6130 files changed, 356183 insertions, 173977 deletions

diff --git a/src/3rdparty/phonon/phonon/volumeslider.cpp b/src/3rdparty/phonon/phonon/volumeslider.cpp
index b59f689..1888cb6 100644
--- a/src/3rdparty/phonon/phonon/volumeslider.cpp
+++ b/src/3rdparty/phonon/phonon/volumeslider.cpp
@@ -85,7 +85,7 @@ VolumeSlider::~VolumeSlider()
 
 bool VolumeSlider::isMuteVisible() const
 {
-    return k_ptr->muteButton.isVisible();
+    return !k_ptr->muteButton.isHidden();
 }
 
 void VolumeSlider::setMuteVisible(bool visible)
diff --git a/src/3rdparty/sha1/sha1.cpp b/src/3rdparty/sha1/sha1.cpp
index d270c60..03c2773 100644
--- a/src/3rdparty/sha1/sha1.cpp
+++ b/src/3rdparty/sha1/sha1.cpp
@@ -1,7 +1,7 @@
 /****************************************************************************
 **
 ** Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies).
-** Contact: Qt Software Information (qt-info@nokia.com)
+** Contact: Nokia Corporation (qt-info@nokia.com)
 **
 ** This file is part of the Qt Toolkit.
 **
@@ -34,7 +34,7 @@
 ** met: http://www.gnu.org/copyleft/gpl.html.
 **
 ** If you are unsure which license is appropriate for your use, please
-** contact the sales department at qt-sales@nokia.com.
+** contact the sales department at http://www.qtsoftware.com/contact.
 ** $QT_END_LICENSE$
 **
 ****************************************************************************/
diff --git a/src/3rdparty/webkit/ChangeLog b/src/3rdparty/webkit/ChangeLog
index 76cfc80..f2cc9a2 100644
--- a/src/3rdparty/webkit/ChangeLog
+++ b/src/3rdparty/webkit/ChangeLog
@@ -1,3 +1,372 @@
+2009-06-20  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        Adding files for the new test case for loading statuses.
+
+        * GNUmakefile.am:
+
+2009-06-15  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Version bump in preparation for 1.1.10 release.
+
+        * configure.ac:
+
+2009-06-12  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Xan Lopez.
+
+        Refactor handling of options in the build-webkit script
+        
+        Options are now defined in one place, and then reused when creating
+        the usage help text, the arguments to GetOptions(), and when passing
+        the options on to the underlying port-dependent build systems.
+        
+        This allows the Qt port to read the defaults for the options from the
+        pro file (dynamically), and to pass the options on to qmake at build.
+
+        * configure.ac:
+
+2009-06-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Fix release build detection
+        https://bugs.webkit.org/show_bug.cgi?id=26267
+
+        * WebKit.pri:
+
+2009-06-10  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Xan Lopez.
+
+        Add unit tests for our WebKitNetworkRequest object.
+
+        * GNUmakefile.am:
+
+2009-06-10  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Version bump in preparation for 1.1.9 release.
+
+        * configure.ac:
+
+2009-06-10  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Add new dependency on the Gail utils library, needed for our a11y
+        implementation.
+
+        * GNUmakefile.am:
+        * configure.ac:
+
+2009-05-29  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        Add a test-case for our HTTP backend, currently checking the
+        ref-counting of the SoupMessage.
+
+        * GNUmakefile.am:
+
+2009-05-28  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Enable the new build flag --filters for Gtk. More details in WebCore/ChangeLog.
+
+        * configure.ac:
+
+2009-05-19  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo and Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Add new test file for ATK.
+
+        * GNUmakefile.am:
+
+2009-05-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Xan Lopez.
+
+        Fix webkitgtk_cleanfiles to clean gtk-doc-related files in the
+        correct directory, so that we pass make distcheck.
+
+        * GNUmakefile.am:
+
+2009-05-28  Xan Lopez  <xlopez@igalia.com>
+
+        Bump version numbers in preparation for 1.1.8 release.
+
+        * configure.ac:
+
+2009-05-23  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Unreviewed build fix. Add gstreamer-video-0.10 libs to
+        GSTREAMER_LIBS to resolve an undefined reference to gst_video_get_size
+        - symbol used in MediaPlayerPrivateGstreamer.
+
+        * configure.ac:
+
+2009-05-23  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Various autotools build refactoring and fixes
+        https://bugs.webkit.org/show_bug.cgi?id=25286
+
+        Refactor library LIBS. Move third-party libs in libwebkit instead
+        of libWebCore.
+
+        * GNUmakefile.am:
+
+2009-05-22  Antonio Gomes  <antonio.gomes@openbossa.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Make Gtk build not bail out if gtk-doc-tools is not installed.
+
+        Warning message shown instead.
+
+        * autogen.sh:
+
+2009-05-22  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Add big warnings about the glib unicode backend being slow and
+        incomplete, since it is a work in progress.
+
+        * autotools/webkit.m4:
+        * configure.ac:
+
+2009-05-22  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15914
+        [GTK] Implement Unicode functionality using GLib
+
+        Initial version of this patch by Jürg Billeter.
+
+        Adding options for --with-unicode-backend=icu|glib
+        and checking for pango version >= 1.21.0 if GLib backend
+        is selected. Temporarily, until remaining parts of
+        this patch are committed, introduce WTF_USE_GLIB_ICU_UNICODE_HYBRID
+        macro to allow for a mixed compilation with WTF Unicode
+        backend based on GLib while text codecs and TextBreakIterator
+        remain ICU dependent.
+
+        * GNUmakefile.am:
+        * configure.ac:
+
+2009-05-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Gavin Barraclough.
+
+        Enable YARR, and disable WREC for GTK+.
+
+        * configure.ac:
+
+2009-05-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+         Reviewed by Xan Lopez.
+
+         [Gtk] Various autotools build refactoring and fixes
+         https://bugs.webkit.org/show_bug.cgi?id=25286
+
+         Add support for running unit tests. Also run the tests whenever
+         the 'check' target runs.
+
+         * GNUmakefile.am:
+
+2009-05-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+         Reviewed by Xan Lopez.
+
+         [Gtk] Various autotools build refactoring and fixes
+         https://bugs.webkit.org/show_bug.cgi?id=25286
+
+         Style fixes
+
+         * GNUmakefile.am:
+
+2009-05-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+         Reviewed by Xan Lopez.
+
+         [Gtk] Various autotools build refactoring and fixes
+         https://bugs.webkit.org/show_bug.cgi?id=25286
+
+         Add -no-install and -no-fast-install to programs and tests that we
+         don't install. Also remove -O2 since this is already handled at
+         configure time.
+
+         * GNUmakefile.am:
+
+2009-05-17  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Various autotools build refactoring and fixes
+        https://bugs.webkit.org/show_bug.cgi?id=25286
+
+        Refactor library cflags
+
+        * GNUmakefile.am:
+
+2009-05-15  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Jan Alonzo.
+
+        Use AC_CANONICAL_HOST instead of AC_CANONICAL_SYSTEM, since
+        the JIT compiler is not a cross-compiler
+
+        * configure.ac:
+
+2009-05-13  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed: bump versions in preparation for 1.1.7 release.
+
+        * configure.ac:
+
+2009-05-13  Xan Lopez  <xlopez@igalia.com>
+
+        Rubber-stamped by Gustavo Noronha.
+
+        Revert commit r43563, since it breaks WebKitGTK+ when compiled
+        with gcc 4.4.
+
+        * GNUmakefile.am:
+
+2009-05-12  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Gtk] Various autotools build refactoring and fixes
+        https://bugs.webkit.org/show_bug.cgi?id=25286
+
+        Refactor use of CFLAGS, CXXFLAGS, LIBADD and LDFLAGS.
+
+        * GNUmakefile.am:
+
+2009-05-09  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        WebKit-r43163 won't build for gtk-directfb
+        https://bugs.webkit.org/show_bug.cgi?id=25538
+
+        Move the ENCHANT check out of the with_target conditional since it
+        applies to all targets
+
+        * configure.ac:
+
+2009-05-09  Mike Hommey  <glandium@debian.org>
+
+        Reviewed by Geoffrey Garen. Landed by Jan Alonzo.
+
+        Enable JIT on x86-64 gtk+
+        https://bugs.webkit.org/show_bug.cgi?id=24724
+
+        * configure.ac:
+
+2009-05-08  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Ship the gtk-doc.make file, so as to not depend on gtkdoc-tools.
+
+        * GNUmakefile.am:
+        * autogen.sh:
+
+2009-05-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Build QtWebKit as a framework on Mac
+
+        This implies both debug and release build by default, unless
+        one of the --debug or --release config options are passed to
+        the build-webkit script.
+
+        Frameworks can be disabled by passing CONFIG+=webkit_no_framework
+        to the build-webkit script.
+
+        To be able to build both debug and release targets in parallel
+        we have to use separate output directories for the generated
+        sources, which is not optimal, but required to avoid race conditions.
+
+        An optimization would be to only require this spit-up on Mac.
+
+        * WebKit.pri:
+
+2009-04-30  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Unreviewed build GTK build fix
+
+        * configure.ac: typo fix - javascript_debugger should be enable_javascript_debugger
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25470
+        Extend the cover of ENABLE_JAVASCRIPT_DEBUGGER to profiler.
+
+        * configure.ac: Add autoconfig options, missed in the first commit.
+
+2009-04-28  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed: bump versions in preparation for 1.1.6 release.
+
+        * configure.ac:
+
+2009-04-25  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Error reporting
+        https://bugs.webkit.org/show_bug.cgi?id=18344
+
+        Add webkiterror to the build.
+
+        * GNUmakefile.am:
+
+2009-04-25  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+         Reviewed by Xan Lopez.
+
+         [GTK] Error reporting
+         https://bugs.webkit.org/show_bug.cgi?id=18344
+
+         Add the default error page for installation.
+
+         * GNUmakefile.am:
+
+2009-04-24  Diego Escalante Urrelo  <diegoe@gnome.org>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15616
+        [GTK] Add spell checking
+
+        Add enchant support for spell-checking-languages property to work
+        properly.
+
+        * GNUmakefile.am:
+        * configure.ac:
+
 2009-04-24  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Reviewed by Ariya Hidayat.
@@ -6,6 +375,375 @@
 
         * WebKit.pro: Include docs.pri for "make docs" target.
 
+2009-04-14  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed version bump in preparation for 1.1.5 release.
+
+        * configure.ac:
+
+2009-04-06  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Sam Weinig.
+
+        Added rules to maintain the localization support. We cannot simply
+        use whatever gettextize gives us because our build system is
+        non-recursive.
+
+        * GNUmakefile.am:
+        * configure.ac:
+
+2009-04-05  Mike Hommey  <glandium@debian.org>
+
+        Reviewed by Holger Freyther.
+
+        Filter out all C++ symbols
+        https://bugs.webkit.org/show_bug.cgi?id=24960
+
+        Considering the public API is all C, we can just filter out all
+        C++ mangled symbols, which will avoid exporting symbols in some
+        corner cases such as gcc bugs on specific architectures, etc.
+
+        * autotools/symbols.filter:
+
+2009-04-03  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        Require GTK+ >= 2.10; 2.8 is already very old, and some very
+        useful APIs are only available since 2.10.
+
+        * configure.ac:
+
+2009-04-01  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Holger Freyther.
+
+        Unit test WebKitDownload
+        http://bugs.webkit.org/show_bug.cgi?id=24844
+
+        * GNUmakefile.am: Add a unit test for downloading.
+
+2009-04-01  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix. Fix make distcheck, after the gtk-doc
+        integration.
+
+        * GNUmakefile.am:
+
+2009-03-30  Gustavo Noronha Silva <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        Integrate gtk-doc into the Gtk+ buildsystem.
+
+        * autogen.sh:
+        * configure.ac:
+
+2009-03-30  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed: bump version to 1.1.4 for release.
+
+        * configure.ac:
+
+2009-03-21  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        Require gnome-keyring 2.26.0, since we were depending on an
+        unreleased trunk revision between 2.25.91 and 2.26.0.
+
+        * configure.ac:
+
+2009-03-20  Jan Michael Alonzo  <jmalonzo@gmail.com>
+
+        Reviewed by Holger Freyther.
+
+        [GTK] Misc patches for WebKitWebHistoryItem
+        https://bugs.webkit.org/show_bug.cgi?id=24493
+
+        Added build support for build the WebKitWebHistoryItem unit test.
+
+        * GNUmakefile.am:
+
+2009-03-20  Jan Michael Alonzo  <jmalonzo@gmail.com>
+
+        Reviewed by Holger Freyther.
+
+        Separate gtk unit tests
+        https://bugs.webkit.org/show_bug.cgi?id=24039
+
+        Build the unit tests accordingly.
+
+        * GNUmakefile.am:
+
+2009-03-17  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Mark Rowe.
+
+        Enable HTML5 media elements support by default in the GTK+ port.
+
+        * configure.ac:
+
+2009-03-17  Mike Hommey <glandium@debian.org>
+
+        Reviewed by Holger Freyther.
+
+        Do not export cti* symbols.
+        See http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=519924.
+
+        * autotools/symbols.filter:
+
+2009-03-15  Xan Lopez  <xlopez@igalia.com>
+
+        Bump version to 1.1.3 for release and fix soversion
+        calculation (oops). Thanks to Frederik Himpe for pointing this
+        out.
+
+        * configure.ac:
+
+2009-03-15  Xan Lopez  <xlopez@igalia.com>
+
+        Bump version and libtool version for release.
+
+        * configure.ac:
+
+2009-03-14  Xan Lopez  <xlopez@igalia.com>
+
+        No review, build fix.
+
+        Split clean rules to make distcheck pass.
+
+        * GNUmakefile.am:
+
+2009-03-13  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Remove rarely used Makefile targets from the Makefile.
+
+        There are many situations in which the targets don't work as expected,
+        and their primary use is addressed by having the build system default
+        to building the appropriate architecture.
+
+        * Makefile.shared:
+
+2009-03-11  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Gtk] Fix make clean targets
+        https://bugs.webkit.org/show_bug.cgi?id=24450
+
+        Fix 'make' clean targets. We shouldn't be removing DerivedSources
+        if it's only clean. Only remove it if it's distclean or
+        maintainer-clean. Also remove build-related auxillary files on
+        dist/maintainer clean.
+
+        * GNUmakefile.am:
+
+2009-03-11  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther
+
+        [GTK]DumpRenderTree doesn't compile for non-X11 GTK ports anymore
+        https://bugs.webkit.org/show_bug.cgi?id=2260
+
+        pangoft2 is also used in directfb builds so use it for all targets
+
+        * configure.ac:
+
+2009-03-02  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24287
+        [GTK] Move auth dialog feature to WebKit/
+
+        Add WebKitSoupAuthDialog files to build.
+
+        * GNUmakefile.am:
+
+2009-03-03  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16826
+        [Gtk] Implement WebKitDownload
+
+        Adding new files related to WebKitDownload to the GTK+ port.
+
+        * GNUmakefile.am:
+
+2009-03-02  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed build fix; adding missing files to EXTRA_DIST, so that
+        they show up in the tarball.
+
+        * GNUmakefile.am:
+
+2009-03-01  Christian Dywan  <christian@twotoasts.de>
+
+        * configure.ac: Bump GTK port version to 1.1.1.
+
+2009-02-27  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed build fix. Adding the WebKit/gtk/webkitmarshal.list
+        file to EXTRA_DIST to fix make dist.
+
+        * GNUmakefile.am:
+
+2009-02-26  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16947
+        [GTK] Missing HTTP Auth challenge
+
+        Add HTTP authentication dialog with optional GNOME Keyring
+        storage.
+
+        * GNUmakefile.am:
+        * configure.ac:
+
+2009-02-26  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16947
+        [GTK] Missing HTTP Auth challenge
+
+        Take marshallers to be built from a manually maintained list
+        instead of grepping the sources.
+
+        It's much faster, especially so now that we want to add
+        marshallers from WebCore too. A system to only take into account
+        the modified files when generating the marshallers from sources
+        could be hacked, but I think it's overkill considering how rarely
+        a new marshaller is added.
+
+        * GNUmakefile.am:
+
+2009-02-24  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        [Gtk] add options for 3D transforms and HTML5 channel messaging to the build
+        https://bugs.webkit.org/show_bug.cgi?id=24072
+
+        Add options for toggling 3D transforms and HTML5 channel messaging
+        support on or off.
+
+        Also fix the web-workers option. It should be web-workers and not workers.
+
+        * configure.ac:
+
+2009-02-23  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22624
+        [SOUP][GTK] Need API to get SoupSession from WebKit.
+
+        Remove CURL support, the only supported HTTP backend is SOUP now.
+
+        * GNUmakefile.am:
+        * configure.ac:
+
+2009-02-19  Christian Dywan  <christian@twotoasts.de>
+
+        Rubber-stamped by Holger Freyther.
+
+        http://bugs.webkit.org/show_bug.cgi?id=22811
+        Underlinking in Programs_UnitTests (GTK+ build)
+
+        * GNUmakefile.am: Add GLIB_LIBS to unit test library flags.
+
+2009-02-18  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Fix symbols.filter location, and add other missing files to the
+        autotools build, so that make dist works.
+
+        * GNUmakefile.am:
+
+2009-02-17  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23939
+        Release build being built with debugging symbols
+
+        * configure.ac: Revert change done in revision 40790, since we
+        already have a AC_PROG_CXX macro call as part of WEBKIT_INIT
+
+2009-02-12  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Eric Seidel.
+
+        * configure.ac: Make soup the default HTTP backend for the Gtk port.
+
+2009-02-09  Calvin Walton  <calvin.walton@gmail.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23823
+
+        [Gtk] Fix build with recent autotools
+
+        Current versions of automake/libtool don't assume you want C++ enabled
+        by default any more, so explicitly check for a C++ compiler.
+
+        * configure.ac: Add AC_PROG_CXX macro
+
+2009-02-02  Christian Dywan  <christian@twotoasts.de>
+
+        Rubber-stamped by Holger Freyther.
+
+        Don't require Geolocation by default.
+
+        * configure.ac:
+
+2009-01-30  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        [Gtk] Refactor autoconf/configure.ac in preparation for jsc and webkit build splits
+        https://bugs.webkit.org/show_bug.cgi?id=22136
+
+        * GNUmakefile.am:
+        * acinclude.m4: Removed.
+        * autogen.sh:
+        * autotools/acinclude.m4: Added.
+        * autotools/dolt.m4: Added.
+        * autotools/symbols.filter: Renamed from symbols.filter.
+        * autotools/webkit.m4: Added.
+        * configure.ac:
+
+2009-01-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        [GTK] Implement GeolocationService using the Geoclue library
+
+        https://bugs.webkit.org/show_bug.cgi?id=22022
+
+        Untested implementation of the GeolocationService using the geoclue
+        library. Velocity handling is completely missing and the accuracy
+        handling might be wrong.
+
+        * GNUmakefile.am:
+        * configure.ac:
+
+2009-01-11  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Bump version to 1.1.0 since we are breaking ABI and adding new
+        major features.
+
+        * configure.ac:
+
 2008-12-19  Marco Barisione  <marco.barisione@collabora.co.uk>
 
         Reviewed by Holger Freyther.
@@ -203,7 +941,7 @@
 2008-11-16  Geoffrey Garen  <ggaren@apple.com>
 
         Not reviewed.
-        
+
         Try to fix gtk build.
 
         * configure.ac:
@@ -801,7 +1539,7 @@
         Reviewed by Mark.
 
         Add x86_64 rule.
-        
+
         * Makefile:
 
 2008-05-09  Simon Hausmann  <hausmann@webkit.org>
@@ -809,11 +1547,11 @@
         Reviewed by Holger.
 
         Removed explicit linkage against libxml and libxslt on Qt/Mac builds.
-        
+
         This dependency is completely unnecessary here and creates only problems by
         propagating through WebCore.pro over libQtWebKit.prl right now customer
         applications.
-        
+
 
         * WebKit.pri:
 
@@ -822,7 +1560,7 @@
         Reviewed by Mark.
 
         Add an "x86_64" make rule.
-        
+
         * Makefile.shared:
 
 2008-05-02  Jan Michael Alonzo  <jmalonzo@unpluggable.com>
@@ -973,7 +1711,7 @@
         http://bugs.webkit.org/show_bug.cgi?id=16476
 
         Add support for multiple http backends, and add soup backend (off by default).
-        
+
         * GNUmakefile.am:
         * configure.ac:
 
@@ -1060,7 +1798,7 @@
         Add separator '\' after libJavaScriptCore_la_LIBADD and cleanup
         whitespaces introduced in the previous commit.
 
-        * GNUmakefile.am: 
+        * GNUmakefile.am:
 
 2008-02-23  Jan Michael Alonzo  <jmalonzo@unpluggable.com>
 
@@ -2452,7 +3190,7 @@
         Reviewed by Lars.
 
         Don't compile the ICO plugin when building against Qt >= 4.4
-        
+
 
         * WebKit.pro:
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/APICast.h b/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
index d356bca..762a15e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/APICast.h
@@ -26,7 +26,10 @@
 #ifndef APICast_h
 #define APICast_h
 
+#include "JSNumberCell.h"
 #include "JSValue.h"
+#include <wtf/Platform.h>
+#include <wtf/UnusedParam.h>
 
 namespace JSC {
     class ExecState;
@@ -34,7 +37,6 @@ namespace JSC {
     class JSGlobalData;
     class JSObject;
     class JSValue;
-    class JSValuePtr;
 }
 
 typedef const struct OpaqueJSContextGroup* JSContextGroupRef;
@@ -56,9 +58,18 @@ inline JSC::ExecState* toJS(JSGlobalContextRef c)
     return reinterpret_cast<JSC::ExecState*>(c);
 }
 
-inline JSC::JSValuePtr toJS(JSValueRef v)
+inline JSC::JSValue toJS(JSC::ExecState* exec, JSValueRef v)
 {
-    return JSC::JSValuePtr::decode(reinterpret_cast<JSC::JSValueEncodedAsPointer*>(const_cast<OpaqueJSValue*>(v)));
+    JSC::JSValue jsValue = JSC::JSValue::decode(reinterpret_cast<JSC::EncodedJSValue>(const_cast<OpaqueJSValue*>(v)));
+#if USE(ALTERNATE_JSIMMEDIATE)
+    UNUSED_PARAM(exec);
+#else
+    if (jsValue && jsValue.isNumber()) {
+        ASSERT(jsValue.isAPIMangledNumber());
+        return JSC::jsNumber(exec, jsValue.uncheckedGetNumber());
+    }
+#endif
+    return jsValue;
 }
 
 inline JSC::JSObject* toJS(JSObjectRef o)
@@ -76,14 +87,17 @@ inline JSC::JSGlobalData* toJS(JSContextGroupRef g)
     return reinterpret_cast<JSC::JSGlobalData*>(const_cast<OpaqueJSContextGroup*>(g));
 }
 
-inline JSValueRef toRef(JSC::JSValuePtr v)
+inline JSValueRef toRef(JSC::ExecState* exec, JSC::JSValue v)
 {
-    return reinterpret_cast<JSValueRef>(JSC::JSValuePtr::encode(v));
-}
-
-inline JSValueRef* toRef(JSC::JSValuePtr* v)
-{
-    return reinterpret_cast<JSValueRef*>(v);
+#if USE(ALTERNATE_JSIMMEDIATE)
+    UNUSED_PARAM(exec);
+#else
+    if (v && v.isNumber()) {
+        ASSERT(!v.isAPIMangledNumber());
+        return reinterpret_cast<JSValueRef>(JSC::JSValue::encode(JSC::jsAPIMangledNumber(exec, v.uncheckedGetNumber())));
+    }
+#endif
+    return reinterpret_cast<JSValueRef>(JSC::JSValue::encode(v));
 }
 
 inline JSObjectRef toRef(JSC::JSObject* o)
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSBase.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSBase.cpp
index 2ffe345..fc3d0fe 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSBase.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSBase.cpp
@@ -55,15 +55,15 @@ JSValueRef JSEvaluateScript(JSContextRef ctx, JSStringRef script, JSObjectRef th
 
     if (completion.complType() == Throw) {
         if (exception)
-            *exception = toRef(completion.value());
+            *exception = toRef(exec, completion.value());
         return 0;
     }
-    
+
     if (completion.value())
-        return toRef(completion.value());
+        return toRef(exec, completion.value());
     
     // happens, for example, when the only statement is an empty (';') statement
-    return toRef(jsUndefined());
+    return toRef(exec, jsUndefined());
 }
 
 bool JSCheckScriptSyntax(JSContextRef ctx, JSStringRef script, JSStringRef sourceURL, int startingLineNumber, JSValueRef* exception)
@@ -76,7 +76,7 @@ bool JSCheckScriptSyntax(JSContextRef ctx, JSStringRef script, JSStringRef sourc
     Completion completion = checkSyntax(exec->dynamicGlobalObject()->globalExec(), source);
     if (completion.complType() == Throw) {
         if (exception)
-            *exception = toRef(completion.value());
+            *exception = toRef(exec, completion.value());
         return false;
     }
     
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h b/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h
index f44d4ad..9f3d88e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSBase.h
@@ -65,14 +65,28 @@ typedef struct OpaqueJSValue* JSObjectRef;
 /* JavaScript symbol exports */
 
 #undef JS_EXPORT
-#if defined(__GNUC__)
+#if defined(BUILDING_WX__)
+    #define JS_EXPORT
+#elif defined(__GNUC__)
     #define JS_EXPORT __attribute__((visibility("default")))
+#elif defined(_WIN32_WCE)
+    #if defined(JS_BUILDING_JS)
+        #define JS_EXPORT __declspec(dllexport)
+    #elif defined(JS_IMPORT_JS)
+        #define JS_EXPORT __declspec(dllimport)
+    #else
+        #define JS_EXPORT
+    #endif
 #elif defined(WIN32) || defined(_WIN32)
     /*
      * TODO: Export symbols with JS_EXPORT when using MSVC.
      * See http://bugs.webkit.org/show_bug.cgi?id=16227
      */
-    #define JS_EXPORT
+    #if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
+    #define JS_EXPORT __declspec(dllexport)
+    #else
+    #define JS_EXPORT __declspec(dllimport)
+    #endif
 #else
     #define JS_EXPORT
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSBasePrivate.h b/src/3rdparty/webkit/JavaScriptCore/API/JSBasePrivate.h
index 6beacda..befa316 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSBasePrivate.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSBasePrivate.h
@@ -43,7 +43,7 @@ owns a large non-GC memory region. Calling this function will encourage the
 garbage collector to collect soon, hoping to reclaim that large non-GC memory
 region.
 */
-JS_EXPORT void JSReportExtraMemoryCost(JSContextRef ctx, size_t size) AVAILABLE_AFTER_WEBKIT_VERSION_3_1;
+JS_EXPORT void JSReportExtraMemoryCost(JSContextRef ctx, size_t size) AVAILABLE_IN_WEBKIT_VERSION_4_0;
 
 #ifdef __cplusplus
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.cpp
index e10733e..64c83cb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.cpp
@@ -61,10 +61,17 @@ static JSObject* constructJSCallback(ExecState* exec, JSObject* constructor, con
         int argumentCount = static_cast<int>(args.size());
         Vector<JSValueRef, 16> arguments(argumentCount);
         for (int i = 0; i < argumentCount; i++)
-            arguments[i] = toRef(args.at(exec, i));
-            
-        JSLock::DropAllLocks dropAllLocks(exec);
-        return toJS(callback(ctx, constructorRef, argumentCount, arguments.data(), toRef(exec->exceptionSlot())));
+            arguments[i] = toRef(exec, args.at(i));
+
+        JSValueRef exception = 0;
+        JSObjectRef result;
+        {
+            JSLock::DropAllLocks dropAllLocks(exec);
+            result = callback(ctx, constructorRef, argumentCount, arguments.data(), &exception);
+        }
+        if (exception)
+            exec->setException(toJS(exec, exception));
+        return toJS(result);
     }
     
     return toJS(JSObjectMake(ctx, static_cast<JSCallbackConstructor*>(constructor)->classRef(), 0));
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
index cb8307f..1f06249 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackConstructor.h
@@ -39,7 +39,7 @@ public:
     JSObjectCallAsConstructorCallback callback() const { return m_callback; }
     static const ClassInfo info;
     
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot)); 
     }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp
index b82932e..1b3217b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.cpp
@@ -46,19 +46,27 @@ JSCallbackFunction::JSCallbackFunction(ExecState* exec, JSObjectCallAsFunctionCa
 {
 }
 
-JSValuePtr JSCallbackFunction::call(ExecState* exec, JSObject* functionObject, JSValuePtr thisValue, const ArgList& args)
+JSValue JSCallbackFunction::call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args)
 {
     JSContextRef execRef = toRef(exec);
     JSObjectRef functionRef = toRef(functionObject);
-    JSObjectRef thisObjRef = toRef(thisValue->toThisObject(exec));
+    JSObjectRef thisObjRef = toRef(thisValue.toThisObject(exec));
 
     int argumentCount = static_cast<int>(args.size());
     Vector<JSValueRef, 16> arguments(argumentCount);
     for (int i = 0; i < argumentCount; i++)
-        arguments[i] = toRef(args.at(exec, i));
+        arguments[i] = toRef(exec, args.at(i));
 
-    JSLock::DropAllLocks dropAllLocks(exec);
-    return toJS(static_cast<JSCallbackFunction*>(functionObject)->m_callback(execRef, functionRef, thisObjRef, argumentCount, arguments.data(), toRef(exec->exceptionSlot())));
+    JSValueRef exception = 0;
+    JSValueRef result;
+    {
+        JSLock::DropAllLocks dropAllLocks(exec);
+        result = static_cast<JSCallbackFunction*>(functionObject)->m_callback(execRef, functionRef, thisObjRef, argumentCount, arguments.data(), &exception);
+    }
+    if (exception)
+        exec->setException(toJS(exec, exception));
+
+    return toJS(exec, result);
 }
 
 CallType JSCallbackFunction::getCallData(CallData& callData)
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
index 46f6fcc..7dd87b5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackFunction.h
@@ -39,7 +39,7 @@ public:
     
     // InternalFunction mish-mashes constructor and function behavior -- we should 
     // refactor the code so this override isn't necessary
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot)); 
     }
@@ -48,7 +48,7 @@ private:
     virtual CallType getCallData(CallData&);
     virtual const ClassInfo* classInfo() const { return &info; }
 
-    static JSValuePtr call(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+    static JSValue JSC_HOST_CALL call(ExecState*, JSObject*, JSValue, const ArgList&);
 
     JSObjectCallAsFunctionCallback m_callback;
 };
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
index 9001c43..9d22ad9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObject.h
@@ -48,7 +48,7 @@ public:
     JSClassRef classRef() const { return m_callbackObjectData->jsClass; }
     bool inherits(JSClassRef) const;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | OverridesHasInstance)); 
     }
@@ -59,12 +59,12 @@ private:
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual bool getOwnPropertySlot(ExecState*, unsigned, PropertySlot&);
     
-    virtual void put(ExecState*, const Identifier&, JSValuePtr, PutPropertySlot&);
+    virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
 
     virtual bool deleteProperty(ExecState*, const Identifier&);
     virtual bool deleteProperty(ExecState*, unsigned);
 
-    virtual bool hasInstance(ExecState* exec, JSValuePtr value, JSValuePtr proto);
+    virtual bool hasInstance(ExecState* exec, JSValue value, JSValue proto);
 
     virtual void getPropertyNames(ExecState*, PropertyNameArray&);
 
@@ -77,14 +77,14 @@ private:
 
     void init(ExecState*);
  
-    static JSCallbackObject* asCallbackObject(JSValuePtr);
+    static JSCallbackObject* asCallbackObject(JSValue);
  
-    static JSValuePtr call(ExecState*, JSObject* functionObject, JSValuePtr thisValue, const ArgList&);
+    static JSValue JSC_HOST_CALL call(ExecState*, JSObject* functionObject, JSValue thisValue, const ArgList&);
     static JSObject* construct(ExecState*, JSObject* constructor, const ArgList&);
    
-    static JSValuePtr staticValueGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValuePtr staticFunctionGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValuePtr callbackGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue staticValueGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue staticFunctionGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue callbackGetter(ExecState*, const Identifier&, const PropertySlot&);
 
     struct JSCallbackObjectData {
         JSCallbackObjectData(void* privateData, JSClassRef jsClass)
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h
index fdbafbc..987c59f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSCallbackObjectFunctions.h
@@ -40,7 +40,7 @@
 namespace JSC {
 
 template <class Base>
-inline JSCallbackObject<Base>* JSCallbackObject<Base>::asCallbackObject(JSValuePtr value)
+inline JSCallbackObject<Base>* JSCallbackObject<Base>::asCallbackObject(JSValue value)
 {
     ASSERT(asObject(value)->inherits(&info));
     return static_cast<JSCallbackObject*>(asObject(value));
@@ -99,7 +99,7 @@ template <class Base>
 UString JSCallbackObject<Base>::className() const
 {
     UString thisClassName = classRef()->className();
-    if (!thisClassName.isNull())
+    if (!thisClassName.isEmpty())
         return thisClassName;
     
     return Base::className();
@@ -125,9 +125,19 @@ bool JSCallbackObject<Base>::getOwnPropertySlot(ExecState* exec, const Identifie
         } else if (JSObjectGetPropertyCallback getProperty = jsClass->getProperty) {
             if (!propertyNameRef)
                 propertyNameRef = OpaqueJSString::create(propertyName.ustring());
-            JSLock::DropAllLocks dropAllLocks(exec);
-            if (JSValueRef value = getProperty(ctx, thisRef, propertyNameRef.get(), toRef(exec->exceptionSlot()))) {
-                slot.setValue(toJS(value));
+            JSValueRef exception = 0;
+            JSValueRef value;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                value = getProperty(ctx, thisRef, propertyNameRef.get(), &exception);
+            }
+            exec->setException(toJS(exec, exception));
+            if (value) {
+                slot.setValue(toJS(exec, value));
+                return true;
+            }
+            if (exception) {
+                slot.setValue(jsUndefined());
                 return true;
             }
         }
@@ -157,19 +167,25 @@ bool JSCallbackObject<Base>::getOwnPropertySlot(ExecState* exec, unsigned proper
 }
 
 template <class Base>
-void JSCallbackObject<Base>::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSCallbackObject<Base>::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     JSContextRef ctx = toRef(exec);
     JSObjectRef thisRef = toRef(this);
     RefPtr<OpaqueJSString> propertyNameRef;
-    JSValueRef valueRef = toRef(value);
+    JSValueRef valueRef = toRef(exec, value);
     
     for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass) {
         if (JSObjectSetPropertyCallback setProperty = jsClass->setProperty) {
             if (!propertyNameRef)
                 propertyNameRef = OpaqueJSString::create(propertyName.ustring());
-            JSLock::DropAllLocks dropAllLocks(exec);
-            if (setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, toRef(exec->exceptionSlot())))
+            JSValueRef exception = 0;
+            bool result;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                result = setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, &exception);
+            }
+            exec->setException(toJS(exec, exception));
+            if (result || exception)
                 return;
         }
         
@@ -180,8 +196,14 @@ void JSCallbackObject<Base>::put(ExecState* exec, const Identifier& propertyName
                 if (JSObjectSetPropertyCallback setProperty = entry->setProperty) {
                     if (!propertyNameRef)
                         propertyNameRef = OpaqueJSString::create(propertyName.ustring());
-                    JSLock::DropAllLocks dropAllLocks(exec);
-                    if (setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, toRef(exec->exceptionSlot())))
+                    JSValueRef exception = 0;
+                    bool result;
+                    {
+                        JSLock::DropAllLocks dropAllLocks(exec);
+                        result = setProperty(ctx, thisRef, propertyNameRef.get(), valueRef, &exception);
+                    }
+                    exec->setException(toJS(exec, exception));
+                    if (result || exception)
                         return;
                 } else
                     throwError(exec, ReferenceError, "Attempt to set a property that is not settable.");
@@ -212,8 +234,14 @@ bool JSCallbackObject<Base>::deleteProperty(ExecState* exec, const Identifier& p
         if (JSObjectDeletePropertyCallback deleteProperty = jsClass->deleteProperty) {
             if (!propertyNameRef)
                 propertyNameRef = OpaqueJSString::create(propertyName.ustring());
-            JSLock::DropAllLocks dropAllLocks(exec);
-            if (deleteProperty(ctx, thisRef, propertyNameRef.get(), toRef(exec->exceptionSlot())))
+            JSValueRef exception = 0;
+            bool result;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                result = deleteProperty(ctx, thisRef, propertyNameRef.get(), &exception);
+            }
+            exec->setException(toJS(exec, exception));
+            if (result || exception)
                 return true;
         }
         
@@ -266,9 +294,15 @@ JSObject* JSCallbackObject<Base>::construct(ExecState* exec, JSObject* construct
             int argumentCount = static_cast<int>(args.size());
             Vector<JSValueRef, 16> arguments(argumentCount);
             for (int i = 0; i < argumentCount; i++)
-                arguments[i] = toRef(args.at(exec, i));
-            JSLock::DropAllLocks dropAllLocks(exec);
-            return toJS(callAsConstructor(execRef, constructorRef, argumentCount, arguments.data(), toRef(exec->exceptionSlot())));
+                arguments[i] = toRef(exec, args.at(i));
+            JSValueRef exception = 0;
+            JSObject* result;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                result = toJS(callAsConstructor(execRef, constructorRef, argumentCount, arguments.data(), &exception));
+            }
+            exec->setException(toJS(exec, exception));
+            return result;
         }
     }
     
@@ -277,15 +311,21 @@ JSObject* JSCallbackObject<Base>::construct(ExecState* exec, JSObject* construct
 }
 
 template <class Base>
-bool JSCallbackObject<Base>::hasInstance(ExecState* exec, JSValuePtr value, JSValuePtr)
+bool JSCallbackObject<Base>::hasInstance(ExecState* exec, JSValue value, JSValue)
 {
     JSContextRef execRef = toRef(exec);
     JSObjectRef thisRef = toRef(this);
     
     for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass) {
         if (JSObjectHasInstanceCallback hasInstance = jsClass->hasInstance) {
-            JSLock::DropAllLocks dropAllLocks(exec);
-            return hasInstance(execRef, thisRef, toRef(value), toRef(exec->exceptionSlot()));
+            JSValueRef exception = 0;
+            bool result;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                result = hasInstance(execRef, thisRef, toRef(exec, value), &exception);
+            }
+            exec->setException(toJS(exec, exception));
+            return result;
         }
     }
     return false;
@@ -304,25 +344,31 @@ CallType JSCallbackObject<Base>::getCallData(CallData& callData)
 }
 
 template <class Base>
-JSValuePtr JSCallbackObject<Base>::call(ExecState* exec, JSObject* functionObject, JSValuePtr thisValue, const ArgList& args)
+JSValue JSCallbackObject<Base>::call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args)
 {
     JSContextRef execRef = toRef(exec);
     JSObjectRef functionRef = toRef(functionObject);
-    JSObjectRef thisObjRef = toRef(thisValue->toThisObject(exec));
+    JSObjectRef thisObjRef = toRef(thisValue.toThisObject(exec));
     
     for (JSClassRef jsClass = static_cast<JSCallbackObject<Base>*>(functionObject)->classRef(); jsClass; jsClass = jsClass->parentClass) {
         if (JSObjectCallAsFunctionCallback callAsFunction = jsClass->callAsFunction) {
             int argumentCount = static_cast<int>(args.size());
             Vector<JSValueRef, 16> arguments(argumentCount);
             for (int i = 0; i < argumentCount; i++)
-                arguments[i] = toRef(args.at(exec, i));
-            JSLock::DropAllLocks dropAllLocks(exec);
-            return toJS(callAsFunction(execRef, functionRef, thisObjRef, argumentCount, arguments.data(), toRef(exec->exceptionSlot())));
+                arguments[i] = toRef(exec, args.at(i));
+            JSValueRef exception = 0;
+            JSValue result;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                result = toJS(exec, callAsFunction(execRef, functionRef, thisObjRef, argumentCount, arguments.data(), &exception));
+            }
+            exec->setException(toJS(exec, exception));
+            return result;
         }
     }
     
     ASSERT_NOT_REACHED(); // getCallData should prevent us from reaching here
-    return noValue();
+    return JSValue();
 }
 
 template <class Base>
@@ -376,9 +422,17 @@ double JSCallbackObject<Base>::toNumber(ExecState* exec) const
     
     for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass)
         if (JSObjectConvertToTypeCallback convertToType = jsClass->convertToType) {
-            JSLock::DropAllLocks dropAllLocks(exec);
-            if (JSValueRef value = convertToType(ctx, thisRef, kJSTypeNumber, toRef(exec->exceptionSlot())))
-                return toJS(value)->getNumber();
+            JSValueRef exception = 0;
+            JSValueRef value;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                value = convertToType(ctx, thisRef, kJSTypeNumber, &exception);
+            }
+            exec->setException(toJS(exec, exception));
+            if (value) {
+                double dValue;
+                return toJS(exec, value).getNumber(dValue) ? dValue : NaN;
+            }
         }
             
     return Base::toNumber(exec);
@@ -392,13 +446,17 @@ UString JSCallbackObject<Base>::toString(ExecState* exec) const
     
     for (JSClassRef jsClass = classRef(); jsClass; jsClass = jsClass->parentClass)
         if (JSObjectConvertToTypeCallback convertToType = jsClass->convertToType) {
+            JSValueRef exception = 0;
             JSValueRef value;
             {
                 JSLock::DropAllLocks dropAllLocks(exec);
-                value = convertToType(ctx, thisRef, kJSTypeString, toRef(exec->exceptionSlot()));
+                value = convertToType(ctx, thisRef, kJSTypeString, &exception);
             }
+            exec->setException(toJS(exec, exception));
             if (value)
-                return toJS(value)->getString();
+                return toJS(exec, value).getString();
+            if (exception)
+                return "";
         }
             
     return Base::toString(exec);
@@ -427,7 +485,7 @@ bool JSCallbackObject<Base>::inherits(JSClassRef c) const
 }
 
 template <class Base>
-JSValuePtr JSCallbackObject<Base>::staticValueGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCallbackObject<Base>::staticValueGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSCallbackObject* thisObj = asCallbackObject(slot.slotBase());
     
@@ -440,16 +498,24 @@ JSValuePtr JSCallbackObject<Base>::staticValueGetter(ExecState* exec, const Iden
                 if (JSObjectGetPropertyCallback getProperty = entry->getProperty) {
                     if (!propertyNameRef)
                         propertyNameRef = OpaqueJSString::create(propertyName.ustring());
-                    JSLock::DropAllLocks dropAllLocks(exec);
-                    if (JSValueRef value = getProperty(toRef(exec), thisRef, propertyNameRef.get(), toRef(exec->exceptionSlot())))
-                        return toJS(value);
+                    JSValueRef exception = 0;
+                    JSValueRef value;
+                    {
+                        JSLock::DropAllLocks dropAllLocks(exec);
+                        value = getProperty(toRef(exec), thisRef, propertyNameRef.get(), &exception);
+                    }
+                    exec->setException(toJS(exec, exception));
+                    if (value)
+                        return toJS(exec, value);
+                    if (exception)
+                        return jsUndefined();
                 }
                     
     return throwError(exec, ReferenceError, "Static value property defined with NULL getProperty callback.");
 }
 
 template <class Base>
-JSValuePtr JSCallbackObject<Base>::staticFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCallbackObject<Base>::staticFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSCallbackObject* thisObj = asCallbackObject(slot.slotBase());
     
@@ -474,7 +540,7 @@ JSValuePtr JSCallbackObject<Base>::staticFunctionGetter(ExecState* exec, const I
 }
 
 template <class Base>
-JSValuePtr JSCallbackObject<Base>::callbackGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCallbackObject<Base>::callbackGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSCallbackObject* thisObj = asCallbackObject(slot.slotBase());
     
@@ -485,9 +551,17 @@ JSValuePtr JSCallbackObject<Base>::callbackGetter(ExecState* exec, const Identif
         if (JSObjectGetPropertyCallback getProperty = jsClass->getProperty) {
             if (!propertyNameRef)
                 propertyNameRef = OpaqueJSString::create(propertyName.ustring());
-            JSLock::DropAllLocks dropAllLocks(exec);
-            if (JSValueRef value = getProperty(toRef(exec), thisRef, propertyNameRef.get(), toRef(exec->exceptionSlot())))
-                return toJS(value);
+            JSValueRef exception = 0;
+            JSValueRef value;
+            {
+                JSLock::DropAllLocks dropAllLocks(exec);
+                value = getProperty(toRef(exec), thisRef, propertyNameRef.get(), &exception);
+            }
+            exec->setException(toJS(exec, exception));
+            if (value)
+                return toJS(exec, value);
+            if (exception)
+                return jsUndefined();
         }
             
     return throwError(exec, ReferenceError, "hasProperty callback returned true for a property that doesn't exist.");
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.cpp
index 77a33f0..afde7ce 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSClassRef.cpp
@@ -111,7 +111,7 @@ PassRefPtr<OpaqueJSClass> OpaqueJSClass::createNoAutomaticPrototype(const JSClas
     return adoptRef(new OpaqueJSClass(definition, 0));
 }
 
-void clearReferenceToPrototype(JSObjectRef prototype)
+static void clearReferenceToPrototype(JSObjectRef prototype)
 {
     OpaqueJSClassContextData* jsClassData = static_cast<OpaqueJSClassContextData*>(JSObjectGetPrivate(prototype));
     ASSERT(jsClassData);
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp
index 40c45d3..a3bdc69 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.cpp
@@ -44,6 +44,7 @@ using namespace JSC;
 
 JSContextGroupRef JSContextGroupCreate()
 {
+    initializeThreading();
     return toRef(JSGlobalData::create().releaseRef());
 }
 
@@ -60,6 +61,7 @@ void JSContextGroupRelease(JSContextGroupRef group)
 
 JSGlobalContextRef JSGlobalContextCreate(JSClassRef globalObjectClass)
 {
+    initializeThreading();
 #if PLATFORM(DARWIN)
     // When running on Tiger or Leopard, or if the application was linked before JSGlobalContextCreate was changed
     // to use a unique JSGlobalData, we use a shared one for compatibility.
@@ -95,7 +97,7 @@ JSGlobalContextRef JSGlobalContextCreateInGroup(JSContextGroupRef group, JSClass
 
     JSGlobalObject* globalObject = new (globalData.get()) JSCallbackObject<JSGlobalObject>(globalObjectClass);
     ExecState* exec = globalObject->globalExec();
-    JSValuePtr prototype = globalObjectClass->prototype(exec);
+    JSValue prototype = globalObjectClass->prototype(exec);
     if (!prototype)
         prototype = jsNull();
     globalObject->resetPrototype(prototype);
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.h b/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.h
index bc89511..c5c8a71 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSContextRef.h
@@ -48,7 +48,7 @@ extern "C" {
  synchronization is required.
 @result The created JSContextGroup.
 */
-JS_EXPORT JSContextGroupRef JSContextGroupCreate() AVAILABLE_AFTER_WEBKIT_VERSION_3_1;
+JS_EXPORT JSContextGroupRef JSContextGroupCreate() AVAILABLE_IN_WEBKIT_VERSION_4_0;
 
 /*!
 @function
@@ -56,14 +56,14 @@ JS_EXPORT JSContextGroupRef JSContextGroupCreate() AVAILABLE_AFTER_WEBKIT_VERSIO
 @param group The JSContextGroup to retain.
 @result A JSContextGroup that is the same as group.
 */
-JS_EXPORT JSContextGroupRef JSContextGroupRetain(JSContextGroupRef group) AVAILABLE_AFTER_WEBKIT_VERSION_3_1;
+JS_EXPORT JSContextGroupRef JSContextGroupRetain(JSContextGroupRef group) AVAILABLE_IN_WEBKIT_VERSION_4_0;
 
 /*!
 @function
 @abstract Releases a JavaScript context group.
 @param group The JSContextGroup to release.
 */
-JS_EXPORT void JSContextGroupRelease(JSContextGroupRef group) AVAILABLE_AFTER_WEBKIT_VERSION_3_1;
+JS_EXPORT void JSContextGroupRelease(JSContextGroupRef group) AVAILABLE_IN_WEBKIT_VERSION_4_0;
 
 /*!
 @function
@@ -92,7 +92,7 @@ JS_EXPORT JSGlobalContextRef JSGlobalContextCreate(JSClassRef globalObjectClass)
 @result A JSGlobalContext with a global object of class globalObjectClass and a context
  group equal to group.
 */
-JS_EXPORT JSGlobalContextRef JSGlobalContextCreateInGroup(JSContextGroupRef group, JSClassRef globalObjectClass) AVAILABLE_AFTER_WEBKIT_VERSION_3_1;
+JS_EXPORT JSGlobalContextRef JSGlobalContextCreateInGroup(JSContextGroupRef group, JSClassRef globalObjectClass) AVAILABLE_IN_WEBKIT_VERSION_4_0;
 
 /*!
 @function
@@ -123,7 +123,7 @@ JS_EXPORT JSObjectRef JSContextGetGlobalObject(JSContextRef ctx);
 @param ctx The JSContext whose group you want to get.
 @result ctx's group.
 */
-JS_EXPORT JSContextGroupRef JSContextGetGroup(JSContextRef ctx) AVAILABLE_AFTER_WEBKIT_VERSION_3_1;
+JS_EXPORT JSContextGroupRef JSContextGetGroup(JSContextRef ctx) AVAILABLE_IN_WEBKIT_VERSION_4_0;
 
 #ifdef __cplusplus
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp
index c08b8b0..50ee635 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.cpp
@@ -32,6 +32,7 @@
 #include "ErrorConstructor.h"
 #include "FunctionConstructor.h"
 #include "Identifier.h"
+#include "InitializeThreading.h"
 #include "JSArray.h"
 #include "JSCallbackConstructor.h"
 #include "JSCallbackFunction.h"
@@ -52,6 +53,7 @@ using namespace JSC;
 
 JSClassRef JSClassCreate(const JSClassDefinition* definition)
 {
+    initializeThreading();
     RefPtr<OpaqueJSClass> jsClass = (definition->attributes & kJSClassAttributeNoAutomaticPrototype)
         ? OpaqueJSClass::createNoAutomaticPrototype(definition)
         : OpaqueJSClass::create(definition);
@@ -103,10 +105,10 @@ JSObjectRef JSObjectMakeConstructor(JSContextRef ctx, JSClassRef jsClass, JSObje
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsPrototype = jsClass 
-        ? jsClass->prototype(exec)
-        : exec->lexicalGlobalObject()->objectPrototype();
-    
+    JSValue jsPrototype = jsClass ? jsClass->prototype(exec) : 0;
+    if (!jsPrototype)
+        jsPrototype = exec->lexicalGlobalObject()->objectPrototype();
+
     JSCallbackConstructor* constructor = new (exec) JSCallbackConstructor(exec->lexicalGlobalObject()->callbackConstructorStructure(), jsClass, callAsConstructor);
     constructor->putDirect(exec->propertyNames().prototype, jsPrototype, DontEnum | DontDelete | ReadOnly);
     return toRef(constructor);
@@ -120,7 +122,7 @@ JSObjectRef JSObjectMakeFunction(JSContextRef ctx, JSStringRef name, unsigned pa
 
     Identifier nameID = name ? name->identifier(&exec->globalData()) : Identifier(exec, "anonymous");
     
-    ArgList args;
+    MarkedArgumentBuffer args;
     for (unsigned i = 0; i < parameterCount; i++)
         args.append(jsString(exec, parameterNames[i]->ustring()));
     args.append(jsString(exec, body->ustring()));
@@ -128,7 +130,7 @@ JSObjectRef JSObjectMakeFunction(JSContextRef ctx, JSStringRef name, unsigned pa
     JSObject* result = constructFunction(exec, args, nameID, sourceURL->ustring(), startingLineNumber);
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         result = 0;
     }
@@ -143,9 +145,9 @@ JSObjectRef JSObjectMakeArray(JSContextRef ctx, size_t argumentCount, const JSVa
 
     JSObject* result;
     if (argumentCount) {
-        ArgList argList;
+        MarkedArgumentBuffer argList;
         for (size_t i = 0; i < argumentCount; ++i)
-            argList.append(toJS(arguments[i]));
+            argList.append(toJS(exec, arguments[i]));
 
         result = constructArray(exec, argList);
     } else
@@ -153,7 +155,7 @@ JSObjectRef JSObjectMakeArray(JSContextRef ctx, size_t argumentCount, const JSVa
 
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         result = 0;
     }
@@ -167,14 +169,14 @@ JSObjectRef JSObjectMakeDate(JSContextRef ctx, size_t argumentCount, const JSVal
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    ArgList argList;
+    MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; ++i)
-        argList.append(toJS(arguments[i]));
+        argList.append(toJS(exec, arguments[i]));
 
     JSObject* result = constructDate(exec, argList);
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         result = 0;
     }
@@ -188,14 +190,14 @@ JSObjectRef JSObjectMakeError(JSContextRef ctx, size_t argumentCount, const JSVa
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    ArgList argList;
+    MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; ++i)
-        argList.append(toJS(arguments[i]));
+        argList.append(toJS(exec, arguments[i]));
 
     JSObject* result = constructError(exec, argList);
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         result = 0;
     }
@@ -209,14 +211,14 @@ JSObjectRef JSObjectMakeRegExp(JSContextRef ctx, size_t argumentCount, const JSV
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    ArgList argList;
+    MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; ++i)
-        argList.append(toJS(arguments[i]));
+        argList.append(toJS(exec, arguments[i]));
 
     JSObject* result = constructRegExp(exec, argList);
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         result = 0;
     }
@@ -224,18 +226,26 @@ JSObjectRef JSObjectMakeRegExp(JSContextRef ctx, size_t argumentCount, const JSV
     return toRef(result);
 }
 
-JSValueRef JSObjectGetPrototype(JSContextRef, JSObjectRef object)
+JSValueRef JSObjectGetPrototype(JSContextRef ctx, JSObjectRef object)
 {
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
     JSObject* jsObject = toJS(object);
-    return toRef(jsObject->prototype());
+    return toRef(exec, jsObject->prototype());
 }
 
-void JSObjectSetPrototype(JSContextRef, JSObjectRef object, JSValueRef value)
+void JSObjectSetPrototype(JSContextRef ctx, JSObjectRef object, JSValueRef value)
 {
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
     JSObject* jsObject = toJS(object);
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
 
-    jsObject->setPrototype(jsValue->isObject() ? jsValue : jsNull());
+    jsObject->setPrototype(jsValue.isObject() ? jsValue : jsNull());
 }
 
 bool JSObjectHasProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName)
@@ -257,13 +267,13 @@ JSValueRef JSObjectGetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef
 
     JSObject* jsObject = toJS(object);
 
-    JSValuePtr jsValue = jsObject->get(exec, propertyName->identifier(&exec->globalData()));
+    JSValue jsValue = jsObject->get(exec, propertyName->identifier(&exec->globalData()));
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
     }
-    return toRef(jsValue);
+    return toRef(exec, jsValue);
 }
 
 void JSObjectSetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef propertyName, JSValueRef value, JSPropertyAttributes attributes, JSValueRef* exception)
@@ -274,7 +284,7 @@ void JSObjectSetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef prope
 
     JSObject* jsObject = toJS(object);
     Identifier name(propertyName->identifier(&exec->globalData()));
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
 
     if (attributes && !jsObject->hasProperty(exec, name))
         jsObject->putWithAttributes(exec, name, jsValue, attributes);
@@ -285,7 +295,7 @@ void JSObjectSetProperty(JSContextRef ctx, JSObjectRef object, JSStringRef prope
 
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
     }
 }
@@ -298,13 +308,13 @@ JSValueRef JSObjectGetPropertyAtIndex(JSContextRef ctx, JSObjectRef object, unsi
 
     JSObject* jsObject = toJS(object);
 
-    JSValuePtr jsValue = jsObject->get(exec, propertyIndex);
+    JSValue jsValue = jsObject->get(exec, propertyIndex);
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
     }
-    return toRef(jsValue);
+    return toRef(exec, jsValue);
 }
 
 
@@ -315,12 +325,12 @@ void JSObjectSetPropertyAtIndex(JSContextRef ctx, JSObjectRef object, unsigned p
     JSLock lock(exec);
 
     JSObject* jsObject = toJS(object);
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
     
     jsObject->put(exec, propertyIndex, jsValue);
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
     }
 }
@@ -336,7 +346,7 @@ bool JSObjectDeleteProperty(JSContextRef ctx, JSObjectRef object, JSStringRef pr
     bool result = jsObject->deleteProperty(exec, propertyName->identifier(&exec->globalData()));
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
     }
     return result;
@@ -387,19 +397,19 @@ JSValueRef JSObjectCallAsFunction(JSContextRef ctx, JSObjectRef object, JSObject
     if (!jsThisObject)
         jsThisObject = exec->globalThisValue();
 
-    ArgList argList;
+    MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; i++)
-        argList.append(toJS(arguments[i]));
+        argList.append(toJS(exec, arguments[i]));
 
     CallData callData;
     CallType callType = jsObject->getCallData(callData);
     if (callType == CallTypeNone)
         return 0;
 
-    JSValueRef result = toRef(call(exec, jsObject, callType, callData, jsThisObject, argList));
+    JSValueRef result = toRef(exec, call(exec, jsObject, callType, callData, jsThisObject, argList));
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         result = 0;
     }
@@ -426,13 +436,13 @@ JSObjectRef JSObjectCallAsConstructor(JSContextRef ctx, JSObjectRef object, size
     if (constructType == ConstructTypeNone)
         return 0;
 
-    ArgList argList;
+    MarkedArgumentBuffer argList;
     for (size_t i = 0; i < argumentCount; i++)
-        argList.append(toJS(arguments[i]));
+        argList.append(toJS(exec, arguments[i]));
     JSObjectRef result = toRef(construct(exec, jsObject, constructType, constructData, argList));
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         result = 0;
     }
@@ -465,7 +475,7 @@ JSPropertyNameArrayRef JSObjectCopyPropertyNames(JSContextRef ctx, JSObjectRef o
     jsObject->getPropertyNames(exec, array);
 
     size_t size = array.size();
-    propertyNames->array.reserveCapacity(size);
+    propertyNames->array.reserveInitialCapacity(size);
     for (size_t i = 0; i < size; ++i)
         propertyNames->array.append(JSRetainPtr<JSStringRef>(Adopt, OpaqueJSString::create(array[i].ustring()).releaseRef()));
     
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.h b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.h
index 461764c..3e8b0eb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSObjectRef.h
@@ -441,7 +441,7 @@ JS_EXPORT JSObjectRef JSObjectMakeConstructor(JSContextRef ctx, JSClassRef jsCla
  @discussion The behavior of this function does not exactly match the behavior of the built-in Array constructor. Specifically, if one argument 
  is supplied, this function returns an array with one element.
  */
-JS_EXPORT JSObjectRef JSObjectMakeArray(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception) AVAILABLE_AFTER_WEBKIT_VERSION_3_1;
+JS_EXPORT JSObjectRef JSObjectMakeArray(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception) AVAILABLE_IN_WEBKIT_VERSION_4_0;
 
 /*!
  @function
@@ -452,7 +452,7 @@ JS_EXPORT JSObjectRef JSObjectMakeArray(JSContextRef ctx, size_t argumentCount,
  @param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
  @result A JSObject that is a Date.
  */
-JS_EXPORT JSObjectRef JSObjectMakeDate(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception) AVAILABLE_AFTER_WEBKIT_VERSION_3_1;
+JS_EXPORT JSObjectRef JSObjectMakeDate(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception) AVAILABLE_IN_WEBKIT_VERSION_4_0;
 
 /*!
  @function
@@ -463,7 +463,7 @@ JS_EXPORT JSObjectRef JSObjectMakeDate(JSContextRef ctx, size_t argumentCount, c
  @param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
  @result A JSObject that is a Error.
  */
-JS_EXPORT JSObjectRef JSObjectMakeError(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception) AVAILABLE_AFTER_WEBKIT_VERSION_3_1;
+JS_EXPORT JSObjectRef JSObjectMakeError(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception) AVAILABLE_IN_WEBKIT_VERSION_4_0;
 
 /*!
  @function
@@ -474,7 +474,7 @@ JS_EXPORT JSObjectRef JSObjectMakeError(JSContextRef ctx, size_t argumentCount,
  @param exception A pointer to a JSValueRef in which to store an exception, if any. Pass NULL if you do not care to store an exception.
  @result A JSObject that is a RegExp.
  */
-JS_EXPORT JSObjectRef JSObjectMakeRegExp(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception) AVAILABLE_AFTER_WEBKIT_VERSION_3_1;
+JS_EXPORT JSObjectRef JSObjectMakeRegExp(JSContextRef ctx, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception) AVAILABLE_IN_WEBKIT_VERSION_4_0;
 
 /*!
 @function
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.cpp
index 6452ffc..8e236e4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSStringRef.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "JSStringRef.h"
 
+#include "InitializeThreading.h"
 #include "OpaqueJSString.h"
 #include <wtf/unicode/UTF8.h>
 
@@ -34,11 +35,13 @@ using namespace WTF::Unicode;
 
 JSStringRef JSStringCreateWithCharacters(const JSChar* chars, size_t numChars)
 {
+    initializeThreading();
     return OpaqueJSString::create(chars, numChars).releaseRef();
 }
 
 JSStringRef JSStringCreateWithUTF8CString(const char* string)
 {
+    initializeThreading();
     if (string) {
         size_t length = strlen(string);
         Vector<UChar, 1024> buffer(length);
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSStringRefCF.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSStringRefCF.cpp
index 65edd09..d1f6fe3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSStringRefCF.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSStringRefCF.cpp
@@ -27,6 +27,7 @@
 #include "JSStringRefCF.h"
 
 #include "APICast.h"
+#include "InitializeThreading.h"
 #include "JSStringRef.h"
 #include "OpaqueJSString.h"
 #include <runtime/UString.h>
@@ -35,7 +36,11 @@
 
 JSStringRef JSStringCreateWithCFString(CFStringRef string)
 {
-    CFIndex length = CFStringGetLength(string);
+    JSC::initializeThreading();
+
+    // We cannot use CFIndex here since CFStringGetLength can return values larger than
+    // it can hold.  (<rdar://problem/6806478>)
+    size_t length = CFStringGetLength(string);
     if (length) {
         OwnArrayPtr<UniChar> buffer(new UniChar[length]);
         CFStringGetCharacters(string, CFRangeMake(0, length), buffer.get());
@@ -44,7 +49,7 @@ JSStringRef JSStringCreateWithCFString(CFStringRef string)
     } else {
         return OpaqueJSString::create(0, 0).releaseRef();
     }
-    }
+}
 
 CFStringRef JSStringCopyCFString(CFAllocatorRef alloc, JSStringRef string)
 {
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.cpp b/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.cpp
index 351a105..2207181 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/API/JSValueRef.cpp
@@ -41,66 +41,99 @@
 
 #include <algorithm> // for std::min
 
-JSType JSValueGetType(JSContextRef, JSValueRef value)
+JSType JSValueGetType(JSContextRef ctx, JSValueRef value)
 {
-    JSC::JSValuePtr jsValue = toJS(value);
-    if (jsValue->isUndefined())
+    JSC::ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSC::JSLock lock(exec);
+
+    JSC::JSValue jsValue = toJS(exec, value);
+
+    if (jsValue.isUndefined())
         return kJSTypeUndefined;
-    if (jsValue->isNull())
+    if (jsValue.isNull())
         return kJSTypeNull;
-    if (jsValue->isBoolean())
+    if (jsValue.isBoolean())
         return kJSTypeBoolean;
-    if (jsValue->isNumber())
+    if (jsValue.isNumber())
         return kJSTypeNumber;
-    if (jsValue->isString())
+    if (jsValue.isString())
         return kJSTypeString;
-    ASSERT(jsValue->isObject());
+    ASSERT(jsValue.isObject());
     return kJSTypeObject;
 }
 
 using namespace JSC; // placed here to avoid conflict between JSC::JSType and JSType, above.
 
-bool JSValueIsUndefined(JSContextRef, JSValueRef value)
+bool JSValueIsUndefined(JSContextRef ctx, JSValueRef value)
 {
-    JSValuePtr jsValue = toJS(value);
-    return jsValue->isUndefined();
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
+    return jsValue.isUndefined();
 }
 
-bool JSValueIsNull(JSContextRef, JSValueRef value)
+bool JSValueIsNull(JSContextRef ctx, JSValueRef value)
 {
-    JSValuePtr jsValue = toJS(value);
-    return jsValue->isNull();
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
+    return jsValue.isNull();
 }
 
-bool JSValueIsBoolean(JSContextRef, JSValueRef value)
+bool JSValueIsBoolean(JSContextRef ctx, JSValueRef value)
 {
-    JSValuePtr jsValue = toJS(value);
-    return jsValue->isBoolean();
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
+    return jsValue.isBoolean();
 }
 
-bool JSValueIsNumber(JSContextRef, JSValueRef value)
+bool JSValueIsNumber(JSContextRef ctx, JSValueRef value)
 {
-    JSValuePtr jsValue = toJS(value);
-    return jsValue->isNumber();
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
+    return jsValue.isNumber();
 }
 
-bool JSValueIsString(JSContextRef, JSValueRef value)
+bool JSValueIsString(JSContextRef ctx, JSValueRef value)
 {
-    JSValuePtr jsValue = toJS(value);
-    return jsValue->isString();
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
+    return jsValue.isString();
 }
 
-bool JSValueIsObject(JSContextRef, JSValueRef value)
+bool JSValueIsObject(JSContextRef ctx, JSValueRef value)
 {
-    JSValuePtr jsValue = toJS(value);
-    return jsValue->isObject();
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
+    return jsValue.isObject();
 }
 
-bool JSValueIsObjectOfClass(JSContextRef, JSValueRef value, JSClassRef jsClass)
+bool JSValueIsObjectOfClass(JSContextRef ctx, JSValueRef value, JSClassRef jsClass)
 {
-    JSValuePtr jsValue = toJS(value);
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
     
-    if (JSObject* o = jsValue->getObject()) {
+    if (JSObject* o = jsValue.getObject()) {
         if (o->inherits(&JSCallbackObject<JSGlobalObject>::info))
             return static_cast<JSCallbackObject<JSGlobalObject>*>(o)->inherits(jsClass);
         else if (o->inherits(&JSCallbackObject<JSObject>::info))
@@ -115,25 +148,28 @@ bool JSValueIsEqual(JSContextRef ctx, JSValueRef a, JSValueRef b, JSValueRef* ex
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsA = toJS(a);
-    JSValuePtr jsB = toJS(b);
+    JSValue jsA = toJS(exec, a);
+    JSValue jsB = toJS(exec, b);
 
-    bool result = equal(exec, jsA, jsB); // false if an exception is thrown
+    bool result = JSValue::equal(exec, jsA, jsB); // false if an exception is thrown
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
     }
     return result;
 }
 
-bool JSValueIsStrictEqual(JSContextRef, JSValueRef a, JSValueRef b)
+bool JSValueIsStrictEqual(JSContextRef ctx, JSValueRef a, JSValueRef b)
 {
-    JSValuePtr jsA = toJS(a);
-    JSValuePtr jsB = toJS(b);
-    
-    bool result = strictEqual(jsA, jsB);
-    return result;
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsA = toJS(exec, a);
+    JSValue jsB = toJS(exec, b);
+
+    return JSValue::strictEqual(jsA, jsB);
 }
 
 bool JSValueIsInstanceOfConstructor(JSContextRef ctx, JSValueRef value, JSObjectRef constructor, JSValueRef* exception)
@@ -142,32 +178,45 @@ bool JSValueIsInstanceOfConstructor(JSContextRef ctx, JSValueRef value, JSObject
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
+
     JSObject* jsConstructor = toJS(constructor);
     if (!jsConstructor->structure()->typeInfo().implementsHasInstance())
         return false;
     bool result = jsConstructor->hasInstance(exec, jsValue, jsConstructor->get(exec, exec->propertyNames().prototype)); // false if an exception is thrown
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
     }
     return result;
 }
 
-JSValueRef JSValueMakeUndefined(JSContextRef)
+JSValueRef JSValueMakeUndefined(JSContextRef ctx)
 {
-    return toRef(jsUndefined());
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    return toRef(exec, jsUndefined());
 }
 
-JSValueRef JSValueMakeNull(JSContextRef)
+JSValueRef JSValueMakeNull(JSContextRef ctx)
 {
-    return toRef(jsNull());
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    return toRef(exec, jsNull());
 }
 
-JSValueRef JSValueMakeBoolean(JSContextRef, bool value)
+JSValueRef JSValueMakeBoolean(JSContextRef ctx, bool value)
 {
-    return toRef(jsBoolean(value));
+    ExecState* exec = toJS(ctx);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    return toRef(exec, jsBoolean(value));
 }
 
 JSValueRef JSValueMakeNumber(JSContextRef ctx, double value)
@@ -176,7 +225,7 @@ JSValueRef JSValueMakeNumber(JSContextRef ctx, double value)
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    return toRef(jsNumber(exec, value));
+    return toRef(exec, jsNumber(exec, value));
 }
 
 JSValueRef JSValueMakeString(JSContextRef ctx, JSStringRef string)
@@ -185,14 +234,17 @@ JSValueRef JSValueMakeString(JSContextRef ctx, JSStringRef string)
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    return toRef(jsString(exec, string->ustring()));
+    return toRef(exec, jsString(exec, string->ustring()));
 }
 
 bool JSValueToBoolean(JSContextRef ctx, JSValueRef value)
 {
     ExecState* exec = toJS(ctx);
-    JSValuePtr jsValue = toJS(value);
-    return jsValue->toBoolean(exec);
+    exec->globalData().heap.registerThread();
+    JSLock lock(exec);
+
+    JSValue jsValue = toJS(exec, value);
+    return jsValue.toBoolean(exec);
 }
 
 double JSValueToNumber(JSContextRef ctx, JSValueRef value, JSValueRef* exception)
@@ -201,12 +253,12 @@ double JSValueToNumber(JSContextRef ctx, JSValueRef value, JSValueRef* exception
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
 
-    double number = jsValue->toNumber(exec);
+    double number = jsValue.toNumber(exec);
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         number = NaN;
     }
@@ -219,12 +271,12 @@ JSStringRef JSValueToStringCopy(JSContextRef ctx, JSValueRef value, JSValueRef*
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
     
-    RefPtr<OpaqueJSString> stringRef(OpaqueJSString::create(jsValue->toString(exec)));
+    RefPtr<OpaqueJSString> stringRef(OpaqueJSString::create(jsValue.toString(exec)));
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         stringRef.clear();
     }
@@ -237,12 +289,12 @@ JSObjectRef JSValueToObject(JSContextRef ctx, JSValueRef value, JSValueRef* exce
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
     
-    JSObjectRef objectRef = toRef(jsValue->toObject(exec));
+    JSObjectRef objectRef = toRef(jsValue.toObject(exec));
     if (exec->hadException()) {
         if (exception)
-            *exception = toRef(exec->exception());
+            *exception = toRef(exec, exec->exception());
         exec->clearException();
         objectRef = 0;
     }
@@ -255,7 +307,7 @@ void JSValueProtect(JSContextRef ctx, JSValueRef value)
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
     gcProtect(jsValue);
 }
 
@@ -265,6 +317,6 @@ void JSValueUnprotect(JSContextRef ctx, JSValueRef value)
     exec->globalData().heap.registerThread();
     JSLock lock(exec);
 
-    JSValuePtr jsValue = toJS(value);
+    JSValue jsValue = toJS(exec, value);
     gcUnprotect(jsValue);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/API/WebKitAvailability.h b/src/3rdparty/webkit/JavaScriptCore/API/WebKitAvailability.h
index 1273360..8402528 100644
--- a/src/3rdparty/webkit/JavaScriptCore/API/WebKitAvailability.h
+++ b/src/3rdparty/webkit/JavaScriptCore/API/WebKitAvailability.h
@@ -38,6 +38,7 @@
 #define WEBKIT_VERSION_2_0    0x0200
 #define WEBKIT_VERSION_3_0    0x0300
 #define WEBKIT_VERSION_3_1    0x0310
+#define WEBKIT_VERSION_4_0    0x0400
 #define WEBKIT_VERSION_LATEST 0x9999
 
 #ifdef __APPLE__
@@ -640,123 +641,123 @@
 
 
 /*
- * AVAILABLE_AFTER_WEBKIT_VERSION_3_1
+ * AVAILABLE_IN_WEBKIT_VERSION_4_0
  * 
- * Used on declarations introduced after WebKit 3.1
+ * Used on declarations introduced in WebKit 4.0
  */
 #if WEBKIT_VERSION_MAX_ALLOWED < WEBKIT_VERSION_LATEST
-    #define AVAILABLE_AFTER_WEBKIT_VERSION_3_1     UNAVAILABLE_ATTRIBUTE
+    #define AVAILABLE_IN_WEBKIT_VERSION_4_0     UNAVAILABLE_ATTRIBUTE
 #elif WEBKIT_VERSION_MIN_REQUIRED < WEBKIT_VERSION_LATEST
-    #define AVAILABLE_AFTER_WEBKIT_VERSION_3_1     WEAK_IMPORT_ATTRIBUTE
+    #define AVAILABLE_IN_WEBKIT_VERSION_4_0     WEAK_IMPORT_ATTRIBUTE
 #else
-    #define AVAILABLE_AFTER_WEBKIT_VERSION_3_1
+    #define AVAILABLE_IN_WEBKIT_VERSION_4_0
 #endif
 
 /*
- * AVAILABLE_AFTER_WEBKIT_VERSION_3_1_BUT_DEPRECATED
+ * AVAILABLE_IN_WEBKIT_VERSION_4_0_BUT_DEPRECATED
  * 
- * Used on declarations introduced after WebKit 3.1, 
- * and deprecated after WebKit 3.1
+ * Used on declarations introduced in WebKit 4.0, 
+ * and deprecated in WebKit 4.0
  */
 #if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
-    #define AVAILABLE_AFTER_WEBKIT_VERSION_3_1_BUT_DEPRECATED    DEPRECATED_ATTRIBUTE
+    #define AVAILABLE_IN_WEBKIT_VERSION_4_0_BUT_DEPRECATED    DEPRECATED_ATTRIBUTE
 #else
-    #define AVAILABLE_AFTER_WEBKIT_VERSION_3_1_BUT_DEPRECATED    AVAILABLE_AFTER_WEBKIT_VERSION_3_1
+    #define AVAILABLE_IN_WEBKIT_VERSION_4_0_BUT_DEPRECATED    AVAILABLE_IN_WEBKIT_VERSION_4_0
 #endif
 
 /*
- * AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1
+ * AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0
  * 
  * Used on declarations introduced in WebKit 1.0, 
- * but later deprecated after WebKit 3.1
+ * but later deprecated in WebKit 4.0
  */
 #if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
-    #define AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    DEPRECATED_ATTRIBUTE
+    #define AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
-    #define AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER
+    #define AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_0_AND_LATER
 #endif
 
 /*
- * AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1
+ * AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0
  * 
  * Used on declarations introduced in WebKit 1.1, 
- * but later deprecated after WebKit 3.1
+ * but later deprecated in WebKit 4.0
  */
 #if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
-    #define AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    DEPRECATED_ATTRIBUTE
+    #define AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
-    #define AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER
+    #define AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_1_AND_LATER
 #endif
 
 /*
- * AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1
+ * AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0
  * 
  * Used on declarations introduced in WebKit 1.2, 
- * but later deprecated after WebKit 3.1
+ * but later deprecated in WebKit 4.0
  */
 #if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
-    #define AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    DEPRECATED_ATTRIBUTE
+    #define AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
-    #define AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER
+    #define AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_2_AND_LATER
 #endif
 
 /*
- * AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1
+ * AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0
  * 
  * Used on declarations introduced in WebKit 1.3, 
- * but later deprecated after WebKit 3.1
+ * but later deprecated in WebKit 4.0
  */
 #if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
-    #define AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    DEPRECATED_ATTRIBUTE
+    #define AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
-    #define AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER
+    #define AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_1_3_AND_LATER
 #endif
 
 /*
- * AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1
+ * AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0
  * 
  * Used on declarations introduced in WebKit 2.0, 
- * but later deprecated after WebKit 3.1
+ * but later deprecated in WebKit 4.0
  */
 #if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
-    #define AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    DEPRECATED_ATTRIBUTE
+    #define AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
-    #define AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER
+    #define AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_2_0_AND_LATER
 #endif
 
 /*
- * AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1
+ * AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0
  * 
  * Used on declarations introduced in WebKit 3.0, 
- * but later deprecated after WebKit 3.1
+ * but later deprecated in WebKit 4.0
  */
 #if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
-    #define AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    DEPRECATED_ATTRIBUTE
+    #define AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
-    #define AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER
+    #define AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_3_0_AND_LATER
 #endif
 
 /*
- * AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1
+ * AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0
  * 
  * Used on declarations introduced in WebKit 3.1, 
- * but later deprecated after WebKit 3.1
+ * but later deprecated in WebKit 4.0
  */
 #if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
-    #define AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    DEPRECATED_ATTRIBUTE
+    #define AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
-    #define AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_AFTER_WEBKIT_VERSION_3_1    AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER
+    #define AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER_BUT_DEPRECATED_IN_WEBKIT_VERSION_4_0    AVAILABLE_WEBKIT_VERSION_3_1_AND_LATER
 #endif
 
 /*
- * DEPRECATED_AFTER_WEBKIT_VERSION_3_1
+ * DEPRECATED_IN_WEBKIT_VERSION_4_0
  * 
- * Used on types deprecated after WebKit 3.1
+ * Used on types deprecated in WebKit 4.0
  */
 #if WEBKIT_VERSION_MIN_REQUIRED >= WEBKIT_VERSION_LATEST
-    #define DEPRECATED_AFTER_WEBKIT_VERSION_3_1    DEPRECATED_ATTRIBUTE
+    #define DEPRECATED_IN_WEBKIT_VERSION_4_0    DEPRECATED_ATTRIBUTE
 #else
-    #define DEPRECATED_AFTER_WEBKIT_VERSION_3_1
+    #define DEPRECATED_IN_WEBKIT_VERSION_4_0
 #endif
 
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/ChangeLog b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
index 3321570..c8bba0f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/ChangeLog
+++ b/src/3rdparty/webkit/JavaScriptCore/ChangeLog
@@ -1,26110 +1,978 @@
-2009-01-22  Oliver Hunt  <oliver@apple.com>
+2009-06-26  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by Geoff Garen.
-
-        <rdar://problem/6516853> (r39682-r39736) JSFunFuzz: crash on "(function(){({ x2: x }), })()"
-        <https://bugs.webkit.org/show_bug.cgi?id=23479>
-
-        Automatic semicolon insertion was resulting in this being accepted in the initial
-        nodeless parsing, but subsequent reparsing for code generation would fail, leading
-        to a crash.  The solution is to ensure that reparsing a function performs parsing
-        in the same state as the initial parse.  We do this by modifying the saved source
-        ranges to include rather than exclude the opening and closing braces.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary): add an assertion for successful recompile
-        * parser/Lexer.h:
-        (JSC::Lexer::sourceCode): include rather than exclude braces.
-        * parser/Nodes.h:
-        (JSC::FunctionBodyNode::toSourceString):  No need to append braces anymore.
-
-2009-01-21  Alexey Proskuryakov  <ap@webkit.org>
-
-        Suggested by Oliver Hunt. Reviewed by Oliver Hunt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23456
-        Function argument names leak
-
-        * parser/Nodes.cpp: (JSC::FunctionBodyNode::~FunctionBodyNode): Destruct parameter names.
-
-2009-01-22  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=23461 LayoutTests/
-        fast/js/numeric-conversion.html is broken, and corresponding 
-        <rdar://problem/6514842>
-
-        The basic problem here is that parseInt(Infinity) should be NaN, 
-        but we were returning 0. NaN matches Safari 3.2.1 and Firefox.
-
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::globalFuncParseInt):
-
-2009-01-13  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Darin Adler and Oliver Hunt.
-
-        <rdar://problem/6489314> REGRESSION: Business widget's front side 
-        fails to render correctly when flipping widget
-
-        The problem here is that parseInt was parsing NaN as 0. This patch 
-        corrects that by parsing NaN as NaN. This matches our old behavior 
-        and Firefox. 
-
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::globalFuncParseInt):
-
-2009-02-13  Adam Treat  <adam.treat@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23960
-        Crash Fix.
-
-        Don't depend on 'initializeThreading()' to come before a call to 'isMainThread()'
-        as QtWebKit only calls 'initializeThreading()' during QWebPage construction.
-
-        A client app may well make a call to QWebSettings::iconForUrl() for instance
-        before creating a QWebPage and that call to QWebSettings triggers an
-        ASSERT(isMainThread()) deep within WebCore.
-
-        * wtf/ThreadingQt.cpp:
-        (WTF::isMainThread):
-
-2009-02-12  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Rubber-stamped by Lars.
-
-        Re-enable the JIT in the Qt build with -fno-stack-protector on Linux.
-
-        * JavaScriptCore.pri:
-
-2009-02-03  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Added accessor for JSByteArray storage.
-
-        * runtime/JSByteArray.h:
-        (JSC::JSByteArray::storage):
-
-2009-01-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Bug 23580: GNU mode RVCT compilation support
-        <https://bugs.webkit.org/show_bug.cgi?id=23580>
-
-        * pcre/pcre_exec.cpp: Use COMPILER(GCC) instead of __GNUC__.
-        * wtf/FastMalloc.cpp: Ditto.
-        (WTF::TCMallocStats::):
-        * wtf/Platform.h: Don't define COMPILER(GCC) with RVCT --gnu.
-
-2008-11-28  George Staikos  <staikos@kde.org>
-
-        Reviewed by NOBODY (OOPS!).
-
-        Implement currentThreadStackBase() on Windows CE.
-
-        Coding style fixes by Joerg Bornemann <joerg.bornemann@trolltech.com>.
-
-        * runtime/Collector.cpp:
-        (JSC::numberOfWritableBytes):
-        (JSC::systemPageSize):
-        (JSC::currentThreadStackBaseWinCE):
-        (JSC::currentThreadStackBase):
-
-2009-01-08  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Encode immediates in the low word of JSValuePtrs, on x86-64.
-
-        On 32-bit platforms a JSValuePtr may represent a 31-bit signed integer.
-        On 64-bit platforms, if USE(ALTERNATE_JSIMMEDIATE) is defined, a full
-        32-bit integer may be stored in an immediate.
-        
-        Presently USE(ALTERNATE_JSIMMEDIATE) uses the same encoding as the default
-        immediate format - the value is left shifted by one, so a one bit tag can
-        be added to indicate the value is an immediate.  However this means that
-        values must be commonly be detagged (by right shifting by one) before
-        arithmetic operations can be performed on immediates.  This patch modifies
-        the formattting so the the high bits of the immediate mark values as being
-        integer.
-
-        * assembler/MacroAssembler.h:
-        (JSC::MacroAssembler::not32):
-        (JSC::MacroAssembler::orPtr):
-        (JSC::MacroAssembler::zeroExtend32ToPtr):
-        (JSC::MacroAssembler::jaePtr):
-        (JSC::MacroAssembler::jbPtr):
-        (JSC::MacroAssembler::jnzPtr):
-        (JSC::MacroAssembler::jzPtr):
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::notl_r):
-        (JSC::X86Assembler::testq_i32r):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileSlowCases):
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JIT.h:
-        * jit/JITArithmetic.cpp:
-        (JSC::JIT::compileFastArith_op_lshift):
-        (JSC::JIT::compileFastArith_op_rshift):
-        (JSC::JIT::compileFastArith_op_bitand):
-        (JSC::JIT::compileFastArithSlow_op_bitand):
-        (JSC::JIT::compileFastArith_op_mod):
-        (JSC::JIT::compileFastArithSlow_op_mod):
-        (JSC::JIT::compileFastArith_op_add):
-        (JSC::JIT::compileFastArith_op_mul):
-        (JSC::JIT::compileFastArith_op_post_inc):
-        (JSC::JIT::compileFastArith_op_post_dec):
-        (JSC::JIT::compileFastArith_op_pre_inc):
-        (JSC::JIT::compileFastArith_op_pre_dec):
-        (JSC::JIT::putDoubleResultToJSNumberCellOrJSImmediate):
-        (JSC::JIT::compileBinaryArithOp):
-        * jit/JITCall.cpp:
-        (JSC::JIT::compileOpCallSlowCase):
-        * jit/JITInlineMethods.h:
-        (JSC::JIT::emitJumpIfJSCell):
-        (JSC::JIT::emitJumpIfNotJSCell):
-        (JSC::JIT::emitJumpIfImmNum):
-        (JSC::JIT::emitJumpSlowCaseIfNotImmNum):
-        (JSC::JIT::emitJumpSlowCaseIfNotImmNums):
-        (JSC::JIT::emitFastArithDeTagImmediate):
-        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
-        (JSC::JIT::emitFastArithReTagImmediate):
-        (JSC::JIT::emitFastArithImmToInt):
-        (JSC::JIT::emitFastArithIntToImmNoCheck):
-        (JSC::JIT::emitTagAsBoolImmediate):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::resizePropertyStorage):
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        (JSC::JIT::privateCompileGetByIdSelf):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdChain):
-        (JSC::JIT::privateCompilePutByIdReplace):
-        * runtime/JSImmediate.h:
-        (JSC::JSImmediate::isNumber):
-        (JSC::JSImmediate::isPositiveNumber):
-        (JSC::JSImmediate::areBothImmediateNumbers):
-        (JSC::JSImmediate::xorImmediateNumbers):
-        (JSC::JSImmediate::rightShiftImmediateNumbers):
-        (JSC::JSImmediate::canDoFastAdditiveOperations):
-        (JSC::JSImmediate::addImmediateNumbers):
-        (JSC::JSImmediate::subImmediateNumbers):
-        (JSC::JSImmediate::makeInt):
-        (JSC::JSImmediate::toBoolean):
-        * wtf/Platform.h:
-
-2009-01-08  Sam Weinig  <sam@webkit.org>
-
-        Revert r39720. It broke Interpreted mode.
-
-2009-01-08  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=23197
-        Delay creating the PCVector until an exception is thrown
-        Part of <rdar://problem/6469060>
-        Don't store exception information for a CodeBlock until first exception is thrown
+        Reviewed by Dan Bernstein.
 
-        - Change the process for re-parsing/re-generating bytecode for exception information
-          to use data from the original CodeBlock (offsets of GlobalResolve instructions) to
-          aid in creating an identical instruction stream on re-parse, instead of padding
-          interchangeable opcodes, which would result in different JITed code.
-        - Fix bug where the wrong ScopeChainNode was used when re-parsing/regenerating from
-          within some odd modified scope chains.
-        - Lazily create the pcVector by re-JITing the regenerated CodeBlock and stealing the
-          the pcVector from it.
+        <rdar://problem/7009684> REGRESSION(r45039): Crashes inside JSEvent::put on PowerPC (26746)
+        <https://bugs.webkit.org/show_bug.cgi?id=26746>
 
-        Saves ~2MB on Membuster head.
+        Fix for r45039 incorrectly uncached a get_by_id by converting it to put_by_id.  Clearly this
+        is less than correct.  This patch corrects that error.
 
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
-        (JSC::CodeBlock::hasGlobalResolveInstructionAtBytecodeOffset):
-        (JSC::CodeBlock::hasGlobalResolveInfoAtBytecodeOffset):
-        * bytecode/CodeBlock.h:
-        (JSC::JITCodeRef::JITCodeRef):
-        (JSC::GlobalResolveInfo::GlobalResolveInfo):
-        (JSC::CodeBlock::getBytecodeIndex):
-        (JSC::CodeBlock::addGlobalResolveInstruction):
-        (JSC::CodeBlock::addGlobalResolveInfo):
-        (JSC::CodeBlock::addFunctionRegisterInfo):
-        (JSC::CodeBlock::hasExceptionInfo):
-        (JSC::CodeBlock::pcVector):
-        (JSC::EvalCodeBlock::EvalCodeBlock):
-        (JSC::EvalCodeBlock::baseScopeDepth):
-        * bytecode/Opcode.h:
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        (JSC::BytecodeGenerator::emitResolve):
-        (JSC::BytecodeGenerator::emitGetScopedVar):
-        * bytecompiler/BytecodeGenerator.h:
-        (JSC::BytecodeGenerator::setRegeneratingForExceptionInfo):
         * interpreter/Interpreter.cpp:
-        (JSC::bytecodeOffsetForPC):
-        (JSC::Interpreter::unwindCallFrame):
-        (JSC::Interpreter::privateExecute):
-        (JSC::Interpreter::retrieveLastCaller):
-        (JSC::Interpreter::cti_op_instanceof):
-        (JSC::Interpreter::cti_op_call_NotJSFunction):
-        (JSC::Interpreter::cti_op_resolve):
-        (JSC::Interpreter::cti_op_construct_NotJSConstruct):
-        (JSC::Interpreter::cti_op_resolve_func):
-        (JSC::Interpreter::cti_op_resolve_skip):
-        (JSC::Interpreter::cti_op_resolve_global):
-        (JSC::Interpreter::cti_op_resolve_with_base):
-        (JSC::Interpreter::cti_op_throw):
-        (JSC::Interpreter::cti_op_in):
-        (JSC::Interpreter::cti_vm_throw):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompile):
-        * parser/Nodes.cpp:
-        (JSC::EvalNode::generateBytecode):
-        (JSC::EvalNode::bytecodeForExceptionInfoReparse):
-        (JSC::FunctionBodyNode::bytecodeForExceptionInfoReparse):
-        * parser/Nodes.h:
+        (JSC::Interpreter::tryCacheGetByID):
 
-2009-01-08  Jian Li  <jianli@chromium.org>
+2009-06-26  Eric Seidel  <eric@webkit.org>
 
-        Reviewed by Alexey Proskuryakov.
+        No review, only rolling out r45259.
 
-        Add Win32 implementation of ThreadSpecific.
-        https://bugs.webkit.org/show_bug.cgi?id=22614
+        Roll out r45259 after crash appeared on the bots:
+        plugins/undefined-property-crash.html
+        ASSERTION FAILED: s <= HeapConstants<heapType>::cellSize
+        (leopard-intel-debug-tests/build/JavaScriptCore/runtime/Collector.cpp:278
+        void* JSC::Heap::heapAllocate(size_t) [with JSC::HeapType heapType = PrimaryHeap])
 
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * wtf/ThreadSpecific.h:
-        (WTF::ThreadSpecific::ThreadSpecific):
-        (WTF::ThreadSpecific::~ThreadSpecific):
-        (WTF::ThreadSpecific::get):
-        (WTF::ThreadSpecific::set):
-        (WTF::ThreadSpecific::destroy):
-        * wtf/ThreadSpecificWin.cpp: Added.
-        (WTF::ThreadSpecificThreadExit):
-        * wtf/ThreadingWin.cpp:
-        (WTF::wtfThreadEntryPoint):
+        * runtime/DateInstance.cpp:
+        * runtime/Identifier.cpp:
+        * runtime/Lookup.h:
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpObject.h:
+        * runtime/ScopeChain.h:
+        * runtime/UString.h:
 
-2009-01-08  Justin McPherson <justin.mcpherson@nokia.com>
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        Fix compilation with Qt on NetBSD.
-
-        * runtime/Collector.cpp:
-        (JSC::currentThreadStackBase): Use PLATFORM(NETBSD) to enter the
-        code path to retrieve the stack base using pthread_attr_get_np.
-        The PTHREAD_NP_H define is not used because the header file does
-        not exist on NetBSD, but the function is declared nevertheless.
-        * wtf/Platform.h: Introduce WTF_PLATFORM_NETBSD.
-
-2009-01-07  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        <rdar://problem/6469060> Don't store exception information for a CodeBlock until first exception is thrown
-
-        Don't initially store exception information (lineNumber/expressionRange/getByIdExcecptionInfo)
-        in CodeBlocks blocks.  Instead, re-parse for the data on demand and cache it then.
-
-        One important change that was needed to make this work was to pad op_get_global_var with nops to
-        be the same length as op_resolve_global, since one could be replaced for the other on re-parsing,
-        and we want to keep the offsets bytecode offsets the same.
+        Add support for QDataStream operators to Vector.
 
-        1.3MB improvement on Membuster head.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump): Update op_get_global_var to account for the padding.
-        (JSC::CodeBlock::dumpStatistics): Add more statistic dumping.
-        (JSC::CodeBlock::CodeBlock): Initialize m_exceptionInfo.
-        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary): Re-parses the CodeBlocks
-        associated SourceCode and steals the ExceptionInfo from it.
-        (JSC::CodeBlock::lineNumberForBytecodeOffset): Creates the exception info on demand.
-        (JSC::CodeBlock::expressionRangeForBytecodeOffset): Ditto.
-        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset): Ditto.
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::numberOfExceptionHandlers): Updated to account for m_exceptionInfo indirection.
-        (JSC::CodeBlock::addExceptionHandler): Ditto.
-        (JSC::CodeBlock::exceptionHandler): Ditto.
-        (JSC::CodeBlock::clearExceptionInfo): Ditto.
-        (JSC::CodeBlock::addExpressionInfo): Ditto.
-        (JSC::CodeBlock::addGetByIdExceptionInfo): Ditto.
-        (JSC::CodeBlock::numberOfLineInfos): Ditto.
-        (JSC::CodeBlock::addLineInfo): Ditto.
-        (JSC::CodeBlock::lastLineInfo): Ditto.
-
-        * bytecode/Opcode.h: Change length of op_get_global_var to match op_resolve_global.
-
-        * bytecode/SamplingTool.cpp:
-        (JSC::SamplingTool::dump): Add comment indicating why it is okay not to pass a CallFrame.
-
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::generate): Clear the exception info after generation for Function and Eval
-        Code when not in regenerate for exception info mode.
-        (JSC::BytecodeGenerator::BytecodeGenerator): Initialize m_regeneratingForExceptionInfo to false.
-        (JSC::BytecodeGenerator::emitGetScopedVar): Pad op_get_global_var with 2 nops.
-        * bytecompiler/BytecodeGenerator.h:
-        (JSC::BytecodeGenerator::setRegeneratingForExcpeptionInfo): Added.
-
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::throwException): Pass the CallFrame to exception info accessors.
-        (JSC::Interpreter::privateExecute): Ditto.
-        (JSC::Interpreter::retrieveLastCaller): Ditto.
-        (JSC::Interpreter::cti_op_new_error): Ditto.
-
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass): Pass the current bytecode offset instead of hard coding the
-        line number, the stub will do the accessing if it gets called.
-
-        * parser/Nodes.cpp:
-        (JSC::ProgramNode::emitBytecode): Moved.
-        (JSC::ProgramNode::generateBytecode): Moved.
-        (JSC::EvalNode::create): Moved.
-        (JSC::EvalNode::bytecodeForExceptionInfoReparse): Added.
-        (JSC::FunctionBodyNode::generateBytecode): Rename reparse to reparseInPlace.
-        (JSC::FunctionBodyNode::bytecodeForExceptionInfoReparse): Addded.
-
-        * parser/Nodes.h:
-        (JSC::ScopeNode::features): Added getter.
-        * parser/Parser.cpp:
-        (JSC::Parser::reparseInPlace): Renamed from reparse.
-        * parser/Parser.h:
-        (JSC::Parser::reparse): Added. Re-parses the passed in Node into
-        a new Node.
-        * runtime/ExceptionHelpers.cpp:
-        (JSC::createUndefinedVariableError): Pass along CallFrame.
-        (JSC::createInvalidParamError): Ditto.
-        (JSC::createNotAConstructorError): Ditto.
-        (JSC::createNotAFunctionError): Ditto.
-        (JSC::createNotAnObjectError): Ditto.
-
-2009-01-06  Gavin Barraclough  <baraclough@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Replace accidentally removed references in BytecodeGenerator, deleting these
-        will be hindering the sharing of constant numbers and strings.
-
-        The code to add a new constant (either number or string) to their respective
-        map works by attempting to add a null entry, then checking the result of the
-        add for null.  The first time, this should return the null (or noValue).
-        The code checks for null (to see if this is the initial add), and then allocates
-        a new number / string object.  This code relies on the result returned from
-        the add to the map being stored as a reference, such that the allocated object
-        will be stored in the map, and will be resused if the same constant is encountered
-        again.  By failing to use a reference we will be leaking GC object for each
-        additional entry added to the map.  As GC objects they should be clollected,
-        be we should no be allocatin them in the first place.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23158
-
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::emitLoad):
+        * wtf/Vector.h:
+        (WTF::operator<<):
+        (WTF::operator>>):
 
-2009-01-06  Oliver Hunt  <oliver@apple.com>
+2009-06-24  Sam Weinig  <sam@webkit.org>
 
         Reviewed by Gavin Barraclough.
 
-        <rdar://problem/6040850> JavaScript register file should use VirtualAlloc on Windows
+        Make the opcode sampler work once again.
 
-        Fairly simple, just reserve 4Mb of address space for the
-        register file, and then commit one section at a time.  We
-        don't release committed memory as we drop back, but then
-        mac doesn't either so this probably not too much of a 
-        problem.
-
-        * interpreter/RegisterFile.cpp:
-        (JSC::RegisterFile::~RegisterFile):
-        * interpreter/RegisterFile.h:
-        (JSC::RegisterFile::RegisterFile):
-        (JSC::RegisterFile::grow):
-
-2009-01-06  Alexey Proskuryakov  <ap@webkit.org>
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdTransition):
+        (JSC::JIT::compileCTIMachineTrampolines):
+        (JSC::JIT::compilePatchGetArrayLength):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::call):
 
-        Reviewed by Darin Adler.
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        https://bugs.webkit.org/show_bug.cgi?id=23142
-        ThreadGlobalData leaks seen on buildbot
+        Reviewed by Maciej Stachowiak.
 
-        * wtf/ThreadSpecific.h: (WTF::ThreadSpecific::destroy): Temporarily reset the thread
-        specific value to make getter work on Mac OS X.
+        Extend FastAllocBase.h with 'using WTF::FastAllocBase' to avoid
+        unnecessary WTF:: usings.
+        Remove existing unnecessary WTF:: usings.
 
-        * wtf/Platform.h: Touch this file again to make sure all Windows builds use the most recent
-        version of ThreadSpecific.h.
+        * interpreter/Interpreter.h:
+        * profiler/CallIdentifier.h:
+        * runtime/ScopeChain.h:
+        * wtf/FastAllocBase.h:
 
-2009-01-05  Gavin Barraclough  <baraclough@apple.com>
+2009-06-24  David Levin  <levin@chromium.org>
 
-        Reviewed by Oliver Hunt.
+        Fix all builds.
 
-        Replace all uses of JSValue* with a new smart pointer type, JSValuePtr.
-        
-        A JavaScript value may be a heap object or boxed primitive, represented by a
-        pointer, or may be an unboxed immediate value, such as an integer.  Since a
-        value may dynamically need to contain either a pointer value or an immediate,
-        we encode immediates as pointer values (since all valid JSCell pointers are
-        allocated at alligned addesses, unaligned addresses are available to encode
-        immediates).  As such all JavaScript values are represented using a JSValue*.
-
-        This implementation is encumbered by a number of constraints.  It ties the
-        JSValue representation to the size of pointer on the platform, which, for
-        example, means that we currently can represent different ranges of integers
-        as immediates on x86 and x86-64.  It also prevents us from overloading the
-        to-boolean conversion used to test for noValue() - effectively forcing us
-        to represent noValue() as 0.  This would potentially be problematic were we
-        to wish to encode integer values differently (e.g. were we to use the v8
-        encoding, where pointers are tagged with 1 and integers with 0, then the
-        immediate integer 0 would conflict with noValue()).
-
-        This patch replaces all usage of JSValue* with a new class, JSValuePtr,
-        which encapsulates the pointer.  JSValuePtr maintains the same interface as
-        JSValue*, overloading operator-> and operator bool such that previous
-        operations in the code on variables of type JSValue* are still supported.
-
-        In order to provide a ProtectPtr<> type with support for the new value
-        representation (without using the internal JSValue type directly), a new
-        ProtectJSValuePtr type has been added, equivalent to the previous type
-        ProtectPtr<JSValue>.
-
-        This patch is likely the first in a sequence of three changes.  With the
-        value now encapsulated it will likely make sense to migrate the functionality
-        from JSValue into JSValuePtr, such that the internal pointer representation
-        need not be exposed.  Through migrating the functionality to the wrapper
-        class the existing JSValue should be rendered redundant, and the class is
-        likely to be removed (the JSValuePtr now wrapping a pointer to a JSCell).
-        At this stage it will likely make sense to rename JSValuePtr to JSValue.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23114
-
-        * API/APICast.h:
-        (toJS):
-        (toRef):
-        * API/JSBase.cpp:
-        (JSEvaluateScript):
-        * API/JSCallbackConstructor.h:
-        (JSC::JSCallbackConstructor::createStructure):
-        * API/JSCallbackFunction.cpp:
-        (JSC::JSCallbackFunction::call):
-        * API/JSCallbackFunction.h:
-        (JSC::JSCallbackFunction::createStructure):
-        * API/JSCallbackObject.h:
-        (JSC::JSCallbackObject::createStructure):
-        * API/JSCallbackObjectFunctions.h:
-        (JSC::::asCallbackObject):
-        (JSC::::put):
-        (JSC::::hasInstance):
-        (JSC::::call):
-        (JSC::::staticValueGetter):
-        (JSC::::staticFunctionGetter):
-        (JSC::::callbackGetter):
-        * API/JSContextRef.cpp:
-        * API/JSObjectRef.cpp:
-        (JSObjectMakeConstructor):
-        (JSObjectSetPrototype):
-        (JSObjectGetProperty):
-        (JSObjectSetProperty):
-        (JSObjectGetPropertyAtIndex):
-        (JSObjectSetPropertyAtIndex):
-        * API/JSValueRef.cpp:
-        (JSValueGetType):
-        (JSValueIsUndefined):
-        (JSValueIsNull):
-        (JSValueIsBoolean):
-        (JSValueIsNumber):
-        (JSValueIsString):
-        (JSValueIsObject):
-        (JSValueIsObjectOfClass):
-        (JSValueIsEqual):
-        (JSValueIsStrictEqual):
-        (JSValueIsInstanceOfConstructor):
-        (JSValueToBoolean):
-        (JSValueToNumber):
-        (JSValueToStringCopy):
-        (JSValueToObject):
-        (JSValueProtect):
-        (JSValueUnprotect):
-        * JavaScriptCore.exp:
-        * bytecode/CodeBlock.cpp:
-        (JSC::valueToSourceString):
-        (JSC::constantName):
-        (JSC::CodeBlock::dump):
         * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::getConstant):
-        (JSC::CodeBlock::addUnexpectedConstant):
-        (JSC::CodeBlock::unexpectedConstant):
-        * bytecode/EvalCodeCache.h:
-        (JSC::EvalCodeCache::get):
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        (JSC::BytecodeGenerator::addConstant):
-        (JSC::BytecodeGenerator::addUnexpectedConstant):
-        (JSC::BytecodeGenerator::emitLoad):
-        (JSC::BytecodeGenerator::emitLoadJSV):
-        (JSC::BytecodeGenerator::emitGetScopedVar):
-        (JSC::BytecodeGenerator::emitPutScopedVar):
-        (JSC::BytecodeGenerator::emitNewError):
-        (JSC::keyForImmediateSwitch):
         * bytecompiler/BytecodeGenerator.h:
-        (JSC::BytecodeGenerator::JSValueHashTraits::constructDeletedValue):
-        (JSC::BytecodeGenerator::JSValueHashTraits::isDeletedValue):
-        * debugger/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::evaluate):
-        * debugger/DebuggerCallFrame.h:
-        (JSC::DebuggerCallFrame::DebuggerCallFrame):
-        (JSC::DebuggerCallFrame::exception):
-        * interpreter/CallFrame.cpp:
-        (JSC::CallFrame::thisValue):
-        * interpreter/CallFrame.h:
-        (JSC::ExecState::setException):
-        (JSC::ExecState::exception):
-        (JSC::ExecState::exceptionSlot):
-        (JSC::ExecState::hadException):
-        * interpreter/Interpreter.cpp:
-        (JSC::fastIsNumber):
-        (JSC::fastToInt32):
-        (JSC::fastToUInt32):
-        (JSC::jsLess):
-        (JSC::jsLessEq):
-        (JSC::jsAddSlowCase):
-        (JSC::jsAdd):
-        (JSC::jsTypeStringForValue):
-        (JSC::jsIsObjectType):
-        (JSC::jsIsFunctionType):
-        (JSC::Interpreter::resolve):
-        (JSC::Interpreter::resolveSkip):
-        (JSC::Interpreter::resolveGlobal):
-        (JSC::inlineResolveBase):
-        (JSC::Interpreter::resolveBase):
-        (JSC::Interpreter::resolveBaseAndProperty):
-        (JSC::Interpreter::resolveBaseAndFunc):
-        (JSC::isNotObject):
-        (JSC::Interpreter::callEval):
-        (JSC::Interpreter::unwindCallFrame):
-        (JSC::Interpreter::throwException):
-        (JSC::Interpreter::execute):
-        (JSC::Interpreter::checkTimeout):
-        (JSC::Interpreter::createExceptionScope):
-        (JSC::cachePrototypeChain):
-        (JSC::Interpreter::tryCachePutByID):
-        (JSC::countPrototypeChainEntriesAndCheckForProxies):
-        (JSC::Interpreter::tryCacheGetByID):
-        (JSC::Interpreter::privateExecute):
-        (JSC::Interpreter::retrieveArguments):
-        (JSC::Interpreter::retrieveCaller):
-        (JSC::Interpreter::retrieveLastCaller):
-        (JSC::Interpreter::tryCTICachePutByID):
-        (JSC::Interpreter::tryCTICacheGetByID):
-        (JSC::returnToThrowTrampoline):
-        (JSC::Interpreter::cti_op_convert_this):
-        (JSC::Interpreter::cti_op_add):
-        (JSC::Interpreter::cti_op_pre_inc):
-        (JSC::Interpreter::cti_op_loop_if_less):
-        (JSC::Interpreter::cti_op_loop_if_lesseq):
-        (JSC::Interpreter::cti_op_get_by_id_generic):
-        (JSC::Interpreter::cti_op_get_by_id):
-        (JSC::Interpreter::cti_op_get_by_id_second):
-        (JSC::Interpreter::cti_op_get_by_id_self_fail):
-        (JSC::Interpreter::cti_op_get_by_id_proto_list):
-        (JSC::Interpreter::cti_op_get_by_id_proto_list_full):
-        (JSC::Interpreter::cti_op_get_by_id_proto_fail):
-        (JSC::Interpreter::cti_op_get_by_id_array_fail):
-        (JSC::Interpreter::cti_op_get_by_id_string_fail):
-        (JSC::Interpreter::cti_op_instanceof):
-        (JSC::Interpreter::cti_op_del_by_id):
-        (JSC::Interpreter::cti_op_mul):
-        (JSC::Interpreter::cti_op_call_NotJSFunction):
-        (JSC::Interpreter::cti_op_resolve):
-        (JSC::Interpreter::cti_op_construct_NotJSConstruct):
-        (JSC::Interpreter::cti_op_get_by_val):
-        (JSC::Interpreter::cti_op_resolve_func):
-        (JSC::Interpreter::cti_op_sub):
-        (JSC::Interpreter::cti_op_put_by_val):
-        (JSC::Interpreter::cti_op_put_by_val_array):
-        (JSC::Interpreter::cti_op_lesseq):
-        (JSC::Interpreter::cti_op_loop_if_true):
-        (JSC::Interpreter::cti_op_negate):
-        (JSC::Interpreter::cti_op_resolve_base):
-        (JSC::Interpreter::cti_op_resolve_skip):
-        (JSC::Interpreter::cti_op_resolve_global):
-        (JSC::Interpreter::cti_op_div):
-        (JSC::Interpreter::cti_op_pre_dec):
-        (JSC::Interpreter::cti_op_jless):
-        (JSC::Interpreter::cti_op_not):
-        (JSC::Interpreter::cti_op_jtrue):
-        (JSC::Interpreter::cti_op_post_inc):
-        (JSC::Interpreter::cti_op_eq):
-        (JSC::Interpreter::cti_op_lshift):
-        (JSC::Interpreter::cti_op_bitand):
-        (JSC::Interpreter::cti_op_rshift):
-        (JSC::Interpreter::cti_op_bitnot):
-        (JSC::Interpreter::cti_op_resolve_with_base):
-        (JSC::Interpreter::cti_op_mod):
-        (JSC::Interpreter::cti_op_less):
-        (JSC::Interpreter::cti_op_neq):
-        (JSC::Interpreter::cti_op_post_dec):
-        (JSC::Interpreter::cti_op_urshift):
-        (JSC::Interpreter::cti_op_bitxor):
-        (JSC::Interpreter::cti_op_bitor):
-        (JSC::Interpreter::cti_op_call_eval):
-        (JSC::Interpreter::cti_op_throw):
-        (JSC::Interpreter::cti_op_next_pname):
-        (JSC::Interpreter::cti_op_typeof):
-        (JSC::Interpreter::cti_op_is_undefined):
-        (JSC::Interpreter::cti_op_is_boolean):
-        (JSC::Interpreter::cti_op_is_number):
-        (JSC::Interpreter::cti_op_is_string):
-        (JSC::Interpreter::cti_op_is_object):
-        (JSC::Interpreter::cti_op_is_function):
-        (JSC::Interpreter::cti_op_stricteq):
-        (JSC::Interpreter::cti_op_nstricteq):
-        (JSC::Interpreter::cti_op_to_jsnumber):
-        (JSC::Interpreter::cti_op_in):
-        (JSC::Interpreter::cti_op_switch_imm):
-        (JSC::Interpreter::cti_op_switch_char):
-        (JSC::Interpreter::cti_op_switch_string):
-        (JSC::Interpreter::cti_op_del_by_val):
-        (JSC::Interpreter::cti_op_new_error):
-        (JSC::Interpreter::cti_vm_throw):
-        * interpreter/Interpreter.h:
-        (JSC::Interpreter::isJSArray):
-        (JSC::Interpreter::isJSString):
         * interpreter/Register.h:
-        (JSC::Register::):
-        (JSC::Register::Register):
-        (JSC::Register::jsValue):
-        (JSC::Register::getJSValue):
-        * jit/JIT.cpp:
-        (JSC::):
-        (JSC::JIT::compileOpStrictEq):
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileSlowCases):
-        * jit/JIT.h:
-        (JSC::):
-        (JSC::JIT::execute):
-        * jit/JITArithmetic.cpp:
-        (JSC::JIT::compileFastArith_op_rshift):
-        (JSC::JIT::compileFastArithSlow_op_rshift):
-        * jit/JITCall.cpp:
-        (JSC::JIT::unlinkCall):
-        (JSC::JIT::compileOpCallInitializeCallFrame):
-        (JSC::JIT::compileOpCall):
-        * jit/JITInlineMethods.h:
-        (JSC::JIT::emitGetVirtualRegister):
-        (JSC::JIT::getConstantOperand):
-        (JSC::JIT::isOperandConstant31BitImmediateInt):
-        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
-        (JSC::JIT::emitInitRegister):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::resizePropertyStorage):
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::patchGetByIdSelf):
-        (JSC::JIT::patchPutByIdReplace):
-        (JSC::JIT::privateCompileGetByIdSelf):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdSelfList):
-        (JSC::JIT::privateCompileGetByIdProtoList):
-        (JSC::JIT::privateCompileGetByIdChainList):
-        (JSC::JIT::privateCompileGetByIdChain):
-        (JSC::JIT::privateCompilePutByIdReplace):
-        * jsc.cpp:
-        (functionPrint):
-        (functionDebug):
-        (functionGC):
-        (functionVersion):
-        (functionRun):
-        (functionLoad):
-        (functionReadline):
-        (functionQuit):
-        * parser/Nodes.cpp:
-        (JSC::NullNode::emitBytecode):
-        (JSC::ArrayNode::emitBytecode):
-        (JSC::FunctionCallValueNode::emitBytecode):
-        (JSC::FunctionCallResolveNode::emitBytecode):
-        (JSC::VoidNode::emitBytecode):
-        (JSC::ConstDeclNode::emitCodeSingle):
-        (JSC::ReturnNode::emitBytecode):
-        (JSC::processClauseList):
-        (JSC::EvalNode::emitBytecode):
-        (JSC::FunctionBodyNode::emitBytecode):
-        (JSC::ProgramNode::emitBytecode):
-        * profiler/ProfileGenerator.cpp:
-        (JSC::ProfileGenerator::addParentForConsoleStart):
-        * profiler/Profiler.cpp:
-        (JSC::Profiler::willExecute):
-        (JSC::Profiler::didExecute):
-        (JSC::Profiler::createCallIdentifier):
-        * profiler/Profiler.h:
-        * runtime/ArgList.cpp:
-        (JSC::ArgList::slowAppend):
-        * runtime/ArgList.h:
-        (JSC::ArgList::at):
-        (JSC::ArgList::append):
-        * runtime/Arguments.cpp:
-        (JSC::Arguments::put):
-        * runtime/Arguments.h:
-        (JSC::Arguments::createStructure):
-        (JSC::asArguments):
-        * runtime/ArrayConstructor.cpp:
-        (JSC::callArrayConstructor):
-        * runtime/ArrayPrototype.cpp:
-        (JSC::getProperty):
-        (JSC::putProperty):
-        (JSC::arrayProtoFuncToString):
-        (JSC::arrayProtoFuncToLocaleString):
-        (JSC::arrayProtoFuncJoin):
-        (JSC::arrayProtoFuncConcat):
-        (JSC::arrayProtoFuncPop):
-        (JSC::arrayProtoFuncPush):
-        (JSC::arrayProtoFuncReverse):
-        (JSC::arrayProtoFuncShift):
-        (JSC::arrayProtoFuncSlice):
-        (JSC::arrayProtoFuncSort):
-        (JSC::arrayProtoFuncSplice):
-        (JSC::arrayProtoFuncUnShift):
-        (JSC::arrayProtoFuncFilter):
-        (JSC::arrayProtoFuncMap):
-        (JSC::arrayProtoFuncEvery):
-        (JSC::arrayProtoFuncForEach):
-        (JSC::arrayProtoFuncSome):
-        (JSC::arrayProtoFuncIndexOf):
-        (JSC::arrayProtoFuncLastIndexOf):
-        * runtime/BooleanConstructor.cpp:
-        (JSC::callBooleanConstructor):
-        (JSC::constructBooleanFromImmediateBoolean):
-        * runtime/BooleanConstructor.h:
-        * runtime/BooleanObject.h:
-        (JSC::asBooleanObject):
-        * runtime/BooleanPrototype.cpp:
-        (JSC::booleanProtoFuncToString):
-        (JSC::booleanProtoFuncValueOf):
-        * runtime/CallData.cpp:
-        (JSC::call):
-        * runtime/CallData.h:
-        * runtime/Collector.cpp:
-        (JSC::Heap::protect):
-        (JSC::Heap::unprotect):
-        (JSC::Heap::heap):
-        (JSC::Heap::collect):
-        * runtime/Collector.h:
-        * runtime/Completion.cpp:
-        (JSC::evaluate):
-        * runtime/Completion.h:
-        (JSC::Completion::Completion):
-        (JSC::Completion::value):
-        (JSC::Completion::setValue):
-        (JSC::Completion::isValueCompletion):
-        * runtime/ConstructData.cpp:
-        (JSC::construct):
-        * runtime/ConstructData.h:
-        * runtime/DateConstructor.cpp:
-        (JSC::constructDate):
-        (JSC::callDate):
-        (JSC::dateParse):
-        (JSC::dateNow):
-        (JSC::dateUTC):
-        * runtime/DateInstance.h:
-        (JSC::asDateInstance):
-        * runtime/DatePrototype.cpp:
-        (JSC::dateProtoFuncToString):
-        (JSC::dateProtoFuncToUTCString):
-        (JSC::dateProtoFuncToDateString):
-        (JSC::dateProtoFuncToTimeString):
-        (JSC::dateProtoFuncToLocaleString):
-        (JSC::dateProtoFuncToLocaleDateString):
-        (JSC::dateProtoFuncToLocaleTimeString):
-        (JSC::dateProtoFuncValueOf):
-        (JSC::dateProtoFuncGetTime):
-        (JSC::dateProtoFuncGetFullYear):
-        (JSC::dateProtoFuncGetUTCFullYear):
-        (JSC::dateProtoFuncToGMTString):
-        (JSC::dateProtoFuncGetMonth):
-        (JSC::dateProtoFuncGetUTCMonth):
-        (JSC::dateProtoFuncGetDate):
-        (JSC::dateProtoFuncGetUTCDate):
-        (JSC::dateProtoFuncGetDay):
-        (JSC::dateProtoFuncGetUTCDay):
-        (JSC::dateProtoFuncGetHours):
-        (JSC::dateProtoFuncGetUTCHours):
-        (JSC::dateProtoFuncGetMinutes):
-        (JSC::dateProtoFuncGetUTCMinutes):
-        (JSC::dateProtoFuncGetSeconds):
-        (JSC::dateProtoFuncGetUTCSeconds):
-        (JSC::dateProtoFuncGetMilliSeconds):
-        (JSC::dateProtoFuncGetUTCMilliseconds):
-        (JSC::dateProtoFuncGetTimezoneOffset):
-        (JSC::dateProtoFuncSetTime):
-        (JSC::setNewValueFromTimeArgs):
-        (JSC::setNewValueFromDateArgs):
-        (JSC::dateProtoFuncSetMilliSeconds):
-        (JSC::dateProtoFuncSetUTCMilliseconds):
-        (JSC::dateProtoFuncSetSeconds):
-        (JSC::dateProtoFuncSetUTCSeconds):
-        (JSC::dateProtoFuncSetMinutes):
-        (JSC::dateProtoFuncSetUTCMinutes):
-        (JSC::dateProtoFuncSetHours):
-        (JSC::dateProtoFuncSetUTCHours):
-        (JSC::dateProtoFuncSetDate):
-        (JSC::dateProtoFuncSetUTCDate):
-        (JSC::dateProtoFuncSetMonth):
-        (JSC::dateProtoFuncSetUTCMonth):
-        (JSC::dateProtoFuncSetFullYear):
-        (JSC::dateProtoFuncSetUTCFullYear):
-        (JSC::dateProtoFuncSetYear):
-        (JSC::dateProtoFuncGetYear):
-        * runtime/DatePrototype.h:
-        (JSC::DatePrototype::createStructure):
-        * runtime/ErrorConstructor.cpp:
-        (JSC::callErrorConstructor):
-        * runtime/ErrorPrototype.cpp:
-        (JSC::errorProtoFuncToString):
-        * runtime/ExceptionHelpers.cpp:
-        (JSC::createInterruptedExecutionException):
-        (JSC::createError):
-        (JSC::createStackOverflowError):
-        (JSC::createUndefinedVariableError):
-        (JSC::createErrorMessage):
-        (JSC::createInvalidParamError):
-        (JSC::createNotAConstructorError):
-        (JSC::createNotAFunctionError):
-        * runtime/ExceptionHelpers.h:
-        * runtime/FunctionConstructor.cpp:
-        (JSC::callFunctionConstructor):
-        * runtime/FunctionPrototype.cpp:
-        (JSC::callFunctionPrototype):
-        (JSC::functionProtoFuncToString):
-        (JSC::functionProtoFuncApply):
-        (JSC::functionProtoFuncCall):
-        * runtime/FunctionPrototype.h:
-        (JSC::FunctionPrototype::createStructure):
-        * runtime/GetterSetter.cpp:
-        (JSC::GetterSetter::toPrimitive):
-        (JSC::GetterSetter::getPrimitiveNumber):
-        * runtime/GetterSetter.h:
-        (JSC::asGetterSetter):
-        * runtime/InitializeThreading.cpp:
-        * runtime/InternalFunction.h:
-        (JSC::InternalFunction::createStructure):
-        (JSC::asInternalFunction):
-        * runtime/JSActivation.cpp:
-        (JSC::JSActivation::getOwnPropertySlot):
-        (JSC::JSActivation::put):
-        (JSC::JSActivation::putWithAttributes):
-        (JSC::JSActivation::argumentsGetter):
-        * runtime/JSActivation.h:
-        (JSC::JSActivation::createStructure):
-        (JSC::asActivation):
-        * runtime/JSArray.cpp:
-        (JSC::storageSize):
-        (JSC::JSArray::JSArray):
-        (JSC::JSArray::getOwnPropertySlot):
-        (JSC::JSArray::put):
-        (JSC::JSArray::putSlowCase):
-        (JSC::JSArray::deleteProperty):
-        (JSC::JSArray::getPropertyNames):
-        (JSC::JSArray::setLength):
-        (JSC::JSArray::pop):
-        (JSC::JSArray::push):
-        (JSC::JSArray::mark):
-        (JSC::JSArray::sort):
-        (JSC::JSArray::compactForSorting):
-        (JSC::JSArray::checkConsistency):
-        (JSC::constructArray):
-        * runtime/JSArray.h:
-        (JSC::JSArray::getIndex):
-        (JSC::JSArray::setIndex):
-        (JSC::JSArray::createStructure):
-        (JSC::asArray):
-        * runtime/JSCell.cpp:
-        (JSC::JSCell::put):
-        (JSC::JSCell::getJSNumber):
-        * runtime/JSCell.h:
-        (JSC::asCell):
-        (JSC::JSValue::asCell):
-        (JSC::JSValue::toPrimitive):
-        (JSC::JSValue::getPrimitiveNumber):
-        (JSC::JSValue::getJSNumber):
-        * runtime/JSFunction.cpp:
-        (JSC::JSFunction::call):
-        (JSC::JSFunction::argumentsGetter):
-        (JSC::JSFunction::callerGetter):
-        (JSC::JSFunction::lengthGetter):
-        (JSC::JSFunction::getOwnPropertySlot):
-        (JSC::JSFunction::put):
-        (JSC::JSFunction::construct):
-        * runtime/JSFunction.h:
-        (JSC::JSFunction::createStructure):
-        (JSC::asFunction):
-        * runtime/JSGlobalData.h:
-        * runtime/JSGlobalObject.cpp:
-        (JSC::markIfNeeded):
-        (JSC::JSGlobalObject::put):
-        (JSC::JSGlobalObject::putWithAttributes):
-        (JSC::JSGlobalObject::reset):
-        (JSC::JSGlobalObject::resetPrototype):
-        * runtime/JSGlobalObject.h:
-        (JSC::JSGlobalObject::createStructure):
-        (JSC::JSGlobalObject::GlobalPropertyInfo::GlobalPropertyInfo):
-        (JSC::asGlobalObject):
-        (JSC::Structure::prototypeForLookup):
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::encode):
-        (JSC::decode):
-        (JSC::globalFuncEval):
-        (JSC::globalFuncParseInt):
-        (JSC::globalFuncParseFloat):
-        (JSC::globalFuncIsNaN):
-        (JSC::globalFuncIsFinite):
-        (JSC::globalFuncDecodeURI):
-        (JSC::globalFuncDecodeURIComponent):
-        (JSC::globalFuncEncodeURI):
-        (JSC::globalFuncEncodeURIComponent):
-        (JSC::globalFuncEscape):
-        (JSC::globalFuncUnescape):
-        (JSC::globalFuncJSCPrint):
-        * runtime/JSGlobalObjectFunctions.h:
-        * runtime/JSImmediate.cpp:
-        (JSC::JSImmediate::toThisObject):
-        (JSC::JSImmediate::toObject):
-        (JSC::JSImmediate::prototype):
-        (JSC::JSImmediate::toString):
-        * runtime/JSImmediate.h:
-        (JSC::JSImmediate::isImmediate):
-        (JSC::JSImmediate::isNumber):
-        (JSC::JSImmediate::isPositiveNumber):
-        (JSC::JSImmediate::isBoolean):
-        (JSC::JSImmediate::isUndefinedOrNull):
-        (JSC::JSImmediate::isNegative):
-        (JSC::JSImmediate::isEitherImmediate):
-        (JSC::JSImmediate::isAnyImmediate):
-        (JSC::JSImmediate::areBothImmediate):
-        (JSC::JSImmediate::areBothImmediateNumbers):
-        (JSC::JSImmediate::andImmediateNumbers):
-        (JSC::JSImmediate::xorImmediateNumbers):
-        (JSC::JSImmediate::orImmediateNumbers):
-        (JSC::JSImmediate::rightShiftImmediateNumbers):
-        (JSC::JSImmediate::canDoFastAdditiveOperations):
-        (JSC::JSImmediate::addImmediateNumbers):
-        (JSC::JSImmediate::subImmediateNumbers):
-        (JSC::JSImmediate::incImmediateNumber):
-        (JSC::JSImmediate::decImmediateNumber):
-        (JSC::JSImmediate::makeValue):
-        (JSC::JSImmediate::makeInt):
-        (JSC::JSImmediate::makeBool):
-        (JSC::JSImmediate::makeUndefined):
-        (JSC::JSImmediate::makeNull):
-        (JSC::JSImmediate::intValue):
-        (JSC::JSImmediate::uintValue):
-        (JSC::JSImmediate::boolValue):
-        (JSC::JSImmediate::rawValue):
-        (JSC::JSImmediate::trueImmediate):
-        (JSC::JSImmediate::falseImmediate):
-        (JSC::JSImmediate::undefinedImmediate):
-        (JSC::JSImmediate::nullImmediate):
-        (JSC::JSImmediate::zeroImmediate):
-        (JSC::JSImmediate::oneImmediate):
-        (JSC::JSImmediate::impossibleValue):
-        (JSC::JSImmediate::toBoolean):
-        (JSC::JSImmediate::getTruncatedUInt32):
-        (JSC::JSImmediate::from):
-        (JSC::JSImmediate::getTruncatedInt32):
-        (JSC::JSImmediate::toDouble):
-        (JSC::JSImmediate::getUInt32):
-        (JSC::jsNull):
-        (JSC::jsBoolean):
-        (JSC::jsUndefined):
-        (JSC::JSValue::isUndefined):
-        (JSC::JSValue::isNull):
-        (JSC::JSValue::isUndefinedOrNull):
-        (JSC::JSValue::isBoolean):
-        (JSC::JSValue::getBoolean):
-        (JSC::JSValue::toInt32):
-        (JSC::JSValue::toUInt32):
-        (JSC::toInt32):
-        (JSC::toUInt32):
-        * runtime/JSNotAnObject.cpp:
-        (JSC::JSNotAnObject::toPrimitive):
-        (JSC::JSNotAnObject::getPrimitiveNumber):
-        (JSC::JSNotAnObject::put):
-        * runtime/JSNotAnObject.h:
-        (JSC::JSNotAnObject::createStructure):
-        * runtime/JSNumberCell.cpp:
-        (JSC::JSNumberCell::toPrimitive):
-        (JSC::JSNumberCell::getPrimitiveNumber):
-        (JSC::JSNumberCell::getJSNumber):
-        (JSC::jsNumberCell):
-        (JSC::jsNaN):
-        * runtime/JSNumberCell.h:
-        (JSC::JSNumberCell::createStructure):
-        (JSC::asNumberCell):
-        (JSC::jsNumber):
-        (JSC::JSValue::toJSNumber):
-        * runtime/JSObject.cpp:
-        (JSC::JSObject::mark):
-        (JSC::JSObject::put):
-        (JSC::JSObject::putWithAttributes):
-        (JSC::callDefaultValueFunction):
-        (JSC::JSObject::getPrimitiveNumber):
-        (JSC::JSObject::defaultValue):
-        (JSC::JSObject::defineGetter):
-        (JSC::JSObject::defineSetter):
-        (JSC::JSObject::lookupGetter):
-        (JSC::JSObject::lookupSetter):
-        (JSC::JSObject::hasInstance):
-        (JSC::JSObject::toNumber):
-        (JSC::JSObject::toString):
-        (JSC::JSObject::fillGetterPropertySlot):
-        * runtime/JSObject.h:
-        (JSC::JSObject::getDirect):
-        (JSC::JSObject::getDirectLocation):
-        (JSC::JSObject::offsetForLocation):
-        (JSC::JSObject::locationForOffset):
-        (JSC::JSObject::getDirectOffset):
-        (JSC::JSObject::putDirectOffset):
-        (JSC::JSObject::createStructure):
-        (JSC::asObject):
-        (JSC::JSObject::prototype):
-        (JSC::JSObject::setPrototype):
-        (JSC::JSObject::inlineGetOwnPropertySlot):
-        (JSC::JSObject::getOwnPropertySlotForWrite):
-        (JSC::JSObject::getPropertySlot):
-        (JSC::JSObject::get):
-        (JSC::JSObject::putDirect):
-        (JSC::JSObject::putDirectWithoutTransition):
-        (JSC::JSObject::toPrimitive):
-        (JSC::JSValue::get):
-        (JSC::JSValue::put):
-        (JSC::JSObject::allocatePropertyStorageInline):
-        * runtime/JSPropertyNameIterator.cpp:
-        (JSC::JSPropertyNameIterator::toPrimitive):
-        (JSC::JSPropertyNameIterator::getPrimitiveNumber):
-        * runtime/JSPropertyNameIterator.h:
-        (JSC::JSPropertyNameIterator::create):
-        (JSC::JSPropertyNameIterator::next):
-        * runtime/JSStaticScopeObject.cpp:
-        (JSC::JSStaticScopeObject::put):
-        (JSC::JSStaticScopeObject::putWithAttributes):
-        * runtime/JSStaticScopeObject.h:
-        (JSC::JSStaticScopeObject::JSStaticScopeObject):
-        (JSC::JSStaticScopeObject::createStructure):
-        * runtime/JSString.cpp:
-        (JSC::JSString::toPrimitive):
-        (JSC::JSString::getPrimitiveNumber):
-        (JSC::JSString::getOwnPropertySlot):
-        * runtime/JSString.h:
-        (JSC::JSString::createStructure):
-        (JSC::asString):
-        * runtime/JSValue.h:
-        (JSC::JSValuePtr::makeImmediate):
-        (JSC::JSValuePtr::immediateValue):
-        (JSC::JSValuePtr::JSValuePtr):
-        (JSC::JSValuePtr::operator->):
-        (JSC::JSValuePtr::hasValue):
-        (JSC::JSValuePtr::operator==):
-        (JSC::JSValuePtr::operator!=):
-        (JSC::JSValuePtr::encode):
-        (JSC::JSValuePtr::decode):
-        (JSC::JSValue::asValue):
-        (JSC::noValue):
-        (JSC::operator==):
-        (JSC::operator!=):
-        * runtime/JSVariableObject.h:
-        (JSC::JSVariableObject::symbolTablePut):
-        (JSC::JSVariableObject::symbolTablePutWithAttributes):
-        * runtime/JSWrapperObject.cpp:
-        (JSC::JSWrapperObject::mark):
-        * runtime/JSWrapperObject.h:
-        (JSC::JSWrapperObject::internalValue):
-        (JSC::JSWrapperObject::setInternalValue):
-        * runtime/Lookup.cpp:
-        (JSC::setUpStaticFunctionSlot):
-        * runtime/Lookup.h:
-        (JSC::lookupPut):
-        * runtime/MathObject.cpp:
-        (JSC::mathProtoFuncAbs):
-        (JSC::mathProtoFuncACos):
-        (JSC::mathProtoFuncASin):
-        (JSC::mathProtoFuncATan):
-        (JSC::mathProtoFuncATan2):
-        (JSC::mathProtoFuncCeil):
-        (JSC::mathProtoFuncCos):
-        (JSC::mathProtoFuncExp):
-        (JSC::mathProtoFuncFloor):
-        (JSC::mathProtoFuncLog):
-        (JSC::mathProtoFuncMax):
-        (JSC::mathProtoFuncMin):
-        (JSC::mathProtoFuncPow):
-        (JSC::mathProtoFuncRandom):
-        (JSC::mathProtoFuncRound):
-        (JSC::mathProtoFuncSin):
-        (JSC::mathProtoFuncSqrt):
-        (JSC::mathProtoFuncTan):
-        * runtime/MathObject.h:
-        (JSC::MathObject::createStructure):
-        * runtime/NativeErrorConstructor.cpp:
-        (JSC::callNativeErrorConstructor):
-        * runtime/NumberConstructor.cpp:
-        (JSC::numberConstructorNaNValue):
-        (JSC::numberConstructorNegInfinity):
-        (JSC::numberConstructorPosInfinity):
-        (JSC::numberConstructorMaxValue):
-        (JSC::numberConstructorMinValue):
-        (JSC::callNumberConstructor):
-        * runtime/NumberConstructor.h:
-        (JSC::NumberConstructor::createStructure):
-        * runtime/NumberObject.cpp:
-        (JSC::NumberObject::getJSNumber):
-        (JSC::constructNumberFromImmediateNumber):
-        * runtime/NumberObject.h:
-        * runtime/NumberPrototype.cpp:
-        (JSC::numberProtoFuncToString):
-        (JSC::numberProtoFuncToLocaleString):
-        (JSC::numberProtoFuncValueOf):
-        (JSC::numberProtoFuncToFixed):
-        (JSC::numberProtoFuncToExponential):
-        (JSC::numberProtoFuncToPrecision):
-        * runtime/ObjectConstructor.cpp:
-        (JSC::constructObject):
-        (JSC::callObjectConstructor):
-        * runtime/ObjectPrototype.cpp:
-        (JSC::objectProtoFuncValueOf):
-        (JSC::objectProtoFuncHasOwnProperty):
-        (JSC::objectProtoFuncIsPrototypeOf):
-        (JSC::objectProtoFuncDefineGetter):
-        (JSC::objectProtoFuncDefineSetter):
-        (JSC::objectProtoFuncLookupGetter):
-        (JSC::objectProtoFuncLookupSetter):
-        (JSC::objectProtoFuncPropertyIsEnumerable):
-        (JSC::objectProtoFuncToLocaleString):
-        (JSC::objectProtoFuncToString):
-        * runtime/ObjectPrototype.h:
-        * runtime/Operations.cpp:
-        (JSC::equal):
-        (JSC::equalSlowCase):
-        (JSC::strictEqual):
-        (JSC::strictEqualSlowCase):
-        (JSC::throwOutOfMemoryError):
-        * runtime/Operations.h:
-        (JSC::equalSlowCaseInline):
-        (JSC::strictEqualSlowCaseInline):
-        * runtime/PropertySlot.cpp:
-        (JSC::PropertySlot::functionGetter):
-        * runtime/PropertySlot.h:
-        (JSC::PropertySlot::PropertySlot):
-        (JSC::PropertySlot::getValue):
-        (JSC::PropertySlot::putValue):
-        (JSC::PropertySlot::setValueSlot):
-        (JSC::PropertySlot::setValue):
-        (JSC::PropertySlot::setCustom):
-        (JSC::PropertySlot::setCustomIndex):
-        (JSC::PropertySlot::slotBase):
-        (JSC::PropertySlot::setBase):
-        (JSC::PropertySlot::):
-        * runtime/Protect.h:
-        (JSC::gcProtect):
-        (JSC::gcUnprotect):
-        (JSC::ProtectedPtr::ProtectedPtr):
-        (JSC::ProtectedPtr::operator JSValuePtr):
-        (JSC::ProtectedJSValuePtr::ProtectedJSValuePtr):
-        (JSC::ProtectedJSValuePtr::get):
-        (JSC::ProtectedJSValuePtr::operator JSValuePtr):
-        (JSC::ProtectedJSValuePtr::operator->):
-        (JSC::::ProtectedPtr):
-        (JSC::::~ProtectedPtr):
-        (JSC::::operator):
-        (JSC::ProtectedJSValuePtr::~ProtectedJSValuePtr):
-        (JSC::ProtectedJSValuePtr::operator=):
-        (JSC::operator==):
-        (JSC::operator!=):
-        * runtime/RegExpConstructor.cpp:
-        (JSC::RegExpConstructor::getBackref):
-        (JSC::RegExpConstructor::getLastParen):
-        (JSC::RegExpConstructor::getLeftContext):
-        (JSC::RegExpConstructor::getRightContext):
-        (JSC::regExpConstructorDollar1):
-        (JSC::regExpConstructorDollar2):
-        (JSC::regExpConstructorDollar3):
-        (JSC::regExpConstructorDollar4):
-        (JSC::regExpConstructorDollar5):
-        (JSC::regExpConstructorDollar6):
-        (JSC::regExpConstructorDollar7):
-        (JSC::regExpConstructorDollar8):
-        (JSC::regExpConstructorDollar9):
-        (JSC::regExpConstructorInput):
-        (JSC::regExpConstructorMultiline):
-        (JSC::regExpConstructorLastMatch):
-        (JSC::regExpConstructorLastParen):
-        (JSC::regExpConstructorLeftContext):
-        (JSC::regExpConstructorRightContext):
-        (JSC::RegExpConstructor::put):
-        (JSC::setRegExpConstructorInput):
-        (JSC::setRegExpConstructorMultiline):
-        (JSC::constructRegExp):
-        (JSC::callRegExpConstructor):
-        * runtime/RegExpConstructor.h:
-        (JSC::RegExpConstructor::createStructure):
-        (JSC::asRegExpConstructor):
-        * runtime/RegExpMatchesArray.h:
-        (JSC::RegExpMatchesArray::put):
-        * runtime/RegExpObject.cpp:
-        (JSC::regExpObjectGlobal):
-        (JSC::regExpObjectIgnoreCase):
-        (JSC::regExpObjectMultiline):
-        (JSC::regExpObjectSource):
-        (JSC::regExpObjectLastIndex):
-        (JSC::RegExpObject::put):
-        (JSC::setRegExpObjectLastIndex):
-        (JSC::RegExpObject::test):
-        (JSC::RegExpObject::exec):
-        (JSC::callRegExpObject):
-        * runtime/RegExpObject.h:
-        (JSC::RegExpObject::createStructure):
-        (JSC::asRegExpObject):
-        * runtime/RegExpPrototype.cpp:
-        (JSC::regExpProtoFuncTest):
-        (JSC::regExpProtoFuncExec):
-        (JSC::regExpProtoFuncCompile):
-        (JSC::regExpProtoFuncToString):
-        * runtime/StringConstructor.cpp:
-        (JSC::stringFromCharCodeSlowCase):
-        (JSC::stringFromCharCode):
-        (JSC::callStringConstructor):
-        * runtime/StringObject.cpp:
-        (JSC::StringObject::put):
-        * runtime/StringObject.h:
-        (JSC::StringObject::createStructure):
-        (JSC::asStringObject):
-        * runtime/StringObjectThatMasqueradesAsUndefined.h:
-        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
-        * runtime/StringPrototype.cpp:
-        (JSC::stringProtoFuncReplace):
-        (JSC::stringProtoFuncToString):
-        (JSC::stringProtoFuncCharAt):
-        (JSC::stringProtoFuncCharCodeAt):
-        (JSC::stringProtoFuncConcat):
-        (JSC::stringProtoFuncIndexOf):
-        (JSC::stringProtoFuncLastIndexOf):
-        (JSC::stringProtoFuncMatch):
-        (JSC::stringProtoFuncSearch):
-        (JSC::stringProtoFuncSlice):
-        (JSC::stringProtoFuncSplit):
-        (JSC::stringProtoFuncSubstr):
-        (JSC::stringProtoFuncSubstring):
-        (JSC::stringProtoFuncToLowerCase):
-        (JSC::stringProtoFuncToUpperCase):
-        (JSC::stringProtoFuncLocaleCompare):
-        (JSC::stringProtoFuncBig):
-        (JSC::stringProtoFuncSmall):
-        (JSC::stringProtoFuncBlink):
-        (JSC::stringProtoFuncBold):
-        (JSC::stringProtoFuncFixed):
-        (JSC::stringProtoFuncItalics):
-        (JSC::stringProtoFuncStrike):
-        (JSC::stringProtoFuncSub):
-        (JSC::stringProtoFuncSup):
-        (JSC::stringProtoFuncFontcolor):
-        (JSC::stringProtoFuncFontsize):
-        (JSC::stringProtoFuncAnchor):
-        (JSC::stringProtoFuncLink):
-        * runtime/Structure.cpp:
-        (JSC::Structure::Structure):
-        (JSC::Structure::changePrototypeTransition):
-        (JSC::Structure::createCachedPrototypeChain):
-        * runtime/Structure.h:
-        (JSC::Structure::create):
-        (JSC::Structure::setPrototypeWithoutTransition):
-        (JSC::Structure::storedPrototype):
 
-2009-01-06  Oliver Hunt  <oliver@apple.com>
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        Reviewed by Cameron Zwarich.
-
-        <https://bugs.webkit.org/show_bug.cgi?id=23085> [jsfunfuzz] Over released ScopeChainNode
-        <rdar://problem/6474110>
-
-        So this delightful bug was caused by our unwind code using a ScopeChain to perform
-        the unwind.  The ScopeChain would ref the initial top of the scope chain, then deref
-        the resultant top of scope chain, which is incorrect.
-
-        This patch removes the dependency on ScopeChain for the unwind, and i've filed
-        <https://bugs.webkit.org/show_bug.cgi?id=23144> to look into the unintuitive
-        ScopeChain behaviour.
-
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::throwException):
-
-2009-01-06  Adam Roben  <aroben@apple.com>
-
-        Hopeful Windows crash-on-launch fix
-
-        * wtf/Platform.h: Force a world rebuild by touching this file.
-
-2009-01-06  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by NOBODY (Build fix).
-
-        * GNUmakefile.am:Add ByteArray.cpp too
-
-2009-01-06  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by NOBODY (Speculative build fix).
-
-        AllInOneFile.cpp does not include the JSByteArray.cpp include it...
-
-        * GNUmakefile.am:
-
-2009-01-05  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by NOBODY (Build fix).
-
-        Fix Wx build
-
-        * JavaScriptCoreSources.bkl:
-
-2009-01-05  Oliver Hunt  <oliver@apple.com>
-
-        Windows build fixes
-
-        Rubber-stamped by Alice Liu.
-
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::Interpreter):
-        * runtime/ByteArray.cpp:
-        (JSC::ByteArray::create):
-        * runtime/ByteArray.h:
-
-2009-01-05  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        CanvasPixelArray performance is too slow 
-        <https://bugs.webkit.org/show_bug.cgi?id=23123>
-
-        The fix to this is to devirtualise get and put in a manner similar to
-        JSString and JSArray.  To do this I've added a ByteArray implementation
-        and JSByteArray wrapper to JSC.  We can then do vptr comparisons to
-        devirtualise the calls.
-
-        This devirtualisation improves performance by 1.5-2x in my somewhat ad
-        hoc tests.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.exp:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.scons:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::Interpreter):
-        (JSC::Interpreter::privateExecute):
-        (JSC::Interpreter::cti_op_get_by_val):
-        (JSC::Interpreter::cti_op_put_by_val):
-        * interpreter/Interpreter.h:
-        (JSC::Interpreter::isJSByteArray):
-        * runtime/ByteArray.cpp: Added.
-        (JSC::ByteArray::create):
-        * runtime/ByteArray.h: Added.
-        (JSC::ByteArray::length):
-        (JSC::ByteArray::set):
-        (JSC::ByteArray::get):
-        (JSC::ByteArray::data):
-        (JSC::ByteArray::ByteArray):
-        * runtime/JSByteArray.cpp: Added.
-        (JSC::):
-        (JSC::JSByteArray::JSByteArray):
-        (JSC::JSByteArray::createStructure):
-        (JSC::JSByteArray::getOwnPropertySlot):
-        (JSC::JSByteArray::put):
-        (JSC::JSByteArray::getPropertyNames):
-        * runtime/JSByteArray.h: Added.
-        (JSC::JSByteArray::canAccessIndex):
-        (JSC::JSByteArray::getIndex):
-        (JSC::JSByteArray::setIndex):
-        (JSC::JSByteArray::classInfo):
-        (JSC::JSByteArray::length):
-        (JSC::JSByteArray::):
-        (JSC::JSByteArray::JSByteArray):
-        (JSC::asByteArray):
-
-2009-01-05  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23073
-        <rdar://problem/6471129> Workers crash on Windows Release builds
-
-        * wtf/ThreadSpecific.h:
-        (WTF::ThreadSpecific::destroy): Changed to clear the pointer only after data object
-        destruction is finished - otherwise, WebCore::ThreadGlobalData destructor was re-creating
-        the object in order to access atomic string table.
-        (WTF::ThreadSpecific::operator T*): Symmetrically, set up the per-thread pointer before
-        data constructor is called.
-
-        * wtf/ThreadingWin.cpp: (WTF::wtfThreadEntryPoint): Remove a Windows-only hack to finalize
-        a thread - pthreadVC2 is a DLL, so it gets thread detached messages, and cleans up thread
-        specific data automatically. Besides, this code wasn't even compiled in for some time now.
-
-2009-01-05  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23115
-        Create a version of ASSERT for use with otherwise unused variables
-
-        * wtf/Assertions.h: Added ASSERT_UNUSED.
-
-        * jit/ExecutableAllocatorPosix.cpp:
-        (JSC::ExecutablePool::systemRelease):
-        * runtime/Collector.cpp:
-        (JSC::Heap::destroy):
-        (JSC::Heap::heapAllocate):
-        * runtime/JSNotAnObject.cpp:
-        (JSC::JSNotAnObject::toPrimitive):
-        (JSC::JSNotAnObject::getPrimitiveNumber):
-        (JSC::JSNotAnObject::toBoolean):
-        (JSC::JSNotAnObject::toNumber):
-        (JSC::JSNotAnObject::toString):
-        (JSC::JSNotAnObject::getOwnPropertySlot):
-        (JSC::JSNotAnObject::put):
-        (JSC::JSNotAnObject::deleteProperty):
-        (JSC::JSNotAnObject::getPropertyNames):
-        * wtf/TCSystemAlloc.cpp:
-        (TCMalloc_SystemRelease):
-        Use it in some places that used other idioms for this purpose.
-
-2009-01-04  Alice Liu  <alice.liu@apple.com>
-
-        <rdar://problem/6341776> Merge m_transitionCount and m_offset in Structure.
-
-        Reviewed by Darin Adler.
-
-        * runtime/Structure.cpp:
-        (JSC::Structure::Structure): Remove m_transitionCount
-        (JSC::Structure::addPropertyTransitionToExistingStructure): No need to wait until after the assignment to offset to assert if it's notFound; move it up.
-        (JSC::Structure::addPropertyTransition): Use method for transitionCount instead of m_transitionCount. Remove line that maintains the m_transitionCount.
-        (JSC::Structure::changePrototypeTransition): Remove line that maintains the m_transitionCount.
-        (JSC::Structure::getterSetterTransition): Remove line that maintains the m_transitionCount.
-        * runtime/Structure.h:
-        Changed s_maxTransitionLength and m_offset from size_t to signed char.  m_offset will never become greater than 64 
-        because the structure transitions to a dictionary at that time.
-        (JSC::Structure::transitionCount): method to replace the data member
-
-2009-01-04  Darin Adler  <darin@apple.com>
-
-        Reviewed by David Kilzer.
-
-        Bug 15114: Provide compile-time assertions for sizeof(UChar), sizeof(DeprecatedChar), etc.
-        https://bugs.webkit.org/show_bug.cgi?id=15114
-
-        * wtf/unicode/Unicode.h: Assert size of UChar. There is no DeprecatedChar any more.
-
-2009-01-03  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Oliver Hunt.
+        Reviewed by Maciej Stachowiak.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26677
 
-        Change the pcVector from storing native code pointers to storing offsets
-        from the base pointer. This will allow us to generate the pcVector on demand
-        for exceptions.
+        Inherits CodeBlock class from FastAllocBase because it
+        has been instantiated by 'new' in JavaScriptCore/bytecode/CodeBlock.h:217.
 
         * bytecode/CodeBlock.h:
-        (JSC::PC::PC):
-        (JSC::getNativePCOffset):
-        (JSC::CodeBlock::getBytecodeIndex):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompile):
 
-2009-01-02  Oliver Hunt  <oliver@apple.com>
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        Reviewed by NOBODY (Build fix).
+        Reviewed by Maciej Stachowiak.
         
-        * runtime/ScopeChain.cpp:
-
-2009-01-02  Oliver Hunt  <oliver@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=26676
 
-        Reviewed by Gavin Barraclough.
-
-        [jsfunfuzz] unwind logic for exceptions in eval fails to account for dynamic scope external to the eval
-        https://bugs.webkit.org/show_bug.cgi?id=23078
-
-        This bug was caused by eval codeblocks being generated without accounting
-        for the depth of the scope chain they inherited.  This meant that exception
-        handlers would understate their expected scope chain depth, which in turn
-        led to incorrectly removing nodes from the scope chain.
+        Inherits BytecodeGenerator class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/parser/Nodes.cpp:1892.
 
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        (JSC::BytecodeGenerator::emitCatch):
         * bytecompiler/BytecodeGenerator.h:
-        * interpreter/Interpreter.cpp:
-        (JSC::depth):
-        * runtime/ScopeChain.cpp:
-        (JSC::ScopeChain::localDepth):
-        * runtime/ScopeChain.h:
-        (JSC::ScopeChainNode::deref):
-        (JSC::ScopeChainNode::ref):
 
-2009-01-02  David Smith  <catfish.man@gmail.com>
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-        Reviewed by Darin Adler.
+        Reviewed by Maciej Stachowiak.
         
-        https://bugs.webkit.org/show_bug.cgi?id=22699
-        Enable NodeList caching for getElementsByTagName
-
-        * wtf/HashFunctions.h: Moved the definition of PHI here and renamed to stringHashingStartValue
-
-2009-01-02  David Kilzer  <ddkilzer@apple.com>
-
-        Attempt to fix Qt Linux build after r39553
-
-        * wtf/RandomNumberSeed.h: Include <sys/time.h> for gettimeofday().
-        Include <sys/types.h> and <unistd.h> for getpid().
+        https://bugs.webkit.org/show_bug.cgi?id=26675
 
-2009-01-02  David Kilzer  <ddkilzer@apple.com>
+        Inherits Register class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/JSVariableObject.h:149.
 
-        Bug 23081: These files are no longer part of the KDE libraries
-
-        <https://bugs.webkit.org/show_bug.cgi?id=23081>
-
-        Reviewed by Darin Adler.
-
-        Removed "This file is part of the KDE libraries" comment from
-        source files.  Added or updated Apple copyrights as well.
-
-        * parser/Lexer.h:
-        * wtf/HashCountedSet.h:
-        * wtf/RetainPtr.h:
-        * wtf/VectorTraits.h:
-
-2009-01-02  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 23080: Remove last vestiges of KJS references
+        * interpreter/Register.h:
 
-        <https://bugs.webkit.org/show_bug.cgi?id=23080>
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
         Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26674
 
-        Also updated Apple copyright statements.
-
-        * DerivedSources.make: Changed bison "kjsyy" prefix to "jscyy".
-        * GNUmakefile.am: Ditto.
-        * JavaScriptCore.pri: Ditto.  Also changed KJSBISON to JSCBISON
-        and kjsbison to jscbison.
-
-        * JavaScriptCoreSources.bkl: Changed JSCORE_KJS_SOURCES to
-        JSCORE_JSC_SOURCES.
-        * jscore.bkl: Ditto.
-
-        * create_hash_table: Updated copyright and removed old comment.
-
-        * parser/Grammar.y: Changed "kjsyy" prefix to "jscyy" prefix.
-        * parser/Lexer.cpp: Ditto.  Also changed KJS_DEBUG_LEX to
-        JSC_DEBUG_LEX.
-        (jscyylex):
-        (JSC::Lexer::lex):
-        * parser/Parser.cpp: Ditto.
-        (JSC::Parser::parse):
-
-        * pcre/dftables: Changed "kjs_pcre_" prefix to "jsc_pcre_".
-        * pcre/pcre_compile.cpp: Ditto.
-        (getOthercaseRange):
-        (encodeUTF8):
-        (compileBranch):
-        (calculateCompiledPatternLength):
-        * pcre/pcre_exec.cpp: Ditto.
-        (matchRef):
-        (getUTF8CharAndIncrementLength):
-        (match):
-        * pcre/pcre_internal.h: Ditto.
-        (toLowerCase):
-        (flipCase):
-        (classBitmapForChar):
-        (charTypeForChar):
-        * pcre/pcre_tables.cpp: Ditto.
-        * pcre/pcre_ucp_searchfuncs.cpp: Ditto.
-        (jsc_pcre_ucp_othercase):
-        * pcre/pcre_xclass.cpp: Ditto.
-        (getUTF8CharAndAdvancePointer):
-        (jsc_pcre_xclass):
-
-        * runtime/Collector.h: Updated header guards using the
-        clean-header-guards script.
-        * runtime/CollectorHeapIterator.h: Added missing header guard.
-        * runtime/Identifier.h: Updated header guards.
-        * runtime/JSFunction.h: Fixed end-of-namespace comment.
-
-        * runtime/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::reset): Renamed "kjsprint" debug function
-        to "jscprint".  Changed implementation method from
-        globalFuncKJSPrint() to globalFuncJSCPrint().
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::globalFuncJSCPrint): Renamed from globalFuncKJSPrint().
-        * runtime/JSGlobalObjectFunctions.h: Ditto.
-
-        * runtime/JSImmediate.h: Updated header guards.
-        * runtime/JSLock.h: Ditto.
-        * runtime/JSType.h: Ditto.
-        * runtime/JSWrapperObject.h: Ditto.
-        * runtime/Lookup.h: Ditto.
-        * runtime/Operations.h: Ditto.
-        * runtime/Protect.h: Ditto.
-        * runtime/RegExp.h: Ditto.
-        * runtime/UString.h: Ditto.
-
-        * tests/mozilla/js1_5/Array/regress-157652.js: Changed "KJS"
-        reference in comment to "JSC".
-
-        * wrec/CharacterClassConstructor.cpp: Change "kjs_pcre_" function
-        prefixes to "jsc_pcre_".
-        (JSC::WREC::CharacterClassConstructor::put):
-        (JSC::WREC::CharacterClassConstructor::flush):
-
-        * wtf/unicode/Unicode.h: Change "KJS_" header guard to "WTF_".
-        * wtf/unicode/icu/UnicodeIcu.h: Ditto.
-        * wtf/unicode/qt4/UnicodeQt4.h: Ditto.
-
-2009-01-02  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Make randomNumber generate 2^53 values instead of 2^32 (or 2^31 for rand() platforms)
-
-        * wtf/RandomNumber.cpp:
-        (WTF::randomNumber):
-
-2009-01-02  David Kilzer  <ddkilzer@apple.com>
-
-        Remove declaration for JSC::Identifier::initializeIdentifierThreading()
-
-        Reviewed by Alexey Proskuryakov.
-
-        * runtime/Identifier.h:
-        (JSC::Identifier::initializeIdentifierThreading): Removed
-        declaration since the implementation was removed in r34412.
-
-2009-01-01  Darin Adler  <darin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        String.replace does not support $& replacement metacharacter when search term is not a RegExp
-        <https://bugs.webkit.org/show_bug.cgi?id=21431>
-        <rdar://problem/6274993>
-
-        Test: fast/js/string-replace-3.html
+        Inherits HashMap class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/Structure.cpp:458.
 
-        * runtime/StringPrototype.cpp:
-        (JSC::substituteBackreferences): Added a null check here so we won't try to handle $$-$9
-        backreferences when the search term is a string, not a RegExp. Added a check for 0 so we
-        won't try to handle $0 or $00 as a backreference.
-        (JSC::stringProtoFuncReplace): Added a call to substituteBackreferences.
+        * wtf/HashMap.h:
 
-2009-01-01  Gavin Barraclough  <barraclough@apple.com>
+2009-06-24  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Darin Adler.
 
-        Allow 32-bit integers to be stored in JSImmediates, on x64-bit.
-        Presently the top 32-bits of a 64-bit JSImmediate serve as a sign extension of a 31-bit
-        int stored in the low word (shifted left by one, to make room for a tag).  In the new
-        format, the top 31-bits serve as a sign extension of a 32-bit int, still shifted left by
-        one.
-
-        The new behavior is enabled using a flag in Platform.h, 'WTF_USE_ALTERNATE_JSIMMEDIATE'.
-        When this is set the constants defining the range of ints allowed to be stored as
-        JSImmediate values is extended.  The code in JSImmediate.h can safely operate on either
-        format.  This patch updates the JIT so that it can also operate with the new format.
+        <rdar://problem/6940519> REGRESSION (Safari 4 Public Beta - TOT): google.com/adplanner shows blank page instead of site details in "basic research'
 
-        ~2% progression on x86-64, with & without the JIT, on sunspider & v8 tests.
-
-        * assembler/MacroAssembler.h:
-        (JSC::MacroAssembler::addPtr):
-        (JSC::MacroAssembler::orPtr):
-        (JSC::MacroAssembler::or32):
-        (JSC::MacroAssembler::rshiftPtr):
-        (JSC::MacroAssembler::rshift32):
-        (JSC::MacroAssembler::subPtr):
-        (JSC::MacroAssembler::xorPtr):
-        (JSC::MacroAssembler::xor32):
-        (JSC::MacroAssembler::move):
-        (JSC::MacroAssembler::compareImm64ForBranch):
-        (JSC::MacroAssembler::compareImm64ForBranchEquality):
-        (JSC::MacroAssembler::jePtr):
-        (JSC::MacroAssembler::jgePtr):
-        (JSC::MacroAssembler::jlPtr):
-        (JSC::MacroAssembler::jlePtr):
-        (JSC::MacroAssembler::jnePtr):
-        (JSC::MacroAssembler::jnzSubPtr):
-        (JSC::MacroAssembler::joAddPtr):
-        (JSC::MacroAssembler::jzSubPtr):
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::addq_rr):
-        (JSC::X86Assembler::orq_ir):
-        (JSC::X86Assembler::subq_ir):
-        (JSC::X86Assembler::xorq_rr):
-        (JSC::X86Assembler::sarq_CLr):
-        (JSC::X86Assembler::sarq_i8r):
-        (JSC::X86Assembler::cmpq_ir):
-        * jit/JIT.cpp:
-        (JSC::JIT::compileOpStrictEq):
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileSlowCases):
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JIT.h:
-        * jit/JITArithmetic.cpp:
-        (JSC::JIT::compileFastArith_op_lshift):
-        (JSC::JIT::compileFastArithSlow_op_lshift):
-        (JSC::JIT::compileFastArith_op_rshift):
-        (JSC::JIT::compileFastArithSlow_op_rshift):
-        (JSC::JIT::compileFastArith_op_bitand):
-        (JSC::JIT::compileFastArithSlow_op_bitand):
-        (JSC::JIT::compileFastArith_op_mod):
-        (JSC::JIT::compileFastArithSlow_op_mod):
-        (JSC::JIT::compileFastArith_op_add):
-        (JSC::JIT::compileFastArithSlow_op_add):
-        (JSC::JIT::compileFastArith_op_mul):
-        (JSC::JIT::compileFastArithSlow_op_mul):
-        (JSC::JIT::compileFastArith_op_post_inc):
-        (JSC::JIT::compileFastArithSlow_op_post_inc):
-        (JSC::JIT::compileFastArith_op_post_dec):
-        (JSC::JIT::compileFastArithSlow_op_post_dec):
-        (JSC::JIT::compileFastArith_op_pre_inc):
-        (JSC::JIT::compileFastArithSlow_op_pre_inc):
-        (JSC::JIT::compileFastArith_op_pre_dec):
-        (JSC::JIT::compileFastArithSlow_op_pre_dec):
-        (JSC::JIT::compileBinaryArithOp):
-        * jit/JITInlineMethods.h:
-        (JSC::JIT::getConstantOperand):
-        (JSC::JIT::getConstantOperandImmediateInt):
-        (JSC::JIT::isOperandConstantImmediateInt):
-        (JSC::JIT::isOperandConstant31BitImmediateInt):
-        (JSC::JIT::emitFastArithDeTagImmediate):
-        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
-        (JSC::JIT::emitFastArithReTagImmediate):
-        (JSC::JIT::emitFastArithImmToInt):
-        (JSC::JIT::emitFastArithIntToImmNoCheck):
-        * runtime/JSImmediate.h:
-        (JSC::JSImmediate::isPositiveNumber):
-        (JSC::JSImmediate::isNegative):
-        (JSC::JSImmediate::rightShiftImmediateNumbers):
-        (JSC::JSImmediate::canDoFastAdditiveOperations):
-        (JSC::JSImmediate::makeValue):
-        (JSC::JSImmediate::makeInt):
-        (JSC::JSImmediate::makeBool):
-        (JSC::JSImmediate::intValue):
-        (JSC::JSImmediate::rawValue):
-        (JSC::JSImmediate::toBoolean):
-        (JSC::JSImmediate::from):
-        * wtf/Platform.h:
-
-2008-12-31  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        [jsfunfuzz] Assertion + incorrect behaviour with dynamically created local variable in a catch block
-        <https://bugs.webkit.org/show_bug.cgi?id=23063>
-
-        Eval inside a catch block attempts to use the catch block's static scope in
-        an unsafe way by attempting to add new properties to the scope.  This patch
-        fixes this issue simply by preventing the catch block from using a static
-        scope if it contains an eval.
+        The problem was caused by the page returned with a function using a
+        var declaration list containing around ~3000 variables.  The solution
+        to this is to flatten the comma expression representation and make
+        codegen comma expressions and initializer lists iterative rather than
+        recursive.
 
         * parser/Grammar.y:
+        * parser/NodeConstructors.h:
+        (JSC::CommaNode::CommaNode):
         * parser/Nodes.cpp:
-        (JSC::TryNode::emitBytecode):
+        (JSC::CommaNode::emitBytecode):
         * parser/Nodes.h:
-        (JSC::TryNode::):
-
-2008-12-31  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        [jsfunfuzz] Computed exception offset wrong when first instruction is attempt to resolve deleted eval
-        <https://bugs.webkit.org/show_bug.cgi?id=23062>
-
-        This was caused by the expression information for the initial resolve of
-        eval not being emitted.  If this resolve was the first instruction that
-        could throw an exception the information search would fail leading to an
-        assertion failure.  If it was not the first throwable opcode the wrong
-        expression information would used.
+        (JSC::ExpressionNode::isCommaNode):
+        (JSC::CommaNode::isCommaNode):
+        (JSC::CommaNode::append):
 
-        Fix is simply to emit the expression info.
-
-        * parser/Nodes.cpp:
-        (JSC::EvalFunctionCallNode::emitBytecode):
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
-2008-12-31  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+        Reviewed by Maciej Stachowiak.
 
-        Reviewed by Oliver Hunt.
+        https://bugs.webkit.org/show_bug.cgi?id=26645
 
-        Bug 23054: Caching of global lookups occurs even when the global object has become a dictionary
-        <https://bugs.webkit.org/show_bug.cgi?id=23054>
-        <rdar://problem/6469905>
+        Inherits ScopeChainNode class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/ScopeChain.h:95.
 
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::resolveGlobal): Do not cache lookup if the global
-        object has transitioned to a dictionary.
-        (JSC::Interpreter::cti_op_resolve_global): Do not cache lookup if the
-        global object has transitioned to a dictionary.
+        * wtf/RefPtr.h:
 
-2008-12-30  Oliver Hunt  <oliver@apple.com>
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
         Reviewed by Darin Adler.
 
-        <https://bugs.webkit.org/show_bug.cgi?id=23049> [jsfunfuzz] With blocks do not correctly protect their scope object
-        <rdar://problem/6469742> Crash in JSC::TypeInfo::hasStandardGetOwnPropertySlot() running jsfunfuzz
+        https://bugs.webkit.org/show_bug.cgi?id=26648
 
-        The problem that caused this was that with nodes were not correctly protecting
-        the final object that was placed in the scope chain.  We correct this by forcing
-        the use of a temporary register (which stops us relying on a local register
-        protecting the scope) and changing the behaviour of op_push_scope so that it
-        will store the final scope object.
+        Inherits Deque class from FastAllocBase because it has been
+        instantiated by 'new' with DEFINE_STATIC_LOCAL macro in 
+        JavaScriptCore/wtf/MainThread.cpp:62.
 
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::emitPushScope):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
-        (JSC::Interpreter::cti_op_push_scope):
-        * interpreter/Interpreter.h:
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        * parser/Nodes.cpp:
-        (JSC::WithNode::emitBytecode):
-
-2008-12-30  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Sam Weinig.
-
-        Bug 23037: Parsing and reparsing disagree on automatic semicolon insertion
-        <https://bugs.webkit.org/show_bug.cgi?id=23037>
-        <rdar://problem/6467124>
-
-        Parsing and reparsing disagree about automatic semicolon insertion, so that a
-        function like
-
-        function() { a = 1, }
-
-        is parsed as being syntactically valid but gets a syntax error upon reparsing.
-        This leads to an assertion failure in Parser::reparse(). It is not that big of
-        an issue in practice, because in a Release build such a function will return
-        'undefined' when called.
-
-        In this case, we are not following the spec and it should be a syntax error.
-        However, unless there is a newline separating the ',' and the '}', WebKit would
-        not treat it as a syntax error in the past either. It would be a bit of work to
-        make the automatic semicolon insertion match the spec exactly, so this patch
-        changes it to match our past behaviour.
-
-        The problem is that even during reparsing, the Lexer adds a semicolon at the
-        end of the input, which confuses allowAutomaticSemicolon(), because it is
-        expecting either a '}', the end of input, or a terminator like a newline.
-
-        * parser/Lexer.cpp:
-        (JSC::Lexer::Lexer): Initialize m_isReparsing to false.
-        (JSC::Lexer::lex): Do not perform automatic semicolon insertion in the Lexer if
-        we are in the middle of reparsing.
-        (JSC::Lexer::clear): Set m_isReparsing to false.
-        * parser/Lexer.h:
-        (JSC::Lexer::setIsReparsing): Added.
-        * parser/Parser.cpp:
-        (JSC::Parser::reparse): Call Lexer::setIsReparsing() to notify the Lexer of
-        reparsing.
-
-2008-12-29  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by NOBODY (Build fix).
+        * wtf/Deque.h:
 
-        Yet another attempt to fix Tiger.
-
-        * wtf/RandomNumber.cpp:
-        (WTF::randomNumber):
-
-2008-12-29  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by NOBODY (Build fix).
-
-        Tiger build fix (correct this time)
-
-        * wtf/RandomNumber.cpp:
-
-2008-12-29  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Rubber-stamped by Alexey Proskuryakov.
-
-        Revert r39509, because kjsyydebug is used in the generated code if YYDEBUG is 1.
-
-        * parser/Grammar.y:
-
-2008-12-29  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by NOBODY (Build fix).
-
-        Tiger build fix.
-
-        * wtf/RandomNumber.cpp:
-
-2008-12-29  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        <rdar://problem/6358108> Insecure randomness in Math.random() leads to user tracking
-
-        Switch to arc4random on PLATFORM(DARWIN), this is ~1.5x slower than random(), but the
-        it is still so fast that there is no fathomable way it could be a bottleneck for anything.
-
-        randomNumber is called in two places
-          * During form submission where it is called once per form
-          * Math.random in JSC.  For this difference to show up you have to be looping on
-            a cached local copy of random, for a large (>10000) calls.
-
-        No change in SunSpider.
-
-        * wtf/RandomNumber.cpp:
-        (WTF::randomNumber):
-        * wtf/RandomNumberSeed.h:
-        (WTF::initializeRandomNumberGenerator):
-
-2008-12-29  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Rubber-stamped by Sam Weinig.
-
-        Remove unused kjsyydebug #define.
-
-        * parser/Grammar.y:
-
-2008-12-29  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Oliver Hunt and Sam Weinig.
-
-        Bug 23029: REGRESSION (r39337): jsfunfuzz generates identical test files
-        <https://bugs.webkit.org/show_bug.cgi?id=23029>
-        <rdar://problem/6469185>
-
-        The unification of random number generation in r39337 resulted in random()
-        being initialized on Darwin, but rand() actually being used. Fix this by
-        making randomNumber() use random() instead of rand() on Darwin.
-
-        * wtf/RandomNumber.cpp:
-        (WTF::randomNumber):
-
-2008-12-29  Sam Weinig  <sam@webkit.org>
-
-        Fix buildbots.
-
-        * runtime/Structure.cpp:
-
-2008-12-29  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Patch for https://bugs.webkit.org/show_bug.cgi?id=23026
-        Move the deleted offsets vector into the PropertyMap
-
-        Saves 3 words per Structure.
-
-        * runtime/PropertyMapHashTable.h:
-        * runtime/Structure.cpp:
-        (JSC::Structure::addPropertyTransition):
-        (JSC::Structure::changePrototypeTransition):
-        (JSC::Structure::getterSetterTransition):
-        (JSC::Structure::toDictionaryTransition):
-        (JSC::Structure::fromDictionaryTransition):
-        (JSC::Structure::copyPropertyTable):
-        (JSC::Structure::put):
-        (JSC::Structure::remove):
-        (JSC::Structure::rehashPropertyMapHashTable):
-        * runtime/Structure.h:
-        (JSC::Structure::propertyStorageSize):
-
-2008-12-29  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Oliver Hunt.
-
-        Change code using m_body.get() as a boolean to take advantage of the 
-        implicit conversion of RefPtr to boolean.
-
-        * runtime/JSFunction.cpp:
-        (JSC::JSFunction::~JSFunction):
-
-2008-12-28  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 22840: REGRESSION (r38349): Gmail doesn't load with profiling enabled
-        <https://bugs.webkit.org/show_bug.cgi?id=22840>
-        <rdar://problem/6468077>
-
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::emitNewArray): Add an assertion that the range
-        of registers passed to op_new_array is sequential.
-        (JSC::BytecodeGenerator::emitCall): Correct the relocation of registers
-        when emitting profiler hooks so that registers aren't leaked. Also, add
-        an assertion that the 'this' register is always ref'd (because it is),
-        remove the needless protection of the 'this' register when relocating,
-        and add an assertion that the range of registers passed to op_call for
-        function call arguments is sequential.
-        (JSC::BytecodeGenerator::emitConstruct): Correct the relocation of
-        registers when emitting profiler hooks so that registers aren't leaked.
-        Also, add an assertion that the range of registers passed to op_construct
-        for function call arguments is sequential.
-
-2008-12-26  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        <rdar://problem/6467376> Race condition in WTF::currentThread can lead to a thread using two different identifiers during its lifetime
-
-        If a newly-created thread calls WTF::currentThread() before WTF::createThread calls establishIdentifierForPthreadHandle
-        then more than one identifier will be used for the same thread.  We can avoid this by adding some extra synchronization
-        during thread creation that delays the execution of the thread function until the thread identifier has been set up, and
-        an assertion to catch this problem should it reappear in the future.
-
-        * wtf/Threading.cpp: Added.
-        (WTF::NewThreadContext::NewThreadContext):
-        (WTF::threadEntryPoint):
-        (WTF::createThread): Add cross-platform createThread function that delays the execution of the thread function until
-        after the thread identifier has been set up.
-        * wtf/Threading.h:
-        * wtf/ThreadingGtk.cpp:
-        (WTF::establishIdentifierForThread):
-        (WTF::createThreadInternal):
-        * wtf/ThreadingNone.cpp:
-        (WTF::createThreadInternal):
-        * wtf/ThreadingPthreads.cpp:
-        (WTF::establishIdentifierForPthreadHandle):
-        (WTF::createThreadInternal):
-        * wtf/ThreadingQt.cpp:
-        (WTF::identifierByQthreadHandle):
-        (WTF::establishIdentifierForThread):
-        (WTF::createThreadInternal):
-        * wtf/ThreadingWin.cpp:
-        (WTF::storeThreadHandleByIdentifier):
-        (WTF::createThreadInternal):
-
-        Add Threading.cpp to the build.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.scons:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-
-2008-12-26  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Remove unused method.
-
-        * runtime/Structure.h: Remove mutableTypeInfo.
-
-2008-12-22  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Fix rounding / bounds / signed comparison bug in ExecutableAllocator.
-
-        ExecutableAllocator::alloc assumed that m_freePtr would be aligned.  This was
-        not always true, since the first allocation from an additional pool would not
-        be rounded up.  Subsequent allocations would be unaligned, and too much memory
-        could be erroneously allocated from the pool, when the size requested was
-        available, but the size rounded up to word granularity was not available in the
-        pool.  This may result in the value of m_freePtr being greater than m_end.
-
-        Under these circumstances, the unsigned check for space will always pass,
-        resulting in pointers to memory outside of the arena being returned, and
-        ultimately segfaulty goodness when attempting to memcpy the hot freshly jitted
-        code from the AssemblerBuffer.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22974
-        ... and probably many, many more.
-
-        * jit/ExecutableAllocator.h:
-        (JSC::ExecutablePool::alloc):
-        (JSC::ExecutablePool::roundUpAllocationSize):
-        (JSC::ExecutablePool::ExecutablePool):
-        (JSC::ExecutablePool::poolAllocate):
-
-2008-12-22  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin Barraclough.
-
-        Rename all uses of the term "repatch" to "patch".
-
-        * assembler/MacroAssembler.h:
-        (JSC::MacroAssembler::DataLabelPtr::patch):
-        (JSC::MacroAssembler::DataLabel32::patch):
-        (JSC::MacroAssembler::Jump::patch):
-        (JSC::MacroAssembler::PatchBuffer::PatchBuffer):
-        (JSC::MacroAssembler::PatchBuffer::setPtr):
-        (JSC::MacroAssembler::loadPtrWithAddressOffsetPatch):
-        (JSC::MacroAssembler::storePtrWithAddressOffsetPatch):
-        (JSC::MacroAssembler::storePtrWithPatch):
-        (JSC::MacroAssembler::jnePtrWithPatch):
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::patchAddress):
-        (JSC::X86Assembler::patchImmediate):
-        (JSC::X86Assembler::patchPointer):
-        (JSC::X86Assembler::patchBranchOffset):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::tryCTICachePutByID):
-        (JSC::Interpreter::tryCTICacheGetByID):
-        (JSC::Interpreter::cti_op_put_by_id):
-        (JSC::Interpreter::cti_op_get_by_id):
-        (JSC::Interpreter::cti_op_get_by_id_self_fail):
-        (JSC::Interpreter::cti_op_get_by_id_proto_list):
-        (JSC::Interpreter::cti_vm_dontLazyLinkCall):
-        * jit/JIT.cpp:
-        (JSC::ctiPatchCallByReturnAddress):
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompile):
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JIT.h:
-        * jit/JITCall.cpp:
-        (JSC::JIT::unlinkCall):
-        (JSC::JIT::linkCall):
-        (JSC::JIT::compileOpCall):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::compileGetByIdHotPath):
-        (JSC::JIT::compilePutByIdHotPath):
-        (JSC::JIT::compileGetByIdSlowCase):
-        (JSC::JIT::compilePutByIdSlowCase):
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::patchGetByIdSelf):
-        (JSC::JIT::patchPutByIdReplace):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        (JSC::JIT::privateCompileGetByIdSelf):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdSelfList):
-        (JSC::JIT::privateCompileGetByIdProtoList):
-        (JSC::JIT::privateCompileGetByIdChainList):
-        (JSC::JIT::privateCompileGetByIdChain):
-        (JSC::JIT::privateCompilePutByIdReplace):
-
-2008-12-22  Adam Roben  <aroben@apple.com>
-
-        Build fix after r39428
-
-        * jit/JITCall.cpp:
-        (JSC::JIT::compileOpCallSlowCase): Added a missing MacroAssembler::
-
-2008-12-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Rubber-stamped by George Staikos.
-
-        Unify all TorchMobile copyright lines. Consolidate in a single line, as requested by Mark Rowe, some time ago.
-
-        * wtf/RandomNumber.cpp:
-        * wtf/RandomNumber.h:
-        * wtf/RandomNumberSeed.h:
-
-2008-12-21  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Rubber-stamped by George Staikos.
-
-        Fix copyright of the new RandomNumber* files.
-
-        * wtf/RandomNumber.cpp:
-        * wtf/RandomNumber.h:
-        * wtf/RandomNumberSeed.h:
-
-2008-12-21  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt & Cameron Zwarich.
-
-        Add support for call and property access repatching on x86-64.
-
-        No change in performance on current configurations (2x impovement on v8-tests with JIT enabled on x86-64).
-
-        * assembler/MacroAssembler.h:
-        (JSC::MacroAssembler::DataLabelPtr::repatch):
-        (JSC::MacroAssembler::DataLabelPtr::operator X86Assembler::JmpDst):
-        (JSC::MacroAssembler::DataLabel32::repatch):
-        (JSC::MacroAssembler::RepatchBuffer::addressOf):
-        (JSC::MacroAssembler::add32):
-        (JSC::MacroAssembler::sub32):
-        (JSC::MacroAssembler::loadPtrWithAddressOffsetRepatch):
-        (JSC::MacroAssembler::storePtrWithAddressOffsetRepatch):
-        (JSC::MacroAssembler::jePtr):
-        (JSC::MacroAssembler::jnePtr):
-        (JSC::MacroAssembler::jnePtrWithRepatch):
-        (JSC::MacroAssembler::differenceBetween):
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::addl_im):
-        (JSC::X86Assembler::subl_im):
-        (JSC::X86Assembler::cmpl_rm):
-        (JSC::X86Assembler::movq_rm_disp32):
-        (JSC::X86Assembler::movq_mr_disp32):
-        (JSC::X86Assembler::repatchPointer):
-        (JSC::X86Assembler::X86InstructionFormatter::oneByteOp64_disp32):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompile):
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JIT.h:
-        * jit/JITCall.cpp:
-        (JSC::JIT::unlinkCall):
-        (JSC::JIT::linkCall):
-        (JSC::JIT::compileOpCall):
-        (JSC::JIT::compileOpCallSlowCase):
-        * jit/JITInlineMethods.h:
-        (JSC::JIT::restoreArgumentReferenceForTrampoline):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::compileGetByIdHotPath):
-        (JSC::JIT::compileGetByIdSlowCase):
-        (JSC::JIT::compilePutByIdHotPath):
-        (JSC::JIT::compilePutByIdSlowCase):
-        (JSC::resizePropertyStorage):
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdProtoList):
-        (JSC::JIT::privateCompileGetByIdChainList):
-        (JSC::JIT::privateCompileGetByIdChain):
-        * wtf/Platform.h:
-
-2008-12-20  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Port optimized property access generation to the MacroAssembler.
-
-        * assembler/MacroAssembler.h:
-        (JSC::MacroAssembler::AbsoluteAddress::AbsoluteAddress):
-        (JSC::MacroAssembler::DataLabelPtr::repatch):
-        (JSC::MacroAssembler::DataLabel32::DataLabel32):
-        (JSC::MacroAssembler::DataLabel32::repatch):
-        (JSC::MacroAssembler::Label::operator X86Assembler::JmpDst):
-        (JSC::MacroAssembler::Jump::repatch):
-        (JSC::MacroAssembler::JumpList::empty):
-        (JSC::MacroAssembler::RepatchBuffer::link):
-        (JSC::MacroAssembler::add32):
-        (JSC::MacroAssembler::and32):
-        (JSC::MacroAssembler::sub32):
-        (JSC::MacroAssembler::loadPtrWithAddressRepatch):
-        (JSC::MacroAssembler::storePtrWithAddressRepatch):
-        (JSC::MacroAssembler::push):
-        (JSC::MacroAssembler::ja32):
-        (JSC::MacroAssembler::jePtr):
-        (JSC::MacroAssembler::jnePtr):
-        (JSC::MacroAssembler::jnePtrWithRepatch):
-        (JSC::MacroAssembler::align):
-        (JSC::MacroAssembler::differenceBetween):
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::movl_rm_disp32):
-        (JSC::X86Assembler::movl_mr_disp32):
-        (JSC::X86Assembler::X86InstructionFormatter::oneByteOp_disp32):
-        (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
-        * jit/JIT.cpp:
-        (JSC::ctiRepatchCallByReturnAddress):
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompile):
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JIT.h:
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::compileGetByIdHotPath):
-        (JSC::JIT::compileGetByIdSlowCase):
-        (JSC::JIT::compilePutByIdHotPath):
-        (JSC::JIT::compilePutByIdSlowCase):
-        (JSC::resizePropertyStorage):
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::patchGetByIdSelf):
-        (JSC::JIT::patchPutByIdReplace):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        (JSC::JIT::privateCompileGetByIdSelf):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdSelfList):
-        (JSC::JIT::privateCompileGetByIdProtoList):
-        (JSC::JIT::privateCompileGetByIdChainList):
-        (JSC::JIT::privateCompileGetByIdChain):
-        (JSC::JIT::privateCompilePutByIdReplace):
-        * wtf/RefCounted.h:
-        (WTF::RefCountedBase::addressOfCount):
-
-2008-12-19  Gustavo Noronha Silva  <gns@gnome.org>
-
-        Reviewed by Holger Freyther.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22686
-
-        Added file which was missing to the javascriptcore_sources
-        variable, so that it shows up in the tarball created by `make
-        dist'.
-
-        * GNUmakefile.am:
-
-2008-12-19  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Antti Koivisto.
-
-        Build fix when building JS API tests with a c89 c compiler
-
-        Do not use C++ style comments and convert them to C comments.
-
-        * wtf/Platform.h:
-
-2008-12-18  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Same as last revision, adding cases for pre & post inc & dec.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22928
-
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-
-2008-12-18  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Fixes for the JIT's handling of JSImmediate values on x86-64.
-        On 64-bit systems, the code in JSImmediate.h relies on the upper
-        bits of a JSImmediate being a sign extension of the low 32-bits.
-        This was not being enforced by the JIT, since a number of inline
-        operations were being performed on 32-bit values in registers, and
-        when a 32-bit result is written to a register on x86-64 the value
-        is zero-extended to 64-bits.
-        
-        This fix honors previous behavoir.  A better fix in the long run
-        (when the JIT is enabled by default) may be to change JSImmediate.h
-        so it no longer relies on the upper bits of the pointer,... though
-        if we're going to change JSImmediate.h for 64-bit, we probably may
-        as well change the format so that the full range of 32-bit ints can
-        be stored, rather than just 31-bits.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22925
-
-        * assembler/MacroAssembler.h:
-        (JSC::MacroAssembler::addPtr):
-        (JSC::MacroAssembler::andPtr):
-        (JSC::MacroAssembler::orPtr):
-        (JSC::MacroAssembler::or32):
-        (JSC::MacroAssembler::xor32):
-        (JSC::MacroAssembler::xorPtr):
-        (JSC::MacroAssembler::signExtend32ToPtr):
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::andq_rr):
-        (JSC::X86Assembler::andq_ir):
-        (JSC::X86Assembler::orq_rr):
-        (JSC::X86Assembler::xorq_ir):
-        (JSC::X86Assembler::movsxd_rr):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        * jit/JITInlineMethods.h:
-        (JSC::JIT::emitFastArithReTagImmediate):
-        (JSC::JIT::emitFastArithPotentiallyReTagImmediate):
-        (JSC::JIT::emitFastArithImmToInt):
-
-2008-12-18  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Just a tidy up - rename & refactor some the #defines configuring the JIT.
-
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::cti_op_convert_this):
-        (JSC::Interpreter::cti_op_end):
-        (JSC::Interpreter::cti_op_add):
-        (JSC::Interpreter::cti_op_pre_inc):
-        (JSC::Interpreter::cti_timeout_check):
-        (JSC::Interpreter::cti_register_file_check):
-        (JSC::Interpreter::cti_op_loop_if_less):
-        (JSC::Interpreter::cti_op_loop_if_lesseq):
-        (JSC::Interpreter::cti_op_new_object):
-        (JSC::Interpreter::cti_op_put_by_id_generic):
-        (JSC::Interpreter::cti_op_get_by_id_generic):
-        (JSC::Interpreter::cti_op_put_by_id):
-        (JSC::Interpreter::cti_op_put_by_id_second):
-        (JSC::Interpreter::cti_op_put_by_id_fail):
-        (JSC::Interpreter::cti_op_get_by_id):
-        (JSC::Interpreter::cti_op_get_by_id_second):
-        (JSC::Interpreter::cti_op_get_by_id_self_fail):
-        (JSC::Interpreter::cti_op_get_by_id_proto_list):
-        (JSC::Interpreter::cti_op_get_by_id_proto_list_full):
-        (JSC::Interpreter::cti_op_get_by_id_proto_fail):
-        (JSC::Interpreter::cti_op_get_by_id_array_fail):
-        (JSC::Interpreter::cti_op_get_by_id_string_fail):
-        (JSC::Interpreter::cti_op_instanceof):
-        (JSC::Interpreter::cti_op_del_by_id):
-        (JSC::Interpreter::cti_op_mul):
-        (JSC::Interpreter::cti_op_new_func):
-        (JSC::Interpreter::cti_op_call_JSFunction):
-        (JSC::Interpreter::cti_op_call_arityCheck):
-        (JSC::Interpreter::cti_vm_dontLazyLinkCall):
-        (JSC::Interpreter::cti_vm_lazyLinkCall):
-        (JSC::Interpreter::cti_op_push_activation):
-        (JSC::Interpreter::cti_op_call_NotJSFunction):
-        (JSC::Interpreter::cti_op_create_arguments):
-        (JSC::Interpreter::cti_op_create_arguments_no_params):
-        (JSC::Interpreter::cti_op_tear_off_activation):
-        (JSC::Interpreter::cti_op_tear_off_arguments):
-        (JSC::Interpreter::cti_op_profile_will_call):
-        (JSC::Interpreter::cti_op_profile_did_call):
-        (JSC::Interpreter::cti_op_ret_scopeChain):
-        (JSC::Interpreter::cti_op_new_array):
-        (JSC::Interpreter::cti_op_resolve):
-        (JSC::Interpreter::cti_op_construct_JSConstruct):
-        (JSC::Interpreter::cti_op_construct_NotJSConstruct):
-        (JSC::Interpreter::cti_op_get_by_val):
-        (JSC::Interpreter::cti_op_resolve_func):
-        (JSC::Interpreter::cti_op_sub):
-        (JSC::Interpreter::cti_op_put_by_val):
-        (JSC::Interpreter::cti_op_put_by_val_array):
-        (JSC::Interpreter::cti_op_lesseq):
-        (JSC::Interpreter::cti_op_loop_if_true):
-        (JSC::Interpreter::cti_op_negate):
-        (JSC::Interpreter::cti_op_resolve_base):
-        (JSC::Interpreter::cti_op_resolve_skip):
-        (JSC::Interpreter::cti_op_resolve_global):
-        (JSC::Interpreter::cti_op_div):
-        (JSC::Interpreter::cti_op_pre_dec):
-        (JSC::Interpreter::cti_op_jless):
-        (JSC::Interpreter::cti_op_not):
-        (JSC::Interpreter::cti_op_jtrue):
-        (JSC::Interpreter::cti_op_post_inc):
-        (JSC::Interpreter::cti_op_eq):
-        (JSC::Interpreter::cti_op_lshift):
-        (JSC::Interpreter::cti_op_bitand):
-        (JSC::Interpreter::cti_op_rshift):
-        (JSC::Interpreter::cti_op_bitnot):
-        (JSC::Interpreter::cti_op_resolve_with_base):
-        (JSC::Interpreter::cti_op_new_func_exp):
-        (JSC::Interpreter::cti_op_mod):
-        (JSC::Interpreter::cti_op_less):
-        (JSC::Interpreter::cti_op_neq):
-        (JSC::Interpreter::cti_op_post_dec):
-        (JSC::Interpreter::cti_op_urshift):
-        (JSC::Interpreter::cti_op_bitxor):
-        (JSC::Interpreter::cti_op_new_regexp):
-        (JSC::Interpreter::cti_op_bitor):
-        (JSC::Interpreter::cti_op_call_eval):
-        (JSC::Interpreter::cti_op_throw):
-        (JSC::Interpreter::cti_op_get_pnames):
-        (JSC::Interpreter::cti_op_next_pname):
-        (JSC::Interpreter::cti_op_push_scope):
-        (JSC::Interpreter::cti_op_pop_scope):
-        (JSC::Interpreter::cti_op_typeof):
-        (JSC::Interpreter::cti_op_is_undefined):
-        (JSC::Interpreter::cti_op_is_boolean):
-        (JSC::Interpreter::cti_op_is_number):
-        (JSC::Interpreter::cti_op_is_string):
-        (JSC::Interpreter::cti_op_is_object):
-        (JSC::Interpreter::cti_op_is_function):
-        (JSC::Interpreter::cti_op_stricteq):
-        (JSC::Interpreter::cti_op_nstricteq):
-        (JSC::Interpreter::cti_op_to_jsnumber):
-        (JSC::Interpreter::cti_op_in):
-        (JSC::Interpreter::cti_op_push_new_scope):
-        (JSC::Interpreter::cti_op_jmp_scopes):
-        (JSC::Interpreter::cti_op_put_by_index):
-        (JSC::Interpreter::cti_op_switch_imm):
-        (JSC::Interpreter::cti_op_switch_char):
-        (JSC::Interpreter::cti_op_switch_string):
-        (JSC::Interpreter::cti_op_del_by_val):
-        (JSC::Interpreter::cti_op_put_getter):
-        (JSC::Interpreter::cti_op_put_setter):
-        (JSC::Interpreter::cti_op_new_error):
-        (JSC::Interpreter::cti_op_debug):
-        (JSC::Interpreter::cti_vm_throw):
-        * interpreter/Interpreter.h:
-        * jit/JIT.cpp:
-        (JSC::):
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompile):
-        * jit/JIT.h:
-        * jit/JITInlineMethods.h:
-        (JSC::JIT::restoreArgumentReference):
-        (JSC::JIT::restoreArgumentReferenceForTrampoline):
-        * wtf/Platform.h:
-
-2008-12-18  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Bug 21855: REGRESSION (r37323): Gmail complains about popup blocking when opening a link
-        <https://bugs.webkit.org/show_bug.cgi?id=21855>
-        <rdar://problem/6278244>
-
-        Move DynamicGlobalObjectScope to JSGlobalObject.h so that it can be used
-        from WebCore.
-
-        * interpreter/Interpreter.cpp:
-        * runtime/JSGlobalObject.h:
-        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
-        (JSC::DynamicGlobalObjectScope::~DynamicGlobalObjectScope):
-
-2008-12-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Gavin Barraclough.
-        
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=22393
-        Segfault when caching property accesses to primitive cells.
-        
-        Changed some asObject casts to asCell casts in cases where a primitive
-        value may be a cell and not an object.
-        
-        Re-enabled property caching for primitives in cases where it had been
-        disabled because of this bug.
-        
-        Updated a comment to better explain something Darin thought needed
-        explaining in an old patch review.
-
-        * interpreter/Interpreter.cpp:
-        (JSC::countPrototypeChainEntriesAndCheckForProxies):
-        (JSC::Interpreter::tryCacheGetByID):
-        (JSC::Interpreter::tryCTICacheGetByID):
-        (JSC::Interpreter::cti_op_get_by_id_self_fail):
-        (JSC::Interpreter::cti_op_get_by_id_proto_list):
-
-2008-12-17  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Fixes for Sunspider failures with the JIT enabled on x86-64.
-
-        * assembler/MacroAssembler.h:
-            Switch the order of the RegisterID & Address form of je32, to keep it consistent with jne32.
-        * jit/JIT.cpp:
-        * jit/JIT.h:
-        * jit/JITInlineMethods.h:
-            Port the m_ctiVirtualCall tramopline generation to use the MacroAssembler interface.
-        * jit/JITCall.cpp:
-            Fix bug in the non-optimizing code path, vptr check should have been to the memory address pointer
-            to by the register, not to the register itself.
-        * wrec/WRECGenerator.cpp:
-            See assembler/MacroAssembler.h, above.
-
-2008-12-17  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        print("Hello, 64-bit jitted world!");
-        Get hello-world working through the JIT, on x86-64.
-
-        * assembler/X86Assembler.h:
-            Fix encoding of opcode + RegisterID format instructions for 64-bit.
-        * interpreter/Interpreter.cpp:
-        * interpreter/Interpreter.h:
-            Make VoidPtrPair actually be a pair of void*s.
-            (Possibly should make this change for 32-bit Mac platforms, too - but won't change 32-bit behaviour in this patch).
-        * jit/JIT.cpp:
-        * jit/JIT.h:
-            Provide names for the timeoutCheckRegister & callFrameRegister on x86-64,
-            force x86-64 ctiTrampoline arguments onto the stack,
-            implement the asm trampolines for x86-64,
-            implement the restoreArgumentReference methods for x86-64 calling conventions.
-        * jit/JITCall.cpp:
-        * jit/JITInlineMethods.h:
-        * wtf/Platform.h:
-            Add switch settings to ENABLE(JIT), on PLATFORM(X86_64) (currently still disabled).
-
-2008-12-17  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin Barraclough.
-
-        Add more CodeBlock statistics.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dumpStatistics):
-
-2008-12-17  Sam Weinig  <sam@webkit.org>
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
         Reviewed by Darin Adler.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=22897
-        <rdar://problem/6428342>
-        Look into feasibility of discarding bytecode after native codegen
-
-        Clear the bytecode Instruction vector at the end JIT generation.
+        https://bugs.webkit.org/show_bug.cgi?id=26644
 
-        Saves 4.8 MB on Membuster head.
+        Inherits RefPtr class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/StructureChain.cpp:41.
 
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump): Add logging for the case that someone tries
-        to dump the instructions of a CodeBlock that has had its bytecode
-        vector cleared.
-        (JSC::CodeBlock::CodeBlock): Initialize the instructionCount
-        (JSC::CodeBlock::handlerForBytecodeOffset): Use instructionCount instead
-        of the size of the instruction vector in the assertion.
-        (JSC::CodeBlock::lineNumberForBytecodeOffset): Ditto.
-        (JSC::CodeBlock::expressionRangeForBytecodeOffset): Ditto.
-        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset): Ditto.
-        (JSC::CodeBlock::functionRegisterForBytecodeOffset): Ditto.
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::setInstructionCount): Store the instruction vector size
-        in debug builds for assertions.
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::generate):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompile): Clear the bytecode vector unless we
-        have compiled with Opcode sampling where we will continue to require it
+        * wtf/RefPtr.h:
 
-2008-12-17  Cary Clark  <caryclark@google.com>
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
         Reviewed by Darin Adler.
-        Landed by Adam Barth.
 
-        Add ENABLE_TEXT_CARET to permit the ANDROID platform
-        to invalidate and draw the caret in a separate thread.
+        Inherits HashSet class from FastAllocBase, because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/Collector.h:116.
 
-        * wtf/Platform.h:
-        Default ENABLE_TEXT_CARET to 1.
+        * wtf/HashSet.h:
 
-2008-12-17  Alexey Proskuryakov  <ap@webkit.org>
+2009-06-24  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
         Reviewed by Darin Adler.
 
-        Don't use unique context group in JSGlobalContextCreate() on Tiger or Leopard, take two.
+        Inherits Vector class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/Structure.cpp:633.
 
-        * API/JSContextRef.cpp: The previous patch that claimed to do this was making Tiger and
-        Leopard always use unique context group instead.
+        * wtf/Vector.h:
 
-2008-12-16  Sam Weinig  <sam@webkit.org>
+2009-06-24  Norbert Leser  <norbert.leser@nokia.com>
 
-        Reviewed by Geoffrey Garen.
+        Reviewed by Maciej Stachoviak.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=22838
-        Remove dependency on the bytecode Instruction buffer in Interpreter::throwException
-        Part of <rdar://problem/6428342>
+        The BytecodeGenerator objects were instantiated on stack, which takes up ~38kB per instance
+        (each instance includes copy of JSC::CodeBlock with large SymbolTable, etc.).
+        Specifically, since there is nested invocation (e.g., GlobalCode --> FunctionCode),
+        the stack overflows immediately on Symbian hardware (max. 80 kB).
+        Proposed change allocates generator objects on heap.
+        Performance impact (if any) should be negligible and change is proposed as general fix,
+        rather than ifdef'd for SYMBIAN.
 
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::functionRegisterForBytecodeOffset): Added. Function to get
-        a function Register index in a callFrame for a bytecode offset.
-        (JSC::CodeBlock::shrinkToFit): Shrink m_getByIdExceptionInfo and m_functionRegisterInfos.
-        * bytecode/CodeBlock.h:
-        (JSC::FunctionRegisterInfo::FunctionRegisterInfo): Added.
-        (JSC::CodeBlock::addFunctionRegisterInfo):
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::emitCall):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::throwException): Use functionRegisterForBytecodeOffset in JIT
-        mode.
+        * parser/Nodes.cpp:
+        (JSC::ProgramNode::generateBytecode):
+        (JSC::EvalNode::generateBytecode):
+        (JSC::EvalNode::bytecodeForExceptionInfoReparse):
+        (JSC::FunctionBodyNode::generateBytecode):
+        (JSC::FunctionBodyNode::bytecodeForExceptionInfoReparse):
 
-2008-12-16  Sam Weinig  <sam@webkit.org>
+2009-06-23  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Gavin Barraclough.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=22837
-        Remove dependency on the bytecode Instruction buffer in Interpreter::cti_op_call_NotJSFunction
-        Part of <rdar://problem/6428342>
-
-        * interpreter/CallFrame.h: Added comment regarding returnPC storing a void*.
-        * interpreter/Interpreter.cpp:
-        (JSC::bytecodeOffsetForPC): We no longer have any cases of the PC
-        being in the instruction stream for JIT, so we can remove the check.
-        (JSC::Interpreter::cti_op_call_NotJSFunction): Use the CTI_RETURN_ADDRESS
-        as the call frame returnPC as it is only necessary for looking up when
-        throwing an exception.
-        * interpreter/RegisterFile.h:
-        (JSC::RegisterFile::): Added comment regarding returnPC storing a void*.
-        * jit/JIT.h: Remove ARG_instr4.
-        * jit/JITCall.cpp:
-        (JSC::JIT::compileOpCallSetupArgs): Don't pass the instruction pointer.
-
-2008-12-16  Darin Adler  <darin@apple.com>
+        <rdar://problem/6992806> REGRESSION: Enumeration can skip new properties in cases of prototypes that have more than 64 (26593)
+        <https://bugs.webkit.org/show_bug.cgi?id=26593>
 
-        Reviewed and landed by Cameron Zwarich.
-
-        Preparatory work for fixing
-
-        Bug 22887: Make UString::Rep use RefCounted rather than implementing its own ref counting
-        <https://bugs.webkit.org/show_bug.cgi?id=22887>
-
-        Change the various string translators used by Identifier:add() so that
-        they never zero the ref count of a newly created UString::Rep.
-
-        * runtime/Identifier.cpp:
-        (JSC::CStringTranslator::translate):
-        (JSC::Identifier::add):
-        (JSC::UCharBufferTranslator::translate):
+        Do not attempt to cache structure chains if they contain a dictionary at any level.
 
-2008-12-16  Gavin Barraclough  <barraclough@apple.com>
-
-        Build fix for 'doze.
-
-        * assembler/AssemblerBuffer.h:
-
-2008-12-16  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Make the JIT compile on x86-64.
-        This largely involves populting the missing calls in MacroAssembler.h.
-        In addition some reinterpret_casts need removing from the JIT, and the
-        repatching property access code will need to be fully compiled out for
-        now.  The changes in interpret.cpp are to reorder the functions so that
-        the _generic forms come before all other property access methods, and
-        then to place all property access methods other than the generic forms
-        under control of the ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS macro.
-
-        No performance impact.
-
-        * assembler/AssemblerBuffer.h:
-        (JSC::AssemblerBuffer::putInt64Unchecked):
-        * assembler/MacroAssembler.h:
-        (JSC::MacroAssembler::loadPtr):
-        (JSC::MacroAssembler::load32):
-        (JSC::MacroAssembler::storePtr):
-        (JSC::MacroAssembler::storePtrWithRepatch):
-        (JSC::MacroAssembler::store32):
-        (JSC::MacroAssembler::poke):
-        (JSC::MacroAssembler::move):
-        (JSC::MacroAssembler::testImm64):
-        (JSC::MacroAssembler::jePtr):
-        (JSC::MacroAssembler::jnePtr):
-        (JSC::MacroAssembler::jnzPtr):
-        (JSC::MacroAssembler::jzPtr):
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::cmpq_rr):
-        (JSC::X86Assembler::cmpq_rm):
-        (JSC::X86Assembler::cmpq_im):
-        (JSC::X86Assembler::testq_i32m):
-        (JSC::X86Assembler::movl_mEAX):
-        (JSC::X86Assembler::movl_i32r):
-        (JSC::X86Assembler::movl_EAXm):
-        (JSC::X86Assembler::movq_rm):
-        (JSC::X86Assembler::movq_mEAX):
-        (JSC::X86Assembler::movq_mr):
-        (JSC::X86Assembler::movq_i64r):
-        (JSC::X86Assembler::movl_mr):
-        (JSC::X86Assembler::X86InstructionFormatter::oneByteOp64):
-        (JSC::X86Assembler::X86InstructionFormatter::immediate64):
         * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::cti_op_put_by_id_generic):
-        (JSC::Interpreter::cti_op_get_by_id_generic):
-        (JSC::Interpreter::cti_op_put_by_id):
-        (JSC::Interpreter::cti_op_put_by_id_second):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompile):
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JITCall.cpp:
-        (JSC::JIT::compileOpCallSetupArgs):
-        (JSC::JIT::compileOpCall):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::compileGetByIdHotPath):
-        (JSC::JIT::compilePutByIdHotPath):
-        * runtime/JSImmediate.h:
-        (JSC::JSImmediate::makeInt):
-
-2008-12-16  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 22869: REGRESSION (r38407): http://news.cnet.com/8301-13579_3-9953533-37.html crashes
-        <https://bugs.webkit.org/show_bug.cgi?id=22869>
-        <rdar://problem/6402499>
-
-        Before r38407, Structure::m_nameInPrevious was ref'd due to it being
-        stored in a PropertyMap. However, PropertyMaps are created lazily after
-        r38407, so Structure::m_nameInPrevious is not necessarily ref'd while
-        it is being used. Making it a RefPtr instead of a raw pointer fixes
-        the problem.
-
-        Unfortunately, the crash in the bug is rather intermittent, and it is
-        impossible to add an assertion in UString::Ref::ref() to catch this bug
-        because some users of UString::Rep deliberately zero out the reference
-        count. Therefore, there is no layout test accompanying this bug fix.
-
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
         * runtime/Structure.cpp:
-        (JSC::Structure::~Structure): Use get().
-        (JSC::Structure::materializePropertyMap): Use get().
-        (JSC::Structure::addPropertyTransitionToExistingStructure): Use get().
-        (JSC::Structure::addPropertyTransition): Use get().
-        * runtime/Structure.h: Make Structure::m_nameInPrevious a RefPtr instead
-        of a raw pointer.
-
-2008-12-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Not reviewed. Attempt to fix win build. No 'using namespace WTF' in this file, needs manual WTF:: prefix.
-        Not sure why the build works as is here.
-
-        * runtime/MathObject.cpp:
-        (JSC::mathProtoFuncRandom):
-
-2008-12-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Darin Adler.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22876
-
-        Unify random number generation in JavaScriptCore & WebCore, by introducing
-        wtf/RandomNumber.h and moving wtf_random/wtf_random_init out of MathExtras.h.
+        (JSC::Structure::getEnumerablePropertyNames):
+        (JSC::Structure::addPropertyTransition):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::isCacheable):
+        * runtime/StructureChain.h:
 
-        wtf_random_init() has been renamed to initializeRandomNumberGenerator() and
-        lives in it's own private header: wtf/RandomNumberSeed.h, only intended to
-        be used from within JavaScriptCore.
+2009-06-23  Yong Li  <yong.li@torchmobile.com>
 
-        wtf_random() has been renamed to randomNumber() and lives in a public header
-        wtf/RandomNumber.h, usable from within JavaScriptCore & WebCore. It encapsulates
-        the code taking care of initializing the random number generator (only when
-        building without ENABLE(JSC_MULTIPLE_THREADS), otherwhise initializeThreading()
-        already took care of that).
+        Reviewed by George Staikos.
 
-        Functional change on darwin: Use random() instead of rand(), as it got a larger
-        period (more randomness). HTMLFormElement already contains this implementation
-        and I just moved it in randomNumber(), as  special case for PLATFORM(DARWIN).
+        https://bugs.webkit.org/show_bug.cgi?id=26654
+        Add the proper export define for the JavaScriptCore API when building for WINCE.
 
-        * GNUmakefile.am: Add RandomNumber.(cpp/h) / RandomNumberSeed.h.
-        * JavaScriptCore.exp: Ditto.
-        * JavaScriptCore.pri: Ditto.
-        * JavaScriptCore.scons: Ditto.
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
-        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
-        * JavaScriptCoreSources.bkl: Ditto.
-        * runtime/MathObject.cpp: Use new WTF::randomNumber() functionality.
-        (JSC::mathProtoFuncRandom):
-        * wtf/MathExtras.h: Move wtf_random / wtf_random_init to new files.
-        * wtf/RandomNumber.cpp: Added.
-        (WTF::randomNumber):
-        * wtf/RandomNumber.h: Added.
-        * wtf/RandomNumberSeed.h: Added. Internal usage within JSC only.
-        (WTF::initializeRandomNumberGenerator):
-        * wtf/ThreadingGtk.cpp: Rename wtf_random_init() to initializeRandomNumberGenerator().
-        (WTF::initializeThreading):
-        * wtf/ThreadingPthreads.cpp: Ditto.
-        (WTF::initializeThreading):
-        * wtf/ThreadingQt.cpp: Ditto.
-        (WTF::initializeThreading):
-        * wtf/ThreadingWin.cpp: Ditto.
-        (WTF::initializeThreading):
+        * API/JSBase.h:
 
-2008-12-16 Yael Aharon <yael.aharon@nokia.com>
+2009-06-23  Joe Mason  <joe.mason@torchmobile.com>
 
-        Reviewed by Tor Arne Vestbø.
+        Reviewed by Adam Treat.
 
-        Qt/Win build fix
+        Authors: Yong Li <yong.li@torchmobile.com>, Joe Mason <joe.mason@torchmobile.com>
 
-        * JavaScriptCore.pri:
+        https://bugs.webkit.org/show_bug.cgi?id=26611
+        Implement currentThreadStackBase on WINCE by adding a global,
+        g_stackBase, which must be set to the address of a local variable
+        by the caller before calling any WebKit function that invokes JSC.
 
-2008-12-15  Mark Rowe  <mrowe@apple.com>
+        * runtime/Collector.cpp:
+        (JSC::isPageWritable):
+        (JSC::getStackBase):
+          Starts at the top of the stack and returns the entire range of
+          consecutive writable pages as an estimate of the actual stack.
+          This will be much bigger than the actual stack range, so some
+          dead objects can't be collected, but it guarantees live objects
+          aren't collected prematurely.
 
-        Reviewed by Cameron Zwarich.
+        (JSC::currentThreadStackBase):
+          On WinCE, returns g_stackBase if set or call getStackBase as a
+          fallback if not.
 
-        Fix the build with GCC 4.0.
+2009-06-23  Oliver Hunt  <oliver@apple.com>
 
-        * Configurations/JavaScriptCore.xcconfig:  GCC 4.0 appears to have a bug when compiling with -funwind-tables on,
-        so don't use it with that compiler version.
+        Reviewed by Alexey Proskuryakov.
 
-2008-12-15  Mark Rowe  <mrowe@apple.com>
+        Fix stupid performance problem in the LiteralParser
 
-        Rubber-stamped by Cameron Zwarich.
+        The LiteralParser was making a new UString in order to use
+        toDouble, however UString's toDouble allows a much wider range
+        of numberic strings than the LiteralParser accepts, and requires
+        an additional heap allocation or two for the construciton of the
+        UString.  To rectify this we just call WTF::dtoa directly using
+        a stack allocated buffer to hold the validated numeric literal.
 
-        <rdar://problem/6289933> Change WebKit-related projects to build with GCC 4.2 on Leopard.
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lexNumber):
+        (JSC::LiteralParser::parse):
+        * runtime/LiteralParser.h:
 
-        * Configurations/Base.xcconfig:
-        * Configurations/DebugRelease.xcconfig:
+2009-06-22  Oliver Hunt  <oliver@apple.com>
 
-2008-12-15  Alexey Proskuryakov  <ap@webkit.org>
+        Reviewed by Alexey Proskuryakov.
 
-        Reviewed by Darin Adler.
+        Bug 26640: JSON.stringify needs to special case Boolean objects
+        <https://bugs.webkit.org/show_bug.cgi?id=26640>
 
-        Don't use unique context group in JSGlobalContextCreate() on Tiger or Leopard.
+        Add special case handling of the Boolean object so we match current
+        ES5 errata.
 
-        * API/JSContextRef.cpp: (JSGlobalContextCreate):
+        * runtime/JSONObject.cpp:
+        (JSC::unwrapBoxedPrimitive): renamed from unwrapNumberOrString
+        (JSC::gap):
+        (JSC::Stringifier::appendStringifiedValue):
 
-2008-12-15  Alexey Proskuryakov  <ap@webkit.org>
+2009-06-22  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Darin Adler.
 
-        <rdar://problem/6445089> Mach ports leak from worker threads
+        Bug 26591: Support revivers in JSON.parse
+        <https://bugs.webkit.org/show_bug.cgi?id=26591>
 
-        * interpreter/Interpreter.cpp: (JSC::getCPUTime):
-        Deallocate the thread self port.
+        Add reviver support to JSON.parse.  This completes the JSON object.
 
-2008-12-15  Gavin Barraclough  <barraclough@apple.com>
+        * runtime/JSONObject.cpp:
+        (JSC::Walker::Walker):
+        (JSC::Walker::callReviver):
+        (JSC::Walker::walk):
+        (JSC::JSONProtoFuncParse):
 
-        Reviewed by Mark Rowe.
+2009-06-21  Oliver Hunt  <oliver@apple.com>
 
-        Construct stack frames in JIT code, so that backtracing can still work.
-        <rdar://problem/6447870> JIT should play nice with attempts to take stack traces
-
-        * jit/JIT.cpp:
-        (JSC::):
-        (JSC::JIT::privateCompileMainPass):
-
-2008-12-15  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        <rdar://problem/6402262> JavaScriptCore needs exception handling tables in order to get stack traces without frame pointers
-
-        * Configurations/JavaScriptCore.xcconfig:
-
-2008-12-15  Gavin Barraclough  <barraclough@apple.com>
+        Reviewed by Darin Adler.
 
-        Rubber stamped by Mark Rowe.
+        Bug 26592: Support standard toJSON functions
+        <https://bugs.webkit.org/show_bug.cgi?id=26592>
 
-        Revert r39226 / Bug 22818: Unify JIT callback argument access OS X / Windows
-        This causes Acid3 failures – reverting for now & will revisit later.
-        https://bugs.webkit.org/show_bug.cgi?id=22873
+        Add support for the standard Date.toJSON function.
 
-        * interpreter/Interpreter.h:
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JIT.h:
-        * jit/JITInlineMethods.h:
-        (JSC::JIT::restoreArgumentReference):
-        (JSC::JIT::restoreArgumentReferenceForTrampoline):
-        (JSC::JIT::emitCTICall_internal):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::privateCompilePutByIdTransition):
-        * wtf/Platform.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToJSON):
 
-2008-12-15  Darin Adler  <darin@apple.com>
+2009-06-21  Oliver Hunt  <oliver@apple.com>
 
         Reviewed by Sam Weinig.
 
-        - fix <rdar://problem/6427048> crash due to infinite recursion after setting window.__proto__ = window
+        Bug 26594: JSC needs to support Date.toISOString
+        <https://bugs.webkit.org/show_bug.cgi?id=26594>
 
-        Replaced toGlobalObject with the more generally useful unwrappedObject and used it to
-        fix the cycle detection code in put(__proto__).
+        Add support for Date.toISOString.
 
-        * JavaScriptCore.exp: Updated.
-
-        * runtime/JSGlobalObject.cpp: Removed toGlobalObject. We now use unwrappedObject instead.
-        * runtime/JSGlobalObject.h:
-        (JSC::JSGlobalObject::isGlobalObject): Ditto.
-
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::globalFuncEval): Use unwrappedObject and isGlobalObject here rather than toGlobalObject.
-
-        * runtime/JSObject.cpp:
-        (JSC::JSObject::put): Rewrote prototype cycle checking loop. Use unwrappedObject in the loop now.
-        (JSC::JSObject::unwrappedObject): Replaced toGlobalObject with this new function.
-        * runtime/JSObject.h: More of the same.
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToISOString):
 
-2008-12-15  Steve Falkenburg  <sfalken@apple.com>
+2009-06-21  Oliver Hunt  <oliver@apple.com>
 
-        Windows build fix.
-        
-        Visual Studio requires visibility of forward declarations to match class declaration.
+        Reviewed by NOBODY (Build fix).
 
-        * assembler/X86Assembler.h:
+        Remove dead code.
 
-2008-12-15  Gustavo Noronha Silva  <kov@kov.eti.br>
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
 
-        Reviewed by Mark Rowe.
+2009-06-21  Oliver Hunt  <oliver@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=22686
+        Reviewed by Darin Adler and Cameron Zwarich.
 
-        GTK+ build fix.
+        Bug 26587: Support JSON.parse
+        <https://bugs.webkit.org/show_bug.cgi?id=26587>
 
-        * GNUmakefile.am:
+        Extend the LiteralParser to support the full strict JSON
+        grammar, fix a few places where the grammar was incorrectly
+        lenient.   Doesn't yet support the JSON.parse reviver function
+        but that does not block the JSON.parse functionality itself.
 
-2008-12-15  Gavin Barraclough  <barraclough@apple.com>
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSONObject.cpp:
+        (JSC::JSONProtoFuncParse):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lex):
+        (JSC::isSafeStringCharacter):
+        (JSC::LiteralParser::Lexer::lexString):
+        (JSC::LiteralParser::parse):
+        * runtime/LiteralParser.h:
+        (JSC::LiteralParser::LiteralParser):
+        (JSC::LiteralParser::tryJSONParse):
+        (JSC::LiteralParser::):
+        (JSC::LiteralParser::Lexer::Lexer):
+
+2009-06-21  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (speculative build fix for windows).
+
+        Simply removed some whitespace form this file to make windows build wtf and
+        hopefully copy the new MessageQueque.h so that WebCore picks it up.
 
-        Reviewed by Geoff Garen.
+        * wtf/Assertions.cpp:
 
-        Add support to X86Assembler emitting instructions that access all 16 registers on x86-64.
-        Add a new formating class, that is reponsible for both emitting the opcode bytes and the
-        ModRm  bytes of an instruction in a single call; this can insert the REX byte as necessary
-        before the opcode, but has access to the register numbers to build the REX.
+2009-06-21  Drew Wilson  <atwilson@google.com>
 
-        * assembler/AssemblerBuffer.h:
-        (JSC::AssemblerBuffer::isAligned):
-        (JSC::AssemblerBuffer::data):
-        * assembler/MacroAssembler.h:
-        (JSC::MacroAssembler::addPtr):
-        (JSC::MacroAssembler::add32):
-        (JSC::MacroAssembler::and32):
-        (JSC::MacroAssembler::or32):
-        (JSC::MacroAssembler::sub32):
-        (JSC::MacroAssembler::xor32):
-        (JSC::MacroAssembler::loadPtr):
-        (JSC::MacroAssembler::load32):
-        (JSC::MacroAssembler::load16):
-        (JSC::MacroAssembler::storePtr):
-        (JSC::MacroAssembler::storePtrWithRepatch):
-        (JSC::MacroAssembler::store32):
-        (JSC::MacroAssembler::pop):
-        (JSC::MacroAssembler::push):
-        (JSC::MacroAssembler::compareImm32ForBranch):
-        (JSC::MacroAssembler::compareImm32ForBranchEquality):
-        (JSC::MacroAssembler::testImm32):
-        (JSC::MacroAssembler::jae32):
-        (JSC::MacroAssembler::jb32):
-        (JSC::MacroAssembler::je16):
-        (JSC::MacroAssembler::jg32):
-        (JSC::MacroAssembler::jnePtr):
-        (JSC::MacroAssembler::jne32):
-        (JSC::MacroAssembler::jump):
-        * assembler/X86Assembler.h:
-        (JSC::X86::):
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::size):
-        (JSC::X86Assembler::push_r):
-        (JSC::X86Assembler::pop_r):
-        (JSC::X86Assembler::push_i32):
-        (JSC::X86Assembler::push_m):
-        (JSC::X86Assembler::pop_m):
-        (JSC::X86Assembler::addl_rr):
-        (JSC::X86Assembler::addl_mr):
-        (JSC::X86Assembler::addl_ir):
-        (JSC::X86Assembler::addq_ir):
-        (JSC::X86Assembler::addl_im):
-        (JSC::X86Assembler::andl_rr):
-        (JSC::X86Assembler::andl_ir):
-        (JSC::X86Assembler::orl_rr):
-        (JSC::X86Assembler::orl_mr):
-        (JSC::X86Assembler::orl_ir):
-        (JSC::X86Assembler::subl_rr):
-        (JSC::X86Assembler::subl_mr):
-        (JSC::X86Assembler::subl_ir):
-        (JSC::X86Assembler::subl_im):
-        (JSC::X86Assembler::xorl_rr):
-        (JSC::X86Assembler::xorl_ir):
-        (JSC::X86Assembler::sarl_i8r):
-        (JSC::X86Assembler::sarl_CLr):
-        (JSC::X86Assembler::shll_i8r):
-        (JSC::X86Assembler::shll_CLr):
-        (JSC::X86Assembler::imull_rr):
-        (JSC::X86Assembler::imull_i32r):
-        (JSC::X86Assembler::idivl_r):
-        (JSC::X86Assembler::cmpl_rr):
-        (JSC::X86Assembler::cmpl_rm):
-        (JSC::X86Assembler::cmpl_mr):
-        (JSC::X86Assembler::cmpl_ir):
-        (JSC::X86Assembler::cmpl_ir_force32):
-        (JSC::X86Assembler::cmpl_im):
-        (JSC::X86Assembler::cmpl_im_force32):
-        (JSC::X86Assembler::cmpw_rm):
-        (JSC::X86Assembler::testl_rr):
-        (JSC::X86Assembler::testl_i32r):
-        (JSC::X86Assembler::testl_i32m):
-        (JSC::X86Assembler::testq_rr):
-        (JSC::X86Assembler::testq_i32r):
-        (JSC::X86Assembler::testb_i8r):
-        (JSC::X86Assembler::sete_r):
-        (JSC::X86Assembler::setz_r):
-        (JSC::X86Assembler::setne_r):
-        (JSC::X86Assembler::setnz_r):
-        (JSC::X86Assembler::cdq):
-        (JSC::X86Assembler::xchgl_rr):
-        (JSC::X86Assembler::movl_rr):
-        (JSC::X86Assembler::movl_rm):
-        (JSC::X86Assembler::movl_mr):
-        (JSC::X86Assembler::movl_i32r):
-        (JSC::X86Assembler::movl_i32m):
-        (JSC::X86Assembler::movq_rr):
-        (JSC::X86Assembler::movq_rm):
-        (JSC::X86Assembler::movq_mr):
-        (JSC::X86Assembler::movzwl_mr):
-        (JSC::X86Assembler::movzbl_rr):
-        (JSC::X86Assembler::leal_mr):
-        (JSC::X86Assembler::call):
-        (JSC::X86Assembler::jmp):
-        (JSC::X86Assembler::jmp_r):
-        (JSC::X86Assembler::jmp_m):
-        (JSC::X86Assembler::jne):
-        (JSC::X86Assembler::jnz):
-        (JSC::X86Assembler::je):
-        (JSC::X86Assembler::jl):
-        (JSC::X86Assembler::jb):
-        (JSC::X86Assembler::jle):
-        (JSC::X86Assembler::jbe):
-        (JSC::X86Assembler::jge):
-        (JSC::X86Assembler::jg):
-        (JSC::X86Assembler::ja):
-        (JSC::X86Assembler::jae):
-        (JSC::X86Assembler::jo):
-        (JSC::X86Assembler::jp):
-        (JSC::X86Assembler::js):
-        (JSC::X86Assembler::addsd_rr):
-        (JSC::X86Assembler::addsd_mr):
-        (JSC::X86Assembler::cvtsi2sd_rr):
-        (JSC::X86Assembler::cvttsd2si_rr):
-        (JSC::X86Assembler::movd_rr):
-        (JSC::X86Assembler::movsd_rm):
-        (JSC::X86Assembler::movsd_mr):
-        (JSC::X86Assembler::mulsd_rr):
-        (JSC::X86Assembler::mulsd_mr):
-        (JSC::X86Assembler::pextrw_irr):
-        (JSC::X86Assembler::subsd_rr):
-        (JSC::X86Assembler::subsd_mr):
-        (JSC::X86Assembler::ucomis_rr):
-        (JSC::X86Assembler::int3):
-        (JSC::X86Assembler::ret):
-        (JSC::X86Assembler::predictNotTaken):
-        (JSC::X86Assembler::label):
-        (JSC::X86Assembler::align):
-        (JSC::X86Assembler::link):
-        (JSC::X86Assembler::executableCopy):
-        (JSC::X86Assembler::X86InstructionFormater::prefix):
-        (JSC::X86Assembler::X86InstructionFormater::oneByteOp):
-        (JSC::X86Assembler::X86InstructionFormater::twoByteOp):
-        (JSC::X86Assembler::X86InstructionFormater::oneByteOp64):
-        (JSC::X86Assembler::X86InstructionFormater::oneByteOp8):
-        (JSC::X86Assembler::X86InstructionFormater::twoByteOp8):
-        (JSC::X86Assembler::X86InstructionFormater::instructionImmediate8):
-        (JSC::X86Assembler::X86InstructionFormater::instructionImmediate32):
-        (JSC::X86Assembler::X86InstructionFormater::instructionRel32):
-        (JSC::X86Assembler::X86InstructionFormater::size):
-        (JSC::X86Assembler::X86InstructionFormater::isAligned):
-        (JSC::X86Assembler::X86InstructionFormater::data):
-        (JSC::X86Assembler::X86InstructionFormater::executableCopy):
-        (JSC::X86Assembler::X86InstructionFormater::registerModRM):
-        (JSC::X86Assembler::X86InstructionFormater::memoryModRM):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompile):
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JITArithmetic.cpp:
-        (JSC::JIT::putDoubleResultToJSNumberCellOrJSImmediate):
-        (JSC::JIT::compileBinaryArithOp):
-        * jit/JITCall.cpp:
-        (JSC::JIT::compileOpCall):
-        (JSC::JIT::compileOpCallSlowCase):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::compileGetByIdHotPath):
-        (JSC::JIT::compilePutByIdHotPath):
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdProtoList):
-        (JSC::JIT::privateCompileGetByIdChainList):
-        (JSC::JIT::privateCompileGetByIdChain):
+        Reviewed by David Levin.
 
-2008-12-15  Darin Adler  <darin@apple.com>
+        <https://bugs.webkit.org/show_bug.cgi?id=25043>
+        Added support for multi-threaded MessagePorts.
 
-        * interpreter/RegisterFile.h: Tweak include formatting.
+        * wtf/MessageQueue.h:
+        (WTF::::appendAndCheckEmpty):
+            Added API to test whether the queue was empty before adding an element.
+  
+2009-06-20  David D. Kilzer  <ddkilzer@webkit.org>
 
-2008-12-15  Holger Hans Peter Freyther  <zecke@selfish.org>
+        Fix namespace comment in SegmentedVector.h
 
-        Build fix for Gtk+.
+        * wtf/SegmentedVector.h: Updated namespace comment to reflect
+        new namespace after r44897.
 
-        * interpreter/RegisterFile.h: Include stdio.h for fprintf
+2009-06-20  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
 
-2008-12-15  Alexey Proskuryakov  <ap@webkit.org>
+        Bug 24986: ARM JIT port
+        <https://bugs.webkit.org/show_bug.cgi?id=24986>
 
         Reviewed by Oliver Hunt.
 
-        <rdar://problem/6444455> Worker Thread crash running multiple workers for a moderate amount of time
-
-        * interpreter/RegisterFile.h: (JSC::RegisterFile::RegisterFile):
-        Improve error handling: if mmap fails, crash immediately, and print out the reason.
-
-2008-12-13  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Re-enable WREC on 64-bit.
-        Implements one of the MacroAssembler::jnzPtr methods, previously only implemented for 32-bit x86.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22849
-
-        * assembler/MacroAssembler.h:
-        (JSC::MacroAssembler::testImm64):
-        (JSC::MacroAssembler::jnzPtr):
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::testq_i32r):
-        (JSC::X86Assembler::testq_rr):
-        * wtf/Platform.h:
-
-2008-12-13  Gavin Barraclough  <barraclough@apple.com>
-
-        Fix PPC builds.
-
-        * assembler/MacroAssembler.h:
-
-2008-12-13  Gavin Barraclough  <barraclough@apple.com>
-
-        Build fix only, no review.
-
-        * bytecode/CodeBlock.h:
-
-2008-12-13  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Port the remainder of the JIT, bar calling convention related code, and code
-        implementing optimizations which can be disabled, to use the MacroAssembler.
-
-        * assembler/MacroAssembler.h:
-        (JSC::MacroAssembler::DataLabelPtr::DataLabelPtr):
-        (JSC::MacroAssembler::RepatchBuffer::RepatchBuffer):
-        (JSC::MacroAssembler::RepatchBuffer::link):
-        (JSC::MacroAssembler::RepatchBuffer::addressOf):
-        (JSC::MacroAssembler::RepatchBuffer::setPtr):
-        (JSC::MacroAssembler::addPtr):
-        (JSC::MacroAssembler::lshift32):
-        (JSC::MacroAssembler::mod32):
-        (JSC::MacroAssembler::rshift32):
-        (JSC::MacroAssembler::storePtrWithRepatch):
-        (JSC::MacroAssembler::jnzPtr):
-        (JSC::MacroAssembler::jzPtr):
-        (JSC::MacroAssembler::jump):
-        (JSC::MacroAssembler::label):
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::xchgl_rr):
-        (JSC::X86Assembler::jmp_m):
-        (JSC::X86Assembler::repatchAddress):
-        (JSC::X86Assembler::getRelocatedAddress):
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::CodeBlock):
-        * bytecode/CodeBlock.h:
-        (JSC::JITCodeRef::JITCodeRef):
-        (JSC::CodeBlock::setJITCode):
-        (JSC::CodeBlock::jitCode):
-        (JSC::CodeBlock::executablePool):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileLinkPass):
-        (JSC::JIT::privateCompile):
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JIT.h:
-        (JSC::CallRecord::CallRecord):
-        (JSC::JumpTable::JumpTable):
-        (JSC::JIT::emitCTICall):
-        (JSC::JIT::JSRInfo::JSRInfo):
-        * jit/JITArithmetic.cpp:
-        * jit/JITCall.cpp:
-        * jit/JITInlineMethods.h:
-        (JSC::JIT::emitNakedCall):
-        (JSC::JIT::emitCTICall_internal):
-        (JSC::JIT::checkStructure):
-        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
-        (JSC::JIT::addSlowCase):
-        (JSC::JIT::addJump):
-        (JSC::JIT::emitJumpSlowToHot):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::privateCompileGetByIdChainList):
-        (JSC::JIT::privateCompileGetByIdChain):
-
-2008-12-12  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Fix the failures of the following layout tests, which regressed in
-        r39255:
-
-        fast/dom/StyleSheet/ownerNode-lifetime-2.html
-        fast/xsl/transform-xhr-doc.xhtml
-
-        The binary search in CodeBlock::getByIdExceptionInfoForBytecodeOffset()
-        doesn't guarantee that it actually finds a match, so add an explicit check
-        for this.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset):
-
-2008-12-12  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Replace emitPutCallArg methods with emitPutJITStubArg methods.  Primarily to make the argument numbering
-        more sensible (1-based incrementing by 1, rather than 0-based incrementing by 4).  The CTI name also seems
-        to be being deprecated from the code generally.
-
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileSlowCases):
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JIT.h:
-        * jit/JITArithmetic.cpp:
-        (JSC::JIT::compileBinaryArithOp):
-        (JSC::JIT::compileBinaryArithOpSlowCase):
-        * jit/JITCall.cpp:
-        (JSC::JIT::compileOpCallSetupArgs):
-        (JSC::JIT::compileOpCallEvalSetupArgs):
-        (JSC::JIT::compileOpConstructSetupArgs):
-        (JSC::JIT::compileOpCall):
-        * jit/JITInlineMethods.h:
-        (JSC::JIT::emitPutJITStubArg):
-        (JSC::JIT::emitPutJITStubArgConstant):
-        (JSC::JIT::emitGetJITStubArg):
-        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::compileGetByIdHotPath):
-        (JSC::JIT::compilePutByIdHotPath):
-        (JSC::JIT::compileGetByIdSlowCase):
-        (JSC::JIT::compilePutByIdSlowCase):
-
-2008-12-12  Gavin Barraclough  <barraclough@apple.com>
-
-        Fix windows builds.
-
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileSlowCases):
-        (JSC::JIT::privateCompile):
-
-2008-12-12  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Remove loop counter 'i' from the JIT generation passes, replace with a member m_bytecodeIndex.
-
-        No impact on performance.
-
-        * jit/JIT.cpp:
-        (JSC::JIT::compileOpStrictEq):
-        (JSC::JIT::emitSlowScriptCheck):
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileSlowCases):
-        (JSC::JIT::privateCompile):
-        * jit/JIT.h:
-        (JSC::CallRecord::CallRecord):
-        (JSC::JmpTable::JmpTable):
-        (JSC::JIT::emitCTICall):
-        * jit/JITArithmetic.cpp:
-        (JSC::JIT::compileBinaryArithOp):
-        (JSC::JIT::compileBinaryArithOpSlowCase):
-        * jit/JITCall.cpp:
-        (JSC::JIT::compileOpCall):
-        (JSC::JIT::compileOpCallSlowCase):
-        * jit/JITInlineMethods.h:
-        (JSC::JIT::emitGetVirtualRegister):
-        (JSC::JIT::emitGetVirtualRegisters):
-        (JSC::JIT::emitNakedCall):
-        (JSC::JIT::emitCTICall_internal):
-        (JSC::JIT::emitJumpSlowCaseIfJSCell):
-        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
-        (JSC::JIT::emitJumpSlowCaseIfNotImmNum):
-        (JSC::JIT::emitJumpSlowCaseIfNotImmNums):
-        (JSC::JIT::emitFastArithIntToImmOrSlowCase):
-        (JSC::JIT::addSlowCase):
-        (JSC::JIT::addJump):
-        (JSC::JIT::emitJumpSlowToHot):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::compileGetByIdHotPath):
-        (JSC::JIT::compileGetByIdSlowCase):
-        (JSC::JIT::compilePutByIdHotPath):
-        (JSC::JIT::compilePutByIdSlowCase):
-
-2008-12-12  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Cameron Zwarich.
+        An Iterator added for SegmentedVector. Currently
+        only the pre ++ operator is supported.
 
-        <rdar://problem/6428342> Look into feasibility of discarding bytecode after native codegen
+        * wtf/SegmentedVector.h:
+        (WTF::SegmentedVectorIterator::~SegmentedVectorIterator):
+        (WTF::SegmentedVectorIterator::operator*):
+        (WTF::SegmentedVectorIterator::operator->):
+        (WTF::SegmentedVectorIterator::operator++):
+        (WTF::SegmentedVectorIterator::operator==):
+        (WTF::SegmentedVectorIterator::operator!=):
+        (WTF::SegmentedVectorIterator::operator=):
+        (WTF::SegmentedVectorIterator::SegmentedVectorIterator):
+        (WTF::SegmentedVector::alloc):
+        (WTF::SegmentedVector::begin):
+        (WTF::SegmentedVector::end):
 
-        Move more JIT functionality to using offsets into the Instruction buffer
-        instead of raw pointers. Two to go!
+2009-06-20  Zoltan Herczeg  <zherczeg@inf.u-szeged.hu>
 
-        * interpreter/Interpreter.cpp:
-        (JSC::bytecodeOffsetForPC): Rename from vPCForPC.
-        (JSC::Interpreter::resolve): Pass offset to exception helper.
-        (JSC::Interpreter::resolveSkip): Ditto.
-        (JSC::Interpreter::resolveGlobal): Ditto.
-        (JSC::Interpreter::resolveBaseAndProperty): Ditto.
-        (JSC::Interpreter::resolveBaseAndFunc): Ditto.
-        (JSC::isNotObject): Ditto.
-        (JSC::Interpreter::unwindCallFrame): Call bytecodeOffsetForPC.
-        (JSC::Interpreter::throwException): Use offsets instead of vPCs.
-        (JSC::Interpreter::privateExecute): Pass offset to exception helper.
-        (JSC::Interpreter::retrieveLastCaller): Ditto.
-        (JSC::Interpreter::cti_op_instanceof): Ditto.
-        (JSC::Interpreter::cti_op_call_NotJSFunction): Ditto.
-        (JSC::Interpreter::cti_op_resolve): Pass offset to exception helper.
-        (JSC::Interpreter::cti_op_construct_NotJSConstruct): Ditto.
-        (JSC::Interpreter::cti_op_resolve_func): Ditto.
-        (JSC::Interpreter::cti_op_resolve_skip): Ditto.
-        (JSC::Interpreter::cti_op_resolve_global): Ditto.
-        (JSC::Interpreter::cti_op_resolve_with_base): Ditto.
-        (JSC::Interpreter::cti_op_throw): Ditto.
-        (JSC::Interpreter::cti_op_in): Ditto.
-        (JSC::Interpreter::cti_vm_throw): Ditto.
-        * interpreter/Interpreter.h:
-
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass): Don't pass unnecessary vPC to stub.
-        * jit/JIT.h: Remove ARG_instr1 - ARG_instr3 and ARG_instr5 - ARG_instr6.
-        * jit/JITCall.cpp:
-        (JSC::JIT::compileOpCallEvalSetupArgs): Don't pass unnecessary vPC to stub..
-        (JSC::JIT::compileOpConstructSetupArgs): Ditto.
-
-        * runtime/ExceptionHelpers.cpp:
-        (JSC::createUndefinedVariableError): Take an offset instead of vPC.
-        (JSC::createInvalidParamError): Ditto.
-        (JSC::createNotAConstructorError): Ditto.
-        (JSC::createNotAFunctionError): Ditto.
-        (JSC::createNotAnObjectError): Ditto.
-        * runtime/ExceptionHelpers.h:
-
-2008-12-12  Cameron Zwarich  <zwarich@apple.com>
+        Bug 24986: ARM JIT port
+        <https://bugs.webkit.org/show_bug.cgi?id=24986>
 
         Reviewed by Oliver Hunt.
 
-        Bug 22835: Crash during bytecode generation when comparing to null
-        <https://bugs.webkit.org/show_bug.cgi?id=22835>
-        <rdar://problem/6286749>
+        Move SegmentedVector to /wtf subdirectory
+        and change "namespace JSC" to "namespace WTF"
 
-        Change the special cases in bytecode generation for comparison to null
-        to use tempDestination().
+        Additional build file updates by David Kilzer.
 
-        * parser/Nodes.cpp:
-        (JSC::BinaryOpNode::emitBytecode):
-        (JSC::EqualNode::emitBytecode):
-
-2008-12-12  Gavin Barraclough  <barraclough@apple.com>
+        * GNUmakefile.am: Updated path to SegmentedVector.h.
+        * JavaScriptCore.order: Updated SegmentedVector namespace from
+        JSC to WTF in mangled C++ method name.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        Removed reference to bytecompiler\SegmentedVector.h.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Added reference to
+        wtf\SegmentedVector.h.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Moved
+        SegmentedVector.h definition from bytecompiler subdirectory to
+        wtf subdirectory.
+        * bytecompiler/BytecodeGenerator.h: Updated #include path to
+        SegmentedVector.h and prepended WTF:: namespace to its use.
+        * parser/Lexer.h: Ditto.
+        * wtf/SegmentedVector.h: Renamed from JavaScriptCore/bytecompiler/SegmentedVector.h.
+        (WTF::SegmentedVector::SegmentedVector):
+        (WTF::SegmentedVector::~SegmentedVector):
+        (WTF::SegmentedVector::size):
+        (WTF::SegmentedVector::at):
+        (WTF::SegmentedVector::operator[]):
+        (WTF::SegmentedVector::last):
+        (WTF::SegmentedVector::append):
+        (WTF::SegmentedVector::removeLast):
+        (WTF::SegmentedVector::grow):
+        (WTF::SegmentedVector::clear):
+        (WTF::SegmentedVector::deleteAllSegments):
+        (WTF::SegmentedVector::segmentExistsFor):
+        (WTF::SegmentedVector::segmentFor):
+        (WTF::SegmentedVector::subscriptFor):
+        (WTF::SegmentedVector::ensureSegmentsFor):
+        (WTF::SegmentedVector::ensureSegment):
 
-        Reviewed by Geoff Garen.
+2009-06-19  Gavin Barraclough  <barraclough@apple.com>
 
-        Move slow-cases of JIT code generation over to the MacroAssembler interface.
+        Reviewed by NOBODY (build fix take 2 - rename FIELD_OFFSET to something that doesn't conflict with winnt.h).
 
-        * assembler/MacroAssembler.h:
-        (JSC::MacroAssembler::Label::Label):
-        (JSC::MacroAssembler::jae32):
-        (JSC::MacroAssembler::jg32):
-        (JSC::MacroAssembler::jzPtr):
         * jit/JIT.cpp:
-        (JSC::JIT::privateCompileSlowCases):
         (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
         (JSC::JIT::emitGetVariableObjectRegister):
         (JSC::JIT::emitPutVariableObjectRegister):
         * jit/JIT.h:
-        (JSC::SlowCaseEntry::SlowCaseEntry):
-        (JSC::JIT::getSlowCase):
-        (JSC::JIT::linkSlowCase):
         * jit/JITArithmetic.cpp:
-        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::compileBinaryArithOp):
         * jit/JITCall.cpp:
         (JSC::JIT::compileOpCallInitializeCallFrame):
         (JSC::JIT::compileOpCall):
-        (JSC::JIT::compileOpCallSlowCase):
-        * jit/JITInlineMethods.h:
-        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
-        (JSC::JIT::linkSlowCaseIfNotJSCell):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::compileGetByIdHotPath):
-        (JSC::JIT::compilePutByIdHotPath):
-        (JSC::JIT::compileGetByIdSlowCase):
-        (JSC::JIT::compilePutByIdSlowCase):
-
-2008-12-12  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Bug 22828: Do not inspect bytecode instruction stream for op_get_by_id exception information
-        <https://bugs.webkit.org/show_bug.cgi?id=22828>
-
-        In order to remove the bytecode instruction stream after generating
-        native code, all inspection of bytecode instructions at runtime must
-        be removed. One particular instance of this is the special handling of
-        exceptions thrown by the op_get_by_id emitted directly before an
-        op_construct or an op_instanceof. This patch moves that information to
-        an auxiliary data structure in CodeBlock.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset):
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::addGetByIdExceptionInfo):
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::emitConstruct):
-        * bytecompiler/BytecodeGenerator.h:
-        (JSC::BytecodeGenerator::emitGetByIdExceptionInfo):
-        * parser/Nodes.cpp:
-        (JSC::InstanceOfNode::emitBytecode):
-        * runtime/ExceptionHelpers.cpp:
-        (JSC::createNotAnObjectError):
-
-2008-12-12  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        Change exception information accessors to take offsets into the bytecode
-        instruction buffer instead of pointers so that they can work even even
-        if the bytecode buffer is purged.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::instructionOffsetForNth):
-        (JSC::CodeBlock::handlerForBytecodeOffset):
-        (JSC::CodeBlock::lineNumberForBytecodeOffset):
-        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
-        * bytecode/CodeBlock.h:
-        * bytecode/SamplingTool.cpp:
-        (JSC::SamplingTool::dump):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::throwException):
-        (JSC::Interpreter::privateExecute):
-        (JSC::Interpreter::retrieveLastCaller):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        * runtime/ExceptionHelpers.cpp:
-        (JSC::createUndefinedVariableError):
-        (JSC::createInvalidParamError):
-        (JSC::createNotAConstructorError):
-        (JSC::createNotAFunctionError):
-        (JSC::createNotAnObjectError):
-
-2008-12-12  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Cameron Zwarich.
-        
-        Tiny bit of refactoring in quantifier generation.
-
-        * wrec/WRECGenerator.cpp:
-        (JSC::WREC::Generator::generateNonGreedyQuantifier):
-        (JSC::WREC::Generator::generateGreedyQuantifier):
-
-2008-12-11  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        Remove dependancy on having the Instruction buffer in order to
-        deref Structures used for property access and global resolves.
-        Instead, we put references to the necessary Structures in auxiliary
-        data structures on the CodeBlock. This is not an ideal solution,
-        as we still pay for having the Structures in two places and we
-        would like to eventually just hold on to offsets into the machine
-        code buffer.
-
-        - Also removes CodeBlock bloat in non-JIT by #ifdefing the JIT
-          only data structures.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.scons:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * bytecode/CodeBlock.cpp:
-        (JSC::isGlobalResolve):
-        (JSC::isPropertyAccess):
-        (JSC::instructionOffsetForNth):
-        (JSC::printGlobalResolveInfo):
-        (JSC::printStructureStubInfo):
-        (JSC::CodeBlock::printStructures):
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::~CodeBlock):
-        (JSC::CodeBlock::shrinkToFit):
-        * bytecode/CodeBlock.h:
-        (JSC::GlobalResolveInfo::GlobalResolveInfo):
-        (JSC::getNativePC):
-        (JSC::CodeBlock::instructions):
-        (JSC::CodeBlock::getStubInfo):
-        (JSC::CodeBlock::getBytecodeIndex):
-        (JSC::CodeBlock::addPropertyAccessInstruction):
-        (JSC::CodeBlock::addGlobalResolveInstruction):
-        (JSC::CodeBlock::numberOfStructureStubInfos):
-        (JSC::CodeBlock::addStructureStubInfo):
-        (JSC::CodeBlock::structureStubInfo):
-        (JSC::CodeBlock::addGlobalResolveInfo):
-        (JSC::CodeBlock::globalResolveInfo):
-        (JSC::CodeBlock::numberOfCallLinkInfos):
-        (JSC::CodeBlock::addCallLinkInfo):
-        (JSC::CodeBlock::callLinkInfo):
-        * bytecode/Instruction.h:
-        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
-        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
-        * bytecode/Opcode.h:
-        (JSC::):
-        * bytecode/StructureStubInfo.cpp: Copied from bytecode/CodeBlock.cpp.
-        (JSC::StructureStubInfo::deref):
-        * bytecode/StructureStubInfo.h: Copied from bytecode/CodeBlock.h.
-        (JSC::StructureStubInfo::StructureStubInfo):
-        (JSC::StructureStubInfo::initGetByIdSelf):
-        (JSC::StructureStubInfo::initGetByIdProto):
-        (JSC::StructureStubInfo::initGetByIdChain):
-        (JSC::StructureStubInfo::initGetByIdSelfList):
-        (JSC::StructureStubInfo::initGetByIdProtoList):
-        (JSC::StructureStubInfo::initPutByIdTransition):
-        (JSC::StructureStubInfo::initPutByIdReplace):
-        (JSC::StructureStubInfo::):
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::emitResolve):
-        (JSC::BytecodeGenerator::emitGetById):
-        (JSC::BytecodeGenerator::emitPutById):
-        (JSC::BytecodeGenerator::emitCall):
-        (JSC::BytecodeGenerator::emitConstruct):
-        (JSC::BytecodeGenerator::emitCatch):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::tryCTICachePutByID):
-        (JSC::Interpreter::tryCTICacheGetByID):
-        (JSC::Interpreter::cti_op_get_by_id_self_fail):
-        (JSC::getPolymorphicAccessStructureListSlot):
-        (JSC::Interpreter::cti_op_get_by_id_proto_list):
-        (JSC::Interpreter::cti_op_resolve_global):
-        * jit/JIT.cpp:
-        (JSC::JIT::JIT):
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileSlowCases):
-        (JSC::JIT::privateCompile):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::compileGetByIdHotPath):
-        (JSC::JIT::compilePutByIdHotPath):
-        (JSC::JIT::compileGetByIdSlowCase):
-        (JSC::JIT::compilePutByIdSlowCase):
-        (JSC::JIT::privateCompileGetByIdSelfList):
-        (JSC::JIT::privateCompileGetByIdProtoList):
-        (JSC::JIT::privateCompileGetByIdChainList):
-
-2008-12-11  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Remove CTI_ARGUMENTS mode, use va_start implementation on Windows,
-        unifying JIT callback (cti_*) argument access on OS X & Windows
-
-        No performance impact.
-
-        * interpreter/Interpreter.h:
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JIT.h:
-        * jit/JITInlineMethods.h:
-        (JSC::JIT::emitCTICall):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::privateCompilePutByIdTransition):
-        * wtf/Platform.h:
-
-2008-12-11  Holger Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon Hausmann.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20953
-
-        For Qt it is not pratical to have a FontCache and GlyphPageTreeNode
-        implementation. This is one of the reasons why the Qt port is currently not
-        using WebCore/platform/graphics/Font.cpp. By allowing to not use
-        the simple/fast-path the Qt port will be able to use it.
-
-        Introduce USE(FONT_FAST_PATH) and define it for every port but the
-        Qt one.
-
-        * wtf/Platform.h: Enable USE(FONT_FAST_PATH)
-
-2008-12-11  Gabor Loki  <loki@inf.u-szeged.hu>
-
-        Reviewed by Darin Adler and landed by Holger Freyther.
-
-        <https://bugs.webkit.org/show_bug.cgi?id=22648>
-        Fix threading on Qt-port and Gtk-port for Sampling tool.
-
-        * wtf/ThreadingGtk.cpp:
-        (WTF::waitForThreadCompletion):
-        * wtf/ThreadingQt.cpp:
-        (WTF::waitForThreadCompletion):
-
-2008-12-10  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 22734: Debugger crashes when stepping into a function call in a return statement
-        <https://bugs.webkit.org/show_bug.cgi?id=22734>
-        <rdar://problem/6426796>
-
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator): The DebuggerCallFrame uses
-        the 'this' value stored in a callFrame, so op_convert_this should be
-        emitted at the beginning of a function body when generating bytecode
-        with debug hooks.
-        * debugger/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::thisObject): The assertion inherent in the call
-        to asObject() here is valid, because any 'this' value should have been
-        converted to a JSObject*.
-
-2008-12-10  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Port more of the JIT to use the MacroAssembler interface.
-        
-        Everything in the main pass, bar a few corner cases (operations with required
-        registers, or calling convention code).  Slightly refactors array creation,
-        moving the offset calculation into the callFrame into C code (reducing code
-        planted).
-
-        Overall this appears to be a 1% win on v8-tests, due to the smaller immediates
-        being planted (in jfalse in particular).
-
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::cti_op_new_array):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileSlowCases):
-        * jit/JIT.h:
-        * wrec/WRECGenerator.cpp:
-        (JSC::WREC::Generator::generateEnter):
-
-2008-12-10  Sam Weinig  <sam@webkit.org>
-
-        Fix non-JIT builds.
-
-        * bytecode/CodeBlock.h:
-
-2008-12-10  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        <rdar://problem/6428332> Remove the CTI return address table from CodeBlock
-
-        Step 2:
-
-        Convert the return address table from a HashMap to a sorted Vector.  This
-        reduces the size of the data structure by ~4.5MB on Membuster head.
-
-        SunSpider reports a 0.5% progression.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::sizeInBytes): Generic method to get the cost of a Vector.
-        (JSC::CodeBlock::dumpStatistics): Add dumping of member sizes.
-        * bytecode/CodeBlock.h:
-        (JSC::PC::PC): Struct representing NativePC -> VirtualPC mappings.
-        (JSC::getNativePC): Helper for binary chop.
-        (JSC::CodeBlock::getBytecodeIndex): Used to get the VirtualPC from a
-        NativePC using a binary chop of the pcVector.
-        (JSC::CodeBlock::pcVector): Accessor.
-
-        * interpreter/Interpreter.cpp:
-        (JSC::vPCForPC): Use getBytecodeIndex instead of jitReturnAddressVPCMap().get().
-        (JSC::Interpreter::cti_op_instanceof): Ditto.
-        (JSC::Interpreter::cti_op_resolve): Ditto.
-        (JSC::Interpreter::cti_op_resolve_func): Ditto.
-        (JSC::Interpreter::cti_op_resolve_skip): Ditto.
-        (JSC::Interpreter::cti_op_resolve_with_base): Ditto.
-        (JSC::Interpreter::cti_op_throw): Ditto.
-        (JSC::Interpreter::cti_op_in): Ditto.
-        (JSC::Interpreter::cti_vm_throw): Ditto.
-
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompile): Reserve exact capacity and fill the pcVector.
-
-2008-12-09  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Added WREC support for an assertion followed by a quantifier. Fixed
-        PCRE to match.
-
-        * wrec/WRECParser.cpp:
-        (JSC::WREC::Parser::parseParentheses): Throw away the quantifier, since
-        it's meaningless. (Firefox does the same.)
-
-        * pcre/pcre_compile.cpp:
-        (compileBranch): ditto.
-
-2008-12-09  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        In preparation for compiling WREC without PCRE:
-        
-        Further relaxed WREC's parsing to be more web-compatible. Fixed PCRE to
-        match in cases where it didn't already.
-        
-        Changed JavaScriptCore to report syntax errors detected by WREC, rather
-        than falling back on PCRE any time WREC sees an error.
-        
-        * pcre/pcre_compile.cpp:
-        (checkEscape): Relaxed parsing of \c and \N escapes to be more
-        web-compatible.
-        
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::RegExp): Only fall back on PCRE if WREC has not reported
-        a syntax error.
-
-        * wrec/WREC.cpp:
-        (JSC::WREC::Generator::compileRegExp): Fixed some error reporting to
-        match PCRE.
-
-        * wrec/WRECParser.cpp: Added error messages that match PCRE.
-
-        (JSC::WREC::Parser::consumeGreedyQuantifier):
-        (JSC::WREC::Parser::parseParentheses):
-        (JSC::WREC::Parser::parseCharacterClass):
-        (JSC::WREC::Parser::parseNonCharacterEscape): Updated the above functions to
-        use the new setError API.
-
-        (JSC::WREC::Parser::consumeEscape): Relaxed parsing of \c \N \u \x \B
-        to be more web-compatible.
-
-        (JSC::WREC::Parser::parseAlternative): Distinguish between a malformed
-        quantifier and a quantifier with no prefix, like PCRE does.
-
-        (JSC::WREC::Parser::consumeParenthesesType): Updated to use the new setError API.
-
-        * wrec/WRECParser.h:
-        (JSC::WREC::Parser::error):
-        (JSC::WREC::Parser::syntaxError):
-        (JSC::WREC::Parser::parsePattern):
-        (JSC::WREC::Parser::reset):
-        (JSC::WREC::Parser::setError): Store error messages instead of error codes,
-        to provide for exception messages. Use a setter for reporting errors, so
-        errors detected early are not overwritten by errors detected later.
-
-2008-12-09  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Use va_args to access cti function arguments.
-        https://bugs.webkit.org/show_bug.cgi?id=22774
-
-        This may be a minor regression, but we'll take the hit if so to reduce fragility.
-
-        * interpreter/Interpreter.cpp:
-        * interpreter/Interpreter.h:
-
-2008-12-09  Sam Weinig  <sam@webkit.org>
-
-        Reviewed twice by Cameron Zwarich.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=22752
-        Clear SymbolTable after codegen for Function codeblocks that
-        don't require an activation
-
-        This is a ~1.5MB improvement on Membuster-head.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dumpStatistics): Add logging of non-empty symbol tables
-        and total size used by symbol tables.
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::generate): Clear the symbol table here.
-
-2008-12-09  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        Remove unnecessary extra lookup when throwing an exception.
-        We used to first lookup the target offset using getHandlerForVPC
-        and then we would lookup the native code stub using 
-        nativeExceptionCodeForHandlerVPC.  Instead, we can just pass around
-        the HandlerInfo.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::handlerForVPC): Return the HandlerInfo.
-        * bytecode/CodeBlock.h: Remove nativeExceptionCodeForHandlerVPC.
-
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::throwException): Return a HandlerInfo instead of
-        and Instruction offset.
-        (JSC::Interpreter::privateExecute): Get the offset from HandlerInfo.
-        (JSC::Interpreter::cti_op_throw): Get the native code from the HandleInfo.
-        (JSC::Interpreter::cti_vm_throw): Ditto.
-        * interpreter/Interpreter.h:
-
-2008-12-09  Eric Seidel  <eric@webkit.org>
-
-        Build fix only, no review.
-
-        Speculative fix for the Chromium-Windows bot.
-        Add JavaScriptCore/os-win32 to the include path (for stdint.h)
-        Strangely it builds fine on my local windows box (or at least doesn't hit this error)
-
-        * JavaScriptCore.scons:
-
-2008-12-09  Eric Seidel  <eric@webkit.org>
-
-        No review, build fix only.
-        
-        Add ExecutableAllocator files missing from Scons build.
-
-        * JavaScriptCore.scons:
-
-2008-12-09  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22631
-        Allow ScriptCallFrame query names of functions in the call stack.
-
-        * JavaScriptCore.exp: added InternalFunction::name and
-        UString operator==() as exported symbol
-
-2008-12-08  Judit Jasz  <jasy@inf.u-szeged.hu>
-
-        Reviewed and tweaked by Cameron Zwarich.
-
-        Bug 22352: Annotate opcodes with their length
-        <https://bugs.webkit.org/show_bug.cgi?id=22352>
-
-        * bytecode/Opcode.cpp:
-        * bytecode/Opcode.h:
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileSlowCases):
-
-2008-12-08  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt.
-        
-        Implemented more of the relaxed and somewhat weird rules for deciding
-        how to interpret a non-pattern-character.
-        
-        * wrec/Escapes.h:
-        (JSC::WREC::Escape::):
-        (JSC::WREC::Escape::Escape): Eliminated Escape::None because it was
-        unused. If you see an '\\', it's either a valid escape or an error.
-
-        * wrec/Quantifier.h:
-        (JSC::WREC::Quantifier::Quantifier):
-        * wrec/WRECGenerator.cpp:
-        (JSC::WREC::Generator::generateNonGreedyQuantifier):
-        (JSC::WREC::Generator::generateGreedyQuantifier): Renamed "noMaxSpecified"
-        to "Infinity", since that's what it means.
-
-        * wrec/WRECParser.cpp:
-        (JSC::WREC::Parser::consumeGreedyQuantifier): Re-wrote {n,m} parsing rules
-        because they were too strict before. Added support for backtracking
-        in the case where the {n,m} fails to parse as a quantifier, and yet is
-        not a syntax error.
-
-        (JSC::WREC::Parser::parseCharacterClass):
-        (JSC::WREC::Parser::parseNonCharacterEscape): Eliminated Escape::None,
-        as above.
-
-        (JSC::WREC::Parser::consumeEscape): Don't treat ASCII and _ escapes
-        as syntax errors. See fast/regex/non-pattern-characters.html.
-        
-        * wrec/WRECParser.h:
-        (JSC::WREC::Parser::SavedState::SavedState):
-        (JSC::WREC::Parser::SavedState::restore): Added a state backtracker,
-        since parsing {n,m} forms requires backtracking if the form turns out
-        not to be a quantifier.
-
-2008-12-08  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt.
-        
-        Refactored WREC parsing so that only one piece of code needs to know
-        the relaxed and somewhat weird rules for deciding how to interpret a
-        non-pattern-character, in preparation for implementing those rules.
-        
-        Also, implemented the relaxed and somewhat weird rules for '}' and ']'.
-
-        * wrec/WREC.cpp: Reduced the regular expression size limit. Now that
-        WREC handles ']' properly, it compiles fast/js/regexp-charclass-crash.html,
-        which makes it hang at the old limit. (The old limit was based on the
-        misimpression that the same value in PCRE limited the regular expression
-        pattern size; in reality, it limited the expected compiled regular
-        expression size. WREC doesn't have a way to calculate an expected
-        compiled regular expression size, but this should be good enough.)
-
-        * wrec/WRECParser.cpp:
-        (JSC::WREC::parsePatternCharacterSequence): Nixed this function because
-        it contained a second copy of the logic for handling non-pattern-characters,
-        which is about to get a lot more complicated.
-
-        (JSC::WREC::PatternCharacterSequence::PatternCharacterSequence): 
-        (JSC::WREC::PatternCharacterSequence::size):
-        (JSC::WREC::PatternCharacterSequence::append):
-        (JSC::WREC::PatternCharacterSequence::flush): Helper object for generating
-        an optimized sequence of pattern characters.
-
-        (JSC::WREC::Parser::parseNonCharacterEscape): Renamed to reflect the fact
-        that the main parseAlternative loop handles character escapes.
-
-        (JSC::WREC::Parser::parseAlternative): Moved pattern character sequence
-        logic from parsePatternCharacterSequence to here, using
-        PatternCharacterSequence to help with the details.
-
-        * wrec/WRECParser.h: Updated for renames.
-
-2008-12-08  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Geoff Garen.
-
-        <rdar://problem/6166088> Give JSGlobalContextCreate a behavior that is concurrency aware,
-        and un-deprecate it
-
-        * API/JSContextRef.cpp: (JSGlobalContextCreate):
-        * API/JSContextRef.h:
-        Use a unique context group for the context, unless the application was linked against old
-        JavaScriptCore.
-
-2008-12-08  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Cameron Zwarich.
-
-        Fix for <rdar://problem/6428332> Remove the CTI return address table from CodeBlock
-
-        Step 1:
-
-        Remove use of jitReturnAddressVPCMap when looking for vPC to store Structures
-        in for cached lookup.  Instead, use the offset in the StructureStubInfo that is
-        already required.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dumpStatistics): Fix extraneous semicolon.
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::tryCTICachePutByID):
-        (JSC::Interpreter::tryCTICacheGetByID):
-        (JSC::Interpreter::cti_op_get_by_id_self_fail):
-        (JSC::Interpreter::cti_op_get_by_id_proto_list):
-        * jit/JIT.h:
-        (JSC::JIT::compileGetByIdSelf):
-        (JSC::JIT::compileGetByIdProto):
-        (JSC::JIT::compileGetByIdChain):
-        (JSC::JIT::compilePutByIdReplace):
-        (JSC::JIT::compilePutByIdTransition):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::patchGetByIdSelf):
-        (JSC::JIT::patchPutByIdReplace):
-        (JSC::JIT::privateCompilePatchGetArrayLength): Remove extra call to getStubInfo.
-        (JSC::JIT::privateCompileGetByIdSelf):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdChain):
-        (JSC::JIT::privateCompilePutByIdReplace):
-
-2008-12-08  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Port the op_j?n?eq_null JIT code generation to use the MacroAssembler,
-        and clean up slightly at the same time.  The 'j' forms currently compare,
-        then set a register, then compare again, then branch.  Branch directly on
-        the result of the first compare.
-
-        Around a 1% progression on deltablue, crypto & early boyer, for about 1/2%
-        overall on v8-tests.
-
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::compileGetByIdSlowCase):
-
-2008-12-08  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Expand MacroAssembler to support more operations, required by the JIT.
-
-        Generally adds more operations and permutations of operands to the existing
-        interface.  Rename 'jset' to 'jnz' and 'jnset' to 'jz', which seem clearer,
-        and require that immediate pointer operands (though not pointer addresses to
-        load and store instructions) are wrapped in a ImmPtr() type, akin to Imm32().
-
-        No performance impact.
-
-        * assembler/MacroAssembler.h:
-        (JSC::MacroAssembler::):
-        (JSC::MacroAssembler::ImmPtr::ImmPtr):
-        (JSC::MacroAssembler::add32):
-        (JSC::MacroAssembler::and32):
-        (JSC::MacroAssembler::or32):
-        (JSC::MacroAssembler::sub32):
-        (JSC::MacroAssembler::xor32):
-        (JSC::MacroAssembler::loadPtr):
-        (JSC::MacroAssembler::load32):
-        (JSC::MacroAssembler::storePtr):
-        (JSC::MacroAssembler::store32):
-        (JSC::MacroAssembler::poke):
-        (JSC::MacroAssembler::move):
-        (JSC::MacroAssembler::testImm32):
-        (JSC::MacroAssembler::jae32):
-        (JSC::MacroAssembler::jb32):
-        (JSC::MacroAssembler::jePtr):
-        (JSC::MacroAssembler::je32):
-        (JSC::MacroAssembler::jnePtr):
-        (JSC::MacroAssembler::jne32):
-        (JSC::MacroAssembler::jnzPtr):
-        (JSC::MacroAssembler::jnz32):
-        (JSC::MacroAssembler::jzPtr):
-        (JSC::MacroAssembler::jz32):
-        (JSC::MacroAssembler::joSub32):
-        (JSC::MacroAssembler::jump):
-        (JSC::MacroAssembler::sete32):
-        (JSC::MacroAssembler::setne32):
-        (JSC::MacroAssembler::setnz32):
-        (JSC::MacroAssembler::setz32):
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::addl_mr):
-        (JSC::X86Assembler::andl_i8r):
-        (JSC::X86Assembler::cmpl_rm):
-        (JSC::X86Assembler::cmpl_mr):
-        (JSC::X86Assembler::cmpl_i8m):
-        (JSC::X86Assembler::subl_mr):
-        (JSC::X86Assembler::testl_i32m):
-        (JSC::X86Assembler::xorl_i32r):
-        (JSC::X86Assembler::movl_rm):
-        (JSC::X86Assembler::modRm_opmsib):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
         * jit/JITInlineMethods.h:
-        (JSC::JIT::emitGetVirtualRegister):
-        (JSC::JIT::emitPutCTIArgConstant):
-        (JSC::JIT::emitPutCTIParam):
-        (JSC::JIT::emitPutImmediateToCallFrameHeader):
-        (JSC::JIT::emitInitRegister):
+        (JSC::JIT::restoreArgumentReference):
         (JSC::JIT::checkStructure):
-        (JSC::JIT::emitJumpIfJSCell):
-        (JSC::JIT::emitJumpIfNotJSCell):
-        (JSC::JIT::emitJumpSlowCaseIfNotImmNum):
-
-2008-12-08  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Fixed a bug where WREC would allow a quantifier whose minimum was
-        greater than its maximum.
-        
-        * wrec/Quantifier.h:
-        (JSC::WREC::Quantifier::Quantifier): ASSERT that the quantifier is not
-        backwards.
-        
-        * wrec/WRECParser.cpp:
-        (JSC::WREC::Parser::consumeGreedyQuantifier): Verify that the minimum
-        is not greater than the maximum.
-
-2008-12-08  Eric Seidel  <eric@webkit.org>
-        
-        Build fix only, no review.
-
-        * JavaScriptCore.scons: add bytecode/JumpTable.cpp
-
-2008-12-08  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        Patch for https://bugs.webkit.org/show_bug.cgi?id=22716
-        <rdar://problem/6428315>
-        Add RareData structure to CodeBlock for infrequently used auxiliary data
-        members.
-
-        Reduces memory on Membuster-head by ~.5MB 
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::dumpStatistics):
-        (JSC::CodeBlock::mark):
-        (JSC::CodeBlock::getHandlerForVPC):
-        (JSC::CodeBlock::nativeExceptionCodeForHandlerVPC):
-        (JSC::CodeBlock::shrinkToFit):
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::numberOfExceptionHandlers):
-        (JSC::CodeBlock::addExceptionHandler):
-        (JSC::CodeBlock::exceptionHandler):
-        (JSC::CodeBlock::addFunction):
-        (JSC::CodeBlock::function):
-        (JSC::CodeBlock::addUnexpectedConstant):
-        (JSC::CodeBlock::unexpectedConstant):
-        (JSC::CodeBlock::addRegExp):
-        (JSC::CodeBlock::regexp):
-        (JSC::CodeBlock::numberOfImmediateSwitchJumpTables):
-        (JSC::CodeBlock::addImmediateSwitchJumpTable):
-        (JSC::CodeBlock::immediateSwitchJumpTable):
-        (JSC::CodeBlock::numberOfCharacterSwitchJumpTables):
-        (JSC::CodeBlock::addCharacterSwitchJumpTable):
-        (JSC::CodeBlock::characterSwitchJumpTable):
-        (JSC::CodeBlock::numberOfStringSwitchJumpTables):
-        (JSC::CodeBlock::addStringSwitchJumpTable):
-        (JSC::CodeBlock::stringSwitchJumpTable):
-        (JSC::CodeBlock::evalCodeCache):
-        (JSC::CodeBlock::createRareDataIfNecessary):
-
-2008-11-26  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Anders Carlsson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=16814
-        Allow ports to disable ActiveX->NPAPI conversion for Media Player.
-        Improve handling of miscellaneous ActiveX objects.
-
-        * wtf/Platform.h: Add another ENABLE(...).
-
-2008-12-08  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Add dumping of CodeBlock member structure usage.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dumpStatistics):
-        * bytecode/EvalCodeCache.h:
-        (JSC::EvalCodeCache::isEmpty):
-
-2008-12-08  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 22555: Sort "children" sections in Xcode project files
-
-        <https://bugs.webkit.org/show_bug.cgi?id=22555>
-
-        Reviewed by Eric Seidel.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj: Sorted.
-
-2008-12-08  Tony Chang  <tony@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Enable Pan scrolling only when building on PLATFORM(WIN_OS)
-        Previously platforms like Apple Windows WebKit, Cairo Windows WebKit,
-        Wx and Chromium were enabling it explicitly, now we just turn it on
-        for all WIN_OS, later platforms can turn it off as needed on Windows
-        (or turn it on under Linux, etc.)
-        https://bugs.webkit.org/show_bug.cgi?id=22698
-
-        * wtf/Platform.h:
-
-2008-12-08  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Cameron Zwarich.
-
-        Add basic memory statistics dumping for CodeBlock.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dumpStatistics):
-        (JSC::CodeBlock::CodeBlock):
-        (JSC::CodeBlock::~CodeBlock):
-        * bytecode/CodeBlock.h:
-
-2008-12-08  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Fix the Linux build with newer gcc/glibc.
-
-        * jit/ExecutableAllocatorPosix.cpp: Include unistd.h for
-        getpagesize(), according to
-        http://opengroup.org/onlinepubs/007908775/xsh/getpagesize.html
-
-2008-12-08  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Fix the build with Qt on Windows.
-
-        * JavaScriptCore.pri: Compile ExecutableAllocatorWin.cpp on Windows.
-
-2008-12-07  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by NOBODY (Buildfix).
-
-        Fix non-WREC builds
-
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::RegExp):
-
-2008-12-07  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by NOBODY (Build fix).
-
-        Put ENABLE(ASSEMBLER) guards around use of ExecutableAllocator in global data
-
-        Correct Qt and Gtk project files
-
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * runtime/JSGlobalData.h:
-
-2008-12-07  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by NOBODY (Build fix).
-
-        Add new files to other projects.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.pro:
-
-2008-12-07  Oliver Hunt  <oliver@apple.com>
-
-        Rubber stamped by Mark Rowe.
-
-        Rename ExecutableAllocatorMMAP to the more sensible ExecutableAllocatorPosix
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * jit/ExecutableAllocator.h:
-        * jit/ExecutableAllocatorPosix.cpp: Renamed from JavaScriptCore/jit/ExecutableAllocatorMMAP.cpp.
-        (JSC::ExecutableAllocator::intializePageSize):
-        (JSC::ExecutablePool::systemAlloc):
-        (JSC::ExecutablePool::systemRelease):
-
-2008-12-07  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Cameron Zwarich and Sam Weinig
-
-        <rdar://problem/6309878> Need more granular control over allocation of executable memory (21783)
-        <https://bugs.webkit.org/show_bug.cgi?id=21783>
-
-        Add a new allocator for use by the JIT that provides executable pages, so
-        we can get rid of the current hack that makes the entire heap executable.
-
-        1-2% progression on SunSpider-v8, 1% on SunSpider.  Reduces memory usage as well!
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * assembler/AssemblerBuffer.h:
-        (JSC::AssemblerBuffer::size):
-        (JSC::AssemblerBuffer::executableCopy):
-        * assembler/MacroAssembler.h:
-        (JSC::MacroAssembler::size):
-        (JSC::MacroAssembler::copyCode):
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::size):
-        (JSC::X86Assembler::executableCopy):
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::~CodeBlock):
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::executablePool):
-        (JSC::CodeBlock::setExecutablePool):
-        * bytecode/Instruction.h:
-        (JSC::PolymorphicAccessStructureList::derefStructures):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::~Interpreter):
-        * interpreter/Interpreter.h:
-        * jit/ExecutableAllocator.cpp: Added.
-        * jit/ExecutableAllocator.h: Added.
-        (JSC::ExecutablePool::create):
-        (JSC::ExecutablePool::alloc):
-        (JSC::ExecutablePool::~ExecutablePool):
-        (JSC::ExecutablePool::available):
-        (JSC::ExecutablePool::ExecutablePool):
-        (JSC::ExecutablePool::poolAllocate):
-        (JSC::ExecutableAllocator::ExecutableAllocator):
-        (JSC::ExecutableAllocator::poolForSize):
-        (JSC::ExecutablePool::sizeForAllocation):
-        * jit/ExecutableAllocatorMMAP.cpp: Added.
-        (JSC::ExecutableAllocator::intializePageSize):
-        (JSC::ExecutablePool::systemAlloc):
-        (JSC::ExecutablePool::systemRelease):
-        * jit/ExecutableAllocatorWin.cpp: Added.
-        (JSC::ExecutableAllocator::intializePageSize):
-        (JSC::ExecutablePool::systemAlloc):
-        (JSC::ExecutablePool::systemRelease):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompile):
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        * jit/JIT.h:
-        (JSC::JIT::compileCTIMachineTrampolines):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_construct_verify):
+        (JSC::JIT::emit_op_resolve_global):
+        (JSC::JIT::emit_op_jeq_null):
+        (JSC::JIT::emit_op_jneq_null):
+        (JSC::JIT::emit_op_to_jsnumber):
+        (JSC::JIT::emit_op_catch):
+        (JSC::JIT::emit_op_eq_null):
+        (JSC::JIT::emit_op_neq_null):
+        (JSC::JIT::emit_op_convert_this):
+        (JSC::JIT::emit_op_profile_will_call):
+        (JSC::JIT::emit_op_profile_did_call):
+        (JSC::JIT::emitSlow_op_get_by_val):
         * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::compileGetDirectOffset):
         (JSC::JIT::privateCompilePutByIdTransition):
         (JSC::JIT::privateCompilePatchGetArrayLength):
-        (JSC::JIT::privateCompileGetByIdSelf):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdSelfList):
-        (JSC::JIT::privateCompileGetByIdProtoList):
-        (JSC::JIT::privateCompileGetByIdChainList):
-        (JSC::JIT::privateCompileGetByIdChain):
-        (JSC::JIT::privateCompilePutByIdReplace):
-        * parser/Nodes.cpp:
-        (JSC::RegExpNode::emitBytecode):
-        * runtime/JSGlobalData.h:
-        (JSC::JSGlobalData::poolForSize):
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::RegExp):
-        (JSC::RegExp::create):
-        (JSC::RegExp::~RegExp):
-        * runtime/RegExp.h:
-        * runtime/RegExpConstructor.cpp:
-        (JSC::constructRegExp):
-        * runtime/RegExpPrototype.cpp:
-        (JSC::regExpProtoFuncCompile):
-        * runtime/StringPrototype.cpp:
-        (JSC::stringProtoFuncMatch):
-        (JSC::stringProtoFuncSearch):
-        * wrec/WREC.cpp:
-        (JSC::WREC::Generator::compileRegExp):
-        * wrec/WRECGenerator.h:
-        * wtf/FastMalloc.cpp:
-        * wtf/FastMalloc.h:
-        * wtf/TCSystemAlloc.cpp:
-        (TryMmap):
-        (TryVirtualAlloc):
-        (TryDevMem):
-        (TCMalloc_SystemRelease):
-
-2008-12-06  Sam Weinig  <sam@webkit.org>
-
-        Fix the Gtk build.
-
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::compileGetByIdHotPath):
-        (JSC::JIT::compilePutByIdHotPath):
-
-2008-12-06  Sam Weinig  <sam@webkit.org>
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
 
-        Reviewed by Cameron Zwarich,
+2009-06-19  Gavin Barraclough  <barraclough@apple.com>
 
-        Move CodeBlock constructor into the .cpp file.
-
-        Sunspider reports a .7% progression, but I can only assume this
-        is noise.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::CodeBlock):
-        * bytecode/CodeBlock.h:
+        Reviewed by NOBODY (Windows build fix).
 
-2008-12-06  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Cameron Zwarich.
-
-        Split JumpTable code into its own file.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * bytecode/CodeBlock.cpp:
-        * bytecode/CodeBlock.h:
-        * bytecode/JumpTable.cpp: Copied from bytecode/CodeBlock.cpp.
-        * bytecode/JumpTable.h: Copied from bytecode/CodeBlock.h.
-
-2008-12-05  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Cameron Zwarich.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=22715
-        Encapsulate more CodeBlock members in preparation
-        of moving some of them to a rare data structure.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::locationForOffset):
-        (JSC::printConditionalJump):
-        (JSC::printGetByIdOp):
-        (JSC::printPutByIdOp):
-        (JSC::CodeBlock::printStructure):
-        (JSC::CodeBlock::printStructures):
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::~CodeBlock):
-        (JSC::CodeBlock::unlinkCallers):
-        (JSC::CodeBlock::derefStructures):
-        (JSC::CodeBlock::refStructures):
-        (JSC::CodeBlock::mark):
-        (JSC::CodeBlock::getHandlerForVPC):
-        (JSC::CodeBlock::nativeExceptionCodeForHandlerVPC):
-        (JSC::CodeBlock::lineNumberForVPC):
-        (JSC::CodeBlock::expressionRangeForVPC):
-        (JSC::CodeBlock::shrinkToFit):
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::CodeBlock):
-        (JSC::CodeBlock::addCaller):
-        (JSC::CodeBlock::removeCaller):
-        (JSC::CodeBlock::isKnownNotImmediate):
-        (JSC::CodeBlock::isConstantRegisterIndex):
-        (JSC::CodeBlock::getConstant):
-        (JSC::CodeBlock::isTemporaryRegisterIndex):
-        (JSC::CodeBlock::getStubInfo):
-        (JSC::CodeBlock::getCallLinkInfo):
-        (JSC::CodeBlock::instructions):
-        (JSC::CodeBlock::setJITCode):
-        (JSC::CodeBlock::jitCode):
-        (JSC::CodeBlock::ownerNode):
-        (JSC::CodeBlock::setGlobalData):
-        (JSC::CodeBlock::setThisRegister):
-        (JSC::CodeBlock::thisRegister):
-        (JSC::CodeBlock::setNeedsFullScopeChain):
-        (JSC::CodeBlock::needsFullScopeChain):
-        (JSC::CodeBlock::setUsesEval):
-        (JSC::CodeBlock::usesEval):
-        (JSC::CodeBlock::setUsesArguments):
-        (JSC::CodeBlock::usesArguments):
-        (JSC::CodeBlock::codeType):
-        (JSC::CodeBlock::source):
-        (JSC::CodeBlock::sourceOffset):
-        (JSC::CodeBlock::addGlobalResolveInstruction):
-        (JSC::CodeBlock::numberOfPropertyAccessInstructions):
-        (JSC::CodeBlock::addPropertyAccessInstruction):
-        (JSC::CodeBlock::propertyAccessInstruction):
-        (JSC::CodeBlock::numberOfCallLinkInfos):
-        (JSC::CodeBlock::addCallLinkInfo):
-        (JSC::CodeBlock::callLinkInfo):
-        (JSC::CodeBlock::numberOfJumpTargets):
-        (JSC::CodeBlock::addJumpTarget):
-        (JSC::CodeBlock::jumpTarget):
-        (JSC::CodeBlock::lastJumpTarget):
-        (JSC::CodeBlock::numberOfExceptionHandlers):
-        (JSC::CodeBlock::addExceptionHandler):
-        (JSC::CodeBlock::exceptionHandler):
-        (JSC::CodeBlock::addExpressionInfo):
-        (JSC::CodeBlock::numberOfLineInfos):
-        (JSC::CodeBlock::addLineInfo):
-        (JSC::CodeBlock::lastLineInfo):
-        (JSC::CodeBlock::jitReturnAddressVPCMap):
-        (JSC::CodeBlock::numberOfIdentifiers):
-        (JSC::CodeBlock::addIdentifier):
-        (JSC::CodeBlock::identifier):
-        (JSC::CodeBlock::numberOfConstantRegisters):
-        (JSC::CodeBlock::addConstantRegister):
-        (JSC::CodeBlock::constantRegister):
-        (JSC::CodeBlock::addFunction):
-        (JSC::CodeBlock::function):
-        (JSC::CodeBlock::addFunctionExpression):
-        (JSC::CodeBlock::functionExpression):
-        (JSC::CodeBlock::addUnexpectedConstant):
-        (JSC::CodeBlock::unexpectedConstant):
-        (JSC::CodeBlock::addRegExp):
-        (JSC::CodeBlock::regexp):
-        (JSC::CodeBlock::symbolTable):
-        (JSC::CodeBlock::evalCodeCache):
-        New inline setters/getters.
-
-        (JSC::ProgramCodeBlock::ProgramCodeBlock):
-        (JSC::ProgramCodeBlock::~ProgramCodeBlock):
-        (JSC::ProgramCodeBlock::clearGlobalObject):
-        * bytecode/SamplingTool.cpp:
-        (JSC::ScopeSampleRecord::sample):
-        (JSC::SamplingTool::dump):
-        * bytecompiler/BytecodeGenerator.cpp:
-        * bytecompiler/BytecodeGenerator.h:
-        * bytecompiler/Label.h:
-        * interpreter/CallFrame.cpp:
-        * interpreter/Interpreter.cpp:
-        * jit/JIT.cpp:
-        * jit/JITCall.cpp:
-        * jit/JITInlineMethods.h:
-        * jit/JITPropertyAccess.cpp:
-        * parser/Nodes.cpp:
-        * runtime/Arguments.h:
-        * runtime/ExceptionHelpers.cpp:
-        * runtime/JSActivation.cpp:
-        * runtime/JSActivation.h:
-        * runtime/JSGlobalObject.cpp:
-        Change direct access to use new getter/setters.
-
-2008-12-05  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Prevent GCC4.2 from hanging when trying to compile Interpreter.cpp.
-        Added "-fno-var-tracking" compiler flag.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22704
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2008-12-05  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Ordering of branch operands in MacroAssembler in unnecessarily  inconsistent.
-
-        je, jg etc take an immediate operand as the second argument, but for the
-        equality branches (je, jne) the immediate operand was the first argument.  This
-        was unnecessarily inconsistent.  Change je, jne methods to take the immediate
-        as the second argument.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22703
-
-        * assembler/MacroAssembler.h:
-        (JSC::MacroAssembler::je32):
-        (JSC::MacroAssembler::jne32):
-        * jit/JIT.cpp:
-        (JSC::JIT::compileOpStrictEq):
-        * wrec/WRECGenerator.cpp:
-        (JSC::WREC::Generator::generateEnter):
-        (JSC::WREC::Generator::generateNonGreedyQuantifier):
-        (JSC::WREC::Generator::generateGreedyQuantifier):
-        (JSC::WREC::Generator::generatePatternCharacterPair):
-        (JSC::WREC::Generator::generatePatternCharacter):
-        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
-        (JSC::WREC::Generator::generateCharacterClassInverted):
-        (JSC::WREC::Generator::generateAssertionBOL):
-        (JSC::WREC::Generator::generateAssertionWordBoundary):
-
-2008-12-05  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Second tranche of porting JIT.cpp to MacroAssembler interface.
-
-        * assembler/MacroAssembler.h:
-        (JSC::MacroAssembler::mul32):
-        (JSC::MacroAssembler::jl32):
-        (JSC::MacroAssembler::jnzSub32):
-        (JSC::MacroAssembler::joAdd32):
-        (JSC::MacroAssembler::joMul32):
-        (JSC::MacroAssembler::jzSub32):
-        * jit/JIT.cpp:
-        (JSC::JIT::emitSlowScriptCheck):
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileSlowCases):
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
         * jit/JIT.h:
         * jit/JITInlineMethods.h:
-        (JSC::JIT::emitJumpIfNotJSCell):
-        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
-
-2008-12-05  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 22609: Provide a build-time choice when generating hash tables for properties of built-in DOM objects
-
-        <https://bugs.webkit.org/show_bug.cgi?id=22609>
-        <rdar://problem/6331749>
-
-        Reviewed by Darin Adler.
 
-        Initial patch by Yosen Lin.  Adapted for ToT WebKit by David Kilzer.
-
-        Added back the code that generates a "compact" hash (instead of a
-        perfect hash) as a build-time option using the
-        ENABLE(PERFECT_HASH_SIZE) macro as defined in Lookup.h.
-
-        * create_hash_table: Rename variables to differentiate perfect hash
-        values from compact hash values.  Added back code to compute compact
-        hash tables.  Generate both hash table sizes and emit
-        conditionalized code based on ENABLE(PERFECT_HASH_SIZE).
-        * runtime/Lookup.cpp:
-        (JSC::HashTable::createTable): Added version of createTable() for
-        use with compact hash tables.
-        (JSC::HashTable::deleteTable): Updated to work with compact hash
-        tables.
-        * runtime/Lookup.h: Defined ENABLE(PERFECT_HASH_SIZE) macro here.
-        (JSC::HashEntry::initialize): Set m_next to zero when using compact
-        hash tables.
-        (JSC::HashEntry::setNext): Added for compact hash tables.
-        (JSC::HashEntry::next): Added for compact hash tables.
-        (JSC::HashTable::entry): Added version of entry() for use with
-        compact hash tables.
-        * runtime/Structure.cpp:
-        (JSC::Structure::getEnumerablePropertyNames): Updated to work with
-        compact hash tables.
-
-2008-12-05  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Remove redundant calls to JIT::emitSlowScriptCheck.
-        This is checked in the hot path, so is not needed on the slow path - and the code
-        was being planted before the start of the slow case, so was completely unreachable!
-
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileSlowCases):
-
-2008-12-05  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoff Garen.
+2009-06-19  Gabor Loki  <loki@inf.u-szeged.hu>
 
-        Move JIT::compileOpStrictEq to MacroAssembler interface.
-
-        The rewrite also looks like a small (<1%) performance progression.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22697
-
-        * jit/JIT.cpp:
-        (JSC::JIT::compileOpStrictEq):
-        (JSC::JIT::privateCompileSlowCases):
-        * jit/JIT.h:
-        * jit/JITInlineMethods.h:
-        (JSC::JIT::emitJumpIfJSCell):
-        (JSC::JIT::emitJumpSlowCaseIfJSCell):
-
-2008-12-05  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Remove m_assembler from MacroAssembler::Jump.
-        Keeping a pointer allowed for some syntactic sugar - "link()" looks nicer
-        than "link(this)".  But maintaining this doubles the size of Jump, which
-        is even more unfortunate for the JIT, since there are many large structures
-        holding JmpSrcs.  Probably best to remove it.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22693
-
-        * assembler/MacroAssembler.h:
-        (JSC::MacroAssembler::Jump::Jump):
-        (JSC::MacroAssembler::Jump::link):
-        (JSC::MacroAssembler::Jump::linkTo):
-        (JSC::MacroAssembler::JumpList::link):
-        (JSC::MacroAssembler::JumpList::linkTo):
-        (JSC::MacroAssembler::jae32):
-        (JSC::MacroAssembler::je32):
-        (JSC::MacroAssembler::je16):
-        (JSC::MacroAssembler::jg32):
-        (JSC::MacroAssembler::jge32):
-        (JSC::MacroAssembler::jl32):
-        (JSC::MacroAssembler::jle32):
-        (JSC::MacroAssembler::jnePtr):
-        (JSC::MacroAssembler::jne32):
-        (JSC::MacroAssembler::jnset32):
-        (JSC::MacroAssembler::jset32):
-        (JSC::MacroAssembler::jump):
-        (JSC::MacroAssembler::jzSub32):
-        (JSC::MacroAssembler::joAdd32):
-        (JSC::MacroAssembler::call):
-        * wrec/WREC.cpp:
-        (JSC::WREC::Generator::compileRegExp):
-        * wrec/WRECGenerator.cpp:
-        (JSC::WREC::Generator::generateEnter):
-        (JSC::WREC::Generator::generateBackreferenceQuantifier):
-        (JSC::WREC::Generator::generateNonGreedyQuantifier):
-        (JSC::WREC::Generator::generateGreedyQuantifier):
-        (JSC::WREC::Generator::generatePatternCharacter):
-        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
-        (JSC::WREC::Generator::generateCharacterClassInverted):
-        (JSC::WREC::Generator::generateCharacterClass):
-        (JSC::WREC::Generator::generateParenthesesAssertion):
-        (JSC::WREC::Generator::generateParenthesesInvertedAssertion):
-        (JSC::WREC::Generator::generateParenthesesNonGreedy):
-        (JSC::WREC::Generator::generateParenthesesResetTrampoline):
-        (JSC::WREC::Generator::generateAssertionBOL):
-        (JSC::WREC::Generator::generateAssertionEOL):
-        (JSC::WREC::Generator::generateAssertionWordBoundary):
-        (JSC::WREC::Generator::generateBackreference):
-        (JSC::WREC::Generator::terminateAlternative):
-        (JSC::WREC::Generator::terminateDisjunction):
-        * wrec/WRECParser.h:
-
-2008-12-05  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Simplify JIT generated checks for timeout code, by moving more work into the C function.
-        https://bugs.webkit.org/show_bug.cgi?id=22688
-
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::cti_timeout_check):
-        * interpreter/Interpreter.h:
-        * jit/JIT.cpp:
-        (JSC::JIT::emitSlowScriptCheck):
-
-2008-12-05  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        Encapsulate access to jump tables in the CodeBlock in preparation
-        of moving them to a rare data structure.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::shrinkToFit):
-        * bytecode/CodeBlock.h:
-        (JSC::CodeBlock::numberOfImmediateSwitchJumpTables):
-        (JSC::CodeBlock::addImmediateSwitchJumpTable):
-        (JSC::CodeBlock::immediateSwitchJumpTable):
-        (JSC::CodeBlock::numberOfCharacterSwitchJumpTables):
-        (JSC::CodeBlock::addCharacterSwitchJumpTable):
-        (JSC::CodeBlock::characterSwitchJumpTable):
-        (JSC::CodeBlock::numberOfStringSwitchJumpTables):
-        (JSC::CodeBlock::addStringSwitchJumpTable):
-        (JSC::CodeBlock::stringSwitchJumpTable):
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::generate):
-        (JSC::BytecodeGenerator::endSwitch):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
-        (JSC::Interpreter::cti_op_switch_imm):
-        (JSC::Interpreter::cti_op_switch_char):
-        (JSC::Interpreter::cti_op_switch_string):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-
-2008-12-05  Adam Roben  <aroben@apple.com>
-
-        Windows build fix after r39020
-
-        * jit/JITInlineMethods.h:
-        (JSC::JIT::restoreArgumentReference):
-        (JSC::JIT::restoreArgumentReferenceForTrampoline):
-        Add some apparently-missing __.
-
-2008-12-04  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=22673
-        
-        Added support for the assertion (?=) and inverted assertion (?!) atoms
-        in WREC.
-
-        * wrec/WRECGenerator.cpp:
-        (JSC::WREC::Generator::generateParenthesesAssertion):
-        (JSC::WREC::Generator::generateParenthesesInvertedAssertion): Split the
-        old (unused) generateParentheses into these two functions, with more
-        limited capabilities.
-        
-        * wrec/WRECGenerator.h:
-        (JSC::WREC::Generator::): Moved an enum to the top of the class definition,
-        to match the WebKit style, and removed a defunct comment.
-
-        * wrec/WRECParser.cpp:
-        (JSC::WREC::Parser::parseParentheses):
-        (JSC::WREC::Parser::consumeParenthesesType):
-        * wrec/WRECParser.h:
-        (JSC::WREC::Parser::): Added support for parsing (?=) and (?!).
-
-2008-12-05  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Rubber-stamped by Tor Arne Vestbø.
-
-        Disable the JIT for the Qt build alltogether again, after observing
-        more miscompilations in a wider range of newer gcc versions.
-
-        * JavaScriptCore.pri:
-
-2008-12-05  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Disable the JIT for the Qt build on Linux unless gcc is >= 4.2,
-        due to miscompilations.
-
-        * JavaScriptCore.pri:
-
-2008-12-04  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoff Garen.
+        Reviewed by Gavin Barraclough.
 
-        Start porting the JIT to use the MacroAssembler.
+        Reorganize ARM architecture specific macros.
+        Use PLATFORM_ARM_ARCH(7) instead of PLATFORM(ARM_V7).
 
-        https://bugs.webkit.org/show_bug.cgi?id=22671
-        No change in performance.
+        Bug 24986: ARM JIT port
+        <https://bugs.webkit.org/show_bug.cgi?id=24986>
 
+        * assembler/ARMv7Assembler.h:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Imm32::Imm32):
         * assembler/MacroAssembler.h:
-        (JSC::MacroAssembler::Jump::operator X86Assembler::JmpSrc):
-        (JSC::MacroAssembler::add32):
-        (JSC::MacroAssembler::and32):
-        (JSC::MacroAssembler::lshift32):
-        (JSC::MacroAssembler::rshift32):
-        (JSC::MacroAssembler::storePtr):
-        (JSC::MacroAssembler::store32):
-        (JSC::MacroAssembler::poke):
-        (JSC::MacroAssembler::move):
-        (JSC::MacroAssembler::compareImm32ForBranchEquality):
-        (JSC::MacroAssembler::jnePtr):
-        (JSC::MacroAssembler::jnset32):
-        (JSC::MacroAssembler::jset32):
-        (JSC::MacroAssembler::jzeroSub32):
-        (JSC::MacroAssembler::joverAdd32):
-        (JSC::MacroAssembler::call):
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::shll_i8r):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompile):
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
         * jit/JIT.h:
-        * jit/JITArithmetic.cpp:
-        (JSC::JIT::compileBinaryArithOp):
         * jit/JITInlineMethods.h:
-        (JSC::JIT::emitGetVirtualRegister):
-        (JSC::JIT::emitPutCTIArg):
-        (JSC::JIT::emitPutCTIArgConstant):
-        (JSC::JIT::emitGetCTIArg):
-        (JSC::JIT::emitPutCTIArgFromVirtualRegister):
-        (JSC::JIT::emitPutCTIParam):
-        (JSC::JIT::emitGetCTIParam):
-        (JSC::JIT::emitPutToCallFrameHeader):
-        (JSC::JIT::emitPutImmediateToCallFrameHeader):
-        (JSC::JIT::emitGetFromCallFrameHeader):
-        (JSC::JIT::emitPutVirtualRegister):
-        (JSC::JIT::emitInitRegister):
-        (JSC::JIT::emitNakedCall):
-        (JSC::JIT::restoreArgumentReference):
         (JSC::JIT::restoreArgumentReferenceForTrampoline):
-        (JSC::JIT::emitCTICall):
-        (JSC::JIT::checkStructure):
-        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
-        (JSC::JIT::emitJumpSlowCaseIfNotImmNum):
-        (JSC::JIT::emitJumpSlowCaseIfNotImmNums):
-        (JSC::JIT::emitFastArithDeTagImmediate):
-        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
-        (JSC::JIT::emitFastArithReTagImmediate):
-        (JSC::JIT::emitFastArithPotentiallyReTagImmediate):
-        (JSC::JIT::emitFastArithImmToInt):
-        (JSC::JIT::emitFastArithIntToImmOrSlowCase):
-        (JSC::JIT::emitFastArithIntToImmNoCheck):
-        (JSC::JIT::emitTagAsBoolImmediate):
-        * jit/JITPropertyAccess.cpp:
-        (JSC::JIT::privateCompilePutByIdTransition):
-
-2008-12-04  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt.
-        
-        Some refactoring for generateGreedyQuantifier.
-        
-        SunSpider reports no change (possibly a 0.3% speedup).
-
-        * wrec/WRECGenerator.cpp:
-        (JSC::WREC::Generator::generateGreedyQuantifier): Clarified label
-        meanings and unified some logic to simplify things.
-
-        * wrec/WRECParser.h:
-        (JSC::WREC::Parser::parseAlternative): Added a version of parseAlternative
-        that can jump to a Label, instead of a JumpList, upon failure. (Eventually,
-        when we have a true Label class, this will be redundant.) This makes
-        things easier for generateGreedyQuantifier, because it can avoid
-        explicitly linking things.
-
-2008-12-04  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        Fix crashes in the Qt build on Linux/i386 with non-executable memory
-        by enabling TCSystemAlloc and the PROT_EXEC flag for mmap.
-
-        * JavaScriptCore.pri: Enable the use of TCSystemAlloc if the JIT is
-        enabled.
-        * wtf/TCSystemAlloc.cpp: Extend the PROT_EXEC permissions to
-        PLATFORM(QT).
-
-2008-12-04  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Enable ENABLE_JIT_OPTIMIZE_CALL, ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS
-        and ENABLE_JIT_OPTIMIZE_ARITHMETIC, as suggested by Niko.
-
-        * JavaScriptCore.pri: 
-
-2008-12-04  Kent Hansen  <khansen@trolltech.com>
-
-        Reviewed by Simon Hausmann.
-
-        Enable the JSC jit for the Qt build by default for release builds on
-        linux-g++ and win32-msvc.
-
-        * JavaScriptCore.pri:
-
-2008-12-04  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Allow JIT to function without property access repatching and arithmetic optimizations.
-        Controlled by ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS and ENABLE_JIT_OPTIMIZE_ARITHMETIC switches.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22643
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileSlowCases):
-        * jit/JIT.h:
-        * jit/JITArithmetic.cpp: Copied from jit/JIT.cpp.
-        (JSC::JIT::compileBinaryArithOp):
-        (JSC::JIT::compileBinaryArithOpSlowCase):
-        * jit/JITPropertyAccess.cpp: Copied from jit/JIT.cpp.
-        (JSC::JIT::compileGetByIdHotPath):
-        (JSC::JIT::compileGetByIdSlowCase):
-        (JSC::JIT::compilePutByIdHotPath):
-        (JSC::JIT::compilePutByIdSlowCase):
-        (JSC::resizePropertyStorage):
-        (JSC::transitionWillNeedStorageRealloc):
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::patchGetByIdSelf):
-        (JSC::JIT::patchPutByIdReplace):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITStubs.cpp:
+        * jit/JITStubs.h:
         * wtf/Platform.h:
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter):
+        (JSC::Yarr::RegexGenerator::generateReturn):
 
-2008-12-03  Geoffrey Garen  <ggaren@apple.com>
+2009-06-19  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Oliver Hunt.
-        
-        Optimized sequences of characters in regular expressions by comparing
-        two characters at a time.
-        
-        1-2% speedup on SunSpider, 19-25% speedup on regexp-dna.
-
-        * assembler/MacroAssembler.h:
-        (JSC::MacroAssembler::load32):
-        (JSC::MacroAssembler::jge32): Filled out a few more macro methods.
-
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::movl_mr): Added a verion of movl_mr that operates
-        without an offset, to allow the macro assembler to optmize for that case.
-        
-        * wrec/WREC.cpp:
-        (JSC::WREC::Generator::compileRegExp): Test the saved value of index
-        instead of the index register when checking for "end of input." The
-        index register doesn't increment by 1 in an orderly fashion, so testing
-        it for == "end of input" is not valid.
-        
-        Also, jump all the way to "return failure" upon reaching "end of input,"
-        instead of executing the next alternative. This is more logical, and
-        it's a slight optimization in the case of an expression with many alternatives.
-
-        * wrec/WRECGenerator.cpp:
-        (JSC::WREC::Generator::generateIncrementIndex): Added support for
-        jumping to a failure label in the case where the index has reached "end
-        of input."
-
-        (JSC::WREC::Generator::generatePatternCharacterSequence):
-        (JSC::WREC::Generator::generatePatternCharacterPair): This is the
-        optmization. It's basically like generatePatternCharacter, but it runs two
-        characters at a time.
-        
-        (JSC::WREC::Generator::generatePatternCharacter): Changed to use isASCII,
-        since it's clearer than comparing to a magic hex value.
-        
-        * wrec/WRECGenerator.h:
-
-2008-12-03  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Allow JIT to operate without the call-repatching optimization.
-        Controlled by ENABLE(JIT_OPTIMIZE_CALL), defaults on, disabling
-        this leads to significant performance regression.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22639
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileSlowCases):
-        * jit/JIT.h:
-        * jit/JITCall.cpp: Copied from jit/JIT.cpp.
-        (JSC::JIT::compileOpCallInitializeCallFrame):
-        (JSC::JIT::compileOpCallSetupArgs):
-        (JSC::JIT::compileOpCallEvalSetupArgs):
-        (JSC::JIT::compileOpConstructSetupArgs):
-        (JSC::JIT::compileOpCall):
-        (JSC::JIT::compileOpCallSlowCase):
-        (JSC::unreachable):
-        * jit/JITInlineMethods.h: Copied from jit/JIT.cpp.
-        (JSC::JIT::checkStructure):
-        (JSC::JIT::emitFastArithPotentiallyReTagImmediate):
-        (JSC::JIT::emitTagAsBoolImmediate):
-        * wtf/Platform.h:
-
-2008-12-03  Eric Seidel  <eric@webkit.org>
-
-        Rubber-stamped by David Hyatt.
-
-        Make HAVE_ACCESSIBILITY only define if !defined
-
-        * wtf/Platform.h:
-
-2008-12-03  Sam Weinig  <sam@webkit.org>
-
-        Fix build.
-
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::orl_i32r):
-
-2008-12-03  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        Remove shared AssemblerBuffer 1MB buffer and instead give AssemblerBuffer
-        an 256 byte inline capacity.
-
-        1% progression on Sunspider.
-
-        * assembler/AssemblerBuffer.h:
-        (JSC::AssemblerBuffer::AssemblerBuffer):
-        (JSC::AssemblerBuffer::~AssemblerBuffer):
-        (JSC::AssemblerBuffer::grow):
-        * assembler/MacroAssembler.h:
-        (JSC::MacroAssembler::MacroAssembler):
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::X86Assembler):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::Interpreter):
-        * interpreter/Interpreter.h:
-        * jit/JIT.cpp:
-        (JSC::JIT::JIT):
-        * parser/Nodes.cpp:
-        (JSC::RegExpNode::emitBytecode):
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::RegExp):
-        (JSC::RegExp::create):
-        * runtime/RegExp.h:
-        * runtime/RegExpConstructor.cpp:
-        (JSC::constructRegExp):
-        * runtime/RegExpPrototype.cpp:
-        (JSC::regExpProtoFuncCompile):
-        * runtime/StringPrototype.cpp:
-        (JSC::stringProtoFuncMatch):
-        (JSC::stringProtoFuncSearch):
-        * wrec/WREC.cpp:
-        (JSC::WREC::Generator::compileRegExp):
-        * wrec/WRECGenerator.h:
-        (JSC::WREC::Generator::Generator):
-        * wrec/WRECParser.h:
-        (JSC::WREC::Parser::Parser):
-
-2008-12-03  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt, with help from Gavin Barraclough.
-        
-        orl_i32r was actually coded as an 8bit OR. So, I renamed orl_i32r to
-        orl_i8r, changed all orl_i32r clients to use orl_i8r, and then added
-        a new orl_i32r that actually does a 32bit OR.
-        
-        (32bit OR is currently unused, but a patch I'm working on uses it.)
-
-        * assembler/MacroAssembler.h:
-        (JSC::MacroAssembler::or32): Updated to choose between 8bit and 32bit OR.
-
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::orl_i8r): The old orl_i32r.
-        (JSC::X86Assembler::orl_i32r): The new orl_i32r.
-        
-        * jit/JIT.cpp:
-        (JSC::JIT::emitFastArithPotentiallyReTagImmediate):
-        (JSC::JIT::emitTagAsBoolImmediate): Use orl_i8r, since we're ORing 8bit
-        values.
-
-2008-12-03  Dean Jackson  <dino@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Helper functions for turn -> degrees.
-        https://bugs.webkit.org/show_bug.cgi?id=22497
-
-        * wtf/MathExtras.h:
-        (turn2deg):
-        (deg2turn):
-
-2008-12-02  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Bug 22504: Crashes during code generation occur due to refing of ignoredResult()
-        <https://bugs.webkit.org/show_bug.cgi?id=22504>
-
-        Since ignoredResult() was implemented by casting 1 to a RegisterID*, any
-        attempt to ref ignoredResult() results in a crash. This will occur in
-        code generation of a function body where a node emits another node with
-        the dst that was passed to it, and then refs the returned RegisterID*.
-
-        To fix this problem, make ignoredResult() a member function of
-        BytecodeGenerator that simply returns a pointe to a fixed RegisterID
-        member of BytecodeGenerator.
-
-        * bytecompiler/BytecodeGenerator.h:
-        (JSC::BytecodeGenerator::ignoredResult):
-        * bytecompiler/RegisterID.h:
-        * parser/Nodes.cpp:
-        (JSC::NullNode::emitBytecode):
-        (JSC::BooleanNode::emitBytecode):
-        (JSC::NumberNode::emitBytecode):
-        (JSC::StringNode::emitBytecode):
-        (JSC::RegExpNode::emitBytecode):
-        (JSC::ThisNode::emitBytecode):
-        (JSC::ResolveNode::emitBytecode):
-        (JSC::ObjectLiteralNode::emitBytecode):
-        (JSC::PostfixResolveNode::emitBytecode):
-        (JSC::PostfixBracketNode::emitBytecode):
-        (JSC::PostfixDotNode::emitBytecode):
-        (JSC::DeleteValueNode::emitBytecode):
-        (JSC::VoidNode::emitBytecode):
-        (JSC::TypeOfResolveNode::emitBytecode):
-        (JSC::TypeOfValueNode::emitBytecode):
-        (JSC::PrefixResolveNode::emitBytecode):
-        (JSC::AssignResolveNode::emitBytecode):
-        (JSC::CommaNode::emitBytecode):
-        (JSC::ForNode::emitBytecode):
-        (JSC::ForInNode::emitBytecode):
-        (JSC::ReturnNode::emitBytecode):
-        (JSC::ThrowNode::emitBytecode):
-        (JSC::FunctionBodyNode::emitBytecode):
-        (JSC::FuncDeclNode::emitBytecode):
-
-2008-12-02  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Cameron Zwarich.
-        
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=22537
-        REGRESSION (r38745): Assertion failure in jsSubstring() at ge.com
-
-        The bug was that index would become greater than length, so our
-        "end of input" checks, which all check "index == length", would fail.
-        
-        The solution is to check for end of input before incrementing index,
-        to ensure that index is always <= length.
-        
-        As a side benefit, generateJumpIfEndOfInput can now use je instead of
-        jg, which should be slightly faster.
-
-        * wrec/WREC.cpp:
-        (JSC::WREC::Generator::compileRegExp):
-        * wrec/WRECGenerator.cpp:
-        (JSC::WREC::Generator::generateJumpIfEndOfInput):
-
-2008-12-02  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Plant shift right immediate instructions, which are awesome.
-        https://bugs.webkit.org/show_bug.cgi?id=22610
-        ~5% on the v8-crypto test.
-
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileSlowCases):
-
-2008-12-02  Geoffrey Garen  <ggaren@apple.com>
 
-        Reviewed by Sam Weinig.
-        
-        Cleaned up SegmentedVector by abstracting segment access into helper
-        functions.
-        
-        SunSpider reports no change.
-
-        * bytecompiler/SegmentedVector.h:
-        (JSC::SegmentedVector::SegmentedVector):
-        (JSC::SegmentedVector::~SegmentedVector):
-        (JSC::SegmentedVector::size):
-        (JSC::SegmentedVector::at):
-        (JSC::SegmentedVector::operator[]):
-        (JSC::SegmentedVector::last):
-        (JSC::SegmentedVector::append):
-        (JSC::SegmentedVector::removeLast):
-        (JSC::SegmentedVector::grow):
-        (JSC::SegmentedVector::clear):
-        (JSC::SegmentedVector::deleteAllSegments):
-        (JSC::SegmentedVector::segmentFor):
-        (JSC::SegmentedVector::subscriptFor):
-        (JSC::SegmentedVector::ensureSegmentsFor):
-        (JSC::SegmentedVector::ensureSegment):
-
-2008-12-02  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Geoffrey Garen. (Patch by Cameron Zwarich <zwarich@apple.com>.)
-        
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=22482
-        REGRESSION (r37991): Occasionally see "Scene rendered incorrectly"
-        message when running the V8 Raytrace benchmark
-        
-        Rolled out r37991. It didn't properly save xmm0, which is caller-save,
-        before calling helper functions.
-        
-        SunSpider and v8 benchmarks show little change -- possibly a .2%
-        SunSpider regression, possibly a .2% v8 benchmark speedup.
-
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::):
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * bytecode/Instruction.h:
-        (JSC::Instruction::):
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::emitUnaryOp):
-        * bytecompiler/BytecodeGenerator.h:
-        (JSC::BytecodeGenerator::emitToJSNumber):
-        (JSC::BytecodeGenerator::emitTypeOf):
-        (JSC::BytecodeGenerator::emitGetPropertyNames):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
-        * interpreter/Interpreter.h:
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileSlowCases):
-        * jit/JIT.h:
-        * parser/Nodes.cpp:
-        (JSC::UnaryOpNode::emitBytecode):
-        (JSC::BinaryOpNode::emitBytecode):
-        (JSC::EqualNode::emitBytecode):
-        * parser/ResultType.h:
-        (JSC::ResultType::isReusable):
-        (JSC::ResultType::mightBeNumber):
-        * runtime/JSNumberCell.h:
+        Fix armv7 JIT build issues.
 
-2008-12-01  Gavin Barraclough  <barraclough@apple.com>
+        Unfortunate the arm compiler does not like the use of offsetof on JITStackFrame (since it now contains non POD types),
+        and the FIELD_OFFSET macro does not appear constantish enough for it to be happy with its use in COMPILE_ASSERT macros.
 
-        Reviewed by Geoffrey Garen.
-
-        Remove unused (sampling only, and derivable) argument to JIT::emitCTICall.
-        https://bugs.webkit.org/show_bug.cgi?id=22587
+        * Replace offsetofs with FIELD_OFFSETs (safe on C++ objects).
+        * Move COMPILE_ASSERTs defending layout of JITStackFrame structure on armv7 into JITThunks constructor.
 
         * jit/JIT.cpp:
-        (JSC::JIT::emitCTICall):
-        (JSC::JIT::compileOpCall):
-        (JSC::JIT::emitSlowScriptCheck):
-        (JSC::JIT::compileBinaryArithOpSlowCase):
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileSlowCases):
-        (JSC::JIT::privateCompile):
         * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_catch):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
 
-2008-12-02  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Eric Seidel.
-        
-        Fix the inheritance chain for JSFunction.
-
-        * runtime/JSFunction.cpp:
-        (JSC::JSFunction::info): Add InternalFunction::info as parent class
-
-2008-12-02  Simon Hausmann  <hausmann@webkit.org>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Fix ability to include JavaScriptCore.pri from other .pro files.
-
-        * JavaScriptCore.pri: Moved -O3 setting into the .pro files.
-        * JavaScriptCore.pro:
-        * jsc.pro:
-
-2008-12-01  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Cameron Zwarich, with help from Gavin Barraclough.
-        
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=22583.
-
-        Refactored regular expression parsing to parse sequences of characters
-        as a single unit, in preparation for optimizing sequences of characters.
-        
-        SunSpider reports no change.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * wrec/Escapes.h: Added. Set of classes for representing an escaped
-        token in a pattern.
-
-        * wrec/Quantifier.h:
-        (JSC::WREC::Quantifier::Quantifier): Simplified this constructor slightly,
-        to match the new Escape constructor.
-
-        * wrec/WRECGenerator.cpp:
-        (JSC::WREC::Generator::generatePatternCharacterSequence):
-        * wrec/WRECGenerator.h: Added an interface for generating a sequence
-        of pattern characters at a time. It doesn't do anything special yet.
-
-        * wrec/WRECParser.cpp:
-        (JSC::WREC::Parser::consumeGreedyQuantifier):
-        (JSC::WREC::Parser::consumeQuantifier): Renamed "parse" to "consume" in
-        these functions, to match "consumeEscape."
-
-        (JSC::WREC::Parser::parsePatternCharacterSequence): New function for
-        iteratively aggregating a sequence of characters in a pattern.
-
-        (JSC::WREC::Parser::parseCharacterClassQuantifier):
-        (JSC::WREC::Parser::parseBackreferenceQuantifier): Renamed "parse" to
-        "consume" in these functions, to match "consumeEscape."
-
-        (JSC::WREC::Parser::parseCharacterClass): Refactored to use the common
-        escape processing code in consumeEscape.
-
-        (JSC::WREC::Parser::parseEscape): Refactored to use the common
-        escape processing code in consumeEscape.
-
-        (JSC::WREC::Parser::consumeEscape): Factored escaped token processing
-        into a common function, since we were doing this in a few places.
-
-        (JSC::WREC::Parser::parseTerm): Refactored to use the common
-        escape processing code in consumeEscape.
-
-        * wrec/WRECParser.h:
-        (JSC::WREC::Parser::consumeOctal): Refactored to use a helper function
-        for reading a digit.
-
-2008-12-01  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 20340: SegmentedVector segment allocations can lead to unsafe use of temporary registers
-        <https://bugs.webkit.org/show_bug.cgi?id=20340>
-
-        SegmentedVector currently frees segments and reallocates them when used
-        as a stack. This can lead to unsafe use of pointers into freed segments.
-
-        In order to fix this problem, SegmentedVector will be changed to only
-        grow and never shrink. Also, rename the reserveCapacity() member
-        function to grow() to match the actual usage in BytecodeGenerator, where
-        this function is used to allocate a group of registers at once, rather
-        than merely saving space for them.
-
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator): Use grow() instead of 
-        reserveCapacity().
-        * bytecompiler/SegmentedVector.h:
-        (JSC::SegmentedVector::SegmentedVector):
-        (JSC::SegmentedVector::last):
-        (JSC::SegmentedVector::append):
-        (JSC::SegmentedVector::removeLast):
-        (JSC::SegmentedVector::grow): Renamed from reserveCapacity().
-        (JSC::SegmentedVector::clear):
-
-2008-12-01  Mark Rowe  <mrowe@apple.com>
-
-        Rubber-stamped by Anders Carlsson.
-
-        Disable WREC for x86_64 since memory allocated by the system allocator is not marked executable,
-        which causes 64-bit debug builds to crash.  Once we have a dedicated allocator for executable
-        memory we can turn this back on.
-
-        * wtf/Platform.h:
-
-2008-12-01  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-        
-        Restore inline buffer after vector is shrunk back below its inline capacity.
-
-        * wtf/Vector.h:
-        (WTF::):
-        (WTF::VectorBuffer::restoreInlineBufferIfNeeded):
-        (WTF::::shrinkCapacity):
-
-2008-11-30  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Mark Rowe.
-        
-        Try to return free pages in the current thread cache too.
-
-        * wtf/FastMalloc.cpp:
-        (WTF::TCMallocStats::releaseFastMallocFreeMemory):
-
-2008-12-01  David Levin  <levin@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22567
-        Make HashTable work as expected with respect to threads. Specifically, it has class-level
-        thread safety and constant methods work on constant objects without synchronization.
-        
-        No observable change in behavior, so no test. This only affects debug builds.
-
-        * wtf/HashTable.cpp:
-        (WTF::hashTableStatsMutex):
-        (WTF::HashTableStats::~HashTableStats):
-        (WTF::HashTableStats::recordCollisionAtCount):
-        Guarded variable access with a mutex.
-
-        * wtf/HashTable.h:
-        (WTF::::lookup):
-        (WTF::::lookupForWriting):
-        (WTF::::fullLookupForWriting):
-        (WTF::::add):
-        (WTF::::reinsert):
-        (WTF::::remove):
-        (WTF::::rehash):
-        Changed increments of static variables to use atomicIncrement.
-
-        (WTF::::invalidateIterators):
-        (WTF::addIterator):
-        (WTF::removeIterator):
-        Guarded mutable access with a mutex.
-
-2008-11-29  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Enable WREC on PLATFORM(X86_64).  This change predominantly requires changes to the
-        WREC::Generator::generateEnter method to support the x86-64 ABI, and addition of
-        support for a limited number of quadword operations in the X86Assembler.
-
-        This patch will cause the JS heap to be allocated with RWX permissions on 64-bit Mac
-        platforms.  This is a regression with respect to previous 64-bit behaviour, but is no
-        more permissive than on 32-bit builds.  This issue should be addressed at some point.
-        (This is tracked by bug #21783.)
-
-        https://bugs.webkit.org/show_bug.cgi?id=22554
-        Greater than 4x speedup on regexp-dna, on x86-64.
-
-        * assembler/MacroAssembler.h:
-        (JSC::MacroAssembler::addPtr):
-        (JSC::MacroAssembler::loadPtr):
-        (JSC::MacroAssembler::storePtr):
-        (JSC::MacroAssembler::pop):
-        (JSC::MacroAssembler::push):
-        (JSC::MacroAssembler::move):
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::movq_rr):
-        (JSC::X86Assembler::addl_i8m):
-        (JSC::X86Assembler::addl_i32r):
-        (JSC::X86Assembler::addq_i8r):
-        (JSC::X86Assembler::addq_i32r):
-        (JSC::X86Assembler::movq_mr):
-        (JSC::X86Assembler::movq_rm):
-        * wrec/WREC.h:
-        * wrec/WRECGenerator.cpp:
-        (JSC::WREC::Generator::generateEnter):
-        (JSC::WREC::Generator::generateReturnSuccess):
-        (JSC::WREC::Generator::generateReturnFailure):
-        * wtf/Platform.h:
-        * wtf/TCSystemAlloc.cpp:
-
-2008-12-01  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Preliminary work for bug 20340: SegmentedVector segment allocations can lead to unsafe use of temporary registers
-        <https://bugs.webkit.org/show_bug.cgi?id=20340>
-
-        SegmentedVector currently frees segments and reallocates them when used
-        as a stack. This can lead to unsafe use of pointers into freed segments.
-
-        In order to fix this problem, SegmentedVector will be changed to only
-        grow and never shrink, with the sole exception of clearing all of its
-        data, a capability that is required by Lexer. This patch changes the
-        public interface to only allow for these capabilities.
-
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator): Use reserveCapacity()
-        instead of resize() for m_globals and m_parameters.
-        * bytecompiler/SegmentedVector.h:
-        (JSC::SegmentedVector::resize): Removed.
-        (JSC::SegmentedVector::reserveCapacity): Added.
-        (JSC::SegmentedVector::clear): Added.
-        (JSC::SegmentedVector::shrink): Removed.
-        (JSC::SegmentedVector::grow): Removed.
-        * parser/Lexer.cpp:
-        (JSC::Lexer::clear): Use clear() instead of resize(0).
-
-2008-11-30  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Renames jumps to m_jumps in JumpList.
-
-        * assembler/MacroAssembler.h:
-        (JSC::MacroAssembler::JumpList::link):
-        (JSC::MacroAssembler::JumpList::linkTo):
-        (JSC::MacroAssembler::JumpList::append):
-
-2008-11-30  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Mark Rowe.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=22557
-        
-        Report free size in central and thread caches too.
-
-        * wtf/FastMalloc.cpp:
-        (WTF::TCMallocStats::fastMallocStatistics):
-        * wtf/FastMalloc.h:
-
-2008-11-29  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Dan Bernstein.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=22557
-        Add statistics for JavaScript GC heap.
-
-        * JavaScriptCore.exp:
-        * runtime/Collector.cpp:
-        (JSC::Heap::objectCount):
-        (JSC::addToStatistics):
-        (JSC::Heap::statistics):
-        * runtime/Collector.h:
-
-2008-11-29  Antti Koivisto  <antti@apple.com>
-
-        Fix debug build by adding a stub method.
-
-        * wtf/FastMalloc.cpp:
-        (WTF::fastMallocStatistics):
-
-2008-11-29  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Alexey Proskuryakov.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=22557
-        
-        Add function for getting basic statistics from FastMalloc.
-
-        * JavaScriptCore.exp:
-        * wtf/FastMalloc.cpp:
-        (WTF::DLL_Length):
-        (WTF::TCMalloc_PageHeap::ReturnedBytes):
-        (WTF::TCMallocStats::fastMallocStatistics):
-        * wtf/FastMalloc.h:
-
-2008-11-29  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        The C++ standard does not automatically grant the friendships of an
-        enclosing class to its nested subclasses, so we should do so explicitly.
-        This fixes the GCC 4.0 build, although both GCC 4.2 and Visual C++ 2005
-        accept the incorrect code as it is.
-
-        * assembler/MacroAssembler.h:
-
-2008-11-29  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Add the class MacroAssembler to provide some abstraction of code generation,
-        and change WREC to make use of this class, rather than directly accessing
-        the X86Assembler.
-
-        This patch also allows WREC to be compiled without the rest of the JIT enabled.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * assembler/MacroAssembler.h: Added.
-        (JSC::MacroAssembler::):
-        (JSC::MacroAssembler::MacroAssembler):
-        (JSC::MacroAssembler::copyCode):
-        (JSC::MacroAssembler::Address::Address):
-        (JSC::MacroAssembler::ImplicitAddress::ImplicitAddress):
-        (JSC::MacroAssembler::BaseIndex::BaseIndex):
-        (JSC::MacroAssembler::Label::Label):
-        (JSC::MacroAssembler::Jump::Jump):
-        (JSC::MacroAssembler::Jump::link):
-        (JSC::MacroAssembler::Jump::linkTo):
-        (JSC::MacroAssembler::JumpList::link):
-        (JSC::MacroAssembler::JumpList::linkTo):
-        (JSC::MacroAssembler::JumpList::append):
-        (JSC::MacroAssembler::Imm32::Imm32):
-        (JSC::MacroAssembler::add32):
-        (JSC::MacroAssembler::or32):
-        (JSC::MacroAssembler::sub32):
-        (JSC::MacroAssembler::loadPtr):
-        (JSC::MacroAssembler::load32):
-        (JSC::MacroAssembler::load16):
-        (JSC::MacroAssembler::storePtr):
-        (JSC::MacroAssembler::store32):
-        (JSC::MacroAssembler::pop):
-        (JSC::MacroAssembler::push):
-        (JSC::MacroAssembler::peek):
-        (JSC::MacroAssembler::poke):
-        (JSC::MacroAssembler::move):
-        (JSC::MacroAssembler::compareImm32ForBranch):
-        (JSC::MacroAssembler::compareImm32ForBranchEquality):
-        (JSC::MacroAssembler::jae32):
-        (JSC::MacroAssembler::je32):
-        (JSC::MacroAssembler::je16):
-        (JSC::MacroAssembler::jg32):
-        (JSC::MacroAssembler::jge32):
-        (JSC::MacroAssembler::jl32):
-        (JSC::MacroAssembler::jle32):
-        (JSC::MacroAssembler::jne32):
-        (JSC::MacroAssembler::jump):
-        (JSC::MacroAssembler::breakpoint):
-        (JSC::MacroAssembler::ret):
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::cmpw_rm):
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::Interpreter):
-        * interpreter/Interpreter.h:
-        (JSC::Interpreter::assemblerBuffer):
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::RegExp):
-        * wrec/WREC.cpp:
-        (JSC::WREC::Generator::compileRegExp):
-        * wrec/WREC.h:
-        * wrec/WRECFunctors.cpp:
-        (JSC::WREC::GeneratePatternCharacterFunctor::generateAtom):
-        (JSC::WREC::GenerateCharacterClassFunctor::generateAtom):
-        (JSC::WREC::GenerateBackreferenceFunctor::generateAtom):
-        (JSC::WREC::GenerateParenthesesNonGreedyFunctor::generateAtom):
-        * wrec/WRECFunctors.h:
-        (JSC::WREC::GenerateParenthesesNonGreedyFunctor::GenerateParenthesesNonGreedyFunctor):
-        * wrec/WRECGenerator.cpp:
-        (JSC::WREC::Generator::generateEnter):
-        (JSC::WREC::Generator::generateReturnSuccess):
-        (JSC::WREC::Generator::generateSaveIndex):
-        (JSC::WREC::Generator::generateIncrementIndex):
-        (JSC::WREC::Generator::generateLoadCharacter):
-        (JSC::WREC::Generator::generateJumpIfEndOfInput):
-        (JSC::WREC::Generator::generateJumpIfNotEndOfInput):
-        (JSC::WREC::Generator::generateReturnFailure):
-        (JSC::WREC::Generator::generateBacktrack1):
-        (JSC::WREC::Generator::generateBacktrackBackreference):
-        (JSC::WREC::Generator::generateBackreferenceQuantifier):
-        (JSC::WREC::Generator::generateNonGreedyQuantifier):
-        (JSC::WREC::Generator::generateGreedyQuantifier):
-        (JSC::WREC::Generator::generatePatternCharacter):
-        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
-        (JSC::WREC::Generator::generateCharacterClassInverted):
-        (JSC::WREC::Generator::generateCharacterClass):
-        (JSC::WREC::Generator::generateParentheses):
-        (JSC::WREC::Generator::generateParenthesesNonGreedy):
-        (JSC::WREC::Generator::generateParenthesesResetTrampoline):
-        (JSC::WREC::Generator::generateAssertionBOL):
-        (JSC::WREC::Generator::generateAssertionEOL):
-        (JSC::WREC::Generator::generateAssertionWordBoundary):
-        (JSC::WREC::Generator::generateBackreference):
-        (JSC::WREC::Generator::terminateAlternative):
-        (JSC::WREC::Generator::terminateDisjunction):
-        * wrec/WRECGenerator.h:
-        (JSC::WREC::Generator::Generator):
-        * wrec/WRECParser.cpp:
-        (JSC::WREC::Parser::parsePatternCharacterQualifier):
-        (JSC::WREC::Parser::parseCharacterClassQuantifier):
-        (JSC::WREC::Parser::parseBackreferenceQuantifier):
-        (JSC::WREC::Parser::parseParentheses):
-        (JSC::WREC::Parser::parseCharacterClass):
-        (JSC::WREC::Parser::parseOctalEscape):
-        (JSC::WREC::Parser::parseEscape):
-        (JSC::WREC::Parser::parseTerm):
-        (JSC::WREC::Parser::parseDisjunction):
-        * wrec/WRECParser.h:
-        (JSC::WREC::Parser::Parser):
-        (JSC::WREC::Parser::parsePattern):
-        (JSC::WREC::Parser::parseAlternative):
-        * wtf/Platform.h:
-
-2008-11-28  Simon Hausmann  <hausmann@webkit.org>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Fix compilation on Windows CE
-
-        Port away from the use of errno after calling strtol(), instead
-        detect conversion errors by checking the result and the stop
-        position.
-
-        * runtime/DateMath.cpp:
-        (JSC::parseLong):
-        (JSC::parseDate):
-
-2008-11-28  Joerg Bornemann  <joerg.bornemann@trolltech.com>
-
-        Reviewed by Simon Hausmann.
-
-        Implement lowResUTCTime() on Windows CE using GetSystemTime as _ftime() is not available.
-
-        * runtime/DateMath.cpp:
-        (JSC::lowResUTCTime):
-
-2008-11-28  Simon Hausmann  <hausmann@webkit.org>
-
-        Rubber-stamped by Tor Arne Vestbø.
-
-        Removed unnecessary inclusion of errno.h, which also fixes compilation on Windows CE.
-
-        * runtime/JSGlobalObjectFunctions.cpp:
-
-2008-11-27  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        r38825 made JSFunction::m_body private, but some inspector code in
-        WebCore sets the field. Add setters for it.
-
-        * runtime/JSFunction.h:
-        (JSC::JSFunction::setBody):
-
-2008-11-27  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Cameron Zwarich.
+2009-06-19  Adam Treat  <adam.treat@torchmobile.com>
 
-        Fix FIXME by adding accessor for JSFunction's m_body property.
+        Blind attempt at build fix.
 
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::cti_op_call_JSFunction):
-        (JSC::Interpreter::cti_vm_dontLazyLinkCall):
-        (JSC::Interpreter::cti_vm_lazyLinkCall):
-        * profiler/Profiler.cpp:
-        (JSC::createCallIdentifierFromFunctionImp):
-        * runtime/Arguments.h:
-        (JSC::Arguments::getArgumentsData):
-        (JSC::Arguments::Arguments):
-        * runtime/FunctionPrototype.cpp:
-        (JSC::functionProtoFuncToString):
-        * runtime/JSFunction.h:
-        (JSC::JSFunction::JSFunction):
-        (JSC::JSFunction::body):
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
 
-2008-11-27  Sam Weinig  <sam@webkit.org>
+2009-06-19  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
         Reviewed by Oliver Hunt.
 
-        Remove unused member variables from ProgramNode.
-
-        * parser/Nodes.h:
-
-2008-11-27  Brent Fulgham  <bfulgham@gmail.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Enable mouse panning feaure on Windows Cairo build.
-        See http://bugs.webkit.org/show_bug.cgi?id=22525
-
-        * wtf/Platform.h: Enable mouse panning feaure on Windows Cairo build.
-
-2008-11-27  Alp Toker  <alp@nuanti.com>
-
-        Change recently introduced C++ comments in Platform.h to C comments to
-        fix the minidom build with traditional C.
-
-        Build GtkLauncher and minidom with the '-ansi' compiler flag to detect
-        API header breakage at build time.
-
-        * GNUmakefile.am:
-        * wtf/Platform.h:
-
-2008-11-27  Alp Toker  <alp@nuanti.com>
-
-        Remove C++ comment from JavaScriptCore API headers (introduced r35449).
-        Fixes build for ANSI C applications using the public API.
-
-        * API/WebKitAvailability.h:
-
-2008-11-26  Eric Seidel  <eric@webkit.org>
-
-        No review, build fix only.
-
-        Fix the JSC Chromium Mac build by adding JavaScriptCore/icu into the include path
-
-        * JavaScriptCore.scons:
-
-2008-11-25  Cameron Zwarich  <zwarich@apple.com>
+        Inherits CallIdentifier struct from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/profiler/CallIdentifier.h:86.
 
-        Reviewed by Maciej Stachowiak.
-
-        Remove the unused member function JSFunction::getParameterName().
-
-        * runtime/JSFunction.cpp:
-        * runtime/JSFunction.h:
-
-2008-11-24  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Polymorpic caching for get by id chain.  Similar to the polymorphic caching already implemented
-        for self and proto accesses (implemented by allowing multiple trampolines to be JIT genertaed,
-        and linked together) - the get by id chain caching is implemented as a genericization of the
-        proto list caching, allowing cached access lists to contain a mix of proto and proto chain
-        accesses (since in JS style inheritance hierarchies you may commonly see a mix of properties
-        being overridden on the direct prototype, or higher up its prototype chain).
-
-        In order to allow this patch to compile there is a fix to appease gcc 4.2 compiler issues
-        (removing the jumps between fall-through cases in privateExecute).
-        
-        This patch also removes redundant immediate checking from the reptach code, and fixes a related
-        memory leak (failure to deallocate trampolines). 
-
-        ~2% progression on v8 tests (bulk on the win on deltablue)
-
-        * bytecode/Instruction.h:
-        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::):
-        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
-        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
-        (JSC::PolymorphicAccessStructureList::derefStructures):
-        * interpreter/Interpreter.cpp:
-        (JSC::countPrototypeChainEntriesAndCheckForProxies):
-        (JSC::Interpreter::tryCacheGetByID):
-        (JSC::Interpreter::privateExecute):
-        (JSC::Interpreter::tryCTICacheGetByID):
-        (JSC::Interpreter::cti_op_get_by_id_self_fail):
-        (JSC::getPolymorphicAccessStructureListSlot):
-        (JSC::Interpreter::cti_op_get_by_id_proto_list):
-        * interpreter/Interpreter.h:
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdSelfList):
-        (JSC::JIT::privateCompileGetByIdProtoList):
-        (JSC::JIT::privateCompileGetByIdChainList):
-        (JSC::JIT::privateCompileGetByIdChain):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        * jit/JIT.h:
-        (JSC::JIT::compileGetByIdChainList):
-
-2008-11-25  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Move the collect() call in Heap::heapAllocate() that is conditionally
-        compiled under COLLECT_ON_EVERY_ALLOCATION so that it is before we get
-        information about the heap. This was causing assertion failures for me
-        while I was reducing a bug.
-
-        * runtime/Collector.cpp:
-        (JSC::Heap::heapAllocate):
-
-2008-11-24  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Bug 13790: Function declarations are not treated as statements (used to affect starcraft2.com)
-        <https://bugs.webkit.org/show_bug.cgi?id=13790>
-
-        Modify the parser to treat function declarations as statements,
-        simplifying the grammar in the process. Technically, according to the
-        grammar in the ECMA spec, function declarations are not statements and
-        can not be used everywhere that statements can, but it is not worth the
-        possibility compatibility issues just to stick to the spec in this case.
-
-        * parser/Grammar.y:
-        * parser/Nodes.cpp:
-        (JSC::FuncDeclNode::emitBytecode): Avoid returning ignoredResult()
-        as a result, because it causes a crash in DoWhileNode::emitBytecode().
-
-2008-11-24  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Unroll the regexp matching loop by 1. 10% speedup on simple matching
-        stress test. No change on SunSpider.
-        
-        (I decided not to unroll to arbitrary levels because the returns diminsh
-        quickly.)
-
-        * wrec/WREC.cpp:
-        (JSC::WREC::compileRegExp):
-        * wrec/WRECGenerator.cpp:
-        (JSC::WREC::Generator::generateJumpIfEndOfInput):
-        (JSC::WREC::Generator::generateJumpIfNotEndOfInput):
-        * wrec/WRECGenerator.h:
-        * wrec/WRECParser.h:
-        (JSC::WREC::Parser::error):
-        (JSC::WREC::Parser::parsePattern):
-
-2008-11-24  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Removed some unnecessary "Generator::" prefixes.
-
-        * wrec/WRECGenerator.cpp:
-        (JSC::WREC::Generator::generateEnter):
-        (JSC::WREC::Generator::generateReturnSuccess):
-        (JSC::WREC::Generator::generateSaveIndex):
-        (JSC::WREC::Generator::generateIncrementIndex):
-        (JSC::WREC::Generator::generateLoopIfNotEndOfInput):
-        (JSC::WREC::Generator::generateReturnFailure):
-
-2008-11-24  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Made a bunch of WREC::Parser functions private, and added an explicit
-        "reset()" function, so a parser can be reused.
-
-        * wrec/WRECParser.h:
-        (JSC::WREC::Parser::Parser):
-        (JSC::WREC::Parser::generator):
-        (JSC::WREC::Parser::ignoreCase):
-        (JSC::WREC::Parser::multiline):
-        (JSC::WREC::Parser::recordSubpattern):
-        (JSC::WREC::Parser::numSubpatterns):
-        (JSC::WREC::Parser::parsePattern):
-        (JSC::WREC::Parser::parseAlternative):
-        (JSC::WREC::Parser::reset):
-
-2008-11-24  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Implement repatching for get by id chain.
-        Previously the access is performed in a function stub, in the repatch form
-        the trampoline is not called to; instead the hot path is relinked to jump
-        directly to the trampoline, if it fails it will jump to the slow case.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22449
-        3% progression on deltablue.
-
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdChain):
-
-2008-11-24  Joerg Bornemann  <joerg.bornemann@trolltech.com>
-
-        Reviewed by Simon Hausmann.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20746
-
-        Various small compilation fixes to make the Qt port of WebKit
-        compile on Windows CE.
-
-        * config.h: Don't set _CRT_RAND_S for CE, it's not available.
-        * jsc.cpp: Disabled use of debugger includes for CE. It
-          does not have the debugging functions.
-        * runtime/DateMath.cpp: Use localtime() on Windows CE.
-        * wtf/Assertions.cpp: Compile on Windows CE without debugger.
-        * wtf/Assertions.h: Include windows.h before defining ASSERT.
-        * wtf/MathExtras.h: Include stdlib.h instead of xmath.h.
-        * wtf/Platform.h: Disable ERRNO_H and detect endianess based
-          on the Qt endianess. On Qt for Windows CE the endianess is
-          defined by the vendor specific build spec.
-        * wtf/Threading.h: Use the volatile-less atomic functions.
-        * wtf/dtoa.cpp: Compile without errno.
-        * wtf/win/MainThreadWin.cpp: Don't include windows.h on CE after
-        Assertions.h due to the redefinition of ASSERT.
-
-2008-11-22  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Replace accidentally deleted immediate check from get by id chain trampoline.
-        https://bugs.webkit.org/show_bug.cgi?id=22413
-
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileGetByIdChain):
+        * wtf/HashCountedSet.h:
 
-2008-11-21  Gavin Barraclough  <barraclough@apple.com>
+2009-06-19  Adam Treat  <adam.treat@torchmobile.com>
 
         Reviewed by Oliver Hunt.
 
-        Add (really) polymorphic caching for get by id self.
-        Very similar to caching of prototype accesses, described below.
-
-        Oh, also, probably shouldn't have been leaking those structure list objects.
-        
-        4% preogression on deltablue.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::derefStructures):
-        (JSC::PrototypeStructureList::derefStructures):
-        * bytecode/Instruction.h:
-        * bytecode/Opcode.h:
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
-        (JSC::Interpreter::cti_op_get_by_id_self_fail):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileGetByIdSelfList):
-        (JSC::JIT::patchGetByIdSelf):
-        * jit/JIT.h:
-        (JSC::JIT::compileGetByIdSelfList):
-
-2008-11-21  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Fixed many crashes seen 'round the world (but only in release builds).
-        
-        Update outputParameter offset to reflect slight re-ordering of push
-        instructions in r38669.
-
-        * wrec/WRECGenerator.cpp:
-
-2008-11-21  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        A little more RegExp refactoring.
-        
-        Deployed a helper function for reading the next character. Used the "link
-        vector of jumps" helper in a place I missed before.
-
-        * wrec/WRECGenerator.cpp:
-        (JSC::WREC::Generator::generateLoadCharacter):
-        (JSC::WREC::Generator::generatePatternCharacter):
-        (JSC::WREC::Generator::generateCharacterClass):
-        (JSC::WREC::Generator::generateAssertionEOL):
-        (JSC::WREC::Generator::generateAssertionWordBoundary):
-        * wrec/WRECGenerator.h:
-
-2008-11-21  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22402
-        Replace abort() with CRASH()
-
-        * wtf/Assertions.h: Added a different method to crash, which should work even is 0xbbadbeef
-        is a valid memory address.
-
-        * runtime/Collector.cpp:
-        * wtf/FastMalloc.cpp:
-        * wtf/FastMalloc.h:
-        * wtf/TCSpinLock.h:
-        Replace abort() with CRASH().
-
-2008-11-21  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reverted fix for bug 22042 (Replace abort() with CRASH()), because it was breaking
-        FOR_EACH_OPCODE_ID macro somehow, making Safari crash.
-
-        * runtime/Collector.cpp:
-        (JSC::Heap::heapAllocate):
-        (JSC::Heap::collect):
-        * wtf/Assertions.h:
-        * wtf/FastMalloc.cpp:
-        (WTF::fastMalloc):
-        (WTF::fastCalloc):
-        (WTF::fastRealloc):
-        (WTF::InitSizeClasses):
-        (WTF::PageHeapAllocator::New):
-        (WTF::TCMallocStats::do_malloc):
-        * wtf/FastMalloc.h:
-        * wtf/TCSpinLock.h:
-        (TCMalloc_SpinLock::Init):
-        (TCMalloc_SpinLock::Finalize):
-        (TCMalloc_SpinLock::Lock):
-        (TCMalloc_SpinLock::Unlock):
-
-2008-11-21  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        A little more RegExp refactoring.
-        
-        Moved all assembly from WREC.cpp into WRECGenerator helper functions.
-        This should help with portability and readability.
-        
-        Removed ASSERTs after calls to executableCopy(), and changed
-        executableCopy() to ASSERT instead.
-
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::executableCopy):
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompile):
-        (JSC::JIT::privateCompileGetByIdSelf):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdChain):
-        (JSC::JIT::privateCompilePutByIdReplace):
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        * wrec/WREC.cpp:
-        (JSC::WREC::compileRegExp):
-        * wrec/WRECGenerator.cpp:
-        (JSC::WREC::Generator::generateEnter):
-        (JSC::WREC::Generator::generateReturnSuccess):
-        (JSC::WREC::Generator::generateSaveIndex):
-        (JSC::WREC::Generator::generateIncrementIndex):
-        (JSC::WREC::Generator::generateLoopIfNotEndOfInput):
-        (JSC::WREC::Generator::generateReturnFailure):
-        * wrec/WRECGenerator.h:
-        * wrec/WRECParser.h:
-        (JSC::WREC::Parser::ignoreCase):
-        (JSC::WREC::Parser::generator):
-
-2008-11-21  Alexey Proskuryakov  <ap@webkit.org>
-
-        Build fix.
-
-        * wtf/Assertions.h: Use ::abort for C++ code.
-
-2008-11-21  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22402
-        Replace abort() with CRASH()
-
-        * wtf/Assertions.h: Added abort() after an attempt to crash for extra safety.
-
-        * runtime/Collector.cpp:
-        * wtf/FastMalloc.cpp:
-        * wtf/FastMalloc.h:
-        * wtf/TCSpinLock.h:
-        Replace abort() with CRASH().
-
-2008-11-21  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Renamed wrec => generator.
-
-        * wrec/WRECFunctors.cpp:
-        (JSC::WREC::GeneratePatternCharacterFunctor::generateAtom):
-        (JSC::WREC::GeneratePatternCharacterFunctor::backtrack):
-        (JSC::WREC::GenerateCharacterClassFunctor::generateAtom):
-        (JSC::WREC::GenerateCharacterClassFunctor::backtrack):
-        (JSC::WREC::GenerateBackreferenceFunctor::generateAtom):
-        (JSC::WREC::GenerateBackreferenceFunctor::backtrack):
-        (JSC::WREC::GenerateParenthesesNonGreedyFunctor::generateAtom):
-
-2008-11-19  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Add support for (really) polymorphic caching of prototype accesses.
-        
-        If a cached prototype access misses, cti_op_get_by_id_proto_list is called.
-        When this occurs the Structure pointers from the instruction stream are copied
-        off into a new ProtoStubInfo object.  A second prototype access trampoline is
-        generated, and chained onto the first.  Subsequent missed call to
-        cti_op_get_by_id_proto_list_append, which append futher new trampolines, up to
-        PROTOTYPE_LIST_CACHE_SIZE (currently 4).  If any of the misses result in an
-        access other than to a direct prototype property, list formation is halted (or
-        for the initial miss, does not take place at all).
-
-        Separate fail case functions are provided for each access since this contributes
-        to the performance progression (enables better processor branch prediction).
-
-        Overall this is a near 5% progression on v8, with around 10% wins on richards
-        and deltablue.
-
-        * bytecode/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::derefStructures):
-        * bytecode/Instruction.h:
-        (JSC::ProtoStructureList::ProtoStubInfo::set):
-        (JSC::ProtoStructureList::ProtoStructureList):
-        (JSC::Instruction::Instruction):
-        (JSC::Instruction::):
-        * bytecode/Opcode.h:
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
-        (JSC::Interpreter::tryCTICacheGetByID):
-        (JSC::Interpreter::cti_op_put_by_id_fail):
-        (JSC::Interpreter::cti_op_get_by_id_self_fail):
-        (JSC::Interpreter::cti_op_get_by_id_proto_list):
-        (JSC::Interpreter::cti_op_get_by_id_proto_list_append):
-        (JSC::Interpreter::cti_op_get_by_id_proto_list_full):
-        (JSC::Interpreter::cti_op_get_by_id_proto_fail):
-        (JSC::Interpreter::cti_op_get_by_id_chain_fail):
-        (JSC::Interpreter::cti_op_get_by_id_array_fail):
-        (JSC::Interpreter::cti_op_get_by_id_string_fail):
-        * interpreter/Interpreter.h:
-        * jit/JIT.cpp:
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileGetByIdSelf):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdProtoList):
-        (JSC::JIT::privateCompileGetByIdChain):
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        * jit/JIT.h:
-        (JSC::JIT::compileGetByIdProtoList):
-
-2008-11-20  Sam Weinig  <sam@webkit.org>
-
-        Try and fix the tiger build.
-
-        * parser/Grammar.y:
-
-2008-11-20  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Make JavaScriptCore Chromium build under Windows (cmd only, cygwin almost works)
-        https://bugs.webkit.org/show_bug.cgi?id=22347
-
-        * JavaScriptCore.scons:
-        * parser/Parser.cpp: Add using std::auto_ptr since we use auto_ptr
-
-2008-11-20  Steve Falkenburg  <sfalken@apple.com>
-
-        Fix build.
-        
-        Reviewed by Sam Weinig.
-
-        * parser/Parser.cpp:
-        (JSC::Parser::reparse):
-
-2008-11-20  Geoffrey Garen  <ggaren@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=26540
+        Modify the test shell to add a new function 'checkSyntax' that will
+        only parse the source instead of executing it. In this way we can test
+        pure parsing performance against some of the larger scripts in the wild.
 
-        Reviewed by Sam Weinig.
-
-        A little more RegExp refactoring.
-        
-        Created a helper function in the assembler for linking a vector of
-        JmpSrc to a location, and deployed it in a bunch of places.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::link):
-        * wrec/WREC.cpp:
-        (JSC::WREC::compileRegExp):
-        * wrec/WRECGenerator.cpp:
-        (JSC::WREC::Generator::generateNonGreedyQuantifier):
-        (JSC::WREC::Generator::generateGreedyQuantifier):
-        (JSC::WREC::Generator::generateCharacterClassInverted):
-        (JSC::WREC::Generator::generateParentheses):
-        (JSC::WREC::Generator::generateParenthesesResetTrampoline):
-        (JSC::WREC::Generator::generateAssertionBOL):
-        (JSC::WREC::Generator::generateAssertionEOL):
-        (JSC::WREC::Generator::generateAssertionWordBoundary):
-        (JSC::WREC::Generator::terminateAlternative):
-        (JSC::WREC::Generator::terminateDisjunction):
-        * wrec/WRECParser.cpp:
-        * wrec/WRECParser.h:
-        (JSC::WREC::Parser::consumeHex):
-
-2008-11-20  Sam Weinig  <sam@webkit.org>
-
-        Fix non-mac builds.
-
-        * parser/Lexer.cpp:
-        * parser/Parser.cpp:
-
-2008-11-20  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Patch for https://bugs.webkit.org/show_bug.cgi?id=22385
-        <rdar://problem/6390179>
-        Lazily reparse FunctionBodyNodes on first execution.
-
-        - Saves 57MB on Membuster head.
-
-        * bytecompiler/BytecodeGenerator.cpp:
-        (JSC::BytecodeGenerator::generate): Remove vector shrinking since this is now
-        handled by destroying the ScopeNodeData after generation.
-
-        * parser/Grammar.y: Add alternate NoNode version of the grammar
-        that does not create nodes.  This is used to lazily create FunctionBodyNodes
-        on first execution.
-
-        * parser/Lexer.cpp:
-        (JSC::Lexer::setCode): Fix bug where on reparse, the Lexer was confused about
-        what position and length meant. Position is the current position in the original
-        data buffer (important for getting correct line/column information) and length
-        the end offset in the original buffer.
-        * parser/Lexer.h:
-        (JSC::Lexer::sourceCode): Positions are relative to the beginning of the buffer.
-
-        * parser/Nodes.cpp:
-        (JSC::ScopeNodeData::ScopeNodeData): Move initialization of ScopeNode data here.
-        (JSC::ScopeNode::ScopeNode): Add constructor that only sets the JSGlobalData
-        for FunctionBodyNode stubs.
-        (JSC::ScopeNode::~ScopeNode): Release m_children now that we don't inherit from
-        BlockNode.
-        (JSC::ScopeNode::releaseNodes): Ditto.
-        (JSC::EvalNode::generateBytecode): Only shrink m_children, as we need to keep around
-        the rest of the data.
-        (JSC::FunctionBodyNode::FunctionBodyNode): Add constructor that only sets the
-        JSGlobalData. 
-        (JSC::FunctionBodyNode::create): Ditto.
-        (JSC::FunctionBodyNode::generateBytecode): If we don't have the data, do a reparse
-        to construct it. Then after generation, destroy the data.
-        (JSC::ProgramNode::generateBytecode): After generation, destroy the AST data.
-        * parser/Nodes.h:
-        (JSC::ExpressionNode::): Add isFuncExprNode for FunctionConstructor.
-        (JSC::StatementNode::): Add isExprStatementNode for FunctionConstructor.
-        (JSC::ExprStatementNode::): Ditto.
-        (JSC::ExprStatementNode::expr): Add accessor for FunctionConstructor.
-        (JSC::FuncExprNode::): Add isFuncExprNode for FunctionConstructor
-
-        (JSC::ScopeNode::adoptData): Adopts a ScopeNodeData.
-        (JSC::ScopeNode::data): Accessor for ScopeNodeData.
-        (JSC::ScopeNode::destroyData): Deletes the ScopeNodeData.
-        (JSC::ScopeNode::setFeatures): Added.
-        (JSC::ScopeNode::varStack): Added assert.
-        (JSC::ScopeNode::functionStack): Ditto.
-        (JSC::ScopeNode::children): Ditto.
-        (JSC::ScopeNode::neededConstants): Ditto.
-        Factor m_varStack, m_functionStack, m_children and m_numConstants into ScopeNodeData.
-
-        * parser/Parser.cpp:
-        (JSC::Parser::reparse): Reparse the SourceCode in the FunctionBodyNode and set
-        set up the ScopeNodeData for it. 
-        * parser/Parser.h:
-
-        * parser/SourceCode.h:
-        (JSC::SourceCode::endOffset): Added for use in the lexer.
-
-        * runtime/FunctionConstructor.cpp:
-        (JSC::getFunctionBody): Assuming a ProgramNode with one FunctionExpression in it,
-        get the FunctionBodyNode.  Any issues signifies a parse failure in constructFunction. 
-        (JSC::constructFunction): Make parsing functions in the form new Function(""), easier
-        by concatenating the strings together (with some glue) and parsing the function expression
-        as a ProgramNode from which we can receive the FunctionBodyNode. This has the added benefit
-        of not having special parsing code for the arguments and lazily constructing the 
-        FunctionBodyNode's AST on first execution.
-
-        * runtime/Identifier.h:
-        (JSC::operator!=): Added.
-
-2008-11-20  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        Speedup the lexer to offset coming re-parsing patch.
-
-        - .6% progression on Sunspider.
-
-        * bytecompiler/SegmentedVector.h:
-        (JSC::SegmentedVector::shrink): Fixed bug where m_size would not be
-        set when shrinking to 0.
-
-        * parser/Lexer.cpp:
-        (JSC::Lexer::Lexer):
-        (JSC::Lexer::isIdentStart): Use isASCIIAlpha and isASCII to avoid going into ICU in the common cases.
-        (JSC::Lexer::isIdentPart): Use isASCIIAlphanumeric and isASCII to avoid going into ICU in the common cases
-        (JSC::isDecimalDigit): Use version in ASCIICType.h. Inlining it was a regression.
-        (JSC::Lexer::isHexDigit): Ditto.
-        (JSC::Lexer::isOctalDigit): Ditto.
-        (JSC::Lexer::clear): Resize the m_identifiers SegmentedVector to initial
-        capacity
-        * parser/Lexer.h: Remove unused m_strings vector. Make m_identifiers
-        a SegmentedVector<Identifier> to avoid allocating a new Identifier* for
-        each identifier found.  The SegmentedVector is need so we can passes 
-        references to the Identifier to the parser, which remain valid even when
-        the vector is resized.
-        (JSC::Lexer::makeIdentifier): Inline and return a reference to the added
-        Identifier.
-
-2008-11-20  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Add isASCII to ASCIICType.  Use coming soon!
-
-        * wtf/ASCIICType.h:
-        (WTF::isASCII):
-
-2008-11-20  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Add OwnPtr constructor and OwnPtr::adopt that take an auto_ptr.
-
-        * wtf/OwnPtr.h:
-        (WTF::OwnPtr::OwnPtr):
-        (WTF::OwnPtr::adopt):
-
-2008-11-20  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22364
-        Crashes seen on Tiger buildbots due to worker threads exhausting pthread keys
-
-        * runtime/Collector.cpp:
-        (JSC::Heap::Heap):
-        (JSC::Heap::destroy):
-        (JSC::Heap::makeUsableFromMultipleThreads):
-        (JSC::Heap::registerThread):
-        * runtime/Collector.h:
-        Pthread key for tracking threads is only created on request now, because this is a limited
-        resource, and thread tracking is not needed for worker heaps, or for WebCore heap.
-
-        * API/JSContextRef.cpp: (JSGlobalContextCreateInGroup): Call makeUsableFromMultipleThreads().
-
-        * runtime/JSGlobalData.cpp: (JSC::JSGlobalData::sharedInstance): Ditto.
-
-        * runtime/JSGlobalData.h: (JSC::JSGlobalData::makeUsableFromMultipleThreads): Just forward
-        the call to Heap, which clients need not know about, ideally.
-
-2008-11-20  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        A little more WREC refactoring.
-        
-        Removed the "Register" suffix from register names in WREC, and renamed:
-            currentPosition => index
-            currentValue => character
-            quantifierCount => repeatCount
-            
-        Added a top-level parsePattern function to the WREC parser, which
-        allowed me to remove the error() and atEndOfPattern() accessors.
-        
-        Factored out an MSVC customization into a constant.
-        
-        Renamed nextLabel => beginPattern.
-
-        * wrec/WREC.cpp:
-        (JSC::WREC::compileRegExp):
-        * wrec/WRECGenerator.cpp:
-        (JSC::WREC::Generator::generateBacktrack1):
-        (JSC::WREC::Generator::generateBacktrackBackreference):
-        (JSC::WREC::Generator::generateBackreferenceQuantifier):
-        (JSC::WREC::Generator::generateNonGreedyQuantifier):
-        (JSC::WREC::Generator::generateGreedyQuantifier):
-        (JSC::WREC::Generator::generatePatternCharacter):
-        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
-        (JSC::WREC::Generator::generateCharacterClassInverted):
-        (JSC::WREC::Generator::generateCharacterClass):
-        (JSC::WREC::Generator::generateParentheses):
-        (JSC::WREC::Generator::generateParenthesesResetTrampoline):
-        (JSC::WREC::Generator::generateAssertionBOL):
-        (JSC::WREC::Generator::generateAssertionEOL):
-        (JSC::WREC::Generator::generateAssertionWordBoundary):
-        (JSC::WREC::Generator::generateBackreference):
-        (JSC::WREC::Generator::generateDisjunction):
-        (JSC::WREC::Generator::terminateDisjunction):
-        * wrec/WRECGenerator.h:
-        * wrec/WRECParser.h:
-        (JSC::WREC::Parser::parsePattern):
-
-2008-11-19  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=22361
-        A little more RegExp refactoring.
-        
-        Consistently named variables holding the starting position at which
-        regexp matching should begin to "startOffset".
-        
-        A few more "regExpObject" => "regExpConstructor" changes.
-        
-        Refactored RegExpObject::match for clarity, and replaced a slow "get"
-        of the "global" property with a fast access to the global bit.
-        
-        Made the error message you see when RegExpObject::match has no input a
-        little more informative, as in Firefox.
-
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::match):
-        * runtime/RegExp.h:
-        * runtime/RegExpObject.cpp:
-        (JSC::RegExpObject::match):
-        * runtime/StringPrototype.cpp:
-        (JSC::stringProtoFuncReplace):
-        (JSC::stringProtoFuncMatch):
-        (JSC::stringProtoFuncSearch):
-
-2008-11-19  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        A little more refactoring.
-        
-        Removed the "emit" and "emitUnlinked" prefixes from the assembler.
-        
-        Moved the JmpSrc and JmpDst class definitions to the top of the X86
-        assembler class, in accordance with WebKit style guidelines.
-
-        * assembler/X86Assembler.h:
-        (JSC::X86Assembler::JmpSrc::JmpSrc):
-        (JSC::X86Assembler::JmpDst::JmpDst):
-        (JSC::X86Assembler::int3):
-        (JSC::X86Assembler::pushl_m):
-        (JSC::X86Assembler::popl_m):
-        (JSC::X86Assembler::movl_rr):
-        (JSC::X86Assembler::addl_rr):
-        (JSC::X86Assembler::addl_i8r):
-        (JSC::X86Assembler::addl_i8m):
-        (JSC::X86Assembler::addl_i32r):
-        (JSC::X86Assembler::addl_mr):
-        (JSC::X86Assembler::andl_rr):
-        (JSC::X86Assembler::andl_i32r):
-        (JSC::X86Assembler::cmpl_i8r):
-        (JSC::X86Assembler::cmpl_rr):
-        (JSC::X86Assembler::cmpl_rm):
-        (JSC::X86Assembler::cmpl_mr):
-        (JSC::X86Assembler::cmpl_i32r):
-        (JSC::X86Assembler::cmpl_i32m):
-        (JSC::X86Assembler::cmpl_i8m):
-        (JSC::X86Assembler::cmpw_rm):
-        (JSC::X86Assembler::orl_rr):
-        (JSC::X86Assembler::orl_mr):
-        (JSC::X86Assembler::orl_i32r):
-        (JSC::X86Assembler::subl_rr):
-        (JSC::X86Assembler::subl_i8r):
-        (JSC::X86Assembler::subl_i8m):
-        (JSC::X86Assembler::subl_i32r):
-        (JSC::X86Assembler::subl_mr):
-        (JSC::X86Assembler::testl_i32r):
-        (JSC::X86Assembler::testl_i32m):
-        (JSC::X86Assembler::testl_rr):
-        (JSC::X86Assembler::xorl_i8r):
-        (JSC::X86Assembler::xorl_rr):
-        (JSC::X86Assembler::sarl_i8r):
-        (JSC::X86Assembler::sarl_CLr):
-        (JSC::X86Assembler::shl_i8r):
-        (JSC::X86Assembler::shll_CLr):
-        (JSC::X86Assembler::imull_rr):
-        (JSC::X86Assembler::imull_i32r):
-        (JSC::X86Assembler::idivl_r):
-        (JSC::X86Assembler::negl_r):
-        (JSC::X86Assembler::movl_mr):
-        (JSC::X86Assembler::movzbl_rr):
-        (JSC::X86Assembler::movzwl_mr):
-        (JSC::X86Assembler::movl_rm):
-        (JSC::X86Assembler::movl_i32r):
-        (JSC::X86Assembler::movl_i32m):
-        (JSC::X86Assembler::leal_mr):
-        (JSC::X86Assembler::jmp_r):
-        (JSC::X86Assembler::jmp_m):
-        (JSC::X86Assembler::movsd_mr):
-        (JSC::X86Assembler::xorpd_mr):
-        (JSC::X86Assembler::movsd_rm):
-        (JSC::X86Assembler::movd_rr):
-        (JSC::X86Assembler::cvtsi2sd_rr):
-        (JSC::X86Assembler::cvttsd2si_rr):
-        (JSC::X86Assembler::addsd_mr):
-        (JSC::X86Assembler::subsd_mr):
-        (JSC::X86Assembler::mulsd_mr):
-        (JSC::X86Assembler::addsd_rr):
-        (JSC::X86Assembler::subsd_rr):
-        (JSC::X86Assembler::mulsd_rr):
-        (JSC::X86Assembler::ucomis_rr):
-        (JSC::X86Assembler::pextrw_irr):
-        (JSC::X86Assembler::call):
-        (JSC::X86Assembler::jmp):
-        (JSC::X86Assembler::jne):
-        (JSC::X86Assembler::jnz):
-        (JSC::X86Assembler::je):
-        (JSC::X86Assembler::jl):
-        (JSC::X86Assembler::jb):
-        (JSC::X86Assembler::jle):
-        (JSC::X86Assembler::jbe):
-        (JSC::X86Assembler::jge):
-        (JSC::X86Assembler::jg):
-        (JSC::X86Assembler::ja):
-        (JSC::X86Assembler::jae):
-        (JSC::X86Assembler::jo):
-        (JSC::X86Assembler::jp):
-        (JSC::X86Assembler::js):
-        (JSC::X86Assembler::predictNotTaken):
-        (JSC::X86Assembler::convertToFastCall):
-        (JSC::X86Assembler::restoreArgumentReference):
-        (JSC::X86Assembler::restoreArgumentReferenceForTrampoline):
-        (JSC::X86Assembler::modRm_rr):
-        (JSC::X86Assembler::modRm_rr_Unchecked):
-        (JSC::X86Assembler::modRm_rm):
-        (JSC::X86Assembler::modRm_rm_Unchecked):
-        (JSC::X86Assembler::modRm_rmsib):
-        (JSC::X86Assembler::modRm_opr):
-        (JSC::X86Assembler::modRm_opr_Unchecked):
-        (JSC::X86Assembler::modRm_opm):
-        (JSC::X86Assembler::modRm_opm_Unchecked):
-        (JSC::X86Assembler::modRm_opmsib):
-        * jit/JIT.cpp:
-        (JSC::JIT::emitNakedCall):
-        (JSC::JIT::emitNakedFastCall):
-        (JSC::JIT::emitCTICall):
-        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
-        (JSC::JIT::emitJumpSlowCaseIfNotImmNum):
-        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
-        (JSC::JIT::emitFastArithIntToImmOrSlowCase):
-        (JSC::JIT::emitArithIntToImmWithJump):
-        (JSC::JIT::compileOpCall):
-        (JSC::JIT::compileOpStrictEq):
-        (JSC::JIT::emitSlowScriptCheck):
-        (JSC::JIT::putDoubleResultToJSNumberCellOrJSImmediate):
-        (JSC::JIT::compileBinaryArithOp):
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileSlowCases):
-        (JSC::JIT::privateCompile):
-        (JSC::JIT::privateCompileGetByIdSelf):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdChain):
-        (JSC::JIT::privateCompilePutByIdReplace):
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        * wrec/WREC.cpp:
-        (JSC::WREC::compileRegExp):
-        * wrec/WRECGenerator.cpp:
-        (JSC::WREC::Generator::generateBackreferenceQuantifier):
-        (JSC::WREC::Generator::generateNonGreedyQuantifier):
-        (JSC::WREC::Generator::generateGreedyQuantifier):
-        (JSC::WREC::Generator::generatePatternCharacter):
-        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
-        (JSC::WREC::Generator::generateCharacterClassInverted):
-        (JSC::WREC::Generator::generateCharacterClass):
-        (JSC::WREC::Generator::generateParentheses):
-        (JSC::WREC::Generator::generateParenthesesNonGreedy):
-        (JSC::WREC::Generator::generateParenthesesResetTrampoline):
-        (JSC::WREC::Generator::generateAssertionBOL):
-        (JSC::WREC::Generator::generateAssertionEOL):
-        (JSC::WREC::Generator::generateAssertionWordBoundary):
-        (JSC::WREC::Generator::generateBackreference):
-        (JSC::WREC::Generator::generateDisjunction):
-
-2008-11-19  Simon Hausmann  <hausmann@webkit.org>
-
-        Sun CC build fix, removed trailing comman for last enum value.
-
-        * wtf/unicode/qt4/UnicodeQt4.h:
-        (WTF::Unicode::):
-
-2008-11-19  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Expand the workaround for Apple GCC compiler bug <rdar://problem/6354696> to all versions of GCC 4.0.1.
-        It has been observed with builds 5465 (Xcode 3.0) and 5484 (Xcode 3.1), and there is no evidence
-        that it has been fixed in newer builds of GCC 4.0.1.
-
-        This addresses <https://bugs.webkit.org/show_bug.cgi?id=22351> (WebKit nightly crashes on launch on 10.4.11).
-
-        * wtf/StdLibExtras.h:
-
-2008-11-18  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Maciej Stachowiak and Geoff Garen.
-
-        Bug 22287: ASSERTION FAILED: Not enough jumps linked in slow case codegen in CTI::privateCompileSlowCases())
-        <https://bugs.webkit.org/show_bug.cgi?id=22287>
-
-        Fix a typo in the number cell reuse code where the first and second
-        operands are sometimes confused.
-
-        * jit/JIT.cpp:
-        (JSC::JIT::compileBinaryArithOpSlowCase):
-
-2008-11-18  Dan Bernstein  <mitz@apple.com>
-
-        - try to fix the Windows build
-
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
-
-2008-11-18  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Minor RegExp cleanup.
-        
-        SunSpider says no change.
-
-        * runtime/RegExpObject.cpp:
-        (JSC::RegExpObject::match): Renamed "regExpObj" to "regExpConstructor".
-
-        * wrec/WREC.cpp:
-        (JSC::WREC::compileRegExp): Instead of checking for a NULL output vector,
-        ASSERT that the output vector is not NULL. (The rest of WREC is not
-        safe to use with a NULL output vector, and we probably don't want to
-        spend the time and/or performance to make it safe.)
-
-2008-11-18  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        A little more renaming and refactoring.
-        
-        VM_CHECK_EXCEPTION() => CHECK_FOR_EXCEPTION().
-        NEXT_INSTRUCTION => NEXT_INSTRUCTION().
-
-        Removed the "Error_" and "TempError_" prefixes from WREC error types.
-
-        Refactored the WREC parser so it doesn't need a "setError" function,
-        and changed "isEndOfPattern" and its use -- they read kind of backwards
-        before.
-        
-        Changed our "TODO:" error messages at least to say something, since you
-        can't say "TODO:" in shipping software.
-
-        * interpreter/Interpreter.cpp:
-        (JSC::Interpreter::privateExecute):
-        (JSC::Interpreter::cti_op_convert_this):
-        (JSC::Interpreter::cti_op_add):
-        (JSC::Interpreter::cti_op_pre_inc):
-        (JSC::Interpreter::cti_op_loop_if_less):
-        (JSC::Interpreter::cti_op_loop_if_lesseq):
-        (JSC::Interpreter::cti_op_put_by_id):
-        (JSC::Interpreter::cti_op_put_by_id_second):
-        (JSC::Interpreter::cti_op_put_by_id_generic):
-        (JSC::Interpreter::cti_op_put_by_id_fail):
-        (JSC::Interpreter::cti_op_get_by_id):
-        (JSC::Interpreter::cti_op_get_by_id_second):
-        (JSC::Interpreter::cti_op_get_by_id_generic):
-        (JSC::Interpreter::cti_op_get_by_id_fail):
-        (JSC::Interpreter::cti_op_instanceof):
-        (JSC::Interpreter::cti_op_del_by_id):
-        (JSC::Interpreter::cti_op_mul):
-        (JSC::Interpreter::cti_op_call_NotJSFunction):
-        (JSC::Interpreter::cti_op_resolve):
-        (JSC::Interpreter::cti_op_construct_NotJSConstruct):
-        (JSC::Interpreter::cti_op_get_by_val):
-        (JSC::Interpreter::cti_op_resolve_func):
-        (JSC::Interpreter::cti_op_sub):
-        (JSC::Interpreter::cti_op_put_by_val):
-        (JSC::Interpreter::cti_op_put_by_val_array):
-        (JSC::Interpreter::cti_op_lesseq):
-        (JSC::Interpreter::cti_op_loop_if_true):
-        (JSC::Interpreter::cti_op_negate):
-        (JSC::Interpreter::cti_op_resolve_skip):
-        (JSC::Interpreter::cti_op_resolve_global):
-        (JSC::Interpreter::cti_op_div):
-        (JSC::Interpreter::cti_op_pre_dec):
-        (JSC::Interpreter::cti_op_jless):
-        (JSC::Interpreter::cti_op_not):
-        (JSC::Interpreter::cti_op_jtrue):
-        (JSC::Interpreter::cti_op_post_inc):
-        (JSC::Interpreter::cti_op_eq):
-        (JSC::Interpreter::cti_op_lshift):
-        (JSC::Interpreter::cti_op_bitand):
-        (JSC::Interpreter::cti_op_rshift):
-        (JSC::Interpreter::cti_op_bitnot):
-        (JSC::Interpreter::cti_op_resolve_with_base):
-        (JSC::Interpreter::cti_op_mod):
-        (JSC::Interpreter::cti_op_less):
-        (JSC::Interpreter::cti_op_neq):
-        (JSC::Interpreter::cti_op_post_dec):
-        (JSC::Interpreter::cti_op_urshift):
-        (JSC::Interpreter::cti_op_bitxor):
-        (JSC::Interpreter::cti_op_bitor):
-        (JSC::Interpreter::cti_op_push_scope):
-        (JSC::Interpreter::cti_op_to_jsnumber):
-        (JSC::Interpreter::cti_op_in):
-        (JSC::Interpreter::cti_op_del_by_val):
-        * wrec/WREC.cpp:
-        (JSC::WREC::compileRegExp):
-        * wrec/WRECParser.cpp:
-        (JSC::WREC::Parser::parseGreedyQuantifier):
-        (JSC::WREC::Parser::parseParentheses):
-        (JSC::WREC::Parser::parseCharacterClass):
-        (JSC::WREC::Parser::parseEscape):
-        * wrec/WRECParser.h:
-        (JSC::WREC::Parser::):
-        (JSC::WREC::Parser::atEndOfPattern):
-
-2008-11-18  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22337
-        Enable workers by default
-
-        * Configurations/JavaScriptCore.xcconfig: Define ENABLE_WORKERS.
-
-2008-11-18  Alexey Proskuryakov  <ap@webkit.org>
-
-        - Windows build fix
-
-        * wrec/WRECFunctors.h:
-        * wrec/WRECGenerator.h:
-        * wrec/WRECParser.h:
-        CharacterClass is a struct, not a class, fix forward declarations.
-
-2008-11-18  Dan Bernstein  <mitz@apple.com>
-
-        - Windows build fix
-
-        * assembler/X86Assembler.h:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix gtk build.
-
-        * wrec/Quantifier.h:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix gtk build.
-
-        * assembler/AssemblerBuffer.h:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Split WREC classes out into individual files, with a few modifications
-        to more closely match the WebKit coding style.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.scons:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * assembler/X86Assembler.h:
-        * runtime/RegExp.cpp:
-        * wrec/CharacterClass.cpp: Copied from wrec/CharacterClassConstructor.cpp.
-        (JSC::WREC::CharacterClass::newline):
-        (JSC::WREC::CharacterClass::digits):
-        (JSC::WREC::CharacterClass::spaces):
-        (JSC::WREC::CharacterClass::wordchar):
-        (JSC::WREC::CharacterClass::nondigits):
-        (JSC::WREC::CharacterClass::nonspaces):
-        (JSC::WREC::CharacterClass::nonwordchar):
-        * wrec/CharacterClass.h: Copied from wrec/CharacterClassConstructor.h.
-        * wrec/CharacterClassConstructor.cpp:
-        (JSC::WREC::CharacterClassConstructor::addSortedRange):
-        (JSC::WREC::CharacterClassConstructor::append):
-        * wrec/CharacterClassConstructor.h:
-        * wrec/Quantifier.h: Copied from wrec/WREC.h.
-        * wrec/WREC.cpp:
-        (JSC::WREC::compileRegExp):
-        * wrec/WREC.h:
-        * wrec/WRECFunctors.cpp: Copied from wrec/WREC.cpp.
-        * wrec/WRECFunctors.h: Copied from wrec/WREC.cpp.
-        (JSC::WREC::GenerateAtomFunctor::~GenerateAtomFunctor):
-        (JSC::WREC::GeneratePatternCharacterFunctor::GeneratePatternCharacterFunctor):
-        (JSC::WREC::GenerateCharacterClassFunctor::GenerateCharacterClassFunctor):
-        (JSC::WREC::GenerateBackreferenceFunctor::GenerateBackreferenceFunctor):
-        (JSC::WREC::GenerateParenthesesNonGreedyFunctor::GenerateParenthesesNonGreedyFunctor):
-        * wrec/WRECGenerator.cpp: Copied from wrec/WREC.cpp.
-        (JSC::WREC::Generator::generatePatternCharacter):
-        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
-        (JSC::WREC::Generator::generateCharacterClassInverted):
-        (JSC::WREC::Generator::generateCharacterClass):
-        (JSC::WREC::Generator::generateParentheses):
-        (JSC::WREC::Generator::generateAssertionBOL):
-        (JSC::WREC::Generator::generateAssertionEOL):
-        (JSC::WREC::Generator::generateAssertionWordBoundary):
-        * wrec/WRECGenerator.h: Copied from wrec/WREC.h.
-        * wrec/WRECParser.cpp: Copied from wrec/WREC.cpp.
-        (JSC::WREC::Parser::parseGreedyQuantifier):
-        (JSC::WREC::Parser::parseCharacterClassQuantifier):
-        (JSC::WREC::Parser::parseParentheses):
-        (JSC::WREC::Parser::parseCharacterClass):
-        (JSC::WREC::Parser::parseEscape):
-        (JSC::WREC::Parser::parseTerm):
-        * wrec/WRECParser.h: Copied from wrec/WREC.h.
-        (JSC::WREC::Parser::):
-        (JSC::WREC::Parser::Parser):
-        (JSC::WREC::Parser::setError):
-        (JSC::WREC::Parser::error):
-        (JSC::WREC::Parser::recordSubpattern):
-        (JSC::WREC::Parser::numSubpatterns):
-        (JSC::WREC::Parser::ignoreCase):
-        (JSC::WREC::Parser::multiline):
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix a few builds.
-
-        * JavaScriptCoreSources.bkl:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix a few builds.
-
-        * JavaScriptCore.pri:
-        * JavaScriptCore.scons:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Moved VM/CTI.* => jit/JIT.*.
-        
-        Removed VM.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.scons:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CTI.cpp: Removed.
-        * VM/CTI.h: Removed.
-        * bytecode/CodeBlock.cpp:
-        * interpreter/Interpreter.cpp:
-        * jit: Added.
-        * jit/JIT.cpp: Copied from VM/CTI.cpp.
-        * jit/JIT.h: Copied from VM/CTI.h.
-        * runtime/RegExp.cpp:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Moved runtime/ExecState.* => interpreter/CallFrame.*.
-
-        * API/JSBase.cpp:
-        * API/OpaqueJSString.cpp:
-        * GNUmakefile.am:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * debugger/DebuggerCallFrame.h:
-        * interpreter/CallFrame.cpp: Copied from runtime/ExecState.cpp.
-        * interpreter/CallFrame.h: Copied from runtime/ExecState.h.
-        * interpreter/Interpreter.cpp:
-        * parser/Nodes.cpp:
-        * profiler/ProfileGenerator.cpp:
-        * profiler/Profiler.cpp:
-        * runtime/ClassInfo.h:
-        * runtime/Collector.cpp:
-        * runtime/Completion.cpp:
-        * runtime/ExceptionHelpers.cpp:
-        * runtime/ExecState.cpp: Removed.
-        * runtime/ExecState.h: Removed.
-        * runtime/Identifier.cpp:
-        * runtime/JSFunction.cpp:
-        * runtime/JSGlobalObjectFunctions.cpp:
-        * runtime/JSLock.cpp:
-        * runtime/JSNumberCell.h:
-        * runtime/JSObject.h:
-        * runtime/JSString.h:
-        * runtime/Lookup.h:
-        * runtime/PropertyNameArray.h:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix Windows build.
-
-        * API/APICast.h:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix Windows build.
-
-        * API/APICast.h:
-        * runtime/ExecState.h:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Moved VM/SamplingTool.* => bytecode/SamplingTool.*.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.scons:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * VM/SamplingTool.cpp: Removed.
-        * VM/SamplingTool.h: Removed.
-        * bytecode/SamplingTool.cpp: Copied from VM/SamplingTool.cpp.
-        * bytecode/SamplingTool.h: Copied from VM/SamplingTool.h.
         * jsc.cpp:
-        (runWithScripts):
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix Windows build.
-
-        * runtime/ExecState.h:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Moved VM/ExceptionHelpers.cpp => runtime/ExceptionHelpers.cpp.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.scons:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * VM/ExceptionHelpers.cpp: Removed.
-        * runtime/ExceptionHelpers.cpp: Copied from VM/ExceptionHelpers.cpp.
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Moved VM/RegisterFile.cpp => interpreter/RegisterFile.cpp.
-
-        * AllInOneFile.cpp:
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.scons:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * VM/RegisterFile.cpp: Removed.
-        * interpreter/RegisterFile.cpp: Copied from VM/RegisterFile.cpp.
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix Windows build.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix Windows build.
-
-        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix Windows build.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Moved:
-            VM/ExceptionHelpers.h => runtime/ExceptionHelpers.h
-            VM/Register.h => interpreter/Register.h
-            VM/RegisterFile.h => interpreter/RegisterFile.h
-        
-        
-        * GNUmakefile.am:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/ExceptionHelpers.h: Removed.
-        * VM/Register.h: Removed.
-        * VM/RegisterFile.h: Removed.
-        * interpreter/Register.h: Copied from VM/Register.h.
-        * interpreter/RegisterFile.h: Copied from VM/RegisterFile.h.
-        * runtime/ExceptionHelpers.h: Copied from VM/ExceptionHelpers.h.
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix Qt build.
-
-        * JavaScriptCore.pri:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Moved VM/Machine.cpp => interpreter/Interpreter.cpp.
-
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.scons:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * VM/Machine.cpp: Removed.
-        * interpreter/Interpreter.cpp: Copied from VM/Machine.cpp.
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Moved VM/Machine.h => interpreter/Interpreter.h
-
-        * GNUmakefile.am:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CTI.cpp:
-        * VM/CTI.h:
-        * VM/ExceptionHelpers.cpp:
-        * VM/Machine.cpp:
-        * VM/Machine.h: Removed.
-        * VM/SamplingTool.cpp:
-        * bytecode/CodeBlock.cpp:
-        * bytecompiler/BytecodeGenerator.cpp:
-        * bytecompiler/BytecodeGenerator.h:
-        * debugger/DebuggerCallFrame.cpp:
-        * interpreter: Added.
-        * interpreter/Interpreter.h: Copied from VM/Machine.h.
-        * profiler/ProfileGenerator.cpp:
-        * runtime/Arguments.h:
-        * runtime/ArrayPrototype.cpp:
-        * runtime/Collector.cpp:
-        * runtime/Completion.cpp:
-        * runtime/ExecState.h:
-        * runtime/FunctionPrototype.cpp:
-        * runtime/JSActivation.cpp:
-        * runtime/JSFunction.cpp:
-        * runtime/JSGlobalData.cpp:
-        * runtime/JSGlobalObject.cpp:
-        * runtime/JSGlobalObjectFunctions.cpp:
-        * wrec/WREC.cpp:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Moved runtime/Interpreter.cpp => runtime/Completion.cpp.
-
-        Moved functions from Interpreter.h to Completion.h, and removed
-        Interpreter.h from the project.
-
-        * API/JSBase.cpp:
-        * AllInOneFile.cpp:
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * jsc.cpp:
-        * runtime/Completion.cpp: Copied from runtime/Interpreter.cpp.
-        * runtime/Completion.h:
-        * runtime/Interpreter.cpp: Removed.
-        * runtime/Interpreter.h: Removed.
-
-2008-11-17  Gabor Loki  <loki@inf.u-szeged.hu>
-
-        Reviewed by Darin Adler.
-
-        <https://bugs.webkit.org/show_bug.cgi?id=22312>
-        Fix PCRE include path problem on Qt-port
-
-        * JavaScriptCore.pri:
-        * pcre/pcre.pri:
+        (GlobalObject::GlobalObject):
+        (functionCheckSyntax):
 
-2008-11-17  Gabor Loki  <loki@inf.u-szeged.hu>
+2009-06-19  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
 
         Reviewed by Darin Adler.
-
-        <https://bugs.webkit.org/show_bug.cgi?id=22313>
-        Add missing CTI source to the build system on Qt-port
-
-        * JavaScriptCore.pri:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
         
-        Try to fix JSGlue build.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+        Inherits HashCountedSet class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/Collector.cpp:1095.
 
-        Not reviewed.
-        
-        Try to fix Qt build.
-
-        * jsc.pro:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix Qt build.
-
-        * JavaScriptCore.pri:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix Qt build.
-
-        * JavaScriptCore.pri:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        More file moves:
-        
-        VM/CodeBlock.* => bytecode/CodeBlock.*
-        VM/EvalCodeCache.h => bytecode/EvalCodeCache.h
-        VM/Instruction.h => bytecode/Instruction.h
-        VM/Opcode.* => bytecode/Opcode.*
-
-        * GNUmakefile.am:
-        * JavaScriptCore.scons:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * VM/CodeBlock.cpp: Removed.
-        * VM/CodeBlock.h: Removed.
-        * VM/EvalCodeCache.h: Removed.
-        * VM/Instruction.h: Removed.
-        * VM/Opcode.cpp: Removed.
-        * VM/Opcode.h: Removed.
-        * bytecode: Added.
-        * bytecode/CodeBlock.cpp: Copied from VM/CodeBlock.cpp.
-        * bytecode/CodeBlock.h: Copied from VM/CodeBlock.h.
-        * bytecode/EvalCodeCache.h: Copied from VM/EvalCodeCache.h.
-        * bytecode/Instruction.h: Copied from VM/Instruction.h.
-        * bytecode/Opcode.cpp: Copied from VM/Opcode.cpp.
-        * bytecode/Opcode.h: Copied from VM/Opcode.h.
-        * jsc.pro:
-        * jscore.bkl:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix a few more builds.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.scons:
-        * JavaScriptCoreSources.bkl:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix gtk build.
-
-        * GNUmakefile.am:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix Windows build.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Some file moves:
-        
-        VM/LabelID.h => bytecompiler/Label.h
-        VM/RegisterID.h => bytecompiler/RegisterID.h
-        VM/SegmentedVector.h => bytecompiler/SegmentedVector.h
-        bytecompiler/CodeGenerator.* => bytecompiler/BytecodeGenerator.*
-
-        * AllInOneFile.cpp:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/LabelID.h: Removed.
-        * VM/RegisterID.h: Removed.
-        * VM/SegmentedVector.h: Removed.
-        * bytecompiler/BytecodeGenerator.cpp: Copied from bytecompiler/CodeGenerator.cpp.
-        * bytecompiler/BytecodeGenerator.h: Copied from bytecompiler/CodeGenerator.h.
-        * bytecompiler/CodeGenerator.cpp: Removed.
-        * bytecompiler/CodeGenerator.h: Removed.
-        * bytecompiler/Label.h: Copied from VM/LabelID.h.
-        * bytecompiler/LabelScope.h:
-        * bytecompiler/RegisterID.h: Copied from VM/RegisterID.h.
-        * bytecompiler/SegmentedVector.h: Copied from VM/SegmentedVector.h.
-        * jsc.cpp:
-        * parser/Nodes.cpp:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix Windows build.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix Windows build.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix Windows build.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-
-2008-11-16  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix Windows build.
-
-        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
-
-2008-11-16  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix Windows build.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-
-2008-11-16  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Moved masm => assembler and split "AssemblerBuffer.h" out of "X86Assembler.h".
-        
-        Also renamed ENABLE_MASM to ENABLE_ASSEMBLER.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * assembler: Added.
-        * assembler/AssemblerBuffer.h: Copied from masm/X86Assembler.h.
-        (JSC::AssemblerBuffer::AssemblerBuffer):
-        (JSC::AssemblerBuffer::~AssemblerBuffer):
-        (JSC::AssemblerBuffer::ensureSpace):
-        (JSC::AssemblerBuffer::isAligned):
-        (JSC::AssemblerBuffer::putByteUnchecked):
-        (JSC::AssemblerBuffer::putByte):
-        (JSC::AssemblerBuffer::putShortUnchecked):
-        (JSC::AssemblerBuffer::putShort):
-        (JSC::AssemblerBuffer::putIntUnchecked):
-        (JSC::AssemblerBuffer::putInt):
-        (JSC::AssemblerBuffer::data):
-        (JSC::AssemblerBuffer::size):
-        (JSC::AssemblerBuffer::reset):
-        (JSC::AssemblerBuffer::executableCopy):
-        (JSC::AssemblerBuffer::grow):
-        * assembler/X86Assembler.h: Copied from masm/X86Assembler.h.
-        * masm: Removed.
-        * masm/X86Assembler.h: Removed.
-        * wtf/Platform.h:
-
-2008-11-16  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix gtk build.
-
-        * GNUmakefile.am:
-
-2008-11-16  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Fixed tyop.
-
-        * VM/CTI.cpp:
-
-2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+        * wtf/HashCountedSet.h:
 
-        Not reviewed.
-        
-        Try to fix windows build.
+2009-06-19  Yong Li  <yong.li@torchmobile.com>
 
-        * VM/CTI.cpp:
+        Reviewed by George Staikos.
 
-2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=26558
+        Declare these symbols extern for WINCE as they are provided by libce.
 
-        Not reviewed.
-        
-        Try to fix gtk build.
+        * runtime/DateConstructor.cpp:
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
 
-        * GNUmakefile.am:
+2009-06-19  Oliver Hunt  <oliver@apple.com>
 
-2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+        Reviewed by Maciej Stachowiak.
 
-        Reviewed by Sam Weinig.
+        <rdar://problem/6988973> ScopeChain leak in interpreter builds
 
-        Renamed ENABLE_CTI and ENABLE(CTI) to ENABLE_JIT and ENABLE(JIT).
+        Move the Scopechain destruction code in JSFunction outside of the ENABLE(JIT)
+        path.
 
-        * VM/CTI.cpp:
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::~CodeBlock):
-        * VM/CodeBlock.h:
-        (JSC::CodeBlock::CodeBlock):
-        * VM/Machine.cpp:
-        (JSC::Interpreter::Interpreter):
-        (JSC::Interpreter::initialize):
-        (JSC::Interpreter::~Interpreter):
-        (JSC::Interpreter::execute):
-        (JSC::Interpreter::privateExecute):
-        * VM/Machine.h:
-        * bytecompiler/CodeGenerator.cpp:
-        (JSC::prepareJumpTableForStringSwitch):
         * runtime/JSFunction.cpp:
         (JSC::JSFunction::~JSFunction):
-        * runtime/JSGlobalData.h:
-        * wrec/WREC.h:
         * wtf/Platform.h:
-        * wtf/TCSystemAlloc.cpp:
 
-2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+2009-06-19  Yong Li  <yong.li@torchmobile.com>
 
-        Not reviewed.
-        
-        Try to fix gtk build.
-
-        * VM/CTI.cpp:
-
-2008-11-16  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by a few people on squirrelfish-dev.
-        
-        Renamed CTI => JIT.
-
-        * VM/CTI.cpp:
-        (JSC::JIT::killLastResultRegister):
-        (JSC::JIT::emitGetVirtualRegister):
-        (JSC::JIT::emitGetVirtualRegisters):
-        (JSC::JIT::emitPutCTIArgFromVirtualRegister):
-        (JSC::JIT::emitPutCTIArg):
-        (JSC::JIT::emitGetCTIArg):
-        (JSC::JIT::emitPutCTIArgConstant):
-        (JSC::JIT::getConstantImmediateNumericArg):
-        (JSC::JIT::emitPutCTIParam):
-        (JSC::JIT::emitGetCTIParam):
-        (JSC::JIT::emitPutToCallFrameHeader):
-        (JSC::JIT::emitGetFromCallFrameHeader):
-        (JSC::JIT::emitPutVirtualRegister):
-        (JSC::JIT::emitInitRegister):
-        (JSC::JIT::printBytecodeOperandTypes):
-        (JSC::JIT::emitAllocateNumber):
-        (JSC::JIT::emitNakedCall):
-        (JSC::JIT::emitNakedFastCall):
-        (JSC::JIT::emitCTICall):
-        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
-        (JSC::JIT::linkSlowCaseIfNotJSCell):
-        (JSC::JIT::emitJumpSlowCaseIfNotImmNum):
-        (JSC::JIT::emitJumpSlowCaseIfNotImmNums):
-        (JSC::JIT::getDeTaggedConstantImmediate):
-        (JSC::JIT::emitFastArithDeTagImmediate):
-        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
-        (JSC::JIT::emitFastArithReTagImmediate):
-        (JSC::JIT::emitFastArithPotentiallyReTagImmediate):
-        (JSC::JIT::emitFastArithImmToInt):
-        (JSC::JIT::emitFastArithIntToImmOrSlowCase):
-        (JSC::JIT::emitFastArithIntToImmNoCheck):
-        (JSC::JIT::emitArithIntToImmWithJump):
-        (JSC::JIT::emitTagAsBoolImmediate):
-        (JSC::JIT::JIT):
-        (JSC::JIT::compileOpCallInitializeCallFrame):
-        (JSC::JIT::compileOpCallSetupArgs):
-        (JSC::JIT::compileOpCallEvalSetupArgs):
-        (JSC::JIT::compileOpConstructSetupArgs):
-        (JSC::JIT::compileOpCall):
-        (JSC::JIT::compileOpStrictEq):
-        (JSC::JIT::emitSlowScriptCheck):
-        (JSC::JIT::putDoubleResultToJSNumberCellOrJSImmediate):
-        (JSC::JIT::compileBinaryArithOp):
-        (JSC::JIT::compileBinaryArithOpSlowCase):
-        (JSC::JIT::privateCompileMainPass):
-        (JSC::JIT::privateCompileLinkPass):
-        (JSC::JIT::privateCompileSlowCases):
-        (JSC::JIT::privateCompile):
-        (JSC::JIT::privateCompileGetByIdSelf):
-        (JSC::JIT::privateCompileGetByIdProto):
-        (JSC::JIT::privateCompileGetByIdChain):
-        (JSC::JIT::privateCompilePutByIdReplace):
-        (JSC::JIT::privateCompilePutByIdTransition):
-        (JSC::JIT::unlinkCall):
-        (JSC::JIT::linkCall):
-        (JSC::JIT::privateCompileCTIMachineTrampolines):
-        (JSC::JIT::freeCTIMachineTrampolines):
-        (JSC::JIT::patchGetByIdSelf):
-        (JSC::JIT::patchPutByIdReplace):
-        (JSC::JIT::privateCompilePatchGetArrayLength):
-        (JSC::JIT::emitGetVariableObjectRegister):
-        (JSC::JIT::emitPutVariableObjectRegister):
-        * VM/CTI.h:
-        (JSC::JIT::compile):
-        (JSC::JIT::compileGetByIdSelf):
-        (JSC::JIT::compileGetByIdProto):
-        (JSC::JIT::compileGetByIdChain):
-        (JSC::JIT::compilePutByIdReplace):
-        (JSC::JIT::compilePutByIdTransition):
-        (JSC::JIT::compileCTIMachineTrampolines):
-        (JSC::JIT::compilePatchGetArrayLength):
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::unlinkCallers):
-        * VM/Machine.cpp:
-        (JSC::Interpreter::initialize):
-        (JSC::Interpreter::~Interpreter):
-        (JSC::Interpreter::execute):
-        (JSC::Interpreter::tryCTICachePutByID):
-        (JSC::Interpreter::tryCTICacheGetByID):
-        (JSC::Interpreter::cti_op_call_JSFunction):
-        (JSC::Interpreter::cti_vm_dontLazyLinkCall):
-        (JSC::Interpreter::cti_vm_lazyLinkCall):
-        * VM/Machine.h:
-        * VM/RegisterFile.h:
-        * parser/Nodes.h:
-        * runtime/JSArray.h:
-        * runtime/JSCell.h:
-        * runtime/JSFunction.h:
-        * runtime/JSImmediate.h:
-        * runtime/JSNumberCell.h:
-        * runtime/JSObject.h:
-        * runtime/JSString.h:
-        * runtime/JSVariableObject.h:
-        * runtime/ScopeChain.h:
-        * runtime/Structure.h:
-        * runtime/TypeInfo.h:
-        * runtime/UString.h:
-
-2008-11-16  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix wx build.
-
-        * jscore.bkl:
-
-2008-11-16  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Nixed X86:: and X86Assembler:: prefixes in a lot of places using typedefs.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitGetVirtualRegister):
-        (JSC::CTI::emitGetVirtualRegisters):
-        (JSC::CTI::emitPutCTIArgFromVirtualRegister):
-        (JSC::CTI::emitPutCTIArg):
-        (JSC::CTI::emitGetCTIArg):
-        (JSC::CTI::emitPutCTIParam):
-        (JSC::CTI::emitGetCTIParam):
-        (JSC::CTI::emitPutToCallFrameHeader):
-        (JSC::CTI::emitGetFromCallFrameHeader):
-        (JSC::CTI::emitPutVirtualRegister):
-        (JSC::CTI::emitNakedCall):
-        (JSC::CTI::emitNakedFastCall):
-        (JSC::CTI::emitCTICall):
-        (JSC::CTI::emitJumpSlowCaseIfNotJSCell):
-        (JSC::CTI::emitJumpSlowCaseIfNotImmNum):
-        (JSC::CTI::emitJumpSlowCaseIfNotImmNums):
-        (JSC::CTI::emitFastArithDeTagImmediate):
-        (JSC::CTI::emitFastArithDeTagImmediateJumpIfZero):
-        (JSC::CTI::emitFastArithReTagImmediate):
-        (JSC::CTI::emitFastArithPotentiallyReTagImmediate):
-        (JSC::CTI::emitFastArithImmToInt):
-        (JSC::CTI::emitFastArithIntToImmOrSlowCase):
-        (JSC::CTI::emitFastArithIntToImmNoCheck):
-        (JSC::CTI::emitArithIntToImmWithJump):
-        (JSC::CTI::emitTagAsBoolImmediate):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::compileOpStrictEq):
-        (JSC::CTI::emitSlowScriptCheck):
-        (JSC::CTI::putDoubleResultToJSNumberCellOrJSImmediate):
-        (JSC::CTI::compileBinaryArithOp):
-        (JSC::CTI::compileBinaryArithOpSlowCase):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        (JSC::CTI::privateCompileGetByIdSelf):
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        (JSC::CTI::privateCompilePutByIdReplace):
-        (JSC::CTI::privateCompilePutByIdTransition):
-        (JSC::CTI::privateCompileCTIMachineTrampolines):
-        (JSC::CTI::privateCompilePatchGetArrayLength):
-        (JSC::CTI::emitGetVariableObjectRegister):
-        (JSC::CTI::emitPutVariableObjectRegister):
-        * VM/CTI.h:
-        (JSC::CallRecord::CallRecord):
-        (JSC::JmpTable::JmpTable):
-        (JSC::SlowCaseEntry::SlowCaseEntry):
-        (JSC::CTI::JSRInfo::JSRInfo):
-        * wrec/WREC.h:
-
-2008-11-16  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix Qt build.
-
-        * JavaScriptCore.pri:
-
-2008-11-16  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Renamed OBJECT_OFFSET => FIELD_OFFSET
-
-        Nixed use of OBJECT_OFFSET outside of CTI.cpp by making CTI a friend in
-        more places.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::compileOpCallInitializeCallFrame):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::emitSlowScriptCheck):
-        (JSC::CTI::putDoubleResultToJSNumberCellOrJSImmediate):
-        (JSC::CTI::compileBinaryArithOp):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        (JSC::CTI::privateCompileGetByIdSelf):
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        (JSC::CTI::privateCompilePutByIdReplace):
-        (JSC::CTI::privateCompilePutByIdTransition):
-        (JSC::CTI::privateCompileCTIMachineTrampolines):
-        (JSC::CTI::privateCompilePatchGetArrayLength):
-        (JSC::CTI::emitGetVariableObjectRegister):
-        (JSC::CTI::emitPutVariableObjectRegister):
-        * runtime/JSValue.h:
-        * runtime/JSVariableObject.h:
-
-2008-11-16  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Renames:
-        
-        X86Assembler::copy => X86Assembler::executableCopy
-        AssemblerBuffer::copy => AssemblerBuffer::executableCopy
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompile):
-        (JSC::CTI::privateCompileGetByIdSelf):
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        (JSC::CTI::privateCompilePutByIdReplace):
-        (JSC::CTI::privateCompilePutByIdTransition):
-        (JSC::CTI::privateCompileCTIMachineTrampolines):
-        (JSC::CTI::privateCompilePatchGetArrayLength):
-        * masm/X86Assembler.h:
-        (JSC::AssemblerBuffer::executableCopy):
-        (JSC::X86Assembler::executableCopy):
-        * wrec/WREC.cpp:
-        (JSC::WREC::compileRegExp):
-
-2008-11-16  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Renamed WREC => JSC::WREC, removing JSC:: prefix in a lot of places.
-        Renamed WRECFunction => WREC::CompiledRegExp, and deployed this type
-        name in place of a few casts.
-
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::RegExp):
-        (JSC::RegExp::~RegExp):
-        (JSC::RegExp::match):
-        * runtime/RegExp.h:
-        * wrec/CharacterClassConstructor.cpp:
-        * wrec/CharacterClassConstructor.h:
-        * wrec/WREC.cpp:
-        (JSC::WREC::compileRegExp):
-        * wrec/WREC.h:
-        (JSC::WREC::Generator::Generator):
-        (JSC::WREC::Parser::Parser):
-        (JSC::WREC::Parser::parseAlternative):
-
-2008-11-16  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Renamed BytecodeInterpreter => Interpreter.
-
-        * JavaScriptCore.exp:
-        * VM/CTI.cpp:
-        (JSC::):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::emitSlowScriptCheck):
-        (JSC::CTI::compileBinaryArithOpSlowCase):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        (JSC::CTI::privateCompileGetByIdSelf):
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        (JSC::CTI::privateCompilePutByIdReplace):
-        (JSC::CTI::privateCompilePutByIdTransition):
-        (JSC::CTI::privateCompileCTIMachineTrampolines):
-        (JSC::CTI::freeCTIMachineTrampolines):
-        (JSC::CTI::patchGetByIdSelf):
-        (JSC::CTI::patchPutByIdReplace):
-        (JSC::CTI::privateCompilePatchGetArrayLength):
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::printStructures):
-        (JSC::CodeBlock::derefStructures):
-        (JSC::CodeBlock::refStructures):
-        * VM/Machine.cpp:
-        (JSC::jsLess):
-        (JSC::jsLessEq):
-        (JSC::Interpreter::resolve):
-        (JSC::Interpreter::resolveSkip):
-        (JSC::Interpreter::resolveGlobal):
-        (JSC::Interpreter::resolveBase):
-        (JSC::Interpreter::resolveBaseAndProperty):
-        (JSC::Interpreter::resolveBaseAndFunc):
-        (JSC::Interpreter::slideRegisterWindowForCall):
-        (JSC::Interpreter::callEval):
-        (JSC::Interpreter::Interpreter):
-        (JSC::Interpreter::initialize):
-        (JSC::Interpreter::~Interpreter):
-        (JSC::Interpreter::dumpCallFrame):
-        (JSC::Interpreter::dumpRegisters):
-        (JSC::Interpreter::isOpcode):
-        (JSC::Interpreter::unwindCallFrame):
-        (JSC::Interpreter::throwException):
-        (JSC::Interpreter::execute):
-        (JSC::Interpreter::debug):
-        (JSC::Interpreter::resetTimeoutCheck):
-        (JSC::Interpreter::checkTimeout):
-        (JSC::Interpreter::createExceptionScope):
-        (JSC::Interpreter::tryCachePutByID):
-        (JSC::Interpreter::uncachePutByID):
-        (JSC::Interpreter::tryCacheGetByID):
-        (JSC::Interpreter::uncacheGetByID):
-        (JSC::Interpreter::privateExecute):
-        (JSC::Interpreter::retrieveArguments):
-        (JSC::Interpreter::retrieveCaller):
-        (JSC::Interpreter::retrieveLastCaller):
-        (JSC::Interpreter::findFunctionCallFrame):
-        (JSC::Interpreter::tryCTICachePutByID):
-        (JSC::Interpreter::tryCTICacheGetByID):
-        (JSC::Interpreter::cti_op_convert_this):
-        (JSC::Interpreter::cti_op_end):
-        (JSC::Interpreter::cti_op_add):
-        (JSC::Interpreter::cti_op_pre_inc):
-        (JSC::Interpreter::cti_timeout_check):
-        (JSC::Interpreter::cti_register_file_check):
-        (JSC::Interpreter::cti_op_loop_if_less):
-        (JSC::Interpreter::cti_op_loop_if_lesseq):
-        (JSC::Interpreter::cti_op_new_object):
-        (JSC::Interpreter::cti_op_put_by_id):
-        (JSC::Interpreter::cti_op_put_by_id_second):
-        (JSC::Interpreter::cti_op_put_by_id_generic):
-        (JSC::Interpreter::cti_op_put_by_id_fail):
-        (JSC::Interpreter::cti_op_get_by_id):
-        (JSC::Interpreter::cti_op_get_by_id_second):
-        (JSC::Interpreter::cti_op_get_by_id_generic):
-        (JSC::Interpreter::cti_op_get_by_id_fail):
-        (JSC::Interpreter::cti_op_instanceof):
-        (JSC::Interpreter::cti_op_del_by_id):
-        (JSC::Interpreter::cti_op_mul):
-        (JSC::Interpreter::cti_op_new_func):
-        (JSC::Interpreter::cti_op_call_JSFunction):
-        (JSC::Interpreter::cti_op_call_arityCheck):
-        (JSC::Interpreter::cti_vm_dontLazyLinkCall):
-        (JSC::Interpreter::cti_vm_lazyLinkCall):
-        (JSC::Interpreter::cti_op_push_activation):
-        (JSC::Interpreter::cti_op_call_NotJSFunction):
-        (JSC::Interpreter::cti_op_create_arguments):
-        (JSC::Interpreter::cti_op_create_arguments_no_params):
-        (JSC::Interpreter::cti_op_tear_off_activation):
-        (JSC::Interpreter::cti_op_tear_off_arguments):
-        (JSC::Interpreter::cti_op_profile_will_call):
-        (JSC::Interpreter::cti_op_profile_did_call):
-        (JSC::Interpreter::cti_op_ret_scopeChain):
-        (JSC::Interpreter::cti_op_new_array):
-        (JSC::Interpreter::cti_op_resolve):
-        (JSC::Interpreter::cti_op_construct_JSConstruct):
-        (JSC::Interpreter::cti_op_construct_NotJSConstruct):
-        (JSC::Interpreter::cti_op_get_by_val):
-        (JSC::Interpreter::cti_op_resolve_func):
-        (JSC::Interpreter::cti_op_sub):
-        (JSC::Interpreter::cti_op_put_by_val):
-        (JSC::Interpreter::cti_op_put_by_val_array):
-        (JSC::Interpreter::cti_op_lesseq):
-        (JSC::Interpreter::cti_op_loop_if_true):
-        (JSC::Interpreter::cti_op_negate):
-        (JSC::Interpreter::cti_op_resolve_base):
-        (JSC::Interpreter::cti_op_resolve_skip):
-        (JSC::Interpreter::cti_op_resolve_global):
-        (JSC::Interpreter::cti_op_div):
-        (JSC::Interpreter::cti_op_pre_dec):
-        (JSC::Interpreter::cti_op_jless):
-        (JSC::Interpreter::cti_op_not):
-        (JSC::Interpreter::cti_op_jtrue):
-        (JSC::Interpreter::cti_op_post_inc):
-        (JSC::Interpreter::cti_op_eq):
-        (JSC::Interpreter::cti_op_lshift):
-        (JSC::Interpreter::cti_op_bitand):
-        (JSC::Interpreter::cti_op_rshift):
-        (JSC::Interpreter::cti_op_bitnot):
-        (JSC::Interpreter::cti_op_resolve_with_base):
-        (JSC::Interpreter::cti_op_new_func_exp):
-        (JSC::Interpreter::cti_op_mod):
-        (JSC::Interpreter::cti_op_less):
-        (JSC::Interpreter::cti_op_neq):
-        (JSC::Interpreter::cti_op_post_dec):
-        (JSC::Interpreter::cti_op_urshift):
-        (JSC::Interpreter::cti_op_bitxor):
-        (JSC::Interpreter::cti_op_new_regexp):
-        (JSC::Interpreter::cti_op_bitor):
-        (JSC::Interpreter::cti_op_call_eval):
-        (JSC::Interpreter::cti_op_throw):
-        (JSC::Interpreter::cti_op_get_pnames):
-        (JSC::Interpreter::cti_op_next_pname):
-        (JSC::Interpreter::cti_op_push_scope):
-        (JSC::Interpreter::cti_op_pop_scope):
-        (JSC::Interpreter::cti_op_typeof):
-        (JSC::Interpreter::cti_op_is_undefined):
-        (JSC::Interpreter::cti_op_is_boolean):
-        (JSC::Interpreter::cti_op_is_number):
-        (JSC::Interpreter::cti_op_is_string):
-        (JSC::Interpreter::cti_op_is_object):
-        (JSC::Interpreter::cti_op_is_function):
-        (JSC::Interpreter::cti_op_stricteq):
-        (JSC::Interpreter::cti_op_nstricteq):
-        (JSC::Interpreter::cti_op_to_jsnumber):
-        (JSC::Interpreter::cti_op_in):
-        (JSC::Interpreter::cti_op_push_new_scope):
-        (JSC::Interpreter::cti_op_jmp_scopes):
-        (JSC::Interpreter::cti_op_put_by_index):
-        (JSC::Interpreter::cti_op_switch_imm):
-        (JSC::Interpreter::cti_op_switch_char):
-        (JSC::Interpreter::cti_op_switch_string):
-        (JSC::Interpreter::cti_op_del_by_val):
-        (JSC::Interpreter::cti_op_put_getter):
-        (JSC::Interpreter::cti_op_put_setter):
-        (JSC::Interpreter::cti_op_new_error):
-        (JSC::Interpreter::cti_op_debug):
-        (JSC::Interpreter::cti_vm_throw):
-        * VM/Machine.h:
-        * VM/Register.h:
-        * VM/SamplingTool.h:
-        (JSC::SamplingTool::SamplingTool):
-        * bytecompiler/CodeGenerator.cpp:
-        (JSC::BytecodeGenerator::generate):
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        * jsc.cpp:
-        (runWithScripts):
-        * runtime/ExecState.h:
-        (JSC::ExecState::interpreter):
-        * runtime/JSCell.h:
-        * runtime/JSFunction.h:
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        * runtime/JSGlobalData.h:
-        * runtime/JSString.h:
-        * wrec/WREC.cpp:
-        (WREC::compileRegExp):
-        * wrec/WREC.h:
-
-2008-11-16  Geoffrey Garen  <ggaren@apple.com>
-
-        Roll out r38461 (my last patch) because it broke the world.
-
-2008-11-16  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        A few more renames:
-
-        BytecodeInterpreter => Interpreter
-        WREC => JSC::WREC, removing JSC:: prefix in a lot of places
-        X86Assembler::copy => X86Assembler::executableCopy
-        AssemblerBuffer::copy => AssemblerBuffer::executableCopy
-        WRECFunction => WREC::RegExpFunction
-        OBJECT_OFFSET => FIELD_OFFSET
-        
-        Also:
-
-        Nixed use of OBJECT_OFFSET outside of CTI.cpp by making CTI a friend in more places.
-        Nixed X86:: and X86Assembler:: prefixes in a lot of places using typedefs
-
-        * JavaScriptCore.exp:
-        * VM/CTI.cpp:
-        (JSC::):
-        (JSC::CTI::emitGetVirtualRegister):
-        (JSC::CTI::emitGetVirtualRegisters):
-        (JSC::CTI::emitPutCTIArgFromVirtualRegister):
-        (JSC::CTI::emitPutCTIArg):
-        (JSC::CTI::emitGetCTIArg):
-        (JSC::CTI::emitPutCTIParam):
-        (JSC::CTI::emitGetCTIParam):
-        (JSC::CTI::emitPutToCallFrameHeader):
-        (JSC::CTI::emitGetFromCallFrameHeader):
-        (JSC::CTI::emitPutVirtualRegister):
-        (JSC::CTI::emitNakedCall):
-        (JSC::CTI::emitNakedFastCall):
-        (JSC::CTI::emitCTICall):
-        (JSC::CTI::emitJumpSlowCaseIfNotJSCell):
-        (JSC::CTI::emitJumpSlowCaseIfNotImmNum):
-        (JSC::CTI::emitJumpSlowCaseIfNotImmNums):
-        (JSC::CTI::emitFastArithDeTagImmediate):
-        (JSC::CTI::emitFastArithDeTagImmediateJumpIfZero):
-        (JSC::CTI::emitFastArithReTagImmediate):
-        (JSC::CTI::emitFastArithPotentiallyReTagImmediate):
-        (JSC::CTI::emitFastArithImmToInt):
-        (JSC::CTI::emitFastArithIntToImmOrSlowCase):
-        (JSC::CTI::emitFastArithIntToImmNoCheck):
-        (JSC::CTI::emitArithIntToImmWithJump):
-        (JSC::CTI::emitTagAsBoolImmediate):
-        (JSC::CTI::compileOpCallInitializeCallFrame):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::compileOpStrictEq):
-        (JSC::CTI::emitSlowScriptCheck):
-        (JSC::CTI::putDoubleResultToJSNumberCellOrJSImmediate):
-        (JSC::CTI::compileBinaryArithOp):
-        (JSC::CTI::compileBinaryArithOpSlowCase):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        (JSC::CTI::privateCompileGetByIdSelf):
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        (JSC::CTI::privateCompilePutByIdReplace):
-        (JSC::CTI::privateCompilePutByIdTransition):
-        (JSC::CTI::privateCompileCTIMachineTrampolines):
-        (JSC::CTI::freeCTIMachineTrampolines):
-        (JSC::CTI::patchGetByIdSelf):
-        (JSC::CTI::patchPutByIdReplace):
-        (JSC::CTI::privateCompilePatchGetArrayLength):
-        (JSC::CTI::emitGetVariableObjectRegister):
-        (JSC::CTI::emitPutVariableObjectRegister):
-        * VM/CTI.h:
-        (JSC::CallRecord::CallRecord):
-        (JSC::JmpTable::JmpTable):
-        (JSC::SlowCaseEntry::SlowCaseEntry):
-        (JSC::CTI::JSRInfo::JSRInfo):
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::printStructures):
-        (JSC::CodeBlock::derefStructures):
-        (JSC::CodeBlock::refStructures):
-        * VM/Machine.cpp:
-        (JSC::jsLess):
-        (JSC::jsLessEq):
-        (JSC::Interpreter::resolve):
-        (JSC::Interpreter::resolveSkip):
-        (JSC::Interpreter::resolveGlobal):
-        (JSC::Interpreter::resolveBase):
-        (JSC::Interpreter::resolveBaseAndProperty):
-        (JSC::Interpreter::resolveBaseAndFunc):
-        (JSC::Interpreter::slideRegisterWindowForCall):
-        (JSC::Interpreter::callEval):
-        (JSC::Interpreter::Interpreter):
-        (JSC::Interpreter::initialize):
-        (JSC::Interpreter::~Interpreter):
-        (JSC::Interpreter::dumpCallFrame):
-        (JSC::Interpreter::dumpRegisters):
-        (JSC::Interpreter::isOpcode):
-        (JSC::Interpreter::unwindCallFrame):
-        (JSC::Interpreter::throwException):
-        (JSC::Interpreter::execute):
-        (JSC::Interpreter::debug):
-        (JSC::Interpreter::resetTimeoutCheck):
-        (JSC::Interpreter::checkTimeout):
-        (JSC::Interpreter::createExceptionScope):
-        (JSC::Interpreter::tryCachePutByID):
-        (JSC::Interpreter::uncachePutByID):
-        (JSC::Interpreter::tryCacheGetByID):
-        (JSC::Interpreter::uncacheGetByID):
-        (JSC::Interpreter::privateExecute):
-        (JSC::Interpreter::retrieveArguments):
-        (JSC::Interpreter::retrieveCaller):
-        (JSC::Interpreter::retrieveLastCaller):
-        (JSC::Interpreter::findFunctionCallFrame):
-        (JSC::Interpreter::tryCTICachePutByID):
-        (JSC::Interpreter::tryCTICacheGetByID):
-        (JSC::):
-        (JSC::Interpreter::cti_op_convert_this):
-        (JSC::Interpreter::cti_op_end):
-        (JSC::Interpreter::cti_op_add):
-        (JSC::Interpreter::cti_op_pre_inc):
-        (JSC::Interpreter::cti_timeout_check):
-        (JSC::Interpreter::cti_register_file_check):
-        (JSC::Interpreter::cti_op_loop_if_less):
-        (JSC::Interpreter::cti_op_loop_if_lesseq):
-        (JSC::Interpreter::cti_op_new_object):
-        (JSC::Interpreter::cti_op_put_by_id):
-        (JSC::Interpreter::cti_op_put_by_id_second):
-        (JSC::Interpreter::cti_op_put_by_id_generic):
-        (JSC::Interpreter::cti_op_put_by_id_fail):
-        (JSC::Interpreter::cti_op_get_by_id):
-        (JSC::Interpreter::cti_op_get_by_id_second):
-        (JSC::Interpreter::cti_op_get_by_id_generic):
-        (JSC::Interpreter::cti_op_get_by_id_fail):
-        (JSC::Interpreter::cti_op_instanceof):
-        (JSC::Interpreter::cti_op_del_by_id):
-        (JSC::Interpreter::cti_op_mul):
-        (JSC::Interpreter::cti_op_new_func):
-        (JSC::Interpreter::cti_op_call_JSFunction):
-        (JSC::Interpreter::cti_op_call_arityCheck):
-        (JSC::Interpreter::cti_vm_dontLazyLinkCall):
-        (JSC::Interpreter::cti_vm_lazyLinkCall):
-        (JSC::Interpreter::cti_op_push_activation):
-        (JSC::Interpreter::cti_op_call_NotJSFunction):
-        (JSC::Interpreter::cti_op_create_arguments):
-        (JSC::Interpreter::cti_op_create_arguments_no_params):
-        (JSC::Interpreter::cti_op_tear_off_activation):
-        (JSC::Interpreter::cti_op_tear_off_arguments):
-        (JSC::Interpreter::cti_op_profile_will_call):
-        (JSC::Interpreter::cti_op_profile_did_call):
-        (JSC::Interpreter::cti_op_ret_scopeChain):
-        (JSC::Interpreter::cti_op_new_array):
-        (JSC::Interpreter::cti_op_resolve):
-        (JSC::Interpreter::cti_op_construct_JSConstruct):
-        (JSC::Interpreter::cti_op_construct_NotJSConstruct):
-        (JSC::Interpreter::cti_op_get_by_val):
-        (JSC::Interpreter::cti_op_resolve_func):
-        (JSC::Interpreter::cti_op_sub):
-        (JSC::Interpreter::cti_op_put_by_val):
-        (JSC::Interpreter::cti_op_put_by_val_array):
-        (JSC::Interpreter::cti_op_lesseq):
-        (JSC::Interpreter::cti_op_loop_if_true):
-        (JSC::Interpreter::cti_op_negate):
-        (JSC::Interpreter::cti_op_resolve_base):
-        (JSC::Interpreter::cti_op_resolve_skip):
-        (JSC::Interpreter::cti_op_resolve_global):
-        (JSC::Interpreter::cti_op_div):
-        (JSC::Interpreter::cti_op_pre_dec):
-        (JSC::Interpreter::cti_op_jless):
-        (JSC::Interpreter::cti_op_not):
-        (JSC::Interpreter::cti_op_jtrue):
-        (JSC::Interpreter::cti_op_post_inc):
-        (JSC::Interpreter::cti_op_eq):
-        (JSC::Interpreter::cti_op_lshift):
-        (JSC::Interpreter::cti_op_bitand):
-        (JSC::Interpreter::cti_op_rshift):
-        (JSC::Interpreter::cti_op_bitnot):
-        (JSC::Interpreter::cti_op_resolve_with_base):
-        (JSC::Interpreter::cti_op_new_func_exp):
-        (JSC::Interpreter::cti_op_mod):
-        (JSC::Interpreter::cti_op_less):
-        (JSC::Interpreter::cti_op_neq):
-        (JSC::Interpreter::cti_op_post_dec):
-        (JSC::Interpreter::cti_op_urshift):
-        (JSC::Interpreter::cti_op_bitxor):
-        (JSC::Interpreter::cti_op_new_regexp):
-        (JSC::Interpreter::cti_op_bitor):
-        (JSC::Interpreter::cti_op_call_eval):
-        (JSC::Interpreter::cti_op_throw):
-        (JSC::Interpreter::cti_op_get_pnames):
-        (JSC::Interpreter::cti_op_next_pname):
-        (JSC::Interpreter::cti_op_push_scope):
-        (JSC::Interpreter::cti_op_pop_scope):
-        (JSC::Interpreter::cti_op_typeof):
-        (JSC::Interpreter::cti_op_is_undefined):
-        (JSC::Interpreter::cti_op_is_boolean):
-        (JSC::Interpreter::cti_op_is_number):
-        (JSC::Interpreter::cti_op_is_string):
-        (JSC::Interpreter::cti_op_is_object):
-        (JSC::Interpreter::cti_op_is_function):
-        (JSC::Interpreter::cti_op_stricteq):
-        (JSC::Interpreter::cti_op_nstricteq):
-        (JSC::Interpreter::cti_op_to_jsnumber):
-        (JSC::Interpreter::cti_op_in):
-        (JSC::Interpreter::cti_op_push_new_scope):
-        (JSC::Interpreter::cti_op_jmp_scopes):
-        (JSC::Interpreter::cti_op_put_by_index):
-        (JSC::Interpreter::cti_op_switch_imm):
-        (JSC::Interpreter::cti_op_switch_char):
-        (JSC::Interpreter::cti_op_switch_string):
-        (JSC::Interpreter::cti_op_del_by_val):
-        (JSC::Interpreter::cti_op_put_getter):
-        (JSC::Interpreter::cti_op_put_setter):
-        (JSC::Interpreter::cti_op_new_error):
-        (JSC::Interpreter::cti_op_debug):
-        (JSC::Interpreter::cti_vm_throw):
-        * VM/Machine.h:
-        * VM/Register.h:
-        * VM/SamplingTool.cpp:
-        (JSC::SamplingTool::dump):
-        * VM/SamplingTool.h:
-        (JSC::SamplingTool::SamplingTool):
-        * bytecompiler/CodeGenerator.cpp:
-        (JSC::BytecodeGenerator::generate):
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        * jsc.cpp:
-        (runWithScripts):
-        * masm/X86Assembler.h:
-        (JSC::AssemblerBuffer::executableCopy):
-        (JSC::X86Assembler::executableCopy):
-        * runtime/ExecState.h:
-        (JSC::ExecState::interpreter):
-        * runtime/JSCell.h:
-        * runtime/JSFunction.h:
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        * runtime/JSGlobalData.h:
-        * runtime/JSImmediate.h:
-        * runtime/JSString.h:
-        * runtime/JSValue.h:
-        * runtime/JSVariableObject.h:
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::RegExp):
-        (JSC::RegExp::~RegExp):
-        (JSC::RegExp::match):
-        * runtime/RegExp.h:
-        * wrec/CharacterClassConstructor.cpp:
-        * wrec/CharacterClassConstructor.h:
-        * wrec/WREC.cpp:
-        (JSC::WREC::compileRegExp):
-        * wrec/WREC.h:
-        (JSC::WREC::Generator::Generator):
-        (JSC::WREC::Parser::):
-        (JSC::WREC::Parser::Parser):
-        (JSC::WREC::Parser::parseAlternative):
-
-2008-11-16  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21810
-        Remove use of static C++ objects that are destroyed at exit time (destructors)
-
-        Conditionally have the DEFINE_STATIC_LOCAL workaround <rdar://problem/6354696> 
-        (Codegen issue with C++ static reference in gcc build 5465) based upon the compiler 
-        build versions. It will use the:
-        static T& = *new T;
-        style for all other compilers.
-
-        * wtf/StdLibExtras.h:
-
-2008-11-16  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22290
-        Remove cross-heap GC and MessagePort multi-threading support
-
-        It is broken (and may not be implementable at all), and no longer needed, as we
-        don't use MessagePorts for communication with workers any more.
+        Reviewed by George Staikos.
 
-        * JavaScriptCore.exp:
-        * runtime/Collector.cpp:
-        (JSC::Heap::collect):
-        * runtime/JSGlobalObject.cpp:
-        * runtime/JSGlobalObject.h:
-        Remove hooks for cross-heap GC.
+        https://bugs.webkit.org/show_bug.cgi?id=26543
+        Windows CE uses 'GetLastError' instead of 'errno.'
 
-2008-11-15  Sam Weinig  <sam@webkit.org>
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::grow):
 
-        Reviewed by Cameron Zwarich.
+2009-06-19  David Levin  <levin@chromium.org>
 
-        Cleanup jsc command line code a little.
+        Reviewed by NOBODY (Windows build fix).
 
-        * jsc.cpp:
-        (functionQuit):
-        (main): Use standard exit status macros
-        (cleanupGlobalData): Factor out cleanup code into this function.
-        (printUsageStatement): Use standard exit status macros.
+        Add export for Windows corresponding to OSX export done in r44844.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
 
-2008-11-15  Sam Weinig  <sam@webkit.org>
+2009-06-18  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by Cameron Zwarich.
+        Reviewed by Gavin "Viceroy of Venezuela" Barraclough.
 
-        Cleanup BytecodeGenerator constructors.
+        Bug 26532: Native functions do not correctly unlink from optimised callsites when they're collected
+        <https://bugs.webkit.org/show_bug.cgi?id=26532> <rdar://problem/6625385>
 
-        * bytecompiler/CodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        * bytecompiler/CodeGenerator.h:
-        * parser/Nodes.cpp:
-        (JSC::ProgramNode::generateBytecode):
+        We need to make sure that each native function instance correctly unlinks any references to it
+        when it is collected.  Allowing this to happen required a few changes:
+            * Every native function needs a codeblock to track the link information
+            * To have this codeblock, every function now also needs its own functionbodynode
+              so we no longer get to have a single shared instance.
+            * Identifying a host function is now done by looking for CodeBlock::codeType() == NativeCode
 
-2008-11-15  Darin Adler  <darin@apple.com>
-
-        Rubber stamped by Geoff Garen.
-
-        - do the long-planned StructureID -> Structure rename
-
-        * API/JSCallbackConstructor.cpp:
-        (JSC::JSCallbackConstructor::JSCallbackConstructor):
-        * API/JSCallbackConstructor.h:
-        (JSC::JSCallbackConstructor::createStructure):
-        * API/JSCallbackFunction.h:
-        (JSC::JSCallbackFunction::createStructure):
-        * API/JSCallbackObject.h:
-        (JSC::JSCallbackObject::createStructure):
-        * API/JSCallbackObjectFunctions.h:
-        (JSC::::JSCallbackObject):
-        * API/JSValueRef.cpp:
-        (JSValueIsInstanceOfConstructor):
-        * GNUmakefile.am:
         * JavaScriptCore.exp:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.scons:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * VM/CTI.cpp:
-        (JSC::CTI::compileBinaryArithOp):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileGetByIdSelf):
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        (JSC::CTI::privateCompilePutByIdReplace):
-        (JSC::transitionWillNeedStorageRealloc):
-        (JSC::CTI::privateCompilePutByIdTransition):
-        (JSC::CTI::patchGetByIdSelf):
-        (JSC::CTI::patchPutByIdReplace):
-        * VM/CTI.h:
-        (JSC::CTI::compileGetByIdSelf):
-        (JSC::CTI::compileGetByIdProto):
-        (JSC::CTI::compileGetByIdChain):
-        (JSC::CTI::compilePutByIdReplace):
-        (JSC::CTI::compilePutByIdTransition):
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::printStructure):
-        (JSC::CodeBlock::printStructures):
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::~CodeBlock):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+           Constructor for NativeCode CodeBlock
         (JSC::CodeBlock::derefStructures):
         (JSC::CodeBlock::refStructures):
-        * VM/CodeBlock.h:
-        * VM/Instruction.h:
-        (JSC::Instruction::Instruction):
-        (JSC::Instruction::):
-        * VM/Machine.cpp:
-        (JSC::jsTypeStringForValue):
-        (JSC::jsIsObjectType):
-        (JSC::BytecodeInterpreter::resolveGlobal):
-        (JSC::BytecodeInterpreter::BytecodeInterpreter):
-        (JSC::cachePrototypeChain):
-        (JSC::BytecodeInterpreter::tryCachePutByID):
-        (JSC::BytecodeInterpreter::uncachePutByID):
-        (JSC::BytecodeInterpreter::tryCacheGetByID):
-        (JSC::BytecodeInterpreter::uncacheGetByID):
-        (JSC::BytecodeInterpreter::privateExecute):
-        (JSC::BytecodeInterpreter::tryCTICachePutByID):
-        (JSC::BytecodeInterpreter::tryCTICacheGetByID):
-        (JSC::BytecodeInterpreter::cti_op_instanceof):
-        (JSC::BytecodeInterpreter::cti_op_construct_JSConstruct):
-        (JSC::BytecodeInterpreter::cti_op_resolve_global):
-        (JSC::BytecodeInterpreter::cti_op_is_undefined):
-        * runtime/Arguments.h:
-        (JSC::Arguments::createStructure):
-        * runtime/ArrayConstructor.cpp:
-        (JSC::ArrayConstructor::ArrayConstructor):
-        * runtime/ArrayConstructor.h:
-        * runtime/ArrayPrototype.cpp:
-        (JSC::ArrayPrototype::ArrayPrototype):
-        * runtime/ArrayPrototype.h:
-        * runtime/BatchedTransitionOptimizer.h:
-        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
-        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
-        * runtime/BooleanConstructor.cpp:
-        (JSC::BooleanConstructor::BooleanConstructor):
-        * runtime/BooleanConstructor.h:
-        * runtime/BooleanObject.cpp:
-        (JSC::BooleanObject::BooleanObject):
-        * runtime/BooleanObject.h:
-        * runtime/BooleanPrototype.cpp:
-        (JSC::BooleanPrototype::BooleanPrototype):
-        * runtime/BooleanPrototype.h:
-        * runtime/DateConstructor.cpp:
-        (JSC::DateConstructor::DateConstructor):
-        * runtime/DateConstructor.h:
-        * runtime/DateInstance.cpp:
-        (JSC::DateInstance::DateInstance):
-        * runtime/DateInstance.h:
-        * runtime/DatePrototype.cpp:
-        (JSC::DatePrototype::DatePrototype):
-        * runtime/DatePrototype.h:
-        (JSC::DatePrototype::createStructure):
-        * runtime/ErrorConstructor.cpp:
-        (JSC::ErrorConstructor::ErrorConstructor):
-        * runtime/ErrorConstructor.h:
-        * runtime/ErrorInstance.cpp:
-        (JSC::ErrorInstance::ErrorInstance):
-        * runtime/ErrorInstance.h:
-        * runtime/ErrorPrototype.cpp:
-        (JSC::ErrorPrototype::ErrorPrototype):
-        * runtime/ErrorPrototype.h:
-        * runtime/FunctionConstructor.cpp:
-        (JSC::FunctionConstructor::FunctionConstructor):
-        * runtime/FunctionConstructor.h:
-        * runtime/FunctionPrototype.cpp:
-        (JSC::FunctionPrototype::FunctionPrototype):
-        (JSC::FunctionPrototype::addFunctionProperties):
-        * runtime/FunctionPrototype.h:
-        (JSC::FunctionPrototype::createStructure):
-        * runtime/GlobalEvalFunction.cpp:
-        (JSC::GlobalEvalFunction::GlobalEvalFunction):
-        * runtime/GlobalEvalFunction.h:
-        * runtime/Identifier.h:
-        * runtime/InternalFunction.cpp:
-        (JSC::InternalFunction::InternalFunction):
-        * runtime/InternalFunction.h:
-        (JSC::InternalFunction::createStructure):
-        (JSC::InternalFunction::InternalFunction):
-        * runtime/JSActivation.cpp:
-        (JSC::JSActivation::JSActivation):
-        * runtime/JSActivation.h:
-        (JSC::JSActivation::createStructure):
-        * runtime/JSArray.cpp:
-        (JSC::JSArray::JSArray):
-        * runtime/JSArray.h:
-        (JSC::JSArray::createStructure):
-        * runtime/JSCell.h:
-        (JSC::JSCell::JSCell):
-        (JSC::JSCell::isObject):
-        (JSC::JSCell::isString):
-        (JSC::JSCell::structure):
-        (JSC::JSValue::needsThisConversion):
-        * runtime/JSFunction.cpp:
-        (JSC::JSFunction::construct):
-        * runtime/JSFunction.h:
-        (JSC::JSFunction::JSFunction):
-        (JSC::JSFunction::createStructure):
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        (JSC::JSGlobalData::createLeaked):
-        * runtime/JSGlobalData.h:
-        * runtime/JSGlobalObject.cpp:
-        (JSC::markIfNeeded):
-        (JSC::JSGlobalObject::reset):
-        * runtime/JSGlobalObject.h:
-        (JSC::JSGlobalObject::JSGlobalObject):
-        (JSC::JSGlobalObject::argumentsStructure):
-        (JSC::JSGlobalObject::arrayStructure):
-        (JSC::JSGlobalObject::booleanObjectStructure):
-        (JSC::JSGlobalObject::callbackConstructorStructure):
-        (JSC::JSGlobalObject::callbackFunctionStructure):
-        (JSC::JSGlobalObject::callbackObjectStructure):
-        (JSC::JSGlobalObject::dateStructure):
-        (JSC::JSGlobalObject::emptyObjectStructure):
-        (JSC::JSGlobalObject::errorStructure):
-        (JSC::JSGlobalObject::functionStructure):
-        (JSC::JSGlobalObject::numberObjectStructure):
-        (JSC::JSGlobalObject::prototypeFunctionStructure):
-        (JSC::JSGlobalObject::regExpMatchesArrayStructure):
-        (JSC::JSGlobalObject::regExpStructure):
-        (JSC::JSGlobalObject::stringObjectStructure):
-        (JSC::JSGlobalObject::createStructure):
-        (JSC::Structure::prototypeForLookup):
-        * runtime/JSNotAnObject.h:
-        (JSC::JSNotAnObject::createStructure):
-        * runtime/JSNumberCell.h:
-        (JSC::JSNumberCell::createStructure):
-        (JSC::JSNumberCell::JSNumberCell):
-        * runtime/JSObject.cpp:
-        (JSC::JSObject::mark):
-        (JSC::JSObject::put):
-        (JSC::JSObject::deleteProperty):
-        (JSC::JSObject::defineGetter):
-        (JSC::JSObject::defineSetter):
-        (JSC::JSObject::getPropertyAttributes):
-        (JSC::JSObject::getPropertyNames):
-        (JSC::JSObject::removeDirect):
-        (JSC::JSObject::createInheritorID):
-        * runtime/JSObject.h:
-        (JSC::JSObject::getDirect):
-        (JSC::JSObject::getDirectLocation):
-        (JSC::JSObject::hasCustomProperties):
-        (JSC::JSObject::hasGetterSetterProperties):
-        (JSC::JSObject::createStructure):
-        (JSC::JSObject::JSObject):
-        (JSC::JSObject::~JSObject):
-        (JSC::JSObject::prototype):
-        (JSC::JSObject::setPrototype):
-        (JSC::JSObject::setStructure):
-        (JSC::JSObject::inheritorID):
-        (JSC::JSObject::inlineGetOwnPropertySlot):
-        (JSC::JSObject::getOwnPropertySlotForWrite):
-        (JSC::JSCell::fastGetOwnPropertySlot):
-        (JSC::JSObject::putDirect):
-        (JSC::JSObject::putDirectWithoutTransition):
-        (JSC::JSObject::transitionTo):
-        * runtime/JSPropertyNameIterator.h:
-        (JSC::JSPropertyNameIterator::next):
-        * runtime/JSStaticScopeObject.h:
-        (JSC::JSStaticScopeObject::JSStaticScopeObject):
-        (JSC::JSStaticScopeObject::createStructure):
-        * runtime/JSString.h:
-        (JSC::JSString::JSString):
-        (JSC::JSString::createStructure):
-        * runtime/JSVariableObject.h:
-        (JSC::JSVariableObject::JSVariableObject):
-        * runtime/JSWrapperObject.h:
-        (JSC::JSWrapperObject::JSWrapperObject):
-        * runtime/MathObject.cpp:
-        (JSC::MathObject::MathObject):
-        * runtime/MathObject.h:
-        (JSC::MathObject::createStructure):
-        * runtime/NativeErrorConstructor.cpp:
-        (JSC::NativeErrorConstructor::NativeErrorConstructor):
-        * runtime/NativeErrorConstructor.h:
-        * runtime/NativeErrorPrototype.cpp:
-        (JSC::NativeErrorPrototype::NativeErrorPrototype):
-        * runtime/NativeErrorPrototype.h:
-        * runtime/NumberConstructor.cpp:
-        (JSC::NumberConstructor::NumberConstructor):
-        * runtime/NumberConstructor.h:
-        (JSC::NumberConstructor::createStructure):
-        * runtime/NumberObject.cpp:
-        (JSC::NumberObject::NumberObject):
-        * runtime/NumberObject.h:
-        * runtime/NumberPrototype.cpp:
-        (JSC::NumberPrototype::NumberPrototype):
-        * runtime/NumberPrototype.h:
-        * runtime/ObjectConstructor.cpp:
-        (JSC::ObjectConstructor::ObjectConstructor):
-        * runtime/ObjectConstructor.h:
-        * runtime/ObjectPrototype.cpp:
-        (JSC::ObjectPrototype::ObjectPrototype):
-        * runtime/ObjectPrototype.h:
-        * runtime/Operations.h:
-        (JSC::equalSlowCaseInline):
-        * runtime/PropertyNameArray.h:
-        (JSC::PropertyNameArrayData::setCachedStructure):
-        (JSC::PropertyNameArrayData::cachedStructure):
-        (JSC::PropertyNameArrayData::setCachedPrototypeChain):
-        (JSC::PropertyNameArrayData::cachedPrototypeChain):
-        (JSC::PropertyNameArrayData::PropertyNameArrayData):
-        * runtime/PrototypeFunction.cpp:
-        (JSC::PrototypeFunction::PrototypeFunction):
-        * runtime/PrototypeFunction.h:
-        * runtime/RegExpConstructor.cpp:
-        (JSC::RegExpConstructor::RegExpConstructor):
-        * runtime/RegExpConstructor.h:
-        (JSC::RegExpConstructor::createStructure):
-        * runtime/RegExpObject.cpp:
-        (JSC::RegExpObject::RegExpObject):
-        * runtime/RegExpObject.h:
-        (JSC::RegExpObject::createStructure):
-        * runtime/RegExpPrototype.cpp:
-        (JSC::RegExpPrototype::RegExpPrototype):
-        * runtime/RegExpPrototype.h:
-        * runtime/StringConstructor.cpp:
-        (JSC::StringConstructor::StringConstructor):
-        * runtime/StringConstructor.h:
-        * runtime/StringObject.cpp:
-        (JSC::StringObject::StringObject):
-        * runtime/StringObject.h:
-        (JSC::StringObject::createStructure):
-        * runtime/StringObjectThatMasqueradesAsUndefined.h:
-        (JSC::StringObjectThatMasqueradesAsUndefined::create):
-        (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
-        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
-        * runtime/StringPrototype.cpp:
-        (JSC::StringPrototype::StringPrototype):
-        * runtime/StringPrototype.h:
-        * runtime/Structure.cpp: Copied from JavaScriptCore/runtime/StructureID.cpp.
-        (JSC::Structure::dumpStatistics):
-        (JSC::Structure::Structure):
-        (JSC::Structure::~Structure):
-        (JSC::Structure::startIgnoringLeaks):
-        (JSC::Structure::stopIgnoringLeaks):
-        (JSC::Structure::materializePropertyMap):
-        (JSC::Structure::getEnumerablePropertyNames):
-        (JSC::Structure::clearEnumerationCache):
-        (JSC::Structure::growPropertyStorageCapacity):
-        (JSC::Structure::addPropertyTransitionToExistingStructure):
-        (JSC::Structure::addPropertyTransition):
-        (JSC::Structure::removePropertyTransition):
-        (JSC::Structure::changePrototypeTransition):
-        (JSC::Structure::getterSetterTransition):
-        (JSC::Structure::toDictionaryTransition):
-        (JSC::Structure::fromDictionaryTransition):
-        (JSC::Structure::addPropertyWithoutTransition):
-        (JSC::Structure::removePropertyWithoutTransition):
-        (JSC::Structure::createCachedPrototypeChain):
-        (JSC::Structure::checkConsistency):
-        (JSC::Structure::copyPropertyTable):
-        (JSC::Structure::get):
-        (JSC::Structure::put):
-        (JSC::Structure::remove):
-        (JSC::Structure::insertIntoPropertyMapHashTable):
-        (JSC::Structure::createPropertyMapHashTable):
-        (JSC::Structure::expandPropertyMapHashTable):
-        (JSC::Structure::rehashPropertyMapHashTable):
-        (JSC::Structure::getEnumerablePropertyNamesInternal):
-        * runtime/Structure.h: Copied from JavaScriptCore/runtime/StructureID.h.
-        (JSC::Structure::create):
-        (JSC::Structure::previousID):
-        (JSC::Structure::setCachedPrototypeChain):
-        (JSC::Structure::cachedPrototypeChain):
-        (JSC::Structure::):
-        (JSC::Structure::get):
-        * runtime/StructureChain.cpp: Copied from JavaScriptCore/runtime/StructureIDChain.cpp.
-        (JSC::StructureChain::StructureChain):
-        (JSC::structureChainsAreEqual):
-        * runtime/StructureChain.h: Copied from JavaScriptCore/runtime/StructureIDChain.h.
-        (JSC::StructureChain::create):
-        (JSC::StructureChain::head):
-        * runtime/StructureID.cpp: Removed.
-        * runtime/StructureID.h: Removed.
-        * runtime/StructureIDChain.cpp: Removed.
-        * runtime/StructureIDChain.h: Removed.
-        * runtime/StructureIDTransitionTable.h: Removed.
-        * runtime/StructureTransitionTable.h: Copied from JavaScriptCore/runtime/StructureIDTransitionTable.h.
-
-2008-11-15  Darin Adler  <darin@apple.com>
-
-        - fix non-WREC build
-
-        * runtime/RegExp.cpp: Put "using namespace WREC" inside #if ENABLE(WREC).
-
-2008-11-15  Kevin Ollivier  <kevino@theolliviers.com>
-
-        Reviewed by Timothy Hatcher.
-        
-        As ThreadingNone doesn't implement threads, isMainThread should return true,
-        not false.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=22285
-
-        * wtf/ThreadingNone.cpp:
-        (WTF::isMainThread):
-
-2008-11-15  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Moved all WREC-related code into WREC.cpp and put it in a WREC namespace.
-        Removed the WREC prefix from class names.
-
-        * VM/CTI.cpp:
-        * VM/CTI.h:
-        * VM/Machine.h:
-        (JSC::BytecodeInterpreter::assemblerBuffer):
-        * masm/X86Assembler.h:
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::RegExp):
-        * wrec/CharacterClassConstructor.cpp:
-        * wrec/CharacterClassConstructor.h:
-        * wrec/WREC.cpp:
-        (WREC::GenerateParenthesesNonGreedyFunctor::GenerateParenthesesNonGreedyFunctor):
-        (WREC::GeneratePatternCharacterFunctor::generateAtom):
-        (WREC::GeneratePatternCharacterFunctor::backtrack):
-        (WREC::GenerateCharacterClassFunctor::generateAtom):
-        (WREC::GenerateCharacterClassFunctor::backtrack):
-        (WREC::GenerateBackreferenceFunctor::generateAtom):
-        (WREC::GenerateBackreferenceFunctor::backtrack):
-        (WREC::GenerateParenthesesNonGreedyFunctor::generateAtom):
-        (WREC::GenerateParenthesesNonGreedyFunctor::backtrack):
-        (WREC::Generator::generateBacktrack1):
-        (WREC::Generator::generateBacktrackBackreference):
-        (WREC::Generator::generateBackreferenceQuantifier):
-        (WREC::Generator::generateNonGreedyQuantifier):
-        (WREC::Generator::generateGreedyQuantifier):
-        (WREC::Generator::generatePatternCharacter):
-        (WREC::Generator::generateCharacterClassInvertedRange):
-        (WREC::Generator::generateCharacterClassInverted):
-        (WREC::Generator::generateCharacterClass):
-        (WREC::Generator::generateParentheses):
-        (WREC::Generator::generateParenthesesNonGreedy):
-        (WREC::Generator::generateParenthesesResetTrampoline):
-        (WREC::Generator::generateAssertionBOL):
-        (WREC::Generator::generateAssertionEOL):
-        (WREC::Generator::generateAssertionWordBoundary):
-        (WREC::Generator::generateBackreference):
-        (WREC::Generator::generateDisjunction):
-        (WREC::Generator::terminateDisjunction):
-        (WREC::Parser::parseGreedyQuantifier):
-        (WREC::Parser::parseQuantifier):
-        (WREC::Parser::parsePatternCharacterQualifier):
-        (WREC::Parser::parseCharacterClassQuantifier):
-        (WREC::Parser::parseBackreferenceQuantifier):
-        (WREC::Parser::parseParentheses):
-        (WREC::Parser::parseCharacterClass):
-        (WREC::Parser::parseOctalEscape):
-        (WREC::Parser::parseEscape):
-        (WREC::Parser::parseTerm):
-        (WREC::Parser::parseDisjunction):
-        (WREC::compileRegExp):
-        * wrec/WREC.h:
-        (WREC::Generator::Generator):
-        (WREC::Parser::Parser):
-        (WREC::Parser::parseAlternative):
-
-2008-11-15  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Changed another case of "m_jit" to "m_assembler".
-
-        * VM/CTI.cpp:
-        * wrec/WREC.cpp:
-        * wrec/WREC.h:
-        (JSC::WRECGenerator::WRECGenerator):
-        (JSC::WRECParser::WRECParser):
-
-2008-11-15  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Renamed "jit" to "assembler" and, for brevity, replaced *jit.* with __
-        using a macro.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitGetVirtualRegister):
-        (JSC::CTI::emitPutCTIArgFromVirtualRegister):
-        (JSC::CTI::emitPutCTIArg):
-        (JSC::CTI::emitGetCTIArg):
-        (JSC::CTI::emitPutCTIArgConstant):
-        (JSC::CTI::emitPutCTIParam):
-        (JSC::CTI::emitGetCTIParam):
-        (JSC::CTI::emitPutToCallFrameHeader):
-        (JSC::CTI::emitGetFromCallFrameHeader):
-        (JSC::CTI::emitPutVirtualRegister):
-        (JSC::CTI::emitInitRegister):
-        (JSC::CTI::emitAllocateNumber):
-        (JSC::CTI::emitNakedCall):
-        (JSC::CTI::emitNakedFastCall):
-        (JSC::CTI::emitCTICall):
-        (JSC::CTI::emitJumpSlowCaseIfNotJSCell):
-        (JSC::CTI::linkSlowCaseIfNotJSCell):
-        (JSC::CTI::emitJumpSlowCaseIfNotImmNum):
-        (JSC::CTI::emitJumpSlowCaseIfNotImmNums):
-        (JSC::CTI::emitFastArithDeTagImmediate):
-        (JSC::CTI::emitFastArithDeTagImmediateJumpIfZero):
-        (JSC::CTI::emitFastArithReTagImmediate):
-        (JSC::CTI::emitFastArithPotentiallyReTagImmediate):
-        (JSC::CTI::emitFastArithImmToInt):
-        (JSC::CTI::emitFastArithIntToImmOrSlowCase):
-        (JSC::CTI::emitFastArithIntToImmNoCheck):
-        (JSC::CTI::emitArithIntToImmWithJump):
-        (JSC::CTI::emitTagAsBoolImmediate):
-        (JSC::CTI::CTI):
-        (JSC::CTI::compileOpCallInitializeCallFrame):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::compileOpStrictEq):
-        (JSC::CTI::emitSlowScriptCheck):
-        (JSC::CTI::putDoubleResultToJSNumberCellOrJSImmediate):
-        (JSC::CTI::compileBinaryArithOp):
-        (JSC::CTI::compileBinaryArithOpSlowCase):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileLinkPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        (JSC::CTI::privateCompileGetByIdSelf):
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        (JSC::CTI::privateCompilePutByIdReplace):
-        (JSC::CTI::privateCompilePutByIdTransition):
-        (JSC::CTI::privateCompileCTIMachineTrampolines):
-        (JSC::CTI::privateCompilePatchGetArrayLength):
-        (JSC::CTI::emitGetVariableObjectRegister):
-        (JSC::CTI::emitPutVariableObjectRegister):
-        (JSC::CTI::compileRegExp):
-        * VM/CTI.h:
-        * wrec/WREC.cpp:
-        (JSC::WRECGenerator::generateBacktrack1):
-        (JSC::WRECGenerator::generateBacktrackBackreference):
-        (JSC::WRECGenerator::generateBackreferenceQuantifier):
-        (JSC::WRECGenerator::generateNonGreedyQuantifier):
-        (JSC::WRECGenerator::generateGreedyQuantifier):
-        (JSC::WRECGenerator::generatePatternCharacter):
-        (JSC::WRECGenerator::generateCharacterClassInvertedRange):
-        (JSC::WRECGenerator::generateCharacterClassInverted):
-        (JSC::WRECGenerator::generateCharacterClass):
-        (JSC::WRECGenerator::generateParentheses):
-        (JSC::WRECGenerator::generateParenthesesNonGreedy):
-        (JSC::WRECGenerator::generateParenthesesResetTrampoline):
-        (JSC::WRECGenerator::generateAssertionBOL):
-        (JSC::WRECGenerator::generateAssertionEOL):
-        (JSC::WRECGenerator::generateAssertionWordBoundary):
-        (JSC::WRECGenerator::generateBackreference):
-        (JSC::WRECGenerator::generateDisjunction):
-        (JSC::WRECGenerator::terminateDisjunction):
-
-2008-11-15  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        Remove dead method declaration.
-
-        * bytecompiler/CodeGenerator.h:
-
-2008-11-15  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Renamed LabelID to Label, Label::isForwardLabel to Label::isForward.
-
-        * VM/LabelID.h:
-        (JSC::Label::Label):
-        (JSC::Label::isForward):
-        * bytecompiler/CodeGenerator.cpp:
-        (JSC::BytecodeGenerator::newLabel):
-        (JSC::BytecodeGenerator::emitLabel):
-        (JSC::BytecodeGenerator::emitJump):
-        (JSC::BytecodeGenerator::emitJumpIfTrue):
-        (JSC::BytecodeGenerator::emitJumpIfFalse):
-        (JSC::BytecodeGenerator::pushFinallyContext):
-        (JSC::BytecodeGenerator::emitComplexJumpScopes):
-        (JSC::BytecodeGenerator::emitJumpScopes):
-        (JSC::BytecodeGenerator::emitNextPropertyName):
-        (JSC::BytecodeGenerator::emitCatch):
-        (JSC::BytecodeGenerator::emitJumpSubroutine):
-        (JSC::prepareJumpTableForImmediateSwitch):
-        (JSC::prepareJumpTableForCharacterSwitch):
-        (JSC::prepareJumpTableForStringSwitch):
-        (JSC::BytecodeGenerator::endSwitch):
-        * bytecompiler/CodeGenerator.h:
-        * bytecompiler/LabelScope.h:
-        (JSC::LabelScope::LabelScope):
-        (JSC::LabelScope::breakTarget):
-        (JSC::LabelScope::continueTarget):
-        * parser/Nodes.cpp:
-        (JSC::LogicalOpNode::emitBytecode):
-        (JSC::ConditionalNode::emitBytecode):
-        (JSC::IfNode::emitBytecode):
-        (JSC::IfElseNode::emitBytecode):
-        (JSC::DoWhileNode::emitBytecode):
-        (JSC::WhileNode::emitBytecode):
-        (JSC::ForNode::emitBytecode):
-        (JSC::ForInNode::emitBytecode):
-        (JSC::ReturnNode::emitBytecode):
-        (JSC::CaseBlockNode::emitBytecodeForBlock):
-        (JSC::TryNode::emitBytecode):
-
-2008-11-15  Geoffrey Garen  <ggaren@apple.com>
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::handlerForBytecodeOffset):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset):
+        (JSC::CodeBlock::functionRegisterForBytecodeOffset):
+        (JSC::CodeBlock::hasGlobalResolveInstructionAtBytecodeOffset):
+        (JSC::CodeBlock::hasGlobalResolveInfoAtBytecodeOffset):
+        (JSC::CodeBlock::setJITCode):
+           Add assertions to ensure we don't try and use NativeCode CodeBlocks as
+           a normal codeblock.
 
-        Reviewed by Sam Weinig.
-        
-        Renamed JITCodeBuffer to AssemblerBuffer and renamed its data members
-        to be more like the rest of our buffer classes, with a size and a
-        capacity.
-        
-        Added an assert in the unchecked put case to match the test in the checked
-        put case.
-        
-        Changed a C-style cast to a C++-style cast.
-        
-        Renamed MAX_INSTRUCTION_SIZE to maxInstructionSize.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::CTI):
-        (JSC::CTI::compileRegExp):
-        * VM/Machine.cpp:
-        (JSC::BytecodeInterpreter::BytecodeInterpreter):
-        * VM/Machine.h:
-        (JSC::BytecodeInterpreter::assemblerBuffer):
-        * masm/X86Assembler.h:
-        (JSC::AssemblerBuffer::AssemblerBuffer):
-        (JSC::AssemblerBuffer::~AssemblerBuffer):
-        (JSC::AssemblerBuffer::ensureSpace):
-        (JSC::AssemblerBuffer::isAligned):
-        (JSC::AssemblerBuffer::putByteUnchecked):
-        (JSC::AssemblerBuffer::putByte):
-        (JSC::AssemblerBuffer::putShortUnchecked):
-        (JSC::AssemblerBuffer::putShort):
-        (JSC::AssemblerBuffer::putIntUnchecked):
-        (JSC::AssemblerBuffer::putInt):
-        (JSC::AssemblerBuffer::data):
-        (JSC::AssemblerBuffer::size):
-        (JSC::AssemblerBuffer::reset):
-        (JSC::AssemblerBuffer::copy):
-        (JSC::AssemblerBuffer::grow):
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::X86Assembler):
-        (JSC::X86Assembler::testl_i32r):
-        (JSC::X86Assembler::movl_mr):
-        (JSC::X86Assembler::movl_rm):
-        (JSC::X86Assembler::movl_i32m):
-        (JSC::X86Assembler::emitCall):
-        (JSC::X86Assembler::label):
-        (JSC::X86Assembler::emitUnlinkedJmp):
-        (JSC::X86Assembler::emitUnlinkedJne):
-        (JSC::X86Assembler::emitUnlinkedJe):
-        (JSC::X86Assembler::emitUnlinkedJl):
-        (JSC::X86Assembler::emitUnlinkedJb):
-        (JSC::X86Assembler::emitUnlinkedJle):
-        (JSC::X86Assembler::emitUnlinkedJbe):
-        (JSC::X86Assembler::emitUnlinkedJge):
-        (JSC::X86Assembler::emitUnlinkedJg):
-        (JSC::X86Assembler::emitUnlinkedJa):
-        (JSC::X86Assembler::emitUnlinkedJae):
-        (JSC::X86Assembler::emitUnlinkedJo):
-        (JSC::X86Assembler::emitUnlinkedJp):
-        (JSC::X86Assembler::emitUnlinkedJs):
-        (JSC::X86Assembler::link):
-        (JSC::X86Assembler::emitModRm_rr):
-        (JSC::X86Assembler::emitModRm_rm):
-        (JSC::X86Assembler::emitModRm_opr):
-
-2008-11-15  Geoffrey Garen  <ggaren@apple.com>
-
-        Suggested by Maciej Stachowiak.
-        
-        Reverted most "opcode" => "bytecode" renames. We use "bytecode" as a
-        mass noun to refer to a stream of instructions. Each instruction may be
-        an opcode or an operand.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitCTICall):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::compileBinaryArithOp):
-        (JSC::CTI::compileBinaryArithOpSlowCase):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::printStructureIDs):
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::derefStructureIDs):
-        (JSC::CodeBlock::refStructureIDs):
-        * VM/CodeBlock.h:
-        * VM/ExceptionHelpers.cpp:
-        (JSC::createNotAnObjectError):
-        * VM/Instruction.h:
-        (JSC::Instruction::Instruction):
-        (JSC::Instruction::):
-        * VM/Machine.cpp:
-        (JSC::BytecodeInterpreter::isOpcode):
-        (JSC::BytecodeInterpreter::throwException):
-        (JSC::BytecodeInterpreter::tryCachePutByID):
-        (JSC::BytecodeInterpreter::uncachePutByID):
-        (JSC::BytecodeInterpreter::tryCacheGetByID):
-        (JSC::BytecodeInterpreter::uncacheGetByID):
-        (JSC::BytecodeInterpreter::privateExecute):
-        (JSC::BytecodeInterpreter::tryCTICachePutByID):
-        (JSC::BytecodeInterpreter::tryCTICacheGetByID):
-        * VM/Machine.h:
-        (JSC::BytecodeInterpreter::getOpcode):
-        (JSC::BytecodeInterpreter::getOpcodeID):
-        (JSC::BytecodeInterpreter::isCallBytecode):
-        * VM/Opcode.cpp:
-        (JSC::):
-        (JSC::OpcodeStats::OpcodeStats):
-        (JSC::compareOpcodeIndices):
-        (JSC::compareOpcodePairIndices):
-        (JSC::OpcodeStats::~OpcodeStats):
-        (JSC::OpcodeStats::recordInstruction):
-        (JSC::OpcodeStats::resetLastInstruction):
-        * VM/Opcode.h:
+        * bytecode/CodeBlock.h:
         (JSC::):
-        (JSC::padOpcodeName):
-        * VM/SamplingTool.cpp:
-        (JSC::ScopeSampleRecord::sample):
-        (JSC::SamplingTool::run):
-        (JSC::compareOpcodeIndicesSampling):
-        (JSC::SamplingTool::dump):
-        * VM/SamplingTool.h:
-        (JSC::ScopeSampleRecord::ScopeSampleRecord):
-        (JSC::SamplingTool::SamplingTool):
-        * bytecompiler/CodeGenerator.cpp:
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        (JSC::BytecodeGenerator::emitLabel):
-        (JSC::BytecodeGenerator::emitOpcode):
-        (JSC::BytecodeGenerator::emitJump):
-        (JSC::BytecodeGenerator::emitJumpIfTrue):
-        (JSC::BytecodeGenerator::emitJumpIfFalse):
-        (JSC::BytecodeGenerator::emitMove):
-        (JSC::BytecodeGenerator::emitUnaryOp):
-        (JSC::BytecodeGenerator::emitPreInc):
-        (JSC::BytecodeGenerator::emitPreDec):
-        (JSC::BytecodeGenerator::emitPostInc):
-        (JSC::BytecodeGenerator::emitPostDec):
-        (JSC::BytecodeGenerator::emitBinaryOp):
-        (JSC::BytecodeGenerator::emitEqualityOp):
-        (JSC::BytecodeGenerator::emitUnexpectedLoad):
-        (JSC::BytecodeGenerator::emitInstanceOf):
-        (JSC::BytecodeGenerator::emitResolve):
-        (JSC::BytecodeGenerator::emitGetScopedVar):
-        (JSC::BytecodeGenerator::emitPutScopedVar):
-        (JSC::BytecodeGenerator::emitResolveBase):
-        (JSC::BytecodeGenerator::emitResolveWithBase):
-        (JSC::BytecodeGenerator::emitResolveFunction):
-        (JSC::BytecodeGenerator::emitGetById):
-        (JSC::BytecodeGenerator::emitPutById):
-        (JSC::BytecodeGenerator::emitPutGetter):
-        (JSC::BytecodeGenerator::emitPutSetter):
-        (JSC::BytecodeGenerator::emitDeleteById):
-        (JSC::BytecodeGenerator::emitGetByVal):
-        (JSC::BytecodeGenerator::emitPutByVal):
-        (JSC::BytecodeGenerator::emitDeleteByVal):
-        (JSC::BytecodeGenerator::emitPutByIndex):
-        (JSC::BytecodeGenerator::emitNewObject):
-        (JSC::BytecodeGenerator::emitNewArray):
-        (JSC::BytecodeGenerator::emitNewFunction):
-        (JSC::BytecodeGenerator::emitNewRegExp):
-        (JSC::BytecodeGenerator::emitNewFunctionExpression):
-        (JSC::BytecodeGenerator::emitCall):
-        (JSC::BytecodeGenerator::emitReturn):
-        (JSC::BytecodeGenerator::emitUnaryNoDstOp):
-        (JSC::BytecodeGenerator::emitConstruct):
-        (JSC::BytecodeGenerator::emitPopScope):
-        (JSC::BytecodeGenerator::emitDebugHook):
-        (JSC::BytecodeGenerator::emitComplexJumpScopes):
-        (JSC::BytecodeGenerator::emitJumpScopes):
-        (JSC::BytecodeGenerator::emitNextPropertyName):
-        (JSC::BytecodeGenerator::emitCatch):
-        (JSC::BytecodeGenerator::emitNewError):
-        (JSC::BytecodeGenerator::emitJumpSubroutine):
-        (JSC::BytecodeGenerator::emitSubroutineReturn):
-        (JSC::BytecodeGenerator::emitPushNewScope):
-        (JSC::BytecodeGenerator::beginSwitch):
-        * bytecompiler/CodeGenerator.h:
-        * jsc.cpp:
-        (runWithScripts):
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::emitModRm_opr):
-        (JSC::X86Assembler::emitModRm_opr_Unchecked):
-        (JSC::X86Assembler::emitModRm_opm):
-        (JSC::X86Assembler::emitModRm_opm_Unchecked):
-        (JSC::X86Assembler::emitModRm_opmsib):
-        * parser/Nodes.cpp:
-        (JSC::UnaryOpNode::emitBytecode):
-        (JSC::BinaryOpNode::emitBytecode):
-        (JSC::ReverseBinaryOpNode::emitBytecode):
-        (JSC::ThrowableBinaryOpNode::emitBytecode):
-        (JSC::emitReadModifyAssignment):
-        (JSC::ScopeNode::ScopeNode):
-        * parser/Nodes.h:
-        (JSC::UnaryPlusNode::):
-        (JSC::NegateNode::):
-        (JSC::BitwiseNotNode::):
-        (JSC::LogicalNotNode::):
-        (JSC::MultNode::):
-        (JSC::DivNode::):
-        (JSC::ModNode::):
-        (JSC::AddNode::):
-        (JSC::SubNode::):
-        (JSC::LeftShiftNode::):
-        (JSC::RightShiftNode::):
-        (JSC::UnsignedRightShiftNode::):
-        (JSC::LessNode::):
-        (JSC::GreaterNode::):
-        (JSC::LessEqNode::):
-        (JSC::GreaterEqNode::):
-        (JSC::InstanceOfNode::):
-        (JSC::InNode::):
-        (JSC::EqualNode::):
-        (JSC::NotEqualNode::):
-        (JSC::StrictEqualNode::):
-        (JSC::NotStrictEqualNode::):
-        (JSC::BitAndNode::):
-        (JSC::BitOrNode::):
-        (JSC::BitXOrNode::):
-        * runtime/StructureID.cpp:
-        (JSC::StructureID::fromDictionaryTransition):
-        * wtf/Platform.h:
-
-2008-11-15  Geoffrey Garen  <ggaren@apple.com>
+        (JSC::CodeBlock::source):
+        (JSC::CodeBlock::sourceOffset):
+        (JSC::CodeBlock::evalCodeCache):
+        (JSC::CodeBlock::createRareDataIfNecessary):
+          More assertions.
 
-        Reviewed by Sam Weinig.
-        
-        Renames:
-        
-        CodeGenerator => BytecodeGenerator
-        emitCodeForBlock => emitBytecodeForBlock
-        generatedByteCode => generatedBytecode
-        generateCode => generateBytecode
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::linkCall):
+          Update logic to allow native function caching
 
-        * JavaScriptCore.exp:
-        * bytecompiler/CodeGenerator.cpp:
-        (JSC::BytecodeGenerator::setDumpsGeneratedCode):
-        (JSC::BytecodeGenerator::generate):
-        (JSC::BytecodeGenerator::addVar):
-        (JSC::BytecodeGenerator::addGlobalVar):
-        (JSC::BytecodeGenerator::allocateConstants):
-        (JSC::BytecodeGenerator::BytecodeGenerator):
-        (JSC::BytecodeGenerator::addParameter):
-        (JSC::BytecodeGenerator::registerFor):
-        (JSC::BytecodeGenerator::constRegisterFor):
-        (JSC::BytecodeGenerator::isLocal):
-        (JSC::BytecodeGenerator::isLocalConstant):
-        (JSC::BytecodeGenerator::newRegister):
-        (JSC::BytecodeGenerator::newTemporary):
-        (JSC::BytecodeGenerator::highestUsedRegister):
-        (JSC::BytecodeGenerator::newLabelScope):
-        (JSC::BytecodeGenerator::newLabel):
-        (JSC::BytecodeGenerator::emitLabel):
-        (JSC::BytecodeGenerator::emitBytecode):
-        (JSC::BytecodeGenerator::retrieveLastBinaryOp):
-        (JSC::BytecodeGenerator::retrieveLastUnaryOp):
-        (JSC::BytecodeGenerator::rewindBinaryOp):
-        (JSC::BytecodeGenerator::rewindUnaryOp):
-        (JSC::BytecodeGenerator::emitJump):
-        (JSC::BytecodeGenerator::emitJumpIfTrue):
-        (JSC::BytecodeGenerator::emitJumpIfFalse):
-        (JSC::BytecodeGenerator::addConstant):
-        (JSC::BytecodeGenerator::addUnexpectedConstant):
-        (JSC::BytecodeGenerator::addRegExp):
-        (JSC::BytecodeGenerator::emitMove):
-        (JSC::BytecodeGenerator::emitUnaryOp):
-        (JSC::BytecodeGenerator::emitPreInc):
-        (JSC::BytecodeGenerator::emitPreDec):
-        (JSC::BytecodeGenerator::emitPostInc):
-        (JSC::BytecodeGenerator::emitPostDec):
-        (JSC::BytecodeGenerator::emitBinaryOp):
-        (JSC::BytecodeGenerator::emitEqualityOp):
-        (JSC::BytecodeGenerator::emitLoad):
-        (JSC::BytecodeGenerator::emitUnexpectedLoad):
-        (JSC::BytecodeGenerator::findScopedProperty):
-        (JSC::BytecodeGenerator::emitInstanceOf):
-        (JSC::BytecodeGenerator::emitResolve):
-        (JSC::BytecodeGenerator::emitGetScopedVar):
-        (JSC::BytecodeGenerator::emitPutScopedVar):
-        (JSC::BytecodeGenerator::emitResolveBase):
-        (JSC::BytecodeGenerator::emitResolveWithBase):
-        (JSC::BytecodeGenerator::emitResolveFunction):
-        (JSC::BytecodeGenerator::emitGetById):
-        (JSC::BytecodeGenerator::emitPutById):
-        (JSC::BytecodeGenerator::emitPutGetter):
-        (JSC::BytecodeGenerator::emitPutSetter):
-        (JSC::BytecodeGenerator::emitDeleteById):
-        (JSC::BytecodeGenerator::emitGetByVal):
-        (JSC::BytecodeGenerator::emitPutByVal):
-        (JSC::BytecodeGenerator::emitDeleteByVal):
-        (JSC::BytecodeGenerator::emitPutByIndex):
-        (JSC::BytecodeGenerator::emitNewObject):
-        (JSC::BytecodeGenerator::emitNewArray):
-        (JSC::BytecodeGenerator::emitNewFunction):
-        (JSC::BytecodeGenerator::emitNewRegExp):
-        (JSC::BytecodeGenerator::emitNewFunctionExpression):
-        (JSC::BytecodeGenerator::emitCall):
-        (JSC::BytecodeGenerator::emitCallEval):
-        (JSC::BytecodeGenerator::emitReturn):
-        (JSC::BytecodeGenerator::emitUnaryNoDstOp):
-        (JSC::BytecodeGenerator::emitConstruct):
-        (JSC::BytecodeGenerator::emitPushScope):
-        (JSC::BytecodeGenerator::emitPopScope):
-        (JSC::BytecodeGenerator::emitDebugHook):
-        (JSC::BytecodeGenerator::pushFinallyContext):
-        (JSC::BytecodeGenerator::popFinallyContext):
-        (JSC::BytecodeGenerator::breakTarget):
-        (JSC::BytecodeGenerator::continueTarget):
-        (JSC::BytecodeGenerator::emitComplexJumpScopes):
-        (JSC::BytecodeGenerator::emitJumpScopes):
-        (JSC::BytecodeGenerator::emitNextPropertyName):
-        (JSC::BytecodeGenerator::emitCatch):
-        (JSC::BytecodeGenerator::emitNewError):
-        (JSC::BytecodeGenerator::emitJumpSubroutine):
-        (JSC::BytecodeGenerator::emitSubroutineReturn):
-        (JSC::BytecodeGenerator::emitPushNewScope):
-        (JSC::BytecodeGenerator::beginSwitch):
-        (JSC::BytecodeGenerator::endSwitch):
-        (JSC::BytecodeGenerator::emitThrowExpressionTooDeepException):
-        * bytecompiler/CodeGenerator.h:
-        * jsc.cpp:
-        (runWithScripts):
+        * jit/JITStubs.cpp:
         * parser/Nodes.cpp:
-        (JSC::ThrowableExpressionData::emitThrowError):
-        (JSC::NullNode::emitBytecode):
-        (JSC::BooleanNode::emitBytecode):
-        (JSC::NumberNode::emitBytecode):
-        (JSC::StringNode::emitBytecode):
-        (JSC::RegExpNode::emitBytecode):
-        (JSC::ThisNode::emitBytecode):
-        (JSC::ResolveNode::isPure):
-        (JSC::ResolveNode::emitBytecode):
-        (JSC::ArrayNode::emitBytecode):
-        (JSC::ObjectLiteralNode::emitBytecode):
-        (JSC::PropertyListNode::emitBytecode):
-        (JSC::BracketAccessorNode::emitBytecode):
-        (JSC::DotAccessorNode::emitBytecode):
-        (JSC::ArgumentListNode::emitBytecode):
-        (JSC::NewExprNode::emitBytecode):
-        (JSC::EvalFunctionCallNode::emitBytecode):
-        (JSC::FunctionCallValueNode::emitBytecode):
-        (JSC::FunctionCallResolveNode::emitBytecode):
-        (JSC::FunctionCallBracketNode::emitBytecode):
-        (JSC::FunctionCallDotNode::emitBytecode):
-        (JSC::emitPreIncOrDec):
-        (JSC::emitPostIncOrDec):
-        (JSC::PostfixResolveNode::emitBytecode):
-        (JSC::PostfixBracketNode::emitBytecode):
-        (JSC::PostfixDotNode::emitBytecode):
-        (JSC::PostfixErrorNode::emitBytecode):
-        (JSC::DeleteResolveNode::emitBytecode):
-        (JSC::DeleteBracketNode::emitBytecode):
-        (JSC::DeleteDotNode::emitBytecode):
-        (JSC::DeleteValueNode::emitBytecode):
-        (JSC::VoidNode::emitBytecode):
-        (JSC::TypeOfResolveNode::emitBytecode):
-        (JSC::TypeOfValueNode::emitBytecode):
-        (JSC::PrefixResolveNode::emitBytecode):
-        (JSC::PrefixBracketNode::emitBytecode):
-        (JSC::PrefixDotNode::emitBytecode):
-        (JSC::PrefixErrorNode::emitBytecode):
-        (JSC::UnaryOpNode::emitBytecode):
-        (JSC::BinaryOpNode::emitBytecode):
-        (JSC::EqualNode::emitBytecode):
-        (JSC::StrictEqualNode::emitBytecode):
-        (JSC::ReverseBinaryOpNode::emitBytecode):
-        (JSC::ThrowableBinaryOpNode::emitBytecode):
-        (JSC::InstanceOfNode::emitBytecode):
-        (JSC::LogicalOpNode::emitBytecode):
-        (JSC::ConditionalNode::emitBytecode):
-        (JSC::emitReadModifyAssignment):
-        (JSC::ReadModifyResolveNode::emitBytecode):
-        (JSC::AssignResolveNode::emitBytecode):
-        (JSC::AssignDotNode::emitBytecode):
-        (JSC::ReadModifyDotNode::emitBytecode):
-        (JSC::AssignErrorNode::emitBytecode):
-        (JSC::AssignBracketNode::emitBytecode):
-        (JSC::ReadModifyBracketNode::emitBytecode):
-        (JSC::CommaNode::emitBytecode):
-        (JSC::ConstDeclNode::emitCodeSingle):
-        (JSC::ConstDeclNode::emitBytecode):
-        (JSC::ConstStatementNode::emitBytecode):
-        (JSC::statementListEmitCode):
-        (JSC::BlockNode::emitBytecode):
-        (JSC::EmptyStatementNode::emitBytecode):
-        (JSC::DebuggerStatementNode::emitBytecode):
-        (JSC::ExprStatementNode::emitBytecode):
-        (JSC::VarStatementNode::emitBytecode):
-        (JSC::IfNode::emitBytecode):
-        (JSC::IfElseNode::emitBytecode):
-        (JSC::DoWhileNode::emitBytecode):
-        (JSC::WhileNode::emitBytecode):
-        (JSC::ForNode::emitBytecode):
-        (JSC::ForInNode::emitBytecode):
-        (JSC::ContinueNode::emitBytecode):
-        (JSC::BreakNode::emitBytecode):
-        (JSC::ReturnNode::emitBytecode):
-        (JSC::WithNode::emitBytecode):
-        (JSC::CaseBlockNode::emitBytecodeForBlock):
-        (JSC::SwitchNode::emitBytecode):
-        (JSC::LabelNode::emitBytecode):
-        (JSC::ThrowNode::emitBytecode):
-        (JSC::TryNode::emitBytecode):
-        (JSC::EvalNode::emitBytecode):
-        (JSC::EvalNode::generateBytecode):
-        (JSC::FunctionBodyNode::generateBytecode):
-        (JSC::FunctionBodyNode::emitBytecode):
-        (JSC::ProgramNode::emitBytecode):
-        (JSC::ProgramNode::generateBytecode):
-        (JSC::FuncDeclNode::emitBytecode):
-        (JSC::FuncExprNode::emitBytecode):
+        (JSC::FunctionBodyNode::createNativeThunk):
+        (JSC::FunctionBodyNode::isHostFunction):
         * parser/Nodes.h:
-        (JSC::ExpressionNode::):
-        (JSC::BooleanNode::):
-        (JSC::NumberNode::):
-        (JSC::StringNode::):
-        (JSC::ProgramNode::):
-        (JSC::EvalNode::):
-        (JSC::FunctionBodyNode::):
-        * runtime/Arguments.h:
-        (JSC::Arguments::getArgumentsData):
-        (JSC::JSActivation::copyRegisters):
-        * runtime/JSActivation.cpp:
-        (JSC::JSActivation::mark):
-        * runtime/JSActivation.h:
-        (JSC::JSActivation::JSActivationData::JSActivationData):
         * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
         (JSC::JSFunction::~JSFunction):
-
-2008-11-15  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Renamed all forms of "byte code" "opcode" "op code" "code" "bitcode"
-        etc. to "bytecode".
-
-        * VM/CTI.cpp:
-        (JSC::CTI::printBytecodeOperandTypes):
-        (JSC::CTI::emitAllocateNumber):
-        (JSC::CTI::emitNakedCall):
-        (JSC::CTI::emitNakedFastCall):
-        (JSC::CTI::emitCTICall):
-        (JSC::CTI::emitJumpSlowCaseIfNotJSCell):
-        (JSC::CTI::emitJumpSlowCaseIfNotImmNum):
-        (JSC::CTI::emitJumpSlowCaseIfNotImmNums):
-        (JSC::CTI::emitFastArithIntToImmOrSlowCase):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::emitSlowScriptCheck):
-        (JSC::CTI::compileBinaryArithOp):
-        (JSC::CTI::compileBinaryArithOpSlowCase):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        * VM/CTI.h:
-        (JSC::CallRecord::CallRecord):
-        (JSC::SwitchRecord::SwitchRecord):
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::printStructureIDs):
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::~CodeBlock):
-        (JSC::CodeBlock::derefStructureIDs):
-        (JSC::CodeBlock::refStructureIDs):
-        * VM/CodeBlock.h:
-        (JSC::StructureStubInfo::StructureStubInfo):
-        * VM/ExceptionHelpers.cpp:
-        (JSC::createNotAnObjectError):
-        * VM/Instruction.h:
-        (JSC::Instruction::Instruction):
-        (JSC::Instruction::):
-        * VM/Machine.cpp:
-        (JSC::BytecodeInterpreter::isBytecode):
-        (JSC::BytecodeInterpreter::throwException):
-        (JSC::BytecodeInterpreter::execute):
-        (JSC::BytecodeInterpreter::tryCachePutByID):
-        (JSC::BytecodeInterpreter::uncachePutByID):
-        (JSC::BytecodeInterpreter::tryCacheGetByID):
-        (JSC::BytecodeInterpreter::uncacheGetByID):
-        (JSC::BytecodeInterpreter::privateExecute):
-        (JSC::BytecodeInterpreter::tryCTICachePutByID):
-        (JSC::BytecodeInterpreter::tryCTICacheGetByID):
-        (JSC::BytecodeInterpreter::cti_op_call_JSFunction):
-        (JSC::BytecodeInterpreter::cti_vm_dontLazyLinkCall):
-        (JSC::BytecodeInterpreter::cti_vm_lazyLinkCall):
-        * VM/Machine.h:
-        (JSC::BytecodeInterpreter::getBytecode):
-        (JSC::BytecodeInterpreter::getBytecodeID):
-        (JSC::BytecodeInterpreter::isCallBytecode):
-        * VM/Opcode.cpp:
-        (JSC::):
-        (JSC::BytecodeStats::BytecodeStats):
-        (JSC::compareBytecodeIndices):
-        (JSC::compareBytecodePairIndices):
-        (JSC::BytecodeStats::~BytecodeStats):
-        (JSC::BytecodeStats::recordInstruction):
-        (JSC::BytecodeStats::resetLastInstruction):
-        * VM/Opcode.h:
-        (JSC::):
-        (JSC::padBytecodeName):
-        * VM/SamplingTool.cpp:
-        (JSC::ScopeSampleRecord::sample):
-        (JSC::SamplingTool::run):
-        (JSC::compareBytecodeIndicesSampling):
-        (JSC::SamplingTool::dump):
-        * VM/SamplingTool.h:
-        (JSC::ScopeSampleRecord::ScopeSampleRecord):
-        (JSC::SamplingTool::SamplingTool):
-        * bytecompiler/CodeGenerator.cpp:
-        (JSC::CodeGenerator::generate):
-        (JSC::CodeGenerator::CodeGenerator):
-        (JSC::CodeGenerator::emitLabel):
-        (JSC::CodeGenerator::emitBytecode):
-        (JSC::CodeGenerator::emitJump):
-        (JSC::CodeGenerator::emitJumpIfTrue):
-        (JSC::CodeGenerator::emitJumpIfFalse):
-        (JSC::CodeGenerator::emitMove):
-        (JSC::CodeGenerator::emitUnaryOp):
-        (JSC::CodeGenerator::emitPreInc):
-        (JSC::CodeGenerator::emitPreDec):
-        (JSC::CodeGenerator::emitPostInc):
-        (JSC::CodeGenerator::emitPostDec):
-        (JSC::CodeGenerator::emitBinaryOp):
-        (JSC::CodeGenerator::emitEqualityOp):
-        (JSC::CodeGenerator::emitUnexpectedLoad):
-        (JSC::CodeGenerator::emitInstanceOf):
-        (JSC::CodeGenerator::emitResolve):
-        (JSC::CodeGenerator::emitGetScopedVar):
-        (JSC::CodeGenerator::emitPutScopedVar):
-        (JSC::CodeGenerator::emitResolveBase):
-        (JSC::CodeGenerator::emitResolveWithBase):
-        (JSC::CodeGenerator::emitResolveFunction):
-        (JSC::CodeGenerator::emitGetById):
-        (JSC::CodeGenerator::emitPutById):
-        (JSC::CodeGenerator::emitPutGetter):
-        (JSC::CodeGenerator::emitPutSetter):
-        (JSC::CodeGenerator::emitDeleteById):
-        (JSC::CodeGenerator::emitGetByVal):
-        (JSC::CodeGenerator::emitPutByVal):
-        (JSC::CodeGenerator::emitDeleteByVal):
-        (JSC::CodeGenerator::emitPutByIndex):
-        (JSC::CodeGenerator::emitNewObject):
-        (JSC::CodeGenerator::emitNewArray):
-        (JSC::CodeGenerator::emitNewFunction):
-        (JSC::CodeGenerator::emitNewRegExp):
-        (JSC::CodeGenerator::emitNewFunctionExpression):
-        (JSC::CodeGenerator::emitCall):
-        (JSC::CodeGenerator::emitReturn):
-        (JSC::CodeGenerator::emitUnaryNoDstOp):
-        (JSC::CodeGenerator::emitConstruct):
-        (JSC::CodeGenerator::emitPopScope):
-        (JSC::CodeGenerator::emitDebugHook):
-        (JSC::CodeGenerator::emitComplexJumpScopes):
-        (JSC::CodeGenerator::emitJumpScopes):
-        (JSC::CodeGenerator::emitNextPropertyName):
-        (JSC::CodeGenerator::emitCatch):
-        (JSC::CodeGenerator::emitNewError):
-        (JSC::CodeGenerator::emitJumpSubroutine):
-        (JSC::CodeGenerator::emitSubroutineReturn):
-        (JSC::CodeGenerator::emitPushNewScope):
-        (JSC::CodeGenerator::beginSwitch):
-        (JSC::CodeGenerator::endSwitch):
-        * bytecompiler/CodeGenerator.h:
-        (JSC::CodeGenerator::emitNode):
-        * jsc.cpp:
-        (runWithScripts):
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::emitModRm_opr):
-        (JSC::X86Assembler::emitModRm_opr_Unchecked):
-        (JSC::X86Assembler::emitModRm_opm):
-        (JSC::X86Assembler::emitModRm_opm_Unchecked):
-        (JSC::X86Assembler::emitModRm_opmsib):
-        * parser/Nodes.cpp:
-        (JSC::NullNode::emitBytecode):
-        (JSC::BooleanNode::emitBytecode):
-        (JSC::NumberNode::emitBytecode):
-        (JSC::StringNode::emitBytecode):
-        (JSC::RegExpNode::emitBytecode):
-        (JSC::ThisNode::emitBytecode):
-        (JSC::ResolveNode::emitBytecode):
-        (JSC::ArrayNode::emitBytecode):
-        (JSC::ObjectLiteralNode::emitBytecode):
-        (JSC::PropertyListNode::emitBytecode):
-        (JSC::BracketAccessorNode::emitBytecode):
-        (JSC::DotAccessorNode::emitBytecode):
-        (JSC::ArgumentListNode::emitBytecode):
-        (JSC::NewExprNode::emitBytecode):
-        (JSC::EvalFunctionCallNode::emitBytecode):
-        (JSC::FunctionCallValueNode::emitBytecode):
-        (JSC::FunctionCallResolveNode::emitBytecode):
-        (JSC::FunctionCallBracketNode::emitBytecode):
-        (JSC::FunctionCallDotNode::emitBytecode):
-        (JSC::PostfixResolveNode::emitBytecode):
-        (JSC::PostfixBracketNode::emitBytecode):
-        (JSC::PostfixDotNode::emitBytecode):
-        (JSC::PostfixErrorNode::emitBytecode):
-        (JSC::DeleteResolveNode::emitBytecode):
-        (JSC::DeleteBracketNode::emitBytecode):
-        (JSC::DeleteDotNode::emitBytecode):
-        (JSC::DeleteValueNode::emitBytecode):
-        (JSC::VoidNode::emitBytecode):
-        (JSC::TypeOfResolveNode::emitBytecode):
-        (JSC::TypeOfValueNode::emitBytecode):
-        (JSC::PrefixResolveNode::emitBytecode):
-        (JSC::PrefixBracketNode::emitBytecode):
-        (JSC::PrefixDotNode::emitBytecode):
-        (JSC::PrefixErrorNode::emitBytecode):
-        (JSC::UnaryOpNode::emitBytecode):
-        (JSC::BinaryOpNode::emitBytecode):
-        (JSC::EqualNode::emitBytecode):
-        (JSC::StrictEqualNode::emitBytecode):
-        (JSC::ReverseBinaryOpNode::emitBytecode):
-        (JSC::ThrowableBinaryOpNode::emitBytecode):
-        (JSC::InstanceOfNode::emitBytecode):
-        (JSC::LogicalOpNode::emitBytecode):
-        (JSC::ConditionalNode::emitBytecode):
-        (JSC::emitReadModifyAssignment):
-        (JSC::ReadModifyResolveNode::emitBytecode):
-        (JSC::AssignResolveNode::emitBytecode):
-        (JSC::AssignDotNode::emitBytecode):
-        (JSC::ReadModifyDotNode::emitBytecode):
-        (JSC::AssignErrorNode::emitBytecode):
-        (JSC::AssignBracketNode::emitBytecode):
-        (JSC::ReadModifyBracketNode::emitBytecode):
-        (JSC::CommaNode::emitBytecode):
-        (JSC::ConstDeclNode::emitBytecode):
-        (JSC::ConstStatementNode::emitBytecode):
-        (JSC::BlockNode::emitBytecode):
-        (JSC::EmptyStatementNode::emitBytecode):
-        (JSC::DebuggerStatementNode::emitBytecode):
-        (JSC::ExprStatementNode::emitBytecode):
-        (JSC::VarStatementNode::emitBytecode):
-        (JSC::IfNode::emitBytecode):
-        (JSC::IfElseNode::emitBytecode):
-        (JSC::DoWhileNode::emitBytecode):
-        (JSC::WhileNode::emitBytecode):
-        (JSC::ForNode::emitBytecode):
-        (JSC::ForInNode::emitBytecode):
-        (JSC::ContinueNode::emitBytecode):
-        (JSC::BreakNode::emitBytecode):
-        (JSC::ReturnNode::emitBytecode):
-        (JSC::WithNode::emitBytecode):
-        (JSC::SwitchNode::emitBytecode):
-        (JSC::LabelNode::emitBytecode):
-        (JSC::ThrowNode::emitBytecode):
-        (JSC::TryNode::emitBytecode):
-        (JSC::ScopeNode::ScopeNode):
-        (JSC::EvalNode::emitBytecode):
-        (JSC::FunctionBodyNode::emitBytecode):
-        (JSC::ProgramNode::emitBytecode):
-        (JSC::FuncDeclNode::emitBytecode):
-        (JSC::FuncExprNode::emitBytecode):
-        * parser/Nodes.h:
-        (JSC::UnaryPlusNode::):
-        (JSC::NegateNode::):
-        (JSC::BitwiseNotNode::):
-        (JSC::LogicalNotNode::):
-        (JSC::MultNode::):
-        (JSC::DivNode::):
-        (JSC::ModNode::):
-        (JSC::AddNode::):
-        (JSC::SubNode::):
-        (JSC::LeftShiftNode::):
-        (JSC::RightShiftNode::):
-        (JSC::UnsignedRightShiftNode::):
-        (JSC::LessNode::):
-        (JSC::GreaterNode::):
-        (JSC::LessEqNode::):
-        (JSC::GreaterEqNode::):
-        (JSC::InstanceOfNode::):
-        (JSC::InNode::):
-        (JSC::EqualNode::):
-        (JSC::NotEqualNode::):
-        (JSC::StrictEqualNode::):
-        (JSC::NotStrictEqualNode::):
-        (JSC::BitAndNode::):
-        (JSC::BitOrNode::):
-        (JSC::BitXOrNode::):
-        (JSC::ProgramNode::):
-        (JSC::EvalNode::):
-        (JSC::FunctionBodyNode::):
-        * runtime/JSNotAnObject.h:
-        * runtime/StructureID.cpp:
-        (JSC::StructureID::fromDictionaryTransition):
-        * wtf/Platform.h:
-
-2008-11-15  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Renamed Machine to BytecodeInterpreter.
-        
-        Nixed the Interpreter class, and changed its two functions to stand-alone
-        functions.
-
-        * JavaScriptCore.exp:
-        * VM/CTI.cpp:
-        (JSC::):
-        (JSC::CTI::emitCTICall):
-        (JSC::CTI::CTI):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::emitSlowScriptCheck):
-        (JSC::CTI::compileBinaryArithOpSlowCase):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        (JSC::CTI::privateCompileGetByIdSelf):
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        (JSC::CTI::privateCompilePutByIdReplace):
-        (JSC::CTI::privateCompilePutByIdTransition):
-        (JSC::CTI::privateCompileCTIMachineTrampolines):
-        (JSC::CTI::freeCTIMachineTrampolines):
-        (JSC::CTI::patchGetByIdSelf):
-        (JSC::CTI::patchPutByIdReplace):
-        (JSC::CTI::privateCompilePatchGetArrayLength):
-        (JSC::CTI::compileRegExp):
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::printStructureIDs):
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::derefStructureIDs):
-        (JSC::CodeBlock::refStructureIDs):
-        * VM/ExceptionHelpers.cpp:
-        (JSC::createNotAnObjectError):
-        * VM/Machine.cpp:
-        (JSC::jsLess):
-        (JSC::jsLessEq):
-        (JSC::BytecodeInterpreter::resolve):
-        (JSC::BytecodeInterpreter::resolveSkip):
-        (JSC::BytecodeInterpreter::resolveGlobal):
-        (JSC::BytecodeInterpreter::resolveBase):
-        (JSC::BytecodeInterpreter::resolveBaseAndProperty):
-        (JSC::BytecodeInterpreter::resolveBaseAndFunc):
-        (JSC::BytecodeInterpreter::slideRegisterWindowForCall):
-        (JSC::BytecodeInterpreter::callEval):
-        (JSC::BytecodeInterpreter::BytecodeInterpreter):
-        (JSC::BytecodeInterpreter::initialize):
-        (JSC::BytecodeInterpreter::~BytecodeInterpreter):
-        (JSC::BytecodeInterpreter::dumpCallFrame):
-        (JSC::BytecodeInterpreter::dumpRegisters):
-        (JSC::BytecodeInterpreter::isOpcode):
-        (JSC::BytecodeInterpreter::unwindCallFrame):
-        (JSC::BytecodeInterpreter::throwException):
-        (JSC::BytecodeInterpreter::execute):
-        (JSC::BytecodeInterpreter::debug):
-        (JSC::BytecodeInterpreter::resetTimeoutCheck):
-        (JSC::BytecodeInterpreter::checkTimeout):
-        (JSC::BytecodeInterpreter::createExceptionScope):
-        (JSC::BytecodeInterpreter::tryCachePutByID):
-        (JSC::BytecodeInterpreter::uncachePutByID):
-        (JSC::BytecodeInterpreter::tryCacheGetByID):
-        (JSC::BytecodeInterpreter::uncacheGetByID):
-        (JSC::BytecodeInterpreter::privateExecute):
-        (JSC::BytecodeInterpreter::retrieveArguments):
-        (JSC::BytecodeInterpreter::retrieveCaller):
-        (JSC::BytecodeInterpreter::retrieveLastCaller):
-        (JSC::BytecodeInterpreter::findFunctionCallFrame):
-        (JSC::BytecodeInterpreter::tryCTICachePutByID):
-        (JSC::BytecodeInterpreter::tryCTICacheGetByID):
-        (JSC::BytecodeInterpreter::cti_op_convert_this):
-        (JSC::BytecodeInterpreter::cti_op_end):
-        (JSC::BytecodeInterpreter::cti_op_add):
-        (JSC::BytecodeInterpreter::cti_op_pre_inc):
-        (JSC::BytecodeInterpreter::cti_timeout_check):
-        (JSC::BytecodeInterpreter::cti_register_file_check):
-        (JSC::BytecodeInterpreter::cti_op_loop_if_less):
-        (JSC::BytecodeInterpreter::cti_op_loop_if_lesseq):
-        (JSC::BytecodeInterpreter::cti_op_new_object):
-        (JSC::BytecodeInterpreter::cti_op_put_by_id):
-        (JSC::BytecodeInterpreter::cti_op_put_by_id_second):
-        (JSC::BytecodeInterpreter::cti_op_put_by_id_generic):
-        (JSC::BytecodeInterpreter::cti_op_put_by_id_fail):
-        (JSC::BytecodeInterpreter::cti_op_get_by_id):
-        (JSC::BytecodeInterpreter::cti_op_get_by_id_second):
-        (JSC::BytecodeInterpreter::cti_op_get_by_id_generic):
-        (JSC::BytecodeInterpreter::cti_op_get_by_id_fail):
-        (JSC::BytecodeInterpreter::cti_op_instanceof):
-        (JSC::BytecodeInterpreter::cti_op_del_by_id):
-        (JSC::BytecodeInterpreter::cti_op_mul):
-        (JSC::BytecodeInterpreter::cti_op_new_func):
-        (JSC::BytecodeInterpreter::cti_op_call_JSFunction):
-        (JSC::BytecodeInterpreter::cti_op_call_arityCheck):
-        (JSC::BytecodeInterpreter::cti_vm_dontLazyLinkCall):
-        (JSC::BytecodeInterpreter::cti_vm_lazyLinkCall):
-        (JSC::BytecodeInterpreter::cti_op_push_activation):
-        (JSC::BytecodeInterpreter::cti_op_call_NotJSFunction):
-        (JSC::BytecodeInterpreter::cti_op_create_arguments):
-        (JSC::BytecodeInterpreter::cti_op_create_arguments_no_params):
-        (JSC::BytecodeInterpreter::cti_op_tear_off_activation):
-        (JSC::BytecodeInterpreter::cti_op_tear_off_arguments):
-        (JSC::BytecodeInterpreter::cti_op_profile_will_call):
-        (JSC::BytecodeInterpreter::cti_op_profile_did_call):
-        (JSC::BytecodeInterpreter::cti_op_ret_scopeChain):
-        (JSC::BytecodeInterpreter::cti_op_new_array):
-        (JSC::BytecodeInterpreter::cti_op_resolve):
-        (JSC::BytecodeInterpreter::cti_op_construct_JSConstruct):
-        (JSC::BytecodeInterpreter::cti_op_construct_NotJSConstruct):
-        (JSC::BytecodeInterpreter::cti_op_get_by_val):
-        (JSC::BytecodeInterpreter::cti_op_resolve_func):
-        (JSC::BytecodeInterpreter::cti_op_sub):
-        (JSC::BytecodeInterpreter::cti_op_put_by_val):
-        (JSC::BytecodeInterpreter::cti_op_put_by_val_array):
-        (JSC::BytecodeInterpreter::cti_op_lesseq):
-        (JSC::BytecodeInterpreter::cti_op_loop_if_true):
-        (JSC::BytecodeInterpreter::cti_op_negate):
-        (JSC::BytecodeInterpreter::cti_op_resolve_base):
-        (JSC::BytecodeInterpreter::cti_op_resolve_skip):
-        (JSC::BytecodeInterpreter::cti_op_resolve_global):
-        (JSC::BytecodeInterpreter::cti_op_div):
-        (JSC::BytecodeInterpreter::cti_op_pre_dec):
-        (JSC::BytecodeInterpreter::cti_op_jless):
-        (JSC::BytecodeInterpreter::cti_op_not):
-        (JSC::BytecodeInterpreter::cti_op_jtrue):
-        (JSC::BytecodeInterpreter::cti_op_post_inc):
-        (JSC::BytecodeInterpreter::cti_op_eq):
-        (JSC::BytecodeInterpreter::cti_op_lshift):
-        (JSC::BytecodeInterpreter::cti_op_bitand):
-        (JSC::BytecodeInterpreter::cti_op_rshift):
-        (JSC::BytecodeInterpreter::cti_op_bitnot):
-        (JSC::BytecodeInterpreter::cti_op_resolve_with_base):
-        (JSC::BytecodeInterpreter::cti_op_new_func_exp):
-        (JSC::BytecodeInterpreter::cti_op_mod):
-        (JSC::BytecodeInterpreter::cti_op_less):
-        (JSC::BytecodeInterpreter::cti_op_neq):
-        (JSC::BytecodeInterpreter::cti_op_post_dec):
-        (JSC::BytecodeInterpreter::cti_op_urshift):
-        (JSC::BytecodeInterpreter::cti_op_bitxor):
-        (JSC::BytecodeInterpreter::cti_op_new_regexp):
-        (JSC::BytecodeInterpreter::cti_op_bitor):
-        (JSC::BytecodeInterpreter::cti_op_call_eval):
-        (JSC::BytecodeInterpreter::cti_op_throw):
-        (JSC::BytecodeInterpreter::cti_op_get_pnames):
-        (JSC::BytecodeInterpreter::cti_op_next_pname):
-        (JSC::BytecodeInterpreter::cti_op_push_scope):
-        (JSC::BytecodeInterpreter::cti_op_pop_scope):
-        (JSC::BytecodeInterpreter::cti_op_typeof):
-        (JSC::BytecodeInterpreter::cti_op_is_undefined):
-        (JSC::BytecodeInterpreter::cti_op_is_boolean):
-        (JSC::BytecodeInterpreter::cti_op_is_number):
-        (JSC::BytecodeInterpreter::cti_op_is_string):
-        (JSC::BytecodeInterpreter::cti_op_is_object):
-        (JSC::BytecodeInterpreter::cti_op_is_function):
-        (JSC::BytecodeInterpreter::cti_op_stricteq):
-        (JSC::BytecodeInterpreter::cti_op_nstricteq):
-        (JSC::BytecodeInterpreter::cti_op_to_jsnumber):
-        (JSC::BytecodeInterpreter::cti_op_in):
-        (JSC::BytecodeInterpreter::cti_op_push_new_scope):
-        (JSC::BytecodeInterpreter::cti_op_jmp_scopes):
-        (JSC::BytecodeInterpreter::cti_op_put_by_index):
-        (JSC::BytecodeInterpreter::cti_op_switch_imm):
-        (JSC::BytecodeInterpreter::cti_op_switch_char):
-        (JSC::BytecodeInterpreter::cti_op_switch_string):
-        (JSC::BytecodeInterpreter::cti_op_del_by_val):
-        (JSC::BytecodeInterpreter::cti_op_put_getter):
-        (JSC::BytecodeInterpreter::cti_op_put_setter):
-        (JSC::BytecodeInterpreter::cti_op_new_error):
-        (JSC::BytecodeInterpreter::cti_op_debug):
-        (JSC::BytecodeInterpreter::cti_vm_throw):
-        * VM/Machine.h:
-        * VM/Register.h:
-        * VM/SamplingTool.cpp:
-        (JSC::SamplingTool::run):
-        * VM/SamplingTool.h:
-        (JSC::SamplingTool::SamplingTool):
-        * bytecompiler/CodeGenerator.cpp:
-        (JSC::CodeGenerator::generate):
-        (JSC::CodeGenerator::CodeGenerator):
-        (JSC::CodeGenerator::emitOpcode):
-        * debugger/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::evaluate):
-        * jsc.cpp:
-        (runWithScripts):
-        * parser/Nodes.cpp:
-        (JSC::ScopeNode::ScopeNode):
-        * profiler/ProfileGenerator.cpp:
-        (JSC::ProfileGenerator::addParentForConsoleStart):
-        * runtime/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncPop):
-        (JSC::arrayProtoFuncPush):
-        * runtime/Collector.cpp:
-        (JSC::Heap::collect):
-        * runtime/ExecState.h:
-        (JSC::ExecState::interpreter):
-        * runtime/FunctionPrototype.cpp:
-        (JSC::functionProtoFuncApply):
-        * runtime/Interpreter.cpp:
-        (JSC::Interpreter::evaluate):
-        * runtime/JSCell.h:
-        * runtime/JSFunction.cpp:
-        (JSC::JSFunction::call):
-        (JSC::JSFunction::argumentsGetter):
-        (JSC::JSFunction::callerGetter):
-        (JSC::JSFunction::construct):
-        * runtime/JSFunction.h:
+        (JSC::JSFunction::mark):
         * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
         (JSC::JSGlobalData::~JSGlobalData):
         * runtime/JSGlobalData.h:
-        * runtime/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::~JSGlobalObject):
-        (JSC::JSGlobalObject::setTimeoutTime):
-        (JSC::JSGlobalObject::startTimeoutCheck):
-        (JSC::JSGlobalObject::stopTimeoutCheck):
-        (JSC::JSGlobalObject::mark):
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::globalFuncEval):
-        * runtime/JSString.h:
-        * runtime/RegExp.cpp:
-        (JSC::RegExp::RegExp):
-
-2008-11-15  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        - Remove SymbolTable from FunctionBodyNode and move it to CodeBlock
-        
-        It's not needed for functions that have never been executed, so no
-        need to waste the memory. Saves ~4M on membuster after 30 pages.
-
-        * VM/CodeBlock.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::retrieveArguments):
-        * parser/Nodes.cpp:
-        (JSC::EvalNode::generateCode):
-        (JSC::FunctionBodyNode::generateCode):
-        * parser/Nodes.h:
-        * runtime/JSActivation.h:
-        (JSC::JSActivation::JSActivationData::JSActivationData):
-
-2008-11-14  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 22259: Make all opcodes use eax as their final result register
-        <https://bugs.webkit.org/show_bug.cgi?id=22259>
-
-        Change one case of op_add (and the corresponding slow case) to use eax
-        rather than edx. Also, change the order in which the two results of
-        resolve_func and resolve_base are emitted so that the retrieved value is
-        put last into eax.
-
-        This gives no performance change on SunSpider or the V8 benchmark suite
-        when run in either harness.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-
-2008-11-14  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Geoff has this wacky notion that emitGetArg and emitPutArg should be related to
-        doing the same thing.  Crazy.
-        
-        Rename the methods for accessing virtual registers to say 'VirtualRegister' in the
-        name, and those for setting up the arguments for CTI methods to contain 'CTIArg'.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitGetVirtualRegister):
-        (JSC::CTI::emitGetVirtualRegisters):
-        (JSC::CTI::emitPutCTIArgFromVirtualRegister):
-        (JSC::CTI::emitPutCTIArg):
-        (JSC::CTI::emitGetCTIArg):
-        (JSC::CTI::emitPutCTIArgConstant):
-        (JSC::CTI::emitPutVirtualRegister):
-        (JSC::CTI::compileOpCallSetupArgs):
-        (JSC::CTI::compileOpCallEvalSetupArgs):
-        (JSC::CTI::compileOpConstructSetupArgs):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::compileOpStrictEq):
-        (JSC::CTI::putDoubleResultToJSNumberCellOrJSImmediate):
-        (JSC::CTI::compileBinaryArithOp):
-        (JSC::CTI::compileBinaryArithOpSlowCase):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompileCTIMachineTrampolines):
-        * VM/CTI.h:
-
-2008-11-14  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Antti Koivisto
-
-        Fix potential build break by adding StdLibExtras.h
-        
-        * GNUmakefile.am:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-
-2008-11-14  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Generate less code for the slow cases of op_call and op_construct.
-        https://bugs.webkit.org/show_bug.cgi?id=22272
-
-        1% progression on v8 tests.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitRetrieveArg):
-        (JSC::CTI::emitNakedCall):
-        (JSC::CTI::compileOpCallInitializeCallFrame):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompileCTIMachineTrampolines):
-        * VM/CTI.h:
-        * VM/CodeBlock.h:
-        (JSC::getCallLinkInfoReturnLocation):
-        (JSC::CodeBlock::getCallLinkInfo):
-        * VM/Machine.cpp:
-        (JSC::Machine::Machine):
-        (JSC::Machine::cti_vm_dontLazyLinkCall):
-        (JSC::Machine::cti_vm_lazyLinkCall):
-        * VM/Machine.h:
-
-2008-11-14  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Darin Alder.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21810
-        Remove use of static C++ objects that are destroyed at exit time (destructors)
-
-        Create DEFINE_STATIC_LOCAL macro. Change static local objects to leak to avoid 
-        exit-time destructor. Update code that was changed to fix this issue that ran 
-        into a gcc bug (<rdar://problem/6354696> Codegen issue with C++ static reference 
-        in gcc build 5465). Also typdefs for template types needed to be added in some 
-        cases so the type could make it through the macro successfully.
-
-        Basically code of the form:
-        static T m;
-        becomes:
-        DEFINE_STATIC_LOCAL(T, m, ());
-
-        Also any code of the form:
-        static T& m = *new T;
-        also becomes:
-        DEFINE_STATIC_LOCAL(T, m, ());
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * wtf/MainThread.cpp:
-        (WTF::mainThreadFunctionQueueMutex):
-        (WTF::functionQueue):
-        * wtf/StdLibExtras.h: Added. Add DEFINE_STATIC_LOCAL macro
-        * wtf/ThreadingPthreads.cpp:
-        (WTF::threadMapMutex):
-        (WTF::threadMap):
-        (WTF::identifierByPthreadHandle):
-
-2008-11-13  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Darin Adler
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=22269
-        Reduce PropertyMap usage
-
-        From observation of StructureID statistics, it became clear that many
-        StructureID's were not being used as StructureIDs themselves, but rather
-        only being necessary as links in the transition chain.  Acknowledging this
-        and that PropertyMaps stored in StructureIDs can be treated as caches, that
-        is that they can be reconstructed on demand, it became clear that we could
-        reduce the memory consumption of StructureIDs by only keeping PropertyMaps
-        for the StructureIDs that need them the most.
-
-        The specific strategy used to reduce the number of StructureIDs with
-        PropertyMaps is to take the previous StructureIDs PropertyMap when initially
-        transitioning (addPropertyTransition) from it and clearing out the pointer 
-        in the process.  The next time we need to do the same transition, for instance
-        repeated calls to the same constructor, we use the new addPropertyTransitionToExistingStructure
-        first, which allows us not to need the PropertyMap to determine if the property
-        exists already, since a transition to that property would require it not already
-        be present in the StructureID.  Should there be no transition, the PropertyMap
-        can be constructed on demand (via materializePropertyMap) to determine if the put is a 
-        replace or a transition to a new StructureID.
-
-        Reduces memory use on Membuster head test (30 pages open) by ~15MB.
-
-        * JavaScriptCore.exp:
-        * runtime/JSObject.h:
-        (JSC::JSObject::putDirect): First use addPropertyTransitionToExistingStructure
-        so that we can avoid building the PropertyMap on subsequent similar object
-        creations.
-        * runtime/PropertyMapHashTable.h:
-        (JSC::PropertyMapEntry::PropertyMapEntry): Add version of constructor which takes
-        all values to be used when lazily building the PropertyMap. 
-        * runtime/StructureID.cpp:
-        (JSC::StructureID::dumpStatistics): Add statistics on the number of StructureIDs
-        with PropertyMaps.
-        (JSC::StructureID::StructureID): Rename m_cachedTransistionOffset to m_offset
-        (JSC::isPowerOf2):
-        (JSC::nextPowerOf2):
-        (JSC::sizeForKeyCount): Returns the expected size of a PropertyMap for a key count.
-        (JSC::StructureID::materializePropertyMap): Builds the PropertyMap out of its previous pointer chain.
-        (JSC::StructureID::addPropertyTransitionToExistingStructure): Only transitions if there is a
-        an existing transition.
-        (JSC::StructureID::addPropertyTransition): Instead of always copying the ProperyMap, try and take
-        it from it previous pointer.
-        (JSC::StructureID::removePropertyTransition): Simplify by calling toDictionaryTransition() to do
-        transition work.
-        (JSC::StructureID::changePrototypeTransition): Build the PropertyMap if necessary before transitioning
-        because once you have transitioned, you will not be able to reconstruct it afterwards as there is no
-        previous pointer, pinning the ProperyMap as well.
-        (JSC::StructureID::getterSetterTransition): Ditto.
-        (JSC::StructureID::toDictionaryTransition): Pin the PropertyMap so that it is not destroyed on further transitions.
-        (JSC::StructureID::fromDictionaryTransition): We can only transition back from a dictionary transition if there
-        are no deleted offsets.
-        (JSC::StructureID::addPropertyWithoutTransition): Build PropertyMap on demands and pin.
-        (JSC::StructureID::removePropertyWithoutTransition): Ditto.
-        (JSC::StructureID::get): Build on demand.
-        (JSC::StructureID::createPropertyMapHashTable): Add version of create that takes a size
-        for on demand building.
-        (JSC::StructureID::expandPropertyMapHashTable):
-        (JSC::StructureID::rehashPropertyMapHashTable):
-        (JSC::StructureID::getEnumerablePropertyNamesInternal): Build PropertyMap on demand.
-        * runtime/StructureID.h:
-        (JSC::StructureID::propertyStorageSize): Account for StructureIDs without PropertyMaps.
-        (JSC::StructureID::isEmpty): Ditto.
-        (JSC::StructureID::materializePropertyMapIfNecessary):
-        (JSC::StructureID::get): Build PropertyMap on demand
-
-2008-11-14  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
-
-        Reviewed by Simon Hausmann.
-
-        <https://bugs.webkit.org/show_bug.cgi?id=21500>
-
-        JavaScriptCore build with -O3 flag instead of -O2 (gcc).
-        2.02% speedup on SunSpider (Qt-port on Linux)
-        1.10% speedup on V8 (Qt-port on Linux)
-        3.45% speedup on WindScorpion (Qt-port on Linux)
-
-        * JavaScriptCore.pri:
-
-2008-11-14  Kristian Amlie  <kristian.amlie@trolltech.com>
-
-        Reviewed by Darin Adler.
-
-        Compile fix for RVCT.
-
-        In reality, it is two fixes:
-
-        1. Remove typename. I believe typename can only be used when the named
-        type depends on the template parameters, which it doesn't in this
-        case, so I think this is more correct.
-        2. Replace ::iterator scope with specialized typedef. This is to work
-        around a bug in RVCT.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22260
-
-        * wtf/ListHashSet.h:
-        (WTF::::find):
-
-2008-11-14  Kristian Amlie  <kristian.amlie@trolltech.com>
-
-        Reviewed by Darin Adler.
-
-        Compile fix for WINSCW.
-
-        This fix doesn't protect against implicit conversions from bool to
-        integers, but most likely that will be caught on another platform.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22260
-
-        * wtf/PassRefPtr.h:
-        (WTF::PassRefPtr::operator bool):
-        * wtf/RefPtr.h:
-        (WTF::RefPtr::operator bool):
-
-2008-11-14  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 22245: Move wtf/dtoa.h into the WTF namespace
-        <https://bugs.webkit.org/show_bug.cgi?id=22245>
-
-        Move wtf/dtoa.h into the WTF namespace from the JSC namespace. This
-        introduces some ambiguities in name lookups, so I changed all uses of
-        the functions in wtf/dtoa.h to explicitly state the namespace.
-
-        * JavaScriptCore.exp:
-        * parser/Lexer.cpp:
-        (JSC::Lexer::lex):
-        * runtime/InitializeThreading.cpp:
-        * runtime/JSGlobalObjectFunctions.cpp:
-        (JSC::parseInt):
-        * runtime/NumberPrototype.cpp:
-        (JSC::integerPartNoExp):
-        (JSC::numberProtoFuncToExponential):
-        * runtime/UString.cpp:
-        (JSC::concatenate):
-        (JSC::UString::from):
-        (JSC::UString::toDouble):
-        * wtf/dtoa.cpp:
-        * wtf/dtoa.h:
-
-2008-11-14  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 22257: Enable redundant read optimizations for results generated by compileBinaryArithOp()
-        <https://bugs.webkit.org/show_bug.cgi?id=22257>
-
-        This shows no change in performance on either SunSpider or the V8
-        benchmark suite, but it removes an ugly special case and allows for
-        future optimizations to be implemented in a cleaner fashion.
-
-        This patch was essentially given to me by Gavin Barraclough upon my
-        request, but I did regression and performance testing so that he could
-        work on something else.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::putDoubleResultToJSNumberCellOrJSImmediate): Move the final
-        result to eax if it is not already there.
-        (JSC::CTI::compileBinaryArithOp): Remove the killing of the final result
-        register that disables the optimization.
-
-2008-11-13  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Roben.
-
-        Add a Scons-based build system for building
-        the Chromium-Mac build of JavaScriptCore.
-        https://bugs.webkit.org/show_bug.cgi?id=21991
-
-        * JavaScriptCore.scons: Added.
-        * SConstruct: Added.
-
-2008-11-13  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Roben.
-        
-        Add PLATFORM(CHROMIUM) to the "we don't use cairo" blacklist
-        until https://bugs.webkit.org/show_bug.cgi?id=22250 is fixed.
-
-        * wtf/Platform.h:
-
-2008-11-13  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        In r38375 the 'jsc' shell was changed to improve teardown on quit. The
-        main() function in jsc.cpp uses Structured Exception Handling, so Visual
-        C++ emits a warning when destructors are used.
-        
-        In order to speculatively fix the Windows build, this patch changes that
-        code to use explicit pointer manipulation and locking rather than smart
-        pointers and RAII.
-
-        * jsc.cpp:
-        (main):
-
-2008-11-13  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 22246: Get arguments for opcodes together to eliminate more redundant memory reads
-        <https://bugs.webkit.org/show_bug.cgi?id=22246>
-
-        It is common for opcodes to read their first operand into eax and their
-        second operand into edx. If the value intended for the second operand is
-        in eax, we should first move eax to the register for the second operand
-        and then read the first operand into eax.
-
-        This is a 0.5% speedup on SunSpider and a 2.0% speedup on the V8
-        benchmark suite when measured using the V8 harness.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitGetArgs):
-        (JSC::CTI::compileOpStrictEq):
-        (JSC::CTI::compileBinaryArithOp):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/CTI.h:
-
-2008-11-13  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 22238: Avoid unnecessary reads of temporaries when the target machine register is not eax
-        <https://bugs.webkit.org/show_bug.cgi?id=22238>
-
-        Enable the optimization of not reading a value back from memory that we
-        just wrote when the target machine register is not eax. In order to do
-        this, the code generation for op_put_global_var must be changed to
-        read its argument into a register before overwriting eax.
-
-        This is a 0.5% speedup on SunSpider and shows no change on the V8
-        benchmark suite when run in either harness.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitGetArg):
-        (JSC::CTI::privateCompileMainPass):
-
-2008-11-13  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Perform teardown in the 'jsc' shell in order to suppress annoying and
-        misleading leak messages. There is still a lone JSC::Node leaking when
-        quit() is called, but hopefully that can be fixed as well.
-
-        * jsc.cpp:
-        (functionQuit):
-        (main):
-
-2008-11-13  Mike Pinkerton  <pinkerton@chromium.org>
-
-        Reviewed by Sam Weinig.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=22087
-        Need correct platform defines for Mac Chromium
-
-        Set the appropriate platform defines for Mac Chromium, which is
-        similar to PLATFORM(MAC), but isn't.
-
-        * wtf/Platform.h:
-
-2008-11-13  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Cameron Zwarich.
-        
-        - remove immediate checks from native codegen for known non-immediate cases like "this"
-        
-        ~.5% speedup on v8 benchmarks
-        
-        In the future we can extend this model to remove all sorts of
-        typechecks based on local type info or type inference.
-        
-        I also added an assertion to verify that all slow cases linked as
-        many slow case jumps as the corresponding fast case generated, and
-        fixed the pre-existing cases where this was not true.
-        
-        * VM/CTI.cpp:
-        (JSC::CTI::emitJumpSlowCaseIfNotJSCell):
-        (JSC::CTI::linkSlowCaseIfNotJSCell):
-        (JSC::CTI::compileBinaryArithOp):
-        (JSC::CTI::compileBinaryArithOpSlowCase):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/CTI.h:
-        * VM/CodeBlock.h:
-        (JSC::CodeBlock::isKnownNotImmediate):
-
-2008-11-13  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 21943: Avoid needless reads of temporary values in CTI code
-        <https://bugs.webkit.org/show_bug.cgi?id=21943>
-
-        If an opcode needs to load a virtual register and a previous opcode left
-        the contents of that virtual register in a machine register, use the
-        value in the machine register rather than getting it from memory.
-
-        In order to perform this optimization, it is necessary to know the
-        jump tagets in the CodeBlock. For temporaries, the only problematic
-        jump targets are binary logical operators and the ternary conditional
-        operator. However, if this optimization were to be extended to local 
-        variable registers as well, other jump targets would need to be
-        included, like switch statement cases and the beginnings of catch
-        blocks.
-
-        This optimization also requires that the fast case and the slow case
-        of an opcode use emitPutResult() on the same register, which was chosen
-        to be eax, as that is the register into which we read the first operand
-        of opcodes. In order to make this the case, we needed to add some mov
-        instructions to the slow cases of some instructions.
-
-        This optimizaton is not applied whenever compileBinaryArithOp() is used
-        to compile an opcode, because different machine registers may be used to
-        store the final result. It seems possible to rewrite the code generation
-        in compileBinaryArithOp() to allow for this optimization.
-
-        This optimization is also not applied when generating slow cases,
-        because some fast cases overwrite the value of eax before jumping to the
-        slow case. In the future, it may be possible to apply this optimization
-        to slow cases as well, but it did not seem to be a speedup when testing
-        an early version of this patch.
-
-        This is a 1.0% speedup on SunSpider and a 6.3% speedup on the V8
-        benchmark suite.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::killLastResultRegister):
-        (JSC::CTI::emitGetArg):
-        (JSC::CTI::emitGetPutArg):
-        (JSC::CTI::emitGetCTIParam):
-        (JSC::CTI::emitGetFromCallFrameHeader):
-        (JSC::CTI::emitPutResult):
-        (JSC::CTI::emitCTICall):
-        (JSC::CTI::CTI):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::compileOpStrictEq):
-        (JSC::CTI::emitSlowScriptCheck):
-        (JSC::CTI::compileBinaryArithOp):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompilePatchGetArrayLength):
-        * VM/CTI.h:
-        * VM/CodeBlock.h:
-        (JSC::CodeBlock::isTemporaryRegisterIndex):
-        * bytecompiler/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitLabel):
-
-2008-11-12  Alp Toker  <alp@nuanti.com>
-
-        autotools build system fix-up only. Add FloatQuad.h to the source
-        lists and sort them.
-
-        * GNUmakefile.am:
-
-2008-11-12  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=22192
-        +37 failures in fast/profiler
-        
-        along with Darin's review comments in
-        https://bugs.webkit.org/show_bug.cgi?id=22174
-        Simplified op_call by nixing its responsibility for moving the value of
-        "this" into the first argument slot
-
-        * VM/Machine.cpp:
-        (JSC::returnToThrowTrampoline):
-        (JSC::throwStackOverflowError):
-        (JSC::Machine::cti_register_file_check):
-        (JSC::Machine::cti_op_call_arityCheck):
-        (JSC::Machine::cti_vm_throw): Moved the throw logic into a function, since
-        functions are better than macros.
-
-        * bytecompiler/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitCall):
-        (JSC::CodeGenerator::emitConstruct): Ensure that the function register
-        is preserved if profiling is enabled, since the profiler uses that
-        register.
-
-        * runtime/JSGlobalData.h: Renamed throwReturnAddress to exceptionLocation,
-        because I had a hard time understanding what "throwReturnAddress" meant.
-
-2008-11-12  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Roll in r38322, now that test failures have been fixed.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::compileOpCallSetupArgs):
-        (JSC::CTI::compileOpCallEvalSetupArgs):
-        (JSC::CTI::compileOpConstructSetupArgs):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/Machine.cpp:
-        (JSC::Machine::callEval):
-        (JSC::Machine::dumpCallFrame):
-        (JSC::Machine::dumpRegisters):
-        (JSC::Machine::execute):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_register_file_check):
-        (JSC::Machine::cti_op_call_arityCheck):
-        (JSC::Machine::cti_op_call_NotJSFunction):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-        (JSC::Machine::cti_op_call_eval):
-        (JSC::Machine::cti_vm_throw):
-        * VM/Machine.h:
-        * bytecompiler/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitCall):
-        (JSC::CodeGenerator::emitCallEval):
-        (JSC::CodeGenerator::emitConstruct):
-        * bytecompiler/CodeGenerator.h:
-        * parser/Nodes.cpp:
-        (JSC::EvalFunctionCallNode::emitCode):
-        (JSC::FunctionCallValueNode::emitCode):
-        (JSC::FunctionCallResolveNode::emitCode):
-        (JSC::FunctionCallBracketNode::emitCode):
-        (JSC::FunctionCallDotNode::emitCode):
-        * parser/Nodes.h:
-        (JSC::ScopeNode::neededConstants):
-
-2008-11-12  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=22201
-        Integer conversion in array.length was safe signed values,
-        but the length is unsigned.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompilePatchGetArrayLength):
-
-2008-11-12  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Mark Rowe.
-
-        Roll out r38322 due to test failures on the bots.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::compileOpCallSetupArgs):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/Machine.cpp:
-        (JSC::Machine::callEval):
-        (JSC::Machine::dumpCallFrame):
-        (JSC::Machine::dumpRegisters):
-        (JSC::Machine::execute):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::throwStackOverflowPreviousFrame):
-        (JSC::Machine::cti_register_file_check):
-        (JSC::Machine::cti_op_call_arityCheck):
-        (JSC::Machine::cti_op_call_NotJSFunction):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-        (JSC::Machine::cti_op_call_eval):
-        (JSC::Machine::cti_vm_throw):
-        * VM/Machine.h:
-        * bytecompiler/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitCall):
-        (JSC::CodeGenerator::emitCallEval):
-        (JSC::CodeGenerator::emitConstruct):
-        * bytecompiler/CodeGenerator.h:
-        * parser/Nodes.cpp:
-        (JSC::EvalFunctionCallNode::emitCode):
-        (JSC::FunctionCallValueNode::emitCode):
-        (JSC::FunctionCallResolveNode::emitCode):
-        (JSC::FunctionCallBracketNode::emitCode):
-        (JSC::FunctionCallDotNode::emitCode):
-        * parser/Nodes.h:
-        (JSC::ScopeNode::neededConstants):
-
-2008-11-11  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=22174
-        Simplified op_call by nixing its responsibility for moving the value of
-        "this" into the first argument slot.
-
-        Instead, the caller emits an explicit load or mov instruction, or relies
-        on implicit knowledge that "this" is already in the first argument slot.
-        As a result, two operands to op_call are gone: firstArg and thisVal.
-        
-        SunSpider and v8 tests show no change in bytecode or CTI.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::compileOpCallSetupArgs):
-        (JSC::CTI::compileOpCallEvalSetupArgs):
-        (JSC::CTI::compileOpConstructSetupArgs): Split apart these three versions
-        of setting up arguments to op_call, because they're more different than
-        they are the same -- even more so with this patch.
-
-        (JSC::CTI::compileOpCall): Updated for the fact that op_construct doesn't
-        match op_call anymore.
-
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases): Merged a few call cases. Updated
-        for changes mentioned above.
-
-        * VM/CTI.h:
-
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump): Updated for new bytecode format of call / construct.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::callEval): Updated for new bytecode format of call / construct.
-
-        (JSC::Machine::dumpCallFrame):
-        (JSC::Machine::dumpRegisters): Simplified these debugging functions, 
-        taking advantage of the new call frame layout.
-
-        (JSC::Machine::execute): Fixed up the eval version of execute to be
-        friendlier to calls in the new format.
-
-        (JSC::Machine::privateExecute): Implemented the new call format in
-        bytecode.
-
-        (JSC::Machine::cti_op_call_NotJSFunction):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-        (JSC::Machine::cti_op_call_eval): Updated CTI helpers to match the new
-        call format.
-        
-        Fixed a latent bug in stack overflow checking that is now hit because
-        the register layout has changed a bit -- namely: when throwing a stack
-        overflow exception inside an op_call helper, we need to account for the
-        fact that the current call frame is only half-constructed, and use the
-        parent call frame instead.
-
-        * VM/Machine.h:
-
-        * bytecompiler/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitCall):
-        (JSC::CodeGenerator::emitCallEval):
-        (JSC::CodeGenerator::emitConstruct):
-        * bytecompiler/CodeGenerator.h: Updated codegen to match the new call
-        format.
-
-        * parser/Nodes.cpp:
-        (JSC::EvalFunctionCallNode::emitCode):
-        (JSC::FunctionCallValueNode::emitCode):
-        (JSC::FunctionCallResolveNode::emitCode):
-        (JSC::FunctionCallBracketNode::emitCode):
-        (JSC::FunctionCallDotNode::emitCode):
-        * parser/Nodes.h:
-        (JSC::ScopeNode::neededConstants): ditto
-
-2008-11-11  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Remove an unused forwarding header for a file that no longer exists.
-
-        * ForwardingHeaders/JavaScriptCore/JSLock.h: Removed.
-
-2008-11-11  Mark Rowe  <mrowe@apple.com>
-
-        Fix broken dependencies building JavaScriptCore on a freezing cold cat, caused
-        by failure to update all instances of "kjs" to their new locations.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2008-11-11  Alexey Proskuryakov  <ap@webkit.org>
-
-        Rubber-stamped by Adam Roben.
-
-        * wtf/AVLTree.h: (WTF::AVLTree::Iterator::start_iter):
-        Fix indentation a little more.
-
-2008-11-11  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        Clean up EvalCodeCache to match our coding style a bit more.
-
-        * VM/EvalCodeCache.h:
-        (JSC::EvalCodeCache::get):
-
-2008-11-11  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        Bug 22179: Move EvalCodeCache from CodeBlock.h into its own file
-        <https://bugs.webkit.org/show_bug.cgi?id=22179>
-
-        * GNUmakefile.am:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CodeBlock.h:
-        * VM/EvalCodeCache.h: Copied from VM/CodeBlock.h.
-        * VM/Machine.cpp:
-
-2008-11-11  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Remove the 'm_' prefix from the fields of the SwitchRecord struct.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompile):
-        * VM/CTI.h:
-        (JSC::SwitchRecord):
-        (JSC::SwitchRecord::SwitchRecord):
-
-2008-11-11  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        Make asInteger() a static function so that it has internal linkage.
-
-        * VM/CTI.cpp:
-        (JSC::asInteger):
-
-2008-11-11  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Mark Rowe.
-        
-        - shrink CodeBlock and AST related Vectors to exact fit (5-10M savings on membuster test)
-        
-        No perf regression combined with the last patch (each seems like a small regression individually)
-
-        * bytecompiler/CodeGenerator.cpp:
-        (JSC::CodeGenerator::generate):
-        * parser/Nodes.h:
-        (JSC::SourceElements::releaseContentsIntoVector):
-        * wtf/Vector.h:
-        (WTF::Vector::shrinkToFit):
-
-2008-11-11  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Mark Rowe.
-        
-        - remove inline capacity from declaration stacks (15M savings on membuster test)
-
-        No perf regression on SunSpider or V8 test combined with other upcoming memory improvement patch.
-        
-        * JavaScriptCore.exp:
-        * parser/Nodes.h:
-
-2008-11-11  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        While r38286 removed the need for the m_callFrame member variable of
-        CTI, it should be also be removed.
-
-        * VM/CTI.h:
-
-2008-11-10  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Make CTI::asInteger() a non-member function, since it needs no access to
-        any of CTI's member variables.
-
-        * VM/CTI.cpp:
-        (JSC::asInteger):
-        * VM/CTI.h:
-
-2008-11-10  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Use 'value' instead of 'js' in CTI as a name for JSValue* to match our
-        usual convention elsewhere.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitGetArg):
-        (JSC::CTI::emitGetPutArg):
-        (JSC::CTI::getConstantImmediateNumericArg):
-        (JSC::CTI::printOpcodeOperandTypes):
-
-2008-11-10  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Make CTI::getConstant() a member function of CodeBlock instead.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitGetArg):
-        (JSC::CTI::emitGetPutArg):
-        (JSC::CTI::getConstantImmediateNumericArg):
-        (JSC::CTI::printOpcodeOperandTypes):
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CTI.h:
-        * VM/CodeBlock.h:
-        (JSC::CodeBlock::getConstant):
-
-2008-11-10  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Rename CodeBlock::isConstant() to isConstantRegisterIndex().
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitGetArg):
-        (JSC::CTI::emitGetPutArg):
-        (JSC::CTI::getConstantImmediateNumericArg):
-        (JSC::CTI::printOpcodeOperandTypes):
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CodeBlock.h:
-        (JSC::CodeBlock::isConstantRegisterIndex):
-        * bytecompiler/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitEqualityOp):
-
-2008-11-10  Gavin Barraclough  <barraclough@apple.com>
-
-        Build fix for non-CTI builds.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::initialize):
-
-2008-11-10  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Remove the unused labels member variable of CodeBlock.
-
-        * VM/CodeBlock.h:
-        * VM/LabelID.h:
-        (JSC::LabelID::setLocation):
-
-2008-11-10  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Batch compile the set of static trampolines at the point Machine is constructed, using a single allocation.
-        Refactor out m_callFrame from CTI, since this is only needed to access the global data (instead store a
-        pointer to the global data directly, since this is available at the point the Machine is constructed).
-        Add a method to align the code buffer, to allow JIT generation for multiple trampolines in one block.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::getConstant):
-        (JSC::CTI::emitGetArg):
-        (JSC::CTI::emitGetPutArg):
-        (JSC::CTI::getConstantImmediateNumericArg):
-        (JSC::CTI::printOpcodeOperandTypes):
-        (JSC::CTI::CTI):
-        (JSC::CTI::compileBinaryArithOp):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        (JSC::CTI::privateCompileCTIMachineTrampolines):
-        (JSC::CTI::freeCTIMachineTrampolines):
-        * VM/CTI.h:
-        (JSC::CTI::compile):
-        (JSC::CTI::compileGetByIdSelf):
-        (JSC::CTI::compileGetByIdProto):
-        (JSC::CTI::compileGetByIdChain):
-        (JSC::CTI::compilePutByIdReplace):
-        (JSC::CTI::compilePutByIdTransition):
-        (JSC::CTI::compileCTIMachineTrampolines):
-        (JSC::CTI::compilePatchGetArrayLength):
-        * VM/Machine.cpp:
-        (JSC::Machine::initialize):
-        (JSC::Machine::~Machine):
-        (JSC::Machine::execute):
-        (JSC::Machine::tryCTICachePutByID):
-        (JSC::Machine::tryCTICacheGetByID):
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_vm_lazyLinkCall):
-        * VM/Machine.h:
-        * masm/X86Assembler.h:
-        (JSC::JITCodeBuffer::isAligned):
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::align):
-        * runtime/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-
-2008-11-10  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Antti Koivisto.
-        
-        - Make Vector::clear() release the Vector's memory (1MB savings on membuster)
-        https://bugs.webkit.org/show_bug.cgi?id=22170
-
-        * wtf/Vector.h:
-        (WTF::VectorBufferBase::deallocateBuffer): Set capacity to 0 as
-        well as size, otherwise shrinking capacity to 0 can fail to reset
-        the capacity and thus cause a future crash.
-        (WTF::Vector::~Vector): Shrink size not capacity; we only need
-        to call destructors, the buffer will be freed anyway.
-        (WTF::Vector::clear): Change this to shrinkCapacity(0), not just shrink(0).
-        (WTF::::shrinkCapacity): Use shrink() instead of resize() for case where
-        the size is greater than the new capacity, to work with types that have no
-        default constructor.
-
-2008-11-10  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Split multiple definitions into separate lines.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::compileBinaryArithOp):
-
-2008-11-10  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Bug 22162: Remove cachedValueGetter from the JavaScriptCore API implementation
-        <https://bugs.webkit.org/show_bug.cgi?id=22162>
-
-        There is no more need for the cachedValueGetter hack now that we have
-        PropertySlot::setValue(), so we should remove it.
-
-        * API/JSCallbackObject.h:
-        * API/JSCallbackObjectFunctions.h:
-        (JSC::::getOwnPropertySlot):
-
-2008-11-10  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 22152: Remove asObject() call from JSCallbackObject::getOwnPropertySlot()
-        <https://bugs.webkit.org/show_bug.cgi?id=22152>
-
-        With the recent change to adopt asType() style cast functions with
-        assertions instead of static_casts in many places, the assertion for
-        the asObject() call in JSCallbackObject::getOwnPropertySlot() has been
-        failing when using any nontrivial client of the JavaScriptCore API.
-        The cast isn't even necessary to call slot.setCustom(), so it should
-        be removed.
-
-        * API/JSCallbackObjectFunctions.h:
-        (JSC::JSCallbackObject::getOwnPropertySlot):
-
-2008-11-10  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Adam Roben.
-
-        A few coding style fixes for AVLTree.
-
-        * wtf/AVLTree.h: Moved to WTF namespace, Removed "KJS_" from include guards.
-        (WTF::AVLTree::Iterator::start_iter): Fixed indentation
-
-        * runtime/JSArray.cpp: Added "using namepace WTF".
-
-2008-11-09  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Speculatively fix the non-AllInOne build.
-
-        * runtime/NativeErrorConstructor.cpp:
-
-2008-11-09  Darin Adler  <darin@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=22149
-          remove unused code from the parser
-
-        * AllInOneFile.cpp: Removed nodes2string.cpp.
-        * GNUmakefile.am: Ditto.
-        * JavaScriptCore.exp: Ditto.
-        * JavaScriptCore.pri: Ditto.
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
-        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
-        * JavaScriptCoreSources.bkl: Ditto.
-
-        * VM/CodeBlock.h: Added include.
-
-        * VM/Machine.cpp: (JSC::Machine::execute): Use the types from
-        DeclarationStacks as DeclarationStacks:: rather than Node:: since
-        "Node" really has little to do with it.
-        * bytecompiler/CodeGenerator.cpp:
-        (JSC::CodeGenerator::CodeGenerator): Ditto.
-
-        * jsc.cpp:
-        (Options::Options): Removed prettyPrint option.
-        (runWithScripts): Ditto.
-        (printUsageStatement): Ditto.
-        (parseArguments): Ditto.
-        (jscmain): Ditto.
-
-        * parser/Grammar.y: Removed use of obsolete ImmediateNumberNode.
-
-        * parser/Nodes.cpp:
-        (JSC::ThrowableExpressionData::emitThrowError): Use inline functions
-        instead of direct member access for ThrowableExpressionData values.
-        (JSC::BracketAccessorNode::emitCode): Ditto.
-        (JSC::DotAccessorNode::emitCode): Ditto.
-        (JSC::NewExprNode::emitCode): Ditto.
-        (JSC::EvalFunctionCallNode::emitCode): Ditto.
-        (JSC::FunctionCallValueNode::emitCode): Ditto.
-        (JSC::FunctionCallResolveNode::emitCode): Ditto.
-        (JSC::FunctionCallBracketNode::emitCode): Ditto.
-        (JSC::FunctionCallDotNode::emitCode): Ditto.
-        (JSC::PostfixResolveNode::emitCode): Ditto.
-        (JSC::PostfixBracketNode::emitCode): Ditto.
-        (JSC::PostfixDotNode::emitCode): Ditto.
-        (JSC::DeleteResolveNode::emitCode): Ditto.
-        (JSC::DeleteBracketNode::emitCode): Ditto.
-        (JSC::DeleteDotNode::emitCode): Ditto.
-        (JSC::PrefixResolveNode::emitCode): Ditto.
-        (JSC::PrefixBracketNode::emitCode): Ditto.
-        (JSC::PrefixDotNode::emitCode): Ditto.
-        (JSC::ThrowableBinaryOpNode::emitCode): Ditto.
-        (JSC::InstanceOfNode::emitCode): Ditto.
-        (JSC::ReadModifyResolveNode::emitCode): Ditto.
-        (JSC::AssignResolveNode::emitCode): Ditto.
-        (JSC::AssignDotNode::emitCode): Ditto.
-        (JSC::ReadModifyDotNode::emitCode): Ditto.
-        (JSC::AssignBracketNode::emitCode): Ditto.
-        (JSC::ReadModifyBracketNode::emitCode): Ditto.
-        (JSC::statementListEmitCode): Take a const StatementVector instead
-        of a non-const one. Also removed unused statementListPushFIFO.
-        (JSC::ForInNode::emitCode): Inline functions instead of member access.
-        (JSC::ThrowNode::emitCode): Ditto.
-        (JSC::EvalNode::emitCode): Ditto.
-        (JSC::FunctionBodyNode::emitCode): Ditto.
-        (JSC::ProgramNode::emitCode): Ditto.
-
-        * parser/Nodes.h: Removed unused includes and forward declarations.
-        Removed Precedence enum. Made many more members private instead of
-        protected or public. Removed unused NodeStack typedef. Moved the
-        VarStack and FunctionStack typedefs from Node to ScopeNode. Made
-        Node::emitCode pure virtual and changed classes that don't emit
-        any code to inherit from ParserRefCounted rather than Node.
-        Moved isReturnNode from Node to StatementNode. Removed the
-        streamTo, precedence, and needsParensIfLeftmost functions from
-        all classes. Removed the ImmediateNumberNode class and make
-        NumberNode::setValue nonvirtual.
-
-        * parser/nodes2string.cpp: Removed.
-
-2008-11-09  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig and Maciej Stachowiak.
-        Includes some work done by Chris Brichford.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=14886
-          Stack overflow due to deeply nested parse tree doing repeated string concatentation
-
-        Test: fast/js/large-expressions.html
-
-        1) Code generation is recursive, so takes stack proportional to the complexity
-           of the source code expression. Fixed by setting an arbitrary recursion limit
-           of 10,000 nodes.
-
-        2) Destruction of the syntax tree was recursive. Fixed by introducing a
-           non-recursive mechanism for destroying the tree.
-
-        * bytecompiler/CodeGenerator.cpp:
-        (JSC::CodeGenerator::CodeGenerator): Initialize depth to 0.
-        (JSC::CodeGenerator::emitThrowExpressionTooDeepException): Added. Emits the code
-        to throw a "too deep" exception.
-        * bytecompiler/CodeGenerator.h:
-        (JSC::CodeGenerator::emitNode): Check depth and emit an exception if we exceed
-        the maximum depth.
-
-        * parser/Nodes.cpp:
-        (JSC::NodeReleaser::releaseAllNodes): Added. To be called inside node destructors
-        to avoid recursive calls to destructors for nodes inside this one.
-        (JSC::NodeReleaser::release): Added. To be called inside releaseNodes functions.
-        Also added releaseNodes functions and calls to releaseAllNodes inside destructors
-        for each class derived from Node that has RefPtr to other nodes.
-        (JSC::NodeReleaser::adopt): Added. Used by the release function.
-        (JSC::NodeReleaser::adoptFunctionBodyNode): Added.
-
-        * parser/Nodes.h: Added declarations of releaseNodes and destructors in all classes
-        that needed it. Eliminated use of ListRefPtr and releaseNext, which are the two parts
-        of an older solution to the non-recursive destruction problem that works only for
-        lists, whereas the new solution works for other graphs. Changed ReverseBinaryOpNode
-        to use BinaryOpNode as a base class to avoid some duplicated code.
-
-2008-11-08  Kevin Ollivier  <kevino@theolliviers.com>
-        
-        wx build fixes after addition of JSCore parser and bycompiler dirs. Also cleanup
-        the JSCore Bakefile's group names to be consistent.
-
-        * JavaScriptCoreSources.bkl:
-        * jscore.bkl:
-
-2008-11-07  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Bug 21801: REGRESSION (r37821): YUI date formatting JavaScript puts the letter 'd' in place of the day
-        <https://bugs.webkit.org/show_bug.cgi?id=21801>
-
-        Fix the constant register check in the 'typeof' optimization in
-        CodeGenerator, which was completely broken after r37821.
-
-        * bytecompiler/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitEqualityOp):
-
-2008-11-07  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Bug 22129: Move CTI::isConstant() to CodeBlock
-        <https://bugs.webkit.org/show_bug.cgi?id=22129>
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitGetArg):
-        (JSC::CTI::emitGetPutArg):
-        (JSC::CTI::getConstantImmediateNumericArg):
-        (JSC::CTI::printOpcodeOperandTypes):
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CTI.h:
-        * VM/CodeBlock.h:
-        (JSC::CodeBlock::isConstant):
-
-2008-11-07  Alp Toker  <alp@nuanti.com>
-
-        autotools fix. Always use the configured perl binary (which may be
-        different to the one in $PATH) when generating sources.
-
-        * GNUmakefile.am:
-
-2008-11-07  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Change grammar.cpp to Grammar.cpp and grammar.h to Grammar.h in several
-        build scripts.
-
-        * DerivedSources.make:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCoreSources.bkl:
-
-2008-11-07  Alp Toker  <alp@nuanti.com>
-
-        More grammar.cpp -> Grammar.cpp build fixes.
-
-        * AllInOneFile.cpp:
-        * GNUmakefile.am:
-
-2008-11-07  Simon Hausmann  <hausmann@webkit.org>
-
-        Fix the build on case-sensitive file systems. grammar.y was renamed to
-        Grammar.y but Lexer.cpp includes grammar.h. The build bots didn't
-        notice this change because of stale files.
-
-        * parser/Lexer.cpp:
-
-2008-11-07  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Rename the m_nextGlobal, m_nextParameter, and m_nextConstant member
-        variables of CodeGenerator to m_nextGlobalIndex, m_nextParameterIndex,
-        and m_nextConstantIndex respectively. This is to distinguish these from
-        member variables like m_lastConstant, which are actually RefPtrs to
-        Registers.
-
-        * bytecompiler/CodeGenerator.cpp:
-        (JSC::CodeGenerator::addGlobalVar):
-        (JSC::CodeGenerator::allocateConstants):
-        (JSC::CodeGenerator::CodeGenerator):
-        (JSC::CodeGenerator::addParameter):
-        (JSC::CodeGenerator::addConstant):
-        * bytecompiler/CodeGenerator.h:
-
-2008-11-06  Gavin Barraclough  barraclough@apple.com
-
-        Reviewed by Oliver Hunt.
-
-        Do not make a cti_* call to perform an op_call unless either:
-        (1) The codeblock for the function body has not been generated.
-        (2) The number of arguments passed does not match the callee arity.
-
-        ~1% progression on sunspider --v8
-
-        * VM/CTI.cpp:
-        (JSC::CTI::compileOpCallInitializeCallFrame):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/CTI.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_op_call_arityCheck):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        * VM/Machine.h:
-        * kjs/nodes.h:
-
-2008-11-06  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Move the remaining files in the kjs subdirectory of JavaScriptCore to
-        a new parser subdirectory, and remove the kjs subdirectory entirely.
-
-        * AllInOneFile.cpp:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * VM/CodeBlock.h:
-        * VM/ExceptionHelpers.cpp:
-        * VM/SamplingTool.h:
-        * bytecompiler/CodeGenerator.h:
-        * jsc.pro:
-        * jscore.bkl:
-        * kjs: Removed.
-        * kjs/NodeInfo.h: Removed.
-        * kjs/Parser.cpp: Removed.
-        * kjs/Parser.h: Removed.
-        * kjs/ResultType.h: Removed.
-        * kjs/SourceCode.h: Removed.
-        * kjs/SourceProvider.h: Removed.
-        * kjs/grammar.y: Removed.
-        * kjs/keywords.table: Removed.
-        * kjs/lexer.cpp: Removed.
-        * kjs/lexer.h: Removed.
-        * kjs/nodes.cpp: Removed.
-        * kjs/nodes.h: Removed.
-        * kjs/nodes2string.cpp: Removed.
-        * parser: Added.
-        * parser/Grammar.y: Copied from kjs/grammar.y.
-        * parser/Keywords.table: Copied from kjs/keywords.table.
-        * parser/Lexer.cpp: Copied from kjs/lexer.cpp.
-        * parser/Lexer.h: Copied from kjs/lexer.h.
-        * parser/NodeInfo.h: Copied from kjs/NodeInfo.h.
-        * parser/Nodes.cpp: Copied from kjs/nodes.cpp.
-        * parser/Nodes.h: Copied from kjs/nodes.h.
-        * parser/Parser.cpp: Copied from kjs/Parser.cpp.
-        * parser/Parser.h: Copied from kjs/Parser.h.
-        * parser/ResultType.h: Copied from kjs/ResultType.h.
-        * parser/SourceCode.h: Copied from kjs/SourceCode.h.
-        * parser/SourceProvider.h: Copied from kjs/SourceProvider.h.
-        * parser/nodes2string.cpp: Copied from kjs/nodes2string.cpp.
-        * pcre/pcre.pri:
-        * pcre/pcre_exec.cpp:
-        * runtime/FunctionConstructor.cpp:
-        * runtime/JSActivation.h:
-        * runtime/JSFunction.h:
-        * runtime/JSGlobalData.cpp:
-        * runtime/JSGlobalObjectFunctions.cpp:
-        * runtime/JSObject.cpp:
-        (JSC::JSObject::toNumber):
-        * runtime/RegExp.cpp:
-
-2008-11-06  Adam Roben  <aroben@apple.com>
-
-        Windows build fix after r38196
-
-        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Added bytecompiler/ to the
-        include path.
-
-2008-11-06  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        Create a new bytecompiler subdirectory of JavaScriptCore and move some
-        relevant files to it.
-
-        * AllInOneFile.cpp:
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * VM/CodeGenerator.cpp: Removed.
-        * VM/CodeGenerator.h: Removed.
-        * bytecompiler: Added.
-        * bytecompiler/CodeGenerator.cpp: Copied from VM/CodeGenerator.cpp.
-        * bytecompiler/CodeGenerator.h: Copied from VM/CodeGenerator.h.
-        * bytecompiler/LabelScope.h: Copied from kjs/LabelScope.h.
-        * jscore.bkl:
-        * kjs/LabelScope.h: Removed.
-
-2008-11-06  Adam Roben  <aroben@apple.com>
-
-        Windows clean build fix after r38155
-
-        Rubberstamped by Cameron Zwarich.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Update
-        the post-build event for the move of create_hash_table out of kjs/.
-
-2008-11-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22107
-
-        Bug uncovered during RVCT port in functions not used. get_lt() and
-        get_gt() takes only one argument - remove second argument where
-        applicable.
-
-        * wtf/AVLTree.h:
-        (JSC::AVLTree::remove): Remove second argument of get_lt/get_gt().
-        (JSC::AVLTree::subst): Ditto.
-
-2008-11-06  Alp Toker  <alp@nuanti.com>
-
-        Reviewed by Cameron Zwarich.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22033
-        [GTK] CTI/Linux r38064 crashes; JIT requires executable memory
-
-        Mark pages allocated by the FastMalloc mmap code path executable with
-        PROT_EXEC. This fixes crashes seen on CPUs and kernels that enforce
-        non-executable memory (like ExecShield on Fedora Linux) when the JIT
-        is enabled.
-
-        This patch does not resolve the issue on debug builds so affected
-        developers may still need to pass --disable-jit to configure.
-
-        * wtf/TCSystemAlloc.cpp:
-        (TryMmap):
-        (TryDevMem):
-        (TCMalloc_SystemRelease):
-
-2008-11-06  Peter Gal  <galpeter@inf.u-szeged.hu>
-
-        Reviewed by Cameron Zwarich.
-
-        Bug 22099: Make the Qt port build the JSC shell in the correct place
-        <https://bugs.webkit.org/show_bug.cgi?id=22099>
-
-        Adjust include paths and build destination dir for the 'jsc' executable
-        in the Qt build.
-
-        * jsc.pro:
-
-2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Implemented the block allocation on Symbian through heap allocation.
-
-        Unfortunately there is no way to allocate virtual memory. The Posix
-        layer provides mmap() but no anonymous mapping. So this is a very slow
-        solution but it should work as a start.
-
-        * runtime/Collector.cpp:
-        (JSC::allocateBlock):
-        (JSC::freeBlock):
-
-2008-11-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Borrow some math functions from the MSVC port to the build with the
-        RVCT compiler.
-
-        * wtf/MathExtras.h:
-        (isinf):
-        (isnan):
-        (signbit):
-
-2008-11-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Include strings.h for strncasecmp().
-        This is needed for compilation inside Symbian and it is also
-        confirmed by the man-page on Linux.
-
-        * runtime/DateMath.cpp:
-
-2008-11-06  Norbert Leser  <norbert.leser@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Implemented currentThreadStackBase for Symbian.
-
-        * runtime/Collector.cpp:
-        (JSC::currentThreadStackBase):
-
-2008-11-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        RVCT does not support tm_gmtoff field, so disable that code just like
-        for MSVC.
-
-        * runtime/DateMath.h:
-        (JSC::GregorianDateTime::GregorianDateTime):
-        (JSC::GregorianDateTime::operator tm):
-
-2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Define PLATFORM(UNIX) for S60. Effectively WebKit on S60 is compiled
-        on top of the Posix layer.
-
-        * wtf/Platform.h:
-
-2008-11-06  Norbert Leser  <norbert.leser@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Added __SYMBIAN32__ condition for defining PLATFORM(SYMBIAN).
-
-        * wtf/Platform.h:
-
-2008-11-06  Ariya Hidayat  <ariya.hidayat@trolltech.com>
-
-        Reviewed by Simon Hausmann.
-
-        Added WINSCW compiler define for Symbian S60.
-
-        * wtf/Platform.h:
-
-2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Use the GCC defines of the WTF_ALIGN* macros for the RVCT and the
-        MINSCW compiler.
-
-        * wtf/Vector.h:
-
-2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Define capabilities of the SYMBIAN platform. Some of the system
-        headers are actually dependent on RVCT.
-
-        * wtf/Platform.h:
-
-2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Add missing stddef.h header needed for compilation in Symbian.
-
-        * runtime/Collector.h:
-
-2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Added COMPILER(RVCT) to detect the ARM RVCT compiler used in the Symbian environment.
-
-        * wtf/Platform.h:
-
-2008-11-06  Simon Hausmann  <hausmann@webkit.org>
-
-        Fix the Qt build, adjust include paths after move of jsc.pro.
-
-        * jsc.pro:
-
-2008-11-06  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        Move kjs/Shell.cpp to the top level of the JavaScriptCore directory and
-        rename it to jsc.cpp to reflect the name of the binary compiled from it.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * jsc.cpp: Copied from kjs/Shell.cpp.
-        * jsc.pro:
-        * jscore.bkl:
-        * kjs/Shell.cpp: Removed.
-
-2008-11-06  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        Move create_hash_table and jsc.pro out of the kjs directory and into the
-        root directory of JavaScriptCore.
-
-        * DerivedSources.make:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * create_hash_table: Copied from kjs/create_hash_table.
-        * jsc.pro: Copied from kjs/jsc.pro.
-        * kjs/create_hash_table: Removed.
-        * kjs/jsc.pro: Removed.
-        * make-generated-sources.sh:
-
-2008-11-05  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22094
-
-        Fix for bug where the callee incorrectly recieves the caller's lexical
-        global object as this, rather than its own.  Implementation closely
-        follows the spec, passing jsNull, checking in the callee and replacing
-        with the global object where necessary.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::compileOpCall):
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_call_NotJSFunction):
-        (JSC::Machine::cti_op_call_eval):
-        * runtime/JSCell.h:
-        (JSC::JSValue::toThisObject):
-        * runtime/JSImmediate.cpp:
-        (JSC::JSImmediate::toThisObject):
-        * runtime/JSImmediate.h:
-
-2008-11-05  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix after Operations.cpp move.
-
-        * JavaScriptCoreSources.bkl:
-
-2008-11-05  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Fix the build for case-sensitive build systems and wxWindows.
-
-        * JavaScriptCoreSources.bkl:
-        * kjs/create_hash_table:
-
-2008-11-05  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Fix the build for case-sensitive build systems.
-
-        * JavaScriptCoreSources.bkl:
-        * kjs/Shell.cpp:
-        * runtime/Interpreter.cpp:
-        * runtime/JSArray.cpp:
-
-2008-11-05  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Fix the build for case-sensitive build systems.
-
-        * API/JSBase.cpp:
-        * API/JSObjectRef.cpp:
-        * runtime/CommonIdentifiers.h:
-        * runtime/Identifier.cpp:
-        * runtime/InitializeThreading.cpp:
-        * runtime/InternalFunction.h:
-        * runtime/JSString.h:
-        * runtime/Lookup.h:
-        * runtime/PropertyNameArray.h:
-        * runtime/PropertySlot.h:
-        * runtime/StructureID.cpp:
-        * runtime/StructureID.h:
-        * runtime/UString.cpp:
-
-2008-11-05  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        Move more files to the runtime subdirectory of JavaScriptCore.
-
-        * API/APICast.h:
-        * API/JSBase.cpp:
-        * API/JSCallbackObject.cpp:
-        * API/JSClassRef.cpp:
-        * API/JSClassRef.h:
-        * API/JSStringRefCF.cpp:
-        * API/JSValueRef.cpp:
-        * API/OpaqueJSString.cpp:
-        * API/OpaqueJSString.h:
-        * AllInOneFile.cpp:
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * VM/CodeBlock.h:
-        * VM/CodeGenerator.cpp:
-        * VM/Machine.cpp:
-        * VM/RegisterFile.h:
-        * debugger/Debugger.h:
-        * kjs/SourceProvider.h:
-        * kjs/TypeInfo.h: Removed.
-        * kjs/collector.cpp: Removed.
-        * kjs/collector.h: Removed.
-        * kjs/completion.h: Removed.
-        * kjs/create_hash_table:
-        * kjs/identifier.cpp: Removed.
-        * kjs/identifier.h: Removed.
-        * kjs/interpreter.cpp: Removed.
-        * kjs/interpreter.h: Removed.
-        * kjs/lexer.cpp:
-        * kjs/lexer.h:
-        * kjs/lookup.cpp: Removed.
-        * kjs/lookup.h: Removed.
-        * kjs/nodes.cpp:
-        * kjs/nodes.h:
-        * kjs/operations.cpp: Removed.
-        * kjs/operations.h: Removed.
-        * kjs/protect.h: Removed.
-        * kjs/regexp.cpp: Removed.
-        * kjs/regexp.h: Removed.
-        * kjs/ustring.cpp: Removed.
-        * kjs/ustring.h: Removed.
-        * pcre/pcre_exec.cpp:
-        * profiler/CallIdentifier.h:
-        * profiler/Profile.h:
-        * runtime/ArrayConstructor.cpp:
-        * runtime/ArrayPrototype.cpp:
-        * runtime/ArrayPrototype.h:
-        * runtime/Collector.cpp: Copied from kjs/collector.cpp.
-        * runtime/Collector.h: Copied from kjs/collector.h.
-        * runtime/CollectorHeapIterator.h:
-        * runtime/Completion.h: Copied from kjs/completion.h.
-        * runtime/ErrorPrototype.cpp:
-        * runtime/Identifier.cpp: Copied from kjs/identifier.cpp.
-        * runtime/Identifier.h: Copied from kjs/identifier.h.
-        * runtime/InitializeThreading.cpp:
-        * runtime/Interpreter.cpp: Copied from kjs/interpreter.cpp.
-        * runtime/Interpreter.h: Copied from kjs/interpreter.h.
-        * runtime/JSCell.h:
-        * runtime/JSGlobalData.cpp:
-        * runtime/JSGlobalData.h:
-        * runtime/JSLock.cpp:
-        * runtime/JSNumberCell.cpp:
-        * runtime/JSNumberCell.h:
-        * runtime/JSObject.cpp:
-        * runtime/JSValue.h:
-        * runtime/Lookup.cpp: Copied from kjs/lookup.cpp.
-        * runtime/Lookup.h: Copied from kjs/lookup.h.
-        * runtime/MathObject.cpp:
-        * runtime/NativeErrorPrototype.cpp:
-        * runtime/NumberPrototype.cpp:
-        * runtime/Operations.cpp: Copied from kjs/operations.cpp.
-        * runtime/Operations.h: Copied from kjs/operations.h.
-        * runtime/PropertyMapHashTable.h:
-        * runtime/Protect.h: Copied from kjs/protect.h.
-        * runtime/RegExp.cpp: Copied from kjs/regexp.cpp.
-        * runtime/RegExp.h: Copied from kjs/regexp.h.
-        * runtime/RegExpConstructor.cpp:
-        * runtime/RegExpObject.h:
-        * runtime/RegExpPrototype.cpp:
-        * runtime/SmallStrings.h:
-        * runtime/StringObjectThatMasqueradesAsUndefined.h:
-        * runtime/StructureID.cpp:
-        * runtime/StructureID.h:
-        * runtime/StructureIDTransitionTable.h:
-        * runtime/SymbolTable.h:
-        * runtime/TypeInfo.h: Copied from kjs/TypeInfo.h.
-        * runtime/UString.cpp: Copied from kjs/ustring.cpp.
-        * runtime/UString.h: Copied from kjs/ustring.h.
-        * wrec/CharacterClassConstructor.h:
-        * wrec/WREC.h:
-
-2008-11-05  Geoffrey Garen  <ggaren@apple.com>
-
-        Suggested by Darin Adler.
-        
-        Removed two copy constructors that the compiler can generate for us
-        automatically.
-
-        * VM/LabelID.h:
-        (JSC::LabelID::setLocation):
-        (JSC::LabelID::offsetFrom):
-        (JSC::LabelID::ref):
-        (JSC::LabelID::refCount):
-        * kjs/LabelScope.h:
-
-2008-11-05  Anders Carlsson  <andersca@apple.com>
-
-        Fix Snow Leopard build.
-        
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2008-11-04  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Steve Falkenburg.
-
-        Move dtoa.cpp and dtoa.h to the WTF Visual Studio project to reflect
-        their movement in the filesystem.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-
-2008-11-04  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        Move kjs/dtoa.h to the wtf subdirectory of JavaScriptCore.
-
-        * AllInOneFile.cpp:
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * kjs/dtoa.cpp: Removed.
-        * kjs/dtoa.h: Removed.
-        * wtf/dtoa.cpp: Copied from kjs/dtoa.cpp.
-        * wtf/dtoa.h: Copied from kjs/dtoa.h.
-
-2008-11-04  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        Move kjs/config.h to the top level of JavaScriptCore.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * config.h: Copied from kjs/config.h.
-        * kjs/config.h: Removed.
-
-2008-11-04  Darin Adler  <darin@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        * wtf/ThreadingNone.cpp: Tweak formatting.
-
-2008-11-03  Darin Adler  <darin@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=22061
-          create script to check for exit-time destructors
-
-        * JavaScriptCore.exp: Changed to export functions rather than
-        a global for the atomically initialized static mutex.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj: Added a script
-        phase that runs the check-for-exit-time-destructors script.
-
-        * wtf/MainThread.cpp:
-        (WTF::mainThreadFunctionQueueMutex): Changed to leak an object
-        rather than using an exit time destructor.
-        (WTF::functionQueue): Ditto.
-        * wtf/unicode/icu/CollatorICU.cpp:
-        (WTF::cachedCollatorMutex): Ditto.
-
-        * wtf/Threading.h: Changed other platforms to share the Windows
-        approach where the mutex is internal and the functions are exported.
-        * wtf/ThreadingGtk.cpp:
-        (WTF::lockAtomicallyInitializedStaticMutex): Ditto.
-        (WTF::unlockAtomicallyInitializedStaticMutex): Ditto.
-        * wtf/ThreadingNone.cpp:
-        (WTF::lockAtomicallyInitializedStaticMutex): Ditto.
-        (WTF::unlockAtomicallyInitializedStaticMutex): Ditto.
-        * wtf/ThreadingPthreads.cpp:
-        (WTF::threadMapMutex): Changed to leak an object rather than using
-        an exit time destructor.
-        (WTF::lockAtomicallyInitializedStaticMutex): Mutex change.
-        (WTF::unlockAtomicallyInitializedStaticMutex): Ditto.
-        (WTF::threadMap): Changed to leak an object rather than using
-        an exit time destructor.
-        * wtf/ThreadingQt.cpp:
-        (WTF::lockAtomicallyInitializedStaticMutex): Mutex change.
-        (WTF::unlockAtomicallyInitializedStaticMutex): Ditto.
-        * wtf/ThreadingWin.cpp:
-        (WTF::lockAtomicallyInitializedStaticMutex): Added an assertion.
-
-2008-11-04  Adam Roben  <aroben@apple.com>
 
-        Windows build fix
+2009-06-18  Gavin Barraclough  <barraclough@apple.com>
 
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Update
-        the location of JSStaticScopeObject.{cpp,h}.
+        Reviewed by NOBODY (Windows build fix).
 
-2008-11-04  Cameron Zwarich  <zwarich@apple.com>
+        * wtf/DateMath.cpp:
+        (WTF::calculateUTCOffset):
 
-        Reviewed by Alexey Proskuryakov.
-
-        Move AllInOneFile.cpp to the top level of JavaScriptCore.
-
-        * AllInOneFile.cpp: Copied from kjs/AllInOneFile.cpp.
-        * GNUmakefile.am:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * kjs/AllInOneFile.cpp: Removed.
-
-2008-11-04  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Alexey Proskuryakov.
-
-        Add NodeInfo.h to the JavaScriptCore Xcode project.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2008-11-03  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Maciej Stachowiak.
-
-        Move more files into the runtime subdirectory of JavaScriptCore.
-
-        * API/JSBase.cpp:
-        * API/JSCallbackConstructor.cpp:
-        * API/JSCallbackFunction.cpp:
-        * API/JSClassRef.cpp:
-        * API/OpaqueJSString.cpp:
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * kjs/AllInOneFile.cpp:
-        * kjs/ArgList.cpp: Removed.
-        * kjs/ArgList.h: Removed.
-        * kjs/Arguments.cpp: Removed.
-        * kjs/Arguments.h: Removed.
-        * kjs/BatchedTransitionOptimizer.h: Removed.
-        * kjs/CollectorHeapIterator.h: Removed.
-        * kjs/CommonIdentifiers.cpp: Removed.
-        * kjs/CommonIdentifiers.h: Removed.
-        * kjs/ExecState.cpp: Removed.
-        * kjs/ExecState.h: Removed.
-        * kjs/GetterSetter.cpp: Removed.
-        * kjs/GetterSetter.h: Removed.
-        * kjs/InitializeThreading.cpp: Removed.
-        * kjs/InitializeThreading.h: Removed.
-        * kjs/JSActivation.cpp: Removed.
-        * kjs/JSActivation.h: Removed.
-        * kjs/JSGlobalData.cpp: Removed.
-        * kjs/JSGlobalData.h: Removed.
-        * kjs/JSLock.cpp: Removed.
-        * kjs/JSLock.h: Removed.
-        * kjs/JSStaticScopeObject.cpp: Removed.
-        * kjs/JSStaticScopeObject.h: Removed.
-        * kjs/JSType.h: Removed.
-        * kjs/PropertyNameArray.cpp: Removed.
-        * kjs/PropertyNameArray.h: Removed.
-        * kjs/ScopeChain.cpp: Removed.
-        * kjs/ScopeChain.h: Removed.
-        * kjs/ScopeChainMark.h: Removed.
-        * kjs/SymbolTable.h: Removed.
-        * kjs/Tracing.d: Removed.
-        * kjs/Tracing.h: Removed.
-        * runtime/ArgList.cpp: Copied from kjs/ArgList.cpp.
-        * runtime/ArgList.h: Copied from kjs/ArgList.h.
-        * runtime/Arguments.cpp: Copied from kjs/Arguments.cpp.
-        * runtime/Arguments.h: Copied from kjs/Arguments.h.
-        * runtime/BatchedTransitionOptimizer.h: Copied from kjs/BatchedTransitionOptimizer.h.
-        * runtime/CollectorHeapIterator.h: Copied from kjs/CollectorHeapIterator.h.
-        * runtime/CommonIdentifiers.cpp: Copied from kjs/CommonIdentifiers.cpp.
-        * runtime/CommonIdentifiers.h: Copied from kjs/CommonIdentifiers.h.
-        * runtime/ExecState.cpp: Copied from kjs/ExecState.cpp.
-        * runtime/ExecState.h: Copied from kjs/ExecState.h.
-        * runtime/GetterSetter.cpp: Copied from kjs/GetterSetter.cpp.
-        * runtime/GetterSetter.h: Copied from kjs/GetterSetter.h.
-        * runtime/InitializeThreading.cpp: Copied from kjs/InitializeThreading.cpp.
-        * runtime/InitializeThreading.h: Copied from kjs/InitializeThreading.h.
-        * runtime/JSActivation.cpp: Copied from kjs/JSActivation.cpp.
-        * runtime/JSActivation.h: Copied from kjs/JSActivation.h.
-        * runtime/JSGlobalData.cpp: Copied from kjs/JSGlobalData.cpp.
-        * runtime/JSGlobalData.h: Copied from kjs/JSGlobalData.h.
-        * runtime/JSLock.cpp: Copied from kjs/JSLock.cpp.
-        * runtime/JSLock.h: Copied from kjs/JSLock.h.
-        * runtime/JSStaticScopeObject.cpp: Copied from kjs/JSStaticScopeObject.cpp.
-        * runtime/JSStaticScopeObject.h: Copied from kjs/JSStaticScopeObject.h.
-        * runtime/JSType.h: Copied from kjs/JSType.h.
-        * runtime/PropertyNameArray.cpp: Copied from kjs/PropertyNameArray.cpp.
-        * runtime/PropertyNameArray.h: Copied from kjs/PropertyNameArray.h.
-        * runtime/ScopeChain.cpp: Copied from kjs/ScopeChain.cpp.
-        * runtime/ScopeChain.h: Copied from kjs/ScopeChain.h.
-        * runtime/ScopeChainMark.h: Copied from kjs/ScopeChainMark.h.
-        * runtime/SymbolTable.h: Copied from kjs/SymbolTable.h.
-        * runtime/Tracing.d: Copied from kjs/Tracing.d.
-        * runtime/Tracing.h: Copied from kjs/Tracing.h.
-
-2008-11-03  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Move #define to turn on dumping StructureID statistics to StructureID.cpp so that
-        turning it on does not require a full rebuild. 
-
-        * runtime/StructureID.cpp:
-        (JSC::StructureID::dumpStatistics):
-        * runtime/StructureID.h:
-
-2008-11-03  Alp Toker  <alp@nuanti.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Fix warning when building on Darwin without JSC_MULTIPLE_THREADS
-        enabled.
-
-        * kjs/InitializeThreading.cpp:
-
-2008-11-02  Matt Lilek  <webkit@mattlilek.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Bug 22042: REGRESSION(r38066): ASSERTION FAILED: source in CodeBlock
-        <https://bugs.webkit.org/show_bug.cgi?id=22042>
-
-        Rename parameter name to avoid ASSERT.
-
-        * VM/CodeBlock.h:
-        (JSC::CodeBlock::CodeBlock):
-        (JSC::ProgramCodeBlock::ProgramCodeBlock):
-        (JSC::EvalCodeBlock::EvalCodeBlock):
-
-2008-11-02  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 22035: Remove the '_' suffix on constructor parameter names for structs
-        <https://bugs.webkit.org/show_bug.cgi?id=22035>
-
-        * API/JSCallbackObject.h:
-        (JSC::JSCallbackObject::JSCallbackObjectData::JSCallbackObjectData):
-        * VM/CodeBlock.h:
-        (JSC::CodeBlock::CodeBlock):
-        (JSC::ProgramCodeBlock::ProgramCodeBlock):
-        (JSC::EvalCodeBlock::EvalCodeBlock):
-        * wrec/WREC.h:
-        (JSC::Quantifier::Quantifier):
-
-2008-10-31  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Geoff Garen.
-
-        Rename SourceRange.h to SourceCode.h.
-
-        * API/JSBase.cpp:
-        * GNUmakefile.am:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CodeBlock.h:
-        * kjs/SourceCode.h: Copied from kjs/SourceRange.h.
-        * kjs/SourceRange.h: Removed.
-        * kjs/grammar.y:
-        * kjs/lexer.h:
-        * kjs/nodes.cpp:
-        (JSC::ForInNode::ForInNode):
-        * kjs/nodes.h:
-        (JSC::ThrowableExpressionData::setExceptionSourceCode):
-
-2008-10-31  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 22019: Move JSC::Interpreter::shouldPrintExceptions() to WebCore::Console
-        <https://bugs.webkit.org/show_bug.cgi?id=22019>
-
-        The JSC::Interpreter::shouldPrintExceptions() function is not used at
-        all in JavaScriptCore, so it should be moved to WebCore::Console, its
-        only user.
-
-        * JavaScriptCore.exp:
-        * kjs/interpreter.cpp:
-        * kjs/interpreter.h:
-
-2008-10-31  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Windows build fix.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-
-2008-10-31  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        Remove the call to Interpreter::setShouldPrintExceptions() from the
-        GlobalObject constructor in the shell. The shouldPrintExceptions()
-        information is not used anywhere in JavaScriptCore, only in WebCore.
-
-        * kjs/Shell.cpp:
-        (GlobalObject::GlobalObject):
-
-2008-10-31  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wxMSW build fix.
-
-        * wtf/Threading.h:
-
-2008-10-31  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        Move more files from the kjs subdirectory of JavaScriptCore to the
-        runtime subdirectory.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * kjs/AllInOneFile.cpp:
-        * kjs/RegExpConstructor.cpp: Removed.
-        * kjs/RegExpConstructor.h: Removed.
-        * kjs/RegExpMatchesArray.h: Removed.
-        * kjs/RegExpObject.cpp: Removed.
-        * kjs/RegExpObject.h: Removed.
-        * kjs/RegExpPrototype.cpp: Removed.
-        * kjs/RegExpPrototype.h: Removed.
-        * runtime/RegExpConstructor.cpp: Copied from kjs/RegExpConstructor.cpp.
-        * runtime/RegExpConstructor.h: Copied from kjs/RegExpConstructor.h.
-        * runtime/RegExpMatchesArray.h: Copied from kjs/RegExpMatchesArray.h.
-        * runtime/RegExpObject.cpp: Copied from kjs/RegExpObject.cpp.
-        * runtime/RegExpObject.h: Copied from kjs/RegExpObject.h.
-        * runtime/RegExpPrototype.cpp: Copied from kjs/RegExpPrototype.cpp.
-        * runtime/RegExpPrototype.h: Copied from kjs/RegExpPrototype.h.
-
-2008-10-31  Mark Rowe  <mrowe@apple.com>
-
-        Revert an incorrect portion of r38034.
-
-        * profiler/ProfilerServer.mm:
-
-2008-10-31  Mark Rowe  <mrowe@apple.com>
-
-        Fix the 64-bit build.
-
-        Disable strict aliasing in ProfilerServer.mm as it leads to the compiler being unhappy
-        with the common Obj-C idiom self = [super init];
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2008-10-31  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Change a header guard to match our coding style.
-
-        * kjs/InitializeThreading.h:
-
-2008-10-30  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt.
-        
-        Fixed a small bit of https://bugs.webkit.org/show_bug.cgi?id=21962
-        AST uses way too much memory
-        
-        Removed a word from StatementNode by nixing LabelStack and turning it
-        into a compile-time data structure managed by CodeGenerator.
-        
-        v8 tests and SunSpider, run by Gavin, report no change.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.order:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * kjs/AllInOneFile.cpp:
-        * JavaScriptCoreSources.bkl: I sure hope this builds!
-        
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::CodeGenerator):
-        (JSC::CodeGenerator::newLabelScope):
-        (JSC::CodeGenerator::breakTarget):
-        (JSC::CodeGenerator::continueTarget):
-        * VM/CodeGenerator.h: Nixed the JumpContext system because it depended
-        on a LabelStack in the AST, and it was a little cumbersome on the client
-        side. Replaced with LabelScope, which tracks all break / continue
-        information in the CodeGenerator, just like we track LabelIDs and other
-        stacks of compile-time data.
-
-        * kjs/LabelScope.h: Added.
-        (JSC::LabelScope::):
-        (JSC::LabelScope::LabelScope):
-        (JSC::LabelScope::ref):
-        (JSC::LabelScope::deref):
-        (JSC::LabelScope::refCount):
-        (JSC::LabelScope::breakTarget):
-        (JSC::LabelScope::continueTarget):
-        (JSC::LabelScope::type):
-        (JSC::LabelScope::name):
-        (JSC::LabelScope::scopeDepth): Simple abstraction for holding everything
-        you might want to know about a break-able / continue-able scope.
-
-        * kjs/LabelStack.cpp: Removed.
-        * kjs/LabelStack.h: Removed.
-
-        * kjs/grammar.y: No need to push labels at parse time -- we don't store
-        LabelStacks in the AST anymore.
-
-        * kjs/nodes.cpp:
-        (JSC::DoWhileNode::emitCode):
-        (JSC::WhileNode::emitCode):
-        (JSC::ForNode::emitCode):
-        (JSC::ForInNode::emitCode):
-        (JSC::ContinueNode::emitCode):
-        (JSC::BreakNode::emitCode):
-        (JSC::SwitchNode::emitCode):
-        (JSC::LabelNode::emitCode):
-        * kjs/nodes.h:
-        (JSC::StatementNode::):
-        (JSC::LabelNode::): Use LabelScope where we used to use JumpContext.
-        Simplified a bunch of code. Touched up label-related error messages a
-        bit.
-
-        * kjs/nodes2string.cpp:
-        (JSC::LabelNode::streamTo): Updated for rename.
-
-2008-10-31  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 22005: Move StructureIDChain into its own file
-        <https://bugs.webkit.org/show_bug.cgi?id=22005>
-
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * runtime/StructureID.cpp:
-        * runtime/StructureID.h:
-        * runtime/StructureIDChain.cpp: Copied from runtime/StructureID.cpp.
-        * runtime/StructureIDChain.h: Copied from runtime/StructureID.h.
-
-2008-10-31  Steve Falkenburg  <sfalken@apple.com>
-
-        Build fix.
-
-        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
-
-2008-10-31  Steve Falkenburg  <sfalken@apple.com>
-
-        Build fix.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-
-2008-10-31  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        - fix storage leak seen on buildbot
-
-        Some other cleanup too. The storage leak was caused by the fact
-        that HashTraits<CallIdentifier>::needsDestruction was false, so
-        the call identifier objects didn't get deleted.
-
-        * profiler/CallIdentifier.h:
-        
-        Added a default constructor to create empty call identifiers.
-
-        Changed the normal constructor to use const UString&
-        to avoid extra copying and reference count thrash.
-        
-        Removed the explicit copy constructor definition, since it's what
-        the compiler will automatically generate. (Rule of thumb: Either
-        you need both a custom copy constructor and a custom assignment
-        operator, or neither.)
-
-        Moved the CallIdentifier hash function out of the WTF namespace;
-        there's no reason to put it there.
-
-        Changed the CallIdentifier hash function to be a struct rather than
-        a specialization of the IntHash struct template. Having it be
-        a specialization made no sense, since CallIdentifier is not an integer,
-        and did no good.
-
-        Removed explicit definition of emptyValueIsZero in the hash traits,
-        since inheriting from GenericHashTraits already makes that false.
-
-        Removed explicit definition of emptyValue, instead relying on the
-        default constructor and GenericHashTraits.
-
-        Removed explicit definition of needsDestruction, because we want it
-        to have its default value: true, not false. This fixes the leak!
-
-        Changed constructDeletedValue and isDeletedValue to use a line number
-        of numeric_limits<unsigned>::max() to indicate a value is deleted.
-        Previously this used empty strings for the empty value and null strings
-        for the deleted value, but it's more efficient to use null for both.
-
-2008-10-31  Timothy Hatcher  <timothy@apple.com>
-
-        Emit the WillExecuteStatement debugger hook before the for loop body
-        when the statement node for the body isn't a block. This allows
-        breakpoints on those statements in the Web Inspector.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22004
-
-        Reviewed by Darin Adler.
-
-        * kjs/nodes.cpp:
-        (JSC::ForNode::emitCode): Emit the WillExecuteStatement
-        debugger hook before the statement node if isn't a block.
-        Also emit the WillExecuteStatement debugger hook for the
-        loop as the first op-code.
-        (JSC::ForInNode::emitCode): Ditto.
-
-2008-10-31  Timothy Hatcher  <timothy@apple.com>
-
-        Fixes console warnings about not having an autorelease pool.
-        Also fixes the build for Snow Leopard, by including individual
-        Foundation headers instead of Foundation.h.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21995
-
-        Reviewed by Oliver Hunt.
-
-        * profiler/ProfilerServer.mm:
-        (-[ProfilerServer init]): Create a NSAutoreleasePool and drain it.
-
-2008-10-31  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Speculative wxWindows build fix.
-
-        * JavaScriptCoreSources.bkl:
-        * jscore.bkl:
-
-2008-10-31  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Maciej Stachowiak.
-
-        Move VM/JSPropertyNameIterator.cpp and VM/JSPropertyNameIterator.h to
-        the runtime directory.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * VM/JSPropertyNameIterator.cpp: Removed.
-        * VM/JSPropertyNameIterator.h: Removed.
-        * runtime/JSPropertyNameIterator.cpp: Copied from VM/JSPropertyNameIterator.cpp.
-        * runtime/JSPropertyNameIterator.h: Copied from VM/JSPropertyNameIterator.h.
-
-2008-10-31  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Speculative wxWindows build fix.
-
-        * jscore.bkl:
-
-2008-10-30  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Jon Homeycutt.
-
-        Explicitly default to building for only the native architecture in debug and release builds.
-
-        * Configurations/DebugRelease.xcconfig:
-
-2008-10-30  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        Create a debugger directory in JavaScriptCore and move the relevant
-        files to it.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CodeBlock.cpp:
-        * VM/CodeGenerator.h:
-        * VM/Machine.cpp:
-        * debugger: Added.
-        * debugger/Debugger.cpp: Copied from kjs/debugger.cpp.
-        * debugger/Debugger.h: Copied from kjs/debugger.h.
-        * debugger/DebuggerCallFrame.cpp: Copied from kjs/DebuggerCallFrame.cpp.
-        * debugger/DebuggerCallFrame.h: Copied from kjs/DebuggerCallFrame.h.
-        * kjs/AllInOneFile.cpp:
-        * kjs/DebuggerCallFrame.cpp: Removed.
-        * kjs/DebuggerCallFrame.h: Removed.
-        * kjs/Parser.cpp:
-        * kjs/Parser.h:
-        * kjs/debugger.cpp: Removed.
-        * kjs/debugger.h: Removed.
-        * kjs/interpreter.cpp:
-        * kjs/nodes.cpp:
-        * runtime/FunctionConstructor.cpp:
-        * runtime/JSGlobalObject.cpp:
-
-2008-10-30  Benjamin K. Stuhl  <bks24@cornell.edu>
-
-        gcc 4.3.3/linux-x86 generates "suggest parentheses around && within ||"
-        warnings; add some parentheses to disambiguate things. No functional
-        changes, so no tests.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21973
-        Add parentheses to clean up some gcc warnings
-
-        Reviewed by Dan Bernstein.
-
-        * wtf/ASCIICType.h:
-        (WTF::isASCIIAlphanumeric):
-        (WTF::isASCIIHexDigit):
-
-2008-10-30  Kevin Lindeman  <klindeman@apple.com>
-
-        Adds ProfilerServer, which is a distributed notification listener
-        that allows starting and stopping the profiler remotely for use
-        in conjunction with the profiler's DTace probes.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21719
-
-        Reviewed by Timothy Hatcher.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData): Calls startProfilerServerIfNeeded.
-        * profiler/ProfilerServer.h: Added.
-        * profiler/ProfilerServer.mm: Added.
-        (+[ProfilerServer sharedProfileServer]):
-        (-[ProfilerServer init]):
-        (-[ProfilerServer startProfiling]):
-        (-[ProfilerServer stopProfiling]):
-        (JSC::startProfilerServerIfNeeded):
-
-2008-10-30  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix after PropertyMap and StructureID merge.
-
-        * JavaScriptCoreSources.bkl:
-
-2008-10-30  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        Change the JavaScriptCore Xcode project to use relative paths for the
-        PCRE source files.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2008-10-30  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Cameron Zwarich and Geoffrey Garen.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21989
-        Merge PropertyMap and StructureID
-
-        - Move PropertyMap code into StructureID in preparation for lazily
-          creating the map on gets.
-        - Make remove with transition explicit by adding removePropertyTransition.
-        - Make the put/remove without transition explicit.
-        - Make cache invalidation part of put/remove without transition.
-
-        1% speedup on SunSpider; 0.5% speedup on v8 suite.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.exp:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * kjs/AllInOneFile.cpp:
-        * kjs/identifier.h:
-        * runtime/JSObject.cpp:
-        (JSC::JSObject::removeDirect):
-        * runtime/JSObject.h:
-        (JSC::JSObject::putDirect):
-        * runtime/PropertyMap.cpp: Removed.
-        * runtime/PropertyMap.h: Removed.
-        * runtime/PropertyMapHashTable.h: Copied from runtime/PropertyMap.h.
-        * runtime/StructureID.cpp:
-        (JSC::StructureID::dumpStatistics):
-        (JSC::StructureID::StructureID):
-        (JSC::StructureID::~StructureID):
-        (JSC::StructureID::getEnumerablePropertyNames):
-        (JSC::StructureID::addPropertyTransition):
-        (JSC::StructureID::removePropertyTransition):
-        (JSC::StructureID::toDictionaryTransition):
-        (JSC::StructureID::changePrototypeTransition):
-        (JSC::StructureID::getterSetterTransition):
-        (JSC::StructureID::addPropertyWithoutTransition):
-        (JSC::StructureID::removePropertyWithoutTransition):
-        (JSC::PropertyMapStatisticsExitLogger::~PropertyMapStatisticsExitLogger):
-        (JSC::StructureID::checkConsistency):
-        (JSC::StructureID::copyPropertyTable):
-        (JSC::StructureID::get):
-        (JSC::StructureID::put):
-        (JSC::StructureID::remove):
-        (JSC::StructureID::insertIntoPropertyMapHashTable):
-        (JSC::StructureID::expandPropertyMapHashTable):
-        (JSC::StructureID::createPropertyMapHashTable):
-        (JSC::StructureID::rehashPropertyMapHashTable):
-        (JSC::comparePropertyMapEntryIndices):
-        (JSC::StructureID::getEnumerablePropertyNamesInternal):
-        * runtime/StructureID.h:
-        (JSC::StructureID::propertyStorageSize):
-        (JSC::StructureID::isEmpty):
-        (JSC::StructureID::get):
-
-2008-10-30  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 21987: CTI::putDoubleResultToJSNumberCellOrJSImmediate() hardcodes its result register
-        <https://bugs.webkit.org/show_bug.cgi?id=21987>
-
-        CTI::putDoubleResultToJSNumberCellOrJSImmediate() hardcodes its result
-        register as ecx, but it should be tempReg1, which is ecx at all of its
-        callsites.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::putDoubleResultToJSNumberCellOrJSImmediate):
-
-2008-10-30  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Bug 21985: Opcodes should use eax as their destination register whenever possible
-        <https://bugs.webkit.org/show_bug.cgi?id=21985>
-
-        Change more opcodes to use eax as the register for their final result,
-        and change calls to emitPutResult() that pass eax to rely on the default
-        value of eax.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-
-2008-10-30  Alp Toker  <alp@nuanti.com>
-
-        Build fix attempt for older gcc on the trunk-mac-intel build bot
-        (error: initializer for scalar variable requires one element).
-
-        Modify the initializer syntax slightly with an additional comma.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        (JSC::Machine::cti_op_resolve_func):
-        (JSC::Machine::cti_op_post_inc):
-        (JSC::Machine::cti_op_resolve_with_base):
-        (JSC::Machine::cti_op_post_dec):
-
-2008-10-30  Alp Toker  <alp@nuanti.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21571
-        VoidPtrPair breaks CTI on Linux
-
-        The VoidPtrPair return change made in r37457 does not work on Linux
-        since POD structs aren't passed in registers.
-
-        This patch uses a union to vectorize VoidPtrPair to a uint64_t and
-        matches Darwin/MSVC fixing CTI/WREC on Linux.
-
-        Alexey reports no measurable change in Mac performance with this fix.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        (JSC::Machine::cti_op_resolve_func):
-        (JSC::Machine::cti_op_post_inc):
-        (JSC::Machine::cti_op_resolve_with_base):
-        (JSC::Machine::cti_op_post_dec):
-        * VM/Machine.h:
-        (JSC::):
-
-2008-10-29  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Initial work to reduce cost of JSNumberCell allocation
-
-        This does the initial work needed to bring more of number
-        allocation into CTI code directly, rather than just falling
-        back onto the slow paths if we can't guarantee that a number
-        cell can be reused.
-
-        Initial implementation only used by op_negate to make sure
-        it all works.  In a negate heavy (though not dominated) test
-        it results in a 10% win in the non-reusable cell case.
-
-        * VM/CTI.cpp:
-        (JSC::):
-        (JSC::CTI::emitAllocateNumber):
-        (JSC::CTI::emitNakedFastCall):
-        (JSC::CTI::emitArithIntToImmWithJump):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitUnaryOp):
-        * VM/CodeGenerator.h:
-        (JSC::CodeGenerator::emitToJSNumber):
-        (JSC::CodeGenerator::emitTypeOf):
-        (JSC::CodeGenerator::emitGetPropertyNames):
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        * VM/Machine.h:
-        * kjs/ResultType.h:
-        (JSC::ResultType::isReusableNumber):
-        (JSC::ResultType::toInt):
-        * kjs/nodes.cpp:
-        (JSC::UnaryOpNode::emitCode):
-        (JSC::BinaryOpNode::emitCode):
-        (JSC::EqualNode::emitCode):
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::negl_r):
-        (JSC::X86Assembler::xorpd_mr):
-        * runtime/JSNumberCell.h:
-        (JSC::JSNumberCell::JSNumberCell):
-
-2008-10-29  Steve Falkenburg  <sfalken@apple.com>
-
-        <rdar://problem/6326563> Crash on launch
-
-        For Windows, export explicit functions rather than exporting data for atomicallyInitializedStaticMutex.
-        
-        Exporting data from a DLL on Windows requires specifying __declspec(dllimport) in the header used by
-        callers, but __declspec(dllexport) when defined in the DLL implementation. By instead exporting
-        the explicit lock/unlock functions, we can avoid this.
-        
-        Fixes a crash on launch, since we were previously erroneously exporting atomicallyInitializedStaticMutex as a function.
-        
-        Reviewed by Darin Adler.
-
-        * wtf/Threading.h:
-        (WTF::lockAtomicallyInitializedStaticMutex):
-        (WTF::unlockAtomicallyInitializedStaticMutex):
-        * wtf/ThreadingWin.cpp:
-        (WTF::lockAtomicallyInitializedStaticMutex):
-        (WTF::unlockAtomicallyInitializedStaticMutex):
-
-2008-10-29  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Remove direct use of PropertyMap.
-
-        * JavaScriptCore.exp:
-        * runtime/JSObject.cpp:
-        (JSC::JSObject::mark):
-        (JSC::JSObject::put):
-        (JSC::JSObject::deleteProperty):
-        (JSC::JSObject::getPropertyAttributes):
-        (JSC::JSObject::removeDirect):
-        * runtime/JSObject.h:
-        (JSC::JSObject::getDirect):
-        (JSC::JSObject::getDirectLocation):
-        (JSC::JSObject::hasCustomProperties):
-        (JSC::JSObject::JSObject):
-        (JSC::JSObject::putDirect):
-        * runtime/PropertyMap.cpp:
-        (JSC::PropertyMap::get):
-        * runtime/PropertyMap.h:
-        (JSC::PropertyMap::isEmpty):
-        (JSC::PropertyMap::get):
-        * runtime/StructureID.cpp:
-        (JSC::StructureID::dumpStatistics):
-        * runtime/StructureID.h:
-        (JSC::StructureID::propertyStorageSize):
-        (JSC::StructureID::get):
-        (JSC::StructureID::put):
-        (JSC::StructureID::remove):
-        (JSC::StructureID::isEmpty):
-
-2008-10-29  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        Rename and move the StructureID transition table to its own file.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * runtime/StructureID.cpp:
-        (JSC::StructureID::addPropertyTransition):
-        * runtime/StructureID.h:
-        (JSC::StructureID::):
-        * runtime/StructureIDTransitionTable.h: Copied from runtime/StructureID.h.
-        (JSC::StructureIDTransitionTableHash::hash):
-        (JSC::StructureIDTransitionTableHash::equal):
-
-2008-10-29  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Cameron Zwarich.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21958
-        Pack bits in StructureID to reduce the size of each StructureID by 2 words.
-
-        * runtime/PropertyMap.h:
-        (JSC::PropertyMap::propertyMapSize):
-        * runtime/StructureID.cpp:
-        (JSC::StructureID::dumpStatistics): Add additional size statistics when dumping.
-        (JSC::StructureID::StructureID):
-        * runtime/StructureID.h:
-
-2008-10-29  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fixes after addition of runtime and ImageBuffer changes.
-
-        * JavaScriptCoreSources.bkl:
-        * jscore.bkl:
-
-2008-10-29  Timothy Hatcher  <timothy@apple.com>
-
-        Emit the WillExecuteStatement debugger hook before the "else" body
-        when there is no block for the "else" body. This allows breakpoints
-        on those statements in the Web Inspector.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21944
-
-        Reviewed by Maciej Stachowiak.
-
-        * kjs/nodes.cpp:
-        (JSC::IfElseNode::emitCode): Emit the WillExecuteStatement
-        debugger hook before the else node if isn't a block.
-
-2008-10-29  Alexey Proskuryakov  <ap@webkit.org>
-
-        Build fix.
-
-        * JavaScriptCore.exp: Export HashTable::deleteTable().
-
-2008-10-28  Alp Toker  <alp@nuanti.com>
-
-        Fix builddir != srcdir builds after kjs -> runtime breakage. Sources
-        may now be generated in both kjs/ and runtime/.
-
-        Also sort the sources list for readability.
-
-        * GNUmakefile.am:
-
-2008-10-28  Alp Toker  <alp@nuanti.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Build fix attempt after kjs -> runtime rename.
-
-        * GNUmakefile.am:
-
-2008-10-28  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Remove a duplicate includes directory.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-
-2008-10-28  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Attempt to fix the Windows build.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
-
-2008-10-28  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        - export WTF::atomicallyInitializedStaticMutex
-
-        * JavaScriptCore.exp:
-
-2008-10-28  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Cameron Zwarich.
-        
-        Fixed CodeBlock dumping to accurately report constant register indices.
-
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-
-2008-10-28  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        More Qt build fixes.
-
-        * JavaScriptCore.pri:
-
-2008-10-28  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Fix the Qt build, hopefully for real this time.
-
-        * JavaScriptCore.pri:
-
-2008-10-28  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Fix the Qt build.
-
-        * JavaScriptCore.pri:
-
-2008-10-28  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Fix the Windows build.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-
-2008-10-28  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        Create a runtime directory in JavaScriptCore and begin moving files to
-        it. This is the first step towards removing the kjs directory and
-        placing files in more meaningful subdirectories of JavaScriptCore.
-
-        * API/JSBase.cpp:
-        * API/JSCallbackConstructor.cpp:
-        * API/JSCallbackConstructor.h:
-        * API/JSCallbackFunction.cpp:
-        * API/JSClassRef.cpp:
-        * API/JSClassRef.h:
-        * API/JSStringRefCF.cpp:
-        * API/JSValueRef.cpp:
-        * API/OpaqueJSString.cpp:
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * kjs/AllInOneFile.cpp:
-        * kjs/ArrayConstructor.cpp: Removed.
-        * kjs/ArrayConstructor.h: Removed.
-        * kjs/ArrayPrototype.cpp: Removed.
-        * kjs/ArrayPrototype.h: Removed.
-        * kjs/BooleanConstructor.cpp: Removed.
-        * kjs/BooleanConstructor.h: Removed.
-        * kjs/BooleanObject.cpp: Removed.
-        * kjs/BooleanObject.h: Removed.
-        * kjs/BooleanPrototype.cpp: Removed.
-        * kjs/BooleanPrototype.h: Removed.
-        * kjs/CallData.cpp: Removed.
-        * kjs/CallData.h: Removed.
-        * kjs/ClassInfo.h: Removed.
-        * kjs/ConstructData.cpp: Removed.
-        * kjs/ConstructData.h: Removed.
-        * kjs/DateConstructor.cpp: Removed.
-        * kjs/DateConstructor.h: Removed.
-        * kjs/DateInstance.cpp: Removed.
-        * kjs/DateInstance.h: Removed.
-        * kjs/DateMath.cpp: Removed.
-        * kjs/DateMath.h: Removed.
-        * kjs/DatePrototype.cpp: Removed.
-        * kjs/DatePrototype.h: Removed.
-        * kjs/Error.cpp: Removed.
-        * kjs/Error.h: Removed.
-        * kjs/ErrorConstructor.cpp: Removed.
-        * kjs/ErrorConstructor.h: Removed.
-        * kjs/ErrorInstance.cpp: Removed.
-        * kjs/ErrorInstance.h: Removed.
-        * kjs/ErrorPrototype.cpp: Removed.
-        * kjs/ErrorPrototype.h: Removed.
-        * kjs/FunctionConstructor.cpp: Removed.
-        * kjs/FunctionConstructor.h: Removed.
-        * kjs/FunctionPrototype.cpp: Removed.
-        * kjs/FunctionPrototype.h: Removed.
-        * kjs/GlobalEvalFunction.cpp: Removed.
-        * kjs/GlobalEvalFunction.h: Removed.
-        * kjs/InternalFunction.cpp: Removed.
-        * kjs/InternalFunction.h: Removed.
-        * kjs/JSArray.cpp: Removed.
-        * kjs/JSArray.h: Removed.
-        * kjs/JSCell.cpp: Removed.
-        * kjs/JSCell.h: Removed.
-        * kjs/JSFunction.cpp: Removed.
-        * kjs/JSFunction.h: Removed.
-        * kjs/JSGlobalObject.cpp: Removed.
-        * kjs/JSGlobalObject.h: Removed.
-        * kjs/JSGlobalObjectFunctions.cpp: Removed.
-        * kjs/JSGlobalObjectFunctions.h: Removed.
-        * kjs/JSImmediate.cpp: Removed.
-        * kjs/JSImmediate.h: Removed.
-        * kjs/JSNotAnObject.cpp: Removed.
-        * kjs/JSNotAnObject.h: Removed.
-        * kjs/JSNumberCell.cpp: Removed.
-        * kjs/JSNumberCell.h: Removed.
-        * kjs/JSObject.cpp: Removed.
-        * kjs/JSObject.h: Removed.
-        * kjs/JSString.cpp: Removed.
-        * kjs/JSString.h: Removed.
-        * kjs/JSValue.cpp: Removed.
-        * kjs/JSValue.h: Removed.
-        * kjs/JSVariableObject.cpp: Removed.
-        * kjs/JSVariableObject.h: Removed.
-        * kjs/JSWrapperObject.cpp: Removed.
-        * kjs/JSWrapperObject.h: Removed.
-        * kjs/MathObject.cpp: Removed.
-        * kjs/MathObject.h: Removed.
-        * kjs/NativeErrorConstructor.cpp: Removed.
-        * kjs/NativeErrorConstructor.h: Removed.
-        * kjs/NativeErrorPrototype.cpp: Removed.
-        * kjs/NativeErrorPrototype.h: Removed.
-        * kjs/NumberConstructor.cpp: Removed.
-        * kjs/NumberConstructor.h: Removed.
-        * kjs/NumberObject.cpp: Removed.
-        * kjs/NumberObject.h: Removed.
-        * kjs/NumberPrototype.cpp: Removed.
-        * kjs/NumberPrototype.h: Removed.
-        * kjs/ObjectConstructor.cpp: Removed.
-        * kjs/ObjectConstructor.h: Removed.
-        * kjs/ObjectPrototype.cpp: Removed.
-        * kjs/ObjectPrototype.h: Removed.
-        * kjs/PropertyMap.cpp: Removed.
-        * kjs/PropertyMap.h: Removed.
-        * kjs/PropertySlot.cpp: Removed.
-        * kjs/PropertySlot.h: Removed.
-        * kjs/PrototypeFunction.cpp: Removed.
-        * kjs/PrototypeFunction.h: Removed.
-        * kjs/PutPropertySlot.h: Removed.
-        * kjs/SmallStrings.cpp: Removed.
-        * kjs/SmallStrings.h: Removed.
-        * kjs/StringConstructor.cpp: Removed.
-        * kjs/StringConstructor.h: Removed.
-        * kjs/StringObject.cpp: Removed.
-        * kjs/StringObject.h: Removed.
-        * kjs/StringObjectThatMasqueradesAsUndefined.h: Removed.
-        * kjs/StringPrototype.cpp: Removed.
-        * kjs/StringPrototype.h: Removed.
-        * kjs/StructureID.cpp: Removed.
-        * kjs/StructureID.h: Removed.
-        * kjs/completion.h:
-        * kjs/interpreter.h:
-        * runtime: Added.
-        * runtime/ArrayConstructor.cpp: Copied from kjs/ArrayConstructor.cpp.
-        * runtime/ArrayConstructor.h: Copied from kjs/ArrayConstructor.h.
-        * runtime/ArrayPrototype.cpp: Copied from kjs/ArrayPrototype.cpp.
-        * runtime/ArrayPrototype.h: Copied from kjs/ArrayPrototype.h.
-        * runtime/BooleanConstructor.cpp: Copied from kjs/BooleanConstructor.cpp.
-        * runtime/BooleanConstructor.h: Copied from kjs/BooleanConstructor.h.
-        * runtime/BooleanObject.cpp: Copied from kjs/BooleanObject.cpp.
-        * runtime/BooleanObject.h: Copied from kjs/BooleanObject.h.
-        * runtime/BooleanPrototype.cpp: Copied from kjs/BooleanPrototype.cpp.
-        * runtime/BooleanPrototype.h: Copied from kjs/BooleanPrototype.h.
-        * runtime/CallData.cpp: Copied from kjs/CallData.cpp.
-        * runtime/CallData.h: Copied from kjs/CallData.h.
-        * runtime/ClassInfo.h: Copied from kjs/ClassInfo.h.
-        * runtime/ConstructData.cpp: Copied from kjs/ConstructData.cpp.
-        * runtime/ConstructData.h: Copied from kjs/ConstructData.h.
-        * runtime/DateConstructor.cpp: Copied from kjs/DateConstructor.cpp.
-        * runtime/DateConstructor.h: Copied from kjs/DateConstructor.h.
-        * runtime/DateInstance.cpp: Copied from kjs/DateInstance.cpp.
-        * runtime/DateInstance.h: Copied from kjs/DateInstance.h.
-        * runtime/DateMath.cpp: Copied from kjs/DateMath.cpp.
-        * runtime/DateMath.h: Copied from kjs/DateMath.h.
-        * runtime/DatePrototype.cpp: Copied from kjs/DatePrototype.cpp.
-        * runtime/DatePrototype.h: Copied from kjs/DatePrototype.h.
-        * runtime/Error.cpp: Copied from kjs/Error.cpp.
-        * runtime/Error.h: Copied from kjs/Error.h.
-        * runtime/ErrorConstructor.cpp: Copied from kjs/ErrorConstructor.cpp.
-        * runtime/ErrorConstructor.h: Copied from kjs/ErrorConstructor.h.
-        * runtime/ErrorInstance.cpp: Copied from kjs/ErrorInstance.cpp.
-        * runtime/ErrorInstance.h: Copied from kjs/ErrorInstance.h.
-        * runtime/ErrorPrototype.cpp: Copied from kjs/ErrorPrototype.cpp.
-        * runtime/ErrorPrototype.h: Copied from kjs/ErrorPrototype.h.
-        * runtime/FunctionConstructor.cpp: Copied from kjs/FunctionConstructor.cpp.
-        * runtime/FunctionConstructor.h: Copied from kjs/FunctionConstructor.h.
-        * runtime/FunctionPrototype.cpp: Copied from kjs/FunctionPrototype.cpp.
-        * runtime/FunctionPrototype.h: Copied from kjs/FunctionPrototype.h.
-        * runtime/GlobalEvalFunction.cpp: Copied from kjs/GlobalEvalFunction.cpp.
-        * runtime/GlobalEvalFunction.h: Copied from kjs/GlobalEvalFunction.h.
-        * runtime/InternalFunction.cpp: Copied from kjs/InternalFunction.cpp.
-        * runtime/InternalFunction.h: Copied from kjs/InternalFunction.h.
-        * runtime/JSArray.cpp: Copied from kjs/JSArray.cpp.
-        * runtime/JSArray.h: Copied from kjs/JSArray.h.
-        * runtime/JSCell.cpp: Copied from kjs/JSCell.cpp.
-        * runtime/JSCell.h: Copied from kjs/JSCell.h.
-        * runtime/JSFunction.cpp: Copied from kjs/JSFunction.cpp.
-        * runtime/JSFunction.h: Copied from kjs/JSFunction.h.
-        * runtime/JSGlobalObject.cpp: Copied from kjs/JSGlobalObject.cpp.
-        * runtime/JSGlobalObject.h: Copied from kjs/JSGlobalObject.h.
-        * runtime/JSGlobalObjectFunctions.cpp: Copied from kjs/JSGlobalObjectFunctions.cpp.
-        * runtime/JSGlobalObjectFunctions.h: Copied from kjs/JSGlobalObjectFunctions.h.
-        * runtime/JSImmediate.cpp: Copied from kjs/JSImmediate.cpp.
-        * runtime/JSImmediate.h: Copied from kjs/JSImmediate.h.
-        * runtime/JSNotAnObject.cpp: Copied from kjs/JSNotAnObject.cpp.
-        * runtime/JSNotAnObject.h: Copied from kjs/JSNotAnObject.h.
-        * runtime/JSNumberCell.cpp: Copied from kjs/JSNumberCell.cpp.
-        * runtime/JSNumberCell.h: Copied from kjs/JSNumberCell.h.
-        * runtime/JSObject.cpp: Copied from kjs/JSObject.cpp.
-        * runtime/JSObject.h: Copied from kjs/JSObject.h.
-        * runtime/JSString.cpp: Copied from kjs/JSString.cpp.
-        * runtime/JSString.h: Copied from kjs/JSString.h.
-        * runtime/JSValue.cpp: Copied from kjs/JSValue.cpp.
-        * runtime/JSValue.h: Copied from kjs/JSValue.h.
-        * runtime/JSVariableObject.cpp: Copied from kjs/JSVariableObject.cpp.
-        * runtime/JSVariableObject.h: Copied from kjs/JSVariableObject.h.
-        * runtime/JSWrapperObject.cpp: Copied from kjs/JSWrapperObject.cpp.
-        * runtime/JSWrapperObject.h: Copied from kjs/JSWrapperObject.h.
-        * runtime/MathObject.cpp: Copied from kjs/MathObject.cpp.
-        * runtime/MathObject.h: Copied from kjs/MathObject.h.
-        * runtime/NativeErrorConstructor.cpp: Copied from kjs/NativeErrorConstructor.cpp.
-        * runtime/NativeErrorConstructor.h: Copied from kjs/NativeErrorConstructor.h.
-        * runtime/NativeErrorPrototype.cpp: Copied from kjs/NativeErrorPrototype.cpp.
-        * runtime/NativeErrorPrototype.h: Copied from kjs/NativeErrorPrototype.h.
-        * runtime/NumberConstructor.cpp: Copied from kjs/NumberConstructor.cpp.
-        * runtime/NumberConstructor.h: Copied from kjs/NumberConstructor.h.
-        * runtime/NumberObject.cpp: Copied from kjs/NumberObject.cpp.
-        * runtime/NumberObject.h: Copied from kjs/NumberObject.h.
-        * runtime/NumberPrototype.cpp: Copied from kjs/NumberPrototype.cpp.
-        * runtime/NumberPrototype.h: Copied from kjs/NumberPrototype.h.
-        * runtime/ObjectConstructor.cpp: Copied from kjs/ObjectConstructor.cpp.
-        * runtime/ObjectConstructor.h: Copied from kjs/ObjectConstructor.h.
-        * runtime/ObjectPrototype.cpp: Copied from kjs/ObjectPrototype.cpp.
-        * runtime/ObjectPrototype.h: Copied from kjs/ObjectPrototype.h.
-        * runtime/PropertyMap.cpp: Copied from kjs/PropertyMap.cpp.
-        * runtime/PropertyMap.h: Copied from kjs/PropertyMap.h.
-        * runtime/PropertySlot.cpp: Copied from kjs/PropertySlot.cpp.
-        * runtime/PropertySlot.h: Copied from kjs/PropertySlot.h.
-        * runtime/PrototypeFunction.cpp: Copied from kjs/PrototypeFunction.cpp.
-        * runtime/PrototypeFunction.h: Copied from kjs/PrototypeFunction.h.
-        * runtime/PutPropertySlot.h: Copied from kjs/PutPropertySlot.h.
-        * runtime/SmallStrings.cpp: Copied from kjs/SmallStrings.cpp.
-        * runtime/SmallStrings.h: Copied from kjs/SmallStrings.h.
-        * runtime/StringConstructor.cpp: Copied from kjs/StringConstructor.cpp.
-        * runtime/StringConstructor.h: Copied from kjs/StringConstructor.h.
-        * runtime/StringObject.cpp: Copied from kjs/StringObject.cpp.
-        * runtime/StringObject.h: Copied from kjs/StringObject.h.
-        * runtime/StringObjectThatMasqueradesAsUndefined.h: Copied from kjs/StringObjectThatMasqueradesAsUndefined.h.
-        * runtime/StringPrototype.cpp: Copied from kjs/StringPrototype.cpp.
-        * runtime/StringPrototype.h: Copied from kjs/StringPrototype.h.
-        * runtime/StructureID.cpp: Copied from kjs/StructureID.cpp.
-        * runtime/StructureID.h: Copied from kjs/StructureID.h.
-
-2008-10-28  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=21919
-        Sampler reports bogus time in op_enter during 3d-raytrace.js
-        
-        Fixed a bug where we would pass the incorrect Instruction* during some
-        parts of CTI codegen.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/SamplingTool.cpp:
-        (JSC::SamplingTool::run):
-        * wtf/Platform.h:
-
-2008-10-28  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        -Removed unused includes.
-        Apparent .4% speedup in Sunspider
-
-        * kjs/JSObject.cpp:
-        * kjs/interpreter.cpp:
-
-2008-10-28  Alp Toker  <alp@nuanti.com>
-
-        Include copyright license files in the autotools dist target.
-
-        Change suggested by Mike Hommey.
-
-        * GNUmakefile.am:
-
-2008-10-27  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-        
-        Stop discarding CodeBlock samples that can't be charged to a specific
-        opcode. Instead, charge the relevant CodeBlock, and provide a footnote
-        explaining the situation.
-        
-        This will help us tell which CodeBlocks are hot, even if we can't
-        identify specific lines of code within the CodeBlocks.
-
-        * VM/SamplingTool.cpp:
-        (JSC::ScopeSampleRecord::sample):
-        (JSC::compareScopeSampleRecords):
-        (JSC::SamplingTool::dump):
-
-        * VM/SamplingTool.h:
-        (JSC::ScopeSampleRecord::ScopeSampleRecord):
-        (JSC::ScopeSampleRecord::~ScopeSampleRecord):
-
-2008-10-27  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Added a mutex around the SamplingTool's ScopeNode* map, to solve a crash
-        when sampling the v8 tests.
-
-        * VM/SamplingTool.cpp:
-        (JSC::SamplingTool::run):
-        (JSC::SamplingTool::notifyOfScope):
-        * VM/SamplingTool.h: Since new ScopeNodes can be created after
-        the SamplingTools has begun sampling, reads and writes to / from the
-        map need to be synchronized. Shark says this doesn't measurably increase
-        sampling overhead.
-
-2008-10-25  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix Windows build.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute): Provide a dummy value to the
-        HostCallRecord in CTI non-sampling builds, to silence compiler warning.
-
-2008-10-25  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix Windows build.
-
-        * VM/SamplingTool.h:
-        (JSC::SamplingTool::encodeSample): Explicitly cast bool to int, to
-        silence compiler warning.
-
-2008-10-25  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig, with Gavin Barraclough's help.
-        
-        Fixed Sampling Tool:
-            - Made CodeBlock sampling work with CTI
-            - Improved accuracy by unifying most sampling data into a single
-              32bit word, which can be written / read atomically.
-            - Split out three different #ifdefs for modularity: OPCODE_SAMPLING;
-              CODEBLOCK_SAMPLING; OPCODE_STATS.
-            - Improved reporting clarity
-            - Refactored for code clarity
-
-        * JavaScriptCore.exp: Exported another symbol.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitCTICall):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::emitSlowScriptCheck):
-        (JSC::CTI::compileBinaryArithOpSlowCase):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        * VM/CTI.h: Updated CTI codegen to use the unified SamplingTool interface
-        for encoding samples. (This required passing the current vPC to a lot
-        more functions, since the unified interface samples the current vPC.)
-        Added hooks for writing the current CodeBlock* on function entry and
-        after a function call, for the sake of the CodeBlock sampler. Removed
-        obsolete hook for clearing the current sample inside op_end. Also removed
-        the custom enum used to differentiate flavors of op_call, since the
-        OpcodeID enum works just as well. (This was important in an earlier
-        version of the patch, but now it's just cleanup.)
-
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::lineNumberForVPC):
-        * VM/CodeBlock.h: Upated for refactored #ifdefs. Changed lineNumberForVPC
-        to be robust against vPCs not recorded for exception handling, since
-        the Sampler may ask for an arbitrary vPC.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::execute):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_call_NotJSFunction):
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-        * VM/Machine.h:
-        (JSC::Machine::setSampler):
-        (JSC::Machine::sampler):
-        (JSC::Machine::jitCodeBuffer): Upated for refactored #ifdefs. Changed
-        Machine to use SamplingTool helper objects to record movement in and
-        out of host code. This makes samples a bit more precise.
-        
-        * VM/Opcode.cpp:
-        (JSC::OpcodeStats::~OpcodeStats):
-        * VM/Opcode.h: Upated for refactored #ifdefs. Added a little more padding,
-        to accomodate our more verbose opcode names.
-
-        * VM/SamplingTool.cpp:
-        (JSC::ScopeSampleRecord::sample): Only count a sample toward our total
-        if we actually record it. This solves cases where a CodeBlock will
-        claim to have been sampled many times, with reported samples that don't
-        match.
-
-        (JSC::SamplingTool::run): Read the current sample into a Sample helper
-        object, to ensure that the data doesn't change while we're analyzing it,
-        and to help decode the data. Only access the CodeBlock sampling hash
-        table if CodeBlock sampling has been enabled, so non-CodeBlock sampling
-        runs can operate with even less overhead.
-
-        (JSC::SamplingTool::dump): I reorganized this code a lot to print the
-        most important info at the top, print as a table, annotate and document
-        the stuff I didn't understand when I started, etc.
-
-        * VM/SamplingTool.h: New helper classes, described above.
-
-        * kjs/Parser.h:
-        * kjs/Shell.cpp:
-        (runWithScripts):
-        * kjs/nodes.cpp:
-        (JSC::ScopeNode::ScopeNode): Updated for new sampling APIs.
-
-        * wtf/Platform.h: Moved sampling #defines here, since our custom is to
-        put ENABLE #defines into Platform.h. Made explicit the fact that
-        CODEBLOCK_SAMPLING depends on OPCODE_SAMPLING.
-
-2008-10-25  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        JSC Build fix, not reviewed.
-
-        * VM/CTI.cpp: add missing include stdio.h for debug builds
-
-2008-10-24  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Darin Adler.
-        
-        Get rid of a bonus ASSERT when using a null string as a regexp.
-        Specifically calling: RegularExpression::match() with String::empty()
-        will hit this ASSERT.
-        Chromium hits this, but I don't know of any way to make a layout test.
-
-        * pcre/pcre_exec.cpp:
-        (jsRegExpExecute):
-
-2008-10-24  Alexey Proskuryakov  <ap@webkit.org>
-
-        Suggested and rubber-stamped by Geoff Garen.
-
-        Fix a crash when opening Font Picker.
-
-        The change also hopefully fixes this bug, which I could never reproduce:
-        https://bugs.webkit.org/show_bug.cgi?id=20241
-        <rdar://problem/6290576> Safari crashes at JSValueUnprotect() when fontpicker view close
-
-        * API/JSContextRef.cpp: (JSContextGetGlobalObject): Use lexical global object instead of
-        dynamic one.
-
-2008-10-24  Cameron Zwarich  <zwarich@apple.com>
+2009-06-18  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Geoff Garen.
 
-        Remove ScopeChainNode::bottom() and inline it into its only caller,
-        ScopeChainnode::globalObject().
-
-        * kjs/JSGlobalObject.h:
-        (JSC::ScopeChainNode::globalObject):
-        * kjs/ScopeChain.h:
-        (JSC::ScopeChain::bottom):
-
-2008-10-24  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Maciej Stachowiak.
+        Timezone calculation incorrect in Venezuela.
 
-        Bug 21862: Create JSFunction prototype property lazily
-        <https://bugs.webkit.org/show_bug.cgi?id=21862>
+        https://bugs.webkit.org/show_bug.cgi?id=26531
+        <rdar://problem/6646169> Time is incorrectly reported to JavaScript in both Safari 3 and Firefox 3
 
-        This is a 1.5% speedup on SunSpider and a 1.4% speedup on the V8
-        benchmark suite, including a 3.8% speedup on Earley-Boyer.
+        The problem is that we're calculating the timezone relative to 01/01/2000,
+        but the VET timezone changed from -4 hours to -4:30 hours on 12/09/2007.
+        According to the spec, section 15.9.1.9 states "the time since the beginning
+        of the year", presumably meaning the *current* year.  Change the calculation
+        to be based on whatever the current year is, rather than a canned date.
 
-        * kjs/JSFunction.cpp:
-        (JSC::JSFunction::getOwnPropertySlot):
-        * kjs/nodes.cpp:
-        (JSC::FuncDeclNode::makeFunction):
-        (JSC::FuncExprNode::makeFunction):
-
-2008-10-24  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21475
-        
-        Provide support for the Geolocation API
-        
-        http://dev.w3.org/geo/api/spec-source.html
-
-        * wtf/Platform.h: ENABLE_GEOLOCATION defaults to 0
-
-2008-10-24  Darin Adler  <darin@apple.com>
-
-        - finish rolling out https://bugs.webkit.org/show_bug.cgi?id=21732
-
-        * API/APICast.h:
-        * API/JSCallbackConstructor.h:
-        * API/JSCallbackFunction.cpp:
-        * API/JSCallbackFunction.h:
-        * API/JSCallbackObject.h:
-        * API/JSCallbackObjectFunctions.h:
-        * API/JSContextRef.cpp:
-        * API/JSObjectRef.cpp:
-        * API/JSValueRef.cpp:
-        * VM/CTI.cpp:
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        * VM/CodeBlock.h:
-        * VM/CodeGenerator.cpp:
-        * VM/CodeGenerator.h:
-        * VM/ExceptionHelpers.cpp:
-        * VM/ExceptionHelpers.h:
-        * VM/JSPropertyNameIterator.cpp:
-        * VM/JSPropertyNameIterator.h:
-        * VM/Machine.cpp:
-        * VM/Machine.h:
-        * VM/Register.h:
-        * kjs/ArgList.cpp:
-        * kjs/ArgList.h:
-        * kjs/Arguments.cpp:
-        * kjs/Arguments.h:
-        * kjs/ArrayConstructor.cpp:
-        * kjs/ArrayPrototype.cpp:
-        * kjs/BooleanConstructor.cpp:
-        * kjs/BooleanConstructor.h:
-        * kjs/BooleanObject.h:
-        * kjs/BooleanPrototype.cpp:
-        * kjs/CallData.cpp:
-        * kjs/CallData.h:
-        * kjs/ConstructData.cpp:
-        * kjs/ConstructData.h:
-        * kjs/DateConstructor.cpp:
-        * kjs/DateInstance.h:
-        * kjs/DatePrototype.cpp:
-        * kjs/DatePrototype.h:
-        * kjs/DebuggerCallFrame.cpp:
-        * kjs/DebuggerCallFrame.h:
-        * kjs/ErrorConstructor.cpp:
-        * kjs/ErrorPrototype.cpp:
-        * kjs/ExecState.cpp:
-        * kjs/ExecState.h:
-        * kjs/FunctionConstructor.cpp:
-        * kjs/FunctionPrototype.cpp:
-        * kjs/FunctionPrototype.h:
-        * kjs/GetterSetter.cpp:
-        * kjs/GetterSetter.h:
-        * kjs/InternalFunction.h:
-        * kjs/JSActivation.cpp:
-        * kjs/JSActivation.h:
-        * kjs/JSArray.cpp:
-        * kjs/JSArray.h:
-        * kjs/JSCell.cpp:
-        * kjs/JSCell.h:
-        * kjs/JSFunction.cpp:
-        * kjs/JSFunction.h:
-        * kjs/JSGlobalData.h:
-        * kjs/JSGlobalObject.cpp:
-        * kjs/JSGlobalObject.h:
-        * kjs/JSGlobalObjectFunctions.cpp:
-        * kjs/JSGlobalObjectFunctions.h:
-        * kjs/JSImmediate.cpp:
-        * kjs/JSImmediate.h:
-        * kjs/JSNotAnObject.cpp:
-        * kjs/JSNotAnObject.h:
-        * kjs/JSNumberCell.cpp:
-        * kjs/JSNumberCell.h:
-        * kjs/JSObject.cpp:
-        * kjs/JSObject.h:
-        * kjs/JSStaticScopeObject.cpp:
-        * kjs/JSStaticScopeObject.h:
-        * kjs/JSString.cpp:
-        * kjs/JSString.h:
-        * kjs/JSValue.h:
-        * kjs/JSVariableObject.h:
-        * kjs/JSWrapperObject.h:
-        * kjs/MathObject.cpp:
-        * kjs/MathObject.h:
-        * kjs/NativeErrorConstructor.cpp:
-        * kjs/NumberConstructor.cpp:
-        * kjs/NumberConstructor.h:
-        * kjs/NumberObject.cpp:
-        * kjs/NumberObject.h:
-        * kjs/NumberPrototype.cpp:
-        * kjs/ObjectConstructor.cpp:
-        * kjs/ObjectPrototype.cpp:
-        * kjs/ObjectPrototype.h:
-        * kjs/PropertyMap.h:
-        * kjs/PropertySlot.cpp:
-        * kjs/PropertySlot.h:
-        * kjs/RegExpConstructor.cpp:
-        * kjs/RegExpConstructor.h:
-        * kjs/RegExpMatchesArray.h:
-        * kjs/RegExpObject.cpp:
-        * kjs/RegExpObject.h:
-        * kjs/RegExpPrototype.cpp:
-        * kjs/Shell.cpp:
-        * kjs/StringConstructor.cpp:
-        * kjs/StringObject.cpp:
-        * kjs/StringObject.h:
-        * kjs/StringObjectThatMasqueradesAsUndefined.h:
-        * kjs/StringPrototype.cpp:
-        * kjs/StructureID.cpp:
-        * kjs/StructureID.h:
-        * kjs/collector.cpp:
-        * kjs/collector.h:
-        * kjs/completion.h:
-        * kjs/grammar.y:
-        * kjs/interpreter.cpp:
-        * kjs/interpreter.h:
-        * kjs/lookup.cpp:
-        * kjs/lookup.h:
-        * kjs/nodes.h:
-        * kjs/operations.cpp:
-        * kjs/operations.h:
-        * kjs/protect.h:
-        * profiler/ProfileGenerator.cpp:
-        * profiler/Profiler.cpp:
-        * profiler/Profiler.h:
-        Use JSValue* instead of JSValuePtr.
-
-2008-10-24  David Kilzer  <ddkilzer@apple.com>
-
-        Rolled out r37840.
-
-        * wtf/Platform.h:
-
-2008-10-23  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21475
-        
-        Provide support for the Geolocation API
-        
-        http://dev.w3.org/geo/api/spec-source.html
-
-        * wtf/Platform.h: ENABLE_GEOLOCATION defaults to 0
-
-2008-10-23  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 21832: Fix scripts using 'new File::Temp' for Perl 5.10
-
-        <https://bugs.webkit.org/show_bug.cgi?id=21832>
-
-        Reviewed by Sam Weinig.
-
-        * pcre/dftables: Use imported tempfile() from File::Temp instead of
-        'new File::Temp' to make the script work with Perl 5.10.
-
-2008-10-23  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Fix hideous pathological case performance when looking up repatch info, bug #21727.
-
-        When repatching JIT code to optimize we look up records providing information about
-        the generated code (also used to track recsources used in linking to be later released). 
-        The lookup was being performed using a linear scan of all such records.
-
-        (1) Split up the different types of reptach information.  This means we can search them
-            separately, and in some cases should reduce their size.
-        (2) In the case of property accesses, search with a binary chop over the data.
-        (3) In the case of calls, pass a pointer to the repatch info into the relink function.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::CTI):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        (JSC::CTI::unlinkCall):
-        (JSC::CTI::linkCall):
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::~CodeBlock):
-        (JSC::CodeBlock::unlinkCallers):
-        (JSC::CodeBlock::derefStructureIDs):
-        * VM/CodeBlock.h:
-        (JSC::StructureStubInfo::StructureStubInfo):
-        (JSC::CallLinkInfo::CallLinkInfo):
-        (JSC::CallLinkInfo::setUnlinked):
-        (JSC::CallLinkInfo::isLinked):
-        (JSC::getStructureStubInfoReturnLocation):
-        (JSC::binaryChop):
-        (JSC::CodeBlock::addCaller):
-        (JSC::CodeBlock::getStubInfo):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitResolve):
-        (JSC::CodeGenerator::emitGetById):
-        (JSC::CodeGenerator::emitPutById):
-        (JSC::CodeGenerator::emitCall):
-        (JSC::CodeGenerator::emitConstruct):
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_vm_lazyLinkCall):
-
-2008-10-23  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Adam Roben.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21833
-        Place JavaScript Debugger hooks under #if ENABLE(JAVASCRIPT_DEBUGGER).
-
-        * wtf/Platform.h:
-
-2008-10-23  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 21831: Fix create_hash_table for Perl 5.10
-
-        <https://bugs.webkit.org/show_bug.cgi?id=21831>
-
-        Reviewed by Sam Weinig.
-
-        * kjs/create_hash_table: Escaped square brackets so that Perl 5.10
-        doesn't try to use @nameEntries.
-
-2008-10-23  Darin Adler  <darin@apple.com>
-
-        - roll out https://bugs.webkit.org/show_bug.cgi?id=21732
-          to remove the JSValuePtr class, to fix two problems
-
-            1) slowness under MSVC, since it doesn't handle a
-               class with a single pointer in it as efficiently
-               as a pointer
-
-            2) uninitialized pointers in Vector
-
-        * JavaScriptCore.exp: Updated.
-
-        * API/APICast.h:
-        (toRef):
-        * VM/CTI.cpp:
-        (JSC::CTI::asInteger):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::addConstant):
-        * VM/CodeGenerator.h:
-        (JSC::CodeGenerator::JSValueHashTraits::constructDeletedValue):
-        (JSC::CodeGenerator::JSValueHashTraits::isDeletedValue):
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_add):
-        (JSC::Machine::cti_op_pre_inc):
-        (JSC::Machine::cti_op_get_by_id):
-        (JSC::Machine::cti_op_get_by_id_second):
-        (JSC::Machine::cti_op_get_by_id_generic):
-        (JSC::Machine::cti_op_get_by_id_fail):
-        (JSC::Machine::cti_op_instanceof):
-        (JSC::Machine::cti_op_del_by_id):
-        (JSC::Machine::cti_op_mul):
-        (JSC::Machine::cti_op_call_NotJSFunction):
-        (JSC::Machine::cti_op_resolve):
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-        (JSC::Machine::cti_op_get_by_val):
-        (JSC::Machine::cti_op_sub):
-        (JSC::Machine::cti_op_lesseq):
-        (JSC::Machine::cti_op_negate):
-        (JSC::Machine::cti_op_resolve_base):
-        (JSC::Machine::cti_op_resolve_skip):
-        (JSC::Machine::cti_op_resolve_global):
-        (JSC::Machine::cti_op_div):
-        (JSC::Machine::cti_op_pre_dec):
-        (JSC::Machine::cti_op_not):
-        (JSC::Machine::cti_op_eq):
-        (JSC::Machine::cti_op_lshift):
-        (JSC::Machine::cti_op_bitand):
-        (JSC::Machine::cti_op_rshift):
-        (JSC::Machine::cti_op_bitnot):
-        (JSC::Machine::cti_op_mod):
-        (JSC::Machine::cti_op_less):
-        (JSC::Machine::cti_op_neq):
-        (JSC::Machine::cti_op_urshift):
-        (JSC::Machine::cti_op_bitxor):
-        (JSC::Machine::cti_op_bitor):
-        (JSC::Machine::cti_op_call_eval):
-        (JSC::Machine::cti_op_throw):
-        (JSC::Machine::cti_op_next_pname):
-        (JSC::Machine::cti_op_typeof):
-        (JSC::Machine::cti_op_is_undefined):
-        (JSC::Machine::cti_op_is_boolean):
-        (JSC::Machine::cti_op_is_number):
-        (JSC::Machine::cti_op_is_string):
-        (JSC::Machine::cti_op_is_object):
-        (JSC::Machine::cti_op_is_function):
-        (JSC::Machine::cti_op_stricteq):
-        (JSC::Machine::cti_op_nstricteq):
-        (JSC::Machine::cti_op_to_jsnumber):
-        (JSC::Machine::cti_op_in):
-        (JSC::Machine::cti_op_del_by_val):
-        (JSC::Machine::cti_vm_throw):
-        Removed calls to payload functions.
-
-        * VM/Register.h:
-        (JSC::Register::Register): Removed overload for JSCell and call
-        to payload function.
-
-        * kjs/JSCell.h: Changed JSCell to derive from JSValue again.
-        Removed JSValuePtr constructor.
-        (JSC::asCell): Changed cast from reinterpret_cast to static_cast.
-
-        * kjs/JSImmediate.h: Removed JSValuePtr class. Added typedef back.
-
-        * kjs/JSValue.h:
-        (JSC::JSValue::JSValue): Added empty protected inline constructor back.
-        (JSC::JSValue::~JSValue): Same for destructor.
-        Removed == and != operator for JSValuePtr.
-
-        * kjs/PropertySlot.h:
-        (JSC::PropertySlot::PropertySlot): Chnaged argument to const JSValue*
-        and added a const_cast.
-
-        * kjs/protect.h: Removed overloads and specialization for JSValuePtr.
-
-2008-10-22  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Really "fix" CTI mode on windows 2k3.
-
-        This adds new methods fastMallocExecutable and fastFreeExecutable
-        to wrap allocation for cti code.  This still just makes fastMalloc
-        return executable memory all the time, which will be fixed in a
-        later patch.
-
-        However in windows debug builds all executable allocations will be
-        allocated on separate executable pages, which should resolve any
-        remaining 2k3 issues.  Conveniently the 2k3 bot will now also fail
-        if there are any fastFree vs. fastFreeExecutable errors.
-
-        * ChangeLog:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::~CodeBlock):
-        * kjs/regexp.cpp:
-        (JSC::RegExp::~RegExp):
-        * masm/X86Assembler.h:
-        (JSC::JITCodeBuffer::copy):
-        * wtf/FastMalloc.cpp:
-        (WTF::fastMallocExecutable):
-        (WTF::fastFreeExecutable):
-        (WTF::TCMallocStats::fastMallocExecutable):
-        (WTF::TCMallocStats::fastFreeExecutable):
-        * wtf/FastMalloc.h:
-
-2008-10-22  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=21294
-          Bug 21294: Devirtualize getOwnPropertySlot()
-
-        A bit over 3% faster on V8 tests.
-
-        * JavascriptCore.exp: Export leak-related functions..
-
-        * API/JSCallbackConstructor.h:
-        (JSC::JSCallbackConstructor::createStructureID): Set HasStandardGetOwnPropertySlot
-        since this class doesn't override getPropertySlot.
-        * API/JSCallbackFunction.h:
-        (JSC::JSCallbackFunction::createStructureID): Ditto.
-
-        * VM/ExceptionHelpers.cpp:
-        (JSC::InterruptedExecutionError::InterruptedExecutionError): Use a structure
-        that's created just for this class instead of trying to share a single "null
-        prototype" structure.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_create_arguments_no_params): Rename
-        Arguments::ArgumentsNoParameters to Arguments::NoParameters.
-        
-        * kjs/Arguments.h: Rename the enum from Arguments::ArgumentsParameters to
-        Arguments::NoParametersType and the value from Arguments::ArgumentsNoParameters
-        to Arguments::NoParameters.
-        (JSC::Arguments::createStructureID): Added. Returns a structure without
-        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
-        (JSC::Arguments::Arguments): Added an assertion that there are no parameters.
-
-        * kjs/DatePrototype.h:
-        (JSC::DatePrototype::createStructureID): Added. Returns a structure without
-        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
-
-        * kjs/FunctionPrototype.h:
-        (JSC::FunctionPrototype::createStructureID): Set HasStandardGetOwnPropertySlot
-        since this class doesn't override getPropertySlot.
-        * kjs/InternalFunction.h:
-        (JSC::InternalFunction::createStructureID): Ditto.
-
-        * kjs/JSArray.h:
-        (JSC::JSArray::createStructureID): Added. Returns a structure without
-        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
-
-        * kjs/JSCell.h: Added declaration of fastGetOwnPropertySlot; a non-virtual
-        version that uses the structure bit to decide whether to call the virtual
-        version.
-
-        * kjs/JSFunction.h:
-        (JSC::JSFunction::createStructureID): Added. Returns a structure without
-        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
-
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData): Initialize new structures; removed
-        nullProtoStructureID.
-        * kjs/JSGlobalData.h: Added new structures. Removed nullProtoStructureID.
-
-        * kjs/JSGlobalObject.h:
-        (JSC::JSGlobalObject::createStructureID): Added. Returns a structure without
-        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
-
-        * kjs/JSNotAnObject.h:
-        (JSC::JSNotAnObjectErrorStub::JSNotAnObjectErrorStub): Use a structure
-        that's created just for this class instead of trying to share a single "null
-        prototype" structure.
-        (JSC::JSNotAnObjectErrorStub::isNotAnObjectErrorStub): Marked this function
-        virtual for clarity and made it private since no one should call it if they
-        already have a pointer to this specific type.
-        (JSC::JSNotAnObject::JSNotAnObject): Use a structure that's created just
-        for this class instead of trying to share a single "null prototype" structure.
-        (JSC::JSNotAnObject::createStructureID): Added. Returns a structure without
-        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
-
-        * kjs/JSObject.h:
-        (JSC::JSObject::createStructureID): Added HasStandardGetOwnPropertySlot.
-        (JSC::JSObject::inlineGetOwnPropertySlot): Added. Used so we can share code
-        between getOwnPropertySlot and fastGetOwnPropertySlot.
-        (JSC::JSObject::getOwnPropertySlot): Moved so that functions are above the
-        functions that call them. Moved the guts of this function into
-        inlineGetOwnPropertySlot.
-        (JSC::JSCell::fastGetOwnPropertySlot): Added. Checks the
-        HasStandardGetOwnPropertySlot bit and if it's set, calls
-        inlineGetOwnPropertySlot, otherwise calls getOwnPropertySlot.
-        (JSC::JSObject::getPropertySlot): Changed to call fastGetOwnPropertySlot.
-        (JSC::JSValue::get): Changed to call fastGetOwnPropertySlot.
-
-        * kjs/JSWrapperObject.h: Made constructor protected to emphasize that
-        this class is only a base class and never instantiated.
-
-        * kjs/MathObject.h:
-        (JSC::MathObject::createStructureID): Added. Returns a structure without
-        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
-        * kjs/NumberConstructor.h:
-        (JSC::NumberConstructor::createStructureID): Ditto.
-        * kjs/RegExpConstructor.h:
-        (JSC::RegExpConstructor::createStructureID): Ditto.
-        * kjs/RegExpObject.h:
-        (JSC::RegExpObject::createStructureID): Ditto.
-        * kjs/StringObject.h:
-        (JSC::StringObject::createStructureID): Ditto.
-
-        * kjs/TypeInfo.h: Added HasStandardGetOwnPropertySlot flag and
-        hasStandardGetOwnPropertySlot accessor function.
-
-2008-10-22  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Bug 21803: Fuse op_jfalse with op_eq_null and op_neq_null
-        <https://bugs.webkit.org/show_bug.cgi?id=21803>
-
-        Fuse op_jfalse with op_eq_null and op_neq_null to make the new opcodes
-        op_jeq_null and op_jneq_null.
-
-        This is a 2.6% speedup on the V8 Raytrace benchmark, and strangely also
-        a 4.7% speedup on the V8 Arguments benchmark, even though it uses
-        neither of the two new opcodes.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitJumpIfTrue):
-        (JSC::CodeGenerator::emitJumpIfFalse):
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        * VM/Opcode.h:
-
-2008-10-22  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Should not define PLATFORM(WIN,MAC,GTK) when PLATFORM(CHROMIUM) is defined
-        https://bugs.webkit.org/show_bug.cgi?id=21757
-
-        PLATFORM(CHROMIUM) implies HAVE_ACCESSIBILITY
-
-        * wtf/Platform.h:
-
-2008-10-22  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Correct opcode names in documentation.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-
-2008-10-21  Oliver Hunt <oliver@apple.com>
-
-        RS=Maciej Stachowiak.
-
-        Force FastMalloc to make all allocated pages executable in
-        a vague hope this will allow the Win2k3 bot to be able to
-        run tests.
-
-        Filed Bug 21783: Need more granular control over allocation of executable memory
-        to cover a more granular version of this patch.
-
-        * wtf/TCSystemAlloc.cpp:
-        (TryVirtualAlloc):
-
-2008-10-21  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21769
-        MessagePort should be GC protected if there are messages to be delivered
-
-        * wtf/MessageQueue.h:
-        (WTF::::isEmpty): Added. Also added a warning for methods that return a snapshot of queue
-        state, thus likely to cause race conditions.
-
-2008-10-21  Darin Adler  <darin@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        - convert post-increment to pre-increment in a couple more places for speed
-
-        Speeds up V8 benchmarks a little on most computers. (But, strangely, slows
-        them down a little on my computer.)
-
-        * kjs/nodes.cpp:
-        (JSC::statementListEmitCode): Removed default argument, since we always want
-        to specify this explicitly.
-        (JSC::ForNode::emitCode): Tolerate ignoredResult() as the dst -- means the
-        same thing as 0.
-        (JSC::ReturnNode::emitCode): Ditto.
-        (JSC::ThrowNode::emitCode): Ditto.
-        (JSC::FunctionBodyNode::emitCode): Pass ignoredResult() so that we know we
-        don't have to compute the result of function statements.
-
-2008-10-21  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Fix an include of a non-public header to use "" instead of <>.
-
-        * API/JSProfilerPrivate.cpp:
-
-2008-10-20  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Cameron Zwarich.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21766
-        REGRESSION: 12 JSC tests fail
-
-        The JSGlobalObject was mutating the shared nullProtoStructureID when
-        used in jsc.  Instead of using nullProtoStructureID, use a new StructureID.
-
-        * API/JSCallbackObject.h:
-        * API/JSCallbackObjectFunctions.h:
-        (JSC::::JSCallbackObject):
-        * API/JSContextRef.cpp:
-        (JSGlobalContextCreateInGroup):
-        * kjs/JSGlobalObject.h:
-        (JSC::JSGlobalObject::JSGlobalObject):
-        * kjs/Shell.cpp:
-        (GlobalObject::GlobalObject):
-        (jscmain):
-
-2008-10-20  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Remove an untaken branch in CodeGenerator::emitJumpIfFalse(). This
-        function is never called with a backwards target LabelID, and there is
-        even an assertion to this effect at the top of the function body.
-
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitJumpIfFalse):
-
-2008-10-20  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        Add opcode documentation for undocumented opcodes.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-
-2008-10-16  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Cameron Zwarich.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21683
-        Don't create intermediate StructureIDs for builtin objects
-
-        Second stage in reduce number of StructureIDs created when initializing the
-        JSGlobalObject.
-
-        - Use putDirectWithoutTransition for the remaining singleton objects to reduce
-          the number of StructureIDs create for about:blank from 132 to 73.
-
-        * kjs/ArrayConstructor.cpp:
-        (JSC::ArrayConstructor::ArrayConstructor):
-        * kjs/BooleanConstructor.cpp:
-        (JSC::BooleanConstructor::BooleanConstructor):
-        * kjs/BooleanPrototype.cpp:
-        (JSC::BooleanPrototype::BooleanPrototype):
-        * kjs/DateConstructor.cpp:
-        (JSC::DateConstructor::DateConstructor):
-        * kjs/ErrorConstructor.cpp:
-        (JSC::ErrorConstructor::ErrorConstructor):
-        * kjs/ErrorPrototype.cpp:
-        (JSC::ErrorPrototype::ErrorPrototype):
-        * kjs/FunctionConstructor.cpp:
-        (JSC::FunctionConstructor::FunctionConstructor):
-        * kjs/FunctionPrototype.cpp:
-        (JSC::FunctionPrototype::FunctionPrototype):
-        (JSC::FunctionPrototype::addFunctionProperties):
-        * kjs/FunctionPrototype.h:
-        (JSC::FunctionPrototype::createStructureID):
-        * kjs/InternalFunction.cpp:
-        * kjs/InternalFunction.h:
-        (JSC::InternalFunction::InternalFunction):
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::reset):
-        * kjs/JSObject.h:
-        * kjs/MathObject.cpp:
-        (JSC::MathObject::MathObject):
-        * kjs/NumberConstructor.cpp:
-        (JSC::NumberConstructor::NumberConstructor):
-        * kjs/NumberPrototype.cpp:
-        (JSC::NumberPrototype::NumberPrototype):
-        * kjs/ObjectConstructor.cpp:
-        (JSC::ObjectConstructor::ObjectConstructor):
-        * kjs/RegExpConstructor.cpp:
-        (JSC::RegExpConstructor::RegExpConstructor):
-        * kjs/RegExpPrototype.cpp:
-        (JSC::RegExpPrototype::RegExpPrototype):
-        * kjs/StringConstructor.cpp:
-        (JSC::StringConstructor::StringConstructor):
-        * kjs/StringPrototype.cpp:
-        (JSC::StringPrototype::StringPrototype):
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::dumpStatistics):
-        * kjs/StructureID.h:
-        (JSC::StructureID::setPrototypeWithoutTransition):
-
-2008-10-20  Alp Toker  <alp@nuanti.com>
-
-        Fix autotools dist build target by listing recently added header
-        files only. Not reviewed.
-
-        * GNUmakefile.am:
-
-2008-10-20  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::tryCacheGetByID): Removed a redundant and sometimes
-        incorrect cast, which started ASSERTing after Darin's last checkin.
-
-2008-10-20  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Re-enable CTI, which I accidentally disabled while checking in fixes
-        to bytecode.
-
-        * wtf/Platform.h:
-
-2008-10-20  Alp Toker  <alp@nuanti.com>
-
-        Rubber-stamped by Mark Rowe.
-
-        Typo fix in function name: mimimum -> minimum.
-
-        * kjs/DateMath.cpp:
-        (JSC::minimumYearForDST):
-        (JSC::equivalentYearForDST):
-
-2008-10-20  Alp Toker  <alp@nuanti.com>
-
-        Reviewed by Mark Rowe.
-
-        Use pthread instead of GThread where possible in the GTK+ port. This
-        fixes issues with global initialisation, particularly on GTK+/Win32
-        where a late g_thread_init() will cause hangs.
-
-        * GNUmakefile.am:
-        * wtf/Platform.h:
-        * wtf/Threading.h:
-        * wtf/ThreadingGtk.cpp:
-        * wtf/ThreadingPthreads.cpp:
-
-2008-10-20  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=21735
-        Emit profiling instrumentation only if the Web Inspector's profiling
-        feature is enabled
-
-        22.2% speedup on empty function call benchmark.
-        2.9% speedup on v8 benchmark.
-        0.7% speedup on SunSpider.
-        
-        Lesser but similar speedups in bytecode.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases): Nixed JITed profiler hooks. Profiler
-        hooks now have their own opcodes. Added support for compiling profiler
-        hook opcodes.
-        
-        (JSC::CodeBlock::dump): Dump support for the new profiling opcodes.
-
-        * VM/CodeGenerator.h:
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::CodeGenerator):
-        (JSC::CodeGenerator::emitCall):
-        (JSC::CodeGenerator::emitConstruct): Conditionally emit profiling hooks
-        around call and construct, at the call site. (It's easier to get things
-        right this way, if you have profiled code calling non-profiled code.
-        Also, you get a slightly more accurate profile, since you charge the full
-        cost of the call / construct operation to the callee.)
-        
-        Also, fixed a bug where construct would fetch the ".prototype" property
-        from the constructor before evaluating the arguments to the constructor,
-        incorrectly allowing an "invalid constructor" exception to short-circuit
-        argument evaluation. I encountered this bug when trying to make
-        constructor exceptions work with profiling.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::callEval): Removed obsolete profiler hooks.
-
-        (JSC::Machine::throwException): Added a check for an exception thrown
-        within a call instruction. We didn't need this before because the call
-        instruction would check for a valid call before involing the profiler.
-        (JSC::Machine::execute): Added a didExecute hook at the end of top-level
-        function invocation, since op_ret no longer does this for us.
-
-        (JSC::Machine::privateExecute): Removed obsolete profiler hooks. Added
-        profiler opcodes. Changed some ++vPC to vPC[x] notation, since the
-        latter is better for performance, and it makes reasoning about the
-        current opcode in exception handling much simpler.
-
-        (JSC::Machine::cti_op_call_NotJSFunction): Removed obsolete profiler
-        hooks.
-
-        (JSC::Machine::cti_op_create_arguments_no_params): Added missing
-        CTI_STACK_HACK that I noticed when adding CTI_STACK_HACK to the new
-        profiler opcode functions.
-
-        (JSC::Machine::cti_op_profile_will_call):
-        (JSC::Machine::cti_op_profile_did_call): The new profiler opcode
-        functions.
-
-        (JSC::Machine::cti_op_construct_NotJSConstruct): Removed obsolete profiler
-        hooks.
-
-        * VM/Machine.h:
-        (JSC::Machine::isCallOpcode): Helper for exception handling.
-
-        * VM/Opcode.h: Declare new opcodes.
-
-        * kjs/JSGlobalObject.h:
-        (JSC::JSGlobalObject::supportsProfiling): Added virtual interface that
-        allows WebCore to specify whether the target global object has the Web
-        Inspector's profiling feature enabled.
-
-        * profiler/Profiler.cpp:
-        (JSC::Profiler::willExecute):
-        (JSC::Profiler::didExecute):
-        (JSC::Profiler::createCallIdentifier):
-        * profiler/Profiler.h: Added support for invoking the profiler with
-        an arbitrary JSValue*, and not a known object. We didn't need this
-        before because the call instruction would check for a valid call before
-        involing the profiler.
-
-2008-10-20  Darin Adler  <darin@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        - get CTI working on Windows again
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitCTICall): Add an overload for functions that
-        return JSObject*.
-        * VM/CTI.h: Use JSValue* and JSObject* as return types for
-        cti_op functions. Apparently, MSVC doesn't handle returning
-        the JSValuePtr struct in a register. We'll have to look into
-        this more.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_convert_this):
-        (JSC::Machine::cti_op_add):
-        (JSC::Machine::cti_op_pre_inc):
-        (JSC::Machine::cti_op_new_object):
-        (JSC::Machine::cti_op_get_by_id):
-        (JSC::Machine::cti_op_get_by_id_second):
-        (JSC::Machine::cti_op_get_by_id_generic):
-        (JSC::Machine::cti_op_get_by_id_fail):
-        (JSC::Machine::cti_op_instanceof):
-        (JSC::Machine::cti_op_del_by_id):
-        (JSC::Machine::cti_op_mul):
-        (JSC::Machine::cti_op_new_func):
-        (JSC::Machine::cti_op_push_activation):
-        (JSC::Machine::cti_op_call_NotJSFunction):
-        (JSC::Machine::cti_op_new_array):
-        (JSC::Machine::cti_op_resolve):
-        (JSC::Machine::cti_op_construct_JSConstructFast):
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-        (JSC::Machine::cti_op_get_by_val):
-        (JSC::Machine::cti_op_sub):
-        (JSC::Machine::cti_op_lesseq):
-        (JSC::Machine::cti_op_negate):
-        (JSC::Machine::cti_op_resolve_base):
-        (JSC::Machine::cti_op_resolve_skip):
-        (JSC::Machine::cti_op_resolve_global):
-        (JSC::Machine::cti_op_div):
-        (JSC::Machine::cti_op_pre_dec):
-        (JSC::Machine::cti_op_not):
-        (JSC::Machine::cti_op_eq):
-        (JSC::Machine::cti_op_lshift):
-        (JSC::Machine::cti_op_bitand):
-        (JSC::Machine::cti_op_rshift):
-        (JSC::Machine::cti_op_bitnot):
-        (JSC::Machine::cti_op_new_func_exp):
-        (JSC::Machine::cti_op_mod):
-        (JSC::Machine::cti_op_less):
-        (JSC::Machine::cti_op_neq):
-        (JSC::Machine::cti_op_urshift):
-        (JSC::Machine::cti_op_bitxor):
-        (JSC::Machine::cti_op_new_regexp):
-        (JSC::Machine::cti_op_bitor):
-        (JSC::Machine::cti_op_call_eval):
-        (JSC::Machine::cti_op_throw):
-        (JSC::Machine::cti_op_next_pname):
-        (JSC::Machine::cti_op_typeof):
-        (JSC::Machine::cti_op_is_undefined):
-        (JSC::Machine::cti_op_is_boolean):
-        (JSC::Machine::cti_op_is_number):
-        (JSC::Machine::cti_op_is_string):
-        (JSC::Machine::cti_op_is_object):
-        (JSC::Machine::cti_op_is_function):
-        (JSC::Machine::cti_op_stricteq):
-        (JSC::Machine::cti_op_nstricteq):
-        (JSC::Machine::cti_op_to_jsnumber):
-        (JSC::Machine::cti_op_in):
-        (JSC::Machine::cti_op_push_new_scope):
-        (JSC::Machine::cti_op_del_by_val):
-        (JSC::Machine::cti_op_new_error):
-        (JSC::Machine::cti_vm_throw):
-        Change these functions to return pointer types, and never
-        JSValuePtr.
-        * VM/Machine.h: Ditto.
-
-2008-10-20  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        Fixed some recent break-age in bytecode mode.
-
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::printStructureIDs): Fixed up an ASSERT caused by
-        Gavin's last checkin. This is a temporary fix so I can keep on moving.
-        I'll send email about what I think is an underlying problem soon.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute): Removed a redundant and sometimes
-        incorrect cast, which started ASSERTing after Darin's last checkin.
-
-2008-10-20  Darin Adler  <darin@apple.com>
-
-        - another similar Windows build fix
-
-        * VM/CTI.cpp: Changed return type to JSObject* instead of JSValuePtr.
-
-2008-10-20  Darin Adler  <darin@apple.com>
-
-        - try to fix Windows build
-
-        * VM/CTI.cpp: Use JSValue* instead of JSValuePtr for ctiTrampoline.
-        * VM/CTI.h: Ditto.
-
-2008-10-19  Darin Adler  <darin@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        - finish https://bugs.webkit.org/show_bug.cgi?id=21732
-          improve performance by eliminating JSValue as a base class for JSCell
-
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_call_profiler): Use asFunction.
-        (JSC::Machine::cti_vm_lazyLinkCall): Ditto.
-        (JSC::Machine::cti_op_construct_JSConstructFast): Use asObject.
-
-        * kjs/JSCell.h: Re-sort friend classes. Eliminate inheritance from
-        JSValue. Changed cast in asCell from static_cast to reinterpret_cast.
-        Removed JSValue::getNumber(double&) and one of JSValue::getObject
-        overloads.
-
-        * kjs/JSValue.h: Made the private constructor and destructor both
-        non-virtual and also remove the definitions. This class can never
-        be instantiated or derived.
-
-2008-10-19  Darin Adler  <darin@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        - next step of https://bugs.webkit.org/show_bug.cgi?id=21732
-          improve performance by eliminating JSValue as a base class for JSCell
-
-        Change JSValuePtr from a typedef into a class. This allows us to support
-        conversion from JSCell* to JSValuePtr even if JSCell isn't derived from
-        JSValue.
-
-        * JavaScriptCore.exp: Updated symbols that involve JSValuePtr, since
-        it's now a distinct type.
-
-        * API/APICast.h:
-        (toRef): Extract the JSValuePtr payload explicitly since we can't just
-        cast any more.
-        * VM/CTI.cpp:
-        (JSC::CTI::asInteger): Ditto.
-
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::addConstant): Get at the payload directly.
-        (JSC::CodeGenerator::emitLoad): Added an overload of JSCell* because
-        otherwise classes derived from JSValue end up calling the bool
-        overload instead of JSValuePtr.
-        * VM/CodeGenerator.h: Ditto. Also update traits to use JSValue*
-        and the payload functions.
-
-        * VM/Register.h: Added a JSCell* overload and use of payload functions.
-
-        * kjs/JSCell.h:
-        (JSC::asCell): Use payload function.
-        (JSC::JSValue::asCell): Use JSValue* instead of JSValuePtr.
-        (JSC::JSValuePtr::JSValuePtr): Added. Constructor that takes JSCell*
-        and creates a JSValuePtr.
-
-        * kjs/JSImmediate.h: Added JSValuePtr class. Also updated makeValue
-        and makeInt to work with JSValue* and the payload function.
-
-        * kjs/JSValue.h: Added == and != operators for JSValuePtr. Put them
-        here because eventually all the JSValue functions should go here
-        except what's needed by JSImmediate. Also fix asValue to use
-        JSValue* instead of JSValuePtr.
-
-        * kjs/PropertySlot.h: Change constructor to take JSValuePtr.
-
-        * kjs/protect.h: Update gcProtect functions to work with JSCell*
-        as well as JSValuePtr. Also updated the ProtectedPtr<JSValuePtr>
-        specialization to work more directly. Also changed all the call
-        sites to use gcProtectNullTolerant.
-
-2008-10-19  Darin Adler  <darin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        - next step of https://bugs.webkit.org/show_bug.cgi?id=21732
-          improve performance by eliminating JSValue as a base class for JSCell
-
-        Remove most uses of JSValue, which will be removed in a future patch.
-
-        * VM/Machine.cpp:
-        (JSC::fastToUInt32): Call toUInt32SlowCase function; no longer a member
-        of JSValue.
-        * kjs/JSNumberCell.h:
-        (JSC::JSNumberCell::toInt32): Ditto.
-        (JSC::JSNumberCell::toUInt32): Ditto.
-
-        * kjs/JSValue.cpp:
-        (JSC::toInt32SlowCase): Made a non-member function.
-        (JSC::JSValue::toInt32SlowCase): Changed to call non-member function.
-        (JSC::toUInt32SlowCase): More of the same.
-        (JSC::JSValue::toUInt32SlowCase): Ditto.
-
-        * kjs/JSValue.h: Moved static member function so they are no longer
-        member functions at all.
-
-        * VM/CTI.h: Removed forward declaration of JSValue.
-        * VM/ExceptionHelpers.h: Ditto.
-        * kjs/CallData.h: Ditto.
-        * kjs/ConstructData.h: Ditto.
-        * kjs/JSGlobalObjectFunctions.h: Ditto.
-        * kjs/PropertyMap.h: Ditto.
-        * kjs/StructureID.h: Ditto.
-        * kjs/collector.h: Ditto.
-        * kjs/completion.h: Ditto.
-
-        * kjs/grammar.y:
-        (JSC::makeBitwiseNotNode): Call new non-member toInt32 function.
-        (JSC::makeLeftShiftNode): More of the same.
-        (JSC::makeRightShiftNode): Ditto.
-
-        * kjs/protect.h: Added a specialization for ProtectedPtr<JSValuePtr>
-        so this can be used with JSValuePtr.
-
-2008-10-18  Darin Adler  <darin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        - next step of https://bugs.webkit.org/show_bug.cgi?id=21732
-          improve performance by eliminating JSValue as a base class for JSCell
-
-        Tweak a little more to get closer to where we can make JSValuePtr a class.
-
-        * API/APICast.h:
-        (toJS): Change back to JSValue* here, since we're converting the
-        pointer type.
-        * VM/CTI.cpp:
-        (JSC::CTI::unlinkCall): Call asPointer.
-        * VM/CTI.h: Cast to JSValue* here, since it's a pointer cast.
-        * kjs/DebuggerCallFrame.h:
-        (JSC::DebuggerCallFrame::DebuggerCallFrame): Call noValue.
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData): Call noValue.
-        * kjs/JSImmediate.cpp:
-        (JSC::JSImmediate::toObject): Remove unneeded const_cast.
-        * kjs/JSWrapperObject.h:
-        (JSC::JSWrapperObject::JSWrapperObject): Call noValue.
-
-2008-10-18  Darin Adler  <darin@apple.com>
-
-        - fix non-all-in-one build
-
-        * kjs/completion.h:
-        (JSC::Completion::Completion): Add include of JSValue.h.
-
-2008-10-18  Darin Adler  <darin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        - fix assertions I introduced with my casting changes
-
-        These were showing up as failures in the JavaScriptCore tests.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_instanceof): Remove the bogus asCell casting that
-        was at the top of the function, and instead cast at the point of use.
-        (JSC::Machine::cti_op_construct_NotJSConstruct): Moved the cast to
-        object after checking the construct type.
-
-2008-10-18  Darin Adler  <darin@apple.com>
-
-        - fix non-all-in-one build
-
-        * kjs/JSGlobalObjectFunctions.h: Add include of JSImmedate.h (for now).
-
-2008-10-18  Darin Adler  <darin@apple.com>
-
-        - fix build
-
-        * kjs/interpreter.h: Include JSValue.h instead of JSImmediate.h.
-
-2008-10-18  Darin Adler  <darin@apple.com>
-
-        * kjs/interpreter.h: Fix include of JSImmediate.h.
-
-2008-10-18  Darin Adler  <darin@apple.com>
-
-        - fix non-all-in-one build
-
-        * kjs/interpreter.h: Add include of JSImmediate.h.
-
-2008-10-18  Darin Adler  <darin@apple.com>
-
-        - fix non-all-in-one build
-
-        * kjs/ConstructData.h: Add include of JSImmedate.h (for now).
-
-2008-10-18  Darin Adler  <darin@apple.com>
-
-        - try to fix Windows build
-
-        * VM/Machine.cpp:
-        (JSC::Machine::Machine): Use JSCell* type since MSVC seems to only allow
-        calling ~JSCell directly if it's a JSCell*.
-
-2008-10-18  Darin Adler  <darin@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        - next step on https://bugs.webkit.org/show_bug.cgi?id=21732
-          improve performance by eliminating JSValue as a base class for JSCell
-
-        Use JSValuePtr everywhere instead of JSValue*. In the future, we'll be
-        changing JSValuePtr to be a class, and then eventually renaming it
-        to JSValue once that's done.
-
-        * JavaScriptCore.exp: Update entry points, since some now take JSValue*
-        instead of const JSValue*.
-
-        * API/APICast.h:
-        * API/JSCallbackConstructor.h:
-        * API/JSCallbackFunction.cpp:
-        * API/JSCallbackFunction.h:
-        * API/JSCallbackObject.h:
-        * API/JSCallbackObjectFunctions.h:
-        * API/JSContextRef.cpp:
-        * API/JSObjectRef.cpp:
-        * API/JSValueRef.cpp:
-        * VM/CTI.cpp:
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        * VM/CodeBlock.h:
-        * VM/CodeGenerator.cpp:
-        * VM/CodeGenerator.h:
-        * VM/ExceptionHelpers.cpp:
-        * VM/ExceptionHelpers.h:
-        * VM/JSPropertyNameIterator.cpp:
-        * VM/JSPropertyNameIterator.h:
-        * VM/Machine.cpp:
-        * VM/Machine.h:
-        * VM/Register.h:
-        * kjs/ArgList.cpp:
-        * kjs/ArgList.h:
-        * kjs/Arguments.cpp:
-        * kjs/Arguments.h:
-        * kjs/ArrayConstructor.cpp:
-        * kjs/ArrayPrototype.cpp:
-        * kjs/BooleanConstructor.cpp:
-        * kjs/BooleanConstructor.h:
-        * kjs/BooleanObject.h:
-        * kjs/BooleanPrototype.cpp:
-        * kjs/CallData.cpp:
-        * kjs/CallData.h:
-        * kjs/ConstructData.cpp:
-        * kjs/ConstructData.h:
-        * kjs/DateConstructor.cpp:
-        * kjs/DateInstance.h:
-        * kjs/DatePrototype.cpp:
-        * kjs/DebuggerCallFrame.cpp:
-        * kjs/DebuggerCallFrame.h:
-        * kjs/ErrorConstructor.cpp:
-        * kjs/ErrorPrototype.cpp:
-        * kjs/ExecState.cpp:
-        * kjs/ExecState.h:
-        * kjs/FunctionConstructor.cpp:
-        * kjs/FunctionPrototype.cpp:
-        * kjs/GetterSetter.cpp:
-        * kjs/GetterSetter.h:
-        * kjs/InternalFunction.h:
-        * kjs/JSActivation.cpp:
-        * kjs/JSActivation.h:
-        * kjs/JSArray.cpp:
-        * kjs/JSArray.h:
-        * kjs/JSCell.cpp:
-        * kjs/JSCell.h:
-        * kjs/JSFunction.cpp:
-        * kjs/JSFunction.h:
-        * kjs/JSGlobalData.h:
-        * kjs/JSGlobalObject.cpp:
-        * kjs/JSGlobalObject.h:
-        * kjs/JSGlobalObjectFunctions.cpp:
-        * kjs/JSGlobalObjectFunctions.h:
-        * kjs/JSImmediate.cpp:
-        * kjs/JSImmediate.h:
-        * kjs/JSNotAnObject.cpp:
-        * kjs/JSNotAnObject.h:
-        * kjs/JSNumberCell.cpp:
-        * kjs/JSNumberCell.h:
-        * kjs/JSObject.cpp:
-        * kjs/JSObject.h:
-        * kjs/JSStaticScopeObject.cpp:
-        * kjs/JSStaticScopeObject.h:
-        * kjs/JSString.cpp:
-        * kjs/JSString.h:
-        * kjs/JSValue.h:
-        * kjs/JSVariableObject.h:
-        * kjs/JSWrapperObject.h:
-        * kjs/MathObject.cpp:
-        * kjs/NativeErrorConstructor.cpp:
-        * kjs/NumberConstructor.cpp:
-        * kjs/NumberConstructor.h:
-        * kjs/NumberObject.cpp:
-        * kjs/NumberObject.h:
-        * kjs/NumberPrototype.cpp:
-        * kjs/ObjectConstructor.cpp:
-        * kjs/ObjectPrototype.cpp:
-        * kjs/ObjectPrototype.h:
-        * kjs/PropertyMap.h:
-        * kjs/PropertySlot.cpp:
-        * kjs/PropertySlot.h:
-        * kjs/RegExpConstructor.cpp:
-        * kjs/RegExpConstructor.h:
-        * kjs/RegExpMatchesArray.h:
-        * kjs/RegExpObject.cpp:
-        * kjs/RegExpObject.h:
-        * kjs/RegExpPrototype.cpp:
-        * kjs/Shell.cpp:
-        * kjs/StringConstructor.cpp:
-        * kjs/StringObject.cpp:
-        * kjs/StringObject.h:
-        * kjs/StringObjectThatMasqueradesAsUndefined.h:
-        * kjs/StringPrototype.cpp:
-        * kjs/StructureID.cpp:
-        * kjs/StructureID.h:
-        * kjs/collector.cpp:
-        * kjs/collector.h:
-        * kjs/completion.h:
-        * kjs/grammar.y:
-        * kjs/interpreter.cpp:
-        * kjs/interpreter.h:
-        * kjs/lookup.cpp:
-        * kjs/lookup.h:
-        * kjs/nodes.h:
-        * kjs/operations.cpp:
-        * kjs/operations.h:
-        * kjs/protect.h:
-        * profiler/ProfileGenerator.cpp:
-        Replace JSValue* with JSValuePtr.
-
-2008-10-18  Darin Adler  <darin@apple.com>
-
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_call_eval): Removed stray parentheses from my
-        last check-in.
-
-2008-10-18  Darin Adler  <darin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        - first step of https://bugs.webkit.org/show_bug.cgi?id=21732
-          improve performance by eliminating JSValue as a base class for JSCell
-
-        Remove casts from JSValue* to derived classes, replacing them with
-        calls to inline casting functions. These functions are also a bit
-        better than aidrect cast because they also do a runtime assertion.
-
-        Removed use of 0 as for JSValue*, changing call sites to use a
-        noValue() function instead.
-
-        Move things needed by classes derived from JSValue out of the class,
-        since the classes won't be deriving from JSValue any more soon.
-
-        I did most of these changes by changing JSValue to not be JSValue* any
-        more, then fixing a lot of the compilation problems, then rolling out
-        the JSValue change.
-
-        1.011x as fast on SunSpider (presumably due to some of the Machine.cpp changes)
-
-        * API/APICast.h: Removed unneeded forward declarations.
-
-        * API/JSCallbackObject.h: Added an asCallbackObject function for casting.
-        * API/JSCallbackObjectFunctions.h:
-        (JSC::JSCallbackObject::asCallbackObject): Added.
-        (JSC::JSCallbackObject::getOwnPropertySlot): Use asObject.
-        (JSC::JSCallbackObject::call): Use noValue.
-        (JSC::JSCallbackObject::staticValueGetter): Use asCallbackObject.
-        (JSC::JSCallbackObject::staticFunctionGetter): Ditto.
-        (JSC::JSCallbackObject::callbackGetter): Ditto.
-
-        * JavaScriptCore.exp: Updated.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj: Added RegExpMatchesArray.h.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::asInteger): Added. For use casting a JSValue to an integer.
-        (JSC::CTI::emitGetArg): Use asInteger.
-        (JSC::CTI::emitGetPutArg): Ditto.
-        (JSC::CTI::getConstantImmediateNumericArg): Ditto. Also use noValue.
-        (JSC::CTI::emitInitRegister): Use asInteger.
-        (JSC::CTI::getDeTaggedConstantImmediate): Ditto.
-        (JSC::CTI::compileOpCallInitializeCallFrame): Ditto.
-        (JSC::CTI::compileOpCall): Ditto.
-        (JSC::CTI::compileOpStrictEq): Ditto.
-        (JSC::CTI::privateCompileMainPass): Ditto.
-        (JSC::CTI::privateCompileGetByIdProto): Ditto.
-        (JSC::CTI::privateCompileGetByIdChain): Ditto.
-        (JSC::CTI::privateCompilePutByIdTransition): Ditto.
-        * VM/CTI.h: Rewrite the ARG-related macros to use C++ casts instead of
-        C casts and get rid of some extra parentheses. Addd declaration of
-        asInteger.
-
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitEqualityOp): Use asString.
-        (JSC::CodeGenerator::emitLoad): Use noValue.
-        (JSC::CodeGenerator::findScopedProperty): Change globalObject argument
-        to JSObject* instead of JSValue*.
-        (JSC::CodeGenerator::emitResolve): Remove unneeded cast.
-        (JSC::CodeGenerator::emitGetScopedVar): Use asCell.
-        (JSC::CodeGenerator::emitPutScopedVar): Ditto.
-        * VM/CodeGenerator.h: Changed out argument of findScopedProperty.
-        Also change the JSValueMap to use PtrHash explicitly instead of
-        getting it from DefaultHash.
-
-        * VM/JSPropertyNameIterator.cpp:
-        (JSC::JSPropertyNameIterator::toPrimitive): Use noValue.
-        * VM/JSPropertyNameIterator.h:
-        (JSC::JSPropertyNameIterator::next): Ditto.
-
-        * VM/Machine.cpp:
-        (JSC::fastIsNumber): Moved isImmediate check here instead of
-        checking for 0 inside Heap::isNumber. Use asCell and asNumberCell.
-        (JSC::fastToInt32): Ditto.
-        (JSC::fastToUInt32): Ditto.
-        (JSC::jsLess): Use asString.
-        (JSC::jsLessEq): Ditto.
-        (JSC::jsAdd): Ditto.
-        (JSC::jsTypeStringForValue): Use asObject.
-        (JSC::jsIsObjectType): Ditto.
-        (JSC::jsIsFunctionType): Ditto.
-        (JSC::inlineResolveBase): Use noValue.
-        (JSC::Machine::callEval): Use asString. Initialize result to
-        undefined, not 0.
-        (JSC::Machine::Machine): Remove unneeded casts to JSCell*.
-        (JSC::Machine::throwException): Use asObject.
-        (JSC::Machine::debug): Remove explicit calls to the DebuggerCallFrame
-        constructor.
-        (JSC::Machine::checkTimeout): Use noValue.
-        (JSC::cachePrototypeChain): Use asObject.
-        (JSC::Machine::tryCachePutByID): Use asCell.
-        (JSC::Machine::tryCacheGetByID): Use aCell and asObject.
-        (JSC::Machine::privateExecute): Use noValue, asCell, asObject, asString,
-        asArray, asActivation, asFunction. Changed code that creates call frames
-        for host functions to pass 0 for the function pointer -- the call frame
-        needs a JSFunction* and a host function object is not one. This was
-        caught by the assertions in the casting functions. Also remove some
-        unneeded casts in cases where two values are compared.
-        (JSC::Machine::retrieveLastCaller): Use noValue.
-        (JSC::Machine::tryCTICachePutByID): Use asCell.
-        (JSC::Machine::tryCTICacheGetByID): Use aCell and asObject.
-        (JSC::setUpThrowTrampolineReturnAddress): Added this function to restore
-        the PIC-branch-avoidance that was recently lost.
-        (JSC::Machine::cti_op_add): Use asString.
-        (JSC::Machine::cti_op_instanceof): Use asCell and asObject.
-        (JSC::Machine::cti_op_call_JSFunction): Use asFunction.
-        (JSC::Machine::cti_op_call_NotJSFunction): Changed code to pass 0 for
-        the function pointer, since we don't have a JSFunction. Use asObject.
-        (JSC::Machine::cti_op_tear_off_activation): Use asActivation.
-        (JSC::Machine::cti_op_construct_JSConstruct): Use asFunction and asObject.
-        (JSC::Machine::cti_op_construct_NotJSConstruct): use asObject.
-        (JSC::Machine::cti_op_get_by_val): Use asArray and asString.
-        (JSC::Machine::cti_op_resolve_func): Use asPointer; this helps prepare
-        us for a situation where JSValue is not a pointer.
-        (JSC::Machine::cti_op_put_by_val): Use asArray.
-        (JSC::Machine::cti_op_put_by_val_array): Ditto.
-        (JSC::Machine::cti_op_resolve_global): Use asGlobalObject.
-        (JSC::Machine::cti_op_post_inc): Change VM_CHECK_EXCEPTION_2 to
-        VM_CHECK_EXCEPTION_AT_END, since there's no observable work done after
-        that point. Also use asPointer.
-        (JSC::Machine::cti_op_resolve_with_base): Use asPointer.
-        (JSC::Machine::cti_op_post_dec): Change VM_CHECK_EXCEPTION_2 to
-        VM_CHECK_EXCEPTION_AT_END, since there's no observable work done after
-        that point. Also use asPointer.
-        (JSC::Machine::cti_op_call_eval): Use asObject, noValue, and change
-        VM_CHECK_EXCEPTION_ARG to VM_THROW_EXCEPTION_AT_END.
-        (JSC::Machine::cti_op_throw): Change return value to a JSValue*.
-        (JSC::Machine::cti_op_in): Use asObject.
-        (JSC::Machine::cti_op_switch_char): Use asString.
-        (JSC::Machine::cti_op_switch_string): Ditto.
-        (JSC::Machine::cti_op_put_getter): Use asObject.
-        (JSC::Machine::cti_op_put_setter): Ditto.
-        (JSC::Machine::cti_vm_throw): Change return value to a JSValue*.
-        Use noValue.
-        * VM/Machine.h: Change return values of both cti_op_throw and
-        cti_vm_throw to JSValue*.
-
-        * VM/Register.h: Remove nullJSValue, which is the same thing
-        as noValue(). Also removed unneeded definition of JSValue.
-
-        * kjs/ArgList.h: Removed unneeded definition of JSValue.
-
-        * kjs/Arguments.h:
-        (JSC::asArguments): Added.
-
-        * kjs/ArrayPrototype.cpp:
-        (JSC::getProperty): Use noValue.
-        (JSC::arrayProtoFuncToString): Use asArray.
-        (JSC::arrayProtoFuncToLocaleString): Ditto.
-        (JSC::arrayProtoFuncConcat): Ditto.
-        (JSC::arrayProtoFuncPop): Ditto. Also removed unneeded initialization
-        of the result, which is set in both sides of the branch.
-        (JSC::arrayProtoFuncPush): Ditto.
-        (JSC::arrayProtoFuncShift): Removed unneeded initialization
-        of the result, which is set in both sides of the branch.
-        (JSC::arrayProtoFuncSort): Use asArray.
-
-        * kjs/BooleanObject.h:
-        (JSC::asBooleanObject): Added.
-
-        * kjs/BooleanPrototype.cpp:
-        (JSC::booleanProtoFuncToString): Use asBooleanObject.
-        (JSC::booleanProtoFuncValueOf): Ditto.
-
-        * kjs/CallData.cpp:
-        (JSC::call): Use asObject and asFunction.
-        * kjs/ConstructData.cpp:
-        (JSC::construct): Ditto.
-
-        * kjs/DateConstructor.cpp:
-        (JSC::constructDate): Use asDateInstance.
-
-        * kjs/DateInstance.h:
-        (JSC::asDateInstance): Added.
-
-        * kjs/DatePrototype.cpp:
-        (JSC::dateProtoFuncToString): Use asDateInstance.
-        (JSC::dateProtoFuncToUTCString): Ditto.
-        (JSC::dateProtoFuncToDateString): Ditto.
-        (JSC::dateProtoFuncToTimeString): Ditto.
-        (JSC::dateProtoFuncToLocaleString): Ditto.
-        (JSC::dateProtoFuncToLocaleDateString): Ditto.
-        (JSC::dateProtoFuncToLocaleTimeString): Ditto.
-        (JSC::dateProtoFuncValueOf): Ditto.
-        (JSC::dateProtoFuncGetTime): Ditto.
-        (JSC::dateProtoFuncGetFullYear): Ditto.
-        (JSC::dateProtoFuncGetUTCFullYear): Ditto.
-        (JSC::dateProtoFuncToGMTString): Ditto.
-        (JSC::dateProtoFuncGetMonth): Ditto.
-        (JSC::dateProtoFuncGetUTCMonth): Ditto.
-        (JSC::dateProtoFuncGetDate): Ditto.
-        (JSC::dateProtoFuncGetUTCDate): Ditto.
-        (JSC::dateProtoFuncGetDay): Ditto.
-        (JSC::dateProtoFuncGetUTCDay): Ditto.
-        (JSC::dateProtoFuncGetHours): Ditto.
-        (JSC::dateProtoFuncGetUTCHours): Ditto.
-        (JSC::dateProtoFuncGetMinutes): Ditto.
-        (JSC::dateProtoFuncGetUTCMinutes): Ditto.
-        (JSC::dateProtoFuncGetSeconds): Ditto.
-        (JSC::dateProtoFuncGetUTCSeconds): Ditto.
-        (JSC::dateProtoFuncGetMilliSeconds): Ditto.
-        (JSC::dateProtoFuncGetUTCMilliseconds): Ditto.
-        (JSC::dateProtoFuncGetTimezoneOffset): Ditto.
-        (JSC::dateProtoFuncSetTime): Ditto.
-        (JSC::setNewValueFromTimeArgs): Ditto.
-        (JSC::setNewValueFromDateArgs): Ditto.
-        (JSC::dateProtoFuncSetYear): Ditto.
-        (JSC::dateProtoFuncGetYear): Ditto.
-
-        * kjs/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::thisObject): Use asObject.
-        (JSC::DebuggerCallFrame::evaluate): Use noValue.
-        * kjs/DebuggerCallFrame.h: Added a constructor that
-        takes only a callFrame.
-
-        * kjs/ExecState.h:
-        (JSC::ExecState::clearException): Use noValue.
-
-        * kjs/FunctionPrototype.cpp:
-        (JSC::functionProtoFuncToString): Use asFunction.
-        (JSC::functionProtoFuncApply): Use asArguments and asArray.
-
-        * kjs/GetterSetter.cpp:
-        (JSC::GetterSetter::getPrimitiveNumber): Use noValue.
-
-        * kjs/GetterSetter.h:
-        (JSC::asGetterSetter): Added.
-
-        * kjs/InternalFunction.cpp:
-        (JSC::InternalFunction::name): Use asString.
-
-        * kjs/InternalFunction.h:
-        (JSC::asInternalFunction): Added.
-
-        * kjs/JSActivation.cpp:
-        (JSC::JSActivation::argumentsGetter): Use asActivation.
-
-        * kjs/JSActivation.h:
-        (JSC::asActivation): Added.
-
-        * kjs/JSArray.cpp:
-        (JSC::JSArray::putSlowCase): Use noValue.
-        (JSC::JSArray::deleteProperty): Ditto.
-        (JSC::JSArray::increaseVectorLength): Ditto.
-        (JSC::JSArray::setLength): Ditto.
-        (JSC::JSArray::pop): Ditto.
-        (JSC::JSArray::sort): Ditto.
-        (JSC::JSArray::compactForSorting): Ditto.
-        * kjs/JSArray.h:
-        (JSC::asArray): Added.
-
-        * kjs/JSCell.cpp:
-        (JSC::JSCell::getJSNumber): Use noValue.
-
-        * kjs/JSCell.h:
-        (JSC::asCell): Added.
-        (JSC::JSValue::asCell): Changed to not preserve const.
-        Given the wide use of JSValue* and JSCell*, it's not
-        really useful to use const.
-        (JSC::JSValue::isNumber): Use asValue.
-        (JSC::JSValue::isString): Ditto.
-        (JSC::JSValue::isGetterSetter): Ditto.
-        (JSC::JSValue::isObject): Ditto.
-        (JSC::JSValue::getNumber): Ditto.
-        (JSC::JSValue::getString): Ditto.
-        (JSC::JSValue::getObject): Ditto.
-        (JSC::JSValue::getCallData): Ditto.
-        (JSC::JSValue::getConstructData): Ditto.
-        (JSC::JSValue::getUInt32): Ditto.
-        (JSC::JSValue::getTruncatedInt32): Ditto.
-        (JSC::JSValue::getTruncatedUInt32): Ditto.
-        (JSC::JSValue::mark): Ditto.
-        (JSC::JSValue::marked): Ditto.
-        (JSC::JSValue::toPrimitive): Ditto.
-        (JSC::JSValue::getPrimitiveNumber): Ditto.
-        (JSC::JSValue::toBoolean): Ditto.
-        (JSC::JSValue::toNumber): Ditto.
-        (JSC::JSValue::toString): Ditto.
-        (JSC::JSValue::toObject): Ditto.
-        (JSC::JSValue::toThisObject): Ditto.
-        (JSC::JSValue::needsThisConversion): Ditto.
-        (JSC::JSValue::toThisString): Ditto.
-        (JSC::JSValue::getJSNumber): Ditto.
-
-        * kjs/JSFunction.cpp:
-        (JSC::JSFunction::argumentsGetter): Use asFunction.
-        (JSC::JSFunction::callerGetter): Ditto.
-        (JSC::JSFunction::lengthGetter): Ditto.
-        (JSC::JSFunction::construct): Use asObject.
-
-        * kjs/JSFunction.h:
-        (JSC::asFunction): Added.
-
-        * kjs/JSGlobalObject.cpp:
-        (JSC::lastInPrototypeChain): Use asObject.
-
-        * kjs/JSGlobalObject.h:
-        (JSC::asGlobalObject): Added.
-        (JSC::ScopeChainNode::globalObject): Use asGlobalObject.
-
-        * kjs/JSImmediate.h: Added noValue, asPointer, and makeValue
-        functions. Use rawValue, makeValue, and noValue consistently
-        instead of doing reinterpret_cast in various functions.
-
-        * kjs/JSNumberCell.h:
-        (JSC::asNumberCell): Added.
-        (JSC::JSValue::uncheckedGetNumber): Use asValue and asNumberCell.
-        (JSC::JSValue::toJSNumber): Use asValue.
-
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::put): Use asObject and asGetterSetter.
-        (JSC::callDefaultValueFunction): Use noValue.
-        (JSC::JSObject::defineGetter): Use asGetterSetter.
-        (JSC::JSObject::defineSetter): Ditto.
-        (JSC::JSObject::lookupGetter): Ditto. Also use asObject.
-        (JSC::JSObject::lookupSetter): Ditto.
-        (JSC::JSObject::hasInstance): Use asObject.
-        (JSC::JSObject::fillGetterPropertySlot): Use asGetterSetter.
-
-        * kjs/JSObject.h:
-        (JSC::JSObject::getDirect): Use noValue.
-        (JSC::asObject): Added.
-        (JSC::JSValue::isObject): Use asValue.
-        (JSC::JSObject::get): Removed unneeded const_cast.
-        (JSC::JSObject::getPropertySlot): Use asObject.
-        (JSC::JSValue::get): Removed unneeded const_cast.
-        Use asValue, asCell, and asObject.
-        (JSC::JSValue::put): Ditto.
-        (JSC::JSObject::allocatePropertyStorageInline): Fixed spelling
-        of "oldPropertStorage".
-
-        * kjs/JSString.cpp:
-        (JSC::JSString::getOwnPropertySlot): Use asObject.
-
-        * kjs/JSString.h:
-        (JSC::asString): Added.
-        (JSC::JSValue::toThisJSString): Use asValue.
-
-        * kjs/JSValue.h: Make PreferredPrimitiveType a top level enum
-        instead of a member of JSValue. Added an asValue function that
-        returns this. Removed overload of asCell for const. Use asValue
-        instead of getting right at this.
-
-        * kjs/ObjectPrototype.cpp:
-        (JSC::objectProtoFuncIsPrototypeOf): Use asObject.
-        (JSC::objectProtoFuncDefineGetter): Ditto.
-        (JSC::objectProtoFuncDefineSetter): Ditto.
-
-        * kjs/PropertySlot.h:
-        (JSC::PropertySlot::PropertySlot): Take a const JSValue* so the
-        callers don't have to worry about const.
-        (JSC::PropertySlot::clearBase): Use noValue.
-        (JSC::PropertySlot::clearValue): Ditto.
-
-        * kjs/RegExpConstructor.cpp:
-        (JSC::regExpConstructorDollar1): Use asRegExpConstructor.
-        (JSC::regExpConstructorDollar2): Ditto.
-        (JSC::regExpConstructorDollar3): Ditto.
-        (JSC::regExpConstructorDollar4): Ditto.
-        (JSC::regExpConstructorDollar5): Ditto.
-        (JSC::regExpConstructorDollar6): Ditto.
-        (JSC::regExpConstructorDollar7): Ditto.
-        (JSC::regExpConstructorDollar8): Ditto.
-        (JSC::regExpConstructorDollar9): Ditto.
-        (JSC::regExpConstructorInput): Ditto.
-        (JSC::regExpConstructorMultiline): Ditto.
-        (JSC::regExpConstructorLastMatch): Ditto.
-        (JSC::regExpConstructorLastParen): Ditto.
-        (JSC::regExpConstructorLeftContext): Ditto.
-        (JSC::regExpConstructorRightContext): Ditto.
-        (JSC::setRegExpConstructorInput): Ditto.
-        (JSC::setRegExpConstructorMultiline): Ditto.
-        (JSC::constructRegExp): Use asObject.
-
-        * kjs/RegExpConstructor.h:
-        (JSC::asRegExpConstructor): Added.
-
-        * kjs/RegExpObject.cpp:
-        (JSC::regExpObjectGlobal): Use asRegExpObject.
-        (JSC::regExpObjectIgnoreCase): Ditto.
-        (JSC::regExpObjectMultiline): Ditto.
-        (JSC::regExpObjectSource): Ditto.
-        (JSC::regExpObjectLastIndex): Ditto.
-        (JSC::setRegExpObjectLastIndex): Ditto.
-        (JSC::callRegExpObject): Ditto.
-
-        * kjs/RegExpObject.h:
-        (JSC::asRegExpObject): Added.
-
-        * kjs/RegExpPrototype.cpp:
-        (JSC::regExpProtoFuncTest): Use asRegExpObject.
-        (JSC::regExpProtoFuncExec): Ditto.
-        (JSC::regExpProtoFuncCompile): Ditto.
-        (JSC::regExpProtoFuncToString): Ditto.
-
-        * kjs/StringObject.h:
-        (JSC::StringObject::internalValue): Use asString.
-        (JSC::asStringObject): Added.
-
-        * kjs/StringPrototype.cpp:
-        (JSC::stringProtoFuncReplace): Use asRegExpObject.
-        (JSC::stringProtoFuncToString): Ue asStringObject.
-        (JSC::stringProtoFuncMatch): Use asRegExpObject.
-        (JSC::stringProtoFuncSearch): Ditto.
-        (JSC::stringProtoFuncSplit): Ditto.
-
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::getEnumerablePropertyNames): Use asObject.
-        (JSC::StructureID::createCachedPrototypeChain): Ditto.
-        (JSC::StructureIDChain::StructureIDChain): Use asCell and asObject.
-
-        * kjs/collector.h:
-        (JSC::Heap::isNumber): Removed null handling. This can only be called
-        on valid cells.
-        (JSC::Heap::cellBlock): Removed overload for const and non-const.
-        Whether the JSCell* is const or not really should have no effect on
-        whether you can modify the collector block it's in.
-
-        * kjs/interpreter.cpp:
-        (JSC::Interpreter::evaluate): Use noValue and noObject.
-
-        * kjs/nodes.cpp:
-        (JSC::FunctionCallResolveNode::emitCode): Use JSObject for the global
-        object rather than JSValue.
-        (JSC::PostfixResolveNode::emitCode): Ditto.
-        (JSC::PrefixResolveNode::emitCode): Ditto.
-        (JSC::ReadModifyResolveNode::emitCode): Ditto.
-        (JSC::AssignResolveNode::emitCode): Ditto.
-
-        * kjs/operations.h:
-        (JSC::equalSlowCaseInline): Use asString, asCell, asNumberCell, 
-        (JSC::strictEqualSlowCaseInline): Ditto.
-
-2008-10-18  Cameron Zwarich  <zwarich@apple.com>
+        No performance impact.
 
-        Reviewed by Oliver Hunt.
+        * wtf/DateMath.cpp:
+        (WTF::calculateUTCOffset):
 
-        Bug 21702: Special op_create_activation for the case where there are no named parameters
-        <https://bugs.webkit.org/show_bug.cgi?id=21702>
+2009-06-18  Gavin Barraclough  <barraclough@apple.com>
 
-        This is a 2.5% speedup on the V8 Raytrace benchmark and a 1.1% speedup
-        on the V8 Earley-Boyer benchmark.
+        Rubber Stamped by Mark Rowe (originally reviewed by Sam Weinig).
 
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_create_arguments_no_params):
-        * VM/Machine.h:
-        * kjs/Arguments.h:
-        (JSC::Arguments::):
-        (JSC::Arguments::Arguments):
+        (Reintroducing patch added in r44492, and reverted in r44796.)
 
-2008-10-17  Maciej Stachowiak  <mjs@apple.com>
+        Change the implementation of op_throw so the stub function always modifies its
+        return address - if it doesn't find a 'catch' it will switch to a trampoline
+        to force a return from JIT execution.  This saves memory, by avoiding the need
+        for a unique return for every op_throw.
 
-        Reviewed by Cameron Zwarich.
-        
-        - in debug builds, alter the stack to avoid blowing out MallocStackLogging
-        
-        (In essence, while executing a CTI function we alter the return
-        address to jscGeneratedNativeCode so that a single consistent
-        function is on the stack instead of many random functions without
-        symbols.)
-
-        * VM/CTI.h:
-        * VM/Machine.cpp:
-        (JSC::doSetReturnAddress):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_throw):
+            JITStubs::cti_op_throw now always changes its return address,
+            remove return code generated after the stub call (this is now
+            handled by ctiOpThrowNotCaught).
+        * jit/JITStubs.cpp:
         (JSC::):
-        (JSC::StackHack::StackHack):
-        (JSC::StackHack::~StackHack):
-        (JSC::Machine::cti_op_convert_this):
-        (JSC::Machine::cti_op_end):
-        (JSC::Machine::cti_op_add):
-        (JSC::Machine::cti_op_pre_inc):
-        (JSC::Machine::cti_timeout_check):
-        (JSC::Machine::cti_register_file_check):
-        (JSC::Machine::cti_op_loop_if_less):
-        (JSC::Machine::cti_op_loop_if_lesseq):
-        (JSC::Machine::cti_op_new_object):
-        (JSC::Machine::cti_op_put_by_id):
-        (JSC::Machine::cti_op_put_by_id_second):
-        (JSC::Machine::cti_op_put_by_id_generic):
-        (JSC::Machine::cti_op_put_by_id_fail):
-        (JSC::Machine::cti_op_get_by_id):
-        (JSC::Machine::cti_op_get_by_id_second):
-        (JSC::Machine::cti_op_get_by_id_generic):
-        (JSC::Machine::cti_op_get_by_id_fail):
-        (JSC::Machine::cti_op_instanceof):
-        (JSC::Machine::cti_op_del_by_id):
-        (JSC::Machine::cti_op_mul):
-        (JSC::Machine::cti_op_new_func):
-        (JSC::Machine::cti_op_call_profiler):
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_vm_lazyLinkCall):
-        (JSC::Machine::cti_vm_compile):
-        (JSC::Machine::cti_op_push_activation):
-        (JSC::Machine::cti_op_call_NotJSFunction):
-        (JSC::Machine::cti_op_create_arguments):
-        (JSC::Machine::cti_op_tear_off_activation):
-        (JSC::Machine::cti_op_tear_off_arguments):
-        (JSC::Machine::cti_op_ret_profiler):
-        (JSC::Machine::cti_op_ret_scopeChain):
-        (JSC::Machine::cti_op_new_array):
-        (JSC::Machine::cti_op_resolve):
-        (JSC::Machine::cti_op_construct_JSConstructFast):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-        (JSC::Machine::cti_op_get_by_val):
-        (JSC::Machine::cti_op_resolve_func):
-        (JSC::Machine::cti_op_sub):
-        (JSC::Machine::cti_op_put_by_val):
-        (JSC::Machine::cti_op_put_by_val_array):
-        (JSC::Machine::cti_op_lesseq):
-        (JSC::Machine::cti_op_loop_if_true):
-        (JSC::Machine::cti_op_negate):
-        (JSC::Machine::cti_op_resolve_base):
-        (JSC::Machine::cti_op_resolve_skip):
-        (JSC::Machine::cti_op_resolve_global):
-        (JSC::Machine::cti_op_div):
-        (JSC::Machine::cti_op_pre_dec):
-        (JSC::Machine::cti_op_jless):
-        (JSC::Machine::cti_op_not):
-        (JSC::Machine::cti_op_jtrue):
-        (JSC::Machine::cti_op_post_inc):
-        (JSC::Machine::cti_op_eq):
-        (JSC::Machine::cti_op_lshift):
-        (JSC::Machine::cti_op_bitand):
-        (JSC::Machine::cti_op_rshift):
-        (JSC::Machine::cti_op_bitnot):
-        (JSC::Machine::cti_op_resolve_with_base):
-        (JSC::Machine::cti_op_new_func_exp):
-        (JSC::Machine::cti_op_mod):
-        (JSC::Machine::cti_op_less):
-        (JSC::Machine::cti_op_neq):
-        (JSC::Machine::cti_op_post_dec):
-        (JSC::Machine::cti_op_urshift):
-        (JSC::Machine::cti_op_bitxor):
-        (JSC::Machine::cti_op_new_regexp):
-        (JSC::Machine::cti_op_bitor):
-        (JSC::Machine::cti_op_call_eval):
-        (JSC::Machine::cti_op_throw):
-        (JSC::Machine::cti_op_get_pnames):
-        (JSC::Machine::cti_op_next_pname):
-        (JSC::Machine::cti_op_push_scope):
-        (JSC::Machine::cti_op_pop_scope):
-        (JSC::Machine::cti_op_typeof):
-        (JSC::Machine::cti_op_is_undefined):
-        (JSC::Machine::cti_op_is_boolean):
-        (JSC::Machine::cti_op_is_number):
-        (JSC::Machine::cti_op_is_string):
-        (JSC::Machine::cti_op_is_object):
-        (JSC::Machine::cti_op_is_function):
-        (JSC::Machine::cti_op_stricteq):
-        (JSC::Machine::cti_op_nstricteq):
-        (JSC::Machine::cti_op_to_jsnumber):
-        (JSC::Machine::cti_op_in):
-        (JSC::Machine::cti_op_push_new_scope):
-        (JSC::Machine::cti_op_jmp_scopes):
-        (JSC::Machine::cti_op_put_by_index):
-        (JSC::Machine::cti_op_switch_imm):
-        (JSC::Machine::cti_op_switch_char):
-        (JSC::Machine::cti_op_switch_string):
-        (JSC::Machine::cti_op_del_by_val):
-        (JSC::Machine::cti_op_put_getter):
-        (JSC::Machine::cti_op_put_setter):
-        (JSC::Machine::cti_op_new_error):
-        (JSC::Machine::cti_op_debug):
-        (JSC::Machine::cti_vm_throw):
-
-2008-10-17  Gavin Barraclough  <barraclough@apple.com>
-
-        Optimize op_call by allowing call sites to be directly linked to callees.
-
-        For the hot path of op_call, CTI now generates a check (initially for an impossible
-        value), and the first time the call is executed we attempt to link the call directly
-        to the callee.  We can currently only do so if the arity of the caller and callee
-        match.  The (optimized) setup for the call on the hot path is linked directly to
-        the ctiCode for the callee, without indirection.
-        
-        Two forms of the slow case of the call are generated, the first will be executed the
-        first time the call is reached.  As well as this path attempting to link the call to
-        a callee, it also relinks the slow case to a second slow case, which will not continue
-        to attempt relinking the call.  (This policy could be changed in future, but for not
-        this is intended to prevent thrashing).
+            Add ctiOpThrowNotCaught definitions.
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+            Change cti_op_throw to always change its return address.
+        * jit/JITStubs.h:
+            Add ctiOpThrowNotCaught declaration.
 
-        If a callee that the caller has been linked to is garbage collected, then the link
-        in the caller's JIt code will be reset back to a value that cannot match - to prevent
-        any false positive matches.
-
-        ~20% progression on deltablue & richards, >12% overall reduction in v8-tests
-        runtime, one or two percent progression on sunspider.
+2009-06-18  Kevin McCullough  <kmccullough@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        * VM/CTI.cpp:
-        (JSC::):
-        (JSC::CTI::emitNakedCall):
-        (JSC::unreachable):
-        (JSC::CTI::compileOpCallInitializeCallFrame):
-        (JSC::CTI::compileOpCallSetupArgs):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        (JSC::CTI::unlinkCall):
-        (JSC::CTI::linkCall):
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::~CodeBlock):
-        (JSC::CodeBlock::unlinkCallers):
-        (JSC::CodeBlock::derefStructureIDs):
-        * VM/CodeBlock.h:
-        (JSC::StructureStubInfo::StructureStubInfo):
-        (JSC::CallLinkInfo::CallLinkInfo):
-        (JSC::CodeBlock::addCaller):
-        (JSC::CodeBlock::removeCaller):
-        (JSC::CodeBlock::getStubInfo):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitCall):
-        (JSC::CodeGenerator::emitConstruct):
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_call_profiler):
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_vm_lazyLinkCall):
-        (JSC::Machine::cti_op_construct_JSConstructFast):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-        * VM/Machine.h:
-        * kjs/JSFunction.cpp:
-        (JSC::JSFunction::~JSFunction):
-        * kjs/JSFunction.h:
-        * kjs/nodes.h:
-        (JSC::FunctionBodyNode::):
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::getDifferenceBetweenLabels):
+        <rdar://problem/6940880> REGRESSION: Breakpoints don't break in 64-bit
 
-2008-10-17  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Geoff Garen.
-        
-        - remove ASSERT that makes the leaks buildbot cry
-
-        * kjs/JSFunction.cpp:
-        (JSC::JSFunction::JSFunction):
-
-2008-10-17  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Cameron Zwarich
-        
-        - don't bother to do arguments tearoff when it will have no effect
-
-        ~1% on v8 raytrace
-        
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitReturn):
-
-2008-10-17  Marco Barisione  <marco.barisione@collabora.co.uk>
-
-        Reviewed by Sam Weinig. Landed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21603
-        [GTK] Minor fixes to GOwnPtr
-
-        * wtf/GOwnPtr.cpp:
-        (WTF::GError):
-        (WTF::GList):
-        (WTF::GCond):
-        (WTF::GMutex):
-        (WTF::GPatternSpec):
-        (WTF::GDir):
-        * wtf/GOwnPtr.h:
-        (WTF::freeOwnedGPtr):
-        (WTF::GOwnPtr::~GOwnPtr):
-        (WTF::GOwnPtr::outPtr):
-        (WTF::GOwnPtr::set):
-        (WTF::GOwnPtr::clear):
-        * wtf/Threading.h:
-
-2008-10-17  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Cameron Zwarich.
-        
-        - speed up transitions that resize the property storage a fair bit
-        
-        ~3% speedup on v8 RayTrace benchmark, ~1% on DeltaBlue
-
-        * VM/CTI.cpp:
-        (JSC::resizePropertyStorage): renamed from transitionObject, and reduced to just resize
-        the object's property storage with one inline call.
-        (JSC::CTI::privateCompilePutByIdTransition): Use a separate function for property storage
-        resize, but still do all the rest of the work in assembly in that case, and pass the known
-        compile-time constants of old and new size rather than structureIDs, saving a bunch of
-        redundant memory access.
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::allocatePropertyStorage): Just call the inline version.
-        * kjs/JSObject.h:
-        (JSC::JSObject::allocatePropertyStorageInline): Inline version of allocatePropertyStorage
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::pushl_i32): Add code to assmeble push of a constant; code originally by Cameron Zwarich.
-
-2008-10-17  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Remove some C style casts.
-
-        * masm/X86Assembler.h:
-        (JSC::JITCodeBuffer::putIntUnchecked):
-        (JSC::X86Assembler::link):
-        (JSC::X86Assembler::linkAbsoluteAddress):
-        (JSC::X86Assembler::getRelocatedAddress):
-
-2008-10-17  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Maciej Stachowiak.
-
-        Remove some C style casts.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::patchGetByIdSelf):
-        (JSC::CTI::patchPutByIdReplace):
-        * VM/Machine.cpp:
-        (JSC::Machine::tryCTICachePutByID):
-        (JSC::Machine::tryCTICacheGetByID):
-        (JSC::Machine::cti_op_put_by_id):
-        (JSC::Machine::cti_op_put_by_id_fail):
-        (JSC::Machine::cti_op_get_by_id):
-        (JSC::Machine::cti_op_get_by_id_fail):
-
-2008-10-17  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Cameron Zwarich.
-        
-        - Avoid restoring the caller's 'r' value in op_ret
-        https://bugs.webkit.org/show_bug.cgi?id=21319
-
-        This patch stops writing the call frame at call and return points;
-        instead it does so immediately before any CTI call.
-        
-        0.5% speedup or so on the v8 benchmark
-               
-        * VM/CTI.cpp:
-        (JSC::CTI::emitCTICall):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::emitSlowScriptCheck):
-        (JSC::CTI::compileBinaryArithOpSlowCase):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        * VM/CTI.h:
-
-2008-10-17  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Make WREC require CTI because it won't actually compile otherwise.
-
-        * wtf/Platform.h:
-
-2008-10-16  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        - fixed <rdar://problem/5806316> JavaScriptCore should not force building with gcc 4.0
-        - use gcc 4.2 when building with Xcode 3.1 or newer on Leopard, even though this is not the default
-
-        This time there is no performance regression; we can avoid having
-        to use the fastcall calling convention for CTI functions by using
-        varargs to prevent the compiler from moving things around on the
-        stack.
-        
-        * Configurations/DebugRelease.xcconfig:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CTI.cpp:
-        * VM/Machine.h:
-        * wtf/Platform.h:
-
-2008-10-16  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        - fix for REGRESSION: r37631 causing crashes on buildbot
-        https://bugs.webkit.org/show_bug.cgi?id=21682
-        
-        * kjs/collector.cpp:
-        (JSC::Heap::collect): Avoid crashing when a GC occurs while no global objects are live.
-
-2008-10-16  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21683
-        Don't create intermediate StructureIDs for builtin objects
-
-        First step in reduce number of StructureIDs created when initializing the
-        JSGlobalObject.
-
-        - In order to avoid creating the intermediate StructureIDs use the new putDirectWithoutTransition
-          and putDirectFunctionWithoutTransition to add properties to JSObjects without transitioning
-          the StructureID.  This patch just implements this strategy for ObjectPrototype but alone
-          reduces the number of StructureIDs create for about:blank by 10, from 142 to 132.
-
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::reset):
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::putDirectFunctionWithoutTransition):
-        * kjs/JSObject.h:
-        (JSC::JSObject::putDirectWithoutTransition):
-        * kjs/ObjectPrototype.cpp:
-        (JSC::ObjectPrototype::ObjectPrototype):
-        * kjs/ObjectPrototype.h:
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::addPropertyWithoutTransition):
-        * kjs/StructureID.h:
-
-2008-10-16  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Cameron Zwarich.
-        
-        - fix for: REGRESSION: over 100 StructureIDs leak loading about:blank (result of fix for bug 21633)
-        
-        Apparent slight progression (< 0.5%) on v8 benchmarks and SunSpider.
-
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::~StructureID): Don't deref this object's parent's pointer to
-        itself from the destructor; that doesn't even make sense.
-        (JSC::StructureID::addPropertyTransition): Don't refer the single transition;
-        the rule is that parent StructureIDs are ref'd but child ones are not. Refing
-        the child creates a cycle.
-
-2008-10-15  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21609
-        Make MessagePorts protect their peers across heaps
+        - Exposed functions now needed by WebCore.
 
         * JavaScriptCore.exp:
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::markCrossHeapDependentObjects):
-        * kjs/JSGlobalObject.h:
-        * kjs/collector.cpp:
-        (JSC::Heap::collect):
-        Before GC sweep phase, a function supplied by global object is now called for all global
-        objects in the heap, making it possible to implement cross-heap dependencies.
-
-2008-10-15  Alexey Proskuryakov  <ap@webkit.org>
 
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21610
-        run-webkit-threads --threaded crashes in StructureID destructor
-
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::StructureID):
-        (JSC::StructureID::~StructureID):
-        Protect access to a static (debug-only) HashSet with a lock.
-
-2008-10-15  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Goeffrey Garen.
-
-        Add function to dump statistics for StructureIDs.
-
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::dumpStatistics):
-        (JSC::StructureID::StructureID):
-        (JSC::StructureID::~StructureID):
-        * kjs/StructureID.h:
-
-2008-10-15  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 21633: Avoid using a HashMap when there is only a single transition
-        <https://bugs.webkit.org/show_bug.cgi?id=21633>
-
-        This is a 0.8% speedup on SunSpider and between a 0.5% and 1.0% speedup
-        on the V8 benchmark suite, depending on which harness we use. It will
-        also slightly reduce the memory footprint of a StructureID.
-
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::StructureID):
-        (JSC::StructureID::~StructureID):
-        (JSC::StructureID::addPropertyTransition):
-        * kjs/StructureID.h:
-        (JSC::StructureID::):
-
-2008-10-15  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
-
-        Reviewed by Geoffrey Garen.
-
-        1.40% speedup on SunSpider, 1.44% speedup on V8. (Linux)
-        
-        No change on Mac.
-
-        * VM/Machine.cpp:
-        (JSC::fastIsNumber): ALWAYS_INLINE modifier added.
-
-2008-10-15  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=21345
-        Start the debugger without reloading the inspected page
-
-        * JavaScriptCore.exp: New symbols.
-        * JavaScriptCore.xcodeproj/project.pbxproj: New files.
-
-        * VM/CodeBlock.h:
-        (JSC::EvalCodeCache::get): Updated for tweak to parsing API.
-
-        * kjs/CollectorHeapIterator.h: Added. An iterator for the object heap,
-        which we use to find all the live functions and recompile them.
-
-        * kjs/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::evaluate): Updated for tweak to parsing API.
-
-        * kjs/FunctionConstructor.cpp:
-        (JSC::constructFunction): Updated for tweak to parsing API.
-
-        * kjs/JSFunction.cpp:
-        (JSC::JSFunction::JSFunction): Try to validate our SourceCode in debug
-        builds by ASSERTing that it's syntactically valid. This doesn't catch
-        all SourceCode bugs, but it catches a lot of them.
-
-        * kjs/JSGlobalObjectFunctions.cpp:
-        (JSC::globalFuncEval): Updated for tweak to parsing API.
-
-        * kjs/Parser.cpp:
-        (JSC::Parser::parse):
-        * kjs/Parser.h:
-        (JSC::Parser::parse): Tweaked the parser to make it possible to parse
-        without an ExecState, and to allow the client to specify a debugger to
-        notify (or not) about the source we parse. This allows the inspector
-        to recompile even though no JavaScript is executing, then notify the
-        debugger about all source code when it's done.
-
-        * kjs/Shell.cpp:
-        (prettyPrintScript): Updated for tweak to parsing API.
-
-        * kjs/SourceRange.h:
-        (JSC::SourceCode::isNull): Added to help with ASSERTs.
-
-        * kjs/collector.cpp:
-        (JSC::Heap::heapAllocate):
-        (JSC::Heap::sweep):
-        (JSC::Heap::primaryHeapBegin):
-        (JSC::Heap::primaryHeapEnd):
-        * kjs/collector.h:
-        (JSC::): Moved a bunch of declarations around to enable compilation of
-        CollectorHeapIterator.
-
-        * kjs/interpreter.cpp:
-        (JSC::Interpreter::checkSyntax):
-        (JSC::Interpreter::evaluate): Updated for tweak to parsing API.
-
-        * kjs/lexer.h:
-        (JSC::Lexer::sourceCode): BUG FIX: Calculate SourceCode ranges relative
-        to the SourceCode range in which we're lexing, otherwise nested functions
-        that are compiled individually get SourceCode ranges that don't reflect
-        their nesting.
-
-        * kjs/nodes.cpp:
-        (JSC::FunctionBodyNode::FunctionBodyNode):
-        (JSC::FunctionBodyNode::finishParsing):
-        (JSC::FunctionBodyNode::create):
-        (JSC::FunctionBodyNode::copyParameters):
-        * kjs/nodes.h:
-        (JSC::ScopeNode::setSource):
-        (JSC::FunctionBodyNode::parameterCount): Added some helper functions for
-        copying one FunctionBodyNode's parameters to another. The recompiler uses
-        these when calling "finishParsing".
-
-2008-10-15  Joerg Bornemann  <joerg.bornemann@trolltech.com>
-
-        Reviewed by Darin Adler.
-
-        - part of https://bugs.webkit.org/show_bug.cgi?id=20746
-          Fix compilation on Windows CE.
-
-        str(n)icmp, strdup and vsnprintf are not available on Windows CE,
-        they are called _str(n)icmp, etc. instead
-
-        * wtf/StringExtras.h: Added inline function implementations.
-
-2008-10-15  Gabor Loki  <loki@inf.u-szeged.hu>
-
-        Reviewed by Cameron Zwarich.
-
-        <https://bugs.webkit.org/show_bug.cgi?id=20912>
-        Use simple uint32_t multiplication on op_mul if both operands are
-        immediate number and they are between zero and 0x7FFF.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-
-2008-10-09  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Sam Weinig.
-
-        Make pan scrolling a platform configurable option.
-        https://bugs.webkit.org/show_bug.cgi?id=21515
-
-        * wtf/Platform.h: Add ENABLE_PAN_SCROLLING
-
-2008-10-14  Maciej Stachowiak  <mjs@apple.com>
-
-        Rubber stamped by Sam Weinig.
-        
-        - revert r37572 and r37581 for now
-        
-        Turns out GCC 4.2 is still a (small) regression, we'll have to do
-        more work to turn it on.
-
-        * Configurations/DebugRelease.xcconfig:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CTI.cpp:
-        * VM/CTI.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_convert_this):
-        (JSC::Machine::cti_op_end):
-        (JSC::Machine::cti_op_add):
-        (JSC::Machine::cti_op_pre_inc):
-        (JSC::Machine::cti_timeout_check):
-        (JSC::Machine::cti_register_file_check):
-        (JSC::Machine::cti_op_loop_if_less):
-        (JSC::Machine::cti_op_loop_if_lesseq):
-        (JSC::Machine::cti_op_new_object):
-        (JSC::Machine::cti_op_put_by_id):
-        (JSC::Machine::cti_op_put_by_id_second):
-        (JSC::Machine::cti_op_put_by_id_generic):
-        (JSC::Machine::cti_op_put_by_id_fail):
-        (JSC::Machine::cti_op_get_by_id):
-        (JSC::Machine::cti_op_get_by_id_second):
-        (JSC::Machine::cti_op_get_by_id_generic):
-        (JSC::Machine::cti_op_get_by_id_fail):
-        (JSC::Machine::cti_op_instanceof):
-        (JSC::Machine::cti_op_del_by_id):
-        (JSC::Machine::cti_op_mul):
-        (JSC::Machine::cti_op_new_func):
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_vm_compile):
-        (JSC::Machine::cti_op_push_activation):
-        (JSC::Machine::cti_op_call_NotJSFunction):
-        (JSC::Machine::cti_op_create_arguments):
-        (JSC::Machine::cti_op_tear_off_activation):
-        (JSC::Machine::cti_op_tear_off_arguments):
-        (JSC::Machine::cti_op_ret_profiler):
-        (JSC::Machine::cti_op_ret_scopeChain):
-        (JSC::Machine::cti_op_new_array):
-        (JSC::Machine::cti_op_resolve):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-        (JSC::Machine::cti_op_get_by_val):
-        (JSC::Machine::cti_op_resolve_func):
-        (JSC::Machine::cti_op_sub):
-        (JSC::Machine::cti_op_put_by_val):
-        (JSC::Machine::cti_op_put_by_val_array):
-        (JSC::Machine::cti_op_lesseq):
-        (JSC::Machine::cti_op_loop_if_true):
-        (JSC::Machine::cti_op_negate):
-        (JSC::Machine::cti_op_resolve_base):
-        (JSC::Machine::cti_op_resolve_skip):
-        (JSC::Machine::cti_op_resolve_global):
-        (JSC::Machine::cti_op_div):
-        (JSC::Machine::cti_op_pre_dec):
-        (JSC::Machine::cti_op_jless):
-        (JSC::Machine::cti_op_not):
-        (JSC::Machine::cti_op_jtrue):
-        (JSC::Machine::cti_op_post_inc):
-        (JSC::Machine::cti_op_eq):
-        (JSC::Machine::cti_op_lshift):
-        (JSC::Machine::cti_op_bitand):
-        (JSC::Machine::cti_op_rshift):
-        (JSC::Machine::cti_op_bitnot):
-        (JSC::Machine::cti_op_resolve_with_base):
-        (JSC::Machine::cti_op_new_func_exp):
-        (JSC::Machine::cti_op_mod):
-        (JSC::Machine::cti_op_less):
-        (JSC::Machine::cti_op_neq):
-        (JSC::Machine::cti_op_post_dec):
-        (JSC::Machine::cti_op_urshift):
-        (JSC::Machine::cti_op_bitxor):
-        (JSC::Machine::cti_op_new_regexp):
-        (JSC::Machine::cti_op_bitor):
-        (JSC::Machine::cti_op_call_eval):
-        (JSC::Machine::cti_op_throw):
-        (JSC::Machine::cti_op_get_pnames):
-        (JSC::Machine::cti_op_next_pname):
-        (JSC::Machine::cti_op_push_scope):
-        (JSC::Machine::cti_op_pop_scope):
-        (JSC::Machine::cti_op_typeof):
-        (JSC::Machine::cti_op_is_undefined):
-        (JSC::Machine::cti_op_is_boolean):
-        (JSC::Machine::cti_op_is_number):
-        (JSC::Machine::cti_op_is_string):
-        (JSC::Machine::cti_op_is_object):
-        (JSC::Machine::cti_op_is_function):
-        (JSC::Machine::cti_op_stricteq):
-        (JSC::Machine::cti_op_nstricteq):
-        (JSC::Machine::cti_op_to_jsnumber):
-        (JSC::Machine::cti_op_in):
-        (JSC::Machine::cti_op_push_new_scope):
-        (JSC::Machine::cti_op_jmp_scopes):
-        (JSC::Machine::cti_op_put_by_index):
-        (JSC::Machine::cti_op_switch_imm):
-        (JSC::Machine::cti_op_switch_char):
-        (JSC::Machine::cti_op_switch_string):
-        (JSC::Machine::cti_op_del_by_val):
-        (JSC::Machine::cti_op_put_getter):
-        (JSC::Machine::cti_op_put_setter):
-        (JSC::Machine::cti_op_new_error):
-        (JSC::Machine::cti_op_debug):
-        (JSC::Machine::cti_vm_throw):
-        * VM/Machine.h:
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::emitRestoreArgumentReference):
-        (JSC::X86Assembler::emitRestoreArgumentReferenceForTrampoline):
-        * wtf/Platform.h:
-
-2008-10-14  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20256
-        Array.push and other standard methods disappear
-
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        (JSC::JSGlobalData::~JSGlobalData):
-        Don't use static hash tables even on platforms that don't enable JSC_MULTIPLE_THREADS -
-        these tables reference IdentifierTable, which is always per-GlobalData.
-
-2008-10-14  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Cameron Zwarich.
-        
-        - always use CTI_ARGUMENTS and CTI_ARGUMENTS_FASTCALL
-        
-        This is a small regression for GCC 4.0, but simplifies the code
-        for future improvements and lets us focus on GCC 4.2+ and MSVC.
-
-        * VM/CTI.cpp:
-        * VM/CTI.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_convert_this):
-        (JSC::Machine::cti_op_end):
-        (JSC::Machine::cti_op_add):
-        (JSC::Machine::cti_op_pre_inc):
-        (JSC::Machine::cti_timeout_check):
-        (JSC::Machine::cti_register_file_check):
-        (JSC::Machine::cti_op_loop_if_less):
-        (JSC::Machine::cti_op_loop_if_lesseq):
-        (JSC::Machine::cti_op_new_object):
-        (JSC::Machine::cti_op_put_by_id):
-        (JSC::Machine::cti_op_put_by_id_second):
-        (JSC::Machine::cti_op_put_by_id_generic):
-        (JSC::Machine::cti_op_put_by_id_fail):
-        (JSC::Machine::cti_op_get_by_id):
-        (JSC::Machine::cti_op_get_by_id_second):
-        (JSC::Machine::cti_op_get_by_id_generic):
-        (JSC::Machine::cti_op_get_by_id_fail):
-        (JSC::Machine::cti_op_instanceof):
-        (JSC::Machine::cti_op_del_by_id):
-        (JSC::Machine::cti_op_mul):
-        (JSC::Machine::cti_op_new_func):
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_vm_compile):
-        (JSC::Machine::cti_op_push_activation):
-        (JSC::Machine::cti_op_call_NotJSFunction):
-        (JSC::Machine::cti_op_create_arguments):
-        (JSC::Machine::cti_op_tear_off_activation):
-        (JSC::Machine::cti_op_tear_off_arguments):
-        (JSC::Machine::cti_op_ret_profiler):
-        (JSC::Machine::cti_op_ret_scopeChain):
-        (JSC::Machine::cti_op_new_array):
-        (JSC::Machine::cti_op_resolve):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-        (JSC::Machine::cti_op_get_by_val):
-        (JSC::Machine::cti_op_resolve_func):
-        (JSC::Machine::cti_op_sub):
-        (JSC::Machine::cti_op_put_by_val):
-        (JSC::Machine::cti_op_put_by_val_array):
-        (JSC::Machine::cti_op_lesseq):
-        (JSC::Machine::cti_op_loop_if_true):
-        (JSC::Machine::cti_op_negate):
-        (JSC::Machine::cti_op_resolve_base):
-        (JSC::Machine::cti_op_resolve_skip):
-        (JSC::Machine::cti_op_resolve_global):
-        (JSC::Machine::cti_op_div):
-        (JSC::Machine::cti_op_pre_dec):
-        (JSC::Machine::cti_op_jless):
-        (JSC::Machine::cti_op_not):
-        (JSC::Machine::cti_op_jtrue):
-        (JSC::Machine::cti_op_post_inc):
-        (JSC::Machine::cti_op_eq):
-        (JSC::Machine::cti_op_lshift):
-        (JSC::Machine::cti_op_bitand):
-        (JSC::Machine::cti_op_rshift):
-        (JSC::Machine::cti_op_bitnot):
-        (JSC::Machine::cti_op_resolve_with_base):
-        (JSC::Machine::cti_op_new_func_exp):
-        (JSC::Machine::cti_op_mod):
-        (JSC::Machine::cti_op_less):
-        (JSC::Machine::cti_op_neq):
-        (JSC::Machine::cti_op_post_dec):
-        (JSC::Machine::cti_op_urshift):
-        (JSC::Machine::cti_op_bitxor):
-        (JSC::Machine::cti_op_new_regexp):
-        (JSC::Machine::cti_op_bitor):
-        (JSC::Machine::cti_op_call_eval):
-        (JSC::Machine::cti_op_throw):
-        (JSC::Machine::cti_op_get_pnames):
-        (JSC::Machine::cti_op_next_pname):
-        (JSC::Machine::cti_op_push_scope):
-        (JSC::Machine::cti_op_pop_scope):
-        (JSC::Machine::cti_op_typeof):
-        (JSC::Machine::cti_op_is_undefined):
-        (JSC::Machine::cti_op_is_boolean):
-        (JSC::Machine::cti_op_is_number):
-        (JSC::Machine::cti_op_is_string):
-        (JSC::Machine::cti_op_is_object):
-        (JSC::Machine::cti_op_is_function):
-        (JSC::Machine::cti_op_stricteq):
-        (JSC::Machine::cti_op_nstricteq):
-        (JSC::Machine::cti_op_to_jsnumber):
-        (JSC::Machine::cti_op_in):
-        (JSC::Machine::cti_op_push_new_scope):
-        (JSC::Machine::cti_op_jmp_scopes):
-        (JSC::Machine::cti_op_put_by_index):
-        (JSC::Machine::cti_op_switch_imm):
-        (JSC::Machine::cti_op_switch_char):
-        (JSC::Machine::cti_op_switch_string):
-        (JSC::Machine::cti_op_del_by_val):
-        (JSC::Machine::cti_op_put_getter):
-        (JSC::Machine::cti_op_put_setter):
-        (JSC::Machine::cti_op_new_error):
-        (JSC::Machine::cti_op_debug):
-        (JSC::Machine::cti_vm_throw):
-        * VM/Machine.h:
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::emitRestoreArgumentReference):
-        (JSC::X86Assembler::emitRestoreArgumentReferenceForTrampoline):
-        * wtf/Platform.h:
-
-2008-10-13  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Cameron Zwarich.
-        
-        - make Machine::getArgumentsData an Arguments method and inline it
-        
-        ~2% on v8 raytrace
-
-        * VM/Machine.cpp:
-        * kjs/Arguments.h:
-        (JSC::Machine::getArgumentsData):
-
-2008-10-13  Alp Toker  <alp@nuanti.com>
-
-        Fix autotools dist build target by listing recently added header
-        files only. Not reviewed.
-
-        * GNUmakefile.am:
-
-2008-10-13  Maciej Stachowiak  <mjs@apple.com>
-
-        Rubber stamped by Mark Rowe.
-        
-        - fixed <rdar://problem/5806316> JavaScriptCore should not force building with gcc 4.0
-        - use gcc 4.2 when building with Xcode 3.1 or newer on Leopard, even though this is not the default
-
-        * Configurations/DebugRelease.xcconfig:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2008-10-13  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Bug 21541: Move RegisterFile growth check to callee
-        <https://bugs.webkit.org/show_bug.cgi?id=21541>
-
-        Move the RegisterFile growth check to the callee in the common case,
-        where some of the information is known statically at JIT time. There is
-        still a check in the caller in the case where the caller provides too
-        few arguments.
-
-        This is a 2.1% speedup on the V8 benchmark, including a 5.1% speedup on
-        the Richards benchmark, a 4.1% speedup on the DeltaBlue benchmark, and a
-        1.4% speedup on the Earley-Boyer benchmark. It is also a 0.5% speedup on
-        SunSpider.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompile):
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_register_file_check):
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        * VM/Machine.h:
-        * VM/RegisterFile.h:
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::cmpl_mr):
-        (JSC::X86Assembler::emitUnlinkedJg):
-
-2008-10-13  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21577
-        5 false positive StructureID leaks
-
-        - Add leak ignore set to StructureID to selectively ignore leaking some StructureIDs.
-        - Add create method to JSGlolalData to be used when the data will be intentionally
-          leaked and ignore all leaks caused the StructureIDs stored in it.
-
-        * JavaScriptCore.exp:
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::createLeaked):
-        * kjs/JSGlobalData.h:
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::StructureID):
-        (JSC::StructureID::~StructureID):
-        (JSC::StructureID::startIgnoringLeaks):
-        (JSC::StructureID::stopIgnoringLeaks):
-        * kjs/StructureID.h:
-
-2008-10-13  Marco Barisione  <marco.barisione@collabora.co.uk>
-
-        Reviewed by Darin Adler. Landed by Jan Alonzo.
-
-        WebKit GTK Port needs a smartpointer to handle g_free (GFreePtr?)
-        http://bugs.webkit.org/show_bug.cgi?id=20483
-
-        Add a GOwnPtr smart pointer (similar to OwnPtr) to handle memory
-        allocated by GLib and start the conversion to use it.
-
-        * GNUmakefile.am:
-        * wtf/GOwnPtr.cpp: Added.
-        (WTF::GError):
-        (WTF::GList):
-        (WTF::GCond):
-        (WTF::GMutex):
-        (WTF::GPatternSpec):
-        (WTF::GDir):
-        * wtf/GOwnPtr.h: Added.
-        (WTF::freeOwnedPtr):
-        (WTF::GOwnPtr::GOwnPtr):
-        (WTF::GOwnPtr::~GOwnPtr):
-        (WTF::GOwnPtr::get):
-        (WTF::GOwnPtr::release):
-        (WTF::GOwnPtr::rawPtr):
-        (WTF::GOwnPtr::set):
-        (WTF::GOwnPtr::clear):
-        (WTF::GOwnPtr::operator*):
-        (WTF::GOwnPtr::operator->):
-        (WTF::GOwnPtr::operator!):
-        (WTF::GOwnPtr::operator UnspecifiedBoolType):
-        (WTF::GOwnPtr::swap):
-        (WTF::swap):
-        (WTF::operator==):
-        (WTF::operator!=):
-        (WTF::getPtr):
-        * wtf/Threading.h:
-        * wtf/ThreadingGtk.cpp:
-        (WTF::Mutex::~Mutex):
-        (WTF::Mutex::lock):
-        (WTF::Mutex::tryLock):
-        (WTF::Mutex::unlock):
-        (WTF::ThreadCondition::~ThreadCondition):
-        (WTF::ThreadCondition::wait):
-        (WTF::ThreadCondition::timedWait):
-        (WTF::ThreadCondition::signal):
-        (WTF::ThreadCondition::broadcast):
-
-2008-10-12  Gabriella Toth  <gtoth@inf.u-szeged.hu>
-
-        Reviewed by Darin Adler.
-
-        - part of https://bugs.webkit.org/show_bug.cgi?id=21055
-          Bug 21055: not invoked functions
-
-        * kjs/nodes.cpp: Deleted a function that is not invoked:
-        statementListInitializeVariableAccessStack.
-
-2008-10-12  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        * wtf/unicode/icu/UnicodeIcu.h: Fixed indentation to match WebKit coding style.
-        * wtf/unicode/qt4/UnicodeQt4.h: Ditto.
-
-2008-10-12  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=21556
-          Bug 21556: non-ASCII digits are allowed in places where only ASCII should be
-
-        * wtf/unicode/icu/UnicodeIcu.h: Removed isDigit, digitValue, and isFormatChar.
-        * wtf/unicode/qt4/UnicodeQt4.h: Ditto.
-
-2008-10-12  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Make the append method that takes a Vector more strict - it now requires the elements 
-        of the vector to be appended same type as the elements of the Vector they're being appended to.
-        
-        This would cause problems when dealing with Vectors containing other Vectors.
-        
-        * wtf/Vector.h:
-        (WTF::::append):
-
-2008-10-11  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Clean up RegExpMatchesArray.h to match our coding style.
-
-        * kjs/RegExpMatchesArray.h:
-        (JSC::RegExpMatchesArray::getOwnPropertySlot):
-        (JSC::RegExpMatchesArray::put):
-        (JSC::RegExpMatchesArray::deleteProperty):
-        (JSC::RegExpMatchesArray::getPropertyNames):
-
-2008-10-11  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Bug 21525: 55 StructureID leaks on Wikitravel's main page
-        <https://bugs.webkit.org/show_bug.cgi?id=21525>
-
-        Bug 21533: Simple JavaScript code leaks StructureIDs
-        <https://bugs.webkit.org/show_bug.cgi?id=21533>
-
-        StructureID::getEnumerablePropertyNames() ends up calling back to itself
-        via JSObject::getPropertyNames(), which causes the PropertyNameArray to
-        be cached twice. This leads to a memory leak in almost every use of
-        JSObject::getPropertyNames() on an object. The fix here is based on a
-        suggestion of Sam Weinig.
-
-        This patch also fixes every StructureID leaks that occurs while running
-        the Mozilla MemBuster test.
-
-        * kjs/PropertyNameArray.h:
-        (JSC::PropertyNameArray::PropertyNameArray):
-        (JSC::PropertyNameArray::setCacheable):
-        (JSC::PropertyNameArray::cacheable):
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::getEnumerablePropertyNames):
-
-2008-10-10  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Use fastcall calling convention on GCC > 4.0
-
-        Results in a 2-3% improvement in GCC 4.2 performance, so
-        that it is no longer a regression vs. GCC 4.0
-
-        * VM/CTI.cpp:
-        * VM/Machine.h:
-        * wtf/Platform.h:
-
-2008-10-10  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        - Add a workaround for a bug in ceil in Darwin libc.
-        - Remove old workarounds for JS math functions that are not needed
-          anymore.
-
-        The math functions are heavily tested by fast/js/math.html.
-
-        * kjs/MathObject.cpp:
-        (JSC::mathProtoFuncAbs): Remove workaround.
-        (JSC::mathProtoFuncCeil): Ditto.
-        (JSC::mathProtoFuncFloor): Ditto.
-        * wtf/MathExtras.h:
-        (wtf_ceil): Add ceil workaround for darwin.
-
-2008-10-10  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Darin Adler
-
-        Add Assertions to JSObject constructor.
-
-        * kjs/JSObject.h:
-        (JSC::JSObject::JSObject):
-
-2008-10-10  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Cameron Zwarich.
-
-        Remove now unused m_getterSetterFlag variable from PropertyMap.
-
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMap::operator=):
-        * kjs/PropertyMap.h:
-        (JSC::PropertyMap::PropertyMap):
-
-2008-10-09  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Add leaks checking to StructureID.
-
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::StructureID):
-        (JSC::StructureID::~StructureID):
-
-2008-10-09  Alp Toker  <alp@nuanti.com>
-
-        Reviewed by Mark Rowe.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20760
-        Implement support for x86 Linux in CTI
-
-        Prepare to enable CTI/WREC on supported architectures.
-
-        Make it possible to use the CTI_ARGUMENT workaround with GCC as well
-        as MSVC by fixing some preprocessor conditionals.
-
-        Note that CTI/WREC no longer requires CTI_ARGUMENT on Linux so we
-        don't actually enable it except when building with MSVC. GCC on Win32
-        remains untested.
-
-        Adapt inline ASM code to use the global symbol underscore prefix only
-        on Darwin and to call the properly mangled Machine::cti_vm_throw
-        symbol name depending on CTI_ARGUMENT.
-
-        Also avoid global inclusion of the JIT infrastructure headers
-        throughout WebCore and WebKit causing recompilation of about ~1500
-        source files after modification to X86Assembler.h, CTI.h, WREC.h,
-        which are only used deep inside JavaScriptCore.
-
-        * GNUmakefile.am:
-        * VM/CTI.cpp:
-        * VM/CTI.h:
-        * VM/Machine.cpp:
-        * VM/Machine.h:
-        * kjs/regexp.cpp:
-        (JSC::RegExp::RegExp):
-        (JSC::RegExp::~RegExp):
-        (JSC::RegExp::match):
-        * kjs/regexp.h:
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::emitConvertToFastCall):
-        (JSC::X86Assembler::emitRestoreArgumentReferenceForTrampoline):
-        (JSC::X86Assembler::emitRestoreArgumentReference):
-
-2008-10-09  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Fix for bug #21160, x=0;1/(x*-1) == -Infinity
-
-        * ChangeLog:
-        * VM/CTI.cpp:
-        (JSC::CTI::emitFastArithDeTagImmediate):
-        (JSC::CTI::emitFastArithDeTagImmediateJumpIfZero):
-        (JSC::CTI::compileBinaryArithOp):
-        (JSC::CTI::compileBinaryArithOpSlowCase):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/CTI.h:
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::emitUnlinkedJs):
-
-2008-10-09  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 21459: REGRESSION (r37324): Safari crashes inside JavaScriptCore while browsing hulu.com
-        <https://bugs.webkit.org/show_bug.cgi?id=21459>
-
-        After r37324, an Arguments object does not mark an associated activation
-        object. This change was made because Arguments no longer directly used
-        the activation object in any way. However, if an activation is torn off,
-        then the backing store of Arguments becomes the register array of the
-        activation object. Arguments directly marks all of the arguments, but
-        the activation object is being collected, which causes its register
-        array to be freed and new memory to be allocated in its place.
-
-        Unfortunately, it does not seem possible to reproduce this issue in a
-        layout test.
-
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::mark):
-        * kjs/Arguments.h:
-        (JSC::Arguments::setActivation):
-        (JSC::Arguments::Arguments):
-        (JSC::JSActivation::copyRegisters):
-
-2008-10-09  Ariya Hidayat  <ariya.hidayat@trolltech.com>
-
-        Reviewed by Simon.
-
-        Build fix for MinGW.
-
-        * wtf/AlwaysInline.h:
-
-2008-10-08  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 21497: REGRESSION (r37433): Bytecode JSC tests are severely broken
-        <https://bugs.webkit.org/show_bug.cgi?id=21497>
-
-        Fix a typo in r37433 that causes the failure of a large number of JSC
-        tests with the bytecode interpreter enabled.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-
-2008-10-08  Mark Rowe  <mrowe@apple.com>
-
-        Windows build fix.
-
-        * VM/CTI.cpp:
-        (JSC::): Update type of argument to ctiTrampoline.
-
-2008-10-08  Darin Adler  <darin@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=21403
-          Bug 21403: use new CallFrame class rather than Register* for call frame manipulation
-
-        Add CallFrame as a synonym for ExecState. Arguably, some day we should switch every
-        client over to the new name.
-
-        Use CallFrame* consistently rather than Register* or ExecState* in low-level code such
-        as Machine.cpp and CTI.cpp. Similarly, use callFrame rather than r as its name and use
-        accessor functions to get at things in the frame.
-
-        Eliminate other uses of ExecState* that aren't needed, replacing in some cases with
-        JSGlobalData* and in other cases eliminating them entirely.
-
-        * API/JSObjectRef.cpp:
-        (JSObjectMakeFunctionWithCallback):
-        (JSObjectMakeFunction):
-        (JSObjectHasProperty):
-        (JSObjectGetProperty):
-        (JSObjectSetProperty):
-        (JSObjectDeleteProperty):
-        * API/OpaqueJSString.cpp:
-        * API/OpaqueJSString.h:
-        * VM/CTI.cpp:
-        (JSC::CTI::getConstant):
-        (JSC::CTI::emitGetArg):
-        (JSC::CTI::emitGetPutArg):
-        (JSC::CTI::getConstantImmediateNumericArg):
-        (JSC::CTI::printOpcodeOperandTypes):
-        (JSC::CTI::CTI):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::compileBinaryArithOp):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompile):
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        (JSC::CTI::compileRegExp):
-        * VM/CTI.h:
-        * VM/CodeBlock.h:
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitEqualityOp):
-        (JSC::CodeGenerator::emitLoad):
-        (JSC::CodeGenerator::emitUnexpectedLoad):
-        (JSC::CodeGenerator::emitConstruct):
-        * VM/CodeGenerator.h:
-        * VM/Machine.cpp:
-        (JSC::jsLess):
-        (JSC::jsLessEq):
-        (JSC::jsAddSlowCase):
-        (JSC::jsAdd):
-        (JSC::jsTypeStringForValue):
-        (JSC::Machine::resolve):
-        (JSC::Machine::resolveSkip):
-        (JSC::Machine::resolveGlobal):
-        (JSC::inlineResolveBase):
-        (JSC::Machine::resolveBase):
-        (JSC::Machine::resolveBaseAndProperty):
-        (JSC::Machine::resolveBaseAndFunc):
-        (JSC::Machine::slideRegisterWindowForCall):
-        (JSC::isNotObject):
-        (JSC::Machine::callEval):
-        (JSC::Machine::dumpCallFrame):
-        (JSC::Machine::dumpRegisters):
-        (JSC::Machine::unwindCallFrame):
-        (JSC::Machine::throwException):
-        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
-        (JSC::DynamicGlobalObjectScope::~DynamicGlobalObjectScope):
-        (JSC::Machine::execute):
-        (JSC::Machine::debug):
-        (JSC::Machine::createExceptionScope):
-        (JSC::cachePrototypeChain):
-        (JSC::Machine::tryCachePutByID):
-        (JSC::Machine::tryCacheGetByID):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::retrieveArguments):
-        (JSC::Machine::retrieveCaller):
-        (JSC::Machine::retrieveLastCaller):
-        (JSC::Machine::findFunctionCallFrame):
-        (JSC::Machine::getArgumentsData):
-        (JSC::Machine::tryCTICachePutByID):
-        (JSC::Machine::getCTIArrayLengthTrampoline):
-        (JSC::Machine::getCTIStringLengthTrampoline):
-        (JSC::Machine::tryCTICacheGetByID):
-        (JSC::Machine::cti_op_convert_this):
-        (JSC::Machine::cti_op_end):
-        (JSC::Machine::cti_op_add):
-        (JSC::Machine::cti_op_pre_inc):
-        (JSC::Machine::cti_timeout_check):
-        (JSC::Machine::cti_op_loop_if_less):
-        (JSC::Machine::cti_op_loop_if_lesseq):
-        (JSC::Machine::cti_op_new_object):
-        (JSC::Machine::cti_op_put_by_id):
-        (JSC::Machine::cti_op_put_by_id_second):
-        (JSC::Machine::cti_op_put_by_id_generic):
-        (JSC::Machine::cti_op_put_by_id_fail):
-        (JSC::Machine::cti_op_get_by_id):
-        (JSC::Machine::cti_op_get_by_id_second):
-        (JSC::Machine::cti_op_get_by_id_generic):
-        (JSC::Machine::cti_op_get_by_id_fail):
-        (JSC::Machine::cti_op_instanceof):
-        (JSC::Machine::cti_op_del_by_id):
-        (JSC::Machine::cti_op_mul):
-        (JSC::Machine::cti_op_new_func):
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_vm_compile):
-        (JSC::Machine::cti_op_push_activation):
-        (JSC::Machine::cti_op_call_NotJSFunction):
-        (JSC::Machine::cti_op_create_arguments):
-        (JSC::Machine::cti_op_tear_off_activation):
-        (JSC::Machine::cti_op_tear_off_arguments):
-        (JSC::Machine::cti_op_ret_profiler):
-        (JSC::Machine::cti_op_ret_scopeChain):
-        (JSC::Machine::cti_op_new_array):
-        (JSC::Machine::cti_op_resolve):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-        (JSC::Machine::cti_op_get_by_val):
-        (JSC::Machine::cti_op_resolve_func):
-        (JSC::Machine::cti_op_sub):
-        (JSC::Machine::cti_op_put_by_val):
-        (JSC::Machine::cti_op_put_by_val_array):
-        (JSC::Machine::cti_op_lesseq):
-        (JSC::Machine::cti_op_loop_if_true):
-        (JSC::Machine::cti_op_negate):
-        (JSC::Machine::cti_op_resolve_base):
-        (JSC::Machine::cti_op_resolve_skip):
-        (JSC::Machine::cti_op_resolve_global):
-        (JSC::Machine::cti_op_div):
-        (JSC::Machine::cti_op_pre_dec):
-        (JSC::Machine::cti_op_jless):
-        (JSC::Machine::cti_op_not):
-        (JSC::Machine::cti_op_jtrue):
-        (JSC::Machine::cti_op_post_inc):
-        (JSC::Machine::cti_op_eq):
-        (JSC::Machine::cti_op_lshift):
-        (JSC::Machine::cti_op_bitand):
-        (JSC::Machine::cti_op_rshift):
-        (JSC::Machine::cti_op_bitnot):
-        (JSC::Machine::cti_op_resolve_with_base):
-        (JSC::Machine::cti_op_new_func_exp):
-        (JSC::Machine::cti_op_mod):
-        (JSC::Machine::cti_op_less):
-        (JSC::Machine::cti_op_neq):
-        (JSC::Machine::cti_op_post_dec):
-        (JSC::Machine::cti_op_urshift):
-        (JSC::Machine::cti_op_bitxor):
-        (JSC::Machine::cti_op_new_regexp):
-        (JSC::Machine::cti_op_bitor):
-        (JSC::Machine::cti_op_call_eval):
-        (JSC::Machine::cti_op_throw):
-        (JSC::Machine::cti_op_get_pnames):
-        (JSC::Machine::cti_op_next_pname):
-        (JSC::Machine::cti_op_push_scope):
-        (JSC::Machine::cti_op_pop_scope):
-        (JSC::Machine::cti_op_typeof):
-        (JSC::Machine::cti_op_to_jsnumber):
-        (JSC::Machine::cti_op_in):
-        (JSC::Machine::cti_op_push_new_scope):
-        (JSC::Machine::cti_op_jmp_scopes):
-        (JSC::Machine::cti_op_put_by_index):
-        (JSC::Machine::cti_op_switch_imm):
-        (JSC::Machine::cti_op_switch_char):
-        (JSC::Machine::cti_op_switch_string):
-        (JSC::Machine::cti_op_del_by_val):
-        (JSC::Machine::cti_op_put_getter):
-        (JSC::Machine::cti_op_put_setter):
-        (JSC::Machine::cti_op_new_error):
-        (JSC::Machine::cti_op_debug):
-        (JSC::Machine::cti_vm_throw):
-        * VM/Machine.h:
-        * VM/Register.h:
-        * VM/RegisterFile.h:
-        * kjs/Arguments.h:
-        * kjs/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::functionName):
-        (JSC::DebuggerCallFrame::type):
-        (JSC::DebuggerCallFrame::thisObject):
-        (JSC::DebuggerCallFrame::evaluate):
-        * kjs/DebuggerCallFrame.h:
-        * kjs/ExecState.cpp:
-        (JSC::CallFrame::thisValue):
-        * kjs/ExecState.h:
-        * kjs/FunctionConstructor.cpp:
-        (JSC::constructFunction):
-        * kjs/JSActivation.cpp:
-        (JSC::JSActivation::JSActivation):
-        (JSC::JSActivation::argumentsGetter):
-        * kjs/JSActivation.h:
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::init):
-        * kjs/JSGlobalObjectFunctions.cpp:
-        (JSC::globalFuncEval):
-        * kjs/JSVariableObject.h:
-        * kjs/Parser.cpp:
-        (JSC::Parser::parse):
-        * kjs/RegExpConstructor.cpp:
-        (JSC::constructRegExp):
-        * kjs/RegExpPrototype.cpp:
-        (JSC::regExpProtoFuncCompile):
-        * kjs/Shell.cpp:
-        (prettyPrintScript):
-        * kjs/StringPrototype.cpp:
-        (JSC::stringProtoFuncMatch):
-        (JSC::stringProtoFuncSearch):
-        * kjs/identifier.cpp:
-        (JSC::Identifier::checkSameIdentifierTable):
-        * kjs/interpreter.cpp:
-        (JSC::Interpreter::checkSyntax):
-        (JSC::Interpreter::evaluate):
-        * kjs/nodes.cpp:
-        (JSC::ThrowableExpressionData::emitThrowError):
-        (JSC::RegExpNode::emitCode):
-        (JSC::ArrayNode::emitCode):
-        (JSC::InstanceOfNode::emitCode):
-        * kjs/nodes.h:
-        * kjs/regexp.cpp:
-        (JSC::RegExp::RegExp):
-        (JSC::RegExp::create):
-        * kjs/regexp.h:
-        * profiler/HeavyProfile.h:
-        * profiler/Profile.h:
-        * wrec/WREC.cpp:
-        * wrec/WREC.h:
-
-2008-10-08  Mark Rowe  <mrowe@apple.com>
-
-        Typed by Maciej Stachowiak, reviewed by Mark Rowe.
-
-        Fix crash in fast/js/constant-folding.html with CTI disabled.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-
-2008-10-08  Timothy Hatcher  <timothy@apple.com>
-
-        Roll out r37427 because it causes an infinite recursion loading about:blank.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21476
-
-2008-10-08  Darin Adler  <darin@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=21403
-          Bug 21403: use new CallFrame class rather than Register* for call frame manipulation
-
-        Add CallFrame as a synonym for ExecState. Arguably, some day we should switch every
-        client over to the new name.
-
-        Use CallFrame* consistently rather than Register* or ExecState* in low-level code such
-        as Machine.cpp and CTI.cpp. Similarly, use callFrame rather than r as its name and use
-        accessor functions to get at things in the frame.
-
-        Eliminate other uses of ExecState* that aren't needed, replacing in some cases with
-        JSGlobalData* and in other cases eliminating them entirely.
-
-        * API/JSObjectRef.cpp:
-        (JSObjectMakeFunctionWithCallback):
-        (JSObjectMakeFunction):
-        (JSObjectHasProperty):
-        (JSObjectGetProperty):
-        (JSObjectSetProperty):
-        (JSObjectDeleteProperty):
-        * API/OpaqueJSString.cpp:
-        * API/OpaqueJSString.h:
-        * VM/CTI.cpp:
-        (JSC::CTI::getConstant):
-        (JSC::CTI::emitGetArg):
-        (JSC::CTI::emitGetPutArg):
-        (JSC::CTI::getConstantImmediateNumericArg):
-        (JSC::CTI::printOpcodeOperandTypes):
-        (JSC::CTI::CTI):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::compileBinaryArithOp):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompile):
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        (JSC::CTI::compileRegExp):
-        * VM/CTI.h:
-        * VM/CodeBlock.h:
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitEqualityOp):
-        (JSC::CodeGenerator::emitLoad):
-        (JSC::CodeGenerator::emitUnexpectedLoad):
-        (JSC::CodeGenerator::emitConstruct):
-        * VM/CodeGenerator.h:
-        * VM/Machine.cpp:
-        (JSC::jsLess):
-        (JSC::jsLessEq):
-        (JSC::jsAddSlowCase):
-        (JSC::jsAdd):
-        (JSC::jsTypeStringForValue):
-        (JSC::Machine::resolve):
-        (JSC::Machine::resolveSkip):
-        (JSC::Machine::resolveGlobal):
-        (JSC::inlineResolveBase):
-        (JSC::Machine::resolveBase):
-        (JSC::Machine::resolveBaseAndProperty):
-        (JSC::Machine::resolveBaseAndFunc):
-        (JSC::Machine::slideRegisterWindowForCall):
-        (JSC::isNotObject):
-        (JSC::Machine::callEval):
-        (JSC::Machine::dumpCallFrame):
-        (JSC::Machine::dumpRegisters):
-        (JSC::Machine::unwindCallFrame):
-        (JSC::Machine::throwException):
-        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
-        (JSC::DynamicGlobalObjectScope::~DynamicGlobalObjectScope):
-        (JSC::Machine::execute):
-        (JSC::Machine::debug):
-        (JSC::Machine::createExceptionScope):
-        (JSC::cachePrototypeChain):
-        (JSC::Machine::tryCachePutByID):
-        (JSC::Machine::tryCacheGetByID):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::retrieveArguments):
-        (JSC::Machine::retrieveCaller):
-        (JSC::Machine::retrieveLastCaller):
-        (JSC::Machine::findFunctionCallFrame):
-        (JSC::Machine::getArgumentsData):
-        (JSC::Machine::tryCTICachePutByID):
-        (JSC::Machine::getCTIArrayLengthTrampoline):
-        (JSC::Machine::getCTIStringLengthTrampoline):
-        (JSC::Machine::tryCTICacheGetByID):
-        (JSC::Machine::cti_op_convert_this):
-        (JSC::Machine::cti_op_end):
-        (JSC::Machine::cti_op_add):
-        (JSC::Machine::cti_op_pre_inc):
-        (JSC::Machine::cti_timeout_check):
-        (JSC::Machine::cti_op_loop_if_less):
-        (JSC::Machine::cti_op_loop_if_lesseq):
-        (JSC::Machine::cti_op_new_object):
-        (JSC::Machine::cti_op_put_by_id):
-        (JSC::Machine::cti_op_put_by_id_second):
-        (JSC::Machine::cti_op_put_by_id_generic):
-        (JSC::Machine::cti_op_put_by_id_fail):
-        (JSC::Machine::cti_op_get_by_id):
-        (JSC::Machine::cti_op_get_by_id_second):
-        (JSC::Machine::cti_op_get_by_id_generic):
-        (JSC::Machine::cti_op_get_by_id_fail):
-        (JSC::Machine::cti_op_instanceof):
-        (JSC::Machine::cti_op_del_by_id):
-        (JSC::Machine::cti_op_mul):
-        (JSC::Machine::cti_op_new_func):
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_vm_compile):
-        (JSC::Machine::cti_op_push_activation):
-        (JSC::Machine::cti_op_call_NotJSFunction):
-        (JSC::Machine::cti_op_create_arguments):
-        (JSC::Machine::cti_op_tear_off_activation):
-        (JSC::Machine::cti_op_tear_off_arguments):
-        (JSC::Machine::cti_op_ret_profiler):
-        (JSC::Machine::cti_op_ret_scopeChain):
-        (JSC::Machine::cti_op_new_array):
-        (JSC::Machine::cti_op_resolve):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-        (JSC::Machine::cti_op_get_by_val):
-        (JSC::Machine::cti_op_resolve_func):
-        (JSC::Machine::cti_op_sub):
-        (JSC::Machine::cti_op_put_by_val):
-        (JSC::Machine::cti_op_put_by_val_array):
-        (JSC::Machine::cti_op_lesseq):
-        (JSC::Machine::cti_op_loop_if_true):
-        (JSC::Machine::cti_op_negate):
-        (JSC::Machine::cti_op_resolve_base):
-        (JSC::Machine::cti_op_resolve_skip):
-        (JSC::Machine::cti_op_resolve_global):
-        (JSC::Machine::cti_op_div):
-        (JSC::Machine::cti_op_pre_dec):
-        (JSC::Machine::cti_op_jless):
-        (JSC::Machine::cti_op_not):
-        (JSC::Machine::cti_op_jtrue):
-        (JSC::Machine::cti_op_post_inc):
-        (JSC::Machine::cti_op_eq):
-        (JSC::Machine::cti_op_lshift):
-        (JSC::Machine::cti_op_bitand):
-        (JSC::Machine::cti_op_rshift):
-        (JSC::Machine::cti_op_bitnot):
-        (JSC::Machine::cti_op_resolve_with_base):
-        (JSC::Machine::cti_op_new_func_exp):
-        (JSC::Machine::cti_op_mod):
-        (JSC::Machine::cti_op_less):
-        (JSC::Machine::cti_op_neq):
-        (JSC::Machine::cti_op_post_dec):
-        (JSC::Machine::cti_op_urshift):
-        (JSC::Machine::cti_op_bitxor):
-        (JSC::Machine::cti_op_new_regexp):
-        (JSC::Machine::cti_op_bitor):
-        (JSC::Machine::cti_op_call_eval):
-        (JSC::Machine::cti_op_throw):
-        (JSC::Machine::cti_op_get_pnames):
-        (JSC::Machine::cti_op_next_pname):
-        (JSC::Machine::cti_op_push_scope):
-        (JSC::Machine::cti_op_pop_scope):
-        (JSC::Machine::cti_op_typeof):
-        (JSC::Machine::cti_op_to_jsnumber):
-        (JSC::Machine::cti_op_in):
-        (JSC::Machine::cti_op_push_new_scope):
-        (JSC::Machine::cti_op_jmp_scopes):
-        (JSC::Machine::cti_op_put_by_index):
-        (JSC::Machine::cti_op_switch_imm):
-        (JSC::Machine::cti_op_switch_char):
-        (JSC::Machine::cti_op_switch_string):
-        (JSC::Machine::cti_op_del_by_val):
-        (JSC::Machine::cti_op_put_getter):
-        (JSC::Machine::cti_op_put_setter):
-        (JSC::Machine::cti_op_new_error):
-        (JSC::Machine::cti_op_debug):
-        (JSC::Machine::cti_vm_throw):
-        * VM/Machine.h:
-        * VM/Register.h:
-        * VM/RegisterFile.h:
-        * kjs/Arguments.h:
-        * kjs/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::functionName):
-        (JSC::DebuggerCallFrame::type):
-        (JSC::DebuggerCallFrame::thisObject):
-        (JSC::DebuggerCallFrame::evaluate):
-        * kjs/DebuggerCallFrame.h:
-        * kjs/ExecState.cpp:
-        (JSC::CallFrame::thisValue):
-        * kjs/ExecState.h:
-        * kjs/FunctionConstructor.cpp:
-        (JSC::constructFunction):
-        * kjs/JSActivation.cpp:
-        (JSC::JSActivation::JSActivation):
-        (JSC::JSActivation::argumentsGetter):
-        * kjs/JSActivation.h:
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::init):
-        * kjs/JSGlobalObjectFunctions.cpp:
-        (JSC::globalFuncEval):
-        * kjs/JSVariableObject.h:
-        * kjs/Parser.cpp:
-        (JSC::Parser::parse):
-        * kjs/RegExpConstructor.cpp:
-        (JSC::constructRegExp):
-        * kjs/RegExpPrototype.cpp:
-        (JSC::regExpProtoFuncCompile):
-        * kjs/Shell.cpp:
-        (prettyPrintScript):
-        * kjs/StringPrototype.cpp:
-        (JSC::stringProtoFuncMatch):
-        (JSC::stringProtoFuncSearch):
-        * kjs/identifier.cpp:
-        (JSC::Identifier::checkSameIdentifierTable):
-        * kjs/interpreter.cpp:
-        (JSC::Interpreter::checkSyntax):
-        (JSC::Interpreter::evaluate):
-        * kjs/nodes.cpp:
-        (JSC::ThrowableExpressionData::emitThrowError):
-        (JSC::RegExpNode::emitCode):
-        (JSC::ArrayNode::emitCode):
-        (JSC::InstanceOfNode::emitCode):
-        * kjs/nodes.h:
-        * kjs/regexp.cpp:
-        (JSC::RegExp::RegExp):
-        (JSC::RegExp::create):
-        * kjs/regexp.h:
-        * profiler/HeavyProfile.h:
-        * profiler/Profile.h:
-        * wrec/WREC.cpp:
-        * wrec/WREC.h:
-
-2008-10-08  Prasanth Ullattil  <pullatti@trolltech.com>
-
-        Reviewed by Oliver Hunt.
-
-        Avoid endless loops when compiling without the computed goto
-        optimization.
-
-        NEXT_OPCODE expands to "continue", which will not work inside
-        loops.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-
-2008-10-08  Maciej Stachowiak  <mjs@apple.com>
+2009-06-17  Darin Adler  <darin@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        Re-landing the following fix with the crashing bug in it fixed (r37405):
-        
-        - optimize away multiplication by constant 1.0
-        
-        2.3% speedup on v8 RayTrace benchmark
-
-        Apparently it's not uncommon for JavaScript code to multiply by
-        constant 1.0 in the mistaken belief that this converts integer to
-        floating point and that there is any operational difference.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass): Optimize to_jsnumber for
-        case where parameter is already number.
-        (JSC::CTI::privateCompileSlowCases): ditto
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute): ditto
-        * kjs/grammar.y:
-        (makeMultNode): Transform as follows:
-        +FOO * BAR ==> FOO * BAR
-        FOO * +BAR ==> FOO * BAR
-        FOO * 1 ==> +FOO
-        1 * FOO ==> +FOO
-        (makeDivNode): Transform as follows:
-        +FOO / BAR ==> FOO / BAR
-        FOO / +BAR ==> FOO / BAR
-        (makeSubNode): Transform as follows:
-        +FOO - BAR ==> FOO - BAR
-        FOO - +BAR ==> FOO - BAR
-        * kjs/nodes.h:
-        (JSC::ExpressionNode::stripUnaryPlus): Helper for above
-        grammar.y changes
-        (JSC::UnaryPlusNode::stripUnaryPlus): ditto
-
-2008-10-08  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Oliver Hunt.
-        
-        - correctly handle appending -0 to a string, it should stringify as just 0
-
-        * kjs/ustring.cpp:
-        (JSC::concatenate):
-
-2008-10-08  Prasanth Ullattil  <pullatti@trolltech.com>
-
-        Reviewed by Simon.
-
-        Fix WebKit compilation with VC2008SP1
-
-        Apply the TR1 workaround for JavaScriptCore, too.
-
-        * JavaScriptCore.pro:
-
-2008-10-08  Prasanth Ullattil  <pullatti@trolltech.com>
-
-        Reviewed by Simon.
-
-        Fix compilation errors on VS2008 64Bit
-
-        * kjs/collector.cpp:
-        (JSC::currentThreadStackBase):
-
-2008-10-08  André Pönitz  <apoenitz@trolltech.com>
+        Bug 26429: Make JSON.stringify non-recursive so it can handle objects
+        of arbitrary complexity
+        https://bugs.webkit.org/show_bug.cgi?id=26429
 
-        Reviewed by Simon.
+        For marking I decided not to use gcProtect, because this is inside the engine
+        so it's easy enough to just do marking. And that darned gcProtect does locking!
+        Oliver tried to convince me to used MarkedArgumentBuffer, but the constructor
+        for that class says "FIXME: Remove all clients of this API, then remove this API."
 
-        Fix compilation with Qt namespaces.
-
-        * wtf/Threading.h:
-
-2008-10-07  Sam Weinig  <sam@webkit.org>
-
-        Roll out r37405.
-
-2008-10-07  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Switch CTI runtime calls to the fastcall calling convention
-
-        Basically this means that we get to store the argument for CTI
-        calls in the ECX register, which saves a register->memory write
-        and subsequent memory->register read.
-        
-        This is a 1.7% progression in SunSpider and 2.4% on commandline
-        v8 tests on Windows
-
-        * VM/CTI.cpp:
-        (JSC::):
-        (JSC::CTI::privateCompilePutByIdTransition):
-        (JSC::CTI::privateCompilePatchGetArrayLength):
-        * VM/CTI.h:
-        * VM/Machine.h:
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::emitRestoreArgumentReference):
-        (JSC::X86Assembler::emitRestoreArgumentReferenceForTrampoline):
-          We need this to correctly reload ecx from inside certain property access
-          trampolines.
-        * wtf/Platform.h:
-
-2008-10-07  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Mark Rowe.
-        
-        - optimize away multiplication by constant 1.0
-        
-        2.3% speedup on v8 RayTrace benchmark
-
-        Apparently it's not uncommon for JavaScript code to multiply by
-        constant 1.0 in the mistaken belief that this converts integer to
-        floating point and that there is any operational difference.
-        
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass): Optimize to_jsnumber for
-        case where parameter is already number.
-        (JSC::CTI::privateCompileSlowCases): ditto
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute): ditto
-        * kjs/grammar.y:
-        (makeMultNode): Transform as follows:
-        +FOO * BAR ==> FOO * BAR
-        FOO * +BAR ==> FOO * BAR
-        FOO * 1 ==> +FOO
-        1 * FOO ==> +FOO
-        (makeDivNode): Transform as follows:
-        +FOO / BAR ==> FOO / BAR
-        FOO / +BAR ==> FOO / BAR
-        (makeSubNode): Transform as follows:
-        +FOO - BAR ==> FOO - BAR
-        FOO - +BAR ==> FOO - BAR
-        * kjs/nodes.h:
-        (JSC::ExpressionNode::stripUnaryPlus): Helper for above
-        grammar.y changes
-        (JSC::UnaryPlusNode::stripUnaryPlus): ditto
-
-2008-10-07  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Oliver Hunt.
-        
-        - make constant folding code more consistent
-        
-        Added a makeSubNode to match add, mult and div; use the makeFooNode functions always,
-        instead of allocating nodes directly in other places in the grammar.
-
-        * kjs/grammar.y:
-
-2008-10-07  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Cameron Zwarich.
-
-        Move hasGetterSetterProperties flag from PropertyMap to StructureID.
+        * runtime/Collector.cpp:
+        (JSC::Heap::collect): Add a call to JSONObject::markStringifiers.
 
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::put):
-        (JSC::JSObject::defineGetter):
-        (JSC::JSObject::defineSetter):
-        * kjs/JSObject.h:
-        (JSC::JSObject::hasGetterSetterProperties):
-        (JSC::JSObject::getOwnPropertySlotForWrite):
-        (JSC::JSObject::getOwnPropertySlot):
-        * kjs/PropertyMap.h:
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::StructureID):
-        (JSC::StructureID::addPropertyTransition):
-        (JSC::StructureID::toDictionaryTransition):
-        (JSC::StructureID::changePrototypeTransition):
-        (JSC::StructureID::getterSetterTransition):
-        * kjs/StructureID.h:
-        (JSC::StructureID::hasGetterSetterProperties):
-        (JSC::StructureID::setHasGetterSetterProperties):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers): Added emptyIdentifier.
+        * runtime/CommonIdentifiers.h: Ditto.
 
-2008-10-07  Sam Weinig  <sam@webkit.org>
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Initialize firstStringifierToMark to 0.
+        * runtime/JSGlobalData.h: Added firstStringifierToMark.
+
+        * runtime/JSONObject.cpp: Cut down the includes to the needed ones only.
+        (JSC::unwrapNumberOrString): Added. Helper for unwrapping number and string
+        objects to get their number and string values.
+        (JSC::ReplacerPropertyName::ReplacerPropertyName): Added. The class is used
+        to wrap an identifier or integer so we don't have to do any work unless we
+        actually call a replacer.
+        (JSC::ReplacerPropertyName::value): Added.
+        (JSC::gap): Added. Helper function for the Stringifier constructor.
+        (JSC::PropertyNameForFunctionCall::PropertyNameForFunctionCall): Added.
+        The class is used to wrap an identifier or integer so we don't have to
+        allocate a number or string until we actually call toJSON or a replacer.
+        (JSC::PropertyNameForFunctionCall::asJSValue): Added.
+        (JSC::Stringifier::Stringifier): Updated and moved out of the class
+        definition. Added code to hook this into a singly linked list for marking.
+        (JSC::Stringifier::~Stringifier): Remove from the singly linked list.
+        (JSC::Stringifier::mark): Mark all the objects in the holder stacks.
+        (JSC::Stringifier::stringify): Updated.
+        (JSC::Stringifier::appendQuotedString): Tweaked and streamlined a bit.
+        (JSC::Stringifier::toJSON): Renamed from toJSONValue.
+        (JSC::Stringifier::appendStringifiedValue): Renamed from stringify.
+        Added code to use the m_holderStack to do non-recursive stringify of
+        objects and arrays. This code also uses the timeout checker since in
+        pathological cases it could be slow even without calling into the
+        JavaScript virtual machine.
+        (JSC::Stringifier::willIndent): Added.
+        (JSC::Stringifier::indent): Added.
+        (JSC::Stringifier::unindent): Added.
+        (JSC::Stringifier::startNewLine): Added.
+        (JSC::Stringifier::Holder::Holder): Added.
+        (JSC::Stringifier::Holder::appendNextProperty): Added. This is the
+        function that handles the format of arrays and objects.
+        (JSC::JSONObject::getOwnPropertySlot): Moved this down to the bottom
+        of the file so the JSONObject class is not interleaved with the
+        Stringifier class.
+        (JSC::JSONObject::markStringifiers): Added. Calls mark.
+        (JSC::JSONProtoFuncStringify): Streamlined the code here. The code
+        to compute the gap string is now a separate function.
+
+        * runtime/JSONObject.h: Made everything private. Added markStringifiers.
+
+2009-06-17  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by Cameron Zwarich.
+        Reviewed by Gavin Barraclough.
 
-        Roll r37370 back in with bug fixes.
+        <rdar://problem/6974140> REGRESSION(r43849): Crash in cti_op_call_NotJSFunction when getting directions on maps.google.com
 
-        - PropertyMap::storageSize() should reflect the number of keys + deletedOffsets
-          and has nothing to do with the internal deletedSentinel count anymore.
+        Roll out r43849 as it appears that we cannot rely on the address of
+        an objects property storage being constant even if the structure is
+        unchanged.
 
-2008-10-07  Gavin Barraclough  <barraclough@apple.com>
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
 
-        Reviewed by Oliver Hunt.
+2009-06-17  Gavin Barraclough  <barraclough@apple.com>
 
-        Move callframe initialization into JIT code, again.
-        
-        As a part of the restructuring the second result from functions is now
-        returned in edx, allowing the new value of 'r' to be returned via a
-        register, and stored to the stack from JIT code, too.
+        Rubber Stamped by Mark Rowe.
 
-        4.5% progression on v8-tests. (3% in their harness)
+        Fully revert r44492 & r44748 while we fix a bug they cause on internal builds <rdar://problem/6955963>.
 
-        * VM/CTI.cpp:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_throw):
+        * jit/JITStubs.cpp:
         (JSC::):
-        (JSC::CTI::emitCall):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        * VM/CTI.h:
-        (JSC::CallRecord::CallRecord):
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        (JSC::Machine::cti_op_resolve_func):
-        (JSC::Machine::cti_op_post_inc):
-        (JSC::Machine::cti_op_resolve_with_base):
-        (JSC::Machine::cti_op_post_dec):
-        * VM/Machine.h:
-        * kjs/JSFunction.h:
-        * kjs/ScopeChain.h:
-
-2008-10-07  Mark Rowe  <mrowe@apple.com>
-
-        Fix typo in method name.
-
-        * wrec/WREC.cpp:
-        * wrec/WREC.h:
-
-2008-10-07  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Mark Rowe.
-
-        Roll out r37370.
-
-2008-10-06  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Cameron Zwarich.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21415
-        Improve the division between PropertyStorageArray and PropertyMap
-
-        - Rework ProperyMap to store offsets in the value so that they don't
-          change when rehashing.  This allows us not to have to keep the 
-          PropertyStorageArray in sync and thus not have to pass it in.
-        - Rename PropertyMap::getOffset -> PropertyMap::get since put/remove
-          now also return offsets.
-        - A Vector of deleted offsets is now needed since the storage is out of
-          band.
-
-        1% win on SunSpider.  Wash on V8 suite.
-
-        * JavaScriptCore.exp:
-        * VM/CTI.cpp:
-        (JSC::transitionWillNeedStorageRealloc):
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        Transition logic can be greatly simplified by the fact that
-        the storage capacity is always known, and is correct for the
-        inline case.
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::put): Rename getOffset -> get.
-        (JSC::JSObject::deleteProperty): Ditto.
-        (JSC::JSObject::getPropertyAttributes): Ditto.
-        (JSC::JSObject::removeDirect): Use returned offset to
-        clear the value in the PropertyNameArray.
-        (JSC::JSObject::allocatePropertyStorage): Add assert.
-        * kjs/JSObject.h:
-        (JSC::JSObject::getDirect): Rename getOffset -> get
-        (JSC::JSObject::getDirectLocation): Rename getOffset -> get
-        (JSC::JSObject::putDirect): Use propertyStorageCapacity to determine whether
-        or not to resize.  Also, since put now returns an offset (and thus 
-        addPropertyTransition does also) setting of the PropertyStorageArray is
-        now done here.
-        (JSC::JSObject::transitionTo):
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMap::checkConsistency): PropertyStorageArray is no longer 
-        passed in.
-        (JSC::PropertyMap::operator=): Copy the delete offsets vector.
-        (JSC::PropertyMap::put): Instead of setting the PropertyNameArray
-        explicitly, return the offset where the value should go.
-        (JSC::PropertyMap::remove): Instead of removing from the PropertyNameArray
-        explicitly, return the offset where the value should be removed.
-        (JSC::PropertyMap::get): Switch to using the stored offset, instead
-        of the implicit one.
-        (JSC::PropertyMap::insert):
-        (JSC::PropertyMap::expand): This is never called when m_table is null,
-        so remove that branch and add it as an assertion.
-        (JSC::PropertyMap::createTable): Consistency checks no longer take
-        a PropertyNameArray.
-        (JSC::PropertyMap::rehash): No need to rehash the PropertyNameArray
-        now that it is completely out of band.
-        * kjs/PropertyMap.h:
-        (JSC::PropertyMapEntry::PropertyMapEntry): Store offset into PropertyNameArray.
-        (JSC::PropertyMap::get): Switch to using the stored offset, instead
-        of the implicit one.
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::StructureID): Initialize the propertyStorageCapacity to 
-        JSObject::inlineStorageCapacity.
-        (JSC::StructureID::growPropertyStorageCapacity): Grow the storage capacity as
-        described below.
-        (JSC::StructureID::addPropertyTransition): Copy the storage capacity.
-        (JSC::StructureID::toDictionaryTransition): Ditto.
-        (JSC::StructureID::changePrototypeTransition): Ditto.
-        (JSC::StructureID::getterSetterTransition): Ditto.
-        * kjs/StructureID.h:
-        (JSC::StructureID::propertyStorageCapacity): Add propertyStorageCapacity
-        which is the current capacity for the JSObjects PropertyStorageArray.
-        It starts at the JSObject::inlineStorageCapacity (currently 2), then
-        when it first needs to be resized moves to the JSObject::nonInlineBaseStorageCapacity
-        (currently 16), and after that doubles each time.
-
-2008-10-06  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 21396: Remove the OptionalCalleeActivation call frame slot
-        <https://bugs.webkit.org/show_bug.cgi?id=21396>
-
-        Remove the OptionalCalleeActivation call frame slot. We have to be
-        careful to store the activation object in a register, because objects
-        in the scope chain do not get marked.
-
-        This is a 0.3% speedup on both SunSpider and the V8 benchmark.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::CodeGenerator):
-        (JSC::CodeGenerator::emitReturn):
-        * VM/CodeGenerator.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::dumpRegisters):
-        (JSC::Machine::unwindCallFrame):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_op_push_activation):
-        (JSC::Machine::cti_op_tear_off_activation):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        * VM/Machine.h:
-        (JSC::Machine::initializeCallFrame):
-        * VM/RegisterFile.h:
-        (JSC::RegisterFile::):
-
-2008-10-06  Tony Chang  <tony@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Chromium doesn't use pthreads on windows, so make its use conditional.
-        
-        Also convert a WORD to a DWORD to avoid a compiler warning.  This
-        matches the other methods around it.
-
-        * wtf/ThreadingWin.cpp:
-        (WTF::wtfThreadEntryPoint):
-        (WTF::ThreadCondition::broadcast):
-
-2008-10-06  Mark Mentovai  <mark@moxienet.com>
-
-        Reviewed by Tim Hatcher.
-
-        Allow ENABLE_DASHBOARD_SUPPORT and ENABLE_MAC_JAVA_BRIDGE to be
-        disabled on the Mac.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21333
-
-        * wtf/Platform.h:
-
-2008-10-06  Steve Falkenburg  <sfalken@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21416
-        Pass 0 for size to VirtualAlloc, as documented by MSDN.
-        Identified by Application Verifier.
-        
-        Reviewed by Darin Adler.
-
-        * kjs/collector.cpp:
-        (KJS::freeBlock):
-
-2008-10-06  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Tim Hatcheri and Oliver Hunt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21412
-        Bug 21412: Refactor user initiated profile count to be more stable
-        - Export UString::from for use with creating the profile title.
-
-        * JavaScriptCore.exp:
-
-2008-10-06  Maciej Stachowiak  <mjs@apple.com>
-
-        Not reviewed. Build fix.
-        
-        - revert toBoolean changes (r37333 and r37335); need to make WebCore work with these
-
-        * API/JSValueRef.cpp:
-        (JSValueToBoolean):
-        * ChangeLog:
-        * JavaScriptCore.exp:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_loop_if_true):
-        (JSC::Machine::cti_op_not):
-        (JSC::Machine::cti_op_jtrue):
-        * kjs/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncFilter):
-        (JSC::arrayProtoFuncEvery):
-        (JSC::arrayProtoFuncSome):
-        * kjs/BooleanConstructor.cpp:
-        (JSC::constructBoolean):
-        (JSC::callBooleanConstructor):
-        * kjs/GetterSetter.h:
-        * kjs/JSCell.h:
-        (JSC::JSValue::toBoolean):
-        * kjs/JSNumberCell.cpp:
-        (JSC::JSNumberCell::toBoolean):
-        * kjs/JSNumberCell.h:
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::toBoolean):
-        * kjs/JSObject.h:
-        * kjs/JSString.cpp:
-        (JSC::JSString::toBoolean):
-        * kjs/JSString.h:
-        * kjs/JSValue.h:
-        * kjs/RegExpConstructor.cpp:
-        (JSC::setRegExpConstructorMultiline):
-        * kjs/RegExpObject.cpp:
-        (JSC::RegExpObject::match):
-        * kjs/RegExpPrototype.cpp:
-        (JSC::regExpProtoFuncToString):
-
-2008-10-06  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        - optimize op_jtrue, op_loop_if_true and op_not in various ways
-        https://bugs.webkit.org/show_bug.cgi?id=21404
-        
-        1) Make JSValue::toBoolean nonvirtual and completely inline by
-        making use of the StructureID type field.
-        
-        2) Make JSValue::toBoolean not take an ExecState; doesn't need it.
-        
-        3) Make op_not, op_loop_if_true and op_jtrue not read the
-        ExecState (toBoolean doesn't need it any more) and not check
-        exceptions (toBoolean can't throw).
-
-        * API/JSValueRef.cpp:
-        (JSValueToBoolean):
-        * JavaScriptCore.exp:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_loop_if_true):
-        (JSC::Machine::cti_op_not):
-        (JSC::Machine::cti_op_jtrue):
-        * kjs/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncFilter):
-        (JSC::arrayProtoFuncEvery):
-        (JSC::arrayProtoFuncSome):
-        * kjs/BooleanConstructor.cpp:
-        (JSC::constructBoolean):
-        (JSC::callBooleanConstructor):
-        * kjs/GetterSetter.h:
-        * kjs/JSCell.h:
-        (JSC::JSValue::toBoolean):
-        * kjs/JSNumberCell.cpp:
-        * kjs/JSNumberCell.h:
-        (JSC::JSNumberCell::toBoolean):
-        * kjs/JSObject.cpp:
-        * kjs/JSObject.h:
-        (JSC::JSObject::toBoolean):
-        (JSC::JSCell::toBoolean):
-        * kjs/JSString.cpp:
-        * kjs/JSString.h:
-        (JSC::JSString::toBoolean):
-        * kjs/JSValue.h:
-        * kjs/RegExpConstructor.cpp:
-        (JSC::setRegExpConstructorMultiline):
-        * kjs/RegExpObject.cpp:
-        (JSC::RegExpObject::match):
-        * kjs/RegExpPrototype.cpp:
-        (JSC::regExpProtoFuncToString):
-
-2008-10-06  Ariya Hidayat  <ariya.hidayat@trolltech.com>
-
-        Reviewed by Simon.
-
-        Build fix for MinGW.
-
-        * JavaScriptCore.pri:
-        * kjs/DateMath.cpp:
-        (JSC::highResUpTime):
-
-2008-10-05  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Remove ScopeNode::containsClosures() now that it is unused.
-
-        * kjs/nodes.h:
-        (JSC::ScopeNode::containsClosures):
-
-2008-10-05  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Cameron Zwarich.
-        
-        - fix releas-only test failures caused by the fix to bug 21375
-
-        * VM/Machine.cpp:
-        (JSC::Machine::unwindCallFrame): Update ExecState while unwinding call frames;
-        it now matters more to have a still-valid ExecState, since dynamicGlobalObject
-        will make use of the ExecState's scope chain.
-        * VM/Machine.h:
-
-2008-10-05  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 21364: Remove the branch in op_ret for OptionalCalleeActivation and OptionalCalleeArguments
-        <https://bugs.webkit.org/show_bug.cgi?id=21364>
-
-        Use information from the parser to detect whether an activation is
-        needed or 'arguments' is used, and emit explicit instructions to tear
-        them off before op_ret. This allows a branch to be removed from op_ret
-        and simplifies some other code. This does cause a small change in the
-        behaviour of 'f.arguments'; it is no longer live when 'arguments' is not
-        mentioned in the lexical scope of the function.
-
-        It should now be easy to remove the OptionaCalleeActivation slot in the
-        call frame, but this will be done in a later patch.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitReturn):
-        * VM/CodeGenerator.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::unwindCallFrame):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::retrieveArguments):
-        (JSC::Machine::cti_op_create_arguments):
-        (JSC::Machine::cti_op_tear_off_activation):
-        (JSC::Machine::cti_op_tear_off_arguments):
-        * VM/Machine.h:
-        * VM/Opcode.h:
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::mark):
-        * kjs/Arguments.h:
-        (JSC::Arguments::isTornOff):
-        (JSC::Arguments::Arguments):
-        (JSC::Arguments::copyRegisters):
-        (JSC::JSActivation::copyRegisters):
-        * kjs/JSActivation.cpp:
-        (JSC::JSActivation::argumentsGetter):
-        * kjs/JSActivation.h:
-
-2008-10-05  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Oliver Hunt.
-        
-        - fixed "REGRESSION (r37297): fast/js/deep-recursion-test takes too long and times out"
-        https://bugs.webkit.org/show_bug.cgi?id=21375
-        
-        The problem is that dynamicGlobalObject had become O(N) in number
-        of call frames, but unwinding the stack for an exception called it
-        for every call frame, resulting in O(N^2) behavior for an
-        exception thrown from inside deep recursion.
-
-        Instead of doing it that way, stash the dynamic global object in JSGlobalData.
-        
-        * JavaScriptCore.exp:
-        * VM/Machine.cpp:
-        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Helper class to temporarily
-        store and later restore a dynamicGlobalObject in JSGlobalData.
-        (JSC::DynamicGlobalObjectScope::~DynamicGlobalObjectScope):
-        (JSC::Machine::execute): In each version, establish a DynamicGlobalObjectScope.
-        For ProgramNode, always establish set new dynamicGlobalObject, for FunctionBody and Eval,
-        only if none is currently set.
-        * VM/Machine.h:
-        * kjs/ExecState.h:
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData): Ininitalize new dynamicGlobalObject field to 0.
-        * kjs/JSGlobalData.h:
-        * kjs/JSGlobalObject.h:
-        (JSC::ExecState::dynamicGlobalObject): Moved here from ExecState for benefit of inlining.
-        Return lexical global object if this is a globalExec(), otherwise look in JSGlobalData
-        for the one stashed there.
-
-2008-10-05  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Avoid an extra lookup when transitioning to an existing StructureID
-        by caching the offset of property that caused the transition.
-
-        1% win on V8 suite.  Wash on SunSpider.
-
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMap::put):
-        * kjs/PropertyMap.h:
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::StructureID):
-        (JSC::StructureID::addPropertyTransition):
-        * kjs/StructureID.h:
-        (JSC::StructureID::setCachedTransistionOffset):
-        (JSC::StructureID::cachedTransistionOffset):
-
-2008-10-05  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 21364: Remove the branch in op_ret for OptionalCalleeActivation and OptionalCalleeArguments
-        <https://bugs.webkit.org/show_bug.cgi?id=21364>
-
-        This patch does not yet remove the branch, but it does a bit of refactoring
-        so that a CodeGenerator now knows whether the associated CodeBlock will need
-        a full scope before doing any code generation. This makes it possible to emit
-        explicit tear-off instructions before every op_ret.
-
-        * VM/CodeBlock.h:
-        (JSC::CodeBlock::CodeBlock):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::generate):
-        (JSC::CodeGenerator::CodeGenerator):
-        (JSC::CodeGenerator::emitPushScope):
-        (JSC::CodeGenerator::emitPushNewScope):
-        * kjs/nodes.h:
-        (JSC::ScopeNode::needsActivation):
-
-2008-10-05  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Fix for bug #21387 - using SamplingTool with CTI.
-
-        (1) A repatch offset offset changes due to an additional instruction to update SamplingTool state.
-        (2) Fix an incusion order problem due to ExecState changes.
-        (3) Change to a MACHINE_SAMPLING macro, use of exec should now be accessing global data.
-
-        * VM/CTI.h:
-        (JSC::CTI::execute):
-        * VM/SamplingTool.h:
-        (JSC::SamplingTool::privateExecuteReturned):
-        * kjs/Shell.cpp:
-
-2008-10-04  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        Add a 'Check For Weak VTables' build phase to catch weak vtables as early as possible.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2008-10-04  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Fix https://bugs.webkit.org/show_bug.cgi?id=21320
-        leaks of PropertyNameArrayData seen on buildbot
-
-        - Fix RefPtr cycle by making PropertyNameArrayData's pointer back
-          to the StructureID a weak pointer.
-
-        * kjs/PropertyNameArray.h:
-        (JSC::PropertyNameArrayData::setCachedStructureID):
-        (JSC::PropertyNameArrayData::cachedStructureID):
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::getEnumerablePropertyNames):
-        (JSC::StructureID::clearEnumerationCache):
-        (JSC::StructureID::~StructureID):
-
-2008-10-04  Darin Adler  <darin@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=21295
-          Bug 21295: Replace ExecState with a call frame Register pointer
-
-        10% faster on Richards; other v8 benchmarks faster too.
-        A wash on SunSpider.
-
-        This does the minimum necessary to get the speedup. Next step in
-        cleaning this up is to replace ExecState with a CallFrame class,
-        and be more judicious about when to pass a call frame and when
-        to pass a global data pointer, global object pointer, or perhaps
-        something else entirely.
-
-        * VM/CTI.cpp: Remove the debug-only check of the exception in
-        ctiVMThrowTrampoline -- already checked in the code the trampoline
-        jumps to, so not all that useful. Removed the exec argument from
-        ctiTrampoline. Removed emitDebugExceptionCheck -- no longer needed.
-        (JSC::CTI::emitCall): Removed code to set ExecState::m_callFrame.
-        (JSC::CTI::privateCompileMainPass): Removed code in catch to extract
-        the exception from ExecState::m_exception; instead, the code that
-        jumps into catch will make sure the exception is already in eax.
-        * VM/CTI.h: Removed exec from the ctiTrampoline. Also removed the
-        non-helpful "volatile". Temporarily left ARG_exec in as a synonym
-        for ARG_r; I'll change that on a future cleanup pass when introducing
-        more use of the CallFrame type.
-        (JSC::CTI::execute): Removed the ExecState* argument.
-
-        * VM/ExceptionHelpers.cpp:
-        (JSC::InterruptedExecutionError::InterruptedExecutionError): Take
-        JSGlobalData* instead of ExecState*.
-        (JSC::createInterruptedExecutionException): Ditto.
-        * VM/ExceptionHelpers.h: Ditto. Also removed an unneeded include.
-
-        * VM/Machine.cpp:
-        (JSC::slideRegisterWindowForCall): Removed the exec and
-        exceptionValue arguments. Changed to return 0 when there's a stack
-        overflow rather than using a separate exception argument to cut
-        down on memory accesses in the calling convention.
-        (JSC::Machine::unwindCallFrame): Removed the exec argument when
-        constructing a DebuggerCallFrame. Also removed code to set
-        ExecState::m_callFrame.
-        (JSC::Machine::throwException): Removed the exec argument when
-        construction a DebuggerCallFrame.
-        (JSC::Machine::execute): Updated to use the register instead of
-        ExecState and also removed various uses of ExecState.
-        (JSC::Machine::debug):
-        (JSC::Machine::privateExecute): Put globalData into a local
-        variable so it can be used throughout the interpreter. Changed
-        the VM_CHECK_EXCEPTION to get the exception in globalData instead
-        of through ExecState.
-        (JSC::Machine::retrieveLastCaller): Turn exec into a registers
-        pointer by calling registers() instead of by getting m_callFrame.
-        (JSC::Machine::callFrame): Ditto.
-        Tweaked exception macros. Made new versions for when you know
-        you have an exception. Get at global exception with ARG_globalData.
-        Got rid of the need to pass in the return value type.
-        (JSC::Machine::cti_op_add): Update to use new version of exception
-        macros.
-        (JSC::Machine::cti_op_pre_inc): Ditto.
-        (JSC::Machine::cti_timeout_check): Ditto.
-        (JSC::Machine::cti_op_instanceof): Ditto.
-        (JSC::Machine::cti_op_new_func): Ditto.
-        (JSC::Machine::cti_op_call_JSFunction): Optimized by using the
-        ARG values directly instead of through local variables -- this gets
-        rid of code that just shuffles things around in the stack frame.
-        Also get rid of ExecState and update for the new way exceptions are
-        handled in slideRegisterWindowForCall.
-        (JSC::Machine::cti_vm_compile): Update to make exec out of r since
-        they are both the same thing now.
-        (JSC::Machine::cti_op_call_NotJSFunction): Ditto.
-        (JSC::Machine::cti_op_init_arguments): Ditto.
-        (JSC::Machine::cti_op_resolve): Ditto.
-        (JSC::Machine::cti_op_construct_JSConstruct): Ditto.
-        (JSC::Machine::cti_op_construct_NotJSConstruct): Ditto.
-        (JSC::Machine::cti_op_resolve_func): Ditto.
-        (JSC::Machine::cti_op_put_by_val): Ditto.
-        (JSC::Machine::cti_op_put_by_val_array): Ditto.
-        (JSC::Machine::cti_op_resolve_skip): Ditto.
-        (JSC::Machine::cti_op_resolve_global): Ditto.
-        (JSC::Machine::cti_op_post_inc): Ditto.
-        (JSC::Machine::cti_op_resolve_with_base): Ditto.
-        (JSC::Machine::cti_op_post_dec): Ditto.
-        (JSC::Machine::cti_op_call_eval): Ditto.
-        (JSC::Machine::cti_op_throw): Ditto. Also rearranged to return
-        the exception value as the return value so it can be used by
-        op_catch.
-        (JSC::Machine::cti_op_push_scope): Ditto.
-        (JSC::Machine::cti_op_in): Ditto.
-        (JSC::Machine::cti_op_del_by_val): Ditto.
-        (JSC::Machine::cti_vm_throw): Ditto. Also rearranged to return
-        the exception value as the return value so it can be used by
-        op_catch.
-
-        * kjs/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::functionName): Pass globalData.
-        (JSC::DebuggerCallFrame::evaluate): Eliminated code to make a
-        new ExecState.
-        * kjs/DebuggerCallFrame.h: Removed ExecState argument from
-        constructor.
-
-        * kjs/ExecState.h: Eliminated all data members and made ExecState
-        inherit privately from Register instead. Also added a typedef to
-        the future name for this class, which is CallFrame. It's just a
-        Register* that knows it's a pointer at a call frame. The new class
-        can't be constructed or copied. Changed all functions to use
-        the this pointer instead of m_callFrame. Changed exception-related
-        functions to access an exception in JSGlobalData. Removed functions
-        used by CTI to pass the return address to the throw machinery --
-        this is now done directly with a global in the global data.
-
-        * kjs/FunctionPrototype.cpp:
-        (JSC::functionProtoFuncToString): Pass globalData instead of exec.
-
-        * kjs/InternalFunction.cpp:
-        (JSC::InternalFunction::name): Take globalData instead of exec.
-        * kjs/InternalFunction.h: Ditto.
-
-        * kjs/JSGlobalData.cpp: Initialize the new exception global to 0.
-        * kjs/JSGlobalData.h: Declare two new globals. One for the current
-        exception and another for the return address used by CTI to
-        implement the throw operation.
-
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::init): Removed code to set up globalExec,
-        which is now the same thing as globalCallFrame.
-        (JSC::JSGlobalObject::reset): Get globalExec from our globalExec
-        function so we don't have to repeat the logic twice.
-        (JSC::JSGlobalObject::mark): Removed code to mark the exception;
-        the exception is now stored in JSGlobalData and marked there.
-        (JSC::JSGlobalObject::globalExec): Return a pointer to the end
-        of the global call frame.
-        * kjs/JSGlobalObject.h: Removed the globalExec data member.
-
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::putDirectFunction): Pass globalData instead of exec.
-
-        * kjs/collector.cpp:
-        (JSC::Heap::collect): Mark the global exception.
-
-        * profiler/ProfileGenerator.cpp:
-        (JSC::ProfileGenerator::addParentForConsoleStart): Pass globalData
-        instead of exec to createCallIdentifier.
-
-        * profiler/Profiler.cpp:
-        (JSC::Profiler::willExecute): Pass globalData instead of exec to
-        createCallIdentifier.
-        (JSC::Profiler::didExecute): Ditto.
-        (JSC::Profiler::createCallIdentifier): Take globalData instead of
-        exec.
-        (JSC::createCallIdentifierFromFunctionImp): Ditto.
-        * profiler/Profiler.h: Change interface to take a JSGlobalData
-        instead of an ExecState.
-
-2008-10-04  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 21369: Add opcode documentation for all undocumented opcodes
-        <https://bugs.webkit.org/show_bug.cgi?id=21369>
-
-        This patch adds opcode documentation for all undocumented opcodes, and
-        it also renames op_init_arguments to op_create_arguments.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::CodeGenerator):
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_create_arguments):
-        * VM/Machine.h:
-        * VM/Opcode.h:
-
-2008-10-03  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Cameron Zwarich.
-        
-        - "this" object in methods called on primitives should be wrapper object
-        https://bugs.webkit.org/show_bug.cgi?id=21362
-
-        I changed things so that functions which use "this" do a fast
-        version of toThisObject conversion if needed. Currently we miss
-        the conversion entirely, at least for primitive types. Using
-        TypeInfo and the primitive check, I made the fast case bail out
-        pretty fast.
-        
-        This is inexplicably an 1.007x SunSpider speedup (and a wash on V8 benchmarks).
-     
-        Also renamed some opcodes for clarity:
-        
-        init ==> enter
-        init_activation ==> enter_with_activation
-        
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::generate):
-        (JSC::CodeGenerator::CodeGenerator):
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_convert_this):
-        * VM/Machine.h:
-        * VM/Opcode.h:
-        * kjs/JSActivation.cpp:
-        (JSC::JSActivation::JSActivation):
-        * kjs/JSActivation.h:
-        (JSC::JSActivation::createStructureID):
-        * kjs/JSCell.h:
-        (JSC::JSValue::needsThisConversion):
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        * kjs/JSGlobalData.h:
-        * kjs/JSNumberCell.h:
-        (JSC::JSNumberCell::createStructureID):
-        * kjs/JSStaticScopeObject.h:
-        (JSC::JSStaticScopeObject::JSStaticScopeObject):
-        (JSC::JSStaticScopeObject::createStructureID):
-        * kjs/JSString.h:
-        (JSC::JSString::createStructureID):
-        * kjs/JSValue.h:
-        * kjs/TypeInfo.h:
-        (JSC::TypeInfo::needsThisConversion):
-        * kjs/nodes.h:
-        (JSC::ScopeNode::usesThis):
-
-2008-10-03  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 21356: The size of the RegisterFile differs depending on 32-bit / 64-bit and Debug / Release
-        <https://bugs.webkit.org/show_bug.cgi?id=21356>
-
-        The RegisterFile decreases in size (measured in terms of numbers of
-        Registers) as the size of a Register increases. This causes
-
-            js1_5/Regress/regress-159334.js
-
-        to fail in 64-bit debug builds. This fix makes the RegisterFile on all
-        platforms the same size that it is in 32-bit Release builds.
-
-        * VM/RegisterFile.h:
-        (JSC::RegisterFile::RegisterFile):
-
-2008-10-03  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Cameron Zwarich.
-        
-        - Some code cleanup to how we handle code features.
-        
-        1) Rename FeatureInfo typedef to CodeFeatures.
-        2) Rename NodeFeatureInfo template to NodeInfo.
-        3) Keep CodeFeature bitmask in ScopeNode instead of trying to break it out into individual bools.
-        4) Rename misleadingly named "needsClosure" method to "containsClosures", which better describes the meaning
-        of ClosureFeature.
-        5) Make setUsersArguments() not take an argument since it only goes one way.
-
-        * JavaScriptCore.exp:
-        * VM/CodeBlock.h:
-        (JSC::CodeBlock::CodeBlock):
-        * kjs/NodeInfo.h:
-        * kjs/Parser.cpp:
-        (JSC::Parser::didFinishParsing):
-        * kjs/Parser.h:
-        (JSC::Parser::parse):
-        * kjs/grammar.y:
-        * kjs/nodes.cpp:
-        (JSC::ScopeNode::ScopeNode):
-        (JSC::ProgramNode::ProgramNode):
-        (JSC::ProgramNode::create):
-        (JSC::EvalNode::EvalNode):
-        (JSC::EvalNode::create):
-        (JSC::FunctionBodyNode::FunctionBodyNode):
-        (JSC::FunctionBodyNode::create):
-        * kjs/nodes.h:
-        (JSC::ScopeNode::usesEval):
-        (JSC::ScopeNode::containsClosures):
-        (JSC::ScopeNode::usesArguments):
-        (JSC::ScopeNode::setUsesArguments):
-
-2008-10-03  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 21343: REGRESSSION (r37160): ecma_3/ExecutionContexts/10.1.3-1.js and js1_4/Functions/function-001.js fail on 64-bit
-        <https://bugs.webkit.org/show_bug.cgi?id=21343>
-
-        A fix was landed for this issue in r37253, and the ChangeLog assumes
-        that it is a compiler bug, but it turns out that it is a subtle issue
-        with mixing signed and unsigned 32-bit values in a 64-bit environment.
-        In order to properly fix this bug, we should convert our signed offsets
-        into the register file to use ptrdiff_t.
-
-        This may not be the only instance of this issue, but I will land this
-        fix first and look for more later.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::getArgumentsData):
-        * VM/Machine.h:
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::getOwnPropertySlot):
-        * kjs/Arguments.h:
-        (JSC::Arguments::init):
-
-2008-10-03  Darin Adler  <darin@apple.com>
-
-        * VM/CTI.cpp: Another Windows build fix. Change the args of ctiTrampoline.
-
-        * kjs/JSNumberCell.h: A build fix for newer versions of gcc. Added
-        declarations of JSGlobalData overloads of jsNumberCell.
-
-2008-10-03  Darin Adler  <darin@apple.com>
-
-        - try to fix Windows build
-
-        * kjs/ScopeChain.h: Add forward declaration of JSGlobalData.
-
-2008-10-03  Darin Adler  <darin@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        - next step of https://bugs.webkit.org/show_bug.cgi?id=21295
-          Turn ExecState into a call frame pointer.
-
-        Remove m_globalObject and m_globalData from ExecState.
-
-        SunSpider says this is a wash (slightly faster but not statistically
-        significant); which is good enough since it's a preparation step and
-        not supposed to be a spedup.
-
-        * API/JSCallbackFunction.cpp:
-        (JSC::JSCallbackFunction::JSCallbackFunction):
-        * kjs/ArrayConstructor.cpp:
-        (JSC::ArrayConstructor::ArrayConstructor):
-        * kjs/BooleanConstructor.cpp:
-        (JSC::BooleanConstructor::BooleanConstructor):
-        * kjs/DateConstructor.cpp:
-        (JSC::DateConstructor::DateConstructor):
-        * kjs/ErrorConstructor.cpp:
-        (JSC::ErrorConstructor::ErrorConstructor):
-        * kjs/FunctionPrototype.cpp:
-        (JSC::FunctionPrototype::FunctionPrototype):
-        * kjs/JSFunction.cpp:
-        (JSC::JSFunction::JSFunction):
-        * kjs/NativeErrorConstructor.cpp:
-        (JSC::NativeErrorConstructor::NativeErrorConstructor):
-        * kjs/NumberConstructor.cpp:
-        (JSC::NumberConstructor::NumberConstructor):
-        * kjs/ObjectConstructor.cpp:
-        (JSC::ObjectConstructor::ObjectConstructor):
-        * kjs/PrototypeFunction.cpp:
-        (JSC::PrototypeFunction::PrototypeFunction):
-        * kjs/RegExpConstructor.cpp:
-        (JSC::RegExpConstructor::RegExpConstructor):
-        * kjs/StringConstructor.cpp:
-        (JSC::StringConstructor::StringConstructor):
-        Pass JSGlobalData* instead of ExecState* to the InternalFunction
-        constructor.
-
-        * API/OpaqueJSString.cpp: Added now-needed include.
-
-        * JavaScriptCore.exp: Updated.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitSlowScriptCheck): Changed to use ARGS_globalData
-        instead of ARGS_exec.
-
-        * VM/CTI.h: Added a new argument to the CTI, the global data pointer.
-        While it's possible to get to the global data pointer using the
-        ExecState pointer, it's slow enough that it's better to just keep
-        it around in the CTI arguments.
-
-        * VM/CodeBlock.h: Moved the CodeType enum here from ExecState.h.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::execute): Pass fewer arguments when constructing
-        ExecState, and pass the global data pointer when invoking CTI.
-        (JSC::Machine::firstCallFrame): Added. Used to get the dynamic global
-        object, which is in the scope chain of the first call frame.
-        (JSC::Machine::cti_op_add): Use globalData instead of exec when
-        possible, to keep fast cases fast, since it's now more expensive to
-        get to it through the exec pointer.
-        (JSC::Machine::cti_timeout_check): Ditto.
-        (JSC::Machine::cti_op_put_by_id_second): Ditto.
-        (JSC::Machine::cti_op_get_by_id_second): Ditto.
-        (JSC::Machine::cti_op_mul): Ditto.
-        (JSC::Machine::cti_vm_compile): Ditto.
-        (JSC::Machine::cti_op_get_by_val): Ditto.
-        (JSC::Machine::cti_op_sub): Ditto.
-        (JSC::Machine::cti_op_put_by_val): Ditto.
-        (JSC::Machine::cti_op_put_by_val_array): Ditto.
-        (JSC::Machine::cti_op_negate): Ditto.
-        (JSC::Machine::cti_op_div): Ditto.
-        (JSC::Machine::cti_op_pre_dec): Ditto.
-        (JSC::Machine::cti_op_post_inc): Ditto.
-        (JSC::Machine::cti_op_lshift): Ditto.
-        (JSC::Machine::cti_op_bitand): Ditto.
-        (JSC::Machine::cti_op_rshift): Ditto.
-        (JSC::Machine::cti_op_bitnot): Ditto.
-        (JSC::Machine::cti_op_mod): Ditto.
-        (JSC::Machine::cti_op_post_dec): Ditto.
-        (JSC::Machine::cti_op_urshift): Ditto.
-        (JSC::Machine::cti_op_bitxor): Ditto.
-        (JSC::Machine::cti_op_bitor): Ditto.
-        (JSC::Machine::cti_op_call_eval): Ditto.
-        (JSC::Machine::cti_op_throw): Ditto.
-        (JSC::Machine::cti_op_is_string): Ditto.
-        (JSC::Machine::cti_op_debug): Ditto.
-        (JSC::Machine::cti_vm_throw): Ditto.
-
-        * VM/Machine.h: Added firstCallFrame.
-
-        * kjs/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::evaluate): Pass fewer arguments when
-        constructing ExecState.
-
-        * kjs/ExecState.cpp: Deleted contents. Later we'll remove the
-        file altogether.
-
-        * kjs/ExecState.h: Removed m_globalObject and m_globalData.
-        Moved CodeType into another header.
-        (JSC::ExecState::ExecState): Take only a single argument, a
-        call frame pointer.
-        (JSC::ExecState::dynamicGlobalObject): Get the object from
-        the first call frame since it's no longer stored.
-        (JSC::ExecState::globalData): Get the global data from the
-        scope chain, since we no longer store a pointer to it here.
-        (JSC::ExecState::identifierTable): Ditto.
-        (JSC::ExecState::propertyNames): Ditto.
-        (JSC::ExecState::emptyList): Ditto.
-        (JSC::ExecState::lexer): Ditto.
-        (JSC::ExecState::parser): Ditto.
-        (JSC::ExecState::machine): Ditto.
-        (JSC::ExecState::arrayTable): Ditto.
-        (JSC::ExecState::dateTable): Ditto.
-        (JSC::ExecState::mathTable): Ditto.
-        (JSC::ExecState::numberTable): Ditto.
-        (JSC::ExecState::regExpTable): Ditto.
-        (JSC::ExecState::regExpConstructorTable): Ditto.
-        (JSC::ExecState::stringTable): Ditto.
-        (JSC::ExecState::heap): Ditto.
-
-        * kjs/FunctionConstructor.cpp:
-        (JSC::FunctionConstructor::FunctionConstructor): Pass
-        JSGlobalData* instead of ExecState* to the InternalFunction
-        constructor.
-        (JSC::constructFunction): Pass the global data pointer when
-        constructing a new scope chain.
-
-        * kjs/InternalFunction.cpp:
-        (JSC::InternalFunction::InternalFunction): Take a JSGlobalData*
-        instead of an ExecState*. Later we can change more places to
-        work this way -- it's more efficient to take the type you need
-        since the caller might already have it.
-        * kjs/InternalFunction.h: Ditto.
-
-        * kjs/JSCell.h:
-        (JSC::JSCell::operator new): Added an overload that takes a
-        JSGlobalData* so you can construct without an ExecState*.
-
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::init): Moved creation of the global scope
-        chain in here, since it now requires a pointer to the global data.
-        Moved the initialization of the call frame in here since it requires
-        the global scope chain node. Removed the extra argument to ExecState
-        when creating the global ExecState*.
-        * kjs/JSGlobalObject.h: Removed initialization of globalScopeChain
-        and the call frame from the JSGlobalObjectData constructor. Added
-        a thisValue argument to the init function.
-
-        * kjs/JSNumberCell.cpp: Added versions of jsNumberCell that take
-        JSGlobalData* rather than ExecState*.
-        * kjs/JSNumberCell.h:
-        (JSC::JSNumberCell::operator new): Added a version that takes
-        JSGlobalData*.
-        (JSC::JSNumberCell::JSNumberCell): Ditto.
-        (JSC::jsNumber): Ditto.
-        * kjs/JSString.cpp:
-        (JSC::jsString): Ditto.
-        (JSC::jsSubstring): Ditto.
-        (JSC::jsOwnedString): Ditto.
-        * kjs/JSString.h:
-        (JSC::JSString::JSString): Changed to take JSGlobalData*.
-        (JSC::jsEmptyString): Added a version that takes JSGlobalData*.
-        (JSC::jsSingleCharacterString): Ditto.
-        (JSC::jsSingleCharacterSubstring): Ditto.
-        (JSC::jsNontrivialString): Ditto.
-        (JSC::JSString::getIndex): Ditto.
-        (JSC::jsString): Ditto.
-        (JSC::jsSubstring): Ditto.
-        (JSC::jsOwnedString): Ditto.
-
-        * kjs/ScopeChain.h: Added a globalData pointer to each node.
-        (JSC::ScopeChainNode::ScopeChainNode): Initialize the globalData
-        pointer.
-        (JSC::ScopeChainNode::push): Set the global data pointer in the
-        new node.
-        (JSC::ScopeChain::ScopeChain): Take a globalData argument.
-
-        * kjs/SmallStrings.cpp:
-        (JSC::SmallStrings::createEmptyString): Take JSGlobalData* instead of
-        ExecState*.
-        (JSC::SmallStrings::createSingleCharacterString): Ditto.
-        * kjs/SmallStrings.h:
-        (JSC::SmallStrings::emptyString): Ditto.
-        (JSC::SmallStrings::singleCharacterString): Ditto.
-
-2008-10-03  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Bug 21343: REGRESSSION (r37160): ecma_3/ExecutionContexts/10.1.3-1.js and js1_4/Functions/function-001.js fail on 64-bit
-        <https://bugs.webkit.org/show_bug.cgi?id=21343>
-
-        Add a workaround for a bug in GCC, which affects GCC 4.0, GCC 4.2, and
-        llvm-gcc 4.2. I put it in an #ifdef because it was a slight regression
-        on SunSpider in 32-bit, although that might be entirely random.
-
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::getOwnPropertySlot):
-
-2008-10-03  Darin Adler  <darin@apple.com>
-
-        Rubber stamped by Alexey Proskuryakov.
-
-        * kjs/Shell.cpp: (main): Don't delete JSGlobalData. Later, we need to change
-        this tool to use public JavaScriptCore API instead.
-
-2008-10-03  Darin Adler  <darin@apple.com>
-
-        Suggested by Alexey Proskuryakov.
-
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::~JSGlobalData): Remove call to heap.destroy() because
-        it's too late to ref the JSGlobalData object once it's already being
-        destroyed. In practice this is not a problem because WebCore's JSGlobalData
-        is never destroyed and JSGlobalContextRelease takes care of calling
-        heap.destroy() in advance.
-
-2008-10-02  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Replace SSE3 check with an SSE2 check, and implement SSE2 check on windows.
-
-        5.6% win on SunSpider on windows.
-
-        * VM/CTI.cpp:
-        (JSC::isSSE2Present):
-        (JSC::CTI::compileBinaryArithOp):
-        (JSC::CTI::compileBinaryArithOpSlowCase):
-
-2008-10-03  Maciej Stachowiak  <mjs@apple.com>
-
-        Rubber stamped by Cameron Zwarich.
-        
-        - fix mistaken change of | to || which caused a big perf regression on EarleyBoyer
-
-        * kjs/grammar.y:
-
-2008-10-02  Darin Adler  <darin@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=21321
-          Bug 21321: speed up JavaScriptCore by inlining Heap in JSGlobalData
-
-        1.019x as fast on SunSpider.
-
-        * API/JSBase.cpp:
-        (JSEvaluateScript): Use heap. instead of heap-> to work with the heap.
-        (JSCheckScriptSyntax): Ditto.
-        (JSGarbageCollect): Ditto.
-        (JSReportExtraMemoryCost): Ditto.
-        * API/JSContextRef.cpp:
-        (JSGlobalContextRetain): Ditto.
-        (JSGlobalContextRelease): Destroy the heap with the destroy function instead
-        of the delete operator.
-        (JSContextGetGlobalObject): Use heap. instead of heap-> to work with the heap.
-        * API/JSObjectRef.cpp:
-        (JSObjectMake): Use heap. instead of heap-> to work with the heap.
-        (JSObjectMakeFunctionWithCallback): Ditto.
-        (JSObjectMakeConstructor): Ditto.
-        (JSObjectMakeFunction): Ditto.
-        (JSObjectMakeArray): Ditto.
-        (JSObjectMakeDate): Ditto.
-        (JSObjectMakeError): Ditto.
-        (JSObjectMakeRegExp): Ditto.
-        (JSObjectHasProperty): Ditto.
-        (JSObjectGetProperty): Ditto.
-        (JSObjectSetProperty): Ditto.
-        (JSObjectGetPropertyAtIndex): Ditto.
-        (JSObjectSetPropertyAtIndex): Ditto.
-        (JSObjectDeleteProperty): Ditto.
-        (JSObjectCallAsFunction): Ditto.
-        (JSObjectCallAsConstructor): Ditto.
-        (JSObjectCopyPropertyNames): Ditto.
-        (JSPropertyNameAccumulatorAddName): Ditto.
-        * API/JSValueRef.cpp:
-        (JSValueIsEqual): Ditto.
-        (JSValueIsInstanceOfConstructor): Ditto.
-        (JSValueMakeNumber): Ditto.
-        (JSValueMakeString): Ditto.
-        (JSValueToNumber): Ditto.
-        (JSValueToStringCopy): Ditto.
-        (JSValueToObject): Ditto.
-        (JSValueProtect): Ditto.
-        (JSValueUnprotect): Ditto.
-
-        * kjs/ExecState.h:
-        (JSC::ExecState::heap): Update to use the & operator.
-
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData): Update to initialize a heap member
-        instead of calling new to make a heap.
-        (JSC::JSGlobalData::~JSGlobalData): Destroy the heap with the destroy
-        function instead of the delete operator.
-        * kjs/JSGlobalData.h: Change from Heap* to a Heap.
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::mark): Use the & operator here.
-        (JSC::JSGlobalObject::operator new): Use heap. instead of heap-> to work
-        with the heap.
-
-2008-10-02  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Bug 21317: Replace RegisterFile size and capacity information with Register pointers
-        <https://bugs.webkit.org/show_bug.cgi?id=21317>
-
-        This is a 2.3% speedup on the V8 DeltaBlue benchmark, a 3.3% speedup on
-        the V8 Raytrace benchmark, and a 1.0% speedup on SunSpider.
-
-        * VM/Machine.cpp:
-        (JSC::slideRegisterWindowForCall):
-        (JSC::Machine::callEval):
-        (JSC::Machine::execute):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        * VM/RegisterFile.cpp:
-        (JSC::RegisterFile::~RegisterFile):
-        * VM/RegisterFile.h:
-        (JSC::RegisterFile::RegisterFile):
-        (JSC::RegisterFile::start):
-        (JSC::RegisterFile::end):
-        (JSC::RegisterFile::size):
-        (JSC::RegisterFile::shrink):
-        (JSC::RegisterFile::grow):
-        (JSC::RegisterFile::lastGlobal):
-        (JSC::RegisterFile::markGlobals):
-        (JSC::RegisterFile::markCallFrames):
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::copyGlobalsTo):
-
-2008-10-02  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Darin Adler.
-
-        Change bitwise operations introduced in r37166 to boolean operations. We
-        only use bitwise operations over boolean operations for increasing
-        performance in extremely hot code, but that does not apply to anything
-        in the parser.
-
-        * kjs/grammar.y:
-
-2008-10-02  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Fix for bug #21232 - should reset m_isPendingDash on flush,
-        and should allow '\-' as beginning or end of a range (though
-        not to specifiy a range itself).
-
-        * ChangeLog:
-        * wrec/CharacterClassConstructor.cpp:
-        (JSC::CharacterClassConstructor::put):
-        (JSC::CharacterClassConstructor::flush):
-        * wrec/CharacterClassConstructor.h:
-        (JSC::CharacterClassConstructor::flushBeforeEscapedHyphen):
-        * wrec/WREC.cpp:
-        (JSC::WRECGenerator::generateDisjunction):
-        (JSC::WRECParser::parseCharacterClass):
-        (JSC::WRECParser::parseDisjunction):
-        * wrec/WREC.h:
-
-2008-10-02  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - remove the "static" from declarations in a header file, since we
-          don't want them to have internal linkage
-
-        * VM/Machine.h: Remove the static keyword from the constant and the
-        three inline functions that Geoff just moved here.
-
-2008-10-02  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=21283.
-        Profiler Crashes When Started
-
-        * VM/Machine.cpp:
-        * VM/Machine.h:
-        (JSC::makeHostCallFramePointer):
-        (JSC::isHostCallFrame):
-        (JSC::stripHostCallFrameBit): Moved some things to the header so
-        JSGlobalObject could use them.
-
-        * kjs/JSGlobalObject.h:
-        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData): Call the
-        new makeHostCallFramePointer API, since 0 no longer indicates a host
-        call frame.
-
-2008-10-02  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21304
-        Stop using a static wrapper map for WebCore JS bindings
-
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        (JSC::JSGlobalData::~JSGlobalData):
-        (JSC::JSGlobalData::ClientData::~ClientData):
-        * kjs/JSGlobalData.h:
-        Added a client data member to JSGlobalData. WebCore will use it to store bindings-related
-        global data.
-
-        * JavaScriptCore.exp: Export virtual ClientData destructor.
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
 
-2008-10-02  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix Qt build.
-
-        * kjs/Error.h:
-
-2008-10-01  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Darin Adler and Cameron Zwarich.
-
-        Preliminary step toward dynamic recompilation: Standardized and
-        simplified the parsing interface.
-        
-        The main goal in this patch is to make it easy to ask for a duplicate
-        compilation, and get back a duplicate result -- same source URL, same
-        debugger / profiler ID, same toString behavior, etc.
-        
-        The basic unit of compilation and evaluation is now SourceCode, which
-        encompasses a SourceProvider, a range in that provider, and a starting
-        line number.
-
-        A SourceProvider now encompasses a source URL, and *is* a source ID,
-        since a pointer is a unique identifier.
-
-        * API/JSBase.cpp:
-        (JSEvaluateScript):
-        (JSCheckScriptSyntax): Provide a SourceCode to the Interpreter, since
-        other APIs are no longer supported.
-        
-        * VM/CodeBlock.h:
-        (JSC::EvalCodeCache::get): Provide a SourceCode to the Interpreter, since
-        other APIs are no longer supported.
-        (JSC::CodeBlock::CodeBlock): ASSERT something that used to be ASSERTed
-        by our caller -- this is a better bottleneck.
-
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::CodeGenerator): Updated for the fact that
-        FunctionBodyNode's parameters are no longer a WTF::Vector.
-
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::Arguments): ditto
-
-        * kjs/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::evaluate): Provide a SourceCode to the Parser,
-        since other APIs are no longer supported.
-
-        * kjs/FunctionConstructor.cpp:
-        (JSC::constructFunction): Provide a SourceCode to the Parser, since
-        other APIs are no longer supported. Adopt FunctionBodyNode's new
-        "finishParsing" API.
-
-        * kjs/JSFunction.cpp:
-        (JSC::JSFunction::lengthGetter):
-        (JSC::JSFunction::getParameterName): Updated for the fact that
-        FunctionBodyNode's parameters are no longer a wtf::Vector.
-
-        * kjs/JSFunction.h: Nixed some cruft.
-
-        * kjs/JSGlobalObjectFunctions.cpp:
-        (JSC::globalFuncEval): Provide a SourceCode to the Parser, since
-        other APIs are no longer supported. 
-
-        * kjs/Parser.cpp:
-        (JSC::Parser::parse): Require a SourceCode argument, instead of a bunch
-        of broken out parameters. Stop tracking sourceId as an integer, since we
-        use the SourceProvider pointer for this now. Don't clamp the
-        startingLineNumber, since SourceCode does that now.
-
-        * kjs/Parser.h:
-        (JSC::Parser::parse): Standardized the parsing interface to require a
-        SourceCode.
-
-        * kjs/Shell.cpp:
-        (functionRun):
-        (functionLoad):
-        (prettyPrintScript):
-        (runWithScripts):
-        (runInteractive): Provide a SourceCode to the Interpreter, since
-        other APIs are no longer supported.
-
-        * kjs/SourceProvider.h:
-        (JSC::SourceProvider::SourceProvider):
-        (JSC::SourceProvider::url):
-        (JSC::SourceProvider::asId):
-        (JSC::UStringSourceProvider::create):
-        (JSC::UStringSourceProvider::UStringSourceProvider): Added new
-        responsibilities described above.
-
-        * kjs/SourceRange.h:
-        (JSC::SourceCode::SourceCode):
-        (JSC::SourceCode::toString):
-        (JSC::SourceCode::provider):
-        (JSC::SourceCode::firstLine):
-        (JSC::SourceCode::data):
-        (JSC::SourceCode::length): Added new responsibilities described above.
-        Renamed SourceRange to SourceCode, based on review feedback. Added
-        a makeSource function for convenience.
-
-        * kjs/debugger.h: Provide a SourceCode to the client, since other APIs
-        are no longer supported.
-
-        * kjs/grammar.y: Provide startingLineNumber when creating a SourceCode.
-
-        * kjs/debugger.h: Treat sourceId as intptr_t to avoid loss of precision
-        on 64bit platforms.
-
-        * kjs/interpreter.cpp:
-        (JSC::Interpreter::checkSyntax):
-        (JSC::Interpreter::evaluate):
-        * kjs/interpreter.h: Require a SourceCode instead of broken out arguments.
-
-        * kjs/lexer.cpp:
-        (JSC::Lexer::setCode):
-        * kjs/lexer.h:
-        (JSC::Lexer::sourceRange): Fold together the SourceProvider and line number
-        into a SourceCode. Fixed a bug where the Lexer would accidentally keep
-        alive the last SourceProvider forever.
-
-        * kjs/nodes.cpp:
-        (JSC::ScopeNode::ScopeNode):
-        (JSC::ProgramNode::ProgramNode):
-        (JSC::ProgramNode::create):
-        (JSC::EvalNode::EvalNode):
-        (JSC::EvalNode::generateCode):
-        (JSC::EvalNode::create):
-        (JSC::FunctionBodyNode::FunctionBodyNode):
-        (JSC::FunctionBodyNode::finishParsing):
-        (JSC::FunctionBodyNode::create):
-        (JSC::FunctionBodyNode::generateCode):
-        (JSC::ProgramNode::generateCode):
-        (JSC::FunctionBodyNode::paramString):
-        * kjs/nodes.h:
-        (JSC::ScopeNode::):
-        (JSC::ScopeNode::sourceId):
-        (JSC::FunctionBodyNode::):
-        (JSC::FunctionBodyNode::parameterCount):
-        (JSC::FuncExprNode::):
-        (JSC::FuncDeclNode::): Store a SourceCode in all ScopeNodes, since
-        SourceCode is now responsible for tracking URL, ID, etc. Streamlined
-        some ad hoc FunctionBodyNode fixups into a "finishParsing" function, to
-        help make clear what you need to do in order to finish parsing a
-        FunctionBodyNode.
-
-        * wtf/Vector.h:
-        (WTF::::releaseBuffer): Don't ASSERT that releaseBuffer() is only called
-        when buffer is not 0, since FunctionBodyNode is more than happy
-        to get back a 0 buffer, and other functions like RefPtr::release() allow
-        for 0, too.
-
-2008-10-01  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 21289: REGRESSION (r37160): Inspector crashes on load
-        <https://bugs.webkit.org/show_bug.cgi?id=21289>
-
-        The code in Arguments::mark() in r37160 was wrong. It marks indices in
-        d->registers, but that makes no sense (they are local variables, not
-        arguments). It should mark those indices in d->registerArray instead.
-
-        This patch also changes Arguments::copyRegisters() to use d->numParameters
-        instead of recomputing it.
-
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::mark):
-        * kjs/Arguments.h:
-        (JSC::Arguments::copyRegisters):
-
-2008-09-30  Darin Adler  <darin@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=21214
-          work on getting rid of ExecState
-
-        Eliminate some unneeded uses of dynamicGlobalObject.
-
-        * API/JSClassRef.cpp:
-        (OpaqueJSClass::contextData): Changed to use a map in the global data instead
-        of on the global object. Also fixed to use only a single hash table lookup.
-
-        * API/JSObjectRef.cpp:
-        (JSObjectMakeConstructor): Use lexicalGlobalObject rather than dynamicGlobalObject
-        to get the object prototype.
-
-        * kjs/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncToString): Use arrayVisitedElements set in global data rather
-        than in the global object.
-        (JSC::arrayProtoFuncToLocaleString): Ditto.
-        (JSC::arrayProtoFuncJoin): Ditto.
-
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData): Don't initialize opaqueJSClassData, since
-        it's no longer a pointer.
-        (JSC::JSGlobalData::~JSGlobalData): We still need to delete all the values, but
-        we don't need to delete the map since it's no longer a pointer.
-
-        * kjs/JSGlobalData.h: Made opaqueJSClassData a map instead of a pointer to a map.
-        Also added arrayVisitedElements.
-
-        * kjs/JSGlobalObject.h: Removed arrayVisitedElements.
-
-        * kjs/Shell.cpp:
-        (functionRun): Use lexicalGlobalObject instead of dynamicGlobalObject.
-        (functionLoad): Ditto.
-
-2008-10-01  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Speculative Windows build fix.
-
-        * kjs/grammar.y:
-
-2008-10-01  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 21123: using "arguments" in a function should not force creation of an activation object
-        <https://bugs.webkit.org/show_bug.cgi?id=21123>
-
-        Make the 'arguments' object not require a JSActivation. We store the
-        'arguments' object in the OptionalCalleeArguments call frame slot. We
-        need to be able to get the original 'arguments' object to tear it off
-        when returning from a function, but 'arguments' may be assigned to in a
-        number of ways.
-
-        Therefore, we use the OptionalCalleeArguments slot when we want to get
-        the original activation or we know that 'arguments' was not assigned a
-        different value. When 'arguments' may have been assigned a new value,
-        we use a new local variable that is initialized with 'arguments'. Since
-        a function parameter named 'arguments' may overwrite the value of
-        'arguments', we also need to be careful to look up 'arguments' in the
-        symbol table, so we get the parameter named 'arguments' instead of the
-        local variable that we have added for holding the 'arguments' object.
-
-        This is a 19.1% win on the V8 Raytrace benchmark using the SunSpider
-        harness, and a 20.7% win using the V8 harness. This amounts to a 6.5%
-        total speedup on the V8 benchmark suite using the V8 harness.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CodeBlock.h:
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::CodeGenerator):
-        * VM/Machine.cpp:
-        (JSC::Machine::unwindCallFrame):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::retrieveArguments):
-        (JSC::Machine::cti_op_init_arguments):
-        (JSC::Machine::cti_op_ret_activation_arguments):
-        * VM/Machine.h:
-        * VM/RegisterFile.h:
-        (JSC::RegisterFile::):
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::mark):
-        (JSC::Arguments::fillArgList):
-        (JSC::Arguments::getOwnPropertySlot):
-        (JSC::Arguments::put):
-        * kjs/Arguments.h:
-        (JSC::Arguments::setRegisters):
-        (JSC::Arguments::init):
-        (JSC::Arguments::Arguments):
-        (JSC::Arguments::copyRegisters):
-        (JSC::JSActivation::copyRegisters):
-        * kjs/JSActivation.cpp:
-        (JSC::JSActivation::argumentsGetter):
-        * kjs/JSActivation.h:
-        (JSC::JSActivation::JSActivationData::JSActivationData):
-        * kjs/grammar.y:
-        * kjs/nodes.h:
-        (JSC::ScopeNode::setUsesArguments):
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::orl_mr):
-
-2008-10-01  Kevin McCullough  <kmccullough@apple.com>
-
-        Rubberstamped by Geoff Garen.
-
-        Remove BreakpointCheckStatement because it's not used anymore.
-        No effect on sunspider or the jsc tests.
-
-        * kjs/nodes.cpp:
-        * kjs/nodes.h:
-
-2008-09-30  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Improve performance of CTI on windows.
-
-        Currently on platforms where the compiler doesn't allow us to safely
-        index relative to the address of a parameter we need to actually
-        provide a pointer to CTI runtime call arguments.  This patch improves
-        performance in this case by making the CTI logic for restoring this
-        parameter much less conservative by only resetting it before we actually
-        make a call, rather than between each and every SF bytecode we generate
-        code for.
-
-        This results in a 3.6% progression on the v8 benchmark when compiled with MSVC.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitCall):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompilePutByIdTransition):
-        * VM/CTI.h:
-        * masm/X86Assembler.h:
-        * wtf/Platform.h:
-
-2008-09-30  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        - track uses of "this", "with" and "catch" in the parser
-        
-        Knowing this up front will be useful for future optimizations.
-        
-        Perf and correctness remain the same.
-        
-        * kjs/NodeInfo.h:
-        * kjs/grammar.y:
-
-2008-09-30  Sam Weinig  <sam@webkit.org>
+2009-06-17  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Mark Rowe.
 
-        Add WebKitAvailability macros for JSObjectMakeArray, JSObjectMakeDate, JSObjectMakeError,
-        and JSObjectMakeRegExp
-
-        * API/JSObjectRef.h:
-
-2008-09-30  Darin Adler  <darin@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=21214
-          work on getting rid of ExecState
-
-        Replaced the m_prev field of ExecState with a bit in the
-        call frame pointer to indicate "host" call frames.
-
-        * VM/Machine.cpp:
-        (JSC::makeHostCallFramePointer): Added. Sets low bit.
-        (JSC::isHostCallFrame): Added. Checks low bit.
-        (JSC::stripHostCallFrameBit): Added. Clears low bit.
-        (JSC::Machine::unwindCallFrame): Replaced null check that was
-        formerly used to detect host call frames with an isHostCallFrame check.
-        (JSC::Machine::execute): Pass in a host call frame pointer rather than
-        always passing 0 when starting execution from the host. This allows us
-        to follow the entire call frame pointer chain when desired, or to stop
-        at the host calls when that's desired.
-        (JSC::Machine::privateExecute): Replaced null check that was
-        formerly used to detect host call frames with an isHostCallFrame check.
-        (JSC::Machine::retrieveCaller): Ditto.
-        (JSC::Machine::retrieveLastCaller): Ditto.
-        (JSC::Machine::callFrame): Removed the code to walk up m_prev pointers
-        and replaced it with code that uses the caller pointer and uses the
-        stripHostCallFrameBit function.
-
-        * kjs/ExecState.cpp: Removed m_prev.
-        * kjs/ExecState.h: Ditto.
-
-2008-09-30  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Move all detection of 'arguments' in a lexical scope to the parser, in
-        preparation for fixing
-
-        Bug 21123: using "arguments" in a function should not force creation of an activation object
-        <https://bugs.webkit.org/show_bug.cgi?id=21123>
-
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::CodeGenerator):
-        * kjs/NodeInfo.h:
-        * kjs/grammar.y:
-
-2008-09-30  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-
-        * kjs/Shell.cpp:
-        (runWithScripts): Fixed indentation.
-
-2008-09-30  Mark Rowe  <mrowe@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        Build fix.  Move InternalFunction::classInfo implementation into the .cpp
-        file to prevent the vtable for InternalFunction being generated as a weak symbol.
-        Has no effect on SunSpider.
-
-        * kjs/InternalFunction.cpp:
-        (JSC::InternalFunction::classInfo):
-        * kjs/InternalFunction.h:
-
-2008-09-29  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        - optimize appending a number to a string
-        https://bugs.webkit.org/show_bug.cgi?id=21203
-        
-        It's pretty common in real-world code (and on some of the v8
-        benchmarks) to append a number to a string, so I made this one of
-        the fast cases, and also added support to UString to do it
-        directly without allocating a temporary UString.
-        
-        ~1% speedup on v8 benchmark.
-
-        * VM/Machine.cpp:
-        (JSC::jsAddSlowCase): Make this NEVER_INLINE because somehow otherwise
-        the change is a regression.
-        (JSC::jsAdd): Handle number + string special case.
-        (JSC::Machine::cti_op_add): Integrate much of the logic of jsAdd to
-        avoid exception check in the str + str, num + num and str + num cases.
-        * kjs/ustring.cpp:
-        (JSC::expandedSize): Make this a non-member function, since it needs to be 
-        called in non-member functions but not outside this file.
-        (JSC::expandCapacity): Ditto.
-        (JSC::UString::expandCapacity): Call the non-member version. 
-        (JSC::createRep): Helper to make a rep from a char*.
-        (JSC::UString::UString): Use above helper.
-        (JSC::concatenate): Guts of concatenating constructor for cases where first
-        item is a UString::Rep, and second is a UChar* and length, or a char*.
-        (JSC::UString::append): Implement for cases where first item is a UString::Rep,
-        and second is an int or double. Sadly duplicates logic of UString::from(int)
-        and UString::from(double).
-        * kjs/ustring.h:
-
-2008-09-29  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=21214
-          work on getting rid of ExecState
-
-        * JavaScriptCore.exp: Updated since JSGlobalObject::init
-        no longer takes a parameter.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::execute): Removed m_registerFile argument
-        for ExecState constructors.
-
-        * kjs/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::evaluate): Removed globalThisValue
-        argument for ExecState constructor.
-
-        * kjs/ExecState.cpp:
-        (JSC::ExecState::ExecState): Removed globalThisValue and
-        registerFile arguments to constructors.
-
-        * kjs/ExecState.h: Removed m_globalThisValue and
-        m_registerFile data members.
-
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::init): Removed globalThisValue
-        argument for ExecState constructor.
-
-        * kjs/JSGlobalObject.h:
-        (JSC::JSGlobalObject::JSGlobalObject): Got rid of parameter
-        for the init function.
-
-2008-09-29  Geoffrey Garen  <ggaren@apple.com>
-
-        Rubber-stamped by Cameron Zwarich.
-        
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=21225
-        Machine::retrieveLastCaller should check for a NULL codeBlock
-        
-        In order to crash, you would need to call retrieveCaller in a situation
-        where you had two host call frames in a row in the register file. I
-        don't know how to make that happen, or if it's even possible, so I don't
-        have a test case -- but better safe than sorry!
-
-        * VM/Machine.cpp:
-        (JSC::Machine::retrieveLastCaller):
-
-2008-09-29  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Cameron Zwarich.
-        
-        Store the callee ScopeChain, not the caller ScopeChain, in the call frame
-        header. Nix the "scopeChain" local variable and ExecState::m_scopeChain, and
-        access the callee ScopeChain through the call frame header instead.
-
-        Profit: call + return are simpler, because they don't have to update the
-        "scopeChain" local variable, or ExecState::m_scopeChain.
-        
-        Because CTI keeps "r" in a register, reading the callee ScopeChain relative
-        to "r" can be very fast, in any cases we care to optimize.
-
-        0% speedup on empty function call benchmark. (5.5% speedup in bytecode.)
-        0% speedup on SunSpider. (7.5% speedup on controlflow-recursive.)
-        2% speedup on SunSpider --v8.
-        2% speedup on v8 benchmark.
-
-        * VM/CTI.cpp: Changed scope chain access to read the scope chain from
-        the call frame header. Sped up op_ret by changing it not to fuss with
-        the "scopeChain" local variable or ExecState::m_scopeChain.
-
-        * VM/CTI.h: Updated CTI trampolines not to take a ScopeChainNode*
-        argument, since that's stored in the call frame header now.
-
-        * VM/Machine.cpp: Access "scopeChain" and "codeBlock" through new helper
-        functions that read from the call frame header. Updated functions operating
-        on ExecState::m_callFrame to account for / take advantage of the fact that
-        Exec:m_callFrame is now never NULL.
-        
-        Fixed a bug in op_construct, where it would use the caller's default
-        object prototype, rather than the callee's, when constructing a new object.
-
-        * VM/Machine.h: Made some helper functions available. Removed
-        ScopeChainNode* arguments to a lot of functions, since the ScopeChainNode*
-        is now stored in the call frame header.
-
-        * VM/RegisterFile.h: Renamed "CallerScopeChain" to "ScopeChain", since
-        that's what it is now.
-
-        * kjs/DebuggerCallFrame.cpp: Updated for change to ExecState signature.
-
-        * kjs/ExecState.cpp:
-        * kjs/ExecState.h: Nixed ExecState::m_callFrame, along with the unused
-        isGlobalObject function.
-
-        * kjs/JSGlobalObject.cpp:
-        * kjs/JSGlobalObject.h: Gave the global object a fake call frame in
-        which to store the global scope chain, since our code now assumes that
-        it can always read the scope chain out of the ExecState's call frame.
-
-2008-09-29  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Sam Weinig.
-
-        Remove the isActivationObject() virtual method on JSObject and use
-        StructureID information instead. This should be slightly faster, but
-        isActivationObject() is only used in assertions and unwinding the stack
-        for exceptions.
-
-        * VM/Machine.cpp:
-        (JSC::depth):
-        (JSC::Machine::unwindCallFrame):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_ret_activation):
-        * kjs/JSActivation.cpp:
-        * kjs/JSActivation.h:
-        * kjs/JSObject.h:
-
-2008-09-29  Peter Gal  <galpeter@inf.u-szeged.hu>
-
-        Reviewed and tweaked by Darin Adler.
-
-        Fix build for non-all-in-one platforms.
-
-        * kjs/StringPrototype.cpp: Added missing ASCIICType.h include.
-
-2008-09-29  Bradley T. Hughes  <bradley.hughes@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Fix compilation with icpc
-
-        * wtf/HashSet.h:
-        (WTF::::find):
-        (WTF::::contains):
-
-2008-09-29  Thiago Macieira  <thiago.macieira@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Changed copyright from Trolltech ASA to Nokia.
-        
-        Nokia acquired Trolltech ASA, assets were transferred on September 26th 2008.
-        
-
-        * wtf/qt/MainThreadQt.cpp:
-
-2008-09-29  Simon Hausmann  <hausmann@webkit.org>
-
-        Reviewed by Lars Knoll.
-
-        Don't accidentially install libJavaScriptCore.a for the build inside
-        Qt.
-
-        * JavaScriptCore.pro:
-
-2008-09-28  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 21200: Allow direct access to 'arguments' without using op_resolve
-        <https://bugs.webkit.org/show_bug.cgi?id=21200>
-
-        Allow fast access to the 'arguments' object by adding an extra slot to
-        the callframe to store it.
-
-        This is a 3.0% speedup on the V8 Raytrace benchmark.
-
-        * JavaScriptCore.exp:
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::CodeGenerator):
-        (JSC::CodeGenerator::registerFor):
-        * VM/CodeGenerator.h:
-        (JSC::CodeGenerator::registerFor):
-        * VM/Machine.cpp:
-        (JSC::Machine::initializeCallFrame):
-        (JSC::Machine::dumpRegisters):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::retrieveArguments):
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_op_create_arguments):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        * VM/Machine.h:
-        * VM/Opcode.h:
-        * VM/RegisterFile.h:
-        (JSC::RegisterFile::):
-        * kjs/JSActivation.cpp:
-        (JSC::JSActivation::mark):
-        (JSC::JSActivation::argumentsGetter):
-        * kjs/JSActivation.h:
-        (JSC::JSActivation::JSActivationData::JSActivationData):
-        * kjs/NodeInfo.h:
-        * kjs/Parser.cpp:
-        (JSC::Parser::didFinishParsing):
-        * kjs/Parser.h:
-        (JSC::Parser::parse):
-        * kjs/grammar.y:
-        * kjs/nodes.cpp:
-        (JSC::ScopeNode::ScopeNode):
-        (JSC::ProgramNode::ProgramNode):
-        (JSC::ProgramNode::create):
-        (JSC::EvalNode::EvalNode):
-        (JSC::EvalNode::create):
-        (JSC::FunctionBodyNode::FunctionBodyNode):
-        (JSC::FunctionBodyNode::create):
-        * kjs/nodes.h:
-        (JSC::ScopeNode::usesArguments):
-
-2008-09-28  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Add an ASCII fast-path to toLowerCase and toUpperCase.
-
-        The fast path speeds up the common case of an ASCII-only string by up to 60% while adding a less than 5% penalty
-        to the less common non-ASCII case.
-
-        This also removes stringProtoFuncToLocaleLowerCase and stringProtoFuncToLocaleUpperCase, which were identical
-        to the non-locale variants of the functions.  toLocaleLowerCase and toLocaleUpperCase now use the non-locale
-        variants of the functions directly.
-
-        * kjs/StringPrototype.cpp:
-        (JSC::stringProtoFuncToLowerCase):
-        (JSC::stringProtoFuncToUpperCase):
-
-2008-09-28  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Speed up parseInt and parseFloat.
-
-        Repeatedly indexing into a UString is slow, so retrieve a pointer into the underlying buffer once up front
-        and use that instead.  This is a 7% win on a parseInt/parseFloat micro-benchmark.
-
-        * kjs/JSGlobalObjectFunctions.cpp:
-        (JSC::parseInt):
-        (JSC::parseFloat):
-
-2008-09-28  Simon Hausmann  <hausmann@webkit.org>
-
-        Reviewed by David Hyatt.
-
-        In Qt's initializeThreading re-use an existing thread identifier for the main
-        thread if it exists.
-
-        currentThread() implicitly creates new identifiers and it could be that
-        it is called before initializeThreading().
-
-        * wtf/ThreadingQt.cpp:
-        (WTF::initializeThreading):
-
-2008-09-27  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Added Machine::retrieveCaller to the export list.
-
-        Reviewed by Kevin McCullough and Tim Hatcher.
-
-        * JavaScriptCore.exp: Added Machine::retrieveCaller.
-
-2008-09-27  Anders Carlsson  <andersca@apple.com>
-
-        Fix build.
-
-        * VM/CTI.cpp:
-        (JSC::):
-
-2008-09-27  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Cameron Zwarich.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=21175
-
-        Store the callee CodeBlock, not the caller CodeBlock, in the call frame
-        header. Nix the "codeBlock" local variable, and access the callee
-        CodeBlock through the call frame header instead.
-        
-        Profit: call + return are simpler, because they don't have to update the
-        "codeBlock" local variable.
-        
-        Because CTI keeps "r" in a register, reading the callee CodeBlock relative
-        to "r" can be very fast, in any cases we care to optimize. Presently,
-        no such cases seem important.
-        
-        Also, stop writing "dst" to the call frame header. CTI doesn't use it.
-        
-        21.6% speedup on empty function call benchmark.
-        3.8% speedup on SunSpider --v8.
-        2.1% speedup on v8 benchmark.
-        0.7% speedup on SunSpider (6% speedup on controlflow-recursive).
-        
-        Small regression in bytecode, because currently every op_ret reads the
-        callee CodeBlock to check needsFullScopeChain, and bytecode does not
-        keep "r" in a register. On-balance, this is probably OK, since CTI is
-        our high-performance execution model. Also, this should go away once
-        we make needsFullScopeChain statically determinable at parse time.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::compileOpCall): The speedup!
-        (JSC::CTI::privateCompileSlowCases): ditto
-
-        * VM/CTI.h:
-        (JSC::): Fixed up magic trampoline constants to account for the nixed
-        "codeBlock" argument.
-        (JSC::CTI::execute): Changed trampoline function not to take a "codeBlock"
-        argument, since codeBlock is now stored in the call frame header.
-        
-        * VM/Machine.cpp: Read the callee CodeBlock from the register file. Use
-        a NULL CallerRegisters in the call frame header to signal a built-in
-        caller, since CodeBlock is now never NULL.
-
-        * VM/Machine.h: Made some stand-alone functions Machine member functions
-        so they could call the private codeBlock() accessor in the Register
-        class, of which Machine is a friend. Renamed "CallerCodeBlock" to
-        "CodeBlock", since it's no longer the caller's CodeBlock.
-
-        * VM/RegisterFile.h: Marked some methods const to accommodate a 
-        const RegisterFile* being passed around in Machine.cpp.
-
-2008-09-26  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Gtk build fix. Not reviewed.
-
-        Narrow-down the target of the JavaScriptCore .lut.h generator so
-        it won't try to create the WebCore .lut.hs.
-
-        * GNUmakefile.am:
-
-2008-09-26  Matt Lilek  <webkit@mattlilek.com>
-
-        Reviewed by Tim Hatcher.
-
-        Update FEATURE_DEFINES after ENABLE_CROSS_DOCUMENT_MESSAGING was removed.
-
-        * Configurations/JavaScriptCore.xcconfig:
-
-2008-09-26  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Rubber-stamped by Anders Carlson.
-
-        Change the name 'sc' to 'scopeChainNode' in a few places.
-
-        * kjs/nodes.cpp:
-        (JSC::EvalNode::generateCode):
-        (JSC::FunctionBodyNode::generateCode):
-        (JSC::ProgramNode::generateCode):
-
-2008-09-26  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Patch for https://bugs.webkit.org/show_bug.cgi?id=21152
-        Speedup static property get/put
-
-        Convert getting/setting static property values to use static functions
-        instead of storing an integer and switching in getValueProperty/putValueProperty.
-
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::deleteProperty):
-        (JSC::JSObject::getPropertyAttributes):
-        * kjs/MathObject.cpp:
-        (JSC::MathObject::getOwnPropertySlot):
-        * kjs/NumberConstructor.cpp:
-        (JSC::numberConstructorNaNValue):
-        (JSC::numberConstructorNegInfinity):
-        (JSC::numberConstructorPosInfinity):
-        (JSC::numberConstructorMaxValue):
-        (JSC::numberConstructorMinValue):
-        * kjs/PropertySlot.h:
-        (JSC::PropertySlot::):
-        * kjs/RegExpConstructor.cpp:
-        (JSC::regExpConstructorDollar1):
-        (JSC::regExpConstructorDollar2):
-        (JSC::regExpConstructorDollar3):
-        (JSC::regExpConstructorDollar4):
-        (JSC::regExpConstructorDollar5):
-        (JSC::regExpConstructorDollar6):
-        (JSC::regExpConstructorDollar7):
-        (JSC::regExpConstructorDollar8):
-        (JSC::regExpConstructorDollar9):
-        (JSC::regExpConstructorInput):
-        (JSC::regExpConstructorMultiline):
-        (JSC::regExpConstructorLastMatch):
-        (JSC::regExpConstructorLastParen):
-        (JSC::regExpConstructorLeftContext):
-        (JSC::regExpConstructorRightContext):
-        (JSC::setRegExpConstructorInput):
-        (JSC::setRegExpConstructorMultiline):
-        (JSC::RegExpConstructor::setInput):
-        (JSC::RegExpConstructor::setMultiline):
-        (JSC::RegExpConstructor::multiline):
-        * kjs/RegExpConstructor.h:
-        * kjs/RegExpObject.cpp:
-        (JSC::regExpObjectGlobal):
-        (JSC::regExpObjectIgnoreCase):
-        (JSC::regExpObjectMultiline):
-        (JSC::regExpObjectSource):
-        (JSC::regExpObjectLastIndex):
-        (JSC::setRegExpObjectLastIndex):
-        * kjs/RegExpObject.h:
-        (JSC::RegExpObject::setLastIndex):
-        (JSC::RegExpObject::lastIndex):
-        (JSC::RegExpObject::RegExpObjectData::RegExpObjectData):
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::getEnumerablePropertyNames):
-        * kjs/create_hash_table:
-        * kjs/lexer.cpp:
-        (JSC::Lexer::lex):
-        * kjs/lookup.cpp:
-        (JSC::HashTable::createTable):
-        (JSC::HashTable::deleteTable):
-        (JSC::setUpStaticFunctionSlot):
-        * kjs/lookup.h:
-        (JSC::HashEntry::initialize):
-        (JSC::HashEntry::setKey):
-        (JSC::HashEntry::key):
-        (JSC::HashEntry::attributes):
-        (JSC::HashEntry::function):
-        (JSC::HashEntry::functionLength):
-        (JSC::HashEntry::propertyGetter):
-        (JSC::HashEntry::propertyPutter):
-        (JSC::HashEntry::lexerValue):
-        (JSC::HashEntry::):
-        (JSC::HashTable::entry):
-        (JSC::getStaticPropertySlot):
-        (JSC::getStaticValueSlot):
-        (JSC::lookupPut):
-
-2008-09-26  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Maciej Stachowiak & Oliver Hunt.
-
-        Add support for reusing temporary JSNumberCells.  This change is based on the observation
-        that if the result of certain operations is a JSNumberCell and is consumed by a subsequent
-        operation that would produce a JSNumberCell, we can reuse the object rather than allocating
-        a fresh one.  E.g. given the expression ((a * b) * c), we can statically determine that
-        (a * b) will have a numeric result (or else it will have thrown an exception), so the result
-        will either be a JSNumberCell or a JSImmediate.
-
-        This patch changes three areas of JSC:
-            * The AST now tracks type information about the result of each node.
-            * This information is consumed in bytecode compilation, and certain bytecode operations
-              now carry the statically determined type information about their operands.
-            * CTI uses the information in a number of fashions:
-                * Where an operand to certain arithmetic operations is reusable, it will plant code
-                  to try to perform the operation in JIT code & reuse the cell, where appropriate.
-                * Where it can be statically determined that an operand can only be numeric (typically
-                  the result of another arithmetic operation) the code will not redundantly check that
-                  the JSCell is a JSNumberCell.
-                * Where either of the operands to an add are non-numeric do not plant an optimized
-                  arithmetic code path, just call straight out to the C function.
-
-        +6% Sunspider (10% progression on 3D, 16% progression on math, 60% progression on access-nbody),
-        +1% v8-tests (improvements in raytrace & crypto)
-
-        * VM/CTI.cpp: Add optimized code generation with reuse of temporary JSNumberCells.
-        * VM/CTI.h:
-        * kjs/JSNumberCell.h:
-        * masm/X86Assembler.h:
-
-        * VM/CodeBlock.cpp: Add type information to specific bytecodes.
-        * VM/CodeGenerator.cpp:
-        * VM/CodeGenerator.h:
-        * VM/Machine.cpp:
-
-        * kjs/nodes.cpp: Track static type information for nodes.
-        * kjs/nodes.h:
-        * kjs/ResultDescriptor.h: (Added)
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2008-09-26  Yichao Yin  <yichao.yin@torchmobile.com.cn>
-
-        Reviewed by George Staikos, Maciej Stachowiak.
-
-        Add utility functions needed for upcoming WML code.
-
-        * wtf/ASCIICType.h:
-        (WTF::isASCIIPrintable):
-
-2008-09-26  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        Reverted the part of r36614 that used static data because static data
-        is not thread-safe.
-
-2008-09-26  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-        
-        Removed dynamic check for whether the callee needs an activation object.
-        Replaced with callee code to create the activation object.
-
-        0.5% speedup on SunSpider.
-        No change on v8 benchmark. (Might be a speedup, but it's in range of the
-        variance.)
-
-        0.7% speedup on v8 benchmark in bytecode.
-        1.3% speedup on empty call benchmark in bytecode.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass): Added support for op_init_activation,
-        the new opcode that specifies that the callee's initialization should
-        create an activation object.
-        (JSC::CTI::privateCompile): Removed previous code that did a similar
-        thing in an ad-hoc way.
-
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump): Added a case for dumping op_init_activation.
-
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::generate): Added fixup code to change op_init to
-        op_init_activation if necessary. (With a better parser, we would know
-        which to use from the beginning.)
-
-        * VM/Instruction.h:
-        (JSC::Instruction::Instruction):
-        (WTF::): Faster traits for the instruction vector. An earlier version
-        of this patch relied on inserting at the beginning of the vector, and
-        depended on this change for speed.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::execute): Removed clients of setScopeChain, the old
-        abstraction for dynamically checking for whether an activation object
-        needed to be created.
-        (JSC::Machine::privateExecute): ditto
-
-        (JSC::Machine::cti_op_push_activation): Renamed this function from
-        cti_vm_updateScopeChain, and made it faster by removing the call to 
-        setScopeChain.
-        * VM/Machine.h:
-
-        * VM/Opcode.h: Declared op_init_activation.
-
-2008-09-24  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-        
-        Move most of the return code back into the callee, now that the callee
-        doesn't have to calculate anything dynamically.
-        
-        11.5% speedup on empty function call benchmark.
-        
-        SunSpider says 0.3% faster. SunSpider --v8 says no change.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-
-2008-09-24  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Remove staticFunctionGetter.  There is only one remaining user of
-        staticFunctionGetter and it can be converted to use setUpStaticFunctionSlot.
-
-        * JavaScriptCore.exp:
-        * kjs/lookup.cpp:
-        * kjs/lookup.h:
-
-2008-09-24  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Oliver Hunt.
-        
-        - inline JIT fast case of op_neq
-        - remove extra level of function call indirection from slow cases of eq and neq
-        
-        1% speedup on Richards
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_eq):
-        (JSC::Machine::cti_op_neq):
-        * kjs/operations.cpp:
-        (JSC::equal):
-        (JSC::equalSlowCase):
-        * kjs/operations.h:
-        (JSC::equalSlowCaseInline):
-
-2008-09-24  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21080
-        <rdar://problem/6243534>
-        Crash below Function.apply when using a runtime array as the argument list
-
-        Test: plugins/bindings-array-apply-crash.html
-
-        * kjs/FunctionPrototype.cpp:
-        (JSC::functionProtoFuncApply): Revert to the slow case if the object inherits from 
-        JSArray (via ClassInfo) but is not a JSArray.
-
-2008-09-24  Kevin McCullough  <kmccullough@apple.com>
-
-        Style change.
-
-        * kjs/nodes.cpp:
-        (JSC::statementListEmitCode):
-
-2008-09-24  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Geoff.
-
-        Bug 21031: Breakpoints in the condition of loops only breaks the first
-        time
-        - Now when setting breakpoints in the condition of a loop (for, while,
-        for in, and do while) will successfully break each time throught the
-        loop.
-        - For 'for' loops we need a little more complicated behavior that cannot
-        be accomplished without some more significant changes:
-        https://bugs.webkit.org/show_bug.cgi?id=21073
-
-        * kjs/nodes.cpp:
-        (JSC::statementListEmitCode): We don't want to blindly emit a debug hook
-        at the first line of loops, instead let the loop emit the debug hooks.
-        (JSC::DoWhileNode::emitCode):
-        (JSC::WhileNode::emitCode):
-        (JSC::ForNode::emitCode):
-        (JSC::ForInNode::emitCode):
-        * kjs/nodes.h:
-        (JSC::StatementNode::):
-        (JSC::DoWhileNode::):
-        (JSC::WhileNode::):
-        (JSC::ForInNode::):
-
-2008-09-24  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        Fixed <rdar://problem/5605532> Need a SPI for telling JS the size of
-        the objects it retains
-
-        * API/tests/testapi.c: Test the new SPI a little.
-
-        * API/JSSPI.cpp: Add the new SPI.
-        * API/JSSPI.h: Add the new SPI.
-        * JavaScriptCore.exp: Add the new SPI.
-        * JavaScriptCore.xcodeproj/project.pbxproj: Add the new SPI.
-
-2008-09-24  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Darin Adler.
-
-        * API/JSBase.h: Filled in some missing function names.
-
-2008-09-24  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Cameron Zwarich.
-        
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=21057
-        Crash in RegisterID::deref() running fast/canvas/canvas-putImageData.html
-
-        * VM/CodeGenerator.h: Changed declaration order to ensure the
-        m_lastConstant, which is a RefPtr that points into m_calleeRegisters,
-        has its destructor called before the destructor for m_calleeRegisters.
-
-2008-09-24  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=21047
-          speed up ret_activation with inlining
-
-        About 1% on v8-raytrace.
-
-        * JavaScriptCore.exp: Removed JSVariableObject::setRegisters.
-
-        * kjs/JSActivation.cpp: Moved copyRegisters to the header to make it inline.
-        * kjs/JSActivation.h:
-        (JSC::JSActivation::copyRegisters): Moved here. Also removed the registerArraySize
-        argument to setRegisters, since the object doesn't need to store the number of
-        registers.
-
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::reset): Removed unnecessary clearing left over from when we
-        used this on objects that weren't brand new. These days, this function is really
-        just part of the constructor.
-
-        * kjs/JSGlobalObject.h: Added registerArraySize to JSGlobalObjectData, since
-        JSVariableObjectData no longer needs it. Added a setRegisters override here
-        that handles storing the size.
-
-        * kjs/JSStaticScopeObject.h: Removed code to set registerArraySize, since it
-        no longer exists.
-
-        * kjs/JSVariableObject.cpp: Moved copyRegisterArray and setRegisters to the
-        header to make them inline.
-        * kjs/JSVariableObject.h: Removed registerArraySize from JSVariableObjectData,
-        since it was only used for the global object.
-        (JSC::JSVariableObject::copyRegisterArray): Moved here ot make it inline.
-        (JSC::JSVariableObject::setRegisters): Moved here to make it inline. Also
-        removed the code to set registerArraySize and changed an if statement into
-        an assert to save an unnnecessary branch.
-
-2008-09-24  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Oliver Hunt.
-        
-        - inline PropertyMap::getOffset to speed up polymorphic lookups
-        
-        ~1.5% speedup on v8 benchmark
-        no effect on SunSpider
-
-        * JavaScriptCore.exp:
-        * kjs/PropertyMap.cpp:
-        * kjs/PropertyMap.h:
-        (JSC::PropertyMap::getOffset):
-
-2008-09-24  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Alp Toker.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20992
-        Build fails on GTK+ Mac OS
-
-        * wtf/ThreadingGtk.cpp: Remove platform ifdef as suggested by
-          Richard Hult.
-        (WTF::initializeThreading):
-
-2008-09-23  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 19968: Slow Script at www.huffingtonpost.com
-        <https://bugs.webkit.org/show_bug.cgi?id=19968>
-
-        Finally found the cause of this accursed issue.  It is triggered
-        by synchronous creation of a new global object from JS.  The new
-        global object resets the timer state in this execution group's
-        Machine, taking timerCheckCount to 0.  Then when JS returns the
-        timerCheckCount is decremented making it non-zero.  The next time
-        we execute JS we will start the timeout counter, however the non-zero
-        timeoutCheckCount means we don't reset the timer information. This
-        means that the timeout check is now checking the cumulative time
-        since the creation of the global object rather than the time since
-        JS was last entered.  At this point the slow script dialog is guaranteed
-        to eventually be displayed incorrectly unless a page is loaded
-        asynchronously (which will reset everything into a sane state).
-
-        The fix for this is rather trivial -- the JSGlobalObject constructor
-        should not be resetting the machine timer state.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::Machine):
-          Now that we can't rely on the GlobalObject initialising the timeout
-          state, we do it in the Machine constructor.
-
-        * VM/Machine.h:
-        (JSC::Machine::stopTimeoutCheck):
-          Add assertions to guard against this happening.
-
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::init):
-          Don't reset the timeout state.
-
-2008-09-23  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt.
-        
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=21038 | <rdar://problem/6240812>
-        Uncaught exceptions in regex replace callbacks crash webkit
-        
-        This was a combination of two problems:
-        
-        (1) the replace function would continue execution after an exception
-        had been thrown.
-        
-        (2) In some cases, the Machine would return 0 in the case of an exception,
-        despite the fact that a few clients dereference the Machine's return
-        value without first checking for an exception.
-        
-        * VM/Machine.cpp:
-        (JSC::Machine::execute):
-        
-        ^ Return jsNull() instead of 0 in the case of an exception, since some
-        clients depend on using our return value.
-        
-        ^ ASSERT that execution does not continue after an exception has been
-        thrown, to help catch problems like this in the future.
-
-        * kjs/StringPrototype.cpp:
-        (JSC::stringProtoFuncReplace):
-        
-        ^ Stop execution if an exception has been thrown.
-
-2008-09-23  Geoffrey Garen  <ggaren@apple.com>
-
-        Try to fix the windows build.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileMainPass):
-
-2008-09-23  Alp Toker  <alp@nuanti.com>
-
-        Build fix.
-
-        * VM/CTI.h:
-
-2008-09-23  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Darin Adler.
-
-        * wtf/Platform.h: Removed duplicate #if.
-
-2008-09-23  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        Changed the layout of the call frame from
-        
-        { header, parameters, locals | constants, temporaries }
-        
-        to
-        
-        { parameters, header | locals, constants, temporaries }
-        
-        This simplifies function entry+exit, and enables a number of future
-        optimizations.
-        
-        13.5% speedup on empty call benchmark for bytecode; 23.6% speedup on
-        empty call benchmark for CTI.
-        
-        SunSpider says no change. SunSpider --v8 says 1% faster.
-
-        * VM/CTI.cpp:
-        
-        Added a bit of abstraction for calculating whether a register is a
-        constant, since this patch changes that calculation:
-        (JSC::CTI::isConstant):
-        (JSC::CTI::getConstant):
-        (JSC::CTI::emitGetArg):
-        (JSC::CTI::emitGetPutArg):
-        (JSC::CTI::getConstantImmediateNumericArg):
-
-        Updated for changes to callframe header location:
-        (JSC::CTI::emitPutToCallFrameHeader):
-        (JSC::CTI::emitGetFromCallFrameHeader):
-        (JSC::CTI::printOpcodeOperandTypes):
-        
-        Renamed to spite Oliver:
-        (JSC::CTI::emitInitRegister):
-        
-        Added an abstraction for emitting a call through a register, so that
-        calls through registers generate exception info, too:
-        (JSC::CTI::emitCall):
-
-        Updated to match the new callframe header layout, and to support calls
-        through registers, which have no destination address:
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-
-        * VM/CTI.h:
-
-        More of the above:
-        (JSC::CallRecord::CallRecord):
-
-        * VM/CodeBlock.cpp:
-
-        Updated for new register layout:
-        (JSC::registerName):
-        (JSC::CodeBlock::dump):
-
-        * VM/CodeBlock.h:
-        
-        Updated CodeBlock to track slightly different information about the
-        register frame, and tweaked the style of an ASSERT_NOT_REACHED.
-        (JSC::CodeBlock::CodeBlock):
-        (JSC::CodeBlock::getStubInfo):
-
-        * VM/CodeGenerator.cpp:
-        
-        Added some abstraction around constant register allocation, since this
-        patch changes it, changed codegen to account for the new callframe
-        layout, and added abstraction around register fetching code
-        that used to assume that all local registers lived at negative indices,
-        since vars now live at positive indices:
-        (JSC::CodeGenerator::generate):
-        (JSC::CodeGenerator::addVar):
-        (JSC::CodeGenerator::addGlobalVar):
-        (JSC::CodeGenerator::allocateConstants):
-        (JSC::CodeGenerator::CodeGenerator):
-        (JSC::CodeGenerator::addParameter):
-        (JSC::CodeGenerator::registerFor):
-        (JSC::CodeGenerator::constRegisterFor):
-        (JSC::CodeGenerator::newRegister):
-        (JSC::CodeGenerator::newTemporary):
-        (JSC::CodeGenerator::highestUsedRegister):
-        (JSC::CodeGenerator::addConstant):
-        
-        ASSERT that our caller referenced the registers it passed to us.
-        Otherwise, we might overwrite them with parameters:
-        (JSC::CodeGenerator::emitCall):
-        (JSC::CodeGenerator::emitConstruct):
-
-        * VM/CodeGenerator.h:
-        
-        Added some abstraction for getting a RegisterID for a given index,
-        since the rules are a little weird:
-        (JSC::CodeGenerator::registerFor):
-
-        * VM/Machine.cpp:
-
-        Utility function to transform a machine return PC to a virtual machine
-        return VPC, for the sake of stack unwinding, since both PCs are stored
-        in the same location now:
-        (JSC::vPCForPC):
-
-        Tweaked to account for new call frame:
-        (JSC::Machine::initializeCallFrame):
-        
-        Tweaked to account for registerOffset supplied by caller:
-        (JSC::slideRegisterWindowForCall):
-
-        Tweaked to account for new register layout:
-        (JSC::scopeChainForCall):
-        (JSC::Machine::callEval):
-        (JSC::Machine::dumpRegisters):
-        (JSC::Machine::unwindCallFrame):
-        (JSC::Machine::execute):
-
-        Changed op_call and op_construct to implement the new calling convention:
-        (JSC::Machine::privateExecute):
-
-        Tweaked to account for the new register layout:
-        (JSC::Machine::retrieveArguments):
-        (JSC::Machine::retrieveCaller):
-        (JSC::Machine::retrieveLastCaller):
-        (JSC::Machine::callFrame):
-        (JSC::Machine::getArgumentsData):
-
-        Changed CTI call helpers to implement the new calling convention:
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_op_call_NotJSFunction):
-        (JSC::Machine::cti_op_ret_activation):
-        (JSC::Machine::cti_op_ret_profiler):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-        (JSC::Machine::cti_op_call_eval):
-
-        * VM/Machine.h:
-
-        * VM/Opcode.h:
-        
-        Renamed op_initialise_locals to op_init, because this opcode
-        doesn't initialize all locals, and it doesn't initialize only locals.
-        Also, to spite Oliver.
-        
-        * VM/RegisterFile.h:
-        
-        New call frame enumeration values:
-        (JSC::RegisterFile::):
-
-        Simplified the calculation of whether a RegisterID is a temporary,
-        since we can no longer assume that all positive non-constant registers
-        are temporaries:
-        * VM/RegisterID.h:
-        (JSC::RegisterID::RegisterID):
-        (JSC::RegisterID::setTemporary):
-        (JSC::RegisterID::isTemporary):
-
-        Renamed firstArgumentIndex to firstParameterIndex because the assumption
-        that this variable pertained to the actual arguments supplied by the
-        caller caused me to write some buggy code:
-        * kjs/Arguments.cpp:
-        (JSC::ArgumentsData::ArgumentsData):
-        (JSC::Arguments::Arguments):
-        (JSC::Arguments::fillArgList):
-        (JSC::Arguments::getOwnPropertySlot):
-        (JSC::Arguments::put):
-
-        Updated for new call frame layout:
-        * kjs/DebuggerCallFrame.cpp:
-        (JSC::DebuggerCallFrame::functionName):
-        (JSC::DebuggerCallFrame::type):
-        * kjs/DebuggerCallFrame.h:
-
-        Changed the activation object to account for the fact that a call frame
-        header now sits between parameters and local variables. This change
-        requires all variable objects to do their own marking, since they
-        now use their register storage differently:
-        * kjs/JSActivation.cpp:
-        (JSC::JSActivation::mark):
-        (JSC::JSActivation::copyRegisters):
-        (JSC::JSActivation::createArgumentsObject):
-        * kjs/JSActivation.h:
-
-        Updated global object to use the new interfaces required by the change
-        to JSActivation above:
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::reset):
-        (JSC::JSGlobalObject::mark):
-        (JSC::JSGlobalObject::copyGlobalsFrom):
-        (JSC::JSGlobalObject::copyGlobalsTo):
-        * kjs/JSGlobalObject.h:
-        (JSC::JSGlobalObject::addStaticGlobals):
-
-        Updated static scope object to use the new interfaces required by the 
-        change to JSActivation above:
-        * kjs/JSStaticScopeObject.cpp:
-        (JSC::JSStaticScopeObject::mark):
-        (JSC::JSStaticScopeObject::~JSStaticScopeObject):
-        * kjs/JSStaticScopeObject.h:
-        (JSC::JSStaticScopeObject::JSStaticScopeObject):
-        (JSC::JSStaticScopeObject::d):
-
-        Updated variable object to use the new interfaces required by the 
-        change to JSActivation above:
-        * kjs/JSVariableObject.cpp:
-        (JSC::JSVariableObject::copyRegisterArray):
-        (JSC::JSVariableObject::setRegisters):
-        * kjs/JSVariableObject.h:
-
-        Changed the bit twiddling in symbol table not to assume that all indices
-        are negative, since they can be positive now:
-        * kjs/SymbolTable.h:
-        (JSC::SymbolTableEntry::SymbolTableEntry):
-        (JSC::SymbolTableEntry::isNull):
-        (JSC::SymbolTableEntry::getIndex):
-        (JSC::SymbolTableEntry::getAttributes):
-        (JSC::SymbolTableEntry::setAttributes):
-        (JSC::SymbolTableEntry::isReadOnly):
-        (JSC::SymbolTableEntry::pack):
-        (JSC::SymbolTableEntry::isValidIndex):
-
-        Changed call and construct nodes to ref their functions and/or bases,
-        so that emitCall/emitConstruct doesn't overwrite them with parameters.
-        Also, updated for rename to registerFor:
-        * kjs/nodes.cpp:
-        (JSC::ResolveNode::emitCode):
-        (JSC::NewExprNode::emitCode):
-        (JSC::EvalFunctionCallNode::emitCode):
-        (JSC::FunctionCallValueNode::emitCode):
-        (JSC::FunctionCallResolveNode::emitCode):
-        (JSC::FunctionCallBracketNode::emitCode):
-        (JSC::FunctionCallDotNode::emitCode):
-        (JSC::PostfixResolveNode::emitCode):
-        (JSC::DeleteResolveNode::emitCode):
-        (JSC::TypeOfResolveNode::emitCode):
-        (JSC::PrefixResolveNode::emitCode):
-        (JSC::ReadModifyResolveNode::emitCode):
-        (JSC::AssignResolveNode::emitCode):
-        (JSC::ConstDeclNode::emitCodeSingle):
-        (JSC::ForInNode::emitCode):
-
-        Added abstraction for getting exception info out of a call through a
-        register:
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::emitCall):
-        
-        Removed duplicate #if:
-        * wtf/Platform.h:
-
-2008-09-23  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Darin.
-
-        Bug 21030: The JS debugger breaks on the do of a do-while not the while
-        (where the conditional statement is)
-        https://bugs.webkit.org/show_bug.cgi?id=21030
-        Now the statementListEmitCode detects if a do-while node is being
-        emited and emits the debug hook on the last line instead of the first.
-
-        This change had no effect on sunspider.
-
-        * kjs/nodes.cpp:
-        (JSC::statementListEmitCode):
-        * kjs/nodes.h:
-        (JSC::StatementNode::isDoWhile):
-        (JSC::DoWhileNode::isDoWhile):
-
-2008-09-23  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        - inline the fast case of instanceof
-        https://bugs.webkit.org/show_bug.cgi?id=20818
-
-        ~2% speedup on EarleyBoyer test.
-        
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_instanceof):
-
-2008-09-23  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Cameron Zwarich.
-        
-        - add forgotten slow case logic for !==
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileSlowCases):
-
-2008-09-23  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        - inline the fast cases of !==, same as for ===
-        
-        2.9% speedup on EarleyBoyer benchmark
-
-        * VM/CTI.cpp:
-        (JSC::CTI::compileOpStrictEq): Factored stricteq codegen into this function,
-        and parameterized so it can do the reverse version as well.
-        (JSC::CTI::privateCompileMainPass): Use the above for stricteq and nstricteq.
-        * VM/CTI.h:
-        (JSC::CTI::): Declare above stuff.
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_nstricteq): Removed fast cases, now handled inline.
-
-2008-09-23  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 20989: Aguments constructor should put 'callee' and 'length' properties in a more efficient way
-        <https://bugs.webkit.org/show_bug.cgi?id=20989>
-
-        Make special cases for the 'callee' and 'length' properties in the
-        Arguments object.
-
-        This is somewhere between a 7.8% speedup and a 10% speedup on the V8
-        Raytrace benchmark, depending on whether it is run alone or with the
-        other V8 benchmarks.
-
-        * kjs/Arguments.cpp:
-        (JSC::ArgumentsData::ArgumentsData):
-        (JSC::Arguments::Arguments):
-        (JSC::Arguments::mark):
-        (JSC::Arguments::getOwnPropertySlot):
-        (JSC::Arguments::put):
-        (JSC::Arguments::deleteProperty):
-
-2008-09-23  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Darin.
-
-        - speed up instanceof some more
-        https://bugs.webkit.org/show_bug.cgi?id=20818
-        
-        ~2% speedup on EarleyBoyer
-
-        The idea here is to record in the StructureID whether the class
-        needs a special hasInstance or if it can use the normal logic from
-        JSObject. 
-        
-        Based on this I inlined the real work directly into
-        cti_op_instanceof and put the fastest checks up front and the
-        error handling at the end (so it should be fairly straightforward
-        to split off the beginning to be inlined if desired).
-
-        I only did this for CTI, not the bytecode interpreter.
-        
-        * API/JSCallbackObject.h:
-        (JSC::JSCallbackObject::createStructureID):
-        * ChangeLog:
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_instanceof):
-        * kjs/JSImmediate.h:
-        (JSC::JSImmediate::isAnyImmediate):
-        * kjs/TypeInfo.h:
-        (JSC::TypeInfo::overridesHasInstance):
-        (JSC::TypeInfo::flags):
-
-2008-09-22  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=21019
-          make FunctionBodyNode::ref/deref fast
-
-        Speeds up v8-raytrace by 7.2%.
-
-        * kjs/nodes.cpp:
-        (JSC::FunctionBodyNode::FunctionBodyNode): Initialize m_refCount to 0.
-        * kjs/nodes.h:
-        (JSC::FunctionBodyNode::ref): Call base class ref once, and thereafter use
-        m_refCount.
-        (JSC::FunctionBodyNode::deref): Ditto, but the deref side.
-
-2008-09-22  Darin Adler  <darin@apple.com>
-
-        Pointed out by Sam Weinig.
-
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::fillArgList): Fix bad copy and paste. Oops!
+        <rdar://problem/6947426> sunspider math-cordic.js exhibits different intermediate results running 32-bit vs. 64-bit
 
-2008-09-22  Darin Adler  <darin@apple.com>
+        On 64-bit, NaN-encoded values must be detagged before they can be used in rshift.
 
-        Reviewed by Cameron Zwarich.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=20983
-          ArgumentsData should have some room to allocate some extra arguments inline
-
-        Speeds up v8-raytrace by 5%.
-
-        * kjs/Arguments.cpp:
-        (JSC::ArgumentsData::ArgumentsData): Use a fixed buffer if there are 4 or fewer
-        extra arguments.
-        (JSC::Arguments::Arguments): Use a fixed buffer if there are 4 or fewer
-        extra arguments.
-        (JSC::Arguments::~Arguments): Delete the buffer if necessary.
-        (JSC::Arguments::mark): Update since extraArguments are now Register.
-        (JSC::Arguments::fillArgList): Added special case for the only case that's
-        actually used in the practice, when there are no parameters. There are some
-        other special cases in there too, but that's the only one that matters.
-        (JSC::Arguments::getOwnPropertySlot): Updated to use setValueSlot since there's
-        no operation to get you at the JSValue* inside a Register as a "slot".
-
-2008-09-22  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Patch for https://bugs.webkit.org/show_bug.cgi?id=21014
-        Speed up for..in by using StructureID to avoid calls to hasProperty
-
-        Speeds up fasta by 8%.
-
-        * VM/JSPropertyNameIterator.cpp:
-        (JSC::JSPropertyNameIterator::invalidate):
-        * VM/JSPropertyNameIterator.h:
-        (JSC::JSPropertyNameIterator::next):
-        * kjs/PropertyNameArray.h:
-        (JSC::PropertyNameArrayData::begin):
-        (JSC::PropertyNameArrayData::end):
-        (JSC::PropertyNameArrayData::setCachedStructureID):
-        (JSC::PropertyNameArrayData::cachedStructureID):
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::getEnumerablePropertyNames):
-        (JSC::structureIDChainsAreEqual):
-        * kjs/StructureID.h:
-
-2008-09-22  Kelvin Sherlock  <ksherlock@gmail.com>
-
-        Updated and tweaked by Sam Weinig.
-
-        Reviewed by Geoffrey Garen.
-
-        Bug 20020: Proposed enhancement to JavaScriptCore API
-        <https://bugs.webkit.org/show_bug.cgi?id=20020>
-
-        Add JSObjectMakeArray, JSObjectMakeDate, JSObjectMakeError, and JSObjectMakeRegExp
-        functions to create JavaScript Array, Date, Error, and RegExp objects, respectively.
-
-        * API/JSObjectRef.cpp: The functions
-        * API/JSObjectRef.h: Function prototype and documentation
-        * JavaScriptCore.exp: Added functions to exported function list
-        * API/tests/testapi.c: Added basic functionality tests.
-
-        * kjs/DateConstructor.cpp:
-        Replaced static JSObject* constructDate(ExecState* exec, JSObject*, const ArgList& args)
-        with JSObject* constructDate(ExecState* exec, const ArgList& args).
-        Added static JSObject* constructWithDateConstructor(ExecState* exec, JSObject*, const ArgList& args) function
-
-        * kjs/DateConstructor.h:
-        added prototype for JSObject* constructDate(ExecState* exec, const ArgList& args)
-
-        * kjs/ErrorConstructor.cpp:
-        removed static qualifier from ErrorInstance* constructError(ExecState* exec, const ArgList& args)
-
-        * kjs/ErrorConstructor.h:
-        added prototype for ErrorInstance* constructError(ExecState* exec, const ArgList& args)
-
-        * kjs/RegExpConstructor.cpp:
-        removed static qualifier from JSObject* constructRegExp(ExecState* exec, const ArgList& args)
-
-        * kjs/RegExpConstructor.h:
-        added prototype for JSObject* constructRegExp(ExecState* exec, const ArgList& args)
-
-2008-09-22  Matt Lilek  <webkit@mattlilek.com>
-
-        Not reviewed, Windows build fix.
-
-        * kjs/Arguments.cpp:
-        * kjs/FunctionPrototype.cpp:
-
-2008-09-22  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Patch for https://bugs.webkit.org/show_bug.cgi?id=20982
-        Speed up the apply method of functions by special-casing array and 'arguments' objects
-
-        1% speedup on v8-raytrace.
-
-        Test: fast/js/function-apply.html
-
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::fillArgList):
-        * kjs/Arguments.h:
-        * kjs/FunctionPrototype.cpp:
-        (JSC::functionProtoFuncApply):
-        * kjs/JSArray.cpp:
-        (JSC::JSArray::fillArgList):
-        * kjs/JSArray.h:
-
-2008-09-22  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=20993
-          Array.push/pop need optimized cases for JSArray
-
-        3% or so speedup on DeltaBlue benchmark.
-
-        * kjs/ArrayPrototype.cpp:
-        (JSC::arrayProtoFuncPop): Call JSArray::pop when appropriate.
-        (JSC::arrayProtoFuncPush): Call JSArray::push when appropriate.
-
-        * kjs/JSArray.cpp:
-        (JSC::JSArray::putSlowCase): Set m_fastAccessCutoff when appropriate, getting
-        us into the fast code path.
-        (JSC::JSArray::pop): Added.
-        (JSC::JSArray::push): Added.
-        * kjs/JSArray.h: Added push and pop.
-
-        * kjs/operations.cpp:
-        (JSC::throwOutOfMemoryError): Don't inline this. Helps us avoid PIC branches.
+        No performance impact.
 
-2008-09-22  Maciej Stachowiak  <mjs@apple.com>
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_rshift):
 
-        Reviewed by Cameron Zwarich.
-        
-        - speed up instanceof operator by replacing implementsHasInstance method with a TypeInfo flag
+2009-06-17  Adam Treat  <adam.treat@torchmobile.com>
 
-        Partial work towards <https://bugs.webkit.org/show_bug.cgi?id=20818>
-        
-        2.2% speedup on EarleyBoyer benchmark.
-
-        * API/JSCallbackConstructor.cpp:
-        * API/JSCallbackConstructor.h:
-        (JSC::JSCallbackConstructor::createStructureID):
-        * API/JSCallbackFunction.cpp:
-        * API/JSCallbackFunction.h:
-        (JSC::JSCallbackFunction::createStructureID):
-        * API/JSCallbackObject.h:
-        (JSC::JSCallbackObject::createStructureID):
-        * API/JSCallbackObjectFunctions.h:
-        (JSC::::hasInstance):
-        * API/JSValueRef.cpp:
-        (JSValueIsInstanceOfConstructor):
-        * JavaScriptCore.exp:
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_instanceof):
-        * kjs/InternalFunction.cpp:
-        * kjs/InternalFunction.h:
-        (JSC::InternalFunction::createStructureID):
-        * kjs/JSObject.cpp:
-        * kjs/JSObject.h:
-        * kjs/TypeInfo.h:
-        (JSC::TypeInfo::implementsHasInstance):
-
-2008-09-22  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Dave Hyatt.
-        
-        Based on initial work by Darin Adler.
-        
-        - replace masqueradesAsUndefined virtual method with a flag in TypeInfo
-        - use this to JIT inline code for eq_null and neq_null
-        https://bugs.webkit.org/show_bug.cgi?id=20823
+        Reviewed by George Staikos.
 
-        0.5% speedup on SunSpider
-        ~4% speedup on Richards benchmark
-        
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        * VM/Machine.cpp:
-        (JSC::jsTypeStringForValue):
-        (JSC::jsIsObjectType):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_is_undefined):
-        * VM/Machine.h:
-        * kjs/JSCell.h:
-        * kjs/JSValue.h:
-        * kjs/StringObjectThatMasqueradesAsUndefined.h:
-        (JSC::StringObjectThatMasqueradesAsUndefined::create):
-        (JSC::StringObjectThatMasqueradesAsUndefined::createStructureID):
-        * kjs/StructureID.h:
-        (JSC::StructureID::mutableTypeInfo):
-        * kjs/TypeInfo.h:
-        (JSC::TypeInfo::TypeInfo):
-        (JSC::TypeInfo::masqueradesAsUndefined):
-        * kjs/operations.cpp:
-        (JSC::equal):
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::setne_r):
-        (JSC::X86Assembler::setnz_r):
-        (JSC::X86Assembler::testl_i32m):
-
-2008-09-22  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon.
-
-        Initialize QCoreApplication in kjs binary/Shell.cpp
-        
-        This allows us to use QCoreApplication::instance() to
-        get the main thread in ThreadingQt.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=23155
+        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
 
-        * kjs/Shell.cpp:
+        * jsc.cpp:
         (main):
-        * wtf/ThreadingQt.cpp:
-        (WTF::initializeThreading):
-
-2008-09-21  Darin Adler  <darin@apple.com>
-
-        - blind attempt to fix non-all-in-one builds
-
-        * kjs/JSGlobalObject.cpp: Added includes of Arguments.h and RegExpObject.h.
-
-2008-09-21  Darin Adler  <darin@apple.com>
-
-        - fix debug build
-
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::addPropertyTransition): Use typeInfo().type() instead of m_type.
-        (JSC::StructureID::createCachedPrototypeChain): Ditto.
-
-2008-09-21  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        - introduce a TypeInfo class, for holding per-type (in the C++ class sense) date in StructureID
-        https://bugs.webkit.org/show_bug.cgi?id=20981
-
-        * JavaScriptCore.exp:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompilePutByIdTransition):
-        * VM/Machine.cpp:
-        (JSC::jsIsObjectType):
-        (JSC::Machine::Machine):
-        * kjs/AllInOneFile.cpp:
-        * kjs/JSCell.h:
-        (JSC::JSCell::isObject):
-        (JSC::JSCell::isString):
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::reset):
-        * kjs/JSGlobalObject.h:
-        (JSC::StructureID::prototypeForLookup):
-        * kjs/JSNumberCell.h:
-        (JSC::JSNumberCell::createStructureID):
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::createInheritorID):
-        * kjs/JSObject.h:
-        (JSC::JSObject::createStructureID):
-        * kjs/JSString.h:
-        (JSC::JSString::createStructureID):
-        * kjs/NativeErrorConstructor.cpp:
-        (JSC::NativeErrorConstructor::NativeErrorConstructor):
-        * kjs/RegExpConstructor.cpp:
-        * kjs/RegExpMatchesArray.h: Added.
-        (JSC::RegExpMatchesArray::getOwnPropertySlot):
-        (JSC::RegExpMatchesArray::put):
-        (JSC::RegExpMatchesArray::deleteProperty):
-        (JSC::RegExpMatchesArray::getPropertyNames):
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::StructureID):
-        (JSC::StructureID::addPropertyTransition):
-        (JSC::StructureID::toDictionaryTransition):
-        (JSC::StructureID::changePrototypeTransition):
-        (JSC::StructureID::getterSetterTransition):
-        * kjs/StructureID.h:
-        (JSC::StructureID::create):
-        (JSC::StructureID::typeInfo):
-        * kjs/TypeInfo.h: Added.
-        (JSC::TypeInfo::TypeInfo):
-        (JSC::TypeInfo::type):
-
-2008-09-21  Darin Adler  <darin@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        - fix crash logging into Gmail due to recent Arguments change
-
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::Arguments): Fix window where mark() function could
-        see d->extraArguments with uninitialized contents.
-        (JSC::Arguments::mark): Check d->extraArguments for 0 to handle two
-        cases: 1) Inside the constructor before it's initialized.
-        2) numArguments <= numParameters.
-
-2008-09-21  Darin Adler  <darin@apple.com>
-
-        - fix loose end from the "duplicate constant values" patch
-
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitLoad): Add a special case for values the
-        hash table can't handle.
-
-2008-09-21  Mark Rowe  <mrowe@apple.com>
-
-        Fix the non-AllInOneFile build.
-
-        * kjs/Arguments.cpp: Add missing #include.
-
-2008-09-21  Darin Adler  <darin@apple.com>
-
-        Reviewed by Cameron Zwarich and Mark Rowe.
-
-        - fix test failure caused by my recent IndexToNameMap patch
-
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::deleteProperty): Added the accidentally-omitted
-        check of the boolean result from toArrayIndex.
-
-2008-09-21  Darin Adler  <darin@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=20975
-          inline immediate-number case of ==
-
-        * VM/CTI.h: Renamed emitJumpSlowCaseIfNotImm to
-        emitJumpSlowCaseIfNotImmNum, since the old name was incorrect.
-
-        * VM/CTI.cpp: Updated for new name.
-        (JSC::CTI::privateCompileMainPass): Added op_eq.
-        (JSC::CTI::privateCompileSlowCases): Added op_eq.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_eq): Removed fast case, since it's now
-        compiled.
-
-2008-09-21  Peter Gal  <galpter@inf.u-szeged.hu>
-
-        Reviewed by Tim Hatcher and Eric Seidel.
-
-        Fix the QT/Linux JavaScriptCore segmentation fault.
-        https://bugs.webkit.org/show_bug.cgi?id=20914
-
-        * wtf/ThreadingQt.cpp:
-        (WTF::initializeThreading): Use currentThread() if
-        platform is not a MAC (like in pre 36541 revisions)
-
-2008-09-21  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        * kjs/debugger.h: Removed some unneeded includes and declarations.
-
-2008-09-21  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=20972
-          speed up Arguments further by eliminating the IndexToNameMap
-
-        No change on SunSpider. 1.29x as fast on V8 Raytrace.
-
-        * kjs/Arguments.cpp: Moved ArgumentsData in here. Eliminated the
-        indexToNameMap and hadDeletes data members. Changed extraArguments into
-        an OwnArrayPtr and added deletedArguments, another OwnArrayPtr.
-        Replaced numExtraArguments with numParameters, since that's what's
-        used more directly in hot code paths.
-        (JSC::Arguments::Arguments): Pass in argument count instead of ArgList.
-        Initialize ArgumentsData the new way.
-        (JSC::Arguments::mark): Updated.
-        (JSC::Arguments::getOwnPropertySlot): Overload for the integer form so
-        we don't have to convert integers to identifiers just to get an argument.
-        Integrated the deleted case with the fast case.
-        (JSC::Arguments::put): Ditto.
-        (JSC::Arguments::deleteProperty): Ditto.
-
-        * kjs/Arguments.h: Minimized includes. Made everything private. Added
-        overloads for the integral property name case. Eliminated mappedIndexSetter.
-        Moved ArgumentsData into the .cpp file.
-
-        * kjs/IndexToNameMap.cpp: Emptied out and prepared for deletion.
-        * kjs/IndexToNameMap.h: Ditto.
-
-        * kjs/JSActivation.cpp:
-        (JSC::JSActivation::createArgumentsObject): Elminated ArgList.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * kjs/AllInOneFile.cpp:
-        Removed IndexToNameMap.
-
-2008-09-21  Darin Adler  <darin@apple.com>
-
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitLoad): One more tweak: Wrote this in a slightly
-        clearer style.
-
-2008-09-21  Judit Jasz  <jasy@inf.u-szeged.hu>
-
-        Reviewed and tweaked by Darin Adler.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=20645
-          Elminate duplicate constant values in CodeBlocks.
-
-        Seems to be a wash on SunSpider.
-
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitLoad): Use m_numberMap and m_stringMap to guarantee
-        we emit the same JSValue* for identical numbers and strings.
-        * VM/CodeGenerator.h: Added overload of emitLoad for const Identifier&.
-        Add NumberMap and IdentifierStringMap types and m_numberMap and m_stringMap.
-        * kjs/nodes.cpp:
-        (JSC::StringNode::emitCode): Call the new emitLoad and let it do the
-        JSString creation.
-
-2008-09-21  Paul Pedriana  <webkit@pedriana.com>
-
-        Reviewed and tweaked by Darin Adler.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=16925
-          Fixed lack of Vector buffer alignment for both GCC and MSVC.
-          Since there's no portable way to do this, for now we don't support
-          other compilers.
-
-        * wtf/Vector.h: Added WTF_ALIGH_ON, WTF_ALIGNED, AlignedBufferChar, and AlignedBuffer.
-        Use AlignedBuffer insteadof an array of char in VectorBuffer.
-
-2008-09-21  Gabor Loki  <loki@inf.u-szeged.hu>
-
-        Reviewed by Darin Adler.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=19408
-          Add lightweight constant folding to the parser for *, /, + (only for numbers), <<, >>, ~ operators.
-
-        1.008x as fast on SunSpider.
-
-        * kjs/grammar.y:
-        (makeNegateNode): Fold if expression is a number > 0.
-        (makeBitwiseNotNode): Fold if expression is a number.
-        (makeMultNode): Fold if expressions are both numbers.
-        (makeDivNode): Fold if expressions are both numbers.
-        (makeAddNode): Fold if expressions are both numbers.
-        (makeLeftShiftNode): Fold if expressions are both numbers.
-        (makeRightShiftNode): Fold if expressions are both numbers.
-
-2008-09-21  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Oliver.
-        
-        - speed up === operator by generating inline machine code for the fast paths
-        https://bugs.webkit.org/show_bug.cgi?id=20820
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitJumpSlowCaseIfNotImmediateNumber):
-        (JSC::CTI::emitJumpSlowCaseIfNotImmediateNumbers):
-        (JSC::CTI::emitJumpSlowCaseIfNotImmediates):
-        (JSC::CTI::emitTagAsBoolImmediate):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/CTI.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_stricteq):
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::sete_r):
-        (JSC::X86Assembler::setz_r):
-        (JSC::X86Assembler::movzbl_rr):
-        (JSC::X86Assembler::emitUnlinkedJnz):
-
-2008-09-21  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej Stachowiak.
-
-        Free memory allocated for extra arguments in the destructor of the
-        Arguments object.
-
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::~Arguments):
-        * kjs/Arguments.h:
-
-2008-09-21  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 20815: 'arguments' object creation is non-optimal
-        <https://bugs.webkit.org/show_bug.cgi?id=20815>
-
-        Fix our inefficient way of creating the arguments object by only
-        creating named properties for each of the arguments after a use of the
-        'delete' statement. This patch also speeds up access to the 'arguments'
-        object slightly, but it still does not use the array fast path for
-        indexed access that exists for many opcodes.
-
-        This is about a 20% improvement on the V8 Raytrace benchmark, and a 1.5%
-        improvement on the Earley-Boyer benchmark, which gives a 4% improvement
-        overall.
-
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::Arguments):
-        (JSC::Arguments::mark):
-        (JSC::Arguments::getOwnPropertySlot):
-        (JSC::Arguments::put):
-        (JSC::Arguments::deleteProperty):
-        * kjs/Arguments.h:
-        (JSC::Arguments::ArgumentsData::ArgumentsData):
-        * kjs/IndexToNameMap.h:
-        (JSC::IndexToNameMap::size):
-        * kjs/JSActivation.cpp:
-        (JSC::JSActivation::createArgumentsObject):
-        * kjs/JSActivation.h:
-        (JSC::JSActivation::uncheckedSymbolTableGet):
-        (JSC::JSActivation::uncheckedSymbolTableGetValue):
-        (JSC::JSActivation::uncheckedSymbolTablePut):
-        * kjs/JSFunction.h:
-        (JSC::JSFunction::numParameters):
-
-2008-09-20  Darin Adler  <darin@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        - fix crash seen on buildbot
-
-        * kjs/JSGlobalObject.cpp:
-        (JSC::JSGlobalObject::mark): Add back mark of arrayPrototype,
-        deleted by accident in my recent check-in.
-
-2008-09-20  Maciej Stachowiak  <mjs@apple.com>
-
-        Not reviewed, build fix.
-        
-        - speculative fix for non-AllInOne builds
-
-        * kjs/operations.h:
-
-2008-09-20  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        - assorted optimizations to === and !== operators
-        (work towards <https://bugs.webkit.org/show_bug.cgi?id=20820>)
-        
-        2.5% speedup on earley-boyer test
-
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_stricteq): Use inline version of
-        strictEqualSlowCase; remove unneeded exception check.
-        (JSC::Machine::cti_op_nstricteq): ditto
-        * kjs/operations.cpp:
-        (JSC::strictEqual): Use strictEqualSlowCaseInline
-        (JSC::strictEqualSlowCase): ditto
-        * kjs/operations.h:
-        (JSC::strictEqualSlowCaseInline): Version of strictEqualSlowCase that can be inlined,
-        since the extra function call indirection is a lose for CTI.
-
-2008-09-20  Darin Adler  <darin@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        - finish https://bugs.webkit.org/show_bug.cgi?id=20858
-          make each distinct C++ class get a distinct JSC::Structure
-
-        This also includes some optimizations that make the change an overall
-        small speedup. Without those it was a bit of a slowdown.
-
-        * API/JSCallbackConstructor.cpp:
-        (JSC::JSCallbackConstructor::JSCallbackConstructor): Take a structure.
-        * API/JSCallbackConstructor.h: Ditto.
-        * API/JSCallbackFunction.cpp:
-        (JSC::JSCallbackFunction::JSCallbackFunction): Pass a structure.
-        * API/JSCallbackObject.h: Take a structure.
-        * API/JSCallbackObjectFunctions.h:
-        (JSC::JSCallbackObject::JSCallbackObject): Ditto.
-
-        * API/JSClassRef.cpp:
-        (OpaqueJSClass::prototype): Pass in a structure. Call setPrototype
-        if there's a custom prototype involved.
-        * API/JSObjectRef.cpp:
-        (JSObjectMake): Ditto.
-        (JSObjectMakeConstructor): Pass in a structure.
-
-        * JavaScriptCore.exp: Updated.
-
-        * VM/Machine.cpp:
-        (JSC::jsLess): Added a special case for when both arguments are strings.
-        This avoids converting both strings to with UString::toDouble.
-        (JSC::jsLessEq): Ditto.
-        (JSC::Machine::privateExecute): Pass in a structure.
-        (JSC::Machine::cti_op_construct_JSConstruct): Ditto.
-        (JSC::Machine::cti_op_new_regexp): Ditto.
-        (JSC::Machine::cti_op_is_string): Ditto.
-        * VM/Machine.h: Made isJSString public so it can be used in the CTI.
-
-        * kjs/Arguments.cpp:
-        (JSC::Arguments::Arguments): Pass in a structure.
-
-        * kjs/JSCell.h: Mark constructor explicit.
-
-        * kjs/JSGlobalObject.cpp:
-        (JSC::markIfNeeded): Added an overload for marking structures.
-        (JSC::JSGlobalObject::reset): Eliminate code to set data members to
-        zero. We now do that in the constructor, and we no longer use this
-        anywhere except in the constructor. Added code to create structures.
-        Pass structures rather than prototypes when creating objects.
-        (JSC::JSGlobalObject::mark): Mark the structures.
-
-        * kjs/JSGlobalObject.h: Removed unneeded class declarations.
-        Added initializers for raw pointers in JSGlobalObjectData so
-        everything starts with a 0. Added structure data and accessor
-        functions.
-
-        * kjs/JSImmediate.cpp:
-        (JSC::JSImmediate::nonInlineNaN): Added.
-        * kjs/JSImmediate.h:
-        (JSC::JSImmediate::toDouble): Rewrote to avoid PIC branches.
-
-        * kjs/JSNumberCell.cpp:
-        (JSC::jsNumberCell): Made non-inline to avoid PIC branches
-        in functions that call this one.
-        (JSC::jsNaN): Ditto.
-        * kjs/JSNumberCell.h: Ditto.
-
-        * kjs/JSObject.h: Removed constructor that takes a prototype.
-        All callers now pass structures.
-
-        * kjs/ArrayConstructor.cpp:
-        (JSC::ArrayConstructor::ArrayConstructor):
-        (JSC::constructArrayWithSizeQuirk):
-        * kjs/ArrayConstructor.h:
-        * kjs/ArrayPrototype.cpp:
-        (JSC::ArrayPrototype::ArrayPrototype):
-        * kjs/ArrayPrototype.h:
-        * kjs/BooleanConstructor.cpp:
-        (JSC::BooleanConstructor::BooleanConstructor):
-        (JSC::constructBoolean):
-        (JSC::constructBooleanFromImmediateBoolean):
-        * kjs/BooleanConstructor.h:
-        * kjs/BooleanObject.cpp:
-        (JSC::BooleanObject::BooleanObject):
-        * kjs/BooleanObject.h:
-        * kjs/BooleanPrototype.cpp:
-        (JSC::BooleanPrototype::BooleanPrototype):
-        * kjs/BooleanPrototype.h:
-        * kjs/DateConstructor.cpp:
-        (JSC::DateConstructor::DateConstructor):
-        (JSC::constructDate):
-        * kjs/DateConstructor.h:
-        * kjs/DateInstance.cpp:
-        (JSC::DateInstance::DateInstance):
-        * kjs/DateInstance.h:
-        * kjs/DatePrototype.cpp:
-        (JSC::DatePrototype::DatePrototype):
-        * kjs/DatePrototype.h:
-        * kjs/ErrorConstructor.cpp:
-        (JSC::ErrorConstructor::ErrorConstructor):
-        (JSC::constructError):
-        * kjs/ErrorConstructor.h:
-        * kjs/ErrorInstance.cpp:
-        (JSC::ErrorInstance::ErrorInstance):
-        * kjs/ErrorInstance.h:
-        * kjs/ErrorPrototype.cpp:
-        (JSC::ErrorPrototype::ErrorPrototype):
-        * kjs/ErrorPrototype.h:
-        * kjs/FunctionConstructor.cpp:
-        (JSC::FunctionConstructor::FunctionConstructor):
-        * kjs/FunctionConstructor.h:
-        * kjs/FunctionPrototype.cpp:
-        (JSC::FunctionPrototype::FunctionPrototype):
-        (JSC::FunctionPrototype::addFunctionProperties):
-        * kjs/FunctionPrototype.h:
-        * kjs/GlobalEvalFunction.cpp:
-        (JSC::GlobalEvalFunction::GlobalEvalFunction):
-        * kjs/GlobalEvalFunction.h:
-        * kjs/InternalFunction.cpp:
-        (JSC::InternalFunction::InternalFunction):
-        * kjs/InternalFunction.h:
-        (JSC::InternalFunction::InternalFunction):
-        * kjs/JSArray.cpp:
-        (JSC::JSArray::JSArray):
-        (JSC::constructEmptyArray):
-        (JSC::constructArray):
-        * kjs/JSArray.h:
-        * kjs/JSFunction.cpp:
-        (JSC::JSFunction::JSFunction):
-        (JSC::JSFunction::construct):
-        * kjs/JSObject.cpp:
-        (JSC::constructEmptyObject):
-        * kjs/JSString.cpp:
-        (JSC::StringObject::create):
-        * kjs/JSWrapperObject.h:
-        * kjs/MathObject.cpp:
-        (JSC::MathObject::MathObject):
-        * kjs/MathObject.h:
-        * kjs/NativeErrorConstructor.cpp:
-        (JSC::NativeErrorConstructor::NativeErrorConstructor):
-        (JSC::NativeErrorConstructor::construct):
-        * kjs/NativeErrorConstructor.h:
-        * kjs/NativeErrorPrototype.cpp:
-        (JSC::NativeErrorPrototype::NativeErrorPrototype):
-        * kjs/NativeErrorPrototype.h:
-        * kjs/NumberConstructor.cpp:
-        (JSC::NumberConstructor::NumberConstructor):
-        (JSC::constructWithNumberConstructor):
-        * kjs/NumberConstructor.h:
-        * kjs/NumberObject.cpp:
-        (JSC::NumberObject::NumberObject):
-        (JSC::constructNumber):
-        (JSC::constructNumberFromImmediateNumber):
-        * kjs/NumberObject.h:
-        * kjs/NumberPrototype.cpp:
-        (JSC::NumberPrototype::NumberPrototype):
-        * kjs/NumberPrototype.h:
-        * kjs/ObjectConstructor.cpp:
-        (JSC::ObjectConstructor::ObjectConstructor):
-        (JSC::constructObject):
-        * kjs/ObjectConstructor.h:
-        * kjs/ObjectPrototype.cpp:
-        (JSC::ObjectPrototype::ObjectPrototype):
-        * kjs/ObjectPrototype.h:
-        * kjs/PrototypeFunction.cpp:
-        (JSC::PrototypeFunction::PrototypeFunction):
-        * kjs/PrototypeFunction.h:
-        * kjs/RegExpConstructor.cpp:
-        (JSC::RegExpConstructor::RegExpConstructor):
-        (JSC::RegExpMatchesArray::RegExpMatchesArray):
-        (JSC::constructRegExp):
-        * kjs/RegExpConstructor.h:
-        * kjs/RegExpObject.cpp:
-        (JSC::RegExpObject::RegExpObject):
-        * kjs/RegExpObject.h:
-        * kjs/RegExpPrototype.cpp:
-        (JSC::RegExpPrototype::RegExpPrototype):
-        * kjs/RegExpPrototype.h:
-        * kjs/Shell.cpp:
-        (GlobalObject::GlobalObject):
-        * kjs/StringConstructor.cpp:
-        (JSC::StringConstructor::StringConstructor):
-        (JSC::constructWithStringConstructor):
-        * kjs/StringConstructor.h:
-        * kjs/StringObject.cpp:
-        (JSC::StringObject::StringObject):
-        * kjs/StringObject.h:
-        * kjs/StringObjectThatMasqueradesAsUndefined.h:
-        (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
-        * kjs/StringPrototype.cpp:
-        (JSC::StringPrototype::StringPrototype):
-        * kjs/StringPrototype.h:
-        Take and pass structures.
-
-2008-09-19  Alp Toker  <alp@nuanti.com>
-
-        Build fix for the 'gold' linker and recent binutils. New behaviour
-        requires that we link to used libraries explicitly.
-
-        * GNUmakefile.am:
-
-2008-09-19  Sam Weinig  <sam@webkit.org>
-
-        Roll r36694 back in.  It did not cause the crash.
-
-        * JavaScriptCore.exp:
-        * VM/JSPropertyNameIterator.cpp:
-        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
-        (JSC::JSPropertyNameIterator::invalidate):
-        * VM/JSPropertyNameIterator.h:
-        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
-        (JSC::JSPropertyNameIterator::create):
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::getPropertyNames):
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMap::getEnumerablePropertyNames):
-        * kjs/PropertyMap.h:
-        * kjs/PropertyNameArray.cpp:
-        (JSC::PropertyNameArray::add):
-        * kjs/PropertyNameArray.h:
-        (JSC::PropertyNameArrayData::create):
-        (JSC::PropertyNameArrayData::propertyNameVector):
-        (JSC::PropertyNameArrayData::setCachedPrototypeChain):
-        (JSC::PropertyNameArrayData::cachedPrototypeChain):
-        (JSC::PropertyNameArrayData::begin):
-        (JSC::PropertyNameArrayData::end):
-        (JSC::PropertyNameArrayData::PropertyNameArrayData):
-        (JSC::PropertyNameArray::PropertyNameArray):
-        (JSC::PropertyNameArray::addKnownUnique):
-        (JSC::PropertyNameArray::size):
-        (JSC::PropertyNameArray::operator[]):
-        (JSC::PropertyNameArray::begin):
-        (JSC::PropertyNameArray::end):
-        (JSC::PropertyNameArray::setData):
-        (JSC::PropertyNameArray::data):
-        (JSC::PropertyNameArray::releaseData):
-        * kjs/StructureID.cpp:
-        (JSC::structureIDChainsAreEqual):
-        (JSC::StructureID::getEnumerablePropertyNames):
-        (JSC::StructureID::clearEnumerationCache):
-        (JSC::StructureID::createCachedPrototypeChain):
-        * kjs/StructureID.h:
-
-2008-09-19  Sam Weinig  <sam@webkit.org>
-
-        Roll out r36694.
-
-        * JavaScriptCore.exp:
-        * VM/JSPropertyNameIterator.cpp:
-        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
-        (JSC::JSPropertyNameIterator::invalidate):
-        * VM/JSPropertyNameIterator.h:
-        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
-        (JSC::JSPropertyNameIterator::create):
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::getPropertyNames):
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMap::getEnumerablePropertyNames):
-        * kjs/PropertyMap.h:
-        * kjs/PropertyNameArray.cpp:
-        (JSC::PropertyNameArray::add):
-        * kjs/PropertyNameArray.h:
-        (JSC::PropertyNameArray::PropertyNameArray):
-        (JSC::PropertyNameArray::addKnownUnique):
-        (JSC::PropertyNameArray::begin):
-        (JSC::PropertyNameArray::end):
-        (JSC::PropertyNameArray::size):
-        (JSC::PropertyNameArray::operator[]):
-        (JSC::PropertyNameArray::releaseIdentifiers):
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::getEnumerablePropertyNames):
-        * kjs/StructureID.h:
-        (JSC::StructureID::clearEnumerationCache):
-
-2008-09-19  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Improve peformance of local variable initialisation.
-
-        Pull local and constant initialisation out of slideRegisterWindowForCall
-        and into its own opcode.  This allows the JIT to generate the initialisation
-        code for a function directly into the instruction stream and so avoids a few
-        branches on function entry.
-
-        Results a 1% progression in SunSpider, particularly in a number of the bitop
-        tests where the called functions are very fast. 
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitInitialiseRegister):
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::CodeGenerator):
-        * VM/Machine.cpp:
-        (JSC::slideRegisterWindowForCall):
-        (JSC::Machine::privateExecute):
-        * VM/Opcode.h:
-
-2008-09-19  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Patch for https://bugs.webkit.org/show_bug.cgi?id=20928
-        Speed up JS property enumeration by caching entire PropertyNameArray
-
-        1.3% speedup on Sunspider, 30% on string-fasta.
-
-        * JavaScriptCore.exp:
-        * VM/JSPropertyNameIterator.cpp:
-        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
-        (JSC::JSPropertyNameIterator::invalidate):
-        * VM/JSPropertyNameIterator.h:
-        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
-        (JSC::JSPropertyNameIterator::create):
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::getPropertyNames):
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMap::getEnumerablePropertyNames):
-        * kjs/PropertyMap.h:
-        * kjs/PropertyNameArray.cpp:
-        (JSC::PropertyNameArray::add):
-        * kjs/PropertyNameArray.h:
-        (JSC::PropertyNameArrayData::create):
-        (JSC::PropertyNameArrayData::propertyNameVector):
-        (JSC::PropertyNameArrayData::setCachedPrototypeChain):
-        (JSC::PropertyNameArrayData::cachedPrototypeChain):
-        (JSC::PropertyNameArrayData::begin):
-        (JSC::PropertyNameArrayData::end):
-        (JSC::PropertyNameArrayData::PropertyNameArrayData):
-        (JSC::PropertyNameArray::PropertyNameArray):
-        (JSC::PropertyNameArray::addKnownUnique):
-        (JSC::PropertyNameArray::size):
-        (JSC::PropertyNameArray::operator[]):
-        (JSC::PropertyNameArray::begin):
-        (JSC::PropertyNameArray::end):
-        (JSC::PropertyNameArray::setData):
-        (JSC::PropertyNameArray::data):
-        (JSC::PropertyNameArray::releaseData):
-        * kjs/ScopeChain.cpp:
-        (JSC::ScopeChainNode::print):
-        * kjs/StructureID.cpp:
-        (JSC::structureIDChainsAreEqual):
-        (JSC::StructureID::getEnumerablePropertyNames):
-        (JSC::StructureID::clearEnumerationCache):
-        (JSC::StructureID::createCachedPrototypeChain):
-        * kjs/StructureID.h:
-
-2008-09-19  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Fix a mismatched new[]/delete in JSObject::allocatePropertyStorage
-
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::allocatePropertyStorage): Spotted by valgrind.
-
-2008-09-19  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - part 2 of https://bugs.webkit.org/show_bug.cgi?id=20858
-          make each distinct C++ class get a distinct JSC::Structure
-
-        * JavaScriptCore.exp: Exported constructEmptyObject for use in WebCore.
-
-        * kjs/JSGlobalObject.h: Changed the protected constructor to take a
-        structure instead of a prototype.
-
-        * kjs/JSVariableObject.h: Removed constructor that takes a prototype.
-
-2008-09-19  Julien Chaffraix  <jchaffraix@pleyo.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Use the template hoisting technique on the RefCounted class. This reduces the code bloat due to
-        non-template methods' code been copied for each instance of the template.
-        The patch splits RefCounted between a base class that holds non-template methods and attributes
-        and the template RefCounted class that keeps the same functionnality.
-
-        On my Linux with gcc 4.3 for the Gtk port, this is:
-        - a ~600KB save on libwebkit.so in release.
-        - a ~1.6MB save on libwebkit.so in debug.
-
-        It is a wash on Sunspider and a small win on Dromaeo (not sure it is relevant).
-        On the whole, it should be a small win as we reduce the compiled code size and the only
-        new function call should be inlined by the compiler.
-
-        * wtf/RefCounted.h:
-        (WTF::RefCountedBase::ref): Copied from RefCounted.
-        (WTF::RefCountedBase::hasOneRef): Ditto.
-        (WTF::RefCountedBase::refCount): Ditto.
-        (WTF::RefCountedBase::RefCountedBase): Ditto.
-        (WTF::RefCountedBase::~RefCountedBase): Ditto.
-        (WTF::RefCountedBase::derefBase): Tweaked from the RefCounted version to remove
-        template section.
-        (WTF::RefCounted::RefCounted):
-        (WTF::RefCounted::deref): Small wrapper around RefCountedBase::derefBase().
-        (WTF::RefCounted::~RefCounted): Keep private destructor.
-
-2008-09-18  Darin Adler  <darin@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        - part 1 of https://bugs.webkit.org/show_bug.cgi?id=20858
-          make each distinct C++ class get a distinct JSC::Structure
-
-        * kjs/lookup.h: Removed things here that were used only in WebCore:
-        cacheGlobalObject, JSC_DEFINE_PROTOTYPE, JSC_DEFINE_PROTOTYPE_WITH_PROTOTYPE,
-        and JSC_IMPLEMENT_PROTOTYPE.
-
-2008-09-18  Darin Adler  <darin@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=20927
-          simplify/streamline the code to turn strings into identifiers while parsing
-
-        * kjs/grammar.y: Get rid of string from the union, and use ident for STRING as
-        well as for IDENT.
-
-        * kjs/lexer.cpp:
-        (JSC::Lexer::lex): Use makeIdentifier instead of makeUString for String.
-        * kjs/lexer.h: Remove makeUString.
-
-        * kjs/nodes.h: Changed StringNode to hold an Identifier instead of UString.
-
-        * VM/CodeGenerator.cpp:
-        (JSC::keyForCharacterSwitch): Updated since StringNode now holds an Identifier.
-        (JSC::prepareJumpTableForStringSwitch): Ditto.
-        * kjs/nodes.cpp:
-        (JSC::StringNode::emitCode): Ditto. The comment from here is now in the lexer.
-        (JSC::processClauseList): Ditto.
-        * kjs/nodes2string.cpp:
-        (JSC::StringNode::streamTo): Ditto.
-
-2008-09-18  Sam Weinig  <sam@webkit.org>
-
-        Fix style.
-
-        * VM/Instruction.h:
-        (JSC::Instruction::Instruction):
-
-2008-09-18  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 20911: REGRESSION(r36480?): Reproducible assertion failure below derefStructureIDs 64-bit JavaScriptCore
-        <https://bugs.webkit.org/show_bug.cgi?id=20911>
-
-        The problem was simply caused by the int constructor for Instruction
-        failing to initialise the full struct in 64bit builds.
-
-        * VM/Instruction.h:
-        (JSC::Instruction::Instruction):
-
-2008-09-18  Darin Adler  <darin@apple.com>
-
-        - fix release build
-
-        * wtf/RefCountedLeakCounter.cpp: Removed stray "static".
-
-2008-09-18  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        * kjs/JSGlobalObject.h: Tiny style guideline tweak.
-
-2008-09-18  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=20925
-          LEAK messages appear every time I quit
-
-        * JavaScriptCore.exp: Updated, and also added an export
-        needed for future WebCore use of JSC::StructureID.
-
-        * wtf/RefCountedLeakCounter.cpp:
-        (WTF::RefCountedLeakCounter::suppressMessages): Added.
-        (WTF::RefCountedLeakCounter::cancelMessageSuppression): Added.
-        (WTF::RefCountedLeakCounter::RefCountedLeakCounter): Tweaked a bit.
-        (WTF::RefCountedLeakCounter::~RefCountedLeakCounter): Added code to
-        log the reason there was no leak checking done.
-        (WTF::RefCountedLeakCounter::increment): Tweaked a bit.
-        (WTF::RefCountedLeakCounter::decrement): Ditto.
-
-        * wtf/RefCountedLeakCounter.h: Replaced setLogLeakMessages with two
-        new functions, suppressMessages and cancelMessageSuppression. Also
-        added m_ prefixes to the data member names.
-
-2008-09-18  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Mark Rowe.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20437
-
-        Add a proper #define to define which XML Parser implementation to use. Client
-        code can use #if USE(QXMLSTREAM) to decide if the Qt XML StreamReader
-        implementation is going to be used.
-
-        * wtf/Platform.h:
-
-2008-09-18  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej Stachowiak.
-
-        Make a Unicode non-breaking space count as a whitespace character in
-        PCRE. This change was already made in WREC, and it fixes one of the
-        Mozilla JS tests. Since it is now fixed in PCRE as well, we can check
-        in a new set of expected test results.
-
-        * pcre/pcre_internal.h:
-        (isSpaceChar):
-        * tests/mozilla/expected.html:
-
-2008-09-18  Stephanie Lewis  <slewis@apple.com>
-
-        Reviewed by Mark Rowe and Maciej Stachowiak.
-
-        add an option use arch to specify which architecture to run.
-
-        * tests/mozilla/jsDriver.pl:
-
-2008-09-17  Oliver Hunt  <oliver@apple.com>
-
-        Correctly restore argument reference prior to SFX runtime calls.
-        
-        Reviewed by Steve Falkenburg.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-
-2008-09-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 20876: REGRESSION (r36417, r36427): fast/js/exception-expression-offset.html fails
-        <https://bugs.webkit.org/show_bug.cgi?id=20876>
-
-        r36417 and r36427 caused an get_by_id opcode to be emitted before the
-        instanceof and construct opcodes, in order to enable inline caching of
-        the prototype property. Unfortunately, this regressed some tests dealing
-        with exceptions thrown by 'instanceof' and the 'new' operator. We fix
-        these problems by detecting whether an "is not an object" exception is
-        thrown before op_instanceof or op_construct, and emit the proper
-        exception in those cases.
-
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitConstruct):
-        * VM/CodeGenerator.h:
-        * VM/ExceptionHelpers.cpp:
-        (JSC::createInvalidParamError):
-        (JSC::createNotAConstructorError):
-        (JSC::createNotAnObjectError):
-        * VM/ExceptionHelpers.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::getOpcode):
-        (JSC::Machine::privateExecute):
-        * VM/Machine.h:
-        * kjs/nodes.cpp:
-        (JSC::NewExprNode::emitCode):
-        (JSC::InstanceOfNode::emitCode):
-
-2008-09-17  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        JIT generation cti_op_construct_verify.
-        
-        Quarter to half percent progression on v8-tests.
-        Roughly not change on SunSpider (possible minor progression).
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        * VM/Machine.cpp:
-        * VM/Machine.h:
-
-2008-09-15  Steve Falkenburg  <sfalken@apple.com>
-
-        Improve timer accuracy for JavaScript Date object on Windows.
-        
-        Use a combination of ftime and QueryPerformanceCounter.
-        ftime returns the information we want, but doesn't have sufficient resolution.
-        QueryPerformanceCounter has high resolution, but is only usable to measure time intervals.
-        To combine them, we call ftime and QueryPerformanceCounter initially. Later calls will use
-        QueryPerformanceCounter by itself, adding the delta to the saved ftime.  We re-sync to
-        correct for drift if the low-res and high-res elapsed time between calls differs by more
-        than twice the low-resolution timer resolution.
-        
-        QueryPerformanceCounter may be inaccurate due to a problems with:
-        - some PCI bridge chipsets (http://support.microsoft.com/kb/274323)
-        - BIOS bugs (http://support.microsoft.com/kb/895980/)
-        - BIOS/HAL bugs on multiprocessor/multicore systems (http://msdn.microsoft.com/en-us/library/ms644904.aspx)
-        
-        Reviewed by Darin Adler.
-
-        * kjs/DateMath.cpp:
-        (JSC::highResUpTime):
-        (JSC::lowResUTCTime):
-        (JSC::qpcAvailable):
-        (JSC::getCurrentUTCTimeWithMicroseconds):
-
-2008-09-17  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Implement JIT generation of CallFrame initialization, for op_call.
-
-        1% sunspider 2.5% v8-tests.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::compileOpCall):
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_op_call_NotJSFunction):
-
-2008-09-17  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Optimizations for op_call in CTI.  Move check for (ctiCode == 0) into JIT code,
-        move copying of scopeChain for CodeBlocks that needFullScopeChain into head of
-        functions, instead of checking prior to making the call.
-
-        3% on v8-tests (4% on richards, 6% in delta-blue)
-
-        * VM/CTI.cpp:
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        * VM/Machine.cpp:
-        (JSC::Machine::execute):
-        (JSC::Machine::cti_op_call_JSFunction):
-        (JSC::Machine::cti_vm_compile):
-        (JSC::Machine::cti_vm_updateScopeChain):
-        (JSC::Machine::cti_op_construct_JSConstruct):
-        * VM/Machine.h:
-
-2008-09-17  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Fix the QtWebKit/Mac build
-
-        * wtf/ThreadingQt.cpp:
-        (WTF::initializeThreading): use QCoreApplication to get the main thread
-
-2008-09-16  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 20857: REGRESSION (r36427): ASSERTION FAILED: m_refCount >= 0 in RegisterID::deref()
-        <https://bugs.webkit.org/show_bug.cgi?id=20857>
-
-        Fix a problem stemming from the slightly unsafe behaviour of the
-        CodeGenerator::finalDestination() method by putting the "func" argument
-        of the emitConstruct() method in a RefPtr in its caller. Also, add an
-        assertion guaranteeing that this is always the case.
-
-        CodeGenerator::finalDestination() is still incorrect and can cause
-        problems with a different allocator; see bug 20340 for more details.
-
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitConstruct):
-        * kjs/nodes.cpp:
-        (JSC::NewExprNode::emitCode):
-
-2008-09-16  Alice Liu  <alice.liu@apple.com>
-
-        build fix.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-
-2008-09-16  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        CTI code generation for op_ret.  The majority of the work
-        (updating variables on the stack & on exec) can be performed
-        directly in generated code.
-
-        We still need to check, & to call out to C-code to handle
-        activation records, profiling, and full scope chains.
-
-        +1.5% Sunspider, +5/6% v8 tests.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitPutCTIParam):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CTI.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_ret_activation):
-        (JSC::Machine::cti_op_ret_profiler):
-        (JSC::Machine::cti_op_ret_scopeChain):
-        * VM/Machine.h:
-
-2008-09-16  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Fix the Windows build.
-
-        Add some extra parentheses to stop MSVC from complaining so much.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_stricteq):
-        (JSC::Machine::cti_op_nstricteq):
-        * kjs/operations.cpp:
-        (JSC::strictEqual):
-
-2008-09-15  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Cameron Zwarich.
-        
-        - speed up the === and !== operators by choosing the fast cases better
-        
-        No effect on SunSpider but speeds up the V8 EarlyBoyer benchmark about 4%.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_stricteq):
-        (JSC::Machine::cti_op_nstricteq):
-        * kjs/JSImmediate.h:
-        (JSC::JSImmediate::areBothImmediate):
-        * kjs/operations.cpp:
-        (JSC::strictEqual):
-        (JSC::strictEqualSlowCase):
-        * kjs/operations.h:
-
-2008-09-15  Oliver Hunt  <oliver@apple.com>
-
-        RS=Sam Weinig.
-
-        Coding style cleanup.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-
-2008-09-15  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Bug 20874: op_resolve does not do any form of caching
-        <https://bugs.webkit.org/show_bug.cgi?id=20874>
-
-        This patch adds an op_resolve_global opcode to handle (and cache)
-        property lookup we can statically determine must occur on the global
-        object (if at all).
-
-        3% progression on sunspider, 3.2x improvement to bitops-bitwise-and, and
-        10% in math-partial-sums
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::findScopedProperty):
-        (JSC::CodeGenerator::emitResolve):
-        * VM/Machine.cpp:
-        (JSC::resolveGlobal):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_resolve_global):
-        * VM/Machine.h:
-        * VM/Opcode.h:
-
-2008-09-15  Sam Weinig  <sam@webkit.org>
-
-        Roll out r36462.  It broke document.all.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/CTI.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::Machine):
-        (JSC::Machine::cti_op_eq_null):
-        (JSC::Machine::cti_op_neq_null):
-        * VM/Machine.h:
-        (JSC::Machine::isJSString):
-        * kjs/JSCell.h:
-        * kjs/JSWrapperObject.h:
-        * kjs/StringObject.h:
-        * kjs/StringObjectThatMasqueradesAsUndefined.h:
-
-2008-09-15  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 20863: ASSERTION FAILED: addressOffset < instructions.size() in CodeBlock::getHandlerForVPC
-        <https://bugs.webkit.org/show_bug.cgi?id=20863>
-
-        r36427 changed the number of arguments to op_construct without changing
-        the argument index for the vPC in the call to initializeCallFrame() in
-        the CTI case. This caused a JSC test failure. Correcting the argument
-        index fixes the test failure.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_construct_JSConstruct):
-
-2008-09-15  Mark Rowe  <mrowe@apple.com>
-
-        Fix GCC 4.2 build.
-
-        * VM/CTI.h:
-
-2008-09-15  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-        
-        Fixed a typo in op_get_by_id_chain that caused it to miss every time
-        in the interpreter.
-        
-        Also, a little cleanup.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute): Set up baseObject before entering the
-        loop, so we compare against the right values.
-
-2008-09-15  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Removed the CalledAsConstructor flag from the call frame header. Now,
-        we use an explicit opcode at the call site to fix up constructor results.
-
-        SunSpider says 0.4% faster.
-        
-        cti_op_construct_verify is an out-of-line function call for now, but we
-        can fix that once StructureID holds type information like isObject.
 
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass): Codegen for the new opcode.
+2009-06-17  George Staikos  <george.staikos@torchmobile.com>
 
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
+        Reviewed by Adam Treat.
 
-        * VM/CodeGenerator.cpp: Codegen for the new opcode. Also...
-        (JSC::CodeGenerator::emitCall): ... don't test for known non-zero value.
-        (JSC::CodeGenerator::emitConstruct): ... ditto.
-
-        * VM/Machine.cpp: No more CalledAsConstructor
-        (JSC::Machine::privateExecute): Implementation for the new opcode.
-        (JSC::Machine::cti_op_ret): The speedup: no need to check whether we were
-        called as a constructor.
-        (JSC::Machine::cti_op_construct_verify): Implementation for the new opcode.
-        * VM/Machine.h:
-
-        * VM/Opcode.h: Declare new opcode.
-
-        * VM/RegisterFile.h:
-        (JSC::RegisterFile::): No more CalledAsConstructor
-
-2008-09-15  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Inline code generation of eq_null/neq_null for CTI.  Uses vptr checking for
-        StringObjectsThatAreMasqueradingAsBeingUndefined.  In the long run, the
-        masquerading may be handled differently (through the StructureIDs - see bug
-        #20823).
-
-        >1% on v8-tests.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitJumpSlowCaseIfIsJSCell):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/CTI.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::Machine):
-        (JSC::Machine::cti_op_eq_null):
-        (JSC::Machine::cti_op_neq_null):
-        * VM/Machine.h:
-        (JSC::Machine::doesMasqueradesAsUndefined):
-        * kjs/JSWrapperObject.h:
-        (JSC::JSWrapperObject::):
-        (JSC::JSWrapperObject::JSWrapperObject):
-        * kjs/StringObject.h:
-        (JSC::StringObject::StringObject):
-        * kjs/StringObjectThatMasqueradesAsUndefined.h:
-        (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
-
-2008-09-15  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Rubber-stamped by Oliver Hunt.
-
-        r36427 broke CodeBlock::dump() by changing the number of arguments to
-        op_construct without changing the code that prints it. This patch fixes
-        it by printing the additional argument.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-
-2008-09-15  Adam Roben  <aroben@apple.com>
-
-        Build fix
-
-        * kjs/StructureID.cpp: Removed a stray semicolon.
-
-2008-09-15  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej Stachowiak.
-
-        Fix a crash in fast/js/exception-expression-offset.html caused by not
-        updating all mentions of the length of op_construct in r36427.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_construct_NotJSConstruct):
-
-2008-09-15  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Cameron Zwarich.
-        
-        - fix layout test failure introduced by fix for 20849
-        
-        (The failing test was fast/js/delete-then-put.html)
-
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::removeDirect): Clear enumeration cache
-        in the dictionary case.
-        * kjs/JSObject.h:
-        (JSC::JSObject::putDirect): Ditto.
-        * kjs/StructureID.h:
-        (JSC::StructureID::clearEnumerationCache): Inline to handle the
-        clear.
-
-2008-09-15  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Cameron Zwarich.
-        
-        - fix JSC test failures introduced by fix for 20849
-
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMap::getEnumerablePropertyNames): Use the correct count.
-
-2008-09-15  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 20851: REGRESSION (r36410): fast/js/kde/GlobalObject.html fails
-        <https://bugs.webkit.org/show_bug.cgi?id=20851>
-
-        r36410 introduced an optimization for parseInt() that is incorrect when
-        its argument is larger than the range of a 32-bit integer. If the
-        argument is a number that is not an immediate integer, then the correct
-        behaviour is to return the floor of its value, unless it is an infinite
-        value, in which case the correct behaviour is to return 0.
-
-        * kjs/JSGlobalObjectFunctions.cpp:
-        (JSC::globalFuncParseInt):
-
-2008-09-15  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Patch for https://bugs.webkit.org/show_bug.cgi?id=20849
-        Cache property names for getEnumerablePropertyNames in the StructureID.
-
-        ~0.5% speedup on Sunspider overall (9.7% speedup on string-fasta).  ~1% speedup
-        on the v8 test suite.
-
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::getPropertyNames):
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMap::getEnumerablePropertyNames):
-        * kjs/PropertyMap.h:
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::StructureID):
-        (JSC::StructureID::getEnumerablePropertyNames):
-        * kjs/StructureID.h:
-
-2008-09-14  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Cameron Zwarich.
-        
-        - speed up JS construction by extracting "prototype" lookup so PIC applies.
-        
-        ~0.5% speedup on SunSpider
-        Speeds up some of the V8 tests as well, most notably earley-boyer.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::compileOpCall): Account for extra arg for prototype.
-        (JSC::CTI::privateCompileMainPass): Account for increased size of op_construct.
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitConstruct): Emit separate lookup to get prototype property.
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute): Expect prototype arg in op_construct.
-        (JSC::Machine::cti_op_construct_JSConstruct): ditto
-        (JSC::Machine::cti_op_construct_NotJSConstruct): ditto
-
-2008-09-10  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Add a protected destructor for RefCounted.
-
-        It is wrong to call its destructor directly, because (1) this should be taken care of by
-        deref(), and (2) many classes that use RefCounted have non-virtual destructors.
-
-        No change in behavior.
-
-        * wtf/RefCounted.h: (WTF::RefCounted::~RefCounted):
-
-2008-09-14  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Accelerated property accesses.
-
-        Inline more of the array access code into the JIT code for get/put_by_val.
-        Accelerate get/put_by_id by speculatively inlining a disable direct access
-        into the hot path of the code, and repatch this with the correct StructureID
-        and property map offset once these are known.  In the case of accesses to the
-        prototype and reading the array-length a trampoline is genertaed, and the
-        branch to the slow-case is relinked to jump to this.
-
-        By repatching, we mean rewriting the x86 instruction stream.  Instructions are
-        only modified in a simple fasion - altering immediate operands, memory access
-        deisplacements, and branch offsets.
-        
-        For regular get_by_id/put_by_id accesses to an object, a StructureID in an
-        instruction's immediate operant is updateded, and a memory access operation's
-        displacement is updated to access the correct field on the object.  In the case
-        of more complex accesses (array length and get_by_id_prototype) the offset on
-        the branch to slow-case is updated, to now jump to a trampoline.
-
-        +2.8% sunspider, +13% v8-tests
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitCall):
-        (JSC::CTI::emitJumpSlowCaseIfNotJSCell):
-        (JSC::CTI::CTI):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        (JSC::CTI::privateCompileGetByIdSelf):
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        (JSC::CTI::privateCompilePutByIdReplace):
-        (JSC::CTI::privateCompilePutByIdTransition):
-        (JSC::CTI::privateCompileArrayLengthTrampoline):
-        (JSC::CTI::privateCompileStringLengthTrampoline):
-        (JSC::CTI::patchGetByIdSelf):
-        (JSC::CTI::patchPutByIdReplace):
-        (JSC::CTI::privateCompilePatchGetArrayLength):
-        (JSC::CTI::privateCompilePatchGetStringLength):
-        * VM/CTI.h:
-        (JSC::CTI::compileGetByIdSelf):
-        (JSC::CTI::compileGetByIdProto):
-        (JSC::CTI::compileGetByIdChain):
-        (JSC::CTI::compilePutByIdReplace):
-        (JSC::CTI::compilePutByIdTransition):
-        (JSC::CTI::compileArrayLengthTrampoline):
-        (JSC::CTI::compileStringLengthTrampoline):
-        (JSC::CTI::compilePatchGetArrayLength):
-        (JSC::CTI::compilePatchGetStringLength):
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::~CodeBlock):
-        * VM/CodeBlock.h:
-        (JSC::StructureStubInfo::StructureStubInfo):
-        (JSC::CodeBlock::getStubInfo):
-        * VM/Machine.cpp:
-        (JSC::Machine::tryCTICachePutByID):
-        (JSC::Machine::tryCTICacheGetByID):
-        (JSC::Machine::cti_op_put_by_val_array):
-        * VM/Machine.h:
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::cmpl_i8m):
-        (JSC::X86Assembler::emitUnlinkedJa):
-        (JSC::X86Assembler::getRelocatedAddress):
-        (JSC::X86Assembler::getDifferenceBetweenLabels):
-        (JSC::X86Assembler::emitModRm_opmsib):
-
-2008-09-14  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Cameron Zwarich.
-        
-        - split the "prototype" lookup for hasInstance into opcode stream so it can be cached
-        
-        ~5% speedup on v8 earley-boyer test
-
-        * API/JSCallbackObject.h: Add a parameter for the pre-looked-up prototype.
-        * API/JSCallbackObjectFunctions.h:
-        (JSC::::hasInstance): Ditto.
-        * API/JSValueRef.cpp:
-        (JSValueIsInstanceOfConstructor): Look up and pass in prototype.
-        * JavaScriptCore.exp:
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass): Pass along prototype.
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump): Print third arg.
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitInstanceOf): Implement this, now that there
-        is a third argument.
-        * VM/CodeGenerator.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute): Pass along the prototype.
-        (JSC::Machine::cti_op_instanceof): ditto
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::hasInstance): Expect to get a pre-looked-up prototype.
-        * kjs/JSObject.h:
-        * kjs/nodes.cpp:
-        (JSC::InstanceOfNode::emitCode): Emit a get_by_id of the prototype
-        property and pass that register to instanceof.
-        * kjs/nodes.h:
-
-2008-09-14  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Remove unnecessary virtual function call from cti_op_call_JSFunction -
-        ~5% on richards, ~2.5% on v8-tests, ~0.5% on sunspider.
-
-        * VM/Machine.cpp:
-        (JSC::Machine::cti_op_call_JSFunction):
-
-2008-09-14  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 20827: the 'typeof' operator is slow
-        <https://bugs.webkit.org/show_bug.cgi?id=20827>
-
-        Optimize the 'typeof' operator when its result is compared to a constant
-        string.
-
-        This is a 5.5% speedup on the V8 Earley-Boyer test.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitEqualityOp):
-        * VM/CodeGenerator.h:
-        * VM/Machine.cpp:
-        (JSC::jsIsObjectType):
-        (JSC::jsIsFunctionType):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_is_undefined):
-        (JSC::Machine::cti_op_is_boolean):
-        (JSC::Machine::cti_op_is_number):
-        (JSC::Machine::cti_op_is_string):
-        (JSC::Machine::cti_op_is_object):
-        (JSC::Machine::cti_op_is_function):
-        * VM/Machine.h:
-        * VM/Opcode.h:
-        * kjs/nodes.cpp:
-        (JSC::BinaryOpNode::emitCode):
-        (JSC::EqualNode::emitCode):
-        (JSC::StrictEqualNode::emitCode):
-        * kjs/nodes.h:
-
-2008-09-14  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Cameron Zwarich.
-
-        Patch for https://bugs.webkit.org/show_bug.cgi?id=20844
-        Speed up parseInt for numbers
-
-        Sunspider reports this as 1.029x as fast overall and 1.37x as fast on string-unpack-code.
-        No change on the v8 suite.
-
-        * kjs/JSGlobalObjectFunctions.cpp:
-        (JSC::globalFuncParseInt): Don't convert numbers to strings just to
-        convert them back to numbers.
-
-2008-09-14  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 20816: op_lesseq should be optimized
-        <https://bugs.webkit.org/show_bug.cgi?id=20816>
-
-        Add a loop_if_lesseq opcode that is similar to the loop_if_less opcode.
-
-        This is a 9.4% speedup on the V8 Crypto benchmark.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitJumpIfTrue):
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_loop_if_lesseq):
-        * VM/Machine.h:
-        * VM/Opcode.h:
-
-2008-09-14  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Cameron Zwarich.
-
-        Cleanup Sampling code.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitCall):
-        (JSC::CTI::privateCompileMainPass):
-        * VM/CTI.h:
-        (JSC::CTI::execute):
-        * VM/SamplingTool.cpp:
-        (JSC::):
-        (JSC::SamplingTool::run):
-        (JSC::SamplingTool::dump):
-        * VM/SamplingTool.h:
-        (JSC::SamplingTool::callingHostFunction):
-
-2008-09-13  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Bug 20821: Cache property transitions to speed up object initialization
-        https://bugs.webkit.org/show_bug.cgi?id=20821
-
-        Implement a transition cache to improve the performance of new properties
-        being added to objects.  This is extremely beneficial in constructors and
-        shows up as a 34% improvement on access-binary-trees in SunSpider (0.8%
-        overall)
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::):
-        (JSC::transitionWillNeedStorageRealloc):
-        (JSC::CTI::privateCompilePutByIdTransition):
-        * VM/CTI.h:
-        (JSC::CTI::compilePutByIdTransition):
-        * VM/CodeBlock.cpp:
-        (JSC::printPutByIdOp):
-        (JSC::CodeBlock::printStructureIDs):
-        (JSC::CodeBlock::dump):
-        (JSC::CodeBlock::derefStructureIDs):
-        (JSC::CodeBlock::refStructureIDs):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::emitPutById):
-        * VM/Machine.cpp:
-        (JSC::cachePrototypeChain):
-        (JSC::Machine::tryCachePutByID):
-        (JSC::Machine::tryCacheGetByID):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::tryCTICachePutByID):
-        (JSC::Machine::tryCTICacheGetByID):
-        * VM/Machine.h:
-        * VM/Opcode.h:
-        * kjs/JSObject.h:
-        (JSC::JSObject::putDirect):
-        (JSC::JSObject::transitionTo):
-        * kjs/PutPropertySlot.h:
-        (JSC::PutPropertySlot::PutPropertySlot):
-        (JSC::PutPropertySlot::wasTransition):
-        (JSC::PutPropertySlot::setWasTransition):
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::transitionTo):
-        (JSC::StructureIDChain::StructureIDChain):
-        * kjs/StructureID.h:
-        (JSC::StructureID::previousID):
-        (JSC::StructureID::setCachedPrototypeChain):
-        (JSC::StructureID::cachedPrototypeChain):
-        (JSC::StructureID::propertyMap):
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::addl_i8m):
-        (JSC::X86Assembler::subl_i8m):
-
-2008-09-12  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 20819: JSValue::isObject() is slow
-        <https://bugs.webkit.org/show_bug.cgi?id=20819>
-
-        Optimize JSCell::isObject() and JSCell::isString() by making them
-        non-virtual calls that rely on the StructureID type information.
-
-        This is a 0.7% speedup on SunSpider and a 1.0% speedup on the V8
-        benchmark suite.
-
-        * JavaScriptCore.exp:
-        * kjs/JSCell.cpp:
-        * kjs/JSCell.h:
-        (JSC::JSCell::isObject):
-        (JSC::JSCell::isString):
-        * kjs/JSObject.cpp:
-        * kjs/JSObject.h:
-        * kjs/JSString.cpp:
-        * kjs/JSString.h:
-        (JSC::JSString::JSString):
-        * kjs/StructureID.h:
-        (JSC::StructureID::type):
-
-2008-09-11  Stephanie Lewis  <slewis@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Turn off PGO Optimization on CTI.cpp -> <rdar://problem/6207709>.  Fixes
-        crash on CNN and on Dromaeo.
-        Fix Missing close tag in vcproj. 
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-
-2008-09-11  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Not reviewed.
-
-        Correct an SVN problem with the last commit and actually add the new
-        files.
-
-        * wrec/CharacterClassConstructor.cpp: Added.
-        (JSC::):
-        (JSC::getCharacterClassNewline):
-        (JSC::getCharacterClassDigits):
-        (JSC::getCharacterClassSpaces):
-        (JSC::getCharacterClassWordchar):
-        (JSC::getCharacterClassNondigits):
-        (JSC::getCharacterClassNonspaces):
-        (JSC::getCharacterClassNonwordchar):
-        (JSC::CharacterClassConstructor::addSorted):
-        (JSC::CharacterClassConstructor::addSortedRange):
-        (JSC::CharacterClassConstructor::put):
-        (JSC::CharacterClassConstructor::flush):
-        (JSC::CharacterClassConstructor::append):
-        * wrec/CharacterClassConstructor.h: Added.
-        (JSC::CharacterClassConstructor::CharacterClassConstructor):
-        (JSC::CharacterClassConstructor::isUpsideDown):
-        (JSC::CharacterClassConstructor::charClass):
-
-2008-09-11  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 20788: Split CharacterClassConstructor into its own file
-        <https://bugs.webkit.org/show_bug.cgi?id=20788>
-
-        Split CharacterClassConstructor into its own file and clean up some
-        style issues.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * wrec/CharacterClassConstructor.cpp: Added.
-        (JSC::):
-        (JSC::getCharacterClassNewline):
-        (JSC::getCharacterClassDigits):
-        (JSC::getCharacterClassSpaces):
-        (JSC::getCharacterClassWordchar):
-        (JSC::getCharacterClassNondigits):
-        (JSC::getCharacterClassNonspaces):
-        (JSC::getCharacterClassNonwordchar):
-        (JSC::CharacterClassConstructor::addSorted):
-        (JSC::CharacterClassConstructor::addSortedRange):
-        (JSC::CharacterClassConstructor::put):
-        (JSC::CharacterClassConstructor::flush):
-        (JSC::CharacterClassConstructor::append):
-        * wrec/CharacterClassConstructor.h: Added.
-        (JSC::CharacterClassConstructor::CharacterClassConstructor):
-        (JSC::CharacterClassConstructor::isUpsideDown):
-        (JSC::CharacterClassConstructor::charClass):
-        * wrec/WREC.cpp:
-        (JSC::WRECParser::parseCharacterClass):
-
-2008-09-10  Simon Hausmann  <hausmann@webkit.org>
-
-        Not reviewed but trivial one-liner for yet unused macro.
-
-        Changed PLATFORM(WINCE) to PLATFORM(WIN_CE) as requested by Mark.
-
-        (part of https://bugs.webkit.org/show_bug.cgi?id=20746)
-
-        * wtf/Platform.h:
-
-2008-09-10  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Rubber-stamped by Oliver Hunt.
-
-        Fix a typo by renaming the overloaded orl_rr that takes an immediate to
-        orl_i32r.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitFastArithPotentiallyReTagImmediate):
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::orl_i32r):
-        * wrec/WREC.cpp:
-        (JSC::WRECGenerator::generatePatternCharacter):
-        (JSC::WRECGenerator::generateCharacterClassInverted):
-
-2008-09-10  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoff Garen.
-
-        Add inline property storage for JSObject.
-
-        1.2% progression on Sunspider. .5% progression on the v8 test suite.
-
-        * JavaScriptCore.exp:
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::mark): There is no reason to check storageSize now that
-        we start from 0.
-        (JSC::JSObject::allocatePropertyStorage): Allocates/reallocates heap storage.
-        * kjs/JSObject.h:
-        (JSC::JSObject::offsetForLocation): m_propertyStorage is not an OwnArrayPtr
-        now so there is no reason to .get()
-        (JSC::JSObject::usingInlineStorage):
-        (JSC::JSObject::JSObject): Start with m_propertyStorage pointing to the
-        inline storage.
-        (JSC::JSObject::~JSObject): Free the heap storage if not using the inline
-        storage.
-        (JSC::JSObject::putDirect): Switch to the heap storage only when we know
-        we know that we are about to add a property that will overflow the inline
-        storage.
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMap::createTable): Don't allocate the propertyStorage, that is
-        now handled by JSObject.
-        (JSC::PropertyMap::rehash): PropertyStorage is not a OwnArrayPtr anymore.
-        * kjs/PropertyMap.h:
-        (JSC::PropertyMap::storageSize): Rename from markingCount.
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::addPropertyTransition): Don't resize the property storage
-        if we are using inline storage.
-        * kjs/StructureID.h:
-
-2008-09-10  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Inline immediate number version of op_mul.
-
-        Renamed mull_rr to imull_rr as that's what it's 
-        actually doing, and added imull_i32r for the constant
-        case immediate multiply.
-
-        1.1% improvement to SunSpider.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::):
-        (JSC::X86Assembler::imull_rr):
-        (JSC::X86Assembler::imull_i32r):
-
-2008-09-10  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Not reviewed.
-
-        Mac build fix.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2008-09-09  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Add optimised access to known properties on the global object.
-
-        Improve cross scope access to the global object by emitting
-        code to access it directly rather than by walking the scope chain.
-
-        This is a 0.8% win in SunSpider and a 1.7% win in the v8 benchmarks.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::emitGetVariableObjectRegister):
-        (JSC::CTI::emitPutVariableObjectRegister):
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        (JSC::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (JSC::CodeGenerator::findScopedProperty):
-        (JSC::CodeGenerator::emitResolve):
-        (JSC::CodeGenerator::emitGetScopedVar):
-        (JSC::CodeGenerator::emitPutScopedVar):
-        * VM/CodeGenerator.h:
-        * VM/Machine.cpp:
-        (JSC::Machine::privateExecute):
-        * VM/Opcode.h:
-        * kjs/nodes.cpp:
-        (JSC::FunctionCallResolveNode::emitCode):
-        (JSC::PostfixResolveNode::emitCode):
-        (JSC::PrefixResolveNode::emitCode):
-        (JSC::ReadModifyResolveNode::emitCode):
-        (JSC::AssignResolveNode::emitCode):
-
-2008-09-10  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Oliver.
-        
-        - enable polymorphic inline caching of properties of primitives
-        
-        1.012x speedup on SunSpider.
-
-        We create special structure IDs for JSString and
-        JSNumberCell. Unlike normal structure IDs, these cannot hold the
-        true prototype. Due to JS autoboxing semantics, the prototype used
-        when looking up string or number properties depends on the lexical
-        global object of the call site, not the creation site. Thus we
-        enable StructureIDs to handle this quirk for primitives.
-        
-        Everything else should be straightforward.
-        
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        * VM/CTI.h:
-        (JSC::CTI::compileGetByIdProto):
-        (JSC::CTI::compileGetByIdChain):
-        * VM/JSPropertyNameIterator.h:
-        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
-        * VM/Machine.cpp:
-        (JSC::Machine::Machine):
-        (JSC::cachePrototypeChain):
-        (JSC::Machine::tryCachePutByID):
-        (JSC::Machine::tryCacheGetByID):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::tryCTICachePutByID):
-        (JSC::Machine::tryCTICacheGetByID):
-        * kjs/GetterSetter.h:
-        (JSC::GetterSetter::GetterSetter):
-        * kjs/JSCell.h:
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        * kjs/JSGlobalData.h:
-        * kjs/JSGlobalObject.h:
-        (JSC::StructureID::prototypeForLookup):
-        * kjs/JSNumberCell.h:
-        (JSC::JSNumberCell::JSNumberCell):
-        (JSC::jsNumberCell):
-        * kjs/JSObject.h:
-        (JSC::JSObject::prototype):
-        * kjs/JSString.cpp:
-        (JSC::jsString):
-        (JSC::jsSubstring):
-        (JSC::jsOwnedString):
-        * kjs/JSString.h:
-        (JSC::JSString::JSString):
-        (JSC::JSString::):
-        (JSC::jsSingleCharacterString):
-        (JSC::jsSingleCharacterSubstring):
-        (JSC::jsNontrivialString):
-        * kjs/SmallStrings.cpp:
-        (JSC::SmallStrings::createEmptyString):
-        (JSC::SmallStrings::createSingleCharacterString):
-        * kjs/StructureID.cpp:
-        (JSC::StructureID::StructureID):
-        (JSC::StructureID::addPropertyTransition):
-        (JSC::StructureID::getterSetterTransition):
-        (JSC::StructureIDChain::StructureIDChain):
-        * kjs/StructureID.h:
-        (JSC::StructureID::create):
-        (JSC::StructureID::storedPrototype):
-
-2008-09-09  Joerg Bornemann  <joerg.bornemann@trolltech.com>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20746
-
-        Added WINCE platform macro.
-
-        * wtf/Platform.h:
-
-2008-09-09  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Remove unnecessary override of getOffset.
-
-        Sunspider reports this as a .6% progression.
-
-        * JavaScriptCore.exp:
-        * kjs/JSObject.h:
-        (JSC::JSObject::getDirectLocation):
-        (JSC::JSObject::getOwnPropertySlotForWrite):
-        (JSC::JSObject::putDirect):
-        * kjs/PropertyMap.cpp:
-        * kjs/PropertyMap.h:
-
-2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 20759: Remove MacroAssembler
-        <https://bugs.webkit.org/show_bug.cgi?id=20759>
-
-        Remove MacroAssembler and move its functionality to X86Assembler.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CTI.cpp:
-        (JSC::CTI::emitGetArg):
-        (JSC::CTI::emitGetPutArg):
-        (JSC::CTI::emitPutArg):
-        (JSC::CTI::emitPutCTIParam):
-        (JSC::CTI::emitGetCTIParam):
-        (JSC::CTI::emitPutToCallFrameHeader):
-        (JSC::CTI::emitGetFromCallFrameHeader):
-        (JSC::CTI::emitPutResult):
-        (JSC::CTI::emitDebugExceptionCheck):
-        (JSC::CTI::emitJumpSlowCaseIfNotImm):
-        (JSC::CTI::emitJumpSlowCaseIfNotImms):
-        (JSC::CTI::emitFastArithDeTagImmediate):
-        (JSC::CTI::emitFastArithReTagImmediate):
-        (JSC::CTI::emitFastArithPotentiallyReTagImmediate):
-        (JSC::CTI::emitFastArithImmToInt):
-        (JSC::CTI::emitFastArithIntToImmOrSlowCase):
-        (JSC::CTI::emitFastArithIntToImmNoCheck):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::emitSlowScriptCheck):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        (JSC::CTI::privateCompileGetByIdSelf):
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        (JSC::CTI::privateCompilePutByIdReplace):
-        (JSC::CTI::privateArrayLengthTrampoline):
-        (JSC::CTI::privateStringLengthTrampoline):
-        (JSC::CTI::compileRegExp):
-        * VM/CTI.h:
-        (JSC::CallRecord::CallRecord):
-        (JSC::JmpTable::JmpTable):
-        (JSC::SlowCaseEntry::SlowCaseEntry):
-        (JSC::CTI::JSRInfo::JSRInfo):
-        * masm/MacroAssembler.h: Removed.
-        * masm/MacroAssemblerWin.cpp: Removed.
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::emitConvertToFastCall):
-        (JSC::X86Assembler::emitRestoreArgumentReference):
-        * wrec/WREC.h:
-        (JSC::WRECGenerator::WRECGenerator):
-        (JSC::WRECParser::WRECParser):
-
-2008-09-09  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Cameron Zwarich.
-
-        Don't waste the first item in the PropertyStorage.
-
-        - Fix typo (makingCount -> markingCount)
-        - Remove undefined method declaration.
-
-        No change on Sunspider.
-
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::mark):
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMap::put):
-        (JSC::PropertyMap::remove):
-        (JSC::PropertyMap::getOffset):
-        (JSC::PropertyMap::insert):
-        (JSC::PropertyMap::rehash):
-        (JSC::PropertyMap::resizePropertyStorage):
-        (JSC::PropertyMap::checkConsistency):
-        * kjs/PropertyMap.h:
-        (JSC::PropertyMap::markingCount): Fix typo.
-
-2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Not reviewed.
-
-        Speculative Windows build fix.
-
-        * masm/MacroAssemblerWin.cpp:
-        (JSC::MacroAssembler::emitConvertToFastCall):
-        (JSC::MacroAssembler::emitRestoreArgumentReference):
-
-2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 20755: Create an X86 namespace for register names and other things
-        <https://bugs.webkit.org/show_bug.cgi?id=20755>
-
-        Create an X86 namespace to put X86 register names. Perhaps I will move
-        opcode names here later as well.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitGetArg):
-        (JSC::CTI::emitGetPutArg):
-        (JSC::CTI::emitPutArg):
-        (JSC::CTI::emitPutArgConstant):
-        (JSC::CTI::emitPutCTIParam):
-        (JSC::CTI::emitGetCTIParam):
-        (JSC::CTI::emitPutToCallFrameHeader):
-        (JSC::CTI::emitGetFromCallFrameHeader):
-        (JSC::CTI::emitPutResult):
-        (JSC::CTI::emitDebugExceptionCheck):
-        (JSC::CTI::emitJumpSlowCaseIfNotImms):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::emitSlowScriptCheck):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        (JSC::CTI::privateCompileGetByIdSelf):
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        (JSC::CTI::privateCompilePutByIdReplace):
-        (JSC::CTI::privateArrayLengthTrampoline):
-        (JSC::CTI::privateStringLengthTrampoline):
-        (JSC::CTI::compileRegExp):
-        * VM/CTI.h:
-        * masm/X86Assembler.h:
-        (JSC::X86::):
-        (JSC::X86Assembler::emitModRm_rm):
-        (JSC::X86Assembler::emitModRm_rm_Unchecked):
-        (JSC::X86Assembler::emitModRm_rmsib):
-        * wrec/WREC.cpp:
-        (JSC::WRECGenerator::generateNonGreedyQuantifier):
-        (JSC::WRECGenerator::generateGreedyQuantifier):
-        (JSC::WRECGenerator::generateParentheses):
-        (JSC::WRECGenerator::generateBackreference):
-        (JSC::WRECGenerator::gernerateDisjunction):
-        * wrec/WREC.h:
-
-2008-09-09  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        Remove unnecessary friend declaration.
-
-        * kjs/PropertyMap.h:
-
-2008-09-09  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        Replace uses of PropertyMap::get and PropertyMap::getLocation with
-        PropertyMap::getOffset.
-
-        Sunspider reports this as a .6% improvement.
-
-        * JavaScriptCore.exp:
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::put):
-        (JSC::JSObject::deleteProperty):
-        (JSC::JSObject::getPropertyAttributes):
-        * kjs/JSObject.h:
-        (JSC::JSObject::getDirect):
-        (JSC::JSObject::getDirectLocation):
-        (JSC::JSObject::locationForOffset):
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMap::remove):
-        (JSC::PropertyMap::getOffset):
-        * kjs/PropertyMap.h:
-
-2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Sam Weinig.
-
-        Bug 20754: Remove emit prefix from assembler opcode methods
-        <https://bugs.webkit.org/show_bug.cgi?id=20754>
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitGetArg):
-        (JSC::CTI::emitGetPutArg):
-        (JSC::CTI::emitPutArg):
-        (JSC::CTI::emitPutArgConstant):
-        (JSC::CTI::emitPutCTIParam):
-        (JSC::CTI::emitGetCTIParam):
-        (JSC::CTI::emitPutToCallFrameHeader):
-        (JSC::CTI::emitGetFromCallFrameHeader):
-        (JSC::CTI::emitPutResult):
-        (JSC::CTI::emitDebugExceptionCheck):
-        (JSC::CTI::emitCall):
-        (JSC::CTI::emitJumpSlowCaseIfNotImm):
-        (JSC::CTI::emitJumpSlowCaseIfNotImms):
-        (JSC::CTI::emitFastArithDeTagImmediate):
-        (JSC::CTI::emitFastArithReTagImmediate):
-        (JSC::CTI::emitFastArithPotentiallyReTagImmediate):
-        (JSC::CTI::emitFastArithImmToInt):
-        (JSC::CTI::emitFastArithIntToImmOrSlowCase):
-        (JSC::CTI::emitFastArithIntToImmNoCheck):
-        (JSC::CTI::compileOpCall):
-        (JSC::CTI::emitSlowScriptCheck):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        (JSC::CTI::privateCompile):
-        (JSC::CTI::privateCompileGetByIdSelf):
-        (JSC::CTI::privateCompileGetByIdProto):
-        (JSC::CTI::privateCompileGetByIdChain):
-        (JSC::CTI::privateCompilePutByIdReplace):
-        (JSC::CTI::privateArrayLengthTrampoline):
-        (JSC::CTI::privateStringLengthTrampoline):
-        (JSC::CTI::compileRegExp):
-        * masm/MacroAssemblerWin.cpp:
-        (JSC::MacroAssembler::emitConvertToFastCall):
-        (JSC::MacroAssembler::emitRestoreArgumentReference):
-        * masm/X86Assembler.h:
-        (JSC::X86Assembler::pushl_r):
-        (JSC::X86Assembler::pushl_m):
-        (JSC::X86Assembler::popl_r):
-        (JSC::X86Assembler::popl_m):
-        (JSC::X86Assembler::movl_rr):
-        (JSC::X86Assembler::addl_rr):
-        (JSC::X86Assembler::addl_i8r):
-        (JSC::X86Assembler::addl_i32r):
-        (JSC::X86Assembler::addl_mr):
-        (JSC::X86Assembler::andl_rr):
-        (JSC::X86Assembler::andl_i32r):
-        (JSC::X86Assembler::cmpl_i8r):
-        (JSC::X86Assembler::cmpl_rr):
-        (JSC::X86Assembler::cmpl_rm):
-        (JSC::X86Assembler::cmpl_i32r):
-        (JSC::X86Assembler::cmpl_i32m):
-        (JSC::X86Assembler::cmpw_rm):
-        (JSC::X86Assembler::orl_rr):
-        (JSC::X86Assembler::subl_rr):
-        (JSC::X86Assembler::subl_i8r):
-        (JSC::X86Assembler::subl_i32r):
-        (JSC::X86Assembler::subl_mr):
-        (JSC::X86Assembler::testl_i32r):
-        (JSC::X86Assembler::testl_rr):
-        (JSC::X86Assembler::xorl_i8r):
-        (JSC::X86Assembler::xorl_rr):
-        (JSC::X86Assembler::sarl_i8r):
-        (JSC::X86Assembler::sarl_CLr):
-        (JSC::X86Assembler::shl_i8r):
-        (JSC::X86Assembler::shll_CLr):
-        (JSC::X86Assembler::mull_rr):
-        (JSC::X86Assembler::idivl_r):
-        (JSC::X86Assembler::cdq):
-        (JSC::X86Assembler::movl_mr):
-        (JSC::X86Assembler::movzwl_mr):
-        (JSC::X86Assembler::movl_rm):
-        (JSC::X86Assembler::movl_i32r):
-        (JSC::X86Assembler::movl_i32m):
-        (JSC::X86Assembler::leal_mr):
-        (JSC::X86Assembler::ret):
-        (JSC::X86Assembler::jmp_r):
-        (JSC::X86Assembler::jmp_m):
-        (JSC::X86Assembler::call_r):
-        * wrec/WREC.cpp:
-        (JSC::WRECGenerator::generateBacktrack1):
-        (JSC::WRECGenerator::generateBacktrackBackreference):
-        (JSC::WRECGenerator::generateBackreferenceQuantifier):
-        (JSC::WRECGenerator::generateNonGreedyQuantifier):
-        (JSC::WRECGenerator::generateGreedyQuantifier):
-        (JSC::WRECGenerator::generatePatternCharacter):
-        (JSC::WRECGenerator::generateCharacterClassInvertedRange):
-        (JSC::WRECGenerator::generateCharacterClassInverted):
-        (JSC::WRECGenerator::generateCharacterClass):
-        (JSC::WRECGenerator::generateParentheses):
-        (JSC::WRECGenerator::gererateParenthesesResetTrampoline):
-        (JSC::WRECGenerator::generateAssertionBOL):
-        (JSC::WRECGenerator::generateAssertionEOL):
-        (JSC::WRECGenerator::generateAssertionWordBoundary):
-        (JSC::WRECGenerator::generateBackreference):
-        (JSC::WRECGenerator::gernerateDisjunction):
-
-2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej Stachowiak.
-
-        Clean up the WREC code some more.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::compileRegExp):
-        * wrec/WREC.cpp:
-        (JSC::getCharacterClassNewline):
-        (JSC::getCharacterClassDigits):
-        (JSC::getCharacterClassSpaces):
-        (JSC::getCharacterClassWordchar):
-        (JSC::getCharacterClassNondigits):
-        (JSC::getCharacterClassNonspaces):
-        (JSC::getCharacterClassNonwordchar):
-        (JSC::WRECGenerator::generateBacktrack1):
-        (JSC::WRECGenerator::generateBacktrackBackreference):
-        (JSC::WRECGenerator::generateBackreferenceQuantifier):
-        (JSC::WRECGenerator::generateNonGreedyQuantifier):
-        (JSC::WRECGenerator::generateGreedyQuantifier):
-        (JSC::WRECGenerator::generatePatternCharacter):
-        (JSC::WRECGenerator::generateCharacterClassInvertedRange):
-        (JSC::WRECGenerator::generateCharacterClassInverted):
-        (JSC::WRECGenerator::generateCharacterClass):
-        (JSC::WRECGenerator::generateParentheses):
-        (JSC::WRECGenerator::gererateParenthesesResetTrampoline):
-        (JSC::WRECGenerator::generateAssertionBOL):
-        (JSC::WRECGenerator::generateAssertionEOL):
-        (JSC::WRECGenerator::generateAssertionWordBoundary):
-        (JSC::WRECGenerator::generateBackreference):
-        (JSC::WRECGenerator::gernerateDisjunction):
-        (JSC::WRECParser::parseCharacterClass):
-        (JSC::WRECParser::parseEscape):
-        (JSC::WRECParser::parseTerm):
-        * wrec/WREC.h:
-
-2008-09-09  Mark Rowe  <mrowe@apple.com>
-
-        Build fix, rubber-stamped by Anders Carlsson.
-
-        Silence spurious build warnings about missing format attributes on functions in Assertions.cpp.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2008-09-09  Mark Rowe  <mrowe@apple.com>
-
-        Rubber-stamped by Oliver Hunt.
-
-        Fix builds using the "debug" variant.
-
-        This reverts r36130 and tweaks Identifier to export the same symbols for Debug
-        and Release configurations.
-
-        * Configurations/JavaScriptCore.xcconfig:
-        * DerivedSources.make:
-        * JavaScriptCore.Debug.exp: Removed.
-        * JavaScriptCore.base.exp: Removed.
-        * JavaScriptCore.exp: Added.
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * kjs/identifier.cpp:
-        (JSC::Identifier::addSlowCase): #ifdef the call to checkSameIdentifierTable so that
-        there is no overhead in Release builds.
-        (JSC::Identifier::checkSameIdentifierTable): Add empty functions for Release builds.
-        * kjs/identifier.h:
-        (JSC::Identifier::add): #ifdef the calls to checkSameIdentifierTable so that there is
-        no overhead in Release builds, and remove the inline definitions of checkSameIdentifierTable.
-
-2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej Stachowiak.
-
-        Clean up WREC a bit to bring it closer to our coding style guidelines.
-
-        * wrec/WREC.cpp:
-        (JSC::):
-        (JSC::getCharacterClass_newline):
-        (JSC::getCharacterClass_d):
-        (JSC::getCharacterClass_s):
-        (JSC::getCharacterClass_w):
-        (JSC::getCharacterClass_D):
-        (JSC::getCharacterClass_S):
-        (JSC::getCharacterClass_W):
-        (JSC::CharacterClassConstructor::append):
-        (JSC::WRECGenerator::generateNonGreedyQuantifier):
-        (JSC::WRECGenerator::generateGreedyQuantifier):
-        (JSC::WRECGenerator::generateCharacterClassInverted):
-        (JSC::WRECParser::parseQuantifier):
-        (JSC::WRECParser::parsePatternCharacterQualifier):
-        (JSC::WRECParser::parseCharacterClassQuantifier):
-        (JSC::WRECParser::parseBackreferenceQuantifier):
-        * wrec/WREC.h:
-        (JSC::Quantifier::):
-        (JSC::Quantifier::Quantifier):
-
-2008-09-09  Jungshik Shin  <jungshik.shin@gmail.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Try MIME charset names before trying IANA names 
-        ( https://bugs.webkit.org/show_bug.cgi?id=17537 )
-
-        * wtf/StringExtras.h: (strcasecmp): Added.
-
-2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Mark Rowe.
-
-        Bug 20719: REGRESSION (r36135-36244): Hangs, then crashes after several seconds
-        <https://bugs.webkit.org/show_bug.cgi?id=20719>
-        <rdar://problem/6205787>
-
-        Fix a typo in the case-insensitive matching of character patterns.
-
-        * wrec/WREC.cpp:
-        (JSC::WRECGenerator::generatePatternCharacter):
-
-2008-09-09  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        - allow polymorphic inline cache to handle Math object functions and possibly other similar things
-        
-        1.012x speedup on SunSpider.
-
-        * kjs/MathObject.cpp:
-        (JSC::MathObject::getOwnPropertySlot):
-        * kjs/lookup.cpp:
-        (JSC::setUpStaticFunctionSlot):
-        * kjs/lookup.h:
-        (JSC::getStaticPropertySlot):
-
-2008-09-08  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Maciej Stachowiak and Oliver Hunt.
-
-        Split storage of properties out of the PropertyMap and into the JSObject
-        to allow sharing PropertyMap on the StructureID.  In order to get this
-        function correctly, the StructureID's transition mappings were changed to
-        transition based on property name and attribute pairs, instead of just
-        property name.
-
-        - Removes the single property optimization now that the PropertyMap is shared.
-          This will be replaced by in-lining some values on the JSObject.
-
-        This is a wash on Sunspider and a 6.7% win on the v8 test suite.
-
-        * JavaScriptCore.base.exp:
-        * VM/CTI.cpp:
-        (JSC::CTI::privateCompileGetByIdSelf): Get the storage directly off the JSObject.
-        (JSC::CTI::privateCompileGetByIdProto): Ditto.
-        (JSC::CTI::privateCompileGetByIdChain): Ditto.
-        (JSC::CTI::privateCompilePutByIdReplace): Ditto.
-        * kjs/JSObject.cpp:
-        (JSC::JSObject::mark): Mark the PropertyStorage.
-        (JSC::JSObject::put): Update to get the propertyMap of the StructureID.
-        (JSC::JSObject::deleteProperty): Ditto.
-        (JSC::JSObject::defineGetter): Return early if the property is already a getter/setter.
-        (JSC::JSObject::defineSetter): Ditto.
-        (JSC::JSObject::getPropertyAttributes): Update to get the propertyMap of the StructureID
-        (JSC::JSObject::getPropertyNames): Ditto.
-        (JSC::JSObject::removeDirect): Ditto.
-        * kjs/JSObject.h: Remove PropertyMap and add PropertyStorage.
-        (JSC::JSObject::propertyStorage): return the PropertyStorage.
-        (JSC::JSObject::getDirect): Update to get the propertyMap of the StructureID.
-        (JSC::JSObject::getDirectLocation): Ditto.
-        (JSC::JSObject::offsetForLocation): Compute location directly.
-        (JSC::JSObject::hasCustomProperties): Update to get the propertyMap of the StructureID.
-        (JSC::JSObject::hasGetterSetterProperties): Ditto.
-        (JSC::JSObject::getDirectOffset): Get by indexing into PropertyStorage.
-        (JSC::JSObject::putDirectOffset): Put by indexing into PropertyStorage.
-        (JSC::JSObject::getOwnPropertySlotForWrite): Update to get the propertyMap of the StructureID.
-        (JSC::JSObject::getOwnPropertySlot): Ditto.
-        (JSC::JSObject::putDirect): Move putting into the StructureID unless the property already exists.
-        * kjs/PropertyMap.cpp: Use the propertyStorage as the storage for the JSValues.
-        (JSC::PropertyMap::checkConsistency): 
-        (JSC::PropertyMap::operator=):
-        (JSC::PropertyMap::~PropertyMap):
-        (JSC::PropertyMap::get):
-        (JSC::PropertyMap::getLocation):
-        (JSC::PropertyMap::put):
-        (JSC::PropertyMap::getOffset):
-        (JSC::PropertyMap::insert):
-        (JSC::PropertyMap::expand):
-        (JSC::PropertyMap::rehash):
-        (JSC::PropertyMap::createTable):
-        (JSC::PropertyMap::resizePropertyStorage): Resize the storage to match the size of the map
-        (JSC::PropertyMap::remove):
-        (JSC::PropertyMap::getEnumerablePropertyNames):
-        * kjs/PropertyMap.h: 
-        (JSC::PropertyMapEntry::PropertyMapEntry):
-        (JSC::PropertyMap::isEmpty):
-        (JSC::PropertyMap::size):
-        (JSC::PropertyMap::makingCount):
-        (JSC::PropertyMap::PropertyMap):
-
-        * kjs/StructureID.cpp: 
-        (JSC::StructureID::addPropertyTransition): Transitions now are based off the property name
-        and attributes. 
-        (JSC::StructureID::toDictionaryTransition): Copy the map.
-        (JSC::StructureID::changePrototypeTransition): Copy the map.
-        (JSC::StructureID::getterSetterTransition): Copy the map.
-        (JSC::StructureID::~StructureID): 
-        * kjs/StructureID.h:
-        (JSC::TransitionTableHash::hash): Custom hash for transition map.
-        (JSC::TransitionTableHash::equal): Ditto.
-        (JSC::TransitionTableHashTraits::emptyValue): Custom traits for transition map
-        (JSC::TransitionTableHashTraits::constructDeletedValue): Ditto.
-        (JSC::TransitionTableHashTraits::isDeletedValue): Ditto.
-        (JSC::StructureID::propertyMap): Added.
-
-2008-09-08  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        Bug 20694: Slow Script error pops up when running Dromaeo tests
-
-        Correct error in timeout logic where execution tick count would
-        be reset to incorrect value due to incorrect offset and indirection.
-        Codegen for the slow script dialog was factored out into a separate
-        method (emitSlowScriptCheck) rather than having multiple copies of
-        the same code.  Also added calls to generate slow script checks
-        for loop_if_less and loop_if_true opcodes.
-
-        * VM/CTI.cpp:
-        (JSC::CTI::emitSlowScriptCheck):
-        (JSC::CTI::privateCompileMainPass):
-        (JSC::CTI::privateCompileSlowCases):
-        * VM/CTI.h:
-
-2008-09-08  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej Stachowiak.
-
-        Remove references to the removed WRECompiler class.
-
-        * VM/Machine.h:
-        * wrec/WREC.h:
-
-2008-09-08  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Rubber-stamped by Mark Rowe.
-
-        Fix the build with CTI enabled but WREC disabled.
-
-        * VM/CTI.cpp:
-        * VM/CTI.h:
-
-2008-09-08  Dan Bernstein  <mitz@apple.com>
-
-        - build fix
-
-        * kjs/nodes.h:
-        (JSC::StatementNode::):
-        (JSC::BlockNode::):
-
-2008-09-08  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Geoff.
-
-       <rdar://problem/6134407> Breakpoints in for loops, while loops or
-       conditions without curly braces don't break. (19306)
-       -Statement Lists already emit debug hooks but conditionals without
-       brackets are not lists.
-
-        * kjs/nodes.cpp:
-        (KJS::IfNode::emitCode):
-        (KJS::IfElseNode::emitCode):
-        (KJS::DoWhileNode::emitCode):
-        (KJS::WhileNode::emitCode):
-        (KJS::ForNode::emitCode):
-        (KJS::ForInNode::emitCode):
-        * kjs/nodes.h:
-        (KJS::StatementNode::):
-        (KJS::BlockNode::):
-
-2008-09-08  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Anders Carlsson.
-        
-        - Cache the code generated for eval to speed up SunSpider and web sites
-        https://bugs.webkit.org/show_bug.cgi?id=20718
-        
-        1.052x on SunSpider
-        2.29x on date-format-tofte
-        
-        Lots of real sites seem to get many hits on this cache as well,
-        including GMail, Google Spreadsheets, Slate and Digg (the last of
-        these gets over 100 hits on initial page load).
-
-        * VM/CodeBlock.h:
-        (JSC::EvalCodeCache::get):
-        * VM/Machine.cpp:
-        (JSC::Machine::callEval):
-        (JSC::Machine::privateExecute):
-        (JSC::Machine::cti_op_call_eval):
-        * VM/Machine.h:
-
-2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 20711: Change KJS prefix on preprocessor macros to JSC
-        <https://bugs.webkit.org/show_bug.cgi?id=20711>
-
-        * kjs/CommonIdentifiers.cpp:
-        (JSC::CommonIdentifiers::CommonIdentifiers):
-        * kjs/CommonIdentifiers.h:
-        * kjs/PropertySlot.h:
-        (JSC::PropertySlot::getValue):
-        (JSC::PropertySlot::putValue):
-        (JSC::PropertySlot::setValueSlot):
-        (JSC::PropertySlot::setValue):
-        (JSC::PropertySlot::setRegisterSlot):
-        * kjs/lookup.h:
-        * kjs/nodes.cpp:
-        * kjs/nodes.h:
-        (JSC::Node::):
-        (JSC::ExpressionNode::):
-        (JSC::StatementNode::):
-        (JSC::NullNode::):
-        (JSC::BooleanNode::):
-        (JSC::NumberNode::):
-        (JSC::ImmediateNumberNode::):
-        (JSC::StringNode::):
-        (JSC::RegExpNode::):
-        (JSC::ThisNode::):
-        (JSC::ResolveNode::):
-        (JSC::ElementNode::):
-        (JSC::ArrayNode::):
-        (JSC::PropertyNode::):
-        (JSC::PropertyListNode::):
-        (JSC::ObjectLiteralNode::):
-        (JSC::BracketAccessorNode::):
-        (JSC::DotAccessorNode::):
-        (JSC::ArgumentListNode::):
-        (JSC::ArgumentsNode::):
-        (JSC::NewExprNode::):
-        (JSC::EvalFunctionCallNode::):
-        (JSC::FunctionCallValueNode::):
-        (JSC::FunctionCallResolveNode::):
-        (JSC::FunctionCallBracketNode::):
-        (JSC::FunctionCallDotNode::):
-        (JSC::PrePostResolveNode::):
-        (JSC::PostfixResolveNode::):
-        (JSC::PostfixBracketNode::):
-        (JSC::PostfixDotNode::):
-        (JSC::PostfixErrorNode::):
-        (JSC::DeleteResolveNode::):
-        (JSC::DeleteBracketNode::):
-        (JSC::DeleteDotNode::):
-        (JSC::DeleteValueNode::):
-        (JSC::VoidNode::):
-        (JSC::TypeOfResolveNode::):
-        (JSC::TypeOfValueNode::):
-        (JSC::PrefixResolveNode::):
-        (JSC::PrefixBracketNode::):
-        (JSC::PrefixDotNode::):
-        (JSC::PrefixErrorNode::):
-        (JSC::UnaryPlusNode::):
-        (JSC::NegateNode::):
-        (JSC::BitwiseNotNode::):
-        (JSC::LogicalNotNode::):
-        (JSC::MultNode::):
-        (JSC::DivNode::):
-        (JSC::ModNode::):
-        (JSC::AddNode::):
-        (JSC::SubNode::):
-        (JSC::LeftShiftNode::):
-        (JSC::RightShiftNode::):
-        (JSC::UnsignedRightShiftNode::):
-        (JSC::LessNode::):
-        (JSC::GreaterNode::):
-        (JSC::LessEqNode::):
-        (JSC::GreaterEqNode::):
-        (JSC::ThrowableBinaryOpNode::):
-        (JSC::InstanceOfNode::):
-        (JSC::InNode::):
-        (JSC::EqualNode::):
-        (JSC::NotEqualNode::):
-        (JSC::StrictEqualNode::):
-        (JSC::NotStrictEqualNode::):
-        (JSC::BitAndNode::):
-        (JSC::BitOrNode::):
-        (JSC::BitXOrNode::):
-        (JSC::LogicalOpNode::):
-        (JSC::ConditionalNode::):
-        (JSC::ReadModifyResolveNode::):
-        (JSC::AssignResolveNode::):
-        (JSC::ReadModifyBracketNode::):
-        (JSC::AssignBracketNode::):
-        (JSC::AssignDotNode::):
-        (JSC::ReadModifyDotNode::):
-        (JSC::AssignErrorNode::):
-        (JSC::CommaNode::):
-        (JSC::VarDeclCommaNode::):
-        (JSC::ConstDeclNode::):
-        (JSC::ConstStatementNode::):
-        (JSC::EmptyStatementNode::):
-        (JSC::DebuggerStatementNode::):
-        (JSC::ExprStatementNode::):
-        (JSC::VarStatementNode::):
-        (JSC::IfNode::):
-        (JSC::IfElseNode::):
-        (JSC::DoWhileNode::):
-        (JSC::WhileNode::):
-        (JSC::ForNode::):
-        (JSC::ContinueNode::):
-        (JSC::BreakNode::):
-        (JSC::ReturnNode::):
-        (JSC::WithNode::):
-        (JSC::LabelNode::):
-        (JSC::ThrowNode::):
-        (JSC::TryNode::):
-        (JSC::ParameterNode::):
-        (JSC::ScopeNode::):
-        (JSC::ProgramNode::):
-        (JSC::EvalNode::):
-        (JSC::FunctionBodyNode::):
-        (JSC::FuncExprNode::):
-        (JSC::FuncDeclNode::):
-        (JSC::CaseClauseNode::):
-        (JSC::ClauseListNode::):
-        (JSC::CaseBlockNode::):
-        (JSC::SwitchNode::):
-
-2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 20704: Replace the KJS namespace
-        <https://bugs.webkit.org/show_bug.cgi?id=20704>
-
-        Rename the KJS namespace to JSC. There are still some uses of KJS in
-        preprocessor macros and comments, but these will also be changed some
-        time in the near future.
-
-        * API/APICast.h:
-        (toJS):
-        (toRef):
-        (toGlobalRef):
-        * API/JSBase.cpp:
-        * API/JSCallbackConstructor.cpp:
-        * API/JSCallbackConstructor.h:
-        * API/JSCallbackFunction.cpp:
-        * API/JSCallbackFunction.h:
-        * API/JSCallbackObject.cpp:
-        * API/JSCallbackObject.h:
-        * API/JSCallbackObjectFunctions.h:
-        * API/JSClassRef.cpp:
-        (OpaqueJSClass::staticValues):
-        (OpaqueJSClass::staticFunctions):
-        * API/JSClassRef.h:
-        * API/JSContextRef.cpp:
-        * API/JSObjectRef.cpp:
-        * API/JSProfilerPrivate.cpp:
-        * API/JSStringRef.cpp:
-        * API/JSValueRef.cpp:
-        (JSValueGetType):
-        * API/OpaqueJSString.cpp:
-        * API/OpaqueJSString.h:
-        * JavaScriptCore.Debug.exp:
-        * JavaScriptCore.base.exp:
-        * VM/CTI.cpp:
-        (JSC::):
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        * VM/CodeBlock.h:
-        * VM/CodeGenerator.cpp:
-        * VM/CodeGenerator.h:
-        * VM/ExceptionHelpers.cpp:
-        * VM/ExceptionHelpers.h:
-        * VM/Instruction.h:
-        * VM/JSPropertyNameIterator.cpp:
-        * VM/JSPropertyNameIterator.h:
-        * VM/LabelID.h:
-        * VM/Machine.cpp:
-        * VM/Machine.h:
-        * VM/Opcode.cpp:
-        * VM/Opcode.h:
-        * VM/Register.h:
-        (WTF::):
-        * VM/RegisterFile.cpp:
-        * VM/RegisterFile.h:
-        * VM/RegisterID.h:
-        (WTF::):
-        * VM/SamplingTool.cpp:
-        * VM/SamplingTool.h:
-        * VM/SegmentedVector.h:
-        * kjs/ArgList.cpp:
-        * kjs/ArgList.h:
-        * kjs/Arguments.cpp:
-        * kjs/Arguments.h:
-        * kjs/ArrayConstructor.cpp:
-        * kjs/ArrayConstructor.h:
-        * kjs/ArrayPrototype.cpp:
-        * kjs/ArrayPrototype.h:
-        * kjs/BatchedTransitionOptimizer.h:
-        * kjs/BooleanConstructor.cpp:
-        * kjs/BooleanConstructor.h:
-        * kjs/BooleanObject.cpp:
-        * kjs/BooleanObject.h:
-        * kjs/BooleanPrototype.cpp:
-        * kjs/BooleanPrototype.h:
-        * kjs/CallData.cpp:
-        * kjs/CallData.h:
-        * kjs/ClassInfo.h:
-        * kjs/CommonIdentifiers.cpp:
-        * kjs/CommonIdentifiers.h:
-        * kjs/ConstructData.cpp:
-        * kjs/ConstructData.h:
-        * kjs/DateConstructor.cpp:
-        * kjs/DateConstructor.h:
-        * kjs/DateInstance.cpp:
-        (JSC::DateInstance::msToGregorianDateTime):
-        * kjs/DateInstance.h:
-        * kjs/DateMath.cpp:
-        * kjs/DateMath.h:
-        * kjs/DatePrototype.cpp:
-        * kjs/DatePrototype.h:
-        * kjs/DebuggerCallFrame.cpp:
-        * kjs/DebuggerCallFrame.h:
-        * kjs/Error.cpp:
-        * kjs/Error.h:
-        * kjs/ErrorConstructor.cpp:
-        * kjs/ErrorConstructor.h:
-        * kjs/ErrorInstance.cpp:
-        * kjs/ErrorInstance.h:
-        * kjs/ErrorPrototype.cpp:
-        * kjs/ErrorPrototype.h:
-        * kjs/ExecState.cpp:
-        * kjs/ExecState.h:
-        * kjs/FunctionConstructor.cpp:
-        * kjs/FunctionConstructor.h:
-        * kjs/FunctionPrototype.cpp:
-        * kjs/FunctionPrototype.h:
-        * kjs/GetterSetter.cpp:
-        * kjs/GetterSetter.h:
-        * kjs/GlobalEvalFunction.cpp:
-        * kjs/GlobalEvalFunction.h:
-        * kjs/IndexToNameMap.cpp:
-        * kjs/IndexToNameMap.h:
-        * kjs/InitializeThreading.cpp:
-        * kjs/InitializeThreading.h:
-        * kjs/InternalFunction.cpp:
-        * kjs/InternalFunction.h:
-        (JSC::InternalFunction::InternalFunction):
-        * kjs/JSActivation.cpp:
-        * kjs/JSActivation.h:
-        * kjs/JSArray.cpp:
-        * kjs/JSArray.h:
-        * kjs/JSCell.cpp:
-        * kjs/JSCell.h:
-        * kjs/JSFunction.cpp:
-        * kjs/JSFunction.h:
-        (JSC::JSFunction::JSFunction):
-        * kjs/JSGlobalData.cpp:
-        (JSC::JSGlobalData::JSGlobalData):
-        * kjs/JSGlobalData.h:
-        * kjs/JSGlobalObject.cpp:
-        * kjs/JSGlobalObject.h:
-        * kjs/JSGlobalObjectFunctions.cpp:
-        * kjs/JSGlobalObjectFunctions.h:
-        * kjs/JSImmediate.cpp:
-        * kjs/JSImmediate.h:
-        * kjs/JSLock.cpp:
-        * kjs/JSLock.h:
-        * kjs/JSNotAnObject.cpp:
-        * kjs/JSNotAnObject.h:
-        * kjs/JSNumberCell.cpp:
-        * kjs/JSNumberCell.h:
-        * kjs/JSObject.cpp:
-        * kjs/JSObject.h:
-        * kjs/JSStaticScopeObject.cpp:
-        * kjs/JSStaticScopeObject.h:
-        * kjs/JSString.cpp:
-        * kjs/JSString.h:
-        * kjs/JSType.h:
-        * kjs/JSValue.cpp:
-        * kjs/JSValue.h:
-        * kjs/JSVariableObject.cpp:
-        * kjs/JSVariableObject.h:
-        * kjs/JSWrapperObject.cpp:
-        * kjs/JSWrapperObject.h:
-        * kjs/LabelStack.cpp:
-        * kjs/LabelStack.h:
-        * kjs/MathObject.cpp:
-        * kjs/MathObject.h:
-        * kjs/NativeErrorConstructor.cpp:
-        * kjs/NativeErrorConstructor.h:
-        * kjs/NativeErrorPrototype.cpp:
-        * kjs/NativeErrorPrototype.h:
-        * kjs/NodeInfo.h:
-        * kjs/NumberConstructor.cpp:
-        * kjs/NumberConstructor.h:
-        * kjs/NumberObject.cpp:
-        * kjs/NumberObject.h:
-        * kjs/NumberPrototype.cpp:
-        * kjs/NumberPrototype.h:
-        * kjs/ObjectConstructor.cpp:
-        * kjs/ObjectConstructor.h:
-        * kjs/ObjectPrototype.cpp:
-        * kjs/ObjectPrototype.h:
-        * kjs/Parser.cpp:
-        * kjs/Parser.h:
-        * kjs/PropertyMap.cpp:
-        (JSC::PropertyMapStatisticsExitLogger::~PropertyMapStatisticsExitLogger):
-        * kjs/PropertyMap.h:
-        * kjs/PropertyNameArray.cpp:
-        * kjs/PropertyNameArray.h:
-        * kjs/PropertySlot.cpp:
-        * kjs/PropertySlot.h:
-        * kjs/PrototypeFunction.cpp:
-        * kjs/PrototypeFunction.h:
-        * kjs/PutPropertySlot.h:
-        * kjs/RegExpConstructor.cpp:
-        * kjs/RegExpConstructor.h:
-        * kjs/RegExpObject.cpp:
-        * kjs/RegExpObject.h:
-        * kjs/RegExpPrototype.cpp:
-        * kjs/RegExpPrototype.h:
-        * kjs/ScopeChain.cpp:
-        * kjs/ScopeChain.h:
-        * kjs/ScopeChainMark.h:
-        * kjs/Shell.cpp:
-        (jscmain):
-        * kjs/SmallStrings.cpp:
-        * kjs/SmallStrings.h:
-        * kjs/SourceProvider.h:
-        * kjs/SourceRange.h:
-        * kjs/StringConstructor.cpp:
-        * kjs/StringConstructor.h:
-        * kjs/StringObject.cpp:
-        * kjs/StringObject.h:
-        * kjs/StringObjectThatMasqueradesAsUndefined.h:
-        * kjs/StringPrototype.cpp:
-        * kjs/StringPrototype.h:
-        * kjs/StructureID.cpp:
-        * kjs/StructureID.h:
-        * kjs/SymbolTable.h:
-        * kjs/collector.cpp:
-        * kjs/collector.h:
-        * kjs/completion.h:
-        * kjs/create_hash_table:
-        * kjs/debugger.cpp:
-        * kjs/debugger.h:
-        * kjs/dtoa.cpp:
-        * kjs/dtoa.h:
-        * kjs/grammar.y:
-        * kjs/identifier.cpp:
-        * kjs/identifier.h:
-        (JSC::Identifier::equal):
-        * kjs/interpreter.cpp:
-        * kjs/interpreter.h:
-        * kjs/lexer.cpp:
-        (JSC::Lexer::Lexer):
-        (JSC::Lexer::clear):
-        (JSC::Lexer::makeIdentifier):
-        * kjs/lexer.h:
-        * kjs/lookup.cpp:
-        * kjs/lookup.h:
-        * kjs/nodes.cpp:
-        * kjs/nodes.h:
-        * kjs/nodes2string.cpp:
-        * kjs/operations.cpp:
-        * kjs/operations.h:
-        * kjs/protect.h:
-        * kjs/regexp.cpp:
-        * kjs/regexp.h:
-        * kjs/ustring.cpp:
-        * kjs/ustring.h:
-        (JSC::operator!=):
-        (JSC::IdentifierRepHash::hash):
-        (WTF::):
-        * masm/MacroAssembler.h:
-        * masm/MacroAssemblerWin.cpp:
-        * masm/X86Assembler.h:
-        * pcre/pcre_exec.cpp:
-        * profiler/CallIdentifier.h:
-        (WTF::):
-        * profiler/HeavyProfile.cpp:
-        * profiler/HeavyProfile.h:
-        * profiler/Profile.cpp:
-        * profiler/Profile.h:
-        * profiler/ProfileGenerator.cpp:
-        * profiler/ProfileGenerator.h:
-        * profiler/ProfileNode.cpp:
-        * profiler/ProfileNode.h:
-        * profiler/Profiler.cpp:
-        * profiler/Profiler.h:
-        * profiler/TreeProfile.cpp:
-        * profiler/TreeProfile.h:
-        * wrec/WREC.cpp:
-        * wrec/WREC.h:
-        * wtf/AVLTree.h:
-
-2008-09-07  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Dan Bernstein.
-        
-        - rename IA32MacroAssembler class to X86Assembler
-        
-        We otherwise call the platform X86, and also, I don't see any macros.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * masm/IA32MacroAsm.h: Removed.
-        * masm/MacroAssembler.h:
-        (KJS::MacroAssembler::MacroAssembler):
-        * masm/MacroAssemblerWin.cpp:
-        (KJS::MacroAssembler::emitRestoreArgumentReference):
-        * masm/X86Assembler.h: Copied from masm/IA32MacroAsm.h.
-        (KJS::X86Assembler::X86Assembler):
-        * wrec/WREC.cpp:
-        (KJS::WRECGenerator::generateNonGreedyQuantifier):
-        (KJS::WRECGenerator::generateGreedyQuantifier):
-        (KJS::WRECGenerator::generateParentheses):
-        (KJS::WRECGenerator::generateBackreference):
-        (KJS::WRECGenerator::gernerateDisjunction):
-        * wrec/WREC.h:
-
-2008-09-07  Cameron Zwarich  <cwzwarich@webkit.org>
-
-        Not reviewed.
-
-        Visual C++ seems to have some odd casting rules, so just convert the
-        offending cast back to a C-style cast for now.
-
-        * kjs/collector.cpp:
-        (KJS::otherThreadStackPointer):
-
-2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Mark Rowe.
-
-        Attempt to fix the Windows build by using a const_cast to cast regs.Esp
-        to a uintptr_t instead of a reinterpret_cast.
-
-        * kjs/collector.cpp:
-        (KJS::otherThreadStackPointer):
-
-2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Sam Weinig.
-
-        Remove C-style casts from kjs/collector.cpp.
-
-        * kjs/collector.cpp:
-        (KJS::Heap::heapAllocate):
-        (KJS::currentThreadStackBase):
-        (KJS::Heap::markConservatively):
-        (KJS::otherThreadStackPointer):
-        (KJS::Heap::markOtherThreadConservatively):
-        (KJS::Heap::sweep):
-
-2008-09-07  Mark Rowe  <mrowe@apple.com>
-
-        Build fix for the debug variant.
-
-        * DerivedSources.make: Also use the .Debug.exp exports file when building the debug variant.
-
-2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Timothy Hatcher.
-
-        Remove C-style casts from the CTI code.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::emitGetArg):
-        (KJS::CTI::emitGetPutArg):
-        (KJS::ctiRepatchCallByReturnAddress):
-        (KJS::CTI::compileOpCall):
-        (KJS::CTI::privateCompileMainPass):
-        (KJS::CTI::privateCompileGetByIdSelf):
-        (KJS::CTI::privateCompileGetByIdProto):
-        (KJS::CTI::privateCompileGetByIdChain):
-        (KJS::CTI::privateCompilePutByIdReplace):
-        (KJS::CTI::privateArrayLengthTrampoline):
-        (KJS::CTI::privateStringLengthTrampoline):
-
-=== End merge of squirrelfish-extreme ===
-
-2008-09-06  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig. Adapted somewhat by Maciej Stachowiak.
-        
-        - refactor WREC to share more of the JIT infrastructure with CTI
-
-        * VM/CTI.cpp:
-        (KJS::CTI::emitGetArg):
-        (KJS::CTI::emitGetPutArg):
-        (KJS::CTI::emitPutArg):
-        (KJS::CTI::emitPutArgConstant):
-        (KJS::CTI::emitPutCTIParam):
-        (KJS::CTI::emitGetCTIParam):
-        (KJS::CTI::emitPutToCallFrameHeader):
-        (KJS::CTI::emitGetFromCallFrameHeader):
-        (KJS::CTI::emitPutResult):
-        (KJS::CTI::emitDebugExceptionCheck):
-        (KJS::CTI::emitJumpSlowCaseIfNotImm):
-        (KJS::CTI::emitJumpSlowCaseIfNotImms):
-        (KJS::CTI::emitFastArithDeTagImmediate):
-        (KJS::CTI::emitFastArithReTagImmediate):
-        (KJS::CTI::emitFastArithPotentiallyReTagImmediate):
-        (KJS::CTI::emitFastArithImmToInt):
-        (KJS::CTI::emitFastArithIntToImmOrSlowCase):
-        (KJS::CTI::emitFastArithIntToImmNoCheck):
-        (KJS::CTI::CTI):
-        (KJS::CTI::compileOpCall):
-        (KJS::CTI::privateCompileMainPass):
-        (KJS::CTI::privateCompileSlowCases):
-        (KJS::CTI::privateCompile):
-        (KJS::CTI::privateCompileGetByIdSelf):
-        (KJS::CTI::privateCompileGetByIdProto):
-        (KJS::CTI::privateCompileGetByIdChain):
-        (KJS::CTI::privateCompilePutByIdReplace):
-        (KJS::CTI::privateArrayLengthTrampoline):
-        (KJS::CTI::privateStringLengthTrampoline):
-        (KJS::CTI::compileRegExp):
-        * VM/CTI.h:
-        (KJS::CallRecord::CallRecord):
-        (KJS::JmpTable::JmpTable):
-        (KJS::SlowCaseEntry::SlowCaseEntry):
-        (KJS::CTI::JSRInfo::JSRInfo):
-        * kjs/regexp.cpp:
-        (KJS::RegExp::RegExp):
-        * wrec/WREC.cpp:
-        (KJS::GenerateParenthesesNonGreedyFunctor::GenerateParenthesesNonGreedyFunctor):
-        (KJS::GeneratePatternCharacterFunctor::generateAtom):
-        (KJS::GeneratePatternCharacterFunctor::backtrack):
-        (KJS::GenerateCharacterClassFunctor::generateAtom):
-        (KJS::GenerateCharacterClassFunctor::backtrack):
-        (KJS::GenerateBackreferenceFunctor::generateAtom):
-        (KJS::GenerateBackreferenceFunctor::backtrack):
-        (KJS::GenerateParenthesesNonGreedyFunctor::generateAtom):
-        (KJS::GenerateParenthesesNonGreedyFunctor::backtrack):
-        (KJS::WRECGenerate::generateBacktrack1):
-        (KJS::WRECGenerate::generateBacktrackBackreference):
-        (KJS::WRECGenerate::generateBackreferenceQuantifier):
-        (KJS::WRECGenerate::generateNonGreedyQuantifier):
-        (KJS::WRECGenerate::generateGreedyQuantifier):
-        (KJS::WRECGenerate::generatePatternCharacter):
-        (KJS::WRECGenerate::generateCharacterClassInvertedRange):
-        (KJS::WRECGenerate::generateCharacterClassInverted):
-        (KJS::WRECGenerate::generateCharacterClass):
-        (KJS::WRECGenerate::generateParentheses):
-        (KJS::WRECGenerate::generateParenthesesNonGreedy):
-        (KJS::WRECGenerate::gererateParenthesesResetTrampoline):
-        (KJS::WRECGenerate::generateAssertionBOL):
-        (KJS::WRECGenerate::generateAssertionEOL):
-        (KJS::WRECGenerate::generateAssertionWordBoundary):
-        (KJS::WRECGenerate::generateBackreference):
-        (KJS::WRECGenerate::gernerateDisjunction):
-        (KJS::WRECGenerate::terminateDisjunction):
-        (KJS::WRECParser::parseGreedyQuantifier):
-        (KJS::WRECParser::parseQuantifier):
-        (KJS::WRECParser::parsePatternCharacterQualifier):
-        (KJS::WRECParser::parseCharacterClassQuantifier):
-        (KJS::WRECParser::parseBackreferenceQuantifier):
-        (KJS::WRECParser::parseParentheses):
-        (KJS::WRECParser::parseCharacterClass):
-        (KJS::WRECParser::parseOctalEscape):
-        (KJS::WRECParser::parseEscape):
-        (KJS::WRECParser::parseTerm):
-        (KJS::WRECParser::parseDisjunction):
-        * wrec/WREC.h:
-        (KJS::WRECGenerate::WRECGenerate):
-        (KJS::WRECParser::):
-        (KJS::WRECParser::WRECParser):
-        (KJS::WRECParser::parseAlternative):
-        (KJS::WRECParser::isEndOfPattern):
-
-2008-09-06  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by NOBODY (Build fix).
-
-        Fix the sampler build.
-
-        * VM/SamplingTool.h:
-
-2008-09-06  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Jump through the necessary hoops required to make MSVC cooperate with SFX
-
-        We now explicitly declare the calling convention on all cti_op_* cfunctions,
-        and return int instead of bool where appropriate (despite the cdecl calling
-        convention seems to state MSVC generates code that returns the result value
-        through ecx).  SFX behaves slightly differently under MSVC, specifically it
-        stores the base argument address for the cti_op_* functions in the first
-        argument, and then does the required stack manipulation through that pointer.
-        This is necessary as MSVC's optimisations assume they have complete control
-        of the stack, and periodically elide our stack manipulations, or move
-        values in unexpected ways.  MSVC also frequently produces tail calls which may
-        clobber the first argument, so the MSVC path is slightly less efficient due
-        to the need to restore it.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CTI.cpp:
-        (KJS::):
-        (KJS::CTI::compileOpCall):
-        (KJS::CTI::privateCompileMainPass):
-        (KJS::CTI::privateCompileSlowCases):
-        * VM/CTI.h:
-        * VM/Machine.cpp:
-        * VM/Machine.h:
-        * masm/MacroAssembler.h:
-        (KJS::MacroAssembler::emitConvertToFastCall):
-        * masm/MacroAssemblerIA32GCC.cpp: Removed.
-           For performance reasons we need these no-op functions to be inlined.
-
-        * masm/MacroAssemblerWin.cpp:
-        (KJS::MacroAssembler::emitRestoreArgumentReference):
-        * wtf/Platform.h:
-
-2008-09-05  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Maciej Stachowiak, or maybe the other way around.
-        
-        Added the ability to coalesce JITCode buffer grow operations by first
-        growing the buffer and then executing unchecked puts to it.
-        
-        About a 2% speedup on date-format-tofte.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::compileOpCall):
-        * masm/IA32MacroAsm.h:
-        (KJS::JITCodeBuffer::ensureSpace):
-        (KJS::JITCodeBuffer::putByteUnchecked):
-        (KJS::JITCodeBuffer::putByte):
-        (KJS::JITCodeBuffer::putShortUnchecked):
-        (KJS::JITCodeBuffer::putShort):
-        (KJS::JITCodeBuffer::putIntUnchecked):
-        (KJS::JITCodeBuffer::putInt):
-        (KJS::IA32MacroAssembler::emitTestl_i32r):
-        (KJS::IA32MacroAssembler::emitMovl_mr):
-        (KJS::IA32MacroAssembler::emitMovl_rm):
-        (KJS::IA32MacroAssembler::emitMovl_i32m):
-        (KJS::IA32MacroAssembler::emitUnlinkedJe):
-        (KJS::IA32MacroAssembler::emitModRm_rr):
-        (KJS::IA32MacroAssembler::emitModRm_rr_Unchecked):
-        (KJS::IA32MacroAssembler::emitModRm_rm_Unchecked):
-        (KJS::IA32MacroAssembler::emitModRm_rm):
-        (KJS::IA32MacroAssembler::emitModRm_opr):
-        (KJS::IA32MacroAssembler::emitModRm_opr_Unchecked):
-        (KJS::IA32MacroAssembler::emitModRm_opm_Unchecked):
-
-2008-09-05  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Disable WREC and CTI on platforms that we have not yet had a chance to test with.
-
-        * wtf/Platform.h:
-
-2008-09-05  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Use jo instead of a mask compare when fetching array.length and
-        string.length. 4% speedup on array.length / string.length torture
-        test.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateArrayLengthTrampoline):
-        (KJS::CTI::privateStringLengthTrampoline):
-
-2008-09-05  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Removed a CTI compilation pass by recording labels during bytecode
-        generation. This is more to reduce complexity than it is to improve
-        performance.
-
-        SunSpider reports no change.
-
-        CodeBlock now keeps a "labels" set, which holds the offsets of all the
-        instructions that can be jumped to.
-
-        * VM/CTI.cpp: Nixed a pass.
-
-        * VM/CodeBlock.h: Added a "labels" set.
-
-        * VM/LabelID.h: No need for a special LableID for holding jump
-        destinations, since the CodeBlock now knows all jump destinations.
-
-        * wtf/HashTraits.h: New hash traits to accomodate putting offset 0 in
-        the set.
-
-        * kjs/nodes.cpp:
-        (KJS::TryNode::emitCode): Emit a dummy label to record sret targets.
-
-2008-09-05  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Oliver Hunt and Gavin Barraclough.
-
-        Move the JITCodeBuffer onto Machine and remove the static variables.
-
-        * VM/CTI.cpp: Initialize m_jit with the Machine's code buffer.
-        * VM/Machine.cpp:
-        (KJS::Machine::Machine): Allocate a JITCodeBuffer.
-        * VM/Machine.h:
-        * kjs/RegExpConstructor.cpp:
-        (KJS::constructRegExp): Pass the ExecState through.
-        * kjs/RegExpPrototype.cpp:
-        (KJS::regExpProtoFuncCompile): Ditto.
-        * kjs/StringPrototype.cpp:
-        (KJS::stringProtoFuncMatch): Ditto.
-        (KJS::stringProtoFuncSearch): Ditto.
-        * kjs/nodes.cpp:
-        (KJS::RegExpNode::emitCode): Compile the pattern at code generation time
-        so that we have access to an ExecState.
-        * kjs/nodes.h:
-        (KJS::RegExpNode::):
-        * kjs/nodes2string.cpp:
-        * kjs/regexp.cpp:
-        (KJS::RegExp::RegExp): Pass the ExecState through.
-        (KJS::RegExp::create): Ditto.
-        * kjs/regexp.h:
-        * masm/IA32MacroAsm.h:
-        (KJS::IA32MacroAssembler::IA32MacroAssembler): Reset the JITCodeBuffer when we are
-        constructed.
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::compile): Retrieve the JITCodeBuffer from the Machine.
-        * wrec/WREC.h:
-
-2008-09-05  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Oliver Hunt and Gavin Barraclough.
-
-        Fix the build when CTI is disabled.
-
-        * VM/CodeBlock.cpp:
-        (KJS::CodeBlock::~CodeBlock):
-        * VM/CodeGenerator.cpp:
-        (KJS::prepareJumpTableForStringSwitch):
-        * VM/Machine.cpp:
-        (KJS::Machine::Machine):
-        (KJS::Machine::~Machine):
-
-2008-09-05  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        Fix some windows abi issues.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompileMainPass):
-        (KJS::CTI::privateCompileSlowCases):
-        * VM/CTI.h:
-        (KJS::CallRecord::CallRecord):
-        (KJS::):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_resolve_func):
-        (KJS::Machine::cti_op_post_inc):
-        (KJS::Machine::cti_op_resolve_with_base):
-        (KJS::Machine::cti_op_post_dec):
-        * VM/Machine.h:
-
-2008-09-05  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Fix ecma/FunctionObjects/15.3.5.3.js after I broke it in r93.
-
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_call_NotJSFunction): Restore m_callFrame to the correct value after making the native call.
-        (KJS::Machine::cti_op_construct_NotJSConstruct): Ditto.
-
-2008-09-04  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Fix fast/dom/Window/console-functions.html.
-
-        The call frame on the ExecState was not being updated on calls into native functions.  This meant that functions
-        such as console.log would use the line number of the last JS function on the call stack.
-
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_call_NotJSFunction): Update the ExecState's call frame before making a native function call,
-        and restore it when the function is done.
-        (KJS::Machine::cti_op_construct_NotJSConstruct): Ditto.
-
-2008-09-05  Oliver Hunt  <oliver@apple.com>
-
-        Start bringing up SFX on windows.
-
-        Reviewed by Mark Rowe and Sam Weinig
-
-        Start doing the work to bring up SFX on windows.  Initially
-        just working on WREC, as it does not make any calls so reduces
-        the amount of code that needs to be corrected.
-        
-        Start abstracting the CTI JIT codegen engine.
-
-        * ChangeLog:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CTI.cpp:
-        * masm/IA32MacroAsm.h:
-        * masm/MacroAssembler.h: Added.
-        (KJS::MacroAssembler::MacroAssembler):
-        * masm/MacroAssemblerIA32GCC.cpp: Added.
-        (KJS::MacroAssembler::emitConvertToFastCall):
-        * masm/MacroAssemblerWin.cpp: Added.
-        (KJS::MacroAssembler::emitConvertToFastCall):
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::parseGreedyQuantifier):
-        (KJS::WRECompiler::parseCharacterClass):
-        (KJS::WRECompiler::parseEscape):
-        (KJS::WRECompiler::compilePattern):
-        * wrec/WREC.h:
-
-2008-09-04  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Support for slow scripts (timeout checking).
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompileMainPass):
-        (KJS::CTI::privateCompile):
-        * VM/Machine.cpp:
-        (KJS::slideRegisterWindowForCall):
-        (KJS::Machine::cti_timeout_check):
-        (KJS::Machine::cti_vm_throw):
-
-2008-09-04  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Third round of style cleanup.
-
-        * VM/CTI.cpp:
-        * VM/CTI.h:
-        * VM/CodeBlock.h:
-        * VM/Machine.cpp:
-        * VM/Machine.h:
-        * kjs/ExecState.h:
-
-2008-09-04  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Jon Honeycutt.
-
-        Second round of style cleanup.
-
-        * VM/CTI.cpp:
-        * VM/CTI.h:
-        * wrec/WREC.h:
-
-2008-09-04  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Mark Rowe.
+        https://bugs.webkit.org/show_bug.cgi?id=23155
+        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
 
-        First round of style cleanup.
-
-        * VM/CTI.cpp:
-        * VM/CTI.h:
-        * masm/IA32MacroAsm.h:
-        * wrec/WREC.cpp:
-        * wrec/WREC.h:
-
-2008-09-04  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Mark Rowe.
-        
-        Merged http://trac.webkit.org/changeset/36081 to work with CTI.
-
-        * VM/Machine.cpp:
-        (KJS::Machine::tryCtiCacheGetByID):
-
-2008-09-04  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Enable profiling in CTI.
-
-        * VM/CTI.h:
-        (KJS::):
-        (KJS::CTI::execute):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_call_JSFunction):
-        (KJS::Machine::cti_op_call_NotJSFunction):
-        (KJS::Machine::cti_op_ret):
-        (KJS::Machine::cti_op_construct_JSConstruct):
-        (KJS::Machine::cti_op_construct_NotJSConstruct):
-
-2008-09-04  Victor Hernandez  <vhernandez@apple.com>
-
-        Reviewed by Geoffrey Garen.
-        
-        Fixed an #if to support using WREC without CTI.
-
-        * kjs/regexp.cpp:
-        (KJS::RegExp::match):
-
-2008-09-04  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        The array/string length trampolines are owned by the Machine, not the codeblock that compiled them.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateArrayLengthTrampoline):
-        (KJS::CTI::privateStringLengthTrampoline):
-        * VM/Machine.cpp:
-        (KJS::Machine::~Machine):
-        * VM/Machine.h:
-
-2008-09-04  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Gavin Barraclough and Sam Weinig.
-
-        Fix a crash on launch of jsc when GuardMalloc is enabled.
-
-        * kjs/ScopeChain.h:
-        (KJS::ScopeChain::ScopeChain): Initialize m_node to 0 when we have no valid scope chain.
-        (KJS::ScopeChain::~ScopeChain): Null-check m_node before calling deref.
-
-2008-09-03  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough and Geoff Garen.
-
-        Fix inspector and fast array access so that it bounds
-        checks correctly.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass2_Main):
-        * masm/IA32MacroAsm.h:
-        (KJS::IA32MacroAssembler::):
-        (KJS::IA32MacroAssembler::emitUnlinkedJb):
-        (KJS::IA32MacroAssembler::emitUnlinkedJbe):
-
-2008-09-03  Mark Rowe  <mrowe@apple.com>
-
-        Move the assertion after the InitializeAndReturn block, as
-        that is used even when CTI is enabled.
-
-        * VM/Machine.cpp:
-        (KJS::Machine::privateExecute):
-
-2008-09-03  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Replace calls to exit with ASSERT_WITH_MESSAGE or ASSERT_NOT_REACHED.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile_pass4_SlowCases):
-        * VM/Machine.cpp:
-        (KJS::Machine::privateExecute):
-        (KJS::Machine::cti_vm_throw):
-
-2008-09-03  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Tweak JavaScriptCore to compile on non-x86 platforms.  This is achieved
-        by wrapping more code with ENABLE(CTI), ENABLE(WREC), and PLATFORM(X86)
-        #if's.
-
-        * VM/CTI.cpp:
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        (KJS::CodeBlock::printStructureIDs): Use %td as the format specifier for
-        printing a ptrdiff_t.
-        * VM/Machine.cpp:
-        * VM/Machine.h:
-        * kjs/regexp.cpp:
-        (KJS::RegExp::RegExp):
-        (KJS::RegExp::~RegExp):
-        (KJS::RegExp::match):
-        * kjs/regexp.h:
-        * masm/IA32MacroAsm.h:
-        * wrec/WREC.cpp:
-        * wrec/WREC.h:
-        * wtf/Platform.h: Only enable CTI and WREC on x86.  Add an extra define to
-        track whether any MASM-using features are enabled.
-
-2008-09-03  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Copy Geoff's array/string length optimization for CTI.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateArrayLengthTrampoline):
-        (KJS::CTI::privateStringLengthTrampoline):
-        * VM/CTI.h:
-        (KJS::CTI::compileArrayLengthTrampoline):
-        (KJS::CTI::compileStringLengthTrampoline):
-        * VM/Machine.cpp:
-        (KJS::Machine::Machine):
-        (KJS::Machine::getCtiArrayLengthTrampoline):
-        (KJS::Machine::getCtiStringLengthTrampoline):
-        (KJS::Machine::tryCtiCacheGetByID):
-        (KJS::Machine::cti_op_get_by_id_second):
-        * VM/Machine.h:
-        * kjs/JSString.h:
-        * kjs/ustring.h:
-
-2008-09-03  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Implement fast array accesses in CTI - 2-3% progression on sunspider.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::emitFastArithIntToImmNoCheck):
-        (KJS::CTI::compileOpCall):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile_pass4_SlowCases):
-        * VM/CTI.h:
-        * kjs/JSArray.h:
-
-2008-09-02  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Enable fast property access support in CTI.
-
-        * VM/CTI.cpp:
-        (KJS::ctiSetReturnAddress):
-        (KJS::ctiRepatchCallByReturnAddress):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile):
-        (KJS::CTI::privateCompileGetByIdSelf):
-        (KJS::CTI::privateCompileGetByIdProto):
-        (KJS::CTI::privateCompileGetByIdChain):
-        (KJS::CTI::privateCompilePutByIdReplace):
-        * VM/CTI.h:
-        (KJS::CTI::compileGetByIdSelf):
-        (KJS::CTI::compileGetByIdProto):
-        (KJS::CTI::compileGetByIdChain):
-        (KJS::CTI::compilePutByIdReplace):
-        * VM/CodeBlock.cpp:
-        (KJS::CodeBlock::~CodeBlock):
-        * VM/CodeBlock.h:
-        * VM/Machine.cpp:
-        (KJS::doSetReturnAddressVmThrowTrampoline):
-        (KJS::Machine::tryCtiCachePutByID):
-        (KJS::Machine::tryCtiCacheGetByID):
-        (KJS::Machine::cti_op_put_by_id):
-        (KJS::Machine::cti_op_put_by_id_second):
-        (KJS::Machine::cti_op_put_by_id_generic):
-        (KJS::Machine::cti_op_put_by_id_fail):
-        (KJS::Machine::cti_op_get_by_id):
-        (KJS::Machine::cti_op_get_by_id_second):
-        (KJS::Machine::cti_op_get_by_id_generic):
-        (KJS::Machine::cti_op_get_by_id_fail):
-        (KJS::Machine::cti_op_throw):
-        (KJS::Machine::cti_vm_throw):
-        * VM/Machine.h:
-        * kjs/JSCell.h:
-        * kjs/JSObject.h:
-        * kjs/PropertyMap.h:
-        * kjs/StructureID.cpp:
-        (KJS::StructureIDChain::StructureIDChain):
-        * masm/IA32MacroAsm.h:
-        (KJS::IA32MacroAssembler::emitCmpl_i32m):
-        (KJS::IA32MacroAssembler::emitMovl_mr):
-        (KJS::IA32MacroAssembler::emitMovl_rm):
-
-2008-09-02  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin Barraclough and Mark Rowe.
-
-        A backslash (\) at the of a RegEx should produce an error.
-        Fixes fast/regex/test1.html.
-
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::parseEscape):
-
-2008-09-02  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoff Garen.
-
-        Link jumps for the slow case of op_loop_if_less.  Fixes acid3.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass4_SlowCases):
-
-2008-09-01  Sam Weinig  <sam@webkit.org>
-
-        Rubber-stamped by Maciej Stachowiak.
-
-        Switch WREC on by default.
-
-        * wtf/Platform.h:
-
-2008-09-01  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Fix two failures in fast/regex/test1.html
-          - \- in a character class should be treated as a literal -
-          - A missing max quantifier needs to be treated differently than
-            a null max quantifier.
-
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::generateNonGreedyQuantifier):
-        (KJS::WRECompiler::generateGreedyQuantifier):
-        (KJS::WRECompiler::parseCharacterClass):
-        * wrec/WREC.h:
-        (KJS::Quantifier::Quantifier):
-
-2008-09-01  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Fix crash in fast/js/kde/evil-n.html
-
-        * kjs/regexp.cpp: Always pass a non-null offset vector to the wrec function.
-
-2008-09-01  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin Barraclough and Mark Rowe.
-
-        Add pattern length limit fixing one test in fast/js.
-
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::compile):
-        * wrec/WREC.h:
-        (KJS::WRECompiler::):
-
-2008-09-01  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin Barraclough and Mark Rowe.
-
-        Make octal escape parsing/back-reference parsing more closely match 
-        prior behavior fixing one test in fast/js.
-
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::parseCharacterClass): 8 and 9 should be IdentityEscaped
-        (KJS::WRECompiler::parseEscape):
-        * wrec/WREC.h:
-        (KJS::WRECompiler::peekDigit):
-
-2008-09-01  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin Barraclough and Mark Rowe.
-
-        Fix one mozilla test.
-
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::generateCharacterClassInverted): Fix incorrect not
-        ascii upper check.
-
-2008-09-01  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin Barraclough and Mark Rowe.
-
-        Parse octal escapes in character classes fixing one mozilla test.
-
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::parseCharacterClass):
-        (KJS::WRECompiler::parseOctalEscape):
-        * wrec/WREC.h:
-        (KJS::WRECompiler::consumeOctal):
-
-2008-09-01  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Fixes two mozilla tests with WREC enabled.
-
-        * wrec/WREC.cpp:
-        (KJS::CharacterClassConstructor::append): Keep the character class sorted
-        when appending another character class.
-
-2008-09-01  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin Barraclough and Mark Rowe.
-
-        Fixes two mozilla tests with WREC enabled.
-
-        * wrec/WREC.cpp:
-        (KJS::CharacterClassConstructor::addSortedRange): Insert the range at the correct position
-        instead of appending it to the end.
-
-2008-09-01  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Move cross-compilation unit call into NEVER_INLINE function.
-
-        * VM/Machine.cpp:
-        (KJS::doSetReturnAddressVmThrowTrampoline):
-
-2008-09-01  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin Barraclough and Geoff Garen.
-
-        Fix one test in fast/js.
-
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_construct_NotJSConstruct): Throw a createNotAConstructorError,
-        instead of a createNotAFunctionError.
-
-2008-08-31  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-        
-        Zero-cost exception handling.  This patch takes the exception checking
-        back of the hot path.  When an exception occurs in a Machine::cti*
-        method, the return address to JIT code is recorded, and is then
-        overwritten with a pointer to a trampoline routine.  When the method
-        returns the trampoline will cause the cti_vm_throw method to be invoked.
-
-        cti_vm_throw uses the return address preserved above, to discover the
-        vPC of the bytecode that raised the exception (using a map build during
-        translation).  From the VPC of the faulting bytecode the vPC of a catch
-        routine may be discovered (unwinding the stack where necesary), and then
-        a bytecode address for the catch routine is looked up.  Final cti_vm_throw
-        overwrites its return address to JIT code again, to trampoline directly
-        to the catch routine.
-        
-        cti_op_throw is handled in a similar fashion.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::emitPutCTIParam):
-        (KJS::CTI::emitPutToCallFrameHeader):
-        (KJS::CTI::emitGetFromCallFrameHeader):
-        (KJS::ctiSetReturnAddressForArgs):
-        (KJS::CTI::emitDebugExceptionCheck):
-        (KJS::CTI::printOpcodeOperandTypes):
-        (KJS::CTI::emitCall):
-        (KJS::CTI::compileOpCall):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile):
-        * VM/CTI.h:
-        (KJS::CallRecord::CallRecord):
-        (KJS::):
-        (KJS::CTI::execute):
-        * VM/CodeBlock.h:
-        * VM/Machine.cpp:
-        (KJS::Machine::privateExecute):
-        (KJS::Machine::cti_op_instanceof):
-        (KJS::Machine::cti_op_call_NotJSFunction):
-        (KJS::Machine::cti_op_resolve):
-        (KJS::Machine::cti_op_resolve_func):
-        (KJS::Machine::cti_op_resolve_skip):
-        (KJS::Machine::cti_op_resolve_with_base):
-        (KJS::Machine::cti_op_throw):
-        (KJS::Machine::cti_op_in):
-        (KJS::Machine::cti_vm_throw):
-        * VM/RegisterFile.h:
-        (KJS::RegisterFile::):
-        * kjs/ExecState.h:
-        (KJS::ExecState::setCtiReturnAddress):
-        (KJS::ExecState::ctiReturnAddress):
-        * masm/IA32MacroAsm.h:
-        (KJS::IA32MacroAssembler::):
-        (KJS::IA32MacroAssembler::emitPushl_m):
-        (KJS::IA32MacroAssembler::emitPopl_m):
-        (KJS::IA32MacroAssembler::getRelocatedAddress):
-
-2008-08-31  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Fall back to PCRE for any regexp containing parentheses until we correctly backtrack within them.
-
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::parseParentheses):
-        * wrec/WREC.h:
-        (KJS::WRECompiler::):
-
-2008-08-31  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Fix several issues within ecma_3/RegExp/perlstress-001.js with WREC enabled.
-
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::generateNonGreedyQuantifier): Compare with the maximum quantifier count rather than the minimum.
-        (KJS::WRECompiler::generateAssertionEOL): Do a register-to-register comparison rather than immediate-to-register.
-        (KJS::WRECompiler::parseCharacterClass): Pass through the correct inversion flag.
-
-2008-08-30  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Re-fix the six remaining failures in the Mozilla JavaScript tests in a manner that does not kill performance.
-        This shows up as a 0.6% progression on SunSpider on my machine.
-
-        Grow the JITCodeBuffer's underlying buffer when we run out of space rather than just bailing out.
-
-        * VM/CodeBlock.h:
-        (KJS::CodeBlock::~CodeBlock): Switch to using fastFree now that JITCodeBuffer::copy uses fastMalloc.
-        * kjs/regexp.cpp: Ditto.
-        * masm/IA32MacroAsm.h:
-        (KJS::JITCodeBuffer::growBuffer):
-        (KJS::JITCodeBuffer::JITCodeBuffer):
-        (KJS::JITCodeBuffer::~JITCodeBuffer):
-        (KJS::JITCodeBuffer::putByte):
-        (KJS::JITCodeBuffer::putShort):
-        (KJS::JITCodeBuffer::putInt):
-        (KJS::JITCodeBuffer::reset):
-        (KJS::JITCodeBuffer::copy):
-
-2008-08-29  Oliver Hunt  <oliver@apple.com>
-
-        RS=Maciej
-
-        Roll out previous patch as it causes a 5% performance regression
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CTI.cpp:
-        (KJS::getJCB):
-        (KJS::CTI::privateCompile):
-        * VM/CodeBlock.h:
-        (KJS::CodeBlock::~CodeBlock):
-        * masm/IA32MacroAsm.h:
-        (KJS::JITCodeBuffer::JITCodeBuffer):
-        (KJS::JITCodeBuffer::putByte):
-        (KJS::JITCodeBuffer::putShort):
-        (KJS::JITCodeBuffer::putInt):
-        (KJS::JITCodeBuffer::getEIP):
-        (KJS::JITCodeBuffer::start):
-        (KJS::JITCodeBuffer::getOffset):
-        (KJS::JITCodeBuffer::reset):
-        (KJS::JITCodeBuffer::copy):
-        (KJS::IA32MacroAssembler::emitModRm_rr):
-        (KJS::IA32MacroAssembler::emitModRm_rm):
-        (KJS::IA32MacroAssembler::emitModRm_rmsib):
-        (KJS::IA32MacroAssembler::IA32MacroAssembler):
-        (KJS::IA32MacroAssembler::emitInt3):
-        (KJS::IA32MacroAssembler::emitPushl_r):
-        (KJS::IA32MacroAssembler::emitPopl_r):
-        (KJS::IA32MacroAssembler::emitMovl_rr):
-        (KJS::IA32MacroAssembler::emitAddl_rr):
-        (KJS::IA32MacroAssembler::emitAddl_i8r):
-        (KJS::IA32MacroAssembler::emitAddl_i32r):
-        (KJS::IA32MacroAssembler::emitAddl_mr):
-        (KJS::IA32MacroAssembler::emitAndl_rr):
-        (KJS::IA32MacroAssembler::emitAndl_i32r):
-        (KJS::IA32MacroAssembler::emitCmpl_i8r):
-        (KJS::IA32MacroAssembler::emitCmpl_rr):
-        (KJS::IA32MacroAssembler::emitCmpl_rm):
-        (KJS::IA32MacroAssembler::emitCmpl_i32r):
-        (KJS::IA32MacroAssembler::emitCmpl_i32m):
-        (KJS::IA32MacroAssembler::emitCmpw_rm):
-        (KJS::IA32MacroAssembler::emitOrl_rr):
-        (KJS::IA32MacroAssembler::emitOrl_i8r):
-        (KJS::IA32MacroAssembler::emitSubl_rr):
-        (KJS::IA32MacroAssembler::emitSubl_i8r):
-        (KJS::IA32MacroAssembler::emitSubl_i32r):
-        (KJS::IA32MacroAssembler::emitSubl_mr):
-        (KJS::IA32MacroAssembler::emitTestl_i32r):
-        (KJS::IA32MacroAssembler::emitTestl_rr):
-        (KJS::IA32MacroAssembler::emitXorl_i8r):
-        (KJS::IA32MacroAssembler::emitXorl_rr):
-        (KJS::IA32MacroAssembler::emitSarl_i8r):
-        (KJS::IA32MacroAssembler::emitSarl_CLr):
-        (KJS::IA32MacroAssembler::emitShl_i8r):
-        (KJS::IA32MacroAssembler::emitShll_CLr):
-        (KJS::IA32MacroAssembler::emitMull_rr):
-        (KJS::IA32MacroAssembler::emitIdivl_r):
-        (KJS::IA32MacroAssembler::emitCdq):
-        (KJS::IA32MacroAssembler::emitMovl_mr):
-        (KJS::IA32MacroAssembler::emitMovzwl_mr):
-        (KJS::IA32MacroAssembler::emitMovl_rm):
-        (KJS::IA32MacroAssembler::emitMovl_i32r):
-        (KJS::IA32MacroAssembler::emitMovl_i32m):
-        (KJS::IA32MacroAssembler::emitLeal_mr):
-        (KJS::IA32MacroAssembler::emitRet):
-        (KJS::IA32MacroAssembler::emitJmpN_r):
-        (KJS::IA32MacroAssembler::emitJmpN_m):
-        (KJS::IA32MacroAssembler::emitCall):
-        (KJS::IA32MacroAssembler::label):
-        (KJS::IA32MacroAssembler::emitUnlinkedJmp):
-        (KJS::IA32MacroAssembler::emitUnlinkedJne):
-        (KJS::IA32MacroAssembler::emitUnlinkedJe):
-        (KJS::IA32MacroAssembler::emitUnlinkedJl):
-        (KJS::IA32MacroAssembler::emitUnlinkedJle):
-        (KJS::IA32MacroAssembler::emitUnlinkedJge):
-        (KJS::IA32MacroAssembler::emitUnlinkedJae):
-        (KJS::IA32MacroAssembler::emitUnlinkedJo):
-        (KJS::IA32MacroAssembler::link):
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::compilePattern):
-        (KJS::WRECompiler::compile):
-        * wrec/WREC.h:
-
-2008-08-29  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Have JITCodeBuffer manage a Vector containing the generated code so that it can grow
-        as needed when generating code for a large function.  This fixes all six remaining failures
-        in Mozilla tests in both debug and release builds.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile):
-        * VM/CodeBlock.h:
-        (KJS::CodeBlock::~CodeBlock):
-        * masm/IA32MacroAsm.h:
-        (KJS::JITCodeBuffer::putByte):
-        (KJS::JITCodeBuffer::putShort):
-        (KJS::JITCodeBuffer::putInt):
-        (KJS::JITCodeBuffer::getEIP):
-        (KJS::JITCodeBuffer::start):
-        (KJS::JITCodeBuffer::getOffset):
-        (KJS::JITCodeBuffer::getCode):
-        (KJS::IA32MacroAssembler::emitModRm_rr):
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::compilePattern):
-        * wrec/WREC.h:
-
-2008-08-29  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Implement parsing of octal escapes in regular expressions.  This fixes three Mozilla tests.
-
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::parseOctalEscape):
-        (KJS::WRECompiler::parseEscape): Parse the escape sequence as an octal escape if it has a leading zero.
-        Add a FIXME about treating invalid backreferences as octal escapes in the future.
-        * wrec/WREC.h:
-        (KJS::WRECompiler::consumeNumber): Multiply by 10 rather than 0 so that we handle numbers with more than
-        one digit.
-        * wtf/ASCIICType.h:
-        (WTF::isASCIIOctalDigit):
-
-2008-08-29  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Pass vPC to instanceof method.  Fixes 2 mozilla tests in debug.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_instanceof):
-
-2008-08-29  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Pass vPCs to resolve methods for correct exception creation.  Fixes
-        17 mozilla tests in debug.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/CTI.h:
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_resolve):
-        (KJS::Machine::cti_op_resolve_func):
-        (KJS::Machine::cti_op_resolve_skip):
-        (KJS::Machine::cti_op_resolve_with_base):
-
-2008-08-29  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Remembering to actually throw the exception passed to op throw helps.
-        Regressions 19 -> 6.
-
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_throw):
-        (KJS::Machine::cti_vm_throw):
-
-2008-08-29  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Support for exception unwinding the stack.
-        
-        Once upon a time, Sam asked me for a bettr ChangeLog entry.  The return address
-        is now preserved on entry to a JIT code function (if we preserve lazily we need
-        restore the native return address during exception stack unwind).  This takes
-        the number of regressions down from ~150 to 19.
-
-        * VM/CTI.cpp:
-        (KJS::getJCB):
-        (KJS::CTI::emitExceptionCheck):
-        (KJS::CTI::compileOpCall):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile):
-        * VM/CTI.h:
-        (KJS::):
-        * VM/Machine.cpp:
-        (KJS::Machine::throwException):
-        (KJS::Machine::cti_op_call_JSFunction):
-        (KJS::Machine::cti_op_call_NotJSFunction):
-        (KJS::Machine::cti_op_construct_JSConstruct):
-        (KJS::Machine::cti_op_construct_NotJSConstruct):
-        (KJS::Machine::cti_op_throw):
-        (KJS::Machine::cti_vm_throw):
-
-2008-08-29  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Fix js1_2/regexp/word_boundary.js and four other Mozilla tests with WREC enabled.
-
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::generateCharacterClassInvertedRange): If none of the exact matches
-        succeeded, jump to failure.
-        (KJS::WRECompiler::compilePattern): Restore and increment the current position stored
-        on the stack to ensure that it will be reset to the correct position after a failed
-        match has consumed input.
-
-2008-08-29  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Fix a hang in ecma_3/RegExp/15.10.2-1.js with WREC enabled.
-        A backreference with a quantifier would get stuck in an infinite
-        loop if the captured range was empty.
-
-        * wrec/WREC.cpp:
-        (KJS::WRECompiler::generateBackreferenceQuantifier): If the captured range
-        was empty, do not attempt to match the backreference.
-        (KJS::WRECompiler::parseBackreferenceQuantifier):
-        * wrec/WREC.h:
-        (KJS::Quantifier::):
-
-2008-08-28  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Implement op_debug.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::debug):
-        (KJS::Machine::privateExecute):
-        (KJS::Machine::cti_op_debug):
-        * VM/Machine.h:
-
-2008-08-28  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin Barraclough and Geoff Garen.
-
-        Implement op_switch_string fixing 1 mozilla test and one test in fast/js.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile):
-        * VM/CTI.h:
-        (KJS::SwitchRecord::):
-        (KJS::SwitchRecord::SwitchRecord):
-        * VM/CodeBlock.cpp:
-        (KJS::CodeBlock::dump):
-        * VM/CodeBlock.h:
-        (KJS::ExpressionRangeInfo::):
-        (KJS::StringJumpTable::offsetForValue):
-        (KJS::StringJumpTable::ctiForValue):
-        (KJS::SimpleJumpTable::add):
-        (KJS::SimpleJumpTable::ctiForValue):
-        * VM/CodeGenerator.cpp:
-        (KJS::prepareJumpTableForStringSwitch):
-        * VM/Machine.cpp:
-        (KJS::Machine::privateExecute):
-        (KJS::Machine::cti_op_switch_string):
-        * VM/Machine.h:
-
-2008-08-28  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Do not recurse on the machine stack when executing op_call.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::emitGetPutArg):
-        (KJS::CTI::emitPutArg):
-        (KJS::CTI::emitPutArgConstant):
-        (KJS::CTI::compileOpCall):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile):
-        * VM/CTI.h:
-        (KJS::):
-        (KJS::CTI::compile):
-        (KJS::CTI::execute):
-        (KJS::CTI::):
-        * VM/Machine.cpp:
-        (KJS::Machine::Machine):
-        (KJS::Machine::execute):
-        (KJS::Machine::cti_op_call_JSFunction):
-        (KJS::Machine::cti_op_call_NotJSFunction):
-        (KJS::Machine::cti_op_ret):
-        (KJS::Machine::cti_op_construct_JSConstruct):
-        (KJS::Machine::cti_op_construct_NotJSConstruct):
-        (KJS::Machine::cti_op_call_eval):
-        * VM/Machine.h:
-        * VM/Register.h:
-        (KJS::Register::Register):
-        * VM/RegisterFile.h:
-        (KJS::RegisterFile::):
-        * kjs/InternalFunction.h:
-        (KJS::InternalFunction::InternalFunction):
-        * kjs/JSFunction.h:
-        (KJS::JSFunction::JSFunction):
-        * kjs/ScopeChain.h:
-        (KJS::ScopeChain::ScopeChain):
-        * masm/IA32MacroAsm.h:
-        (KJS::IA32MacroAssembler::):
-        (KJS::IA32MacroAssembler::emitModRm_opm):
-        (KJS::IA32MacroAssembler::emitCmpl_i32m):
-        (KJS::IA32MacroAssembler::emitCallN_r):
-
-2008-08-28  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Exit instead of crashing in ctiUnsupported and ctiTimedOut.
-
-        * VM/Machine.cpp:
-        (KJS::ctiUnsupported):
-        (KJS::ctiTimedOut):
-
-2008-08-28  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Implement codegen for op_jsr and op_sret.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile):
-        * VM/CTI.h:
-        (KJS::CTI::JSRInfo::JSRInfo):
-        * masm/IA32MacroAsm.h:
-        (KJS::IA32MacroAssembler::emitJmpN_m):
-        (KJS::IA32MacroAssembler::linkAbsoluteAddress):
-
-2008-08-28  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Initial support for exceptions (throw / catch must occur in same CodeBlock).
-
-        * VM/CTI.cpp:
-        (KJS::CTI::emitExceptionCheck):
-        (KJS::CTI::emitCall):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile_pass4_SlowCases):
-        (KJS::CTI::privateCompile):
-        * VM/CTI.h:
-        * VM/CodeBlock.cpp:
-        (KJS::CodeBlock::nativeExceptionCodeForHandlerVPC):
-        * VM/CodeBlock.h:
-        * VM/CodeGenerator.cpp:
-        (KJS::CodeGenerator::emitCatch):
-        * VM/Machine.cpp:
-        (KJS::Machine::throwException):
-        (KJS::Machine::privateExecute):
-        (KJS::ctiUnsupported):
-        (KJS::ctiTimedOut):
-        (KJS::Machine::cti_op_add):
-        (KJS::Machine::cti_op_pre_inc):
-        (KJS::Machine::cti_timeout_check):
-        (KJS::Machine::cti_op_loop_if_less):
-        (KJS::Machine::cti_op_put_by_id):
-        (KJS::Machine::cti_op_get_by_id):
-        (KJS::Machine::cti_op_instanceof):
-        (KJS::Machine::cti_op_del_by_id):
-        (KJS::Machine::cti_op_mul):
-        (KJS::Machine::cti_op_call):
-        (KJS::Machine::cti_op_resolve):
-        (KJS::Machine::cti_op_construct):
-        (KJS::Machine::cti_op_get_by_val):
-        (KJS::Machine::cti_op_resolve_func):
-        (KJS::Machine::cti_op_sub):
-        (KJS::Machine::cti_op_put_by_val):
-        (KJS::Machine::cti_op_lesseq):
-        (KJS::Machine::cti_op_loop_if_true):
-        (KJS::Machine::cti_op_negate):
-        (KJS::Machine::cti_op_resolve_skip):
-        (KJS::Machine::cti_op_div):
-        (KJS::Machine::cti_op_pre_dec):
-        (KJS::Machine::cti_op_jless):
-        (KJS::Machine::cti_op_not):
-        (KJS::Machine::cti_op_jtrue):
-        (KJS::Machine::cti_op_post_inc):
-        (KJS::Machine::cti_op_eq):
-        (KJS::Machine::cti_op_lshift):
-        (KJS::Machine::cti_op_bitand):
-        (KJS::Machine::cti_op_rshift):
-        (KJS::Machine::cti_op_bitnot):
-        (KJS::Machine::cti_op_resolve_with_base):
-        (KJS::Machine::cti_op_mod):
-        (KJS::Machine::cti_op_less):
-        (KJS::Machine::cti_op_neq):
-        (KJS::Machine::cti_op_post_dec):
-        (KJS::Machine::cti_op_urshift):
-        (KJS::Machine::cti_op_bitxor):
-        (KJS::Machine::cti_op_bitor):
-        (KJS::Machine::cti_op_call_eval):
-        (KJS::Machine::cti_op_throw):
-        (KJS::Machine::cti_op_push_scope):
-        (KJS::Machine::cti_op_stricteq):
-        (KJS::Machine::cti_op_nstricteq):
-        (KJS::Machine::cti_op_to_jsnumber):
-        (KJS::Machine::cti_op_in):
-        (KJS::Machine::cti_op_del_by_val):
-        (KJS::Machine::cti_vm_throw):
-        * VM/Machine.h:
-        * kjs/ExecState.h:
-        * masm/IA32MacroAsm.h:
-        (KJS::IA32MacroAssembler::emitCmpl_i32m):
-
-2008-08-28  Mark Rowe  <mrowe@apple.com>
-
-        Rubber-stamped by Oliver Hunt.
-
-        Print debugging info to stderr so that run-webkit-tests can capture it.
-        This makes it easy to check whether test failures are due to unimplemented
-        op codes, missing support for exceptions, etc.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::printOpcodeOperandTypes):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile_pass4_SlowCases):
-        (KJS::CTI::privateCompile):
-        * VM/Machine.cpp:
-        (KJS::Machine::privateExecute):
-        (KJS::ctiException):
-        (KJS::ctiUnsupported):
-        (KJS::Machine::cti_op_call):
-        (KJS::Machine::cti_op_resolve):
-        (KJS::Machine::cti_op_construct):
-        (KJS::Machine::cti_op_get_by_val):
-        (KJS::Machine::cti_op_resolve_func):
-        (KJS::Machine::cti_op_resolve_skip):
-        (KJS::Machine::cti_op_resolve_with_base):
-        (KJS::Machine::cti_op_call_eval):
-
-2008-08-27  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Gavin Barraclough and Maciej Stachowiak.
-
-        Fix fast/js/bitwise-and-on-undefined.html.
-
-        A temporary value in the slow path of op_bitand was being stored in edx, but was
-        being clobbered by emitGetPutArg before we used it.  To fix this, emitGetPutArg
-        now takes a third argument that specifies the scratch register to use when loading
-        from memory.  This allows us to avoid clobbering the temporary in op_bitand.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::emitGetPutArg):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile_pass4_SlowCases):
-        * VM/CTI.h:
-
-2008-08-27  Mark Rowe  <mrowe@apple.com>
-
-        Rubber-stamped by Oliver Hunt.
-
-        Switch CTI on by default.
-
-        * wtf/Platform.h:
-
-2008-08-27  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Fix the build of the full WebKit stack.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj: Mark two new headers as private so they can be pulled in from WebCore.
-        * VM/CTI.h: Fix build issues that show up when compiled with GCC 4.2 as part of WebCore.
-        * wrec/WREC.h: Ditto.
-
-2008-08-27  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Implement op_new_error.  Does not fix any tests as it is always followed by the unimplemented op_throw.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_new_error):
-        * VM/Machine.h:
-
-2008-08-27  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin Barraclough and Geoff Garen.
-
-        Implement op_put_getter and op_put_setter.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_put_getter):
-        (KJS::Machine::cti_op_put_setter):
-        * VM/Machine.h:
-
-2008-08-27  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin Barraclough and Geoff Garen.
-
-        Implement op_del_by_val fixing 3 mozilla tests.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_del_by_val):
-        * VM/Machine.h:
-
-2008-08-27  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Quick & dirty fix to get SamplingTool sampling op_call.
-
-        * VM/SamplingTool.h:
-        (KJS::SamplingTool::callingHostFunction):
-
-2008-08-27  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin Barraclough and Geoff Garen.
-
-        Fix op_put_by_index.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass2_Main): Use emitPutArgConstant instead of emitGetPutArg
-        for the property value.
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_put_by_index): Get the property value from the correct argument.
-
-2008-08-27  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin Barraclough and Geoff Garen.
-
-        Implement op_switch_imm in the CTI fixing 13 mozilla tests.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_switch_imm):
-        * VM/Machine.h:
-
-2008-08-27  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Implement op_switch_char in CTI.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::emitCall):
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile):
-        * VM/CTI.h:
-        (KJS::CallRecord::CallRecord):
-        (KJS::SwitchRecord::SwitchRecord):
-        * VM/CodeBlock.h:
-        (KJS::SimpleJumpTable::SimpleJumpTable::ctiForValue):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_switch_char):
-        * VM/Machine.h:
-        * masm/IA32MacroAsm.h:
-        (KJS::IA32MacroAssembler::):
-        (KJS::IA32MacroAssembler::emitJmpN_r):
-        (KJS::IA32MacroAssembler::getRelocatedAddress):
-        * wtf/Platform.h:
-
-2008-08-26  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Implement op_put_by_index to fix 1 mozilla test.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_put_by_index):
-        * VM/Machine.h:
-
-2008-08-26  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        More fixes from Geoff's review.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::emitGetArg):
-        (KJS::CTI::emitGetPutArg):
-        (KJS::CTI::emitPutArg):
-        (KJS::CTI::emitPutArgConstant):
-        (KJS::CTI::getConstantImmediateNumericArg):
-        (KJS::CTI::emitGetCTIParam):
-        (KJS::CTI::emitPutResult):
-        (KJS::CTI::emitCall):
-        (KJS::CTI::emitJumpSlowCaseIfNotImm):
-        (KJS::CTI::emitJumpSlowCaseIfNotImms):
-        (KJS::CTI::getDeTaggedConstantImmediate):
-        (KJS::CTI::emitFastArithDeTagImmediate):
-        (KJS::CTI::emitFastArithReTagImmediate):
-        (KJS::CTI::emitFastArithPotentiallyReTagImmediate):
-        (KJS::CTI::emitFastArithImmToInt):
-        (KJS::CTI::emitFastArithIntToImmOrSlowCase):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile_pass4_SlowCases):
-        (KJS::CTI::privateCompile):
-        * VM/CTI.h:
-
-2008-08-26  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Gavin Barraclough and Geoff Garen.
-
-        Implement op_jmp_scopes to fix 2 Mozilla tests.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_push_new_scope): Update ExecState::m_scopeChain after calling ARG_setScopeChain.
-        (KJS::Machine::cti_op_jmp_scopes):
-        * VM/Machine.h:
-
-2008-08-26  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        WebKit Regular Expression Compiler. (set ENABLE_WREC = 1 in Platform.h).
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * kjs/regexp.cpp:
-        * kjs/regexp.h:
-        * wrec: Added.
-        * wrec/WREC.cpp: Added.
-        * wrec/WREC.h: Added.
-        * wtf/Platform.h:
-
-2008-08-26  Sam Weinig  <sam@webkit.org>
-
-        Rubber-stamped by Oliver Hunt.
-
-        Remove bogus assertion.
-
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_del_by_id):
-
-2008-08-26  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Implement op_push_new_scope and stub out op_catch.  This fixes 11 Mozilla tests.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_push_new_scope):
-        (KJS::Machine::cti_op_catch):
-        * VM/Machine.h:
-
-2008-08-26  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Clean up op_resolve_base so that it shares its implementation with the bytecode interpreter.
-
-        * VM/Machine.cpp:
-        (KJS::inlineResolveBase):
-        (KJS::resolveBase):
-
-2008-08-26  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Add codegen support for op_instanceof, fixing 15 mozilla tests.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_instanceof):
-        (KJS::Machine::cti_op_del_by_id):
-        * VM/Machine.h:
-        * wtf/Platform.h:
-
-2008-08-26  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Fixes for initial review comments.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::ctiCompileGetArg):
-        (KJS::CTI::ctiCompileGetPutArg):
-        (KJS::CTI::ctiCompilePutResult):
-        (KJS::CTI::ctiCompileCall):
-        (KJS::CTI::CTI):
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::printOpcodeOperandTypes):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile_pass4_SlowCases):
-        (KJS::CTI::privateCompile):
-        * VM/CTI.h:
-        * VM/Register.h:
-        * kjs/JSValue.h:
-
-2008-08-26  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin Barraclough and Geoff Garen.
-
-        Fix up exception checking code.
-
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_call):
-        (KJS::Machine::cti_op_resolve):
-        (KJS::Machine::cti_op_construct):
-        (KJS::Machine::cti_op_resolve_func):
-        (KJS::Machine::cti_op_resolve_skip):
-        (KJS::Machine::cti_op_resolve_with_base):
-        (KJS::Machine::cti_op_call_eval):
-
-2008-08-26  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Fix slowcase for op_post_inc and op_post_dec fixing 2 mozilla tests.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass4_SlowCases):
-
-2008-08-26  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Implement op_in, fixing 8 mozilla tests.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_in):
-        * VM/Machine.h:
-
-2008-08-26  Mark Rowe  <mrowe@apple.com>
-
-        Rubber-stamped by Oliver Hunt.
-
-        Don't hardcode the size of a Register for op_new_array.  Fixes a crash
-        seen during the Mozilla tests.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass2_Main):
-
-2008-08-26  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin Barraclough and Geoff Garen.
-
-        Add support for op_push_scope and op_pop_scope, fixing 20 mozilla tests.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/CTI.h:
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_push_scope):
-        (KJS::Machine::cti_op_pop_scope):
-        * VM/Machine.h:
-
-2008-08-26  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Add codegen support for op_del_by_id, fixing 49 mozilla tests.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-        * VM/Machine.cpp:
-        (KJS::Machine::cti_op_del_by_id):
-        * VM/Machine.h:
-
-2008-08-26  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Gavin Barraclough and Geoff Garen.
-
-        Don't hardcode the size of a Register for op_get_scoped_var and op_put_scoped_var 
-        fixing 513 mozilla tests in debug build.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass2_Main):
-
-2008-08-26  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-        
-        Added code generator support for op_loop, fixing around 60 mozilla tests.
-
-        * VM/CTI.cpp:
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::privateCompile_pass2_Main):
-
-2008-08-26  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Set -fomit-frame-pointer in the correct location.
-
-        * Configurations/JavaScriptCore.xcconfig:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2008-08-26  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoff Garen.
-        
-        Inital cut of CTI, Geoff's review fixes to follow.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/CTI.cpp: Added.
-        (KJS::getJCB):
-        (KJS::CTI::ctiCompileGetArg):
-        (KJS::CTI::ctiCompileGetPutArg):
-        (KJS::CTI::ctiCompilePutArg):
-        (KJS::CTI::ctiCompilePutArgImm):
-        (KJS::CTI::ctiImmediateNumericArg):
-        (KJS::CTI::ctiCompileGetCTIParam):
-        (KJS::CTI::ctiCompilePutResult):
-        (KJS::CTI::ctiCompileCall):
-        (KJS::CTI::slowCaseIfNotImm):
-        (KJS::CTI::slowCaseIfNotImms):
-        (KJS::CTI::ctiFastArithDeTagConstImmediate):
-        (KJS::CTI::ctiFastArithDeTagImmediate):
-        (KJS::CTI::ctiFastArithReTagImmediate):
-        (KJS::CTI::ctiFastArithPotentiallyReTagImmediate):
-        (KJS::CTI::ctiFastArithImmToInt):
-        (KJS::CTI::ctiFastArithIntToImmOrSlowCase):
-        (KJS::CTI::CTI):
-        (KJS::CTI::privateCompile_pass1_Scan):
-        (KJS::CTI::ctiCompileAdd):
-        (KJS::CTI::ctiCompileAddImm):
-        (KJS::CTI::ctiCompileAddImmNotInt):
-        (KJS::CTI::TEMP_HACK_PRINT_TYPES):
-        (KJS::CTI::privateCompile_pass2_Main):
-        (KJS::CTI::privateCompile_pass3_Link):
-        (KJS::CTI::privateCompile_pass4_SlowCases):
-        (KJS::CTI::privateCompile):
-        * VM/CTI.h: Added.
-        (KJS::CTI2Result::CTI2Result):
-        (KJS::CallRecord::CallRecord):
-        (KJS::JmpTable::JmpTable):
-        (KJS::SlowCaseEntry::SlowCaseEntry):
-        (KJS::CTI::compile):
-        (KJS::CTI::LabelInfo::LabelInfo):
-        * VM/CodeBlock.h:
-        (KJS::CodeBlock::CodeBlock):
-        (KJS::CodeBlock::~CodeBlock):
-        * VM/Machine.cpp:
-        (KJS::Machine::execute):
-        (KJS::Machine::privateExecute):
-        (KJS::ctiException):
-        (KJS::ctiUnsupported):
-        (KJS::ctiTimedOut):
-        (KJS::Machine::cti_op_end):
-        (KJS::Machine::cti_op_add):
-        (KJS::Machine::cti_op_pre_inc):
-        (KJS::Machine::cti_timeout_check):
-        (KJS::Machine::cti_op_loop_if_less):
-        (KJS::Machine::cti_op_new_object):
-        (KJS::Machine::cti_op_put_by_id):
-        (KJS::Machine::cti_op_get_by_id):
-        (KJS::Machine::cti_op_mul):
-        (KJS::Machine::cti_op_new_func):
-        (KJS::Machine::cti_op_call):
-        (KJS::Machine::cti_op_ret):
-        (KJS::Machine::cti_op_new_array):
-        (KJS::Machine::cti_op_resolve):
-        (KJS::Machine::cti_op_construct):
-        (KJS::Machine::cti_op_get_by_val):
-        (KJS::Machine::cti_op_resolve_func):
-        (KJS::Machine::cti_op_sub):
-        (KJS::Machine::cti_op_put_by_val):
-        (KJS::Machine::cti_op_lesseq):
-        (KJS::Machine::cti_op_loop_if_true):
-        (KJS::Machine::cti_op_negate):
-        (KJS::Machine::cti_op_resolve_base):
-        (KJS::Machine::cti_op_resolve_skip):
-        (KJS::Machine::cti_op_div):
-        (KJS::Machine::cti_op_pre_dec):
-        (KJS::Machine::cti_op_jless):
-        (KJS::Machine::cti_op_not):
-        (KJS::Machine::cti_op_jtrue):
-        (KJS::Machine::cti_op_post_inc):
-        (KJS::Machine::cti_op_eq):
-        (KJS::Machine::cti_op_lshift):
-        (KJS::Machine::cti_op_bitand):
-        (KJS::Machine::cti_op_rshift):
-        (KJS::Machine::cti_op_bitnot):
-        (KJS::Machine::cti_op_resolve_with_base):
-        (KJS::Machine::cti_op_new_func_exp):
-        (KJS::Machine::cti_op_mod):
-        (KJS::Machine::cti_op_less):
-        (KJS::Machine::cti_op_neq):
-        (KJS::Machine::cti_op_post_dec):
-        (KJS::Machine::cti_op_urshift):
-        (KJS::Machine::cti_op_bitxor):
-        (KJS::Machine::cti_op_new_regexp):
-        (KJS::Machine::cti_op_bitor):
-        (KJS::Machine::cti_op_call_eval):
-        (KJS::Machine::cti_op_throw):
-        (KJS::Machine::cti_op_get_pnames):
-        (KJS::Machine::cti_op_next_pname):
-        (KJS::Machine::cti_op_typeof):
-        (KJS::Machine::cti_op_stricteq):
-        (KJS::Machine::cti_op_nstricteq):
-        (KJS::Machine::cti_op_to_jsnumber):
-        * VM/Machine.h:
-        * VM/Register.h:
-        (KJS::Register::jsValue):
-        (KJS::Register::getJSValue):
-        (KJS::Register::codeBlock):
-        (KJS::Register::scopeChain):
-        (KJS::Register::i):
-        (KJS::Register::r):
-        (KJS::Register::vPC):
-        (KJS::Register::jsPropertyNameIterator):
-        * VM/SamplingTool.cpp:
-        (KJS::):
-        (KJS::SamplingTool::run):
-        (KJS::SamplingTool::dump):
-        * VM/SamplingTool.h:
-        * kjs/JSImmediate.h:
-        (KJS::JSImmediate::zeroImmediate):
-        (KJS::JSImmediate::oneImmediate):
-        * kjs/JSValue.h:
-        * kjs/JSVariableObject.h:
-        (KJS::JSVariableObject::JSVariableObjectData::offsetOf_registers):
-        (KJS::JSVariableObject::offsetOf_d):
-        (KJS::JSVariableObject::offsetOf_Data_registers):
-        * masm: Added.
-        * masm/IA32MacroAsm.h: Added.
-        (KJS::JITCodeBuffer::JITCodeBuffer):
-        (KJS::JITCodeBuffer::putByte):
-        (KJS::JITCodeBuffer::putShort):
-        (KJS::JITCodeBuffer::putInt):
-        (KJS::JITCodeBuffer::getEIP):
-        (KJS::JITCodeBuffer::start):
-        (KJS::JITCodeBuffer::getOffset):
-        (KJS::JITCodeBuffer::reset):
-        (KJS::JITCodeBuffer::copy):
-        (KJS::IA32MacroAssembler::):
-        (KJS::IA32MacroAssembler::emitModRm_rr):
-        (KJS::IA32MacroAssembler::emitModRm_rm):
-        (KJS::IA32MacroAssembler::emitModRm_rmsib):
-        (KJS::IA32MacroAssembler::emitModRm_opr):
-        (KJS::IA32MacroAssembler::emitModRm_opm):
-        (KJS::IA32MacroAssembler::IA32MacroAssembler):
-        (KJS::IA32MacroAssembler::emitInt3):
-        (KJS::IA32MacroAssembler::emitPushl_r):
-        (KJS::IA32MacroAssembler::emitPopl_r):
-        (KJS::IA32MacroAssembler::emitMovl_rr):
-        (KJS::IA32MacroAssembler::emitAddl_rr):
-        (KJS::IA32MacroAssembler::emitAddl_i8r):
-        (KJS::IA32MacroAssembler::emitAddl_i32r):
-        (KJS::IA32MacroAssembler::emitAddl_mr):
-        (KJS::IA32MacroAssembler::emitAndl_rr):
-        (KJS::IA32MacroAssembler::emitAndl_i32r):
-        (KJS::IA32MacroAssembler::emitCmpl_i8r):
-        (KJS::IA32MacroAssembler::emitCmpl_rr):
-        (KJS::IA32MacroAssembler::emitCmpl_rm):
-        (KJS::IA32MacroAssembler::emitCmpl_i32r):
-        (KJS::IA32MacroAssembler::emitCmpw_rm):
-        (KJS::IA32MacroAssembler::emitOrl_rr):
-        (KJS::IA32MacroAssembler::emitOrl_i8r):
-        (KJS::IA32MacroAssembler::emitSubl_rr):
-        (KJS::IA32MacroAssembler::emitSubl_i8r):
-        (KJS::IA32MacroAssembler::emitSubl_i32r):
-        (KJS::IA32MacroAssembler::emitSubl_mr):
-        (KJS::IA32MacroAssembler::emitTestl_i32r):
-        (KJS::IA32MacroAssembler::emitTestl_rr):
-        (KJS::IA32MacroAssembler::emitXorl_i8r):
-        (KJS::IA32MacroAssembler::emitXorl_rr):
-        (KJS::IA32MacroAssembler::emitSarl_i8r):
-        (KJS::IA32MacroAssembler::emitSarl_CLr):
-        (KJS::IA32MacroAssembler::emitShl_i8r):
-        (KJS::IA32MacroAssembler::emitShll_CLr):
-        (KJS::IA32MacroAssembler::emitMull_rr):
-        (KJS::IA32MacroAssembler::emitIdivl_r):
-        (KJS::IA32MacroAssembler::emitCdq):
-        (KJS::IA32MacroAssembler::emitMovl_mr):
-        (KJS::IA32MacroAssembler::emitMovzwl_mr):
-        (KJS::IA32MacroAssembler::emitMovl_rm):
-        (KJS::IA32MacroAssembler::emitMovl_i32r):
-        (KJS::IA32MacroAssembler::emitMovl_i32m):
-        (KJS::IA32MacroAssembler::emitLeal_mr):
-        (KJS::IA32MacroAssembler::emitRet):
-        (KJS::IA32MacroAssembler::JmpSrc::JmpSrc):
-        (KJS::IA32MacroAssembler::JmpDst::JmpDst):
-        (KJS::IA32MacroAssembler::emitCall):
-        (KJS::IA32MacroAssembler::label):
-        (KJS::IA32MacroAssembler::emitUnlinkedJmp):
-        (KJS::IA32MacroAssembler::emitUnlinkedJne):
-        (KJS::IA32MacroAssembler::emitUnlinkedJe):
-        (KJS::IA32MacroAssembler::emitUnlinkedJl):
-        (KJS::IA32MacroAssembler::emitUnlinkedJle):
-        (KJS::IA32MacroAssembler::emitUnlinkedJge):
-        (KJS::IA32MacroAssembler::emitUnlinkedJae):
-        (KJS::IA32MacroAssembler::emitUnlinkedJo):
-        (KJS::IA32MacroAssembler::emitPredictionNotTaken):
-        (KJS::IA32MacroAssembler::link):
-        (KJS::IA32MacroAssembler::copy):
-        * wtf/Platform.h:
-
-2008-08-26  Oliver Hunt  <oliver@apple.com>
-
-        RS=Maciej.
-
-        Enabled -fomit-frame-pointer on Release and Production builds, add additional Profiling build config for shark, etc.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-=== Start merge of squirrelfish-extreme ===
-
-2008-09-06  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej Stachowiak.
-
-        Fix the Mac Debug build by adding symbols that are exported only in a
-        Debug configuration.
-
-        * Configurations/JavaScriptCore.xcconfig:
-        * DerivedSources.make:
-        * JavaScriptCore.Debug.exp: Added.
-        * JavaScriptCore.base.exp: Copied from JavaScriptCore.exp.
-        * JavaScriptCore.exp: Removed.
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-
-2008-09-05  Darin Adler  <darin@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=20681
-          JSPropertyNameIterator functions need to be inlined
-
-        1.007x as fast on SunSpider overall
-        1.081x as fast on SunSpider math-cordic
-
-        * VM/JSPropertyNameIterator.cpp: Moved functions out of here.
-        * VM/JSPropertyNameIterator.h:
-        (KJS::JSPropertyNameIterator::JSPropertyNameIterator): Moved
-        this into the header and marked it inline.
-        (KJS::JSPropertyNameIterator::create): Ditto.
-        (KJS::JSPropertyNameIterator::next): Ditto.
-
-2008-09-05  Darin Adler  <darin@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=20673
-          single-character strings are churning in the Identifier table
-
-        1.007x as fast on SunSpider overall
-        1.167x as fast on SunSpider string-fasta
-
-        * JavaScriptCore.exp: Updated.
-        * kjs/SmallStrings.cpp:
-        (KJS::SmallStrings::singleCharacterStringRep): Added.
-        * kjs/SmallStrings.h: Added singleCharacterStringRep for clients that
-        need just a UString, not a JSString.
-        * kjs/identifier.cpp:
-        (KJS::Identifier::add): Added special cases for single character strings
-        so that the UString::Rep that ends up in the identifier table is the one
-        from the single-character string optimization; otherwise we end up having
-        to look it up in the identifier table over and over again.
-        (KJS::Identifier::addSlowCase): Ditto.
-        (KJS::Identifier::checkSameIdentifierTable): Made this function an empty
-        inline in release builds so that callers don't have to put #ifndef NDEBUG
-        at each call site.
-        * kjs/identifier.h:
-        (KJS::Identifier::add): Removed #ifndef NDEBUG around the calls to
-        checkSameIdentifierTable.
-        (KJS::Identifier::checkSameIdentifierTable): Added. Empty inline version
-        for NDEBUG builds.
-
-2008-09-05  Mark Rowe  <mrowe@apple.com>
-
-        Build fix.
-
-        * kjs/JSObject.h: Move the inline virtual destructor after a non-inline
-        virtual function so that the symbol for the vtable is not marked as a
-        weakly exported symbol.
-
-2008-09-05  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=20671
-          JavaScriptCore string manipulation spends too much time in memcpy
-
-        1.011x as fast on SunSpider overall
-        1.028x as fast on SunSpider string tests
-
-        For small strings, use a loop rather than calling memcpy. The loop can
-        be faster because there's no function call overhead, and because it can
-        assume the pointers are aligned instead of checking that. Currently the
-        threshold is set at 20 characters, based on some testing on one particular
-        computer. Later we can tune this for various platforms by setting
-        USTRING_COPY_CHARS_INLINE_CUTOFF appropriately, but it does no great harm
-        if not perfectly tuned.
-
-        * kjs/ustring.cpp:
-        (KJS::overflowIndicator): Removed bogus const.
-        (KJS::maxUChars): Ditto.
-        (KJS::copyChars): Added.
-        (KJS::UString::Rep::createCopying): Call copyChars instead of memcpy.
-        Also eliminated need for const_cast.
-        (KJS::UString::expandPreCapacity): Ditto.
-        (KJS::concatenate): Ditto.
-        (KJS::UString::spliceSubstringsWithSeparators): Ditto.
-        (KJS::UString::append): Ditto.
-
-2008-09-05  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Sam and Alexey.
-
-        Make the profiler work with a null exec state.  This will allow other
-        applications start the profiler to get DTrace probes going without
-        needing a WebView.
-
-        * ChangeLog:
-        * profiler/ProfileGenerator.cpp:
-        (KJS::ProfileGenerator::ProfileGenerator):
-        (KJS::ProfileGenerator::willExecute):
-        (KJS::ProfileGenerator::didExecute):
-        * profiler/Profiler.cpp:
-        (KJS::Profiler::startProfiling):
-        (KJS::Profiler::stopProfiling):
-        (KJS::dispatchFunctionToProfiles):
-
-2008-09-04  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoffrey Garen.
-        
-        Fixed an off-by-one error that would cause the StructureIDChain to
-        be one object too short.
-        
-        Can't construct a test case because other factors make this not crash
-        (yet!).
-
-        * kjs/StructureID.cpp:
-        (KJS::StructureIDChain::StructureIDChain):
-
-2008-09-04  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fixes.
-
-        * JavaScriptCoreSources.bkl:
-
-2008-09-04  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        Fix https://bugs.webkit.org/show_bug.cgi?id=20639.
-        Bug 20639: ENABLE_DASHBOARD_SUPPORT does not need to be a FEATURE_DEFINE
-
-        * Configurations/JavaScriptCore.xcconfig: Remove ENABLE_DASHBOARD_SUPPORT from FEATURE_DEFINES.
-        * wtf/Platform.h: Set ENABLE_DASHBOARD_SUPPORT for PLATFORM(MAC).
-
-2008-09-04  Adele Peterson  <adele@apple.com>
-
-        Build fix.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
-
-2008-09-04  Mark Rowe  <mrowe@apple.com>
-
-        Mac build fix.
-
-        * kjs/config.h: Only check the value of HAVE_CONFIG_H if it is defined.
-
-2008-09-04  Marco Barisione  <marco.barisione@collabora.co.uk>
-
-        Reviewed by Eric Seidel.
-
-        http://bugs.webkit.org/show_bug.cgi?id=20380
-        [GTK][AUTOTOOLS] Include autotoolsconfig.h from config.h
-
-        * kjs/config.h: Include the configuration header generated by
-        autotools if available.
-
-2008-09-04  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon.
-
-        Fix the QtWebKit build to match changes in r36016
-
-        * JavaScriptCore.pri:
-
-2008-09-04  Mark Rowe  <mrowe@apple.com>
-
-        Fix the 64-bit build.
-
-        * VM/CodeBlock.cpp:
-        (KJS::CodeBlock::printStructureID): Store the instruction offset into an unsigned local
-        to avoid a warning related to format specifiers.
-        (KJS::CodeBlock::printStructureIDs): Ditto.
-
-2008-09-04  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Rubber-stamped by Oliver Hunt.
-
-        Correct the spelling of 'entryIndices'.
-
-        * kjs/PropertyMap.cpp:
-        (KJS::PropertyMap::get):
-        (KJS::PropertyMap::getLocation):
-        (KJS::PropertyMap::put):
-        (KJS::PropertyMap::insert):
-        (KJS::PropertyMap::remove):
-        (KJS::PropertyMap::checkConsistency):
-        * kjs/PropertyMap.h:
-        (KJS::PropertyMapHashTable::entries):
-        (KJS::PropertyMap::getOffset):
-        (KJS::PropertyMap::putOffset):
-        (KJS::PropertyMap::offsetForTableLocation):
-
-2008-09-03  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Cameron Zwarich.
-        
-        Fixed <rdar://problem/6193925> REGRESSION: Crash occurs at
-        KJS::Machine::privateExecute() when attempting to load my Mobile Gallery
-        (http://www.me.com/gallery/#home)
-        
-        also
-        
-        https://bugs.webkit.org/show_bug.cgi?id=20633 Crash in privateExecute
-        @ cs.byu.edu
-        
-        The underlying problem was that we would cache prototype properties
-        even if the prototype was a dictionary.
-        
-        The fix is to transition a prototype back from dictionary to normal
-        status when an opcode caches access to it. (This is better than just
-        refusing to cache, since a heavily accessed prototype is almost
-        certainly not a true dictionary.)
-
-        * VM/Machine.cpp:
-        (KJS::Machine::tryCacheGetByID):
-        * kjs/JSObject.h:
-
-2008-09-03  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Sam.
-
-        Clean up Platform.h and add PLATFORM(CHROMIUM), PLATFORM(SKIA) and USE(V8_BINDINGS)
-
-        * Configurations/JavaScriptCore.xcconfig: add missing ENABLE_*
-        * wtf/ASCIICType.h: include <wtf/Assertions.h> since it depends on it.
-        * wtf/Platform.h:
-
-2008-09-03  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Tim.
-
-        Remove the rest of the "zombie" code from the profiler.
-        - There is no longer a need for the ProfilerClient callback mechanism.
-
-        * API/JSProfilerPrivate.cpp:
-        (JSStartProfiling):
-        * JavaScriptCore.exp:
-        * profiler/HeavyProfile.h:
-        * profiler/ProfileGenerator.cpp:
-        (KJS::ProfileGenerator::create):
-        (KJS::ProfileGenerator::ProfileGenerator):
-        * profiler/ProfileGenerator.h:
-        (KJS::ProfileGenerator::profileGroup):
-        * profiler/Profiler.cpp:
-        (KJS::Profiler::startProfiling):
-        (KJS::Profiler::stopProfiling): Immediately return the profile when
-        stopped instead of using a callback.
-        * profiler/Profiler.h:
-        * profiler/TreeProfile.h:
-
-2008-09-03  Adele Peterson  <adele@apple.com>
-
-        Build fix.
-
-        * wtf/win/MainThreadWin.cpp:
-
-2008-09-02  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Darin and Tim.
-
-        Remove most of the "zombie" mode from the profiler.  Next we will need
-        to remove the client callback mechanism in profiles.
-
-        - This simplifies the code, leverages the recent changes I've made in
-        getting line numbers from SquirrelFish, and is a slight speed
-        improvement on SunSpider.
-        - Also the "zombie" mode was a constant source of odd edge cases and
-        obscure bugs so it's good to remove since all of its issues may not have
-        been found.
-
-        * API/JSProfilerPrivate.cpp: No need to call didFinishAllExecution() any
-        more.
-        (JSEndProfiling):
-        * JavaScriptCore.exp: Export the new signature of retrieveLastCaller()
-        * VM/Machine.cpp:
-        (KJS::Machine::execute): No need to call didFinishAllExecution() any
-        more.
-        (KJS::Machine::retrieveCaller): Now operates on InternalFunctions now
-        since the RegisterFile is no longer guaranteeded to store only
-        JSFunctions
-        (KJS::Machine::retrieveLastCaller): Now also retrieve the function's
-        name
-        (KJS::Machine::callFrame): A result of changing retrieveCaller()
-        * VM/Machine.h:
-        * VM/Register.h: 
-        * kjs/JSGlobalObject.cpp:
-        (KJS::JSGlobalObject::~JSGlobalObject):
-        * kjs/nodes.h:
-        * profiler/ProfileGenerator.cpp:
-        (KJS::ProfileGenerator::create): Now pass the original exec and get the
-        global exec and client when necessary.  We need the original exec so we
-        can have the stack frame where profiling started.
-        (KJS::ProfileGenerator::ProfileGenerator): ditto.
-        (KJS::ProfileGenerator::addParentForConsoleStart): This is where the 
-        parent to star of the profile is added, if there is one.
-        (KJS::ProfileGenerator::willExecute): Remove uglyness!
-        (KJS::ProfileGenerator::didExecute): Ditto!
-        (KJS::ProfileGenerator::stopProfiling):
-        (KJS::ProfileGenerator::removeProfileStart): Use a better way to find
-        and remove the function we are looking for.
-        (KJS::ProfileGenerator::removeProfileEnd): Ditto.
-        * profiler/ProfileGenerator.h:
-        (KJS::ProfileGenerator::client):
-        * profiler/ProfileNode.cpp:
-        (KJS::ProfileNode::removeChild): Add a better way to remove a child from
-        a ProfileNode.
-        (KJS::ProfileNode::stopProfiling):
-        (KJS::ProfileNode::debugPrintData): Modified a debug-only diagnostic
-        function to be sane.
-        * profiler/ProfileNode.h:
-        * profiler/Profiler.cpp: Change to pass the original exec state.
-        (KJS::Profiler::startProfiling):
-        (KJS::Profiler::stopProfiling):
-        (KJS::Profiler::willExecute):
-        (KJS::Profiler::didExecute):
-        (KJS::Profiler::createCallIdentifier):
-        * profiler/Profiler.h:
-
-2008-09-01  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Implement callOnMainThreadAndWait().
-
-        This will be useful when a background thread needs to perform UI calls synchronously
-        (e.g. an openDatabase() call cannot return until the user answers to a confirmation dialog).
-
-        * wtf/MainThread.cpp:
-        (WTF::FunctionWithContext::FunctionWithContext): Added a ThreadCondition member. When
-        non-zero, the condition is signalled after the function is called.
-        (WTF::mainThreadFunctionQueueMutex): Renamed from functionQueueMutex, sinc this is no longer
-        static. Changed to be initialized from initializeThreading() to avoid lock contention.
-        (WTF::initializeMainThread): On non-Windows platforms, just call mainThreadFunctionQueueMutex.
-        (WTF::dispatchFunctionsFromMainThread): Signal synchronous calls when done.
-        (WTF::callOnMainThread): Updated for functionQueueMutex rename.
-        (WTF::callOnMainThreadAndWait):  Added.
-
-        * wtf/MainThread.h: Added callOnMainThreadAndWait(); initializeMainThread() now exists on
-        all platforms.
-
-        * wtf/win/MainThreadWin.cpp: (WTF::initializeMainThread): Added a callOnMainThreadAndWait()
-        call to initialize function queue mutex.
-
-        * wtf/ThreadingGtk.cpp: (WTF::initializeThreading):
-        * wtf/ThreadingPthreads.cpp: (WTF::initializeThreading):
-        * wtf/ThreadingQt.cpp: (WTF::initializeThreading):
-        Only initialize mainThreadIdentifier on non-Darwin platforms. It was not guaranteed to be
-        accurate on Darwin.
-
-2008-09-03  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        Use isUndefinedOrNull() instead of separate checks for each in op_eq_null
-        and op_neq_null.
-
-        * VM/Machine.cpp:
-        (KJS::Machine::privateExecute):
-
-2008-09-02  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
-
-        Reviewed by Darin Adler.
-
-        Bug 20296: OpcodeStats doesn't build on platforms which don't have mergesort().
-        <https://bugs.webkit.org/show_bug.cgi?id=20296>
-
-        * VM/Opcode.cpp:
-        (KJS::OpcodeStats::~OpcodeStats): mergesort() replaced with qsort()
-
-2008-09-02  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt.
-        
-        Fast path for array.length and string.length.
-        
-        SunSpider says 0.5% faster.
-
-2008-09-02  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Anders Carlsson.
-        
-        Added optimized paths for comparing to null.
-        
-        SunSpider says 0.5% faster.
-
-2008-09-02  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Changed jsDriver.pl to dump the exact text you would need in order to
-        reproduce a test result. This enables a fast workflow where you copy
-        and paste a test failure in the terminal.
-
-        * tests/mozilla/jsDriver.pl:
-
-2008-09-02  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Implemented the rest of Darin's review comments for the 09-01 inline
-        caching patch.
-        
-        SunSpider says 0.5% faster, but that seems like noise.
-
-        * JavaScriptCore.xcodeproj/project.pbxproj: Put PutPropertySlot into
-        its own file, and added BatchedTransitionOptimizer.
-
-        * VM/CodeBlock.cpp:
-        (KJS::CodeBlock::~CodeBlock): Use array indexing instead of a pointer
-        iterator.
-
-        * VM/CodeGenerator.cpp:
-        (KJS::CodeGenerator::CodeGenerator): Used BatchedTransitionOptimizer to
-        make batched put and remove for declared variables fast, without forever
-        pessimizing the global object. Removed the old getDirect/removeDirect hack
-        that tried to do the same in a more limited way.
-
-        * VM/CodeGenerator.h: Moved IdentifierRepHash to the KJS namespace since
-        it doesn't specialize anything in WTF.
-
-        * VM/Machine.cpp:
-        (KJS::Machine::Machine): Nixed the DummyConstruct tag because it was
-        confusingly named.
-
-        (KJS::Machine::execute):  Used BatchedTransitionOptimizer, as above. Fixed
-        up some comments.
-
-        (KJS::cachePrototypeChain): Cast to JSObject*, since it's more specific.
-
-        (KJS::Machine::tryCachePutByID): Use isNull() instead of comparing to
-        jsNull(), since isNull() leaves more options open for the future.
-        (KJS::Machine::tryCacheGetByID): ditto
-        (KJS::Machine::privateExecute): ditto
-
-        * VM/SamplingTool.cpp:
-        (KJS::SamplingTool::dump): Use C++-style cast, to match our style
-        guidelines.
-
-        * kjs/BatchedTransitionOptimizer.h: Added. New class that allows host
-        code to add a batch of properties to an object in an efficient way.
-
-        * kjs/JSActivation.cpp: Use isNull(), as above.
-
-        * kjs/JSArray.cpp: Get rid of DummyConstruct tag, as above.
-        * kjs/JSArray.h:
-
-        * kjs/JSGlobalData.cpp: Nixed two unused StructureIDs.
-        * kjs/JSGlobalData.h:
-
-        * kjs/JSImmediate.cpp: Use isNull(), as above.
-
-        * kjs/JSObject.cpp:
-        (KJS::JSObject::mark): Moved mark tracing code elsewhere, to make this
-        function more readable.
-
-        (KJS::JSObject::put): Use isNull(), as above.
-
-        (KJS::JSObject::createInheritorID): Return a raw pointer, since the
-        object is owned by a data member, not necessarily the caller.
-        * kjs/JSObject.h:
-
-        * kjs/JSString.cpp: Use isNull(), as above.
-
-        * kjs/PropertyMap.h: Updated to use PropertySlot::invalidOffset.
-
-        * kjs/PropertySlot.h: Changed KJS_INVALID_OFFSET to WTF::notFound
-        because C macros are so 80's.
-
-        * kjs/PutPropertySlot.h: Added. Split out of PropertySlot.h. Also renamed
-        PutPropertySlot::SlotType to PutPropertySlot::Type, and slotBase to base,
-        since "slot" was redundant.
-
-        * kjs/StructureID.cpp: Added a new transition *away* from dictionary
-        status, to support BatchedTransitionOptimizer.
-
-        (KJS::StructureIDChain::StructureIDChain): No need to store m_size as
-        a data member, so keep it in a local, which might be faster.
-        * kjs/StructureID.h:
-
-        * kjs/SymbolTable.h: Moved IdentifierRepHash to KJS namespace, as above.
-        * kjs/ustring.h:
-
-2008-09-02  Adam Roben  <aroben@apple.com>
-
-        Windows build fixes
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Add
-        StructureID.{cpp,h} to the project. Also let VS reorder this file.
-        * VM/CodeBlock.cpp: Include StringExtras so that snprintf will be
-        defined on Windows.
-
-2008-09-01  Sam Weinig  <sam@webkit.org>
-
-        Fix release build.
-
-        * JavaScriptCore.exp:
-
-2008-09-01  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Gtk buildfix
-
-        * GNUmakefile.am:
-        * kjs/PropertyMap.cpp: rename Identifier.h to identifier.h
-        * kjs/StructureID.cpp: include JSObject.h
-
-2008-09-01  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Darin Adler.
-
-        First cut at inline caching for access to vanilla JavaScript properties.
-        
-        SunSpider says 4% faster. Tests heavy on dictionary-like access have
-        regressed a bit -- we have a lot of room to improve in this area,
-        but this patch is over-ripe as-is.
-        
-        JSCells now have a StructureID that uniquely identifies their layout,
-        and holds their prototype.
-        
-        JSValue::put takes a PropertySlot& argument, so it can fill in details
-        about where it put a value, for the sake of caching.
-
-        * VM/CodeGenerator.cpp:
-        (KJS::CodeGenerator::CodeGenerator): Avoid calling removeDirect if we
-        can, since it disables inline caching in the global object. This can
-        probably improve in the future.
-
-        * kjs/JSGlobalObject.cpp: Nixed reset(), since it complicates caching, and
-        wasn't really necessary.
-
-        * kjs/JSObject.cpp: Tweaked getter / setter behavior not to rely on the
-        IsGetterSetter flag, since the flag was buggy. This is necessary in order
-        to avoid accidentally accessing a getter / setter as a normal property.
-        
-        Also changed getter / setter creation to honor ReadOnly, matching Mozilla.
-        
-        * kjs/PropertyMap.cpp: Nixed clear(), since it complicates caching and
-        isn't necessary.
-
-        * kjs/Shell.cpp: Moved SamplingTool dumping outside the loop. This allows
-        you to aggregate sampling of multiple files (or the same file repeatedly),
-        which helped me track down regressions.
-
-        * kjs/ustring.h: Moved IdentifierRepHash here to share it.
-
-2008-09-01  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Eagerly allocate the Math object's numeric constants. This avoids
-        constantly reallocating them in loops, and also ensures that the Math
-        object will not use the single property optimization, which makes
-        properties ineligible for caching.
-
-        SunSpider reports a small speedup, in combination with inline caching.
-
-        * kjs/MathObject.cpp:
-        (KJS::MathObject::MathObject):
-        (KJS::MathObject::getOwnPropertySlot):
-        * kjs/MathObject.h:
-
-2008-09-01  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Gtk build fix, not reviewed.
-
-        * GNUmakefile.am: Add SmallStrings.cpp in both release and debug builds
-
-2008-08-31  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 20577: REGRESSION (r36006): Gmail is broken
-        <https://bugs.webkit.org/show_bug.cgi?id=20577>
-
-        r36006 changed stringProtoFuncSubstr() so that it is uses the more
-        efficient jsSubstring(), rather than using UString::substr() and then
-        calling jsString(). However, the change did not account for the case
-        where the start and the length of the substring extend beyond the length
-        of the original string. This patch corrects that.
-
-        * kjs/StringPrototype.cpp:
-        (KJS::stringProtoFuncSubstr):
-
-2008-08-31  Simon Hausmann  <hausmann@wekit.org>
-
-        Unreviewed build fix (with gcc 4.3)
-
-        * kjs/ustring.h: Properly forward declare operator== for UString and
-        the the concatenate functions inside the KJS namespace.
-
-2008-08-30  Darin Adler  <darin@apple.com>
-
-        Reviewed by Maciej.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=20333
-          improve JavaScript speed when handling single-character strings
-
-        1.035x as fast on SunSpider overall.
-        1.127x as fast on SunSpider string tests.
-        1.910x as fast on SunSpider string-base64 test.
-
-        * API/JSObjectRef.cpp:
-        (JSObjectMakeFunction): Removed unneeded explicit construction of UString.
-
-        * GNUmakefile.am: Added SmallStrings.h and SmallStrings.cpp.
-        * JavaScriptCore.pri: Ditto.
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        Ditto.
-        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
-        * JavaScriptCoreSources.bkl: Ditto.
-
-        * JavaScriptCore.exp: Updated.
-
-        * VM/Machine.cpp:
-        (KJS::jsAddSlowCase): Changed to use a code path that doesn't involve
-        a UString constructor. This avoids an extra jump caused by the "in charge"
-        vs. "not in charge" constructors.
-        (KJS::jsAdd): Ditto.
-        (KJS::jsTypeStringForValue): Adopted jsNontrivialString.
-
-        * kjs/ArrayPrototype.cpp:
-        (KJS::arrayProtoFuncToString): Adopted jsEmptyString.
-        (KJS::arrayProtoFuncToLocaleString): Ditto.
-        (KJS::arrayProtoFuncJoin): Ditto.
-        * kjs/BooleanPrototype.cpp:
-        (KJS::booleanProtoFuncToString): Adopted jsNontrivialString.
-        * kjs/DateConstructor.cpp:
-        (KJS::callDate): Ditto.
-        * kjs/DatePrototype.cpp:
-        (KJS::formatLocaleDate): Adopted jsEmptyString and jsNontrivialString.
-        (KJS::dateProtoFuncToString): Ditto.
-        (KJS::dateProtoFuncToUTCString): Ditto.
-        (KJS::dateProtoFuncToDateString): Ditto.
-        (KJS::dateProtoFuncToTimeString): Ditto.
-        (KJS::dateProtoFuncToLocaleString): Ditto.
-        (KJS::dateProtoFuncToLocaleDateString): Ditto.
-        (KJS::dateProtoFuncToLocaleTimeString): Ditto.
-        (KJS::dateProtoFuncToGMTString): Ditto.
-
-        * kjs/ErrorPrototype.cpp:
-        (KJS::ErrorPrototype::ErrorPrototype): Ditto.
-        (KJS::errorProtoFuncToString): Ditto.
-
-        * kjs/JSGlobalData.h: Added SmallStrings.
-
-        * kjs/JSString.cpp:
-        (KJS::jsString): Eliminated the overload that takes a const char*.
-        Added code to use SmallStrings to get strings of small sizes rather
-        than creating a new JSString every time.
-        (KJS::jsSubstring): Added. Used when creating a string from a substring
-        to avoid creating a JSString in cases where the substring will end up
-        empty or as one character.
-        (KJS::jsOwnedString): Added the same code as in jsString.
-
-        * kjs/JSString.h: Added new functions jsEmptyString, jsSingleCharacterString,
-        jsSingleCharacterSubstring, jsSubstring, and jsNontrivialString for various
-        cases where we want to create JSString, and want special handling for small
-        strings.
-        (KJS::JSString::JSString): Added an overload that takes a PassRefPtr of
-        a UString::Rep so you don't have to construct a UString; PassRefPtr can be
-        more efficient.
-        (KJS::jsEmptyString): Added.
-        (KJS::jsSingleCharacterString): Added.
-        (KJS::jsSingleCharacterSubstring): Added.
-        (KJS::jsNontrivialString): Added.
-        (KJS::JSString::getIndex): Adopted jsSingleCharacterSubstring.
-        (KJS::JSString::getStringPropertySlot): Ditto.
-
-        * kjs/NumberPrototype.cpp:
-        (KJS::numberProtoFuncToFixed): Adopted jsNontrivialString.
-        (KJS::numberProtoFuncToExponential): Ditto.
-        (KJS::numberProtoFuncToPrecision): Ditto.
-
-        * kjs/ObjectPrototype.cpp:
-        (KJS::objectProtoFuncToLocaleString): Adopted toThisJSString.
-        (KJS::objectProtoFuncToString): Adopted jsNontrivialString.
-
-        * kjs/RegExpConstructor.cpp: Separated the lastInput value that's used
-        with the lastOvector to return matches from the input value that can be
-        changed via JavaScript. They will be equal in many cases, but not all.
-        (KJS::RegExpConstructor::performMatch): Set input.
-        (KJS::RegExpMatchesArray::RegExpMatchesArray): Ditto.
-        (KJS::RegExpMatchesArray::fillArrayInstance): Adopted jsSubstring. Also,
-        use input rather than lastInput in the appropriate place.
-        (KJS::RegExpConstructor::getBackref): Adopted jsSubstring and jsEmptyString.
-        Added code to handle the case where there is no backref -- before this
-        depended on range checking in UString::substr which is not present in
-        jsSubstring.
-        (KJS::RegExpConstructor::getLastParen): Ditto.
-        (KJS::RegExpConstructor::getLeftContext): Ditto.
-        (KJS::RegExpConstructor::getRightContext): Ditto.
-        (KJS::RegExpConstructor::getValueProperty): Use input rather than lastInput.
-        Also adopt jsEmptyString.
-        (KJS::RegExpConstructor::putValueProperty): Ditto.
-        (KJS::RegExpConstructor::input): Ditto.
-
-        * kjs/RegExpPrototype.cpp:
-        (KJS::regExpProtoFuncToString): Adopt jsNonTrivialString. Also changed to
-        use UString::append to append single characters rather than using += and
-        a C-style string.
-
-        * kjs/SmallStrings.cpp: Added.
-        (KJS::SmallStringsStorage::SmallStringsStorage): Construct the
-        buffer and UString::Rep for all 256 single-character strings for
-        the U+0000 through U+00FF. This covers all the values used in
-        the base64 test as well as most values seen elsewhere on the web
-        as well. It's possible that later we might fix this to only work
-        for U+0000 through U+007F but the others are used quite a bit in
-        the current version of the base64 test.
-        (KJS::SmallStringsStorage::~SmallStringsStorage): Free memory.
-        (KJS::SmallStrings::SmallStrings): Create a set of small strings,
-        initially not created; created later when they are used.
-        (KJS::SmallStrings::~SmallStrings): Deallocate. Not left compiler
-        generated because the SmallStringsStorage class's destructor needs
-        to be visible.
-        (KJS::SmallStrings::mark): Mark all the strings.
-        (KJS::SmallStrings::createEmptyString): Create a cell for the
-        empty string. Called only the first time.
-        (KJS::SmallStrings::createSingleCharacterString): Create a cell
-        for one of the single-character strings. Called only the first time.
-        * kjs/SmallStrings.h: Added.
-
-        * kjs/StringConstructor.cpp:
-        (KJS::stringFromCharCodeSlowCase): Factored out of strinFromCharCode.
-        Only used for cases where the caller does not pass exactly one argument.
-        (KJS::stringFromCharCode): Adopted jsSingleCharacterString.
-        (KJS::callStringConstructor): Adopted jsEmptyString.
-
-        * kjs/StringObject.cpp:
-        (KJS::StringObject::StringObject): Adopted jsEmptyString.
-
-        * kjs/StringPrototype.cpp:
-        (KJS::stringProtoFuncReplace): Adopted jsSubstring.
-        (KJS::stringProtoFuncCharAt): Adopted jsEmptyString and
-        jsSingleCharacterSubstring and also added a special case when the
-        index is an immediate number to avoid conversion to and from floating
-        point, since that's the common case.
-        (KJS::stringProtoFuncCharCodeAt): Ditto.
-        (KJS::stringProtoFuncMatch): Adopted jsSubstring and jsEmptyString.
-        (KJS::stringProtoFuncSlice): Adopted jsSubstring and
-        jsSingleCharacterSubstring. Also got rid of some unneeded locals and
-        removed unneeded code to set the length property of the array, since it
-        is automatically updated as values are added to the array.
-        (KJS::stringProtoFuncSplit): Adopted jsEmptyString.
-        (KJS::stringProtoFuncSubstr): Adopted jsSubstring.
-        (KJS::stringProtoFuncSubstring): Ditto.
-
-        * kjs/collector.cpp:
-        (KJS::Heap::collect): Added a call to mark SmallStrings.
-
-        * kjs/ustring.cpp:
-        (KJS::UString::expandedSize): Made this a static member function since
-        it doesn't need to look at any data members.
-        (KJS::UString::expandCapacity): Use a non-inline function, makeNull, to
-        set the rep to null in failure cases. This avoids adding a PIC branch for
-        the normal case when there is no failure.
-        (KJS::UString::expandPreCapacity): Ditto.
-        (KJS::UString::UString): Ditto.
-        (KJS::concatenate): Refactored the concatenation constructor into this
-        separate function. Calling the concatenation constructor was leading to
-        an extra branch because of the in-charge vs. not-in-charge versions not
-        both being inlined, and this was showing up as nearly 1% on Shark. Also
-        added a special case for when the second string is a single character,
-        since it's a common idiom to build up a string that way and we can do
-        things much more quickly, without involving memcpy for example. Also
-        adopted the non-inline function, nullRep, for the same reason given for
-        makeNull above.
-        (KJS::UString::append): Adopted makeNull for failure cases.
-        (KJS::UString::operator=): Ditto.
-        (KJS::UString::toDouble): Added a special case for converting single
-        character strings to numbers. We're doing this a ton of times while
-        running the base64 test.
-        (KJS::operator==): Added special cases so we can compare single-character
-        strings without calling memcmp. Later we might want to special case other
-        short lengths similarly.
-        (KJS::UString::makeNull): Added.
-        (KJS::UString::nullRep): Added.
-        * kjs/ustring.h: Added declarations for the nullRep and makeNull. Changed
-        expandedSize to be a static member function. Added a declaration of the
-        concatenate function. Removed the concatenation constructor. Rewrote
-        operator+ to use the concatenate function.
-
-2008-08-29  Anders Carlsson  <andersca@apple.com>
-
-        Build fix.
-
-        * VM/Machine.cpp:
-        (KJS::getCPUTime):
-
-2008-08-29  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/6174667> 
-        When a machine is under heavy load, the Slow Script dialog often comes up many times and just gets in the way
-        
-        Instead of using clock time, use the CPU time spent executing the current thread when
-        determining if the script has been running for too long.
-        
-        * VM/Machine.cpp:
-        (KJS::getCPUTime):
-        (KJS::Machine::checkTimeout):
-
-2008-08-28  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Rubber-stamped by Sam Weinig.
-
-        Change 'term' to 'expr' in variable names to standardize terminology.
-
-        * kjs/nodes.cpp:
-        (KJS::BinaryOpNode::emitCode):
-        (KJS::ReverseBinaryOpNode::emitCode):
-        (KJS::ThrowableBinaryOpNode::emitCode):
-        * kjs/nodes.h:
-        (KJS::BinaryOpNode::BinaryOpNode):
-        (KJS::ReverseBinaryOpNode::ReverseBinaryOpNode):
-        (KJS::MultNode::):
-        (KJS::DivNode::):
-        (KJS::ModNode::):
-        (KJS::AddNode::):
-        (KJS::SubNode::):
-        (KJS::LeftShiftNode::):
-        (KJS::RightShiftNode::):
-        (KJS::UnsignedRightShiftNode::):
-        (KJS::LessNode::):
-        (KJS::GreaterNode::):
-        (KJS::LessEqNode::):
-        (KJS::GreaterEqNode::):
-        (KJS::ThrowableBinaryOpNode::):
-        (KJS::InstanceOfNode::):
-        (KJS::InNode::):
-        (KJS::EqualNode::):
-        (KJS::NotEqualNode::):
-        (KJS::StrictEqualNode::):
-        (KJS::NotStrictEqualNode::):
-        (KJS::BitAndNode::):
-        (KJS::BitOrNode::):
-        (KJS::BitXOrNode::):
-        * kjs/nodes2string.cpp:
-        (KJS::MultNode::streamTo):
-        (KJS::DivNode::streamTo):
-        (KJS::ModNode::streamTo):
-        (KJS::AddNode::streamTo):
-        (KJS::SubNode::streamTo):
-        (KJS::LeftShiftNode::streamTo):
-        (KJS::RightShiftNode::streamTo):
-        (KJS::UnsignedRightShiftNode::streamTo):
-        (KJS::LessNode::streamTo):
-        (KJS::GreaterNode::streamTo):
-        (KJS::LessEqNode::streamTo):
-        (KJS::GreaterEqNode::streamTo):
-        (KJS::InstanceOfNode::streamTo):
-        (KJS::InNode::streamTo):
-        (KJS::EqualNode::streamTo):
-        (KJS::NotEqualNode::streamTo):
-        (KJS::StrictEqualNode::streamTo):
-        (KJS::NotStrictEqualNode::streamTo):
-        (KJS::BitAndNode::streamTo):
-        (KJS::BitXOrNode::streamTo):
-        (KJS::BitOrNode::streamTo):
-
-2008-08-28  Alp Toker  <alp@nuanti.com>
-
-        GTK+ dist/build fix. List newly added header files.
-
-        * GNUmakefile.am:
-
-2008-08-28  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Change to throw a ReferenceError at runtime instead of a ParseError
-        at parse time, when the left hand side expression of a for-in statement
-        is not an lvalue.
-
-        * kjs/grammar.y:
-        * kjs/nodes.cpp:
-        (KJS::ForInNode::emitCode):
-
-2008-08-28  Alexey Proskuryakov  <ap@webkit.org>
-
-        Not reviewed, build fix (at least for OpenBSD, posssibly more).
-
-        https://bugs.webkit.org/show_bug.cgi?id=20545
-        missing #include <unistd.h> in JavaScriptCore/VM/SamplingTool.cpp
-
-        * VM/SamplingTool.cpp: add the missing include.
-
-2008-08-26  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Geoff and Cameron.
-
-        <rdar://problem/6174603> Hitting assertion in Register::codeBlock when
-        loading facebook (20516).
-
-        - This was a result of my line numbers change.  After a host function is
-        called the stack does not get reset correctly.
-        - Oddly this also appears to be a slight speedup on SunSpider.
-
-        * VM/Machine.cpp:
-        (KJS::Machine::privateExecute):
-
-2008-08-26  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Geoff and Tim.
-
-        Export new API methods.
-
-        * JavaScriptCore.exp:
-
-2008-08-25  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Geoff, Tim and Mark.
-
-        <rdar://problem/6150623> JSProfiler: It would be nice if the profiles
-        in the console said what file and line number they came from
-        - Lay the foundation for getting line numbers and other data from the
-        JavaScript engine.  With the cleanup in kjs/ExecState this is actually
-        a slight performance improvement.
-
-        * JavaScriptCore.exp: Export retrieveLastCaller() for WebCore.
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * VM/Machine.cpp: Now Host and JS functions set a call frame on the
-        exec state, so this and the profiler code were pulled out of the
-        branches.
-        (KJS::Machine::privateExecute):
-        (KJS::Machine::retrieveLastCaller): This get's the lineNumber, sourceID
-        and sourceURL for the previously called function.
-        * VM/Machine.h:
-        * kjs/ExecState.cpp: Remove references to JSFunction since it's not used
-        anywhere.
-        * kjs/ExecState.h:
-
-2008-08-25  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Ensure that JSGlobalContextRelease() performs garbage collection, even if there are other
-        contexts in the current context's group.
-
-        This is only really necessary when the last reference is released, but there is no way to
-        determine that, and no harm in collecting slightly more often.
-
-        * API/JSContextRef.cpp: (JSGlobalContextRelease): Explicitly collect the heap if it is not
-        being destroyed.
-
-2008-08-24  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 20093: JSC shell does not clear exceptions after it executes toString on an expression
-        <https://bugs.webkit.org/show_bug.cgi?id=20093>
-
-        Clear exceptions after evaluating any code in the JSC shell. We do not
-        report exceptions that are caused by calling toString on the final
-        valued, but at least we avoid incorrect behaviour.
-
-        Also, print any exceptions that occurred while evaluating code at the
-        interactive prompt, not just while evaluating code from a file.
-
-        * kjs/Shell.cpp:
-        (runWithScripts):
-        (runInteractive):
-
-2008-08-24  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Oliver.
-
-        Remove an unnecessary RefPtr to a RegisterID.
-
-        * kjs/nodes.cpp:
-        (KJS::DeleteBracketNode::emitCode):
-
-2008-08-24  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Use the correct version number for when JSGlobalContextCreate was introduced.
-
-        * API/JSContextRef.h:
-
-2008-08-23  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Rubber-stamped by Mark Rowe.
-
-        Remove modelines.
-
-        * API/APICast.h:
-        * API/JSBase.cpp:
-        * API/JSCallbackConstructor.cpp:
-        * API/JSCallbackConstructor.h:
-        * API/JSCallbackFunction.cpp:
-        * API/JSCallbackFunction.h:
-        * API/JSCallbackObject.cpp:
-        * API/JSCallbackObject.h:
-        * API/JSCallbackObjectFunctions.h:
-        * API/JSClassRef.cpp:
-        * API/JSContextRef.cpp:
-        * API/JSObjectRef.cpp:
-        * API/JSProfilerPrivate.cpp:
-        * API/JSStringRef.cpp:
-        * API/JSStringRefBSTR.cpp:
-        * API/JSStringRefCF.cpp:
-        * API/JSValueRef.cpp:
-        * API/tests/JSNode.c:
-        * API/tests/JSNode.h:
-        * API/tests/JSNodeList.c:
-        * API/tests/JSNodeList.h:
-        * API/tests/Node.c:
-        * API/tests/Node.h:
-        * API/tests/NodeList.c:
-        * API/tests/NodeList.h:
-        * API/tests/minidom.c:
-        * API/tests/minidom.js:
-        * API/tests/testapi.c:
-        * API/tests/testapi.js:
-        * JavaScriptCore.pro:
-        * kjs/FunctionConstructor.h:
-        * kjs/FunctionPrototype.h:
-        * kjs/JSArray.h:
-        * kjs/JSString.h:
-        * kjs/JSWrapperObject.cpp:
-        * kjs/NumberConstructor.h:
-        * kjs/NumberObject.h:
-        * kjs/NumberPrototype.h:
-        * kjs/lexer.h:
-        * kjs/lookup.h:
+        * config.h:
+        * jsc.cpp:
         * wtf/Assertions.cpp:
         * wtf/Assertions.h:
-        * wtf/HashCountedSet.h:
-        * wtf/HashFunctions.h:
-        * wtf/HashIterators.h:
-        * wtf/HashMap.h:
-        * wtf/HashSet.h:
-        * wtf/HashTable.h:
-        * wtf/HashTraits.h:
-        * wtf/ListHashSet.h:
-        * wtf/ListRefPtr.h:
-        * wtf/Noncopyable.h:
-        * wtf/OwnArrayPtr.h:
-        * wtf/OwnPtr.h:
-        * wtf/PassRefPtr.h:
+        * wtf/CurrentTime.cpp:
+        (WTF::lowResUTCTime):
+        * wtf/DateMath.cpp:
+        (WTF::getLocalTime):
+        * wtf/MathExtras.h:
         * wtf/Platform.h:
-        * wtf/RefPtr.h:
-        * wtf/RefPtrHashMap.h:
-        * wtf/RetainPtr.h:
-        * wtf/UnusedParam.h:
-        * wtf/Vector.h:
-        * wtf/VectorTraits.h:
-        * wtf/unicode/Unicode.h:
-        * wtf/unicode/icu/UnicodeIcu.h:
-
-2008-08-22  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Oliver.
-
-        Some cleanup to match our coding style.
-
-        * VM/CodeGenerator.h:
-        * VM/Machine.cpp:
-        (KJS::Machine::privateExecute):
-        * kjs/ExecState.cpp:
-        * kjs/ExecState.h:
-        * kjs/completion.h:
-        * kjs/identifier.cpp:
-        (KJS::Identifier::equal):
-        (KJS::CStringTranslator::hash):
-        (KJS::CStringTranslator::equal):
-        (KJS::CStringTranslator::translate):
-        (KJS::UCharBufferTranslator::equal):
-        (KJS::UCharBufferTranslator::translate):
-        (KJS::Identifier::remove):
-        * kjs/operations.h:
-
-2008-08-20  Alexey Proskuryakov  <ap@webkit.org>
-
-        Windows build fix.
-
-        * API/WebKitAvailability.h: Define DEPRECATED_ATTRIBUTE.
-
-2008-08-19  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Geoff Garen.
-
-        Bring back shared JSGlobalData and implicit locking, because too many clients rely on it.
-
-        * kjs/JSGlobalData.cpp:
-        (KJS::JSGlobalData::~JSGlobalData):
-        (KJS::JSGlobalData::JSGlobalData): Re-add shared instance.
-        (KJS::JSGlobalData::sharedInstanceExists): Ditto.
-        (KJS::JSGlobalData::sharedInstance): Ditto.
-        (KJS::JSGlobalData::sharedInstanceInternal): Ditto.
-
-        * API/JSContextRef.h: Deprecated JSGlobalContextCreate(). Added a very conservative
-        description of its threading model (nothing is allowed).
-
-        * API/JSContextRef.cpp:
-        (JSGlobalContextCreate): Use shared JSGlobalData.
-        (JSGlobalContextCreateInGroup): Support passing NULL group to request a unique one.
-        (JSGlobalContextRetain): Added back locking.
-        (JSGlobalContextRelease): Ditto.
-        (JSContextGetGlobalObject): Ditto.
-
-        * API/tests/minidom.c: (main):
-        * API/tests/testapi.c: (main):
-        Switched to JSGlobalContextCreateInGroup() to avoid deprecation warnings.
-
-        * JavaScriptCore.exp: Re-added JSLock methods. Added JSGlobalContextCreateInGroup (d'oh!).
-
-        * API/JSBase.cpp:
-        (JSEvaluateScript):
-        (JSCheckScriptSyntax):
-        (JSGarbageCollect):
-        * API/JSCallbackConstructor.cpp:
-        (KJS::constructJSCallback):
-        * API/JSCallbackFunction.cpp:
-        (KJS::JSCallbackFunction::call):
-        * API/JSCallbackObjectFunctions.h:
-        (KJS::::init):
-        (KJS::::getOwnPropertySlot):
-        (KJS::::put):
-        (KJS::::deleteProperty):
-        (KJS::::construct):
-        (KJS::::hasInstance):
-        (KJS::::call):
-        (KJS::::getPropertyNames):
-        (KJS::::toNumber):
-        (KJS::::toString):
-        (KJS::::staticValueGetter):
-        (KJS::::callbackGetter):
-        * API/JSObjectRef.cpp:
-        (JSObjectMake):
-        (JSObjectMakeFunctionWithCallback):
-        (JSObjectMakeConstructor):
-        (JSObjectMakeFunction):
-        (JSObjectHasProperty):
-        (JSObjectGetProperty):
-        (JSObjectSetProperty):
-        (JSObjectGetPropertyAtIndex):
-        (JSObjectSetPropertyAtIndex):
-        (JSObjectDeleteProperty):
-        (JSObjectCallAsFunction):
-        (JSObjectCallAsConstructor):
-        (JSObjectCopyPropertyNames):
-        (JSPropertyNameArrayRelease):
-        (JSPropertyNameAccumulatorAddName):
-        * API/JSValueRef.cpp:
-        (JSValueIsEqual):
-        (JSValueIsInstanceOfConstructor):
-        (JSValueMakeNumber):
-        (JSValueMakeString):
-        (JSValueToNumber):
-        (JSValueToStringCopy):
-        (JSValueToObject):
-        (JSValueProtect):
-        (JSValueUnprotect):
-        * ForwardingHeaders/JavaScriptCore/JSLock.h: Added.
-        * GNUmakefile.am:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        * kjs/AllInOneFile.cpp:
-        * kjs/JSGlobalData.h:
-        * kjs/JSGlobalObject.cpp:
-        (KJS::JSGlobalObject::~JSGlobalObject):
-        (KJS::JSGlobalObject::init):
-        * kjs/JSLock.cpp: Added.
-        (KJS::createJSLockCount):
-        (KJS::JSLock::lockCount):
-        (KJS::setLockCount):
-        (KJS::JSLock::JSLock):
-        (KJS::JSLock::lock):
-        (KJS::JSLock::unlock):
-        (KJS::JSLock::currentThreadIsHoldingLock):
-        (KJS::JSLock::DropAllLocks::DropAllLocks):
-        (KJS::JSLock::DropAllLocks::~DropAllLocks):
-        * kjs/JSLock.h: Added.
-        (KJS::JSLock::JSLock):
-        (KJS::JSLock::~JSLock):
-        * kjs/Shell.cpp:
-        (functionGC):
-        (jscmain):
-        * kjs/collector.cpp:
-        (KJS::Heap::~Heap):
-        (KJS::Heap::heapAllocate):
-        (KJS::Heap::setGCProtectNeedsLocking):
-        (KJS::Heap::protect):
-        (KJS::Heap::unprotect):
-        (KJS::Heap::collect):
-        * kjs/identifier.cpp:
-        * kjs/interpreter.cpp:
-        (KJS::Interpreter::checkSyntax):
-        (KJS::Interpreter::evaluate):
-        Re-added implicit locking.
-
-2008-08-19  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Tim and Mark.
-
-        Implement DTrace hooks for dashcode and instruments.
-
-        * API/JSProfilerPrivate.cpp: Added. Expose SPI so that profiling can be
-        turned on from a client.  The DTrace probes were added within the
-        profiler mechanism for performance reasons so the profiler must be
-        started to enable tracing.
-        (JSStartProfiling):
-        (JSEndProfiling):
-        * API/JSProfilerPrivate.h: Added. Ditto.
-        * JavaScriptCore.exp: Exposing the start/stop methods to clients.
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * kjs/Tracing.d: Define the DTrace probes.
-        * kjs/Tracing.h: Ditto.
-        * profiler/ProfileGenerator.cpp: Implement the DTrace probes in the
-        profiler.
-        (KJS::ProfileGenerator::willExecute):
-        (KJS::ProfileGenerator::didExecute):
-
-2008-08-19  Steve Falkenburg  <sfalken@apple.com>
-
-        Build fix.
-        
-        * kjs/operations.cpp:
-        (KJS::equal):
-
-2008-08-18  Timothy Hatcher  <timothy@apple.com>
-
-        Fix an assertion when generating a heavy profile because the
-        empty value and deleted value of CallIdentifier where equal.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20439
-
-        Reviewed by Dan Bernstein.
-
-        * profiler/CallIdentifier.h: Make the emptyValue for CallIdentifier
-        use empty strings for URL and function name.
-
-2008-08-12  Darin Adler  <darin@apple.com>
-
-        Reviewed by Geoff.
-
-        - eliminate JSValue::type()
-
-        This will make it slightly easier to change the JSImmediate design without
-        having to touch so many call sites.
-
-        SunSpider says this change is a wash (looked like a slight speedup, but not
-        statistically significant).
-
-        * API/JSStringRef.cpp: Removed include of JSType.h.
-        * API/JSValueRef.cpp: Removed include of JSType.h.
-        (JSValueGetType): Replaced use of JSValue::type() with
-        JSValue::is functions.
-
-        * JavaScriptCore.exp: Updated.
-
-        * VM/JSPropertyNameIterator.cpp: Removed type() implementation.
-        (KJS::JSPropertyNameIterator::toPrimitive): Changed to take
-        PreferredPrimitiveType argument instead of JSType.
-        * VM/JSPropertyNameIterator.h: Ditto.
-
-        * VM/Machine.cpp:
-        (KJS::fastIsNumber): Updated for name change.
-        (KJS::fastToInt32): Ditto.
-        (KJS::fastToUInt32): Ditto.
-        (KJS::jsAddSlowCase): Updated toPrimitive caller for change from
-        JSType to PreferredPrimitiveType.
-        (KJS::jsAdd): Replaced calls to JSValue::type() with calls to
-        JSValue::isString().
-        (KJS::jsTypeStringForValue): Replaced calls to JSValue::type()
-        with multiple calls to JSValue::is -- we could make this a
-        virtual function instead if we want to have faster performance.
-        (KJS::Machine::privateExecute): Renamed JSImmediate::toTruncatedUInt32
-        to JSImmediate::getTruncatedUInt32 for consistency with other functions.
-        Changed two calls of JSValue::type() to JSValue::isString().
-
-        * kjs/GetterSetter.cpp:
-        (KJS::GetterSetter::toPrimitive): Changed to take
-        PreferredPrimitiveType argument instead of JSType.
-        (KJS::GetterSetter::isGetterSetter): Added.
-        * kjs/GetterSetter.h:
-
-        * kjs/JSCell.cpp:
-        (KJS::JSCell::isString): Added.
-        (KJS::JSCell::isGetterSetter): Added.
-        (KJS::JSCell::isObject): Added.
-
-        * kjs/JSCell.h: Eliminated type function. Added isGetterSetter.
-        Made isString and isObject virtual. Changed toPrimitive to take
-        PreferredPrimitiveType argument instead of JSType.
-        (KJS::JSCell::isNumber): Use Heap::isNumber for faster performance.
-        (KJS::JSValue::isGetterSetter): Added.
-        (KJS::JSValue::toPrimitive): Changed to take
-        PreferredPrimitiveType argument instead of JSType.
-
-        * kjs/JSImmediate.h: Removed JSValue::type() and replaced
-        JSValue::toTruncatedUInt32 with JSValue::getTruncatedUInt32.
-        (KJS::JSImmediate::isEitherImmediate): Added.
-
-        * kjs/JSNotAnObject.cpp:
-        (KJS::JSNotAnObject::toPrimitive): Changed to take
-        PreferredPrimitiveType argument instead of JSType.
-        * kjs/JSNotAnObject.h: Ditto.
-        * kjs/JSNumberCell.cpp:
-        (KJS::JSNumberCell::toPrimitive): Ditto.
-        * kjs/JSNumberCell.h:
-        (KJS::JSNumberCell::toInt32): Renamed from fastToInt32. There's no
-        other "slow" version of this once you have a JSNumberCell, so there's
-        no need for "fast" in the name. It's a feature that this hides the
-        base class toInt32, which does the same job less efficiently (and has
-        an additional ExecState argument).
-        (KJS::JSNumberCell::toUInt32): Ditto.
-
-        * kjs/JSObject.cpp:
-        (KJS::callDefaultValueFunction): Use isGetterSetter instead of type.
-        (KJS::JSObject::getPrimitiveNumber): Use PreferredPrimitiveType.
-        (KJS::JSObject::defaultValue): Ditto.
-        (KJS::JSObject::defineGetter): Use isGetterSetter.
-        (KJS::JSObject::defineSetter): Ditto.
-        (KJS::JSObject::lookupGetter): Ditto.
-        (KJS::JSObject::lookupSetter): Ditto.
-        (KJS::JSObject::toNumber): Use PreferredPrimitiveType.
-        (KJS::JSObject::toString): Ditto.
-        (KJS::JSObject::isObject): Added.
-
-        * kjs/JSObject.h:
-        (KJS::JSObject::inherits): Call the isObject from JSCell; it's now
-        hidden by our override of isObject.
-        (KJS::JSObject::getOwnPropertySlotForWrite): Use isGetterSetter
-        instead of type.
-        (KJS::JSObject::getOwnPropertySlot): Ditto.
-        (KJS::JSObject::toPrimitive): Use PreferredPrimitiveType.
-
-        * kjs/JSString.cpp:
-        (KJS::JSString::toPrimitive): Use PreferredPrimitiveType.
-        (KJS::JSString::isString): Added.
-        * kjs/JSString.h: Ditto.
-
-        * kjs/JSValue.h: Removed type(), added isGetterSetter(). Added
-        PreferredPrimitiveType enum and used it as the argument for the
-        toPrimitive function.
-        (KJS::JSValue::getBoolean): Simplified a bit an removed a branch.
-
-        * kjs/collector.cpp:
-        (KJS::typeName): Changed to use JSCell::is functions instead of
-        calling JSCell::type.
-
-        * kjs/collector.h:
-        (KJS::Heap::isNumber): Renamed from fastIsNumber.
-
-        * kjs/nodes.h: Added now-needed include of JSType, since the type
-        is used here to record types of values in the tree.
-
-        * kjs/operations.cpp:
-        (KJS::equal): Rewrote to no longer depend on type().
-        (KJS::strictEqual): Ditto.
-
-2008-08-18  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Tim.
-
-        If there are no nodes in a profile all the time should be attributed to
-        (idle)
-
-        * profiler/Profile.cpp: If ther are no nodes make sure we still process
-        the head.
-        (KJS::Profile::forEach):
-        * profiler/ProfileGenerator.cpp: Remove some useless code.
-        (KJS::ProfileGenerator::stopProfiling):
-
-2008-08-18  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Maciej.
-
-        Make JSGlobalContextRetain/Release actually work.
-
-        * API/JSContextRef.cpp:
-        (JSGlobalContextRetain):
-        (JSGlobalContextRelease):
-        Ref/deref global data to give checking for globalData.refCount() some sense.
-
-        * API/tests/testapi.c: (main): Added a test for this bug.
-
-        * kjs/JSGlobalData.cpp:
-        (KJS::JSGlobalData::~JSGlobalData):
-        While checking for memory leaks, found that JSGlobalData::emptyList has changed to
-        a pointer, but it was not destructed, causing a huge leak in run-webkit-tests --threaded.
-
-2008-08-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej.
-
-        Change the counting of constants so that preincrement and predecrement of
-        const local variables are considered unexpected loads.
-
-        * kjs/nodes.cpp:
-        (KJS::PrefixResolveNode::emitCode):
-        * kjs/nodes.h:
-        (KJS::ScopeNode::neededConstants):
-
-2008-08-17  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        <rdar://problem/6150322> In Gmail, a crash occurs at KJS::Machine::privateExecute() when applying list styling to text after a quote had been removed
-        <https://bugs.webkit.org/show_bug.cgi?id=20386>
-
-        This crash was caused by "depth()" incorrectly determining the scope depth 
-        of a 0 depth function without a full scope chain.  Because such a function
-        would not have an activation the depth function would return the scope depth
-        of the parent frame, thus triggering an incorrect unwind.  Any subsequent 
-        look up that walked the scope chain would result in incorrect behaviour,
-        leading to a crash or incorrect variable resolution.  This can only actually
-        happen in try...finally statements as that's the only path that can result in
-        the need to unwind the scope chain, but not force the function to need a
-        full scope chain.
-
-        The fix is simply to check for this case before attempting to walk the scope chain.
-
-        * VM/Machine.cpp:
-        (KJS::depth):
-        (KJS::Machine::throwException):
-
-2008-08-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej.
-
-        Bug 20419: Remove op_jless
-        <https://bugs.webkit.org/show_bug.cgi?id=20419>
-
-        Remove op_jless, which is rarely used now that we have op_loop_if_less.
-
-        * VM/CodeBlock.cpp:
-        (KJS::CodeBlock::dump):
-        * VM/CodeGenerator.cpp:
-        (KJS::CodeGenerator::emitJumpIfTrue):
-        * VM/Machine.cpp:
-        (KJS::Machine::privateExecute):
-        * VM/Opcode.h:
-
-2008-08-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Dan Bernstein.
-
-        Fix a typo in r35807 that is also causing build failures for
-        non-AllInOne builds.
-
-        * kjs/NumberConstructor.cpp:
-
-2008-08-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Made room for a free word in JSCell.
-        
-        SunSpider says no change.
-        
-        I changed JSCallbackObjectData, Arguments, JSArray, and RegExpObject to
-        store auxiliary data in a secondary structure.
-
-        I changed InternalFunction to store the function's name in the property
-        map.
-        
-        I changed JSGlobalObjectData to use a virtual destructor, so WebCore's
-        JSDOMWindowBaseData could inherit from it safely. (It's a strange design
-        for JSDOMWindowBase to allocate an object that JSGlobalObject deletes,
-        but that's really our only option, given the size constraint.)
-        
-        I also added a bunch of compile-time ASSERTs, and removed lots of comments
-        in JSObject.h because they were often out of date, and they got in the
-        way of reading what was actually going on.
-        
-        Also renamed JSArray::getLength to JSArray::length, to match our style
-        guidelines.
-
-2008-08-16  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Oliver Hunt.
-        
-        Sped up property access for array.length and string.length by adding a
-        mechanism for returning a temporary value directly instead of returning
-        a pointer to a function that retrieves the value.
-        
-        Also removed some unused cruft from PropertySlot.
-        
-        SunSpider says 0.5% - 1.2% faster.
-
-        NOTE: This optimization is not a good idea in general, because it's
-        actually a pessimization in the case of resolve for assignment,
-        and it may get in the way of other optimizations in the future.
-        
-2008-08-16  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Disable dead code stripping in debug builds.
-
-        * Configurations/Base.xcconfig:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/StringExtras.h:
+        * wtf/Threading.h:
+        * wtf/win/MainThreadWin.cpp:
 
-2008-08-15  Mark Rowe  <mrowe@apple.com>
+2009-06-17  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        <rdar://problem/6143072> FastMallocZone's enumeration code makes assumptions about handling of remote memory regions that overlap
-
-        * wtf/FastMalloc.cpp:
-        (WTF::TCMalloc_Central_FreeList::enumerateFreeObjects): Don't directly compare pointers mapped into the local process with
-        a pointer that has not been mapped.  Instead, calculate a local address for the pointer and compare with that.
-        (WTF::TCMallocStats::FreeObjectFinder::findFreeObjects): Pass in the remote address of the central free list so that it can
-        be used when calculating local addresses.
-        (WTF::TCMallocStats::FastMallocZone::enumerate): Ditto.
-
-2008-08-15  Mark Rowe  <mrowe@apple.com>
-
-        Rubber-stamped by Geoff Garen.
-
-        <rdar://problem/6139914> Please include a _debug version of JavaScriptCore framework
-
-        * Configurations/Base.xcconfig: Factor out the debug-only settings so that they can shared
-        between the Debug configuration and debug Production variant.
-        * JavaScriptCore.xcodeproj/project.pbxproj: Enable the debug variant.
-
-2008-08-15  Mark Rowe  <mrowe@apple.com>
-
-        Fix the 64-bit build.
-
-        Add extra cast to avoid warnings about loss of precision when casting from
-        JSValue* to an integer type.
+        <rdar://problem/6974175> ASSERT in JITStubs.cpp at appsaccess.apple.com
 
-        * kjs/JSImmediate.h:
-        (KJS::JSImmediate::intValue):
-        (KJS::JSImmediate::uintValue):
+        Remove PropertySlot::putValue - PropertySlots should only be used for getting,
+        not putting.  Rename JSGlobalObject::getOwnPropertySlot to hasOwnPropertyForWrite,
+        which is what it really was being used to ask, and remove some other getOwnPropertySlot
+        & getOwnPropertySlotForWrite methods, which were unused and likely to lead to confusion.
 
-2008-08-15  Alexey Proskuryakov  <ap@webkit.org>
-
-        Still fixing Windows build.
-
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make: Added OpaqueJSString
-        to yet another place.
-
-2008-08-15  Alexey Proskuryakov  <ap@webkit.org>
-
-        Trying to fix non-Apple builds.
-
-        * ForwardingHeaders/JavaScriptCore/OpaqueJSString.h: Added.
-
-2008-08-15  Gavin Barraclough  <barraclough@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Allow JSImmediate to hold 31 bit signed integer immediate values.  The low two bits of a
-        JSValue* are a tag, with the tag value 00 indicating the JSValue* is a pointer to a
-        JSCell.  Non-zero tag values used to indicate that the JSValue* is not a real pointer,
-        but instead holds an immediate value encoded within the pointer.  This patch changes the
-        encoding so both the tag values 01 and 11 indicate the value is a signed integer, allowing
-        a 31 bit value to be stored.  All other immediates are tagged with the value 10, and
-        distinguished by a secondary tag.
-
-        Roughly +2% on SunSpider.
-
-        * kjs/JSImmediate.h: Encoding of JSImmediates has changed - see comment at head of file for
-                             descption of new layout.
-
-2008-08-15  Alexey Proskuryakov  <ap@webkit.org>
-
-        More build fixes.
-
-        * API/OpaqueJSString.h: Add a namespace to friend declaration to appease MSVC.
-        * API/JSStringRefCF.h: (JSStringCreateWithCFString) Cast UniChar* to UChar* explicitly.
-        * JavaScriptCore.exp: Added OpaqueJSString::create(const KJS::UString&) to fix WebCore build.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::hasOwnPropertyForWrite):
+        * runtime/JSObject.h:
+        * runtime/JSStaticScopeObject.cpp:
+        * runtime/JSStaticScopeObject.h:
+        * runtime/PropertySlot.h:
 
-2008-08-15  Alexey Proskuryakov  <ap@webkit.org>
+2009-06-16  Gavin Barraclough  <barraclough@apple.com>
 
-        Build fix.
+        Reviewed by Oliver hunt.
 
-        * JavaScriptCore.xcodeproj/project.pbxproj: Marked OpaqueJSString as private
+        Temporarily partially disable r44492, since this is causing some problems on internal builds.
 
-        * kjs/identifier.cpp:
-        (KJS::Identifier::checkSameIdentifierTable):
-        * kjs/identifier.h:
-        (KJS::Identifier::add):
-        Since checkSameIdentifierTable is exported for debug build's sake, gcc wants it to be
-        non-inline in release builds, too.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_throw):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
 
-        * JavaScriptCore.exp: Don't export inline OpaqueJSString destructor.
+2009-06-16  Sam Weinig  <sam@webkit.org>
 
-2008-08-15  Alexey Proskuryakov  <ap@webkit.org>
+        Fix windows build.
 
-        Reviewed by Geoff Garen.
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
 
-        JSStringRef is created context-free, but can get linked to one via an identifier table,
-        breaking an implicit API contract.
-
-        Made JSStringRef point to OpaqueJSString, which is a new string object separate from UString.
-
-        * API/APICast.h: Removed toRef/toJS conversions for JSStringRef, as this is no longer a
-        simple typecast.
-
-        * kjs/identifier.cpp:
-        (KJS::Identifier::checkSameIdentifierTable):
-        * kjs/identifier.h:
-        (KJS::Identifier::add):
-        (KJS::UString::checkSameIdentifierTable):
-        Added assertions to verify that an identifier is not being added to a different JSGlobalData.
-
-        * API/JSObjectRef.cpp:
-        (OpaqueJSPropertyNameArray::OpaqueJSPropertyNameArray): Changed OpaqueJSPropertyNameArray to
-        hold JSStringRefs. This is necessary to avoid having to construct (and leak) a new instance
-        in JSPropertyNameArrayGetNameAtIndex(), now that making a JSStringRef is not just a typecast.
-
-        * API/OpaqueJSString.cpp: Added.
-        (OpaqueJSString::create):
-        (OpaqueJSString::ustring):
-        (OpaqueJSString::identifier):
-        * API/OpaqueJSString.h: Added.
-        (OpaqueJSString::create):
-        (OpaqueJSString::characters):
-        (OpaqueJSString::length):
-        (OpaqueJSString::OpaqueJSString):
-        (OpaqueJSString::~OpaqueJSString):
-
-        * API/JSBase.cpp:
-        (JSEvaluateScript):
-        (JSCheckScriptSyntax):
-        * API/JSCallbackObjectFunctions.h:
-        (KJS::::getOwnPropertySlot):
-        (KJS::::put):
-        (KJS::::deleteProperty):
-        (KJS::::staticValueGetter):
-        (KJS::::callbackGetter):
-        * API/JSStringRef.cpp:
-        (JSStringCreateWithCharacters):
-        (JSStringCreateWithUTF8CString):
-        (JSStringRetain):
-        (JSStringRelease):
-        (JSStringGetLength):
-        (JSStringGetCharactersPtr):
-        (JSStringGetMaximumUTF8CStringSize):
-        (JSStringGetUTF8CString):
-        (JSStringIsEqual):
-        * API/JSStringRefCF.cpp:
-        (JSStringCreateWithCFString):
-        (JSStringCopyCFString):
-        * API/JSValueRef.cpp:
-        (JSValueMakeString):
-        (JSValueToStringCopy):
-        Updated to use OpaqueJSString.
-
-        * GNUmakefile.am:
-        * JavaScriptCore.exp:
-        * JavaScriptCore.pri:
-        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        * JavaScriptCoreSources.bkl:
-        Added OpaqueJSString.
-
-2008-08-14  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Tim.
-
-        <rdar://problem/6115819> Notify of profile in console
-        - Profiles now have a unique ID so that they can be linked to the
-        console message that announces that a profile completed.
-
-        * profiler/HeavyProfile.cpp: 
-        (KJS::HeavyProfile::HeavyProfile):
-        * profiler/Profile.cpp:
-        (KJS::Profile::create):
-        (KJS::Profile::Profile):
-        * profiler/Profile.h:
-        (KJS::Profile::uid):
-        * profiler/ProfileGenerator.cpp:
-        (KJS::ProfileGenerator::create):
-        (KJS::ProfileGenerator::ProfileGenerator):
-        * profiler/ProfileGenerator.h:
-        * profiler/Profiler.cpp:
-        (KJS::Profiler::startProfiling):
-        * profiler/TreeProfile.cpp:
-        (KJS::TreeProfile::create):
-        (KJS::TreeProfile::TreeProfile):
-        * profiler/TreeProfile.h:
-
-2008-08-13  Geoffrey Garen  <ggaren@apple.com>
+2009-06-16  Sam Weinig  <sam@webkit.org>
 
         Reviewed by Oliver Hunt.
-        
-        Nixed a PIC branch from JSObject::getOwnPropertySlot, by forcing
-        fillGetterProperty, which references a global function pointer,
-        out-of-line.
-        
-        .2% SunSpider speedup, 4.3% access-nbody speedup, 8.7% speedup on a
-        custom property access benchmark for objects with one property.
-
-        * kjs/JSObject.cpp:
-        (KJS::JSObject::fillGetterPropertySlot):
-
-2008-08-13  Alp Toker  <alp@nuanti.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20349
-        WTF::initializeThreading() fails if threading is already initialized
-
-        Fix threading initialization logic to support cases where
-        g_thread_init() has already been called elsewhere.
-
-        Resolves database-related crashers reported in several applications.
-
-        * wtf/ThreadingGtk.cpp:
-        (WTF::initializeThreading):
-
-2008-08-13  Brad Hughes <bhughes@trolltech.com>
-
-        Reviewed by Simon.
-
-        Fix compiling of QtWebKit in release mode with the Intel C++ Compiler for Linux
-
-        The latest upgrade of the intel compiler allows us to compile all of
-        Qt with optimizations enabled (yay!).
-
-        * JavaScriptCore.pro:
-
-2008-08-12  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Add peephole optimisation to 'op_not... jfalse...' (eg. if(!...) )
 
-        This is a very slight win in sunspider, and a fairly substantial win
-        in hot code that does if(!...), etc.
+        Initialize m_bytecodeIndex to -1 in JIT, and correctly initialize
+        it for each type of stub using the return address to find the correct
+        offset.
 
-        * VM/CodeGenerator.cpp:
-        (KJS::CodeGenerator::retrieveLastUnaryOp):
-        (KJS::CodeGenerator::rewindBinaryOp):
-        (KJS::CodeGenerator::rewindUnaryOp):
-        (KJS::CodeGenerator::emitJumpIfFalse):
-        * VM/CodeGenerator.h:
-
-2008-08-12  Dan Bernstein  <mitz@apple.com>
-
-        - JavaScriptCore part of <rdar://problem/6121636>
-          Make fast*alloc() abort() on failure and add "try" variants that
-          return NULL on failure.
-
-        Reviewed by Darin Adler.
-
-        * JavaScriptCore.exp: Exported tryFastCalloc().
-        * VM/RegisterFile.h:
-        (KJS::RegisterFile::RegisterFile): Removed an ASSERT().
-        * kjs/JSArray.cpp:
-        (KJS::JSArray::putSlowCase): Changed to use tryFastRealloc().
-        (KJS::JSArray::increaseVectorLength): Ditto.
-        * kjs/ustring.cpp:
-        (KJS::allocChars): Changed to use tryFastMalloc().
-        (KJS::reallocChars): Changed to use tryFastRealloc().
-        * wtf/FastMalloc.cpp:
-        (WTF::fastZeroedMalloc): Removed null checking of fastMalloc()'s result
-        and removed extra call to InvokeNewHook().
-        (WTF::tryFastZeroedMalloc): Added. Uses tryFastMalloc().
-        (WTF::tryFastMalloc): Renamed fastMalloc() to this.
-        (WTF::fastMalloc): Added. This version abort()s if allocation fails.
-        (WTF::tryFastCalloc): Renamed fastCalloc() to this.
-        (WTF::fastCalloc): Added. This version abort()s if allocation fails.
-        (WTF::tryFastRealloc): Renamed fastRealloc() to this.
-        (WTF::fastRealloc): Added. This version abort()s if allocation fails.
-        (WTF::do_malloc): Made this a function template. When the abortOnFailure
-        template parameter is set, the function abort()s on failure to allocate.
-        Otherwise, it sets errno to ENOMEM and returns zero.
-        (WTF::TCMallocStats::fastMalloc): Defined to abort() on failure.
-        (WTF::TCMallocStats::tryFastMalloc): Added. Does not abort() on
-        failure.
-        (WTF::TCMallocStats::fastCalloc): Defined to abort() on failure.
-        (WTF::TCMallocStats::tryFastCalloc): Added. Does not abort() on
-        failure.
-        (WTF::TCMallocStats::fastRealloc): Defined to abort() on failure.
-        (WTF::TCMallocStats::tryFastRealloc): Added. Does not abort() on
-        failure.
-        * wtf/FastMalloc.h: Declared the "try" variants.
-
-2008-08-11  Adam Roben  <aroben@apple.com>
-
-        Move WTF::notFound into its own header so that it can be used
-        independently of Vector
-
-        Rubberstamped by Darin Adler.
-
-        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
-        * JavaScriptCore.xcodeproj/project.pbxproj:
-        Added NotFound.h to the project.
-        * wtf/NotFound.h: Added. Moved the notFound constant here...
-        * wtf/Vector.h: ...from here.
-
-2008-08-11  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        <rdar://problem/6130393> REGRESSION: PhotoBooth hangs after launching under TOT Webkit
-
-        * API/JSContextRef.cpp: (JSGlobalContextRelease): Corrected a comment.
-
-        * kjs/collector.cpp: (KJS::Heap::~Heap): Ensure that JSGlobalData is not deleted while
-        sweeping the heap.
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdSelfList):
+        (JSC::JIT::compileGetByIdProtoList):
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdTransition):
+        (JSC::JIT::compileCTIMachineTrampolines):
+        (JSC::JIT::compilePatchGetArrayLength):
+        * jit/JITStubCall.h:
+        (JSC::JITStubCall::call):
 
-== Rolled over to ChangeLog-2008-08-10 ==
+== Rolled over to ChangeLog-2009-06-16 ==
diff --git a/src/3rdparty/webkit/JavaScriptCore/ChangeLog-2007-10-14 b/src/3rdparty/webkit/JavaScriptCore/ChangeLog-2007-10-14
index a91f1ff..693f966 100644
--- a/src/3rdparty/webkit/JavaScriptCore/ChangeLog-2007-10-14
+++ b/src/3rdparty/webkit/JavaScriptCore/ChangeLog-2007-10-14
@@ -756,7 +756,7 @@
 
         * wtf/Platform.h: Also test if __arm__ is defined.
 
-2007-08-25  Peter Kasting <zerodpx@gmail.org>
+2007-08-25  Peter Kasting <pkasting@google.com>
 
         Reviewed by Maciej Stachowiak.
 
@@ -766,7 +766,7 @@
         * wtf/Vector.h:
         (WTF::Vector::operator[]): Only provide versions of operator[] that takes a size_t argument.
 
-2007-08-25  Peter Kasting <zerodpx@gmail.org>
+2007-08-25  Peter Kasting <pkasting@google.com>
 
         Reviewed by Sam Weinig.
 
@@ -786,7 +786,7 @@
 
         * kjs/object.cpp:
 
-2007-08-15  Peter Kasting  <zerodpx@gmail.org>
+2007-08-15  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Darin.
         
@@ -4435,7 +4435,7 @@
         Interestingly, even the single-threaded testkjs shows a speed gain
         from removing the pthread_is_threaded_np() short-circuit. Not sure why.
 
-2007-03-04  Don Gibson  <dgibson77@gmail.com>
+2007-03-04  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Nikolas Zimmermann.
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/ChangeLog-2009-06-16 b/src/3rdparty/webkit/JavaScriptCore/ChangeLog-2009-06-16
new file mode 100644
index 0000000..52d3c36
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/ChangeLog-2009-06-16
@@ -0,0 +1,39978 @@
+2009-06-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Sam Weinig.
+
+        Rename PatchBuffer to LinkBuffer.  Previously our terminology has been a little
+        mixed up, but we have decided to fix on refering to the process that takes place
+        at the end of code generation as 'linking', and on any modifications that take
+        place later (and once the code has potentially already been executed) as 'patching'.
+
+        However, the term 'PatchBuffer' is already in use, and needs to be repurposed.
+
+        To try to minimize confusion, we're going to switch the terminology over in stages,
+        so for now we'll refer to later modifications as 'repatching'.  This means that the
+        new 'PatchBuffer' has been introduced with the name 'RepatchBuffer' instead.
+
+        This patch renames the old 'PatchBuffer' to 'LinkBuffer'.  We'll leave ToT in this
+        state for a week or so to try to avoid to much overlap of the meaning of the term
+        'PatchBuffer', then will come back and rename 'RepatchBuffer'.
+
+        * assembler/ARMv7Assembler.h:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::LinkBuffer::LinkBuffer):
+        (JSC::AbstractMacroAssembler::LinkBuffer::~LinkBuffer):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::compile):
+
+2009-06-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Having moved most of their functionality into the RepatchBuffer class,
+        we can simplify the CodeLocation* classes.
+
+        The CodeLocation* classes are currently a tangle of templatey and friendly
+        badness, burried in the middle of AbstractMacroAssembler.  Having moved
+        the ability to repatch out into RepatchBufer they are now do-nothing wrappers
+        on CodePtr (MacroAssemblerCodePtr), that only exist to provide type-safety.
+
+        Simplify the code, and move them off into their own header.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::PatchBuffer::patch):
+        * assembler/CodeLocation.h: Copied from assembler/AbstractMacroAssembler.h.
+        (JSC::CodeLocationCommon::CodeLocationCommon):
+        (JSC::CodeLocationInstruction::CodeLocationInstruction):
+        (JSC::CodeLocationLabel::CodeLocationLabel):
+        (JSC::CodeLocationJump::CodeLocationJump):
+        (JSC::CodeLocationCall::CodeLocationCall):
+        (JSC::CodeLocationNearCall::CodeLocationNearCall):
+        (JSC::CodeLocationDataLabel32::CodeLocationDataLabel32):
+        (JSC::CodeLocationDataLabelPtr::CodeLocationDataLabelPtr):
+        (JSC::CodeLocationCommon::instructionAtOffset):
+        (JSC::CodeLocationCommon::labelAtOffset):
+        (JSC::CodeLocationCommon::jumpAtOffset):
+        (JSC::CodeLocationCommon::callAtOffset):
+        (JSC::CodeLocationCommon::nearCallAtOffset):
+        (JSC::CodeLocationCommon::dataLabelPtrAtOffset):
+        (JSC::CodeLocationCommon::dataLabel32AtOffset):
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::MacroAssemblerCodePtr::operator!):
+        * bytecode/CodeBlock.h:
+        (JSC::getStructureStubInfoReturnLocation):
+        (JSC::getCallLinkInfoReturnLocation):
+        (JSC::getMethodCallLinkInfoReturnLocation):
+        * bytecode/Instruction.h:
+        * bytecode/JumpTable.h:
+        (JSC::StringJumpTable::ctiForValue):
+        (JSC::SimpleJumpTable::ctiForValue):
+        * bytecode/StructureStubInfo.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCatch):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        (JSC::JITStubs::getPolymorphicAccessStructureListSlot):
+
+2009-06-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Having introduced the RepatchBuffer, ProcessorReturnAddress is now a do-nothing
+        wrapper around ReturnAddressPtr.  Remove it.  In tugging on this piece of string
+        it made sense to roll out the use of ReturnAddressPtr a little further into
+        JITStubs (which had always been the intention).
+
+        No performance impact.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::RepatchBuffer::relinkCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::RepatchBuffer::relinkCallerToFunction):
+        (JSC::AbstractMacroAssembler::RepatchBuffer::relinkNearCallerToTrampoline):
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::ReturnAddressPtr::ReturnAddressPtr):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getStubInfo):
+        (JSC::CodeBlock::getCallLinkInfo):
+        (JSC::CodeBlock::getMethodCallLinkInfo):
+        (JSC::CodeBlock::getBytecodeIndex):
+        * interpreter/Interpreter.cpp:
+        (JSC::bytecodeOffsetForPC):
+        * jit/JIT.cpp:
+        (JSC::ctiPatchNearCallByReturnAddress):
+        (JSC::ctiPatchCallByReturnAddress):
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdTransition):
+        (JSC::JIT::compilePatchGetArrayLength):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::StackHack::StackHack):
+        (JSC::returnToThrowTrampoline):
+        (JSC::throwStackOverflowError):
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::):
+        (JSC::JITStackFrame::returnAddressSlot):
+        * runtime/JSGlobalData.h:
+
+2009-06-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6974857>
+
+        Define ENABLE_3D_RENDERING when building on 10.6, and move ENABLE_3D_RENDERING
+        switch from config.h to wtf/Platform.h.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * wtf/Platform.h:
+
+2009-06-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move repatching methods into a set of methods on a class.  This will allow us to
+        coallesce memory reprotection calls.  Really, we want this class to be called
+        PatchBuffer, we want the class PatchBuffer to be called LinkBuffer, we want both
+        to be memblers of MacroAssembler rather then AbstractMacroAssembler, we don't
+        want the CodeLocationFoo types anymore (they are now only really there to provide
+        type safety, and that is completely undermined by the way we use offsets).  Then
+        the link & patch buffers should delegate the actual patching calls to the
+        architecture-specific layer of the MacroAssembler.  Landing all these changes as a
+        sequence of patches.
+
+        No performance impact.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CodeLocationCall::CodeLocationCall):
+        (JSC::AbstractMacroAssembler::CodeLocationNearCall::CodeLocationNearCall):
+        (JSC::AbstractMacroAssembler::CodeLocationNearCall::calleeReturnAddressValue):
+        (JSC::AbstractMacroAssembler::RepatchBuffer::RepatchBuffer):
+        (JSC::AbstractMacroAssembler::RepatchBuffer::relink):
+        (JSC::AbstractMacroAssembler::RepatchBuffer::repatch):
+        (JSC::AbstractMacroAssembler::RepatchBuffer::relinkCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::RepatchBuffer::relinkCallerToFunction):
+        (JSC::AbstractMacroAssembler::RepatchBuffer::relinkNearCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::RepatchBuffer::repatchLoadPtrToLEA):
+        * jit/JIT.cpp:
+        (JSC::ctiPatchNearCallByReturnAddress):
+        (JSC::ctiPatchCallByReturnAddress):
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::linkCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchMethodCallProto):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+
+2009-06-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Hunt & Oliver Garen.
+
+        We are currently generating two copies of the slow path for op_call for no reason.  Stop that.
+
+        Originally op_call used two slow paths since the first set up the pointer to the CallLinkInfo
+        for use when linking.  However this is now looked up using the return address (as we do for
+        property accesses) so the two paths are now identical.
+
+        No performance impact, reduces memory footprint.
+
+        * bytecode/CodeBlock.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::linkCall):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+
+2009-06-12  Dave Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26373
+
+        Add a new class to Threading in wtf called ReadWriteLock that handles single writer/multiple reader locking.
+        Provide a pthreads-only implementation of the lock for now, as this class is only going to be used
+        on Snow Leopard at first.
+
+        * wtf/Threading.h:
+        (WTF::ReadWriteLock::impl):
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::ReadWriteLock::ReadWriteLock):
+        (WTF::ReadWriteLock::~ReadWriteLock):
+        (WTF::ReadWriteLock::readLock):
+        (WTF::ReadWriteLock::tryReadLock):
+        (WTF::ReadWriteLock::writeLock):
+        (WTF::ReadWriteLock::tryWriteLock):
+        (WTF::ReadWriteLock::unlock):
+
+2009-06-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make LiteralParser non-recursive
+
+        Convert LiteralParser from using a simple recursive descent parser
+        to a hand rolled PDA.  Relatively simple conversion, but required
+        modifications to MarkedArgumentBuffer to make it more suitable as
+        a generic marked vector.   I'll refactor and rename MarkedArgumentBuffer
+        in future as there are many other cases where it will be useful to
+        have such a class.
+
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::MarkedArgumentBuffer):
+        (JSC::MarkedArgumentBuffer::append):
+        (JSC::MarkedArgumentBuffer::removeLast):
+        (JSC::MarkedArgumentBuffer::last):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parse):
+        * runtime/LiteralParser.h:
+        (JSC::LiteralParser::LiteralParser):
+        (JSC::LiteralParser::tryLiteralParse):
+        (JSC::LiteralParser::):
+
+2009-06-12  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (build fix for windows).
+
+        Adjust the exports for JSC on Windows like what was done for OSX in
+        the previous commit.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-06-12  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        UString shouldn't create sharedBuffer for SmallStrings.
+        https://bugs.webkit.org/show_bug.cgi?id=26360
+
+        The methods changed are not used by JSC, so there is no JS perf impact.  However,
+        there is a potential DOM perf impact, so I re-ran several of the tests that
+        I ran previously and ensured that the perf stay the same which caused me to
+        adjust the minLengthToShare.
+
+        * JavaScriptCore.exp:
+        * runtime/UString.cpp:
+        (JSC::UString::Rep::sharedBuffer):
+            Determines if the buffer being shared is big enough before doing so.
+            Previously, BaseString::sharedBuffer was called but it would only know
+            the length of the base string (BaseString::len) which may not be the same
+            as the string being shared (Rep::len).
+        (JSC::UString::BaseString::sharedBuffer):
+            This is now only be used by Rep::sharedBuffer. which does the length check.
+        * runtime/UString.h:
+
+2009-06-12  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26191
+        Remove xmath include in MathExtras.h, because it is not needed and also
+        breaks VS2008 builds with TR1 turned on.
+
+        * wtf/MathExtras.h: Removed xmath include.
+
+2009-06-12  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        * ChangeLog-2007-10-14: Change pseudonym "Don Gibson" to me (was used while Google Chrome was not public); update my email address.
+
+2009-06-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Adding JSONObject.cpp to the build.
+
+        * JavaScriptCoreSources.bkl:
+
+2009-06-12  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Jan Michael Alonzo.
+
+        [Qt] Fix build break
+        https://bugs.webkit.org/show_bug.cgi?id=26340
+
+        * JavaScriptCore.pri: Add JSONObject.cpp to LUT files.
+
+2009-06-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Lower stringify recursion limit to deal with small windows stack.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::):
+
+2009-06-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Fix compilation warnings
+        <https://bugs.webkit.org/show_bug.cgi?id=26015>
+
+        * wtf/ThreadingNone.cpp:
+        (WTF::ThreadCondition::wait): Fix compilation warning.
+        (WTF::ThreadCondition::timedWait): Ditto.
+
+2009-06-10  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix for Windows target.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+          Correct missing </File> tag after @r44550 that prevents the
+          project from being loaded in the Visual Studio IDE.
+
+2009-06-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber Stamped by Mark Rowe.
+
+        Tidy up a couple of comments.
+
+        * assembler/ARMv7Assembler.h:
+            Fix date in copyright, neaten up a couple of comments.
+        * assembler/MacroAssemblerARMv7.h:
+            Fix date in copyright.
+
+2009-06-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 26249: Support JSON.stringify
+        <https://bugs.webkit.org/show_bug.cgi?id=26249>
+        
+        Implement JSON.stringify.  This patch handles all the semantics of the ES5
+        JSON.stringify function, including replacer functions and arrays and both
+        string and numeric gap arguments.
+        
+        Currently uses a clamped recursive algorithm basically identical to the spec
+        description but with a few minor tweaks for performance and corrected semantics
+        discussed in the es-discuss mailing list.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::jsonTable):
+        * runtime/CommonIdentifiers.h:
+           add toJSON to the list of common identifiers
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+            Add support for the JSON object lookup table
+
+        * runtime/JSONObject.cpp: Added.
+        (JSC::):
+        (JSC::JSONObject::getOwnPropertySlot):
+        (JSC::Stringifier::):
+        (JSC::Stringifier::Stringifier):
+        (JSC::Stringifier::stringify):
+        (JSC::Stringifier::appendString):
+
+        (JSC::Stringifier::StringKeyGenerator::StringKeyGenerator):
+        (JSC::Stringifier::StringKeyGenerator::getKey):
+        (JSC::Stringifier::IntKeyGenerator::IntKeyGenerator):
+        (JSC::Stringifier::IntKeyGenerator::getKey):
+            These KeyGenerator classes are used to abstract away the lazy evaluation of keys for
+            toJSON and replacer functions.
+
+        (JSC::Stringifier::toJSONValue):
+        (JSC::Stringifier::stringifyArray):
+        (JSC::Stringifier::stringifyObject):
+        (JSC::JSONProtoFuncStringify):
+        * runtime/JSONObject.h: Added.
+        (JSC::JSONObject:::JSObject):
+        (JSC::JSONObject::classInfo):
+        (JSC::JSONObject::createStructure):
+
+2009-06-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Enable JIT_OPTIMIZE_CALL & JIT_OPTIMIZE_METHOD_CALLS on ARMv7 platforms.
+
+        These optimizations function correctly with no further changes.
+
+        * wtf/Platform.h:
+            Change to enable JIT_OPTIMIZE_CALL & JIT_OPTIMIZE_METHOD_CALLS.
+
+2009-06-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Not Reviewed, build fix.
+
+        * assembler/MacroAssemblerARMv7.h:
+
+2009-06-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Enable JIT_OPTIMIZE_ARITHMETIC on ARMv7 platforms.
+
+        Temporarily split support for 'branchTruncateDoubleToInt32' onto its own switch
+        ('supportsFloatingPointTruncate').  See comment in MacroAssemblerARMv7, we need
+        to work out wherther we are going to be able to support the current interface on
+        all platforms, or whether this should be refactored.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::supportsFloatingPoint):
+            Add implementation of supportsFloatingPointTruncate (returns true).
+        (JSC::MacroAssemblerARMv7::supportsFloatingPointTruncate):
+            Add implementation of supportsFloatingPointTruncate (returns false).
+        (JSC::MacroAssemblerARMv7::loadDouble):
+        (JSC::MacroAssemblerARMv7::storeDouble):
+        (JSC::MacroAssemblerARMv7::addDouble):
+        (JSC::MacroAssemblerARMv7::subDouble):
+        (JSC::MacroAssemblerARMv7::mulDouble):
+        (JSC::MacroAssemblerARMv7::convertInt32ToDouble):
+        (JSC::MacroAssemblerARMv7::branchDouble):
+            Implement FP code genertion operations.
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::supportsFloatingPointTruncate):
+            Add implementation of supportsFloatingPointTruncate (returns true).
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::supportsFloatingPointTruncate):
+            Add implementation of supportsFloatingPointTruncate (returns true).
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_rshift):
+            Changed to call supportsFloatingPointTruncate().
+        (JSC::JIT::emitSlow_op_rshift):
+            Changed to call supportsFloatingPointTruncate().
+        * wtf/Platform.h:
+            Change to enable JIT_OPTIMIZE_ARITHMETIC.
+
+2009-06-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Mark Rowe & Geoff Garen.
+
+        Enable JIT_OPTIMIZE_PROPERTY_ACCESS on ARMv7 platforms.
+
+        Firm up interface for planting load intructions that will be repatched by
+        repatchLoadPtrToLEA().  This method should now no longer be applied to just
+        any loadPtr instruction.
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::loadPtrWithPatchToLEA):
+            Implement loadPtrWithPatchToLEA interface (plants a load with a fixed width address).
+        (JSC::MacroAssemblerARMv7::move):
+        (JSC::MacroAssemblerARMv7::nearCall):
+        (JSC::MacroAssemblerARMv7::call):
+        (JSC::MacroAssemblerARMv7::moveWithPatch):
+        (JSC::MacroAssemblerARMv7::tailRecursiveCall):
+            Switch to use common method 'moveFixedWidthEncoding()' to perform fixed width (often patchable) loads.
+        (JSC::MacroAssemblerARMv7::moveFixedWidthEncoding):
+            Move an immediate to a register, always plants movT3/movt instruction pair.
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::loadPtrWithPatchToLEA):
+            Implement loadPtrWithPatchToLEA interface (just a regular 32-bit load on x86).
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::loadPtrWithPatchToLEA):
+            Implement loadPtrWithPatchToLEA interface (just a regular 64-bit load on x86_64).
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::emit_op_put_by_id):
+        * wtf/Platform.h:
+            Change to enable JIT_OPTIMIZE_PROPERTY_ACCESS.
+
+2009-06-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Enable JS language JIT for ARM thumb2 platforms.  Add ARMv7 specific
+        asm & constants, add appropriate configuration switches to Platform.h.
+
+        Landing this disabled until jump linking is completed (see YARR jit patch).
+
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::load32):
+            Fix: should load pointer with ImmPtr not Imm32.
+        (JSC::MacroAssemblerARMv7::store32):
+            Fix: should load pointer with ImmPtr not Imm32.
+        (JSC::MacroAssemblerARMv7::move):
+            Fix: When moving an Imm32 that is actually a pointer, should call movT3()
+            not mov(), to ensure code generation is repeatable (for exception handling).
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+            Disable JIT_OPTIMIZE_NATIVE_CALL specific code generation if the optimization is not enabled.
+        * jit/JIT.h:
+            Add ARMv7 specific values of constants & register names.
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::preverveReturnAddressAfterCall):
+        (JSC::JIT::restoreReturnAddressBeforeReturn):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+            Implement for ARMv7 (move value to/from lr).
+        * jit/JITStubs.cpp:
+            Add JIT entry/thow trampolines, add macro to add thunk wrapper around stub routines.
+        * jit/JITStubs.h:
+        (JSC::JITStackFrame::returnAddressSlot):
+            Add ARMv7 stack frame object.
+        * wtf/Platform.h:
+            Add changes necessary to allow JIT to build on this platform, disabled.
+
+2009-06-08  Mark Rowe  <mrowe@apple.com>
+
+        Speculative GTK build fix.
+
+        * wtf/DateMath.cpp:
+
+2009-06-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Previous patch caused a regression.
+
+        Restructure so no new (empty, inline) function calls are added on x86.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::makeWritable):
+        (JSC::ExecutableAllocator::makeExecutable):
+        (JSC::ExecutableAllocator::reprotectRegion):
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2009-06-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, GTK build fix (thanks, bdash).
+
+        * GNUmakefile.am: Moved DateMath with all other wtf kin.
+
+2009-06-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Add (incomplete) support to YARR for running with the jit enabled
+        on Arm thumb2 platforms.  Adds new Assembler/MacroAssembler classes,
+        along with cache flushing support, tweaks to MacroAssemblerCodePtr
+        to support decorated thumb code pointers, and new enter/exit code
+        to YARR jit for the platform.
+
+        Support for this platform is still under development - the assembler
+        currrently only supports planting and linking jumps with a 16Mb range.
+        As such, initially commiting in a disabled state.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            Add new assembler files.
+        * assembler/ARMv7Assembler.h: Added.
+            Add new Assembler.
+        * assembler/AbstractMacroAssembler.h:
+            Tweaks to ensure sizes of pointer values planted in JIT code do not change.
+        * assembler/MacroAssembler.h:
+            On ARMv7 platforms use MacroAssemblerARMv7.
+        * assembler/MacroAssemblerARMv7.h: Added.
+            Add new MacroAssembler.
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::FunctionPtr::FunctionPtr):
+            Add better ASSERT.
+        (JSC::ReturnAddressPtr::ReturnAddressPtr):
+            Add better ASSERT.
+        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
+            On ARMv7, MacroAssemblerCodePtr's mush be 'decorated' with a low bit set,
+            to indicate to the processor that the code is thumb code, not traditional
+            32-bit ARM.
+        (JSC::MacroAssemblerCodePtr::dataLocation):
+            On ARMv7, decoration must be removed.
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::makeWritable):
+            Reformatted, no change.
+        (JSC::ExecutableAllocator::makeExecutable):
+            When marking code executable also cache flush it, where necessary.
+        (JSC::ExecutableAllocator::MakeWritable::MakeWritable):
+            Only use the null implementation of this class if both !ASSEMBLER_WX_EXCLUSIVE
+            and running on x86(_64) - on other platforms we may also need ensure that
+            makeExecutable is called at the end to flush caches.
+        (JSC::ExecutableAllocator::reprotectRegion):
+            Reformatted, no change.
+        (JSC::ExecutableAllocator::cacheFlush):
+            Cache flush a region of memory, or platforms where this is necessary.
+        * wtf/Platform.h:
+            Add changes necessary to allow YARR jit to build on this platform, disabled.
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateEnter):
+        (JSC::Yarr::RegexGenerator::generateReturn):
+            Add support to these methods for ARMv7.
+
+2009-06-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, fix my previous fix.
+
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::msToGregorianDateTime): Use WTF namespace qualifier to
+            disambiguate func signatures.
+
+2009-06-08  Mark Rowe  <mrowe@apple.com>
+
+        Attempt to fix the Tiger build.
+
+        * wtf/Platform.h: Only test the value of the macro once we know it is defined.
+
+2009-06-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, another Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-06-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, projectile-fixing Windows build.
+
+        * runtime/DateConversion.cpp: Added StringExtras include.
+        * wtf/DateMath.cpp: Replaced math with algorithm include (looking for std::min def for Windows).
+
+2009-06-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, Windows build fix.
+
+        * runtime/DateConstructor.cpp: Changed to use WTF namespace.
+        * runtime/DateConversion.cpp: Added UString include.
+        * runtime/DateInstance.cpp: Changed to use WTF namespace.
+        * wtf/DateMath.cpp: Added math include.
+
+2009-06-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26238
+        Move most of runtime/DateMath functions to wtf/DateMath, and split off conversion-related
+        helpers to DateConversion.
+
+        * AllInOneFile.cpp: Changed DateMath->DateConversion.
+        * GNUmakefile.am: Ditto and added DateMath.
+        * JavaScriptCore.exp: Ditto.
+        * JavaScriptCore.pri: Ditto.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Added DateMath.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * JavaScriptCoreSources.bkl: Ditto.
+        * pcre/pcre_exec.cpp: Changed to use DateMath.
+        * profiler/ProfileNode.cpp:
+        (JSC::getCount): Changed to use DateConversion.
+        * runtime/DateConstructor.cpp: Ditto.
+        * runtime/DateConversion.cpp: Copied from JavaScriptCore/runtime/DateMath.cpp.
+        (JSC::parseDate): Refactored to use null-terminated characters as input.
+        * runtime/DateConversion.h: Copied from JavaScriptCore/runtime/DateMath.h.
+        * runtime/DateInstance.cpp: Changed to use wtf/DateMath.
+        * runtime/DateInstance.h: Ditto.
+        * runtime/DateMath.cpp: Removed.
+        * runtime/DateMath.h: Removed.
+        * runtime/DatePrototype.cpp: Ditto.
+        * runtime/InitializeThreading.cpp: Ditto.
+        * wtf/DateMath.cpp: Copied from JavaScriptCore/runtime/DateMath.cpp.
+        * wtf/DateMath.h: Copied from JavaScriptCore/runtime/DateMath.h.
+
+2009-06-08  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+
+2009-06-07  David Kilzer  <ddkilzer@apple.com>
+
+        Make JavaScriptCore compile for iPhone and iPhone Simulator
+
+        Reviewed by Gavin Barraclough.
+
+        * Configurations/Base.xcconfig: Split GCC_ENABLE_OBJC_GC on
+        $(REAL_PLATFORM_NAME).  Added $(ARCHS_UNIVERSAL_IPHONE_OS) to
+        VALID_ARCHS.  Added REAL_PLATFORM_NAME_iphoneos,
+        REAL_PLATFORM_NAME_iphonesimulator, HAVE_DTRACE_iphoneos and
+        HAVE_DTRACE_iphonesimulator variables.
+        * Configurations/DebugRelase.xcconfig: Split ARCHS definition on
+        $(REAL_PLATFORM_NAME).
+        * Configurations/JavaScriptCore.xcconfig: Added
+        EXPORTED_SYMBOLS_FILE_armv6 and EXPORTED_SYMBOLS_FILE_armv7
+        variables.  Split OTHER_LDFLAGS into OTHER_LDFLAGS_BASE and
+        OTHER_LDFLAGS_$(REAL_PLATFORM_NAME) since CoreServices.framework
+        is only linked to on Mac OS X.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Removed references
+        to CoreServices.framework since it's linked using OTHER_LDFLAGS
+        in JavaScriptCore.xcconfig.
+        * profiler/ProfilerServer.mm: Added #import for iPhone
+        Simulator.
+        (-[ProfilerServer init]): Conditionalize use of
+        NSDistributedNotificationCenter to non-iPhone or iPhone
+        Simulator.
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::): Build fix for iPhone and iPhone
+        Simulator.
+        * wtf/Platform.h: Defined PLATFORM(IPHONE) and
+        PLATFORM(IPHONE_SIMULATOR).
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::setThreadNameInternal): Build fix for iPhone and iPhone
+        Simulator.
+
+2009-06-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Use $QMAKE_PATH_SEP instead of hardcoded / to fix Windows build
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+        * jsc.pro:
+
+2009-06-07  Gavin Barraclough  <barraclough@apple.com>
+
+        RS by Sam Weinig.
+
+        Remove bonus bogus \n from last commit.
+
+        * jit/JITStubs.cpp:
+        (JSC::):
+
+2009-06-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Change the implementation of op_throw so the stub function always modifies its
+        return address - if it doesn't find a 'catch' it will switch to a trampoline
+        to force a return from JIT execution.  This saves memory, by avoiding the need
+        for a unique return for every op_throw.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_throw):
+            JITStubs::cti_op_throw now always changes its return address,
+            remove return code generated after the stub call (this is now
+            handled by ctiOpThrowNotCaught).
+        * jit/JITStubs.cpp:
+        (JSC::):
+            Add ctiOpThrowNotCaught definitions.
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+            Change cti_op_throw to always change its return address.
+        * jit/JITStubs.h:
+            Add ctiOpThrowNotCaught declaration.
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Rudder stamped by Sam Weinig.
+
+        Add missing ASSERT.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::getRelocatedAddress):
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Switch storePtrWithPatch to take the initial immediate value as an argument.
+
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::storePtrWithPatch):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::storePtrWithPatch):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_jsr):
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove patchLength..tByIdExternalLoadPrefix magic numbers from JIT.h.
+
+        These aren't really suitable values to be tracking within common code
+        of the JIT, since they are not (and realistically cannot) be checked
+        by ASSERTs, as the other repatch offsets are.  Move this functionality
+        (skipping the REX prefix when patching load instructions to LEAs on
+        x86-64) into the X86Assembler.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::repatchLoadPtrToLEA):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::repatchLoadPtrToLEA):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+
+2009-06-05  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Bug 26160: Compile fails in MacOSX when GNU fileutils are installed
+
+        <https://bugs.webkit.org/show_bug.cgi?id=26160>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Use /bin/ln instead of ln for cases where this command is used with -h option.
+        As this option is not supported by GNU fileutils, this change helps users 
+        who have GNU fileutils in their PATH.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Remove DoubleNotEqual floating point comparison condition for now -
+        it is not used, and it is unclear the semantics are correct (I think
+        this comparison would actually give you not-equal-or-unordered, which
+        might be what is wanted... we can revisit this interface & get it
+        right when required).
+
+        Also, fix asserts in branchArith32 ops.  All adds & subs can check
+        for Signed, multiply only sets OF so can only check for overflow.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::branchMul32):
+        (JSC::MacroAssemblerX86Common::branchSub32):
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Minor tidy up in JITStubs.
+
+        * jit/JITStubs.cpp:
+        (JSC::StackHack::StackHack):
+        * jit/JITStubs.h:
+
+2009-06-05  Koen Kooi <koen@dominion.thruhere.net>
+
+        Reviewed by Xan Lopez.
+
+        Build fix for glib unicode backend.
+
+        * wtf/unicode/glib/UnicodeMacrosFromICU.h:
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        3 tiny cleanups:
+
+        * assembler/MacroAssemblerX86.h:
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::storePtrWithPatch):
+            store*() methods should take an ImplicitAddress, rather than an Address.
+        * assembler/X86Assembler.h:
+            Make patchPointer private.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_ret):
+            Remove empty line at end of function.
+
+2009-06-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Encapsulate many uses of void* in the assembler & jit with types that provide
+        more semantic information.  The new types are:
+        
+            * MacroAssemblerCodePtr - this wraps a pointer into JIT generated code.
+            * FunctionPtr - this wraps a pointer to a C/C++ function in JSC.
+            * ReturnAddressPtr - this wraps a return address resulting from a 'call' instruction.
+
+        Wrapping these types allows for stronger type-checking than is possible with everything
+        represented a void*.  For example, it is now enforced by the type system that near
+        calls can only be linked to JIT code and not to C functions in JSC (this was previously
+        required, but could not be enforced on the interface).
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::CodeLocationCommon):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::dataLocation):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::executableAddress):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::reset):
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::repatchLoadToLEA):
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::CodeLocationInstruction):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForSwitch):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForExceptionHandler):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForJSR):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::operator!):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::reset):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::CodeLocationLabel):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::getJumpDestination):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::CodeLocationJump):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::calleeReturnAddressValue):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::CodeLocationCall):
+        (JSC::AbstractMacroAssembler::CodeLocationNearCall::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationNearCall::calleeReturnAddressValue):
+        (JSC::AbstractMacroAssembler::CodeLocationNearCall::CodeLocationNearCall):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::repatch):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::CodeLocationDataLabel32):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::repatch):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::CodeLocationDataLabelPtr):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToFunction):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkNearCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::addressForLookup):
+        (JSC::AbstractMacroAssembler::trampolineAt):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::AbstractMacroAssembler::PatchBuffer::performFinalization):
+        (JSC::::CodeLocationCommon::instructionAtOffset):
+        (JSC::::CodeLocationCommon::labelAtOffset):
+        (JSC::::CodeLocationCommon::jumpAtOffset):
+        (JSC::::CodeLocationCommon::callAtOffset):
+        (JSC::::CodeLocationCommon::nearCallAtOffset):
+        (JSC::::CodeLocationCommon::dataLabelPtrAtOffset):
+        (JSC::::CodeLocationCommon::dataLabel32AtOffset):
+        * assembler/MacroAssemblerCodeRef.h:
+        (JSC::FunctionPtr::FunctionPtr):
+        (JSC::FunctionPtr::value):
+        (JSC::FunctionPtr::executableAddress):
+        (JSC::ReturnAddressPtr::ReturnAddressPtr):
+        (JSC::ReturnAddressPtr::value):
+        (JSC::MacroAssemblerCodePtr::MacroAssemblerCodePtr):
+        (JSC::MacroAssemblerCodePtr::executableAddress):
+        (JSC::MacroAssemblerCodePtr::dataLocation):
+        (JSC::MacroAssemblerCodeRef::MacroAssemblerCodeRef):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::patchPointerForCall):
+        * jit/JIT.cpp:
+        (JSC::ctiPatchNearCallByReturnAddress):
+        (JSC::ctiPatchCallByReturnAddress):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        * jit/JITCode.h:
+        (JSC::JITCode::operator !):
+        (JSC::JITCode::addressForCall):
+        (JSC::JITCode::offsetOf):
+        (JSC::JITCode::execute):
+        (JSC::JITCode::size):
+        (JSC::JITCode::HostFunction):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitNakedCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITThunks::JITThunks):
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::JITThunks::ctiArrayLengthTrampoline):
+        (JSC::JITThunks::ctiStringLengthTrampoline):
+        (JSC::JITThunks::ctiVirtualCallPreLink):
+        (JSC::JITThunks::ctiVirtualCallLink):
+        (JSC::JITThunks::ctiVirtualCall):
+        (JSC::JITThunks::ctiNativeCallThunk):
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::RegexCodeBlock::operator!):
+        (JSC::Yarr::RegexCodeBlock::execute):
+
+2009-06-05  Antti Koivisto  <antti@apple.com>
+
+        Try to unbreak Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-06-03  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=13128
+        Safari not obeying cache header
+        
+        Export JSC::parseDate()
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-06-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug in property caching of getters and setters.
+
+        Make sure that the transition logic accounts for getters and setters.
+        If we don't we end up screwing up the transition tables so that some
+        transitions will start incorrectly believing that they need to check
+        for getters and setters. 
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        * runtime/JSObject.h:
+        (JSC::):
+        * runtime/Structure.h:
+
+2009-06-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Minor tweak to PatchBuffer, change it so it no longer holds a CodeRef, and instead
+        holds a separate code pointer and executable pool.  Since it now always holds its
+        own copy of the code size, and to simplify the construction sequence, it's neater
+        this way.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::PatchBuffer::PatchBuffer):
+        (JSC::AbstractMacroAssembler::PatchBuffer::finalizeCode):
+        (JSC::AbstractMacroAssembler::PatchBuffer::code):
+        (JSC::AbstractMacroAssembler::PatchBuffer::performFinalization):
+
+2009-06-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Remove 'JIT_STUB_ARGUMENT_STACK' this is unused and untested.
+
+        This just leaves JIT_STUB_ARGUMENT_REGISTER and JIT_STUB_ARGUMENT_VA_LIST.
+        Since JIT_STUB_ARGUMENT_REGISTER is the sensible configuration on most platforms,
+        remove this define and make this the default behaviour.
+        Platforms must now define JIT_STUB_ARGUMENT_VA_LIST to get crazy va_list voodoo,
+        if they so desire.
+
+        (Refactoring of #ifdefs only, no functional change, no performance impact.)
+
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        * jit/JITStubs.cpp:
+        (JSC::):
+        * jit/JITStubs.h:
+        * wtf/Platform.h:
+
+2009-06-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam Weinig.
+
+        * jit/JITArithmetic.cpp:
+            Remove some redundant typedefs, unused since arithmetic was added to the MacroAssembler interface.
+
+2009-06-04  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix due to header include problem.
+
+        * interpreter/Interpreter.h: Remove wtf from includes so that
+          compile can find the headers in expected places.
+
+2009-06-04  Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        HashTable class (JavaScriptCore/wtf/HashTable.h) doesn't instantiated by 'new', so 
+        inheritance was removed. HashTable struct has been instantiated by operator new in
+        JSGlobalData.cpp:106.
+        HashTable couldn't inherited from FastAllocBase since struct with inheritance is 
+        no longer POD, so HashTable struct has been instantiated by fastNew, destroyed by
+        fastDelete.
+
+        * interpreter/Interpreter.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * wtf/HashTable.h:
+
+2009-06-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Wrap the code that plants pushes/pops planted by JIT in explanatorily named
+        methods; move property storage reallocation into a standard stub function.
+
+        ~No performance impact (possible <1% progression on x86-64, likely just noise).
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+            Wrap calls to push/pop.
+        * jit/JIT.h:
+            Declare the new wrapper methods.
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::preverveReturnAddressAfterCall):
+        (JSC::JIT::restoreReturnAddressBeforeReturn):
+            Define the new wrapper methods.
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_op_ret):
+            Wrap calls to push/pop.
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+            Move property storage reallocation into a standard stub function.
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::JITStubs::):
+
+2009-06-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Single-threaded QtWebKit configuration
+        <https://bugs.webkit.org/show_bug.cgi?id=26015>
+
+        * JavaScriptCore.pri: Use ThreadingNone.cpp instead of
+        ThreadingQt.cpp and make sure ENABLE_JSC_MULTIPLE_THREADS is turned off
+        when ENABLE_SINGLE_THREADED is tuned on
+        * wtf/ThreadingNone.cpp:
+        (WTF::ThreadCondition::wait): Fix compilation warning.
+        (WTF::ThreadCondition::timedWait): Ditto.
+
+2009-06-02  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Remove workaround that was added to address <rdar://problem/5488678> as it no longer affects our Tiger builds.
+
+        * Configurations/Base.xcconfig:
+
+2009-06-02  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Sam Weinig.
+
+        Use C-style comments in Platform.h so it can be included from C
+        files.
+
+        * wtf/Platform.h:
+
+2009-06-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Rubber-stamped by Simon Hausmann.
+
+        Use File::Spec->tmpdir instead of hardcoded paths for tempfile() dir
+        
+        This fixes the Windows-build if the user does not have a /tmp directory.
+
+        * pcre/dftables:
+
+2009-06-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver ">>" Hunt.
+
+        emitSlow_op_rshift is linking the wrong number of slow cases, if !supportsFloatingPoint().
+        Fixerate, and refactor/comment the code a little to make it clearer what is going on.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_rshift):
+
+2009-06-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY - speculative windows build fix (errm, for the other patch!).
+
+        * jit/JITStubs.cpp:
+        (JSC::):
+
+2009-06-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY - speculative windows build fix.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::::CodeLocationCall::CodeLocationCall):
+        (JSC::::CodeLocationNearCall::CodeLocationNearCall):
+
+2009-06-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Olliej Hunt.
+
+        Change JITStub functions from being static members on the JITStub class to be
+        global extern "C" functions, and switch their the function signature declaration
+        in the definition of the functions to be C-macro generated.  This makes it easier
+        to work with the stub functions from assembler code (since the names no longer
+        require mangling), and by delaring the functions with a macro we can look at
+        also auto-generating asm thunks to wrap the JITStub functions to perform the
+        work currently in 'restoreArgumentReference' (as a memory saving).
+
+        Making this change also forces us to be a bit more realistic about what is private
+        on the Register and CallFrame objects.  Presently most everything on these classes
+        is private, and the classes have plenty of friends.  We could befriend all the
+        global functions to perpetuate the delusion of encapsulation, but using friends is
+        a bit of a sledgehammer solution here - since friends can poke around with all of
+        the class's privates, and since all the major classes taht operate on Regsiters are
+        currently friends, right there is currently in practice very little protection at
+        all.  Better to start removing friend delclarations, and exposing just the parts
+        that need to be exposed.
+
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::returnPC):
+        (JSC::ExecState::setCallerFrame):
+        (JSC::ExecState::returnValueRegister):
+        (JSC::ExecState::setArgumentCount):
+        (JSC::ExecState::setCallee):
+        (JSC::ExecState::setCodeBlock):
+        * interpreter/Interpreter.h:
+        * interpreter/Register.h:
+        (JSC::Register::Register):
+        (JSC::Register::i):
+        * jit/JITStubs.cpp:
+        (JSC::):
+        (JSC::JITThunks::JITThunks):
+        (JSC::JITThunks::tryCachePutByID):
+        (JSC::JITThunks::tryCacheGetByID):
+        (JSC::JITStubs::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        (JSC::JITStubs::):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::nativeFunction):
+        (JSC::JSFunction::classInfo):
+        * runtime/JSGlobalData.h:
+
+2009-06-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Tidy up the literal parser.
+
+        Make the number lexing in the LiteralParser exactly match the JSON spec, which
+        makes us cover more cases, but also more strict.  Also made string lexing only
+        allow double-quoted strings.
+
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lex):
+        (JSC::LiteralParser::Lexer::lexString):
+        (JSC::LiteralParser::Lexer::lexNumber):
+
+2009-06-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam "WX" Weinig.
+
+        Allow the JIT to operate without relying on use of RWX memory, on platforms where this is supported.
+
+        This patch adds a switch to Platform.h (ENABLE_ASSEMBLER_WX_EXCLUSIVE) which enables this mode of operation.
+        When this flag is set, all executable memory will be allocated RX, and switched to RW only whilst being
+        modified.  Upon completion of code generation the protection is switched back to RX to allow execution.
+
+        Further optimization will be required before it is desirable to enable this mode of operation by default;
+        enabling this presently incurs a 5%-10% regression.
+
+        (Submitting disabled - no performance impact).
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::repatchLoadToLEA):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::fromFunctionPointer):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationNearCall::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::repatch):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::repatch):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToFunction):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkNearCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkNearCallerToFunction):
+        (JSC::AbstractMacroAssembler::PatchBuffer::PatchBuffer):
+        (JSC::AbstractMacroAssembler::PatchBuffer::~PatchBuffer):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::AbstractMacroAssembler::PatchBuffer::patch):
+        (JSC::AbstractMacroAssembler::PatchBuffer::performFinalization):
+        (JSC::::CodeLocationCommon::nearCallAtOffset):
+        (JSC::::CodeLocationCall::CodeLocationCall):
+        (JSC::::CodeLocationNearCall::CodeLocationNearCall):
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::executableCopy):
+        * assembler/X86Assembler.h:
+        (JSC::CAN_SIGN_EXTEND_U32_64):
+        (JSC::X86Assembler::linkJump):
+        (JSC::X86Assembler::linkCall):
+        (JSC::X86Assembler::patchPointer):
+        (JSC::X86Assembler::relinkJump):
+        (JSC::X86Assembler::relinkCall):
+        (JSC::X86Assembler::repatchInt32):
+        (JSC::X86Assembler::repatchPointer):
+        (JSC::X86Assembler::repatchLoadToLEA):
+        (JSC::X86Assembler::patchInt32):
+        (JSC::X86Assembler::patchRel32):
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::):
+        (JSC::ExecutableAllocator::makeWritable):
+        (JSC::ExecutableAllocator::makeExecutable):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        (JSC::ExecutableAllocator::reprotectRegion):
+        * jit/ExecutableAllocatorWin.cpp:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        * wtf/Platform.h:
+
+2009-05-29 Zoltan Horvath  <hzoltan@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Inherits Interpreter class from FastAllocBase because it has been
+        instantiated by 'new' in JavaScriptCore/runtime/JSGlobalData.cpp. 
+
+        * interpreter/Interpreter.h:
+
+2009-06-01  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (windows build fix).
+
+        Add exports for windows (corresponding to the JavaScriptCore.exp modification
+        in the previous change).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-06-01  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Alder and Maciej Stachowiak.
+
+        Bug 26057: StringImpl should share buffers with UString.
+        https://bugs.webkit.org/show_bug.cgi?id=26057
+
+        * JavaScriptCore.exp:
+        * runtime/UString.cpp:
+        (JSC::UString::Rep::create):
+        (JSC::UString::BaseString::sharedBuffer): Only do the sharing when
+        the buffer exceeds a certain size.  The size was tuned by running
+        various dom benchmarks with numbers ranging from 20 to 800 and finding
+        a place that seemed to do the best overall.
+        * runtime/UString.h:
+
+2009-05-31  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Olliej "you just need to change NativeFunctionWrapper.h" Hunt.
+
+        Add ENABLE_JIT_OPTIMIZE_NATIVE_CALL switch to allow JIT to operate without native call optimizations.
+
+        * runtime/NativeFunctionWrapper.h:
+        * wtf/Platform.h:
+
+2009-05-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6935193> REGRESSION (r42734): Celtic Kane JavaScript benchmark does not run:
+        "Maximum call stack size exceeded"
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString): Use the same recursion limit as the other recursion checks.
+        We need a limit of at least 100 to run the benchmark above.
+        (JSC::arrayProtoFuncToLocaleString): Ditto.
+        (JSC::arrayProtoFuncJoin): Ditto.
+
+2009-05-28  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Added new build flag --filters for Mac. More details in WebCore/ChangeLog.
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-05-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6928025> Stack overflow in JSC::stringProtoFuncReplace() running jsFunFuzz
+
+        We should always check for exceptions after creating a CachedCall, this wasn't being done in
+        the string replace logic.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2009-05-27  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed (make distcheck) build fix; adding missing headers.
+
+        * GNUmakefile.am:
+
+2009-05-27  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Adam Roben
+        
+        Fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-27  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Gustavo Noronha.
+
+        When building on Windows, consider Windows specific files.
+
+        * GNUmakefile.am:
+
+2009-05-27  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Maciej Stachowiak.
+
+        When building with MinGW, don't use the __declspec(dl{import,export})
+        decorations and rely on the linker to use its nifty auto-import feature.
+        It is extremely hard to get the decorations right with MinGW in general
+        and impossible in WebKit, where the resulting shared library is linking
+        together some static libraries.
+
+        * config.h:
+
+2009-05-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25613
+
+        Be able to use GOwnPtr for GHashTable as well. The assumption
+        is that the hash table has been created with g_hash_table_new_full
+        and has proper destruction functions.
+
+        * wtf/GOwnPtr.cpp:
+        (WTF::GHashTable):
+        * wtf/GOwnPtr.h:
+
+2009-05-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/6924033> REGRESSION: Assertion failure due to forward references
+
+        Add a pattern type for forward references to ensure that we don't confuse the
+        quantifier alternatives assertion.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::atomBackReference):
+        (JSC::Yarr::RegexPatternConstructor::setupAlternativeOffsets):
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::PatternTerm::):
+        (JSC::Yarr::PatternTerm::PatternTerm):
+        (JSC::Yarr::PatternTerm::ForwardReference):
+
+2009-05-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for: <rdar://problem/6918095> REGRESSION: jQuery load() issue (25981),
+        and also an ASSERT failure on http://ihasahotdog.com/.
+
+        When overwriting a property on a dictionary with a cached specific value,
+        clear the cache if new value being written is different.
+
+        * JavaScriptCore.exp:
+            Export the new symbols.
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_get_by_id_method_check_second):
+            Close dictionary prototypes upon caching a method access, as would happen when caching
+            a regular get_by_id.
+        * runtime/JSObject.h:
+        (JSC::JSObject::propertyStorage):
+        (JSC::JSObject::locationForOffset):
+            Make these methods private.
+        (JSC::JSObject::putDirectInternal):
+            When overwriting a property on a dictionary with a cached specific value,
+            clear the cache if new value being written is different.
+        * runtime/Structure.cpp:
+        (JSC::Structure::despecifyDictionaryFunction):
+            Reset the specific value field for a given property in a dictionary.
+        (JSC::Structure::despecifyFunctionTransition):
+            Rename of 'changeFunctionTransition' (this was already internally refered to as a despecification).
+        * runtime/Structure.h:
+            Declare new method.
+
+2009-05-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver "pieces of eight" Hunt.
+
+        When reseting RegexPattern class, should fully reset the class, not just bits of it.
+        In particular, we delete the cached character classes (for wordchars, etc), but do
+        not reset the set of pointers to the cached classes.  In the case of a repeated parse
+        due to an illegal back-reference we will continue to use the deleted character class.
+
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::RegexPattern::reset):
+
+2009-05-26  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix to correct r44161.
+
+        * wtf/FastAllocBase.h:
+
+2009-05-26  Zoltan Horvath  <horvath.zoltan.6@stud.u-szeged.hu>
+
+        Reviewed by Maciej Stachowiak.
+
+        Inherite HashTable from FastAllocBase, because it has been instantiated by
+        'new' in JavaScriptCore/runtime/JSGlobalData.cpp.
+
+        * wtf/HashTable.h:
+        * wtf/FastAllocBase.h: Remove 'wtf' path from TypeTraits.h to allow use outside of wtf.
+
+2009-05-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Maciej Stachowiak and Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25126
+        Allow the buffer underlying UString to be shared.
+
+        In order to not grow the underlying size of any structure,
+        there is a union in the Rep string which holds
+         + m_sharedBuffer -- a pointer to the shared ref counted buffer
+           if the class is BaseString and the buffer is being shared OR
+         + m_baseString -- the BaseString if the class is only UString::Rep
+           but not a UString::BaseString
+
+        Ideally, m_sharedBuffer would be a RefPtr, but it cannot be because
+        it is in a union.
+
+        No change in sunspider perf.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/UString.cpp:
+        (JSC::UString::Rep::share):
+        (JSC::UString::Rep::destroy):
+        (JSC::UString::BaseString::sharedBuffer):
+        (JSC::UString::BaseString::setSharedBuffer):
+        (JSC::UString::BaseString::slowIsBufferReadOnly):
+        (JSC::expandCapacity):
+        (JSC::UString::Rep::reserveCapacity):
+        (JSC::UString::expandPreCapacity):
+        (JSC::concatenate):
+        (JSC::UString::append):
+        * runtime/UString.h:
+        (JSC::UString::Rep::Rep):
+        (JSC::UString::Rep::):
+        (JSC::UString::BaseString::isShared):
+        (JSC::UString::BaseString::isBufferReadOnly):
+        (JSC::UString::Rep::baseString):
+        * wtf/CrossThreadRefCounted.h:
+        (WTF::CrossThreadRefCounted::isShared):
+        * wtf/OwnFastMallocPtr.h: Added.
+        (WTF::OwnFastMallocPtr::OwnFastMallocPtr):
+        (WTF::OwnFastMallocPtr::~OwnFastMallocPtr):
+        (WTF::OwnFastMallocPtr::get):
+        (WTF::OwnFastMallocPtr::release):
+
+2009-05-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Re-add interpreter logic to jit-enabled builds as GCC mysteriously regresses without it
+
+        * wtf/Platform.h:
+
+2009-05-25  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Maciej Stachowiak.
+
+        The functions written in assembly need to have a leading
+        underscore on Windows too.
+
+        * jit/JITStubs.cpp:
+
+2009-05-24  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix for experimental PGO Windows target.
+        
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-05-23  David Kilzer  <ddkilzer@apple.com>
+
+        Part 1 of 2: Bug 25495: Implement PassOwnPtr and replace uses of std::auto_ptr
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25495>
+
+        Reviewed by Oliver Hunt.
+
+        * GNUmakefile.am: Added OwnPtrCommon.h and PassOwnPtr.h.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+
+        * wtf/OwnPtr.h:
+        (WTF::OwnPtr::OwnPtr): Added constructors that take a
+        PassOwnPtr.  Also added a copy constructor declaration that's
+        required when assigning a PassOwnPtr to a stack-based OwnPtr.
+        (WTF::operator=): Added assignment operator methods that take a
+        PassOwnPtr.
+        (WTF::swap): Reformatted.
+        (WTF::operator==): Whitespace changes.
+        (WTF::operator!=): Ditto.
+
+        * wtf/OwnPtrCommon.h: Added.
+        (WTF::deleteOwnedPtr):
+
+        * wtf/PassOwnPtr.h: Added.
+        (WTF::PassOwnPtr::PassOwnPtr):
+        (WTF::PassOwnPtr::~PassOwnPtr):
+        (WTF::PassOwnPtr::get):
+        (WTF::PassOwnPtr::clear):
+        (WTF::PassOwnPtr::release):
+        (WTF::PassOwnPtr::operator*):
+        (WTF::PassOwnPtr::operator->):
+        (WTF::PassOwnPtr::operator!):
+        (WTF::PassOwnPtr::operator UnspecifiedBoolType):
+        (WTF::::operator):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::static_pointer_cast):
+        (WTF::const_pointer_cast):
+        (WTF::getPtr):
+
+2009-05-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove interpreter specific logic from the JIT builds.
+
+        This saves ~100k in JSC release builds.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * wtf/Platform.h:
+
+2009-05-22  Mark Rowe  <mrowe@apple.com>
+
+        Part two of an attempted Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-22  Mark Rowe  <mrowe@apple.com>
+
+        Part one of an attempted Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        op_method_check
+
+        Optimize method calls, by caching specific function values within the Structure.
+        The new opcode is used almost like an x86 opcode prefix byte to optimize op_get_by_id,
+        where the property access is being used to read a function to be passed to op-call (i.e.
+        'foo.bar();').  This patch modifies the Structure class such that when a property is
+        put to an object for the first time we will check if the value is a function.  If it is,
+        we will cache the function value on the Structure.  A Structure in such a state guarantees
+        that not only does a property with the given identifier exist on the object, but also that
+        its value is unchanged.  Upon any further attempt to put a property with the same identifier
+        (but a different value) to the object, it will transition back to a normal Structure (where
+        it will guarantee the presence but not the value of the property).
+
+        op_method_check makes use of the new information made available by the Structure, by
+        augmenting the functionality of op_get_by_id.  Upon generating a FunctionCallDotNode a
+        check will be emitted prior to the property access reading the function value, and the JIT
+        will generate an extra (initially unlinked but patchable) set of checks prior to the regular
+        JIT code for get_by_id.  The new code will do inline structure and prototype structure check
+        (unlike a regular get_by_id, which can only handle 'self' accesses inline), and then performs
+        an immediate load of the function value, rather than using memory accesses to load the value
+        from the obejct's property storage array.  If the method check fails it will revert, or if
+        the access is polymorphic, the op_get_by_id will continue to operate - and optimize itself -
+        just as any other regular op_get_by_id would.
+
+        ~2.5% on v8-tests, due to a ~9% progression on richards.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::put):
+        (JSC::::staticFunctionGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        * JavaScriptCore.exp:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::differenceBetween):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::moveWithPatch):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::getMethodCallLinkInfoReturnLocation):
+        (JSC::CodeBlock::getMethodCallLinkInfo):
+        (JSC::CodeBlock::addMethodCallLinkInfos):
+        (JSC::CodeBlock::methodCallLinkInfo):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitMethodCheck):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::MethodCallCompilationInfo::MethodCallCompilationInfo):
+        * jit/JITOpcodes.cpp:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_method_check):
+        (JSC::JIT::emitSlow_op_method_check):
+        (JSC::JIT::emit_op_get_by_id):
+        (JSC::JIT::emitSlow_op_get_by_id):
+        (JSC::JIT::emit_op_put_by_id):
+        (JSC::JIT::emitSlow_op_put_by_id):
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::patchMethodCallProto):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_get_by_id_method_check):
+        (JSC::JITStubs::cti_op_get_by_id_method_check_second):
+        * jit/JITStubs.h:
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * parser/Nodes.cpp:
+        (JSC::FunctionCallDotNode::emitBytecode):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::put):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        (JSC::constructError):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::put):
+        (JSC::JSActivation::putWithAttributes):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::JSByteArray):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::getOwnPropertySlot):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::putWithAttributes):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::mark):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData):
+        (JSC::JSGlobalObject::methodCallDummy):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::putWithAttributes):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::getPropertyAttributes):
+        (JSC::JSObject::getPropertySpecificFunction):
+        (JSC::JSObject::putDirectFunction):
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        * runtime/JSObject.h:
+        (JSC::getJSFunction):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectWithoutTransition):
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::parseObject):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        (JSC::NativeErrorConstructor::construct):
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::):
+        (JSC::PutPropertySlot::PutPropertySlot):
+        (JSC::PutPropertySlot::setNewProperty):
+        (JSC::PutPropertySlot::setDespecifyFunctionProperty):
+        (JSC::PutPropertySlot::isCacheable):
+        (JSC::PutPropertySlot::cachedOffset):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::~Structure):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changeFunctionTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::get):
+        (JSC::Structure::despecifyFunction):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        * runtime/Structure.h:
+        (JSC::Structure::get):
+        (JSC::Structure::specificFunction):
+        * runtime/StructureTransitionTable.h:
+        (JSC::StructureTransitionTableHashTraits::emptyValue):
+        * wtf/Platform.h:
+
+2009-05-22  Brent Fulgham <bfulgham@webkit.org>
+
+        Reviewed by Steve Falkenburg.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25950
+        JavaScriptCore Fails to build on Windows (Cairo) due to CoreFoundation
+        link requirement.
+
+        Modify project to add new Debug_CFLite and Release_CFLite targets.  These
+        use the new JavaScriptCoreCFLite.vsprops to link against CFLite.dll.
+        Existing projects are changed to use the new JavaScriptCoreCF.vsprops
+        to link against CoreFoundation.dll.
+
+        The JavaScriptCoreCommon.vsprops is modified to remove the link
+        against CoreFoundation.dll.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCF.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCFLite.vsprops: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+
+2009-05-22  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15914
+        [GTK] Implement Unicode functionality using GLib
+
+        Original patch by Jürg Billeter and Naiem Shaik.
+        Implementing WTF Unicode functionality based on GLib.
+
+        * GNUmakefile.am:
+        * wtf/unicode/Unicode.h:
+        * wtf/unicode/glib: Added.
+        * wtf/unicode/glib/UnicodeGLib.cpp: Added.
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::direction):
+        (WTF::Unicode::umemcasecmp):
+        * wtf/unicode/glib/UnicodeGLib.h: Added.
+        (WTF::Unicode::):
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::toTitleCase):
+        (WTF::Unicode::isArabicChar):
+        (WTF::Unicode::isFormatChar):
+        (WTF::Unicode::isSeparatorSpace):
+        (WTF::Unicode::isPrintableChar):
+        (WTF::Unicode::isDigit):
+        (WTF::Unicode::isPunct):
+        (WTF::Unicode::mirroredChar):
+        (WTF::Unicode::category):
+        (WTF::Unicode::isLower):
+        (WTF::Unicode::digitValue):
+        (WTF::Unicode::combiningClass):
+        (WTF::Unicode::decompositionType):
+        * wtf/unicode/glib/UnicodeMacrosFromICU.h: Added.
+
+2009-05-21  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        Add MacroAssemblerCodeRef.h to file list.
+
+        * GNUmakefile.am:
+
+2009-05-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+        Addition of MacroAssemblerCodeRef.h rubber stamped by Geoff Garen.
+
+        Refactor JIT code-handle objects.  The representation of generated code is currently
+        a bit of a mess.  We have a class JITCode which wraps the pointer to a block of
+        generated code, but this object does not reference the executable pool meaning that
+        external events (the pool being derefed) could make the pointer become invalid.
+        To overcome this both the JIT and Yarr implement further (and similar) objects to
+        wrap the code pointer with a RefPtr to the pool.  To add to the mire, as well as the
+        CodeBlock containing a handle onto the code the FunctionBodyNode also contains a
+        copy of the code pointer which is used almost (but not entirely) uniquely to access
+        the JIT code for a function.
+
+        Rationalization of all this:
+
+            * Add a new type 'MacroAssembler::CodeRef' as a handle for a block of JIT generated code.
+            * Change the JIT & Yarr to internally handle code using CodeRefs.
+            * Move the CodeRef (formerly anow defunct JITCodeRef) from CodeBlock to its owner node.
+            * Remove the (now) redundant code pointer from FunctionBodyNode.
+
+        While tidying this up I've made the PatchBuffer return code in new allocations using a CodeRef,
+        and have enforced an interface that the PatchBuffer will always be used, and 'finalizeCode()' or
+        'finalizeCodeAddendum()' will always be called exactly once on the PatchBuffer to complete code generation.
+
+        This gives us a potentially useful hook ('PatchBuffer::performFinalization()') at the end of generation,
+        which may have a number of uses.  It may be helpful should we wish to switch our generation
+        model to allow RW/RX exclusive memory, and it may be useful on non-cache-coherent platforms to
+        give us an oportunity to cache flush as necessary.
+
+        No performance impact.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToTrampoline):
+        (JSC::AbstractMacroAssembler::CodeRef::CodeRef):
+        (JSC::AbstractMacroAssembler::CodeRef::trampolineAt):
+        (JSC::AbstractMacroAssembler::PatchBuffer::PatchBuffer):
+        (JSC::AbstractMacroAssembler::PatchBuffer::~PatchBuffer):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::AbstractMacroAssembler::PatchBuffer::linkTailRecursive):
+        (JSC::AbstractMacroAssembler::PatchBuffer::patch):
+        (JSC::AbstractMacroAssembler::PatchBuffer::complete):
+        (JSC::AbstractMacroAssembler::PatchBuffer::finalize):
+        (JSC::AbstractMacroAssembler::PatchBuffer::entry):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::setJITCode):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getBytecodeIndex):
+        (JSC::CodeBlock::executablePool):
+        * interpreter/CallFrameClosure.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::linkCall):
+        * jit/JIT.h:
+        * jit/JITCode.h:
+        (JSC::JITCode::JITCode):
+        (JSC::JITCode::operator bool):
+        (JSC::JITCode::addressForCall):
+        (JSC::JITCode::offsetOf):
+        (JSC::JITCode::execute):
+        (JSC::JITCode::size):
+        (JSC::JITCode::executablePool):
+        (JSC::JITCode::HostFunction):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_vm_dontLazyLinkCall):
+        (JSC::JITStubs::cti_vm_lazyLinkCall):
+        * parser/Nodes.cpp:
+        (JSC::ProgramNode::generateJITCode):
+        (JSC::EvalNode::generateJITCode):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::createNativeThunk):
+        (JSC::FunctionBodyNode::generateJITCode):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::generatedJITCode):
+        (JSC::ScopeNode::getExecutablePool):
+        (JSC::ScopeNode::setJITCode):
+        (JSC::ProgramNode::jitCode):
+        (JSC::EvalNode::jitCode):
+        (JSC::FunctionBodyNode::jitCode):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::compile):
+        (JSC::Yarr::jitCompileRegex):
+        (JSC::Yarr::executeRegex):
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
+        (JSC::Yarr::RegexCodeBlock::pcreFallback):
+        (JSC::Yarr::RegexCodeBlock::setFallback):
+        (JSC::Yarr::RegexCodeBlock::operator bool):
+        (JSC::Yarr::RegexCodeBlock::set):
+        (JSC::Yarr::RegexCodeBlock::execute):
+
+2009-05-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        <rdar://problem/6910264> REGRESSION: Cached DOM global object property access fails in browser (25921)
+        <https://bugs.webkit.org/show_bug.cgi?id=25921>
+
+        When caching properties on the global object we need to ensure that we're
+        not attempting to cache through a shell object.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobal):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_resolve_global):
+
+2009-05-21  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+
+2009-05-21  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 25945: Add support for MADV_FREE to TCMalloc
+        <https://bugs.webkit.org/show_bug.cgi?id=25945>
+        <rdar://problem/6910754>
+
+        Add support for MADV_FREE to TCMalloc_SystemRelease for platforms that
+        don't also support MADV_FREE_REUSE. The code is identical to the MADV_DONTNEED
+        case except for the advice passed to madvise(), so combining the two cases
+        makes the most sense.
+
+        * wtf/Platform.h: Only define HAVE_MADV_FREE when not building on Tiger or
+        Leopard, because while it is defined on these platforms it actually does
+        nothing.
+        * wtf/TCSystemAlloc.cpp:
+        (TCMalloc_SystemRelease): use MADV_FREE if it is available; otherwise use
+        MADV_DONTNEED.
+
+2009-05-21  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=25917> / <rdar://problem/6910066>.
+        Bug 25917: REGRESSION (r43559?): Javascript debugger crashes when pausing page
+
+        The debugger currently retrieves the arguments object from an activation rather than pulling
+        it from a call frame.  This is unreliable to due to the recent optimization to lazily create
+        the arguments object.  In the long-term it should stop doing that (<rdar://problem/6911886>),
+        but for now we force eager creation of the arguments object when debugging.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+
+2009-05-21  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 25912: Harden NumberPrototype.cpp by removing use of strcpy()
+        <https://bugs.webkit.org/show_bug.cgi?id=25912>
+
+        This causes no change on SunSpider.
+
+        * runtime/NumberPrototype.cpp:
+        (JSC::integerPartNoExp): replace strcpy() with memcpy(), ASSERT that the
+        temporary buffer has sufficient space to store the result, and move the
+        explicit null-termination closer to the memcpy() for easier visual inspection
+        of the code.
+        (JSC::fractionalPartToString): replace strcpy() with memcpy(), and ASSERT
+        that the temporary buffer has sufficient space to store the result. There
+        is no explicit null-termination because this is done by the caller. The
+        same is already true for exponentialPartToString().
+        (JSC::numberProtoFuncToExponential): replace strcpy() with memcpy(), explicitly
+        null-terminate the result, and ASSERT that the temporary buffer has sufficient
+        space to store the result.
+
+2009-05-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Cleanup the JSGlobalData when exiting early with the usage statement in jsc.
+
+        * jsc.cpp:
+        (printUsageStatement):
+        (parseArguments):
+        (jscmain):
+
+2009-05-20  Stephanie Lewis  <slewis@apple.com>
+
+        Update the order files.  <rdar://problem/6881750> Generate new order files.
+
+        * JavaScriptCore.order:
+
+2009-05-19  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Replace WREC with YARR + YARR_JIT for the Qt port. This is only
+        used when compiled with JIT support for now, so it is a drop-in
+        replacement for the WREC usage. Still including the wrec headers
+        as they are being referred from RegExp.h, though the contents of
+        that header it protected by "#if ENABLE(WREC)".
+
+        * JavaScriptCore.pri:
+
+2009-05-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix GTK debug build.
+
+        The function dumpDisjunction, compiled with debug enabled, uses
+        printf, which needs stdio.h to be included.
+
+        * yarr/RegexInterpreter.cpp:
+
+2009-05-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by George Staikos.
+
+        BUG 25843: [Qt] Remove qt-port build flag
+        <https://bugs.webkit.org/show_bug.cgi?id=25843>
+
+        * JavaScriptCore.pro:
+
+
+2009-05-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::releaseExcessCapacity): Copy-paste typo.
+
+2009-05-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed <rdar://problem/6885680> CrashTracer: [USER] 1 crash in Install
+        Mac OS X at <unknown binary> • 0x9274241c
+        
+        (Original patch by Joe Sokol and Ronnie Misra.)
+        
+        SunSpider says 1.004x faster.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::releaseExcessCapacity): Instead of doing complicated
+        math that sometimes used to overflow, just release the full range of the
+        register file.
+
+        * interpreter/RegisterFile.h:
+        (JSC::isPageAligned):
+        (JSC::RegisterFile::RegisterFile): Added ASSERTs to verify that it's
+        safe to release the full range of the register file.
+
+        (JSC::RegisterFile::shrink): No need to releaseExcessCapacity() if the
+        new end is not smaller than the old end. (Also, doing so used to cause
+        numeric overflow, unmapping basically the whole process from memory.)
+
+2009-05-19  Oliver Hunt  <oliver@apple.com>
+
+        RS=Mark Rowe.
+
+        <rdar://problem/6888393> REGRESSION: Start Debugging JavaScript crashes browser (nightly builds only?)
+        <https://bugs.webkit.org/show_bug.cgi?id=25717>
+
+        Remove JSC_FAST_CALL as it wasn't gaining us anything, and was
+        resulting in weird bugs in the nightly builds.
+
+        * parser/Nodes.cpp:
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::isNumber):
+        (JSC::ExpressionNode::isString):
+        (JSC::ExpressionNode::isNull):
+        (JSC::ExpressionNode::isPure):
+        (JSC::ExpressionNode::isLocation):
+        (JSC::ExpressionNode::isResolveNode):
+        (JSC::ExpressionNode::isBracketAccessorNode):
+        (JSC::ExpressionNode::isDotAccessorNode):
+        (JSC::ExpressionNode::isFuncExprNode):
+        (JSC::ExpressionNode::isSimpleArray):
+        (JSC::ExpressionNode::isAdd):
+        (JSC::ExpressionNode::resultDescriptor):
+        (JSC::StatementNode::firstLine):
+        (JSC::StatementNode::lastLine):
+        (JSC::StatementNode::isEmptyStatement):
+        (JSC::StatementNode::isReturnNode):
+        (JSC::StatementNode::isExprStatement):
+        (JSC::StatementNode::isBlock):
+        (JSC::NullNode::isNull):
+        (JSC::BooleanNode::isPure):
+        (JSC::NumberNode::value):
+        (JSC::NumberNode::setValue):
+        (JSC::NumberNode::isNumber):
+        (JSC::NumberNode::isPure):
+        (JSC::StringNode::isPure):
+        (JSC::StringNode::isString):
+        (JSC::ResolveNode::identifier):
+        (JSC::ResolveNode::isLocation):
+        (JSC::ResolveNode::isResolveNode):
+        (JSC::BracketAccessorNode::isLocation):
+        (JSC::BracketAccessorNode::isBracketAccessorNode):
+        (JSC::DotAccessorNode::base):
+        (JSC::DotAccessorNode::identifier):
+        (JSC::DotAccessorNode::isLocation):
+        (JSC::DotAccessorNode::isDotAccessorNode):
+        (JSC::TypeOfResolveNode::identifier):
+        (JSC::AddNode::isAdd):
+        (JSC::BlockNode::isBlock):
+        (JSC::EmptyStatementNode::isEmptyStatement):
+        (JSC::ExprStatementNode::isExprStatement):
+        (JSC::ReturnNode::isReturnNode):
+        (JSC::ScopeNode::sourceURL):
+        (JSC::ProgramNode::bytecode):
+        (JSC::EvalNode::bytecode):
+        (JSC::FunctionBodyNode::parameters):
+        (JSC::FunctionBodyNode::toSourceString):
+        (JSC::FunctionBodyNode::bytecode):
+        (JSC::FuncExprNode::isFuncExprNode):
+
+2009-05-19  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Gavin Barraclough.
+        
+        - speed up string comparison, especially for short strings
+        
+        ~1% on SunSpider
+
+        * JavaScriptCore.exp:
+        * runtime/UString.cpp:
+        * runtime/UString.h:
+        (JSC::operator==): Inline UString's operator==, since it is called from
+        hot places in the runtime. Also, specialize 2-char strings in a similar way to
+        1-char, since we're taking the hit of a switch anyway.
+
+2009-05-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Gavin Barraclough.
+        
+        - for polymorphic prototype lookups, increase the number of slots from 4 to 8
+        
+        ~4% faster on v8 raytrace benchmark
+
+        * bytecode/Instruction.h:
+
+2009-05-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        - tighten up the code for the load_varargs stub
+        
+        ~1-2% on v8-raytrace
+        
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_load_varargs): Hoist some loop invariants that
+        the compiler didn't feel like hoisting for us. Remove unneeded exception check.
+
+2009-05-18  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        - Improve code generation for access to prototype properties
+        
+        ~0.4% speedup on SunSpider.
+        
+        Based on a suggestion from Geoff Garen.
+
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+
+2009-05-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Gavin Barraclough.
+
+        Enable YARR, and disable WREC for GTK+.
+
+        * GNUmakefile.am:
+        * yarr/RegexParser.h:
+
+2009-05-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+         Reviewed by Xan Lopez.
+
+         [Gtk] Various autotools build refactoring and fixes
+         https://bugs.webkit.org/show_bug.cgi?id=25286
+
+         Add -no-install and -no-fast-install to programs and tests that we
+         don't install. Also remove -O2 since this is already handled at
+         configure time.
+
+         * GNUmakefile.am:
+
+2009-05-17  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Various autotools build refactoring and fixes
+        https://bugs.webkit.org/show_bug.cgi?id=25286
+
+        Add JavaScriptCore/ to JSC include path only since it's not
+        required when building WebCore.
+
+        * GNUmakefile.am:
+
+2009-05-17  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-05-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Looking like MSVC doesn't like static variables in inline methods?
+        Make the state of the SSE2 check a static variable on the class
+        MacroAssemblerX86Common as a speculative build fix for Windows.
+
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::convertInt32ToDouble):
+        (JSC::MacroAssemblerX86Common::branchDouble):
+        (JSC::MacroAssemblerX86Common::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerX86Common::isSSE2Present):
+        (JSC::MacroAssemblerX86Common::):
+        * jit/JIT.cpp:
+
+2009-05-15  Adam Roben  <aroben@apple.com>
+
+        Add some assembler headers to JavaScriptCore.vcproj
+
+        This is just a convenience for Windows developers.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-05-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add FP support to the MacroAssembler, port JITArithmetic over to make use of this. Also add
+        API to determine whether FP support is available 'MacroAssembler::supportsFloatingPoint()',
+        FP is presently only supported on SSE2 platforms, not x87.  On platforms where a suitable
+        hardware FPU is not available 'supportsFloatingPoint()' may simply return false, and all
+        other methods ASSERT_NOT_REACHED().
+
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::MacroAssemblerX86):
+        (JSC::MacroAssemblerX86::branch32):
+        (JSC::MacroAssemblerX86::branchPtrWithPatch):
+        (JSC::MacroAssemblerX86::supportsFloatingPoint):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::):
+        (JSC::MacroAssemblerX86Common::loadDouble):
+        (JSC::MacroAssemblerX86Common::storeDouble):
+        (JSC::MacroAssemblerX86Common::addDouble):
+        (JSC::MacroAssemblerX86Common::subDouble):
+        (JSC::MacroAssemblerX86Common::mulDouble):
+        (JSC::MacroAssemblerX86Common::convertInt32ToDouble):
+        (JSC::MacroAssemblerX86Common::branchDouble):
+        (JSC::MacroAssemblerX86Common::branchTruncateDoubleToInt32):
+        (JSC::MacroAssemblerX86Common::branch32):
+        (JSC::MacroAssemblerX86Common::branch16):
+        (JSC::MacroAssemblerX86Common::branchTest32):
+        (JSC::MacroAssemblerX86Common::branchAdd32):
+        (JSC::MacroAssemblerX86Common::branchMul32):
+        (JSC::MacroAssemblerX86Common::branchSub32):
+        (JSC::MacroAssemblerX86Common::set32):
+        (JSC::MacroAssemblerX86Common::setTest32):
+        (JSC::MacroAssemblerX86Common::x86Condition):
+        (JSC::MacroAssemblerX86Common::isSSE2Present):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::movePtrToDouble):
+        (JSC::MacroAssemblerX86_64::moveDoubleToPtr):
+        (JSC::MacroAssemblerX86_64::setPtr):
+        (JSC::MacroAssemblerX86_64::branchPtr):
+        (JSC::MacroAssemblerX86_64::branchTestPtr):
+        (JSC::MacroAssemblerX86_64::branchAddPtr):
+        (JSC::MacroAssemblerX86_64::branchSubPtr):
+        (JSC::MacroAssemblerX86_64::supportsFloatingPoint):
+        * assembler/X86Assembler.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emitSlow_op_jnlesseq):
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::emit_op_add):
+        (JSC::JIT::emitSlow_op_add):
+        (JSC::JIT::emit_op_mul):
+        (JSC::JIT::emitSlow_op_mul):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+
+2009-05-15  Francisco Tolmasky  <francisco@280north.com>
+
+        BUG 25467: JavaScript debugger should use function.displayName as the function's name in the call stack
+        <https://bugs.webkit.org/show_bug.cgi?id=25467>
+        
+        Reviewed by Adam Roben.
+
+        * JavaScriptCore.exp: Added calculatedFunctionName
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: Added calculatedFunctionName
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Added calculatedFunctionName
+        * debugger/DebuggerCallFrame.cpp: Added calculatedFunctionName to match existing one in ProfileNode.
+        (JSC::DebuggerCallFrame::calculatedFunctionName):
+        * debugger/DebuggerCallFrame.h: Added calculatedFunctionName to match existing one in ProfileNode.
+
+2009-05-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix, not reviewed.
+
+        Quick fixes for JIT builds with OPTIMIZE flags disabled.
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compilePutByIdHotPath):
+
+2009-05-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Back out incorrect Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-05-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2009-05-14  Adam Roben  <aroben@apple.com>
+
+        Windows jsc build fix
+
+        r43648 modified jsc.vcproj's post-build event not to try to copy files
+        that aren't present. Then r43661 mistakenly un-did that modification.
+        This patch restores the modification from r43648, but puts the code in
+        jscCommon.vsprops (where it should have been added in r43648).
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Restored empty
+        VCPostBuildEventTool tags.
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Modified the post-build
+        event command line to match the one in jsc.vcproj from r43648.
+
+2009-05-14  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25325
+
+        Make sure pthread_self() is declared before it gets called in Collector.cpp
+
+        * runtime/Collector.cpp: Include pthread.h in most Unix-like platforms
+        (not just for OPENBSD)
+
+2009-05-14  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=25785>.
+        Bug 25785: Segfault in mark when using JSObjectMakeConstructor
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor): OpaqueJSClass::prototype can return 0.  We need to use the default object prototype when it does.
+        * API/tests/testapi.c:
+        (main): Add a test case.
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirect): Add a clearer assertion for a null value.  The assertion on the next line does catch this,
+        but the cause of the failure is not clear from the assertion itself.
+
+2009-05-14  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Darin Adler.
+
+        <rdar://problem/6681868> When building with Xcode 3.1.3 should be using gcc 4.2
+
+        The meaning of XCODE_VERSION_ACTUAL is more sensible in newer versions of Xcode.
+        Update our logic to select the compiler version to use the more appropriate XCODE_VERSION_MINOR
+        if the version of Xcode supports it, and fall back to XCODE_VERSION_ACTUAL if not.
+
+        * Configurations/Base.xcconfig:
+
+2009-05-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Checking register file bounds should be a ptr comparison (m_end is a Register*).
+        Also, the compare should be unsigned, pointers don'ts go negative.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+
+2009-05-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix <rdar://problem/6882919> REGRESSION: page at Metroauto site crashes in cti_op_loop_if_less (25730)
+
+        op_loop_if_less (imm < op) was loading op into regT1, but in the slow path spills regT0.
+        This leads to bad happen.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_less):
+        (JSC::JIT::emitSlow_op_loop_if_less):
+
+2009-05-13  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25746
+        Revert http://trac.webkit.org/changeset/43507 which caused crash in PPC nightlies with Safari 4.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingThread::start):
+        (JSC::SamplingThread::stop):
+        * bytecode/SamplingTool.h:
+        * wtf/CrossThreadRefCounted.h:
+        (WTF::CrossThreadRefCounted::CrossThreadRefCounted):
+        (WTF::::ref):
+        (WTF::::deref):
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::clearPthreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+        * wtf/ThreadingWin.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::clearThreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::identifierByGthreadHandle):
+        (WTF::establishIdentifierForThread):
+        (WTF::threadForIdentifier):
+        (WTF::clearThreadForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::threadMapMutex):
+        (WTF::threadMap):
+        (WTF::identifierByQthreadHandle):
+        (WTF::establishIdentifierForThread):
+        (WTF::clearThreadForIdentifier):
+        (WTF::threadForIdentifier):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+2009-05-13  Darin Adler  <darin@apple.com>
+
+        Revert the parser arena change. It was a slowdown, not a speedup.
+        Better luck next time (I'll break it up into pieces).
+
+2009-05-13  Darin Adler  <darin@apple.com>
+
+        Tiger build fix.
+
+        * parser/Grammar.y: Add back empty code blocks, needed by older
+        versions of bison on certain rules.
+
+2009-05-13  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+
+2009-05-13  Adam Roben  <aroben@apple.com>
+
+        Windows build fixes after r43642
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Updated.
+
+        * debugger/Debugger.cpp:
+        * runtime/ArrayConstructor.cpp:
+        * runtime/JSArray.cpp:
+        * runtime/RegExp.cpp:
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpPrototype.cpp:
+        * runtime/StringPrototype.cpp:
+        Added missing #includes.
+
+2009-05-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 25674: syntax tree nodes should use arena allocation
+        https://bugs.webkit.org/show_bug.cgi?id=25674
+
+        Step 3: Add some actual arena allocation. About 1% SunSpider speedup.
+
+        * JavaScriptCore.exp: Updated.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Updated since VarStack
+        contains const Identifier* now.
+        (JSC::BytecodeGenerator::emitPushNewScope): Updated to take a const
+        Identifier&.
+        * bytecompiler/BytecodeGenerator.h: Ditto
+
+        * bytecompiler/SegmentedVector.h: Added isEmpty.
+
+        * debugger/Debugger.cpp:
+        (JSC::Debugger::recompileAllJSFunctions): Moved this function here from
+        WebCore so WebCore doesn't need the details of FunctionBodyNode.
+        * debugger/Debugger.h: Ditto.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute): Updated since VarStack contains const
+        Identifier* now.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_vm_lazyLinkCall): Call isHostFunction on the body
+        rather than on the function object, since we can't easily have inlined
+        access to the FunctionBodyNode in JSFunction.h since WebCore needs
+        access to that header.
+        (JSC::JITStubs::cti_op_construct_JSConstruct): Ditto.
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier): Ditto.
+
+        * parser/Grammar.y: Use JSGlobalData* to pass the global data pointer
+        around whenever possible instead of using void*. Changed
+        SET_EXCEPTION_LOCATION from a macro to an inline function. Marked
+        the structure-creating functions inline. Changed the VarStack to use
+        identifier pointers instead of actual identifiers. This takes
+        advantage of the fact that all identifier pointers come from the
+        arena and avoids reference count churn. Changed Identifier* to
+        const Identifier* to make sure we don't modify any by accident.
+        Used identifiers for regular expression strings too, using the new
+        scanRegExp that has out parameters instead of the old one that relied
+        on side effects in the Lexer. Move the creation of numeric identifiers
+        out of this file and into the PropertyNode constructor.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode): Pass in ParserArena, used for identifiers.
+        (JSC::Lexer::makeIdentifier): Changed return type to const Identifier*
+        and changed to call ParserArena.
+        (JSC::Lexer::scanRegExp): Added out arguments that are const Identifier*
+        as well as a prefix character argument so we can handle the /= case
+        without a string append.
+        (JSC::Lexer::skipRegExp): Added. Skips a regular expression without
+        allocating Identifier objects.
+        (JSC::Lexer::clear): Removed the code to manage m_identifiers, m_pattern,
+        and m_flags, and added code to set m_arena to 0.
+        * parser/Lexer.h: Updated for changes above.
+
+        * parser/NodeConstructors.h:
+        (JSC::ParserArenaFreeable::operator new): Added. Calls allocateFreeable
+        on the arena.
+        (JSC::ParserArenaDeletable::operator new): Changed to call the
+        allocateDeletable function on the arena instead of deleteWithArena.
+        (JSC::RegExpNode::RegExpNode): Changed arguments to Identifier instead
+        of UString since these come from the parser which makes identifiers.
+        (JSC::PropertyNode::PropertyNode): Added new constructor that makes
+        numeric identifiers. Some day we might want to optimize this for
+        integers so it doesn't create a string for each one.
+        (JSC::ContinueNode::ContinueNode): Initialize m_ident to nullIdentifier
+        since it's now a const Identifier& so it can't be left uninitialized.
+        (JSC::BreakNode::BreakNode): Ditto.
+        (JSC::CaseClauseNode::CaseClauseNode): Updated to use SourceElements*
+        to keep track of the statements rather than a separate statement vector.
+        (JSC::BlockNode::BlockNode): Ditto.
+        (JSC::ForInNode::ForInNode): Initialize m_ident to nullIdentifier.
+
+        * parser/Nodes.cpp: Moved the comment explaining emitBytecode in here.
+        It seemed strangely out of place in the header.
+        (JSC::ThrowableExpressionData::emitThrowError): Added an overload for
+        UString as well as Identifier.
+        (JSC::SourceElements::singleStatement): Added.
+        (JSC::SourceElements::lastStatement): Added.
+        (JSC::RegExpNode::emitBytecode): Updated since the pattern and flags
+        are now Identifier instead of UString. Also changed the throwError code
+        to use the substitution mechanism instead of doing a string append.
+        (JSC::SourceElements::emitBytecode): Added. Replaces the old
+        statementListEmitCode function, since we now keep the SourceElements
+        objects around.
+        (JSC::BlockNode::lastStatement): Added.
+        (JSC::BlockNode::emitBytecode): Changed to use emitBytecode instead of
+        statementListEmitCode.
+        (JSC::CaseClauseNode::emitBytecode): Added.
+        (JSC::CaseBlockNode::emitBytecodeForBlock): Changed to use emitBytecode
+        instead of statementListEmitCode.
+        (JSC::ScopeNodeData::ScopeNodeData): Changed to store the
+        SourceElements* instead of using releaseContentsIntoVector.
+        (JSC::ScopeNode::emitStatementsBytecode): Added.
+        (JSC::ScopeNode::singleStatement): Added.
+        (JSC::ProgramNode::emitBytecode): Call emitStatementsBytecode instead
+        of statementListEmitCode.
+        (JSC::EvalNode::emitBytecode): Ditto.
+        (JSC::EvalNode::generateBytecode): Removed code to clear the children
+        vector. This optimization is no longer possible since everything is in
+        a single arena.
+        (JSC::FunctionBodyNode::emitBytecode): Call emitStatementsBytecode
+        insetad of statementListEmitCode and check for the return node using
+        the new functions.
+
+        * parser/Nodes.h: Changed VarStack to store const Identifier* instead
+        of Identifier and rely on the arena to control lifetime. Added a new
+        ParserArenaFreeable class. Made ParserArenaDeletable inherit from
+        FastAllocBase instead of having its own operator new. Base the Node
+        class on ParserArenaFreeable. Changed the various Node classes
+        to use const Identifier& instead of Identifier to avoid the need to
+        call their destructors and allow them to function as "freeable" in the
+        arena. Removed extraneous JSC_FAST_CALL on definitions of inline functions.
+        Changed ElementNode, PropertyNode, ArgumentsNode, ParameterNode,
+        CaseClauseNode, ClauseListNode, and CaseBlockNode to use ParserArenaFreeable
+        as a base class since they do not descend from Node. Eliminated the
+        StatementVector type and instead have various classes use SourceElements*
+        instead of StatementVector. This prevents those classes from having th
+        use ParserArenaDeletable to make sure the vector destructor is called.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::parse): Pass the arena to the lexer.
+
+        * parser/Parser.h: Added an include of ParserArena.h, which is no longer
+        included by Nodes.h.
+
+        * parser/ParserArena.cpp:
+        (JSC::ParserArena::ParserArena): Added. Initializes the new members,
+        m_freeableMemory, m_freeablePoolEnd, and m_identifiers.
+        (JSC::ParserArena::freeablePool): Added. Computes the pool pointer,
+        since we store only the current pointer and the end of pool pointer.
+        (JSC::ParserArena::deallocateObjects): Added. Contains the common
+        memory-deallocation logic used by both the destructor and the
+        reset function.
+        (JSC::ParserArena::~ParserArena): Changed to call deallocateObjects.
+        (JSC::ParserArena::reset): Ditto. Also added code to zero out the
+        new structures, and switched to use clear() instead of shrink(0) since
+        we don't really reuse arenas.
+        (JSC::ParserArena::makeNumericIdentifier): Added.
+        (JSC::ParserArena::allocateFreeablePool): Added. Used when the pool
+        is empty.
+        (JSC::ParserArena::isEmpty): Added. No longer inline, which is fine
+        since this is used only for assertions at the moment.
+
+        * parser/ParserArena.h: Added an actual arena of "freeable" objects,
+        ones that don't need destructors to be called. Also added the segmented
+        vector of identifiers that used to be in the Lexer.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::extractFunctionBody): Use singleStatement function rather than
+        getting at a StatementVector.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString): Call isHostFunction on the body
+        rather than the function object.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction): Moved the structure version of this in
+        here from the header. It's not hot enough that it needs to be inlined.
+        (JSC::JSFunction::isHostFunction): Moved this in here from the header.
+        It's now a helper to be used only within the class.
+        (JSC::JSFunction::setBody): Moved this in here. It's not hot enough that
+        it needs to be inlined, and we want to be able to compile the header
+        without the definition of FunctionBodyNode.
+
+        * runtime/JSFunction.h: Eliminated the include of "Nodes.h". This was
+        exposing too much JavaScriptCore dependency to WebCore. Because of this
+        change and some changes made to WebCore, we could now export a lot fewer
+        headers from JavaScriptCore, but I have not done that yet in this check-in.
+        Made a couple functions non-inline. Removes some isHostFunction() assertions.
+        
+        * wtf/FastAllocBase.h: Added the conventional using statements we use in
+        WTF so we can use identifiers from the WTF namespace without explicit
+        namespace qualification or namespace directive. This is the usual WTF style,
+        although it's unconventional in the C++ world. We use the namespace primarily
+        for link-time disambiguation, not compile-time.
+
+        * wtf/FastMalloc.cpp: Fixed an incorrect comment.
+
+2009-05-13  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix: add JITStubCall.h to files list.
+
+        * GNUmakefile.am:
+
+2009-05-13  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Unreviewed build fix, as suggested by Yael Aharon <yael.aharon@nokia.com>.
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::waitForThreadCompletion): renamed IsValid to isValid.
+
+2009-05-13  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Revert r43562 - [Gtk] WTF_USE_JSC is already defined in
+        WebCore/config.h.
+
+        * wtf/Platform.h:
+
+2009-05-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add SamplingCounter tool to provide a simple mechanism for counting events in JSC
+        (enabled using ENABLE(SAMPLING_COUNTERS)).  To count events within a single function
+        use the class 'SamplingCounter', where the counter may be incremented from multiple
+        functions 'GlobalSamplingCounter' may be convenient; all other counters (stack or
+        heap allocated, rather than statically declared) should use the DeletableSamplingCounter.
+        Further description of these classes is provided alongside their definition in 
+        SamplingTool.h.
+
+        Counters may be incremented from c++ by calling the 'count()' method on the counter,
+        or may be incremented by JIT code by using the 'emitCount()' method within the JIT.
+
+        This patch also fixes CODEBLOCK_SAMPLING, which was missing a null pointer check.
+
+        * JavaScriptCore.exp:
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::addWithCarry32):
+        (JSC::MacroAssemblerX86::and32):
+        (JSC::MacroAssemblerX86::or32):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::and32):
+        (JSC::MacroAssemblerX86Common::or32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::and32):
+        (JSC::MacroAssemblerX86_64::or32):
+        (JSC::MacroAssemblerX86_64::addPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::adcl_im):
+        (JSC::X86Assembler::addq_im):
+        (JSC::X86Assembler::andl_im):
+        (JSC::X86Assembler::orl_im):
+        * bytecode/SamplingTool.cpp:
+        (JSC::AbstractSamplingCounter::dump):
+        * bytecode/SamplingTool.h:
+        (JSC::AbstractSamplingCounter::count):
+        (JSC::GlobalSamplingCounter::name):
+        (JSC::SamplingCounter::SamplingCounter):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::setSamplingFlag):
+        (JSC::JIT::clearSamplingFlag):
+        (JSC::JIT::emitCount):
+        * jsc.cpp:
+        (runWithScripts):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        * wtf/Platform.h:
+
+2009-05-13  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+
+2009-05-12  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+
+2009-05-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/6881457> Crash occurs at JSC::Interpreter::execute() when loading http://www.sears.com
+
+        We created the arguments objects before an op_push_scope but not
+        before op_push_new_scope, this meant a null arguments object could
+        be resolved inside catch blocks.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPushNewScope):
+
+2009-05-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/6879881> Crash occurs at JSC::JSActivation::mark() when loading http://www.monster.com; http://www.cnet.com
+        <https://bugs.webkit.org/show_bug.cgi?id=25736> Crash loading www.google.dk/ig (and other igoogle's as well)
+
+        Following on from the lazy arguments creation patch, it's now
+        possible for an activation to to have a null register in the callframe
+        so we can't just blindly mark the local registers in an activation,
+        and must null check first instead.
+
+        * API/tests/testapi.c:
+        (functionGC):
+        * API/tests/testapi.js:
+        (bludgeonArguments.return.g):
+        (bludgeonArguments):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::mark):
+
+2009-05-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Geoff Garen.
+
+        WTF_USE_CTI_REPATCH_PIC is no longer used, remove.
+
+        * jit/JIT.h:
+        * jit/JITStubCall.h:
+
+2009-05-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        We've run into some problems where changing the size of the class JIT leads to
+        performance fluctuations.  Try forcing alignment in an attempt to stabalize this.
+
+        * jit/JIT.h:
+
+2009-05-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Add ParserArena.cpp to the build.
+
+        * JavaScriptCoreSources.bkl:
+
+2009-05-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Unsigned underflow on 64bit cannot be treated as a negative number
+
+        This code included some placeswhere we deliberately create negative offsets
+        from unsigned values, on 32bit this is "safe", but in 64bit builds much
+        badness occurs. Solution is to use signed types as nature intended.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_load_varargs):
+
+2009-05-12  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [Gtk] Various autotools build refactoring and fixes
+        https://bugs.webkit.org/show_bug.cgi?id=25286
+
+        Define WTF_USE_JSC for the Gtk port.
+
+        * wtf/Platform.h:
+
+2009-05-12  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        - allow all of strictEqual to be inlined into cti_op_stricteq once again
+        
+        We had this optimization once but accidentally lost it at some point.
+
+        * runtime/Operations.h:
+        (JSC::JSValue::strictEqualSlowCaseInline):
+        (JSC::JSValue::strictEqual):
+
+2009-05-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        instanceof should throw if the constructor being tested does not implement
+        'HasInstance" (i.e. is a function).  Instead we were returning false.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::isInvalidParamForIn):
+        (JSC::isInvalidParamForInstanceOf):
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_instanceof):
+        * tests/mozilla/ecma_2/instanceof/instanceof-003.js:
+            Fix broken test case.
+        * tests/mozilla/ecma_2/instanceof/regress-7635.js:
+            Remove broken test case (was an exact duplicate of a test in instanceof-003.js).
+
+2009-05-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve function call forwarding performance
+
+        Make creation of the Arguments object occur lazily, so it
+        is not necessarily created for every function that references
+        it.  Then add logic to Function.apply to allow it to avoid
+        allocating the Arguments object at all.  Helps a lot with
+        the function forwarding/binding logic in jQuery, Prototype,
+        and numerous other JS libraries.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::registerFor):
+        (JSC::BytecodeGenerator::willResolveToArguments):
+        (JSC::BytecodeGenerator::uncheckedRegisterForArguments):
+        (JSC::BytecodeGenerator::createArgumentsIfNecessary):
+        (JSC::BytecodeGenerator::emitCallEval):
+        (JSC::BytecodeGenerator::emitPushScope):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_create_arguments):
+        (JSC::JIT::emit_op_init_arguments):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_tear_off_arguments):
+        (JSC::JITStubs::cti_op_load_varargs):
+        * parser/Nodes.cpp:
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+
+2009-05-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Enable use of SamplingFlags directly from JIT code.
+
+        * bytecode/SamplingTool.h:
+        * jit/JIT.h:
+        (JSC::JIT::sampleCodeBlock):
+        (JSC::JIT::sampleInstruction):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::setSamplingFlag):
+        (JSC::JIT::clearSamplingFlag):
+
+2009-05-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Implement JIT generation for instanceof for non-objects (always returns false).
+        Also fixes the sequencing of the prototype and value isObject checks, to no match the spec.
+
+        0.5% progression on v8 tests overall, due to 3.5% on early-boyer.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::hasInstance):
+        * runtime/TypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+
+2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        A little more JIT refactoring.
+        
+        Rearranged code to more clearly indicate what's conditionally compiled
+        and why. Now, all shared code is at the top of our JIT files, and all
+        #if'd code is at the bottom. #if'd code is delineated by large comments.
+        
+        Moved functions that relate to the JIT but don't explicitly do codegen
+        into JIT.cpp. Refactored SSE2 check to store its result as a data member
+        in the JIT.
+
+        * jit/JIT.cpp:
+        (JSC::isSSE2Present):
+        (JSC::JIT::JIT):
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::linkCall):
+        * jit/JIT.h:
+        (JSC::JIT::isSSE2Present):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCallVarargsSlowCase):
+
+2009-05-11  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Build fix.
+
+        * JavaScriptCore.pri: Build the new JITOpcodes.cpp
+
+2009-05-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        More re-factoring of JIT code generation.  Use a macro to
+        forward the main switch-statement cases to the helper functions.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+
+2009-05-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        More re-factoring of JIT code generation to move opcode generation
+        to helper functions outside the main switch-statement and gave those
+        helper functions standardized names. This patch covers the remaining
+        slow cases.
+
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+
+2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * GNUmakefile.am: Added JITOpcodes.cpp and JITStubCall.h to the project.
+
+2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Added
+        JITOpcodes.cpp and JITStubCall.h to the project.
+
+2009-05-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Some JIT refactoring.
+        
+        Moved JITStubCall* into its own header.
+        
+        Modified JITStubCall to ASSERT that its return value is handled correctly.
+        Also, replaced function template with explicit instantiations to resolve
+        some confusion.
+        
+        Replaced all uses of emit{Get,Put}CTIArgument with explicit peeks, pokes,
+        and calls to killLastResultRegister().
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        * jit/JITCall.cpp:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        * jit/JITPropertyAccess.cpp:
+        * jit/JITStubCall.h: Copied from jit/JIT.h.
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::addArgument):
+        (JSC::JITStubCall::call):
+        (JSC::JITStubCall::):
+
+2009-05-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Start re-factoring JIT code generation to move opcode generation
+        to helper functions outside the main switch-statement and gave those
+        helper functions standardized names.  This patch only covers the main
+        pass and all the arithmetic opcodes in the slow path.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        * jit/JITOpcodes.cpp: Copied from jit/JIT.cpp.
+        * jit/JITPropertyAccess.cpp:
+
+2009-05-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Re-add experimental PGO configs.
+        
+        Reviewed by Adam Roben.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+
+2009-05-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey "1" Garen.
+
+        Rip out the !USE(CTI_REPATCH_PIC) code.  It was untested and unused.
+
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdChainList):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compileCTIMachineTrampolines):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::tryCachePutByID):
+        (JSC::JITStubs::tryCacheGetByID):
+
+2009-05-11  Dmitry Titov  <dimich@chromium.org>
+
+        GTK build fix - the deprecated waitForThreadCompletion is not needed on GTK.
+
+        * wtf/ThreadingPthreads.cpp: used #ifdef PLATFORM(DARWIN) around waitForThreadCompletion().
+
+2009-05-11  Adam Roben  <aroben@apple.com>
+
+        Build fix for newer versions of GCC
+
+        * wtf/ThreadingPthreads.cpp: Added a declaration of
+        waitForThreadCompletion before its definition to silence a warning.
+
+2009-05-11  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov and Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25348
+        Change WTF::ThreadIdentifier to be an actual (but wrapped) thread id, remove ThreadMap.
+
+        * wtf/Threading.h:
+        (WTF::ThreadIdentifier::ThreadIdentifier):
+        (WTF::ThreadIdentifier::isValid):
+        (WTF::ThreadIdentifier::invalidate):
+        (WTF::ThreadIdentifier::platformId):
+        ThreadIdentifier is now a class, containing a PlatformThreadIdentifier and
+        methods that are used across the code on thread ids: construction, comparisons,
+        check for 'valid' state etc. '0' is used as invalid id, which happens to just work
+        with all platform-specific thread id implementations.
+
+        All the following files repeatedly reflect the new ThreadIdentifier for each platform.
+        We remove ThreadMap and threadMapMutex from all of them, remove the functions that
+        populated/searched/cleared the map and add platform-specific comparison operators
+        for ThreadIdentifier.
+
+        There are specific temporary workarounds for Safari 4 beta on OSX and Win32 since the
+        public build uses WTF threading functions with old type of ThreadingIdentifier.
+        The next time Safari 4 is rebuilt, it will 'automatically' pick up the new type and new
+        functions so the deprecated ones can be removed.
+
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+        * wtf/ThreadingNone.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+        (WTF::waitForThreadCompletion): This is a workaround for Safari 4 beta on Mac.
+        Safari 4 is linked against old definition of ThreadIdentifier so it treats it as uint32_t.
+        This 'old' variant of waitForThreadCompletion takes uint32_t and has the old decorated name, so Safari can
+        load it from JavaScriptCore library. The other functions (CurrentThread() etc) happen to match their previous
+        decorated names and, while they return pthread_t now, it is a pointer which round-trips through a uint32_t.
+        This function will be removed as soon as Safari 4 will release next public build.
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal): All the platforms (except Windows) used a sequential
+        counter as a thread ID and mapped it into platform ID. Windows was using native thread
+        id and mapped it into thread handle. Since we can always obtain a thread handle
+        by thread id, createThread now closes the handle.
+        (WTF::waitForThreadCompletion): obtains another one using OpenThread(id) API. If can not obtain a handle,
+        it means the thread already exited.
+        (WTF::detachThread):
+        (WTF::currentThread):
+        (WTF::detachThreadDeprecated): old function, renamed (for Win Safari 4 beta which uses it for now).
+        (WTF::waitForThreadCompletionDeprecated): same.
+        (WTF::currentThreadDeprecated): same.
+        (WTF::createThreadDeprecated): same.
+
+        * bytecode/SamplingTool.h:
+        * bytecode/SamplingTool.cpp: Use DEFINE_STATIC_LOCAL for a static ThreadIdentifier variable, to avoid static constructor.
+
+        * JavaScriptCore.exp: export lists - updated decorated names of the WTF threading functions
+        since they now take a different type as a parameter.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: ditto for Windows, plus added "deprecated" functions
+        that take old parameter type - turns out public beta of Safari 4 uses those, so they need to be kept along for a while.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: ditto.
+
+2009-05-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 25560: REGRESSION (r34821): "string value".__proto__ gets the wrong object.
+        https://bugs.webkit.org/show_bug.cgi?id=25560
+        rdar://problem/6861069
+
+        I missed this case back a year ago when I sped up handling
+        of JavaScript wrappers. Easy to fix.
+
+        * runtime/JSObject.h:
+        (JSC::JSValue::get): Return the prototype itself if the property name
+        is __proto__.
+        * runtime/JSString.cpp:
+        (JSC::JSString::getOwnPropertySlot): Ditto.
+
+2009-05-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Rename emitGetFromCallFrameHeader to emitGetFromCallFrameHeaderPtr
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetFromCallFrameHeaderPtr):
+        (JSC::JIT::emitGetFromCallFrameHeader32):
+
+2009-05-11  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix. Build ParserAreana.cpp for Qt
+
+        * JavaScriptCore.pri:
+
+2009-05-11  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24536
+
+        Symbian compilers cannot resolve WTF::PassRefPtr<JSC::Profile>
+        unless Profile.h is included.
+
+        * profiler/ProfileGenerator.h:
+
+2009-05-11  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24284
+
+        * JavaScriptCore.pri: coding style modified
+        * jsc.pro: duplicated values removed from INCLUDEPATH, DEFINES
+
+2009-05-11  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by NOBODY (build fix).
+
+        Also add ParserArena, in addition to AllInOne, for release builds,
+        since adding it to AllInOne breaks Mac.
+
+        * GNUmakefile.am:
+
+2009-05-11  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix. Adding ParserArena to the autotools build.
+
+        * GNUmakefile.am:
+
+2009-05-11  Adam Roben  <aroben@apple.com>
+
+        More Windows build fixes after r43479
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Export ParserArena::reset.
+
+2009-05-11  Adam Roben  <aroben@apple.com>
+
+        Windows build fixes after r43479
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Added
+        ParserArena to the project.
+
+        * parser/NodeConstructors.h: Added a missing include.
+        (JSC::ParserArenaDeletable::operator new): Marked these as inline.
+
+2009-05-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff Garen.
+        
+        - fixed REGRESSION(r43432): Many JavaScriptCore tests crash in 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=25680
+
+        Accound for the 64-bit instruction prefix when rewriting mov to lea on 64-bit.
+        
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+
+2009-05-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 25674: syntax tree nodes should use arena allocation
+        https://bugs.webkit.org/show_bug.cgi?id=25674
+
+        Part two: Remove reference counting from most nodes.
+
+        * JavaScriptCore.exp: Updated.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added ParserArena.h and .cpp.
+
+        * parser/Grammar.y: Replaced uses of ParserRefCountedData with uses of
+        ParserArenaData. Took out now-nonfunctional code that tries to manually
+        release declaration list. Changed the new calls that create FuncDeclNode
+        and FuncExprNode so that they use the proper version of operator new for
+        the reference-counted idiom, not the deletion idiom.
+
+        * parser/NodeConstructors.h:
+        (JSC::ParserArenaDeletable::operator new): Added.
+        (JSC::ParserArenaRefCounted::ParserArenaRefCounted): Added.
+        (JSC::Node::Node): Removed ParserRefCounted initializer.
+        (JSC::ElementNode::ElementNode): Ditto.
+        (JSC::PropertyNode::PropertyNode): Ditto.
+        (JSC::ArgumentsNode::ArgumentsNode): Ditto.
+        (JSC::SourceElements::SourceElements): Ditto.
+        (JSC::ParameterNode::ParameterNode): Ditto.
+        (JSC::FuncExprNode::FuncExprNode): Added ParserArenaRefCounted initializer.
+        (JSC::FuncDeclNode::FuncDeclNode): Ditto.
+        (JSC::CaseClauseNode::CaseClauseNode): Removed ParserRefCounted initializer.
+        (JSC::ClauseListNode::ClauseListNode): Ditto.
+        (JSC::CaseBlockNode::CaseBlockNode): Ditto.
+
+        * parser/NodeInfo.h: Replaced uses of ParserRefCountedData with uses of
+        ParserArenaData.
+
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode): Added ParserArenaRefCounted initializer.
+        (JSC::ProgramNode::create): Use the proper version of operator new for
+        the reference-counted idiom, not the deletion idiom. Use the arena
+        contains function instead of the vecctor find function.
+        (JSC::EvalNode::create): Use the proper version of operator new for
+        the reference-counted idiom, not the deletion idiom. Use the arena
+        reset function instead of the vector shrink function.
+        (JSC::FunctionBodyNode::createNativeThunk): Use the proper version
+        of operator new for the reference-counted idiom, not the deletion idiom.
+        (JSC::FunctionBodyNode::create): More of the same.
+
+        * parser/Nodes.h: Added ParserArenaDeletable and ParserArenaRefCounted
+        to replace ParserRefCounted. Fixed inheritance so only the classes that
+        need reference counting inherit from ParserArenaRefCounted.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::parse): Set m_sourceElements to 0 since it now starts
+        uninitialized. Just set it to 0 again in the failure case, since it's
+        now just a raw pointer, not an owning one.
+        (JSC::Parser::reparseInPlace): Removed now-unneeded get() function.
+        (JSC::Parser::didFinishParsing): Replaced uses of ParserRefCountedData
+        with uses of ParserArenaData.
+
+        * parser/Parser.h: Less RefPtr, more arena.
+
+        * parser/ParserArena.cpp: Added.
+        * parser/ParserArena.h: Added.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData): Removed arena-related code, since it's
+        now in the Parser.
+        (JSC::JSGlobalData::createLeaked): Removed unneeded #ifndef.
+        (JSC::JSGlobalData::createNativeThunk): Tweaked #if a bit.
+
+        * runtime/JSGlobalData.h: Removed parserArena, which is now in Parser.
+
+        * wtf/RefCounted.h: Added deletionHasBegun function, for use in
+        assertions to catch deletion not done by the deref function.
+
+2009-05-10  David Kilzer  <ddkilzer@apple.com>
+
+        Part 2: Try to fix the Windows build by adding a symbol which is really just a re-mangling of a changed method signature
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-10  David Kilzer  <ddkilzer@apple.com>
+
+        Try to fix the Windows build by removing an unknown symbol
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-10  David Kilzer  <ddkilzer@apple.com>
+
+        Touch Nodes.cpp to try to fix Windows build
+
+        * parser/Nodes.cpp: Removed whitespace.
+
+2009-05-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Quick fix for failures seen on buildbot. Maciej plans a better fix later.
+
+        * wtf/dtoa.cpp: Change the hardcoded number of 32-bit words in a BigInt
+        from 32 to 64. Parsing "1e500", for example, requires more than 32 words.
+
+2009-05-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25674: syntax tree nodes should use arena allocation
+        Part one: Change lifetimes so we won't have to use reference
+        counting so much, but don't eliminate the reference counts
+        entirely yet.
+
+        * JavaScriptCore.exp: Updated.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Update for use of raw pointers
+        instead of RefPtr.
+        (JSC::BytecodeGenerator::emitCall): Ditto.
+        (JSC::BytecodeGenerator::emitConstruct): Ditto.
+
+        * parser/Grammar.y: Update node creating code to use new (JSGlobalData*)
+        instead of the plain new. At the moment this is just a hook for future
+        arena allocation; it's inline and JSGlobalData* is not used.
+
+        * parser/NodeConstructors.h: Updated for name change of parserObjects to
+        parserArena. Also added explicit initialization for raw pointers that used
+        to be RefPtr. Also removed some uses of get() that aren't needed now that
+        the pointers are raw pointers. Also eliminated m_parameter from FuncExprNode
+        and FuncDeclNode. Also changed node-creating code to use new (JSGlobalData*)
+        as above.
+
+        * parser/Nodes.cpp: Eliminated NodeReleaser and all use of it.
+        (JSC::ParserRefCounted::ParserRefCounted): Updated for name change of
+        parserObjects to parserArena.
+        (JSC::SourceElements::append): Use raw pointers.
+        (JSC::ArrayNode::emitBytecode): Ditto.
+        (JSC::ArrayNode::isSimpleArray): Ditto.
+        (JSC::ArrayNode::toArgumentList): Ditto.
+        (JSC::ObjectLiteralNode::emitBytecode): Ditto.
+        (JSC::PropertyListNode::emitBytecode): Ditto.
+        (JSC::BracketAccessorNode::emitBytecode): Ditto.
+        (JSC::DotAccessorNode::emitBytecode): Ditto.
+        (JSC::ArgumentListNode::emitBytecode): Ditto.
+        (JSC::NewExprNode::emitBytecode): Ditto.
+        (JSC::EvalFunctionCallNode::emitBytecode): Ditto.
+        (JSC::FunctionCallValueNode::emitBytecode): Ditto.
+        (JSC::FunctionCallResolveNode::emitBytecode): Ditto.
+        (JSC::FunctionCallBracketNode::emitBytecode): Ditto.
+        (JSC::FunctionCallDotNode::emitBytecode): Ditto.
+        (JSC::CallFunctionCallDotNode::emitBytecode): Ditto.
+        (JSC::ApplyFunctionCallDotNode::emitBytecode): Ditto.
+        (JSC::PostfixBracketNode::emitBytecode): Ditto.
+        (JSC::PostfixDotNode::emitBytecode): Ditto.
+        (JSC::DeleteBracketNode::emitBytecode): Ditto.
+        (JSC::DeleteDotNode::emitBytecode): Ditto.
+        (JSC::DeleteValueNode::emitBytecode): Ditto.
+        (JSC::VoidNode::emitBytecode): Ditto.
+        (JSC::TypeOfValueNode::emitBytecode): Ditto.
+        (JSC::PrefixBracketNode::emitBytecode): Ditto.
+        (JSC::PrefixDotNode::emitBytecode): Ditto.
+        (JSC::UnaryOpNode::emitBytecode): Ditto.
+        (JSC::BinaryOpNode::emitStrcat): Ditto.
+        (JSC::BinaryOpNode::emitBytecode): Ditto.
+        (JSC::EqualNode::emitBytecode): Ditto.
+        (JSC::StrictEqualNode::emitBytecode): Ditto.
+        (JSC::ReverseBinaryOpNode::emitBytecode): Ditto.
+        (JSC::ThrowableBinaryOpNode::emitBytecode): Ditto.
+        (JSC::InstanceOfNode::emitBytecode): Ditto.
+        (JSC::LogicalOpNode::emitBytecode): Ditto.
+        (JSC::ConditionalNode::emitBytecode): Ditto.
+        (JSC::ReadModifyResolveNode::emitBytecode): Ditto.
+        (JSC::AssignResolveNode::emitBytecode): Ditto.
+        (JSC::AssignDotNode::emitBytecode): Ditto.
+        (JSC::ReadModifyDotNode::emitBytecode): Ditto.
+        (JSC::AssignBracketNode::emitBytecode): Ditto.
+        (JSC::ReadModifyBracketNode::emitBytecode): Ditto.
+        (JSC::CommaNode::emitBytecode): Ditto.
+        (JSC::ConstDeclNode::emitCodeSingle): Ditto.
+        (JSC::ConstDeclNode::emitBytecode): Ditto.
+        (JSC::ConstStatementNode::emitBytecode): Ditto.
+        (JSC::statementListEmitCode): Ditto.
+        (JSC::BlockNode::emitBytecode): Ditto.
+        (JSC::ExprStatementNode::emitBytecode): Ditto.
+        (JSC::VarStatementNode::emitBytecode): Ditto.
+        (JSC::IfNode::emitBytecode): Ditto.
+        (JSC::IfElseNode::emitBytecode): Ditto.
+        (JSC::DoWhileNode::emitBytecode): Ditto.
+        (JSC::WhileNode::emitBytecode): Ditto.
+        (JSC::ForNode::emitBytecode): Ditto.
+        (JSC::ForInNode::emitBytecode): Ditto.
+        (JSC::ReturnNode::emitBytecode): Ditto.
+        (JSC::WithNode::emitBytecode): Ditto.
+        (JSC::CaseBlockNode::tryOptimizedSwitch): Ditto.
+        (JSC::CaseBlockNode::emitBytecodeForBlock): Ditto.
+        (JSC::SwitchNode::emitBytecode): Ditto.
+        (JSC::LabelNode::emitBytecode): Ditto.
+        (JSC::ThrowNode::emitBytecode): Ditto.
+        (JSC::TryNode::emitBytecode): Ditto.
+        (JSC::ScopeNodeData::ScopeNodeData): Use swap to transfer ownership
+        of the arena, varStack and functionStack.
+        (JSC::ScopeNode::ScopeNode): Pass in the arena when creating the
+        ScopeNodeData.
+        (JSC::ProgramNode::ProgramNode): Made this inline since it's used
+        in only one place.
+        (JSC::ProgramNode::create): Changed this to return a PassRefPtr since
+        we plan to have the scope nodes be outside the arena, so they will need
+        some kind of ownership transfer (maybe auto_ptr instead of PassRefPtr
+        in the future, though). Remove the node from the newly-created arena to
+        avoid a circular reference. Later we'll keep the node out of the arena
+        by using a different operator new, but for now it's the ParserRefCounted
+        constructor that puts the node into the arena, and there's no way to
+        bypass that.
+        (JSC::EvalNode::EvalNode): Ditto.
+        (JSC::EvalNode::create): Ditto.
+        (JSC::FunctionBodyNode::FunctionBodyNode): Ditto.
+        (JSC::FunctionBodyNode::createNativeThunk): Moved the code that
+        reseets the arena here instead of the caller.
+        (JSC::FunctionBodyNode::create): Same change as the other create
+        functions above.
+        (JSC::FunctionBodyNode::emitBytecode): Use raw pointers.
+
+        * parser/Nodes.h: Removed NodeReleaser. Changed FunctionStack to
+        use raw pointers. Removed the releaseNodes function. Added an override
+        of operator new that takes a JSGlobalData* to prepare for future arena use.
+        Use raw pointers instead of RefPtr everywhere possible.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::reparseInPlace): Pass the arena in.
+
+        * parser/Parser.h:
+        (JSC::Parser::parse): Updated for name change of parserObjects to parserArena.
+        (JSC::Parser::reparse): Ditto.
+        * runtime/FunctionConstructor.cpp:
+        (JSC::extractFunctionBody): Ditto.
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData): Ditto.
+        (JSC::JSGlobalData::createNativeThunk): Moved arena manipulation into the
+        FunctionBodyNode::createNativeThunk function.
+
+        * runtime/JSGlobalData.h: Tweaked formatting and renamed parserObjects to
+        parserArena.
+
+        * wtf/NotFound.h: Added the usual "using WTF" to this header to match the
+        rest of WTF.
+
+2009-05-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25670
+        Remove no longer valid chunk of code from dtoa.
+
+        * wtf/dtoa.cpp:
+        (WTF::dtoa): Removed invalid code.
+
+2009-05-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        "Class const *" is the same as "const Class*", use the latter syntax consistently.
+
+        See <http://www.parashift.com/c++-faq-lite/const-correctness.html#faq-18.9>.
+
+        * pcre/pcre_compile.cpp:
+        (calculateCompiledPatternLength):
+        * runtime/JSObject.h:
+        (JSC::JSObject::offsetForLocation):
+        (JSC::JSObject::locationForOffset):
+
+2009-05-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+        
+        - speedup dtoa/strtod
+        
+        Added a bunch of inlining, and replaced malloc with stack allocation.
+        
+        0.5% SunSpider speedup (7% on string-tagcloud).
+
+        * runtime/NumberPrototype.cpp:
+        (JSC::integerPartNoExp):
+        (JSC::numberProtoFuncToExponential):
+        * runtime/UString.cpp:
+        (JSC::concatenate):
+        (JSC::UString::from):
+        * wtf/dtoa.cpp:
+        (WTF::BigInt::BigInt):
+        (WTF::BigInt::operator=):
+        (WTF::Balloc):
+        (WTF::Bfree):
+        (WTF::multadd):
+        (WTF::s2b):
+        (WTF::i2b):
+        (WTF::mult):
+        (WTF::pow5mult):
+        (WTF::lshift):
+        (WTF::cmp):
+        (WTF::diff):
+        (WTF::b2d):
+        (WTF::d2b):
+        (WTF::ratio):
+        (WTF::strtod):
+        (WTF::quorem):
+        (WTF::freedtoa):
+        (WTF::dtoa):
+        * wtf/dtoa.h:
+
+2009-05-09  Mike Hommey  <glandium@debian.org>
+
+        Reviewed by Geoffrey Garen. Landed by Jan Alonzo.
+
+        Enable JIT on x86-64 gtk+
+        https://bugs.webkit.org/show_bug.cgi?id=24724
+
+        * GNUmakefile.am:
+
+2009-05-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Removed the last non-call-related manually managed JIT stub call.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_rshift): Fully use the JITStubCall
+        abstraction, instead of emitPutJITStubArg.
+
+2009-05-09  Sebastian Andrzej Siewior  <sebastian@breakpoint.cc>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25653
+        PLATFORM(X86_64) inherits ia64
+
+        __ia64__ is defined by gcc in an IA64 arch and has completely
+        nothing in common with X86-64 exept both are from Intel and have
+        an 64bit address space. That's it. Since code seems to expect x86
+        here, ia64 has to go.
+
+        * wtf/Platform.h:
+
+2009-05-09  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Suggested by Geoffrey Garen.
+
+        Assume SSE2 is present on X86-64 and on MAC X86-32. This fixes a
+        build breakage on non-Mac X86-64 when JIT is enabled.
+
+        * jit/JITArithmetic.cpp:
+
+2009-05-09  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Build fix, adding missing files to make dist.
+
+        * GNUmakefile.am:
+
+2009-05-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::patchLoadToLEA):
+
+2009-05-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::patchLoadToLEA):
+
+2009-05-09  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Gavin Barraclough.
+        
+        Original patch by John McCall. Updated by Cameron Zwarich. Further refined by me.
+        
+        - Assorted speedups to property access
+        
+        ~.3%-1% speedup on SunSpider
+        
+        1) When we know from the structure ID that an object is using inline storage, plant direct
+        loads and stores against it; no need to indirect through storage pointer.
+        
+        2) Also because of the above, union the property storage pointer with the first inline property
+        slot and add an extra inline property slot.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::CodeLocationInstruction):
+        (JSC::AbstractMacroAssembler::CodeLocationInstruction::patchLoadToLEA):
+        (JSC::::CodeLocationCommon::instructionAtOffset):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::storePtr):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::store32):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::storePtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movq_EAXm):
+        (JSC::X86Assembler::movl_rm):
+        (JSC::X86Assembler::patchLoadToLEA):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compilePutDirectOffset):
+        (JSC::JIT::compileGetDirectOffset):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::mark):
+        (JSC::JSObject::removeDirect):
+        * runtime/JSObject.h:
+        (JSC::JSObject::propertyStorage):
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getOffset):
+        (JSC::JSObject::offsetForLocation):
+        (JSC::JSObject::locationForOffset):
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::isUsingInlineStorage):
+        (JSC::JSObject::):
+        (JSC::JSObject::JSObject):
+        (JSC::JSObject::~JSObject):
+        (JSC::Structure::isUsingInlineStorage):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        * runtime/Structure.h:
+
+2009-05-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Changed all our JIT stubs so that they return a maximum of 1 JS value or
+        two non-JS pointers, and do all other value returning through out
+        parameters, in preparation for 64bit JS values on a 32bit system.
+
+        Stubs that used to return two JSValues now return one JSValue and take
+        and out parameter specifying where in the register array the second
+        value should go.
+        
+        SunSpider reports no change.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_post_inc):
+        (JSC::JIT::compileFastArithSlow_op_post_dec):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_call_arityCheck):
+        (JSC::JITStubs::cti_op_resolve_func):
+        (JSC::JITStubs::cti_op_post_inc):
+        (JSC::JITStubs::cti_op_resolve_with_base):
+        (JSC::JITStubs::cti_op_post_dec):
+        * jit/JITStubs.h:
+        (JSC::):
+
+2009-05-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed <rdar://problem/6634956> CrashTracer: [REGRESSION] >400 crashes
+        in Safari at com.apple.JavaScriptCore • JSC::BytecodeGenerator::emitComplexJumpScopes + 468
+        https://bugs.webkit.org/show_bug.cgi?id=25658
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitComplexJumpScopes): Guard the whole loop
+        with a bounds check. The old loop logic would decrement and read topScope
+        without a bounds check, which could cause crashes on page boundaries.
+
+2009-05-08  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by NOBODY (BuildFix).
+
+        Gtk fix: add LiteralParser to the build script per r43424.
+
+        Add LiteralParser to the Qt and Wx build scripts too.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCoreSources.bkl:
+
+2009-05-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough and Darin Adler.
+
+        Add a limited literal parser for eval to handle object and array literals fired at eval
+
+        This is a simplified parser and lexer that we can throw at strings passed to eval
+        in case a site is using eval to parse JSON (eg. json2.js).  The lexer is intentionally
+        limited (in effect it's whitelisting a limited "common" subset of the JSON grammar)
+        as this decreases the likelihood of us wating time attempting to parse any significant
+        amount of non-JSON content.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/LiteralParser.cpp: Added.
+        (JSC::isStringCharacter):
+        (JSC::LiteralParser::Lexer::lex):
+        (JSC::LiteralParser::Lexer::lexString):
+        (JSC::LiteralParser::Lexer::lexNumber):
+        (JSC::LiteralParser::parseStatement):
+        (JSC::LiteralParser::parseExpression):
+        (JSC::LiteralParser::parseArray):
+        (JSC::LiteralParser::parseObject):
+        (JSC::LiteralParser::StackGuard::StackGuard):
+        (JSC::LiteralParser::StackGuard::~StackGuard):
+        (JSC::LiteralParser::StackGuard::isSafe):
+        * runtime/LiteralParser.h: Added.
+        (JSC::LiteralParser::LiteralParser):
+        (JSC::LiteralParser::attemptJSONParse):
+        (JSC::LiteralParser::):
+        (JSC::LiteralParser::Lexer::Lexer):
+        (JSC::LiteralParser::Lexer::next):
+        (JSC::LiteralParser::Lexer::currentToken):
+        (JSC::LiteralParser::abortParse):
+
+2009-05-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Restored a Mozilla JS test I accidentally gutted.
+
+        * tests/mozilla/ecma/Array/15.4.4.2.js:
+        (getTestCases):
+        (test):
+
+2009-05-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+        
+        More abstraction for JITStub calls from JITed code.
+        
+        Added a JITStubCall class that automatically handles things like assigning
+        arguments to different stack slots and storing return values. Deployed
+        the class in about a billion places. A bunch more places remain to be
+        fixed up, but this is a good stopping point for now.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::emitTimeoutCheck):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::JSRInfo::JSRInfo):
+        (JSC::JITStubCall::JITStubCall):
+        (JSC::JITStubCall::addArgument):
+        (JSC::JITStubCall::call):
+        (JSC::JITStubCall::):
+        (JSC::CallEvalJITStub::CallEvalJITStub):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_lshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_jnless):
+        (JSC::JIT::compileFastArithSlow_op_bitand):
+        (JSC::JIT::compileFastArithSlow_op_mod):
+        (JSC::JIT::compileFastArith_op_mod):
+        (JSC::JIT::compileFastArithSlow_op_post_inc):
+        (JSC::JIT::compileFastArithSlow_op_post_dec):
+        (JSC::JIT::compileFastArithSlow_op_pre_inc):
+        (JSC::JIT::compileFastArithSlow_op_pre_dec):
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        (JSC::JIT::compileFastArith_op_sub):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::compileFastArithSlow_op_add):
+        (JSC::JIT::compileFastArithSlow_op_mul):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdSlowCase):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_resolve_func):
+        (JSC::JITStubs::cti_op_resolve_with_base):
+
+2009-05-08  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add a new opcode jnlesseq, and optimize its compilation in the JIT using
+        techniques similar to what were used to optimize jnless in r43363.
+
+        This gives a 0.7% speedup on SunSpider, particularly on the tests 3d-cube,
+        control-flow-recursive, date-format-xparb, and string-base64.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Add support for dumping op_jnlesseq.
+        * bytecode/Opcode.h: Add op_jnlesseq to the list of opcodes.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfFalse): Add a peephole optimization
+        for op_jnlesseq when emitting lesseq followed by a jump.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Add case for op_jnlesseq.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass): Add case for op_jnlesseq.
+        (JSC::JIT::privateCompileSlowCases): Add case for op_jnlesseq.
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_jnlesseq): Added.
+        (JSC::JIT::compileFastArithSlow_op_jnlesseq): Added.
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_jlesseq): Added.
+        * jit/JITStubs.h:
+
+2009-05-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - fix test failures on 64-bit
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_jnless): Avoid accidentaly treating an
+        immediate int as an immediate float in the 64-bit value representation.
+
+2009-05-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Oliver Hunt.
+
+        Removing an empty constructor and an uncalled, empty function seems to be a
+        pretty solid 1% regeression on my machine, so I'm going to put them back.
+        Um.  Yeah, this this pretty pointles and makes no sense at all.  I officially
+        lose the will to live in 3... 2...
+
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::notifyOfScope):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingTool::~SamplingTool):
+
+2009-05-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver "I see lots of ifdefs" Hunt.
+
+        Fix (kinda) for sampling tool breakage.  The codeblock sampling tool has become
+        b0rked due to recent changes in native function calling.  The initialization of
+        a ScopeNode appears to now occur before the sampling tool (or possibly the
+        interpreter has been brought into existence, wihich leads to crashyness).
+
+        This patch doesn't fix the problem.  The crash occurs when tracking a Scope, but
+        we shouldn't need to track scopes when we're just sampling opcodes, not
+        codeblocks.  Not retaining Scopes when just opcode sampling will reduce sampling
+        overhead reducing any instrumentation skew, which is a good thing.  As a side
+        benefit this patch also gets the opcode sampling going again, albeit in a bit of
+        a lame way.  Will come back later with a proper fix from codeblock sampling. 
+
+        * JavaScriptCore.exp:
+        * bytecode/SamplingTool.cpp:
+        (JSC::compareLineCountInfoSampling):
+        (JSC::SamplingTool::dump):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingTool::SamplingTool):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+
+2009-05-07  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=25640>.
+        Bug 25640: Crash on quit in r43384 nightly build on Leopard w/ Safari 4 beta installed
+        
+        Roll out r43366 as it removed symbols that Safari 4 Beta uses.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingThread::start):
+        (JSC::SamplingThread::stop):
+        * bytecode/SamplingTool.h:
+        * wtf/CrossThreadRefCounted.h:
+        (WTF::CrossThreadRefCounted::CrossThreadRefCounted):
+        (WTF::::ref):
+        (WTF::::deref):
+        * wtf/Threading.h:
+        * wtf/ThreadingNone.cpp:
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::identifierByPthreadHandle):
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::pthreadHandleForIdentifier):
+        (WTF::clearPthreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+        * wtf/ThreadingWin.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::threadHandleForIdentifier):
+        (WTF::clearThreadHandleForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::threadMapMutex):
+        (WTF::initializeThreading):
+        (WTF::threadMap):
+        (WTF::identifierByGthreadHandle):
+        (WTF::establishIdentifierForThread):
+        (WTF::threadForIdentifier):
+        (WTF::clearThreadForIdentifier):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::threadMapMutex):
+        (WTF::threadMap):
+        (WTF::identifierByQthreadHandle):
+        (WTF::establishIdentifierForThread):
+        (WTF::clearThreadForIdentifier):
+        (WTF::threadForIdentifier):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+2009-05-07  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Suggested by Oliver Hunt.
+
+        Also check for Linux for the special-cased calling convention.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * wtf/Platform.h:
+
+2009-05-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Previously, when appending to an existing string and growing the underlying buffer,
+        we would actually allocate 110% of the required size in order to give us some space
+        to expand into.  Now we treat strings differently based on their size:
+
+        Small Strings (up to 4 pages):
+        Expand the allocation size to 112.5% of the amount requested.  This is largely sicking
+        to our previous policy, however 112.5% is cheaper to calculate.
+
+        Medium Strings (up to 128 pages):
+        For pages covering multiple pages over-allocation is less of a concern - any unused
+        space will not be paged in if it is not used, so this is purely a VM overhead.  For
+        these strings allocate 2x the requested size.
+
+        Large Strings (to infinity and beyond!):
+        Revert to our 112.5% policy - probably best to limit the amount of unused VM we allow
+        any individual string be responsible for.
+
+        Additionally, round small allocations up to a multiple of 16 bytes, and medium and
+        large allocations up to a multiple of page size.
+
+        ~1.5% progression on Sunspider, due to 5% improvement on tagcloud & 15% on validate.
+
+        * runtime/UString.cpp:
+        (JSC::expandedSize):
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed a minor sequencing error introduced by recent Parser speedups.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::createNativeThunk): Missed a spot in my last patch.
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        * wtf/Platform.h: Reverted an accidental (and performance-catastrophic)
+        change.
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed a minor sequencing error introduced by recent Parser speedups.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::reparseInPlace): Missed a spot in my last patch.
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed a minor sequencing error introduced by recent Parser speedups.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        (JSC::Parser::reparse): Shrink the parsedObjects vector after allocating
+        the root node, to avoid leaving a stray node in the vector, since that's
+        a slight memory leak, and it causes problems during JSGlobalData teardown.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData): ASSERT that we're not being torn
+        down while we think we're still parsing, since that would cause lots of
+        bad memory references during our destruction.
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Replaced two more macros with references to the JITStackFrame structure.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        * jit/JITStubs.cpp:
+        (JSC::):
+        * jit/JITStubs.h:
+
+2009-05-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve native call performance
+
+        Fix the windows build by adding calling convention declarations everywhere,
+        chose fastcall as that seemed most sensible given we were having to declare
+        the convention explicitly.  In addition switched to fastcall on mac in the
+        deluded belief that documented fastcall behavior on windows would match 
+        actual its actual behavior.
+
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.h:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::argumentCount):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (functionGC):
+        (functionVersion):
+        (functionRun):
+        (functionLoad):
+        (functionSetSamplingFlags):
+        (functionClearSamplingFlags):
+        (functionReadline):
+        (functionQuit):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::callArrayConstructor):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::callBooleanConstructor):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/CallData.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::callDate):
+        (JSC::dateParse):
+        (JSC::dateNow):
+        (JSC::dateUTC):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::dateProtoFuncSetMilliSeconds):
+        (JSC::dateProtoFuncSetUTCMilliseconds):
+        (JSC::dateProtoFuncSetSeconds):
+        (JSC::dateProtoFuncSetUTCSeconds):
+        (JSC::dateProtoFuncSetMinutes):
+        (JSC::dateProtoFuncSetUTCMinutes):
+        (JSC::dateProtoFuncSetHours):
+        (JSC::dateProtoFuncSetUTCHours):
+        (JSC::dateProtoFuncSetDate):
+        (JSC::dateProtoFuncSetUTCDate):
+        (JSC::dateProtoFuncSetMonth):
+        (JSC::dateProtoFuncSetUTCMonth):
+        (JSC::dateProtoFuncSetFullYear):
+        (JSC::dateProtoFuncSetUTCFullYear):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::callErrorConstructor):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::callFunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::callFunctionPrototype):
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::nativeFunction):
+        (JSC::JSFunction::setScopeChain):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncIsNaN):
+        (JSC::globalFuncIsFinite):
+        (JSC::globalFuncDecodeURI):
+        (JSC::globalFuncDecodeURIComponent):
+        (JSC::globalFuncEncodeURI):
+        (JSC::globalFuncEncodeURIComponent):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRandom):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::callNativeErrorConstructor):
+        * runtime/NativeFunctionWrapper.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::callNumberConstructor):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString):
+        (JSC::numberProtoFuncValueOf):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::callObjectConstructor):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncValueOf):
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        (JSC::objectProtoFuncToLocaleString):
+        (JSC::objectProtoFuncToString):
+        * runtime/ObjectPrototype.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::callRegExpConstructor):
+        * runtime/RegExpObject.cpp:
+        (JSC::callRegExpObject):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCode):
+        (JSC::callStringConstructor):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        * wtf/Platform.h:
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Rolled out a portion of r43352 because it broke 64bit.
+
+        * jit/JITStubs.h:
+
+2009-05-07  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix for functions reaturning ThreadIdentifier.
+
+        * wtf/ThreadingNone.cpp:
+        (WTF::createThreadInternal):
+        (WTF::currentThread):
+
+2009-05-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by John Honeycutt.
+        
+        - enable optimization case im the last patch that I accidentally had disabled.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_jnless):
+
+2009-05-07  Dmitry Titov  <dimich@chromium.org>
+
+        Attempt to fix Win build.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_jnless):
+
+2009-05-07  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov and Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25348
+        Change WTF::ThreadIdentifier to be an actual (but wrapped) thread id, remove ThreadMap.
+
+        * wtf/Threading.h:
+        (WTF::ThreadIdentifier::ThreadIdentifier):
+        (WTF::ThreadIdentifier::isValid):
+        (WTF::ThreadIdentifier::invalidate):
+        (WTF::ThreadIdentifier::platformId):
+        ThreadIdentifier is now a class, containing a PlatformThreadIdentifier and
+        methods that are used across the code on thread ids: construction, comparisons,
+        check for 'valid' state etc. '0' is used as invalid id, which happens to just work
+        with all platform-specific thread id implementations.
+
+        All the following files repeatedly reflect the new ThreadIdentifier for each platform.
+        We remove ThreadMap and threadMapMutex from all of them, remove the functions that
+        populated/searched/cleared the map and add platform-specific comparison operators
+        for ThreadIdentifier.
+
+        * wtf/gtk/ThreadingGtk.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+        * wtf/ThreadingNone.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::detachThread):
+        (WTF::currentThread):
+
+        * wtf/qt/ThreadingQt.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal):
+        (WTF::waitForThreadCompletion):
+        (WTF::currentThread):
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::ThreadIdentifier::operator==):
+        (WTF::ThreadIdentifier::operator!=):
+        (WTF::initializeThreading):
+        (WTF::createThreadInternal): All the platforms (except Windows) used a sequential
+        counter as a thread ID and mapped it into platform ID. Windows was using native thread
+        id and mapped it into thread handle. Since we can always obtain a thread handle
+        by thread id, createThread now closes the handle.
+        (WTF::waitForThreadCompletion): obtains another one using OpenThread(id) API. If can not obtain a handle,
+        it means the thread already exited.
+        (WTF::detachThread):
+        (WTF::currentThread):
+        (WTF::detachThreadDeprecated): old function, renamed (for Win Safari 4 beta which uses it for now).
+        (WTF::waitForThreadCompletionDeprecated): same.
+        (WTF::currentThreadDeprecated): same.
+        (WTF::createThreadDeprecated): same.
+
+        * bytecode/SamplingTool.h:
+        * bytecode/SamplingTool.cpp: Use DEFINE_STATIC_LOCAL for a static ThreadIdentifier variable, to avoid static constructor.
+
+        * JavaScriptCore.exp: export lists - updated the WTF threading functions decorated names
+        since they now take a different type as a parameter.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: ditto for Windows, plus added "deprecated" functions
+        that take old parameter type - turns out public beta of Safari 4 uses those, so they need to be kept along for a while.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def: ditto.
+
+2009-05-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        - optimize various cases of branch-fused less
+        
+        1% speedup on SunSpider overall
+        13% speedup on math-cordic
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        op_loop_if_less: Optimize case of constant as first operand, just as case of constant as
+        second operand.
+        op_jnless: Factored out into compileFastArith_op_jnless.
+        (JSC::JIT::privateCompileSlowCases):
+        op_jnless: Factored out into compileFastArithSlow_op_jnless.
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_jnless): Factored out from main compile loop.
+        - Generate inline code for comparison of constant immediate int as first operand to another
+        immediate int, as for loop_if_less
+
+        (JSC::JIT::compileFastArithSlow_op_jnless):
+        - Generate inline code for comparing two floating point numbers.
+        - Generate code for both cases of comparing a floating point number to a constant immediate 
+        int.
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Fix dumping of op_jnless (tangentially related bugfix).
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Added the return address of a stub function to the JITStackFrame abstraction.
+
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITStubs.cpp:
+        (JSC::):
+        (JSC::StackHack::StackHack):
+        (JSC::StackHack::~StackHack):
+        (JSC::returnToThrowTrampoline):
+        (JSC::JITStubs::cti_op_convert_this):
+        (JSC::JITStubs::cti_op_end):
+        (JSC::JITStubs::cti_op_add):
+        (JSC::JITStubs::cti_op_pre_inc):
+        (JSC::JITStubs::cti_timeout_check):
+        (JSC::JITStubs::cti_register_file_check):
+        (JSC::JITStubs::cti_op_loop_if_less):
+        (JSC::JITStubs::cti_op_loop_if_lesseq):
+        (JSC::JITStubs::cti_op_new_object):
+        (JSC::JITStubs::cti_op_put_by_id_generic):
+        (JSC::JITStubs::cti_op_get_by_id_generic):
+        (JSC::JITStubs::cti_op_put_by_id):
+        (JSC::JITStubs::cti_op_put_by_id_second):
+        (JSC::JITStubs::cti_op_put_by_id_fail):
+        (JSC::JITStubs::cti_op_get_by_id):
+        (JSC::JITStubs::cti_op_get_by_id_second):
+        (JSC::JITStubs::cti_op_get_by_id_self_fail):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list_full):
+        (JSC::JITStubs::cti_op_get_by_id_proto_fail):
+        (JSC::JITStubs::cti_op_get_by_id_array_fail):
+        (JSC::JITStubs::cti_op_get_by_id_string_fail):
+        (JSC::JITStubs::cti_op_instanceof):
+        (JSC::JITStubs::cti_op_del_by_id):
+        (JSC::JITStubs::cti_op_mul):
+        (JSC::JITStubs::cti_op_new_func):
+        (JSC::JITStubs::cti_op_call_JSFunction):
+        (JSC::JITStubs::cti_op_call_arityCheck):
+        (JSC::JITStubs::cti_vm_dontLazyLinkCall):
+        (JSC::JITStubs::cti_vm_lazyLinkCall):
+        (JSC::JITStubs::cti_op_push_activation):
+        (JSC::JITStubs::cti_op_call_NotJSFunction):
+        (JSC::JITStubs::cti_op_create_arguments):
+        (JSC::JITStubs::cti_op_create_arguments_no_params):
+        (JSC::JITStubs::cti_op_tear_off_activation):
+        (JSC::JITStubs::cti_op_tear_off_arguments):
+        (JSC::JITStubs::cti_op_profile_will_call):
+        (JSC::JITStubs::cti_op_profile_did_call):
+        (JSC::JITStubs::cti_op_ret_scopeChain):
+        (JSC::JITStubs::cti_op_new_array):
+        (JSC::JITStubs::cti_op_resolve):
+        (JSC::JITStubs::cti_op_construct_JSConstruct):
+        (JSC::JITStubs::cti_op_construct_NotJSConstruct):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_string):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_resolve_func):
+        (JSC::JITStubs::cti_op_sub):
+        (JSC::JITStubs::cti_op_put_by_val):
+        (JSC::JITStubs::cti_op_put_by_val_array):
+        (JSC::JITStubs::cti_op_put_by_val_byte_array):
+        (JSC::JITStubs::cti_op_lesseq):
+        (JSC::JITStubs::cti_op_loop_if_true):
+        (JSC::JITStubs::cti_op_load_varargs):
+        (JSC::JITStubs::cti_op_negate):
+        (JSC::JITStubs::cti_op_resolve_base):
+        (JSC::JITStubs::cti_op_resolve_skip):
+        (JSC::JITStubs::cti_op_resolve_global):
+        (JSC::JITStubs::cti_op_div):
+        (JSC::JITStubs::cti_op_pre_dec):
+        (JSC::JITStubs::cti_op_jless):
+        (JSC::JITStubs::cti_op_not):
+        (JSC::JITStubs::cti_op_jtrue):
+        (JSC::JITStubs::cti_op_post_inc):
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_lshift):
+        (JSC::JITStubs::cti_op_bitand):
+        (JSC::JITStubs::cti_op_rshift):
+        (JSC::JITStubs::cti_op_bitnot):
+        (JSC::JITStubs::cti_op_resolve_with_base):
+        (JSC::JITStubs::cti_op_new_func_exp):
+        (JSC::JITStubs::cti_op_mod):
+        (JSC::JITStubs::cti_op_less):
+        (JSC::JITStubs::cti_op_neq):
+        (JSC::JITStubs::cti_op_post_dec):
+        (JSC::JITStubs::cti_op_urshift):
+        (JSC::JITStubs::cti_op_bitxor):
+        (JSC::JITStubs::cti_op_new_regexp):
+        (JSC::JITStubs::cti_op_bitor):
+        (JSC::JITStubs::cti_op_call_eval):
+        (JSC::JITStubs::cti_op_throw):
+        (JSC::JITStubs::cti_op_get_pnames):
+        (JSC::JITStubs::cti_op_next_pname):
+        (JSC::JITStubs::cti_op_push_scope):
+        (JSC::JITStubs::cti_op_pop_scope):
+        (JSC::JITStubs::cti_op_typeof):
+        (JSC::JITStubs::cti_op_is_undefined):
+        (JSC::JITStubs::cti_op_is_boolean):
+        (JSC::JITStubs::cti_op_is_number):
+        (JSC::JITStubs::cti_op_is_string):
+        (JSC::JITStubs::cti_op_is_object):
+        (JSC::JITStubs::cti_op_is_function):
+        (JSC::JITStubs::cti_op_stricteq):
+        (JSC::JITStubs::cti_op_to_primitive):
+        (JSC::JITStubs::cti_op_strcat):
+        (JSC::JITStubs::cti_op_nstricteq):
+        (JSC::JITStubs::cti_op_to_jsnumber):
+        (JSC::JITStubs::cti_op_in):
+        (JSC::JITStubs::cti_op_push_new_scope):
+        (JSC::JITStubs::cti_op_jmp_scopes):
+        (JSC::JITStubs::cti_op_put_by_index):
+        (JSC::JITStubs::cti_op_switch_imm):
+        (JSC::JITStubs::cti_op_switch_char):
+        (JSC::JITStubs::cti_op_switch_string):
+        (JSC::JITStubs::cti_op_del_by_val):
+        (JSC::JITStubs::cti_op_put_getter):
+        (JSC::JITStubs::cti_op_put_setter):
+        (JSC::JITStubs::cti_op_new_error):
+        (JSC::JITStubs::cti_op_debug):
+        (JSC::JITStubs::cti_vm_throw):
+        * jit/JITStubs.h:
+        (JSC::JITStackFrame::returnAddressSlot):
+
+2009-05-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::lex): Fix missing braces. This would make us always
+        take the slower case for string parsing and Visual Studio correctly
+        noticed unreachable code.
+
+2009-05-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25589: goto instead of state machine in lexer
+        https://bugs.webkit.org/show_bug.cgi?id=25589
+
+        SunSpider is 0.8% faster.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::currentCharacter): Added.
+        (JSC::Lexer::currentOffset): Changed to call currentCharacter for clarity.
+        (JSC::Lexer::setCode): Removed code to set now-obsolete m_skipLineEnd.
+        (JSC::Lexer::shiftLineTerminator): Added. Handles line numbers and the
+        two-character line terminators.
+        (JSC::Lexer::makeIdentifier): Changed to take characters and length rather
+        than a vector, since we now make these directly out of the source buffer
+        when possible.
+        (JSC::Lexer::lastTokenWasRestrKeyword): Added.
+        (JSC::isNonASCIIIdentStart): Broke out the non-inline part.
+        (JSC::isIdentStart): Moved here.
+        (JSC::isNonASCIIIdentPart): Broke out the non-inline part.
+        (JSC::isIdentPart): Moved here.
+        (JSC::singleEscape): Moved here, and removed some unneeded cases.
+        (JSC::Lexer::record8): Moved here.
+        (JSC::Lexer::record16): Moved here.
+        (JSC::Lexer::lex): Rewrote this whole function to use goto and not use
+        a state machine. Got rid of most of the local variables. Also rolled the
+        matchPunctuator function in here.
+        (JSC::Lexer::scanRegExp): Changed to use the new version of isLineTerminator.
+        Clear m_buffer16 after using it instead of before.
+
+        * parser/Lexer.h: Removed State enum, setDone function, nextLine function,
+        lookupKeywordFunction, one of the isLineTerminator functions, m_done data member,
+        m_skipLineEnd data member, and m_state data member. Added shiftLineTerminator
+        function, currentCharacter function, and changed the arguments to the makeIdentifier
+        function. Removed one branch from the isLineTerminator function.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace): Streamlined the case where we don't replace anything.
+
+2009-05-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Removed a few more special constants, and replaced them with uses of
+        the JITStackFrame struct.
+
+        Removed one of the two possible definitions of VoidPtrPair. The Mac
+        definition was more elegant, but SunSpider doesn't think it's any
+        faster, and it's net less elegant to have two ways of doing things.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        * jit/JITStubs.h:
+        (JSC::):
+
+2009-05-07  Darin Adler  <darin@apple.com>
+
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::~ScopeChainNode): Tweak formatting.
+
+2009-05-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix the build thread stack base determination build on Symbian,
+        by moving the code block before PLATFORM(UNIX), which is also
+        enabled on Symbian builds.
+
+        * runtime/Collector.cpp:
+        (JSC::currentThreadStackBase):
+
+2009-05-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix crash due to incorrectly using an invalid scopechain 
+
+        stringProtoFuncReplace was checking for an exception on a CachedCall
+        by asking for the cached callframes exception.  Unfortunately this
+        could crash in certain circumstances as CachedCall does not guarantee
+        a valid callframe following a call.  Even more unfortunately the check
+        was entirely unnecessary as there is only a single exception slot per
+        global data, so it was already checked via the initial exec->hadException()
+        check.
+
+        To make bugs like this more obvious, i've added a debug only destructor
+        to ScopeChainNode that 0's all of its fields.  This exposed a crash in
+        the standard javascriptcore tests.
+
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::~ScopeChainNode):
+        (JSC::ScopeChain::~ScopeChain):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2009-05-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Enable op_strcat across += assignments.  This patch allows the lhs of a read/modify node
+        to be included within the concatenation operation, and also modifies the implementation
+        of the concatenation to attempt to reuse and cat onto the leftmost string, rather than
+        always allocating a new empty output string to copy into (as was previously the behaviour).
+
+        ~0.5% progression, due to a 3%-3.5% progression on the string tests (particularly validate).
+
+        * parser/Nodes.cpp:
+        (JSC::BinaryOpNode::emitStrcat):
+        (JSC::emitReadModifyAssignment):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::ReadModifyDotNode::emitBytecode):
+        (JSC::ReadModifyBracketNode::emitBytecode):
+        * parser/Nodes.h:
+        * runtime/Operations.h:
+        (JSC::concatenateStrings):
+        * runtime/UString.cpp:
+        (JSC::UString::reserveCapacity):
+        * runtime/UString.h:
+
+2009-05-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix the build on Windows without JIT: interpreter/RegisterFile.h needs
+        roundUpAllocationSize, which is protected by #if ENABLED(ASSEMBLER).
+        Moved the #ifdef down and always offer the function.
+
+        * jit/ExecutableAllocator.h:
+
+2009-05-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin "++" Barraclough.
+        
+        Added some abstraction around the JIT stub calling convention by creating
+        a struct to represent the persistent stack frame JIT code shares with
+        JIT stubs.
+        
+        SunSpider reports no change.
+
+        * jit/JIT.h:
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_convert_this):
+        (JSC::JITStubs::cti_op_end):
+        (JSC::JITStubs::cti_op_add):
+        (JSC::JITStubs::cti_op_pre_inc):
+        (JSC::JITStubs::cti_timeout_check):
+        (JSC::JITStubs::cti_register_file_check):
+        (JSC::JITStubs::cti_op_loop_if_less):
+        (JSC::JITStubs::cti_op_loop_if_lesseq):
+        (JSC::JITStubs::cti_op_new_object):
+        (JSC::JITStubs::cti_op_put_by_id_generic):
+        (JSC::JITStubs::cti_op_get_by_id_generic):
+        (JSC::JITStubs::cti_op_put_by_id):
+        (JSC::JITStubs::cti_op_put_by_id_second):
+        (JSC::JITStubs::cti_op_put_by_id_fail):
+        (JSC::JITStubs::cti_op_get_by_id):
+        (JSC::JITStubs::cti_op_get_by_id_second):
+        (JSC::JITStubs::cti_op_get_by_id_self_fail):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list_full):
+        (JSC::JITStubs::cti_op_get_by_id_proto_fail):
+        (JSC::JITStubs::cti_op_get_by_id_array_fail):
+        (JSC::JITStubs::cti_op_get_by_id_string_fail):
+        (JSC::JITStubs::cti_op_instanceof):
+        (JSC::JITStubs::cti_op_del_by_id):
+        (JSC::JITStubs::cti_op_mul):
+        (JSC::JITStubs::cti_op_new_func):
+        (JSC::JITStubs::cti_op_call_JSFunction):
+        (JSC::JITStubs::cti_op_call_arityCheck):
+        (JSC::JITStubs::cti_vm_dontLazyLinkCall):
+        (JSC::JITStubs::cti_vm_lazyLinkCall):
+        (JSC::JITStubs::cti_op_push_activation):
+        (JSC::JITStubs::cti_op_call_NotJSFunction):
+        (JSC::JITStubs::cti_op_create_arguments):
+        (JSC::JITStubs::cti_op_create_arguments_no_params):
+        (JSC::JITStubs::cti_op_tear_off_activation):
+        (JSC::JITStubs::cti_op_tear_off_arguments):
+        (JSC::JITStubs::cti_op_profile_will_call):
+        (JSC::JITStubs::cti_op_profile_did_call):
+        (JSC::JITStubs::cti_op_ret_scopeChain):
+        (JSC::JITStubs::cti_op_new_array):
+        (JSC::JITStubs::cti_op_resolve):
+        (JSC::JITStubs::cti_op_construct_JSConstruct):
+        (JSC::JITStubs::cti_op_construct_NotJSConstruct):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_string):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_resolve_func):
+        (JSC::JITStubs::cti_op_sub):
+        (JSC::JITStubs::cti_op_put_by_val):
+        (JSC::JITStubs::cti_op_put_by_val_array):
+        (JSC::JITStubs::cti_op_put_by_val_byte_array):
+        (JSC::JITStubs::cti_op_lesseq):
+        (JSC::JITStubs::cti_op_loop_if_true):
+        (JSC::JITStubs::cti_op_load_varargs):
+        (JSC::JITStubs::cti_op_negate):
+        (JSC::JITStubs::cti_op_resolve_base):
+        (JSC::JITStubs::cti_op_resolve_skip):
+        (JSC::JITStubs::cti_op_resolve_global):
+        (JSC::JITStubs::cti_op_div):
+        (JSC::JITStubs::cti_op_pre_dec):
+        (JSC::JITStubs::cti_op_jless):
+        (JSC::JITStubs::cti_op_not):
+        (JSC::JITStubs::cti_op_jtrue):
+        (JSC::JITStubs::cti_op_post_inc):
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_lshift):
+        (JSC::JITStubs::cti_op_bitand):
+        (JSC::JITStubs::cti_op_rshift):
+        (JSC::JITStubs::cti_op_bitnot):
+        (JSC::JITStubs::cti_op_resolve_with_base):
+        (JSC::JITStubs::cti_op_new_func_exp):
+        (JSC::JITStubs::cti_op_mod):
+        (JSC::JITStubs::cti_op_less):
+        (JSC::JITStubs::cti_op_neq):
+        (JSC::JITStubs::cti_op_post_dec):
+        (JSC::JITStubs::cti_op_urshift):
+        (JSC::JITStubs::cti_op_bitxor):
+        (JSC::JITStubs::cti_op_new_regexp):
+        (JSC::JITStubs::cti_op_bitor):
+        (JSC::JITStubs::cti_op_call_eval):
+        (JSC::JITStubs::cti_op_throw):
+        (JSC::JITStubs::cti_op_get_pnames):
+        (JSC::JITStubs::cti_op_next_pname):
+        (JSC::JITStubs::cti_op_push_scope):
+        (JSC::JITStubs::cti_op_pop_scope):
+        (JSC::JITStubs::cti_op_typeof):
+        (JSC::JITStubs::cti_op_is_undefined):
+        (JSC::JITStubs::cti_op_is_boolean):
+        (JSC::JITStubs::cti_op_is_number):
+        (JSC::JITStubs::cti_op_is_string):
+        (JSC::JITStubs::cti_op_is_object):
+        (JSC::JITStubs::cti_op_is_function):
+        (JSC::JITStubs::cti_op_stricteq):
+        (JSC::JITStubs::cti_op_to_primitive):
+        (JSC::JITStubs::cti_op_strcat):
+        (JSC::JITStubs::cti_op_nstricteq):
+        (JSC::JITStubs::cti_op_to_jsnumber):
+        (JSC::JITStubs::cti_op_in):
+        (JSC::JITStubs::cti_op_push_new_scope):
+        (JSC::JITStubs::cti_op_jmp_scopes):
+        (JSC::JITStubs::cti_op_put_by_index):
+        (JSC::JITStubs::cti_op_switch_imm):
+        (JSC::JITStubs::cti_op_switch_char):
+        (JSC::JITStubs::cti_op_switch_string):
+        (JSC::JITStubs::cti_op_del_by_val):
+        (JSC::JITStubs::cti_op_put_getter):
+        (JSC::JITStubs::cti_op_put_setter):
+        (JSC::JITStubs::cti_op_new_error):
+        (JSC::JITStubs::cti_op_debug):
+        (JSC::JITStubs::cti_vm_throw):
+        * jit/JITStubs.h:
+        (JSC::):
+
+2009-05-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak & Darin Adler.
+
+        Improve string concatenation (as coded in JS as a sequence of adds).
+
+        Detect patterns corresponding to string concatenation, and change the bytecode
+        generation to emit a new op_strcat instruction.  By handling the full set of
+        additions within a single function we do not need allocate JSString wrappers
+        for intermediate results, and we can calculate the size of the output string
+        prior to allocating storage, in order to prevent reallocation of the buffer.
+
+        1.5%-2% progression on Sunspider, largely due to a 30% progression on date-format-xparb.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+            Add new opcodes.
+        * bytecode/Opcode.h:
+            Add new opcodes.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitStrcat):
+        (JSC::BytecodeGenerator::emitToPrimitive):
+            Add generation of new opcodes.
+        * bytecompiler/BytecodeGenerator.h:
+            Add generation of new opcodes.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+            Add implmentation of new opcodes.
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+            Add implmentation of new opcodes.
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_to_primitive):
+        (JSC::JITStubs::cti_op_strcat):
+            Add implmentation of new opcodes.
+        * jit/JITStubs.h:
+            Add implmentation of new opcodes.
+        * parser/Nodes.cpp:
+        (JSC::BinaryOpNode::emitStrcat):
+        (JSC::BinaryOpNode::emitBytecode):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+            Add generation of new opcodes.
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::):
+        (JSC::AddNode::):
+            Add methods to allow identification of add nodes.
+        * parser/ResultType.h:
+        (JSC::ResultType::definitelyIsString):
+        (JSC::ResultType::forAdd):
+            Fix error in detection of adds that will produce string results.
+        * runtime/Operations.h:
+        (JSC::concatenateStrings):
+            Add implmentation of new opcodes.
+        * runtime/UString.cpp:
+        (JSC::UString::appendNumeric):
+            Add methods to append numbers to an existing string.
+        * runtime/UString.h:
+        (JSC::UString::Rep::createEmptyBuffer):
+        (JSC::UString::BaseString::BaseString):
+            Add support for creating an empty string with a non-zero capacity available in the BaseString.
+
+2009-05-06  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Made RefCounted::m_refCount private.
+
+        * runtime/Structure.h: Removed addressOfCount.
+        * wtf/RefCounted.h: Made m_refCount private.
+        Added addressOfCount.
+
+2009-05-06  Darin Adler  <darin@apple.com>
+
+        Fixed assertion seen a lot!
+
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::~FunctionBodyNode): Removed now-bogus assertion.
+
+2009-05-06  Darin Adler  <darin@apple.com>
+
+        Working with Sam Weinig.
+
+        Redo parse tree constructor optimization without breaking the Windows
+        build the way I did yesterday. The previous try broke the build by adding
+        an include of Lexer.h and all its dependencies that had to work outside
+        the JavaScriptCore project.
+
+        * GNUmakefile.am: Added NodeConstructors.h.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        Removed byteocde directory -- we no longer are trying to include Lexer.h
+        outside JavaScriptCore.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Change SegmentedVector.h
+        and Lexer.h back to internal files. Added NodeConstructors.h.
+
+        * parser/Grammar.y: Added include of NodeConstructors.h.
+        Changed use of ConstDeclNode to use public functions.
+
+        * parser/NodeConstructors.h: Copied from parser/Nodes.h.
+        Just contains the inlined constructors now.
+
+        * parser/Nodes.cpp: Added include of NodeConstructors.h.
+        Moved node constructors into the header.
+        (JSC::FunctionBodyNode::FunctionBodyNode): Removed m_refCount
+        initialization.
+
+        * parser/Nodes.h: Removed all the constructor definitions, and also
+        removed the JSC_FAST_CALL from them since these are all inlined, so the
+        calling convention is irrelevant. Made more things private. Used a data
+        member for operator opcodes instead of a virtual function. Removed the
+        special FunctionBodyNode::ref/deref functions since the default functions
+        are now just as fast.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::extractFunctionBody): Fixed types here so we don't typecast until
+        after we do type checking.
+
+2009-05-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix the Qt build on Windows.
+
+        * JavaScriptCore.pri: Define BUILDING_JavaScriptCore/WTF to get the meaning
+        of the JS_EXPORTDATA macros correct
+
+2009-05-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Enable the JIT for the Qt build on Windows.
+
+        * JavaScriptCore.pri:
+
+2009-05-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Tweak JavaScriptCore.pri for being able to override the generated sources dir for the
+        generated_files target.
+
+        * JavaScriptCore.pri:
+
+2009-05-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Build QtWebKit as a framework on Mac
+
+        This implies both debug and release build by default, unless
+        one of the --debug or --release config options are passed to
+        the build-webkit script.
+
+        Frameworks can be disabled by passing CONFIG+=webkit_no_framework
+        to the build-webkit script.
+
+        To be able to build both debug and release targets in parallel
+        we have to use separate output directories for the generated
+        sources, which is not optimal, but required to avoid race conditions.
+
+        An optimization would be to only require this spit-up on Mac.
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+        * jsc.pro:
+
+2009-05-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Use $$GENERATED_SOURCES_DIR as output when running bison
+
+        A couple of the generators left the bison output file in the source
+        tree, and then moved it into $$GENERATED_SOURCES_DIR, which did not
+        work well when building release and debug configurations in parallel.
+
+        * JavaScriptCore.pri:
+
+2009-05-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Simplified a bit of codegen.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2009-05-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Moved all the JIT stub related code into one place.
+
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITCode.h:
+        * jit/JITStubs.cpp:
+        (JSC::):
+        * jit/JITStubs.h:
+
+2009-05-05  Sam Weinig  <sam@webkit.org>
+
+        Try to fix Windows build.
+
+        Move Node constructor to the .cpp file.
+
+        * parser/Nodes.cpp: 
+        * parser/Nodes.h:
+
+2009-05-05  Darin Adler  <darin@apple.com>
+
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+        Try to fix Mac build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Made SegmentedVector.h private.
+
+2009-05-05  Darin Adler  <darin@apple.com>
+
+        Try to fix Mac build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Made Lexer.h private.
+
+2009-05-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25569: make ParserRefCounted use conventional reference counting
+        https://bugs.webkit.org/show_bug.cgi?id=25569
+
+        SunSpider speedup of about 1.6%.
+
+        * JavaScriptCore.exp: Updated.
+
+        * parser/Nodes.cpp:
+        (JSC::NodeReleaser::releaseAllNodes): ALWAYS_INLINE.
+        (JSC::NodeReleaser::adopt): Ditto.
+        (JSC::ParserRefCounted::ParserRefCounted): Removed most of the code.
+        Add the object to a Vector<RefPtr> that gets cleared after parsing.
+        (JSC::ParserRefCounted::~ParserRefCounted): Removed most of the code.
+
+        * parser/Nodes.h: Made ParserRefCounted inherit from RefCounted and
+        made inline versions of the constructor and destructor. Made the
+        Node constructor inline.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::parse): Call globalData->parserObjects.shrink(0) after
+        parsing, where it used to call ParserRefCounted::deleteNewObjects.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Eliminated code to manage the
+        newParserObjects and parserObjectExtraRefCounts.
+        (JSC::JSGlobalData::~JSGlobalData): Ditto.
+
+        * runtime/JSGlobalData.h: Replaced the HashSet and HashCountedSet
+        with a Vector.
+
+        * wtf/PassRefPtr.h:
+        (WTF::PassRefPtr::~PassRefPtr): The most common thing to do with a
+        PassRefPtr in hot code is to pass it and then destroy it once it's
+        set to zero. Help the optimizer by telling it that's true.
+
+2009-05-05  Xan Lopez  <xlopez@igalia.com> and Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Oliver Hunt.
+
+        Disable the NativeFunctionWrapper for all non-Mac ports for now,
+        as it is also crashing on Linux/x86.
+
+        * runtime/NativeFunctionWrapper.h:
+
+2009-05-05  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Expose toThisObject for the DOM Window
+
+        * JavaScriptCore.exp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Make windows go again until i work out the
+        accursed calling convention).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * jit/JIT.cpp:
+        * runtime/NativeFunctionWrapper.h:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Fix windows debug builds).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Hopefully the last fix).
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Fix the build fix caused by a different build fix).
+
+        * parser/Nodes.cpp:
+        * parser/Nodes.h:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (No idea how my changes could have broken these).
+
+        * runtime/DatePrototype.cpp:
+        * runtime/RegExpObject.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Why should i expect msvc to list all the errors in a file?).
+
+        * parser/Nodes.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Fix warning, and another missing include).
+
+        * jit/JIT.cpp:
+        * parser/Nodes.h:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (More build fixes).
+
+        * runtime/ErrorPrototype.cpp:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/NumberPrototype.cpp:
+        * runtime/ObjectPrototype.cpp:
+        * runtime/StringConstructor.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Will the fixes never end?).
+
+        * runtime/FunctionPrototype.h:
+        * runtime/Lookup.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (More build fixes).
+
+        * jit/JIT.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (More build fixing).
+
+        * runtime/CallData.h:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        * runtime/ArrayConstructor.cpp:
+        * runtime/BooleanPrototype.cpp:
+        * runtime/DateConstructor.cpp:
+        * runtime/Error.cpp:
+        * runtime/ObjectConstructor.cpp:
+        * runtime/RegExpPrototype.cpp:
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Buildfix).
+
+        Add missing file
+
+        * runtime/NativeFunctionWrapper.h: Copied from JavaScriptCore/jit/ExecutableAllocator.cpp.
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 25559: Improve native function call performance
+        <https://bugs.webkit.org/show_bug.cgi?id=25559>
+
+        In order to cache calls to native functions we now make the standard
+        prototype functions use a small assembly thunk that converts the JS
+        calling convention into the native calling convention.  As this is
+        only beneficial in the JIT we use the NativeFunctionWrapper typedef
+        to alternate between PrototypeFunction and JSFunction to keep the
+        code sane.  This change from PrototypeFunction to NativeFunctionWrapper
+        is the bulk of this patch.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::call):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::addPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::leaq_mr):
+        (JSC::X86Assembler::call_m):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+        * jit/JITCall.cpp:
+        (JSC::JIT::linkCall):
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCode.h:
+        (JSC::JITCode::operator bool):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetFromCallFrameHeader):
+        (JSC::JIT::emitGetFromCallFrameHeader32):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::JITStubs):
+        (JSC::JITStubs::cti_op_call_JSFunction):
+        (JSC::JITStubs::cti_vm_dontLazyLinkCall):
+        (JSC::JITStubs::cti_vm_lazyLinkCall):
+        (JSC::JITStubs::cti_op_construct_JSConstruct):
+        * jit/JITStubs.h:
+        (JSC::JITStubs::ctiNativeCallThunk):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::createNativeThunk):
+        (JSC::FunctionBodyNode::generateJITCode):
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::):
+        (JSC::FunctionBodyNode::generatedJITCode):
+        (JSC::FunctionBodyNode::jitCode):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier):
+        * runtime/ArgList.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        (JSC::functionProtoFuncToString):
+        * runtime/FunctionPrototype.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::~JSFunction):
+        (JSC::JSFunction::mark):
+        (JSC::JSFunction::getCallData):
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::deleteProperty):
+        (JSC::JSFunction::getConstructData):
+        (JSC::JSFunction::construct):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::setScope):
+        (JSC::JSFunction::scope):
+        (JSC::JSFunction::isHostFunction):
+        (JSC::JSFunction::scopeChain):
+        (JSC::JSFunction::clearScopeChain):
+        (JSC::JSFunction::setScopeChain):
+        (JSC::JSFunction::nativeFunction):
+        (JSC::JSFunction::setNativeFunction):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData):
+        (JSC::JSGlobalData::createNativeThunk):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::nativeFunctionThunk):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+
+2009-05-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        For convenience, let the sampling flags tool clear multiple flags at once.
+
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        (functionSetSamplingFlags):
+        (functionClearSamplingFlags):
+
+2009-05-04  Maciej Stachowiak  <mjs@apple.com>
+
+        Rubber stamped by Gavin.
+
+        - inline Vector::resize for a ~1.5% speedup on string-tagcloud
+
+        * wtf/Vector.h:
+        (WTF::Vector::resize): Inline
+
+2009-05-03  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCoreSubmit.sln:
+
+2009-05-03  Mark Rowe  <mrowe@apple.com>
+
+        Fix the 64-bit build.
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        * runtime/JSNumberCell.cpp:
+        (JSC::jsAPIMangledNumber):
+        * runtime/JSNumberCell.h:
+
+2009-05-02  Sam Weinig  <sam@webkit.org>
+
+        Roll JSC API number marshaling back in one last time (I hope).
+
+2009-05-03  Sam Weinig  <sam@webkit.org>
+
+        Roll JSC API number marshaling back out. It still breaks windows.
+
+2009-05-03  Sam Weinig  <sam@webkit.org>
+
+        Roll JSC API number marshaling back in.
+
+2009-05-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 25519: streamline lexer by handling BOMs differently
+        https://bugs.webkit.org/show_bug.cgi?id=25519
+
+        Roughly 1% faster SunSpider.
+
+        * parser/Grammar.y: Tweak formatting a bit.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::Lexer): Remove unnnecessary initialization of data members
+        that are set up by setCode.
+        (JSC::Lexer::currentOffset): Added. Used where the old code would look at
+        m_currentOffset.
+        (JSC::Lexer::shift1): Replaces the old shift function. No longer does anything
+        to handle BOM characters.
+        (JSC::Lexer::shift2): Ditto.
+        (JSC::Lexer::shift3): Ditto.
+        (JSC::Lexer::shift4): Ditto.
+        (JSC::Lexer::setCode): Updated for name change from yylineno to m_line.
+        Removed now-unused m_eatNextIdentifier, m_stackToken, and m_restrKeyword.
+        Replaced m_skipLF and m_skipCR with m_skipLineEnd. Replaced the old
+        m_length with m_codeEnd and m_currentOffset with m_codeStart. Added code
+        to scan for a BOM character and call copyCodeWithoutBOMs() if we find any.
+        (JSC::Lexer::copyCodeWithoutBOMs): Added.
+        (JSC::Lexer::nextLine): Updated for name change from yylineno to m_line.
+        (JSC::Lexer::makeIdentifier): Moved up higher in the file.
+        (JSC::Lexer::matchPunctuator): Moved up higher in the file and changed to
+        use a switch statement instead of just if statements.
+        (JSC::Lexer::isLineTerminator): Moved up higher in the file and changed to
+        have fewer branches.
+        (JSC::Lexer::lastTokenWasRestrKeyword): Added. This replaces the old
+        m_restrKeyword boolean.
+        (JSC::Lexer::isIdentStart): Moved up higher in the file. Changed to use
+        fewer branches in the ASCII but not identifier case.
+        (JSC::Lexer::isIdentPart): Ditto.
+        (JSC::Lexer::singleEscape): Moved up higher in the file.
+        (JSC::Lexer::convertOctal): Moved up higher in the file.
+        (JSC::Lexer::convertHex): Moved up higher in the file. Changed to use
+        toASCIIHexValue instead of rolling our own here.
+        (JSC::Lexer::convertUnicode): Ditto.
+        (JSC::Lexer::record8): Moved up higher in the file.
+        (JSC::Lexer::record16): Moved up higher in the file.
+        (JSC::Lexer::lex): Changed type of stringType to int. Replaced m_skipLF
+        and m_skipCR with m_skipLineEnd, which requires fewer branches in the
+        main lexer loop. Use currentOffset instead of m_currentOffset. Removed
+        unneeded m_stackToken. Use isASCIIDigit instead of isDecimalDigit.
+        Split out the two cases for InIdentifierOrKeyword and InIdentifier.
+        Added special case tight loops for identifiers and other simple states.
+        Removed a branch from the code that sets m_atLineStart to false using goto.
+        Streamlined the number-handling code so we don't check for the same types
+        twice for non-numeric cases and don't add a null to m_buffer8 when it's
+        not being used. Removed m_eatNextIdentifier, which wasn't working anyway,
+        and m_restrKeyword, which is redundant with m_lastToken. Set the
+        m_delimited flag without using a branch.
+        (JSC::Lexer::scanRegExp): Tweaked style a bit.
+        (JSC::Lexer::clear): Clear m_codeWithoutBOMs so we don't use memory after
+        parsing. Clear out UString objects in the more conventional way.
+        (JSC::Lexer::sourceCode): Made this no-longer inline since it has more
+        work to do in the case where we stripped BOMs.
+
+        * parser/Lexer.h: Renamed yylineno to m_lineNumber. Removed convertHex
+        function, which is the same as toASCIIHexValue. Removed isHexDigit
+        function, which is the same as isASCIIHedDigit. Replaced shift with four
+        separate shift functions. Removed isWhiteSpace function that passes
+        m_current, instead just passing m_current explicitly. Removed isOctalDigit,
+        which is the same as isASCIIOctalDigit. Eliminated unused arguments from
+        matchPunctuator. Added copyCoodeWithoutBOMs and currentOffset. Moved the
+        makeIdentifier function out of the header. Added lastTokenWasRestrKeyword
+        function. Added new constants for m_skipLineEnd. Removed unused yycolumn,
+        m_restrKeyword, m_skipLF, m_skipCR, m_eatNextIdentifier, m_stackToken,
+        m_position, m_length, m_currentOffset, m_nextOffset1, m_nextOffset2,
+        m_nextOffset3. Added m_skipLineEnd, m_codeStart, m_codeEnd, and
+        m_codeWithoutBOMs.
+
+        * parser/SourceProvider.h: Added hasBOMs function. In the future this can
+        be used to tell the lexer about strings known not to have BOMs.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncUnescape): Changed to use isASCIIHexDigit.
+
+        * wtf/ASCIICType.h: Added using statements to match the design of the
+        other WTF headers.
+
+2009-05-02  Ada Chan  <adachan@apple.com>
+
+        Fix windows build (when doing a clean build)
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Simplified null-ish JSValues.
+        
+        Replaced calls to noValue() with calls to JSValue() (which is what
+        noValue() returned). Removed noValue().
+        
+        Replaced almost all uses of jsImpossibleValue() with uses of JSValue().
+        Its one remaining use is for construction of hash table deleted values.
+        For that specific task, I made a new, private constructor with a special
+        tag. Removed jsImpossibleValue().
+        
+        Removed "JSValue()" initialiazers, since default construction happens...
+        by default.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::call):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+        * bytecompiler/BytecodeGenerator.h:
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * debugger/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::DebuggerCallFrame):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::clearException):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveLastCaller):
+        * interpreter/Register.h:
+        (JSC::Register::Register):
+        * jit/JITCall.cpp:
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_call_eval):
+        (JSC::JITStubs::cti_vm_throw):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::willExecute):
+        (JSC::Profiler::didExecute):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::getProperty):
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/Completion.h:
+        (JSC::Completion::Completion):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::getPrimitiveNumber):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::increaseVectorLength):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::getJSNumber):
+        * runtime/JSCell.h:
+        (JSC::JSValue::getJSNumber):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSImmediate.h:
+        (JSC::JSImmediate::fromNumberOutsideIntegerRange):
+        (JSC::JSImmediate::from):
+        * runtime/JSNumberCell.cpp:
+        (JSC::jsNumberCell):
+        * runtime/JSObject.cpp:
+        (JSC::callDefaultValueFunction):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirect):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::toPrimitive):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::next):
+        * runtime/JSValue.h:
+        (JSC::JSValue::):
+        (JSC::JSValueHashTraits::constructDeletedValue):
+        (JSC::JSValueHashTraits::isDeletedValue):
+        (JSC::JSValue::JSValue):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/Operations.h:
+        (JSC::resolveBase):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::clearBase):
+        (JSC::PropertySlot::clearValue):
+
+2009-05-02  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - speed up the lexer in various ways
+
+        ~2% command-line SunSpider speedup
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode): Moved below shift() so it can inline.
+        (JSC::Lexer::scanRegExp):  Use resize(0) instead of clear() on Vectors, since the intent
+        here is not to free the underlying buffer.
+        (JSC::Lexer::lex): ditto; also, change the loop logic a bit for the main lexing loop
+        to avoid branching on !m_done twice per iteration. Now we only check it once.
+        (JSC::Lexer::shift): Make this ALWAYS_INLINE and tag an unusual branch as UNLIKELY
+        * parser/Lexer.h:
+        (JSC::Lexer::makeIdentifier): force to be ALWAYS_INLINE
+        * wtf/Vector.h:
+        (WTF::::append): force to be ALWAYS_INLINE (may have helped in ways other than parsing but it wasn't
+        getting inlined in a hot code path in the lexer)
+
+2009-05-01  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make:
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Fix 64bit build.
+
+        * runtime/JSNumberCell.h:
+        (JSC::JSValue::JSValue):
+        * runtime/JSValue.h:
+        (JSC::jsNumber):
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Roll out JavaScriptCore API number marshaling.
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::construct):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        (JSC::::staticValueGetter):
+        (JSC::::callbackGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectGetPrototype):
+        (JSObjectSetPrototype):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueMakeUndefined):
+        (JSValueMakeNull):
+        (JSValueMakeBoolean):
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        * runtime/JSNumberCell.cpp:
+        * runtime/JSNumberCell.h:
+        * runtime/JSValue.h:
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Fix the build.
+
+        * JavaScriptCore.exp:
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey "Too Far!" Garen.
+
+        Move JS number construction into JSValue.
+
+        * runtime/JSImmediate.h:
+        * runtime/JSNumberCell.h:
+        (JSC::JSValue::JSValue):
+        * runtime/JSValue.h:
+        (JSC::jsNumber):
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoff "The Minneapolis" Garen.
+
+        Add mechanism to vend heap allocated JS numbers to JavaScriptCore API clients with a
+        representation that is independent of the number representation in the VM.
+        - Numbers leaving the interpreter are converted to a tagged JSNumberCell.
+        - The numbers coming into the interpreter (asserted to be the tagged JSNumberCell) are
+          converted back to the VM's internal number representation.
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+        (JSC::::put):
+        (JSC::::deleteProperty):
+        (JSC::::construct):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        (JSC::::staticValueGetter):
+        (JSC::::callbackGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectGetPrototype):
+        (JSObjectSetPrototype):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueMakeUndefined):
+        (JSValueMakeNull):
+        (JSValueMakeBoolean):
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * runtime/JSNumberCell.cpp:
+        (JSC::jsAPIMangledNumber):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::isAPIMangledNumber):
+        (JSC::JSNumberCell::):
+        (JSC::JSNumberCell::JSNumberCell):
+        (JSC::JSValue::isAPIMangledNumber):
+        * runtime/JSValue.h:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 6.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 5.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 4.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 3.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 2.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Windows build fix take 1.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber Stamped by Sam Weinig.
+        
+        Renamed JSValuePtr => JSValue.
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::asCallbackObject):
+        (JSC::::put):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::staticValueGetter):
+        (JSC::::staticFunctionGetter):
+        (JSC::::callbackGetter):
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        (JSObjectSetPrototype):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::valueToSourceString):
+        (JSC::constantName):
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getConstant):
+        (JSC::CodeBlock::addUnexpectedConstant):
+        (JSC::CodeBlock::unexpectedConstant):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::addUnexpectedConstant):
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::emitGetScopedVar):
+        (JSC::BytecodeGenerator::emitPutScopedVar):
+        (JSC::BytecodeGenerator::emitNewError):
+        (JSC::keyForImmediateSwitch):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::JSValueHashTraits::constructDeletedValue):
+        (JSC::BytecodeGenerator::JSValueHashTraits::isDeletedValue):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/Debugger.h:
+        * debugger/DebuggerActivation.cpp:
+        (JSC::DebuggerActivation::put):
+        (JSC::DebuggerActivation::putWithAttributes):
+        (JSC::DebuggerActivation::lookupGetter):
+        (JSC::DebuggerActivation::lookupSetter):
+        * debugger/DebuggerActivation.h:
+        (JSC::DebuggerActivation::createStructure):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * debugger/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::DebuggerCallFrame):
+        (JSC::DebuggerCallFrame::exception):
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        (JSC::CachedCall::call):
+        (JSC::CachedCall::setThis):
+        (JSC::CachedCall::setArgument):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::thisValue):
+        (JSC::CallFrame::dumpCaller):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::setException):
+        (JSC::ExecState::exception):
+        (JSC::ExecState::exceptionSlot):
+        * interpreter/CallFrameClosure.h:
+        (JSC::CallFrameClosure::setArgument):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::resolveBaseAndFunc):
+        (JSC::isNotObject):
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        (JSC::Interpreter::retrieveCaller):
+        (JSC::Interpreter::retrieveLastCaller):
+        * interpreter/Interpreter.h:
+        * interpreter/Register.h:
+        (JSC::Register::):
+        (JSC::Register::Register):
+        (JSC::Register::jsValue):
+        * jit/JIT.cpp:
+        (JSC::):
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_mod):
+        * jit/JITCall.cpp:
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITCode.h:
+        (JSC::):
+        (JSC::JITCode::execute):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetVirtualRegister):
+        (JSC::JIT::getConstantOperand):
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        (JSC::JIT::emitInitRegister):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::tryCachePutByID):
+        (JSC::JITStubs::tryCacheGetByID):
+        (JSC::JITStubs::cti_op_convert_this):
+        (JSC::JITStubs::cti_op_add):
+        (JSC::JITStubs::cti_op_pre_inc):
+        (JSC::JITStubs::cti_op_loop_if_less):
+        (JSC::JITStubs::cti_op_loop_if_lesseq):
+        (JSC::JITStubs::cti_op_get_by_id_generic):
+        (JSC::JITStubs::cti_op_get_by_id):
+        (JSC::JITStubs::cti_op_get_by_id_second):
+        (JSC::JITStubs::cti_op_get_by_id_self_fail):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list_full):
+        (JSC::JITStubs::cti_op_get_by_id_proto_fail):
+        (JSC::JITStubs::cti_op_get_by_id_array_fail):
+        (JSC::JITStubs::cti_op_get_by_id_string_fail):
+        (JSC::JITStubs::cti_op_instanceof):
+        (JSC::JITStubs::cti_op_del_by_id):
+        (JSC::JITStubs::cti_op_mul):
+        (JSC::JITStubs::cti_op_call_NotJSFunction):
+        (JSC::JITStubs::cti_op_resolve):
+        (JSC::JITStubs::cti_op_construct_NotJSConstruct):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_string):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_resolve_func):
+        (JSC::JITStubs::cti_op_sub):
+        (JSC::JITStubs::cti_op_put_by_val):
+        (JSC::JITStubs::cti_op_put_by_val_array):
+        (JSC::JITStubs::cti_op_put_by_val_byte_array):
+        (JSC::JITStubs::cti_op_lesseq):
+        (JSC::JITStubs::cti_op_loop_if_true):
+        (JSC::JITStubs::cti_op_load_varargs):
+        (JSC::JITStubs::cti_op_negate):
+        (JSC::JITStubs::cti_op_resolve_base):
+        (JSC::JITStubs::cti_op_resolve_skip):
+        (JSC::JITStubs::cti_op_resolve_global):
+        (JSC::JITStubs::cti_op_div):
+        (JSC::JITStubs::cti_op_pre_dec):
+        (JSC::JITStubs::cti_op_jless):
+        (JSC::JITStubs::cti_op_not):
+        (JSC::JITStubs::cti_op_jtrue):
+        (JSC::JITStubs::cti_op_post_inc):
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_lshift):
+        (JSC::JITStubs::cti_op_bitand):
+        (JSC::JITStubs::cti_op_rshift):
+        (JSC::JITStubs::cti_op_bitnot):
+        (JSC::JITStubs::cti_op_resolve_with_base):
+        (JSC::JITStubs::cti_op_mod):
+        (JSC::JITStubs::cti_op_less):
+        (JSC::JITStubs::cti_op_neq):
+        (JSC::JITStubs::cti_op_post_dec):
+        (JSC::JITStubs::cti_op_urshift):
+        (JSC::JITStubs::cti_op_bitxor):
+        (JSC::JITStubs::cti_op_bitor):
+        (JSC::JITStubs::cti_op_call_eval):
+        (JSC::JITStubs::cti_op_throw):
+        (JSC::JITStubs::cti_op_next_pname):
+        (JSC::JITStubs::cti_op_typeof):
+        (JSC::JITStubs::cti_op_is_undefined):
+        (JSC::JITStubs::cti_op_is_boolean):
+        (JSC::JITStubs::cti_op_is_number):
+        (JSC::JITStubs::cti_op_is_string):
+        (JSC::JITStubs::cti_op_is_object):
+        (JSC::JITStubs::cti_op_is_function):
+        (JSC::JITStubs::cti_op_stricteq):
+        (JSC::JITStubs::cti_op_nstricteq):
+        (JSC::JITStubs::cti_op_to_jsnumber):
+        (JSC::JITStubs::cti_op_in):
+        (JSC::JITStubs::cti_op_switch_imm):
+        (JSC::JITStubs::cti_op_switch_char):
+        (JSC::JITStubs::cti_op_switch_string):
+        (JSC::JITStubs::cti_op_del_by_val):
+        (JSC::JITStubs::cti_op_new_error):
+        (JSC::JITStubs::cti_vm_throw):
+        * jit/JITStubs.h:
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (functionGC):
+        (functionVersion):
+        (functionRun):
+        (functionLoad):
+        (functionSetSamplingFlag):
+        (functionClearSamplingFlag):
+        (functionReadline):
+        (functionQuit):
+        * parser/Nodes.cpp:
+        (JSC::processClauseList):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::willExecute):
+        (JSC::Profiler::didExecute):
+        (JSC::Profiler::createCallIdentifier):
+        * profiler/Profiler.h:
+        * runtime/ArgList.cpp:
+        (JSC::MarkedArgumentBuffer::slowAppend):
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::at):
+        (JSC::MarkedArgumentBuffer::append):
+        (JSC::ArgList::ArgList):
+        (JSC::ArgList::at):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::put):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        (JSC::asArguments):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::callArrayConstructor):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::getProperty):
+        (JSC::putProperty):
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::callBooleanConstructor):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanConstructor.h:
+        * runtime/BooleanObject.h:
+        (JSC::asBooleanObject):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/CallData.cpp:
+        (JSC::call):
+        * runtime/CallData.h:
+        * runtime/Collector.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::heap):
+        * runtime/Collector.h:
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/Completion.h:
+        (JSC::Completion::Completion):
+        (JSC::Completion::value):
+        (JSC::Completion::setValue):
+        * runtime/ConstructData.cpp:
+        (JSC::construct):
+        * runtime/ConstructData.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::callDate):
+        (JSC::dateParse):
+        (JSC::dateNow):
+        (JSC::dateUTC):
+        * runtime/DateInstance.h:
+        (JSC::asDateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetMilliSeconds):
+        (JSC::dateProtoFuncSetUTCMilliseconds):
+        (JSC::dateProtoFuncSetSeconds):
+        (JSC::dateProtoFuncSetUTCSeconds):
+        (JSC::dateProtoFuncSetMinutes):
+        (JSC::dateProtoFuncSetUTCMinutes):
+        (JSC::dateProtoFuncSetHours):
+        (JSC::dateProtoFuncSetUTCHours):
+        (JSC::dateProtoFuncSetDate):
+        (JSC::dateProtoFuncSetUTCDate):
+        (JSC::dateProtoFuncSetMonth):
+        (JSC::dateProtoFuncSetUTCMonth):
+        (JSC::dateProtoFuncSetFullYear):
+        (JSC::dateProtoFuncSetUTCFullYear):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::callErrorConstructor):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createInterruptedExecutionException):
+        (JSC::createError):
+        (JSC::createStackOverflowError):
+        (JSC::createUndefinedVariableError):
+        (JSC::createErrorMessage):
+        (JSC::createInvalidParamError):
+        (JSC::createNotAConstructorError):
+        (JSC::createNotAFunctionError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::callFunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::callFunctionPrototype):
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::toPrimitive):
+        (JSC::GetterSetter::getPrimitiveNumber):
+        * runtime/GetterSetter.h:
+        (JSC::asGetterSetter):
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::displayName):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        (JSC::asInternalFunction):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertySlot):
+        (JSC::JSActivation::put):
+        (JSC::JSActivation::putWithAttributes):
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        (JSC::asActivation):
+        * runtime/JSArray.cpp:
+        (JSC::storageSize):
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::mark):
+        (JSC::compareNumbersForQSort):
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::checkConsistency):
+        (JSC::constructArray):
+        * runtime/JSArray.h:
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::createStructure):
+        (JSC::asArray):
+        (JSC::isJSArray):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::createStructure):
+        (JSC::JSByteArray::put):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::getIndex):
+        (JSC::JSByteArray::setIndex):
+        (JSC::asByteArray):
+        (JSC::isJSByteArray):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::put):
+        (JSC::JSCell::getJSNumber):
+        * runtime/JSCell.h:
+        (JSC::asCell):
+        (JSC::JSValue::asCell):
+        (JSC::JSValue::isString):
+        (JSC::JSValue::isGetterSetter):
+        (JSC::JSValue::isObject):
+        (JSC::JSValue::getString):
+        (JSC::JSValue::getObject):
+        (JSC::JSValue::getCallData):
+        (JSC::JSValue::getConstructData):
+        (JSC::JSValue::getUInt32):
+        (JSC::JSValue::getTruncatedInt32):
+        (JSC::JSValue::getTruncatedUInt32):
+        (JSC::JSValue::mark):
+        (JSC::JSValue::marked):
+        (JSC::JSValue::toPrimitive):
+        (JSC::JSValue::getPrimitiveNumber):
+        (JSC::JSValue::toBoolean):
+        (JSC::JSValue::toNumber):
+        (JSC::JSValue::toString):
+        (JSC::JSValue::toObject):
+        (JSC::JSValue::toThisObject):
+        (JSC::JSValue::needsThisConversion):
+        (JSC::JSValue::toThisString):
+        (JSC::JSValue::getJSNumber):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::construct):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        (JSC::asFunction):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::put):
+        (JSC::JSGlobalObject::putWithAttributes):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::resetPrototype):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        (JSC::JSGlobalObject::GlobalPropertyInfo::GlobalPropertyInfo):
+        (JSC::asGlobalObject):
+        (JSC::Structure::prototypeForLookup):
+        (JSC::Structure::prototypeChain):
+        (JSC::Structure::isValid):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEval):
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncIsNaN):
+        (JSC::globalFuncIsFinite):
+        (JSC::globalFuncDecodeURI):
+        (JSC::globalFuncDecodeURIComponent):
+        (JSC::globalFuncEncodeURI):
+        (JSC::globalFuncEncodeURIComponent):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSImmediate.cpp:
+        (JSC::JSImmediate::toThisObject):
+        (JSC::JSImmediate::toObject):
+        (JSC::JSImmediate::prototype):
+        (JSC::JSImmediate::toString):
+        * runtime/JSImmediate.h:
+        (JSC::JSImmediate::isImmediate):
+        (JSC::JSImmediate::isNumber):
+        (JSC::JSImmediate::isIntegerNumber):
+        (JSC::JSImmediate::isDoubleNumber):
+        (JSC::JSImmediate::isPositiveIntegerNumber):
+        (JSC::JSImmediate::isBoolean):
+        (JSC::JSImmediate::isUndefinedOrNull):
+        (JSC::JSImmediate::isEitherImmediate):
+        (JSC::JSImmediate::areBothImmediate):
+        (JSC::JSImmediate::areBothImmediateIntegerNumbers):
+        (JSC::JSImmediate::makeValue):
+        (JSC::JSImmediate::makeInt):
+        (JSC::JSImmediate::makeDouble):
+        (JSC::JSImmediate::makeBool):
+        (JSC::JSImmediate::makeUndefined):
+        (JSC::JSImmediate::makeNull):
+        (JSC::JSImmediate::doubleValue):
+        (JSC::JSImmediate::intValue):
+        (JSC::JSImmediate::uintValue):
+        (JSC::JSImmediate::boolValue):
+        (JSC::JSImmediate::rawValue):
+        (JSC::JSImmediate::trueImmediate):
+        (JSC::JSImmediate::falseImmediate):
+        (JSC::JSImmediate::undefinedImmediate):
+        (JSC::JSImmediate::nullImmediate):
+        (JSC::JSImmediate::zeroImmediate):
+        (JSC::JSImmediate::oneImmediate):
+        (JSC::JSImmediate::impossibleValue):
+        (JSC::JSImmediate::toBoolean):
+        (JSC::JSImmediate::getTruncatedUInt32):
+        (JSC::JSImmediate::fromNumberOutsideIntegerRange):
+        (JSC::JSImmediate::from):
+        (JSC::JSImmediate::getTruncatedInt32):
+        (JSC::JSImmediate::toDouble):
+        (JSC::JSImmediate::getUInt32):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::isUndefinedOrNull):
+        (JSC::JSValue::isBoolean):
+        (JSC::JSValue::getBoolean):
+        (JSC::JSValue::toInt32):
+        (JSC::JSValue::toUInt32):
+        (JSC::JSValue::isCell):
+        (JSC::JSValue::isInt32Fast):
+        (JSC::JSValue::getInt32Fast):
+        (JSC::JSValue::isUInt32Fast):
+        (JSC::JSValue::getUInt32Fast):
+        (JSC::JSValue::makeInt32Fast):
+        (JSC::JSValue::areBothInt32Fast):
+        (JSC::JSFastMath::canDoFastBitwiseOperations):
+        (JSC::JSFastMath::equal):
+        (JSC::JSFastMath::notEqual):
+        (JSC::JSFastMath::andImmediateNumbers):
+        (JSC::JSFastMath::xorImmediateNumbers):
+        (JSC::JSFastMath::orImmediateNumbers):
+        (JSC::JSFastMath::canDoFastRshift):
+        (JSC::JSFastMath::canDoFastUrshift):
+        (JSC::JSFastMath::rightShiftImmediateNumbers):
+        (JSC::JSFastMath::canDoFastAdditiveOperations):
+        (JSC::JSFastMath::addImmediateNumbers):
+        (JSC::JSFastMath::subImmediateNumbers):
+        (JSC::JSFastMath::incImmediateNumber):
+        (JSC::JSFastMath::decImmediateNumber):
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::toPrimitive):
+        (JSC::JSNotAnObject::getPrimitiveNumber):
+        (JSC::JSNotAnObject::put):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSNumberCell.cpp:
+        (JSC::JSNumberCell::toPrimitive):
+        (JSC::JSNumberCell::getPrimitiveNumber):
+        (JSC::JSNumberCell::getJSNumber):
+        (JSC::jsNumberCell):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure):
+        (JSC::isNumberCell):
+        (JSC::asNumberCell):
+        (JSC::jsNumber):
+        (JSC::JSValue::isDoubleNumber):
+        (JSC::JSValue::getDoubleNumber):
+        (JSC::JSValue::isNumber):
+        (JSC::JSValue::uncheckedGetNumber):
+        (JSC::jsNaN):
+        (JSC::JSValue::toJSNumber):
+        (JSC::JSValue::getNumber):
+        (JSC::JSValue::numberToInt32):
+        (JSC::JSValue::numberToUInt32):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::mark):
+        (JSC::JSObject::put):
+        (JSC::JSObject::putWithAttributes):
+        (JSC::callDefaultValueFunction):
+        (JSC::JSObject::getPrimitiveNumber):
+        (JSC::JSObject::defaultValue):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::lookupGetter):
+        (JSC::JSObject::lookupSetter):
+        (JSC::JSObject::hasInstance):
+        (JSC::JSObject::toNumber):
+        (JSC::JSObject::toString):
+        (JSC::JSObject::fillGetterPropertySlot):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::offsetForLocation):
+        (JSC::JSObject::locationForOffset):
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::createStructure):
+        (JSC::asObject):
+        (JSC::JSObject::prototype):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSValue::isObject):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSObject::getOwnPropertySlotForWrite):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSObject::get):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::toPrimitive):
+        (JSC::JSValue::get):
+        (JSC::JSValue::put):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::toPrimitive):
+        (JSC::JSPropertyNameIterator::getPrimitiveNumber):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::create):
+        (JSC::JSPropertyNameIterator::next):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::put):
+        (JSC::JSStaticScopeObject::putWithAttributes):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.cpp:
+        (JSC::JSString::toPrimitive):
+        (JSC::JSString::getPrimitiveNumber):
+        (JSC::JSString::getOwnPropertySlot):
+        * runtime/JSString.h:
+        (JSC::JSString::createStructure):
+        (JSC::asString):
+        (JSC::isJSString):
+        (JSC::JSValue::toThisJSString):
+        * runtime/JSValue.cpp:
+        (JSC::JSValue::toInteger):
+        (JSC::JSValue::toIntegerPreserveNaN):
+        * runtime/JSValue.h:
+        (JSC::JSValue::makeImmediate):
+        (JSC::JSValue::asValue):
+        (JSC::noValue):
+        (JSC::jsImpossibleValue):
+        (JSC::jsNull):
+        (JSC::jsUndefined):
+        (JSC::jsBoolean):
+        (JSC::operator==):
+        (JSC::operator!=):
+        (JSC::JSValue::encode):
+        (JSC::JSValue::decode):
+        (JSC::JSValue::JSValue):
+        (JSC::JSValue::operator bool):
+        (JSC::JSValue::operator==):
+        (JSC::JSValue::operator!=):
+        (JSC::JSValue::isUndefined):
+        (JSC::JSValue::isNull):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::symbolTablePut):
+        (JSC::JSVariableObject::symbolTablePutWithAttributes):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRandom):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::callNativeErrorConstructor):
+        * runtime/NumberConstructor.cpp:
+        (JSC::numberConstructorNaNValue):
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+        (JSC::callNumberConstructor):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::getJSNumber):
+        (JSC::constructNumber):
+        * runtime/NumberObject.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString):
+        (JSC::numberProtoFuncValueOf):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        (JSC::callObjectConstructor):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncValueOf):
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        (JSC::objectProtoFuncToLocaleString):
+        (JSC::objectProtoFuncToString):
+        * runtime/ObjectPrototype.h:
+        * runtime/Operations.cpp:
+        (JSC::JSValue::equalSlowCase):
+        (JSC::JSValue::strictEqualSlowCase):
+        (JSC::throwOutOfMemoryError):
+        (JSC::jsAddSlowCase):
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        (JSC::jsIsFunctionType):
+        * runtime/Operations.h:
+        (JSC::JSValue::equal):
+        (JSC::JSValue::equalSlowCaseInline):
+        (JSC::JSValue::strictEqual):
+        (JSC::JSValue::strictEqualSlowCaseInline):
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAdd):
+        (JSC::countPrototypeChainEntriesAndCheckForProxies):
+        (JSC::resolveBase):
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::PropertySlot):
+        (JSC::PropertySlot::getValue):
+        (JSC::PropertySlot::putValue):
+        (JSC::PropertySlot::setValueSlot):
+        (JSC::PropertySlot::setValue):
+        (JSC::PropertySlot::setCustom):
+        (JSC::PropertySlot::setCustomIndex):
+        (JSC::PropertySlot::slotBase):
+        (JSC::PropertySlot::setBase):
+        (JSC::PropertySlot::):
+        * runtime/Protect.h:
+        (JSC::gcProtect):
+        (JSC::gcUnprotect):
+        (JSC::ProtectedPtr::operator JSValue):
+        (JSC::ProtectedJSValue::ProtectedJSValue):
+        (JSC::ProtectedJSValue::get):
+        (JSC::ProtectedJSValue::operator JSValue):
+        (JSC::ProtectedJSValue::operator->):
+        (JSC::ProtectedJSValue::~ProtectedJSValue):
+        (JSC::ProtectedJSValue::operator=):
+        (JSC::operator==):
+        (JSC::operator!=):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getBackref):
+        (JSC::RegExpConstructor::getLastParen):
+        (JSC::RegExpConstructor::getLeftContext):
+        (JSC::RegExpConstructor::getRightContext):
+        (JSC::regExpConstructorDollar1):
+        (JSC::regExpConstructorDollar2):
+        (JSC::regExpConstructorDollar3):
+        (JSC::regExpConstructorDollar4):
+        (JSC::regExpConstructorDollar5):
+        (JSC::regExpConstructorDollar6):
+        (JSC::regExpConstructorDollar7):
+        (JSC::regExpConstructorDollar8):
+        (JSC::regExpConstructorDollar9):
+        (JSC::regExpConstructorInput):
+        (JSC::regExpConstructorMultiline):
+        (JSC::regExpConstructorLastMatch):
+        (JSC::regExpConstructorLastParen):
+        (JSC::regExpConstructorLeftContext):
+        (JSC::regExpConstructorRightContext):
+        (JSC::RegExpConstructor::put):
+        (JSC::setRegExpConstructorInput):
+        (JSC::setRegExpConstructorMultiline):
+        (JSC::constructRegExp):
+        (JSC::callRegExpConstructor):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        (JSC::asRegExpConstructor):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::put):
+        * runtime/RegExpObject.cpp:
+        (JSC::regExpObjectGlobal):
+        (JSC::regExpObjectIgnoreCase):
+        (JSC::regExpObjectMultiline):
+        (JSC::regExpObjectSource):
+        (JSC::regExpObjectLastIndex):
+        (JSC::RegExpObject::put):
+        (JSC::setRegExpObjectLastIndex):
+        (JSC::RegExpObject::test):
+        (JSC::RegExpObject::exec):
+        (JSC::callRegExpObject):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        (JSC::asRegExpObject):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        (JSC::stringFromCharCode):
+        (JSC::callStringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::put):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        (JSC::asStringObject):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::changePrototypeTransition):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::setPrototypeWithoutTransition):
+        (JSC::Structure::storedPrototype):
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam "That doesn't look like what I thought it looks like" Weinig.
+        
+        Beefed up the JSValuePtr class and removed some non-JSValuePtr dependencies
+        on JSImmediate, in prepapration for making JSImmediate an implementation
+        detail of JSValuePtr.
+        
+        SunSpider reports no change.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_mod):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt): Updated for interface changes.
+
+        * runtime/JSImmediate.h:
+        (JSC::JSValuePtr::JSValuePtr):
+        * runtime/JSValue.h:
+        (JSC::JSValuePtr::):
+        (JSC::jsImpossibleValue):
+        (JSC::jsNull):
+        (JSC::jsUndefined):
+        (JSC::jsBoolean):
+        (JSC::JSValuePtr::encode):
+        (JSC::JSValuePtr::decode):
+        (JSC::JSValuePtr::JSValuePtr):
+        (JSC::JSValuePtr::operator bool):
+        (JSC::JSValuePtr::operator==):
+        (JSC::JSValuePtr::operator!=):
+        (JSC::JSValuePtr::isUndefined):
+        (JSC::JSValuePtr::isNull): Changed jsImpossibleValue(), jsNull(),
+        jsUndefined(), and jsBoolean() to operate in terms of JSValuePtr instead
+        of JSImmediate.
+
+        * wtf/StdLibExtras.h:
+        (WTF::bitwise_cast): Fixed up for clarity.
+
+2009-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug fix for rdar:/6845379.  If a case-insensitive regex contains
+        a character class containing a range with an upper bound of \uFFFF
+        the parser will infinite-loop whist adding other-case characters
+        for characters in the range that do have another case.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::CharacterClassConstructor::putRange):
+
+2009-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        OPCODE_SAMPLING without CODEBLOCK_SAMPLING is currently broken,
+        since SamplingTool::Sample::isNull() checks the m_codeBlock
+        member (which is always null without CODEBLOCK_SAMPLING).
+
+        Restructure the checks so make this work again.
+
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::doRun):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingTool::Sample::isNull):
+
+2009-04-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        - Concatenate final three strings in simple replace case at one go
+
+        ~0.2% SunSpider speedup
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace): Use new replaceRange helper instead of
+        taking substrings and concatenating three strings.
+        * runtime/UString.cpp:
+        (JSC::UString::replaceRange): New helper function.
+        * runtime/UString.h:
+
+2009-04-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber Stamped by Gavin Barraclough.
+        
+        Changed JSValueEncodedAsPtr* => EncodedJSValuePtr to support a non-pointer
+        encoding for JSValuePtrs.
+
+        * API/APICast.h:
+        (toJS):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::JSValueHashTraits::constructDeletedValue):
+        (JSC::BytecodeGenerator::JSValueHashTraits::isDeletedValue):
+        * interpreter/Register.h:
+        (JSC::Register::):
+        * jit/JIT.cpp:
+        (JSC::):
+        * jit/JIT.h:
+        * jit/JITCode.h:
+        (JSC::):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_add):
+        (JSC::JITStubs::cti_op_pre_inc):
+        (JSC::JITStubs::cti_op_get_by_id_generic):
+        (JSC::JITStubs::cti_op_get_by_id):
+        (JSC::JITStubs::cti_op_get_by_id_second):
+        (JSC::JITStubs::cti_op_get_by_id_self_fail):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list_full):
+        (JSC::JITStubs::cti_op_get_by_id_proto_fail):
+        (JSC::JITStubs::cti_op_get_by_id_array_fail):
+        (JSC::JITStubs::cti_op_get_by_id_string_fail):
+        (JSC::JITStubs::cti_op_instanceof):
+        (JSC::JITStubs::cti_op_del_by_id):
+        (JSC::JITStubs::cti_op_mul):
+        (JSC::JITStubs::cti_op_call_NotJSFunction):
+        (JSC::JITStubs::cti_op_resolve):
+        (JSC::JITStubs::cti_op_construct_NotJSConstruct):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_string):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_sub):
+        (JSC::JITStubs::cti_op_lesseq):
+        (JSC::JITStubs::cti_op_negate):
+        (JSC::JITStubs::cti_op_resolve_base):
+        (JSC::JITStubs::cti_op_resolve_skip):
+        (JSC::JITStubs::cti_op_resolve_global):
+        (JSC::JITStubs::cti_op_div):
+        (JSC::JITStubs::cti_op_pre_dec):
+        (JSC::JITStubs::cti_op_not):
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_lshift):
+        (JSC::JITStubs::cti_op_bitand):
+        (JSC::JITStubs::cti_op_rshift):
+        (JSC::JITStubs::cti_op_bitnot):
+        (JSC::JITStubs::cti_op_mod):
+        (JSC::JITStubs::cti_op_less):
+        (JSC::JITStubs::cti_op_neq):
+        (JSC::JITStubs::cti_op_urshift):
+        (JSC::JITStubs::cti_op_bitxor):
+        (JSC::JITStubs::cti_op_bitor):
+        (JSC::JITStubs::cti_op_call_eval):
+        (JSC::JITStubs::cti_op_throw):
+        (JSC::JITStubs::cti_op_next_pname):
+        (JSC::JITStubs::cti_op_typeof):
+        (JSC::JITStubs::cti_op_is_undefined):
+        (JSC::JITStubs::cti_op_is_boolean):
+        (JSC::JITStubs::cti_op_is_number):
+        (JSC::JITStubs::cti_op_is_string):
+        (JSC::JITStubs::cti_op_is_object):
+        (JSC::JITStubs::cti_op_is_function):
+        (JSC::JITStubs::cti_op_stricteq):
+        (JSC::JITStubs::cti_op_nstricteq):
+        (JSC::JITStubs::cti_op_to_jsnumber):
+        (JSC::JITStubs::cti_op_in):
+        (JSC::JITStubs::cti_op_del_by_val):
+        (JSC::JITStubs::cti_vm_throw):
+        * jit/JITStubs.h:
+        * runtime/JSValue.h:
+        (JSC::JSValuePtr::encode):
+        (JSC::JSValuePtr::decode):
+
+2009-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver "Abandon Ship!" Hunt.
+
+        Fix a leak in Yarr.
+
+        All Disjunctions should be recorded in RegexPattern::m_disjunctions,
+        so that they can be freed at the end of compilation - copyDisjunction
+        is failing to do so.
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::copyDisjunction):
+
+2009-04-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Add function to CallFrame for dumping the current JS caller
+
+        Added debug only method CallFrame::dumpCaller() that provide the call location
+        of the deepest currently executing JS function.
+
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::dumpCaller):
+        * interpreter/CallFrame.h:
+
+2009-04-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        - make BaseStrings have themselves as a base, instead of nothing, to remove common branches
+
+        ~0.7% SunSpider speedup
+
+        * runtime/UString.h:
+        (JSC::UString::Rep::Rep): For the constructor without a base, set self as base instead of null.
+        (JSC::UString::Rep::baseString): Just read m_baseString - no more branching.
+
+2009-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Two quick improvements to SamplingFlags mechanism.
+
+        SamplingFlags::ScopedFlag class to provide support for automagically
+        clearing a flag as it goes out of scope, and add a little more detail
+        to the output generated by the tool.
+
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingFlags::stop):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingFlags::ScopedFlag::ScopedFlag):
+        (JSC::SamplingFlags::ScopedFlag::~ScopedFlag):
+
+2009-04-30  Adam Roben  <aroben@apple.com>
+
+        Restore build event steps that were truncated in r43082
+
+        Rubber-stamped by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops:
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops:
+        Re-copied the command lines for the build events from the pre-r43082
+        .vcproj files.
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Removed an unnecessary
+        attribute.
+
+2009-04-30  Adam Roben  <aroben@apple.com>
+
+        Move settings from .vcproj files to .vsprops files within the
+        JavaScriptCore directory
+
+        Moving the settings to a .vsprops file means that we will only have to
+        change a single setting to affect all configurations, instead of one
+        setting per configuration.
+
+        Reviewed by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        Moved settings from these files to the new .vsprops files. Note that
+        testapi.vcproj had a lot of overrides of default settings that were
+        the same as the defaults, which I've removed.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops: Added.
+        * JavaScriptCore.vcproj/WTF/WTFCommon.vsprops: Added.
+        * JavaScriptCore.vcproj/jsc/jscCommon.vsprops: Added.
+        * JavaScriptCore.vcproj/testapi/testapiCommon.vsprops: Added.
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25470
+        Extend the cover of ENABLE_JAVASCRIPT_DEBUGGER to profiler.
+
+        * Configurations/FeatureDefines.xcconfig: Added ENABLE_JAVASCRIPT_DEBUGGER define.
+
+2009-04-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        - speed up string concatenation by reorganizing some simple cases
+
+        0.7% SunSpider speedup
+
+        * runtime/UString.cpp:
+        (JSC::concatenate): Put fast case for appending a single character
+        before the empty string special cases; streamline code a bit to
+        delay computing values that are not needed in the fast path.
+
+2009-04-30  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add SamplingFlags mechanism.
+
+        This mechanism allows fine-grained JSC and JavaScript program aware
+        performance measurement.  The mechanism provides a set of 32 flags,
+        numbered #1..#32.  Flag #16 is initially set, and all other flags
+        are cleared.  Flags may be set and cleared from within
+
+        Enable by setting ENABLE_SAMPLING_FLAGS to 1 in wtf/Platform.h.
+        Disabled by default, no performance impact.  Flags may be modified
+        by calling SamplingFlags::setFlag() and SamplingFlags::clearFlag()
+        from within JSC implementation, or by calling setSamplingFlag() and
+        clearSamplingFlag() from JavaScript.
+
+        The flags are sampled with a frequency of 10000Hz, and the highest
+        set flag in recorded, allowing multiple events to be measured (with
+        the highest flag number representing the highest priority).
+
+        Disabled by default; no performance impact.
+
+        * JavaScriptCore.exp:
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingFlags::sample):
+        (JSC::SamplingFlags::start):
+        (JSC::SamplingFlags::stop):
+        (JSC::SamplingThread::threadStartFunc):
+        (JSC::SamplingThread::start):
+        (JSC::SamplingThread::stop):
+        (JSC::ScopeSampleRecord::sample):
+        (JSC::SamplingTool::doRun):
+        (JSC::SamplingTool::sample):
+        (JSC::SamplingTool::start):
+        (JSC::SamplingTool::stop):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingFlags::setFlag):
+        (JSC::SamplingFlags::clearFlag):
+        (JSC::SamplingTool::SamplingTool):
+        * jsc.cpp:
+        (GlobalObject::GlobalObject):
+        (functionSetSamplingFlag):
+        (functionClearSamplingFlag):
+        (runWithScripts):
+        * wtf/Platform.h:
+
+2009-04-29  Sam Weinig  <sam@webkit.org>
+
+        Another attempt to fix the windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-04-29  Sam Weinig  <sam@webkit.org>
+
+        Try and fix the windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-04-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver "Peg-Leg" Hunt.
+
+        Coallesce input checking and reduce futzing with the index position
+        between alternatives and iterations of the main loop of a regex,
+        when run in YARR.
+
+        Consider the following regex:  /foo|bar/
+        
+        Prior to this patch, this will be implemented something like this pseudo-code description:
+        
+        loop:
+            check_for_available_input(3) // this increments the index by 3, for the first alterantive.
+                if (available) { test "foo" }
+            decrement_index(3)
+            check_for_available_input(3) // this increments the index by 3, for the second alterantive.
+                if (available) { test "bar" }
+            decrement_index(3)
+            check_for_available_input(1) // can we loop again?
+                if (available) { goto loop }
+
+        With these changes it will look more like this:
+
+            check_for_available_input(3) // this increments the index by 3, for the first alterantive.
+            if (!available) { goto fail }
+        loop:
+            test "foo"
+            test "bar"
+            check_for_available_input(1) // can we loop again?
+                if (available) { goto loop }
+        fail:
+
+
+        This gives about a 5% gain on v8-regex, no change on Sunspider.
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::TermGenerationState::linkAlternativeBacktracksTo):
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+
+2009-04-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Clean up ArgList to be a trivial type
+
+        Separate out old ArgList logic to handle buffering and marking arguments
+        into a distinct MarkedArgumentBuffer type.  ArgList becomes a trivial
+        struct of a pointer and length.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction):
+        (JSObjectMakeArray):
+        (JSObjectMakeDate):
+        (JSObjectMakeError):
+        (JSObjectMakeRegExp):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        * JavaScriptCore.exp:
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::emptyList):
+        * runtime/ArgList.cpp:
+        (JSC::ArgList::getSlice):
+        (JSC::MarkedArgumentBuffer::markLists):
+        (JSC::MarkedArgumentBuffer::slowAppend):
+        * runtime/ArgList.h:
+        (JSC::MarkedArgumentBuffer::MarkedArgumentBuffer):
+        (JSC::MarkedArgumentBuffer::~MarkedArgumentBuffer):
+        (JSC::ArgList::ArgList):
+        (JSC::ArgList::at):
+        (JSC::ArgList::isEmpty):
+        (JSC::ArgList::size):
+        (JSC::ArgList::begin):
+        (JSC::ArgList::end):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::fillArgList):
+        * runtime/Arguments.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        * runtime/Collector.cpp:
+        (JSC::Heap::collect):
+        * runtime/Collector.h:
+        (JSC::Heap::markListSet):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Error.cpp:
+        (JSC::Error::create):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncApply):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+        (JSC::JSArray::fillArgList):
+        (JSC::constructArray):
+        * runtime/JSArray.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncMatch):
+
+2009-04-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25334
+
+        Fix Qt build when ENABLE_JIT is explicitly set to 1
+        to overrule defaults.
+
+        * JavaScriptCore.pri:
+
+2009-04-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Crash in profiler due to incorrect assuming displayName would be a string.
+
+        Fixed by adding a type guard.
+
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::displayName):
+
+2009-04-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber stamped by Beth Dakin.
+        
+        Removed scaffolding supporting dynamically converting between 32bit and
+        64bit value representations. 
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::construct):
+        (JSC::::call):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getConstant):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::thisValue):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        * interpreter/Register.h:
+        (JSC::Register::):
+        (JSC::Register::Register):
+        (JSC::Register::jsValue):
+        (JSC::Register::marked):
+        (JSC::Register::mark):
+        (JSC::Register::i):
+        (JSC::Register::activation):
+        (JSC::Register::arguments):
+        (JSC::Register::callFrame):
+        (JSC::Register::codeBlock):
+        (JSC::Register::function):
+        (JSC::Register::propertyNameIterator):
+        (JSC::Register::scopeChain):
+        (JSC::Register::vPC):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_call_NotJSFunction):
+        (JSC::JITStubs::cti_op_load_varargs):
+        (JSC::JITStubs::cti_op_call_eval):
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (functionRun):
+        (functionLoad):
+        * runtime/ArgList.h:
+        (JSC::ArgList::at):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::copyToRegisters):
+        (JSC::Arguments::fillArgList):
+        (JSC::Arguments::getOwnPropertySlot):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncReduce):
+        (JSC::arrayProtoFuncReduceRight):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructBoolean):
+        (JSC::callBooleanConstructor):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::dateParse):
+        (JSC::dateUTC):
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::fillStructuresUsingTimeArgs):
+        (JSC::fillStructuresUsingDateArgs):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::dateProtoFuncSetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::constructError):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::constructArray):
+        * runtime/JSArray.h:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEval):
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncIsNaN):
+        (JSC::globalFuncIsFinite):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        (JSC::globalFuncJSCPrint):
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::construct):
+        * runtime/NumberConstructor.cpp:
+        (JSC::constructWithNumberConstructor):
+        (JSC::callNumberConstructor):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::getValue):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        (JSC::stringFromCharCode):
+        (JSC::constructWithStringConstructor):
+        (JSC::callStringConstructor):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+
+2009-04-28  David Kilzer  <ddkilzer@apple.com>
+
+        A little more hardening for UString
+
+        Reviewed by Maciej Stachowiak.
+
+        Revised fix for <rdar://problem/5861045> in r42644.
+
+        * runtime/UString.cpp:
+        (JSC::newCapacityWithOverflowCheck): Added.
+        (JSC::concatenate): Used newCapacityWithOverflowCheck().
+        (JSC::UString::append): Ditto.
+
+2009-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bring back r42969, this time with correct codegen
+
+        Add logic to the codegen for right shift to avoid jumping to a helper function
+        when shifting a small floating point value.
+
+        * jit/JITArithmetic.cpp:
+        (isSSE2Present):
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+
+2009-04-28  Kevin Ollivier <kevino@theolliviers.com>
+
+        wxMSW build fix. Switch JSCore build back to static. 
+
+        * API/JSBase.h:
+        * config.h:
+        * jscore.bkl:
+
+2009-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Roll out r42969, due to hangs in build bot.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+        (JSC::isSSE2Present):
+
+2009-04-28  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed: fix distcheck build, add (even more) missing files to list.
+
+        * GNUmakefile.am:
+
+2009-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Improve performance of string indexing
+
+        Add a cti_get_by_val_string function to specialise indexing into a string object.
+        This gives us a slight performance win on a number of string tests.
+
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_string):
+        * jit/JITStubs.h:
+
+2009-04-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Improve performance of right shifts of large or otherwise floating point values.
+
+        Add logic to the codegen for right shift to avoid jumping to a helper function
+        when shifting a small floating point value.
+
+        * jit/JITArithmetic.cpp:
+        (isSSE2Present): Moved to the head of file.
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+
+2009-04-28  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed: fix distcheck build, add (more) missing files to list.
+
+        * GNUmakefile.am:
+
+2009-04-28  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed: fix distcheck build, add missing header to file list.
+
+        * GNUmakefile.am:
+
+2009-04-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Maciej "Henry Morgan" Stachowiak.
+
+        Enable YARR.
+        (Again.)
+
+        * wtf/Platform.h:
+
+2009-04-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Tweak a loop condition to keep GCC happy,
+        some GCCs seem to be having issues with this. :-/
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::breakTarget):
+        * wtf/Platform.h:
+
+2009-04-27  Adam Roben  <aroben@apple.com>
+
+        Windows Debug build fix
+
+        Not sure why the buildbots weren't affected by this problem.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Let VS
+        re-order the file list, and added JavaScriptCore[_debug].def to the
+        project. This was not necessary for the fix, but made making the fix
+        easier.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+        Removed a function that no longer exists.
+
+2009-04-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Weinig Sam.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=25416
+        "Cached prototype accesses unsafely hoist property storage load above structure checks."
+        
+        Do not hoist the load of the pointer to the property storage array.
+
+        No performance impact.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+
+2009-04-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoffrey "Gaffe or energy?" Garen.
+
+        Randomize address requested by ExecutableAllocatorFixedVMPool.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+
+2009-04-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove scons-based build system.
+
+        * JavaScriptCore.scons: Removed.
+
+2009-04-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Buildfix).
+
+        Make HAVE_MADV_FREE darwin only for now
+
+        * wtf/Platform.h:
+
+2009-04-25  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Gtk build fix - check if we have MADV_FREE before using it.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::releaseExcessCapacity):
+        * wtf/Platform.h:
+
+2009-04-24  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Switching JSCore from a static lib to a dynamic lib
+        to match the Apple build and fix symbol exports.
+
+        * jscore.bkl:
+
+2009-04-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25337
+        Move ThreadingQt.cpp under the qt directory.
+
+        * JavaScriptCore.pri:
+        * wtf/ThreadingQt.cpp: Removed.
+        * wtf/qt/ThreadingQt.cpp: Copied from JavaScriptCore/wtf/ThreadingQt.cpp.
+
+2009-04-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25338
+        Move ThreadingGtk.cpp under the gtk directory.
+
+        * GNUmakefile.am:
+        * wtf/ThreadingGtk.cpp: Removed.
+        * wtf/gtk/ThreadingGtk.cpp: Copied from JavaScriptCore/wtf/ThreadingGtk.cpp.
+
+2009-04-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam "Wesley" Weinig.
+
+        Improve performance to YARR interpreter.
+        (From about 3x slower than PCRE on regex-dna to about 30% slower).
+
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::setupAlternativeOffsets):
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::checkCharacter):
+        (JSC::Yarr::Interpreter::checkCasedCharacter):
+        (JSC::Yarr::Interpreter::backtrackPatternCharacter):
+        (JSC::Yarr::Interpreter::backtrackPatternCasedCharacter):
+        (JSC::Yarr::Interpreter::matchParentheticalAssertionBegin):
+        (JSC::Yarr::Interpreter::matchParentheticalAssertionEnd):
+        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionBegin):
+        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionEnd):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::Interpreter::interpret):
+        (JSC::Yarr::ByteCompiler::atomPatternCharacter):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionBegin):
+        (JSC::Yarr::ByteCompiler::closeAlternative):
+        (JSC::Yarr::ByteCompiler::closeBodyAlternative):
+        (JSC::Yarr::ByteCompiler::atomParenthesesEnd):
+        (JSC::Yarr::ByteCompiler::regexBegin):
+        (JSC::Yarr::ByteCompiler::regexEnd):
+        (JSC::Yarr::ByteCompiler::alterantiveBodyDisjunction):
+        (JSC::Yarr::ByteCompiler::alterantiveDisjunction):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/RegexInterpreter.h:
+        (JSC::Yarr::ByteTerm::):
+        (JSC::Yarr::ByteTerm::ByteTerm):
+        (JSC::Yarr::ByteTerm::BodyAlternativeBegin):
+        (JSC::Yarr::ByteTerm::BodyAlternativeDisjunction):
+        (JSC::Yarr::ByteTerm::BodyAlternativeEnd):
+        (JSC::Yarr::ByteTerm::AlternativeBegin):
+        (JSC::Yarr::ByteTerm::AlternativeDisjunction):
+        (JSC::Yarr::ByteTerm::AlternativeEnd):
+        (JSC::Yarr::ByteTerm::SubpatternBegin):
+        (JSC::Yarr::ByteTerm::SubpatternEnd):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateParentheticalAssertion):
+        * yarr/RegexPattern.h:
+
+2009-04-24  Rob Raguet-Schofield  <ragfield@gmail.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        * wtf/CurrentTime.h: Fix a typo in a comment.
+
+2009-04-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Add reinterpret_cast
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::releaseExcessCapacity):
+
+2009-04-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/6050421> JavaScript register file should remap to release physical pages accumulated during deep recursion
+
+        We now track the maximum extent of the RegisterFile, and when we reach the final
+        return from JS (so the stack portion of the registerfile becomes empty) we see
+        if that extent is greater than maxExcessCapacity.  If it is we use madvise or
+        VirtualFree to release the physical pages that were backing the excess.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::releaseExcessCapacity):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::shrink):
+        (JSC::RegisterFile::grow):
+
+2009-04-23  Mark Rowe  <mrowe@apple.com>
+
+        With great sadness and a heavy heart I switch us back from YARR to WREC in
+        order to restore greenness to the world once more.
+
+        * wtf/Platform.h:
+
+2009-04-23  Mark Rowe  <mrowe@apple.com>
+
+        More Windows build fixage.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore_debug.def:
+
+2009-04-23  Mark Rowe  <mrowe@apple.com>
+
+        Attempt to fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:  Remove a symbol that no longer exists.
+
+2009-04-23  Francisco Tolmasky  <francisco@280north.com>
+
+        BUG 24604: WebKit profiler reports incorrect total times
+        <https://bugs.webkit.org/show_bug.cgi?id=24604>
+
+        Reviewed by Timothy Hatcher and Kevin McCullough.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * profiler/CallIdentifier.h:
+        (JSC::CallIdentifier::Hash::hash):
+        (JSC::CallIdentifier::Hash::equal):
+        (JSC::CallIdentifier::hash):
+        (WTF::):
+        * profiler/HeavyProfile.cpp: Removed.
+        * profiler/HeavyProfile.h: Removed.
+        * profiler/Profile.cpp: No more need for TreeProfile/HeavyProfile
+        (JSC::Profile::create):
+        * profiler/Profile.h:
+        * profiler/ProfileNode.cpp:
+        * profiler/ProfileNode.h:
+        * profiler/TreeProfile.cpp: Removed.
+        * profiler/TreeProfile.h: Removed.
+
+2009-04-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Not Reviewed.
+
+        Speculative Windows build fix II.
+
+        * yarr/RegexInterpreter.cpp:
+
+2009-04-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Not Reviewed.
+
+        Speculative Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * runtime/RegExp.cpp:
+
+2009-04-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by salty sea dogs Sam & Geoff.
+
+        Enable YARR_JIT by default (where supported), replacing WREC.
+
+        * wtf/Platform.h:
+
+2009-04-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff "Dread Pirate Roberts" Garen.
+
+        Various small fixes to YARR JIT, in preparation for enabling it by default.
+
+        * Correctly index into the callframe when storing restart addresses for
+          nested alternatives.
+        * Allow backtracking back into matched alternatives of parentheses.
+        * Fix callframe offset calculation for parenthetical assertions.
+        * When a set of parenthese are quantified with a fixed and variable portion,
+          and the variable portion is quantified once, this should not reset the
+          pattern match on failure to match (the last match from the firxed portion
+          should be preserved).
+        * Up the pattern size limit to match PCRE's new limit.
+        * Unlclosed parentheses should be reported with the message "missing )".
+
+        * wtf/Platform.h:
+        * yarr/RegexCompiler.cpp:
+        (JSC::Yarr::RegexPatternConstructor::quantifyAtom):
+        (JSC::Yarr::RegexPatternConstructor::setupAlternativeOffsets):
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchParentheses):
+        (JSC::Yarr::Interpreter::backtrackParentheses):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::loadFromFrameAndJump):
+        (JSC::Yarr::RegexGenerator::generateParenthesesDisjunction):
+        (JSC::Yarr::RegexGenerator::generateParentheticalAssertion):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        (JSC::Yarr::executeRegex):
+        * yarr/RegexParser.h:
+        (JSC::Yarr::Parser::):
+        (JSC::Yarr::Parser::parseTokens):
+        (JSC::Yarr::Parser::parse):
+        * yarr/RegexPattern.h:
+        (JSC::Yarr::PatternTerm::):
+        (JSC::Yarr::PatternTerm::PatternTerm):
+
+2009-04-22  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Gavin Barraclough.
+
+        Add the m_ prefix on FixedVMPoolAllocator's member variables, and fix typos in a few comments.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::addToFreeList):
+        (JSC::FixedVMPoolAllocator::coalesceFreeSpace):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::isWithinVMPool):
+
+2009-04-22  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Gavin Barraclough.
+
+        Add some assertions to FixedVMPoolAllocator to guard against cases where we
+        attempt to free memory that didn't originate from the pool, or we attempt to
+        hand out a bogus address from alloc.
+
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::release):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::FixedVMPoolAllocator::isWithinVMPool):
+
+2009-04-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam "Blackbeard" Weinig.
+
+        Although pirates do spell the word 'generate' as 'genertate',
+        webkit developers do not.  Fixertate.
+
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::generateAssertionBOL):
+        (JSC::Yarr::RegexGenerator::generateAssertionEOL):
+        (JSC::Yarr::RegexGenerator::generateAssertionWordBoundary):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterSingle):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterPair):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterFixed):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterGreedy):
+        (JSC::Yarr::RegexGenerator::generatePatternCharacterNonGreedy):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassSingle):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassFixed):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassGreedy):
+        (JSC::Yarr::RegexGenerator::generateCharacterClassNonGreedy):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+
+2009-04-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam "Blackbeard" Weinig.
+
+        Improvements to YARR JIT.  This patch expands support in three key areas:
+            * Add (temporary) support for falling back to PCRE for expressions not supported.
+            * Add support for x86_64 and Windows.
+            * Add support for singly quantified parentheses (? and ??), alternatives within
+              parentheses, and parenthetical assertions.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * yarr/RegexJIT.cpp:
+        (JSC::Yarr::RegexGenerator::storeToFrame):
+        (JSC::Yarr::RegexGenerator::storeToFrameWithPatch):
+        (JSC::Yarr::RegexGenerator::loadFromFrameAndJump):
+        (JSC::Yarr::RegexGenerator::AlternativeBacktrackRecord::AlternativeBacktrackRecord):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::resetAlternative):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::resetTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::jumpToBacktrack):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::plantJumpToBacktrackIfExists):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::addBacktrackJump):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::linkAlternativeBacktracks):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::propagateBacktrackingFrom):
+        (JSC::Yarr::RegexGenerator::genertateAssertionBOL):
+        (JSC::Yarr::RegexGenerator::genertateAssertionEOL):
+        (JSC::Yarr::RegexGenerator::matchAssertionWordchar):
+        (JSC::Yarr::RegexGenerator::genertateAssertionWordBoundary):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterSingle):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterPair):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterFixed):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterGreedy):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterNonGreedy):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassSingle):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassFixed):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassGreedy):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassNonGreedy):
+        (JSC::Yarr::RegexGenerator::generateParenthesesDisjunction):
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
+        (JSC::Yarr::RegexGenerator::generateParentheticalAssertion):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+        (JSC::Yarr::RegexGenerator::generateEnter):
+        (JSC::Yarr::RegexGenerator::generateReturn):
+        (JSC::Yarr::RegexGenerator::RegexGenerator):
+        (JSC::Yarr::RegexGenerator::generate):
+        (JSC::Yarr::RegexGenerator::compile):
+        (JSC::Yarr::RegexGenerator::generationFailed):
+        (JSC::Yarr::jitCompileRegex):
+        (JSC::Yarr::executeRegex):
+        * yarr/RegexJIT.h:
+        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
+        (JSC::Yarr::RegexCodeBlock::~RegexCodeBlock):
+
+2009-04-22  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Fix for <rdar://problem/6816957>
+        Turn off Geolocation by default
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-04-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Buildfix).
+
+        * interpreter/CachedCall.h:
+
+2009-04-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        * runtime/StringPrototype.cpp:
+
+2009-04-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Improve String.replace performance slightly
+
+        Apply our vm reentry caching logic to String.replace with global
+        regexes.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+
+2009-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich and Oliver Hunt.
+        
+        Re-Fixed <rdar://problem/6406045> REGRESSION: Stack overflow on PowerPC on
+        fast/workers/use-machine-stack.html (22531)
+        
+        SunSpider reports no change.
+        
+        Use a larger recursion limit on the main thread (because we can, and
+        there's some evidence that it may improve compatibility), and a smaller
+        recursion limit on secondary threads (because they tend to have smaller
+        stacks).
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::prepareForRepeatCall):
+        * interpreter/Interpreter.h:
+        (JSC::): Ditto. I wrote the recursion test slightly funny, so that the
+        common case remains a simple compare to constant.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin): Conservatively, set the array recursion limits
+        to the lower, secondary thread limit. We can do something fancier if
+        compatibility moves us, but this seems sufficient for now.
+
+2009-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber-stamped by Adam Roben.
+        
+        Disabled one more Mozilla JS test because it fails intermittently on Windows.
+        (See https://bugs.webkit.org/show_bug.cgi?id=25160.)
+
+        * tests/mozilla/expected.html:
+
+2009-04-21  Adam Roben  <aroben@apple.com>
+
+        Rename JavaScriptCore_debug.dll to JavaScriptCore.dll in the Debug
+        configuration
+
+        This matches the naming scheme for WebKit.dll, and will be necessary
+        once Safari links against JavaScriptCore.dll. This change also causes
+        run-safari not to fail (because the launcher printed by FindSafari was
+        always looking for JavaScriptCore.dll, never
+        JavaScriptCore_debug.dll).
+
+        Part of Bug 25305: can't run safari or drt on windows
+        <https://bugs.webkit.org/show_bug.cgi?id=25305>
+
+        Reviewed by Steve Falkenburg and Sam Weinig.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj:
+        Use $(WebKitDLLConfigSuffix) for naming JavaScriptCore.{dll,lib}.
+
+2009-04-21  Adam Roben  <aroben@apple.com>
+
+        Fix JavaScriptCore build on VC++ Express
+
+        Reviewed by Steve Falkenburg and Sam Weinig.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Link
+        explicitly against gdi32.lib and oleaut32.lib.
+
+2009-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        Tiger crash fix: Put VM tags in their own header file, and fixed up the
+        #ifdefs so they're not used on Tiger.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        * runtime/Collector.cpp:
+        (JSC::allocateBlock):
+        * wtf/VMTags.h: Added.
+
+2009-04-20  Steve Falkenburg  <sfalken@apple.com>
+
+        More Windows build fixes.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.make: Copy DLLs, PDBs.
+        * JavaScriptCore.vcproj/JavaScriptCore.resources: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore.resources/Info.plist: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.rc: Added.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Add version stamping, resource copying.
+
+2009-04-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Separate JavaScriptCore.dll from WebKit.dll.
+        Slight performance improvement or no change on benchmarks.
+        
+        Allows us to break a circular dependency between CFNetwork and WebKit on Windows,
+        and simplifies standalone JavaScriptCore builds.
+
+        Reviewed by Oliver Hunt.
+
+        * API/JSBase.h: Export symbols with JS_EXPORT when using MSVC.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Build JavaScriptCore as a DLL instead of a static library.
+        * config.h: Specify __declspec(dllexport/dllimport) appropriately when exporting data.
+        * runtime/InternalFunction.h: Specify JS_EXPORTDATA on exported data.
+        * runtime/JSArray.h: Specify JS_EXPORTDATA on exported data.
+        * runtime/JSFunction.h: Specify JS_EXPORTDATA on exported data.
+        * runtime/StringObject.h: Specify JS_EXPORTDATA on exported data.
+        * runtime/UString.h: Specify JS_EXPORTDATA on exported data.
+
+2009-04-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Kevin McCullough.
+
+        Always tag mmaped memory on darwin and clean up #defines
+        now that they are a little bigger.
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        * runtime/Collector.cpp:
+        (JSC::allocateBlock):
+
+2009-04-20  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Tim Hatcher.
+
+        Add licenses for xcconfig files.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/JavaScriptCore.xcconfig:
+        * Configurations/Version.xcconfig:
+
+2009-04-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Build fix for Qt port (after r42646). Not reviewed.
+
+        * wtf/unicode/qt4/UnicodeQt4.h: Added U16_PREV.
+
+2009-04-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Better fix for JSStringCreateWithCFString hardening.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+
+2009-04-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/5860954>
+        Harden JSStringCreateWithCFString against malformed CFStringRefs.
+
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+
+2009-04-19  David Kilzer  <ddkilzer@apple.com>
+
+        Make FEATURE_DEFINES completely dynamic
+
+        Reviewed by Darin Adler.
+
+        Make FEATURE_DEFINES depend on individual ENABLE_FEATURE_NAME
+        variables for each feature, making it possible to remove all
+        knowledge of FEATURE_DEFINES from build-webkit.
+
+        * Configurations/FeatureDefines.xcconfig: Extract a variable
+        from FEATURE_DEFINES for each feature setting.
+
+2009-04-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix typo.  s/VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE/VM_MEMORY_JAVASCRIPT_CORE/
+
+        * runtime/Collector.cpp:
+        (JSC::allocateBlock): Fix bozo typo.
+
+2009-04-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for <rdar://problem/6801555> Tag JavaScript memory on SnowLeopard
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        * jit/ExecutableAllocatorFixedVMPool.cpp:
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::systemAlloc):
+        * runtime/Collector.cpp:
+        (JSC::allocateBlock):
+
+2009-04-18  Drew Wilson  <amw@apple.com>
+
+        <rdar://problem/6781407> VisiblePosition.characterAfter should return UChar32
+
+        Reviewed by Dan Bernstein.
+
+        * wtf/unicode/icu/UnicodeIcu.h:
+        (WTF::Unicode::hasLineBreakingPropertyComplexContextOrIdeographic): Added.
+
+2009-04-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix for <rdar://problem/5861045>
+        A little bit of hardening for UString.
+
+        * runtime/UString.cpp:
+        (JSC::concatenate):
+        (JSC::UString::append):
+
+2009-04-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe and Dan Bernstein.
+
+        Fix for <rdar://problem/5861188>
+        A little bit of hardening for Vector.
+
+        * wtf/Vector.h:
+        (WTF::Vector<T, inlineCapacity>::append):
+        (WTF::Vector<T, inlineCapacity>::insert):
+
+2009-04-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        On x86_64, make all JIT-code allocations from a new heap, managed
+        by FixedVMPoolAllocator.  This class allocates a single large (2Gb)
+        pool of virtual memory from which all further allocations take place.
+        Since all JIT code is allocated from this pool, we can continue to
+        safely assume (as is already asserted) that it will always be possible
+        to link any JIT-code to JIT-code jumps and calls.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+            Add new file.
+        * jit/ExecutableAllocatorFixedVMPool.cpp: Added.
+        (JSC::FreeListEntry::FreeListEntry):
+        (JSC::AVLTreeAbstractorForFreeList::get_less):
+        (JSC::AVLTreeAbstractorForFreeList::set_less):
+        (JSC::AVLTreeAbstractorForFreeList::get_greater):
+        (JSC::AVLTreeAbstractorForFreeList::set_greater):
+        (JSC::AVLTreeAbstractorForFreeList::get_balance_factor):
+        (JSC::AVLTreeAbstractorForFreeList::set_balance_factor):
+        (JSC::AVLTreeAbstractorForFreeList::null):
+        (JSC::AVLTreeAbstractorForFreeList::compare_key_key):
+        (JSC::AVLTreeAbstractorForFreeList::compare_key_node):
+        (JSC::AVLTreeAbstractorForFreeList::compare_node_node):
+        (JSC::sortFreeListEntriesByPointer):
+        (JSC::sortCommonSizedAllocations):
+        (JSC::FixedVMPoolAllocator::release):
+        (JSC::FixedVMPoolAllocator::reuse):
+        (JSC::FixedVMPoolAllocator::addToFreeList):
+        (JSC::FixedVMPoolAllocator::coalesceFreeSpace):
+        (JSC::FixedVMPoolAllocator::FixedVMPoolAllocator):
+        (JSC::FixedVMPoolAllocator::alloc):
+        (JSC::FixedVMPoolAllocator::free):
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+            The new 2Gb heap class!
+        * jit/ExecutableAllocatorPosix.cpp:
+            Disable use of this implementation on x86_64.
+        * wtf/AVLTree.h:
+            Add missing variable initialization.
+        (WTF::::remove):
+
+2009-04-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix bug where the VM reentry cache would not correctly unroll the cached callframe
+
+        Fix a check that was intended to mark a cached call as invalid when the callframe could
+        not be constructed.  Instead it was just checking that there was a place to put the
+        exception.  This eventually results in a non-recoverable RegisterFile starvation.
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::CachedCall):
+        (JSC::CachedCall::call): add assertion to ensure we don't use a bad callframe
+
+2009-04-17  David Kilzer  <ddkilzer@apple.com>
+
+        Simplify FEATURE_DEFINES definition
+
+        Reviewed by Darin Adler.
+
+        This moves FEATURE_DEFINES and its related ENABLE_FEATURE_NAME
+        variables to their own FeatureDefines.xcconfig file.  It also
+        extracts a new ENABLE_GEOLOCATION variable so that
+        FEATURE_DEFINES only needs to be defined once.
+
+        * Configurations/FeatureDefines.xcconfig: Added.
+        * Configurations/JavaScriptCore.xcconfig: Removed definition of
+        ENABLE_SVG_DOM_OBJC_BINDINGS and FEATURE_DEFINES.  Added include
+        of FeatureDefines.xcconfig.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added
+        FeatureDefines.xcconfig file.
+
+2009-04-08  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 25027: JavaScript parseInt wrong on negative numbers
+        <https://bugs.webkit.org/show_bug.cgi?id=25027>
+
+        When dealing with negative numbers, parseInt should use ceil instead of floor.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+
+2009-04-16  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6744652> 32-bit to 64-bit: Javascript hash tables double in size
+
+        Remove perfect hash optimization which removes 1 MB of overhead on 32-bit and almost 2 MB on 64-bit.  Removing the optimization was not a regression on SunSpider and the acid 3 test still passes.
+
+        * create_hash_table:
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable):
+        (JSC::HashTable::deleteTable):
+        * runtime/Lookup.h:
+        (JSC::HashEntry::initialize):
+        (JSC::HashEntry::next):
+        (JSC::HashTable::entry):
+        * runtime/Structure.cpp:
+        (JSC::Structure::getEnumerableNamesFromClassInfoTable):
+
+2009-04-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix subtle error in optimised VM reentry in Array.sort
+
+        Basically to ensure we don't accidentally invalidate the cached callframe
+        we should be using the cached callframe rather than our own exec state.
+        While the old behaviour was wrong i have been unable to actually create a
+        test case where anything actually ends up going wrong.
+
+        * interpreter/CachedCall.h:
+        (JSC::CachedCall::newCallFrame):
+        * runtime/JSArray.cpp:
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+
+2009-04-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Optimise op_resolve_base
+
+        If we can statically find a property we are trying to resolve
+        the base of, the base is guaranteed to be the global object.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolveBase):
+
+2009-04-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve performance of read-write-modify operators
+
+        Implement cross scope optimisation for read-write-modify
+        operators, to avoid unnecessary calls to property resolve
+        helper functions.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitLoadGlobalObject):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        * bytecompiler/BytecodeGenerator.h:
+
+2009-04-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve performance of remaining array enumeration functions
+
+        Make use of function entry cache for remaining Array enumeration functions.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+
+2009-04-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve performance of Array.sort
+
+        Cache the VM entry for Array.sort when using a JS comparison function.
+
+        * runtime/JSArray.cpp:
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+        (JSC::JSArray::sort):
+
+2009-04-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 25229: Need support for Array.prototype.reduceRight
+        <https://bugs.webkit.org/show_bug.cgi?id=25229>
+
+        Implement Array.reduceRight
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncReduceRight):
+
+2009-04-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 25227: Array.filter triggers an assertion when the target array shrinks while being filtered
+        <https://bugs.webkit.org/show_bug.cgi?id=25227>
+
+        We correct this simply by making the fast array path fall back on the slow path if
+        we ever discover the fast access is unsafe.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncFilter):
+
+2009-04-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 25159: Support Array.prototype.reduce
+        <https://bugs.webkit.org/show_bug.cgi?id=25159>
+
+        Implement Array.prototype.reduce
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncReduce):
+
+2009-04-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Move CallFrameClosure from inside the Interpreter class to its own file.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/CachedCall.h:
+        * interpreter/CallFrameClosure.h: Copied from JavaScriptCore/yarr/RegexJIT.h.
+        (JSC::CallFrameClosure::setArgument):
+        (JSC::CallFrameClosure::resetCallFrame):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::prepareForRepeatCall):
+        * interpreter/Interpreter.h:
+
+2009-04-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 25202: Improve performance of repeated callbacks into the VM
+
+        Add the concept of a CachedCall to native code for use in Array
+        prototype and similar functions where a single callback function
+        is called repeatedly with the same number of arguments.
+
+        Used Array.prototype.filter as the test function and got a 50% win
+        over a naive non-caching specialised version.  This makes the native
+        implementation of Array.prototype.filter faster than the JS one once
+        more.
+
+        * JavaScriptCore.vcproj/JavaScriptCore.sln:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/CachedCall.h: Added.
+        (JSC::CachedCall::CachedCall):
+        (JSC::CachedCall::call):
+        (JSC::CachedCall::setThis):
+        (JSC::CachedCall::setArgument):
+        (JSC::CachedCall::~CachedCall):
+           CachedCall is a wrapper that automates the calling and teardown
+           for a CallFrameClosure
+        * interpreter/CallFrame.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::prepareForRepeatCall):
+           Create the basic entry closure for a function
+        (JSC::Interpreter::execute):
+           A new ::execute method to enter the interpreter from a closure
+        (JSC::Interpreter::endRepeatCall):
+           Clear the entry closure
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::CallFrameClosure::setArgument):
+        (JSC::Interpreter::CallFrameClosure::resetCallFrame):
+           Helper functions to simplify setting up the closure's callframe
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncFilter):
+
+2009-04-14  Xan Lopez  <xlopez@igalia.com>
+
+        Fix the build.
+
+        Add the yarr headers (and only the headers) to the build, so that
+        RegExp.cpp can compile. The headers are ifdefed out with yarr
+        disabled, so we don't need anything else for now.
+
+        * GNUmakefile.am:
+
+2009-04-14  Adam Roben  <aroben@apple.com>
+
+        Remove support for profile-guided optimization on Windows
+
+        Rubber-stamped by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Removed
+        the Release_PGO configuration. Also let VS re-order the source files
+        list.
+
+2009-04-14  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        * GNUmakefile.am:
+
+2009-04-14  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix when building minidom. Not reviewed.
+
+        Use C-style comment instead of C++ style since autotools builds
+        minidom using gcc and not g++.
+
+        * wtf/Platform.h:
+
+2009-04-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by NOBODY - speculative build fix.
+
+        * runtime/RegExp.h:
+
+2009-04-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cap'n Geoff Garen.
+
+        Yarr!
+        (Yet another regex runtime).
+
+        Currently disabled by default since the interpreter, whilst awesomely
+        functional, has not been optimized and is likely slower than PCRE, and
+        the JIT, whilst faster than WREC, is presently incomplete and does not
+        fallback to using an interpreter for the cases it cannot handle.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::move):
+        (JSC::MacroAssemblerX86Common::swap):
+        (JSC::MacroAssemblerX86Common::signExtend32ToPtr):
+        (JSC::MacroAssemblerX86Common::zeroExtend32ToPtr):
+        (JSC::MacroAssemblerX86Common::branch32):
+        (JSC::MacroAssemblerX86Common::branch16):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::cmpw_im):
+        (JSC::X86Assembler::testw_rr):
+        (JSC::X86Assembler::X86InstructionFormatter::immediate16):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::~RegExp):
+        (JSC::RegExp::create):
+        (JSC::RegExp::compile):
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+        * wtf/Platform.h:
+        * yarr: Added.
+        * yarr/RegexCompiler.cpp: Added.
+        (JSC::Yarr::CharacterClassConstructor::CharacterClassConstructor):
+        (JSC::Yarr::CharacterClassConstructor::reset):
+        (JSC::Yarr::CharacterClassConstructor::append):
+        (JSC::Yarr::CharacterClassConstructor::putChar):
+        (JSC::Yarr::CharacterClassConstructor::isUnicodeUpper):
+        (JSC::Yarr::CharacterClassConstructor::isUnicodeLower):
+        (JSC::Yarr::CharacterClassConstructor::putRange):
+        (JSC::Yarr::CharacterClassConstructor::charClass):
+        (JSC::Yarr::CharacterClassConstructor::addSorted):
+        (JSC::Yarr::CharacterClassConstructor::addSortedRange):
+        (JSC::Yarr::newlineCreate):
+        (JSC::Yarr::digitsCreate):
+        (JSC::Yarr::spacesCreate):
+        (JSC::Yarr::wordcharCreate):
+        (JSC::Yarr::nondigitsCreate):
+        (JSC::Yarr::nonspacesCreate):
+        (JSC::Yarr::nonwordcharCreate):
+        (JSC::Yarr::RegexPatternConstructor::RegexPatternConstructor):
+        (JSC::Yarr::RegexPatternConstructor::~RegexPatternConstructor):
+        (JSC::Yarr::RegexPatternConstructor::reset):
+        (JSC::Yarr::RegexPatternConstructor::assertionBOL):
+        (JSC::Yarr::RegexPatternConstructor::assertionEOL):
+        (JSC::Yarr::RegexPatternConstructor::assertionWordBoundary):
+        (JSC::Yarr::RegexPatternConstructor::atomPatternCharacter):
+        (JSC::Yarr::RegexPatternConstructor::atomBuiltInCharacterClass):
+        (JSC::Yarr::RegexPatternConstructor::atomCharacterClassBegin):
+        (JSC::Yarr::RegexPatternConstructor::atomCharacterClassAtom):
+        (JSC::Yarr::RegexPatternConstructor::atomCharacterClassRange):
+        (JSC::Yarr::RegexPatternConstructor::atomCharacterClassBuiltIn):
+        (JSC::Yarr::RegexPatternConstructor::atomCharacterClassEnd):
+        (JSC::Yarr::RegexPatternConstructor::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::RegexPatternConstructor::atomParentheticalAssertionBegin):
+        (JSC::Yarr::RegexPatternConstructor::atomParenthesesEnd):
+        (JSC::Yarr::RegexPatternConstructor::atomBackReference):
+        (JSC::Yarr::RegexPatternConstructor::copyDisjunction):
+        (JSC::Yarr::RegexPatternConstructor::copyTerm):
+        (JSC::Yarr::RegexPatternConstructor::quantifyAtom):
+        (JSC::Yarr::RegexPatternConstructor::disjunction):
+        (JSC::Yarr::RegexPatternConstructor::regexBegin):
+        (JSC::Yarr::RegexPatternConstructor::regexEnd):
+        (JSC::Yarr::RegexPatternConstructor::regexError):
+        (JSC::Yarr::RegexPatternConstructor::setupAlternativeOffsets):
+        (JSC::Yarr::RegexPatternConstructor::setupDisjunctionOffsets):
+        (JSC::Yarr::RegexPatternConstructor::setupOffsets):
+        (JSC::Yarr::compileRegex):
+        * yarr/RegexCompiler.h: Added.
+        * yarr/RegexInterpreter.cpp: Added.
+        (JSC::Yarr::Interpreter::appendParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::popParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::DisjunctionContext::DisjunctionContext):
+        (JSC::Yarr::Interpreter::DisjunctionContext::operator new):
+        (JSC::Yarr::Interpreter::allocDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeDisjunctionContext):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::ParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::operator new):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::restoreOutput):
+        (JSC::Yarr::Interpreter::ParenthesesDisjunctionContext::getDisjunctionContext):
+        (JSC::Yarr::Interpreter::allocParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::freeParenthesesDisjunctionContext):
+        (JSC::Yarr::Interpreter::InputStream::InputStream):
+        (JSC::Yarr::Interpreter::InputStream::next):
+        (JSC::Yarr::Interpreter::InputStream::rewind):
+        (JSC::Yarr::Interpreter::InputStream::read):
+        (JSC::Yarr::Interpreter::InputStream::readChecked):
+        (JSC::Yarr::Interpreter::InputStream::reread):
+        (JSC::Yarr::Interpreter::InputStream::prev):
+        (JSC::Yarr::Interpreter::InputStream::getPos):
+        (JSC::Yarr::Interpreter::InputStream::setPos):
+        (JSC::Yarr::Interpreter::InputStream::atStart):
+        (JSC::Yarr::Interpreter::InputStream::atEnd):
+        (JSC::Yarr::Interpreter::InputStream::checkInput):
+        (JSC::Yarr::Interpreter::InputStream::uncheckInput):
+        (JSC::Yarr::Interpreter::testCharacterClass):
+        (JSC::Yarr::Interpreter::tryConsumeCharacter):
+        (JSC::Yarr::Interpreter::checkCharacter):
+        (JSC::Yarr::Interpreter::tryConsumeCharacterClass):
+        (JSC::Yarr::Interpreter::checkCharacterClass):
+        (JSC::Yarr::Interpreter::tryConsumeBackReference):
+        (JSC::Yarr::Interpreter::matchAssertionBOL):
+        (JSC::Yarr::Interpreter::matchAssertionEOL):
+        (JSC::Yarr::Interpreter::matchAssertionWordBoundary):
+        (JSC::Yarr::Interpreter::matchPatternCharacter):
+        (JSC::Yarr::Interpreter::backtrackPatternCharacter):
+        (JSC::Yarr::Interpreter::matchCharacterClass):
+        (JSC::Yarr::Interpreter::backtrackCharacterClass):
+        (JSC::Yarr::Interpreter::matchBackReference):
+        (JSC::Yarr::Interpreter::backtrackBackReference):
+        (JSC::Yarr::Interpreter::recordParenthesesMatch):
+        (JSC::Yarr::Interpreter::resetMatches):
+        (JSC::Yarr::Interpreter::resetAssertionMatches):
+        (JSC::Yarr::Interpreter::parenthesesDoBacktrack):
+        (JSC::Yarr::Interpreter::matchParenthesesOnceBegin):
+        (JSC::Yarr::Interpreter::matchParenthesesOnceEnd):
+        (JSC::Yarr::Interpreter::backtrackParenthesesOnceBegin):
+        (JSC::Yarr::Interpreter::backtrackParenthesesOnceEnd):
+        (JSC::Yarr::Interpreter::matchParentheticalAssertionOnceBegin):
+        (JSC::Yarr::Interpreter::matchParentheticalAssertionOnceEnd):
+        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionOnceBegin):
+        (JSC::Yarr::Interpreter::backtrackParentheticalAssertionOnceEnd):
+        (JSC::Yarr::Interpreter::matchParentheses):
+        (JSC::Yarr::Interpreter::backtrackParentheses):
+        (JSC::Yarr::Interpreter::matchTerm):
+        (JSC::Yarr::Interpreter::backtrackTerm):
+        (JSC::Yarr::Interpreter::matchAlternative):
+        (JSC::Yarr::Interpreter::matchDisjunction):
+        (JSC::Yarr::Interpreter::matchNonZeroDisjunction):
+        (JSC::Yarr::Interpreter::interpret):
+        (JSC::Yarr::Interpreter::Interpreter):
+        (JSC::Yarr::ByteCompiler::ParenthesesStackEntry::ParenthesesStackEntry):
+        (JSC::Yarr::ByteCompiler::ByteCompiler):
+        (JSC::Yarr::ByteCompiler::compile):
+        (JSC::Yarr::ByteCompiler::checkInput):
+        (JSC::Yarr::ByteCompiler::assertionBOL):
+        (JSC::Yarr::ByteCompiler::assertionEOL):
+        (JSC::Yarr::ByteCompiler::assertionWordBoundary):
+        (JSC::Yarr::ByteCompiler::atomPatternCharacter):
+        (JSC::Yarr::ByteCompiler::atomCharacterClass):
+        (JSC::Yarr::ByteCompiler::atomBackReference):
+        (JSC::Yarr::ByteCompiler::atomParenthesesSubpatternBegin):
+        (JSC::Yarr::ByteCompiler::atomParentheticalAssertionBegin):
+        (JSC::Yarr::ByteCompiler::popParenthesesStack):
+        (JSC::Yarr::ByteCompiler::dumpDisjunction):
+        (JSC::Yarr::ByteCompiler::closeAlternative):
+        (JSC::Yarr::ByteCompiler::atomParenthesesEnd):
+        (JSC::Yarr::ByteCompiler::regexBegin):
+        (JSC::Yarr::ByteCompiler::regexEnd):
+        (JSC::Yarr::ByteCompiler::alterantiveDisjunction):
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+        (JSC::Yarr::byteCompileRegex):
+        (JSC::Yarr::interpretRegex):
+        * yarr/RegexInterpreter.h: Added.
+        (JSC::Yarr::ByteTerm::):
+        (JSC::Yarr::ByteTerm::ByteTerm):
+        (JSC::Yarr::ByteTerm::BOL):
+        (JSC::Yarr::ByteTerm::CheckInput):
+        (JSC::Yarr::ByteTerm::EOL):
+        (JSC::Yarr::ByteTerm::WordBoundary):
+        (JSC::Yarr::ByteTerm::BackReference):
+        (JSC::Yarr::ByteTerm::AlternativeBegin):
+        (JSC::Yarr::ByteTerm::AlternativeDisjunction):
+        (JSC::Yarr::ByteTerm::AlternativeEnd):
+        (JSC::Yarr::ByteTerm::PatternEnd):
+        (JSC::Yarr::ByteTerm::invert):
+        (JSC::Yarr::ByteTerm::capture):
+        (JSC::Yarr::ByteDisjunction::ByteDisjunction):
+        (JSC::Yarr::BytecodePattern::BytecodePattern):
+        (JSC::Yarr::BytecodePattern::~BytecodePattern):
+        * yarr/RegexJIT.cpp: Added.
+        (JSC::Yarr::RegexGenerator::optimizeAlternative):
+        (JSC::Yarr::RegexGenerator::matchCharacterClassRange):
+        (JSC::Yarr::RegexGenerator::matchCharacterClass):
+        (JSC::Yarr::RegexGenerator::jumpIfNoAvailableInput):
+        (JSC::Yarr::RegexGenerator::jumpIfAvailableInput):
+        (JSC::Yarr::RegexGenerator::checkInput):
+        (JSC::Yarr::RegexGenerator::atEndOfInput):
+        (JSC::Yarr::RegexGenerator::notAtEndOfInput):
+        (JSC::Yarr::RegexGenerator::jumpIfCharEquals):
+        (JSC::Yarr::RegexGenerator::jumpIfCharNotEquals):
+        (JSC::Yarr::RegexGenerator::readCharacter):
+        (JSC::Yarr::RegexGenerator::storeToFrame):
+        (JSC::Yarr::RegexGenerator::loadFromFrame):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::TermGenerationState):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::resetAlternative):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::alternativeValid):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::nextAlternative):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::alternative):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::resetTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::termValid):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::nextTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::term):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::lookaheadTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::isSinglePatternCharacterLookaheadTerm):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::inputOffset):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::jumpToBacktrack):
+        (JSC::Yarr::RegexGenerator::TermGenerationState::setBacktrackGenerated):
+        (JSC::Yarr::RegexGenerator::jumpToBacktrackCheckEmitPending):
+        (JSC::Yarr::RegexGenerator::genertateAssertionBOL):
+        (JSC::Yarr::RegexGenerator::genertateAssertionEOL):
+        (JSC::Yarr::RegexGenerator::matchAssertionWordchar):
+        (JSC::Yarr::RegexGenerator::genertateAssertionWordBoundary):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterSingle):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterPair):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterFixed):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterGreedy):
+        (JSC::Yarr::RegexGenerator::genertatePatternCharacterNonGreedy):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassSingle):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassFixed):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassGreedy):
+        (JSC::Yarr::RegexGenerator::genertateCharacterClassNonGreedy):
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingleDisjunctionOneAlternative):
+        (JSC::Yarr::RegexGenerator::generateParenthesesSingle):
+        (JSC::Yarr::RegexGenerator::generateTerm):
+        (JSC::Yarr::RegexGenerator::generateDisjunction):
+        (JSC::Yarr::RegexGenerator::RegexGenerator):
+        (JSC::Yarr::RegexGenerator::generate):
+        (JSC::Yarr::jitCompileRegex):
+        (JSC::Yarr::executeRegex):
+        * yarr/RegexJIT.h: Added.
+        (JSC::Yarr::RegexCodeBlock::RegexCodeBlock):
+        * yarr/RegexParser.h: Added.
+        (JSC::Yarr::):
+        (JSC::Yarr::Parser::):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::CharacterClassParserDelegate):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::begin):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomPatternCharacterUnescaped):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomPatternCharacter):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBuiltInCharacterClass):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::end):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::assertionWordBoundary):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::atomBackReference):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::flush):
+        (JSC::Yarr::Parser::CharacterClassParserDelegate::):
+        (JSC::Yarr::Parser::Parser):
+        (JSC::Yarr::Parser::parseEscape):
+        (JSC::Yarr::Parser::parseAtomEscape):
+        (JSC::Yarr::Parser::parseCharacterClassEscape):
+        (JSC::Yarr::Parser::parseCharacterClass):
+        (JSC::Yarr::Parser::parseParenthesesBegin):
+        (JSC::Yarr::Parser::parseParenthesesEnd):
+        (JSC::Yarr::Parser::parseQuantifier):
+        (JSC::Yarr::Parser::parseTokens):
+        (JSC::Yarr::Parser::parse):
+        (JSC::Yarr::Parser::saveState):
+        (JSC::Yarr::Parser::restoreState):
+        (JSC::Yarr::Parser::atEndOfPattern):
+        (JSC::Yarr::Parser::peek):
+        (JSC::Yarr::Parser::peekIsDigit):
+        (JSC::Yarr::Parser::peekDigit):
+        (JSC::Yarr::Parser::consume):
+        (JSC::Yarr::Parser::consumeDigit):
+        (JSC::Yarr::Parser::consumeNumber):
+        (JSC::Yarr::Parser::consumeOctal):
+        (JSC::Yarr::Parser::tryConsume):
+        (JSC::Yarr::Parser::tryConsumeHex):
+        (JSC::Yarr::parse):
+        * yarr/RegexPattern.h: Added.
+        (JSC::Yarr::CharacterRange::CharacterRange):
+        (JSC::Yarr::):
+        (JSC::Yarr::PatternTerm::):
+        (JSC::Yarr::PatternTerm::PatternTerm):
+        (JSC::Yarr::PatternTerm::BOL):
+        (JSC::Yarr::PatternTerm::EOL):
+        (JSC::Yarr::PatternTerm::WordBoundary):
+        (JSC::Yarr::PatternTerm::invert):
+        (JSC::Yarr::PatternTerm::capture):
+        (JSC::Yarr::PatternTerm::quantify):
+        (JSC::Yarr::PatternAlternative::PatternAlternative):
+        (JSC::Yarr::PatternAlternative::lastTerm):
+        (JSC::Yarr::PatternAlternative::removeLastTerm):
+        (JSC::Yarr::PatternDisjunction::PatternDisjunction):
+        (JSC::Yarr::PatternDisjunction::~PatternDisjunction):
+        (JSC::Yarr::PatternDisjunction::addNewAlternative):
+        (JSC::Yarr::RegexPattern::RegexPattern):
+        (JSC::Yarr::RegexPattern::~RegexPattern):
+        (JSC::Yarr::RegexPattern::reset):
+        (JSC::Yarr::RegexPattern::containsIllegalBackReference):
+        (JSC::Yarr::RegexPattern::newlineCharacterClass):
+        (JSC::Yarr::RegexPattern::digitsCharacterClass):
+        (JSC::Yarr::RegexPattern::spacesCharacterClass):
+        (JSC::Yarr::RegexPattern::wordcharCharacterClass):
+        (JSC::Yarr::RegexPattern::nondigitsCharacterClass):
+        (JSC::Yarr::RegexPattern::nonspacesCharacterClass):
+        (JSC::Yarr::RegexPattern::nonwordcharCharacterClass):
+
+2009-04-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Missed code from last patch).
+
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::displayName):
+        (JSC::InternalFunction::calculatedDisplayName):
+        * runtime/InternalFunction.h:
+
+2009-04-13  Francisco Tolmasky  <francisco@280north.com>
+
+        Reviewed by Oliver Hunt.
+        
+        BUG 25171: It should be possible to manually set the name of an anonymous function
+        <https://bugs.webkit.org/show_bug.cgi?id=25171>
+
+        This change adds the displayName property to functions, which when set overrides the 
+        normal name when appearing in the console.
+
+        * profiler/Profiler.cpp:
+        (JSC::createCallIdentifierFromFunctionImp): Changed call to InternalFunction::name to InternalFunction::calculatedDisplayName
+        * runtime/CommonIdentifiers.h: Added displayName common identifier.
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::displayName): Access to user settable displayName property
+        (JSC::InternalFunction::calculatedDisplayName): Returns displayName if it exists, if not then the natural name
+
+2009-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Disabled another JavaScriptCore test because it fails on Windows but
+        not Mac, so it makes the bots red.
+
+        * tests/mozilla/expected.html:
+
+2009-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Disabled two JavaScriptCore tests because they fail on Window or Mac but
+        not both, so they make the bots red.
+
+        * tests/mozilla/expected.html: Updated expected results.
+
+2009-04-09  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25091
+        The Android platform requires threads to be registered with the VM.
+        This patch implements this behaviour inside ThreadingPthreads.cpp.
+
+        * wtf/ThreadingPthreads.cpp: Add a level above threadEntryPoint that takes care of (un)registering threads with the VM.
+        (WTF::runThreadWithRegistration): register the thread and run entryPoint. Unregister the thread afterwards.
+        (WTF::createThreadInternal): call runThreadWithRegistration instead of entryPoint directly.
+
+2009-04-09  David Kilzer  <ddkilzer@apple.com>
+
+        Reinstating <rdar://problem/6718589> Option to turn off SVG DOM Objective-C bindings
+
+        Rolled r42345 back in.  The build failure was caused by an
+        internal script which had not been updated the same way that
+        build-webkit was updated.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2009-04-09  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reverting <rdar://problem/6718589> Option to turn off SVG DOM Objective-C bindings.
+        It broke Mac build, and I don't know how to fix it.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2009-04-09  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        Checking for __GLIBCXX__ being bigger than some date is not enough
+        to get std::tr1, C++0x has to be in use too. Add another check for
+        __GXX_EXPERIMENTAL_CXX0X__.
+
+        * wtf/TypeTraits.h:
+
+2009-04-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix assertion failure in function.apply
+
+        The result of excess arguments to function.apply is irrelevant
+        so we don't need to provide a result register.  We were providing
+        temporary result register but not ref'ing it resulting in an
+        assertion failure.
+
+        * parser/Nodes.cpp:
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+
+2009-04-08  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6718589> Option to turn off SVG DOM Objective-C bindings
+
+        Reviewed by Darin Adler and Maciej Stachowiak.
+
+        Introduce the ENABLE_SVG_DOM_OBJC_BINDINGS feature define so
+        that SVG DOM Objective-C bindings may be optionally disabled.
+
+        * Configurations/JavaScriptCore.xcconfig: Added
+        ENABLE_SVG_DOM_OBJC_BINDINGS variable and use it in
+        FEATURE_DEFINES.
+
+2009-04-08  Paul Pedriana <ppedriana@ea.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20422
+        Allow custom memory allocation control.
+        
+        * wtf/FastAllocBase.h:
+        New added file. Implements allocation base class.
+        * wtf/TypeTraits.h:
+        Augments existing type traits support as needed by FastAllocBase.
+        * wtf/FastMalloc.h:
+        Changed to support FastMalloc match validation.
+        * wtf/FastMalloc.cpp:
+        Changed to support FastMalloc match validation.
+        * wtf/Platform.h:
+        Added ENABLE_FAST_MALLOC_MATCH_VALIDATION; defaults to 0.
+        * GNUmakefile.am:
+        Updated to include added FastAllocBase.h.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Updated to include added FastAllocBase.h.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        Updated to include added FastAllocBase.h.
+
+2009-04-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Improve function.apply performance
+
+        Jump through a few hoops to improve performance of function.apply in the general case.
+
+        In the case of zero or one arguments, or if there are only two arguments and the
+        second is an array literal we treat function.apply as function.call.
+
+        Otherwise we use the new opcodes op_load_varargs and op_call_varargs to do the .apply call
+        without re-entering the virtual machine.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionApply):
+        (JSC::BytecodeGenerator::emitLoadVarargs):
+        (JSC::BytecodeGenerator::emitCallVarargs):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpCallVarargsSetupArgs):
+        (JSC::JIT::compileOpCallVarargs):
+        (JSC::JIT::compileOpCallVarargsSlowCase):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_load_varargs):
+        * jit/JITStubs.h:
+        * parser/Grammar.y:
+        * parser/Nodes.cpp:
+        (JSC::ArrayNode::isSimpleArray):
+        (JSC::ArrayNode::toArgumentList):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::):
+        (JSC::ApplyFunctionCallDotNode::):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::copyToRegisters):
+        (JSC::Arguments::fillArgList):
+        * runtime/Arguments.h:
+        (JSC::Arguments::numProvidedArguments):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        * runtime/FunctionPrototype.h:
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::copyToRegisters):
+        * runtime/JSArray.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::mark):
+        * runtime/JSGlobalObject.h:
+
+2009-04-08  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25073
+        JavaScriptCore tests don't run if time zone is not PST
+
+        * API/tests/testapi.c:
+        (timeZoneIsPST): Added a function that checks whether the time zone is PST, using the same
+        method as functions in DateMath.cpp do for formatting the result.
+        (main): Skip date string format test if the time zone is not PST.
+
+2009-04-07  David Levin  <levin@chromium.org>
+
+        Reviewed by Sam Weinig and Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25039
+        UString refactoring to support UChar* sharing.
+
+        No change in sunspider perf.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        * runtime/UString.cpp:
+        (JSC::initializeStaticBaseString):
+        (JSC::initializeUString):
+        (JSC::UString::BaseString::isShared):
+        Encapsulate the meaning behind the refcount == 1 checks because
+        this needs to do slightly more when sharing is added.
+        (JSC::concatenate):
+        (JSC::UString::append):
+        (JSC::UString::operator=):
+        * runtime/UString.h:
+        Make m_baseString part of a union to get rid of casts, but make it protected because
+        it is tricky to use it correctly since it is only valid when the Rep is not a BaseString.
+        The void* will be filled in when sharing is added.
+
+        Add constructors due to the making members protected and it make ensuring proper
+        initialization work better (like in SmallStringsStorage).
+        (JSC::UString::Rep::create):
+        (JSC::UString::Rep::Rep):
+        (JSC::UString::Rep::):
+        (JSC::UString::BaseString::BaseString):
+        (JSC::UString::Rep::setBaseString):
+        (JSC::UString::Rep::baseString):
+
+2009-04-04  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25033
+        dtoa.cpp segfaults with g++ 4.4.0
+
+        g++ 4.4.0 seems to be more strict about aliasing rules, so it
+        produces incorrect code if dtoa.cpp is compiled with
+        -fstrict-aliasing (it also emits a ton of warnings, so fair enough
+        I guess). The problem was that we were only casting variables to
+        union types in order to do type punning, but GCC and the C
+        standard require that we actually use a union to store the value.
+
+        This patch does just that, the code is mostly copied from the dtoa
+        version in GCC:
+        http://gcc.gnu.org/viewcvs/trunk/libjava/classpath/native/fdlibm/dtoa.c?view=markup.
+
+        * wtf/dtoa.cpp:
+        (WTF::ulp):
+        (WTF::b2d):
+        (WTF::ratio):
+        (WTF::hexnan):
+        (WTF::strtod):
+        (WTF::dtoa):
+
+2009-04-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for Win port. Build the assembler sources to get missing functions.
+
+        * JavaScriptCoreSources.bkl:
+        * jscore.bkl:
+        * wtf/Platform.h:
+
+2009-04-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        <rdar://problem/6744471> crash in GC due to uninitialized callFunction pointer
+
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData): Initialize
+        callFunction as we do the other data members that are used in the mark function.
+
+2009-04-02  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann
+
+        https://bugs.webkit.org/show_bug.cgi?id=24490
+
+        Implement WTF::ThreadSpecific in the Qt build using
+        QThreadStorage.
+
+        * wtf/ThreadSpecific.h:
+
+2009-04-01  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24990
+        Put SECTORDER_FLAGS into xcconfig files.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2009-03-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix non-AllInOneFile builds.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+
+2009-03-27  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve performance of Function.prototype.call
+        <https://bugs.webkit.org/show_bug.cgi?id=24907>
+
+        Optimistically assume that expression.call(..) is going to be a call to
+        Function.prototype.call, and handle it specially to attempt to reduce the
+        degree of VM reentrancy.
+
+        When everything goes right this removes the vm reentry improving .call()
+        by around a factor of 10.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitJumpIfNotFunctionCall):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * parser/Grammar.y:
+        * parser/Nodes.cpp:
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::CallFunctionCallDotNode::):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::addFunctionProperties):
+        * runtime/FunctionPrototype.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::mark):
+        * runtime/JSGlobalObject.h:
+
+2009-03-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 24884: Include strings.h for strcasecmp()
+        https://bugs.webkit.org/show_bug.cgi?id=24884
+
+        * runtime/DateMath.cpp: Reversed previous change including strings.h
+        * wtf/StringExtras.h: Include strings.h here is available
+
+2009-03-26  Adam Roben  <aroben@apple.com>
+
+        Copy testapi.js to $WebKitOutputDir on Windows
+
+        Part of Bug 24856: run-javascriptcore-tests should run testapi on
+        Windows
+        <https://bugs.webkit.org/show_bug.cgi?id=24856>
+
+        This matches what Mac does, which will help once we enable running
+        testapi from run-javascriptcore-tests on Windows.
+
+        Reviewed by Steve Falkenburg.
+
+        * JavaScriptCore.vcproj/testapi/testapi.vcproj: Copy testapi.js next
+        to testapi.exe.
+
+2009-03-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix exception handling for instanceof in the interpreter.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-03-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed <rdar://problem/6724011> Write to freed memory in JSC::Label::deref
+        when reloading http://helpme.att.net/speedtest/
+
+        * bytecompiler/BytecodeGenerator.h: Reversed the declaration order for
+        m_labelScopes and m_labels to reverse their destruction order.
+        m_labelScopes has references to memory within m_labels, so its destructor
+        needs to run first.
+
+2009-03-24  Eli Fidler  <eli.fidler@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Correct warnings which in some environments are treated as errors.
+
+        * wtf/dtoa.cpp:
+        (WTF::b2d):
+        (WTF::d2b):
+        (WTF::strtod):
+        (WTF::dtoa):
+
+2009-03-24  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Darin Adler.
+        
+        Explicitly define HAVE_LANGINFO_H on Darwin. Fixes the wx build bot jscore 
+        test failure. 
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24780
+
+        * wtf/Platform.h:
+
+2009-03-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix className() for API defined class
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::className):
+        * API/tests/testapi.c:
+        (EmptyObject_class):
+        (main):
+        * API/tests/testapi.js:
+
+2009-03-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Make testapi assertions run in release builds, so that testapi actually
+        works in a release build.
+
+        Many of the testapi assertions have side effects that are necessary, and
+        given testapi is a testing program, perf impact of an assertion is not
+        important, so it makes sense to apply the assertions in release builds
+        anyway.
+
+        * API/tests/testapi.c:
+        (EvilExceptionObject_hasInstance):
+
+2009-03-23  David Kilzer  <ddkilzer@apple.com>
+
+        Provide JavaScript exception information after slow script timeout
+
+        Reviewed by Oliver Hunt.
+
+        * runtime/Completion.cpp:
+        (JSC::evaluate): Set the exception object as the Completion
+        object's value for slow script timeouts.  This is used in
+        WebCore when reporting the exception.
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::InterruptedExecutionError::toString): Added.  Provides a
+        description message for the exception when it is reported.
+
+2009-03-23  Gustavo Noronha Silva  <gns@gnome.org> and Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24674
+        Crashes in !PLATFORM(MAC)'s formatLocaleDate, in very specific situations
+
+        Make sure strftime never returns 2-digits years to avoid ambiguity
+        and a crash. We wrap this new code option in HAVE_LANGINFO_H,
+        since it is apparently not available in all platforms.
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        * wtf/Platform.h:
+
+2009-03-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix exception handling in API
+
+        We can't just use the ExecState exception slot for returning exceptions
+        from class introspection functions provided through the API as many JSC
+        functions will explicitly clear the ExecState exception when returning.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject<Base>::getOwnPropertySlot):
+        (JSC::JSCallbackObject<Base>::put):
+        (JSC::JSCallbackObject<Base>::deleteProperty):
+        (JSC::JSCallbackObject<Base>::construct):
+        (JSC::JSCallbackObject<Base>::hasInstance):
+        (JSC::JSCallbackObject<Base>::call):
+        (JSC::JSCallbackObject<Base>::toNumber):
+        (JSC::JSCallbackObject<Base>::toString):
+        (JSC::JSCallbackObject<Base>::staticValueGetter):
+        (JSC::JSCallbackObject<Base>::callbackGetter):
+        * API/tests/testapi.c:
+        (MyObject_hasProperty):
+        (MyObject_getProperty):
+        (MyObject_setProperty):
+        (MyObject_deleteProperty):
+        (MyObject_callAsFunction):
+        (MyObject_callAsConstructor):
+        (MyObject_hasInstance):
+        (EvilExceptionObject_hasInstance):
+        (EvilExceptionObject_convertToType):
+        (EvilExceptionObject_class):
+        (main):
+        * API/tests/testapi.js:
+        (EvilExceptionObject.hasInstance):
+        (EvilExceptionObject.toNumber):
+        (EvilExceptionObject.toStringExplicit):
+
+2009-03-21  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 20049: testapi failure: MyObject - 0 should be NaN but instead is 1.
+        <https://bugs.webkit.org/show_bug.cgi?id=20049>
+        <rdar://problem/6079127>
+
+        In this case, the test is wrong. According to the ECMA spec, subtraction
+        uses ToNumber, not ToPrimitive. Change the test to match the spec.
+
+        * API/tests/testapi.js:
+
+2009-03-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Ensure that JSObjectMakeFunction doesn't produce incorrect line numbers.
+
+        Also make test api correctly propagate failures.
+
+        * API/tests/testapi.c:
+        (main):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+
+2009-03-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Improve testapi by making it report failures in a way we can pick up
+        from our test scripts.
+
+        * API/tests/testapi.c:
+        (assertEqualsAsBoolean):
+        (assertEqualsAsNumber):
+        (assertEqualsAsUTF8String):
+        (assertEqualsAsCharactersPtr):
+        (main):
+        * API/tests/testapi.js:
+        (pass):
+        (fail):
+        (shouldBe):
+        (shouldThrow):
+
+2009-03-20  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24535
+
+        Fixes missing line terminator character (;) after macro call.
+        It is common practice to add the trailing ";" where macros are substituted
+        and not where they are defined with #define.
+        This change is consistent with other macro declarations across webkit,
+        and it also solves compilation failure with symbian compilers. 
+ 
+        * runtime/UString.cpp:
+        * wtf/Assertions.h:
+
+2009-03-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed a JavaScriptCore crash on the Windows buildbot.
+
+        * bytecompiler/BytecodeGenerator.h: Reduced the AST recursion limit.
+        Apparently, Windows has small stacks.
+
+2009-03-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        A little cleanup in the RegisterFile code.
+        
+        Moved large inline functions out of the class declaration, to make it
+        more readable.
+        
+        Switched over to using the roundUpAllocationSize function to avoid
+        duplicate code and subtle bugs.
+        
+        Renamed m_maxCommitted to m_commitEnd, to match m_end.
+        
+        Renamed allocationSize to commitSize because it's the chunk size for
+        committing memory, not allocating memory.
+        
+        SunSpider reports no change.
+
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::shrink):
+        (JSC::RegisterFile::grow):
+        * jit/ExecutableAllocator.h:
+        (JSC::roundUpAllocationSize):
+
+2009-03-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed <rdar://problem/6033712> -- a little bit of hardening in the Collector.
+        
+        SunSpider reports no change. I also verified in the disassembly that
+        we end up with a single compare to constant.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::heapAllocate):
+
+2009-03-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich and Oliver Hunt.
+
+        Fixed <rdar://problem/6406045> REGRESSION: Stack overflow on PowerPC on
+        fast/workers/use-machine-stack.html (22531)
+
+        Dialed down the re-entry allowance to 64 (from 128).
+        
+        On a 512K stack, this leaves about 64K for other code on the stack while
+        JavaScript is running. Not perfect, but it solves our crash on PPC.
+
+        Different platforms may want to dial this down even more.
+
+        Also, substantially shrunk BytecodeGenerator. Since we allocate one on
+        the stack in order to throw a stack overflow exception -- well, let's
+        just say the old code had an appreciation for irony.
+
+        SunSpider reports no change.
+
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.h:
+        (JSC::):
+
+2009-03-19  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 24350: REGRESSION: Safari 4 breaks SPAW wysiwyg editor multiple instances
+        <https://bugs.webkit.org/show_bug.cgi?id=24350>
+        <rdar://problem/6674182>
+
+        The SPAW editor's JavaScript assumes that toString() on a function
+        constructed with the Function constructor produces a function with
+        a newline after the opening brace.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction): Add a newline after the opening brace of the
+        function's source code.
+
+2009-03-19  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Geoff Garen.
+
+        Bug 23771: REGRESSION (r36016): JSObjectHasProperty freezes on global class without kJSClassAttributeNoAutomaticPrototype
+        <https://bugs.webkit.org/show_bug.cgi?id=23771>
+        <rdar://problem/6561016>
+
+        * API/tests/testapi.c:
+        (main): Add a test for this bug.
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::resetPrototype): Don't set the prototype of the
+        last object in the prototype chain to the object prototype when the
+        object prototype is already the last object in the prototype chain.
+
+2009-03-19  Timothy Hatcher  <timothy@apple.com>
+
+        <rdar://problem/6687342> -[WebView scheduleInRunLoop:forMode:] has no affect on timers
+
+        Reviewed by Darin Adler.
+
+        * wtf/Platform.h: Added HAVE_RUNLOOP_TIMER for PLATFORM(MAC).
+
+2009-03-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed <rdar://problem/6279213> Regular expression run-time complexity
+        limit too low for long inputs (21485)
+        
+        I raised PCRE's "matchLimit" (limit on backtracking) by an order of
+        magnitude. This fixes all the reported examples of timing out on legitimate
+        regular expression matches.
+        
+        In my testing on a Core Duo MacBook Pro, the longest you can get stuck
+        trying to match a string is still under 1s, so this seems like a safe change.
+        
+        I can think of a number of better solutions that are more complicated,
+        but this is a good improvement for now.
+
+        * pcre/pcre_exec.cpp:
+
+2009-03-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed <rdar://problem/6603562> REGRESSION (Safari 4): regular expression
+        pattern size limit lower than Safari 3.2, other browsers, breaks SAP (14873)
+        
+        Bumped the pattern size limit to 1MB, and standardized it between PCRE
+        and WREC. (Empirical testing says that we can easily compile a 1MB regular
+        expression without risking a hang. Other browsers support bigger regular
+        expressions, but also hang.)
+        
+        SunSpider reports no change.
+        
+        I started with a patch posted to Bugzilla by Erik Corry (erikcorry@google.com).
+        
+        * pcre/pcre_internal.h:
+        (put3ByteValue):
+        (get3ByteValue):
+        (put3ByteValueAndAdvance):
+        (putLinkValueAllowZero):
+        (getLinkValueAllowZero): Made PCRE's "LINK_SIZE" (the number of bytes
+        used to record jumps between bytecodes) 3, to accomodate larger potential
+        jumps. Bumped PCRE's "MAX_PATTERN_SIZE" to 1MB. (Technically, at this
+        LINK_SIZE, we can support even larger patterns, but we risk a hang during
+        compilation, and it's not clear that such large patterns are important
+        on the web.)
+
+        * wrec/WREC.cpp:
+        (JSC::WREC::Generator::compileRegExp): Match PCRE's maximum pattern size,
+        to avoid quirks between platforms.
+
+2009-03-18  Ada Chan  <adachan@apple.com>
+
+        Rolling out r41818 since it broke the windows build.
+        Error: ..\..\runtime\DatePrototype.cpp(30) : fatal error C1083: Cannot open include file: 'langinfo.h': No such file or directory
+
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+
+2009-03-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        <rdar://problem/6692138> REGRESSION (Safari 4): Incorrect function return value when using IE "try ... finally" memory leak work-around (24654)
+        <https://bugs.webkit.org/show_bug.cgi?id=24654>
+
+        If the return value for a function is in a local register we need
+        to copy it before executing any finalisers, otherwise it is possible
+        for the finaliser to clobber the result.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::hasFinaliser):
+        * parser/Nodes.cpp:
+        (JSC::ReturnNode::emitBytecode):
+
+2009-03-17  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Mark Rowe.
+        
+        Move BUILDING_ON_* defines into Platform.h to make them available to other ports.
+        Also tweak the defines so that they work with the default values set by 
+        AvailabilityMacros.h.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24630
+
+        * JavaScriptCorePrefix.h:
+        * wtf/Platform.h:
+
+2009-03-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Revert r41718 because it broke DumpRenderTree on Tiger.
+
+        * JavaScriptCorePrefix.h:
+        * wtf/Platform.h:
+
+2009-03-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Non-Apple Mac ports build fix. Move defines for the BUILDING_ON_ macros into
+        Platform.h so that they're defined for all ports building on Mac, and tweak
+        the definitions of those macros based on Mark Rowe's suggestions to accomodate
+        cases where the values may not be <= to the .0 release for that version.
+
+        * JavaScriptCorePrefix.h:
+        * wtf/Platform.h:
+
+2009-03-13  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Take advantage of the ability of recent versions of Xcode to easily switch the active
+        architecture.
+
+        * Configurations/DebugRelease.xcconfig:
+
+2009-03-13  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Prevent AllInOneFile.cpp and ProfileGenerator.cpp from rebuilding unnecessarily when
+        switching between building in Xcode and via build-webkit.
+
+        build-webkit passes FEATURE_DEFINES to xcodebuild, resulting in it being present in the
+        Derived Sources build settings.  When building in Xcode, this setting isn't present so
+        Xcode reruns the script build phases.  This results in a new version of TracingDtrace.h
+        being generated, and the files that include it being rebuilt.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:  Don't regenerate TracingDtrace.h if it is
+        already newer than the input file.
+
+2009-03-13  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Resolved name conflict with globally defined tzname in Symbian.
+        Replaced with different name instead of using namespace qualifier
+        (appeared to be less clumsy).
+
+        * runtime/DateMath.cpp:
+
+2009-03-12  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6548446> TCMalloc_SystemRelease should use madvise rather than re-mmaping span of pages
+
+        * wtf/FastMalloc.cpp:
+        (WTF::mergeDecommittedStates): If either of the spans has been released to the system, release the other
+        span as well so that the flag in the merged span is accurate.
+        * wtf/Platform.h:
+        * wtf/TCSystemAlloc.cpp: Track decommitted spans when using MADV_FREE_REUSABLE / MADV_FREE_REUSE.
+        (TCMalloc_SystemRelease): Use madvise with MADV_FREE_REUSABLE when it is available.
+        (TCMalloc_SystemCommit): Use madvise with MADV_FREE_REUSE when it is available.
+        * wtf/TCSystemAlloc.h:
+
+2009-03-12  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Include string.h for strlen usage.
+
+        * wtf/Threading.cpp:
+
+2009-03-12  David Kilzer  <ddkilzer@apple.com>
+
+        Add NO_RETURN attribute to runInteractive() when not using readline
+
+        Reviewed by Darin Adler.
+
+        * jsc.cpp:
+        (runInteractive): If the readline library is not used, this method
+        will never return, thus the NO_RETURN attribute is needed to prevent
+        a gcc warning.
+
+2009-03-12  Adam Roben  <aroben@apple.com>
+
+        Adopt setThreadNameInternal on Windows
+
+        Also changed a Windows-only assertion about thread name length to an
+        all-platform log message.
+
+        Reviewed by Adam Treat.
+
+        * wtf/Threading.cpp:
+        (WTF::createThread): Warn if the thread name is longer than 31
+        characters, as Visual Studio will truncate names longer than that
+        length.
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::setThreadNameInternal): Renamed from setThreadName and changed
+        to always operate on the current thread.
+        (WTF::initializeThreading): Changed to use setThreadNameInternal.
+        (WTF::createThreadInternal): Removed call to setThreadName. This is
+        now handled by threadEntryPoint and setThreadNameInternal.
+
+2009-03-11  David Kilzer  <ddkilzer@apple.com>
+
+        Clarify comments regarding order of FEATURE_DEFINES
+
+        Rubber-stamped by Mark Rowe.
+
+        * Configurations/JavaScriptCore.xcconfig: Added warning about
+        the consequences when FEATURE_DEFINES are not kept in sync.
+
+2009-03-11  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - WTF support for fixing <rdar://problem/3919124> Thai text selection
+          in Safari is incorrect
+
+        * wtf/unicode/icu/UnicodeIcu.h:
+        (WTF::Unicode::hasLineBreakingPropertyComplexContext): Added. Returns
+        whether the character has Unicode line breaking property value SA
+        ("Complex Context").
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        (WTF::Unicode::hasLineBreakingPropertyComplexContext): Added an
+        implementation that always returns false.
+
+2009-03-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Give threads names on platforms with pthread_setname_np.
+
+        * wtf/Threading.cpp:
+        (WTF::NewThreadContext::NewThreadContext): Initialize thread name.
+        (WTF::threadEntryPoint): Call setThreadNameInternal.
+        (WTF::createThread): Pass thread name.
+
+        * wtf/Threading.h: Added new comments, setThreadNameInternal.
+
+        * wtf/ThreadingGtk.cpp:
+        (WTF::setThreadNameInternal): Added. Empty.
+        * wtf/ThreadingNone.cpp:
+        (WTF::setThreadNameInternal): Added. Empty.
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::setThreadNameInternal): Call pthread_setname_np when available.
+        * wtf/ThreadingQt.cpp:
+        (WTF::setThreadNameInternal): Added. Empty.
+        * wtf/ThreadingWin.cpp:
+        (WTF::setThreadNameInternal): Added. Empty.
+
+2009-03-11  Adam Roben  <aroben@apple.com>
+
+        Change the Windows implementation of ThreadSpecific to use functions
+        instead of extern globals
+
+        This will make it easier to export ThreadSpecific from WebKit.
+
+        Reviewed by John Sullivan.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript): 
+        Touched this file to force ThreadSpecific.h to be copied into
+        $WebKitOutputDir.
+
+        * wtf/ThreadSpecific.h: Replaced g_tls_key_count with tlsKeyCount()
+        and g_tls_keys with tlsKeys().
+
+        (WTF::::ThreadSpecific):
+        (WTF::::~ThreadSpecific):
+        (WTF::::get):
+        (WTF::::set):
+        (WTF::::destroy):
+        Updated to use the new functions.
+
+        * wtf/ThreadSpecificWin.cpp:
+        (WTF::tlsKeyCount):
+        (WTF::tlsKeys):
+        Added.
+
+        (WTF::ThreadSpecificThreadExit): Changed to use the new functions.
+
+2009-03-10  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Geoff Garen.
+
+        Bug 24291: REGRESSION (r38635): Single line JavaScript comment prevents HTML button click handler execution
+        <https://bugs.webkit.org/show_bug.cgi?id=24291>
+        <rdar://problem/6663472>
+
+        Add an extra newline to the end of the body of the program text constructed
+        by the Function constructor for parsing. This allows single line comments to
+        be handled correctly by the parser.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+
+2009-03-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 24447: REGRESSION (r41508): Google Maps does not complete initialization
+        <rdar://problem/6657774>
+
+        r41508 actually exposed a pre-existing bug where we were not invalidating the result
+        register cache at jump targets.  This causes problems when condition loads occur in an
+        expression -- namely through the ?: and || operators.  This patch corrects these issues
+        by marking the target of all forward jumps as being a jump target, and then clears the
+        result register cache when ever it starts generating code for a targeted instruction.
+
+        I do not believe it is possible to cause this class of failure outside of a single
+        expression, and expressions only provide forward branches, so this should resolve this
+        entire class of bug.  That said i've included a test case that gets as close as possible
+        to hitting this bug with a back branch, to hopefully prevent anyone from introducing the
+        problem in future.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Label::isUsed):
+        (JSC::AbstractMacroAssembler::Label::used):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::JmpDst::JmpDst):
+        (JSC::X86Assembler::JmpDst::isUsed):
+        (JSC::X86Assembler::JmpDst::used):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2009-03-09  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 23175: String and UString should be able to share a UChar* buffer.
+        <https://bugs.webkit.org/show_bug.cgi?id=23175>
+
+        Add CrossThreadRefCounted.
+
+        * wtf/CrossThreadRefCounted.h: Added.
+        (WTF::CrossThreadRefCounted::create):
+        (WTF::CrossThreadRefCounted::isShared):
+        (WTF::CrossThreadRefCounted::dataAccessMustBeThreadSafe):
+        (WTF::CrossThreadRefCounted::mayBePassedToAnotherThread):
+        (WTF::CrossThreadRefCounted::CrossThreadRefCounted):
+        (WTF::CrossThreadRefCounted::~CrossThreadRefCounted):
+        (WTF::CrossThreadRefCounted::ref):
+        (WTF::CrossThreadRefCounted::deref):
+        (WTF::CrossThreadRefCounted::release):
+        (WTF::CrossThreadRefCounted::copy):
+        (WTF::CrossThreadRefCounted::threadSafeDeref):
+        * wtf/RefCounted.h:
+        * wtf/Threading.h:
+        (WTF::ThreadSafeSharedBase::ThreadSafeSharedBase):
+        (WTF::ThreadSafeSharedBase::derefBase):
+        (WTF::ThreadSafeShared::ThreadSafeShared):
+        (WTF::ThreadSafeShared::deref):
+
+2009-03-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24353
+        Allow to overrule default build options for Qt build.
+
+        * JavaScriptCore.pri: Allow to overrule ENABLE_JIT
+
+2009-03-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Build fix.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncConcat):
+
+2009-03-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 24268: RuntimeArray is not a fully implemented JSArray
+        <https://bugs.webkit.org/show_bug.cgi?id=24268>
+
+        Don't cast a type to JSArray, just because it reportsArray as a supertype
+        in the JS type system.  Doesn't appear feasible to create a testcase
+        unfortunately as setting up the failure conditions requires internal access 
+        to JSC not present in DRT.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncConcat):
+
+2009-03-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        When preforming an op_mov, preserve any existing register mapping.
+
+        ~0.5% progression on v8 tests x86-64.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2009-03-05  Simone Fiorentino  <simone.fiorentino@consulenti.fastweb.it>
+
+        Bug 24382: request to add SH4 platform
+
+        <https://bugs.webkit.org/show_bug.cgi?id=24382>
+
+        Reviewed by David Kilzer.
+
+        * wtf/Platform.h: Added support for SH4 platform.
+
+2009-03-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Writes of constant values to SF registers should be made with direct memory
+        writes where possible, rather than moving the value via a hardware register.
+
+        ~3% win on SunSpider tests on x86, ~1.5% win on v8 tests on x86-64.
+
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::storePtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movq_i32m):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2009-03-05  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        Sprinkle "static" around NumberConstructor.cpp in order to please the compiler.
+
+        * runtime/NumberConstructor.cpp:
+        (JSC::numberConstructorNaNValue):
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+
+2009-03-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6354858> FastMallocZone's enumeration code reports fragmented administration space
+
+        The handling of MALLOC_ADMIN_REGION_RANGE_TYPE in FastMalloc's zone was incorrect.  It was attempting
+        to record the memory containing and individual span as an administrative region, when all memory
+        allocated via MetaDataAlloc should in fact be recorded.  This was causing memory regions allocated
+        via MetaDataAlloc to appear as "VM_ALLOCATE ?" in vmmap output.  They are now correctly reported as
+        "MALLOC_OTHER" regions associated with the JavaScriptCore FastMalloc zone.
+
+        Memory is allocated via MetaDataAlloc from two locations: PageHeapAllocator, and TCMalloc_PageMap{2,3}.
+        These two cases are handled differently.
+
+        PageHeapAllocator is extended to keep a linked list of memory regions that it has allocated.  The
+        first object in an allocated region contains the link to the previously allocated region. To record
+        the administrative regions of a PageHeapAllocator we can simply walk the linked list and record
+        each allocated region we encounter.
+
+        TCMalloc_PageMaps allocate memory via MetaDataAlloc to store each level of the radix tree.  To record
+        the administrative regions of a TCMalloc_PageMap we walk the tree and record the storage used for nodes
+        at each position rather than the nodes themselves.
+
+        A small performance improvement is achieved by coalescing adjacent memory regions inside the PageMapMemoryUsageRecorder
+        so that fewer calls in to the range recorder are necessary.  We further reduce the number of calls to the
+        range recorder by aggregating the in-use ranges of a given memory region into a local buffer before recording
+        them with a single call.  A similar approach is also used by AdminRegionRecorder.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::PageHeapAllocator::Init):
+        (WTF::PageHeapAllocator::New):
+        (WTF::PageHeapAllocator::recordAdministrativeRegions):
+        (WTF::TCMallocStats::FreeObjectFinder::isFreeObject):
+        (WTF::TCMallocStats::PageMapMemoryUsageRecorder::~PageMapMemoryUsageRecorder):
+        (WTF::TCMallocStats::PageMapMemoryUsageRecorder::recordPendingRegions):
+        (WTF::TCMallocStats::PageMapMemoryUsageRecorder::visit):
+        (WTF::TCMallocStats::AdminRegionRecorder::AdminRegionRecorder):
+        (WTF::TCMallocStats::AdminRegionRecorder::recordRegion):
+        (WTF::TCMallocStats::AdminRegionRecorder::visit):
+        (WTF::TCMallocStats::AdminRegionRecorder::recordPendingRegions):
+        (WTF::TCMallocStats::AdminRegionRecorder::~AdminRegionRecorder):
+        (WTF::TCMallocStats::FastMallocZone::enumerate):
+        (WTF::TCMallocStats::FastMallocZone::FastMallocZone):
+        (WTF::TCMallocStats::FastMallocZone::init):
+        * wtf/TCPageMap.h:
+        (TCMalloc_PageMap2::visitValues):
+        (TCMalloc_PageMap2::visitAllocations):
+        (TCMalloc_PageMap3::visitValues):
+        (TCMalloc_PageMap3::visitAllocations):
+
+2009-03-04  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24359
+        Repaint throttling mechanism
+        
+        Set ENABLE_REPAINT_THROTTLING to 0 by default.
+
+        * wtf/Platform.h:
+
+2009-03-03  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6581203> WebCore and WebKit should install the same set of headers during installhdrs phase as build phase
+
+        Reviewed by Mark Rowe.
+
+        * Configurations/Base.xcconfig: Defined REAL_PLATFORM_NAME based
+        on PLATFORM_NAME to work around the missing definition on Tiger.
+        Updated HAVE_DTRACE to use REAL_PLATFORM_NAME.
+
+2009-03-03  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6639110> console.profile() doesn't work without a title
+
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::startProfiling): assert if there is not title to ensure
+        we don't start profiling without one.
+
+2009-03-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Enable Geolocation (except on Tiger and Leopard).
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2009-03-01  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6635688> Move HAVE_DTRACE check to Base.xcconfig
+
+        Reviewed by Mark Rowe.
+
+        * Configurations/Base.xcconfig: Set HAVE_DTRACE Xcode variable
+        based on PLATFORM_NAME and MAC_OS_X_VERSION_MAJOR.  Also define
+        it as a preprocessor macro by modifying
+        GCC_PREPROCESSOR_DEFINITIONS.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Changed "Generate
+        DTrace header" script phase to check for HAVE_DTRACE instead of
+        MACOSX_DEPLOYMENT_TARGET.
+        * wtf/Platform.h: Removed definition of HAVE_DTRACE macro since
+        it's defined in Base.xcconfig now.
+
+2009-03-01  Horia Olaru  <olaru@adobe.com>
+
+        By looking in grammar.y there are only a few types of statement nodes
+        on which the debugger should stop. 
+
+        Removed isBlock and isLoop virtual calls. No need to emit debug hooks in
+        the "statementListEmitCode" method as long as the necessary hooks can be
+        added in each "emitCode".
+
+        https://bugs.webkit.org/show_bug.cgi?id=21073
+
+        Reviewed by Kevin McCullough.
+
+        * parser/Nodes.cpp:
+        (JSC::ConstStatementNode::emitBytecode):
+        (JSC::statementListEmitCode):
+        (JSC::EmptyStatementNode::emitBytecode):
+        (JSC::ExprStatementNode::emitBytecode):
+        (JSC::VarStatementNode::emitBytecode):
+        (JSC::IfNode::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        * parser/Nodes.h:
+
+2009-02-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix bug #23614.  Switches on double precision values were incorrectly
+        truncating the scrutinee value.  E.g.:
+
+            switch (1.1) { case 1: print("FAIL"); }
+
+        Was resulting in FAIL.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::cti_op_switch_imm):
+
+2009-02-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Integer Immediate representation need not be canonical in x86 JIT code.
+        On x86-64 we already have loosened the requirement that the int immediate
+        representation in canonical, we should bring x86 into line.
+
+        This patch is a minor (~0.5%) improvement on sunspider & v8-tests, and
+        should reduce memory footoprint (reduces JIT code size).
+
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        (JSC::JIT::emitJumpIfImmediateNumber):
+        (JSC::JIT::emitJumpIfNotImmediateNumber):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::JIT::compileBinaryArithOp):
+
+2009-02-26  Carol Szabo  <carol.szabo@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24099
+        ARM Compiler Warnings in pcre_exec.cpp
+
+        * pcre/pcre_exec.cpp:
+        (match):
+
+2009-02-25  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 24086: Regression (r40993): WebKit crashes after logging in to lists.zenbe
+        <https://bugs.webkit.org/show_bug.cgi?id=24086>
+        <rdar://problem/6625111>
+
+        The numeric sort optimization in r40993 generated bytecode for a function
+        without generating JIT code. This breaks an assumption in some parts of
+        the JIT's function calling logic that the presence of a CodeBlock implies
+        the existence of JIT code.
+
+        In order to fix this, we simply generate JIT code whenever we check whether
+        a function is a numeric sort function. This only incurs an additional cost
+        in the case when the function is a numeric sort function, in which case it
+        is not expensive to generate JIT code for it.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::isNumericCompareFunction):
+
+2009-02-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed <rdar://problem/6611174> REGRESSION (r36701): Unable to select
+        messages on hotmail (24052)
+        
+        The bug was that for-in enumeration used a cached prototype chain without
+        validating that it was up-to-date.
+        
+        This led me to refactor prototype chain caching so it was easier to work
+        with and harder to get wrong.
+        
+        After a bit of inlining, this patch is performance-neutral on SunSpider
+        and the v8 benchmarks.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::tryCachePutByID):
+        (JSC::JITStubs::tryCacheGetByID):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list): Use the new refactored goodness. See
+        lines beginning with "-" and smile.
+
+        * runtime/JSGlobalObject.h:
+        (JSC::Structure::prototypeForLookup): A shout out to const.
+
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::next): We can use a pointer comparison to
+        see if our cached structure chain is equal to the object's structure chain,
+        since in the case of a cache hit, we share references to the same structure
+        chain.
+
+        * runtime/Operations.h:
+        (JSC::countPrototypeChainEntriesAndCheckForProxies): Use the new refactored
+        goodness.
+
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArray::PropertyNameArray):
+        (JSC::PropertyNameArray::setShouldCache):
+        (JSC::PropertyNameArray::shouldCache): Renamed "cacheable" to "shouldCache"
+        to communicate that the client is specifying a recommendation, not a
+        capability.
+        
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure): No need to initialize a RefPtr.
+        (JSC::Structure::getEnumerablePropertyNames): Moved some code into helper
+        functions.
+
+        (JSC::Structure::prototypeChain): New centralized accessor for a prototype
+        chain. Revalidates on every access, since the objects in the prototype
+        chain may have mutated.
+
+        (JSC::Structure::isValid): Helper function for revalidating a cached
+        prototype chain.
+
+        (JSC::Structure::getEnumerableNamesFromPropertyTable):
+        (JSC::Structure::getEnumerableNamesFromClassInfoTable): Factored out of
+        getEnumerablePropertyNames.
+
+        * runtime/Structure.h:
+
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain):
+        * runtime/StructureChain.h:
+        (JSC::StructureChain::create): No need for structureChainsAreEqual, since
+        we use pointer equality now. Refactored StructureChain to make a little
+        more sense and eliminate special cases for null prototypes.
+
+2009-02-25  Steve Falkenburg  <sfalken@apple.com>
+
+        Use timeBeginPeriod to enable timing resolution greater than 16ms in command line jsc for Windows.
+        Allows more accurate reporting of benchmark times via command line jsc.exe. Doesn't affect WebKit's use of JavaScriptCore.
+        
+        Reviewed by Adam Roben.
+
+        * jsc.cpp:
+        (main):
+
+2009-02-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix?
+
+        * GNUmakefile.am:
+
+2009-02-24  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6259220> Rename AVAILABLE_AFTER_WEBKIT_VERSION_3_1 (etc.) to match the other macros
+
+        * API/JSBasePrivate.h:
+        * API/JSContextRef.h:
+        * API/JSObjectRef.h:
+        * API/WebKitAvailability.h:
+
+2009-02-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Next step in splitting JIT functionality out of the Interpreter class:
+        Moved vptr storage from Interpreter to JSGlobalData, so it could be shared
+        between Interpreter and JITStubs, and moved the *Trampoline JIT stubs
+        into the JITStubs class. Also added a VPtrSet class to encapsulate vptr
+        hacks during JSGlobalData initialization.
+        
+        SunSpider says 0.4% faster. Meh.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::JITStubs):
+        (JSC::JITStubs::tryCacheGetByID):
+        (JSC::JITStubs::cti_vm_dontLazyLinkCall):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_put_by_val):
+        (JSC::JITStubs::cti_op_put_by_val_array):
+        (JSC::JITStubs::cti_op_put_by_val_byte_array):
+        (JSC::JITStubs::cti_op_is_string):
+        * jit/JITStubs.h:
+        (JSC::JITStubs::ctiArrayLengthTrampoline):
+        (JSC::JITStubs::ctiStringLengthTrampoline):
+        (JSC::JITStubs::ctiVirtualCallPreLink):
+        (JSC::JITStubs::ctiVirtualCallLink):
+        (JSC::JITStubs::ctiVirtualCall):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncApply):
+        * runtime/JSArray.h:
+        (JSC::isJSArray):
+        * runtime/JSByteArray.h:
+        (JSC::asByteArray):
+        (JSC::isJSByteArray):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::VPtrSet::VPtrSet):
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::create):
+        (JSC::JSGlobalData::sharedInstance):
+        * runtime/JSGlobalData.h:
+        * runtime/JSString.h:
+        (JSC::isJSString):
+        * runtime/Operations.h:
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        * wrec/WREC.cpp:
+        (JSC::WREC::Generator::compileRegExp):
+
+2009-02-23  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 23787: Allow JIT to generate SSE2 code if using GCC
+        <https://bugs.webkit.org/show_bug.cgi?id=23787>
+
+        GCC version of the cpuid check.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::isSSE2Present): previous assembly code fixed.
+
+2009-02-23  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 24047: Need to simplify nested if's in WorkerRunLoop::runInMode
+        <https://bugs.webkit.org/show_bug.cgi?id=24047>
+
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueue::infiniteTime):
+        Allows for one to call waitForMessageFilteredWithTimeout and wait forever.
+
+        (WTF::MessageQueue::alwaysTruePredicate):
+        (WTF::MessageQueue::waitForMessage):
+        Made waitForMessage call waitForMessageFilteredWithTimeout, so that there is less
+        duplicate code.
+
+        (WTF::MessageQueue::waitForMessageFilteredWithTimeout):
+
+        * wtf/ThreadingQt.cpp:
+        (WTF::ThreadCondition::timedWait):
+        * wtf/ThreadingWin.cpp:
+        (WTF::ThreadCondition::timedWait):
+        Made these two implementations consistent with the pthread and gtk implementations.
+        Currently, the time calculations would overflow when passed large values.
+
+2009-02-23  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24096
+        PLATFORM(MAC)->PLATFORM(CF) since we want to use the CF functions in Chrome on OS X.
+
+        * wtf/CurrentTime.cpp:
+
+2009-02-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix?
+
+        * GNUmakefile.am:
+
+2009-02-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * GNUmakefile.am:
+
+2009-02-22  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Next step in splitting JIT functionality out of the Interpreter class:
+        Created a JITStubs class and renamed Interpreter::cti_* to JITStubs::cti_*.
+        
+        Also, moved timeout checking into its own class, located in JSGlobalData,
+        so both the Interpreter and the JIT could have access to it.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * interpreter/CallFrame.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * interpreter/Register.h:
+        * jit/JIT.cpp:
+        (JSC::):
+        (JSC::JIT::emitTimeoutCheck):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArithSlow_op_lshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_bitand):
+        (JSC::JIT::compileFastArithSlow_op_mod):
+        (JSC::JIT::compileFastArith_op_mod):
+        (JSC::JIT::compileFastArithSlow_op_post_inc):
+        (JSC::JIT::compileFastArithSlow_op_post_dec):
+        (JSC::JIT::compileFastArithSlow_op_pre_inc):
+        (JSC::JIT::compileFastArithSlow_op_pre_dec):
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        (JSC::JIT::compileFastArith_op_sub):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::compileFastArithSlow_op_add):
+        (JSC::JIT::compileFastArithSlow_op_mul):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdSlowCase):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        * jit/JITStubs.cpp:
+        (JSC::JITStubs::tryCachePutByID):
+        (JSC::JITStubs::tryCacheGetByID):
+        (JSC::JITStubs::cti_op_convert_this):
+        (JSC::JITStubs::cti_op_end):
+        (JSC::JITStubs::cti_op_add):
+        (JSC::JITStubs::cti_op_pre_inc):
+        (JSC::JITStubs::cti_timeout_check):
+        (JSC::JITStubs::cti_register_file_check):
+        (JSC::JITStubs::cti_op_loop_if_less):
+        (JSC::JITStubs::cti_op_loop_if_lesseq):
+        (JSC::JITStubs::cti_op_new_object):
+        (JSC::JITStubs::cti_op_put_by_id_generic):
+        (JSC::JITStubs::cti_op_get_by_id_generic):
+        (JSC::JITStubs::cti_op_put_by_id):
+        (JSC::JITStubs::cti_op_put_by_id_second):
+        (JSC::JITStubs::cti_op_put_by_id_fail):
+        (JSC::JITStubs::cti_op_get_by_id):
+        (JSC::JITStubs::cti_op_get_by_id_second):
+        (JSC::JITStubs::cti_op_get_by_id_self_fail):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list):
+        (JSC::JITStubs::cti_op_get_by_id_proto_list_full):
+        (JSC::JITStubs::cti_op_get_by_id_proto_fail):
+        (JSC::JITStubs::cti_op_get_by_id_array_fail):
+        (JSC::JITStubs::cti_op_get_by_id_string_fail):
+        (JSC::JITStubs::cti_op_instanceof):
+        (JSC::JITStubs::cti_op_del_by_id):
+        (JSC::JITStubs::cti_op_mul):
+        (JSC::JITStubs::cti_op_new_func):
+        (JSC::JITStubs::cti_op_call_JSFunction):
+        (JSC::JITStubs::cti_op_call_arityCheck):
+        (JSC::JITStubs::cti_vm_dontLazyLinkCall):
+        (JSC::JITStubs::cti_vm_lazyLinkCall):
+        (JSC::JITStubs::cti_op_push_activation):
+        (JSC::JITStubs::cti_op_call_NotJSFunction):
+        (JSC::JITStubs::cti_op_create_arguments):
+        (JSC::JITStubs::cti_op_create_arguments_no_params):
+        (JSC::JITStubs::cti_op_tear_off_activation):
+        (JSC::JITStubs::cti_op_tear_off_arguments):
+        (JSC::JITStubs::cti_op_profile_will_call):
+        (JSC::JITStubs::cti_op_profile_did_call):
+        (JSC::JITStubs::cti_op_ret_scopeChain):
+        (JSC::JITStubs::cti_op_new_array):
+        (JSC::JITStubs::cti_op_resolve):
+        (JSC::JITStubs::cti_op_construct_JSConstruct):
+        (JSC::JITStubs::cti_op_construct_NotJSConstruct):
+        (JSC::JITStubs::cti_op_get_by_val):
+        (JSC::JITStubs::cti_op_get_by_val_byte_array):
+        (JSC::JITStubs::cti_op_resolve_func):
+        (JSC::JITStubs::cti_op_sub):
+        (JSC::JITStubs::cti_op_put_by_val):
+        (JSC::JITStubs::cti_op_put_by_val_array):
+        (JSC::JITStubs::cti_op_put_by_val_byte_array):
+        (JSC::JITStubs::cti_op_lesseq):
+        (JSC::JITStubs::cti_op_loop_if_true):
+        (JSC::JITStubs::cti_op_negate):
+        (JSC::JITStubs::cti_op_resolve_base):
+        (JSC::JITStubs::cti_op_resolve_skip):
+        (JSC::JITStubs::cti_op_resolve_global):
+        (JSC::JITStubs::cti_op_div):
+        (JSC::JITStubs::cti_op_pre_dec):
+        (JSC::JITStubs::cti_op_jless):
+        (JSC::JITStubs::cti_op_not):
+        (JSC::JITStubs::cti_op_jtrue):
+        (JSC::JITStubs::cti_op_post_inc):
+        (JSC::JITStubs::cti_op_eq):
+        (JSC::JITStubs::cti_op_lshift):
+        (JSC::JITStubs::cti_op_bitand):
+        (JSC::JITStubs::cti_op_rshift):
+        (JSC::JITStubs::cti_op_bitnot):
+        (JSC::JITStubs::cti_op_resolve_with_base):
+        (JSC::JITStubs::cti_op_new_func_exp):
+        (JSC::JITStubs::cti_op_mod):
+        (JSC::JITStubs::cti_op_less):
+        (JSC::JITStubs::cti_op_neq):
+        (JSC::JITStubs::cti_op_post_dec):
+        (JSC::JITStubs::cti_op_urshift):
+        (JSC::JITStubs::cti_op_bitxor):
+        (JSC::JITStubs::cti_op_new_regexp):
+        (JSC::JITStubs::cti_op_bitor):
+        (JSC::JITStubs::cti_op_call_eval):
+        (JSC::JITStubs::cti_op_throw):
+        (JSC::JITStubs::cti_op_get_pnames):
+        (JSC::JITStubs::cti_op_next_pname):
+        (JSC::JITStubs::cti_op_push_scope):
+        (JSC::JITStubs::cti_op_pop_scope):
+        (JSC::JITStubs::cti_op_typeof):
+        (JSC::JITStubs::cti_op_is_undefined):
+        (JSC::JITStubs::cti_op_is_boolean):
+        (JSC::JITStubs::cti_op_is_number):
+        (JSC::JITStubs::cti_op_is_string):
+        (JSC::JITStubs::cti_op_is_object):
+        (JSC::JITStubs::cti_op_is_function):
+        (JSC::JITStubs::cti_op_stricteq):
+        (JSC::JITStubs::cti_op_nstricteq):
+        (JSC::JITStubs::cti_op_to_jsnumber):
+        (JSC::JITStubs::cti_op_in):
+        (JSC::JITStubs::cti_op_push_new_scope):
+        (JSC::JITStubs::cti_op_jmp_scopes):
+        (JSC::JITStubs::cti_op_put_by_index):
+        (JSC::JITStubs::cti_op_switch_imm):
+        (JSC::JITStubs::cti_op_switch_char):
+        (JSC::JITStubs::cti_op_switch_string):
+        (JSC::JITStubs::cti_op_del_by_val):
+        (JSC::JITStubs::cti_op_put_getter):
+        (JSC::JITStubs::cti_op_put_setter):
+        (JSC::JITStubs::cti_op_new_error):
+        (JSC::JITStubs::cti_op_debug):
+        (JSC::JITStubs::cti_vm_throw):
+        * jit/JITStubs.h:
+        (JSC::):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        * runtime/TimeoutChecker.cpp: Copied from interpreter/Interpreter.cpp.
+        (JSC::TimeoutChecker::TimeoutChecker):
+        (JSC::TimeoutChecker::reset):
+        (JSC::TimeoutChecker::didTimeOut):
+        * runtime/TimeoutChecker.h: Copied from interpreter/Interpreter.h.
+        (JSC::TimeoutChecker::setTimeoutInterval):
+        (JSC::TimeoutChecker::ticksUntilNextCheck):
+        (JSC::TimeoutChecker::start):
+        (JSC::TimeoutChecker::stop):
+
+2009-02-20  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed build fix after r41100.
+
+        * GNUmakefile.am:
+
+2009-02-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6606660> 2==null returns true in 64bit jit
+
+        Code for op_eq_null and op_neq_null was incorrectly performing
+        a 32bit compare, which truncated the type tag from an integer
+        immediate, leading to incorrect behaviour.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::setPtr):
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::setPtr):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2009-02-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+        
+        First step in splitting JIT functionality out of the Interpreter class:
+        Created JITStubs.h/.cpp, and moved Interpreter::cti_* into JITStubs.cpp.
+        
+        Functions that the Interpreter and JITStubs share moved to Operations.h/.cpp.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::checkTimeout):
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * jit/JITStubs.cpp: Copied from interpreter/Interpreter.cpp.
+        (JSC::Interpreter::cti_op_resolve_base):
+        * jit/JITStubs.h: Copied from interpreter/Interpreter.h.
+        * runtime/Operations.cpp:
+        (JSC::jsAddSlowCase):
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        (JSC::jsIsFunctionType):
+        * runtime/Operations.h:
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAdd):
+        (JSC::cachePrototypeChain):
+        (JSC::countPrototypeChainEntriesAndCheckForProxies):
+        (JSC::resolveBase):
+
+2009-02-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for x86-64. Where the JavaScriptCore text segment lies outside
+        a 2gb range of the heap containing JIT generated code, callbacks
+        from JIT code to the stub functions in Interpreter will be incorrectly
+        linked.
+
+        No performance impact on Sunspider, 1% regression on v8-tests,
+        due to a 3% regression on richards.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::Call::Call):
+        (JSC::AbstractMacroAssembler::Jump::link):
+        (JSC::AbstractMacroAssembler::Jump::linkTo):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::relink):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToFunction):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::AbstractMacroAssembler::PatchBuffer::linkTailRecursive):
+        (JSC::AbstractMacroAssembler::differenceBetween):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::tailRecursiveCall):
+        (JSC::MacroAssembler::makeTailRecursiveCall):
+        * assembler/MacroAssemblerX86.h:
+        (JSC::MacroAssemblerX86::call):
+        * assembler/MacroAssemblerX86Common.h:
+        * assembler/MacroAssemblerX86_64.h:
+        (JSC::MacroAssemblerX86_64::call):
+        (JSC::MacroAssemblerX86_64::moveWithPatch):
+        (JSC::MacroAssemblerX86_64::branchPtrWithPatch):
+        (JSC::MacroAssemblerX86_64::storePtrWithPatch):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::jmp_r):
+        (JSC::X86Assembler::linkJump):
+        (JSC::X86Assembler::patchJump):
+        (JSC::X86Assembler::patchCall):
+        (JSC::X86Assembler::linkCall):
+        (JSC::X86Assembler::patchAddress):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCTICachePutByID):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::JIT::compileBinaryArithOp):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompilePutByIdReplace):
+
+2009-02-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Simplified .call and .apply in preparation for optimizing them. Also,
+        a little cleanup.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall): No need to do any specific conversion on
+        'this' -- op_convert_this will do it if necessary.
+
+        * runtime/JSImmediate.cpp:
+        (JSC::JSImmediate::toThisObject): Slightly relaxed the rules on
+        toThisObject to allow for 'undefined', which can be passed through
+        .call and .apply.
+
+2009-02-19  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23976: MessageQueue needs a way to wait for a message that satisfies an arbitrary criteria.
+        <https://bugs.webkit.org/show_bug.cgi?id=23976>
+
+        * wtf/Deque.h:
+        (WTF::Deque<T>::findIf):
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueue<T>::waitForMessageFiltered):
+
+2009-02-18  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23974: Deque::Remove would be a useful method.
+        <https://bugs.webkit.org/show_bug.cgi?id=23974>
+
+        Add Deque::remove and DequeIteratorBase<T>::operator=.
+
+        Why was operator= added? Every concrete iterator (DequeIterator..DequeConstReverseIterator)
+        was calling DequeIteratorBase::assign(), which called Base::operator=(). Base::operator=()
+        was not implemented. This went unnoticed because the iterator copy code has been unused.
+
+        * wtf/Deque.h:
+        (WTF::Deque<T>::remove):
+        (WTF::DequeIteratorBase<T>::removeFromIteratorsList):
+        (WTF::DequeIteratorBase<T>::operator=):
+        (WTF::DequeIteratorBase<T>::~DequeIteratorBase):
+
+2009-02-18  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Fix symbols.filter location, and add other missing files to the
+        autotools build, so that make dist works.
+
+        * GNUmakefile.am:
+
+2009-02-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed failure in js1_5/Regress/regress-168347.js, as seen on the Oliver
+        bot.
+        
+        Technically, both behaviors are OK, but we might as well keep this test
+        passing.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::insertSemicolonIfNeeded): No need to add a trailing semicolon
+        after a trailing '}', since '}' ends a block, indicating the end of a
+        statement.
+
+2009-02-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * runtime/FunctionPrototype.cpp:
+
+2009-02-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Add assertion to guard against oversized pc relative calls.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::link):
+
+2009-02-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed <rdar://problem/6595040> REGRESSION: http://www.amnestyusa.org/
+        fails to load.
+        
+        amnestyusa.org uses the Optimist JavaScript library, which adds event
+        listeners by concatenating string-ified functions. This is only sure to
+        be syntactically valid if the string-ified functions end in semicolons.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::isWhiteSpace):
+        * parser/Lexer.h:
+        (JSC::Lexer::isWhiteSpace):
+        (JSC::Lexer::isLineTerminator): Added some helper functions for examining
+        whitespace.
+
+        * runtime/FunctionPrototype.cpp:
+        (JSC::appendSemicolonIfNeeded):
+        (JSC::functionProtoFuncToString): When string-ifying a function, insert
+        a semicolon in the last non-whitespace position, if one doesn't already exist.
+
+2009-02-16  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Roll out r41022 as it breaks qt and gtk builds
+
+        * jit/JITArithmetic.cpp:
+        (JSC::isSSE2Present):
+
+2009-02-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix for <rdar://problem/6468156>
+        REGRESSION (r36779): Adding link, images, flash in TinyMCE blocks entire page (21382)
+
+        No performance regression.
+
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::fillArgList): Add codepath for when the "length" property has been
+        overridden.
+
+2009-02-16  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::):
+        (WTF::TCMallocStats::FastMallocZone::FastMallocZone):
+
+2009-02-16  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 23787: Allow JIT to generate SSE2 code if using GCC
+        <https://bugs.webkit.org/show_bug.cgi?id=23787>
+
+        GCC version of the cpuid check.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::isSSE2Present): GCC assembly code added.
+        6.6% progression on x86 Linux with JIT and WREC on SunSpider if using SSE2 capable machine.
+
+2009-02-13  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23960
+        Crash Fix.
+
+        Don't depend on 'initializeThreading()' to come before a call to 'isMainThread()'
+        as QtWebKit only calls 'initializeThreading()' during QWebPage construction.
+
+        A client app may well make a call to QWebSettings::iconForUrl() for instance
+        before creating a QWebPage and that call to QWebSettings triggers an
+        ASSERT(isMainThread()) deep within WebCore.
+
+        * wtf/ThreadingQt.cpp:
+        (WTF::isMainThread):
+
+2009-02-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Some data in the instruction stream is potentially uninitialized - fix this.
+
+        Change the OperandTypes constructor so that uninitialized memory in the int
+        is zeroed, and modify the Instruction constructor taking an Opcode so that
+        if !HAVE(COMPUTED_GOTO) (i.e. when Opcode is an enum, and is potentially only
+        a byte) it zeros the Instruction first before writing the opcode.
+
+        * bytecode/Instruction.h:
+        (JSC::Instruction::Instruction):
+        * parser/ResultType.h:
+        (JSC::OperandTypes::OperandTypes):
+
+2009-02-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix for non_JIT platforms.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setIsNumericCompareFunction):
+        (JSC::CodeBlock::isNumericCompareFunction):
+
+2009-02-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed <rdar://problem/6584057> Optimize sort by JS numeric comparison
+        function not to run the comparison function
+        
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setIsNumericCompareFunction):
+        (JSC::CodeBlock::isNumericCompareFunction): Added the ability to track
+        whether a CodeBlock performs a sort-like numeric comparison.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate): Set the isNumericCompareFunction bit
+        after compiling.
+
+        * parser/Nodes.cpp:
+        (JSC::FunctionBodyNode::emitBytecode): Fixed a bug that caused us to
+        codegen an extra return at the end of all functions (eek!), since this
+        made it harder / weirder to detect the numeric comparison pattern in
+        bytecode.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncSort): Use the isNumericCompareFunction bit to do
+        a faster sort if we can.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::extractFunctionBody):
+        (JSC::constructFunction):
+        * runtime/FunctionConstructor.h: Renamed and exported extractFunctionBody for
+        use in initializing lazyNumericCompareFunction.
+
+        * runtime/JSArray.cpp:
+        (JSC::compareNumbersForQSort):
+        (JSC::compareByStringPairForQSort):
+        (JSC::JSArray::sortNumeric):
+        (JSC::JSArray::sort):
+        * runtime/JSArray.h: Added a fast numeric sort. Renamed ArrayQSortPair
+        to be more specific since we do different kinds of qsort now.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::numericCompareFunction):
+        (JSC::JSGlobalData::ClientData::~ClientData):
+        * runtime/JSGlobalData.h: Added helper data for computing the
+        isNumericCompareFunction bit.
+
+2009-02-13  Darin Adler  <darin@apple.com>
+
+        * Configurations/JavaScriptCore.xcconfig: Undo accidental commit of this file.
+
+2009-02-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt and Alexey Proskuryakov.
+
+        Speed up a couple string functions.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncIndexOf): Added a fast path for cases where the second
+        argument is either missing or an integer.
+        (JSC::stringProtoFuncBig): Use jsNontrivialString since the string is guaranteed
+        to be 2 or more characters long.
+        (JSC::stringProtoFuncSmall): Ditto.
+        (JSC::stringProtoFuncBlink): Ditto.
+        (JSC::stringProtoFuncBold): Ditto.
+        (JSC::stringProtoFuncItalics): Ditto.
+        (JSC::stringProtoFuncStrike): Ditto.
+        (JSC::stringProtoFuncSub): Ditto.
+        (JSC::stringProtoFuncSup): Ditto.
+        (JSC::stringProtoFuncFontcolor): Ditto.
+        (JSC::stringProtoFuncFontsize): Make the fast path Sam recently added even faster
+        by avoiding all but the minimum memory allocation.
+        (JSC::stringProtoFuncAnchor): Use jsNontrivialString.
+        (JSC::stringProtoFuncLink): Added a fast path.
+
+        * runtime/UString.cpp:
+        (JSC::UString::find): Added a fast path for single-character search strings.
+
+2009-02-13  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 23926: Race condition in callOnMainThreadAndWait
+        <https://bugs.webkit.org/show_bug.cgi?id=23926>
+
+        * wtf/MainThread.cpp:
+        Removed callOnMainThreadAndWait since it isn't used.
+
+2009-02-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Math.random is really slow on windows.
+
+        Math.random calls WTF::randomNumber which is implemented as
+        the secure rand_s on windows.  Unfortunately rand_s is an order
+        of magnitude slower than arc4random.  For this reason I've
+        added "weakRandomNumber" for use by JavaScript's Math Object.
+        In the long term we should look at using our own secure PRNG
+        in place of the system, but this will do for now.
+
+        30% win on SunSpider on Windows, resolving most of the remaining
+        disparity vs. Mac.
+
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        (JSC::mathProtoFuncRandom):
+        * wtf/RandomNumber.cpp:
+        (WTF::weakRandomNumber):
+        (WTF::randomNumber):
+        * wtf/RandomNumber.h:
+        * wtf/RandomNumberSeed.h:
+        (WTF::initializeWeakRandomNumberGenerator):
+
+2009-02-12  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build for other platforms.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+
+2009-02-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove (/reduce) use of hard-wired register names from the JIT.
+        Currently there is no abstraction of registers used in the JIT,
+        which has a number of negative consequences.  Hard-wiring x86
+        register names makes the JIT less portable to other platforms,
+        and prevents us from performing dynamic register allocation to
+        attempt to maintain more temporary values in machine registers.
+        (The latter will be more important on x86-64, where we have more
+        registers to make use of).
+
+        Also, remove MacroAssembler::mod32.  This was not providing a
+        useful abstraction, and was not in keeping with the rest of the
+        MacroAssembler interface, in having specific register requirements.
+
+        * assembler/MacroAssemblerX86Common.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emitSlowScriptCheck):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_lshift):
+        (JSC::JIT::compileFastArithSlow_op_lshift):
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+        (JSC::JIT::compileFastArith_op_bitand):
+        (JSC::JIT::compileFastArithSlow_op_bitand):
+        (JSC::JIT::compileFastArith_op_mod):
+        (JSC::JIT::compileFastArithSlow_op_mod):
+        (JSC::JIT::compileFastArith_op_post_inc):
+        (JSC::JIT::compileFastArithSlow_op_post_inc):
+        (JSC::JIT::compileFastArith_op_post_dec):
+        (JSC::JIT::compileFastArithSlow_op_post_dec):
+        (JSC::JIT::compileFastArith_op_pre_inc):
+        (JSC::JIT::compileFastArithSlow_op_pre_inc):
+        (JSC::JIT::compileFastArith_op_pre_dec):
+        (JSC::JIT::compileFastArithSlow_op_pre_dec):
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        (JSC::JIT::compileFastArith_op_sub):
+        (JSC::JIT::compileBinaryArithOp):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpCallEvalSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetVirtualRegister):
+        (JSC::JIT::emitPutVirtualRegister):
+        (JSC::JIT::emitNakedCall):
+        (JSC::JIT::restoreArgumentReference):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdSlowCase):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+
+2009-02-12  Horia Olaru  <olaru@adobe.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23400
+
+        When throwing an exception within an eval argument string, the dst parameter was
+        modified in the functions below and the return value for eval was altered. Changed
+        the emitNode call in JSC::ThrowNode::emitBytecode to use a temporary register
+        to store its results instead of dst. The JSC::FunctionCallResolveNode::emitBytecode
+        would load the function within the dst registry, also altering the result returned
+        by eval. Replaced it with another temporary.
+
+        * parser/Nodes.cpp:
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+
+2009-02-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Speed up String.prototype.fontsize.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncFontsize): Specialize for defined/commonly used values.
+
+2009-02-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Correctness fix.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber): Divide by the maximum representable value, which
+        is different on each platform now, to get values between 0 and 1.
+
+2009-02-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+
+2009-02-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed <rdar://problem/6582048>.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber): Make only one call to the random number generator
+        on platforms where the generator is cryptographically secure. The value
+        of randomness over and above cryptographically secure randomness is not
+        clear, and it caused some performance problems.
+
+2009-02-12  Adam Roben  <aroben@apple.com>
+
+        Fix lots of Perl warnings when building JavaScriptCoreGenerated on
+        Windows
+
+        Reviewed by John Sullivan.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/build-generated-files.sh:
+        Create the docs/ directory so that we can write bytecode.html into it.
+        This matches what JavaScriptCore.xcodeproj does.
+
+2009-02-12  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Lars.
+
+        Re-enable the JIT in the Qt build with -fno-stack-protector on Linux.
+
+        * JavaScriptCore.pri:
+
+2009-02-11  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23705
+        Fix the UI freeze caused by Worker generating a flood of messages.
+        Measure time we spend in executing posted work items. If too much time is spent
+        without returning to the run loop, exit and reschedule.
+
+        * wtf/MainThread.h:
+        Added initializeMainThreadPlatform() to initialize low-level mechanism for posting
+        work items from thread to thread. This removes #ifdefs for WIN and CHROMIUM from platform-independent code.
+
+        * wtf/MainThread.cpp:
+        (WTF::initializeMainThread):
+        (WTF::dispatchFunctionsFromMainThread):
+        Instead of dispatching all work items in the queue, dispatch them one by one
+        and measure elapsed time. After a threshold, reschedule and quit.
+
+        (WTF::callOnMainThread):
+        (WTF::callOnMainThreadAndWait):
+        Only schedule dispatch if the queue was empty - to avoid many posted messages in the run loop queue.
+
+        * wtf/mac/MainThreadMac.mm:
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+        Use static instance of the mainThreadCaller instead of allocating and releasing it each time.
+        (WTF::initializeMainThreadPlatform):
+        * wtf/gtk/MainThreadChromium.cpp:
+        (WTF::initializeMainThreadPlatform):
+        * wtf/gtk/MainThreadGtk.cpp:
+        (WTF::initializeMainThreadPlatform):
+        * wtf/qt/MainThreadQt.cpp:
+        (WTF::initializeMainThreadPlatform):
+        * wtf/win/MainThreadWin.cpp:
+        (WTF::initializeMainThreadPlatform):
+        * wtf/wx/MainThreadWx.cpp:
+        (WTF::initializeMainThreadPlatform):
+
+2009-02-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Style cleanup.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::CodeLocationCommon):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::operator bool):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::reset):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForSwitch):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForExceptionHandler):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForJSR):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::getJumpDestination):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::CodeLocationJump):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::calleeReturnAddressValue):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::CodeLocationCall):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::repatch):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::CodeLocationDataLabel32):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::repatch):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::CodeLocationDataLabelPtr):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::ProcessorReturnAddress):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToFunction):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::operator void*):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::::CodeLocationCommon::labelAtOffset):
+        (JSC::::CodeLocationCommon::jumpAtOffset):
+        (JSC::::CodeLocationCommon::callAtOffset):
+        (JSC::::CodeLocationCommon::dataLabelPtrAtOffset):
+        (JSC::::CodeLocationCommon::dataLabel32AtOffset):
+
+2009-02-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        * assembler/AbstractMacroAssembler.h: Fix comments.
+
+2009-02-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Trying to fix wx build.
+
+        * bytecode/JumpTable.h: Include "MacroAssembler.h", not <MacroAssembler.h>.
+        * jscore.bkl: Added assembler directory to search paths.
+
+2009-02-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Build
+        fix.
+        (Narrow
+        changelog
+        for
+        dhyatt).
+
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+
+2009-02-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Reduce use of void* / reinterpret_cast in JIT repatching code,
+        add strong types for Calls and for the various types of pointers
+        we retain into the JIT generated instruction stream.
+
+        No performance impact.
+
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::ImmPtr::ImmPtr):
+        (JSC::AbstractMacroAssembler::ImmPtr::asIntptr):
+        (JSC::AbstractMacroAssembler::Imm32::Imm32):
+        (JSC::AbstractMacroAssembler::Label::Label):
+        (JSC::AbstractMacroAssembler::DataLabelPtr::DataLabelPtr):
+        (JSC::AbstractMacroAssembler::Call::Call):
+        (JSC::AbstractMacroAssembler::Call::link):
+        (JSC::AbstractMacroAssembler::Call::linkTo):
+        (JSC::AbstractMacroAssembler::Jump::Jump):
+        (JSC::AbstractMacroAssembler::Jump::linkTo):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::CodeLocationCommon):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::operator bool):
+        (JSC::AbstractMacroAssembler::CodeLocationCommon::reset):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::CodeLocationLabel):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForSwitch):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForExceptionHandler):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::addressForJSR):
+        (JSC::AbstractMacroAssembler::CodeLocationLabel::getJumpDestination):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::CodeLocationJump):
+        (JSC::AbstractMacroAssembler::CodeLocationJump::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::CodeLocationCall):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::relink):
+        (JSC::AbstractMacroAssembler::CodeLocationCall::calleeReturnAddressValue):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::CodeLocationDataLabel32):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabel32::repatch):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::CodeLocationDataLabelPtr):
+        (JSC::AbstractMacroAssembler::CodeLocationDataLabelPtr::repatch):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::ProcessorReturnAddress):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::relinkCallerToFunction):
+        (JSC::AbstractMacroAssembler::ProcessorReturnAddress::operator void*):
+        (JSC::AbstractMacroAssembler::PatchBuffer::entry):
+        (JSC::AbstractMacroAssembler::PatchBuffer::trampolineAt):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::AbstractMacroAssembler::PatchBuffer::linkTailRecursive):
+        (JSC::AbstractMacroAssembler::PatchBuffer::patch):
+        (JSC::AbstractMacroAssembler::PatchBuffer::locationOf):
+        (JSC::AbstractMacroAssembler::PatchBuffer::returnAddressOffset):
+        (JSC::AbstractMacroAssembler::differenceBetween):
+        (JSC::::CodeLocationCommon::labelAtOffset):
+        (JSC::::CodeLocationCommon::jumpAtOffset):
+        (JSC::::CodeLocationCommon::callAtOffset):
+        (JSC::::CodeLocationCommon::dataLabelPtrAtOffset):
+        (JSC::::CodeLocationCommon::dataLabel32AtOffset):
+        * assembler/MacroAssemblerX86Common.h:
+        (JSC::MacroAssemblerX86Common::call):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::getCallReturnOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::CallLinkInfo::CallLinkInfo):
+        (JSC::getStructureStubInfoReturnLocation):
+        (JSC::getCallLinkInfoReturnLocation):
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        * bytecode/JumpTable.h:
+        (JSC::StringJumpTable::ctiForValue):
+        (JSC::SimpleJumpTable::ctiForValue):
+        * bytecode/StructureStubInfo.h:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCatch):
+        (JSC::prepareJumpTableForStringSwitch):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::getPolymorphicAccessStructureListSlot):
+        (JSC::Interpreter::cti_op_throw):
+        (JSC::Interpreter::cti_op_switch_imm):
+        (JSC::Interpreter::cti_op_switch_char):
+        (JSC::Interpreter::cti_op_switch_string):
+        (JSC::Interpreter::cti_vm_throw):
+        * jit/JIT.cpp:
+        (JSC::ctiSetReturnAddress):
+        (JSC::ctiPatchCallByReturnAddress):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        (JSC::CallRecord::CallRecord):
+        (JSC::JIT::compileGetByIdSelf):
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdReplace):
+        (JSC::JIT::compilePutByIdTransition):
+        (JSC::JIT::compilePatchGetArrayLength):
+        (JSC::JIT::emitCTICall):
+        * jit/JITCall.cpp:
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::linkCall):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitNakedCall):
+        (JSC::JIT::emitCTICall_internal):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdSlowCase):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+
+2009-02-10  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r40813
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Added profiler/ to the include
+        path so that Profiler.h can be found.
+
+2009-02-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Provide a class type for a generated block of JIT code.
+        Also changes the return address -> bytecode index map to
+        track the return addess as an unsigned offset into the code
+        instead of a ptrdiff_t in terms of void**s - the latter is
+        equal to the actual offset / sizeof(void*), making it a
+        potentially lossy representation.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AbstractMacroAssembler.h:
+        (JSC::AbstractMacroAssembler::PatchBuffer::returnAddressOffset):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::getCallReturnOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::CallReturnOffsetToBytecodeIndex::CallReturnOffsetToBytecodeIndex):
+        (JSC::getCallReturnOffset):
+        (JSC::CodeBlock::getBytecodeIndex):
+        (JSC::CodeBlock::jitCode):
+        (JSC::CodeBlock::callReturnIndexVector):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::cti_vm_dontLazyLinkCall):
+        (JSC::Interpreter::cti_vm_lazyLinkCall):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::):
+        * jit/JITCall.cpp:
+        (JSC::JIT::linkCall):
+        * jit/JITCode.h: Added.
+        (JSC::):
+        (JSC::JITCode::JITCode):
+        (JSC::JITCode::operator bool):
+        (JSC::JITCode::addressForCall):
+        (JSC::JITCode::offsetOf):
+        (JSC::JITCode::execute):
+
+2009-02-09  John Grabowski  <jrg@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23856
+        Change the definition of "main thread" for Chromium on OSX.
+        It does not match the DARWIN definition.
+
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::initializeThreading):
+        (WTF::isMainThread):
+
+2009-02-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Minor bugfix, incorrect check meant that subtraction causing integer overflow
+        would be missed on x86-64 JIT.
+
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOp):
+
+2009-02-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        A more sensible register allocation for x86-64.
+
+        When WREC was ported to x86-64 it stuck with the same register allocation as x86.
+        This requires registers to be reordered on entry into WREC generated code, since
+        argument passing is different on x86-64 and x86 (regparm(3)).  This patch switches
+        x86-64 to use a native register allocation, that does not require argument registers
+        to be reordered.
+
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+        (JSC::WREC::Generator::generateReturnSuccess):
+        (JSC::WREC::Generator::generateReturnFailure):
+        * wrec/WRECGenerator.h:
+
+2009-02-05  Adam Roben  <aroben@apple.com>
+
+        Build fix
+
+        Rubberstamped by Sam Weinig.
+
+        * wtf/TypeTraits.h: Include Platform.h, since this header uses macros
+        defined there.
+
+2009-02-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23747
+        Add Chromium threading-related files.
+
+        * wtf/MainThread.cpp: Added platform guard to initializeMainThread.
+        * wtf/chromium/ChromiumThreading.h: Added.
+        * wtf/chromium/MainThreadChromium.cpp: Added.
+        (WTF::initializeMainThread):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2009-02-05  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 23713: COMPILE_ASSERTS should be moved out of TypeTraits.h and into .cpp file
+        <https://bugs.webkit.org/show_bug.cgi?id=23713>
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+
+        * wtf/HashTraits.h:
+        Remove unnecessary header file that I missed when moving out the type traits form this file.
+
+        * wtf/TypeTraits.cpp: Added.
+        (WTF::):
+        * wtf/TypeTraits.h:
+        Moved the compile asserts into TypeTraits.cpp file.
+
+2009-02-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver 'the nun' Hunt.
+
+        Add -e switch to jsc to enable evaluation of scripts passed on the command line.
+
+        * jsc.cpp:
+        (Script::Script):
+        (runWithScripts):
+        (printUsageStatement):
+        (parseArguments):
+        (jscmain):
+
+2009-02-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Sam 'Big Mac' Weinig.
+
+        * assembler/AbstractMacroAssembler.h: Copied from assembler/MacroAssembler.h.
+        * assembler/MacroAssemblerX86.h: Copied from assembler/MacroAssembler.h.
+        * assembler/MacroAssemblerX86Common.h: Copied from assembler/MacroAssembler.h.
+        * assembler/MacroAssemblerX86_64.h: Copied from assembler/MacroAssembler.h.
+
+2009-02-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        This patch tidies up the MacroAssembler, cleaning up the code and refactoring out the
+        platform-specific parts.  The MacroAssembler gets split up like a beef burger, with the
+        platform-agnostic data types being the lower bun (in the form of the class AbstractMacroAssembler),
+        the plaform-specific code generation forming a big meaty patty of methods like 'add32',
+        'branch32', etc (MacroAssemblerX86), and finally topped off with the bun-lid of the
+        MacroAssembler class itself, providing covenience methods such as the stack peek & poke,
+        and backwards branch methods, all of which can be described in a platform independent
+        way using methods from the base class.  The AbstractMacroAssembler is templated on the
+        type of the assembler class that will be used for code generation, and the three layers
+        are held together with the cocktail stick of inheritance.
+
+        The above description is a slight simplification since the MacroAssemblerX86 is actually
+        formed from two layers (in effect giving us a kind on bacon double cheeseburger) - with the
+        bulk of methods that are common between x86 & x86-64 implemented in MacroAssemblerX86Common,
+        which forms a base class for MacroAssemblerX86 and MacroAssemblerX86_64 (which add the methods
+        specific to the given platform).
+
+        I'm landing these changes first without splitting the classes across multiple files,
+        I will follow up with a second patch to split up the file MacroAssembler.h.
+
+        * assembler/MacroAssembler.h:
+        (JSC::AbstractMacroAssembler::):
+        (JSC::AbstractMacroAssembler::DataLabelPtr::DataLabelPtr):
+        (JSC::AbstractMacroAssembler::DataLabelPtr::patch):
+        (JSC::AbstractMacroAssembler::DataLabel32::DataLabel32):
+        (JSC::AbstractMacroAssembler::DataLabel32::patch):
+        (JSC::AbstractMacroAssembler::Label::Label):
+        (JSC::AbstractMacroAssembler::Jump::Jump):
+        (JSC::AbstractMacroAssembler::Jump::link):
+        (JSC::AbstractMacroAssembler::Jump::linkTo):
+        (JSC::AbstractMacroAssembler::Jump::patch):
+        (JSC::AbstractMacroAssembler::JumpList::link):
+        (JSC::AbstractMacroAssembler::JumpList::linkTo):
+        (JSC::AbstractMacroAssembler::PatchBuffer::link):
+        (JSC::AbstractMacroAssembler::PatchBuffer::addressOf):
+        (JSC::AbstractMacroAssembler::PatchBuffer::setPtr):
+        (JSC::AbstractMacroAssembler::size):
+        (JSC::AbstractMacroAssembler::copyCode):
+        (JSC::AbstractMacroAssembler::label):
+        (JSC::AbstractMacroAssembler::align):
+        (JSC::AbstractMacroAssembler::differenceBetween):
+        (JSC::MacroAssemblerX86Common::xor32):
+        (JSC::MacroAssemblerX86Common::load32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerX86Common::store32WithAddressOffsetPatch):
+        (JSC::MacroAssemblerX86Common::move):
+        (JSC::MacroAssemblerX86Common::swap):
+        (JSC::MacroAssemblerX86Common::signExtend32ToPtr):
+        (JSC::MacroAssemblerX86Common::zeroExtend32ToPtr):
+        (JSC::MacroAssemblerX86Common::branch32):
+        (JSC::MacroAssemblerX86Common::jump):
+        (JSC::MacroAssemblerX86_64::add32):
+        (JSC::MacroAssemblerX86_64::sub32):
+        (JSC::MacroAssemblerX86_64::load32):
+        (JSC::MacroAssemblerX86_64::store32):
+        (JSC::MacroAssemblerX86_64::addPtr):
+        (JSC::MacroAssemblerX86_64::andPtr):
+        (JSC::MacroAssemblerX86_64::orPtr):
+        (JSC::MacroAssemblerX86_64::rshiftPtr):
+        (JSC::MacroAssemblerX86_64::subPtr):
+        (JSC::MacroAssemblerX86_64::xorPtr):
+        (JSC::MacroAssemblerX86_64::loadPtr):
+        (JSC::MacroAssemblerX86_64::loadPtrWithAddressOffsetPatch):
+        (JSC::MacroAssemblerX86_64::storePtr):
+        (JSC::MacroAssemblerX86_64::storePtrWithAddressOffsetPatch):
+        (JSC::MacroAssemblerX86_64::branchPtr):
+        (JSC::MacroAssemblerX86_64::branchTestPtr):
+        (JSC::MacroAssemblerX86_64::branchAddPtr):
+        (JSC::MacroAssemblerX86_64::branchSubPtr):
+        (JSC::MacroAssemblerX86_64::branchPtrWithPatch):
+        (JSC::MacroAssemblerX86_64::storePtrWithPatch):
+        (JSC::MacroAssemblerX86::add32):
+        (JSC::MacroAssemblerX86::sub32):
+        (JSC::MacroAssemblerX86::load32):
+        (JSC::MacroAssemblerX86::store32):
+        (JSC::MacroAssemblerX86::branch32):
+        (JSC::MacroAssemblerX86::branchPtrWithPatch):
+        (JSC::MacroAssemblerX86::storePtrWithPatch):
+        (JSC::MacroAssembler::pop):
+        (JSC::MacroAssembler::peek):
+        (JSC::MacroAssembler::poke):
+        (JSC::MacroAssembler::branchPtr):
+        (JSC::MacroAssembler::branch32):
+        (JSC::MacroAssembler::branch16):
+        (JSC::MacroAssembler::branchTestPtr):
+        (JSC::MacroAssembler::addPtr):
+        (JSC::MacroAssembler::andPtr):
+        (JSC::MacroAssembler::orPtr):
+        (JSC::MacroAssembler::rshiftPtr):
+        (JSC::MacroAssembler::subPtr):
+        (JSC::MacroAssembler::xorPtr):
+        (JSC::MacroAssembler::loadPtr):
+        (JSC::MacroAssembler::loadPtrWithAddressOffsetPatch):
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::storePtrWithAddressOffsetPatch):
+        (JSC::MacroAssembler::branchAddPtr):
+        (JSC::MacroAssembler::branchSubPtr):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOp):
+
+2009-02-04  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23681
+        Worker tests crash in debug builds if run --singly
+
+        The crash happened because worker threads continued running while debug-only static objects
+        were already being destroyed on main thread.
+
+        * runtime/Structure.cpp: Create static debug-only sets in heap, so that they don't get
+        destroyed.
+
+        * wtf/ThreadingPthreads.cpp: Changed assertions to conventional form.
+
+2009-02-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23715
+
+        Simplify MacroAssembler interface, by combining comparison methods.
+        Seprate operations are combined as follows:
+            jz32/jnz32/jzPtr/jnzPtr -> branchTest32/branchTestPtr,
+            j*(Add|Mul|Sub)32/j*(Add|Mul|Sub)Ptr -> branch(Add|Mul|Sub)32/branch(Add|Mul|Sub)Ptr
+            j*32/j*Ptr (all other two op combparisons) -> branch32/brnachPtr
+            set*32 -> set32
+
+        Also, represent the Scale of BaseIndex addresses as a plain enum (0,1,2,3),
+        instead of as multiplicands (1,2,4,8).
+
+        This patch singificantly reduces replication of code, and increases functionality supported
+        by the MacroAssembler.  No performance impact.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::):
+        (JSC::MacroAssembler::branchPtr):
+        (JSC::MacroAssembler::branchPtrWithPatch):
+        (JSC::MacroAssembler::branch32):
+        (JSC::MacroAssembler::branch16):
+        (JSC::MacroAssembler::branchTestPtr):
+        (JSC::MacroAssembler::branchTest32):
+        (JSC::MacroAssembler::branchAddPtr):
+        (JSC::MacroAssembler::branchAdd32):
+        (JSC::MacroAssembler::branchMul32):
+        (JSC::MacroAssembler::branchSubPtr):
+        (JSC::MacroAssembler::branchSub32):
+        (JSC::MacroAssembler::set32):
+        (JSC::MacroAssembler::setTest32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::jccRel32):
+        (JSC::X86Assembler::setccOpcode):
+        (JSC::X86Assembler::cmpq_mr):
+        (JSC::X86Assembler::setcc_r):
+        (JSC::X86Assembler::sete_r):
+        (JSC::X86Assembler::setne_r):
+        (JSC::X86Assembler::jne):
+        (JSC::X86Assembler::je):
+        (JSC::X86Assembler::jl):
+        (JSC::X86Assembler::jb):
+        (JSC::X86Assembler::jle):
+        (JSC::X86Assembler::jbe):
+        (JSC::X86Assembler::jge):
+        (JSC::X86Assembler::jg):
+        (JSC::X86Assembler::ja):
+        (JSC::X86Assembler::jae):
+        (JSC::X86Assembler::jo):
+        (JSC::X86Assembler::jp):
+        (JSC::X86Assembler::js):
+        (JSC::X86Assembler::jcc):
+        (JSC::X86Assembler::X86InstructionFormatter::putModRmSib):
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emitSlowScriptCheck):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_lshift):
+        (JSC::JIT::compileFastArith_op_mod):
+        (JSC::JIT::compileFastArith_op_post_inc):
+        (JSC::JIT::compileFastArith_op_post_dec):
+        (JSC::JIT::compileFastArith_op_pre_inc):
+        (JSC::JIT::compileFastArith_op_pre_dec):
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::checkStructure):
+        (JSC::JIT::emitJumpIfJSCell):
+        (JSC::JIT::emitJumpIfNotJSCell):
+        (JSC::JIT::emitJumpIfImmediateNumber):
+        (JSC::JIT::emitJumpIfNotImmediateNumber):
+        (JSC::JIT::emitJumpIfImmediateInteger):
+        (JSC::JIT::emitJumpIfNotImmediateInteger):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+        (JSC::WREC::Generator::generateIncrementIndex):
+        (JSC::WREC::Generator::generateLoadCharacter):
+        (JSC::WREC::Generator::generateJumpIfNotEndOfInput):
+        (JSC::WREC::Generator::generateBackreferenceQuantifier):
+        (JSC::WREC::Generator::generateNonGreedyQuantifier):
+        (JSC::WREC::Generator::generateGreedyQuantifier):
+        (JSC::WREC::Generator::generatePatternCharacterPair):
+        (JSC::WREC::Generator::generatePatternCharacter):
+        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
+        (JSC::WREC::Generator::generateCharacterClassInverted):
+        (JSC::WREC::Generator::generateAssertionBOL):
+        (JSC::WREC::Generator::generateAssertionEOL):
+        (JSC::WREC::Generator::generateAssertionWordBoundary):
+        (JSC::WREC::Generator::generateBackreference):
+
+2009-02-03  David Hyatt  <hyatt@apple.com>
+
+        Fix a bug in Vector's shrinkCapacity method.  It did not properly copy elements into the inline buffer
+        when shrinking down from a size that was greater than the inline capacity.
+
+        Reviewed by Maciej
+
+        * wtf/Vector.h:
+        (WTF::VectorBuffer::VectorBuffer):
+        (WTF::VectorBuffer::allocateBuffer):
+
+2009-02-03  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Added accessor for JSByteArray storage.
+
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::storage):
+
+2009-02-03  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23560
+        Implement SharedTimer on WorkerRunLoop
+
+        * JavaScriptCore.exp:
+        Forgot to expose ThreadCondition::timedWait() in one of previous patches.
+
+2009-02-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=21414> REGRESSION: Regular Expressions and character classes, shorthands and ranges
+        <rdar://problem/6543487>
+
+        In certain circumstances when WREC::Generator::generateCharacterClassInvertedRange invokes
+        itself recursively, it will incorrectly emit (and thus consume) the next single character
+        match in the current character class.  As WREC uses a binary search this out of sequence
+        codegen could result in a character match being missed and so cause the regex to produce
+        incorrect results.
+
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
+
+2009-02-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Bug 23676: Speed up uses of reserveCapacity on new vectors by adding a new reserveInitialCapacity
+        https://bugs.webkit.org/show_bug.cgi?id=23676
+
+        * API/JSObjectRef.cpp:
+        (JSObjectCopyPropertyNames): Use reserveInitialCapacity.
+        * parser/Lexer.cpp:
+        (JSC::Lexer::Lexer): Ditto.
+        (JSC::Lexer::clear): Ditto.
+
+        * wtf/Vector.h: Added reserveInitialCapacity, a more efficient version of
+        reserveCapacity for use when the vector is brand new (still size 0 with no
+        capacity other than the inline capacity).
+
+2009-01-30  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        <rdar://problem/6391501> Enable the JIT on Mac OS X x86_64 as it passes all tests.
+
+        * wtf/Platform.h:
+
+2009-01-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark Rowe and Sam Weinig.
+
+        Finally fix load() to propagate exceptions correctly.
+
+        * jsc.cpp:
+        (functionLoad):
+
+2009-01-30  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23618
+        Templated worker tasks should be more error proof to use.
+        Fix Chromium build.
+
+        * wtf/TypeTraits.h:
+        (WTF::IsConvertibleToInteger::IsConvertibleToDouble):
+        Avoid "possible loss of data" warning when using Microsoft's C++ compiler
+        by avoiding an implicit conversion of int types to doubles.
+
+2009-01-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Bug 23580: GNU mode RVCT compilation support
+        <https://bugs.webkit.org/show_bug.cgi?id=23580>
+
+        * pcre/pcre_exec.cpp: Use COMPILER(GCC) instead of __GNUC__.
+        * wtf/FastMalloc.cpp: Ditto.
+        (WTF::TCMallocStats::):
+        * wtf/Platform.h: Don't define COMPILER(GCC) with RVCT --gnu.
+
+2009-01-30  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23618: Templated worker tasks should be more error proof to use
+        <https://bugs.webkit.org/show_bug.cgi?id=23618>
+
+        Add the type traits needed for the generic worker tasks
+        and compile asserts for them.
+
+        Add a summary header to the TypeTraits.h file to explain what is in there.
+
+        Add a note to explain IsPod's deficiencies.
+
+        * wtf/TypeTraits.h:
+
+2009-01-30  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23616: Various "template helpers" should be consolidated from isolated files in JavaScriptCore.
+        <https://bugs.webkit.org/show_bug.cgi?id=23616>
+
+        * wtf/TypeTraits.h: Moved RemovePointer, IsPod, IsInteger to this file.
+
+        * wtf/OwnPtr.h: Use RemovePointer from TypeTraits.h.
+        * wtf/RetainPtr.h:  Ditto.
+
+        * wtf/HashTraits.h: Use IsInteger from TypeTraits.h.
+
+        * wtf/VectorTraits.h: Use IsPod from TypeTraits.h.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Added TypeTraits.h.
+
+2009-01-29  Stephanie Lewis <slewis@apple.com>
+
+        RS by Oliver Hunt.
+
+        Update the order files.
+
+        * JavaScriptCore.order:
+
+2009-01-29  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 23551: Crash on page load with profiler enabled and running
+        <https://bugs.webkit.org/show_bug.cgi?id=23551>
+        <rdar://problem/6529521>
+
+        Interpreter::execute(FunctionBodyNode*, ...) calls Profiler::didExecute()
+        with a stale CallFrame. If some part of the scope chain has already been
+        freed, Profiler::didExecute() will crash when attempting to get the lexical
+        global object. The fix is to make the didExecute() call use the caller's
+        CallFrame, not the one made for the function call. In this case, the
+        willExecute() call should also be changed to match.
+
+        Since this occurs in the actual inspector JS, it is difficult to reduce.
+        I couldn't make a layout test.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::execute):
+
+2009-01-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix for <rdar://problem/6525537>
+        Hang occurs when closing Installer window (iTunes, Aperture)
+
+        * JavaScriptCore.exp: Export JSGlobalData::sharedInstance.
+
+2009-01-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        Initial patch by Mark Rowe.
+
+        <rdar://problem/6519356>
+        REGRESSION (r36006): "out of memory" alert running dromaeo on Windows
+
+        Report the cost of the ArrayStorage vector more accurately/often.
+
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray): Report the extra cost even for a filled array
+        because JSString using the single character optimization and immediates
+        wont increase the cost themselves. 
+        (JSC::JSArray::putSlowCase): Update the cost when increasing the size of
+        the array.
+        (JSC::JSArray::increaseVectorLength): Ditto.
+
+2009-01-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        Fix for <rdar://problem/6129678>
+        REGRESSION (Safari 3-4): Local variable not accessible from Dashcode console or variables view
+
+        Iterating the properties of activation objects accessed through the WebKit debugging
+        APIs was broken by forced conversion of JSActivation to the global object. To fix this,
+        we use a proxy activation object that acts more like a normal JSObject.
+
+        * debugger/DebuggerActivation.cpp: Added.
+        (JSC::DebuggerActivation::DebuggerActivation):
+        (JSC::DebuggerActivation::mark):
+        (JSC::DebuggerActivation::className):
+        (JSC::DebuggerActivation::getOwnPropertySlot):
+        (JSC::DebuggerActivation::put):
+        (JSC::DebuggerActivation::putWithAttributes):
+        (JSC::DebuggerActivation::deleteProperty):
+        (JSC::DebuggerActivation::getPropertyNames):
+        (JSC::DebuggerActivation::getPropertyAttributes):
+        (JSC::DebuggerActivation::defineGetter):
+        (JSC::DebuggerActivation::defineSetter):
+        (JSC::DebuggerActivation::lookupGetter):
+        (JSC::DebuggerActivation::lookupSetter):
+        * debugger/DebuggerActivation.h: Added.
+        Proxy JSActivation object for Debugging.
+
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::isActivationObject): Added.
+        * runtime/JSObject.h:
+        (JSC::JSObject::isActivationObject): Added.
+
+2009-01-28  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 23490: Remove initialRefCount argument from RefCounted class
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23490>
+
+        Reviewed by Darin Adler.
+
+        RefCountedBase now always starts with a ref count of 1, so there
+        is no need to pass the initialRefCount into the class anymore.
+
+        * wtf/ByteArray.h:
+        (WTF::ByteArray::ByteArray): Removed call to RefCounted(1).
+        * wtf/RefCounted.h:
+        (WTF::RefCountedBase::RefCountedBase): Changed to start with a
+        ref count of 1.
+        (WTF::RefCounted::RefCounted): Removed initialRefCount argument
+        and removed call to RefCounted(1).
+
+2009-01-26  Adele Peterson  <adele@apple.com>
+
+        Build fix.  
+
+        * debugger/Debugger.cpp:
+
+2009-01-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes for eq null & neq null, on 64-bit JIT.
+        https://bugs.webkit.org/show_bug.cgi?id=23559
+
+        This patch degrades 64-bit JIT performance on some benchmarks,
+        due to the whole not-being-incorrect thing.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2009-01-26  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 23552: Dashcode evaluator no longer works after making ExecStates actual call frames
+        <https://bugs.webkit.org/show_bug.cgi?id=23552>
+        <rdar://problem/6398839>
+
+        * JavaScriptCore.exp:
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame): Added so that WebScriptCallFrame can
+        evaluate JS starting from a global call frame.
+        * debugger/Debugger.h:
+
+2009-01-25  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Improve the consistency of settings in our .xcconfig files.
+
+        * Configurations/Base.xcconfig: Enable GCC_OBJC_CALL_CXX_CDTORS to match other projects.
+
+2009-01-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 23352: Turn on more compiler warnings in the Mac build
+        https://bugs.webkit.org/show_bug.cgi?id=23352
+
+        Turn on the following warnings:
+
+            -Wcast-qual
+            -Wextra-tokens
+            -Wformat=2
+            -Winit-self
+            -Wmissing-noreturn
+            -Wpacked
+            -Wrendundant-decls
+
+        * Configurations/Base.xcconfig: Added the new warnings. Switched to -Wextra instead of
+        -W for clarity since we don't have to support the older versions of gcc that require the
+        old -W syntax. Since we now use -Wformat=2, removed -Wformat-security. Also removed
+        -Wno-format-y2k since we can have that one on now.
+
+2009-01-25  Judit Jasz  <jasy@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+        
+        Compilation problem fixing 
+        http://bugs.webkit.org/show_bug.cgi?id=23497
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall): Use JSValuePtr::encode.
+
+2009-01-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23352: Turn on more compiler warnings in the Mac build
+        https://bugs.webkit.org/show_bug.cgi?id=23352
+
+        Fourth patch: Deal with the last few stray warnings.
+
+        * parser/Parser.cpp: Only declare jscyyparse if it's not already declared.
+        This makes both separate compilation and all-in-one compilation work with the
+        -Wredundant-decls warning.
+
+2009-01-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23352: Turn on more compiler warnings in the Mac build
+        https://bugs.webkit.org/show_bug.cgi?id=23352
+
+        Third patch: Use the noreturn attribute on functions that don't
+        return to prepare for the use of the -Wmissing-noreturn warning.
+
+        * jit/JITCall.cpp:
+        (JSC::unreachable): Added NO_RETURN.
+        * jsc.cpp:
+        (functionQuit): Ditto.
+        (printUsageStatement): Ditto.
+        * wtf/AlwaysInline.h: Added definition of NO_RETURN.
+
+2009-01-24  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Force inlining of Lexer::matchPunctuator
+
+        2.2% win when parsing jQuery, Mootools, Prototype, etc
+
+        * parser/Lexer.h:
+
+2009-01-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix for <rdar://problem/6126212>
+        Ensure that callbacks out from the JSC interface are only allowed
+        to return in reverse-chronological order to that in which they were
+        made.  If we allow earlier callbacks to return first, then this may
+        result in setions of the RegisterFile in use by another thread
+        being trampled.
+
+        See uber-comment in JSLock.h for details.
+
+        * runtime/JSLock.cpp:
+        (JSC::JSLock::DropAllLocks::DropAllLocks):
+        (JSC::JSLock::DropAllLocks::~DropAllLocks):
+
+2009-01-23  Darin Adler  <darin@apple.com>
+
+        Try to fix WX build.
+
+        * runtime/JSGlobalObjectFunctions.h: Include <wtf/unicode/Unicode.h>
+        for the definition of UChar.
+
+2009-01-23  Anders Carlsson  <andersca@apple.com>
+
+        * Configurations/Base.xcconfig:
+        GCC 4.0 build fix.
+        
+        * runtime/JSNumberCell.h:
+        64-bit build fix.
+
+2009-01-23  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Turn on -Wmissing-prototypes and fix the warnings.
+        
+        * API/JSClassRef.cpp:
+        (clearReferenceToPrototype):
+        * Configurations/Base.xcconfig:
+        * runtime/Collector.cpp:
+        (JSC::getPlatformThreadRegisters):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createError):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSNumberCell.h:
+        * runtime/UString.cpp:
+        (JSC::initializeStaticBaseString):
+        (JSC::createRep):
+        * wtf/FastMalloc.cpp:
+        * wtf/Threading.cpp:
+
+2009-01-22  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Anders Carlsson.
+
+        Disable GCC_WARN_ABOUT_MISSING_PROTOTYPES temporarily.
+
+        Current versions of Xcode only respect it for C and Objective-C files,
+        and our code doesn't currently compile if it is applied to C++ and
+        Objective-C++ files.
+
+        * Configurations/Base.xcconfig:
+
+2009-01-22  Steve Falkenburg  <sfalken@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=23489
+        
+        Return currentTime() in correct units for the two early return cases.
+
+        Reviewed by Mark Rowe.
+
+        * wtf/CurrentTime.cpp:
+        (WTF::currentTime):
+
+2009-01-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix for <rdar://problem/6439247>
+        FastMalloc allocating an extra 4MB of meta-data on 64-bit
+
+        Rely on the fact that on all known x86-64 platforms only use 48 bits of
+        address space to shrink the initial size of the PageMap from ~4MB to 120K.
+        For 64-bit we still use a 3-level radix tree, but now each level is only 12
+        bits wide.
+
+        No performance change.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::MapSelector): Add specialization for 64 bit that takes into account the
+        16 bits of unused address space on x86-64.
+
+2009-01-22  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23461 LayoutTests/
+        fast/js/numeric-conversion.html is broken, and corresponding 
+        <rdar://problem/6514842>
+
+        The basic problem here is that parseInt(Infinity) should be NaN, 
+        but we were returning 0. NaN matches Safari 3.2.1 and Firefox.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+
+2009-01-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/6516853> (r39682-r39736) JSFunFuzz: crash on "(function(){({ x2: x }), })()"
+        <https://bugs.webkit.org/show_bug.cgi?id=23479>
+
+        Automatic semicolon insertion was resulting in this being accepted in the initial
+        nodeless parsing, but subsequent reparsing for code generation would fail, leading
+        to a crash.  The solution is to ensure that reparsing a function performs parsing
+        in the same state as the initial parse.  We do this by modifying the saved source
+        ranges to include rather than exclude the opening and closing braces.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary): add an assertion for successful recompile
+        * parser/Lexer.h:
+        (JSC::Lexer::sourceCode): include rather than exclude braces.
+        * parser/Nodes.h:
+        (JSC::FunctionBodyNode::toSourceString):  No need to append braces anymore.
+
+2009-01-22  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23373
+
+        Implement ThreadCondition::timedWait().
+        Since we borrow the code for condition variables from other sources,
+        I did the same for timedWait(). See comments in ThreadingWin.cpp for
+        rationale and more info.
+
+        * wtf/CONTRIBUTORS.pthreads-win32: 
+        Added. A list of Pthreads-win32 contributors mentioned in their license. The license itself
+        is included into wtf/ThreadingWin32.cpp.
+
+        * wtf/Threading.h:
+        * wtf/ThreadingWin.cpp:
+        Additional info and Pthreads-win32 license at the beginning.
+        (WTF::PlatformCondition::timedWait): new method, derived from Pthreads-win32.
+        (WTF::PlatformCondition::signal): same
+        (WTF::ThreadCondition::ThreadCondition):
+        (WTF::ThreadCondition::~ThreadCondition):
+        (WTF::ThreadCondition::wait): this now calls PlatformCondition::timedWait.
+        (WTF::ThreadCondition::timedWait): same
+        (WTF::ThreadCondition::signal): this now calls PlatformCondition::signal.
+        (WTF::ThreadCondition::broadcast): same
+
+2009-01-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23469.
+
+        We need to check all numbers in integer switches, not just those
+        represented as integer JSImmediates.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::cti_op_switch_imm):
+
+2009-01-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23468.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-01-21  Alexey Proskuryakov  <ap@webkit.org>
+
+        Suggested by Oliver Hunt. Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23456
+        Function argument names leak
+
+        * parser/Nodes.cpp: (JSC::FunctionBodyNode::~FunctionBodyNode): Destruct parameter names.
+
+2009-01-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2009-01-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Structure property table deleted offset maps are being leaked.
+        Probably shouldn't be doing that.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23442
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure):
+
+2009-01-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Attempt to fix gtk build
+
+        * GNUmakefile.am:
+
+2009-01-20  Darin Adler  <darin@apple.com>
+
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferences): Add back the initialization to fix the build.
+
+2009-01-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 23352: Turn on more compiler warnings in the Mac build
+        https://bugs.webkit.org/show_bug.cgi?id=23352
+
+        First patch: Fix some simple cases of various warnings.
+
+        * pcre/pcre_compile.cpp:
+        (jsRegExpCompile): Use const_cast to change const-ness.
+
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferences): Remove unneeded initialization and
+        use UChar instead of unsigned short for UTF-16 values.
+
+        * wtf/dtoa.cpp:
+        (WTF::strtod): Use const_cast to change const-ness.
+
+2009-01-20  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        Whoops, remove runtime/ByteArray references from .pri and .scons builds, update .bkl
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCoreSources.bkl:
+
+2009-01-20  Oliver Hunt  <oliver@apple.com>
+
+        RS=Dan Bernstein.
+
+        Move runtime/ByteArray to wtf/ByteArray
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/JSByteArray.cpp:
+        * runtime/JSByteArray.h:
+        * wtf/ByteArray.cpp: Renamed from JavaScriptCore/runtime/ByteArray.cpp.
+        (WTF::ByteArray::create):
+        * wtf/ByteArray.h: Renamed from JavaScriptCore/runtime/ByteArray.h.
+        (WTF::ByteArray::length):
+        (WTF::ByteArray::set):
+        (WTF::ByteArray::get):
+        (WTF::ByteArray::data):
+        (WTF::ByteArray::deref):
+        (WTF::ByteArray::ByteArray):
+
+2009-01-19  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Gavin Barraclough.
+
+        Remove temporary operator-> from JSValuePtr.
+
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::call):
+        (JSC::::toNumber):
+        (JSC::::toString):
+        * API/JSObjectRef.cpp:
+        (JSObjectSetPrototype):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        * bytecode/CodeBlock.cpp:
+        (JSC::valueToSourceString):
+        (JSC::CodeBlock::mark):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isKnownNotImmediate):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        (JSC::keyForImmediateSwitch):
+        * interpreter/Interpreter.cpp:
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAddSlowCase):
+        (JSC::jsAdd):
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        (JSC::jsIsFunctionType):
+        (JSC::isNotObject):
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::throwException):
+        (JSC::cachePrototypeChain):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::countPrototypeChainEntriesAndCheckForProxies):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::tryCTICachePutByID):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::Interpreter::cti_op_convert_this):
+        (JSC::Interpreter::cti_op_add):
+        (JSC::Interpreter::cti_op_pre_inc):
+        (JSC::Interpreter::cti_op_put_by_id_generic):
+        (JSC::Interpreter::cti_op_get_by_id_generic):
+        (JSC::Interpreter::cti_op_put_by_id):
+        (JSC::Interpreter::cti_op_put_by_id_second):
+        (JSC::Interpreter::cti_op_put_by_id_fail):
+        (JSC::Interpreter::cti_op_get_by_id):
+        (JSC::Interpreter::cti_op_get_by_id_second):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list_full):
+        (JSC::Interpreter::cti_op_get_by_id_proto_fail):
+        (JSC::Interpreter::cti_op_get_by_id_array_fail):
+        (JSC::Interpreter::cti_op_get_by_id_string_fail):
+        (JSC::Interpreter::cti_op_instanceof):
+        (JSC::Interpreter::cti_op_del_by_id):
+        (JSC::Interpreter::cti_op_mul):
+        (JSC::Interpreter::cti_op_call_JSFunction):
+        (JSC::Interpreter::cti_op_call_NotJSFunction):
+        (JSC::Interpreter::cti_op_construct_JSConstruct):
+        (JSC::Interpreter::cti_op_construct_NotJSConstruct):
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_get_by_val_byte_array):
+        (JSC::Interpreter::cti_op_sub):
+        (JSC::Interpreter::cti_op_put_by_val):
+        (JSC::Interpreter::cti_op_put_by_val_array):
+        (JSC::Interpreter::cti_op_put_by_val_byte_array):
+        (JSC::Interpreter::cti_op_loop_if_true):
+        (JSC::Interpreter::cti_op_negate):
+        (JSC::Interpreter::cti_op_div):
+        (JSC::Interpreter::cti_op_pre_dec):
+        (JSC::Interpreter::cti_op_not):
+        (JSC::Interpreter::cti_op_jtrue):
+        (JSC::Interpreter::cti_op_post_inc):
+        (JSC::Interpreter::cti_op_lshift):
+        (JSC::Interpreter::cti_op_bitand):
+        (JSC::Interpreter::cti_op_rshift):
+        (JSC::Interpreter::cti_op_bitnot):
+        (JSC::Interpreter::cti_op_mod):
+        (JSC::Interpreter::cti_op_post_dec):
+        (JSC::Interpreter::cti_op_urshift):
+        (JSC::Interpreter::cti_op_bitxor):
+        (JSC::Interpreter::cti_op_bitor):
+        (JSC::Interpreter::cti_op_push_scope):
+        (JSC::Interpreter::cti_op_is_undefined):
+        (JSC::Interpreter::cti_op_is_boolean):
+        (JSC::Interpreter::cti_op_is_number):
+        (JSC::Interpreter::cti_op_to_jsnumber):
+        (JSC::Interpreter::cti_op_in):
+        (JSC::Interpreter::cti_op_put_by_index):
+        (JSC::Interpreter::cti_op_switch_imm):
+        (JSC::Interpreter::cti_op_switch_char):
+        (JSC::Interpreter::cti_op_switch_string):
+        (JSC::Interpreter::cti_op_del_by_val):
+        (JSC::Interpreter::cti_op_put_getter):
+        (JSC::Interpreter::cti_op_put_setter):
+        (JSC::Interpreter::cti_op_new_error):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::isJSArray):
+        (JSC::Interpreter::isJSString):
+        (JSC::Interpreter::isJSByteArray):
+        * interpreter/Register.h:
+        (JSC::Register::marked):
+        (JSC::Register::mark):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::getConstantOperandImmediateInt):
+        (JSC::JIT::isOperandConstantImmediateInt):
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (functionRun):
+        (functionLoad):
+        (runWithScripts):
+        (runInteractive):
+        * parser/Nodes.cpp:
+        (JSC::processClauseList):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::createCallIdentifier):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::constructArrayWithSizeQuirk):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::constructBoolean):
+        (JSC::callBooleanConstructor):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/Collector.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::heap):
+        (JSC::Heap::collect):
+        (JSC::typeName):
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::dateParse):
+        (JSC::dateUTC):
+        * runtime/DateInstance.h:
+        (JSC::DateInstance::internalNumber):
+        * runtime/DatePrototype.cpp:
+        (JSC::formatLocaleDate):
+        (JSC::fillStructuresUsingTimeArgs):
+        (JSC::fillStructuresUsingDateArgs):
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::constructError):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createError):
+        (JSC::createErrorMessage):
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::toObject):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertySlot):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::put):
+        (JSC::JSArray::mark):
+        (JSC::JSArray::sort):
+        (JSC::AVLTreeAbstractorForArrayCompare::compare_key_key):
+        (JSC::JSArray::compactForSorting):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::setIndex):
+        * runtime/JSCell.h:
+        (JSC::asCell):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::construct):
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::lastInPrototypeChain):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEval):
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncIsNaN):
+        (JSC::globalFuncIsFinite):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSImmediate.cpp:
+        (JSC::JSImmediate::toThisObject):
+        (JSC::JSImmediate::toObject):
+        (JSC::JSImmediate::prototype):
+        (JSC::JSImmediate::toString):
+        * runtime/JSImmediate.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::mark):
+        (JSC::JSObject::put):
+        (JSC::callDefaultValueFunction):
+        (JSC::JSObject::getPrimitiveNumber):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::lookupGetter):
+        (JSC::JSObject::lookupSetter):
+        (JSC::JSObject::hasInstance):
+        (JSC::JSObject::toNumber):
+        (JSC::JSObject::toString):
+        * runtime/JSObject.h:
+        (JSC::JSObject::JSObject):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSObject::getOwnPropertySlotForWrite):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSValuePtr::get):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::create):
+        * runtime/JSString.cpp:
+        (JSC::JSString::getOwnPropertySlot):
+        * runtime/JSValue.h:
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::mark):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        (JSC::NativeErrorConstructor::construct):
+        * runtime/NumberConstructor.cpp:
+        (JSC::constructWithNumberConstructor):
+        (JSC::callNumberConstructor):
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString):
+        (JSC::numberProtoFuncValueOf):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncValueOf):
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        (JSC::objectProtoFuncToLocaleString):
+        (JSC::objectProtoFuncToString):
+        * runtime/Operations.h:
+        (JSC::JSValuePtr::equalSlowCaseInline):
+        (JSC::JSValuePtr::strictEqual):
+        (JSC::JSValuePtr::strictEqualSlowCaseInline):
+        * runtime/Protect.h:
+        (JSC::gcProtect):
+        (JSC::gcUnprotect):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::setRegExpConstructorInput):
+        (JSC::setRegExpConstructorMultiline):
+        (JSC::constructRegExp):
+        * runtime/RegExpObject.cpp:
+        (JSC::setRegExpObjectLastIndex):
+        (JSC::RegExpObject::match):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        (JSC::stringFromCharCode):
+        (JSC::constructWithStringConstructor):
+        (JSC::callStringConstructor):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::getEnumerablePropertyNames):
+        (JSC::Structure::createCachedPrototypeChain):
+        * runtime/Structure.h:
+        (JSC::Structure::mark):
+        * runtime/StructureChain.cpp:
+        (JSC::StructureChain::StructureChain):
+
+2009-01-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23409: REGRESSION: RegExp 'replace()' function improperly processes '$$'
+        <https://bugs.webkit.org/show_bug.cgi?id=23409>
+        <rdar://problem/6505723>
+
+        Test: fast/js/string-replace-3.html
+
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferences): Remove code that adds an extra $ -- not sure
+        how this ever worked.
+
+2009-01-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        On x86-64 jit, cache JSImmedate::TagMask & JSImmedate::TagTypeNumber in
+        registers, save reloading them every time they're used.
+
+        Draws x86-64 jit performance close to that of i386 jit.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::subPtr):
+        (JSC::MacroAssembler::jnzPtr):
+        (JSC::MacroAssembler::jzPtr):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpIfJSCell):
+        (JSC::JIT::emitJumpIfNotJSCell):
+        (JSC::JIT::emitJumpIfImmediateNumber):
+        (JSC::JIT::emitJumpIfNotImmediateNumber):
+        (JSC::JIT::emitJumpIfImmediateInteger):
+        (JSC::JIT::emitJumpIfNotImmediateInteger):
+        (JSC::JIT::emitFastArithIntToImmNoCheck):
+
+2009-01-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add support to x86-64 JIT for inline double precision arithmetic ops.
+        +5/6% on x86-64, JIT enabled, sunspider.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::addPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movq_rr):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_pre_inc):
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArithSlow_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        (JSC::JIT::compileFastArithSlow_op_mul):
+        (JSC::JIT::compileFastArith_op_sub):
+        (JSC::JIT::compileFastArithSlow_op_sub):
+        * parser/ResultType.h:
+        (JSC::ResultType::isReusable):
+        (JSC::ResultType::isInt32):
+        (JSC::ResultType::definitelyIsNumber):
+        (JSC::ResultType::mightBeNumber):
+        (JSC::ResultType::isNotNumber):
+        (JSC::ResultType::unknownType):
+
+2009-01-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fixes for SamplingTool.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23390
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::storePtr):
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::run):
+        (JSC::SamplingTool::dump):
+        * bytecode/SamplingTool.h:
+        (JSC::SamplingTool::encodeSample):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::JIT::samplingToolTrackCodeBlock):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitCTICall_internal):
+
+2009-01-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed <rdar://problem/6452301> REGRESSION: Latest WebKit nightlies
+        turn "c" into "" when stripping \\c_ character
+
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::Parser::consumeEscape): Mimic a Firefox quirk when parsing
+        control escapes inside character classes.
+
+2009-01-16  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::Parser::parseParentheses): Removed unreachable code.
+
+2009-01-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed <rdar://problem/6471394> REGRESSION (r39164): Discarding quantifier
+        on assertion gives incorrect result (23075)
+        
+        https://bugs.webkit.org/show_bug.cgi?id=23075
+
+        * pcre/pcre_compile.cpp:
+        (compileBranch): Throw away an assertion if it's followed by a quantifier
+        with a 0 minimum, to match SpiderMonkey, v8, and the ECMA spec.
+
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::Parser::parseParentheses): Fall back on PCRE for the rare
+        case of an assertion with a quantifier with a 0 minimum, since we
+        don't handle quantified subexpressions yet, and in this special case,
+        we can't just throw away the quantifier.
+
+2009-01-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add support in ResultType to track that the results of bitops
+        are always of type int32_t.
+
+        * parser/Nodes.cpp:
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::ReadModifyDotNode::emitBytecode):
+        (JSC::ReadModifyBracketNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::):
+        (JSC::BooleanNode::):
+        (JSC::NumberNode::):
+        (JSC::StringNode::):
+        (JSC::PrePostResolveNode::):
+        (JSC::TypeOfResolveNode::):
+        (JSC::TypeOfValueNode::):
+        (JSC::UnaryPlusNode::):
+        (JSC::NegateNode::):
+        (JSC::BitwiseNotNode::):
+        (JSC::LogicalNotNode::):
+        (JSC::MultNode::):
+        (JSC::DivNode::):
+        (JSC::ModNode::):
+        (JSC::SubNode::):
+        (JSC::LeftShiftNode::):
+        (JSC::RightShiftNode::):
+        (JSC::UnsignedRightShiftNode::):
+        (JSC::LessNode::):
+        (JSC::GreaterNode::):
+        (JSC::LessEqNode::):
+        (JSC::GreaterEqNode::):
+        (JSC::InstanceOfNode::):
+        (JSC::EqualNode::):
+        (JSC::NotEqualNode::):
+        (JSC::StrictEqualNode::):
+        (JSC::NotStrictEqualNode::):
+        (JSC::BitAndNode::):
+        (JSC::BitOrNode::):
+        (JSC::BitXOrNode::):
+        (JSC::LogicalOpNode::):
+        * parser/ResultType.h:
+        (JSC::ResultType::isInt32):
+        (JSC::ResultType::isNotNumber):
+        (JSC::ResultType::booleanType):
+        (JSC::ResultType::numberType):
+        (JSC::ResultType::numberTypeCanReuse):
+        (JSC::ResultType::numberTypeCanReuseIsInt32):
+        (JSC::ResultType::stringOrNumberTypeCanReuse):
+        (JSC::ResultType::stringType):
+        (JSC::ResultType::unknownType):
+        (JSC::ResultType::forAdd):
+        (JSC::ResultType::forBitOp):
+        (JSC::OperandTypes::OperandTypes):
+
+2009-01-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add support for integer addition, subtraction and multiplication
+        in JIT code on x86-64.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::mul32):
+        (JSC::MacroAssembler::sub32):
+        (JSC::MacroAssembler::joMul32):
+        (JSC::MacroAssembler::joSub32):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArithSlow_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        (JSC::JIT::compileFastArithSlow_op_mul):
+        (JSC::JIT::compileFastArith_op_sub):
+        (JSC::JIT::compileFastArithSlow_op_sub):
+
+2009-01-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        On x86-64 allow JSImmediate to encode 64-bit double precision values.
+        This patch only affects builds that set USE(ALTERNATE_JSIMMEDIATE).
+        Updates the implementation of JSValuePtr:: and JSImmediate:: methods
+        that operate on neumeric values to be be aware of the new representation.
+        When this representation is in use, the class JSNumberCell is redundant
+        and is compiled out.
+
+        The format of the new immediate representation is documented in JSImmediate.h.
+
+        * JavaScriptCore.exp:
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::subPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::subq_rr):
+        (JSC::X86Assembler::movq_rr):
+        (JSC::X86Assembler::ucomisd_rr):
+        (JSC::X86Assembler::X86InstructionFormatter::twoByteOp64):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_stricteq):
+        (JSC::Interpreter::cti_op_nstricteq):
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_lshift):
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArith_op_bitand):
+        (JSC::JIT::compileFastArith_op_mod):
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        (JSC::JIT::compileFastArith_op_post_inc):
+        (JSC::JIT::compileFastArith_op_post_dec):
+        (JSC::JIT::compileFastArith_op_pre_inc):
+        (JSC::JIT::compileFastArith_op_pre_dec):
+        (JSC::JIT::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::JIT::compileBinaryArithOp):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpIfBothJSCells):
+        (JSC::JIT::emitJumpIfEitherNumber):
+        (JSC::JIT::emitJumpIfNotEitherNumber):
+        (JSC::JIT::emitJumpIfImmediateIntegerNumber):
+        (JSC::JIT::emitJumpIfNotImmediateIntegerNumber):
+        (JSC::JIT::emitJumpIfNotImmediateIntegerNumbers):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmediateIntegerNumber):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmediateIntegerNumbers):
+        (JSC::JIT::emitFastArithDeTagImmediate):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::JIT::emitFastArithReTagImmediate):
+        (JSC::JIT::emitFastArithIntToImmNoCheck):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSImmediate.cpp:
+        (JSC::JSImmediate::toThisObject):
+        (JSC::JSImmediate::toObject):
+        (JSC::JSImmediate::toString):
+        * runtime/JSImmediate.h:
+        (JSC::wtf_reinterpret_cast):
+        (JSC::JSImmediate::isNumber):
+        (JSC::JSImmediate::isIntegerNumber):
+        (JSC::JSImmediate::isDoubleNumber):
+        (JSC::JSImmediate::isPositiveIntegerNumber):
+        (JSC::JSImmediate::areBothImmediateIntegerNumbers):
+        (JSC::JSImmediate::makeInt):
+        (JSC::JSImmediate::makeDouble):
+        (JSC::JSImmediate::doubleValue):
+        (JSC::doubleToBoolean):
+        (JSC::JSImmediate::toBoolean):
+        (JSC::JSImmediate::getTruncatedUInt32):
+        (JSC::JSImmediate::makeOutOfIntegerRange):
+        (JSC::JSImmediate::from):
+        (JSC::JSImmediate::getTruncatedInt32):
+        (JSC::JSImmediate::toDouble):
+        (JSC::JSImmediate::getUInt32):
+        (JSC::JSValuePtr::isInt32Fast):
+        (JSC::JSValuePtr::isUInt32Fast):
+        (JSC::JSValuePtr::areBothInt32Fast):
+        (JSC::JSFastMath::canDoFastBitwiseOperations):
+        (JSC::JSFastMath::xorImmediateNumbers):
+        (JSC::JSFastMath::canDoFastRshift):
+        (JSC::JSFastMath::canDoFastUrshift):
+        (JSC::JSFastMath::rightShiftImmediateNumbers):
+        (JSC::JSFastMath::canDoFastAdditiveOperations):
+        (JSC::JSFastMath::addImmediateNumbers):
+        (JSC::JSFastMath::subImmediateNumbers):
+        * runtime/JSNumberCell.cpp:
+        (JSC::jsNumberCell):
+        * runtime/JSNumberCell.h:
+        (JSC::createNumberStructure):
+        (JSC::isNumberCell):
+        (JSC::asNumberCell):
+        (JSC::jsNumber):
+        (JSC::JSValuePtr::isDoubleNumber):
+        (JSC::JSValuePtr::getDoubleNumber):
+        (JSC::JSValuePtr::isNumber):
+        (JSC::JSValuePtr::uncheckedGetNumber):
+        (JSC::jsNaN):
+        (JSC::JSValuePtr::getNumber):
+        (JSC::JSValuePtr::numberToInt32):
+        (JSC::JSValuePtr::numberToUInt32):
+        * runtime/JSValue.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+        * runtime/NumberObject.cpp:
+        (JSC::constructNumber):
+        * runtime/NumberObject.h:
+        * runtime/Operations.h:
+        (JSC::JSValuePtr::equal):
+        (JSC::JSValuePtr::equalSlowCaseInline):
+        (JSC::JSValuePtr::strictEqual):
+        (JSC::JSValuePtr::strictEqualSlowCaseInline):
+        * wtf/Platform.h:
+
+2009-01-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        <rdar://problem/6045018>
+        REGRESSION (r34838): JavaScript objects appear to be leaked after loading google.com
+
+        Subtract the number of JSStrings cached in SmallStrings when calculating the
+        number of live JSObjects.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::objectCount):
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStrings::count):
+        * runtime/SmallStrings.h:
+
+2009-01-15  Sam Weinig  <sam@webkit.org>
+
+        Fix Qt build.
+
+        * runtime/Collector.cpp:
+
+2009-01-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix crash seen running fast/canvas.
+
+        Make sure to mark the ScopeNode and CodeBlock being created
+        in the re-parse for exception information.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::mark):
+        * runtime/Collector.cpp:
+        (JSC::Heap::collect):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+
+2009-01-15  Craig Schlenter  <craig.schlenter@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23347
+        Compilation of JavaScriptCore/wtf/ThreadingPthreads.cpp fails on Linux
+
+        * wtf/ThreadingPthreads.cpp: included limits.h as INT_MAX is defined there.
+
+2009-01-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 23225: REGRESSION: Assertion failure in reparseInPlace() (m_sourceElements) at sfgate.com
+        <https://bugs.webkit.org/show_bug.cgi?id=23225> <rdar://problem/6487432>
+
+        Character position for open and closing brace was incorrectly referencing m_position to
+        record their position in a source document, however this is unsafe as BOMs may lead to
+        m_position being an arbitrary position from the real position of the current character.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::matchPunctuator):
+
+2009-01-14  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 23153: JSC build always touches JavaScriptCore/docs/bytecode.html
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23153>
+
+        Reviewed by Darin Adler.
+
+        Instead of building bytecode.html into ${SRCROOT}/docs/bytecode.html, build it
+        into ${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore/docs/bytecode.html.
+
+        Also fixes make-bytecode-docs.pl to actually generate documentation.
+
+        * DerivedSources.make: Changed bytecode.html to be built into local docs
+        directory in ${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added "/docs" to the end of the
+        "mkdir -p" command so that the docs subdirectory is automatically created.
+        * docs/make-bytecode-docs.pl: Changed BEGIN_OPCODE to DEFINE_OPCODE so that
+        documentation is actually generated.
+
+2009-01-14  Adam Treat  <adam.treat@torchmobile.com>
+
+        Build fix for Qt from Dmitry Titov.
+
+        * wtf/ThreadingQt.cpp:
+        (WTF::ThreadCondition::timedWait):
+
+2009-01-14  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 22903: REGRESSION (r36267): visiting this site reliably crashes WebKit nightly
+
+        EvalCodeBlock's do not reference the functions that are declared inside the eval
+        code, this means that simply marking the EvalCodeBlock through the global object
+        is insufficient to mark the declared functions.  This patch corrects this by
+        explicitly marking the CodeBlocks of all the functions declared in the cached
+        EvalNode.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::mark):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::hasFunctions):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::mark):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNodeData::mark):
+        (JSC::EvalNode::mark):
+        * parser/Nodes.h:
+
+2009-01-14  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23312
+        Implement MessageQueue::waitForMessageTimed()
+        Also fixed ThreadCondition::timedWait() to take absolute time, as discussed on webkit-dev.
+        Win32 version of timedWait still has to be implemented.
+
+        * wtf/MessageQueue.h:
+        (WTF::MessageQueueWaitResult: new enum for the result of MessageQueue::waitForMessageTimed.
+        (WTF::MessageQueue::waitForMessage):
+        (WTF::MessageQueue::waitForMessageTimed): New method.
+        * wtf/Threading.h:
+        * wtf/ThreadingGtk.cpp:
+        (WTF::ThreadCondition::timedWait): changed to use absolute time instead of interval.
+        * wtf/ThreadingNone.cpp:
+        (WTF::ThreadCondition::timedWait): ditto.
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::ThreadCondition::timedWait): ditto.
+        * wtf/ThreadingQt.cpp:
+        (WTF::ThreadCondition::timedWait): ditto.
+        * wtf/ThreadingWin.cpp:
+        (WTF::ThreadCondition::timedWait): ditto. The actual Win32 code is still to be implemented.
+
+2009-01-14  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Darin Adler and Oliver hunt.
+
+        Correctly match allocation functions by implementing a custom deref().
+
+        https://bugs.webkit.org/show_bug.cgi?id=23315
+
+        * runtime/ByteArray.h:
+        (JSC::ByteArray::deref):
+        (JSC::ByteArray::ByteArray):
+
+2009-01-14  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - update copyright
+
+        * Info.plist:
+
+2009-01-13  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler and Oliver Hunt.
+
+        <rdar://problem/6489314> REGRESSION: Business widget's front side 
+        fails to render correctly when flipping widget
+
+        The problem here is that parseInt was parsing NaN as 0. This patch 
+        corrects that by parsing NaN as NaN. This matches our old behavior 
+        and Firefox. 
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+
+2009-01-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for: https://bugs.webkit.org/show_bug.cgi?id=23292
+
+        Implementation of two argument canDoFastAdditiveOperations does not correlate well with reality.
+
+        * runtime/JSImmediate.h:
+        (JSC::JSFastMath::canDoFastAdditiveOperations):
+
+2009-01-13  Zalan Bujtas  <zbujtas@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23290
+        Fix JSImmediate::isImmediate(src) to !src->isCell()
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2009-01-13  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23281
+        Fix the Chromium Win build.
+        Need to use PLATFORM(WIN_OS) instead of PLATFORM(WIN).
+        Moved GTK and WX up in #if sequence because they could come with WIN_OS too,
+        while they have their own implementation even on Windows.
+
+        * wtf/CurrentTime.cpp:
+        (WTF::currentTime):
+
+2009-01-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make the JSImmediate interface private.
+
+        All manipulation of JS values should be through the JSValuePtr class, not by using JSImmediate
+        directly.  The key missing methods on JSValuePtr are:
+
+            * isCell() - check for values that are JSCell*s, and as such where asCell() may be used.
+            * isInt32Fast() getInt32Fast() - fast check/access for integer immediates.
+            * isUInt32Fast() getUInt32Fast() - ditto for unsigned integer immediates.
+
+        The JIT is allowed full access to JSImmediate, since it needs to be able to directly
+        manipulate JSValuePtrs.  The Interpreter is provided access to perform operations directly
+        on JSValuePtrs through the new JSFastMath interface.
+
+        No performance impact.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::toNumber):
+        * API/JSValueRef.cpp:
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isKnownNotImmediate):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::keyForImmediateSwitch):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::JSValueHashTraits::constructDeletedValue):
+        (JSC::BytecodeGenerator::JSValueHashTraits::isDeletedValue):
+        * interpreter/Interpreter.cpp:
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAdd):
+        (JSC::jsIsObjectType):
+        (JSC::cachePrototypeChain):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::tryCTICachePutByID):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::Interpreter::cti_op_add):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list):
+        (JSC::Interpreter::cti_op_instanceof):
+        (JSC::Interpreter::cti_op_mul):
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_get_by_val_byte_array):
+        (JSC::Interpreter::cti_op_sub):
+        (JSC::Interpreter::cti_op_put_by_val):
+        (JSC::Interpreter::cti_op_put_by_val_array):
+        (JSC::Interpreter::cti_op_put_by_val_byte_array):
+        (JSC::Interpreter::cti_op_negate):
+        (JSC::Interpreter::cti_op_div):
+        (JSC::Interpreter::cti_op_eq):
+        (JSC::Interpreter::cti_op_lshift):
+        (JSC::Interpreter::cti_op_bitand):
+        (JSC::Interpreter::cti_op_rshift):
+        (JSC::Interpreter::cti_op_bitnot):
+        (JSC::Interpreter::cti_op_neq):
+        (JSC::Interpreter::cti_op_urshift):
+        (JSC::Interpreter::cti_op_call_eval):
+        (JSC::Interpreter::cti_op_throw):
+        (JSC::Interpreter::cti_op_is_undefined):
+        (JSC::Interpreter::cti_op_stricteq):
+        (JSC::Interpreter::cti_op_nstricteq):
+        (JSC::Interpreter::cti_op_switch_imm):
+        (JSC::Interpreter::cti_vm_throw):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::isJSArray):
+        (JSC::Interpreter::isJSString):
+        (JSC::Interpreter::isJSByteArray):
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        (JSC::JIT::isStrictEqCaseHandledInJITCode):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArith_op_bitand):
+        (JSC::JIT::compileFastArith_op_mod):
+        * jit/JITCall.cpp:
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::getConstantOperandImmediateInt):
+        (JSC::JIT::isOperandConstantImmediateInt):
+        * parser/Nodes.cpp:
+        (JSC::processClauseList):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/Collector.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::heap):
+        * runtime/JSByteArray.cpp:
+        (JSC::JSByteArray::getOwnPropertySlot):
+        * runtime/JSByteArray.h:
+        (JSC::JSByteArray::getIndex):
+        * runtime/JSCell.cpp:
+        * runtime/JSCell.h:
+        (JSC::JSValuePtr::isNumberCell):
+        (JSC::JSValuePtr::asCell):
+        (JSC::JSValuePtr::isNumber):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+        * runtime/JSImmediate.h:
+        (JSC::js0):
+        (JSC::jsImpossibleValue):
+        (JSC::JSValuePtr::toInt32):
+        (JSC::JSValuePtr::toUInt32):
+        (JSC::JSValuePtr::isCell):
+        (JSC::JSValuePtr::isInt32Fast):
+        (JSC::JSValuePtr::getInt32Fast):
+        (JSC::JSValuePtr::isUInt32Fast):
+        (JSC::JSValuePtr::getUInt32Fast):
+        (JSC::JSValuePtr::makeInt32Fast):
+        (JSC::JSValuePtr::areBothInt32Fast):
+        (JSC::JSFastMath::canDoFastBitwiseOperations):
+        (JSC::JSFastMath::equal):
+        (JSC::JSFastMath::notEqual):
+        (JSC::JSFastMath::andImmediateNumbers):
+        (JSC::JSFastMath::xorImmediateNumbers):
+        (JSC::JSFastMath::orImmediateNumbers):
+        (JSC::JSFastMath::canDoFastRshift):
+        (JSC::JSFastMath::canDoFastUrshift):
+        (JSC::JSFastMath::rightShiftImmediateNumbers):
+        (JSC::JSFastMath::canDoFastAdditiveOperations):
+        (JSC::JSFastMath::addImmediateNumbers):
+        (JSC::JSFastMath::subImmediateNumbers):
+        (JSC::JSFastMath::incImmediateNumber):
+        (JSC::JSFastMath::decImmediateNumber):
+        * runtime/JSNumberCell.h:
+        (JSC::JSValuePtr::asNumberCell):
+        (JSC::jsNumber):
+        (JSC::JSValuePtr::uncheckedGetNumber):
+        (JSC::JSNumberCell::toInt32):
+        (JSC::JSNumberCell::toUInt32):
+        (JSC::JSValuePtr::toJSNumber):
+        (JSC::JSValuePtr::getNumber):
+        (JSC::JSValuePtr::numberToInt32):
+        (JSC::JSValuePtr::numberToUInt32):
+        * runtime/JSObject.h:
+        (JSC::JSValuePtr::isObject):
+        (JSC::JSValuePtr::get):
+        (JSC::JSValuePtr::put):
+        * runtime/JSValue.cpp:
+        (JSC::JSValuePtr::toInteger):
+        (JSC::JSValuePtr::toIntegerPreserveNaN):
+        * runtime/JSValue.h:
+        * runtime/Operations.cpp:
+        (JSC::JSValuePtr::equalSlowCase):
+        (JSC::JSValuePtr::strictEqualSlowCase):
+        * runtime/Operations.h:
+        (JSC::JSValuePtr::equal):
+        (JSC::JSValuePtr::equalSlowCaseInline):
+        (JSC::JSValuePtr::strictEqual):
+        (JSC::JSValuePtr::strictEqualSlowCaseInline):
+        * runtime/Protect.h:
+        (JSC::gcProtect):
+        (JSC::gcUnprotect):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        * runtime/Structure.cpp:
+        (JSC::Structure::createCachedPrototypeChain):
+
+2009-01-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Since date time functions have moved here, now the wx port JSC
+        needs to depend on wx.
+
+        * jscore.bkl:
+
+2009-01-11  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23245
+
+        Add initializeThreading to key places in JS API to ensure that
+        UString is properly initialized.
+
+        * API/JSContextRef.cpp:
+        (JSContextGroupCreate):
+        (JSGlobalContextCreate):
+        * API/JSObjectRef.cpp:
+        (JSClassCreate):
+        * API/JSStringRef.cpp:
+        (JSStringCreateWithCharacters):
+        (JSStringCreateWithUTF8CString):
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+
+2009-01-11  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23175
+
+        Separate out BaseString information from UString::Rep and make all baseString access go through
+        a member function, so that it may be used for something else (in the future) in the BaseString
+        case.
+
+        * runtime/SmallStrings.cpp:
+        (JSC::SmallStringsStorage::rep):
+        (JSC::SmallStringsStorage::SmallStringsStorage):
+        (JSC::SmallStrings::SmallStrings):
+        (JSC::SmallStrings::mark):
+        Adjust to account for the changes in UString and put the UString in place in
+        SmallStringsStorage to aid in locality of reference among the UChar[] and UString::Rep's.
+
+        * runtime/SmallStrings.h:
+        * runtime/UString.cpp:
+        (JSC::initializeStaticBaseString):
+        (JSC::initializeUString):
+        (JSC::UString::Rep::create):
+        (JSC::UString::Rep::destroy):
+        (JSC::UString::Rep::checkConsistency):
+        (JSC::expandCapacity):
+        (JSC::UString::expandPreCapacity):
+        (JSC::concatenate):
+        (JSC::UString::append):
+        (JSC::UString::operator=):
+        * runtime/UString.h:
+        (JSC::UString::Rep::baseIsSelf):
+        (JSC::UString::Rep::setBaseString):
+        (JSC::UString::Rep::baseString):
+        (JSC::UString::Rep::):
+        (JSC::UString::Rep::null):
+        (JSC::UString::Rep::empty):
+        (JSC::UString::Rep::data):
+        (JSC::UString::cost):
+        Separate out the items out used by base strings from those used in Rep's that only
+        point to base strings.  (This potentially saves 24 bytes per Rep.)
+
+2009-01-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 23239: improve handling of unused arguments in JavaScriptCore
+        https://bugs.webkit.org/show_bug.cgi?id=23239
+
+        * runtime/DatePrototype.cpp: Moved LocaleDateTimeFormat enum outside #if
+        so we can use this on all platforms. Changed valueOf to share the same
+        function with getTime, since the contents of the two are identical. Removed
+        a FIXME since the idea isn't really specific enough or helpful enough to
+        need to sit here in the source code.
+        (JSC::formatLocaleDate): Changed the Mac version of this function to take
+        the same arguments as the non-Mac version so the caller doesn't have to
+        special-case the two platforms. Also made the formatString array be const;
+        before the characters were, but the array was a modifiable global variable.
+        (JSC::dateProtoFuncToLocaleString): Changed to call the new unified
+        version of formatLocaleDate and remove the ifdef.
+        (JSC::dateProtoFuncToLocaleDateString): Ditto.
+        (JSC::dateProtoFuncToLocaleTimeString): Ditto.
+
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::toObject): Use the new ASSERT_UNUSED instead of the
+        old UNUSED_PARAM.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp): Changed to only use UNUSED_PARAM when the parameter
+        is actually unused.
+
+        * wtf/TCSystemAlloc.cpp:
+        (TCMalloc_SystemRelease): Changed to only use UNUSED_PARAM when the parameter
+        is actually unused.
+        (TCMalloc_SystemCommit): Changed to omit the argument names instead of using
+        UNUSED_PARAM.
+
+2009-01-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix the build (whoops)
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_get_by_val):
+
+2009-01-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler and Anders Carlsson
+
+        Bug 23128: get/put_by_val need to respecialise in the face of ByteArray
+
+        Restructure the code slightly, and add comments per Darin's suggestions
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_get_by_val_byte_array):
+        (JSC::Interpreter::cti_op_put_by_val):
+        (JSC::Interpreter::cti_op_put_by_val_byte_array):
+
+2009-01-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Whoops, I accidentally removed an exception check from fast the
+        fast path for string indexing when i originally landed the
+        byte array logic.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_get_by_val):
+
+2009-01-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Bug 23128: get/put_by_val need to respecialise in the face of ByteArray
+        <https://bugs.webkit.org/show_bug.cgi?id=23128>
+
+        Fairly simple patch, add specialised versions of cti_op_get/put_by_val
+        that assume ByteArray, thus avoiding a few branches in the case of bytearray
+        manipulation.
+
+        No effect on SunSpider.  15% win on the original testcase.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_get_by_val_byte_array):
+        (JSC::Interpreter::cti_op_put_by_val):
+        (JSC::Interpreter::cti_op_put_by_val_byte_array):
+        * interpreter/Interpreter.h:
+
+2009-01-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Try to fix Windows build.
+
+        * wtf/CurrentTime.cpp: Added a definition of msPerSecond (previously, this code was in
+        DateMath.cpp, with constant definition in DateTime.h)
+
+2009-01-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Try to fix Windows build.
+
+        * wtf/CurrentTime.cpp: Include <sys/types.h> and <sys/timeb.h>, as MSDN says to.
+
+2009-01-11  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23207
+        Moved currentTime() to from WebCore to WTF.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp: added export for WTF::currentTime()
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * runtime/DateMath.cpp:
+        (JSC::getCurrentUTCTimeWithMicroseconds): This function had another implementation of currentTime(), essentially. Now uses WTF version.
+        * wtf/CurrentTime.cpp: Added.
+        (WTF::currentTime):
+        (WTF::highResUpTime):
+        (WTF::lowResUTCTime):
+        (WTF::qpcAvailable):
+        * wtf/CurrentTime.h: Added.
+
+2009-01-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Stage two of converting JSValue from a pointer to a class type.
+        Remove the class JSValue.  The functionallity has been transitioned
+        into the wrapper class type JSValuePtr.
+
+        The last stage will be to rename JSValuePtr to JSValue, remove the
+        overloaded -> operator, and switch operations on JSValuePtrs from
+        using '->' to use '.' instead.
+
+        * API/APICast.h:
+        * JavaScriptCore.exp:
+        * runtime/JSCell.h:
+        (JSC::asCell):
+        (JSC::JSValuePtr::asCell):
+        (JSC::JSValuePtr::isNumber):
+        (JSC::JSValuePtr::isString):
+        (JSC::JSValuePtr::isGetterSetter):
+        (JSC::JSValuePtr::isObject):
+        (JSC::JSValuePtr::getNumber):
+        (JSC::JSValuePtr::getString):
+        (JSC::JSValuePtr::getObject):
+        (JSC::JSValuePtr::getCallData):
+        (JSC::JSValuePtr::getConstructData):
+        (JSC::JSValuePtr::getUInt32):
+        (JSC::JSValuePtr::getTruncatedInt32):
+        (JSC::JSValuePtr::getTruncatedUInt32):
+        (JSC::JSValuePtr::mark):
+        (JSC::JSValuePtr::marked):
+        (JSC::JSValuePtr::toPrimitive):
+        (JSC::JSValuePtr::getPrimitiveNumber):
+        (JSC::JSValuePtr::toBoolean):
+        (JSC::JSValuePtr::toNumber):
+        (JSC::JSValuePtr::toString):
+        (JSC::JSValuePtr::toObject):
+        (JSC::JSValuePtr::toThisObject):
+        (JSC::JSValuePtr::needsThisConversion):
+        (JSC::JSValuePtr::toThisString):
+        (JSC::JSValuePtr::getJSNumber):
+        * runtime/JSImmediate.h:
+        (JSC::JSValuePtr::isUndefined):
+        (JSC::JSValuePtr::isNull):
+        (JSC::JSValuePtr::isUndefinedOrNull):
+        (JSC::JSValuePtr::isBoolean):
+        (JSC::JSValuePtr::getBoolean):
+        (JSC::JSValuePtr::toInt32):
+        (JSC::JSValuePtr::toUInt32):
+        * runtime/JSNumberCell.h:
+        (JSC::JSValuePtr::uncheckedGetNumber):
+        (JSC::JSValuePtr::toJSNumber):
+        * runtime/JSObject.h:
+        (JSC::JSValuePtr::isObject):
+        (JSC::JSValuePtr::get):
+        (JSC::JSValuePtr::put):
+        * runtime/JSString.h:
+        (JSC::JSValuePtr::toThisJSString):
+        * runtime/JSValue.cpp:
+        (JSC::JSValuePtr::toInteger):
+        (JSC::JSValuePtr::toIntegerPreserveNaN):
+        (JSC::JSValuePtr::toInt32SlowCase):
+        (JSC::JSValuePtr::toUInt32SlowCase):
+        * runtime/JSValue.h:
+        (JSC::JSValuePtr::makeImmediate):
+        (JSC::JSValuePtr::immediateValue):
+        (JSC::JSValuePtr::JSValuePtr):
+        (JSC::JSValuePtr::operator->):
+        (JSC::JSValuePtr::operator bool):
+        (JSC::JSValuePtr::operator==):
+        (JSC::JSValuePtr::operator!=):
+        (JSC::JSValuePtr::encode):
+        (JSC::JSValuePtr::decode):
+        (JSC::JSValuePtr::toFloat):
+        (JSC::JSValuePtr::asValue):
+        (JSC::operator==):
+        (JSC::operator!=):
+
+2009-01-09  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23175
+
+        Adjustment to previous patch.  Remove call to initilizeThreading from JSGlobalCreate
+        and fix jsc.cpp instead.
+
+        * jsc.cpp:
+        (main):
+        (jscmain):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::create):
+
+2009-01-09  Sam Weinig  <sam@webkit.org>
+
+        Roll r39720 back in with a working interpreted mode.
+
+2009-01-09  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23175
+
+        Added a template to make the pointer and flags combination
+        in UString more readable and less error prone.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Added PtrAndFlags.h (and sorted the xcode project file).
+
+        * runtime/Identifier.cpp:
+        (JSC::Identifier::add):
+        (JSC::Identifier::addSlowCase):
+        * runtime/InitializeThreading.cpp:
+        (JSC::initializeThreadingOnce):
+        Made the init threading initialize the UString globals.  Before
+        these were initilized using {} but that became harder due to the
+        addition of this tempalte class.
+
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::create):
+        * runtime/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * runtime/UString.cpp:
+        (JSC::initializeStaticBaseString):
+        (JSC::initializeUString):
+        (JSC::UString::Rep::create):
+        (JSC::UString::Rep::createFromUTF8):
+        (JSC::createRep):
+        (JSC::UString::UString):
+        (JSC::concatenate):
+        (JSC::UString::operator=):
+        (JSC::UString::makeNull):
+        (JSC::UString::nullRep):
+        * runtime/UString.h:
+        (JSC::UString::Rep::identifierTable):
+        (JSC::UString::Rep::setIdentifierTable):
+        (JSC::UString::Rep::isStatic):
+        (JSC::UString::Rep::setStatic):
+        (JSC::UString::Rep::):
+        (JSC::UString::Rep::null):
+        (JSC::UString::Rep::empty):
+        (JSC::UString::isNull):
+        (JSC::UString::null):
+        (JSC::UString::UString):
+
+        * wtf/PtrAndFlags.h: Added.
+        (WTF::PtrAndFlags::PtrAndFlags):
+        (WTF::PtrAndFlags::isFlagSet):
+        (WTF::PtrAndFlags::setFlag):
+        (WTF::PtrAndFlags::clearFlag):
+        (WTF::PtrAndFlags::get):
+        (WTF::PtrAndFlags::set):
+        A simple way to layer together a pointer and 2 flags.  It relies on the pointer being 4 byte aligned,
+        which should happen for all allocators (due to aligning pointers, int's, etc. on 4 byte boundaries).
+
+2009-01-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by -O-l-i-v-e-r- -H-u-n-t- Sam Weinig (sorry, Sam!).
+
+        Encode immediates in the low word of JSValuePtrs, on x86-64.
+
+        On 32-bit platforms a JSValuePtr may represent a 31-bit signed integer.
+        On 64-bit platforms, if USE(ALTERNATE_JSIMMEDIATE) is defined, a full
+        32-bit integer may be stored in an immediate.
+        
+        Presently USE(ALTERNATE_JSIMMEDIATE) uses the same encoding as the default
+        immediate format - the value is left shifted by one, so a one bit tag can
+        be added to indicate the value is an immediate.  However this means that
+        values must be commonly be detagged (by right shifting by one) before
+        arithmetic operations can be performed on immediates.  This patch modifies
+        the formattting so the the high bits of the immediate mark values as being
+        integer.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::not32):
+        (JSC::MacroAssembler::orPtr):
+        (JSC::MacroAssembler::zeroExtend32ToPtr):
+        (JSC::MacroAssembler::jaePtr):
+        (JSC::MacroAssembler::jbPtr):
+        (JSC::MacroAssembler::jnzPtr):
+        (JSC::MacroAssembler::jzPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::notl_r):
+        (JSC::X86Assembler::testq_i32r):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_lshift):
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArith_op_bitand):
+        (JSC::JIT::compileFastArithSlow_op_bitand):
+        (JSC::JIT::compileFastArith_op_mod):
+        (JSC::JIT::compileFastArithSlow_op_mod):
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        (JSC::JIT::compileFastArith_op_post_inc):
+        (JSC::JIT::compileFastArith_op_post_dec):
+        (JSC::JIT::compileFastArith_op_pre_inc):
+        (JSC::JIT::compileFastArith_op_pre_dec):
+        (JSC::JIT::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::JIT::compileBinaryArithOp):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpIfJSCell):
+        (JSC::JIT::emitJumpIfNotJSCell):
+        (JSC::JIT::emitJumpIfImmNum):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmNum):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmNums):
+        (JSC::JIT::emitFastArithDeTagImmediate):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::JIT::emitFastArithReTagImmediate):
+        (JSC::JIT::emitFastArithImmToInt):
+        (JSC::JIT::emitFastArithIntToImmNoCheck):
+        (JSC::JIT::emitTagAsBoolImmediate):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::resizePropertyStorage):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        * runtime/JSImmediate.h:
+        (JSC::JSImmediate::isNumber):
+        (JSC::JSImmediate::isPositiveNumber):
+        (JSC::JSImmediate::areBothImmediateNumbers):
+        (JSC::JSImmediate::xorImmediateNumbers):
+        (JSC::JSImmediate::rightShiftImmediateNumbers):
+        (JSC::JSImmediate::canDoFastAdditiveOperations):
+        (JSC::JSImmediate::addImmediateNumbers):
+        (JSC::JSImmediate::subImmediateNumbers):
+        (JSC::JSImmediate::makeInt):
+        (JSC::JSImmediate::toBoolean):
+        * wtf/Platform.h:
+
+2009-01-08  Sam Weinig  <sam@webkit.org>
+
+        Revert r39720. It broke Interpreted mode.
+
+2009-01-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23197
+        Delay creating the PCVector until an exception is thrown
+        Part of <rdar://problem/6469060>
+        Don't store exception information for a CodeBlock until first exception is thrown
+
+        - Change the process for re-parsing/re-generating bytecode for exception information
+          to use data from the original CodeBlock (offsets of GlobalResolve instructions) to
+          aid in creating an identical instruction stream on re-parse, instead of padding
+          interchangeable opcodes, which would result in different JITed code.
+        - Fix bug where the wrong ScopeChainNode was used when re-parsing/regenerating from
+          within some odd modified scope chains.
+        - Lazily create the pcVector by re-JITing the regenerated CodeBlock and stealing the
+          the pcVector from it.
+
+        Saves ~2MB on Membuster head.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::hasGlobalResolveInstructionAtBytecodeOffset):
+        (JSC::CodeBlock::hasGlobalResolveInfoAtBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::JITCodeRef::JITCodeRef):
+        (JSC::GlobalResolveInfo::GlobalResolveInfo):
+        (JSC::CodeBlock::getBytecodeIndex):
+        (JSC::CodeBlock::addGlobalResolveInstruction):
+        (JSC::CodeBlock::addGlobalResolveInfo):
+        (JSC::CodeBlock::addFunctionRegisterInfo):
+        (JSC::CodeBlock::hasExceptionInfo):
+        (JSC::CodeBlock::pcVector):
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+        (JSC::EvalCodeBlock::baseScopeDepth):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitGetScopedVar):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::setRegeneratingForExceptionInfo):
+        * interpreter/Interpreter.cpp:
+        (JSC::bytecodeOffsetForPC):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveLastCaller):
+        (JSC::Interpreter::cti_op_instanceof):
+        (JSC::Interpreter::cti_op_call_NotJSFunction):
+        (JSC::Interpreter::cti_op_resolve):
+        (JSC::Interpreter::cti_op_construct_NotJSConstruct):
+        (JSC::Interpreter::cti_op_resolve_func):
+        (JSC::Interpreter::cti_op_resolve_skip):
+        (JSC::Interpreter::cti_op_resolve_global):
+        (JSC::Interpreter::cti_op_resolve_with_base):
+        (JSC::Interpreter::cti_op_throw):
+        (JSC::Interpreter::cti_op_in):
+        (JSC::Interpreter::cti_vm_throw):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        * parser/Nodes.cpp:
+        (JSC::EvalNode::generateBytecode):
+        (JSC::EvalNode::bytecodeForExceptionInfoReparse):
+        (JSC::FunctionBodyNode::bytecodeForExceptionInfoReparse):
+        * parser/Nodes.h:
+
+2009-01-08  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add Win32 implementation of ThreadSpecific.
+        https://bugs.webkit.org/show_bug.cgi?id=22614
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * wtf/ThreadSpecific.h:
+        (WTF::ThreadSpecific::ThreadSpecific):
+        (WTF::ThreadSpecific::~ThreadSpecific):
+        (WTF::ThreadSpecific::get):
+        (WTF::ThreadSpecific::set):
+        (WTF::ThreadSpecific::destroy):
+        * wtf/ThreadSpecificWin.cpp: Added.
+        (WTF::ThreadSpecificThreadExit):
+        * wtf/ThreadingWin.cpp:
+        (WTF::wtfThreadEntryPoint):
+
+2009-01-08  Justin McPherson <justin.mcpherson@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compilation with Qt on NetBSD.
+
+        * runtime/Collector.cpp:
+        (JSC::currentThreadStackBase): Use PLATFORM(NETBSD) to enter the
+        code path to retrieve the stack base using pthread_attr_get_np.
+        The PTHREAD_NP_H define is not used because the header file does
+        not exist on NetBSD, but the function is declared nevertheless.
+        * wtf/Platform.h: Introduce WTF_PLATFORM_NETBSD.
+
+2009-01-07  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        <rdar://problem/6469060> Don't store exception information for a CodeBlock until first exception is thrown
+
+        Don't initially store exception information (lineNumber/expressionRange/getByIdExcecptionInfo)
+        in CodeBlocks blocks.  Instead, re-parse for the data on demand and cache it then.
+
+        One important change that was needed to make this work was to pad op_get_global_var with nops to
+        be the same length as op_resolve_global, since one could be replaced for the other on re-parsing,
+        and we want to keep the offsets bytecode offsets the same.
+
+        1.3MB improvement on Membuster head.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Update op_get_global_var to account for the padding.
+        (JSC::CodeBlock::dumpStatistics): Add more statistic dumping.
+        (JSC::CodeBlock::CodeBlock): Initialize m_exceptionInfo.
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary): Re-parses the CodeBlocks
+        associated SourceCode and steals the ExceptionInfo from it.
+        (JSC::CodeBlock::lineNumberForBytecodeOffset): Creates the exception info on demand.
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset): Ditto.
+        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset): Ditto.
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::numberOfExceptionHandlers): Updated to account for m_exceptionInfo indirection.
+        (JSC::CodeBlock::addExceptionHandler): Ditto.
+        (JSC::CodeBlock::exceptionHandler): Ditto.
+        (JSC::CodeBlock::clearExceptionInfo): Ditto.
+        (JSC::CodeBlock::addExpressionInfo): Ditto.
+        (JSC::CodeBlock::addGetByIdExceptionInfo): Ditto.
+        (JSC::CodeBlock::numberOfLineInfos): Ditto.
+        (JSC::CodeBlock::addLineInfo): Ditto.
+        (JSC::CodeBlock::lastLineInfo): Ditto.
+
+        * bytecode/Opcode.h: Change length of op_get_global_var to match op_resolve_global.
+
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::dump): Add comment indicating why it is okay not to pass a CallFrame.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate): Clear the exception info after generation for Function and Eval
+        Code when not in regenerate for exception info mode.
+        (JSC::BytecodeGenerator::BytecodeGenerator): Initialize m_regeneratingForExceptionInfo to false.
+        (JSC::BytecodeGenerator::emitGetScopedVar): Pad op_get_global_var with 2 nops.
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::setRegeneratingForExcpeptionInfo): Added.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException): Pass the CallFrame to exception info accessors.
+        (JSC::Interpreter::privateExecute): Ditto.
+        (JSC::Interpreter::retrieveLastCaller): Ditto.
+        (JSC::Interpreter::cti_op_new_error): Ditto.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass): Pass the current bytecode offset instead of hard coding the
+        line number, the stub will do the accessing if it gets called.
+
+        * parser/Nodes.cpp:
+        (JSC::ProgramNode::emitBytecode): Moved.
+        (JSC::ProgramNode::generateBytecode): Moved.
+        (JSC::EvalNode::create): Moved.
+        (JSC::EvalNode::bytecodeForExceptionInfoReparse): Added.
+        (JSC::FunctionBodyNode::generateBytecode): Rename reparse to reparseInPlace.
+        (JSC::FunctionBodyNode::bytecodeForExceptionInfoReparse): Addded.
+
+        * parser/Nodes.h:
+        (JSC::ScopeNode::features): Added getter.
+        * parser/Parser.cpp:
+        (JSC::Parser::reparseInPlace): Renamed from reparse.
+        * parser/Parser.h:
+        (JSC::Parser::reparse): Added. Re-parses the passed in Node into
+        a new Node.
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError): Pass along CallFrame.
+        (JSC::createInvalidParamError): Ditto.
+        (JSC::createNotAConstructorError): Ditto.
+        (JSC::createNotAFunctionError): Ditto.
+        (JSC::createNotAnObjectError): Ditto.
+
+2009-01-06  Gavin Barraclough  <baraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Replace accidentally removed references in BytecodeGenerator, deleting these
+        will be hindering the sharing of constant numbers and strings.
+
+        The code to add a new constant (either number or string) to their respective
+        map works by attempting to add a null entry, then checking the result of the
+        add for null.  The first time, this should return the null (or noValue).
+        The code checks for null (to see if this is the initial add), and then allocates
+        a new number / string object.  This code relies on the result returned from
+        the add to the map being stored as a reference, such that the allocated object
+        will be stored in the map, and will be resused if the same constant is encountered
+        again.  By failing to use a reference we will be leaking GC object for each
+        additional entry added to the map.  As GC objects they should be clollected,
+        be we should no be allocatin them in the first place.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23158
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitLoad):
+
+2009-01-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/6040850> JavaScript register file should use VirtualAlloc on Windows
+
+        Fairly simple, just reserve 4Mb of address space for the
+        register file, and then commit one section at a time.  We
+        don't release committed memory as we drop back, but then
+        mac doesn't either so this probably not too much of a 
+        problem.
+
+        * interpreter/RegisterFile.cpp:
+        (JSC::RegisterFile::~RegisterFile):
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::grow):
+
+2009-01-06  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23142
+        ThreadGlobalData leaks seen on buildbot
+
+        * wtf/ThreadSpecific.h: (WTF::ThreadSpecific::destroy): Temporarily reset the thread
+        specific value to make getter work on Mac OS X.
+
+        * wtf/Platform.h: Touch this file again to make sure all Windows builds use the most recent
+        version of ThreadSpecific.h.
+
+2009-01-05  Gavin Barraclough  <baraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Replace all uses of JSValue* with a new smart pointer type, JSValuePtr.
+        
+        A JavaScript value may be a heap object or boxed primitive, represented by a
+        pointer, or may be an unboxed immediate value, such as an integer.  Since a
+        value may dynamically need to contain either a pointer value or an immediate,
+        we encode immediates as pointer values (since all valid JSCell pointers are
+        allocated at alligned addesses, unaligned addresses are available to encode
+        immediates).  As such all JavaScript values are represented using a JSValue*.
+
+        This implementation is encumbered by a number of constraints.  It ties the
+        JSValue representation to the size of pointer on the platform, which, for
+        example, means that we currently can represent different ranges of integers
+        as immediates on x86 and x86-64.  It also prevents us from overloading the
+        to-boolean conversion used to test for noValue() - effectively forcing us
+        to represent noValue() as 0.  This would potentially be problematic were we
+        to wish to encode integer values differently (e.g. were we to use the v8
+        encoding, where pointers are tagged with 1 and integers with 0, then the
+        immediate integer 0 would conflict with noValue()).
+
+        This patch replaces all usage of JSValue* with a new class, JSValuePtr,
+        which encapsulates the pointer.  JSValuePtr maintains the same interface as
+        JSValue*, overloading operator-> and operator bool such that previous
+        operations in the code on variables of type JSValue* are still supported.
+
+        In order to provide a ProtectPtr<> type with support for the new value
+        representation (without using the internal JSValue type directly), a new
+        ProtectJSValuePtr type has been added, equivalent to the previous type
+        ProtectPtr<JSValue>.
+
+        This patch is likely the first in a sequence of three changes.  With the
+        value now encapsulated it will likely make sense to migrate the functionality
+        from JSValue into JSValuePtr, such that the internal pointer representation
+        need not be exposed.  Through migrating the functionality to the wrapper
+        class the existing JSValue should be rendered redundant, and the class is
+        likely to be removed (the JSValuePtr now wrapping a pointer to a JSCell).
+        At this stage it will likely make sense to rename JSValuePtr to JSValue.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23114
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::call):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::asCallbackObject):
+        (JSC::::put):
+        (JSC::::hasInstance):
+        (JSC::::call):
+        (JSC::::staticValueGetter):
+        (JSC::::staticFunctionGetter):
+        (JSC::::callbackGetter):
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor):
+        (JSObjectSetPrototype):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        (JSValueIsUndefined):
+        (JSValueIsNull):
+        (JSValueIsBoolean):
+        (JSValueIsNumber):
+        (JSValueIsString):
+        (JSValueIsObject):
+        (JSValueIsObjectOfClass):
+        (JSValueIsEqual):
+        (JSValueIsStrictEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueToBoolean):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * JavaScriptCore.exp:
+        * bytecode/CodeBlock.cpp:
+        (JSC::valueToSourceString):
+        (JSC::constantName):
+        (JSC::CodeBlock::dump):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::getConstant):
+        (JSC::CodeBlock::addUnexpectedConstant):
+        (JSC::CodeBlock::unexpectedConstant):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::addUnexpectedConstant):
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::emitLoadJSV):
+        (JSC::BytecodeGenerator::emitGetScopedVar):
+        (JSC::BytecodeGenerator::emitPutScopedVar):
+        (JSC::BytecodeGenerator::emitNewError):
+        (JSC::keyForImmediateSwitch):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::JSValueHashTraits::constructDeletedValue):
+        (JSC::BytecodeGenerator::JSValueHashTraits::isDeletedValue):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * debugger/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::DebuggerCallFrame):
+        (JSC::DebuggerCallFrame::exception):
+        * interpreter/CallFrame.cpp:
+        (JSC::CallFrame::thisValue):
+        * interpreter/CallFrame.h:
+        (JSC::ExecState::setException):
+        (JSC::ExecState::exception):
+        (JSC::ExecState::exceptionSlot):
+        (JSC::ExecState::hadException):
+        * interpreter/Interpreter.cpp:
+        (JSC::fastIsNumber):
+        (JSC::fastToInt32):
+        (JSC::fastToUInt32):
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAddSlowCase):
+        (JSC::jsAdd):
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        (JSC::jsIsFunctionType):
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::inlineResolveBase):
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::resolveBaseAndFunc):
+        (JSC::isNotObject):
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::checkTimeout):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::cachePrototypeChain):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::countPrototypeChainEntriesAndCheckForProxies):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        (JSC::Interpreter::retrieveCaller):
+        (JSC::Interpreter::retrieveLastCaller):
+        (JSC::Interpreter::tryCTICachePutByID):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::returnToThrowTrampoline):
+        (JSC::Interpreter::cti_op_convert_this):
+        (JSC::Interpreter::cti_op_add):
+        (JSC::Interpreter::cti_op_pre_inc):
+        (JSC::Interpreter::cti_op_loop_if_less):
+        (JSC::Interpreter::cti_op_loop_if_lesseq):
+        (JSC::Interpreter::cti_op_get_by_id_generic):
+        (JSC::Interpreter::cti_op_get_by_id):
+        (JSC::Interpreter::cti_op_get_by_id_second):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list_full):
+        (JSC::Interpreter::cti_op_get_by_id_proto_fail):
+        (JSC::Interpreter::cti_op_get_by_id_array_fail):
+        (JSC::Interpreter::cti_op_get_by_id_string_fail):
+        (JSC::Interpreter::cti_op_instanceof):
+        (JSC::Interpreter::cti_op_del_by_id):
+        (JSC::Interpreter::cti_op_mul):
+        (JSC::Interpreter::cti_op_call_NotJSFunction):
+        (JSC::Interpreter::cti_op_resolve):
+        (JSC::Interpreter::cti_op_construct_NotJSConstruct):
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_resolve_func):
+        (JSC::Interpreter::cti_op_sub):
+        (JSC::Interpreter::cti_op_put_by_val):
+        (JSC::Interpreter::cti_op_put_by_val_array):
+        (JSC::Interpreter::cti_op_lesseq):
+        (JSC::Interpreter::cti_op_loop_if_true):
+        (JSC::Interpreter::cti_op_negate):
+        (JSC::Interpreter::cti_op_resolve_base):
+        (JSC::Interpreter::cti_op_resolve_skip):
+        (JSC::Interpreter::cti_op_resolve_global):
+        (JSC::Interpreter::cti_op_div):
+        (JSC::Interpreter::cti_op_pre_dec):
+        (JSC::Interpreter::cti_op_jless):
+        (JSC::Interpreter::cti_op_not):
+        (JSC::Interpreter::cti_op_jtrue):
+        (JSC::Interpreter::cti_op_post_inc):
+        (JSC::Interpreter::cti_op_eq):
+        (JSC::Interpreter::cti_op_lshift):
+        (JSC::Interpreter::cti_op_bitand):
+        (JSC::Interpreter::cti_op_rshift):
+        (JSC::Interpreter::cti_op_bitnot):
+        (JSC::Interpreter::cti_op_resolve_with_base):
+        (JSC::Interpreter::cti_op_mod):
+        (JSC::Interpreter::cti_op_less):
+        (JSC::Interpreter::cti_op_neq):
+        (JSC::Interpreter::cti_op_post_dec):
+        (JSC::Interpreter::cti_op_urshift):
+        (JSC::Interpreter::cti_op_bitxor):
+        (JSC::Interpreter::cti_op_bitor):
+        (JSC::Interpreter::cti_op_call_eval):
+        (JSC::Interpreter::cti_op_throw):
+        (JSC::Interpreter::cti_op_next_pname):
+        (JSC::Interpreter::cti_op_typeof):
+        (JSC::Interpreter::cti_op_is_undefined):
+        (JSC::Interpreter::cti_op_is_boolean):
+        (JSC::Interpreter::cti_op_is_number):
+        (JSC::Interpreter::cti_op_is_string):
+        (JSC::Interpreter::cti_op_is_object):
+        (JSC::Interpreter::cti_op_is_function):
+        (JSC::Interpreter::cti_op_stricteq):
+        (JSC::Interpreter::cti_op_nstricteq):
+        (JSC::Interpreter::cti_op_to_jsnumber):
+        (JSC::Interpreter::cti_op_in):
+        (JSC::Interpreter::cti_op_switch_imm):
+        (JSC::Interpreter::cti_op_switch_char):
+        (JSC::Interpreter::cti_op_switch_string):
+        (JSC::Interpreter::cti_op_del_by_val):
+        (JSC::Interpreter::cti_op_new_error):
+        (JSC::Interpreter::cti_vm_throw):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::isJSArray):
+        (JSC::Interpreter::isJSString):
+        * interpreter/Register.h:
+        (JSC::Register::):
+        (JSC::Register::Register):
+        (JSC::Register::jsValue):
+        (JSC::Register::getJSValue):
+        * jit/JIT.cpp:
+        (JSC::):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        (JSC::):
+        (JSC::JIT::execute):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+        * jit/JITCall.cpp:
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetVirtualRegister):
+        (JSC::JIT::getConstantOperand):
+        (JSC::JIT::isOperandConstant31BitImmediateInt):
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        (JSC::JIT::emitInitRegister):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::resizePropertyStorage):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        * jsc.cpp:
+        (functionPrint):
+        (functionDebug):
+        (functionGC):
+        (functionVersion):
+        (functionRun):
+        (functionLoad):
+        (functionReadline):
+        (functionQuit):
+        * parser/Nodes.cpp:
+        (JSC::NullNode::emitBytecode):
+        (JSC::ArrayNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::VoidNode::emitBytecode):
+        (JSC::ConstDeclNode::emitCodeSingle):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::processClauseList):
+        (JSC::EvalNode::emitBytecode):
+        (JSC::FunctionBodyNode::emitBytecode):
+        (JSC::ProgramNode::emitBytecode):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::willExecute):
+        (JSC::Profiler::didExecute):
+        (JSC::Profiler::createCallIdentifier):
+        * profiler/Profiler.h:
+        * runtime/ArgList.cpp:
+        (JSC::ArgList::slowAppend):
+        * runtime/ArgList.h:
+        (JSC::ArgList::at):
+        (JSC::ArgList::append):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::put):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        (JSC::asArguments):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::callArrayConstructor):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::getProperty):
+        (JSC::putProperty):
+        (JSC::arrayProtoFuncToString):
+        (JSC::arrayProtoFuncToLocaleString):
+        (JSC::arrayProtoFuncJoin):
+        (JSC::arrayProtoFuncConcat):
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        (JSC::arrayProtoFuncReverse):
+        (JSC::arrayProtoFuncShift):
+        (JSC::arrayProtoFuncSlice):
+        (JSC::arrayProtoFuncSort):
+        (JSC::arrayProtoFuncSplice):
+        (JSC::arrayProtoFuncUnShift):
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncMap):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncForEach):
+        (JSC::arrayProtoFuncSome):
+        (JSC::arrayProtoFuncIndexOf):
+        (JSC::arrayProtoFuncLastIndexOf):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::callBooleanConstructor):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * runtime/BooleanConstructor.h:
+        * runtime/BooleanObject.h:
+        (JSC::asBooleanObject):
+        * runtime/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString):
+        (JSC::booleanProtoFuncValueOf):
+        * runtime/CallData.cpp:
+        (JSC::call):
+        * runtime/CallData.h:
+        * runtime/Collector.cpp:
+        (JSC::Heap::protect):
+        (JSC::Heap::unprotect):
+        (JSC::Heap::heap):
+        (JSC::Heap::collect):
+        * runtime/Collector.h:
+        * runtime/Completion.cpp:
+        (JSC::evaluate):
+        * runtime/Completion.h:
+        (JSC::Completion::Completion):
+        (JSC::Completion::value):
+        (JSC::Completion::setValue):
+        (JSC::Completion::isValueCompletion):
+        * runtime/ConstructData.cpp:
+        (JSC::construct):
+        * runtime/ConstructData.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::constructDate):
+        (JSC::callDate):
+        (JSC::dateParse):
+        (JSC::dateNow):
+        (JSC::dateUTC):
+        * runtime/DateInstance.h:
+        (JSC::asDateInstance):
+        * runtime/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString):
+        (JSC::dateProtoFuncToUTCString):
+        (JSC::dateProtoFuncToDateString):
+        (JSC::dateProtoFuncToTimeString):
+        (JSC::dateProtoFuncToLocaleString):
+        (JSC::dateProtoFuncToLocaleDateString):
+        (JSC::dateProtoFuncToLocaleTimeString):
+        (JSC::dateProtoFuncValueOf):
+        (JSC::dateProtoFuncGetTime):
+        (JSC::dateProtoFuncGetFullYear):
+        (JSC::dateProtoFuncGetUTCFullYear):
+        (JSC::dateProtoFuncToGMTString):
+        (JSC::dateProtoFuncGetMonth):
+        (JSC::dateProtoFuncGetUTCMonth):
+        (JSC::dateProtoFuncGetDate):
+        (JSC::dateProtoFuncGetUTCDate):
+        (JSC::dateProtoFuncGetDay):
+        (JSC::dateProtoFuncGetUTCDay):
+        (JSC::dateProtoFuncGetHours):
+        (JSC::dateProtoFuncGetUTCHours):
+        (JSC::dateProtoFuncGetMinutes):
+        (JSC::dateProtoFuncGetUTCMinutes):
+        (JSC::dateProtoFuncGetSeconds):
+        (JSC::dateProtoFuncGetUTCSeconds):
+        (JSC::dateProtoFuncGetMilliSeconds):
+        (JSC::dateProtoFuncGetUTCMilliseconds):
+        (JSC::dateProtoFuncGetTimezoneOffset):
+        (JSC::dateProtoFuncSetTime):
+        (JSC::setNewValueFromTimeArgs):
+        (JSC::setNewValueFromDateArgs):
+        (JSC::dateProtoFuncSetMilliSeconds):
+        (JSC::dateProtoFuncSetUTCMilliseconds):
+        (JSC::dateProtoFuncSetSeconds):
+        (JSC::dateProtoFuncSetUTCSeconds):
+        (JSC::dateProtoFuncSetMinutes):
+        (JSC::dateProtoFuncSetUTCMinutes):
+        (JSC::dateProtoFuncSetHours):
+        (JSC::dateProtoFuncSetUTCHours):
+        (JSC::dateProtoFuncSetDate):
+        (JSC::dateProtoFuncSetUTCDate):
+        (JSC::dateProtoFuncSetMonth):
+        (JSC::dateProtoFuncSetUTCMonth):
+        (JSC::dateProtoFuncSetFullYear):
+        (JSC::dateProtoFuncSetUTCFullYear):
+        (JSC::dateProtoFuncSetYear):
+        (JSC::dateProtoFuncGetYear):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::callErrorConstructor):
+        * runtime/ErrorPrototype.cpp:
+        (JSC::errorProtoFuncToString):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createInterruptedExecutionException):
+        (JSC::createError):
+        (JSC::createStackOverflowError):
+        (JSC::createUndefinedVariableError):
+        (JSC::createErrorMessage):
+        (JSC::createInvalidParamError):
+        (JSC::createNotAConstructorError):
+        (JSC::createNotAFunctionError):
+        * runtime/ExceptionHelpers.h:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::callFunctionConstructor):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::callFunctionPrototype):
+        (JSC::functionProtoFuncToString):
+        (JSC::functionProtoFuncApply):
+        (JSC::functionProtoFuncCall):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GetterSetter.cpp:
+        (JSC::GetterSetter::toPrimitive):
+        (JSC::GetterSetter::getPrimitiveNumber):
+        * runtime/GetterSetter.h:
+        (JSC::asGetterSetter):
+        * runtime/InitializeThreading.cpp:
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        (JSC::asInternalFunction):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::getOwnPropertySlot):
+        (JSC::JSActivation::put):
+        (JSC::JSActivation::putWithAttributes):
+        (JSC::JSActivation::argumentsGetter):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        (JSC::asActivation):
+        * runtime/JSArray.cpp:
+        (JSC::storageSize):
+        (JSC::JSArray::JSArray):
+        (JSC::JSArray::getOwnPropertySlot):
+        (JSC::JSArray::put):
+        (JSC::JSArray::putSlowCase):
+        (JSC::JSArray::deleteProperty):
+        (JSC::JSArray::getPropertyNames):
+        (JSC::JSArray::setLength):
+        (JSC::JSArray::pop):
+        (JSC::JSArray::push):
+        (JSC::JSArray::mark):
+        (JSC::JSArray::sort):
+        (JSC::JSArray::compactForSorting):
+        (JSC::JSArray::checkConsistency):
+        (JSC::constructArray):
+        * runtime/JSArray.h:
+        (JSC::JSArray::getIndex):
+        (JSC::JSArray::setIndex):
+        (JSC::JSArray::createStructure):
+        (JSC::asArray):
+        * runtime/JSCell.cpp:
+        (JSC::JSCell::put):
+        (JSC::JSCell::getJSNumber):
+        * runtime/JSCell.h:
+        (JSC::asCell):
+        (JSC::JSValue::asCell):
+        (JSC::JSValue::toPrimitive):
+        (JSC::JSValue::getPrimitiveNumber):
+        (JSC::JSValue::getJSNumber):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::put):
+        (JSC::JSFunction::construct):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::createStructure):
+        (JSC::asFunction):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::put):
+        (JSC::JSGlobalObject::putWithAttributes):
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::resetPrototype):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructure):
+        (JSC::JSGlobalObject::GlobalPropertyInfo::GlobalPropertyInfo):
+        (JSC::asGlobalObject):
+        (JSC::Structure::prototypeForLookup):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::decode):
+        (JSC::globalFuncEval):
+        (JSC::globalFuncParseInt):
+        (JSC::globalFuncParseFloat):
+        (JSC::globalFuncIsNaN):
+        (JSC::globalFuncIsFinite):
+        (JSC::globalFuncDecodeURI):
+        (JSC::globalFuncDecodeURIComponent):
+        (JSC::globalFuncEncodeURI):
+        (JSC::globalFuncEncodeURIComponent):
+        (JSC::globalFuncEscape):
+        (JSC::globalFuncUnescape):
+        (JSC::globalFuncJSCPrint):
+        * runtime/JSGlobalObjectFunctions.h:
+        * runtime/JSImmediate.cpp:
+        (JSC::JSImmediate::toThisObject):
+        (JSC::JSImmediate::toObject):
+        (JSC::JSImmediate::prototype):
+        (JSC::JSImmediate::toString):
+        * runtime/JSImmediate.h:
+        (JSC::JSImmediate::isImmediate):
+        (JSC::JSImmediate::isNumber):
+        (JSC::JSImmediate::isPositiveNumber):
+        (JSC::JSImmediate::isBoolean):
+        (JSC::JSImmediate::isUndefinedOrNull):
+        (JSC::JSImmediate::isNegative):
+        (JSC::JSImmediate::isEitherImmediate):
+        (JSC::JSImmediate::isAnyImmediate):
+        (JSC::JSImmediate::areBothImmediate):
+        (JSC::JSImmediate::areBothImmediateNumbers):
+        (JSC::JSImmediate::andImmediateNumbers):
+        (JSC::JSImmediate::xorImmediateNumbers):
+        (JSC::JSImmediate::orImmediateNumbers):
+        (JSC::JSImmediate::rightShiftImmediateNumbers):
+        (JSC::JSImmediate::canDoFastAdditiveOperations):
+        (JSC::JSImmediate::addImmediateNumbers):
+        (JSC::JSImmediate::subImmediateNumbers):
+        (JSC::JSImmediate::incImmediateNumber):
+        (JSC::JSImmediate::decImmediateNumber):
+        (JSC::JSImmediate::makeValue):
+        (JSC::JSImmediate::makeInt):
+        (JSC::JSImmediate::makeBool):
+        (JSC::JSImmediate::makeUndefined):
+        (JSC::JSImmediate::makeNull):
+        (JSC::JSImmediate::intValue):
+        (JSC::JSImmediate::uintValue):
+        (JSC::JSImmediate::boolValue):
+        (JSC::JSImmediate::rawValue):
+        (JSC::JSImmediate::trueImmediate):
+        (JSC::JSImmediate::falseImmediate):
+        (JSC::JSImmediate::undefinedImmediate):
+        (JSC::JSImmediate::nullImmediate):
+        (JSC::JSImmediate::zeroImmediate):
+        (JSC::JSImmediate::oneImmediate):
+        (JSC::JSImmediate::impossibleValue):
+        (JSC::JSImmediate::toBoolean):
+        (JSC::JSImmediate::getTruncatedUInt32):
+        (JSC::JSImmediate::from):
+        (JSC::JSImmediate::getTruncatedInt32):
+        (JSC::JSImmediate::toDouble):
+        (JSC::JSImmediate::getUInt32):
+        (JSC::jsNull):
+        (JSC::jsBoolean):
+        (JSC::jsUndefined):
+        (JSC::JSValue::isUndefined):
+        (JSC::JSValue::isNull):
+        (JSC::JSValue::isUndefinedOrNull):
+        (JSC::JSValue::isBoolean):
+        (JSC::JSValue::getBoolean):
+        (JSC::JSValue::toInt32):
+        (JSC::JSValue::toUInt32):
+        (JSC::toInt32):
+        (JSC::toUInt32):
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::toPrimitive):
+        (JSC::JSNotAnObject::getPrimitiveNumber):
+        (JSC::JSNotAnObject::put):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSNumberCell.cpp:
+        (JSC::JSNumberCell::toPrimitive):
+        (JSC::JSNumberCell::getPrimitiveNumber):
+        (JSC::JSNumberCell::getJSNumber):
+        (JSC::jsNumberCell):
+        (JSC::jsNaN):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure):
+        (JSC::asNumberCell):
+        (JSC::jsNumber):
+        (JSC::JSValue::toJSNumber):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::mark):
+        (JSC::JSObject::put):
+        (JSC::JSObject::putWithAttributes):
+        (JSC::callDefaultValueFunction):
+        (JSC::JSObject::getPrimitiveNumber):
+        (JSC::JSObject::defaultValue):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::lookupGetter):
+        (JSC::JSObject::lookupSetter):
+        (JSC::JSObject::hasInstance):
+        (JSC::JSObject::toNumber):
+        (JSC::JSObject::toString):
+        (JSC::JSObject::fillGetterPropertySlot):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::offsetForLocation):
+        (JSC::JSObject::locationForOffset):
+        (JSC::JSObject::getDirectOffset):
+        (JSC::JSObject::putDirectOffset):
+        (JSC::JSObject::createStructure):
+        (JSC::asObject):
+        (JSC::JSObject::prototype):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSObject::getOwnPropertySlotForWrite):
+        (JSC::JSObject::getPropertySlot):
+        (JSC::JSObject::get):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::toPrimitive):
+        (JSC::JSValue::get):
+        (JSC::JSValue::put):
+        (JSC::JSObject::allocatePropertyStorageInline):
+        * runtime/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::toPrimitive):
+        (JSC::JSPropertyNameIterator::getPrimitiveNumber):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::create):
+        (JSC::JSPropertyNameIterator::next):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::put):
+        (JSC::JSStaticScopeObject::putWithAttributes):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.cpp:
+        (JSC::JSString::toPrimitive):
+        (JSC::JSString::getPrimitiveNumber):
+        (JSC::JSString::getOwnPropertySlot):
+        * runtime/JSString.h:
+        (JSC::JSString::createStructure):
+        (JSC::asString):
+        * runtime/JSValue.h:
+        (JSC::JSValuePtr::makeImmediate):
+        (JSC::JSValuePtr::immediateValue):
+        (JSC::JSValuePtr::JSValuePtr):
+        (JSC::JSValuePtr::operator->):
+        (JSC::JSValuePtr::hasValue):
+        (JSC::JSValuePtr::operator==):
+        (JSC::JSValuePtr::operator!=):
+        (JSC::JSValuePtr::encode):
+        (JSC::JSValuePtr::decode):
+        (JSC::JSValue::asValue):
+        (JSC::noValue):
+        (JSC::operator==):
+        (JSC::operator!=):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::symbolTablePut):
+        (JSC::JSVariableObject::symbolTablePutWithAttributes):
+        * runtime/JSWrapperObject.cpp:
+        (JSC::JSWrapperObject::mark):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::internalValue):
+        (JSC::JSWrapperObject::setInternalValue):
+        * runtime/Lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * runtime/Lookup.h:
+        (JSC::lookupPut):
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncAbs):
+        (JSC::mathProtoFuncACos):
+        (JSC::mathProtoFuncASin):
+        (JSC::mathProtoFuncATan):
+        (JSC::mathProtoFuncATan2):
+        (JSC::mathProtoFuncCeil):
+        (JSC::mathProtoFuncCos):
+        (JSC::mathProtoFuncExp):
+        (JSC::mathProtoFuncFloor):
+        (JSC::mathProtoFuncLog):
+        (JSC::mathProtoFuncMax):
+        (JSC::mathProtoFuncMin):
+        (JSC::mathProtoFuncPow):
+        (JSC::mathProtoFuncRandom):
+        (JSC::mathProtoFuncRound):
+        (JSC::mathProtoFuncSin):
+        (JSC::mathProtoFuncSqrt):
+        (JSC::mathProtoFuncTan):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::callNativeErrorConstructor):
+        * runtime/NumberConstructor.cpp:
+        (JSC::numberConstructorNaNValue):
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+        (JSC::callNumberConstructor):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::getJSNumber):
+        (JSC::constructNumberFromImmediateNumber):
+        * runtime/NumberObject.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToString):
+        (JSC::numberProtoFuncToLocaleString):
+        (JSC::numberProtoFuncValueOf):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToPrecision):
+        * runtime/ObjectConstructor.cpp:
+        (JSC::constructObject):
+        (JSC::callObjectConstructor):
+        * runtime/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncValueOf):
+        (JSC::objectProtoFuncHasOwnProperty):
+        (JSC::objectProtoFuncIsPrototypeOf):
+        (JSC::objectProtoFuncDefineGetter):
+        (JSC::objectProtoFuncDefineSetter):
+        (JSC::objectProtoFuncLookupGetter):
+        (JSC::objectProtoFuncLookupSetter):
+        (JSC::objectProtoFuncPropertyIsEnumerable):
+        (JSC::objectProtoFuncToLocaleString):
+        (JSC::objectProtoFuncToString):
+        * runtime/ObjectPrototype.h:
+        * runtime/Operations.cpp:
+        (JSC::equal):
+        (JSC::equalSlowCase):
+        (JSC::strictEqual):
+        (JSC::strictEqualSlowCase):
+        (JSC::throwOutOfMemoryError):
+        * runtime/Operations.h:
+        (JSC::equalSlowCaseInline):
+        (JSC::strictEqualSlowCaseInline):
+        * runtime/PropertySlot.cpp:
+        (JSC::PropertySlot::functionGetter):
+        * runtime/PropertySlot.h:
+        (JSC::PropertySlot::PropertySlot):
+        (JSC::PropertySlot::getValue):
+        (JSC::PropertySlot::putValue):
+        (JSC::PropertySlot::setValueSlot):
+        (JSC::PropertySlot::setValue):
+        (JSC::PropertySlot::setCustom):
+        (JSC::PropertySlot::setCustomIndex):
+        (JSC::PropertySlot::slotBase):
+        (JSC::PropertySlot::setBase):
+        (JSC::PropertySlot::):
+        * runtime/Protect.h:
+        (JSC::gcProtect):
+        (JSC::gcUnprotect):
+        (JSC::ProtectedPtr::ProtectedPtr):
+        (JSC::ProtectedPtr::operator JSValuePtr):
+        (JSC::ProtectedJSValuePtr::ProtectedJSValuePtr):
+        (JSC::ProtectedJSValuePtr::get):
+        (JSC::ProtectedJSValuePtr::operator JSValuePtr):
+        (JSC::ProtectedJSValuePtr::operator->):
+        (JSC::::ProtectedPtr):
+        (JSC::::~ProtectedPtr):
+        (JSC::::operator):
+        (JSC::ProtectedJSValuePtr::~ProtectedJSValuePtr):
+        (JSC::ProtectedJSValuePtr::operator=):
+        (JSC::operator==):
+        (JSC::operator!=):
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::getBackref):
+        (JSC::RegExpConstructor::getLastParen):
+        (JSC::RegExpConstructor::getLeftContext):
+        (JSC::RegExpConstructor::getRightContext):
+        (JSC::regExpConstructorDollar1):
+        (JSC::regExpConstructorDollar2):
+        (JSC::regExpConstructorDollar3):
+        (JSC::regExpConstructorDollar4):
+        (JSC::regExpConstructorDollar5):
+        (JSC::regExpConstructorDollar6):
+        (JSC::regExpConstructorDollar7):
+        (JSC::regExpConstructorDollar8):
+        (JSC::regExpConstructorDollar9):
+        (JSC::regExpConstructorInput):
+        (JSC::regExpConstructorMultiline):
+        (JSC::regExpConstructorLastMatch):
+        (JSC::regExpConstructorLastParen):
+        (JSC::regExpConstructorLeftContext):
+        (JSC::regExpConstructorRightContext):
+        (JSC::RegExpConstructor::put):
+        (JSC::setRegExpConstructorInput):
+        (JSC::setRegExpConstructorMultiline):
+        (JSC::constructRegExp):
+        (JSC::callRegExpConstructor):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        (JSC::asRegExpConstructor):
+        * runtime/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::put):
+        * runtime/RegExpObject.cpp:
+        (JSC::regExpObjectGlobal):
+        (JSC::regExpObjectIgnoreCase):
+        (JSC::regExpObjectMultiline):
+        (JSC::regExpObjectSource):
+        (JSC::regExpObjectLastIndex):
+        (JSC::RegExpObject::put):
+        (JSC::setRegExpObjectLastIndex):
+        (JSC::RegExpObject::test):
+        (JSC::RegExpObject::exec):
+        (JSC::callRegExpObject):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        (JSC::asRegExpObject):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest):
+        (JSC::regExpProtoFuncExec):
+        (JSC::regExpProtoFuncCompile):
+        (JSC::regExpProtoFuncToString):
+        * runtime/StringConstructor.cpp:
+        (JSC::stringFromCharCodeSlowCase):
+        (JSC::stringFromCharCode):
+        (JSC::callStringConstructor):
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::put):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        (JSC::asStringObject):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncToString):
+        (JSC::stringProtoFuncCharAt):
+        (JSC::stringProtoFuncCharCodeAt):
+        (JSC::stringProtoFuncConcat):
+        (JSC::stringProtoFuncIndexOf):
+        (JSC::stringProtoFuncLastIndexOf):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        (JSC::stringProtoFuncSlice):
+        (JSC::stringProtoFuncSplit):
+        (JSC::stringProtoFuncSubstr):
+        (JSC::stringProtoFuncSubstring):
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+        (JSC::stringProtoFuncLocaleCompare):
+        (JSC::stringProtoFuncBig):
+        (JSC::stringProtoFuncSmall):
+        (JSC::stringProtoFuncBlink):
+        (JSC::stringProtoFuncBold):
+        (JSC::stringProtoFuncFixed):
+        (JSC::stringProtoFuncItalics):
+        (JSC::stringProtoFuncStrike):
+        (JSC::stringProtoFuncSub):
+        (JSC::stringProtoFuncSup):
+        (JSC::stringProtoFuncFontcolor):
+        (JSC::stringProtoFuncFontsize):
+        (JSC::stringProtoFuncAnchor):
+        (JSC::stringProtoFuncLink):
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::createCachedPrototypeChain):
+        * runtime/Structure.h:
+        (JSC::Structure::create):
+        (JSC::Structure::setPrototypeWithoutTransition):
+        (JSC::Structure::storedPrototype):
+
+2009-01-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23085> [jsfunfuzz] Over released ScopeChainNode
+        <rdar://problem/6474110>
+
+        So this delightful bug was caused by our unwind code using a ScopeChain to perform
+        the unwind.  The ScopeChain would ref the initial top of the scope chain, then deref
+        the resultant top of scope chain, which is incorrect.
+
+        This patch removes the dependency on ScopeChain for the unwind, and i've filed
+        <https://bugs.webkit.org/show_bug.cgi?id=23144> to look into the unintuitive
+        ScopeChain behaviour.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+
+2009-01-06  Adam Roben  <aroben@apple.com>
+
+        Hopeful Windows crash-on-launch fix
+
+        * wtf/Platform.h: Force a world rebuild by touching this file.
+
+2009-01-06  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by NOBODY (Build fix).
+
+        * GNUmakefile.am:Add ByteArray.cpp too
+
+2009-01-06  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by NOBODY (Speculative build fix).
+
+        AllInOneFile.cpp does not include the JSByteArray.cpp include it...
+
+        * GNUmakefile.am:
+
+2009-01-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix Wx build
+
+        * JavaScriptCoreSources.bkl:
+
+2009-01-05  Oliver Hunt  <oliver@apple.com>
+
+        Windows build fixes
+
+        Rubber-stamped by Alice Liu.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        * runtime/ByteArray.cpp:
+        (JSC::ByteArray::create):
+        * runtime/ByteArray.h:
+
+2009-01-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        CanvasPixelArray performance is too slow 
+        <https://bugs.webkit.org/show_bug.cgi?id=23123>
+
+        The fix to this is to devirtualise get and put in a manner similar to
+        JSString and JSArray.  To do this I've added a ByteArray implementation
+        and JSByteArray wrapper to JSC.  We can then do vptr comparisons to
+        devirtualise the calls.
+
+        This devirtualisation improves performance by 1.5-2x in my somewhat ad
+        hoc tests.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_put_by_val):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::isJSByteArray):
+        * runtime/ByteArray.cpp: Added.
+        (JSC::ByteArray::create):
+        * runtime/ByteArray.h: Added.
+        (JSC::ByteArray::length):
+        (JSC::ByteArray::set):
+        (JSC::ByteArray::get):
+        (JSC::ByteArray::data):
+        (JSC::ByteArray::ByteArray):
+        * runtime/JSByteArray.cpp: Added.
+        (JSC::):
+        (JSC::JSByteArray::JSByteArray):
+        (JSC::JSByteArray::createStructure):
+        (JSC::JSByteArray::getOwnPropertySlot):
+        (JSC::JSByteArray::put):
+        (JSC::JSByteArray::getPropertyNames):
+        * runtime/JSByteArray.h: Added.
+        (JSC::JSByteArray::canAccessIndex):
+        (JSC::JSByteArray::getIndex):
+        (JSC::JSByteArray::setIndex):
+        (JSC::JSByteArray::classInfo):
+        (JSC::JSByteArray::length):
+        (JSC::JSByteArray::):
+        (JSC::JSByteArray::JSByteArray):
+        (JSC::asByteArray):
+
+2009-01-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23073
+        <rdar://problem/6471129> Workers crash on Windows Release builds
+
+        * wtf/ThreadSpecific.h:
+        (WTF::ThreadSpecific::destroy): Changed to clear the pointer only after data object
+        destruction is finished - otherwise, WebCore::ThreadGlobalData destructor was re-creating
+        the object in order to access atomic string table.
+        (WTF::ThreadSpecific::operator T*): Symmetrically, set up the per-thread pointer before
+        data constructor is called.
+
+        * wtf/ThreadingWin.cpp: (WTF::wtfThreadEntryPoint): Remove a Windows-only hack to finalize
+        a thread - pthreadVC2 is a DLL, so it gets thread detached messages, and cleans up thread
+        specific data automatically. Besides, this code wasn't even compiled in for some time now.
+
+2009-01-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23115
+        Create a version of ASSERT for use with otherwise unused variables
+
+        * wtf/Assertions.h: Added ASSERT_UNUSED.
+
+        * jit/ExecutableAllocatorPosix.cpp:
+        (JSC::ExecutablePool::systemRelease):
+        * runtime/Collector.cpp:
+        (JSC::Heap::destroy):
+        (JSC::Heap::heapAllocate):
+        * runtime/JSNotAnObject.cpp:
+        (JSC::JSNotAnObject::toPrimitive):
+        (JSC::JSNotAnObject::getPrimitiveNumber):
+        (JSC::JSNotAnObject::toBoolean):
+        (JSC::JSNotAnObject::toNumber):
+        (JSC::JSNotAnObject::toString):
+        (JSC::JSNotAnObject::getOwnPropertySlot):
+        (JSC::JSNotAnObject::put):
+        (JSC::JSNotAnObject::deleteProperty):
+        (JSC::JSNotAnObject::getPropertyNames):
+        * wtf/TCSystemAlloc.cpp:
+        (TCMalloc_SystemRelease):
+        Use it in some places that used other idioms for this purpose.
+
+2009-01-04  Alice Liu  <alice.liu@apple.com>
+
+        <rdar://problem/6341776> Merge m_transitionCount and m_offset in Structure.
+
+        Reviewed by Darin Adler.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::Structure): Remove m_transitionCount
+        (JSC::Structure::addPropertyTransitionToExistingStructure): No need to wait until after the assignment to offset to assert if it's notFound; move it up.
+        (JSC::Structure::addPropertyTransition): Use method for transitionCount instead of m_transitionCount. Remove line that maintains the m_transitionCount.
+        (JSC::Structure::changePrototypeTransition): Remove line that maintains the m_transitionCount.
+        (JSC::Structure::getterSetterTransition): Remove line that maintains the m_transitionCount.
+        * runtime/Structure.h:
+        Changed s_maxTransitionLength and m_offset from size_t to signed char.  m_offset will never become greater than 64 
+        because the structure transitions to a dictionary at that time.
+        (JSC::Structure::transitionCount): method to replace the data member
+
+2009-01-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Bug 15114: Provide compile-time assertions for sizeof(UChar), sizeof(DeprecatedChar), etc.
+        https://bugs.webkit.org/show_bug.cgi?id=15114
+
+        * wtf/unicode/Unicode.h: Assert size of UChar. There is no DeprecatedChar any more.
+
+2009-01-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Change the pcVector from storing native code pointers to storing offsets
+        from the base pointer. This will allow us to generate the pcVector on demand
+        for exceptions.
+
+        * bytecode/CodeBlock.h:
+        (JSC::PC::PC):
+        (JSC::getNativePCOffset):
+        (JSC::CodeBlock::getBytecodeIndex):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+
+2009-01-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+        
+        * runtime/ScopeChain.cpp:
+
+2009-01-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [jsfunfuzz] unwind logic for exceptions in eval fails to account for dynamic scope external to the eval
+        https://bugs.webkit.org/show_bug.cgi?id=23078
+
+        This bug was caused by eval codeblocks being generated without accounting
+        for the depth of the scope chain they inherited.  This meant that exception
+        handlers would understate their expected scope chain depth, which in turn
+        led to incorrectly removing nodes from the scope chain.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitCatch):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::depth):
+        * runtime/ScopeChain.cpp:
+        (JSC::ScopeChain::localDepth):
+        * runtime/ScopeChain.h:
+        (JSC::ScopeChainNode::deref):
+        (JSC::ScopeChainNode::ref):
+
+2009-01-02  David Smith  <catfish.man@gmail.com>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=22699
+        Enable NodeList caching for getElementsByTagName
+
+        * wtf/HashFunctions.h: Moved the definition of PHI here and renamed to stringHashingStartValue
+
+2009-01-02  David Kilzer  <ddkilzer@apple.com>
+
+        Attempt to fix Qt Linux build after r39553
+
+        * wtf/RandomNumberSeed.h: Include <sys/time.h> for gettimeofday().
+        Include <sys/types.h> and <unistd.h> for getpid().
+
+2009-01-02  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 23081: These files are no longer part of the KDE libraries
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23081>
+
+        Reviewed by Darin Adler.
+
+        Removed "This file is part of the KDE libraries" comment from
+        source files.  Added or updated Apple copyrights as well.
+
+        * parser/Lexer.h:
+        * wtf/HashCountedSet.h:
+        * wtf/RetainPtr.h:
+        * wtf/VectorTraits.h:
+
+2009-01-02  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 23080: Remove last vestiges of KJS references
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23080>
+
+        Reviewed by Darin Adler.
+
+        Also updated Apple copyright statements.
+
+        * DerivedSources.make: Changed bison "kjsyy" prefix to "jscyy".
+        * GNUmakefile.am: Ditto.
+        * JavaScriptCore.pri: Ditto.  Also changed KJSBISON to JSCBISON
+        and kjsbison to jscbison.
+
+        * JavaScriptCoreSources.bkl: Changed JSCORE_KJS_SOURCES to
+        JSCORE_JSC_SOURCES.
+        * jscore.bkl: Ditto.
+
+        * create_hash_table: Updated copyright and removed old comment.
+
+        * parser/Grammar.y: Changed "kjsyy" prefix to "jscyy" prefix.
+        * parser/Lexer.cpp: Ditto.  Also changed KJS_DEBUG_LEX to
+        JSC_DEBUG_LEX.
+        (jscyylex):
+        (JSC::Lexer::lex):
+        * parser/Parser.cpp: Ditto.
+        (JSC::Parser::parse):
+
+        * pcre/dftables: Changed "kjs_pcre_" prefix to "jsc_pcre_".
+        * pcre/pcre_compile.cpp: Ditto.
+        (getOthercaseRange):
+        (encodeUTF8):
+        (compileBranch):
+        (calculateCompiledPatternLength):
+        * pcre/pcre_exec.cpp: Ditto.
+        (matchRef):
+        (getUTF8CharAndIncrementLength):
+        (match):
+        * pcre/pcre_internal.h: Ditto.
+        (toLowerCase):
+        (flipCase):
+        (classBitmapForChar):
+        (charTypeForChar):
+        * pcre/pcre_tables.cpp: Ditto.
+        * pcre/pcre_ucp_searchfuncs.cpp: Ditto.
+        (jsc_pcre_ucp_othercase):
+        * pcre/pcre_xclass.cpp: Ditto.
+        (getUTF8CharAndAdvancePointer):
+        (jsc_pcre_xclass):
+
+        * runtime/Collector.h: Updated header guards using the
+        clean-header-guards script.
+        * runtime/CollectorHeapIterator.h: Added missing header guard.
+        * runtime/Identifier.h: Updated header guards.
+        * runtime/JSFunction.h: Fixed end-of-namespace comment.
+
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset): Renamed "kjsprint" debug function
+        to "jscprint".  Changed implementation method from
+        globalFuncKJSPrint() to globalFuncJSCPrint().
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncJSCPrint): Renamed from globalFuncKJSPrint().
+        * runtime/JSGlobalObjectFunctions.h: Ditto.
+
+        * runtime/JSImmediate.h: Updated header guards.
+        * runtime/JSLock.h: Ditto.
+        * runtime/JSType.h: Ditto.
+        * runtime/JSWrapperObject.h: Ditto.
+        * runtime/Lookup.h: Ditto.
+        * runtime/Operations.h: Ditto.
+        * runtime/Protect.h: Ditto.
+        * runtime/RegExp.h: Ditto.
+        * runtime/UString.h: Ditto.
+
+        * tests/mozilla/js1_5/Array/regress-157652.js: Changed "KJS"
+        reference in comment to "JSC".
+
+        * wrec/CharacterClassConstructor.cpp: Change "kjs_pcre_" function
+        prefixes to "jsc_pcre_".
+        (JSC::WREC::CharacterClassConstructor::put):
+        (JSC::WREC::CharacterClassConstructor::flush):
+
+        * wtf/unicode/Unicode.h: Change "KJS_" header guard to "WTF_".
+        * wtf/unicode/icu/UnicodeIcu.h: Ditto.
+        * wtf/unicode/qt4/UnicodeQt4.h: Ditto.
+
+2009-01-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Make randomNumber generate 2^53 values instead of 2^32 (or 2^31 for rand() platforms)
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+
+2009-01-02  David Kilzer  <ddkilzer@apple.com>
+
+        Remove declaration for JSC::Identifier::initializeIdentifierThreading()
+
+        Reviewed by Alexey Proskuryakov.
+
+        * runtime/Identifier.h:
+        (JSC::Identifier::initializeIdentifierThreading): Removed
+        declaration since the implementation was removed in r34412.
+
+2009-01-01  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        String.replace does not support $& replacement metacharacter when search term is not a RegExp
+        <https://bugs.webkit.org/show_bug.cgi?id=21431>
+        <rdar://problem/6274993>
+
+        Test: fast/js/string-replace-3.html
+
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferences): Added a null check here so we won't try to handle $$-$9
+        backreferences when the search term is a string, not a RegExp. Added a check for 0 so we
+        won't try to handle $0 or $00 as a backreference.
+        (JSC::stringProtoFuncReplace): Added a call to substituteBackreferences.
+
+2009-01-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Allow 32-bit integers to be stored in JSImmediates, on x64-bit.
+        Presently the top 32-bits of a 64-bit JSImmediate serve as a sign extension of a 31-bit
+        int stored in the low word (shifted left by one, to make room for a tag).  In the new
+        format, the top 31-bits serve as a sign extension of a 32-bit int, still shifted left by
+        one.
+
+        The new behavior is enabled using a flag in Platform.h, 'WTF_USE_ALTERNATE_JSIMMEDIATE'.
+        When this is set the constants defining the range of ints allowed to be stored as
+        JSImmediate values is extended.  The code in JSImmediate.h can safely operate on either
+        format.  This patch updates the JIT so that it can also operate with the new format.
+
+        ~2% progression on x86-64, with & without the JIT, on sunspider & v8 tests.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::addPtr):
+        (JSC::MacroAssembler::orPtr):
+        (JSC::MacroAssembler::or32):
+        (JSC::MacroAssembler::rshiftPtr):
+        (JSC::MacroAssembler::rshift32):
+        (JSC::MacroAssembler::subPtr):
+        (JSC::MacroAssembler::xorPtr):
+        (JSC::MacroAssembler::xor32):
+        (JSC::MacroAssembler::move):
+        (JSC::MacroAssembler::compareImm64ForBranch):
+        (JSC::MacroAssembler::compareImm64ForBranchEquality):
+        (JSC::MacroAssembler::jePtr):
+        (JSC::MacroAssembler::jgePtr):
+        (JSC::MacroAssembler::jlPtr):
+        (JSC::MacroAssembler::jlePtr):
+        (JSC::MacroAssembler::jnePtr):
+        (JSC::MacroAssembler::jnzSubPtr):
+        (JSC::MacroAssembler::joAddPtr):
+        (JSC::MacroAssembler::jzSubPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::addq_rr):
+        (JSC::X86Assembler::orq_ir):
+        (JSC::X86Assembler::subq_ir):
+        (JSC::X86Assembler::xorq_rr):
+        (JSC::X86Assembler::sarq_CLr):
+        (JSC::X86Assembler::sarq_i8r):
+        (JSC::X86Assembler::cmpq_ir):
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileFastArith_op_lshift):
+        (JSC::JIT::compileFastArithSlow_op_lshift):
+        (JSC::JIT::compileFastArith_op_rshift):
+        (JSC::JIT::compileFastArithSlow_op_rshift):
+        (JSC::JIT::compileFastArith_op_bitand):
+        (JSC::JIT::compileFastArithSlow_op_bitand):
+        (JSC::JIT::compileFastArith_op_mod):
+        (JSC::JIT::compileFastArithSlow_op_mod):
+        (JSC::JIT::compileFastArith_op_add):
+        (JSC::JIT::compileFastArithSlow_op_add):
+        (JSC::JIT::compileFastArith_op_mul):
+        (JSC::JIT::compileFastArithSlow_op_mul):
+        (JSC::JIT::compileFastArith_op_post_inc):
+        (JSC::JIT::compileFastArithSlow_op_post_inc):
+        (JSC::JIT::compileFastArith_op_post_dec):
+        (JSC::JIT::compileFastArithSlow_op_post_dec):
+        (JSC::JIT::compileFastArith_op_pre_inc):
+        (JSC::JIT::compileFastArithSlow_op_pre_inc):
+        (JSC::JIT::compileFastArith_op_pre_dec):
+        (JSC::JIT::compileFastArithSlow_op_pre_dec):
+        (JSC::JIT::compileBinaryArithOp):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::getConstantOperand):
+        (JSC::JIT::getConstantOperandImmediateInt):
+        (JSC::JIT::isOperandConstantImmediateInt):
+        (JSC::JIT::isOperandConstant31BitImmediateInt):
+        (JSC::JIT::emitFastArithDeTagImmediate):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::JIT::emitFastArithReTagImmediate):
+        (JSC::JIT::emitFastArithImmToInt):
+        (JSC::JIT::emitFastArithIntToImmNoCheck):
+        * runtime/JSImmediate.h:
+        (JSC::JSImmediate::isPositiveNumber):
+        (JSC::JSImmediate::isNegative):
+        (JSC::JSImmediate::rightShiftImmediateNumbers):
+        (JSC::JSImmediate::canDoFastAdditiveOperations):
+        (JSC::JSImmediate::makeValue):
+        (JSC::JSImmediate::makeInt):
+        (JSC::JSImmediate::makeBool):
+        (JSC::JSImmediate::intValue):
+        (JSC::JSImmediate::rawValue):
+        (JSC::JSImmediate::toBoolean):
+        (JSC::JSImmediate::from):
+        * wtf/Platform.h:
+
+2008-12-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        [jsfunfuzz] Assertion + incorrect behaviour with dynamically created local variable in a catch block
+        <https://bugs.webkit.org/show_bug.cgi?id=23063>
+
+        Eval inside a catch block attempts to use the catch block's static scope in
+        an unsafe way by attempting to add new properties to the scope.  This patch
+        fixes this issue simply by preventing the catch block from using a static
+        scope if it contains an eval.
+
+        * parser/Grammar.y:
+        * parser/Nodes.cpp:
+        (JSC::TryNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::TryNode::):
+
+2008-12-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [jsfunfuzz] Computed exception offset wrong when first instruction is attempt to resolve deleted eval
+        <https://bugs.webkit.org/show_bug.cgi?id=23062>
+
+        This was caused by the expression information for the initial resolve of
+        eval not being emitted.  If this resolve was the first instruction that
+        could throw an exception the information search would fail leading to an
+        assertion failure.  If it was not the first throwable opcode the wrong
+        expression information would used.
+
+        Fix is simply to emit the expression info.
+
+        * parser/Nodes.cpp:
+        (JSC::EvalFunctionCallNode::emitBytecode):
+
+2008-12-31  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 23054: Caching of global lookups occurs even when the global object has become a dictionary
+        <https://bugs.webkit.org/show_bug.cgi?id=23054>
+        <rdar://problem/6469905>
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveGlobal): Do not cache lookup if the global
+        object has transitioned to a dictionary.
+        (JSC::Interpreter::cti_op_resolve_global): Do not cache lookup if the
+        global object has transitioned to a dictionary.
+
+2008-12-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23049> [jsfunfuzz] With blocks do not correctly protect their scope object
+        <rdar://problem/6469742> Crash in JSC::TypeInfo::hasStandardGetOwnPropertySlot() running jsfunfuzz
+
+        The problem that caused this was that with nodes were not correctly protecting
+        the final object that was placed in the scope chain.  We correct this by forcing
+        the use of a temporary register (which stops us relying on a local register
+        protecting the scope) and changing the behaviour of op_push_scope so that it
+        will store the final scope object.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitPushScope):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::cti_op_push_scope):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * parser/Nodes.cpp:
+        (JSC::WithNode::emitBytecode):
+
+2008-12-30  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23037: Parsing and reparsing disagree on automatic semicolon insertion
+        <https://bugs.webkit.org/show_bug.cgi?id=23037>
+        <rdar://problem/6467124>
+
+        Parsing and reparsing disagree about automatic semicolon insertion, so that a
+        function like
+
+        function() { a = 1, }
+
+        is parsed as being syntactically valid but gets a syntax error upon reparsing.
+        This leads to an assertion failure in Parser::reparse(). It is not that big of
+        an issue in practice, because in a Release build such a function will return
+        'undefined' when called.
+
+        In this case, we are not following the spec and it should be a syntax error.
+        However, unless there is a newline separating the ',' and the '}', WebKit would
+        not treat it as a syntax error in the past either. It would be a bit of work to
+        make the automatic semicolon insertion match the spec exactly, so this patch
+        changes it to match our past behaviour.
+
+        The problem is that even during reparsing, the Lexer adds a semicolon at the
+        end of the input, which confuses allowAutomaticSemicolon(), because it is
+        expecting either a '}', the end of input, or a terminator like a newline.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::Lexer): Initialize m_isReparsing to false.
+        (JSC::Lexer::lex): Do not perform automatic semicolon insertion in the Lexer if
+        we are in the middle of reparsing.
+        (JSC::Lexer::clear): Set m_isReparsing to false.
+        * parser/Lexer.h:
+        (JSC::Lexer::setIsReparsing): Added.
+        * parser/Parser.cpp:
+        (JSC::Parser::reparse): Call Lexer::setIsReparsing() to notify the Lexer of
+        reparsing.
+
+2008-12-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Yet another attempt to fix Tiger.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+
+2008-12-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Tiger build fix (correct this time)
+
+        * wtf/RandomNumber.cpp:
+
+2008-12-29  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Rubber-stamped by Alexey Proskuryakov.
+
+        Revert r39509, because kjsyydebug is used in the generated code if YYDEBUG is 1.
+
+        * parser/Grammar.y:
+
+2008-12-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Tiger build fix.
+
+        * wtf/RandomNumber.cpp:
+
+2008-12-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6358108> Insecure randomness in Math.random() leads to user tracking
+
+        Switch to arc4random on PLATFORM(DARWIN), this is ~1.5x slower than random(), but the
+        it is still so fast that there is no fathomable way it could be a bottleneck for anything.
+
+        randomNumber is called in two places
+          * During form submission where it is called once per form
+          * Math.random in JSC.  For this difference to show up you have to be looping on
+            a cached local copy of random, for a large (>10000) calls.
+
+        No change in SunSpider.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+        * wtf/RandomNumberSeed.h:
+        (WTF::initializeRandomNumberGenerator):
+
+2008-12-29  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Rubber-stamped by Sam Weinig.
+
+        Remove unused kjsyydebug #define.
+
+        * parser/Grammar.y:
+
+2008-12-29  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt and Sam Weinig.
+
+        Bug 23029: REGRESSION (r39337): jsfunfuzz generates identical test files
+        <https://bugs.webkit.org/show_bug.cgi?id=23029>
+        <rdar://problem/6469185>
+
+        The unification of random number generation in r39337 resulted in random()
+        being initialized on Darwin, but rand() actually being used. Fix this by
+        making randomNumber() use random() instead of rand() on Darwin.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+
+2008-12-29  Sam Weinig  <sam@webkit.org>
+
+        Fix buildbots.
+
+        * runtime/Structure.cpp:
+
+2008-12-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=23026
+        Move the deleted offsets vector into the PropertyMap
+
+        Saves 3 words per Structure.
+
+        * runtime/PropertyMapHashTable.h:
+        * runtime/Structure.cpp:
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::fromDictionaryTransition):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        (JSC::Structure::rehashPropertyMapHashTable):
+        * runtime/Structure.h:
+        (JSC::Structure::propertyStorageSize):
+
+2008-12-29  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Change code using m_body.get() as a boolean to take advantage of the 
+        implicit conversion of RefPtr to boolean.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::~JSFunction):
+
+2008-12-28  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 22840: REGRESSION (r38349): Gmail doesn't load with profiling enabled
+        <https://bugs.webkit.org/show_bug.cgi?id=22840>
+        <rdar://problem/6468077>
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitNewArray): Add an assertion that the range
+        of registers passed to op_new_array is sequential.
+        (JSC::BytecodeGenerator::emitCall): Correct the relocation of registers
+        when emitting profiler hooks so that registers aren't leaked. Also, add
+        an assertion that the 'this' register is always ref'd (because it is),
+        remove the needless protection of the 'this' register when relocating,
+        and add an assertion that the range of registers passed to op_call for
+        function call arguments is sequential.
+        (JSC::BytecodeGenerator::emitConstruct): Correct the relocation of
+        registers when emitting profiler hooks so that registers aren't leaked.
+        Also, add an assertion that the range of registers passed to op_construct
+        for function call arguments is sequential.
+
+2008-12-26  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        <rdar://problem/6467376> Race condition in WTF::currentThread can lead to a thread using two different identifiers during its lifetime
+
+        If a newly-created thread calls WTF::currentThread() before WTF::createThread calls establishIdentifierForPthreadHandle
+        then more than one identifier will be used for the same thread.  We can avoid this by adding some extra synchronization
+        during thread creation that delays the execution of the thread function until the thread identifier has been set up, and
+        an assertion to catch this problem should it reappear in the future.
+
+        * wtf/Threading.cpp: Added.
+        (WTF::NewThreadContext::NewThreadContext):
+        (WTF::threadEntryPoint):
+        (WTF::createThread): Add cross-platform createThread function that delays the execution of the thread function until
+        after the thread identifier has been set up.
+        * wtf/Threading.h:
+        * wtf/ThreadingGtk.cpp:
+        (WTF::establishIdentifierForThread):
+        (WTF::createThreadInternal):
+        * wtf/ThreadingNone.cpp:
+        (WTF::createThreadInternal):
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::establishIdentifierForPthreadHandle):
+        (WTF::createThreadInternal):
+        * wtf/ThreadingQt.cpp:
+        (WTF::identifierByQthreadHandle):
+        (WTF::establishIdentifierForThread):
+        (WTF::createThreadInternal):
+        * wtf/ThreadingWin.cpp:
+        (WTF::storeThreadHandleByIdentifier):
+        (WTF::createThreadInternal):
+
+        Add Threading.cpp to the build.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+
+2008-12-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove unused method.
+
+        * runtime/Structure.h: Remove mutableTypeInfo.
+
+2008-12-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix rounding / bounds / signed comparison bug in ExecutableAllocator.
+
+        ExecutableAllocator::alloc assumed that m_freePtr would be aligned.  This was
+        not always true, since the first allocation from an additional pool would not
+        be rounded up.  Subsequent allocations would be unaligned, and too much memory
+        could be erroneously allocated from the pool, when the size requested was
+        available, but the size rounded up to word granularity was not available in the
+        pool.  This may result in the value of m_freePtr being greater than m_end.
+
+        Under these circumstances, the unsigned check for space will always pass,
+        resulting in pointers to memory outside of the arena being returned, and
+        ultimately segfaulty goodness when attempting to memcpy the hot freshly jitted
+        code from the AssemblerBuffer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22974
+        ... and probably many, many more.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutablePool::alloc):
+        (JSC::ExecutablePool::roundUpAllocationSize):
+        (JSC::ExecutablePool::ExecutablePool):
+        (JSC::ExecutablePool::poolAllocate):
+
+2008-12-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Rename all uses of the term "repatch" to "patch".
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::DataLabelPtr::patch):
+        (JSC::MacroAssembler::DataLabel32::patch):
+        (JSC::MacroAssembler::Jump::patch):
+        (JSC::MacroAssembler::PatchBuffer::PatchBuffer):
+        (JSC::MacroAssembler::PatchBuffer::setPtr):
+        (JSC::MacroAssembler::loadPtrWithAddressOffsetPatch):
+        (JSC::MacroAssembler::storePtrWithAddressOffsetPatch):
+        (JSC::MacroAssembler::storePtrWithPatch):
+        (JSC::MacroAssembler::jnePtrWithPatch):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::patchAddress):
+        (JSC::X86Assembler::patchImmediate):
+        (JSC::X86Assembler::patchPointer):
+        (JSC::X86Assembler::patchBranchOffset):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCTICachePutByID):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::Interpreter::cti_op_put_by_id):
+        (JSC::Interpreter::cti_op_get_by_id):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list):
+        (JSC::Interpreter::cti_vm_dontLazyLinkCall):
+        * jit/JIT.cpp:
+        (JSC::ctiPatchCallByReturnAddress):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::linkCall):
+        (JSC::JIT::compileOpCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdSlowCase):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+
+2008-12-22  Adam Roben  <aroben@apple.com>
+
+        Build fix after r39428
+
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSlowCase): Added a missing MacroAssembler::
+
+2008-12-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Rubber-stamped by George Staikos.
+
+        Unify all TorchMobile copyright lines. Consolidate in a single line, as requested by Mark Rowe, some time ago.
+
+        * wtf/RandomNumber.cpp:
+        * wtf/RandomNumber.h:
+        * wtf/RandomNumberSeed.h:
+
+2008-12-21  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Rubber-stamped by George Staikos.
+
+        Fix copyright of the new RandomNumber* files.
+
+        * wtf/RandomNumber.cpp:
+        * wtf/RandomNumber.h:
+        * wtf/RandomNumberSeed.h:
+
+2008-12-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt & Cameron Zwarich.
+
+        Add support for call and property access repatching on x86-64.
+
+        No change in performance on current configurations (2x impovement on v8-tests with JIT enabled on x86-64).
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::DataLabelPtr::repatch):
+        (JSC::MacroAssembler::DataLabelPtr::operator X86Assembler::JmpDst):
+        (JSC::MacroAssembler::DataLabel32::repatch):
+        (JSC::MacroAssembler::RepatchBuffer::addressOf):
+        (JSC::MacroAssembler::add32):
+        (JSC::MacroAssembler::sub32):
+        (JSC::MacroAssembler::loadPtrWithAddressOffsetRepatch):
+        (JSC::MacroAssembler::storePtrWithAddressOffsetRepatch):
+        (JSC::MacroAssembler::jePtr):
+        (JSC::MacroAssembler::jnePtr):
+        (JSC::MacroAssembler::jnePtrWithRepatch):
+        (JSC::MacroAssembler::differenceBetween):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::addl_im):
+        (JSC::X86Assembler::subl_im):
+        (JSC::X86Assembler::cmpl_rm):
+        (JSC::X86Assembler::movq_rm_disp32):
+        (JSC::X86Assembler::movq_mr_disp32):
+        (JSC::X86Assembler::repatchPointer):
+        (JSC::X86Assembler::X86InstructionFormatter::oneByteOp64_disp32):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITCall.cpp:
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::linkCall):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compilePutByIdSlowCase):
+        (JSC::resizePropertyStorage):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        * wtf/Platform.h:
+
+2008-12-20  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Port optimized property access generation to the MacroAssembler.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::AbsoluteAddress::AbsoluteAddress):
+        (JSC::MacroAssembler::DataLabelPtr::repatch):
+        (JSC::MacroAssembler::DataLabel32::DataLabel32):
+        (JSC::MacroAssembler::DataLabel32::repatch):
+        (JSC::MacroAssembler::Label::operator X86Assembler::JmpDst):
+        (JSC::MacroAssembler::Jump::repatch):
+        (JSC::MacroAssembler::JumpList::empty):
+        (JSC::MacroAssembler::RepatchBuffer::link):
+        (JSC::MacroAssembler::add32):
+        (JSC::MacroAssembler::and32):
+        (JSC::MacroAssembler::sub32):
+        (JSC::MacroAssembler::loadPtrWithAddressRepatch):
+        (JSC::MacroAssembler::storePtrWithAddressRepatch):
+        (JSC::MacroAssembler::push):
+        (JSC::MacroAssembler::ja32):
+        (JSC::MacroAssembler::jePtr):
+        (JSC::MacroAssembler::jnePtr):
+        (JSC::MacroAssembler::jnePtrWithRepatch):
+        (JSC::MacroAssembler::align):
+        (JSC::MacroAssembler::differenceBetween):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movl_rm_disp32):
+        (JSC::X86Assembler::movl_mr_disp32):
+        (JSC::X86Assembler::X86InstructionFormatter::oneByteOp_disp32):
+        (JSC::X86Assembler::X86InstructionFormatter::memoryModRM):
+        * jit/JIT.cpp:
+        (JSC::ctiRepatchCallByReturnAddress):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compilePutByIdSlowCase):
+        (JSC::resizePropertyStorage):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        * wtf/RefCounted.h:
+        (WTF::RefCountedBase::addressOfCount):
+
+2008-12-19  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22686
+
+        Added file which was missing to the javascriptcore_sources
+        variable, so that it shows up in the tarball created by `make
+        dist'.
+
+        * GNUmakefile.am:
+
+2008-12-19  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Antti Koivisto.
+
+        Build fix when building JS API tests with a c89 c compiler
+
+        Do not use C++ style comments and convert them to C comments.
+
+        * wtf/Platform.h:
+
+2008-12-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Same as last revision, adding cases for pre & post inc & dec.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22928
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2008-12-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixes for the JIT's handling of JSImmediate values on x86-64.
+        On 64-bit systems, the code in JSImmediate.h relies on the upper
+        bits of a JSImmediate being a sign extension of the low 32-bits.
+        This was not being enforced by the JIT, since a number of inline
+        operations were being performed on 32-bit values in registers, and
+        when a 32-bit result is written to a register on x86-64 the value
+        is zero-extended to 64-bits.
+        
+        This fix honors previous behavoir.  A better fix in the long run
+        (when the JIT is enabled by default) may be to change JSImmediate.h
+        so it no longer relies on the upper bits of the pointer,... though
+        if we're going to change JSImmediate.h for 64-bit, we probably may
+        as well change the format so that the full range of 32-bit ints can
+        be stored, rather than just 31-bits.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22925
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::addPtr):
+        (JSC::MacroAssembler::andPtr):
+        (JSC::MacroAssembler::orPtr):
+        (JSC::MacroAssembler::or32):
+        (JSC::MacroAssembler::xor32):
+        (JSC::MacroAssembler::xorPtr):
+        (JSC::MacroAssembler::signExtend32ToPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::andq_rr):
+        (JSC::X86Assembler::andq_ir):
+        (JSC::X86Assembler::orq_rr):
+        (JSC::X86Assembler::xorq_ir):
+        (JSC::X86Assembler::movsxd_rr):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitFastArithReTagImmediate):
+        (JSC::JIT::emitFastArithPotentiallyReTagImmediate):
+        (JSC::JIT::emitFastArithImmToInt):
+
+2008-12-18  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Just a tidy up - rename & refactor some the #defines configuring the JIT.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_convert_this):
+        (JSC::Interpreter::cti_op_end):
+        (JSC::Interpreter::cti_op_add):
+        (JSC::Interpreter::cti_op_pre_inc):
+        (JSC::Interpreter::cti_timeout_check):
+        (JSC::Interpreter::cti_register_file_check):
+        (JSC::Interpreter::cti_op_loop_if_less):
+        (JSC::Interpreter::cti_op_loop_if_lesseq):
+        (JSC::Interpreter::cti_op_new_object):
+        (JSC::Interpreter::cti_op_put_by_id_generic):
+        (JSC::Interpreter::cti_op_get_by_id_generic):
+        (JSC::Interpreter::cti_op_put_by_id):
+        (JSC::Interpreter::cti_op_put_by_id_second):
+        (JSC::Interpreter::cti_op_put_by_id_fail):
+        (JSC::Interpreter::cti_op_get_by_id):
+        (JSC::Interpreter::cti_op_get_by_id_second):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list_full):
+        (JSC::Interpreter::cti_op_get_by_id_proto_fail):
+        (JSC::Interpreter::cti_op_get_by_id_array_fail):
+        (JSC::Interpreter::cti_op_get_by_id_string_fail):
+        (JSC::Interpreter::cti_op_instanceof):
+        (JSC::Interpreter::cti_op_del_by_id):
+        (JSC::Interpreter::cti_op_mul):
+        (JSC::Interpreter::cti_op_new_func):
+        (JSC::Interpreter::cti_op_call_JSFunction):
+        (JSC::Interpreter::cti_op_call_arityCheck):
+        (JSC::Interpreter::cti_vm_dontLazyLinkCall):
+        (JSC::Interpreter::cti_vm_lazyLinkCall):
+        (JSC::Interpreter::cti_op_push_activation):
+        (JSC::Interpreter::cti_op_call_NotJSFunction):
+        (JSC::Interpreter::cti_op_create_arguments):
+        (JSC::Interpreter::cti_op_create_arguments_no_params):
+        (JSC::Interpreter::cti_op_tear_off_activation):
+        (JSC::Interpreter::cti_op_tear_off_arguments):
+        (JSC::Interpreter::cti_op_profile_will_call):
+        (JSC::Interpreter::cti_op_profile_did_call):
+        (JSC::Interpreter::cti_op_ret_scopeChain):
+        (JSC::Interpreter::cti_op_new_array):
+        (JSC::Interpreter::cti_op_resolve):
+        (JSC::Interpreter::cti_op_construct_JSConstruct):
+        (JSC::Interpreter::cti_op_construct_NotJSConstruct):
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_resolve_func):
+        (JSC::Interpreter::cti_op_sub):
+        (JSC::Interpreter::cti_op_put_by_val):
+        (JSC::Interpreter::cti_op_put_by_val_array):
+        (JSC::Interpreter::cti_op_lesseq):
+        (JSC::Interpreter::cti_op_loop_if_true):
+        (JSC::Interpreter::cti_op_negate):
+        (JSC::Interpreter::cti_op_resolve_base):
+        (JSC::Interpreter::cti_op_resolve_skip):
+        (JSC::Interpreter::cti_op_resolve_global):
+        (JSC::Interpreter::cti_op_div):
+        (JSC::Interpreter::cti_op_pre_dec):
+        (JSC::Interpreter::cti_op_jless):
+        (JSC::Interpreter::cti_op_not):
+        (JSC::Interpreter::cti_op_jtrue):
+        (JSC::Interpreter::cti_op_post_inc):
+        (JSC::Interpreter::cti_op_eq):
+        (JSC::Interpreter::cti_op_lshift):
+        (JSC::Interpreter::cti_op_bitand):
+        (JSC::Interpreter::cti_op_rshift):
+        (JSC::Interpreter::cti_op_bitnot):
+        (JSC::Interpreter::cti_op_resolve_with_base):
+        (JSC::Interpreter::cti_op_new_func_exp):
+        (JSC::Interpreter::cti_op_mod):
+        (JSC::Interpreter::cti_op_less):
+        (JSC::Interpreter::cti_op_neq):
+        (JSC::Interpreter::cti_op_post_dec):
+        (JSC::Interpreter::cti_op_urshift):
+        (JSC::Interpreter::cti_op_bitxor):
+        (JSC::Interpreter::cti_op_new_regexp):
+        (JSC::Interpreter::cti_op_bitor):
+        (JSC::Interpreter::cti_op_call_eval):
+        (JSC::Interpreter::cti_op_throw):
+        (JSC::Interpreter::cti_op_get_pnames):
+        (JSC::Interpreter::cti_op_next_pname):
+        (JSC::Interpreter::cti_op_push_scope):
+        (JSC::Interpreter::cti_op_pop_scope):
+        (JSC::Interpreter::cti_op_typeof):
+        (JSC::Interpreter::cti_op_is_undefined):
+        (JSC::Interpreter::cti_op_is_boolean):
+        (JSC::Interpreter::cti_op_is_number):
+        (JSC::Interpreter::cti_op_is_string):
+        (JSC::Interpreter::cti_op_is_object):
+        (JSC::Interpreter::cti_op_is_function):
+        (JSC::Interpreter::cti_op_stricteq):
+        (JSC::Interpreter::cti_op_nstricteq):
+        (JSC::Interpreter::cti_op_to_jsnumber):
+        (JSC::Interpreter::cti_op_in):
+        (JSC::Interpreter::cti_op_push_new_scope):
+        (JSC::Interpreter::cti_op_jmp_scopes):
+        (JSC::Interpreter::cti_op_put_by_index):
+        (JSC::Interpreter::cti_op_switch_imm):
+        (JSC::Interpreter::cti_op_switch_char):
+        (JSC::Interpreter::cti_op_switch_string):
+        (JSC::Interpreter::cti_op_del_by_val):
+        (JSC::Interpreter::cti_op_put_getter):
+        (JSC::Interpreter::cti_op_put_setter):
+        (JSC::Interpreter::cti_op_new_error):
+        (JSC::Interpreter::cti_op_debug):
+        (JSC::Interpreter::cti_vm_throw):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        * wtf/Platform.h:
+
+2008-12-18  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 21855: REGRESSION (r37323): Gmail complains about popup blocking when opening a link
+        <https://bugs.webkit.org/show_bug.cgi?id=21855>
+        <rdar://problem/6278244>
+
+        Move DynamicGlobalObjectScope to JSGlobalObject.h so that it can be used
+        from WebCore.
+
+        * interpreter/Interpreter.cpp:
+        * runtime/JSGlobalObject.h:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
+        (JSC::DynamicGlobalObjectScope::~DynamicGlobalObjectScope):
+
+2008-12-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Gavin Barraclough.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=22393
+        Segfault when caching property accesses to primitive cells.
+        
+        Changed some asObject casts to asCell casts in cases where a primitive
+        value may be a cell and not an object.
+        
+        Re-enabled property caching for primitives in cases where it had been
+        disabled because of this bug.
+        
+        Updated a comment to better explain something Darin thought needed
+        explaining in an old patch review.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::countPrototypeChainEntriesAndCheckForProxies):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list):
+
+2008-12-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fixes for Sunspider failures with the JIT enabled on x86-64.
+
+        * assembler/MacroAssembler.h:
+            Switch the order of the RegisterID & Address form of je32, to keep it consistent with jne32.
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+            Port the m_ctiVirtualCall tramopline generation to use the MacroAssembler interface.
+        * jit/JITCall.cpp:
+            Fix bug in the non-optimizing code path, vptr check should have been to the memory address pointer
+            to by the register, not to the register itself.
+        * wrec/WRECGenerator.cpp:
+            See assembler/MacroAssembler.h, above.
+
+2008-12-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        print("Hello, 64-bit jitted world!");
+        Get hello-world working through the JIT, on x86-64.
+
+        * assembler/X86Assembler.h:
+            Fix encoding of opcode + RegisterID format instructions for 64-bit.
+        * interpreter/Interpreter.cpp:
+        * interpreter/Interpreter.h:
+            Make VoidPtrPair actually be a pair of void*s.
+            (Possibly should make this change for 32-bit Mac platforms, too - but won't change 32-bit behaviour in this patch).
+        * jit/JIT.cpp:
+        * jit/JIT.h:
+            Provide names for the timeoutCheckRegister & callFrameRegister on x86-64,
+            force x86-64 ctiTrampoline arguments onto the stack,
+            implement the asm trampolines for x86-64,
+            implement the restoreArgumentReference methods for x86-64 calling conventions.
+        * jit/JITCall.cpp:
+        * jit/JITInlineMethods.h:
+        * wtf/Platform.h:
+            Add switch settings to ENABLE(JIT), on PLATFORM(X86_64) (currently still disabled).
+
+2008-12-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Add more CodeBlock statistics.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpStatistics):
+
+2008-12-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22897
+        <rdar://problem/6428342>
+        Look into feasibility of discarding bytecode after native codegen
+
+        Clear the bytecode Instruction vector at the end JIT generation.
+
+        Saves 4.8 MB on Membuster head.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Add logging for the case that someone tries
+        to dump the instructions of a CodeBlock that has had its bytecode
+        vector cleared.
+        (JSC::CodeBlock::CodeBlock): Initialize the instructionCount
+        (JSC::CodeBlock::handlerForBytecodeOffset): Use instructionCount instead
+        of the size of the instruction vector in the assertion.
+        (JSC::CodeBlock::lineNumberForBytecodeOffset): Ditto.
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset): Ditto.
+        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset): Ditto.
+        (JSC::CodeBlock::functionRegisterForBytecodeOffset): Ditto.
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setInstructionCount): Store the instruction vector size
+        in debug builds for assertions.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile): Clear the bytecode vector unless we
+        have compiled with Opcode sampling where we will continue to require it
+
+2008-12-17  Cary Clark  <caryclark@google.com>
+
+        Reviewed by Darin Adler.
+        Landed by Adam Barth.
+
+        Add ENABLE_TEXT_CARET to permit the ANDROID platform
+        to invalidate and draw the caret in a separate thread.
+
+        * wtf/Platform.h:
+        Default ENABLE_TEXT_CARET to 1.
+
+2008-12-17  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Don't use unique context group in JSGlobalContextCreate() on Tiger or Leopard, take two.
+
+        * API/JSContextRef.cpp: The previous patch that claimed to do this was making Tiger and
+        Leopard always use unique context group instead.
+
+2008-12-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22838
+        Remove dependency on the bytecode Instruction buffer in Interpreter::throwException
+        Part of <rdar://problem/6428342>
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::functionRegisterForBytecodeOffset): Added. Function to get
+        a function Register index in a callFrame for a bytecode offset.
+        (JSC::CodeBlock::shrinkToFit): Shrink m_getByIdExceptionInfo and m_functionRegisterInfos.
+        * bytecode/CodeBlock.h:
+        (JSC::FunctionRegisterInfo::FunctionRegisterInfo): Added.
+        (JSC::CodeBlock::addFunctionRegisterInfo):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitCall):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException): Use functionRegisterForBytecodeOffset in JIT
+        mode.
+
+2008-12-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22837
+        Remove dependency on the bytecode Instruction buffer in Interpreter::cti_op_call_NotJSFunction
+        Part of <rdar://problem/6428342>
+
+        * interpreter/CallFrame.h: Added comment regarding returnPC storing a void*.
+        * interpreter/Interpreter.cpp:
+        (JSC::bytecodeOffsetForPC): We no longer have any cases of the PC
+        being in the instruction stream for JIT, so we can remove the check.
+        (JSC::Interpreter::cti_op_call_NotJSFunction): Use the CTI_RETURN_ADDRESS
+        as the call frame returnPC as it is only necessary for looking up when
+        throwing an exception.
+        * interpreter/RegisterFile.h:
+        (JSC::RegisterFile::): Added comment regarding returnPC storing a void*.
+        * jit/JIT.h: Remove ARG_instr4.
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSetupArgs): Don't pass the instruction pointer.
+
+2008-12-16  Darin Adler  <darin@apple.com>
+
+        Reviewed and landed by Cameron Zwarich.
+
+        Preparatory work for fixing
+
+        Bug 22887: Make UString::Rep use RefCounted rather than implementing its own ref counting
+        <https://bugs.webkit.org/show_bug.cgi?id=22887>
+
+        Change the various string translators used by Identifier:add() so that
+        they never zero the ref count of a newly created UString::Rep.
+
+        * runtime/Identifier.cpp:
+        (JSC::CStringTranslator::translate):
+        (JSC::Identifier::add):
+        (JSC::UCharBufferTranslator::translate):
+
+2008-12-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix for 'doze.
+
+        * assembler/AssemblerBuffer.h:
+
+2008-12-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Make the JIT compile on x86-64.
+        This largely involves populting the missing calls in MacroAssembler.h.
+        In addition some reinterpret_casts need removing from the JIT, and the
+        repatching property access code will need to be fully compiled out for
+        now.  The changes in interpret.cpp are to reorder the functions so that
+        the _generic forms come before all other property access methods, and
+        then to place all property access methods other than the generic forms
+        under control of the ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS macro.
+
+        No performance impact.
+
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::putInt64Unchecked):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::loadPtr):
+        (JSC::MacroAssembler::load32):
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::storePtrWithRepatch):
+        (JSC::MacroAssembler::store32):
+        (JSC::MacroAssembler::poke):
+        (JSC::MacroAssembler::move):
+        (JSC::MacroAssembler::testImm64):
+        (JSC::MacroAssembler::jePtr):
+        (JSC::MacroAssembler::jnePtr):
+        (JSC::MacroAssembler::jnzPtr):
+        (JSC::MacroAssembler::jzPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::cmpq_rr):
+        (JSC::X86Assembler::cmpq_rm):
+        (JSC::X86Assembler::cmpq_im):
+        (JSC::X86Assembler::testq_i32m):
+        (JSC::X86Assembler::movl_mEAX):
+        (JSC::X86Assembler::movl_i32r):
+        (JSC::X86Assembler::movl_EAXm):
+        (JSC::X86Assembler::movq_rm):
+        (JSC::X86Assembler::movq_mEAX):
+        (JSC::X86Assembler::movq_mr):
+        (JSC::X86Assembler::movq_i64r):
+        (JSC::X86Assembler::movl_mr):
+        (JSC::X86Assembler::X86InstructionFormatter::oneByteOp64):
+        (JSC::X86Assembler::X86InstructionFormatter::immediate64):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_put_by_id_generic):
+        (JSC::Interpreter::cti_op_get_by_id_generic):
+        (JSC::Interpreter::cti_op_put_by_id):
+        (JSC::Interpreter::cti_op_put_by_id_second):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        * runtime/JSImmediate.h:
+        (JSC::JSImmediate::makeInt):
+
+2008-12-16  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 22869: REGRESSION (r38407): http://news.cnet.com/8301-13579_3-9953533-37.html crashes
+        <https://bugs.webkit.org/show_bug.cgi?id=22869>
+        <rdar://problem/6402499>
+
+        Before r38407, Structure::m_nameInPrevious was ref'd due to it being
+        stored in a PropertyMap. However, PropertyMaps are created lazily after
+        r38407, so Structure::m_nameInPrevious is not necessarily ref'd while
+        it is being used. Making it a RefPtr instead of a raw pointer fixes
+        the problem.
+
+        Unfortunately, the crash in the bug is rather intermittent, and it is
+        impossible to add an assertion in UString::Ref::ref() to catch this bug
+        because some users of UString::Rep deliberately zero out the reference
+        count. Therefore, there is no layout test accompanying this bug fix.
+
+        * runtime/Structure.cpp:
+        (JSC::Structure::~Structure): Use get().
+        (JSC::Structure::materializePropertyMap): Use get().
+        (JSC::Structure::addPropertyTransitionToExistingStructure): Use get().
+        (JSC::Structure::addPropertyTransition): Use get().
+        * runtime/Structure.h: Make Structure::m_nameInPrevious a RefPtr instead
+        of a raw pointer.
+
+2008-12-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Attempt to fix win build. No 'using namespace WTF' in this file, needs manual WTF:: prefix.
+        Not sure why the build works as is here.
+
+        * runtime/MathObject.cpp:
+        (JSC::mathProtoFuncRandom):
+
+2008-12-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22876
+
+        Unify random number generation in JavaScriptCore & WebCore, by introducing
+        wtf/RandomNumber.h and moving wtf_random/wtf_random_init out of MathExtras.h.
+
+        wtf_random_init() has been renamed to initializeRandomNumberGenerator() and
+        lives in it's own private header: wtf/RandomNumberSeed.h, only intended to
+        be used from within JavaScriptCore.
+
+        wtf_random() has been renamed to randomNumber() and lives in a public header
+        wtf/RandomNumber.h, usable from within JavaScriptCore & WebCore. It encapsulates
+        the code taking care of initializing the random number generator (only when
+        building without ENABLE(JSC_MULTIPLE_THREADS), otherwhise initializeThreading()
+        already took care of that).
+
+        Functional change on darwin: Use random() instead of rand(), as it got a larger
+        period (more randomness). HTMLFormElement already contains this implementation
+        and I just moved it in randomNumber(), as  special case for PLATFORM(DARWIN).
+
+        * GNUmakefile.am: Add RandomNumber.(cpp/h) / RandomNumberSeed.h.
+        * JavaScriptCore.exp: Ditto.
+        * JavaScriptCore.pri: Ditto.
+        * JavaScriptCore.scons: Ditto.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * JavaScriptCoreSources.bkl: Ditto.
+        * runtime/MathObject.cpp: Use new WTF::randomNumber() functionality.
+        (JSC::mathProtoFuncRandom):
+        * wtf/MathExtras.h: Move wtf_random / wtf_random_init to new files.
+        * wtf/RandomNumber.cpp: Added.
+        (WTF::randomNumber):
+        * wtf/RandomNumber.h: Added.
+        * wtf/RandomNumberSeed.h: Added. Internal usage within JSC only.
+        (WTF::initializeRandomNumberGenerator):
+        * wtf/ThreadingGtk.cpp: Rename wtf_random_init() to initializeRandomNumberGenerator().
+        (WTF::initializeThreading):
+        * wtf/ThreadingPthreads.cpp: Ditto.
+        (WTF::initializeThreading):
+        * wtf/ThreadingQt.cpp: Ditto.
+        (WTF::initializeThreading):
+        * wtf/ThreadingWin.cpp: Ditto.
+        (WTF::initializeThreading):
+
+2008-12-16 Yael Aharon <yael.aharon@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Qt/Win build fix
+
+        * JavaScriptCore.pri:
+
+2008-12-15  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix the build with GCC 4.0.
+
+        * Configurations/JavaScriptCore.xcconfig:  GCC 4.0 appears to have a bug when compiling with -funwind-tables on,
+        so don't use it with that compiler version.
+
+2008-12-15  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Cameron Zwarich.
+
+        <rdar://problem/6289933> Change WebKit-related projects to build with GCC 4.2 on Leopard.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+
+2008-12-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Don't use unique context group in JSGlobalContextCreate() on Tiger or Leopard.
+
+        * API/JSContextRef.cpp: (JSGlobalContextCreate):
+
+2008-12-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6445089> Mach ports leak from worker threads
+
+        * interpreter/Interpreter.cpp: (JSC::getCPUTime):
+        Deallocate the thread self port.
+
+2008-12-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Construct stack frames in JIT code, so that backtracing can still work.
+        <rdar://problem/6447870> JIT should play nice with attempts to take stack traces
+
+        * jit/JIT.cpp:
+        (JSC::):
+        (JSC::JIT::privateCompileMainPass):
+
+2008-12-15  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/6402262> JavaScriptCore needs exception handling tables in order to get stack traces without frame pointers
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2008-12-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Rubber stamped by Mark Rowe.
+
+        Revert r39226 / Bug 22818: Unify JIT callback argument access OS X / Windows
+        This causes Acid3 failures – reverting for now & will revisit later.
+        https://bugs.webkit.org/show_bug.cgi?id=22873
+
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        (JSC::JIT::emitCTICall_internal):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        * wtf/Platform.h:
+
+2008-12-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix <rdar://problem/6427048> crash due to infinite recursion after setting window.__proto__ = window
+
+        Replaced toGlobalObject with the more generally useful unwrappedObject and used it to
+        fix the cycle detection code in put(__proto__).
+
+        * JavaScriptCore.exp: Updated.
+
+        * runtime/JSGlobalObject.cpp: Removed toGlobalObject. We now use unwrappedObject instead.
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::isGlobalObject): Ditto.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval): Use unwrappedObject and isGlobalObject here rather than toGlobalObject.
+
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put): Rewrote prototype cycle checking loop. Use unwrappedObject in the loop now.
+        (JSC::JSObject::unwrappedObject): Replaced toGlobalObject with this new function.
+        * runtime/JSObject.h: More of the same.
+
+2008-12-15  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+        
+        Visual Studio requires visibility of forward declarations to match class declaration.
+
+        * assembler/X86Assembler.h:
+
+2008-12-15  Gustavo Noronha Silva  <kov@kov.eti.br>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22686
+
+        GTK+ build fix.
+
+        * GNUmakefile.am:
+
+2008-12-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Add support to X86Assembler emitting instructions that access all 16 registers on x86-64.
+        Add a new formating class, that is reponsible for both emitting the opcode bytes and the
+        ModRm  bytes of an instruction in a single call; this can insert the REX byte as necessary
+        before the opcode, but has access to the register numbers to build the REX.
+
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::isAligned):
+        (JSC::AssemblerBuffer::data):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::addPtr):
+        (JSC::MacroAssembler::add32):
+        (JSC::MacroAssembler::and32):
+        (JSC::MacroAssembler::or32):
+        (JSC::MacroAssembler::sub32):
+        (JSC::MacroAssembler::xor32):
+        (JSC::MacroAssembler::loadPtr):
+        (JSC::MacroAssembler::load32):
+        (JSC::MacroAssembler::load16):
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::storePtrWithRepatch):
+        (JSC::MacroAssembler::store32):
+        (JSC::MacroAssembler::pop):
+        (JSC::MacroAssembler::push):
+        (JSC::MacroAssembler::compareImm32ForBranch):
+        (JSC::MacroAssembler::compareImm32ForBranchEquality):
+        (JSC::MacroAssembler::testImm32):
+        (JSC::MacroAssembler::jae32):
+        (JSC::MacroAssembler::jb32):
+        (JSC::MacroAssembler::je16):
+        (JSC::MacroAssembler::jg32):
+        (JSC::MacroAssembler::jnePtr):
+        (JSC::MacroAssembler::jne32):
+        (JSC::MacroAssembler::jump):
+        * assembler/X86Assembler.h:
+        (JSC::X86::):
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::size):
+        (JSC::X86Assembler::push_r):
+        (JSC::X86Assembler::pop_r):
+        (JSC::X86Assembler::push_i32):
+        (JSC::X86Assembler::push_m):
+        (JSC::X86Assembler::pop_m):
+        (JSC::X86Assembler::addl_rr):
+        (JSC::X86Assembler::addl_mr):
+        (JSC::X86Assembler::addl_ir):
+        (JSC::X86Assembler::addq_ir):
+        (JSC::X86Assembler::addl_im):
+        (JSC::X86Assembler::andl_rr):
+        (JSC::X86Assembler::andl_ir):
+        (JSC::X86Assembler::orl_rr):
+        (JSC::X86Assembler::orl_mr):
+        (JSC::X86Assembler::orl_ir):
+        (JSC::X86Assembler::subl_rr):
+        (JSC::X86Assembler::subl_mr):
+        (JSC::X86Assembler::subl_ir):
+        (JSC::X86Assembler::subl_im):
+        (JSC::X86Assembler::xorl_rr):
+        (JSC::X86Assembler::xorl_ir):
+        (JSC::X86Assembler::sarl_i8r):
+        (JSC::X86Assembler::sarl_CLr):
+        (JSC::X86Assembler::shll_i8r):
+        (JSC::X86Assembler::shll_CLr):
+        (JSC::X86Assembler::imull_rr):
+        (JSC::X86Assembler::imull_i32r):
+        (JSC::X86Assembler::idivl_r):
+        (JSC::X86Assembler::cmpl_rr):
+        (JSC::X86Assembler::cmpl_rm):
+        (JSC::X86Assembler::cmpl_mr):
+        (JSC::X86Assembler::cmpl_ir):
+        (JSC::X86Assembler::cmpl_ir_force32):
+        (JSC::X86Assembler::cmpl_im):
+        (JSC::X86Assembler::cmpl_im_force32):
+        (JSC::X86Assembler::cmpw_rm):
+        (JSC::X86Assembler::testl_rr):
+        (JSC::X86Assembler::testl_i32r):
+        (JSC::X86Assembler::testl_i32m):
+        (JSC::X86Assembler::testq_rr):
+        (JSC::X86Assembler::testq_i32r):
+        (JSC::X86Assembler::testb_i8r):
+        (JSC::X86Assembler::sete_r):
+        (JSC::X86Assembler::setz_r):
+        (JSC::X86Assembler::setne_r):
+        (JSC::X86Assembler::setnz_r):
+        (JSC::X86Assembler::cdq):
+        (JSC::X86Assembler::xchgl_rr):
+        (JSC::X86Assembler::movl_rr):
+        (JSC::X86Assembler::movl_rm):
+        (JSC::X86Assembler::movl_mr):
+        (JSC::X86Assembler::movl_i32r):
+        (JSC::X86Assembler::movl_i32m):
+        (JSC::X86Assembler::movq_rr):
+        (JSC::X86Assembler::movq_rm):
+        (JSC::X86Assembler::movq_mr):
+        (JSC::X86Assembler::movzwl_mr):
+        (JSC::X86Assembler::movzbl_rr):
+        (JSC::X86Assembler::leal_mr):
+        (JSC::X86Assembler::call):
+        (JSC::X86Assembler::jmp):
+        (JSC::X86Assembler::jmp_r):
+        (JSC::X86Assembler::jmp_m):
+        (JSC::X86Assembler::jne):
+        (JSC::X86Assembler::jnz):
+        (JSC::X86Assembler::je):
+        (JSC::X86Assembler::jl):
+        (JSC::X86Assembler::jb):
+        (JSC::X86Assembler::jle):
+        (JSC::X86Assembler::jbe):
+        (JSC::X86Assembler::jge):
+        (JSC::X86Assembler::jg):
+        (JSC::X86Assembler::ja):
+        (JSC::X86Assembler::jae):
+        (JSC::X86Assembler::jo):
+        (JSC::X86Assembler::jp):
+        (JSC::X86Assembler::js):
+        (JSC::X86Assembler::addsd_rr):
+        (JSC::X86Assembler::addsd_mr):
+        (JSC::X86Assembler::cvtsi2sd_rr):
+        (JSC::X86Assembler::cvttsd2si_rr):
+        (JSC::X86Assembler::movd_rr):
+        (JSC::X86Assembler::movsd_rm):
+        (JSC::X86Assembler::movsd_mr):
+        (JSC::X86Assembler::mulsd_rr):
+        (JSC::X86Assembler::mulsd_mr):
+        (JSC::X86Assembler::pextrw_irr):
+        (JSC::X86Assembler::subsd_rr):
+        (JSC::X86Assembler::subsd_mr):
+        (JSC::X86Assembler::ucomis_rr):
+        (JSC::X86Assembler::int3):
+        (JSC::X86Assembler::ret):
+        (JSC::X86Assembler::predictNotTaken):
+        (JSC::X86Assembler::label):
+        (JSC::X86Assembler::align):
+        (JSC::X86Assembler::link):
+        (JSC::X86Assembler::executableCopy):
+        (JSC::X86Assembler::X86InstructionFormater::prefix):
+        (JSC::X86Assembler::X86InstructionFormater::oneByteOp):
+        (JSC::X86Assembler::X86InstructionFormater::twoByteOp):
+        (JSC::X86Assembler::X86InstructionFormater::oneByteOp64):
+        (JSC::X86Assembler::X86InstructionFormater::oneByteOp8):
+        (JSC::X86Assembler::X86InstructionFormater::twoByteOp8):
+        (JSC::X86Assembler::X86InstructionFormater::instructionImmediate8):
+        (JSC::X86Assembler::X86InstructionFormater::instructionImmediate32):
+        (JSC::X86Assembler::X86InstructionFormater::instructionRel32):
+        (JSC::X86Assembler::X86InstructionFormater::size):
+        (JSC::X86Assembler::X86InstructionFormater::isAligned):
+        (JSC::X86Assembler::X86InstructionFormater::data):
+        (JSC::X86Assembler::X86InstructionFormater::executableCopy):
+        (JSC::X86Assembler::X86InstructionFormater::registerModRM):
+        (JSC::X86Assembler::X86InstructionFormater::memoryModRM):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::JIT::compileBinaryArithOp):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+
+2008-12-15  Darin Adler  <darin@apple.com>
+
+        * interpreter/RegisterFile.h: Tweak include formatting.
+
+2008-12-15  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Build fix for Gtk+.
+
+        * interpreter/RegisterFile.h: Include stdio.h for fprintf
+
+2008-12-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6444455> Worker Thread crash running multiple workers for a moderate amount of time
+
+        * interpreter/RegisterFile.h: (JSC::RegisterFile::RegisterFile):
+        Improve error handling: if mmap fails, crash immediately, and print out the reason.
+
+2008-12-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Re-enable WREC on 64-bit.
+        Implements one of the MacroAssembler::jnzPtr methods, previously only implemented for 32-bit x86.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22849
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::testImm64):
+        (JSC::MacroAssembler::jnzPtr):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::testq_i32r):
+        (JSC::X86Assembler::testq_rr):
+        * wtf/Platform.h:
+
+2008-12-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Fix PPC builds.
+
+        * assembler/MacroAssembler.h:
+
+2008-12-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix only, no review.
+
+        * bytecode/CodeBlock.h:
+
+2008-12-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Port the remainder of the JIT, bar calling convention related code, and code
+        implementing optimizations which can be disabled, to use the MacroAssembler.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::DataLabelPtr::DataLabelPtr):
+        (JSC::MacroAssembler::RepatchBuffer::RepatchBuffer):
+        (JSC::MacroAssembler::RepatchBuffer::link):
+        (JSC::MacroAssembler::RepatchBuffer::addressOf):
+        (JSC::MacroAssembler::RepatchBuffer::setPtr):
+        (JSC::MacroAssembler::addPtr):
+        (JSC::MacroAssembler::lshift32):
+        (JSC::MacroAssembler::mod32):
+        (JSC::MacroAssembler::rshift32):
+        (JSC::MacroAssembler::storePtrWithRepatch):
+        (JSC::MacroAssembler::jnzPtr):
+        (JSC::MacroAssembler::jzPtr):
+        (JSC::MacroAssembler::jump):
+        (JSC::MacroAssembler::label):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::xchgl_rr):
+        (JSC::X86Assembler::jmp_m):
+        (JSC::X86Assembler::repatchAddress):
+        (JSC::X86Assembler::getRelocatedAddress):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::JITCodeRef::JITCodeRef):
+        (JSC::CodeBlock::setJITCode):
+        (JSC::CodeBlock::jitCode):
+        (JSC::CodeBlock::executablePool):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileLinkPass):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        (JSC::CallRecord::CallRecord):
+        (JSC::JumpTable::JumpTable):
+        (JSC::JIT::emitCTICall):
+        (JSC::JIT::JSRInfo::JSRInfo):
+        * jit/JITArithmetic.cpp:
+        * jit/JITCall.cpp:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitNakedCall):
+        (JSC::JIT::emitCTICall_internal):
+        (JSC::JIT::checkStructure):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::JIT::addSlowCase):
+        (JSC::JIT::addJump):
+        (JSC::JIT::emitJumpSlowToHot):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+
+2008-12-12  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix the failures of the following layout tests, which regressed in
+        r39255:
+
+        fast/dom/StyleSheet/ownerNode-lifetime-2.html
+        fast/xsl/transform-xhr-doc.xhtml
+
+        The binary search in CodeBlock::getByIdExceptionInfoForBytecodeOffset()
+        doesn't guarantee that it actually finds a match, so add an explicit check
+        for this.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset):
+
+2008-12-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Replace emitPutCallArg methods with emitPutJITStubArg methods.  Primarily to make the argument numbering
+        more sensible (1-based incrementing by 1, rather than 0-based incrementing by 4).  The CTI name also seems
+        to be being deprecated from the code generally.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpCallEvalSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::compileOpCall):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitPutJITStubArg):
+        (JSC::JIT::emitPutJITStubArgConstant):
+        (JSC::JIT::emitGetJITStubArg):
+        (JSC::JIT::emitPutJITStubArgFromVirtualRegister):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdSlowCase):
+
+2008-12-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Fix windows builds.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+
+2008-12-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Remove loop counter 'i' from the JIT generation passes, replace with a member m_bytecodeIndex.
+
+        No impact on performance.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emitSlowScriptCheck):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+        (JSC::CallRecord::CallRecord):
+        (JSC::JmpTable::JmpTable):
+        (JSC::JIT::emitCTICall):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetVirtualRegister):
+        (JSC::JIT::emitGetVirtualRegisters):
+        (JSC::JIT::emitNakedCall):
+        (JSC::JIT::emitCTICall_internal):
+        (JSC::JIT::emitJumpSlowCaseIfJSCell):
+        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmNum):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmNums):
+        (JSC::JIT::emitFastArithIntToImmOrSlowCase):
+        (JSC::JIT::addSlowCase):
+        (JSC::JIT::addJump):
+        (JSC::JIT::emitJumpSlowToHot):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compilePutByIdSlowCase):
+
+2008-12-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        <rdar://problem/6428342> Look into feasibility of discarding bytecode after native codegen
+
+        Move more JIT functionality to using offsets into the Instruction buffer
+        instead of raw pointers. Two to go!
+
+        * interpreter/Interpreter.cpp:
+        (JSC::bytecodeOffsetForPC): Rename from vPCForPC.
+        (JSC::Interpreter::resolve): Pass offset to exception helper.
+        (JSC::Interpreter::resolveSkip): Ditto.
+        (JSC::Interpreter::resolveGlobal): Ditto.
+        (JSC::Interpreter::resolveBaseAndProperty): Ditto.
+        (JSC::Interpreter::resolveBaseAndFunc): Ditto.
+        (JSC::isNotObject): Ditto.
+        (JSC::Interpreter::unwindCallFrame): Call bytecodeOffsetForPC.
+        (JSC::Interpreter::throwException): Use offsets instead of vPCs.
+        (JSC::Interpreter::privateExecute): Pass offset to exception helper.
+        (JSC::Interpreter::retrieveLastCaller): Ditto.
+        (JSC::Interpreter::cti_op_instanceof): Ditto.
+        (JSC::Interpreter::cti_op_call_NotJSFunction): Ditto.
+        (JSC::Interpreter::cti_op_resolve): Pass offset to exception helper.
+        (JSC::Interpreter::cti_op_construct_NotJSConstruct): Ditto.
+        (JSC::Interpreter::cti_op_resolve_func): Ditto.
+        (JSC::Interpreter::cti_op_resolve_skip): Ditto.
+        (JSC::Interpreter::cti_op_resolve_global): Ditto.
+        (JSC::Interpreter::cti_op_resolve_with_base): Ditto.
+        (JSC::Interpreter::cti_op_throw): Ditto.
+        (JSC::Interpreter::cti_op_in): Ditto.
+        (JSC::Interpreter::cti_vm_throw): Ditto.
+        * interpreter/Interpreter.h:
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass): Don't pass unnecessary vPC to stub.
+        * jit/JIT.h: Remove ARG_instr1 - ARG_instr3 and ARG_instr5 - ARG_instr6.
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallEvalSetupArgs): Don't pass unnecessary vPC to stub..
+        (JSC::JIT::compileOpConstructSetupArgs): Ditto.
+
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError): Take an offset instead of vPC.
+        (JSC::createInvalidParamError): Ditto.
+        (JSC::createNotAConstructorError): Ditto.
+        (JSC::createNotAFunctionError): Ditto.
+        (JSC::createNotAnObjectError): Ditto.
+        * runtime/ExceptionHelpers.h:
+
+2008-12-12  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 22835: Crash during bytecode generation when comparing to null
+        <https://bugs.webkit.org/show_bug.cgi?id=22835>
+        <rdar://problem/6286749>
+
+        Change the special cases in bytecode generation for comparison to null
+        to use tempDestination().
+
+        * parser/Nodes.cpp:
+        (JSC::BinaryOpNode::emitBytecode):
+        (JSC::EqualNode::emitBytecode):
+
+2008-12-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Move slow-cases of JIT code generation over to the MacroAssembler interface.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::Label::Label):
+        (JSC::MacroAssembler::jae32):
+        (JSC::MacroAssembler::jg32):
+        (JSC::MacroAssembler::jzPtr):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::emitGetVariableObjectRegister):
+        (JSC::JIT::emitPutVariableObjectRegister):
+        * jit/JIT.h:
+        (JSC::SlowCaseEntry::SlowCaseEntry):
+        (JSC::JIT::getSlowCase):
+        (JSC::JIT::linkSlowCase):
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        * jit/JITCall.cpp:
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
+        (JSC::JIT::linkSlowCaseIfNotJSCell):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdSlowCase):
+
+2008-12-12  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 22828: Do not inspect bytecode instruction stream for op_get_by_id exception information
+        <https://bugs.webkit.org/show_bug.cgi?id=22828>
+
+        In order to remove the bytecode instruction stream after generating
+        native code, all inspection of bytecode instructions at runtime must
+        be removed. One particular instance of this is the special handling of
+        exceptions thrown by the op_get_by_id emitted directly before an
+        op_construct or an op_instanceof. This patch moves that information to
+        an auxiliary data structure in CodeBlock.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::getByIdExceptionInfoForBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::addGetByIdExceptionInfo):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitConstruct):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitGetByIdExceptionInfo):
+        * parser/Nodes.cpp:
+        (JSC::InstanceOfNode::emitBytecode):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createNotAnObjectError):
+
+2008-12-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Change exception information accessors to take offsets into the bytecode
+        instruction buffer instead of pointers so that they can work even even
+        if the bytecode buffer is purged.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::instructionOffsetForNth):
+        (JSC::CodeBlock::handlerForBytecodeOffset):
+        (JSC::CodeBlock::lineNumberForBytecodeOffset):
+        (JSC::CodeBlock::expressionRangeForBytecodeOffset):
+        * bytecode/CodeBlock.h:
+        * bytecode/SamplingTool.cpp:
+        (JSC::SamplingTool::dump):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveLastCaller):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createUndefinedVariableError):
+        (JSC::createInvalidParamError):
+        (JSC::createNotAConstructorError):
+        (JSC::createNotAFunctionError):
+        (JSC::createNotAnObjectError):
+
+2008-12-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Tiny bit of refactoring in quantifier generation.
+
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateNonGreedyQuantifier):
+        (JSC::WREC::Generator::generateGreedyQuantifier):
+
+2008-12-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove dependancy on having the Instruction buffer in order to
+        deref Structures used for property access and global resolves.
+        Instead, we put references to the necessary Structures in auxiliary
+        data structures on the CodeBlock. This is not an ideal solution,
+        as we still pay for having the Structures in two places and we
+        would like to eventually just hold on to offsets into the machine
+        code buffer.
+
+        - Also removes CodeBlock bloat in non-JIT by #ifdefing the JIT
+          only data structures.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * bytecode/CodeBlock.cpp:
+        (JSC::isGlobalResolve):
+        (JSC::isPropertyAccess):
+        (JSC::instructionOffsetForNth):
+        (JSC::printGlobalResolveInfo):
+        (JSC::printStructureStubInfo):
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::GlobalResolveInfo::GlobalResolveInfo):
+        (JSC::getNativePC):
+        (JSC::CodeBlock::instructions):
+        (JSC::CodeBlock::getStubInfo):
+        (JSC::CodeBlock::getBytecodeIndex):
+        (JSC::CodeBlock::addPropertyAccessInstruction):
+        (JSC::CodeBlock::addGlobalResolveInstruction):
+        (JSC::CodeBlock::numberOfStructureStubInfos):
+        (JSC::CodeBlock::addStructureStubInfo):
+        (JSC::CodeBlock::structureStubInfo):
+        (JSC::CodeBlock::addGlobalResolveInfo):
+        (JSC::CodeBlock::globalResolveInfo):
+        (JSC::CodeBlock::numberOfCallLinkInfos):
+        (JSC::CodeBlock::addCallLinkInfo):
+        (JSC::CodeBlock::callLinkInfo):
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        * bytecode/Opcode.h:
+        (JSC::):
+        * bytecode/StructureStubInfo.cpp: Copied from bytecode/CodeBlock.cpp.
+        (JSC::StructureStubInfo::deref):
+        * bytecode/StructureStubInfo.h: Copied from bytecode/CodeBlock.h.
+        (JSC::StructureStubInfo::StructureStubInfo):
+        (JSC::StructureStubInfo::initGetByIdSelf):
+        (JSC::StructureStubInfo::initGetByIdProto):
+        (JSC::StructureStubInfo::initGetByIdChain):
+        (JSC::StructureStubInfo::initGetByIdSelfList):
+        (JSC::StructureStubInfo::initGetByIdProtoList):
+        (JSC::StructureStubInfo::initPutByIdTransition):
+        (JSC::StructureStubInfo::initPutByIdReplace):
+        (JSC::StructureStubInfo::):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitConstruct):
+        (JSC::BytecodeGenerator::emitCatch):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCTICachePutByID):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::getPolymorphicAccessStructureListSlot):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list):
+        (JSC::Interpreter::cti_op_resolve_global):
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdSlowCase):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+
+2008-12-11  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Remove CTI_ARGUMENTS mode, use va_start implementation on Windows,
+        unifying JIT callback (cti_*) argument access on OS X & Windows
+
+        No performance impact.
+
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitCTICall):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        * wtf/Platform.h:
+
+2008-12-11  Holger Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20953
+
+        For Qt it is not pratical to have a FontCache and GlyphPageTreeNode
+        implementation. This is one of the reasons why the Qt port is currently not
+        using WebCore/platform/graphics/Font.cpp. By allowing to not use
+        the simple/fast-path the Qt port will be able to use it.
+
+        Introduce USE(FONT_FAST_PATH) and define it for every port but the
+        Qt one.
+
+        * wtf/Platform.h: Enable USE(FONT_FAST_PATH)
+
+2008-12-11  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler and landed by Holger Freyther.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=22648>
+        Fix threading on Qt-port and Gtk-port for Sampling tool.
+
+        * wtf/ThreadingGtk.cpp:
+        (WTF::waitForThreadCompletion):
+        * wtf/ThreadingQt.cpp:
+        (WTF::waitForThreadCompletion):
+
+2008-12-10  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 22734: Debugger crashes when stepping into a function call in a return statement
+        <https://bugs.webkit.org/show_bug.cgi?id=22734>
+        <rdar://problem/6426796>
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): The DebuggerCallFrame uses
+        the 'this' value stored in a callFrame, so op_convert_this should be
+        emitted at the beginning of a function body when generating bytecode
+        with debug hooks.
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::thisObject): The assertion inherent in the call
+        to asObject() here is valid, because any 'this' value should have been
+        converted to a JSObject*.
+
+2008-12-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Port more of the JIT to use the MacroAssembler interface.
+        
+        Everything in the main pass, bar a few corner cases (operations with required
+        registers, or calling convention code).  Slightly refactors array creation,
+        moving the offset calculation into the callFrame into C code (reducing code
+        planted).
+
+        Overall this appears to be a 1% win on v8-tests, due to the smaller immediates
+        being planted (in jfalse in particular).
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_new_array):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+
+2008-12-10  Sam Weinig  <sam@webkit.org>
+
+        Fix non-JIT builds.
+
+        * bytecode/CodeBlock.h:
+
+2008-12-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        <rdar://problem/6428332> Remove the CTI return address table from CodeBlock
+
+        Step 2:
+
+        Convert the return address table from a HashMap to a sorted Vector.  This
+        reduces the size of the data structure by ~4.5MB on Membuster head.
+
+        SunSpider reports a 0.5% progression.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::sizeInBytes): Generic method to get the cost of a Vector.
+        (JSC::CodeBlock::dumpStatistics): Add dumping of member sizes.
+        * bytecode/CodeBlock.h:
+        (JSC::PC::PC): Struct representing NativePC -> VirtualPC mappings.
+        (JSC::getNativePC): Helper for binary chop.
+        (JSC::CodeBlock::getBytecodeIndex): Used to get the VirtualPC from a
+        NativePC using a binary chop of the pcVector.
+        (JSC::CodeBlock::pcVector): Accessor.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::vPCForPC): Use getBytecodeIndex instead of jitReturnAddressVPCMap().get().
+        (JSC::Interpreter::cti_op_instanceof): Ditto.
+        (JSC::Interpreter::cti_op_resolve): Ditto.
+        (JSC::Interpreter::cti_op_resolve_func): Ditto.
+        (JSC::Interpreter::cti_op_resolve_skip): Ditto.
+        (JSC::Interpreter::cti_op_resolve_with_base): Ditto.
+        (JSC::Interpreter::cti_op_throw): Ditto.
+        (JSC::Interpreter::cti_op_in): Ditto.
+        (JSC::Interpreter::cti_vm_throw): Ditto.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile): Reserve exact capacity and fill the pcVector.
+
+2008-12-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Added WREC support for an assertion followed by a quantifier. Fixed
+        PCRE to match.
+
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::Parser::parseParentheses): Throw away the quantifier, since
+        it's meaningless. (Firefox does the same.)
+
+        * pcre/pcre_compile.cpp:
+        (compileBranch): ditto.
+
+2008-12-09  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        In preparation for compiling WREC without PCRE:
+        
+        Further relaxed WREC's parsing to be more web-compatible. Fixed PCRE to
+        match in cases where it didn't already.
+        
+        Changed JavaScriptCore to report syntax errors detected by WREC, rather
+        than falling back on PCRE any time WREC sees an error.
+        
+        * pcre/pcre_compile.cpp:
+        (checkEscape): Relaxed parsing of \c and \N escapes to be more
+        web-compatible.
+        
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp): Only fall back on PCRE if WREC has not reported
+        a syntax error.
+
+        * wrec/WREC.cpp:
+        (JSC::WREC::Generator::compileRegExp): Fixed some error reporting to
+        match PCRE.
+
+        * wrec/WRECParser.cpp: Added error messages that match PCRE.
+
+        (JSC::WREC::Parser::consumeGreedyQuantifier):
+        (JSC::WREC::Parser::parseParentheses):
+        (JSC::WREC::Parser::parseCharacterClass):
+        (JSC::WREC::Parser::parseNonCharacterEscape): Updated the above functions to
+        use the new setError API.
+
+        (JSC::WREC::Parser::consumeEscape): Relaxed parsing of \c \N \u \x \B
+        to be more web-compatible.
+
+        (JSC::WREC::Parser::parseAlternative): Distinguish between a malformed
+        quantifier and a quantifier with no prefix, like PCRE does.
+
+        (JSC::WREC::Parser::consumeParenthesesType): Updated to use the new setError API.
+
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::error):
+        (JSC::WREC::Parser::syntaxError):
+        (JSC::WREC::Parser::parsePattern):
+        (JSC::WREC::Parser::reset):
+        (JSC::WREC::Parser::setError): Store error messages instead of error codes,
+        to provide for exception messages. Use a setter for reporting errors, so
+        errors detected early are not overwritten by errors detected later.
+
+2008-12-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Use va_args to access cti function arguments.
+        https://bugs.webkit.org/show_bug.cgi?id=22774
+
+        This may be a minor regression, but we'll take the hit if so to reduce fragility.
+
+        * interpreter/Interpreter.cpp:
+        * interpreter/Interpreter.h:
+
+2008-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed twice by Cameron Zwarich.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22752
+        Clear SymbolTable after codegen for Function codeblocks that
+        don't require an activation
+
+        This is a ~1.5MB improvement on Membuster-head.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpStatistics): Add logging of non-empty symbol tables
+        and total size used by symbol tables.
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate): Clear the symbol table here.
+
+2008-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove unnecessary extra lookup when throwing an exception.
+        We used to first lookup the target offset using getHandlerForVPC
+        and then we would lookup the native code stub using 
+        nativeExceptionCodeForHandlerVPC.  Instead, we can just pass around
+        the HandlerInfo.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::handlerForVPC): Return the HandlerInfo.
+        * bytecode/CodeBlock.h: Remove nativeExceptionCodeForHandlerVPC.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException): Return a HandlerInfo instead of
+        and Instruction offset.
+        (JSC::Interpreter::privateExecute): Get the offset from HandlerInfo.
+        (JSC::Interpreter::cti_op_throw): Get the native code from the HandleInfo.
+        (JSC::Interpreter::cti_vm_throw): Ditto.
+        * interpreter/Interpreter.h:
+
+2008-12-09  Eric Seidel  <eric@webkit.org>
+
+        Build fix only, no review.
+
+        Speculative fix for the Chromium-Windows bot.
+        Add JavaScriptCore/os-win32 to the include path (for stdint.h)
+        Strangely it builds fine on my local windows box (or at least doesn't hit this error)
+
+        * JavaScriptCore.scons:
+
+2008-12-09  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+        
+        Add ExecutableAllocator files missing from Scons build.
+
+        * JavaScriptCore.scons:
+
+2008-12-09  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22631
+        Allow ScriptCallFrame query names of functions in the call stack.
+
+        * JavaScriptCore.exp: added InternalFunction::name and
+        UString operator==() as exported symbol
+
+2008-12-08  Judit Jasz  <jasy@inf.u-szeged.hu>
+
+        Reviewed and tweaked by Cameron Zwarich.
+
+        Bug 22352: Annotate opcodes with their length
+        <https://bugs.webkit.org/show_bug.cgi?id=22352>
+
+        * bytecode/Opcode.cpp:
+        * bytecode/Opcode.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+
+2008-12-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Implemented more of the relaxed and somewhat weird rules for deciding
+        how to interpret a non-pattern-character.
+        
+        * wrec/Escapes.h:
+        (JSC::WREC::Escape::):
+        (JSC::WREC::Escape::Escape): Eliminated Escape::None because it was
+        unused. If you see an '\\', it's either a valid escape or an error.
+
+        * wrec/Quantifier.h:
+        (JSC::WREC::Quantifier::Quantifier):
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateNonGreedyQuantifier):
+        (JSC::WREC::Generator::generateGreedyQuantifier): Renamed "noMaxSpecified"
+        to "Infinity", since that's what it means.
+
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::Parser::consumeGreedyQuantifier): Re-wrote {n,m} parsing rules
+        because they were too strict before. Added support for backtracking
+        in the case where the {n,m} fails to parse as a quantifier, and yet is
+        not a syntax error.
+
+        (JSC::WREC::Parser::parseCharacterClass):
+        (JSC::WREC::Parser::parseNonCharacterEscape): Eliminated Escape::None,
+        as above.
+
+        (JSC::WREC::Parser::consumeEscape): Don't treat ASCII and _ escapes
+        as syntax errors. See fast/regex/non-pattern-characters.html.
+        
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::SavedState::SavedState):
+        (JSC::WREC::Parser::SavedState::restore): Added a state backtracker,
+        since parsing {n,m} forms requires backtracking if the form turns out
+        not to be a quantifier.
+
+2008-12-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Refactored WREC parsing so that only one piece of code needs to know
+        the relaxed and somewhat weird rules for deciding how to interpret a
+        non-pattern-character, in preparation for implementing those rules.
+        
+        Also, implemented the relaxed and somewhat weird rules for '}' and ']'.
+
+        * wrec/WREC.cpp: Reduced the regular expression size limit. Now that
+        WREC handles ']' properly, it compiles fast/js/regexp-charclass-crash.html,
+        which makes it hang at the old limit. (The old limit was based on the
+        misimpression that the same value in PCRE limited the regular expression
+        pattern size; in reality, it limited the expected compiled regular
+        expression size. WREC doesn't have a way to calculate an expected
+        compiled regular expression size, but this should be good enough.)
+
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::parsePatternCharacterSequence): Nixed this function because
+        it contained a second copy of the logic for handling non-pattern-characters,
+        which is about to get a lot more complicated.
+
+        (JSC::WREC::PatternCharacterSequence::PatternCharacterSequence): 
+        (JSC::WREC::PatternCharacterSequence::size):
+        (JSC::WREC::PatternCharacterSequence::append):
+        (JSC::WREC::PatternCharacterSequence::flush): Helper object for generating
+        an optimized sequence of pattern characters.
+
+        (JSC::WREC::Parser::parseNonCharacterEscape): Renamed to reflect the fact
+        that the main parseAlternative loop handles character escapes.
+
+        (JSC::WREC::Parser::parseAlternative): Moved pattern character sequence
+        logic from parsePatternCharacterSequence to here, using
+        PatternCharacterSequence to help with the details.
+
+        * wrec/WRECParser.h: Updated for renames.
+
+2008-12-08  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/6166088> Give JSGlobalContextCreate a behavior that is concurrency aware,
+        and un-deprecate it
+
+        * API/JSContextRef.cpp: (JSGlobalContextCreate):
+        * API/JSContextRef.h:
+        Use a unique context group for the context, unless the application was linked against old
+        JavaScriptCore.
+
+2008-12-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix for <rdar://problem/6428332> Remove the CTI return address table from CodeBlock
+
+        Step 1:
+
+        Remove use of jitReturnAddressVPCMap when looking for vPC to store Structures
+        in for cached lookup.  Instead, use the offset in the StructureStubInfo that is
+        already required.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpStatistics): Fix extraneous semicolon.
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::tryCTICachePutByID):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list):
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdSelf):
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdReplace):
+        (JSC::JIT::compilePutByIdTransition):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength): Remove extra call to getStubInfo.
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+
+2008-12-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Port the op_j?n?eq_null JIT code generation to use the MacroAssembler,
+        and clean up slightly at the same time.  The 'j' forms currently compare,
+        then set a register, then compare again, then branch.  Branch directly on
+        the result of the first compare.
+
+        Around a 1% progression on deltablue, crypto & early boyer, for about 1/2%
+        overall on v8-tests.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdSlowCase):
+
+2008-12-08  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Expand MacroAssembler to support more operations, required by the JIT.
+
+        Generally adds more operations and permutations of operands to the existing
+        interface.  Rename 'jset' to 'jnz' and 'jnset' to 'jz', which seem clearer,
+        and require that immediate pointer operands (though not pointer addresses to
+        load and store instructions) are wrapped in a ImmPtr() type, akin to Imm32().
+
+        No performance impact.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::):
+        (JSC::MacroAssembler::ImmPtr::ImmPtr):
+        (JSC::MacroAssembler::add32):
+        (JSC::MacroAssembler::and32):
+        (JSC::MacroAssembler::or32):
+        (JSC::MacroAssembler::sub32):
+        (JSC::MacroAssembler::xor32):
+        (JSC::MacroAssembler::loadPtr):
+        (JSC::MacroAssembler::load32):
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::store32):
+        (JSC::MacroAssembler::poke):
+        (JSC::MacroAssembler::move):
+        (JSC::MacroAssembler::testImm32):
+        (JSC::MacroAssembler::jae32):
+        (JSC::MacroAssembler::jb32):
+        (JSC::MacroAssembler::jePtr):
+        (JSC::MacroAssembler::je32):
+        (JSC::MacroAssembler::jnePtr):
+        (JSC::MacroAssembler::jne32):
+        (JSC::MacroAssembler::jnzPtr):
+        (JSC::MacroAssembler::jnz32):
+        (JSC::MacroAssembler::jzPtr):
+        (JSC::MacroAssembler::jz32):
+        (JSC::MacroAssembler::joSub32):
+        (JSC::MacroAssembler::jump):
+        (JSC::MacroAssembler::sete32):
+        (JSC::MacroAssembler::setne32):
+        (JSC::MacroAssembler::setnz32):
+        (JSC::MacroAssembler::setz32):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::addl_mr):
+        (JSC::X86Assembler::andl_i8r):
+        (JSC::X86Assembler::cmpl_rm):
+        (JSC::X86Assembler::cmpl_mr):
+        (JSC::X86Assembler::cmpl_i8m):
+        (JSC::X86Assembler::subl_mr):
+        (JSC::X86Assembler::testl_i32m):
+        (JSC::X86Assembler::xorl_i32r):
+        (JSC::X86Assembler::movl_rm):
+        (JSC::X86Assembler::modRm_opmsib):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetVirtualRegister):
+        (JSC::JIT::emitPutCTIArgConstant):
+        (JSC::JIT::emitPutCTIParam):
+        (JSC::JIT::emitPutImmediateToCallFrameHeader):
+        (JSC::JIT::emitInitRegister):
+        (JSC::JIT::checkStructure):
+        (JSC::JIT::emitJumpIfJSCell):
+        (JSC::JIT::emitJumpIfNotJSCell):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmNum):
+
+2008-12-08  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed a bug where WREC would allow a quantifier whose minimum was
+        greater than its maximum.
+        
+        * wrec/Quantifier.h:
+        (JSC::WREC::Quantifier::Quantifier): ASSERT that the quantifier is not
+        backwards.
+        
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::Parser::consumeGreedyQuantifier): Verify that the minimum
+        is not greater than the maximum.
+
+2008-12-08  Eric Seidel  <eric@webkit.org>
+        
+        Build fix only, no review.
+
+        * JavaScriptCore.scons: add bytecode/JumpTable.cpp
+
+2008-12-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=22716
+        <rdar://problem/6428315>
+        Add RareData structure to CodeBlock for infrequently used auxiliary data
+        members.
+
+        Reduces memory on Membuster-head by ~.5MB 
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::dumpStatistics):
+        (JSC::CodeBlock::mark):
+        (JSC::CodeBlock::getHandlerForVPC):
+        (JSC::CodeBlock::nativeExceptionCodeForHandlerVPC):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::numberOfExceptionHandlers):
+        (JSC::CodeBlock::addExceptionHandler):
+        (JSC::CodeBlock::exceptionHandler):
+        (JSC::CodeBlock::addFunction):
+        (JSC::CodeBlock::function):
+        (JSC::CodeBlock::addUnexpectedConstant):
+        (JSC::CodeBlock::unexpectedConstant):
+        (JSC::CodeBlock::addRegExp):
+        (JSC::CodeBlock::regexp):
+        (JSC::CodeBlock::numberOfImmediateSwitchJumpTables):
+        (JSC::CodeBlock::addImmediateSwitchJumpTable):
+        (JSC::CodeBlock::immediateSwitchJumpTable):
+        (JSC::CodeBlock::numberOfCharacterSwitchJumpTables):
+        (JSC::CodeBlock::addCharacterSwitchJumpTable):
+        (JSC::CodeBlock::characterSwitchJumpTable):
+        (JSC::CodeBlock::numberOfStringSwitchJumpTables):
+        (JSC::CodeBlock::addStringSwitchJumpTable):
+        (JSC::CodeBlock::stringSwitchJumpTable):
+        (JSC::CodeBlock::evalCodeCache):
+        (JSC::CodeBlock::createRareDataIfNecessary):
+
+2008-11-26  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16814
+        Allow ports to disable ActiveX->NPAPI conversion for Media Player.
+        Improve handling of miscellaneous ActiveX objects.
+
+        * wtf/Platform.h: Add another ENABLE(...).
+
+2008-12-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Add dumping of CodeBlock member structure usage.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpStatistics):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::isEmpty):
+
+2008-12-08  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 22555: Sort "children" sections in Xcode project files
+
+        <https://bugs.webkit.org/show_bug.cgi?id=22555>
+
+        Reviewed by Eric Seidel.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Sorted.
+
+2008-12-08  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Enable Pan scrolling only when building on PLATFORM(WIN_OS)
+        Previously platforms like Apple Windows WebKit, Cairo Windows WebKit,
+        Wx and Chromium were enabling it explicitly, now we just turn it on
+        for all WIN_OS, later platforms can turn it off as needed on Windows
+        (or turn it on under Linux, etc.)
+        https://bugs.webkit.org/show_bug.cgi?id=22698
+
+        * wtf/Platform.h:
+
+2008-12-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Add basic memory statistics dumping for CodeBlock.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dumpStatistics):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::~CodeBlock):
+        * bytecode/CodeBlock.h:
+
+2008-12-08  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Linux build with newer gcc/glibc.
+
+        * jit/ExecutableAllocatorPosix.cpp: Include unistd.h for
+        getpagesize(), according to
+        http://opengroup.org/onlinepubs/007908775/xsh/getpagesize.html
+
+2008-12-08  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the build with Qt on Windows.
+
+        * JavaScriptCore.pri: Compile ExecutableAllocatorWin.cpp on Windows.
+
+2008-12-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Buildfix).
+
+        Fix non-WREC builds
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+
+2008-12-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Put ENABLE(ASSEMBLER) guards around use of ExecutableAllocator in global data
+
+        Correct Qt and Gtk project files
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * runtime/JSGlobalData.h:
+
+2008-12-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Add new files to other projects.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.pro:
+
+2008-12-07  Oliver Hunt  <oliver@apple.com>
+
+        Rubber stamped by Mark Rowe.
+
+        Rename ExecutableAllocatorMMAP to the more sensible ExecutableAllocatorPosix
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/ExecutableAllocator.h:
+        * jit/ExecutableAllocatorPosix.cpp: Renamed from JavaScriptCore/jit/ExecutableAllocatorMMAP.cpp.
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+
+2008-12-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich and Sam Weinig
+
+        <rdar://problem/6309878> Need more granular control over allocation of executable memory (21783)
+        <https://bugs.webkit.org/show_bug.cgi?id=21783>
+
+        Add a new allocator for use by the JIT that provides executable pages, so
+        we can get rid of the current hack that makes the entire heap executable.
+
+        1-2% progression on SunSpider-v8, 1% on SunSpider.  Reduces memory usage as well!
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::size):
+        (JSC::AssemblerBuffer::executableCopy):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::size):
+        (JSC::MacroAssembler::copyCode):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::size):
+        (JSC::X86Assembler::executableCopy):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::executablePool):
+        (JSC::CodeBlock::setExecutablePool):
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::derefStructures):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::~Interpreter):
+        * interpreter/Interpreter.h:
+        * jit/ExecutableAllocator.cpp: Added.
+        * jit/ExecutableAllocator.h: Added.
+        (JSC::ExecutablePool::create):
+        (JSC::ExecutablePool::alloc):
+        (JSC::ExecutablePool::~ExecutablePool):
+        (JSC::ExecutablePool::available):
+        (JSC::ExecutablePool::ExecutablePool):
+        (JSC::ExecutablePool::poolAllocate):
+        (JSC::ExecutableAllocator::ExecutableAllocator):
+        (JSC::ExecutableAllocator::poolForSize):
+        (JSC::ExecutablePool::sizeForAllocation):
+        * jit/ExecutableAllocatorMMAP.cpp: Added.
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        * jit/ExecutableAllocatorWin.cpp: Added.
+        (JSC::ExecutableAllocator::intializePageSize):
+        (JSC::ExecutablePool::systemAlloc):
+        (JSC::ExecutablePool::systemRelease):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        (JSC::JIT::compileCTIMachineTrampolines):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        * parser/Nodes.cpp:
+        (JSC::RegExpNode::emitBytecode):
+        * runtime/JSGlobalData.h:
+        (JSC::JSGlobalData::poolForSize):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::create):
+        (JSC::RegExp::~RegExp):
+        * runtime/RegExp.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        * wrec/WREC.cpp:
+        (JSC::WREC::Generator::compileRegExp):
+        * wrec/WRECGenerator.h:
+        * wtf/FastMalloc.cpp:
+        * wtf/FastMalloc.h:
+        * wtf/TCSystemAlloc.cpp:
+        (TryMmap):
+        (TryVirtualAlloc):
+        (TryDevMem):
+        (TCMalloc_SystemRelease):
+
+2008-12-06  Sam Weinig  <sam@webkit.org>
+
+        Fix the Gtk build.
+
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compilePutByIdHotPath):
+
+2008-12-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich,
+
+        Move CodeBlock constructor into the .cpp file.
+
+        Sunspider reports a .7% progression, but I can only assume this
+        is noise.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::CodeBlock):
+        * bytecode/CodeBlock.h:
+
+2008-12-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Split JumpTable code into its own file.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * bytecode/CodeBlock.cpp:
+        * bytecode/CodeBlock.h:
+        * bytecode/JumpTable.cpp: Copied from bytecode/CodeBlock.cpp.
+        * bytecode/JumpTable.h: Copied from bytecode/CodeBlock.h.
+
+2008-12-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22715
+        Encapsulate more CodeBlock members in preparation
+        of moving some of them to a rare data structure.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::locationForOffset):
+        (JSC::printConditionalJump):
+        (JSC::printGetByIdOp):
+        (JSC::printPutByIdOp):
+        (JSC::CodeBlock::printStructure):
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::unlinkCallers):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        (JSC::CodeBlock::mark):
+        (JSC::CodeBlock::getHandlerForVPC):
+        (JSC::CodeBlock::nativeExceptionCodeForHandlerVPC):
+        (JSC::CodeBlock::lineNumberForVPC):
+        (JSC::CodeBlock::expressionRangeForVPC):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::addCaller):
+        (JSC::CodeBlock::removeCaller):
+        (JSC::CodeBlock::isKnownNotImmediate):
+        (JSC::CodeBlock::isConstantRegisterIndex):
+        (JSC::CodeBlock::getConstant):
+        (JSC::CodeBlock::isTemporaryRegisterIndex):
+        (JSC::CodeBlock::getStubInfo):
+        (JSC::CodeBlock::getCallLinkInfo):
+        (JSC::CodeBlock::instructions):
+        (JSC::CodeBlock::setJITCode):
+        (JSC::CodeBlock::jitCode):
+        (JSC::CodeBlock::ownerNode):
+        (JSC::CodeBlock::setGlobalData):
+        (JSC::CodeBlock::setThisRegister):
+        (JSC::CodeBlock::thisRegister):
+        (JSC::CodeBlock::setNeedsFullScopeChain):
+        (JSC::CodeBlock::needsFullScopeChain):
+        (JSC::CodeBlock::setUsesEval):
+        (JSC::CodeBlock::usesEval):
+        (JSC::CodeBlock::setUsesArguments):
+        (JSC::CodeBlock::usesArguments):
+        (JSC::CodeBlock::codeType):
+        (JSC::CodeBlock::source):
+        (JSC::CodeBlock::sourceOffset):
+        (JSC::CodeBlock::addGlobalResolveInstruction):
+        (JSC::CodeBlock::numberOfPropertyAccessInstructions):
+        (JSC::CodeBlock::addPropertyAccessInstruction):
+        (JSC::CodeBlock::propertyAccessInstruction):
+        (JSC::CodeBlock::numberOfCallLinkInfos):
+        (JSC::CodeBlock::addCallLinkInfo):
+        (JSC::CodeBlock::callLinkInfo):
+        (JSC::CodeBlock::numberOfJumpTargets):
+        (JSC::CodeBlock::addJumpTarget):
+        (JSC::CodeBlock::jumpTarget):
+        (JSC::CodeBlock::lastJumpTarget):
+        (JSC::CodeBlock::numberOfExceptionHandlers):
+        (JSC::CodeBlock::addExceptionHandler):
+        (JSC::CodeBlock::exceptionHandler):
+        (JSC::CodeBlock::addExpressionInfo):
+        (JSC::CodeBlock::numberOfLineInfos):
+        (JSC::CodeBlock::addLineInfo):
+        (JSC::CodeBlock::lastLineInfo):
+        (JSC::CodeBlock::jitReturnAddressVPCMap):
+        (JSC::CodeBlock::numberOfIdentifiers):
+        (JSC::CodeBlock::addIdentifier):
+        (JSC::CodeBlock::identifier):
+        (JSC::CodeBlock::numberOfConstantRegisters):
+        (JSC::CodeBlock::addConstantRegister):
+        (JSC::CodeBlock::constantRegister):
+        (JSC::CodeBlock::addFunction):
+        (JSC::CodeBlock::function):
+        (JSC::CodeBlock::addFunctionExpression):
+        (JSC::CodeBlock::functionExpression):
+        (JSC::CodeBlock::addUnexpectedConstant):
+        (JSC::CodeBlock::unexpectedConstant):
+        (JSC::CodeBlock::addRegExp):
+        (JSC::CodeBlock::regexp):
+        (JSC::CodeBlock::symbolTable):
+        (JSC::CodeBlock::evalCodeCache):
+        New inline setters/getters.
+
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        (JSC::ProgramCodeBlock::~ProgramCodeBlock):
+        (JSC::ProgramCodeBlock::clearGlobalObject):
+        * bytecode/SamplingTool.cpp:
+        (JSC::ScopeSampleRecord::sample):
+        (JSC::SamplingTool::dump):
+        * bytecompiler/BytecodeGenerator.cpp:
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/Label.h:
+        * interpreter/CallFrame.cpp:
+        * interpreter/Interpreter.cpp:
+        * jit/JIT.cpp:
+        * jit/JITCall.cpp:
+        * jit/JITInlineMethods.h:
+        * jit/JITPropertyAccess.cpp:
+        * parser/Nodes.cpp:
+        * runtime/Arguments.h:
+        * runtime/ExceptionHelpers.cpp:
+        * runtime/JSActivation.cpp:
+        * runtime/JSActivation.h:
+        * runtime/JSGlobalObject.cpp:
+        Change direct access to use new getter/setters.
+
+2008-12-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Prevent GCC4.2 from hanging when trying to compile Interpreter.cpp.
+        Added "-fno-var-tracking" compiler flag.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22704
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-12-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Ordering of branch operands in MacroAssembler in unnecessarily  inconsistent.
+
+        je, jg etc take an immediate operand as the second argument, but for the
+        equality branches (je, jne) the immediate operand was the first argument.  This
+        was unnecessarily inconsistent.  Change je, jne methods to take the immediate
+        as the second argument.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22703
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::je32):
+        (JSC::MacroAssembler::jne32):
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+        (JSC::WREC::Generator::generateNonGreedyQuantifier):
+        (JSC::WREC::Generator::generateGreedyQuantifier):
+        (JSC::WREC::Generator::generatePatternCharacterPair):
+        (JSC::WREC::Generator::generatePatternCharacter):
+        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
+        (JSC::WREC::Generator::generateCharacterClassInverted):
+        (JSC::WREC::Generator::generateAssertionBOL):
+        (JSC::WREC::Generator::generateAssertionWordBoundary):
+
+2008-12-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Second tranche of porting JIT.cpp to MacroAssembler interface.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::mul32):
+        (JSC::MacroAssembler::jl32):
+        (JSC::MacroAssembler::jnzSub32):
+        (JSC::MacroAssembler::joAdd32):
+        (JSC::MacroAssembler::joMul32):
+        (JSC::MacroAssembler::jzSub32):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitSlowScriptCheck):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpIfNotJSCell):
+        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
+
+2008-12-05  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 22609: Provide a build-time choice when generating hash tables for properties of built-in DOM objects
+
+        <https://bugs.webkit.org/show_bug.cgi?id=22609>
+        <rdar://problem/6331749>
+
+        Reviewed by Darin Adler.
+
+        Initial patch by Yosen Lin.  Adapted for ToT WebKit by David Kilzer.
+
+        Added back the code that generates a "compact" hash (instead of a
+        perfect hash) as a build-time option using the
+        ENABLE(PERFECT_HASH_SIZE) macro as defined in Lookup.h.
+
+        * create_hash_table: Rename variables to differentiate perfect hash
+        values from compact hash values.  Added back code to compute compact
+        hash tables.  Generate both hash table sizes and emit
+        conditionalized code based on ENABLE(PERFECT_HASH_SIZE).
+        * runtime/Lookup.cpp:
+        (JSC::HashTable::createTable): Added version of createTable() for
+        use with compact hash tables.
+        (JSC::HashTable::deleteTable): Updated to work with compact hash
+        tables.
+        * runtime/Lookup.h: Defined ENABLE(PERFECT_HASH_SIZE) macro here.
+        (JSC::HashEntry::initialize): Set m_next to zero when using compact
+        hash tables.
+        (JSC::HashEntry::setNext): Added for compact hash tables.
+        (JSC::HashEntry::next): Added for compact hash tables.
+        (JSC::HashTable::entry): Added version of entry() for use with
+        compact hash tables.
+        * runtime/Structure.cpp:
+        (JSC::Structure::getEnumerablePropertyNames): Updated to work with
+        compact hash tables.
+
+2008-12-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Remove redundant calls to JIT::emitSlowScriptCheck.
+        This is checked in the hot path, so is not needed on the slow path - and the code
+        was being planted before the start of the slow case, so was completely unreachable!
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+
+2008-12-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Move JIT::compileOpStrictEq to MacroAssembler interface.
+
+        The rewrite also looks like a small (<1%) performance progression.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22697
+
+        * jit/JIT.cpp:
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitJumpIfJSCell):
+        (JSC::JIT::emitJumpSlowCaseIfJSCell):
+
+2008-12-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Remove m_assembler from MacroAssembler::Jump.
+        Keeping a pointer allowed for some syntactic sugar - "link()" looks nicer
+        than "link(this)".  But maintaining this doubles the size of Jump, which
+        is even more unfortunate for the JIT, since there are many large structures
+        holding JmpSrcs.  Probably best to remove it.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22693
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::Jump::Jump):
+        (JSC::MacroAssembler::Jump::link):
+        (JSC::MacroAssembler::Jump::linkTo):
+        (JSC::MacroAssembler::JumpList::link):
+        (JSC::MacroAssembler::JumpList::linkTo):
+        (JSC::MacroAssembler::jae32):
+        (JSC::MacroAssembler::je32):
+        (JSC::MacroAssembler::je16):
+        (JSC::MacroAssembler::jg32):
+        (JSC::MacroAssembler::jge32):
+        (JSC::MacroAssembler::jl32):
+        (JSC::MacroAssembler::jle32):
+        (JSC::MacroAssembler::jnePtr):
+        (JSC::MacroAssembler::jne32):
+        (JSC::MacroAssembler::jnset32):
+        (JSC::MacroAssembler::jset32):
+        (JSC::MacroAssembler::jump):
+        (JSC::MacroAssembler::jzSub32):
+        (JSC::MacroAssembler::joAdd32):
+        (JSC::MacroAssembler::call):
+        * wrec/WREC.cpp:
+        (JSC::WREC::Generator::compileRegExp):
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+        (JSC::WREC::Generator::generateBackreferenceQuantifier):
+        (JSC::WREC::Generator::generateNonGreedyQuantifier):
+        (JSC::WREC::Generator::generateGreedyQuantifier):
+        (JSC::WREC::Generator::generatePatternCharacter):
+        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
+        (JSC::WREC::Generator::generateCharacterClassInverted):
+        (JSC::WREC::Generator::generateCharacterClass):
+        (JSC::WREC::Generator::generateParenthesesAssertion):
+        (JSC::WREC::Generator::generateParenthesesInvertedAssertion):
+        (JSC::WREC::Generator::generateParenthesesNonGreedy):
+        (JSC::WREC::Generator::generateParenthesesResetTrampoline):
+        (JSC::WREC::Generator::generateAssertionBOL):
+        (JSC::WREC::Generator::generateAssertionEOL):
+        (JSC::WREC::Generator::generateAssertionWordBoundary):
+        (JSC::WREC::Generator::generateBackreference):
+        (JSC::WREC::Generator::terminateAlternative):
+        (JSC::WREC::Generator::terminateDisjunction):
+        * wrec/WRECParser.h:
+
+2008-12-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Simplify JIT generated checks for timeout code, by moving more work into the C function.
+        https://bugs.webkit.org/show_bug.cgi?id=22688
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_timeout_check):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::emitSlowScriptCheck):
+
+2008-12-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Encapsulate access to jump tables in the CodeBlock in preparation
+        of moving them to a rare data structure.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::shrinkToFit):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::numberOfImmediateSwitchJumpTables):
+        (JSC::CodeBlock::addImmediateSwitchJumpTable):
+        (JSC::CodeBlock::immediateSwitchJumpTable):
+        (JSC::CodeBlock::numberOfCharacterSwitchJumpTables):
+        (JSC::CodeBlock::addCharacterSwitchJumpTable):
+        (JSC::CodeBlock::characterSwitchJumpTable):
+        (JSC::CodeBlock::numberOfStringSwitchJumpTables):
+        (JSC::CodeBlock::addStringSwitchJumpTable):
+        (JSC::CodeBlock::stringSwitchJumpTable):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::endSwitch):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::cti_op_switch_imm):
+        (JSC::Interpreter::cti_op_switch_char):
+        (JSC::Interpreter::cti_op_switch_string):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+
+2008-12-05  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r39020
+
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::restoreArgumentReference):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        Add some apparently-missing __.
+
+2008-12-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=22673
+        
+        Added support for the assertion (?=) and inverted assertion (?!) atoms
+        in WREC.
+
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateParenthesesAssertion):
+        (JSC::WREC::Generator::generateParenthesesInvertedAssertion): Split the
+        old (unused) generateParentheses into these two functions, with more
+        limited capabilities.
+        
+        * wrec/WRECGenerator.h:
+        (JSC::WREC::Generator::): Moved an enum to the top of the class definition,
+        to match the WebKit style, and removed a defunct comment.
+
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::Parser::parseParentheses):
+        (JSC::WREC::Parser::consumeParenthesesType):
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::): Added support for parsing (?=) and (?!).
+
+2008-12-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Tor Arne Vestbø.
+
+        Disable the JIT for the Qt build alltogether again, after observing
+        more miscompilations in a wider range of newer gcc versions.
+
+        * JavaScriptCore.pri:
+
+2008-12-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Disable the JIT for the Qt build on Linux unless gcc is >= 4.2,
+        due to miscompilations.
+
+        * JavaScriptCore.pri:
+
+2008-12-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Start porting the JIT to use the MacroAssembler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22671
+        No change in performance.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::Jump::operator X86Assembler::JmpSrc):
+        (JSC::MacroAssembler::add32):
+        (JSC::MacroAssembler::and32):
+        (JSC::MacroAssembler::lshift32):
+        (JSC::MacroAssembler::rshift32):
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::store32):
+        (JSC::MacroAssembler::poke):
+        (JSC::MacroAssembler::move):
+        (JSC::MacroAssembler::compareImm32ForBranchEquality):
+        (JSC::MacroAssembler::jnePtr):
+        (JSC::MacroAssembler::jnset32):
+        (JSC::MacroAssembler::jset32):
+        (JSC::MacroAssembler::jzeroSub32):
+        (JSC::MacroAssembler::joverAdd32):
+        (JSC::MacroAssembler::call):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::shll_i8r):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::compileBinaryArithOp):
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetVirtualRegister):
+        (JSC::JIT::emitPutCTIArg):
+        (JSC::JIT::emitPutCTIArgConstant):
+        (JSC::JIT::emitGetCTIArg):
+        (JSC::JIT::emitPutCTIArgFromVirtualRegister):
+        (JSC::JIT::emitPutCTIParam):
+        (JSC::JIT::emitGetCTIParam):
+        (JSC::JIT::emitPutToCallFrameHeader):
+        (JSC::JIT::emitPutImmediateToCallFrameHeader):
+        (JSC::JIT::emitGetFromCallFrameHeader):
+        (JSC::JIT::emitPutVirtualRegister):
+        (JSC::JIT::emitInitRegister):
+        (JSC::JIT::emitNakedCall):
+        (JSC::JIT::restoreArgumentReference):
+        (JSC::JIT::restoreArgumentReferenceForTrampoline):
+        (JSC::JIT::emitCTICall):
+        (JSC::JIT::checkStructure):
+        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmNum):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmNums):
+        (JSC::JIT::emitFastArithDeTagImmediate):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::JIT::emitFastArithReTagImmediate):
+        (JSC::JIT::emitFastArithPotentiallyReTagImmediate):
+        (JSC::JIT::emitFastArithImmToInt):
+        (JSC::JIT::emitFastArithIntToImmOrSlowCase):
+        (JSC::JIT::emitFastArithIntToImmNoCheck):
+        (JSC::JIT::emitTagAsBoolImmediate):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::privateCompilePutByIdTransition):
+
+2008-12-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Some refactoring for generateGreedyQuantifier.
+        
+        SunSpider reports no change (possibly a 0.3% speedup).
+
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateGreedyQuantifier): Clarified label
+        meanings and unified some logic to simplify things.
+
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::parseAlternative): Added a version of parseAlternative
+        that can jump to a Label, instead of a JumpList, upon failure. (Eventually,
+        when we have a true Label class, this will be redundant.) This makes
+        things easier for generateGreedyQuantifier, because it can avoid
+        explicitly linking things.
+
+2008-12-04  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Fix crashes in the Qt build on Linux/i386 with non-executable memory
+        by enabling TCSystemAlloc and the PROT_EXEC flag for mmap.
+
+        * JavaScriptCore.pri: Enable the use of TCSystemAlloc if the JIT is
+        enabled.
+        * wtf/TCSystemAlloc.cpp: Extend the PROT_EXEC permissions to
+        PLATFORM(QT).
+
+2008-12-04  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Enable ENABLE_JIT_OPTIMIZE_CALL, ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS
+        and ENABLE_JIT_OPTIMIZE_ARITHMETIC, as suggested by Niko.
+
+        * JavaScriptCore.pri: 
+
+2008-12-04  Kent Hansen  <khansen@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Enable the JSC jit for the Qt build by default for release builds on
+        linux-g++ and win32-msvc.
+
+        * JavaScriptCore.pri:
+
+2008-12-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Allow JIT to function without property access repatching and arithmetic optimizations.
+        Controlled by ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS and ENABLE_JIT_OPTIMIZE_ARITHMETIC switches.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22643
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp: Copied from jit/JIT.cpp.
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        * jit/JITPropertyAccess.cpp: Copied from jit/JIT.cpp.
+        (JSC::JIT::compileGetByIdHotPath):
+        (JSC::JIT::compileGetByIdSlowCase):
+        (JSC::JIT::compilePutByIdHotPath):
+        (JSC::JIT::compilePutByIdSlowCase):
+        (JSC::resizePropertyStorage):
+        (JSC::transitionWillNeedStorageRealloc):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * wtf/Platform.h:
+
+2008-12-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Optimized sequences of characters in regular expressions by comparing
+        two characters at a time.
+        
+        1-2% speedup on SunSpider, 19-25% speedup on regexp-dna.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::load32):
+        (JSC::MacroAssembler::jge32): Filled out a few more macro methods.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::movl_mr): Added a verion of movl_mr that operates
+        without an offset, to allow the macro assembler to optmize for that case.
+        
+        * wrec/WREC.cpp:
+        (JSC::WREC::Generator::compileRegExp): Test the saved value of index
+        instead of the index register when checking for "end of input." The
+        index register doesn't increment by 1 in an orderly fashion, so testing
+        it for == "end of input" is not valid.
+        
+        Also, jump all the way to "return failure" upon reaching "end of input,"
+        instead of executing the next alternative. This is more logical, and
+        it's a slight optimization in the case of an expression with many alternatives.
+
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateIncrementIndex): Added support for
+        jumping to a failure label in the case where the index has reached "end
+        of input."
+
+        (JSC::WREC::Generator::generatePatternCharacterSequence):
+        (JSC::WREC::Generator::generatePatternCharacterPair): This is the
+        optmization. It's basically like generatePatternCharacter, but it runs two
+        characters at a time.
+        
+        (JSC::WREC::Generator::generatePatternCharacter): Changed to use isASCII,
+        since it's clearer than comparing to a magic hex value.
+        
+        * wrec/WRECGenerator.h:
+
+2008-12-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Allow JIT to operate without the call-repatching optimization.
+        Controlled by ENABLE(JIT_OPTIMIZE_CALL), defaults on, disabling
+        this leads to significant performance regression.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22639
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITCall.cpp: Copied from jit/JIT.cpp.
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpCallEvalSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpCallSlowCase):
+        (JSC::unreachable):
+        * jit/JITInlineMethods.h: Copied from jit/JIT.cpp.
+        (JSC::JIT::checkStructure):
+        (JSC::JIT::emitFastArithPotentiallyReTagImmediate):
+        (JSC::JIT::emitTagAsBoolImmediate):
+        * wtf/Platform.h:
+
+2008-12-03  Eric Seidel  <eric@webkit.org>
+
+        Rubber-stamped by David Hyatt.
+
+        Make HAVE_ACCESSIBILITY only define if !defined
+
+        * wtf/Platform.h:
+
+2008-12-03  Sam Weinig  <sam@webkit.org>
+
+        Fix build.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::orl_i32r):
+
+2008-12-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove shared AssemblerBuffer 1MB buffer and instead give AssemblerBuffer
+        an 256 byte inline capacity.
+
+        1% progression on Sunspider.
+
+        * assembler/AssemblerBuffer.h:
+        (JSC::AssemblerBuffer::AssemblerBuffer):
+        (JSC::AssemblerBuffer::~AssemblerBuffer):
+        (JSC::AssemblerBuffer::grow):
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::MacroAssembler):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::X86Assembler):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::JIT):
+        * parser/Nodes.cpp:
+        (JSC::RegExpNode::emitBytecode):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::create):
+        * runtime/RegExp.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        * wrec/WREC.cpp:
+        (JSC::WREC::Generator::compileRegExp):
+        * wrec/WRECGenerator.h:
+        (JSC::WREC::Generator::Generator):
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::Parser):
+
+2008-12-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt, with help from Gavin Barraclough.
+        
+        orl_i32r was actually coded as an 8bit OR. So, I renamed orl_i32r to
+        orl_i8r, changed all orl_i32r clients to use orl_i8r, and then added
+        a new orl_i32r that actually does a 32bit OR.
+        
+        (32bit OR is currently unused, but a patch I'm working on uses it.)
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::or32): Updated to choose between 8bit and 32bit OR.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::orl_i8r): The old orl_i32r.
+        (JSC::X86Assembler::orl_i32r): The new orl_i32r.
+        
+        * jit/JIT.cpp:
+        (JSC::JIT::emitFastArithPotentiallyReTagImmediate):
+        (JSC::JIT::emitTagAsBoolImmediate): Use orl_i8r, since we're ORing 8bit
+        values.
+
+2008-12-03  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Helper functions for turn -> degrees.
+        https://bugs.webkit.org/show_bug.cgi?id=22497
+
+        * wtf/MathExtras.h:
+        (turn2deg):
+        (deg2turn):
+
+2008-12-02  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 22504: Crashes during code generation occur due to refing of ignoredResult()
+        <https://bugs.webkit.org/show_bug.cgi?id=22504>
+
+        Since ignoredResult() was implemented by casting 1 to a RegisterID*, any
+        attempt to ref ignoredResult() results in a crash. This will occur in
+        code generation of a function body where a node emits another node with
+        the dst that was passed to it, and then refs the returned RegisterID*.
+
+        To fix this problem, make ignoredResult() a member function of
+        BytecodeGenerator that simply returns a pointe to a fixed RegisterID
+        member of BytecodeGenerator.
+
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::ignoredResult):
+        * bytecompiler/RegisterID.h:
+        * parser/Nodes.cpp:
+        (JSC::NullNode::emitBytecode):
+        (JSC::BooleanNode::emitBytecode):
+        (JSC::NumberNode::emitBytecode):
+        (JSC::StringNode::emitBytecode):
+        (JSC::RegExpNode::emitBytecode):
+        (JSC::ThisNode::emitBytecode):
+        (JSC::ResolveNode::emitBytecode):
+        (JSC::ObjectLiteralNode::emitBytecode):
+        (JSC::PostfixResolveNode::emitBytecode):
+        (JSC::PostfixBracketNode::emitBytecode):
+        (JSC::PostfixDotNode::emitBytecode):
+        (JSC::DeleteValueNode::emitBytecode):
+        (JSC::VoidNode::emitBytecode):
+        (JSC::TypeOfResolveNode::emitBytecode):
+        (JSC::TypeOfValueNode::emitBytecode):
+        (JSC::PrefixResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::CommaNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        (JSC::FunctionBodyNode::emitBytecode):
+        (JSC::FuncDeclNode::emitBytecode):
+
+2008-12-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=22537
+        REGRESSION (r38745): Assertion failure in jsSubstring() at ge.com
+
+        The bug was that index would become greater than length, so our
+        "end of input" checks, which all check "index == length", would fail.
+        
+        The solution is to check for end of input before incrementing index,
+        to ensure that index is always <= length.
+        
+        As a side benefit, generateJumpIfEndOfInput can now use je instead of
+        jg, which should be slightly faster.
+
+        * wrec/WREC.cpp:
+        (JSC::WREC::Generator::compileRegExp):
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateJumpIfEndOfInput):
+
+2008-12-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Plant shift right immediate instructions, which are awesome.
+        https://bugs.webkit.org/show_bug.cgi?id=22610
+        ~5% on the v8-crypto test.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+
+2008-12-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Cleaned up SegmentedVector by abstracting segment access into helper
+        functions.
+        
+        SunSpider reports no change.
+
+        * bytecompiler/SegmentedVector.h:
+        (JSC::SegmentedVector::SegmentedVector):
+        (JSC::SegmentedVector::~SegmentedVector):
+        (JSC::SegmentedVector::size):
+        (JSC::SegmentedVector::at):
+        (JSC::SegmentedVector::operator[]):
+        (JSC::SegmentedVector::last):
+        (JSC::SegmentedVector::append):
+        (JSC::SegmentedVector::removeLast):
+        (JSC::SegmentedVector::grow):
+        (JSC::SegmentedVector::clear):
+        (JSC::SegmentedVector::deleteAllSegments):
+        (JSC::SegmentedVector::segmentFor):
+        (JSC::SegmentedVector::subscriptFor):
+        (JSC::SegmentedVector::ensureSegmentsFor):
+        (JSC::SegmentedVector::ensureSegment):
+
+2008-12-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Geoffrey Garen. (Patch by Cameron Zwarich <zwarich@apple.com>.)
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=22482
+        REGRESSION (r37991): Occasionally see "Scene rendered incorrectly"
+        message when running the V8 Raytrace benchmark
+        
+        Rolled out r37991. It didn't properly save xmm0, which is caller-save,
+        before calling helper functions.
+        
+        SunSpider and v8 benchmarks show little change -- possibly a .2%
+        SunSpider regression, possibly a .2% v8 benchmark speedup.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Instruction.h:
+        (JSC::Instruction::):
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitUnaryOp):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::emitToJSNumber):
+        (JSC::BytecodeGenerator::emitTypeOf):
+        (JSC::BytecodeGenerator::emitGetPropertyNames):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * parser/Nodes.cpp:
+        (JSC::UnaryOpNode::emitBytecode):
+        (JSC::BinaryOpNode::emitBytecode):
+        (JSC::EqualNode::emitBytecode):
+        * parser/ResultType.h:
+        (JSC::ResultType::isReusable):
+        (JSC::ResultType::mightBeNumber):
+        * runtime/JSNumberCell.h:
+
+2008-12-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove unused (sampling only, and derivable) argument to JIT::emitCTICall.
+        https://bugs.webkit.org/show_bug.cgi?id=22587
+
+        * jit/JIT.cpp:
+        (JSC::JIT::emitCTICall):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::emitSlowScriptCheck):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        * jit/JIT.h:
+
+2008-12-02  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+        
+        Fix the inheritance chain for JSFunction.
+
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::info): Add InternalFunction::info as parent class
+
+2008-12-02  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix ability to include JavaScriptCore.pri from other .pro files.
+
+        * JavaScriptCore.pri: Moved -O3 setting into the .pro files.
+        * JavaScriptCore.pro:
+        * jsc.pro:
+
+2008-12-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich, with help from Gavin Barraclough.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=22583.
+
+        Refactored regular expression parsing to parse sequences of characters
+        as a single unit, in preparation for optimizing sequences of characters.
+        
+        SunSpider reports no change.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wrec/Escapes.h: Added. Set of classes for representing an escaped
+        token in a pattern.
+
+        * wrec/Quantifier.h:
+        (JSC::WREC::Quantifier::Quantifier): Simplified this constructor slightly,
+        to match the new Escape constructor.
+
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generatePatternCharacterSequence):
+        * wrec/WRECGenerator.h: Added an interface for generating a sequence
+        of pattern characters at a time. It doesn't do anything special yet.
+
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::Parser::consumeGreedyQuantifier):
+        (JSC::WREC::Parser::consumeQuantifier): Renamed "parse" to "consume" in
+        these functions, to match "consumeEscape."
+
+        (JSC::WREC::Parser::parsePatternCharacterSequence): New function for
+        iteratively aggregating a sequence of characters in a pattern.
+
+        (JSC::WREC::Parser::parseCharacterClassQuantifier):
+        (JSC::WREC::Parser::parseBackreferenceQuantifier): Renamed "parse" to
+        "consume" in these functions, to match "consumeEscape."
+
+        (JSC::WREC::Parser::parseCharacterClass): Refactored to use the common
+        escape processing code in consumeEscape.
+
+        (JSC::WREC::Parser::parseEscape): Refactored to use the common
+        escape processing code in consumeEscape.
+
+        (JSC::WREC::Parser::consumeEscape): Factored escaped token processing
+        into a common function, since we were doing this in a few places.
+
+        (JSC::WREC::Parser::parseTerm): Refactored to use the common
+        escape processing code in consumeEscape.
+
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::consumeOctal): Refactored to use a helper function
+        for reading a digit.
+
+2008-12-01  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 20340: SegmentedVector segment allocations can lead to unsafe use of temporary registers
+        <https://bugs.webkit.org/show_bug.cgi?id=20340>
+
+        SegmentedVector currently frees segments and reallocates them when used
+        as a stack. This can lead to unsafe use of pointers into freed segments.
+
+        In order to fix this problem, SegmentedVector will be changed to only
+        grow and never shrink. Also, rename the reserveCapacity() member
+        function to grow() to match the actual usage in BytecodeGenerator, where
+        this function is used to allocate a group of registers at once, rather
+        than merely saving space for them.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Use grow() instead of 
+        reserveCapacity().
+        * bytecompiler/SegmentedVector.h:
+        (JSC::SegmentedVector::SegmentedVector):
+        (JSC::SegmentedVector::last):
+        (JSC::SegmentedVector::append):
+        (JSC::SegmentedVector::removeLast):
+        (JSC::SegmentedVector::grow): Renamed from reserveCapacity().
+        (JSC::SegmentedVector::clear):
+
+2008-12-01  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Anders Carlsson.
+
+        Disable WREC for x86_64 since memory allocated by the system allocator is not marked executable,
+        which causes 64-bit debug builds to crash.  Once we have a dedicated allocator for executable
+        memory we can turn this back on.
+
+        * wtf/Platform.h:
+
+2008-12-01  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Restore inline buffer after vector is shrunk back below its inline capacity.
+
+        * wtf/Vector.h:
+        (WTF::):
+        (WTF::VectorBuffer::restoreInlineBufferIfNeeded):
+        (WTF::::shrinkCapacity):
+
+2008-11-30  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        Try to return free pages in the current thread cache too.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::releaseFastMallocFreeMemory):
+
+2008-12-01  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22567
+        Make HashTable work as expected with respect to threads. Specifically, it has class-level
+        thread safety and constant methods work on constant objects without synchronization.
+        
+        No observable change in behavior, so no test. This only affects debug builds.
+
+        * wtf/HashTable.cpp:
+        (WTF::hashTableStatsMutex):
+        (WTF::HashTableStats::~HashTableStats):
+        (WTF::HashTableStats::recordCollisionAtCount):
+        Guarded variable access with a mutex.
+
+        * wtf/HashTable.h:
+        (WTF::::lookup):
+        (WTF::::lookupForWriting):
+        (WTF::::fullLookupForWriting):
+        (WTF::::add):
+        (WTF::::reinsert):
+        (WTF::::remove):
+        (WTF::::rehash):
+        Changed increments of static variables to use atomicIncrement.
+
+        (WTF::::invalidateIterators):
+        (WTF::addIterator):
+        (WTF::removeIterator):
+        Guarded mutable access with a mutex.
+
+2008-11-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Enable WREC on PLATFORM(X86_64).  This change predominantly requires changes to the
+        WREC::Generator::generateEnter method to support the x86-64 ABI, and addition of
+        support for a limited number of quadword operations in the X86Assembler.
+
+        This patch will cause the JS heap to be allocated with RWX permissions on 64-bit Mac
+        platforms.  This is a regression with respect to previous 64-bit behaviour, but is no
+        more permissive than on 32-bit builds.  This issue should be addressed at some point.
+        (This is tracked by bug #21783.)
+
+        https://bugs.webkit.org/show_bug.cgi?id=22554
+        Greater than 4x speedup on regexp-dna, on x86-64.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::addPtr):
+        (JSC::MacroAssembler::loadPtr):
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::pop):
+        (JSC::MacroAssembler::push):
+        (JSC::MacroAssembler::move):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::movq_rr):
+        (JSC::X86Assembler::addl_i8m):
+        (JSC::X86Assembler::addl_i32r):
+        (JSC::X86Assembler::addq_i8r):
+        (JSC::X86Assembler::addq_i32r):
+        (JSC::X86Assembler::movq_mr):
+        (JSC::X86Assembler::movq_rm):
+        * wrec/WREC.h:
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+        (JSC::WREC::Generator::generateReturnSuccess):
+        (JSC::WREC::Generator::generateReturnFailure):
+        * wtf/Platform.h:
+        * wtf/TCSystemAlloc.cpp:
+
+2008-12-01  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Preliminary work for bug 20340: SegmentedVector segment allocations can lead to unsafe use of temporary registers
+        <https://bugs.webkit.org/show_bug.cgi?id=20340>
+
+        SegmentedVector currently frees segments and reallocates them when used
+        as a stack. This can lead to unsafe use of pointers into freed segments.
+
+        In order to fix this problem, SegmentedVector will be changed to only
+        grow and never shrink, with the sole exception of clearing all of its
+        data, a capability that is required by Lexer. This patch changes the
+        public interface to only allow for these capabilities.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Use reserveCapacity()
+        instead of resize() for m_globals and m_parameters.
+        * bytecompiler/SegmentedVector.h:
+        (JSC::SegmentedVector::resize): Removed.
+        (JSC::SegmentedVector::reserveCapacity): Added.
+        (JSC::SegmentedVector::clear): Added.
+        (JSC::SegmentedVector::shrink): Removed.
+        (JSC::SegmentedVector::grow): Removed.
+        * parser/Lexer.cpp:
+        (JSC::Lexer::clear): Use clear() instead of resize(0).
+
+2008-11-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Renames jumps to m_jumps in JumpList.
+
+        * assembler/MacroAssembler.h:
+        (JSC::MacroAssembler::JumpList::link):
+        (JSC::MacroAssembler::JumpList::linkTo):
+        (JSC::MacroAssembler::JumpList::append):
+
+2008-11-30  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=22557
+        
+        Report free size in central and thread caches too.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMallocStats::fastMallocStatistics):
+        * wtf/FastMalloc.h:
+
+2008-11-29  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dan Bernstein.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=22557
+        Add statistics for JavaScript GC heap.
+
+        * JavaScriptCore.exp:
+        * runtime/Collector.cpp:
+        (JSC::Heap::objectCount):
+        (JSC::addToStatistics):
+        (JSC::Heap::statistics):
+        * runtime/Collector.h:
+
+2008-11-29  Antti Koivisto  <antti@apple.com>
+
+        Fix debug build by adding a stub method.
+
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMallocStatistics):
+
+2008-11-29  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=22557
+        
+        Add function for getting basic statistics from FastMalloc.
+
+        * JavaScriptCore.exp:
+        * wtf/FastMalloc.cpp:
+        (WTF::DLL_Length):
+        (WTF::TCMalloc_PageHeap::ReturnedBytes):
+        (WTF::TCMallocStats::fastMallocStatistics):
+        * wtf/FastMalloc.h:
+
+2008-11-29  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        The C++ standard does not automatically grant the friendships of an
+        enclosing class to its nested subclasses, so we should do so explicitly.
+        This fixes the GCC 4.0 build, although both GCC 4.2 and Visual C++ 2005
+        accept the incorrect code as it is.
+
+        * assembler/MacroAssembler.h:
+
+2008-11-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Add the class MacroAssembler to provide some abstraction of code generation,
+        and change WREC to make use of this class, rather than directly accessing
+        the X86Assembler.
+
+        This patch also allows WREC to be compiled without the rest of the JIT enabled.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/MacroAssembler.h: Added.
+        (JSC::MacroAssembler::):
+        (JSC::MacroAssembler::MacroAssembler):
+        (JSC::MacroAssembler::copyCode):
+        (JSC::MacroAssembler::Address::Address):
+        (JSC::MacroAssembler::ImplicitAddress::ImplicitAddress):
+        (JSC::MacroAssembler::BaseIndex::BaseIndex):
+        (JSC::MacroAssembler::Label::Label):
+        (JSC::MacroAssembler::Jump::Jump):
+        (JSC::MacroAssembler::Jump::link):
+        (JSC::MacroAssembler::Jump::linkTo):
+        (JSC::MacroAssembler::JumpList::link):
+        (JSC::MacroAssembler::JumpList::linkTo):
+        (JSC::MacroAssembler::JumpList::append):
+        (JSC::MacroAssembler::Imm32::Imm32):
+        (JSC::MacroAssembler::add32):
+        (JSC::MacroAssembler::or32):
+        (JSC::MacroAssembler::sub32):
+        (JSC::MacroAssembler::loadPtr):
+        (JSC::MacroAssembler::load32):
+        (JSC::MacroAssembler::load16):
+        (JSC::MacroAssembler::storePtr):
+        (JSC::MacroAssembler::store32):
+        (JSC::MacroAssembler::pop):
+        (JSC::MacroAssembler::push):
+        (JSC::MacroAssembler::peek):
+        (JSC::MacroAssembler::poke):
+        (JSC::MacroAssembler::move):
+        (JSC::MacroAssembler::compareImm32ForBranch):
+        (JSC::MacroAssembler::compareImm32ForBranchEquality):
+        (JSC::MacroAssembler::jae32):
+        (JSC::MacroAssembler::je32):
+        (JSC::MacroAssembler::je16):
+        (JSC::MacroAssembler::jg32):
+        (JSC::MacroAssembler::jge32):
+        (JSC::MacroAssembler::jl32):
+        (JSC::MacroAssembler::jle32):
+        (JSC::MacroAssembler::jne32):
+        (JSC::MacroAssembler::jump):
+        (JSC::MacroAssembler::breakpoint):
+        (JSC::MacroAssembler::ret):
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::cmpw_rm):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::Interpreter):
+        * interpreter/Interpreter.h:
+        (JSC::Interpreter::assemblerBuffer):
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * wrec/WREC.cpp:
+        (JSC::WREC::Generator::compileRegExp):
+        * wrec/WREC.h:
+        * wrec/WRECFunctors.cpp:
+        (JSC::WREC::GeneratePatternCharacterFunctor::generateAtom):
+        (JSC::WREC::GenerateCharacterClassFunctor::generateAtom):
+        (JSC::WREC::GenerateBackreferenceFunctor::generateAtom):
+        (JSC::WREC::GenerateParenthesesNonGreedyFunctor::generateAtom):
+        * wrec/WRECFunctors.h:
+        (JSC::WREC::GenerateParenthesesNonGreedyFunctor::GenerateParenthesesNonGreedyFunctor):
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+        (JSC::WREC::Generator::generateReturnSuccess):
+        (JSC::WREC::Generator::generateSaveIndex):
+        (JSC::WREC::Generator::generateIncrementIndex):
+        (JSC::WREC::Generator::generateLoadCharacter):
+        (JSC::WREC::Generator::generateJumpIfEndOfInput):
+        (JSC::WREC::Generator::generateJumpIfNotEndOfInput):
+        (JSC::WREC::Generator::generateReturnFailure):
+        (JSC::WREC::Generator::generateBacktrack1):
+        (JSC::WREC::Generator::generateBacktrackBackreference):
+        (JSC::WREC::Generator::generateBackreferenceQuantifier):
+        (JSC::WREC::Generator::generateNonGreedyQuantifier):
+        (JSC::WREC::Generator::generateGreedyQuantifier):
+        (JSC::WREC::Generator::generatePatternCharacter):
+        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
+        (JSC::WREC::Generator::generateCharacterClassInverted):
+        (JSC::WREC::Generator::generateCharacterClass):
+        (JSC::WREC::Generator::generateParentheses):
+        (JSC::WREC::Generator::generateParenthesesNonGreedy):
+        (JSC::WREC::Generator::generateParenthesesResetTrampoline):
+        (JSC::WREC::Generator::generateAssertionBOL):
+        (JSC::WREC::Generator::generateAssertionEOL):
+        (JSC::WREC::Generator::generateAssertionWordBoundary):
+        (JSC::WREC::Generator::generateBackreference):
+        (JSC::WREC::Generator::terminateAlternative):
+        (JSC::WREC::Generator::terminateDisjunction):
+        * wrec/WRECGenerator.h:
+        (JSC::WREC::Generator::Generator):
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::Parser::parsePatternCharacterQualifier):
+        (JSC::WREC::Parser::parseCharacterClassQuantifier):
+        (JSC::WREC::Parser::parseBackreferenceQuantifier):
+        (JSC::WREC::Parser::parseParentheses):
+        (JSC::WREC::Parser::parseCharacterClass):
+        (JSC::WREC::Parser::parseOctalEscape):
+        (JSC::WREC::Parser::parseEscape):
+        (JSC::WREC::Parser::parseTerm):
+        (JSC::WREC::Parser::parseDisjunction):
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::Parser):
+        (JSC::WREC::Parser::parsePattern):
+        (JSC::WREC::Parser::parseAlternative):
+        * wtf/Platform.h:
+
+2008-11-28  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix compilation on Windows CE
+
+        Port away from the use of errno after calling strtol(), instead
+        detect conversion errors by checking the result and the stop
+        position.
+
+        * runtime/DateMath.cpp:
+        (JSC::parseLong):
+        (JSC::parseDate):
+
+2008-11-28  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Implement lowResUTCTime() on Windows CE using GetSystemTime as _ftime() is not available.
+
+        * runtime/DateMath.cpp:
+        (JSC::lowResUTCTime):
+
+2008-11-28  Simon Hausmann  <hausmann@webkit.org>
+
+        Rubber-stamped by Tor Arne Vestbø.
+
+        Removed unnecessary inclusion of errno.h, which also fixes compilation on Windows CE.
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+
+2008-11-27  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        r38825 made JSFunction::m_body private, but some inspector code in
+        WebCore sets the field. Add setters for it.
+
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::setBody):
+
+2008-11-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix FIXME by adding accessor for JSFunction's m_body property.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::cti_op_call_JSFunction):
+        (JSC::Interpreter::cti_vm_dontLazyLinkCall):
+        (JSC::Interpreter::cti_vm_lazyLinkCall):
+        * profiler/Profiler.cpp:
+        (JSC::createCallIdentifierFromFunctionImp):
+        * runtime/Arguments.h:
+        (JSC::Arguments::getArgumentsData):
+        (JSC::Arguments::Arguments):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::body):
+
+2008-11-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Remove unused member variables from ProgramNode.
+
+        * parser/Nodes.h:
+
+2008-11-27  Brent Fulgham  <bfulgham@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Enable mouse panning feaure on Windows Cairo build.
+        See http://bugs.webkit.org/show_bug.cgi?id=22525
+
+        * wtf/Platform.h: Enable mouse panning feaure on Windows Cairo build.
+
+2008-11-27  Alp Toker  <alp@nuanti.com>
+
+        Change recently introduced C++ comments in Platform.h to C comments to
+        fix the minidom build with traditional C.
+
+        Build GtkLauncher and minidom with the '-ansi' compiler flag to detect
+        API header breakage at build time.
+
+        * GNUmakefile.am:
+        * wtf/Platform.h:
+
+2008-11-27  Alp Toker  <alp@nuanti.com>
+
+        Remove C++ comment from JavaScriptCore API headers (introduced r35449).
+        Fixes build for ANSI C applications using the public API.
+
+        * API/WebKitAvailability.h:
+
+2008-11-26  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        Fix the JSC Chromium Mac build by adding JavaScriptCore/icu into the include path
+
+        * JavaScriptCore.scons:
+
+2008-11-25  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove the unused member function JSFunction::getParameterName().
+
+        * runtime/JSFunction.cpp:
+        * runtime/JSFunction.h:
+
+2008-11-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Polymorpic caching for get by id chain.  Similar to the polymorphic caching already implemented
+        for self and proto accesses (implemented by allowing multiple trampolines to be JIT genertaed,
+        and linked together) - the get by id chain caching is implemented as a genericization of the
+        proto list caching, allowing cached access lists to contain a mix of proto and proto chain
+        accesses (since in JS style inheritance hierarchies you may commonly see a mix of properties
+        being overridden on the direct prototype, or higher up its prototype chain).
+
+        In order to allow this patch to compile there is a fix to appease gcc 4.2 compiler issues
+        (removing the jumps between fall-through cases in privateExecute).
+        
+        This patch also removes redundant immediate checking from the reptach code, and fixes a related
+        memory leak (failure to deallocate trampolines). 
+
+        ~2% progression on v8 tests (bulk on the win on deltablue)
+
+        * bytecode/Instruction.h:
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::):
+        (JSC::PolymorphicAccessStructureList::PolymorphicStubInfo::set):
+        (JSC::PolymorphicAccessStructureList::PolymorphicAccessStructureList):
+        (JSC::PolymorphicAccessStructureList::derefStructures):
+        * interpreter/Interpreter.cpp:
+        (JSC::countPrototypeChainEntriesAndCheckForProxies):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::getPolymorphicAccessStructureListSlot):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChainList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdChainList):
+
+2008-11-25  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Move the collect() call in Heap::heapAllocate() that is conditionally
+        compiled under COLLECT_ON_EVERY_ALLOCATION so that it is before we get
+        information about the heap. This was causing assertion failures for me
+        while I was reducing a bug.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::heapAllocate):
+
+2008-11-24  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 13790: Function declarations are not treated as statements (used to affect starcraft2.com)
+        <https://bugs.webkit.org/show_bug.cgi?id=13790>
+
+        Modify the parser to treat function declarations as statements,
+        simplifying the grammar in the process. Technically, according to the
+        grammar in the ECMA spec, function declarations are not statements and
+        can not be used everywhere that statements can, but it is not worth the
+        possibility compatibility issues just to stick to the spec in this case.
+
+        * parser/Grammar.y:
+        * parser/Nodes.cpp:
+        (JSC::FuncDeclNode::emitBytecode): Avoid returning ignoredResult()
+        as a result, because it causes a crash in DoWhileNode::emitBytecode().
+
+2008-11-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Unroll the regexp matching loop by 1. 10% speedup on simple matching
+        stress test. No change on SunSpider.
+        
+        (I decided not to unroll to arbitrary levels because the returns diminsh
+        quickly.)
+
+        * wrec/WREC.cpp:
+        (JSC::WREC::compileRegExp):
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateJumpIfEndOfInput):
+        (JSC::WREC::Generator::generateJumpIfNotEndOfInput):
+        * wrec/WRECGenerator.h:
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::error):
+        (JSC::WREC::Parser::parsePattern):
+
+2008-11-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Removed some unnecessary "Generator::" prefixes.
+
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+        (JSC::WREC::Generator::generateReturnSuccess):
+        (JSC::WREC::Generator::generateSaveIndex):
+        (JSC::WREC::Generator::generateIncrementIndex):
+        (JSC::WREC::Generator::generateLoopIfNotEndOfInput):
+        (JSC::WREC::Generator::generateReturnFailure):
+
+2008-11-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Made a bunch of WREC::Parser functions private, and added an explicit
+        "reset()" function, so a parser can be reused.
+
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::Parser):
+        (JSC::WREC::Parser::generator):
+        (JSC::WREC::Parser::ignoreCase):
+        (JSC::WREC::Parser::multiline):
+        (JSC::WREC::Parser::recordSubpattern):
+        (JSC::WREC::Parser::numSubpatterns):
+        (JSC::WREC::Parser::parsePattern):
+        (JSC::WREC::Parser::parseAlternative):
+        (JSC::WREC::Parser::reset):
+
+2008-11-24  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Implement repatching for get by id chain.
+        Previously the access is performed in a function stub, in the repatch form
+        the trampoline is not called to; instead the hot path is relinked to jump
+        directly to the trampoline, if it fails it will jump to the slow case.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22449
+        3% progression on deltablue.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChain):
+
+2008-11-24  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20746
+
+        Various small compilation fixes to make the Qt port of WebKit
+        compile on Windows CE.
+
+        * config.h: Don't set _CRT_RAND_S for CE, it's not available.
+        * jsc.cpp: Disabled use of debugger includes for CE. It
+          does not have the debugging functions.
+        * runtime/DateMath.cpp: Use localtime() on Windows CE.
+        * wtf/Assertions.cpp: Compile on Windows CE without debugger.
+        * wtf/Assertions.h: Include windows.h before defining ASSERT.
+        * wtf/MathExtras.h: Include stdlib.h instead of xmath.h.
+        * wtf/Platform.h: Disable ERRNO_H and detect endianess based
+          on the Qt endianess. On Qt for Windows CE the endianess is
+          defined by the vendor specific build spec.
+        * wtf/Threading.h: Use the volatile-less atomic functions.
+        * wtf/dtoa.cpp: Compile without errno.
+        * wtf/win/MainThreadWin.cpp: Don't include windows.h on CE after
+        Assertions.h due to the redefinition of ASSERT.
+
+2008-11-22  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Replace accidentally deleted immediate check from get by id chain trampoline.
+        https://bugs.webkit.org/show_bug.cgi?id=22413
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileGetByIdChain):
+
+2008-11-21  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add (really) polymorphic caching for get by id self.
+        Very similar to caching of prototype accesses, described below.
+
+        Oh, also, probably shouldn't have been leaking those structure list objects.
+        
+        4% preogression on deltablue.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::PrototypeStructureList::derefStructures):
+        * bytecode/Instruction.h:
+        * bytecode/Opcode.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileGetByIdSelfList):
+        (JSC::JIT::patchGetByIdSelf):
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdSelfList):
+
+2008-11-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed many crashes seen 'round the world (but only in release builds).
+        
+        Update outputParameter offset to reflect slight re-ordering of push
+        instructions in r38669.
+
+        * wrec/WRECGenerator.cpp:
+
+2008-11-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        A little more RegExp refactoring.
+        
+        Deployed a helper function for reading the next character. Used the "link
+        vector of jumps" helper in a place I missed before.
+
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateLoadCharacter):
+        (JSC::WREC::Generator::generatePatternCharacter):
+        (JSC::WREC::Generator::generateCharacterClass):
+        (JSC::WREC::Generator::generateAssertionEOL):
+        (JSC::WREC::Generator::generateAssertionWordBoundary):
+        * wrec/WRECGenerator.h:
+
+2008-11-21  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22402
+        Replace abort() with CRASH()
+
+        * wtf/Assertions.h: Added a different method to crash, which should work even is 0xbbadbeef
+        is a valid memory address.
+
+        * runtime/Collector.cpp:
+        * wtf/FastMalloc.cpp:
+        * wtf/FastMalloc.h:
+        * wtf/TCSpinLock.h:
+        Replace abort() with CRASH().
+
+2008-11-21  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reverted fix for bug 22042 (Replace abort() with CRASH()), because it was breaking
+        FOR_EACH_OPCODE_ID macro somehow, making Safari crash.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::heapAllocate):
+        (JSC::Heap::collect):
+        * wtf/Assertions.h:
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMalloc):
+        (WTF::fastCalloc):
+        (WTF::fastRealloc):
+        (WTF::InitSizeClasses):
+        (WTF::PageHeapAllocator::New):
+        (WTF::TCMallocStats::do_malloc):
+        * wtf/FastMalloc.h:
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SpinLock::Init):
+        (TCMalloc_SpinLock::Finalize):
+        (TCMalloc_SpinLock::Lock):
+        (TCMalloc_SpinLock::Unlock):
+
+2008-11-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        A little more RegExp refactoring.
+        
+        Moved all assembly from WREC.cpp into WRECGenerator helper functions.
+        This should help with portability and readability.
+        
+        Removed ASSERTs after calls to executableCopy(), and changed
+        executableCopy() to ASSERT instead.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::executableCopy):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * wrec/WREC.cpp:
+        (JSC::WREC::compileRegExp):
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateEnter):
+        (JSC::WREC::Generator::generateReturnSuccess):
+        (JSC::WREC::Generator::generateSaveIndex):
+        (JSC::WREC::Generator::generateIncrementIndex):
+        (JSC::WREC::Generator::generateLoopIfNotEndOfInput):
+        (JSC::WREC::Generator::generateReturnFailure):
+        * wrec/WRECGenerator.h:
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::ignoreCase):
+        (JSC::WREC::Parser::generator):
+
+2008-11-21  Alexey Proskuryakov  <ap@webkit.org>
+
+        Build fix.
+
+        * wtf/Assertions.h: Use ::abort for C++ code.
+
+2008-11-21  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22402
+        Replace abort() with CRASH()
+
+        * wtf/Assertions.h: Added abort() after an attempt to crash for extra safety.
+
+        * runtime/Collector.cpp:
+        * wtf/FastMalloc.cpp:
+        * wtf/FastMalloc.h:
+        * wtf/TCSpinLock.h:
+        Replace abort() with CRASH().
+
+2008-11-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Renamed wrec => generator.
+
+        * wrec/WRECFunctors.cpp:
+        (JSC::WREC::GeneratePatternCharacterFunctor::generateAtom):
+        (JSC::WREC::GeneratePatternCharacterFunctor::backtrack):
+        (JSC::WREC::GenerateCharacterClassFunctor::generateAtom):
+        (JSC::WREC::GenerateCharacterClassFunctor::backtrack):
+        (JSC::WREC::GenerateBackreferenceFunctor::generateAtom):
+        (JSC::WREC::GenerateBackreferenceFunctor::backtrack):
+        (JSC::WREC::GenerateParenthesesNonGreedyFunctor::generateAtom):
+
+2008-11-19  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add support for (really) polymorphic caching of prototype accesses.
+        
+        If a cached prototype access misses, cti_op_get_by_id_proto_list is called.
+        When this occurs the Structure pointers from the instruction stream are copied
+        off into a new ProtoStubInfo object.  A second prototype access trampoline is
+        generated, and chained onto the first.  Subsequent missed call to
+        cti_op_get_by_id_proto_list_append, which append futher new trampolines, up to
+        PROTOTYPE_LIST_CACHE_SIZE (currently 4).  If any of the misses result in an
+        access other than to a direct prototype property, list formation is halted (or
+        for the initial miss, does not take place at all).
+
+        Separate fail case functions are provided for each access since this contributes
+        to the performance progression (enables better processor branch prediction).
+
+        Overall this is a near 5% progression on v8, with around 10% wins on richards
+        and deltablue.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructures):
+        * bytecode/Instruction.h:
+        (JSC::ProtoStructureList::ProtoStubInfo::set):
+        (JSC::ProtoStructureList::ProtoStructureList):
+        (JSC::Instruction::Instruction):
+        (JSC::Instruction::):
+        * bytecode/Opcode.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::Interpreter::cti_op_put_by_id_fail):
+        (JSC::Interpreter::cti_op_get_by_id_self_fail):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list_append):
+        (JSC::Interpreter::cti_op_get_by_id_proto_list_full):
+        (JSC::Interpreter::cti_op_get_by_id_proto_fail):
+        (JSC::Interpreter::cti_op_get_by_id_chain_fail):
+        (JSC::Interpreter::cti_op_get_by_id_array_fail):
+        (JSC::Interpreter::cti_op_get_by_id_string_fail):
+        * interpreter/Interpreter.h:
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdProtoList):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * jit/JIT.h:
+        (JSC::JIT::compileGetByIdProtoList):
+
+2008-11-20  Sam Weinig  <sam@webkit.org>
+
+        Try and fix the tiger build.
+
+        * parser/Grammar.y:
+
+2008-11-20  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Make JavaScriptCore Chromium build under Windows (cmd only, cygwin almost works)
+        https://bugs.webkit.org/show_bug.cgi?id=22347
+
+        * JavaScriptCore.scons:
+        * parser/Parser.cpp: Add using std::auto_ptr since we use auto_ptr
+
+2008-11-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix build.
+        
+        Reviewed by Sam Weinig.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::reparse):
+
+2008-11-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        A little more RegExp refactoring.
+        
+        Created a helper function in the assembler for linking a vector of
+        JmpSrc to a location, and deployed it in a bunch of places.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::link):
+        * wrec/WREC.cpp:
+        (JSC::WREC::compileRegExp):
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateNonGreedyQuantifier):
+        (JSC::WREC::Generator::generateGreedyQuantifier):
+        (JSC::WREC::Generator::generateCharacterClassInverted):
+        (JSC::WREC::Generator::generateParentheses):
+        (JSC::WREC::Generator::generateParenthesesResetTrampoline):
+        (JSC::WREC::Generator::generateAssertionBOL):
+        (JSC::WREC::Generator::generateAssertionEOL):
+        (JSC::WREC::Generator::generateAssertionWordBoundary):
+        (JSC::WREC::Generator::terminateAlternative):
+        (JSC::WREC::Generator::terminateDisjunction):
+        * wrec/WRECParser.cpp:
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::consumeHex):
+
+2008-11-20  Sam Weinig  <sam@webkit.org>
+
+        Fix non-mac builds.
+
+        * parser/Lexer.cpp:
+        * parser/Parser.cpp:
+
+2008-11-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=22385
+        <rdar://problem/6390179>
+        Lazily reparse FunctionBodyNodes on first execution.
+
+        - Saves 57MB on Membuster head.
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate): Remove vector shrinking since this is now
+        handled by destroying the ScopeNodeData after generation.
+
+        * parser/Grammar.y: Add alternate NoNode version of the grammar
+        that does not create nodes.  This is used to lazily create FunctionBodyNodes
+        on first execution.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode): Fix bug where on reparse, the Lexer was confused about
+        what position and length meant. Position is the current position in the original
+        data buffer (important for getting correct line/column information) and length
+        the end offset in the original buffer.
+        * parser/Lexer.h:
+        (JSC::Lexer::sourceCode): Positions are relative to the beginning of the buffer.
+
+        * parser/Nodes.cpp:
+        (JSC::ScopeNodeData::ScopeNodeData): Move initialization of ScopeNode data here.
+        (JSC::ScopeNode::ScopeNode): Add constructor that only sets the JSGlobalData
+        for FunctionBodyNode stubs.
+        (JSC::ScopeNode::~ScopeNode): Release m_children now that we don't inherit from
+        BlockNode.
+        (JSC::ScopeNode::releaseNodes): Ditto.
+        (JSC::EvalNode::generateBytecode): Only shrink m_children, as we need to keep around
+        the rest of the data.
+        (JSC::FunctionBodyNode::FunctionBodyNode): Add constructor that only sets the
+        JSGlobalData. 
+        (JSC::FunctionBodyNode::create): Ditto.
+        (JSC::FunctionBodyNode::generateBytecode): If we don't have the data, do a reparse
+        to construct it. Then after generation, destroy the data.
+        (JSC::ProgramNode::generateBytecode): After generation, destroy the AST data.
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::): Add isFuncExprNode for FunctionConstructor.
+        (JSC::StatementNode::): Add isExprStatementNode for FunctionConstructor.
+        (JSC::ExprStatementNode::): Ditto.
+        (JSC::ExprStatementNode::expr): Add accessor for FunctionConstructor.
+        (JSC::FuncExprNode::): Add isFuncExprNode for FunctionConstructor
+
+        (JSC::ScopeNode::adoptData): Adopts a ScopeNodeData.
+        (JSC::ScopeNode::data): Accessor for ScopeNodeData.
+        (JSC::ScopeNode::destroyData): Deletes the ScopeNodeData.
+        (JSC::ScopeNode::setFeatures): Added.
+        (JSC::ScopeNode::varStack): Added assert.
+        (JSC::ScopeNode::functionStack): Ditto.
+        (JSC::ScopeNode::children): Ditto.
+        (JSC::ScopeNode::neededConstants): Ditto.
+        Factor m_varStack, m_functionStack, m_children and m_numConstants into ScopeNodeData.
+
+        * parser/Parser.cpp:
+        (JSC::Parser::reparse): Reparse the SourceCode in the FunctionBodyNode and set
+        set up the ScopeNodeData for it. 
+        * parser/Parser.h:
+
+        * parser/SourceCode.h:
+        (JSC::SourceCode::endOffset): Added for use in the lexer.
+
+        * runtime/FunctionConstructor.cpp:
+        (JSC::getFunctionBody): Assuming a ProgramNode with one FunctionExpression in it,
+        get the FunctionBodyNode.  Any issues signifies a parse failure in constructFunction. 
+        (JSC::constructFunction): Make parsing functions in the form new Function(""), easier
+        by concatenating the strings together (with some glue) and parsing the function expression
+        as a ProgramNode from which we can receive the FunctionBodyNode. This has the added benefit
+        of not having special parsing code for the arguments and lazily constructing the 
+        FunctionBodyNode's AST on first execution.
+
+        * runtime/Identifier.h:
+        (JSC::operator!=): Added.
+
+2008-11-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Speedup the lexer to offset coming re-parsing patch.
+
+        - .6% progression on Sunspider.
+
+        * bytecompiler/SegmentedVector.h:
+        (JSC::SegmentedVector::shrink): Fixed bug where m_size would not be
+        set when shrinking to 0.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::Lexer):
+        (JSC::Lexer::isIdentStart): Use isASCIIAlpha and isASCII to avoid going into ICU in the common cases.
+        (JSC::Lexer::isIdentPart): Use isASCIIAlphanumeric and isASCII to avoid going into ICU in the common cases
+        (JSC::isDecimalDigit): Use version in ASCIICType.h. Inlining it was a regression.
+        (JSC::Lexer::isHexDigit): Ditto.
+        (JSC::Lexer::isOctalDigit): Ditto.
+        (JSC::Lexer::clear): Resize the m_identifiers SegmentedVector to initial
+        capacity
+        * parser/Lexer.h: Remove unused m_strings vector. Make m_identifiers
+        a SegmentedVector<Identifier> to avoid allocating a new Identifier* for
+        each identifier found.  The SegmentedVector is need so we can passes 
+        references to the Identifier to the parser, which remain valid even when
+        the vector is resized.
+        (JSC::Lexer::makeIdentifier): Inline and return a reference to the added
+        Identifier.
+
+2008-11-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add isASCII to ASCIICType.  Use coming soon!
+
+        * wtf/ASCIICType.h:
+        (WTF::isASCII):
+
+2008-11-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add OwnPtr constructor and OwnPtr::adopt that take an auto_ptr.
+
+        * wtf/OwnPtr.h:
+        (WTF::OwnPtr::OwnPtr):
+        (WTF::OwnPtr::adopt):
+
+2008-11-20  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22364
+        Crashes seen on Tiger buildbots due to worker threads exhausting pthread keys
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::Heap):
+        (JSC::Heap::destroy):
+        (JSC::Heap::makeUsableFromMultipleThreads):
+        (JSC::Heap::registerThread):
+        * runtime/Collector.h:
+        Pthread key for tracking threads is only created on request now, because this is a limited
+        resource, and thread tracking is not needed for worker heaps, or for WebCore heap.
+
+        * API/JSContextRef.cpp: (JSGlobalContextCreateInGroup): Call makeUsableFromMultipleThreads().
+
+        * runtime/JSGlobalData.cpp: (JSC::JSGlobalData::sharedInstance): Ditto.
+
+        * runtime/JSGlobalData.h: (JSC::JSGlobalData::makeUsableFromMultipleThreads): Just forward
+        the call to Heap, which clients need not know about, ideally.
+
+2008-11-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        A little more WREC refactoring.
+        
+        Removed the "Register" suffix from register names in WREC, and renamed:
+            currentPosition => index
+            currentValue => character
+            quantifierCount => repeatCount
+            
+        Added a top-level parsePattern function to the WREC parser, which
+        allowed me to remove the error() and atEndOfPattern() accessors.
+        
+        Factored out an MSVC customization into a constant.
+        
+        Renamed nextLabel => beginPattern.
+
+        * wrec/WREC.cpp:
+        (JSC::WREC::compileRegExp):
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateBacktrack1):
+        (JSC::WREC::Generator::generateBacktrackBackreference):
+        (JSC::WREC::Generator::generateBackreferenceQuantifier):
+        (JSC::WREC::Generator::generateNonGreedyQuantifier):
+        (JSC::WREC::Generator::generateGreedyQuantifier):
+        (JSC::WREC::Generator::generatePatternCharacter):
+        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
+        (JSC::WREC::Generator::generateCharacterClassInverted):
+        (JSC::WREC::Generator::generateCharacterClass):
+        (JSC::WREC::Generator::generateParentheses):
+        (JSC::WREC::Generator::generateParenthesesResetTrampoline):
+        (JSC::WREC::Generator::generateAssertionBOL):
+        (JSC::WREC::Generator::generateAssertionEOL):
+        (JSC::WREC::Generator::generateAssertionWordBoundary):
+        (JSC::WREC::Generator::generateBackreference):
+        (JSC::WREC::Generator::generateDisjunction):
+        (JSC::WREC::Generator::terminateDisjunction):
+        * wrec/WRECGenerator.h:
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::parsePattern):
+
+2008-11-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=22361
+        A little more RegExp refactoring.
+        
+        Consistently named variables holding the starting position at which
+        regexp matching should begin to "startOffset".
+        
+        A few more "regExpObject" => "regExpConstructor" changes.
+        
+        Refactored RegExpObject::match for clarity, and replaced a slow "get"
+        of the "global" property with a fast access to the global bit.
+        
+        Made the error message you see when RegExpObject::match has no input a
+        little more informative, as in Firefox.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+        * runtime/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+
+2008-11-19  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        A little more refactoring.
+        
+        Removed the "emit" and "emitUnlinked" prefixes from the assembler.
+        
+        Moved the JmpSrc and JmpDst class definitions to the top of the X86
+        assembler class, in accordance with WebKit style guidelines.
+
+        * assembler/X86Assembler.h:
+        (JSC::X86Assembler::JmpSrc::JmpSrc):
+        (JSC::X86Assembler::JmpDst::JmpDst):
+        (JSC::X86Assembler::int3):
+        (JSC::X86Assembler::pushl_m):
+        (JSC::X86Assembler::popl_m):
+        (JSC::X86Assembler::movl_rr):
+        (JSC::X86Assembler::addl_rr):
+        (JSC::X86Assembler::addl_i8r):
+        (JSC::X86Assembler::addl_i8m):
+        (JSC::X86Assembler::addl_i32r):
+        (JSC::X86Assembler::addl_mr):
+        (JSC::X86Assembler::andl_rr):
+        (JSC::X86Assembler::andl_i32r):
+        (JSC::X86Assembler::cmpl_i8r):
+        (JSC::X86Assembler::cmpl_rr):
+        (JSC::X86Assembler::cmpl_rm):
+        (JSC::X86Assembler::cmpl_mr):
+        (JSC::X86Assembler::cmpl_i32r):
+        (JSC::X86Assembler::cmpl_i32m):
+        (JSC::X86Assembler::cmpl_i8m):
+        (JSC::X86Assembler::cmpw_rm):
+        (JSC::X86Assembler::orl_rr):
+        (JSC::X86Assembler::orl_mr):
+        (JSC::X86Assembler::orl_i32r):
+        (JSC::X86Assembler::subl_rr):
+        (JSC::X86Assembler::subl_i8r):
+        (JSC::X86Assembler::subl_i8m):
+        (JSC::X86Assembler::subl_i32r):
+        (JSC::X86Assembler::subl_mr):
+        (JSC::X86Assembler::testl_i32r):
+        (JSC::X86Assembler::testl_i32m):
+        (JSC::X86Assembler::testl_rr):
+        (JSC::X86Assembler::xorl_i8r):
+        (JSC::X86Assembler::xorl_rr):
+        (JSC::X86Assembler::sarl_i8r):
+        (JSC::X86Assembler::sarl_CLr):
+        (JSC::X86Assembler::shl_i8r):
+        (JSC::X86Assembler::shll_CLr):
+        (JSC::X86Assembler::imull_rr):
+        (JSC::X86Assembler::imull_i32r):
+        (JSC::X86Assembler::idivl_r):
+        (JSC::X86Assembler::negl_r):
+        (JSC::X86Assembler::movl_mr):
+        (JSC::X86Assembler::movzbl_rr):
+        (JSC::X86Assembler::movzwl_mr):
+        (JSC::X86Assembler::movl_rm):
+        (JSC::X86Assembler::movl_i32r):
+        (JSC::X86Assembler::movl_i32m):
+        (JSC::X86Assembler::leal_mr):
+        (JSC::X86Assembler::jmp_r):
+        (JSC::X86Assembler::jmp_m):
+        (JSC::X86Assembler::movsd_mr):
+        (JSC::X86Assembler::xorpd_mr):
+        (JSC::X86Assembler::movsd_rm):
+        (JSC::X86Assembler::movd_rr):
+        (JSC::X86Assembler::cvtsi2sd_rr):
+        (JSC::X86Assembler::cvttsd2si_rr):
+        (JSC::X86Assembler::addsd_mr):
+        (JSC::X86Assembler::subsd_mr):
+        (JSC::X86Assembler::mulsd_mr):
+        (JSC::X86Assembler::addsd_rr):
+        (JSC::X86Assembler::subsd_rr):
+        (JSC::X86Assembler::mulsd_rr):
+        (JSC::X86Assembler::ucomis_rr):
+        (JSC::X86Assembler::pextrw_irr):
+        (JSC::X86Assembler::call):
+        (JSC::X86Assembler::jmp):
+        (JSC::X86Assembler::jne):
+        (JSC::X86Assembler::jnz):
+        (JSC::X86Assembler::je):
+        (JSC::X86Assembler::jl):
+        (JSC::X86Assembler::jb):
+        (JSC::X86Assembler::jle):
+        (JSC::X86Assembler::jbe):
+        (JSC::X86Assembler::jge):
+        (JSC::X86Assembler::jg):
+        (JSC::X86Assembler::ja):
+        (JSC::X86Assembler::jae):
+        (JSC::X86Assembler::jo):
+        (JSC::X86Assembler::jp):
+        (JSC::X86Assembler::js):
+        (JSC::X86Assembler::predictNotTaken):
+        (JSC::X86Assembler::convertToFastCall):
+        (JSC::X86Assembler::restoreArgumentReference):
+        (JSC::X86Assembler::restoreArgumentReferenceForTrampoline):
+        (JSC::X86Assembler::modRm_rr):
+        (JSC::X86Assembler::modRm_rr_Unchecked):
+        (JSC::X86Assembler::modRm_rm):
+        (JSC::X86Assembler::modRm_rm_Unchecked):
+        (JSC::X86Assembler::modRm_rmsib):
+        (JSC::X86Assembler::modRm_opr):
+        (JSC::X86Assembler::modRm_opr_Unchecked):
+        (JSC::X86Assembler::modRm_opm):
+        (JSC::X86Assembler::modRm_opm_Unchecked):
+        (JSC::X86Assembler::modRm_opmsib):
+        * jit/JIT.cpp:
+        (JSC::JIT::emitNakedCall):
+        (JSC::JIT::emitNakedFastCall):
+        (JSC::JIT::emitCTICall):
+        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmNum):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::JIT::emitFastArithIntToImmOrSlowCase):
+        (JSC::JIT::emitArithIntToImmWithJump):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emitSlowScriptCheck):
+        (JSC::JIT::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        * wrec/WREC.cpp:
+        (JSC::WREC::compileRegExp):
+        * wrec/WRECGenerator.cpp:
+        (JSC::WREC::Generator::generateBackreferenceQuantifier):
+        (JSC::WREC::Generator::generateNonGreedyQuantifier):
+        (JSC::WREC::Generator::generateGreedyQuantifier):
+        (JSC::WREC::Generator::generatePatternCharacter):
+        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
+        (JSC::WREC::Generator::generateCharacterClassInverted):
+        (JSC::WREC::Generator::generateCharacterClass):
+        (JSC::WREC::Generator::generateParentheses):
+        (JSC::WREC::Generator::generateParenthesesNonGreedy):
+        (JSC::WREC::Generator::generateParenthesesResetTrampoline):
+        (JSC::WREC::Generator::generateAssertionBOL):
+        (JSC::WREC::Generator::generateAssertionEOL):
+        (JSC::WREC::Generator::generateAssertionWordBoundary):
+        (JSC::WREC::Generator::generateBackreference):
+        (JSC::WREC::Generator::generateDisjunction):
+
+2008-11-19  Simon Hausmann  <hausmann@webkit.org>
+
+        Sun CC build fix, removed trailing comman for last enum value.
+
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        (WTF::Unicode::):
+
+2008-11-19  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Expand the workaround for Apple GCC compiler bug <rdar://problem/6354696> to all versions of GCC 4.0.1.
+        It has been observed with builds 5465 (Xcode 3.0) and 5484 (Xcode 3.1), and there is no evidence
+        that it has been fixed in newer builds of GCC 4.0.1.
+
+        This addresses <https://bugs.webkit.org/show_bug.cgi?id=22351> (WebKit nightly crashes on launch on 10.4.11).
+
+        * wtf/StdLibExtras.h:
+
+2008-11-18  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak and Geoff Garen.
+
+        Bug 22287: ASSERTION FAILED: Not enough jumps linked in slow case codegen in CTI::privateCompileSlowCases())
+        <https://bugs.webkit.org/show_bug.cgi?id=22287>
+
+        Fix a typo in the number cell reuse code where the first and second
+        operands are sometimes confused.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+
+2008-11-18  Dan Bernstein  <mitz@apple.com>
+
+        - try to fix the Windows build
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2008-11-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Minor RegExp cleanup.
+        
+        SunSpider says no change.
+
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::match): Renamed "regExpObj" to "regExpConstructor".
+
+        * wrec/WREC.cpp:
+        (JSC::WREC::compileRegExp): Instead of checking for a NULL output vector,
+        ASSERT that the output vector is not NULL. (The rest of WREC is not
+        safe to use with a NULL output vector, and we probably don't want to
+        spend the time and/or performance to make it safe.)
+
+2008-11-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        A little more renaming and refactoring.
+        
+        VM_CHECK_EXCEPTION() => CHECK_FOR_EXCEPTION().
+        NEXT_INSTRUCTION => NEXT_INSTRUCTION().
+
+        Removed the "Error_" and "TempError_" prefixes from WREC error types.
+
+        Refactored the WREC parser so it doesn't need a "setError" function,
+        and changed "isEndOfPattern" and its use -- they read kind of backwards
+        before.
+        
+        Changed our "TODO:" error messages at least to say something, since you
+        can't say "TODO:" in shipping software.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::cti_op_convert_this):
+        (JSC::Interpreter::cti_op_add):
+        (JSC::Interpreter::cti_op_pre_inc):
+        (JSC::Interpreter::cti_op_loop_if_less):
+        (JSC::Interpreter::cti_op_loop_if_lesseq):
+        (JSC::Interpreter::cti_op_put_by_id):
+        (JSC::Interpreter::cti_op_put_by_id_second):
+        (JSC::Interpreter::cti_op_put_by_id_generic):
+        (JSC::Interpreter::cti_op_put_by_id_fail):
+        (JSC::Interpreter::cti_op_get_by_id):
+        (JSC::Interpreter::cti_op_get_by_id_second):
+        (JSC::Interpreter::cti_op_get_by_id_generic):
+        (JSC::Interpreter::cti_op_get_by_id_fail):
+        (JSC::Interpreter::cti_op_instanceof):
+        (JSC::Interpreter::cti_op_del_by_id):
+        (JSC::Interpreter::cti_op_mul):
+        (JSC::Interpreter::cti_op_call_NotJSFunction):
+        (JSC::Interpreter::cti_op_resolve):
+        (JSC::Interpreter::cti_op_construct_NotJSConstruct):
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_resolve_func):
+        (JSC::Interpreter::cti_op_sub):
+        (JSC::Interpreter::cti_op_put_by_val):
+        (JSC::Interpreter::cti_op_put_by_val_array):
+        (JSC::Interpreter::cti_op_lesseq):
+        (JSC::Interpreter::cti_op_loop_if_true):
+        (JSC::Interpreter::cti_op_negate):
+        (JSC::Interpreter::cti_op_resolve_skip):
+        (JSC::Interpreter::cti_op_resolve_global):
+        (JSC::Interpreter::cti_op_div):
+        (JSC::Interpreter::cti_op_pre_dec):
+        (JSC::Interpreter::cti_op_jless):
+        (JSC::Interpreter::cti_op_not):
+        (JSC::Interpreter::cti_op_jtrue):
+        (JSC::Interpreter::cti_op_post_inc):
+        (JSC::Interpreter::cti_op_eq):
+        (JSC::Interpreter::cti_op_lshift):
+        (JSC::Interpreter::cti_op_bitand):
+        (JSC::Interpreter::cti_op_rshift):
+        (JSC::Interpreter::cti_op_bitnot):
+        (JSC::Interpreter::cti_op_resolve_with_base):
+        (JSC::Interpreter::cti_op_mod):
+        (JSC::Interpreter::cti_op_less):
+        (JSC::Interpreter::cti_op_neq):
+        (JSC::Interpreter::cti_op_post_dec):
+        (JSC::Interpreter::cti_op_urshift):
+        (JSC::Interpreter::cti_op_bitxor):
+        (JSC::Interpreter::cti_op_bitor):
+        (JSC::Interpreter::cti_op_push_scope):
+        (JSC::Interpreter::cti_op_to_jsnumber):
+        (JSC::Interpreter::cti_op_in):
+        (JSC::Interpreter::cti_op_del_by_val):
+        * wrec/WREC.cpp:
+        (JSC::WREC::compileRegExp):
+        * wrec/WRECParser.cpp:
+        (JSC::WREC::Parser::parseGreedyQuantifier):
+        (JSC::WREC::Parser::parseParentheses):
+        (JSC::WREC::Parser::parseCharacterClass):
+        (JSC::WREC::Parser::parseEscape):
+        * wrec/WRECParser.h:
+        (JSC::WREC::Parser::):
+        (JSC::WREC::Parser::atEndOfPattern):
+
+2008-11-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22337
+        Enable workers by default
+
+        * Configurations/JavaScriptCore.xcconfig: Define ENABLE_WORKERS.
+
+2008-11-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        - Windows build fix
+
+        * wrec/WRECFunctors.h:
+        * wrec/WRECGenerator.h:
+        * wrec/WRECParser.h:
+        CharacterClass is a struct, not a class, fix forward declarations.
+
+2008-11-18  Dan Bernstein  <mitz@apple.com>
+
+        - Windows build fix
+
+        * assembler/X86Assembler.h:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix gtk build.
+
+        * wrec/Quantifier.h:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix gtk build.
+
+        * assembler/AssemblerBuffer.h:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Split WREC classes out into individual files, with a few modifications
+        to more closely match the WebKit coding style.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler/X86Assembler.h:
+        * runtime/RegExp.cpp:
+        * wrec/CharacterClass.cpp: Copied from wrec/CharacterClassConstructor.cpp.
+        (JSC::WREC::CharacterClass::newline):
+        (JSC::WREC::CharacterClass::digits):
+        (JSC::WREC::CharacterClass::spaces):
+        (JSC::WREC::CharacterClass::wordchar):
+        (JSC::WREC::CharacterClass::nondigits):
+        (JSC::WREC::CharacterClass::nonspaces):
+        (JSC::WREC::CharacterClass::nonwordchar):
+        * wrec/CharacterClass.h: Copied from wrec/CharacterClassConstructor.h.
+        * wrec/CharacterClassConstructor.cpp:
+        (JSC::WREC::CharacterClassConstructor::addSortedRange):
+        (JSC::WREC::CharacterClassConstructor::append):
+        * wrec/CharacterClassConstructor.h:
+        * wrec/Quantifier.h: Copied from wrec/WREC.h.
+        * wrec/WREC.cpp:
+        (JSC::WREC::compileRegExp):
+        * wrec/WREC.h:
+        * wrec/WRECFunctors.cpp: Copied from wrec/WREC.cpp.
+        * wrec/WRECFunctors.h: Copied from wrec/WREC.cpp.
+        (JSC::WREC::GenerateAtomFunctor::~GenerateAtomFunctor):
+        (JSC::WREC::GeneratePatternCharacterFunctor::GeneratePatternCharacterFunctor):
+        (JSC::WREC::GenerateCharacterClassFunctor::GenerateCharacterClassFunctor):
+        (JSC::WREC::GenerateBackreferenceFunctor::GenerateBackreferenceFunctor):
+        (JSC::WREC::GenerateParenthesesNonGreedyFunctor::GenerateParenthesesNonGreedyFunctor):
+        * wrec/WRECGenerator.cpp: Copied from wrec/WREC.cpp.
+        (JSC::WREC::Generator::generatePatternCharacter):
+        (JSC::WREC::Generator::generateCharacterClassInvertedRange):
+        (JSC::WREC::Generator::generateCharacterClassInverted):
+        (JSC::WREC::Generator::generateCharacterClass):
+        (JSC::WREC::Generator::generateParentheses):
+        (JSC::WREC::Generator::generateAssertionBOL):
+        (JSC::WREC::Generator::generateAssertionEOL):
+        (JSC::WREC::Generator::generateAssertionWordBoundary):
+        * wrec/WRECGenerator.h: Copied from wrec/WREC.h.
+        * wrec/WRECParser.cpp: Copied from wrec/WREC.cpp.
+        (JSC::WREC::Parser::parseGreedyQuantifier):
+        (JSC::WREC::Parser::parseCharacterClassQuantifier):
+        (JSC::WREC::Parser::parseParentheses):
+        (JSC::WREC::Parser::parseCharacterClass):
+        (JSC::WREC::Parser::parseEscape):
+        (JSC::WREC::Parser::parseTerm):
+        * wrec/WRECParser.h: Copied from wrec/WREC.h.
+        (JSC::WREC::Parser::):
+        (JSC::WREC::Parser::Parser):
+        (JSC::WREC::Parser::setError):
+        (JSC::WREC::Parser::error):
+        (JSC::WREC::Parser::recordSubpattern):
+        (JSC::WREC::Parser::numSubpatterns):
+        (JSC::WREC::Parser::ignoreCase):
+        (JSC::WREC::Parser::multiline):
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix a few builds.
+
+        * JavaScriptCoreSources.bkl:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix a few builds.
+
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved VM/CTI.* => jit/JIT.*.
+        
+        Removed VM.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CTI.cpp: Removed.
+        * VM/CTI.h: Removed.
+        * bytecode/CodeBlock.cpp:
+        * interpreter/Interpreter.cpp:
+        * jit: Added.
+        * jit/JIT.cpp: Copied from VM/CTI.cpp.
+        * jit/JIT.h: Copied from VM/CTI.h.
+        * runtime/RegExp.cpp:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved runtime/ExecState.* => interpreter/CallFrame.*.
+
+        * API/JSBase.cpp:
+        * API/OpaqueJSString.cpp:
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * debugger/DebuggerCallFrame.h:
+        * interpreter/CallFrame.cpp: Copied from runtime/ExecState.cpp.
+        * interpreter/CallFrame.h: Copied from runtime/ExecState.h.
+        * interpreter/Interpreter.cpp:
+        * parser/Nodes.cpp:
+        * profiler/ProfileGenerator.cpp:
+        * profiler/Profiler.cpp:
+        * runtime/ClassInfo.h:
+        * runtime/Collector.cpp:
+        * runtime/Completion.cpp:
+        * runtime/ExceptionHelpers.cpp:
+        * runtime/ExecState.cpp: Removed.
+        * runtime/ExecState.h: Removed.
+        * runtime/Identifier.cpp:
+        * runtime/JSFunction.cpp:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        * runtime/JSLock.cpp:
+        * runtime/JSNumberCell.h:
+        * runtime/JSObject.h:
+        * runtime/JSString.h:
+        * runtime/Lookup.h:
+        * runtime/PropertyNameArray.h:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * API/APICast.h:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * API/APICast.h:
+        * runtime/ExecState.h:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved VM/SamplingTool.* => bytecode/SamplingTool.*.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/SamplingTool.cpp: Removed.
+        * VM/SamplingTool.h: Removed.
+        * bytecode/SamplingTool.cpp: Copied from VM/SamplingTool.cpp.
+        * bytecode/SamplingTool.h: Copied from VM/SamplingTool.h.
+        * jsc.cpp:
+        (runWithScripts):
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * runtime/ExecState.h:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved VM/ExceptionHelpers.cpp => runtime/ExceptionHelpers.cpp.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/ExceptionHelpers.cpp: Removed.
+        * runtime/ExceptionHelpers.cpp: Copied from VM/ExceptionHelpers.cpp.
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved VM/RegisterFile.cpp => interpreter/RegisterFile.cpp.
+
+        * AllInOneFile.cpp:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/RegisterFile.cpp: Removed.
+        * interpreter/RegisterFile.cpp: Copied from VM/RegisterFile.cpp.
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved:
+            VM/ExceptionHelpers.h => runtime/ExceptionHelpers.h
+            VM/Register.h => interpreter/Register.h
+            VM/RegisterFile.h => interpreter/RegisterFile.h
+        
+        
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/ExceptionHelpers.h: Removed.
+        * VM/Register.h: Removed.
+        * VM/RegisterFile.h: Removed.
+        * interpreter/Register.h: Copied from VM/Register.h.
+        * interpreter/RegisterFile.h: Copied from VM/RegisterFile.h.
+        * runtime/ExceptionHelpers.h: Copied from VM/ExceptionHelpers.h.
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Qt build.
+
+        * JavaScriptCore.pri:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved VM/Machine.cpp => interpreter/Interpreter.cpp.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/Machine.cpp: Removed.
+        * interpreter/Interpreter.cpp: Copied from VM/Machine.cpp.
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved VM/Machine.h => interpreter/Interpreter.h
+
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * VM/ExceptionHelpers.cpp:
+        * VM/Machine.cpp:
+        * VM/Machine.h: Removed.
+        * VM/SamplingTool.cpp:
+        * bytecode/CodeBlock.cpp:
+        * bytecompiler/BytecodeGenerator.cpp:
+        * bytecompiler/BytecodeGenerator.h:
+        * debugger/DebuggerCallFrame.cpp:
+        * interpreter: Added.
+        * interpreter/Interpreter.h: Copied from VM/Machine.h.
+        * profiler/ProfileGenerator.cpp:
+        * runtime/Arguments.h:
+        * runtime/ArrayPrototype.cpp:
+        * runtime/Collector.cpp:
+        * runtime/Completion.cpp:
+        * runtime/ExecState.h:
+        * runtime/FunctionPrototype.cpp:
+        * runtime/JSActivation.cpp:
+        * runtime/JSFunction.cpp:
+        * runtime/JSGlobalData.cpp:
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        * wrec/WREC.cpp:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved runtime/Interpreter.cpp => runtime/Completion.cpp.
+
+        Moved functions from Interpreter.h to Completion.h, and removed
+        Interpreter.h from the project.
+
+        * API/JSBase.cpp:
+        * AllInOneFile.cpp:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * jsc.cpp:
+        * runtime/Completion.cpp: Copied from runtime/Interpreter.cpp.
+        * runtime/Completion.h:
+        * runtime/Interpreter.cpp: Removed.
+        * runtime/Interpreter.h: Removed.
+
+2008-11-17  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=22312>
+        Fix PCRE include path problem on Qt-port
+
+        * JavaScriptCore.pri:
+        * pcre/pcre.pri:
+
+2008-11-17  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=22313>
+        Add missing CTI source to the build system on Qt-port
+
+        * JavaScriptCore.pri:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix JSGlue build.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Qt build.
+
+        * jsc.pro:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Qt build.
+
+        * JavaScriptCore.pri:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Qt build.
+
+        * JavaScriptCore.pri:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        More file moves:
+        
+        VM/CodeBlock.* => bytecode/CodeBlock.*
+        VM/EvalCodeCache.h => bytecode/EvalCodeCache.h
+        VM/Instruction.h => bytecode/Instruction.h
+        VM/Opcode.* => bytecode/Opcode.*
+
+        * GNUmakefile.am:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/CodeBlock.cpp: Removed.
+        * VM/CodeBlock.h: Removed.
+        * VM/EvalCodeCache.h: Removed.
+        * VM/Instruction.h: Removed.
+        * VM/Opcode.cpp: Removed.
+        * VM/Opcode.h: Removed.
+        * bytecode: Added.
+        * bytecode/CodeBlock.cpp: Copied from VM/CodeBlock.cpp.
+        * bytecode/CodeBlock.h: Copied from VM/CodeBlock.h.
+        * bytecode/EvalCodeCache.h: Copied from VM/EvalCodeCache.h.
+        * bytecode/Instruction.h: Copied from VM/Instruction.h.
+        * bytecode/Opcode.cpp: Copied from VM/Opcode.cpp.
+        * bytecode/Opcode.h: Copied from VM/Opcode.h.
+        * jsc.pro:
+        * jscore.bkl:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix a few more builds.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCoreSources.bkl:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix gtk build.
+
+        * GNUmakefile.am:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Some file moves:
+        
+        VM/LabelID.h => bytecompiler/Label.h
+        VM/RegisterID.h => bytecompiler/RegisterID.h
+        VM/SegmentedVector.h => bytecompiler/SegmentedVector.h
+        bytecompiler/CodeGenerator.* => bytecompiler/BytecodeGenerator.*
+
+        * AllInOneFile.cpp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/LabelID.h: Removed.
+        * VM/RegisterID.h: Removed.
+        * VM/SegmentedVector.h: Removed.
+        * bytecompiler/BytecodeGenerator.cpp: Copied from bytecompiler/CodeGenerator.cpp.
+        * bytecompiler/BytecodeGenerator.h: Copied from bytecompiler/CodeGenerator.h.
+        * bytecompiler/CodeGenerator.cpp: Removed.
+        * bytecompiler/CodeGenerator.h: Removed.
+        * bytecompiler/Label.h: Copied from VM/LabelID.h.
+        * bytecompiler/LabelScope.h:
+        * bytecompiler/RegisterID.h: Copied from VM/RegisterID.h.
+        * bytecompiler/SegmentedVector.h: Copied from VM/SegmentedVector.h.
+        * jsc.cpp:
+        * parser/Nodes.cpp:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved masm => assembler and split "AssemblerBuffer.h" out of "X86Assembler.h".
+        
+        Also renamed ENABLE_MASM to ENABLE_ASSEMBLER.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * assembler: Added.
+        * assembler/AssemblerBuffer.h: Copied from masm/X86Assembler.h.
+        (JSC::AssemblerBuffer::AssemblerBuffer):
+        (JSC::AssemblerBuffer::~AssemblerBuffer):
+        (JSC::AssemblerBuffer::ensureSpace):
+        (JSC::AssemblerBuffer::isAligned):
+        (JSC::AssemblerBuffer::putByteUnchecked):
+        (JSC::AssemblerBuffer::putByte):
+        (JSC::AssemblerBuffer::putShortUnchecked):
+        (JSC::AssemblerBuffer::putShort):
+        (JSC::AssemblerBuffer::putIntUnchecked):
+        (JSC::AssemblerBuffer::putInt):
+        (JSC::AssemblerBuffer::data):
+        (JSC::AssemblerBuffer::size):
+        (JSC::AssemblerBuffer::reset):
+        (JSC::AssemblerBuffer::executableCopy):
+        (JSC::AssemblerBuffer::grow):
+        * assembler/X86Assembler.h: Copied from masm/X86Assembler.h.
+        * masm: Removed.
+        * masm/X86Assembler.h: Removed.
+        * wtf/Platform.h:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix gtk build.
+
+        * GNUmakefile.am:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Fixed tyop.
+
+        * VM/CTI.cpp:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix windows build.
+
+        * VM/CTI.cpp:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix gtk build.
+
+        * GNUmakefile.am:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Renamed ENABLE_CTI and ENABLE(CTI) to ENABLE_JIT and ENABLE(JIT).
+
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        * VM/CodeBlock.h:
+        (JSC::CodeBlock::CodeBlock):
+        * VM/Machine.cpp:
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::initialize):
+        (JSC::Interpreter::~Interpreter):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        * VM/Machine.h:
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::prepareJumpTableForStringSwitch):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::~JSFunction):
+        * runtime/JSGlobalData.h:
+        * wrec/WREC.h:
+        * wtf/Platform.h:
+        * wtf/TCSystemAlloc.cpp:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix gtk build.
+
+        * VM/CTI.cpp:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by a few people on squirrelfish-dev.
+        
+        Renamed CTI => JIT.
+
+        * VM/CTI.cpp:
+        (JSC::JIT::killLastResultRegister):
+        (JSC::JIT::emitGetVirtualRegister):
+        (JSC::JIT::emitGetVirtualRegisters):
+        (JSC::JIT::emitPutCTIArgFromVirtualRegister):
+        (JSC::JIT::emitPutCTIArg):
+        (JSC::JIT::emitGetCTIArg):
+        (JSC::JIT::emitPutCTIArgConstant):
+        (JSC::JIT::getConstantImmediateNumericArg):
+        (JSC::JIT::emitPutCTIParam):
+        (JSC::JIT::emitGetCTIParam):
+        (JSC::JIT::emitPutToCallFrameHeader):
+        (JSC::JIT::emitGetFromCallFrameHeader):
+        (JSC::JIT::emitPutVirtualRegister):
+        (JSC::JIT::emitInitRegister):
+        (JSC::JIT::printBytecodeOperandTypes):
+        (JSC::JIT::emitAllocateNumber):
+        (JSC::JIT::emitNakedCall):
+        (JSC::JIT::emitNakedFastCall):
+        (JSC::JIT::emitCTICall):
+        (JSC::JIT::emitJumpSlowCaseIfNotJSCell):
+        (JSC::JIT::linkSlowCaseIfNotJSCell):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmNum):
+        (JSC::JIT::emitJumpSlowCaseIfNotImmNums):
+        (JSC::JIT::getDeTaggedConstantImmediate):
+        (JSC::JIT::emitFastArithDeTagImmediate):
+        (JSC::JIT::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::JIT::emitFastArithReTagImmediate):
+        (JSC::JIT::emitFastArithPotentiallyReTagImmediate):
+        (JSC::JIT::emitFastArithImmToInt):
+        (JSC::JIT::emitFastArithIntToImmOrSlowCase):
+        (JSC::JIT::emitFastArithIntToImmNoCheck):
+        (JSC::JIT::emitArithIntToImmWithJump):
+        (JSC::JIT::emitTagAsBoolImmediate):
+        (JSC::JIT::JIT):
+        (JSC::JIT::compileOpCallInitializeCallFrame):
+        (JSC::JIT::compileOpCallSetupArgs):
+        (JSC::JIT::compileOpCallEvalSetupArgs):
+        (JSC::JIT::compileOpConstructSetupArgs):
+        (JSC::JIT::compileOpCall):
+        (JSC::JIT::compileOpStrictEq):
+        (JSC::JIT::emitSlowScriptCheck):
+        (JSC::JIT::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::JIT::compileBinaryArithOp):
+        (JSC::JIT::compileBinaryArithOpSlowCase):
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileLinkPass):
+        (JSC::JIT::privateCompileSlowCases):
+        (JSC::JIT::privateCompile):
+        (JSC::JIT::privateCompileGetByIdSelf):
+        (JSC::JIT::privateCompileGetByIdProto):
+        (JSC::JIT::privateCompileGetByIdChain):
+        (JSC::JIT::privateCompilePutByIdReplace):
+        (JSC::JIT::privateCompilePutByIdTransition):
+        (JSC::JIT::unlinkCall):
+        (JSC::JIT::linkCall):
+        (JSC::JIT::privateCompileCTIMachineTrampolines):
+        (JSC::JIT::freeCTIMachineTrampolines):
+        (JSC::JIT::patchGetByIdSelf):
+        (JSC::JIT::patchPutByIdReplace):
+        (JSC::JIT::privateCompilePatchGetArrayLength):
+        (JSC::JIT::emitGetVariableObjectRegister):
+        (JSC::JIT::emitPutVariableObjectRegister):
+        * VM/CTI.h:
+        (JSC::JIT::compile):
+        (JSC::JIT::compileGetByIdSelf):
+        (JSC::JIT::compileGetByIdProto):
+        (JSC::JIT::compileGetByIdChain):
+        (JSC::JIT::compilePutByIdReplace):
+        (JSC::JIT::compilePutByIdTransition):
+        (JSC::JIT::compileCTIMachineTrampolines):
+        (JSC::JIT::compilePatchGetArrayLength):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::unlinkCallers):
+        * VM/Machine.cpp:
+        (JSC::Interpreter::initialize):
+        (JSC::Interpreter::~Interpreter):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::tryCTICachePutByID):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::Interpreter::cti_op_call_JSFunction):
+        (JSC::Interpreter::cti_vm_dontLazyLinkCall):
+        (JSC::Interpreter::cti_vm_lazyLinkCall):
+        * VM/Machine.h:
+        * VM/RegisterFile.h:
+        * parser/Nodes.h:
+        * runtime/JSArray.h:
+        * runtime/JSCell.h:
+        * runtime/JSFunction.h:
+        * runtime/JSImmediate.h:
+        * runtime/JSNumberCell.h:
+        * runtime/JSObject.h:
+        * runtime/JSString.h:
+        * runtime/JSVariableObject.h:
+        * runtime/ScopeChain.h:
+        * runtime/Structure.h:
+        * runtime/TypeInfo.h:
+        * runtime/UString.h:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix wx build.
+
+        * jscore.bkl:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Nixed X86:: and X86Assembler:: prefixes in a lot of places using typedefs.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetVirtualRegister):
+        (JSC::CTI::emitGetVirtualRegisters):
+        (JSC::CTI::emitPutCTIArgFromVirtualRegister):
+        (JSC::CTI::emitPutCTIArg):
+        (JSC::CTI::emitGetCTIArg):
+        (JSC::CTI::emitPutCTIParam):
+        (JSC::CTI::emitGetCTIParam):
+        (JSC::CTI::emitPutToCallFrameHeader):
+        (JSC::CTI::emitGetFromCallFrameHeader):
+        (JSC::CTI::emitPutVirtualRegister):
+        (JSC::CTI::emitNakedCall):
+        (JSC::CTI::emitNakedFastCall):
+        (JSC::CTI::emitCTICall):
+        (JSC::CTI::emitJumpSlowCaseIfNotJSCell):
+        (JSC::CTI::emitJumpSlowCaseIfNotImmNum):
+        (JSC::CTI::emitJumpSlowCaseIfNotImmNums):
+        (JSC::CTI::emitFastArithDeTagImmediate):
+        (JSC::CTI::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::CTI::emitFastArithReTagImmediate):
+        (JSC::CTI::emitFastArithPotentiallyReTagImmediate):
+        (JSC::CTI::emitFastArithImmToInt):
+        (JSC::CTI::emitFastArithIntToImmOrSlowCase):
+        (JSC::CTI::emitFastArithIntToImmNoCheck):
+        (JSC::CTI::emitArithIntToImmWithJump):
+        (JSC::CTI::emitTagAsBoolImmediate):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::compileOpStrictEq):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        (JSC::CTI::privateCompileCTIMachineTrampolines):
+        (JSC::CTI::privateCompilePatchGetArrayLength):
+        (JSC::CTI::emitGetVariableObjectRegister):
+        (JSC::CTI::emitPutVariableObjectRegister):
+        * VM/CTI.h:
+        (JSC::CallRecord::CallRecord):
+        (JSC::JmpTable::JmpTable):
+        (JSC::SlowCaseEntry::SlowCaseEntry):
+        (JSC::CTI::JSRInfo::JSRInfo):
+        * wrec/WREC.h:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Qt build.
+
+        * JavaScriptCore.pri:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Renamed OBJECT_OFFSET => FIELD_OFFSET
+
+        Nixed use of OBJECT_OFFSET outside of CTI.cpp by making CTI a friend in
+        more places.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCallInitializeCallFrame):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        (JSC::CTI::privateCompileCTIMachineTrampolines):
+        (JSC::CTI::privateCompilePatchGetArrayLength):
+        (JSC::CTI::emitGetVariableObjectRegister):
+        (JSC::CTI::emitPutVariableObjectRegister):
+        * runtime/JSValue.h:
+        * runtime/JSVariableObject.h:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Renames:
+        
+        X86Assembler::copy => X86Assembler::executableCopy
+        AssemblerBuffer::copy => AssemblerBuffer::executableCopy
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        (JSC::CTI::privateCompileCTIMachineTrampolines):
+        (JSC::CTI::privateCompilePatchGetArrayLength):
+        * masm/X86Assembler.h:
+        (JSC::AssemblerBuffer::executableCopy):
+        (JSC::X86Assembler::executableCopy):
+        * wrec/WREC.cpp:
+        (JSC::WREC::compileRegExp):
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Renamed WREC => JSC::WREC, removing JSC:: prefix in a lot of places.
+        Renamed WRECFunction => WREC::CompiledRegExp, and deployed this type
+        name in place of a few casts.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::~RegExp):
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+        * wrec/CharacterClassConstructor.cpp:
+        * wrec/CharacterClassConstructor.h:
+        * wrec/WREC.cpp:
+        (JSC::WREC::compileRegExp):
+        * wrec/WREC.h:
+        (JSC::WREC::Generator::Generator):
+        (JSC::WREC::Parser::Parser):
+        (JSC::WREC::Parser::parseAlternative):
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Renamed BytecodeInterpreter => Interpreter.
+
+        * JavaScriptCore.exp:
+        * VM/CTI.cpp:
+        (JSC::):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        (JSC::CTI::privateCompileCTIMachineTrampolines):
+        (JSC::CTI::freeCTIMachineTrampolines):
+        (JSC::CTI::patchGetByIdSelf):
+        (JSC::CTI::patchPutByIdReplace):
+        (JSC::CTI::privateCompilePatchGetArrayLength):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        * VM/Machine.cpp:
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::resolveBaseAndFunc):
+        (JSC::Interpreter::slideRegisterWindowForCall):
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::initialize):
+        (JSC::Interpreter::~Interpreter):
+        (JSC::Interpreter::dumpCallFrame):
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::isOpcode):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::debug):
+        (JSC::Interpreter::resetTimeoutCheck):
+        (JSC::Interpreter::checkTimeout):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::uncachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::uncacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        (JSC::Interpreter::retrieveCaller):
+        (JSC::Interpreter::retrieveLastCaller):
+        (JSC::Interpreter::findFunctionCallFrame):
+        (JSC::Interpreter::tryCTICachePutByID):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::Interpreter::cti_op_convert_this):
+        (JSC::Interpreter::cti_op_end):
+        (JSC::Interpreter::cti_op_add):
+        (JSC::Interpreter::cti_op_pre_inc):
+        (JSC::Interpreter::cti_timeout_check):
+        (JSC::Interpreter::cti_register_file_check):
+        (JSC::Interpreter::cti_op_loop_if_less):
+        (JSC::Interpreter::cti_op_loop_if_lesseq):
+        (JSC::Interpreter::cti_op_new_object):
+        (JSC::Interpreter::cti_op_put_by_id):
+        (JSC::Interpreter::cti_op_put_by_id_second):
+        (JSC::Interpreter::cti_op_put_by_id_generic):
+        (JSC::Interpreter::cti_op_put_by_id_fail):
+        (JSC::Interpreter::cti_op_get_by_id):
+        (JSC::Interpreter::cti_op_get_by_id_second):
+        (JSC::Interpreter::cti_op_get_by_id_generic):
+        (JSC::Interpreter::cti_op_get_by_id_fail):
+        (JSC::Interpreter::cti_op_instanceof):
+        (JSC::Interpreter::cti_op_del_by_id):
+        (JSC::Interpreter::cti_op_mul):
+        (JSC::Interpreter::cti_op_new_func):
+        (JSC::Interpreter::cti_op_call_JSFunction):
+        (JSC::Interpreter::cti_op_call_arityCheck):
+        (JSC::Interpreter::cti_vm_dontLazyLinkCall):
+        (JSC::Interpreter::cti_vm_lazyLinkCall):
+        (JSC::Interpreter::cti_op_push_activation):
+        (JSC::Interpreter::cti_op_call_NotJSFunction):
+        (JSC::Interpreter::cti_op_create_arguments):
+        (JSC::Interpreter::cti_op_create_arguments_no_params):
+        (JSC::Interpreter::cti_op_tear_off_activation):
+        (JSC::Interpreter::cti_op_tear_off_arguments):
+        (JSC::Interpreter::cti_op_profile_will_call):
+        (JSC::Interpreter::cti_op_profile_did_call):
+        (JSC::Interpreter::cti_op_ret_scopeChain):
+        (JSC::Interpreter::cti_op_new_array):
+        (JSC::Interpreter::cti_op_resolve):
+        (JSC::Interpreter::cti_op_construct_JSConstruct):
+        (JSC::Interpreter::cti_op_construct_NotJSConstruct):
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_resolve_func):
+        (JSC::Interpreter::cti_op_sub):
+        (JSC::Interpreter::cti_op_put_by_val):
+        (JSC::Interpreter::cti_op_put_by_val_array):
+        (JSC::Interpreter::cti_op_lesseq):
+        (JSC::Interpreter::cti_op_loop_if_true):
+        (JSC::Interpreter::cti_op_negate):
+        (JSC::Interpreter::cti_op_resolve_base):
+        (JSC::Interpreter::cti_op_resolve_skip):
+        (JSC::Interpreter::cti_op_resolve_global):
+        (JSC::Interpreter::cti_op_div):
+        (JSC::Interpreter::cti_op_pre_dec):
+        (JSC::Interpreter::cti_op_jless):
+        (JSC::Interpreter::cti_op_not):
+        (JSC::Interpreter::cti_op_jtrue):
+        (JSC::Interpreter::cti_op_post_inc):
+        (JSC::Interpreter::cti_op_eq):
+        (JSC::Interpreter::cti_op_lshift):
+        (JSC::Interpreter::cti_op_bitand):
+        (JSC::Interpreter::cti_op_rshift):
+        (JSC::Interpreter::cti_op_bitnot):
+        (JSC::Interpreter::cti_op_resolve_with_base):
+        (JSC::Interpreter::cti_op_new_func_exp):
+        (JSC::Interpreter::cti_op_mod):
+        (JSC::Interpreter::cti_op_less):
+        (JSC::Interpreter::cti_op_neq):
+        (JSC::Interpreter::cti_op_post_dec):
+        (JSC::Interpreter::cti_op_urshift):
+        (JSC::Interpreter::cti_op_bitxor):
+        (JSC::Interpreter::cti_op_new_regexp):
+        (JSC::Interpreter::cti_op_bitor):
+        (JSC::Interpreter::cti_op_call_eval):
+        (JSC::Interpreter::cti_op_throw):
+        (JSC::Interpreter::cti_op_get_pnames):
+        (JSC::Interpreter::cti_op_next_pname):
+        (JSC::Interpreter::cti_op_push_scope):
+        (JSC::Interpreter::cti_op_pop_scope):
+        (JSC::Interpreter::cti_op_typeof):
+        (JSC::Interpreter::cti_op_is_undefined):
+        (JSC::Interpreter::cti_op_is_boolean):
+        (JSC::Interpreter::cti_op_is_number):
+        (JSC::Interpreter::cti_op_is_string):
+        (JSC::Interpreter::cti_op_is_object):
+        (JSC::Interpreter::cti_op_is_function):
+        (JSC::Interpreter::cti_op_stricteq):
+        (JSC::Interpreter::cti_op_nstricteq):
+        (JSC::Interpreter::cti_op_to_jsnumber):
+        (JSC::Interpreter::cti_op_in):
+        (JSC::Interpreter::cti_op_push_new_scope):
+        (JSC::Interpreter::cti_op_jmp_scopes):
+        (JSC::Interpreter::cti_op_put_by_index):
+        (JSC::Interpreter::cti_op_switch_imm):
+        (JSC::Interpreter::cti_op_switch_char):
+        (JSC::Interpreter::cti_op_switch_string):
+        (JSC::Interpreter::cti_op_del_by_val):
+        (JSC::Interpreter::cti_op_put_getter):
+        (JSC::Interpreter::cti_op_put_setter):
+        (JSC::Interpreter::cti_op_new_error):
+        (JSC::Interpreter::cti_op_debug):
+        (JSC::Interpreter::cti_vm_throw):
+        * VM/Machine.h:
+        * VM/Register.h:
+        * VM/SamplingTool.h:
+        (JSC::SamplingTool::SamplingTool):
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * jsc.cpp:
+        (runWithScripts):
+        * runtime/ExecState.h:
+        (JSC::ExecState::interpreter):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSString.h:
+        * wrec/WREC.cpp:
+        (WREC::compileRegExp):
+        * wrec/WREC.h:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Roll out r38461 (my last patch) because it broke the world.
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        A few more renames:
+
+        BytecodeInterpreter => Interpreter
+        WREC => JSC::WREC, removing JSC:: prefix in a lot of places
+        X86Assembler::copy => X86Assembler::executableCopy
+        AssemblerBuffer::copy => AssemblerBuffer::executableCopy
+        WRECFunction => WREC::RegExpFunction
+        OBJECT_OFFSET => FIELD_OFFSET
+        
+        Also:
+
+        Nixed use of OBJECT_OFFSET outside of CTI.cpp by making CTI a friend in more places.
+        Nixed X86:: and X86Assembler:: prefixes in a lot of places using typedefs
+
+        * JavaScriptCore.exp:
+        * VM/CTI.cpp:
+        (JSC::):
+        (JSC::CTI::emitGetVirtualRegister):
+        (JSC::CTI::emitGetVirtualRegisters):
+        (JSC::CTI::emitPutCTIArgFromVirtualRegister):
+        (JSC::CTI::emitPutCTIArg):
+        (JSC::CTI::emitGetCTIArg):
+        (JSC::CTI::emitPutCTIParam):
+        (JSC::CTI::emitGetCTIParam):
+        (JSC::CTI::emitPutToCallFrameHeader):
+        (JSC::CTI::emitGetFromCallFrameHeader):
+        (JSC::CTI::emitPutVirtualRegister):
+        (JSC::CTI::emitNakedCall):
+        (JSC::CTI::emitNakedFastCall):
+        (JSC::CTI::emitCTICall):
+        (JSC::CTI::emitJumpSlowCaseIfNotJSCell):
+        (JSC::CTI::emitJumpSlowCaseIfNotImmNum):
+        (JSC::CTI::emitJumpSlowCaseIfNotImmNums):
+        (JSC::CTI::emitFastArithDeTagImmediate):
+        (JSC::CTI::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::CTI::emitFastArithReTagImmediate):
+        (JSC::CTI::emitFastArithPotentiallyReTagImmediate):
+        (JSC::CTI::emitFastArithImmToInt):
+        (JSC::CTI::emitFastArithIntToImmOrSlowCase):
+        (JSC::CTI::emitFastArithIntToImmNoCheck):
+        (JSC::CTI::emitArithIntToImmWithJump):
+        (JSC::CTI::emitTagAsBoolImmediate):
+        (JSC::CTI::compileOpCallInitializeCallFrame):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::compileOpStrictEq):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        (JSC::CTI::privateCompileCTIMachineTrampolines):
+        (JSC::CTI::freeCTIMachineTrampolines):
+        (JSC::CTI::patchGetByIdSelf):
+        (JSC::CTI::patchPutByIdReplace):
+        (JSC::CTI::privateCompilePatchGetArrayLength):
+        (JSC::CTI::emitGetVariableObjectRegister):
+        (JSC::CTI::emitPutVariableObjectRegister):
+        * VM/CTI.h:
+        (JSC::CallRecord::CallRecord):
+        (JSC::JmpTable::JmpTable):
+        (JSC::SlowCaseEntry::SlowCaseEntry):
+        (JSC::CTI::JSRInfo::JSRInfo):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        * VM/Machine.cpp:
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::Interpreter::resolve):
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobal):
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::resolveBaseAndProperty):
+        (JSC::Interpreter::resolveBaseAndFunc):
+        (JSC::Interpreter::slideRegisterWindowForCall):
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::Interpreter):
+        (JSC::Interpreter::initialize):
+        (JSC::Interpreter::~Interpreter):
+        (JSC::Interpreter::dumpCallFrame):
+        (JSC::Interpreter::dumpRegisters):
+        (JSC::Interpreter::isOpcode):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::debug):
+        (JSC::Interpreter::resetTimeoutCheck):
+        (JSC::Interpreter::checkTimeout):
+        (JSC::Interpreter::createExceptionScope):
+        (JSC::Interpreter::tryCachePutByID):
+        (JSC::Interpreter::uncachePutByID):
+        (JSC::Interpreter::tryCacheGetByID):
+        (JSC::Interpreter::uncacheGetByID):
+        (JSC::Interpreter::privateExecute):
+        (JSC::Interpreter::retrieveArguments):
+        (JSC::Interpreter::retrieveCaller):
+        (JSC::Interpreter::retrieveLastCaller):
+        (JSC::Interpreter::findFunctionCallFrame):
+        (JSC::Interpreter::tryCTICachePutByID):
+        (JSC::Interpreter::tryCTICacheGetByID):
+        (JSC::):
+        (JSC::Interpreter::cti_op_convert_this):
+        (JSC::Interpreter::cti_op_end):
+        (JSC::Interpreter::cti_op_add):
+        (JSC::Interpreter::cti_op_pre_inc):
+        (JSC::Interpreter::cti_timeout_check):
+        (JSC::Interpreter::cti_register_file_check):
+        (JSC::Interpreter::cti_op_loop_if_less):
+        (JSC::Interpreter::cti_op_loop_if_lesseq):
+        (JSC::Interpreter::cti_op_new_object):
+        (JSC::Interpreter::cti_op_put_by_id):
+        (JSC::Interpreter::cti_op_put_by_id_second):
+        (JSC::Interpreter::cti_op_put_by_id_generic):
+        (JSC::Interpreter::cti_op_put_by_id_fail):
+        (JSC::Interpreter::cti_op_get_by_id):
+        (JSC::Interpreter::cti_op_get_by_id_second):
+        (JSC::Interpreter::cti_op_get_by_id_generic):
+        (JSC::Interpreter::cti_op_get_by_id_fail):
+        (JSC::Interpreter::cti_op_instanceof):
+        (JSC::Interpreter::cti_op_del_by_id):
+        (JSC::Interpreter::cti_op_mul):
+        (JSC::Interpreter::cti_op_new_func):
+        (JSC::Interpreter::cti_op_call_JSFunction):
+        (JSC::Interpreter::cti_op_call_arityCheck):
+        (JSC::Interpreter::cti_vm_dontLazyLinkCall):
+        (JSC::Interpreter::cti_vm_lazyLinkCall):
+        (JSC::Interpreter::cti_op_push_activation):
+        (JSC::Interpreter::cti_op_call_NotJSFunction):
+        (JSC::Interpreter::cti_op_create_arguments):
+        (JSC::Interpreter::cti_op_create_arguments_no_params):
+        (JSC::Interpreter::cti_op_tear_off_activation):
+        (JSC::Interpreter::cti_op_tear_off_arguments):
+        (JSC::Interpreter::cti_op_profile_will_call):
+        (JSC::Interpreter::cti_op_profile_did_call):
+        (JSC::Interpreter::cti_op_ret_scopeChain):
+        (JSC::Interpreter::cti_op_new_array):
+        (JSC::Interpreter::cti_op_resolve):
+        (JSC::Interpreter::cti_op_construct_JSConstruct):
+        (JSC::Interpreter::cti_op_construct_NotJSConstruct):
+        (JSC::Interpreter::cti_op_get_by_val):
+        (JSC::Interpreter::cti_op_resolve_func):
+        (JSC::Interpreter::cti_op_sub):
+        (JSC::Interpreter::cti_op_put_by_val):
+        (JSC::Interpreter::cti_op_put_by_val_array):
+        (JSC::Interpreter::cti_op_lesseq):
+        (JSC::Interpreter::cti_op_loop_if_true):
+        (JSC::Interpreter::cti_op_negate):
+        (JSC::Interpreter::cti_op_resolve_base):
+        (JSC::Interpreter::cti_op_resolve_skip):
+        (JSC::Interpreter::cti_op_resolve_global):
+        (JSC::Interpreter::cti_op_div):
+        (JSC::Interpreter::cti_op_pre_dec):
+        (JSC::Interpreter::cti_op_jless):
+        (JSC::Interpreter::cti_op_not):
+        (JSC::Interpreter::cti_op_jtrue):
+        (JSC::Interpreter::cti_op_post_inc):
+        (JSC::Interpreter::cti_op_eq):
+        (JSC::Interpreter::cti_op_lshift):
+        (JSC::Interpreter::cti_op_bitand):
+        (JSC::Interpreter::cti_op_rshift):
+        (JSC::Interpreter::cti_op_bitnot):
+        (JSC::Interpreter::cti_op_resolve_with_base):
+        (JSC::Interpreter::cti_op_new_func_exp):
+        (JSC::Interpreter::cti_op_mod):
+        (JSC::Interpreter::cti_op_less):
+        (JSC::Interpreter::cti_op_neq):
+        (JSC::Interpreter::cti_op_post_dec):
+        (JSC::Interpreter::cti_op_urshift):
+        (JSC::Interpreter::cti_op_bitxor):
+        (JSC::Interpreter::cti_op_new_regexp):
+        (JSC::Interpreter::cti_op_bitor):
+        (JSC::Interpreter::cti_op_call_eval):
+        (JSC::Interpreter::cti_op_throw):
+        (JSC::Interpreter::cti_op_get_pnames):
+        (JSC::Interpreter::cti_op_next_pname):
+        (JSC::Interpreter::cti_op_push_scope):
+        (JSC::Interpreter::cti_op_pop_scope):
+        (JSC::Interpreter::cti_op_typeof):
+        (JSC::Interpreter::cti_op_is_undefined):
+        (JSC::Interpreter::cti_op_is_boolean):
+        (JSC::Interpreter::cti_op_is_number):
+        (JSC::Interpreter::cti_op_is_string):
+        (JSC::Interpreter::cti_op_is_object):
+        (JSC::Interpreter::cti_op_is_function):
+        (JSC::Interpreter::cti_op_stricteq):
+        (JSC::Interpreter::cti_op_nstricteq):
+        (JSC::Interpreter::cti_op_to_jsnumber):
+        (JSC::Interpreter::cti_op_in):
+        (JSC::Interpreter::cti_op_push_new_scope):
+        (JSC::Interpreter::cti_op_jmp_scopes):
+        (JSC::Interpreter::cti_op_put_by_index):
+        (JSC::Interpreter::cti_op_switch_imm):
+        (JSC::Interpreter::cti_op_switch_char):
+        (JSC::Interpreter::cti_op_switch_string):
+        (JSC::Interpreter::cti_op_del_by_val):
+        (JSC::Interpreter::cti_op_put_getter):
+        (JSC::Interpreter::cti_op_put_setter):
+        (JSC::Interpreter::cti_op_new_error):
+        (JSC::Interpreter::cti_op_debug):
+        (JSC::Interpreter::cti_vm_throw):
+        * VM/Machine.h:
+        * VM/Register.h:
+        * VM/SamplingTool.cpp:
+        (JSC::SamplingTool::dump):
+        * VM/SamplingTool.h:
+        (JSC::SamplingTool::SamplingTool):
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * jsc.cpp:
+        (runWithScripts):
+        * masm/X86Assembler.h:
+        (JSC::AssemblerBuffer::executableCopy):
+        (JSC::X86Assembler::executableCopy):
+        * runtime/ExecState.h:
+        (JSC::ExecState::interpreter):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSImmediate.h:
+        * runtime/JSString.h:
+        * runtime/JSValue.h:
+        * runtime/JSVariableObject.h:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::~RegExp):
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+        * wrec/CharacterClassConstructor.cpp:
+        * wrec/CharacterClassConstructor.h:
+        * wrec/WREC.cpp:
+        (JSC::WREC::compileRegExp):
+        * wrec/WREC.h:
+        (JSC::WREC::Generator::Generator):
+        (JSC::WREC::Parser::):
+        (JSC::WREC::Parser::Parser):
+        (JSC::WREC::Parser::parseAlternative):
+
+2008-11-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21810
+        Remove use of static C++ objects that are destroyed at exit time (destructors)
+
+        Conditionally have the DEFINE_STATIC_LOCAL workaround <rdar://problem/6354696> 
+        (Codegen issue with C++ static reference in gcc build 5465) based upon the compiler 
+        build versions. It will use the:
+        static T& = *new T;
+        style for all other compilers.
+
+        * wtf/StdLibExtras.h:
+
+2008-11-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22290
+        Remove cross-heap GC and MessagePort multi-threading support
+
+        It is broken (and may not be implementable at all), and no longer needed, as we
+        don't use MessagePorts for communication with workers any more.
+
+        * JavaScriptCore.exp:
+        * runtime/Collector.cpp:
+        (JSC::Heap::collect):
+        * runtime/JSGlobalObject.cpp:
+        * runtime/JSGlobalObject.h:
+        Remove hooks for cross-heap GC.
+
+2008-11-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Cleanup jsc command line code a little.
+
+        * jsc.cpp:
+        (functionQuit):
+        (main): Use standard exit status macros
+        (cleanupGlobalData): Factor out cleanup code into this function.
+        (printUsageStatement): Use standard exit status macros.
+
+2008-11-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Cleanup BytecodeGenerator constructors.
+
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        * bytecompiler/CodeGenerator.h:
+        * parser/Nodes.cpp:
+        (JSC::ProgramNode::generateBytecode):
+
+2008-11-15  Darin Adler  <darin@apple.com>
+
+        Rubber stamped by Geoff Garen.
+
+        - do the long-planned StructureID -> Structure rename
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::JSCallbackConstructor):
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructure):
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructure):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructure):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::JSCallbackObject):
+        * API/JSValueRef.cpp:
+        (JSValueIsInstanceOfConstructor):
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.scons:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/CTI.cpp:
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::transitionWillNeedStorageRealloc):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        (JSC::CTI::patchGetByIdSelf):
+        (JSC::CTI::patchPutByIdReplace):
+        * VM/CTI.h:
+        (JSC::CTI::compileGetByIdSelf):
+        (JSC::CTI::compileGetByIdProto):
+        (JSC::CTI::compileGetByIdChain):
+        (JSC::CTI::compilePutByIdReplace):
+        (JSC::CTI::compilePutByIdTransition):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::printStructure):
+        (JSC::CodeBlock::printStructures):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::derefStructures):
+        (JSC::CodeBlock::refStructures):
+        * VM/CodeBlock.h:
+        * VM/Instruction.h:
+        (JSC::Instruction::Instruction):
+        (JSC::Instruction::):
+        * VM/Machine.cpp:
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        (JSC::BytecodeInterpreter::resolveGlobal):
+        (JSC::BytecodeInterpreter::BytecodeInterpreter):
+        (JSC::cachePrototypeChain):
+        (JSC::BytecodeInterpreter::tryCachePutByID):
+        (JSC::BytecodeInterpreter::uncachePutByID):
+        (JSC::BytecodeInterpreter::tryCacheGetByID):
+        (JSC::BytecodeInterpreter::uncacheGetByID):
+        (JSC::BytecodeInterpreter::privateExecute):
+        (JSC::BytecodeInterpreter::tryCTICachePutByID):
+        (JSC::BytecodeInterpreter::tryCTICacheGetByID):
+        (JSC::BytecodeInterpreter::cti_op_instanceof):
+        (JSC::BytecodeInterpreter::cti_op_construct_JSConstruct):
+        (JSC::BytecodeInterpreter::cti_op_resolve_global):
+        (JSC::BytecodeInterpreter::cti_op_is_undefined):
+        * runtime/Arguments.h:
+        (JSC::Arguments::createStructure):
+        * runtime/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        * runtime/ArrayConstructor.h:
+        * runtime/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::ArrayPrototype):
+        * runtime/ArrayPrototype.h:
+        * runtime/BatchedTransitionOptimizer.h:
+        (JSC::BatchedTransitionOptimizer::BatchedTransitionOptimizer):
+        (JSC::BatchedTransitionOptimizer::~BatchedTransitionOptimizer):
+        * runtime/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        * runtime/BooleanConstructor.h:
+        * runtime/BooleanObject.cpp:
+        (JSC::BooleanObject::BooleanObject):
+        * runtime/BooleanObject.h:
+        * runtime/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * runtime/BooleanPrototype.h:
+        * runtime/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * runtime/DateConstructor.h:
+        * runtime/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * runtime/DateInstance.h:
+        * runtime/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype):
+        * runtime/DatePrototype.h:
+        (JSC::DatePrototype::createStructure):
+        * runtime/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * runtime/ErrorConstructor.h:
+        * runtime/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * runtime/ErrorInstance.h:
+        * runtime/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * runtime/ErrorPrototype.h:
+        * runtime/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * runtime/FunctionConstructor.h:
+        * runtime/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        (JSC::FunctionPrototype::addFunctionProperties):
+        * runtime/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructure):
+        * runtime/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::GlobalEvalFunction):
+        * runtime/GlobalEvalFunction.h:
+        * runtime/Identifier.h:
+        * runtime/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/InternalFunction.h:
+        (JSC::InternalFunction::createStructure):
+        (JSC::InternalFunction::InternalFunction):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::createStructure):
+        * runtime/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        * runtime/JSArray.h:
+        (JSC::JSArray::createStructure):
+        * runtime/JSCell.h:
+        (JSC::JSCell::JSCell):
+        (JSC::JSCell::isObject):
+        (JSC::JSCell::isString):
+        (JSC::JSCell::structure):
+        (JSC::JSValue::needsThisConversion):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::construct):
+        * runtime/JSFunction.h:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::createStructure):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::createLeaked):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::markIfNeeded):
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        (JSC::JSGlobalObject::argumentsStructure):
+        (JSC::JSGlobalObject::arrayStructure):
+        (JSC::JSGlobalObject::booleanObjectStructure):
+        (JSC::JSGlobalObject::callbackConstructorStructure):
+        (JSC::JSGlobalObject::callbackFunctionStructure):
+        (JSC::JSGlobalObject::callbackObjectStructure):
+        (JSC::JSGlobalObject::dateStructure):
+        (JSC::JSGlobalObject::emptyObjectStructure):
+        (JSC::JSGlobalObject::errorStructure):
+        (JSC::JSGlobalObject::functionStructure):
+        (JSC::JSGlobalObject::numberObjectStructure):
+        (JSC::JSGlobalObject::prototypeFunctionStructure):
+        (JSC::JSGlobalObject::regExpMatchesArrayStructure):
+        (JSC::JSGlobalObject::regExpStructure):
+        (JSC::JSGlobalObject::stringObjectStructure):
+        (JSC::JSGlobalObject::createStructure):
+        (JSC::Structure::prototypeForLookup):
+        * runtime/JSNotAnObject.h:
+        (JSC::JSNotAnObject::createStructure):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructure):
+        (JSC::JSNumberCell::JSNumberCell):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::mark):
+        (JSC::JSObject::put):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        (JSC::JSObject::getPropertyAttributes):
+        (JSC::JSObject::getPropertyNames):
+        (JSC::JSObject::removeDirect):
+        (JSC::JSObject::createInheritorID):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::hasCustomProperties):
+        (JSC::JSObject::hasGetterSetterProperties):
+        (JSC::JSObject::createStructure):
+        (JSC::JSObject::JSObject):
+        (JSC::JSObject::~JSObject):
+        (JSC::JSObject::prototype):
+        (JSC::JSObject::setPrototype):
+        (JSC::JSObject::setStructure):
+        (JSC::JSObject::inheritorID):
+        (JSC::JSObject::inlineGetOwnPropertySlot):
+        (JSC::JSObject::getOwnPropertySlotForWrite):
+        (JSC::JSCell::fastGetOwnPropertySlot):
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::putDirectWithoutTransition):
+        (JSC::JSObject::transitionTo):
+        * runtime/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::next):
+        * runtime/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        (JSC::JSStaticScopeObject::createStructure):
+        * runtime/JSString.h:
+        (JSC::JSString::JSString):
+        (JSC::JSString::createStructure):
+        * runtime/JSVariableObject.h:
+        (JSC::JSVariableObject::JSVariableObject):
+        * runtime/JSWrapperObject.h:
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * runtime/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * runtime/MathObject.h:
+        (JSC::MathObject::createStructure):
+        * runtime/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * runtime/NativeErrorConstructor.h:
+        * runtime/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * runtime/NativeErrorPrototype.h:
+        * runtime/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        * runtime/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructure):
+        * runtime/NumberObject.cpp:
+        (JSC::NumberObject::NumberObject):
+        * runtime/NumberObject.h:
+        * runtime/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * runtime/NumberPrototype.h:
+        * runtime/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        * runtime/ObjectConstructor.h:
+        * runtime/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * runtime/ObjectPrototype.h:
+        * runtime/Operations.h:
+        (JSC::equalSlowCaseInline):
+        * runtime/PropertyNameArray.h:
+        (JSC::PropertyNameArrayData::setCachedStructure):
+        (JSC::PropertyNameArrayData::cachedStructure):
+        (JSC::PropertyNameArrayData::setCachedPrototypeChain):
+        (JSC::PropertyNameArrayData::cachedPrototypeChain):
+        (JSC::PropertyNameArrayData::PropertyNameArrayData):
+        * runtime/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * runtime/PrototypeFunction.h:
+        * runtime/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * runtime/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructure):
+        * runtime/RegExpObject.cpp:
+        (JSC::RegExpObject::RegExpObject):
+        * runtime/RegExpObject.h:
+        (JSC::RegExpObject::createStructure):
+        * runtime/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * runtime/RegExpPrototype.h:
+        * runtime/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * runtime/StringConstructor.h:
+        * runtime/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * runtime/StringObject.h:
+        (JSC::StringObject::createStructure):
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::create):
+        (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructure):
+        * runtime/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * runtime/StringPrototype.h:
+        * runtime/Structure.cpp: Copied from JavaScriptCore/runtime/StructureID.cpp.
+        (JSC::Structure::dumpStatistics):
+        (JSC::Structure::Structure):
+        (JSC::Structure::~Structure):
+        (JSC::Structure::startIgnoringLeaks):
+        (JSC::Structure::stopIgnoringLeaks):
+        (JSC::Structure::materializePropertyMap):
+        (JSC::Structure::getEnumerablePropertyNames):
+        (JSC::Structure::clearEnumerationCache):
+        (JSC::Structure::growPropertyStorageCapacity):
+        (JSC::Structure::addPropertyTransitionToExistingStructure):
+        (JSC::Structure::addPropertyTransition):
+        (JSC::Structure::removePropertyTransition):
+        (JSC::Structure::changePrototypeTransition):
+        (JSC::Structure::getterSetterTransition):
+        (JSC::Structure::toDictionaryTransition):
+        (JSC::Structure::fromDictionaryTransition):
+        (JSC::Structure::addPropertyWithoutTransition):
+        (JSC::Structure::removePropertyWithoutTransition):
+        (JSC::Structure::createCachedPrototypeChain):
+        (JSC::Structure::checkConsistency):
+        (JSC::Structure::copyPropertyTable):
+        (JSC::Structure::get):
+        (JSC::Structure::put):
+        (JSC::Structure::remove):
+        (JSC::Structure::insertIntoPropertyMapHashTable):
+        (JSC::Structure::createPropertyMapHashTable):
+        (JSC::Structure::expandPropertyMapHashTable):
+        (JSC::Structure::rehashPropertyMapHashTable):
+        (JSC::Structure::getEnumerablePropertyNamesInternal):
+        * runtime/Structure.h: Copied from JavaScriptCore/runtime/StructureID.h.
+        (JSC::Structure::create):
+        (JSC::Structure::previousID):
+        (JSC::Structure::setCachedPrototypeChain):
+        (JSC::Structure::cachedPrototypeChain):
+        (JSC::Structure::):
+        (JSC::Structure::get):
+        * runtime/StructureChain.cpp: Copied from JavaScriptCore/runtime/StructureIDChain.cpp.
+        (JSC::StructureChain::StructureChain):
+        (JSC::structureChainsAreEqual):
+        * runtime/StructureChain.h: Copied from JavaScriptCore/runtime/StructureIDChain.h.
+        (JSC::StructureChain::create):
+        (JSC::StructureChain::head):
+        * runtime/StructureID.cpp: Removed.
+        * runtime/StructureID.h: Removed.
+        * runtime/StructureIDChain.cpp: Removed.
+        * runtime/StructureIDChain.h: Removed.
+        * runtime/StructureIDTransitionTable.h: Removed.
+        * runtime/StructureTransitionTable.h: Copied from JavaScriptCore/runtime/StructureIDTransitionTable.h.
+
+2008-11-15  Darin Adler  <darin@apple.com>
+
+        - fix non-WREC build
+
+        * runtime/RegExp.cpp: Put "using namespace WREC" inside #if ENABLE(WREC).
+
+2008-11-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Timothy Hatcher.
+        
+        As ThreadingNone doesn't implement threads, isMainThread should return true,
+        not false.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=22285
+
+        * wtf/ThreadingNone.cpp:
+        (WTF::isMainThread):
+
+2008-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Moved all WREC-related code into WREC.cpp and put it in a WREC namespace.
+        Removed the WREC prefix from class names.
+
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * VM/Machine.h:
+        (JSC::BytecodeInterpreter::assemblerBuffer):
+        * masm/X86Assembler.h:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * wrec/CharacterClassConstructor.cpp:
+        * wrec/CharacterClassConstructor.h:
+        * wrec/WREC.cpp:
+        (WREC::GenerateParenthesesNonGreedyFunctor::GenerateParenthesesNonGreedyFunctor):
+        (WREC::GeneratePatternCharacterFunctor::generateAtom):
+        (WREC::GeneratePatternCharacterFunctor::backtrack):
+        (WREC::GenerateCharacterClassFunctor::generateAtom):
+        (WREC::GenerateCharacterClassFunctor::backtrack):
+        (WREC::GenerateBackreferenceFunctor::generateAtom):
+        (WREC::GenerateBackreferenceFunctor::backtrack):
+        (WREC::GenerateParenthesesNonGreedyFunctor::generateAtom):
+        (WREC::GenerateParenthesesNonGreedyFunctor::backtrack):
+        (WREC::Generator::generateBacktrack1):
+        (WREC::Generator::generateBacktrackBackreference):
+        (WREC::Generator::generateBackreferenceQuantifier):
+        (WREC::Generator::generateNonGreedyQuantifier):
+        (WREC::Generator::generateGreedyQuantifier):
+        (WREC::Generator::generatePatternCharacter):
+        (WREC::Generator::generateCharacterClassInvertedRange):
+        (WREC::Generator::generateCharacterClassInverted):
+        (WREC::Generator::generateCharacterClass):
+        (WREC::Generator::generateParentheses):
+        (WREC::Generator::generateParenthesesNonGreedy):
+        (WREC::Generator::generateParenthesesResetTrampoline):
+        (WREC::Generator::generateAssertionBOL):
+        (WREC::Generator::generateAssertionEOL):
+        (WREC::Generator::generateAssertionWordBoundary):
+        (WREC::Generator::generateBackreference):
+        (WREC::Generator::generateDisjunction):
+        (WREC::Generator::terminateDisjunction):
+        (WREC::Parser::parseGreedyQuantifier):
+        (WREC::Parser::parseQuantifier):
+        (WREC::Parser::parsePatternCharacterQualifier):
+        (WREC::Parser::parseCharacterClassQuantifier):
+        (WREC::Parser::parseBackreferenceQuantifier):
+        (WREC::Parser::parseParentheses):
+        (WREC::Parser::parseCharacterClass):
+        (WREC::Parser::parseOctalEscape):
+        (WREC::Parser::parseEscape):
+        (WREC::Parser::parseTerm):
+        (WREC::Parser::parseDisjunction):
+        (WREC::compileRegExp):
+        * wrec/WREC.h:
+        (WREC::Generator::Generator):
+        (WREC::Parser::Parser):
+        (WREC::Parser::parseAlternative):
+
+2008-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Changed another case of "m_jit" to "m_assembler".
+
+        * VM/CTI.cpp:
+        * wrec/WREC.cpp:
+        * wrec/WREC.h:
+        (JSC::WRECGenerator::WRECGenerator):
+        (JSC::WRECParser::WRECParser):
+
+2008-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Renamed "jit" to "assembler" and, for brevity, replaced *jit.* with __
+        using a macro.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetVirtualRegister):
+        (JSC::CTI::emitPutCTIArgFromVirtualRegister):
+        (JSC::CTI::emitPutCTIArg):
+        (JSC::CTI::emitGetCTIArg):
+        (JSC::CTI::emitPutCTIArgConstant):
+        (JSC::CTI::emitPutCTIParam):
+        (JSC::CTI::emitGetCTIParam):
+        (JSC::CTI::emitPutToCallFrameHeader):
+        (JSC::CTI::emitGetFromCallFrameHeader):
+        (JSC::CTI::emitPutVirtualRegister):
+        (JSC::CTI::emitInitRegister):
+        (JSC::CTI::emitAllocateNumber):
+        (JSC::CTI::emitNakedCall):
+        (JSC::CTI::emitNakedFastCall):
+        (JSC::CTI::emitCTICall):
+        (JSC::CTI::emitJumpSlowCaseIfNotJSCell):
+        (JSC::CTI::linkSlowCaseIfNotJSCell):
+        (JSC::CTI::emitJumpSlowCaseIfNotImmNum):
+        (JSC::CTI::emitJumpSlowCaseIfNotImmNums):
+        (JSC::CTI::emitFastArithDeTagImmediate):
+        (JSC::CTI::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::CTI::emitFastArithReTagImmediate):
+        (JSC::CTI::emitFastArithPotentiallyReTagImmediate):
+        (JSC::CTI::emitFastArithImmToInt):
+        (JSC::CTI::emitFastArithIntToImmOrSlowCase):
+        (JSC::CTI::emitFastArithIntToImmNoCheck):
+        (JSC::CTI::emitArithIntToImmWithJump):
+        (JSC::CTI::emitTagAsBoolImmediate):
+        (JSC::CTI::CTI):
+        (JSC::CTI::compileOpCallInitializeCallFrame):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::compileOpStrictEq):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileLinkPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        (JSC::CTI::privateCompileCTIMachineTrampolines):
+        (JSC::CTI::privateCompilePatchGetArrayLength):
+        (JSC::CTI::emitGetVariableObjectRegister):
+        (JSC::CTI::emitPutVariableObjectRegister):
+        (JSC::CTI::compileRegExp):
+        * VM/CTI.h:
+        * wrec/WREC.cpp:
+        (JSC::WRECGenerator::generateBacktrack1):
+        (JSC::WRECGenerator::generateBacktrackBackreference):
+        (JSC::WRECGenerator::generateBackreferenceQuantifier):
+        (JSC::WRECGenerator::generateNonGreedyQuantifier):
+        (JSC::WRECGenerator::generateGreedyQuantifier):
+        (JSC::WRECGenerator::generatePatternCharacter):
+        (JSC::WRECGenerator::generateCharacterClassInvertedRange):
+        (JSC::WRECGenerator::generateCharacterClassInverted):
+        (JSC::WRECGenerator::generateCharacterClass):
+        (JSC::WRECGenerator::generateParentheses):
+        (JSC::WRECGenerator::generateParenthesesNonGreedy):
+        (JSC::WRECGenerator::generateParenthesesResetTrampoline):
+        (JSC::WRECGenerator::generateAssertionBOL):
+        (JSC::WRECGenerator::generateAssertionEOL):
+        (JSC::WRECGenerator::generateAssertionWordBoundary):
+        (JSC::WRECGenerator::generateBackreference):
+        (JSC::WRECGenerator::generateDisjunction):
+        (JSC::WRECGenerator::terminateDisjunction):
+
+2008-11-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove dead method declaration.
+
+        * bytecompiler/CodeGenerator.h:
+
+2008-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Renamed LabelID to Label, Label::isForwardLabel to Label::isForward.
+
+        * VM/LabelID.h:
+        (JSC::Label::Label):
+        (JSC::Label::isForward):
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::BytecodeGenerator::newLabel):
+        (JSC::BytecodeGenerator::emitLabel):
+        (JSC::BytecodeGenerator::emitJump):
+        (JSC::BytecodeGenerator::emitJumpIfTrue):
+        (JSC::BytecodeGenerator::emitJumpIfFalse):
+        (JSC::BytecodeGenerator::pushFinallyContext):
+        (JSC::BytecodeGenerator::emitComplexJumpScopes):
+        (JSC::BytecodeGenerator::emitJumpScopes):
+        (JSC::BytecodeGenerator::emitNextPropertyName):
+        (JSC::BytecodeGenerator::emitCatch):
+        (JSC::BytecodeGenerator::emitJumpSubroutine):
+        (JSC::prepareJumpTableForImmediateSwitch):
+        (JSC::prepareJumpTableForCharacterSwitch):
+        (JSC::prepareJumpTableForStringSwitch):
+        (JSC::BytecodeGenerator::endSwitch):
+        * bytecompiler/CodeGenerator.h:
+        * bytecompiler/LabelScope.h:
+        (JSC::LabelScope::LabelScope):
+        (JSC::LabelScope::breakTarget):
+        (JSC::LabelScope::continueTarget):
+        * parser/Nodes.cpp:
+        (JSC::LogicalOpNode::emitBytecode):
+        (JSC::ConditionalNode::emitBytecode):
+        (JSC::IfNode::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::CaseBlockNode::emitBytecodeForBlock):
+        (JSC::TryNode::emitBytecode):
+
+2008-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Renamed JITCodeBuffer to AssemblerBuffer and renamed its data members
+        to be more like the rest of our buffer classes, with a size and a
+        capacity.
+        
+        Added an assert in the unchecked put case to match the test in the checked
+        put case.
+        
+        Changed a C-style cast to a C++-style cast.
+        
+        Renamed MAX_INSTRUCTION_SIZE to maxInstructionSize.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::CTI):
+        (JSC::CTI::compileRegExp):
+        * VM/Machine.cpp:
+        (JSC::BytecodeInterpreter::BytecodeInterpreter):
+        * VM/Machine.h:
+        (JSC::BytecodeInterpreter::assemblerBuffer):
+        * masm/X86Assembler.h:
+        (JSC::AssemblerBuffer::AssemblerBuffer):
+        (JSC::AssemblerBuffer::~AssemblerBuffer):
+        (JSC::AssemblerBuffer::ensureSpace):
+        (JSC::AssemblerBuffer::isAligned):
+        (JSC::AssemblerBuffer::putByteUnchecked):
+        (JSC::AssemblerBuffer::putByte):
+        (JSC::AssemblerBuffer::putShortUnchecked):
+        (JSC::AssemblerBuffer::putShort):
+        (JSC::AssemblerBuffer::putIntUnchecked):
+        (JSC::AssemblerBuffer::putInt):
+        (JSC::AssemblerBuffer::data):
+        (JSC::AssemblerBuffer::size):
+        (JSC::AssemblerBuffer::reset):
+        (JSC::AssemblerBuffer::copy):
+        (JSC::AssemblerBuffer::grow):
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::X86Assembler):
+        (JSC::X86Assembler::testl_i32r):
+        (JSC::X86Assembler::movl_mr):
+        (JSC::X86Assembler::movl_rm):
+        (JSC::X86Assembler::movl_i32m):
+        (JSC::X86Assembler::emitCall):
+        (JSC::X86Assembler::label):
+        (JSC::X86Assembler::emitUnlinkedJmp):
+        (JSC::X86Assembler::emitUnlinkedJne):
+        (JSC::X86Assembler::emitUnlinkedJe):
+        (JSC::X86Assembler::emitUnlinkedJl):
+        (JSC::X86Assembler::emitUnlinkedJb):
+        (JSC::X86Assembler::emitUnlinkedJle):
+        (JSC::X86Assembler::emitUnlinkedJbe):
+        (JSC::X86Assembler::emitUnlinkedJge):
+        (JSC::X86Assembler::emitUnlinkedJg):
+        (JSC::X86Assembler::emitUnlinkedJa):
+        (JSC::X86Assembler::emitUnlinkedJae):
+        (JSC::X86Assembler::emitUnlinkedJo):
+        (JSC::X86Assembler::emitUnlinkedJp):
+        (JSC::X86Assembler::emitUnlinkedJs):
+        (JSC::X86Assembler::link):
+        (JSC::X86Assembler::emitModRm_rr):
+        (JSC::X86Assembler::emitModRm_rm):
+        (JSC::X86Assembler::emitModRm_opr):
+
+2008-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Suggested by Maciej Stachowiak.
+        
+        Reverted most "opcode" => "bytecode" renames. We use "bytecode" as a
+        mass noun to refer to a stream of instructions. Each instruction may be
+        an opcode or an operand.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitCTICall):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::printStructureIDs):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructureIDs):
+        (JSC::CodeBlock::refStructureIDs):
+        * VM/CodeBlock.h:
+        * VM/ExceptionHelpers.cpp:
+        (JSC::createNotAnObjectError):
+        * VM/Instruction.h:
+        (JSC::Instruction::Instruction):
+        (JSC::Instruction::):
+        * VM/Machine.cpp:
+        (JSC::BytecodeInterpreter::isOpcode):
+        (JSC::BytecodeInterpreter::throwException):
+        (JSC::BytecodeInterpreter::tryCachePutByID):
+        (JSC::BytecodeInterpreter::uncachePutByID):
+        (JSC::BytecodeInterpreter::tryCacheGetByID):
+        (JSC::BytecodeInterpreter::uncacheGetByID):
+        (JSC::BytecodeInterpreter::privateExecute):
+        (JSC::BytecodeInterpreter::tryCTICachePutByID):
+        (JSC::BytecodeInterpreter::tryCTICacheGetByID):
+        * VM/Machine.h:
+        (JSC::BytecodeInterpreter::getOpcode):
+        (JSC::BytecodeInterpreter::getOpcodeID):
+        (JSC::BytecodeInterpreter::isCallBytecode):
+        * VM/Opcode.cpp:
+        (JSC::):
+        (JSC::OpcodeStats::OpcodeStats):
+        (JSC::compareOpcodeIndices):
+        (JSC::compareOpcodePairIndices):
+        (JSC::OpcodeStats::~OpcodeStats):
+        (JSC::OpcodeStats::recordInstruction):
+        (JSC::OpcodeStats::resetLastInstruction):
+        * VM/Opcode.h:
+        (JSC::):
+        (JSC::padOpcodeName):
+        * VM/SamplingTool.cpp:
+        (JSC::ScopeSampleRecord::sample):
+        (JSC::SamplingTool::run):
+        (JSC::compareOpcodeIndicesSampling):
+        (JSC::SamplingTool::dump):
+        * VM/SamplingTool.h:
+        (JSC::ScopeSampleRecord::ScopeSampleRecord):
+        (JSC::SamplingTool::SamplingTool):
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitLabel):
+        (JSC::BytecodeGenerator::emitOpcode):
+        (JSC::BytecodeGenerator::emitJump):
+        (JSC::BytecodeGenerator::emitJumpIfTrue):
+        (JSC::BytecodeGenerator::emitJumpIfFalse):
+        (JSC::BytecodeGenerator::emitMove):
+        (JSC::BytecodeGenerator::emitUnaryOp):
+        (JSC::BytecodeGenerator::emitPreInc):
+        (JSC::BytecodeGenerator::emitPreDec):
+        (JSC::BytecodeGenerator::emitPostInc):
+        (JSC::BytecodeGenerator::emitPostDec):
+        (JSC::BytecodeGenerator::emitBinaryOp):
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        (JSC::BytecodeGenerator::emitUnexpectedLoad):
+        (JSC::BytecodeGenerator::emitInstanceOf):
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitGetScopedVar):
+        (JSC::BytecodeGenerator::emitPutScopedVar):
+        (JSC::BytecodeGenerator::emitResolveBase):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitResolveFunction):
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitPutGetter):
+        (JSC::BytecodeGenerator::emitPutSetter):
+        (JSC::BytecodeGenerator::emitDeleteById):
+        (JSC::BytecodeGenerator::emitGetByVal):
+        (JSC::BytecodeGenerator::emitPutByVal):
+        (JSC::BytecodeGenerator::emitDeleteByVal):
+        (JSC::BytecodeGenerator::emitPutByIndex):
+        (JSC::BytecodeGenerator::emitNewObject):
+        (JSC::BytecodeGenerator::emitNewArray):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitNewRegExp):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitReturn):
+        (JSC::BytecodeGenerator::emitUnaryNoDstOp):
+        (JSC::BytecodeGenerator::emitConstruct):
+        (JSC::BytecodeGenerator::emitPopScope):
+        (JSC::BytecodeGenerator::emitDebugHook):
+        (JSC::BytecodeGenerator::emitComplexJumpScopes):
+        (JSC::BytecodeGenerator::emitJumpScopes):
+        (JSC::BytecodeGenerator::emitNextPropertyName):
+        (JSC::BytecodeGenerator::emitCatch):
+        (JSC::BytecodeGenerator::emitNewError):
+        (JSC::BytecodeGenerator::emitJumpSubroutine):
+        (JSC::BytecodeGenerator::emitSubroutineReturn):
+        (JSC::BytecodeGenerator::emitPushNewScope):
+        (JSC::BytecodeGenerator::beginSwitch):
+        * bytecompiler/CodeGenerator.h:
+        * jsc.cpp:
+        (runWithScripts):
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::emitModRm_opr):
+        (JSC::X86Assembler::emitModRm_opr_Unchecked):
+        (JSC::X86Assembler::emitModRm_opm):
+        (JSC::X86Assembler::emitModRm_opm_Unchecked):
+        (JSC::X86Assembler::emitModRm_opmsib):
+        * parser/Nodes.cpp:
+        (JSC::UnaryOpNode::emitBytecode):
+        (JSC::BinaryOpNode::emitBytecode):
+        (JSC::ReverseBinaryOpNode::emitBytecode):
+        (JSC::ThrowableBinaryOpNode::emitBytecode):
+        (JSC::emitReadModifyAssignment):
+        (JSC::ScopeNode::ScopeNode):
+        * parser/Nodes.h:
+        (JSC::UnaryPlusNode::):
+        (JSC::NegateNode::):
+        (JSC::BitwiseNotNode::):
+        (JSC::LogicalNotNode::):
+        (JSC::MultNode::):
+        (JSC::DivNode::):
+        (JSC::ModNode::):
+        (JSC::AddNode::):
+        (JSC::SubNode::):
+        (JSC::LeftShiftNode::):
+        (JSC::RightShiftNode::):
+        (JSC::UnsignedRightShiftNode::):
+        (JSC::LessNode::):
+        (JSC::GreaterNode::):
+        (JSC::LessEqNode::):
+        (JSC::GreaterEqNode::):
+        (JSC::InstanceOfNode::):
+        (JSC::InNode::):
+        (JSC::EqualNode::):
+        (JSC::NotEqualNode::):
+        (JSC::StrictEqualNode::):
+        (JSC::NotStrictEqualNode::):
+        (JSC::BitAndNode::):
+        (JSC::BitOrNode::):
+        (JSC::BitXOrNode::):
+        * runtime/StructureID.cpp:
+        (JSC::StructureID::fromDictionaryTransition):
+        * wtf/Platform.h:
+
+2008-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Renames:
+        
+        CodeGenerator => BytecodeGenerator
+        emitCodeForBlock => emitBytecodeForBlock
+        generatedByteCode => generatedBytecode
+        generateCode => generateBytecode
+
+        * JavaScriptCore.exp:
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::BytecodeGenerator::setDumpsGeneratedCode):
+        (JSC::BytecodeGenerator::generate):
+        (JSC::BytecodeGenerator::addVar):
+        (JSC::BytecodeGenerator::addGlobalVar):
+        (JSC::BytecodeGenerator::allocateConstants):
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::addParameter):
+        (JSC::BytecodeGenerator::registerFor):
+        (JSC::BytecodeGenerator::constRegisterFor):
+        (JSC::BytecodeGenerator::isLocal):
+        (JSC::BytecodeGenerator::isLocalConstant):
+        (JSC::BytecodeGenerator::newRegister):
+        (JSC::BytecodeGenerator::newTemporary):
+        (JSC::BytecodeGenerator::highestUsedRegister):
+        (JSC::BytecodeGenerator::newLabelScope):
+        (JSC::BytecodeGenerator::newLabel):
+        (JSC::BytecodeGenerator::emitLabel):
+        (JSC::BytecodeGenerator::emitBytecode):
+        (JSC::BytecodeGenerator::retrieveLastBinaryOp):
+        (JSC::BytecodeGenerator::retrieveLastUnaryOp):
+        (JSC::BytecodeGenerator::rewindBinaryOp):
+        (JSC::BytecodeGenerator::rewindUnaryOp):
+        (JSC::BytecodeGenerator::emitJump):
+        (JSC::BytecodeGenerator::emitJumpIfTrue):
+        (JSC::BytecodeGenerator::emitJumpIfFalse):
+        (JSC::BytecodeGenerator::addConstant):
+        (JSC::BytecodeGenerator::addUnexpectedConstant):
+        (JSC::BytecodeGenerator::addRegExp):
+        (JSC::BytecodeGenerator::emitMove):
+        (JSC::BytecodeGenerator::emitUnaryOp):
+        (JSC::BytecodeGenerator::emitPreInc):
+        (JSC::BytecodeGenerator::emitPreDec):
+        (JSC::BytecodeGenerator::emitPostInc):
+        (JSC::BytecodeGenerator::emitPostDec):
+        (JSC::BytecodeGenerator::emitBinaryOp):
+        (JSC::BytecodeGenerator::emitEqualityOp):
+        (JSC::BytecodeGenerator::emitLoad):
+        (JSC::BytecodeGenerator::emitUnexpectedLoad):
+        (JSC::BytecodeGenerator::findScopedProperty):
+        (JSC::BytecodeGenerator::emitInstanceOf):
+        (JSC::BytecodeGenerator::emitResolve):
+        (JSC::BytecodeGenerator::emitGetScopedVar):
+        (JSC::BytecodeGenerator::emitPutScopedVar):
+        (JSC::BytecodeGenerator::emitResolveBase):
+        (JSC::BytecodeGenerator::emitResolveWithBase):
+        (JSC::BytecodeGenerator::emitResolveFunction):
+        (JSC::BytecodeGenerator::emitGetById):
+        (JSC::BytecodeGenerator::emitPutById):
+        (JSC::BytecodeGenerator::emitPutGetter):
+        (JSC::BytecodeGenerator::emitPutSetter):
+        (JSC::BytecodeGenerator::emitDeleteById):
+        (JSC::BytecodeGenerator::emitGetByVal):
+        (JSC::BytecodeGenerator::emitPutByVal):
+        (JSC::BytecodeGenerator::emitDeleteByVal):
+        (JSC::BytecodeGenerator::emitPutByIndex):
+        (JSC::BytecodeGenerator::emitNewObject):
+        (JSC::BytecodeGenerator::emitNewArray):
+        (JSC::BytecodeGenerator::emitNewFunction):
+        (JSC::BytecodeGenerator::emitNewRegExp):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        (JSC::BytecodeGenerator::emitCall):
+        (JSC::BytecodeGenerator::emitCallEval):
+        (JSC::BytecodeGenerator::emitReturn):
+        (JSC::BytecodeGenerator::emitUnaryNoDstOp):
+        (JSC::BytecodeGenerator::emitConstruct):
+        (JSC::BytecodeGenerator::emitPushScope):
+        (JSC::BytecodeGenerator::emitPopScope):
+        (JSC::BytecodeGenerator::emitDebugHook):
+        (JSC::BytecodeGenerator::pushFinallyContext):
+        (JSC::BytecodeGenerator::popFinallyContext):
+        (JSC::BytecodeGenerator::breakTarget):
+        (JSC::BytecodeGenerator::continueTarget):
+        (JSC::BytecodeGenerator::emitComplexJumpScopes):
+        (JSC::BytecodeGenerator::emitJumpScopes):
+        (JSC::BytecodeGenerator::emitNextPropertyName):
+        (JSC::BytecodeGenerator::emitCatch):
+        (JSC::BytecodeGenerator::emitNewError):
+        (JSC::BytecodeGenerator::emitJumpSubroutine):
+        (JSC::BytecodeGenerator::emitSubroutineReturn):
+        (JSC::BytecodeGenerator::emitPushNewScope):
+        (JSC::BytecodeGenerator::beginSwitch):
+        (JSC::BytecodeGenerator::endSwitch):
+        (JSC::BytecodeGenerator::emitThrowExpressionTooDeepException):
+        * bytecompiler/CodeGenerator.h:
+        * jsc.cpp:
+        (runWithScripts):
+        * parser/Nodes.cpp:
+        (JSC::ThrowableExpressionData::emitThrowError):
+        (JSC::NullNode::emitBytecode):
+        (JSC::BooleanNode::emitBytecode):
+        (JSC::NumberNode::emitBytecode):
+        (JSC::StringNode::emitBytecode):
+        (JSC::RegExpNode::emitBytecode):
+        (JSC::ThisNode::emitBytecode):
+        (JSC::ResolveNode::isPure):
+        (JSC::ResolveNode::emitBytecode):
+        (JSC::ArrayNode::emitBytecode):
+        (JSC::ObjectLiteralNode::emitBytecode):
+        (JSC::PropertyListNode::emitBytecode):
+        (JSC::BracketAccessorNode::emitBytecode):
+        (JSC::DotAccessorNode::emitBytecode):
+        (JSC::ArgumentListNode::emitBytecode):
+        (JSC::NewExprNode::emitBytecode):
+        (JSC::EvalFunctionCallNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::FunctionCallBracketNode::emitBytecode):
+        (JSC::FunctionCallDotNode::emitBytecode):
+        (JSC::emitPreIncOrDec):
+        (JSC::emitPostIncOrDec):
+        (JSC::PostfixResolveNode::emitBytecode):
+        (JSC::PostfixBracketNode::emitBytecode):
+        (JSC::PostfixDotNode::emitBytecode):
+        (JSC::PostfixErrorNode::emitBytecode):
+        (JSC::DeleteResolveNode::emitBytecode):
+        (JSC::DeleteBracketNode::emitBytecode):
+        (JSC::DeleteDotNode::emitBytecode):
+        (JSC::DeleteValueNode::emitBytecode):
+        (JSC::VoidNode::emitBytecode):
+        (JSC::TypeOfResolveNode::emitBytecode):
+        (JSC::TypeOfValueNode::emitBytecode):
+        (JSC::PrefixResolveNode::emitBytecode):
+        (JSC::PrefixBracketNode::emitBytecode):
+        (JSC::PrefixDotNode::emitBytecode):
+        (JSC::PrefixErrorNode::emitBytecode):
+        (JSC::UnaryOpNode::emitBytecode):
+        (JSC::BinaryOpNode::emitBytecode):
+        (JSC::EqualNode::emitBytecode):
+        (JSC::StrictEqualNode::emitBytecode):
+        (JSC::ReverseBinaryOpNode::emitBytecode):
+        (JSC::ThrowableBinaryOpNode::emitBytecode):
+        (JSC::InstanceOfNode::emitBytecode):
+        (JSC::LogicalOpNode::emitBytecode):
+        (JSC::ConditionalNode::emitBytecode):
+        (JSC::emitReadModifyAssignment):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::AssignDotNode::emitBytecode):
+        (JSC::ReadModifyDotNode::emitBytecode):
+        (JSC::AssignErrorNode::emitBytecode):
+        (JSC::AssignBracketNode::emitBytecode):
+        (JSC::ReadModifyBracketNode::emitBytecode):
+        (JSC::CommaNode::emitBytecode):
+        (JSC::ConstDeclNode::emitCodeSingle):
+        (JSC::ConstDeclNode::emitBytecode):
+        (JSC::ConstStatementNode::emitBytecode):
+        (JSC::statementListEmitCode):
+        (JSC::BlockNode::emitBytecode):
+        (JSC::EmptyStatementNode::emitBytecode):
+        (JSC::DebuggerStatementNode::emitBytecode):
+        (JSC::ExprStatementNode::emitBytecode):
+        (JSC::VarStatementNode::emitBytecode):
+        (JSC::IfNode::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::CaseBlockNode::emitBytecodeForBlock):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        (JSC::EvalNode::emitBytecode):
+        (JSC::EvalNode::generateBytecode):
+        (JSC::FunctionBodyNode::generateBytecode):
+        (JSC::FunctionBodyNode::emitBytecode):
+        (JSC::ProgramNode::emitBytecode):
+        (JSC::ProgramNode::generateBytecode):
+        (JSC::FuncDeclNode::emitBytecode):
+        (JSC::FuncExprNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::ExpressionNode::):
+        (JSC::BooleanNode::):
+        (JSC::NumberNode::):
+        (JSC::StringNode::):
+        (JSC::ProgramNode::):
+        (JSC::EvalNode::):
+        (JSC::FunctionBodyNode::):
+        * runtime/Arguments.h:
+        (JSC::Arguments::getArgumentsData):
+        (JSC::JSActivation::copyRegisters):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::mark):
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::JSActivationData::JSActivationData):
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::~JSFunction):
+
+2008-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Renamed all forms of "byte code" "opcode" "op code" "code" "bitcode"
+        etc. to "bytecode".
+
+        * VM/CTI.cpp:
+        (JSC::CTI::printBytecodeOperandTypes):
+        (JSC::CTI::emitAllocateNumber):
+        (JSC::CTI::emitNakedCall):
+        (JSC::CTI::emitNakedFastCall):
+        (JSC::CTI::emitCTICall):
+        (JSC::CTI::emitJumpSlowCaseIfNotJSCell):
+        (JSC::CTI::emitJumpSlowCaseIfNotImmNum):
+        (JSC::CTI::emitJumpSlowCaseIfNotImmNums):
+        (JSC::CTI::emitFastArithIntToImmOrSlowCase):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        * VM/CTI.h:
+        (JSC::CallRecord::CallRecord):
+        (JSC::SwitchRecord::SwitchRecord):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::printStructureIDs):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::derefStructureIDs):
+        (JSC::CodeBlock::refStructureIDs):
+        * VM/CodeBlock.h:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        * VM/ExceptionHelpers.cpp:
+        (JSC::createNotAnObjectError):
+        * VM/Instruction.h:
+        (JSC::Instruction::Instruction):
+        (JSC::Instruction::):
+        * VM/Machine.cpp:
+        (JSC::BytecodeInterpreter::isBytecode):
+        (JSC::BytecodeInterpreter::throwException):
+        (JSC::BytecodeInterpreter::execute):
+        (JSC::BytecodeInterpreter::tryCachePutByID):
+        (JSC::BytecodeInterpreter::uncachePutByID):
+        (JSC::BytecodeInterpreter::tryCacheGetByID):
+        (JSC::BytecodeInterpreter::uncacheGetByID):
+        (JSC::BytecodeInterpreter::privateExecute):
+        (JSC::BytecodeInterpreter::tryCTICachePutByID):
+        (JSC::BytecodeInterpreter::tryCTICacheGetByID):
+        (JSC::BytecodeInterpreter::cti_op_call_JSFunction):
+        (JSC::BytecodeInterpreter::cti_vm_dontLazyLinkCall):
+        (JSC::BytecodeInterpreter::cti_vm_lazyLinkCall):
+        * VM/Machine.h:
+        (JSC::BytecodeInterpreter::getBytecode):
+        (JSC::BytecodeInterpreter::getBytecodeID):
+        (JSC::BytecodeInterpreter::isCallBytecode):
+        * VM/Opcode.cpp:
+        (JSC::):
+        (JSC::BytecodeStats::BytecodeStats):
+        (JSC::compareBytecodeIndices):
+        (JSC::compareBytecodePairIndices):
+        (JSC::BytecodeStats::~BytecodeStats):
+        (JSC::BytecodeStats::recordInstruction):
+        (JSC::BytecodeStats::resetLastInstruction):
+        * VM/Opcode.h:
+        (JSC::):
+        (JSC::padBytecodeName):
+        * VM/SamplingTool.cpp:
+        (JSC::ScopeSampleRecord::sample):
+        (JSC::SamplingTool::run):
+        (JSC::compareBytecodeIndicesSampling):
+        (JSC::SamplingTool::dump):
+        * VM/SamplingTool.h:
+        (JSC::ScopeSampleRecord::ScopeSampleRecord):
+        (JSC::SamplingTool::SamplingTool):
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::generate):
+        (JSC::CodeGenerator::CodeGenerator):
+        (JSC::CodeGenerator::emitLabel):
+        (JSC::CodeGenerator::emitBytecode):
+        (JSC::CodeGenerator::emitJump):
+        (JSC::CodeGenerator::emitJumpIfTrue):
+        (JSC::CodeGenerator::emitJumpIfFalse):
+        (JSC::CodeGenerator::emitMove):
+        (JSC::CodeGenerator::emitUnaryOp):
+        (JSC::CodeGenerator::emitPreInc):
+        (JSC::CodeGenerator::emitPreDec):
+        (JSC::CodeGenerator::emitPostInc):
+        (JSC::CodeGenerator::emitPostDec):
+        (JSC::CodeGenerator::emitBinaryOp):
+        (JSC::CodeGenerator::emitEqualityOp):
+        (JSC::CodeGenerator::emitUnexpectedLoad):
+        (JSC::CodeGenerator::emitInstanceOf):
+        (JSC::CodeGenerator::emitResolve):
+        (JSC::CodeGenerator::emitGetScopedVar):
+        (JSC::CodeGenerator::emitPutScopedVar):
+        (JSC::CodeGenerator::emitResolveBase):
+        (JSC::CodeGenerator::emitResolveWithBase):
+        (JSC::CodeGenerator::emitResolveFunction):
+        (JSC::CodeGenerator::emitGetById):
+        (JSC::CodeGenerator::emitPutById):
+        (JSC::CodeGenerator::emitPutGetter):
+        (JSC::CodeGenerator::emitPutSetter):
+        (JSC::CodeGenerator::emitDeleteById):
+        (JSC::CodeGenerator::emitGetByVal):
+        (JSC::CodeGenerator::emitPutByVal):
+        (JSC::CodeGenerator::emitDeleteByVal):
+        (JSC::CodeGenerator::emitPutByIndex):
+        (JSC::CodeGenerator::emitNewObject):
+        (JSC::CodeGenerator::emitNewArray):
+        (JSC::CodeGenerator::emitNewFunction):
+        (JSC::CodeGenerator::emitNewRegExp):
+        (JSC::CodeGenerator::emitNewFunctionExpression):
+        (JSC::CodeGenerator::emitCall):
+        (JSC::CodeGenerator::emitReturn):
+        (JSC::CodeGenerator::emitUnaryNoDstOp):
+        (JSC::CodeGenerator::emitConstruct):
+        (JSC::CodeGenerator::emitPopScope):
+        (JSC::CodeGenerator::emitDebugHook):
+        (JSC::CodeGenerator::emitComplexJumpScopes):
+        (JSC::CodeGenerator::emitJumpScopes):
+        (JSC::CodeGenerator::emitNextPropertyName):
+        (JSC::CodeGenerator::emitCatch):
+        (JSC::CodeGenerator::emitNewError):
+        (JSC::CodeGenerator::emitJumpSubroutine):
+        (JSC::CodeGenerator::emitSubroutineReturn):
+        (JSC::CodeGenerator::emitPushNewScope):
+        (JSC::CodeGenerator::beginSwitch):
+        (JSC::CodeGenerator::endSwitch):
+        * bytecompiler/CodeGenerator.h:
+        (JSC::CodeGenerator::emitNode):
+        * jsc.cpp:
+        (runWithScripts):
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::emitModRm_opr):
+        (JSC::X86Assembler::emitModRm_opr_Unchecked):
+        (JSC::X86Assembler::emitModRm_opm):
+        (JSC::X86Assembler::emitModRm_opm_Unchecked):
+        (JSC::X86Assembler::emitModRm_opmsib):
+        * parser/Nodes.cpp:
+        (JSC::NullNode::emitBytecode):
+        (JSC::BooleanNode::emitBytecode):
+        (JSC::NumberNode::emitBytecode):
+        (JSC::StringNode::emitBytecode):
+        (JSC::RegExpNode::emitBytecode):
+        (JSC::ThisNode::emitBytecode):
+        (JSC::ResolveNode::emitBytecode):
+        (JSC::ArrayNode::emitBytecode):
+        (JSC::ObjectLiteralNode::emitBytecode):
+        (JSC::PropertyListNode::emitBytecode):
+        (JSC::BracketAccessorNode::emitBytecode):
+        (JSC::DotAccessorNode::emitBytecode):
+        (JSC::ArgumentListNode::emitBytecode):
+        (JSC::NewExprNode::emitBytecode):
+        (JSC::EvalFunctionCallNode::emitBytecode):
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::FunctionCallBracketNode::emitBytecode):
+        (JSC::FunctionCallDotNode::emitBytecode):
+        (JSC::PostfixResolveNode::emitBytecode):
+        (JSC::PostfixBracketNode::emitBytecode):
+        (JSC::PostfixDotNode::emitBytecode):
+        (JSC::PostfixErrorNode::emitBytecode):
+        (JSC::DeleteResolveNode::emitBytecode):
+        (JSC::DeleteBracketNode::emitBytecode):
+        (JSC::DeleteDotNode::emitBytecode):
+        (JSC::DeleteValueNode::emitBytecode):
+        (JSC::VoidNode::emitBytecode):
+        (JSC::TypeOfResolveNode::emitBytecode):
+        (JSC::TypeOfValueNode::emitBytecode):
+        (JSC::PrefixResolveNode::emitBytecode):
+        (JSC::PrefixBracketNode::emitBytecode):
+        (JSC::PrefixDotNode::emitBytecode):
+        (JSC::PrefixErrorNode::emitBytecode):
+        (JSC::UnaryOpNode::emitBytecode):
+        (JSC::BinaryOpNode::emitBytecode):
+        (JSC::EqualNode::emitBytecode):
+        (JSC::StrictEqualNode::emitBytecode):
+        (JSC::ReverseBinaryOpNode::emitBytecode):
+        (JSC::ThrowableBinaryOpNode::emitBytecode):
+        (JSC::InstanceOfNode::emitBytecode):
+        (JSC::LogicalOpNode::emitBytecode):
+        (JSC::ConditionalNode::emitBytecode):
+        (JSC::emitReadModifyAssignment):
+        (JSC::ReadModifyResolveNode::emitBytecode):
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::AssignDotNode::emitBytecode):
+        (JSC::ReadModifyDotNode::emitBytecode):
+        (JSC::AssignErrorNode::emitBytecode):
+        (JSC::AssignBracketNode::emitBytecode):
+        (JSC::ReadModifyBracketNode::emitBytecode):
+        (JSC::CommaNode::emitBytecode):
+        (JSC::ConstDeclNode::emitBytecode):
+        (JSC::ConstStatementNode::emitBytecode):
+        (JSC::BlockNode::emitBytecode):
+        (JSC::EmptyStatementNode::emitBytecode):
+        (JSC::DebuggerStatementNode::emitBytecode):
+        (JSC::ExprStatementNode::emitBytecode):
+        (JSC::VarStatementNode::emitBytecode):
+        (JSC::IfNode::emitBytecode):
+        (JSC::IfElseNode::emitBytecode):
+        (JSC::DoWhileNode::emitBytecode):
+        (JSC::WhileNode::emitBytecode):
+        (JSC::ForNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        (JSC::ContinueNode::emitBytecode):
+        (JSC::BreakNode::emitBytecode):
+        (JSC::ReturnNode::emitBytecode):
+        (JSC::WithNode::emitBytecode):
+        (JSC::SwitchNode::emitBytecode):
+        (JSC::LabelNode::emitBytecode):
+        (JSC::ThrowNode::emitBytecode):
+        (JSC::TryNode::emitBytecode):
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::EvalNode::emitBytecode):
+        (JSC::FunctionBodyNode::emitBytecode):
+        (JSC::ProgramNode::emitBytecode):
+        (JSC::FuncDeclNode::emitBytecode):
+        (JSC::FuncExprNode::emitBytecode):
+        * parser/Nodes.h:
+        (JSC::UnaryPlusNode::):
+        (JSC::NegateNode::):
+        (JSC::BitwiseNotNode::):
+        (JSC::LogicalNotNode::):
+        (JSC::MultNode::):
+        (JSC::DivNode::):
+        (JSC::ModNode::):
+        (JSC::AddNode::):
+        (JSC::SubNode::):
+        (JSC::LeftShiftNode::):
+        (JSC::RightShiftNode::):
+        (JSC::UnsignedRightShiftNode::):
+        (JSC::LessNode::):
+        (JSC::GreaterNode::):
+        (JSC::LessEqNode::):
+        (JSC::GreaterEqNode::):
+        (JSC::InstanceOfNode::):
+        (JSC::InNode::):
+        (JSC::EqualNode::):
+        (JSC::NotEqualNode::):
+        (JSC::StrictEqualNode::):
+        (JSC::NotStrictEqualNode::):
+        (JSC::BitAndNode::):
+        (JSC::BitOrNode::):
+        (JSC::BitXOrNode::):
+        (JSC::ProgramNode::):
+        (JSC::EvalNode::):
+        (JSC::FunctionBodyNode::):
+        * runtime/JSNotAnObject.h:
+        * runtime/StructureID.cpp:
+        (JSC::StructureID::fromDictionaryTransition):
+        * wtf/Platform.h:
+
+2008-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Renamed Machine to BytecodeInterpreter.
+        
+        Nixed the Interpreter class, and changed its two functions to stand-alone
+        functions.
+
+        * JavaScriptCore.exp:
+        * VM/CTI.cpp:
+        (JSC::):
+        (JSC::CTI::emitCTICall):
+        (JSC::CTI::CTI):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        (JSC::CTI::privateCompileCTIMachineTrampolines):
+        (JSC::CTI::freeCTIMachineTrampolines):
+        (JSC::CTI::patchGetByIdSelf):
+        (JSC::CTI::patchPutByIdReplace):
+        (JSC::CTI::privateCompilePatchGetArrayLength):
+        (JSC::CTI::compileRegExp):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::printStructureIDs):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructureIDs):
+        (JSC::CodeBlock::refStructureIDs):
+        * VM/ExceptionHelpers.cpp:
+        (JSC::createNotAnObjectError):
+        * VM/Machine.cpp:
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::BytecodeInterpreter::resolve):
+        (JSC::BytecodeInterpreter::resolveSkip):
+        (JSC::BytecodeInterpreter::resolveGlobal):
+        (JSC::BytecodeInterpreter::resolveBase):
+        (JSC::BytecodeInterpreter::resolveBaseAndProperty):
+        (JSC::BytecodeInterpreter::resolveBaseAndFunc):
+        (JSC::BytecodeInterpreter::slideRegisterWindowForCall):
+        (JSC::BytecodeInterpreter::callEval):
+        (JSC::BytecodeInterpreter::BytecodeInterpreter):
+        (JSC::BytecodeInterpreter::initialize):
+        (JSC::BytecodeInterpreter::~BytecodeInterpreter):
+        (JSC::BytecodeInterpreter::dumpCallFrame):
+        (JSC::BytecodeInterpreter::dumpRegisters):
+        (JSC::BytecodeInterpreter::isOpcode):
+        (JSC::BytecodeInterpreter::unwindCallFrame):
+        (JSC::BytecodeInterpreter::throwException):
+        (JSC::BytecodeInterpreter::execute):
+        (JSC::BytecodeInterpreter::debug):
+        (JSC::BytecodeInterpreter::resetTimeoutCheck):
+        (JSC::BytecodeInterpreter::checkTimeout):
+        (JSC::BytecodeInterpreter::createExceptionScope):
+        (JSC::BytecodeInterpreter::tryCachePutByID):
+        (JSC::BytecodeInterpreter::uncachePutByID):
+        (JSC::BytecodeInterpreter::tryCacheGetByID):
+        (JSC::BytecodeInterpreter::uncacheGetByID):
+        (JSC::BytecodeInterpreter::privateExecute):
+        (JSC::BytecodeInterpreter::retrieveArguments):
+        (JSC::BytecodeInterpreter::retrieveCaller):
+        (JSC::BytecodeInterpreter::retrieveLastCaller):
+        (JSC::BytecodeInterpreter::findFunctionCallFrame):
+        (JSC::BytecodeInterpreter::tryCTICachePutByID):
+        (JSC::BytecodeInterpreter::tryCTICacheGetByID):
+        (JSC::BytecodeInterpreter::cti_op_convert_this):
+        (JSC::BytecodeInterpreter::cti_op_end):
+        (JSC::BytecodeInterpreter::cti_op_add):
+        (JSC::BytecodeInterpreter::cti_op_pre_inc):
+        (JSC::BytecodeInterpreter::cti_timeout_check):
+        (JSC::BytecodeInterpreter::cti_register_file_check):
+        (JSC::BytecodeInterpreter::cti_op_loop_if_less):
+        (JSC::BytecodeInterpreter::cti_op_loop_if_lesseq):
+        (JSC::BytecodeInterpreter::cti_op_new_object):
+        (JSC::BytecodeInterpreter::cti_op_put_by_id):
+        (JSC::BytecodeInterpreter::cti_op_put_by_id_second):
+        (JSC::BytecodeInterpreter::cti_op_put_by_id_generic):
+        (JSC::BytecodeInterpreter::cti_op_put_by_id_fail):
+        (JSC::BytecodeInterpreter::cti_op_get_by_id):
+        (JSC::BytecodeInterpreter::cti_op_get_by_id_second):
+        (JSC::BytecodeInterpreter::cti_op_get_by_id_generic):
+        (JSC::BytecodeInterpreter::cti_op_get_by_id_fail):
+        (JSC::BytecodeInterpreter::cti_op_instanceof):
+        (JSC::BytecodeInterpreter::cti_op_del_by_id):
+        (JSC::BytecodeInterpreter::cti_op_mul):
+        (JSC::BytecodeInterpreter::cti_op_new_func):
+        (JSC::BytecodeInterpreter::cti_op_call_JSFunction):
+        (JSC::BytecodeInterpreter::cti_op_call_arityCheck):
+        (JSC::BytecodeInterpreter::cti_vm_dontLazyLinkCall):
+        (JSC::BytecodeInterpreter::cti_vm_lazyLinkCall):
+        (JSC::BytecodeInterpreter::cti_op_push_activation):
+        (JSC::BytecodeInterpreter::cti_op_call_NotJSFunction):
+        (JSC::BytecodeInterpreter::cti_op_create_arguments):
+        (JSC::BytecodeInterpreter::cti_op_create_arguments_no_params):
+        (JSC::BytecodeInterpreter::cti_op_tear_off_activation):
+        (JSC::BytecodeInterpreter::cti_op_tear_off_arguments):
+        (JSC::BytecodeInterpreter::cti_op_profile_will_call):
+        (JSC::BytecodeInterpreter::cti_op_profile_did_call):
+        (JSC::BytecodeInterpreter::cti_op_ret_scopeChain):
+        (JSC::BytecodeInterpreter::cti_op_new_array):
+        (JSC::BytecodeInterpreter::cti_op_resolve):
+        (JSC::BytecodeInterpreter::cti_op_construct_JSConstruct):
+        (JSC::BytecodeInterpreter::cti_op_construct_NotJSConstruct):
+        (JSC::BytecodeInterpreter::cti_op_get_by_val):
+        (JSC::BytecodeInterpreter::cti_op_resolve_func):
+        (JSC::BytecodeInterpreter::cti_op_sub):
+        (JSC::BytecodeInterpreter::cti_op_put_by_val):
+        (JSC::BytecodeInterpreter::cti_op_put_by_val_array):
+        (JSC::BytecodeInterpreter::cti_op_lesseq):
+        (JSC::BytecodeInterpreter::cti_op_loop_if_true):
+        (JSC::BytecodeInterpreter::cti_op_negate):
+        (JSC::BytecodeInterpreter::cti_op_resolve_base):
+        (JSC::BytecodeInterpreter::cti_op_resolve_skip):
+        (JSC::BytecodeInterpreter::cti_op_resolve_global):
+        (JSC::BytecodeInterpreter::cti_op_div):
+        (JSC::BytecodeInterpreter::cti_op_pre_dec):
+        (JSC::BytecodeInterpreter::cti_op_jless):
+        (JSC::BytecodeInterpreter::cti_op_not):
+        (JSC::BytecodeInterpreter::cti_op_jtrue):
+        (JSC::BytecodeInterpreter::cti_op_post_inc):
+        (JSC::BytecodeInterpreter::cti_op_eq):
+        (JSC::BytecodeInterpreter::cti_op_lshift):
+        (JSC::BytecodeInterpreter::cti_op_bitand):
+        (JSC::BytecodeInterpreter::cti_op_rshift):
+        (JSC::BytecodeInterpreter::cti_op_bitnot):
+        (JSC::BytecodeInterpreter::cti_op_resolve_with_base):
+        (JSC::BytecodeInterpreter::cti_op_new_func_exp):
+        (JSC::BytecodeInterpreter::cti_op_mod):
+        (JSC::BytecodeInterpreter::cti_op_less):
+        (JSC::BytecodeInterpreter::cti_op_neq):
+        (JSC::BytecodeInterpreter::cti_op_post_dec):
+        (JSC::BytecodeInterpreter::cti_op_urshift):
+        (JSC::BytecodeInterpreter::cti_op_bitxor):
+        (JSC::BytecodeInterpreter::cti_op_new_regexp):
+        (JSC::BytecodeInterpreter::cti_op_bitor):
+        (JSC::BytecodeInterpreter::cti_op_call_eval):
+        (JSC::BytecodeInterpreter::cti_op_throw):
+        (JSC::BytecodeInterpreter::cti_op_get_pnames):
+        (JSC::BytecodeInterpreter::cti_op_next_pname):
+        (JSC::BytecodeInterpreter::cti_op_push_scope):
+        (JSC::BytecodeInterpreter::cti_op_pop_scope):
+        (JSC::BytecodeInterpreter::cti_op_typeof):
+        (JSC::BytecodeInterpreter::cti_op_is_undefined):
+        (JSC::BytecodeInterpreter::cti_op_is_boolean):
+        (JSC::BytecodeInterpreter::cti_op_is_number):
+        (JSC::BytecodeInterpreter::cti_op_is_string):
+        (JSC::BytecodeInterpreter::cti_op_is_object):
+        (JSC::BytecodeInterpreter::cti_op_is_function):
+        (JSC::BytecodeInterpreter::cti_op_stricteq):
+        (JSC::BytecodeInterpreter::cti_op_nstricteq):
+        (JSC::BytecodeInterpreter::cti_op_to_jsnumber):
+        (JSC::BytecodeInterpreter::cti_op_in):
+        (JSC::BytecodeInterpreter::cti_op_push_new_scope):
+        (JSC::BytecodeInterpreter::cti_op_jmp_scopes):
+        (JSC::BytecodeInterpreter::cti_op_put_by_index):
+        (JSC::BytecodeInterpreter::cti_op_switch_imm):
+        (JSC::BytecodeInterpreter::cti_op_switch_char):
+        (JSC::BytecodeInterpreter::cti_op_switch_string):
+        (JSC::BytecodeInterpreter::cti_op_del_by_val):
+        (JSC::BytecodeInterpreter::cti_op_put_getter):
+        (JSC::BytecodeInterpreter::cti_op_put_setter):
+        (JSC::BytecodeInterpreter::cti_op_new_error):
+        (JSC::BytecodeInterpreter::cti_op_debug):
+        (JSC::BytecodeInterpreter::cti_vm_throw):
+        * VM/Machine.h:
+        * VM/Register.h:
+        * VM/SamplingTool.cpp:
+        (JSC::SamplingTool::run):
+        * VM/SamplingTool.h:
+        (JSC::SamplingTool::SamplingTool):
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::generate):
+        (JSC::CodeGenerator::CodeGenerator):
+        (JSC::CodeGenerator::emitOpcode):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * jsc.cpp:
+        (runWithScripts):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart):
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncPop):
+        (JSC::arrayProtoFuncPush):
+        * runtime/Collector.cpp:
+        (JSC::Heap::collect):
+        * runtime/ExecState.h:
+        (JSC::ExecState::interpreter):
+        * runtime/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncApply):
+        * runtime/Interpreter.cpp:
+        (JSC::Interpreter::evaluate):
+        * runtime/JSCell.h:
+        * runtime/JSFunction.cpp:
+        (JSC::JSFunction::call):
+        (JSC::JSFunction::argumentsGetter):
+        (JSC::JSFunction::callerGetter):
+        (JSC::JSFunction::construct):
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::~JSGlobalObject):
+        (JSC::JSGlobalObject::setTimeoutTime):
+        (JSC::JSGlobalObject::startTimeoutCheck):
+        (JSC::JSGlobalObject::stopTimeoutCheck):
+        (JSC::JSGlobalObject::mark):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSString.h:
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+
+2008-11-15  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        - Remove SymbolTable from FunctionBodyNode and move it to CodeBlock
+        
+        It's not needed for functions that have never been executed, so no
+        need to waste the memory. Saves ~4M on membuster after 30 pages.
+
+        * VM/CodeBlock.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::retrieveArguments):
+        * parser/Nodes.cpp:
+        (JSC::EvalNode::generateCode):
+        (JSC::FunctionBodyNode::generateCode):
+        * parser/Nodes.h:
+        * runtime/JSActivation.h:
+        (JSC::JSActivation::JSActivationData::JSActivationData):
+
+2008-11-14  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 22259: Make all opcodes use eax as their final result register
+        <https://bugs.webkit.org/show_bug.cgi?id=22259>
+
+        Change one case of op_add (and the corresponding slow case) to use eax
+        rather than edx. Also, change the order in which the two results of
+        resolve_func and resolve_base are emitted so that the retrieved value is
+        put last into eax.
+
+        This gives no performance change on SunSpider or the V8 benchmark suite
+        when run in either harness.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+
+2008-11-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Geoff has this wacky notion that emitGetArg and emitPutArg should be related to
+        doing the same thing.  Crazy.
+        
+        Rename the methods for accessing virtual registers to say 'VirtualRegister' in the
+        name, and those for setting up the arguments for CTI methods to contain 'CTIArg'.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetVirtualRegister):
+        (JSC::CTI::emitGetVirtualRegisters):
+        (JSC::CTI::emitPutCTIArgFromVirtualRegister):
+        (JSC::CTI::emitPutCTIArg):
+        (JSC::CTI::emitGetCTIArg):
+        (JSC::CTI::emitPutCTIArgConstant):
+        (JSC::CTI::emitPutVirtualRegister):
+        (JSC::CTI::compileOpCallSetupArgs):
+        (JSC::CTI::compileOpCallEvalSetupArgs):
+        (JSC::CTI::compileOpConstructSetupArgs):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::compileOpStrictEq):
+        (JSC::CTI::putDoubleResultToJSNumberCellOrJSImmediate):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompileCTIMachineTrampolines):
+        * VM/CTI.h:
+
+2008-11-14  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Antti Koivisto
+
+        Fix potential build break by adding StdLibExtras.h
+        
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2008-11-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Generate less code for the slow cases of op_call and op_construct.
+        https://bugs.webkit.org/show_bug.cgi?id=22272
+
+        1% progression on v8 tests.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitRetrieveArg):
+        (JSC::CTI::emitNakedCall):
+        (JSC::CTI::compileOpCallInitializeCallFrame):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompileCTIMachineTrampolines):
+        * VM/CTI.h:
+        * VM/CodeBlock.h:
+        (JSC::getCallLinkInfoReturnLocation):
+        (JSC::CodeBlock::getCallLinkInfo):
+        * VM/Machine.cpp:
+        (JSC::Machine::Machine):
+        (JSC::Machine::cti_vm_dontLazyLinkCall):
+        (JSC::Machine::cti_vm_lazyLinkCall):
+        * VM/Machine.h:
+
+2008-11-14  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Darin Alder.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21810
+        Remove use of static C++ objects that are destroyed at exit time (destructors)
+
+        Create DEFINE_STATIC_LOCAL macro. Change static local objects to leak to avoid 
+        exit-time destructor. Update code that was changed to fix this issue that ran 
+        into a gcc bug (<rdar://problem/6354696> Codegen issue with C++ static reference 
+        in gcc build 5465). Also typdefs for template types needed to be added in some 
+        cases so the type could make it through the macro successfully.
+
+        Basically code of the form:
+        static T m;
+        becomes:
+        DEFINE_STATIC_LOCAL(T, m, ());
+
+        Also any code of the form:
+        static T& m = *new T;
+        also becomes:
+        DEFINE_STATIC_LOCAL(T, m, ());
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/MainThread.cpp:
+        (WTF::mainThreadFunctionQueueMutex):
+        (WTF::functionQueue):
+        * wtf/StdLibExtras.h: Added. Add DEFINE_STATIC_LOCAL macro
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::threadMapMutex):
+        (WTF::threadMap):
+        (WTF::identifierByPthreadHandle):
+
+2008-11-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22269
+        Reduce PropertyMap usage
+
+        From observation of StructureID statistics, it became clear that many
+        StructureID's were not being used as StructureIDs themselves, but rather
+        only being necessary as links in the transition chain.  Acknowledging this
+        and that PropertyMaps stored in StructureIDs can be treated as caches, that
+        is that they can be reconstructed on demand, it became clear that we could
+        reduce the memory consumption of StructureIDs by only keeping PropertyMaps
+        for the StructureIDs that need them the most.
+
+        The specific strategy used to reduce the number of StructureIDs with
+        PropertyMaps is to take the previous StructureIDs PropertyMap when initially
+        transitioning (addPropertyTransition) from it and clearing out the pointer 
+        in the process.  The next time we need to do the same transition, for instance
+        repeated calls to the same constructor, we use the new addPropertyTransitionToExistingStructure
+        first, which allows us not to need the PropertyMap to determine if the property
+        exists already, since a transition to that property would require it not already
+        be present in the StructureID.  Should there be no transition, the PropertyMap
+        can be constructed on demand (via materializePropertyMap) to determine if the put is a 
+        replace or a transition to a new StructureID.
+
+        Reduces memory use on Membuster head test (30 pages open) by ~15MB.
+
+        * JavaScriptCore.exp:
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirect): First use addPropertyTransitionToExistingStructure
+        so that we can avoid building the PropertyMap on subsequent similar object
+        creations.
+        * runtime/PropertyMapHashTable.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry): Add version of constructor which takes
+        all values to be used when lazily building the PropertyMap. 
+        * runtime/StructureID.cpp:
+        (JSC::StructureID::dumpStatistics): Add statistics on the number of StructureIDs
+        with PropertyMaps.
+        (JSC::StructureID::StructureID): Rename m_cachedTransistionOffset to m_offset
+        (JSC::isPowerOf2):
+        (JSC::nextPowerOf2):
+        (JSC::sizeForKeyCount): Returns the expected size of a PropertyMap for a key count.
+        (JSC::StructureID::materializePropertyMap): Builds the PropertyMap out of its previous pointer chain.
+        (JSC::StructureID::addPropertyTransitionToExistingStructure): Only transitions if there is a
+        an existing transition.
+        (JSC::StructureID::addPropertyTransition): Instead of always copying the ProperyMap, try and take
+        it from it previous pointer.
+        (JSC::StructureID::removePropertyTransition): Simplify by calling toDictionaryTransition() to do
+        transition work.
+        (JSC::StructureID::changePrototypeTransition): Build the PropertyMap if necessary before transitioning
+        because once you have transitioned, you will not be able to reconstruct it afterwards as there is no
+        previous pointer, pinning the ProperyMap as well.
+        (JSC::StructureID::getterSetterTransition): Ditto.
+        (JSC::StructureID::toDictionaryTransition): Pin the PropertyMap so that it is not destroyed on further transitions.
+        (JSC::StructureID::fromDictionaryTransition): We can only transition back from a dictionary transition if there
+        are no deleted offsets.
+        (JSC::StructureID::addPropertyWithoutTransition): Build PropertyMap on demands and pin.
+        (JSC::StructureID::removePropertyWithoutTransition): Ditto.
+        (JSC::StructureID::get): Build on demand.
+        (JSC::StructureID::createPropertyMapHashTable): Add version of create that takes a size
+        for on demand building.
+        (JSC::StructureID::expandPropertyMapHashTable):
+        (JSC::StructureID::rehashPropertyMapHashTable):
+        (JSC::StructureID::getEnumerablePropertyNamesInternal): Build PropertyMap on demand.
+        * runtime/StructureID.h:
+        (JSC::StructureID::propertyStorageSize): Account for StructureIDs without PropertyMaps.
+        (JSC::StructureID::isEmpty): Ditto.
+        (JSC::StructureID::materializePropertyMapIfNecessary):
+        (JSC::StructureID::get): Build PropertyMap on demand
+
+2008-11-14  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Simon Hausmann.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=21500>
+
+        JavaScriptCore build with -O3 flag instead of -O2 (gcc).
+        2.02% speedup on SunSpider (Qt-port on Linux)
+        1.10% speedup on V8 (Qt-port on Linux)
+        3.45% speedup on WindScorpion (Qt-port on Linux)
+
+        * JavaScriptCore.pri:
+
+2008-11-14  Kristian Amlie  <kristian.amlie@trolltech.com>
+
+        Reviewed by Darin Adler.
+
+        Compile fix for RVCT.
+
+        In reality, it is two fixes:
+
+        1. Remove typename. I believe typename can only be used when the named
+        type depends on the template parameters, which it doesn't in this
+        case, so I think this is more correct.
+        2. Replace ::iterator scope with specialized typedef. This is to work
+        around a bug in RVCT.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22260
+
+        * wtf/ListHashSet.h:
+        (WTF::::find):
+
+2008-11-14  Kristian Amlie  <kristian.amlie@trolltech.com>
+
+        Reviewed by Darin Adler.
+
+        Compile fix for WINSCW.
+
+        This fix doesn't protect against implicit conversions from bool to
+        integers, but most likely that will be caught on another platform.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22260
+
+        * wtf/PassRefPtr.h:
+        (WTF::PassRefPtr::operator bool):
+        * wtf/RefPtr.h:
+        (WTF::RefPtr::operator bool):
+
+2008-11-14  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 22245: Move wtf/dtoa.h into the WTF namespace
+        <https://bugs.webkit.org/show_bug.cgi?id=22245>
+
+        Move wtf/dtoa.h into the WTF namespace from the JSC namespace. This
+        introduces some ambiguities in name lookups, so I changed all uses of
+        the functions in wtf/dtoa.h to explicitly state the namespace.
+
+        * JavaScriptCore.exp:
+        * parser/Lexer.cpp:
+        (JSC::Lexer::lex):
+        * runtime/InitializeThreading.cpp:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::parseInt):
+        * runtime/NumberPrototype.cpp:
+        (JSC::integerPartNoExp):
+        (JSC::numberProtoFuncToExponential):
+        * runtime/UString.cpp:
+        (JSC::concatenate):
+        (JSC::UString::from):
+        (JSC::UString::toDouble):
+        * wtf/dtoa.cpp:
+        * wtf/dtoa.h:
+
+2008-11-14  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 22257: Enable redundant read optimizations for results generated by compileBinaryArithOp()
+        <https://bugs.webkit.org/show_bug.cgi?id=22257>
+
+        This shows no change in performance on either SunSpider or the V8
+        benchmark suite, but it removes an ugly special case and allows for
+        future optimizations to be implemented in a cleaner fashion.
+
+        This patch was essentially given to me by Gavin Barraclough upon my
+        request, but I did regression and performance testing so that he could
+        work on something else.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::putDoubleResultToJSNumberCellOrJSImmediate): Move the final
+        result to eax if it is not already there.
+        (JSC::CTI::compileBinaryArithOp): Remove the killing of the final result
+        register that disables the optimization.
+
+2008-11-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Add a Scons-based build system for building
+        the Chromium-Mac build of JavaScriptCore.
+        https://bugs.webkit.org/show_bug.cgi?id=21991
+
+        * JavaScriptCore.scons: Added.
+        * SConstruct: Added.
+
+2008-11-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Roben.
+        
+        Add PLATFORM(CHROMIUM) to the "we don't use cairo" blacklist
+        until https://bugs.webkit.org/show_bug.cgi?id=22250 is fixed.
+
+        * wtf/Platform.h:
+
+2008-11-13  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        In r38375 the 'jsc' shell was changed to improve teardown on quit. The
+        main() function in jsc.cpp uses Structured Exception Handling, so Visual
+        C++ emits a warning when destructors are used.
+        
+        In order to speculatively fix the Windows build, this patch changes that
+        code to use explicit pointer manipulation and locking rather than smart
+        pointers and RAII.
+
+        * jsc.cpp:
+        (main):
+
+2008-11-13  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 22246: Get arguments for opcodes together to eliminate more redundant memory reads
+        <https://bugs.webkit.org/show_bug.cgi?id=22246>
+
+        It is common for opcodes to read their first operand into eax and their
+        second operand into edx. If the value intended for the second operand is
+        in eax, we should first move eax to the register for the second operand
+        and then read the first operand into eax.
+
+        This is a 0.5% speedup on SunSpider and a 2.0% speedup on the V8
+        benchmark suite when measured using the V8 harness.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetArgs):
+        (JSC::CTI::compileOpStrictEq):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+
+2008-11-13  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 22238: Avoid unnecessary reads of temporaries when the target machine register is not eax
+        <https://bugs.webkit.org/show_bug.cgi?id=22238>
+
+        Enable the optimization of not reading a value back from memory that we
+        just wrote when the target machine register is not eax. In order to do
+        this, the code generation for op_put_global_var must be changed to
+        read its argument into a register before overwriting eax.
+
+        This is a 0.5% speedup on SunSpider and shows no change on the V8
+        benchmark suite when run in either harness.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::privateCompileMainPass):
+
+2008-11-13  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Perform teardown in the 'jsc' shell in order to suppress annoying and
+        misleading leak messages. There is still a lone JSC::Node leaking when
+        quit() is called, but hopefully that can be fixed as well.
+
+        * jsc.cpp:
+        (functionQuit):
+        (main):
+
+2008-11-13  Mike Pinkerton  <pinkerton@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22087
+        Need correct platform defines for Mac Chromium
+
+        Set the appropriate platform defines for Mac Chromium, which is
+        similar to PLATFORM(MAC), but isn't.
+
+        * wtf/Platform.h:
+
+2008-11-13  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - remove immediate checks from native codegen for known non-immediate cases like "this"
+        
+        ~.5% speedup on v8 benchmarks
+        
+        In the future we can extend this model to remove all sorts of
+        typechecks based on local type info or type inference.
+        
+        I also added an assertion to verify that all slow cases linked as
+        many slow case jumps as the corresponding fast case generated, and
+        fixed the pre-existing cases where this was not true.
+        
+        * VM/CTI.cpp:
+        (JSC::CTI::emitJumpSlowCaseIfNotJSCell):
+        (JSC::CTI::linkSlowCaseIfNotJSCell):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+        * VM/CodeBlock.h:
+        (JSC::CodeBlock::isKnownNotImmediate):
+
+2008-11-13  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21943: Avoid needless reads of temporary values in CTI code
+        <https://bugs.webkit.org/show_bug.cgi?id=21943>
+
+        If an opcode needs to load a virtual register and a previous opcode left
+        the contents of that virtual register in a machine register, use the
+        value in the machine register rather than getting it from memory.
+
+        In order to perform this optimization, it is necessary to know the
+        jump tagets in the CodeBlock. For temporaries, the only problematic
+        jump targets are binary logical operators and the ternary conditional
+        operator. However, if this optimization were to be extended to local 
+        variable registers as well, other jump targets would need to be
+        included, like switch statement cases and the beginnings of catch
+        blocks.
+
+        This optimization also requires that the fast case and the slow case
+        of an opcode use emitPutResult() on the same register, which was chosen
+        to be eax, as that is the register into which we read the first operand
+        of opcodes. In order to make this the case, we needed to add some mov
+        instructions to the slow cases of some instructions.
+
+        This optimizaton is not applied whenever compileBinaryArithOp() is used
+        to compile an opcode, because different machine registers may be used to
+        store the final result. It seems possible to rewrite the code generation
+        in compileBinaryArithOp() to allow for this optimization.
+
+        This optimization is also not applied when generating slow cases,
+        because some fast cases overwrite the value of eax before jumping to the
+        slow case. In the future, it may be possible to apply this optimization
+        to slow cases as well, but it did not seem to be a speedup when testing
+        an early version of this patch.
+
+        This is a 1.0% speedup on SunSpider and a 6.3% speedup on the V8
+        benchmark suite.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::killLastResultRegister):
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::emitGetCTIParam):
+        (JSC::CTI::emitGetFromCallFrameHeader):
+        (JSC::CTI::emitPutResult):
+        (JSC::CTI::emitCTICall):
+        (JSC::CTI::CTI):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::compileOpStrictEq):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompilePatchGetArrayLength):
+        * VM/CTI.h:
+        * VM/CodeBlock.h:
+        (JSC::CodeBlock::isTemporaryRegisterIndex):
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitLabel):
+
+2008-11-12  Alp Toker  <alp@nuanti.com>
+
+        autotools build system fix-up only. Add FloatQuad.h to the source
+        lists and sort them.
+
+        * GNUmakefile.am:
+
+2008-11-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=22192
+        +37 failures in fast/profiler
+        
+        along with Darin's review comments in
+        https://bugs.webkit.org/show_bug.cgi?id=22174
+        Simplified op_call by nixing its responsibility for moving the value of
+        "this" into the first argument slot
+
+        * VM/Machine.cpp:
+        (JSC::returnToThrowTrampoline):
+        (JSC::throwStackOverflowError):
+        (JSC::Machine::cti_register_file_check):
+        (JSC::Machine::cti_op_call_arityCheck):
+        (JSC::Machine::cti_vm_throw): Moved the throw logic into a function, since
+        functions are better than macros.
+
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitCall):
+        (JSC::CodeGenerator::emitConstruct): Ensure that the function register
+        is preserved if profiling is enabled, since the profiler uses that
+        register.
+
+        * runtime/JSGlobalData.h: Renamed throwReturnAddress to exceptionLocation,
+        because I had a hard time understanding what "throwReturnAddress" meant.
+
+2008-11-12  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Roll in r38322, now that test failures have been fixed.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCallSetupArgs):
+        (JSC::CTI::compileOpCallEvalSetupArgs):
+        (JSC::CTI::compileOpConstructSetupArgs):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/Machine.cpp:
+        (JSC::Machine::callEval):
+        (JSC::Machine::dumpCallFrame):
+        (JSC::Machine::dumpRegisters):
+        (JSC::Machine::execute):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_register_file_check):
+        (JSC::Machine::cti_op_call_arityCheck):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        (JSC::Machine::cti_op_call_eval):
+        (JSC::Machine::cti_vm_throw):
+        * VM/Machine.h:
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitCall):
+        (JSC::CodeGenerator::emitCallEval):
+        (JSC::CodeGenerator::emitConstruct):
+        * bytecompiler/CodeGenerator.h:
+        * parser/Nodes.cpp:
+        (JSC::EvalFunctionCallNode::emitCode):
+        (JSC::FunctionCallValueNode::emitCode):
+        (JSC::FunctionCallResolveNode::emitCode):
+        (JSC::FunctionCallBracketNode::emitCode):
+        (JSC::FunctionCallDotNode::emitCode):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::neededConstants):
+
+2008-11-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22201
+        Integer conversion in array.length was safe signed values,
+        but the length is unsigned.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompilePatchGetArrayLength):
+
+2008-11-12  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        Roll out r38322 due to test failures on the bots.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCallSetupArgs):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/Machine.cpp:
+        (JSC::Machine::callEval):
+        (JSC::Machine::dumpCallFrame):
+        (JSC::Machine::dumpRegisters):
+        (JSC::Machine::execute):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::throwStackOverflowPreviousFrame):
+        (JSC::Machine::cti_register_file_check):
+        (JSC::Machine::cti_op_call_arityCheck):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        (JSC::Machine::cti_op_call_eval):
+        (JSC::Machine::cti_vm_throw):
+        * VM/Machine.h:
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitCall):
+        (JSC::CodeGenerator::emitCallEval):
+        (JSC::CodeGenerator::emitConstruct):
+        * bytecompiler/CodeGenerator.h:
+        * parser/Nodes.cpp:
+        (JSC::EvalFunctionCallNode::emitCode):
+        (JSC::FunctionCallValueNode::emitCode):
+        (JSC::FunctionCallResolveNode::emitCode):
+        (JSC::FunctionCallBracketNode::emitCode):
+        (JSC::FunctionCallDotNode::emitCode):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::neededConstants):
+
+2008-11-11  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=22174
+        Simplified op_call by nixing its responsibility for moving the value of
+        "this" into the first argument slot.
+
+        Instead, the caller emits an explicit load or mov instruction, or relies
+        on implicit knowledge that "this" is already in the first argument slot.
+        As a result, two operands to op_call are gone: firstArg and thisVal.
+        
+        SunSpider and v8 tests show no change in bytecode or CTI.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCallSetupArgs):
+        (JSC::CTI::compileOpCallEvalSetupArgs):
+        (JSC::CTI::compileOpConstructSetupArgs): Split apart these three versions
+        of setting up arguments to op_call, because they're more different than
+        they are the same -- even more so with this patch.
+
+        (JSC::CTI::compileOpCall): Updated for the fact that op_construct doesn't
+        match op_call anymore.
+
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases): Merged a few call cases. Updated
+        for changes mentioned above.
+
+        * VM/CTI.h:
+
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Updated for new bytecode format of call / construct.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::callEval): Updated for new bytecode format of call / construct.
+
+        (JSC::Machine::dumpCallFrame):
+        (JSC::Machine::dumpRegisters): Simplified these debugging functions, 
+        taking advantage of the new call frame layout.
+
+        (JSC::Machine::execute): Fixed up the eval version of execute to be
+        friendlier to calls in the new format.
+
+        (JSC::Machine::privateExecute): Implemented the new call format in
+        bytecode.
+
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        (JSC::Machine::cti_op_call_eval): Updated CTI helpers to match the new
+        call format.
+        
+        Fixed a latent bug in stack overflow checking that is now hit because
+        the register layout has changed a bit -- namely: when throwing a stack
+        overflow exception inside an op_call helper, we need to account for the
+        fact that the current call frame is only half-constructed, and use the
+        parent call frame instead.
+
+        * VM/Machine.h:
+
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitCall):
+        (JSC::CodeGenerator::emitCallEval):
+        (JSC::CodeGenerator::emitConstruct):
+        * bytecompiler/CodeGenerator.h: Updated codegen to match the new call
+        format.
+
+        * parser/Nodes.cpp:
+        (JSC::EvalFunctionCallNode::emitCode):
+        (JSC::FunctionCallValueNode::emitCode):
+        (JSC::FunctionCallResolveNode::emitCode):
+        (JSC::FunctionCallBracketNode::emitCode):
+        (JSC::FunctionCallDotNode::emitCode):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::neededConstants): ditto
+
+2008-11-11  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Remove an unused forwarding header for a file that no longer exists.
+
+        * ForwardingHeaders/JavaScriptCore/JSLock.h: Removed.
+
+2008-11-11  Mark Rowe  <mrowe@apple.com>
+
+        Fix broken dependencies building JavaScriptCore on a freezing cold cat, caused
+        by failure to update all instances of "kjs" to their new locations.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-11-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Rubber-stamped by Adam Roben.
+
+        * wtf/AVLTree.h: (WTF::AVLTree::Iterator::start_iter):
+        Fix indentation a little more.
+
+2008-11-11  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Clean up EvalCodeCache to match our coding style a bit more.
+
+        * VM/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+
+2008-11-11  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Bug 22179: Move EvalCodeCache from CodeBlock.h into its own file
+        <https://bugs.webkit.org/show_bug.cgi?id=22179>
+
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CodeBlock.h:
+        * VM/EvalCodeCache.h: Copied from VM/CodeBlock.h.
+        * VM/Machine.cpp:
+
+2008-11-11  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove the 'm_' prefix from the fields of the SwitchRecord struct.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompile):
+        * VM/CTI.h:
+        (JSC::SwitchRecord):
+        (JSC::SwitchRecord::SwitchRecord):
+
+2008-11-11  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Make asInteger() a static function so that it has internal linkage.
+
+        * VM/CTI.cpp:
+        (JSC::asInteger):
+
+2008-11-11  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        - shrink CodeBlock and AST related Vectors to exact fit (5-10M savings on membuster test)
+        
+        No perf regression combined with the last patch (each seems like a small regression individually)
+
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::generate):
+        * parser/Nodes.h:
+        (JSC::SourceElements::releaseContentsIntoVector):
+        * wtf/Vector.h:
+        (WTF::Vector::shrinkToFit):
+
+2008-11-11  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        - remove inline capacity from declaration stacks (15M savings on membuster test)
+
+        No perf regression on SunSpider or V8 test combined with other upcoming memory improvement patch.
+        
+        * JavaScriptCore.exp:
+        * parser/Nodes.h:
+
+2008-11-11  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        While r38286 removed the need for the m_callFrame member variable of
+        CTI, it should be also be removed.
+
+        * VM/CTI.h:
+
+2008-11-10  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Make CTI::asInteger() a non-member function, since it needs no access to
+        any of CTI's member variables.
+
+        * VM/CTI.cpp:
+        (JSC::asInteger):
+        * VM/CTI.h:
+
+2008-11-10  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Use 'value' instead of 'js' in CTI as a name for JSValue* to match our
+        usual convention elsewhere.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::getConstantImmediateNumericArg):
+        (JSC::CTI::printOpcodeOperandTypes):
+
+2008-11-10  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Make CTI::getConstant() a member function of CodeBlock instead.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::getConstantImmediateNumericArg):
+        (JSC::CTI::printOpcodeOperandTypes):
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CTI.h:
+        * VM/CodeBlock.h:
+        (JSC::CodeBlock::getConstant):
+
+2008-11-10  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Rename CodeBlock::isConstant() to isConstantRegisterIndex().
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::getConstantImmediateNumericArg):
+        (JSC::CTI::printOpcodeOperandTypes):
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CodeBlock.h:
+        (JSC::CodeBlock::isConstantRegisterIndex):
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitEqualityOp):
+
+2008-11-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix for non-CTI builds.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::initialize):
+
+2008-11-10  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove the unused labels member variable of CodeBlock.
+
+        * VM/CodeBlock.h:
+        * VM/LabelID.h:
+        (JSC::LabelID::setLocation):
+
+2008-11-10  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Batch compile the set of static trampolines at the point Machine is constructed, using a single allocation.
+        Refactor out m_callFrame from CTI, since this is only needed to access the global data (instead store a
+        pointer to the global data directly, since this is available at the point the Machine is constructed).
+        Add a method to align the code buffer, to allow JIT generation for multiple trampolines in one block.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::getConstant):
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::getConstantImmediateNumericArg):
+        (JSC::CTI::printOpcodeOperandTypes):
+        (JSC::CTI::CTI):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompileCTIMachineTrampolines):
+        (JSC::CTI::freeCTIMachineTrampolines):
+        * VM/CTI.h:
+        (JSC::CTI::compile):
+        (JSC::CTI::compileGetByIdSelf):
+        (JSC::CTI::compileGetByIdProto):
+        (JSC::CTI::compileGetByIdChain):
+        (JSC::CTI::compilePutByIdReplace):
+        (JSC::CTI::compilePutByIdTransition):
+        (JSC::CTI::compileCTIMachineTrampolines):
+        (JSC::CTI::compilePatchGetArrayLength):
+        * VM/Machine.cpp:
+        (JSC::Machine::initialize):
+        (JSC::Machine::~Machine):
+        (JSC::Machine::execute):
+        (JSC::Machine::tryCTICachePutByID):
+        (JSC::Machine::tryCTICacheGetByID):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_vm_lazyLinkCall):
+        * VM/Machine.h:
+        * masm/X86Assembler.h:
+        (JSC::JITCodeBuffer::isAligned):
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::align):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+
+2008-11-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Antti Koivisto.
+        
+        - Make Vector::clear() release the Vector's memory (1MB savings on membuster)
+        https://bugs.webkit.org/show_bug.cgi?id=22170
+
+        * wtf/Vector.h:
+        (WTF::VectorBufferBase::deallocateBuffer): Set capacity to 0 as
+        well as size, otherwise shrinking capacity to 0 can fail to reset
+        the capacity and thus cause a future crash.
+        (WTF::Vector::~Vector): Shrink size not capacity; we only need
+        to call destructors, the buffer will be freed anyway.
+        (WTF::Vector::clear): Change this to shrinkCapacity(0), not just shrink(0).
+        (WTF::::shrinkCapacity): Use shrink() instead of resize() for case where
+        the size is greater than the new capacity, to work with types that have no
+        default constructor.
+
+2008-11-10  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Split multiple definitions into separate lines.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileBinaryArithOp):
+
+2008-11-10  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 22162: Remove cachedValueGetter from the JavaScriptCore API implementation
+        <https://bugs.webkit.org/show_bug.cgi?id=22162>
+
+        There is no more need for the cachedValueGetter hack now that we have
+        PropertySlot::setValue(), so we should remove it.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::getOwnPropertySlot):
+
+2008-11-10  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 22152: Remove asObject() call from JSCallbackObject::getOwnPropertySlot()
+        <https://bugs.webkit.org/show_bug.cgi?id=22152>
+
+        With the recent change to adopt asType() style cast functions with
+        assertions instead of static_casts in many places, the assertion for
+        the asObject() call in JSCallbackObject::getOwnPropertySlot() has been
+        failing when using any nontrivial client of the JavaScriptCore API.
+        The cast isn't even necessary to call slot.setCustom(), so it should
+        be removed.
+
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject::getOwnPropertySlot):
+
+2008-11-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        A few coding style fixes for AVLTree.
+
+        * wtf/AVLTree.h: Moved to WTF namespace, Removed "KJS_" from include guards.
+        (WTF::AVLTree::Iterator::start_iter): Fixed indentation
+
+        * runtime/JSArray.cpp: Added "using namepace WTF".
+
+2008-11-09  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Speculatively fix the non-AllInOne build.
+
+        * runtime/NativeErrorConstructor.cpp:
+
+2008-11-09  Darin Adler  <darin@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=22149
+          remove unused code from the parser
+
+        * AllInOneFile.cpp: Removed nodes2string.cpp.
+        * GNUmakefile.am: Ditto.
+        * JavaScriptCore.exp: Ditto.
+        * JavaScriptCore.pri: Ditto.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * JavaScriptCoreSources.bkl: Ditto.
+
+        * VM/CodeBlock.h: Added include.
+
+        * VM/Machine.cpp: (JSC::Machine::execute): Use the types from
+        DeclarationStacks as DeclarationStacks:: rather than Node:: since
+        "Node" really has little to do with it.
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::CodeGenerator): Ditto.
+
+        * jsc.cpp:
+        (Options::Options): Removed prettyPrint option.
+        (runWithScripts): Ditto.
+        (printUsageStatement): Ditto.
+        (parseArguments): Ditto.
+        (jscmain): Ditto.
+
+        * parser/Grammar.y: Removed use of obsolete ImmediateNumberNode.
+
+        * parser/Nodes.cpp:
+        (JSC::ThrowableExpressionData::emitThrowError): Use inline functions
+        instead of direct member access for ThrowableExpressionData values.
+        (JSC::BracketAccessorNode::emitCode): Ditto.
+        (JSC::DotAccessorNode::emitCode): Ditto.
+        (JSC::NewExprNode::emitCode): Ditto.
+        (JSC::EvalFunctionCallNode::emitCode): Ditto.
+        (JSC::FunctionCallValueNode::emitCode): Ditto.
+        (JSC::FunctionCallResolveNode::emitCode): Ditto.
+        (JSC::FunctionCallBracketNode::emitCode): Ditto.
+        (JSC::FunctionCallDotNode::emitCode): Ditto.
+        (JSC::PostfixResolveNode::emitCode): Ditto.
+        (JSC::PostfixBracketNode::emitCode): Ditto.
+        (JSC::PostfixDotNode::emitCode): Ditto.
+        (JSC::DeleteResolveNode::emitCode): Ditto.
+        (JSC::DeleteBracketNode::emitCode): Ditto.
+        (JSC::DeleteDotNode::emitCode): Ditto.
+        (JSC::PrefixResolveNode::emitCode): Ditto.
+        (JSC::PrefixBracketNode::emitCode): Ditto.
+        (JSC::PrefixDotNode::emitCode): Ditto.
+        (JSC::ThrowableBinaryOpNode::emitCode): Ditto.
+        (JSC::InstanceOfNode::emitCode): Ditto.
+        (JSC::ReadModifyResolveNode::emitCode): Ditto.
+        (JSC::AssignResolveNode::emitCode): Ditto.
+        (JSC::AssignDotNode::emitCode): Ditto.
+        (JSC::ReadModifyDotNode::emitCode): Ditto.
+        (JSC::AssignBracketNode::emitCode): Ditto.
+        (JSC::ReadModifyBracketNode::emitCode): Ditto.
+        (JSC::statementListEmitCode): Take a const StatementVector instead
+        of a non-const one. Also removed unused statementListPushFIFO.
+        (JSC::ForInNode::emitCode): Inline functions instead of member access.
+        (JSC::ThrowNode::emitCode): Ditto.
+        (JSC::EvalNode::emitCode): Ditto.
+        (JSC::FunctionBodyNode::emitCode): Ditto.
+        (JSC::ProgramNode::emitCode): Ditto.
+
+        * parser/Nodes.h: Removed unused includes and forward declarations.
+        Removed Precedence enum. Made many more members private instead of
+        protected or public. Removed unused NodeStack typedef. Moved the
+        VarStack and FunctionStack typedefs from Node to ScopeNode. Made
+        Node::emitCode pure virtual and changed classes that don't emit
+        any code to inherit from ParserRefCounted rather than Node.
+        Moved isReturnNode from Node to StatementNode. Removed the
+        streamTo, precedence, and needsParensIfLeftmost functions from
+        all classes. Removed the ImmediateNumberNode class and make
+        NumberNode::setValue nonvirtual.
+
+        * parser/nodes2string.cpp: Removed.
+
+2008-11-09  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig and Maciej Stachowiak.
+        Includes some work done by Chris Brichford.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=14886
+          Stack overflow due to deeply nested parse tree doing repeated string concatentation
+
+        Test: fast/js/large-expressions.html
+
+        1) Code generation is recursive, so takes stack proportional to the complexity
+           of the source code expression. Fixed by setting an arbitrary recursion limit
+           of 10,000 nodes.
+
+        2) Destruction of the syntax tree was recursive. Fixed by introducing a
+           non-recursive mechanism for destroying the tree.
+
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::CodeGenerator): Initialize depth to 0.
+        (JSC::CodeGenerator::emitThrowExpressionTooDeepException): Added. Emits the code
+        to throw a "too deep" exception.
+        * bytecompiler/CodeGenerator.h:
+        (JSC::CodeGenerator::emitNode): Check depth and emit an exception if we exceed
+        the maximum depth.
+
+        * parser/Nodes.cpp:
+        (JSC::NodeReleaser::releaseAllNodes): Added. To be called inside node destructors
+        to avoid recursive calls to destructors for nodes inside this one.
+        (JSC::NodeReleaser::release): Added. To be called inside releaseNodes functions.
+        Also added releaseNodes functions and calls to releaseAllNodes inside destructors
+        for each class derived from Node that has RefPtr to other nodes.
+        (JSC::NodeReleaser::adopt): Added. Used by the release function.
+        (JSC::NodeReleaser::adoptFunctionBodyNode): Added.
+
+        * parser/Nodes.h: Added declarations of releaseNodes and destructors in all classes
+        that needed it. Eliminated use of ListRefPtr and releaseNext, which are the two parts
+        of an older solution to the non-recursive destruction problem that works only for
+        lists, whereas the new solution works for other graphs. Changed ReverseBinaryOpNode
+        to use BinaryOpNode as a base class to avoid some duplicated code.
+
+2008-11-08  Kevin Ollivier  <kevino@theolliviers.com>
+        
+        wx build fixes after addition of JSCore parser and bycompiler dirs. Also cleanup
+        the JSCore Bakefile's group names to be consistent.
+
+        * JavaScriptCoreSources.bkl:
+        * jscore.bkl:
+
+2008-11-07  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 21801: REGRESSION (r37821): YUI date formatting JavaScript puts the letter 'd' in place of the day
+        <https://bugs.webkit.org/show_bug.cgi?id=21801>
+
+        Fix the constant register check in the 'typeof' optimization in
+        CodeGenerator, which was completely broken after r37821.
+
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitEqualityOp):
+
+2008-11-07  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 22129: Move CTI::isConstant() to CodeBlock
+        <https://bugs.webkit.org/show_bug.cgi?id=22129>
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::getConstantImmediateNumericArg):
+        (JSC::CTI::printOpcodeOperandTypes):
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CTI.h:
+        * VM/CodeBlock.h:
+        (JSC::CodeBlock::isConstant):
+
+2008-11-07  Alp Toker  <alp@nuanti.com>
+
+        autotools fix. Always use the configured perl binary (which may be
+        different to the one in $PATH) when generating sources.
+
+        * GNUmakefile.am:
+
+2008-11-07  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Change grammar.cpp to Grammar.cpp and grammar.h to Grammar.h in several
+        build scripts.
+
+        * DerivedSources.make:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCoreSources.bkl:
+
+2008-11-07  Alp Toker  <alp@nuanti.com>
+
+        More grammar.cpp -> Grammar.cpp build fixes.
+
+        * AllInOneFile.cpp:
+        * GNUmakefile.am:
+
+2008-11-07  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the build on case-sensitive file systems. grammar.y was renamed to
+        Grammar.y but Lexer.cpp includes grammar.h. The build bots didn't
+        notice this change because of stale files.
+
+        * parser/Lexer.cpp:
+
+2008-11-07  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Rename the m_nextGlobal, m_nextParameter, and m_nextConstant member
+        variables of CodeGenerator to m_nextGlobalIndex, m_nextParameterIndex,
+        and m_nextConstantIndex respectively. This is to distinguish these from
+        member variables like m_lastConstant, which are actually RefPtrs to
+        Registers.
+
+        * bytecompiler/CodeGenerator.cpp:
+        (JSC::CodeGenerator::addGlobalVar):
+        (JSC::CodeGenerator::allocateConstants):
+        (JSC::CodeGenerator::CodeGenerator):
+        (JSC::CodeGenerator::addParameter):
+        (JSC::CodeGenerator::addConstant):
+        * bytecompiler/CodeGenerator.h:
+
+2008-11-06  Gavin Barraclough  barraclough@apple.com
+
+        Reviewed by Oliver Hunt.
+
+        Do not make a cti_* call to perform an op_call unless either:
+        (1) The codeblock for the function body has not been generated.
+        (2) The number of arguments passed does not match the callee arity.
+
+        ~1% progression on sunspider --v8
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCallInitializeCallFrame):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_op_call_arityCheck):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        * VM/Machine.h:
+        * kjs/nodes.h:
+
+2008-11-06  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Move the remaining files in the kjs subdirectory of JavaScriptCore to
+        a new parser subdirectory, and remove the kjs subdirectory entirely.
+
+        * AllInOneFile.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/CodeBlock.h:
+        * VM/ExceptionHelpers.cpp:
+        * VM/SamplingTool.h:
+        * bytecompiler/CodeGenerator.h:
+        * jsc.pro:
+        * jscore.bkl:
+        * kjs: Removed.
+        * kjs/NodeInfo.h: Removed.
+        * kjs/Parser.cpp: Removed.
+        * kjs/Parser.h: Removed.
+        * kjs/ResultType.h: Removed.
+        * kjs/SourceCode.h: Removed.
+        * kjs/SourceProvider.h: Removed.
+        * kjs/grammar.y: Removed.
+        * kjs/keywords.table: Removed.
+        * kjs/lexer.cpp: Removed.
+        * kjs/lexer.h: Removed.
+        * kjs/nodes.cpp: Removed.
+        * kjs/nodes.h: Removed.
+        * kjs/nodes2string.cpp: Removed.
+        * parser: Added.
+        * parser/Grammar.y: Copied from kjs/grammar.y.
+        * parser/Keywords.table: Copied from kjs/keywords.table.
+        * parser/Lexer.cpp: Copied from kjs/lexer.cpp.
+        * parser/Lexer.h: Copied from kjs/lexer.h.
+        * parser/NodeInfo.h: Copied from kjs/NodeInfo.h.
+        * parser/Nodes.cpp: Copied from kjs/nodes.cpp.
+        * parser/Nodes.h: Copied from kjs/nodes.h.
+        * parser/Parser.cpp: Copied from kjs/Parser.cpp.
+        * parser/Parser.h: Copied from kjs/Parser.h.
+        * parser/ResultType.h: Copied from kjs/ResultType.h.
+        * parser/SourceCode.h: Copied from kjs/SourceCode.h.
+        * parser/SourceProvider.h: Copied from kjs/SourceProvider.h.
+        * parser/nodes2string.cpp: Copied from kjs/nodes2string.cpp.
+        * pcre/pcre.pri:
+        * pcre/pcre_exec.cpp:
+        * runtime/FunctionConstructor.cpp:
+        * runtime/JSActivation.h:
+        * runtime/JSFunction.h:
+        * runtime/JSGlobalData.cpp:
+        * runtime/JSGlobalObjectFunctions.cpp:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::toNumber):
+        * runtime/RegExp.cpp:
+
+2008-11-06  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r38196
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj: Added bytecompiler/ to the
+        include path.
+
+2008-11-06  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Create a new bytecompiler subdirectory of JavaScriptCore and move some
+        relevant files to it.
+
+        * AllInOneFile.cpp:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/CodeGenerator.cpp: Removed.
+        * VM/CodeGenerator.h: Removed.
+        * bytecompiler: Added.
+        * bytecompiler/CodeGenerator.cpp: Copied from VM/CodeGenerator.cpp.
+        * bytecompiler/CodeGenerator.h: Copied from VM/CodeGenerator.h.
+        * bytecompiler/LabelScope.h: Copied from kjs/LabelScope.h.
+        * jscore.bkl:
+        * kjs/LabelScope.h: Removed.
+
+2008-11-06  Adam Roben  <aroben@apple.com>
+
+        Windows clean build fix after r38155
+
+        Rubberstamped by Cameron Zwarich.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Update
+        the post-build event for the move of create_hash_table out of kjs/.
+
+2008-11-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22107
+
+        Bug uncovered during RVCT port in functions not used. get_lt() and
+        get_gt() takes only one argument - remove second argument where
+        applicable.
+
+        * wtf/AVLTree.h:
+        (JSC::AVLTree::remove): Remove second argument of get_lt/get_gt().
+        (JSC::AVLTree::subst): Ditto.
+
+2008-11-06  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Cameron Zwarich.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22033
+        [GTK] CTI/Linux r38064 crashes; JIT requires executable memory
+
+        Mark pages allocated by the FastMalloc mmap code path executable with
+        PROT_EXEC. This fixes crashes seen on CPUs and kernels that enforce
+        non-executable memory (like ExecShield on Fedora Linux) when the JIT
+        is enabled.
+
+        This patch does not resolve the issue on debug builds so affected
+        developers may still need to pass --disable-jit to configure.
+
+        * wtf/TCSystemAlloc.cpp:
+        (TryMmap):
+        (TryDevMem):
+        (TCMalloc_SystemRelease):
+
+2008-11-06  Peter Gal  <galpeter@inf.u-szeged.hu>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 22099: Make the Qt port build the JSC shell in the correct place
+        <https://bugs.webkit.org/show_bug.cgi?id=22099>
+
+        Adjust include paths and build destination dir for the 'jsc' executable
+        in the Qt build.
+
+        * jsc.pro:
+
+2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Implemented the block allocation on Symbian through heap allocation.
+
+        Unfortunately there is no way to allocate virtual memory. The Posix
+        layer provides mmap() but no anonymous mapping. So this is a very slow
+        solution but it should work as a start.
+
+        * runtime/Collector.cpp:
+        (JSC::allocateBlock):
+        (JSC::freeBlock):
+
+2008-11-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Borrow some math functions from the MSVC port to the build with the
+        RVCT compiler.
+
+        * wtf/MathExtras.h:
+        (isinf):
+        (isnan):
+        (signbit):
+
+2008-11-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Include strings.h for strncasecmp().
+        This is needed for compilation inside Symbian and it is also
+        confirmed by the man-page on Linux.
+
+        * runtime/DateMath.cpp:
+
+2008-11-06  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Implemented currentThreadStackBase for Symbian.
+
+        * runtime/Collector.cpp:
+        (JSC::currentThreadStackBase):
+
+2008-11-06  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        RVCT does not support tm_gmtoff field, so disable that code just like
+        for MSVC.
+
+        * runtime/DateMath.h:
+        (JSC::GregorianDateTime::GregorianDateTime):
+        (JSC::GregorianDateTime::operator tm):
+
+2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Define PLATFORM(UNIX) for S60. Effectively WebKit on S60 is compiled
+        on top of the Posix layer.
+
+        * wtf/Platform.h:
+
+2008-11-06  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Added __SYMBIAN32__ condition for defining PLATFORM(SYMBIAN).
+
+        * wtf/Platform.h:
+
+2008-11-06  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Added WINSCW compiler define for Symbian S60.
+
+        * wtf/Platform.h:
+
+2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Use the GCC defines of the WTF_ALIGN* macros for the RVCT and the
+        MINSCW compiler.
+
+        * wtf/Vector.h:
+
+2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Define capabilities of the SYMBIAN platform. Some of the system
+        headers are actually dependent on RVCT.
+
+        * wtf/Platform.h:
+
+2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add missing stddef.h header needed for compilation in Symbian.
+
+        * runtime/Collector.h:
+
+2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Added COMPILER(RVCT) to detect the ARM RVCT compiler used in the Symbian environment.
+
+        * wtf/Platform.h:
+
+2008-11-06  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the Qt build, adjust include paths after move of jsc.pro.
+
+        * jsc.pro:
+
+2008-11-06  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Move kjs/Shell.cpp to the top level of the JavaScriptCore directory and
+        rename it to jsc.cpp to reflect the name of the binary compiled from it.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * jsc.cpp: Copied from kjs/Shell.cpp.
+        * jsc.pro:
+        * jscore.bkl:
+        * kjs/Shell.cpp: Removed.
+
+2008-11-06  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Move create_hash_table and jsc.pro out of the kjs directory and into the
+        root directory of JavaScriptCore.
+
+        * DerivedSources.make:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * create_hash_table: Copied from kjs/create_hash_table.
+        * jsc.pro: Copied from kjs/jsc.pro.
+        * kjs/create_hash_table: Removed.
+        * kjs/jsc.pro: Removed.
+        * make-generated-sources.sh:
+
+2008-11-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22094
+
+        Fix for bug where the callee incorrectly recieves the caller's lexical
+        global object as this, rather than its own.  Implementation closely
+        follows the spec, passing jsNull, checking in the callee and replacing
+        with the global object where necessary.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCall):
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_call_eval):
+        * runtime/JSCell.h:
+        (JSC::JSValue::toThisObject):
+        * runtime/JSImmediate.cpp:
+        (JSC::JSImmediate::toThisObject):
+        * runtime/JSImmediate.h:
+
+2008-11-05  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix after Operations.cpp move.
+
+        * JavaScriptCoreSources.bkl:
+
+2008-11-05  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Fix the build for case-sensitive build systems and wxWindows.
+
+        * JavaScriptCoreSources.bkl:
+        * kjs/create_hash_table:
+
+2008-11-05  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Fix the build for case-sensitive build systems.
+
+        * JavaScriptCoreSources.bkl:
+        * kjs/Shell.cpp:
+        * runtime/Interpreter.cpp:
+        * runtime/JSArray.cpp:
+
+2008-11-05  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Fix the build for case-sensitive build systems.
+
+        * API/JSBase.cpp:
+        * API/JSObjectRef.cpp:
+        * runtime/CommonIdentifiers.h:
+        * runtime/Identifier.cpp:
+        * runtime/InitializeThreading.cpp:
+        * runtime/InternalFunction.h:
+        * runtime/JSString.h:
+        * runtime/Lookup.h:
+        * runtime/PropertyNameArray.h:
+        * runtime/PropertySlot.h:
+        * runtime/StructureID.cpp:
+        * runtime/StructureID.h:
+        * runtime/UString.cpp:
+
+2008-11-05  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Move more files to the runtime subdirectory of JavaScriptCore.
+
+        * API/APICast.h:
+        * API/JSBase.cpp:
+        * API/JSCallbackObject.cpp:
+        * API/JSClassRef.cpp:
+        * API/JSClassRef.h:
+        * API/JSStringRefCF.cpp:
+        * API/JSValueRef.cpp:
+        * API/OpaqueJSString.cpp:
+        * API/OpaqueJSString.h:
+        * AllInOneFile.cpp:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/CodeBlock.h:
+        * VM/CodeGenerator.cpp:
+        * VM/Machine.cpp:
+        * VM/RegisterFile.h:
+        * debugger/Debugger.h:
+        * kjs/SourceProvider.h:
+        * kjs/TypeInfo.h: Removed.
+        * kjs/collector.cpp: Removed.
+        * kjs/collector.h: Removed.
+        * kjs/completion.h: Removed.
+        * kjs/create_hash_table:
+        * kjs/identifier.cpp: Removed.
+        * kjs/identifier.h: Removed.
+        * kjs/interpreter.cpp: Removed.
+        * kjs/interpreter.h: Removed.
+        * kjs/lexer.cpp:
+        * kjs/lexer.h:
+        * kjs/lookup.cpp: Removed.
+        * kjs/lookup.h: Removed.
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+        * kjs/operations.cpp: Removed.
+        * kjs/operations.h: Removed.
+        * kjs/protect.h: Removed.
+        * kjs/regexp.cpp: Removed.
+        * kjs/regexp.h: Removed.
+        * kjs/ustring.cpp: Removed.
+        * kjs/ustring.h: Removed.
+        * pcre/pcre_exec.cpp:
+        * profiler/CallIdentifier.h:
+        * profiler/Profile.h:
+        * runtime/ArrayConstructor.cpp:
+        * runtime/ArrayPrototype.cpp:
+        * runtime/ArrayPrototype.h:
+        * runtime/Collector.cpp: Copied from kjs/collector.cpp.
+        * runtime/Collector.h: Copied from kjs/collector.h.
+        * runtime/CollectorHeapIterator.h:
+        * runtime/Completion.h: Copied from kjs/completion.h.
+        * runtime/ErrorPrototype.cpp:
+        * runtime/Identifier.cpp: Copied from kjs/identifier.cpp.
+        * runtime/Identifier.h: Copied from kjs/identifier.h.
+        * runtime/InitializeThreading.cpp:
+        * runtime/Interpreter.cpp: Copied from kjs/interpreter.cpp.
+        * runtime/Interpreter.h: Copied from kjs/interpreter.h.
+        * runtime/JSCell.h:
+        * runtime/JSGlobalData.cpp:
+        * runtime/JSGlobalData.h:
+        * runtime/JSLock.cpp:
+        * runtime/JSNumberCell.cpp:
+        * runtime/JSNumberCell.h:
+        * runtime/JSObject.cpp:
+        * runtime/JSValue.h:
+        * runtime/Lookup.cpp: Copied from kjs/lookup.cpp.
+        * runtime/Lookup.h: Copied from kjs/lookup.h.
+        * runtime/MathObject.cpp:
+        * runtime/NativeErrorPrototype.cpp:
+        * runtime/NumberPrototype.cpp:
+        * runtime/Operations.cpp: Copied from kjs/operations.cpp.
+        * runtime/Operations.h: Copied from kjs/operations.h.
+        * runtime/PropertyMapHashTable.h:
+        * runtime/Protect.h: Copied from kjs/protect.h.
+        * runtime/RegExp.cpp: Copied from kjs/regexp.cpp.
+        * runtime/RegExp.h: Copied from kjs/regexp.h.
+        * runtime/RegExpConstructor.cpp:
+        * runtime/RegExpObject.h:
+        * runtime/RegExpPrototype.cpp:
+        * runtime/SmallStrings.h:
+        * runtime/StringObjectThatMasqueradesAsUndefined.h:
+        * runtime/StructureID.cpp:
+        * runtime/StructureID.h:
+        * runtime/StructureIDTransitionTable.h:
+        * runtime/SymbolTable.h:
+        * runtime/TypeInfo.h: Copied from kjs/TypeInfo.h.
+        * runtime/UString.cpp: Copied from kjs/ustring.cpp.
+        * runtime/UString.h: Copied from kjs/ustring.h.
+        * wrec/CharacterClassConstructor.h:
+        * wrec/WREC.h:
+
+2008-11-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Suggested by Darin Adler.
+        
+        Removed two copy constructors that the compiler can generate for us
+        automatically.
+
+        * VM/LabelID.h:
+        (JSC::LabelID::setLocation):
+        (JSC::LabelID::offsetFrom):
+        (JSC::LabelID::ref):
+        (JSC::LabelID::refCount):
+        * kjs/LabelScope.h:
+
+2008-11-05  Anders Carlsson  <andersca@apple.com>
+
+        Fix Snow Leopard build.
+        
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-11-04  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Steve Falkenburg.
+
+        Move dtoa.cpp and dtoa.h to the WTF Visual Studio project to reflect
+        their movement in the filesystem.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2008-11-04  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Move kjs/dtoa.h to the wtf subdirectory of JavaScriptCore.
+
+        * AllInOneFile.cpp:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * kjs/dtoa.cpp: Removed.
+        * kjs/dtoa.h: Removed.
+        * wtf/dtoa.cpp: Copied from kjs/dtoa.cpp.
+        * wtf/dtoa.h: Copied from kjs/dtoa.h.
+
+2008-11-04  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Move kjs/config.h to the top level of JavaScriptCore.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * config.h: Copied from kjs/config.h.
+        * kjs/config.h: Removed.
+
+2008-11-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        * wtf/ThreadingNone.cpp: Tweak formatting.
+
+2008-11-03  Darin Adler  <darin@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=22061
+          create script to check for exit-time destructors
+
+        * JavaScriptCore.exp: Changed to export functions rather than
+        a global for the atomically initialized static mutex.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added a script
+        phase that runs the check-for-exit-time-destructors script.
+
+        * wtf/MainThread.cpp:
+        (WTF::mainThreadFunctionQueueMutex): Changed to leak an object
+        rather than using an exit time destructor.
+        (WTF::functionQueue): Ditto.
+        * wtf/unicode/icu/CollatorICU.cpp:
+        (WTF::cachedCollatorMutex): Ditto.
+
+        * wtf/Threading.h: Changed other platforms to share the Windows
+        approach where the mutex is internal and the functions are exported.
+        * wtf/ThreadingGtk.cpp:
+        (WTF::lockAtomicallyInitializedStaticMutex): Ditto.
+        (WTF::unlockAtomicallyInitializedStaticMutex): Ditto.
+        * wtf/ThreadingNone.cpp:
+        (WTF::lockAtomicallyInitializedStaticMutex): Ditto.
+        (WTF::unlockAtomicallyInitializedStaticMutex): Ditto.
+        * wtf/ThreadingPthreads.cpp:
+        (WTF::threadMapMutex): Changed to leak an object rather than using
+        an exit time destructor.
+        (WTF::lockAtomicallyInitializedStaticMutex): Mutex change.
+        (WTF::unlockAtomicallyInitializedStaticMutex): Ditto.
+        (WTF::threadMap): Changed to leak an object rather than using
+        an exit time destructor.
+        * wtf/ThreadingQt.cpp:
+        (WTF::lockAtomicallyInitializedStaticMutex): Mutex change.
+        (WTF::unlockAtomicallyInitializedStaticMutex): Ditto.
+        * wtf/ThreadingWin.cpp:
+        (WTF::lockAtomicallyInitializedStaticMutex): Added an assertion.
+
+2008-11-04  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Update
+        the location of JSStaticScopeObject.{cpp,h}.
+
+2008-11-04  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Move AllInOneFile.cpp to the top level of JavaScriptCore.
+
+        * AllInOneFile.cpp: Copied from kjs/AllInOneFile.cpp.
+        * GNUmakefile.am:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/AllInOneFile.cpp: Removed.
+
+2008-11-04  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Alexey Proskuryakov.
+
+        Add NodeInfo.h to the JavaScriptCore Xcode project.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-11-03  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Move more files into the runtime subdirectory of JavaScriptCore.
+
+        * API/JSBase.cpp:
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackFunction.cpp:
+        * API/JSClassRef.cpp:
+        * API/OpaqueJSString.cpp:
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * kjs/AllInOneFile.cpp:
+        * kjs/ArgList.cpp: Removed.
+        * kjs/ArgList.h: Removed.
+        * kjs/Arguments.cpp: Removed.
+        * kjs/Arguments.h: Removed.
+        * kjs/BatchedTransitionOptimizer.h: Removed.
+        * kjs/CollectorHeapIterator.h: Removed.
+        * kjs/CommonIdentifiers.cpp: Removed.
+        * kjs/CommonIdentifiers.h: Removed.
+        * kjs/ExecState.cpp: Removed.
+        * kjs/ExecState.h: Removed.
+        * kjs/GetterSetter.cpp: Removed.
+        * kjs/GetterSetter.h: Removed.
+        * kjs/InitializeThreading.cpp: Removed.
+        * kjs/InitializeThreading.h: Removed.
+        * kjs/JSActivation.cpp: Removed.
+        * kjs/JSActivation.h: Removed.
+        * kjs/JSGlobalData.cpp: Removed.
+        * kjs/JSGlobalData.h: Removed.
+        * kjs/JSLock.cpp: Removed.
+        * kjs/JSLock.h: Removed.
+        * kjs/JSStaticScopeObject.cpp: Removed.
+        * kjs/JSStaticScopeObject.h: Removed.
+        * kjs/JSType.h: Removed.
+        * kjs/PropertyNameArray.cpp: Removed.
+        * kjs/PropertyNameArray.h: Removed.
+        * kjs/ScopeChain.cpp: Removed.
+        * kjs/ScopeChain.h: Removed.
+        * kjs/ScopeChainMark.h: Removed.
+        * kjs/SymbolTable.h: Removed.
+        * kjs/Tracing.d: Removed.
+        * kjs/Tracing.h: Removed.
+        * runtime/ArgList.cpp: Copied from kjs/ArgList.cpp.
+        * runtime/ArgList.h: Copied from kjs/ArgList.h.
+        * runtime/Arguments.cpp: Copied from kjs/Arguments.cpp.
+        * runtime/Arguments.h: Copied from kjs/Arguments.h.
+        * runtime/BatchedTransitionOptimizer.h: Copied from kjs/BatchedTransitionOptimizer.h.
+        * runtime/CollectorHeapIterator.h: Copied from kjs/CollectorHeapIterator.h.
+        * runtime/CommonIdentifiers.cpp: Copied from kjs/CommonIdentifiers.cpp.
+        * runtime/CommonIdentifiers.h: Copied from kjs/CommonIdentifiers.h.
+        * runtime/ExecState.cpp: Copied from kjs/ExecState.cpp.
+        * runtime/ExecState.h: Copied from kjs/ExecState.h.
+        * runtime/GetterSetter.cpp: Copied from kjs/GetterSetter.cpp.
+        * runtime/GetterSetter.h: Copied from kjs/GetterSetter.h.
+        * runtime/InitializeThreading.cpp: Copied from kjs/InitializeThreading.cpp.
+        * runtime/InitializeThreading.h: Copied from kjs/InitializeThreading.h.
+        * runtime/JSActivation.cpp: Copied from kjs/JSActivation.cpp.
+        * runtime/JSActivation.h: Copied from kjs/JSActivation.h.
+        * runtime/JSGlobalData.cpp: Copied from kjs/JSGlobalData.cpp.
+        * runtime/JSGlobalData.h: Copied from kjs/JSGlobalData.h.
+        * runtime/JSLock.cpp: Copied from kjs/JSLock.cpp.
+        * runtime/JSLock.h: Copied from kjs/JSLock.h.
+        * runtime/JSStaticScopeObject.cpp: Copied from kjs/JSStaticScopeObject.cpp.
+        * runtime/JSStaticScopeObject.h: Copied from kjs/JSStaticScopeObject.h.
+        * runtime/JSType.h: Copied from kjs/JSType.h.
+        * runtime/PropertyNameArray.cpp: Copied from kjs/PropertyNameArray.cpp.
+        * runtime/PropertyNameArray.h: Copied from kjs/PropertyNameArray.h.
+        * runtime/ScopeChain.cpp: Copied from kjs/ScopeChain.cpp.
+        * runtime/ScopeChain.h: Copied from kjs/ScopeChain.h.
+        * runtime/ScopeChainMark.h: Copied from kjs/ScopeChainMark.h.
+        * runtime/SymbolTable.h: Copied from kjs/SymbolTable.h.
+        * runtime/Tracing.d: Copied from kjs/Tracing.d.
+        * runtime/Tracing.h: Copied from kjs/Tracing.h.
+
+2008-11-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Move #define to turn on dumping StructureID statistics to StructureID.cpp so that
+        turning it on does not require a full rebuild. 
+
+        * runtime/StructureID.cpp:
+        (JSC::StructureID::dumpStatistics):
+        * runtime/StructureID.h:
+
+2008-11-03  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix warning when building on Darwin without JSC_MULTIPLE_THREADS
+        enabled.
+
+        * kjs/InitializeThreading.cpp:
+
+2008-11-02  Matt Lilek  <webkit@mattlilek.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 22042: REGRESSION(r38066): ASSERTION FAILED: source in CodeBlock
+        <https://bugs.webkit.org/show_bug.cgi?id=22042>
+
+        Rename parameter name to avoid ASSERT.
+
+        * VM/CodeBlock.h:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+
+2008-11-02  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 22035: Remove the '_' suffix on constructor parameter names for structs
+        <https://bugs.webkit.org/show_bug.cgi?id=22035>
+
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::JSCallbackObjectData::JSCallbackObjectData):
+        * VM/CodeBlock.h:
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::ProgramCodeBlock::ProgramCodeBlock):
+        (JSC::EvalCodeBlock::EvalCodeBlock):
+        * wrec/WREC.h:
+        (JSC::Quantifier::Quantifier):
+
+2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Geoff Garen.
+
+        Rename SourceRange.h to SourceCode.h.
+
+        * API/JSBase.cpp:
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CodeBlock.h:
+        * kjs/SourceCode.h: Copied from kjs/SourceRange.h.
+        * kjs/SourceRange.h: Removed.
+        * kjs/grammar.y:
+        * kjs/lexer.h:
+        * kjs/nodes.cpp:
+        (JSC::ForInNode::ForInNode):
+        * kjs/nodes.h:
+        (JSC::ThrowableExpressionData::setExceptionSourceCode):
+
+2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 22019: Move JSC::Interpreter::shouldPrintExceptions() to WebCore::Console
+        <https://bugs.webkit.org/show_bug.cgi?id=22019>
+
+        The JSC::Interpreter::shouldPrintExceptions() function is not used at
+        all in JavaScriptCore, so it should be moved to WebCore::Console, its
+        only user.
+
+        * JavaScriptCore.exp:
+        * kjs/interpreter.cpp:
+        * kjs/interpreter.h:
+
+2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Remove the call to Interpreter::setShouldPrintExceptions() from the
+        GlobalObject constructor in the shell. The shouldPrintExceptions()
+        information is not used anywhere in JavaScriptCore, only in WebCore.
+
+        * kjs/Shell.cpp:
+        (GlobalObject::GlobalObject):
+
+2008-10-31  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxMSW build fix.
+
+        * wtf/Threading.h:
+
+2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Move more files from the kjs subdirectory of JavaScriptCore to the
+        runtime subdirectory.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * kjs/AllInOneFile.cpp:
+        * kjs/RegExpConstructor.cpp: Removed.
+        * kjs/RegExpConstructor.h: Removed.
+        * kjs/RegExpMatchesArray.h: Removed.
+        * kjs/RegExpObject.cpp: Removed.
+        * kjs/RegExpObject.h: Removed.
+        * kjs/RegExpPrototype.cpp: Removed.
+        * kjs/RegExpPrototype.h: Removed.
+        * runtime/RegExpConstructor.cpp: Copied from kjs/RegExpConstructor.cpp.
+        * runtime/RegExpConstructor.h: Copied from kjs/RegExpConstructor.h.
+        * runtime/RegExpMatchesArray.h: Copied from kjs/RegExpMatchesArray.h.
+        * runtime/RegExpObject.cpp: Copied from kjs/RegExpObject.cpp.
+        * runtime/RegExpObject.h: Copied from kjs/RegExpObject.h.
+        * runtime/RegExpPrototype.cpp: Copied from kjs/RegExpPrototype.cpp.
+        * runtime/RegExpPrototype.h: Copied from kjs/RegExpPrototype.h.
+
+2008-10-31  Mark Rowe  <mrowe@apple.com>
+
+        Revert an incorrect portion of r38034.
+
+        * profiler/ProfilerServer.mm:
+
+2008-10-31  Mark Rowe  <mrowe@apple.com>
+
+        Fix the 64-bit build.
+
+        Disable strict aliasing in ProfilerServer.mm as it leads to the compiler being unhappy
+        with the common Obj-C idiom self = [super init];
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Change a header guard to match our coding style.
+
+        * kjs/InitializeThreading.h:
+
+2008-10-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed a small bit of https://bugs.webkit.org/show_bug.cgi?id=21962
+        AST uses way too much memory
+        
+        Removed a word from StatementNode by nixing LabelStack and turning it
+        into a compile-time data structure managed by CodeGenerator.
+        
+        v8 tests and SunSpider, run by Gavin, report no change.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.order:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/AllInOneFile.cpp:
+        * JavaScriptCoreSources.bkl: I sure hope this builds!
+        
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::CodeGenerator):
+        (JSC::CodeGenerator::newLabelScope):
+        (JSC::CodeGenerator::breakTarget):
+        (JSC::CodeGenerator::continueTarget):
+        * VM/CodeGenerator.h: Nixed the JumpContext system because it depended
+        on a LabelStack in the AST, and it was a little cumbersome on the client
+        side. Replaced with LabelScope, which tracks all break / continue
+        information in the CodeGenerator, just like we track LabelIDs and other
+        stacks of compile-time data.
+
+        * kjs/LabelScope.h: Added.
+        (JSC::LabelScope::):
+        (JSC::LabelScope::LabelScope):
+        (JSC::LabelScope::ref):
+        (JSC::LabelScope::deref):
+        (JSC::LabelScope::refCount):
+        (JSC::LabelScope::breakTarget):
+        (JSC::LabelScope::continueTarget):
+        (JSC::LabelScope::type):
+        (JSC::LabelScope::name):
+        (JSC::LabelScope::scopeDepth): Simple abstraction for holding everything
+        you might want to know about a break-able / continue-able scope.
+
+        * kjs/LabelStack.cpp: Removed.
+        * kjs/LabelStack.h: Removed.
+
+        * kjs/grammar.y: No need to push labels at parse time -- we don't store
+        LabelStacks in the AST anymore.
+
+        * kjs/nodes.cpp:
+        (JSC::DoWhileNode::emitCode):
+        (JSC::WhileNode::emitCode):
+        (JSC::ForNode::emitCode):
+        (JSC::ForInNode::emitCode):
+        (JSC::ContinueNode::emitCode):
+        (JSC::BreakNode::emitCode):
+        (JSC::SwitchNode::emitCode):
+        (JSC::LabelNode::emitCode):
+        * kjs/nodes.h:
+        (JSC::StatementNode::):
+        (JSC::LabelNode::): Use LabelScope where we used to use JumpContext.
+        Simplified a bunch of code. Touched up label-related error messages a
+        bit.
+
+        * kjs/nodes2string.cpp:
+        (JSC::LabelNode::streamTo): Updated for rename.
+
+2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 22005: Move StructureIDChain into its own file
+        <https://bugs.webkit.org/show_bug.cgi?id=22005>
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * runtime/StructureID.cpp:
+        * runtime/StructureID.h:
+        * runtime/StructureIDChain.cpp: Copied from runtime/StructureID.cpp.
+        * runtime/StructureIDChain.h: Copied from runtime/StructureID.h.
+
+2008-10-31  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+
+2008-10-31  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-10-31  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        - fix storage leak seen on buildbot
+
+        Some other cleanup too. The storage leak was caused by the fact
+        that HashTraits<CallIdentifier>::needsDestruction was false, so
+        the call identifier objects didn't get deleted.
+
+        * profiler/CallIdentifier.h:
+        
+        Added a default constructor to create empty call identifiers.
+
+        Changed the normal constructor to use const UString&
+        to avoid extra copying and reference count thrash.
+        
+        Removed the explicit copy constructor definition, since it's what
+        the compiler will automatically generate. (Rule of thumb: Either
+        you need both a custom copy constructor and a custom assignment
+        operator, or neither.)
+
+        Moved the CallIdentifier hash function out of the WTF namespace;
+        there's no reason to put it there.
+
+        Changed the CallIdentifier hash function to be a struct rather than
+        a specialization of the IntHash struct template. Having it be
+        a specialization made no sense, since CallIdentifier is not an integer,
+        and did no good.
+
+        Removed explicit definition of emptyValueIsZero in the hash traits,
+        since inheriting from GenericHashTraits already makes that false.
+
+        Removed explicit definition of emptyValue, instead relying on the
+        default constructor and GenericHashTraits.
+
+        Removed explicit definition of needsDestruction, because we want it
+        to have its default value: true, not false. This fixes the leak!
+
+        Changed constructDeletedValue and isDeletedValue to use a line number
+        of numeric_limits<unsigned>::max() to indicate a value is deleted.
+        Previously this used empty strings for the empty value and null strings
+        for the deleted value, but it's more efficient to use null for both.
+
+2008-10-31  Timothy Hatcher  <timothy@apple.com>
+
+        Emit the WillExecuteStatement debugger hook before the for loop body
+        when the statement node for the body isn't a block. This allows
+        breakpoints on those statements in the Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22004
+
+        Reviewed by Darin Adler.
+
+        * kjs/nodes.cpp:
+        (JSC::ForNode::emitCode): Emit the WillExecuteStatement
+        debugger hook before the statement node if isn't a block.
+        Also emit the WillExecuteStatement debugger hook for the
+        loop as the first op-code.
+        (JSC::ForInNode::emitCode): Ditto.
+
+2008-10-31  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes console warnings about not having an autorelease pool.
+        Also fixes the build for Snow Leopard, by including individual
+        Foundation headers instead of Foundation.h.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21995
+
+        Reviewed by Oliver Hunt.
+
+        * profiler/ProfilerServer.mm:
+        (-[ProfilerServer init]): Create a NSAutoreleasePool and drain it.
+
+2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Speculative wxWindows build fix.
+
+        * JavaScriptCoreSources.bkl:
+        * jscore.bkl:
+
+2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Move VM/JSPropertyNameIterator.cpp and VM/JSPropertyNameIterator.h to
+        the runtime directory.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * VM/JSPropertyNameIterator.cpp: Removed.
+        * VM/JSPropertyNameIterator.h: Removed.
+        * runtime/JSPropertyNameIterator.cpp: Copied from VM/JSPropertyNameIterator.cpp.
+        * runtime/JSPropertyNameIterator.h: Copied from VM/JSPropertyNameIterator.h.
+
+2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Speculative wxWindows build fix.
+
+        * jscore.bkl:
+
+2008-10-30  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Jon Homeycutt.
+
+        Explicitly default to building for only the native architecture in debug and release builds.
+
+        * Configurations/DebugRelease.xcconfig:
+
+2008-10-30  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Create a debugger directory in JavaScriptCore and move the relevant
+        files to it.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CodeBlock.cpp:
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        * debugger: Added.
+        * debugger/Debugger.cpp: Copied from kjs/debugger.cpp.
+        * debugger/Debugger.h: Copied from kjs/debugger.h.
+        * debugger/DebuggerCallFrame.cpp: Copied from kjs/DebuggerCallFrame.cpp.
+        * debugger/DebuggerCallFrame.h: Copied from kjs/DebuggerCallFrame.h.
+        * kjs/AllInOneFile.cpp:
+        * kjs/DebuggerCallFrame.cpp: Removed.
+        * kjs/DebuggerCallFrame.h: Removed.
+        * kjs/Parser.cpp:
+        * kjs/Parser.h:
+        * kjs/debugger.cpp: Removed.
+        * kjs/debugger.h: Removed.
+        * kjs/interpreter.cpp:
+        * kjs/nodes.cpp:
+        * runtime/FunctionConstructor.cpp:
+        * runtime/JSGlobalObject.cpp:
+
+2008-10-30  Benjamin K. Stuhl  <bks24@cornell.edu>
+
+        gcc 4.3.3/linux-x86 generates "suggest parentheses around && within ||"
+        warnings; add some parentheses to disambiguate things. No functional
+        changes, so no tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21973
+        Add parentheses to clean up some gcc warnings
+
+        Reviewed by Dan Bernstein.
+
+        * wtf/ASCIICType.h:
+        (WTF::isASCIIAlphanumeric):
+        (WTF::isASCIIHexDigit):
+
+2008-10-30  Kevin Lindeman  <klindeman@apple.com>
+
+        Adds ProfilerServer, which is a distributed notification listener
+        that allows starting and stopping the profiler remotely for use
+        in conjunction with the profiler's DTace probes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21719
+
+        Reviewed by Timothy Hatcher.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Calls startProfilerServerIfNeeded.
+        * profiler/ProfilerServer.h: Added.
+        * profiler/ProfilerServer.mm: Added.
+        (+[ProfilerServer sharedProfileServer]):
+        (-[ProfilerServer init]):
+        (-[ProfilerServer startProfiling]):
+        (-[ProfilerServer stopProfiling]):
+        (JSC::startProfilerServerIfNeeded):
+
+2008-10-30  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix after PropertyMap and StructureID merge.
+
+        * JavaScriptCoreSources.bkl:
+
+2008-10-30  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Change the JavaScriptCore Xcode project to use relative paths for the
+        PCRE source files.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-10-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich and Geoffrey Garen.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21989
+        Merge PropertyMap and StructureID
+
+        - Move PropertyMap code into StructureID in preparation for lazily
+          creating the map on gets.
+        - Make remove with transition explicit by adding removePropertyTransition.
+        - Make the put/remove without transition explicit.
+        - Make cache invalidation part of put/remove without transition.
+
+        1% speedup on SunSpider; 0.5% speedup on v8 suite.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * kjs/AllInOneFile.cpp:
+        * kjs/identifier.h:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::removeDirect):
+        * runtime/JSObject.h:
+        (JSC::JSObject::putDirect):
+        * runtime/PropertyMap.cpp: Removed.
+        * runtime/PropertyMap.h: Removed.
+        * runtime/PropertyMapHashTable.h: Copied from runtime/PropertyMap.h.
+        * runtime/StructureID.cpp:
+        (JSC::StructureID::dumpStatistics):
+        (JSC::StructureID::StructureID):
+        (JSC::StructureID::~StructureID):
+        (JSC::StructureID::getEnumerablePropertyNames):
+        (JSC::StructureID::addPropertyTransition):
+        (JSC::StructureID::removePropertyTransition):
+        (JSC::StructureID::toDictionaryTransition):
+        (JSC::StructureID::changePrototypeTransition):
+        (JSC::StructureID::getterSetterTransition):
+        (JSC::StructureID::addPropertyWithoutTransition):
+        (JSC::StructureID::removePropertyWithoutTransition):
+        (JSC::PropertyMapStatisticsExitLogger::~PropertyMapStatisticsExitLogger):
+        (JSC::StructureID::checkConsistency):
+        (JSC::StructureID::copyPropertyTable):
+        (JSC::StructureID::get):
+        (JSC::StructureID::put):
+        (JSC::StructureID::remove):
+        (JSC::StructureID::insertIntoPropertyMapHashTable):
+        (JSC::StructureID::expandPropertyMapHashTable):
+        (JSC::StructureID::createPropertyMapHashTable):
+        (JSC::StructureID::rehashPropertyMapHashTable):
+        (JSC::comparePropertyMapEntryIndices):
+        (JSC::StructureID::getEnumerablePropertyNamesInternal):
+        * runtime/StructureID.h:
+        (JSC::StructureID::propertyStorageSize):
+        (JSC::StructureID::isEmpty):
+        (JSC::StructureID::get):
+
+2008-10-30  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 21987: CTI::putDoubleResultToJSNumberCellOrJSImmediate() hardcodes its result register
+        <https://bugs.webkit.org/show_bug.cgi?id=21987>
+
+        CTI::putDoubleResultToJSNumberCellOrJSImmediate() hardcodes its result
+        register as ecx, but it should be tempReg1, which is ecx at all of its
+        callsites.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::putDoubleResultToJSNumberCellOrJSImmediate):
+
+2008-10-30  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 21985: Opcodes should use eax as their destination register whenever possible
+        <https://bugs.webkit.org/show_bug.cgi?id=21985>
+
+        Change more opcodes to use eax as the register for their final result,
+        and change calls to emitPutResult() that pass eax to rely on the default
+        value of eax.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+
+2008-10-30  Alp Toker  <alp@nuanti.com>
+
+        Build fix attempt for older gcc on the trunk-mac-intel build bot
+        (error: initializer for scalar variable requires one element).
+
+        Modify the initializer syntax slightly with an additional comma.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_resolve_func):
+        (JSC::Machine::cti_op_post_inc):
+        (JSC::Machine::cti_op_resolve_with_base):
+        (JSC::Machine::cti_op_post_dec):
+
+2008-10-30  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21571
+        VoidPtrPair breaks CTI on Linux
+
+        The VoidPtrPair return change made in r37457 does not work on Linux
+        since POD structs aren't passed in registers.
+
+        This patch uses a union to vectorize VoidPtrPair to a uint64_t and
+        matches Darwin/MSVC fixing CTI/WREC on Linux.
+
+        Alexey reports no measurable change in Mac performance with this fix.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_resolve_func):
+        (JSC::Machine::cti_op_post_inc):
+        (JSC::Machine::cti_op_resolve_with_base):
+        (JSC::Machine::cti_op_post_dec):
+        * VM/Machine.h:
+        (JSC::):
+
+2008-10-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Initial work to reduce cost of JSNumberCell allocation
+
+        This does the initial work needed to bring more of number
+        allocation into CTI code directly, rather than just falling
+        back onto the slow paths if we can't guarantee that a number
+        cell can be reused.
+
+        Initial implementation only used by op_negate to make sure
+        it all works.  In a negate heavy (though not dominated) test
+        it results in a 10% win in the non-reusable cell case.
+
+        * VM/CTI.cpp:
+        (JSC::):
+        (JSC::CTI::emitAllocateNumber):
+        (JSC::CTI::emitNakedFastCall):
+        (JSC::CTI::emitArithIntToImmWithJump):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitUnaryOp):
+        * VM/CodeGenerator.h:
+        (JSC::CodeGenerator::emitToJSNumber):
+        (JSC::CodeGenerator::emitTypeOf):
+        (JSC::CodeGenerator::emitGetPropertyNames):
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        * VM/Machine.h:
+        * kjs/ResultType.h:
+        (JSC::ResultType::isReusableNumber):
+        (JSC::ResultType::toInt):
+        * kjs/nodes.cpp:
+        (JSC::UnaryOpNode::emitCode):
+        (JSC::BinaryOpNode::emitCode):
+        (JSC::EqualNode::emitCode):
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::negl_r):
+        (JSC::X86Assembler::xorpd_mr):
+        * runtime/JSNumberCell.h:
+        (JSC::JSNumberCell::JSNumberCell):
+
+2008-10-29  Steve Falkenburg  <sfalken@apple.com>
+
+        <rdar://problem/6326563> Crash on launch
+
+        For Windows, export explicit functions rather than exporting data for atomicallyInitializedStaticMutex.
+        
+        Exporting data from a DLL on Windows requires specifying __declspec(dllimport) in the header used by
+        callers, but __declspec(dllexport) when defined in the DLL implementation. By instead exporting
+        the explicit lock/unlock functions, we can avoid this.
+        
+        Fixes a crash on launch, since we were previously erroneously exporting atomicallyInitializedStaticMutex as a function.
+        
+        Reviewed by Darin Adler.
+
+        * wtf/Threading.h:
+        (WTF::lockAtomicallyInitializedStaticMutex):
+        (WTF::unlockAtomicallyInitializedStaticMutex):
+        * wtf/ThreadingWin.cpp:
+        (WTF::lockAtomicallyInitializedStaticMutex):
+        (WTF::unlockAtomicallyInitializedStaticMutex):
+
+2008-10-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Remove direct use of PropertyMap.
+
+        * JavaScriptCore.exp:
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::mark):
+        (JSC::JSObject::put):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::getPropertyAttributes):
+        (JSC::JSObject::removeDirect):
+        * runtime/JSObject.h:
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::hasCustomProperties):
+        (JSC::JSObject::JSObject):
+        (JSC::JSObject::putDirect):
+        * runtime/PropertyMap.cpp:
+        (JSC::PropertyMap::get):
+        * runtime/PropertyMap.h:
+        (JSC::PropertyMap::isEmpty):
+        (JSC::PropertyMap::get):
+        * runtime/StructureID.cpp:
+        (JSC::StructureID::dumpStatistics):
+        * runtime/StructureID.h:
+        (JSC::StructureID::propertyStorageSize):
+        (JSC::StructureID::get):
+        (JSC::StructureID::put):
+        (JSC::StructureID::remove):
+        (JSC::StructureID::isEmpty):
+
+2008-10-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Rename and move the StructureID transition table to its own file.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/StructureID.cpp:
+        (JSC::StructureID::addPropertyTransition):
+        * runtime/StructureID.h:
+        (JSC::StructureID::):
+        * runtime/StructureIDTransitionTable.h: Copied from runtime/StructureID.h.
+        (JSC::StructureIDTransitionTableHash::hash):
+        (JSC::StructureIDTransitionTableHash::equal):
+
+2008-10-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21958
+        Pack bits in StructureID to reduce the size of each StructureID by 2 words.
+
+        * runtime/PropertyMap.h:
+        (JSC::PropertyMap::propertyMapSize):
+        * runtime/StructureID.cpp:
+        (JSC::StructureID::dumpStatistics): Add additional size statistics when dumping.
+        (JSC::StructureID::StructureID):
+        * runtime/StructureID.h:
+
+2008-10-29  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes after addition of runtime and ImageBuffer changes.
+
+        * JavaScriptCoreSources.bkl:
+        * jscore.bkl:
+
+2008-10-29  Timothy Hatcher  <timothy@apple.com>
+
+        Emit the WillExecuteStatement debugger hook before the "else" body
+        when there is no block for the "else" body. This allows breakpoints
+        on those statements in the Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21944
+
+        Reviewed by Maciej Stachowiak.
+
+        * kjs/nodes.cpp:
+        (JSC::IfElseNode::emitCode): Emit the WillExecuteStatement
+        debugger hook before the else node if isn't a block.
+
+2008-10-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Build fix.
+
+        * JavaScriptCore.exp: Export HashTable::deleteTable().
+
+2008-10-28  Alp Toker  <alp@nuanti.com>
+
+        Fix builddir != srcdir builds after kjs -> runtime breakage. Sources
+        may now be generated in both kjs/ and runtime/.
+
+        Also sort the sources list for readability.
+
+        * GNUmakefile.am:
+
+2008-10-28  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Build fix attempt after kjs -> runtime rename.
+
+        * GNUmakefile.am:
+
+2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Remove a duplicate includes directory.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Attempt to fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+
+2008-10-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - export WTF::atomicallyInitializedStaticMutex
+
+        * JavaScriptCore.exp:
+
+2008-10-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed CodeBlock dumping to accurately report constant register indices.
+
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+
+2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        More Qt build fixes.
+
+        * JavaScriptCore.pri:
+
+2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Fix the Qt build, hopefully for real this time.
+
+        * JavaScriptCore.pri:
+
+2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Fix the Qt build.
+
+        * JavaScriptCore.pri:
+
+2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Fix the Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Create a runtime directory in JavaScriptCore and begin moving files to
+        it. This is the first step towards removing the kjs directory and
+        placing files in more meaningful subdirectories of JavaScriptCore.
+
+        * API/JSBase.cpp:
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackFunction.cpp:
+        * API/JSClassRef.cpp:
+        * API/JSClassRef.h:
+        * API/JSStringRefCF.cpp:
+        * API/JSValueRef.cpp:
+        * API/OpaqueJSString.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/AllInOneFile.cpp:
+        * kjs/ArrayConstructor.cpp: Removed.
+        * kjs/ArrayConstructor.h: Removed.
+        * kjs/ArrayPrototype.cpp: Removed.
+        * kjs/ArrayPrototype.h: Removed.
+        * kjs/BooleanConstructor.cpp: Removed.
+        * kjs/BooleanConstructor.h: Removed.
+        * kjs/BooleanObject.cpp: Removed.
+        * kjs/BooleanObject.h: Removed.
+        * kjs/BooleanPrototype.cpp: Removed.
+        * kjs/BooleanPrototype.h: Removed.
+        * kjs/CallData.cpp: Removed.
+        * kjs/CallData.h: Removed.
+        * kjs/ClassInfo.h: Removed.
+        * kjs/ConstructData.cpp: Removed.
+        * kjs/ConstructData.h: Removed.
+        * kjs/DateConstructor.cpp: Removed.
+        * kjs/DateConstructor.h: Removed.
+        * kjs/DateInstance.cpp: Removed.
+        * kjs/DateInstance.h: Removed.
+        * kjs/DateMath.cpp: Removed.
+        * kjs/DateMath.h: Removed.
+        * kjs/DatePrototype.cpp: Removed.
+        * kjs/DatePrototype.h: Removed.
+        * kjs/Error.cpp: Removed.
+        * kjs/Error.h: Removed.
+        * kjs/ErrorConstructor.cpp: Removed.
+        * kjs/ErrorConstructor.h: Removed.
+        * kjs/ErrorInstance.cpp: Removed.
+        * kjs/ErrorInstance.h: Removed.
+        * kjs/ErrorPrototype.cpp: Removed.
+        * kjs/ErrorPrototype.h: Removed.
+        * kjs/FunctionConstructor.cpp: Removed.
+        * kjs/FunctionConstructor.h: Removed.
+        * kjs/FunctionPrototype.cpp: Removed.
+        * kjs/FunctionPrototype.h: Removed.
+        * kjs/GlobalEvalFunction.cpp: Removed.
+        * kjs/GlobalEvalFunction.h: Removed.
+        * kjs/InternalFunction.cpp: Removed.
+        * kjs/InternalFunction.h: Removed.
+        * kjs/JSArray.cpp: Removed.
+        * kjs/JSArray.h: Removed.
+        * kjs/JSCell.cpp: Removed.
+        * kjs/JSCell.h: Removed.
+        * kjs/JSFunction.cpp: Removed.
+        * kjs/JSFunction.h: Removed.
+        * kjs/JSGlobalObject.cpp: Removed.
+        * kjs/JSGlobalObject.h: Removed.
+        * kjs/JSGlobalObjectFunctions.cpp: Removed.
+        * kjs/JSGlobalObjectFunctions.h: Removed.
+        * kjs/JSImmediate.cpp: Removed.
+        * kjs/JSImmediate.h: Removed.
+        * kjs/JSNotAnObject.cpp: Removed.
+        * kjs/JSNotAnObject.h: Removed.
+        * kjs/JSNumberCell.cpp: Removed.
+        * kjs/JSNumberCell.h: Removed.
+        * kjs/JSObject.cpp: Removed.
+        * kjs/JSObject.h: Removed.
+        * kjs/JSString.cpp: Removed.
+        * kjs/JSString.h: Removed.
+        * kjs/JSValue.cpp: Removed.
+        * kjs/JSValue.h: Removed.
+        * kjs/JSVariableObject.cpp: Removed.
+        * kjs/JSVariableObject.h: Removed.
+        * kjs/JSWrapperObject.cpp: Removed.
+        * kjs/JSWrapperObject.h: Removed.
+        * kjs/MathObject.cpp: Removed.
+        * kjs/MathObject.h: Removed.
+        * kjs/NativeErrorConstructor.cpp: Removed.
+        * kjs/NativeErrorConstructor.h: Removed.
+        * kjs/NativeErrorPrototype.cpp: Removed.
+        * kjs/NativeErrorPrototype.h: Removed.
+        * kjs/NumberConstructor.cpp: Removed.
+        * kjs/NumberConstructor.h: Removed.
+        * kjs/NumberObject.cpp: Removed.
+        * kjs/NumberObject.h: Removed.
+        * kjs/NumberPrototype.cpp: Removed.
+        * kjs/NumberPrototype.h: Removed.
+        * kjs/ObjectConstructor.cpp: Removed.
+        * kjs/ObjectConstructor.h: Removed.
+        * kjs/ObjectPrototype.cpp: Removed.
+        * kjs/ObjectPrototype.h: Removed.
+        * kjs/PropertyMap.cpp: Removed.
+        * kjs/PropertyMap.h: Removed.
+        * kjs/PropertySlot.cpp: Removed.
+        * kjs/PropertySlot.h: Removed.
+        * kjs/PrototypeFunction.cpp: Removed.
+        * kjs/PrototypeFunction.h: Removed.
+        * kjs/PutPropertySlot.h: Removed.
+        * kjs/SmallStrings.cpp: Removed.
+        * kjs/SmallStrings.h: Removed.
+        * kjs/StringConstructor.cpp: Removed.
+        * kjs/StringConstructor.h: Removed.
+        * kjs/StringObject.cpp: Removed.
+        * kjs/StringObject.h: Removed.
+        * kjs/StringObjectThatMasqueradesAsUndefined.h: Removed.
+        * kjs/StringPrototype.cpp: Removed.
+        * kjs/StringPrototype.h: Removed.
+        * kjs/StructureID.cpp: Removed.
+        * kjs/StructureID.h: Removed.
+        * kjs/completion.h:
+        * kjs/interpreter.h:
+        * runtime: Added.
+        * runtime/ArrayConstructor.cpp: Copied from kjs/ArrayConstructor.cpp.
+        * runtime/ArrayConstructor.h: Copied from kjs/ArrayConstructor.h.
+        * runtime/ArrayPrototype.cpp: Copied from kjs/ArrayPrototype.cpp.
+        * runtime/ArrayPrototype.h: Copied from kjs/ArrayPrototype.h.
+        * runtime/BooleanConstructor.cpp: Copied from kjs/BooleanConstructor.cpp.
+        * runtime/BooleanConstructor.h: Copied from kjs/BooleanConstructor.h.
+        * runtime/BooleanObject.cpp: Copied from kjs/BooleanObject.cpp.
+        * runtime/BooleanObject.h: Copied from kjs/BooleanObject.h.
+        * runtime/BooleanPrototype.cpp: Copied from kjs/BooleanPrototype.cpp.
+        * runtime/BooleanPrototype.h: Copied from kjs/BooleanPrototype.h.
+        * runtime/CallData.cpp: Copied from kjs/CallData.cpp.
+        * runtime/CallData.h: Copied from kjs/CallData.h.
+        * runtime/ClassInfo.h: Copied from kjs/ClassInfo.h.
+        * runtime/ConstructData.cpp: Copied from kjs/ConstructData.cpp.
+        * runtime/ConstructData.h: Copied from kjs/ConstructData.h.
+        * runtime/DateConstructor.cpp: Copied from kjs/DateConstructor.cpp.
+        * runtime/DateConstructor.h: Copied from kjs/DateConstructor.h.
+        * runtime/DateInstance.cpp: Copied from kjs/DateInstance.cpp.
+        * runtime/DateInstance.h: Copied from kjs/DateInstance.h.
+        * runtime/DateMath.cpp: Copied from kjs/DateMath.cpp.
+        * runtime/DateMath.h: Copied from kjs/DateMath.h.
+        * runtime/DatePrototype.cpp: Copied from kjs/DatePrototype.cpp.
+        * runtime/DatePrototype.h: Copied from kjs/DatePrototype.h.
+        * runtime/Error.cpp: Copied from kjs/Error.cpp.
+        * runtime/Error.h: Copied from kjs/Error.h.
+        * runtime/ErrorConstructor.cpp: Copied from kjs/ErrorConstructor.cpp.
+        * runtime/ErrorConstructor.h: Copied from kjs/ErrorConstructor.h.
+        * runtime/ErrorInstance.cpp: Copied from kjs/ErrorInstance.cpp.
+        * runtime/ErrorInstance.h: Copied from kjs/ErrorInstance.h.
+        * runtime/ErrorPrototype.cpp: Copied from kjs/ErrorPrototype.cpp.
+        * runtime/ErrorPrototype.h: Copied from kjs/ErrorPrototype.h.
+        * runtime/FunctionConstructor.cpp: Copied from kjs/FunctionConstructor.cpp.
+        * runtime/FunctionConstructor.h: Copied from kjs/FunctionConstructor.h.
+        * runtime/FunctionPrototype.cpp: Copied from kjs/FunctionPrototype.cpp.
+        * runtime/FunctionPrototype.h: Copied from kjs/FunctionPrototype.h.
+        * runtime/GlobalEvalFunction.cpp: Copied from kjs/GlobalEvalFunction.cpp.
+        * runtime/GlobalEvalFunction.h: Copied from kjs/GlobalEvalFunction.h.
+        * runtime/InternalFunction.cpp: Copied from kjs/InternalFunction.cpp.
+        * runtime/InternalFunction.h: Copied from kjs/InternalFunction.h.
+        * runtime/JSArray.cpp: Copied from kjs/JSArray.cpp.
+        * runtime/JSArray.h: Copied from kjs/JSArray.h.
+        * runtime/JSCell.cpp: Copied from kjs/JSCell.cpp.
+        * runtime/JSCell.h: Copied from kjs/JSCell.h.
+        * runtime/JSFunction.cpp: Copied from kjs/JSFunction.cpp.
+        * runtime/JSFunction.h: Copied from kjs/JSFunction.h.
+        * runtime/JSGlobalObject.cpp: Copied from kjs/JSGlobalObject.cpp.
+        * runtime/JSGlobalObject.h: Copied from kjs/JSGlobalObject.h.
+        * runtime/JSGlobalObjectFunctions.cpp: Copied from kjs/JSGlobalObjectFunctions.cpp.
+        * runtime/JSGlobalObjectFunctions.h: Copied from kjs/JSGlobalObjectFunctions.h.
+        * runtime/JSImmediate.cpp: Copied from kjs/JSImmediate.cpp.
+        * runtime/JSImmediate.h: Copied from kjs/JSImmediate.h.
+        * runtime/JSNotAnObject.cpp: Copied from kjs/JSNotAnObject.cpp.
+        * runtime/JSNotAnObject.h: Copied from kjs/JSNotAnObject.h.
+        * runtime/JSNumberCell.cpp: Copied from kjs/JSNumberCell.cpp.
+        * runtime/JSNumberCell.h: Copied from kjs/JSNumberCell.h.
+        * runtime/JSObject.cpp: Copied from kjs/JSObject.cpp.
+        * runtime/JSObject.h: Copied from kjs/JSObject.h.
+        * runtime/JSString.cpp: Copied from kjs/JSString.cpp.
+        * runtime/JSString.h: Copied from kjs/JSString.h.
+        * runtime/JSValue.cpp: Copied from kjs/JSValue.cpp.
+        * runtime/JSValue.h: Copied from kjs/JSValue.h.
+        * runtime/JSVariableObject.cpp: Copied from kjs/JSVariableObject.cpp.
+        * runtime/JSVariableObject.h: Copied from kjs/JSVariableObject.h.
+        * runtime/JSWrapperObject.cpp: Copied from kjs/JSWrapperObject.cpp.
+        * runtime/JSWrapperObject.h: Copied from kjs/JSWrapperObject.h.
+        * runtime/MathObject.cpp: Copied from kjs/MathObject.cpp.
+        * runtime/MathObject.h: Copied from kjs/MathObject.h.
+        * runtime/NativeErrorConstructor.cpp: Copied from kjs/NativeErrorConstructor.cpp.
+        * runtime/NativeErrorConstructor.h: Copied from kjs/NativeErrorConstructor.h.
+        * runtime/NativeErrorPrototype.cpp: Copied from kjs/NativeErrorPrototype.cpp.
+        * runtime/NativeErrorPrototype.h: Copied from kjs/NativeErrorPrototype.h.
+        * runtime/NumberConstructor.cpp: Copied from kjs/NumberConstructor.cpp.
+        * runtime/NumberConstructor.h: Copied from kjs/NumberConstructor.h.
+        * runtime/NumberObject.cpp: Copied from kjs/NumberObject.cpp.
+        * runtime/NumberObject.h: Copied from kjs/NumberObject.h.
+        * runtime/NumberPrototype.cpp: Copied from kjs/NumberPrototype.cpp.
+        * runtime/NumberPrototype.h: Copied from kjs/NumberPrototype.h.
+        * runtime/ObjectConstructor.cpp: Copied from kjs/ObjectConstructor.cpp.
+        * runtime/ObjectConstructor.h: Copied from kjs/ObjectConstructor.h.
+        * runtime/ObjectPrototype.cpp: Copied from kjs/ObjectPrototype.cpp.
+        * runtime/ObjectPrototype.h: Copied from kjs/ObjectPrototype.h.
+        * runtime/PropertyMap.cpp: Copied from kjs/PropertyMap.cpp.
+        * runtime/PropertyMap.h: Copied from kjs/PropertyMap.h.
+        * runtime/PropertySlot.cpp: Copied from kjs/PropertySlot.cpp.
+        * runtime/PropertySlot.h: Copied from kjs/PropertySlot.h.
+        * runtime/PrototypeFunction.cpp: Copied from kjs/PrototypeFunction.cpp.
+        * runtime/PrototypeFunction.h: Copied from kjs/PrototypeFunction.h.
+        * runtime/PutPropertySlot.h: Copied from kjs/PutPropertySlot.h.
+        * runtime/SmallStrings.cpp: Copied from kjs/SmallStrings.cpp.
+        * runtime/SmallStrings.h: Copied from kjs/SmallStrings.h.
+        * runtime/StringConstructor.cpp: Copied from kjs/StringConstructor.cpp.
+        * runtime/StringConstructor.h: Copied from kjs/StringConstructor.h.
+        * runtime/StringObject.cpp: Copied from kjs/StringObject.cpp.
+        * runtime/StringObject.h: Copied from kjs/StringObject.h.
+        * runtime/StringObjectThatMasqueradesAsUndefined.h: Copied from kjs/StringObjectThatMasqueradesAsUndefined.h.
+        * runtime/StringPrototype.cpp: Copied from kjs/StringPrototype.cpp.
+        * runtime/StringPrototype.h: Copied from kjs/StringPrototype.h.
+        * runtime/StructureID.cpp: Copied from kjs/StructureID.cpp.
+        * runtime/StructureID.h: Copied from kjs/StructureID.h.
+
+2008-10-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=21919
+        Sampler reports bogus time in op_enter during 3d-raytrace.js
+        
+        Fixed a bug where we would pass the incorrect Instruction* during some
+        parts of CTI codegen.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/SamplingTool.cpp:
+        (JSC::SamplingTool::run):
+        * wtf/Platform.h:
+
+2008-10-28  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        -Removed unused includes.
+        Apparent .4% speedup in Sunspider
+
+        * kjs/JSObject.cpp:
+        * kjs/interpreter.cpp:
+
+2008-10-28  Alp Toker  <alp@nuanti.com>
+
+        Include copyright license files in the autotools dist target.
+
+        Change suggested by Mike Hommey.
+
+        * GNUmakefile.am:
+
+2008-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Stop discarding CodeBlock samples that can't be charged to a specific
+        opcode. Instead, charge the relevant CodeBlock, and provide a footnote
+        explaining the situation.
+        
+        This will help us tell which CodeBlocks are hot, even if we can't
+        identify specific lines of code within the CodeBlocks.
+
+        * VM/SamplingTool.cpp:
+        (JSC::ScopeSampleRecord::sample):
+        (JSC::compareScopeSampleRecords):
+        (JSC::SamplingTool::dump):
+
+        * VM/SamplingTool.h:
+        (JSC::ScopeSampleRecord::ScopeSampleRecord):
+        (JSC::ScopeSampleRecord::~ScopeSampleRecord):
+
+2008-10-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Added a mutex around the SamplingTool's ScopeNode* map, to solve a crash
+        when sampling the v8 tests.
+
+        * VM/SamplingTool.cpp:
+        (JSC::SamplingTool::run):
+        (JSC::SamplingTool::notifyOfScope):
+        * VM/SamplingTool.h: Since new ScopeNodes can be created after
+        the SamplingTools has begun sampling, reads and writes to / from the
+        map need to be synchronized. Shark says this doesn't measurably increase
+        sampling overhead.
+
+2008-10-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute): Provide a dummy value to the
+        HostCallRecord in CTI non-sampling builds, to silence compiler warning.
+
+2008-10-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Windows build.
+
+        * VM/SamplingTool.h:
+        (JSC::SamplingTool::encodeSample): Explicitly cast bool to int, to
+        silence compiler warning.
+
+2008-10-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig, with Gavin Barraclough's help.
+        
+        Fixed Sampling Tool:
+            - Made CodeBlock sampling work with CTI
+            - Improved accuracy by unifying most sampling data into a single
+              32bit word, which can be written / read atomically.
+            - Split out three different #ifdefs for modularity: OPCODE_SAMPLING;
+              CODEBLOCK_SAMPLING; OPCODE_STATS.
+            - Improved reporting clarity
+            - Refactored for code clarity
+
+        * JavaScriptCore.exp: Exported another symbol.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitCTICall):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        * VM/CTI.h: Updated CTI codegen to use the unified SamplingTool interface
+        for encoding samples. (This required passing the current vPC to a lot
+        more functions, since the unified interface samples the current vPC.)
+        Added hooks for writing the current CodeBlock* on function entry and
+        after a function call, for the sake of the CodeBlock sampler. Removed
+        obsolete hook for clearing the current sample inside op_end. Also removed
+        the custom enum used to differentiate flavors of op_call, since the
+        OpcodeID enum works just as well. (This was important in an earlier
+        version of the patch, but now it's just cleanup.)
+
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::lineNumberForVPC):
+        * VM/CodeBlock.h: Upated for refactored #ifdefs. Changed lineNumberForVPC
+        to be robust against vPCs not recorded for exception handling, since
+        the Sampler may ask for an arbitrary vPC.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::execute):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        * VM/Machine.h:
+        (JSC::Machine::setSampler):
+        (JSC::Machine::sampler):
+        (JSC::Machine::jitCodeBuffer): Upated for refactored #ifdefs. Changed
+        Machine to use SamplingTool helper objects to record movement in and
+        out of host code. This makes samples a bit more precise.
+        
+        * VM/Opcode.cpp:
+        (JSC::OpcodeStats::~OpcodeStats):
+        * VM/Opcode.h: Upated for refactored #ifdefs. Added a little more padding,
+        to accomodate our more verbose opcode names.
+
+        * VM/SamplingTool.cpp:
+        (JSC::ScopeSampleRecord::sample): Only count a sample toward our total
+        if we actually record it. This solves cases where a CodeBlock will
+        claim to have been sampled many times, with reported samples that don't
+        match.
+
+        (JSC::SamplingTool::run): Read the current sample into a Sample helper
+        object, to ensure that the data doesn't change while we're analyzing it,
+        and to help decode the data. Only access the CodeBlock sampling hash
+        table if CodeBlock sampling has been enabled, so non-CodeBlock sampling
+        runs can operate with even less overhead.
+
+        (JSC::SamplingTool::dump): I reorganized this code a lot to print the
+        most important info at the top, print as a table, annotate and document
+        the stuff I didn't understand when I started, etc.
+
+        * VM/SamplingTool.h: New helper classes, described above.
+
+        * kjs/Parser.h:
+        * kjs/Shell.cpp:
+        (runWithScripts):
+        * kjs/nodes.cpp:
+        (JSC::ScopeNode::ScopeNode): Updated for new sampling APIs.
+
+        * wtf/Platform.h: Moved sampling #defines here, since our custom is to
+        put ENABLE #defines into Platform.h. Made explicit the fact that
+        CODEBLOCK_SAMPLING depends on OPCODE_SAMPLING.
+
+2008-10-25  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        JSC Build fix, not reviewed.
+
+        * VM/CTI.cpp: add missing include stdio.h for debug builds
+
+2008-10-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+        
+        Get rid of a bonus ASSERT when using a null string as a regexp.
+        Specifically calling: RegularExpression::match() with String::empty()
+        will hit this ASSERT.
+        Chromium hits this, but I don't know of any way to make a layout test.
+
+        * pcre/pcre_exec.cpp:
+        (jsRegExpExecute):
+
+2008-10-24  Alexey Proskuryakov  <ap@webkit.org>
+
+        Suggested and rubber-stamped by Geoff Garen.
+
+        Fix a crash when opening Font Picker.
+
+        The change also hopefully fixes this bug, which I could never reproduce:
+        https://bugs.webkit.org/show_bug.cgi?id=20241
+        <rdar://problem/6290576> Safari crashes at JSValueUnprotect() when fontpicker view close
+
+        * API/JSContextRef.cpp: (JSContextGetGlobalObject): Use lexical global object instead of
+        dynamic one.
+
+2008-10-24  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Remove ScopeChainNode::bottom() and inline it into its only caller,
+        ScopeChainnode::globalObject().
+
+        * kjs/JSGlobalObject.h:
+        (JSC::ScopeChainNode::globalObject):
+        * kjs/ScopeChain.h:
+        (JSC::ScopeChain::bottom):
+
+2008-10-24  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21862: Create JSFunction prototype property lazily
+        <https://bugs.webkit.org/show_bug.cgi?id=21862>
+
+        This is a 1.5% speedup on SunSpider and a 1.4% speedup on the V8
+        benchmark suite, including a 3.8% speedup on Earley-Boyer.
+
+        * kjs/JSFunction.cpp:
+        (JSC::JSFunction::getOwnPropertySlot):
+        * kjs/nodes.cpp:
+        (JSC::FuncDeclNode::makeFunction):
+        (JSC::FuncExprNode::makeFunction):
+
+2008-10-24  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21475
+        
+        Provide support for the Geolocation API
+        
+        http://dev.w3.org/geo/api/spec-source.html
+
+        * wtf/Platform.h: ENABLE_GEOLOCATION defaults to 0
+
+2008-10-24  Darin Adler  <darin@apple.com>
+
+        - finish rolling out https://bugs.webkit.org/show_bug.cgi?id=21732
+
+        * API/APICast.h:
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        * API/JSValueRef.cpp:
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        * VM/CodeBlock.h:
+        * VM/CodeGenerator.cpp:
+        * VM/CodeGenerator.h:
+        * VM/ExceptionHelpers.cpp:
+        * VM/ExceptionHelpers.h:
+        * VM/JSPropertyNameIterator.cpp:
+        * VM/JSPropertyNameIterator.h:
+        * VM/Machine.cpp:
+        * VM/Machine.h:
+        * VM/Register.h:
+        * kjs/ArgList.cpp:
+        * kjs/ArgList.h:
+        * kjs/Arguments.cpp:
+        * kjs/Arguments.h:
+        * kjs/ArrayConstructor.cpp:
+        * kjs/ArrayPrototype.cpp:
+        * kjs/BooleanConstructor.cpp:
+        * kjs/BooleanConstructor.h:
+        * kjs/BooleanObject.h:
+        * kjs/BooleanPrototype.cpp:
+        * kjs/CallData.cpp:
+        * kjs/CallData.h:
+        * kjs/ConstructData.cpp:
+        * kjs/ConstructData.h:
+        * kjs/DateConstructor.cpp:
+        * kjs/DateInstance.h:
+        * kjs/DatePrototype.cpp:
+        * kjs/DatePrototype.h:
+        * kjs/DebuggerCallFrame.cpp:
+        * kjs/DebuggerCallFrame.h:
+        * kjs/ErrorConstructor.cpp:
+        * kjs/ErrorPrototype.cpp:
+        * kjs/ExecState.cpp:
+        * kjs/ExecState.h:
+        * kjs/FunctionConstructor.cpp:
+        * kjs/FunctionPrototype.cpp:
+        * kjs/FunctionPrototype.h:
+        * kjs/GetterSetter.cpp:
+        * kjs/GetterSetter.h:
+        * kjs/InternalFunction.h:
+        * kjs/JSActivation.cpp:
+        * kjs/JSActivation.h:
+        * kjs/JSArray.cpp:
+        * kjs/JSArray.h:
+        * kjs/JSCell.cpp:
+        * kjs/JSCell.h:
+        * kjs/JSFunction.cpp:
+        * kjs/JSFunction.h:
+        * kjs/JSGlobalData.h:
+        * kjs/JSGlobalObject.cpp:
+        * kjs/JSGlobalObject.h:
+        * kjs/JSGlobalObjectFunctions.cpp:
+        * kjs/JSGlobalObjectFunctions.h:
+        * kjs/JSImmediate.cpp:
+        * kjs/JSImmediate.h:
+        * kjs/JSNotAnObject.cpp:
+        * kjs/JSNotAnObject.h:
+        * kjs/JSNumberCell.cpp:
+        * kjs/JSNumberCell.h:
+        * kjs/JSObject.cpp:
+        * kjs/JSObject.h:
+        * kjs/JSStaticScopeObject.cpp:
+        * kjs/JSStaticScopeObject.h:
+        * kjs/JSString.cpp:
+        * kjs/JSString.h:
+        * kjs/JSValue.h:
+        * kjs/JSVariableObject.h:
+        * kjs/JSWrapperObject.h:
+        * kjs/MathObject.cpp:
+        * kjs/MathObject.h:
+        * kjs/NativeErrorConstructor.cpp:
+        * kjs/NumberConstructor.cpp:
+        * kjs/NumberConstructor.h:
+        * kjs/NumberObject.cpp:
+        * kjs/NumberObject.h:
+        * kjs/NumberPrototype.cpp:
+        * kjs/ObjectConstructor.cpp:
+        * kjs/ObjectPrototype.cpp:
+        * kjs/ObjectPrototype.h:
+        * kjs/PropertyMap.h:
+        * kjs/PropertySlot.cpp:
+        * kjs/PropertySlot.h:
+        * kjs/RegExpConstructor.cpp:
+        * kjs/RegExpConstructor.h:
+        * kjs/RegExpMatchesArray.h:
+        * kjs/RegExpObject.cpp:
+        * kjs/RegExpObject.h:
+        * kjs/RegExpPrototype.cpp:
+        * kjs/Shell.cpp:
+        * kjs/StringConstructor.cpp:
+        * kjs/StringObject.cpp:
+        * kjs/StringObject.h:
+        * kjs/StringObjectThatMasqueradesAsUndefined.h:
+        * kjs/StringPrototype.cpp:
+        * kjs/StructureID.cpp:
+        * kjs/StructureID.h:
+        * kjs/collector.cpp:
+        * kjs/collector.h:
+        * kjs/completion.h:
+        * kjs/grammar.y:
+        * kjs/interpreter.cpp:
+        * kjs/interpreter.h:
+        * kjs/lookup.cpp:
+        * kjs/lookup.h:
+        * kjs/nodes.h:
+        * kjs/operations.cpp:
+        * kjs/operations.h:
+        * kjs/protect.h:
+        * profiler/ProfileGenerator.cpp:
+        * profiler/Profiler.cpp:
+        * profiler/Profiler.h:
+        Use JSValue* instead of JSValuePtr.
+
+2008-10-24  David Kilzer  <ddkilzer@apple.com>
+
+        Rolled out r37840.
+
+        * wtf/Platform.h:
+
+2008-10-23  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21475
+        
+        Provide support for the Geolocation API
+        
+        http://dev.w3.org/geo/api/spec-source.html
+
+        * wtf/Platform.h: ENABLE_GEOLOCATION defaults to 0
+
+2008-10-23  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 21832: Fix scripts using 'new File::Temp' for Perl 5.10
+
+        <https://bugs.webkit.org/show_bug.cgi?id=21832>
+
+        Reviewed by Sam Weinig.
+
+        * pcre/dftables: Use imported tempfile() from File::Temp instead of
+        'new File::Temp' to make the script work with Perl 5.10.
+
+2008-10-23  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix hideous pathological case performance when looking up repatch info, bug #21727.
+
+        When repatching JIT code to optimize we look up records providing information about
+        the generated code (also used to track recsources used in linking to be later released). 
+        The lookup was being performed using a linear scan of all such records.
+
+        (1) Split up the different types of reptach information.  This means we can search them
+            separately, and in some cases should reduce their size.
+        (2) In the case of property accesses, search with a binary chop over the data.
+        (3) In the case of calls, pass a pointer to the repatch info into the relink function.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::CTI):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::unlinkCall):
+        (JSC::CTI::linkCall):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::unlinkCallers):
+        (JSC::CodeBlock::derefStructureIDs):
+        * VM/CodeBlock.h:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        (JSC::CallLinkInfo::CallLinkInfo):
+        (JSC::CallLinkInfo::setUnlinked):
+        (JSC::CallLinkInfo::isLinked):
+        (JSC::getStructureStubInfoReturnLocation):
+        (JSC::binaryChop):
+        (JSC::CodeBlock::addCaller):
+        (JSC::CodeBlock::getStubInfo):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitResolve):
+        (JSC::CodeGenerator::emitGetById):
+        (JSC::CodeGenerator::emitPutById):
+        (JSC::CodeGenerator::emitCall):
+        (JSC::CodeGenerator::emitConstruct):
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_vm_lazyLinkCall):
+
+2008-10-23  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21833
+        Place JavaScript Debugger hooks under #if ENABLE(JAVASCRIPT_DEBUGGER).
+
+        * wtf/Platform.h:
+
+2008-10-23  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 21831: Fix create_hash_table for Perl 5.10
+
+        <https://bugs.webkit.org/show_bug.cgi?id=21831>
+
+        Reviewed by Sam Weinig.
+
+        * kjs/create_hash_table: Escaped square brackets so that Perl 5.10
+        doesn't try to use @nameEntries.
+
+2008-10-23  Darin Adler  <darin@apple.com>
+
+        - roll out https://bugs.webkit.org/show_bug.cgi?id=21732
+          to remove the JSValuePtr class, to fix two problems
+
+            1) slowness under MSVC, since it doesn't handle a
+               class with a single pointer in it as efficiently
+               as a pointer
+
+            2) uninitialized pointers in Vector
+
+        * JavaScriptCore.exp: Updated.
+
+        * API/APICast.h:
+        (toRef):
+        * VM/CTI.cpp:
+        (JSC::CTI::asInteger):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::addConstant):
+        * VM/CodeGenerator.h:
+        (JSC::CodeGenerator::JSValueHashTraits::constructDeletedValue):
+        (JSC::CodeGenerator::JSValueHashTraits::isDeletedValue):
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_add):
+        (JSC::Machine::cti_op_pre_inc):
+        (JSC::Machine::cti_op_get_by_id):
+        (JSC::Machine::cti_op_get_by_id_second):
+        (JSC::Machine::cti_op_get_by_id_generic):
+        (JSC::Machine::cti_op_get_by_id_fail):
+        (JSC::Machine::cti_op_instanceof):
+        (JSC::Machine::cti_op_del_by_id):
+        (JSC::Machine::cti_op_mul):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_resolve):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        (JSC::Machine::cti_op_get_by_val):
+        (JSC::Machine::cti_op_sub):
+        (JSC::Machine::cti_op_lesseq):
+        (JSC::Machine::cti_op_negate):
+        (JSC::Machine::cti_op_resolve_base):
+        (JSC::Machine::cti_op_resolve_skip):
+        (JSC::Machine::cti_op_resolve_global):
+        (JSC::Machine::cti_op_div):
+        (JSC::Machine::cti_op_pre_dec):
+        (JSC::Machine::cti_op_not):
+        (JSC::Machine::cti_op_eq):
+        (JSC::Machine::cti_op_lshift):
+        (JSC::Machine::cti_op_bitand):
+        (JSC::Machine::cti_op_rshift):
+        (JSC::Machine::cti_op_bitnot):
+        (JSC::Machine::cti_op_mod):
+        (JSC::Machine::cti_op_less):
+        (JSC::Machine::cti_op_neq):
+        (JSC::Machine::cti_op_urshift):
+        (JSC::Machine::cti_op_bitxor):
+        (JSC::Machine::cti_op_bitor):
+        (JSC::Machine::cti_op_call_eval):
+        (JSC::Machine::cti_op_throw):
+        (JSC::Machine::cti_op_next_pname):
+        (JSC::Machine::cti_op_typeof):
+        (JSC::Machine::cti_op_is_undefined):
+        (JSC::Machine::cti_op_is_boolean):
+        (JSC::Machine::cti_op_is_number):
+        (JSC::Machine::cti_op_is_string):
+        (JSC::Machine::cti_op_is_object):
+        (JSC::Machine::cti_op_is_function):
+        (JSC::Machine::cti_op_stricteq):
+        (JSC::Machine::cti_op_nstricteq):
+        (JSC::Machine::cti_op_to_jsnumber):
+        (JSC::Machine::cti_op_in):
+        (JSC::Machine::cti_op_del_by_val):
+        (JSC::Machine::cti_vm_throw):
+        Removed calls to payload functions.
+
+        * VM/Register.h:
+        (JSC::Register::Register): Removed overload for JSCell and call
+        to payload function.
+
+        * kjs/JSCell.h: Changed JSCell to derive from JSValue again.
+        Removed JSValuePtr constructor.
+        (JSC::asCell): Changed cast from reinterpret_cast to static_cast.
+
+        * kjs/JSImmediate.h: Removed JSValuePtr class. Added typedef back.
+
+        * kjs/JSValue.h:
+        (JSC::JSValue::JSValue): Added empty protected inline constructor back.
+        (JSC::JSValue::~JSValue): Same for destructor.
+        Removed == and != operator for JSValuePtr.
+
+        * kjs/PropertySlot.h:
+        (JSC::PropertySlot::PropertySlot): Chnaged argument to const JSValue*
+        and added a const_cast.
+
+        * kjs/protect.h: Removed overloads and specialization for JSValuePtr.
+
+2008-10-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Really "fix" CTI mode on windows 2k3.
+
+        This adds new methods fastMallocExecutable and fastFreeExecutable
+        to wrap allocation for cti code.  This still just makes fastMalloc
+        return executable memory all the time, which will be fixed in a
+        later patch.
+
+        However in windows debug builds all executable allocations will be
+        allocated on separate executable pages, which should resolve any
+        remaining 2k3 issues.  Conveniently the 2k3 bot will now also fail
+        if there are any fastFree vs. fastFreeExecutable errors.
+
+        * ChangeLog:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        * kjs/regexp.cpp:
+        (JSC::RegExp::~RegExp):
+        * masm/X86Assembler.h:
+        (JSC::JITCodeBuffer::copy):
+        * wtf/FastMalloc.cpp:
+        (WTF::fastMallocExecutable):
+        (WTF::fastFreeExecutable):
+        (WTF::TCMallocStats::fastMallocExecutable):
+        (WTF::TCMallocStats::fastFreeExecutable):
+        * wtf/FastMalloc.h:
+
+2008-10-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=21294
+          Bug 21294: Devirtualize getOwnPropertySlot()
+
+        A bit over 3% faster on V8 tests.
+
+        * JavascriptCore.exp: Export leak-related functions..
+
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructureID): Set HasStandardGetOwnPropertySlot
+        since this class doesn't override getPropertySlot.
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructureID): Ditto.
+
+        * VM/ExceptionHelpers.cpp:
+        (JSC::InterruptedExecutionError::InterruptedExecutionError): Use a structure
+        that's created just for this class instead of trying to share a single "null
+        prototype" structure.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_create_arguments_no_params): Rename
+        Arguments::ArgumentsNoParameters to Arguments::NoParameters.
+        
+        * kjs/Arguments.h: Rename the enum from Arguments::ArgumentsParameters to
+        Arguments::NoParametersType and the value from Arguments::ArgumentsNoParameters
+        to Arguments::NoParameters.
+        (JSC::Arguments::createStructureID): Added. Returns a structure without
+        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
+        (JSC::Arguments::Arguments): Added an assertion that there are no parameters.
+
+        * kjs/DatePrototype.h:
+        (JSC::DatePrototype::createStructureID): Added. Returns a structure without
+        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
+
+        * kjs/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructureID): Set HasStandardGetOwnPropertySlot
+        since this class doesn't override getPropertySlot.
+        * kjs/InternalFunction.h:
+        (JSC::InternalFunction::createStructureID): Ditto.
+
+        * kjs/JSArray.h:
+        (JSC::JSArray::createStructureID): Added. Returns a structure without
+        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
+
+        * kjs/JSCell.h: Added declaration of fastGetOwnPropertySlot; a non-virtual
+        version that uses the structure bit to decide whether to call the virtual
+        version.
+
+        * kjs/JSFunction.h:
+        (JSC::JSFunction::createStructureID): Added. Returns a structure without
+        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
+
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Initialize new structures; removed
+        nullProtoStructureID.
+        * kjs/JSGlobalData.h: Added new structures. Removed nullProtoStructureID.
+
+        * kjs/JSGlobalObject.h:
+        (JSC::JSGlobalObject::createStructureID): Added. Returns a structure without
+        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
+
+        * kjs/JSNotAnObject.h:
+        (JSC::JSNotAnObjectErrorStub::JSNotAnObjectErrorStub): Use a structure
+        that's created just for this class instead of trying to share a single "null
+        prototype" structure.
+        (JSC::JSNotAnObjectErrorStub::isNotAnObjectErrorStub): Marked this function
+        virtual for clarity and made it private since no one should call it if they
+        already have a pointer to this specific type.
+        (JSC::JSNotAnObject::JSNotAnObject): Use a structure that's created just
+        for this class instead of trying to share a single "null prototype" structure.
+        (JSC::JSNotAnObject::createStructureID): Added. Returns a structure without
+        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
+
+        * kjs/JSObject.h:
+        (JSC::JSObject::createStructureID): Added HasStandardGetOwnPropertySlot.
+        (JSC::JSObject::inlineGetOwnPropertySlot): Added. Used so we can share code
+        between getOwnPropertySlot and fastGetOwnPropertySlot.
+        (JSC::JSObject::getOwnPropertySlot): Moved so that functions are above the
+        functions that call them. Moved the guts of this function into
+        inlineGetOwnPropertySlot.
+        (JSC::JSCell::fastGetOwnPropertySlot): Added. Checks the
+        HasStandardGetOwnPropertySlot bit and if it's set, calls
+        inlineGetOwnPropertySlot, otherwise calls getOwnPropertySlot.
+        (JSC::JSObject::getPropertySlot): Changed to call fastGetOwnPropertySlot.
+        (JSC::JSValue::get): Changed to call fastGetOwnPropertySlot.
+
+        * kjs/JSWrapperObject.h: Made constructor protected to emphasize that
+        this class is only a base class and never instantiated.
+
+        * kjs/MathObject.h:
+        (JSC::MathObject::createStructureID): Added. Returns a structure without
+        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
+        * kjs/NumberConstructor.h:
+        (JSC::NumberConstructor::createStructureID): Ditto.
+        * kjs/RegExpConstructor.h:
+        (JSC::RegExpConstructor::createStructureID): Ditto.
+        * kjs/RegExpObject.h:
+        (JSC::RegExpObject::createStructureID): Ditto.
+        * kjs/StringObject.h:
+        (JSC::StringObject::createStructureID): Ditto.
+
+        * kjs/TypeInfo.h: Added HasStandardGetOwnPropertySlot flag and
+        hasStandardGetOwnPropertySlot accessor function.
+
+2008-10-22  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 21803: Fuse op_jfalse with op_eq_null and op_neq_null
+        <https://bugs.webkit.org/show_bug.cgi?id=21803>
+
+        Fuse op_jfalse with op_eq_null and op_neq_null to make the new opcodes
+        op_jeq_null and op_jneq_null.
+
+        This is a 2.6% speedup on the V8 Raytrace benchmark, and strangely also
+        a 4.7% speedup on the V8 Arguments benchmark, even though it uses
+        neither of the two new opcodes.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitJumpIfTrue):
+        (JSC::CodeGenerator::emitJumpIfFalse):
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        * VM/Opcode.h:
+
+2008-10-22  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Should not define PLATFORM(WIN,MAC,GTK) when PLATFORM(CHROMIUM) is defined
+        https://bugs.webkit.org/show_bug.cgi?id=21757
+
+        PLATFORM(CHROMIUM) implies HAVE_ACCESSIBILITY
+
+        * wtf/Platform.h:
+
+2008-10-22  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Correct opcode names in documentation.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+
+2008-10-21  Oliver Hunt <oliver@apple.com>
+
+        RS=Maciej Stachowiak.
+
+        Force FastMalloc to make all allocated pages executable in
+        a vague hope this will allow the Win2k3 bot to be able to
+        run tests.
+
+        Filed Bug 21783: Need more granular control over allocation of executable memory
+        to cover a more granular version of this patch.
+
+        * wtf/TCSystemAlloc.cpp:
+        (TryVirtualAlloc):
+
+2008-10-21  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21769
+        MessagePort should be GC protected if there are messages to be delivered
+
+        * wtf/MessageQueue.h:
+        (WTF::::isEmpty): Added. Also added a warning for methods that return a snapshot of queue
+        state, thus likely to cause race conditions.
+
+2008-10-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        - convert post-increment to pre-increment in a couple more places for speed
+
+        Speeds up V8 benchmarks a little on most computers. (But, strangely, slows
+        them down a little on my computer.)
+
+        * kjs/nodes.cpp:
+        (JSC::statementListEmitCode): Removed default argument, since we always want
+        to specify this explicitly.
+        (JSC::ForNode::emitCode): Tolerate ignoredResult() as the dst -- means the
+        same thing as 0.
+        (JSC::ReturnNode::emitCode): Ditto.
+        (JSC::ThrowNode::emitCode): Ditto.
+        (JSC::FunctionBodyNode::emitCode): Pass ignoredResult() so that we know we
+        don't have to compute the result of function statements.
+
+2008-10-21  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix an include of a non-public header to use "" instead of <>.
+
+        * API/JSProfilerPrivate.cpp:
+
+2008-10-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21766
+        REGRESSION: 12 JSC tests fail
+
+        The JSGlobalObject was mutating the shared nullProtoStructureID when
+        used in jsc.  Instead of using nullProtoStructureID, use a new StructureID.
+
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::JSCallbackObject):
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreateInGroup):
+        * kjs/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObject):
+        * kjs/Shell.cpp:
+        (GlobalObject::GlobalObject):
+        (jscmain):
+
+2008-10-20  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove an untaken branch in CodeGenerator::emitJumpIfFalse(). This
+        function is never called with a backwards target LabelID, and there is
+        even an assertion to this effect at the top of the function body.
+
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitJumpIfFalse):
+
+2008-10-20  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Add opcode documentation for undocumented opcodes.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+
+2008-10-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21683
+        Don't create intermediate StructureIDs for builtin objects
+
+        Second stage in reduce number of StructureIDs created when initializing the
+        JSGlobalObject.
+
+        - Use putDirectWithoutTransition for the remaining singleton objects to reduce
+          the number of StructureIDs create for about:blank from 132 to 73.
+
+        * kjs/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        * kjs/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        * kjs/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * kjs/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * kjs/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * kjs/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * kjs/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * kjs/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        (JSC::FunctionPrototype::addFunctionProperties):
+        * kjs/FunctionPrototype.h:
+        (JSC::FunctionPrototype::createStructureID):
+        * kjs/InternalFunction.cpp:
+        * kjs/InternalFunction.h:
+        (JSC::InternalFunction::InternalFunction):
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * kjs/JSObject.h:
+        * kjs/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * kjs/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        * kjs/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * kjs/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        * kjs/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * kjs/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * kjs/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        * kjs/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::dumpStatistics):
+        * kjs/StructureID.h:
+        (JSC::StructureID::setPrototypeWithoutTransition):
+
+2008-10-20  Alp Toker  <alp@nuanti.com>
+
+        Fix autotools dist build target by listing recently added header
+        files only. Not reviewed.
+
+        * GNUmakefile.am:
+
+2008-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::tryCacheGetByID): Removed a redundant and sometimes
+        incorrect cast, which started ASSERTing after Darin's last checkin.
+
+2008-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Re-enable CTI, which I accidentally disabled while checking in fixes
+        to bytecode.
+
+        * wtf/Platform.h:
+
+2008-10-20  Alp Toker  <alp@nuanti.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        Typo fix in function name: mimimum -> minimum.
+
+        * kjs/DateMath.cpp:
+        (JSC::minimumYearForDST):
+        (JSC::equivalentYearForDST):
+
+2008-10-20  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Mark Rowe.
+
+        Use pthread instead of GThread where possible in the GTK+ port. This
+        fixes issues with global initialisation, particularly on GTK+/Win32
+        where a late g_thread_init() will cause hangs.
+
+        * GNUmakefile.am:
+        * wtf/Platform.h:
+        * wtf/Threading.h:
+        * wtf/ThreadingGtk.cpp:
+        * wtf/ThreadingPthreads.cpp:
+
+2008-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=21735
+        Emit profiling instrumentation only if the Web Inspector's profiling
+        feature is enabled
+
+        22.2% speedup on empty function call benchmark.
+        2.9% speedup on v8 benchmark.
+        0.7% speedup on SunSpider.
+        
+        Lesser but similar speedups in bytecode.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases): Nixed JITed profiler hooks. Profiler
+        hooks now have their own opcodes. Added support for compiling profiler
+        hook opcodes.
+        
+        (JSC::CodeBlock::dump): Dump support for the new profiling opcodes.
+
+        * VM/CodeGenerator.h:
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::CodeGenerator):
+        (JSC::CodeGenerator::emitCall):
+        (JSC::CodeGenerator::emitConstruct): Conditionally emit profiling hooks
+        around call and construct, at the call site. (It's easier to get things
+        right this way, if you have profiled code calling non-profiled code.
+        Also, you get a slightly more accurate profile, since you charge the full
+        cost of the call / construct operation to the callee.)
+        
+        Also, fixed a bug where construct would fetch the ".prototype" property
+        from the constructor before evaluating the arguments to the constructor,
+        incorrectly allowing an "invalid constructor" exception to short-circuit
+        argument evaluation. I encountered this bug when trying to make
+        constructor exceptions work with profiling.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::callEval): Removed obsolete profiler hooks.
+
+        (JSC::Machine::throwException): Added a check for an exception thrown
+        within a call instruction. We didn't need this before because the call
+        instruction would check for a valid call before involing the profiler.
+        (JSC::Machine::execute): Added a didExecute hook at the end of top-level
+        function invocation, since op_ret no longer does this for us.
+
+        (JSC::Machine::privateExecute): Removed obsolete profiler hooks. Added
+        profiler opcodes. Changed some ++vPC to vPC[x] notation, since the
+        latter is better for performance, and it makes reasoning about the
+        current opcode in exception handling much simpler.
+
+        (JSC::Machine::cti_op_call_NotJSFunction): Removed obsolete profiler
+        hooks.
+
+        (JSC::Machine::cti_op_create_arguments_no_params): Added missing
+        CTI_STACK_HACK that I noticed when adding CTI_STACK_HACK to the new
+        profiler opcode functions.
+
+        (JSC::Machine::cti_op_profile_will_call):
+        (JSC::Machine::cti_op_profile_did_call): The new profiler opcode
+        functions.
+
+        (JSC::Machine::cti_op_construct_NotJSConstruct): Removed obsolete profiler
+        hooks.
+
+        * VM/Machine.h:
+        (JSC::Machine::isCallOpcode): Helper for exception handling.
+
+        * VM/Opcode.h: Declare new opcodes.
+
+        * kjs/JSGlobalObject.h:
+        (JSC::JSGlobalObject::supportsProfiling): Added virtual interface that
+        allows WebCore to specify whether the target global object has the Web
+        Inspector's profiling feature enabled.
+
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::willExecute):
+        (JSC::Profiler::didExecute):
+        (JSC::Profiler::createCallIdentifier):
+        * profiler/Profiler.h: Added support for invoking the profiler with
+        an arbitrary JSValue*, and not a known object. We didn't need this
+        before because the call instruction would check for a valid call before
+        involing the profiler.
+
+2008-10-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        - get CTI working on Windows again
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitCTICall): Add an overload for functions that
+        return JSObject*.
+        * VM/CTI.h: Use JSValue* and JSObject* as return types for
+        cti_op functions. Apparently, MSVC doesn't handle returning
+        the JSValuePtr struct in a register. We'll have to look into
+        this more.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_convert_this):
+        (JSC::Machine::cti_op_add):
+        (JSC::Machine::cti_op_pre_inc):
+        (JSC::Machine::cti_op_new_object):
+        (JSC::Machine::cti_op_get_by_id):
+        (JSC::Machine::cti_op_get_by_id_second):
+        (JSC::Machine::cti_op_get_by_id_generic):
+        (JSC::Machine::cti_op_get_by_id_fail):
+        (JSC::Machine::cti_op_instanceof):
+        (JSC::Machine::cti_op_del_by_id):
+        (JSC::Machine::cti_op_mul):
+        (JSC::Machine::cti_op_new_func):
+        (JSC::Machine::cti_op_push_activation):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_new_array):
+        (JSC::Machine::cti_op_resolve):
+        (JSC::Machine::cti_op_construct_JSConstructFast):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        (JSC::Machine::cti_op_get_by_val):
+        (JSC::Machine::cti_op_sub):
+        (JSC::Machine::cti_op_lesseq):
+        (JSC::Machine::cti_op_negate):
+        (JSC::Machine::cti_op_resolve_base):
+        (JSC::Machine::cti_op_resolve_skip):
+        (JSC::Machine::cti_op_resolve_global):
+        (JSC::Machine::cti_op_div):
+        (JSC::Machine::cti_op_pre_dec):
+        (JSC::Machine::cti_op_not):
+        (JSC::Machine::cti_op_eq):
+        (JSC::Machine::cti_op_lshift):
+        (JSC::Machine::cti_op_bitand):
+        (JSC::Machine::cti_op_rshift):
+        (JSC::Machine::cti_op_bitnot):
+        (JSC::Machine::cti_op_new_func_exp):
+        (JSC::Machine::cti_op_mod):
+        (JSC::Machine::cti_op_less):
+        (JSC::Machine::cti_op_neq):
+        (JSC::Machine::cti_op_urshift):
+        (JSC::Machine::cti_op_bitxor):
+        (JSC::Machine::cti_op_new_regexp):
+        (JSC::Machine::cti_op_bitor):
+        (JSC::Machine::cti_op_call_eval):
+        (JSC::Machine::cti_op_throw):
+        (JSC::Machine::cti_op_next_pname):
+        (JSC::Machine::cti_op_typeof):
+        (JSC::Machine::cti_op_is_undefined):
+        (JSC::Machine::cti_op_is_boolean):
+        (JSC::Machine::cti_op_is_number):
+        (JSC::Machine::cti_op_is_string):
+        (JSC::Machine::cti_op_is_object):
+        (JSC::Machine::cti_op_is_function):
+        (JSC::Machine::cti_op_stricteq):
+        (JSC::Machine::cti_op_nstricteq):
+        (JSC::Machine::cti_op_to_jsnumber):
+        (JSC::Machine::cti_op_in):
+        (JSC::Machine::cti_op_push_new_scope):
+        (JSC::Machine::cti_op_del_by_val):
+        (JSC::Machine::cti_op_new_error):
+        (JSC::Machine::cti_vm_throw):
+        Change these functions to return pointer types, and never
+        JSValuePtr.
+        * VM/Machine.h: Ditto.
+
+2008-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed some recent break-age in bytecode mode.
+
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::printStructureIDs): Fixed up an ASSERT caused by
+        Gavin's last checkin. This is a temporary fix so I can keep on moving.
+        I'll send email about what I think is an underlying problem soon.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute): Removed a redundant and sometimes
+        incorrect cast, which started ASSERTing after Darin's last checkin.
+
+2008-10-20  Darin Adler  <darin@apple.com>
+
+        - another similar Windows build fix
+
+        * VM/CTI.cpp: Changed return type to JSObject* instead of JSValuePtr.
+
+2008-10-20  Darin Adler  <darin@apple.com>
+
+        - try to fix Windows build
+
+        * VM/CTI.cpp: Use JSValue* instead of JSValuePtr for ctiTrampoline.
+        * VM/CTI.h: Ditto.
+
+2008-10-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - finish https://bugs.webkit.org/show_bug.cgi?id=21732
+          improve performance by eliminating JSValue as a base class for JSCell
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_call_profiler): Use asFunction.
+        (JSC::Machine::cti_vm_lazyLinkCall): Ditto.
+        (JSC::Machine::cti_op_construct_JSConstructFast): Use asObject.
+
+        * kjs/JSCell.h: Re-sort friend classes. Eliminate inheritance from
+        JSValue. Changed cast in asCell from static_cast to reinterpret_cast.
+        Removed JSValue::getNumber(double&) and one of JSValue::getObject
+        overloads.
+
+        * kjs/JSValue.h: Made the private constructor and destructor both
+        non-virtual and also remove the definitions. This class can never
+        be instantiated or derived.
+
+2008-10-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - next step of https://bugs.webkit.org/show_bug.cgi?id=21732
+          improve performance by eliminating JSValue as a base class for JSCell
+
+        Change JSValuePtr from a typedef into a class. This allows us to support
+        conversion from JSCell* to JSValuePtr even if JSCell isn't derived from
+        JSValue.
+
+        * JavaScriptCore.exp: Updated symbols that involve JSValuePtr, since
+        it's now a distinct type.
+
+        * API/APICast.h:
+        (toRef): Extract the JSValuePtr payload explicitly since we can't just
+        cast any more.
+        * VM/CTI.cpp:
+        (JSC::CTI::asInteger): Ditto.
+
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::addConstant): Get at the payload directly.
+        (JSC::CodeGenerator::emitLoad): Added an overload of JSCell* because
+        otherwise classes derived from JSValue end up calling the bool
+        overload instead of JSValuePtr.
+        * VM/CodeGenerator.h: Ditto. Also update traits to use JSValue*
+        and the payload functions.
+
+        * VM/Register.h: Added a JSCell* overload and use of payload functions.
+
+        * kjs/JSCell.h:
+        (JSC::asCell): Use payload function.
+        (JSC::JSValue::asCell): Use JSValue* instead of JSValuePtr.
+        (JSC::JSValuePtr::JSValuePtr): Added. Constructor that takes JSCell*
+        and creates a JSValuePtr.
+
+        * kjs/JSImmediate.h: Added JSValuePtr class. Also updated makeValue
+        and makeInt to work with JSValue* and the payload function.
+
+        * kjs/JSValue.h: Added == and != operators for JSValuePtr. Put them
+        here because eventually all the JSValue functions should go here
+        except what's needed by JSImmediate. Also fix asValue to use
+        JSValue* instead of JSValuePtr.
+
+        * kjs/PropertySlot.h: Change constructor to take JSValuePtr.
+
+        * kjs/protect.h: Update gcProtect functions to work with JSCell*
+        as well as JSValuePtr. Also updated the ProtectedPtr<JSValuePtr>
+        specialization to work more directly. Also changed all the call
+        sites to use gcProtectNullTolerant.
+
+2008-10-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - next step of https://bugs.webkit.org/show_bug.cgi?id=21732
+          improve performance by eliminating JSValue as a base class for JSCell
+
+        Remove most uses of JSValue, which will be removed in a future patch.
+
+        * VM/Machine.cpp:
+        (JSC::fastToUInt32): Call toUInt32SlowCase function; no longer a member
+        of JSValue.
+        * kjs/JSNumberCell.h:
+        (JSC::JSNumberCell::toInt32): Ditto.
+        (JSC::JSNumberCell::toUInt32): Ditto.
+
+        * kjs/JSValue.cpp:
+        (JSC::toInt32SlowCase): Made a non-member function.
+        (JSC::JSValue::toInt32SlowCase): Changed to call non-member function.
+        (JSC::toUInt32SlowCase): More of the same.
+        (JSC::JSValue::toUInt32SlowCase): Ditto.
+
+        * kjs/JSValue.h: Moved static member function so they are no longer
+        member functions at all.
+
+        * VM/CTI.h: Removed forward declaration of JSValue.
+        * VM/ExceptionHelpers.h: Ditto.
+        * kjs/CallData.h: Ditto.
+        * kjs/ConstructData.h: Ditto.
+        * kjs/JSGlobalObjectFunctions.h: Ditto.
+        * kjs/PropertyMap.h: Ditto.
+        * kjs/StructureID.h: Ditto.
+        * kjs/collector.h: Ditto.
+        * kjs/completion.h: Ditto.
+
+        * kjs/grammar.y:
+        (JSC::makeBitwiseNotNode): Call new non-member toInt32 function.
+        (JSC::makeLeftShiftNode): More of the same.
+        (JSC::makeRightShiftNode): Ditto.
+
+        * kjs/protect.h: Added a specialization for ProtectedPtr<JSValuePtr>
+        so this can be used with JSValuePtr.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - next step of https://bugs.webkit.org/show_bug.cgi?id=21732
+          improve performance by eliminating JSValue as a base class for JSCell
+
+        Tweak a little more to get closer to where we can make JSValuePtr a class.
+
+        * API/APICast.h:
+        (toJS): Change back to JSValue* here, since we're converting the
+        pointer type.
+        * VM/CTI.cpp:
+        (JSC::CTI::unlinkCall): Call asPointer.
+        * VM/CTI.h: Cast to JSValue* here, since it's a pointer cast.
+        * kjs/DebuggerCallFrame.h:
+        (JSC::DebuggerCallFrame::DebuggerCallFrame): Call noValue.
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Call noValue.
+        * kjs/JSImmediate.cpp:
+        (JSC::JSImmediate::toObject): Remove unneeded const_cast.
+        * kjs/JSWrapperObject.h:
+        (JSC::JSWrapperObject::JSWrapperObject): Call noValue.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        - fix non-all-in-one build
+
+        * kjs/completion.h:
+        (JSC::Completion::Completion): Add include of JSValue.h.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - fix assertions I introduced with my casting changes
+
+        These were showing up as failures in the JavaScriptCore tests.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_instanceof): Remove the bogus asCell casting that
+        was at the top of the function, and instead cast at the point of use.
+        (JSC::Machine::cti_op_construct_NotJSConstruct): Moved the cast to
+        object after checking the construct type.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        - fix non-all-in-one build
+
+        * kjs/JSGlobalObjectFunctions.h: Add include of JSImmedate.h (for now).
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        - fix build
+
+        * kjs/interpreter.h: Include JSValue.h instead of JSImmediate.h.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        * kjs/interpreter.h: Fix include of JSImmediate.h.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        - fix non-all-in-one build
+
+        * kjs/interpreter.h: Add include of JSImmediate.h.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        - fix non-all-in-one build
+
+        * kjs/ConstructData.h: Add include of JSImmedate.h (for now).
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        - try to fix Windows build
+
+        * VM/Machine.cpp:
+        (JSC::Machine::Machine): Use JSCell* type since MSVC seems to only allow
+        calling ~JSCell directly if it's a JSCell*.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - next step on https://bugs.webkit.org/show_bug.cgi?id=21732
+          improve performance by eliminating JSValue as a base class for JSCell
+
+        Use JSValuePtr everywhere instead of JSValue*. In the future, we'll be
+        changing JSValuePtr to be a class, and then eventually renaming it
+        to JSValue once that's done.
+
+        * JavaScriptCore.exp: Update entry points, since some now take JSValue*
+        instead of const JSValue*.
+
+        * API/APICast.h:
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        * API/JSValueRef.cpp:
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        * VM/CodeBlock.h:
+        * VM/CodeGenerator.cpp:
+        * VM/CodeGenerator.h:
+        * VM/ExceptionHelpers.cpp:
+        * VM/ExceptionHelpers.h:
+        * VM/JSPropertyNameIterator.cpp:
+        * VM/JSPropertyNameIterator.h:
+        * VM/Machine.cpp:
+        * VM/Machine.h:
+        * VM/Register.h:
+        * kjs/ArgList.cpp:
+        * kjs/ArgList.h:
+        * kjs/Arguments.cpp:
+        * kjs/Arguments.h:
+        * kjs/ArrayConstructor.cpp:
+        * kjs/ArrayPrototype.cpp:
+        * kjs/BooleanConstructor.cpp:
+        * kjs/BooleanConstructor.h:
+        * kjs/BooleanObject.h:
+        * kjs/BooleanPrototype.cpp:
+        * kjs/CallData.cpp:
+        * kjs/CallData.h:
+        * kjs/ConstructData.cpp:
+        * kjs/ConstructData.h:
+        * kjs/DateConstructor.cpp:
+        * kjs/DateInstance.h:
+        * kjs/DatePrototype.cpp:
+        * kjs/DebuggerCallFrame.cpp:
+        * kjs/DebuggerCallFrame.h:
+        * kjs/ErrorConstructor.cpp:
+        * kjs/ErrorPrototype.cpp:
+        * kjs/ExecState.cpp:
+        * kjs/ExecState.h:
+        * kjs/FunctionConstructor.cpp:
+        * kjs/FunctionPrototype.cpp:
+        * kjs/GetterSetter.cpp:
+        * kjs/GetterSetter.h:
+        * kjs/InternalFunction.h:
+        * kjs/JSActivation.cpp:
+        * kjs/JSActivation.h:
+        * kjs/JSArray.cpp:
+        * kjs/JSArray.h:
+        * kjs/JSCell.cpp:
+        * kjs/JSCell.h:
+        * kjs/JSFunction.cpp:
+        * kjs/JSFunction.h:
+        * kjs/JSGlobalData.h:
+        * kjs/JSGlobalObject.cpp:
+        * kjs/JSGlobalObject.h:
+        * kjs/JSGlobalObjectFunctions.cpp:
+        * kjs/JSGlobalObjectFunctions.h:
+        * kjs/JSImmediate.cpp:
+        * kjs/JSImmediate.h:
+        * kjs/JSNotAnObject.cpp:
+        * kjs/JSNotAnObject.h:
+        * kjs/JSNumberCell.cpp:
+        * kjs/JSNumberCell.h:
+        * kjs/JSObject.cpp:
+        * kjs/JSObject.h:
+        * kjs/JSStaticScopeObject.cpp:
+        * kjs/JSStaticScopeObject.h:
+        * kjs/JSString.cpp:
+        * kjs/JSString.h:
+        * kjs/JSValue.h:
+        * kjs/JSVariableObject.h:
+        * kjs/JSWrapperObject.h:
+        * kjs/MathObject.cpp:
+        * kjs/NativeErrorConstructor.cpp:
+        * kjs/NumberConstructor.cpp:
+        * kjs/NumberConstructor.h:
+        * kjs/NumberObject.cpp:
+        * kjs/NumberObject.h:
+        * kjs/NumberPrototype.cpp:
+        * kjs/ObjectConstructor.cpp:
+        * kjs/ObjectPrototype.cpp:
+        * kjs/ObjectPrototype.h:
+        * kjs/PropertyMap.h:
+        * kjs/PropertySlot.cpp:
+        * kjs/PropertySlot.h:
+        * kjs/RegExpConstructor.cpp:
+        * kjs/RegExpConstructor.h:
+        * kjs/RegExpMatchesArray.h:
+        * kjs/RegExpObject.cpp:
+        * kjs/RegExpObject.h:
+        * kjs/RegExpPrototype.cpp:
+        * kjs/Shell.cpp:
+        * kjs/StringConstructor.cpp:
+        * kjs/StringObject.cpp:
+        * kjs/StringObject.h:
+        * kjs/StringObjectThatMasqueradesAsUndefined.h:
+        * kjs/StringPrototype.cpp:
+        * kjs/StructureID.cpp:
+        * kjs/StructureID.h:
+        * kjs/collector.cpp:
+        * kjs/collector.h:
+        * kjs/completion.h:
+        * kjs/grammar.y:
+        * kjs/interpreter.cpp:
+        * kjs/interpreter.h:
+        * kjs/lookup.cpp:
+        * kjs/lookup.h:
+        * kjs/nodes.h:
+        * kjs/operations.cpp:
+        * kjs/operations.h:
+        * kjs/protect.h:
+        * profiler/ProfileGenerator.cpp:
+        Replace JSValue* with JSValuePtr.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_call_eval): Removed stray parentheses from my
+        last check-in.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - first step of https://bugs.webkit.org/show_bug.cgi?id=21732
+          improve performance by eliminating JSValue as a base class for JSCell
+
+        Remove casts from JSValue* to derived classes, replacing them with
+        calls to inline casting functions. These functions are also a bit
+        better than aidrect cast because they also do a runtime assertion.
+
+        Removed use of 0 as for JSValue*, changing call sites to use a
+        noValue() function instead.
+
+        Move things needed by classes derived from JSValue out of the class,
+        since the classes won't be deriving from JSValue any more soon.
+
+        I did most of these changes by changing JSValue to not be JSValue* any
+        more, then fixing a lot of the compilation problems, then rolling out
+        the JSValue change.
+
+        1.011x as fast on SunSpider (presumably due to some of the Machine.cpp changes)
+
+        * API/APICast.h: Removed unneeded forward declarations.
+
+        * API/JSCallbackObject.h: Added an asCallbackObject function for casting.
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject::asCallbackObject): Added.
+        (JSC::JSCallbackObject::getOwnPropertySlot): Use asObject.
+        (JSC::JSCallbackObject::call): Use noValue.
+        (JSC::JSCallbackObject::staticValueGetter): Use asCallbackObject.
+        (JSC::JSCallbackObject::staticFunctionGetter): Ditto.
+        (JSC::JSCallbackObject::callbackGetter): Ditto.
+
+        * JavaScriptCore.exp: Updated.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added RegExpMatchesArray.h.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::asInteger): Added. For use casting a JSValue to an integer.
+        (JSC::CTI::emitGetArg): Use asInteger.
+        (JSC::CTI::emitGetPutArg): Ditto.
+        (JSC::CTI::getConstantImmediateNumericArg): Ditto. Also use noValue.
+        (JSC::CTI::emitInitRegister): Use asInteger.
+        (JSC::CTI::getDeTaggedConstantImmediate): Ditto.
+        (JSC::CTI::compileOpCallInitializeCallFrame): Ditto.
+        (JSC::CTI::compileOpCall): Ditto.
+        (JSC::CTI::compileOpStrictEq): Ditto.
+        (JSC::CTI::privateCompileMainPass): Ditto.
+        (JSC::CTI::privateCompileGetByIdProto): Ditto.
+        (JSC::CTI::privateCompileGetByIdChain): Ditto.
+        (JSC::CTI::privateCompilePutByIdTransition): Ditto.
+        * VM/CTI.h: Rewrite the ARG-related macros to use C++ casts instead of
+        C casts and get rid of some extra parentheses. Addd declaration of
+        asInteger.
+
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitEqualityOp): Use asString.
+        (JSC::CodeGenerator::emitLoad): Use noValue.
+        (JSC::CodeGenerator::findScopedProperty): Change globalObject argument
+        to JSObject* instead of JSValue*.
+        (JSC::CodeGenerator::emitResolve): Remove unneeded cast.
+        (JSC::CodeGenerator::emitGetScopedVar): Use asCell.
+        (JSC::CodeGenerator::emitPutScopedVar): Ditto.
+        * VM/CodeGenerator.h: Changed out argument of findScopedProperty.
+        Also change the JSValueMap to use PtrHash explicitly instead of
+        getting it from DefaultHash.
+
+        * VM/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::toPrimitive): Use noValue.
+        * VM/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::next): Ditto.
+
+        * VM/Machine.cpp:
+        (JSC::fastIsNumber): Moved isImmediate check here instead of
+        checking for 0 inside Heap::isNumber. Use asCell and asNumberCell.
+        (JSC::fastToInt32): Ditto.
+        (JSC::fastToUInt32): Ditto.
+        (JSC::jsLess): Use asString.
+        (JSC::jsLessEq): Ditto.
+        (JSC::jsAdd): Ditto.
+        (JSC::jsTypeStringForValue): Use asObject.
+        (JSC::jsIsObjectType): Ditto.
+        (JSC::jsIsFunctionType): Ditto.
+        (JSC::inlineResolveBase): Use noValue.
+        (JSC::Machine::callEval): Use asString. Initialize result to
+        undefined, not 0.
+        (JSC::Machine::Machine): Remove unneeded casts to JSCell*.
+        (JSC::Machine::throwException): Use asObject.
+        (JSC::Machine::debug): Remove explicit calls to the DebuggerCallFrame
+        constructor.
+        (JSC::Machine::checkTimeout): Use noValue.
+        (JSC::cachePrototypeChain): Use asObject.
+        (JSC::Machine::tryCachePutByID): Use asCell.
+        (JSC::Machine::tryCacheGetByID): Use aCell and asObject.
+        (JSC::Machine::privateExecute): Use noValue, asCell, asObject, asString,
+        asArray, asActivation, asFunction. Changed code that creates call frames
+        for host functions to pass 0 for the function pointer -- the call frame
+        needs a JSFunction* and a host function object is not one. This was
+        caught by the assertions in the casting functions. Also remove some
+        unneeded casts in cases where two values are compared.
+        (JSC::Machine::retrieveLastCaller): Use noValue.
+        (JSC::Machine::tryCTICachePutByID): Use asCell.
+        (JSC::Machine::tryCTICacheGetByID): Use aCell and asObject.
+        (JSC::setUpThrowTrampolineReturnAddress): Added this function to restore
+        the PIC-branch-avoidance that was recently lost.
+        (JSC::Machine::cti_op_add): Use asString.
+        (JSC::Machine::cti_op_instanceof): Use asCell and asObject.
+        (JSC::Machine::cti_op_call_JSFunction): Use asFunction.
+        (JSC::Machine::cti_op_call_NotJSFunction): Changed code to pass 0 for
+        the function pointer, since we don't have a JSFunction. Use asObject.
+        (JSC::Machine::cti_op_tear_off_activation): Use asActivation.
+        (JSC::Machine::cti_op_construct_JSConstruct): Use asFunction and asObject.
+        (JSC::Machine::cti_op_construct_NotJSConstruct): use asObject.
+        (JSC::Machine::cti_op_get_by_val): Use asArray and asString.
+        (JSC::Machine::cti_op_resolve_func): Use asPointer; this helps prepare
+        us for a situation where JSValue is not a pointer.
+        (JSC::Machine::cti_op_put_by_val): Use asArray.
+        (JSC::Machine::cti_op_put_by_val_array): Ditto.
+        (JSC::Machine::cti_op_resolve_global): Use asGlobalObject.
+        (JSC::Machine::cti_op_post_inc): Change VM_CHECK_EXCEPTION_2 to
+        VM_CHECK_EXCEPTION_AT_END, since there's no observable work done after
+        that point. Also use asPointer.
+        (JSC::Machine::cti_op_resolve_with_base): Use asPointer.
+        (JSC::Machine::cti_op_post_dec): Change VM_CHECK_EXCEPTION_2 to
+        VM_CHECK_EXCEPTION_AT_END, since there's no observable work done after
+        that point. Also use asPointer.
+        (JSC::Machine::cti_op_call_eval): Use asObject, noValue, and change
+        VM_CHECK_EXCEPTION_ARG to VM_THROW_EXCEPTION_AT_END.
+        (JSC::Machine::cti_op_throw): Change return value to a JSValue*.
+        (JSC::Machine::cti_op_in): Use asObject.
+        (JSC::Machine::cti_op_switch_char): Use asString.
+        (JSC::Machine::cti_op_switch_string): Ditto.
+        (JSC::Machine::cti_op_put_getter): Use asObject.
+        (JSC::Machine::cti_op_put_setter): Ditto.
+        (JSC::Machine::cti_vm_throw): Change return value to a JSValue*.
+        Use noValue.
+        * VM/Machine.h: Change return values of both cti_op_throw and
+        cti_vm_throw to JSValue*.
+
+        * VM/Register.h: Remove nullJSValue, which is the same thing
+        as noValue(). Also removed unneeded definition of JSValue.
+
+        * kjs/ArgList.h: Removed unneeded definition of JSValue.
+
+        * kjs/Arguments.h:
+        (JSC::asArguments): Added.
+
+        * kjs/ArrayPrototype.cpp:
+        (JSC::getProperty): Use noValue.
+        (JSC::arrayProtoFuncToString): Use asArray.
+        (JSC::arrayProtoFuncToLocaleString): Ditto.
+        (JSC::arrayProtoFuncConcat): Ditto.
+        (JSC::arrayProtoFuncPop): Ditto. Also removed unneeded initialization
+        of the result, which is set in both sides of the branch.
+        (JSC::arrayProtoFuncPush): Ditto.
+        (JSC::arrayProtoFuncShift): Removed unneeded initialization
+        of the result, which is set in both sides of the branch.
+        (JSC::arrayProtoFuncSort): Use asArray.
+
+        * kjs/BooleanObject.h:
+        (JSC::asBooleanObject): Added.
+
+        * kjs/BooleanPrototype.cpp:
+        (JSC::booleanProtoFuncToString): Use asBooleanObject.
+        (JSC::booleanProtoFuncValueOf): Ditto.
+
+        * kjs/CallData.cpp:
+        (JSC::call): Use asObject and asFunction.
+        * kjs/ConstructData.cpp:
+        (JSC::construct): Ditto.
+
+        * kjs/DateConstructor.cpp:
+        (JSC::constructDate): Use asDateInstance.
+
+        * kjs/DateInstance.h:
+        (JSC::asDateInstance): Added.
+
+        * kjs/DatePrototype.cpp:
+        (JSC::dateProtoFuncToString): Use asDateInstance.
+        (JSC::dateProtoFuncToUTCString): Ditto.
+        (JSC::dateProtoFuncToDateString): Ditto.
+        (JSC::dateProtoFuncToTimeString): Ditto.
+        (JSC::dateProtoFuncToLocaleString): Ditto.
+        (JSC::dateProtoFuncToLocaleDateString): Ditto.
+        (JSC::dateProtoFuncToLocaleTimeString): Ditto.
+        (JSC::dateProtoFuncValueOf): Ditto.
+        (JSC::dateProtoFuncGetTime): Ditto.
+        (JSC::dateProtoFuncGetFullYear): Ditto.
+        (JSC::dateProtoFuncGetUTCFullYear): Ditto.
+        (JSC::dateProtoFuncToGMTString): Ditto.
+        (JSC::dateProtoFuncGetMonth): Ditto.
+        (JSC::dateProtoFuncGetUTCMonth): Ditto.
+        (JSC::dateProtoFuncGetDate): Ditto.
+        (JSC::dateProtoFuncGetUTCDate): Ditto.
+        (JSC::dateProtoFuncGetDay): Ditto.
+        (JSC::dateProtoFuncGetUTCDay): Ditto.
+        (JSC::dateProtoFuncGetHours): Ditto.
+        (JSC::dateProtoFuncGetUTCHours): Ditto.
+        (JSC::dateProtoFuncGetMinutes): Ditto.
+        (JSC::dateProtoFuncGetUTCMinutes): Ditto.
+        (JSC::dateProtoFuncGetSeconds): Ditto.
+        (JSC::dateProtoFuncGetUTCSeconds): Ditto.
+        (JSC::dateProtoFuncGetMilliSeconds): Ditto.
+        (JSC::dateProtoFuncGetUTCMilliseconds): Ditto.
+        (JSC::dateProtoFuncGetTimezoneOffset): Ditto.
+        (JSC::dateProtoFuncSetTime): Ditto.
+        (JSC::setNewValueFromTimeArgs): Ditto.
+        (JSC::setNewValueFromDateArgs): Ditto.
+        (JSC::dateProtoFuncSetYear): Ditto.
+        (JSC::dateProtoFuncGetYear): Ditto.
+
+        * kjs/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::thisObject): Use asObject.
+        (JSC::DebuggerCallFrame::evaluate): Use noValue.
+        * kjs/DebuggerCallFrame.h: Added a constructor that
+        takes only a callFrame.
+
+        * kjs/ExecState.h:
+        (JSC::ExecState::clearException): Use noValue.
+
+        * kjs/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString): Use asFunction.
+        (JSC::functionProtoFuncApply): Use asArguments and asArray.
+
+        * kjs/GetterSetter.cpp:
+        (JSC::GetterSetter::getPrimitiveNumber): Use noValue.
+
+        * kjs/GetterSetter.h:
+        (JSC::asGetterSetter): Added.
+
+        * kjs/InternalFunction.cpp:
+        (JSC::InternalFunction::name): Use asString.
+
+        * kjs/InternalFunction.h:
+        (JSC::asInternalFunction): Added.
+
+        * kjs/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter): Use asActivation.
+
+        * kjs/JSActivation.h:
+        (JSC::asActivation): Added.
+
+        * kjs/JSArray.cpp:
+        (JSC::JSArray::putSlowCase): Use noValue.
+        (JSC::JSArray::deleteProperty): Ditto.
+        (JSC::JSArray::increaseVectorLength): Ditto.
+        (JSC::JSArray::setLength): Ditto.
+        (JSC::JSArray::pop): Ditto.
+        (JSC::JSArray::sort): Ditto.
+        (JSC::JSArray::compactForSorting): Ditto.
+        * kjs/JSArray.h:
+        (JSC::asArray): Added.
+
+        * kjs/JSCell.cpp:
+        (JSC::JSCell::getJSNumber): Use noValue.
+
+        * kjs/JSCell.h:
+        (JSC::asCell): Added.
+        (JSC::JSValue::asCell): Changed to not preserve const.
+        Given the wide use of JSValue* and JSCell*, it's not
+        really useful to use const.
+        (JSC::JSValue::isNumber): Use asValue.
+        (JSC::JSValue::isString): Ditto.
+        (JSC::JSValue::isGetterSetter): Ditto.
+        (JSC::JSValue::isObject): Ditto.
+        (JSC::JSValue::getNumber): Ditto.
+        (JSC::JSValue::getString): Ditto.
+        (JSC::JSValue::getObject): Ditto.
+        (JSC::JSValue::getCallData): Ditto.
+        (JSC::JSValue::getConstructData): Ditto.
+        (JSC::JSValue::getUInt32): Ditto.
+        (JSC::JSValue::getTruncatedInt32): Ditto.
+        (JSC::JSValue::getTruncatedUInt32): Ditto.
+        (JSC::JSValue::mark): Ditto.
+        (JSC::JSValue::marked): Ditto.
+        (JSC::JSValue::toPrimitive): Ditto.
+        (JSC::JSValue::getPrimitiveNumber): Ditto.
+        (JSC::JSValue::toBoolean): Ditto.
+        (JSC::JSValue::toNumber): Ditto.
+        (JSC::JSValue::toString): Ditto.
+        (JSC::JSValue::toObject): Ditto.
+        (JSC::JSValue::toThisObject): Ditto.
+        (JSC::JSValue::needsThisConversion): Ditto.
+        (JSC::JSValue::toThisString): Ditto.
+        (JSC::JSValue::getJSNumber): Ditto.
+
+        * kjs/JSFunction.cpp:
+        (JSC::JSFunction::argumentsGetter): Use asFunction.
+        (JSC::JSFunction::callerGetter): Ditto.
+        (JSC::JSFunction::lengthGetter): Ditto.
+        (JSC::JSFunction::construct): Use asObject.
+
+        * kjs/JSFunction.h:
+        (JSC::asFunction): Added.
+
+        * kjs/JSGlobalObject.cpp:
+        (JSC::lastInPrototypeChain): Use asObject.
+
+        * kjs/JSGlobalObject.h:
+        (JSC::asGlobalObject): Added.
+        (JSC::ScopeChainNode::globalObject): Use asGlobalObject.
+
+        * kjs/JSImmediate.h: Added noValue, asPointer, and makeValue
+        functions. Use rawValue, makeValue, and noValue consistently
+        instead of doing reinterpret_cast in various functions.
+
+        * kjs/JSNumberCell.h:
+        (JSC::asNumberCell): Added.
+        (JSC::JSValue::uncheckedGetNumber): Use asValue and asNumberCell.
+        (JSC::JSValue::toJSNumber): Use asValue.
+
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::put): Use asObject and asGetterSetter.
+        (JSC::callDefaultValueFunction): Use noValue.
+        (JSC::JSObject::defineGetter): Use asGetterSetter.
+        (JSC::JSObject::defineSetter): Ditto.
+        (JSC::JSObject::lookupGetter): Ditto. Also use asObject.
+        (JSC::JSObject::lookupSetter): Ditto.
+        (JSC::JSObject::hasInstance): Use asObject.
+        (JSC::JSObject::fillGetterPropertySlot): Use asGetterSetter.
+
+        * kjs/JSObject.h:
+        (JSC::JSObject::getDirect): Use noValue.
+        (JSC::asObject): Added.
+        (JSC::JSValue::isObject): Use asValue.
+        (JSC::JSObject::get): Removed unneeded const_cast.
+        (JSC::JSObject::getPropertySlot): Use asObject.
+        (JSC::JSValue::get): Removed unneeded const_cast.
+        Use asValue, asCell, and asObject.
+        (JSC::JSValue::put): Ditto.
+        (JSC::JSObject::allocatePropertyStorageInline): Fixed spelling
+        of "oldPropertStorage".
+
+        * kjs/JSString.cpp:
+        (JSC::JSString::getOwnPropertySlot): Use asObject.
+
+        * kjs/JSString.h:
+        (JSC::asString): Added.
+        (JSC::JSValue::toThisJSString): Use asValue.
+
+        * kjs/JSValue.h: Make PreferredPrimitiveType a top level enum
+        instead of a member of JSValue. Added an asValue function that
+        returns this. Removed overload of asCell for const. Use asValue
+        instead of getting right at this.
+
+        * kjs/ObjectPrototype.cpp:
+        (JSC::objectProtoFuncIsPrototypeOf): Use asObject.
+        (JSC::objectProtoFuncDefineGetter): Ditto.
+        (JSC::objectProtoFuncDefineSetter): Ditto.
+
+        * kjs/PropertySlot.h:
+        (JSC::PropertySlot::PropertySlot): Take a const JSValue* so the
+        callers don't have to worry about const.
+        (JSC::PropertySlot::clearBase): Use noValue.
+        (JSC::PropertySlot::clearValue): Ditto.
+
+        * kjs/RegExpConstructor.cpp:
+        (JSC::regExpConstructorDollar1): Use asRegExpConstructor.
+        (JSC::regExpConstructorDollar2): Ditto.
+        (JSC::regExpConstructorDollar3): Ditto.
+        (JSC::regExpConstructorDollar4): Ditto.
+        (JSC::regExpConstructorDollar5): Ditto.
+        (JSC::regExpConstructorDollar6): Ditto.
+        (JSC::regExpConstructorDollar7): Ditto.
+        (JSC::regExpConstructorDollar8): Ditto.
+        (JSC::regExpConstructorDollar9): Ditto.
+        (JSC::regExpConstructorInput): Ditto.
+        (JSC::regExpConstructorMultiline): Ditto.
+        (JSC::regExpConstructorLastMatch): Ditto.
+        (JSC::regExpConstructorLastParen): Ditto.
+        (JSC::regExpConstructorLeftContext): Ditto.
+        (JSC::regExpConstructorRightContext): Ditto.
+        (JSC::setRegExpConstructorInput): Ditto.
+        (JSC::setRegExpConstructorMultiline): Ditto.
+        (JSC::constructRegExp): Use asObject.
+
+        * kjs/RegExpConstructor.h:
+        (JSC::asRegExpConstructor): Added.
+
+        * kjs/RegExpObject.cpp:
+        (JSC::regExpObjectGlobal): Use asRegExpObject.
+        (JSC::regExpObjectIgnoreCase): Ditto.
+        (JSC::regExpObjectMultiline): Ditto.
+        (JSC::regExpObjectSource): Ditto.
+        (JSC::regExpObjectLastIndex): Ditto.
+        (JSC::setRegExpObjectLastIndex): Ditto.
+        (JSC::callRegExpObject): Ditto.
+
+        * kjs/RegExpObject.h:
+        (JSC::asRegExpObject): Added.
+
+        * kjs/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncTest): Use asRegExpObject.
+        (JSC::regExpProtoFuncExec): Ditto.
+        (JSC::regExpProtoFuncCompile): Ditto.
+        (JSC::regExpProtoFuncToString): Ditto.
+
+        * kjs/StringObject.h:
+        (JSC::StringObject::internalValue): Use asString.
+        (JSC::asStringObject): Added.
+
+        * kjs/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace): Use asRegExpObject.
+        (JSC::stringProtoFuncToString): Ue asStringObject.
+        (JSC::stringProtoFuncMatch): Use asRegExpObject.
+        (JSC::stringProtoFuncSearch): Ditto.
+        (JSC::stringProtoFuncSplit): Ditto.
+
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::getEnumerablePropertyNames): Use asObject.
+        (JSC::StructureID::createCachedPrototypeChain): Ditto.
+        (JSC::StructureIDChain::StructureIDChain): Use asCell and asObject.
+
+        * kjs/collector.h:
+        (JSC::Heap::isNumber): Removed null handling. This can only be called
+        on valid cells.
+        (JSC::Heap::cellBlock): Removed overload for const and non-const.
+        Whether the JSCell* is const or not really should have no effect on
+        whether you can modify the collector block it's in.
+
+        * kjs/interpreter.cpp:
+        (JSC::Interpreter::evaluate): Use noValue and noObject.
+
+        * kjs/nodes.cpp:
+        (JSC::FunctionCallResolveNode::emitCode): Use JSObject for the global
+        object rather than JSValue.
+        (JSC::PostfixResolveNode::emitCode): Ditto.
+        (JSC::PrefixResolveNode::emitCode): Ditto.
+        (JSC::ReadModifyResolveNode::emitCode): Ditto.
+        (JSC::AssignResolveNode::emitCode): Ditto.
+
+        * kjs/operations.h:
+        (JSC::equalSlowCaseInline): Use asString, asCell, asNumberCell, 
+        (JSC::strictEqualSlowCaseInline): Ditto.
+
+2008-10-18  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 21702: Special op_create_activation for the case where there are no named parameters
+        <https://bugs.webkit.org/show_bug.cgi?id=21702>
+
+        This is a 2.5% speedup on the V8 Raytrace benchmark and a 1.1% speedup
+        on the V8 Earley-Boyer benchmark.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_create_arguments_no_params):
+        * VM/Machine.h:
+        * kjs/Arguments.h:
+        (JSC::Arguments::):
+        (JSC::Arguments::Arguments):
+
+2008-10-17  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - in debug builds, alter the stack to avoid blowing out MallocStackLogging
+        
+        (In essence, while executing a CTI function we alter the return
+        address to jscGeneratedNativeCode so that a single consistent
+        function is on the stack instead of many random functions without
+        symbols.)
+
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        (JSC::doSetReturnAddress):
+        (JSC::):
+        (JSC::StackHack::StackHack):
+        (JSC::StackHack::~StackHack):
+        (JSC::Machine::cti_op_convert_this):
+        (JSC::Machine::cti_op_end):
+        (JSC::Machine::cti_op_add):
+        (JSC::Machine::cti_op_pre_inc):
+        (JSC::Machine::cti_timeout_check):
+        (JSC::Machine::cti_register_file_check):
+        (JSC::Machine::cti_op_loop_if_less):
+        (JSC::Machine::cti_op_loop_if_lesseq):
+        (JSC::Machine::cti_op_new_object):
+        (JSC::Machine::cti_op_put_by_id):
+        (JSC::Machine::cti_op_put_by_id_second):
+        (JSC::Machine::cti_op_put_by_id_generic):
+        (JSC::Machine::cti_op_put_by_id_fail):
+        (JSC::Machine::cti_op_get_by_id):
+        (JSC::Machine::cti_op_get_by_id_second):
+        (JSC::Machine::cti_op_get_by_id_generic):
+        (JSC::Machine::cti_op_get_by_id_fail):
+        (JSC::Machine::cti_op_instanceof):
+        (JSC::Machine::cti_op_del_by_id):
+        (JSC::Machine::cti_op_mul):
+        (JSC::Machine::cti_op_new_func):
+        (JSC::Machine::cti_op_call_profiler):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_vm_lazyLinkCall):
+        (JSC::Machine::cti_vm_compile):
+        (JSC::Machine::cti_op_push_activation):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_create_arguments):
+        (JSC::Machine::cti_op_tear_off_activation):
+        (JSC::Machine::cti_op_tear_off_arguments):
+        (JSC::Machine::cti_op_ret_profiler):
+        (JSC::Machine::cti_op_ret_scopeChain):
+        (JSC::Machine::cti_op_new_array):
+        (JSC::Machine::cti_op_resolve):
+        (JSC::Machine::cti_op_construct_JSConstructFast):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        (JSC::Machine::cti_op_get_by_val):
+        (JSC::Machine::cti_op_resolve_func):
+        (JSC::Machine::cti_op_sub):
+        (JSC::Machine::cti_op_put_by_val):
+        (JSC::Machine::cti_op_put_by_val_array):
+        (JSC::Machine::cti_op_lesseq):
+        (JSC::Machine::cti_op_loop_if_true):
+        (JSC::Machine::cti_op_negate):
+        (JSC::Machine::cti_op_resolve_base):
+        (JSC::Machine::cti_op_resolve_skip):
+        (JSC::Machine::cti_op_resolve_global):
+        (JSC::Machine::cti_op_div):
+        (JSC::Machine::cti_op_pre_dec):
+        (JSC::Machine::cti_op_jless):
+        (JSC::Machine::cti_op_not):
+        (JSC::Machine::cti_op_jtrue):
+        (JSC::Machine::cti_op_post_inc):
+        (JSC::Machine::cti_op_eq):
+        (JSC::Machine::cti_op_lshift):
+        (JSC::Machine::cti_op_bitand):
+        (JSC::Machine::cti_op_rshift):
+        (JSC::Machine::cti_op_bitnot):
+        (JSC::Machine::cti_op_resolve_with_base):
+        (JSC::Machine::cti_op_new_func_exp):
+        (JSC::Machine::cti_op_mod):
+        (JSC::Machine::cti_op_less):
+        (JSC::Machine::cti_op_neq):
+        (JSC::Machine::cti_op_post_dec):
+        (JSC::Machine::cti_op_urshift):
+        (JSC::Machine::cti_op_bitxor):
+        (JSC::Machine::cti_op_new_regexp):
+        (JSC::Machine::cti_op_bitor):
+        (JSC::Machine::cti_op_call_eval):
+        (JSC::Machine::cti_op_throw):
+        (JSC::Machine::cti_op_get_pnames):
+        (JSC::Machine::cti_op_next_pname):
+        (JSC::Machine::cti_op_push_scope):
+        (JSC::Machine::cti_op_pop_scope):
+        (JSC::Machine::cti_op_typeof):
+        (JSC::Machine::cti_op_is_undefined):
+        (JSC::Machine::cti_op_is_boolean):
+        (JSC::Machine::cti_op_is_number):
+        (JSC::Machine::cti_op_is_string):
+        (JSC::Machine::cti_op_is_object):
+        (JSC::Machine::cti_op_is_function):
+        (JSC::Machine::cti_op_stricteq):
+        (JSC::Machine::cti_op_nstricteq):
+        (JSC::Machine::cti_op_to_jsnumber):
+        (JSC::Machine::cti_op_in):
+        (JSC::Machine::cti_op_push_new_scope):
+        (JSC::Machine::cti_op_jmp_scopes):
+        (JSC::Machine::cti_op_put_by_index):
+        (JSC::Machine::cti_op_switch_imm):
+        (JSC::Machine::cti_op_switch_char):
+        (JSC::Machine::cti_op_switch_string):
+        (JSC::Machine::cti_op_del_by_val):
+        (JSC::Machine::cti_op_put_getter):
+        (JSC::Machine::cti_op_put_setter):
+        (JSC::Machine::cti_op_new_error):
+        (JSC::Machine::cti_op_debug):
+        (JSC::Machine::cti_vm_throw):
+
+2008-10-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Optimize op_call by allowing call sites to be directly linked to callees.
+
+        For the hot path of op_call, CTI now generates a check (initially for an impossible
+        value), and the first time the call is executed we attempt to link the call directly
+        to the callee.  We can currently only do so if the arity of the caller and callee
+        match.  The (optimized) setup for the call on the hot path is linked directly to
+        the ctiCode for the callee, without indirection.
+        
+        Two forms of the slow case of the call are generated, the first will be executed the
+        first time the call is reached.  As well as this path attempting to link the call to
+        a callee, it also relinks the slow case to a second slow case, which will not continue
+        to attempt relinking the call.  (This policy could be changed in future, but for not
+        this is intended to prevent thrashing).
+
+        If a callee that the caller has been linked to is garbage collected, then the link
+        in the caller's JIt code will be reset back to a value that cannot match - to prevent
+        any false positive matches.
+
+        ~20% progression on deltablue & richards, >12% overall reduction in v8-tests
+        runtime, one or two percent progression on sunspider.
+
+        Reviewed by Oliver Hunt.
+
+        * VM/CTI.cpp:
+        (JSC::):
+        (JSC::CTI::emitNakedCall):
+        (JSC::unreachable):
+        (JSC::CTI::compileOpCallInitializeCallFrame):
+        (JSC::CTI::compileOpCallSetupArgs):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::unlinkCall):
+        (JSC::CTI::linkCall):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::~CodeBlock):
+        (JSC::CodeBlock::unlinkCallers):
+        (JSC::CodeBlock::derefStructureIDs):
+        * VM/CodeBlock.h:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        (JSC::CallLinkInfo::CallLinkInfo):
+        (JSC::CodeBlock::addCaller):
+        (JSC::CodeBlock::removeCaller):
+        (JSC::CodeBlock::getStubInfo):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitCall):
+        (JSC::CodeGenerator::emitConstruct):
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_call_profiler):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_vm_lazyLinkCall):
+        (JSC::Machine::cti_op_construct_JSConstructFast):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        * VM/Machine.h:
+        * kjs/JSFunction.cpp:
+        (JSC::JSFunction::~JSFunction):
+        * kjs/JSFunction.h:
+        * kjs/nodes.h:
+        (JSC::FunctionBodyNode::):
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::getDifferenceBetweenLabels):
+
+2008-10-17  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff Garen.
+        
+        - remove ASSERT that makes the leaks buildbot cry
+
+        * kjs/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+
+2008-10-17  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich
+        
+        - don't bother to do arguments tearoff when it will have no effect
+
+        ~1% on v8 raytrace
+        
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitReturn):
+
+2008-10-17  Marco Barisione  <marco.barisione@collabora.co.uk>
+
+        Reviewed by Sam Weinig. Landed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21603
+        [GTK] Minor fixes to GOwnPtr
+
+        * wtf/GOwnPtr.cpp:
+        (WTF::GError):
+        (WTF::GList):
+        (WTF::GCond):
+        (WTF::GMutex):
+        (WTF::GPatternSpec):
+        (WTF::GDir):
+        * wtf/GOwnPtr.h:
+        (WTF::freeOwnedGPtr):
+        (WTF::GOwnPtr::~GOwnPtr):
+        (WTF::GOwnPtr::outPtr):
+        (WTF::GOwnPtr::set):
+        (WTF::GOwnPtr::clear):
+        * wtf/Threading.h:
+
+2008-10-17  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - speed up transitions that resize the property storage a fair bit
+        
+        ~3% speedup on v8 RayTrace benchmark, ~1% on DeltaBlue
+
+        * VM/CTI.cpp:
+        (JSC::resizePropertyStorage): renamed from transitionObject, and reduced to just resize
+        the object's property storage with one inline call.
+        (JSC::CTI::privateCompilePutByIdTransition): Use a separate function for property storage
+        resize, but still do all the rest of the work in assembly in that case, and pass the known
+        compile-time constants of old and new size rather than structureIDs, saving a bunch of
+        redundant memory access.
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::allocatePropertyStorage): Just call the inline version.
+        * kjs/JSObject.h:
+        (JSC::JSObject::allocatePropertyStorageInline): Inline version of allocatePropertyStorage
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::pushl_i32): Add code to assmeble push of a constant; code originally by Cameron Zwarich.
+
+2008-10-17  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove some C style casts.
+
+        * masm/X86Assembler.h:
+        (JSC::JITCodeBuffer::putIntUnchecked):
+        (JSC::X86Assembler::link):
+        (JSC::X86Assembler::linkAbsoluteAddress):
+        (JSC::X86Assembler::getRelocatedAddress):
+
+2008-10-17  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Remove some C style casts.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::patchGetByIdSelf):
+        (JSC::CTI::patchPutByIdReplace):
+        * VM/Machine.cpp:
+        (JSC::Machine::tryCTICachePutByID):
+        (JSC::Machine::tryCTICacheGetByID):
+        (JSC::Machine::cti_op_put_by_id):
+        (JSC::Machine::cti_op_put_by_id_fail):
+        (JSC::Machine::cti_op_get_by_id):
+        (JSC::Machine::cti_op_get_by_id_fail):
+
+2008-10-17  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - Avoid restoring the caller's 'r' value in op_ret
+        https://bugs.webkit.org/show_bug.cgi?id=21319
+
+        This patch stops writing the call frame at call and return points;
+        instead it does so immediately before any CTI call.
+        
+        0.5% speedup or so on the v8 benchmark
+               
+        * VM/CTI.cpp:
+        (JSC::CTI::emitCTICall):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        * VM/CTI.h:
+
+2008-10-17  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make WREC require CTI because it won't actually compile otherwise.
+
+        * wtf/Platform.h:
+
+2008-10-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        - fixed <rdar://problem/5806316> JavaScriptCore should not force building with gcc 4.0
+        - use gcc 4.2 when building with Xcode 3.1 or newer on Leopard, even though this is not the default
+
+        This time there is no performance regression; we can avoid having
+        to use the fastcall calling convention for CTI functions by using
+        varargs to prevent the compiler from moving things around on the
+        stack.
+        
+        * Configurations/DebugRelease.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CTI.cpp:
+        * VM/Machine.h:
+        * wtf/Platform.h:
+
+2008-10-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - fix for REGRESSION: r37631 causing crashes on buildbot
+        https://bugs.webkit.org/show_bug.cgi?id=21682
+        
+        * kjs/collector.cpp:
+        (JSC::Heap::collect): Avoid crashing when a GC occurs while no global objects are live.
+
+2008-10-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21683
+        Don't create intermediate StructureIDs for builtin objects
+
+        First step in reduce number of StructureIDs created when initializing the
+        JSGlobalObject.
+
+        - In order to avoid creating the intermediate StructureIDs use the new putDirectWithoutTransition
+          and putDirectFunctionWithoutTransition to add properties to JSObjects without transitioning
+          the StructureID.  This patch just implements this strategy for ObjectPrototype but alone
+          reduces the number of StructureIDs create for about:blank by 10, from 142 to 132.
+
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::putDirectFunctionWithoutTransition):
+        * kjs/JSObject.h:
+        (JSC::JSObject::putDirectWithoutTransition):
+        * kjs/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * kjs/ObjectPrototype.h:
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::addPropertyWithoutTransition):
+        * kjs/StructureID.h:
+
+2008-10-16  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - fix for: REGRESSION: over 100 StructureIDs leak loading about:blank (result of fix for bug 21633)
+        
+        Apparent slight progression (< 0.5%) on v8 benchmarks and SunSpider.
+
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::~StructureID): Don't deref this object's parent's pointer to
+        itself from the destructor; that doesn't even make sense.
+        (JSC::StructureID::addPropertyTransition): Don't refer the single transition;
+        the rule is that parent StructureIDs are ref'd but child ones are not. Refing
+        the child creates a cycle.
+
+2008-10-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21609
+        Make MessagePorts protect their peers across heaps
+
+        * JavaScriptCore.exp:
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::markCrossHeapDependentObjects):
+        * kjs/JSGlobalObject.h:
+        * kjs/collector.cpp:
+        (JSC::Heap::collect):
+        Before GC sweep phase, a function supplied by global object is now called for all global
+        objects in the heap, making it possible to implement cross-heap dependencies.
+
+2008-10-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21610
+        run-webkit-threads --threaded crashes in StructureID destructor
+
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::StructureID):
+        (JSC::StructureID::~StructureID):
+        Protect access to a static (debug-only) HashSet with a lock.
+
+2008-10-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Goeffrey Garen.
+
+        Add function to dump statistics for StructureIDs.
+
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::dumpStatistics):
+        (JSC::StructureID::StructureID):
+        (JSC::StructureID::~StructureID):
+        * kjs/StructureID.h:
+
+2008-10-15  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21633: Avoid using a HashMap when there is only a single transition
+        <https://bugs.webkit.org/show_bug.cgi?id=21633>
+
+        This is a 0.8% speedup on SunSpider and between a 0.5% and 1.0% speedup
+        on the V8 benchmark suite, depending on which harness we use. It will
+        also slightly reduce the memory footprint of a StructureID.
+
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::StructureID):
+        (JSC::StructureID::~StructureID):
+        (JSC::StructureID::addPropertyTransition):
+        * kjs/StructureID.h:
+        (JSC::StructureID::):
+
+2008-10-15  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Geoffrey Garen.
+
+        1.40% speedup on SunSpider, 1.44% speedup on V8. (Linux)
+        
+        No change on Mac.
+
+        * VM/Machine.cpp:
+        (JSC::fastIsNumber): ALWAYS_INLINE modifier added.
+
+2008-10-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=21345
+        Start the debugger without reloading the inspected page
+
+        * JavaScriptCore.exp: New symbols.
+        * JavaScriptCore.xcodeproj/project.pbxproj: New files.
+
+        * VM/CodeBlock.h:
+        (JSC::EvalCodeCache::get): Updated for tweak to parsing API.
+
+        * kjs/CollectorHeapIterator.h: Added. An iterator for the object heap,
+        which we use to find all the live functions and recompile them.
+
+        * kjs/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate): Updated for tweak to parsing API.
+
+        * kjs/FunctionConstructor.cpp:
+        (JSC::constructFunction): Updated for tweak to parsing API.
+
+        * kjs/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction): Try to validate our SourceCode in debug
+        builds by ASSERTing that it's syntactically valid. This doesn't catch
+        all SourceCode bugs, but it catches a lot of them.
+
+        * kjs/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval): Updated for tweak to parsing API.
+
+        * kjs/Parser.cpp:
+        (JSC::Parser::parse):
+        * kjs/Parser.h:
+        (JSC::Parser::parse): Tweaked the parser to make it possible to parse
+        without an ExecState, and to allow the client to specify a debugger to
+        notify (or not) about the source we parse. This allows the inspector
+        to recompile even though no JavaScript is executing, then notify the
+        debugger about all source code when it's done.
+
+        * kjs/Shell.cpp:
+        (prettyPrintScript): Updated for tweak to parsing API.
+
+        * kjs/SourceRange.h:
+        (JSC::SourceCode::isNull): Added to help with ASSERTs.
+
+        * kjs/collector.cpp:
+        (JSC::Heap::heapAllocate):
+        (JSC::Heap::sweep):
+        (JSC::Heap::primaryHeapBegin):
+        (JSC::Heap::primaryHeapEnd):
+        * kjs/collector.h:
+        (JSC::): Moved a bunch of declarations around to enable compilation of
+        CollectorHeapIterator.
+
+        * kjs/interpreter.cpp:
+        (JSC::Interpreter::checkSyntax):
+        (JSC::Interpreter::evaluate): Updated for tweak to parsing API.
+
+        * kjs/lexer.h:
+        (JSC::Lexer::sourceCode): BUG FIX: Calculate SourceCode ranges relative
+        to the SourceCode range in which we're lexing, otherwise nested functions
+        that are compiled individually get SourceCode ranges that don't reflect
+        their nesting.
+
+        * kjs/nodes.cpp:
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::finishParsing):
+        (JSC::FunctionBodyNode::create):
+        (JSC::FunctionBodyNode::copyParameters):
+        * kjs/nodes.h:
+        (JSC::ScopeNode::setSource):
+        (JSC::FunctionBodyNode::parameterCount): Added some helper functions for
+        copying one FunctionBodyNode's parameters to another. The recompiler uses
+        these when calling "finishParsing".
+
+2008-10-15  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+
+        Reviewed by Darin Adler.
+
+        - part of https://bugs.webkit.org/show_bug.cgi?id=20746
+          Fix compilation on Windows CE.
+
+        str(n)icmp, strdup and vsnprintf are not available on Windows CE,
+        they are called _str(n)icmp, etc. instead
+
+        * wtf/StringExtras.h: Added inline function implementations.
+
+2008-10-15  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Cameron Zwarich.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=20912>
+        Use simple uint32_t multiplication on op_mul if both operands are
+        immediate number and they are between zero and 0x7FFF.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+
+2008-10-09  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Make pan scrolling a platform configurable option.
+        https://bugs.webkit.org/show_bug.cgi?id=21515
+
+        * wtf/Platform.h: Add ENABLE_PAN_SCROLLING
+
+2008-10-14  Maciej Stachowiak  <mjs@apple.com>
+
+        Rubber stamped by Sam Weinig.
+        
+        - revert r37572 and r37581 for now
+        
+        Turns out GCC 4.2 is still a (small) regression, we'll have to do
+        more work to turn it on.
+
+        * Configurations/DebugRelease.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_convert_this):
+        (JSC::Machine::cti_op_end):
+        (JSC::Machine::cti_op_add):
+        (JSC::Machine::cti_op_pre_inc):
+        (JSC::Machine::cti_timeout_check):
+        (JSC::Machine::cti_register_file_check):
+        (JSC::Machine::cti_op_loop_if_less):
+        (JSC::Machine::cti_op_loop_if_lesseq):
+        (JSC::Machine::cti_op_new_object):
+        (JSC::Machine::cti_op_put_by_id):
+        (JSC::Machine::cti_op_put_by_id_second):
+        (JSC::Machine::cti_op_put_by_id_generic):
+        (JSC::Machine::cti_op_put_by_id_fail):
+        (JSC::Machine::cti_op_get_by_id):
+        (JSC::Machine::cti_op_get_by_id_second):
+        (JSC::Machine::cti_op_get_by_id_generic):
+        (JSC::Machine::cti_op_get_by_id_fail):
+        (JSC::Machine::cti_op_instanceof):
+        (JSC::Machine::cti_op_del_by_id):
+        (JSC::Machine::cti_op_mul):
+        (JSC::Machine::cti_op_new_func):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_vm_compile):
+        (JSC::Machine::cti_op_push_activation):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_create_arguments):
+        (JSC::Machine::cti_op_tear_off_activation):
+        (JSC::Machine::cti_op_tear_off_arguments):
+        (JSC::Machine::cti_op_ret_profiler):
+        (JSC::Machine::cti_op_ret_scopeChain):
+        (JSC::Machine::cti_op_new_array):
+        (JSC::Machine::cti_op_resolve):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        (JSC::Machine::cti_op_get_by_val):
+        (JSC::Machine::cti_op_resolve_func):
+        (JSC::Machine::cti_op_sub):
+        (JSC::Machine::cti_op_put_by_val):
+        (JSC::Machine::cti_op_put_by_val_array):
+        (JSC::Machine::cti_op_lesseq):
+        (JSC::Machine::cti_op_loop_if_true):
+        (JSC::Machine::cti_op_negate):
+        (JSC::Machine::cti_op_resolve_base):
+        (JSC::Machine::cti_op_resolve_skip):
+        (JSC::Machine::cti_op_resolve_global):
+        (JSC::Machine::cti_op_div):
+        (JSC::Machine::cti_op_pre_dec):
+        (JSC::Machine::cti_op_jless):
+        (JSC::Machine::cti_op_not):
+        (JSC::Machine::cti_op_jtrue):
+        (JSC::Machine::cti_op_post_inc):
+        (JSC::Machine::cti_op_eq):
+        (JSC::Machine::cti_op_lshift):
+        (JSC::Machine::cti_op_bitand):
+        (JSC::Machine::cti_op_rshift):
+        (JSC::Machine::cti_op_bitnot):
+        (JSC::Machine::cti_op_resolve_with_base):
+        (JSC::Machine::cti_op_new_func_exp):
+        (JSC::Machine::cti_op_mod):
+        (JSC::Machine::cti_op_less):
+        (JSC::Machine::cti_op_neq):
+        (JSC::Machine::cti_op_post_dec):
+        (JSC::Machine::cti_op_urshift):
+        (JSC::Machine::cti_op_bitxor):
+        (JSC::Machine::cti_op_new_regexp):
+        (JSC::Machine::cti_op_bitor):
+        (JSC::Machine::cti_op_call_eval):
+        (JSC::Machine::cti_op_throw):
+        (JSC::Machine::cti_op_get_pnames):
+        (JSC::Machine::cti_op_next_pname):
+        (JSC::Machine::cti_op_push_scope):
+        (JSC::Machine::cti_op_pop_scope):
+        (JSC::Machine::cti_op_typeof):
+        (JSC::Machine::cti_op_is_undefined):
+        (JSC::Machine::cti_op_is_boolean):
+        (JSC::Machine::cti_op_is_number):
+        (JSC::Machine::cti_op_is_string):
+        (JSC::Machine::cti_op_is_object):
+        (JSC::Machine::cti_op_is_function):
+        (JSC::Machine::cti_op_stricteq):
+        (JSC::Machine::cti_op_nstricteq):
+        (JSC::Machine::cti_op_to_jsnumber):
+        (JSC::Machine::cti_op_in):
+        (JSC::Machine::cti_op_push_new_scope):
+        (JSC::Machine::cti_op_jmp_scopes):
+        (JSC::Machine::cti_op_put_by_index):
+        (JSC::Machine::cti_op_switch_imm):
+        (JSC::Machine::cti_op_switch_char):
+        (JSC::Machine::cti_op_switch_string):
+        (JSC::Machine::cti_op_del_by_val):
+        (JSC::Machine::cti_op_put_getter):
+        (JSC::Machine::cti_op_put_setter):
+        (JSC::Machine::cti_op_new_error):
+        (JSC::Machine::cti_op_debug):
+        (JSC::Machine::cti_vm_throw):
+        * VM/Machine.h:
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::emitRestoreArgumentReference):
+        (JSC::X86Assembler::emitRestoreArgumentReferenceForTrampoline):
+        * wtf/Platform.h:
+
+2008-10-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20256
+        Array.push and other standard methods disappear
+
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        Don't use static hash tables even on platforms that don't enable JSC_MULTIPLE_THREADS -
+        these tables reference IdentifierTable, which is always per-GlobalData.
+
+2008-10-14  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - always use CTI_ARGUMENTS and CTI_ARGUMENTS_FASTCALL
+        
+        This is a small regression for GCC 4.0, but simplifies the code
+        for future improvements and lets us focus on GCC 4.2+ and MSVC.
+
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_convert_this):
+        (JSC::Machine::cti_op_end):
+        (JSC::Machine::cti_op_add):
+        (JSC::Machine::cti_op_pre_inc):
+        (JSC::Machine::cti_timeout_check):
+        (JSC::Machine::cti_register_file_check):
+        (JSC::Machine::cti_op_loop_if_less):
+        (JSC::Machine::cti_op_loop_if_lesseq):
+        (JSC::Machine::cti_op_new_object):
+        (JSC::Machine::cti_op_put_by_id):
+        (JSC::Machine::cti_op_put_by_id_second):
+        (JSC::Machine::cti_op_put_by_id_generic):
+        (JSC::Machine::cti_op_put_by_id_fail):
+        (JSC::Machine::cti_op_get_by_id):
+        (JSC::Machine::cti_op_get_by_id_second):
+        (JSC::Machine::cti_op_get_by_id_generic):
+        (JSC::Machine::cti_op_get_by_id_fail):
+        (JSC::Machine::cti_op_instanceof):
+        (JSC::Machine::cti_op_del_by_id):
+        (JSC::Machine::cti_op_mul):
+        (JSC::Machine::cti_op_new_func):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_vm_compile):
+        (JSC::Machine::cti_op_push_activation):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_create_arguments):
+        (JSC::Machine::cti_op_tear_off_activation):
+        (JSC::Machine::cti_op_tear_off_arguments):
+        (JSC::Machine::cti_op_ret_profiler):
+        (JSC::Machine::cti_op_ret_scopeChain):
+        (JSC::Machine::cti_op_new_array):
+        (JSC::Machine::cti_op_resolve):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        (JSC::Machine::cti_op_get_by_val):
+        (JSC::Machine::cti_op_resolve_func):
+        (JSC::Machine::cti_op_sub):
+        (JSC::Machine::cti_op_put_by_val):
+        (JSC::Machine::cti_op_put_by_val_array):
+        (JSC::Machine::cti_op_lesseq):
+        (JSC::Machine::cti_op_loop_if_true):
+        (JSC::Machine::cti_op_negate):
+        (JSC::Machine::cti_op_resolve_base):
+        (JSC::Machine::cti_op_resolve_skip):
+        (JSC::Machine::cti_op_resolve_global):
+        (JSC::Machine::cti_op_div):
+        (JSC::Machine::cti_op_pre_dec):
+        (JSC::Machine::cti_op_jless):
+        (JSC::Machine::cti_op_not):
+        (JSC::Machine::cti_op_jtrue):
+        (JSC::Machine::cti_op_post_inc):
+        (JSC::Machine::cti_op_eq):
+        (JSC::Machine::cti_op_lshift):
+        (JSC::Machine::cti_op_bitand):
+        (JSC::Machine::cti_op_rshift):
+        (JSC::Machine::cti_op_bitnot):
+        (JSC::Machine::cti_op_resolve_with_base):
+        (JSC::Machine::cti_op_new_func_exp):
+        (JSC::Machine::cti_op_mod):
+        (JSC::Machine::cti_op_less):
+        (JSC::Machine::cti_op_neq):
+        (JSC::Machine::cti_op_post_dec):
+        (JSC::Machine::cti_op_urshift):
+        (JSC::Machine::cti_op_bitxor):
+        (JSC::Machine::cti_op_new_regexp):
+        (JSC::Machine::cti_op_bitor):
+        (JSC::Machine::cti_op_call_eval):
+        (JSC::Machine::cti_op_throw):
+        (JSC::Machine::cti_op_get_pnames):
+        (JSC::Machine::cti_op_next_pname):
+        (JSC::Machine::cti_op_push_scope):
+        (JSC::Machine::cti_op_pop_scope):
+        (JSC::Machine::cti_op_typeof):
+        (JSC::Machine::cti_op_is_undefined):
+        (JSC::Machine::cti_op_is_boolean):
+        (JSC::Machine::cti_op_is_number):
+        (JSC::Machine::cti_op_is_string):
+        (JSC::Machine::cti_op_is_object):
+        (JSC::Machine::cti_op_is_function):
+        (JSC::Machine::cti_op_stricteq):
+        (JSC::Machine::cti_op_nstricteq):
+        (JSC::Machine::cti_op_to_jsnumber):
+        (JSC::Machine::cti_op_in):
+        (JSC::Machine::cti_op_push_new_scope):
+        (JSC::Machine::cti_op_jmp_scopes):
+        (JSC::Machine::cti_op_put_by_index):
+        (JSC::Machine::cti_op_switch_imm):
+        (JSC::Machine::cti_op_switch_char):
+        (JSC::Machine::cti_op_switch_string):
+        (JSC::Machine::cti_op_del_by_val):
+        (JSC::Machine::cti_op_put_getter):
+        (JSC::Machine::cti_op_put_setter):
+        (JSC::Machine::cti_op_new_error):
+        (JSC::Machine::cti_op_debug):
+        (JSC::Machine::cti_vm_throw):
+        * VM/Machine.h:
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::emitRestoreArgumentReference):
+        (JSC::X86Assembler::emitRestoreArgumentReferenceForTrampoline):
+        * wtf/Platform.h:
+
+2008-10-13  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - make Machine::getArgumentsData an Arguments method and inline it
+        
+        ~2% on v8 raytrace
+
+        * VM/Machine.cpp:
+        * kjs/Arguments.h:
+        (JSC::Machine::getArgumentsData):
+
+2008-10-13  Alp Toker  <alp@nuanti.com>
+
+        Fix autotools dist build target by listing recently added header
+        files only. Not reviewed.
+
+        * GNUmakefile.am:
+
+2008-10-13  Maciej Stachowiak  <mjs@apple.com>
+
+        Rubber stamped by Mark Rowe.
+        
+        - fixed <rdar://problem/5806316> JavaScriptCore should not force building with gcc 4.0
+        - use gcc 4.2 when building with Xcode 3.1 or newer on Leopard, even though this is not the default
+
+        * Configurations/DebugRelease.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-10-13  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 21541: Move RegisterFile growth check to callee
+        <https://bugs.webkit.org/show_bug.cgi?id=21541>
+
+        Move the RegisterFile growth check to the callee in the common case,
+        where some of the information is known statically at JIT time. There is
+        still a check in the caller in the case where the caller provides too
+        few arguments.
+
+        This is a 2.1% speedup on the V8 benchmark, including a 5.1% speedup on
+        the Richards benchmark, a 4.1% speedup on the DeltaBlue benchmark, and a
+        1.4% speedup on the Earley-Boyer benchmark. It is also a 0.5% speedup on
+        SunSpider.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompile):
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_register_file_check):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        * VM/Machine.h:
+        * VM/RegisterFile.h:
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::cmpl_mr):
+        (JSC::X86Assembler::emitUnlinkedJg):
+
+2008-10-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21577
+        5 false positive StructureID leaks
+
+        - Add leak ignore set to StructureID to selectively ignore leaking some StructureIDs.
+        - Add create method to JSGlolalData to be used when the data will be intentionally
+          leaked and ignore all leaks caused the StructureIDs stored in it.
+
+        * JavaScriptCore.exp:
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::createLeaked):
+        * kjs/JSGlobalData.h:
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::StructureID):
+        (JSC::StructureID::~StructureID):
+        (JSC::StructureID::startIgnoringLeaks):
+        (JSC::StructureID::stopIgnoringLeaks):
+        * kjs/StructureID.h:
+
+2008-10-13  Marco Barisione  <marco.barisione@collabora.co.uk>
+
+        Reviewed by Darin Adler. Landed by Jan Alonzo.
+
+        WebKit GTK Port needs a smartpointer to handle g_free (GFreePtr?)
+        http://bugs.webkit.org/show_bug.cgi?id=20483
+
+        Add a GOwnPtr smart pointer (similar to OwnPtr) to handle memory
+        allocated by GLib and start the conversion to use it.
+
+        * GNUmakefile.am:
+        * wtf/GOwnPtr.cpp: Added.
+        (WTF::GError):
+        (WTF::GList):
+        (WTF::GCond):
+        (WTF::GMutex):
+        (WTF::GPatternSpec):
+        (WTF::GDir):
+        * wtf/GOwnPtr.h: Added.
+        (WTF::freeOwnedPtr):
+        (WTF::GOwnPtr::GOwnPtr):
+        (WTF::GOwnPtr::~GOwnPtr):
+        (WTF::GOwnPtr::get):
+        (WTF::GOwnPtr::release):
+        (WTF::GOwnPtr::rawPtr):
+        (WTF::GOwnPtr::set):
+        (WTF::GOwnPtr::clear):
+        (WTF::GOwnPtr::operator*):
+        (WTF::GOwnPtr::operator->):
+        (WTF::GOwnPtr::operator!):
+        (WTF::GOwnPtr::operator UnspecifiedBoolType):
+        (WTF::GOwnPtr::swap):
+        (WTF::swap):
+        (WTF::operator==):
+        (WTF::operator!=):
+        (WTF::getPtr):
+        * wtf/Threading.h:
+        * wtf/ThreadingGtk.cpp:
+        (WTF::Mutex::~Mutex):
+        (WTF::Mutex::lock):
+        (WTF::Mutex::tryLock):
+        (WTF::Mutex::unlock):
+        (WTF::ThreadCondition::~ThreadCondition):
+        (WTF::ThreadCondition::wait):
+        (WTF::ThreadCondition::timedWait):
+        (WTF::ThreadCondition::signal):
+        (WTF::ThreadCondition::broadcast):
+
+2008-10-12  Gabriella Toth  <gtoth@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        - part of https://bugs.webkit.org/show_bug.cgi?id=21055
+          Bug 21055: not invoked functions
+
+        * kjs/nodes.cpp: Deleted a function that is not invoked:
+        statementListInitializeVariableAccessStack.
+
+2008-10-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * wtf/unicode/icu/UnicodeIcu.h: Fixed indentation to match WebKit coding style.
+        * wtf/unicode/qt4/UnicodeQt4.h: Ditto.
+
+2008-10-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21556
+          Bug 21556: non-ASCII digits are allowed in places where only ASCII should be
+
+        * wtf/unicode/icu/UnicodeIcu.h: Removed isDigit, digitValue, and isFormatChar.
+        * wtf/unicode/qt4/UnicodeQt4.h: Ditto.
+
+2008-10-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Make the append method that takes a Vector more strict - it now requires the elements 
+        of the vector to be appended same type as the elements of the Vector they're being appended to.
+        
+        This would cause problems when dealing with Vectors containing other Vectors.
+        
+        * wtf/Vector.h:
+        (WTF::::append):
+
+2008-10-11  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Clean up RegExpMatchesArray.h to match our coding style.
+
+        * kjs/RegExpMatchesArray.h:
+        (JSC::RegExpMatchesArray::getOwnPropertySlot):
+        (JSC::RegExpMatchesArray::put):
+        (JSC::RegExpMatchesArray::deleteProperty):
+        (JSC::RegExpMatchesArray::getPropertyNames):
+
+2008-10-11  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 21525: 55 StructureID leaks on Wikitravel's main page
+        <https://bugs.webkit.org/show_bug.cgi?id=21525>
+
+        Bug 21533: Simple JavaScript code leaks StructureIDs
+        <https://bugs.webkit.org/show_bug.cgi?id=21533>
+
+        StructureID::getEnumerablePropertyNames() ends up calling back to itself
+        via JSObject::getPropertyNames(), which causes the PropertyNameArray to
+        be cached twice. This leads to a memory leak in almost every use of
+        JSObject::getPropertyNames() on an object. The fix here is based on a
+        suggestion of Sam Weinig.
+
+        This patch also fixes every StructureID leaks that occurs while running
+        the Mozilla MemBuster test.
+
+        * kjs/PropertyNameArray.h:
+        (JSC::PropertyNameArray::PropertyNameArray):
+        (JSC::PropertyNameArray::setCacheable):
+        (JSC::PropertyNameArray::cacheable):
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::getEnumerablePropertyNames):
+
+2008-10-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Use fastcall calling convention on GCC > 4.0
+
+        Results in a 2-3% improvement in GCC 4.2 performance, so
+        that it is no longer a regression vs. GCC 4.0
+
+        * VM/CTI.cpp:
+        * VM/Machine.h:
+        * wtf/Platform.h:
+
+2008-10-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        - Add a workaround for a bug in ceil in Darwin libc.
+        - Remove old workarounds for JS math functions that are not needed
+          anymore.
+
+        The math functions are heavily tested by fast/js/math.html.
+
+        * kjs/MathObject.cpp:
+        (JSC::mathProtoFuncAbs): Remove workaround.
+        (JSC::mathProtoFuncCeil): Ditto.
+        (JSC::mathProtoFuncFloor): Ditto.
+        * wtf/MathExtras.h:
+        (wtf_ceil): Add ceil workaround for darwin.
+
+2008-10-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler
+
+        Add Assertions to JSObject constructor.
+
+        * kjs/JSObject.h:
+        (JSC::JSObject::JSObject):
+
+2008-10-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Remove now unused m_getterSetterFlag variable from PropertyMap.
+
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMap::operator=):
+        * kjs/PropertyMap.h:
+        (JSC::PropertyMap::PropertyMap):
+
+2008-10-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add leaks checking to StructureID.
+
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::StructureID):
+        (JSC::StructureID::~StructureID):
+
+2008-10-09  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20760
+        Implement support for x86 Linux in CTI
+
+        Prepare to enable CTI/WREC on supported architectures.
+
+        Make it possible to use the CTI_ARGUMENT workaround with GCC as well
+        as MSVC by fixing some preprocessor conditionals.
+
+        Note that CTI/WREC no longer requires CTI_ARGUMENT on Linux so we
+        don't actually enable it except when building with MSVC. GCC on Win32
+        remains untested.
+
+        Adapt inline ASM code to use the global symbol underscore prefix only
+        on Darwin and to call the properly mangled Machine::cti_vm_throw
+        symbol name depending on CTI_ARGUMENT.
+
+        Also avoid global inclusion of the JIT infrastructure headers
+        throughout WebCore and WebKit causing recompilation of about ~1500
+        source files after modification to X86Assembler.h, CTI.h, WREC.h,
+        which are only used deep inside JavaScriptCore.
+
+        * GNUmakefile.am:
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        * VM/Machine.h:
+        * kjs/regexp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::~RegExp):
+        (JSC::RegExp::match):
+        * kjs/regexp.h:
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::emitConvertToFastCall):
+        (JSC::X86Assembler::emitRestoreArgumentReferenceForTrampoline):
+        (JSC::X86Assembler::emitRestoreArgumentReference):
+
+2008-10-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix for bug #21160, x=0;1/(x*-1) == -Infinity
+
+        * ChangeLog:
+        * VM/CTI.cpp:
+        (JSC::CTI::emitFastArithDeTagImmediate):
+        (JSC::CTI::emitFastArithDeTagImmediateJumpIfZero):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::emitUnlinkedJs):
+
+2008-10-09  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 21459: REGRESSION (r37324): Safari crashes inside JavaScriptCore while browsing hulu.com
+        <https://bugs.webkit.org/show_bug.cgi?id=21459>
+
+        After r37324, an Arguments object does not mark an associated activation
+        object. This change was made because Arguments no longer directly used
+        the activation object in any way. However, if an activation is torn off,
+        then the backing store of Arguments becomes the register array of the
+        activation object. Arguments directly marks all of the arguments, but
+        the activation object is being collected, which causes its register
+        array to be freed and new memory to be allocated in its place.
+
+        Unfortunately, it does not seem possible to reproduce this issue in a
+        layout test.
+
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::mark):
+        * kjs/Arguments.h:
+        (JSC::Arguments::setActivation):
+        (JSC::Arguments::Arguments):
+        (JSC::JSActivation::copyRegisters):
+
+2008-10-09  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Simon.
+
+        Build fix for MinGW.
+
+        * wtf/AlwaysInline.h:
+
+2008-10-08  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21497: REGRESSION (r37433): Bytecode JSC tests are severely broken
+        <https://bugs.webkit.org/show_bug.cgi?id=21497>
+
+        Fix a typo in r37433 that causes the failure of a large number of JSC
+        tests with the bytecode interpreter enabled.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+
+2008-10-08  Mark Rowe  <mrowe@apple.com>
+
+        Windows build fix.
+
+        * VM/CTI.cpp:
+        (JSC::): Update type of argument to ctiTrampoline.
+
+2008-10-08  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21403
+          Bug 21403: use new CallFrame class rather than Register* for call frame manipulation
+
+        Add CallFrame as a synonym for ExecState. Arguably, some day we should switch every
+        client over to the new name.
+
+        Use CallFrame* consistently rather than Register* or ExecState* in low-level code such
+        as Machine.cpp and CTI.cpp. Similarly, use callFrame rather than r as its name and use
+        accessor functions to get at things in the frame.
+
+        Eliminate other uses of ExecState* that aren't needed, replacing in some cases with
+        JSGlobalData* and in other cases eliminating them entirely.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeFunction):
+        (JSObjectHasProperty):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectDeleteProperty):
+        * API/OpaqueJSString.cpp:
+        * API/OpaqueJSString.h:
+        * VM/CTI.cpp:
+        (JSC::CTI::getConstant):
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::getConstantImmediateNumericArg):
+        (JSC::CTI::printOpcodeOperandTypes):
+        (JSC::CTI::CTI):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::compileRegExp):
+        * VM/CTI.h:
+        * VM/CodeBlock.h:
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitEqualityOp):
+        (JSC::CodeGenerator::emitLoad):
+        (JSC::CodeGenerator::emitUnexpectedLoad):
+        (JSC::CodeGenerator::emitConstruct):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAddSlowCase):
+        (JSC::jsAdd):
+        (JSC::jsTypeStringForValue):
+        (JSC::Machine::resolve):
+        (JSC::Machine::resolveSkip):
+        (JSC::Machine::resolveGlobal):
+        (JSC::inlineResolveBase):
+        (JSC::Machine::resolveBase):
+        (JSC::Machine::resolveBaseAndProperty):
+        (JSC::Machine::resolveBaseAndFunc):
+        (JSC::Machine::slideRegisterWindowForCall):
+        (JSC::isNotObject):
+        (JSC::Machine::callEval):
+        (JSC::Machine::dumpCallFrame):
+        (JSC::Machine::dumpRegisters):
+        (JSC::Machine::unwindCallFrame):
+        (JSC::Machine::throwException):
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
+        (JSC::DynamicGlobalObjectScope::~DynamicGlobalObjectScope):
+        (JSC::Machine::execute):
+        (JSC::Machine::debug):
+        (JSC::Machine::createExceptionScope):
+        (JSC::cachePrototypeChain):
+        (JSC::Machine::tryCachePutByID):
+        (JSC::Machine::tryCacheGetByID):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::retrieveArguments):
+        (JSC::Machine::retrieveCaller):
+        (JSC::Machine::retrieveLastCaller):
+        (JSC::Machine::findFunctionCallFrame):
+        (JSC::Machine::getArgumentsData):
+        (JSC::Machine::tryCTICachePutByID):
+        (JSC::Machine::getCTIArrayLengthTrampoline):
+        (JSC::Machine::getCTIStringLengthTrampoline):
+        (JSC::Machine::tryCTICacheGetByID):
+        (JSC::Machine::cti_op_convert_this):
+        (JSC::Machine::cti_op_end):
+        (JSC::Machine::cti_op_add):
+        (JSC::Machine::cti_op_pre_inc):
+        (JSC::Machine::cti_timeout_check):
+        (JSC::Machine::cti_op_loop_if_less):
+        (JSC::Machine::cti_op_loop_if_lesseq):
+        (JSC::Machine::cti_op_new_object):
+        (JSC::Machine::cti_op_put_by_id):
+        (JSC::Machine::cti_op_put_by_id_second):
+        (JSC::Machine::cti_op_put_by_id_generic):
+        (JSC::Machine::cti_op_put_by_id_fail):
+        (JSC::Machine::cti_op_get_by_id):
+        (JSC::Machine::cti_op_get_by_id_second):
+        (JSC::Machine::cti_op_get_by_id_generic):
+        (JSC::Machine::cti_op_get_by_id_fail):
+        (JSC::Machine::cti_op_instanceof):
+        (JSC::Machine::cti_op_del_by_id):
+        (JSC::Machine::cti_op_mul):
+        (JSC::Machine::cti_op_new_func):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_vm_compile):
+        (JSC::Machine::cti_op_push_activation):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_create_arguments):
+        (JSC::Machine::cti_op_tear_off_activation):
+        (JSC::Machine::cti_op_tear_off_arguments):
+        (JSC::Machine::cti_op_ret_profiler):
+        (JSC::Machine::cti_op_ret_scopeChain):
+        (JSC::Machine::cti_op_new_array):
+        (JSC::Machine::cti_op_resolve):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        (JSC::Machine::cti_op_get_by_val):
+        (JSC::Machine::cti_op_resolve_func):
+        (JSC::Machine::cti_op_sub):
+        (JSC::Machine::cti_op_put_by_val):
+        (JSC::Machine::cti_op_put_by_val_array):
+        (JSC::Machine::cti_op_lesseq):
+        (JSC::Machine::cti_op_loop_if_true):
+        (JSC::Machine::cti_op_negate):
+        (JSC::Machine::cti_op_resolve_base):
+        (JSC::Machine::cti_op_resolve_skip):
+        (JSC::Machine::cti_op_resolve_global):
+        (JSC::Machine::cti_op_div):
+        (JSC::Machine::cti_op_pre_dec):
+        (JSC::Machine::cti_op_jless):
+        (JSC::Machine::cti_op_not):
+        (JSC::Machine::cti_op_jtrue):
+        (JSC::Machine::cti_op_post_inc):
+        (JSC::Machine::cti_op_eq):
+        (JSC::Machine::cti_op_lshift):
+        (JSC::Machine::cti_op_bitand):
+        (JSC::Machine::cti_op_rshift):
+        (JSC::Machine::cti_op_bitnot):
+        (JSC::Machine::cti_op_resolve_with_base):
+        (JSC::Machine::cti_op_new_func_exp):
+        (JSC::Machine::cti_op_mod):
+        (JSC::Machine::cti_op_less):
+        (JSC::Machine::cti_op_neq):
+        (JSC::Machine::cti_op_post_dec):
+        (JSC::Machine::cti_op_urshift):
+        (JSC::Machine::cti_op_bitxor):
+        (JSC::Machine::cti_op_new_regexp):
+        (JSC::Machine::cti_op_bitor):
+        (JSC::Machine::cti_op_call_eval):
+        (JSC::Machine::cti_op_throw):
+        (JSC::Machine::cti_op_get_pnames):
+        (JSC::Machine::cti_op_next_pname):
+        (JSC::Machine::cti_op_push_scope):
+        (JSC::Machine::cti_op_pop_scope):
+        (JSC::Machine::cti_op_typeof):
+        (JSC::Machine::cti_op_to_jsnumber):
+        (JSC::Machine::cti_op_in):
+        (JSC::Machine::cti_op_push_new_scope):
+        (JSC::Machine::cti_op_jmp_scopes):
+        (JSC::Machine::cti_op_put_by_index):
+        (JSC::Machine::cti_op_switch_imm):
+        (JSC::Machine::cti_op_switch_char):
+        (JSC::Machine::cti_op_switch_string):
+        (JSC::Machine::cti_op_del_by_val):
+        (JSC::Machine::cti_op_put_getter):
+        (JSC::Machine::cti_op_put_setter):
+        (JSC::Machine::cti_op_new_error):
+        (JSC::Machine::cti_op_debug):
+        (JSC::Machine::cti_vm_throw):
+        * VM/Machine.h:
+        * VM/Register.h:
+        * VM/RegisterFile.h:
+        * kjs/Arguments.h:
+        * kjs/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName):
+        (JSC::DebuggerCallFrame::type):
+        (JSC::DebuggerCallFrame::thisObject):
+        (JSC::DebuggerCallFrame::evaluate):
+        * kjs/DebuggerCallFrame.h:
+        * kjs/ExecState.cpp:
+        (JSC::CallFrame::thisValue):
+        * kjs/ExecState.h:
+        * kjs/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * kjs/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        (JSC::JSActivation::argumentsGetter):
+        * kjs/JSActivation.h:
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * kjs/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * kjs/JSVariableObject.h:
+        * kjs/Parser.cpp:
+        (JSC::Parser::parse):
+        * kjs/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * kjs/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        * kjs/Shell.cpp:
+        (prettyPrintScript):
+        * kjs/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        * kjs/identifier.cpp:
+        (JSC::Identifier::checkSameIdentifierTable):
+        * kjs/interpreter.cpp:
+        (JSC::Interpreter::checkSyntax):
+        (JSC::Interpreter::evaluate):
+        * kjs/nodes.cpp:
+        (JSC::ThrowableExpressionData::emitThrowError):
+        (JSC::RegExpNode::emitCode):
+        (JSC::ArrayNode::emitCode):
+        (JSC::InstanceOfNode::emitCode):
+        * kjs/nodes.h:
+        * kjs/regexp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::create):
+        * kjs/regexp.h:
+        * profiler/HeavyProfile.h:
+        * profiler/Profile.h:
+        * wrec/WREC.cpp:
+        * wrec/WREC.h:
+
+2008-10-08  Mark Rowe  <mrowe@apple.com>
+
+        Typed by Maciej Stachowiak, reviewed by Mark Rowe.
+
+        Fix crash in fast/js/constant-folding.html with CTI disabled.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+
+2008-10-08  Timothy Hatcher  <timothy@apple.com>
+
+        Roll out r37427 because it causes an infinite recursion loading about:blank.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21476
+
+2008-10-08  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21403
+          Bug 21403: use new CallFrame class rather than Register* for call frame manipulation
+
+        Add CallFrame as a synonym for ExecState. Arguably, some day we should switch every
+        client over to the new name.
+
+        Use CallFrame* consistently rather than Register* or ExecState* in low-level code such
+        as Machine.cpp and CTI.cpp. Similarly, use callFrame rather than r as its name and use
+        accessor functions to get at things in the frame.
+
+        Eliminate other uses of ExecState* that aren't needed, replacing in some cases with
+        JSGlobalData* and in other cases eliminating them entirely.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeFunction):
+        (JSObjectHasProperty):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectDeleteProperty):
+        * API/OpaqueJSString.cpp:
+        * API/OpaqueJSString.h:
+        * VM/CTI.cpp:
+        (JSC::CTI::getConstant):
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::getConstantImmediateNumericArg):
+        (JSC::CTI::printOpcodeOperandTypes):
+        (JSC::CTI::CTI):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::compileRegExp):
+        * VM/CTI.h:
+        * VM/CodeBlock.h:
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitEqualityOp):
+        (JSC::CodeGenerator::emitLoad):
+        (JSC::CodeGenerator::emitUnexpectedLoad):
+        (JSC::CodeGenerator::emitConstruct):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (JSC::jsLess):
+        (JSC::jsLessEq):
+        (JSC::jsAddSlowCase):
+        (JSC::jsAdd):
+        (JSC::jsTypeStringForValue):
+        (JSC::Machine::resolve):
+        (JSC::Machine::resolveSkip):
+        (JSC::Machine::resolveGlobal):
+        (JSC::inlineResolveBase):
+        (JSC::Machine::resolveBase):
+        (JSC::Machine::resolveBaseAndProperty):
+        (JSC::Machine::resolveBaseAndFunc):
+        (JSC::Machine::slideRegisterWindowForCall):
+        (JSC::isNotObject):
+        (JSC::Machine::callEval):
+        (JSC::Machine::dumpCallFrame):
+        (JSC::Machine::dumpRegisters):
+        (JSC::Machine::unwindCallFrame):
+        (JSC::Machine::throwException):
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope):
+        (JSC::DynamicGlobalObjectScope::~DynamicGlobalObjectScope):
+        (JSC::Machine::execute):
+        (JSC::Machine::debug):
+        (JSC::Machine::createExceptionScope):
+        (JSC::cachePrototypeChain):
+        (JSC::Machine::tryCachePutByID):
+        (JSC::Machine::tryCacheGetByID):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::retrieveArguments):
+        (JSC::Machine::retrieveCaller):
+        (JSC::Machine::retrieveLastCaller):
+        (JSC::Machine::findFunctionCallFrame):
+        (JSC::Machine::getArgumentsData):
+        (JSC::Machine::tryCTICachePutByID):
+        (JSC::Machine::getCTIArrayLengthTrampoline):
+        (JSC::Machine::getCTIStringLengthTrampoline):
+        (JSC::Machine::tryCTICacheGetByID):
+        (JSC::Machine::cti_op_convert_this):
+        (JSC::Machine::cti_op_end):
+        (JSC::Machine::cti_op_add):
+        (JSC::Machine::cti_op_pre_inc):
+        (JSC::Machine::cti_timeout_check):
+        (JSC::Machine::cti_op_loop_if_less):
+        (JSC::Machine::cti_op_loop_if_lesseq):
+        (JSC::Machine::cti_op_new_object):
+        (JSC::Machine::cti_op_put_by_id):
+        (JSC::Machine::cti_op_put_by_id_second):
+        (JSC::Machine::cti_op_put_by_id_generic):
+        (JSC::Machine::cti_op_put_by_id_fail):
+        (JSC::Machine::cti_op_get_by_id):
+        (JSC::Machine::cti_op_get_by_id_second):
+        (JSC::Machine::cti_op_get_by_id_generic):
+        (JSC::Machine::cti_op_get_by_id_fail):
+        (JSC::Machine::cti_op_instanceof):
+        (JSC::Machine::cti_op_del_by_id):
+        (JSC::Machine::cti_op_mul):
+        (JSC::Machine::cti_op_new_func):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_vm_compile):
+        (JSC::Machine::cti_op_push_activation):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_create_arguments):
+        (JSC::Machine::cti_op_tear_off_activation):
+        (JSC::Machine::cti_op_tear_off_arguments):
+        (JSC::Machine::cti_op_ret_profiler):
+        (JSC::Machine::cti_op_ret_scopeChain):
+        (JSC::Machine::cti_op_new_array):
+        (JSC::Machine::cti_op_resolve):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        (JSC::Machine::cti_op_get_by_val):
+        (JSC::Machine::cti_op_resolve_func):
+        (JSC::Machine::cti_op_sub):
+        (JSC::Machine::cti_op_put_by_val):
+        (JSC::Machine::cti_op_put_by_val_array):
+        (JSC::Machine::cti_op_lesseq):
+        (JSC::Machine::cti_op_loop_if_true):
+        (JSC::Machine::cti_op_negate):
+        (JSC::Machine::cti_op_resolve_base):
+        (JSC::Machine::cti_op_resolve_skip):
+        (JSC::Machine::cti_op_resolve_global):
+        (JSC::Machine::cti_op_div):
+        (JSC::Machine::cti_op_pre_dec):
+        (JSC::Machine::cti_op_jless):
+        (JSC::Machine::cti_op_not):
+        (JSC::Machine::cti_op_jtrue):
+        (JSC::Machine::cti_op_post_inc):
+        (JSC::Machine::cti_op_eq):
+        (JSC::Machine::cti_op_lshift):
+        (JSC::Machine::cti_op_bitand):
+        (JSC::Machine::cti_op_rshift):
+        (JSC::Machine::cti_op_bitnot):
+        (JSC::Machine::cti_op_resolve_with_base):
+        (JSC::Machine::cti_op_new_func_exp):
+        (JSC::Machine::cti_op_mod):
+        (JSC::Machine::cti_op_less):
+        (JSC::Machine::cti_op_neq):
+        (JSC::Machine::cti_op_post_dec):
+        (JSC::Machine::cti_op_urshift):
+        (JSC::Machine::cti_op_bitxor):
+        (JSC::Machine::cti_op_new_regexp):
+        (JSC::Machine::cti_op_bitor):
+        (JSC::Machine::cti_op_call_eval):
+        (JSC::Machine::cti_op_throw):
+        (JSC::Machine::cti_op_get_pnames):
+        (JSC::Machine::cti_op_next_pname):
+        (JSC::Machine::cti_op_push_scope):
+        (JSC::Machine::cti_op_pop_scope):
+        (JSC::Machine::cti_op_typeof):
+        (JSC::Machine::cti_op_to_jsnumber):
+        (JSC::Machine::cti_op_in):
+        (JSC::Machine::cti_op_push_new_scope):
+        (JSC::Machine::cti_op_jmp_scopes):
+        (JSC::Machine::cti_op_put_by_index):
+        (JSC::Machine::cti_op_switch_imm):
+        (JSC::Machine::cti_op_switch_char):
+        (JSC::Machine::cti_op_switch_string):
+        (JSC::Machine::cti_op_del_by_val):
+        (JSC::Machine::cti_op_put_getter):
+        (JSC::Machine::cti_op_put_setter):
+        (JSC::Machine::cti_op_new_error):
+        (JSC::Machine::cti_op_debug):
+        (JSC::Machine::cti_vm_throw):
+        * VM/Machine.h:
+        * VM/Register.h:
+        * VM/RegisterFile.h:
+        * kjs/Arguments.h:
+        * kjs/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName):
+        (JSC::DebuggerCallFrame::type):
+        (JSC::DebuggerCallFrame::thisObject):
+        (JSC::DebuggerCallFrame::evaluate):
+        * kjs/DebuggerCallFrame.h:
+        * kjs/ExecState.cpp:
+        (JSC::CallFrame::thisValue):
+        * kjs/ExecState.h:
+        * kjs/FunctionConstructor.cpp:
+        (JSC::constructFunction):
+        * kjs/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        (JSC::JSActivation::argumentsGetter):
+        * kjs/JSActivation.h:
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+        * kjs/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * kjs/JSVariableObject.h:
+        * kjs/Parser.cpp:
+        (JSC::Parser::parse):
+        * kjs/RegExpConstructor.cpp:
+        (JSC::constructRegExp):
+        * kjs/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncCompile):
+        * kjs/Shell.cpp:
+        (prettyPrintScript):
+        * kjs/StringPrototype.cpp:
+        (JSC::stringProtoFuncMatch):
+        (JSC::stringProtoFuncSearch):
+        * kjs/identifier.cpp:
+        (JSC::Identifier::checkSameIdentifierTable):
+        * kjs/interpreter.cpp:
+        (JSC::Interpreter::checkSyntax):
+        (JSC::Interpreter::evaluate):
+        * kjs/nodes.cpp:
+        (JSC::ThrowableExpressionData::emitThrowError):
+        (JSC::RegExpNode::emitCode):
+        (JSC::ArrayNode::emitCode):
+        (JSC::InstanceOfNode::emitCode):
+        * kjs/nodes.h:
+        * kjs/regexp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::create):
+        * kjs/regexp.h:
+        * profiler/HeavyProfile.h:
+        * profiler/Profile.h:
+        * wrec/WREC.cpp:
+        * wrec/WREC.h:
+
+2008-10-08  Prasanth Ullattil  <pullatti@trolltech.com>
+
+        Reviewed by Oliver Hunt.
+
+        Avoid endless loops when compiling without the computed goto
+        optimization.
+
+        NEXT_OPCODE expands to "continue", which will not work inside
+        loops.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+
+2008-10-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Re-landing the following fix with the crashing bug in it fixed (r37405):
+        
+        - optimize away multiplication by constant 1.0
+        
+        2.3% speedup on v8 RayTrace benchmark
+
+        Apparently it's not uncommon for JavaScript code to multiply by
+        constant 1.0 in the mistaken belief that this converts integer to
+        floating point and that there is any operational difference.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass): Optimize to_jsnumber for
+        case where parameter is already number.
+        (JSC::CTI::privateCompileSlowCases): ditto
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute): ditto
+        * kjs/grammar.y:
+        (makeMultNode): Transform as follows:
+        +FOO * BAR ==> FOO * BAR
+        FOO * +BAR ==> FOO * BAR
+        FOO * 1 ==> +FOO
+        1 * FOO ==> +FOO
+        (makeDivNode): Transform as follows:
+        +FOO / BAR ==> FOO / BAR
+        FOO / +BAR ==> FOO / BAR
+        (makeSubNode): Transform as follows:
+        +FOO - BAR ==> FOO - BAR
+        FOO - +BAR ==> FOO - BAR
+        * kjs/nodes.h:
+        (JSC::ExpressionNode::stripUnaryPlus): Helper for above
+        grammar.y changes
+        (JSC::UnaryPlusNode::stripUnaryPlus): ditto
+
+2008-10-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        - correctly handle appending -0 to a string, it should stringify as just 0
+
+        * kjs/ustring.cpp:
+        (JSC::concatenate):
+
+2008-10-08  Prasanth Ullattil  <pullatti@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix WebKit compilation with VC2008SP1
+
+        Apply the TR1 workaround for JavaScriptCore, too.
+
+        * JavaScriptCore.pro:
+
+2008-10-08  Prasanth Ullattil  <pullatti@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix compilation errors on VS2008 64Bit
+
+        * kjs/collector.cpp:
+        (JSC::currentThreadStackBase):
+
+2008-10-08  André Pönitz  <apoenitz@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix compilation with Qt namespaces.
+
+        * wtf/Threading.h:
+
+2008-10-07  Sam Weinig  <sam@webkit.org>
+
+        Roll out r37405.
+
+2008-10-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Switch CTI runtime calls to the fastcall calling convention
+
+        Basically this means that we get to store the argument for CTI
+        calls in the ECX register, which saves a register->memory write
+        and subsequent memory->register read.
+        
+        This is a 1.7% progression in SunSpider and 2.4% on commandline
+        v8 tests on Windows
+
+        * VM/CTI.cpp:
+        (JSC::):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        (JSC::CTI::privateCompilePatchGetArrayLength):
+        * VM/CTI.h:
+        * VM/Machine.h:
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::emitRestoreArgumentReference):
+        (JSC::X86Assembler::emitRestoreArgumentReferenceForTrampoline):
+          We need this to correctly reload ecx from inside certain property access
+          trampolines.
+        * wtf/Platform.h:
+
+2008-10-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        - optimize away multiplication by constant 1.0
+        
+        2.3% speedup on v8 RayTrace benchmark
+
+        Apparently it's not uncommon for JavaScript code to multiply by
+        constant 1.0 in the mistaken belief that this converts integer to
+        floating point and that there is any operational difference.
+        
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass): Optimize to_jsnumber for
+        case where parameter is already number.
+        (JSC::CTI::privateCompileSlowCases): ditto
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute): ditto
+        * kjs/grammar.y:
+        (makeMultNode): Transform as follows:
+        +FOO * BAR ==> FOO * BAR
+        FOO * +BAR ==> FOO * BAR
+        FOO * 1 ==> +FOO
+        1 * FOO ==> +FOO
+        (makeDivNode): Transform as follows:
+        +FOO / BAR ==> FOO / BAR
+        FOO / +BAR ==> FOO / BAR
+        (makeSubNode): Transform as follows:
+        +FOO - BAR ==> FOO - BAR
+        FOO - +BAR ==> FOO - BAR
+        * kjs/nodes.h:
+        (JSC::ExpressionNode::stripUnaryPlus): Helper for above
+        grammar.y changes
+        (JSC::UnaryPlusNode::stripUnaryPlus): ditto
+
+2008-10-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        - make constant folding code more consistent
+        
+        Added a makeSubNode to match add, mult and div; use the makeFooNode functions always,
+        instead of allocating nodes directly in other places in the grammar.
+
+        * kjs/grammar.y:
+
+2008-10-07  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Move hasGetterSetterProperties flag from PropertyMap to StructureID.
+
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::defineGetter):
+        (JSC::JSObject::defineSetter):
+        * kjs/JSObject.h:
+        (JSC::JSObject::hasGetterSetterProperties):
+        (JSC::JSObject::getOwnPropertySlotForWrite):
+        (JSC::JSObject::getOwnPropertySlot):
+        * kjs/PropertyMap.h:
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::StructureID):
+        (JSC::StructureID::addPropertyTransition):
+        (JSC::StructureID::toDictionaryTransition):
+        (JSC::StructureID::changePrototypeTransition):
+        (JSC::StructureID::getterSetterTransition):
+        * kjs/StructureID.h:
+        (JSC::StructureID::hasGetterSetterProperties):
+        (JSC::StructureID::setHasGetterSetterProperties):
+
+2008-10-07  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Roll r37370 back in with bug fixes.
+
+        - PropertyMap::storageSize() should reflect the number of keys + deletedOffsets
+          and has nothing to do with the internal deletedSentinel count anymore.
+
+2008-10-07  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move callframe initialization into JIT code, again.
+        
+        As a part of the restructuring the second result from functions is now
+        returned in edx, allowing the new value of 'r' to be returned via a
+        register, and stored to the stack from JIT code, too.
+
+        4.5% progression on v8-tests. (3% in their harness)
+
+        * VM/CTI.cpp:
+        (JSC::):
+        (JSC::CTI::emitCall):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        * VM/CTI.h:
+        (JSC::CallRecord::CallRecord):
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_resolve_func):
+        (JSC::Machine::cti_op_post_inc):
+        (JSC::Machine::cti_op_resolve_with_base):
+        (JSC::Machine::cti_op_post_dec):
+        * VM/Machine.h:
+        * kjs/JSFunction.h:
+        * kjs/ScopeChain.h:
+
+2008-10-07  Mark Rowe  <mrowe@apple.com>
+
+        Fix typo in method name.
+
+        * wrec/WREC.cpp:
+        * wrec/WREC.h:
+
+2008-10-07  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        Roll out r37370.
+
+2008-10-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21415
+        Improve the division between PropertyStorageArray and PropertyMap
+
+        - Rework ProperyMap to store offsets in the value so that they don't
+          change when rehashing.  This allows us not to have to keep the 
+          PropertyStorageArray in sync and thus not have to pass it in.
+        - Rename PropertyMap::getOffset -> PropertyMap::get since put/remove
+          now also return offsets.
+        - A Vector of deleted offsets is now needed since the storage is out of
+          band.
+
+        1% win on SunSpider.  Wash on V8 suite.
+
+        * JavaScriptCore.exp:
+        * VM/CTI.cpp:
+        (JSC::transitionWillNeedStorageRealloc):
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        Transition logic can be greatly simplified by the fact that
+        the storage capacity is always known, and is correct for the
+        inline case.
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::put): Rename getOffset -> get.
+        (JSC::JSObject::deleteProperty): Ditto.
+        (JSC::JSObject::getPropertyAttributes): Ditto.
+        (JSC::JSObject::removeDirect): Use returned offset to
+        clear the value in the PropertyNameArray.
+        (JSC::JSObject::allocatePropertyStorage): Add assert.
+        * kjs/JSObject.h:
+        (JSC::JSObject::getDirect): Rename getOffset -> get
+        (JSC::JSObject::getDirectLocation): Rename getOffset -> get
+        (JSC::JSObject::putDirect): Use propertyStorageCapacity to determine whether
+        or not to resize.  Also, since put now returns an offset (and thus 
+        addPropertyTransition does also) setting of the PropertyStorageArray is
+        now done here.
+        (JSC::JSObject::transitionTo):
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMap::checkConsistency): PropertyStorageArray is no longer 
+        passed in.
+        (JSC::PropertyMap::operator=): Copy the delete offsets vector.
+        (JSC::PropertyMap::put): Instead of setting the PropertyNameArray
+        explicitly, return the offset where the value should go.
+        (JSC::PropertyMap::remove): Instead of removing from the PropertyNameArray
+        explicitly, return the offset where the value should be removed.
+        (JSC::PropertyMap::get): Switch to using the stored offset, instead
+        of the implicit one.
+        (JSC::PropertyMap::insert):
+        (JSC::PropertyMap::expand): This is never called when m_table is null,
+        so remove that branch and add it as an assertion.
+        (JSC::PropertyMap::createTable): Consistency checks no longer take
+        a PropertyNameArray.
+        (JSC::PropertyMap::rehash): No need to rehash the PropertyNameArray
+        now that it is completely out of band.
+        * kjs/PropertyMap.h:
+        (JSC::PropertyMapEntry::PropertyMapEntry): Store offset into PropertyNameArray.
+        (JSC::PropertyMap::get): Switch to using the stored offset, instead
+        of the implicit one.
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::StructureID): Initialize the propertyStorageCapacity to 
+        JSObject::inlineStorageCapacity.
+        (JSC::StructureID::growPropertyStorageCapacity): Grow the storage capacity as
+        described below.
+        (JSC::StructureID::addPropertyTransition): Copy the storage capacity.
+        (JSC::StructureID::toDictionaryTransition): Ditto.
+        (JSC::StructureID::changePrototypeTransition): Ditto.
+        (JSC::StructureID::getterSetterTransition): Ditto.
+        * kjs/StructureID.h:
+        (JSC::StructureID::propertyStorageCapacity): Add propertyStorageCapacity
+        which is the current capacity for the JSObjects PropertyStorageArray.
+        It starts at the JSObject::inlineStorageCapacity (currently 2), then
+        when it first needs to be resized moves to the JSObject::nonInlineBaseStorageCapacity
+        (currently 16), and after that doubles each time.
+
+2008-10-06  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 21396: Remove the OptionalCalleeActivation call frame slot
+        <https://bugs.webkit.org/show_bug.cgi?id=21396>
+
+        Remove the OptionalCalleeActivation call frame slot. We have to be
+        careful to store the activation object in a register, because objects
+        in the scope chain do not get marked.
+
+        This is a 0.3% speedup on both SunSpider and the V8 benchmark.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::CodeGenerator):
+        (JSC::CodeGenerator::emitReturn):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::dumpRegisters):
+        (JSC::Machine::unwindCallFrame):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_op_push_activation):
+        (JSC::Machine::cti_op_tear_off_activation):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        * VM/Machine.h:
+        (JSC::Machine::initializeCallFrame):
+        * VM/RegisterFile.h:
+        (JSC::RegisterFile::):
+
+2008-10-06  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Chromium doesn't use pthreads on windows, so make its use conditional.
+        
+        Also convert a WORD to a DWORD to avoid a compiler warning.  This
+        matches the other methods around it.
+
+        * wtf/ThreadingWin.cpp:
+        (WTF::wtfThreadEntryPoint):
+        (WTF::ThreadCondition::broadcast):
+
+2008-10-06  Mark Mentovai  <mark@moxienet.com>
+
+        Reviewed by Tim Hatcher.
+
+        Allow ENABLE_DASHBOARD_SUPPORT and ENABLE_MAC_JAVA_BRIDGE to be
+        disabled on the Mac.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21333
+
+        * wtf/Platform.h:
+
+2008-10-06  Steve Falkenburg  <sfalken@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21416
+        Pass 0 for size to VirtualAlloc, as documented by MSDN.
+        Identified by Application Verifier.
+        
+        Reviewed by Darin Adler.
+
+        * kjs/collector.cpp:
+        (KJS::freeBlock):
+
+2008-10-06  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim Hatcheri and Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21412
+        Bug 21412: Refactor user initiated profile count to be more stable
+        - Export UString::from for use with creating the profile title.
+
+        * JavaScriptCore.exp:
+
+2008-10-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed. Build fix.
+        
+        - revert toBoolean changes (r37333 and r37335); need to make WebCore work with these
+
+        * API/JSValueRef.cpp:
+        (JSValueToBoolean):
+        * ChangeLog:
+        * JavaScriptCore.exp:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_loop_if_true):
+        (JSC::Machine::cti_op_not):
+        (JSC::Machine::cti_op_jtrue):
+        * kjs/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncSome):
+        * kjs/BooleanConstructor.cpp:
+        (JSC::constructBoolean):
+        (JSC::callBooleanConstructor):
+        * kjs/GetterSetter.h:
+        * kjs/JSCell.h:
+        (JSC::JSValue::toBoolean):
+        * kjs/JSNumberCell.cpp:
+        (JSC::JSNumberCell::toBoolean):
+        * kjs/JSNumberCell.h:
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::toBoolean):
+        * kjs/JSObject.h:
+        * kjs/JSString.cpp:
+        (JSC::JSString::toBoolean):
+        * kjs/JSString.h:
+        * kjs/JSValue.h:
+        * kjs/RegExpConstructor.cpp:
+        (JSC::setRegExpConstructorMultiline):
+        * kjs/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+        * kjs/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+
+2008-10-06  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        - optimize op_jtrue, op_loop_if_true and op_not in various ways
+        https://bugs.webkit.org/show_bug.cgi?id=21404
+        
+        1) Make JSValue::toBoolean nonvirtual and completely inline by
+        making use of the StructureID type field.
+        
+        2) Make JSValue::toBoolean not take an ExecState; doesn't need it.
+        
+        3) Make op_not, op_loop_if_true and op_jtrue not read the
+        ExecState (toBoolean doesn't need it any more) and not check
+        exceptions (toBoolean can't throw).
+
+        * API/JSValueRef.cpp:
+        (JSValueToBoolean):
+        * JavaScriptCore.exp:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_loop_if_true):
+        (JSC::Machine::cti_op_not):
+        (JSC::Machine::cti_op_jtrue):
+        * kjs/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncFilter):
+        (JSC::arrayProtoFuncEvery):
+        (JSC::arrayProtoFuncSome):
+        * kjs/BooleanConstructor.cpp:
+        (JSC::constructBoolean):
+        (JSC::callBooleanConstructor):
+        * kjs/GetterSetter.h:
+        * kjs/JSCell.h:
+        (JSC::JSValue::toBoolean):
+        * kjs/JSNumberCell.cpp:
+        * kjs/JSNumberCell.h:
+        (JSC::JSNumberCell::toBoolean):
+        * kjs/JSObject.cpp:
+        * kjs/JSObject.h:
+        (JSC::JSObject::toBoolean):
+        (JSC::JSCell::toBoolean):
+        * kjs/JSString.cpp:
+        * kjs/JSString.h:
+        (JSC::JSString::toBoolean):
+        * kjs/JSValue.h:
+        * kjs/RegExpConstructor.cpp:
+        (JSC::setRegExpConstructorMultiline):
+        * kjs/RegExpObject.cpp:
+        (JSC::RegExpObject::match):
+        * kjs/RegExpPrototype.cpp:
+        (JSC::regExpProtoFuncToString):
+
+2008-10-06  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Simon.
+
+        Build fix for MinGW.
+
+        * JavaScriptCore.pri:
+        * kjs/DateMath.cpp:
+        (JSC::highResUpTime):
+
+2008-10-05  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Remove ScopeNode::containsClosures() now that it is unused.
+
+        * kjs/nodes.h:
+        (JSC::ScopeNode::containsClosures):
+
+2008-10-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - fix releas-only test failures caused by the fix to bug 21375
+
+        * VM/Machine.cpp:
+        (JSC::Machine::unwindCallFrame): Update ExecState while unwinding call frames;
+        it now matters more to have a still-valid ExecState, since dynamicGlobalObject
+        will make use of the ExecState's scope chain.
+        * VM/Machine.h:
+
+2008-10-05  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 21364: Remove the branch in op_ret for OptionalCalleeActivation and OptionalCalleeArguments
+        <https://bugs.webkit.org/show_bug.cgi?id=21364>
+
+        Use information from the parser to detect whether an activation is
+        needed or 'arguments' is used, and emit explicit instructions to tear
+        them off before op_ret. This allows a branch to be removed from op_ret
+        and simplifies some other code. This does cause a small change in the
+        behaviour of 'f.arguments'; it is no longer live when 'arguments' is not
+        mentioned in the lexical scope of the function.
+
+        It should now be easy to remove the OptionaCalleeActivation slot in the
+        call frame, but this will be done in a later patch.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitReturn):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::unwindCallFrame):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::retrieveArguments):
+        (JSC::Machine::cti_op_create_arguments):
+        (JSC::Machine::cti_op_tear_off_activation):
+        (JSC::Machine::cti_op_tear_off_arguments):
+        * VM/Machine.h:
+        * VM/Opcode.h:
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::mark):
+        * kjs/Arguments.h:
+        (JSC::Arguments::isTornOff):
+        (JSC::Arguments::Arguments):
+        (JSC::Arguments::copyRegisters):
+        (JSC::JSActivation::copyRegisters):
+        * kjs/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * kjs/JSActivation.h:
+
+2008-10-05  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        - fixed "REGRESSION (r37297): fast/js/deep-recursion-test takes too long and times out"
+        https://bugs.webkit.org/show_bug.cgi?id=21375
+        
+        The problem is that dynamicGlobalObject had become O(N) in number
+        of call frames, but unwinding the stack for an exception called it
+        for every call frame, resulting in O(N^2) behavior for an
+        exception thrown from inside deep recursion.
+
+        Instead of doing it that way, stash the dynamic global object in JSGlobalData.
+        
+        * JavaScriptCore.exp:
+        * VM/Machine.cpp:
+        (JSC::DynamicGlobalObjectScope::DynamicGlobalObjectScope): Helper class to temporarily
+        store and later restore a dynamicGlobalObject in JSGlobalData.
+        (JSC::DynamicGlobalObjectScope::~DynamicGlobalObjectScope):
+        (JSC::Machine::execute): In each version, establish a DynamicGlobalObjectScope.
+        For ProgramNode, always establish set new dynamicGlobalObject, for FunctionBody and Eval,
+        only if none is currently set.
+        * VM/Machine.h:
+        * kjs/ExecState.h:
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Ininitalize new dynamicGlobalObject field to 0.
+        * kjs/JSGlobalData.h:
+        * kjs/JSGlobalObject.h:
+        (JSC::ExecState::dynamicGlobalObject): Moved here from ExecState for benefit of inlining.
+        Return lexical global object if this is a globalExec(), otherwise look in JSGlobalData
+        for the one stashed there.
+
+2008-10-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Avoid an extra lookup when transitioning to an existing StructureID
+        by caching the offset of property that caused the transition.
+
+        1% win on V8 suite.  Wash on SunSpider.
+
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMap::put):
+        * kjs/PropertyMap.h:
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::StructureID):
+        (JSC::StructureID::addPropertyTransition):
+        * kjs/StructureID.h:
+        (JSC::StructureID::setCachedTransistionOffset):
+        (JSC::StructureID::cachedTransistionOffset):
+
+2008-10-05  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21364: Remove the branch in op_ret for OptionalCalleeActivation and OptionalCalleeArguments
+        <https://bugs.webkit.org/show_bug.cgi?id=21364>
+
+        This patch does not yet remove the branch, but it does a bit of refactoring
+        so that a CodeGenerator now knows whether the associated CodeBlock will need
+        a full scope before doing any code generation. This makes it possible to emit
+        explicit tear-off instructions before every op_ret.
+
+        * VM/CodeBlock.h:
+        (JSC::CodeBlock::CodeBlock):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::generate):
+        (JSC::CodeGenerator::CodeGenerator):
+        (JSC::CodeGenerator::emitPushScope):
+        (JSC::CodeGenerator::emitPushNewScope):
+        * kjs/nodes.h:
+        (JSC::ScopeNode::needsActivation):
+
+2008-10-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix for bug #21387 - using SamplingTool with CTI.
+
+        (1) A repatch offset offset changes due to an additional instruction to update SamplingTool state.
+        (2) Fix an incusion order problem due to ExecState changes.
+        (3) Change to a MACHINE_SAMPLING macro, use of exec should now be accessing global data.
+
+        * VM/CTI.h:
+        (JSC::CTI::execute):
+        * VM/SamplingTool.h:
+        (JSC::SamplingTool::privateExecuteReturned):
+        * kjs/Shell.cpp:
+
+2008-10-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Add a 'Check For Weak VTables' build phase to catch weak vtables as early as possible.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-10-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=21320
+        leaks of PropertyNameArrayData seen on buildbot
+
+        - Fix RefPtr cycle by making PropertyNameArrayData's pointer back
+          to the StructureID a weak pointer.
+
+        * kjs/PropertyNameArray.h:
+        (JSC::PropertyNameArrayData::setCachedStructureID):
+        (JSC::PropertyNameArrayData::cachedStructureID):
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::getEnumerablePropertyNames):
+        (JSC::StructureID::clearEnumerationCache):
+        (JSC::StructureID::~StructureID):
+
+2008-10-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21295
+          Bug 21295: Replace ExecState with a call frame Register pointer
+
+        10% faster on Richards; other v8 benchmarks faster too.
+        A wash on SunSpider.
+
+        This does the minimum necessary to get the speedup. Next step in
+        cleaning this up is to replace ExecState with a CallFrame class,
+        and be more judicious about when to pass a call frame and when
+        to pass a global data pointer, global object pointer, or perhaps
+        something else entirely.
+
+        * VM/CTI.cpp: Remove the debug-only check of the exception in
+        ctiVMThrowTrampoline -- already checked in the code the trampoline
+        jumps to, so not all that useful. Removed the exec argument from
+        ctiTrampoline. Removed emitDebugExceptionCheck -- no longer needed.
+        (JSC::CTI::emitCall): Removed code to set ExecState::m_callFrame.
+        (JSC::CTI::privateCompileMainPass): Removed code in catch to extract
+        the exception from ExecState::m_exception; instead, the code that
+        jumps into catch will make sure the exception is already in eax.
+        * VM/CTI.h: Removed exec from the ctiTrampoline. Also removed the
+        non-helpful "volatile". Temporarily left ARG_exec in as a synonym
+        for ARG_r; I'll change that on a future cleanup pass when introducing
+        more use of the CallFrame type.
+        (JSC::CTI::execute): Removed the ExecState* argument.
+
+        * VM/ExceptionHelpers.cpp:
+        (JSC::InterruptedExecutionError::InterruptedExecutionError): Take
+        JSGlobalData* instead of ExecState*.
+        (JSC::createInterruptedExecutionException): Ditto.
+        * VM/ExceptionHelpers.h: Ditto. Also removed an unneeded include.
+
+        * VM/Machine.cpp:
+        (JSC::slideRegisterWindowForCall): Removed the exec and
+        exceptionValue arguments. Changed to return 0 when there's a stack
+        overflow rather than using a separate exception argument to cut
+        down on memory accesses in the calling convention.
+        (JSC::Machine::unwindCallFrame): Removed the exec argument when
+        constructing a DebuggerCallFrame. Also removed code to set
+        ExecState::m_callFrame.
+        (JSC::Machine::throwException): Removed the exec argument when
+        construction a DebuggerCallFrame.
+        (JSC::Machine::execute): Updated to use the register instead of
+        ExecState and also removed various uses of ExecState.
+        (JSC::Machine::debug):
+        (JSC::Machine::privateExecute): Put globalData into a local
+        variable so it can be used throughout the interpreter. Changed
+        the VM_CHECK_EXCEPTION to get the exception in globalData instead
+        of through ExecState.
+        (JSC::Machine::retrieveLastCaller): Turn exec into a registers
+        pointer by calling registers() instead of by getting m_callFrame.
+        (JSC::Machine::callFrame): Ditto.
+        Tweaked exception macros. Made new versions for when you know
+        you have an exception. Get at global exception with ARG_globalData.
+        Got rid of the need to pass in the return value type.
+        (JSC::Machine::cti_op_add): Update to use new version of exception
+        macros.
+        (JSC::Machine::cti_op_pre_inc): Ditto.
+        (JSC::Machine::cti_timeout_check): Ditto.
+        (JSC::Machine::cti_op_instanceof): Ditto.
+        (JSC::Machine::cti_op_new_func): Ditto.
+        (JSC::Machine::cti_op_call_JSFunction): Optimized by using the
+        ARG values directly instead of through local variables -- this gets
+        rid of code that just shuffles things around in the stack frame.
+        Also get rid of ExecState and update for the new way exceptions are
+        handled in slideRegisterWindowForCall.
+        (JSC::Machine::cti_vm_compile): Update to make exec out of r since
+        they are both the same thing now.
+        (JSC::Machine::cti_op_call_NotJSFunction): Ditto.
+        (JSC::Machine::cti_op_init_arguments): Ditto.
+        (JSC::Machine::cti_op_resolve): Ditto.
+        (JSC::Machine::cti_op_construct_JSConstruct): Ditto.
+        (JSC::Machine::cti_op_construct_NotJSConstruct): Ditto.
+        (JSC::Machine::cti_op_resolve_func): Ditto.
+        (JSC::Machine::cti_op_put_by_val): Ditto.
+        (JSC::Machine::cti_op_put_by_val_array): Ditto.
+        (JSC::Machine::cti_op_resolve_skip): Ditto.
+        (JSC::Machine::cti_op_resolve_global): Ditto.
+        (JSC::Machine::cti_op_post_inc): Ditto.
+        (JSC::Machine::cti_op_resolve_with_base): Ditto.
+        (JSC::Machine::cti_op_post_dec): Ditto.
+        (JSC::Machine::cti_op_call_eval): Ditto.
+        (JSC::Machine::cti_op_throw): Ditto. Also rearranged to return
+        the exception value as the return value so it can be used by
+        op_catch.
+        (JSC::Machine::cti_op_push_scope): Ditto.
+        (JSC::Machine::cti_op_in): Ditto.
+        (JSC::Machine::cti_op_del_by_val): Ditto.
+        (JSC::Machine::cti_vm_throw): Ditto. Also rearranged to return
+        the exception value as the return value so it can be used by
+        op_catch.
+
+        * kjs/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName): Pass globalData.
+        (JSC::DebuggerCallFrame::evaluate): Eliminated code to make a
+        new ExecState.
+        * kjs/DebuggerCallFrame.h: Removed ExecState argument from
+        constructor.
+
+        * kjs/ExecState.h: Eliminated all data members and made ExecState
+        inherit privately from Register instead. Also added a typedef to
+        the future name for this class, which is CallFrame. It's just a
+        Register* that knows it's a pointer at a call frame. The new class
+        can't be constructed or copied. Changed all functions to use
+        the this pointer instead of m_callFrame. Changed exception-related
+        functions to access an exception in JSGlobalData. Removed functions
+        used by CTI to pass the return address to the throw machinery --
+        this is now done directly with a global in the global data.
+
+        * kjs/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncToString): Pass globalData instead of exec.
+
+        * kjs/InternalFunction.cpp:
+        (JSC::InternalFunction::name): Take globalData instead of exec.
+        * kjs/InternalFunction.h: Ditto.
+
+        * kjs/JSGlobalData.cpp: Initialize the new exception global to 0.
+        * kjs/JSGlobalData.h: Declare two new globals. One for the current
+        exception and another for the return address used by CTI to
+        implement the throw operation.
+
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Removed code to set up globalExec,
+        which is now the same thing as globalCallFrame.
+        (JSC::JSGlobalObject::reset): Get globalExec from our globalExec
+        function so we don't have to repeat the logic twice.
+        (JSC::JSGlobalObject::mark): Removed code to mark the exception;
+        the exception is now stored in JSGlobalData and marked there.
+        (JSC::JSGlobalObject::globalExec): Return a pointer to the end
+        of the global call frame.
+        * kjs/JSGlobalObject.h: Removed the globalExec data member.
+
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::putDirectFunction): Pass globalData instead of exec.
+
+        * kjs/collector.cpp:
+        (JSC::Heap::collect): Mark the global exception.
+
+        * profiler/ProfileGenerator.cpp:
+        (JSC::ProfileGenerator::addParentForConsoleStart): Pass globalData
+        instead of exec to createCallIdentifier.
+
+        * profiler/Profiler.cpp:
+        (JSC::Profiler::willExecute): Pass globalData instead of exec to
+        createCallIdentifier.
+        (JSC::Profiler::didExecute): Ditto.
+        (JSC::Profiler::createCallIdentifier): Take globalData instead of
+        exec.
+        (JSC::createCallIdentifierFromFunctionImp): Ditto.
+        * profiler/Profiler.h: Change interface to take a JSGlobalData
+        instead of an ExecState.
+
+2008-10-04  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 21369: Add opcode documentation for all undocumented opcodes
+        <https://bugs.webkit.org/show_bug.cgi?id=21369>
+
+        This patch adds opcode documentation for all undocumented opcodes, and
+        it also renames op_init_arguments to op_create_arguments.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::CodeGenerator):
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_create_arguments):
+        * VM/Machine.h:
+        * VM/Opcode.h:
+
+2008-10-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - "this" object in methods called on primitives should be wrapper object
+        https://bugs.webkit.org/show_bug.cgi?id=21362
+
+        I changed things so that functions which use "this" do a fast
+        version of toThisObject conversion if needed. Currently we miss
+        the conversion entirely, at least for primitive types. Using
+        TypeInfo and the primitive check, I made the fast case bail out
+        pretty fast.
+        
+        This is inexplicably an 1.007x SunSpider speedup (and a wash on V8 benchmarks).
+     
+        Also renamed some opcodes for clarity:
+        
+        init ==> enter
+        init_activation ==> enter_with_activation
+        
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::generate):
+        (JSC::CodeGenerator::CodeGenerator):
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_convert_this):
+        * VM/Machine.h:
+        * VM/Opcode.h:
+        * kjs/JSActivation.cpp:
+        (JSC::JSActivation::JSActivation):
+        * kjs/JSActivation.h:
+        (JSC::JSActivation::createStructureID):
+        * kjs/JSCell.h:
+        (JSC::JSValue::needsThisConversion):
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * kjs/JSGlobalData.h:
+        * kjs/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructureID):
+        * kjs/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        (JSC::JSStaticScopeObject::createStructureID):
+        * kjs/JSString.h:
+        (JSC::JSString::createStructureID):
+        * kjs/JSValue.h:
+        * kjs/TypeInfo.h:
+        (JSC::TypeInfo::needsThisConversion):
+        * kjs/nodes.h:
+        (JSC::ScopeNode::usesThis):
+
+2008-10-03  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21356: The size of the RegisterFile differs depending on 32-bit / 64-bit and Debug / Release
+        <https://bugs.webkit.org/show_bug.cgi?id=21356>
+
+        The RegisterFile decreases in size (measured in terms of numbers of
+        Registers) as the size of a Register increases. This causes
+
+            js1_5/Regress/regress-159334.js
+
+        to fail in 64-bit debug builds. This fix makes the RegisterFile on all
+        platforms the same size that it is in 32-bit Release builds.
+
+        * VM/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+
+2008-10-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - Some code cleanup to how we handle code features.
+        
+        1) Rename FeatureInfo typedef to CodeFeatures.
+        2) Rename NodeFeatureInfo template to NodeInfo.
+        3) Keep CodeFeature bitmask in ScopeNode instead of trying to break it out into individual bools.
+        4) Rename misleadingly named "needsClosure" method to "containsClosures", which better describes the meaning
+        of ClosureFeature.
+        5) Make setUsersArguments() not take an argument since it only goes one way.
+
+        * JavaScriptCore.exp:
+        * VM/CodeBlock.h:
+        (JSC::CodeBlock::CodeBlock):
+        * kjs/NodeInfo.h:
+        * kjs/Parser.cpp:
+        (JSC::Parser::didFinishParsing):
+        * kjs/Parser.h:
+        (JSC::Parser::parse):
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::EvalNode):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::create):
+        * kjs/nodes.h:
+        (JSC::ScopeNode::usesEval):
+        (JSC::ScopeNode::containsClosures):
+        (JSC::ScopeNode::usesArguments):
+        (JSC::ScopeNode::setUsesArguments):
+
+2008-10-03  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21343: REGRESSSION (r37160): ecma_3/ExecutionContexts/10.1.3-1.js and js1_4/Functions/function-001.js fail on 64-bit
+        <https://bugs.webkit.org/show_bug.cgi?id=21343>
+
+        A fix was landed for this issue in r37253, and the ChangeLog assumes
+        that it is a compiler bug, but it turns out that it is a subtle issue
+        with mixing signed and unsigned 32-bit values in a 64-bit environment.
+        In order to properly fix this bug, we should convert our signed offsets
+        into the register file to use ptrdiff_t.
+
+        This may not be the only instance of this issue, but I will land this
+        fix first and look for more later.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::getArgumentsData):
+        * VM/Machine.h:
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+        * kjs/Arguments.h:
+        (JSC::Arguments::init):
+
+2008-10-03  Darin Adler  <darin@apple.com>
+
+        * VM/CTI.cpp: Another Windows build fix. Change the args of ctiTrampoline.
+
+        * kjs/JSNumberCell.h: A build fix for newer versions of gcc. Added
+        declarations of JSGlobalData overloads of jsNumberCell.
+
+2008-10-03  Darin Adler  <darin@apple.com>
+
+        - try to fix Windows build
+
+        * kjs/ScopeChain.h: Add forward declaration of JSGlobalData.
+
+2008-10-03  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        - next step of https://bugs.webkit.org/show_bug.cgi?id=21295
+          Turn ExecState into a call frame pointer.
+
+        Remove m_globalObject and m_globalData from ExecState.
+
+        SunSpider says this is a wash (slightly faster but not statistically
+        significant); which is good enough since it's a preparation step and
+        not supposed to be a spedup.
+
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::JSCallbackFunction):
+        * kjs/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        * kjs/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        * kjs/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        * kjs/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        * kjs/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        * kjs/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        * kjs/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * kjs/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        * kjs/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        * kjs/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * kjs/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        * kjs/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        Pass JSGlobalData* instead of ExecState* to the InternalFunction
+        constructor.
+
+        * API/OpaqueJSString.cpp: Added now-needed include.
+
+        * JavaScriptCore.exp: Updated.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitSlowScriptCheck): Changed to use ARGS_globalData
+        instead of ARGS_exec.
+
+        * VM/CTI.h: Added a new argument to the CTI, the global data pointer.
+        While it's possible to get to the global data pointer using the
+        ExecState pointer, it's slow enough that it's better to just keep
+        it around in the CTI arguments.
+
+        * VM/CodeBlock.h: Moved the CodeType enum here from ExecState.h.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::execute): Pass fewer arguments when constructing
+        ExecState, and pass the global data pointer when invoking CTI.
+        (JSC::Machine::firstCallFrame): Added. Used to get the dynamic global
+        object, which is in the scope chain of the first call frame.
+        (JSC::Machine::cti_op_add): Use globalData instead of exec when
+        possible, to keep fast cases fast, since it's now more expensive to
+        get to it through the exec pointer.
+        (JSC::Machine::cti_timeout_check): Ditto.
+        (JSC::Machine::cti_op_put_by_id_second): Ditto.
+        (JSC::Machine::cti_op_get_by_id_second): Ditto.
+        (JSC::Machine::cti_op_mul): Ditto.
+        (JSC::Machine::cti_vm_compile): Ditto.
+        (JSC::Machine::cti_op_get_by_val): Ditto.
+        (JSC::Machine::cti_op_sub): Ditto.
+        (JSC::Machine::cti_op_put_by_val): Ditto.
+        (JSC::Machine::cti_op_put_by_val_array): Ditto.
+        (JSC::Machine::cti_op_negate): Ditto.
+        (JSC::Machine::cti_op_div): Ditto.
+        (JSC::Machine::cti_op_pre_dec): Ditto.
+        (JSC::Machine::cti_op_post_inc): Ditto.
+        (JSC::Machine::cti_op_lshift): Ditto.
+        (JSC::Machine::cti_op_bitand): Ditto.
+        (JSC::Machine::cti_op_rshift): Ditto.
+        (JSC::Machine::cti_op_bitnot): Ditto.
+        (JSC::Machine::cti_op_mod): Ditto.
+        (JSC::Machine::cti_op_post_dec): Ditto.
+        (JSC::Machine::cti_op_urshift): Ditto.
+        (JSC::Machine::cti_op_bitxor): Ditto.
+        (JSC::Machine::cti_op_bitor): Ditto.
+        (JSC::Machine::cti_op_call_eval): Ditto.
+        (JSC::Machine::cti_op_throw): Ditto.
+        (JSC::Machine::cti_op_is_string): Ditto.
+        (JSC::Machine::cti_op_debug): Ditto.
+        (JSC::Machine::cti_vm_throw): Ditto.
+
+        * VM/Machine.h: Added firstCallFrame.
+
+        * kjs/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate): Pass fewer arguments when
+        constructing ExecState.
+
+        * kjs/ExecState.cpp: Deleted contents. Later we'll remove the
+        file altogether.
+
+        * kjs/ExecState.h: Removed m_globalObject and m_globalData.
+        Moved CodeType into another header.
+        (JSC::ExecState::ExecState): Take only a single argument, a
+        call frame pointer.
+        (JSC::ExecState::dynamicGlobalObject): Get the object from
+        the first call frame since it's no longer stored.
+        (JSC::ExecState::globalData): Get the global data from the
+        scope chain, since we no longer store a pointer to it here.
+        (JSC::ExecState::identifierTable): Ditto.
+        (JSC::ExecState::propertyNames): Ditto.
+        (JSC::ExecState::emptyList): Ditto.
+        (JSC::ExecState::lexer): Ditto.
+        (JSC::ExecState::parser): Ditto.
+        (JSC::ExecState::machine): Ditto.
+        (JSC::ExecState::arrayTable): Ditto.
+        (JSC::ExecState::dateTable): Ditto.
+        (JSC::ExecState::mathTable): Ditto.
+        (JSC::ExecState::numberTable): Ditto.
+        (JSC::ExecState::regExpTable): Ditto.
+        (JSC::ExecState::regExpConstructorTable): Ditto.
+        (JSC::ExecState::stringTable): Ditto.
+        (JSC::ExecState::heap): Ditto.
+
+        * kjs/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor): Pass
+        JSGlobalData* instead of ExecState* to the InternalFunction
+        constructor.
+        (JSC::constructFunction): Pass the global data pointer when
+        constructing a new scope chain.
+
+        * kjs/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction): Take a JSGlobalData*
+        instead of an ExecState*. Later we can change more places to
+        work this way -- it's more efficient to take the type you need
+        since the caller might already have it.
+        * kjs/InternalFunction.h: Ditto.
+
+        * kjs/JSCell.h:
+        (JSC::JSCell::operator new): Added an overload that takes a
+        JSGlobalData* so you can construct without an ExecState*.
+
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Moved creation of the global scope
+        chain in here, since it now requires a pointer to the global data.
+        Moved the initialization of the call frame in here since it requires
+        the global scope chain node. Removed the extra argument to ExecState
+        when creating the global ExecState*.
+        * kjs/JSGlobalObject.h: Removed initialization of globalScopeChain
+        and the call frame from the JSGlobalObjectData constructor. Added
+        a thisValue argument to the init function.
+
+        * kjs/JSNumberCell.cpp: Added versions of jsNumberCell that take
+        JSGlobalData* rather than ExecState*.
+        * kjs/JSNumberCell.h:
+        (JSC::JSNumberCell::operator new): Added a version that takes
+        JSGlobalData*.
+        (JSC::JSNumberCell::JSNumberCell): Ditto.
+        (JSC::jsNumber): Ditto.
+        * kjs/JSString.cpp:
+        (JSC::jsString): Ditto.
+        (JSC::jsSubstring): Ditto.
+        (JSC::jsOwnedString): Ditto.
+        * kjs/JSString.h:
+        (JSC::JSString::JSString): Changed to take JSGlobalData*.
+        (JSC::jsEmptyString): Added a version that takes JSGlobalData*.
+        (JSC::jsSingleCharacterString): Ditto.
+        (JSC::jsSingleCharacterSubstring): Ditto.
+        (JSC::jsNontrivialString): Ditto.
+        (JSC::JSString::getIndex): Ditto.
+        (JSC::jsString): Ditto.
+        (JSC::jsSubstring): Ditto.
+        (JSC::jsOwnedString): Ditto.
+
+        * kjs/ScopeChain.h: Added a globalData pointer to each node.
+        (JSC::ScopeChainNode::ScopeChainNode): Initialize the globalData
+        pointer.
+        (JSC::ScopeChainNode::push): Set the global data pointer in the
+        new node.
+        (JSC::ScopeChain::ScopeChain): Take a globalData argument.
+
+        * kjs/SmallStrings.cpp:
+        (JSC::SmallStrings::createEmptyString): Take JSGlobalData* instead of
+        ExecState*.
+        (JSC::SmallStrings::createSingleCharacterString): Ditto.
+        * kjs/SmallStrings.h:
+        (JSC::SmallStrings::emptyString): Ditto.
+        (JSC::SmallStrings::singleCharacterString): Ditto.
+
+2008-10-03  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 21343: REGRESSSION (r37160): ecma_3/ExecutionContexts/10.1.3-1.js and js1_4/Functions/function-001.js fail on 64-bit
+        <https://bugs.webkit.org/show_bug.cgi?id=21343>
+
+        Add a workaround for a bug in GCC, which affects GCC 4.0, GCC 4.2, and
+        llvm-gcc 4.2. I put it in an #ifdef because it was a slight regression
+        on SunSpider in 32-bit, although that might be entirely random.
+
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::getOwnPropertySlot):
+
+2008-10-03  Darin Adler  <darin@apple.com>
+
+        Rubber stamped by Alexey Proskuryakov.
+
+        * kjs/Shell.cpp: (main): Don't delete JSGlobalData. Later, we need to change
+        this tool to use public JavaScriptCore API instead.
+
+2008-10-03  Darin Adler  <darin@apple.com>
+
+        Suggested by Alexey Proskuryakov.
+
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::~JSGlobalData): Remove call to heap.destroy() because
+        it's too late to ref the JSGlobalData object once it's already being
+        destroyed. In practice this is not a problem because WebCore's JSGlobalData
+        is never destroyed and JSGlobalContextRelease takes care of calling
+        heap.destroy() in advance.
+
+2008-10-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Replace SSE3 check with an SSE2 check, and implement SSE2 check on windows.
+
+        5.6% win on SunSpider on windows.
+
+        * VM/CTI.cpp:
+        (JSC::isSSE2Present):
+        (JSC::CTI::compileBinaryArithOp):
+        (JSC::CTI::compileBinaryArithOpSlowCase):
+
+2008-10-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Rubber stamped by Cameron Zwarich.
+        
+        - fix mistaken change of | to || which caused a big perf regression on EarleyBoyer
+
+        * kjs/grammar.y:
+
+2008-10-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21321
+          Bug 21321: speed up JavaScriptCore by inlining Heap in JSGlobalData
+
+        1.019x as fast on SunSpider.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript): Use heap. instead of heap-> to work with the heap.
+        (JSCheckScriptSyntax): Ditto.
+        (JSGarbageCollect): Ditto.
+        (JSReportExtraMemoryCost): Ditto.
+        * API/JSContextRef.cpp:
+        (JSGlobalContextRetain): Ditto.
+        (JSGlobalContextRelease): Destroy the heap with the destroy function instead
+        of the delete operator.
+        (JSContextGetGlobalObject): Use heap. instead of heap-> to work with the heap.
+        * API/JSObjectRef.cpp:
+        (JSObjectMake): Use heap. instead of heap-> to work with the heap.
+        (JSObjectMakeFunctionWithCallback): Ditto.
+        (JSObjectMakeConstructor): Ditto.
+        (JSObjectMakeFunction): Ditto.
+        (JSObjectMakeArray): Ditto.
+        (JSObjectMakeDate): Ditto.
+        (JSObjectMakeError): Ditto.
+        (JSObjectMakeRegExp): Ditto.
+        (JSObjectHasProperty): Ditto.
+        (JSObjectGetProperty): Ditto.
+        (JSObjectSetProperty): Ditto.
+        (JSObjectGetPropertyAtIndex): Ditto.
+        (JSObjectSetPropertyAtIndex): Ditto.
+        (JSObjectDeleteProperty): Ditto.
+        (JSObjectCallAsFunction): Ditto.
+        (JSObjectCallAsConstructor): Ditto.
+        (JSObjectCopyPropertyNames): Ditto.
+        (JSPropertyNameAccumulatorAddName): Ditto.
+        * API/JSValueRef.cpp:
+        (JSValueIsEqual): Ditto.
+        (JSValueIsInstanceOfConstructor): Ditto.
+        (JSValueMakeNumber): Ditto.
+        (JSValueMakeString): Ditto.
+        (JSValueToNumber): Ditto.
+        (JSValueToStringCopy): Ditto.
+        (JSValueToObject): Ditto.
+        (JSValueProtect): Ditto.
+        (JSValueUnprotect): Ditto.
+
+        * kjs/ExecState.h:
+        (JSC::ExecState::heap): Update to use the & operator.
+
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Update to initialize a heap member
+        instead of calling new to make a heap.
+        (JSC::JSGlobalData::~JSGlobalData): Destroy the heap with the destroy
+        function instead of the delete operator.
+        * kjs/JSGlobalData.h: Change from Heap* to a Heap.
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::mark): Use the & operator here.
+        (JSC::JSGlobalObject::operator new): Use heap. instead of heap-> to work
+        with the heap.
+
+2008-10-02  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 21317: Replace RegisterFile size and capacity information with Register pointers
+        <https://bugs.webkit.org/show_bug.cgi?id=21317>
+
+        This is a 2.3% speedup on the V8 DeltaBlue benchmark, a 3.3% speedup on
+        the V8 Raytrace benchmark, and a 1.0% speedup on SunSpider.
+
+        * VM/Machine.cpp:
+        (JSC::slideRegisterWindowForCall):
+        (JSC::Machine::callEval):
+        (JSC::Machine::execute):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        * VM/RegisterFile.cpp:
+        (JSC::RegisterFile::~RegisterFile):
+        * VM/RegisterFile.h:
+        (JSC::RegisterFile::RegisterFile):
+        (JSC::RegisterFile::start):
+        (JSC::RegisterFile::end):
+        (JSC::RegisterFile::size):
+        (JSC::RegisterFile::shrink):
+        (JSC::RegisterFile::grow):
+        (JSC::RegisterFile::lastGlobal):
+        (JSC::RegisterFile::markGlobals):
+        (JSC::RegisterFile::markCallFrames):
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::copyGlobalsTo):
+
+2008-10-02  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Darin Adler.
+
+        Change bitwise operations introduced in r37166 to boolean operations. We
+        only use bitwise operations over boolean operations for increasing
+        performance in extremely hot code, but that does not apply to anything
+        in the parser.
+
+        * kjs/grammar.y:
+
+2008-10-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for bug #21232 - should reset m_isPendingDash on flush,
+        and should allow '\-' as beginning or end of a range (though
+        not to specifiy a range itself).
+
+        * ChangeLog:
+        * wrec/CharacterClassConstructor.cpp:
+        (JSC::CharacterClassConstructor::put):
+        (JSC::CharacterClassConstructor::flush):
+        * wrec/CharacterClassConstructor.h:
+        (JSC::CharacterClassConstructor::flushBeforeEscapedHyphen):
+        * wrec/WREC.cpp:
+        (JSC::WRECGenerator::generateDisjunction):
+        (JSC::WRECParser::parseCharacterClass):
+        (JSC::WRECParser::parseDisjunction):
+        * wrec/WREC.h:
+
+2008-10-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - remove the "static" from declarations in a header file, since we
+          don't want them to have internal linkage
+
+        * VM/Machine.h: Remove the static keyword from the constant and the
+        three inline functions that Geoff just moved here.
+
+2008-10-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=21283.
+        Profiler Crashes When Started
+
+        * VM/Machine.cpp:
+        * VM/Machine.h:
+        (JSC::makeHostCallFramePointer):
+        (JSC::isHostCallFrame):
+        (JSC::stripHostCallFrameBit): Moved some things to the header so
+        JSGlobalObject could use them.
+
+        * kjs/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObjectData::JSGlobalObjectData): Call the
+        new makeHostCallFramePointer API, since 0 no longer indicates a host
+        call frame.
+
+2008-10-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21304
+        Stop using a static wrapper map for WebCore JS bindings
+
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        (JSC::JSGlobalData::~JSGlobalData):
+        (JSC::JSGlobalData::ClientData::~ClientData):
+        * kjs/JSGlobalData.h:
+        Added a client data member to JSGlobalData. WebCore will use it to store bindings-related
+        global data.
+
+        * JavaScriptCore.exp: Export virtual ClientData destructor.
+
+2008-10-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+        
+        Try to fix Qt build.
+
+        * kjs/Error.h:
+
+2008-10-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler and Cameron Zwarich.
+
+        Preliminary step toward dynamic recompilation: Standardized and
+        simplified the parsing interface.
+        
+        The main goal in this patch is to make it easy to ask for a duplicate
+        compilation, and get back a duplicate result -- same source URL, same
+        debugger / profiler ID, same toString behavior, etc.
+        
+        The basic unit of compilation and evaluation is now SourceCode, which
+        encompasses a SourceProvider, a range in that provider, and a starting
+        line number.
+
+        A SourceProvider now encompasses a source URL, and *is* a source ID,
+        since a pointer is a unique identifier.
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax): Provide a SourceCode to the Interpreter, since
+        other APIs are no longer supported.
+        
+        * VM/CodeBlock.h:
+        (JSC::EvalCodeCache::get): Provide a SourceCode to the Interpreter, since
+        other APIs are no longer supported.
+        (JSC::CodeBlock::CodeBlock): ASSERT something that used to be ASSERTed
+        by our caller -- this is a better bottleneck.
+
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::CodeGenerator): Updated for the fact that
+        FunctionBodyNode's parameters are no longer a WTF::Vector.
+
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::Arguments): ditto
+
+        * kjs/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate): Provide a SourceCode to the Parser,
+        since other APIs are no longer supported.
+
+        * kjs/FunctionConstructor.cpp:
+        (JSC::constructFunction): Provide a SourceCode to the Parser, since
+        other APIs are no longer supported. Adopt FunctionBodyNode's new
+        "finishParsing" API.
+
+        * kjs/JSFunction.cpp:
+        (JSC::JSFunction::lengthGetter):
+        (JSC::JSFunction::getParameterName): Updated for the fact that
+        FunctionBodyNode's parameters are no longer a wtf::Vector.
+
+        * kjs/JSFunction.h: Nixed some cruft.
+
+        * kjs/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval): Provide a SourceCode to the Parser, since
+        other APIs are no longer supported. 
+
+        * kjs/Parser.cpp:
+        (JSC::Parser::parse): Require a SourceCode argument, instead of a bunch
+        of broken out parameters. Stop tracking sourceId as an integer, since we
+        use the SourceProvider pointer for this now. Don't clamp the
+        startingLineNumber, since SourceCode does that now.
+
+        * kjs/Parser.h:
+        (JSC::Parser::parse): Standardized the parsing interface to require a
+        SourceCode.
+
+        * kjs/Shell.cpp:
+        (functionRun):
+        (functionLoad):
+        (prettyPrintScript):
+        (runWithScripts):
+        (runInteractive): Provide a SourceCode to the Interpreter, since
+        other APIs are no longer supported.
+
+        * kjs/SourceProvider.h:
+        (JSC::SourceProvider::SourceProvider):
+        (JSC::SourceProvider::url):
+        (JSC::SourceProvider::asId):
+        (JSC::UStringSourceProvider::create):
+        (JSC::UStringSourceProvider::UStringSourceProvider): Added new
+        responsibilities described above.
+
+        * kjs/SourceRange.h:
+        (JSC::SourceCode::SourceCode):
+        (JSC::SourceCode::toString):
+        (JSC::SourceCode::provider):
+        (JSC::SourceCode::firstLine):
+        (JSC::SourceCode::data):
+        (JSC::SourceCode::length): Added new responsibilities described above.
+        Renamed SourceRange to SourceCode, based on review feedback. Added
+        a makeSource function for convenience.
+
+        * kjs/debugger.h: Provide a SourceCode to the client, since other APIs
+        are no longer supported.
+
+        * kjs/grammar.y: Provide startingLineNumber when creating a SourceCode.
+
+        * kjs/debugger.h: Treat sourceId as intptr_t to avoid loss of precision
+        on 64bit platforms.
+
+        * kjs/interpreter.cpp:
+        (JSC::Interpreter::checkSyntax):
+        (JSC::Interpreter::evaluate):
+        * kjs/interpreter.h: Require a SourceCode instead of broken out arguments.
+
+        * kjs/lexer.cpp:
+        (JSC::Lexer::setCode):
+        * kjs/lexer.h:
+        (JSC::Lexer::sourceRange): Fold together the SourceProvider and line number
+        into a SourceCode. Fixed a bug where the Lexer would accidentally keep
+        alive the last SourceProvider forever.
+
+        * kjs/nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::EvalNode):
+        (JSC::EvalNode::generateCode):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::finishParsing):
+        (JSC::FunctionBodyNode::create):
+        (JSC::FunctionBodyNode::generateCode):
+        (JSC::ProgramNode::generateCode):
+        (JSC::FunctionBodyNode::paramString):
+        * kjs/nodes.h:
+        (JSC::ScopeNode::):
+        (JSC::ScopeNode::sourceId):
+        (JSC::FunctionBodyNode::):
+        (JSC::FunctionBodyNode::parameterCount):
+        (JSC::FuncExprNode::):
+        (JSC::FuncDeclNode::): Store a SourceCode in all ScopeNodes, since
+        SourceCode is now responsible for tracking URL, ID, etc. Streamlined
+        some ad hoc FunctionBodyNode fixups into a "finishParsing" function, to
+        help make clear what you need to do in order to finish parsing a
+        FunctionBodyNode.
+
+        * wtf/Vector.h:
+        (WTF::::releaseBuffer): Don't ASSERT that releaseBuffer() is only called
+        when buffer is not 0, since FunctionBodyNode is more than happy
+        to get back a 0 buffer, and other functions like RefPtr::release() allow
+        for 0, too.
+
+2008-10-01  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21289: REGRESSION (r37160): Inspector crashes on load
+        <https://bugs.webkit.org/show_bug.cgi?id=21289>
+
+        The code in Arguments::mark() in r37160 was wrong. It marks indices in
+        d->registers, but that makes no sense (they are local variables, not
+        arguments). It should mark those indices in d->registerArray instead.
+
+        This patch also changes Arguments::copyRegisters() to use d->numParameters
+        instead of recomputing it.
+
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::mark):
+        * kjs/Arguments.h:
+        (JSC::Arguments::copyRegisters):
+
+2008-09-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21214
+          work on getting rid of ExecState
+
+        Eliminate some unneeded uses of dynamicGlobalObject.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::contextData): Changed to use a map in the global data instead
+        of on the global object. Also fixed to use only a single hash table lookup.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeConstructor): Use lexicalGlobalObject rather than dynamicGlobalObject
+        to get the object prototype.
+
+        * kjs/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString): Use arrayVisitedElements set in global data rather
+        than in the global object.
+        (JSC::arrayProtoFuncToLocaleString): Ditto.
+        (JSC::arrayProtoFuncJoin): Ditto.
+
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData): Don't initialize opaqueJSClassData, since
+        it's no longer a pointer.
+        (JSC::JSGlobalData::~JSGlobalData): We still need to delete all the values, but
+        we don't need to delete the map since it's no longer a pointer.
+
+        * kjs/JSGlobalData.h: Made opaqueJSClassData a map instead of a pointer to a map.
+        Also added arrayVisitedElements.
+
+        * kjs/JSGlobalObject.h: Removed arrayVisitedElements.
+
+        * kjs/Shell.cpp:
+        (functionRun): Use lexicalGlobalObject instead of dynamicGlobalObject.
+        (functionLoad): Ditto.
+
+2008-10-01  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Speculative Windows build fix.
+
+        * kjs/grammar.y:
+
+2008-10-01  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 21123: using "arguments" in a function should not force creation of an activation object
+        <https://bugs.webkit.org/show_bug.cgi?id=21123>
+
+        Make the 'arguments' object not require a JSActivation. We store the
+        'arguments' object in the OptionalCalleeArguments call frame slot. We
+        need to be able to get the original 'arguments' object to tear it off
+        when returning from a function, but 'arguments' may be assigned to in a
+        number of ways.
+
+        Therefore, we use the OptionalCalleeArguments slot when we want to get
+        the original activation or we know that 'arguments' was not assigned a
+        different value. When 'arguments' may have been assigned a new value,
+        we use a new local variable that is initialized with 'arguments'. Since
+        a function parameter named 'arguments' may overwrite the value of
+        'arguments', we also need to be careful to look up 'arguments' in the
+        symbol table, so we get the parameter named 'arguments' instead of the
+        local variable that we have added for holding the 'arguments' object.
+
+        This is a 19.1% win on the V8 Raytrace benchmark using the SunSpider
+        harness, and a 20.7% win using the V8 harness. This amounts to a 6.5%
+        total speedup on the V8 benchmark suite using the V8 harness.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CodeBlock.h:
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::CodeGenerator):
+        * VM/Machine.cpp:
+        (JSC::Machine::unwindCallFrame):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::retrieveArguments):
+        (JSC::Machine::cti_op_init_arguments):
+        (JSC::Machine::cti_op_ret_activation_arguments):
+        * VM/Machine.h:
+        * VM/RegisterFile.h:
+        (JSC::RegisterFile::):
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::mark):
+        (JSC::Arguments::fillArgList):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::put):
+        * kjs/Arguments.h:
+        (JSC::Arguments::setRegisters):
+        (JSC::Arguments::init):
+        (JSC::Arguments::Arguments):
+        (JSC::Arguments::copyRegisters):
+        (JSC::JSActivation::copyRegisters):
+        * kjs/JSActivation.cpp:
+        (JSC::JSActivation::argumentsGetter):
+        * kjs/JSActivation.h:
+        (JSC::JSActivation::JSActivationData::JSActivationData):
+        * kjs/grammar.y:
+        * kjs/nodes.h:
+        (JSC::ScopeNode::setUsesArguments):
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::orl_mr):
+
+2008-10-01  Kevin McCullough  <kmccullough@apple.com>
+
+        Rubberstamped by Geoff Garen.
+
+        Remove BreakpointCheckStatement because it's not used anymore.
+        No effect on sunspider or the jsc tests.
+
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+
+2008-09-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Improve performance of CTI on windows.
+
+        Currently on platforms where the compiler doesn't allow us to safely
+        index relative to the address of a parameter we need to actually
+        provide a pointer to CTI runtime call arguments.  This patch improves
+        performance in this case by making the CTI logic for restoring this
+        parameter much less conservative by only resetting it before we actually
+        make a call, rather than between each and every SF bytecode we generate
+        code for.
+
+        This results in a 3.6% progression on the v8 benchmark when compiled with MSVC.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitCall):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        * VM/CTI.h:
+        * masm/X86Assembler.h:
+        * wtf/Platform.h:
+
+2008-09-30  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - track uses of "this", "with" and "catch" in the parser
+        
+        Knowing this up front will be useful for future optimizations.
+        
+        Perf and correctness remain the same.
+        
+        * kjs/NodeInfo.h:
+        * kjs/grammar.y:
+
+2008-09-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Add WebKitAvailability macros for JSObjectMakeArray, JSObjectMakeDate, JSObjectMakeError,
+        and JSObjectMakeRegExp
+
+        * API/JSObjectRef.h:
+
+2008-09-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21214
+          work on getting rid of ExecState
+
+        Replaced the m_prev field of ExecState with a bit in the
+        call frame pointer to indicate "host" call frames.
+
+        * VM/Machine.cpp:
+        (JSC::makeHostCallFramePointer): Added. Sets low bit.
+        (JSC::isHostCallFrame): Added. Checks low bit.
+        (JSC::stripHostCallFrameBit): Added. Clears low bit.
+        (JSC::Machine::unwindCallFrame): Replaced null check that was
+        formerly used to detect host call frames with an isHostCallFrame check.
+        (JSC::Machine::execute): Pass in a host call frame pointer rather than
+        always passing 0 when starting execution from the host. This allows us
+        to follow the entire call frame pointer chain when desired, or to stop
+        at the host calls when that's desired.
+        (JSC::Machine::privateExecute): Replaced null check that was
+        formerly used to detect host call frames with an isHostCallFrame check.
+        (JSC::Machine::retrieveCaller): Ditto.
+        (JSC::Machine::retrieveLastCaller): Ditto.
+        (JSC::Machine::callFrame): Removed the code to walk up m_prev pointers
+        and replaced it with code that uses the caller pointer and uses the
+        stripHostCallFrameBit function.
+
+        * kjs/ExecState.cpp: Removed m_prev.
+        * kjs/ExecState.h: Ditto.
+
+2008-09-30  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Move all detection of 'arguments' in a lexical scope to the parser, in
+        preparation for fixing
+
+        Bug 21123: using "arguments" in a function should not force creation of an activation object
+        <https://bugs.webkit.org/show_bug.cgi?id=21123>
+
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::CodeGenerator):
+        * kjs/NodeInfo.h:
+        * kjs/grammar.y:
+
+2008-09-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        * kjs/Shell.cpp:
+        (runWithScripts): Fixed indentation.
+
+2008-09-30  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Build fix.  Move InternalFunction::classInfo implementation into the .cpp
+        file to prevent the vtable for InternalFunction being generated as a weak symbol.
+        Has no effect on SunSpider.
+
+        * kjs/InternalFunction.cpp:
+        (JSC::InternalFunction::classInfo):
+        * kjs/InternalFunction.h:
+
+2008-09-29  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        - optimize appending a number to a string
+        https://bugs.webkit.org/show_bug.cgi?id=21203
+        
+        It's pretty common in real-world code (and on some of the v8
+        benchmarks) to append a number to a string, so I made this one of
+        the fast cases, and also added support to UString to do it
+        directly without allocating a temporary UString.
+        
+        ~1% speedup on v8 benchmark.
+
+        * VM/Machine.cpp:
+        (JSC::jsAddSlowCase): Make this NEVER_INLINE because somehow otherwise
+        the change is a regression.
+        (JSC::jsAdd): Handle number + string special case.
+        (JSC::Machine::cti_op_add): Integrate much of the logic of jsAdd to
+        avoid exception check in the str + str, num + num and str + num cases.
+        * kjs/ustring.cpp:
+        (JSC::expandedSize): Make this a non-member function, since it needs to be 
+        called in non-member functions but not outside this file.
+        (JSC::expandCapacity): Ditto.
+        (JSC::UString::expandCapacity): Call the non-member version. 
+        (JSC::createRep): Helper to make a rep from a char*.
+        (JSC::UString::UString): Use above helper.
+        (JSC::concatenate): Guts of concatenating constructor for cases where first
+        item is a UString::Rep, and second is a UChar* and length, or a char*.
+        (JSC::UString::append): Implement for cases where first item is a UString::Rep,
+        and second is an int or double. Sadly duplicates logic of UString::from(int)
+        and UString::from(double).
+        * kjs/ustring.h:
+
+2008-09-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21214
+          work on getting rid of ExecState
+
+        * JavaScriptCore.exp: Updated since JSGlobalObject::init
+        no longer takes a parameter.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::execute): Removed m_registerFile argument
+        for ExecState constructors.
+
+        * kjs/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate): Removed globalThisValue
+        argument for ExecState constructor.
+
+        * kjs/ExecState.cpp:
+        (JSC::ExecState::ExecState): Removed globalThisValue and
+        registerFile arguments to constructors.
+
+        * kjs/ExecState.h: Removed m_globalThisValue and
+        m_registerFile data members.
+
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init): Removed globalThisValue
+        argument for ExecState constructor.
+
+        * kjs/JSGlobalObject.h:
+        (JSC::JSGlobalObject::JSGlobalObject): Got rid of parameter
+        for the init function.
+
+2008-09-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber-stamped by Cameron Zwarich.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=21225
+        Machine::retrieveLastCaller should check for a NULL codeBlock
+        
+        In order to crash, you would need to call retrieveCaller in a situation
+        where you had two host call frames in a row in the register file. I
+        don't know how to make that happen, or if it's even possible, so I don't
+        have a test case -- but better safe than sorry!
+
+        * VM/Machine.cpp:
+        (JSC::Machine::retrieveLastCaller):
+
+2008-09-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Store the callee ScopeChain, not the caller ScopeChain, in the call frame
+        header. Nix the "scopeChain" local variable and ExecState::m_scopeChain, and
+        access the callee ScopeChain through the call frame header instead.
+
+        Profit: call + return are simpler, because they don't have to update the
+        "scopeChain" local variable, or ExecState::m_scopeChain.
+        
+        Because CTI keeps "r" in a register, reading the callee ScopeChain relative
+        to "r" can be very fast, in any cases we care to optimize.
+
+        0% speedup on empty function call benchmark. (5.5% speedup in bytecode.)
+        0% speedup on SunSpider. (7.5% speedup on controlflow-recursive.)
+        2% speedup on SunSpider --v8.
+        2% speedup on v8 benchmark.
+
+        * VM/CTI.cpp: Changed scope chain access to read the scope chain from
+        the call frame header. Sped up op_ret by changing it not to fuss with
+        the "scopeChain" local variable or ExecState::m_scopeChain.
+
+        * VM/CTI.h: Updated CTI trampolines not to take a ScopeChainNode*
+        argument, since that's stored in the call frame header now.
+
+        * VM/Machine.cpp: Access "scopeChain" and "codeBlock" through new helper
+        functions that read from the call frame header. Updated functions operating
+        on ExecState::m_callFrame to account for / take advantage of the fact that
+        Exec:m_callFrame is now never NULL.
+        
+        Fixed a bug in op_construct, where it would use the caller's default
+        object prototype, rather than the callee's, when constructing a new object.
+
+        * VM/Machine.h: Made some helper functions available. Removed
+        ScopeChainNode* arguments to a lot of functions, since the ScopeChainNode*
+        is now stored in the call frame header.
+
+        * VM/RegisterFile.h: Renamed "CallerScopeChain" to "ScopeChain", since
+        that's what it is now.
+
+        * kjs/DebuggerCallFrame.cpp: Updated for change to ExecState signature.
+
+        * kjs/ExecState.cpp:
+        * kjs/ExecState.h: Nixed ExecState::m_callFrame, along with the unused
+        isGlobalObject function.
+
+        * kjs/JSGlobalObject.cpp:
+        * kjs/JSGlobalObject.h: Gave the global object a fake call frame in
+        which to store the global scope chain, since our code now assumes that
+        it can always read the scope chain out of the ExecState's call frame.
+
+2008-09-29  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Sam Weinig.
+
+        Remove the isActivationObject() virtual method on JSObject and use
+        StructureID information instead. This should be slightly faster, but
+        isActivationObject() is only used in assertions and unwinding the stack
+        for exceptions.
+
+        * VM/Machine.cpp:
+        (JSC::depth):
+        (JSC::Machine::unwindCallFrame):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_ret_activation):
+        * kjs/JSActivation.cpp:
+        * kjs/JSActivation.h:
+        * kjs/JSObject.h:
+
+2008-09-29  Peter Gal  <galpeter@inf.u-szeged.hu>
+
+        Reviewed and tweaked by Darin Adler.
+
+        Fix build for non-all-in-one platforms.
+
+        * kjs/StringPrototype.cpp: Added missing ASCIICType.h include.
+
+2008-09-29  Bradley T. Hughes  <bradley.hughes@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix compilation with icpc
+
+        * wtf/HashSet.h:
+        (WTF::::find):
+        (WTF::::contains):
+
+2008-09-29  Thiago Macieira  <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Changed copyright from Trolltech ASA to Nokia.
+        
+        Nokia acquired Trolltech ASA, assets were transferred on September 26th 2008.
+        
+
+        * wtf/qt/MainThreadQt.cpp:
+
+2008-09-29  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Lars Knoll.
+
+        Don't accidentially install libJavaScriptCore.a for the build inside
+        Qt.
+
+        * JavaScriptCore.pro:
+
+2008-09-28  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21200: Allow direct access to 'arguments' without using op_resolve
+        <https://bugs.webkit.org/show_bug.cgi?id=21200>
+
+        Allow fast access to the 'arguments' object by adding an extra slot to
+        the callframe to store it.
+
+        This is a 3.0% speedup on the V8 Raytrace benchmark.
+
+        * JavaScriptCore.exp:
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::CodeGenerator):
+        (JSC::CodeGenerator::registerFor):
+        * VM/CodeGenerator.h:
+        (JSC::CodeGenerator::registerFor):
+        * VM/Machine.cpp:
+        (JSC::Machine::initializeCallFrame):
+        (JSC::Machine::dumpRegisters):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::retrieveArguments):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_op_create_arguments):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        * VM/Machine.h:
+        * VM/Opcode.h:
+        * VM/RegisterFile.h:
+        (JSC::RegisterFile::):
+        * kjs/JSActivation.cpp:
+        (JSC::JSActivation::mark):
+        (JSC::JSActivation::argumentsGetter):
+        * kjs/JSActivation.h:
+        (JSC::JSActivation::JSActivationData::JSActivationData):
+        * kjs/NodeInfo.h:
+        * kjs/Parser.cpp:
+        (JSC::Parser::didFinishParsing):
+        * kjs/Parser.h:
+        (JSC::Parser::parse):
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::ProgramNode::ProgramNode):
+        (JSC::ProgramNode::create):
+        (JSC::EvalNode::EvalNode):
+        (JSC::EvalNode::create):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::create):
+        * kjs/nodes.h:
+        (JSC::ScopeNode::usesArguments):
+
+2008-09-28  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add an ASCII fast-path to toLowerCase and toUpperCase.
+
+        The fast path speeds up the common case of an ASCII-only string by up to 60% while adding a less than 5% penalty
+        to the less common non-ASCII case.
+
+        This also removes stringProtoFuncToLocaleLowerCase and stringProtoFuncToLocaleUpperCase, which were identical
+        to the non-locale variants of the functions.  toLocaleLowerCase and toLocaleUpperCase now use the non-locale
+        variants of the functions directly.
+
+        * kjs/StringPrototype.cpp:
+        (JSC::stringProtoFuncToLowerCase):
+        (JSC::stringProtoFuncToUpperCase):
+
+2008-09-28  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Speed up parseInt and parseFloat.
+
+        Repeatedly indexing into a UString is slow, so retrieve a pointer into the underlying buffer once up front
+        and use that instead.  This is a 7% win on a parseInt/parseFloat micro-benchmark.
+
+        * kjs/JSGlobalObjectFunctions.cpp:
+        (JSC::parseInt):
+        (JSC::parseFloat):
+
+2008-09-28  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        In Qt's initializeThreading re-use an existing thread identifier for the main
+        thread if it exists.
+
+        currentThread() implicitly creates new identifiers and it could be that
+        it is called before initializeThreading().
+
+        * wtf/ThreadingQt.cpp:
+        (WTF::initializeThreading):
+
+2008-09-27  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Added Machine::retrieveCaller to the export list.
+
+        Reviewed by Kevin McCullough and Tim Hatcher.
+
+        * JavaScriptCore.exp: Added Machine::retrieveCaller.
+
+2008-09-27  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+
+        * VM/CTI.cpp:
+        (JSC::):
+
+2008-09-27  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=21175
+
+        Store the callee CodeBlock, not the caller CodeBlock, in the call frame
+        header. Nix the "codeBlock" local variable, and access the callee
+        CodeBlock through the call frame header instead.
+        
+        Profit: call + return are simpler, because they don't have to update the
+        "codeBlock" local variable.
+        
+        Because CTI keeps "r" in a register, reading the callee CodeBlock relative
+        to "r" can be very fast, in any cases we care to optimize. Presently,
+        no such cases seem important.
+        
+        Also, stop writing "dst" to the call frame header. CTI doesn't use it.
+        
+        21.6% speedup on empty function call benchmark.
+        3.8% speedup on SunSpider --v8.
+        2.1% speedup on v8 benchmark.
+        0.7% speedup on SunSpider (6% speedup on controlflow-recursive).
+        
+        Small regression in bytecode, because currently every op_ret reads the
+        callee CodeBlock to check needsFullScopeChain, and bytecode does not
+        keep "r" in a register. On-balance, this is probably OK, since CTI is
+        our high-performance execution model. Also, this should go away once
+        we make needsFullScopeChain statically determinable at parse time.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCall): The speedup!
+        (JSC::CTI::privateCompileSlowCases): ditto
+
+        * VM/CTI.h:
+        (JSC::): Fixed up magic trampoline constants to account for the nixed
+        "codeBlock" argument.
+        (JSC::CTI::execute): Changed trampoline function not to take a "codeBlock"
+        argument, since codeBlock is now stored in the call frame header.
+        
+        * VM/Machine.cpp: Read the callee CodeBlock from the register file. Use
+        a NULL CallerRegisters in the call frame header to signal a built-in
+        caller, since CodeBlock is now never NULL.
+
+        * VM/Machine.h: Made some stand-alone functions Machine member functions
+        so they could call the private codeBlock() accessor in the Register
+        class, of which Machine is a friend. Renamed "CallerCodeBlock" to
+        "CodeBlock", since it's no longer the caller's CodeBlock.
+
+        * VM/RegisterFile.h: Marked some methods const to accommodate a 
+        const RegisterFile* being passed around in Machine.cpp.
+
+2008-09-26  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix. Not reviewed.
+
+        Narrow-down the target of the JavaScriptCore .lut.h generator so
+        it won't try to create the WebCore .lut.hs.
+
+        * GNUmakefile.am:
+
+2008-09-26  Matt Lilek  <webkit@mattlilek.com>
+
+        Reviewed by Tim Hatcher.
+
+        Update FEATURE_DEFINES after ENABLE_CROSS_DOCUMENT_MESSAGING was removed.
+
+        * Configurations/JavaScriptCore.xcconfig:
+
+2008-09-26  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Rubber-stamped by Anders Carlson.
+
+        Change the name 'sc' to 'scopeChainNode' in a few places.
+
+        * kjs/nodes.cpp:
+        (JSC::EvalNode::generateCode):
+        (JSC::FunctionBodyNode::generateCode):
+        (JSC::ProgramNode::generateCode):
+
+2008-09-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=21152
+        Speedup static property get/put
+
+        Convert getting/setting static property values to use static functions
+        instead of storing an integer and switching in getValueProperty/putValueProperty.
+
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::getPropertyAttributes):
+        * kjs/MathObject.cpp:
+        (JSC::MathObject::getOwnPropertySlot):
+        * kjs/NumberConstructor.cpp:
+        (JSC::numberConstructorNaNValue):
+        (JSC::numberConstructorNegInfinity):
+        (JSC::numberConstructorPosInfinity):
+        (JSC::numberConstructorMaxValue):
+        (JSC::numberConstructorMinValue):
+        * kjs/PropertySlot.h:
+        (JSC::PropertySlot::):
+        * kjs/RegExpConstructor.cpp:
+        (JSC::regExpConstructorDollar1):
+        (JSC::regExpConstructorDollar2):
+        (JSC::regExpConstructorDollar3):
+        (JSC::regExpConstructorDollar4):
+        (JSC::regExpConstructorDollar5):
+        (JSC::regExpConstructorDollar6):
+        (JSC::regExpConstructorDollar7):
+        (JSC::regExpConstructorDollar8):
+        (JSC::regExpConstructorDollar9):
+        (JSC::regExpConstructorInput):
+        (JSC::regExpConstructorMultiline):
+        (JSC::regExpConstructorLastMatch):
+        (JSC::regExpConstructorLastParen):
+        (JSC::regExpConstructorLeftContext):
+        (JSC::regExpConstructorRightContext):
+        (JSC::setRegExpConstructorInput):
+        (JSC::setRegExpConstructorMultiline):
+        (JSC::RegExpConstructor::setInput):
+        (JSC::RegExpConstructor::setMultiline):
+        (JSC::RegExpConstructor::multiline):
+        * kjs/RegExpConstructor.h:
+        * kjs/RegExpObject.cpp:
+        (JSC::regExpObjectGlobal):
+        (JSC::regExpObjectIgnoreCase):
+        (JSC::regExpObjectMultiline):
+        (JSC::regExpObjectSource):
+        (JSC::regExpObjectLastIndex):
+        (JSC::setRegExpObjectLastIndex):
+        * kjs/RegExpObject.h:
+        (JSC::RegExpObject::setLastIndex):
+        (JSC::RegExpObject::lastIndex):
+        (JSC::RegExpObject::RegExpObjectData::RegExpObjectData):
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::getEnumerablePropertyNames):
+        * kjs/create_hash_table:
+        * kjs/lexer.cpp:
+        (JSC::Lexer::lex):
+        * kjs/lookup.cpp:
+        (JSC::HashTable::createTable):
+        (JSC::HashTable::deleteTable):
+        (JSC::setUpStaticFunctionSlot):
+        * kjs/lookup.h:
+        (JSC::HashEntry::initialize):
+        (JSC::HashEntry::setKey):
+        (JSC::HashEntry::key):
+        (JSC::HashEntry::attributes):
+        (JSC::HashEntry::function):
+        (JSC::HashEntry::functionLength):
+        (JSC::HashEntry::propertyGetter):
+        (JSC::HashEntry::propertyPutter):
+        (JSC::HashEntry::lexerValue):
+        (JSC::HashEntry::):
+        (JSC::HashTable::entry):
+        (JSC::getStaticPropertySlot):
+        (JSC::getStaticValueSlot):
+        (JSC::lookupPut):
+
+2008-09-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak & Oliver Hunt.
+
+        Add support for reusing temporary JSNumberCells.  This change is based on the observation
+        that if the result of certain operations is a JSNumberCell and is consumed by a subsequent
+        operation that would produce a JSNumberCell, we can reuse the object rather than allocating
+        a fresh one.  E.g. given the expression ((a * b) * c), we can statically determine that
+        (a * b) will have a numeric result (or else it will have thrown an exception), so the result
+        will either be a JSNumberCell or a JSImmediate.
+
+        This patch changes three areas of JSC:
+            * The AST now tracks type information about the result of each node.
+            * This information is consumed in bytecode compilation, and certain bytecode operations
+              now carry the statically determined type information about their operands.
+            * CTI uses the information in a number of fashions:
+                * Where an operand to certain arithmetic operations is reusable, it will plant code
+                  to try to perform the operation in JIT code & reuse the cell, where appropriate.
+                * Where it can be statically determined that an operand can only be numeric (typically
+                  the result of another arithmetic operation) the code will not redundantly check that
+                  the JSCell is a JSNumberCell.
+                * Where either of the operands to an add are non-numeric do not plant an optimized
+                  arithmetic code path, just call straight out to the C function.
+
+        +6% Sunspider (10% progression on 3D, 16% progression on math, 60% progression on access-nbody),
+        +1% v8-tests (improvements in raytrace & crypto)
+
+        * VM/CTI.cpp: Add optimized code generation with reuse of temporary JSNumberCells.
+        * VM/CTI.h:
+        * kjs/JSNumberCell.h:
+        * masm/X86Assembler.h:
+
+        * VM/CodeBlock.cpp: Add type information to specific bytecodes.
+        * VM/CodeGenerator.cpp:
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+
+        * kjs/nodes.cpp: Track static type information for nodes.
+        * kjs/nodes.h:
+        * kjs/ResultDescriptor.h: (Added)
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-09-26  Yichao Yin  <yichao.yin@torchmobile.com.cn>
+
+        Reviewed by George Staikos, Maciej Stachowiak.
+
+        Add utility functions needed for upcoming WML code.
+
+        * wtf/ASCIICType.h:
+        (WTF::isASCIIPrintable):
+
+2008-09-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Reverted the part of r36614 that used static data because static data
+        is not thread-safe.
+
+2008-09-26  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Removed dynamic check for whether the callee needs an activation object.
+        Replaced with callee code to create the activation object.
+
+        0.5% speedup on SunSpider.
+        No change on v8 benchmark. (Might be a speedup, but it's in range of the
+        variance.)
+
+        0.7% speedup on v8 benchmark in bytecode.
+        1.3% speedup on empty call benchmark in bytecode.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass): Added support for op_init_activation,
+        the new opcode that specifies that the callee's initialization should
+        create an activation object.
+        (JSC::CTI::privateCompile): Removed previous code that did a similar
+        thing in an ad-hoc way.
+
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Added a case for dumping op_init_activation.
+
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::generate): Added fixup code to change op_init to
+        op_init_activation if necessary. (With a better parser, we would know
+        which to use from the beginning.)
+
+        * VM/Instruction.h:
+        (JSC::Instruction::Instruction):
+        (WTF::): Faster traits for the instruction vector. An earlier version
+        of this patch relied on inserting at the beginning of the vector, and
+        depended on this change for speed.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::execute): Removed clients of setScopeChain, the old
+        abstraction for dynamically checking for whether an activation object
+        needed to be created.
+        (JSC::Machine::privateExecute): ditto
+
+        (JSC::Machine::cti_op_push_activation): Renamed this function from
+        cti_vm_updateScopeChain, and made it faster by removing the call to 
+        setScopeChain.
+        * VM/Machine.h:
+
+        * VM/Opcode.h: Declared op_init_activation.
+
+2008-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Move most of the return code back into the callee, now that the callee
+        doesn't have to calculate anything dynamically.
+        
+        11.5% speedup on empty function call benchmark.
+        
+        SunSpider says 0.3% faster. SunSpider --v8 says no change.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+
+2008-09-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove staticFunctionGetter.  There is only one remaining user of
+        staticFunctionGetter and it can be converted to use setUpStaticFunctionSlot.
+
+        * JavaScriptCore.exp:
+        * kjs/lookup.cpp:
+        * kjs/lookup.h:
+
+2008-09-24  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        - inline JIT fast case of op_neq
+        - remove extra level of function call indirection from slow cases of eq and neq
+        
+        1% speedup on Richards
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_eq):
+        (JSC::Machine::cti_op_neq):
+        * kjs/operations.cpp:
+        (JSC::equal):
+        (JSC::equalSlowCase):
+        * kjs/operations.h:
+        (JSC::equalSlowCaseInline):
+
+2008-09-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21080
+        <rdar://problem/6243534>
+        Crash below Function.apply when using a runtime array as the argument list
+
+        Test: plugins/bindings-array-apply-crash.html
+
+        * kjs/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncApply): Revert to the slow case if the object inherits from 
+        JSArray (via ClassInfo) but is not a JSArray.
+
+2008-09-24  Kevin McCullough  <kmccullough@apple.com>
+
+        Style change.
+
+        * kjs/nodes.cpp:
+        (JSC::statementListEmitCode):
+
+2008-09-24  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoff.
+
+        Bug 21031: Breakpoints in the condition of loops only breaks the first
+        time
+        - Now when setting breakpoints in the condition of a loop (for, while,
+        for in, and do while) will successfully break each time throught the
+        loop.
+        - For 'for' loops we need a little more complicated behavior that cannot
+        be accomplished without some more significant changes:
+        https://bugs.webkit.org/show_bug.cgi?id=21073
+
+        * kjs/nodes.cpp:
+        (JSC::statementListEmitCode): We don't want to blindly emit a debug hook
+        at the first line of loops, instead let the loop emit the debug hooks.
+        (JSC::DoWhileNode::emitCode):
+        (JSC::WhileNode::emitCode):
+        (JSC::ForNode::emitCode):
+        (JSC::ForInNode::emitCode):
+        * kjs/nodes.h:
+        (JSC::StatementNode::):
+        (JSC::DoWhileNode::):
+        (JSC::WhileNode::):
+        (JSC::ForInNode::):
+
+2008-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed <rdar://problem/5605532> Need a SPI for telling JS the size of
+        the objects it retains
+
+        * API/tests/testapi.c: Test the new SPI a little.
+
+        * API/JSSPI.cpp: Add the new SPI.
+        * API/JSSPI.h: Add the new SPI.
+        * JavaScriptCore.exp: Add the new SPI.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Add the new SPI.
+
+2008-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        * API/JSBase.h: Filled in some missing function names.
+
+2008-09-24  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=21057
+        Crash in RegisterID::deref() running fast/canvas/canvas-putImageData.html
+
+        * VM/CodeGenerator.h: Changed declaration order to ensure the
+        m_lastConstant, which is a RefPtr that points into m_calleeRegisters,
+        has its destructor called before the destructor for m_calleeRegisters.
+
+2008-09-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21047
+          speed up ret_activation with inlining
+
+        About 1% on v8-raytrace.
+
+        * JavaScriptCore.exp: Removed JSVariableObject::setRegisters.
+
+        * kjs/JSActivation.cpp: Moved copyRegisters to the header to make it inline.
+        * kjs/JSActivation.h:
+        (JSC::JSActivation::copyRegisters): Moved here. Also removed the registerArraySize
+        argument to setRegisters, since the object doesn't need to store the number of
+        registers.
+
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset): Removed unnecessary clearing left over from when we
+        used this on objects that weren't brand new. These days, this function is really
+        just part of the constructor.
+
+        * kjs/JSGlobalObject.h: Added registerArraySize to JSGlobalObjectData, since
+        JSVariableObjectData no longer needs it. Added a setRegisters override here
+        that handles storing the size.
+
+        * kjs/JSStaticScopeObject.h: Removed code to set registerArraySize, since it
+        no longer exists.
+
+        * kjs/JSVariableObject.cpp: Moved copyRegisterArray and setRegisters to the
+        header to make them inline.
+        * kjs/JSVariableObject.h: Removed registerArraySize from JSVariableObjectData,
+        since it was only used for the global object.
+        (JSC::JSVariableObject::copyRegisterArray): Moved here ot make it inline.
+        (JSC::JSVariableObject::setRegisters): Moved here to make it inline. Also
+        removed the code to set registerArraySize and changed an if statement into
+        an assert to save an unnnecessary branch.
+
+2008-09-24  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        - inline PropertyMap::getOffset to speed up polymorphic lookups
+        
+        ~1.5% speedup on v8 benchmark
+        no effect on SunSpider
+
+        * JavaScriptCore.exp:
+        * kjs/PropertyMap.cpp:
+        * kjs/PropertyMap.h:
+        (JSC::PropertyMap::getOffset):
+
+2008-09-24  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Alp Toker.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20992
+        Build fails on GTK+ Mac OS
+
+        * wtf/ThreadingGtk.cpp: Remove platform ifdef as suggested by
+          Richard Hult.
+        (WTF::initializeThreading):
+
+2008-09-23  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 19968: Slow Script at www.huffingtonpost.com
+        <https://bugs.webkit.org/show_bug.cgi?id=19968>
+
+        Finally found the cause of this accursed issue.  It is triggered
+        by synchronous creation of a new global object from JS.  The new
+        global object resets the timer state in this execution group's
+        Machine, taking timerCheckCount to 0.  Then when JS returns the
+        timerCheckCount is decremented making it non-zero.  The next time
+        we execute JS we will start the timeout counter, however the non-zero
+        timeoutCheckCount means we don't reset the timer information. This
+        means that the timeout check is now checking the cumulative time
+        since the creation of the global object rather than the time since
+        JS was last entered.  At this point the slow script dialog is guaranteed
+        to eventually be displayed incorrectly unless a page is loaded
+        asynchronously (which will reset everything into a sane state).
+
+        The fix for this is rather trivial -- the JSGlobalObject constructor
+        should not be resetting the machine timer state.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::Machine):
+          Now that we can't rely on the GlobalObject initialising the timeout
+          state, we do it in the Machine constructor.
+
+        * VM/Machine.h:
+        (JSC::Machine::stopTimeoutCheck):
+          Add assertions to guard against this happening.
+
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::init):
+          Don't reset the timeout state.
+
+2008-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=21038 | <rdar://problem/6240812>
+        Uncaught exceptions in regex replace callbacks crash webkit
+        
+        This was a combination of two problems:
+        
+        (1) the replace function would continue execution after an exception
+        had been thrown.
+        
+        (2) In some cases, the Machine would return 0 in the case of an exception,
+        despite the fact that a few clients dereference the Machine's return
+        value without first checking for an exception.
+        
+        * VM/Machine.cpp:
+        (JSC::Machine::execute):
+        
+        ^ Return jsNull() instead of 0 in the case of an exception, since some
+        clients depend on using our return value.
+        
+        ^ ASSERT that execution does not continue after an exception has been
+        thrown, to help catch problems like this in the future.
+
+        * kjs/StringPrototype.cpp:
+        (JSC::stringProtoFuncReplace):
+        
+        ^ Stop execution if an exception has been thrown.
+
+2008-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Try to fix the windows build.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileMainPass):
+
+2008-09-23  Alp Toker  <alp@nuanti.com>
+
+        Build fix.
+
+        * VM/CTI.h:
+
+2008-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        * wtf/Platform.h: Removed duplicate #if.
+
+2008-09-23  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Changed the layout of the call frame from
+        
+        { header, parameters, locals | constants, temporaries }
+        
+        to
+        
+        { parameters, header | locals, constants, temporaries }
+        
+        This simplifies function entry+exit, and enables a number of future
+        optimizations.
+        
+        13.5% speedup on empty call benchmark for bytecode; 23.6% speedup on
+        empty call benchmark for CTI.
+        
+        SunSpider says no change. SunSpider --v8 says 1% faster.
+
+        * VM/CTI.cpp:
+        
+        Added a bit of abstraction for calculating whether a register is a
+        constant, since this patch changes that calculation:
+        (JSC::CTI::isConstant):
+        (JSC::CTI::getConstant):
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::getConstantImmediateNumericArg):
+
+        Updated for changes to callframe header location:
+        (JSC::CTI::emitPutToCallFrameHeader):
+        (JSC::CTI::emitGetFromCallFrameHeader):
+        (JSC::CTI::printOpcodeOperandTypes):
+        
+        Renamed to spite Oliver:
+        (JSC::CTI::emitInitRegister):
+        
+        Added an abstraction for emitting a call through a register, so that
+        calls through registers generate exception info, too:
+        (JSC::CTI::emitCall):
+
+        Updated to match the new callframe header layout, and to support calls
+        through registers, which have no destination address:
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+
+        * VM/CTI.h:
+
+        More of the above:
+        (JSC::CallRecord::CallRecord):
+
+        * VM/CodeBlock.cpp:
+
+        Updated for new register layout:
+        (JSC::registerName):
+        (JSC::CodeBlock::dump):
+
+        * VM/CodeBlock.h:
+        
+        Updated CodeBlock to track slightly different information about the
+        register frame, and tweaked the style of an ASSERT_NOT_REACHED.
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::getStubInfo):
+
+        * VM/CodeGenerator.cpp:
+        
+        Added some abstraction around constant register allocation, since this
+        patch changes it, changed codegen to account for the new callframe
+        layout, and added abstraction around register fetching code
+        that used to assume that all local registers lived at negative indices,
+        since vars now live at positive indices:
+        (JSC::CodeGenerator::generate):
+        (JSC::CodeGenerator::addVar):
+        (JSC::CodeGenerator::addGlobalVar):
+        (JSC::CodeGenerator::allocateConstants):
+        (JSC::CodeGenerator::CodeGenerator):
+        (JSC::CodeGenerator::addParameter):
+        (JSC::CodeGenerator::registerFor):
+        (JSC::CodeGenerator::constRegisterFor):
+        (JSC::CodeGenerator::newRegister):
+        (JSC::CodeGenerator::newTemporary):
+        (JSC::CodeGenerator::highestUsedRegister):
+        (JSC::CodeGenerator::addConstant):
+        
+        ASSERT that our caller referenced the registers it passed to us.
+        Otherwise, we might overwrite them with parameters:
+        (JSC::CodeGenerator::emitCall):
+        (JSC::CodeGenerator::emitConstruct):
+
+        * VM/CodeGenerator.h:
+        
+        Added some abstraction for getting a RegisterID for a given index,
+        since the rules are a little weird:
+        (JSC::CodeGenerator::registerFor):
+
+        * VM/Machine.cpp:
+
+        Utility function to transform a machine return PC to a virtual machine
+        return VPC, for the sake of stack unwinding, since both PCs are stored
+        in the same location now:
+        (JSC::vPCForPC):
+
+        Tweaked to account for new call frame:
+        (JSC::Machine::initializeCallFrame):
+        
+        Tweaked to account for registerOffset supplied by caller:
+        (JSC::slideRegisterWindowForCall):
+
+        Tweaked to account for new register layout:
+        (JSC::scopeChainForCall):
+        (JSC::Machine::callEval):
+        (JSC::Machine::dumpRegisters):
+        (JSC::Machine::unwindCallFrame):
+        (JSC::Machine::execute):
+
+        Changed op_call and op_construct to implement the new calling convention:
+        (JSC::Machine::privateExecute):
+
+        Tweaked to account for the new register layout:
+        (JSC::Machine::retrieveArguments):
+        (JSC::Machine::retrieveCaller):
+        (JSC::Machine::retrieveLastCaller):
+        (JSC::Machine::callFrame):
+        (JSC::Machine::getArgumentsData):
+
+        Changed CTI call helpers to implement the new calling convention:
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+        (JSC::Machine::cti_op_ret_activation):
+        (JSC::Machine::cti_op_ret_profiler):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+        (JSC::Machine::cti_op_call_eval):
+
+        * VM/Machine.h:
+
+        * VM/Opcode.h:
+        
+        Renamed op_initialise_locals to op_init, because this opcode
+        doesn't initialize all locals, and it doesn't initialize only locals.
+        Also, to spite Oliver.
+        
+        * VM/RegisterFile.h:
+        
+        New call frame enumeration values:
+        (JSC::RegisterFile::):
+
+        Simplified the calculation of whether a RegisterID is a temporary,
+        since we can no longer assume that all positive non-constant registers
+        are temporaries:
+        * VM/RegisterID.h:
+        (JSC::RegisterID::RegisterID):
+        (JSC::RegisterID::setTemporary):
+        (JSC::RegisterID::isTemporary):
+
+        Renamed firstArgumentIndex to firstParameterIndex because the assumption
+        that this variable pertained to the actual arguments supplied by the
+        caller caused me to write some buggy code:
+        * kjs/Arguments.cpp:
+        (JSC::ArgumentsData::ArgumentsData):
+        (JSC::Arguments::Arguments):
+        (JSC::Arguments::fillArgList):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::put):
+
+        Updated for new call frame layout:
+        * kjs/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::functionName):
+        (JSC::DebuggerCallFrame::type):
+        * kjs/DebuggerCallFrame.h:
+
+        Changed the activation object to account for the fact that a call frame
+        header now sits between parameters and local variables. This change
+        requires all variable objects to do their own marking, since they
+        now use their register storage differently:
+        * kjs/JSActivation.cpp:
+        (JSC::JSActivation::mark):
+        (JSC::JSActivation::copyRegisters):
+        (JSC::JSActivation::createArgumentsObject):
+        * kjs/JSActivation.h:
+
+        Updated global object to use the new interfaces required by the change
+        to JSActivation above:
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        (JSC::JSGlobalObject::mark):
+        (JSC::JSGlobalObject::copyGlobalsFrom):
+        (JSC::JSGlobalObject::copyGlobalsTo):
+        * kjs/JSGlobalObject.h:
+        (JSC::JSGlobalObject::addStaticGlobals):
+
+        Updated static scope object to use the new interfaces required by the 
+        change to JSActivation above:
+        * kjs/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::mark):
+        (JSC::JSStaticScopeObject::~JSStaticScopeObject):
+        * kjs/JSStaticScopeObject.h:
+        (JSC::JSStaticScopeObject::JSStaticScopeObject):
+        (JSC::JSStaticScopeObject::d):
+
+        Updated variable object to use the new interfaces required by the 
+        change to JSActivation above:
+        * kjs/JSVariableObject.cpp:
+        (JSC::JSVariableObject::copyRegisterArray):
+        (JSC::JSVariableObject::setRegisters):
+        * kjs/JSVariableObject.h:
+
+        Changed the bit twiddling in symbol table not to assume that all indices
+        are negative, since they can be positive now:
+        * kjs/SymbolTable.h:
+        (JSC::SymbolTableEntry::SymbolTableEntry):
+        (JSC::SymbolTableEntry::isNull):
+        (JSC::SymbolTableEntry::getIndex):
+        (JSC::SymbolTableEntry::getAttributes):
+        (JSC::SymbolTableEntry::setAttributes):
+        (JSC::SymbolTableEntry::isReadOnly):
+        (JSC::SymbolTableEntry::pack):
+        (JSC::SymbolTableEntry::isValidIndex):
+
+        Changed call and construct nodes to ref their functions and/or bases,
+        so that emitCall/emitConstruct doesn't overwrite them with parameters.
+        Also, updated for rename to registerFor:
+        * kjs/nodes.cpp:
+        (JSC::ResolveNode::emitCode):
+        (JSC::NewExprNode::emitCode):
+        (JSC::EvalFunctionCallNode::emitCode):
+        (JSC::FunctionCallValueNode::emitCode):
+        (JSC::FunctionCallResolveNode::emitCode):
+        (JSC::FunctionCallBracketNode::emitCode):
+        (JSC::FunctionCallDotNode::emitCode):
+        (JSC::PostfixResolveNode::emitCode):
+        (JSC::DeleteResolveNode::emitCode):
+        (JSC::TypeOfResolveNode::emitCode):
+        (JSC::PrefixResolveNode::emitCode):
+        (JSC::ReadModifyResolveNode::emitCode):
+        (JSC::AssignResolveNode::emitCode):
+        (JSC::ConstDeclNode::emitCodeSingle):
+        (JSC::ForInNode::emitCode):
+
+        Added abstraction for getting exception info out of a call through a
+        register:
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::emitCall):
+        
+        Removed duplicate #if:
+        * wtf/Platform.h:
+
+2008-09-23  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin.
+
+        Bug 21030: The JS debugger breaks on the do of a do-while not the while
+        (where the conditional statement is)
+        https://bugs.webkit.org/show_bug.cgi?id=21030
+        Now the statementListEmitCode detects if a do-while node is being
+        emited and emits the debug hook on the last line instead of the first.
+
+        This change had no effect on sunspider.
+
+        * kjs/nodes.cpp:
+        (JSC::statementListEmitCode):
+        * kjs/nodes.h:
+        (JSC::StatementNode::isDoWhile):
+        (JSC::DoWhileNode::isDoWhile):
+
+2008-09-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - inline the fast case of instanceof
+        https://bugs.webkit.org/show_bug.cgi?id=20818
+
+        ~2% speedup on EarleyBoyer test.
+        
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_instanceof):
+
+2008-09-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - add forgotten slow case logic for !==
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileSlowCases):
+
+2008-09-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - inline the fast cases of !==, same as for ===
+        
+        2.9% speedup on EarleyBoyer benchmark
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpStrictEq): Factored stricteq codegen into this function,
+        and parameterized so it can do the reverse version as well.
+        (JSC::CTI::privateCompileMainPass): Use the above for stricteq and nstricteq.
+        * VM/CTI.h:
+        (JSC::CTI::): Declare above stuff.
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_nstricteq): Removed fast cases, now handled inline.
+
+2008-09-23  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 20989: Aguments constructor should put 'callee' and 'length' properties in a more efficient way
+        <https://bugs.webkit.org/show_bug.cgi?id=20989>
+
+        Make special cases for the 'callee' and 'length' properties in the
+        Arguments object.
+
+        This is somewhere between a 7.8% speedup and a 10% speedup on the V8
+        Raytrace benchmark, depending on whether it is run alone or with the
+        other V8 benchmarks.
+
+        * kjs/Arguments.cpp:
+        (JSC::ArgumentsData::ArgumentsData):
+        (JSC::Arguments::Arguments):
+        (JSC::Arguments::mark):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::put):
+        (JSC::Arguments::deleteProperty):
+
+2008-09-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        - speed up instanceof some more
+        https://bugs.webkit.org/show_bug.cgi?id=20818
+        
+        ~2% speedup on EarleyBoyer
+
+        The idea here is to record in the StructureID whether the class
+        needs a special hasInstance or if it can use the normal logic from
+        JSObject. 
+        
+        Based on this I inlined the real work directly into
+        cti_op_instanceof and put the fastest checks up front and the
+        error handling at the end (so it should be fairly straightforward
+        to split off the beginning to be inlined if desired).
+
+        I only did this for CTI, not the bytecode interpreter.
+        
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructureID):
+        * ChangeLog:
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_instanceof):
+        * kjs/JSImmediate.h:
+        (JSC::JSImmediate::isAnyImmediate):
+        * kjs/TypeInfo.h:
+        (JSC::TypeInfo::overridesHasInstance):
+        (JSC::TypeInfo::flags):
+
+2008-09-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21019
+          make FunctionBodyNode::ref/deref fast
+
+        Speeds up v8-raytrace by 7.2%.
+
+        * kjs/nodes.cpp:
+        (JSC::FunctionBodyNode::FunctionBodyNode): Initialize m_refCount to 0.
+        * kjs/nodes.h:
+        (JSC::FunctionBodyNode::ref): Call base class ref once, and thereafter use
+        m_refCount.
+        (JSC::FunctionBodyNode::deref): Ditto, but the deref side.
+
+2008-09-22  Darin Adler  <darin@apple.com>
+
+        Pointed out by Sam Weinig.
+
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::fillArgList): Fix bad copy and paste. Oops!
+
+2008-09-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=20983
+          ArgumentsData should have some room to allocate some extra arguments inline
+
+        Speeds up v8-raytrace by 5%.
+
+        * kjs/Arguments.cpp:
+        (JSC::ArgumentsData::ArgumentsData): Use a fixed buffer if there are 4 or fewer
+        extra arguments.
+        (JSC::Arguments::Arguments): Use a fixed buffer if there are 4 or fewer
+        extra arguments.
+        (JSC::Arguments::~Arguments): Delete the buffer if necessary.
+        (JSC::Arguments::mark): Update since extraArguments are now Register.
+        (JSC::Arguments::fillArgList): Added special case for the only case that's
+        actually used in the practice, when there are no parameters. There are some
+        other special cases in there too, but that's the only one that matters.
+        (JSC::Arguments::getOwnPropertySlot): Updated to use setValueSlot since there's
+        no operation to get you at the JSValue* inside a Register as a "slot".
+
+2008-09-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=21014
+        Speed up for..in by using StructureID to avoid calls to hasProperty
+
+        Speeds up fasta by 8%.
+
+        * VM/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::invalidate):
+        * VM/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::next):
+        * kjs/PropertyNameArray.h:
+        (JSC::PropertyNameArrayData::begin):
+        (JSC::PropertyNameArrayData::end):
+        (JSC::PropertyNameArrayData::setCachedStructureID):
+        (JSC::PropertyNameArrayData::cachedStructureID):
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::getEnumerablePropertyNames):
+        (JSC::structureIDChainsAreEqual):
+        * kjs/StructureID.h:
+
+2008-09-22  Kelvin Sherlock  <ksherlock@gmail.com>
+
+        Updated and tweaked by Sam Weinig.
+
+        Reviewed by Geoffrey Garen.
+
+        Bug 20020: Proposed enhancement to JavaScriptCore API
+        <https://bugs.webkit.org/show_bug.cgi?id=20020>
+
+        Add JSObjectMakeArray, JSObjectMakeDate, JSObjectMakeError, and JSObjectMakeRegExp
+        functions to create JavaScript Array, Date, Error, and RegExp objects, respectively.
+
+        * API/JSObjectRef.cpp: The functions
+        * API/JSObjectRef.h: Function prototype and documentation
+        * JavaScriptCore.exp: Added functions to exported function list
+        * API/tests/testapi.c: Added basic functionality tests.
+
+        * kjs/DateConstructor.cpp:
+        Replaced static JSObject* constructDate(ExecState* exec, JSObject*, const ArgList& args)
+        with JSObject* constructDate(ExecState* exec, const ArgList& args).
+        Added static JSObject* constructWithDateConstructor(ExecState* exec, JSObject*, const ArgList& args) function
+
+        * kjs/DateConstructor.h:
+        added prototype for JSObject* constructDate(ExecState* exec, const ArgList& args)
+
+        * kjs/ErrorConstructor.cpp:
+        removed static qualifier from ErrorInstance* constructError(ExecState* exec, const ArgList& args)
+
+        * kjs/ErrorConstructor.h:
+        added prototype for ErrorInstance* constructError(ExecState* exec, const ArgList& args)
+
+        * kjs/RegExpConstructor.cpp:
+        removed static qualifier from JSObject* constructRegExp(ExecState* exec, const ArgList& args)
+
+        * kjs/RegExpConstructor.h:
+        added prototype for JSObject* constructRegExp(ExecState* exec, const ArgList& args)
+
+2008-09-22  Matt Lilek  <webkit@mattlilek.com>
+
+        Not reviewed, Windows build fix.
+
+        * kjs/Arguments.cpp:
+        * kjs/FunctionPrototype.cpp:
+
+2008-09-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=20982
+        Speed up the apply method of functions by special-casing array and 'arguments' objects
+
+        1% speedup on v8-raytrace.
+
+        Test: fast/js/function-apply.html
+
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::fillArgList):
+        * kjs/Arguments.h:
+        * kjs/FunctionPrototype.cpp:
+        (JSC::functionProtoFuncApply):
+        * kjs/JSArray.cpp:
+        (JSC::JSArray::fillArgList):
+        * kjs/JSArray.h:
+
+2008-09-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=20993
+          Array.push/pop need optimized cases for JSArray
+
+        3% or so speedup on DeltaBlue benchmark.
+
+        * kjs/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncPop): Call JSArray::pop when appropriate.
+        (JSC::arrayProtoFuncPush): Call JSArray::push when appropriate.
+
+        * kjs/JSArray.cpp:
+        (JSC::JSArray::putSlowCase): Set m_fastAccessCutoff when appropriate, getting
+        us into the fast code path.
+        (JSC::JSArray::pop): Added.
+        (JSC::JSArray::push): Added.
+        * kjs/JSArray.h: Added push and pop.
+
+        * kjs/operations.cpp:
+        (JSC::throwOutOfMemoryError): Don't inline this. Helps us avoid PIC branches.
+
+2008-09-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - speed up instanceof operator by replacing implementsHasInstance method with a TypeInfo flag
+
+        Partial work towards <https://bugs.webkit.org/show_bug.cgi?id=20818>
+        
+        2.2% speedup on EarleyBoyer benchmark.
+
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackConstructor.h:
+        (JSC::JSCallbackConstructor::createStructureID):
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackFunction.h:
+        (JSC::JSCallbackFunction::createStructureID):
+        * API/JSCallbackObject.h:
+        (JSC::JSCallbackObject::createStructureID):
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::hasInstance):
+        * API/JSValueRef.cpp:
+        (JSValueIsInstanceOfConstructor):
+        * JavaScriptCore.exp:
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_instanceof):
+        * kjs/InternalFunction.cpp:
+        * kjs/InternalFunction.h:
+        (JSC::InternalFunction::createStructureID):
+        * kjs/JSObject.cpp:
+        * kjs/JSObject.h:
+        * kjs/TypeInfo.h:
+        (JSC::TypeInfo::implementsHasInstance):
+
+2008-09-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dave Hyatt.
+        
+        Based on initial work by Darin Adler.
+        
+        - replace masqueradesAsUndefined virtual method with a flag in TypeInfo
+        - use this to JIT inline code for eq_null and neq_null
+        https://bugs.webkit.org/show_bug.cgi?id=20823
+
+        0.5% speedup on SunSpider
+        ~4% speedup on Richards benchmark
+        
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        * VM/Machine.cpp:
+        (JSC::jsTypeStringForValue):
+        (JSC::jsIsObjectType):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_is_undefined):
+        * VM/Machine.h:
+        * kjs/JSCell.h:
+        * kjs/JSValue.h:
+        * kjs/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::create):
+        (JSC::StringObjectThatMasqueradesAsUndefined::createStructureID):
+        * kjs/StructureID.h:
+        (JSC::StructureID::mutableTypeInfo):
+        * kjs/TypeInfo.h:
+        (JSC::TypeInfo::TypeInfo):
+        (JSC::TypeInfo::masqueradesAsUndefined):
+        * kjs/operations.cpp:
+        (JSC::equal):
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::setne_r):
+        (JSC::X86Assembler::setnz_r):
+        (JSC::X86Assembler::testl_i32m):
+
+2008-09-22  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Initialize QCoreApplication in kjs binary/Shell.cpp
+        
+        This allows us to use QCoreApplication::instance() to
+        get the main thread in ThreadingQt.cpp
+
+        * kjs/Shell.cpp:
+        (main):
+        * wtf/ThreadingQt.cpp:
+        (WTF::initializeThreading):
+
+2008-09-21  Darin Adler  <darin@apple.com>
+
+        - blind attempt to fix non-all-in-one builds
+
+        * kjs/JSGlobalObject.cpp: Added includes of Arguments.h and RegExpObject.h.
+
+2008-09-21  Darin Adler  <darin@apple.com>
+
+        - fix debug build
+
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::addPropertyTransition): Use typeInfo().type() instead of m_type.
+        (JSC::StructureID::createCachedPrototypeChain): Ditto.
+
+2008-09-21  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        - introduce a TypeInfo class, for holding per-type (in the C++ class sense) date in StructureID
+        https://bugs.webkit.org/show_bug.cgi?id=20981
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        * VM/Machine.cpp:
+        (JSC::jsIsObjectType):
+        (JSC::Machine::Machine):
+        * kjs/AllInOneFile.cpp:
+        * kjs/JSCell.h:
+        (JSC::JSCell::isObject):
+        (JSC::JSCell::isString):
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * kjs/JSGlobalObject.h:
+        (JSC::StructureID::prototypeForLookup):
+        * kjs/JSNumberCell.h:
+        (JSC::JSNumberCell::createStructureID):
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::createInheritorID):
+        * kjs/JSObject.h:
+        (JSC::JSObject::createStructureID):
+        * kjs/JSString.h:
+        (JSC::JSString::createStructureID):
+        * kjs/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        * kjs/RegExpConstructor.cpp:
+        * kjs/RegExpMatchesArray.h: Added.
+        (JSC::RegExpMatchesArray::getOwnPropertySlot):
+        (JSC::RegExpMatchesArray::put):
+        (JSC::RegExpMatchesArray::deleteProperty):
+        (JSC::RegExpMatchesArray::getPropertyNames):
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::StructureID):
+        (JSC::StructureID::addPropertyTransition):
+        (JSC::StructureID::toDictionaryTransition):
+        (JSC::StructureID::changePrototypeTransition):
+        (JSC::StructureID::getterSetterTransition):
+        * kjs/StructureID.h:
+        (JSC::StructureID::create):
+        (JSC::StructureID::typeInfo):
+        * kjs/TypeInfo.h: Added.
+        (JSC::TypeInfo::TypeInfo):
+        (JSC::TypeInfo::type):
+
+2008-09-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - fix crash logging into Gmail due to recent Arguments change
+
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::Arguments): Fix window where mark() function could
+        see d->extraArguments with uninitialized contents.
+        (JSC::Arguments::mark): Check d->extraArguments for 0 to handle two
+        cases: 1) Inside the constructor before it's initialized.
+        2) numArguments <= numParameters.
+
+2008-09-21  Darin Adler  <darin@apple.com>
+
+        - fix loose end from the "duplicate constant values" patch
+
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitLoad): Add a special case for values the
+        hash table can't handle.
+
+2008-09-21  Mark Rowe  <mrowe@apple.com>
+
+        Fix the non-AllInOneFile build.
+
+        * kjs/Arguments.cpp: Add missing #include.
+
+2008-09-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich and Mark Rowe.
+
+        - fix test failure caused by my recent IndexToNameMap patch
+
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::deleteProperty): Added the accidentally-omitted
+        check of the boolean result from toArrayIndex.
+
+2008-09-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=20975
+          inline immediate-number case of ==
+
+        * VM/CTI.h: Renamed emitJumpSlowCaseIfNotImm to
+        emitJumpSlowCaseIfNotImmNum, since the old name was incorrect.
+
+        * VM/CTI.cpp: Updated for new name.
+        (JSC::CTI::privateCompileMainPass): Added op_eq.
+        (JSC::CTI::privateCompileSlowCases): Added op_eq.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_eq): Removed fast case, since it's now
+        compiled.
+
+2008-09-21  Peter Gal  <galpter@inf.u-szeged.hu>
+
+        Reviewed by Tim Hatcher and Eric Seidel.
+
+        Fix the QT/Linux JavaScriptCore segmentation fault.
+        https://bugs.webkit.org/show_bug.cgi?id=20914
+
+        * wtf/ThreadingQt.cpp:
+        (WTF::initializeThreading): Use currentThread() if
+        platform is not a MAC (like in pre 36541 revisions)
+
+2008-09-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * kjs/debugger.h: Removed some unneeded includes and declarations.
+
+2008-09-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=20972
+          speed up Arguments further by eliminating the IndexToNameMap
+
+        No change on SunSpider. 1.29x as fast on V8 Raytrace.
+
+        * kjs/Arguments.cpp: Moved ArgumentsData in here. Eliminated the
+        indexToNameMap and hadDeletes data members. Changed extraArguments into
+        an OwnArrayPtr and added deletedArguments, another OwnArrayPtr.
+        Replaced numExtraArguments with numParameters, since that's what's
+        used more directly in hot code paths.
+        (JSC::Arguments::Arguments): Pass in argument count instead of ArgList.
+        Initialize ArgumentsData the new way.
+        (JSC::Arguments::mark): Updated.
+        (JSC::Arguments::getOwnPropertySlot): Overload for the integer form so
+        we don't have to convert integers to identifiers just to get an argument.
+        Integrated the deleted case with the fast case.
+        (JSC::Arguments::put): Ditto.
+        (JSC::Arguments::deleteProperty): Ditto.
+
+        * kjs/Arguments.h: Minimized includes. Made everything private. Added
+        overloads for the integral property name case. Eliminated mappedIndexSetter.
+        Moved ArgumentsData into the .cpp file.
+
+        * kjs/IndexToNameMap.cpp: Emptied out and prepared for deletion.
+        * kjs/IndexToNameMap.h: Ditto.
+
+        * kjs/JSActivation.cpp:
+        (JSC::JSActivation::createArgumentsObject): Elminated ArgList.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * kjs/AllInOneFile.cpp:
+        Removed IndexToNameMap.
+
+2008-09-21  Darin Adler  <darin@apple.com>
+
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitLoad): One more tweak: Wrote this in a slightly
+        clearer style.
+
+2008-09-21  Judit Jasz  <jasy@inf.u-szeged.hu>
+
+        Reviewed and tweaked by Darin Adler.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=20645
+          Elminate duplicate constant values in CodeBlocks.
+
+        Seems to be a wash on SunSpider.
+
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitLoad): Use m_numberMap and m_stringMap to guarantee
+        we emit the same JSValue* for identical numbers and strings.
+        * VM/CodeGenerator.h: Added overload of emitLoad for const Identifier&.
+        Add NumberMap and IdentifierStringMap types and m_numberMap and m_stringMap.
+        * kjs/nodes.cpp:
+        (JSC::StringNode::emitCode): Call the new emitLoad and let it do the
+        JSString creation.
+
+2008-09-21  Paul Pedriana  <webkit@pedriana.com>
+
+        Reviewed and tweaked by Darin Adler.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=16925
+          Fixed lack of Vector buffer alignment for both GCC and MSVC.
+          Since there's no portable way to do this, for now we don't support
+          other compilers.
+
+        * wtf/Vector.h: Added WTF_ALIGH_ON, WTF_ALIGNED, AlignedBufferChar, and AlignedBuffer.
+        Use AlignedBuffer insteadof an array of char in VectorBuffer.
+
+2008-09-21  Gabor Loki  <loki@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=19408
+          Add lightweight constant folding to the parser for *, /, + (only for numbers), <<, >>, ~ operators.
+
+        1.008x as fast on SunSpider.
+
+        * kjs/grammar.y:
+        (makeNegateNode): Fold if expression is a number > 0.
+        (makeBitwiseNotNode): Fold if expression is a number.
+        (makeMultNode): Fold if expressions are both numbers.
+        (makeDivNode): Fold if expressions are both numbers.
+        (makeAddNode): Fold if expressions are both numbers.
+        (makeLeftShiftNode): Fold if expressions are both numbers.
+        (makeRightShiftNode): Fold if expressions are both numbers.
+
+2008-09-21  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - speed up === operator by generating inline machine code for the fast paths
+        https://bugs.webkit.org/show_bug.cgi?id=20820
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitJumpSlowCaseIfNotImmediateNumber):
+        (JSC::CTI::emitJumpSlowCaseIfNotImmediateNumbers):
+        (JSC::CTI::emitJumpSlowCaseIfNotImmediates):
+        (JSC::CTI::emitTagAsBoolImmediate):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_stricteq):
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::sete_r):
+        (JSC::X86Assembler::setz_r):
+        (JSC::X86Assembler::movzbl_rr):
+        (JSC::X86Assembler::emitUnlinkedJnz):
+
+2008-09-21  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Free memory allocated for extra arguments in the destructor of the
+        Arguments object.
+
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::~Arguments):
+        * kjs/Arguments.h:
+
+2008-09-21  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20815: 'arguments' object creation is non-optimal
+        <https://bugs.webkit.org/show_bug.cgi?id=20815>
+
+        Fix our inefficient way of creating the arguments object by only
+        creating named properties for each of the arguments after a use of the
+        'delete' statement. This patch also speeds up access to the 'arguments'
+        object slightly, but it still does not use the array fast path for
+        indexed access that exists for many opcodes.
+
+        This is about a 20% improvement on the V8 Raytrace benchmark, and a 1.5%
+        improvement on the Earley-Boyer benchmark, which gives a 4% improvement
+        overall.
+
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::Arguments):
+        (JSC::Arguments::mark):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::put):
+        (JSC::Arguments::deleteProperty):
+        * kjs/Arguments.h:
+        (JSC::Arguments::ArgumentsData::ArgumentsData):
+        * kjs/IndexToNameMap.h:
+        (JSC::IndexToNameMap::size):
+        * kjs/JSActivation.cpp:
+        (JSC::JSActivation::createArgumentsObject):
+        * kjs/JSActivation.h:
+        (JSC::JSActivation::uncheckedSymbolTableGet):
+        (JSC::JSActivation::uncheckedSymbolTableGetValue):
+        (JSC::JSActivation::uncheckedSymbolTablePut):
+        * kjs/JSFunction.h:
+        (JSC::JSFunction::numParameters):
+
+2008-09-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix crash seen on buildbot
+
+        * kjs/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::mark): Add back mark of arrayPrototype,
+        deleted by accident in my recent check-in.
+
+2008-09-20  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+        
+        - speculative fix for non-AllInOne builds
+
+        * kjs/operations.h:
+
+2008-09-20  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        - assorted optimizations to === and !== operators
+        (work towards <https://bugs.webkit.org/show_bug.cgi?id=20820>)
+        
+        2.5% speedup on earley-boyer test
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_stricteq): Use inline version of
+        strictEqualSlowCase; remove unneeded exception check.
+        (JSC::Machine::cti_op_nstricteq): ditto
+        * kjs/operations.cpp:
+        (JSC::strictEqual): Use strictEqualSlowCaseInline
+        (JSC::strictEqualSlowCase): ditto
+        * kjs/operations.h:
+        (JSC::strictEqualSlowCaseInline): Version of strictEqualSlowCase that can be inlined,
+        since the extra function call indirection is a lose for CTI.
+
+2008-09-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        - finish https://bugs.webkit.org/show_bug.cgi?id=20858
+          make each distinct C++ class get a distinct JSC::Structure
+
+        This also includes some optimizations that make the change an overall
+        small speedup. Without those it was a bit of a slowdown.
+
+        * API/JSCallbackConstructor.cpp:
+        (JSC::JSCallbackConstructor::JSCallbackConstructor): Take a structure.
+        * API/JSCallbackConstructor.h: Ditto.
+        * API/JSCallbackFunction.cpp:
+        (JSC::JSCallbackFunction::JSCallbackFunction): Pass a structure.
+        * API/JSCallbackObject.h: Take a structure.
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::JSCallbackObject::JSCallbackObject): Ditto.
+
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::prototype): Pass in a structure. Call setPrototype
+        if there's a custom prototype involved.
+        * API/JSObjectRef.cpp:
+        (JSObjectMake): Ditto.
+        (JSObjectMakeConstructor): Pass in a structure.
+
+        * JavaScriptCore.exp: Updated.
+
+        * VM/Machine.cpp:
+        (JSC::jsLess): Added a special case for when both arguments are strings.
+        This avoids converting both strings to with UString::toDouble.
+        (JSC::jsLessEq): Ditto.
+        (JSC::Machine::privateExecute): Pass in a structure.
+        (JSC::Machine::cti_op_construct_JSConstruct): Ditto.
+        (JSC::Machine::cti_op_new_regexp): Ditto.
+        (JSC::Machine::cti_op_is_string): Ditto.
+        * VM/Machine.h: Made isJSString public so it can be used in the CTI.
+
+        * kjs/Arguments.cpp:
+        (JSC::Arguments::Arguments): Pass in a structure.
+
+        * kjs/JSCell.h: Mark constructor explicit.
+
+        * kjs/JSGlobalObject.cpp:
+        (JSC::markIfNeeded): Added an overload for marking structures.
+        (JSC::JSGlobalObject::reset): Eliminate code to set data members to
+        zero. We now do that in the constructor, and we no longer use this
+        anywhere except in the constructor. Added code to create structures.
+        Pass structures rather than prototypes when creating objects.
+        (JSC::JSGlobalObject::mark): Mark the structures.
+
+        * kjs/JSGlobalObject.h: Removed unneeded class declarations.
+        Added initializers for raw pointers in JSGlobalObjectData so
+        everything starts with a 0. Added structure data and accessor
+        functions.
+
+        * kjs/JSImmediate.cpp:
+        (JSC::JSImmediate::nonInlineNaN): Added.
+        * kjs/JSImmediate.h:
+        (JSC::JSImmediate::toDouble): Rewrote to avoid PIC branches.
+
+        * kjs/JSNumberCell.cpp:
+        (JSC::jsNumberCell): Made non-inline to avoid PIC branches
+        in functions that call this one.
+        (JSC::jsNaN): Ditto.
+        * kjs/JSNumberCell.h: Ditto.
+
+        * kjs/JSObject.h: Removed constructor that takes a prototype.
+        All callers now pass structures.
+
+        * kjs/ArrayConstructor.cpp:
+        (JSC::ArrayConstructor::ArrayConstructor):
+        (JSC::constructArrayWithSizeQuirk):
+        * kjs/ArrayConstructor.h:
+        * kjs/ArrayPrototype.cpp:
+        (JSC::ArrayPrototype::ArrayPrototype):
+        * kjs/ArrayPrototype.h:
+        * kjs/BooleanConstructor.cpp:
+        (JSC::BooleanConstructor::BooleanConstructor):
+        (JSC::constructBoolean):
+        (JSC::constructBooleanFromImmediateBoolean):
+        * kjs/BooleanConstructor.h:
+        * kjs/BooleanObject.cpp:
+        (JSC::BooleanObject::BooleanObject):
+        * kjs/BooleanObject.h:
+        * kjs/BooleanPrototype.cpp:
+        (JSC::BooleanPrototype::BooleanPrototype):
+        * kjs/BooleanPrototype.h:
+        * kjs/DateConstructor.cpp:
+        (JSC::DateConstructor::DateConstructor):
+        (JSC::constructDate):
+        * kjs/DateConstructor.h:
+        * kjs/DateInstance.cpp:
+        (JSC::DateInstance::DateInstance):
+        * kjs/DateInstance.h:
+        * kjs/DatePrototype.cpp:
+        (JSC::DatePrototype::DatePrototype):
+        * kjs/DatePrototype.h:
+        * kjs/ErrorConstructor.cpp:
+        (JSC::ErrorConstructor::ErrorConstructor):
+        (JSC::constructError):
+        * kjs/ErrorConstructor.h:
+        * kjs/ErrorInstance.cpp:
+        (JSC::ErrorInstance::ErrorInstance):
+        * kjs/ErrorInstance.h:
+        * kjs/ErrorPrototype.cpp:
+        (JSC::ErrorPrototype::ErrorPrototype):
+        * kjs/ErrorPrototype.h:
+        * kjs/FunctionConstructor.cpp:
+        (JSC::FunctionConstructor::FunctionConstructor):
+        * kjs/FunctionConstructor.h:
+        * kjs/FunctionPrototype.cpp:
+        (JSC::FunctionPrototype::FunctionPrototype):
+        (JSC::FunctionPrototype::addFunctionProperties):
+        * kjs/FunctionPrototype.h:
+        * kjs/GlobalEvalFunction.cpp:
+        (JSC::GlobalEvalFunction::GlobalEvalFunction):
+        * kjs/GlobalEvalFunction.h:
+        * kjs/InternalFunction.cpp:
+        (JSC::InternalFunction::InternalFunction):
+        * kjs/InternalFunction.h:
+        (JSC::InternalFunction::InternalFunction):
+        * kjs/JSArray.cpp:
+        (JSC::JSArray::JSArray):
+        (JSC::constructEmptyArray):
+        (JSC::constructArray):
+        * kjs/JSArray.h:
+        * kjs/JSFunction.cpp:
+        (JSC::JSFunction::JSFunction):
+        (JSC::JSFunction::construct):
+        * kjs/JSObject.cpp:
+        (JSC::constructEmptyObject):
+        * kjs/JSString.cpp:
+        (JSC::StringObject::create):
+        * kjs/JSWrapperObject.h:
+        * kjs/MathObject.cpp:
+        (JSC::MathObject::MathObject):
+        * kjs/MathObject.h:
+        * kjs/NativeErrorConstructor.cpp:
+        (JSC::NativeErrorConstructor::NativeErrorConstructor):
+        (JSC::NativeErrorConstructor::construct):
+        * kjs/NativeErrorConstructor.h:
+        * kjs/NativeErrorPrototype.cpp:
+        (JSC::NativeErrorPrototype::NativeErrorPrototype):
+        * kjs/NativeErrorPrototype.h:
+        * kjs/NumberConstructor.cpp:
+        (JSC::NumberConstructor::NumberConstructor):
+        (JSC::constructWithNumberConstructor):
+        * kjs/NumberConstructor.h:
+        * kjs/NumberObject.cpp:
+        (JSC::NumberObject::NumberObject):
+        (JSC::constructNumber):
+        (JSC::constructNumberFromImmediateNumber):
+        * kjs/NumberObject.h:
+        * kjs/NumberPrototype.cpp:
+        (JSC::NumberPrototype::NumberPrototype):
+        * kjs/NumberPrototype.h:
+        * kjs/ObjectConstructor.cpp:
+        (JSC::ObjectConstructor::ObjectConstructor):
+        (JSC::constructObject):
+        * kjs/ObjectConstructor.h:
+        * kjs/ObjectPrototype.cpp:
+        (JSC::ObjectPrototype::ObjectPrototype):
+        * kjs/ObjectPrototype.h:
+        * kjs/PrototypeFunction.cpp:
+        (JSC::PrototypeFunction::PrototypeFunction):
+        * kjs/PrototypeFunction.h:
+        * kjs/RegExpConstructor.cpp:
+        (JSC::RegExpConstructor::RegExpConstructor):
+        (JSC::RegExpMatchesArray::RegExpMatchesArray):
+        (JSC::constructRegExp):
+        * kjs/RegExpConstructor.h:
+        * kjs/RegExpObject.cpp:
+        (JSC::RegExpObject::RegExpObject):
+        * kjs/RegExpObject.h:
+        * kjs/RegExpPrototype.cpp:
+        (JSC::RegExpPrototype::RegExpPrototype):
+        * kjs/RegExpPrototype.h:
+        * kjs/Shell.cpp:
+        (GlobalObject::GlobalObject):
+        * kjs/StringConstructor.cpp:
+        (JSC::StringConstructor::StringConstructor):
+        (JSC::constructWithStringConstructor):
+        * kjs/StringConstructor.h:
+        * kjs/StringObject.cpp:
+        (JSC::StringObject::StringObject):
+        * kjs/StringObject.h:
+        * kjs/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
+        * kjs/StringPrototype.cpp:
+        (JSC::StringPrototype::StringPrototype):
+        * kjs/StringPrototype.h:
+        Take and pass structures.
+
+2008-09-19  Alp Toker  <alp@nuanti.com>
+
+        Build fix for the 'gold' linker and recent binutils. New behaviour
+        requires that we link to used libraries explicitly.
+
+        * GNUmakefile.am:
+
+2008-09-19  Sam Weinig  <sam@webkit.org>
+
+        Roll r36694 back in.  It did not cause the crash.
+
+        * JavaScriptCore.exp:
+        * VM/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::invalidate):
+        * VM/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::create):
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMap::getEnumerablePropertyNames):
+        * kjs/PropertyMap.h:
+        * kjs/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * kjs/PropertyNameArray.h:
+        (JSC::PropertyNameArrayData::create):
+        (JSC::PropertyNameArrayData::propertyNameVector):
+        (JSC::PropertyNameArrayData::setCachedPrototypeChain):
+        (JSC::PropertyNameArrayData::cachedPrototypeChain):
+        (JSC::PropertyNameArrayData::begin):
+        (JSC::PropertyNameArrayData::end):
+        (JSC::PropertyNameArrayData::PropertyNameArrayData):
+        (JSC::PropertyNameArray::PropertyNameArray):
+        (JSC::PropertyNameArray::addKnownUnique):
+        (JSC::PropertyNameArray::size):
+        (JSC::PropertyNameArray::operator[]):
+        (JSC::PropertyNameArray::begin):
+        (JSC::PropertyNameArray::end):
+        (JSC::PropertyNameArray::setData):
+        (JSC::PropertyNameArray::data):
+        (JSC::PropertyNameArray::releaseData):
+        * kjs/StructureID.cpp:
+        (JSC::structureIDChainsAreEqual):
+        (JSC::StructureID::getEnumerablePropertyNames):
+        (JSC::StructureID::clearEnumerationCache):
+        (JSC::StructureID::createCachedPrototypeChain):
+        * kjs/StructureID.h:
+
+2008-09-19  Sam Weinig  <sam@webkit.org>
+
+        Roll out r36694.
+
+        * JavaScriptCore.exp:
+        * VM/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::invalidate):
+        * VM/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::create):
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMap::getEnumerablePropertyNames):
+        * kjs/PropertyMap.h:
+        * kjs/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * kjs/PropertyNameArray.h:
+        (JSC::PropertyNameArray::PropertyNameArray):
+        (JSC::PropertyNameArray::addKnownUnique):
+        (JSC::PropertyNameArray::begin):
+        (JSC::PropertyNameArray::end):
+        (JSC::PropertyNameArray::size):
+        (JSC::PropertyNameArray::operator[]):
+        (JSC::PropertyNameArray::releaseIdentifiers):
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::getEnumerablePropertyNames):
+        * kjs/StructureID.h:
+        (JSC::StructureID::clearEnumerationCache):
+
+2008-09-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Improve peformance of local variable initialisation.
+
+        Pull local and constant initialisation out of slideRegisterWindowForCall
+        and into its own opcode.  This allows the JIT to generate the initialisation
+        code for a function directly into the instruction stream and so avoids a few
+        branches on function entry.
+
+        Results a 1% progression in SunSpider, particularly in a number of the bitop
+        tests where the called functions are very fast. 
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitInitialiseRegister):
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::CodeGenerator):
+        * VM/Machine.cpp:
+        (JSC::slideRegisterWindowForCall):
+        (JSC::Machine::privateExecute):
+        * VM/Opcode.h:
+
+2008-09-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=20928
+        Speed up JS property enumeration by caching entire PropertyNameArray
+
+        1.3% speedup on Sunspider, 30% on string-fasta.
+
+        * JavaScriptCore.exp:
+        * VM/JSPropertyNameIterator.cpp:
+        (JSC::JSPropertyNameIterator::~JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::invalidate):
+        * VM/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        (JSC::JSPropertyNameIterator::create):
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMap::getEnumerablePropertyNames):
+        * kjs/PropertyMap.h:
+        * kjs/PropertyNameArray.cpp:
+        (JSC::PropertyNameArray::add):
+        * kjs/PropertyNameArray.h:
+        (JSC::PropertyNameArrayData::create):
+        (JSC::PropertyNameArrayData::propertyNameVector):
+        (JSC::PropertyNameArrayData::setCachedPrototypeChain):
+        (JSC::PropertyNameArrayData::cachedPrototypeChain):
+        (JSC::PropertyNameArrayData::begin):
+        (JSC::PropertyNameArrayData::end):
+        (JSC::PropertyNameArrayData::PropertyNameArrayData):
+        (JSC::PropertyNameArray::PropertyNameArray):
+        (JSC::PropertyNameArray::addKnownUnique):
+        (JSC::PropertyNameArray::size):
+        (JSC::PropertyNameArray::operator[]):
+        (JSC::PropertyNameArray::begin):
+        (JSC::PropertyNameArray::end):
+        (JSC::PropertyNameArray::setData):
+        (JSC::PropertyNameArray::data):
+        (JSC::PropertyNameArray::releaseData):
+        * kjs/ScopeChain.cpp:
+        (JSC::ScopeChainNode::print):
+        * kjs/StructureID.cpp:
+        (JSC::structureIDChainsAreEqual):
+        (JSC::StructureID::getEnumerablePropertyNames):
+        (JSC::StructureID::clearEnumerationCache):
+        (JSC::StructureID::createCachedPrototypeChain):
+        * kjs/StructureID.h:
+
+2008-09-19  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix a mismatched new[]/delete in JSObject::allocatePropertyStorage
+
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::allocatePropertyStorage): Spotted by valgrind.
+
+2008-09-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - part 2 of https://bugs.webkit.org/show_bug.cgi?id=20858
+          make each distinct C++ class get a distinct JSC::Structure
+
+        * JavaScriptCore.exp: Exported constructEmptyObject for use in WebCore.
+
+        * kjs/JSGlobalObject.h: Changed the protected constructor to take a
+        structure instead of a prototype.
+
+        * kjs/JSVariableObject.h: Removed constructor that takes a prototype.
+
+2008-09-19  Julien Chaffraix  <jchaffraix@pleyo.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Use the template hoisting technique on the RefCounted class. This reduces the code bloat due to
+        non-template methods' code been copied for each instance of the template.
+        The patch splits RefCounted between a base class that holds non-template methods and attributes
+        and the template RefCounted class that keeps the same functionnality.
+
+        On my Linux with gcc 4.3 for the Gtk port, this is:
+        - a ~600KB save on libwebkit.so in release.
+        - a ~1.6MB save on libwebkit.so in debug.
+
+        It is a wash on Sunspider and a small win on Dromaeo (not sure it is relevant).
+        On the whole, it should be a small win as we reduce the compiled code size and the only
+        new function call should be inlined by the compiler.
+
+        * wtf/RefCounted.h:
+        (WTF::RefCountedBase::ref): Copied from RefCounted.
+        (WTF::RefCountedBase::hasOneRef): Ditto.
+        (WTF::RefCountedBase::refCount): Ditto.
+        (WTF::RefCountedBase::RefCountedBase): Ditto.
+        (WTF::RefCountedBase::~RefCountedBase): Ditto.
+        (WTF::RefCountedBase::derefBase): Tweaked from the RefCounted version to remove
+        template section.
+        (WTF::RefCounted::RefCounted):
+        (WTF::RefCounted::deref): Small wrapper around RefCountedBase::derefBase().
+        (WTF::RefCounted::~RefCounted): Keep private destructor.
+
+2008-09-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        - part 1 of https://bugs.webkit.org/show_bug.cgi?id=20858
+          make each distinct C++ class get a distinct JSC::Structure
+
+        * kjs/lookup.h: Removed things here that were used only in WebCore:
+        cacheGlobalObject, JSC_DEFINE_PROTOTYPE, JSC_DEFINE_PROTOTYPE_WITH_PROTOTYPE,
+        and JSC_IMPLEMENT_PROTOTYPE.
+
+2008-09-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=20927
+          simplify/streamline the code to turn strings into identifiers while parsing
+
+        * kjs/grammar.y: Get rid of string from the union, and use ident for STRING as
+        well as for IDENT.
+
+        * kjs/lexer.cpp:
+        (JSC::Lexer::lex): Use makeIdentifier instead of makeUString for String.
+        * kjs/lexer.h: Remove makeUString.
+
+        * kjs/nodes.h: Changed StringNode to hold an Identifier instead of UString.
+
+        * VM/CodeGenerator.cpp:
+        (JSC::keyForCharacterSwitch): Updated since StringNode now holds an Identifier.
+        (JSC::prepareJumpTableForStringSwitch): Ditto.
+        * kjs/nodes.cpp:
+        (JSC::StringNode::emitCode): Ditto. The comment from here is now in the lexer.
+        (JSC::processClauseList): Ditto.
+        * kjs/nodes2string.cpp:
+        (JSC::StringNode::streamTo): Ditto.
+
+2008-09-18  Sam Weinig  <sam@webkit.org>
+
+        Fix style.
+
+        * VM/Instruction.h:
+        (JSC::Instruction::Instruction):
+
+2008-09-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20911: REGRESSION(r36480?): Reproducible assertion failure below derefStructureIDs 64-bit JavaScriptCore
+        <https://bugs.webkit.org/show_bug.cgi?id=20911>
+
+        The problem was simply caused by the int constructor for Instruction
+        failing to initialise the full struct in 64bit builds.
+
+        * VM/Instruction.h:
+        (JSC::Instruction::Instruction):
+
+2008-09-18  Darin Adler  <darin@apple.com>
+
+        - fix release build
+
+        * wtf/RefCountedLeakCounter.cpp: Removed stray "static".
+
+2008-09-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * kjs/JSGlobalObject.h: Tiny style guideline tweak.
+
+2008-09-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=20925
+          LEAK messages appear every time I quit
+
+        * JavaScriptCore.exp: Updated, and also added an export
+        needed for future WebCore use of JSC::StructureID.
+
+        * wtf/RefCountedLeakCounter.cpp:
+        (WTF::RefCountedLeakCounter::suppressMessages): Added.
+        (WTF::RefCountedLeakCounter::cancelMessageSuppression): Added.
+        (WTF::RefCountedLeakCounter::RefCountedLeakCounter): Tweaked a bit.
+        (WTF::RefCountedLeakCounter::~RefCountedLeakCounter): Added code to
+        log the reason there was no leak checking done.
+        (WTF::RefCountedLeakCounter::increment): Tweaked a bit.
+        (WTF::RefCountedLeakCounter::decrement): Ditto.
+
+        * wtf/RefCountedLeakCounter.h: Replaced setLogLeakMessages with two
+        new functions, suppressMessages and cancelMessageSuppression. Also
+        added m_ prefixes to the data member names.
+
+2008-09-18  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20437
+
+        Add a proper #define to define which XML Parser implementation to use. Client
+        code can use #if USE(QXMLSTREAM) to decide if the Qt XML StreamReader
+        implementation is going to be used.
+
+        * wtf/Platform.h:
+
+2008-09-18  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Make a Unicode non-breaking space count as a whitespace character in
+        PCRE. This change was already made in WREC, and it fixes one of the
+        Mozilla JS tests. Since it is now fixed in PCRE as well, we can check
+        in a new set of expected test results.
+
+        * pcre/pcre_internal.h:
+        (isSpaceChar):
+        * tests/mozilla/expected.html:
+
+2008-09-18  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Mark Rowe and Maciej Stachowiak.
+
+        add an option use arch to specify which architecture to run.
+
+        * tests/mozilla/jsDriver.pl:
+
+2008-09-17  Oliver Hunt  <oliver@apple.com>
+
+        Correctly restore argument reference prior to SFX runtime calls.
+        
+        Reviewed by Steve Falkenburg.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+
+2008-09-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20876: REGRESSION (r36417, r36427): fast/js/exception-expression-offset.html fails
+        <https://bugs.webkit.org/show_bug.cgi?id=20876>
+
+        r36417 and r36427 caused an get_by_id opcode to be emitted before the
+        instanceof and construct opcodes, in order to enable inline caching of
+        the prototype property. Unfortunately, this regressed some tests dealing
+        with exceptions thrown by 'instanceof' and the 'new' operator. We fix
+        these problems by detecting whether an "is not an object" exception is
+        thrown before op_instanceof or op_construct, and emit the proper
+        exception in those cases.
+
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitConstruct):
+        * VM/CodeGenerator.h:
+        * VM/ExceptionHelpers.cpp:
+        (JSC::createInvalidParamError):
+        (JSC::createNotAConstructorError):
+        (JSC::createNotAnObjectError):
+        * VM/ExceptionHelpers.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::getOpcode):
+        (JSC::Machine::privateExecute):
+        * VM/Machine.h:
+        * kjs/nodes.cpp:
+        (JSC::NewExprNode::emitCode):
+        (JSC::InstanceOfNode::emitCode):
+
+2008-09-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        JIT generation cti_op_construct_verify.
+        
+        Quarter to half percent progression on v8-tests.
+        Roughly not change on SunSpider (possible minor progression).
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        * VM/Machine.cpp:
+        * VM/Machine.h:
+
+2008-09-15  Steve Falkenburg  <sfalken@apple.com>
+
+        Improve timer accuracy for JavaScript Date object on Windows.
+        
+        Use a combination of ftime and QueryPerformanceCounter.
+        ftime returns the information we want, but doesn't have sufficient resolution.
+        QueryPerformanceCounter has high resolution, but is only usable to measure time intervals.
+        To combine them, we call ftime and QueryPerformanceCounter initially. Later calls will use
+        QueryPerformanceCounter by itself, adding the delta to the saved ftime.  We re-sync to
+        correct for drift if the low-res and high-res elapsed time between calls differs by more
+        than twice the low-resolution timer resolution.
+        
+        QueryPerformanceCounter may be inaccurate due to a problems with:
+        - some PCI bridge chipsets (http://support.microsoft.com/kb/274323)
+        - BIOS bugs (http://support.microsoft.com/kb/895980/)
+        - BIOS/HAL bugs on multiprocessor/multicore systems (http://msdn.microsoft.com/en-us/library/ms644904.aspx)
+        
+        Reviewed by Darin Adler.
+
+        * kjs/DateMath.cpp:
+        (JSC::highResUpTime):
+        (JSC::lowResUTCTime):
+        (JSC::qpcAvailable):
+        (JSC::getCurrentUTCTimeWithMicroseconds):
+
+2008-09-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Implement JIT generation of CallFrame initialization, for op_call.
+
+        1% sunspider 2.5% v8-tests.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCall):
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_op_call_NotJSFunction):
+
+2008-09-17  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Optimizations for op_call in CTI.  Move check for (ctiCode == 0) into JIT code,
+        move copying of scopeChain for CodeBlocks that needFullScopeChain into head of
+        functions, instead of checking prior to making the call.
+
+        3% on v8-tests (4% on richards, 6% in delta-blue)
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        * VM/Machine.cpp:
+        (JSC::Machine::execute):
+        (JSC::Machine::cti_op_call_JSFunction):
+        (JSC::Machine::cti_vm_compile):
+        (JSC::Machine::cti_vm_updateScopeChain):
+        (JSC::Machine::cti_op_construct_JSConstruct):
+        * VM/Machine.h:
+
+2008-09-17  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Fix the QtWebKit/Mac build
+
+        * wtf/ThreadingQt.cpp:
+        (WTF::initializeThreading): use QCoreApplication to get the main thread
+
+2008-09-16  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20857: REGRESSION (r36427): ASSERTION FAILED: m_refCount >= 0 in RegisterID::deref()
+        <https://bugs.webkit.org/show_bug.cgi?id=20857>
+
+        Fix a problem stemming from the slightly unsafe behaviour of the
+        CodeGenerator::finalDestination() method by putting the "func" argument
+        of the emitConstruct() method in a RefPtr in its caller. Also, add an
+        assertion guaranteeing that this is always the case.
+
+        CodeGenerator::finalDestination() is still incorrect and can cause
+        problems with a different allocator; see bug 20340 for more details.
+
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitConstruct):
+        * kjs/nodes.cpp:
+        (JSC::NewExprNode::emitCode):
+
+2008-09-16  Alice Liu  <alice.liu@apple.com>
+
+        build fix.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+
+2008-09-16  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        CTI code generation for op_ret.  The majority of the work
+        (updating variables on the stack & on exec) can be performed
+        directly in generated code.
+
+        We still need to check, & to call out to C-code to handle
+        activation records, profiling, and full scope chains.
+
+        +1.5% Sunspider, +5/6% v8 tests.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitPutCTIParam):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_ret_activation):
+        (JSC::Machine::cti_op_ret_profiler):
+        (JSC::Machine::cti_op_ret_scopeChain):
+        * VM/Machine.h:
+
+2008-09-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Fix the Windows build.
+
+        Add some extra parentheses to stop MSVC from complaining so much.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_stricteq):
+        (JSC::Machine::cti_op_nstricteq):
+        * kjs/operations.cpp:
+        (JSC::strictEqual):
+
+2008-09-15  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - speed up the === and !== operators by choosing the fast cases better
+        
+        No effect on SunSpider but speeds up the V8 EarlyBoyer benchmark about 4%.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_stricteq):
+        (JSC::Machine::cti_op_nstricteq):
+        * kjs/JSImmediate.h:
+        (JSC::JSImmediate::areBothImmediate):
+        * kjs/operations.cpp:
+        (JSC::strictEqual):
+        (JSC::strictEqualSlowCase):
+        * kjs/operations.h:
+
+2008-09-15  Oliver Hunt  <oliver@apple.com>
+
+        RS=Sam Weinig.
+
+        Coding style cleanup.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+
+2008-09-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 20874: op_resolve does not do any form of caching
+        <https://bugs.webkit.org/show_bug.cgi?id=20874>
+
+        This patch adds an op_resolve_global opcode to handle (and cache)
+        property lookup we can statically determine must occur on the global
+        object (if at all).
+
+        3% progression on sunspider, 3.2x improvement to bitops-bitwise-and, and
+        10% in math-partial-sums
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::findScopedProperty):
+        (JSC::CodeGenerator::emitResolve):
+        * VM/Machine.cpp:
+        (JSC::resolveGlobal):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_resolve_global):
+        * VM/Machine.h:
+        * VM/Opcode.h:
+
+2008-09-15  Sam Weinig  <sam@webkit.org>
+
+        Roll out r36462.  It broke document.all.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::Machine):
+        (JSC::Machine::cti_op_eq_null):
+        (JSC::Machine::cti_op_neq_null):
+        * VM/Machine.h:
+        (JSC::Machine::isJSString):
+        * kjs/JSCell.h:
+        * kjs/JSWrapperObject.h:
+        * kjs/StringObject.h:
+        * kjs/StringObjectThatMasqueradesAsUndefined.h:
+
+2008-09-15  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20863: ASSERTION FAILED: addressOffset < instructions.size() in CodeBlock::getHandlerForVPC
+        <https://bugs.webkit.org/show_bug.cgi?id=20863>
+
+        r36427 changed the number of arguments to op_construct without changing
+        the argument index for the vPC in the call to initializeCallFrame() in
+        the CTI case. This caused a JSC test failure. Correcting the argument
+        index fixes the test failure.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_construct_JSConstruct):
+
+2008-09-15  Mark Rowe  <mrowe@apple.com>
+
+        Fix GCC 4.2 build.
+
+        * VM/CTI.h:
+
+2008-09-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Fixed a typo in op_get_by_id_chain that caused it to miss every time
+        in the interpreter.
+        
+        Also, a little cleanup.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute): Set up baseObject before entering the
+        loop, so we compare against the right values.
+
+2008-09-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Removed the CalledAsConstructor flag from the call frame header. Now,
+        we use an explicit opcode at the call site to fix up constructor results.
+
+        SunSpider says 0.4% faster.
+        
+        cti_op_construct_verify is an out-of-line function call for now, but we
+        can fix that once StructureID holds type information like isObject.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass): Codegen for the new opcode.
+
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+
+        * VM/CodeGenerator.cpp: Codegen for the new opcode. Also...
+        (JSC::CodeGenerator::emitCall): ... don't test for known non-zero value.
+        (JSC::CodeGenerator::emitConstruct): ... ditto.
+
+        * VM/Machine.cpp: No more CalledAsConstructor
+        (JSC::Machine::privateExecute): Implementation for the new opcode.
+        (JSC::Machine::cti_op_ret): The speedup: no need to check whether we were
+        called as a constructor.
+        (JSC::Machine::cti_op_construct_verify): Implementation for the new opcode.
+        * VM/Machine.h:
+
+        * VM/Opcode.h: Declare new opcode.
+
+        * VM/RegisterFile.h:
+        (JSC::RegisterFile::): No more CalledAsConstructor
+
+2008-09-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Inline code generation of eq_null/neq_null for CTI.  Uses vptr checking for
+        StringObjectsThatAreMasqueradingAsBeingUndefined.  In the long run, the
+        masquerading may be handled differently (through the StructureIDs - see bug
+        #20823).
+
+        >1% on v8-tests.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitJumpSlowCaseIfIsJSCell):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::Machine):
+        (JSC::Machine::cti_op_eq_null):
+        (JSC::Machine::cti_op_neq_null):
+        * VM/Machine.h:
+        (JSC::Machine::doesMasqueradesAsUndefined):
+        * kjs/JSWrapperObject.h:
+        (JSC::JSWrapperObject::):
+        (JSC::JSWrapperObject::JSWrapperObject):
+        * kjs/StringObject.h:
+        (JSC::StringObject::StringObject):
+        * kjs/StringObjectThatMasqueradesAsUndefined.h:
+        (JSC::StringObjectThatMasqueradesAsUndefined::StringObjectThatMasqueradesAsUndefined):
+
+2008-09-15  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Rubber-stamped by Oliver Hunt.
+
+        r36427 broke CodeBlock::dump() by changing the number of arguments to
+        op_construct without changing the code that prints it. This patch fixes
+        it by printing the additional argument.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+
+2008-09-15  Adam Roben  <aroben@apple.com>
+
+        Build fix
+
+        * kjs/StructureID.cpp: Removed a stray semicolon.
+
+2008-09-15  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix a crash in fast/js/exception-expression-offset.html caused by not
+        updating all mentions of the length of op_construct in r36427.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_construct_NotJSConstruct):
+
+2008-09-15  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - fix layout test failure introduced by fix for 20849
+        
+        (The failing test was fast/js/delete-then-put.html)
+
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::removeDirect): Clear enumeration cache
+        in the dictionary case.
+        * kjs/JSObject.h:
+        (JSC::JSObject::putDirect): Ditto.
+        * kjs/StructureID.h:
+        (JSC::StructureID::clearEnumerationCache): Inline to handle the
+        clear.
+
+2008-09-15  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - fix JSC test failures introduced by fix for 20849
+
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMap::getEnumerablePropertyNames): Use the correct count.
+
+2008-09-15  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20851: REGRESSION (r36410): fast/js/kde/GlobalObject.html fails
+        <https://bugs.webkit.org/show_bug.cgi?id=20851>
+
+        r36410 introduced an optimization for parseInt() that is incorrect when
+        its argument is larger than the range of a 32-bit integer. If the
+        argument is a number that is not an immediate integer, then the correct
+        behaviour is to return the floor of its value, unless it is an infinite
+        value, in which case the correct behaviour is to return 0.
+
+        * kjs/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt):
+
+2008-09-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=20849
+        Cache property names for getEnumerablePropertyNames in the StructureID.
+
+        ~0.5% speedup on Sunspider overall (9.7% speedup on string-fasta).  ~1% speedup
+        on the v8 test suite.
+
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::getPropertyNames):
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMap::getEnumerablePropertyNames):
+        * kjs/PropertyMap.h:
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::StructureID):
+        (JSC::StructureID::getEnumerablePropertyNames):
+        * kjs/StructureID.h:
+
+2008-09-14  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - speed up JS construction by extracting "prototype" lookup so PIC applies.
+        
+        ~0.5% speedup on SunSpider
+        Speeds up some of the V8 tests as well, most notably earley-boyer.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileOpCall): Account for extra arg for prototype.
+        (JSC::CTI::privateCompileMainPass): Account for increased size of op_construct.
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitConstruct): Emit separate lookup to get prototype property.
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute): Expect prototype arg in op_construct.
+        (JSC::Machine::cti_op_construct_JSConstruct): ditto
+        (JSC::Machine::cti_op_construct_NotJSConstruct): ditto
+
+2008-09-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add a protected destructor for RefCounted.
+
+        It is wrong to call its destructor directly, because (1) this should be taken care of by
+        deref(), and (2) many classes that use RefCounted have non-virtual destructors.
+
+        No change in behavior.
+
+        * wtf/RefCounted.h: (WTF::RefCounted::~RefCounted):
+
+2008-09-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Accelerated property accesses.
+
+        Inline more of the array access code into the JIT code for get/put_by_val.
+        Accelerate get/put_by_id by speculatively inlining a disable direct access
+        into the hot path of the code, and repatch this with the correct StructureID
+        and property map offset once these are known.  In the case of accesses to the
+        prototype and reading the array-length a trampoline is genertaed, and the
+        branch to the slow-case is relinked to jump to this.
+
+        By repatching, we mean rewriting the x86 instruction stream.  Instructions are
+        only modified in a simple fasion - altering immediate operands, memory access
+        deisplacements, and branch offsets.
+        
+        For regular get_by_id/put_by_id accesses to an object, a StructureID in an
+        instruction's immediate operant is updateded, and a memory access operation's
+        displacement is updated to access the correct field on the object.  In the case
+        of more complex accesses (array length and get_by_id_prototype) the offset on
+        the branch to slow-case is updated, to now jump to a trampoline.
+
+        +2.8% sunspider, +13% v8-tests
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitCall):
+        (JSC::CTI::emitJumpSlowCaseIfNotJSCell):
+        (JSC::CTI::CTI):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        (JSC::CTI::privateCompileArrayLengthTrampoline):
+        (JSC::CTI::privateCompileStringLengthTrampoline):
+        (JSC::CTI::patchGetByIdSelf):
+        (JSC::CTI::patchPutByIdReplace):
+        (JSC::CTI::privateCompilePatchGetArrayLength):
+        (JSC::CTI::privateCompilePatchGetStringLength):
+        * VM/CTI.h:
+        (JSC::CTI::compileGetByIdSelf):
+        (JSC::CTI::compileGetByIdProto):
+        (JSC::CTI::compileGetByIdChain):
+        (JSC::CTI::compilePutByIdReplace):
+        (JSC::CTI::compilePutByIdTransition):
+        (JSC::CTI::compileArrayLengthTrampoline):
+        (JSC::CTI::compileStringLengthTrampoline):
+        (JSC::CTI::compilePatchGetArrayLength):
+        (JSC::CTI::compilePatchGetStringLength):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::~CodeBlock):
+        * VM/CodeBlock.h:
+        (JSC::StructureStubInfo::StructureStubInfo):
+        (JSC::CodeBlock::getStubInfo):
+        * VM/Machine.cpp:
+        (JSC::Machine::tryCTICachePutByID):
+        (JSC::Machine::tryCTICacheGetByID):
+        (JSC::Machine::cti_op_put_by_val_array):
+        * VM/Machine.h:
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::cmpl_i8m):
+        (JSC::X86Assembler::emitUnlinkedJa):
+        (JSC::X86Assembler::getRelocatedAddress):
+        (JSC::X86Assembler::getDifferenceBetweenLabels):
+        (JSC::X86Assembler::emitModRm_opmsib):
+
+2008-09-14  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        - split the "prototype" lookup for hasInstance into opcode stream so it can be cached
+        
+        ~5% speedup on v8 earley-boyer test
+
+        * API/JSCallbackObject.h: Add a parameter for the pre-looked-up prototype.
+        * API/JSCallbackObjectFunctions.h:
+        (JSC::::hasInstance): Ditto.
+        * API/JSValueRef.cpp:
+        (JSValueIsInstanceOfConstructor): Look up and pass in prototype.
+        * JavaScriptCore.exp:
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass): Pass along prototype.
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): Print third arg.
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitInstanceOf): Implement this, now that there
+        is a third argument.
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute): Pass along the prototype.
+        (JSC::Machine::cti_op_instanceof): ditto
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::hasInstance): Expect to get a pre-looked-up prototype.
+        * kjs/JSObject.h:
+        * kjs/nodes.cpp:
+        (JSC::InstanceOfNode::emitCode): Emit a get_by_id of the prototype
+        property and pass that register to instanceof.
+        * kjs/nodes.h:
+
+2008-09-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove unnecessary virtual function call from cti_op_call_JSFunction -
+        ~5% on richards, ~2.5% on v8-tests, ~0.5% on sunspider.
+
+        * VM/Machine.cpp:
+        (JSC::Machine::cti_op_call_JSFunction):
+
+2008-09-14  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20827: the 'typeof' operator is slow
+        <https://bugs.webkit.org/show_bug.cgi?id=20827>
+
+        Optimize the 'typeof' operator when its result is compared to a constant
+        string.
+
+        This is a 5.5% speedup on the V8 Earley-Boyer test.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitEqualityOp):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (JSC::jsIsObjectType):
+        (JSC::jsIsFunctionType):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_is_undefined):
+        (JSC::Machine::cti_op_is_boolean):
+        (JSC::Machine::cti_op_is_number):
+        (JSC::Machine::cti_op_is_string):
+        (JSC::Machine::cti_op_is_object):
+        (JSC::Machine::cti_op_is_function):
+        * VM/Machine.h:
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (JSC::BinaryOpNode::emitCode):
+        (JSC::EqualNode::emitCode):
+        (JSC::StrictEqualNode::emitCode):
+        * kjs/nodes.h:
+
+2008-09-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=20844
+        Speed up parseInt for numbers
+
+        Sunspider reports this as 1.029x as fast overall and 1.37x as fast on string-unpack-code.
+        No change on the v8 suite.
+
+        * kjs/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncParseInt): Don't convert numbers to strings just to
+        convert them back to numbers.
+
+2008-09-14  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 20816: op_lesseq should be optimized
+        <https://bugs.webkit.org/show_bug.cgi?id=20816>
+
+        Add a loop_if_lesseq opcode that is similar to the loop_if_less opcode.
+
+        This is a 9.4% speedup on the V8 Crypto benchmark.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitJumpIfTrue):
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_loop_if_lesseq):
+        * VM/Machine.h:
+        * VM/Opcode.h:
+
+2008-09-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Cleanup Sampling code.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitCall):
+        (JSC::CTI::privateCompileMainPass):
+        * VM/CTI.h:
+        (JSC::CTI::execute):
+        * VM/SamplingTool.cpp:
+        (JSC::):
+        (JSC::SamplingTool::run):
+        (JSC::SamplingTool::dump):
+        * VM/SamplingTool.h:
+        (JSC::SamplingTool::callingHostFunction):
+
+2008-09-13  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 20821: Cache property transitions to speed up object initialization
+        https://bugs.webkit.org/show_bug.cgi?id=20821
+
+        Implement a transition cache to improve the performance of new properties
+        being added to objects.  This is extremely beneficial in constructors and
+        shows up as a 34% improvement on access-binary-trees in SunSpider (0.8%
+        overall)
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::):
+        (JSC::transitionWillNeedStorageRealloc):
+        (JSC::CTI::privateCompilePutByIdTransition):
+        * VM/CTI.h:
+        (JSC::CTI::compilePutByIdTransition):
+        * VM/CodeBlock.cpp:
+        (JSC::printPutByIdOp):
+        (JSC::CodeBlock::printStructureIDs):
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::derefStructureIDs):
+        (JSC::CodeBlock::refStructureIDs):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::emitPutById):
+        * VM/Machine.cpp:
+        (JSC::cachePrototypeChain):
+        (JSC::Machine::tryCachePutByID):
+        (JSC::Machine::tryCacheGetByID):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::tryCTICachePutByID):
+        (JSC::Machine::tryCTICacheGetByID):
+        * VM/Machine.h:
+        * VM/Opcode.h:
+        * kjs/JSObject.h:
+        (JSC::JSObject::putDirect):
+        (JSC::JSObject::transitionTo):
+        * kjs/PutPropertySlot.h:
+        (JSC::PutPropertySlot::PutPropertySlot):
+        (JSC::PutPropertySlot::wasTransition):
+        (JSC::PutPropertySlot::setWasTransition):
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::transitionTo):
+        (JSC::StructureIDChain::StructureIDChain):
+        * kjs/StructureID.h:
+        (JSC::StructureID::previousID):
+        (JSC::StructureID::setCachedPrototypeChain):
+        (JSC::StructureID::cachedPrototypeChain):
+        (JSC::StructureID::propertyMap):
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::addl_i8m):
+        (JSC::X86Assembler::subl_i8m):
+
+2008-09-12  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20819: JSValue::isObject() is slow
+        <https://bugs.webkit.org/show_bug.cgi?id=20819>
+
+        Optimize JSCell::isObject() and JSCell::isString() by making them
+        non-virtual calls that rely on the StructureID type information.
+
+        This is a 0.7% speedup on SunSpider and a 1.0% speedup on the V8
+        benchmark suite.
+
+        * JavaScriptCore.exp:
+        * kjs/JSCell.cpp:
+        * kjs/JSCell.h:
+        (JSC::JSCell::isObject):
+        (JSC::JSCell::isString):
+        * kjs/JSObject.cpp:
+        * kjs/JSObject.h:
+        * kjs/JSString.cpp:
+        * kjs/JSString.h:
+        (JSC::JSString::JSString):
+        * kjs/StructureID.h:
+        (JSC::StructureID::type):
+
+2008-09-11  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Turn off PGO Optimization on CTI.cpp -> <rdar://problem/6207709>.  Fixes
+        crash on CNN and on Dromaeo.
+        Fix Missing close tag in vcproj. 
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+
+2008-09-11  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Not reviewed.
+
+        Correct an SVN problem with the last commit and actually add the new
+        files.
+
+        * wrec/CharacterClassConstructor.cpp: Added.
+        (JSC::):
+        (JSC::getCharacterClassNewline):
+        (JSC::getCharacterClassDigits):
+        (JSC::getCharacterClassSpaces):
+        (JSC::getCharacterClassWordchar):
+        (JSC::getCharacterClassNondigits):
+        (JSC::getCharacterClassNonspaces):
+        (JSC::getCharacterClassNonwordchar):
+        (JSC::CharacterClassConstructor::addSorted):
+        (JSC::CharacterClassConstructor::addSortedRange):
+        (JSC::CharacterClassConstructor::put):
+        (JSC::CharacterClassConstructor::flush):
+        (JSC::CharacterClassConstructor::append):
+        * wrec/CharacterClassConstructor.h: Added.
+        (JSC::CharacterClassConstructor::CharacterClassConstructor):
+        (JSC::CharacterClassConstructor::isUpsideDown):
+        (JSC::CharacterClassConstructor::charClass):
+
+2008-09-11  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20788: Split CharacterClassConstructor into its own file
+        <https://bugs.webkit.org/show_bug.cgi?id=20788>
+
+        Split CharacterClassConstructor into its own file and clean up some
+        style issues.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wrec/CharacterClassConstructor.cpp: Added.
+        (JSC::):
+        (JSC::getCharacterClassNewline):
+        (JSC::getCharacterClassDigits):
+        (JSC::getCharacterClassSpaces):
+        (JSC::getCharacterClassWordchar):
+        (JSC::getCharacterClassNondigits):
+        (JSC::getCharacterClassNonspaces):
+        (JSC::getCharacterClassNonwordchar):
+        (JSC::CharacterClassConstructor::addSorted):
+        (JSC::CharacterClassConstructor::addSortedRange):
+        (JSC::CharacterClassConstructor::put):
+        (JSC::CharacterClassConstructor::flush):
+        (JSC::CharacterClassConstructor::append):
+        * wrec/CharacterClassConstructor.h: Added.
+        (JSC::CharacterClassConstructor::CharacterClassConstructor):
+        (JSC::CharacterClassConstructor::isUpsideDown):
+        (JSC::CharacterClassConstructor::charClass):
+        * wrec/WREC.cpp:
+        (JSC::WRECParser::parseCharacterClass):
+
+2008-09-10  Simon Hausmann  <hausmann@webkit.org>
+
+        Not reviewed but trivial one-liner for yet unused macro.
+
+        Changed PLATFORM(WINCE) to PLATFORM(WIN_CE) as requested by Mark.
+
+        (part of https://bugs.webkit.org/show_bug.cgi?id=20746)
+
+        * wtf/Platform.h:
+
+2008-09-10  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Fix a typo by renaming the overloaded orl_rr that takes an immediate to
+        orl_i32r.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitFastArithPotentiallyReTagImmediate):
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::orl_i32r):
+        * wrec/WREC.cpp:
+        (JSC::WRECGenerator::generatePatternCharacter):
+        (JSC::WRECGenerator::generateCharacterClassInverted):
+
+2008-09-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        Add inline property storage for JSObject.
+
+        1.2% progression on Sunspider. .5% progression on the v8 test suite.
+
+        * JavaScriptCore.exp:
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::mark): There is no reason to check storageSize now that
+        we start from 0.
+        (JSC::JSObject::allocatePropertyStorage): Allocates/reallocates heap storage.
+        * kjs/JSObject.h:
+        (JSC::JSObject::offsetForLocation): m_propertyStorage is not an OwnArrayPtr
+        now so there is no reason to .get()
+        (JSC::JSObject::usingInlineStorage):
+        (JSC::JSObject::JSObject): Start with m_propertyStorage pointing to the
+        inline storage.
+        (JSC::JSObject::~JSObject): Free the heap storage if not using the inline
+        storage.
+        (JSC::JSObject::putDirect): Switch to the heap storage only when we know
+        we know that we are about to add a property that will overflow the inline
+        storage.
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMap::createTable): Don't allocate the propertyStorage, that is
+        now handled by JSObject.
+        (JSC::PropertyMap::rehash): PropertyStorage is not a OwnArrayPtr anymore.
+        * kjs/PropertyMap.h:
+        (JSC::PropertyMap::storageSize): Rename from markingCount.
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::addPropertyTransition): Don't resize the property storage
+        if we are using inline storage.
+        * kjs/StructureID.h:
+
+2008-09-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Inline immediate number version of op_mul.
+
+        Renamed mull_rr to imull_rr as that's what it's 
+        actually doing, and added imull_i32r for the constant
+        case immediate multiply.
+
+        1.1% improvement to SunSpider.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::):
+        (JSC::X86Assembler::imull_rr):
+        (JSC::X86Assembler::imull_i32r):
+
+2008-09-10  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Not reviewed.
+
+        Mac build fix.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-09-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add optimised access to known properties on the global object.
+
+        Improve cross scope access to the global object by emitting
+        code to access it directly rather than by walking the scope chain.
+
+        This is a 0.8% win in SunSpider and a 1.7% win in the v8 benchmarks.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::emitGetVariableObjectRegister):
+        (JSC::CTI::emitPutVariableObjectRegister):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (JSC::CodeGenerator::findScopedProperty):
+        (JSC::CodeGenerator::emitResolve):
+        (JSC::CodeGenerator::emitGetScopedVar):
+        (JSC::CodeGenerator::emitPutScopedVar):
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (JSC::Machine::privateExecute):
+        * VM/Opcode.h:
+        * kjs/nodes.cpp:
+        (JSC::FunctionCallResolveNode::emitCode):
+        (JSC::PostfixResolveNode::emitCode):
+        (JSC::PrefixResolveNode::emitCode):
+        (JSC::ReadModifyResolveNode::emitCode):
+        (JSC::AssignResolveNode::emitCode):
+
+2008-09-10  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Oliver.
+        
+        - enable polymorphic inline caching of properties of primitives
+        
+        1.012x speedup on SunSpider.
+
+        We create special structure IDs for JSString and
+        JSNumberCell. Unlike normal structure IDs, these cannot hold the
+        true prototype. Due to JS autoboxing semantics, the prototype used
+        when looking up string or number properties depends on the lexical
+        global object of the call site, not the creation site. Thus we
+        enable StructureIDs to handle this quirk for primitives.
+        
+        Everything else should be straightforward.
+        
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        * VM/CTI.h:
+        (JSC::CTI::compileGetByIdProto):
+        (JSC::CTI::compileGetByIdChain):
+        * VM/JSPropertyNameIterator.h:
+        (JSC::JSPropertyNameIterator::JSPropertyNameIterator):
+        * VM/Machine.cpp:
+        (JSC::Machine::Machine):
+        (JSC::cachePrototypeChain):
+        (JSC::Machine::tryCachePutByID):
+        (JSC::Machine::tryCacheGetByID):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::tryCTICachePutByID):
+        (JSC::Machine::tryCTICacheGetByID):
+        * kjs/GetterSetter.h:
+        (JSC::GetterSetter::GetterSetter):
+        * kjs/JSCell.h:
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * kjs/JSGlobalData.h:
+        * kjs/JSGlobalObject.h:
+        (JSC::StructureID::prototypeForLookup):
+        * kjs/JSNumberCell.h:
+        (JSC::JSNumberCell::JSNumberCell):
+        (JSC::jsNumberCell):
+        * kjs/JSObject.h:
+        (JSC::JSObject::prototype):
+        * kjs/JSString.cpp:
+        (JSC::jsString):
+        (JSC::jsSubstring):
+        (JSC::jsOwnedString):
+        * kjs/JSString.h:
+        (JSC::JSString::JSString):
+        (JSC::JSString::):
+        (JSC::jsSingleCharacterString):
+        (JSC::jsSingleCharacterSubstring):
+        (JSC::jsNontrivialString):
+        * kjs/SmallStrings.cpp:
+        (JSC::SmallStrings::createEmptyString):
+        (JSC::SmallStrings::createSingleCharacterString):
+        * kjs/StructureID.cpp:
+        (JSC::StructureID::StructureID):
+        (JSC::StructureID::addPropertyTransition):
+        (JSC::StructureID::getterSetterTransition):
+        (JSC::StructureIDChain::StructureIDChain):
+        * kjs/StructureID.h:
+        (JSC::StructureID::create):
+        (JSC::StructureID::storedPrototype):
+
+2008-09-09  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20746
+
+        Added WINCE platform macro.
+
+        * wtf/Platform.h:
+
+2008-09-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Remove unnecessary override of getOffset.
+
+        Sunspider reports this as a .6% progression.
+
+        * JavaScriptCore.exp:
+        * kjs/JSObject.h:
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::getOwnPropertySlotForWrite):
+        (JSC::JSObject::putDirect):
+        * kjs/PropertyMap.cpp:
+        * kjs/PropertyMap.h:
+
+2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20759: Remove MacroAssembler
+        <https://bugs.webkit.org/show_bug.cgi?id=20759>
+
+        Remove MacroAssembler and move its functionality to X86Assembler.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::emitPutArg):
+        (JSC::CTI::emitPutCTIParam):
+        (JSC::CTI::emitGetCTIParam):
+        (JSC::CTI::emitPutToCallFrameHeader):
+        (JSC::CTI::emitGetFromCallFrameHeader):
+        (JSC::CTI::emitPutResult):
+        (JSC::CTI::emitDebugExceptionCheck):
+        (JSC::CTI::emitJumpSlowCaseIfNotImm):
+        (JSC::CTI::emitJumpSlowCaseIfNotImms):
+        (JSC::CTI::emitFastArithDeTagImmediate):
+        (JSC::CTI::emitFastArithReTagImmediate):
+        (JSC::CTI::emitFastArithPotentiallyReTagImmediate):
+        (JSC::CTI::emitFastArithImmToInt):
+        (JSC::CTI::emitFastArithIntToImmOrSlowCase):
+        (JSC::CTI::emitFastArithIntToImmNoCheck):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::CTI::privateArrayLengthTrampoline):
+        (JSC::CTI::privateStringLengthTrampoline):
+        (JSC::CTI::compileRegExp):
+        * VM/CTI.h:
+        (JSC::CallRecord::CallRecord):
+        (JSC::JmpTable::JmpTable):
+        (JSC::SlowCaseEntry::SlowCaseEntry):
+        (JSC::CTI::JSRInfo::JSRInfo):
+        * masm/MacroAssembler.h: Removed.
+        * masm/MacroAssemblerWin.cpp: Removed.
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::emitConvertToFastCall):
+        (JSC::X86Assembler::emitRestoreArgumentReference):
+        * wrec/WREC.h:
+        (JSC::WRECGenerator::WRECGenerator):
+        (JSC::WRECParser::WRECParser):
+
+2008-09-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Don't waste the first item in the PropertyStorage.
+
+        - Fix typo (makingCount -> markingCount)
+        - Remove undefined method declaration.
+
+        No change on Sunspider.
+
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::mark):
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMap::put):
+        (JSC::PropertyMap::remove):
+        (JSC::PropertyMap::getOffset):
+        (JSC::PropertyMap::insert):
+        (JSC::PropertyMap::rehash):
+        (JSC::PropertyMap::resizePropertyStorage):
+        (JSC::PropertyMap::checkConsistency):
+        * kjs/PropertyMap.h:
+        (JSC::PropertyMap::markingCount): Fix typo.
+
+2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Not reviewed.
+
+        Speculative Windows build fix.
+
+        * masm/MacroAssemblerWin.cpp:
+        (JSC::MacroAssembler::emitConvertToFastCall):
+        (JSC::MacroAssembler::emitRestoreArgumentReference):
+
+2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20755: Create an X86 namespace for register names and other things
+        <https://bugs.webkit.org/show_bug.cgi?id=20755>
+
+        Create an X86 namespace to put X86 register names. Perhaps I will move
+        opcode names here later as well.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::emitPutArg):
+        (JSC::CTI::emitPutArgConstant):
+        (JSC::CTI::emitPutCTIParam):
+        (JSC::CTI::emitGetCTIParam):
+        (JSC::CTI::emitPutToCallFrameHeader):
+        (JSC::CTI::emitGetFromCallFrameHeader):
+        (JSC::CTI::emitPutResult):
+        (JSC::CTI::emitDebugExceptionCheck):
+        (JSC::CTI::emitJumpSlowCaseIfNotImms):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::CTI::privateArrayLengthTrampoline):
+        (JSC::CTI::privateStringLengthTrampoline):
+        (JSC::CTI::compileRegExp):
+        * VM/CTI.h:
+        * masm/X86Assembler.h:
+        (JSC::X86::):
+        (JSC::X86Assembler::emitModRm_rm):
+        (JSC::X86Assembler::emitModRm_rm_Unchecked):
+        (JSC::X86Assembler::emitModRm_rmsib):
+        * wrec/WREC.cpp:
+        (JSC::WRECGenerator::generateNonGreedyQuantifier):
+        (JSC::WRECGenerator::generateGreedyQuantifier):
+        (JSC::WRECGenerator::generateParentheses):
+        (JSC::WRECGenerator::generateBackreference):
+        (JSC::WRECGenerator::gernerateDisjunction):
+        * wrec/WREC.h:
+
+2008-09-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove unnecessary friend declaration.
+
+        * kjs/PropertyMap.h:
+
+2008-09-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Replace uses of PropertyMap::get and PropertyMap::getLocation with
+        PropertyMap::getOffset.
+
+        Sunspider reports this as a .6% improvement.
+
+        * JavaScriptCore.exp:
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::deleteProperty):
+        (JSC::JSObject::getPropertyAttributes):
+        * kjs/JSObject.h:
+        (JSC::JSObject::getDirect):
+        (JSC::JSObject::getDirectLocation):
+        (JSC::JSObject::locationForOffset):
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMap::remove):
+        (JSC::PropertyMap::getOffset):
+        * kjs/PropertyMap.h:
+
+2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Sam Weinig.
+
+        Bug 20754: Remove emit prefix from assembler opcode methods
+        <https://bugs.webkit.org/show_bug.cgi?id=20754>
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitGetArg):
+        (JSC::CTI::emitGetPutArg):
+        (JSC::CTI::emitPutArg):
+        (JSC::CTI::emitPutArgConstant):
+        (JSC::CTI::emitPutCTIParam):
+        (JSC::CTI::emitGetCTIParam):
+        (JSC::CTI::emitPutToCallFrameHeader):
+        (JSC::CTI::emitGetFromCallFrameHeader):
+        (JSC::CTI::emitPutResult):
+        (JSC::CTI::emitDebugExceptionCheck):
+        (JSC::CTI::emitCall):
+        (JSC::CTI::emitJumpSlowCaseIfNotImm):
+        (JSC::CTI::emitJumpSlowCaseIfNotImms):
+        (JSC::CTI::emitFastArithDeTagImmediate):
+        (JSC::CTI::emitFastArithReTagImmediate):
+        (JSC::CTI::emitFastArithPotentiallyReTagImmediate):
+        (JSC::CTI::emitFastArithImmToInt):
+        (JSC::CTI::emitFastArithIntToImmOrSlowCase):
+        (JSC::CTI::emitFastArithIntToImmNoCheck):
+        (JSC::CTI::compileOpCall):
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        (JSC::CTI::privateCompile):
+        (JSC::CTI::privateCompileGetByIdSelf):
+        (JSC::CTI::privateCompileGetByIdProto):
+        (JSC::CTI::privateCompileGetByIdChain):
+        (JSC::CTI::privateCompilePutByIdReplace):
+        (JSC::CTI::privateArrayLengthTrampoline):
+        (JSC::CTI::privateStringLengthTrampoline):
+        (JSC::CTI::compileRegExp):
+        * masm/MacroAssemblerWin.cpp:
+        (JSC::MacroAssembler::emitConvertToFastCall):
+        (JSC::MacroAssembler::emitRestoreArgumentReference):
+        * masm/X86Assembler.h:
+        (JSC::X86Assembler::pushl_r):
+        (JSC::X86Assembler::pushl_m):
+        (JSC::X86Assembler::popl_r):
+        (JSC::X86Assembler::popl_m):
+        (JSC::X86Assembler::movl_rr):
+        (JSC::X86Assembler::addl_rr):
+        (JSC::X86Assembler::addl_i8r):
+        (JSC::X86Assembler::addl_i32r):
+        (JSC::X86Assembler::addl_mr):
+        (JSC::X86Assembler::andl_rr):
+        (JSC::X86Assembler::andl_i32r):
+        (JSC::X86Assembler::cmpl_i8r):
+        (JSC::X86Assembler::cmpl_rr):
+        (JSC::X86Assembler::cmpl_rm):
+        (JSC::X86Assembler::cmpl_i32r):
+        (JSC::X86Assembler::cmpl_i32m):
+        (JSC::X86Assembler::cmpw_rm):
+        (JSC::X86Assembler::orl_rr):
+        (JSC::X86Assembler::subl_rr):
+        (JSC::X86Assembler::subl_i8r):
+        (JSC::X86Assembler::subl_i32r):
+        (JSC::X86Assembler::subl_mr):
+        (JSC::X86Assembler::testl_i32r):
+        (JSC::X86Assembler::testl_rr):
+        (JSC::X86Assembler::xorl_i8r):
+        (JSC::X86Assembler::xorl_rr):
+        (JSC::X86Assembler::sarl_i8r):
+        (JSC::X86Assembler::sarl_CLr):
+        (JSC::X86Assembler::shl_i8r):
+        (JSC::X86Assembler::shll_CLr):
+        (JSC::X86Assembler::mull_rr):
+        (JSC::X86Assembler::idivl_r):
+        (JSC::X86Assembler::cdq):
+        (JSC::X86Assembler::movl_mr):
+        (JSC::X86Assembler::movzwl_mr):
+        (JSC::X86Assembler::movl_rm):
+        (JSC::X86Assembler::movl_i32r):
+        (JSC::X86Assembler::movl_i32m):
+        (JSC::X86Assembler::leal_mr):
+        (JSC::X86Assembler::ret):
+        (JSC::X86Assembler::jmp_r):
+        (JSC::X86Assembler::jmp_m):
+        (JSC::X86Assembler::call_r):
+        * wrec/WREC.cpp:
+        (JSC::WRECGenerator::generateBacktrack1):
+        (JSC::WRECGenerator::generateBacktrackBackreference):
+        (JSC::WRECGenerator::generateBackreferenceQuantifier):
+        (JSC::WRECGenerator::generateNonGreedyQuantifier):
+        (JSC::WRECGenerator::generateGreedyQuantifier):
+        (JSC::WRECGenerator::generatePatternCharacter):
+        (JSC::WRECGenerator::generateCharacterClassInvertedRange):
+        (JSC::WRECGenerator::generateCharacterClassInverted):
+        (JSC::WRECGenerator::generateCharacterClass):
+        (JSC::WRECGenerator::generateParentheses):
+        (JSC::WRECGenerator::gererateParenthesesResetTrampoline):
+        (JSC::WRECGenerator::generateAssertionBOL):
+        (JSC::WRECGenerator::generateAssertionEOL):
+        (JSC::WRECGenerator::generateAssertionWordBoundary):
+        (JSC::WRECGenerator::generateBackreference):
+        (JSC::WRECGenerator::gernerateDisjunction):
+
+2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Clean up the WREC code some more.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::compileRegExp):
+        * wrec/WREC.cpp:
+        (JSC::getCharacterClassNewline):
+        (JSC::getCharacterClassDigits):
+        (JSC::getCharacterClassSpaces):
+        (JSC::getCharacterClassWordchar):
+        (JSC::getCharacterClassNondigits):
+        (JSC::getCharacterClassNonspaces):
+        (JSC::getCharacterClassNonwordchar):
+        (JSC::WRECGenerator::generateBacktrack1):
+        (JSC::WRECGenerator::generateBacktrackBackreference):
+        (JSC::WRECGenerator::generateBackreferenceQuantifier):
+        (JSC::WRECGenerator::generateNonGreedyQuantifier):
+        (JSC::WRECGenerator::generateGreedyQuantifier):
+        (JSC::WRECGenerator::generatePatternCharacter):
+        (JSC::WRECGenerator::generateCharacterClassInvertedRange):
+        (JSC::WRECGenerator::generateCharacterClassInverted):
+        (JSC::WRECGenerator::generateCharacterClass):
+        (JSC::WRECGenerator::generateParentheses):
+        (JSC::WRECGenerator::gererateParenthesesResetTrampoline):
+        (JSC::WRECGenerator::generateAssertionBOL):
+        (JSC::WRECGenerator::generateAssertionEOL):
+        (JSC::WRECGenerator::generateAssertionWordBoundary):
+        (JSC::WRECGenerator::generateBackreference):
+        (JSC::WRECGenerator::gernerateDisjunction):
+        (JSC::WRECParser::parseCharacterClass):
+        (JSC::WRECParser::parseEscape):
+        (JSC::WRECParser::parseTerm):
+        * wrec/WREC.h:
+
+2008-09-09  Mark Rowe  <mrowe@apple.com>
+
+        Build fix, rubber-stamped by Anders Carlsson.
+
+        Silence spurious build warnings about missing format attributes on functions in Assertions.cpp.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-09-09  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Fix builds using the "debug" variant.
+
+        This reverts r36130 and tweaks Identifier to export the same symbols for Debug
+        and Release configurations.
+
+        * Configurations/JavaScriptCore.xcconfig:
+        * DerivedSources.make:
+        * JavaScriptCore.Debug.exp: Removed.
+        * JavaScriptCore.base.exp: Removed.
+        * JavaScriptCore.exp: Added.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/identifier.cpp:
+        (JSC::Identifier::addSlowCase): #ifdef the call to checkSameIdentifierTable so that
+        there is no overhead in Release builds.
+        (JSC::Identifier::checkSameIdentifierTable): Add empty functions for Release builds.
+        * kjs/identifier.h:
+        (JSC::Identifier::add): #ifdef the calls to checkSameIdentifierTable so that there is
+        no overhead in Release builds, and remove the inline definitions of checkSameIdentifierTable.
+
+2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Clean up WREC a bit to bring it closer to our coding style guidelines.
+
+        * wrec/WREC.cpp:
+        (JSC::):
+        (JSC::getCharacterClass_newline):
+        (JSC::getCharacterClass_d):
+        (JSC::getCharacterClass_s):
+        (JSC::getCharacterClass_w):
+        (JSC::getCharacterClass_D):
+        (JSC::getCharacterClass_S):
+        (JSC::getCharacterClass_W):
+        (JSC::CharacterClassConstructor::append):
+        (JSC::WRECGenerator::generateNonGreedyQuantifier):
+        (JSC::WRECGenerator::generateGreedyQuantifier):
+        (JSC::WRECGenerator::generateCharacterClassInverted):
+        (JSC::WRECParser::parseQuantifier):
+        (JSC::WRECParser::parsePatternCharacterQualifier):
+        (JSC::WRECParser::parseCharacterClassQuantifier):
+        (JSC::WRECParser::parseBackreferenceQuantifier):
+        * wrec/WREC.h:
+        (JSC::Quantifier::):
+        (JSC::Quantifier::Quantifier):
+
+2008-09-09  Jungshik Shin  <jungshik.shin@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Try MIME charset names before trying IANA names 
+        ( https://bugs.webkit.org/show_bug.cgi?id=17537 )
+
+        * wtf/StringExtras.h: (strcasecmp): Added.
+
+2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Mark Rowe.
+
+        Bug 20719: REGRESSION (r36135-36244): Hangs, then crashes after several seconds
+        <https://bugs.webkit.org/show_bug.cgi?id=20719>
+        <rdar://problem/6205787>
+
+        Fix a typo in the case-insensitive matching of character patterns.
+
+        * wrec/WREC.cpp:
+        (JSC::WRECGenerator::generatePatternCharacter):
+
+2008-09-09  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        - allow polymorphic inline cache to handle Math object functions and possibly other similar things
+        
+        1.012x speedup on SunSpider.
+
+        * kjs/MathObject.cpp:
+        (JSC::MathObject::getOwnPropertySlot):
+        * kjs/lookup.cpp:
+        (JSC::setUpStaticFunctionSlot):
+        * kjs/lookup.h:
+        (JSC::getStaticPropertySlot):
+
+2008-09-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak and Oliver Hunt.
+
+        Split storage of properties out of the PropertyMap and into the JSObject
+        to allow sharing PropertyMap on the StructureID.  In order to get this
+        function correctly, the StructureID's transition mappings were changed to
+        transition based on property name and attribute pairs, instead of just
+        property name.
+
+        - Removes the single property optimization now that the PropertyMap is shared.
+          This will be replaced by in-lining some values on the JSObject.
+
+        This is a wash on Sunspider and a 6.7% win on the v8 test suite.
+
+        * JavaScriptCore.base.exp:
+        * VM/CTI.cpp:
+        (JSC::CTI::privateCompileGetByIdSelf): Get the storage directly off the JSObject.
+        (JSC::CTI::privateCompileGetByIdProto): Ditto.
+        (JSC::CTI::privateCompileGetByIdChain): Ditto.
+        (JSC::CTI::privateCompilePutByIdReplace): Ditto.
+        * kjs/JSObject.cpp:
+        (JSC::JSObject::mark): Mark the PropertyStorage.
+        (JSC::JSObject::put): Update to get the propertyMap of the StructureID.
+        (JSC::JSObject::deleteProperty): Ditto.
+        (JSC::JSObject::defineGetter): Return early if the property is already a getter/setter.
+        (JSC::JSObject::defineSetter): Ditto.
+        (JSC::JSObject::getPropertyAttributes): Update to get the propertyMap of the StructureID
+        (JSC::JSObject::getPropertyNames): Ditto.
+        (JSC::JSObject::removeDirect): Ditto.
+        * kjs/JSObject.h: Remove PropertyMap and add PropertyStorage.
+        (JSC::JSObject::propertyStorage): return the PropertyStorage.
+        (JSC::JSObject::getDirect): Update to get the propertyMap of the StructureID.
+        (JSC::JSObject::getDirectLocation): Ditto.
+        (JSC::JSObject::offsetForLocation): Compute location directly.
+        (JSC::JSObject::hasCustomProperties): Update to get the propertyMap of the StructureID.
+        (JSC::JSObject::hasGetterSetterProperties): Ditto.
+        (JSC::JSObject::getDirectOffset): Get by indexing into PropertyStorage.
+        (JSC::JSObject::putDirectOffset): Put by indexing into PropertyStorage.
+        (JSC::JSObject::getOwnPropertySlotForWrite): Update to get the propertyMap of the StructureID.
+        (JSC::JSObject::getOwnPropertySlot): Ditto.
+        (JSC::JSObject::putDirect): Move putting into the StructureID unless the property already exists.
+        * kjs/PropertyMap.cpp: Use the propertyStorage as the storage for the JSValues.
+        (JSC::PropertyMap::checkConsistency): 
+        (JSC::PropertyMap::operator=):
+        (JSC::PropertyMap::~PropertyMap):
+        (JSC::PropertyMap::get):
+        (JSC::PropertyMap::getLocation):
+        (JSC::PropertyMap::put):
+        (JSC::PropertyMap::getOffset):
+        (JSC::PropertyMap::insert):
+        (JSC::PropertyMap::expand):
+        (JSC::PropertyMap::rehash):
+        (JSC::PropertyMap::createTable):
+        (JSC::PropertyMap::resizePropertyStorage): Resize the storage to match the size of the map
+        (JSC::PropertyMap::remove):
+        (JSC::PropertyMap::getEnumerablePropertyNames):
+        * kjs/PropertyMap.h: 
+        (JSC::PropertyMapEntry::PropertyMapEntry):
+        (JSC::PropertyMap::isEmpty):
+        (JSC::PropertyMap::size):
+        (JSC::PropertyMap::makingCount):
+        (JSC::PropertyMap::PropertyMap):
+
+        * kjs/StructureID.cpp: 
+        (JSC::StructureID::addPropertyTransition): Transitions now are based off the property name
+        and attributes. 
+        (JSC::StructureID::toDictionaryTransition): Copy the map.
+        (JSC::StructureID::changePrototypeTransition): Copy the map.
+        (JSC::StructureID::getterSetterTransition): Copy the map.
+        (JSC::StructureID::~StructureID): 
+        * kjs/StructureID.h:
+        (JSC::TransitionTableHash::hash): Custom hash for transition map.
+        (JSC::TransitionTableHash::equal): Ditto.
+        (JSC::TransitionTableHashTraits::emptyValue): Custom traits for transition map
+        (JSC::TransitionTableHashTraits::constructDeletedValue): Ditto.
+        (JSC::TransitionTableHashTraits::isDeletedValue): Ditto.
+        (JSC::StructureID::propertyMap): Added.
+
+2008-09-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 20694: Slow Script error pops up when running Dromaeo tests
+
+        Correct error in timeout logic where execution tick count would
+        be reset to incorrect value due to incorrect offset and indirection.
+        Codegen for the slow script dialog was factored out into a separate
+        method (emitSlowScriptCheck) rather than having multiple copies of
+        the same code.  Also added calls to generate slow script checks
+        for loop_if_less and loop_if_true opcodes.
+
+        * VM/CTI.cpp:
+        (JSC::CTI::emitSlowScriptCheck):
+        (JSC::CTI::privateCompileMainPass):
+        (JSC::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+
+2008-09-08  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove references to the removed WRECompiler class.
+
+        * VM/Machine.h:
+        * wrec/WREC.h:
+
+2008-09-08  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Rubber-stamped by Mark Rowe.
+
+        Fix the build with CTI enabled but WREC disabled.
+
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+
+2008-09-08  Dan Bernstein  <mitz@apple.com>
+
+        - build fix
+
+        * kjs/nodes.h:
+        (JSC::StatementNode::):
+        (JSC::BlockNode::):
+
+2008-09-08  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoff.
+
+       <rdar://problem/6134407> Breakpoints in for loops, while loops or
+       conditions without curly braces don't break. (19306)
+       -Statement Lists already emit debug hooks but conditionals without
+       brackets are not lists.
+
+        * kjs/nodes.cpp:
+        (KJS::IfNode::emitCode):
+        (KJS::IfElseNode::emitCode):
+        (KJS::DoWhileNode::emitCode):
+        (KJS::WhileNode::emitCode):
+        (KJS::ForNode::emitCode):
+        (KJS::ForInNode::emitCode):
+        * kjs/nodes.h:
+        (KJS::StatementNode::):
+        (KJS::BlockNode::):
+
+2008-09-08  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Anders Carlsson.
+        
+        - Cache the code generated for eval to speed up SunSpider and web sites
+        https://bugs.webkit.org/show_bug.cgi?id=20718
+        
+        1.052x on SunSpider
+        2.29x on date-format-tofte
+        
+        Lots of real sites seem to get many hits on this cache as well,
+        including GMail, Google Spreadsheets, Slate and Digg (the last of
+        these gets over 100 hits on initial page load).
+
+        * VM/CodeBlock.h:
+        (JSC::EvalCodeCache::get):
+        * VM/Machine.cpp:
+        (JSC::Machine::callEval):
+        (JSC::Machine::privateExecute):
+        (JSC::Machine::cti_op_call_eval):
+        * VM/Machine.h:
+
+2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 20711: Change KJS prefix on preprocessor macros to JSC
+        <https://bugs.webkit.org/show_bug.cgi?id=20711>
+
+        * kjs/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        * kjs/CommonIdentifiers.h:
+        * kjs/PropertySlot.h:
+        (JSC::PropertySlot::getValue):
+        (JSC::PropertySlot::putValue):
+        (JSC::PropertySlot::setValueSlot):
+        (JSC::PropertySlot::setValue):
+        (JSC::PropertySlot::setRegisterSlot):
+        * kjs/lookup.h:
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+        (JSC::Node::):
+        (JSC::ExpressionNode::):
+        (JSC::StatementNode::):
+        (JSC::NullNode::):
+        (JSC::BooleanNode::):
+        (JSC::NumberNode::):
+        (JSC::ImmediateNumberNode::):
+        (JSC::StringNode::):
+        (JSC::RegExpNode::):
+        (JSC::ThisNode::):
+        (JSC::ResolveNode::):
+        (JSC::ElementNode::):
+        (JSC::ArrayNode::):
+        (JSC::PropertyNode::):
+        (JSC::PropertyListNode::):
+        (JSC::ObjectLiteralNode::):
+        (JSC::BracketAccessorNode::):
+        (JSC::DotAccessorNode::):
+        (JSC::ArgumentListNode::):
+        (JSC::ArgumentsNode::):
+        (JSC::NewExprNode::):
+        (JSC::EvalFunctionCallNode::):
+        (JSC::FunctionCallValueNode::):
+        (JSC::FunctionCallResolveNode::):
+        (JSC::FunctionCallBracketNode::):
+        (JSC::FunctionCallDotNode::):
+        (JSC::PrePostResolveNode::):
+        (JSC::PostfixResolveNode::):
+        (JSC::PostfixBracketNode::):
+        (JSC::PostfixDotNode::):
+        (JSC::PostfixErrorNode::):
+        (JSC::DeleteResolveNode::):
+        (JSC::DeleteBracketNode::):
+        (JSC::DeleteDotNode::):
+        (JSC::DeleteValueNode::):
+        (JSC::VoidNode::):
+        (JSC::TypeOfResolveNode::):
+        (JSC::TypeOfValueNode::):
+        (JSC::PrefixResolveNode::):
+        (JSC::PrefixBracketNode::):
+        (JSC::PrefixDotNode::):
+        (JSC::PrefixErrorNode::):
+        (JSC::UnaryPlusNode::):
+        (JSC::NegateNode::):
+        (JSC::BitwiseNotNode::):
+        (JSC::LogicalNotNode::):
+        (JSC::MultNode::):
+        (JSC::DivNode::):
+        (JSC::ModNode::):
+        (JSC::AddNode::):
+        (JSC::SubNode::):
+        (JSC::LeftShiftNode::):
+        (JSC::RightShiftNode::):
+        (JSC::UnsignedRightShiftNode::):
+        (JSC::LessNode::):
+        (JSC::GreaterNode::):
+        (JSC::LessEqNode::):
+        (JSC::GreaterEqNode::):
+        (JSC::ThrowableBinaryOpNode::):
+        (JSC::InstanceOfNode::):
+        (JSC::InNode::):
+        (JSC::EqualNode::):
+        (JSC::NotEqualNode::):
+        (JSC::StrictEqualNode::):
+        (JSC::NotStrictEqualNode::):
+        (JSC::BitAndNode::):
+        (JSC::BitOrNode::):
+        (JSC::BitXOrNode::):
+        (JSC::LogicalOpNode::):
+        (JSC::ConditionalNode::):
+        (JSC::ReadModifyResolveNode::):
+        (JSC::AssignResolveNode::):
+        (JSC::ReadModifyBracketNode::):
+        (JSC::AssignBracketNode::):
+        (JSC::AssignDotNode::):
+        (JSC::ReadModifyDotNode::):
+        (JSC::AssignErrorNode::):
+        (JSC::CommaNode::):
+        (JSC::VarDeclCommaNode::):
+        (JSC::ConstDeclNode::):
+        (JSC::ConstStatementNode::):
+        (JSC::EmptyStatementNode::):
+        (JSC::DebuggerStatementNode::):
+        (JSC::ExprStatementNode::):
+        (JSC::VarStatementNode::):
+        (JSC::IfNode::):
+        (JSC::IfElseNode::):
+        (JSC::DoWhileNode::):
+        (JSC::WhileNode::):
+        (JSC::ForNode::):
+        (JSC::ContinueNode::):
+        (JSC::BreakNode::):
+        (JSC::ReturnNode::):
+        (JSC::WithNode::):
+        (JSC::LabelNode::):
+        (JSC::ThrowNode::):
+        (JSC::TryNode::):
+        (JSC::ParameterNode::):
+        (JSC::ScopeNode::):
+        (JSC::ProgramNode::):
+        (JSC::EvalNode::):
+        (JSC::FunctionBodyNode::):
+        (JSC::FuncExprNode::):
+        (JSC::FuncDeclNode::):
+        (JSC::CaseClauseNode::):
+        (JSC::ClauseListNode::):
+        (JSC::CaseBlockNode::):
+        (JSC::SwitchNode::):
+
+2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20704: Replace the KJS namespace
+        <https://bugs.webkit.org/show_bug.cgi?id=20704>
+
+        Rename the KJS namespace to JSC. There are still some uses of KJS in
+        preprocessor macros and comments, but these will also be changed some
+        time in the near future.
+
+        * API/APICast.h:
+        (toJS):
+        (toRef):
+        (toGlobalRef):
+        * API/JSBase.cpp:
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.cpp:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        * API/JSClassRef.cpp:
+        (OpaqueJSClass::staticValues):
+        (OpaqueJSClass::staticFunctions):
+        * API/JSClassRef.h:
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        * API/JSProfilerPrivate.cpp:
+        * API/JSStringRef.cpp:
+        * API/JSValueRef.cpp:
+        (JSValueGetType):
+        * API/OpaqueJSString.cpp:
+        * API/OpaqueJSString.h:
+        * JavaScriptCore.Debug.exp:
+        * JavaScriptCore.base.exp:
+        * VM/CTI.cpp:
+        (JSC::):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        * VM/CodeBlock.h:
+        * VM/CodeGenerator.cpp:
+        * VM/CodeGenerator.h:
+        * VM/ExceptionHelpers.cpp:
+        * VM/ExceptionHelpers.h:
+        * VM/Instruction.h:
+        * VM/JSPropertyNameIterator.cpp:
+        * VM/JSPropertyNameIterator.h:
+        * VM/LabelID.h:
+        * VM/Machine.cpp:
+        * VM/Machine.h:
+        * VM/Opcode.cpp:
+        * VM/Opcode.h:
+        * VM/Register.h:
+        (WTF::):
+        * VM/RegisterFile.cpp:
+        * VM/RegisterFile.h:
+        * VM/RegisterID.h:
+        (WTF::):
+        * VM/SamplingTool.cpp:
+        * VM/SamplingTool.h:
+        * VM/SegmentedVector.h:
+        * kjs/ArgList.cpp:
+        * kjs/ArgList.h:
+        * kjs/Arguments.cpp:
+        * kjs/Arguments.h:
+        * kjs/ArrayConstructor.cpp:
+        * kjs/ArrayConstructor.h:
+        * kjs/ArrayPrototype.cpp:
+        * kjs/ArrayPrototype.h:
+        * kjs/BatchedTransitionOptimizer.h:
+        * kjs/BooleanConstructor.cpp:
+        * kjs/BooleanConstructor.h:
+        * kjs/BooleanObject.cpp:
+        * kjs/BooleanObject.h:
+        * kjs/BooleanPrototype.cpp:
+        * kjs/BooleanPrototype.h:
+        * kjs/CallData.cpp:
+        * kjs/CallData.h:
+        * kjs/ClassInfo.h:
+        * kjs/CommonIdentifiers.cpp:
+        * kjs/CommonIdentifiers.h:
+        * kjs/ConstructData.cpp:
+        * kjs/ConstructData.h:
+        * kjs/DateConstructor.cpp:
+        * kjs/DateConstructor.h:
+        * kjs/DateInstance.cpp:
+        (JSC::DateInstance::msToGregorianDateTime):
+        * kjs/DateInstance.h:
+        * kjs/DateMath.cpp:
+        * kjs/DateMath.h:
+        * kjs/DatePrototype.cpp:
+        * kjs/DatePrototype.h:
+        * kjs/DebuggerCallFrame.cpp:
+        * kjs/DebuggerCallFrame.h:
+        * kjs/Error.cpp:
+        * kjs/Error.h:
+        * kjs/ErrorConstructor.cpp:
+        * kjs/ErrorConstructor.h:
+        * kjs/ErrorInstance.cpp:
+        * kjs/ErrorInstance.h:
+        * kjs/ErrorPrototype.cpp:
+        * kjs/ErrorPrototype.h:
+        * kjs/ExecState.cpp:
+        * kjs/ExecState.h:
+        * kjs/FunctionConstructor.cpp:
+        * kjs/FunctionConstructor.h:
+        * kjs/FunctionPrototype.cpp:
+        * kjs/FunctionPrototype.h:
+        * kjs/GetterSetter.cpp:
+        * kjs/GetterSetter.h:
+        * kjs/GlobalEvalFunction.cpp:
+        * kjs/GlobalEvalFunction.h:
+        * kjs/IndexToNameMap.cpp:
+        * kjs/IndexToNameMap.h:
+        * kjs/InitializeThreading.cpp:
+        * kjs/InitializeThreading.h:
+        * kjs/InternalFunction.cpp:
+        * kjs/InternalFunction.h:
+        (JSC::InternalFunction::InternalFunction):
+        * kjs/JSActivation.cpp:
+        * kjs/JSActivation.h:
+        * kjs/JSArray.cpp:
+        * kjs/JSArray.h:
+        * kjs/JSCell.cpp:
+        * kjs/JSCell.h:
+        * kjs/JSFunction.cpp:
+        * kjs/JSFunction.h:
+        (JSC::JSFunction::JSFunction):
+        * kjs/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * kjs/JSGlobalData.h:
+        * kjs/JSGlobalObject.cpp:
+        * kjs/JSGlobalObject.h:
+        * kjs/JSGlobalObjectFunctions.cpp:
+        * kjs/JSGlobalObjectFunctions.h:
+        * kjs/JSImmediate.cpp:
+        * kjs/JSImmediate.h:
+        * kjs/JSLock.cpp:
+        * kjs/JSLock.h:
+        * kjs/JSNotAnObject.cpp:
+        * kjs/JSNotAnObject.h:
+        * kjs/JSNumberCell.cpp:
+        * kjs/JSNumberCell.h:
+        * kjs/JSObject.cpp:
+        * kjs/JSObject.h:
+        * kjs/JSStaticScopeObject.cpp:
+        * kjs/JSStaticScopeObject.h:
+        * kjs/JSString.cpp:
+        * kjs/JSString.h:
+        * kjs/JSType.h:
+        * kjs/JSValue.cpp:
+        * kjs/JSValue.h:
+        * kjs/JSVariableObject.cpp:
+        * kjs/JSVariableObject.h:
+        * kjs/JSWrapperObject.cpp:
+        * kjs/JSWrapperObject.h:
+        * kjs/LabelStack.cpp:
+        * kjs/LabelStack.h:
+        * kjs/MathObject.cpp:
+        * kjs/MathObject.h:
+        * kjs/NativeErrorConstructor.cpp:
+        * kjs/NativeErrorConstructor.h:
+        * kjs/NativeErrorPrototype.cpp:
+        * kjs/NativeErrorPrototype.h:
+        * kjs/NodeInfo.h:
+        * kjs/NumberConstructor.cpp:
+        * kjs/NumberConstructor.h:
+        * kjs/NumberObject.cpp:
+        * kjs/NumberObject.h:
+        * kjs/NumberPrototype.cpp:
+        * kjs/NumberPrototype.h:
+        * kjs/ObjectConstructor.cpp:
+        * kjs/ObjectConstructor.h:
+        * kjs/ObjectPrototype.cpp:
+        * kjs/ObjectPrototype.h:
+        * kjs/Parser.cpp:
+        * kjs/Parser.h:
+        * kjs/PropertyMap.cpp:
+        (JSC::PropertyMapStatisticsExitLogger::~PropertyMapStatisticsExitLogger):
+        * kjs/PropertyMap.h:
+        * kjs/PropertyNameArray.cpp:
+        * kjs/PropertyNameArray.h:
+        * kjs/PropertySlot.cpp:
+        * kjs/PropertySlot.h:
+        * kjs/PrototypeFunction.cpp:
+        * kjs/PrototypeFunction.h:
+        * kjs/PutPropertySlot.h:
+        * kjs/RegExpConstructor.cpp:
+        * kjs/RegExpConstructor.h:
+        * kjs/RegExpObject.cpp:
+        * kjs/RegExpObject.h:
+        * kjs/RegExpPrototype.cpp:
+        * kjs/RegExpPrototype.h:
+        * kjs/ScopeChain.cpp:
+        * kjs/ScopeChain.h:
+        * kjs/ScopeChainMark.h:
+        * kjs/Shell.cpp:
+        (jscmain):
+        * kjs/SmallStrings.cpp:
+        * kjs/SmallStrings.h:
+        * kjs/SourceProvider.h:
+        * kjs/SourceRange.h:
+        * kjs/StringConstructor.cpp:
+        * kjs/StringConstructor.h:
+        * kjs/StringObject.cpp:
+        * kjs/StringObject.h:
+        * kjs/StringObjectThatMasqueradesAsUndefined.h:
+        * kjs/StringPrototype.cpp:
+        * kjs/StringPrototype.h:
+        * kjs/StructureID.cpp:
+        * kjs/StructureID.h:
+        * kjs/SymbolTable.h:
+        * kjs/collector.cpp:
+        * kjs/collector.h:
+        * kjs/completion.h:
+        * kjs/create_hash_table:
+        * kjs/debugger.cpp:
+        * kjs/debugger.h:
+        * kjs/dtoa.cpp:
+        * kjs/dtoa.h:
+        * kjs/grammar.y:
+        * kjs/identifier.cpp:
+        * kjs/identifier.h:
+        (JSC::Identifier::equal):
+        * kjs/interpreter.cpp:
+        * kjs/interpreter.h:
+        * kjs/lexer.cpp:
+        (JSC::Lexer::Lexer):
+        (JSC::Lexer::clear):
+        (JSC::Lexer::makeIdentifier):
+        * kjs/lexer.h:
+        * kjs/lookup.cpp:
+        * kjs/lookup.h:
+        * kjs/nodes.cpp:
+        * kjs/nodes.h:
+        * kjs/nodes2string.cpp:
+        * kjs/operations.cpp:
+        * kjs/operations.h:
+        * kjs/protect.h:
+        * kjs/regexp.cpp:
+        * kjs/regexp.h:
+        * kjs/ustring.cpp:
+        * kjs/ustring.h:
+        (JSC::operator!=):
+        (JSC::IdentifierRepHash::hash):
+        (WTF::):
+        * masm/MacroAssembler.h:
+        * masm/MacroAssemblerWin.cpp:
+        * masm/X86Assembler.h:
+        * pcre/pcre_exec.cpp:
+        * profiler/CallIdentifier.h:
+        (WTF::):
+        * profiler/HeavyProfile.cpp:
+        * profiler/HeavyProfile.h:
+        * profiler/Profile.cpp:
+        * profiler/Profile.h:
+        * profiler/ProfileGenerator.cpp:
+        * profiler/ProfileGenerator.h:
+        * profiler/ProfileNode.cpp:
+        * profiler/ProfileNode.h:
+        * profiler/Profiler.cpp:
+        * profiler/Profiler.h:
+        * profiler/TreeProfile.cpp:
+        * profiler/TreeProfile.h:
+        * wrec/WREC.cpp:
+        * wrec/WREC.h:
+        * wtf/AVLTree.h:
+
+2008-09-07  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dan Bernstein.
+        
+        - rename IA32MacroAssembler class to X86Assembler
+        
+        We otherwise call the platform X86, and also, I don't see any macros.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * masm/IA32MacroAsm.h: Removed.
+        * masm/MacroAssembler.h:
+        (KJS::MacroAssembler::MacroAssembler):
+        * masm/MacroAssemblerWin.cpp:
+        (KJS::MacroAssembler::emitRestoreArgumentReference):
+        * masm/X86Assembler.h: Copied from masm/IA32MacroAsm.h.
+        (KJS::X86Assembler::X86Assembler):
+        * wrec/WREC.cpp:
+        (KJS::WRECGenerator::generateNonGreedyQuantifier):
+        (KJS::WRECGenerator::generateGreedyQuantifier):
+        (KJS::WRECGenerator::generateParentheses):
+        (KJS::WRECGenerator::generateBackreference):
+        (KJS::WRECGenerator::gernerateDisjunction):
+        * wrec/WREC.h:
+
+2008-09-07  Cameron Zwarich  <cwzwarich@webkit.org>
+
+        Not reviewed.
+
+        Visual C++ seems to have some odd casting rules, so just convert the
+        offending cast back to a C-style cast for now.
+
+        * kjs/collector.cpp:
+        (KJS::otherThreadStackPointer):
+
+2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Mark Rowe.
+
+        Attempt to fix the Windows build by using a const_cast to cast regs.Esp
+        to a uintptr_t instead of a reinterpret_cast.
+
+        * kjs/collector.cpp:
+        (KJS::otherThreadStackPointer):
+
+2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Sam Weinig.
+
+        Remove C-style casts from kjs/collector.cpp.
+
+        * kjs/collector.cpp:
+        (KJS::Heap::heapAllocate):
+        (KJS::currentThreadStackBase):
+        (KJS::Heap::markConservatively):
+        (KJS::otherThreadStackPointer):
+        (KJS::Heap::markOtherThreadConservatively):
+        (KJS::Heap::sweep):
+
+2008-09-07  Mark Rowe  <mrowe@apple.com>
+
+        Build fix for the debug variant.
+
+        * DerivedSources.make: Also use the .Debug.exp exports file when building the debug variant.
+
+2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Timothy Hatcher.
+
+        Remove C-style casts from the CTI code.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::emitGetArg):
+        (KJS::CTI::emitGetPutArg):
+        (KJS::ctiRepatchCallByReturnAddress):
+        (KJS::CTI::compileOpCall):
+        (KJS::CTI::privateCompileMainPass):
+        (KJS::CTI::privateCompileGetByIdSelf):
+        (KJS::CTI::privateCompileGetByIdProto):
+        (KJS::CTI::privateCompileGetByIdChain):
+        (KJS::CTI::privateCompilePutByIdReplace):
+        (KJS::CTI::privateArrayLengthTrampoline):
+        (KJS::CTI::privateStringLengthTrampoline):
+
+=== End merge of squirrelfish-extreme ===
+
+2008-09-06  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig. Adapted somewhat by Maciej Stachowiak.
+        
+        - refactor WREC to share more of the JIT infrastructure with CTI
+
+        * VM/CTI.cpp:
+        (KJS::CTI::emitGetArg):
+        (KJS::CTI::emitGetPutArg):
+        (KJS::CTI::emitPutArg):
+        (KJS::CTI::emitPutArgConstant):
+        (KJS::CTI::emitPutCTIParam):
+        (KJS::CTI::emitGetCTIParam):
+        (KJS::CTI::emitPutToCallFrameHeader):
+        (KJS::CTI::emitGetFromCallFrameHeader):
+        (KJS::CTI::emitPutResult):
+        (KJS::CTI::emitDebugExceptionCheck):
+        (KJS::CTI::emitJumpSlowCaseIfNotImm):
+        (KJS::CTI::emitJumpSlowCaseIfNotImms):
+        (KJS::CTI::emitFastArithDeTagImmediate):
+        (KJS::CTI::emitFastArithReTagImmediate):
+        (KJS::CTI::emitFastArithPotentiallyReTagImmediate):
+        (KJS::CTI::emitFastArithImmToInt):
+        (KJS::CTI::emitFastArithIntToImmOrSlowCase):
+        (KJS::CTI::emitFastArithIntToImmNoCheck):
+        (KJS::CTI::CTI):
+        (KJS::CTI::compileOpCall):
+        (KJS::CTI::privateCompileMainPass):
+        (KJS::CTI::privateCompileSlowCases):
+        (KJS::CTI::privateCompile):
+        (KJS::CTI::privateCompileGetByIdSelf):
+        (KJS::CTI::privateCompileGetByIdProto):
+        (KJS::CTI::privateCompileGetByIdChain):
+        (KJS::CTI::privateCompilePutByIdReplace):
+        (KJS::CTI::privateArrayLengthTrampoline):
+        (KJS::CTI::privateStringLengthTrampoline):
+        (KJS::CTI::compileRegExp):
+        * VM/CTI.h:
+        (KJS::CallRecord::CallRecord):
+        (KJS::JmpTable::JmpTable):
+        (KJS::SlowCaseEntry::SlowCaseEntry):
+        (KJS::CTI::JSRInfo::JSRInfo):
+        * kjs/regexp.cpp:
+        (KJS::RegExp::RegExp):
+        * wrec/WREC.cpp:
+        (KJS::GenerateParenthesesNonGreedyFunctor::GenerateParenthesesNonGreedyFunctor):
+        (KJS::GeneratePatternCharacterFunctor::generateAtom):
+        (KJS::GeneratePatternCharacterFunctor::backtrack):
+        (KJS::GenerateCharacterClassFunctor::generateAtom):
+        (KJS::GenerateCharacterClassFunctor::backtrack):
+        (KJS::GenerateBackreferenceFunctor::generateAtom):
+        (KJS::GenerateBackreferenceFunctor::backtrack):
+        (KJS::GenerateParenthesesNonGreedyFunctor::generateAtom):
+        (KJS::GenerateParenthesesNonGreedyFunctor::backtrack):
+        (KJS::WRECGenerate::generateBacktrack1):
+        (KJS::WRECGenerate::generateBacktrackBackreference):
+        (KJS::WRECGenerate::generateBackreferenceQuantifier):
+        (KJS::WRECGenerate::generateNonGreedyQuantifier):
+        (KJS::WRECGenerate::generateGreedyQuantifier):
+        (KJS::WRECGenerate::generatePatternCharacter):
+        (KJS::WRECGenerate::generateCharacterClassInvertedRange):
+        (KJS::WRECGenerate::generateCharacterClassInverted):
+        (KJS::WRECGenerate::generateCharacterClass):
+        (KJS::WRECGenerate::generateParentheses):
+        (KJS::WRECGenerate::generateParenthesesNonGreedy):
+        (KJS::WRECGenerate::gererateParenthesesResetTrampoline):
+        (KJS::WRECGenerate::generateAssertionBOL):
+        (KJS::WRECGenerate::generateAssertionEOL):
+        (KJS::WRECGenerate::generateAssertionWordBoundary):
+        (KJS::WRECGenerate::generateBackreference):
+        (KJS::WRECGenerate::gernerateDisjunction):
+        (KJS::WRECGenerate::terminateDisjunction):
+        (KJS::WRECParser::parseGreedyQuantifier):
+        (KJS::WRECParser::parseQuantifier):
+        (KJS::WRECParser::parsePatternCharacterQualifier):
+        (KJS::WRECParser::parseCharacterClassQuantifier):
+        (KJS::WRECParser::parseBackreferenceQuantifier):
+        (KJS::WRECParser::parseParentheses):
+        (KJS::WRECParser::parseCharacterClass):
+        (KJS::WRECParser::parseOctalEscape):
+        (KJS::WRECParser::parseEscape):
+        (KJS::WRECParser::parseTerm):
+        (KJS::WRECParser::parseDisjunction):
+        * wrec/WREC.h:
+        (KJS::WRECGenerate::WRECGenerate):
+        (KJS::WRECParser::):
+        (KJS::WRECParser::WRECParser):
+        (KJS::WRECParser::parseAlternative):
+        (KJS::WRECParser::isEndOfPattern):
+
+2008-09-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix the sampler build.
+
+        * VM/SamplingTool.h:
+
+2008-09-06  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Jump through the necessary hoops required to make MSVC cooperate with SFX
+
+        We now explicitly declare the calling convention on all cti_op_* cfunctions,
+        and return int instead of bool where appropriate (despite the cdecl calling
+        convention seems to state MSVC generates code that returns the result value
+        through ecx).  SFX behaves slightly differently under MSVC, specifically it
+        stores the base argument address for the cti_op_* functions in the first
+        argument, and then does the required stack manipulation through that pointer.
+        This is necessary as MSVC's optimisations assume they have complete control
+        of the stack, and periodically elide our stack manipulations, or move
+        values in unexpected ways.  MSVC also frequently produces tail calls which may
+        clobber the first argument, so the MSVC path is slightly less efficient due
+        to the need to restore it.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CTI.cpp:
+        (KJS::):
+        (KJS::CTI::compileOpCall):
+        (KJS::CTI::privateCompileMainPass):
+        (KJS::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        * VM/Machine.h:
+        * masm/MacroAssembler.h:
+        (KJS::MacroAssembler::emitConvertToFastCall):
+        * masm/MacroAssemblerIA32GCC.cpp: Removed.
+           For performance reasons we need these no-op functions to be inlined.
+
+        * masm/MacroAssemblerWin.cpp:
+        (KJS::MacroAssembler::emitRestoreArgumentReference):
+        * wtf/Platform.h:
+
+2008-09-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Maciej Stachowiak, or maybe the other way around.
+        
+        Added the ability to coalesce JITCode buffer grow operations by first
+        growing the buffer and then executing unchecked puts to it.
+        
+        About a 2% speedup on date-format-tofte.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::compileOpCall):
+        * masm/IA32MacroAsm.h:
+        (KJS::JITCodeBuffer::ensureSpace):
+        (KJS::JITCodeBuffer::putByteUnchecked):
+        (KJS::JITCodeBuffer::putByte):
+        (KJS::JITCodeBuffer::putShortUnchecked):
+        (KJS::JITCodeBuffer::putShort):
+        (KJS::JITCodeBuffer::putIntUnchecked):
+        (KJS::JITCodeBuffer::putInt):
+        (KJS::IA32MacroAssembler::emitTestl_i32r):
+        (KJS::IA32MacroAssembler::emitMovl_mr):
+        (KJS::IA32MacroAssembler::emitMovl_rm):
+        (KJS::IA32MacroAssembler::emitMovl_i32m):
+        (KJS::IA32MacroAssembler::emitUnlinkedJe):
+        (KJS::IA32MacroAssembler::emitModRm_rr):
+        (KJS::IA32MacroAssembler::emitModRm_rr_Unchecked):
+        (KJS::IA32MacroAssembler::emitModRm_rm_Unchecked):
+        (KJS::IA32MacroAssembler::emitModRm_rm):
+        (KJS::IA32MacroAssembler::emitModRm_opr):
+        (KJS::IA32MacroAssembler::emitModRm_opr_Unchecked):
+        (KJS::IA32MacroAssembler::emitModRm_opm_Unchecked):
+
+2008-09-05  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Disable WREC and CTI on platforms that we have not yet had a chance to test with.
+
+        * wtf/Platform.h:
+
+2008-09-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Use jo instead of a mask compare when fetching array.length and
+        string.length. 4% speedup on array.length / string.length torture
+        test.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateArrayLengthTrampoline):
+        (KJS::CTI::privateStringLengthTrampoline):
+
+2008-09-05  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed a CTI compilation pass by recording labels during bytecode
+        generation. This is more to reduce complexity than it is to improve
+        performance.
+
+        SunSpider reports no change.
+
+        CodeBlock now keeps a "labels" set, which holds the offsets of all the
+        instructions that can be jumped to.
+
+        * VM/CTI.cpp: Nixed a pass.
+
+        * VM/CodeBlock.h: Added a "labels" set.
+
+        * VM/LabelID.h: No need for a special LableID for holding jump
+        destinations, since the CodeBlock now knows all jump destinations.
+
+        * wtf/HashTraits.h: New hash traits to accomodate putting offset 0 in
+        the set.
+
+        * kjs/nodes.cpp:
+        (KJS::TryNode::emitCode): Emit a dummy label to record sret targets.
+
+2008-09-05  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt and Gavin Barraclough.
+
+        Move the JITCodeBuffer onto Machine and remove the static variables.
+
+        * VM/CTI.cpp: Initialize m_jit with the Machine's code buffer.
+        * VM/Machine.cpp:
+        (KJS::Machine::Machine): Allocate a JITCodeBuffer.
+        * VM/Machine.h:
+        * kjs/RegExpConstructor.cpp:
+        (KJS::constructRegExp): Pass the ExecState through.
+        * kjs/RegExpPrototype.cpp:
+        (KJS::regExpProtoFuncCompile): Ditto.
+        * kjs/StringPrototype.cpp:
+        (KJS::stringProtoFuncMatch): Ditto.
+        (KJS::stringProtoFuncSearch): Ditto.
+        * kjs/nodes.cpp:
+        (KJS::RegExpNode::emitCode): Compile the pattern at code generation time
+        so that we have access to an ExecState.
+        * kjs/nodes.h:
+        (KJS::RegExpNode::):
+        * kjs/nodes2string.cpp:
+        * kjs/regexp.cpp:
+        (KJS::RegExp::RegExp): Pass the ExecState through.
+        (KJS::RegExp::create): Ditto.
+        * kjs/regexp.h:
+        * masm/IA32MacroAsm.h:
+        (KJS::IA32MacroAssembler::IA32MacroAssembler): Reset the JITCodeBuffer when we are
+        constructed.
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::compile): Retrieve the JITCodeBuffer from the Machine.
+        * wrec/WREC.h:
+
+2008-09-05  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt and Gavin Barraclough.
+
+        Fix the build when CTI is disabled.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::~CodeBlock):
+        * VM/CodeGenerator.cpp:
+        (KJS::prepareJumpTableForStringSwitch):
+        * VM/Machine.cpp:
+        (KJS::Machine::Machine):
+        (KJS::Machine::~Machine):
+
+2008-09-05  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix some windows abi issues.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompileMainPass):
+        (KJS::CTI::privateCompileSlowCases):
+        * VM/CTI.h:
+        (KJS::CallRecord::CallRecord):
+        (KJS::):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_resolve_func):
+        (KJS::Machine::cti_op_post_inc):
+        (KJS::Machine::cti_op_resolve_with_base):
+        (KJS::Machine::cti_op_post_dec):
+        * VM/Machine.h:
+
+2008-09-05  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix ecma/FunctionObjects/15.3.5.3.js after I broke it in r93.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_call_NotJSFunction): Restore m_callFrame to the correct value after making the native call.
+        (KJS::Machine::cti_op_construct_NotJSConstruct): Ditto.
+
+2008-09-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix fast/dom/Window/console-functions.html.
+
+        The call frame on the ExecState was not being updated on calls into native functions.  This meant that functions
+        such as console.log would use the line number of the last JS function on the call stack.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_call_NotJSFunction): Update the ExecState's call frame before making a native function call,
+        and restore it when the function is done.
+        (KJS::Machine::cti_op_construct_NotJSConstruct): Ditto.
+
+2008-09-05  Oliver Hunt  <oliver@apple.com>
+
+        Start bringing up SFX on windows.
+
+        Reviewed by Mark Rowe and Sam Weinig
+
+        Start doing the work to bring up SFX on windows.  Initially
+        just working on WREC, as it does not make any calls so reduces
+        the amount of code that needs to be corrected.
+        
+        Start abstracting the CTI JIT codegen engine.
+
+        * ChangeLog:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CTI.cpp:
+        * masm/IA32MacroAsm.h:
+        * masm/MacroAssembler.h: Added.
+        (KJS::MacroAssembler::MacroAssembler):
+        * masm/MacroAssemblerIA32GCC.cpp: Added.
+        (KJS::MacroAssembler::emitConvertToFastCall):
+        * masm/MacroAssemblerWin.cpp: Added.
+        (KJS::MacroAssembler::emitConvertToFastCall):
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::parseGreedyQuantifier):
+        (KJS::WRECompiler::parseCharacterClass):
+        (KJS::WRECompiler::parseEscape):
+        (KJS::WRECompiler::compilePattern):
+        * wrec/WREC.h:
+
+2008-09-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Support for slow scripts (timeout checking).
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompileMainPass):
+        (KJS::CTI::privateCompile):
+        * VM/Machine.cpp:
+        (KJS::slideRegisterWindowForCall):
+        (KJS::Machine::cti_timeout_check):
+        (KJS::Machine::cti_vm_throw):
+
+2008-09-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Third round of style cleanup.
+
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * VM/CodeBlock.h:
+        * VM/Machine.cpp:
+        * VM/Machine.h:
+        * kjs/ExecState.h:
+
+2008-09-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Jon Honeycutt.
+
+        Second round of style cleanup.
+
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * wrec/WREC.h:
+
+2008-09-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        First round of style cleanup.
+
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * masm/IA32MacroAsm.h:
+        * wrec/WREC.cpp:
+        * wrec/WREC.h:
+
+2008-09-04  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        Merged http://trac.webkit.org/changeset/36081 to work with CTI.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::tryCtiCacheGetByID):
+
+2008-09-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Enable profiling in CTI.
+
+        * VM/CTI.h:
+        (KJS::):
+        (KJS::CTI::execute):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_call_JSFunction):
+        (KJS::Machine::cti_op_call_NotJSFunction):
+        (KJS::Machine::cti_op_ret):
+        (KJS::Machine::cti_op_construct_JSConstruct):
+        (KJS::Machine::cti_op_construct_NotJSConstruct):
+
+2008-09-04  Victor Hernandez  <vhernandez@apple.com>
+
+        Reviewed by Geoffrey Garen.
+        
+        Fixed an #if to support using WREC without CTI.
+
+        * kjs/regexp.cpp:
+        (KJS::RegExp::match):
+
+2008-09-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        The array/string length trampolines are owned by the Machine, not the codeblock that compiled them.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateArrayLengthTrampoline):
+        (KJS::CTI::privateStringLengthTrampoline):
+        * VM/Machine.cpp:
+        (KJS::Machine::~Machine):
+        * VM/Machine.h:
+
+2008-09-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough and Sam Weinig.
+
+        Fix a crash on launch of jsc when GuardMalloc is enabled.
+
+        * kjs/ScopeChain.h:
+        (KJS::ScopeChain::ScopeChain): Initialize m_node to 0 when we have no valid scope chain.
+        (KJS::ScopeChain::~ScopeChain): Null-check m_node before calling deref.
+
+2008-09-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Fix inspector and fast array access so that it bounds
+        checks correctly.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass2_Main):
+        * masm/IA32MacroAsm.h:
+        (KJS::IA32MacroAssembler::):
+        (KJS::IA32MacroAssembler::emitUnlinkedJb):
+        (KJS::IA32MacroAssembler::emitUnlinkedJbe):
+
+2008-09-03  Mark Rowe  <mrowe@apple.com>
+
+        Move the assertion after the InitializeAndReturn block, as
+        that is used even when CTI is enabled.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-09-03  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Replace calls to exit with ASSERT_WITH_MESSAGE or ASSERT_NOT_REACHED.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile_pass4_SlowCases):
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        (KJS::Machine::cti_vm_throw):
+
+2008-09-03  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Tweak JavaScriptCore to compile on non-x86 platforms.  This is achieved
+        by wrapping more code with ENABLE(CTI), ENABLE(WREC), and PLATFORM(X86)
+        #if's.
+
+        * VM/CTI.cpp:
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::printStructureIDs): Use %td as the format specifier for
+        printing a ptrdiff_t.
+        * VM/Machine.cpp:
+        * VM/Machine.h:
+        * kjs/regexp.cpp:
+        (KJS::RegExp::RegExp):
+        (KJS::RegExp::~RegExp):
+        (KJS::RegExp::match):
+        * kjs/regexp.h:
+        * masm/IA32MacroAsm.h:
+        * wrec/WREC.cpp:
+        * wrec/WREC.h:
+        * wtf/Platform.h: Only enable CTI and WREC on x86.  Add an extra define to
+        track whether any MASM-using features are enabled.
+
+2008-09-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Copy Geoff's array/string length optimization for CTI.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateArrayLengthTrampoline):
+        (KJS::CTI::privateStringLengthTrampoline):
+        * VM/CTI.h:
+        (KJS::CTI::compileArrayLengthTrampoline):
+        (KJS::CTI::compileStringLengthTrampoline):
+        * VM/Machine.cpp:
+        (KJS::Machine::Machine):
+        (KJS::Machine::getCtiArrayLengthTrampoline):
+        (KJS::Machine::getCtiStringLengthTrampoline):
+        (KJS::Machine::tryCtiCacheGetByID):
+        (KJS::Machine::cti_op_get_by_id_second):
+        * VM/Machine.h:
+        * kjs/JSString.h:
+        * kjs/ustring.h:
+
+2008-09-03  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Implement fast array accesses in CTI - 2-3% progression on sunspider.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::emitFastArithIntToImmNoCheck):
+        (KJS::CTI::compileOpCall):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile_pass4_SlowCases):
+        * VM/CTI.h:
+        * kjs/JSArray.h:
+
+2008-09-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Enable fast property access support in CTI.
+
+        * VM/CTI.cpp:
+        (KJS::ctiSetReturnAddress):
+        (KJS::ctiRepatchCallByReturnAddress):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile):
+        (KJS::CTI::privateCompileGetByIdSelf):
+        (KJS::CTI::privateCompileGetByIdProto):
+        (KJS::CTI::privateCompileGetByIdChain):
+        (KJS::CTI::privateCompilePutByIdReplace):
+        * VM/CTI.h:
+        (KJS::CTI::compileGetByIdSelf):
+        (KJS::CTI::compileGetByIdProto):
+        (KJS::CTI::compileGetByIdChain):
+        (KJS::CTI::compilePutByIdReplace):
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::~CodeBlock):
+        * VM/CodeBlock.h:
+        * VM/Machine.cpp:
+        (KJS::doSetReturnAddressVmThrowTrampoline):
+        (KJS::Machine::tryCtiCachePutByID):
+        (KJS::Machine::tryCtiCacheGetByID):
+        (KJS::Machine::cti_op_put_by_id):
+        (KJS::Machine::cti_op_put_by_id_second):
+        (KJS::Machine::cti_op_put_by_id_generic):
+        (KJS::Machine::cti_op_put_by_id_fail):
+        (KJS::Machine::cti_op_get_by_id):
+        (KJS::Machine::cti_op_get_by_id_second):
+        (KJS::Machine::cti_op_get_by_id_generic):
+        (KJS::Machine::cti_op_get_by_id_fail):
+        (KJS::Machine::cti_op_throw):
+        (KJS::Machine::cti_vm_throw):
+        * VM/Machine.h:
+        * kjs/JSCell.h:
+        * kjs/JSObject.h:
+        * kjs/PropertyMap.h:
+        * kjs/StructureID.cpp:
+        (KJS::StructureIDChain::StructureIDChain):
+        * masm/IA32MacroAsm.h:
+        (KJS::IA32MacroAssembler::emitCmpl_i32m):
+        (KJS::IA32MacroAssembler::emitMovl_mr):
+        (KJS::IA32MacroAssembler::emitMovl_rm):
+
+2008-09-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Mark Rowe.
+
+        A backslash (\) at the of a RegEx should produce an error.
+        Fixes fast/regex/test1.html.
+
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::parseEscape):
+
+2008-09-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        Link jumps for the slow case of op_loop_if_less.  Fixes acid3.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass4_SlowCases):
+
+2008-09-01  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Switch WREC on by default.
+
+        * wtf/Platform.h:
+
+2008-09-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix two failures in fast/regex/test1.html
+          - \- in a character class should be treated as a literal -
+          - A missing max quantifier needs to be treated differently than
+            a null max quantifier.
+
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::generateNonGreedyQuantifier):
+        (KJS::WRECompiler::generateGreedyQuantifier):
+        (KJS::WRECompiler::parseCharacterClass):
+        * wrec/WREC.h:
+        (KJS::Quantifier::Quantifier):
+
+2008-09-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix crash in fast/js/kde/evil-n.html
+
+        * kjs/regexp.cpp: Always pass a non-null offset vector to the wrec function.
+
+2008-09-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Mark Rowe.
+
+        Add pattern length limit fixing one test in fast/js.
+
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::compile):
+        * wrec/WREC.h:
+        (KJS::WRECompiler::):
+
+2008-09-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Mark Rowe.
+
+        Make octal escape parsing/back-reference parsing more closely match 
+        prior behavior fixing one test in fast/js.
+
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::parseCharacterClass): 8 and 9 should be IdentityEscaped
+        (KJS::WRECompiler::parseEscape):
+        * wrec/WREC.h:
+        (KJS::WRECompiler::peekDigit):
+
+2008-09-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Mark Rowe.
+
+        Fix one mozilla test.
+
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::generateCharacterClassInverted): Fix incorrect not
+        ascii upper check.
+
+2008-09-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Mark Rowe.
+
+        Parse octal escapes in character classes fixing one mozilla test.
+
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::parseCharacterClass):
+        (KJS::WRECompiler::parseOctalEscape):
+        * wrec/WREC.h:
+        (KJS::WRECompiler::consumeOctal):
+
+2008-09-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fixes two mozilla tests with WREC enabled.
+
+        * wrec/WREC.cpp:
+        (KJS::CharacterClassConstructor::append): Keep the character class sorted
+        when appending another character class.
+
+2008-09-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Mark Rowe.
+
+        Fixes two mozilla tests with WREC enabled.
+
+        * wrec/WREC.cpp:
+        (KJS::CharacterClassConstructor::addSortedRange): Insert the range at the correct position
+        instead of appending it to the end.
+
+2008-09-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Move cross-compilation unit call into NEVER_INLINE function.
+
+        * VM/Machine.cpp:
+        (KJS::doSetReturnAddressVmThrowTrampoline):
+
+2008-09-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Fix one test in fast/js.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_construct_NotJSConstruct): Throw a createNotAConstructorError,
+        instead of a createNotAFunctionError.
+
+2008-08-31  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Zero-cost exception handling.  This patch takes the exception checking
+        back of the hot path.  When an exception occurs in a Machine::cti*
+        method, the return address to JIT code is recorded, and is then
+        overwritten with a pointer to a trampoline routine.  When the method
+        returns the trampoline will cause the cti_vm_throw method to be invoked.
+
+        cti_vm_throw uses the return address preserved above, to discover the
+        vPC of the bytecode that raised the exception (using a map build during
+        translation).  From the VPC of the faulting bytecode the vPC of a catch
+        routine may be discovered (unwinding the stack where necesary), and then
+        a bytecode address for the catch routine is looked up.  Final cti_vm_throw
+        overwrites its return address to JIT code again, to trampoline directly
+        to the catch routine.
+        
+        cti_op_throw is handled in a similar fashion.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::emitPutCTIParam):
+        (KJS::CTI::emitPutToCallFrameHeader):
+        (KJS::CTI::emitGetFromCallFrameHeader):
+        (KJS::ctiSetReturnAddressForArgs):
+        (KJS::CTI::emitDebugExceptionCheck):
+        (KJS::CTI::printOpcodeOperandTypes):
+        (KJS::CTI::emitCall):
+        (KJS::CTI::compileOpCall):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile):
+        * VM/CTI.h:
+        (KJS::CallRecord::CallRecord):
+        (KJS::):
+        (KJS::CTI::execute):
+        * VM/CodeBlock.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        (KJS::Machine::cti_op_instanceof):
+        (KJS::Machine::cti_op_call_NotJSFunction):
+        (KJS::Machine::cti_op_resolve):
+        (KJS::Machine::cti_op_resolve_func):
+        (KJS::Machine::cti_op_resolve_skip):
+        (KJS::Machine::cti_op_resolve_with_base):
+        (KJS::Machine::cti_op_throw):
+        (KJS::Machine::cti_op_in):
+        (KJS::Machine::cti_vm_throw):
+        * VM/RegisterFile.h:
+        (KJS::RegisterFile::):
+        * kjs/ExecState.h:
+        (KJS::ExecState::setCtiReturnAddress):
+        (KJS::ExecState::ctiReturnAddress):
+        * masm/IA32MacroAsm.h:
+        (KJS::IA32MacroAssembler::):
+        (KJS::IA32MacroAssembler::emitPushl_m):
+        (KJS::IA32MacroAssembler::emitPopl_m):
+        (KJS::IA32MacroAssembler::getRelocatedAddress):
+
+2008-08-31  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fall back to PCRE for any regexp containing parentheses until we correctly backtrack within them.
+
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::parseParentheses):
+        * wrec/WREC.h:
+        (KJS::WRECompiler::):
+
+2008-08-31  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix several issues within ecma_3/RegExp/perlstress-001.js with WREC enabled.
+
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::generateNonGreedyQuantifier): Compare with the maximum quantifier count rather than the minimum.
+        (KJS::WRECompiler::generateAssertionEOL): Do a register-to-register comparison rather than immediate-to-register.
+        (KJS::WRECompiler::parseCharacterClass): Pass through the correct inversion flag.
+
+2008-08-30  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Re-fix the six remaining failures in the Mozilla JavaScript tests in a manner that does not kill performance.
+        This shows up as a 0.6% progression on SunSpider on my machine.
+
+        Grow the JITCodeBuffer's underlying buffer when we run out of space rather than just bailing out.
+
+        * VM/CodeBlock.h:
+        (KJS::CodeBlock::~CodeBlock): Switch to using fastFree now that JITCodeBuffer::copy uses fastMalloc.
+        * kjs/regexp.cpp: Ditto.
+        * masm/IA32MacroAsm.h:
+        (KJS::JITCodeBuffer::growBuffer):
+        (KJS::JITCodeBuffer::JITCodeBuffer):
+        (KJS::JITCodeBuffer::~JITCodeBuffer):
+        (KJS::JITCodeBuffer::putByte):
+        (KJS::JITCodeBuffer::putShort):
+        (KJS::JITCodeBuffer::putInt):
+        (KJS::JITCodeBuffer::reset):
+        (KJS::JITCodeBuffer::copy):
+
+2008-08-29  Oliver Hunt  <oliver@apple.com>
+
+        RS=Maciej
+
+        Roll out previous patch as it causes a 5% performance regression
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CTI.cpp:
+        (KJS::getJCB):
+        (KJS::CTI::privateCompile):
+        * VM/CodeBlock.h:
+        (KJS::CodeBlock::~CodeBlock):
+        * masm/IA32MacroAsm.h:
+        (KJS::JITCodeBuffer::JITCodeBuffer):
+        (KJS::JITCodeBuffer::putByte):
+        (KJS::JITCodeBuffer::putShort):
+        (KJS::JITCodeBuffer::putInt):
+        (KJS::JITCodeBuffer::getEIP):
+        (KJS::JITCodeBuffer::start):
+        (KJS::JITCodeBuffer::getOffset):
+        (KJS::JITCodeBuffer::reset):
+        (KJS::JITCodeBuffer::copy):
+        (KJS::IA32MacroAssembler::emitModRm_rr):
+        (KJS::IA32MacroAssembler::emitModRm_rm):
+        (KJS::IA32MacroAssembler::emitModRm_rmsib):
+        (KJS::IA32MacroAssembler::IA32MacroAssembler):
+        (KJS::IA32MacroAssembler::emitInt3):
+        (KJS::IA32MacroAssembler::emitPushl_r):
+        (KJS::IA32MacroAssembler::emitPopl_r):
+        (KJS::IA32MacroAssembler::emitMovl_rr):
+        (KJS::IA32MacroAssembler::emitAddl_rr):
+        (KJS::IA32MacroAssembler::emitAddl_i8r):
+        (KJS::IA32MacroAssembler::emitAddl_i32r):
+        (KJS::IA32MacroAssembler::emitAddl_mr):
+        (KJS::IA32MacroAssembler::emitAndl_rr):
+        (KJS::IA32MacroAssembler::emitAndl_i32r):
+        (KJS::IA32MacroAssembler::emitCmpl_i8r):
+        (KJS::IA32MacroAssembler::emitCmpl_rr):
+        (KJS::IA32MacroAssembler::emitCmpl_rm):
+        (KJS::IA32MacroAssembler::emitCmpl_i32r):
+        (KJS::IA32MacroAssembler::emitCmpl_i32m):
+        (KJS::IA32MacroAssembler::emitCmpw_rm):
+        (KJS::IA32MacroAssembler::emitOrl_rr):
+        (KJS::IA32MacroAssembler::emitOrl_i8r):
+        (KJS::IA32MacroAssembler::emitSubl_rr):
+        (KJS::IA32MacroAssembler::emitSubl_i8r):
+        (KJS::IA32MacroAssembler::emitSubl_i32r):
+        (KJS::IA32MacroAssembler::emitSubl_mr):
+        (KJS::IA32MacroAssembler::emitTestl_i32r):
+        (KJS::IA32MacroAssembler::emitTestl_rr):
+        (KJS::IA32MacroAssembler::emitXorl_i8r):
+        (KJS::IA32MacroAssembler::emitXorl_rr):
+        (KJS::IA32MacroAssembler::emitSarl_i8r):
+        (KJS::IA32MacroAssembler::emitSarl_CLr):
+        (KJS::IA32MacroAssembler::emitShl_i8r):
+        (KJS::IA32MacroAssembler::emitShll_CLr):
+        (KJS::IA32MacroAssembler::emitMull_rr):
+        (KJS::IA32MacroAssembler::emitIdivl_r):
+        (KJS::IA32MacroAssembler::emitCdq):
+        (KJS::IA32MacroAssembler::emitMovl_mr):
+        (KJS::IA32MacroAssembler::emitMovzwl_mr):
+        (KJS::IA32MacroAssembler::emitMovl_rm):
+        (KJS::IA32MacroAssembler::emitMovl_i32r):
+        (KJS::IA32MacroAssembler::emitMovl_i32m):
+        (KJS::IA32MacroAssembler::emitLeal_mr):
+        (KJS::IA32MacroAssembler::emitRet):
+        (KJS::IA32MacroAssembler::emitJmpN_r):
+        (KJS::IA32MacroAssembler::emitJmpN_m):
+        (KJS::IA32MacroAssembler::emitCall):
+        (KJS::IA32MacroAssembler::label):
+        (KJS::IA32MacroAssembler::emitUnlinkedJmp):
+        (KJS::IA32MacroAssembler::emitUnlinkedJne):
+        (KJS::IA32MacroAssembler::emitUnlinkedJe):
+        (KJS::IA32MacroAssembler::emitUnlinkedJl):
+        (KJS::IA32MacroAssembler::emitUnlinkedJle):
+        (KJS::IA32MacroAssembler::emitUnlinkedJge):
+        (KJS::IA32MacroAssembler::emitUnlinkedJae):
+        (KJS::IA32MacroAssembler::emitUnlinkedJo):
+        (KJS::IA32MacroAssembler::link):
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::compilePattern):
+        (KJS::WRECompiler::compile):
+        * wrec/WREC.h:
+
+2008-08-29  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Have JITCodeBuffer manage a Vector containing the generated code so that it can grow
+        as needed when generating code for a large function.  This fixes all six remaining failures
+        in Mozilla tests in both debug and release builds.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile):
+        * VM/CodeBlock.h:
+        (KJS::CodeBlock::~CodeBlock):
+        * masm/IA32MacroAsm.h:
+        (KJS::JITCodeBuffer::putByte):
+        (KJS::JITCodeBuffer::putShort):
+        (KJS::JITCodeBuffer::putInt):
+        (KJS::JITCodeBuffer::getEIP):
+        (KJS::JITCodeBuffer::start):
+        (KJS::JITCodeBuffer::getOffset):
+        (KJS::JITCodeBuffer::getCode):
+        (KJS::IA32MacroAssembler::emitModRm_rr):
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::compilePattern):
+        * wrec/WREC.h:
+
+2008-08-29  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Implement parsing of octal escapes in regular expressions.  This fixes three Mozilla tests.
+
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::parseOctalEscape):
+        (KJS::WRECompiler::parseEscape): Parse the escape sequence as an octal escape if it has a leading zero.
+        Add a FIXME about treating invalid backreferences as octal escapes in the future.
+        * wrec/WREC.h:
+        (KJS::WRECompiler::consumeNumber): Multiply by 10 rather than 0 so that we handle numbers with more than
+        one digit.
+        * wtf/ASCIICType.h:
+        (WTF::isASCIIOctalDigit):
+
+2008-08-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Pass vPC to instanceof method.  Fixes 2 mozilla tests in debug.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_instanceof):
+
+2008-08-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Pass vPCs to resolve methods for correct exception creation.  Fixes
+        17 mozilla tests in debug.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_resolve):
+        (KJS::Machine::cti_op_resolve_func):
+        (KJS::Machine::cti_op_resolve_skip):
+        (KJS::Machine::cti_op_resolve_with_base):
+
+2008-08-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Remembering to actually throw the exception passed to op throw helps.
+        Regressions 19 -> 6.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_throw):
+        (KJS::Machine::cti_vm_throw):
+
+2008-08-29  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Support for exception unwinding the stack.
+        
+        Once upon a time, Sam asked me for a bettr ChangeLog entry.  The return address
+        is now preserved on entry to a JIT code function (if we preserve lazily we need
+        restore the native return address during exception stack unwind).  This takes
+        the number of regressions down from ~150 to 19.
+
+        * VM/CTI.cpp:
+        (KJS::getJCB):
+        (KJS::CTI::emitExceptionCheck):
+        (KJS::CTI::compileOpCall):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile):
+        * VM/CTI.h:
+        (KJS::):
+        * VM/Machine.cpp:
+        (KJS::Machine::throwException):
+        (KJS::Machine::cti_op_call_JSFunction):
+        (KJS::Machine::cti_op_call_NotJSFunction):
+        (KJS::Machine::cti_op_construct_JSConstruct):
+        (KJS::Machine::cti_op_construct_NotJSConstruct):
+        (KJS::Machine::cti_op_throw):
+        (KJS::Machine::cti_vm_throw):
+
+2008-08-29  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix js1_2/regexp/word_boundary.js and four other Mozilla tests with WREC enabled.
+
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::generateCharacterClassInvertedRange): If none of the exact matches
+        succeeded, jump to failure.
+        (KJS::WRECompiler::compilePattern): Restore and increment the current position stored
+        on the stack to ensure that it will be reset to the correct position after a failed
+        match has consumed input.
+
+2008-08-29  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix a hang in ecma_3/RegExp/15.10.2-1.js with WREC enabled.
+        A backreference with a quantifier would get stuck in an infinite
+        loop if the captured range was empty.
+
+        * wrec/WREC.cpp:
+        (KJS::WRECompiler::generateBackreferenceQuantifier): If the captured range
+        was empty, do not attempt to match the backreference.
+        (KJS::WRECompiler::parseBackreferenceQuantifier):
+        * wrec/WREC.h:
+        (KJS::Quantifier::):
+
+2008-08-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Implement op_debug.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::debug):
+        (KJS::Machine::privateExecute):
+        (KJS::Machine::cti_op_debug):
+        * VM/Machine.h:
+
+2008-08-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Implement op_switch_string fixing 1 mozilla test and one test in fast/js.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile):
+        * VM/CTI.h:
+        (KJS::SwitchRecord::):
+        (KJS::SwitchRecord::SwitchRecord):
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeBlock.h:
+        (KJS::ExpressionRangeInfo::):
+        (KJS::StringJumpTable::offsetForValue):
+        (KJS::StringJumpTable::ctiForValue):
+        (KJS::SimpleJumpTable::add):
+        (KJS::SimpleJumpTable::ctiForValue):
+        * VM/CodeGenerator.cpp:
+        (KJS::prepareJumpTableForStringSwitch):
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        (KJS::Machine::cti_op_switch_string):
+        * VM/Machine.h:
+
+2008-08-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Do not recurse on the machine stack when executing op_call.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::emitGetPutArg):
+        (KJS::CTI::emitPutArg):
+        (KJS::CTI::emitPutArgConstant):
+        (KJS::CTI::compileOpCall):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile):
+        * VM/CTI.h:
+        (KJS::):
+        (KJS::CTI::compile):
+        (KJS::CTI::execute):
+        (KJS::CTI::):
+        * VM/Machine.cpp:
+        (KJS::Machine::Machine):
+        (KJS::Machine::execute):
+        (KJS::Machine::cti_op_call_JSFunction):
+        (KJS::Machine::cti_op_call_NotJSFunction):
+        (KJS::Machine::cti_op_ret):
+        (KJS::Machine::cti_op_construct_JSConstruct):
+        (KJS::Machine::cti_op_construct_NotJSConstruct):
+        (KJS::Machine::cti_op_call_eval):
+        * VM/Machine.h:
+        * VM/Register.h:
+        (KJS::Register::Register):
+        * VM/RegisterFile.h:
+        (KJS::RegisterFile::):
+        * kjs/InternalFunction.h:
+        (KJS::InternalFunction::InternalFunction):
+        * kjs/JSFunction.h:
+        (KJS::JSFunction::JSFunction):
+        * kjs/ScopeChain.h:
+        (KJS::ScopeChain::ScopeChain):
+        * masm/IA32MacroAsm.h:
+        (KJS::IA32MacroAssembler::):
+        (KJS::IA32MacroAssembler::emitModRm_opm):
+        (KJS::IA32MacroAssembler::emitCmpl_i32m):
+        (KJS::IA32MacroAssembler::emitCallN_r):
+
+2008-08-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Exit instead of crashing in ctiUnsupported and ctiTimedOut.
+
+        * VM/Machine.cpp:
+        (KJS::ctiUnsupported):
+        (KJS::ctiTimedOut):
+
+2008-08-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Implement codegen for op_jsr and op_sret.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile):
+        * VM/CTI.h:
+        (KJS::CTI::JSRInfo::JSRInfo):
+        * masm/IA32MacroAsm.h:
+        (KJS::IA32MacroAssembler::emitJmpN_m):
+        (KJS::IA32MacroAssembler::linkAbsoluteAddress):
+
+2008-08-28  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Initial support for exceptions (throw / catch must occur in same CodeBlock).
+
+        * VM/CTI.cpp:
+        (KJS::CTI::emitExceptionCheck):
+        (KJS::CTI::emitCall):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile_pass4_SlowCases):
+        (KJS::CTI::privateCompile):
+        * VM/CTI.h:
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::nativeExceptionCodeForHandlerVPC):
+        * VM/CodeBlock.h:
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitCatch):
+        * VM/Machine.cpp:
+        (KJS::Machine::throwException):
+        (KJS::Machine::privateExecute):
+        (KJS::ctiUnsupported):
+        (KJS::ctiTimedOut):
+        (KJS::Machine::cti_op_add):
+        (KJS::Machine::cti_op_pre_inc):
+        (KJS::Machine::cti_timeout_check):
+        (KJS::Machine::cti_op_loop_if_less):
+        (KJS::Machine::cti_op_put_by_id):
+        (KJS::Machine::cti_op_get_by_id):
+        (KJS::Machine::cti_op_instanceof):
+        (KJS::Machine::cti_op_del_by_id):
+        (KJS::Machine::cti_op_mul):
+        (KJS::Machine::cti_op_call):
+        (KJS::Machine::cti_op_resolve):
+        (KJS::Machine::cti_op_construct):
+        (KJS::Machine::cti_op_get_by_val):
+        (KJS::Machine::cti_op_resolve_func):
+        (KJS::Machine::cti_op_sub):
+        (KJS::Machine::cti_op_put_by_val):
+        (KJS::Machine::cti_op_lesseq):
+        (KJS::Machine::cti_op_loop_if_true):
+        (KJS::Machine::cti_op_negate):
+        (KJS::Machine::cti_op_resolve_skip):
+        (KJS::Machine::cti_op_div):
+        (KJS::Machine::cti_op_pre_dec):
+        (KJS::Machine::cti_op_jless):
+        (KJS::Machine::cti_op_not):
+        (KJS::Machine::cti_op_jtrue):
+        (KJS::Machine::cti_op_post_inc):
+        (KJS::Machine::cti_op_eq):
+        (KJS::Machine::cti_op_lshift):
+        (KJS::Machine::cti_op_bitand):
+        (KJS::Machine::cti_op_rshift):
+        (KJS::Machine::cti_op_bitnot):
+        (KJS::Machine::cti_op_resolve_with_base):
+        (KJS::Machine::cti_op_mod):
+        (KJS::Machine::cti_op_less):
+        (KJS::Machine::cti_op_neq):
+        (KJS::Machine::cti_op_post_dec):
+        (KJS::Machine::cti_op_urshift):
+        (KJS::Machine::cti_op_bitxor):
+        (KJS::Machine::cti_op_bitor):
+        (KJS::Machine::cti_op_call_eval):
+        (KJS::Machine::cti_op_throw):
+        (KJS::Machine::cti_op_push_scope):
+        (KJS::Machine::cti_op_stricteq):
+        (KJS::Machine::cti_op_nstricteq):
+        (KJS::Machine::cti_op_to_jsnumber):
+        (KJS::Machine::cti_op_in):
+        (KJS::Machine::cti_op_del_by_val):
+        (KJS::Machine::cti_vm_throw):
+        * VM/Machine.h:
+        * kjs/ExecState.h:
+        * masm/IA32MacroAsm.h:
+        (KJS::IA32MacroAssembler::emitCmpl_i32m):
+
+2008-08-28  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Print debugging info to stderr so that run-webkit-tests can capture it.
+        This makes it easy to check whether test failures are due to unimplemented
+        op codes, missing support for exceptions, etc.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::printOpcodeOperandTypes):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile_pass4_SlowCases):
+        (KJS::CTI::privateCompile):
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        (KJS::ctiException):
+        (KJS::ctiUnsupported):
+        (KJS::Machine::cti_op_call):
+        (KJS::Machine::cti_op_resolve):
+        (KJS::Machine::cti_op_construct):
+        (KJS::Machine::cti_op_get_by_val):
+        (KJS::Machine::cti_op_resolve_func):
+        (KJS::Machine::cti_op_resolve_skip):
+        (KJS::Machine::cti_op_resolve_with_base):
+        (KJS::Machine::cti_op_call_eval):
+
+2008-08-27  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough and Maciej Stachowiak.
+
+        Fix fast/js/bitwise-and-on-undefined.html.
+
+        A temporary value in the slow path of op_bitand was being stored in edx, but was
+        being clobbered by emitGetPutArg before we used it.  To fix this, emitGetPutArg
+        now takes a third argument that specifies the scratch register to use when loading
+        from memory.  This allows us to avoid clobbering the temporary in op_bitand.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::emitGetPutArg):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile_pass4_SlowCases):
+        * VM/CTI.h:
+
+2008-08-27  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Switch CTI on by default.
+
+        * wtf/Platform.h:
+
+2008-08-27  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix the build of the full WebKit stack.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Mark two new headers as private so they can be pulled in from WebCore.
+        * VM/CTI.h: Fix build issues that show up when compiled with GCC 4.2 as part of WebCore.
+        * wrec/WREC.h: Ditto.
+
+2008-08-27  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Implement op_new_error.  Does not fix any tests as it is always followed by the unimplemented op_throw.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_new_error):
+        * VM/Machine.h:
+
+2008-08-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Implement op_put_getter and op_put_setter.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_put_getter):
+        (KJS::Machine::cti_op_put_setter):
+        * VM/Machine.h:
+
+2008-08-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Implement op_del_by_val fixing 3 mozilla tests.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_del_by_val):
+        * VM/Machine.h:
+
+2008-08-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Quick & dirty fix to get SamplingTool sampling op_call.
+
+        * VM/SamplingTool.h:
+        (KJS::SamplingTool::callingHostFunction):
+
+2008-08-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Fix op_put_by_index.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass2_Main): Use emitPutArgConstant instead of emitGetPutArg
+        for the property value.
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_put_by_index): Get the property value from the correct argument.
+
+2008-08-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Implement op_switch_imm in the CTI fixing 13 mozilla tests.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_switch_imm):
+        * VM/Machine.h:
+
+2008-08-27  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Implement op_switch_char in CTI.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::emitCall):
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile):
+        * VM/CTI.h:
+        (KJS::CallRecord::CallRecord):
+        (KJS::SwitchRecord::SwitchRecord):
+        * VM/CodeBlock.h:
+        (KJS::SimpleJumpTable::SimpleJumpTable::ctiForValue):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_switch_char):
+        * VM/Machine.h:
+        * masm/IA32MacroAsm.h:
+        (KJS::IA32MacroAssembler::):
+        (KJS::IA32MacroAssembler::emitJmpN_r):
+        (KJS::IA32MacroAssembler::getRelocatedAddress):
+        * wtf/Platform.h:
+
+2008-08-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Implement op_put_by_index to fix 1 mozilla test.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_put_by_index):
+        * VM/Machine.h:
+
+2008-08-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        More fixes from Geoff's review.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::emitGetArg):
+        (KJS::CTI::emitGetPutArg):
+        (KJS::CTI::emitPutArg):
+        (KJS::CTI::emitPutArgConstant):
+        (KJS::CTI::getConstantImmediateNumericArg):
+        (KJS::CTI::emitGetCTIParam):
+        (KJS::CTI::emitPutResult):
+        (KJS::CTI::emitCall):
+        (KJS::CTI::emitJumpSlowCaseIfNotImm):
+        (KJS::CTI::emitJumpSlowCaseIfNotImms):
+        (KJS::CTI::getDeTaggedConstantImmediate):
+        (KJS::CTI::emitFastArithDeTagImmediate):
+        (KJS::CTI::emitFastArithReTagImmediate):
+        (KJS::CTI::emitFastArithPotentiallyReTagImmediate):
+        (KJS::CTI::emitFastArithImmToInt):
+        (KJS::CTI::emitFastArithIntToImmOrSlowCase):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile_pass4_SlowCases):
+        (KJS::CTI::privateCompile):
+        * VM/CTI.h:
+
+2008-08-26  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Implement op_jmp_scopes to fix 2 Mozilla tests.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_push_new_scope): Update ExecState::m_scopeChain after calling ARG_setScopeChain.
+        (KJS::Machine::cti_op_jmp_scopes):
+        * VM/Machine.h:
+
+2008-08-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        WebKit Regular Expression Compiler. (set ENABLE_WREC = 1 in Platform.h).
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/regexp.cpp:
+        * kjs/regexp.h:
+        * wrec: Added.
+        * wrec/WREC.cpp: Added.
+        * wrec/WREC.h: Added.
+        * wtf/Platform.h:
+
+2008-08-26  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Remove bogus assertion.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_del_by_id):
+
+2008-08-26  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Implement op_push_new_scope and stub out op_catch.  This fixes 11 Mozilla tests.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_push_new_scope):
+        (KJS::Machine::cti_op_catch):
+        * VM/Machine.h:
+
+2008-08-26  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Clean up op_resolve_base so that it shares its implementation with the bytecode interpreter.
+
+        * VM/Machine.cpp:
+        (KJS::inlineResolveBase):
+        (KJS::resolveBase):
+
+2008-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add codegen support for op_instanceof, fixing 15 mozilla tests.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_instanceof):
+        (KJS::Machine::cti_op_del_by_id):
+        * VM/Machine.h:
+        * wtf/Platform.h:
+
+2008-08-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fixes for initial review comments.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::ctiCompileGetArg):
+        (KJS::CTI::ctiCompileGetPutArg):
+        (KJS::CTI::ctiCompilePutResult):
+        (KJS::CTI::ctiCompileCall):
+        (KJS::CTI::CTI):
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::printOpcodeOperandTypes):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile_pass4_SlowCases):
+        (KJS::CTI::privateCompile):
+        * VM/CTI.h:
+        * VM/Register.h:
+        * kjs/JSValue.h:
+
+2008-08-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Fix up exception checking code.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_call):
+        (KJS::Machine::cti_op_resolve):
+        (KJS::Machine::cti_op_construct):
+        (KJS::Machine::cti_op_resolve_func):
+        (KJS::Machine::cti_op_resolve_skip):
+        (KJS::Machine::cti_op_resolve_with_base):
+        (KJS::Machine::cti_op_call_eval):
+
+2008-08-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix slowcase for op_post_inc and op_post_dec fixing 2 mozilla tests.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass4_SlowCases):
+
+2008-08-26  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Implement op_in, fixing 8 mozilla tests.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_in):
+        * VM/Machine.h:
+
+2008-08-26  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Don't hardcode the size of a Register for op_new_array.  Fixes a crash
+        seen during the Mozilla tests.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass2_Main):
+
+2008-08-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Add support for op_push_scope and op_pop_scope, fixing 20 mozilla tests.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/CTI.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_push_scope):
+        (KJS::Machine::cti_op_pop_scope):
+        * VM/Machine.h:
+
+2008-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add codegen support for op_del_by_id, fixing 49 mozilla tests.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+        * VM/Machine.cpp:
+        (KJS::Machine::cti_op_del_by_id):
+        * VM/Machine.h:
+
+2008-08-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Gavin Barraclough and Geoff Garen.
+
+        Don't hardcode the size of a Register for op_get_scoped_var and op_put_scoped_var 
+        fixing 513 mozilla tests in debug build.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass2_Main):
+
+2008-08-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+        
+        Added code generator support for op_loop, fixing around 60 mozilla tests.
+
+        * VM/CTI.cpp:
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::privateCompile_pass2_Main):
+
+2008-08-26  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Set -fomit-frame-pointer in the correct location.
+
+        * Configurations/JavaScriptCore.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-08-26  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+        
+        Inital cut of CTI, Geoff's review fixes to follow.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/CTI.cpp: Added.
+        (KJS::getJCB):
+        (KJS::CTI::ctiCompileGetArg):
+        (KJS::CTI::ctiCompileGetPutArg):
+        (KJS::CTI::ctiCompilePutArg):
+        (KJS::CTI::ctiCompilePutArgImm):
+        (KJS::CTI::ctiImmediateNumericArg):
+        (KJS::CTI::ctiCompileGetCTIParam):
+        (KJS::CTI::ctiCompilePutResult):
+        (KJS::CTI::ctiCompileCall):
+        (KJS::CTI::slowCaseIfNotImm):
+        (KJS::CTI::slowCaseIfNotImms):
+        (KJS::CTI::ctiFastArithDeTagConstImmediate):
+        (KJS::CTI::ctiFastArithDeTagImmediate):
+        (KJS::CTI::ctiFastArithReTagImmediate):
+        (KJS::CTI::ctiFastArithPotentiallyReTagImmediate):
+        (KJS::CTI::ctiFastArithImmToInt):
+        (KJS::CTI::ctiFastArithIntToImmOrSlowCase):
+        (KJS::CTI::CTI):
+        (KJS::CTI::privateCompile_pass1_Scan):
+        (KJS::CTI::ctiCompileAdd):
+        (KJS::CTI::ctiCompileAddImm):
+        (KJS::CTI::ctiCompileAddImmNotInt):
+        (KJS::CTI::TEMP_HACK_PRINT_TYPES):
+        (KJS::CTI::privateCompile_pass2_Main):
+        (KJS::CTI::privateCompile_pass3_Link):
+        (KJS::CTI::privateCompile_pass4_SlowCases):
+        (KJS::CTI::privateCompile):
+        * VM/CTI.h: Added.
+        (KJS::CTI2Result::CTI2Result):
+        (KJS::CallRecord::CallRecord):
+        (KJS::JmpTable::JmpTable):
+        (KJS::SlowCaseEntry::SlowCaseEntry):
+        (KJS::CTI::compile):
+        (KJS::CTI::LabelInfo::LabelInfo):
+        * VM/CodeBlock.h:
+        (KJS::CodeBlock::CodeBlock):
+        (KJS::CodeBlock::~CodeBlock):
+        * VM/Machine.cpp:
+        (KJS::Machine::execute):
+        (KJS::Machine::privateExecute):
+        (KJS::ctiException):
+        (KJS::ctiUnsupported):
+        (KJS::ctiTimedOut):
+        (KJS::Machine::cti_op_end):
+        (KJS::Machine::cti_op_add):
+        (KJS::Machine::cti_op_pre_inc):
+        (KJS::Machine::cti_timeout_check):
+        (KJS::Machine::cti_op_loop_if_less):
+        (KJS::Machine::cti_op_new_object):
+        (KJS::Machine::cti_op_put_by_id):
+        (KJS::Machine::cti_op_get_by_id):
+        (KJS::Machine::cti_op_mul):
+        (KJS::Machine::cti_op_new_func):
+        (KJS::Machine::cti_op_call):
+        (KJS::Machine::cti_op_ret):
+        (KJS::Machine::cti_op_new_array):
+        (KJS::Machine::cti_op_resolve):
+        (KJS::Machine::cti_op_construct):
+        (KJS::Machine::cti_op_get_by_val):
+        (KJS::Machine::cti_op_resolve_func):
+        (KJS::Machine::cti_op_sub):
+        (KJS::Machine::cti_op_put_by_val):
+        (KJS::Machine::cti_op_lesseq):
+        (KJS::Machine::cti_op_loop_if_true):
+        (KJS::Machine::cti_op_negate):
+        (KJS::Machine::cti_op_resolve_base):
+        (KJS::Machine::cti_op_resolve_skip):
+        (KJS::Machine::cti_op_div):
+        (KJS::Machine::cti_op_pre_dec):
+        (KJS::Machine::cti_op_jless):
+        (KJS::Machine::cti_op_not):
+        (KJS::Machine::cti_op_jtrue):
+        (KJS::Machine::cti_op_post_inc):
+        (KJS::Machine::cti_op_eq):
+        (KJS::Machine::cti_op_lshift):
+        (KJS::Machine::cti_op_bitand):
+        (KJS::Machine::cti_op_rshift):
+        (KJS::Machine::cti_op_bitnot):
+        (KJS::Machine::cti_op_resolve_with_base):
+        (KJS::Machine::cti_op_new_func_exp):
+        (KJS::Machine::cti_op_mod):
+        (KJS::Machine::cti_op_less):
+        (KJS::Machine::cti_op_neq):
+        (KJS::Machine::cti_op_post_dec):
+        (KJS::Machine::cti_op_urshift):
+        (KJS::Machine::cti_op_bitxor):
+        (KJS::Machine::cti_op_new_regexp):
+        (KJS::Machine::cti_op_bitor):
+        (KJS::Machine::cti_op_call_eval):
+        (KJS::Machine::cti_op_throw):
+        (KJS::Machine::cti_op_get_pnames):
+        (KJS::Machine::cti_op_next_pname):
+        (KJS::Machine::cti_op_typeof):
+        (KJS::Machine::cti_op_stricteq):
+        (KJS::Machine::cti_op_nstricteq):
+        (KJS::Machine::cti_op_to_jsnumber):
+        * VM/Machine.h:
+        * VM/Register.h:
+        (KJS::Register::jsValue):
+        (KJS::Register::getJSValue):
+        (KJS::Register::codeBlock):
+        (KJS::Register::scopeChain):
+        (KJS::Register::i):
+        (KJS::Register::r):
+        (KJS::Register::vPC):
+        (KJS::Register::jsPropertyNameIterator):
+        * VM/SamplingTool.cpp:
+        (KJS::):
+        (KJS::SamplingTool::run):
+        (KJS::SamplingTool::dump):
+        * VM/SamplingTool.h:
+        * kjs/JSImmediate.h:
+        (KJS::JSImmediate::zeroImmediate):
+        (KJS::JSImmediate::oneImmediate):
+        * kjs/JSValue.h:
+        * kjs/JSVariableObject.h:
+        (KJS::JSVariableObject::JSVariableObjectData::offsetOf_registers):
+        (KJS::JSVariableObject::offsetOf_d):
+        (KJS::JSVariableObject::offsetOf_Data_registers):
+        * masm: Added.
+        * masm/IA32MacroAsm.h: Added.
+        (KJS::JITCodeBuffer::JITCodeBuffer):
+        (KJS::JITCodeBuffer::putByte):
+        (KJS::JITCodeBuffer::putShort):
+        (KJS::JITCodeBuffer::putInt):
+        (KJS::JITCodeBuffer::getEIP):
+        (KJS::JITCodeBuffer::start):
+        (KJS::JITCodeBuffer::getOffset):
+        (KJS::JITCodeBuffer::reset):
+        (KJS::JITCodeBuffer::copy):
+        (KJS::IA32MacroAssembler::):
+        (KJS::IA32MacroAssembler::emitModRm_rr):
+        (KJS::IA32MacroAssembler::emitModRm_rm):
+        (KJS::IA32MacroAssembler::emitModRm_rmsib):
+        (KJS::IA32MacroAssembler::emitModRm_opr):
+        (KJS::IA32MacroAssembler::emitModRm_opm):
+        (KJS::IA32MacroAssembler::IA32MacroAssembler):
+        (KJS::IA32MacroAssembler::emitInt3):
+        (KJS::IA32MacroAssembler::emitPushl_r):
+        (KJS::IA32MacroAssembler::emitPopl_r):
+        (KJS::IA32MacroAssembler::emitMovl_rr):
+        (KJS::IA32MacroAssembler::emitAddl_rr):
+        (KJS::IA32MacroAssembler::emitAddl_i8r):
+        (KJS::IA32MacroAssembler::emitAddl_i32r):
+        (KJS::IA32MacroAssembler::emitAddl_mr):
+        (KJS::IA32MacroAssembler::emitAndl_rr):
+        (KJS::IA32MacroAssembler::emitAndl_i32r):
+        (KJS::IA32MacroAssembler::emitCmpl_i8r):
+        (KJS::IA32MacroAssembler::emitCmpl_rr):
+        (KJS::IA32MacroAssembler::emitCmpl_rm):
+        (KJS::IA32MacroAssembler::emitCmpl_i32r):
+        (KJS::IA32MacroAssembler::emitCmpw_rm):
+        (KJS::IA32MacroAssembler::emitOrl_rr):
+        (KJS::IA32MacroAssembler::emitOrl_i8r):
+        (KJS::IA32MacroAssembler::emitSubl_rr):
+        (KJS::IA32MacroAssembler::emitSubl_i8r):
+        (KJS::IA32MacroAssembler::emitSubl_i32r):
+        (KJS::IA32MacroAssembler::emitSubl_mr):
+        (KJS::IA32MacroAssembler::emitTestl_i32r):
+        (KJS::IA32MacroAssembler::emitTestl_rr):
+        (KJS::IA32MacroAssembler::emitXorl_i8r):
+        (KJS::IA32MacroAssembler::emitXorl_rr):
+        (KJS::IA32MacroAssembler::emitSarl_i8r):
+        (KJS::IA32MacroAssembler::emitSarl_CLr):
+        (KJS::IA32MacroAssembler::emitShl_i8r):
+        (KJS::IA32MacroAssembler::emitShll_CLr):
+        (KJS::IA32MacroAssembler::emitMull_rr):
+        (KJS::IA32MacroAssembler::emitIdivl_r):
+        (KJS::IA32MacroAssembler::emitCdq):
+        (KJS::IA32MacroAssembler::emitMovl_mr):
+        (KJS::IA32MacroAssembler::emitMovzwl_mr):
+        (KJS::IA32MacroAssembler::emitMovl_rm):
+        (KJS::IA32MacroAssembler::emitMovl_i32r):
+        (KJS::IA32MacroAssembler::emitMovl_i32m):
+        (KJS::IA32MacroAssembler::emitLeal_mr):
+        (KJS::IA32MacroAssembler::emitRet):
+        (KJS::IA32MacroAssembler::JmpSrc::JmpSrc):
+        (KJS::IA32MacroAssembler::JmpDst::JmpDst):
+        (KJS::IA32MacroAssembler::emitCall):
+        (KJS::IA32MacroAssembler::label):
+        (KJS::IA32MacroAssembler::emitUnlinkedJmp):
+        (KJS::IA32MacroAssembler::emitUnlinkedJne):
+        (KJS::IA32MacroAssembler::emitUnlinkedJe):
+        (KJS::IA32MacroAssembler::emitUnlinkedJl):
+        (KJS::IA32MacroAssembler::emitUnlinkedJle):
+        (KJS::IA32MacroAssembler::emitUnlinkedJge):
+        (KJS::IA32MacroAssembler::emitUnlinkedJae):
+        (KJS::IA32MacroAssembler::emitUnlinkedJo):
+        (KJS::IA32MacroAssembler::emitPredictionNotTaken):
+        (KJS::IA32MacroAssembler::link):
+        (KJS::IA32MacroAssembler::copy):
+        * wtf/Platform.h:
+
+2008-08-26  Oliver Hunt  <oliver@apple.com>
+
+        RS=Maciej.
+
+        Enabled -fomit-frame-pointer on Release and Production builds, add additional Profiling build config for shark, etc.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+=== Start merge of squirrelfish-extreme ===
+
+2008-09-06  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix the Mac Debug build by adding symbols that are exported only in a
+        Debug configuration.
+
+        * Configurations/JavaScriptCore.xcconfig:
+        * DerivedSources.make:
+        * JavaScriptCore.Debug.exp: Added.
+        * JavaScriptCore.base.exp: Copied from JavaScriptCore.exp.
+        * JavaScriptCore.exp: Removed.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-09-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=20681
+          JSPropertyNameIterator functions need to be inlined
+
+        1.007x as fast on SunSpider overall
+        1.081x as fast on SunSpider math-cordic
+
+        * VM/JSPropertyNameIterator.cpp: Moved functions out of here.
+        * VM/JSPropertyNameIterator.h:
+        (KJS::JSPropertyNameIterator::JSPropertyNameIterator): Moved
+        this into the header and marked it inline.
+        (KJS::JSPropertyNameIterator::create): Ditto.
+        (KJS::JSPropertyNameIterator::next): Ditto.
+
+2008-09-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=20673
+          single-character strings are churning in the Identifier table
+
+        1.007x as fast on SunSpider overall
+        1.167x as fast on SunSpider string-fasta
+
+        * JavaScriptCore.exp: Updated.
+        * kjs/SmallStrings.cpp:
+        (KJS::SmallStrings::singleCharacterStringRep): Added.
+        * kjs/SmallStrings.h: Added singleCharacterStringRep for clients that
+        need just a UString, not a JSString.
+        * kjs/identifier.cpp:
+        (KJS::Identifier::add): Added special cases for single character strings
+        so that the UString::Rep that ends up in the identifier table is the one
+        from the single-character string optimization; otherwise we end up having
+        to look it up in the identifier table over and over again.
+        (KJS::Identifier::addSlowCase): Ditto.
+        (KJS::Identifier::checkSameIdentifierTable): Made this function an empty
+        inline in release builds so that callers don't have to put #ifndef NDEBUG
+        at each call site.
+        * kjs/identifier.h:
+        (KJS::Identifier::add): Removed #ifndef NDEBUG around the calls to
+        checkSameIdentifierTable.
+        (KJS::Identifier::checkSameIdentifierTable): Added. Empty inline version
+        for NDEBUG builds.
+
+2008-09-05  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * kjs/JSObject.h: Move the inline virtual destructor after a non-inline
+        virtual function so that the symbol for the vtable is not marked as a
+        weakly exported symbol.
+
+2008-09-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=20671
+          JavaScriptCore string manipulation spends too much time in memcpy
+
+        1.011x as fast on SunSpider overall
+        1.028x as fast on SunSpider string tests
+
+        For small strings, use a loop rather than calling memcpy. The loop can
+        be faster because there's no function call overhead, and because it can
+        assume the pointers are aligned instead of checking that. Currently the
+        threshold is set at 20 characters, based on some testing on one particular
+        computer. Later we can tune this for various platforms by setting
+        USTRING_COPY_CHARS_INLINE_CUTOFF appropriately, but it does no great harm
+        if not perfectly tuned.
+
+        * kjs/ustring.cpp:
+        (KJS::overflowIndicator): Removed bogus const.
+        (KJS::maxUChars): Ditto.
+        (KJS::copyChars): Added.
+        (KJS::UString::Rep::createCopying): Call copyChars instead of memcpy.
+        Also eliminated need for const_cast.
+        (KJS::UString::expandPreCapacity): Ditto.
+        (KJS::concatenate): Ditto.
+        (KJS::UString::spliceSubstringsWithSeparators): Ditto.
+        (KJS::UString::append): Ditto.
+
+2008-09-05  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Sam and Alexey.
+
+        Make the profiler work with a null exec state.  This will allow other
+        applications start the profiler to get DTrace probes going without
+        needing a WebView.
+
+        * ChangeLog:
+        * profiler/ProfileGenerator.cpp:
+        (KJS::ProfileGenerator::ProfileGenerator):
+        (KJS::ProfileGenerator::willExecute):
+        (KJS::ProfileGenerator::didExecute):
+        * profiler/Profiler.cpp:
+        (KJS::Profiler::startProfiling):
+        (KJS::Profiler::stopProfiling):
+        (KJS::dispatchFunctionToProfiles):
+
+2008-09-04  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoffrey Garen.
+        
+        Fixed an off-by-one error that would cause the StructureIDChain to
+        be one object too short.
+        
+        Can't construct a test case because other factors make this not crash
+        (yet!).
+
+        * kjs/StructureID.cpp:
+        (KJS::StructureIDChain::StructureIDChain):
+
+2008-09-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes.
+
+        * JavaScriptCoreSources.bkl:
+
+2008-09-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=20639.
+        Bug 20639: ENABLE_DASHBOARD_SUPPORT does not need to be a FEATURE_DEFINE
+
+        * Configurations/JavaScriptCore.xcconfig: Remove ENABLE_DASHBOARD_SUPPORT from FEATURE_DEFINES.
+        * wtf/Platform.h: Set ENABLE_DASHBOARD_SUPPORT for PLATFORM(MAC).
+
+2008-09-04  Adele Peterson  <adele@apple.com>
+
+        Build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+
+2008-09-04  Mark Rowe  <mrowe@apple.com>
+
+        Mac build fix.
+
+        * kjs/config.h: Only check the value of HAVE_CONFIG_H if it is defined.
+
+2008-09-04  Marco Barisione  <marco.barisione@collabora.co.uk>
+
+        Reviewed by Eric Seidel.
+
+        http://bugs.webkit.org/show_bug.cgi?id=20380
+        [GTK][AUTOTOOLS] Include autotoolsconfig.h from config.h
+
+        * kjs/config.h: Include the configuration header generated by
+        autotools if available.
+
+2008-09-04  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix the QtWebKit build to match changes in r36016
+
+        * JavaScriptCore.pri:
+
+2008-09-04  Mark Rowe  <mrowe@apple.com>
+
+        Fix the 64-bit build.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::printStructureID): Store the instruction offset into an unsigned local
+        to avoid a warning related to format specifiers.
+        (KJS::CodeBlock::printStructureIDs): Ditto.
+
+2008-09-04  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Correct the spelling of 'entryIndices'.
+
+        * kjs/PropertyMap.cpp:
+        (KJS::PropertyMap::get):
+        (KJS::PropertyMap::getLocation):
+        (KJS::PropertyMap::put):
+        (KJS::PropertyMap::insert):
+        (KJS::PropertyMap::remove):
+        (KJS::PropertyMap::checkConsistency):
+        * kjs/PropertyMap.h:
+        (KJS::PropertyMapHashTable::entries):
+        (KJS::PropertyMap::getOffset):
+        (KJS::PropertyMap::putOffset):
+        (KJS::PropertyMap::offsetForTableLocation):
+
+2008-09-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+        
+        Fixed <rdar://problem/6193925> REGRESSION: Crash occurs at
+        KJS::Machine::privateExecute() when attempting to load my Mobile Gallery
+        (http://www.me.com/gallery/#home)
+        
+        also
+        
+        https://bugs.webkit.org/show_bug.cgi?id=20633 Crash in privateExecute
+        @ cs.byu.edu
+        
+        The underlying problem was that we would cache prototype properties
+        even if the prototype was a dictionary.
+        
+        The fix is to transition a prototype back from dictionary to normal
+        status when an opcode caches access to it. (This is better than just
+        refusing to cache, since a heavily accessed prototype is almost
+        certainly not a true dictionary.)
+
+        * VM/Machine.cpp:
+        (KJS::Machine::tryCacheGetByID):
+        * kjs/JSObject.h:
+
+2008-09-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Clean up Platform.h and add PLATFORM(CHROMIUM), PLATFORM(SKIA) and USE(V8_BINDINGS)
+
+        * Configurations/JavaScriptCore.xcconfig: add missing ENABLE_*
+        * wtf/ASCIICType.h: include <wtf/Assertions.h> since it depends on it.
+        * wtf/Platform.h:
+
+2008-09-03  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        Remove the rest of the "zombie" code from the profiler.
+        - There is no longer a need for the ProfilerClient callback mechanism.
+
+        * API/JSProfilerPrivate.cpp:
+        (JSStartProfiling):
+        * JavaScriptCore.exp:
+        * profiler/HeavyProfile.h:
+        * profiler/ProfileGenerator.cpp:
+        (KJS::ProfileGenerator::create):
+        (KJS::ProfileGenerator::ProfileGenerator):
+        * profiler/ProfileGenerator.h:
+        (KJS::ProfileGenerator::profileGroup):
+        * profiler/Profiler.cpp:
+        (KJS::Profiler::startProfiling):
+        (KJS::Profiler::stopProfiling): Immediately return the profile when
+        stopped instead of using a callback.
+        * profiler/Profiler.h:
+        * profiler/TreeProfile.h:
+
+2008-09-03  Adele Peterson  <adele@apple.com>
+
+        Build fix.
+
+        * wtf/win/MainThreadWin.cpp:
+
+2008-09-02  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin and Tim.
+
+        Remove most of the "zombie" mode from the profiler.  Next we will need
+        to remove the client callback mechanism in profiles.
+
+        - This simplifies the code, leverages the recent changes I've made in
+        getting line numbers from SquirrelFish, and is a slight speed
+        improvement on SunSpider.
+        - Also the "zombie" mode was a constant source of odd edge cases and
+        obscure bugs so it's good to remove since all of its issues may not have
+        been found.
+
+        * API/JSProfilerPrivate.cpp: No need to call didFinishAllExecution() any
+        more.
+        (JSEndProfiling):
+        * JavaScriptCore.exp: Export the new signature of retrieveLastCaller()
+        * VM/Machine.cpp:
+        (KJS::Machine::execute): No need to call didFinishAllExecution() any
+        more.
+        (KJS::Machine::retrieveCaller): Now operates on InternalFunctions now
+        since the RegisterFile is no longer guaranteeded to store only
+        JSFunctions
+        (KJS::Machine::retrieveLastCaller): Now also retrieve the function's
+        name
+        (KJS::Machine::callFrame): A result of changing retrieveCaller()
+        * VM/Machine.h:
+        * VM/Register.h: 
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::~JSGlobalObject):
+        * kjs/nodes.h:
+        * profiler/ProfileGenerator.cpp:
+        (KJS::ProfileGenerator::create): Now pass the original exec and get the
+        global exec and client when necessary.  We need the original exec so we
+        can have the stack frame where profiling started.
+        (KJS::ProfileGenerator::ProfileGenerator): ditto.
+        (KJS::ProfileGenerator::addParentForConsoleStart): This is where the 
+        parent to star of the profile is added, if there is one.
+        (KJS::ProfileGenerator::willExecute): Remove uglyness!
+        (KJS::ProfileGenerator::didExecute): Ditto!
+        (KJS::ProfileGenerator::stopProfiling):
+        (KJS::ProfileGenerator::removeProfileStart): Use a better way to find
+        and remove the function we are looking for.
+        (KJS::ProfileGenerator::removeProfileEnd): Ditto.
+        * profiler/ProfileGenerator.h:
+        (KJS::ProfileGenerator::client):
+        * profiler/ProfileNode.cpp:
+        (KJS::ProfileNode::removeChild): Add a better way to remove a child from
+        a ProfileNode.
+        (KJS::ProfileNode::stopProfiling):
+        (KJS::ProfileNode::debugPrintData): Modified a debug-only diagnostic
+        function to be sane.
+        * profiler/ProfileNode.h:
+        * profiler/Profiler.cpp: Change to pass the original exec state.
+        (KJS::Profiler::startProfiling):
+        (KJS::Profiler::stopProfiling):
+        (KJS::Profiler::willExecute):
+        (KJS::Profiler::didExecute):
+        (KJS::Profiler::createCallIdentifier):
+        * profiler/Profiler.h:
+
+2008-09-01  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Implement callOnMainThreadAndWait().
+
+        This will be useful when a background thread needs to perform UI calls synchronously
+        (e.g. an openDatabase() call cannot return until the user answers to a confirmation dialog).
+
+        * wtf/MainThread.cpp:
+        (WTF::FunctionWithContext::FunctionWithContext): Added a ThreadCondition member. When
+        non-zero, the condition is signalled after the function is called.
+        (WTF::mainThreadFunctionQueueMutex): Renamed from functionQueueMutex, sinc this is no longer
+        static. Changed to be initialized from initializeThreading() to avoid lock contention.
+        (WTF::initializeMainThread): On non-Windows platforms, just call mainThreadFunctionQueueMutex.
+        (WTF::dispatchFunctionsFromMainThread): Signal synchronous calls when done.
+        (WTF::callOnMainThread): Updated for functionQueueMutex rename.
+        (WTF::callOnMainThreadAndWait):  Added.
+
+        * wtf/MainThread.h: Added callOnMainThreadAndWait(); initializeMainThread() now exists on
+        all platforms.
+
+        * wtf/win/MainThreadWin.cpp: (WTF::initializeMainThread): Added a callOnMainThreadAndWait()
+        call to initialize function queue mutex.
+
+        * wtf/ThreadingGtk.cpp: (WTF::initializeThreading):
+        * wtf/ThreadingPthreads.cpp: (WTF::initializeThreading):
+        * wtf/ThreadingQt.cpp: (WTF::initializeThreading):
+        Only initialize mainThreadIdentifier on non-Darwin platforms. It was not guaranteed to be
+        accurate on Darwin.
+
+2008-09-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Use isUndefinedOrNull() instead of separate checks for each in op_eq_null
+        and op_neq_null.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-09-02  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        Bug 20296: OpcodeStats doesn't build on platforms which don't have mergesort().
+        <https://bugs.webkit.org/show_bug.cgi?id=20296>
+
+        * VM/Opcode.cpp:
+        (KJS::OpcodeStats::~OpcodeStats): mergesort() replaced with qsort()
+
+2008-09-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Fast path for array.length and string.length.
+        
+        SunSpider says 0.5% faster.
+
+2008-09-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Anders Carlsson.
+        
+        Added optimized paths for comparing to null.
+        
+        SunSpider says 0.5% faster.
+
+2008-09-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Changed jsDriver.pl to dump the exact text you would need in order to
+        reproduce a test result. This enables a fast workflow where you copy
+        and paste a test failure in the terminal.
+
+        * tests/mozilla/jsDriver.pl:
+
+2008-09-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Implemented the rest of Darin's review comments for the 09-01 inline
+        caching patch.
+        
+        SunSpider says 0.5% faster, but that seems like noise.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Put PutPropertySlot into
+        its own file, and added BatchedTransitionOptimizer.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::~CodeBlock): Use array indexing instead of a pointer
+        iterator.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::CodeGenerator): Used BatchedTransitionOptimizer to
+        make batched put and remove for declared variables fast, without forever
+        pessimizing the global object. Removed the old getDirect/removeDirect hack
+        that tried to do the same in a more limited way.
+
+        * VM/CodeGenerator.h: Moved IdentifierRepHash to the KJS namespace since
+        it doesn't specialize anything in WTF.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::Machine): Nixed the DummyConstruct tag because it was
+        confusingly named.
+
+        (KJS::Machine::execute):  Used BatchedTransitionOptimizer, as above. Fixed
+        up some comments.
+
+        (KJS::cachePrototypeChain): Cast to JSObject*, since it's more specific.
+
+        (KJS::Machine::tryCachePutByID): Use isNull() instead of comparing to
+        jsNull(), since isNull() leaves more options open for the future.
+        (KJS::Machine::tryCacheGetByID): ditto
+        (KJS::Machine::privateExecute): ditto
+
+        * VM/SamplingTool.cpp:
+        (KJS::SamplingTool::dump): Use C++-style cast, to match our style
+        guidelines.
+
+        * kjs/BatchedTransitionOptimizer.h: Added. New class that allows host
+        code to add a batch of properties to an object in an efficient way.
+
+        * kjs/JSActivation.cpp: Use isNull(), as above.
+
+        * kjs/JSArray.cpp: Get rid of DummyConstruct tag, as above.
+        * kjs/JSArray.h:
+
+        * kjs/JSGlobalData.cpp: Nixed two unused StructureIDs.
+        * kjs/JSGlobalData.h:
+
+        * kjs/JSImmediate.cpp: Use isNull(), as above.
+
+        * kjs/JSObject.cpp:
+        (KJS::JSObject::mark): Moved mark tracing code elsewhere, to make this
+        function more readable.
+
+        (KJS::JSObject::put): Use isNull(), as above.
+
+        (KJS::JSObject::createInheritorID): Return a raw pointer, since the
+        object is owned by a data member, not necessarily the caller.
+        * kjs/JSObject.h:
+
+        * kjs/JSString.cpp: Use isNull(), as above.
+
+        * kjs/PropertyMap.h: Updated to use PropertySlot::invalidOffset.
+
+        * kjs/PropertySlot.h: Changed KJS_INVALID_OFFSET to WTF::notFound
+        because C macros are so 80's.
+
+        * kjs/PutPropertySlot.h: Added. Split out of PropertySlot.h. Also renamed
+        PutPropertySlot::SlotType to PutPropertySlot::Type, and slotBase to base,
+        since "slot" was redundant.
+
+        * kjs/StructureID.cpp: Added a new transition *away* from dictionary
+        status, to support BatchedTransitionOptimizer.
+
+        (KJS::StructureIDChain::StructureIDChain): No need to store m_size as
+        a data member, so keep it in a local, which might be faster.
+        * kjs/StructureID.h:
+
+        * kjs/SymbolTable.h: Moved IdentifierRepHash to KJS namespace, as above.
+        * kjs/ustring.h:
+
+2008-09-02  Adam Roben  <aroben@apple.com>
+
+        Windows build fixes
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Add
+        StructureID.{cpp,h} to the project. Also let VS reorder this file.
+        * VM/CodeBlock.cpp: Include StringExtras so that snprintf will be
+        defined on Windows.
+
+2008-09-01  Sam Weinig  <sam@webkit.org>
+
+        Fix release build.
+
+        * JavaScriptCore.exp:
+
+2008-09-01  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Gtk buildfix
+
+        * GNUmakefile.am:
+        * kjs/PropertyMap.cpp: rename Identifier.h to identifier.h
+        * kjs/StructureID.cpp: include JSObject.h
+
+2008-09-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        First cut at inline caching for access to vanilla JavaScript properties.
+        
+        SunSpider says 4% faster. Tests heavy on dictionary-like access have
+        regressed a bit -- we have a lot of room to improve in this area,
+        but this patch is over-ripe as-is.
+        
+        JSCells now have a StructureID that uniquely identifies their layout,
+        and holds their prototype.
+        
+        JSValue::put takes a PropertySlot& argument, so it can fill in details
+        about where it put a value, for the sake of caching.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::CodeGenerator): Avoid calling removeDirect if we
+        can, since it disables inline caching in the global object. This can
+        probably improve in the future.
+
+        * kjs/JSGlobalObject.cpp: Nixed reset(), since it complicates caching, and
+        wasn't really necessary.
+
+        * kjs/JSObject.cpp: Tweaked getter / setter behavior not to rely on the
+        IsGetterSetter flag, since the flag was buggy. This is necessary in order
+        to avoid accidentally accessing a getter / setter as a normal property.
+        
+        Also changed getter / setter creation to honor ReadOnly, matching Mozilla.
+        
+        * kjs/PropertyMap.cpp: Nixed clear(), since it complicates caching and
+        isn't necessary.
+
+        * kjs/Shell.cpp: Moved SamplingTool dumping outside the loop. This allows
+        you to aggregate sampling of multiple files (or the same file repeatedly),
+        which helped me track down regressions.
+
+        * kjs/ustring.h: Moved IdentifierRepHash here to share it.
+
+2008-09-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Eagerly allocate the Math object's numeric constants. This avoids
+        constantly reallocating them in loops, and also ensures that the Math
+        object will not use the single property optimization, which makes
+        properties ineligible for caching.
+
+        SunSpider reports a small speedup, in combination with inline caching.
+
+        * kjs/MathObject.cpp:
+        (KJS::MathObject::MathObject):
+        (KJS::MathObject::getOwnPropertySlot):
+        * kjs/MathObject.h:
+
+2008-09-01  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix, not reviewed.
+
+        * GNUmakefile.am: Add SmallStrings.cpp in both release and debug builds
+
+2008-08-31  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20577: REGRESSION (r36006): Gmail is broken
+        <https://bugs.webkit.org/show_bug.cgi?id=20577>
+
+        r36006 changed stringProtoFuncSubstr() so that it is uses the more
+        efficient jsSubstring(), rather than using UString::substr() and then
+        calling jsString(). However, the change did not account for the case
+        where the start and the length of the substring extend beyond the length
+        of the original string. This patch corrects that.
+
+        * kjs/StringPrototype.cpp:
+        (KJS::stringProtoFuncSubstr):
+
+2008-08-31  Simon Hausmann  <hausmann@wekit.org>
+
+        Unreviewed build fix (with gcc 4.3)
+
+        * kjs/ustring.h: Properly forward declare operator== for UString and
+        the the concatenate functions inside the KJS namespace.
+
+2008-08-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=20333
+          improve JavaScript speed when handling single-character strings
+
+        1.035x as fast on SunSpider overall.
+        1.127x as fast on SunSpider string tests.
+        1.910x as fast on SunSpider string-base64 test.
+
+        * API/JSObjectRef.cpp:
+        (JSObjectMakeFunction): Removed unneeded explicit construction of UString.
+
+        * GNUmakefile.am: Added SmallStrings.h and SmallStrings.cpp.
+        * JavaScriptCore.pri: Ditto.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * JavaScriptCoreSources.bkl: Ditto.
+
+        * JavaScriptCore.exp: Updated.
+
+        * VM/Machine.cpp:
+        (KJS::jsAddSlowCase): Changed to use a code path that doesn't involve
+        a UString constructor. This avoids an extra jump caused by the "in charge"
+        vs. "not in charge" constructors.
+        (KJS::jsAdd): Ditto.
+        (KJS::jsTypeStringForValue): Adopted jsNontrivialString.
+
+        * kjs/ArrayPrototype.cpp:
+        (KJS::arrayProtoFuncToString): Adopted jsEmptyString.
+        (KJS::arrayProtoFuncToLocaleString): Ditto.
+        (KJS::arrayProtoFuncJoin): Ditto.
+        * kjs/BooleanPrototype.cpp:
+        (KJS::booleanProtoFuncToString): Adopted jsNontrivialString.
+        * kjs/DateConstructor.cpp:
+        (KJS::callDate): Ditto.
+        * kjs/DatePrototype.cpp:
+        (KJS::formatLocaleDate): Adopted jsEmptyString and jsNontrivialString.
+        (KJS::dateProtoFuncToString): Ditto.
+        (KJS::dateProtoFuncToUTCString): Ditto.
+        (KJS::dateProtoFuncToDateString): Ditto.
+        (KJS::dateProtoFuncToTimeString): Ditto.
+        (KJS::dateProtoFuncToLocaleString): Ditto.
+        (KJS::dateProtoFuncToLocaleDateString): Ditto.
+        (KJS::dateProtoFuncToLocaleTimeString): Ditto.
+        (KJS::dateProtoFuncToGMTString): Ditto.
+
+        * kjs/ErrorPrototype.cpp:
+        (KJS::ErrorPrototype::ErrorPrototype): Ditto.
+        (KJS::errorProtoFuncToString): Ditto.
+
+        * kjs/JSGlobalData.h: Added SmallStrings.
+
+        * kjs/JSString.cpp:
+        (KJS::jsString): Eliminated the overload that takes a const char*.
+        Added code to use SmallStrings to get strings of small sizes rather
+        than creating a new JSString every time.
+        (KJS::jsSubstring): Added. Used when creating a string from a substring
+        to avoid creating a JSString in cases where the substring will end up
+        empty or as one character.
+        (KJS::jsOwnedString): Added the same code as in jsString.
+
+        * kjs/JSString.h: Added new functions jsEmptyString, jsSingleCharacterString,
+        jsSingleCharacterSubstring, jsSubstring, and jsNontrivialString for various
+        cases where we want to create JSString, and want special handling for small
+        strings.
+        (KJS::JSString::JSString): Added an overload that takes a PassRefPtr of
+        a UString::Rep so you don't have to construct a UString; PassRefPtr can be
+        more efficient.
+        (KJS::jsEmptyString): Added.
+        (KJS::jsSingleCharacterString): Added.
+        (KJS::jsSingleCharacterSubstring): Added.
+        (KJS::jsNontrivialString): Added.
+        (KJS::JSString::getIndex): Adopted jsSingleCharacterSubstring.
+        (KJS::JSString::getStringPropertySlot): Ditto.
+
+        * kjs/NumberPrototype.cpp:
+        (KJS::numberProtoFuncToFixed): Adopted jsNontrivialString.
+        (KJS::numberProtoFuncToExponential): Ditto.
+        (KJS::numberProtoFuncToPrecision): Ditto.
+
+        * kjs/ObjectPrototype.cpp:
+        (KJS::objectProtoFuncToLocaleString): Adopted toThisJSString.
+        (KJS::objectProtoFuncToString): Adopted jsNontrivialString.
+
+        * kjs/RegExpConstructor.cpp: Separated the lastInput value that's used
+        with the lastOvector to return matches from the input value that can be
+        changed via JavaScript. They will be equal in many cases, but not all.
+        (KJS::RegExpConstructor::performMatch): Set input.
+        (KJS::RegExpMatchesArray::RegExpMatchesArray): Ditto.
+        (KJS::RegExpMatchesArray::fillArrayInstance): Adopted jsSubstring. Also,
+        use input rather than lastInput in the appropriate place.
+        (KJS::RegExpConstructor::getBackref): Adopted jsSubstring and jsEmptyString.
+        Added code to handle the case where there is no backref -- before this
+        depended on range checking in UString::substr which is not present in
+        jsSubstring.
+        (KJS::RegExpConstructor::getLastParen): Ditto.
+        (KJS::RegExpConstructor::getLeftContext): Ditto.
+        (KJS::RegExpConstructor::getRightContext): Ditto.
+        (KJS::RegExpConstructor::getValueProperty): Use input rather than lastInput.
+        Also adopt jsEmptyString.
+        (KJS::RegExpConstructor::putValueProperty): Ditto.
+        (KJS::RegExpConstructor::input): Ditto.
+
+        * kjs/RegExpPrototype.cpp:
+        (KJS::regExpProtoFuncToString): Adopt jsNonTrivialString. Also changed to
+        use UString::append to append single characters rather than using += and
+        a C-style string.
+
+        * kjs/SmallStrings.cpp: Added.
+        (KJS::SmallStringsStorage::SmallStringsStorage): Construct the
+        buffer and UString::Rep for all 256 single-character strings for
+        the U+0000 through U+00FF. This covers all the values used in
+        the base64 test as well as most values seen elsewhere on the web
+        as well. It's possible that later we might fix this to only work
+        for U+0000 through U+007F but the others are used quite a bit in
+        the current version of the base64 test.
+        (KJS::SmallStringsStorage::~SmallStringsStorage): Free memory.
+        (KJS::SmallStrings::SmallStrings): Create a set of small strings,
+        initially not created; created later when they are used.
+        (KJS::SmallStrings::~SmallStrings): Deallocate. Not left compiler
+        generated because the SmallStringsStorage class's destructor needs
+        to be visible.
+        (KJS::SmallStrings::mark): Mark all the strings.
+        (KJS::SmallStrings::createEmptyString): Create a cell for the
+        empty string. Called only the first time.
+        (KJS::SmallStrings::createSingleCharacterString): Create a cell
+        for one of the single-character strings. Called only the first time.
+        * kjs/SmallStrings.h: Added.
+
+        * kjs/StringConstructor.cpp:
+        (KJS::stringFromCharCodeSlowCase): Factored out of strinFromCharCode.
+        Only used for cases where the caller does not pass exactly one argument.
+        (KJS::stringFromCharCode): Adopted jsSingleCharacterString.
+        (KJS::callStringConstructor): Adopted jsEmptyString.
+
+        * kjs/StringObject.cpp:
+        (KJS::StringObject::StringObject): Adopted jsEmptyString.
+
+        * kjs/StringPrototype.cpp:
+        (KJS::stringProtoFuncReplace): Adopted jsSubstring.
+        (KJS::stringProtoFuncCharAt): Adopted jsEmptyString and
+        jsSingleCharacterSubstring and also added a special case when the
+        index is an immediate number to avoid conversion to and from floating
+        point, since that's the common case.
+        (KJS::stringProtoFuncCharCodeAt): Ditto.
+        (KJS::stringProtoFuncMatch): Adopted jsSubstring and jsEmptyString.
+        (KJS::stringProtoFuncSlice): Adopted jsSubstring and
+        jsSingleCharacterSubstring. Also got rid of some unneeded locals and
+        removed unneeded code to set the length property of the array, since it
+        is automatically updated as values are added to the array.
+        (KJS::stringProtoFuncSplit): Adopted jsEmptyString.
+        (KJS::stringProtoFuncSubstr): Adopted jsSubstring.
+        (KJS::stringProtoFuncSubstring): Ditto.
+
+        * kjs/collector.cpp:
+        (KJS::Heap::collect): Added a call to mark SmallStrings.
+
+        * kjs/ustring.cpp:
+        (KJS::UString::expandedSize): Made this a static member function since
+        it doesn't need to look at any data members.
+        (KJS::UString::expandCapacity): Use a non-inline function, makeNull, to
+        set the rep to null in failure cases. This avoids adding a PIC branch for
+        the normal case when there is no failure.
+        (KJS::UString::expandPreCapacity): Ditto.
+        (KJS::UString::UString): Ditto.
+        (KJS::concatenate): Refactored the concatenation constructor into this
+        separate function. Calling the concatenation constructor was leading to
+        an extra branch because of the in-charge vs. not-in-charge versions not
+        both being inlined, and this was showing up as nearly 1% on Shark. Also
+        added a special case for when the second string is a single character,
+        since it's a common idiom to build up a string that way and we can do
+        things much more quickly, without involving memcpy for example. Also
+        adopted the non-inline function, nullRep, for the same reason given for
+        makeNull above.
+        (KJS::UString::append): Adopted makeNull for failure cases.
+        (KJS::UString::operator=): Ditto.
+        (KJS::UString::toDouble): Added a special case for converting single
+        character strings to numbers. We're doing this a ton of times while
+        running the base64 test.
+        (KJS::operator==): Added special cases so we can compare single-character
+        strings without calling memcmp. Later we might want to special case other
+        short lengths similarly.
+        (KJS::UString::makeNull): Added.
+        (KJS::UString::nullRep): Added.
+        * kjs/ustring.h: Added declarations for the nullRep and makeNull. Changed
+        expandedSize to be a static member function. Added a declaration of the
+        concatenate function. Removed the concatenation constructor. Rewrote
+        operator+ to use the concatenate function.
+
+2008-08-29  Anders Carlsson  <andersca@apple.com>
+
+        Build fix.
+
+        * VM/Machine.cpp:
+        (KJS::getCPUTime):
+
+2008-08-29  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6174667> 
+        When a machine is under heavy load, the Slow Script dialog often comes up many times and just gets in the way
+        
+        Instead of using clock time, use the CPU time spent executing the current thread when
+        determining if the script has been running for too long.
+        
+        * VM/Machine.cpp:
+        (KJS::getCPUTime):
+        (KJS::Machine::checkTimeout):
+
+2008-08-28  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Rubber-stamped by Sam Weinig.
+
+        Change 'term' to 'expr' in variable names to standardize terminology.
+
+        * kjs/nodes.cpp:
+        (KJS::BinaryOpNode::emitCode):
+        (KJS::ReverseBinaryOpNode::emitCode):
+        (KJS::ThrowableBinaryOpNode::emitCode):
+        * kjs/nodes.h:
+        (KJS::BinaryOpNode::BinaryOpNode):
+        (KJS::ReverseBinaryOpNode::ReverseBinaryOpNode):
+        (KJS::MultNode::):
+        (KJS::DivNode::):
+        (KJS::ModNode::):
+        (KJS::AddNode::):
+        (KJS::SubNode::):
+        (KJS::LeftShiftNode::):
+        (KJS::RightShiftNode::):
+        (KJS::UnsignedRightShiftNode::):
+        (KJS::LessNode::):
+        (KJS::GreaterNode::):
+        (KJS::LessEqNode::):
+        (KJS::GreaterEqNode::):
+        (KJS::ThrowableBinaryOpNode::):
+        (KJS::InstanceOfNode::):
+        (KJS::InNode::):
+        (KJS::EqualNode::):
+        (KJS::NotEqualNode::):
+        (KJS::StrictEqualNode::):
+        (KJS::NotStrictEqualNode::):
+        (KJS::BitAndNode::):
+        (KJS::BitOrNode::):
+        (KJS::BitXOrNode::):
+        * kjs/nodes2string.cpp:
+        (KJS::MultNode::streamTo):
+        (KJS::DivNode::streamTo):
+        (KJS::ModNode::streamTo):
+        (KJS::AddNode::streamTo):
+        (KJS::SubNode::streamTo):
+        (KJS::LeftShiftNode::streamTo):
+        (KJS::RightShiftNode::streamTo):
+        (KJS::UnsignedRightShiftNode::streamTo):
+        (KJS::LessNode::streamTo):
+        (KJS::GreaterNode::streamTo):
+        (KJS::LessEqNode::streamTo):
+        (KJS::GreaterEqNode::streamTo):
+        (KJS::InstanceOfNode::streamTo):
+        (KJS::InNode::streamTo):
+        (KJS::EqualNode::streamTo):
+        (KJS::NotEqualNode::streamTo):
+        (KJS::StrictEqualNode::streamTo):
+        (KJS::NotStrictEqualNode::streamTo):
+        (KJS::BitAndNode::streamTo):
+        (KJS::BitXOrNode::streamTo):
+        (KJS::BitOrNode::streamTo):
+
+2008-08-28  Alp Toker  <alp@nuanti.com>
+
+        GTK+ dist/build fix. List newly added header files.
+
+        * GNUmakefile.am:
+
+2008-08-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Change to throw a ReferenceError at runtime instead of a ParseError
+        at parse time, when the left hand side expression of a for-in statement
+        is not an lvalue.
+
+        * kjs/grammar.y:
+        * kjs/nodes.cpp:
+        (KJS::ForInNode::emitCode):
+
+2008-08-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Not reviewed, build fix (at least for OpenBSD, posssibly more).
+
+        https://bugs.webkit.org/show_bug.cgi?id=20545
+        missing #include <unistd.h> in JavaScriptCore/VM/SamplingTool.cpp
+
+        * VM/SamplingTool.cpp: add the missing include.
+
+2008-08-26  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoff and Cameron.
+
+        <rdar://problem/6174603> Hitting assertion in Register::codeBlock when
+        loading facebook (20516).
+
+        - This was a result of my line numbers change.  After a host function is
+        called the stack does not get reset correctly.
+        - Oddly this also appears to be a slight speedup on SunSpider.
+
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+
+2008-08-26  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff and Tim.
+
+        Export new API methods.
+
+        * JavaScriptCore.exp:
+
+2008-08-25  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoff, Tim and Mark.
+
+        <rdar://problem/6150623> JSProfiler: It would be nice if the profiles
+        in the console said what file and line number they came from
+        - Lay the foundation for getting line numbers and other data from the
+        JavaScript engine.  With the cleanup in kjs/ExecState this is actually
+        a slight performance improvement.
+
+        * JavaScriptCore.exp: Export retrieveLastCaller() for WebCore.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * VM/Machine.cpp: Now Host and JS functions set a call frame on the
+        exec state, so this and the profiler code were pulled out of the
+        branches.
+        (KJS::Machine::privateExecute):
+        (KJS::Machine::retrieveLastCaller): This get's the lineNumber, sourceID
+        and sourceURL for the previously called function.
+        * VM/Machine.h:
+        * kjs/ExecState.cpp: Remove references to JSFunction since it's not used
+        anywhere.
+        * kjs/ExecState.h:
+
+2008-08-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Ensure that JSGlobalContextRelease() performs garbage collection, even if there are other
+        contexts in the current context's group.
+
+        This is only really necessary when the last reference is released, but there is no way to
+        determine that, and no harm in collecting slightly more often.
+
+        * API/JSContextRef.cpp: (JSGlobalContextRelease): Explicitly collect the heap if it is not
+        being destroyed.
+
+2008-08-24  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 20093: JSC shell does not clear exceptions after it executes toString on an expression
+        <https://bugs.webkit.org/show_bug.cgi?id=20093>
+
+        Clear exceptions after evaluating any code in the JSC shell. We do not
+        report exceptions that are caused by calling toString on the final
+        valued, but at least we avoid incorrect behaviour.
+
+        Also, print any exceptions that occurred while evaluating code at the
+        interactive prompt, not just while evaluating code from a file.
+
+        * kjs/Shell.cpp:
+        (runWithScripts):
+        (runInteractive):
+
+2008-08-24  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Remove an unnecessary RefPtr to a RegisterID.
+
+        * kjs/nodes.cpp:
+        (KJS::DeleteBracketNode::emitCode):
+
+2008-08-24  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Use the correct version number for when JSGlobalContextCreate was introduced.
+
+        * API/JSContextRef.h:
+
+2008-08-23  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Rubber-stamped by Mark Rowe.
+
+        Remove modelines.
+
+        * API/APICast.h:
+        * API/JSBase.cpp:
+        * API/JSCallbackConstructor.cpp:
+        * API/JSCallbackConstructor.h:
+        * API/JSCallbackFunction.cpp:
+        * API/JSCallbackFunction.h:
+        * API/JSCallbackObject.cpp:
+        * API/JSCallbackObject.h:
+        * API/JSCallbackObjectFunctions.h:
+        * API/JSClassRef.cpp:
+        * API/JSContextRef.cpp:
+        * API/JSObjectRef.cpp:
+        * API/JSProfilerPrivate.cpp:
+        * API/JSStringRef.cpp:
+        * API/JSStringRefBSTR.cpp:
+        * API/JSStringRefCF.cpp:
+        * API/JSValueRef.cpp:
+        * API/tests/JSNode.c:
+        * API/tests/JSNode.h:
+        * API/tests/JSNodeList.c:
+        * API/tests/JSNodeList.h:
+        * API/tests/Node.c:
+        * API/tests/Node.h:
+        * API/tests/NodeList.c:
+        * API/tests/NodeList.h:
+        * API/tests/minidom.c:
+        * API/tests/minidom.js:
+        * API/tests/testapi.c:
+        * API/tests/testapi.js:
+        * JavaScriptCore.pro:
+        * kjs/FunctionConstructor.h:
+        * kjs/FunctionPrototype.h:
+        * kjs/JSArray.h:
+        * kjs/JSString.h:
+        * kjs/JSWrapperObject.cpp:
+        * kjs/NumberConstructor.h:
+        * kjs/NumberObject.h:
+        * kjs/NumberPrototype.h:
+        * kjs/lexer.h:
+        * kjs/lookup.h:
+        * wtf/Assertions.cpp:
+        * wtf/Assertions.h:
+        * wtf/HashCountedSet.h:
+        * wtf/HashFunctions.h:
+        * wtf/HashIterators.h:
+        * wtf/HashMap.h:
+        * wtf/HashSet.h:
+        * wtf/HashTable.h:
+        * wtf/HashTraits.h:
+        * wtf/ListHashSet.h:
+        * wtf/ListRefPtr.h:
+        * wtf/Noncopyable.h:
+        * wtf/OwnArrayPtr.h:
+        * wtf/OwnPtr.h:
+        * wtf/PassRefPtr.h:
+        * wtf/Platform.h:
+        * wtf/RefPtr.h:
+        * wtf/RefPtrHashMap.h:
+        * wtf/RetainPtr.h:
+        * wtf/UnusedParam.h:
+        * wtf/Vector.h:
+        * wtf/VectorTraits.h:
+        * wtf/unicode/Unicode.h:
+        * wtf/unicode/icu/UnicodeIcu.h:
+
+2008-08-22  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver.
+
+        Some cleanup to match our coding style.
+
+        * VM/CodeGenerator.h:
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * kjs/ExecState.cpp:
+        * kjs/ExecState.h:
+        * kjs/completion.h:
+        * kjs/identifier.cpp:
+        (KJS::Identifier::equal):
+        (KJS::CStringTranslator::hash):
+        (KJS::CStringTranslator::equal):
+        (KJS::CStringTranslator::translate):
+        (KJS::UCharBufferTranslator::equal):
+        (KJS::UCharBufferTranslator::translate):
+        (KJS::Identifier::remove):
+        * kjs/operations.h:
+
+2008-08-20  Alexey Proskuryakov  <ap@webkit.org>
+
+        Windows build fix.
+
+        * API/WebKitAvailability.h: Define DEPRECATED_ATTRIBUTE.
+
+2008-08-19  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        Bring back shared JSGlobalData and implicit locking, because too many clients rely on it.
+
+        * kjs/JSGlobalData.cpp:
+        (KJS::JSGlobalData::~JSGlobalData):
+        (KJS::JSGlobalData::JSGlobalData): Re-add shared instance.
+        (KJS::JSGlobalData::sharedInstanceExists): Ditto.
+        (KJS::JSGlobalData::sharedInstance): Ditto.
+        (KJS::JSGlobalData::sharedInstanceInternal): Ditto.
+
+        * API/JSContextRef.h: Deprecated JSGlobalContextCreate(). Added a very conservative
+        description of its threading model (nothing is allowed).
+
+        * API/JSContextRef.cpp:
+        (JSGlobalContextCreate): Use shared JSGlobalData.
+        (JSGlobalContextCreateInGroup): Support passing NULL group to request a unique one.
+        (JSGlobalContextRetain): Added back locking.
+        (JSGlobalContextRelease): Ditto.
+        (JSContextGetGlobalObject): Ditto.
+
+        * API/tests/minidom.c: (main):
+        * API/tests/testapi.c: (main):
+        Switched to JSGlobalContextCreateInGroup() to avoid deprecation warnings.
+
+        * JavaScriptCore.exp: Re-added JSLock methods. Added JSGlobalContextCreateInGroup (d'oh!).
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        (JSGarbageCollect):
+        * API/JSCallbackConstructor.cpp:
+        (KJS::constructJSCallback):
+        * API/JSCallbackFunction.cpp:
+        (KJS::JSCallbackFunction::call):
+        * API/JSCallbackObjectFunctions.h:
+        (KJS::::init):
+        (KJS::::getOwnPropertySlot):
+        (KJS::::put):
+        (KJS::::deleteProperty):
+        (KJS::::construct):
+        (KJS::::hasInstance):
+        (KJS::::call):
+        (KJS::::getPropertyNames):
+        (KJS::::toNumber):
+        (KJS::::toString):
+        (KJS::::staticValueGetter):
+        (KJS::::callbackGetter):
+        * API/JSObjectRef.cpp:
+        (JSObjectMake):
+        (JSObjectMakeFunctionWithCallback):
+        (JSObjectMakeConstructor):
+        (JSObjectMakeFunction):
+        (JSObjectHasProperty):
+        (JSObjectGetProperty):
+        (JSObjectSetProperty):
+        (JSObjectGetPropertyAtIndex):
+        (JSObjectSetPropertyAtIndex):
+        (JSObjectDeleteProperty):
+        (JSObjectCallAsFunction):
+        (JSObjectCallAsConstructor):
+        (JSObjectCopyPropertyNames):
+        (JSPropertyNameArrayRelease):
+        (JSPropertyNameAccumulatorAddName):
+        * API/JSValueRef.cpp:
+        (JSValueIsEqual):
+        (JSValueIsInstanceOfConstructor):
+        (JSValueMakeNumber):
+        (JSValueMakeString):
+        (JSValueToNumber):
+        (JSValueToStringCopy):
+        (JSValueToObject):
+        (JSValueProtect):
+        (JSValueUnprotect):
+        * ForwardingHeaders/JavaScriptCore/JSLock.h: Added.
+        * GNUmakefile.am:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        * kjs/AllInOneFile.cpp:
+        * kjs/JSGlobalData.h:
+        * kjs/JSGlobalObject.cpp:
+        (KJS::JSGlobalObject::~JSGlobalObject):
+        (KJS::JSGlobalObject::init):
+        * kjs/JSLock.cpp: Added.
+        (KJS::createJSLockCount):
+        (KJS::JSLock::lockCount):
+        (KJS::setLockCount):
+        (KJS::JSLock::JSLock):
+        (KJS::JSLock::lock):
+        (KJS::JSLock::unlock):
+        (KJS::JSLock::currentThreadIsHoldingLock):
+        (KJS::JSLock::DropAllLocks::DropAllLocks):
+        (KJS::JSLock::DropAllLocks::~DropAllLocks):
+        * kjs/JSLock.h: Added.
+        (KJS::JSLock::JSLock):
+        (KJS::JSLock::~JSLock):
+        * kjs/Shell.cpp:
+        (functionGC):
+        (jscmain):
+        * kjs/collector.cpp:
+        (KJS::Heap::~Heap):
+        (KJS::Heap::heapAllocate):
+        (KJS::Heap::setGCProtectNeedsLocking):
+        (KJS::Heap::protect):
+        (KJS::Heap::unprotect):
+        (KJS::Heap::collect):
+        * kjs/identifier.cpp:
+        * kjs/interpreter.cpp:
+        (KJS::Interpreter::checkSyntax):
+        (KJS::Interpreter::evaluate):
+        Re-added implicit locking.
+
+2008-08-19  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim and Mark.
+
+        Implement DTrace hooks for dashcode and instruments.
+
+        * API/JSProfilerPrivate.cpp: Added. Expose SPI so that profiling can be
+        turned on from a client.  The DTrace probes were added within the
+        profiler mechanism for performance reasons so the profiler must be
+        started to enable tracing.
+        (JSStartProfiling):
+        (JSEndProfiling):
+        * API/JSProfilerPrivate.h: Added. Ditto.
+        * JavaScriptCore.exp: Exposing the start/stop methods to clients.
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * kjs/Tracing.d: Define the DTrace probes.
+        * kjs/Tracing.h: Ditto.
+        * profiler/ProfileGenerator.cpp: Implement the DTrace probes in the
+        profiler.
+        (KJS::ProfileGenerator::willExecute):
+        (KJS::ProfileGenerator::didExecute):
+
+2008-08-19  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+        
+        * kjs/operations.cpp:
+        (KJS::equal):
+
+2008-08-18  Timothy Hatcher  <timothy@apple.com>
+
+        Fix an assertion when generating a heavy profile because the
+        empty value and deleted value of CallIdentifier where equal.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20439
+
+        Reviewed by Dan Bernstein.
+
+        * profiler/CallIdentifier.h: Make the emptyValue for CallIdentifier
+        use empty strings for URL and function name.
+
+2008-08-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - eliminate JSValue::type()
+
+        This will make it slightly easier to change the JSImmediate design without
+        having to touch so many call sites.
+
+        SunSpider says this change is a wash (looked like a slight speedup, but not
+        statistically significant).
+
+        * API/JSStringRef.cpp: Removed include of JSType.h.
+        * API/JSValueRef.cpp: Removed include of JSType.h.
+        (JSValueGetType): Replaced use of JSValue::type() with
+        JSValue::is functions.
+
+        * JavaScriptCore.exp: Updated.
+
+        * VM/JSPropertyNameIterator.cpp: Removed type() implementation.
+        (KJS::JSPropertyNameIterator::toPrimitive): Changed to take
+        PreferredPrimitiveType argument instead of JSType.
+        * VM/JSPropertyNameIterator.h: Ditto.
+
+        * VM/Machine.cpp:
+        (KJS::fastIsNumber): Updated for name change.
+        (KJS::fastToInt32): Ditto.
+        (KJS::fastToUInt32): Ditto.
+        (KJS::jsAddSlowCase): Updated toPrimitive caller for change from
+        JSType to PreferredPrimitiveType.
+        (KJS::jsAdd): Replaced calls to JSValue::type() with calls to
+        JSValue::isString().
+        (KJS::jsTypeStringForValue): Replaced calls to JSValue::type()
+        with multiple calls to JSValue::is -- we could make this a
+        virtual function instead if we want to have faster performance.
+        (KJS::Machine::privateExecute): Renamed JSImmediate::toTruncatedUInt32
+        to JSImmediate::getTruncatedUInt32 for consistency with other functions.
+        Changed two calls of JSValue::type() to JSValue::isString().
+
+        * kjs/GetterSetter.cpp:
+        (KJS::GetterSetter::toPrimitive): Changed to take
+        PreferredPrimitiveType argument instead of JSType.
+        (KJS::GetterSetter::isGetterSetter): Added.
+        * kjs/GetterSetter.h:
+
+        * kjs/JSCell.cpp:
+        (KJS::JSCell::isString): Added.
+        (KJS::JSCell::isGetterSetter): Added.
+        (KJS::JSCell::isObject): Added.
+
+        * kjs/JSCell.h: Eliminated type function. Added isGetterSetter.
+        Made isString and isObject virtual. Changed toPrimitive to take
+        PreferredPrimitiveType argument instead of JSType.
+        (KJS::JSCell::isNumber): Use Heap::isNumber for faster performance.
+        (KJS::JSValue::isGetterSetter): Added.
+        (KJS::JSValue::toPrimitive): Changed to take
+        PreferredPrimitiveType argument instead of JSType.
+
+        * kjs/JSImmediate.h: Removed JSValue::type() and replaced
+        JSValue::toTruncatedUInt32 with JSValue::getTruncatedUInt32.
+        (KJS::JSImmediate::isEitherImmediate): Added.
+
+        * kjs/JSNotAnObject.cpp:
+        (KJS::JSNotAnObject::toPrimitive): Changed to take
+        PreferredPrimitiveType argument instead of JSType.
+        * kjs/JSNotAnObject.h: Ditto.
+        * kjs/JSNumberCell.cpp:
+        (KJS::JSNumberCell::toPrimitive): Ditto.
+        * kjs/JSNumberCell.h:
+        (KJS::JSNumberCell::toInt32): Renamed from fastToInt32. There's no
+        other "slow" version of this once you have a JSNumberCell, so there's
+        no need for "fast" in the name. It's a feature that this hides the
+        base class toInt32, which does the same job less efficiently (and has
+        an additional ExecState argument).
+        (KJS::JSNumberCell::toUInt32): Ditto.
+
+        * kjs/JSObject.cpp:
+        (KJS::callDefaultValueFunction): Use isGetterSetter instead of type.
+        (KJS::JSObject::getPrimitiveNumber): Use PreferredPrimitiveType.
+        (KJS::JSObject::defaultValue): Ditto.
+        (KJS::JSObject::defineGetter): Use isGetterSetter.
+        (KJS::JSObject::defineSetter): Ditto.
+        (KJS::JSObject::lookupGetter): Ditto.
+        (KJS::JSObject::lookupSetter): Ditto.
+        (KJS::JSObject::toNumber): Use PreferredPrimitiveType.
+        (KJS::JSObject::toString): Ditto.
+        (KJS::JSObject::isObject): Added.
+
+        * kjs/JSObject.h:
+        (KJS::JSObject::inherits): Call the isObject from JSCell; it's now
+        hidden by our override of isObject.
+        (KJS::JSObject::getOwnPropertySlotForWrite): Use isGetterSetter
+        instead of type.
+        (KJS::JSObject::getOwnPropertySlot): Ditto.
+        (KJS::JSObject::toPrimitive): Use PreferredPrimitiveType.
+
+        * kjs/JSString.cpp:
+        (KJS::JSString::toPrimitive): Use PreferredPrimitiveType.
+        (KJS::JSString::isString): Added.
+        * kjs/JSString.h: Ditto.
+
+        * kjs/JSValue.h: Removed type(), added isGetterSetter(). Added
+        PreferredPrimitiveType enum and used it as the argument for the
+        toPrimitive function.
+        (KJS::JSValue::getBoolean): Simplified a bit an removed a branch.
+
+        * kjs/collector.cpp:
+        (KJS::typeName): Changed to use JSCell::is functions instead of
+        calling JSCell::type.
+
+        * kjs/collector.h:
+        (KJS::Heap::isNumber): Renamed from fastIsNumber.
+
+        * kjs/nodes.h: Added now-needed include of JSType, since the type
+        is used here to record types of values in the tree.
+
+        * kjs/operations.cpp:
+        (KJS::equal): Rewrote to no longer depend on type().
+        (KJS::strictEqual): Ditto.
+
+2008-08-18  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        If there are no nodes in a profile all the time should be attributed to
+        (idle)
+
+        * profiler/Profile.cpp: If ther are no nodes make sure we still process
+        the head.
+        (KJS::Profile::forEach):
+        * profiler/ProfileGenerator.cpp: Remove some useless code.
+        (KJS::ProfileGenerator::stopProfiling):
+
+2008-08-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej.
+
+        Make JSGlobalContextRetain/Release actually work.
+
+        * API/JSContextRef.cpp:
+        (JSGlobalContextRetain):
+        (JSGlobalContextRelease):
+        Ref/deref global data to give checking for globalData.refCount() some sense.
+
+        * API/tests/testapi.c: (main): Added a test for this bug.
+
+        * kjs/JSGlobalData.cpp:
+        (KJS::JSGlobalData::~JSGlobalData):
+        While checking for memory leaks, found that JSGlobalData::emptyList has changed to
+        a pointer, but it was not destructed, causing a huge leak in run-webkit-tests --threaded.
+
+2008-08-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Change the counting of constants so that preincrement and predecrement of
+        const local variables are considered unexpected loads.
+
+        * kjs/nodes.cpp:
+        (KJS::PrefixResolveNode::emitCode):
+        * kjs/nodes.h:
+        (KJS::ScopeNode::neededConstants):
+
+2008-08-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        <rdar://problem/6150322> In Gmail, a crash occurs at KJS::Machine::privateExecute() when applying list styling to text after a quote had been removed
+        <https://bugs.webkit.org/show_bug.cgi?id=20386>
+
+        This crash was caused by "depth()" incorrectly determining the scope depth 
+        of a 0 depth function without a full scope chain.  Because such a function
+        would not have an activation the depth function would return the scope depth
+        of the parent frame, thus triggering an incorrect unwind.  Any subsequent 
+        look up that walked the scope chain would result in incorrect behaviour,
+        leading to a crash or incorrect variable resolution.  This can only actually
+        happen in try...finally statements as that's the only path that can result in
+        the need to unwind the scope chain, but not force the function to need a
+        full scope chain.
+
+        The fix is simply to check for this case before attempting to walk the scope chain.
+
+        * VM/Machine.cpp:
+        (KJS::depth):
+        (KJS::Machine::throwException):
+
+2008-08-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej.
+
+        Bug 20419: Remove op_jless
+        <https://bugs.webkit.org/show_bug.cgi?id=20419>
+
+        Remove op_jless, which is rarely used now that we have op_loop_if_less.
+
+        * VM/CodeBlock.cpp:
+        (KJS::CodeBlock::dump):
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::emitJumpIfTrue):
+        * VM/Machine.cpp:
+        (KJS::Machine::privateExecute):
+        * VM/Opcode.h:
+
+2008-08-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Dan Bernstein.
+
+        Fix a typo in r35807 that is also causing build failures for
+        non-AllInOne builds.
+
+        * kjs/NumberConstructor.cpp:
+
+2008-08-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Made room for a free word in JSCell.
+        
+        SunSpider says no change.
+        
+        I changed JSCallbackObjectData, Arguments, JSArray, and RegExpObject to
+        store auxiliary data in a secondary structure.
+
+        I changed InternalFunction to store the function's name in the property
+        map.
+        
+        I changed JSGlobalObjectData to use a virtual destructor, so WebCore's
+        JSDOMWindowBaseData could inherit from it safely. (It's a strange design
+        for JSDOMWindowBase to allocate an object that JSGlobalObject deletes,
+        but that's really our only option, given the size constraint.)
+        
+        I also added a bunch of compile-time ASSERTs, and removed lots of comments
+        in JSObject.h because they were often out of date, and they got in the
+        way of reading what was actually going on.
+        
+        Also renamed JSArray::getLength to JSArray::length, to match our style
+        guidelines.
+
+2008-08-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Sped up property access for array.length and string.length by adding a
+        mechanism for returning a temporary value directly instead of returning
+        a pointer to a function that retrieves the value.
+        
+        Also removed some unused cruft from PropertySlot.
+        
+        SunSpider says 0.5% - 1.2% faster.
+
+        NOTE: This optimization is not a good idea in general, because it's
+        actually a pessimization in the case of resolve for assignment,
+        and it may get in the way of other optimizations in the future.
+        
+2008-08-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Disable dead code stripping in debug builds.
+
+        * Configurations/Base.xcconfig:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2008-08-15  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6143072> FastMallocZone's enumeration code makes assumptions about handling of remote memory regions that overlap
+
+        * wtf/FastMalloc.cpp:
+        (WTF::TCMalloc_Central_FreeList::enumerateFreeObjects): Don't directly compare pointers mapped into the local process with
+        a pointer that has not been mapped.  Instead, calculate a local address for the pointer and compare with that.
+        (WTF::TCMallocStats::FreeObjectFinder::findFreeObjects): Pass in the remote address of the central free list so that it can
+        be used when calculating local addresses.
+        (WTF::TCMallocStats::FastMallocZone::enumerate): Ditto.
+
+2008-08-15  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Geoff Garen.
+
+        <rdar://problem/6139914> Please include a _debug version of JavaScriptCore framework
+
+        * Configurations/Base.xcconfig: Factor out the debug-only settings so that they can shared
+        between the Debug configuration and debug Production variant.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Enable the debug variant.
+
+2008-08-15  Mark Rowe  <mrowe@apple.com>
+
+        Fix the 64-bit build.
+
+        Add extra cast to avoid warnings about loss of precision when casting from
+        JSValue* to an integer type.
+
+        * kjs/JSImmediate.h:
+        (KJS::JSImmediate::intValue):
+        (KJS::JSImmediate::uintValue):
+
+2008-08-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Still fixing Windows build.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make: Added OpaqueJSString
+        to yet another place.
+
+2008-08-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Trying to fix non-Apple builds.
+
+        * ForwardingHeaders/JavaScriptCore/OpaqueJSString.h: Added.
+
+2008-08-15  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Allow JSImmediate to hold 31 bit signed integer immediate values.  The low two bits of a
+        JSValue* are a tag, with the tag value 00 indicating the JSValue* is a pointer to a
+        JSCell.  Non-zero tag values used to indicate that the JSValue* is not a real pointer,
+        but instead holds an immediate value encoded within the pointer.  This patch changes the
+        encoding so both the tag values 01 and 11 indicate the value is a signed integer, allowing
+        a 31 bit value to be stored.  All other immediates are tagged with the value 10, and
+        distinguished by a secondary tag.
+
+        Roughly +2% on SunSpider.
+
+        * kjs/JSImmediate.h: Encoding of JSImmediates has changed - see comment at head of file for
+                             descption of new layout.
+
+2008-08-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        More build fixes.
+
+        * API/OpaqueJSString.h: Add a namespace to friend declaration to appease MSVC.
+        * API/JSStringRefCF.h: (JSStringCreateWithCFString) Cast UniChar* to UChar* explicitly.
+        * JavaScriptCore.exp: Added OpaqueJSString::create(const KJS::UString&) to fix WebCore build.
+
+2008-08-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Build fix.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Marked OpaqueJSString as private
+
+        * kjs/identifier.cpp:
+        (KJS::Identifier::checkSameIdentifierTable):
+        * kjs/identifier.h:
+        (KJS::Identifier::add):
+        Since checkSameIdentifierTable is exported for debug build's sake, gcc wants it to be
+        non-inline in release builds, too.
+
+        * JavaScriptCore.exp: Don't export inline OpaqueJSString destructor.
+
+2008-08-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        JSStringRef is created context-free, but can get linked to one via an identifier table,
+        breaking an implicit API contract.
+
+        Made JSStringRef point to OpaqueJSString, which is a new string object separate from UString.
+
+        * API/APICast.h: Removed toRef/toJS conversions for JSStringRef, as this is no longer a
+        simple typecast.
+
+        * kjs/identifier.cpp:
+        (KJS::Identifier::checkSameIdentifierTable):
+        * kjs/identifier.h:
+        (KJS::Identifier::add):
+        (KJS::UString::checkSameIdentifierTable):
+        Added assertions to verify that an identifier is not being added to a different JSGlobalData.
+
+        * API/JSObjectRef.cpp:
+        (OpaqueJSPropertyNameArray::OpaqueJSPropertyNameArray): Changed OpaqueJSPropertyNameArray to
+        hold JSStringRefs. This is necessary to avoid having to construct (and leak) a new instance
+        in JSPropertyNameArrayGetNameAtIndex(), now that making a JSStringRef is not just a typecast.
+
+        * API/OpaqueJSString.cpp: Added.
+        (OpaqueJSString::create):
+        (OpaqueJSString::ustring):
+        (OpaqueJSString::identifier):
+        * API/OpaqueJSString.h: Added.
+        (OpaqueJSString::create):
+        (OpaqueJSString::characters):
+        (OpaqueJSString::length):
+        (OpaqueJSString::OpaqueJSString):
+        (OpaqueJSString::~OpaqueJSString):
+
+        * API/JSBase.cpp:
+        (JSEvaluateScript):
+        (JSCheckScriptSyntax):
+        * API/JSCallbackObjectFunctions.h:
+        (KJS::::getOwnPropertySlot):
+        (KJS::::put):
+        (KJS::::deleteProperty):
+        (KJS::::staticValueGetter):
+        (KJS::::callbackGetter):
+        * API/JSStringRef.cpp:
+        (JSStringCreateWithCharacters):
+        (JSStringCreateWithUTF8CString):
+        (JSStringRetain):
+        (JSStringRelease):
+        (JSStringGetLength):
+        (JSStringGetCharactersPtr):
+        (JSStringGetMaximumUTF8CStringSize):
+        (JSStringGetUTF8CString):
+        (JSStringIsEqual):
+        * API/JSStringRefCF.cpp:
+        (JSStringCreateWithCFString):
+        (JSStringCopyCFString):
+        * API/JSValueRef.cpp:
+        (JSValueMakeString):
+        (JSValueToStringCopy):
+        Updated to use OpaqueJSString.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pri:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * JavaScriptCoreSources.bkl:
+        Added OpaqueJSString.
+
+2008-08-14  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        <rdar://problem/6115819> Notify of profile in console
+        - Profiles now have a unique ID so that they can be linked to the
+        console message that announces that a profile completed.
+
+        * profiler/HeavyProfile.cpp: 
+        (KJS::HeavyProfile::HeavyProfile):
+        * profiler/Profile.cpp:
+        (KJS::Profile::create):
+        (KJS::Profile::Profile):
+        * profiler/Profile.h:
+        (KJS::Profile::uid):
+        * profiler/ProfileGenerator.cpp:
+        (KJS::ProfileGenerator::create):
+        (KJS::ProfileGenerator::ProfileGenerator):
+        * profiler/ProfileGenerator.h:
+        * profiler/Profiler.cpp:
+        (KJS::Profiler::startProfiling):
+        * profiler/TreeProfile.cpp:
+        (KJS::TreeProfile::create):
+        (KJS::TreeProfile::TreeProfile):
+        * profiler/TreeProfile.h:
+
+2008-08-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Nixed a PIC branch from JSObject::getOwnPropertySlot, by forcing
+        fillGetterProperty, which references a global function pointer,
+        out-of-line.
+        
+        .2% SunSpider speedup, 4.3% access-nbody speedup, 8.7% speedup on a
+        custom property access benchmark for objects with one property.
+
+        * kjs/JSObject.cpp:
+        (KJS::JSObject::fillGetterPropertySlot):
+
+2008-08-13  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20349
+        WTF::initializeThreading() fails if threading is already initialized
+
+        Fix threading initialization logic to support cases where
+        g_thread_init() has already been called elsewhere.
+
+        Resolves database-related crashers reported in several applications.
+
+        * wtf/ThreadingGtk.cpp:
+        (WTF::initializeThreading):
+
+2008-08-13  Brad Hughes <bhughes@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix compiling of QtWebKit in release mode with the Intel C++ Compiler for Linux
+
+        The latest upgrade of the intel compiler allows us to compile all of
+        Qt with optimizations enabled (yay!).
+
+        * JavaScriptCore.pro:
+
+2008-08-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Add peephole optimisation to 'op_not... jfalse...' (eg. if(!...) )
+
+        This is a very slight win in sunspider, and a fairly substantial win
+        in hot code that does if(!...), etc.
+
+        * VM/CodeGenerator.cpp:
+        (KJS::CodeGenerator::retrieveLastUnaryOp):
+        (KJS::CodeGenerator::rewindBinaryOp):
+        (KJS::CodeGenerator::rewindUnaryOp):
+        (KJS::CodeGenerator::emitJumpIfFalse):
+        * VM/CodeGenerator.h:
+
+2008-08-12  Dan Bernstein  <mitz@apple.com>
+
+        - JavaScriptCore part of <rdar://problem/6121636>
+          Make fast*alloc() abort() on failure and add "try" variants that
+          return NULL on failure.
+
+        Reviewed by Darin Adler.
+
+        * JavaScriptCore.exp: Exported tryFastCalloc().
+        * VM/RegisterFile.h:
+        (KJS::RegisterFile::RegisterFile): Removed an ASSERT().
+        * kjs/JSArray.cpp:
+        (KJS::JSArray::putSlowCase): Changed to use tryFastRealloc().
+        (KJS::JSArray::increaseVectorLength): Ditto.
+        * kjs/ustring.cpp:
+        (KJS::allocChars): Changed to use tryFastMalloc().
+        (KJS::reallocChars): Changed to use tryFastRealloc().
+        * wtf/FastMalloc.cpp:
+        (WTF::fastZeroedMalloc): Removed null checking of fastMalloc()'s result
+        and removed extra call to InvokeNewHook().
+        (WTF::tryFastZeroedMalloc): Added. Uses tryFastMalloc().
+        (WTF::tryFastMalloc): Renamed fastMalloc() to this.
+        (WTF::fastMalloc): Added. This version abort()s if allocation fails.
+        (WTF::tryFastCalloc): Renamed fastCalloc() to this.
+        (WTF::fastCalloc): Added. This version abort()s if allocation fails.
+        (WTF::tryFastRealloc): Renamed fastRealloc() to this.
+        (WTF::fastRealloc): Added. This version abort()s if allocation fails.
+        (WTF::do_malloc): Made this a function template. When the abortOnFailure
+        template parameter is set, the function abort()s on failure to allocate.
+        Otherwise, it sets errno to ENOMEM and returns zero.
+        (WTF::TCMallocStats::fastMalloc): Defined to abort() on failure.
+        (WTF::TCMallocStats::tryFastMalloc): Added. Does not abort() on
+        failure.
+        (WTF::TCMallocStats::fastCalloc): Defined to abort() on failure.
+        (WTF::TCMallocStats::tryFastCalloc): Added. Does not abort() on
+        failure.
+        (WTF::TCMallocStats::fastRealloc): Defined to abort() on failure.
+        (WTF::TCMallocStats::tryFastRealloc): Added. Does not abort() on
+        failure.
+        * wtf/FastMalloc.h: Declared the "try" variants.
+
+2008-08-11  Adam Roben  <aroben@apple.com>
+
+        Move WTF::notFound into its own header so that it can be used
+        independently of Vector
+
+        Rubberstamped by Darin Adler.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        Added NotFound.h to the project.
+        * wtf/NotFound.h: Added. Moved the notFound constant here...
+        * wtf/Vector.h: ...from here.
+
+2008-08-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6130393> REGRESSION: PhotoBooth hangs after launching under TOT Webkit
+
+        * API/JSContextRef.cpp: (JSGlobalContextRelease): Corrected a comment.
+
+        * kjs/collector.cpp: (KJS::Heap::~Heap): Ensure that JSGlobalData is not deleted while
+        sweeping the heap.
+
+== Rolled over to ChangeLog-2008-08-10 ==
diff --git a/src/3rdparty/webkit/JavaScriptCore/DerivedSources.make b/src/3rdparty/webkit/JavaScriptCore/DerivedSources.make
index 865ba7c..9eaccab 100644
--- a/src/3rdparty/webkit/JavaScriptCore/DerivedSources.make
+++ b/src/3rdparty/webkit/JavaScriptCore/DerivedSources.make
@@ -1,4 +1,4 @@
-# Copyright (C) 2006, 2007, 2008 2009 Apple Inc. All rights reserved.
+# Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -40,13 +40,14 @@ all : \
     chartables.c \
     DatePrototype.lut.h \
     Grammar.cpp \
+    JSONObject.lut.h \
     Lexer.lut.h \
     MathObject.lut.h \
     NumberConstructor.lut.h \
     RegExpConstructor.lut.h \
     RegExpObject.lut.h \
     StringPrototype.lut.h \
-    $(JavaScriptCore)/docs/bytecode.html \
+    docs/bytecode.html \
 #
 
 # lookup tables for classes
@@ -71,5 +72,5 @@ Grammar.cpp: Grammar.y
 chartables.c : dftables
 	$^ $@
 
-$(JavaScriptCore)/docs/bytecode.html: make-bytecode-docs.pl Interpreter.cpp 
+docs/bytecode.html: make-bytecode-docs.pl Interpreter.cpp 
 	perl $^ $@
diff --git a/src/3rdparty/webkit/JavaScriptCore/Info.plist b/src/3rdparty/webkit/JavaScriptCore/Info.plist
index 55537af..17949b0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/Info.plist
+++ b/src/3rdparty/webkit/JavaScriptCore/Info.plist
@@ -7,7 +7,7 @@
 	<key>CFBundleExecutable</key>
 	<string>${PRODUCT_NAME}</string>
 	<key>CFBundleGetInfoString</key>
-	<string>${BUNDLE_VERSION}, Copyright 2003-2007 Apple Inc.; Copyright 1999-2001 Harri Porten &lt;porten@kde.org&gt;; Copyright 2001 Peter Kelly &lt;pmk@post.com&gt;; Copyright 1997-2005 University of Cambridge; Copyright 1991, 2000, 2001 by Lucent Technologies.</string>
+	<string>${BUNDLE_VERSION}, Copyright 2003-2009 Apple Inc.; Copyright 1999-2001 Harri Porten &lt;porten@kde.org&gt;; Copyright 2001 Peter Kelly &lt;pmk@post.com&gt;; Copyright 1997-2005 University of Cambridge; Copyright 1991, 2000, 2001 by Lucent Technologies.</string>
 	<key>CFBundleIdentifier</key>
 	<string>com.apple.${PRODUCT_NAME}</string>
 	<key>CFBundleInfoDictionaryVersion</key>
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.order b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.order
index 9f7cb30..3ae3ec6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.order
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.order
@@ -1,1526 +1,1965 @@
 __ZN3WTF10fastMallocEm
+__ZN3WTF10fastMallocILb1EEEPvm
 __ZN3WTF20TCMalloc_ThreadCache10InitModuleEv
-__ZN3WTF15InitSizeClassesEv
+__ZN3WTFL15InitSizeClassesEv
 __Z20TCMalloc_SystemAllocmPmm
-__ZN3WTF17TCMalloc_PageHeap4initEv
+__ZN3WTFL13MetaDataAllocEm
 __ZN3WTF20TCMalloc_ThreadCache22CreateCacheIfNecessaryEv
 __ZN3WTF25TCMalloc_Central_FreeList11RemoveRangeEPPvS2_Pi
 __ZN3WTF25TCMalloc_Central_FreeList18FetchFromSpansSafeEv
 __ZN3WTF17TCMalloc_PageHeap10AllocLargeEm
 __ZN3WTF17TCMalloc_PageHeap8GrowHeapEm
-__ZN3WTF13MetaDataAllocEm
-__ZN3WTF17TCMalloc_PageHeap19IncrementalScavengeEm
+__ZN3WTF19initializeThreadingEv
+__ZN3WTF20initializeMainThreadEv
+__ZN3WTF5MutexC1Ev
+__ZN3WTF28initializeMainThreadPlatformEv
+__ZN3WTF36lockAtomicallyInitializedStaticMutexEv
 __ZN3WTF8fastFreeEPv
+__ZN3WTF38unlockAtomicallyInitializedStaticMutexEv
+__ZN3JSC19initializeThreadingEv
+__ZN3JSCL23initializeThreadingOnceEv
+__ZN3JSC17initializeUStringEv
+__ZN3JSC12initDateMathEv
+__ZN3WTF11currentTimeEv
+__ZN3WTF15ThreadConditionC1Ev
+__ZN3WTF5Mutex4lockEv
+__ZN3WTF5Mutex6unlockEv
+__ZN3WTF12createThreadEPFPvS0_ES0_PKc
+__ZN3WTF20createThreadInternalEPFPvS0_ES0_PKc
+__ZN3WTFL35establishIdentifierForPthreadHandleERP17_opaque_pthread_t
+__ZN3WTF9HashTableIjSt4pairIjP17_opaque_pthread_tENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTrai
+__ZN3WTFL16threadEntryPointEPv
 __ZN3WTF16fastZeroedMallocEm
+__ZN3WTF21setThreadNameInternalEPKc
+__ZN3WTF5MutexD1Ev
+__ZN3WTF25TCMalloc_Central_FreeList11InsertRangeEPvS1_i
+__ZN3WTF25TCMalloc_Central_FreeList18ReleaseListToSpansEPv
+__ZN3WTF12isMainThreadEv
 __ZN3WTF14FastMallocZone4sizeEP14_malloc_zone_tPKv
-__ZN3KJS8Bindings10RootObject19setCreateRootObjectEPFN3WTF10PassRefPtrIS1_EEPvE
-__ZN3KJS8Bindings8Instance21setDidExecuteFunctionEPFvPNS_9ExecStateEPNS_8JSObjectEE
-_kjs_strtod
-__Z15jsRegExpCompilePKti24JSRegExpIgnoreCaseOption23JSRegExpMultilineOptionPjPPKc
-__Z30calculateCompiledPatternLengthPKti24JSRegExpIgnoreCaseOptionR11CompileDataR9ErrorCode
-__Z11checkEscapePPKtS0_P9ErrorCodeib
-__Z13compileBranchiPiPPhPPKtS3_P9ErrorCodeS_S_R11CompileData
-__Z15jsRegExpExecutePK8JSRegExpPKtiiPii
+__ZN3WTF13currentThreadEv
+__ZN3WTF16callOnMainThreadEPFvPvES0_
+__ZN3WTF5DequeINS_19FunctionWithContextEE14expandCapacityEv
+__ZN3WTF37scheduleDispatchFunctionsOnMainThreadEv
+__ZN3WTF15ThreadCondition4waitERNS_5MutexE
+__ZN3JSC8DebuggerC2Ev
+__ZN3WTF6strtodEPKcPPc
+__ZN3WTF15ThreadCondition6signalEv
+__ZN3WTF15ThreadCondition9timedWaitERNS_5MutexEd
+__ZN3WTF15ThreadCondition9broadcastEv
+-[WTFMainThreadCaller call]
+__ZN3WTF31dispatchFunctionsFromMainThreadEv
+__ZN3WTF14FastMallocZone9forceLockEP14_malloc_zone_t
 __ZN3WTF11fastReallocEPvm
-__ZN3KJS20createDidLockJSMutexEv
-__ZN3KJS9Collector14registerThreadEv
-__ZN3KJS29initializeRegisteredThreadKeyEv
-__ZN3KJS15SavedPropertiesC1Ev
-__ZN3KJS6JSCellnwEm
-__ZN3KJS9Collector12heapAllocateILNS0_8HeapTypeE0EEEPvm
-__ZN3KJS15GlobalExecStateC1EPNS_14JSGlobalObjectE
-__ZN3KJS17CommonIdentifiers6sharedEv
-__ZN3KJS17CommonIdentifiersC2Ev
-__ZN3KJS10IdentifierC1EPKc
-__ZN3KJS10Identifier3addEPKc
-__ZN3WTF7HashSetIPN3KJS7UString3RepENS_7StrHashIS4_EENS_10HashTraitsIS4_EEE3addINS1_11UCharBufferENS1_21UCharBufferTranslatorEEESt4pairINS_24HashTableIteratorAdapterINS_9HashTableIS4_S4_NS_17IdentityExtractorIS4_EES6_S8_S8_EES4_EEbERKT_
-__ZN3WTF9HashTableIPN3KJS7UString3RepES4_NS_17IdentityExtractorIS4_EENS_7StrHashIS4_EENS_10HashTraitsIS4_EESA_E6rehashEi
-__ZN3KJS14JSGlobalObject4initEv
-__ZN3KJS14JSGlobalObject5resetEPNS_7JSValueE
-__ZN3KJS11PropertyMap5clearEv
-__ZN3KJS17FunctionPrototypeC2EPNS_9ExecStateE
-__ZN3KJS11PropertyMap3putERKNS_10IdentifierEPNS_7JSValueEjb
-__ZN3KJS17PrototypeFunctionC1EPNS_9ExecStateEPNS_17FunctionPrototypeEiRKNS_10IdentifierEPFPNS_7JSValueES2_PNS_8JSObjectERKNS_4ListEE
-__ZN3KJS19InternalFunctionImpC2EPNS_17FunctionPrototypeERKNS_10IdentifierE
-__ZN3KJS11PropertyMap11createTableEv
-__ZN3KJS15ObjectPrototypeC2EPNS_9ExecStateEPNS_17FunctionPrototypeE
-__ZN3KJS11PropertyMap6rehashEj
-__ZN3KJS14ArrayPrototypeC1EPNS_9ExecStateEPNS_15ObjectPrototypeE
-__ZN3KJS13ArrayInstanceC2EPNS_8JSObjectEj
-__ZN3KJS15StringPrototypeC2EPNS_9ExecStateEPNS_15ObjectPrototypeE
-__ZN3KJS8jsStringEPKc
-__ZN3KJS16BooleanPrototypeC2EPNS_9ExecStateEPNS_15ObjectPrototypeEPNS_17FunctionPrototypeE
-__ZN3KJS15NumberPrototypeC2EPNS_9ExecStateEPNS_15ObjectPrototypeEPNS_17FunctionPrototypeE
-__ZN3KJS13DatePrototypeC1EPNS_9ExecStateEPNS_15ObjectPrototypeE
-__ZN3KJS12jsNumberCellEd
-__ZN3KJS9Collector12heapAllocateILNS0_8HeapTypeE1EEEPvm
-__ZN3KJS15RegExpPrototypeC2EPNS_9ExecStateEPNS_15ObjectPrototypeEPNS_17FunctionPrototypeE
-__ZN3WTF9HashTableIPN3KJS7UString3RepES4_NS_17IdentityExtractorIS4_EENS_7StrHashIS4_EENS_10HashTraitsIS4_EESA_E4findIS4_NS_22IdentityHashTranslatorIS4_S4_S8_EEEENS_17HashTableIteratorIS4_S4_S6_S8_SA_SA_EERKT_
-__ZN3KJS14ErrorPrototypeC2EPNS_9ExecStateEPNS_15ObjectPrototypeEPNS_17FunctionPrototypeE
-__ZN3KJS7UStringC1EPKc
-__ZN3KJS20NativeErrorPrototypeC1EPNS_9ExecStateEPNS_14ErrorPrototypeERKNS_7UStringES7_
-__ZN3KJS8jsStringERKNS_7UStringE
-__ZN3KJS15ObjectObjectImpC2EPNS_9ExecStateEPNS_15ObjectPrototypeEPNS_17FunctionPrototypeE
-__ZN3KJS17FunctionObjectImpC2EPNS_9ExecStateEPNS_17FunctionPrototypeE
-__ZNK3KJS19InternalFunctionImp9classInfoEv
-__ZN3KJS14ArrayObjectImpC2EPNS_9ExecStateEPNS_17FunctionPrototypeEPNS_14ArrayPrototypeE
-__ZNK3KJS14ArrayPrototype9classInfoEv
-__ZN3KJS15StringObjectImpC2EPNS_9ExecStateEPNS_17FunctionPrototypeEPNS_15StringPrototypeE
-__ZNK3KJS15StringPrototype9classInfoEv
-__ZN3KJS19StringObjectFuncImpC2EPNS_9ExecStateEPNS_17FunctionPrototypeERKNS_10IdentifierE
-__ZN3KJS16BooleanObjectImpC2EPNS_9ExecStateEPNS_17FunctionPrototypeEPNS_16BooleanPrototypeE
-__ZNK3KJS15BooleanInstance9classInfoEv
-__ZN3KJS15NumberObjectImpC2EPNS_9ExecStateEPNS_17FunctionPrototypeEPNS_15NumberPrototypeE
-__ZNK3KJS14NumberInstance9classInfoEv
-__ZN3KJS13DateObjectImpC2EPNS_9ExecStateEPNS_17FunctionPrototypeEPNS_13DatePrototypeE
-__ZNK3KJS13DatePrototype9classInfoEv
-__ZN3KJS15RegExpObjectImpC2EPNS_9ExecStateEPNS_17FunctionPrototypeEPNS_15RegExpPrototypeE
-__ZN3KJS14ErrorObjectImpC2EPNS_9ExecStateEPNS_17FunctionPrototypeEPNS_14ErrorPrototypeE
-__ZNK3KJS13ErrorInstance9classInfoEv
-__ZN3KJS14NativeErrorImpC1EPNS_9ExecStateEPNS_17FunctionPrototypeEPNS_20NativeErrorPrototypeE
-__ZNK3KJS11PropertyMap3getERKNS_10IdentifierE
-__ZNK3KJS9StringImp4typeEv
-__ZN3KJS10Identifier11addSlowCaseEPNS_7UString3RepE
-__ZN3WTF9HashTableIPN3KJS7UString3RepES4_NS_17IdentityExtractorIS4_EENS_7StrHashIS4_EENS_10HashTraitsIS4_EESA_E3addIS4_S4_NS_17HashSetTranslatorILb1ES4_SA_SA_S8_EEEESt4pairINS_17HashTableIteratorIS4_S4_S6_S8_SA_SA_EEbERKT_RKT0_
-__ZN3KJS8JSObject9putDirectERKNS_10IdentifierEPNS_7JSValueEi
-__ZN3KJS13MathObjectImpC1EPNS_9ExecStateEPNS_15ObjectPrototypeE
-__ZN3KJS8JSObject17putDirectFunctionEPNS_19InternalFunctionImpEi
-__ZNK3KJS8JSObject4typeEv
-__ZN3KJS9Collector23collectOnMainThreadOnlyEPNS_7JSValueE
-__ZN3KJS9Collector7protectEPNS_7JSValueE
-__ZN3WTF9HashTableIiSt4pairIiiENS_18PairFirstExtractorIS2_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEES9_EES9_E3addIPN3KJS8JSObjectEjNS_17HashMapTranslatorILb1ES1_ISF_jENS_18PairBaseHashTraitsINS8_ISF_EENS8_IjEEEESA_NS_7PtrHashISF_EEEEEES1_INS_17HashTableIteratorIiS2_S4_S6_SA_S9_EEbERKT_RKT0_
-__ZN3WTF9HashTableIiSt4pairIiiENS_18PairFirstExtractorIS2_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEES9_EES9_E6rehashEi
-__ZN3KJS6JSCell9getObjectEv
-__ZN3KJS8Bindings10RootObject6createEPKvPNS_14JSGlobalObjectE
-__ZN3KJS8Bindings10RootObjectC2EPKvPNS_14JSGlobalObjectE
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E6rehashEi
-__ZN3KJS8Bindings10RootObject9gcProtectEPNS_8JSObjectE
-__ZNK3KJS14JSGlobalObject12saveBuiltinsERNS_13SavedBuiltinsE
-__ZN3KJS21SavedBuiltinsInternalC2Ev
-__ZNK3KJS11PropertyMap4saveERNS_15SavedPropertiesE
-__ZN3KJS30comparePropertyMapEntryIndicesEPKvS1_
-__ZN3WTF9HashTableIiSt4pairIiiENS_18PairFirstExtractorIS2_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEES9_EES9_E4findIiNS_22IdentityHashTranslatorIiS2_S6_EEEENS_17HashTableIteratorIiS2_S4_S6_SA_S9_EERKT_
-__ZNK3KJS16JSVariableObject16saveLocalStorageERNS_15SavedPropertiesE
-__ZN3KJS13ActivationImpD0Ev
-__ZN3KJS8JSObject12removeDirectERKNS_10IdentifierE
-__ZN3KJS11PropertyMap6removeERKNS_10IdentifierE
-__ZN3KJS7UString3Rep7destroyEv
-__ZN3KJS10Identifier6removeEPNS_7UString3RepE
-__ZN3KJS8Bindings10RootObject10invalidateEv
-__ZN3KJS9Collector9unprotectEPNS_7JSValueE
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E4findIiNS_22IdentityHashTranslatorIiiS4_EEEENS_17HashTableIteratorIiiS2_S4_S6_S6_EERKT_
-__ZN3KJS8Bindings10RootObjectD1Ev
-__ZN3KJS14JSGlobalObject10globalExecEv
-__ZN3KJS14JSGlobalObject17startTimeoutCheckEv
-__ZN3KJS7UStringC1EPKNS_5UCharEi
-__ZN3KJS11Interpreter8evaluateEPNS_9ExecStateERKNS_7UStringEiPKNS_5UCharEiPNS_7JSValueE
-__ZN3KJS6ParserC2Ev
-__ZN3KJS6Parser5parseINS_11ProgramNodeEEEN3WTF10PassRefPtrIT_EERKNS_7UStringEiPKNS_5UCharEjPiSD_PS7_
-__ZN3KJS6Parser5parseEiPKNS_5UCharEjPiS4_PNS_7UStringE
-__ZN3KJS7UStringaSEPKc
-__ZN3KJS5LexerC2Ev
-__ZN3WTF6VectorIcLm0EE15reserveCapacityEm
-__ZN3WTF6VectorIN3KJS5UCharELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIPN3KJS7UStringELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIPN3KJS10IdentifierELm0EE15reserveCapacityEm
-__Z10kjsyyparsev
-__Z8kjsyylexv
-__ZN3KJS5Lexer3lexEv
-__ZN3KJS5Lexer14makeIdentifierERKN3WTF6VectorINS_5UCharELm0EEE
-__ZN3KJS10Identifier3addEPKNS_5UCharEi
-__ZN3KJS5Lexer15matchPunctuatorEiiii
-__ZN3KJS7UStringC2ERKN3WTF6VectorINS_5UCharELm0EEE
-__ZN3KJS14ExpressionNodeC2ENS_6JSTypeE
-__ZN3KJS16ParserRefCountedC2Ev
-__ZN3KJS7UStringC1ERKS0_
-__ZN3KJS4NodeC2Ev
-__ZN3KJS10IdentifierC1ERKS0_
-__ZN3WTF6RefPtrIN3KJS14ExpressionNodeEEC1EPS2_
-__ZN3KJS16ParserRefCounted3refEv
-__ZN3WTF6RefPtrIN3KJS12PropertyNodeEEC1EPS2_
-__ZN3WTF10ListRefPtrIN3KJS16PropertyListNodeEEC1Ev
-__ZN3KJS11ResolveNodeC1ERKNS_10IdentifierE
-__ZN3KJS14ExpressionNodeC2Ev
-__ZN3WTF10ListRefPtrIN3KJS16ArgumentListNodeEEC1Ev
-__Z20makeFunctionCallNodePN3KJS14ExpressionNodeEPNS_13ArgumentsNodeE
-__ZNK3KJS15DotAccessorNode10isLocationEv
-__ZNK3KJS14ExpressionNode13isResolveNodeEv
-__ZNK3KJS14ExpressionNode21isBracketAccessorNodeEv
-__Z14makeNumberNoded
-__Z14makeNegateNodePN3KJS14ExpressionNodeE
-__ZNK3KJS10NumberNode8isNumberEv
-__ZN3KJS19ImmediateNumberNode8setValueEd
-__ZN3KJS5lexerEv
-__ZN3KJS5Lexer10scanRegExpEv
-__ZN3KJS6RegExp6createERKNS_7UStringES3_
-__ZNK3KJS7UString4findENS_5UCharEi
-__ZN3KJS17ObjectLiteralNodeC1EPNS_16PropertyListNodeE
-__Z14compileBracketiPiPPhPPKtS3_P9ErrorCodeiS_S_R11CompileData
-__ZN3KJS16FunctionBodyNode6createEPNS_14SourceElementsEPN3WTF6VectorISt4pairINS_10IdentifierEjELm16EEEPNS4_IPNS_12FuncDeclNodeELm16EEE
-__ZN3KJS16FunctionBodyNodeC2EPNS_14SourceElementsEPN3WTF6VectorISt4pairINS_10IdentifierEjELm16EEEPNS4_IPNS_12FuncDeclNodeELm16EEE
-__ZN3KJS9ScopeNodeC2EPNS_14SourceElementsEPN3WTF6VectorISt4pairINS_10IdentifierEjELm16EEEPNS4_IPNS_12FuncDeclNodeELm16EEE
-__ZN3KJS9BlockNodeC1EPNS_14SourceElementsE
-__ZN3KJS13StatementNodeC2Ev
-__ZN3WTF6RefPtrIN3KJS13ParameterNodeEEC1EPS2_
-__ZN3WTF6RefPtrIN3KJS16FunctionBodyNodeEEC1EPS2_
-__ZN3KJS12FuncExprNode9addParamsEv
-__ZN3WTF10ListRefPtrIN3KJS13ParameterNodeEEC1Ev
-__ZN3KJS10ReturnNodeC1EPNS_14ExpressionNodeE
-__Z23allowAutomaticSemicolonv
-__ZN3KJS14SourceElementsC1Ev
-__ZN3WTF10PassRefPtrIN3KJS13StatementNodeEEC1EPS2_
-__ZN3KJS14SourceElements6appendEN3WTF10PassRefPtrINS_13StatementNodeEEE
-__ZNK3KJS13StatementNode16isEmptyStatementEv
-__ZN3WTF6VectorINS_6RefPtrIN3KJS13StatementNodeEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN3KJS13StatementNodeEEELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIN3KJS10IdentifierELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN3KJS10IdentifierELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN3KJS10IdentifierELm0EE15reserveCapacityEm
-__ZN3KJS20ParserRefCountedDataIN3WTF6VectorISt4pairINS_10IdentifierEjELm16EEEEC1Ev
-__Z26appendToVarDeclarationListRPN3KJS20ParserRefCountedDataIN3WTF6VectorISt4pairINS_10IdentifierEjELm16EEEEERKS4_j
-__Z20makeVarStatementNodePN3KJS14ExpressionNodeE
-__Z14makeAssignNodePN3KJS14ExpressionNodeENS_8OperatorES1_
-__ZN3KJS17ExprStatementNodeC1EPNS_14ExpressionNodeE
-__ZN3KJS6IfNodeC2EPNS_14ExpressionNodeEPNS_13StatementNodeE
-__Z21mergeDeclarationListsIPN3KJS20ParserRefCountedDataIN3WTF6VectorISt4pairINS0_10IdentifierEjELm16EEEEEET_SA_SA_
-__Z21mergeDeclarationListsIPN3KJS20ParserRefCountedDataIN3WTF6VectorIPNS0_12FuncDeclNodeELm16EEEEEET_S9_S9_
-__ZNK3KJS11ResolveNode10isLocationEv
-__ZNK3KJS11ResolveNode13isResolveNodeEv
-__Z22combineVarInitializersPN3KJS14ExpressionNodeEPNS_17AssignResolveNodeE
-__ZN3KJS14ExpressionNode28optimizeForUnnecessaryResultEv
-__ZN3WTF6VectorIPN3KJS10IdentifierELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN3KJS10IdentifierELm0EE14expandCapacityEm
-__ZN3KJS12FuncDeclNode9addParamsEv
-__ZN3WTF6VectorIPN3KJS12FuncDeclNodeELm16EEC1Ev
-__ZN3WTF6VectorISt4pairIN3KJS10IdentifierEjELm16EE6appendIS4_EEvPKT_m
-__ZN3KJS16ParserRefCounted5derefEv
-__ZN3KJS20ParserRefCountedDataIN3WTF6VectorISt4pairINS_10IdentifierEjELm16EEEED1Ev
-__Z12makeLessNodePN3KJS14ExpressionNodeES1_
-__Z15makePostfixNodePN3KJS14ExpressionNodeENS_8OperatorE
-__ZN3WTF6RefPtrIN3KJS13StatementNodeEEC1EPS2_
-__ZN3KJS18PostIncResolveNode28optimizeForUnnecessaryResultEv
-__ZN3WTF6VectorISt4pairIN3KJS10IdentifierEjELm16EEaSERKS5_
-__ZN3WTF6VectorIPN3KJS12FuncDeclNodeELm16EEaSERKS4_
-__ZNK3KJS14ExpressionNode10isLocationEv
-__ZNK3KJS19BracketAccessorNode10isLocationEv
-__ZNK3KJS19BracketAccessorNode21isBracketAccessorNodeEv
-__ZN3KJS9ForInNodeC1ERKNS_10IdentifierEPNS_14ExpressionNodeES5_PNS_13StatementNodeE
-__ZN3KJS9ThrowNodeC1EPNS_14ExpressionNodeE
-__Z14makeTypeOfNodePN3KJS14ExpressionNodeE
-__ZN3WTF6VectorINS_6RefPtrIN3KJS13StatementNodeEEELm0EEC1Ev
-__ZN3WTF6RefPtrIN3KJS14CaseClauseNodeEEC1EPS2_
-__ZN3WTF10ListRefPtrIN3KJS14ClauseListNodeEEC1Ev
-__ZN3KJS13CaseBlockNodeC2EPNS_14ClauseListNodeEPNS_14CaseClauseNodeES2_
-__Z11makeAddNodePN3KJS14ExpressionNodeES1_
-__ZN3WTF10ListRefPtrIN3KJS11ElementNodeEEC1Ev
-__ZN3WTF6RefPtrIN3KJS11ElementNodeEEC1EPS2_
-__ZNK3KJS18EmptyStatementNode16isEmptyStatementEv
-__ZN3KJS9BreakNodeC1Ev
-__Z32branchFindFirstAssertedCharacterPKhb
-__Z20branchNeedsLineStartPKhjj
-__ZN3KJS10IdentifierC1ERKNS_7UStringE
-__ZN3WTF6RefPtrIN3KJS7UString3RepEED1Ev
-__ZN3KJS9CommaNodeC2EPNS_14ExpressionNodeES2_
-__Z14makePrefixNodePN3KJS14ExpressionNodeENS_8OperatorE
-__ZN3WTF6RefPtrIN3KJS13ArgumentsNodeEEC1EPS2_
-__ZN3WTF6VectorIPN3KJS7UStringELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN3KJS7UStringELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN3KJS5UCharELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN3KJS5UCharELm0EE14expandCapacityEm
-__ZNK3KJS14ExpressionNode8isNumberEv
-__ZN3KJS19PlaceholderTrueNodeC1Ev
-__ZN3KJS18EmptyStatementNodeC1Ev
-__Z14makeDeleteNodePN3KJS14ExpressionNodeE
-__Z15isCountedRepeatPKtS0_
-__ZN3KJS12ContinueNodeC1Ev
-__ZN3KJS9ForInNodeC1EPNS_14ExpressionNodeES2_PNS_13StatementNodeE
-__ZN3KJS18PostDecResolveNode28optimizeForUnnecessaryResultEv
-__Z17bracketIsAnchoredPKh
-__ZN3WTF6VectorISt4pairIN3KJS10IdentifierEjELm16EE14expandCapacityEmPKS4_
-__ZN3WTF6VectorISt4pairIN3KJS10IdentifierEjELm16EE14expandCapacityEm
-__ZN3WTF6VectorISt4pairIN3KJS10IdentifierEjELm16EE15reserveCapacityEm
-__ZN3KJS7UString4fromEd
-_kjs_dtoa
-_d2b
-_Balloc
-__ZN3KJS6parserEv
-__ZN3KJS6Parser16didFinishParsingEPNS_14SourceElementsEPNS_20ParserRefCountedDataIN3WTF6VectorISt4pairINS_10IdentifierEjELm16EEEEEPNS3_INS5_IPNS_12FuncDeclNodeELm16EEEEEi
-__ZN3KJS5Lexer5clearEv
-__ZN3WTF25TCMalloc_Central_FreeList11InsertRangeEPvS1_i
+__ZN3WTF11fastReallocILb1EEEPvS1_m
+__ZN3JSC7UStringC1EPKti
+__ZN3JSC7UStringC2EPKti
+__ZN3JSC12JSGlobalData12createLeakedEv
+__ZN3JSC9Structure18startIgnoringLeaksEv
+__ZN3JSC7VPtrSetC2Ev
+__ZN3JSC9StructureC1ENS_7JSValueERKNS_8TypeInfoE
+__ZN3JSC7JSArrayC1EN3WTF10PassRefPtrINS_9StructureEEE
+__ZN3JSC7JSArrayD1Ev
+__ZN3JSC7JSArrayD2Ev
+__ZN3WTF10RefCountedIN3JSC9StructureEE5derefEv
+__ZN3JSC9StructureD1Ev
+__ZN3JSC9StructureD2Ev
+__ZN3JSC11JSByteArray15createStructureENS_7JSValueE
+__ZN3JSC11JSByteArrayD1Ev
+__ZN3JSC8JSStringD1Ev
+__ZN3JSC10JSFunctionD1Ev
+__ZN3JSC10JSFunctionD2Ev
+__ZN3JSC8JSObjectD2Ev
+__ZN3JSC12JSGlobalDataC2EbRKNS_7VPtrSetE
+__ZN3JSC21createIdentifierTableEv
+__ZN3JSC17CommonIdentifiersC1EPNS_12JSGlobalDataE
+__ZN3JSC17CommonIdentifiersC2EPNS_12JSGlobalDataE
+__ZN3JSC10Identifier3addEPNS_12JSGlobalDataEPKc
+__ZN3WTF7HashSetIPN3JSC7UString3RepENS_7StrHashIS4_EENS_10HashTraitsIS4_EEE3addIPKcNS1_17CStringTranslatorEEESt4pairINS_24HashT
+__ZN3WTF9HashTableIPN3JSC7UString3RepES4_NS_17IdentityExtractorIS4_EENS_7StrHashIS4_EENS_10HashTraitsIS4_EESA_E6rehashEi
+__ZN3WTF9HashTableIPKcSt4pairIS2_NS_6RefPtrIN3JSC7UString3RepEEEENS_18PairFirstExtractorIS9_EENS_7PtrHashIS2_EENS_14PairHashTra
+__ZN3WTF6RefPtrIN3JSC7UString3RepEED1Ev
+__ZN3JSC12SmallStringsC1Ev
+__ZN3JSC19ExecutableAllocator17intializePageSizeEv
+__ZN3JSC14ExecutablePool11systemAllocEm
+__ZN3JSC5LexerC1EPNS_12JSGlobalDataE
+__ZN3JSC5LexerC2EPNS_12JSGlobalDataE
+__ZN3JSC11InterpreterC1Ev
+__ZN3JSC11InterpreterC2Ev
+__ZN3JSC11Interpreter14privateExecuteENS0_13ExecutionFlagEPNS_12RegisterFileEPNS_9ExecStateEPNS_7JSValueE
+__ZN3WTF7HashMapIPvN3JSC8OpcodeIDENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS6_IS3_EEE3addERKS1_RKS3_
+__ZN3WTF9HashTableIPvSt4pairIS1_N3JSC8OpcodeIDEENS_18PairFirstExtractorIS5_EENS_7PtrHashIS1_EENS_14PairHashTraitsINS_10HashTrai
+__ZN3JSC8JITStubsC1EPNS_12JSGlobalDataE
+__ZN3JSC3JITC1EPNS_12JSGlobalDataEPNS_9CodeBlockE
+__ZN3JSC3JITC2EPNS_12JSGlobalDataEPNS_9CodeBlockE
+__ZN3JSC3JIT35privateCompileCTIMachineTrampolinesEPN3WTF6RefPtrINS_14ExecutablePoolEEEPNS_12JSGlobalDataEPPvS9_S9_S9_S9_S9_
+__ZN3JSC12X86Assembler23X86InstructionFormatter11oneByteOp64ENS0_15OneByteOpcodeIDEiNS_3X8610RegisterIDE
+__ZN3JSC12X86Assembler3jCCENS0_9ConditionE
+__ZN3JSC23MacroAssemblerX86Common4moveENS_22AbstractMacroAssemblerINS_12X86AssemblerEE6ImmPtrENS_3X8610RegisterIDE
+__ZN3JSC12X86Assembler23X86InstructionFormatter11oneByteOp64ENS0_15OneByteOpcodeIDEiNS_3X8610RegisterIDEi
+__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDEiNS_3X8610RegisterIDE
+__ZN3JSC15AssemblerBuffer11ensureSpaceEi
+__ZN3JSC20MacroAssemblerX86_6413branchTestPtrENS_23MacroAssemblerX86Common9ConditionENS_3X8610RegisterIDENS_22AbstractMacroAsse
+__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDENS_3X8610RegisterIDE
+__ZN3JSC20MacroAssemblerX86_644callEv
+__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDEiNS_3X8610RegisterIDEi
+__ZN3JSC3JIT32compileOpCallInitializeCallFrameEv
+__ZN3JSC12X86Assembler23X86InstructionFormatter11memoryModRMEiNS_3X8610RegisterIDEi
+__ZN3JSC20MacroAssemblerX86_6421makeTailRecursiveCallENS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpE
+__ZN3JSC14TimeoutCheckerC1Ev
+__ZN3JSC4HeapC1EPNS_12JSGlobalDataE
+__ZN3JSC27startProfilerServerIfNeededEv
++[ProfilerServer sharedProfileServer]
+-[ProfilerServer init]
+__ZN3JSC9Structure17stopIgnoringLeaksEv
+__ZN3JSC4Heap8allocateEm
+__ZN3JSCL13allocateBlockILNS_8HeapTypeE0EEEPNS_14CollectorBlockEv
+__ZN3JSC4Heap4heapENS_7JSValueE
+__ZN3JSC4Heap7protectENS_7JSValueE
+__ZN3WTF7HashMapIPN3JSC6JSCellEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
+__ZN3WTF9HashTableIPN3JSC6JSCellESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTraits
+__ZN3JSC14JSGlobalObjectnwEmPNS_12JSGlobalDataE
+__ZN3JSC14JSGlobalObject4initEPNS_8JSObjectE
+__ZN3JSC14JSGlobalObject5resetENS_7JSValueE
+__ZN3JSC4Heap12heapAllocateILNS_8HeapTypeE0EEEPvm
+__ZN3JSC8jsStringEPNS_12JSGlobalDataERKNS_7UStringE
+__ZN3JSC12SmallStrings17createEmptyStringEPNS_12JSGlobalDataE
+__ZN3JSC7UStringC1EPKc
+__ZN3JSCL9createRepEPKc
+__ZN3JSC8JSObject9putDirectERKNS_10IdentifierENS_7JSValueEjbRNS_15PutPropertySlotE
+__ZN3JSC9Structure40addPropertyTransitionToExistingStructureEPS0_RKNS_10IdentifierEjRm
+__ZN3JSC9Structure3getERKNS_10IdentifierERj
+__ZN3JSC9Structure21addPropertyTransitionEPS0_RKNS_10IdentifierEjRm
+__ZN3JSC9Structure3putERKNS_10IdentifierEj
+__ZN3JSC8JSObject26putDirectWithoutTransitionERKNS_10IdentifierENS_7JSValueEj
+__ZN3JSC9Structure28addPropertyWithoutTransitionERKNS_10IdentifierEj
+__ZN3JSC17FunctionPrototype21addFunctionPropertiesEPNS_9ExecStateEPNS_9StructureEPPNS_10JSFunctionES7_
+__ZN3JSC10JSFunctionC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjectESA_RK
+__ZN3JSC12JSGlobalData17createNativeThunkEv
+__ZN3JSC16FunctionBodyNode17createNativeThunkEPNS_12JSGlobalDataE
+__ZN3WTF6VectorINS_6RefPtrIN3JSC21ParserArenaRefCountedEEELm0EE15reserveCapacityEm
+__ZN3JSC11ParserArena5resetEv
+__ZN3JSC8JSObject34putDirectFunctionWithoutTransitionEPNS_9ExecStateEPNS_16InternalFunctionEj
+__ZN3JSC15ObjectPrototypeC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPS5_
+__ZN3JSC9Structure26rehashPropertyMapHashTableEj
+__ZN3JSC15StringPrototypeC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEE
+__ZN3JSC16BooleanPrototypeC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPS5_
+__ZN3JSC15NumberPrototypeC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPS5_
+__ZN3JSC15RegExpPrototypeC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPS5_
+__ZN3JSC14ErrorPrototypeC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPS5_
+__ZN3JSC20NativeErrorPrototypeC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEERKNS_7UStringES9_
+__ZN3JSC17ObjectConstructorC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS_15ObjectPrototypeE
+__ZN3JSC19FunctionConstructorC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS_17FunctionPrototypeE
+__ZNK3JSC16InternalFunction9classInfoEv
+__ZN3JSC16ArrayConstructorC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS_14ArrayPrototypeE
+__ZNK3JSC14ArrayPrototype9classInfoEv
+__ZN3JSC17StringConstructorC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPS5_PNS_15StringPrototypeE
+__ZNK3JSC15StringPrototype9classInfoEv
+__ZN3JSC18BooleanConstructorC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS_16BooleanPrototypeE
+__ZNK3JSC13BooleanObject9classInfoEv
+__ZN3JSC17NumberConstructorC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS_15NumberPrototypeE
+__ZN3JSC15DateConstructorC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPS5_PNS_13DatePrototypeE
+__ZNK3JSC13DatePrototype9classInfoEv
+__ZN3JSC17RegExpConstructorC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS_15RegExpPrototypeE
+__ZN3JSC16ErrorConstructorC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS_14ErrorPrototypeE
+__ZNK3JSC13ErrorInstance9classInfoEv
+__ZN3JSC22NativeErrorConstructorC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS_20NativeErrorPrototypeE
+__ZN3JSC10Identifier11addSlowCaseEPNS_12JSGlobalDataEPNS_7UString3RepE
+__ZN3WTF7HashSetIPN3JSC7UString3RepENS_7StrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3JSC10MathObjectC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEE
+__ZN3JSC12SmallStrings24singleCharacterStringRepEh
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEENS2_16SymbolTableEntryENS2_17IdentifierRepHashENS_10HashTraitsIS5_EENS2_26Symbo
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_NS2_16SymbolTableEntryEENS_18PairFirstExtractorIS8_EENS2_17Identif
+__ZN3JSC17PrototypeFunctionC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjec
+__ZN3JSC9Structure25changePrototypeTransitionEPS0_NS_7JSValueE
+__ZN3JSC9Structure17copyPropertyTableEv
+__ZN3JSC14JSGlobalObject10globalExecEv
+__ZN3JSC10Identifier3addEPNS_9ExecStateEPKc
+__ZN3JSC4Heap9unprotectENS_7JSValueE
+__ZN3JSC6JSCellnwEmPNS_9ExecStateE
+__ZN3JSC14TimeoutChecker5resetEv
+__ZN3JSC8evaluateEPNS_9ExecStateERNS_10ScopeChainERKNS_10SourceCodeENS_7JSValueE
+__ZN3JSC6JSLock4lockEb
+__ZN3JSC6Parser5parseINS_11ProgramNodeEEEN3WTF10PassRefPtrIT_EEPNS_9ExecStateEPNS_8DebuggerERKNS_10SourceCodeEPiPNS_7UStringE
+__ZN3JSC6Parser5parseEPNS_12JSGlobalDataEPiPNS_7UStringE
+__ZN3JSC7UStringaSEPKc
+__Z10jscyyparsePv
+__ZN3JSC5Lexer3lexEPvS1_
+__ZN3JSC10Identifier3addEPNS_12JSGlobalDataEPKti
+__ZN3WTF7HashSetIPN3JSC7UString3RepENS_7StrHashIS4_EENS_10HashTraitsIS4_EEE3addINS1_11UCharBufferENS1_21UCharBufferTranslatorEE
+__ZN3WTF15SegmentedVectorINS_10IdentifierELm64EE6appendIS1_EEvRKT_
+__ZNK3JSC9HashTable11createTableEPNS_12JSGlobalDataE
+__ZN3JSC20ParserArenaDeletablenwEmPNS_12JSGlobalDataE
+__ZN3WTF6VectorIPN3JSC20ParserArenaDeletableELm0EE15reserveCapacityEm
+__ZN3JSC5Lexer10sourceCodeEiii
+__ZN3JSC16FunctionBodyNode13finishParsingERKNS_10SourceCodeEPNS_13ParameterNodeE
+__ZN3WTF6VectorIN3JSC10IdentifierELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN3JSC12FuncDeclNodeELm0EE14expandCapacityEm
+__ZN3JSC14SourceElements6appendEPNS_13StatementNodeE
+__ZNK3JSC13StatementNode16isEmptyStatementEv
+__ZN3WTF6VectorIPN3JSC13StatementNodeELm0EE14expandCapacityEm
+__ZL20makeFunctionCallNodePvN3JSC8NodeInfoIPNS0_14ExpressionNodeEEENS1_IPNS0_13ArgumentsNodeEEEiii
+__ZNK3JSC11ResolveNode10isLocationEv
+__ZNK3JSC11ResolveNode13isResolveNodeEv
+__ZN3JSC5Lexer7record8Ei
+__ZN3JSC5Lexer10scanRegExpEv
+__ZN3JSC7UStringC2ERKN3WTF6VectorItLm0EEE
+__ZN3JSC7UString3Rep7destroyEv
+__ZN3JSC5Lexer5clearEv
+__ZN3JSC10Identifier6removeEPNS_7UString3RepE
+__ZN3WTF6VectorIN3JSC10IdentifierELm64EE14shrinkCapacityEm
+__ZN3JSC9ScopeNodeC2EPNS_12JSGlobalDataERKNS_10SourceCodeEPNS_14SourceElementsEPN3WTF6VectorISt4pairINS_10IdentifierEjELm0EEEPN
+__ZN3WTF6VectorIPN3JSC13StatementNodeELm0EE14shrinkCapacityEm
+__ZN3JSC11ParserArena10removeLastEv
+__ZNK3JSC8JSObject8toObjectEPNS_9ExecStateE
+__ZN3JSC11Interpreter7executeEPNS_11ProgramNodeEPNS_9ExecStateEPNS_14ScopeChainNodeEPNS_8JSObjectEPNS_7JSValueE
+__ZN3JSC11ProgramNode16generateBytecodeEPNS_14ScopeChainNodeE
+__ZN3JSC9CodeBlockC2EPNS_9ScopeNodeENS_8CodeTypeEN3WTF10PassRefPtrINS_14SourceProviderEEEj
+__ZN3WTF7HashSetIPN3JSC16ProgramCodeBlockENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN3JSC16ProgramCodeBlockES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3JSC17BytecodeGeneratorC2EPNS_11ProgramNodeEPKNS_8DebuggerERKNS_10ScopeChainEPN3WTF7HashMapINS9_6RefPtrINS_7UString3RepEEEN
+__ZN3WTF6VectorIN3JSC11InstructionELm0EE14expandCapacityEm
+__ZN3JSC9Structure22toDictionaryTransitionEPS0_
+__ZN3JSC8JSObject12removeDirectERKNS_10IdentifierE
+__ZN3JSC9Structure31removePropertyWithoutTransitionERKNS_10IdentifierE
+__ZN3JSC9Structure6removeERKNS_10IdentifierE
+__ZN3JSC17BytecodeGenerator12addGlobalVarERKNS_10IdentifierEbRPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator15emitNewFunctionEPNS_10RegisterIDEPNS_12FuncDeclNodeE
+__ZN3JSC9CodeBlock25createRareDataIfNecessaryEv
+__ZN3JSC17BytecodeGenerator11newRegisterEv
+__ZN3JSC9Structure24fromDictionaryTransitionEPS0_
+__ZN3JSC17BytecodeGenerator8generateEv
+__ZN3JSC11ProgramNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator13emitDebugHookENS_11DebugHookIDEii
+__ZN3JSC17BytecodeGenerator11addConstantENS_7JSValueE
+__ZN3WTF9HashTableIPvSt4pairIS1_jENS_18PairFirstExtractorIS3_EENS_7PtrHashIS1_EENS_14PairHashTraitsIN3JSC17JSValueHashTraitsENS
+__ZN3WTF6VectorIN3JSC8RegisterELm0EE14expandCapacityEm
+__ZN3JSC17BytecodeGenerator8emitMoveEPNS_10RegisterIDES2_
+__ZN3JSC17BytecodeGenerator8emitNodeEPNS_10RegisterIDEPNS_4NodeE
+__ZN3WTF6VectorIN3JSC8LineInfoELm0EE14expandCapacityEm
+__ZN3JSC12FuncDeclNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17ExprStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC23FunctionCallResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator11registerForERKNS_10IdentifierE
+__ZN3JSC17BytecodeGenerator8emitCallENS_8OpcodeIDEPNS_10RegisterIDES3_S3_PNS_13ArgumentsNodeEjjj
+__ZN3JSC16ArgumentListNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC12FuncExprNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator25emitNewFunctionExpressionEPNS_10RegisterIDEPNS_12FuncExprNodeE
+__ZN3WTF6VectorIN3JSC19ExpressionRangeInfoELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN3JSC12CallLinkInfoELm0EE14expandCapacityEm
+__ZN3JSC11ResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC12JSGlobalData22numericCompareFunctionEPNS_9ExecStateE
+__ZNK3JSC21UStringSourceProvider6lengthEv
+__ZNK3JSC21UStringSourceProvider4dataEv
+__ZN3JSC19extractFunctionBodyEPNS_11ProgramNodeE
+__ZNK3JSC17ExprStatementNode15isExprStatementEv
+__ZNK3JSC12FuncExprNode14isFuncExprNodeEv
+__ZN3JSC16FunctionBodyNode16generateBytecodeEPNS_14ScopeChainNodeE
+__ZN3JSC6Parser14reparseInPlaceEPNS_12JSGlobalDataEPNS_16FunctionBodyNodeE
+__ZL11makeSubNodePvPN3JSC14ExpressionNodeES2_b
+__ZN3JSC14ExpressionNode14stripUnaryPlusEv
+__ZNK3JSC14ExpressionNode8isNumberEv
+__ZN3JSC9CodeBlockC1EPNS_9ScopeNodeENS_8CodeTypeEN3WTF10PassRefPtrINS_14SourceProviderEEEj
+__ZN3JSC17BytecodeGeneratorC2EPNS_16FunctionBodyNodeEPKNS_8DebuggerERKNS_10ScopeChainEPN3WTF7HashMapINS9_6RefPtrINS_7UString3Re
+__ZN3JSC17BytecodeGenerator12addParameterERKNS_10IdentifierE
+__ZN3JSC16FunctionBodyNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC9BlockNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC10ReturnNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC12BinaryOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC11ResolveNode6isPureERNS_17BytecodeGeneratorE
+__ZN3JSC17BytecodeGenerator12newTemporaryEv
+__ZN3JSC17BytecodeGenerator12emitBinaryOpENS_8OpcodeIDEPNS_10RegisterIDES3_S3_NS_12OperandTypesE
+__ZN3JSC17BytecodeGenerator10emitReturnEPNS_10RegisterIDE
+__ZNK3JSC9BlockNode7isBlockEv
+__ZNK3JSC10ReturnNode12isReturnNodeEv
+__ZN3JSC9CodeBlock11shrinkToFitEv
+__ZN3WTF6VectorIN3JSC11InstructionELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC17StructureStubInfoELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIPN3JSC12CallLinkInfoELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC10IdentifierELm0EE14shrinkCapacityEm
+__ZN3JSC11ParserArenaD1Ev
+__ZN3JSC11ResolveNodeD0Ev
+__ZN3JSC7SubNodeD0Ev
+__ZN3JSC10ReturnNodeD0Ev
+__ZN3JSC14SourceElementsD0Ev
+__ZN3JSC9BlockNodeD0Ev
+__ZN3JSC17BytecodeGeneratorD2Ev
+__ZN3WTF6VectorIN3JSC11InstructionELm0EEaSERKS3_
+__ZThn16_N3JSC11ProgramNodeD0Ev
+__ZN3JSC11ProgramNodeD0Ev
+__ZN3JSC13ParameterNodeD0Ev
+__ZN3JSC17ExprStatementNodeD0Ev
+__ZThn16_N3JSC12FuncExprNodeD0Ev
+__ZN3JSC12FuncExprNodeD0Ev
+__ZThn16_N3JSC16FunctionBodyNodeD0Ev
+__ZN3JSC16FunctionBodyNodeD0Ev
+__ZN3JSC9CodeBlockD1Ev
+__ZN3JSC9CodeBlockD2Ev
+__ZN3JSC21UStringSourceProviderD0Ev
+__ZN3WTF6VectorIN3JSC19ExpressionRangeInfoELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC8LineInfoELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN3JSC12FuncDeclNodeEEELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC15SimpleJumpTableELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN3JSC15StringJumpTableELm0EE14shrinkCapacityEm
+__ZN3JSC15ParserArenaDataIN3WTF6VectorIPNS_12FuncDeclNodeELm0EEEED0Ev
+__ZN3JSC16ArgumentListNodeD0Ev
+__ZN3JSC13ArgumentsNodeD0Ev
+__ZN3JSC23FunctionCallResolveNodeD0Ev
+__ZN3JSC14JSGlobalObject13copyGlobalsToERNS_12RegisterFileE
+__ZN3JSC3JIT14privateCompileEv
+__ZN3JSC3JIT22privateCompileMainPassEv
+__ZN3JSC3JIT13emit_op_enterEPNS_11InstructionE
+__ZN3JSC3JIT16emit_op_new_funcEPNS_11InstructionE
+__ZN3JSC20MacroAssemblerX86_648storePtrENS_22AbstractMacroAssemblerINS_12X86AssemblerEE6ImmPtrENS3_15ImplicitAddressE
+__ZN3JSC11JITStubCall4callEj
+__ZN3WTF6VectorIN3JSC10CallRecordELm0EE14expandCapacityEm
+__ZN3JSC3JIT11emit_op_movEPNS_11InstructionE
+__ZN3JSC3JIT20emit_op_new_func_expEPNS_11InstructionE
+__ZN3JSC3JIT12emit_op_callEPNS_11InstructionE
+__ZN3JSC3JIT13compileOpCallENS_8OpcodeIDEPNS_11InstructionEj
+__ZN3WTF6VectorIN3JSC13SlowCaseEntryELm0EE14expandCapacityEm
+__ZN3JSC3JIT11emit_op_endEPNS_11InstructionE
+__ZN3JSC11JITStubCall4callEv
+__ZN3WTF6VectorIN3JSC9JumpTableELm0EE14shrinkCapacityEm
+__ZN3JSC3JIT23privateCompileSlowCasesEv
+__ZN3JSC3JIT16emitSlow_op_callEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT21compileOpCallSlowCaseEPNS_11InstructionERPNS_13SlowCaseEntryEjNS_8OpcodeIDE
+__ZN3JSC3JIT22compileOpCallSetupArgsEPNS_11InstructionE
+__ZN3JSC9CodeBlock10setJITCodeERNS_10JITCodeRefE
+__ZN3JSC17BytecodeGenerator18dumpsGeneratedCodeEv
+__ZN3WTF10RefCountedIN3JSC14ExecutablePoolEE5derefEv
+_ctiTrampoline
+__ZN3JSC8JITStubs15cti_op_new_funcEPPv
+__ZN3JSC12FuncDeclNode12makeFunctionEPNS_9ExecStateEPNS_14ScopeChainNodeE
+__ZN3JSC8JITStubs19cti_op_new_func_expEPPv
+__ZN3JSC12FuncExprNode12makeFunctionEPNS_9ExecStateEPNS_14ScopeChainNodeE
+__ZN3JSC8JITStubs22cti_op_call_JSFunctionEPPv
+__ZN3JSC16FunctionBodyNode15generateJITCodeEPNS_14ScopeChainNodeE
+__ZN3JSC10IfElseNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator8newLabelEv
+__ZN3JSC15DotAccessorNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator11emitResolveEPNS_10RegisterIDERKNS_10IdentifierE
+__ZN3JSC17BytecodeGenerator18findScopedPropertyERKNS_10IdentifierERiRmbRPNS_8JSObjectE
+__ZNK3JSC16JSVariableObject16isVariableObjectEv
+__ZN3JSC17BytecodeGenerator16emitGetScopedVarEPNS_10RegisterIDEmiNS_7JSValueE
+__ZN3JSC17BytecodeGenerator11emitGetByIdEPNS_10RegisterIDES2_RKNS_10IdentifierE
+__ZN3WTF6VectorIN3JSC17StructureStubInfoELm0EE14expandCapacityEm
+__ZN3JSC17BytecodeGenerator11addConstantERKNS_10IdentifierE
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEiNS2_17IdentifierRepHashENS_10HashTraitsIS5_EENS2_17BytecodeGenerator28Identifi
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_iENS_18PairFirstExtractorIS7_EENS2_17IdentifierRepHashENS_14PairHa
+__ZN3JSC17BytecodeGenerator15emitJumpIfFalseEPNS_10RegisterIDEPNS_5LabelE
+__ZNK3JSC14JSGlobalObject14isDynamicScopeEv
+__ZN3JSC17BytecodeGenerator19emitResolveFunctionEPNS_10RegisterIDES2_RKNS_10IdentifierE
+__ZN3JSC10StringNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator8emitLoadEPNS_10RegisterIDERKNS_10IdentifierE
+__ZN3WTF9HashTableIPN3JSC7UString3RepESt4pairIS4_PNS1_8JSStringEENS_18PairFirstExtractorIS8_EENS1_17IdentifierRepHashENS_14Pair
+__ZN3JSC11BooleanNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator8emitJumpEPNS_5LabelE
+__ZN3JSC17BytecodeGenerator9emitLabelEPNS_5LabelE
+__ZN3WTF6VectorIjLm0EE15reserveCapacityEm
+__ZN3JSC6IfNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC13StatementNode12isReturnNodeEv
+__ZN3JSC15DotAccessorNodeD0Ev
+__ZN3JSC10StringNodeD0Ev
+__ZN3JSC11BooleanNodeD0Ev
+__ZN3JSC6IfNodeD0Ev
+__ZN3JSC10IfElseNodeD0Ev
+__ZN3JSC3JIT22emit_op_get_global_varEPNS_11InstructionE
+__ZN3JSC3JIT29emitGetVariableObjectRegisterENS_3X8610RegisterIDEiS2_
+__ZN3JSC3JIT17emit_op_get_by_idEPNS_11InstructionE
+__ZN3JSC3JIT21compileGetByIdHotPathEiiPNS_10IdentifierEj
+__ZN3WTF6VectorIN3JSC13SlowCaseEntryELm0EE14expandCapacityEmPKS2_
+__ZN3JSC3JIT14emit_op_jfalseEPNS_11InstructionE
+__ZN3JSC20MacroAssemblerX86_649branchPtrENS_23MacroAssemblerX86Common9ConditionENS_3X8610RegisterIDENS_22AbstractMacroAssembler
+__ZN3JSC20MacroAssemblerX86_649branchPtrENS_23MacroAssemblerX86Common9ConditionENS_3X8610RegisterIDES4_
+__ZN3WTF6VectorIN3JSC9JumpTableELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN3JSC9JumpTableELm0EE14expandCapacityEm
+__ZN3JSC3JIT20emit_op_resolve_funcEPNS_11InstructionE
+__ZN3JSC3JIT11emit_op_jmpEPNS_11InstructionE
+__ZN3JSC3JIT11emit_op_retEPNS_11InstructionE
+__ZN3JSC3JIT21emitSlow_op_get_by_idEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT22compileGetByIdSlowCaseEiiPNS_10IdentifierERPNS_13SlowCaseEntryEj
+__ZN3JSC3JIT18emitSlow_op_jfalseEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC23MacroAssemblerX86Common12branchTest32ENS0_9ConditionENS_3X8610RegisterIDENS_22AbstractMacroAssemblerINS_12X86Assemble
+__ZN3JSC8JITStubs23cti_vm_dontLazyLinkCallEPPv
+__ZN3JSC31ctiPatchNearCallByReturnAddressENS_22AbstractMacroAssemblerINS_12X86AssemblerEE22ProcessorReturnAddressEPv
+__ZN3JSC8JITStubs23cti_register_file_checkEPPv
+__ZN3JSC8JITStubs16cti_op_get_by_idEPPv
+__ZNK3JSC7JSValue3getEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC23setUpStaticFunctionSlotEPNS_9ExecStateEPKNS_9HashEntryEPNS_8JSObjectERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC27ctiPatchCallByReturnAddressENS_22AbstractMacroAssemblerINS_12X86AssemblerEE22ProcessorReturnAddressEPv
+__ZN3JSC8JITStubs12cti_op_jtrueEPPv
+__ZNK3JSC8JSObject9toBooleanEPNS_9ExecStateE
+__ZN3JSC8JITStubs19cti_op_resolve_funcEPPv
+__ZNK3JSC8JSObject12toThisObjectEPNS_9ExecStateE
+__ZNK3JSC8JSString8toStringEPNS_9ExecStateE
+__ZN3JSC8JITStubs23cti_op_get_by_id_secondEPPv
+__ZN3JSC8JITStubs15tryCacheGetByIDEPNS_9ExecStateEPNS_9CodeBlockEPvNS_7JSValueERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSC3JIT26privateCompileGetByIdProtoEPNS_17StructureStubInfoEPNS_9StructureES4_mNS_22AbstractMacroAssemblerINS_12X86Assembl
+__ZN3JSC3JIT22compileGetDirectOffsetEPNS_8JSObjectENS_3X8610RegisterIDES4_m
+__ZN3JSC8JITStubs19cti_vm_lazyLinkCallEPPv
+__ZN3JSC3JIT8linkCallEPNS_10JSFunctionEPNS_9CodeBlockENS_7JITCodeEPNS_12CallLinkInfoEi
+__ZN3JSC8JITStubs10cti_op_endEPPv
+__ZThn16_N3JSC12FuncDeclNodeD0Ev
+__ZN3JSC12FuncDeclNodeD0Ev
 __ZN3WTF25TCMalloc_Central_FreeList11ShrinkCacheEib
-__ZN3WTF25TCMalloc_Central_FreeList18ReleaseListToSpansEPv
-__ZN3WTF15deleteAllValuesIPN3KJS16ParserRefCountedEKNS_9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEESA_EEEEvRT0_
-__ZN3KJS19BracketAccessorNodeD1Ev
-__ZN3KJS11ProgramNodeC2EPNS_14SourceElementsEPN3WTF6VectorISt4pairINS_10IdentifierEjELm16EEEPNS4_IPNS_12FuncDeclNodeELm16EEE
-__ZNK3KJS8JSObject8toObjectEPNS_9ExecStateE
-__ZN3KJS11ProgramNode7executeEPNS_9ExecStateE
-__ZN3KJS11ProgramNode21initializeSymbolTableEPNS_9ExecStateE
-__ZN3WTF6VectorImLm0EE6resizeEm
-__ZN3WTF6VectorImLm0EE14expandCapacityEm
-__ZN3WTF6VectorImLm0EE15reserveCapacityEm
-__ZN3WTF9HashTableINS_6RefPtrIN3KJS7UString3RepEEESt4pairIS5_mENS_18PairFirstExtractorIS7_EENS2_17IdentifierRepHashENS_14PairHashTraitsINS2_23IdentifierRepHashTraitsENS2_26SymbolTableIndexHashTraitsEEESC_E3addIS5_mNS_17HashMapTranslatorILb1ES7_NS_18PairBaseHashTraitsISC_SD_EESE_SA_EEEES6_INS_17HashTableIteratorIS5_S7_S9_SA_SE_SC_EEbERKT_RKT0_
-__ZN3WTF9HashTableINS_6RefPtrIN3KJS7UString3RepEEESt4pairIS5_mENS_18PairFirstExtractorIS7_EENS2_17IdentifierRepHashENS_14PairHashTraitsINS2_23IdentifierRepHashTraitsENS2_26SymbolTableIndexHashTraitsEEESC_E6rehashEi
-__ZN3KJS14JSGlobalObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZNK3WTF7HashMapINS_6RefPtrIN3KJS7UString3RepEEEmNS2_17IdentifierRepHashENS2_23IdentifierRepHashTraitsENS2_26SymbolTableIndexHashTraitsEE3getEPS4_
-__ZN3KJS11PropertyMap11getLocationERKNS_10IdentifierE
-__ZN3KJS6Lookup9findEntryEPKNS_9HashTableERKNS_10IdentifierE
-__ZNK3KJS7UString14toStrictUInt32EPb
-__ZN3KJS8JSObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3WTF6VectorIN3KJS17LocalStorageEntryELm32EE15reserveCapacityEm
-__ZN3KJS11FunctionImpC2EPNS_9ExecStateERKNS_10IdentifierEPNS_16FunctionBodyNodeERKNS_10ScopeChainE
-__ZN3KJS15ObjectObjectImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS9ScopeNode22optimizeVariableAccessEPNS_9ExecStateE
-__ZN3WTF6VectorIPN3KJS4NodeELm16EE14expandCapacityEm
-__ZN3WTF6VectorIPN3KJS4NodeELm16EE15reserveCapacityEm
-__ZN3KJS16VarStatementNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS17AssignResolveNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS17ObjectLiteralNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS16PropertyListNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS12PropertyNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS4Node22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPS0_Lm16EEE
-__ZN3KJS14LogicalNotNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS14LogicalAndNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS15DotAccessorNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS11ResolveNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS11GreaterNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS19FunctionCallDotNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS13ArgumentsNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS16ArgumentListNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS9EqualNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS18NotStrictEqualNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS6IfNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS17ExprStatementNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS13AssignDotNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS13LogicalOrNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS8WithNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS9BlockNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS23FunctionCallResolveNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS21FunctionCallValueNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS9ArrayNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS11ElementNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS10IfElseNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS7AddNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS6InNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS11NewExprNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS16VarStatementNode7executeEPNS_9ExecStateE
-__ZN3KJS18AssignLocalVarNode8evaluateEPNS_9ExecStateE
-__ZN3KJS17ObjectLiteralNode8evaluateEPNS_9ExecStateE
-__ZN3KJS16PropertyListNode8evaluateEPNS_9ExecStateE
-__ZN3KJS10StringNode8evaluateEPNS_9ExecStateE
-__ZN3KJS13jsOwnedStringERKNS_7UStringE
-__ZN3KJS8JSObject3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
-__ZN3KJS14LogicalNotNode8evaluateEPNS_9ExecStateE
-__ZN3KJS14LogicalNotNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS14LogicalAndNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS15DotAccessorNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS11ResolveNode8evaluateEPNS_9ExecStateE
-__ZN3KJS11GreaterNode8evaluateEPNS_9ExecStateE
-__ZN3KJS19FunctionCallDotNode8evaluateEPNS_9ExecStateE
-__ZN3KJS15DotAccessorNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS9ExecState19lexicalGlobalObjectEv
-__ZNK3KJS9StringImp8toObjectEPNS_9ExecStateE
-__ZN3KJS14StringInstance18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS15StringPrototype18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS20staticFunctionGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS17PrototypeFunctionC1EPNS_9ExecStateEiRKNS_10IdentifierEPFPNS_7JSValueES2_PNS_8JSObjectERKNS_4ListEE
-__ZNK3KJS19InternalFunctionImp14implementsCallEv
-__ZN3KJS16ArgumentListNode12evaluateListEPNS_9ExecStateERNS_4ListE
-__ZN3KJS17PrototypeFunction14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS22stringProtoFuncIndexOfEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS14StringInstance9classInfoEv
-__ZNK3KJS9StringImp8toStringEPNS_9ExecStateE
-__ZNK3KJS7JSValue9toIntegerEPNS_9ExecStateE
-__ZNK3KJS7UString4findERKS0_i
-__ZN3KJS19ImmediateNumberNode8evaluateEPNS_9ExecStateE
-__ZN3KJS14LogicalAndNode8evaluateEPNS_9ExecStateE
-__ZN3KJS9EqualNode8evaluateEPNS_9ExecStateE
-__ZN3KJS5equalEPNS_9ExecStateEPNS_7JSValueES3_
-__ZN3KJS19FunctionCallDotNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS10RegExpNode8evaluateEPNS_9ExecStateE
-__ZN3KJS15RegExpObjectImp15createRegExpImpEPNS_9ExecStateEN3WTF10PassRefPtrINS_6RegExpEEE
-__ZN3KJS20stringProtoFuncMatchEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS9RegExpImp9classInfoEv
-__ZN3KJS15RegExpObjectImp12performMatchEPNS_6RegExpERKNS_7UStringEiRiS6_PPi
-__ZN3KJS6RegExp5matchERKNS_7UStringEiPN3WTF11OwnArrayPtrIiEE
-__Z5matchPKtPKhiR9MatchData
-__ZNK3KJS8JSObject9toBooleanEPNS_9ExecStateE
-__ZN3KJS18NotStrictEqualNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS7UString8toUInt32EPbb
-__ZNK3KJS7UString8toDoubleEbb
-__ZN3KJS11strictEqualEPNS_9ExecStateEPNS_7JSValueES3_
-__ZN3KJS12FuncExprNode8evaluateEPNS_9ExecStateE
-__ZN3KJS14JSGlobalObject17tearOffActivationEPNS_9ExecStateEb
-__ZN3KJS6IfNode7executeEPNS_9ExecStateE
-__ZN3KJS18LocalVarAccessNode8evaluateEPNS_9ExecStateE
-__ZN3KJS17ExprStatementNode7executeEPNS_9ExecStateE
-__ZN3KJS13AssignDotNode8evaluateEPNS_9ExecStateE
-__ZN3KJS11FunctionImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS17FunctionExecStateC1EPNS_14JSGlobalObjectEPNS_8JSObjectEPNS_16FunctionBodyNodeEPNS_9ExecStateEPNS_11FunctionImpERKNS_4ListE
-__ZN3KJS14JSGlobalObject14pushActivationEPNS_9ExecStateE
-__ZN3KJS13ActivationImp4initEPNS_9ExecStateE
-__ZN3KJS16FunctionBodyNode7executeEPNS_9ExecStateE
-__ZN3KJS16FunctionBodyNode21initializeSymbolTableEPNS_9ExecStateE
-__ZN3KJS9ForInNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS17AssignBracketNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS19BracketAccessorNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS10ReturnNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS9ForInNode7executeEPNS_9ExecStateE
-__ZN3KJS8JSObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
-__ZNK3KJS11PropertyMap26getEnumerablePropertyNamesERNS_17PropertyNameArrayE
-__ZNK3KJS8JSObject9classInfoEv
-__ZN3KJS13ActivationImp18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS13ActivationImp3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
-__ZN3KJS17AssignBracketNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS6JSCell9getUInt32ERj
-__ZN3KJS19BracketAccessorNode8evaluateEPNS_9ExecStateE
-__ZN3KJS10ReturnNode7executeEPNS_9ExecStateE
-__ZN3KJS14JSGlobalObject13popActivationEv
-__ZN3KJS11FunctionImp18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS10NumberNode8evaluateEPNS_9ExecStateE
-__ZN3KJS9CommaNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS13ActivationImpC1ERKNS0_14ActivationDataEb
-__ZN3WTF6VectorIN3KJS17LocalStorageEntryELm32EEC2ERKS3_
-__ZN3KJS13ActivationImp15argumentsGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS13ActivationImp21createArgumentsObjectEPNS_9ExecStateE
-__ZN3KJS9ArgumentsC2EPNS_9ExecStateEPNS_11FunctionImpERKNS_4ListEPNS_13ActivationImpE
-__ZN3KJS14IndexToNameMapC2EPNS_11FunctionImpERKNS_4ListE
-__ZN3KJS11FunctionImp16getParameterNameEi
-__ZN3KJS7UString4fromEj
-__ZN3KJS9Arguments18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS9CommaNode8evaluateEPNS_9ExecStateE
-__ZN3KJS8ThisNode8evaluateEPNS_9ExecStateE
-__ZN3KJS23FunctionCallResolveNode8evaluateEPNS_9ExecStateE
-__ZN3KJS9WhileNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS18PostDecResolveNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS18LocalVarAccessNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS13LogicalOrNode8evaluateEPNS_9ExecStateE
-__ZN3KJS11NewExprNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS14ArrayObjectImp19implementsConstructEv
-__ZN3KJS14ArrayObjectImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS9WhileNode7executeEPNS_9ExecStateE
-__ZN3KJS19PostDecLocalVarNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS8JSObject18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
-__ZN3KJS13ArrayInstance3putEPNS_9ExecStateEjPNS_7JSValueEi
-__ZN3KJS15RegExpObjectImp18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS15RegExpObjectImp3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
-__ZN3KJS7ForNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS8LessNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS17PreIncResolveNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS8NullNode8evaluateEPNS_9ExecStateE
-__ZN3KJS13ArrayInstance18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
-__ZN3KJS17TypeOfResolveNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS18LocalVarTypeOfNode8evaluateEPNS_9ExecStateE
-__ZN3KJS18typeStringForValueEPNS_7JSValueE
-__ZNK3KJS8JSObject21masqueradeAsUndefinedEv
-__ZNK3KJS8JSObject14implementsCallEv
-__ZN3KJS12FuncDeclNode7executeEPNS_9ExecStateE
-__ZN3KJS11FunctionImp3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
-__ZN3KJS9ArrayNode8evaluateEPNS_9ExecStateE
-__ZN3KJS13ArrayInstanceC2EPNS_8JSObjectERKNS_4ListE
-__ZN3KJS13ArrayInstance3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
-__ZN3KJS13ArrayInstance9setLengthEj
-__ZN3KJS7ForNode7executeEPNS_9ExecStateE
-__ZN3KJS8LessNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS13ArrayInstance18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS13ArrayInstance12lengthGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS14ArrayPrototype18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS18arrayProtoFuncPushEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS8TrueNode8evaluateEPNS_9ExecStateE
-__ZN3KJS9BlockNode7executeEPNS_9ExecStateE
-__ZN3KJS18PreIncLocalVarNode8evaluateEPNS_9ExecStateE
-__ZN3KJS14StringInstance3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
-__ZN3KJS13LogicalOrNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS8WithNode7executeEPNS_9ExecStateE
-__ZN3KJS15NumberObjectImp18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS24LocalVarFunctionCallNode8evaluateEPNS_9ExecStateE
-__ZN3KJS15ConditionalNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS22stringProtoFuncReplaceEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS7replaceEPNS_9ExecStateEPNS_9StringImpEPNS_7JSValueES5_
-__ZNK3KJS7UString30spliceSubstringsWithSeparatorsEPKNS0_5RangeEiPKS0_i
-__ZN3KJS15ConditionalNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS9StringImp9toBooleanEPNS_9ExecStateE
-__ZN3KJS20stringProtoFuncSplitEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS7UString6substrEii
-__ZN3KJS7UString3Rep6createEN3WTF10PassRefPtrIS1_EEii
-__ZN3KJS7TryNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS15LessNumbersNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS15DotAccessorNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS10NumberNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS7TryNode7executeEPNS_9ExecStateE
-__ZN3KJS21arrayProtoFuncForEachEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS18PostIncResolveNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS18PostIncResolveNode8evaluateEPNS_9ExecStateE
-__ZN3KJS13ActivationImp18isActivationObjectEv
-__ZN3KJS13MathObjectImp18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS21FunctionCallValueNode8evaluateEPNS_9ExecStateE
-__ZN3KJS12NotEqualNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS9FalseNode8evaluateEPNS_9ExecStateE
-__ZN3KJS19arrayProtoFuncShiftEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS13ArrayInstance14deletePropertyEPNS_9ExecStateEj
-__ZNK3KJS11FunctionImp19implementsConstructEv
-__ZN3KJS11FunctionImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS9EqualNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS25functionProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS11FunctionImp9classInfoEv
-__ZNK3KJS4Node8toStringEv
-__ZNK3KJS9ScopeNode8streamToERNS_12SourceStreamE
-__ZN3KJS7UString6appendEt
-__ZN3KJS7UString6appendERKS0_
-__ZN3KJS7UString6appendEPKc
-__ZN3KJS7UString14expandCapacityEi
-__ZN3KJS12SourceStreamlsEPKNS_4NodeE
-__ZNK3KJS17ExprStatementNode8streamToERNS_12SourceStreamE
-__ZNK3KJS4Node21needsParensIfLeftmostEv
-__ZNK3KJS23FunctionCallResolveNode8streamToERNS_12SourceStreamE
-__ZNK3KJS13ArgumentsNode8streamToERNS_12SourceStreamE
-__ZNK3KJS16ArgumentListNode8streamToERNS_12SourceStreamE
-__ZNK3KJS11ResolveNode10precedenceEv
-__ZNK3KJS11ResolveNode8streamToERNS_12SourceStreamE
-__ZNK3KJS13AssignDotNode8streamToERNS_12SourceStreamE
-__ZNK3KJS8ThisNode10precedenceEv
-__ZNK3KJS8ThisNode8streamToERNS_12SourceStreamE
-__ZNK3KJS19FunctionCallDotNode10precedenceEv
-__ZNK3KJS19FunctionCallDotNode8streamToERNS_12SourceStreamE
-__ZNK3KJS16FunctionBodyNode11paramStringEv
-__ZNK3KJS15RegExpObjectImp14arrayOfMatchesEPNS_9ExecStateE
-__ZN3KJS9Arguments17mappedIndexGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS19arrayProtoFuncSliceEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS22functionProtoFuncApplyEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS13ArrayInstance9classInfoEv
-__ZN3KJS24substituteBackreferencesERKNS_7UStringES2_PiPNS_6RegExpE
-__ZNK3KJS15DotAccessorNode10precedenceEv
-__ZNK3KJS15DotAccessorNode8streamToERNS_12SourceStreamE
-__ZNK3KJS16VarStatementNode8streamToERNS_12SourceStreamE
-__ZNK3KJS17AssignResolveNode8streamToERNS_12SourceStreamE
-__ZNK3KJS6IfNode8streamToERNS_12SourceStreamE
-__ZNK3KJS14LogicalNotNode8streamToERNS_12SourceStreamE
-__ZNK3KJS9ArrayNode10precedenceEv
-__ZNK3KJS9ArrayNode8streamToERNS_12SourceStreamE
-__ZNK3KJS11ElementNode8streamToERNS_12SourceStreamE
-__ZNK3KJS10StringNode10precedenceEv
-__ZNK3KJS10StringNode8streamToERNS_12SourceStreamE
-__ZN3KJS29escapeStringForPrettyPrintingERKNS_7UStringE
-__ZNK3KJS9BlockNode8streamToERNS_12SourceStreamE
-__ZNK3KJS17AssignBracketNode8streamToERNS_12SourceStreamE
-__ZNK3KJS10IfElseNode8streamToERNS_12SourceStreamE
-__ZNK3KJS9EqualNode8streamToERNS_12SourceStreamE
-__ZNK3KJS9EqualNode10precedenceEv
-__ZN3KJS35streamLeftAssociativeBinaryOperatorERNS_12SourceStreamENS_10PrecedenceEPKcPKNS_4NodeES7_
-__ZNK3KJS17ReadModifyDotNode8streamToERNS_12SourceStreamE
-__ZNK3KJS7AddNode10precedenceEv
-__ZNK3KJS7AddNode8streamToERNS_12SourceStreamE
-__ZNK3KJS15ConditionalNode10precedenceEv
-__ZNK3KJS15ConditionalNode8streamToERNS_12SourceStreamE
-__ZNK3KJS10RegExpNode10precedenceEv
-__ZNK3KJS10RegExpNode8streamToERNS_12SourceStreamE
-__ZNK3KJS21ReadModifyResolveNode8streamToERNS_12SourceStreamE
-__ZNK3KJS7TryNode8streamToERNS_12SourceStreamE
-__ZNK3KJS11NewExprNode10precedenceEv
-__ZNK3KJS11NewExprNode8streamToERNS_12SourceStreamE
-__ZNK3KJS10NumberNode10precedenceEv
-__ZNK3KJS10NumberNode8streamToERNS_12SourceStreamE
-__ZN3KJS12SourceStreamlsEd
-__ZNK3KJS13LogicalOrNode10precedenceEv
-__ZNK3KJS13LogicalOrNode8streamToERNS_12SourceStreamE
-__ZNK3KJS8NullNode10precedenceEv
-__ZNK3KJS8NullNode8streamToERNS_12SourceStreamE
-__ZNK3KJS14LogicalAndNode8streamToERNS_12SourceStreamE
-__ZNK3KJS14LogicalAndNode10precedenceEv
-__ZNK3KJS14LogicalNotNode10precedenceEv
-__ZN3KJS7UString17expandPreCapacityEi
-__ZN3KJS19BracketAccessorNode17evaluateToBooleanEPNS_9ExecStateE
-__ZNK3KJS11GreaterNode10precedenceEv
-__ZNK3KJS11GreaterNode8streamToERNS_12SourceStreamE
-__ZNK3KJS17ObjectLiteralNode10precedenceEv
-__ZNK3KJS17ObjectLiteralNode8streamToERNS_12SourceStreamE
-__ZNK3KJS16PropertyListNode8streamToERNS_12SourceStreamE
-__ZNK3KJS12PropertyNode8streamToERNS_12SourceStreamE
-__ZNK3KJS8LessNode10precedenceEv
-__ZNK3KJS8LessNode8streamToERNS_12SourceStreamE
-__ZNK3KJS19BracketAccessorNode10precedenceEv
-__ZNK3KJS19BracketAccessorNode8streamToERNS_12SourceStreamE
-__ZNK3KJS15TypeOfValueNode10precedenceEv
-__ZNK3KJS15TypeOfValueNode8streamToERNS_12SourceStreamE
-__ZNK3KJS7ForNode8streamToERNS_12SourceStreamE
-__ZNK3KJS9CommaNode8streamToERNS_12SourceStreamE
-__ZNK3KJS17AssignResolveNode10precedenceEv
-__ZNK3KJS23FunctionCallResolveNode10precedenceEv
-__ZNK3KJS12FuncExprNode10precedenceEv
-__ZNK3KJS12FuncExprNode8streamToERNS_12SourceStreamE
-__ZNK3KJS13ParameterNode8streamToERNS_12SourceStreamE
-__ZNK3KJS9ForInNode8streamToERNS_12SourceStreamE
-__ZNK3KJS10ReturnNode8streamToERNS_12SourceStreamE
-__ZNK3KJS13GreaterEqNode10precedenceEv
-__ZNK3KJS13GreaterEqNode8streamToERNS_12SourceStreamE
-__ZNK3KJS8TrueNode10precedenceEv
-__ZNK3KJS8TrueNode8streamToERNS_12SourceStreamE
-__ZNK3KJS21FunctionCallValueNode8streamToERNS_12SourceStreamE
-__ZN3KJS11ElementNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS8MultNode10precedenceEv
-__ZNK3KJS8MultNode8streamToERNS_12SourceStreamE
-__ZN3KJS21functionProtoFuncCallEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS4List8getSliceEiRS0_
-__ZN3KJS10IfElseNode7executeEPNS_9ExecStateE
-__ZN3KJS6InNode17evaluateToBooleanEPNS_9ExecStateE
-__ZNK3KJS12NotEqualNode10precedenceEv
-__ZNK3KJS12NotEqualNode8streamToERNS_12SourceStreamE
-__ZN3KJS17AssignResolveNode8evaluateEPNS_9ExecStateE
-__ZN3KJS13DeleteDotNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS12ContinueNode7executeEPNS_9ExecStateE
-__ZN3KJS13DeleteDotNode8evaluateEPNS_9ExecStateE
-__ZN3KJS11FunctionImp14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3KJS8JSObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZNK3KJS11PropertyMap3getERKNS_10IdentifierERj
-__ZN3KJS11GreaterNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS13PrefixDotNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS13PreIncDotNode8evaluateEPNS_9ExecStateE
-__ZN3KJS14JSGlobalObject3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
-__ZNK3KJS8JSObject8toStringEPNS_9ExecStateE
-__ZNK3KJS8JSObject11toPrimitiveEPNS_9ExecStateENS_6JSTypeE
-__ZNK3KJS8JSObject12defaultValueEPNS_9ExecStateENS_6JSTypeE
-__ZN3KJS22arrayProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E3addIPN3KJS16RuntimeObjectImpESB_NS_17HashSetTranslatorILb1ESB_NS5_ISB_EES6_NS_7PtrHashISB_EEEEEESt4pairINS_17HashTableIteratorIiiS2_S4_S6_S6_EEbERKT_RKT0_
-__ZN3KJS11JSImmediate8toStringEPKNS_7JSValueE
-__ZN3KJS12NotEqualNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS21arrayProtoFuncIndexOfEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS14ErrorObjectImp19implementsConstructEv
-__ZN3KJS14ErrorObjectImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS9Collector7collectEv
-__ZN3KJS9Collector31markCurrentThreadConservativelyEv
-__ZN3KJS9Collector30markStackObjectsConservativelyEPvS1_
-__ZN3KJS6JSCell4markEv
-__ZN3KJS8JSObject4markEv
-__ZNK3KJS11PropertyMap4markEv
-__ZN3KJS11FunctionImp4markEv
-__ZN3KJS14JSGlobalObject4markEv
-__ZN3KJS16JSVariableObject4markEv
-__ZN3KJS13ArrayInstance4markEv
-__ZN3KJS15JSWrapperObject4markEv
-__ZN3KJS13ActivationImp4markEv
-__ZN3KJS13ActivationImp12markChildrenEv
-__ZN3KJS14NativeErrorImp4markEv
-__ZN3KJS9Arguments4markEv
-__ZN3KJS9Collector20markProtectedObjectsEv
-__ZN3KJS9Collector5sweepILNS0_8HeapTypeE0EEEmb
-__ZN3KJS11PropertyMapD1Ev
-__ZN3KJS11FunctionImpD0Ev
-__ZN3KJS9StringImpD0Ev
-__ZN3KJS9RegExpImpD0Ev
-__ZN3KJS13ArrayInstanceD0Ev
-__ZN3KJS9ArgumentsD0Ev
-__ZN3KJS9Collector5sweepILNS0_8HeapTypeE1EEEmb
-__ZN3KJS14AddStringsNode8evaluateEPNS_9ExecStateE
-__ZN3KJS17AddStringLeftNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS9StringImp11toPrimitiveEPNS_9ExecStateENS_6JSTypeE
-__ZN3KJS7AddNode8evaluateEPNS_9ExecStateE
-__ZN3KJS21stringProtoFuncCharAtEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS26stringProtoFuncToUpperCaseEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS24stringProtoFuncSubstringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS26stringProtoFuncToLowerCaseEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS7UString8toUInt32EPb
-__ZN3KJS22ReadModifyLocalVarNode8evaluateEPNS_9ExecStateE
-__ZN3KJS19PostIncLocalVarNode8evaluateEPNS_9ExecStateE
-__ZN3KJS17PreDecResolveNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS18PreDecLocalVarNode8evaluateEPNS_9ExecStateE
-__ZN3KJS8MultNode16evaluateToNumberEPNS_9ExecStateE
-__ZNK3KJS9NumberImp4typeEv
-__ZN3KJS20dateProtoFuncSetTimeEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS7SubNode16evaluateToNumberEPNS_9ExecStateE
-__ZNK3KJS9StringImp8toNumberEPNS_9ExecStateE
-__ZN3KJS18globalFuncParseIntEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS7JSValue15toInt32SlowCaseEPNS_9ExecStateERb
-__ZN3KJS24dateProtoFuncToGMTStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS10formatTimeERKNS_17GregorianDateTimeEb
-__ZNK3KJS15RegExpObjectImp19implementsConstructEv
-__ZN3KJS15RegExpObjectImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS19regExpProtoFuncExecEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS14StringInstance18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
-__ZN3KJS35stringInstanceNumericPropertyGetterEPNS_9ExecStateEPNS_8JSObjectEjRKNS_12PropertySlotE
-__ZN3KJS23FunctionCallResolveNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS15globalFuncIsNaNEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS20dateProtoFuncSetYearEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS21gregorianDateTimeToMSERKNS_17GregorianDateTimeEdb
-__ZN3KJS15dateToDayInYearEiii
-__ZN3KJS21ReadModifyBracketNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZNK3KJS15ObjectObjectImp19implementsConstructEv
-__ZN3KJS21ReadModifyBracketNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS9ExecState12hadExceptionEv
-__ZNK3KJS7JSValue8toObjectEPNS_9ExecStateE
-__ZNK3KJS7JSValue8toStringEPNS_9ExecStateE
-__ZN3KJS7UStringD1Ev
-__ZN3KJS8JSObject15getPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZNK3KJS12PropertySlot8getValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierE
-__ZNK3WTF6RefPtrIN3KJS14ExpressionNodeEE3getEv
-__ZN3KJS3addEPNS_9ExecStateEPNS_7JSValueES3_
-__ZN3KJS10IdentifierD1Ev
-__ZNK3KJS8JSObject3getEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3KJS20arrayProtoFuncConcatEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS14ExpressionNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS9BreakNode7executeEPNS_9ExecStateE
-__ZN3KJS18arrayProtoFuncJoinEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS11JSImmediate8toObjectEPKNS_7JSValueEPNS_9ExecStateE
-__ZN3KJS10throwErrorEPNS_9ExecStateENS_9ErrorTypeEPKc
-__ZN3KJS5Error6createEPNS_9ExecStateENS_9ErrorTypeERKNS_7UStringEiiS6_
-__ZN3KJS14NativeErrorImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZNK3KJS6JSCell17getTruncatedInt32ERi
-__ZN3KJS15StringObjectImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS9Collector15recordExtraCostEm
-__ZN3KJS22objectProtoFuncValueOfEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS23objectProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS8JSObject9classNameEv
-__ZN3KJS14PostDecDotNode8evaluateEPNS_9ExecStateE
-__ZN3KJS9CommaNodeD1Ev
-__ZN3KJS28globalFuncDecodeURIComponentEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS6decodeEPNS_9ExecStateERKNS_4ListEPKcb
-__ZN3KJS19BracketAccessorNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS15TypeOfValueNodeD1Ev
-__ZN3KJS17PrototypeFunctionD0Ev
-__ZN3KJS13ErrorInstanceD0Ev
-__ZN3KJS18mathProtoFuncRoundEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS23FunctionCallResolveNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS13GreaterEqNodeD1Ev
-__ZN3KJS7ModNodeD1Ev
-__ZN3KJS24LocalVarFunctionCallNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS4List15expandAndAppendEPNS_7JSValueE
-__ZN3WTF6VectorIPN3KJS7JSValueELm8EE15reserveCapacityEm
-__ZN3KJS10SwitchNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS13CaseBlockNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS14ClauseListNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS14CaseClauseNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS10SwitchNode7executeEPNS_9ExecStateE
-__ZN3KJS13CaseBlockNode12executeBlockEPNS_9ExecStateEPNS_7JSValueE
-__ZN3KJS18NotStrictEqualNode17evaluateToBooleanEPNS_9ExecStateE
-__Z23_NPN_CreateScriptObjectP4_NPPPN3KJS8JSObjectEN3WTF10PassRefPtrINS1_8Bindings10RootObjectEEE
-__NPN_CreateObject
-__Z10jsAllocateP4_NPPP7NPClass
-__NPN_RetainObject
-__NPN_Evaluate
-__ZNK3KJS8Bindings10RootObject12globalObjectEv
-__ZN3KJS8Bindings22convertNPStringToUTF16EPK9_NPStringPPtPj
-__ZN3KJS8Bindings36convertUTF8ToUTF16WithLatin1FallbackEPKciPPtPj
-__ZN3WTF7Unicode18convertUTF8ToUTF16EPPKcS2_PPtS4_b
-__ZN3KJS11Interpreter8evaluateEPNS_9ExecStateERKNS_7UStringEiS5_PNS_7JSValueE
-__ZN3KJS8Bindings23convertValueToNPVariantEPNS_9ExecStateEPNS_7JSValueEP10_NPVariant
-__ZN3KJS11JSImmediate4typeEPKNS_7JSValueE
-__NPN_GetStringIdentifier
-__ZN3KJS8Bindings26identifierFromNPIdentifierEPKc
-__NPN_Invoke
-__ZN3KJS8Bindings14findRootObjectEPNS_14JSGlobalObjectE
-__NPN_ReleaseVariantValue
-__ZNK3KJS7UString10UTF8StringEb
+__ZN3JSC10JSFunction18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC10JSFunction11getCallDataERNS_8CallDataE
+__ZN3JSC4callEPNS_9ExecStateENS_7JSValueENS_8CallTypeERKNS_8CallDataES2_RKNS_7ArgListE
+__ZN3JSC11Interpreter7executeEPNS_16FunctionBodyNodeEPNS_9ExecStateEPNS_10JSFunctionEPNS_8JSObjectERKNS_7ArgListEPNS_14ScopeCha
+__ZNK3JSC15DotAccessorNode10isLocationEv
+__ZNK3JSC14ExpressionNode13isResolveNodeEv
+__ZNK3JSC14ExpressionNode21isBracketAccessorNodeEv
+__ZN3JSC19FunctionCallDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC19FunctionCallDotNodeD0Ev
+__ZL26appendToVarDeclarationListPvRPN3JSC15ParserArenaDataIN3WTF6VectorISt4pairINS0_10IdentifierEjELm0EEEEERKS5_j
+__ZN3WTF6VectorISt4pairIN3JSC10IdentifierEjELm0EE14expandCapacityEm
+__ZL14makeAssignNodePvPN3JSC14ExpressionNodeENS0_8OperatorES2_bbiii
+__ZL11makeAddNodePvPN3JSC14ExpressionNodeES2_b
+__ZN3JSC16VarStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17AssignResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC11UnaryOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC10RegExpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC6RegExp6createEPNS_12JSGlobalDataERKNS_7UStringES5_
+__ZN3JSC4Yarr15jitCompileRegexEPNS_12JSGlobalDataERNS0_14RegexCodeBlockERKNS_7UStringERjRPKcbb
+__ZN3JSC4Yarr12compileRegexERKNS_7UStringERNS0_12RegexPatternE
+__ZN3JSC4Yarr18PatternDisjunction17addNewAlternativeEv
+__ZN3WTF6VectorIPN3JSC4Yarr18PatternAlternativeELm0EE14expandCapacityEm
+__ZN3JSC4Yarr6ParserINS0_23RegexPatternConstructorEE11parseTokensEv
+__ZN3WTF6VectorIN3JSC4Yarr11PatternTermELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN3JSC4Yarr11PatternTermELm0EE14expandCapacityEm
+__ZN3JSC4Yarr6ParserINS0_23RegexPatternConstructorEE11parseEscapeILb0ES2_EEbRT0_
+__ZN3JSC4Yarr23RegexPatternConstructor25atomBuiltInCharacterClassENS0_23BuiltInCharacterClassIDEb
+__ZN3JSC4Yarr14wordcharCreateEv
+__ZN3WTF6VectorItLm0EE14expandCapacityEm
+__ZN3WTF6VectorIN3JSC4Yarr14CharacterRangeELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN3JSC4Yarr14CharacterRangeELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN3JSC4Yarr14CharacterClassELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorIPN3JSC4Yarr14CharacterClassELm0EE14expandCapacityEm
+__ZN3JSC4Yarr14RegexGenerator19generateDisjunctionEPNS0_18PatternDisjunctionE
+__ZN3JSC12X86Assembler7addl_irEiNS_3X8610RegisterIDE
+__ZN3JSC23MacroAssemblerX86Common8branch32ENS0_9ConditionENS_3X8610RegisterIDES3_
+__ZN3JSC22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpList6appendENS2_4JumpE
+__ZN3JSC4Yarr14RegexGenerator12generateTermERNS1_19TermGenerationStateE
+__ZN3JSC23MacroAssemblerX86Common8branch32ENS0_9ConditionENS_3X8610RegisterIDENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5I
+__ZN3JSC4Yarr14RegexGenerator19TermGenerationState15jumpToBacktrackENS_22AbstractMacroAssemblerINS_12X86AssemblerEE4JumpEPNS_14
+__ZN3JSC4Yarr14RegexGenerator13readCharacterEiNS_3X8610RegisterIDE
+__ZN3JSC4Yarr14RegexGenerator19matchCharacterClassENS_3X8610RegisterIDERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpLis
+__ZN3JSC4Yarr14RegexGenerator24matchCharacterClassRangeENS_3X8610RegisterIDERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE8Ju
+__ZN3JSC22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpList4linkEPS2_
+__ZN3JSC23MacroAssemblerX86Common4jumpEv
+__ZN3WTF6VectorIN3JSC22AbstractMacroAssemblerINS1_12X86AssemblerEE4JumpELm16EED1Ev
+__ZN3JSC4Yarr14RegexGenerator28generateCharacterClassGreedyERNS1_19TermGenerationStateE
+__ZN3JSC12X86Assembler7subl_irEiNS_3X8610RegisterIDE
+__ZN3JSC15AssemblerBuffer4growEv
+__ZN3WTF15deleteAllValuesIPN3JSC4Yarr14CharacterClassELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN3JSC17BytecodeGenerator13emitNewRegExpEPNS_10RegisterIDEPNS_6RegExpE
+__ZN3JSC15ConditionalNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC9EqualNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC14ExpressionNode6isNullEv
+__ZNK3JSC10StringNode6isPureERNS_17BytecodeGeneratorE
+__ZN3JSC19BracketAccessorNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC10NumberNode6isPureERNS_17BytecodeGeneratorE
+__ZN3JSC10NumberNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator8emitLoadEPNS_10RegisterIDEd
+__ZN3JSC17BytecodeGenerator12emitGetByValEPNS_10RegisterIDES2_S2_
+__ZN3JSC17BytecodeGenerator14emitEqualityOpENS_8OpcodeIDEPNS_10RegisterIDES3_S3_
+__ZN3JSC19ReverseBinaryOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC14ExpressionNode5isAddEv
+__ZN3JSC12SmallStrings27createSingleCharacterStringEPNS_12JSGlobalDataEh
+__ZN3JSC13AssignDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator11emitPutByIdEPNS_10RegisterIDERKNS_10IdentifierES2_
+__ZN3JSC17AssignResolveNodeD0Ev
+__ZN3JSC15ParserArenaDataIN3WTF6VectorISt4pairINS_10IdentifierEjELm0EEEED0Ev
+__ZN3JSC16VarStatementNodeD0Ev
+__ZN3JSC14LogicalNotNodeD0Ev
+__ZN3JSC10RegExpNodeD0Ev
+__ZN3JSC10NumberNodeD0Ev
+__ZN3JSC19BracketAccessorNodeD0Ev
+__ZN3JSC9EqualNodeD0Ev
+__ZN3JSC15ConditionalNodeD0Ev
+__ZN3JSC7AddNodeD0Ev
+__ZN3JSC13GreaterEqNodeD0Ev
+__ZN3JSC13AssignDotNodeD0Ev
+__ZN3JSC3JIT13emit_op_jtrueEPNS_11InstructionE
+__ZN3JSC3JIT18emit_op_new_regexpEPNS_11InstructionE
+__ZN3JSC3JIT18emit_op_get_by_valEPNS_11InstructionE
+__ZN3JSC3JIT10emit_op_eqEPNS_11InstructionE
+__ZN3JSC3JIT11emit_op_addEPNS_11InstructionE
+__ZN3JSC11JITStubCall11addArgumentEjNS_3X8610RegisterIDE
+__ZN3JSC3JIT16emit_op_jnlesseqEPNS_11InstructionE
+__ZN3JSC3JIT17emit_op_put_by_idEPNS_11InstructionE
+__ZN3JSC3JIT21compilePutByIdHotPathEiPNS_10IdentifierEij
+__ZN3JSC3JIT17emitSlow_op_jtrueEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT22emitSlow_op_get_by_valEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT14emitSlow_op_eqEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT20emitSlow_op_jnlesseqEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC20MacroAssemblerX86_6413branchTestPtrENS_23MacroAssemblerX86Common9ConditionENS_3X8610RegisterIDES4_
+__ZN3JSC12X86Assembler23X86InstructionFormatter9twoByteOpENS0_15TwoByteOpcodeIDEiNS_3X8610RegisterIDE
+__ZN3JSC23MacroAssemblerX86Common12branchDoubleENS0_15DoubleConditionENS_3X8613XMMRegisterIDES3_
+__ZN3JSC3JIT21emitSlow_op_put_by_idEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT22compilePutByIdSlowCaseEiPNS_10IdentifierEiRPNS_13SlowCaseEntryEj
+__ZN3JSC13LogicalOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3WTF6VectorIN3JSC17GlobalResolveInfoELm0EE14expandCapacityEm
+__ZN3JSC17BytecodeGenerator14emitJumpIfTrueEPNS_10RegisterIDEPNS_5LabelE
+__ZN3JSC13LogicalOpNodeD0Ev
+__ZN3JSC3JIT22emit_op_resolve_globalEPNS_11InstructionE
+__ZN3JSC8JITStubs21cti_op_resolve_globalEPPv
+__ZNK3JSC8JSString9toBooleanEPNS_9ExecStateE
+__ZN3JSC8JSString18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC15StringPrototype18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC12StringObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSCL20stringProtoFuncMatchEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC8JSString12toThisStringEPNS_9ExecStateE
+__ZNK3JSC6JSCell8isObjectEPKNS_9ClassInfoE
+__ZNK3JSC6JSCell9classInfoEv
+__ZN3JSC4Yarr23RegexPatternConstructor20atomPatternCharacterEt
+__ZN3JSC4Yarr25CharacterClassConstructor7putCharEt
+__ZN3JSC4Yarr25CharacterClassConstructor9addSortedERN3WTF6VectorItLm0EEEt
+__ZN3JSC4Yarr23RegexPatternConstructor21atomCharacterClassEndEv
+__ZN3JSC4Yarr23RegexPatternConstructor23setupDisjunctionOffsetsEPNS0_18PatternDisjunctionEjj
+__ZN3JSC4Yarr14RegexGenerator25generateParenthesesSingleERNS1_19TermGenerationStateE
+__ZN3JSC4Yarr14RegexGenerator30generateParenthesesDisjunctionERNS0_11PatternTermERNS1_19TermGenerationStateEj
+__ZN3WTF6VectorIN3JSC4Yarr14RegexGenerator26AlternativeBacktrackRecordELm0EE14expandCapacityEm
+__ZN3JSC4Yarr14RegexGenerator19jumpIfCharNotEqualsEti
+__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDEiNS_3X8610RegisterIDES4_ii
+__ZN3JSC4Yarr14RegexGenerator19TermGenerationState15jumpToBacktrackERNS_22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpListEP
+__ZN3JSC17RegExpConstructor12performMatchEPNS_6RegExpERKNS_7UStringEiRiS6_PPi
+__ZN3JSC6RegExp5matchERKNS_7UStringEiPN3WTF11OwnArrayPtrIiEE
+__ZN3JSC4Yarr12executeRegexERNS0_14RegexCodeBlockEPKtjjPii
+__ZN3JSC8JITStubs17cti_op_new_regexpEPPv
+__ZN3JSC12RegExpObjectC1EN3WTF10PassRefPtrINS_9StructureEEENS2_INS_6RegExpEEE
+__ZNK3JSC12RegExpObject9classInfoEv
+__ZN3JSC18RegExpMatchesArrayC2EPNS_9ExecStateEPNS_24RegExpConstructorPrivateE
+__ZN3JSC8JITStubs17cti_op_get_by_valEPPv
+__ZN3JSC18RegExpMatchesArray18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC18RegExpMatchesArray17fillArrayInstanceEPNS_9ExecStateE
+__ZN3JSC11jsSubstringEPNS_12JSGlobalDataERKNS_7UStringEjj
+__ZN3JSC7JSArray3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC8JSObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC7JSArray18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC8JITStubs9cti_op_eqEPPv
+__ZN3JSCeqERKNS_7UStringES2_
+__ZN3JSC8JITStubs10cti_op_addEPPv
+__ZN3JSC11concatenateEPNS_7UString3RepES2_
+__ZN3JSCL22stringProtoFuncIndexOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC7UString4findERKS0_i
+__ZN3JSC8JITStubs16cti_op_put_by_idEPPv
+__ZNK3JSC7UString8toUInt32EPbb
+__ZNK3JSC7UString8toDoubleEbb
+__ZNK3JSC7UString10getCStringERN3WTF6VectorIcLm32EEE
+__ZN3WTF14FastMallocZone11forceUnlockEP14_malloc_zone_t
+__Z15jsRegExpCompilePKti24JSRegExpIgnoreCaseOption23JSRegExpMultilineOptionPjPPKc
+__ZL30calculateCompiledPatternLengthPKti24JSRegExpIgnoreCaseOptionR11CompileDataR9ErrorCode
+__ZL11checkEscapePPKtS0_P9ErrorCodeib
+__ZL13compileBranchiPiPPhPPKtS3_P9ErrorCodeS_S_R11CompileData
+__Z15jsRegExpExecutePK8JSRegExpPKtiiPii
+__ZL5matchPKtPKhiR9MatchData
+__ZNK3JSC7UString14toStrictUInt32EPb
+__ZN3JSC17ObjectLiteralNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC16PropertyListNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC7TryNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator9emitCatchEPNS_10RegisterIDEPNS_5LabelES4_
+__ZN3WTF6VectorIN3JSC11HandlerInfoELm0EE14expandCapacityEm
+__ZN3JSC17BytecodeGenerator16emitPushNewScopeEPNS_10RegisterIDERNS_10IdentifierES2_
+__ZN3WTF6VectorIN3JSC18ControlFlowContextELm0EE14expandCapacityEm
+__ZNK3JSC14ExpressionNode6isPureERNS_17BytecodeGeneratorE
+__ZN3JSC12PropertyNodeD0Ev
+__ZN3JSC16PropertyListNodeD0Ev
+__ZN3JSC17ObjectLiteralNodeD0Ev
+__ZN3JSC7TryNodeD0Ev
+__ZN3JSC3JIT18emit_op_new_objectEPNS_11InstructionE
+__ZN3JSC3JIT13emit_op_catchEPNS_11InstructionE
+__ZN3JSC3JIT22emit_op_push_new_scopeEPNS_11InstructionE
+__ZN3JSC3JIT15emit_op_resolveEPNS_11InstructionE
+__ZN3JSC3JIT17emit_op_pop_scopeEPNS_11InstructionE
+__ZN3JSC8JITStubs17cti_op_new_objectEPPv
+__ZN3JSC20constructEmptyObjectEPNS_9ExecStateE
+__ZN3JSC17StructureStubInfo5derefEv
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEES5_NS_17IdentityExtractorIS5_EENS2_17IdentifierRepHashENS_10HashTraitsIS5_EES
+__ZN3JSC8ThisNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC21ThrowableBinaryOpNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC8ThisNodeD0Ev
+__ZN3JSC6InNodeD0Ev
+__ZN3JSC3JIT29emit_op_enter_with_activationEPNS_11InstructionE
+__ZN3JSC3JIT20emit_op_convert_thisEPNS_11InstructionE
+__ZN3JSC3JIT27emit_op_tear_off_activationEPNS_11InstructionE
+__ZN3JSC3JIT24emitSlow_op_convert_thisEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs22cti_op_push_activationEPPv
+__ZN3JSC12JSActivationC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_16FunctionBodyNodeEEE
+__ZN3JSC12JSActivationC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_16FunctionBodyNodeEEE
+__ZN3JSC4Yarr6ParserINS0_23RegexPatternConstructorEE11parseEscapeILb1ENS3_28CharacterClassParserDelegateEEEbRT0_
+__ZN3JSC4Yarr12digitsCreateEv
+__ZN3JSC4Yarr25CharacterClassConstructor6appendEPKNS0_14CharacterClassE
+__ZN3JSC4Yarr25CharacterClassConstructor14addSortedRangeERN3WTF6VectorINS0_14CharacterRangeELm0EEEtt
+__ZN3JSC4Yarr6ParserINS0_23RegexPatternConstructorEE28CharacterClassParserDelegate20atomPatternCharacterEt
+__ZN3JSC11GreaterNodeD0Ev
+__ZN3JSCL26stringProtoFuncToLowerCaseEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JSString14toThisJSStringEPNS_9ExecStateE
+__ZN3JSC7UStringC2EPtib
+__ZN3JSC18globalFuncParseIntEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC11JSImmediate12nonInlineNaNEv
+__ZN3JSC8JITStubs11cti_op_lessEPPv
+__ZN3JSC8JITStubs9cti_op_inEPPv
+__ZNK3JSC6JSCell9getUInt32ERj
+__ZNK3JSC8JSObject11hasPropertyEPNS_9ExecStateERKNS_10IdentifierE
+__ZL14makePrefixNodePvPN3JSC14ExpressionNodeENS0_8OperatorEiii
+__ZN3JSC7ForNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator13newLabelScopeENS_10LabelScope4TypeEPKNS_10IdentifierE
+__ZN3JSC12ContinueNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator14continueTargetERKNS_10IdentifierE
+__ZN3JSC17BytecodeGenerator14emitJumpScopesEPNS_5LabelEi
+__ZN3JSC17PrefixResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC21ReadModifyResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC11NewExprNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator13emitConstructEPNS_10RegisterIDES2_PNS_13ArgumentsNodeEjjj
+__ZN3WTF6VectorIN3JSC20GetByIdExceptionInfoELm0EE14expandCapacityEm
+__ZN3JSC8LessNodeD0Ev
+__ZN3JSC17PrefixResolveNodeD0Ev
+__ZN3JSC12ContinueNodeD0Ev
+__ZN3JSC7ForNodeD0Ev
+__ZN3JSC21ReadModifyResolveNodeD0Ev
+__ZN3JSC11NewExprNodeD0Ev
+__ZN3JSC3JIT11emit_op_notEPNS_11InstructionE
+__ZN3JSC3JIT15emit_op_pre_incEPNS_11InstructionE
+__ZN3JSC3JIT20emit_op_loop_if_lessEPNS_11InstructionE
+__ZN3JSC3JIT16emitTimeoutCheckEv
+__ZN3JSC3JIT20compileBinaryArithOpENS_8OpcodeIDEjjjNS_12OperandTypesE
+__ZN3JSC3JIT11emit_op_subEPNS_11InstructionE
+__ZN3JSC3JIT17emit_op_constructEPNS_11InstructionE
+__ZN3JSC3JIT24emit_op_construct_verifyEPNS_11InstructionE
+__ZN3JSC3JIT15emitSlow_op_notEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT19emitSlow_op_pre_incEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT24emitSlow_op_loop_if_lessEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT15emitSlow_op_addEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT28compileBinaryArithOpSlowCaseENS_8OpcodeIDERPNS_13SlowCaseEntryEjjjNS_12OperandTypesE
+__ZN3JSC15AssemblerBuffer7putByteEi
+__ZN3JSC12X86Assembler23X86InstructionFormatter11twoByteOp64ENS0_15TwoByteOpcodeIDEiNS_3X8610RegisterIDE
+__ZN3JSC3JIT15emitSlow_op_subEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT21emitSlow_op_constructEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT27compileOpConstructSetupArgsEPNS_11InstructionE
+__ZN3JSC3JIT28emitSlow_op_construct_verifyEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC7UString4fromEj
+__ZN3JSC10Identifier11addSlowCaseEPNS_9ExecStateEPNS_7UString3RepE
+__ZN3JSC8JITStubs10cti_op_notEPPv
+__ZN3JSC8JITStubs24cti_op_get_by_id_genericEPPv
+__ZN3JSC7JSArrayC2EN3WTF10PassRefPtrINS_9StructureEEERKNS_7ArgListE
+__ZN3JSC7JSArray18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSCL24stringProtoFuncSubstringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs31cti_op_construct_NotJSConstructEPPv
+__ZN3JSC3JIT33privateCompilePatchGetArrayLengthENS_22AbstractMacroAssemblerINS_12X86AssemblerEE22ProcessorReturnAddressE
+__ZN3JSC8JITStubs27cti_op_get_by_id_proto_listEPPv
+__ZN3JSC3JIT30privateCompileGetByIdProtoListEPNS_17StructureStubInfoEPNS_30PolymorphicAccessStructureListEiPNS_9StructureES6_mP
+__ZN3JSC3JIT16patchGetByIdSelfEPNS_17StructureStubInfoEPNS_9StructureEmNS_22AbstractMacroAssemblerINS_12X86AssemblerEE22Process
+__ZN3JSC14StructureChainC1EPNS_9StructureE
+__ZN3JSC14StructureChainC2EPNS_9StructureE
+__ZN3JSC3JIT26privateCompileGetByIdChainEPNS_17StructureStubInfoEPNS_9StructureEPNS_14StructureChainEmmNS_22AbstractMacroAssemb
+__ZN3JSC8JITStubs23cti_op_put_by_id_secondEPPv
+__ZN3JSC8JITStubs15tryCachePutByIDEPNS_9ExecStateEPNS_9CodeBlockEPvNS_7JSValueERKNS_15PutPropertySlotE
+__ZN3JSC8JITStubs24cti_op_put_by_id_genericEPPv
+__ZN3JSC8JITStubs26cti_op_tear_off_activationEPPv
+__ZN3JSC8JITStubs21cti_op_ret_scopeChainEPPv
+__ZN3JSC17BytecodeGenerator16emitPutScopedVarEmiPNS_10RegisterIDENS_7JSValueE
+__ZN3JSC3JIT22emit_op_get_scoped_varEPNS_11InstructionE
+__ZN3JSC3JIT22emit_op_put_scoped_varEPNS_11InstructionE
+__ZN3JSC3JIT29emitPutVariableObjectRegisterENS_3X8610RegisterIDES2_i
+__ZN3JSC12X86Assembler7movq_rrENS_3X8610RegisterIDENS1_13XMMRegisterIDE
+__ZN3WTF20TCMalloc_ThreadCache18DestroyThreadCacheEPv
+__ZN3WTF20TCMalloc_ThreadCache11DeleteCacheEPS0_
+__ZN3JSC15StrictEqualNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC15StrictEqualNodeD0Ev
+__ZN3JSC3JIT16emit_op_stricteqEPNS_11InstructionE
+__ZN3JSC3JIT17compileOpStrictEqEPNS_11InstructionENS0_21CompileOpStrictEqTypeE
+__ZN3JSC3JIT20emitSlow_op_stricteqEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs15cti_op_stricteqEPPv
+__ZN3WTF12detachThreadEj
+__ZN3WTFL26pthreadHandleForIdentifierEj
+__ZN3WTFL31clearPthreadHandleForIdentifierEj
+__ZN3WTF6VectorIPNS0_IN3JSC10IdentifierELm64EEELm32EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorIPNS0_IN3JSC10IdentifierELm64EEELm32EE15reserveCapacityEm
+__ZN3JSC8NullNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC8NullNodeD0Ev
+__ZN3WTF7HashMapISt4pairINS_6RefPtrIN3JSC7UString3RepEEEjEPNS3_9StructureENS3_28StructureTransitionTableHashENS3_34StructureTra
+__ZN3WTF9HashTableISt4pairINS_6RefPtrIN3JSC7UString3RepEEEjES1_IS7_PNS3_9StructureEENS_18PairFirstExtractorISA_EENS3_28Structur
+__ZN3JSC9Structure22materializePropertyMapEv
+__ZN3JSC15TypeOfValueNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC15TypeOfValueNodeD0Ev
+__ZN3JSC12NotEqualNodeD0Ev
+__ZN3JSC3JIT11emit_op_neqEPNS_11InstructionE
+__ZN3JSC3JIT15emitSlow_op_neqEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs13cti_op_typeofEPPv
+__ZN3JSC20jsTypeStringForValueEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC8JITStubs10cti_op_neqEPPv
+__ZN3JSC14ExecutablePool13systemReleaseERKNS0_10AllocationE
+__ZN3WTF6VectorItLm0EE14expandCapacityEmPKt
+__ZNK3JSC10NumberNode8isNumberEv
+__ZNK3JSC14ExpressionNode10isLocationEv
+__ZN3WTF6VectorIPN3JSC10RegisterIDELm32EE14expandCapacityEm
+__ZNK3JSC11BooleanNode6isPureERNS_17BytecodeGeneratorE
+__ZN3JSC4Yarr13newlineCreateEv
+__ZN3JSC12X86Assembler23X86InstructionFormatter15emitRexIfNeededEiii
+__ZN3JSC12X86Assembler23X86InstructionFormatter11memoryModRMEiNS_3X8610RegisterIDES3_ii
+__ZN3JSC17TypeOfResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator15emitResolveBaseEPNS_10RegisterIDERKNS_10IdentifierE
+__ZN3JSC17BytecodeGenerator20emitLoadGlobalObjectEPNS_10RegisterIDEPNS_8JSObjectE
+__ZN3WTF6VectorIN3JSC7JSValueELm0EE14expandCapacityEm
+__ZNK3JSC7AddNode5isAddEv
+__ZN3JSC12BinaryOpNode10emitStrcatERNS_17BytecodeGeneratorEPNS_10RegisterIDES4_PNS_21ReadModifyResolveNodeE
+__ZNK3JSC10StringNode8isStringEv
+__ZNK3JSC14ExpressionNode8isStringEv
+__ZN3JSC17BytecodeGenerator10emitStrcatEPNS_10RegisterIDES2_i
+__ZN3JSC4Yarr12spacesCreateEv
+__ZN3JSC4Yarr15nonspacesCreateEv
+__ZN3JSC8WithNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator13emitPushScopeEPNS_10RegisterIDE
+__ZN3JSC23MacroAssemblerX86Common4moveENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5Imm32ENS_3X8610RegisterIDE
+__ZN3JSC14MacroAssembler4peekENS_3X8610RegisterIDEi
+__ZN3JSC4Yarr14RegexGenerator12atEndOfInputEv
+__ZN3JSC22AbstractMacroAssemblerINS_12X86AssemblerEE8JumpList6linkToENS2_5LabelEPS2_
+__ZN3JSC14MacroAssembler4pokeENS_3X8610RegisterIDEi
+__ZN3JSC21FunctionCallValueNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC9ArrayNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator12emitNewArrayEPNS_10RegisterIDEPNS_11ElementNodeE
+__ZN3JSC23CallFunctionCallDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator25emitJumpIfNotFunctionCallEPNS_10RegisterIDEPNS_5LabelE
+__ZN3JSC4Yarr14RegexGenerator29generateAssertionWordBoundaryERNS1_19TermGenerationStateE
+__ZN3JSC4Yarr14RegexGenerator22matchAssertionWordcharERNS1_19TermGenerationStateERNS_22AbstractMacroAssemblerINS_12X86Assembler
+__ZN3WTF6VectorIPN3JSC4Yarr18PatternDisjunctionELm4EE14expandCapacityEm
+__ZL14compileBracketiPiPPhPPKtS3_P9ErrorCodeiS_S_R11CompileData
+__ZN3JSC9ThrowNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC9CommaNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3WTF9HashTableIdSt4pairIdN3JSC7JSValueEENS_18PairFirstExtractorIS4_EENS_9FloatHashIdEENS_14PairHashTraitsINS_10HashTraitsId
+__ZN3JSC17TypeOfResolveNodeD0Ev
+__ZN3JSC18NotStrictEqualNodeD0Ev
+__ZN3JSC8WithNodeD0Ev
+__ZN3JSC21FunctionCallValueNodeD0Ev
+__ZN3JSC9ArrayNodeD0Ev
+__ZN3JSC11ElementNodeD0Ev
+__ZN3JSC23CallFunctionCallDotNodeD0Ev
+__ZN3JSC9ThrowNodeD0Ev
+__ZN3JSC9CommaNodeD0Ev
+__ZN3JSC3JIT23emit_op_unexpected_loadEPNS_11InstructionE
+__ZN3JSC3JIT20emit_op_to_primitiveEPNS_11InstructionE
+__ZN3JSC3JIT14emit_op_strcatEPNS_11InstructionE
+__ZN3JSC3JIT17emit_op_nstricteqEPNS_11InstructionE
+__ZN3JSC3JIT18emit_op_push_scopeEPNS_11InstructionE
+__ZN3JSC3JIT17emit_op_new_arrayEPNS_11InstructionE
+__ZN3JSC3JIT16emit_op_jneq_ptrEPNS_11InstructionE
+__ZN3JSC3JIT13emit_op_throwEPNS_11InstructionE
+__ZN3JSC3JIT14emit_op_jnlessEPNS_11InstructionE
+__ZN3JSC3JIT24emitSlow_op_to_primitiveEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT21emitSlow_op_nstricteqEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT18emitSlow_op_jnlessEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZL15makePostfixNodePvPN3JSC14ExpressionNodeENS0_8OperatorEiii
+__ZN3JSC18PostfixResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC18PostfixResolveNodeD0Ev
+__ZN3JSC8JITStubs22cti_op_call_arityCheckEPPv
+__ZN3JSC19FunctionConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL32constructWithFunctionConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC17constructFunctionEPNS_9ExecStateERKNS_7ArgListERKNS_10IdentifierERKNS_7UStringEi
+__ZN3JSCplERKNS_7UStringES2_
+__ZN3JSC7UString6appendERKS0_
+__ZN3JSC7UString17expandPreCapacityEi
+__ZN3WTF11fastReallocILb0EEEPvS1_m
+__ZN3JSC14JSGlobalObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZL11makeDivNodePvPN3JSC14ExpressionNodeES2_b
+__ZL12makeMultNodePvPN3JSC14ExpressionNodeES2_b
+__ZN3JSC9WhileNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC7ModNodeD0Ev
+__ZN3JSC7DivNodeD0Ev
+__ZN3JSC8MultNodeD0Ev
+__ZN3JSC9WhileNodeD0Ev
+__ZN3JSC3JIT11emit_op_modEPNS_11InstructionE
+__ZN3JSC3JIT11emit_op_mulEPNS_11InstructionE
+__ZN3JSC3JIT20emit_op_loop_if_trueEPNS_11InstructionE
+__ZN3JSC3JIT15emitSlow_op_modEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT15emitSlow_op_mulEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT24emitSlow_op_loop_if_trueEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSCL26stringProtoFuncLastIndexOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC7JSValue20toIntegerPreserveNaNEPNS_9ExecStateE
+__ZN3JSC8JITStubs10cti_op_divEPPv
+__ZN3JSC3JIT22emit_op_loop_if_lesseqEPNS_11InstructionE
+__ZN3JSC3JIT26emitSlow_op_loop_if_lesseqEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs13cti_op_lesseqEPPv
+__ZN3JSCL20stringProtoFuncSplitEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC19constructEmptyArrayEPNS_9ExecStateE
+__ZN3JSC7JSArray3putEPNS_9ExecStateEjNS_7JSValueE
+__ZN3JSC7JSArray11putSlowCaseEPNS_9ExecStateEjNS_7JSValueE
+__ZN3JSC14ArrayPrototype18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSCL18arrayProtoFuncJoinEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF7HashSetIPN3JSC8JSObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN3JSC8JSObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF6VectorItLm256EE6appendItEEvPKT_m
+__ZN3WTF6VectorItLm256EE14expandCapacityEm
+__ZN3WTF6VectorIPN3JSC12CallLinkInfoELm0EE15reserveCapacityEm
+__ZN3JSC4Heap7collectEv
+__ZN3JSC4Heap30markStackObjectsConservativelyEv
+__ZN3JSC4Heap31markCurrentThreadConservativelyEv
+__ZN3JSC4Heap39markCurrentThreadConservativelyInternalEv
+__ZN3JSC4Heap18markConservativelyEPvS1_
+__ZN3JSC7JSArray4markEv
+__ZN3JSC8JSObject4markEv
+__ZN3JSC10JSFunction4markEv
+__ZN3JSC6JSCell4markEv
+__ZN3JSC14JSGlobalObject4markEv
+__ZN3JSC15JSWrapperObject4markEv
+__ZN3JSC18GlobalEvalFunction4markEv
+__ZN3JSC16FunctionBodyNode4markEv
+__ZN3JSC9CodeBlock4markEv
+__ZN3JSC4Heap20markProtectedObjectsEv
+__ZN3JSC12SmallStrings4markEv
+__ZN3JSC4Heap5sweepILNS_8HeapTypeE0EEEmv
+__ZN3JSC14JSGlobalObjectD2Ev
+__ZN3JSC17FunctionPrototypeD1Ev
+__ZN3JSC15ObjectPrototypeD1Ev
+__ZN3JSC14ArrayPrototypeD1Ev
+__ZN3JSC15StringPrototypeD1Ev
+__ZN3JSC16BooleanPrototypeD1Ev
+__ZN3JSC15NumberPrototypeD1Ev
+__ZN3JSC13DatePrototypeD1Ev
+__ZN3JSC12DateInstanceD2Ev
+__ZN3JSC15RegExpPrototypeD1Ev
+__ZN3JSC14ErrorPrototypeD1Ev
+__ZN3JSC20NativeErrorPrototypeD1Ev
+__ZN3JSC17ObjectConstructorD1Ev
+__ZN3JSC19FunctionConstructorD1Ev
+__ZN3JSC16ArrayConstructorD1Ev
+__ZN3JSC17StringConstructorD1Ev
+__ZN3JSC18BooleanConstructorD1Ev
+__ZN3JSC17NumberConstructorD1Ev
+__ZN3JSC15DateConstructorD1Ev
+__ZN3JSC17RegExpConstructorD1Ev
+__ZN3JSC16ErrorConstructorD1Ev
+__ZN3JSC22NativeErrorConstructorD1Ev
+__ZN3JSC10MathObjectD1Ev
+__ZN3JSC18GlobalEvalFunctionD1Ev
+__ZN3JSC8JSObjectD1Ev
+__ZN3JSC9CodeBlock13unlinkCallersEv
+__ZN3WTF6VectorINS_6RefPtrIN3JSC6RegExpEEELm0EE6shrinkEm
+__ZN3JSC12JSActivationD1Ev
+__ZN3JSC12JSActivationD2Ev
+__ZN3JSC12RegExpObjectD1Ev
+__ZN3JSC18RegExpMatchesArrayD1Ev
+__ZN3JSC4Heap5sweepILNS_8HeapTypeE1EEEmv
+__ZN3JSC20globalFuncParseFloatEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF17TCMalloc_PageHeap3NewEm
+__ZN3JSC8JITStubs28cti_op_construct_JSConstructEPPv
+__ZN3JSC8JSObject17createInheritorIDEv
+__ZNK3JSC19BracketAccessorNode10isLocationEv
+__ZNK3JSC19BracketAccessorNode21isBracketAccessorNodeEv
+__ZN3JSC17AssignBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator12emitPutByValEPNS_10RegisterIDES2_S2_
+__ZN3JSC14PostfixDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17ReadModifyDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17AssignBracketNodeD0Ev
+__ZN3JSC14PostfixDotNodeD0Ev
+__ZN3JSC17ReadModifyDotNodeD0Ev
+__ZN3JSC3JIT18emit_op_put_by_valEPNS_11InstructionE
+__ZN3JSC3JIT22emitSlow_op_put_by_valEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC16ArrayConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL29constructWithArrayConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSCL27constructArrayWithSizeQuirkEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSC8JITStubs23cti_op_put_by_val_arrayEPPv
+__ZN3JSC8JITStubs13cti_op_strcatEPPv
+__ZN3JSC7UString3Rep15reserveCapacityEi
+__ZN3JSC7UString13appendNumericEi
+__ZN3JSC11concatenateEPNS_7UString3RepEi
+__ZN3JSC12JSActivation18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSCL18stringFromCharCodeEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC16globalFuncEscapeEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL26stringProtoFuncToUpperCaseEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC12JSActivation14isDynamicScopeEv
+__ZN3WTF6VectorINS_6RefPtrIN3JSC10RegisterIDEEELm16EE14expandCapacityEm
+__ZN3JSC17ObjectConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL30constructWithObjectConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC8JITStubs17cti_op_put_by_valEPPv
+__ZN3JSC15DateConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL28constructWithDateConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC13constructDateEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSC8JITStubs18cti_op_is_functionEPPv
+__ZN3JSC16jsIsFunctionTypeENS_7JSValueE
+__ZN3JSC10Identifier5equalEPKNS_7UString3RepEPKc
+__ZN3JSC11JSImmediate8toStringENS_7JSValueE
+__ZN3JSC7UString4fromEi
+__ZN3JSC7UString3Rep11computeHashEPKti
+__ZNK3JSC8NullNode6isNullEv
+__ZN3JSC9BreakNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator11breakTargetERKNS_10IdentifierE
+__ZN3JSC9BreakNodeD0Ev
+__ZN3JSC3JIT15emit_op_eq_nullEPNS_11InstructionE
+__ZN3JSC8JITStubs19cti_op_is_undefinedEPPv
+__ZN3JSC12JSActivation4markEv
+__ZN3JSC12DateInstanceD1Ev
+__ZNK3JSC18EmptyStatementNode16isEmptyStatementEv
+__ZN3JSC18EmptyStatementNodeD0Ev
+__ZN3JSC3JIT15emit_op_pre_decEPNS_11InstructionE
+__ZN3JSC3JIT19emitSlow_op_pre_decEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3WTF13tryFastMallocEm
+__ZN3JSC8JITStubs17cti_timeout_checkEPPv
+__ZN3JSC14TimeoutChecker10didTimeOutEPNS_9ExecStateE
+__ZN3JSC8JITStubs14cti_op_pre_decEPPv
+__ZN3JSC13jsAddSlowCaseEPNS_9ExecStateENS_7JSValueES2_
+__ZNK3JSC8JSString11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZNK3JSC8JSObject11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZNK3JSC8JSObject12defaultValueEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZN3JSCL22objectProtoFuncValueOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL25functionProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC10JSFunction9classInfoEv
+__ZNK3JSC21UStringSourceProvider8getRangeEii
+__ZNK3JSC7UString6substrEii
+__ZN3JSC8JITStubs26cti_op_get_by_id_self_failEPPv
+__ZN3JSC3JIT29privateCompileGetByIdSelfListEPNS_17StructureStubInfoEPNS_30PolymorphicAccessStructureListEiPNS_9StructureEm
+__ZN3JSC8JITStubs16cti_op_nstricteqEPPv
+__ZN3JSC9ForInNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator20emitNextPropertyNameEPNS_10RegisterIDES2_PNS_5LabelE
+__ZN3JSC9ForInNodeD0Ev
+__ZN3JSC3JIT18emit_op_next_pnameEPNS_11InstructionE
+__ZN3JSC8JITStubs17cti_op_get_pnamesEPPv
+__ZN3JSC8JSObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
+__ZN3JSC9Structure26getEnumerablePropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayEPNS_8JSObjectE
+__ZN3JSC9Structure35getEnumerableNamesFromPropertyTableERNS_17PropertyNameArrayE
+__ZN3JSC8JITStubs17cti_op_next_pnameEPPv
+__ZN3JSC13jsOwnedStringEPNS_12JSGlobalDataERKNS_7UStringE
+__ZN3JSC22JSPropertyNameIterator10invalidateEv
+__ZN3JSC3JIT22emit_op_init_argumentsEPNS_11InstructionE
+__ZN3JSC3JIT24emit_op_create_argumentsEPNS_11InstructionE
+__ZN3JSC8JITStubs33cti_op_create_arguments_no_paramsEPPv
+__ZN3JSC9Arguments18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC3JIT16emit_op_post_decEPNS_11InstructionE
+__ZN3JSC3JIT20emitSlow_op_post_decEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs15cti_op_post_decEPPv
+__ZN3JSC9Arguments18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC17RegExpConstructor18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC17RegExpConstructor3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC6JSCell11getCallDataERNS_8CallDataE
+__ZN3JSC10JSFunction3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC8JITStubs16cti_op_new_arrayEPPv
+__ZN3JSC14constructArrayEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSCL18arrayProtoFuncPushEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL30comparePropertyMapEntryIndicesEPKvS1_
+__ZN3WTF6VectorIN3JSC10IdentifierELm20EE15reserveCapacityEm
+__ZN3JSC12StringObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC8JITStubs17cti_op_push_scopeEPPv
+__ZN3JSC8JITStubs14cti_op_resolveEPPv
+__ZN3JSC8JITStubs16cti_op_pop_scopeEPPv
+__ZN3JSC3JIT31privateCompilePutByIdTransitionEPNS_17StructureStubInfoEPNS_9StructureES4_mPNS_14StructureChainENS_22AbstractMacr
+__ZN3JSC20MacroAssemblerX86_649branchPtrENS_23MacroAssemblerX86Common9ConditionENS_22AbstractMacroAssemblerINS_12X86AssemblerEE
+__ZN3JSC3JIT19patchPutByIdReplaceEPNS_17StructureStubInfoEPNS_9StructureEmNS_22AbstractMacroAssemblerINS_12X86AssemblerEE22Proc
+__ZN3JSC17NumberConstructor18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC8JITStubs16cti_op_is_stringEPPv
+__ZN3JSC8JITStubs19cti_op_convert_thisEPPv
+__ZNK3JSC8JSString12toThisObjectEPNS_9ExecStateE
+__ZN3JSCL22stringProtoFuncReplaceEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC12StringObject14toThisJSStringEPNS_9ExecStateE
+__ZN3JSCL21arrayProtoFuncForEachEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC11Interpreter20prepareForRepeatCallEPNS_16FunctionBodyNodeEPNS_9ExecStateEPNS_10JSFunctionEiPNS_14ScopeChainNodeEPNS_7J
+__ZN3JSC3JIT16emit_op_post_incEPNS_11InstructionE
+__ZN3JSC3JIT20emitSlow_op_post_incEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC11Interpreter7executeERNS_16CallFrameClosureEPNS_7JSValueE
+__ZN3JSC10MathObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC11Interpreter13endRepeatCallERNS_16CallFrameClosureE
+__ZN3JSCL21resizePropertyStorageEPNS_8JSObjectEii
+__ZN3JSC8JSObject23allocatePropertyStorageEmm
+__ZN3JSC14ExecutablePool12poolAllocateEm
+__ZN3JSC9Arguments4markEv
+__ZN3JSC22JSPropertyNameIterator4markEv
+__ZN3JSC3JIT10unlinkCallEPNS_12CallLinkInfoE
+__ZN3JSC22JSPropertyNameIteratorD1Ev
+__ZN3JSC9ArgumentsD1Ev
+__ZN3JSC9ArgumentsD2Ev
+__ZN3JSC12StringObjectD1Ev
+__ZN3WTF6VectorIPN3JSC9StructureELm8EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN3JSC9StructureELm8EE15reserveCapacityEm
+__ZN3JSCL19arrayProtoFuncShiftEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL11getPropertyEPNS_9ExecStateEPNS_8JSObjectEj
+__ZN3JSC7JSArray14deletePropertyEPNS_9ExecStateEj
+__ZN3JSC7JSArray9setLengthEj
+__ZN3JSC7UString6appendEPKc
+__ZN3JSC8JITStubs23cti_op_create_argumentsEPPv
+__ZN3JSCL19arrayProtoFuncSliceEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC7JSValue9toIntegerEPNS_9ExecStateE
+__ZN3JSC24ApplyFunctionCallDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZNK3JSC14ExpressionNode13isSimpleArrayEv
+__ZN3JSC17BytecodeGenerator26emitJumpIfNotFunctionApplyEPNS_10RegisterIDEPNS_5LabelE
+__ZN3JSC17BytecodeGenerator15emitCallVarargsEPNS_10RegisterIDES2_S2_S2_jjj
+__ZN3JSC24ApplyFunctionCallDotNodeD0Ev
+__ZN3JSC3JIT20emit_op_load_varargsEPNS_11InstructionE
+__ZN3JSC3JIT20emit_op_call_varargsEPNS_11InstructionE
+__ZN3JSC3JIT20compileOpCallVarargsEPNS_11InstructionE
+__ZN3JSC3JIT29compileOpCallVarargsSetupArgsEPNS_11InstructionE
+__ZN3JSC3JIT24emitSlow_op_call_varargsEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC3JIT28compileOpCallVarargsSlowCaseEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs19cti_op_load_varargsEPPv
+__ZNK3JSC7JSArray9classInfoEv
+__ZN3JSC7JSArray15copyToRegistersEPNS_9ExecStateEPNS_8RegisterEj
+__ZNK3JSC7UString30spliceSubstringsWithSeparatorsEPKNS0_5RangeEiPKS0_i
+__ZN3JSC8JSObject18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC8JSObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC7UString4fromEd
+__ZN3WTF4dtoaEPcdiPiS1_PS0_
+__ZN3JSC8JITStubs21cti_op_put_by_id_failEPPv
+__ZN3JSC13DeleteDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator14emitDeleteByIdEPNS_10RegisterIDES2_RKNS_10IdentifierE
+__ZN3JSC13DeleteDotNodeD0Ev
+__ZN3JSC3JIT17emit_op_del_by_idEPNS_11InstructionE
+__ZN3JSC8JITStubs16cti_op_del_by_idEPPv
+__ZN3JSC10JSFunction14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
+__ZN3JSC8JSObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
+__ZNK3JSC7ArgList8getSliceEiRS0_
+__ZN3JSC3JIT26emit_op_tear_off_argumentsEPNS_11InstructionE
+__ZN3JSC8JITStubs25cti_op_tear_off_argumentsEPPv
+__ZNK3JSC12StringObject12toThisStringEPNS_9ExecStateE
+__ZN3JSC13PrefixDotNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC13PrefixDotNodeD0Ev
+__ZNK3JSC8JSObject8toStringEPNS_9ExecStateE
+__ZN3JSCL22arrayProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL21arrayProtoFuncIndexOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC16ErrorConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL29constructWithErrorConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC14constructErrorEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSCL21stringProtoFuncCharAtEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs32cti_op_get_by_id_proto_list_fullEPPv
+__ZN3JSC14InstanceOfNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator14emitInstanceOfEPNS_10RegisterIDES2_S2_S2_
+__ZN3JSC14InstanceOfNodeD0Ev
+__ZN3JSC3JIT18emit_op_instanceofEPNS_11InstructionE
+__ZN3JSC3JIT22emitSlow_op_instanceofEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC12X86Assembler6orl_irEiNS_3X8610RegisterIDE
+__ZN3JSC17RegExpConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL30constructWithRegExpConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC15constructRegExpEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSC13DatePrototype18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSCL20dateProtoFuncGetTimeEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC12DateInstance9classInfoEv
+__ZN3JSC12RegExpObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSCL19regExpProtoFuncTestEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC12RegExpObject5matchEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSC3JIT18emit_op_jmp_scopesEPNS_11InstructionE
+__ZN3JSC3JIT30privateCompileGetByIdChainListEPNS_17StructureStubInfoEPNS_30PolymorphicAccessStructureListEiPNS_9StructureEPNS_1
+__ZN3JSC18globalFuncUnescapeEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC7UString6appendEt
+__ZN3JSC8JSObject3putEPNS_9ExecStateEjNS_7JSValueE
+__ZN3JSC17PropertyNameArray3addEPNS_7UString3RepE
+__ZN3WTF7HashSetIPN3JSC7UString3RepENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableIPN3JSC7UString3RepES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6rehashEi
+__ZN3WTF6VectorIN3JSC10IdentifierELm20EE14expandCapacityEm
+__ZN3JSCL20arrayProtoFuncConcatEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC9ArrayNode13isSimpleArrayEv
+__ZN3JSC8JITStubs10cti_op_mulEPPv
+__ZN3JSC8JITStubs16cti_op_is_objectEPPv
+__ZN3JSC14jsIsObjectTypeENS_7JSValueE
+__ZNK3JSC11Interpreter18retrieveLastCallerEPNS_9ExecStateERiRlRNS_7UStringERNS_7JSValueE
+__ZN3JSC9CodeBlock34reparseForExceptionInfoIfNecessaryEPNS_9ExecStateE
+__ZNK3JSC10ScopeChain10localDepthEv
+__ZNK3JSC12JSActivation9classInfoEv
+__ZN3JSC6Parser7reparseINS_16FunctionBodyNodeEEEN3WTF10PassRefPtrIT_EEPNS_12JSGlobalDataEPS5_
+__ZN3JSC16FunctionBodyNode6createEPNS_12JSGlobalDataEPNS_14SourceElementsEPN3WTF6VectorISt4pairINS_10IdentifierEjELm0EEEPNS6_IP
+__ZN3JSC13StatementNode6setLocEii
+__ZN3JSC16FunctionBodyNode14copyParametersEv
+__ZN3JSC16FunctionBodyNode13finishParsingEPNS_10IdentifierEm
+__ZN3JSC16FunctionBodyNode31bytecodeForExceptionInfoReparseEPNS_14ScopeChainNodeEPNS_9CodeBlockE
+__ZN3JSC9CodeBlock36hasGlobalResolveInfoAtBytecodeOffsetEj
+__ZN3JSC9CodeBlock27lineNumberForBytecodeOffsetEPNS_9ExecStateEj
+__ZN3WTF6VectorIPvLm0EE14expandCapacityEmPKS1_
+__ZN3WTF6VectorIPvLm0EE15reserveCapacityEm
+__ZN3JSC3JIT16emit_op_jeq_nullEPNS_11InstructionE
+__ZN3JSC8JITStubs16cti_op_is_numberEPPv
+__ZN3JSCL23stringProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC12StringObject9classInfoEv
+__ZN3JSC8JITStubs28cti_op_get_by_id_string_failEPPv
+__ZN3JSC11JSImmediate9prototypeENS_7JSValueEPNS_9ExecStateE
+__ZN3JSCL23numberProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC3JIT16emit_op_neq_nullEPNS_11InstructionE
+__ZN3JSC4Yarr23RegexPatternConstructor8copyTermERNS0_11PatternTermE
+__ZL17bracketIsAnchoredPKh
+__ZL32branchFindFirstAssertedCharacterPKhb
+__ZL20branchNeedsLineStartPKhjj
+__ZN3JSC18RegExpMatchesArray18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSCL20stringProtoFuncSliceEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC3JIT17emit_op_jneq_nullEPNS_11InstructionE
+__ZN3JSC8JITStubs25cti_op_call_NotJSFunctionEPPv
+__ZN3JSC17StringConstructor11getCallDataERNS_8CallDataE
+__ZN3JSCL21callStringConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC12StringObject8toStringEPNS_9ExecStateE
+__ZN3JSC23FunctionCallBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC20EvalFunctionCallNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator19emitResolveWithBaseEPNS_10RegisterIDES2_RKNS_10IdentifierE
+__ZN3JSC23FunctionCallBracketNodeD0Ev
+__ZN3JSC20EvalFunctionCallNodeD0Ev
+__ZN3JSC3JIT25emit_op_resolve_with_baseEPNS_11InstructionE
+__ZN3JSC3JIT17emit_op_call_evalEPNS_11InstructionE
+__ZN3JSC3JIT21emitSlow_op_call_evalEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC14MacroAssembler4jumpENS_22AbstractMacroAssemblerINS_12X86AssemblerEE5LabelE
+__ZN3JSCL19regExpProtoFuncExecEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC7UString12replaceRangeEiiRKS0_
+__ZN3JSC8JITStubs17cti_op_is_booleanEPPv
+__ZN3JSC3JIT22emit_op_put_global_varEPNS_11InstructionE
+__ZN3JSCL23regExpProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL18regExpObjectSourceEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL18regExpObjectGlobalEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL22regExpObjectIgnoreCaseEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL21regExpObjectMultilineEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSC4Yarr14RegexGenerator30generatePatternCharacterGreedyERNS1_19TermGenerationStateE
+__ZN3JSC8JITStubs27cti_op_get_by_id_proto_failEPPv
+__ZN3JSC17DeleteResolveNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17DeleteResolveNodeD0Ev
+__ZN3JSC3JIT20emit_op_resolve_baseEPNS_11InstructionE
+__ZN3JSC8JITStubs19cti_op_resolve_baseEPPv
+__ZN3JSC12JSActivation14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
+__ZN3JSC16JSVariableObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
+__ZNK3JSC8JSString8toNumberEPNS_9ExecStateE
+__ZN3JSC8JITStubs24cti_op_resolve_with_baseEPPv
+__ZN3JSC8JITStubs16cti_op_call_evalEPPv
+__ZN3JSC11Interpreter8callEvalEPNS_9ExecStateEPNS_12RegisterFileEPNS_8RegisterEiiRNS_7JSValueE
+__ZN3JSC13LiteralParser5Lexer3lexERNS1_18LiteralParserTokenE
+__ZN3JSC13LiteralParser14parseStatementEv
+__ZN3JSC13LiteralParser15parseExpressionEv
+__ZN3JSC13LiteralParser10parseArrayEv
+__ZN3JSC13LiteralParser11parseObjectEv
+__ZN3JSC10Identifier3addEPNS_9ExecStateEPKti
+__ZN3JSC7JSArray4pushEPNS_9ExecStateENS_7JSValueE
+__ZN3JSCL19mathProtoFuncRandomEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF16weakRandomNumberEv
+__ZN3JSCL18mathProtoFuncFloorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC4Heap15recordExtraCostEm
+__ZN3JSC6Parser5parseINS_8EvalNodeEEEN3WTF10PassRefPtrIT_EEPNS_9ExecStateEPNS_8DebuggerERKNS_10SourceCodeEPiPNS_7UStringE
+__ZN3JSC9ExecState9thisValueEv
+__ZN3JSC11Interpreter7executeEPNS_8EvalNodeEPNS_9ExecStateEPNS_8JSObjectEiPNS_14ScopeChainNodeEPNS_7JSValueE
+__ZN3JSC8EvalNode16generateBytecodeEPNS_14ScopeChainNodeE
+__ZN3JSC17BytecodeGeneratorC2EPNS_8EvalNodeEPKNS_8DebuggerERKNS_10ScopeChainEPN3WTF7HashMapINS9_6RefPtrINS_7UString3RepEEENS_16
+__ZN3JSC8EvalNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZThn16_N3JSC8EvalNodeD0Ev
+__ZN3JSC8EvalNodeD0Ev
+__ZN3JSC23objectProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC8JSObject9classNameEv
+__ZN3JSC11JSImmediate12toThisObjectENS_7JSValueEPNS_9ExecStateE
+__ZNK3JSC6JSCell17getTruncatedInt32ERi
+__ZN3JSC15toInt32SlowCaseEdRb
+__ZN3JSCL20dateProtoFuncSetYearEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC12DateInstance21msToGregorianDateTimeEdbRNS_17GregorianDateTimeE
+__ZN3JSC21msToGregorianDateTimeEdbRNS_17GregorianDateTimeE
+__ZN3JSCL12getDSTOffsetEdd
+__ZN3JSC21gregorianDateTimeToMSERKNS_17GregorianDateTimeEdb
+__ZN3JSCL15dateToDayInYearEiii
+__ZN3JSC8JITStubs19cti_op_to_primitiveEPPv
+__ZN3JSCL21dateProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC10formatTimeERKNS_17GregorianDateTimeEb
+__ZN3JSCL24dateProtoFuncToGMTStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC7UString13appendNumericEd
+__ZN3JSC11concatenateEPNS_7UString3RepEd
+__ZN3JSCL20dateProtoFuncGetYearEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL20dateProtoFuncGetDateEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL21dateProtoFuncGetMonthEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL21dateProtoFuncGetHoursEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23dateProtoFuncGetMinutesEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23dateProtoFuncGetSecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL19dateProtoFuncGetDayEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL30dateProtoFuncGetTimezoneOffsetEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC28createUndefinedVariableErrorEPNS_9ExecStateERKNS_10IdentifierEjPNS_9CodeBlockE
+__ZN3JSC9CodeBlock32expressionRangeForBytecodeOffsetEPNS_9ExecStateEjRiS3_S3_
+__ZN3JSC5Error6createEPNS_9ExecStateENS_9ErrorTypeERKNS_7UStringEilS6_
+__ZN3JSC22NativeErrorConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL35constructWithNativeErrorConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC22NativeErrorConstructor9constructEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSC8JSObject17putWithAttributesEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueEj
+__ZN3JSCL23returnToThrowTrampolineEPNS_12JSGlobalDataEPvRS2_
+_ctiVMThrowTrampoline
+__ZN3JSC8JITStubs12cti_vm_throwEPPv
+__ZN3JSC11Interpreter14throwExceptionERPNS_9ExecStateERNS_7JSValueEjb
+__ZNK3JSC8JSObject22isNotAnObjectErrorStubEv
+__ZNK3JSC8JSObject19isWatchdogExceptionEv
+__ZN3JSC9CodeBlock24handlerForBytecodeOffsetEj
+__ZN3JSC8JITStubs21cti_op_push_new_scopeEPPv
+__ZN3WTF6VectorIN3JSC22AbstractMacroAssemblerINS1_12X86AssemblerEE4JumpELm16EE14expandCapacityEm
+__ZN3JSCL20dateProtoFuncSetTimeEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEENS1_INS2_8EvalNodeEEENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEE3getEPS4
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEENS1_INS2_8EvalNodeEEENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEE3setEPS4_
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_NS1_INS2_8EvalNodeEEEENS_18PairFirstExtractorIS9_EENS_7StrHashIS5_
+__ZN3JSC10LessEqNodeD0Ev
+__ZN3JSC8JITStubs14cti_op_jlesseqEPPv
+__ZN3JSC8JSString18getPrimitiveNumberEPNS_9ExecStateERdRNS_7JSValueE
+__ZL18makeRightShiftNodePvPN3JSC14ExpressionNodeES2_b
+__ZN3JSC14RightShiftNodeD0Ev
+__ZN3JSC3JIT14emit_op_rshiftEPNS_11InstructionE
+__ZN3JSC3JIT18emitSlow_op_rshiftEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC18PostfixBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC18PostfixBracketNodeD0Ev
+__ZN3JSC21ReadModifyBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC21ReadModifyBracketNodeD0Ev
+__ZN3JSC11Interpreter15unwindCallFrameERPNS_9ExecStateENS_7JSValueERjRPNS_9CodeBlockE
+__ZN3JSCL22errorProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF23waitForThreadCompletionEjPPv
+__ZN3WTF15ThreadConditionD1Ev
+__ZN3JSC9Structure24removePropertyTransitionEPS0_RKNS_10IdentifierERm
+__ZN3JSC12JSActivation3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC26createNotAnObjectErrorStubEPNS_9ExecStateEb
+__ZN3JSC13JSNotAnObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZNK3JSC22JSNotAnObjectErrorStub22isNotAnObjectErrorStubEv
+__ZN3JSC22createNotAnObjectErrorEPNS_9ExecStateEPNS_22JSNotAnObjectErrorStubEjPNS_9CodeBlockE
+__ZN3JSC9CodeBlock37getByIdExceptionInfoForBytecodeOffsetEPNS_9ExecStateEjRNS_8OpcodeIDE
+__ZN3JSCL18createErrorMessageEPNS_9ExecStateEPNS_9CodeBlockEiiiNS_7JSValueENS_7UStringE
+__ZN3JSC13ErrorInstanceD1Ev
+__ZN3JSC22JSNotAnObjectErrorStubD1Ev
+__ZN3JSC13JSNotAnObjectD1Ev
+__ZN3JSC19JSStaticScopeObjectD1Ev
+__ZN3JSC19JSStaticScopeObjectD2Ev
+__ZN3JSC17DeleteBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17BytecodeGenerator15emitDeleteByValEPNS_10RegisterIDES2_S2_
+__ZN3JSC17DeleteBracketNodeD0Ev
+__ZN3JSC8JITStubs17cti_op_del_by_valEPPv
+__ZN3JSC8JSObject14deletePropertyEPNS_9ExecStateEj
+__ZN3JSC28globalFuncEncodeURIComponentEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL6encodeEPNS_9ExecStateERKNS_7ArgListEPKc
+__ZNK3JSC7UString10UTF8StringEb
 __ZN3WTF7Unicode18convertUTF16ToUTF8EPPKtS2_PPcS4_b
-__Z35NPN_InitializeVariantWithStringCopyP10_NPVariantPK9_NPString
-__ZN3KJS7CStringD1Ev
-__NPN_ReleaseObject
-__Z12jsDeallocateP8NPObject
-__ZN3KJS8Bindings10RootObject11gcUnprotectEPNS_8JSObjectE
-_pow5mult
-_quorem
-_diff
-__ZN3WTF6VectorIPN3KJS12FuncDeclNodeELm16EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN3KJS12FuncDeclNodeELm16EE14expandCapacityEm
-__ZN3WTF6VectorIPN3KJS12FuncDeclNodeELm16EE15reserveCapacityEm
-__ZN3KJS10NumberNode8setValueEd
-__ZN3KJS11ResolveNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS21dateProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS24dateProtoFuncGetFullYearEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS12NotEqualNode8evaluateEPNS_9ExecStateE
-__ZN3KJS14InstanceOfNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS17PreIncResolveNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS9NumberImp9toBooleanEPNS_9ExecStateE
-__ZN3KJS10LessEqNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS29objectProtoFuncHasOwnPropertyEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS10LessEqNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS13UnaryPlusNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS17DeleteBracketNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS17DeleteBracketNode8evaluateEPNS_9ExecStateE
-__ZN3KJS20arrayProtoFuncSpliceEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS17staticValueGetterINS_13MathObjectImpEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK3KJS13MathObjectImp16getValuePropertyEPNS_9ExecStateEi
-__NPN_DeallocateObject
-__ZN3KJS14PostIncDotNodeD1Ev
-__ZN3KJS22ReadModifyLocalVarNodeD1Ev
-__ZN3KJS10LessEqNodeD1Ev
-__ZN3KJS18PostDecResolveNodeD1Ev
-__ZN3KJS17DeleteBracketNodeD1Ev
-__ZN3KJS18PostIncResolveNodeD1Ev
-__ZN3KJS14InstanceOfNodeD1Ev
-__ZN3KJS10NegateNodeD1Ev
-__ZN3KJS17PreDecResolveNodeD1Ev
-__ZN3KJS21ReadModifyBracketNodeD1Ev
-__ZN3KJS10BitAndNodeD1Ev
-__ZN3KJS9BitOrNodeD1Ev
-__ZN3KJS14RightShiftNodeD1Ev
-__ZN3KJS13LeftShiftNodeD1Ev
-__ZN3KJS13UnaryPlusNodeD1Ev
-__ZN3KJS13MathObjectImpD0Ev
-__ZN3KJS14NativeErrorImpD0Ev
-__ZN3KJS14ErrorObjectImpD0Ev
-__ZN3KJS15RegExpObjectImpD0Ev
-__ZN3KJS17DateObjectFuncImpD0Ev
-__ZN3KJS13DateObjectImpD0Ev
-__ZN3KJS15NumberObjectImpD0Ev
-__ZN3KJS16BooleanObjectImpD0Ev
-__ZN3KJS19StringObjectFuncImpD0Ev
-__ZN3KJS15StringObjectImpD0Ev
-__ZN3KJS14ArrayObjectImpD0Ev
-__ZN3KJS17FunctionObjectImpD0Ev
-__ZN3KJS15ObjectObjectImpD0Ev
-__ZN3KJS20NativeErrorPrototypeD0Ev
-__ZN3KJS15RegExpPrototypeD0Ev
-__ZN3KJS15NumberPrototypeD0Ev
-__ZN3KJS16BooleanPrototypeD0Ev
-__ZN3KJS15StringPrototypeD0Ev
-__ZN3KJS15ObjectPrototypeD0Ev
-__ZN3KJS17FunctionPrototypeD0Ev
-__ZN3KJS13PreIncDotNodeD1Ev
-__ZN3KJS17staticValueGetterINS_15RegExpObjectImpEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK3KJS15RegExpObjectImp16getValuePropertyEPNS_9ExecStateEi
-__ZNK3KJS15RegExpObjectImp10getBackrefEj
-__ZN3KJS16mathProtoFuncMaxEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS17staticValueGetterINS_15NumberObjectImpEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK3KJS15NumberObjectImp16getValuePropertyEPNS_9ExecStateEi
-__ZN3KJS10NegateNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS10NegateNode8evaluateEPNS_9ExecStateE
-__ZN3KJS25stringProtoFuncCharCodeAtEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS21arrayProtoFuncUnShiftEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS10LessEqNode8evaluateEPNS_9ExecStateE
-__ZN3KJS8JSObject15getPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
-__ZNK3KJS12PropertySlot8getValueEPNS_9ExecStateEPNS_8JSObjectEj
-__ZN3KJS16mathProtoFuncMinEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS10Identifier5equalEPKNS_7UString3RepEPKc
-__ZN3KJS11addSlowCaseEPNS_9ExecStateEPNS_7JSValueES3_
-__ZN3KJS8LessNode8evaluateEPNS_9ExecStateE
-__ZN3KJS7DivNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS10NegateNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS7AddNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS16mathProtoFuncSinEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS16mathProtoFuncLogEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS16mathProtoFuncAbsEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3WTF6VectorIPN3KJS9ExecStateELm16EE14expandCapacityEm
-__ZN3WTF6VectorIPN3KJS9ExecStateELm16EE15reserveCapacityEm
-__ZN3KJS17arrayProtoFuncPopEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS21stringProtoFuncSubstrEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS28globalFuncEncodeURIComponentEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS6encodeEPNS_9ExecStateERKNS_4ListEPKc
-__ZN3KJS17PrefixBracketNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS17PreIncBracketNode8evaluateEPNS_9ExecStateE
-__ZN3KJS16mathProtoFuncExpEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS17mathProtoFuncATanEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS17mathProtoFuncCeilEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS14AddNumbersNode8evaluateEPNS_9ExecStateE
-__ZN3KJS18arrayProtoFuncSortEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS13ArrayInstance4sortEPNS_9ExecStateEPNS_8JSObjectE
-__ZN3KJS13ArrayInstance17compactForSortingEv
-__ZN3KJS34compareWithCompareFunctionForQSortEPKvS1_
-__ZN3KJS13ArrayInstance4sortEPNS_9ExecStateE
-__ZN3KJS16mathProtoFuncPowEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS15NumberObjectImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS23numberProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS9NumberImp8toObjectEPNS_9ExecStateE
-__ZN3KJS16mathProtoFuncCosEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS17mathProtoFuncSqrtEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS17mathProtoFuncASinEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS14ExpressionNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS11DoWhileNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS21stringProtoFuncSearchEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS13PreDecDotNode8evaluateEPNS_9ExecStateE
-__ZN3KJS18PostfixBracketNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS18PostIncBracketNode8evaluateEPNS_9ExecStateE
-__ZN3KJS13LeftShiftNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
+__ZN3JSC10NegateNodeD0Ev
+__ZN3JSC8JITStubs13cti_op_negateEPPv
+__ZN3JSCL17mathProtoFuncSqrtEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL16mathProtoFuncAbsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL18mathProtoFuncRoundEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL16mathProtoFuncCosEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL16mathProtoFuncSinEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs10cti_op_subEPPv
+__ZNK3JSC8JSObject8toNumberEPNS_9ExecStateE
+__ZN3JSC16ArrayConstructor11getCallDataERNS_8CallDataE
+__ZN3JSCL20callArrayConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs10cti_op_modEPPv
+__ZN3JSC8JITStubs12cti_op_jlessEPPv
+__ZL17makeLeftShiftNodePvPN3JSC14ExpressionNodeES2_b
+__ZN3JSC13LeftShiftNodeD0Ev
+__ZN3JSC3JIT14emit_op_lshiftEPNS_11InstructionE
+__ZN3JSC3JIT18emitSlow_op_lshiftEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC11JITStubCall11addArgumentENS_3X8610RegisterIDE
+__ZN3JSCL16mathProtoFuncMaxEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC10BitAndNodeD0Ev
+__ZN3JSC3JIT14emit_op_bitandEPNS_11InstructionE
+__ZN3JSC3JIT18emitSlow_op_bitandEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs13cti_op_bitandEPPv
+__ZN3JSC14BitwiseNotNodeD0Ev
+__ZN3JSC3JIT14emit_op_bitnotEPNS_11InstructionE
+__ZN3JSC3JIT18emitSlow_op_bitnotEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC22UnsignedRightShiftNodeD0Ev
+__ZN3JSC10BitXOrNodeD0Ev
+__ZN3JSC3JIT14emit_op_bitxorEPNS_11InstructionE
+__ZN3JSC3JIT18emitSlow_op_bitxorEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSCL25stringProtoFuncCharCodeAtEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs14cti_op_urshiftEPPv
+__ZN3JSC16toUInt32SlowCaseEdRb
+__ZN3JSCL17mathProtoFuncCeilEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC6JSCell18getTruncatedUInt32ERj
+__ZN3JSC3JIT13emit_op_bitorEPNS_11InstructionE
+__ZN3JSC3JIT17emitSlow_op_bitorEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs12cti_op_bitorEPPv
+__ZN3JSC9BitOrNodeD0Ev
+__ZN3JSC8JITStubs13cti_op_rshiftEPPv
+__ZN3JSC8JITStubs13cti_op_bitxorEPPv
+__ZN3JSC9parseDateERKNS_7UStringE
+__ZN3WTF6VectorIN3JSC10CallRecordELm0EE14expandCapacityEmPKS2_
+__ZNK3JSC12JSActivation12toThisObjectEPNS_9ExecStateE
+__ZN3JSC3JIT20emit_op_resolve_skipEPNS_11InstructionE
+__ZN3JSC8JITStubs19cti_op_resolve_skipEPPv
+__ZN3JSCL24dateProtoFuncGetFullYearEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC17StringConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL30constructWithStringConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC5equalEPKNS_7UString3RepES3_
+__ZN3JSC8EvalNode4markEv
+__ZN3JSC10SwitchNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC13CaseBlockNode20emitBytecodeForBlockERNS_17BytecodeGeneratorEPNS_10RegisterIDES4_
+__ZN3JSC13CaseBlockNode18tryOptimizedSwitchERN3WTF6VectorIPNS_14ExpressionNodeELm8EEERiS7_
+__ZN3JSCL17processClauseListEPNS_14ClauseListNodeERN3WTF6VectorIPNS_14ExpressionNodeELm8EEERNS_10SwitchKindERbRiSB_
+__ZN3WTF6VectorIPN3JSC14ExpressionNodeELm8EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN3JSC5LabelEEELm8EE14expandCapacityEm
+__ZN3JSC17BytecodeGenerator11beginSwitchEPNS_10RegisterIDENS_10SwitchInfo10SwitchTypeE
+__ZN3WTF6VectorIN3JSC10SwitchInfoELm0EE14expandCapacityEm
+__ZN3JSC17BytecodeGenerator9endSwitchEjPN3WTF6RefPtrINS_5LabelEEEPPNS_14ExpressionNodeEPS3_ii
+__ZN3WTF6VectorIN3JSC15SimpleJumpTableELm0EE14expandCapacityEm
+__ZN3WTF6VectorIiLm0EE15reserveCapacityEm
+__ZN3JSC14CaseClauseNodeD0Ev
+__ZN3JSC14ClauseListNodeD0Ev
+__ZN3JSC13CaseBlockNodeD0Ev
+__ZN3JSC10SwitchNodeD0Ev
+__ZN3JSC3JIT19emit_op_switch_charEPNS_11InstructionE
+__ZN3WTF6VectorIN3JSC12SwitchRecordELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN3JSC22AbstractMacroAssemblerINS1_12X86AssemblerEE17CodeLocationLabelELm0EE4growEm
+__ZN3JSC8JITStubs18cti_op_switch_charEPPv
+__ZN3JSCL16mathProtoFuncPowEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF6VectorIcLm0EE14expandCapacityEm
+__ZN3WTF6VectorIN3JSC7UString5RangeELm16EE14expandCapacityEm
+__ZN3WTF6VectorIN3JSC7UStringELm16EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN3JSC7UStringELm16EE15reserveCapacityEm
+__ZN3JSC7JSArray16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
+__ZN3JSC9ExecState10arrayTableEPS0_
+__ZN3JSC20MarkedArgumentBuffer10slowAppendENS_7JSValueE
+__ZN3WTF9HashTableIPN3JSC20MarkedArgumentBufferES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehas
+__ZN3JSC8JITStubs24cti_op_get_by_val_stringEPPv
+__ZN3JSCL16mathProtoFuncLogEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC7UString8toDoubleEv
+__ZN3WTF9HashTableIPN3JSC7UString3RepES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E4findIS4_NS_22Id
+__ZN3JSCL29objectProtoFuncHasOwnPropertyEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL18arrayProtoFuncSortEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC7JSArray4sortEPNS_9ExecStateENS_7JSValueENS_8CallTypeERKNS_8CallDataE
+__ZN3WTF7AVLTreeIN3JSC32AVLTreeAbstractorForArrayCompareELj44ENS_18AVLTreeDefaultBSetILj44EEEE6insertEi
+__ZN3JSCltERKNS_7UStringES2_
+__ZN3WTF7AVLTreeIN3JSC32AVLTreeAbstractorForArrayCompareELj44ENS_18AVLTreeDefaultBSetILj44EEEE7balanceEi
+__Z12jsRegExpFreeP8JSRegExp
+__ZN3JSCL21stringProtoFuncConcatEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC19globalFuncEncodeURIEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC19globalFuncDecodeURIEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL6decodeEPNS_9ExecStateERKNS_7ArgListEPKcb
 __ZN3WTF7Unicode18UTF8SequenceLengthEc
 __ZN3WTF7Unicode18decodeUTF8SequenceEPKc
-__ZN3KJS9StringImp18getPrimitiveNumberEPNS_9ExecStateERdRPNS_7JSValueE
-__ZN3KJSltERKNS_7UStringES2_
-__ZN3KJS15ConditionalNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS10BitAndNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS10BitAndNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS15DotAccessorNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS19ImmediateNumberNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS13ArrayInstance16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
-__ZN3KJS18LocalVarAccessNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS13LeftShiftNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS19BracketAccessorNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS14RightShiftNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS14RightShiftNode8evaluateEPNS_9ExecStateE
-__ZN3KJS7AddNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS19ImmediateNumberNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS13LeftShiftNode8evaluateEPNS_9ExecStateE
-__ZN3KJS18LocalVarAccessNode16evaluateToUInt32EPNS_9ExecStateE
-__ZNK3KJS9NumberImp17getTruncatedInt32ERi
-__ZN3KJS19BracketAccessorNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS16BooleanObjectImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS24booleanProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS14BitwiseNotNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS9BitOrNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS9BitOrNode8evaluateEPNS_9ExecStateE
-__ZN3KJS10BitAndNode8evaluateEPNS_9ExecStateE
-__ZN3KJS14BitwiseNotNode8evaluateEPNS_9ExecStateE
-__ZN3KJS15NumberObjectImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS8Bindings8Instance32createBindingForLanguageInstanceENS1_15BindingLanguageEPvN3WTF10PassRefPtrINS0_10RootObjectEEE
-__ZN3KJS8Bindings9CInstanceC2EP8NPObjectN3WTF10PassRefPtrINS0_10RootObjectEEE
-__ZN3KJS8Bindings8InstanceC2EN3WTF10PassRefPtrINS0_10RootObjectEEE
-__ZNK3KJS8Bindings8Instance10rootObjectEv
-__ZN3KJS8Bindings8Instance19createRuntimeObjectEPS1_
-__ZN3KJS16RuntimeObjectImpC2EPNS_8Bindings8InstanceE
-__ZN3KJS8Bindings10RootObject16addRuntimeObjectEPNS_16RuntimeObjectImpE
-__ZN3KJS16RuntimeObjectImp18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS8Bindings9CInstance5beginEv
-__ZNK3KJS8Bindings9CInstance8getClassEv
-__ZN3KJS8Bindings6CClass11classForIsAEP7NPClass
-__ZN3KJS8Bindings6CClassC2EP7NPClass
-__ZNK3KJS8Bindings6CClass10fieldNamedERKNS_10IdentifierEPNS0_8InstanceE
-__ZNK3KJS7UString5asciiEv
-__ZNK3KJS8Bindings6CClass12methodsNamedERKNS_10IdentifierEPNS0_8InstanceE
-__NPN_UTF8FromIdentifier
-__ZN3KJS8Bindings5Class14fallbackObjectEPNS_9ExecStateEPNS0_8InstanceERKNS_10IdentifierE
-__ZN3KJS8Bindings9CInstance3endEv
-__ZN3WTF6VectorIPN3KJS8Bindings6MethodELm0EE14expandCapacityEmPKS4_
-__ZN3WTF6VectorIPN3KJS8Bindings6MethodELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN3KJS8Bindings6MethodELm0EE15reserveCapacityEm
-__ZN3KJS16RuntimeObjectImp12methodGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS13RuntimeMethodC2EPNS_9ExecStateERKNS_10IdentifierERN3WTF6VectorIPNS_8Bindings6MethodELm0EEE
-__ZN3WTF6VectorIPN3KJS8Bindings6MethodELm0EEC2ERKS5_
-__ZN3KJS13RuntimeMethod14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS16RuntimeObjectImp9classInfoEv
-__ZN3KJS8Bindings9CInstance12invokeMethodEPNS_9ExecStateERKN3WTF6VectorIPNS0_6MethodELm0EEERKNS_4ListE
-__ZNK3KJS8Bindings7CMethod4nameEv
-__ZN3KJS8Bindings23convertNPVariantToValueEPNS_9ExecStateEPK10_NPVariantPNS0_10RootObjectE
-__ZN3KJS16RuntimeObjectImpD2Ev
-__ZN3KJS8Bindings10RootObject19removeRuntimeObjectEPNS_16RuntimeObjectImpE
-__ZN3KJS4Node10throwErrorEPNS_9ExecStateENS_9ErrorTypeEPKcPNS_7JSValueEPS0_RKNS_10IdentifierE
-__ZN3KJS10substituteERNS_7UStringERKS0_
-__ZN3KJS4Node16rethrowExceptionEPNS_9ExecStateE
-__ZN3KJS4Node15handleExceptionEPNS_9ExecStateEPNS_7JSValueE
-__ZN3KJS16RuntimeObjectImp10invalidateEv
-__ZN3KJS16JSVariableObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3KJS14JSGlobalObjectD2Ev
-__ZN3KJS15GlobalExecStateD1Ev
-__ZN3KJS14BitwiseNotNodeD1Ev
-__ZN3KJSplERKNS_7UStringES2_
-__ZN3KJS5Lexer14convertUnicodeEiiii
-__ZN3KJS14ArrayObjectImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS9Arguments3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
-__ZN3WTF9HashTableIjSt4pairIjiENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENS8_IiEEEES9_E3addIjS2_NS_22IdentityHashTranslatorIjS2_S6_EEEES1_INS_17HashTableIteratorIjS2_S4_S6_SB_S9_EEbERKT_RKT0_
-__ZN3WTF9HashTableIjSt4pairIjiENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENS8_IiEEEES9_EC2ERKSC_
-__ZN3KJS23stringProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3WTF9HashTableIjSt4pairIjiENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENS8_IiEEEES9_E4findIjNS_22IdentityHashTranslatorIjS2_S6_EEEENS_17HashTableIteratorIjS2_S4_S6_SB_S9_EERKT_
-__ZN3KJS10BitXOrNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS10BitXOrNode8evaluateEPNS_9ExecStateE
-__ZN3KJS14RightShiftNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS10BitXOrNodeD1Ev
-__ZN3KJS17DateObjectFuncImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS9parseDateERKNS_7UStringE
-__ZN3KJS6RegExp6createERKNS_7UStringE
-__ZN3KJS7ModNode16evaluateToNumberEPNS_9ExecStateE
-__ZNK3KJS16RuntimeObjectImp14implementsCallEv
-__ZNK3KJS8Bindings9CInstance14implementsCallEv
-__ZN3KJS11Interpreter21shouldPrintExceptionsEv
-__ZN3KJS4Node10throwErrorEPNS_9ExecStateENS_9ErrorTypeEPKcRKNS_10IdentifierE
-__ZN3KJS12PropertySlot15undefinedGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKS0_
-__ZN3KJS15SavedPropertiesD1Ev
-__ZN3KJS8JSObject18isActivationObjectEv
-__ZN3KJS19globalFuncDecodeURIEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS14JSGlobalObject15restoreBuiltinsERKNS_13SavedBuiltinsE
-__ZN3KJS11PropertyMap7restoreERKNS_15SavedPropertiesE
-__ZN3KJS16JSVariableObject19restoreLocalStorageERKNS_15SavedPropertiesE
-__ZN3WTF6VectorIN3KJS17LocalStorageEntryELm32EE6resizeEm
-__ZNK3KJS23FunctionCallBracketNode8streamToERNS_12SourceStreamE
-__ZNK3KJS17TypeOfResolveNode10precedenceEv
-__ZNK3KJS17TypeOfResolveNode8streamToERNS_12SourceStreamE
-__ZNK3KJS13AssignDotNode10precedenceEv
-__ZNK3KJS12ContinueNode8streamToERNS_12SourceStreamE
-__ZN3KJS11FunctionImp12callerGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS9BreakNodeC1ERKNS_10IdentifierE
-__ZN3KJS13StatementNode9pushLabelERKNS_10IdentifierE
-__ZN3KJS9ThrowNode7executeEPNS_9ExecStateE
-__ZNK3KJS15NumberObjectImp19implementsConstructEv
-__ZN3KJS22numberProtoFuncValueOfEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS8VoidNodeD1Ev
-__ZN3KJS14ErrorObjectImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS18globalFuncIsFiniteEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS21ReadModifyResolveNode8evaluateEPNS_9ExecStateE
-__ZN3KJS15StrictEqualNode8evaluateEPNS_9ExecStateE
-__ZN3KJS27compareByStringPairForQSortEPKvS1_
-__ZN3KJS7compareERKNS_7UStringES2_
-__ZN3KJS4Node10throwErrorEPNS_9ExecStateENS_9ErrorTypeEPKcPNS_7JSValueEPS0_S8_
-__ZN3KJS21arrayProtoFuncReverseEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS20stringProtoFuncSliceEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS15StringObjectImp19implementsConstructEv
-__ZN3KJS15StringObjectImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS18PostDecResolveNode8evaluateEPNS_9ExecStateE
-__ZN3KJS21dateProtoFuncSetMonthEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS23setNewValueFromDateArgsEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListEib
-__ZN3KJS20dateProtoFuncSetDateEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS21dateProtoFuncSetHoursEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS23setNewValueFromTimeArgsEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListEib
-__ZN3KJS23dateProtoFuncSetMinutesEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS24dateProtoFuncSetFullYearEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS8JSObject18getPrimitiveNumberEPNS_9ExecStateERdRPNS_7JSValueE
-__ZN3KJS20dateProtoFuncValueOfEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS27dateProtoFuncGetUTCFullYearEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS27dateProtoFuncSetUTCFullYearEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS24dateProtoFuncGetUTCMonthEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS24dateProtoFuncSetUTCMonthEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS23dateProtoFuncGetUTCDateEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS23dateProtoFuncSetUTCDateEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS24dateProtoFuncGetUTCHoursEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS24dateProtoFuncSetUTCHoursEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS26dateProtoFuncGetUTCMinutesEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS26dateProtoFuncSetUTCMinutesEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS26dateProtoFuncGetUTCSecondsEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS26dateProtoFuncSetUTCSecondsEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS22numberProtoFuncToFixedEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS18integer_part_noexpEd
-__ZN3KJS14AddNumbersNode16evaluateToNumberEPNS_9ExecStateE
-__ZNK3KJS14InstanceOfNode10precedenceEv
-__ZNK3KJS14InstanceOfNode8streamToERNS_12SourceStreamE
-__ZNK3KJS8JSObject8toNumberEPNS_9ExecStateE
-__Z15kjs_pcre_xclassiPKh
-__ZN3KJS10NumberNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS18PostDecBracketNodeD1Ev
-__ZN3KJS17PropertyNameArray3addERKNS_10IdentifierE
-__ZN3KJS22errorProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS13LeftShiftNode15evaluateToInt32EPNS_9ExecStateE
-__ZNK3KJS9RegExpImp14implementsCallEv
-__ZN3KJS22stringProtoFuncValueOfEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS15ConditionalNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS16JSVariableObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
-__ZN3KJS11DoWhileNode7executeEPNS_9ExecStateE
-__ZN3KJS8Bindings23convertObjcValueToValueEPNS_9ExecStateEPvNS0_13ObjcValueTypeEPNS0_10RootObjectE
-__ZN3KJS8Bindings17webUndefinedClassEv
-__ZN3KJS8Bindings20webScriptObjectClassEv
-__ZN3KJS8Bindings8Instance19createRuntimeObjectENS1_15BindingLanguageEPvN3WTF10PassRefPtrINS0_10RootObjectEEE
-__ZN3KJS8Bindings12ObjcInstanceC2EP11objc_objectN3WTF10PassRefPtrINS0_10RootObjectEEE
-__ZN3KJS8Bindings8Instance18didExecuteFunctionEv
-__ZN3KJS8Bindings12ObjcInstance5beginEv
-__ZNK3KJS8Bindings12ObjcInstance8getClassEv
-__ZN3KJS8Bindings9ObjcClass11classForIsAEP10objc_class
-__ZN3KJS8Bindings9ObjcClassC2EP10objc_class
-__ZNK3KJS8Bindings9ObjcClass10fieldNamedERKNS_10IdentifierEPNS0_8InstanceE
-__ZNK3KJS8Bindings9ObjcClass12methodsNamedERKNS_10IdentifierEPNS0_8InstanceE
-__ZN3KJS8Bindings25convertJSMethodNameToObjcEPKcPcm
-__ZN3KJS8Bindings10ObjcMethodC2EP10objc_classPKc
-__ZN3KJS8Bindings12ObjcInstance3endEv
-__ZN3KJS8Bindings12ObjcInstance12invokeMethodEPNS_9ExecStateERKN3WTF6VectorIPNS0_6MethodELm0EEERKNS_4ListE
-__ZNK3KJS8Bindings10ObjcMethod18getMethodSignatureEv
-__ZNK3KJS8Bindings10ObjcMethod4nameEv
-__ZN3KJS8Bindings20objcValueTypeForTypeEPKc
-__ZN3KJS8Bindings23convertValueToObjcValueEPNS_9ExecStateEPNS_7JSValueENS0_13ObjcValueTypeE
-__ZNK3KJS6JSCell9getStringEv
-__ZN3KJS8Bindings23convertNSStringToStringEP8NSString
-__ZN3KJS8Bindings12ObjcInstanceD1Ev
-__ZN3KJS9LabelNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS9LabelNode7executeEPNS_9ExecStateE
-__ZN3KJS12ContinueNodeC1ERKNS_10IdentifierE
-__ZN3KJS11FunctionImp12lengthGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS9BitOrNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS18EmptyStatementNode7executeEPNS_9ExecStateE
-__ZN3KJS22UnsignedRightShiftNodeD1Ev
-__ZN3KJS7ModNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS20arrayProtoFuncFilterEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS6InNode8evaluateEPNS_9ExecStateE
-__ZN3KJS17arrayProtoFuncMapEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS10LessEqNode10precedenceEv
-__ZNK3KJS10LessEqNode8streamToERNS_12SourceStreamE
-__ZNK3KJS18NotStrictEqualNode10precedenceEv
-__ZNK3KJS18NotStrictEqualNode8streamToERNS_12SourceStreamE
-__ZN3KJS14StringInstance16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
-__ZN3KJS7UString4fromEi
-__ZN3KJS14StringInstance11indexGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS21stringProtoFuncConcatEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS22UnsignedRightShiftNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS11ResolveNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS19FunctionCallDotNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS22UnsignedRightShiftNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS11ResolveNode16evaluateToUInt32EPNS_9ExecStateE
-__ZNK3KJS9NumberImp18getTruncatedUInt32ERj
-__ZN3KJS10NumberNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS7SubNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS14BitwiseNotNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS10BitAndNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS7AddNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS7SubNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS8VoidNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS8VoidNode8evaluateEPNS_9ExecStateE
-__ZN3KJS17DeleteResolveNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS18LocalVarDeleteNodeD1Ev
-__ZN3KJS11FunctionImp15argumentsGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS18LocalVarDeleteNode8evaluateEPNS_9ExecStateE
-__ZN3KJS17DeleteResolveNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS16RuntimeObjectImp6canPutEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3KJS13UnaryPlusNode8evaluateEPNS_9ExecStateE
-__ZN3KJS24dateProtoFuncToUTCStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS23booleanProtoFuncValueOfEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS11NewExprNode16evaluateToNumberEPNS_9ExecStateE
-__Z22kjs_pcre_ucp_othercasej
-__ZN3KJS17PreDecResolveNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS7JSValue7toFloatEPNS_9ExecStateE
-__ZN3KJS14ExpressionNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS4List26markProtectedListsSlowCaseEv
-__ZNK3KJS6JSCell9getStringERNS_7UStringE
-__ZN3KJS8TrueNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS9RegExpImp3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
-__ZNK3KJS9NumberImp9getUInt32ERj
-__ZN3KJS4Node10throwErrorEPNS_9ExecStateENS_9ErrorTypeEPKcPNS_7JSValueEPS0_
-__ZN3KJS23FunctionCallResolveNode15evaluateToInt32EPNS_9ExecStateE
-__ZNK3KJS6JSCell18getTruncatedUInt32ERj
-__ZNK3KJS9LabelNode8streamToERNS_12SourceStreamE
-__ZNK3KJS17ObjectLiteralNode21needsParensIfLeftmostEv
-__ZNK3KJS11DoWhileNode8streamToERNS_12SourceStreamE
-__ZNK3KJS17PreDecResolveNode8streamToERNS_12SourceStreamE
-__ZNK3KJS13PreIncDotNode8streamToERNS_12SourceStreamE
-__ZNK3KJS13PreDecDotNode8streamToERNS_12SourceStreamE
-__ZNK3KJS17DeleteResolveNode8streamToERNS_12SourceStreamE
-__ZN3KJS9FalseNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS23dateProtoFuncSetSecondsEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS14PostIncDotNode8streamToERNS_12SourceStreamE
-__ZNK3KJS8Bindings12ObjcInstance14implementsCallEv
-__ZN3KJS8Bindings9ObjcClass14fallbackObjectEPNS_9ExecStateEPNS0_8InstanceERKNS_10IdentifierE
-__ZN3KJS16BooleanObjectImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS11jsUndefinedEv
-___tcf_2
-___tcf_6
-___tcf_0
-___tcf_5
-___tcf_3
-___tcf_4
-__Z12jsRegExpFreeP8JSRegExp
-__ZN3KJS25CollectorHeapIntrospector4sizeEP14_malloc_zone_tPKv
-__ZN3WTF9HashTableINS_6RefPtrIN3KJS7UString3RepEEESt4pairIS5_mENS_18PairFirstExtractorIS7_EENS2_17IdentifierRepHashENS_14PairHashTraitsINS2_23IdentifierRepHashTraitsENS2_26SymbolTableIndexHashTraitsEEESC_E4findIS5_NS_22IdentityHashTranslatorIS5_S7_SA_EEEENS_17HashTableIteratorIS5_S7_S9_SA_SE_SC_EERKT_
-__ZN3KJS18AssignLocalVarNodeD1Ev
-__ZN3KJS8TrueNodeD1Ev
-__ZN3KJS11NewExprNodeD1Ev
-__ZN3KJS19ImmediateNumberNodeD1Ev
-__ZN3KJS17AssignBracketNodeD1Ev
-__ZN3KJS18LocalVarAccessNodeD1Ev
-__ZN3KJS16ParserRefCounted8refcountEv
-__ZN3KJS14JSGlobalObject16stopTimeoutCheckEv
-__ZN3KJS11GreaterNodeD1Ev
-__ZN3KJS16ArgumentListNodeD1Ev
-__ZN3KJS17FunctionObjectImp9constructEPNS_9ExecStateERKNS_4ListERKNS_10IdentifierERKNS_7UStringEi
-__ZN3KJS6Parser5parseINS_16FunctionBodyNodeEEEN3WTF10PassRefPtrIT_EERKNS_7UStringEiPKNS_5UCharEjPiSD_PS7_
-__ZN3KJS8JSObject4callEPNS_9ExecStateEPS0_RKNS_4ListE
-__ZN3KJS18AddStringRightNode8evaluateEPNS_9ExecStateE
-__ZN3KJS16globalFuncEscapeEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS13DateObjectImp19implementsConstructEv
-__ZN3KJS13DateObjectImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS13DatePrototype18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS20dateProtoFuncGetTimeEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS12DateInstance9classInfoEv
-__ZNK3KJS9NumberImp8toNumberEPNS_9ExecStateE
-__ZNK3KJS9NumberImp8toStringEPNS_9ExecStateE
-__ZN3KJS9BlockNodeD1Ev
-__ZN3KJS21dateProtoFuncGetMonthEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS21msToGregorianDateTimeEdbRNS_17GregorianDateTimeE
-__ZN3KJS12getUTCOffsetEv
-__ZN3KJS12getDSTOffsetEdd
-__ZN3KJS15ConditionalNodeD1Ev
-__ZN3KJS7DivNodeD1Ev
-__ZN3KJS9EqualNodeD1Ev
-__ZN3KJS8NullNodeD1Ev
-__ZN3KJS9FalseNodeD1Ev
-__ZN3KJS12NotEqualNodeD1Ev
-__ZN3KJS7SubNodeD1Ev
-__ZN3KJS7SubNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS24LocalVarFunctionCallNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS21ReadModifyResolveNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS14StringInstance12lengthGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS18globalFuncUnescapeEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS7DivNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS7DivNode8evaluateEPNS_9ExecStateE
-__ZN3KJS18LocalVarAccessNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS8MultNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS8MultNode8evaluateEPNS_9ExecStateE
-__ZN3KJS19FunctionCallDotNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS7SubNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS9NumberImp11toPrimitiveEPNS_9ExecStateENS_6JSTypeE
-__ZN3KJS18AddStringRightNodeD1Ev
-__ZN3KJS7AddNodeD1Ev
-__ZN3KJS13LogicalOrNodeD1Ev
-__ZN3KJS17PreIncResolveNodeD1Ev
-__ZN3KJS8MultNodeD1Ev
-__ZN3KJS8LessNodeD1Ev
-__ZN3KJS14LogicalAndNodeD1Ev
-__ZN3KJS10NumberNodeD1Ev
-__ZN3KJS13GreaterEqNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS14LogicalNotNodeD1Ev
-__ZN3KJS7ModNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS14JSGlobalObject12checkTimeoutEv
-__ZN3KJS7ModNode8evaluateEPNS_9ExecStateE
-__ZN3KJS15LessNumbersNode8evaluateEPNS_9ExecStateE
-__ZN3KJS20dateProtoFuncGetYearEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS8ThisNodeD1Ev
-__ZN3KJS19mathProtoFuncRandomEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS20globalFuncParseFloatEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS13GreaterEqNode8evaluateEPNS_9ExecStateE
-__ZN3KJS20dateProtoFuncGetDateEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS18mathProtoFuncFloorEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS23stringProtoFuncFontsizeEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS11ResolveNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS13GreaterEqNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS9NumberImp18getPrimitiveNumberEPNS_9ExecStateERdRPNS_7JSValueE
-__ZN3KJS19stringProtoFuncLinkEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS19dateProtoFuncGetDayEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS21dateProtoFuncGetHoursEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS23dateProtoFuncGetMinutesEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS23dateProtoFuncGetSecondsEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS9ArrayNodeD1Ev
-__ZN3KJS11ElementNodeD1Ev
-__ZN3KJS17ObjectLiteralNodeD1Ev
-__ZN3KJS14PostfixDotNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS14PostIncDotNode8evaluateEPNS_9ExecStateE
-__ZN3KJS19PlaceholderTrueNodeD1Ev
-__ZN3KJS19PostDecLocalVarNode8evaluateEPNS_9ExecStateE
-__ZN3KJS17ReadModifyDotNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS17ReadModifyDotNode8evaluateEPNS_9ExecStateE
-__ZN3KJS21FunctionCallValueNodeD1Ev
-__ZN3KJS10BitAndNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS14AddNumbersNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS10BitXOrNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS22UnsignedRightShiftNode8evaluateEPNS_9ExecStateE
-__ZN3KJS8MultNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS7DivNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS19StringObjectFuncImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS7ModNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS10BitAndNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS14RightShiftNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS14AddNumbersNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS14globalFuncEvalEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS6Parser5parseINS_8EvalNodeEEEN3WTF10PassRefPtrIT_EERKNS_7UStringEiPKNS_5UCharEjPiSD_PS7_
-__ZN3KJS13EvalExecStateC1EPNS_14JSGlobalObjectEPNS_8EvalNodeEPNS_9ExecStateE
-__ZN3KJS8EvalNode7executeEPNS_9ExecStateE
-__ZN3KJS8EvalNodeD1Ev
-__ZN3KJS23FunctionCallBracketNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS23FunctionCallBracketNode8evaluateEPNS_9ExecStateE
-__ZN3KJS16PropertyListNodeD1Ev
-__ZN3KJS12PropertyNodeD1Ev
-__ZN3KJS13CaseBlockNodeD1Ev
-__ZN3KJS14CaseClauseNodeD1Ev
-__ZN3KJS14ClauseListNodeD1Ev
-__ZN3KJS9RegExpImp18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS17staticValueGetterINS_9RegExpImpEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK3KJS9RegExpImp16getValuePropertyEPNS_9ExecStateEi
-__ZN3KJS9ThrowNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS15StrictEqualNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS19regExpProtoFuncTestEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS9RegExpImp5matchEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS15StrictEqualNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS18NotStrictEqualNodeD1Ev
-__ZN3KJS15StrictEqualNodeD1Ev
-__ZN3KJS18LocalVarTypeOfNodeD1Ev
-__ZN3KJS19globalFuncEncodeURIEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS17TypeOfResolveNode8evaluateEPNS_9ExecStateE
-__ZN3KJS26stringProtoFuncLastIndexOfEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS7JSValue20toIntegerPreserveNaNEPNS_9ExecStateE
-__ZNK3KJS7UString5rfindERKS0_i
-__ZN3KJS15TypeOfValueNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS15TypeOfValueNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS17FunctionObjectImp19implementsConstructEv
-__ZN3KJS17FunctionObjectImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZNK3KJS8JSObject11hasPropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3KJS30dateProtoFuncGetTimezoneOffsetEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS8JSObject3putEPNS_9ExecStateEjPNS_7JSValueEi
-__ZN3KJS6InNodeD1Ev
-__ZNK3KJS9Arguments9classInfoEv
-__ZN3KJS10BitXOrNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS19addSlowCaseToNumberEPNS_9ExecStateEPNS_7JSValueES3_
-__ZN3KJS8JSObject14deletePropertyEPNS_9ExecStateEj
-__ZNK3KJS9WhileNode8streamToERNS_12SourceStreamE
-__ZNK3KJS9FalseNode8streamToERNS_12SourceStreamE
-__ZNK3KJS7DivNode8streamToERNS_12SourceStreamE
-__ZNK3KJS7DivNode10precedenceEv
-__ZNK3KJS15StrictEqualNode8streamToERNS_12SourceStreamE
-__ZNK3KJS15StrictEqualNode10precedenceEv
-__ZNK3KJS16VarDeclCommaNode10precedenceEv
-__ZNK3KJS17PreIncResolveNode8streamToERNS_12SourceStreamE
-__ZNK3KJS9FalseNode10precedenceEv
-__ZN3KJS14InstanceOfNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZNK3KJS19InternalFunctionImp21implementsHasInstanceEv
-__ZN3KJS8JSObject11hasInstanceEPNS_9ExecStateEPNS_7JSValueE
-__ZN3WTF14FastMallocZone9forceLockEP14_malloc_zone_t
-__ZN3KJS25CollectorHeapIntrospector9forceLockEP14_malloc_zone_t
-__ZN3WTF14FastMallocZone11forceUnlockEP14_malloc_zone_t
-__ZN3KJS25CollectorHeapIntrospector11forceUnlockEP14_malloc_zone_t
-__ZNK3KJS23FunctionCallBracketNode10precedenceEv
-__ZN3KJS14InstanceOfNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS9ThrowNode8streamToERNS_12SourceStreamE
-__ZNK3KJS7SubNode10precedenceEv
-__ZNK3KJS7SubNode8streamToERNS_12SourceStreamE
-__ZNK3KJS10NegateNode10precedenceEv
-__ZNK3KJS10NegateNode8streamToERNS_12SourceStreamE
-__ZNK3KJS12FuncDeclNode8streamToERNS_12SourceStreamE
-__ZNK3KJS18PostDecResolveNode8streamToERNS_12SourceStreamE
-__ZNK3KJS9BreakNode8streamToERNS_12SourceStreamE
-__ZNK3KJS6InNode10precedenceEv
-__ZNK3KJS6InNode8streamToERNS_12SourceStreamE
-__ZN3KJS14StringInstanceC2EPNS_8JSObjectERKNS_7UStringE
-__ZN3KJS18PostDecBracketNode8evaluateEPNS_9ExecStateE
-__ZN3KJS28dateProtoFuncGetMilliSecondsEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS18PostIncResolveNode8streamToERNS_12SourceStreamE
-__ZN3KJS13ArrayInstance14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3KJS14StringInstance14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3KJS15AssignErrorNodeD1Ev
-__ZN3WTF6VectorIcLm0EE14expandCapacityEmPKc
-__ZN3WTF6VectorIcLm0EE14expandCapacityEm
+__ZN3JSCL22numberProtoFuncToFixedEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL16integerPartNoExpEd
+__ZN3WTF14FastMallocZone10statisticsEP14_malloc_zone_tP19malloc_statistics_t
+__ZN3JSC4Heap26protectedGlobalObjectCountEv
+__ZN3JSC10JSFunction15argumentsGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZNK3JSC11Interpreter17retrieveArgumentsEPNS_9ExecStateEPNS_10JSFunctionE
+__ZN3JSCL21dateProtoFuncSetMonthEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23setNewValueFromDateArgsEPNS_9ExecStateENS_7JSValueERKNS_7ArgListEib
+__ZN3JSCL20dateProtoFuncSetDateEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF6VectorIPNS0_IN3JSC10RegisterIDELm32EEELm32EE14expandCapacityEm
+__ZN3JSC8JITStubs14cti_op_pre_incEPPv
+__ZN3WTF6VectorIPN3JSC14ExpressionNodeELm16EE14expandCapacityEm
+__ZN3JSC13UnaryPlusNodeD0Ev
+__ZN3JSC3JIT19emit_op_to_jsnumberEPNS_11InstructionE
+__ZN3JSC3JIT23emitSlow_op_to_jsnumberEPNS_11InstructionERPNS_13SlowCaseEntryE
+__ZN3JSC8JITStubs18cti_op_to_jsnumberEPPv
+__ZN3JSC6JSLock12DropAllLocksC1Eb
+__ZN3JSCL17createJSLockCountEv
+__ZN3JSC6JSLock12DropAllLocksD1Ev
+__ZN3JSCL24dateProtoFuncSetFullYearEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF6VectorIN3JSC15StringJumpTableELm0EE15reserveCapacityEm
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEENS2_14OffsetLocationENS_7StrHashIS5_EENS_10HashTraitsIS5_EENS9_IS6_EEE3addEPS4_
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_NS2_14OffsetLocationEENS_18PairFirstExtractorIS8_EENS_7StrHashIS5_
+__ZN3JSC3JIT21emit_op_switch_stringEPNS_11InstructionE
+__ZN3JSC8JITStubs20cti_op_switch_stringEPPv
+__ZN3WTF6VectorIN3JSC14ExecutablePool10AllocationELm2EE14expandCapacityEm
+__ZN3JSC12JSGlobalData6createEb
+__ZN3JSCL13allocateBlockILNS_8HeapTypeE1EEEPNS_14CollectorBlockEv
+__ZN3JSC7JSValueC1EPNS_9ExecStateEd
+__ZN3JSC10JSFunctionC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjectESA_RK
+__ZN3JSC8JSObject17putDirectFunctionEPNS_9ExecStateEPNS_16InternalFunctionEj
+__ZN3JSC7CStringD1Ev
+__ZN3WTF7HashMapIPvjNS_7PtrHashIS1_EEN3JSC17JSValueHashTraitsENS_10HashTraitsIjEEE3addERKS1_RKj
+__ZN3WTF6VectorINS_6RefPtrIN3JSC12FuncExprNodeEEELm0EE14shrinkCapacityEm
+__ZN3JSC14ExpressionNodeD2Ev
+__ZThn12_N3JSC11ProgramNodeD0Ev
+__ZThn12_N3JSC12FuncExprNodeD0Ev
+__ZThn12_N3JSC16FunctionBodyNodeD0Ev
+__ZN3JSC8JITStubs16cti_op_new_arrayEPvz
+__ZN3WTF6VectorIN3JSC17StructureStubInfoELm0EE15reserveCapacityEm
+__ZN3JSC17BytecodeGenerator10emitOpcodeENS_8OpcodeIDE
+__ZN3JSC23MacroAssemblerX86Common4moveENS_3X8610RegisterIDES2_
+__ZN3JSC8JITStubs15cti_op_new_funcEPvz
+__ZN3JSC8JITStubs21cti_op_resolve_globalEPvz
+__ZN3JSC8JITStubs16cti_op_get_by_idEPvz
+__ZN3JSC8JITStubs31cti_op_construct_NotJSConstructEPvz
+__ZN3JSC8JITStubs16cti_op_put_by_idEPvz
+__ZN3JSC8JITStubs13cti_op_strcatEPvz
+__ZN3JSC8JITStubs19cti_op_resolve_funcEPvz
+__ZN3JSC8JITStubs23cti_vm_dontLazyLinkCallEPvz
+__ZN3JSC8JITStubs22cti_op_call_JSFunctionEPvz
+__ZN3JSC8JITStubs23cti_register_file_checkEPvz
+__ZN3JSC8JITStubs13cti_op_negateEPvz
+__ZN3JSC8JITStubs28cti_op_construct_JSConstructEPvz
+__ZN3JSC23MacroAssemblerX86Common12branchTest32ENS0_9ConditionENS_22AbstractMacroAssemblerINS_12X86AssemblerEE7AddressENS4_5Imm
+__ZN3JSC8JITStubs23cti_op_put_by_val_arrayEPvz
+__ZN3JSC8JITStubs23cti_op_put_by_id_secondEPvz
+__ZN3JSC15AssemblerBuffer14executableCopyEPNS_14ExecutablePoolE
+__ZN3JSC12X86Assembler8sarl_i8rEiNS_3X8610RegisterIDE
+__ZN3JSC12X86Assembler23X86InstructionFormatter9twoByteOpENS0_15TwoByteOpcodeIDEiNS_3X8610RegisterIDEi
+__ZN3JSC8JITStubs10cti_op_mulEPvz
+__ZN3JSC12jsNumberCellEPNS_12JSGlobalDataEd
+__ZN3JSC8JITStubs10cti_op_subEPvz
+__ZN3JSC8JITStubs10cti_op_divEPvz
+__ZN3JSC8JITStubs23cti_op_get_by_id_secondEPvz
+__ZN3JSC8JITStubs19cti_vm_lazyLinkCallEPvz
+__ZN3WTF6VectorIPN3JSC12CallLinkInfoELm0EE14expandCapacityEm
+__ZN3JSC8JITStubs19cti_op_convert_thisEPvz
+__ZN3JSC8JITStubs21cti_op_put_by_id_failEPvz
+__ZN3JSC8JITStubs10cti_op_addEPvz
+__ZN3JSC8JITStubs17cti_timeout_checkEPvz
+__ZN3JSC9jsBooleanEb
+__ZN3JSC9CodeBlock19isKnownNotImmediateEi
+__ZN3JSC12X86Assembler8movsd_mrEiNS_3X8610RegisterIDENS1_13XMMRegisterIDE
+__ZN3JSC8JITStubs25cti_op_call_NotJSFunctionEPvz
+__ZNK3JSC12JSNumberCell8toNumberEPNS_9ExecStateE
+__ZN3JSC8JITStubs26cti_op_get_by_id_self_failEPvz
+__ZN3JSC8JITStubs10cti_op_endEPvz
+__ZThn12_N3JSC12FuncDeclNodeD0Ev
+__ZN3JSC8JITStubs24cti_op_resolve_with_baseEPvz
+__ZN3JSC8JITStubs19cti_op_new_func_expEPvz
+__ZN3JSC8JITStubs22cti_op_push_activationEPvz
+__ZN3JSC8JITStubs17cti_op_get_by_valEPvz
+__ZN3JSC8JITStubs22cti_op_call_arityCheckEPvz
+__ZN3JSC8JITStubs11cti_op_lessEPvz
+__ZN3JSC12JSNumberCell18getPrimitiveNumberEPNS_9ExecStateERdRNS_7JSValueE
+__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDE
+__ZN3JSC8JITStubs27cti_op_get_by_id_proto_listEPvz
+__ZN3JSC8JITStubs12cti_op_jtrueEPvz
+__ZN3JSC8JITStubs10cti_op_modEPvz
+__ZN3JSC8JITStubs10cti_op_neqEPvz
+__ZN3JSC8JITStubs12cti_op_jlessEPvz
+__ZN3JSC8JITStubs24cti_op_get_by_id_genericEPvz
+__ZN3JSC8JITStubs14cti_op_jlesseqEPvz
+__ZN3JSC8JITStubs26cti_op_tear_off_activationEPvz
+__ZN3JSC8JITStubs21cti_op_ret_scopeChainEPvz
+__ZN3JSC8JITStubs19cti_op_to_primitiveEPvz
+__ZNK3JSC12JSNumberCell8toStringEPNS_9ExecStateE
+__ZN3JSC8JITStubs13cti_op_bitandEPvz
+__ZN3JSC8JITStubs13cti_op_lshiftEPvz
+__ZN3JSC8JITStubs13cti_op_bitnotEPvz
+__ZNK3JSC12JSNumberCell9toBooleanEPNS_9ExecStateE
+__ZN3JSC8JITStubs14cti_op_urshiftEPvz
+__ZNK3JSC12JSNumberCell18getTruncatedUInt32ERj
+__ZN3JSC4Yarr14RegexGenerator28generateCharacterClassSingleERNS1_19TermGenerationStateE
+__ZN3WTF15deleteAllValuesIPN3JSC4Yarr18PatternDisjunctionELm4EEEvRKNS_6VectorIT_XT0_EEE
+__ZN3JSC8JITStubs17cti_op_new_regexpEPvz
+__ZN3JSC8JITStubs12cti_op_bitorEPvz
+__ZNK3JSC12JSNumberCell17getTruncatedInt32ERi
+__ZN3JSC8JITStubs13cti_op_rshiftEPvz
+__ZN3JSC8JITStubs13cti_op_bitxorEPvz
+__ZN3WTF7HashSetINS_6RefPtrIN3JSC7UString3RepEEENS2_17IdentifierRepHashENS_10HashTraitsIS5_EEE3addERKS5_
+__ZN3JSC8JITStubs9cti_op_eqEPvz
+__ZN3JSC8JITStubs16cti_op_call_evalEPvz
+__ZN3JSC8JITStubs19cti_op_resolve_skipEPvz
+__ZN3JSC8JITStubs17cti_op_new_objectEPvz
+__ZN3JSC8JITStubs14cti_op_resolveEPvz
+__ZN3JSC8JITStubs17cti_op_put_by_valEPvz
+__ZN3JSC8JITStubs18cti_op_switch_charEPvz
+__ZN3JSC8JITStubs28cti_op_get_by_id_string_failEPvz
+__ZThn12_N3JSC8EvalNodeD0Ev
+__ZN3WTF6VectorIN3JSC7UStringELm16EE14expandCapacityEm
+__ZN3JSC8JITStubs17cti_op_get_pnamesEPvz
+__ZN3JSC8JITStubs17cti_op_next_pnameEPvz
+__ZN3WTF7HashSetIPN3JSC20MarkedArgumentBufferENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN3JSC20MarkedArgumentBufferES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findI
+__ZN3JSC8JITStubs24cti_op_get_by_val_stringEPvz
+__ZN3JSC4Yarr6ParserINS0_23RegexPatternConstructorEE28CharacterClassParserDelegate25atomBuiltInCharacterClassENS0_23BuiltInChar
+__ZN3JSC12jsNumberCellEPNS_9ExecStateEd
+__ZN3JSC8JITStubs18cti_op_is_functionEPvz
+__ZN3JSC8JITStubs16cti_op_is_objectEPvz
+__ZN3JSC8JITStubs16cti_op_nstricteqEPvz
+__ZN3JSC8JITStubs13cti_op_lesseqEPvz
+__ZNK3JSC12JSNumberCell11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZN3JSC4Yarr14RegexGenerator27generateCharacterClassFixedERNS1_19TermGenerationStateE
+__ZN3JSC4Heap7destroyEv
+__ZN3JSC12JSGlobalDataD1Ev
+__ZN3JSC12JSGlobalDataD2Ev
+__ZN3JSC12RegisterFileD1Ev
+__ZNK3JSC9HashTable11deleteTableEv
+__ZN3JSC5LexerD1Ev
+__ZN3JSC5LexerD2Ev
+__ZN3WTF20deleteAllPairSecondsIP24OpaqueJSClassContextDataKNS_7HashMapIP13OpaqueJSClassS2_NS_7PtrHashIS5_EENS_10HashTraitsIS5_E
+__ZN3JSC17CommonIdentifiersD2Ev
+__ZN3JSC21deleteIdentifierTableEPNS_15IdentifierTableE
+__ZN3JSC4HeapD1Ev
+__ZN3JSC12SmallStringsD1Ev
+__ZN3JSCL16mathProtoFuncMinEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL17arrayProtoFuncPopEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC7JSArray3popEv
+__ZN3JSC11DoWhileNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC11DoWhileNodeD0Ev
+__ZN3JSC3JIT18emit_op_switch_immEPNS_11InstructionE
+__ZN3JSC8JITStubs17cti_op_switch_immEPPv
+__ZN3JSC13UnaryPlusNode14stripUnaryPlusEv
+__ZN3JSC15globalFuncIsNaNEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC17NumberConstructor11getCallDataERNS_8CallDataE
+__ZN3JSCL21callNumberConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF6VectorIPNS0_IN3JSC10IdentifierELm64EEELm32EE14expandCapacityEm
+__ZN3JSC8JITStubs19cti_op_is_undefinedEPvz
+__ZN3JSC8JITStubs13cti_op_typeofEPvz
+__ZN3JSC8JITStubs33cti_op_create_arguments_no_paramsEPvz
+__ZN3JSC8JITStubs19cti_op_load_varargsEPvz
+__ZN3JSC8JITStubs10cti_op_notEPvz
+__ZN3JSC8JITStubs16cti_op_is_stringEPvz
+__ZN3JSCL24regExpConstructorDollar1EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3WTF6VectorIN3JSC15StringJumpTableELm0EE14expandCapacityEm
+__ZN3JSC8JITStubs20cti_op_switch_stringEPvz
+__ZN3JSC9Arguments3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC8JITStubs18cti_op_to_jsnumberEPvz
+__ZN3JSC8JITStubs19cti_op_loop_if_lessEPvz
+__ZN3JSC9LabelNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC9LabelNodeD0Ev
+__ZNK3JSC7UString5asciiEv
+__ZN3JSC8JITStubs27cti_op_get_by_id_array_failEPvz
+__ZN3JSC12X86Assembler23X86InstructionFormatter9oneByteOpENS0_15OneByteOpcodeIDEiPv
+__ZN3JSC8JITStubs23cti_op_create_argumentsEPvz
+__ZN3JSCL21arrayProtoFuncUnShiftEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs25cti_op_tear_off_argumentsEPvz
+__ZN3JSC7JSArray11sortNumericEPNS_9ExecStateENS_7JSValueENS_8CallTypeERKNS_8CallDataE
+__ZN3JSC7JSArray17compactForSortingEv
+__ZN3JSCL22compareNumbersForQSortEPKvS1_
+__ZN3JSC8JITStubs15cti_op_post_incEPPv
+__ZN3JSC8JITStubs24cti_op_put_by_id_genericEPvz
+__ZN3JSCL24regExpConstructorDollar2EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL24regExpConstructorDollar3EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL24regExpConstructorDollar4EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL24regExpConstructorDollar5EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL24regExpConstructorDollar6EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL21stringProtoFuncSubstrEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23stringProtoFuncFontsizeEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL24dateProtoFuncToUTCStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL19stringProtoFuncLinkEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL9dateParseEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs21cti_op_loop_if_lesseqEPPv
+__ZN3JSCL16mathProtoFuncExpEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC4Yarr17nonwordcharCreateEv
+__ZN3WTF6VectorIPN3JSC4Yarr18PatternDisjunctionELm4EE14expandCapacityEmPKS4_
+__Z15jsc_pcre_xclassiPKh
+__ZN3JSC18RegExpMatchesArray3putEPNS_9ExecStateEjNS_7JSValueE
+__ZN3JSC28globalFuncDecodeURIComponentEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs27cti_op_get_by_id_array_failEPPv
+__ZNK3JSC9Arguments9classInfoEv
+__ZN3JSC9Arguments15copyToRegistersEPNS_9ExecStateEPNS_8RegisterEj
+__ZN3JSC19JSStaticScopeObject4markEv
+__ZN3JSC8JITStubs19cti_op_loop_if_lessEPPv
+__ZN3JSC8JITStubs16cti_op_del_by_idEPvz
+__ZN3JSC7JSArray14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
+__ZN3JSC7UString6appendEPKti
+__ZN3JSC8JITStubs17cti_op_push_scopeEPvz
+__ZN3JSC8JITStubs19cti_op_resolve_baseEPvz
+__ZN3JSC8JITStubs16cti_op_pop_scopeEPvz
+__ZN3JSC8JITStubs17cti_op_is_booleanEPvz
+__ZN3JSCL20arrayProtoFuncSpliceEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs17cti_op_jmp_scopesEPvz
+__ZN3JSC8JITStubs9cti_op_inEPvz
+__ZN3JSC8JITStubs15cti_op_stricteqEPvz
+__ZN3JSC8JITStubs32cti_op_get_by_id_proto_list_fullEPvz
+__ZN3WTF6VectorIiLm8EE14expandCapacityEm
+__ZN3JSCL21stringProtoFuncSearchEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs12cti_vm_throwEPvz
+__ZN3JSC8JITStubs21cti_op_push_new_scopeEPvz
+__ZN3JSC8JITStubs16cti_op_is_numberEPvz
+__ZN3JSC16JSVariableObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
+__ZNK3JSC8JSString8toObjectEPNS_9ExecStateE
+__ZN3JSC12StringObject16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
+__ZN3JSC9ExecState11stringTableEPS0_
+__ZN3JSC11JSImmediate8toObjectENS_7JSValueEPNS_9ExecStateE
+__ZN3JSC36constructBooleanFromImmediateBooleanEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC13BooleanObjectD1Ev
+__ZN3JSCL17arrayProtoFuncMapEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC7JSArrayC2EN3WTF10PassRefPtrINS_9StructureEEEj
+__ZN3JSC8JITStubs17cti_op_del_by_valEPvz
+__ZN3JSC8JITStubs27cti_op_get_by_id_proto_failEPvz
+__ZN3JSC10JSFunction12callerGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZNK3JSC11Interpreter14retrieveCallerEPNS_9ExecStateEPNS_16InternalFunctionE
+__ZN3JSC18globalFuncIsFiniteEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC6JSCell18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZNK3JSC12JSNumberCell8toObjectEPNS_9ExecStateE
+__ZN3JSC15constructNumberEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC12NumberObject11getJSNumberEv
+__ZN3JSCL7dateNowEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC12NumberObjectD1Ev
+__ZN3JSC8JSObject18getPrimitiveNumberEPNS_9ExecStateERdRNS_7JSValueE
+__ZN3JSCL22numberProtoFuncValueOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC13JSNotAnObject18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC19JSStaticScopeObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC16InternalFunction4nameEPNS_12JSGlobalDataE
+__ZN3JSCL18arrayProtoFuncSomeEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JSString18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC12JSNumberCell11getJSNumberEv
+__ZN3JSC23createNotAFunctionErrorEPNS_9ExecStateENS_7JSValueEjPNS_9CodeBlockE
+__ZN3JSC17PrefixBracketNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC17PrefixBracketNodeD0Ev
+__ZN3JSC17RegExpConstructor11getCallDataERNS_8CallDataE
+__ZN3JSCL21callRegExpConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC7JSArray4sortEPNS_9ExecStateE
+__ZN3JSCL27dateProtoFuncSetUTCFullYearEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL24dateProtoFuncSetUTCHoursEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23setNewValueFromTimeArgsEPNS_9ExecStateENS_7JSValueERKNS_7ArgListEib
+__ZN3JSC8JITStubs17cti_op_switch_immEPvz
+__ZN3JSC12RegExpObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSCL24setRegExpObjectLastIndexEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueE
+__ZN3JSCL28regExpConstructorLeftContextEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSC18RegExpMatchesArray14deletePropertyEPNS_9ExecStateEj
+__ZN3JSC18RegExpMatchesArray3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC10JSFunction12lengthGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZNK3JSC12NumberObject9classInfoEv
+__ZN3JSC8JITStubs12cti_op_throwEPvz
+__ZN3JSCL19isNonASCIIIdentPartEi
+__ZN3JSCL27dateProtoFuncToLocaleStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL16formatLocaleDateEPNS_9ExecStateEPNS_12DateInstanceEdNS_20LocaleDateTimeFormatERKNS_7ArgListE
+__ZN3JSCL21dateProtoFuncSetHoursEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23dateProtoFuncSetMinutesEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23dateProtoFuncSetSecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL28dateProtoFuncSetMilliSecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC12JSNumberCell12toThisObjectEPNS_9ExecStateE
+__ZN3JSC16ErrorConstructor11getCallDataERNS_8CallDataE
+__ZN3JSCL20callErrorConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC17PrototypeFunctionC1EPNS_9ExecStateEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjectES6_RKNS_7ArgListEE
+__ZN3JSC17PrototypeFunctionC2EPNS_9ExecStateEiRKNS_10IdentifierEPFNS_7JSValueES2_PNS_8JSObjectES6_RKNS_7ArgListEE
+__ZN3JSC17PrototypeFunction11getCallDataERNS_8CallDataE
+__ZN3JSC17PrototypeFunctionD1Ev
+__ZN3JSCL24booleanProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC17BytecodeGenerator18emitJumpSubroutineEPNS_10RegisterIDEPNS_5LabelE
+__ZN3JSC3JIT11emit_op_jsrEPNS_11InstructionE
+__ZN3WTF6VectorIN3JSC3JIT7JSRInfoELm0EE14expandCapacityEm
+__ZN3JSC3JIT12emit_op_sretEPNS_11InstructionE
+__ZN3JSC6Parser7reparseINS_8EvalNodeEEEN3WTF10PassRefPtrIT_EEPNS_12JSGlobalDataEPS5_
+__ZN3JSC8EvalNode6createEPNS_12JSGlobalDataEPNS_14SourceElementsEPN3WTF6VectorISt4pairINS_10IdentifierEjELm0EEEPNS6_IPNS_12Func
+__ZN3JSC8EvalNode31bytecodeForExceptionInfoReparseEPNS_14ScopeChainNodeEPNS_9CodeBlockE
+__ZN3JSC20FixedVMPoolAllocator17coalesceFreeSpaceEv
+__ZN3WTF6VectorIPN3JSC13FreeListEntryELm0EE15reserveCapacityEm
+__ZN3JSCL35reverseSortFreeListEntriesByPointerEPKvS1_
+__ZN3JSC14globalFuncEvalEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL21functionProtoFuncCallEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL22functionProtoFuncApplyEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC9Arguments11fillArgListEPNS_9ExecStateERNS_20MarkedArgumentBufferE
+__ZNK3JSC7JSValue12toThisObjectEPNS_9ExecStateE
+__ZN3JSC8VoidNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC8VoidNodeD0Ev
+__ZN3JSC16InternalFunctionC2EPNS_12JSGlobalDataEN3WTF10PassRefPtrINS_9StructureEEERKNS_10IdentifierE
+__ZN3JSC20MarkedArgumentBuffer9markListsERN3WTF7HashSetIPS0_NS1_7PtrHashIS3_EENS1_10HashTraitsIS3_EEEE
+__ZN3JSC7CStringaSERKS0_
+__ZNK3JSC19JSStaticScopeObject14isDynamicScopeEv
+__ZN3JSCL33reverseSortCommonSizedAllocationsEPKvS1_
+__ZN3JSCL20arrayProtoFuncFilterEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC17NumberConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL30constructWithNumberConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC17BytecodeGenerator18emitUnexpectedLoadEPNS_10RegisterIDEb
+__ZN3JSC8JITStubs12cti_op_throwEPPv
+__ZN3JSC6JSCell9getObjectEv
+__ZN3JSCL21arrayProtoFuncReverseEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC8JSObject16isVariableObjectEv
+__ZN3JSC18EmptyStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSCL27compareByStringPairForQSortEPKvS1_
+__Z22jsc_pcre_ucp_othercasej
+__ZN3JSCL35objectProtoFuncPropertyIsEnumerableEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC8JSObject21getPropertyAttributesEPNS_9ExecStateERKNS_10IdentifierERj
+__ZN3WTF7HashMapIjN3JSC7JSValueENS_7IntHashIjEENS_10HashTraitsIjEENS5_IS2_EEE3setERKjRKS2_
+__ZN3WTF9HashTableIjSt4pairIjN3JSC7JSValueEENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEE
+__ZN3JSC12RegisterFile21releaseExcessCapacityEv
+__ZN3JSCL20isNonASCIIIdentStartEi
+__ZN3JSC17BytecodeGenerator14emitPutByIndexEPNS_10RegisterIDEjS2_
+__ZN3JSC3JIT20emit_op_put_by_indexEPNS_11InstructionE
+__ZN3JSC8JITStubs19cti_op_put_by_indexEPPv
+__ZN3JSCL25numberConstructorMaxValueEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL28numberConstructorPosInfinityEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL28numberConstructorNegInfinityEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSC18BooleanConstructor11getCallDataERNS_8CallDataE
+__ZN3JSCL22callBooleanConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL17mathProtoFuncATanEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JITStubs17cti_op_jmp_scopesEPPv
+__ZNK3JSC8JSObject11hasPropertyEPNS_9ExecStateEj
+__ZN3JSCL17mathProtoFuncASinEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC11Interpreter7executeEPNS_8EvalNodeEPNS_9ExecStateEPNS_8JSObjectEPNS_14ScopeChainNodeEPNS_7JSValueE
 _JSContextGetGlobalObject
+__ZN3JSC4Heap14registerThreadEv
+__ZN3JSC6JSLockC1EPNS_9ExecStateE
+_JSStringCreateWithUTF8CString
+__ZN3WTF7Unicode18convertUTF8ToUTF16EPPKcS2_PPtS4_b
 _JSClassCreate
 __ZN13OpaqueJSClass6createEPK17JSClassDefinition
 __ZN13OpaqueJSClassC2EPK17JSClassDefinitionPS_
+__ZN3JSC7UString3Rep14createFromUTF8EPKc
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEP19StaticFunctionEntryNS_7StrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEE3addERKS
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_P19StaticFunctionEntryENS_18PairFirstExtractorIS9_EENS_7StrHashIS5
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEP16StaticValueEntryNS_7StrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEE3addERKS5_R
 _JSClassRetain
 _JSObjectMake
-__ZN13OpaqueJSClass9prototypeEPK15OpaqueJSContext
-__ZN3KJS16JSCallbackObjectINS_8JSObjectEE4initEPNS_9ExecStateE
-_JSStringCreateWithUTF8CString
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEE4initEPNS_9ExecStateE
+__ZN13OpaqueJSClass9prototypeEPN3JSC9ExecStateE
+__ZN13OpaqueJSClass11contextDataEPN3JSC9ExecStateE
+__ZN3WTF9HashTableIP13OpaqueJSClassSt4pairIS2_P24OpaqueJSClassContextDataENS_18PairFirstExtractorIS6_EENS_7PtrHashIS2_EENS_14Pa
+__ZN24OpaqueJSClassContextDataC2EP13OpaqueJSClass
+__ZN3JSC7UString3Rep13createCopyingEPKti
 _JSObjectSetProperty
+__ZNK14OpaqueJSString10identifierEPN3JSC12JSGlobalDataE
+__ZN3JSC14JSGlobalObject17putWithAttributesEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueEj
 _JSStringRelease
-__Z30makeGetterOrSetterPropertyNodeRKN3KJS10IdentifierES2_PNS_13ParameterNodeEPNS_16FunctionBodyNodeE
-__ZN3KJS8JSObject12defineGetterEPNS_9ExecStateERKNS_10IdentifierEPS0_
-__ZN3KJS8JSObject12defineSetterEPNS_9ExecStateERKNS_10IdentifierEPS0_
-__ZNK3KJS15GetterSetterImp4typeEv
-__ZNK3KJS8JSObject6canPutEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3KJS13ConstDeclNodeC1ERKNS_10IdentifierEPNS_14ExpressionNodeE
-__Z26appendToVarDeclarationListRPN3KJS20ParserRefCountedDataIN3WTF6VectorISt4pairINS_10IdentifierEjELm16EEEEEPNS_13ConstDeclNodeE
-__ZN3KJS18ConstStatementNodeC1EPNS_13ConstDeclNodeE
-__ZN3KJS16JSCallbackObjectINS_8JSObjectEE18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS16JSCallbackObjectINS_8JSObjectEE20staticFunctionGetterEPNS_9ExecStateEPS1_RKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS18JSCallbackFunctionC1EPNS_9ExecStateEPFPK13OpaqueJSValuePK15OpaqueJSContextPS3_S9_mPKS5_PS5_ERKNS_10IdentifierE
-__ZN3KJS18JSCallbackFunction14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEE18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEE20staticFunctionGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSC18JSCallbackFunctionC1EPNS_9ExecStateEPFPK13OpaqueJSValuePK15OpaqueJSContextPS3_S9_mPKS5_PS5_ERKNS_10IdentifierE
+__ZN3JSC18JSCallbackFunction11getCallDataERNS_8CallDataE
+__ZN3JSC18JSCallbackFunction4callEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC6JSLock12DropAllLocksC1EPNS_9ExecStateE
 _JSObjectGetPrivate
-__ZNK3KJS16JSCallbackObjectINS_8JSObjectEE9classInfoEv
+__ZNK3JSC16JSCallbackObjectINS_8JSObjectEE9classInfoEv
+_JSValueMakeUndefined
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEE17staticValueGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN14OpaqueJSString6createERKN3JSC7UStringE
 _JSStringCreateWithCharacters
 _JSValueMakeString
-__ZN3KJS12PropertySlot14functionGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKS0_
-__ZN3WTF10fastCallocEmm
+__ZNK14OpaqueJSString7ustringEv
+__ZN3JSC7UStringC1EPtib
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEED1Ev
+_JSClassRelease
+__ZL25clearReferenceToPrototypeP13OpaqueJSValue
 _JSObjectGetProperty
 _JSValueToObject
-_JSValueProtect
-_JSObjectCallAsFunction
-_JSValueMakeNumber
+__ZN3JSCL22dateProtoFuncGetUTCDayEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL24dateProtoFuncGetUTCMonthEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23dateProtoFuncGetUTCDateEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL27dateProtoFuncGetUTCFullYearEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC7UString8toUInt32EPb
+__ZN3JSCL24dateProtoFuncGetUTCHoursEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL26dateProtoFuncGetUTCMinutesEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL26dateProtoFuncGetUTCSecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL7dateUTCEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC12RegExpObject11getCallDataERNS_8CallDataE
+__ZN3JSC9Arguments14deletePropertyEPNS_9ExecStateEj
 _JSValueMakeBoolean
-_JSObjectCallAsConstructor
-__ZN3KJS15GetterSetterImp4markEv
-_JSValueMakeUndefined
-_JSValueUnprotect
-_JSValueIsNumber
 _JSValueToNumber
-__ZN3KJS16JSCallbackObjectINS_8JSObjectEED0Ev
-__Z25clearReferenceToPrototypeP13OpaqueJSValue
-_JSClassRelease
-_JSStringIsEqualToUTF8CString
-_JSStringIsEqual
-__ZN3KJSeqERKNS_7UStringES2_
-__ZN3KJS16JSCallbackObjectINS_8JSObjectEE14callbackGetterEPNS_9ExecStateEPS1_RKNS_10IdentifierERKNS_12PropertySlotE
 _JSStringCreateWithCFString
-__ZN3KJS7UStringC2EPNS_5UCharEib
-__ZN3KJS16JSCallbackObjectINS_8JSObjectEE3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
+__ZN3WTF13tryFastCallocEmm
+_JSValueMakeNumber
+__ZN3JSC18JSCallbackFunctionD1Ev
+_JSValueToStringCopy
+_JSStringCopyCFString
+__ZN3JSC18ConstStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC13ConstDeclNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC13ConstDeclNode14emitCodeSingleERNS_17BytecodeGeneratorE
+__ZN3JSC13ConstDeclNodeD0Ev
+__ZN3JSC18ConstStatementNodeD0Ev
+__ZN3JSC18BooleanConstructor16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL31constructWithBooleanConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC16constructBooleanEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSCL31dateProtoFuncGetUTCMillisecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL28dateProtoFuncGetMilliSecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL31dateProtoFuncToLocaleTimeStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL21regExpObjectLastIndexEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSC21DebuggerStatementNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC21DebuggerStatementNodeD0Ev
+__ZN3JSC4Yarr12RegexPattern21newlineCharacterClassEv
+__ZN3JSC17ObjectConstructor11getCallDataERNS_8CallDataE
+__ZN3JSCL23dateProtoFuncSetUTCDateEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL26stringFromCharCodeSlowCaseEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSCL21callObjectConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL27objectProtoFuncDefineGetterEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JSObject12defineGetterEPNS_9ExecStateERKNS_10IdentifierEPS0_
+__ZN3JSC12GetterSetter4markEv
+__ZN3JSC12GetterSetterD1Ev
+__ZN3JSCL22regExpProtoFuncCompileEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC17NumberConstructor9classInfoEv
+__ZNK3JSC17RegExpConstructor9classInfoEv
+__ZN3JSCL31dateProtoFuncToLocaleDateStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC8JSObject14isGlobalObjectEv
+_JSValueToBoolean
+__ZN3JSC8JITStubs13cti_op_lshiftEPPv
+__ZN3JSC8JITStubs13cti_op_bitnotEPPv
+__ZN3JSC6JSCell3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC19FunctionConstructor11getCallDataERNS_8CallDataE
+__ZN3WTF9ByteArray6createEm
+__ZNK3JSC6JSCell9getStringERNS_7UStringE
+__ZN3JSC3JIT12emit_op_loopEPNS_11InstructionE
+__ZN3JSC10throwErrorEPNS_9ExecStateENS_9ErrorTypeE
+__ZN3JSC11JSByteArrayC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS3_9ByteArrayEPKNS_9ClassInfoE
+__ZN3JSC11JSByteArrayC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEEPNS3_9ByteArrayEPKNS_9ClassInfoE
+__ZN3JSC11JSByteArray18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC11JSByteArray3putEPNS_9ExecStateEjNS_7JSValueE
+__ZN3JSC11JSByteArray3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC11JSByteArray18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZN3JSC8JITStubs28cti_op_get_by_val_byte_arrayEPPv
+__ZN3JSC8JITStubs28cti_op_put_by_val_byte_arrayEPPv
+__ZL30makeGetterOrSetterPropertyNodePvRKN3JSC10IdentifierES3_PNS0_13ParameterNodeEPNS0_16FunctionBodyNodeERKNS0_10SourceCodeE
+__ZN3JSC17BytecodeGenerator13emitPutGetterEPNS_10RegisterIDERKNS_10IdentifierES2_
+__ZN3JSC17BytecodeGenerator13emitPutSetterEPNS_10RegisterIDERKNS_10IdentifierES2_
+__ZN3JSC3JIT18emit_op_put_getterEPNS_11InstructionE
+__ZN3JSC3JIT18emit_op_put_setterEPNS_11InstructionE
+__ZN3JSC8JITStubs17cti_op_put_getterEPPv
+__ZN3JSC8JITStubs17cti_op_put_setterEPPv
+__ZN3JSC8JSObject12defineSetterEPNS_9ExecStateERKNS_10IdentifierEPS0_
+__ZNK3JSC12GetterSetter14isGetterSetterEv
+__ZNK3JSC6JSCell14isGetterSetterEv
+__ZN3JSCL29regExpConstructorRightContextEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSC5Lexer19copyCodeWithoutBOMsEv
+__ZN3JSC13JSNotAnObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC6JSCell16getConstructDataERNS_13ConstructDataE
+__ZN3JSC26createNotAConstructorErrorEPNS_9ExecStateENS_7JSValueEjPNS_9CodeBlockE
+__ZN3JSC15isStrWhiteSpaceEt
+__ZN3JSC10throwErrorEPNS_9ExecStateENS_9ErrorTypeEPKc
+__ZNK3JSC22NativeErrorConstructor9classInfoEv
+__ZNK3JSC16JSCallbackObjectINS_8JSObjectEE9classNameEv
+__ZN3JSC4Heap11objectCountEv
+__ZNK3JSC12SmallStrings5countEv
+__ZN3JSC14JSGlobalObject12defineGetterEPNS_9ExecStateERKNS_10IdentifierEPNS_8JSObjectE
+__ZN3JSCL27objectProtoFuncLookupGetterEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JSObject12lookupGetterEPNS_9ExecStateERKNS_10IdentifierE
+__ZN3JSCL27objectProtoFuncDefineSetterEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC14JSGlobalObject12defineSetterEPNS_9ExecStateERKNS_10IdentifierEPNS_8JSObjectE
+__ZN3JSC9Structure22getterSetterTransitionEPS0_
+__ZN3JSC8JSObject22fillGetterPropertySlotERNS_12PropertySlotEPNS_7JSValueE
+__ZN3JSC12PropertySlot14functionGetterEPNS_9ExecStateERKNS_10IdentifierERKS0_
+__ZN3JSCL28objectProtoFuncIsPrototypeOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC12StringObjectC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_9StructureEEERKNS_7UStringE
+__ZNK3JSC7UString6is8BitEv
+__ZN3JSC8JSObject15unwrappedObjectEv
+__ZN3JSC22NativeErrorConstructor11getCallDataERNS_8CallDataE
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEE11getCallDataERNS_8CallDataE
+__ZN3JSC17BytecodeGenerator21emitComplexJumpScopesEPNS_5LabelEPNS_18ControlFlowContextES4_
+__ZN3JSC23ThrowableExpressionData14emitThrowErrorERNS_17BytecodeGeneratorENS_9ErrorTypeEPKc
+__ZN3JSC17BytecodeGenerator12emitNewErrorEPNS_10RegisterIDENS_9ErrorTypeENS_7JSValueE
+__ZN3JSC3JIT17emit_op_new_errorEPNS_11InstructionE
+__ZN3JSC23MacroAssemblerX86Common8branch16ENS0_9ConditionENS_22AbstractMacroAssemblerINS_12X86AssemblerEE9BaseIndexENS4_5Imm32E
+_JSStringRetain
+__ZN3JSCL19arrayProtoFuncEveryEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL20arrayProtoFuncReduceEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL25arrayProtoFuncReduceRightEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL28arrayProtoFuncToLocaleStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL25arrayProtoFuncLastIndexOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC15AssignErrorNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC8JITStubs16cti_op_new_errorEPPv
+__ZN3JSC15AssignErrorNodeD0Ev
+__ZN3JSC17BytecodeGenerator18emitUnexpectedLoadEPNS_10RegisterIDEd
+__ZN3JSC19JSStaticScopeObject3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC9ExecState9dateTableEPS0_
+__ZNK3JSC15RegExpPrototype9classInfoEv
+__ZN3JSC12StringObject14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
+__ZN3JSCL25dateProtoFuncToDateStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL25dateProtoFuncToTimeStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL25numberConstructorNaNValueEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL31dateProtoFuncSetUTCMillisecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL26dateProtoFuncSetUTCSecondsEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL26dateProtoFuncSetUTCMinutesEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL24dateProtoFuncSetUTCMonthEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL23throwStackOverflowErrorEPNS_9ExecStateEPNS_12JSGlobalDataEPvRS4_
+__ZN3JSC24createStackOverflowErrorEPNS_9ExecStateE
+__ZN3JSC15DeleteValueNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC15DeleteValueNodeD0Ev
+__ZN3JSC16PostfixErrorNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC15PrefixErrorNode12emitBytecodeERNS_17BytecodeGeneratorEPNS_10RegisterIDE
+__ZN3JSC16PostfixErrorNodeD0Ev
+__ZN3JSC15PrefixErrorNodeD0Ev
+__ZN3JSC23createInvalidParamErrorEPNS_9ExecStateEPKcNS_7JSValueEjPNS_9CodeBlockE
+__ZNK3JSC15DotAccessorNode17isDotAccessorNodeEv
+__ZNK3JSC14ExpressionNode17isDotAccessorNodeEv
+__ZN3JSC13JSNotAnObject3putEPNS_9ExecStateEjNS_7JSValueE
+__ZN3JSC4Heap24setGCProtectNeedsLockingEv
+__ZN3JSCL23callFunctionConstructorEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZNK3JSC16JSCallbackObjectINS_8JSObjectEE8toStringEPNS_9ExecStateE
+__ZN3JSC8JITStubs17cti_op_instanceofEPPv
+__ZN3JSC17BytecodeGenerator35emitThrowExpressionTooDeepExceptionEv
+__ZN3JSCL25numberConstructorMinValueEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL17mathProtoFuncACosEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL18mathProtoFuncATan2EPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL16mathProtoFuncTanEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL28numberProtoFuncToExponentialEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL26numberProtoFuncToPrecisionEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL12charSequenceEci
+__ZN3JSCL29objectProtoFuncToLocaleStringEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC6JSCell14toThisJSStringEPNS_9ExecStateE
+__ZNK3JSC6JSCell12toThisStringEPNS_9ExecStateE
+__ZN3JSCL27objectProtoFuncLookupSetterEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8JSObject12lookupSetterEPNS_9ExecStateERKNS_10IdentifierE
+__ZNK3JSC16JSVariableObject21getPropertyAttributesEPNS_9ExecStateERKNS_10IdentifierERj
+__ZN3JSC9ExecState22regExpConstructorTableEPS0_
+__ZN3JSCL24regExpConstructorDollar7EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL24regExpConstructorDollar8EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL24regExpConstructorDollar9EPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL22regExpConstructorInputEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL25setRegExpConstructorInputEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueE
+__ZN3JSCL26regExpConstructorLastMatchEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL26regExpConstructorLastParenEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL26regExpConstructorMultilineEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL29setRegExpConstructorMultilineEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueE
+__ZN3JSC4Yarr15nondigitsCreateEv
+__ZNK3JSC19JSStaticScopeObject12toThisObjectEPNS_9ExecStateE
+__ZN3JSC12JSActivation18getArgumentsGetterEv
+__ZN3JSC12JSActivation15argumentsGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSCL23booleanProtoFuncValueOfEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSCL28stringProtoFuncLocaleCompareEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3WTF8Collator11userDefaultEv
+__ZNK3WTF8Collator7collateEPKtmS2_m
+__ZNK3WTF8Collator14createCollatorEv
+__ZN3WTF8CollatorD1Ev
+__ZN3WTF8Collator15releaseCollatorEv
+__ZNK3JSC10MathObject9classInfoEv
+__ZN3JSC9ExecState9mathTableEPS0_
+__ZN3WTF6VectorIN3JSC20FunctionRegisterInfoELm0EE14expandCapacityEm
+__ZN3JSC3JIT25emit_op_profile_will_callEPNS_11InstructionE
+__ZN3JSC3JIT24emit_op_profile_did_callEPNS_11InstructionE
+__ZN3JSC8Profiler8profilerEv
+__ZN3JSC8Profiler14startProfilingEPNS_9ExecStateERKNS_7UStringE
+__ZN3JSC16ProfileGenerator6createERKNS_7UStringEPNS_9ExecStateEj
+__ZN3JSC16ProfileGeneratorC2ERKNS_7UStringEPNS_9ExecStateEj
+__ZN3JSC7Profile6createERKNS_7UStringEj
+__ZN3JSC7ProfileC2ERKNS_7UStringEj
+__ZN3JSC11ProfileNodeC1ERKNS_14CallIdentifierEPS0_S4_
+__ZN3JSC33getCurrentUTCTimeWithMicrosecondsEv
+__ZN3JSC16ProfileGenerator24addParentForConsoleStartEPNS_9ExecStateE
+__ZN3JSC8Profiler20createCallIdentifierEPNS_12JSGlobalDataENS_7JSValueERKNS_7UStringEi
+__ZN3JSC16InternalFunction21calculatedDisplayNameEPNS_12JSGlobalDataE
+__ZN3JSC11ProfileNode10insertNodeEN3WTF10PassRefPtrIS0_EE
+__ZN3WTF6VectorINS_6RefPtrIN3JSC11ProfileNodeEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN3JSC16ProfileGeneratorEEELm0EE14expandCapacityEm
+__ZN3JSC8JITStubs23cti_op_profile_did_callEPPv
+__ZN3JSC8Profiler10didExecuteEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC16ProfileGenerator10didExecuteERKNS_14CallIdentifierE
+__ZN3JSC11ProfileNode10didExecuteEv
+__ZN3JSC8JITStubs24cti_op_profile_will_callEPPv
+__ZN3JSC8Profiler11willExecuteEPNS_9ExecStateENS_7JSValueE
+__ZN3JSC16ProfileGenerator11willExecuteERKNS_14CallIdentifierE
+__ZN3JSC11ProfileNode11willExecuteERKNS_14CallIdentifierE
+__ZN3JSC8Profiler13stopProfilingEPNS_9ExecStateERKNS_7UStringE
+__ZN3JSC16ProfileGenerator13stopProfilingEv
+__ZN3JSC7Profile7forEachEMNS_11ProfileNodeEFvvE
+__ZNK3JSC11ProfileNode25traverseNextNodePostOrderEv
+__ZN3JSC11ProfileNode13stopProfilingEv
+__ZN3JSCeqERKNS_7UStringEPKc
+__ZN3JSC11ProfileNode11removeChildEPS0_
+__ZN3JSC11ProfileNode8addChildEN3WTF10PassRefPtrIS0_EE
+_JSValueIsObjectOfClass
+_JSObjectCallAsConstructor
+__ZN3JSC9constructEPNS_9ExecStateENS_7JSValueENS_13ConstructTypeERKNS_13ConstructDataERKNS_7ArgListE
+_JSObjectCallAsFunction
+__ZN3JSC4Heap14primaryHeapEndEv
+__ZN3JSC4Heap16primaryHeapBeginEv
+__ZNK3JSC18JSCallbackFunction9classInfoEv
+__ZN3JSC8Profiler11willExecuteEPNS_9ExecStateERKNS_7UStringEi
+__ZN3JSC8Profiler10didExecuteEPNS_9ExecStateERKNS_7UStringEi
+__ZNK3JSC16ProfileGenerator5titleEv
+__ZN3JSC7ProfileD0Ev
+__ZN3WTF10RefCountedIN3JSC11ProfileNodeEE5derefEv
+__ZN3JSC4Yarr14RegexGenerator33generatePatternCharacterNonGreedyERNS1_19TermGenerationStateE
+__ZN3JSC35createInterruptedExecutionExceptionEPNS_12JSGlobalDataE
+__ZNK3JSC25InterruptedExecutionError19isWatchdogExceptionEv
+__ZN3JSC25InterruptedExecutionErrorD1Ev
+__ZN3JSC12JSGlobalData10ClientDataD2Ev
+__ZN3JSC18RegExpMatchesArray16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
+__ZN3WTF8CollatorC1EPKc
+__ZN3WTF8Collator18setOrderLowerFirstEb
+__ZN3WTF12randomNumberEv
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEE3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZNK3JSC6JSCell9getStringEv
+__ZNK3JSC12DateInstance7getTimeERdRi
+__ZN3JSC10throwErrorEPNS_9ExecStateENS_9ErrorTypeERKNS_7UStringE
+_JSGlobalContextCreate
+_JSGlobalContextCreateInGroup
+__ZN3JSC4Heap29makeUsableFromMultipleThreadsEv
+_JSGlobalContextRetain
+__ZN3JSC6JSLock6unlockEb
+_JSEvaluateScript
+__ZNK3JSC14JSGlobalObject17supportsProfilingEv
+_JSGlobalContextRelease
+__ZN3JSC14JSGlobalObjectD1Ev
+__ZN3JSC14JSGlobalObject18JSGlobalObjectDataD0Ev
+__ZN3JSC17FunctionPrototype11getCallDataERNS_8CallDataE
+__ZN3JSC15DateConstructor11getCallDataERNS_8CallDataE
+__ZN3JSCL8callDateEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC13JSNotAnObject4markEv
+_JSObjectIsFunction
+__ZN3JSC4Heap17globalObjectCountEv
+__ZN3JSC4Heap20protectedObjectCountEv
+__ZN3JSC4Heap25protectedObjectTypeCountsEv
+__ZN3WTF9HashTableIPKcSt4pairIS2_jENS_18PairFirstExtractorIS4_EENS_7PtrHashIS2_EENS_14PairHashTraitsINS_10HashTraitsIS2_EENSA_I
+__ZN3WTF20fastMallocStatisticsEv
+__ZNK3JSC4Heap10statisticsEv
+__ZN3WTF27releaseFastMallocFreeMemoryEv
+__ZN3JSC10JSFunction16getConstructDataERNS_13ConstructDataE
+__ZN3JSC10JSFunction9constructEPNS_9ExecStateERKNS_7ArgListE
+__ZN3JSC8Debugger6attachEPNS_14JSGlobalObjectE
+__ZN3WTF7HashSetIPN3JSC14JSGlobalObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN3JSC14JSGlobalObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3JSC3JIT13emit_op_debugEPNS_11InstructionE
+__ZN3JSC8JITStubs12cti_op_debugEPPv
+__ZN3JSC11Interpreter5debugEPNS_9ExecStateENS_11DebugHookIDEii
+__ZN3JSC8Debugger6detachEPNS_14JSGlobalObjectE
+__ZN3JSC9CodeBlock33functionRegisterForBytecodeOffsetEjRi
+_JSStringIsEqualToUTF8CString
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEE14callbackGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
 _JSObjectSetPrivate
-__ZN3KJS15GetterSetterImpD0Ev
-__ZN3KJS27objectProtoFuncLookupGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS17PreIncResolveNode10precedenceEv
-__ZNK3KJS10SwitchNode8streamToERNS_12SourceStreamE
-__ZNK3KJS13CaseBlockNode8streamToERNS_12SourceStreamE
-__ZNK3KJS14CaseClauseNode8streamToERNS_12SourceStreamE
-__ZN3KJS18ConstStatementNodeD1Ev
-__ZN3KJS17PreDecBracketNodeD1Ev
-__ZN3KJS11Interpreter24setShouldPrintExceptionsEb
-__ZN3KJS9Collector26protectedGlobalObjectCountEv
-__ZN3KJS9Collector4sizeEv
-__ZN3KJS9Collector17globalObjectCountEv
-__ZN3KJS9Collector20protectedObjectCountEv
-__ZN3KJS9Collector25protectedObjectTypeCountsEv
-__ZNK3KJS15NumberObjectImp9classInfoEv
-__ZNK3KJS15RegExpPrototype9classInfoEv
-__ZNK3KJS15RegExpObjectImp9classInfoEv
-__ZNK3KJS14NativeErrorImp9classInfoEv
-__ZNK3KJS13MathObjectImp9classInfoEv
-__ZN3WTF6VectorIPN3KJS7JSValueELm8EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN3KJS7JSValueELm8EE14expandCapacityEm
-__ZN3KJS15ConditionalNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS9Arguments14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZNK3KJS17DeleteBracketNode8streamToERNS_12SourceStreamE
-__ZNK3KJS9BitOrNode10precedenceEv
-__ZNK3KJS9BitOrNode8streamToERNS_12SourceStreamE
-__ZNK3KJS7ModNode10precedenceEv
-__ZNK3KJS7ModNode8streamToERNS_12SourceStreamE
-__ZN3KJS31dateProtoFuncToLocaleTimeStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS16formatLocaleDateEPNS_9ExecStateEdbbRKNS_4ListE
-__ZN3KJS31dateProtoFuncToLocaleDateStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS9BitOrNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS7DivNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS14BitwiseNotNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS13ActivationImp14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
-__ZN3KJS27objectProtoFuncDefineGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS17PreDecBracketNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS16BooleanObjectImp19implementsConstructEv
-__ZN3KJS27objectProtoFuncDefineSetterEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS8JSObject22fillGetterPropertySlotERNS_12PropertySlotEPPNS_7JSValueE
-__ZN3KJS10StringNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS13UnaryPlusNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS31dateProtoFuncGetUTCMillisecondsEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS17FunctionObjectImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS15DeleteValueNodeD1Ev
-__ZN3KJS15RegExpObjectImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS22dateProtoFuncGetUTCDayEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS8MultNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS4Node18setErrorCompletionEPNS_9ExecStateENS_9ErrorTypeEPKc
-__ZN3KJS10StringNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS27dateProtoFuncToLocaleStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS22UnsignedRightShiftNode16evaluateToNumberEPNS_9ExecStateE
-__ZNK3KJS18PostIncResolveNode10precedenceEv
-__ZNK3KJS21ReadModifyResolveNode10precedenceEv
-__ZNK3KJS21FunctionCallValueNode10precedenceEv
-__ZN3KJS4Node15handleExceptionEPNS_9ExecStateE
-__ZNK3KJS13UnaryPlusNode10precedenceEv
-__ZNK3KJS13UnaryPlusNode8streamToERNS_12SourceStreamE
-__ZN3KJS4Node10throwErrorEPNS_9ExecStateENS_9ErrorTypeEPKcPNS_7JSValueERKNS_10IdentifierE
-__ZNK3KJS15DotAccessorNode17isDotAccessorNodeEv
-__ZNK3KJS14PostfixDotNode10precedenceEv
-__ZN3KJS23regExpProtoFuncToStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS14PostDecDotNode8streamToERNS_12SourceStreamE
-__ZNK3KJS9CommaNode10precedenceEv
-__ZNK3KJS17ReadModifyDotNode10precedenceEv
-__ZNK3KJS13DeleteDotNode8streamToERNS_12SourceStreamE
-__ZNK3KJS19PlaceholderTrueNode8streamToERNS_12SourceStreamE
-__ZNK3KJS17AssignBracketNode10precedenceEv
-__ZNK3KJS8WithNode8streamToERNS_12SourceStreamE
-__ZNK3KJS17DeleteBracketNode10precedenceEv
-__ZN3KJS15ObjectObjectImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-_KJS_JSCreateNativeJSObject
-__ZN3KJS8Bindings12JavaJSObject6invokeEPNS0_19JSObjectCallContextE
-__ZN3KJS8Bindings12JavaJSObject12createNativeEx
-__ZN3KJS8Bindings24findProtectingRootObjectEPNS_8JSObjectE
-_KJS_JSObject_JSObjectEval
-__ZN3KJS8Bindings12JavaJSObjectC1Ex
-__ZNK3KJS8Bindings12JavaJSObject4evalEP8_jstring
-__ZN3KJS8Bindings9getJNIEnvEv
-__ZN3KJS8Bindings9getJavaVMEv
-__ZN3KJS8Bindings30getUCharactersFromJStringInEnvEP7JNIEnv_P8_jstring
-__ZN3KJS8Bindings33releaseUCharactersForJStringInEnvEP7JNIEnv_P8_jstringPKt
-__ZNK3KJS8Bindings12JavaJSObject21convertValueToJObjectEPNS_7JSValueE
-__ZN7JNIEnv_9NewObjectEP7_jclassP10_jmethodIDz
-_KJS_JSObject_JSFinalize
-__ZN3KJS19stringProtoFuncBoldEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS15RegExpObjectImp15getRightContextEv
-__ZNK3KJS15RegExpObjectImp14getLeftContextEv
-__ZN3KJS13LeftShiftNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS7ModNode15evaluateToInt32EPNS_9ExecStateE
-__ZNK3KJS18PostDecResolveNode10precedenceEv
-__ZN3KJS28dateProtoFuncSetMilliSecondsEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS32stringProtoFuncToLocaleLowerCaseEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__NPN_SetException
-__ZN3KJS18mathProtoFuncATan2EPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS8Bindings12JavaInstanceC2EP8_jobjectN3WTF10PassRefPtrINS0_10RootObjectEEE
-__ZN3KJS8Bindings12JavaInstance5beginEv
-__ZNK3KJS8Bindings12JavaInstance8getClassEv
-__ZN3KJS8Bindings9JavaClassC2EP8_jobject
-__ZN3KJS8Bindings19callJNIObjectMethodEP8_jobjectPKcS4_z
-__ZN3KJS8Bindings13callJNIMethodE7JNITypeP8_jobjectPKcS5_Pc
-__ZN3KJS8Bindings24getCharactersFromJStringEP8_jstring
-__ZN3KJS8Bindings27releaseCharactersForJStringEP8_jstringPKc
-__ZN3KJS8Bindings9JavaFieldC2EP7JNIEnv_P8_jobject
-__ZN3KJS7CStringaSERKS0_
-__ZN3KJS8Bindings20JNITypeFromClassNameEPKc
-__ZN3KJS8Bindings14JObjectWrapperC1EP8_jobject
-__ZNK3KJS8Bindings9JavaField4nameEv
-__ZN3KJS8Bindings10JavaMethodC2EP7JNIEnv_P8_jobject
-__ZN3KJS8Bindings16callJNIIntMethodEP8_jobjectPKcS4_z
-__ZN3KJS8Bindings26callJNIStaticBooleanMethodEP7_jclassPKcS4_z
-__ZN3KJS8Bindings19callJNIStaticMethodE7JNITypeP7_jclassPKcS5_Pc
-__ZNK3KJS8Bindings10JavaMethod4nameEv
-__ZN3KJS8Bindings13JavaParameterC2EP7JNIEnv_P8_jstring
-__ZNK3KJS8Bindings9JavaClass10fieldNamedERKNS_10IdentifierEPNS0_8InstanceE
-__ZNK3KJS8Bindings9JavaClass12methodsNamedERKNS_10IdentifierEPNS0_8InstanceE
-__ZN3KJS8Bindings12JavaInstance3endEv
-__ZN3KJS8Bindings12JavaInstanceD1Ev
-__ZN3KJS8Bindings9JavaClassD1Ev
-__ZN3WTF20deleteAllPairSecondsIPN3KJS8Bindings5FieldEKNS_7HashMapINS_6RefPtrINS1_7UString3RepEEES4_NS_7PtrHashIS9_EENS_10HashTraitsIS9_EENSC_IS4_EEEEEEvRT0_
-__ZN3KJS8Bindings14JObjectWrapperD1Ev
-__ZN3KJS35objectProtoFuncPropertyIsEnumerableEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS31dateProtoFuncSetUTCMillisecondsEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS12FuncExprNode21needsParensIfLeftmostEv
-__ZN3KJS13DateObjectImp14callAsFunctionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS11NewExprNode17evaluateToBooleanEPNS_9ExecStateE
-__ZN3KJS29numberProtoFuncToLocaleStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS25dateProtoFuncToDateStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS9BitOrNode16evaluateToNumberEPNS_9ExecStateE
-__ZNK3KJS7JSValue8toUInt32EPNS_9ExecStateE
-__ZNK3KJS8JSObject3getEPNS_9ExecStateEj
-__ZNK3KJS7JSValue16toUInt32SlowCaseEPNS_9ExecStateERb
-__ZN3KJS9Collector29markOtherThreadConservativelyEPNS0_6ThreadE
-__ZN3WTF20TCMalloc_ThreadCache18DestroyThreadCacheEPv
-__ZN3WTF20TCMalloc_ThreadCache11DeleteCacheEPS0_
-__ZN3KJS23destroyRegisteredThreadEPv
-__ZN3KJS28numberProtoFuncToExponentialEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS26numberProtoFuncToPrecisionEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS15RegExpObjectImp16putValuePropertyEPNS_9ExecStateEiPNS_7JSValueEi
-__ZNK3KJS15RegExpObjectImp12getLastParenEv
-__ZN3KJS10throwErrorEPNS_9ExecStateENS_9ErrorTypeE
-__ZN3KJS18arrayProtoFuncSomeEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS9LabelNode9pushLabelERKNS_10IdentifierE
-__ZN3KJS9Collector32reportOutOfMemoryToAllExecStatesEv
-__ZN3KJS5Error6createEPNS_9ExecStateENS_9ErrorTypeEPKc
-__ZNK3KJS17PreDecResolveNode10precedenceEv
-__ZN3KJS17mathProtoFuncACosEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS16mathProtoFuncTanEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS16PostfixErrorNode8streamToERNS_12SourceStreamE
-__ZNK3KJS15PrefixErrorNode8streamToERNS_12SourceStreamE
-__ZNK3KJS15AssignErrorNode8streamToERNS_12SourceStreamE
-__ZN3KJS16PostfixErrorNode8evaluateEPNS_9ExecStateE
-__ZN3KJS4Node10throwErrorEPNS_9ExecStateENS_9ErrorTypeEPKcS5_
-__ZN3KJS16PostfixErrorNodeD1Ev
-__ZNK3KJS13LeftShiftNode8streamToERNS_12SourceStreamE
-__ZNK3KJS13LeftShiftNode10precedenceEv
-__ZNK3KJS14RightShiftNode8streamToERNS_12SourceStreamE
-__ZNK3KJS14RightShiftNode10precedenceEv
-__ZNK3KJS22UnsignedRightShiftNode8streamToERNS_12SourceStreamE
-__ZNK3KJS22UnsignedRightShiftNode10precedenceEv
-__ZNK3KJS10BitAndNode8streamToERNS_12SourceStreamE
-__ZNK3KJS10BitAndNode10precedenceEv
-__ZNK3KJS10BitXOrNode8streamToERNS_12SourceStreamE
-__ZNK3KJS10BitXOrNode10precedenceEv
-__ZN3KJS15AssignErrorNode8evaluateEPNS_9ExecStateE
-__ZN3KJS4Node10throwErrorEPNS_9ExecStateENS_9ErrorTypeEPKc
-__ZN3KJS13char_sequenceEci
-__ZN3KJS15LessStringsNode8evaluateEPNS_9ExecStateE
-__ZN3KJS15LessStringsNodeD1Ev
-__ZN3KJS15DeleteValueNode8evaluateEPNS_9ExecStateE
-__ZN3KJS22regExpProtoFuncCompileEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS15PrefixErrorNode8evaluateEPNS_9ExecStateE
-__ZN3KJS28objectProtoFuncIsPrototypeOfEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS15PrefixErrorNodeD1Ev
-__ZN3KJS19arrayProtoFuncEveryEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS29objectProtoFuncToLocaleStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS25arrayProtoFuncLastIndexOfEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3WTF6VectorItLm0EE6resizeEm
-__ZN3WTF6VectorItLm0EE14expandCapacityEm
-__ZN3WTF6VectorItLm0EE15reserveCapacityEm
-__ZN3KJS28arrayProtoFuncToLocaleStringEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS18ConstStatementNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS13ConstDeclNode22optimizeVariableAccessERKN3WTF7HashMapINS1_6RefPtrINS_7UString3RepEEEmNS_17IdentifierRepHashENS_23IdentifierRepHashTraitsENS_26SymbolTableIndexHashTraitsEEERKNS1_6VectorINS_17LocalStorageEntryELm32EEERNSD_IPNS_4NodeELm16EEE
-__ZN3KJS18ConstStatementNode7executeEPNS_9ExecStateE
-__ZN3KJS13ConstDeclNode8evaluateEPNS_9ExecStateE
-__ZN3KJS15AssignConstNode8evaluateEPNS_9ExecStateE
-__ZN3KJS16PostIncConstNode8evaluateEPNS_9ExecStateE
-__ZN3KJS16PostDecConstNode8evaluateEPNS_9ExecStateE
-__ZN3KJS15PreIncConstNode8evaluateEPNS_9ExecStateE
-__ZN3KJS15PreDecConstNode8evaluateEPNS_9ExecStateE
-__ZN3KJS19ReadModifyConstNode8evaluateEPNS_9ExecStateE
-__ZNK3KJS13ActivationImp9classInfoEv
-__ZN3KJS16PostIncConstNodeD1Ev
-__ZN3KJS15PreIncConstNodeD1Ev
-__ZN3KJS15PreDecConstNodeD1Ev
-__ZNK3KJS13DeleteDotNode10precedenceEv
-__ZN3KJS28stringProtoFuncLocaleCompareEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS10NumberNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS19FunctionCallDotNode16evaluateToUInt32EPNS_9ExecStateE
-__ZNK3KJS21ReadModifyBracketNode8streamToERNS_12SourceStreamE
-__ZN3KJS10BitXOrNode16evaluateToNumberEPNS_9ExecStateE
-___tcf_1
-__ZNK3KJS7UString6is8BitEv
-__ZN3KJS15DotAccessorNode16evaluateToUInt32EPNS_9ExecStateE
-__ZN3KJS24stringProtoFuncFontcolorEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS14NativeErrorImp19implementsConstructEv
-__ZN3KJS19PostDecLocalVarNode16evaluateToNumberEPNS_9ExecStateE
-__ZN3KJS19PostDecLocalVarNode15evaluateToInt32EPNS_9ExecStateE
-__ZN3KJS13UnaryPlusNode17evaluateToBooleanEPNS_9ExecStateE
+__ZN3JSC7UString3Rep11computeHashEPKci
+__ZN3JSC16JSCallbackObjectINS_8JSObjectEE14deletePropertyEPNS_9ExecStateERKNS_10IdentifierE
+_JSGarbageCollect
+__ZN3JSC4Heap6isBusyEv
+__ZN3JSCL18styleFromArgStringERKNS_7UStringEl
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
index dca9355..dbc467d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pri
@@ -1,30 +1,68 @@
 # JavaScriptCore - Qt4 build info
 VPATH += $$PWD
 
-INCLUDEPATH += tmp
-INCLUDEPATH += $$PWD $$PWD/parser $$PWD/bytecompiler $$PWD/debugger $$PWD/runtime $$PWD/wtf $$PWD/wtf/unicode $$PWD/interpreter $$PWD/jit $$PWD/profiler $$PWD/wrec $$PWD/API $$PWD/.. \
-               $$PWD/ForwardingHeaders $$PWD/bytecode $$PWD/assembler
-DEFINES += BUILDING_QT__
+CONFIG(debug, debug|release) {
+    isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}debug
+    OBJECTS_DIR = obj/debug
+} else { # Release
+    isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}release
+    OBJECTS_DIR = obj/release
+}
+
+INCLUDEPATH += $$GENERATED_SOURCES_DIR \
+               $$PWD \
+               $$PWD/parser \
+               $$PWD/bytecompiler \
+               $$PWD/debugger \
+               $$PWD/runtime \
+               $$PWD/wtf \
+               $$PWD/wtf/unicode \
+               $$PWD/interpreter \
+               $$PWD/jit \
+               $$PWD/profiler \
+               $$PWD/wrec \
+               $$PWD/yarr \
+               $$PWD/API \
+               $$PWD/.. \
+               $$PWD/ForwardingHeaders \
+               $$PWD/bytecode \
+               $$PWD/assembler \
 
-isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = tmp
-GENERATED_SOURCES_DIR_SLASH = $$GENERATED_SOURCES_DIR/
+DEFINES += BUILDING_QT__ BUILDING_JavaScriptCore BUILDING_WTF
+
+GENERATED_SOURCES_DIR_SLASH = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}
 win32-* {
-    GENERATED_SOURCES_DIR_SLASH ~= s|/|\|
     LIBS += -lwinmm
 }
 
-# Disable the JIT due to numerous observed miscompilations :(
-CONFIG(release):isEqual(QT_ARCH,i386) {
-     JIT_DEFINES = ENABLE_JIT ENABLE_WREC ENABLE_JIT_OPTIMIZE_CALL ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS ENABLE_JIT_OPTIMIZE_ARITHMETIC
-     # Require gcc >= 4.1
-     linux-g++*:greaterThan(QT_GCC_MAJOR_VERSION,3):greaterThan(QT_GCC_MINOR_VERSION,0) {
-         DEFINES += $$JIT_DEFINES WTF_USE_JIT_STUB_ARGUMENT_VA_LIST
-         QMAKE_CXXFLAGS += -fno-stack-protector
-         QMAKE_CFLAGS += -fno-stack-protector
-     }
-     win32-msvc* {
-         DEFINES += $$JIT_DEFINES WTF_USE_JIT_STUB_ARGUMENT_REGISTER
-     }
+# Default rules to turn JIT on/off
+!contains(DEFINES, ENABLE_JIT=.) {
+    isEqual(QT_ARCH,i386)|isEqual(QT_ARCH,windows) {
+        # Require gcc >= 4.1
+        CONFIG(release):linux-g++*:greaterThan(QT_GCC_MAJOR_VERSION,3):greaterThan(QT_GCC_MINOR_VERSION,0) {
+            DEFINES += ENABLE_JIT=1
+        }
+        win32-msvc* {
+            DEFINES += ENABLE_JIT=1
+        }
+    }
+}
+
+# Rules when JIT enabled
+contains(DEFINES, ENABLE_JIT=1) {
+    !contains(DEFINES, ENABLE_YARR=.): DEFINES += ENABLE_YARR=1
+    !contains(DEFINES, ENABLE_YARR_JIT=.): DEFINES += ENABLE_YARR_JIT=1
+    !contains(DEFINES, ENABLE_JIT_OPTIMIZE_CALL=.): DEFINES += ENABLE_JIT_OPTIMIZE_CALL=1
+    !contains(DEFINES, ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS=.): DEFINES += ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS=1
+    !contains(DEFINES, ENABLE_JIT_OPTIMIZE_ARITHMETIC=.): DEFINES += ENABLE_JIT_OPTIMIZE_ARITHMETIC=1
+    linux-g++* {
+        !contains(DEFINES, WTF_USE_JIT_STUB_ARGUMENT_VA_LIST=.): DEFINES += WTF_USE_JIT_STUB_ARGUMENT_VA_LIST=1
+        QMAKE_CXXFLAGS += -fno-stack-protector
+        QMAKE_CFLAGS += -fno-stack-protector
+    }
+    win32-msvc* {
+        !contains(DEFINES, WTF_USE_JIT_STUB_ARGUMENT_REGISTER=.): DEFINES += WTF_USE_JIT_STUB_ARGUMENT_REGISTER=1
+    }
 }
 
 win32-msvc*: INCLUDEPATH += $$PWD/os-win32
@@ -38,6 +76,7 @@ include(pcre/pcre.pri)
 
 LUT_FILES += \
     runtime/DatePrototype.cpp \
+    runtime/JSONObject.cpp \
     runtime/NumberConstructor.cpp \
     runtime/StringPrototype.cpp \
     runtime/ArrayPrototype.cpp \
@@ -53,10 +92,12 @@ JSCBISON += \
 
 SOURCES += \
     wtf/Assertions.cpp \
+    wtf/ByteArray.cpp \
     wtf/HashTable.cpp \
     wtf/MainThread.cpp \
     wtf/RandomNumber.cpp \
     wtf/RefCountedLeakCounter.cpp \
+    wtf/TypeTraits.cpp \
     wtf/unicode/CollatorDefault.cpp \
     wtf/unicode/icu/CollatorICU.cpp \
     wtf/unicode/UTF8.cpp \
@@ -77,26 +118,28 @@ SOURCES += \
     runtime/JSVariableObject.cpp \
     runtime/JSActivation.cpp \
     runtime/JSNotAnObject.cpp \
+    runtime/JSONObject.cpp \
+    runtime/LiteralParser.cpp \
+    runtime/TimeoutChecker.cpp \
     bytecode/CodeBlock.cpp \
     bytecode/StructureStubInfo.cpp \
     bytecode/JumpTable.cpp \
     jit/JIT.cpp \
     jit/JITCall.cpp \
     jit/JITArithmetic.cpp \
+    jit/JITOpcodes.cpp \
     jit/JITPropertyAccess.cpp \
     jit/ExecutableAllocator.cpp \
+    jit/JITStubs.cpp \
     bytecompiler/BytecodeGenerator.cpp \
     runtime/ExceptionHelpers.cpp \
     runtime/JSPropertyNameIterator.cpp \
     interpreter/Interpreter.cpp \
     bytecode/Opcode.cpp \
     bytecode/SamplingTool.cpp \
-    wrec/CharacterClass.cpp \
-    wrec/CharacterClassConstructor.cpp \
-    wrec/WREC.cpp \
-    wrec/WRECFunctors.cpp \
-    wrec/WRECGenerator.cpp \
-    wrec/WRECParser.cpp \
+    yarr/RegexCompiler.cpp \
+    yarr/RegexInterpreter.cpp \
+    yarr/RegexJIT.cpp \
     interpreter/RegisterFile.cpp
 
 win32-*: SOURCES += jit/ExecutableAllocatorWin.cpp
@@ -112,17 +155,18 @@ SOURCES += \
     runtime/BooleanConstructor.cpp \
     runtime/BooleanObject.cpp \
     runtime/BooleanPrototype.cpp \
-    runtime/ByteArray.cpp \
     runtime/CallData.cpp \
     runtime/Collector.cpp \
     runtime/CommonIdentifiers.cpp \
     runtime/ConstructData.cpp \
+    wtf/CurrentTime.cpp \
     runtime/DateConstructor.cpp \
+    runtime/DateConversion.cpp \
     runtime/DateInstance.cpp \
-    runtime/DateMath.cpp \
     runtime/DatePrototype.cpp \
     debugger/Debugger.cpp \
     debugger/DebuggerCallFrame.cpp \
+    debugger/DebuggerActivation.cpp \
     wtf/dtoa.cpp \
     runtime/Error.cpp \
     runtime/ErrorConstructor.cpp \
@@ -161,6 +205,7 @@ SOURCES += \
     runtime/ObjectPrototype.cpp \
     runtime/Operations.cpp \
     parser/Parser.cpp \
+    parser/ParserArena.cpp \
     runtime/PropertyNameArray.cpp \
     runtime/PropertySlot.cpp \
     runtime/PrototypeFunction.cpp \
@@ -182,13 +227,20 @@ SOURCES += \
     profiler/ProfileNode.cpp \
     profiler/Profiler.cpp \
     profiler/TreeProfile.cpp \
+    wtf/DateMath.cpp \
     wtf/FastMalloc.cpp \
     wtf/Threading.cpp \
-    wtf/ThreadingQt.cpp \
     wtf/qt/MainThreadQt.cpp
 
+!contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
+    SOURCES += wtf/qt/ThreadingQt.cpp
+} else {
+    DEFINES += ENABLE_JSC_MULTIPLE_THREADS=0
+    SOURCES += wtf/ThreadingNone.cpp
+}
+
 # GENERATOR 1-A: LUT creator
-lut.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.lut.h
+lut.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.lut.h
 lut.commands = perl $$PWD/create_hash_table ${QMAKE_FILE_NAME} -i > ${QMAKE_FILE_OUT}
 lut.depend = ${QMAKE_FILE_NAME}
 lut.input = LUT_FILES
@@ -196,7 +248,7 @@ lut.CONFIG += no_link
 addExtraCompiler(lut)
 
 # GENERATOR 1-B: particular LUT creator (for 1 file only)
-keywordlut.output = $$GENERATED_SOURCES_DIR/Lexer.lut.h
+keywordlut.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}Lexer.lut.h
 keywordlut.commands = perl $$PWD/create_hash_table ${QMAKE_FILE_NAME} -i > ${QMAKE_FILE_OUT}
 keywordlut.depend = ${QMAKE_FILE_NAME}
 keywordlut.input = KEYWORDLUT_FILES
@@ -204,8 +256,8 @@ keywordlut.CONFIG += no_link
 addExtraCompiler(keywordlut)
 
 # GENERATOR 2: bison grammar
-jscbison.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp
-jscbison.commands = bison -d -p jscyy ${QMAKE_FILE_NAME} -o ${QMAKE_FILE_BASE}.tab.c && $(MOVE) ${QMAKE_FILE_BASE}.tab.c ${QMAKE_FILE_OUT} && $(MOVE) ${QMAKE_FILE_BASE}.tab.h $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.h
+jscbison.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
+jscbison.commands = bison -d -p jscyy ${QMAKE_FILE_NAME} -o $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c ${QMAKE_FILE_OUT} && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.h $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.h
 jscbison.depend = ${QMAKE_FILE_NAME}
 jscbison.input = JSCBISON
 jscbison.variable_out = GENERATED_SOURCES
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
index 56dae05..28f0e6b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCore.pro
@@ -21,13 +21,16 @@ CONFIG(QTDIR_build) {
 }
 
 isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = tmp
-GENERATED_SOURCES_DIR_SLASH = $$GENERATED_SOURCES_DIR/
-win32-*: GENERATED_SOURCES_DIR_SLASH ~= s|/|\|
+GENERATED_SOURCES_DIR_SLASH = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}
 
 INCLUDEPATH += $$GENERATED_SOURCES_DIR
 
 !CONFIG(QTDIR_build) {
-     OBJECTS_DIR = tmp
+    CONFIG(debug, debug|release) {
+        OBJECTS_DIR = obj/debug
+    } else { # Release
+        OBJECTS_DIR = obj/release
+    }
 }
 
 include($$OUTPUT_DIR/config.pri)
@@ -64,7 +67,7 @@ include(JavaScriptCore.pri)
 
 QMAKE_EXTRA_TARGETS += generated_files
 
-qt-port: lessThan(QT_MINOR_VERSION, 4) {
+lessThan(QT_MINOR_VERSION, 4) {
     DEFINES += QT_BEGIN_NAMESPACE="" QT_END_NAMESPACE=""
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCorePrefix.h b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCorePrefix.h
index e71c8a8..13b21bb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/JavaScriptCorePrefix.h
+++ b/src/3rdparty/webkit/JavaScriptCore/JavaScriptCorePrefix.h
@@ -25,15 +25,6 @@
 
 #endif
 
-#if defined(__APPLE__)
-#import <AvailabilityMacros.h>
-#if MAC_OS_X_VERSION_MAX_ALLOWED <= MAC_OS_X_VERSION_10_4
-#define BUILDING_ON_TIGER 1
-#elif MAC_OS_X_VERSION_MAX_ALLOWED <= MAC_OS_X_VERSION_10_5
-#define BUILDING_ON_LEOPARD 1
-#endif
-#endif
-
 #ifdef __cplusplus
 #define new ("if you use new/delete make sure to include config.h at the top of the file"()) 
 #define delete ("if you use new/delete make sure to include config.h at the top of the file"()) 
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h
new file mode 100644
index 0000000..9745d6d
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/ARMv7Assembler.h
@@ -0,0 +1,1758 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ARMAssembler_h
+#define ARMAssembler_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(ASSEMBLER) && PLATFORM_ARM_ARCH(7)
+
+#include "AssemblerBuffer.h"
+#include <wtf/Assertions.h>
+#include <wtf/Vector.h>
+#include <stdint.h>
+
+namespace JSC {
+
+namespace ARM {
+    typedef enum {
+        r0,
+        r1,
+        r2,
+        r3,
+        r4,
+        r5,
+        r6,
+        r7, wr = r7,   // thumb work register
+        r8,
+        r9, sb = r9,   // static base
+        r10, sl = r10, // stack limit
+        r11, fp = r11, // frame pointer
+        r12, ip = r12,
+        r13, sp = r13,
+        r14, lr = r14,
+        r15, pc = r15,
+    } RegisterID;
+
+    // s0 == d0 == q0
+    // s4 == d2 == q1
+    // etc
+    typedef enum {
+        s0 = 0,
+        s1 = 1,
+        s2 = 2,
+        s3 = 3,
+        s4 = 4,
+        s5 = 5,
+        s6 = 6,
+        s7 = 7,
+        s8 = 8,
+        s9 = 9,
+        s10 = 10,
+        s11 = 11,
+        s12 = 12,
+        s13 = 13,
+        s14 = 14,
+        s15 = 15,
+        s16 = 16,
+        s17 = 17,
+        s18 = 18,
+        s19 = 19,
+        s20 = 20,
+        s21 = 21,
+        s22 = 22,
+        s23 = 23,
+        s24 = 24,
+        s25 = 25,
+        s26 = 26,
+        s27 = 27,
+        s28 = 28,
+        s29 = 29,
+        s30 = 30,
+        s31 = 31,
+        d0 = 0 << 1,
+        d1 = 1 << 1,
+        d2 = 2 << 1,
+        d3 = 3 << 1,
+        d4 = 4 << 1,
+        d5 = 5 << 1,
+        d6 = 6 << 1,
+        d7 = 7 << 1,
+        d8 = 8 << 1,
+        d9 = 9 << 1,
+        d10 = 10 << 1,
+        d11 = 11 << 1,
+        d12 = 12 << 1,
+        d13 = 13 << 1,
+        d14 = 14 << 1,
+        d15 = 15 << 1,
+        d16 = 16 << 1,
+        d17 = 17 << 1,
+        d18 = 18 << 1,
+        d19 = 19 << 1,
+        d20 = 20 << 1,
+        d21 = 21 << 1,
+        d22 = 22 << 1,
+        d23 = 23 << 1,
+        d24 = 24 << 1,
+        d25 = 25 << 1,
+        d26 = 26 << 1,
+        d27 = 27 << 1,
+        d28 = 28 << 1,
+        d29 = 29 << 1,
+        d30 = 30 << 1,
+        d31 = 31 << 1,
+        q0 = 0 << 2,
+        q1 = 1 << 2,
+        q2 = 2 << 2,
+        q3 = 3 << 2,
+        q4 = 4 << 2,
+        q5 = 5 << 2,
+        q6 = 6 << 2,
+        q7 = 7 << 2,
+        q8 = 8 << 2,
+        q9 = 9 << 2,
+        q10 = 10 << 2,
+        q11 = 11 << 2,
+        q12 = 12 << 2,
+        q13 = 13 << 2,
+        q14 = 14 << 2,
+        q15 = 15 << 2,
+        q16 = 16 << 2,
+        q17 = 17 << 2,
+        q18 = 18 << 2,
+        q19 = 19 << 2,
+        q20 = 20 << 2,
+        q21 = 21 << 2,
+        q22 = 22 << 2,
+        q23 = 23 << 2,
+        q24 = 24 << 2,
+        q25 = 25 << 2,
+        q26 = 26 << 2,
+        q27 = 27 << 2,
+        q28 = 28 << 2,
+        q29 = 29 << 2,
+        q30 = 30 << 2,
+        q31 = 31 << 2,
+    } FPRegisterID;
+}
+
+class ARMv7Assembler;
+class ARMThumbImmediate {
+    friend class ARMv7Assembler;
+
+    typedef uint8_t ThumbImmediateType;
+    static const ThumbImmediateType TypeInvalid = 0;
+    static const ThumbImmediateType TypeEncoded = 1;
+    static const ThumbImmediateType TypeUInt16 = 2;
+
+    typedef union {
+        int16_t asInt;
+        struct {
+            unsigned imm8 : 8;
+            unsigned imm3 : 3;
+            unsigned i    : 1;
+            unsigned imm4 : 4;
+        };
+        // If this is an encoded immediate, then it may describe a shift, or a pattern.
+        struct {
+            unsigned shiftValue7 : 7;
+            unsigned shiftAmount : 5;
+        };
+        struct {
+            unsigned immediate   : 8;
+            unsigned pattern     : 4;
+        };
+    } ThumbImmediateValue;
+
+    // byte0 contains least significant bit; not using an array to make client code endian agnostic.
+    typedef union {
+        int32_t asInt;
+        struct {
+            uint8_t byte0;
+            uint8_t byte1;
+            uint8_t byte2;
+            uint8_t byte3;
+        };
+    } PatternBytes;
+
+    ALWAYS_INLINE static int32_t countLeadingZerosPartial(uint32_t& value, int32_t& zeros, const int N)
+    {
+        if (value & ~((1<<N)-1)) /* check for any of the top N bits (of 2N bits) are set */ \
+            value >>= N;         /* if any were set, lose the bottom N */ \
+        else                     /* if none of the top N bits are set, */ \
+            zeros += N;          /* then we have identified N leading zeros */
+    }
+
+    static int32_t countLeadingZeros(uint32_t value)
+    {
+        if (!value)
+            return 32;
+
+        int32_t zeros = 0;
+        countLeadingZerosPartial(value, zeros, 16);
+        countLeadingZerosPartial(value, zeros, 8);
+        countLeadingZerosPartial(value, zeros, 4);
+        countLeadingZerosPartial(value, zeros, 2);
+        countLeadingZerosPartial(value, zeros, 1);
+        return zeros;
+    }
+
+    ARMThumbImmediate()
+        : m_type(TypeInvalid)
+    {
+        m_value.asInt = 0;
+    }
+        
+    ARMThumbImmediate(ThumbImmediateType type, ThumbImmediateValue value)
+        : m_type(type)
+        , m_value(value)
+    {
+    }
+
+    ARMThumbImmediate(ThumbImmediateType type, uint16_t value)
+        : m_type(TypeUInt16)
+    {
+        m_value.asInt = value;
+    }
+
+public:
+    static ARMThumbImmediate makeEncodedImm(uint32_t value)
+    {
+        ThumbImmediateValue encoding;
+        encoding.asInt = 0;
+
+        // okay, these are easy.
+        if (value < 256) {
+            encoding.immediate = value;
+            encoding.pattern = 0;
+            return ARMThumbImmediate(TypeEncoded, encoding);
+        }
+
+        int32_t leadingZeros = countLeadingZeros(value);
+        // if there were 24 or more leading zeros, then we'd have hit the (value < 256) case.
+        ASSERT(leadingZeros < 24);
+
+        // Given a number with bit fields Z:B:C, where count(Z)+count(B)+count(C) == 32,
+        // Z are the bits known zero, B is the 8-bit immediate, C are the bits to check for
+        // zero.  count(B) == 8, so the count of bits to be checked is 24 - count(Z).
+        int32_t rightShiftAmount = 24 - leadingZeros;
+        if (value == ((value >> rightShiftAmount) << rightShiftAmount)) {
+            // Shift the value down to the low byte position.  The assign to 
+            // shiftValue7 drops the implicit top bit.
+            encoding.shiftValue7 = value >> rightShiftAmount;
+            // The endoded shift amount is the magnitude of a right rotate.
+            encoding.shiftAmount = 8 + leadingZeros;
+            return ARMThumbImmediate(TypeEncoded, encoding);
+        }
+        
+        PatternBytes bytes;
+        bytes.asInt = value;
+
+        if ((bytes.byte0 == bytes.byte1) && (bytes.byte0 == bytes.byte2) && (bytes.byte0 == bytes.byte3)) {
+            encoding.immediate = bytes.byte0;
+            encoding.pattern = 3;
+            return ARMThumbImmediate(TypeEncoded, encoding);
+        }
+
+        if ((bytes.byte0 == bytes.byte2) && !(bytes.byte1 | bytes.byte3)) {
+            encoding.immediate = bytes.byte0;
+            encoding.pattern = 1;
+            return ARMThumbImmediate(TypeEncoded, encoding);
+        }
+
+        if ((bytes.byte1 == bytes.byte3) && !(bytes.byte0 | bytes.byte2)) {
+            encoding.immediate = bytes.byte0;
+            encoding.pattern = 2;
+            return ARMThumbImmediate(TypeEncoded, encoding);
+        }
+
+        return ARMThumbImmediate();
+    }
+
+    static ARMThumbImmediate makeUInt12(int32_t value)
+    {
+        return (!(value & 0xfffff000))
+            ? ARMThumbImmediate(TypeUInt16, (uint16_t)value)
+            : ARMThumbImmediate();
+    }
+
+    static ARMThumbImmediate makeUInt12OrEncodedImm(int32_t value)
+    {
+        // If this is not a 12-bit unsigned it, try making an encoded immediate.
+        return (!(value & 0xfffff000))
+            ? ARMThumbImmediate(TypeUInt16, (uint16_t)value)
+            : makeEncodedImm(value);
+    }
+
+    // The 'make' methods, above, return a !isValid() value if the argument
+    // cannot be represented as the requested type.  This methods  is called
+    // 'get' since the argument can always be represented.
+    static ARMThumbImmediate makeUInt16(uint16_t value)
+    {
+        return ARMThumbImmediate(TypeUInt16, value);
+    }
+    
+    bool isValid()
+    {
+        return m_type != TypeInvalid;
+    }
+
+    // These methods rely on the format of encoded byte values.
+    bool isUInt3() { return !(m_value.asInt & 0xfff8); }
+    bool isUInt4() { return !(m_value.asInt & 0xfff0); }
+    bool isUInt5() { return !(m_value.asInt & 0xffe0); }
+    bool isUInt6() { return !(m_value.asInt & 0xffc0); }
+    bool isUInt7() { return !(m_value.asInt & 0xff80); }
+    bool isUInt8() { return !(m_value.asInt & 0xff00); }
+    bool isUInt9() { return (m_type == TypeUInt16) && !(m_value.asInt & 0xfe00); }
+    bool isUInt10() { return (m_type == TypeUInt16) && !(m_value.asInt & 0xfc00); }
+    bool isUInt12() { return (m_type == TypeUInt16) && !(m_value.asInt & 0xf000); }
+    bool isUInt16() { return m_type == TypeUInt16; }
+    uint8_t getUInt3() { ASSERT(isUInt3()); return m_value.asInt; }
+    uint8_t getUInt4() { ASSERT(isUInt4()); return m_value.asInt; }
+    uint8_t getUInt5() { ASSERT(isUInt5()); return m_value.asInt; }
+    uint8_t getUInt6() { ASSERT(isUInt6()); return m_value.asInt; }
+    uint8_t getUInt7() { ASSERT(isUInt7()); return m_value.asInt; }
+    uint8_t getUInt8() { ASSERT(isUInt8()); return m_value.asInt; }
+    uint8_t getUInt9() { ASSERT(isUInt9()); return m_value.asInt; }
+    uint8_t getUInt10() { ASSERT(isUInt10()); return m_value.asInt; }
+    uint16_t getUInt12() { ASSERT(isUInt12()); return m_value.asInt; }
+    uint16_t getUInt16() { ASSERT(isUInt16()); return m_value.asInt; }
+
+    bool isEncodedImm() { return m_type == TypeEncoded; }
+
+private:
+    ThumbImmediateType m_type;
+    ThumbImmediateValue m_value;
+};
+
+
+typedef enum {
+    SRType_LSL,
+    SRType_LSR,
+    SRType_ASR,
+    SRType_ROR,
+
+    SRType_RRX = SRType_ROR
+} ARMShiftType;
+
+class ARMv7Assembler;
+class ShiftTypeAndAmount {
+    friend class ARMv7Assembler;
+
+public:
+    ShiftTypeAndAmount()
+    {
+        m_u.type = (ARMShiftType)0;
+        m_u.amount = 0;
+    }
+    
+    ShiftTypeAndAmount(ARMShiftType type, unsigned amount)
+    {
+        m_u.type = type;
+        m_u.amount = amount & 31;
+    }
+    
+    unsigned lo4() { return m_u.lo4; }
+    unsigned hi4() { return m_u.hi4; }
+    
+private:
+    union {
+        struct {
+            unsigned lo4 : 4;
+            unsigned hi4 : 4;
+        };
+        struct {
+            unsigned type   : 2;
+            unsigned amount : 5;
+        };
+    } m_u;
+};
+
+
+/*
+Some features of the Thumb instruction set are deprecated in ARMv7. Deprecated features affecting 
+instructions supported by ARMv7-M are as follows: 
+• use of the PC as <Rd> or <Rm> in a 16-bit ADD (SP plus register) instruction 
+• use of the SP as <Rm> in a 16-bit ADD (SP plus register) instruction 
+• use of the SP as <Rm> in a 16-bit CMP (register) instruction 
+• use of MOV (register) instructions in which <Rd> is the SP or PC and <Rm> is also the SP or PC. 
+• use of <Rn> as the lowest-numbered register in the register list of a 16-bit STM instruction with base 
+register writeback 
+*/
+
+class ARMv7Assembler {
+public:
+    typedef ARM::RegisterID RegisterID;
+    typedef ARM::FPRegisterID FPRegisterID;
+
+    // (HS, LO, HI, LS) -> (AE, B, A, BE)
+    // (VS, VC) -> (O, NO)
+    typedef enum {
+        ConditionEQ,
+        ConditionNE,
+        ConditionHS,
+        ConditionLO,
+        ConditionMI,
+        ConditionPL,
+        ConditionVS,
+        ConditionVC,
+        ConditionHI,
+        ConditionLS,
+        ConditionGE,
+        ConditionLT,
+        ConditionGT,
+        ConditionLE,
+        ConditionAL,
+
+        ConditionCS = ConditionHS,
+        ConditionCC = ConditionLO,
+    } Condition;
+
+    class JmpSrc {
+        friend class ARMv7Assembler;
+        friend class ARMInstructionFormatter;
+    public:
+        JmpSrc()
+            : m_offset(-1)
+        {
+        }
+
+    private:
+        JmpSrc(int offset)
+            : m_offset(offset)
+        {
+        }
+
+        int m_offset;
+    };
+    
+    class JmpDst {
+        friend class ARMv7Assembler;
+        friend class ARMInstructionFormatter;
+    public:
+        JmpDst()
+            : m_offset(-1)
+            , m_used(false)
+        {
+        }
+
+        bool isUsed() const { return m_used; }
+        void used() { m_used = true; }
+    private:
+        JmpDst(int offset)
+            : m_offset(offset)
+            , m_used(false)
+        {
+            ASSERT(m_offset == offset);
+        }
+
+        int m_offset : 31;
+        int m_used : 1;
+    };
+
+private:
+
+    // ARMv7, Appx-A.6.3
+    bool BadReg(RegisterID reg)
+    {
+        return (reg == ARM::sp) || (reg == ARM::pc);
+    }
+
+    bool isSingleRegister(FPRegisterID reg)
+    {
+        // Check that the high bit isn't set (q16+), and that the low bit isn't (s1, s3, etc).
+        return !(reg & ~31);
+    }
+
+    bool isDoubleRegister(FPRegisterID reg)
+    {
+        // Check that the high bit isn't set (q16+), and that the low bit isn't (s1, s3, etc).
+        return !(reg & ~(31 << 1));
+    }
+
+    bool isQuadRegister(FPRegisterID reg)
+    {
+        return !(reg & ~(31 << 2));
+    }
+
+    uint32_t singleRegisterNum(FPRegisterID reg)
+    {
+        ASSERT(isSingleRegister(reg));
+        return reg;
+    }
+
+    uint32_t doubleRegisterNum(FPRegisterID reg)
+    {
+        ASSERT(isDoubleRegister(reg));
+        return reg >> 1;
+    }
+
+    uint32_t quadRegisterNum(FPRegisterID reg)
+    {
+        ASSERT(isQuadRegister(reg));
+        return reg >> 2;
+    }
+
+    uint32_t singleRegisterMask(FPRegisterID rd, int highBitsShift, int lowBitShift)
+    {
+        uint32_t rdNum = singleRegisterNum(rd);
+        uint32_t rdMask = (rdNum >> 1) << highBitsShift;
+        if (rdNum & 1)
+            rdMask |= 1 << lowBitShift;
+        return rdMask;
+    }
+
+    uint32_t doubleRegisterMask(FPRegisterID rd, int highBitShift, int lowBitsShift)
+    {
+        uint32_t rdNum = doubleRegisterNum(rd);
+        uint32_t rdMask = (rdNum & 0xf) << lowBitsShift;
+        if (rdNum & 16)
+            rdMask |= 1 << highBitShift;
+        return rdMask;
+    }
+
+    typedef enum {
+        OP_ADD_reg_T1       = 0x1800,
+        OP_ADD_S_reg_T1     = 0x1800,
+        OP_SUB_reg_T1       = 0x1A00,
+        OP_SUB_S_reg_T1     = 0x1A00,
+        OP_ADD_imm_T1       = 0x1C00,
+        OP_ADD_S_imm_T1     = 0x1C00,
+        OP_SUB_imm_T1       = 0x1E00,
+        OP_SUB_S_imm_T1     = 0x1E00,
+        OP_MOV_imm_T1       = 0x2000,
+        OP_CMP_imm_T1       = 0x2800,
+        OP_ADD_imm_T2       = 0x3000,
+        OP_ADD_S_imm_T2     = 0x3000,
+        OP_SUB_imm_T2       = 0x3800,
+        OP_SUB_S_imm_T2     = 0x3800,
+        OP_AND_reg_T1       = 0x4000,
+        OP_EOR_reg_T1       = 0x4040,
+        OP_TST_reg_T1       = 0x4200,
+        OP_CMP_reg_T1       = 0x4280,
+        OP_ORR_reg_T1       = 0x4300,
+        OP_MVN_reg_T1       = 0x43C0,
+        OP_ADD_reg_T2       = 0x4400,
+        OP_MOV_reg_T1       = 0x4600,
+        OP_BLX              = 0x4700,
+        OP_BX               = 0x4700,
+        OP_LDRH_reg_T1      = 0x5A00,
+        OP_STR_reg_T1       = 0x5000,
+        OP_LDR_reg_T1       = 0x5800,
+        OP_STR_imm_T1       = 0x6000,
+        OP_LDR_imm_T1       = 0x6800,
+        OP_LDRH_imm_T1      = 0x8800,
+        OP_STR_imm_T2       = 0x9000,
+        OP_LDR_imm_T2       = 0x9800,
+        OP_ADD_SP_imm_T1    = 0xA800,
+        OP_ADD_SP_imm_T2    = 0xB000,
+        OP_SUB_SP_imm_T1    = 0xB080,
+        OP_BKPT             = 0xBE00,
+        OP_IT               = 0xBF00,
+    } OpcodeID;
+
+    typedef enum {
+        OP_AND_reg_T2   = 0xEA00,
+        OP_TST_reg_T2   = 0xEA10,
+        OP_ORR_reg_T2   = 0xEA40,
+        OP_ASR_imm_T1   = 0xEA4F,
+        OP_LSL_imm_T1   = 0xEA4F,
+        OP_LSR_imm_T1   = 0xEA4F,
+        OP_ROR_imm_T1   = 0xEA4F,
+        OP_MVN_reg_T2   = 0xEA6F,
+        OP_EOR_reg_T2   = 0xEA80,
+        OP_ADD_reg_T3   = 0xEB00,
+        OP_ADD_S_reg_T3 = 0xEB10,
+        OP_SUB_reg_T2   = 0xEBA0,
+        OP_SUB_S_reg_T2 = 0xEBB0,
+        OP_CMP_reg_T2   = 0xEBB0,
+        OP_B_T4a        = 0xF000,
+        OP_AND_imm_T1   = 0xF000,
+        OP_TST_imm      = 0xF010,
+        OP_ORR_imm_T1   = 0xF040,
+        OP_MOV_imm_T2   = 0xF040,
+        OP_MVN_imm      = 0xF060,
+        OP_EOR_imm_T1   = 0xF080,
+        OP_ADD_imm_T3   = 0xF100,
+        OP_ADD_S_imm_T3 = 0xF110,
+        OP_CMN_imm      = 0xF110,
+        OP_SUB_imm_T3   = 0xF1A0,
+        OP_SUB_S_imm_T3 = 0xF1B0,
+        OP_CMP_imm_T2   = 0xF1B0,
+        OP_ADD_imm_T4   = 0xF200,
+        OP_MOV_imm_T3   = 0xF240,
+        OP_SUB_imm_T4   = 0xF2A0,
+        OP_MOVT         = 0xF2C0,
+        OP_LDRH_reg_T2  = 0xF830,
+        OP_LDRH_imm_T3  = 0xF830,
+        OP_STR_imm_T4   = 0xF840,
+        OP_STR_reg_T2   = 0xF840,
+        OP_LDR_imm_T4   = 0xF850,
+        OP_LDR_reg_T2   = 0xF850,
+        OP_LDRH_imm_T2  = 0xF8B0,
+        OP_STR_imm_T3   = 0xF8C0,
+        OP_LDR_imm_T3   = 0xF8D0,
+        OP_LSL_reg_T2   = 0xFA00,
+        OP_LSR_reg_T2   = 0xFA20,
+        OP_ASR_reg_T2   = 0xFA40,
+        OP_ROR_reg_T2   = 0xFA60,
+        OP_SMULL_T1     = 0xFB80,
+    } OpcodeID1;
+
+    typedef enum {
+        OP_B_T4b        = 0x9000,
+    } OpcodeID2;
+
+    struct FourFours {
+        FourFours(unsigned f3, unsigned f2, unsigned f1, unsigned f0)
+        {
+            m_u.f0 = f0;
+            m_u.f1 = f1;
+            m_u.f2 = f2;
+            m_u.f3 = f3;
+        }
+
+        union {
+            unsigned value;
+            struct {
+                unsigned f0 : 4;
+                unsigned f1 : 4;
+                unsigned f2 : 4;
+                unsigned f3 : 4;
+            };
+        } m_u;
+    };
+
+    class ARMInstructionFormatter;
+
+    // false means else!
+    bool ifThenElseConditionBit(Condition condition, bool isIf)
+    {
+        return isIf ? (condition & 1) : !(condition & 1);
+    }
+    uint8_t ifThenElse(Condition condition, bool inst2if, bool inst3if, bool inst4if)
+    {
+        int mask = (ifThenElseConditionBit(condition, inst2if) << 3)
+            | (ifThenElseConditionBit(condition, inst3if) << 2)
+            | (ifThenElseConditionBit(condition, inst4if) << 1)
+            | 1;
+        ASSERT((condition != ConditionAL) || (mask & (mask - 1)));
+        return (condition << 4) | mask;
+    }
+    uint8_t ifThenElse(Condition condition, bool inst2if, bool inst3if)
+    {
+        int mask = (ifThenElseConditionBit(condition, inst2if) << 3)
+            | (ifThenElseConditionBit(condition, inst3if) << 2)
+            | 2;
+        ASSERT((condition != ConditionAL) || (mask & (mask - 1)));
+        return (condition << 4) | mask;
+    }
+    uint8_t ifThenElse(Condition condition, bool inst2if)
+    {
+        int mask = (ifThenElseConditionBit(condition, inst2if) << 3)
+            | 4;
+        ASSERT((condition != ConditionAL) || (mask & (mask - 1)));
+        return (condition << 4) | mask;
+    }
+
+    uint8_t ifThenElse(Condition condition)
+    {
+        int mask = 8;
+        ASSERT((condition != ConditionAL) || (mask & (mask - 1)));
+        return (condition << 4) | mask;
+    }
+
+public:
+
+    void add(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
+    {
+        // Rd can only be SP if Rn is also SP.
+        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
+        ASSERT(rd != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(imm.isValid());
+
+        if (rn == ARM::sp) {
+            if (!(rd & 8) && imm.isUInt10()) {
+                m_formatter.oneWordOp5Reg3Imm8(OP_ADD_SP_imm_T1, rd, imm.getUInt10() >> 2);
+                return;
+            } else if ((rd == ARM::sp) && imm.isUInt9()) {
+                m_formatter.oneWordOp9Imm7(OP_ADD_SP_imm_T2, imm.getUInt9() >> 2);
+                return;
+            }
+        } else if (!((rd | rn) & 8)) {
+            if (imm.isUInt3()) {
+                m_formatter.oneWordOp7Reg3Reg3Reg3(OP_ADD_imm_T1, (RegisterID)imm.getUInt3(), rn, rd);
+                return;
+            } else if ((rd == rn) && imm.isUInt8()) {
+                m_formatter.oneWordOp5Reg3Imm8(OP_ADD_imm_T2, rd, imm.getUInt8());
+                return;
+            }
+        }
+
+        if (imm.isEncodedImm())
+            m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_ADD_imm_T3, rn, rd, imm);
+        else {
+            ASSERT(imm.isUInt12());
+            m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_ADD_imm_T4, rn, rd, imm);
+        }
+    }
+
+    void add(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
+        ASSERT(rd != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_ADD_reg_T3, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    // NOTE: In an IT block, add doesn't modify the flags register.
+    void add(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        if (rd == rn)
+            m_formatter.oneWordOp8RegReg143(OP_ADD_reg_T2, rm, rd);
+        else if (rd == rm)
+            m_formatter.oneWordOp8RegReg143(OP_ADD_reg_T2, rn, rd);
+        else if (!((rd | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_ADD_reg_T1, rm, rn, rd);
+        else
+            add(rd, rn, rm, ShiftTypeAndAmount());
+    }
+
+    // Not allowed in an IT (if then) block.
+    void add_S(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
+    {
+        // Rd can only be SP if Rn is also SP.
+        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
+        ASSERT(rd != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(imm.isEncodedImm());
+
+        if (!((rd | rn) & 8)) {
+            if (imm.isUInt3()) {
+                m_formatter.oneWordOp7Reg3Reg3Reg3(OP_ADD_S_imm_T1, (RegisterID)imm.getUInt3(), rn, rd);
+                return;
+            } else if ((rd == rn) && imm.isUInt8()) {
+                m_formatter.oneWordOp5Reg3Imm8(OP_ADD_S_imm_T2, rd, imm.getUInt8());
+                return;
+            }
+        }
+
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_ADD_S_imm_T3, rn, rd, imm);
+    }
+
+    // Not allowed in an IT (if then) block?
+    void add_S(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
+        ASSERT(rd != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_ADD_S_reg_T3, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    // Not allowed in an IT (if then) block.
+    void add_S(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        if (!((rd | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_ADD_S_reg_T1, rm, rn, rd);
+        else
+            add_S(rd, rn, rm, ShiftTypeAndAmount());
+    }
+
+    void ARM_and(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(imm.isEncodedImm());
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_AND_imm_T1, rn, rd, imm);
+    }
+
+    void ARM_and(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_AND_reg_T2, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    void ARM_and(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        if ((rd == rn) && !((rd | rm) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_AND_reg_T1, rm, rd);
+        else if ((rd == rm) && !((rd | rn) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_AND_reg_T1, rn, rd);
+        else
+            ARM_and(rd, rn, rm, ShiftTypeAndAmount());
+    }
+
+    void asr(RegisterID rd, RegisterID rm, int32_t shiftAmount)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rm));
+        ShiftTypeAndAmount shift(SRType_ASR, shiftAmount);
+        m_formatter.twoWordOp16FourFours(OP_ASR_imm_T1, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    void asr(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_ASR_reg_T2, rn, FourFours(0xf, rd, 0, rm));
+    }
+
+    // Only allowed in IT (if then) block if last instruction.
+    JmpSrc b()
+    {
+        m_formatter.twoWordOp16Op16(OP_B_T4a, OP_B_T4b);
+        return JmpSrc(m_formatter.size());
+    }
+    
+    // Only allowed in IT (if then) block if last instruction.
+    JmpSrc blx(RegisterID rm)
+    {
+        ASSERT(rm != ARM::pc);
+        m_formatter.oneWordOp8RegReg143(OP_BLX, rm, (RegisterID)8);
+        return JmpSrc(m_formatter.size());
+    }
+
+    // Only allowed in IT (if then) block if last instruction.
+    JmpSrc bx(RegisterID rm)
+    {
+        m_formatter.oneWordOp8RegReg143(OP_BX, rm, (RegisterID)0);
+        return JmpSrc(m_formatter.size());
+    }
+
+    void bkpt(uint8_t imm=0)
+    {
+        m_formatter.oneWordOp8Imm8(OP_BKPT, imm);
+    }
+
+    void cmn(RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(rn != ARM::pc);
+        ASSERT(imm.isEncodedImm());
+
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_CMN_imm, rn, (RegisterID)0xf, imm);
+    }
+
+    void cmp(RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(rn != ARM::pc);
+        ASSERT(imm.isEncodedImm());
+
+        if (!(rn & 8) && imm.isUInt8())
+            m_formatter.oneWordOp5Reg3Imm8(OP_CMP_imm_T1, rn, imm.getUInt8());
+        else
+            m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_CMP_imm_T2, rn, (RegisterID)0xf, imm);
+    }
+
+    void cmp(RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT(rn != ARM::pc);
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_CMP_reg_T2, rn, FourFours(shift.hi4(), 0xf, shift.lo4(), rm));
+    }
+
+    void cmp(RegisterID rn, RegisterID rm)
+    {
+        if ((rn | rm) & 8)
+            cmp(rn, rm, ShiftTypeAndAmount());
+        else
+            m_formatter.oneWordOp10Reg3Reg3(OP_CMP_reg_T1, rm, rn);
+    }
+
+    // xor is not spelled with an 'e'. :-(
+    void eor(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(imm.isEncodedImm());
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_EOR_imm_T1, rn, rd, imm);
+    }
+
+    // xor is not spelled with an 'e'. :-(
+    void eor(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_EOR_reg_T2, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    // xor is not spelled with an 'e'. :-(
+    void eor(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        if ((rd == rn) && !((rd | rm) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_EOR_reg_T1, rm, rd);
+        else if ((rd == rm) && !((rd | rn) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_EOR_reg_T1, rn, rd);
+        else
+            eor(rd, rn, rm, ShiftTypeAndAmount());
+    }
+
+    void it(Condition cond)
+    {
+        m_formatter.oneWordOp8Imm8(OP_IT, ifThenElse(cond));
+    }
+
+    void it(Condition cond, bool inst2if)
+    {
+        m_formatter.oneWordOp8Imm8(OP_IT, ifThenElse(cond, inst2if));
+    }
+
+    void it(Condition cond, bool inst2if, bool inst3if)
+    {
+        m_formatter.oneWordOp8Imm8(OP_IT, ifThenElse(cond, inst2if, inst3if));
+    }
+
+    void it(Condition cond, bool inst2if, bool inst3if, bool inst4if)
+    {
+        m_formatter.oneWordOp8Imm8(OP_IT, ifThenElse(cond, inst2if, inst3if, inst4if));
+    }
+
+    // rt == ARM::pc only allowed if last instruction in IT (if then) block.
+    void ldr(RegisterID rt, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(rn != ARM::pc); // LDR (literal)
+        ASSERT(imm.isUInt12());
+
+        if (!((rt | rn) & 8) && imm.isUInt7())
+            m_formatter.oneWordOp5Imm5Reg3Reg3(OP_LDR_imm_T1, imm.getUInt7() >> 2, rn, rt);
+        else if ((rn == ARM::sp) && !(rt & 8) && imm.isUInt10())
+            m_formatter.oneWordOp5Reg3Imm8(OP_LDR_imm_T2, rt, imm.getUInt10() >> 2);
+        else
+            m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDR_imm_T3, rn, rt, imm.getUInt12());
+    }
+
+    // If index is set, this is a regular offset or a pre-indexed load;
+    // if index is not set then is is a post-index load.
+    //
+    // If wback is set rn is updated - this is a pre or post index load,
+    // if wback is not set this is a regular offset memory access.
+    //
+    // (-255 <= offset <= 255)
+    // _reg = REG[rn]
+    // _tmp = _reg + offset
+    // MEM[index ? _tmp : _reg] = REG[rt]
+    // if (wback) REG[rn] = _tmp
+    void ldr(RegisterID rt, RegisterID rn, int offset, bool index, bool wback)
+    {
+        ASSERT(rt != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(index || wback);
+        ASSERT(!wback | (rt != rn));
+    
+        bool add = true;
+        if (offset < 0) {
+            add = false;
+            offset = -offset;
+        }
+        ASSERT((offset & ~0xff) == 0);
+        
+        offset |= (wback << 8);
+        offset |= (add   << 9);
+        offset |= (index << 10);
+        offset |= (1 << 11);
+        
+        m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDR_imm_T4, rn, rt, offset);
+    }
+
+    // rt == ARM::pc only allowed if last instruction in IT (if then) block.
+    void ldr(RegisterID rt, RegisterID rn, RegisterID rm, unsigned shift=0)
+    {
+        ASSERT(rn != ARM::pc); // LDR (literal)
+        ASSERT(!BadReg(rm));
+        ASSERT(shift <= 3);
+
+        if (!shift && !((rt | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_LDR_reg_T1, rm, rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4FourFours(OP_LDR_reg_T2, rn, FourFours(rt, 0, shift, rm));
+    }
+
+    // rt == ARM::pc only allowed if last instruction in IT (if then) block.
+    void ldrh(RegisterID rt, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(rn != ARM::pc); // LDR (literal)
+        ASSERT(imm.isUInt12());
+
+        if (!((rt | rn) & 8) && imm.isUInt6())
+            m_formatter.oneWordOp5Imm5Reg3Reg3(OP_LDRH_imm_T1, imm.getUInt6() >> 2, rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDRH_imm_T2, rn, rt, imm.getUInt12());
+    }
+
+    // If index is set, this is a regular offset or a pre-indexed load;
+    // if index is not set then is is a post-index load.
+    //
+    // If wback is set rn is updated - this is a pre or post index load,
+    // if wback is not set this is a regular offset memory access.
+    //
+    // (-255 <= offset <= 255)
+    // _reg = REG[rn]
+    // _tmp = _reg + offset
+    // MEM[index ? _tmp : _reg] = REG[rt]
+    // if (wback) REG[rn] = _tmp
+    void ldrh(RegisterID rt, RegisterID rn, int offset, bool index, bool wback)
+    {
+        ASSERT(rt != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(index || wback);
+        ASSERT(!wback | (rt != rn));
+    
+        bool add = true;
+        if (offset < 0) {
+            add = false;
+            offset = -offset;
+        }
+        ASSERT((offset & ~0xff) == 0);
+        
+        offset |= (wback << 8);
+        offset |= (add   << 9);
+        offset |= (index << 10);
+        offset |= (1 << 11);
+        
+        m_formatter.twoWordOp12Reg4Reg4Imm12(OP_LDRH_imm_T3, rn, rt, offset);
+    }
+
+    void ldrh(RegisterID rt, RegisterID rn, RegisterID rm, unsigned shift=0)
+    {
+        ASSERT(!BadReg(rt));   // Memory hint
+        ASSERT(rn != ARM::pc); // LDRH (literal)
+        ASSERT(!BadReg(rm));
+        ASSERT(shift <= 3);
+
+        if (!shift && !((rt | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_LDRH_reg_T1, rm, rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4FourFours(OP_LDRH_reg_T2, rn, FourFours(rt, 0, shift, rm));
+    }
+
+    void lsl(RegisterID rd, RegisterID rm, int32_t shiftAmount)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rm));
+        ShiftTypeAndAmount shift(SRType_LSL, shiftAmount);
+        m_formatter.twoWordOp16FourFours(OP_LSL_imm_T1, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    void lsl(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_LSL_reg_T2, rn, FourFours(0xf, rd, 0, rm));
+    }
+
+    void lsr(RegisterID rd, RegisterID rm, int32_t shiftAmount)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rm));
+        ShiftTypeAndAmount shift(SRType_LSR, shiftAmount);
+        m_formatter.twoWordOp16FourFours(OP_LSR_imm_T1, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    void lsr(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_LSR_reg_T2, rn, FourFours(0xf, rd, 0, rm));
+    }
+
+    void movT3(RegisterID rd, ARMThumbImmediate imm)
+    {
+        ASSERT(imm.isValid());
+        ASSERT(!imm.isEncodedImm());
+        ASSERT(!BadReg(rd));
+        
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_MOV_imm_T3, imm.m_value.imm4, rd, imm);
+    }
+
+     void mov(RegisterID rd, ARMThumbImmediate imm)
+    {
+        ASSERT(imm.isValid());
+        ASSERT(!BadReg(rd));
+        
+        if ((rd < 8) && imm.isUInt8())
+            m_formatter.oneWordOp5Reg3Imm8(OP_MOV_imm_T1, rd, imm.getUInt8());
+        else if (imm.isEncodedImm())
+            m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_MOV_imm_T2, 0xf, rd, imm);
+        else
+            movT3(rd, imm);
+    }
+
+   void mov(RegisterID rd, RegisterID rm)
+    {
+        m_formatter.oneWordOp8RegReg143(OP_MOV_reg_T1, rm, rd);
+    }
+
+    void movt(RegisterID rd, ARMThumbImmediate imm)
+    {
+        ASSERT(imm.isUInt16());
+        ASSERT(!BadReg(rd));
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_MOVT, imm.m_value.imm4, rd, imm);
+    }
+
+    void mvn(RegisterID rd, ARMThumbImmediate imm)
+    {
+        ASSERT(imm.isEncodedImm());
+        ASSERT(!BadReg(rd));
+        
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_MVN_imm, 0xf, rd, imm);
+    }
+
+    void mvn(RegisterID rd, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp16FourFours(OP_MVN_reg_T2, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    void mvn(RegisterID rd, RegisterID rm)
+    {
+        if (!((rd | rm) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_MVN_reg_T1, rm, rd);
+        else
+            mvn(rd, rm, ShiftTypeAndAmount());
+    }
+
+    void orr(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(imm.isEncodedImm());
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_ORR_imm_T1, rn, rd, imm);
+    }
+
+    void orr(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_ORR_reg_T2, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    void orr(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        if ((rd == rn) && !((rd | rm) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_ORR_reg_T1, rm, rd);
+        else if ((rd == rm) && !((rd | rn) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_ORR_reg_T1, rn, rd);
+        else
+            orr(rd, rn, rm, ShiftTypeAndAmount());
+    }
+
+    void ror(RegisterID rd, RegisterID rm, int32_t shiftAmount)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rm));
+        ShiftTypeAndAmount shift(SRType_ROR, shiftAmount);
+        m_formatter.twoWordOp16FourFours(OP_ROR_imm_T1, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    void ror(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_ROR_reg_T2, rn, FourFours(0xf, rd, 0, rm));
+    }
+
+    void smull(RegisterID rdLo, RegisterID rdHi, RegisterID rn, RegisterID rm)
+    {
+        ASSERT(!BadReg(rdLo));
+        ASSERT(!BadReg(rdHi));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        ASSERT(rdLo != rdHi);
+        m_formatter.twoWordOp12Reg4FourFours(OP_SMULL_T1, rn, FourFours(rdLo, rdHi, 0, rm));
+    }
+
+    // rt == ARM::pc only allowed if last instruction in IT (if then) block.
+    void str(RegisterID rt, RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(rt != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(imm.isUInt12());
+
+        if (!((rt | rn) & 8) && imm.isUInt7())
+            m_formatter.oneWordOp5Imm5Reg3Reg3(OP_STR_imm_T1, imm.getUInt7() >> 2, rn, rt);
+        else if ((rn == ARM::sp) && !(rt & 8) && imm.isUInt10())
+            m_formatter.oneWordOp5Reg3Imm8(OP_STR_imm_T2, rt, imm.getUInt10() >> 2);
+        else
+            m_formatter.twoWordOp12Reg4Reg4Imm12(OP_STR_imm_T3, rn, rt, imm.getUInt12());
+    }
+
+    // If index is set, this is a regular offset or a pre-indexed store;
+    // if index is not set then is is a post-index store.
+    //
+    // If wback is set rn is updated - this is a pre or post index store,
+    // if wback is not set this is a regular offset memory access.
+    //
+    // (-255 <= offset <= 255)
+    // _reg = REG[rn]
+    // _tmp = _reg + offset
+    // MEM[index ? _tmp : _reg] = REG[rt]
+    // if (wback) REG[rn] = _tmp
+    void str(RegisterID rt, RegisterID rn, int offset, bool index, bool wback)
+    {
+        ASSERT(rt != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(index || wback);
+        ASSERT(!wback | (rt != rn));
+    
+        bool add = true;
+        if (offset < 0) {
+            add = false;
+            offset = -offset;
+        }
+        ASSERT((offset & ~0xff) == 0);
+        
+        offset |= (wback << 8);
+        offset |= (add   << 9);
+        offset |= (index << 10);
+        offset |= (1 << 11);
+        
+        m_formatter.twoWordOp12Reg4Reg4Imm12(OP_STR_imm_T4, rn, rt, offset);
+    }
+
+    // rt == ARM::pc only allowed if last instruction in IT (if then) block.
+    void str(RegisterID rt, RegisterID rn, RegisterID rm, unsigned shift=0)
+    {
+        ASSERT(rn != ARM::pc);
+        ASSERT(!BadReg(rm));
+        ASSERT(shift <= 3);
+
+        if (!shift && !((rt | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_STR_reg_T1, rm, rn, rt);
+        else
+            m_formatter.twoWordOp12Reg4FourFours(OP_STR_reg_T2, rn, FourFours(rt, 0, shift, rm));
+    }
+
+    void sub(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
+    {
+        // Rd can only be SP if Rn is also SP.
+        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
+        ASSERT(rd != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(imm.isValid());
+
+        if ((rn == ARM::sp) && (rd == ARM::sp) && imm.isUInt9()) {
+            m_formatter.oneWordOp9Imm7(OP_SUB_SP_imm_T1, imm.getUInt9() >> 2);
+            return;
+        } else if (!((rd | rn) & 8)) {
+            if (imm.isUInt3()) {
+                m_formatter.oneWordOp7Reg3Reg3Reg3(OP_SUB_imm_T1, (RegisterID)imm.getUInt3(), rn, rd);
+                return;
+            } else if ((rd == rn) && imm.isUInt8()) {
+                m_formatter.oneWordOp5Reg3Imm8(OP_SUB_imm_T2, rd, imm.getUInt8());
+                return;
+            }
+        }
+
+        if (imm.isEncodedImm())
+            m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_SUB_imm_T3, rn, rd, imm);
+        else {
+            ASSERT(imm.isUInt12());
+            m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_SUB_imm_T4, rn, rd, imm);
+        }
+    }
+
+    void sub(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
+        ASSERT(rd != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_SUB_reg_T2, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    // NOTE: In an IT block, add doesn't modify the flags register.
+    void sub(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        if (!((rd | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_SUB_reg_T1, rm, rn, rd);
+        else
+            sub(rd, rn, rm, ShiftTypeAndAmount());
+    }
+
+    // Not allowed in an IT (if then) block.
+    void sub_S(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
+    {
+        // Rd can only be SP if Rn is also SP.
+        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
+        ASSERT(rd != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(imm.isValid());
+
+        if ((rn == ARM::sp) && (rd == ARM::sp) && imm.isUInt9()) {
+            m_formatter.oneWordOp9Imm7(OP_SUB_SP_imm_T1, imm.getUInt9() >> 2);
+            return;
+        } else if (!((rd | rn) & 8)) {
+            if (imm.isUInt3()) {
+                m_formatter.oneWordOp7Reg3Reg3Reg3(OP_SUB_S_imm_T1, (RegisterID)imm.getUInt3(), rn, rd);
+                return;
+            } else if ((rd == rn) && imm.isUInt8()) {
+                m_formatter.oneWordOp5Reg3Imm8(OP_SUB_S_imm_T2, rd, imm.getUInt8());
+                return;
+            }
+        }
+
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_SUB_S_imm_T3, rn, rd, imm);
+    }
+
+    // Not allowed in an IT (if then) block?
+    void sub_S(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT((rd != ARM::sp) || (rn == ARM::sp));
+        ASSERT(rd != ARM::pc);
+        ASSERT(rn != ARM::pc);
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_SUB_S_reg_T2, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    // Not allowed in an IT (if then) block.
+    void sub_S(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        if (!((rd | rn | rm) & 8))
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_SUB_S_reg_T1, rm, rn, rd);
+        else
+            sub_S(rd, rn, rm, ShiftTypeAndAmount());
+    }
+
+    void tst(RegisterID rn, ARMThumbImmediate imm)
+    {
+        ASSERT(!BadReg(rn));
+        ASSERT(imm.isEncodedImm());
+
+        m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_TST_imm, rn, (RegisterID)0xf, imm);
+    }
+
+    void tst(RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_TST_reg_T2, rn, FourFours(shift.hi4(), 0xf, shift.lo4(), rm));
+    }
+
+    void tst(RegisterID rn, RegisterID rm)
+    {
+        if ((rn | rm) & 8)
+            tst(rn, rm, ShiftTypeAndAmount());
+        else
+            m_formatter.oneWordOp10Reg3Reg3(OP_TST_reg_T1, rm, rn);
+    }
+
+    void vadd_F64(FPRegisterID rd, FPRegisterID rn, FPRegisterID rm)
+    {
+        m_formatter.vfpOp(0x0b00ee30 | doubleRegisterMask(rd, 6, 28) | doubleRegisterMask(rn, 23, 0) | doubleRegisterMask(rm, 21, 16));
+    }
+
+    void vcmp_F64(FPRegisterID rd, FPRegisterID rm)
+    {
+        m_formatter.vfpOp(0x0bc0eeb4 | doubleRegisterMask(rd, 6, 28) | doubleRegisterMask(rm, 21, 16));
+    }
+
+    void vcvt_F64_S32(FPRegisterID fd, FPRegisterID sm)
+    {
+        m_formatter.vfpOp(0x0bc0eeb8 | doubleRegisterMask(fd, 6, 28) | singleRegisterMask(sm, 16, 21));
+    }
+
+    void vcvt_S32_F64(FPRegisterID sd, FPRegisterID fm)
+    {
+        m_formatter.vfpOp(0x0bc0eebd | singleRegisterMask(sd, 28, 6) | doubleRegisterMask(fm, 21, 16));
+    }
+
+    void vldr(FPRegisterID rd, RegisterID rn, int32_t imm)
+    {
+        vmem(rd, rn, imm, true);
+    }
+
+    void vmov(RegisterID rd, FPRegisterID sn)
+    {
+        m_formatter.vfpOp(0x0a10ee10 | (rd << 28) | singleRegisterMask(sn, 0, 23));
+    }
+
+    void vmov(FPRegisterID sn, RegisterID rd)
+    {
+        m_formatter.vfpOp(0x0a10ee00 | (rd << 28) | singleRegisterMask(sn, 0, 23));
+    }
+
+    // move FPSCR flags to APSR.
+    void vmrs_APSR_nzcv_FPSCR()
+    {
+        m_formatter.vfpOp(0xfa10eef1);
+    }
+
+    void vmul_F64(FPRegisterID rd, FPRegisterID rn, FPRegisterID rm)
+    {
+        m_formatter.vfpOp(0x0b00ee20 | doubleRegisterMask(rd, 6, 28) | doubleRegisterMask(rn, 23, 0) | doubleRegisterMask(rm, 21, 16));
+    }
+
+    void vstr(FPRegisterID rd, RegisterID rn, int32_t imm)
+    {
+        vmem(rd, rn, imm, false);
+    }
+
+    void vsub_F64(FPRegisterID rd, FPRegisterID rn, FPRegisterID rm)
+    {
+        m_formatter.vfpOp(0x0b40ee30 | doubleRegisterMask(rd, 6, 28) | doubleRegisterMask(rn, 23, 0) | doubleRegisterMask(rm, 21, 16));
+    }
+
+
+    JmpDst label()
+    {
+        return JmpDst(m_formatter.size());
+    }
+    
+    JmpDst align(int alignment)
+    {
+        while (!m_formatter.isAligned(alignment))
+            bkpt();
+
+        return label();
+    }
+    
+    static void* getRelocatedAddress(void* code, JmpSrc jump)
+    {
+        ASSERT(jump.m_offset != -1);
+
+        return reinterpret_cast<void*>(reinterpret_cast<ptrdiff_t>(code) + jump.m_offset);
+    }
+    
+    static void* getRelocatedAddress(void* code, JmpDst destination)
+    {
+        ASSERT(destination.m_offset != -1);
+
+        return reinterpret_cast<void*>(reinterpret_cast<ptrdiff_t>(code) + destination.m_offset);
+    }
+    
+    static int getDifferenceBetweenLabels(JmpDst src, JmpDst dst)
+    {
+        return dst.m_offset - src.m_offset;
+    }
+    
+    static int getDifferenceBetweenLabels(JmpDst src, JmpSrc dst)
+    {
+        return dst.m_offset - src.m_offset;
+    }
+    
+    static int getDifferenceBetweenLabels(JmpSrc src, JmpDst dst)
+    {
+        return dst.m_offset - src.m_offset;
+    }
+    
+    // Assembler admin methods:
+
+    size_t size() const
+    {
+        return m_formatter.size();
+    }
+
+    void* executableCopy(ExecutablePool* allocator)
+    {
+        void* copy = m_formatter.executableCopy(allocator);
+        ASSERT(copy);
+        return copy;
+    }
+
+    static unsigned getCallReturnOffset(JmpSrc call)
+    {
+        ASSERT(call.m_offset >= 0);
+        return call.m_offset;
+    }
+
+    // Linking & patching:
+    //
+    // 'link' and 'patch' methods are for use on unprotected code - such as the code
+    // within the AssemblerBuffer, and code being patched by the patch buffer.  Once
+    // code has been finalized it is (platform support permitting) within a non-
+    // writable region of memory; to modify the code in an execute-only execuable
+    // pool the 'repatch' and 'relink' methods should be used.
+
+    void linkJump(JmpSrc from, JmpDst to)
+    {
+        ASSERT(to.m_offset != -1);
+        ASSERT(from.m_offset != -1);
+
+        uint16_t* location = reinterpret_cast<uint16_t*>(reinterpret_cast<intptr_t>(m_formatter.data()) + from.m_offset);
+        intptr_t relative = to.m_offset - from.m_offset;
+
+        linkWithOffset(location, relative);
+    }
+
+    static void linkJump(void* code, JmpSrc from, void* to)
+    {
+        ASSERT(from.m_offset != -1);
+        
+        uint16_t* location = reinterpret_cast<uint16_t*>(reinterpret_cast<intptr_t>(code) + from.m_offset);
+        intptr_t relative = reinterpret_cast<intptr_t>(to) - reinterpret_cast<intptr_t>(location);
+
+        linkWithOffset(location, relative);
+    }
+
+    // bah, this mathod should really be static, since it is used by the LinkBuffer.
+    // return a bool saying whether the link was successful?
+    static void linkCall(void* code, JmpSrc from, void* to)
+    {
+        ASSERT(!(reinterpret_cast<intptr_t>(code) & 1));
+        ASSERT(from.m_offset != -1);
+        ASSERT(reinterpret_cast<intptr_t>(to) & 1);
+
+        patchPointer(reinterpret_cast<uint16_t*>(reinterpret_cast<intptr_t>(code) + from.m_offset) - 1, to);
+    }
+
+    static void patchPointer(void* code, JmpDst where, void* value)
+    {
+        patchPointer(reinterpret_cast<char*>(code) + where.m_offset, value);
+    }
+
+    static void relinkJump(void* from, void* to)
+    {
+        ExecutableAllocator::MakeWritable unprotect(reinterpret_cast<uint16_t*>(from) - 2, 2 * sizeof(uint16_t));
+
+        ASSERT(!(reinterpret_cast<intptr_t>(from) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(to) & 1));
+
+        intptr_t relative = reinterpret_cast<intptr_t>(to) - reinterpret_cast<intptr_t>(from);
+        linkWithOffset(reinterpret_cast<uint16_t*>(from), relative);
+    }
+    
+    static void relinkCall(void* from, void* to)
+    {
+        ExecutableAllocator::MakeWritable unprotect(reinterpret_cast<uint16_t*>(from) - 5, 4 * sizeof(uint16_t));
+
+        ASSERT(!(reinterpret_cast<intptr_t>(from) & 1));
+        ASSERT(reinterpret_cast<intptr_t>(to) & 1);
+
+        patchPointer(reinterpret_cast<uint16_t*>(from) - 1, to);
+    }
+
+    static void repatchInt32(void* where, int32_t value)
+    {
+        ExecutableAllocator::MakeWritable unprotect(reinterpret_cast<uint16_t*>(where) - 4, 4 * sizeof(uint16_t));
+
+        ASSERT(!(reinterpret_cast<intptr_t>(where) & 1));
+        
+        patchInt32(where, value);
+    }
+
+    static void repatchPointer(void* where, void* value)
+    {
+        ExecutableAllocator::MakeWritable unprotect(reinterpret_cast<uint16_t*>(where) - 4, 4 * sizeof(uint16_t));
+
+        ASSERT(!(reinterpret_cast<intptr_t>(where) & 1));
+        
+        patchPointer(where, value);
+    }
+
+    static void repatchLoadPtrToLEA(void* where)
+    {
+        ASSERT(!(reinterpret_cast<intptr_t>(where) & 1));
+
+        uint16_t* loadOp = reinterpret_cast<uint16_t*>(where) + 4;
+        ASSERT((*loadOp & 0xfff0) == OP_LDR_reg_T2);
+
+        ExecutableAllocator::MakeWritable unprotect(loadOp, sizeof(uint16_t));
+        *loadOp = OP_ADD_reg_T3 | (*loadOp & 0xf);
+    }
+
+private:
+
+    // Arm vfp addresses can be offset by a 9-bit ones-comp immediate, left shifted by 2.
+    // (i.e. +/-(0..255) 32-bit words)
+    void vmem(FPRegisterID rd, RegisterID rn, int32_t imm, bool isLoad)
+    {
+        bool up;
+        uint32_t offset;
+        if (imm < 0) {
+            offset = -imm;
+            up = false;
+        } else {
+            offset = imm;
+            up = true;
+        }
+
+        // offset is effectively leftshifted by 2 already (the bottom two bits are zero, and not
+        // reperesented in the instruction.  Left shift by 14, to mov it into position 0x00AA0000.
+        ASSERT((offset & ~(0xff << 2)) == 0);
+        offset <<= 14;
+
+        m_formatter.vfpOp(0x0b00ed00 | offset | (up << 7) | (isLoad << 4) | doubleRegisterMask(rd, 6, 28) | rn);
+    }
+
+    static void patchInt32(void* code, uint32_t value)
+    {
+        uint16_t* location = reinterpret_cast<uint16_t*>(code);
+
+        ExecutableAllocator::MakeWritable unprotect(location - 4, 4 * sizeof(uint16_t));
+
+        uint16_t lo16 = value;
+        uint16_t hi16 = value >> 16;
+
+        spliceHi5(location - 4, lo16);
+        spliceLo11(location - 3, lo16);
+        spliceHi5(location - 2, hi16);
+        spliceLo11(location - 1, hi16);
+    }
+
+    static void patchPointer(void* code, void* value)
+    {
+        patchInt32(code, reinterpret_cast<uint32_t>(value));
+    }
+
+    // Linking & patching:
+    // This method assumes that the JmpSrc being linked is a T4 b instruction.
+    static void linkWithOffset(uint16_t* instruction, intptr_t relative)
+    {
+        // Currently branches > 16m = mostly deathy.
+        if (((relative << 7) >> 7) != relative) {
+            // FIXME: This CRASH means we cannot turn the JIT on by default on arm-v7.
+            fprintf(stderr, "Error: Cannot link T4b.\n");
+            CRASH();
+        }
+        
+        // ARM encoding for the top two bits below the sign bit is 'peculiar'.
+        if (relative >= 0)
+            relative ^= 0xC00000;
+
+        // All branch offsets should be an even distance.
+        ASSERT(!(relative & 1));
+
+        int word1 = ((relative & 0x1000000) >> 14) | ((relative & 0x3ff000) >> 12);
+        int word2 = ((relative & 0x800000) >> 10) | ((relative & 0x400000) >> 11) | ((relative & 0xffe) >> 1);
+
+        instruction[-2] = OP_B_T4a | word1;
+        instruction[-1] = OP_B_T4b | word2;
+    }
+
+    // These functions can be used to splice 16-bit immediates back into previously generated instructions.
+    static void spliceHi5(uint16_t* where, uint16_t what)
+    {
+        uint16_t pattern = (what >> 12) | ((what & 0x0800) >> 1);
+        *where = (*where & 0xFBF0) | pattern;
+    }
+    static void spliceLo11(uint16_t* where, uint16_t what)
+    {
+        uint16_t pattern = ((what & 0x0700) << 4) | (what & 0x00FF);
+        *where = (*where & 0x8F00) | pattern;
+    }
+
+    class ARMInstructionFormatter {
+    public:
+        void oneWordOp5Reg3Imm8(OpcodeID op, RegisterID rd, uint8_t imm)
+        {
+            m_buffer.putShort(op | (rd << 8) | imm);
+        }
+        
+        void oneWordOp5Imm5Reg3Reg3(OpcodeID op, uint8_t imm, RegisterID reg1, RegisterID reg2)
+        {
+            m_buffer.putShort(op | (imm << 6) | (reg1 << 3) | reg2);
+        }
+
+        void oneWordOp7Reg3Reg3Reg3(OpcodeID op, RegisterID reg1, RegisterID reg2, RegisterID reg3)
+        {
+            m_buffer.putShort(op | (reg1 << 6) | (reg2 << 3) | reg3);
+        }
+
+        void oneWordOp8Imm8(OpcodeID op, uint8_t imm)
+        {
+            m_buffer.putShort(op | imm);
+        }
+
+        void oneWordOp8RegReg143(OpcodeID op, RegisterID reg1, RegisterID reg2)
+        {
+            m_buffer.putShort(op | ((reg2 & 8) << 4) | (reg1 << 3) | (reg2 & 7));
+        }
+        void oneWordOp9Imm7(OpcodeID op, uint8_t imm)
+        {
+            m_buffer.putShort(op | imm);
+        }
+
+        void oneWordOp10Reg3Reg3(OpcodeID op, RegisterID reg1, RegisterID reg2)
+        {
+            m_buffer.putShort(op | (reg1 << 3) | reg2);
+        }
+
+        void twoWordOp12Reg4FourFours(OpcodeID1 op, RegisterID reg, FourFours ff)
+        {
+            m_buffer.putShort(op | reg);
+            m_buffer.putShort(ff.m_u.value);
+        }
+        
+        void twoWordOp16FourFours(OpcodeID1 op, FourFours ff)
+        {
+            m_buffer.putShort(op);
+            m_buffer.putShort(ff.m_u.value);
+        }
+        
+        void twoWordOp16Op16(OpcodeID1 op1, OpcodeID2 op2)
+        {
+            m_buffer.putShort(op1);
+            m_buffer.putShort(op2);
+        }
+
+        void twoWordOp5i6Imm4Reg4EncodedImm(OpcodeID1 op, int imm4, RegisterID rd, ARMThumbImmediate imm)
+        {
+            m_buffer.putShort(op | (imm.m_value.i << 10) | imm4);
+            m_buffer.putShort((imm.m_value.imm3 << 12) | (rd << 8) | imm.m_value.imm8);
+        }
+
+        void twoWordOp12Reg4Reg4Imm12(OpcodeID1 op, RegisterID reg1, RegisterID reg2, uint16_t imm)
+        {
+            m_buffer.putShort(op | reg1);
+            m_buffer.putShort((reg2 << 12) | imm);
+        }
+
+        void vfpOp(int32_t op)
+        {
+            m_buffer.putInt(op);
+        }
+
+
+        // Administrative methods:
+
+        size_t size() const { return m_buffer.size(); }
+        bool isAligned(int alignment) const { return m_buffer.isAligned(alignment); }
+        void* data() const { return m_buffer.data(); }
+        void* executableCopy(ExecutablePool* allocator) { return m_buffer.executableCopy(allocator); }
+
+    private:
+        AssemblerBuffer m_buffer;
+    } m_formatter;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER) && PLATFORM_ARM_ARCH(7)
+
+#endif // ARMAssembler_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/AbstractMacroAssembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/AbstractMacroAssembler.h
new file mode 100644
index 0000000..cf94677
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/AbstractMacroAssembler.h
@@ -0,0 +1,721 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef AbstractMacroAssembler_h
+#define AbstractMacroAssembler_h
+
+#include <wtf/Platform.h>
+
+#include <MacroAssemblerCodeRef.h>
+#include <CodeLocation.h>
+#include <wtf/Noncopyable.h>
+#include <wtf/UnusedParam.h>
+
+#if ENABLE(ASSEMBLER)
+
+// FIXME: keep transitioning this out into MacroAssemblerX86_64.
+#if PLATFORM(X86_64)
+#define REPTACH_OFFSET_CALL_R11 3
+#endif
+
+namespace JSC {
+
+template <class AssemblerType>
+class AbstractMacroAssembler {
+public:
+    typedef MacroAssemblerCodePtr CodePtr;
+    typedef MacroAssemblerCodeRef CodeRef;
+
+    class Jump;
+    class LinkBuffer;
+    class RepatchBuffer;
+
+    typedef typename AssemblerType::RegisterID RegisterID;
+    typedef typename AssemblerType::FPRegisterID FPRegisterID;
+    typedef typename AssemblerType::JmpSrc JmpSrc;
+    typedef typename AssemblerType::JmpDst JmpDst;
+
+
+    // Section 1: MacroAssembler operand types
+    //
+    // The following types are used as operands to MacroAssembler operations,
+    // describing immediate  and memory operands to the instructions to be planted.
+
+
+    enum Scale {
+        TimesOne,
+        TimesTwo,
+        TimesFour,
+        TimesEight,
+    };
+
+    // Address:
+    //
+    // Describes a simple base-offset address.
+    struct Address {
+        explicit Address(RegisterID base, int32_t offset = 0)
+            : base(base)
+            , offset(offset)
+        {
+        }
+
+        RegisterID base;
+        int32_t offset;
+    };
+
+    // ImplicitAddress:
+    //
+    // This class is used for explicit 'load' and 'store' operations
+    // (as opposed to situations in which a memory operand is provided
+    // to a generic operation, such as an integer arithmetic instruction).
+    //
+    // In the case of a load (or store) operation we want to permit
+    // addresses to be implicitly constructed, e.g. the two calls:
+    //
+    //     load32(Address(addrReg), destReg);
+    //     load32(addrReg, destReg);
+    //
+    // Are equivalent, and the explicit wrapping of the Address in the former
+    // is unnecessary.
+    struct ImplicitAddress {
+        ImplicitAddress(RegisterID base)
+            : base(base)
+            , offset(0)
+        {
+        }
+
+        ImplicitAddress(Address address)
+            : base(address.base)
+            , offset(address.offset)
+        {
+        }
+
+        RegisterID base;
+        int32_t offset;
+    };
+
+    // BaseIndex:
+    //
+    // Describes a complex addressing mode.
+    struct BaseIndex {
+        BaseIndex(RegisterID base, RegisterID index, Scale scale, int32_t offset = 0)
+            : base(base)
+            , index(index)
+            , scale(scale)
+            , offset(offset)
+        {
+        }
+
+        RegisterID base;
+        RegisterID index;
+        Scale scale;
+        int32_t offset;
+    };
+
+    // AbsoluteAddress:
+    //
+    // Describes an memory operand given by a pointer.  For regular load & store
+    // operations an unwrapped void* will be used, rather than using this.
+    struct AbsoluteAddress {
+        explicit AbsoluteAddress(void* ptr)
+            : m_ptr(ptr)
+        {
+        }
+
+        void* m_ptr;
+    };
+
+    // ImmPtr:
+    //
+    // A pointer sized immediate operand to an instruction - this is wrapped
+    // in a class requiring explicit construction in order to differentiate
+    // from pointers used as absolute addresses to memory operations
+    struct ImmPtr {
+        explicit ImmPtr(void* value)
+            : m_value(value)
+        {
+        }
+
+        intptr_t asIntptr()
+        {
+            return reinterpret_cast<intptr_t>(m_value);
+        }
+
+        void* m_value;
+    };
+
+    // Imm32:
+    //
+    // A 32bit immediate operand to an instruction - this is wrapped in a
+    // class requiring explicit construction in order to prevent RegisterIDs
+    // (which are implemented as an enum) from accidentally being passed as
+    // immediate values.
+    struct Imm32 {
+        explicit Imm32(int32_t value)
+            : m_value(value)
+#if PLATFORM_ARM_ARCH(7)
+            , m_isPointer(false)
+#endif
+        {
+        }
+
+#if !PLATFORM(X86_64)
+        explicit Imm32(ImmPtr ptr)
+            : m_value(ptr.asIntptr())
+#if PLATFORM_ARM_ARCH(7)
+            , m_isPointer(true)
+#endif
+        {
+        }
+#endif
+
+        int32_t m_value;
+#if PLATFORM_ARM_ARCH(7)
+        // We rely on being able to regenerate code to recover exception handling
+        // information.  Since ARMv7 supports 16-bit immediates there is a danger
+        // that if pointer values change the layout of the generated code will change.
+        // To avoid this problem, always generate pointers (and thus Imm32s constructed
+        // from ImmPtrs) with a code sequence that is able  to represent  any pointer
+        // value - don't use a more compact form in these cases.
+        bool m_isPointer;
+#endif
+    };
+
+
+    // Section 2: MacroAssembler code buffer handles
+    //
+    // The following types are used to reference items in the code buffer
+    // during JIT code generation.  For example, the type Jump is used to
+    // track the location of a jump instruction so that it may later be
+    // linked to a label marking its destination.
+
+
+    // Label:
+    //
+    // A Label records a point in the generated instruction stream, typically such that
+    // it may be used as a destination for a jump.
+    class Label {
+        template<class TemplateAssemblerType>
+        friend class AbstractMacroAssembler;
+        friend class Jump;
+        friend class MacroAssemblerCodeRef;
+        friend class LinkBuffer;
+
+    public:
+        Label()
+        {
+        }
+
+        Label(AbstractMacroAssembler<AssemblerType>* masm)
+            : m_label(masm->m_assembler.label())
+        {
+        }
+        
+        bool isUsed() const { return m_label.isUsed(); }
+        void used() { m_label.used(); }
+    private:
+        JmpDst m_label;
+    };
+
+    // DataLabelPtr:
+    //
+    // A DataLabelPtr is used to refer to a location in the code containing a pointer to be
+    // patched after the code has been generated.
+    class DataLabelPtr {
+        template<class TemplateAssemblerType>
+        friend class AbstractMacroAssembler;
+        friend class LinkBuffer;
+    public:
+        DataLabelPtr()
+        {
+        }
+
+        DataLabelPtr(AbstractMacroAssembler<AssemblerType>* masm)
+            : m_label(masm->m_assembler.label())
+        {
+        }
+        
+    private:
+        JmpDst m_label;
+    };
+
+    // DataLabel32:
+    //
+    // A DataLabelPtr is used to refer to a location in the code containing a pointer to be
+    // patched after the code has been generated.
+    class DataLabel32 {
+        template<class TemplateAssemblerType>
+        friend class AbstractMacroAssembler;
+        friend class LinkBuffer;
+    public:
+        DataLabel32()
+        {
+        }
+
+        DataLabel32(AbstractMacroAssembler<AssemblerType>* masm)
+            : m_label(masm->m_assembler.label())
+        {
+        }
+
+    private:
+        JmpDst m_label;
+    };
+
+    // Call:
+    //
+    // A Call object is a reference to a call instruction that has been planted
+    // into the code buffer - it is typically used to link the call, setting the
+    // relative offset such that when executed it will call to the desired
+    // destination.
+    class Call {
+        template<class TemplateAssemblerType>
+        friend class AbstractMacroAssembler;
+        friend class LinkBuffer;
+    public:
+        enum Flags {
+            None = 0x0,
+            Linkable = 0x1,
+            Near = 0x2,
+            LinkableNear = 0x3,
+        };
+
+        Call()
+            : m_flags(None)
+        {
+        }
+        
+        Call(JmpSrc jmp, Flags flags)
+            : m_jmp(jmp)
+            , m_flags(flags)
+        {
+        }
+
+        bool isFlagSet(Flags flag)
+        {
+            return m_flags & flag;
+        }
+
+        static Call fromTailJump(Jump jump)
+        {
+            return Call(jump.m_jmp, Linkable);
+        }
+
+    private:
+        JmpSrc m_jmp;
+        Flags m_flags;
+    };
+
+    // Jump:
+    //
+    // A jump object is a reference to a jump instruction that has been planted
+    // into the code buffer - it is typically used to link the jump, setting the
+    // relative offset such that when executed it will jump to the desired
+    // destination.
+    class Jump {
+        template<class TemplateAssemblerType>
+        friend class AbstractMacroAssembler;
+        friend class Call;
+        friend class LinkBuffer;
+    public:
+        Jump()
+        {
+        }
+        
+        Jump(JmpSrc jmp)    
+            : m_jmp(jmp)
+        {
+        }
+        
+        void link(AbstractMacroAssembler<AssemblerType>* masm)
+        {
+            masm->m_assembler.linkJump(m_jmp, masm->m_assembler.label());
+        }
+        
+        void linkTo(Label label, AbstractMacroAssembler<AssemblerType>* masm)
+        {
+            masm->m_assembler.linkJump(m_jmp, label.m_label);
+        }
+
+    private:
+        JmpSrc m_jmp;
+    };
+
+    // JumpList:
+    //
+    // A JumpList is a set of Jump objects.
+    // All jumps in the set will be linked to the same destination.
+    class JumpList {
+        friend class LinkBuffer;
+
+    public:
+        void link(AbstractMacroAssembler<AssemblerType>* masm)
+        {
+            size_t size = m_jumps.size();
+            for (size_t i = 0; i < size; ++i)
+                m_jumps[i].link(masm);
+            m_jumps.clear();
+        }
+        
+        void linkTo(Label label, AbstractMacroAssembler<AssemblerType>* masm)
+        {
+            size_t size = m_jumps.size();
+            for (size_t i = 0; i < size; ++i)
+                m_jumps[i].linkTo(label, masm);
+            m_jumps.clear();
+        }
+        
+        void append(Jump jump)
+        {
+            m_jumps.append(jump);
+        }
+        
+        void append(JumpList& other)
+        {
+            m_jumps.append(other.m_jumps.begin(), other.m_jumps.size());
+        }
+
+        bool empty()
+        {
+            return !m_jumps.size();
+        }
+
+    private:
+        Vector<Jump, 16> m_jumps;
+    };
+
+
+    // Section 3: LinkBuffer - utility to finalize code generation.
+
+    static CodePtr trampolineAt(CodeRef ref, Label label)
+    {
+        return CodePtr(AssemblerType::getRelocatedAddress(ref.m_code.dataLocation(), label.m_label));
+    }
+
+    // LinkBuffer:
+    //
+    // This class assists in linking code generated by the macro assembler, once code generation
+    // has been completed, and the code has been copied to is final location in memory.  At this
+    // time pointers to labels within the code may be resolved, and relative offsets to external
+    // addresses may be fixed.
+    //
+    // Specifically:
+    //   * Jump objects may be linked to external targets,
+    //   * The address of Jump objects may taken, such that it can later be relinked.
+    //   * The return address of a Jump object representing a call may be acquired.
+    //   * The address of a Label pointing into the code may be resolved.
+    //   * The value referenced by a DataLabel may be fixed.
+    //
+    // FIXME: distinguish between Calls & Jumps (make a specific call to obtain the return
+    // address of calls, as opposed to a point that can be used to later relink a Jump -
+    // possibly wrap the later up in an object that can do just that).
+    class LinkBuffer : public Noncopyable {
+    public:
+        // Note: Initialization sequence is significant, since executablePool is a PassRefPtr.
+        //       First, executablePool is copied into m_executablePool, then the initialization of
+        //       m_code uses m_executablePool, *not* executablePool, since this is no longer valid.
+        LinkBuffer(AbstractMacroAssembler<AssemblerType>* masm, PassRefPtr<ExecutablePool> executablePool)
+            : m_executablePool(executablePool)
+            , m_code(masm->m_assembler.executableCopy(m_executablePool.get()))
+            , m_size(masm->m_assembler.size())
+#ifndef NDEBUG
+            , m_completed(false)
+#endif
+        {
+        }
+
+        ~LinkBuffer()
+        {
+            ASSERT(m_completed);
+        }
+
+        // These methods are used to link or set values at code generation time.
+
+        void link(Call call, FunctionPtr function)
+        {
+            ASSERT(call.isFlagSet(Call::Linkable));
+#if PLATFORM(X86_64)
+            if (!call.isFlagSet(Call::Near)) {
+                char* callLocation = reinterpret_cast<char*>(AssemblerType::getRelocatedAddress(code(), call.m_jmp)) - REPTACH_OFFSET_CALL_R11;
+                AssemblerType::patchPointerForCall(callLocation, function.value());
+            } else
+#endif
+            AssemblerType::linkCall(code(), call.m_jmp, function.value());
+        }
+        
+        void link(Jump jump, CodeLocationLabel label)
+        {
+            AssemblerType::linkJump(code(), jump.m_jmp, label.dataLocation());
+        }
+
+        void link(JumpList list, CodeLocationLabel label)
+        {
+            for (unsigned i = 0; i < list.m_jumps.size(); ++i)
+                AssemblerType::linkJump(code(), list.m_jumps[i].m_jmp, label.dataLocation());
+        }
+
+        void patch(DataLabelPtr label, void* value)
+        {
+            AssemblerType::patchPointer(code(), label.m_label, value);
+        }
+
+        void patch(DataLabelPtr label, CodeLocationLabel value)
+        {
+            AssemblerType::patchPointer(code(), label.m_label, value.executableAddress());
+        }
+
+        // These methods are used to obtain handles to allow the code to be relinked / repatched later.
+
+        CodeLocationCall locationOf(Call call)
+        {
+            ASSERT(call.isFlagSet(Call::Linkable));
+            ASSERT(!call.isFlagSet(Call::Near));
+            return CodeLocationCall(AssemblerType::getRelocatedAddress(code(), call.m_jmp));
+        }
+
+        CodeLocationNearCall locationOfNearCall(Call call)
+        {
+            ASSERT(call.isFlagSet(Call::Linkable));
+            ASSERT(call.isFlagSet(Call::Near));
+            return CodeLocationNearCall(AssemblerType::getRelocatedAddress(code(), call.m_jmp));
+        }
+
+        CodeLocationLabel locationOf(Label label)
+        {
+            return CodeLocationLabel(AssemblerType::getRelocatedAddress(code(), label.m_label));
+        }
+
+        CodeLocationDataLabelPtr locationOf(DataLabelPtr label)
+        {
+            return CodeLocationDataLabelPtr(AssemblerType::getRelocatedAddress(code(), label.m_label));
+        }
+
+        CodeLocationDataLabel32 locationOf(DataLabel32 label)
+        {
+            return CodeLocationDataLabel32(AssemblerType::getRelocatedAddress(code(), label.m_label));
+        }
+
+        // This method obtains the return address of the call, given as an offset from
+        // the start of the code.
+        unsigned returnAddressOffset(Call call)
+        {
+            return AssemblerType::getCallReturnOffset(call.m_jmp);
+        }
+
+        // Upon completion of all patching either 'finalizeCode()' or 'finalizeCodeAddendum()' should be called
+        // once to complete generation of the code.  'finalizeCode()' is suited to situations
+        // where the executable pool must also be retained, the lighter-weight 'finalizeCodeAddendum()' is
+        // suited to adding to an existing allocation.
+        CodeRef finalizeCode()
+        {
+            performFinalization();
+
+            return CodeRef(m_code, m_executablePool, m_size);
+        }
+        CodeLocationLabel finalizeCodeAddendum()
+        {
+            performFinalization();
+
+            return CodeLocationLabel(code());
+        }
+
+    private:
+        // Keep this private! - the underlying code should only be obtained externally via 
+        // finalizeCode() or finalizeCodeAddendum().
+        void* code()
+        {
+            return m_code;
+        }
+
+        void performFinalization()
+        {
+#ifndef NDEBUG
+            ASSERT(!m_completed);
+            m_completed = true;
+#endif
+
+            ExecutableAllocator::makeExecutable(code(), m_size);
+        }
+
+        RefPtr<ExecutablePool> m_executablePool;
+        void* m_code;
+        size_t m_size;
+#ifndef NDEBUG
+        bool m_completed;
+#endif
+    };
+
+    class RepatchBuffer {
+    public:
+        RepatchBuffer()
+        {
+        }
+
+        void relink(CodeLocationJump jump, CodeLocationLabel destination)
+        {
+            AssemblerType::relinkJump(jump.dataLocation(), destination.dataLocation());
+        }
+
+        void relink(CodeLocationCall call, CodeLocationLabel destination)
+        {
+#if PLATFORM(X86_64)
+            repatch(call.dataLabelPtrAtOffset(-REPTACH_OFFSET_CALL_R11), destination.executableAddress());
+#else
+            AssemblerType::relinkCall(call.dataLocation(), destination.executableAddress());
+#endif
+        }
+
+        void relink(CodeLocationCall call, FunctionPtr destination)
+        {
+#if PLATFORM(X86_64)
+            repatch(call.dataLabelPtrAtOffset(-REPTACH_OFFSET_CALL_R11), destination.executableAddress());
+#else
+            AssemblerType::relinkCall(call.dataLocation(), destination.executableAddress());
+#endif
+        }
+
+        void relink(CodeLocationNearCall nearCall, CodePtr destination)
+        {
+            AssemblerType::relinkCall(nearCall.dataLocation(), destination.executableAddress());
+        }
+
+        void relink(CodeLocationNearCall nearCall, CodeLocationLabel destination)
+        {
+            AssemblerType::relinkCall(nearCall.dataLocation(), destination.executableAddress());
+        }
+
+        void relink(CodeLocationNearCall nearCall, FunctionPtr destination)
+        {
+            AssemblerType::relinkCall(nearCall.dataLocation(), destination.executableAddress());
+        }
+
+        void repatch(CodeLocationDataLabel32 dataLabel32, int32_t value)
+        {
+            AssemblerType::repatchInt32(dataLabel32.dataLocation(), value);
+        }
+
+        void repatch(CodeLocationDataLabelPtr dataLabelPtr, void* value)
+        {
+            AssemblerType::repatchPointer(dataLabelPtr.dataLocation(), value);
+        }
+
+        void relinkCallerToTrampoline(ReturnAddressPtr returnAddress, CodeLocationLabel label)
+        {
+            relink(CodeLocationCall(CodePtr(returnAddress)), label);
+        }
+        
+        void relinkCallerToTrampoline(ReturnAddressPtr returnAddress, CodePtr newCalleeFunction)
+        {
+            relinkCallerToTrampoline(returnAddress, CodeLocationLabel(newCalleeFunction));
+        }
+
+        void relinkCallerToFunction(ReturnAddressPtr returnAddress, FunctionPtr function)
+        {
+            relink(CodeLocationCall(CodePtr(returnAddress)), function);
+        }
+        
+        void relinkNearCallerToTrampoline(ReturnAddressPtr returnAddress, CodeLocationLabel label)
+        {
+            relink(CodeLocationNearCall(CodePtr(returnAddress)), label);
+        }
+        
+        void relinkNearCallerToTrampoline(ReturnAddressPtr returnAddress, CodePtr newCalleeFunction)
+        {
+            relinkNearCallerToTrampoline(returnAddress, CodeLocationLabel(newCalleeFunction));
+        }
+
+        void repatchLoadPtrToLEA(CodeLocationInstruction instruction)
+        {
+            AssemblerType::repatchLoadPtrToLEA(instruction.dataLocation());
+        }
+    };
+
+
+    // Section 4: Misc admin methods
+
+    size_t size()
+    {
+        return m_assembler.size();
+    }
+
+    Label label()
+    {
+        return Label(this);
+    }
+    
+    Label align()
+    {
+        m_assembler.align(16);
+        return Label(this);
+    }
+
+    ptrdiff_t differenceBetween(Label from, Jump to)
+    {
+        return AssemblerType::getDifferenceBetweenLabels(from.m_label, to.m_jmp);
+    }
+
+    ptrdiff_t differenceBetween(Label from, Call to)
+    {
+        return AssemblerType::getDifferenceBetweenLabels(from.m_label, to.m_jmp);
+    }
+
+    ptrdiff_t differenceBetween(Label from, Label to)
+    {
+        return AssemblerType::getDifferenceBetweenLabels(from.m_label, to.m_label);
+    }
+
+    ptrdiff_t differenceBetween(Label from, DataLabelPtr to)
+    {
+        return AssemblerType::getDifferenceBetweenLabels(from.m_label, to.m_label);
+    }
+
+    ptrdiff_t differenceBetween(Label from, DataLabel32 to)
+    {
+        return AssemblerType::getDifferenceBetweenLabels(from.m_label, to.m_label);
+    }
+
+    ptrdiff_t differenceBetween(DataLabelPtr from, Jump to)
+    {
+        return AssemblerType::getDifferenceBetweenLabels(from.m_label, to.m_jmp);
+    }
+
+    ptrdiff_t differenceBetween(DataLabelPtr from, DataLabelPtr to)
+    {
+        return AssemblerType::getDifferenceBetweenLabels(from.m_label, to.m_label);
+    }
+
+    ptrdiff_t differenceBetween(DataLabelPtr from, Call to)
+    {
+        return AssemblerType::getDifferenceBetweenLabels(from.m_label, to.m_jmp);
+    }
+
+protected:
+    AssemblerType m_assembler;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
+
+#endif // AbstractMacroAssembler_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h b/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h
index e1f53d8..7a5a8d3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/AssemblerBuffer.h
@@ -132,6 +132,8 @@ namespace JSC {
             if (!result)
                 return 0;
 
+            ExecutableAllocator::makeWritable(result, m_size);
+
             return memcpy(result, m_buffer, m_size);
         }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/CodeLocation.h b/src/3rdparty/webkit/JavaScriptCore/assembler/CodeLocation.h
new file mode 100644
index 0000000..b910b6f
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/CodeLocation.h
@@ -0,0 +1,186 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CodeLocation_h
+#define CodeLocation_h
+
+#include <wtf/Platform.h>
+
+#include <MacroAssemblerCodeRef.h>
+
+#if ENABLE(ASSEMBLER)
+
+namespace JSC {
+
+class CodeLocationInstruction;
+class CodeLocationLabel;
+class CodeLocationJump;
+class CodeLocationCall;
+class CodeLocationNearCall;
+class CodeLocationDataLabel32;
+class CodeLocationDataLabelPtr;
+
+// The CodeLocation* types are all pretty much do-nothing wrappers around
+// CodePtr (or MacroAssemblerCodePtr, to give it its full name).  These
+// classes only exist to provide type-safety when linking and patching code.
+//
+// The one new piece of functionallity introduced by these classes is the
+// ability to create (or put another way, to re-discover) another CodeLocation
+// at an offset from one you already know.  When patching code to optimize it
+// we often want to patch a number of instructions that are short, fixed
+// offsets apart.  To reduce memory overhead we will only retain a pointer to
+// one of the instructions, and we will use the *AtOffset methods provided by
+// CodeLocationCommon to find the other points in the code to modify.
+class CodeLocationCommon : public MacroAssemblerCodePtr {
+public:
+    CodeLocationInstruction instructionAtOffset(int offset);
+    CodeLocationLabel labelAtOffset(int offset);
+    CodeLocationJump jumpAtOffset(int offset);
+    CodeLocationCall callAtOffset(int offset);
+    CodeLocationNearCall nearCallAtOffset(int offset);
+    CodeLocationDataLabelPtr dataLabelPtrAtOffset(int offset);
+    CodeLocationDataLabel32 dataLabel32AtOffset(int offset);
+
+protected:
+    CodeLocationCommon()
+    {
+    }
+
+    CodeLocationCommon(MacroAssemblerCodePtr location)
+        : MacroAssemblerCodePtr(location)
+    {
+    }
+};
+
+class CodeLocationInstruction : public CodeLocationCommon {
+public:
+    CodeLocationInstruction() {}
+    explicit CodeLocationInstruction(MacroAssemblerCodePtr location)
+        : CodeLocationCommon(location) {}
+    explicit CodeLocationInstruction(void* location)
+        : CodeLocationCommon(MacroAssemblerCodePtr(location)) {}
+};
+
+class CodeLocationLabel : public CodeLocationCommon {
+public:
+    CodeLocationLabel() {}
+    explicit CodeLocationLabel(MacroAssemblerCodePtr location)
+        : CodeLocationCommon(location) {}
+    explicit CodeLocationLabel(void* location)
+        : CodeLocationCommon(MacroAssemblerCodePtr(location)) {}
+};
+
+class CodeLocationJump : public CodeLocationCommon {
+public:
+    CodeLocationJump() {}
+    explicit CodeLocationJump(MacroAssemblerCodePtr location)
+        : CodeLocationCommon(location) {}
+    explicit CodeLocationJump(void* location)
+        : CodeLocationCommon(MacroAssemblerCodePtr(location)) {}
+};
+
+class CodeLocationCall : public CodeLocationCommon {
+public:
+    CodeLocationCall() {}
+    explicit CodeLocationCall(MacroAssemblerCodePtr location)
+        : CodeLocationCommon(location) {}
+    explicit CodeLocationCall(void* location)
+        : CodeLocationCommon(MacroAssemblerCodePtr(location)) {}
+};
+
+class CodeLocationNearCall : public CodeLocationCommon {
+public:
+    CodeLocationNearCall() {}
+    explicit CodeLocationNearCall(MacroAssemblerCodePtr location)
+        : CodeLocationCommon(location) {}
+    explicit CodeLocationNearCall(void* location)
+        : CodeLocationCommon(MacroAssemblerCodePtr(location)) {}
+};
+
+class CodeLocationDataLabel32 : public CodeLocationCommon {
+public:
+    CodeLocationDataLabel32() {}
+    explicit CodeLocationDataLabel32(MacroAssemblerCodePtr location)
+        : CodeLocationCommon(location) {}
+    explicit CodeLocationDataLabel32(void* location)
+        : CodeLocationCommon(MacroAssemblerCodePtr(location)) {}
+};
+
+class CodeLocationDataLabelPtr : public CodeLocationCommon {
+public:
+    CodeLocationDataLabelPtr() {}
+    explicit CodeLocationDataLabelPtr(MacroAssemblerCodePtr location)
+        : CodeLocationCommon(location) {}
+    explicit CodeLocationDataLabelPtr(void* location)
+        : CodeLocationCommon(MacroAssemblerCodePtr(location)) {}
+};
+
+inline CodeLocationInstruction CodeLocationCommon::instructionAtOffset(int offset)
+{
+    ASSERT_VALID_CODE_OFFSET(offset);
+    return CodeLocationInstruction(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+inline CodeLocationLabel CodeLocationCommon::labelAtOffset(int offset)
+{
+    ASSERT_VALID_CODE_OFFSET(offset);
+    return CodeLocationLabel(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+inline CodeLocationJump CodeLocationCommon::jumpAtOffset(int offset)
+{
+    ASSERT_VALID_CODE_OFFSET(offset);
+    return CodeLocationJump(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+inline CodeLocationCall CodeLocationCommon::callAtOffset(int offset)
+{
+    ASSERT_VALID_CODE_OFFSET(offset);
+    return CodeLocationCall(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+inline CodeLocationNearCall CodeLocationCommon::nearCallAtOffset(int offset)
+{
+    ASSERT_VALID_CODE_OFFSET(offset);
+    return CodeLocationNearCall(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+inline CodeLocationDataLabelPtr CodeLocationCommon::dataLabelPtrAtOffset(int offset)
+{
+    ASSERT_VALID_CODE_OFFSET(offset);
+    return CodeLocationDataLabelPtr(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+inline CodeLocationDataLabel32 CodeLocationCommon::dataLabel32AtOffset(int offset)
+{
+    ASSERT_VALID_CODE_OFFSET(offset);
+    return CodeLocationDataLabel32(reinterpret_cast<char*>(dataLocation()) + offset);
+}
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
+
+#endif // CodeLocation_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h
index 9f8d474..43d27e7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssembler.h
@@ -30,1896 +30,310 @@
 
 #if ENABLE(ASSEMBLER)
 
-#include "X86Assembler.h"
+#if PLATFORM_ARM_ARCH(7)
+#include "MacroAssemblerARMv7.h"
+namespace JSC { typedef MacroAssemblerARMv7 MacroAssemblerBase; };
 
-namespace JSC {
+#elif PLATFORM(X86)
+#include "MacroAssemblerX86.h"
+namespace JSC { typedef MacroAssemblerX86 MacroAssemblerBase; };
 
-class MacroAssembler {
-protected:
-    X86Assembler m_assembler;
+#elif PLATFORM(X86_64)
+#include "MacroAssemblerX86_64.h"
+namespace JSC { typedef MacroAssemblerX86_64 MacroAssemblerBase; };
 
-#if PLATFORM(X86_64)
-    static const X86::RegisterID scratchRegister = X86::r11;
+#else
+#error "The MacroAssembler is not supported on this platform."
 #endif
 
+
+namespace JSC {
+
+class MacroAssembler : public MacroAssemblerBase {
 public:
-    typedef X86::RegisterID RegisterID;
-
-    // Note: do not rely on values in this enum, these will change (to 0..3).
-    enum Scale {
-        TimesOne = 1,
-        TimesTwo = 2,
-        TimesFour = 4,
-        TimesEight = 8,
-#if PLATFORM(X86)
-        ScalePtr = TimesFour
-#endif
+
+    using MacroAssemblerBase::pop;
+    using MacroAssemblerBase::jump;
+    using MacroAssemblerBase::branch32;
+    using MacroAssemblerBase::branch16;
 #if PLATFORM(X86_64)
-        ScalePtr = TimesEight
+    using MacroAssemblerBase::branchPtr;
+    using MacroAssemblerBase::branchTestPtr;
 #endif
-    };
 
-    MacroAssembler()
+
+    // Platform agnostic onvenience functions,
+    // described in terms of other macro assembly methods.
+    void pop()
     {
+        addPtr(Imm32(sizeof(void*)), stackPointerRegister);
     }
     
-    size_t size() { return m_assembler.size(); }
-    void* copyCode(ExecutablePool* allocator)
+    void peek(RegisterID dest, int index = 0)
     {
-        return m_assembler.executableCopy(allocator);
+        loadPtr(Address(stackPointerRegister, (index * sizeof(void*))), dest);
     }
 
-
-    // Address:
-    //
-    // Describes a simple base-offset address.
-    struct Address {
-        explicit Address(RegisterID base, int32_t offset = 0)
-            : base(base)
-            , offset(offset)
-        {
-        }
-
-        RegisterID base;
-        int32_t offset;
-    };
-
-    // ImplicitAddress:
-    //
-    // This class is used for explicit 'load' and 'store' operations
-    // (as opposed to situations in which a memory operand is provided
-    // to a generic operation, such as an integer arithmetic instruction).
-    //
-    // In the case of a load (or store) operation we want to permit
-    // addresses to be implicitly constructed, e.g. the two calls:
-    //
-    //     load32(Address(addrReg), destReg);
-    //     load32(addrReg, destReg);
-    //
-    // Are equivalent, and the explicit wrapping of the Address in the former
-    // is unnecessary.
-    struct ImplicitAddress {
-        ImplicitAddress(RegisterID base)
-            : base(base)
-            , offset(0)
-        {
-        }
-
-        ImplicitAddress(Address address)
-            : base(address.base)
-            , offset(address.offset)
-        {
-        }
-
-        RegisterID base;
-        int32_t offset;
-    };
-
-    // BaseIndex:
-    //
-    // Describes a complex addressing mode.
-    struct BaseIndex {
-        BaseIndex(RegisterID base, RegisterID index, Scale scale, int32_t offset = 0)
-            : base(base)
-            , index(index)
-            , scale(scale)
-            , offset(offset)
-        {
-        }
-
-        RegisterID base;
-        RegisterID index;
-        Scale scale;
-        int32_t offset;
-    };
-
-    // AbsoluteAddress:
-    //
-    // Describes an memory operand given by a pointer.  For regular load & store
-    // operations an unwrapped void* will be used, rather than using this.
-    struct AbsoluteAddress {
-        explicit AbsoluteAddress(void* ptr)
-            : m_ptr(ptr)
-        {
-        }
-
-        void* m_ptr;
-    };
-
-
-    class Jump;
-    class PatchBuffer;
-
-    // DataLabelPtr:
-    //
-    // A DataLabelPtr is used to refer to a location in the code containing a pointer to be
-    // patched after the code has been generated.
-    class DataLabelPtr {
-        friend class MacroAssembler;
-        friend class PatchBuffer;
-
-    public:
-        DataLabelPtr()
-        {
-        }
-
-        DataLabelPtr(MacroAssembler* masm)
-            : m_label(masm->m_assembler.label())
-        {
-        }
-
-        static void patch(void* address, void* value)
-        {
-            X86Assembler::patchPointer(reinterpret_cast<intptr_t>(address), reinterpret_cast<intptr_t>(value));
-        }
-        
-    private:
-        X86Assembler::JmpDst m_label;
-    };
-
-    // DataLabel32:
-    //
-    // A DataLabelPtr is used to refer to a location in the code containing a pointer to be
-    // patched after the code has been generated.
-    class DataLabel32 {
-        friend class MacroAssembler;
-        friend class PatchBuffer;
-
-    public:
-        DataLabel32()
-        {
-        }
-
-        DataLabel32(MacroAssembler* masm)
-            : m_label(masm->m_assembler.label())
-        {
-        }
-
-        static void patch(void* address, int32_t value)
-        {
-            X86Assembler::patchImmediate(reinterpret_cast<intptr_t>(address), value);
-        }
-
-    private:
-        X86Assembler::JmpDst m_label;
-    };
-
-    // Label:
-    //
-    // A Label records a point in the generated instruction stream, typically such that
-    // it may be used as a destination for a jump.
-    class Label {
-        friend class Jump;
-        friend class MacroAssembler;
-        friend class PatchBuffer;
-
-    public:
-        Label()
-        {
-        }
-
-        Label(MacroAssembler* masm)
-            : m_label(masm->m_assembler.label())
-        {
-        }
-        
-        // FIXME: transitionary method, while we replace JmpSrces with Jumps.
-        operator X86Assembler::JmpDst()
-        {
-            return m_label;
-        }
-
-    private:
-        X86Assembler::JmpDst m_label;
-    };
-
-
-    // Jump:
-    //
-    // A jump object is a reference to a jump instruction that has been planted
-    // into the code buffer - it is typically used to link the jump, setting the
-    // relative offset such that when executed it will jump to the desired
-    // destination.
-    //
-    // Jump objects retain a pointer to the assembler for syntactic purposes -
-    // to allow the jump object to be able to link itself, e.g.:
-    //
-    //     Jump forwardsBranch = jne32(Imm32(0), reg1);
-    //     // ...
-    //     forwardsBranch.link();
-    //
-    // Jumps may also be linked to a Label.
-    class Jump {
-        friend class PatchBuffer;
-        friend class MacroAssembler;
-
-    public:
-        Jump()
-        {
-        }
-        
-        // FIXME: transitionary method, while we replace JmpSrces with Jumps.
-        Jump(X86Assembler::JmpSrc jmp)
-            : m_jmp(jmp)
-        {
-        }
-        
-        void link(MacroAssembler* masm)
-        {
-            masm->m_assembler.link(m_jmp, masm->m_assembler.label());
-        }
-        
-        void linkTo(Label label, MacroAssembler* masm)
-        {
-            masm->m_assembler.link(m_jmp, label.m_label);
-        }
-        
-        // FIXME: transitionary method, while we replace JmpSrces with Jumps.
-        operator X86Assembler::JmpSrc()
-        {
-            return m_jmp;
-        }
-
-        static void patch(void* address, void* destination)
-        {
-            X86Assembler::patchBranchOffset(reinterpret_cast<intptr_t>(address), destination);
-        }
-
-    private:
-        X86Assembler::JmpSrc m_jmp;
-    };
-
-    // JumpList:
-    //
-    // A JumpList is a set of Jump objects.
-    // All jumps in the set will be linked to the same destination.
-    class JumpList {
-        friend class PatchBuffer;
-
-    public:
-        void link(MacroAssembler* masm)
-        {
-            size_t size = m_jumps.size();
-            for (size_t i = 0; i < size; ++i)
-                m_jumps[i].link(masm);
-            m_jumps.clear();
-        }
-        
-        void linkTo(Label label, MacroAssembler* masm)
-        {
-            size_t size = m_jumps.size();
-            for (size_t i = 0; i < size; ++i)
-                m_jumps[i].linkTo(label, masm);
-            m_jumps.clear();
-        }
-        
-        void append(Jump jump)
-        {
-            m_jumps.append(jump);
-        }
-        
-        void append(JumpList& other)
-        {
-            m_jumps.append(other.m_jumps.begin(), other.m_jumps.size());
-        }
-
-        bool empty()
-        {
-            return !m_jumps.size();
-        }
-
-    private:
-        Vector<Jump, 16> m_jumps;
-    };
-
-
-    // PatchBuffer:
-    //
-    // This class assists in linking code generated by the macro assembler, once code generation
-    // has been completed, and the code has been copied to is final location in memory.  At this
-    // time pointers to labels within the code may be resolved, and relative offsets to external
-    // addresses may be fixed.
-    //
-    // Specifically:
-    //   * Jump objects may be linked to external targets,
-    //   * The address of Jump objects may taken, such that it can later be relinked.
-    //   * The return address of a Jump object representing a call may be acquired.
-    //   * The address of a Label pointing into the code may be resolved.
-    //   * The value referenced by a DataLabel may be fixed.
-    //
-    // FIXME: distinguish between Calls & Jumps (make a specific call to obtain the return
-    // address of calls, as opposed to a point that can be used to later relink a Jump -
-    // possibly wrap the later up in an object that can do just that).
-    class PatchBuffer {
-    public:
-        PatchBuffer(void* code)
-            : m_code(code)
-        {
-        }
-
-        void link(Jump jump, void* target)
-        {
-            X86Assembler::link(m_code, jump.m_jmp, target);
-        }
-
-        void link(JumpList list, void* target)
-        {
-            for (unsigned i = 0; i < list.m_jumps.size(); ++i)
-                X86Assembler::link(m_code, list.m_jumps[i], target);
-        }
-
-        void* addressOf(Jump jump)
-        {
-            return X86Assembler::getRelocatedAddress(m_code, jump.m_jmp);
-        }
-
-        void* addressOf(Label label)
-        {
-            return X86Assembler::getRelocatedAddress(m_code, label.m_label);
-        }
-
-        void* addressOf(DataLabelPtr label)
-        {
-            return X86Assembler::getRelocatedAddress(m_code, label.m_label);
-        }
-
-        void* addressOf(DataLabel32 label)
-        {
-            return X86Assembler::getRelocatedAddress(m_code, label.m_label);
-        }
-
-        void setPtr(DataLabelPtr label, void* value)
-        {
-            X86Assembler::patchAddress(m_code, label.m_label, value);
-        }
-
-    private:
-        void* m_code;
-    };
- 
-
-    // ImmPtr:
-    //
-    // A pointer sized immediate operand to an instruction - this is wrapped
-    // in a class requiring explicit construction in order to differentiate
-    // from pointers used as absolute addresses to memory operations
-    struct ImmPtr {
-        explicit ImmPtr(void* value)
-            : m_value(value)
-        {
-        }
-
-        intptr_t asIntptr()
-        {
-            return reinterpret_cast<intptr_t>(m_value);
-        }
-
-        void* m_value;
-    };
-
-
-    // Imm32:
-    //
-    // A 32bit immediate operand to an instruction - this is wrapped in a
-    // class requiring explicit construction in order to prevent RegisterIDs
-    // (which are implemented as an enum) from accidentally being passed as
-    // immediate values.
-    struct Imm32 {
-        explicit Imm32(int32_t value)
-            : m_value(value)
-        {
-        }
-
-#if PLATFORM(X86)
-        explicit Imm32(ImmPtr ptr)
-            : m_value(ptr.asIntptr())
-        {
-        }
-#endif
-
-        int32_t m_value;
-    };
-
-    // Integer arithmetic operations:
-    //
-    // Operations are typically two operand - operation(source, srcDst)
-    // For many operations the source may be an Imm32, the srcDst operand
-    // may often be a memory location (explictly described using an Address
-    // object).
-
-    void addPtr(RegisterID src, RegisterID dest)
+    void poke(RegisterID src, int index = 0)
     {
-#if PLATFORM(X86_64)
-        m_assembler.addq_rr(src, dest);
-#else
-        add32(src, dest);
-#endif
+        storePtr(src, Address(stackPointerRegister, (index * sizeof(void*))));
     }
 
-    void addPtr(Imm32 imm, RegisterID srcDest)
+    void poke(Imm32 value, int index = 0)
     {
-#if PLATFORM(X86_64)
-        m_assembler.addq_ir(imm.m_value, srcDest);
-#else
-        add32(imm, srcDest);
-#endif
+        store32(value, Address(stackPointerRegister, (index * sizeof(void*))));
     }
 
-    void addPtr(Imm32 imm, RegisterID src, RegisterID dest)
+    void poke(ImmPtr imm, int index = 0)
     {
-        m_assembler.leal_mr(imm.m_value, src, dest);
+        storePtr(imm, Address(stackPointerRegister, (index * sizeof(void*))));
     }
 
-    void add32(RegisterID src, RegisterID dest)
+
+    // Backwards banches, these are currently all implemented using existing forwards branch mechanisms.
+    void branchPtr(Condition cond, RegisterID op1, ImmPtr imm, Label target)
     {
-        m_assembler.addl_rr(src, dest);
+        branchPtr(cond, op1, imm).linkTo(target, this);
     }
 
-    void add32(Imm32 imm, Address address)
+    void branch32(Condition cond, RegisterID op1, RegisterID op2, Label target)
     {
-        m_assembler.addl_im(imm.m_value, address.offset, address.base);
+        branch32(cond, op1, op2).linkTo(target, this);
     }
 
-    void add32(Imm32 imm, RegisterID dest)
+    void branch32(Condition cond, RegisterID op1, Imm32 imm, Label target)
     {
-        m_assembler.addl_ir(imm.m_value, dest);
+        branch32(cond, op1, imm).linkTo(target, this);
     }
-    
-    void add32(Imm32 imm, AbsoluteAddress address)
+
+    void branch32(Condition cond, RegisterID left, Address right, Label target)
     {
-#if PLATFORM(X86_64)
-        move(ImmPtr(address.m_ptr), scratchRegister);
-        add32(imm, Address(scratchRegister));
-#else
-        m_assembler.addl_im(imm.m_value, address.m_ptr);
-#endif
+        branch32(cond, left, right).linkTo(target, this);
     }
-    
-    void add32(Address src, RegisterID dest)
+
+    void branch16(Condition cond, BaseIndex left, RegisterID right, Label target)
     {
-        m_assembler.addl_mr(src.offset, src.base, dest);
+        branch16(cond, left, right).linkTo(target, this);
     }
     
-    void andPtr(RegisterID src, RegisterID dest)
+    void branchTestPtr(Condition cond, RegisterID reg, Label target)
     {
-#if PLATFORM(X86_64)
-        m_assembler.andq_rr(src, dest);
-#else
-        and32(src, dest);
-#endif
+        branchTestPtr(cond, reg).linkTo(target, this);
     }
 
-    void andPtr(Imm32 imm, RegisterID srcDest)
+    void jump(Label target)
     {
-#if PLATFORM(X86_64)
-        m_assembler.andq_ir(imm.m_value, srcDest);
-#else
-        and32(imm, srcDest);
-#endif
+        jump().linkTo(target, this);
     }
 
-    void and32(RegisterID src, RegisterID dest)
-    {
-        m_assembler.andl_rr(src, dest);
-    }
 
-    void and32(Imm32 imm, RegisterID dest)
+    // Ptr methods
+    // On 32-bit platforms (i.e. x86), these methods directly map onto their 32-bit equivalents.
+#if !PLATFORM(X86_64)
+    void addPtr(RegisterID src, RegisterID dest)
     {
-        m_assembler.andl_ir(imm.m_value, dest);
+        add32(src, dest);
     }
 
-    void lshift32(Imm32 imm, RegisterID dest)
+    void addPtr(Imm32 imm, RegisterID srcDest)
     {
-        m_assembler.shll_i8r(imm.m_value, dest);
+        add32(imm, srcDest);
     }
-    
-    void lshift32(RegisterID shift_amount, RegisterID dest)
+
+    void addPtr(ImmPtr imm, RegisterID dest)
     {
-        // On x86 we can only shift by ecx; if asked to shift by another register we'll
-        // need rejig the shift amount into ecx first, and restore the registers afterwards.
-        if (shift_amount != X86::ecx) {
-            swap(shift_amount, X86::ecx);
-
-            // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
-            if (dest == shift_amount)
-                m_assembler.shll_CLr(X86::ecx);
-            // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
-            else if (dest == X86::ecx)
-                m_assembler.shll_CLr(shift_amount);
-            // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
-            else
-                m_assembler.shll_CLr(dest);
-        
-            swap(shift_amount, X86::ecx);
-        } else
-            m_assembler.shll_CLr(dest);
+        add32(Imm32(imm), dest);
     }
-    
-    // Take the value from dividend, divide it by divisor, and put the remainder in remainder.
-    // For now, this operation has specific register requirements, and the three register must
-    // be unique.  It is unfortunate to expose this in the MacroAssembler interface, however
-    // given the complexity to fix, the fact that it is not uncommmon  for processors to have
-    // specific register requirements on this operation (e.g. Mips result in 'hi'), or to not
-    // support a hardware divide at all, it may not be 
-    void mod32(RegisterID divisor, RegisterID dividend, RegisterID remainder)
-    {
-#ifdef NDEBUG
-#pragma unused(dividend,remainder)
-#else
-        ASSERT((dividend == X86::eax) && (remainder == X86::edx));
-        ASSERT((dividend != divisor) && (remainder != divisor));
-#endif
 
-        m_assembler.cdq();
-        m_assembler.idivl_r(divisor);
+    void addPtr(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        add32(imm, src, dest);
     }
 
-    void mul32(Imm32 imm, RegisterID src, RegisterID dest)
+    void andPtr(RegisterID src, RegisterID dest)
     {
-        m_assembler.imull_i32r(src, imm.m_value, dest);
+        and32(src, dest);
     }
-    
-    void not32(RegisterID srcDest)
+
+    void andPtr(Imm32 imm, RegisterID srcDest)
     {
-        m_assembler.notl_r(srcDest);
+        and32(imm, srcDest);
     }
-    
+
     void orPtr(RegisterID src, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        m_assembler.orq_rr(src, dest);
-#else
         or32(src, dest);
-#endif
     }
 
     void orPtr(ImmPtr imm, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        move(imm, scratchRegister);
-        m_assembler.orq_rr(scratchRegister, dest);
-#else
         or32(Imm32(imm), dest);
-#endif
     }
 
     void orPtr(Imm32 imm, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        m_assembler.orq_ir(imm.m_value, dest);
-#else
         or32(imm, dest);
-#endif
-    }
-
-    void or32(RegisterID src, RegisterID dest)
-    {
-        m_assembler.orl_rr(src, dest);
-    }
-
-    void or32(Imm32 imm, RegisterID dest)
-    {
-        m_assembler.orl_ir(imm.m_value, dest);
     }
 
     void rshiftPtr(RegisterID shift_amount, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        // On x86 we can only shift by ecx; if asked to shift by another register we'll
-        // need rejig the shift amount into ecx first, and restore the registers afterwards.
-        if (shift_amount != X86::ecx) {
-            swap(shift_amount, X86::ecx);
-
-            // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
-            if (dest == shift_amount)
-                m_assembler.sarq_CLr(X86::ecx);
-            // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
-            else if (dest == X86::ecx)
-                m_assembler.sarq_CLr(shift_amount);
-            // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
-            else
-                m_assembler.sarq_CLr(dest);
-        
-            swap(shift_amount, X86::ecx);
-        } else
-            m_assembler.sarq_CLr(dest);
-#else
         rshift32(shift_amount, dest);
-#endif
     }
 
     void rshiftPtr(Imm32 imm, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        m_assembler.sarq_i8r(imm.m_value, dest);
-#else
         rshift32(imm, dest);
-#endif
-    }
-
-    void rshift32(RegisterID shift_amount, RegisterID dest)
-    {
-        // On x86 we can only shift by ecx; if asked to shift by another register we'll
-        // need rejig the shift amount into ecx first, and restore the registers afterwards.
-        if (shift_amount != X86::ecx) {
-            swap(shift_amount, X86::ecx);
-
-            // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
-            if (dest == shift_amount)
-                m_assembler.sarl_CLr(X86::ecx);
-            // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
-            else if (dest == X86::ecx)
-                m_assembler.sarl_CLr(shift_amount);
-            // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
-            else
-                m_assembler.sarl_CLr(dest);
-        
-            swap(shift_amount, X86::ecx);
-        } else
-            m_assembler.sarl_CLr(dest);
     }
 
-    void rshift32(Imm32 imm, RegisterID dest)
+    void subPtr(RegisterID src, RegisterID dest)
     {
-        m_assembler.sarl_i8r(imm.m_value, dest);
+        sub32(src, dest);
     }
-
+    
     void subPtr(Imm32 imm, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        m_assembler.subq_ir(imm.m_value, dest);
-#else
         sub32(imm, dest);
-#endif
     }
     
-    void sub32(Imm32 imm, RegisterID dest)
-    {
-        m_assembler.subl_ir(imm.m_value, dest);
-    }
-    
-    void sub32(Imm32 imm, Address address)
-    {
-        m_assembler.subl_im(imm.m_value, address.offset, address.base);
-    }
-
-    void sub32(Imm32 imm, AbsoluteAddress address)
-    {
-#if PLATFORM(X86_64)
-        move(ImmPtr(address.m_ptr), scratchRegister);
-        sub32(imm, Address(scratchRegister));
-#else
-        m_assembler.subl_im(imm.m_value, address.m_ptr);
-#endif
-    }
-
-    void sub32(Address src, RegisterID dest)
+    void subPtr(ImmPtr imm, RegisterID dest)
     {
-        m_assembler.subl_mr(src.offset, src.base, dest);
+        sub32(Imm32(imm), dest);
     }
 
     void xorPtr(RegisterID src, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        m_assembler.xorq_rr(src, dest);
-#else
         xor32(src, dest);
-#endif
     }
 
     void xorPtr(Imm32 imm, RegisterID srcDest)
     {
-#if PLATFORM(X86_64)
-        m_assembler.xorq_ir(imm.m_value, srcDest);
-#else
         xor32(imm, srcDest);
-#endif
     }
 
-    void xor32(RegisterID src, RegisterID dest)
-    {
-        m_assembler.xorl_rr(src, dest);
-    }
-
-    void xor32(Imm32 imm, RegisterID srcDest)
-    {
-        m_assembler.xorl_ir(imm.m_value, srcDest);
-    }
-    
-
-    // Memory access operations:
-    //
-    // Loads are of the form load(address, destination) and stores of the form
-    // store(source, address).  The source for a store may be an Imm32.  Address
-    // operand objects to loads and store will be implicitly constructed if a
-    // register is passed.
 
     void loadPtr(ImplicitAddress address, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        m_assembler.movq_mr(address.offset, address.base, dest);
-#else
         load32(address, dest);
-#endif
-    }
-
-    DataLabel32 loadPtrWithAddressOffsetPatch(Address address, RegisterID dest)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.movq_mr_disp32(address.offset, address.base, dest);
-        return DataLabel32(this);
-#else
-        m_assembler.movl_mr_disp32(address.offset, address.base, dest);
-        return DataLabel32(this);
-#endif
     }
 
     void loadPtr(BaseIndex address, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        m_assembler.movq_mr(address.offset, address.base, address.index, address.scale, dest);
-#else
         load32(address, dest);
-#endif
     }
 
     void loadPtr(void* address, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        if (dest == X86::eax)
-            m_assembler.movq_mEAX(address);
-        else {
-            move(X86::eax, dest);
-            m_assembler.movq_mEAX(address);
-            swap(X86::eax, dest);
-        }
-#else
         load32(address, dest);
-#endif
-    }
-
-    void load32(ImplicitAddress address, RegisterID dest)
-    {
-        m_assembler.movl_mr(address.offset, address.base, dest);
     }
 
-    void load32(BaseIndex address, RegisterID dest)
+    DataLabel32 loadPtrWithAddressOffsetPatch(Address address, RegisterID dest)
     {
-        m_assembler.movl_mr(address.offset, address.base, address.index, address.scale, dest);
+        return load32WithAddressOffsetPatch(address, dest);
     }
 
-    void load32(void* address, RegisterID dest)
+    void setPtr(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        if (dest == X86::eax)
-            m_assembler.movl_mEAX(address);
-        else {
-            move(X86::eax, dest);
-            m_assembler.movl_mEAX(address);
-            swap(X86::eax, dest);
-        }
-#else
-        m_assembler.movl_mr(address, dest);
-#endif
-    }
-
-    void load16(BaseIndex address, RegisterID dest)
-    {
-        m_assembler.movzwl_mr(address.offset, address.base, address.index, address.scale, dest);
+        set32(cond, left, right, dest);
     }
 
     void storePtr(RegisterID src, ImplicitAddress address)
     {
-#if PLATFORM(X86_64)
-        m_assembler.movq_rm(src, address.offset, address.base);
-#else
         store32(src, address);
-#endif
-    }
-
-    DataLabel32 storePtrWithAddressOffsetPatch(RegisterID src, Address address)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.movq_rm_disp32(src, address.offset, address.base);
-        return DataLabel32(this);
-#else
-        m_assembler.movl_rm_disp32(src, address.offset, address.base);
-        return DataLabel32(this);
-#endif
     }
 
     void storePtr(RegisterID src, BaseIndex address)
     {
-#if PLATFORM(X86_64)
-        m_assembler.movq_rm(src, address.offset, address.base, address.index, address.scale);
-#else
         store32(src, address);
-#endif
-    }
-
-    void storePtr(ImmPtr imm, ImplicitAddress address)
-    {
-#if PLATFORM(X86_64)
-        move(imm, scratchRegister);
-        storePtr(scratchRegister, address);
-#else
-        m_assembler.movl_i32m(imm.asIntptr(), address.offset, address.base);
-#endif
-    }
-
-    DataLabelPtr storePtrWithPatch(Address address)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.movq_i64r(0, scratchRegister);
-        DataLabelPtr label(this);
-        storePtr(scratchRegister, address);
-        return label;
-#else
-        m_assembler.movl_i32m(0, address.offset, address.base);
-        return DataLabelPtr(this);
-#endif
-    }
-
-    void store32(RegisterID src, ImplicitAddress address)
-    {
-        m_assembler.movl_rm(src, address.offset, address.base);
-    }
-
-    void store32(RegisterID src, BaseIndex address)
-    {
-        m_assembler.movl_rm(src, address.offset, address.base, address.index, address.scale);
-    }
-
-    void store32(Imm32 imm, ImplicitAddress address)
-    {
-        m_assembler.movl_i32m(imm.m_value, address.offset, address.base);
-    }
-    
-    void store32(Imm32 imm, void* address)
-    {
-#if PLATFORM(X86_64)
-        move(X86::eax, scratchRegister);
-        move(imm, X86::eax);
-        m_assembler.movl_EAXm(address);
-        move(scratchRegister, X86::eax);
-#else
-        m_assembler.movl_i32m(imm.m_value, address);
-#endif
-    }
-
-
-    // Stack manipulation operations:
-    //
-    // The ABI is assumed to provide a stack abstraction to memory,
-    // containing machine word sized units of data.  Push and pop
-    // operations add and remove a single register sized unit of data
-    // to or from the stack.  Peek and poke operations read or write
-    // values on the stack, without moving the current stack position.
-    
-    void pop(RegisterID dest)
-    {
-        m_assembler.pop_r(dest);
-    }
-
-    void push(RegisterID src)
-    {
-        m_assembler.push_r(src);
-    }
-
-    void push(Address address)
-    {
-        m_assembler.push_m(address.offset, address.base);
-    }
-
-    void push(Imm32 imm)
-    {
-        m_assembler.push_i32(imm.m_value);
-    }
-
-    void pop()
-    {
-        addPtr(Imm32(sizeof(void*)), X86::esp);
-    }
-    
-    void peek(RegisterID dest, int index = 0)
-    {
-        loadPtr(Address(X86::esp, (index * sizeof(void *))), dest);
-    }
-
-    void poke(RegisterID src, int index = 0)
-    {
-        storePtr(src, Address(X86::esp, (index * sizeof(void *))));
-    }
-
-    void poke(Imm32 value, int index = 0)
-    {
-        store32(value, Address(X86::esp, (index * sizeof(void *))));
-    }
-
-    void poke(ImmPtr imm, int index = 0)
-    {
-        storePtr(imm, Address(X86::esp, (index * sizeof(void *))));
-    }
-
-    // Register move operations:
-    //
-    // Move values in registers.
-
-    void move(Imm32 imm, RegisterID dest)
-    {
-        // Note: on 64-bit the Imm32 value is zero extended into the register, it
-        // may be useful to have a separate version that sign extends the value?
-        if (!imm.m_value)
-            m_assembler.xorl_rr(dest, dest);
-        else
-            m_assembler.movl_i32r(imm.m_value, dest);
-    }
-
-    void move(RegisterID src, RegisterID dest)
-    {
-        // Note: on 64-bit this is is a full register move; perhaps it would be
-        // useful to have separate move32 & movePtr, with move32 zero extending?
-#if PLATFORM(X86_64)
-        m_assembler.movq_rr(src, dest);
-#else
-        m_assembler.movl_rr(src, dest);
-#endif
-    }
-
-    void move(ImmPtr imm, RegisterID dest)
-    {
-#if PLATFORM(X86_64)
-        if (CAN_SIGN_EXTEND_U32_64(imm.asIntptr()))
-            m_assembler.movl_i32r(static_cast<int32_t>(imm.asIntptr()), dest);
-        else
-            m_assembler.movq_i64r(imm.asIntptr(), dest);
-#else
-        m_assembler.movl_i32r(imm.asIntptr(), dest);
-#endif
-    }
-
-    void swap(RegisterID reg1, RegisterID reg2)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.xchgq_rr(reg1, reg2);
-#else
-        m_assembler.xchgl_rr(reg1, reg2);
-#endif
-    }
-
-    void signExtend32ToPtr(RegisterID src, RegisterID dest)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.movsxd_rr(src, dest);
-#else
-        if (src != dest)
-            move(src, dest);
-#endif
-    }
-
-    void zeroExtend32ToPtr(RegisterID src, RegisterID dest)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.movl_rr(src, dest);
-#else
-        if (src != dest)
-            move(src, dest);
-#endif
-    }
-
-
-    // Forwards / external control flow operations:
-    //
-    // This set of jump and conditional branch operations return a Jump
-    // object which may linked at a later point, allow forwards jump,
-    // or jumps that will require external linkage (after the code has been
-    // relocated).
-    //
-    // For branches, signed <, >, <= and >= are denoted as l, g, le, and ge
-    // respecitvely, for unsigned comparisons the names b, a, be, and ae are
-    // used (representing the names 'below' and 'above').
-    //
-    // Operands to the comparision are provided in the expected order, e.g.
-    // jle32(reg1, Imm32(5)) will branch if the value held in reg1, when
-    // treated as a signed 32bit value, is less than or equal to 5.
-    //
-    // jz and jnz test whether the first operand is equal to zero, and take
-    // an optional second operand of a mask under which to perform the test.
-
-private:
-    void compareImm32ForBranch(RegisterID left, int32_t right)
-    {
-        m_assembler.cmpl_ir(right, left);
-    }
-
-    void compareImm32ForBranchEquality(RegisterID reg, int32_t imm)
-    {
-        if (!imm)
-            m_assembler.testl_rr(reg, reg);
-        else
-            m_assembler.cmpl_ir(imm, reg);
-    }
-
-    void compareImm32ForBranchEquality(Address address, int32_t imm)
-    {
-        m_assembler.cmpl_im(imm, address.offset, address.base);
-    }
-
-    void testImm32(RegisterID reg, Imm32 mask)
-    {
-        // if we are only interested in the low seven bits, this can be tested with a testb
-        if (mask.m_value == -1)
-            m_assembler.testl_rr(reg, reg);
-        else if ((mask.m_value & ~0x7f) == 0)
-            m_assembler.testb_i8r(mask.m_value, reg);
-        else
-            m_assembler.testl_i32r(mask.m_value, reg);
-    }
-
-    void testImm32(Address address, Imm32 mask)
-    {
-        if (mask.m_value == -1)
-            m_assembler.cmpl_im(0, address.offset, address.base);
-        else
-            m_assembler.testl_i32m(mask.m_value, address.offset, address.base);
-    }
-
-    void testImm32(BaseIndex address, Imm32 mask)
-    {
-        if (mask.m_value == -1)
-            m_assembler.cmpl_im(0, address.offset, address.base, address.index, address.scale);
-        else
-            m_assembler.testl_i32m(mask.m_value, address.offset, address.base, address.index, address.scale);
-    }
-
-#if PLATFORM(X86_64)
-    void compareImm64ForBranch(RegisterID left, int32_t right)
-    {
-        m_assembler.cmpq_ir(right, left);
-    }
-
-    void compareImm64ForBranchEquality(RegisterID reg, int32_t imm)
-    {
-        if (!imm)
-            m_assembler.testq_rr(reg, reg);
-        else
-            m_assembler.cmpq_ir(imm, reg);
-    }
-
-    void testImm64(RegisterID reg, Imm32 mask)
-    {
-        // if we are only interested in the low seven bits, this can be tested with a testb
-        if (mask.m_value == -1)
-            m_assembler.testq_rr(reg, reg);
-        else if ((mask.m_value & ~0x7f) == 0)
-            m_assembler.testb_i8r(mask.m_value, reg);
-        else
-            m_assembler.testq_i32r(mask.m_value, reg);
-    }
-
-    void testImm64(Address address, Imm32 mask)
-    {
-        if (mask.m_value == -1)
-            m_assembler.cmpq_im(0, address.offset, address.base);
-        else
-            m_assembler.testq_i32m(mask.m_value, address.offset, address.base);
-    }
-
-    void testImm64(BaseIndex address, Imm32 mask)
-    {
-        if (mask.m_value == -1)
-            m_assembler.cmpq_im(0, address.offset, address.base, address.index, address.scale);
-        else
-            m_assembler.testq_i32m(mask.m_value, address.offset, address.base, address.index, address.scale);
-    }
-#endif
-
-public:
-    Jump ja32(RegisterID left, Imm32 right)
-    {
-        compareImm32ForBranch(left, right.m_value);
-        return Jump(m_assembler.ja());
-    }
-    
-    Jump jaePtr(RegisterID left, RegisterID right)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.cmpq_rr(right, left);
-        return Jump(m_assembler.jae());
-#else
-        return jae32(left, right);
-#endif
-    }
-
-    Jump jaePtr(RegisterID reg, ImmPtr ptr)
-    {
-#if PLATFORM(X86_64)
-        intptr_t imm = ptr.asIntptr();
-        if (CAN_SIGN_EXTEND_32_64(imm)) {
-            compareImm64ForBranch(reg, imm);
-            return Jump(m_assembler.jae());
-        } else {
-            move(ptr, scratchRegister);
-            return jaePtr(reg, scratchRegister);
-        }
-#else
-        return jae32(reg, Imm32(ptr));
-#endif
-    }
-
-    Jump jae32(RegisterID left, RegisterID right)
-    {
-        m_assembler.cmpl_rr(right, left);
-        return Jump(m_assembler.jae());
-    }
-
-    Jump jae32(RegisterID left, Imm32 right)
-    {
-        compareImm32ForBranch(left, right.m_value);
-        return Jump(m_assembler.jae());
-    }
-    
-    Jump jae32(RegisterID left, Address right)
-    {
-        m_assembler.cmpl_mr(right.offset, right.base, left);
-        return Jump(m_assembler.jae());
-    }
-    
-    Jump jae32(Address left, RegisterID right)
-    {
-        m_assembler.cmpl_rm(right, left.offset, left.base);
-        return Jump(m_assembler.jae());
-    }
-    
-    Jump jbPtr(RegisterID left, RegisterID right)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.cmpq_rr(right, left);
-        return Jump(m_assembler.jb());
-#else
-        return jb32(left, right);
-#endif
-    }
-
-    Jump jbPtr(RegisterID reg, ImmPtr ptr)
-    {
-#if PLATFORM(X86_64)
-        intptr_t imm = ptr.asIntptr();
-        if (CAN_SIGN_EXTEND_32_64(imm)) {
-            compareImm64ForBranch(reg, imm);
-            return Jump(m_assembler.jb());
-        } else {
-            move(ptr, scratchRegister);
-            return jbPtr(reg, scratchRegister);
-        }
-#else
-        return jb32(reg, Imm32(ptr));
-#endif
-    }
-
-    Jump jb32(RegisterID left, RegisterID right)
-    {
-        m_assembler.cmpl_rr(right, left);
-        return Jump(m_assembler.jb());
-    }
-
-    Jump jb32(RegisterID left, Imm32 right)
-    {
-        compareImm32ForBranch(left, right.m_value);
-        return Jump(m_assembler.jb());
-    }
-    
-    Jump jb32(RegisterID left, Address right)
-    {
-        m_assembler.cmpl_mr(right.offset, right.base, left);
-        return Jump(m_assembler.jb());
-    }
-    
-    Jump jePtr(RegisterID op1, RegisterID op2)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.cmpq_rr(op1, op2);
-        return Jump(m_assembler.je());
-#else
-        return je32(op1, op2);
-#endif
-    }
-
-    Jump jePtr(RegisterID reg, Address address)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.cmpq_rm(reg, address.offset, address.base);
-#else
-        m_assembler.cmpl_rm(reg, address.offset, address.base);
-#endif
-        return Jump(m_assembler.je());
     }
 
-    Jump jePtr(RegisterID reg, ImmPtr ptr)
+    void storePtr(RegisterID src, void* address)
     {
-#if PLATFORM(X86_64)
-        intptr_t imm = ptr.asIntptr();
-        if (CAN_SIGN_EXTEND_32_64(imm)) {
-            compareImm64ForBranchEquality(reg, imm);
-            return Jump(m_assembler.je());
-        } else {
-            move(ptr, scratchRegister);
-            return jePtr(scratchRegister, reg);
-        }
-#else
-        return je32(reg, Imm32(ptr));
-#endif
-    }
-
-    Jump jePtr(Address address, ImmPtr imm)
-    {
-#if PLATFORM(X86_64)
-        move(imm, scratchRegister);
-        return jePtr(scratchRegister, address);
-#else
-        return je32(address, Imm32(imm));
-#endif
-    }
-
-    Jump je32(RegisterID op1, RegisterID op2)
-    {
-        m_assembler.cmpl_rr(op1, op2);
-        return Jump(m_assembler.je());
-    }
-    
-    Jump je32(Address op1, RegisterID op2)
-    {
-        m_assembler.cmpl_mr(op1.offset, op1.base, op2);
-        return Jump(m_assembler.je());
-    }
-    
-    Jump je32(RegisterID reg, Imm32 imm)
-    {
-        compareImm32ForBranchEquality(reg, imm.m_value);
-        return Jump(m_assembler.je());
-    }
-
-    Jump je32(Address address, Imm32 imm)
-    {
-        compareImm32ForBranchEquality(address, imm.m_value);
-        return Jump(m_assembler.je());
-    }
-    
-    Jump je16(RegisterID op1, BaseIndex op2)
-    {
-        m_assembler.cmpw_rm(op1, op2.offset, op2.base, op2.index, op2.scale);
-        return Jump(m_assembler.je());
-    }
-    
-    Jump jg32(RegisterID left, RegisterID right)
-    {
-        m_assembler.cmpl_rr(right, left);
-        return Jump(m_assembler.jg());
-    }
-
-    Jump jg32(RegisterID reg, Address address)
-    {
-        m_assembler.cmpl_mr(address.offset, address.base, reg);
-        return Jump(m_assembler.jg());
-    }
-
-    Jump jgePtr(RegisterID left, RegisterID right)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.cmpq_rr(right, left);
-        return Jump(m_assembler.jge());
-#else
-        return jge32(left, right);
-#endif
-    }
-
-    Jump jgePtr(RegisterID reg, ImmPtr ptr)
-    {
-#if PLATFORM(X86_64)
-        intptr_t imm = ptr.asIntptr();
-        if (CAN_SIGN_EXTEND_32_64(imm)) {
-            compareImm64ForBranch(reg, imm);
-            return Jump(m_assembler.jge());
-        } else {
-            move(ptr, scratchRegister);
-            return jgePtr(reg, scratchRegister);
-        }
-#else
-        return jge32(reg, Imm32(ptr));
-#endif
-    }
-
-    Jump jge32(RegisterID left, RegisterID right)
-    {
-        m_assembler.cmpl_rr(right, left);
-        return Jump(m_assembler.jge());
-    }
-
-    Jump jge32(RegisterID left, Imm32 right)
-    {
-        compareImm32ForBranch(left, right.m_value);
-        return Jump(m_assembler.jge());
-    }
-
-    Jump jlPtr(RegisterID left, RegisterID right)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.cmpq_rr(right, left);
-        return Jump(m_assembler.jl());
-#else
-        return jl32(left, right);
-#endif
-    }
-
-    Jump jlPtr(RegisterID reg, ImmPtr ptr)
-    {
-#if PLATFORM(X86_64)
-        intptr_t imm = ptr.asIntptr();
-        if (CAN_SIGN_EXTEND_32_64(imm)) {
-            compareImm64ForBranch(reg, imm);
-            return Jump(m_assembler.jl());
-        } else {
-            move(ptr, scratchRegister);
-            return jlPtr(reg, scratchRegister);
-        }
-#else
-        return jl32(reg, Imm32(ptr));
-#endif
-    }
-
-    Jump jl32(RegisterID left, RegisterID right)
-    {
-        m_assembler.cmpl_rr(right, left);
-        return Jump(m_assembler.jl());
-    }
-    
-    Jump jl32(RegisterID left, Imm32 right)
-    {
-        compareImm32ForBranch(left, right.m_value);
-        return Jump(m_assembler.jl());
-    }
-
-    Jump jlePtr(RegisterID left, RegisterID right)
-    {
-#if PLATFORM(X86_64)
-        m_assembler.cmpq_rr(right, left);
-        return Jump(m_assembler.jle());
-#else
-        return jle32(left, right);
-#endif
-    }
-
-    Jump jlePtr(RegisterID reg, ImmPtr ptr)
-    {
-#if PLATFORM(X86_64)
-        intptr_t imm = ptr.asIntptr();
-        if (CAN_SIGN_EXTEND_32_64(imm)) {
-            compareImm64ForBranch(reg, imm);
-            return Jump(m_assembler.jle());
-        } else {
-            move(ptr, scratchRegister);
-            return jlePtr(reg, scratchRegister);
-        }
-#else
-        return jle32(reg, Imm32(ptr));
-#endif
-    }
-
-    Jump jle32(RegisterID left, RegisterID right)
-    {
-        m_assembler.cmpl_rr(right, left);
-        return Jump(m_assembler.jle());
-    }
-    
-    Jump jle32(RegisterID left, Imm32 right)
-    {
-        compareImm32ForBranch(left, right.m_value);
-        return Jump(m_assembler.jle());
+        store32(src, address);
     }
 
-    Jump jnePtr(RegisterID op1, RegisterID op2)
+    void storePtr(ImmPtr imm, ImplicitAddress address)
     {
-#if PLATFORM(X86_64)
-        m_assembler.cmpq_rr(op1, op2);
-        return Jump(m_assembler.jne());
-#else
-        return jne32(op1, op2);
-#endif
+        store32(Imm32(imm), address);
     }
 
-    Jump jnePtr(RegisterID reg, Address address)
+    void storePtr(ImmPtr imm, void* address)
     {
-#if PLATFORM(X86_64)
-        m_assembler.cmpq_rm(reg, address.offset, address.base);
-#else
-        m_assembler.cmpl_rm(reg, address.offset, address.base);
-#endif
-        return Jump(m_assembler.jne());
+        store32(Imm32(imm), address);
     }
 
-    Jump jnePtr(RegisterID reg, AbsoluteAddress address)
+    DataLabel32 storePtrWithAddressOffsetPatch(RegisterID src, Address address)
     {
-#if PLATFORM(X86_64)
-        move(ImmPtr(address.m_ptr), scratchRegister);
-        return jnePtr(reg, Address(scratchRegister));
-#else
-        m_assembler.cmpl_rm(reg, address.m_ptr);
-        return Jump(m_assembler.jne());
-#endif
+        return store32WithAddressOffsetPatch(src, address);
     }
 
-    Jump jnePtr(RegisterID reg, ImmPtr ptr)
-    {
-#if PLATFORM(X86_64)
-        intptr_t imm = ptr.asIntptr();
-        if (CAN_SIGN_EXTEND_32_64(imm)) {
-            compareImm64ForBranchEquality(reg, imm);
-            return Jump(m_assembler.jne());
-        } else {
-            move(ptr, scratchRegister);
-            return jnePtr(scratchRegister, reg);
-        }
-#else
-        return jne32(reg, Imm32(ptr));
-#endif
-    }
 
-    Jump jnePtr(Address address, ImmPtr imm)
+    Jump branchPtr(Condition cond, RegisterID left, RegisterID right)
     {
-#if PLATFORM(X86_64)
-        move(imm, scratchRegister);
-        return jnePtr(scratchRegister, address);
-#else
-        return jne32(address, Imm32(imm));
-#endif
+        return branch32(cond, left, right);
     }
 
-#if !PLATFORM(X86_64)
-    Jump jnePtr(AbsoluteAddress address, ImmPtr imm)
+    Jump branchPtr(Condition cond, RegisterID left, ImmPtr right)
     {
-        m_assembler.cmpl_im(imm.asIntptr(), address.m_ptr);
-        return Jump(m_assembler.jne());
+        return branch32(cond, left, Imm32(right));
     }
-#endif
 
-    Jump jnePtrWithPatch(RegisterID reg, DataLabelPtr& dataLabel, ImmPtr initialValue = ImmPtr(0))
+    Jump branchPtr(Condition cond, RegisterID left, Address right)
     {
-#if PLATFORM(X86_64)
-        m_assembler.movq_i64r(initialValue.asIntptr(), scratchRegister);
-        dataLabel = DataLabelPtr(this);
-        return jnePtr(scratchRegister, reg);
-#else
-        m_assembler.cmpl_ir_force32(initialValue.asIntptr(), reg);
-        dataLabel = DataLabelPtr(this);
-        return Jump(m_assembler.jne());
-#endif
+        return branch32(cond, left, right);
     }
 
-    Jump jnePtrWithPatch(Address address, DataLabelPtr& dataLabel, ImmPtr initialValue = ImmPtr(0))
+    Jump branchPtr(Condition cond, Address left, RegisterID right)
     {
-#if PLATFORM(X86_64)
-        m_assembler.movq_i64r(initialValue.asIntptr(), scratchRegister);
-        dataLabel = DataLabelPtr(this);
-        return jnePtr(scratchRegister, address);
-#else
-        m_assembler.cmpl_im_force32(initialValue.asIntptr(), address.offset, address.base);
-        dataLabel = DataLabelPtr(this);
-        return Jump(m_assembler.jne());
-#endif
+        return branch32(cond, left, right);
     }
 
-    Jump jne32(RegisterID op1, RegisterID op2)
+    Jump branchPtr(Condition cond, AbsoluteAddress left, RegisterID right)
     {
-        m_assembler.cmpl_rr(op1, op2);
-        return Jump(m_assembler.jne());
+        return branch32(cond, left, right);
     }
 
-    Jump jne32(RegisterID reg, Imm32 imm)
+    Jump branchPtr(Condition cond, Address left, ImmPtr right)
     {
-        compareImm32ForBranchEquality(reg, imm.m_value);
-        return Jump(m_assembler.jne());
+        return branch32(cond, left, Imm32(right));
     }
 
-    Jump jne32(Address address, Imm32 imm)
-    {
-        compareImm32ForBranchEquality(address, imm.m_value);
-        return Jump(m_assembler.jne());
-    }
-    
-    Jump jne32(Address address, RegisterID reg)
+    Jump branchPtr(Condition cond, AbsoluteAddress left, ImmPtr right)
     {
-        m_assembler.cmpl_rm(reg, address.offset, address.base);
-        return Jump(m_assembler.jne());
-    }
-    
-    Jump jnzPtr(RegisterID reg, Imm32 mask = Imm32(-1))
-    {
-#if PLATFORM(X86_64)
-        testImm64(reg, mask);
-        return Jump(m_assembler.jne());
-#else
-        return jnz32(reg, mask);
-#endif
+        return branch32(cond, left, Imm32(right));
     }
 
-    Jump jnzPtr(RegisterID reg, ImmPtr mask)
+    Jump branchTestPtr(Condition cond, RegisterID reg, RegisterID mask)
     {
-#if PLATFORM(X86_64)
-        move(mask, scratchRegister);
-        m_assembler.testq_rr(scratchRegister, reg);
-        return Jump(m_assembler.jne());
-#else
-        return jnz32(reg, Imm32(mask));
-#endif
+        return branchTest32(cond, reg, mask);
     }
 
-    Jump jnzPtr(Address address, Imm32 mask = Imm32(-1))
+    Jump branchTestPtr(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
     {
-#if PLATFORM(X86_64)
-        testImm64(address, mask);
-        return Jump(m_assembler.jne());
-#else
-        return jnz32(address, mask);
-#endif
+        return branchTest32(cond, reg, mask);
     }
 
-    Jump jnz32(RegisterID reg, Imm32 mask = Imm32(-1))
+    Jump branchTestPtr(Condition cond, Address address, Imm32 mask = Imm32(-1))
     {
-        testImm32(reg, mask);
-        return Jump(m_assembler.jne());
+        return branchTest32(cond, address, mask);
     }
 
-    Jump jnz32(Address address, Imm32 mask = Imm32(-1))
+    Jump branchTestPtr(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
     {
-        testImm32(address, mask);
-        return Jump(m_assembler.jne());
+        return branchTest32(cond, address, mask);
     }
 
-    Jump jzPtr(RegisterID reg, Imm32 mask = Imm32(-1))
-    {
-#if PLATFORM(X86_64)
-        testImm64(reg, mask);
-        return Jump(m_assembler.je());
-#else
-        return jz32(reg, mask);
-#endif
-    }
 
-    Jump jzPtr(RegisterID reg, ImmPtr mask)
+    Jump branchAddPtr(Condition cond, RegisterID src, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        move(mask, scratchRegister);
-        m_assembler.testq_rr(scratchRegister, reg);
-        return Jump(m_assembler.je());
-#else
-        return jz32(reg, Imm32(mask));
-#endif
+        return branchAdd32(cond, src, dest);
     }
 
-    Jump jzPtr(Address address, Imm32 mask = Imm32(-1))
+    Jump branchSubPtr(Condition cond, Imm32 imm, RegisterID dest)
     {
-#if PLATFORM(X86_64)
-        testImm64(address, mask);
-        return Jump(m_assembler.je());
-#else
-        return jz32(address, mask);
-#endif
+        return branchSub32(cond, imm, dest);
     }
-
-    Jump jzPtr(BaseIndex address, Imm32 mask = Imm32(-1))
-    {
-#if PLATFORM(X86_64)
-        testImm64(address, mask);
-        return Jump(m_assembler.je());
-#else
-        return jz32(address, mask);
 #endif
-    }
-
-    Jump jz32(RegisterID reg, Imm32 mask = Imm32(-1))
-    {
-        testImm32(reg, mask);
-        return Jump(m_assembler.je());
-    }
-
-    Jump jz32(Address address, Imm32 mask = Imm32(-1))
-    {
-        testImm32(address, mask);
-        return Jump(m_assembler.je());
-    }
-
-    Jump jz32(BaseIndex address, Imm32 mask = Imm32(-1))
-    {
-        testImm32(address, mask);
-        return Jump(m_assembler.je());
-    }
-
-    Jump jump()
-    {
-        return Jump(m_assembler.jmp());
-    }
-
-
-    // Backwards, local control flow operations:
-    //
-    // These operations provide a shorter notation for local
-    // backwards branches, which may be both more convenient
-    // for the user, and for the programmer, and for the
-    // assembler (allowing shorter values to be used in
-    // relative offsets).
-    //
-    // The code sequence:
-    //
-    //     Label topOfLoop(this);
-    //     // ...
-    //     jne32(reg1, reg2, topOfLoop);
-    //
-    // Is equivalent to the longer, potentially less efficient form:
-    //
-    //     Label topOfLoop(this);
-    //     // ...
-    //     jne32(reg1, reg2).linkTo(topOfLoop);
-
-    void jae32(RegisterID left, Address right, Label target)
-    {
-        jae32(left, right).linkTo(target, this);
-    }
 
-    void je32(RegisterID op1, Imm32 imm, Label target)
-    {
-        je32(op1, imm).linkTo(target, this);
-    }
-
-    void je16(RegisterID op1, BaseIndex op2, Label target)
-    {
-        je16(op1, op2).linkTo(target, this);
-    }
-    
-    void jl32(RegisterID left, Imm32 right, Label target)
-    {
-        jl32(left, right).linkTo(target, this);
-    }
-    
-    void jle32(RegisterID left, RegisterID right, Label target)
-    {
-        jle32(left, right).linkTo(target, this);
-    }
-    
-    void jnePtr(RegisterID op1, ImmPtr imm, Label target)
-    {
-        jnePtr(op1, imm).linkTo(target, this);
-    }
-
-    void jne32(RegisterID op1, RegisterID op2, Label target)
-    {
-        jne32(op1, op2).linkTo(target, this);
-    }
-
-    void jne32(RegisterID op1, Imm32 imm, Label target)
-    {
-        jne32(op1, imm).linkTo(target, this);
-    }
-
-    void jzPtr(RegisterID reg, Label target)
-    {
-        jzPtr(reg).linkTo(target, this);
-    }
-
-    void jump(Label target)
-    {
-        m_assembler.link(m_assembler.jmp(), target.m_label);
-    }
-
-    void jump(RegisterID target)
-    {
-        m_assembler.jmp_r(target);
-    }
-
-    // Address is a memory location containing the address to jump to
-    void jump(Address address)
-    {
-        m_assembler.jmp_m(address.offset, address.base);
-    }
-
-
-    // Arithmetic control flow operations:
-    //
-    // This set of conditional branch operations branch based
-    // on the result of an arithmetic operation.  The operation
-    // is performed as normal, storing the result.
-    //
-    // * jz operations branch if the result is zero.
-    // * jo operations branch if the (signed) arithmetic
-    //   operation caused an overflow to occur.
-
-    Jump jnzSubPtr(Imm32 imm, RegisterID dest)
-    {
-        subPtr(imm, dest);
-        return Jump(m_assembler.jne());
-    }
-    
-    Jump jnzSub32(Imm32 imm, RegisterID dest)
-    {
-        sub32(imm, dest);
-        return Jump(m_assembler.jne());
-    }
-    
-    Jump joAddPtr(RegisterID src, RegisterID dest)
-    {
-        addPtr(src, dest);
-        return Jump(m_assembler.jo());
-    }
-    
-    Jump joAdd32(RegisterID src, RegisterID dest)
-    {
-        add32(src, dest);
-        return Jump(m_assembler.jo());
-    }
-    
-    Jump joAdd32(Imm32 imm, RegisterID dest)
-    {
-        add32(imm, dest);
-        return Jump(m_assembler.jo());
-    }
-    
-    Jump joMul32(Imm32 imm, RegisterID src, RegisterID dest)
-    {
-        mul32(imm, src, dest);
-        return Jump(m_assembler.jo());
-    }
-    
-    Jump joSub32(Imm32 imm, RegisterID dest)
-    {
-        sub32(imm, dest);
-        return Jump(m_assembler.jo());
-    }
-    
-    Jump jzSubPtr(Imm32 imm, RegisterID dest)
-    {
-        subPtr(imm, dest);
-        return Jump(m_assembler.je());
-    }
-    
-    Jump jzSub32(Imm32 imm, RegisterID dest)
-    {
-        sub32(imm, dest);
-        return Jump(m_assembler.je());
-    }
-    
-
-    // Miscellaneous operations:
-
-    void breakpoint()
-    {
-        m_assembler.int3();
-    }
-
-    Jump call()
-    {
-        return Jump(m_assembler.call());
-    }
-
-    // FIXME: why does this return a Jump object? - it can't be linked.
-    // This may be to get a reference to the return address of the call.
-    //
-    // This should probably be handled by a separate label type to a regular
-    // jump.  Todo: add a CallLabel type, for the regular call - can be linked
-    // like a jump (possibly a subclass of jump?, or possibly casts to a Jump).
-    // Also add a CallReturnLabel type for this to return (just a more JmpDsty
-    // form of label, can get the void* after the code has been linked, but can't
-    // try to link it like a Jump object), and let the CallLabel be cast into a
-    // CallReturnLabel.
-    Jump call(RegisterID target)
-    {
-        return Jump(m_assembler.call(target));
-    }
-
-    Label label()
-    {
-        return Label(this);
-    }
-    
-    Label align()
-    {
-        m_assembler.align(16);
-        return Label(this);
-    }
-
-    ptrdiff_t differenceBetween(Label from, Jump to)
-    {
-        return X86Assembler::getDifferenceBetweenLabels(from.m_label, to.m_jmp);
-    }
-
-    ptrdiff_t differenceBetween(Label from, Label to)
-    {
-        return X86Assembler::getDifferenceBetweenLabels(from.m_label, to.m_label);
-    }
-
-    ptrdiff_t differenceBetween(Label from, DataLabelPtr to)
-    {
-        return X86Assembler::getDifferenceBetweenLabels(from.m_label, to.m_label);
-    }
-
-    ptrdiff_t differenceBetween(Label from, DataLabel32 to)
-    {
-        return X86Assembler::getDifferenceBetweenLabels(from.m_label, to.m_label);
-    }
-
-    ptrdiff_t differenceBetween(DataLabelPtr from, Jump to)
-    {
-        return X86Assembler::getDifferenceBetweenLabels(from.m_label, to.m_jmp);
-    }
-
-    void ret()
-    {
-        m_assembler.ret();
-    }
-
-    void sete32(RegisterID src, RegisterID srcDest)
-    {
-        m_assembler.cmpl_rr(srcDest, src);
-        m_assembler.sete_r(srcDest);
-        m_assembler.movzbl_rr(srcDest, srcDest);
-    }
-
-    void sete32(Imm32 imm, RegisterID srcDest)
-    {
-        compareImm32ForBranchEquality(srcDest, imm.m_value);
-        m_assembler.sete_r(srcDest);
-        m_assembler.movzbl_rr(srcDest, srcDest);
-    }
-
-    void setne32(RegisterID src, RegisterID srcDest)
-    {
-        m_assembler.cmpl_rr(srcDest, src);
-        m_assembler.setne_r(srcDest);
-        m_assembler.movzbl_rr(srcDest, srcDest);
-    }
-
-    void setne32(Imm32 imm, RegisterID srcDest)
-    {
-        compareImm32ForBranchEquality(srcDest, imm.m_value);
-        m_assembler.setne_r(srcDest);
-        m_assembler.movzbl_rr(srcDest, srcDest);
-    }
-
-    // FIXME:
-    // The mask should be optional... paerhaps the argument order should be
-    // dest-src, operations always have a dest? ... possibly not true, considering
-    // asm ops like test, or pseudo ops like pop().
-    void setnz32(Address address, Imm32 mask, RegisterID dest)
-    {
-        testImm32(address, mask);
-        m_assembler.setnz_r(dest);
-        m_assembler.movzbl_rr(dest, dest);
-    }
-
-    void setz32(Address address, Imm32 mask, RegisterID dest)
-    {
-        testImm32(address, mask);
-        m_assembler.setz_r(dest);
-        m_assembler.movzbl_rr(dest, dest);
-    }
 };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h
new file mode 100644
index 0000000..bd83c60
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerARMv7.h
@@ -0,0 +1,1063 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MacroAssemblerARMv7_h
+#define MacroAssemblerARMv7_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(ASSEMBLER)
+
+#include "ARMv7Assembler.h"
+#include "AbstractMacroAssembler.h"
+
+namespace JSC {
+
+class MacroAssemblerARMv7 : public AbstractMacroAssembler<ARMv7Assembler> {
+    // FIXME: switch dataTempRegister & addressTempRegister, or possibly use r7?
+    //        - dTR is likely used more than aTR, and we'll get better instruction
+    //        encoding if it's in the low 8 registers.
+    static const ARM::RegisterID dataTempRegister = ARM::ip;
+    static const RegisterID addressTempRegister = ARM::r3;
+    static const FPRegisterID fpTempRegister = ARM::d7;
+
+    struct ArmAddress {
+        enum AddressType {
+            HasOffset,
+            HasIndex,
+        } type;
+        RegisterID base;
+        union {
+            int32_t offset;
+            struct {
+                RegisterID index;
+                Scale scale;
+            };
+        } u;
+        
+        explicit ArmAddress(RegisterID base, int32_t offset = 0)
+            : type(HasOffset)
+            , base(base)
+        {
+            u.offset = offset;
+        }
+        
+        explicit ArmAddress(RegisterID base, RegisterID index, Scale scale = TimesOne)
+            : type(HasIndex)
+            , base(base)
+        {
+            u.index = index;
+            u.scale = scale;
+        }
+    };
+    
+public:
+
+    static const Scale ScalePtr = TimesFour;
+
+    enum Condition {
+        Equal = ARMv7Assembler::ConditionEQ,
+        NotEqual = ARMv7Assembler::ConditionNE,
+        Above = ARMv7Assembler::ConditionHI,
+        AboveOrEqual = ARMv7Assembler::ConditionHS,
+        Below = ARMv7Assembler::ConditionLO,
+        BelowOrEqual = ARMv7Assembler::ConditionLS,
+        GreaterThan = ARMv7Assembler::ConditionGT,
+        GreaterThanOrEqual = ARMv7Assembler::ConditionGE,
+        LessThan = ARMv7Assembler::ConditionLT,
+        LessThanOrEqual = ARMv7Assembler::ConditionLE,
+        Overflow = ARMv7Assembler::ConditionVS,
+        Signed = ARMv7Assembler::ConditionMI,
+        Zero = ARMv7Assembler::ConditionEQ,
+        NonZero = ARMv7Assembler::ConditionNE
+    };
+
+    enum DoubleCondition {
+        DoubleEqual = ARMv7Assembler::ConditionEQ,
+        DoubleGreaterThan = ARMv7Assembler::ConditionGT,
+        DoubleGreaterThanOrEqual = ARMv7Assembler::ConditionGE,
+        DoubleLessThan = ARMv7Assembler::ConditionLO,
+        DoubleLessThanOrEqual = ARMv7Assembler::ConditionLS,
+    };
+
+    static const RegisterID stackPointerRegister = ARM::sp;
+    static const RegisterID linkRegister = ARM::lr;
+
+    // Integer arithmetic operations:
+    //
+    // Operations are typically two operand - operation(source, srcDst)
+    // For many operations the source may be an Imm32, the srcDst operand
+    // may often be a memory location (explictly described using an Address
+    // object).
+
+    void add32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.add(dest, dest, src);
+    }
+
+    void add32(Imm32 imm, RegisterID dest)
+    {
+        add32(imm, dest, dest);
+    }
+
+    void add32(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12OrEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.add(dest, src, armImm);
+        else {
+            move(imm, dataTempRegister);
+            m_assembler.add(dest, src, dataTempRegister);
+        }
+    }
+
+    void add32(Imm32 imm, Address address)
+    {
+        load32(address, dataTempRegister);
+
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12OrEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.add(dataTempRegister, dataTempRegister, armImm);
+        else {
+            // Hrrrm, since dataTempRegister holds the data loaded,
+            // use addressTempRegister to hold the immediate.
+            move(imm, addressTempRegister);
+            m_assembler.add(dataTempRegister, dataTempRegister, addressTempRegister);
+        }
+
+        store32(dataTempRegister, address);
+    }
+
+    void add32(Address src, RegisterID dest)
+    {
+        load32(src, dataTempRegister);
+        add32(dataTempRegister, dest);
+    }
+
+    void add32(Imm32 imm, AbsoluteAddress address)
+    {
+        load32(address.m_ptr, dataTempRegister);
+
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12OrEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.add(dataTempRegister, dataTempRegister, armImm);
+        else {
+            // Hrrrm, since dataTempRegister holds the data loaded,
+            // use addressTempRegister to hold the immediate.
+            move(imm, addressTempRegister);
+            m_assembler.add(dataTempRegister, dataTempRegister, addressTempRegister);
+        }
+
+        store32(dataTempRegister, address.m_ptr);
+    }
+
+    void and32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.ARM_and(dest, dest, src);
+    }
+
+    void and32(Imm32 imm, RegisterID dest)
+    {
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.ARM_and(dest, dest, armImm);
+        else {
+            move(imm, dataTempRegister);
+            m_assembler.ARM_and(dest, dest, dataTempRegister);
+        }
+    }
+
+    void lshift32(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.lsl(dest, dest, imm.m_value);
+    }
+
+    void lshift32(RegisterID shift_amount, RegisterID dest)
+    {
+        m_assembler.lsl(dest, dest, shift_amount);
+    }
+
+    void mul32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.smull(dest, dataTempRegister, dest, src);
+    }
+
+    void mul32(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        move(imm, dataTempRegister);
+        m_assembler.smull(dest, dataTempRegister, src, dataTempRegister);
+    }
+
+    void not32(RegisterID srcDest)
+    {
+        m_assembler.mvn(srcDest, srcDest);
+    }
+
+    void or32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.orr(dest, dest, src);
+    }
+
+    void or32(Imm32 imm, RegisterID dest)
+    {
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.orr(dest, dest, armImm);
+        else {
+            move(imm, dataTempRegister);
+            m_assembler.orr(dest, dest, dataTempRegister);
+        }
+    }
+
+    void rshift32(RegisterID shift_amount, RegisterID dest)
+    {
+        m_assembler.asr(dest, dest, shift_amount);
+    }
+
+    void rshift32(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.asr(dest, dest, imm.m_value);
+    }
+
+    void sub32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.sub(dest, dest, src);
+    }
+
+    void sub32(Imm32 imm, RegisterID dest)
+    {
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12OrEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.sub(dest, dest, armImm);
+        else {
+            move(imm, dataTempRegister);
+            m_assembler.sub(dest, dest, dataTempRegister);
+        }
+    }
+
+    void sub32(Imm32 imm, Address address)
+    {
+        load32(address, dataTempRegister);
+
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12OrEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.sub(dataTempRegister, dataTempRegister, armImm);
+        else {
+            // Hrrrm, since dataTempRegister holds the data loaded,
+            // use addressTempRegister to hold the immediate.
+            move(imm, addressTempRegister);
+            m_assembler.sub(dataTempRegister, dataTempRegister, addressTempRegister);
+        }
+
+        store32(dataTempRegister, address);
+    }
+
+    void sub32(Address src, RegisterID dest)
+    {
+        load32(src, dataTempRegister);
+        sub32(dataTempRegister, dest);
+    }
+
+    void sub32(Imm32 imm, AbsoluteAddress address)
+    {
+        load32(address.m_ptr, dataTempRegister);
+
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12OrEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.sub(dataTempRegister, dataTempRegister, armImm);
+        else {
+            // Hrrrm, since dataTempRegister holds the data loaded,
+            // use addressTempRegister to hold the immediate.
+            move(imm, addressTempRegister);
+            m_assembler.sub(dataTempRegister, dataTempRegister, addressTempRegister);
+        }
+
+        store32(dataTempRegister, address.m_ptr);
+    }
+
+    void xor32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.eor(dest, dest, src);
+    }
+
+    void xor32(Imm32 imm, RegisterID dest)
+    {
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.eor(dest, dest, armImm);
+        else {
+            move(imm, dataTempRegister);
+            m_assembler.eor(dest, dest, dataTempRegister);
+        }
+    }
+    
+
+    // Memory access operations:
+    //
+    // Loads are of the form load(address, destination) and stores of the form
+    // store(source, address).  The source for a store may be an Imm32.  Address
+    // operand objects to loads and store will be implicitly constructed if a
+    // register is passed.
+
+private:
+    void load32(ArmAddress address, RegisterID dest)
+    {
+        if (address.type == ArmAddress::HasIndex)
+            m_assembler.ldr(dest, address.base, address.u.index, address.u.scale);
+        else if (address.u.offset >= 0) {
+            ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12(address.u.offset);
+            ASSERT(armImm.isValid());
+            m_assembler.ldr(dest, address.base, armImm);
+        } else {
+            ASSERT(address.u.offset >= -255);
+            m_assembler.ldr(dest, address.base, address.u.offset, true, false);
+        }
+    }
+
+    void load16(ArmAddress address, RegisterID dest)
+    {
+        if (address.type == ArmAddress::HasIndex)
+            m_assembler.ldrh(dest, address.base, address.u.index, address.u.scale);
+        else if (address.u.offset >= 0) {
+            ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12(address.u.offset);
+            ASSERT(armImm.isValid());
+            m_assembler.ldrh(dest, address.base, armImm);
+        } else {
+            ASSERT(address.u.offset >= -255);
+            m_assembler.ldrh(dest, address.base, address.u.offset, true, false);
+        }
+    }
+
+    void store32(RegisterID src, ArmAddress address)
+    {
+        if (address.type == ArmAddress::HasIndex)
+            m_assembler.str(src, address.base, address.u.index, address.u.scale);
+        else if (address.u.offset >= 0) {
+            ARMThumbImmediate armImm = ARMThumbImmediate::makeUInt12(address.u.offset);
+            ASSERT(armImm.isValid());
+            m_assembler.str(src, address.base, armImm);
+        } else {
+            ASSERT(address.u.offset >= -255);
+            m_assembler.str(src, address.base, address.u.offset, true, false);
+        }
+    }
+
+public:
+    void load32(ImplicitAddress address, RegisterID dest)
+    {
+        load32(setupArmAddress(address), dest);
+    }
+
+    void load32(BaseIndex address, RegisterID dest)
+    {
+        load32(setupArmAddress(address), dest);
+    }
+
+    void load32(void* address, RegisterID dest)
+    {
+        move(ImmPtr(address), addressTempRegister);
+        m_assembler.ldr(dest, addressTempRegister, ARMThumbImmediate::makeUInt16(0));
+    }
+
+    DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        DataLabel32 label = moveWithPatch(Imm32(address.offset), dataTempRegister);
+        load32(ArmAddress(address.base, dataTempRegister), dest);
+        return label;
+    }
+
+    Label loadPtrWithPatchToLEA(Address address, RegisterID dest)
+    {
+        Label label(this);
+        moveFixedWidthEncoding(Imm32(address.offset), dataTempRegister);
+        load32(ArmAddress(address.base, dataTempRegister), dest);
+        return label;
+    }
+
+    void load16(BaseIndex address, RegisterID dest)
+    {
+        m_assembler.ldrh(dest, makeBaseIndexBase(address), address.index, address.scale);
+    }
+
+    DataLabel32 store32WithAddressOffsetPatch(RegisterID src, Address address)
+    {
+        DataLabel32 label = moveWithPatch(Imm32(address.offset), dataTempRegister);
+        store32(src, ArmAddress(address.base, dataTempRegister));
+        return label;
+    }
+
+    void store32(RegisterID src, ImplicitAddress address)
+    {
+        store32(src, setupArmAddress(address));
+    }
+
+    void store32(RegisterID src, BaseIndex address)
+    {
+        store32(src, setupArmAddress(address));
+    }
+
+    void store32(Imm32 imm, ImplicitAddress address)
+    {
+        move(imm, dataTempRegister);
+        store32(dataTempRegister, setupArmAddress(address));
+    }
+
+    void store32(RegisterID src, void* address)
+    {
+        move(ImmPtr(address), addressTempRegister);
+        m_assembler.str(src, addressTempRegister, ARMThumbImmediate::makeUInt16(0));
+    }
+
+    void store32(Imm32 imm, void* address)
+    {
+        move(imm, dataTempRegister);
+        store32(dataTempRegister, address);
+    }
+
+
+    // Floating-point operations:
+
+    bool supportsFloatingPoint() const { return true; }
+    // On x86(_64) the MacroAssembler provides an interface to truncate a double to an integer.
+    // If a value is not representable as an integer, and possibly for some values that are,
+    // (on x86 INT_MIN, since this is indistinguishable from results for out-of-range/NaN input)
+    // a branch will  be taken.  It is not clear whether this interface will be well suited to
+    // other platforms.  On ARMv7 the hardware truncation operation produces multiple possible
+    // failure values (saturates to INT_MIN & INT_MAX, NaN reulsts in a value of 0).  This is a
+    // temporary solution while we work out what this interface should be.  Either we need to
+    // decide to make this interface work on all platforms, rework the interface to make it more
+    // generic, or decide that the MacroAssembler cannot practically be used to abstracted these
+    // operations, and make clients go directly to the m_assembler to plant truncation instructions.
+    // In short, FIXME:.
+    bool supportsFloatingPointTruncate() const { return false; }
+
+    void loadDouble(ImplicitAddress address, FPRegisterID dest)
+    {
+        RegisterID base = address.base;
+        int32_t offset = address.offset;
+
+        // Arm vfp addresses can be offset by a 9-bit ones-comp immediate, left shifted by 2.
+        if ((offset & 3) || (offset > (255 * 4)) || (offset < -(255 * 4))) {
+            add32(Imm32(offset), base, addressTempRegister);
+            base = addressTempRegister;
+            offset = 0;
+        }
+        
+        m_assembler.vldr(dest, base, offset);
+    }
+
+    void storeDouble(FPRegisterID src, ImplicitAddress address)
+    {
+        RegisterID base = address.base;
+        int32_t offset = address.offset;
+
+        // Arm vfp addresses can be offset by a 9-bit ones-comp immediate, left shifted by 2.
+        if ((offset & 3) || (offset > (255 * 4)) || (offset < -(255 * 4))) {
+            add32(Imm32(offset), base, addressTempRegister);
+            base = addressTempRegister;
+            offset = 0;
+        }
+        
+        m_assembler.vstr(src, base, offset);
+    }
+
+    void addDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vadd_F64(dest, dest, src);
+    }
+
+    void addDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        addDouble(fpTempRegister, dest);
+    }
+
+    void subDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vsub_F64(dest, dest, src);
+    }
+
+    void subDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        subDouble(fpTempRegister, dest);
+    }
+
+    void mulDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vmul_F64(dest, dest, src);
+    }
+
+    void mulDouble(Address src, FPRegisterID dest)
+    {
+        loadDouble(src, fpTempRegister);
+        mulDouble(fpTempRegister, dest);
+    }
+
+    void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vmov(fpTempRegister, src);
+        m_assembler.vcvt_F64_S32(dest, fpTempRegister);
+    }
+
+    Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
+    {
+        m_assembler.vcmp_F64(left, right);
+        m_assembler.vmrs_APSR_nzcv_FPSCR();
+        return makeBranch(cond);
+    }
+
+    Jump branchTruncateDoubleToInt32(FPRegisterID, RegisterID)
+    {
+        ASSERT_NOT_REACHED();
+    }
+
+
+    // Stack manipulation operations:
+    //
+    // The ABI is assumed to provide a stack abstraction to memory,
+    // containing machine word sized units of data.  Push and pop
+    // operations add and remove a single register sized unit of data
+    // to or from the stack.  Peek and poke operations read or write
+    // values on the stack, without moving the current stack position.
+    
+    void pop(RegisterID dest)
+    {
+        // store postindexed with writeback
+        m_assembler.ldr(dest, ARM::sp, sizeof(void*), false, true);
+    }
+
+    void push(RegisterID src)
+    {
+        // store preindexed with writeback
+        m_assembler.str(src, ARM::sp, -sizeof(void*), true, true);
+    }
+
+    void push(Address address)
+    {
+        load32(address, dataTempRegister);
+        push(dataTempRegister);
+    }
+
+    void push(Imm32 imm)
+    {
+        move(imm, dataTempRegister);
+        push(dataTempRegister);
+    }
+
+    // Register move operations:
+    //
+    // Move values in registers.
+
+    void move(Imm32 imm, RegisterID dest)
+    {
+        uint32_t value = imm.m_value;
+
+        if (imm.m_isPointer)
+            moveFixedWidthEncoding(imm, dest);
+        else {
+            ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(value);
+
+            if (armImm.isValid())
+                m_assembler.mov(dest, armImm);
+            else if ((armImm = ARMThumbImmediate::makeEncodedImm(~value)).isValid())
+                m_assembler.mvn(dest, armImm);
+            else {
+                m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(value));
+                if (value & 0xffff0000)
+                    m_assembler.movt(dest, ARMThumbImmediate::makeUInt16(value >> 16));
+            }
+        }
+    }
+
+    void move(RegisterID src, RegisterID dest)
+    {
+        m_assembler.mov(dest, src);
+    }
+
+    void move(ImmPtr imm, RegisterID dest)
+    {
+        move(Imm32(imm), dest);
+    }
+
+    void swap(RegisterID reg1, RegisterID reg2)
+    {
+        move(reg1, dataTempRegister);
+        move(reg2, reg1);
+        move(dataTempRegister, reg2);
+    }
+
+    void signExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        if (src != dest)
+            move(src, dest);
+    }
+
+    void zeroExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        if (src != dest)
+            move(src, dest);
+    }
+
+
+    // Forwards / external control flow operations:
+    //
+    // This set of jump and conditional branch operations return a Jump
+    // object which may linked at a later point, allow forwards jump,
+    // or jumps that will require external linkage (after the code has been
+    // relocated).
+    //
+    // For branches, signed <, >, <= and >= are denoted as l, g, le, and ge
+    // respecitvely, for unsigned comparisons the names b, a, be, and ae are
+    // used (representing the names 'below' and 'above').
+    //
+    // Operands to the comparision are provided in the expected order, e.g.
+    // jle32(reg1, Imm32(5)) will branch if the value held in reg1, when
+    // treated as a signed 32bit value, is less than or equal to 5.
+    //
+    // jz and jnz test whether the first operand is equal to zero, and take
+    // an optional second operand of a mask under which to perform the test.
+private:
+
+    // Should we be using TEQ for equal/not-equal?
+    void compare32(RegisterID left, Imm32 right)
+    {
+        int32_t imm = right.m_value;
+        if (!imm)
+            m_assembler.tst(left, left);
+        else {
+            ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm);
+            if (armImm.isValid())
+                m_assembler.cmp(left, armImm);
+            if ((armImm = ARMThumbImmediate::makeEncodedImm(-imm)).isValid())
+                m_assembler.cmn(left, armImm);
+            else {
+                move(Imm32(imm), dataTempRegister);
+                m_assembler.cmp(left, dataTempRegister);
+            }
+        }
+    }
+
+    void test32(RegisterID reg, Imm32 mask)
+    {
+        int32_t imm = mask.m_value;
+
+        if (imm == -1)
+            m_assembler.tst(reg, reg);
+        else {
+            ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm);
+            if (armImm.isValid())
+                m_assembler.tst(reg, armImm);
+            else {
+                move(mask, dataTempRegister);
+                m_assembler.tst(reg, dataTempRegister);
+            }
+        }
+    }
+
+public:
+    Jump branch32(Condition cond, RegisterID left, RegisterID right)
+    {
+        m_assembler.cmp(left, right);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branch32(Condition cond, RegisterID left, Imm32 right)
+    {
+        compare32(left, right);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branch32(Condition cond, RegisterID left, Address right)
+    {
+        load32(right, dataTempRegister);
+        return branch32(cond, left, dataTempRegister);
+    }
+
+    Jump branch32(Condition cond, Address left, RegisterID right)
+    {
+        load32(left, dataTempRegister);
+        return branch32(cond, dataTempRegister, right);
+    }
+
+    Jump branch32(Condition cond, Address left, Imm32 right)
+    {
+        // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
+        load32(left, addressTempRegister);
+        return branch32(cond, addressTempRegister, right);
+    }
+
+    Jump branch32(Condition cond, BaseIndex left, Imm32 right)
+    {
+        // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
+        load32(left, addressTempRegister);
+        return branch32(cond, addressTempRegister, right);
+    }
+
+    Jump branch32(Condition cond, AbsoluteAddress left, RegisterID right)
+    {
+        load32(left.m_ptr, dataTempRegister);
+        return branch32(cond, dataTempRegister, right);
+    }
+
+    Jump branch32(Condition cond, AbsoluteAddress left, Imm32 right)
+    {
+        // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
+        load32(left.m_ptr, addressTempRegister);
+        return branch32(cond, addressTempRegister, right);
+    }
+
+    Jump branch16(Condition cond, BaseIndex left, RegisterID right)
+    {
+        load16(left, dataTempRegister);
+        m_assembler.lsl(addressTempRegister, right, 16);
+        m_assembler.lsl(dataTempRegister, dataTempRegister, 16);
+        return branch32(cond, dataTempRegister, addressTempRegister);
+    }
+
+    Jump branch16(Condition cond, BaseIndex left, Imm32 right)
+    {
+        // use addressTempRegister incase the branch32 we call uses dataTempRegister. :-/
+        load16(left, addressTempRegister);
+        m_assembler.lsl(addressTempRegister, addressTempRegister, 16);
+        return branch32(cond, addressTempRegister, Imm32(right.m_value << 16));
+    }
+
+    Jump branchTest32(Condition cond, RegisterID reg, RegisterID mask)
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        m_assembler.tst(reg, mask);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchTest32(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        test32(reg, mask);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchTest32(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        // use addressTempRegister incase the branchTest32 we call uses dataTempRegister. :-/
+        load32(address, addressTempRegister);
+        return branchTest32(cond, addressTempRegister, mask);
+    }
+
+    Jump branchTest32(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        // use addressTempRegister incase the branchTest32 we call uses dataTempRegister. :-/
+        load32(address, addressTempRegister);
+        return branchTest32(cond, addressTempRegister, mask);
+    }
+
+    Jump jump()
+    {
+        return Jump(makeJump());
+    }
+
+    void jump(RegisterID target)
+    {
+        m_assembler.bx(target);
+    }
+
+    // Address is a memory location containing the address to jump to
+    void jump(Address address)
+    {
+        load32(address, dataTempRegister);
+        m_assembler.bx(dataTempRegister);
+    }
+
+
+    // Arithmetic control flow operations:
+    //
+    // This set of conditional branch operations branch based
+    // on the result of an arithmetic operation.  The operation
+    // is performed as normal, storing the result.
+    //
+    // * jz operations branch if the result is zero.
+    // * jo operations branch if the (signed) arithmetic
+    //   operation caused an overflow to occur.
+    
+    Jump branchAdd32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        m_assembler.add_S(dest, dest, src);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchAdd32(Condition cond, Imm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.add_S(dest, dest, armImm);
+        else {
+            move(imm, dataTempRegister);
+            m_assembler.add_S(dest, dest, dataTempRegister);
+        }
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchMul32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT(cond == Overflow);
+        m_assembler.smull(dest, dataTempRegister, dest, src);
+        m_assembler.asr(addressTempRegister, dest, 31);
+        return branch32(NotEqual, addressTempRegister, dataTempRegister);
+    }
+
+    Jump branchMul32(Condition cond, Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        ASSERT(cond == Overflow);
+        move(imm, dataTempRegister);
+        m_assembler.smull(dest, dataTempRegister, src, dataTempRegister);
+        m_assembler.asr(addressTempRegister, dest, 31);
+        return branch32(NotEqual, addressTempRegister, dataTempRegister);
+    }
+
+    Jump branchSub32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        m_assembler.sub_S(dest, dest, src);
+        return Jump(makeBranch(cond));
+    }
+
+    Jump branchSub32(Condition cond, Imm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        ARMThumbImmediate armImm = ARMThumbImmediate::makeEncodedImm(imm.m_value);
+        if (armImm.isValid())
+            m_assembler.sub_S(dest, dest, armImm);
+        else {
+            move(imm, dataTempRegister);
+            m_assembler.sub_S(dest, dest, dataTempRegister);
+        }
+        return Jump(makeBranch(cond));
+    }
+    
+
+    // Miscellaneous operations:
+
+    void breakpoint()
+    {
+        m_assembler.bkpt();
+    }
+
+    Call nearCall()
+    {
+        moveFixedWidthEncoding(Imm32(0), dataTempRegister);
+        return Call(m_assembler.blx(dataTempRegister), Call::LinkableNear);
+    }
+
+    Call call()
+    {
+        moveFixedWidthEncoding(Imm32(0), dataTempRegister);
+        return Call(m_assembler.blx(dataTempRegister), Call::Linkable);
+    }
+
+    Call call(RegisterID target)
+    {
+        return Call(m_assembler.blx(target), Call::None);
+    }
+
+    Call call(Address address)
+    {
+        load32(address, dataTempRegister);
+        return Call(m_assembler.blx(dataTempRegister), Call::None);
+    }
+
+    void ret()
+    {
+        m_assembler.bx(linkRegister);
+    }
+
+    void set32(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        m_assembler.cmp(left, right);
+        m_assembler.it(armV7Condition(cond), false);
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(1));
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(0));
+    }
+
+    void set32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    {
+        compare32(left, right);
+        m_assembler.it(armV7Condition(cond), false);
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(1));
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(0));
+    }
+
+    // FIXME:
+    // The mask should be optional... paerhaps the argument order should be
+    // dest-src, operations always have a dest? ... possibly not true, considering
+    // asm ops like test, or pseudo ops like pop().
+    void setTest32(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    {
+        load32(address, dataTempRegister);
+        test32(dataTempRegister, mask);
+        m_assembler.it(armV7Condition(cond), false);
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(1));
+        m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(0));
+    }
+
+
+    DataLabel32 moveWithPatch(Imm32 imm, RegisterID dst)
+    {
+        moveFixedWidthEncoding(imm, dst);
+        return DataLabel32(this);
+    }
+
+    DataLabelPtr moveWithPatch(ImmPtr imm, RegisterID dst)
+    {
+        moveFixedWidthEncoding(Imm32(imm), dst);
+        return DataLabelPtr(this);
+    }
+
+    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    {
+        dataLabel = moveWithPatch(initialRightValue, dataTempRegister);
+        return branch32(cond, left, dataTempRegister);
+    }
+
+    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    {
+        load32(left, addressTempRegister);
+        dataLabel = moveWithPatch(initialRightValue, dataTempRegister);
+        return branch32(cond, addressTempRegister, dataTempRegister);
+    }
+
+    DataLabelPtr storePtrWithPatch(ImmPtr initialValue, ImplicitAddress address)
+    {
+        DataLabelPtr label = moveWithPatch(initialValue, dataTempRegister);
+        store32(dataTempRegister, address);
+        return label;
+    }
+    DataLabelPtr storePtrWithPatch(ImplicitAddress address) { return storePtrWithPatch(ImmPtr(0), address); }
+
+
+    Call tailRecursiveCall()
+    {
+        // Like a normal call, but don't link.
+        moveFixedWidthEncoding(Imm32(0), dataTempRegister);
+        return Call(m_assembler.bx(dataTempRegister), Call::Linkable);
+    }
+
+    Call makeTailRecursiveCall(Jump oldJump)
+    {
+        oldJump.link(this);
+        return tailRecursiveCall();
+    }
+
+
+protected:
+    ARMv7Assembler::JmpSrc makeJump()
+    {
+        return m_assembler.b();
+    }
+
+    ARMv7Assembler::JmpSrc makeBranch(ARMv7Assembler::Condition cond)
+    {
+        m_assembler.it(cond);
+        return m_assembler.b();
+    }
+    ARMv7Assembler::JmpSrc makeBranch(Condition cond) { return makeBranch(armV7Condition(cond)); }
+    ARMv7Assembler::JmpSrc makeBranch(DoubleCondition cond) { return makeBranch(armV7Condition(cond)); }
+
+    ArmAddress setupArmAddress(BaseIndex address)
+    {
+        if (address.offset) {
+            ARMThumbImmediate imm = ARMThumbImmediate::makeUInt12OrEncodedImm(address.offset);
+            if (imm.isValid())
+                m_assembler.add(addressTempRegister, address.base, imm);
+            else {
+                move(Imm32(address.offset), addressTempRegister);
+                m_assembler.add(addressTempRegister, addressTempRegister, address.base);
+            }
+
+            return ArmAddress(addressTempRegister, address.index, address.scale);
+        } else
+            return ArmAddress(address.base, address.index, address.scale);
+    }
+
+    ArmAddress setupArmAddress(Address address)
+    {
+        if ((address.offset >= -0xff) && (address.offset <= 0xfff))
+            return ArmAddress(address.base, address.offset);
+
+        move(Imm32(address.offset), addressTempRegister);
+        return ArmAddress(address.base, addressTempRegister);
+    }
+
+    ArmAddress setupArmAddress(ImplicitAddress address)
+    {
+        if ((address.offset >= -0xff) && (address.offset <= 0xfff))
+            return ArmAddress(address.base, address.offset);
+
+        move(Imm32(address.offset), addressTempRegister);
+        return ArmAddress(address.base, addressTempRegister);
+    }
+
+    RegisterID makeBaseIndexBase(BaseIndex address)
+    {
+        if (!address.offset)
+            return address.base;
+
+        ARMThumbImmediate imm = ARMThumbImmediate::makeUInt12OrEncodedImm(address.offset);
+        if (imm.isValid())
+            m_assembler.add(addressTempRegister, address.base, imm);
+        else {
+            move(Imm32(address.offset), addressTempRegister);
+            m_assembler.add(addressTempRegister, addressTempRegister, address.base);
+        }
+
+        return addressTempRegister;
+    }
+
+    DataLabel32 moveFixedWidthEncoding(Imm32 imm, RegisterID dst)
+    {
+        uint32_t value = imm.m_value;
+        m_assembler.movT3(dst, ARMThumbImmediate::makeUInt16(value & 0xffff));
+        m_assembler.movt(dst, ARMThumbImmediate::makeUInt16(value >> 16));
+    }
+
+    ARMv7Assembler::Condition armV7Condition(Condition cond)
+    {
+        return static_cast<ARMv7Assembler::Condition>(cond);
+    }
+
+    ARMv7Assembler::Condition armV7Condition(DoubleCondition cond)
+    {
+        return static_cast<ARMv7Assembler::Condition>(cond);
+    }
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
+
+#endif // MacroAssemblerARMv7_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
new file mode 100644
index 0000000..50fca5b
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerCodeRef.h
@@ -0,0 +1,196 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MacroAssemblerCodeRef_h
+#define MacroAssemblerCodeRef_h
+
+#include <wtf/Platform.h>
+
+#include "ExecutableAllocator.h"
+#include "PassRefPtr.h"
+#include "RefPtr.h"
+#include "UnusedParam.h"
+
+#if ENABLE(ASSEMBLER)
+
+// ASSERT_VALID_CODE_POINTER checks that ptr is a non-null pointer, and that it is a valid
+// instruction address on the platform (for example, check any alignment requirements).
+#if PLATFORM_ARM_ARCH(7)
+// ARM/thumb instructions must be 16-bit aligned, but all code pointers to be loaded
+// into the processor are decorated with the bottom bit set, indicating that this is
+// thumb code (as oposed to 32-bit traditional ARM).  The first test checks for both
+// decorated and undectorated null, and the second test ensures that the pointer is
+// decorated.
+#define ASSERT_VALID_CODE_POINTER(ptr) \
+    ASSERT(reinterpret_cast<intptr_t>(ptr) & ~1); \
+    ASSERT(reinterpret_cast<intptr_t>(ptr) & 1)
+#define ASSERT_VALID_CODE_OFFSET(offset) \
+    ASSERT(!(offset & 1)) // Must be multiple of 2.
+#else
+#define ASSERT_VALID_CODE_POINTER(ptr) \
+    ASSERT(ptr)
+#define ASSERT_VALID_CODE_OFFSET(offset) // Anything goes!
+#endif
+
+namespace JSC {
+
+// FunctionPtr:
+//
+// FunctionPtr should be used to wrap pointers to C/C++ functions in JSC
+// (particularly, the stub functions).
+class FunctionPtr {
+public:
+    FunctionPtr()
+        : m_value(0)
+    {
+    }
+
+    template<typename FunctionType>
+    explicit FunctionPtr(FunctionType* value)
+        : m_value(reinterpret_cast<void*>(value))
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    void* value() const { return m_value; }
+    void* executableAddress() const { return m_value; }
+
+
+private:
+    void* m_value;
+};
+
+// ReturnAddressPtr:
+//
+// ReturnAddressPtr should be used to wrap return addresses generated by processor
+// 'call' instructions exectued in JIT code.  We use return addresses to look up
+// exception and optimization information, and to repatch the call instruction
+// that is the source of the return address.
+class ReturnAddressPtr {
+public:
+    ReturnAddressPtr()
+        : m_value(0)
+    {
+    }
+
+    explicit ReturnAddressPtr(void* value)
+        : m_value(value)
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    explicit ReturnAddressPtr(FunctionPtr function)
+        : m_value(function.value())
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    void* value() const { return m_value; }
+
+private:
+    void* m_value;
+};
+
+// MacroAssemblerCodePtr:
+//
+// MacroAssemblerCodePtr should be used to wrap pointers to JIT generated code.
+class MacroAssemblerCodePtr {
+public:
+    MacroAssemblerCodePtr()
+        : m_value(0)
+    {
+    }
+
+    explicit MacroAssemblerCodePtr(void* value)
+#if PLATFORM_ARM_ARCH(7)
+        // Decorate the pointer as a thumb code pointer.
+        : m_value(reinterpret_cast<char*>(value) + 1)
+#else
+        : m_value(value)
+#endif
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    explicit MacroAssemblerCodePtr(ReturnAddressPtr ra)
+        : m_value(ra.value())
+    {
+        ASSERT_VALID_CODE_POINTER(m_value);
+    }
+
+    void* executableAddress() const { return m_value; }
+#if PLATFORM_ARM_ARCH(7)
+    // To use this pointer as a data address remove the decoration.
+    void* dataLocation() const { ASSERT_VALID_CODE_POINTER(m_value); return reinterpret_cast<char*>(m_value) - 1; }
+#else
+    void* dataLocation() const { ASSERT_VALID_CODE_POINTER(m_value); return m_value; }
+#endif
+
+    bool operator!()
+    {
+        return !m_value;
+    }
+
+private:
+    void* m_value;
+};
+
+// MacroAssemblerCodeRef:
+//
+// A reference to a section of JIT generated code.  A CodeRef consists of a
+// pointer to the code, and a ref pointer to the pool from within which it
+// was allocated.
+class MacroAssemblerCodeRef {
+public:
+    MacroAssemblerCodeRef()
+#ifndef NDEBUG
+        : m_size(0)
+#endif
+    {
+    }
+
+    MacroAssemblerCodeRef(void* code, PassRefPtr<ExecutablePool> executablePool, size_t size)
+        : m_code(code)
+        , m_executablePool(executablePool)
+    {
+#ifndef NDEBUG
+        m_size = size;
+#else
+        UNUSED_PARAM(size);
+#endif
+    }
+
+    MacroAssemblerCodePtr m_code;
+    RefPtr<ExecutablePool> m_executablePool;
+#ifndef NDEBUG
+    size_t m_size;
+#endif
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
+
+#endif // MacroAssemblerCodeRef_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86.h
new file mode 100644
index 0000000..aaf98fd
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86.h
@@ -0,0 +1,173 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MacroAssemblerX86_h
+#define MacroAssemblerX86_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(ASSEMBLER) && PLATFORM(X86)
+
+#include "MacroAssemblerX86Common.h"
+
+namespace JSC {
+
+class MacroAssemblerX86 : public MacroAssemblerX86Common {
+public:
+    MacroAssemblerX86()
+        : m_isSSE2Present(isSSE2Present())
+    {
+    }
+
+    static const Scale ScalePtr = TimesFour;
+
+    using MacroAssemblerX86Common::add32;
+    using MacroAssemblerX86Common::and32;
+    using MacroAssemblerX86Common::sub32;
+    using MacroAssemblerX86Common::or32;
+    using MacroAssemblerX86Common::load32;
+    using MacroAssemblerX86Common::store32;
+    using MacroAssemblerX86Common::branch32;
+    using MacroAssemblerX86Common::call;
+
+    void add32(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        m_assembler.leal_mr(imm.m_value, src, dest);
+    }
+
+    void add32(Imm32 imm, AbsoluteAddress address)
+    {
+        m_assembler.addl_im(imm.m_value, address.m_ptr);
+    }
+    
+    void addWithCarry32(Imm32 imm, AbsoluteAddress address)
+    {
+        m_assembler.adcl_im(imm.m_value, address.m_ptr);
+    }
+    
+    void and32(Imm32 imm, AbsoluteAddress address)
+    {
+        m_assembler.andl_im(imm.m_value, address.m_ptr);
+    }
+    
+    void or32(Imm32 imm, AbsoluteAddress address)
+    {
+        m_assembler.orl_im(imm.m_value, address.m_ptr);
+    }
+
+    void sub32(Imm32 imm, AbsoluteAddress address)
+    {
+        m_assembler.subl_im(imm.m_value, address.m_ptr);
+    }
+
+    void load32(void* address, RegisterID dest)
+    {
+        m_assembler.movl_mr(address, dest);
+    }
+
+    void store32(Imm32 imm, void* address)
+    {
+        m_assembler.movl_i32m(imm.m_value, address);
+    }
+
+    void store32(RegisterID src, void* address)
+    {
+        m_assembler.movl_rm(src, address);
+    }
+
+    Jump branch32(Condition cond, AbsoluteAddress left, RegisterID right)
+    {
+        m_assembler.cmpl_rm(right, left.m_ptr);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch32(Condition cond, AbsoluteAddress left, Imm32 right)
+    {
+        m_assembler.cmpl_im(right.m_value, left.m_ptr);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Call call()
+    {
+        return Call(m_assembler.call(), Call::Linkable);
+    }
+
+    Call tailRecursiveCall()
+    {
+        return Call::fromTailJump(jump());
+    }
+
+    Call makeTailRecursiveCall(Jump oldJump)
+    {
+        return Call::fromTailJump(oldJump);
+    }
+
+
+    DataLabelPtr moveWithPatch(ImmPtr initialValue, RegisterID dest)
+    {
+        m_assembler.movl_i32r(initialValue.asIntptr(), dest);
+        return DataLabelPtr(this);
+    }
+
+    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    {
+        m_assembler.cmpl_ir_force32(initialRightValue.asIntptr(), left);
+        dataLabel = DataLabelPtr(this);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    {
+        m_assembler.cmpl_im_force32(initialRightValue.asIntptr(), left.offset, left.base);
+        dataLabel = DataLabelPtr(this);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    DataLabelPtr storePtrWithPatch(ImmPtr initialValue, ImplicitAddress address)
+    {
+        m_assembler.movl_i32m(initialValue.asIntptr(), address.offset, address.base);
+        return DataLabelPtr(this);
+    }
+
+    Label loadPtrWithPatchToLEA(Address address, RegisterID dest)
+    {
+        Label label(this);
+        load32(address, dest);
+        return label;
+    }
+
+    bool supportsFloatingPoint() const { return m_isSSE2Present; }
+    // See comment on MacroAssemblerARMv7::supportsFloatingPointTruncate()
+    bool supportsFloatingPointTruncate() const { return m_isSSE2Present; }
+
+private:
+    const bool m_isSSE2Present;
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
+
+#endif // MacroAssemblerX86_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h
new file mode 100644
index 0000000..cea691e
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86Common.h
@@ -0,0 +1,780 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MacroAssemblerX86Common_h
+#define MacroAssemblerX86Common_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(ASSEMBLER)
+
+#include "X86Assembler.h"
+#include "AbstractMacroAssembler.h"
+
+namespace JSC {
+
+class MacroAssemblerX86Common : public AbstractMacroAssembler<X86Assembler> {
+public:
+
+    enum Condition {
+        Equal = X86Assembler::ConditionE,
+        NotEqual = X86Assembler::ConditionNE,
+        Above = X86Assembler::ConditionA,
+        AboveOrEqual = X86Assembler::ConditionAE,
+        Below = X86Assembler::ConditionB,
+        BelowOrEqual = X86Assembler::ConditionBE,
+        GreaterThan = X86Assembler::ConditionG,
+        GreaterThanOrEqual = X86Assembler::ConditionGE,
+        LessThan = X86Assembler::ConditionL,
+        LessThanOrEqual = X86Assembler::ConditionLE,
+        Overflow = X86Assembler::ConditionO,
+        Signed = X86Assembler::ConditionS,
+        Zero = X86Assembler::ConditionE,
+        NonZero = X86Assembler::ConditionNE
+    };
+
+    enum DoubleCondition {
+        DoubleEqual = X86Assembler::ConditionE,
+        DoubleGreaterThan = X86Assembler::ConditionA,
+        DoubleGreaterThanOrEqual = X86Assembler::ConditionAE,
+        DoubleLessThan = X86Assembler::ConditionB,
+        DoubleLessThanOrEqual = X86Assembler::ConditionBE,
+    };
+
+    static const RegisterID stackPointerRegister = X86::esp;
+
+    // Integer arithmetic operations:
+    //
+    // Operations are typically two operand - operation(source, srcDst)
+    // For many operations the source may be an Imm32, the srcDst operand
+    // may often be a memory location (explictly described using an Address
+    // object).
+
+    void add32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.addl_rr(src, dest);
+    }
+
+    void add32(Imm32 imm, Address address)
+    {
+        m_assembler.addl_im(imm.m_value, address.offset, address.base);
+    }
+
+    void add32(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.addl_ir(imm.m_value, dest);
+    }
+    
+    void add32(Address src, RegisterID dest)
+    {
+        m_assembler.addl_mr(src.offset, src.base, dest);
+    }
+    
+    void and32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.andl_rr(src, dest);
+    }
+
+    void and32(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.andl_ir(imm.m_value, dest);
+    }
+
+    void and32(Imm32 imm, Address address)
+    {
+        m_assembler.andl_im(imm.m_value, address.offset, address.base);
+    }
+
+    void lshift32(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.shll_i8r(imm.m_value, dest);
+    }
+    
+    void lshift32(RegisterID shift_amount, RegisterID dest)
+    {
+        // On x86 we can only shift by ecx; if asked to shift by another register we'll
+        // need rejig the shift amount into ecx first, and restore the registers afterwards.
+        if (shift_amount != X86::ecx) {
+            swap(shift_amount, X86::ecx);
+
+            // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
+            if (dest == shift_amount)
+                m_assembler.shll_CLr(X86::ecx);
+            // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
+            else if (dest == X86::ecx)
+                m_assembler.shll_CLr(shift_amount);
+            // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
+            else
+                m_assembler.shll_CLr(dest);
+        
+            swap(shift_amount, X86::ecx);
+        } else
+            m_assembler.shll_CLr(dest);
+    }
+    
+    void mul32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.imull_rr(src, dest);
+    }
+    
+    void mul32(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        m_assembler.imull_i32r(src, imm.m_value, dest);
+    }
+    
+    void not32(RegisterID srcDest)
+    {
+        m_assembler.notl_r(srcDest);
+    }
+    
+    void or32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.orl_rr(src, dest);
+    }
+
+    void or32(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.orl_ir(imm.m_value, dest);
+    }
+
+    void or32(Imm32 imm, Address address)
+    {
+        m_assembler.orl_im(imm.m_value, address.offset, address.base);
+    }
+
+    void rshift32(RegisterID shift_amount, RegisterID dest)
+    {
+        // On x86 we can only shift by ecx; if asked to shift by another register we'll
+        // need rejig the shift amount into ecx first, and restore the registers afterwards.
+        if (shift_amount != X86::ecx) {
+            swap(shift_amount, X86::ecx);
+
+            // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
+            if (dest == shift_amount)
+                m_assembler.sarl_CLr(X86::ecx);
+            // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
+            else if (dest == X86::ecx)
+                m_assembler.sarl_CLr(shift_amount);
+            // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
+            else
+                m_assembler.sarl_CLr(dest);
+        
+            swap(shift_amount, X86::ecx);
+        } else
+            m_assembler.sarl_CLr(dest);
+    }
+
+    void rshift32(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.sarl_i8r(imm.m_value, dest);
+    }
+
+    void sub32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.subl_rr(src, dest);
+    }
+    
+    void sub32(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.subl_ir(imm.m_value, dest);
+    }
+    
+    void sub32(Imm32 imm, Address address)
+    {
+        m_assembler.subl_im(imm.m_value, address.offset, address.base);
+    }
+
+    void sub32(Address src, RegisterID dest)
+    {
+        m_assembler.subl_mr(src.offset, src.base, dest);
+    }
+
+    void xor32(RegisterID src, RegisterID dest)
+    {
+        m_assembler.xorl_rr(src, dest);
+    }
+
+    void xor32(Imm32 imm, RegisterID srcDest)
+    {
+        m_assembler.xorl_ir(imm.m_value, srcDest);
+    }
+    
+
+    // Memory access operations:
+    //
+    // Loads are of the form load(address, destination) and stores of the form
+    // store(source, address).  The source for a store may be an Imm32.  Address
+    // operand objects to loads and store will be implicitly constructed if a
+    // register is passed.
+
+    void load32(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.movl_mr(address.offset, address.base, dest);
+    }
+
+    void load32(BaseIndex address, RegisterID dest)
+    {
+        m_assembler.movl_mr(address.offset, address.base, address.index, address.scale, dest);
+    }
+
+    DataLabel32 load32WithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        m_assembler.movl_mr_disp32(address.offset, address.base, dest);
+        return DataLabel32(this);
+    }
+
+    void load16(BaseIndex address, RegisterID dest)
+    {
+        m_assembler.movzwl_mr(address.offset, address.base, address.index, address.scale, dest);
+    }
+
+    DataLabel32 store32WithAddressOffsetPatch(RegisterID src, Address address)
+    {
+        m_assembler.movl_rm_disp32(src, address.offset, address.base);
+        return DataLabel32(this);
+    }
+
+    void store32(RegisterID src, ImplicitAddress address)
+    {
+        m_assembler.movl_rm(src, address.offset, address.base);
+    }
+
+    void store32(RegisterID src, BaseIndex address)
+    {
+        m_assembler.movl_rm(src, address.offset, address.base, address.index, address.scale);
+    }
+
+    void store32(Imm32 imm, ImplicitAddress address)
+    {
+        m_assembler.movl_i32m(imm.m_value, address.offset, address.base);
+    }
+
+
+    // Floating-point operation:
+    //
+    // Presently only supports SSE, not x87 floating point.
+
+    void loadDouble(ImplicitAddress address, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.movsd_mr(address.offset, address.base, dest);
+    }
+
+    void storeDouble(FPRegisterID src, ImplicitAddress address)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.movsd_rm(src, address.offset, address.base);
+    }
+
+    void addDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.addsd_rr(src, dest);
+    }
+
+    void addDouble(Address src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.addsd_mr(src.offset, src.base, dest);
+    }
+
+    void subDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.subsd_rr(src, dest);
+    }
+
+    void subDouble(Address src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.subsd_mr(src.offset, src.base, dest);
+    }
+
+    void mulDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.mulsd_rr(src, dest);
+    }
+
+    void mulDouble(Address src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.mulsd_mr(src.offset, src.base, dest);
+    }
+
+    void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.cvtsi2sd_rr(src, dest);
+    }
+
+    Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.ucomisd_rr(right, left);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    // Truncates 'src' to an integer, and places the resulting 'dest'.
+    // If the result is not representable as a 32 bit value, branch.
+    // May also branch for some values that are representable in 32 bits
+    // (specifically, in this case, INT_MIN).
+    Jump branchTruncateDoubleToInt32(FPRegisterID src, RegisterID dest)
+    {
+        ASSERT(isSSE2Present());
+        m_assembler.cvttsd2si_rr(src, dest);
+        return branch32(Equal, dest, Imm32(0x80000000));
+    }
+
+
+    // Stack manipulation operations:
+    //
+    // The ABI is assumed to provide a stack abstraction to memory,
+    // containing machine word sized units of data.  Push and pop
+    // operations add and remove a single register sized unit of data
+    // to or from the stack.  Peek and poke operations read or write
+    // values on the stack, without moving the current stack position.
+    
+    void pop(RegisterID dest)
+    {
+        m_assembler.pop_r(dest);
+    }
+
+    void push(RegisterID src)
+    {
+        m_assembler.push_r(src);
+    }
+
+    void push(Address address)
+    {
+        m_assembler.push_m(address.offset, address.base);
+    }
+
+    void push(Imm32 imm)
+    {
+        m_assembler.push_i32(imm.m_value);
+    }
+
+
+    // Register move operations:
+    //
+    // Move values in registers.
+
+    void move(Imm32 imm, RegisterID dest)
+    {
+        // Note: on 64-bit the Imm32 value is zero extended into the register, it
+        // may be useful to have a separate version that sign extends the value?
+        if (!imm.m_value)
+            m_assembler.xorl_rr(dest, dest);
+        else
+            m_assembler.movl_i32r(imm.m_value, dest);
+    }
+
+#if PLATFORM(X86_64)
+    void move(RegisterID src, RegisterID dest)
+    {
+        // Note: on 64-bit this is is a full register move; perhaps it would be
+        // useful to have separate move32 & movePtr, with move32 zero extending?
+        m_assembler.movq_rr(src, dest);
+    }
+
+    void move(ImmPtr imm, RegisterID dest)
+    {
+        if (CAN_SIGN_EXTEND_U32_64(imm.asIntptr()))
+            m_assembler.movl_i32r(static_cast<int32_t>(imm.asIntptr()), dest);
+        else
+            m_assembler.movq_i64r(imm.asIntptr(), dest);
+    }
+
+    void swap(RegisterID reg1, RegisterID reg2)
+    {
+        m_assembler.xchgq_rr(reg1, reg2);
+    }
+
+    void signExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        m_assembler.movsxd_rr(src, dest);
+    }
+
+    void zeroExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        m_assembler.movl_rr(src, dest);
+    }
+#else
+    void move(RegisterID src, RegisterID dest)
+    {
+        if (src != dest)
+            m_assembler.movl_rr(src, dest);
+    }
+
+    void move(ImmPtr imm, RegisterID dest)
+    {
+        m_assembler.movl_i32r(imm.asIntptr(), dest);
+    }
+
+    void swap(RegisterID reg1, RegisterID reg2)
+    {
+        if (reg1 != reg2)
+            m_assembler.xchgl_rr(reg1, reg2);
+    }
+
+    void signExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        move(src, dest);
+    }
+
+    void zeroExtend32ToPtr(RegisterID src, RegisterID dest)
+    {
+        move(src, dest);
+    }
+#endif
+
+
+    // Forwards / external control flow operations:
+    //
+    // This set of jump and conditional branch operations return a Jump
+    // object which may linked at a later point, allow forwards jump,
+    // or jumps that will require external linkage (after the code has been
+    // relocated).
+    //
+    // For branches, signed <, >, <= and >= are denoted as l, g, le, and ge
+    // respecitvely, for unsigned comparisons the names b, a, be, and ae are
+    // used (representing the names 'below' and 'above').
+    //
+    // Operands to the comparision are provided in the expected order, e.g.
+    // jle32(reg1, Imm32(5)) will branch if the value held in reg1, when
+    // treated as a signed 32bit value, is less than or equal to 5.
+    //
+    // jz and jnz test whether the first operand is equal to zero, and take
+    // an optional second operand of a mask under which to perform the test.
+
+public:
+    Jump branch32(Condition cond, RegisterID left, RegisterID right)
+    {
+        m_assembler.cmpl_rr(right, left);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch32(Condition cond, RegisterID left, Imm32 right)
+    {
+        if (((cond == Equal) || (cond == NotEqual)) && !right.m_value)
+            m_assembler.testl_rr(left, left);
+        else
+            m_assembler.cmpl_ir(right.m_value, left);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+    Jump branch32(Condition cond, RegisterID left, Address right)
+    {
+        m_assembler.cmpl_mr(right.offset, right.base, left);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+    Jump branch32(Condition cond, Address left, RegisterID right)
+    {
+        m_assembler.cmpl_rm(right, left.offset, left.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch32(Condition cond, Address left, Imm32 right)
+    {
+        m_assembler.cmpl_im(right.m_value, left.offset, left.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch32(Condition cond, BaseIndex left, Imm32 right)
+    {
+        m_assembler.cmpl_im(right.m_value, left.offset, left.base, left.index, left.scale);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch16(Condition cond, BaseIndex left, RegisterID right)
+    {
+        m_assembler.cmpw_rm(right, left.offset, left.base, left.index, left.scale);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branch16(Condition cond, BaseIndex left, Imm32 right)
+    {
+        ASSERT(!(right.m_value & 0xFFFF0000));
+
+        m_assembler.cmpw_im(right.m_value, left.offset, left.base, left.index, left.scale);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchTest32(Condition cond, RegisterID reg, RegisterID mask)
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        m_assembler.testl_rr(reg, mask);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchTest32(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        // if we are only interested in the low seven bits, this can be tested with a testb
+        if (mask.m_value == -1)
+            m_assembler.testl_rr(reg, reg);
+        else if ((mask.m_value & ~0x7f) == 0)
+            m_assembler.testb_i8r(mask.m_value, reg);
+        else
+            m_assembler.testl_i32r(mask.m_value, reg);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchTest32(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        if (mask.m_value == -1)
+            m_assembler.cmpl_im(0, address.offset, address.base);
+        else
+            m_assembler.testl_i32m(mask.m_value, address.offset, address.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchTest32(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
+    {
+        ASSERT((cond == Zero) || (cond == NonZero));
+        if (mask.m_value == -1)
+            m_assembler.cmpl_im(0, address.offset, address.base, address.index, address.scale);
+        else
+            m_assembler.testl_i32m(mask.m_value, address.offset, address.base, address.index, address.scale);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump jump()
+    {
+        return Jump(m_assembler.jmp());
+    }
+
+    void jump(RegisterID target)
+    {
+        m_assembler.jmp_r(target);
+    }
+
+    // Address is a memory location containing the address to jump to
+    void jump(Address address)
+    {
+        m_assembler.jmp_m(address.offset, address.base);
+    }
+
+
+    // Arithmetic control flow operations:
+    //
+    // This set of conditional branch operations branch based
+    // on the result of an arithmetic operation.  The operation
+    // is performed as normal, storing the result.
+    //
+    // * jz operations branch if the result is zero.
+    // * jo operations branch if the (signed) arithmetic
+    //   operation caused an overflow to occur.
+    
+    Jump branchAdd32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        add32(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchAdd32(Condition cond, Imm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        add32(imm, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+    Jump branchMul32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT(cond == Overflow);
+        mul32(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+    Jump branchMul32(Condition cond, Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        ASSERT(cond == Overflow);
+        mul32(imm, src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+    Jump branchSub32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        sub32(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+    Jump branchSub32(Condition cond, Imm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
+        sub32(imm, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+    
+
+    // Miscellaneous operations:
+
+    void breakpoint()
+    {
+        m_assembler.int3();
+    }
+
+    Call nearCall()
+    {
+        return Call(m_assembler.call(), Call::LinkableNear);
+    }
+
+    Call call(RegisterID target)
+    {
+        return Call(m_assembler.call(target), Call::None);
+    }
+
+    void call(Address address)
+    {
+        m_assembler.call_m(address.offset, address.base);
+    }
+
+    void ret()
+    {
+        m_assembler.ret();
+    }
+
+    void set32(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        m_assembler.cmpl_rr(right, left);
+        m_assembler.setCC_r(x86Condition(cond), dest);
+        m_assembler.movzbl_rr(dest, dest);
+    }
+
+    void set32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    {
+        if (((cond == Equal) || (cond == NotEqual)) && !right.m_value)
+            m_assembler.testl_rr(left, left);
+        else
+            m_assembler.cmpl_ir(right.m_value, left);
+        m_assembler.setCC_r(x86Condition(cond), dest);
+        m_assembler.movzbl_rr(dest, dest);
+    }
+
+    // FIXME:
+    // The mask should be optional... paerhaps the argument order should be
+    // dest-src, operations always have a dest? ... possibly not true, considering
+    // asm ops like test, or pseudo ops like pop().
+    void setTest32(Condition cond, Address address, Imm32 mask, RegisterID dest)
+    {
+        if (mask.m_value == -1)
+            m_assembler.cmpl_im(0, address.offset, address.base);
+        else
+            m_assembler.testl_i32m(mask.m_value, address.offset, address.base);
+        m_assembler.setCC_r(x86Condition(cond), dest);
+        m_assembler.movzbl_rr(dest, dest);
+    }
+
+protected:
+    X86Assembler::Condition x86Condition(Condition cond)
+    {
+        return static_cast<X86Assembler::Condition>(cond);
+    }
+
+    X86Assembler::Condition x86Condition(DoubleCondition cond)
+    {
+        return static_cast<X86Assembler::Condition>(cond);
+    }
+
+private:
+    // Only MacroAssemblerX86 should be using the following method; SSE2 is always available on
+    // x86_64, and clients & subclasses of MacroAssembler should be using 'supportsFloatingPoint()'.
+    friend class MacroAssemblerX86;
+
+#if PLATFORM(X86)
+#if PLATFORM(MAC)
+
+    // All X86 Macs are guaranteed to support at least SSE2,
+    static bool isSSE2Present()
+    {
+        return true;
+    }
+
+#else // PLATFORM(MAC)
+
+    enum SSE2CheckState {
+        NotCheckedSSE2,
+        HasSSE2,
+        NoSSE2
+    };
+
+    static bool isSSE2Present()
+    {
+        if (s_sse2CheckState == NotCheckedSSE2) {
+            // Default the flags value to zero; if the compiler is
+            // not MSVC or GCC we will read this as SSE2 not present.
+            int flags = 0;
+#if COMPILER(MSVC)
+            _asm {
+                mov eax, 1 // cpuid function 1 gives us the standard feature set
+                cpuid;
+                mov flags, edx;
+            }
+#elif COMPILER(GCC)
+            asm (
+                 "movl $0x1, %%eax;"
+                 "pushl %%ebx;"
+                 "cpuid;"
+                 "popl %%ebx;"
+                 "movl %%edx, %0;"
+                 : "=g" (flags)
+                 :
+                 : "%eax", "%ecx", "%edx"
+                 );
+#endif
+            static const int SSE2FeatureBit = 1 << 26;
+            s_sse2CheckState = (flags & SSE2FeatureBit) ? HasSSE2 : NoSSE2;
+        }
+        // Only check once.
+        ASSERT(s_sse2CheckState != NotCheckedSSE2);
+
+        return s_sse2CheckState == HasSSE2;
+    }
+    
+    static SSE2CheckState s_sse2CheckState;
+
+#endif // PLATFORM(MAC)
+#elif !defined(NDEBUG) // PLATFORM(X86)
+
+    // On x86-64 we should never be checking for SSE2 in a non-debug build,
+    // but non debug add this method to keep the asserts above happy.
+    static bool isSSE2Present()
+    {
+        return true;
+    }
+
+#endif
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
+
+#endif // MacroAssemblerX86Common_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86_64.h b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86_64.h
new file mode 100644
index 0000000..ffdca7c
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/MacroAssemblerX86_64.h
@@ -0,0 +1,455 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MacroAssemblerX86_64_h
+#define MacroAssemblerX86_64_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(ASSEMBLER) && PLATFORM(X86_64)
+
+#include "MacroAssemblerX86Common.h"
+
+namespace JSC {
+
+class MacroAssemblerX86_64 : public MacroAssemblerX86Common {
+protected:
+    static const X86::RegisterID scratchRegister = X86::r11;
+
+public:
+    static const Scale ScalePtr = TimesEight;
+
+    using MacroAssemblerX86Common::add32;
+    using MacroAssemblerX86Common::and32;
+    using MacroAssemblerX86Common::or32;
+    using MacroAssemblerX86Common::sub32;
+    using MacroAssemblerX86Common::load32;
+    using MacroAssemblerX86Common::store32;
+    using MacroAssemblerX86Common::call;
+
+    void add32(Imm32 imm, AbsoluteAddress address)
+    {
+        move(ImmPtr(address.m_ptr), scratchRegister);
+        add32(imm, Address(scratchRegister));
+    }
+    
+    void and32(Imm32 imm, AbsoluteAddress address)
+    {
+        move(ImmPtr(address.m_ptr), scratchRegister);
+        and32(imm, Address(scratchRegister));
+    }
+    
+    void or32(Imm32 imm, AbsoluteAddress address)
+    {
+        move(ImmPtr(address.m_ptr), scratchRegister);
+        or32(imm, Address(scratchRegister));
+    }
+
+    void sub32(Imm32 imm, AbsoluteAddress address)
+    {
+        move(ImmPtr(address.m_ptr), scratchRegister);
+        sub32(imm, Address(scratchRegister));
+    }
+
+    void load32(void* address, RegisterID dest)
+    {
+        if (dest == X86::eax)
+            m_assembler.movl_mEAX(address);
+        else {
+            move(X86::eax, dest);
+            m_assembler.movl_mEAX(address);
+            swap(X86::eax, dest);
+        }
+    }
+
+    void store32(Imm32 imm, void* address)
+    {
+        move(X86::eax, scratchRegister);
+        move(imm, X86::eax);
+        m_assembler.movl_EAXm(address);
+        move(scratchRegister, X86::eax);
+    }
+
+    Call call()
+    {
+        DataLabelPtr label = moveWithPatch(ImmPtr(0), scratchRegister);
+        Call result = Call(m_assembler.call(scratchRegister), Call::Linkable);
+        ASSERT(differenceBetween(label, result) == REPTACH_OFFSET_CALL_R11);
+        return result;
+    }
+
+    Call tailRecursiveCall()
+    {
+        DataLabelPtr label = moveWithPatch(ImmPtr(0), scratchRegister);
+        Jump newJump = Jump(m_assembler.jmp_r(scratchRegister));
+        ASSERT(differenceBetween(label, newJump) == REPTACH_OFFSET_CALL_R11);
+        return Call::fromTailJump(newJump);
+    }
+
+    Call makeTailRecursiveCall(Jump oldJump)
+    {
+        oldJump.link(this);
+        DataLabelPtr label = moveWithPatch(ImmPtr(0), scratchRegister);
+        Jump newJump = Jump(m_assembler.jmp_r(scratchRegister));
+        ASSERT(differenceBetween(label, newJump) == REPTACH_OFFSET_CALL_R11);
+        return Call::fromTailJump(newJump);
+    }
+
+
+    void addPtr(RegisterID src, RegisterID dest)
+    {
+        m_assembler.addq_rr(src, dest);
+    }
+
+    void addPtr(Imm32 imm, RegisterID srcDest)
+    {
+        m_assembler.addq_ir(imm.m_value, srcDest);
+    }
+
+    void addPtr(ImmPtr imm, RegisterID dest)
+    {
+        move(imm, scratchRegister);
+        m_assembler.addq_rr(scratchRegister, dest);
+    }
+
+    void addPtr(Imm32 imm, RegisterID src, RegisterID dest)
+    {
+        m_assembler.leaq_mr(imm.m_value, src, dest);
+    }
+
+    void addPtr(Imm32 imm, Address address)
+    {
+        m_assembler.addq_im(imm.m_value, address.offset, address.base);
+    }
+
+    void addPtr(Imm32 imm, AbsoluteAddress address)
+    {
+        move(ImmPtr(address.m_ptr), scratchRegister);
+        addPtr(imm, Address(scratchRegister));
+    }
+    
+    void andPtr(RegisterID src, RegisterID dest)
+    {
+        m_assembler.andq_rr(src, dest);
+    }
+
+    void andPtr(Imm32 imm, RegisterID srcDest)
+    {
+        m_assembler.andq_ir(imm.m_value, srcDest);
+    }
+
+    void orPtr(RegisterID src, RegisterID dest)
+    {
+        m_assembler.orq_rr(src, dest);
+    }
+
+    void orPtr(ImmPtr imm, RegisterID dest)
+    {
+        move(imm, scratchRegister);
+        m_assembler.orq_rr(scratchRegister, dest);
+    }
+
+    void orPtr(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.orq_ir(imm.m_value, dest);
+    }
+
+    void rshiftPtr(RegisterID shift_amount, RegisterID dest)
+    {
+        // On x86 we can only shift by ecx; if asked to shift by another register we'll
+        // need rejig the shift amount into ecx first, and restore the registers afterwards.
+        if (shift_amount != X86::ecx) {
+            swap(shift_amount, X86::ecx);
+
+            // E.g. transform "shll %eax, %eax" -> "xchgl %eax, %ecx; shll %ecx, %ecx; xchgl %eax, %ecx"
+            if (dest == shift_amount)
+                m_assembler.sarq_CLr(X86::ecx);
+            // E.g. transform "shll %eax, %ecx" -> "xchgl %eax, %ecx; shll %ecx, %eax; xchgl %eax, %ecx"
+            else if (dest == X86::ecx)
+                m_assembler.sarq_CLr(shift_amount);
+            // E.g. transform "shll %eax, %ebx" -> "xchgl %eax, %ecx; shll %ecx, %ebx; xchgl %eax, %ecx"
+            else
+                m_assembler.sarq_CLr(dest);
+        
+            swap(shift_amount, X86::ecx);
+        } else
+            m_assembler.sarq_CLr(dest);
+    }
+
+    void rshiftPtr(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.sarq_i8r(imm.m_value, dest);
+    }
+
+    void subPtr(RegisterID src, RegisterID dest)
+    {
+        m_assembler.subq_rr(src, dest);
+    }
+    
+    void subPtr(Imm32 imm, RegisterID dest)
+    {
+        m_assembler.subq_ir(imm.m_value, dest);
+    }
+    
+    void subPtr(ImmPtr imm, RegisterID dest)
+    {
+        move(imm, scratchRegister);
+        m_assembler.subq_rr(scratchRegister, dest);
+    }
+
+    void xorPtr(RegisterID src, RegisterID dest)
+    {
+        m_assembler.xorq_rr(src, dest);
+    }
+
+    void xorPtr(Imm32 imm, RegisterID srcDest)
+    {
+        m_assembler.xorq_ir(imm.m_value, srcDest);
+    }
+
+
+    void loadPtr(ImplicitAddress address, RegisterID dest)
+    {
+        m_assembler.movq_mr(address.offset, address.base, dest);
+    }
+
+    void loadPtr(BaseIndex address, RegisterID dest)
+    {
+        m_assembler.movq_mr(address.offset, address.base, address.index, address.scale, dest);
+    }
+
+    void loadPtr(void* address, RegisterID dest)
+    {
+        if (dest == X86::eax)
+            m_assembler.movq_mEAX(address);
+        else {
+            move(X86::eax, dest);
+            m_assembler.movq_mEAX(address);
+            swap(X86::eax, dest);
+        }
+    }
+
+    DataLabel32 loadPtrWithAddressOffsetPatch(Address address, RegisterID dest)
+    {
+        m_assembler.movq_mr_disp32(address.offset, address.base, dest);
+        return DataLabel32(this);
+    }
+
+    void storePtr(RegisterID src, ImplicitAddress address)
+    {
+        m_assembler.movq_rm(src, address.offset, address.base);
+    }
+
+    void storePtr(RegisterID src, BaseIndex address)
+    {
+        m_assembler.movq_rm(src, address.offset, address.base, address.index, address.scale);
+    }
+    
+    void storePtr(RegisterID src, void* address)
+    {
+        if (src == X86::eax)
+            m_assembler.movq_EAXm(address);
+        else {
+            swap(X86::eax, src);
+            m_assembler.movq_EAXm(address);
+            swap(X86::eax, src);
+        }
+    }
+
+    void storePtr(ImmPtr imm, ImplicitAddress address)
+    {
+        intptr_t ptr = imm.asIntptr();
+        if (CAN_SIGN_EXTEND_32_64(ptr))
+            m_assembler.movq_i32m(static_cast<int>(ptr), address.offset, address.base);
+        else {
+            move(imm, scratchRegister);
+            storePtr(scratchRegister, address);
+        }
+    }
+
+    DataLabel32 storePtrWithAddressOffsetPatch(RegisterID src, Address address)
+    {
+        m_assembler.movq_rm_disp32(src, address.offset, address.base);
+        return DataLabel32(this);
+    }
+
+    void movePtrToDouble(RegisterID src, FPRegisterID dest)
+    {
+        m_assembler.movq_rr(src, dest);
+    }
+
+    void moveDoubleToPtr(FPRegisterID src, RegisterID dest)
+    {
+        m_assembler.movq_rr(src, dest);
+    }
+
+    void setPtr(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    {
+        if (((cond == Equal) || (cond == NotEqual)) && !right.m_value)
+            m_assembler.testq_rr(left, left);
+        else
+            m_assembler.cmpq_ir(right.m_value, left);
+        m_assembler.setCC_r(x86Condition(cond), dest);
+        m_assembler.movzbl_rr(dest, dest);
+    }
+
+    Jump branchPtr(Condition cond, RegisterID left, RegisterID right)
+    {
+        m_assembler.cmpq_rr(right, left);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchPtr(Condition cond, RegisterID left, ImmPtr right)
+    {
+        intptr_t imm = right.asIntptr();
+        if (CAN_SIGN_EXTEND_32_64(imm)) {
+            if (!imm)
+                m_assembler.testq_rr(left, left);
+            else
+                m_assembler.cmpq_ir(imm, left);
+            return Jump(m_assembler.jCC(x86Condition(cond)));
+        } else {
+            move(right, scratchRegister);
+            return branchPtr(cond, left, scratchRegister);
+        }
+    }
+
+    Jump branchPtr(Condition cond, RegisterID left, Address right)
+    {
+        m_assembler.cmpq_mr(right.offset, right.base, left);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchPtr(Condition cond, AbsoluteAddress left, RegisterID right)
+    {
+        move(ImmPtr(left.m_ptr), scratchRegister);
+        return branchPtr(cond, Address(scratchRegister), right);
+    }
+
+    Jump branchPtr(Condition cond, Address left, RegisterID right)
+    {
+        m_assembler.cmpq_rm(right, left.offset, left.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchPtr(Condition cond, Address left, ImmPtr right)
+    {
+        move(right, scratchRegister);
+        return branchPtr(cond, left, scratchRegister);
+    }
+
+    Jump branchTestPtr(Condition cond, RegisterID reg, RegisterID mask)
+    {
+        m_assembler.testq_rr(reg, mask);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchTestPtr(Condition cond, RegisterID reg, Imm32 mask = Imm32(-1))
+    {
+        // if we are only interested in the low seven bits, this can be tested with a testb
+        if (mask.m_value == -1)
+            m_assembler.testq_rr(reg, reg);
+        else if ((mask.m_value & ~0x7f) == 0)
+            m_assembler.testb_i8r(mask.m_value, reg);
+        else
+            m_assembler.testq_i32r(mask.m_value, reg);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchTestPtr(Condition cond, Address address, Imm32 mask = Imm32(-1))
+    {
+        if (mask.m_value == -1)
+            m_assembler.cmpq_im(0, address.offset, address.base);
+        else
+            m_assembler.testq_i32m(mask.m_value, address.offset, address.base);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchTestPtr(Condition cond, BaseIndex address, Imm32 mask = Imm32(-1))
+    {
+        if (mask.m_value == -1)
+            m_assembler.cmpq_im(0, address.offset, address.base, address.index, address.scale);
+        else
+            m_assembler.testq_i32m(mask.m_value, address.offset, address.base, address.index, address.scale);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+
+    Jump branchAddPtr(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
+        addPtr(src, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    Jump branchSubPtr(Condition cond, Imm32 imm, RegisterID dest)
+    {
+        ASSERT((cond == Overflow) || (cond == Zero) || (cond == NonZero));
+        subPtr(imm, dest);
+        return Jump(m_assembler.jCC(x86Condition(cond)));
+    }
+
+    DataLabelPtr moveWithPatch(ImmPtr initialValue, RegisterID dest)
+    {
+        m_assembler.movq_i64r(initialValue.asIntptr(), dest);
+        return DataLabelPtr(this);
+    }
+
+    Jump branchPtrWithPatch(Condition cond, RegisterID left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    {
+        dataLabel = moveWithPatch(initialRightValue, scratchRegister);
+        return branchPtr(cond, left, scratchRegister);
+    }
+
+    Jump branchPtrWithPatch(Condition cond, Address left, DataLabelPtr& dataLabel, ImmPtr initialRightValue = ImmPtr(0))
+    {
+        dataLabel = moveWithPatch(initialRightValue, scratchRegister);
+        return branchPtr(cond, left, scratchRegister);
+    }
+
+    DataLabelPtr storePtrWithPatch(ImmPtr initialValue, ImplicitAddress address)
+    {
+        DataLabelPtr label = moveWithPatch(initialValue, scratchRegister);
+        storePtr(scratchRegister, address);
+        return label;
+    }
+
+    Label loadPtrWithPatchToLEA(Address address, RegisterID dest)
+    {
+        Label label(this);
+        loadPtr(address, dest);
+        return label;
+    }
+
+    bool supportsFloatingPoint() const { return true; }
+    // See comment on MacroAssemblerARMv7::supportsFloatingPointTruncate()
+    bool supportsFloatingPointTruncate() const { return true; }
+};
+
+} // namespace JSC
+
+#endif // ENABLE(ASSEMBLER)
+
+#endif // MacroAssemblerX86_64_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h b/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h
index 3b0ce65..7a8b58d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/assembler/X86Assembler.h
@@ -82,8 +82,32 @@ class X86Assembler {
 public:
     typedef X86::RegisterID RegisterID;
     typedef X86::XMMRegisterID XMMRegisterID;
+    typedef XMMRegisterID FPRegisterID;
 
     typedef enum {
+        ConditionO,
+        ConditionNO,
+        ConditionB,
+        ConditionAE,
+        ConditionE,
+        ConditionNE,
+        ConditionBE,
+        ConditionA,
+        ConditionS,
+        ConditionNS,
+        ConditionP,
+        ConditionNP,
+        ConditionL,
+        ConditionGE,
+        ConditionLE,
+        ConditionG,
+
+        ConditionC  = ConditionB,
+        ConditionNC = ConditionAE,
+    } Condition;
+
+private:
+    typedef enum {
         OP_ADD_EvGv                     = 0x01,
         OP_ADD_GvEv                     = 0x03,
         OP_OR_EvGv                      = 0x09,
@@ -145,31 +169,30 @@ public:
         OP2_ADDSD_VsdWsd    = 0x58,
         OP2_MULSD_VsdWsd    = 0x59,
         OP2_SUBSD_VsdWsd    = 0x5C,
+        OP2_MOVD_VdEd       = 0x6E,
         OP2_MOVD_EdVd       = 0x7E,
-        OP2_JO_rel32        = 0x80,
-        OP2_JB_rel32        = 0x82,
-        OP2_JAE_rel32       = 0x83,
-        OP2_JE_rel32        = 0x84,
-        OP2_JNE_rel32       = 0x85,
-        OP2_JBE_rel32       = 0x86,
-        OP2_JA_rel32        = 0x87,
-        OP2_JS_rel32        = 0x88,
-        OP2_JP_rel32        = 0x8A,
-        OP2_JL_rel32        = 0x8C,
-        OP2_JGE_rel32       = 0x8D,
-        OP2_JLE_rel32       = 0x8E,
-        OP2_JG_rel32        = 0x8F,
-        OP_SETE             = 0x94,
-        OP_SETNE            = 0x95,
+        OP2_JCC_rel32       = 0x80,
+        OP_SETCC            = 0x90,
         OP2_IMUL_GvEv       = 0xAF,
         OP2_MOVZX_GvEb      = 0xB6,
         OP2_MOVZX_GvEw      = 0xB7,
         OP2_PEXTRW_GdUdIb   = 0xC5,
     } TwoByteOpcodeID;
 
+    TwoByteOpcodeID jccRel32(Condition cond)
+    {
+        return (TwoByteOpcodeID)(OP2_JCC_rel32 + cond);
+    }
+
+    TwoByteOpcodeID setccOpcode(Condition cond)
+    {
+        return (TwoByteOpcodeID)(OP_SETCC + cond);
+    }
+
     typedef enum {
         GROUP1_OP_ADD = 0,
         GROUP1_OP_OR  = 1,
+        GROUP1_OP_ADC = 2,
         GROUP1_OP_AND = 4,
         GROUP1_OP_SUB = 5,
         GROUP1_OP_XOR = 6,
@@ -191,9 +214,6 @@ public:
         GROUP11_MOV = 0,
     } GroupOpcodeID;
     
-    // Opaque label types
-    
-private:
     class X86InstructionFormatter;
 public:
 
@@ -221,16 +241,22 @@ public:
     public:
         JmpDst()
             : m_offset(-1)
+            , m_used(false)
         {
         }
 
+        bool isUsed() const { return m_used; }
+        void used() { m_used = true; }
     private:
         JmpDst(int offset)
             : m_offset(offset)
+            , m_used(false)
         {
+            ASSERT(m_offset == offset);
         }
 
-        int m_offset;
+        int m_offset : 31;
+        bool m_used : 1;
     };
 
     X86Assembler()
@@ -269,6 +295,19 @@ public:
 
     // Arithmetic operations:
 
+#if !PLATFORM(X86_64)
+    void adcl_im(int imm, void* addr)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_ADC, addr);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_ADC, addr);
+            m_formatter.immediate32(imm);
+        }
+    }
+#endif
+
     void addl_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp(OP_ADD_EvGv, src, dst);
@@ -317,6 +356,17 @@ public:
             m_formatter.immediate32(imm);
         }
     }
+
+    void addq_im(int imm, int offset, RegisterID base)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp64(OP_GROUP1_EvIb, GROUP1_OP_ADD, base, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp64(OP_GROUP1_EvIz, GROUP1_OP_ADD, base, offset);
+            m_formatter.immediate32(imm);
+        }
+    }
 #else
     void addl_im(int imm, void* addr)
     {
@@ -346,6 +396,17 @@ public:
         }
     }
 
+    void andl_im(int imm, int offset, RegisterID base)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_AND, base, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_AND, base, offset);
+            m_formatter.immediate32(imm);
+        }
+    }
+
 #if PLATFORM(X86_64)
     void andq_rr(RegisterID src, RegisterID dst)
     {
@@ -362,6 +423,17 @@ public:
             m_formatter.immediate32(imm);
         }
     }
+#else
+    void andl_im(int imm, void* addr)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_AND, addr);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_AND, addr);
+            m_formatter.immediate32(imm);
+        }
+    }
 #endif
 
     void notl_r(RegisterID dst)
@@ -390,6 +462,17 @@ public:
         }
     }
 
+    void orl_im(int imm, int offset, RegisterID base)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_OR, base, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_OR, base, offset);
+            m_formatter.immediate32(imm);
+        }
+    }
+
 #if PLATFORM(X86_64)
     void orq_rr(RegisterID src, RegisterID dst)
     {
@@ -406,6 +489,17 @@ public:
             m_formatter.immediate32(imm);
         }
     }
+#else
+    void orl_im(int imm, void* addr)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_OR, addr);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_OR, addr);
+            m_formatter.immediate32(imm);
+        }
+    }
 #endif
 
     void subl_rr(RegisterID src, RegisterID dst)
@@ -441,6 +535,11 @@ public:
     }
 
 #if PLATFORM(X86_64)
+    void subq_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_SUB_EvGv, src, dst);
+    }
+
     void subq_ir(int imm, RegisterID dst)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
@@ -634,6 +733,11 @@ public:
         m_formatter.oneByteOp64(OP_CMP_EvGv, src, base, offset);
     }
 
+    void cmpq_mr(int offset, RegisterID base, RegisterID src)
+    {
+        m_formatter.oneByteOp64(OP_CMP_GvEv, src, base, offset);
+    }
+
     void cmpq_ir(int imm, RegisterID dst)
     {
         if (CAN_SIGN_EXTEND_8_32(imm)) {
@@ -690,6 +794,19 @@ public:
         m_formatter.oneByteOp(OP_CMP_EvGv, src, base, index, scale, offset);
     }
 
+    void cmpw_im(int imm, int offset, RegisterID base, RegisterID index, int scale)
+    {
+        if (CAN_SIGN_EXTEND_8_32(imm)) {
+            m_formatter.prefix(PRE_OPERAND_SIZE);
+            m_formatter.oneByteOp(OP_GROUP1_EvIb, GROUP1_OP_CMP, base, index, scale, offset);
+            m_formatter.immediate8(imm);
+        } else {
+            m_formatter.prefix(PRE_OPERAND_SIZE);
+            m_formatter.oneByteOp(OP_GROUP1_EvIz, GROUP1_OP_CMP, base, index, scale, offset);
+            m_formatter.immediate16(imm);
+        }
+    }
+
     void testl_rr(RegisterID src, RegisterID dst)
     {
         m_formatter.oneByteOp(OP_TEST_EvGv, src, dst);
@@ -738,15 +855,26 @@ public:
     }
 #endif 
 
+    void testw_rr(RegisterID src, RegisterID dst)
+    {
+        m_formatter.prefix(PRE_OPERAND_SIZE);
+        m_formatter.oneByteOp(OP_TEST_EvGv, src, dst);
+    }
+    
     void testb_i8r(int imm, RegisterID dst)
     {
         m_formatter.oneByteOp8(OP_GROUP3_EbIb, GROUP3_OP_TEST, dst);
         m_formatter.immediate8(imm);
     }
 
+    void setCC_r(Condition cond, RegisterID dst)
+    {
+        m_formatter.twoByteOp8(setccOpcode(cond), (GroupOpcodeID)0, dst);
+    }
+
     void sete_r(RegisterID dst)
     {
-        m_formatter.twoByteOp8(OP_SETE, (GroupOpcodeID)0, dst);
+        m_formatter.twoByteOp8(setccOpcode(ConditionE), (GroupOpcodeID)0, dst);
     }
 
     void setz_r(RegisterID dst)
@@ -756,7 +884,7 @@ public:
 
     void setne_r(RegisterID dst)
     {
-        m_formatter.twoByteOp8(OP_SETNE, (GroupOpcodeID)0, dst);
+        m_formatter.twoByteOp8(setccOpcode(ConditionNE), (GroupOpcodeID)0, dst);
     }
 
     void setnz_r(RegisterID dst)
@@ -877,6 +1005,12 @@ public:
         m_formatter.immediate64(reinterpret_cast<int64_t>(addr));
     }
 
+    void movq_EAXm(void* addr)
+    {
+        m_formatter.oneByteOp64(OP_MOV_OvEAX);
+        m_formatter.immediate64(reinterpret_cast<int64_t>(addr));
+    }
+
     void movq_mr(int offset, RegisterID base, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_MOV_GvEv, dst, base, offset);
@@ -892,6 +1026,12 @@ public:
         m_formatter.oneByteOp64(OP_MOV_GvEv, dst, base, index, scale, offset);
     }
 
+    void movq_i32m(int imm, int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp64(OP_GROUP11_EvIz, GROUP11_MOV, base, offset);
+        m_formatter.immediate32(imm);
+    }
+
     void movq_i64r(int64_t imm, RegisterID dst)
     {
         m_formatter.oneByteOp64(OP_MOV_EAXIv, dst);
@@ -905,6 +1045,14 @@ public:
     
     
 #else
+    void movl_rm(RegisterID src, void* addr)
+    {
+        if (src == X86::eax)
+            movl_EAXm(addr);
+        else 
+            m_formatter.oneByteOp(OP_MOV_EvGv, src, addr);
+    }
+    
     void movl_mr(void* addr, RegisterID dst)
     {
         if (dst == X86::eax)
@@ -942,6 +1090,12 @@ public:
     {
         m_formatter.oneByteOp(OP_LEA, dst, base, offset);
     }
+#if PLATFORM(X86_64)
+    void leaq_mr(int offset, RegisterID base, RegisterID dst)
+    {
+        m_formatter.oneByteOp64(OP_LEA, dst, base, offset);
+    }
+#endif
 
     // Flow control:
 
@@ -956,6 +1110,11 @@ public:
         m_formatter.oneByteOp(OP_GROUP5_Ev, GROUP5_OP_CALLN, dst);
         return JmpSrc(m_formatter.size());
     }
+    
+    void call_m(int offset, RegisterID base)
+    {
+        m_formatter.oneByteOp(OP_GROUP5_Ev, GROUP5_OP_CALLN, base, offset);
+    }
 
     JmpSrc jmp()
     {
@@ -963,9 +1122,13 @@ public:
         return m_formatter.immediateRel32();
     }
     
-    void jmp_r(RegisterID dst)
+    // Return a JmpSrc so we have a label to the jump, so we can use this
+    // To make a tail recursive call on x86-64.  The MacroAssembler
+    // really shouldn't wrap this as a Jump, since it can't be linked. :-/
+    JmpSrc jmp_r(RegisterID dst)
     {
         m_formatter.oneByteOp(OP_GROUP5_Ev, GROUP5_OP_JMPN, dst);
+        return JmpSrc(m_formatter.size());
     }
     
     void jmp_m(int offset, RegisterID base)
@@ -975,7 +1138,7 @@ public:
 
     JmpSrc jne()
     {
-        m_formatter.twoByteOp(OP2_JNE_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionNE));
         return m_formatter.immediateRel32();
     }
     
@@ -986,73 +1149,79 @@ public:
 
     JmpSrc je()
     {
-        m_formatter.twoByteOp(OP2_JE_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionE));
         return m_formatter.immediateRel32();
     }
     
     JmpSrc jl()
     {
-        m_formatter.twoByteOp(OP2_JL_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionL));
         return m_formatter.immediateRel32();
     }
     
     JmpSrc jb()
     {
-        m_formatter.twoByteOp(OP2_JB_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionB));
         return m_formatter.immediateRel32();
     }
     
     JmpSrc jle()
     {
-        m_formatter.twoByteOp(OP2_JLE_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionLE));
         return m_formatter.immediateRel32();
     }
     
     JmpSrc jbe()
     {
-        m_formatter.twoByteOp(OP2_JBE_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionBE));
         return m_formatter.immediateRel32();
     }
     
     JmpSrc jge()
     {
-        m_formatter.twoByteOp(OP2_JGE_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionGE));
         return m_formatter.immediateRel32();
     }
 
     JmpSrc jg()
     {
-        m_formatter.twoByteOp(OP2_JG_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionG));
         return m_formatter.immediateRel32();
     }
 
     JmpSrc ja()
     {
-        m_formatter.twoByteOp(OP2_JA_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionA));
         return m_formatter.immediateRel32();
     }
     
     JmpSrc jae()
     {
-        m_formatter.twoByteOp(OP2_JAE_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionAE));
         return m_formatter.immediateRel32();
     }
     
     JmpSrc jo()
     {
-        m_formatter.twoByteOp(OP2_JO_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionO));
         return m_formatter.immediateRel32();
     }
 
     JmpSrc jp()
     {
-        m_formatter.twoByteOp(OP2_JP_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionP));
         return m_formatter.immediateRel32();
     }
     
     JmpSrc js()
     {
-        m_formatter.twoByteOp(OP2_JS_rel32);
+        m_formatter.twoByteOp(jccRel32(ConditionS));
+        return m_formatter.immediateRel32();
+    }
+
+    JmpSrc jCC(Condition cond)
+    {
+        m_formatter.twoByteOp(jccRel32(cond));
         return m_formatter.immediateRel32();
     }
 
@@ -1088,6 +1257,20 @@ public:
         m_formatter.twoByteOp(OP2_MOVD_EdVd, (RegisterID)src, dst);
     }
 
+#if PLATFORM(X86_64)
+    void movq_rr(XMMRegisterID src, RegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.twoByteOp64(OP2_MOVD_EdVd, (RegisterID)src, dst);
+    }
+
+    void movq_rr(RegisterID src, XMMRegisterID dst)
+    {
+        m_formatter.prefix(PRE_SSE_66);
+        m_formatter.twoByteOp64(OP2_MOVD_VdEd, (RegisterID)dst, src);
+    }
+#endif
+
     void movsd_rm(XMMRegisterID src, int offset, RegisterID base)
     {
         m_formatter.prefix(PRE_SSE_F2);
@@ -1131,7 +1314,7 @@ public:
         m_formatter.twoByteOp(OP2_SUBSD_VsdWsd, (RegisterID)dst, base, offset);
     }
 
-    void ucomis_rr(XMMRegisterID src, XMMRegisterID dst)
+    void ucomisd_rr(XMMRegisterID src, XMMRegisterID dst)
     {
         m_formatter.prefix(PRE_SSE_66);
         m_formatter.twoByteOp(OP2_UCOMISD_VsdWsd, (RegisterID)dst, (RegisterID)src);
@@ -1170,31 +1353,95 @@ public:
     }
 
     // Linking & patching:
+    //
+    // 'link' and 'patch' methods are for use on unprotected code - such as the code
+    // within the AssemblerBuffer, and code being patched by the patch buffer.  Once
+    // code has been finalized it is (platform support permitting) within a non-
+    // writable region of memory; to modify the code in an execute-only execuable
+    // pool the 'repatch' and 'relink' methods should be used.
 
-    void link(JmpSrc from, JmpDst to)
+    void linkJump(JmpSrc from, JmpDst to)
     {
-        ASSERT(to.m_offset != -1);
         ASSERT(from.m_offset != -1);
-        
-        reinterpret_cast<int*>(reinterpret_cast<ptrdiff_t>(m_formatter.data()) + from.m_offset)[-1] = to.m_offset - from.m_offset;
+        ASSERT(to.m_offset != -1);
+
+        char* code = reinterpret_cast<char*>(m_formatter.data());
+        patchRel32(code + from.m_offset, code + to.m_offset);
     }
     
-    static void patchAddress(void* code, JmpDst position, void* value)
+    static void linkJump(void* code, JmpSrc from, void* to)
     {
-        ASSERT(position.m_offset != -1);
-        
-        reinterpret_cast<void**>(reinterpret_cast<ptrdiff_t>(code) + position.m_offset)[-1] = value;
+        ASSERT(from.m_offset != -1);
+
+        patchRel32(reinterpret_cast<char*>(code) + from.m_offset, to);
     }
-    
-    static void link(void* code, JmpSrc from, void* to)
+
+    static void linkCall(void* code, JmpSrc from, void* to)
     {
         ASSERT(from.m_offset != -1);
-        
-        reinterpret_cast<int*>(reinterpret_cast<ptrdiff_t>(code) + from.m_offset)[-1] = reinterpret_cast<ptrdiff_t>(to) - (reinterpret_cast<ptrdiff_t>(code) + from.m_offset);
+
+        patchRel32(reinterpret_cast<char*>(code) + from.m_offset, to);
+    }
+
+#if PLATFORM(X86_64)
+    static void patchPointerForCall(void* where, void* value)
+    {
+        reinterpret_cast<void**>(where)[-1] = value;
+    }
+#endif
+
+    static void patchPointer(void* code, JmpDst where, void* value)
+    {
+        ASSERT(where.m_offset != -1);
+
+        patchPointer(reinterpret_cast<char*>(code) + where.m_offset, value);
+    }
+
+    static void relinkJump(void* from, void* to)
+    {
+        ExecutableAllocator::MakeWritable unprotect(reinterpret_cast<char*>(from) - sizeof(int32_t), sizeof(int32_t));
+        patchRel32(from, to);
     }
     
+    static void relinkCall(void* from, void* to)
+    {
+        ExecutableAllocator::MakeWritable unprotect(reinterpret_cast<char*>(from) - sizeof(int32_t), sizeof(int32_t));
+        patchRel32(from, to);
+    }
+
+    static void repatchInt32(void* where, int32_t value)
+    {
+        ExecutableAllocator::MakeWritable unprotect(reinterpret_cast<char*>(where) - sizeof(int32_t), sizeof(int32_t));
+        patchInt32(where, value);
+    }
+
+    static void repatchPointer(void* where, void* value)
+    {
+        ExecutableAllocator::MakeWritable unprotect(reinterpret_cast<char*>(where) - sizeof(void*), sizeof(void*));
+        patchPointer(where, value);
+    }
+
+    static void repatchLoadPtrToLEA(void* where)
+    {
+#if PLATFORM(X86_64)
+        // On x86-64 pointer memory accesses require a 64-bit operand, and as such a REX prefix.
+        // Skip over the prefix byte.
+        where = reinterpret_cast<char*>(where) + 1;
+#endif
+        ExecutableAllocator::MakeWritable unprotect(where, 1);
+        *reinterpret_cast<unsigned char*>(where) = static_cast<unsigned char>(OP_LEA);
+    }
+    
+    static unsigned getCallReturnOffset(JmpSrc call)
+    {
+        ASSERT(call.m_offset >= 0);
+        return call.m_offset;
+    }
+
     static void* getRelocatedAddress(void* code, JmpSrc jump)
     {
+        ASSERT(jump.m_offset != -1);
+
         return reinterpret_cast<void*>(reinterpret_cast<ptrdiff_t>(code) + jump.m_offset);
     }
     
@@ -1220,23 +1467,6 @@ public:
         return dst.m_offset - src.m_offset;
     }
     
-    static void patchImmediate(intptr_t where, int32_t value)
-    {
-        reinterpret_cast<int32_t*>(where)[-1] = value;
-    }
-    
-    static void patchPointer(intptr_t where, intptr_t value)
-    {
-        reinterpret_cast<intptr_t*>(where)[-1] = value;
-    }
-    
-    static void patchBranchOffset(intptr_t where, void* destination)
-    {
-        intptr_t offset = reinterpret_cast<intptr_t>(destination) - where;
-        ASSERT(offset == static_cast<int32_t>(offset));
-        reinterpret_cast<int32_t*>(where)[-1] = static_cast<int32_t>(offset);
-    }
-    
     void* executableCopy(ExecutablePool* allocator)
     {
         void* copy = m_formatter.executableCopy(allocator);
@@ -1246,6 +1476,24 @@ public:
 
 private:
 
+    static void patchPointer(void* where, void* value)
+    {
+        reinterpret_cast<void**>(where)[-1] = value;
+    }
+
+    static void patchInt32(void* where, int32_t value)
+    {
+        reinterpret_cast<int32_t*>(where)[-1] = value;
+    }
+
+    static void patchRel32(void* from, void* to)
+    {
+        intptr_t offset = reinterpret_cast<intptr_t>(to) - reinterpret_cast<intptr_t>(from);
+        ASSERT(offset == static_cast<int32_t>(offset));
+
+        patchInt32(from, offset);
+    }
+
     class X86InstructionFormatter {
 
         static const int maxInstructionSize = 16;
@@ -1415,6 +1663,15 @@ private:
             m_buffer.putByteUnchecked(opcode);
             memoryModRM(reg, base, index, scale, offset);
         }
+
+        void twoByteOp64(TwoByteOpcodeID opcode, int reg, RegisterID rm)
+        {
+            m_buffer.ensureSpace(maxInstructionSize);
+            emitRexW(reg, 0, rm);
+            m_buffer.putByteUnchecked(OP_2BYTE_ESCAPE);
+            m_buffer.putByteUnchecked(opcode);
+            registerModRM(reg, rm);
+        }
 #endif
 
         // Byte-operands:
@@ -1478,6 +1735,11 @@ private:
             m_buffer.putByteUnchecked(imm);
         }
 
+        void immediate16(int imm)
+        {
+            m_buffer.putShortUnchecked(imm);
+        }
+
         void immediate32(int imm)
         {
             m_buffer.putIntUnchecked(imm);
@@ -1572,13 +1834,8 @@ private:
         {
             ASSERT(mode != ModRmRegister);
 
-            // Encode sacle of (1,2,4,8) -> (0,1,2,3)
-            int shift = 0;
-            while (scale >>= 1)
-                shift++;
-
             putModRm(mode, reg, hasSib);
-            m_buffer.putByteUnchecked((shift << 6) | ((index & 7) << 3) | (base & 7));
+            m_buffer.putByteUnchecked((scale << 6) | ((index & 7) << 3) | (base & 7));
         }
 
         void registerModRM(int reg, RegisterID rm)
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
index 9207c8a..d777f73 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -55,15 +55,15 @@ static UString escapeQuotes(const UString& str)
     return result;
 }
 
-static UString valueToSourceString(ExecState* exec, JSValuePtr val)
+static UString valueToSourceString(ExecState* exec, JSValue val)
 {
-    if (val->isString()) {
+    if (val.isString()) {
         UString result("\"");
-        result += escapeQuotes(val->toString(exec)) + "\"";
+        result += escapeQuotes(val.toString(exec)) + "\"";
         return result;
     } 
 
-    return val->toString(exec);
+    return val.toString(exec);
 }
 
 static CString registerName(int r)
@@ -74,7 +74,7 @@ static CString registerName(int r)
     return (UString("r") + UString::from(r)).UTF8String();
 }
 
-static CString constantName(ExecState* exec, int k, JSValuePtr value)
+static CString constantName(ExecState* exec, int k, JSValue value)
 {
     return (valueToSourceString(exec, value) + "(@k" + UString::from(k) + ")").UTF8String();
 }
@@ -357,7 +357,7 @@ void CodeBlock::dump(ExecState* exec) const
         unsigned registerIndex = m_numVars;
         size_t i = 0;
         do {
-            printf("   r%u = %s\n", registerIndex, valueToSourceString(exec, m_constantRegisters[i].jsValue(exec)).ascii());
+            printf("   r%u = %s\n", registerIndex, valueToSourceString(exec, m_constantRegisters[i].jsValue()).ascii());
             ++i;
             ++registerIndex;
         } while (i < m_constantRegisters.size());
@@ -497,6 +497,10 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             printf("[%4d] create_arguments\n", location);
             break;
         }
+        case op_init_arguments: {
+            printf("[%4d] init_arguments\n", location);
+            break;
+        }
         case op_convert_this: {
             int r0 = (++it)->u.operand;
             printf("[%4d] convert_this %s\n", location, registerName(r0).c_str());
@@ -703,7 +707,7 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_resolve_global: {
             int r0 = (++it)->u.operand;
-            JSValuePtr scope = JSValuePtr((++it)->u.jsCell);
+            JSValue scope = JSValue((++it)->u.jsCell);
             int id0 = (++it)->u.operand;
             printf("[%4d] resolve_global\t %s, %s, %s\n", location, registerName(r0).c_str(), valueToSourceString(exec, scope).ascii(), idName(id0, m_identifiers[id0]).c_str());
             it += 2;
@@ -724,15 +728,14 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             break;
         }
         case op_get_global_var: {
-            int r0 = it[1].u.operand;
-            JSValuePtr scope = JSValuePtr(it[2].u.jsCell);
-            int index = it[3].u.operand;
+            int r0 = (++it)->u.operand;
+            JSValue scope = JSValue((++it)->u.jsCell);
+            int index = (++it)->u.operand;
             printf("[%4d] get_global_var\t %s, %s, %d\n", location, registerName(r0).c_str(), valueToSourceString(exec, scope).ascii(), index);
-            it += OPCODE_LENGTH(op_get_global_var);
             break;
         }
         case op_put_global_var: {
-            JSValuePtr scope = JSValuePtr((++it)->u.jsCell);
+            JSValue scope = JSValue((++it)->u.jsCell);
             int index = (++it)->u.operand;
             int r0 = (++it)->u.operand;
             printf("[%4d] put_global_var\t %s, %d, %s\n", location, valueToSourceString(exec, scope).ascii(), index, registerName(r0).c_str());
@@ -824,6 +827,10 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             printf("[%4d] put_setter\t %s, %s, %s\n", location, registerName(r0).c_str(), idName(id0, m_identifiers[id0]).c_str(), registerName(r1).c_str());
             break;
         }
+        case op_method_check: {
+            printf("[%4d] op_method_check\n", location);
+            break;
+        }
         case op_del_by_id: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
@@ -889,6 +896,13 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             printConditionalJump(begin, it, location, "jneq_null");
             break;
         }
+        case op_jneq_ptr: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int offset = (++it)->u.operand;
+            printf("[%4d] jneq_ptr\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
+            break;
+        }
         case op_jnless: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
@@ -896,6 +910,13 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             printf("[%4d] jnless\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
             break;
         }
+        case op_jnlesseq: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int offset = (++it)->u.operand;
+            printf("[%4d] jnlesseq\t\t %s, %s, %d(->%d)\n", location, registerName(r0).c_str(), registerName(r1).c_str(), offset, locationForOffset(begin, it, offset));
+            break;
+        }
         case op_loop_if_less: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
@@ -959,6 +980,18 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             printf("[%4d] call_eval\t %s, %s, %d, %d\n", location, registerName(dst).c_str(), registerName(func).c_str(), argCount, registerOffset);
             break;
         }
+        case op_call_varargs: {
+            int dst = (++it)->u.operand;
+            int func = (++it)->u.operand;
+            int argCount = (++it)->u.operand;
+            int registerOffset = (++it)->u.operand;
+            printf("[%4d] call_varargs\t %s, %s, %s, %d\n", location, registerName(dst).c_str(), registerName(func).c_str(), registerName(argCount).c_str(), registerOffset);
+            break;
+        }
+        case op_load_varargs: {
+            printUnaryOp(location, it, "load_varargs");
+            break;
+        }
         case op_tear_off_activation: {
             int r0 = (++it)->u.operand;
             printf("[%4d] tear_off_activation\t %s\n", location, registerName(r0).c_str());
@@ -989,6 +1022,19 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             printf("[%4d] construct_verify\t %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str());
             break;
         }
+        case op_strcat: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            int count = (++it)->u.operand;
+            printf("[%4d] op_strcat\t %s, %s, %d\n", location, registerName(r0).c_str(), registerName(r1).c_str(), count);
+            break;
+        }
+        case op_to_primitive: {
+            int r0 = (++it)->u.operand;
+            int r1 = (++it)->u.operand;
+            printf("[%4d] op_to_primitive\t %s, %s\n", location, registerName(r0).c_str(), registerName(r1).c_str());
+            break;
+        }
         case op_get_pnames: {
             int r0 = (++it)->u.operand;
             int r1 = (++it)->u.operand;
@@ -1091,8 +1137,7 @@ static HashSet<CodeBlock*> liveCodeBlockSet;
     macro(linkedCallerList) \
     macro(identifiers) \
     macro(functionExpressions) \
-    macro(constantRegisters) \
-    macro(pcVector)
+    macro(constantRegisters)
 
 #define FOR_EACH_MEMBER_VECTOR_RARE_DATA(macro) \
     macro(regexps) \
@@ -1107,7 +1152,8 @@ static HashSet<CodeBlock*> liveCodeBlockSet;
 #define FOR_EACH_MEMBER_VECTOR_EXCEPTION_INFO(macro) \
     macro(expressionInfo) \
     macro(lineInfo) \
-    macro(getByIdExceptionInfo)
+    macro(getByIdExceptionInfo) \
+    macro(pcVector)
 
 template<typename T>
 static size_t sizeInBytes(const Vector<T>& vector)
@@ -1219,6 +1265,28 @@ void CodeBlock::dumpStatistics()
 #endif
 }
 
+CodeBlock::CodeBlock(ScopeNode* ownerNode)
+    : m_numCalleeRegisters(0)
+    , m_numConstants(0)
+    , m_numVars(0)
+    , m_numParameters(0)
+    , m_ownerNode(ownerNode)
+    , m_globalData(0)
+#ifndef NDEBUG
+    , m_instructionCount(0)
+#endif
+    , m_needsFullScopeChain(false)
+    , m_usesEval(false)
+    , m_isNumericCompareFunction(false)
+    , m_codeType(NativeCode)
+    , m_source(0)
+    , m_sourceOffset(0)
+    , m_exceptionInfo(0)
+{
+#if DUMP_CODE_BLOCK_STATISTICS
+    liveCodeBlockSet.add(this);
+#endif
+}
 
 CodeBlock::CodeBlock(ScopeNode* ownerNode, CodeType codeType, PassRefPtr<SourceProvider> sourceProvider, unsigned sourceOffset)
     : m_numCalleeRegisters(0)
@@ -1232,6 +1300,7 @@ CodeBlock::CodeBlock(ScopeNode* ownerNode, CodeType codeType, PassRefPtr<SourceP
 #endif
     , m_needsFullScopeChain(ownerNode->needsActivation())
     , m_usesEval(ownerNode->usesEval())
+    , m_isNumericCompareFunction(false)
     , m_codeType(codeType)
     , m_source(sourceProvider)
     , m_sourceOffset(sourceOffset)
@@ -1267,6 +1336,11 @@ CodeBlock::~CodeBlock()
             callLinkInfo->callee->removeCaller(callLinkInfo);
     }
 
+    for (size_t size = m_methodCallLinkInfos.size(), i = 0; i < size; ++i) {
+        if (Structure* structure = m_methodCallLinkInfos[i].cachedStructure)
+            structure->deref();
+    }
+
     unlinkCallers();
 #endif
 
@@ -1290,6 +1364,7 @@ void CodeBlock::unlinkCallers()
 
 void CodeBlock::derefStructures(Instruction* vPC) const
 {
+    ASSERT(m_codeType != NativeCode);
     Interpreter* interpreter = m_globalData->interpreter;
 
     if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self)) {
@@ -1335,6 +1410,7 @@ void CodeBlock::derefStructures(Instruction* vPC) const
 
 void CodeBlock::refStructures(Instruction* vPC) const
 {
+    ASSERT(m_codeType != NativeCode);
     Interpreter* interpreter = m_globalData->interpreter;
 
     if (vPC[0].u.opcode == interpreter->getOpcode(op_get_by_id_self)) {
@@ -1380,18 +1456,31 @@ void CodeBlock::mark()
             m_rareData->m_functions[i]->body()->mark();
 
         for (size_t i = 0; i < m_rareData->m_unexpectedConstants.size(); ++i) {
-            if (!m_rareData->m_unexpectedConstants[i]->marked())
-                m_rareData->m_unexpectedConstants[i]->mark();
+            if (!m_rareData->m_unexpectedConstants[i].marked())
+                m_rareData->m_unexpectedConstants[i].mark();
         }
+        m_rareData->m_evalCodeCache.mark();
     }
 }
 
 void CodeBlock::reparseForExceptionInfoIfNecessary(CallFrame* callFrame)
 {
+    ASSERT(m_codeType != NativeCode);
     if (m_exceptionInfo)
         return;
 
     ScopeChainNode* scopeChain = callFrame->scopeChain();
+    if (m_needsFullScopeChain) {
+        ScopeChain sc(scopeChain);
+        int scopeDelta = sc.localDepth();
+        if (m_codeType == EvalCode)
+            scopeDelta -= static_cast<EvalCodeBlock*>(this)->baseScopeDepth();
+        else if (m_codeType == FunctionCode)
+            scopeDelta++; // Compilation of function code assumes activation is not on the scope chain yet.
+        ASSERT(scopeDelta >= 0);
+        while (scopeDelta--)
+            scopeChain = scopeChain->next;
+    }
 
     switch (m_codeType) {
         case FunctionCode: {
@@ -1399,19 +1488,43 @@ void CodeBlock::reparseForExceptionInfoIfNecessary(CallFrame* callFrame)
             RefPtr<FunctionBodyNode> newFunctionBody = m_globalData->parser->reparse<FunctionBodyNode>(m_globalData, ownerFunctionBodyNode);
             ASSERT(newFunctionBody);
             newFunctionBody->finishParsing(ownerFunctionBodyNode->copyParameters(), ownerFunctionBodyNode->parameterCount());
-            CodeBlock& newCodeBlock = newFunctionBody->bytecodeForExceptionInfoReparse(scopeChain);
+
+            m_globalData->scopeNodeBeingReparsed = newFunctionBody.get();
+
+            CodeBlock& newCodeBlock = newFunctionBody->bytecodeForExceptionInfoReparse(scopeChain, this);
             ASSERT(newCodeBlock.m_exceptionInfo);
             ASSERT(newCodeBlock.m_instructionCount == m_instructionCount);
+
+#if ENABLE(JIT)
+            JIT::compile(m_globalData, &newCodeBlock);
+            ASSERT(newFunctionBody->generatedJITCode().size() == ownerNode()->generatedJITCode().size());
+#endif
+
             m_exceptionInfo.set(newCodeBlock.m_exceptionInfo.release());
+
+            m_globalData->scopeNodeBeingReparsed = 0;
+
             break;
         }
         case EvalCode: {
             EvalNode* ownerEvalNode = static_cast<EvalNode*>(m_ownerNode);
             RefPtr<EvalNode> newEvalBody = m_globalData->parser->reparse<EvalNode>(m_globalData, ownerEvalNode);
-            EvalCodeBlock& newCodeBlock = newEvalBody->bytecodeForExceptionInfoReparse(scopeChain);
+
+            m_globalData->scopeNodeBeingReparsed = newEvalBody.get();
+
+            EvalCodeBlock& newCodeBlock = newEvalBody->bytecodeForExceptionInfoReparse(scopeChain, this);
             ASSERT(newCodeBlock.m_exceptionInfo);
             ASSERT(newCodeBlock.m_instructionCount == m_instructionCount);
+
+#if ENABLE(JIT)
+            JIT::compile(m_globalData, &newCodeBlock);
+            ASSERT(newEvalBody->generatedJITCode().size() == ownerNode()->generatedJITCode().size());
+#endif
+
             m_exceptionInfo.set(newCodeBlock.m_exceptionInfo.release());
+
+            m_globalData->scopeNodeBeingReparsed = 0;
+
             break;
         }
         default:
@@ -1423,6 +1536,7 @@ void CodeBlock::reparseForExceptionInfoIfNecessary(CallFrame* callFrame)
 
 HandlerInfo* CodeBlock::handlerForBytecodeOffset(unsigned bytecodeOffset)
 {
+    ASSERT(m_codeType != NativeCode);
     ASSERT(bytecodeOffset < m_instructionCount);
 
     if (!m_rareData)
@@ -1441,6 +1555,7 @@ HandlerInfo* CodeBlock::handlerForBytecodeOffset(unsigned bytecodeOffset)
 
 int CodeBlock::lineNumberForBytecodeOffset(CallFrame* callFrame, unsigned bytecodeOffset)
 {
+    ASSERT(m_codeType != NativeCode);
     ASSERT(bytecodeOffset < m_instructionCount);
 
     reparseForExceptionInfoIfNecessary(callFrame);
@@ -1466,6 +1581,7 @@ int CodeBlock::lineNumberForBytecodeOffset(CallFrame* callFrame, unsigned byteco
 
 int CodeBlock::expressionRangeForBytecodeOffset(CallFrame* callFrame, unsigned bytecodeOffset, int& divot, int& startOffset, int& endOffset)
 {
+    ASSERT(m_codeType != NativeCode);
     ASSERT(bytecodeOffset < m_instructionCount);
 
     reparseForExceptionInfoIfNecessary(callFrame);
@@ -1505,6 +1621,7 @@ int CodeBlock::expressionRangeForBytecodeOffset(CallFrame* callFrame, unsigned b
 
 bool CodeBlock::getByIdExceptionInfoForBytecodeOffset(CallFrame* callFrame, unsigned bytecodeOffset, OpcodeID& opcodeID)
 {
+    ASSERT(m_codeType != NativeCode);
     ASSERT(bytecodeOffset < m_instructionCount);
 
     reparseForExceptionInfoIfNecessary(callFrame);
@@ -1533,6 +1650,7 @@ bool CodeBlock::getByIdExceptionInfoForBytecodeOffset(CallFrame* callFrame, unsi
 #if ENABLE(JIT)
 bool CodeBlock::functionRegisterForBytecodeOffset(unsigned bytecodeOffset, int& functionRegisterIndex)
 {
+    ASSERT(m_codeType != NativeCode);
     ASSERT(bytecodeOffset < m_instructionCount);
 
     if (!m_rareData || !m_rareData->m_functionRegisterInfos.size())
@@ -1554,10 +1672,57 @@ bool CodeBlock::functionRegisterForBytecodeOffset(unsigned bytecodeOffset, int&
     functionRegisterIndex = m_rareData->m_functionRegisterInfos[low - 1].functionRegisterIndex;
     return true;
 }
+#endif
+
+#if !ENABLE(JIT)
+bool CodeBlock::hasGlobalResolveInstructionAtBytecodeOffset(unsigned bytecodeOffset)
+{
+    ASSERT(m_codeType != NativeCode);
+    if (m_globalResolveInstructions.isEmpty())
+        return false;
+
+    int low = 0;
+    int high = m_globalResolveInstructions.size();
+    while (low < high) {
+        int mid = low + (high - low) / 2;
+        if (m_globalResolveInstructions[mid] <= bytecodeOffset)
+            low = mid + 1;
+        else
+            high = mid;
+    }
+
+    if (!low || m_globalResolveInstructions[low - 1] != bytecodeOffset)
+        return false;
+    return true;
+}
+#else
+bool CodeBlock::hasGlobalResolveInfoAtBytecodeOffset(unsigned bytecodeOffset)
+{
+    ASSERT(m_codeType != NativeCode);
+    if (m_globalResolveInfos.isEmpty())
+        return false;
 
-void CodeBlock::setJITCode(JITCodeRef& jitCode)
+    int low = 0;
+    int high = m_globalResolveInfos.size();
+    while (low < high) {
+        int mid = low + (high - low) / 2;
+        if (m_globalResolveInfos[mid].bytecodeOffset <= bytecodeOffset)
+            low = mid + 1;
+        else
+            high = mid;
+    }
+
+    if (!low || m_globalResolveInfos[low - 1].bytecodeOffset != bytecodeOffset)
+        return false;
+    return true;
+}
+#endif
+
+#if ENABLE(JIT)
+void CodeBlock::setJITCode(JITCode jitCode)
 {
-    m_jitCode = jitCode;
+    ASSERT(m_codeType != NativeCode); 
+    ownerNode()->setJITCode(jitCode);
 #if !ENABLE(OPCODE_SAMPLING)
     if (!BytecodeGenerator::dumpsGeneratedCode())
         m_instructions.clear();
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
index 517bd27..afd32f0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/CodeBlock.h
@@ -32,11 +32,13 @@
 
 #include "EvalCodeCache.h"
 #include "Instruction.h"
+#include "JITCode.h"
 #include "JSGlobalObject.h"
 #include "JumpTable.h"
 #include "Nodes.h"
 #include "RegExp.h"
 #include "UString.h"
+#include <wtf/FastAllocBase.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 
@@ -48,7 +50,7 @@ namespace JSC {
 
     class ExecState;
 
-    enum CodeType { GlobalCode, EvalCode, FunctionCode };
+    enum CodeType { GlobalCode, EvalCode, FunctionCode, NativeCode };
 
     static ALWAYS_INLINE int missingThisObjectMarker() { return std::numeric_limits<int>::max(); }
 
@@ -58,29 +60,10 @@ namespace JSC {
         uint32_t target;
         uint32_t scopeDepth;
 #if ENABLE(JIT)
-        void* nativeCode;
+        CodeLocationLabel nativeCode;
 #endif
     };
 
-#if ENABLE(JIT)
-    // The code, and the associated pool from which it was allocated.
-    struct JITCodeRef {
-        void* code;
-        RefPtr<ExecutablePool> executablePool;
-        
-        JITCodeRef()
-            : code(0)
-        {
-        }
-        
-        JITCodeRef(void* code, PassRefPtr<ExecutablePool> executablePool)
-            : code(code)
-            , executablePool(executablePool)
-        {
-        }
-    };
-#endif
-
     struct ExpressionRangeInfo {
         enum {
             MaxOffset = (1 << 7) - 1, 
@@ -108,19 +91,14 @@ namespace JSC {
 #if ENABLE(JIT)
     struct CallLinkInfo {
         CallLinkInfo()
-            : callReturnLocation(0)
-            , hotPathBegin(0)
-            , hotPathOther(0)
-            , coldPathOther(0)
-            , callee(0)
+            : callee(0)
         {
         }
     
         unsigned bytecodeIndex;
-        void* callReturnLocation;
-        void* hotPathBegin;
-        void* hotPathOther;
-        void* coldPathOther;
+        CodeLocationNearCall callReturnLocation;
+        CodeLocationDataLabelPtr hotPathBegin;
+        CodeLocationNearCall hotPathOther;
         CodeBlock* callee;
         unsigned position;
         
@@ -128,6 +106,17 @@ namespace JSC {
         bool isLinked() { return callee; }
     };
 
+    struct MethodCallLinkInfo {
+        MethodCallLinkInfo()
+            : cachedStructure(0)
+        {
+        }
+
+        CodeLocationCall callReturnLocation;
+        CodeLocationDataLabelPtr structureLabel;
+        Structure* cachedStructure;
+    };
+
     struct FunctionRegisterInfo {
         FunctionRegisterInfo(unsigned bytecodeOffset, int functionRegisterIndex)
             : bytecodeOffset(bytecodeOffset)
@@ -140,24 +129,30 @@ namespace JSC {
     };
 
     struct GlobalResolveInfo {
-        GlobalResolveInfo()
+        GlobalResolveInfo(unsigned bytecodeOffset)
             : structure(0)
             , offset(0)
+            , bytecodeOffset(bytecodeOffset)
         {
         }
 
         Structure* structure;
         unsigned offset;
+        unsigned bytecodeOffset;
     };
 
-    struct PC {
-        PC(ptrdiff_t nativePCOffset, unsigned bytecodeIndex)
-            : nativePCOffset(nativePCOffset)
+    // This structure is used to map from a call return location
+    // (given as an offset in bytes into the JIT code) back to
+    // the bytecode index of the corresponding bytecode operation.
+    // This is then used to look up the corresponding handler.
+    struct CallReturnOffsetToBytecodeIndex {
+        CallReturnOffsetToBytecodeIndex(unsigned callReturnOffset, unsigned bytecodeIndex)
+            : callReturnOffset(callReturnOffset)
             , bytecodeIndex(bytecodeIndex)
         {
         }
 
-        ptrdiff_t nativePCOffset;
+        unsigned callReturnOffset;
         unsigned bytecodeIndex;
     };
 
@@ -165,17 +160,22 @@ namespace JSC {
 
     inline void* getStructureStubInfoReturnLocation(StructureStubInfo* structureStubInfo)
     {
-        return structureStubInfo->callReturnLocation;
+        return structureStubInfo->callReturnLocation.executableAddress();
     }
 
     inline void* getCallLinkInfoReturnLocation(CallLinkInfo* callLinkInfo)
     {
-        return callLinkInfo->callReturnLocation;
+        return callLinkInfo->callReturnLocation.executableAddress();
+    }
+
+    inline void* getMethodCallLinkInfoReturnLocation(MethodCallLinkInfo* methodCallLinkInfo)
+    {
+        return methodCallLinkInfo->callReturnLocation.executableAddress();
     }
 
-    inline ptrdiff_t getNativePCOffset(PC* pc)
+    inline unsigned getCallReturnOffset(CallReturnOffsetToBytecodeIndex* pc)
     {
-        return pc->nativePCOffset;
+        return pc->callReturnOffset;
     }
 
     // Binary chop algorithm, calls valueAtPosition on pre-sorted elements in array,
@@ -215,9 +215,10 @@ namespace JSC {
     }
 #endif
 
-    class CodeBlock {
+    class CodeBlock : public WTF::FastAllocBase {
         friend class JIT;
     public:
+        CodeBlock(ScopeNode* ownerNode);
         CodeBlock(ScopeNode* ownerNode, CodeType, PassRefPtr<SourceProvider>, unsigned sourceOffset);
         ~CodeBlock();
 
@@ -242,7 +243,7 @@ namespace JSC {
                 return true;
 
             if (isConstantRegisterIndex(index))
-                return !JSImmediate::isImmediate(getConstant(index));
+                return getConstant(index).isCell();
 
             return false;
         }
@@ -252,9 +253,9 @@ namespace JSC {
             return index >= m_numVars && index < m_numVars + m_numConstants;
         }
 
-        ALWAYS_INLINE JSValuePtr getConstant(int index)
+        ALWAYS_INLINE JSValue getConstant(int index)
         {
-            return m_constantRegisters[index - m_numVars].getJSValue();
+            return m_constantRegisters[index - m_numVars].jsValue();
         }
 
         ALWAYS_INLINE bool isTemporaryRegisterIndex(int index)
@@ -287,34 +288,41 @@ namespace JSC {
             m_linkedCallerList.shrink(lastPos);
         }
 
-        StructureStubInfo& getStubInfo(void* returnAddress)
+        StructureStubInfo& getStubInfo(ReturnAddressPtr returnAddress)
         {
-            return *(binaryChop<StructureStubInfo, void*, getStructureStubInfoReturnLocation>(m_structureStubInfos.begin(), m_structureStubInfos.size(), returnAddress));
+            return *(binaryChop<StructureStubInfo, void*, getStructureStubInfoReturnLocation>(m_structureStubInfos.begin(), m_structureStubInfos.size(), returnAddress.value()));
         }
 
-        CallLinkInfo& getCallLinkInfo(void* returnAddress)
+        CallLinkInfo& getCallLinkInfo(ReturnAddressPtr returnAddress)
         {
-            return *(binaryChop<CallLinkInfo, void*, getCallLinkInfoReturnLocation>(m_callLinkInfos.begin(), m_callLinkInfos.size(), returnAddress));
+            return *(binaryChop<CallLinkInfo, void*, getCallLinkInfoReturnLocation>(m_callLinkInfos.begin(), m_callLinkInfos.size(), returnAddress.value()));
         }
 
-        unsigned getBytecodeIndex(void* nativePC)
+        MethodCallLinkInfo& getMethodCallLinkInfo(ReturnAddressPtr returnAddress)
         {
-            ptrdiff_t nativePCOffset = reinterpret_cast<void**>(nativePC) - reinterpret_cast<void**>(m_jitCode.code);
-            return binaryChop<PC, ptrdiff_t, getNativePCOffset>(m_pcVector.begin(), m_pcVector.size(), nativePCOffset)->bytecodeIndex;
+            return *(binaryChop<MethodCallLinkInfo, void*, getMethodCallLinkInfoReturnLocation>(m_methodCallLinkInfos.begin(), m_methodCallLinkInfos.size(), returnAddress.value()));
         }
 
+        unsigned getBytecodeIndex(CallFrame* callFrame, ReturnAddressPtr returnAddress)
+        {
+            reparseForExceptionInfoIfNecessary(callFrame);
+            return binaryChop<CallReturnOffsetToBytecodeIndex, unsigned, getCallReturnOffset>(m_exceptionInfo->m_callReturnIndexVector.begin(), m_exceptionInfo->m_callReturnIndexVector.size(), ownerNode()->generatedJITCode().offsetOf(returnAddress.value()))->bytecodeIndex;
+        }
+        
         bool functionRegisterForBytecodeOffset(unsigned bytecodeOffset, int& functionRegisterIndex);
 #endif
 
+        void setIsNumericCompareFunction(bool isNumericCompareFunction) { m_isNumericCompareFunction = isNumericCompareFunction; }
+        bool isNumericCompareFunction() { return m_isNumericCompareFunction; }
+
         Vector<Instruction>& instructions() { return m_instructions; }
 #ifndef NDEBUG
         void setInstructionCount(unsigned instructionCount) { m_instructionCount = instructionCount; }
 #endif
 
 #if ENABLE(JIT)
-        void setJITCode(JITCodeRef& jitCode);
-        void* jitCode() { return m_jitCode.code; }
-        ExecutablePool* executablePool() { return m_jitCode.executablePool.get(); }
+        void setJITCode(JITCode);
+        ExecutablePool* executablePool() { return ownerNode()->getExecutablePool(); }
 #endif
 
         ScopeNode* ownerNode() const { return m_ownerNode; }
@@ -333,8 +341,8 @@ namespace JSC {
 
         CodeType codeType() const { return m_codeType; }
 
-        SourceProvider* source() const { return m_source.get(); }
-        unsigned sourceOffset() const { return m_sourceOffset; }
+        SourceProvider* source() const { ASSERT(m_codeType != NativeCode); return m_source.get(); }
+        unsigned sourceOffset() const { ASSERT(m_codeType != NativeCode); return m_sourceOffset; }
 
         size_t numberOfJumpTargets() const { return m_jumpTargets.size(); }
         void addJumpTarget(unsigned jumpTarget) { m_jumpTargets.append(jumpTarget); }
@@ -343,22 +351,25 @@ namespace JSC {
 
 #if !ENABLE(JIT)
         void addPropertyAccessInstruction(unsigned propertyAccessInstruction) { m_propertyAccessInstructions.append(propertyAccessInstruction); }
-        void addGlobalResolveInstruction(unsigned globalResolveInstructions) { m_globalResolveInstructions.append(globalResolveInstructions); }
+        void addGlobalResolveInstruction(unsigned globalResolveInstruction) { m_globalResolveInstructions.append(globalResolveInstruction); }
+        bool hasGlobalResolveInstructionAtBytecodeOffset(unsigned bytecodeOffset);
 #else
         size_t numberOfStructureStubInfos() const { return m_structureStubInfos.size(); }
         void addStructureStubInfo(const StructureStubInfo& stubInfo) { m_structureStubInfos.append(stubInfo); }
         StructureStubInfo& structureStubInfo(int index) { return m_structureStubInfos[index]; }
 
-        void addGlobalResolveInfo() { m_globalResolveInfos.append(GlobalResolveInfo()); }
+        void addGlobalResolveInfo(unsigned globalResolveInstruction) { m_globalResolveInfos.append(GlobalResolveInfo(globalResolveInstruction)); }
         GlobalResolveInfo& globalResolveInfo(int index) { return m_globalResolveInfos[index]; }
+        bool hasGlobalResolveInfoAtBytecodeOffset(unsigned bytecodeOffset);
 
         size_t numberOfCallLinkInfos() const { return m_callLinkInfos.size(); }
         void addCallLinkInfo() { m_callLinkInfos.append(CallLinkInfo()); }
         CallLinkInfo& callLinkInfo(int index) { return m_callLinkInfos[index]; }
 
-        void addFunctionRegisterInfo(unsigned bytecodeOffset, int functionIndex) { createRareDataIfNecessary(); m_rareData->m_functionRegisterInfos.append(FunctionRegisterInfo(bytecodeOffset, functionIndex)); }
+        void addMethodCallLinkInfos(unsigned n) { m_methodCallLinkInfos.grow(n); }
+        MethodCallLinkInfo& methodCallLinkInfo(int index) { return m_methodCallLinkInfos[index]; }
 
-        Vector<PC>& pcVector() { return m_pcVector; }
+        void addFunctionRegisterInfo(unsigned bytecodeOffset, int functionIndex) { createRareDataIfNecessary(); m_rareData->m_functionRegisterInfos.append(FunctionRegisterInfo(bytecodeOffset, functionIndex)); }
 #endif
 
         // Exception handling support
@@ -367,6 +378,7 @@ namespace JSC {
         void addExceptionHandler(const HandlerInfo& hanler) { createRareDataIfNecessary(); return m_rareData->m_exceptionHandlers.append(hanler); }
         HandlerInfo& exceptionHandler(int index) { ASSERT(m_rareData); return m_rareData->m_exceptionHandlers[index]; }
 
+        bool hasExceptionInfo() const { return m_exceptionInfo; }
         void clearExceptionInfo() { m_exceptionInfo.clear(); }
 
         void addExpressionInfo(const ExpressionRangeInfo& expressionInfo) { ASSERT(m_exceptionInfo); m_exceptionInfo->m_expressionInfo.append(expressionInfo); }
@@ -376,6 +388,10 @@ namespace JSC {
         void addLineInfo(const LineInfo& lineInfo) { ASSERT(m_exceptionInfo); m_exceptionInfo->m_lineInfo.append(lineInfo); }
         LineInfo& lastLineInfo() { ASSERT(m_exceptionInfo); return m_exceptionInfo->m_lineInfo.last(); }
 
+#if ENABLE(JIT)
+        Vector<CallReturnOffsetToBytecodeIndex>& callReturnIndexVector() { ASSERT(m_exceptionInfo); return m_exceptionInfo->m_callReturnIndexVector; }
+#endif
+
         // Constant Pool
 
         size_t numberOfIdentifiers() const { return m_identifiers.size(); }
@@ -392,8 +408,10 @@ namespace JSC {
         unsigned addFunction(FuncDeclNode* n) { createRareDataIfNecessary(); unsigned size = m_rareData->m_functions.size(); m_rareData->m_functions.append(n); return size; }
         FuncDeclNode* function(int index) const { ASSERT(m_rareData); return m_rareData->m_functions[index].get(); }
 
-        unsigned addUnexpectedConstant(JSValuePtr v) { createRareDataIfNecessary(); unsigned size = m_rareData->m_unexpectedConstants.size(); m_rareData->m_unexpectedConstants.append(v); return size; }
-        JSValuePtr unexpectedConstant(int index) const { ASSERT(m_rareData); return m_rareData->m_unexpectedConstants[index]; }
+        bool hasFunctions() const { return m_functionExpressions.size() || (m_rareData && m_rareData->m_functions.size()); }
+
+        unsigned addUnexpectedConstant(JSValue v) { createRareDataIfNecessary(); unsigned size = m_rareData->m_unexpectedConstants.size(); m_rareData->m_unexpectedConstants.append(v); return size; }
+        JSValue unexpectedConstant(int index) const { ASSERT(m_rareData); return m_rareData->m_unexpectedConstants[index]; }
 
         unsigned addRegExp(RegExp* r) { createRareDataIfNecessary(); unsigned size = m_rareData->m_regexps.size(); m_rareData->m_regexps.append(r); return size; }
         RegExp* regexp(int index) const { ASSERT(m_rareData); return m_rareData->m_regexps[index].get(); }
@@ -416,7 +434,7 @@ namespace JSC {
 
         SymbolTable& symbolTable() { return m_symbolTable; }
 
-        EvalCodeCache& evalCodeCache() { createRareDataIfNecessary(); return m_rareData->m_evalCodeCache; }
+        EvalCodeCache& evalCodeCache() { ASSERT(m_codeType != NativeCode); createRareDataIfNecessary(); return m_rareData->m_evalCodeCache; }
 
         void shrinkToFit();
 
@@ -440,6 +458,7 @@ namespace JSC {
 
         void createRareDataIfNecessary()
         {
+            ASSERT(m_codeType != NativeCode); 
             if (!m_rareData)
                 m_rareData.set(new RareData);
         }
@@ -451,15 +470,13 @@ namespace JSC {
 #ifndef NDEBUG
         unsigned m_instructionCount;
 #endif
-#if ENABLE(JIT)
-        JITCodeRef m_jitCode;
-#endif
 
         int m_thisRegister;
 
         bool m_needsFullScopeChain;
         bool m_usesEval;
         bool m_usesArguments;
+        bool m_isNumericCompareFunction;
 
         CodeType m_codeType;
 
@@ -473,9 +490,8 @@ namespace JSC {
         Vector<StructureStubInfo> m_structureStubInfos;
         Vector<GlobalResolveInfo> m_globalResolveInfos;
         Vector<CallLinkInfo> m_callLinkInfos;
+        Vector<MethodCallLinkInfo> m_methodCallLinkInfos;
         Vector<CallLinkInfo*> m_linkedCallerList;
-
-        Vector<PC> m_pcVector;
 #endif
 
         Vector<unsigned> m_jumpTargets;
@@ -491,6 +507,10 @@ namespace JSC {
             Vector<ExpressionRangeInfo> m_expressionInfo;
             Vector<LineInfo> m_lineInfo;
             Vector<GetByIdExceptionInfo> m_getByIdExceptionInfo;
+
+#if ENABLE(JIT)
+            Vector<CallReturnOffsetToBytecodeIndex> m_callReturnIndexVector;
+#endif
         };
         OwnPtr<ExceptionInfo> m_exceptionInfo;
 
@@ -499,7 +519,7 @@ namespace JSC {
 
             // Rare Constants
             Vector<RefPtr<FuncDeclNode> > m_functions;
-            Vector<JSValuePtr> m_unexpectedConstants;
+            Vector<JSValue> m_unexpectedConstants;
             Vector<RefPtr<RegExp> > m_regexps;
 
             // Jump Tables
@@ -542,10 +562,16 @@ namespace JSC {
 
     class EvalCodeBlock : public ProgramCodeBlock {
     public:
-        EvalCodeBlock(ScopeNode* ownerNode, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider)
+        EvalCodeBlock(ScopeNode* ownerNode, JSGlobalObject* globalObject, PassRefPtr<SourceProvider> sourceProvider, int baseScopeDepth)
             : ProgramCodeBlock(ownerNode, EvalCode, globalObject, sourceProvider)
+            , m_baseScopeDepth(baseScopeDepth)
         {
         }
+
+        int baseScopeDepth() const { return m_baseScopeDepth; }
+
+    private:
+        int m_baseScopeDepth;
     };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h
index 29be295..f0ce73e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/EvalCodeCache.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -41,7 +41,7 @@ namespace JSC {
 
     class EvalCodeCache {
     public:
-        PassRefPtr<EvalNode> get(ExecState* exec, const UString& evalSource, ScopeChainNode* scopeChain, JSValuePtr& exceptionValue)
+        PassRefPtr<EvalNode> get(ExecState* exec, const UString& evalSource, ScopeChainNode* scopeChain, JSValue& exceptionValue)
         {
             RefPtr<EvalNode> evalNode;
 
@@ -68,11 +68,18 @@ namespace JSC {
 
         bool isEmpty() const { return m_cacheMap.isEmpty(); }
 
+        void mark()
+        {
+            EvalCacheMap::iterator end = m_cacheMap.end();
+            for (EvalCacheMap::iterator ptr = m_cacheMap.begin(); ptr != end; ++ptr)
+                ptr->second->mark();
+        }
     private:
         static const int maxCacheableSourceLength = 256;
         static const int maxCacheEntries = 64;
 
-        HashMap<RefPtr<UString::Rep>, RefPtr<EvalNode> > m_cacheMap;
+        typedef HashMap<RefPtr<UString::Rep>, RefPtr<EvalNode> > EvalCacheMap;
+        EvalCacheMap m_cacheMap;
     };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h
index 81a7fa0..eeeac6f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/Instruction.h
@@ -29,14 +29,25 @@
 #ifndef Instruction_h
 #define Instruction_h
 
+#include "MacroAssembler.h"
 #include "Opcode.h"
 #include "Structure.h"
 #include <wtf/VectorTraits.h>
 
-#define POLYMORPHIC_LIST_CACHE_SIZE 4
+#define POLYMORPHIC_LIST_CACHE_SIZE 8
 
 namespace JSC {
 
+    // *Sigh*, If the JIT is enabled we need to track the stubRountine (of type CodeLocationLabel),
+    // If the JIT is not in use we don't actually need the variable (that said, if the JIT is not in use we don't
+    // curently actually use PolymorphicAccessStructureLists, which we should).  Anyway, this seems like the best
+    // solution for now - will need to something smarter if/when we actually want mixed-mode operation.
+#if ENABLE(JIT)
+    typedef CodeLocationLabel PolymorphicAccessStructureListStubRoutineType;
+#else
+    typedef void* PolymorphicAccessStructureListStubRoutineType;
+#endif
+
     class JSCell;
     class Structure;
     class StructureChain;
@@ -45,14 +56,14 @@ namespace JSC {
     struct PolymorphicAccessStructureList {
         struct PolymorphicStubInfo {
             bool isChain;
-            void* stubRoutine;
+            PolymorphicAccessStructureListStubRoutineType stubRoutine;
             Structure* base;
             union {
                 Structure* proto;
                 StructureChain* chain;
             } u;
 
-            void set(void* _stubRoutine, Structure* _base)
+            void set(PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base)
             {
                 stubRoutine = _stubRoutine;
                 base = _base;
@@ -60,7 +71,7 @@ namespace JSC {
                 isChain = false;
             }
             
-            void set(void* _stubRoutine, Structure* _base, Structure* _proto)
+            void set(PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base, Structure* _proto)
             {
                 stubRoutine = _stubRoutine;
                 base = _base;
@@ -68,7 +79,7 @@ namespace JSC {
                 isChain = false;
             }
             
-            void set(void* _stubRoutine, Structure* _base, StructureChain* _chain)
+            void set(PolymorphicAccessStructureListStubRoutineType _stubRoutine, Structure* _base, StructureChain* _chain)
             {
                 stubRoutine = _stubRoutine;
                 base = _base;
@@ -77,17 +88,17 @@ namespace JSC {
             }
         } list[POLYMORPHIC_LIST_CACHE_SIZE];
         
-        PolymorphicAccessStructureList(void* stubRoutine, Structure* firstBase)
+        PolymorphicAccessStructureList(PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase)
         {
             list[0].set(stubRoutine, firstBase);
         }
 
-        PolymorphicAccessStructureList(void* stubRoutine, Structure* firstBase, Structure* firstProto)
+        PolymorphicAccessStructureList(PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase, Structure* firstProto)
         {
             list[0].set(stubRoutine, firstBase, firstProto);
         }
 
-        PolymorphicAccessStructureList(void* stubRoutine, Structure* firstBase, StructureChain* firstChain)
+        PolymorphicAccessStructureList(PolymorphicAccessStructureListStubRoutineType stubRoutine, Structure* firstBase, StructureChain* firstChain)
         {
             list[0].set(stubRoutine, firstBase, firstChain);
         }
@@ -111,11 +122,20 @@ namespace JSC {
     };
 
     struct Instruction {
-        Instruction(Opcode opcode) { u.opcode = opcode; }
+        Instruction(Opcode opcode)
+        {
+#if !HAVE(COMPUTED_GOTO)
+            // We have to initialize one of the pointer members to ensure that
+            // the entire struct is initialized, when opcode is not a pointer.
+            u.jsCell = 0;
+#endif
+            u.opcode = opcode;
+        }
+
         Instruction(int operand)
         {
             // We have to initialize one of the pointer members to ensure that
-            // the entire struct is initialised in 64-bit.
+            // the entire struct is initialized in 64-bit.
             u.jsCell = 0;
             u.operand = operand;
         }
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/JumpTable.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/JumpTable.h
index 44e224d..b4f8e44 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/JumpTable.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/JumpTable.h
@@ -30,6 +30,7 @@
 #ifndef JumpTable_h
 #define JumpTable_h
 
+#include "MacroAssembler.h"
 #include "UString.h"
 #include <wtf/HashMap.h>
 #include <wtf/Vector.h>
@@ -39,7 +40,7 @@ namespace JSC {
     struct OffsetLocation {
         int32_t branchOffset;
 #if ENABLE(JIT)
-        void* ctiOffset;
+        CodeLocationLabel ctiOffset;
 #endif
     };
 
@@ -47,7 +48,7 @@ namespace JSC {
         typedef HashMap<RefPtr<UString::Rep>, OffsetLocation> StringOffsetTable;
         StringOffsetTable offsetTable;
 #if ENABLE(JIT)
-        void* ctiDefault; // FIXME: it should not be necessary to store this.
+        CodeLocationLabel ctiDefault; // FIXME: it should not be necessary to store this.
 #endif
 
         inline int32_t offsetForValue(UString::Rep* value, int32_t defaultOffset)
@@ -60,7 +61,7 @@ namespace JSC {
         }
 
 #if ENABLE(JIT)
-        inline void* ctiForValue(UString::Rep* value)
+        inline CodeLocationLabel ctiForValue(UString::Rep* value)
         {
             StringOffsetTable::const_iterator end = offsetTable.end();
             StringOffsetTable::const_iterator loc = offsetTable.find(value);
@@ -76,8 +77,8 @@ namespace JSC {
         Vector<int32_t> branchOffsets;
         int32_t min;
 #if ENABLE(JIT)
-        Vector<void*> ctiOffsets;
-        void* ctiDefault;
+        Vector<CodeLocationLabel> ctiOffsets;
+        CodeLocationLabel ctiDefault;
 #endif
 
         int32_t offsetForValue(int32_t value, int32_t defaultOffset);
@@ -88,7 +89,7 @@ namespace JSC {
         }
 
 #if ENABLE(JIT)
-        inline void* ctiForValue(int32_t value)
+        inline CodeLocationLabel ctiForValue(int32_t value)
         {
             if (value >= min && static_cast<uint32_t>(value - min) < ctiOffsets.size())
                 return ctiOffsets[value - min];
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
index e9c8f78..f4421df 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/Opcode.h
@@ -40,6 +40,7 @@ namespace JSC {
     #define FOR_EACH_OPCODE_ID(macro) \
         macro(op_enter, 1) \
         macro(op_enter_with_activation, 2) \
+        macro(op_init_arguments, 1) \
         macro(op_create_arguments, 1) \
         macro(op_convert_this, 2) \
         \
@@ -94,7 +95,7 @@ namespace JSC {
         macro(op_resolve_global, 6) \
         macro(op_get_scoped_var, 4) \
         macro(op_put_scoped_var, 4) \
-        macro(op_get_global_var, 6) \
+        macro(op_get_global_var, 4) \
         macro(op_put_global_var, 4) \
         macro(op_resolve_base, 3) \
         macro(op_resolve_with_base, 4) \
@@ -125,7 +126,9 @@ namespace JSC {
         macro(op_jfalse, 3) \
         macro(op_jeq_null, 3) \
         macro(op_jneq_null, 3) \
+        macro(op_jneq_ptr, 4) \
         macro(op_jnless, 4) \
+        macro(op_jnlesseq, 4) \
         macro(op_jmp_scopes, 3) \
         macro(op_loop, 2) \
         macro(op_loop_if_true, 3) \
@@ -139,12 +142,17 @@ namespace JSC {
         macro(op_new_func_exp, 3) \
         macro(op_call, 5) \
         macro(op_call_eval, 5) \
+        macro(op_call_varargs, 5) \
+        macro(op_load_varargs, 3) \
         macro(op_tear_off_activation, 2) \
         macro(op_tear_off_arguments, 1) \
         macro(op_ret, 2) \
+        macro(op_method_check, 1) \
         \
         macro(op_construct, 7) \
         macro(op_construct_verify, 3) \
+        macro(op_strcat, 4) \
+        macro(op_to_primitive, 3) \
         \
         macro(op_get_pnames, 3) \
         macro(op_next_pname, 4) \
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp
index ffb9132..8651723 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.cpp
@@ -39,24 +39,57 @@
 
 namespace JSC {
 
-void ScopeSampleRecord::sample(CodeBlock* codeBlock, Instruction* vPC)
+#if ENABLE(SAMPLING_FLAGS)
+
+void SamplingFlags::sample()
 {
-    if (!m_samples) {
-        m_size = codeBlock->instructions().size();
-        m_samples = static_cast<int*>(calloc(m_size, sizeof(int)));
-        m_codeBlock = codeBlock;
+    uint32_t mask = 1 << 31;
+    unsigned index;
+
+    for (index = 0; index < 32; ++index) {
+        if (mask & s_flags)
+            break;
+        mask >>= 1;
     }
 
-    ++m_sampleCount;
+    s_flagCounts[32 - index]++;
+}
 
-    unsigned offest = vPC - codeBlock->instructions().begin();
-    // Since we don't read and write codeBlock and vPC atomically, this check
-    // can fail if we sample mid op_call / op_ret.
-    if (offest < m_size) {
-        m_samples[offest]++;
-        m_opcodeSampleCount++;
-    }
+void SamplingFlags::start()
+{
+    for (unsigned i = 0; i <= 32; ++i)
+        s_flagCounts[i] = 0;
 }
+void SamplingFlags::stop()
+{
+    uint64_t total = 0;
+    for (unsigned i = 0; i <= 32; ++i)
+        total += s_flagCounts[i];
+
+    if (total) {
+        printf("\nSamplingFlags: sample counts with flags set: (%lld total)\n", total);
+        for (unsigned i = 0; i <= 32; ++i) {
+            if (s_flagCounts[i])
+                printf("  [ %02d ] : %lld\t\t(%03.2f%%)\n", i, s_flagCounts[i], (100.0 * s_flagCounts[i]) / total);
+        }
+        printf("\n");
+    } else
+    printf("\nSamplingFlags: no samples.\n\n");
+}
+uint64_t SamplingFlags::s_flagCounts[33];
+
+#else
+void SamplingFlags::start() {}
+void SamplingFlags::stop() {}
+#endif
+
+/*
+  Start with flag 16 set.
+  By doing this the monitoring of lower valued flags will be masked out
+  until flag 16 is explictly cleared.
+*/
+uint32_t SamplingFlags::s_flags = 1 << 15;
+
 
 #if PLATFORM(WIN_OS)
 
@@ -82,62 +115,113 @@ static inline unsigned hertz2us(unsigned hertz)
     return 1000000 / hertz;
 }
 
-void SamplingTool::run()
+
+SamplingTool* SamplingTool::s_samplingTool = 0;
+
+
+bool SamplingThread::s_running = false;
+unsigned SamplingThread::s_hertz = 10000;
+ThreadIdentifier SamplingThread::s_samplingThread;
+
+void* SamplingThread::threadStartFunc(void*)
 {
-    while (m_running) {
-        sleepForMicroseconds(hertz2us(m_hertz));
+    while (s_running) {
+        sleepForMicroseconds(hertz2us(s_hertz));
 
-        Sample sample(m_sample, m_codeBlock);
-        ++m_sampleCount;
+#if ENABLE(SAMPLING_FLAGS)
+        SamplingFlags::sample();
+#endif
+#if ENABLE(OPCODE_SAMPLING)
+        SamplingTool::sample();
+#endif
+    }
 
-        if (sample.isNull())
-            continue;
+    return 0;
+}
 
-        if (!sample.inHostFunction()) {
-            unsigned opcodeID = m_interpreter->getOpcodeID(sample.vPC()[0].u.opcode);
 
-            ++m_opcodeSampleCount;
-            ++m_opcodeSamples[opcodeID];
+void SamplingThread::start(unsigned hertz)
+{
+    ASSERT(!s_running);
+    s_running = true;
+    s_hertz = hertz;
 
-            if (sample.inCTIFunction())
-                m_opcodeSamplesInCTIFunctions[opcodeID]++;
-        }
+    s_samplingThread = createThread(threadStartFunc, 0, "JavaScriptCore::Sampler");
+}
+
+void SamplingThread::stop()
+{
+    ASSERT(s_running);
+    s_running = false;
+    waitForThreadCompletion(s_samplingThread, 0);
+}
+
+
+void ScopeSampleRecord::sample(CodeBlock* codeBlock, Instruction* vPC)
+{
+    if (!m_samples) {
+        m_size = codeBlock->instructions().size();
+        m_samples = static_cast<int*>(calloc(m_size, sizeof(int)));
+        m_codeBlock = codeBlock;
+    }
+
+    ++m_sampleCount;
+
+    unsigned offest = vPC - codeBlock->instructions().begin();
+    // Since we don't read and write codeBlock and vPC atomically, this check
+    // can fail if we sample mid op_call / op_ret.
+    if (offest < m_size) {
+        m_samples[offest]++;
+        m_opcodeSampleCount++;
+    }
+}
+
+void SamplingTool::doRun()
+{
+    Sample sample(m_sample, m_codeBlock);
+    ++m_sampleCount;
+
+    if (sample.isNull())
+        return;
+
+    if (!sample.inHostFunction()) {
+        unsigned opcodeID = m_interpreter->getOpcodeID(sample.vPC()[0].u.opcode);
+
+        ++m_opcodeSampleCount;
+        ++m_opcodeSamples[opcodeID];
+
+        if (sample.inCTIFunction())
+            m_opcodeSamplesInCTIFunctions[opcodeID]++;
+    }
 
 #if ENABLE(CODEBLOCK_SAMPLING)
+    if (CodeBlock* codeBlock = sample.codeBlock()) {
         MutexLocker locker(m_scopeSampleMapMutex);
-        ScopeSampleRecord* record = m_scopeSampleMap->get(sample.codeBlock()->ownerNode);
+        ScopeSampleRecord* record = m_scopeSampleMap->get(codeBlock->ownerNode());
         ASSERT(record);
-        record->sample(sample.codeBlock(), sample.vPC());
-#endif
+        record->sample(codeBlock, sample.vPC());
     }
+#endif
 }
 
-void* SamplingTool::threadStartFunc(void* samplingTool)
+void SamplingTool::sample()
 {
-    reinterpret_cast<SamplingTool*>(samplingTool)->run();
-    return 0;
+    s_samplingTool->doRun();
 }
 
 void SamplingTool::notifyOfScope(ScopeNode* scope)
 {
+#if ENABLE(CODEBLOCK_SAMPLING)
     MutexLocker locker(m_scopeSampleMapMutex);
     m_scopeSampleMap->set(scope, new ScopeSampleRecord(scope));
+#else
+    UNUSED_PARAM(scope);
+#endif
 }
 
-void SamplingTool::start(unsigned hertz)
-{
-    ASSERT(!m_running);
-    m_running = true;
-    m_hertz = hertz;
-
-    m_samplingThread = createThread(threadStartFunc, this, "JavaScriptCore::Sampler");
-}
-
-void SamplingTool::stop()
+void SamplingTool::setup()
 {
-    ASSERT(m_running);
-    m_running = false;
-    waitForThreadCompletion(m_samplingThread, 0);
+    s_samplingTool = this;
 }
 
 #if ENABLE(OPCODE_SAMPLING)
@@ -153,14 +237,6 @@ struct LineCountInfo {
     unsigned count;
 };
 
-static int compareLineCountInfoSampling(const void* left, const void* right)
-{
-    const LineCountInfo* leftLineCount = reinterpret_cast<const LineCountInfo*>(left);
-    const LineCountInfo* rightLineCount = reinterpret_cast<const LineCountInfo*>(right);
-
-    return (leftLineCount->line > rightLineCount->line) ? 1 : (leftLineCount->line < rightLineCount->line) ? -1 : 0;
-}
-
 static int compareOpcodeIndicesSampling(const void* left, const void* right)
 {
     const OpcodeSampleInfo* leftSampleInfo = reinterpret_cast<const OpcodeSampleInfo*>(left);
@@ -169,6 +245,15 @@ static int compareOpcodeIndicesSampling(const void* left, const void* right)
     return (leftSampleInfo->count < rightSampleInfo->count) ? 1 : (leftSampleInfo->count > rightSampleInfo->count) ? -1 : 0;
 }
 
+#if ENABLE(CODEBLOCK_SAMPLING)
+static int compareLineCountInfoSampling(const void* left, const void* right)
+{
+    const LineCountInfo* leftLineCount = reinterpret_cast<const LineCountInfo*>(left);
+    const LineCountInfo* rightLineCount = reinterpret_cast<const LineCountInfo*>(right);
+
+    return (leftLineCount->line > rightLineCount->line) ? 1 : (leftLineCount->line < rightLineCount->line) ? -1 : 0;
+}
+
 static int compareScopeSampleRecords(const void* left, const void* right)
 {
     const ScopeSampleRecord* const leftValue = *static_cast<const ScopeSampleRecord* const *>(left);
@@ -176,6 +261,7 @@ static int compareScopeSampleRecords(const void* left, const void* right)
 
     return (leftValue->m_sampleCount < rightValue->m_sampleCount) ? 1 : (leftValue->m_sampleCount > rightValue->m_sampleCount) ? -1 : 0;
 }
+#endif
 
 void SamplingTool::dump(ExecState* exec)
 {
@@ -227,6 +313,8 @@ void SamplingTool::dump(ExecState* exec)
     printf("\tcti count:\tsamples inside a CTI function called by this opcode\n");
     printf("\tcti %% of self:\tcti count / sample count\n");
     
+#if ENABLE(CODEBLOCK_SAMPLING)
+
     // (3) Build and sort 'codeBlockSamples' array.
 
     int scopeCount = m_scopeSampleMap->size();
@@ -248,8 +336,8 @@ void SamplingTool::dump(ExecState* exec)
         double blockPercent = (record->m_sampleCount * 100.0) / m_sampleCount;
 
         if (blockPercent >= 1) {
-            Instruction* code = codeBlock->instructions().begin();
-            printf("#%d: %s:%d: %d / %lld (%.3f%%)\n", i + 1, record->m_scope->sourceURL().UTF8String().c_str(), codeBlock->lineNumberForBytecodeOffset(0), record->m_sampleCount, m_sampleCount, blockPercent);
+            //Instruction* code = codeBlock->instructions().begin();
+            printf("#%d: %s:%d: %d / %lld (%.3f%%)\n", i + 1, record->m_scope->sourceURL().UTF8String().c_str(), codeBlock->lineNumberForBytecodeOffset(exec, 0), record->m_sampleCount, m_sampleCount, blockPercent);
             if (i < 10) {
                 HashMap<unsigned,unsigned> lineCounts;
                 codeBlock->dump(exec);
@@ -259,9 +347,7 @@ void SamplingTool::dump(ExecState* exec)
                     int count = record->m_samples[op];
                     if (count) {
                         printf("    [% 4d] has sample count: % 4d\n", op, count);
-                        // It is okay to pass 0 as the CallFrame for lineNumberForBytecodeOffset since
-                        // we ensure exception information when Sampling is enabled.
-                        unsigned line = codeBlock->lineNumberForBytecodeOffset(0, op);
+                        unsigned line = codeBlock->lineNumberForBytecodeOffset(exec, op);
                         lineCounts.set(line, (lineCounts.contains(line) ? lineCounts.get(line) : 0) + count);
                     }
                 }
@@ -287,6 +373,9 @@ void SamplingTool::dump(ExecState* exec)
             }
         }
     }
+#else
+    UNUSED_PARAM(exec);
+#endif
 }
 
 #else
@@ -297,4 +386,21 @@ void SamplingTool::dump(ExecState*)
 
 #endif
 
+void AbstractSamplingCounter::dump()
+{
+#if ENABLE(SAMPLING_COUNTERS)
+    if (s_abstractSamplingCounterChain != &s_abstractSamplingCounterChainEnd) {
+        printf("\nSampling Counter Values:\n");
+        for (AbstractSamplingCounter* currCounter = s_abstractSamplingCounterChain; (currCounter != &s_abstractSamplingCounterChainEnd); currCounter = currCounter->m_next)
+            printf("\t%s\t: %lld\n", currCounter->m_name, currCounter->m_counter);
+        printf("\n\n");
+    }
+    s_completed = true;
+#endif
+}
+
+AbstractSamplingCounter AbstractSamplingCounter::s_abstractSamplingCounterChainEnd;
+AbstractSamplingCounter* AbstractSamplingCounter::s_abstractSamplingCounterChain = &s_abstractSamplingCounterChainEnd;
+bool AbstractSamplingCounter::s_completed = false;
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.h
index daf99d2..7d7dc9c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/SamplingTool.h
@@ -38,6 +38,54 @@
 
 namespace JSC {
 
+    class SamplingFlags {
+        friend class JIT;
+    public:
+        static void start();
+        static void stop();
+
+#if ENABLE(SAMPLING_FLAGS)
+        static void setFlag(unsigned flag)
+        {
+            ASSERT(flag >= 1);
+            ASSERT(flag <= 32);
+            s_flags |= 1u << (flag - 1);
+        }
+
+        static void clearFlag(unsigned flag)
+        {
+            ASSERT(flag >= 1);
+            ASSERT(flag <= 32);
+            s_flags &= ~(1u << (flag - 1));
+        }
+
+        static void sample();
+
+        class ScopedFlag {
+        public:
+            ScopedFlag(int flag)
+                : m_flag(flag)
+            {
+                setFlag(flag);
+            }
+
+            ~ScopedFlag()
+            {
+                clearFlag(m_flag);
+            }
+
+        private:
+            int m_flag;
+        };
+    
+#endif
+    private:
+        static uint32_t s_flags;
+#if ENABLE(SAMPLING_FLAGS)
+        static uint64_t s_flagCounts[33];
+#endif
+    };
+
     class CodeBlock;
     class ExecState;
     class Interpreter;
@@ -73,6 +121,19 @@ namespace JSC {
 
     typedef WTF::HashMap<ScopeNode*, ScopeSampleRecord*> ScopeSampleRecordMap;
 
+    class SamplingThread {
+    public:
+        // Sampling thread state.
+        static bool s_running;
+        static unsigned s_hertz;
+        static ThreadIdentifier s_samplingThread;
+
+        static void start(unsigned hertz=10000);
+        static void stop();
+
+        static void* threadStartFunc(void*);
+    };
+
     class SamplingTool {
     public:
         friend class CallRecord;
@@ -127,12 +188,13 @@ namespace JSC {
 
         SamplingTool(Interpreter* interpreter)
             : m_interpreter(interpreter)
-            , m_running(false)
             , m_codeBlock(0)
             , m_sample(0)
             , m_sampleCount(0)
             , m_opcodeSampleCount(0)
+#if ENABLE(CODEBLOCK_SAMPLING)
             , m_scopeSampleMap(new ScopeSampleRecordMap())
+#endif
         {
             memset(m_opcodeSamples, 0, sizeof(m_opcodeSamples));
             memset(m_opcodeSamplesInCTIFunctions, 0, sizeof(m_opcodeSamplesInCTIFunctions));
@@ -140,11 +202,12 @@ namespace JSC {
 
         ~SamplingTool()
         {
+#if ENABLE(CODEBLOCK_SAMPLING)
             deleteAllValues(*m_scopeSampleMap);
+#endif
         }
 
-        void start(unsigned hertz=10000);
-        void stop();
+        void setup();
         void dump(ExecState*);
 
         void notifyOfScope(ScopeNode* scope);
@@ -159,12 +222,14 @@ namespace JSC {
         CodeBlock** codeBlockSlot() { return &m_codeBlock; }
         intptr_t* sampleSlot() { return &m_sample; }
 
-        unsigned encodeSample(Instruction* vPC, bool inCTIFunction = false, bool inHostFunction = false)
+        void* encodeSample(Instruction* vPC, bool inCTIFunction = false, bool inHostFunction = false)
         {
             ASSERT(!(reinterpret_cast<intptr_t>(vPC) & 0x3));
-            return reinterpret_cast<intptr_t>(vPC) | (static_cast<intptr_t>(inCTIFunction) << 1) | static_cast<intptr_t>(inHostFunction);
+            return reinterpret_cast<void*>(reinterpret_cast<intptr_t>(vPC) | (static_cast<intptr_t>(inCTIFunction) << 1) | static_cast<intptr_t>(inHostFunction));
         }
 
+        static void sample();
+
     private:
         class Sample {
         public:
@@ -174,7 +239,7 @@ namespace JSC {
             {
             }
             
-            bool isNull() { return !m_sample || !m_codeBlock; }
+            bool isNull() { return !m_sample; }
             CodeBlock* codeBlock() { return m_codeBlock; }
             Instruction* vPC() { return reinterpret_cast<Instruction*>(m_sample & ~0x3); }
             bool inHostFunction() { return m_sample & 0x1; }
@@ -184,17 +249,12 @@ namespace JSC {
             intptr_t m_sample;
             CodeBlock* m_codeBlock;
         };
-        
-        static void* threadStartFunc(void*);
-        void run();
+
+        void doRun();
+        static SamplingTool* s_samplingTool;
         
         Interpreter* m_interpreter;
         
-        // Sampling thread state.
-        bool m_running;
-        unsigned m_hertz;
-        ThreadIdentifier m_samplingThread;
-
         // State tracked by the main thread, used by the sampling thread.
         CodeBlock* m_codeBlock;
         intptr_t m_sample;
@@ -205,9 +265,147 @@ namespace JSC {
         unsigned m_opcodeSamples[numOpcodeIDs];
         unsigned m_opcodeSamplesInCTIFunctions[numOpcodeIDs];
         
+#if ENABLE(CODEBLOCK_SAMPLING)
         Mutex m_scopeSampleMapMutex;
         OwnPtr<ScopeSampleRecordMap> m_scopeSampleMap;
+#endif
+    };
+
+    // AbstractSamplingCounter:
+    //
+    // Implements a named set of counters, printed on exit if ENABLE(SAMPLING_COUNTERS).
+    // See subclasses below, SamplingCounter, GlobalSamplingCounter and DeletableSamplingCounter.
+    class AbstractSamplingCounter {
+        friend class JIT;
+        friend class DeletableSamplingCounter;
+    public:
+        void count(uint32_t count = 1)
+        {
+            m_counter += count;
+        }
+
+        static void dump();
+
+    protected:
+        // Effectively the contructor, however called lazily in the case of GlobalSamplingCounter.
+        void init(const char* name)
+        {
+            m_counter = 0;
+            m_name = name;
+
+            // Set m_next to point to the head of the chain, and inform whatever is
+            // currently at the head that this node will now hold the pointer to it.
+            m_next = s_abstractSamplingCounterChain;
+            s_abstractSamplingCounterChain->m_referer = &m_next;
+            // Add this node to the head of the list.
+            s_abstractSamplingCounterChain = this;
+            m_referer = &s_abstractSamplingCounterChain;
+        }
+
+        int64_t m_counter;
+        const char* m_name;
+        AbstractSamplingCounter* m_next;
+        // This is a pointer to the pointer to this node in the chain; used to
+        // allow fast linked list deletion.
+        AbstractSamplingCounter** m_referer;
+        // Null object used to detect end of static chain.
+        static AbstractSamplingCounter s_abstractSamplingCounterChainEnd;
+        static AbstractSamplingCounter* s_abstractSamplingCounterChain;
+        static bool s_completed;
+    };
+
+#if ENABLE(SAMPLING_COUNTERS)
+    // SamplingCounter:
+    //
+    // This class is suitable and (hopefully!) convenient for cases where a counter is
+    // required within the scope of a single function.  It can be instantiated as a
+    // static variable since it contains a constructor but not a destructor (static
+    // variables in WebKit cannot have destructors).
+    //
+    // For example:
+    //
+    // void someFunction()
+    // {
+    //     static SamplingCounter countMe("This is my counter.  There are many like it, but this one is mine.");
+    //     countMe.count();
+    //     // ...
+    // }
+    //
+    class SamplingCounter : public AbstractSamplingCounter {
+    public:
+        SamplingCounter(const char* name) { init(name); }
+    };
+
+    // GlobalSamplingCounter:
+    //
+    // This class is suitable for use where a counter is to be declared globally,
+    // since it contains neither a constructor nor destructor.  Instead, ensure
+    // that 'name()' is called to provide the counter with a name (and also to
+    // allow it to be printed out on exit).
+    //
+    // GlobalSamplingCounter globalCounter;
+    //
+    // void firstFunction()
+    // {
+    //     // Put this within a function that is definitely called!
+    //     // (Or alternatively alongside all calls to 'count()').
+    //     globalCounter.name("I Name You Destroyer.");
+    //     globalCounter.count();
+    //     // ...
+    // }
+    //
+    // void secondFunction()
+    // {
+    //     globalCounter.count();
+    //     // ...
+    // }
+    //
+    class GlobalSamplingCounter : public AbstractSamplingCounter {
+    public:
+        void name(const char* name)
+        {
+            // Global objects should be mapped in zero filled memory, so this should
+            // be a safe (albeit not necessarily threadsafe) check for 'first call'.
+            if (!m_next)
+                init(name);
+        }
+    };
+
+    // DeletableSamplingCounter:
+    //
+    // The above classes (SamplingCounter, GlobalSamplingCounter), are intended for
+    // use within a global or static scope, and as such cannot have a destructor.
+    // This means there is no convenient way for them to remove themselves from the
+    // static list of counters, and should an instance of either class be freed
+    // before 'dump()' has walked over the list it will potentially walk over an
+    // invalid pointer.
+    //
+    // This class is intended for use where the counter may possibly be deleted before
+    // the program exits.  Should this occur, the counter will print it's value to
+    // stderr, and remove itself from the static list.  Example:
+    //
+    // DeletableSamplingCounter* counter = new DeletableSamplingCounter("The Counter With No Name");
+    // counter->count();
+    // delete counter;
+    //
+    class DeletableSamplingCounter : public AbstractSamplingCounter {
+    public:
+        DeletableSamplingCounter(const char* name) { init(name); }
+
+        ~DeletableSamplingCounter()
+        {
+            if (!s_completed)
+                fprintf(stderr, "DeletableSamplingCounter \"%s\" deleted early (with count %lld)\n", m_name, m_counter);
+            // Our m_referer pointer should know where the pointer to this node is,
+            // and m_next should know that this node is the previous node in the list.
+            ASSERT(*m_referer == this);
+            ASSERT(m_next->m_referer == &m_next);
+            // Remove this node from the list, and inform m_next that we have done so.
+            m_next->m_referer = m_referer;
+            *m_referer = m_next;
+        }
     };
+#endif
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecode/StructureStubInfo.h b/src/3rdparty/webkit/JavaScriptCore/bytecode/StructureStubInfo.h
index a9e0678..95dd266 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecode/StructureStubInfo.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecode/StructureStubInfo.h
@@ -26,19 +26,18 @@
 #ifndef StructureStubInfo_h
 #define StructureStubInfo_h
 
+#if ENABLE(JIT)
+
 #include "Instruction.h"
+#include "MacroAssembler.h"
 #include "Opcode.h"
 #include "Structure.h"
 
 namespace JSC {
 
-#if ENABLE(JIT)
     struct StructureStubInfo {
         StructureStubInfo(OpcodeID opcodeID)
             : opcodeID(opcodeID)
-            , stubRoutine(0)
-            , callReturnLocation(0)
-            , hotPathBegin(0)
         {
         }
 
@@ -145,12 +144,13 @@ namespace JSC {
             } putByIdReplace;
         } u;
 
-        void* stubRoutine;
-        void* callReturnLocation;
-        void* hotPathBegin;
+        CodeLocationLabel stubRoutine;
+        CodeLocationCall callReturnLocation;
+        CodeLocationLabel hotPathBegin;
     };
-#endif
 
 } // namespace JSC
 
+#endif
+
 #endif // StructureStubInfo_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 91279b8..7feb3c8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -31,6 +31,7 @@
 #include "BytecodeGenerator.h"
 
 #include "BatchedTransitionOptimizer.h"
+#include "PrototypeFunction.h"
 #include "JSFunction.h"
 #include "Interpreter.h"
 #include "UString.h"
@@ -115,7 +116,7 @@ namespace JSC {
 */
 
 #ifndef NDEBUG
-bool BytecodeGenerator::s_dumpsGeneratedCode = false;
+static bool s_dumpsGeneratedCode = false;
 #endif
 
 void BytecodeGenerator::setDumpsGeneratedCode(bool dumpsGeneratedCode)
@@ -145,14 +146,14 @@ void BytecodeGenerator::generate()
 #ifndef NDEBUG
     m_codeBlock->setInstructionCount(m_codeBlock->instructions().size());
 
-    if (s_dumpsGeneratedCode) {
-        JSGlobalObject* globalObject = m_scopeChain->globalObject();
-        m_codeBlock->dump(globalObject->globalExec());
-    }
+    if (s_dumpsGeneratedCode)
+        m_codeBlock->dump(m_scopeChain->globalObject()->globalExec());
 #endif
 
     if ((m_codeType == FunctionCode && !m_codeBlock->needsFullScopeChain() && !m_codeBlock->usesArguments()) || m_codeType == EvalCode)
         symbolTable().clear();
+        
+    m_codeBlock->setIsNumericCompareFunction(instructions() == m_globalData->numericCompareFunction(m_scopeChain->globalObject()->globalExec()));
 
 #if !ENABLE(OPCODE_SAMPLING)
     if (!m_regeneratingForExceptionInfo && (m_codeType == FunctionCode || m_codeType == EvalCode))
@@ -211,7 +212,6 @@ void BytecodeGenerator::allocateConstants(size_t count)
 BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, const Debugger* debugger, const ScopeChain& scopeChain, SymbolTable* symbolTable, ProgramCodeBlock* codeBlock)
     : m_shouldEmitDebugHooks(!!debugger)
     , m_shouldEmitProfileHooks(scopeChain.globalObject()->supportsProfiling())
-    , m_regeneratingForExceptionInfo(false)
     , m_scopeChain(&scopeChain)
     , m_symbolTable(symbolTable)
     , m_scopeNode(programNode)
@@ -222,9 +222,12 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, const Debugger* d
     , m_baseScopeDepth(0)
     , m_codeType(GlobalCode)
     , m_nextGlobalIndex(-1)
+    , m_globalConstantIndex(0)
     , m_globalData(&scopeChain.globalObject()->globalExec()->globalData())
     , m_lastOpcodeID(op_end)
     , m_emitNodeDepth(0)
+    , m_regeneratingForExceptionInfo(false)
+    , m_codeBlockBeingRegeneratedFrom(0)
 {
     if (m_shouldEmitDebugHooks)
         m_codeBlock->setNeedsFullScopeChain(true);
@@ -259,7 +262,7 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, const Debugger* d
         m_nextGlobalIndex -= symbolTable->size();
 
         for (size_t i = 0; i < functionStack.size(); ++i) {
-            FuncDeclNode* funcDecl = functionStack[i].get();
+            FuncDeclNode* funcDecl = functionStack[i];
             globalObject->removeDirect(funcDecl->m_ident); // Make sure our new function is not shadowed by an old property.
             emitNewFunction(addGlobalVar(funcDecl->m_ident, false), funcDecl);
         }
@@ -275,7 +278,7 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, const Debugger* d
             emitLoad(newVars[i], jsUndefined());
     } else {
         for (size_t i = 0; i < functionStack.size(); ++i) {
-            FuncDeclNode* funcDecl = functionStack[i].get();
+            FuncDeclNode* funcDecl = functionStack[i];
             globalObject->putWithAttributes(exec, funcDecl->m_ident, funcDecl->makeFunction(exec, scopeChain.node()), DontDelete);
         }
         for (size_t i = 0; i < varStack.size(); ++i) {
@@ -294,7 +297,6 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, const Debugger* d
 BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, const Debugger* debugger, const ScopeChain& scopeChain, SymbolTable* symbolTable, CodeBlock* codeBlock)
     : m_shouldEmitDebugHooks(!!debugger)
     , m_shouldEmitProfileHooks(scopeChain.globalObject()->supportsProfiling())
-    , m_regeneratingForExceptionInfo(false)
     , m_scopeChain(&scopeChain)
     , m_symbolTable(symbolTable)
     , m_scopeNode(functionBody)
@@ -303,9 +305,12 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, const Debug
     , m_dynamicScopeDepth(0)
     , m_baseScopeDepth(0)
     , m_codeType(FunctionCode)
+    , m_globalConstantIndex(0)
     , m_globalData(&scopeChain.globalObject()->globalExec()->globalData())
     , m_lastOpcodeID(op_end)
     , m_emitNodeDepth(0)
+    , m_regeneratingForExceptionInfo(false)
+    , m_codeBlockBeingRegeneratedFrom(0)
 {
     if (m_shouldEmitDebugHooks)
         m_codeBlock->setNeedsFullScopeChain(true);
@@ -327,12 +332,19 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, const Debug
     } else
         emitOpcode(op_enter);
 
-    if (usesArguments)
-        emitOpcode(op_create_arguments);
+     if (usesArguments) {
+        emitOpcode(op_init_arguments);
+
+        // The debugger currently retrieves the arguments object from an activation rather than pulling
+        // it from a call frame.  In the long-term it should stop doing that (<rdar://problem/6911886>),
+        // but for now we force eager creation of the arguments object when debugging.
+        if (m_shouldEmitDebugHooks)
+            emitOpcode(op_create_arguments);
+    }
 
     const DeclarationStacks::FunctionStack& functionStack = functionBody->functionStack();
     for (size_t i = 0; i < functionStack.size(); ++i) {
-        FuncDeclNode* funcDecl = functionStack[i].get();
+        FuncDeclNode* funcDecl = functionStack[i];
         const Identifier& ident = funcDecl->m_ident;
         m_functions.add(ident.ustring().rep());
         emitNewFunction(addVar(ident, false), funcDecl);
@@ -366,7 +378,6 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, const Debug
 BytecodeGenerator::BytecodeGenerator(EvalNode* evalNode, const Debugger* debugger, const ScopeChain& scopeChain, SymbolTable* symbolTable, EvalCodeBlock* codeBlock)
     : m_shouldEmitDebugHooks(!!debugger)
     , m_shouldEmitProfileHooks(scopeChain.globalObject()->supportsProfiling())
-    , m_regeneratingForExceptionInfo(false)
     , m_scopeChain(&scopeChain)
     , m_symbolTable(symbolTable)
     , m_scopeNode(evalNode)
@@ -374,11 +385,14 @@ BytecodeGenerator::BytecodeGenerator(EvalNode* evalNode, const Debugger* debugge
     , m_thisRegister(RegisterFile::ProgramCodeThisRegister)
     , m_finallyDepth(0)
     , m_dynamicScopeDepth(0)
-    , m_baseScopeDepth(scopeChain.localDepth())
+    , m_baseScopeDepth(codeBlock->baseScopeDepth())
     , m_codeType(EvalCode)
+    , m_globalConstantIndex(0)
     , m_globalData(&scopeChain.globalObject()->globalExec()->globalData())
     , m_lastOpcodeID(op_end)
     , m_emitNodeDepth(0)
+    , m_regeneratingForExceptionInfo(false)
+    , m_codeBlockBeingRegeneratedFrom(0)
 {
     if (m_shouldEmitDebugHooks || m_baseScopeDepth)
         m_codeBlock->setNeedsFullScopeChain(true);
@@ -421,6 +435,36 @@ RegisterID* BytecodeGenerator::registerFor(const Identifier& ident)
     if (entry.isNull())
         return 0;
 
+    if (ident == propertyNames().arguments)
+        createArgumentsIfNecessary();
+
+    return &registerFor(entry.getIndex());
+}
+
+bool BytecodeGenerator::willResolveToArguments(const Identifier& ident)
+{
+    if (ident != propertyNames().arguments)
+        return false;
+    
+    if (!shouldOptimizeLocals())
+        return false;
+    
+    SymbolTableEntry entry = symbolTable().get(ident.ustring().rep());
+    if (entry.isNull())
+        return false;
+    
+    if (m_codeBlock->usesArguments() && m_codeType == FunctionCode)
+        return true;
+    
+    return false;
+}
+
+RegisterID* BytecodeGenerator::uncheckedRegisterForArguments()
+{
+    ASSERT(willResolveToArguments(propertyNames().arguments));
+
+    SymbolTableEntry entry = symbolTable().get(propertyNames().arguments.ustring().rep());
+    ASSERT(!entry.isNull());
     return &registerFor(entry.getIndex());
 }
 
@@ -645,6 +689,21 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
             instructions().append(target->offsetFrom(instructions().size()));
             return target;
         }
+    } else if (m_lastOpcodeID == op_lesseq) {
+        int dstIndex;
+        int src1Index;
+        int src2Index;
+
+        retrieveLastBinaryOp(dstIndex, src1Index, src2Index);
+
+        if (cond->index() == dstIndex && cond->isTemporary() && !cond->refCount()) {
+            rewindBinaryOp();
+            emitOpcode(op_jnlesseq);
+            instructions().append(src1Index);
+            instructions().append(src2Index);
+            instructions().append(target->offsetFrom(instructions().size()));
+            return target;
+        }
     } else if (m_lastOpcodeID == op_not) {
         int dstIndex;
         int srcIndex;
@@ -692,6 +751,24 @@ PassRefPtr<Label> BytecodeGenerator::emitJumpIfFalse(RegisterID* cond, Label* ta
     return target;
 }
 
+PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionCall(RegisterID* cond, Label* target)
+{
+    emitOpcode(op_jneq_ptr);
+    instructions().append(cond->index());
+    instructions().append(m_scopeChain->globalObject()->d()->callFunction);
+    instructions().append(target->offsetFrom(instructions().size()));
+    return target;
+}
+
+PassRefPtr<Label> BytecodeGenerator::emitJumpIfNotFunctionApply(RegisterID* cond, Label* target)
+{
+    emitOpcode(op_jneq_ptr);
+    instructions().append(cond->index());
+    instructions().append(m_scopeChain->globalObject()->d()->applyFunction);
+    instructions().append(target->offsetFrom(instructions().size()));
+    return target;
+}
+
 unsigned BytecodeGenerator::addConstant(FuncDeclNode* n)
 {
     // No need to explicitly unique function body nodes -- they're unique already.
@@ -714,26 +791,36 @@ unsigned BytecodeGenerator::addConstant(const Identifier& ident)
     return result.first->second;
 }
 
-RegisterID* BytecodeGenerator::addConstant(JSValuePtr v)
+RegisterID* BytecodeGenerator::addConstant(JSValue v)
 {
-    pair<JSValueMap::iterator, bool> result = m_jsValueMap.add(JSValuePtr::encode(v), m_nextConstantIndex);
+    pair<JSValueMap::iterator, bool> result = m_jsValueMap.add(JSValue::encode(v), m_nextConstantIndex);
     if (result.second) {
         RegisterID& constant = m_calleeRegisters[m_nextConstantIndex];
         
         ++m_nextConstantIndex;
 
-        m_codeBlock->addConstantRegister(JSValuePtr(v));
+        m_codeBlock->addConstantRegister(JSValue(v));
         return &constant;
     }
 
     return &registerFor(result.first->second);
 }
 
-unsigned BytecodeGenerator::addUnexpectedConstant(JSValuePtr v)
+unsigned BytecodeGenerator::addUnexpectedConstant(JSValue v)
 {
     return m_codeBlock->addUnexpectedConstant(v);
 }
 
+RegisterID* BytecodeGenerator::emitLoadGlobalObject(RegisterID* dst, JSObject* globalObject)
+{
+    if (!m_globalConstantIndex)
+        m_globalConstantIndex = m_codeBlock->addUnexpectedConstant(globalObject);
+    emitOpcode(op_unexpected_load);
+    instructions().append(dst->index());
+    instructions().append(m_globalConstantIndex);
+    return dst;
+}
+
 unsigned BytecodeGenerator::addRegExp(RegExp* r)
 {
     return m_codeBlock->addRegExp(r);
@@ -811,8 +898,8 @@ RegisterID* BytecodeGenerator::emitEqualityOp(OpcodeID opcodeID, RegisterID* dst
         if (src1->index() == dstIndex
             && src1->isTemporary()
             && m_codeBlock->isConstantRegisterIndex(src2->index())
-            && m_codeBlock->constantRegister(src2->index() - m_codeBlock->m_numVars).jsValue(m_scopeChain->globalObject()->globalExec())->isString()) {
-            const UString& value = asString(m_codeBlock->constantRegister(src2->index() - m_codeBlock->m_numVars).jsValue(m_scopeChain->globalObject()->globalExec()))->value();
+            && m_codeBlock->constantRegister(src2->index() - m_codeBlock->m_numVars).jsValue().isString()) {
+            const UString& value = asString(m_codeBlock->constantRegister(src2->index() - m_codeBlock->m_numVars).jsValue())->value();
             if (value == "undefined") {
                 rewindUnaryOp();
                 emitOpcode(op_is_undefined);
@@ -876,7 +963,7 @@ RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, double number)
     // Later we can do the extra work to handle that like the other cases.
     if (number == HashTraits<double>::emptyValue() || HashTraits<double>::isDeletedValue(number))
         return emitLoad(dst, jsNumber(globalData(), number));
-    JSValuePtr& valueInMap = m_numberMap.add(number, noValue()).first->second;
+    JSValue& valueInMap = m_numberMap.add(number, JSValue()).first->second;
     if (!valueInMap)
         valueInMap = jsNumber(globalData(), number);
     return emitLoad(dst, valueInMap);
@@ -887,10 +974,10 @@ RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, const Identifier& ident
     JSString*& stringInMap = m_stringMap.add(identifier.ustring().rep(), 0).first->second;
     if (!stringInMap)
         stringInMap = jsOwnedString(globalData(), identifier.ustring());
-    return emitLoad(dst, JSValuePtr(stringInMap));
+    return emitLoad(dst, JSValue(stringInMap));
 }
 
-RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, JSValuePtr v)
+RegisterID* BytecodeGenerator::emitLoad(RegisterID* dst, JSValue v)
 {
     RegisterID* constantID = addConstant(v);
     if (dst)
@@ -991,14 +1078,23 @@ RegisterID* BytecodeGenerator::emitResolve(RegisterID* dst, const Identifier& pr
         return dst;
     }
 
-    if (index != missingSymbolMarker()) {
-        // Directly index the property lookup across multiple scopes.  Yay!
-        return emitGetScopedVar(dst, depth, index, globalObject);
-    }
-
     if (globalObject) {
+        bool forceGlobalResolve = false;
+        if (m_regeneratingForExceptionInfo) {
 #if ENABLE(JIT)
-        m_codeBlock->addGlobalResolveInfo();
+            forceGlobalResolve = m_codeBlockBeingRegeneratedFrom->hasGlobalResolveInfoAtBytecodeOffset(instructions().size());
+#else
+            forceGlobalResolve = m_codeBlockBeingRegeneratedFrom->hasGlobalResolveInstructionAtBytecodeOffset(instructions().size());
+#endif
+        }
+
+        if (index != missingSymbolMarker() && !forceGlobalResolve) {
+            // Directly index the property lookup across multiple scopes.
+            return emitGetScopedVar(dst, depth, index, globalObject);
+        }
+
+#if ENABLE(JIT)
+        m_codeBlock->addGlobalResolveInfo(instructions().size());
 #else
         m_codeBlock->addGlobalResolveInstruction(instructions().size());
 #endif
@@ -1011,6 +1107,11 @@ RegisterID* BytecodeGenerator::emitResolve(RegisterID* dst, const Identifier& pr
         return dst;
     }
 
+    if (index != missingSymbolMarker()) {
+        // Directly index the property lookup across multiple scopes.
+        return emitGetScopedVar(dst, depth, index, globalObject);
+    }
+
     // In this case we are at least able to drop a few scope chains from the
     // lookup chain, although we still need to hash from then on.
     emitOpcode(op_resolve_skip);
@@ -1020,16 +1121,13 @@ RegisterID* BytecodeGenerator::emitResolve(RegisterID* dst, const Identifier& pr
     return dst;
 }
 
-RegisterID* BytecodeGenerator::emitGetScopedVar(RegisterID* dst, size_t depth, int index, JSValuePtr globalObject)
+RegisterID* BytecodeGenerator::emitGetScopedVar(RegisterID* dst, size_t depth, int index, JSValue globalObject)
 {
     if (globalObject) {
-        // op_get_global_var must be the same length as op_resolve_global.
         emitOpcode(op_get_global_var);
         instructions().append(dst->index());
         instructions().append(asCell(globalObject));
         instructions().append(index);
-        instructions().append(0);
-        instructions().append(0);
         return dst;
     }
 
@@ -1040,7 +1138,7 @@ RegisterID* BytecodeGenerator::emitGetScopedVar(RegisterID* dst, size_t depth, i
     return dst;
 }
 
-RegisterID* BytecodeGenerator::emitPutScopedVar(size_t depth, int index, RegisterID* value, JSValuePtr globalObject)
+RegisterID* BytecodeGenerator::emitPutScopedVar(size_t depth, int index, RegisterID* value, JSValue globalObject)
 {
     if (globalObject) {
         emitOpcode(op_put_global_var);
@@ -1058,18 +1156,65 @@ RegisterID* BytecodeGenerator::emitPutScopedVar(size_t depth, int index, Registe
 
 RegisterID* BytecodeGenerator::emitResolveBase(RegisterID* dst, const Identifier& property)
 {
-    emitOpcode(op_resolve_base);
-    instructions().append(dst->index());
-    instructions().append(addConstant(property));
-    return dst;
+    size_t depth = 0;
+    int index = 0;
+    JSObject* globalObject = 0;
+    findScopedProperty(property, index, depth, false, globalObject);
+    if (!globalObject) {
+        // We can't optimise at all :-(
+        emitOpcode(op_resolve_base);
+        instructions().append(dst->index());
+        instructions().append(addConstant(property));
+        return dst;
+    }
+
+    // Global object is the base
+    return emitLoadGlobalObject(dst, globalObject);
 }
 
 RegisterID* BytecodeGenerator::emitResolveWithBase(RegisterID* baseDst, RegisterID* propDst, const Identifier& property)
 {
-    emitOpcode(op_resolve_with_base);
-    instructions().append(baseDst->index());
+    size_t depth = 0;
+    int index = 0;
+    JSObject* globalObject = 0;
+    if (!findScopedProperty(property, index, depth, false, globalObject) || !globalObject) {
+        // We can't optimise at all :-(
+        emitOpcode(op_resolve_with_base);
+        instructions().append(baseDst->index());
+        instructions().append(propDst->index());
+        instructions().append(addConstant(property));
+        return baseDst;
+    }
+
+    bool forceGlobalResolve = false;
+    if (m_regeneratingForExceptionInfo) {
+#if ENABLE(JIT)
+        forceGlobalResolve = m_codeBlockBeingRegeneratedFrom->hasGlobalResolveInfoAtBytecodeOffset(instructions().size());
+#else
+        forceGlobalResolve = m_codeBlockBeingRegeneratedFrom->hasGlobalResolveInstructionAtBytecodeOffset(instructions().size());
+#endif
+    }
+
+    // Global object is the base
+    emitLoadGlobalObject(baseDst, globalObject);
+
+    if (index != missingSymbolMarker() && !forceGlobalResolve) {
+        // Directly index the property lookup across multiple scopes.
+        emitGetScopedVar(propDst, depth, index, globalObject);
+        return baseDst;
+    }
+
+#if ENABLE(JIT)
+    m_codeBlock->addGlobalResolveInfo(instructions().size());
+#else
+    m_codeBlock->addGlobalResolveInstruction(instructions().size());
+#endif
+    emitOpcode(op_resolve_global);
     instructions().append(propDst->index());
+    instructions().append(globalObject);
     instructions().append(addConstant(property));
+    instructions().append(0);
+    instructions().append(0);
     return baseDst;
 }
 
@@ -1082,6 +1227,11 @@ RegisterID* BytecodeGenerator::emitResolveFunction(RegisterID* baseDst, Register
     return baseDst;
 }
 
+void BytecodeGenerator::emitMethodCheck()
+{
+    emitOpcode(op_method_check);
+}
+
 RegisterID* BytecodeGenerator::emitGetById(RegisterID* dst, RegisterID* base, const Identifier& property)
 {
 #if ENABLE(JIT)
@@ -1238,8 +1388,15 @@ RegisterID* BytecodeGenerator::emitCall(RegisterID* dst, RegisterID* func, Regis
     return emitCall(op_call, dst, func, thisRegister, argumentsNode, divot, startOffset, endOffset);
 }
 
+void BytecodeGenerator::createArgumentsIfNecessary()
+{
+    if (m_codeBlock->usesArguments() && m_codeType == FunctionCode)
+        emitOpcode(op_create_arguments);
+}
+
 RegisterID* BytecodeGenerator::emitCallEval(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, ArgumentsNode* argumentsNode, unsigned divot, unsigned startOffset, unsigned endOffset)
 {
+    createArgumentsIfNecessary();
     return emitCall(op_call_eval, dst, func, thisRegister, argumentsNode, divot, startOffset, endOffset);
 }
 
@@ -1266,7 +1423,7 @@ RegisterID* BytecodeGenerator::emitCall(OpcodeID opcodeID, RegisterID* dst, Regi
     // Generate code for arguments.
     Vector<RefPtr<RegisterID>, 16> argv;
     argv.append(thisRegister);
-    for (ArgumentListNode* n = argumentsNode->m_listNode.get(); n; n = n->m_next.get()) {
+    for (ArgumentListNode* n = argumentsNode->m_listNode; n; n = n->m_next) {
         argv.append(newTemporary());
         // op_call requires the arguments to be a sequential range of registers
         ASSERT(argv[argv.size() - 1]->index() == argv[argv.size() - 2]->index() + 1);
@@ -1313,6 +1470,44 @@ RegisterID* BytecodeGenerator::emitCall(OpcodeID opcodeID, RegisterID* dst, Regi
     return dst;
 }
 
+RegisterID* BytecodeGenerator::emitLoadVarargs(RegisterID* argCountDst, RegisterID* arguments)
+{
+    ASSERT(argCountDst->index() < arguments->index());
+    emitOpcode(op_load_varargs);
+    instructions().append(argCountDst->index());
+    instructions().append(arguments->index());
+    return argCountDst;
+}
+
+RegisterID* BytecodeGenerator::emitCallVarargs(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, RegisterID* argCountRegister, unsigned divot, unsigned startOffset, unsigned endOffset)
+{
+    ASSERT(func->refCount());
+    ASSERT(thisRegister->refCount());
+    ASSERT(dst != func);
+    if (m_shouldEmitProfileHooks) {
+        emitOpcode(op_profile_will_call);
+        instructions().append(func->index());
+        
+#if ENABLE(JIT)
+        m_codeBlock->addFunctionRegisterInfo(instructions().size(), func->index());
+#endif
+    }
+    
+    emitExpressionInfo(divot, startOffset, endOffset);
+    
+    // Emit call.
+    emitOpcode(op_call_varargs);
+    instructions().append(dst->index()); // dst
+    instructions().append(func->index()); // func
+    instructions().append(argCountRegister->index()); // arg count
+    instructions().append(thisRegister->index() + RegisterFile::CallFrameHeaderSize); // initial registerOffset
+    if (m_shouldEmitProfileHooks) {
+        emitOpcode(op_profile_did_call);
+        instructions().append(func->index());
+    }
+    return dst;
+}
+
 RegisterID* BytecodeGenerator::emitReturn(RegisterID* src)
 {
     if (m_codeBlock->needsFullScopeChain()) {
@@ -1351,7 +1546,7 @@ RegisterID* BytecodeGenerator::emitConstruct(RegisterID* dst, RegisterID* func,
     // Generate code for arguments.
     Vector<RefPtr<RegisterID>, 16> argv;
     argv.append(newTemporary()); // reserve space for "this"
-    for (ArgumentListNode* n = argumentsNode ? argumentsNode->m_listNode.get() : 0; n; n = n->m_next.get()) {
+    for (ArgumentListNode* n = argumentsNode ? argumentsNode->m_listNode : 0; n; n = n->m_next) {
         argv.append(newTemporary());
         // op_construct requires the arguments to be a sequential range of registers
         ASSERT(argv[argv.size() - 1]->index() == argv[argv.size() - 2]->index() + 1);
@@ -1402,6 +1597,23 @@ RegisterID* BytecodeGenerator::emitConstruct(RegisterID* dst, RegisterID* func,
     return dst;
 }
 
+RegisterID* BytecodeGenerator::emitStrcat(RegisterID* dst, RegisterID* src, int count)
+{
+    emitOpcode(op_strcat);
+    instructions().append(dst->index());
+    instructions().append(src->index());
+    instructions().append(count);
+
+    return dst;
+}
+
+void BytecodeGenerator::emitToPrimitive(RegisterID* dst, RegisterID* src)
+{
+    emitOpcode(op_to_primitive);
+    instructions().append(dst->index());
+    instructions().append(src->index());
+}
+
 RegisterID* BytecodeGenerator::emitPushScope(RegisterID* scope)
 {
     ASSERT(scope->isTemporary());
@@ -1409,6 +1621,7 @@ RegisterID* BytecodeGenerator::emitPushScope(RegisterID* scope)
     context.isFinallyBlock = false;
     m_scopeContextStack.append(context);
     m_dynamicScopeDepth++;
+    createArgumentsIfNecessary();
 
     return emitUnaryNoDstOp(op_push_scope, scope);
 }
@@ -1456,8 +1669,17 @@ void BytecodeGenerator::popFinallyContext()
 LabelScope* BytecodeGenerator::breakTarget(const Identifier& name)
 {
     // Reclaim free label scopes.
-    while (m_labelScopes.size() && !m_labelScopes.last().refCount())
+    //
+    // The condition was previously coded as 'm_labelScopes.size() && !m_labelScopes.last().refCount()',
+    // however sometimes this appears to lead to GCC going a little haywire and entering the loop with
+    // size 0, leading to segfaulty badness.  We are yet to identify a valid cause within our code to
+    // cause the GCC codegen to misbehave in this fashion, and as such the following refactoring of the
+    // loop condition is a workaround.
+    while (m_labelScopes.size()) {
+        if  (m_labelScopes.last().refCount())
+            break;
         m_labelScopes.removeLast();
+    }
 
     if (!m_labelScopes.size())
         return 0;
@@ -1554,14 +1776,10 @@ PassRefPtr<Label> BytecodeGenerator::emitComplexJumpScopes(Label* target, Contro
             emitLabel(nextInsn.get());
         }
 
-        // To get here there must be at least one finally block present
-        do {
-            ASSERT(topScope->isFinallyBlock);
+        while (topScope > bottomScope && topScope->isFinallyBlock) {
             emitJumpSubroutine(topScope->finallyContext.retAddrDst, topScope->finallyContext.finallyAddr);
             --topScope;
-            if (!topScope->isFinallyBlock)
-                break;
-        } while (topScope > bottomScope);
+        }
     }
     return emitJump(target);
 }
@@ -1597,7 +1815,7 @@ RegisterID* BytecodeGenerator::emitNextPropertyName(RegisterID* dst, RegisterID*
 RegisterID* BytecodeGenerator::emitCatch(RegisterID* targetRegister, Label* start, Label* end)
 {
 #if ENABLE(JIT)
-    HandlerInfo info = { start->offsetFrom(0), end->offsetFrom(0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth, 0 };
+    HandlerInfo info = { start->offsetFrom(0), end->offsetFrom(0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth, CodeLocationLabel() };
 #else
     HandlerInfo info = { start->offsetFrom(0), end->offsetFrom(0), instructions().size(), m_dynamicScopeDepth + m_baseScopeDepth };
 #endif
@@ -1608,7 +1826,7 @@ RegisterID* BytecodeGenerator::emitCatch(RegisterID* targetRegister, Label* star
     return targetRegister;
 }
 
-RegisterID* BytecodeGenerator::emitNewError(RegisterID* dst, ErrorType type, JSValuePtr message)
+RegisterID* BytecodeGenerator::emitNewError(RegisterID* dst, ErrorType type, JSValue message)
 {
     emitOpcode(op_new_error);
     instructions().append(dst->index());
@@ -1638,6 +1856,8 @@ void BytecodeGenerator::emitPushNewScope(RegisterID* dst, Identifier& property,
     m_scopeContextStack.append(context);
     m_dynamicScopeDepth++;
     
+    createArgumentsIfNecessary();
+
     emitOpcode(op_push_new_scope);
     instructions().append(dst->index());
     instructions().append(addConstant(property));
@@ -1672,8 +1892,8 @@ static int32_t keyForImmediateSwitch(ExpressionNode* node, int32_t min, int32_t
     UNUSED_PARAM(max);
     ASSERT(node->isNumber());
     double value = static_cast<NumberNode*>(node)->value();
-    ASSERT(JSImmediate::from(value));
     int32_t key = static_cast<int32_t>(value);
+    ASSERT(JSValue::makeInt32Fast(key) && (JSValue::makeInt32Fast(key).getInt32Fast() == value));
     ASSERT(key == value);
     ASSERT(key >= min);
     ASSERT(key <= max);
@@ -1730,9 +1950,6 @@ static void prepareJumpTableForStringSwitch(StringJumpTable& jumpTable, int32_t
         UString::Rep* clause = static_cast<StringNode*>(nodes[i])->value().ustring().rep();
         OffsetLocation location;
         location.branchOffset = labels[i]->offsetFrom(switchAddress);
-#if ENABLE(JIT)
-        location.ctiOffset = 0;
-#endif
         jumpTable.offsetTable.add(clause, location);
     }
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index 3156cbf..d29a24d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -37,11 +37,12 @@
 #include "LabelScope.h"
 #include "Interpreter.h"
 #include "RegisterID.h"
-#include "SegmentedVector.h"
 #include "SymbolTable.h"
 #include "Debugger.h"
 #include "Nodes.h"
+#include <wtf/FastAllocBase.h>
 #include <wtf/PassRefPtr.h>
+#include <wtf/SegmentedVector.h>
 #include <wtf/Vector.h>
 
 namespace JSC {
@@ -60,7 +61,7 @@ namespace JSC {
         FinallyContext finallyContext;
     };
 
-    class BytecodeGenerator {
+    class BytecodeGenerator : public WTF::FastAllocBase {
     public:
         typedef DeclarationStacks::VarStack VarStack;
         typedef DeclarationStacks::FunctionStack FunctionStack;
@@ -81,6 +82,9 @@ namespace JSC {
         // such register exists. Registers returned by registerFor do not
         // require explicit reference counting.
         RegisterID* registerFor(const Identifier&);
+        
+        bool willResolveToArguments(const Identifier&);
+        RegisterID* uncheckedRegisterForArguments();
 
         // Behaves as registerFor does, but ignores dynamic scope as
         // dynamic scope should not interfere with const initialisation
@@ -240,9 +244,10 @@ namespace JSC {
         RegisterID* emitLoad(RegisterID* dst, bool);
         RegisterID* emitLoad(RegisterID* dst, double);
         RegisterID* emitLoad(RegisterID* dst, const Identifier&);
-        RegisterID* emitLoad(RegisterID* dst, JSValuePtr);
+        RegisterID* emitLoad(RegisterID* dst, JSValue);
         RegisterID* emitUnexpectedLoad(RegisterID* dst, bool);
         RegisterID* emitUnexpectedLoad(RegisterID* dst, double);
+        RegisterID* emitLoadGlobalObject(RegisterID* dst, JSObject* globalObject);
 
         RegisterID* emitUnaryOp(OpcodeID, RegisterID* dst, RegisterID* src);
         RegisterID* emitBinaryOp(OpcodeID, RegisterID* dst, RegisterID* src1, RegisterID* src2, OperandTypes);
@@ -269,13 +274,15 @@ namespace JSC {
         RegisterID* emitIn(RegisterID* dst, RegisterID* property, RegisterID* base) { return emitBinaryOp(op_in, dst, property, base, OperandTypes()); }
 
         RegisterID* emitResolve(RegisterID* dst, const Identifier& property);
-        RegisterID* emitGetScopedVar(RegisterID* dst, size_t skip, int index, JSValuePtr globalObject);
-        RegisterID* emitPutScopedVar(size_t skip, int index, RegisterID* value, JSValuePtr globalObject);
+        RegisterID* emitGetScopedVar(RegisterID* dst, size_t skip, int index, JSValue globalObject);
+        RegisterID* emitPutScopedVar(size_t skip, int index, RegisterID* value, JSValue globalObject);
 
         RegisterID* emitResolveBase(RegisterID* dst, const Identifier& property);
         RegisterID* emitResolveWithBase(RegisterID* baseDst, RegisterID* propDst, const Identifier& property);
         RegisterID* emitResolveFunction(RegisterID* baseDst, RegisterID* funcDst, const Identifier& property);
 
+        void emitMethodCheck();
+
         RegisterID* emitGetById(RegisterID* dst, RegisterID* base, const Identifier& property);
         RegisterID* emitPutById(RegisterID* base, const Identifier& property, RegisterID* value);
         RegisterID* emitDeleteById(RegisterID* dst, RegisterID* base, const Identifier&);
@@ -288,16 +295,22 @@ namespace JSC {
 
         RegisterID* emitCall(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
         RegisterID* emitCallEval(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
+        RegisterID* emitCallVarargs(RegisterID* dst, RegisterID* func, RegisterID* thisRegister, RegisterID* argCount, unsigned divot, unsigned startOffset, unsigned endOffset);
+        RegisterID* emitLoadVarargs(RegisterID* argCountDst, RegisterID* args);
 
         RegisterID* emitReturn(RegisterID* src);
         RegisterID* emitEnd(RegisterID* src) { return emitUnaryNoDstOp(op_end, src); }
 
         RegisterID* emitConstruct(RegisterID* dst, RegisterID* func, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
+        RegisterID* emitStrcat(RegisterID* dst, RegisterID* src, int count);
+        void emitToPrimitive(RegisterID* dst, RegisterID* src);
 
         PassRefPtr<Label> emitLabel(Label*);
         PassRefPtr<Label> emitJump(Label* target);
         PassRefPtr<Label> emitJumpIfTrue(RegisterID* cond, Label* target);
         PassRefPtr<Label> emitJumpIfFalse(RegisterID* cond, Label* target);
+        PassRefPtr<Label> emitJumpIfNotFunctionCall(RegisterID* cond, Label* target);
+        PassRefPtr<Label> emitJumpIfNotFunctionApply(RegisterID* cond, Label* target);
         PassRefPtr<Label> emitJumpScopes(Label* target, int targetScopeDepth);
 
         PassRefPtr<Label> emitJumpSubroutine(RegisterID* retAddrDst, Label*);
@@ -308,7 +321,7 @@ namespace JSC {
 
         RegisterID* emitCatch(RegisterID*, Label* start, Label* end);
         void emitThrow(RegisterID* exc) { emitUnaryNoDstOp(op_throw, exc); }
-        RegisterID* emitNewError(RegisterID* dst, ErrorType type, JSValuePtr message);
+        RegisterID* emitNewError(RegisterID* dst, ErrorType type, JSValue message);
         void emitPushNewScope(RegisterID* dst, Identifier& property, RegisterID* value);
 
         RegisterID* emitPushScope(RegisterID* scope);
@@ -317,6 +330,7 @@ namespace JSC {
         void emitDebugHook(DebugHookID, int firstLine, int lastLine);
 
         int scopeDepth() { return m_dynamicScopeDepth + m_finallyDepth; }
+        bool hasFinaliser() { return m_finallyDepth != 0; }
 
         void pushFinallyContext(Label* target, RegisterID* returnAddrDst);
         void popFinallyContext();
@@ -329,7 +343,11 @@ namespace JSC {
 
         CodeType codeType() const { return m_codeType; }
 
-        void setRegeneratingForExceptionInfo() { m_regeneratingForExceptionInfo = true; }
+        void setRegeneratingForExceptionInfo(CodeBlock* originalCodeBlock)
+        {
+            m_regeneratingForExceptionInfo = true;
+            m_codeBlockBeingRegeneratedFrom = originalCodeBlock;
+        }
 
     private:
         void emitOpcode(OpcodeID);
@@ -340,12 +358,7 @@ namespace JSC {
 
         PassRefPtr<Label> emitComplexJumpScopes(Label* target, ControlFlowContext* topScope, ControlFlowContext* bottomScope);
 
-        struct JSValueHashTraits : HashTraits<JSValueEncodedAsPointer*> {
-            static void constructDeletedValue(JSValueEncodedAsPointer*& slot) { slot = JSValuePtr::encode(JSImmediate::impossibleValue()); }
-            static bool isDeletedValue(JSValueEncodedAsPointer* value) { return value == JSValuePtr::encode(JSImmediate::impossibleValue()); }
-        };
-
-        typedef HashMap<JSValueEncodedAsPointer*, unsigned, PtrHash<JSValueEncodedAsPointer*>, JSValueHashTraits> JSValueMap;
+        typedef HashMap<EncodedJSValue, unsigned, PtrHash<EncodedJSValue>, JSValueHashTraits> JSValueMap;
 
         struct IdentifierMapIndexHashTraits {
             typedef int TraitType;
@@ -357,9 +370,9 @@ namespace JSC {
         };
 
         typedef HashMap<RefPtr<UString::Rep>, int, IdentifierRepHash, HashTraits<RefPtr<UString::Rep> >, IdentifierMapIndexHashTraits> IdentifierMap;
-        typedef HashMap<double, JSValuePtr> NumberMap;
+        typedef HashMap<double, JSValue> NumberMap;
         typedef HashMap<UString::Rep*, JSString*, IdentifierRepHash> IdentifierStringMap;
-
+        
         RegisterID* emitCall(OpcodeID, RegisterID* dst, RegisterID* func, RegisterID* thisRegister, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
         
         RegisterID* newRegister();
@@ -407,8 +420,8 @@ namespace JSC {
         unsigned addConstant(FuncDeclNode*);
         unsigned addConstant(FuncExprNode*);
         unsigned addConstant(const Identifier&);
-        RegisterID* addConstant(JSValuePtr);
-        unsigned addUnexpectedConstant(JSValuePtr);
+        RegisterID* addConstant(JSValue);
+        unsigned addUnexpectedConstant(JSValue);
         unsigned addRegExp(RegExp*);
 
         Vector<Instruction>& instructions() { return m_codeBlock->instructions(); }
@@ -419,27 +432,29 @@ namespace JSC {
 
         RegisterID* emitThrowExpressionTooDeepException();
 
+        void createArgumentsIfNecessary();
+
         bool m_shouldEmitDebugHooks;
         bool m_shouldEmitProfileHooks;
 
-        bool m_regeneratingForExceptionInfo;
-
         const ScopeChain* m_scopeChain;
         SymbolTable* m_symbolTable;
 
         ScopeNode* m_scopeNode;
         CodeBlock* m_codeBlock;
 
+        // Some of these objects keep pointers to one another. They are arranged
+        // to ensure a sane destruction order that avoids references to freed memory.
         HashSet<RefPtr<UString::Rep>, IdentifierRepHash> m_functions;
         RegisterID m_ignoredResultRegister;
         RegisterID m_thisRegister;
         RegisterID m_argumentsRegister;
         int m_activationRegisterIndex;
-        SegmentedVector<RegisterID, 512> m_calleeRegisters;
-        SegmentedVector<RegisterID, 512> m_parameters;
-        SegmentedVector<RegisterID, 512> m_globals;
-        SegmentedVector<LabelScope, 256> m_labelScopes;
-        SegmentedVector<Label, 256> m_labels;
+        WTF::SegmentedVector<RegisterID, 32> m_calleeRegisters;
+        WTF::SegmentedVector<RegisterID, 32> m_parameters;
+        WTF::SegmentedVector<RegisterID, 32> m_globals;
+        WTF::SegmentedVector<Label, 32> m_labels;
+        WTF::SegmentedVector<LabelScope, 8> m_labelScopes;
         RefPtr<RegisterID> m_lastConstant;
         int m_finallyDepth;
         int m_dynamicScopeDepth;
@@ -452,6 +467,7 @@ namespace JSC {
         int m_nextGlobalIndex;
         int m_nextParameterIndex;
         int m_nextConstantIndex;
+        unsigned m_globalConstantIndex;
 
         int m_globalVarStorageOffset;
 
@@ -465,13 +481,12 @@ namespace JSC {
 
         OpcodeID m_lastOpcodeID;
 
-#ifndef NDEBUG
-        static bool s_dumpsGeneratedCode;
-#endif
-
         unsigned m_emitNodeDepth;
 
-        static const unsigned s_maxEmitNodeDepth = 10000;
+        bool m_regeneratingForExceptionInfo;
+        CodeBlock* m_codeBlockBeingRegeneratedFrom;
+
+        static const unsigned s_maxEmitNodeDepth = 5000;
     };
 
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/config.h b/src/3rdparty/webkit/JavaScriptCore/config.h
index a85178c..6681761 100644
--- a/src/3rdparty/webkit/JavaScriptCore/config.h
+++ b/src/3rdparty/webkit/JavaScriptCore/config.h
@@ -25,6 +25,16 @@
 
 #include <wtf/Platform.h>
 
+#if PLATFORM(WIN_OS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
+#if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
+#define JS_EXPORTDATA __declspec(dllexport)
+#else
+#define JS_EXPORTDATA __declspec(dllimport)
+#endif
+#else
+#define JS_EXPORTDATA
+#endif
+
 #if PLATFORM(WIN_OS)
 
 // If we don't define these, they get defined in windef.h. 
@@ -32,7 +42,7 @@
 #define max max
 #define min min
 
-#if !COMPILER(MSVC7) && !PLATFORM(WIN_CE)
+#if !COMPILER(MSVC7) && !PLATFORM(WINCE)
 // We need to define this before the first #include of stdlib.h or it won't contain rand_s.
 #ifndef _CRT_RAND_S
 #define _CRT_RAND_S
diff --git a/src/3rdparty/webkit/JavaScriptCore/create_hash_table b/src/3rdparty/webkit/JavaScriptCore/create_hash_table
index 3bd9f76..25d0b02 100755
--- a/src/3rdparty/webkit/JavaScriptCore/create_hash_table
+++ b/src/3rdparty/webkit/JavaScriptCore/create_hash_table
@@ -269,10 +269,6 @@ sub output() {
     print "   { 0, 0, 0, 0 }\n";
     print "};\n\n";
     print "extern const struct HashTable $name =\n";
-    print "#if ENABLE(PERFECT_HASH_SIZE)\n";
-    print "    \{ ", $pefectHashSize - 1, ", $nameEntries, 0 \};\n";
-    print "#else\n";
     print "    \{ $compactSize, $compactHashSizeMask, $nameEntries, 0 \};\n";
-    print "#endif\n\n";
     print "} // namespace\n";
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp
index a52a542..7d791e7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.cpp
@@ -23,6 +23,8 @@
 #include "Debugger.h"
 
 #include "JSGlobalObject.h"
+#include "Interpreter.h"
+#include "Parser.h"
 
 namespace JSC {
 
@@ -51,4 +53,18 @@ void Debugger::detach(JSGlobalObject* globalObject)
     globalObject->setDebugger(0);
 }
 
+JSValue evaluateInGlobalCallFrame(const UString& script, JSValue& exception, JSGlobalObject* globalObject)
+{
+    CallFrame* globalCallFrame = globalObject->globalExec();
+
+    int errLine;
+    UString errMsg;
+    SourceCode source = makeSource(script);
+    RefPtr<EvalNode> evalNode = globalObject->globalData()->parser->parse<EvalNode>(globalCallFrame, globalObject->debugger(), source, &errLine, &errMsg);
+    if (!evalNode)
+        return Error::create(globalCallFrame, SyntaxError, errMsg, errLine, source.provider()->asID(), source.provider()->url());
+
+    return globalObject->globalData()->interpreter->execute(evalNode.get(), globalCallFrame, globalObject, globalCallFrame->scopeChain(), &exception);
+}
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h
index 6af116f..868ea71 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/Debugger.h
@@ -54,6 +54,10 @@ namespace JSC {
         HashSet<JSGlobalObject*> m_globalObjects;
     };
 
+    // This method exists only for backwards compatibility with existing
+    // WebScriptDebugger clients
+    JSValue evaluateInGlobalCallFrame(const UString&, JSValue& exception, JSGlobalObject*);
+
 } // namespace JSC
 
 #endif // Debugger_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp
new file mode 100644
index 0000000..4b2568f
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.cpp
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DebuggerActivation.h"
+
+#include "JSActivation.h"
+
+namespace JSC {
+
+DebuggerActivation::DebuggerActivation(JSObject* activation)
+    : JSObject(DebuggerActivation::createStructure(jsNull()))
+{
+    ASSERT(activation);
+    ASSERT(activation->isActivationObject());
+    m_activation = static_cast<JSActivation*>(activation);
+}
+
+void DebuggerActivation::mark()
+{
+    JSObject::mark();
+    if (m_activation && !m_activation->marked())
+        m_activation->mark();
+}
+
+UString DebuggerActivation::className() const
+{
+    return m_activation->className();
+}
+
+bool DebuggerActivation::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return m_activation->getOwnPropertySlot(exec, propertyName, slot);
+}
+
+void DebuggerActivation::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    m_activation->put(exec, propertyName, value, slot);
+}
+
+void DebuggerActivation::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValue value, unsigned attributes)
+{
+    m_activation->putWithAttributes(exec, propertyName, value, attributes);
+}
+
+bool DebuggerActivation::deleteProperty(ExecState* exec, const Identifier& propertyName)
+{
+    return m_activation->deleteProperty(exec, propertyName);
+}
+
+void DebuggerActivation::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    m_activation->getPropertyNames(exec, propertyNames);
+}
+
+bool DebuggerActivation::getPropertyAttributes(JSC::ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
+{
+    return m_activation->getPropertyAttributes(exec, propertyName, attributes);
+}
+
+void DebuggerActivation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+{
+    m_activation->defineGetter(exec, propertyName, getterFunction);
+}
+
+void DebuggerActivation::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction)
+{
+    m_activation->defineSetter(exec, propertyName, setterFunction);
+}
+
+JSValue DebuggerActivation::lookupGetter(ExecState* exec, const Identifier& propertyName)
+{
+    return m_activation->lookupGetter(exec, propertyName);
+}
+
+JSValue DebuggerActivation::lookupSetter(ExecState* exec, const Identifier& propertyName)
+{
+    return m_activation->lookupSetter(exec, propertyName);
+}
+
+} // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
new file mode 100644
index 0000000..9e1f9f5
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerActivation.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DebuggerActivation_h
+#define DebuggerActivation_h
+
+#include "JSObject.h"
+
+namespace JSC {
+
+    class JSActivation;
+
+    class DebuggerActivation : public JSObject {
+    public:
+        DebuggerActivation(JSObject*);
+
+        virtual void mark();
+        virtual UString className() const;
+        virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
+        virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValue, unsigned attributes);
+        virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
+        virtual void getPropertyNames(ExecState*, PropertyNameArray&);
+        virtual bool getPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned& attributes) const;
+        virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunction);
+        virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunction);
+        virtual JSValue lookupGetter(ExecState*, const Identifier& propertyName);
+        virtual JSValue lookupSetter(ExecState*, const Identifier& propertyName);
+
+        static PassRefPtr<Structure> createStructure(JSValue prototype) 
+        {
+            return Structure::create(prototype, TypeInfo(ObjectType)); 
+        }
+
+    private:
+        JSActivation* m_activation;
+    };
+
+} // namespace JSC
+
+#endif // DebuggerActivation_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp
index 27b824c..cd8702b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.cpp
@@ -46,6 +46,17 @@ const UString* DebuggerCallFrame::functionName() const
         return 0;
     return &function->name(&m_callFrame->globalData());
 }
+    
+UString DebuggerCallFrame::calculatedFunctionName() const
+{
+    if (!m_callFrame->codeBlock())
+        return 0;
+    
+    JSFunction* function = static_cast<JSFunction*>(m_callFrame->callee());
+    if (!function)
+        return 0;
+    return function->calculatedDisplayName(&m_callFrame->globalData());
+}
 
 DebuggerCallFrame::Type DebuggerCallFrame::type() const
 {
@@ -63,10 +74,10 @@ JSObject* DebuggerCallFrame::thisObject() const
     return asObject(m_callFrame->thisValue());
 }
 
-JSValuePtr DebuggerCallFrame::evaluate(const UString& script, JSValuePtr& exception) const
+JSValue DebuggerCallFrame::evaluate(const UString& script, JSValue& exception) const
 {
     if (!m_callFrame->codeBlock())
-        return noValue();
+        return JSValue();
 
     int errLine;
     UString errMsg;
diff --git a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.h b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.h
index cdf4965..9d377ef 100644
--- a/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.h
+++ b/src/3rdparty/webkit/JavaScriptCore/debugger/DebuggerCallFrame.h
@@ -39,11 +39,10 @@ namespace JSC {
 
         DebuggerCallFrame(CallFrame* callFrame)
             : m_callFrame(callFrame)
-            , m_exception(noValue())
         {
         }
 
-        DebuggerCallFrame(CallFrame* callFrame, JSValuePtr exception)
+        DebuggerCallFrame(CallFrame* callFrame, JSValue exception)
             : m_callFrame(callFrame)
             , m_exception(exception)
         {
@@ -52,14 +51,15 @@ namespace JSC {
         JSGlobalObject* dynamicGlobalObject() const { return m_callFrame->dynamicGlobalObject(); }
         const ScopeChainNode* scopeChain() const { return m_callFrame->scopeChain(); }
         const UString* functionName() const;
+        UString calculatedFunctionName() const;
         Type type() const;
         JSObject* thisObject() const;
-        JSValuePtr evaluate(const UString&, JSValuePtr& exception) const;
-        JSValuePtr exception() const { return m_exception; }
+        JSValue evaluate(const UString&, JSValue& exception) const;
+        JSValue exception() const { return m_exception; }
 
     private:
         CallFrame* m_callFrame;
-        JSValuePtr m_exception;
+        JSValue m_exception;
     };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/docs/make-bytecode-docs.pl b/src/3rdparty/webkit/JavaScriptCore/docs/make-bytecode-docs.pl
index 0be22eb..9494d1b 100755
--- a/src/3rdparty/webkit/JavaScriptCore/docs/make-bytecode-docs.pl
+++ b/src/3rdparty/webkit/JavaScriptCore/docs/make-bytecode-docs.pl
@@ -10,9 +10,9 @@ my @undocumented = ();
 print OUTPUT "<style>p code \{ font-size: 14px; \}</style>\n";
 
 while (<MACHINE>) {
-    if (/^ *BEGIN_OPCODE/) {
+    if (/^ *DEFINE_OPCODE/) {
         chomp;
-        s/^ *BEGIN_OPCODE\(op_//;
+        s/^ *DEFINE_OPCODE\(op_//;
         s/\).*$//;
         my $opcode = $_;
         $_ = <MACHINE>;
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/ArrayPrototype.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/ArrayPrototype.lut.h
index 59dd35f..2a7c98f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/ArrayPrototype.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/ArrayPrototype.lut.h
@@ -4,7 +4,7 @@
 
 namespace JSC {
 
-static const struct HashTableValue arrayTableValues[20] = {
+static const struct HashTableValue arrayTableValues[22] = {
    { "toString", DontEnum|Function, (intptr_t)arrayProtoFuncToString, (intptr_t)0 },
    { "toLocaleString", DontEnum|Function, (intptr_t)arrayProtoFuncToLocaleString, (intptr_t)0 },
    { "concat", DontEnum|Function, (intptr_t)arrayProtoFuncConcat, (intptr_t)1 },
@@ -23,15 +23,12 @@ static const struct HashTableValue arrayTableValues[20] = {
    { "indexOf", DontEnum|Function, (intptr_t)arrayProtoFuncIndexOf, (intptr_t)1 },
    { "lastIndexOf", DontEnum|Function, (intptr_t)arrayProtoFuncLastIndexOf, (intptr_t)1 },
    { "filter", DontEnum|Function, (intptr_t)arrayProtoFuncFilter, (intptr_t)1 },
+   { "reduce", DontEnum|Function, (intptr_t)arrayProtoFuncReduce, (intptr_t)1 },
+   { "reduceRight", DontEnum|Function, (intptr_t)arrayProtoFuncReduceRight, (intptr_t)1 },
    { "map", DontEnum|Function, (intptr_t)arrayProtoFuncMap, (intptr_t)1 },
    { 0, 0, 0, 0 }
 };
 
 extern const struct HashTable arrayTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 127, arrayTableValues, 0 };
-#else
     { 65, 63, arrayTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/DatePrototype.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/DatePrototype.lut.h
index d70845a..1f43d4d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/DatePrototype.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/DatePrototype.lut.h
@@ -4,15 +4,16 @@
 
 namespace JSC {
 
-static const struct HashTableValue dateTableValues[45] = {
+static const struct HashTableValue dateTableValues[47] = {
    { "toString", DontEnum|Function, (intptr_t)dateProtoFuncToString, (intptr_t)0 },
+   { "toISOString", DontEnum|Function, (intptr_t)dateProtoFuncToISOString, (intptr_t)0 },
    { "toUTCString", DontEnum|Function, (intptr_t)dateProtoFuncToUTCString, (intptr_t)0 },
    { "toDateString", DontEnum|Function, (intptr_t)dateProtoFuncToDateString, (intptr_t)0 },
    { "toTimeString", DontEnum|Function, (intptr_t)dateProtoFuncToTimeString, (intptr_t)0 },
    { "toLocaleString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleString, (intptr_t)0 },
    { "toLocaleDateString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleDateString, (intptr_t)0 },
    { "toLocaleTimeString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleTimeString, (intptr_t)0 },
-   { "valueOf", DontEnum|Function, (intptr_t)dateProtoFuncValueOf, (intptr_t)0 },
+   { "valueOf", DontEnum|Function, (intptr_t)dateProtoFuncGetTime, (intptr_t)0 },
    { "getTime", DontEnum|Function, (intptr_t)dateProtoFuncGetTime, (intptr_t)0 },
    { "getFullYear", DontEnum|Function, (intptr_t)dateProtoFuncGetFullYear, (intptr_t)0 },
    { "getUTCFullYear", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCFullYear, (intptr_t)0 },
@@ -49,14 +50,10 @@ static const struct HashTableValue dateTableValues[45] = {
    { "setUTCFullYear", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCFullYear, (intptr_t)3 },
    { "setYear", DontEnum|Function, (intptr_t)dateProtoFuncSetYear, (intptr_t)1 },
    { "getYear", DontEnum|Function, (intptr_t)dateProtoFuncGetYear, (intptr_t)0 },
+   { "toJSON", DontEnum|Function, (intptr_t)dateProtoFuncToJSON, (intptr_t)0 },
    { 0, 0, 0, 0 }
 };
 
 extern const struct HashTable dateTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 2047, dateTableValues, 0 };
-#else
     { 134, 127, dateTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
index 1652b24..8e80eca 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.cpp
@@ -238,7 +238,7 @@
 #include <stdlib.h>
 #include "JSValue.h"
 #include "JSObject.h"
-#include "Nodes.h"
+#include "NodeConstructors.h"
 #include "Lexer.h"
 #include "JSString.h"
 #include "JSGlobalData.h"
@@ -289,7 +289,7 @@ static ExpressionNode* makeSubNode(void*, ExpressionNode*, ExpressionNode*, bool
 static ExpressionNode* makeLeftShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
 static ExpressionNode* makeRightShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
 static StatementNode* makeVarStatementNode(void*, ExpressionNode*);
-static ExpressionNode* combineVarInitializers(void*, ExpressionNode* list, AssignResolveNode* init);
+static ExpressionNode* combineCommaNodes(void*, ExpressionNode* list, ExpressionNode* init);
 
 #if COMPILER(MSVC)
 
@@ -308,24 +308,24 @@ static ExpressionNode* combineVarInitializers(void*, ExpressionNode* list, Assig
 #define YYPARSE_PARAM globalPtr
 #define YYLEX_PARAM globalPtr
 
-template <typename T> NodeDeclarationInfo<T> createNodeDeclarationInfo(T node, ParserRefCountedData<DeclarationStacks::VarStack>* varDecls, 
-                                                                       ParserRefCountedData<DeclarationStacks::FunctionStack>* funcDecls,
+template <typename T> NodeDeclarationInfo<T> createNodeDeclarationInfo(T node, ParserArenaData<DeclarationStacks::VarStack>* varDecls, 
+                                                                       ParserArenaData<DeclarationStacks::FunctionStack>* funcDecls,
                                                                        CodeFeatures info,
                                                                        int numConstants) 
 {
     ASSERT((info & ~AllFeatures) == 0);
-    NodeDeclarationInfo<T> result = {node, varDecls, funcDecls, info, numConstants};
+    NodeDeclarationInfo<T> result = { node, varDecls, funcDecls, info, numConstants };
     return result;
 }
 
 template <typename T> NodeInfo<T> createNodeInfo(T node, CodeFeatures info, int numConstants)
 {
     ASSERT((info & ~AllFeatures) == 0);
-    NodeInfo<T> result = {node, info, numConstants};
+    NodeInfo<T> result = { node, info, numConstants };
     return result;
 }
 
-template <typename T> T mergeDeclarationLists(T decls1, T decls2) 
+template <typename T> inline T mergeDeclarationLists(T decls1, T decls2) 
 {
     // decls1 or both are null
     if (!decls1)
@@ -337,28 +337,28 @@ template <typename T> T mergeDeclarationLists(T decls1, T decls2)
     // Both are non-null
     decls1->data.append(decls2->data);
     
-    // We manually release the declaration lists to avoid accumulating many many
-    // unused heap allocated vectors
-    decls2->ref();
-    decls2->deref();
+    // Manually release as much as possible from the now-defunct declaration lists
+    // to avoid accumulating so many unused heap allocated vectors.
+    decls2->data.clear();
+
     return decls1;
 }
 
-static void appendToVarDeclarationList(void* globalPtr, ParserRefCountedData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
+static void appendToVarDeclarationList(void* globalPtr, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
 {
     if (!varDecls)
-        varDecls = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+        varDecls = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
 
     varDecls->data.append(make_pair(ident, attrs));
 
 }
 
-static inline void appendToVarDeclarationList(void* globalPtr, ParserRefCountedData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
+static inline void appendToVarDeclarationList(void* globalPtr, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
 {
     unsigned attrs = DeclarationStacks::IsConstant;
-    if (decl->m_init)
+    if (decl->hasInitializer())
         attrs |= DeclarationStacks::HasInitializer;        
-    appendToVarDeclarationList(globalPtr, varDecls, decl->m_ident, attrs);
+    appendToVarDeclarationList(globalPtr, varDecls, decl->ident(), attrs);
 }
 
 
@@ -416,7 +416,7 @@ typedef union YYSTYPE
     Operator            op;
 }
 /* Line 187 of yacc.c.  */
-#line 420 "Grammar.tab.c"
+#line 420 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
 	YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
@@ -441,7 +441,7 @@ typedef struct YYLTYPE
 
 
 /* Line 216 of yacc.c.  */
-#line 445 "Grammar.tab.c"
+#line 445 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
 
 #ifdef short
 # undef short
@@ -1019,42 +1019,42 @@ static const yytype_uint16 yyrline[] =
      804,   805,   806,   807,   808,   809,   810,   811,   815,   817,
      822,   824,   830,   837,   846,   854,   867,   874,   883,   891,
      904,   906,   912,   920,   932,   933,   937,   941,   945,   949,
-     951,   956,   959,   968,   970,   972,   974,   980,   987,   996,
-    1002,  1013,  1014,  1018,  1019,  1023,  1027,  1031,  1035,  1042,
-    1045,  1048,  1051,  1057,  1060,  1063,  1066,  1072,  1078,  1084,
-    1085,  1094,  1095,  1099,  1105,  1115,  1116,  1120,  1121,  1125,
-    1131,  1135,  1142,  1148,  1154,  1164,  1166,  1171,  1172,  1183,
-    1184,  1191,  1192,  1202,  1205,  1211,  1212,  1216,  1217,  1222,
-    1229,  1240,  1241,  1242,  1243,  1244,  1245,  1246,  1250,  1251,
-    1252,  1253,  1254,  1258,  1259,  1263,  1264,  1265,  1267,  1271,
-    1272,  1273,  1274,  1275,  1279,  1280,  1281,  1285,  1286,  1289,
-    1291,  1295,  1296,  1300,  1301,  1302,  1303,  1304,  1308,  1309,
-    1310,  1311,  1315,  1316,  1320,  1321,  1325,  1326,  1327,  1328,
-    1332,  1333,  1334,  1335,  1339,  1340,  1344,  1345,  1349,  1350,
-    1354,  1355,  1359,  1360,  1361,  1365,  1366,  1367,  1371,  1372,
-    1373,  1374,  1375,  1376,  1377,  1378,  1379,  1380,  1381,  1384,
-    1385,  1389,  1390,  1394,  1395,  1396,  1397,  1401,  1402,  1403,
-    1404,  1408,  1409,  1410,  1414,  1415,  1416,  1420,  1421,  1422,
-    1423,  1427,  1428,  1429,  1430,  1434,  1435,  1436,  1437,  1438,
-    1439,  1440,  1444,  1445,  1446,  1447,  1448,  1449,  1453,  1454,
-    1455,  1456,  1457,  1458,  1459,  1463,  1464,  1465,  1466,  1467,
-    1471,  1472,  1473,  1474,  1475,  1479,  1480,  1481,  1482,  1483,
-    1487,  1488,  1492,  1493,  1497,  1498,  1502,  1503,  1507,  1508,
-    1512,  1513,  1517,  1518,  1522,  1523,  1527,  1528,  1532,  1533,
-    1537,  1538,  1542,  1543,  1547,  1548,  1552,  1553,  1557,  1558,
-    1562,  1563,  1567,  1568,  1572,  1573,  1577,  1578,  1582,  1583,
-    1587,  1588,  1592,  1593,  1594,  1595,  1596,  1597,  1598,  1599,
-    1600,  1601,  1602,  1603,  1607,  1608,  1612,  1613,  1617,  1618,
-    1622,  1623,  1624,  1625,  1626,  1627,  1628,  1629,  1630,  1631,
-    1632,  1633,  1634,  1635,  1636,  1637,  1638,  1642,  1643,  1647,
-    1648,  1652,  1653,  1654,  1655,  1659,  1660,  1661,  1662,  1666,
-    1667,  1671,  1672,  1676,  1677,  1681,  1685,  1689,  1693,  1694,
-    1698,  1699,  1703,  1704,  1705,  1706,  1707,  1708,  1709,  1710,
-    1713,  1715,  1718,  1720,  1724,  1725,  1726,  1727,  1731,  1732,
-    1733,  1734,  1738,  1739,  1740,  1741,  1745,  1749,  1753,  1754,
-    1757,  1759,  1763,  1764,  1768,  1769,  1773,  1774,  1778,  1782,
-    1783,  1787,  1788,  1789,  1793,  1794,  1798,  1799,  1803,  1804,
-    1805,  1806,  1810,  1811,  1814,  1816,  1820,  1821
+     951,   956,   959,   969,   971,   973,   975,   981,   988,   997,
+    1003,  1014,  1015,  1019,  1020,  1024,  1028,  1032,  1036,  1043,
+    1046,  1049,  1052,  1058,  1061,  1064,  1067,  1073,  1079,  1085,
+    1086,  1095,  1096,  1100,  1106,  1116,  1117,  1121,  1122,  1126,
+    1132,  1136,  1143,  1149,  1155,  1165,  1167,  1172,  1173,  1184,
+    1185,  1192,  1193,  1203,  1206,  1212,  1213,  1217,  1218,  1223,
+    1230,  1241,  1242,  1243,  1244,  1245,  1246,  1247,  1251,  1252,
+    1253,  1254,  1255,  1259,  1260,  1264,  1265,  1266,  1268,  1272,
+    1273,  1274,  1275,  1276,  1280,  1281,  1282,  1286,  1287,  1290,
+    1292,  1296,  1297,  1301,  1302,  1303,  1304,  1305,  1309,  1310,
+    1311,  1312,  1316,  1317,  1321,  1322,  1326,  1327,  1328,  1329,
+    1333,  1334,  1335,  1336,  1340,  1341,  1345,  1346,  1350,  1351,
+    1355,  1356,  1360,  1361,  1362,  1366,  1367,  1368,  1372,  1373,
+    1374,  1375,  1376,  1377,  1378,  1379,  1380,  1381,  1382,  1385,
+    1386,  1390,  1391,  1395,  1396,  1397,  1398,  1402,  1403,  1404,
+    1405,  1409,  1410,  1411,  1415,  1416,  1417,  1421,  1422,  1423,
+    1424,  1428,  1429,  1430,  1431,  1435,  1436,  1437,  1438,  1439,
+    1440,  1441,  1445,  1446,  1447,  1448,  1449,  1450,  1454,  1455,
+    1456,  1457,  1458,  1459,  1460,  1464,  1465,  1466,  1467,  1468,
+    1472,  1473,  1474,  1475,  1476,  1480,  1481,  1482,  1483,  1484,
+    1488,  1489,  1493,  1494,  1498,  1499,  1503,  1504,  1508,  1509,
+    1513,  1514,  1518,  1519,  1523,  1524,  1528,  1529,  1533,  1534,
+    1538,  1539,  1543,  1544,  1548,  1549,  1553,  1554,  1558,  1559,
+    1563,  1564,  1568,  1569,  1573,  1574,  1578,  1579,  1583,  1584,
+    1588,  1589,  1593,  1594,  1595,  1596,  1597,  1598,  1599,  1600,
+    1601,  1602,  1603,  1604,  1608,  1609,  1613,  1614,  1618,  1619,
+    1623,  1624,  1625,  1626,  1627,  1628,  1629,  1630,  1631,  1632,
+    1633,  1634,  1635,  1636,  1637,  1638,  1639,  1643,  1644,  1648,
+    1649,  1653,  1654,  1655,  1656,  1660,  1661,  1662,  1663,  1667,
+    1668,  1672,  1673,  1677,  1678,  1682,  1686,  1690,  1694,  1695,
+    1699,  1700,  1704,  1705,  1706,  1707,  1708,  1709,  1710,  1711,
+    1714,  1716,  1719,  1721,  1725,  1726,  1727,  1728,  1732,  1733,
+    1734,  1735,  1739,  1740,  1741,  1742,  1746,  1750,  1754,  1755,
+    1758,  1760,  1764,  1765,  1769,  1770,  1774,  1775,  1779,  1783,
+    1784,  1788,  1789,  1790,  1794,  1795,  1799,  1800,  1804,  1805,
+    1806,  1807,  1811,  1812,  1815,  1817,  1821,  1822
 };
 #endif
 
@@ -3009,17 +3009,17 @@ yyreduce:
     {
         case 2:
 #line 290 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NullNode(GLOBAL_DATA), 0, 1); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NullNode(GLOBAL_DATA), 0, 1); ;}
     break;
 
   case 3:
 #line 291 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BooleanNode(GLOBAL_DATA, true), 0, 1); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, true), 0, 1); ;}
     break;
 
   case 4:
 #line 292 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BooleanNode(GLOBAL_DATA, false), 0, 1); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, false), 0, 1); ;}
     break;
 
   case 5:
@@ -3029,7 +3029,7 @@ yyreduce:
 
   case 6:
 #line 294 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new StringNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident)), 0, 1); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StringNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident)), 0, 1); ;}
     break;
 
   case 7:
@@ -3038,7 +3038,7 @@ yyreduce:
                                             Lexer& l = *LEXER;
                                             if (!l.scanRegExp())
                                                 YYABORT;
-                                            RegExpNode* node = new RegExpNode(GLOBAL_DATA, l.pattern(), l.flags());
+                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, l.pattern(), l.flags());
                                             int size = l.pattern().size() + 2; // + 2 for the two /'s
                                             SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (1)]).first_column, (yylsp[(1) - (1)]).first_column + size, (yylsp[(1) - (1)]).first_column + size);
                                             (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, 0, 0);
@@ -3051,7 +3051,7 @@ yyreduce:
                                             Lexer& l = *LEXER;
                                             if (!l.scanRegExp())
                                                 YYABORT;
-                                            RegExpNode* node = new RegExpNode(GLOBAL_DATA, "=" + l.pattern(), l.flags());
+                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, "=" + l.pattern(), l.flags());
                                             int size = l.pattern().size() + 2; // + 2 for the two /'s
                                             SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (1)]).first_column, (yylsp[(1) - (1)]).first_column + size, (yylsp[(1) - (1)]).first_column + size);
                                             (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, 0, 0);
@@ -3060,17 +3060,17 @@ yyreduce:
 
   case 9:
 #line 316 "../parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 10:
 #line 317 "../parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 11:
 #line 318 "../parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new PropertyNode(GLOBAL_DATA, Identifier(GLOBAL_DATA, UString::from((yyvsp[(1) - (3)].doubleValue))), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, Identifier(GLOBAL_DATA, UString::from((yyvsp[(1) - (3)].doubleValue))), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 12:
@@ -3092,7 +3092,7 @@ yyreduce:
 
   case 14:
 #line 332 "../parser/Grammar.y"
-    { (yyval.propertyList).m_node.head = new PropertyListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].propertyNode).m_node); 
+    { (yyval.propertyList).m_node.head = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].propertyNode).m_node); 
                                           (yyval.propertyList).m_node.tail = (yyval.propertyList).m_node.head;
                                           (yyval.propertyList).m_features = (yyvsp[(1) - (1)].propertyNode).m_features;
                                           (yyval.propertyList).m_numConstants = (yyvsp[(1) - (1)].propertyNode).m_numConstants; ;}
@@ -3101,34 +3101,34 @@ yyreduce:
   case 15:
 #line 336 "../parser/Grammar.y"
     { (yyval.propertyList).m_node.head = (yyvsp[(1) - (3)].propertyList).m_node.head;
-                                          (yyval.propertyList).m_node.tail = new PropertyListNode(GLOBAL_DATA, (yyvsp[(3) - (3)].propertyNode).m_node, (yyvsp[(1) - (3)].propertyList).m_node.tail);
+                                          (yyval.propertyList).m_node.tail = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(3) - (3)].propertyNode).m_node, (yyvsp[(1) - (3)].propertyList).m_node.tail);
                                           (yyval.propertyList).m_features = (yyvsp[(1) - (3)].propertyList).m_features | (yyvsp[(3) - (3)].propertyNode).m_features;
                                           (yyval.propertyList).m_numConstants = (yyvsp[(1) - (3)].propertyList).m_numConstants + (yyvsp[(3) - (3)].propertyNode).m_numConstants; ;}
     break;
 
   case 17:
 #line 344 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ObjectLiteralNode(GLOBAL_DATA), 0, 0); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA), 0, 0); ;}
     break;
 
   case 18:
 #line 345 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (3)].propertyList).m_node.head), (yyvsp[(2) - (3)].propertyList).m_features, (yyvsp[(2) - (3)].propertyList).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (3)].propertyList).m_node.head), (yyvsp[(2) - (3)].propertyList).m_features, (yyvsp[(2) - (3)].propertyList).m_numConstants); ;}
     break;
 
   case 19:
 #line 347 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (4)].propertyList).m_node.head), (yyvsp[(2) - (4)].propertyList).m_features, (yyvsp[(2) - (4)].propertyList).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (4)].propertyList).m_node.head), (yyvsp[(2) - (4)].propertyList).m_features, (yyvsp[(2) - (4)].propertyList).m_numConstants); ;}
     break;
 
   case 20:
 #line 351 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ThisNode(GLOBAL_DATA), ThisFeature, 0); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ThisNode(GLOBAL_DATA), ThisFeature, 0); ;}
     break;
 
   case 23:
 #line 354 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), (yylsp[(1) - (1)]).first_column), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), (yylsp[(1) - (1)]).first_column), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
     break;
 
   case 24:
@@ -3138,22 +3138,22 @@ yyreduce:
 
   case 25:
 #line 359 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].intValue)), 0, (yyvsp[(2) - (3)].intValue) ? 1 : 0); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].intValue)), 0, (yyvsp[(2) - (3)].intValue) ? 1 : 0); ;}
     break;
 
   case 26:
 #line 360 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].elementList).m_node.head), (yyvsp[(2) - (3)].elementList).m_features, (yyvsp[(2) - (3)].elementList).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].elementList).m_node.head), (yyvsp[(2) - (3)].elementList).m_features, (yyvsp[(2) - (3)].elementList).m_numConstants); ;}
     break;
 
   case 27:
 #line 361 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ArrayNode(GLOBAL_DATA, (yyvsp[(4) - (5)].intValue), (yyvsp[(2) - (5)].elementList).m_node.head), (yyvsp[(2) - (5)].elementList).m_features, (yyvsp[(4) - (5)].intValue) ? (yyvsp[(2) - (5)].elementList).m_numConstants + 1 : (yyvsp[(2) - (5)].elementList).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(4) - (5)].intValue), (yyvsp[(2) - (5)].elementList).m_node.head), (yyvsp[(2) - (5)].elementList).m_features, (yyvsp[(4) - (5)].intValue) ? (yyvsp[(2) - (5)].elementList).m_numConstants + 1 : (yyvsp[(2) - (5)].elementList).m_numConstants); ;}
     break;
 
   case 28:
 #line 365 "../parser/Grammar.y"
-    { (yyval.elementList).m_node.head = new ElementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].intValue), (yyvsp[(2) - (2)].expressionNode).m_node);
+    { (yyval.elementList).m_node.head = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].intValue), (yyvsp[(2) - (2)].expressionNode).m_node);
                                           (yyval.elementList).m_node.tail = (yyval.elementList).m_node.head;
                                           (yyval.elementList).m_features = (yyvsp[(2) - (2)].expressionNode).m_features;
                                           (yyval.elementList).m_numConstants = (yyvsp[(2) - (2)].expressionNode).m_numConstants; ;}
@@ -3162,7 +3162,7 @@ yyreduce:
   case 29:
 #line 370 "../parser/Grammar.y"
     { (yyval.elementList).m_node.head = (yyvsp[(1) - (4)].elementList).m_node.head;
-                                          (yyval.elementList).m_node.tail = new ElementNode(GLOBAL_DATA, (yyvsp[(1) - (4)].elementList).m_node.tail, (yyvsp[(3) - (4)].intValue), (yyvsp[(4) - (4)].expressionNode).m_node);
+                                          (yyval.elementList).m_node.tail = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (4)].elementList).m_node.tail, (yyvsp[(3) - (4)].intValue), (yyvsp[(4) - (4)].expressionNode).m_node);
                                           (yyval.elementList).m_features = (yyvsp[(1) - (4)].elementList).m_features | (yyvsp[(4) - (4)].expressionNode).m_features;
                                           (yyval.elementList).m_numConstants = (yyvsp[(1) - (4)].elementList).m_numConstants + (yyvsp[(4) - (4)].expressionNode).m_numConstants; ;}
     break;
@@ -3189,7 +3189,7 @@ yyreduce:
 
   case 36:
 #line 389 "../parser/Grammar.y"
-    { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
+    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
@@ -3197,7 +3197,7 @@ yyreduce:
 
   case 37:
 #line 393 "../parser/Grammar.y"
-    { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
+    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants);
                                         ;}
@@ -3205,7 +3205,7 @@ yyreduce:
 
   case 38:
 #line 397 "../parser/Grammar.y"
-    { NewExprNode* node = new NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
+    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].argumentsNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].argumentsNode).m_numConstants);
                                         ;}
@@ -3213,7 +3213,7 @@ yyreduce:
 
   case 40:
 #line 405 "../parser/Grammar.y"
-    { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
+    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
@@ -3221,7 +3221,7 @@ yyreduce:
 
   case 41:
 #line 409 "../parser/Grammar.y"
-    { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
+    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants);
                                         ;}
@@ -3229,7 +3229,7 @@ yyreduce:
 
   case 42:
 #line 413 "../parser/Grammar.y"
-    { NewExprNode* node = new NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
+    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].argumentsNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].argumentsNode).m_numConstants);
                                         ;}
@@ -3237,7 +3237,7 @@ yyreduce:
 
   case 44:
 #line 421 "../parser/Grammar.y"
-    { NewExprNode* node = new NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
+    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); 
                                         ;}
@@ -3245,7 +3245,7 @@ yyreduce:
 
   case 46:
 #line 429 "../parser/Grammar.y"
-    { NewExprNode* node = new NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
+    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants);
                                         ;}
@@ -3263,7 +3263,7 @@ yyreduce:
 
   case 49:
 #line 438 "../parser/Grammar.y"
-    { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
+    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
@@ -3271,7 +3271,7 @@ yyreduce:
 
   case 50:
 #line 442 "../parser/Grammar.y"
-    { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
+    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants); ;}
     break;
@@ -3288,7 +3288,7 @@ yyreduce:
 
   case 53:
 #line 450 "../parser/Grammar.y"
-    { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
+    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
@@ -3296,7 +3296,7 @@ yyreduce:
 
   case 54:
 #line 454 "../parser/Grammar.y"
-    { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
+    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants); 
                                         ;}
@@ -3304,17 +3304,17 @@ yyreduce:
 
   case 55:
 #line 461 "../parser/Grammar.y"
-    { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new ArgumentsNode(GLOBAL_DATA), 0, 0); ;}
+    { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA), 0, 0); ;}
     break;
 
   case 56:
 #line 462 "../parser/Grammar.y"
-    { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new ArgumentsNode(GLOBAL_DATA, (yyvsp[(2) - (3)].argumentList).m_node.head), (yyvsp[(2) - (3)].argumentList).m_features, (yyvsp[(2) - (3)].argumentList).m_numConstants); ;}
+    { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA, (yyvsp[(2) - (3)].argumentList).m_node.head), (yyvsp[(2) - (3)].argumentList).m_features, (yyvsp[(2) - (3)].argumentList).m_numConstants); ;}
     break;
 
   case 57:
 #line 466 "../parser/Grammar.y"
-    { (yyval.argumentList).m_node.head = new ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].expressionNode).m_node);
+    { (yyval.argumentList).m_node.head = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].expressionNode).m_node);
                                           (yyval.argumentList).m_node.tail = (yyval.argumentList).m_node.head;
                                           (yyval.argumentList).m_features = (yyvsp[(1) - (1)].expressionNode).m_features;
                                           (yyval.argumentList).m_numConstants = (yyvsp[(1) - (1)].expressionNode).m_numConstants; ;}
@@ -3323,7 +3323,7 @@ yyreduce:
   case 58:
 #line 470 "../parser/Grammar.y"
     { (yyval.argumentList).m_node.head = (yyvsp[(1) - (3)].argumentList).m_node.head;
-                                          (yyval.argumentList).m_node.tail = new ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (3)].argumentList).m_node.tail, (yyvsp[(3) - (3)].expressionNode).m_node);
+                                          (yyval.argumentList).m_node.tail = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (3)].argumentList).m_node.tail, (yyvsp[(3) - (3)].expressionNode).m_node);
                                           (yyval.argumentList).m_features = (yyvsp[(1) - (3)].argumentList).m_features | (yyvsp[(3) - (3)].expressionNode).m_features;
                                           (yyval.argumentList).m_numConstants = (yyvsp[(1) - (3)].argumentList).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants; ;}
     break;
@@ -3355,7 +3355,7 @@ yyreduce:
 
   case 70:
 #line 500 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new VoidNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants + 1); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) VoidNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants + 1); ;}
     break;
 
   case 71:
@@ -3385,7 +3385,7 @@ yyreduce:
 
   case 76:
 #line 506 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new UnaryPlusNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 77:
@@ -3400,7 +3400,7 @@ yyreduce:
 
   case 79:
 #line 509 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 85:
@@ -3415,7 +3415,7 @@ yyreduce:
 
   case 87:
 #line 525 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 89:
@@ -3430,7 +3430,7 @@ yyreduce:
 
   case 91:
 #line 535 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 93:
@@ -3465,7 +3465,7 @@ yyreduce:
 
   case 101:
 #line 556 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 103:
@@ -3480,252 +3480,252 @@ yyreduce:
 
   case 105:
 #line 563 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 107:
 #line 568 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 108:
 #line 569 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 109:
 #line 570 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 110:
 #line 571 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 111:
 #line 572 "../parser/Grammar.y"
-    { InstanceOfNode* node = new InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
+    { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 112:
 #line 575 "../parser/Grammar.y"
-    { InNode* node = new InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
+    { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 114:
 #line 582 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 115:
 #line 583 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 116:
 #line 584 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 117:
 #line 585 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 118:
 #line 587 "../parser/Grammar.y"
-    { InstanceOfNode* node = new InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
+    { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 120:
 #line 594 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 121:
 #line 595 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 122:
 #line 596 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 123:
 #line 597 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 124:
 #line 599 "../parser/Grammar.y"
-    { InstanceOfNode* node = new InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
+    { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 125:
 #line 603 "../parser/Grammar.y"
-    { InNode* node = new InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
+    { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 127:
 #line 610 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 128:
 #line 611 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 129:
 #line 612 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 130:
 #line 613 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 132:
 #line 619 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 133:
 #line 621 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 134:
 #line 623 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 135:
 #line 625 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 137:
 #line 631 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 138:
 #line 632 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 139:
 #line 634 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 140:
 #line 636 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 142:
 #line 641 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 144:
 #line 647 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 146:
 #line 652 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 148:
 #line 657 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 150:
 #line 663 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 152:
 #line 669 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 154:
 #line 674 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 156:
 #line 680 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 158:
 #line 686 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 160:
 #line 691 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 162:
 #line 697 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 164:
 #line 703 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 166:
 #line 708 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 168:
 #line 714 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 170:
 #line 719 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 172:
 #line 725 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 174:
 #line 731 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 176:
 #line 737 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 178:
@@ -3811,28 +3811,28 @@ yyreduce:
 
   case 196:
 #line 781 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 198:
 #line 786 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 200:
 #line 791 "../parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 218:
 #line 815 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 219:
 #line 817 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new BlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].sourceElements).m_node), (yyvsp[(2) - (3)].sourceElements).m_varDeclarations, (yyvsp[(2) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (3)].sourceElements).m_features, (yyvsp[(2) - (3)].sourceElements).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].sourceElements).m_node), (yyvsp[(2) - (3)].sourceElements).m_varDeclarations, (yyvsp[(2) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (3)].sourceElements).m_features, (yyvsp[(2) - (3)].sourceElements).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
@@ -3852,7 +3852,7 @@ yyreduce:
   case 222:
 #line 830 "../parser/Grammar.y"
     { (yyval.varDeclList).m_node = 0;
-                                          (yyval.varDeclList).m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (1)].ident), 0);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
                                           (yyval.varDeclList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
@@ -3862,10 +3862,10 @@ yyreduce:
 
   case 223:
 #line 837 "../parser/Grammar.y"
-    { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
+    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
                                           (yyval.varDeclList).m_node = node;
-                                          (yyval.varDeclList).m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (2)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
                                           (yyval.varDeclList).m_features = ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features;
@@ -3886,9 +3886,9 @@ yyreduce:
 
   case 225:
 #line 855 "../parser/Grammar.y"
-    { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
+    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.varDeclList).m_node = combineVarInitializers(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
+                                          (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (4)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
@@ -3900,7 +3900,7 @@ yyreduce:
   case 226:
 #line 867 "../parser/Grammar.y"
     { (yyval.varDeclList).m_node = 0;
-                                          (yyval.varDeclList).m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (1)].ident), 0);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
                                           (yyval.varDeclList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
@@ -3910,10 +3910,10 @@ yyreduce:
 
   case 227:
 #line 874 "../parser/Grammar.y"
-    { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
+    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
                                           (yyval.varDeclList).m_node = node;
-                                          (yyval.varDeclList).m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (2)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
                                           (yyval.varDeclList).m_features = ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features;
@@ -3934,9 +3934,9 @@ yyreduce:
 
   case 229:
 #line 892 "../parser/Grammar.y"
-    { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
+    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.varDeclList).m_node = combineVarInitializers(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
+                                          (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (4)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
@@ -3947,13 +3947,13 @@ yyreduce:
 
   case 230:
 #line 904 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 231:
 #line 907 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
@@ -3961,7 +3961,7 @@ yyreduce:
 #line 912 "../parser/Grammar.y"
     { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (1)].constDeclNode).m_node;
                                           (yyval.constDeclList).m_node.tail = (yyval.constDeclList).m_node.head;
-                                          (yyval.constDeclList).m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          (yyval.constDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.constDeclList).m_varDeclarations, (yyvsp[(1) - (1)].constDeclNode).m_node);
                                           (yyval.constDeclList).m_funcDeclarations = 0; 
                                           (yyval.constDeclList).m_features = (yyvsp[(1) - (1)].constDeclNode).m_features;
@@ -3971,7 +3971,7 @@ yyreduce:
 
   case 233:
 #line 921 "../parser/Grammar.y"
-    {  (yyval.constDeclList).m_node.head = (yyvsp[(1) - (3)].constDeclList).m_node.head;
+    { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (3)].constDeclList).m_node.head;
                                           (yyvsp[(1) - (3)].constDeclList).m_node.tail->m_next = (yyvsp[(3) - (3)].constDeclNode).m_node;
                                           (yyval.constDeclList).m_node.tail = (yyvsp[(3) - (3)].constDeclNode).m_node;
                                           (yyval.constDeclList).m_varDeclarations = (yyvsp[(1) - (3)].constDeclList).m_varDeclarations;
@@ -3983,12 +3983,12 @@ yyreduce:
 
   case 234:
 #line 932 "../parser/Grammar.y"
-    { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), 0), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
+    { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), 0), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
     break;
 
   case 235:
 #line 933 "../parser/Grammar.y"
-    { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node), ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
+    { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node), ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 236:
@@ -4003,57 +4003,58 @@ yyreduce:
 
   case 238:
 #line 945 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new EmptyStatementNode(GLOBAL_DATA), 0, 0, 0, 0); ;}
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA), 0, 0, 0, 0); ;}
     break;
 
   case 239:
 #line 949 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 240:
 #line 951 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 241:
 #line 957 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new IfNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 242:
 #line 960 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new IfElseNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].statementNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node), 
-                                                                                         mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations), mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfElseNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].statementNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node), 
+                                                                                         mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
+                                                                                         mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(3) - (7)].expressionNode).m_features | (yyvsp[(5) - (7)].statementNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features,
                                                                                          (yyvsp[(3) - (7)].expressionNode).m_numConstants + (yyvsp[(5) - (7)].statementNode).m_numConstants + (yyvsp[(7) - (7)].statementNode).m_numConstants); 
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(4) - (7)])); ;}
     break;
 
   case 243:
-#line 968 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
+#line 969 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
                                              DBG((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
     break;
 
   case 244:
-#line 970 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
+#line 971 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
                                              DBG((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
     break;
 
   case 245:
-#line 972 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new WhileNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
+#line 973 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WhileNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 246:
-#line 975 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ForNode(GLOBAL_DATA, (yyvsp[(3) - (9)].expressionNode).m_node, (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, false), (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations, 
+#line 976 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(3) - (9)].expressionNode).m_node, (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, false), (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations, 
                                                                                          (yyvsp[(3) - (9)].expressionNode).m_features | (yyvsp[(5) - (9)].expressionNode).m_features | (yyvsp[(7) - (9)].expressionNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features,
                                                                                          (yyvsp[(3) - (9)].expressionNode).m_numConstants + (yyvsp[(5) - (9)].expressionNode).m_numConstants + (yyvsp[(7) - (9)].expressionNode).m_numConstants + (yyvsp[(9) - (9)].statementNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (9)]), (yylsp[(8) - (9)])); 
@@ -4061,8 +4062,8 @@ yyreduce:
     break;
 
   case 247:
-#line 981 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ForNode(GLOBAL_DATA, (yyvsp[(4) - (10)].varDeclList).m_node, (yyvsp[(6) - (10)].expressionNode).m_node, (yyvsp[(8) - (10)].expressionNode).m_node, (yyvsp[(10) - (10)].statementNode).m_node, true),
+#line 982 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(4) - (10)].varDeclList).m_node, (yyvsp[(6) - (10)].expressionNode).m_node, (yyvsp[(8) - (10)].expressionNode).m_node, (yyvsp[(10) - (10)].statementNode).m_node, true),
                                                                                          mergeDeclarationLists((yyvsp[(4) - (10)].varDeclList).m_varDeclarations, (yyvsp[(10) - (10)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(4) - (10)].varDeclList).m_funcDeclarations, (yyvsp[(10) - (10)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(4) - (10)].varDeclList).m_features | (yyvsp[(6) - (10)].expressionNode).m_features | (yyvsp[(8) - (10)].expressionNode).m_features | (yyvsp[(10) - (10)].statementNode).m_features,
@@ -4071,9 +4072,9 @@ yyreduce:
     break;
 
   case 248:
-#line 988 "../parser/Grammar.y"
+#line 989 "../parser/Grammar.y"
     {
-                                            ForInNode* node = new ForInNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node);
+                                            ForInNode* node = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node);
                                             SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (7)]).first_column, (yylsp[(3) - (7)]).last_column, (yylsp[(5) - (7)]).last_column);
                                             (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, (yyvsp[(7) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations,
                                                                                            (yyvsp[(3) - (7)].expressionNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features,
@@ -4083,8 +4084,8 @@ yyreduce:
     break;
 
   case 249:
-#line 997 "../parser/Grammar.y"
-    { ForInNode *forIn = new ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (8)].ident), 0, (yyvsp[(6) - (8)].expressionNode).m_node, (yyvsp[(8) - (8)].statementNode).m_node, (yylsp[(5) - (8)]).first_column, (yylsp[(5) - (8)]).first_column - (yylsp[(4) - (8)]).first_column, (yylsp[(6) - (8)]).last_column - (yylsp[(5) - (8)]).first_column);
+#line 998 "../parser/Grammar.y"
+    { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (8)].ident), 0, (yyvsp[(6) - (8)].expressionNode).m_node, (yyvsp[(8) - (8)].statementNode).m_node, (yylsp[(5) - (8)]).first_column, (yylsp[(5) - (8)]).first_column - (yylsp[(4) - (8)]).first_column, (yylsp[(6) - (8)]).last_column - (yylsp[(5) - (8)]).first_column);
                                           SET_EXCEPTION_LOCATION(forIn, (yylsp[(4) - (8)]).first_column, (yylsp[(5) - (8)]).first_column + 1, (yylsp[(6) - (8)]).last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyvsp[(8) - (8)].statementNode).m_varDeclarations, *(yyvsp[(4) - (8)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(forIn, (yyvsp[(8) - (8)].statementNode).m_varDeclarations, (yyvsp[(8) - (8)].statementNode).m_funcDeclarations, ((*(yyvsp[(4) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(6) - (8)].expressionNode).m_features | (yyvsp[(8) - (8)].statementNode).m_features, (yyvsp[(6) - (8)].expressionNode).m_numConstants + (yyvsp[(8) - (8)].statementNode).m_numConstants);
@@ -4092,8 +4093,8 @@ yyreduce:
     break;
 
   case 250:
-#line 1003 "../parser/Grammar.y"
-    { ForInNode *forIn = new ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (9)].ident), (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, (yylsp[(5) - (9)]).first_column, (yylsp[(5) - (9)]).first_column - (yylsp[(4) - (9)]).first_column, (yylsp[(5) - (9)]).last_column - (yylsp[(5) - (9)]).first_column);
+#line 1004 "../parser/Grammar.y"
+    { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (9)].ident), (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, (yylsp[(5) - (9)]).first_column, (yylsp[(5) - (9)]).first_column - (yylsp[(4) - (9)]).first_column, (yylsp[(5) - (9)]).last_column - (yylsp[(5) - (9)]).first_column);
                                           SET_EXCEPTION_LOCATION(forIn, (yylsp[(4) - (9)]).first_column, (yylsp[(6) - (9)]).first_column + 1, (yylsp[(7) - (9)]).last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyvsp[(9) - (9)].statementNode).m_varDeclarations, *(yyvsp[(4) - (9)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(forIn, (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations,
@@ -4103,125 +4104,125 @@ yyreduce:
     break;
 
   case 251:
-#line 1013 "../parser/Grammar.y"
+#line 1014 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
     break;
 
   case 253:
-#line 1018 "../parser/Grammar.y"
+#line 1019 "../parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
     break;
 
   case 255:
-#line 1023 "../parser/Grammar.y"
-    { ContinueNode* node = new ContinueNode(GLOBAL_DATA);
+#line 1024 "../parser/Grammar.y"
+    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 256:
-#line 1027 "../parser/Grammar.y"
-    { ContinueNode* node = new ContinueNode(GLOBAL_DATA);
+#line 1028 "../parser/Grammar.y"
+    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 257:
-#line 1031 "../parser/Grammar.y"
-    { ContinueNode* node = new ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
+#line 1032 "../parser/Grammar.y"
+    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 258:
-#line 1035 "../parser/Grammar.y"
-    { ContinueNode* node = new ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
+#line 1036 "../parser/Grammar.y"
+    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
   case 259:
-#line 1042 "../parser/Grammar.y"
-    { BreakNode* node = new BreakNode(GLOBAL_DATA);
+#line 1043 "../parser/Grammar.y"
+    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 260:
-#line 1045 "../parser/Grammar.y"
-    { BreakNode* node = new BreakNode(GLOBAL_DATA);
+#line 1046 "../parser/Grammar.y"
+    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new BreakNode(GLOBAL_DATA), 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA), 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 261:
-#line 1048 "../parser/Grammar.y"
-    { BreakNode* node = new BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
+#line 1049 "../parser/Grammar.y"
+    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 262:
-#line 1051 "../parser/Grammar.y"
-    { BreakNode* node = new BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
+#line 1052 "../parser/Grammar.y"
+    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident)), 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident)), 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
   case 263:
-#line 1057 "../parser/Grammar.y"
-    { ReturnNode* node = new ReturnNode(GLOBAL_DATA, 0); 
+#line 1058 "../parser/Grammar.y"
+    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 264:
-#line 1060 "../parser/Grammar.y"
-    { ReturnNode* node = new ReturnNode(GLOBAL_DATA, 0); 
+#line 1061 "../parser/Grammar.y"
+    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 265:
-#line 1063 "../parser/Grammar.y"
-    { ReturnNode* node = new ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
+#line 1064 "../parser/Grammar.y"
+    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 266:
-#line 1066 "../parser/Grammar.y"
-    { ReturnNode* node = new ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
+#line 1067 "../parser/Grammar.y"
+    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
   case 267:
-#line 1072 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new WithNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node, (yylsp[(3) - (5)]).last_column, (yylsp[(3) - (5)]).last_column - (yylsp[(3) - (5)]).first_column),
+#line 1073 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WithNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node, (yylsp[(3) - (5)]).last_column, (yylsp[(3) - (5)]).last_column - (yylsp[(3) - (5)]).first_column),
                                                                                          (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features | WithFeature, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 268:
-#line 1078 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new SwitchNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].caseBlockNode).m_node), (yyvsp[(5) - (5)].caseBlockNode).m_varDeclarations, (yyvsp[(5) - (5)].caseBlockNode).m_funcDeclarations,
+#line 1079 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) SwitchNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].caseBlockNode).m_node), (yyvsp[(5) - (5)].caseBlockNode).m_varDeclarations, (yyvsp[(5) - (5)].caseBlockNode).m_funcDeclarations,
                                                                                          (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].caseBlockNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].caseBlockNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 269:
-#line 1084 "../parser/Grammar.y"
-    { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].clauseList).m_node.head, 0, 0), (yyvsp[(2) - (3)].clauseList).m_varDeclarations, (yyvsp[(2) - (3)].clauseList).m_funcDeclarations, (yyvsp[(2) - (3)].clauseList).m_features, (yyvsp[(2) - (3)].clauseList).m_numConstants); ;}
+#line 1085 "../parser/Grammar.y"
+    { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].clauseList).m_node.head, 0, 0), (yyvsp[(2) - (3)].clauseList).m_varDeclarations, (yyvsp[(2) - (3)].clauseList).m_funcDeclarations, (yyvsp[(2) - (3)].clauseList).m_features, (yyvsp[(2) - (3)].clauseList).m_numConstants); ;}
     break;
 
   case 270:
-#line 1086 "../parser/Grammar.y"
-    { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (5)].clauseList).m_node.head, (yyvsp[(3) - (5)].caseClauseNode).m_node, (yyvsp[(4) - (5)].clauseList).m_node.head),
+#line 1087 "../parser/Grammar.y"
+    { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (5)].clauseList).m_node.head, (yyvsp[(3) - (5)].caseClauseNode).m_node, (yyvsp[(4) - (5)].clauseList).m_node.head),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (5)].clauseList).m_varDeclarations, (yyvsp[(3) - (5)].caseClauseNode).m_varDeclarations), (yyvsp[(4) - (5)].clauseList).m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (5)].clauseList).m_funcDeclarations, (yyvsp[(3) - (5)].caseClauseNode).m_funcDeclarations), (yyvsp[(4) - (5)].clauseList).m_funcDeclarations),
                                                                                          (yyvsp[(2) - (5)].clauseList).m_features | (yyvsp[(3) - (5)].caseClauseNode).m_features | (yyvsp[(4) - (5)].clauseList).m_features,
@@ -4229,13 +4230,13 @@ yyreduce:
     break;
 
   case 271:
-#line 1094 "../parser/Grammar.y"
+#line 1095 "../parser/Grammar.y"
     { (yyval.clauseList).m_node.head = 0; (yyval.clauseList).m_node.tail = 0; (yyval.clauseList).m_varDeclarations = 0; (yyval.clauseList).m_funcDeclarations = 0; (yyval.clauseList).m_features = 0; (yyval.clauseList).m_numConstants = 0; ;}
     break;
 
   case 273:
-#line 1099 "../parser/Grammar.y"
-    { (yyval.clauseList).m_node.head = new ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].caseClauseNode).m_node);
+#line 1100 "../parser/Grammar.y"
+    { (yyval.clauseList).m_node.head = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].caseClauseNode).m_node);
                                           (yyval.clauseList).m_node.tail = (yyval.clauseList).m_node.head;
                                           (yyval.clauseList).m_varDeclarations = (yyvsp[(1) - (1)].caseClauseNode).m_varDeclarations;
                                           (yyval.clauseList).m_funcDeclarations = (yyvsp[(1) - (1)].caseClauseNode).m_funcDeclarations; 
@@ -4244,9 +4245,9 @@ yyreduce:
     break;
 
   case 274:
-#line 1105 "../parser/Grammar.y"
+#line 1106 "../parser/Grammar.y"
     { (yyval.clauseList).m_node.head = (yyvsp[(1) - (2)].clauseList).m_node.head;
-                                          (yyval.clauseList).m_node.tail = new ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (2)].clauseList).m_node.tail, (yyvsp[(2) - (2)].caseClauseNode).m_node);
+                                          (yyval.clauseList).m_node.tail = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (2)].clauseList).m_node.tail, (yyvsp[(2) - (2)].caseClauseNode).m_node);
                                           (yyval.clauseList).m_varDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].clauseList).m_varDeclarations, (yyvsp[(2) - (2)].caseClauseNode).m_varDeclarations);
                                           (yyval.clauseList).m_funcDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].clauseList).m_funcDeclarations, (yyvsp[(2) - (2)].caseClauseNode).m_funcDeclarations);
                                           (yyval.clauseList).m_features = (yyvsp[(1) - (2)].clauseList).m_features | (yyvsp[(2) - (2)].caseClauseNode).m_features;
@@ -4255,51 +4256,51 @@ yyreduce:
     break;
 
   case 275:
-#line 1115 "../parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node), 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); ;}
+#line 1116 "../parser/Grammar.y"
+    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node), 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 276:
-#line 1116 "../parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].sourceElements).m_node), (yyvsp[(4) - (4)].sourceElements).m_varDeclarations, (yyvsp[(4) - (4)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (4)].expressionNode).m_features | (yyvsp[(4) - (4)].sourceElements).m_features, (yyvsp[(2) - (4)].expressionNode).m_numConstants + (yyvsp[(4) - (4)].sourceElements).m_numConstants); ;}
+#line 1117 "../parser/Grammar.y"
+    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].sourceElements).m_node), (yyvsp[(4) - (4)].sourceElements).m_varDeclarations, (yyvsp[(4) - (4)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (4)].expressionNode).m_features | (yyvsp[(4) - (4)].sourceElements).m_features, (yyvsp[(2) - (4)].expressionNode).m_numConstants + (yyvsp[(4) - (4)].sourceElements).m_numConstants); ;}
     break;
 
   case 277:
-#line 1120 "../parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, 0), 0, 0, 0, 0); ;}
+#line 1121 "../parser/Grammar.y"
+    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0), 0, 0, 0, 0); ;}
     break;
 
   case 278:
-#line 1121 "../parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, 0, (yyvsp[(3) - (3)].sourceElements).m_node), (yyvsp[(3) - (3)].sourceElements).m_varDeclarations, (yyvsp[(3) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(3) - (3)].sourceElements).m_features, (yyvsp[(3) - (3)].sourceElements).m_numConstants); ;}
+#line 1122 "../parser/Grammar.y"
+    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0, (yyvsp[(3) - (3)].sourceElements).m_node), (yyvsp[(3) - (3)].sourceElements).m_varDeclarations, (yyvsp[(3) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(3) - (3)].sourceElements).m_features, (yyvsp[(3) - (3)].sourceElements).m_numConstants); ;}
     break;
 
   case 279:
-#line 1125 "../parser/Grammar.y"
-    { LabelNode* node = new LabelNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].statementNode).m_node);
+#line 1126 "../parser/Grammar.y"
+    { LabelNode* node = new (GLOBAL_DATA) LabelNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].statementNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, (yyvsp[(3) - (3)].statementNode).m_varDeclarations, (yyvsp[(3) - (3)].statementNode).m_funcDeclarations, (yyvsp[(3) - (3)].statementNode).m_features, (yyvsp[(3) - (3)].statementNode).m_numConstants); ;}
     break;
 
   case 280:
-#line 1131 "../parser/Grammar.y"
-    { ThrowNode* node = new ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
+#line 1132 "../parser/Grammar.y"
+    { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
                                         ;}
     break;
 
   case 281:
-#line 1135 "../parser/Grammar.y"
-    { ThrowNode* node = new ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
+#line 1136 "../parser/Grammar.y"
+    { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; 
                                         ;}
     break;
 
   case 282:
-#line 1142 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new TryNode(GLOBAL_DATA, (yyvsp[(2) - (4)].statementNode).m_node, GLOBAL_DATA->propertyNames->nullIdentifier, false, 0, (yyvsp[(4) - (4)].statementNode).m_node),
+#line 1143 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (4)].statementNode).m_node, GLOBAL_DATA->propertyNames->nullIdentifier, false, 0, (yyvsp[(4) - (4)].statementNode).m_node),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (4)].statementNode).m_varDeclarations, (yyvsp[(4) - (4)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (4)].statementNode).m_funcDeclarations, (yyvsp[(4) - (4)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(2) - (4)].statementNode).m_features | (yyvsp[(4) - (4)].statementNode).m_features,
@@ -4308,8 +4309,8 @@ yyreduce:
     break;
 
   case 283:
-#line 1148 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new TryNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, *(yyvsp[(5) - (7)].ident), ((yyvsp[(7) - (7)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (7)].statementNode).m_node, 0),
+#line 1149 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, *(yyvsp[(5) - (7)].ident), ((yyvsp[(7) - (7)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (7)].statementNode).m_node, 0),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features | CatchFeature,
@@ -4318,8 +4319,8 @@ yyreduce:
     break;
 
   case 284:
-#line 1155 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new TryNode(GLOBAL_DATA, (yyvsp[(2) - (9)].statementNode).m_node, *(yyvsp[(5) - (9)].ident), ((yyvsp[(7) - (9)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (9)].statementNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node),
+#line 1156 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (9)].statementNode).m_node, *(yyvsp[(5) - (9)].ident), ((yyvsp[(7) - (9)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (9)].statementNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (9)].statementNode).m_varDeclarations, (yyvsp[(7) - (9)].statementNode).m_varDeclarations), (yyvsp[(9) - (9)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (9)].statementNode).m_funcDeclarations, (yyvsp[(7) - (9)].statementNode).m_funcDeclarations), (yyvsp[(9) - (9)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(2) - (9)].statementNode).m_features | (yyvsp[(7) - (9)].statementNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features | CatchFeature,
@@ -4328,26 +4329,26 @@ yyreduce:
     break;
 
   case 285:
-#line 1164 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
+#line 1165 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 286:
-#line 1166 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
+#line 1167 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 287:
-#line 1171 "../parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), 0, new ParserRefCountedData<DeclarationStacks::FunctionStack>(GLOBAL_DATA), ((*(yyvsp[(2) - (7)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); DBG((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node)); ;}
+#line 1172 "../parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (7)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); DBG((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node)); ;}
     break;
 
   case 288:
-#line 1173 "../parser/Grammar.y"
+#line 1174 "../parser/Grammar.y"
     { 
-          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), LEXER->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), 0, new ParserRefCountedData<DeclarationStacks::FunctionStack>(GLOBAL_DATA), ((*(yyvsp[(2) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
+          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), LEXER->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
           if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
               (yyvsp[(7) - (8)].functionBodyNode)->setUsesArguments(); 
           DBG((yyvsp[(7) - (8)].functionBodyNode), (yylsp[(6) - (8)]), (yylsp[(8) - (8)]));
@@ -4356,12 +4357,12 @@ yyreduce:
     break;
 
   case 289:
-#line 1183 "../parser/Grammar.y"
+#line 1184 "../parser/Grammar.y"
     { (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(5) - (6)].functionBodyNode), LEXER->sourceCode((yyvsp[(4) - (6)].intValue), (yyvsp[(6) - (6)].intValue), (yylsp[(4) - (6)]).first_line)), ClosureFeature, 0); DBG((yyvsp[(5) - (6)].functionBodyNode), (yylsp[(4) - (6)]), (yylsp[(6) - (6)])); ;}
     break;
 
   case 290:
-#line 1185 "../parser/Grammar.y"
+#line 1186 "../parser/Grammar.y"
     { 
           (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line), (yyvsp[(3) - (7)].parameterList).m_node.head), (yyvsp[(3) - (7)].parameterList).m_features | ClosureFeature, 0); 
           if ((yyvsp[(3) - (7)].parameterList).m_features & ArgumentsFeature) 
@@ -4371,12 +4372,12 @@ yyreduce:
     break;
 
   case 291:
-#line 1191 "../parser/Grammar.y"
+#line 1192 "../parser/Grammar.y"
     { (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); DBG((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); ;}
     break;
 
   case 292:
-#line 1193 "../parser/Grammar.y"
+#line 1194 "../parser/Grammar.y"
     { 
           (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), LEXER->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
           if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
@@ -4386,43 +4387,43 @@ yyreduce:
     break;
 
   case 293:
-#line 1202 "../parser/Grammar.y"
-    { (yyval.parameterList).m_node.head = new ParameterNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident));
+#line 1203 "../parser/Grammar.y"
+    { (yyval.parameterList).m_node.head = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident));
                                           (yyval.parameterList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
                                           (yyval.parameterList).m_node.tail = (yyval.parameterList).m_node.head; ;}
     break;
 
   case 294:
-#line 1205 "../parser/Grammar.y"
+#line 1206 "../parser/Grammar.y"
     { (yyval.parameterList).m_node.head = (yyvsp[(1) - (3)].parameterList).m_node.head;
                                           (yyval.parameterList).m_features = (yyvsp[(1) - (3)].parameterList).m_features | ((*(yyvsp[(3) - (3)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0);
-                                          (yyval.parameterList).m_node.tail = new ParameterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].parameterList).m_node.tail, *(yyvsp[(3) - (3)].ident));  ;}
+                                          (yyval.parameterList).m_node.tail = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].parameterList).m_node.tail, *(yyvsp[(3) - (3)].ident));  ;}
     break;
 
   case 295:
-#line 1211 "../parser/Grammar.y"
+#line 1212 "../parser/Grammar.y"
     { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
     break;
 
   case 296:
-#line 1212 "../parser/Grammar.y"
+#line 1213 "../parser/Grammar.y"
     { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
     break;
 
   case 297:
-#line 1216 "../parser/Grammar.y"
-    { GLOBAL_DATA->parser->didFinishParsing(new SourceElements(GLOBAL_DATA), 0, 0, NoFeatures, (yylsp[(0) - (0)]).last_line, 0); ;}
+#line 1217 "../parser/Grammar.y"
+    { GLOBAL_DATA->parser->didFinishParsing(new (GLOBAL_DATA) SourceElements(GLOBAL_DATA), 0, 0, NoFeatures, (yylsp[(0) - (0)]).last_line, 0); ;}
     break;
 
   case 298:
-#line 1217 "../parser/Grammar.y"
+#line 1218 "../parser/Grammar.y"
     { GLOBAL_DATA->parser->didFinishParsing((yyvsp[(1) - (1)].sourceElements).m_node, (yyvsp[(1) - (1)].sourceElements).m_varDeclarations, (yyvsp[(1) - (1)].sourceElements).m_funcDeclarations, (yyvsp[(1) - (1)].sourceElements).m_features, 
                                                                                 (yylsp[(1) - (1)]).last_line, (yyvsp[(1) - (1)].sourceElements).m_numConstants); ;}
     break;
 
   case 299:
-#line 1222 "../parser/Grammar.y"
-    { (yyval.sourceElements).m_node = new SourceElements(GLOBAL_DATA);
+#line 1223 "../parser/Grammar.y"
+    { (yyval.sourceElements).m_node = new (GLOBAL_DATA) SourceElements(GLOBAL_DATA);
                                           (yyval.sourceElements).m_node->append((yyvsp[(1) - (1)].statementNode).m_node);
                                           (yyval.sourceElements).m_varDeclarations = (yyvsp[(1) - (1)].statementNode).m_varDeclarations;
                                           (yyval.sourceElements).m_funcDeclarations = (yyvsp[(1) - (1)].statementNode).m_funcDeclarations;
@@ -4432,7 +4433,7 @@ yyreduce:
     break;
 
   case 300:
-#line 1229 "../parser/Grammar.y"
+#line 1230 "../parser/Grammar.y"
     { (yyval.sourceElements).m_node->append((yyvsp[(2) - (2)].statementNode).m_node);
                                           (yyval.sourceElements).m_varDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].sourceElements).m_varDeclarations, (yyvsp[(2) - (2)].statementNode).m_varDeclarations);
                                           (yyval.sourceElements).m_funcDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (2)].statementNode).m_funcDeclarations);
@@ -4442,188 +4443,188 @@ yyreduce:
     break;
 
   case 304:
-#line 1243 "../parser/Grammar.y"
+#line 1244 "../parser/Grammar.y"
     { ;}
     break;
 
   case 305:
-#line 1244 "../parser/Grammar.y"
+#line 1245 "../parser/Grammar.y"
     { ;}
     break;
 
   case 306:
-#line 1245 "../parser/Grammar.y"
+#line 1246 "../parser/Grammar.y"
     { Lexer& l = *LEXER; if (!l.scanRegExp()) YYABORT; ;}
     break;
 
   case 307:
-#line 1246 "../parser/Grammar.y"
+#line 1247 "../parser/Grammar.y"
     { Lexer& l = *LEXER; if (!l.scanRegExp()) YYABORT; ;}
     break;
 
   case 308:
-#line 1250 "../parser/Grammar.y"
+#line 1251 "../parser/Grammar.y"
     { ;}
     break;
 
   case 309:
-#line 1251 "../parser/Grammar.y"
+#line 1252 "../parser/Grammar.y"
     { ;}
     break;
 
   case 310:
-#line 1252 "../parser/Grammar.y"
+#line 1253 "../parser/Grammar.y"
     { ;}
     break;
 
   case 311:
-#line 1253 "../parser/Grammar.y"
+#line 1254 "../parser/Grammar.y"
     { if (*(yyvsp[(1) - (7)].ident) != "get" && *(yyvsp[(1) - (7)].ident) != "set") YYABORT; ;}
     break;
 
   case 312:
-#line 1254 "../parser/Grammar.y"
+#line 1255 "../parser/Grammar.y"
     { if (*(yyvsp[(1) - (8)].ident) != "get" && *(yyvsp[(1) - (8)].ident) != "set") YYABORT; ;}
     break;
 
   case 316:
-#line 1264 "../parser/Grammar.y"
+#line 1265 "../parser/Grammar.y"
     { ;}
     break;
 
   case 317:
-#line 1265 "../parser/Grammar.y"
+#line 1266 "../parser/Grammar.y"
     { ;}
     break;
 
   case 318:
-#line 1267 "../parser/Grammar.y"
+#line 1268 "../parser/Grammar.y"
     { ;}
     break;
 
   case 322:
-#line 1274 "../parser/Grammar.y"
+#line 1275 "../parser/Grammar.y"
     { ;}
     break;
 
   case 517:
-#line 1642 "../parser/Grammar.y"
+#line 1643 "../parser/Grammar.y"
     { ;}
     break;
 
   case 518:
-#line 1643 "../parser/Grammar.y"
+#line 1644 "../parser/Grammar.y"
     { ;}
     break;
 
   case 520:
-#line 1648 "../parser/Grammar.y"
+#line 1649 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 521:
-#line 1652 "../parser/Grammar.y"
+#line 1653 "../parser/Grammar.y"
     { ;}
     break;
 
   case 522:
-#line 1653 "../parser/Grammar.y"
+#line 1654 "../parser/Grammar.y"
     { ;}
     break;
 
   case 525:
-#line 1659 "../parser/Grammar.y"
+#line 1660 "../parser/Grammar.y"
     { ;}
     break;
 
   case 526:
-#line 1660 "../parser/Grammar.y"
+#line 1661 "../parser/Grammar.y"
     { ;}
     break;
 
   case 530:
-#line 1667 "../parser/Grammar.y"
+#line 1668 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 533:
-#line 1676 "../parser/Grammar.y"
+#line 1677 "../parser/Grammar.y"
     { ;}
     break;
 
   case 534:
-#line 1677 "../parser/Grammar.y"
+#line 1678 "../parser/Grammar.y"
     { ;}
     break;
 
   case 539:
-#line 1694 "../parser/Grammar.y"
+#line 1695 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 555:
-#line 1725 "../parser/Grammar.y"
+#line 1726 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 557:
-#line 1727 "../parser/Grammar.y"
+#line 1728 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 559:
-#line 1732 "../parser/Grammar.y"
+#line 1733 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 561:
-#line 1734 "../parser/Grammar.y"
+#line 1735 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 563:
-#line 1739 "../parser/Grammar.y"
+#line 1740 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 565:
-#line 1741 "../parser/Grammar.y"
+#line 1742 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 568:
-#line 1753 "../parser/Grammar.y"
+#line 1754 "../parser/Grammar.y"
     { ;}
     break;
 
   case 569:
-#line 1754 "../parser/Grammar.y"
+#line 1755 "../parser/Grammar.y"
     { ;}
     break;
 
   case 578:
-#line 1778 "../parser/Grammar.y"
+#line 1779 "../parser/Grammar.y"
     { ;}
     break;
 
   case 580:
-#line 1783 "../parser/Grammar.y"
+#line 1784 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 585:
-#line 1794 "../parser/Grammar.y"
+#line 1795 "../parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 592:
-#line 1810 "../parser/Grammar.y"
+#line 1811 "../parser/Grammar.y"
     { ;}
     break;
 
 
 /* Line 1267 of yacc.c.  */
-#line 4627 "Grammar.tab.c"
+#line 4628 "JavaScriptCore/tmp/../generated/Grammar.tab.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -4843,29 +4844,29 @@ yyreturn:
 }
 
 
-#line 1826 "../parser/Grammar.y"
+#line 1827 "../parser/Grammar.y"
 
 
 static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Operator op, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end)
 {
     if (!loc->isLocation())
-        return new AssignErrorNode(GLOBAL_DATA, loc, op, expr, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) AssignErrorNode(GLOBAL_DATA, loc, op, expr, divot, divot - start, end - divot);
 
     if (loc->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(loc);
         if (op == OpEqual) {
-            AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, resolve->identifier(), expr, exprHasAssignments);
+            AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, resolve->identifier(), expr, exprHasAssignments);
             SET_EXCEPTION_LOCATION(node, start, divot, end);
             return node;
         } else
-            return new ReadModifyResolveNode(GLOBAL_DATA, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+            return new (GLOBAL_DATA) ReadModifyResolveNode(GLOBAL_DATA, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     }
     if (loc->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(loc);
         if (op == OpEqual)
-            return new AssignBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
+            return new (GLOBAL_DATA) AssignBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
         else {
-            ReadModifyBracketNode* node = new ReadModifyBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
+            ReadModifyBracketNode* node = new (GLOBAL_DATA) ReadModifyBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
             node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
             return node;
         }
@@ -4873,9 +4874,9 @@ static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Oper
     ASSERT(loc->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(loc);
     if (op == OpEqual)
-        return new AssignDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
+        return new (GLOBAL_DATA) AssignDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
 
-    ReadModifyDotNode* node = new ReadModifyDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+    ReadModifyDotNode* node = new (GLOBAL_DATA) ReadModifyDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
@@ -4883,21 +4884,21 @@ static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Oper
 static ExpressionNode* makePrefixNode(void* globalPtr, ExpressionNode* expr, Operator op, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new PrefixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PrefixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
     
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new PrefixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PrefixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PrefixBracketNode* node = new PrefixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PrefixBracketNode* node = new (GLOBAL_DATA) PrefixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->startOffset());
         return node;
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PrefixDotNode* node = new PrefixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PrefixDotNode* node = new (GLOBAL_DATA) PrefixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->startOffset());
     return node;
 }
@@ -4905,22 +4906,22 @@ static ExpressionNode* makePrefixNode(void* globalPtr, ExpressionNode* expr, Ope
 static ExpressionNode* makePostfixNode(void* globalPtr, ExpressionNode* expr, Operator op, int start, int divot, int end)
 { 
     if (!expr->isLocation())
-        return new PostfixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PostfixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
     
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new PostfixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PostfixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PostfixBracketNode* node = new PostfixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PostfixBracketNode* node = new (GLOBAL_DATA) PostfixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return node;
         
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PostfixDotNode* node = new PostfixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PostfixDotNode* node = new (GLOBAL_DATA) PostfixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
@@ -4930,23 +4931,29 @@ static ExpressionNodeInfo makeFunctionCallNode(void* globalPtr, ExpressionNodeIn
     CodeFeatures features = func.m_features | args.m_features;
     int numConstants = func.m_numConstants + args.m_numConstants;
     if (!func.m_node->isLocation())
-        return createNodeInfo<ExpressionNode*>(new FunctionCallValueNode(GLOBAL_DATA, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
+        return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) FunctionCallValueNode(GLOBAL_DATA, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
     if (func.m_node->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(func.m_node);
         const Identifier& identifier = resolve->identifier();
         if (identifier == GLOBAL_DATA->propertyNames->eval)
-            return createNodeInfo<ExpressionNode*>(new EvalFunctionCallNode(GLOBAL_DATA, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
-        return createNodeInfo<ExpressionNode*>(new FunctionCallResolveNode(GLOBAL_DATA, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
+            return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EvalFunctionCallNode(GLOBAL_DATA, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
+        return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) FunctionCallResolveNode(GLOBAL_DATA, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
     }
     if (func.m_node->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(func.m_node);
-        FunctionCallBracketNode* node = new FunctionCallBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
+        FunctionCallBracketNode* node = new (GLOBAL_DATA) FunctionCallBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return createNodeInfo<ExpressionNode*>(node, features, numConstants);
     }
     ASSERT(func.m_node->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(func.m_node);
-    FunctionCallDotNode* node = new FunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    FunctionCallDotNode* node;
+    if (dot->identifier() == GLOBAL_DATA->propertyNames->call)
+        node = new (GLOBAL_DATA) CallFunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    else if (dot->identifier() == GLOBAL_DATA->propertyNames->apply)
+        node = new (GLOBAL_DATA) ApplyFunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    else
+        node = new (GLOBAL_DATA) FunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return createNodeInfo<ExpressionNode*>(node, features, numConstants);
 }
@@ -4955,26 +4962,26 @@ static ExpressionNode* makeTypeOfNode(void* globalPtr, ExpressionNode* expr)
 {
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new TypeOfResolveNode(GLOBAL_DATA, resolve->identifier());
+        return new (GLOBAL_DATA) TypeOfResolveNode(GLOBAL_DATA, resolve->identifier());
     }
-    return new TypeOfValueNode(GLOBAL_DATA, expr);
+    return new (GLOBAL_DATA) TypeOfValueNode(GLOBAL_DATA, expr);
 }
 
 static ExpressionNode* makeDeleteNode(void* globalPtr, ExpressionNode* expr, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new DeleteValueNode(GLOBAL_DATA, expr);
+        return new (GLOBAL_DATA) DeleteValueNode(GLOBAL_DATA, expr);
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new DeleteResolveNode(GLOBAL_DATA, resolve->identifier(), divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) DeleteResolveNode(GLOBAL_DATA, resolve->identifier(), divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        return new DeleteBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) DeleteBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    return new DeleteDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), divot, divot - start, end - divot);
+    return new (GLOBAL_DATA) DeleteDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), divot, divot - start, end - divot);
 }
 
 static PropertyNode* makeGetterOrSetterPropertyNode(void* globalPtr, const Identifier& getOrSet, const Identifier& name, ParameterNode* params, FunctionBodyNode* body, const SourceCode& source)
@@ -4986,7 +4993,7 @@ static PropertyNode* makeGetterOrSetterPropertyNode(void* globalPtr, const Ident
         type = PropertyNode::Setter;
     else
         return 0;
-    return new PropertyNode(GLOBAL_DATA, name, new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, body, source, params), type);
+    return new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, name, new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, body, source, params), type);
 }
 
 static ExpressionNode* makeNegateNode(void* globalPtr, ExpressionNode* n)
@@ -5000,19 +5007,19 @@ static ExpressionNode* makeNegateNode(void* globalPtr, ExpressionNode* n)
         }
     }
 
-    return new NegateNode(GLOBAL_DATA, n);
+    return new (GLOBAL_DATA) NegateNode(GLOBAL_DATA, n);
 }
 
 static NumberNode* makeNumberNode(void* globalPtr, double d)
 {
-    return new NumberNode(GLOBAL_DATA, d);
+    return new (GLOBAL_DATA) NumberNode(GLOBAL_DATA, d);
 }
 
 static ExpressionNode* makeBitwiseNotNode(void* globalPtr, ExpressionNode* expr)
 {
     if (expr->isNumber())
         return makeNumberNode(globalPtr, ~toInt32(static_cast<NumberNode*>(expr)->value()));
-    return new BitwiseNotNode(GLOBAL_DATA, expr);
+    return new (GLOBAL_DATA) BitwiseNotNode(GLOBAL_DATA, expr);
 }
 
 static ExpressionNode* makeMultNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
@@ -5024,12 +5031,12 @@ static ExpressionNode* makeMultNode(void* globalPtr, ExpressionNode* expr1, Expr
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() * static_cast<NumberNode*>(expr2)->value());
 
     if (expr1->isNumber() && static_cast<NumberNode*>(expr1)->value() == 1)
-        return new UnaryPlusNode(GLOBAL_DATA, expr2);
+        return new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, expr2);
 
     if (expr2->isNumber() && static_cast<NumberNode*>(expr2)->value() == 1)
-        return new UnaryPlusNode(GLOBAL_DATA, expr1);
+        return new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, expr1);
 
-    return new MultNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) MultNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeDivNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
@@ -5039,14 +5046,14 @@ static ExpressionNode* makeDivNode(void* globalPtr, ExpressionNode* expr1, Expre
 
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() / static_cast<NumberNode*>(expr2)->value());
-    return new DivNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) DivNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeAddNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() + static_cast<NumberNode*>(expr2)->value());
-    return new AddNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) AddNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeSubNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
@@ -5056,21 +5063,21 @@ static ExpressionNode* makeSubNode(void* globalPtr, ExpressionNode* expr1, Expre
 
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() - static_cast<NumberNode*>(expr2)->value());
-    return new SubNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) SubNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeLeftShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) << (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new LeftShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) LeftShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeRightShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) >> (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new RightShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) RightShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 /* called by yyparse on error */
@@ -5085,11 +5092,15 @@ static bool allowAutomaticSemicolon(Lexer& lexer, int yychar)
     return yychar == CLOSEBRACE || yychar == 0 || lexer.prevTerminator();
 }
 
-static ExpressionNode* combineVarInitializers(void* globalPtr, ExpressionNode* list, AssignResolveNode* init)
+static ExpressionNode* combineCommaNodes(void* globalPtr, ExpressionNode* list, ExpressionNode* init)
 {
     if (!list)
         return init;
-    return new VarDeclCommaNode(GLOBAL_DATA, list, init);
+    if (list->isCommaNode()) {
+        static_cast<CommaNode*>(list)->append(init);
+        return list;
+    }
+    return new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, list, init);
 }
 
 // We turn variable declarations into either assignments or empty
@@ -5098,8 +5109,8 @@ static ExpressionNode* combineVarInitializers(void* globalPtr, ExpressionNode* l
 static StatementNode* makeVarStatementNode(void* globalPtr, ExpressionNode* expr)
 {
     if (!expr)
-        return new EmptyStatementNode(GLOBAL_DATA);
-    return new VarStatementNode(GLOBAL_DATA, expr);
+        return new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA);
+    return new (GLOBAL_DATA) VarStatementNode(GLOBAL_DATA, expr);
 }
 
 #undef GLOBAL_DATA
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h
index 99dbd4c..ebd30c8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/Grammar.h
@@ -207,7 +207,7 @@ typedef union YYSTYPE
     Operator            op;
 }
 /* Line 1489 of yacc.c.  */
-#line 211 "Grammar.tab.h"
+#line 211 "JavaScriptCore/tmp/../generated/Grammar.tab.h"
 	YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/JSONObject.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/JSONObject.lut.h
new file mode 100644
index 0000000..2b7e836
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/JSONObject.lut.h
@@ -0,0 +1,15 @@
+// Automatically generated from ../runtime/JSONObject.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+
+#include "Lookup.h"
+
+namespace JSC {
+
+static const struct HashTableValue jsonTableValues[3] = {
+   { "parse", DontEnum|Function, (intptr_t)JSONProtoFuncParse, (intptr_t)1 },
+   { "stringify", DontEnum|Function, (intptr_t)JSONProtoFuncStringify, (intptr_t)1 },
+   { 0, 0, 0, 0 }
+};
+
+extern const struct HashTable jsonTable =
+    { 4, 3, jsonTableValues, 0 };
+} // namespace
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/Lexer.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/Lexer.lut.h
index 07cf122..fb1ae29 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/Lexer.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/Lexer.lut.h
@@ -45,10 +45,5 @@ static const struct HashTableValue mainTableValues[37] = {
 };
 
 extern const struct HashTable mainTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 1023, mainTableValues, 0 };
-#else
     { 133, 127, mainTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/MathObject.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/MathObject.lut.h
index 8fb01f2..7d9b43e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/MathObject.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/MathObject.lut.h
@@ -27,10 +27,5 @@ static const struct HashTableValue mathTableValues[19] = {
 };
 
 extern const struct HashTable mathTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 511, mathTableValues, 0 };
-#else
     { 67, 63, mathTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/NumberConstructor.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/NumberConstructor.lut.h
index de3d5a9..e963e1a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/NumberConstructor.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/NumberConstructor.lut.h
@@ -14,10 +14,5 @@ static const struct HashTableValue numberTableValues[6] = {
 };
 
 extern const struct HashTable numberTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 15, numberTableValues, 0 };
-#else
     { 16, 15, numberTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/RegExpConstructor.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/RegExpConstructor.lut.h
index 705efbb..fd822c6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/RegExpConstructor.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/RegExpConstructor.lut.h
@@ -30,10 +30,5 @@ static const struct HashTableValue regExpConstructorTableValues[22] = {
 };
 
 extern const struct HashTable regExpConstructorTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 511, regExpConstructorTableValues, 0 };
-#else
     { 65, 63, regExpConstructorTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/RegExpObject.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/RegExpObject.lut.h
index 3612f62..81d5b60 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/RegExpObject.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/RegExpObject.lut.h
@@ -14,10 +14,5 @@ static const struct HashTableValue regExpTableValues[6] = {
 };
 
 extern const struct HashTable regExpTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 31, regExpTableValues, 0 };
-#else
     { 17, 15, regExpTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h b/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h
index 0cf0815..dfb9c20 100644
--- a/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h
+++ b/src/3rdparty/webkit/JavaScriptCore/generated/StringPrototype.lut.h
@@ -41,10 +41,5 @@ static const struct HashTableValue stringTableValues[33] = {
 };
 
 extern const struct HashTable stringTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 2047, stringTableValues, 0 };
-#else
     { 71, 63, stringTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h
new file mode 100644
index 0000000..f48f4f4
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/CachedCall.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CachedCall_h
+#define CachedCall_h
+
+#include "CallFrameClosure.h"
+#include "JSFunction.h"
+#include "JSGlobalObject.h"
+#include "Interpreter.h"
+
+namespace JSC {
+    class CachedCall : Noncopyable {
+    public:
+        CachedCall(CallFrame* callFrame, JSFunction* function, int argCount, JSValue* exception)
+            : m_valid(false)
+            , m_interpreter(callFrame->interpreter())
+            , m_exception(exception)
+            , m_globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : function->scope().node()->globalObject())
+        {
+            m_closure = m_interpreter->prepareForRepeatCall(function->body(), callFrame, function, argCount, function->scope().node(), exception);
+            m_valid = !*exception;
+        }
+        
+        JSValue call()
+        { 
+            ASSERT(m_valid);
+            return m_interpreter->execute(m_closure, m_exception);
+        }
+        void setThis(JSValue v) { m_closure.setArgument(0, v); }
+        void setArgument(int n, JSValue v) { m_closure.setArgument(n + 1, v); }
+        CallFrame* newCallFrame() { return m_closure.newCallFrame; }
+        ~CachedCall()
+        {
+            if (m_valid)
+                m_interpreter->endRepeatCall(m_closure);
+        }
+        
+    private:
+        bool m_valid;
+        Interpreter* m_interpreter;
+        JSValue* m_exception;
+        DynamicGlobalObjectScope m_globalObjectScope;
+        CallFrameClosure m_closure;
+    };
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.cpp
index 1c74280..9724875 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.cpp
@@ -27,12 +27,26 @@
 #include "CallFrame.h"
 
 #include "CodeBlock.h"
+#include "Interpreter.h"
 
 namespace JSC {
 
-JSValuePtr CallFrame::thisValue()
+JSValue CallFrame::thisValue()
 {
-    return this[codeBlock()->thisRegister()].jsValue(this);
+    return this[codeBlock()->thisRegister()].jsValue();
 }
 
+#ifndef NDEBUG
+void CallFrame::dumpCaller()
+{
+    int signedLineNumber;
+    intptr_t sourceID;
+    UString urlString;
+    JSValue function;
+    
+    interpreter()->retrieveLastCaller(this, signedLineNumber, sourceID, urlString, function);
+    printf("Callpoint => %s:%d\n", urlString.ascii(), signedLineNumber);
+}
+#endif
+
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h
index d6b9b79..0b0e5fe 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrame.h
@@ -40,8 +40,9 @@ namespace JSC  {
         JSFunction* callee() const { return this[RegisterFile::Callee].function(); }
         CodeBlock* codeBlock() const { return this[RegisterFile::CodeBlock].Register::codeBlock(); }
         ScopeChainNode* scopeChain() const { return this[RegisterFile::ScopeChain].Register::scopeChain(); }
+        int argumentCount() const { return this[RegisterFile::ArgumentCount].i(); }
 
-        JSValuePtr thisValue();
+        JSValue thisValue();
 
         // Global object in which execution began.
         JSGlobalObject* dynamicGlobalObject();
@@ -73,47 +74,39 @@ namespace JSC  {
         // pointer, so these are inefficient, and should be used sparingly in new code.
         // But they're used in many places in legacy code, so they're not going away any time soon.
 
-        void setException(JSValuePtr exception) { globalData().exception = exception; }
-        void clearException() { globalData().exception = noValue(); }
-        JSValuePtr exception() const { return globalData().exception; }
-        JSValuePtr* exceptionSlot() { return &globalData().exception; }
+        void setException(JSValue exception) { globalData().exception = exception; }
+        void clearException() { globalData().exception = JSValue(); }
+        JSValue exception() const { return globalData().exception; }
+        JSValue* exceptionSlot() { return &globalData().exception; }
         bool hadException() const { return globalData().exception; }
 
         const CommonIdentifiers& propertyNames() const { return *globalData().propertyNames; }
-        const ArgList& emptyList() const { return *globalData().emptyList; }
+        const MarkedArgumentBuffer& emptyList() const { return *globalData().emptyList; }
         Interpreter* interpreter() { return globalData().interpreter; }
         Heap* heap() { return &globalData().heap; }
-
+#ifndef NDEBUG
+        void dumpCaller();
+#endif
         static const HashTable* arrayTable(CallFrame* callFrame) { return callFrame->globalData().arrayTable; }
         static const HashTable* dateTable(CallFrame* callFrame) { return callFrame->globalData().dateTable; }
+        static const HashTable* jsonTable(CallFrame* callFrame) { return callFrame->globalData().jsonTable; }
         static const HashTable* mathTable(CallFrame* callFrame) { return callFrame->globalData().mathTable; }
         static const HashTable* numberTable(CallFrame* callFrame) { return callFrame->globalData().numberTable; }
         static const HashTable* regExpTable(CallFrame* callFrame) { return callFrame->globalData().regExpTable; }
         static const HashTable* regExpConstructorTable(CallFrame* callFrame) { return callFrame->globalData().regExpConstructorTable; }
         static const HashTable* stringTable(CallFrame* callFrame) { return callFrame->globalData().stringTable; }
 
-    private:
-        friend class Arguments;
-        friend class JSActivation;
-        friend class JSGlobalObject;
-        friend class Interpreter;
-
         static CallFrame* create(Register* callFrameBase) { return static_cast<CallFrame*>(callFrameBase); }
         Register* registers() { return this; }
 
         CallFrame& operator=(const Register& r) { *static_cast<Register*>(this) = r; return *this; }
 
-        int argumentCount() const { return this[RegisterFile::ArgumentCount].i(); }
         CallFrame* callerFrame() const { return this[RegisterFile::CallerFrame].callFrame(); }
         Arguments* optionalCalleeArguments() const { return this[RegisterFile::OptionalCalleeArguments].arguments(); }
         Instruction* returnPC() const { return this[RegisterFile::ReturnPC].vPC(); }
-        int returnValueRegister() const { return this[RegisterFile::ReturnValueRegister].i(); }
 
-        void setArgumentCount(int count) { this[RegisterFile::ArgumentCount] = count; }
-        void setCallee(JSFunction* callee) { this[RegisterFile::Callee] = callee; }
         void setCalleeArguments(Arguments* arguments) { this[RegisterFile::OptionalCalleeArguments] = arguments; }
         void setCallerFrame(CallFrame* callerFrame) { this[RegisterFile::CallerFrame] = callerFrame; }
-        void setCodeBlock(CodeBlock* codeBlock) { this[RegisterFile::CodeBlock] = codeBlock; }
         void setScopeChain(ScopeChainNode* scopeChain) { this[RegisterFile::ScopeChain] = scopeChain; }
 
         ALWAYS_INLINE void init(CodeBlock* codeBlock, Instruction* vPC, ScopeChainNode* scopeChain,
@@ -131,6 +124,19 @@ namespace JSC  {
             setCalleeArguments(0);
         }
 
+    private:
+        friend class Arguments;
+        friend class JSActivation;
+        friend class JSGlobalObject;
+        friend class Interpreter;
+        friend struct CallFrameClosure;
+
+        int returnValueRegister() const { return this[RegisterFile::ReturnValueRegister].i(); }
+
+        void setArgumentCount(int count) { this[RegisterFile::ArgumentCount] = count; }
+        void setCallee(JSFunction* callee) { this[RegisterFile::Callee] = callee; }
+        void setCodeBlock(CodeBlock* codeBlock) { this[RegisterFile::CodeBlock] = codeBlock; }
+
         static const intptr_t HostCallFrameFlag = 1;
 
         static CallFrame* noCaller() { return reinterpret_cast<CallFrame*>(HostCallFrameFlag); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrameClosure.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrameClosure.h
new file mode 100644
index 0000000..0e14ced
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/CallFrameClosure.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef CallFrameClosure_h
+#define CallFrameClosure_h
+
+namespace JSC {
+
+struct CallFrameClosure {
+    CallFrame* oldCallFrame;
+    CallFrame* newCallFrame;
+    JSFunction* function;
+    FunctionBodyNode* functionBody;
+    JSGlobalData* globalData;
+    Register* oldEnd;
+    ScopeChainNode* scopeChain;
+    int expectedParams;
+    int providedParams;
+    
+    void setArgument(int arg, JSValue value)
+    {
+        if (arg < expectedParams)
+            newCallFrame[arg - RegisterFile::CallFrameHeaderSize - expectedParams] = value;
+        else
+            newCallFrame[arg - RegisterFile::CallFrameHeaderSize - expectedParams - providedParams] = value;
+    }
+    void resetCallFrame()
+    {
+        newCallFrame->setScopeChain(scopeChain);
+        newCallFrame->setCalleeArguments(0);
+        for (int i = providedParams; i < expectedParams; ++i)
+            newCallFrame[i - RegisterFile::CallFrameHeaderSize - expectedParams] = jsUndefined();
+    }
+};
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
index 0f9ea01..7b1e547 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.cpp
@@ -32,11 +32,14 @@
 
 #include "Arguments.h"
 #include "BatchedTransitionOptimizer.h"
+#include "CallFrame.h"
+#include "CallFrameClosure.h"
 #include "CodeBlock.h"
+#include "Collector.h"
+#include "Debugger.h"
 #include "DebuggerCallFrame.h"
 #include "EvalCodeCache.h"
 #include "ExceptionHelpers.h"
-#include "CallFrame.h"
 #include "GlobalEvalFunction.h"
 #include "JSActivation.h"
 #include "JSArray.h"
@@ -44,19 +47,19 @@
 #include "JSFunction.h"
 #include "JSNotAnObject.h"
 #include "JSPropertyNameIterator.h"
+#include "LiteralParser.h"
 #include "JSStaticScopeObject.h"
 #include "JSString.h"
 #include "ObjectPrototype.h"
+#include "Operations.h"
 #include "Parser.h"
 #include "Profiler.h"
 #include "RegExpObject.h"
 #include "RegExpPrototype.h"
 #include "Register.h"
-#include "Collector.h"
-#include "Debugger.h"
-#include "Operations.h"
 #include "SamplingTool.h"
 #include <stdio.h>
+#include <wtf/Threading.h>
 
 #if ENABLE(JIT)
 #include "JIT.h"
@@ -66,34 +69,16 @@
 #include "AssemblerBuffer.h"
 #endif
 
-#if PLATFORM(DARWIN)
-#include <mach/mach.h>
-#endif
-
-#if HAVE(SYS_TIME_H)
-#include <sys/time.h>
-#endif
-
-#if PLATFORM(WIN_OS)
-#include <windows.h>
-#endif
-
-#if PLATFORM(QT)
-#include <QDateTime>
-#endif
-
 using namespace std;
 
 namespace JSC {
 
-// Preferred number of milliseconds between each timeout check
-static const int preferredScriptCheckTimeInterval = 1000;
-
-static ALWAYS_INLINE unsigned bytecodeOffsetForPC(CodeBlock* codeBlock, void* pc)
+static ALWAYS_INLINE unsigned bytecodeOffsetForPC(CallFrame* callFrame, CodeBlock* codeBlock, void* pc)
 {
 #if ENABLE(JIT)
-    return codeBlock->getBytecodeIndex(pc);
+    return codeBlock->getBytecodeIndex(callFrame, ReturnAddressPtr(pc));
 #else
+    UNUSED_PARAM(callFrame);
     return static_cast<Instruction*>(pc) - codeBlock->instructions().begin();
 #endif
 }
@@ -106,203 +91,8 @@ static int depth(CodeBlock* codeBlock, ScopeChain& sc)
     return sc.localDepth();
 }
 
-// FIXME: This operation should be called "getNumber", not "isNumber" (as it is in JSValue.h).
-// FIXME: There's no need to have a "slow" version of this. All versions should be fast.
-static ALWAYS_INLINE bool fastIsNumber(JSValuePtr value, double& arg)
-{
-    if (JSImmediate::isNumber(value))
-        arg = JSImmediate::getTruncatedInt32(value);
-    else if (LIKELY(!JSImmediate::isImmediate(value)) && LIKELY(Heap::isNumber(asCell(value))))
-        arg = asNumberCell(value)->value();
-    else
-        return false;
-    return true;
-}
-
-// FIXME: Why doesn't JSValuePtr::toInt32 have the Heap::isNumber optimization?
-static bool fastToInt32(JSValuePtr value, int32_t& arg)
-{
-    if (JSImmediate::isNumber(value))
-        arg = JSImmediate::getTruncatedInt32(value);
-    else if (LIKELY(!JSImmediate::isImmediate(value)) && LIKELY(Heap::isNumber(asCell(value))))
-        arg = asNumberCell(value)->toInt32();
-    else
-        return false;
-    return true;
-}
-
-static ALWAYS_INLINE bool fastToUInt32(JSValuePtr value, uint32_t& arg)
-{
-    if (JSImmediate::isNumber(value)) {
-        if (JSImmediate::getTruncatedUInt32(value, arg))
-            return true;
-        bool scratch;
-        arg = toUInt32SlowCase(JSImmediate::getTruncatedInt32(value), scratch);
-        return true;
-    } else if (!JSImmediate::isImmediate(value) && Heap::isNumber(asCell(value)))
-        arg = asNumberCell(value)->toUInt32();
-    else
-        return false;
-    return true;
-}
-
-static inline bool jsLess(CallFrame* callFrame, JSValuePtr v1, JSValuePtr v2)
-{
-    if (JSImmediate::areBothImmediateNumbers(v1, v2))
-        return JSImmediate::getTruncatedInt32(v1) < JSImmediate::getTruncatedInt32(v2);
-
-    double n1;
-    double n2;
-    if (fastIsNumber(v1, n1) && fastIsNumber(v2, n2))
-        return n1 < n2;
-
-    Interpreter* interpreter = callFrame->interpreter();
-    if (interpreter->isJSString(v1) && interpreter->isJSString(v2))
-        return asString(v1)->value() < asString(v2)->value();
-
-    JSValuePtr p1;
-    JSValuePtr p2;
-    bool wasNotString1 = v1->getPrimitiveNumber(callFrame, n1, p1);
-    bool wasNotString2 = v2->getPrimitiveNumber(callFrame, n2, p2);
-
-    if (wasNotString1 | wasNotString2)
-        return n1 < n2;
-
-    return asString(p1)->value() < asString(p2)->value();
-}
-
-static inline bool jsLessEq(CallFrame* callFrame, JSValuePtr v1, JSValuePtr v2)
-{
-    if (JSImmediate::areBothImmediateNumbers(v1, v2))
-        return JSImmediate::getTruncatedInt32(v1) <= JSImmediate::getTruncatedInt32(v2);
-
-    double n1;
-    double n2;
-    if (fastIsNumber(v1, n1) && fastIsNumber(v2, n2))
-        return n1 <= n2;
-
-    Interpreter* interpreter = callFrame->interpreter();
-    if (interpreter->isJSString(v1) && interpreter->isJSString(v2))
-        return !(asString(v2)->value() < asString(v1)->value());
-
-    JSValuePtr p1;
-    JSValuePtr p2;
-    bool wasNotString1 = v1->getPrimitiveNumber(callFrame, n1, p1);
-    bool wasNotString2 = v2->getPrimitiveNumber(callFrame, n2, p2);
-
-    if (wasNotString1 | wasNotString2)
-        return n1 <= n2;
-
-    return !(asString(p2)->value() < asString(p1)->value());
-}
-
-static NEVER_INLINE JSValuePtr jsAddSlowCase(CallFrame* callFrame, JSValuePtr v1, JSValuePtr v2)
-{
-    // exception for the Date exception in defaultValue()
-    JSValuePtr p1 = v1->toPrimitive(callFrame);
-    JSValuePtr p2 = v2->toPrimitive(callFrame);
-
-    if (p1->isString() || p2->isString()) {
-        RefPtr<UString::Rep> value = concatenate(p1->toString(callFrame).rep(), p2->toString(callFrame).rep());
-        if (!value)
-            return throwOutOfMemoryError(callFrame);
-        return jsString(callFrame, value.release());
-    }
-
-    return jsNumber(callFrame, p1->toNumber(callFrame) + p2->toNumber(callFrame));
-}
-
-// Fast-path choices here are based on frequency data from SunSpider:
-//    <times> Add case: <t1> <t2>
-//    ---------------------------
-//    5626160 Add case: 3 3 (of these, 3637690 are for immediate values)
-//    247412  Add case: 5 5
-//    20900   Add case: 5 6
-//    13962   Add case: 5 3
-//    4000    Add case: 3 5
-
-static ALWAYS_INLINE JSValuePtr jsAdd(CallFrame* callFrame, JSValuePtr v1, JSValuePtr v2)
-{
-    double left;
-    double right = 0.0;
-
-    bool rightIsNumber = fastIsNumber(v2, right);
-    if (rightIsNumber && fastIsNumber(v1, left))
-        return jsNumber(callFrame, left + right);
-    
-    bool leftIsString = v1->isString();
-    if (leftIsString && v2->isString()) {
-        RefPtr<UString::Rep> value = concatenate(asString(v1)->value().rep(), asString(v2)->value().rep());
-        if (!value)
-            return throwOutOfMemoryError(callFrame);
-        return jsString(callFrame, value.release());
-    }
-
-    if (rightIsNumber & leftIsString) {
-        RefPtr<UString::Rep> value = JSImmediate::isImmediate(v2) ?
-            concatenate(asString(v1)->value().rep(), JSImmediate::getTruncatedInt32(v2)) :
-            concatenate(asString(v1)->value().rep(), right);
-
-        if (!value)
-            return throwOutOfMemoryError(callFrame);
-        return jsString(callFrame, value.release());
-    }
-
-    // All other cases are pretty uncommon
-    return jsAddSlowCase(callFrame, v1, v2);
-}
-
-static JSValuePtr jsTypeStringForValue(CallFrame* callFrame, JSValuePtr v)
-{
-    if (v->isUndefined())
-        return jsNontrivialString(callFrame, "undefined");
-    if (v->isBoolean())
-        return jsNontrivialString(callFrame, "boolean");
-    if (v->isNumber())
-        return jsNontrivialString(callFrame, "number");
-    if (v->isString())
-        return jsNontrivialString(callFrame, "string");
-    if (v->isObject()) {
-        // Return "undefined" for objects that should be treated
-        // as null when doing comparisons.
-        if (asObject(v)->structure()->typeInfo().masqueradesAsUndefined())
-            return jsNontrivialString(callFrame, "undefined");
-        CallData callData;
-        if (asObject(v)->getCallData(callData) != CallTypeNone)
-            return jsNontrivialString(callFrame, "function");
-    }
-    return jsNontrivialString(callFrame, "object");
-}
-
-static bool jsIsObjectType(JSValuePtr v)
-{
-    if (JSImmediate::isImmediate(v))
-        return v->isNull();
-
-    JSType type = asCell(v)->structure()->typeInfo().type();
-    if (type == NumberType || type == StringType)
-        return false;
-    if (type == ObjectType) {
-        if (asObject(v)->structure()->typeInfo().masqueradesAsUndefined())
-            return false;
-        CallData callData;
-        if (asObject(v)->getCallData(callData) != CallTypeNone)
-            return false;
-    }
-    return true;
-}
-
-static bool jsIsFunctionType(JSValuePtr v)
-{
-    if (v->isObject()) {
-        CallData callData;
-        if (asObject(v)->getCallData(callData) != CallTypeNone)
-            return true;
-    }
-    return false;
-}
-
-NEVER_INLINE bool Interpreter::resolve(CallFrame* callFrame, Instruction* vPC, JSValuePtr& exceptionValue)
+#if USE(INTERPRETER)
+NEVER_INLINE bool Interpreter::resolve(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
     int dst = (vPC + 1)->u.operand;
     int property = (vPC + 2)->u.operand;
@@ -318,11 +108,11 @@ NEVER_INLINE bool Interpreter::resolve(CallFrame* callFrame, Instruction* vPC, J
         JSObject* o = *iter;
         PropertySlot slot(o);
         if (o->getPropertySlot(callFrame, ident, slot)) {
-            JSValuePtr result = slot.getValue(callFrame, ident);
+            JSValue result = slot.getValue(callFrame, ident);
             exceptionValue = callFrame->globalData().exception;
             if (exceptionValue)
                 return false;
-            callFrame[dst] = JSValuePtr(result);
+            callFrame[dst] = JSValue(result);
             return true;
         }
     } while (++iter != end);
@@ -330,7 +120,7 @@ NEVER_INLINE bool Interpreter::resolve(CallFrame* callFrame, Instruction* vPC, J
     return false;
 }
 
-NEVER_INLINE bool Interpreter::resolveSkip(CallFrame* callFrame, Instruction* vPC, JSValuePtr& exceptionValue)
+NEVER_INLINE bool Interpreter::resolveSkip(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
     CodeBlock* codeBlock = callFrame->codeBlock();
 
@@ -351,11 +141,11 @@ NEVER_INLINE bool Interpreter::resolveSkip(CallFrame* callFrame, Instruction* vP
         JSObject* o = *iter;
         PropertySlot slot(o);
         if (o->getPropertySlot(callFrame, ident, slot)) {
-            JSValuePtr result = slot.getValue(callFrame, ident);
+            JSValue result = slot.getValue(callFrame, ident);
             exceptionValue = callFrame->globalData().exception;
             if (exceptionValue)
                 return false;
-            callFrame[dst] = JSValuePtr(result);
+            callFrame[dst] = JSValue(result);
             return true;
         }
     } while (++iter != end);
@@ -363,7 +153,7 @@ NEVER_INLINE bool Interpreter::resolveSkip(CallFrame* callFrame, Instruction* vP
     return false;
 }
 
-NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction* vPC, JSValuePtr& exceptionValue)
+NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
     int dst = (vPC + 1)->u.operand;
     JSGlobalObject* globalObject = static_cast<JSGlobalObject*>((vPC + 2)->u.jsCell);
@@ -373,7 +163,7 @@ NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction*
     int offset = (vPC + 5)->u.operand;
 
     if (structure == globalObject->structure()) {
-        callFrame[dst] = JSValuePtr(globalObject->getDirectOffset(offset));
+        callFrame[dst] = JSValue(globalObject->getDirectOffset(offset));
         return true;
     }
 
@@ -381,21 +171,21 @@ NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction*
     Identifier& ident = codeBlock->identifier(property);
     PropertySlot slot(globalObject);
     if (globalObject->getPropertySlot(callFrame, ident, slot)) {
-        JSValuePtr result = slot.getValue(callFrame, ident);
-        if (slot.isCacheable() && !globalObject->structure()->isDictionary()) {
+        JSValue result = slot.getValue(callFrame, ident);
+        if (slot.isCacheable() && !globalObject->structure()->isDictionary() && slot.slotBase() == globalObject) {
             if (vPC[4].u.structure)
                 vPC[4].u.structure->deref();
             globalObject->structure()->ref();
             vPC[4] = globalObject->structure();
             vPC[5] = slot.cachedOffset();
-            callFrame[dst] = JSValuePtr(result);
+            callFrame[dst] = JSValue(result);
             return true;
         }
 
         exceptionValue = callFrame->globalData().exception;
         if (exceptionValue)
             return false;
-        callFrame[dst] = JSValuePtr(result);
+        callFrame[dst] = JSValue(result);
         return true;
     }
 
@@ -403,37 +193,14 @@ NEVER_INLINE bool Interpreter::resolveGlobal(CallFrame* callFrame, Instruction*
     return false;
 }
 
-static ALWAYS_INLINE JSValuePtr inlineResolveBase(CallFrame* callFrame, Identifier& property, ScopeChainNode* scopeChain)
-{
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator next = iter;
-    ++next;
-    ScopeChainIterator end = scopeChain->end();
-    ASSERT(iter != end);
-
-    PropertySlot slot;
-    JSObject* base;
-    while (true) {
-        base = *iter;
-        if (next == end || base->getPropertySlot(callFrame, property, slot))
-            return base;
-
-        iter = next;
-        ++next;
-    }
-
-    ASSERT_NOT_REACHED();
-    return noValue();
-}
-
 NEVER_INLINE void Interpreter::resolveBase(CallFrame* callFrame, Instruction* vPC)
 {
     int dst = (vPC + 1)->u.operand;
     int property = (vPC + 2)->u.operand;
-    callFrame[dst] = JSValuePtr(inlineResolveBase(callFrame, callFrame->codeBlock()->identifier(property), callFrame->scopeChain()));
+    callFrame[dst] = JSValue(JSC::resolveBase(callFrame, callFrame->codeBlock()->identifier(property), callFrame->scopeChain()));
 }
 
-NEVER_INLINE bool Interpreter::resolveBaseAndProperty(CallFrame* callFrame, Instruction* vPC, JSValuePtr& exceptionValue)
+NEVER_INLINE bool Interpreter::resolveBaseAndProperty(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
     int baseDst = (vPC + 1)->u.operand;
     int propDst = (vPC + 2)->u.operand;
@@ -454,12 +221,12 @@ NEVER_INLINE bool Interpreter::resolveBaseAndProperty(CallFrame* callFrame, Inst
         base = *iter;
         PropertySlot slot(base);
         if (base->getPropertySlot(callFrame, ident, slot)) {
-            JSValuePtr result = slot.getValue(callFrame, ident);
+            JSValue result = slot.getValue(callFrame, ident);
             exceptionValue = callFrame->globalData().exception;
             if (exceptionValue)
                 return false;
-            callFrame[propDst] = JSValuePtr(result);
-            callFrame[baseDst] = JSValuePtr(base);
+            callFrame[propDst] = JSValue(result);
+            callFrame[baseDst] = JSValue(base);
             return true;
         }
         ++iter;
@@ -469,7 +236,7 @@ NEVER_INLINE bool Interpreter::resolveBaseAndProperty(CallFrame* callFrame, Inst
     return false;
 }
 
-NEVER_INLINE bool Interpreter::resolveBaseAndFunc(CallFrame* callFrame, Instruction* vPC, JSValuePtr& exceptionValue)
+NEVER_INLINE bool Interpreter::resolveBaseAndFunc(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
 {
     int baseDst = (vPC + 1)->u.operand;
     int funcDst = (vPC + 2)->u.operand;
@@ -498,13 +265,13 @@ NEVER_INLINE bool Interpreter::resolveBaseAndFunc(CallFrame* callFrame, Instruct
             // that in host objects you always get a valid object for this.
             // We also handle wrapper substitution for the global object at the same time.
             JSObject* thisObj = base->toThisObject(callFrame);
-            JSValuePtr result = slot.getValue(callFrame, ident);
+            JSValue result = slot.getValue(callFrame, ident);
             exceptionValue = callFrame->globalData().exception;
             if (exceptionValue)
                 return false;
 
-            callFrame[baseDst] = JSValuePtr(thisObj);
-            callFrame[funcDst] = JSValuePtr(result);
+            callFrame[baseDst] = JSValue(thisObj);
+            callFrame[funcDst] = JSValue(result);
             return true;
         }
         ++iter;
@@ -514,6 +281,8 @@ NEVER_INLINE bool Interpreter::resolveBaseAndFunc(CallFrame* callFrame, Instruct
     return false;
 }
 
+#endif // USE(INTERPRETER)
+
 ALWAYS_INLINE CallFrame* Interpreter::slideRegisterWindowForCall(CodeBlock* newCodeBlock, RegisterFile* registerFile, CallFrame* callFrame, size_t registerOffset, int argc)
 {
     Register* r = callFrame->registers();
@@ -551,89 +320,57 @@ ALWAYS_INLINE CallFrame* Interpreter::slideRegisterWindowForCall(CodeBlock* newC
     return CallFrame::create(r);
 }
 
-static NEVER_INLINE bool isNotObject(CallFrame* callFrame, bool forInstanceOf, CodeBlock* codeBlock, const Instruction* vPC, JSValuePtr value, JSValuePtr& exceptionData)
+#if USE(INTERPRETER)
+static NEVER_INLINE bool isInvalidParamForIn(CallFrame* callFrame, CodeBlock* codeBlock, const Instruction* vPC, JSValue value, JSValue& exceptionData)
+{
+    if (value.isObject())
+        return false;
+    exceptionData = createInvalidParamError(callFrame, "in" , value, vPC - codeBlock->instructions().begin(), codeBlock);
+    return true;
+}
+
+static NEVER_INLINE bool isInvalidParamForInstanceOf(CallFrame* callFrame, CodeBlock* codeBlock, const Instruction* vPC, JSValue value, JSValue& exceptionData)
 {
-    if (value->isObject())
+    if (value.isObject() && asObject(value)->structure()->typeInfo().implementsHasInstance())
         return false;
-    exceptionData = createInvalidParamError(callFrame, forInstanceOf ? "instanceof" : "in" , value, vPC - codeBlock->instructions().begin(), codeBlock);
+    exceptionData = createInvalidParamError(callFrame, "instanceof" , value, vPC - codeBlock->instructions().begin(), codeBlock);
     return true;
 }
+#endif
 
-NEVER_INLINE JSValuePtr Interpreter::callEval(CallFrame* callFrame, RegisterFile* registerFile, Register* argv, int argc, int registerOffset, JSValuePtr& exceptionValue)
+NEVER_INLINE JSValue Interpreter::callEval(CallFrame* callFrame, RegisterFile* registerFile, Register* argv, int argc, int registerOffset, JSValue& exceptionValue)
 {
     if (argc < 2)
         return jsUndefined();
 
-    JSValuePtr program = argv[1].jsValue(callFrame);
+    JSValue program = argv[1].jsValue();
 
-    if (!program->isString())
+    if (!program.isString())
         return program;
 
     UString programSource = asString(program)->value();
 
+    LiteralParser preparser(callFrame, programSource, LiteralParser::NonStrictJSON);
+    if (JSValue parsedObject = preparser.tryLiteralParse())
+        return parsedObject;
+    
+    
     ScopeChainNode* scopeChain = callFrame->scopeChain();
     CodeBlock* codeBlock = callFrame->codeBlock();
     RefPtr<EvalNode> evalNode = codeBlock->evalCodeCache().get(callFrame, programSource, scopeChain, exceptionValue);
 
-    JSValuePtr result = jsUndefined();
+    JSValue result = jsUndefined();
     if (evalNode)
-        result = callFrame->globalData().interpreter->execute(evalNode.get(), callFrame, callFrame->thisValue()->toThisObject(callFrame), callFrame->registers() - registerFile->start() + registerOffset, scopeChain, &exceptionValue);
+        result = callFrame->globalData().interpreter->execute(evalNode.get(), callFrame, callFrame->thisValue().toThisObject(callFrame), callFrame->registers() - registerFile->start() + registerOffset, scopeChain, &exceptionValue);
 
     return result;
 }
 
 Interpreter::Interpreter()
     : m_sampler(0)
-#if ENABLE(JIT)
-    , m_ctiArrayLengthTrampoline(0)
-    , m_ctiStringLengthTrampoline(0)
-    , m_ctiVirtualCallPreLink(0)
-    , m_ctiVirtualCallLink(0)
-    , m_ctiVirtualCall(0)
-#endif
     , m_reentryDepth(0)
-    , m_timeoutTime(0)
-    , m_timeAtLastCheckTimeout(0)
-    , m_timeExecuting(0)
-    , m_timeoutCheckCount(0)
-    , m_ticksUntilNextTimeoutCheck(initialTickCountThreshold)
 {
-    initTimeout();
     privateExecute(InitializeAndReturn, 0, 0, 0);
-    
-    // Bizarrely, calling fastMalloc here is faster than allocating space on the stack.
-    void* storage = fastMalloc(sizeof(CollectorBlock));
-
-    JSCell* jsArray = new (storage) JSArray(JSArray::createStructure(jsNull()));
-    m_jsArrayVptr = jsArray->vptr();
-    jsArray->~JSCell();
-
-    JSCell* jsByteArray = new (storage) JSByteArray(JSByteArray::VPtrStealingHack);
-    m_jsByteArrayVptr = jsByteArray->vptr();
-    jsByteArray->~JSCell();
-
-    JSCell* jsString = new (storage) JSString(JSString::VPtrStealingHack);
-    m_jsStringVptr = jsString->vptr();
-    jsString->~JSCell();
-
-    JSCell* jsFunction = new (storage) JSFunction(JSFunction::createStructure(jsNull()));
-    m_jsFunctionVptr = jsFunction->vptr();
-    jsFunction->~JSCell();
-    
-    fastFree(storage);
-}
-
-void Interpreter::initialize(JSGlobalData* globalData)
-{
-#if ENABLE(JIT)
-    JIT::compileCTIMachineTrampolines(globalData);
-#else
-    UNUSED_PARAM(globalData);
-#endif
-}
-
-Interpreter::~Interpreter()
-{
 }
 
 #ifndef NDEBUG
@@ -733,7 +470,7 @@ bool Interpreter::isOpcode(Opcode opcode)
 #endif
 }
 
-NEVER_INLINE bool Interpreter::unwindCallFrame(CallFrame*& callFrame, JSValuePtr exceptionValue, unsigned& bytecodeOffset, CodeBlock*& codeBlock)
+NEVER_INLINE bool Interpreter::unwindCallFrame(CallFrame*& callFrame, JSValue exceptionValue, unsigned& bytecodeOffset, CodeBlock*& codeBlock)
 {
     CodeBlock* oldCodeBlock = codeBlock;
     ScopeChainNode* scopeChain = callFrame->scopeChain();
@@ -772,16 +509,16 @@ NEVER_INLINE bool Interpreter::unwindCallFrame(CallFrame*& callFrame, JSValuePtr
         return false;
 
     codeBlock = callFrame->codeBlock();
-    bytecodeOffset = bytecodeOffsetForPC(codeBlock, returnPC);
+    bytecodeOffset = bytecodeOffsetForPC(callFrame, codeBlock, returnPC);
     return true;
 }
 
-NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSValuePtr& exceptionValue, unsigned bytecodeOffset, bool explicitThrow)
+NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSValue& exceptionValue, unsigned bytecodeOffset, bool explicitThrow)
 {
     // Set up the exception object
 
     CodeBlock* codeBlock = callFrame->codeBlock();
-    if (exceptionValue->isObject()) {
+    if (exceptionValue.isObject()) {
         JSObject* exception = asObject(exceptionValue);
         if (exception->isNotAnObjectErrorStub()) {
             exception = createNotAnObjectError(callFrame, static_cast<JSNotAnObjectErrorStub*>(exception), bytecodeOffset, codeBlock);
@@ -830,13 +567,13 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
     if (Profiler* profiler = *Profiler::enabledProfilerReference()) {
 #if !ENABLE(JIT)
         if (isCallBytecode(codeBlock->instructions()[bytecodeOffset].u.opcode))
-            profiler->didExecute(callFrame, callFrame[codeBlock->instructions()[bytecodeOffset + 2].u.operand].jsValue(callFrame));
+            profiler->didExecute(callFrame, callFrame[codeBlock->instructions()[bytecodeOffset + 2].u.operand].jsValue());
         else if (codeBlock->instructions()[bytecodeOffset + 8].u.opcode == getOpcode(op_construct))
-            profiler->didExecute(callFrame, callFrame[codeBlock->instructions()[bytecodeOffset + 10].u.operand].jsValue(callFrame));
+            profiler->didExecute(callFrame, callFrame[codeBlock->instructions()[bytecodeOffset + 10].u.operand].jsValue());
 #else
         int functionRegisterIndex;
         if (codeBlock->functionRegisterForBytecodeOffset(bytecodeOffset, functionRegisterIndex))
-            profiler->didExecute(callFrame, callFrame[functionRegisterIndex].jsValue(callFrame));
+            profiler->didExecute(callFrame, callFrame[functionRegisterIndex].jsValue());
 #endif
     }
 
@@ -861,13 +598,15 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
     return handler;
 }
 
-JSValuePtr Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame, ScopeChainNode* scopeChain, JSObject* thisObj, JSValuePtr* exception)
+JSValue Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame, ScopeChainNode* scopeChain, JSObject* thisObj, JSValue* exception)
 {
     ASSERT(!scopeChain->globalData->exception);
 
-    if (m_reentryDepth >= MaxReentryDepth) {
-        *exception = createStackOverflowError(callFrame);
-        return jsNull();
+    if (m_reentryDepth >= MaxSecondaryThreadReentryDepth) {
+        if (!isMainThread() || m_reentryDepth >= MaxMainThreadReentryDepth) {
+            *exception = createStackOverflowError(callFrame);
+            return jsNull();
+        }
     }
 
     CodeBlock* codeBlock = &programNode->bytecode(scopeChain);
@@ -886,7 +625,7 @@ JSValuePtr Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame,
     globalObject->copyGlobalsTo(m_registerFile);
 
     CallFrame* newCallFrame = CallFrame::create(oldEnd + codeBlock->m_numParameters + RegisterFile::CallFrameHeaderSize);
-    newCallFrame[codeBlock->thisRegister()] = JSValuePtr(thisObj);
+    newCallFrame[codeBlock->thisRegister()] = JSValue(thisObj);
     newCallFrame->init(codeBlock, 0, scopeChain, CallFrame::noCaller(), 0, 0, 0);
 
     if (codeBlock->needsFullScopeChain())
@@ -896,15 +635,13 @@ JSValuePtr Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame,
     if (*profiler)
         (*profiler)->willExecute(newCallFrame, programNode->sourceURL(), programNode->lineNo());
 
-    JSValuePtr result;
+    JSValue result;
     {
         SamplingTool::CallRecord callRecord(m_sampler);
 
         m_reentryDepth++;
 #if ENABLE(JIT)
-        if (!codeBlock->jitCode())
-            JIT::compile(scopeChain->globalData, codeBlock);
-        result = JIT::execute(codeBlock->jitCode(), &m_registerFile, newCallFrame, scopeChain->globalData, exception);
+        result = programNode->jitCode(scopeChain).execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
 #else
         result = privateExecute(Normal, &m_registerFile, newCallFrame, exception);
 #endif
@@ -922,13 +659,15 @@ JSValuePtr Interpreter::execute(ProgramNode* programNode, CallFrame* callFrame,
     return result;
 }
 
-JSValuePtr Interpreter::execute(FunctionBodyNode* functionBodyNode, CallFrame* callFrame, JSFunction* function, JSObject* thisObj, const ArgList& args, ScopeChainNode* scopeChain, JSValuePtr* exception)
+JSValue Interpreter::execute(FunctionBodyNode* functionBodyNode, CallFrame* callFrame, JSFunction* function, JSObject* thisObj, const ArgList& args, ScopeChainNode* scopeChain, JSValue* exception)
 {
     ASSERT(!scopeChain->globalData->exception);
 
-    if (m_reentryDepth >= MaxReentryDepth) {
-        *exception = createStackOverflowError(callFrame);
-        return jsNull();
+    if (m_reentryDepth >= MaxSecondaryThreadReentryDepth) {
+        if (!isMainThread() || m_reentryDepth >= MaxMainThreadReentryDepth) {
+            *exception = createStackOverflowError(callFrame);
+            return jsNull();
+        }
     }
 
     Register* oldEnd = m_registerFile.end();
@@ -943,7 +682,7 @@ JSValuePtr Interpreter::execute(FunctionBodyNode* functionBodyNode, CallFrame* c
 
     CallFrame* newCallFrame = CallFrame::create(oldEnd);
     size_t dst = 0;
-    newCallFrame[0] = JSValuePtr(thisObj);
+    newCallFrame[0] = JSValue(thisObj);
     ArgList::const_iterator end = args.end();
     for (ArgList::const_iterator it = args.begin(); it != end; ++it)
         newCallFrame[++dst] = *it;
@@ -960,17 +699,15 @@ JSValuePtr Interpreter::execute(FunctionBodyNode* functionBodyNode, CallFrame* c
 
     Profiler** profiler = Profiler::enabledProfilerReference();
     if (*profiler)
-        (*profiler)->willExecute(newCallFrame, function);
+        (*profiler)->willExecute(callFrame, function);
 
-    JSValuePtr result;
+    JSValue result;
     {
         SamplingTool::CallRecord callRecord(m_sampler);
 
         m_reentryDepth++;
 #if ENABLE(JIT)
-        if (!codeBlock->jitCode())
-            JIT::compile(scopeChain->globalData, codeBlock);
-        result = JIT::execute(codeBlock->jitCode(), &m_registerFile, newCallFrame, scopeChain->globalData, exception);
+        result = functionBodyNode->jitCode(scopeChain).execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
 #else
         result = privateExecute(Normal, &m_registerFile, newCallFrame, exception);
 #endif
@@ -978,24 +715,97 @@ JSValuePtr Interpreter::execute(FunctionBodyNode* functionBodyNode, CallFrame* c
     }
 
     if (*profiler)
-        (*profiler)->didExecute(newCallFrame, function);
+        (*profiler)->didExecute(callFrame, function);
 
     m_registerFile.shrink(oldEnd);
     return result;
 }
 
-JSValuePtr Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject* thisObj, ScopeChainNode* scopeChain, JSValuePtr* exception)
+CallFrameClosure Interpreter::prepareForRepeatCall(FunctionBodyNode* functionBodyNode, CallFrame* callFrame, JSFunction* function, int argCount, ScopeChainNode* scopeChain, JSValue* exception)
+{
+    ASSERT(!scopeChain->globalData->exception);
+    
+    if (m_reentryDepth >= MaxSecondaryThreadReentryDepth) {
+        if (!isMainThread() || m_reentryDepth >= MaxMainThreadReentryDepth) {
+            *exception = createStackOverflowError(callFrame);
+            return CallFrameClosure();
+        }
+    }
+    
+    Register* oldEnd = m_registerFile.end();
+    int argc = 1 + argCount; // implicit "this" parameter
+    
+    if (!m_registerFile.grow(oldEnd + argc)) {
+        *exception = createStackOverflowError(callFrame);
+        return CallFrameClosure();
+    }
+
+    CallFrame* newCallFrame = CallFrame::create(oldEnd);
+    size_t dst = 0;
+    for (int i = 0; i < argc; ++i)
+        newCallFrame[++dst] = jsUndefined();
+    
+    CodeBlock* codeBlock = &functionBodyNode->bytecode(scopeChain);
+    newCallFrame = slideRegisterWindowForCall(codeBlock, &m_registerFile, newCallFrame, argc + RegisterFile::CallFrameHeaderSize, argc);
+    if (UNLIKELY(!newCallFrame)) {
+        *exception = createStackOverflowError(callFrame);
+        m_registerFile.shrink(oldEnd);
+        return CallFrameClosure();
+    }
+    // a 0 codeBlock indicates a built-in caller
+    newCallFrame->init(codeBlock, 0, scopeChain, callFrame->addHostCallFrameFlag(), 0, argc, function);
+#if ENABLE(JIT)
+    functionBodyNode->jitCode(scopeChain);
+#endif
+
+    CallFrameClosure result = { callFrame, newCallFrame, function, functionBodyNode, scopeChain->globalData, oldEnd, scopeChain, codeBlock->m_numParameters, argc };
+    return result;
+}
+
+JSValue Interpreter::execute(CallFrameClosure& closure, JSValue* exception) 
+{
+    closure.resetCallFrame();
+    Profiler** profiler = Profiler::enabledProfilerReference();
+    if (*profiler)
+        (*profiler)->willExecute(closure.oldCallFrame, closure.function);
+    
+    JSValue result;
+    {
+        SamplingTool::CallRecord callRecord(m_sampler);
+        
+        m_reentryDepth++;
+#if ENABLE(JIT)
+        result = closure.functionBody->generatedJITCode().execute(&m_registerFile, closure.newCallFrame, closure.globalData, exception);
+#else
+        result = privateExecute(Normal, &m_registerFile, closure.newCallFrame, exception);
+#endif
+        m_reentryDepth--;
+    }
+    
+    if (*profiler)
+        (*profiler)->didExecute(closure.oldCallFrame, closure.function);
+    return result;
+}
+
+void Interpreter::endRepeatCall(CallFrameClosure& closure)
+{
+    m_registerFile.shrink(closure.oldEnd);
+}
+
+JSValue Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject* thisObj, ScopeChainNode* scopeChain, JSValue* exception)
 {
     return execute(evalNode, callFrame, thisObj, m_registerFile.size() + evalNode->bytecode(scopeChain).m_numParameters + RegisterFile::CallFrameHeaderSize, scopeChain, exception);
 }
 
-JSValuePtr Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject* thisObj, int globalRegisterOffset, ScopeChainNode* scopeChain, JSValuePtr* exception)
+JSValue Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObject* thisObj, int globalRegisterOffset, ScopeChainNode* scopeChain, JSValue* exception)
 {
     ASSERT(!scopeChain->globalData->exception);
 
-    if (m_reentryDepth >= MaxReentryDepth) {
-        *exception = createStackOverflowError(callFrame);
-        return jsNull();
+    if (m_reentryDepth >= MaxSecondaryThreadReentryDepth) {
+        if (!isMainThread() || m_reentryDepth >= MaxMainThreadReentryDepth) {
+            *exception = createStackOverflowError(callFrame);
+            return jsNull();
+        }
     }
 
     DynamicGlobalObjectScope globalObjectScope(callFrame, callFrame->globalData().dynamicGlobalObject ? callFrame->globalData().dynamicGlobalObject : scopeChain->globalObject());
@@ -1044,7 +854,7 @@ JSValuePtr Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObje
     CallFrame* newCallFrame = CallFrame::create(m_registerFile.start() + globalRegisterOffset);
 
     // a 0 codeBlock indicates a built-in caller
-    newCallFrame[codeBlock->thisRegister()] = JSValuePtr(thisObj);
+    newCallFrame[codeBlock->thisRegister()] = JSValue(thisObj);
     newCallFrame->init(codeBlock, 0, scopeChain, callFrame->addHostCallFrameFlag(), 0, 0, 0);
 
     if (codeBlock->needsFullScopeChain())
@@ -1054,15 +864,13 @@ JSValuePtr Interpreter::execute(EvalNode* evalNode, CallFrame* callFrame, JSObje
     if (*profiler)
         (*profiler)->willExecute(newCallFrame, evalNode->sourceURL(), evalNode->lineNo());
 
-    JSValuePtr result;
+    JSValue result;
     {
         SamplingTool::CallRecord callRecord(m_sampler);
 
         m_reentryDepth++;
 #if ENABLE(JIT)
-        if (!codeBlock->jitCode())
-            JIT::compile(scopeChain->globalData, codeBlock);
-        result = JIT::execute(codeBlock->jitCode(), &m_registerFile, newCallFrame, scopeChain->globalData, exception);
+        result = evalNode->jitCode(scopeChain).execute(&m_registerFile, newCallFrame, scopeChain->globalData, exception);
 #else
         result = privateExecute(Normal, &m_registerFile, newCallFrame, exception);
 #endif
@@ -1103,123 +911,27 @@ NEVER_INLINE void Interpreter::debug(CallFrame* callFrame, DebugHookID debugHook
             return;
     }
 }
-
-void Interpreter::resetTimeoutCheck()
-{
-    m_ticksUntilNextTimeoutCheck = initialTickCountThreshold;
-    m_timeAtLastCheckTimeout = 0;
-    m_timeExecuting = 0;
-}
-
-// Returns the time the current thread has spent executing, in milliseconds.
-static inline unsigned getCPUTime()
-{
-#if PLATFORM(DARWIN)
-    mach_msg_type_number_t infoCount = THREAD_BASIC_INFO_COUNT;
-    thread_basic_info_data_t info;
-
-    // Get thread information
-    mach_port_t threadPort = mach_thread_self();
-    thread_info(threadPort, THREAD_BASIC_INFO, reinterpret_cast<thread_info_t>(&info), &infoCount);
-    mach_port_deallocate(mach_task_self(), threadPort);
-    
-    unsigned time = info.user_time.seconds * 1000 + info.user_time.microseconds / 1000;
-    time += info.system_time.seconds * 1000 + info.system_time.microseconds / 1000;
-    
-    return time;
-#elif HAVE(SYS_TIME_H)
-    // FIXME: This should probably use getrusage with the RUSAGE_THREAD flag.
-    struct timeval tv;
-    gettimeofday(&tv, 0);
-    return tv.tv_sec * 1000 + tv.tv_usec / 1000;
-#elif PLATFORM(QT)
-    QDateTime t = QDateTime::currentDateTime();
-    return t.toTime_t() * 1000 + t.time().msec();
-#elif PLATFORM(WIN_OS)
-    union {
-        FILETIME fileTime;
-        unsigned long long fileTimeAsLong;
-    } userTime, kernelTime;
-    
-    // GetThreadTimes won't accept NULL arguments so we pass these even though
-    // they're not used.
-    FILETIME creationTime, exitTime;
-    
-    GetThreadTimes(GetCurrentThread(), &creationTime, &exitTime, &kernelTime.fileTime, &userTime.fileTime);
-    
-    return userTime.fileTimeAsLong / 10000 + kernelTime.fileTimeAsLong / 10000;
-#else
-#error Platform does not have getCurrentTime function
-#endif
-}
-
-// We have to return a JSValue here, gcc seems to produce worse code if 
-// we attempt to return a bool
-ALWAYS_INLINE bool Interpreter::checkTimeout(JSGlobalObject* globalObject)
-{
-    unsigned currentTime = getCPUTime();
-    
-    if (!m_timeAtLastCheckTimeout) {
-        // Suspicious amount of looping in a script -- start timing it
-        m_timeAtLastCheckTimeout = currentTime;
-        return false;
-    }
     
-    unsigned timeDiff = currentTime - m_timeAtLastCheckTimeout;
-    
-    if (timeDiff == 0)
-        timeDiff = 1;
-    
-    m_timeExecuting += timeDiff;
-    m_timeAtLastCheckTimeout = currentTime;
-    
-    // Adjust the tick threshold so we get the next checkTimeout call in the interval specified in 
-    // preferredScriptCheckTimeInterval
-    m_ticksUntilNextTimeoutCheck = static_cast<unsigned>((static_cast<float>(preferredScriptCheckTimeInterval) / timeDiff) * m_ticksUntilNextTimeoutCheck);
-    // If the new threshold is 0 reset it to the default threshold. This can happen if the timeDiff is higher than the
-    // preferred script check time interval.
-    if (m_ticksUntilNextTimeoutCheck == 0)
-        m_ticksUntilNextTimeoutCheck = initialTickCountThreshold;
-    
-    if (m_timeoutTime && m_timeExecuting > m_timeoutTime) {
-        if (globalObject->shouldInterruptScript())
-            return true;
-        
-        resetTimeoutCheck();
-    }
-    
-    return false;
-}
-
+#if USE(INTERPRETER)
 NEVER_INLINE ScopeChainNode* Interpreter::createExceptionScope(CallFrame* callFrame, const Instruction* vPC)
 {
     int dst = (++vPC)->u.operand;
     CodeBlock* codeBlock = callFrame->codeBlock();
     Identifier& property = codeBlock->identifier((++vPC)->u.operand);
-    JSValuePtr value = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+    JSValue value = callFrame[(++vPC)->u.operand].jsValue();
     JSObject* scope = new (callFrame) JSStaticScopeObject(callFrame, property, value, DontDelete);
-    callFrame[dst] = JSValuePtr(scope);
+    callFrame[dst] = JSValue(scope);
 
     return callFrame->scopeChain()->push(scope);
 }
 
-static StructureChain* cachePrototypeChain(CallFrame* callFrame, Structure* structure)
-{
-    JSValuePtr prototype = structure->prototypeForLookup(callFrame);
-    if (JSImmediate::isImmediate(prototype))
-        return 0;
-    RefPtr<StructureChain> chain = StructureChain::create(asObject(prototype)->structure());
-    structure->setCachedPrototypeChain(chain.release());
-    return structure->cachedPrototypeChain();
-}
-
-NEVER_INLINE void Interpreter::tryCachePutByID(CallFrame* callFrame, CodeBlock* codeBlock, Instruction* vPC, JSValuePtr baseValue, const PutPropertySlot& slot)
+NEVER_INLINE void Interpreter::tryCachePutByID(CallFrame* callFrame, CodeBlock* codeBlock, Instruction* vPC, JSValue baseValue, const PutPropertySlot& slot)
 {
     // Recursive invocation may already have specialized this instruction.
     if (vPC[0].u.opcode != getOpcode(op_put_by_id))
         return;
 
-    if (JSImmediate::isImmediate(baseValue))
+    if (!baseValue.isCell())
         return;
 
     // Uncacheable: give up.
@@ -1258,21 +970,18 @@ NEVER_INLINE void Interpreter::tryCachePutByID(CallFrame* callFrame, CodeBlock*
         return;
     }
 
+    StructureChain* protoChain = structure->prototypeChain(callFrame);
+    if (!protoChain->isCacheable()) {
+        vPC[0] = getOpcode(op_put_by_id_generic);
+        return;
+    }
+
     // Structure transition, cache transition info
     if (slot.type() == PutPropertySlot::NewProperty) {
         vPC[0] = getOpcode(op_put_by_id_transition);
         vPC[4] = structure->previousID();
         vPC[5] = structure;
-        StructureChain* chain = structure->cachedPrototypeChain();
-        if (!chain) {
-            chain = cachePrototypeChain(callFrame, structure);
-            if (!chain) {
-                // This happens if someone has manually inserted null into the prototype chain
-                vPC[0] = getOpcode(op_put_by_id_generic);
-                return;
-            }
-        }
-        vPC[6] = chain;
+        vPC[6] = protoChain;
         vPC[7] = slot.cachedOffset();
         codeBlock->refStructures(vPC);
         return;
@@ -1290,55 +999,25 @@ NEVER_INLINE void Interpreter::uncachePutByID(CodeBlock* codeBlock, Instruction*
     vPC[4] = 0;
 }
 
-static size_t countPrototypeChainEntriesAndCheckForProxies(CallFrame* callFrame, JSValuePtr baseValue, const PropertySlot& slot)
-{
-    JSCell* cell = asCell(baseValue);
-    size_t count = 0;
-
-    while (slot.slotBase() != cell) {
-        JSValuePtr v = cell->structure()->prototypeForLookup(callFrame);
-
-        // If we didn't find slotBase in baseValue's prototype chain, then baseValue
-        // must be a proxy for another object.
-
-        if (v->isNull())
-            return 0;
-
-        cell = asCell(v);
-
-        // Since we're accessing a prototype in a loop, it's a good bet that it
-        // should not be treated as a dictionary.
-        if (cell->structure()->isDictionary()) {
-            RefPtr<Structure> transition = Structure::fromDictionaryTransition(cell->structure());
-            asObject(cell)->setStructure(transition.release());
-            cell->structure()->setCachedPrototypeChain(0);
-        }
-
-        ++count;
-    }
-    
-    ASSERT(count);
-    return count;
-}
-
-NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock* codeBlock, Instruction* vPC, JSValuePtr baseValue, const Identifier& propertyName, const PropertySlot& slot)
+NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock* codeBlock, Instruction* vPC, JSValue baseValue, const Identifier& propertyName, const PropertySlot& slot)
 {
     // Recursive invocation may already have specialized this instruction.
     if (vPC[0].u.opcode != getOpcode(op_get_by_id))
         return;
 
     // FIXME: Cache property access for immediates.
-    if (JSImmediate::isImmediate(baseValue)) {
+    if (!baseValue.isCell()) {
         vPC[0] = getOpcode(op_get_by_id_generic);
         return;
     }
 
-    if (isJSArray(baseValue) && propertyName == callFrame->propertyNames().length) {
+    JSGlobalData* globalData = &callFrame->globalData();
+    if (isJSArray(globalData, baseValue) && propertyName == callFrame->propertyNames().length) {
         vPC[0] = getOpcode(op_get_array_length);
         return;
     }
 
-    if (isJSString(baseValue) && propertyName == callFrame->propertyNames().length) {
+    if (isJSString(globalData, baseValue) && propertyName == callFrame->propertyNames().length) {
         vPC[0] = getOpcode(op_get_string_length);
         return;
     }
@@ -1381,17 +1060,14 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
     }
 
     if (slot.slotBase() == structure->prototypeForLookup(callFrame)) {
-        ASSERT(slot.slotBase()->isObject());
+        ASSERT(slot.slotBase().isObject());
 
         JSObject* baseObject = asObject(slot.slotBase());
 
         // Since we're accessing a prototype in a loop, it's a good bet that it
         // should not be treated as a dictionary.
-        if (baseObject->structure()->isDictionary()) {
-            RefPtr<Structure> transition = Structure::fromDictionaryTransition(baseObject->structure());
-            baseObject->setStructure(transition.release());
-            asCell(baseValue)->structure()->setCachedPrototypeChain(0);
-        }
+        if (baseObject->structure()->isDictionary())
+            baseObject->setStructure(Structure::fromDictionaryTransition(baseObject->structure()));
 
         vPC[0] = getOpcode(op_get_by_id_proto);
         vPC[5] = baseObject->structure();
@@ -1407,14 +1083,15 @@ NEVER_INLINE void Interpreter::tryCacheGetByID(CallFrame* callFrame, CodeBlock*
         return;
     }
 
-    StructureChain* chain = structure->cachedPrototypeChain();
-    if (!chain)
-        chain = cachePrototypeChain(callFrame, structure);
-    ASSERT(chain);
+    StructureChain* protoChain = structure->prototypeChain(callFrame);
+    if (!protoChain->isCacheable()) {
+        vPC[0] = getOpcode(op_get_by_id_generic);
+        return;
+    }
 
     vPC[0] = getOpcode(op_get_by_id_chain);
     vPC[4] = structure;
-    vPC[5] = chain;
+    vPC[5] = protoChain;
     vPC[6] = count;
     vPC[7] = slot.cachedOffset();
     codeBlock->refStructures(vPC);
@@ -1427,7 +1104,9 @@ NEVER_INLINE void Interpreter::uncacheGetByID(CodeBlock* codeBlock, Instruction*
     vPC[4] = 0;
 }
 
-JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFile, CallFrame* callFrame, JSValuePtr* exception)
+#endif // USE(INTERPRETER)
+
+JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFile, CallFrame* callFrame, JSValue* exception)
 {
     // One-time initialization of our address tables. We have to put this code
     // here because our labels are only in scope inside this function.
@@ -1442,25 +1121,31 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
             #undef ADD_OPCODE_ID
             ASSERT(m_opcodeIDTable.size() == numOpcodeIDs);
         #endif // HAVE(COMPUTED_GOTO)
-        return noValue();
+        return JSValue();
     }
 
 #if ENABLE(JIT)
     // Currently with CTI enabled we never interpret functions
     ASSERT_NOT_REACHED();
 #endif
+#if !USE(INTERPRETER)
+    UNUSED_PARAM(registerFile);
+    UNUSED_PARAM(callFrame);
+    UNUSED_PARAM(exception);
+    return JSValue();
+#else
 
     JSGlobalData* globalData = &callFrame->globalData();
-    JSValuePtr exceptionValue = noValue();
+    JSValue exceptionValue;
     HandlerInfo* handler = 0;
 
     Instruction* vPC = callFrame->codeBlock()->instructions().begin();
     Profiler** enabledProfilerReference = Profiler::enabledProfilerReference();
-    unsigned tickCount = m_ticksUntilNextTimeoutCheck + 1;
+    unsigned tickCount = globalData->timeoutChecker.ticksUntilNextCheck();
 
 #define CHECK_FOR_EXCEPTION() \
     do { \
-        if (UNLIKELY(globalData->exception != noValue())) { \
+        if (UNLIKELY(globalData->exception != JSValue())) { \
             exceptionValue = globalData->exception; \
             goto vm_throw; \
         } \
@@ -1472,19 +1157,17 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
 
 #define CHECK_FOR_TIMEOUT() \
     if (!--tickCount) { \
-        if (checkTimeout(callFrame->dynamicGlobalObject())) { \
+        if (globalData->timeoutChecker.didTimeOut(callFrame)) { \
             exceptionValue = jsNull(); \
             goto vm_throw; \
         } \
-        tickCount = m_ticksUntilNextTimeoutCheck; \
+        tickCount = globalData->timeoutChecker.ticksUntilNextCheck(); \
     }
     
 #if ENABLE(OPCODE_SAMPLING)
     #define SAMPLE(codeBlock, vPC) m_sampler->sample(codeBlock, vPC)
-    #define CTI_SAMPLER ARG_globalData->interpreter->sampler()
 #else
     #define SAMPLE(codeBlock, vPC)
-    #define CTI_SAMPLER 0
 #endif
 
 #if HAVE(COMPUTED_GOTO)
@@ -1514,7 +1197,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            constructor, and puts the result in register dst.
         */
         int dst = (++vPC)->u.operand;
-        callFrame[dst] = JSValuePtr(constructEmptyObject(callFrame));
+        callFrame[dst] = JSValue(constructEmptyObject(callFrame));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -1531,7 +1214,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int firstArg = (++vPC)->u.operand;
         int argCount = (++vPC)->u.operand;
         ArgList args(callFrame->registers() + firstArg, argCount);
-        callFrame[dst] = JSValuePtr(constructArray(callFrame, args));
+        callFrame[dst] = JSValue(constructArray(callFrame, args));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -1545,7 +1228,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int regExp = (++vPC)->u.operand;
-        callFrame[dst] = JSValuePtr(new (globalData) RegExpObject(callFrame->scopeChain()->globalObject()->regExpStructure(), callFrame->codeBlock()->regexp(regExp)));
+        callFrame[dst] = JSValue(new (globalData) RegExpObject(callFrame->scopeChain()->globalObject()->regExpStructure(), callFrame->codeBlock()->regexp(regExp)));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -1570,12 +1253,12 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            as a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        if (JSImmediate::areBothImmediateNumbers(src1, src2))
-            callFrame[dst] = jsBoolean(src1 == src2);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
+        if (JSFastMath::canDoFastBitwiseOperations(src1, src2))
+            callFrame[dst] = JSFastMath::equal(src1, src2);
         else {
-            JSValuePtr result = jsBoolean(equalSlowCase(callFrame, src1, src2));
+            JSValue result = jsBoolean(JSValue::equalSlowCase(callFrame, src1, src2));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1590,15 +1273,15 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            operator, and puts the result as a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src = callFrame[(++vPC)->u.operand].jsValue();
 
-        if (src->isUndefinedOrNull()) {
+        if (src.isUndefinedOrNull()) {
             callFrame[dst] = jsBoolean(true);
             ++vPC;
             NEXT_INSTRUCTION();
         }
         
-        callFrame[dst] = jsBoolean(!JSImmediate::isImmediate(src) && src->asCell()->structure()->typeInfo().masqueradesAsUndefined());
+        callFrame[dst] = jsBoolean(src.isCell() && src.asCell()->structure()->typeInfo().masqueradesAsUndefined());
         ++vPC;
         NEXT_INSTRUCTION();
     }
@@ -1610,12 +1293,12 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            result as a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        if (JSImmediate::areBothImmediateNumbers(src1, src2))
-            callFrame[dst] = jsBoolean(src1 != src2);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
+        if (JSFastMath::canDoFastBitwiseOperations(src1, src2))
+            callFrame[dst] = JSFastMath::notEqual(src1, src2);
         else {
-            JSValuePtr result = jsBoolean(!equalSlowCase(callFrame, src1, src2));
+            JSValue result = jsBoolean(!JSValue::equalSlowCase(callFrame, src1, src2));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1630,15 +1313,15 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            operator, and puts the result as a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src = callFrame[(++vPC)->u.operand].jsValue();
 
-        if (src->isUndefinedOrNull()) {
+        if (src.isUndefinedOrNull()) {
             callFrame[dst] = jsBoolean(false);
             ++vPC;
             NEXT_INSTRUCTION();
         }
         
-        callFrame[dst] = jsBoolean(JSImmediate::isImmediate(src) || !asCell(src)->structure()->typeInfo().masqueradesAsUndefined());
+        callFrame[dst] = jsBoolean(!src.isCell() || !asCell(src)->structure()->typeInfo().masqueradesAsUndefined());
         ++vPC;
         NEXT_INSTRUCTION();
     }
@@ -1650,14 +1333,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            result as a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        if (JSImmediate::areBothImmediate(src1, src2))
-            callFrame[dst] = jsBoolean(src1 == src2);
-        else if (JSImmediate::isEitherImmediate(src1, src2) & (src1 != JSImmediate::zeroImmediate()) & (src2 != JSImmediate::zeroImmediate()))
-            callFrame[dst] = jsBoolean(false);
-        else
-            callFrame[dst] = jsBoolean(strictEqualSlowCase(src1, src2));
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
+        callFrame[dst] = jsBoolean(JSValue::strictEqual(src1, src2));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -1670,15 +1348,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            puts the result as a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-
-        if (JSImmediate::areBothImmediate(src1, src2))
-            callFrame[dst] = jsBoolean(src1 != src2);
-        else if (JSImmediate::isEitherImmediate(src1, src2) & (src1 != JSImmediate::zeroImmediate()) & (src2 != JSImmediate::zeroImmediate()))
-            callFrame[dst] = jsBoolean(true);
-        else
-            callFrame[dst] = jsBoolean(!strictEqualSlowCase(src1, src2));
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
+        callFrame[dst] = jsBoolean(!JSValue::strictEqual(src1, src2));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -1691,9 +1363,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr result = jsBoolean(jsLess(callFrame, src1, src2));
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue result = jsBoolean(jsLess(callFrame, src1, src2));
         CHECK_FOR_EXCEPTION();
         callFrame[dst] = result;
 
@@ -1708,9 +1380,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            puts the result as a boolean in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr result = jsBoolean(jsLessEq(callFrame, src1, src2));
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue result = jsBoolean(jsLessEq(callFrame, src1, src2));
         CHECK_FOR_EXCEPTION();
         callFrame[dst] = result;
 
@@ -1724,11 +1396,11 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            back in register srcDst.
         */
         int srcDst = (++vPC)->u.operand;
-        JSValuePtr v = callFrame[srcDst].jsValue(callFrame);
-        if (JSImmediate::canDoFastAdditiveOperations(v))
-            callFrame[srcDst] = JSValuePtr(JSImmediate::incImmediateNumber(v));
+        JSValue v = callFrame[srcDst].jsValue();
+        if (JSFastMath::canDoFastAdditiveOperations(v))
+            callFrame[srcDst] = JSValue(JSFastMath::incImmediateNumber(v));
         else {
-            JSValuePtr result = jsNumber(callFrame, v->toNumber(callFrame) + 1);
+            JSValue result = jsNumber(callFrame, v.toNumber(callFrame) + 1);
             CHECK_FOR_EXCEPTION();
             callFrame[srcDst] = result;
         }
@@ -1743,11 +1415,11 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            back in register srcDst.
         */
         int srcDst = (++vPC)->u.operand;
-        JSValuePtr v = callFrame[srcDst].jsValue(callFrame);
-        if (JSImmediate::canDoFastAdditiveOperations(v))
-            callFrame[srcDst] = JSValuePtr(JSImmediate::decImmediateNumber(v));
+        JSValue v = callFrame[srcDst].jsValue();
+        if (JSFastMath::canDoFastAdditiveOperations(v))
+            callFrame[srcDst] = JSValue(JSFastMath::decImmediateNumber(v));
         else {
-            JSValuePtr result = jsNumber(callFrame, v->toNumber(callFrame) - 1);
+            JSValue result = jsNumber(callFrame, v.toNumber(callFrame) - 1);
             CHECK_FOR_EXCEPTION();
             callFrame[srcDst] = result;
         }
@@ -1764,15 +1436,15 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int srcDst = (++vPC)->u.operand;
-        JSValuePtr v = callFrame[srcDst].jsValue(callFrame);
-        if (JSImmediate::canDoFastAdditiveOperations(v)) {
+        JSValue v = callFrame[srcDst].jsValue();
+        if (JSFastMath::canDoFastAdditiveOperations(v)) {
             callFrame[dst] = v;
-            callFrame[srcDst] = JSValuePtr(JSImmediate::incImmediateNumber(v));
+            callFrame[srcDst] = JSValue(JSFastMath::incImmediateNumber(v));
         } else {
-            JSValuePtr number = callFrame[srcDst].jsValue(callFrame)->toJSNumber(callFrame);
+            JSValue number = callFrame[srcDst].jsValue().toJSNumber(callFrame);
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = number;
-            callFrame[srcDst] = JSValuePtr(jsNumber(callFrame, number->uncheckedGetNumber() + 1));
+            callFrame[srcDst] = JSValue(jsNumber(callFrame, number.uncheckedGetNumber() + 1));
         }
 
         ++vPC;
@@ -1787,15 +1459,15 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int srcDst = (++vPC)->u.operand;
-        JSValuePtr v = callFrame[srcDst].jsValue(callFrame);
-        if (JSImmediate::canDoFastAdditiveOperations(v)) {
+        JSValue v = callFrame[srcDst].jsValue();
+        if (JSFastMath::canDoFastAdditiveOperations(v)) {
             callFrame[dst] = v;
-            callFrame[srcDst] = JSValuePtr(JSImmediate::decImmediateNumber(v));
+            callFrame[srcDst] = JSValue(JSFastMath::decImmediateNumber(v));
         } else {
-            JSValuePtr number = callFrame[srcDst].jsValue(callFrame)->toJSNumber(callFrame);
+            JSValue number = callFrame[srcDst].jsValue().toJSNumber(callFrame);
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = number;
-            callFrame[srcDst] = JSValuePtr(jsNumber(callFrame, number->uncheckedGetNumber() - 1));
+            callFrame[srcDst] = JSValue(jsNumber(callFrame, number.uncheckedGetNumber() - 1));
         }
 
         ++vPC;
@@ -1810,12 +1482,12 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
 
-        JSValuePtr srcVal = callFrame[src].jsValue(callFrame);
+        JSValue srcVal = callFrame[src].jsValue();
 
-        if (LIKELY(srcVal->isNumber()))
+        if (LIKELY(srcVal.isNumber()))
             callFrame[dst] = callFrame[src];
         else {
-            JSValuePtr result = srcVal->toJSNumber(callFrame);
+            JSValue result = srcVal.toJSNumber(callFrame);
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1830,13 +1502,13 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            result in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src = callFrame[(++vPC)->u.operand].jsValue();
         ++vPC;
         double v;
-        if (fastIsNumber(src, v))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, -v));
+        if (src.getNumber(v))
+            callFrame[dst] = JSValue(jsNumber(callFrame, -v));
         else {
-            JSValuePtr result = jsNumber(callFrame, -src->toNumber(callFrame));
+            JSValue result = jsNumber(callFrame, -src.toNumber(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1851,12 +1523,12 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            numeric add, depending on the types of the operands.)
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        if (JSImmediate::canDoFastAdditiveOperations(src1) && JSImmediate::canDoFastAdditiveOperations(src2))
-            callFrame[dst] = JSValuePtr(JSImmediate::addImmediateNumbers(src1, src2));
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
+        if (JSFastMath::canDoFastAdditiveOperations(src1, src2))
+            callFrame[dst] = JSValue(JSFastMath::addImmediateNumbers(src1, src2));
         else {
-            JSValuePtr result = jsAdd(callFrame, src1, src2);
+            JSValue result = jsAdd(callFrame, src1, src2);
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1870,21 +1542,21 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            numbers), and puts the product in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         double left;
         double right;
-        if (JSImmediate::areBothImmediateNumbers(src1, src2)) {
-            int32_t left = JSImmediate::getTruncatedInt32(src1);
-            int32_t right = JSImmediate::getTruncatedInt32(src2);
+        if (JSValue::areBothInt32Fast(src1, src2)) {
+            int32_t left = src1.getInt32Fast();
+            int32_t right = src2.getInt32Fast();
             if ((left | right) >> 15 == 0)
-                callFrame[dst] = JSValuePtr(jsNumber(callFrame, left * right));
+                callFrame[dst] = JSValue(jsNumber(callFrame, left * right));
             else
-                callFrame[dst] = JSValuePtr(jsNumber(callFrame, static_cast<double>(left) * static_cast<double>(right)));
-        } else if (fastIsNumber(src1, left) && fastIsNumber(src2, right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left * right));
+                callFrame[dst] = JSValue(jsNumber(callFrame, static_cast<double>(left) * static_cast<double>(right)));
+        } else if (src1.getNumber(left) && src2.getNumber(right))
+            callFrame[dst] = JSValue(jsNumber(callFrame, left * right));
         else {
-            JSValuePtr result = jsNumber(callFrame, src1->toNumber(callFrame) * src2->toNumber(callFrame));
+            JSValue result = jsNumber(callFrame, src1.toNumber(callFrame) * src2.toNumber(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1900,14 +1572,14 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            quotient in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr dividend = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr divisor = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue dividend = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue divisor = callFrame[(++vPC)->u.operand].jsValue();
         double left;
         double right;
-        if (fastIsNumber(dividend, left) && fastIsNumber(divisor, right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left / right));
+        if (dividend.getNumber(left) && divisor.getNumber(right))
+            callFrame[dst] = JSValue(jsNumber(callFrame, left / right));
         else {
-            JSValuePtr result = jsNumber(callFrame, dividend->toNumber(callFrame) / divisor->toNumber(callFrame));
+            JSValue result = jsNumber(callFrame, dividend.toNumber(callFrame) / divisor.toNumber(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1925,17 +1597,21 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int dividend = (++vPC)->u.operand;
         int divisor = (++vPC)->u.operand;
 
-        JSValuePtr dividendValue = callFrame[dividend].jsValue(callFrame);
-        JSValuePtr divisorValue = callFrame[divisor].jsValue(callFrame);
+        JSValue dividendValue = callFrame[dividend].jsValue();
+        JSValue divisorValue = callFrame[divisor].jsValue();
 
-        if (JSImmediate::areBothImmediateNumbers(dividendValue, divisorValue) && divisorValue != JSImmediate::from(0)) {
-            callFrame[dst] = JSValuePtr(JSImmediate::from(JSImmediate::getTruncatedInt32(dividendValue) % JSImmediate::getTruncatedInt32(divisorValue)));
+        if (JSValue::areBothInt32Fast(dividendValue, divisorValue) && divisorValue != jsNumber(callFrame, 0)) {
+            // We expect the result of the modulus of a number that was representable as an int32 to also be representable
+            // as an int32.
+            JSValue result = JSValue::makeInt32Fast(dividendValue.getInt32Fast() % divisorValue.getInt32Fast());
+            ASSERT(result);
+            callFrame[dst] = result;
             ++vPC;
             NEXT_INSTRUCTION();
         }
 
-        double d = dividendValue->toNumber(callFrame);
-        JSValuePtr result = jsNumber(callFrame, fmod(d, divisorValue->toNumber(callFrame)));
+        double d = dividendValue.toNumber(callFrame);
+        JSValue result = jsNumber(callFrame, fmod(d, divisorValue.toNumber(callFrame)));
         CHECK_FOR_EXCEPTION();
         callFrame[dst] = result;
         ++vPC;
@@ -1949,16 +1625,16 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         double left;
         double right;
-        if (JSImmediate::canDoFastAdditiveOperations(src1) && JSImmediate::canDoFastAdditiveOperations(src2))
-            callFrame[dst] = JSValuePtr(JSImmediate::subImmediateNumbers(src1, src2));
-        else if (fastIsNumber(src1, left) && fastIsNumber(src2, right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left - right));
+        if (JSFastMath::canDoFastAdditiveOperations(src1, src2))
+            callFrame[dst] = JSValue(JSFastMath::subImmediateNumbers(src1, src2));
+        else if (src1.getNumber(left) && src2.getNumber(right))
+            callFrame[dst] = JSValue(jsNumber(callFrame, left - right));
         else {
-            JSValuePtr result = jsNumber(callFrame, src1->toNumber(callFrame) - src2->toNumber(callFrame));
+            JSValue result = jsNumber(callFrame, src1.toNumber(callFrame) - src2.toNumber(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1973,16 +1649,16 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr val = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr shift = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue val = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue shift = callFrame[(++vPC)->u.operand].jsValue();
         int32_t left;
         uint32_t right;
-        if (JSImmediate::areBothImmediateNumbers(val, shift))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, JSImmediate::getTruncatedInt32(val) << (JSImmediate::getTruncatedUInt32(shift) & 0x1f)));
-        else if (fastToInt32(val, left) && fastToUInt32(shift, right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left << (right & 0x1f)));
+        if (JSValue::areBothInt32Fast(val, shift))
+            callFrame[dst] = JSValue(jsNumber(callFrame, val.getInt32Fast() << (shift.getInt32Fast() & 0x1f)));
+        else if (val.numberToInt32(left) && shift.numberToUInt32(right))
+            callFrame[dst] = JSValue(jsNumber(callFrame, left << (right & 0x1f)));
         else {
-            JSValuePtr result = jsNumber(callFrame, (val->toInt32(callFrame)) << (shift->toUInt32(callFrame) & 0x1f));
+            JSValue result = jsNumber(callFrame, (val.toInt32(callFrame)) << (shift.toUInt32(callFrame) & 0x1f));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -1998,16 +1674,16 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            uint32), and puts the result in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr val = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr shift = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue val = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue shift = callFrame[(++vPC)->u.operand].jsValue();
         int32_t left;
         uint32_t right;
-        if (JSImmediate::areBothImmediateNumbers(val, shift))
-            callFrame[dst] = JSValuePtr(JSImmediate::rightShiftImmediateNumbers(val, shift));
-        else if (fastToInt32(val, left) && fastToUInt32(shift, right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left >> (right & 0x1f)));
+        if (JSFastMath::canDoFastRshift(val, shift))
+            callFrame[dst] = JSValue(JSFastMath::rightShiftImmediateNumbers(val, shift));
+        else if (val.numberToInt32(left) && shift.numberToUInt32(right))
+            callFrame[dst] = JSValue(jsNumber(callFrame, left >> (right & 0x1f)));
         else {
-            JSValuePtr result = jsNumber(callFrame, (val->toInt32(callFrame)) >> (shift->toUInt32(callFrame) & 0x1f));
+            JSValue result = jsNumber(callFrame, (val.toInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -2023,12 +1699,12 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            uint32), and puts the result in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr val = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr shift = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        if (JSImmediate::areBothImmediateNumbers(val, shift) && !JSImmediate::isNegative(val))
-            callFrame[dst] = JSValuePtr(JSImmediate::rightShiftImmediateNumbers(val, shift));
+        JSValue val = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue shift = callFrame[(++vPC)->u.operand].jsValue();
+        if (JSFastMath::canDoFastUrshift(val, shift))
+            callFrame[dst] = JSValue(JSFastMath::rightShiftImmediateNumbers(val, shift));
         else {
-            JSValuePtr result = jsNumber(callFrame, (val->toUInt32(callFrame)) >> (shift->toUInt32(callFrame) & 0x1f));
+            JSValue result = jsNumber(callFrame, (val.toUInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -2044,16 +1720,16 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         int32_t left;
         int32_t right;
-        if (JSImmediate::areBothImmediateNumbers(src1, src2))
-            callFrame[dst] = JSValuePtr(JSImmediate::andImmediateNumbers(src1, src2));
-        else if (fastToInt32(src1, left) && fastToInt32(src2, right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left & right));
+        if (JSFastMath::canDoFastBitwiseOperations(src1, src2))
+            callFrame[dst] = JSValue(JSFastMath::andImmediateNumbers(src1, src2));
+        else if (src1.numberToInt32(left) && src2.numberToInt32(right))
+            callFrame[dst] = JSValue(jsNumber(callFrame, left & right));
         else {
-            JSValuePtr result = jsNumber(callFrame, src1->toInt32(callFrame) & src2->toInt32(callFrame));
+            JSValue result = jsNumber(callFrame, src1.toInt32(callFrame) & src2.toInt32(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -2069,16 +1745,16 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         int32_t left;
         int32_t right;
-        if (JSImmediate::areBothImmediateNumbers(src1, src2))
-            callFrame[dst] = JSValuePtr(JSImmediate::xorImmediateNumbers(src1, src2));
-        else if (fastToInt32(src1, left) && fastToInt32(src2, right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left ^ right));
+        if (JSFastMath::canDoFastBitwiseOperations(src1, src2))
+            callFrame[dst] = JSValue(JSFastMath::xorImmediateNumbers(src1, src2));
+        else if (src1.numberToInt32(left) && src2.numberToInt32(right))
+            callFrame[dst] = JSValue(jsNumber(callFrame, left ^ right));
         else {
-            JSValuePtr result = jsNumber(callFrame, src1->toInt32(callFrame) ^ src2->toInt32(callFrame));
+            JSValue result = jsNumber(callFrame, src1.toInt32(callFrame) ^ src2.toInt32(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -2094,16 +1770,16 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            result in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         int32_t left;
         int32_t right;
-        if (JSImmediate::areBothImmediateNumbers(src1, src2))
-            callFrame[dst] = JSValuePtr(JSImmediate::orImmediateNumbers(src1, src2));
-        else if (fastToInt32(src1, left) && fastToInt32(src2, right))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, left | right));
+        if (JSFastMath::canDoFastBitwiseOperations(src1, src2))
+            callFrame[dst] = JSValue(JSFastMath::orImmediateNumbers(src1, src2));
+        else if (src1.numberToInt32(left) && src2.numberToInt32(right))
+            callFrame[dst] = JSValue(jsNumber(callFrame, left | right));
         else {
-            JSValuePtr result = jsNumber(callFrame, src1->toInt32(callFrame) | src2->toInt32(callFrame));
+            JSValue result = jsNumber(callFrame, src1.toInt32(callFrame) | src2.toInt32(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -2118,12 +1794,12 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            and puts the result in register dst.
         */
         int dst = (++vPC)->u.operand;
-        JSValuePtr src = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src = callFrame[(++vPC)->u.operand].jsValue();
         int32_t value;
-        if (fastToInt32(src, value))
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, ~value));
+        if (src.numberToInt32(value))
+            callFrame[dst] = JSValue(jsNumber(callFrame, ~value));
         else {
-            JSValuePtr result = jsNumber(callFrame, ~src->toInt32(callFrame));
+            JSValue result = jsNumber(callFrame, ~src.toInt32(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = result;
         }
@@ -2138,7 +1814,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        JSValuePtr result = jsBoolean(!callFrame[src].jsValue(callFrame)->toBoolean(callFrame));
+        JSValue result = jsBoolean(!callFrame[src].jsValue().toBoolean(callFrame));
         CHECK_FOR_EXCEPTION();
         callFrame[dst] = result;
 
@@ -2163,13 +1839,14 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int base = vPC[3].u.operand;
         int baseProto = vPC[4].u.operand;
 
-        JSValuePtr baseVal = callFrame[base].jsValue(callFrame);
+        JSValue baseVal = callFrame[base].jsValue();
 
-        if (isNotObject(callFrame, true, callFrame->codeBlock(), vPC, baseVal, exceptionValue))
+        if (isInvalidParamForInstanceOf(callFrame, callFrame->codeBlock(), vPC, baseVal, exceptionValue))
             goto vm_throw;
 
-        JSObject* baseObj = asObject(baseVal);
-        callFrame[dst] = jsBoolean(baseObj->structure()->typeInfo().implementsHasInstance() ? baseObj->hasInstance(callFrame, callFrame[value].jsValue(callFrame), callFrame[baseProto].jsValue(callFrame)) : false);
+        bool result = asObject(baseVal)->hasInstance(callFrame, callFrame[value].jsValue(), callFrame[baseProto].jsValue());
+        CHECK_FOR_EXCEPTION();
+        callFrame[dst] = jsBoolean(result);
 
         vPC += 5;
         NEXT_INSTRUCTION();
@@ -2182,7 +1859,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        callFrame[dst] = JSValuePtr(jsTypeStringForValue(callFrame, callFrame[src].jsValue(callFrame)));
+        callFrame[dst] = JSValue(jsTypeStringForValue(callFrame, callFrame[src].jsValue()));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -2196,8 +1873,8 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        JSValuePtr v = callFrame[src].jsValue(callFrame);
-        callFrame[dst] = jsBoolean(JSImmediate::isImmediate(v) ? v->isUndefined() : v->asCell()->structure()->typeInfo().masqueradesAsUndefined());
+        JSValue v = callFrame[src].jsValue();
+        callFrame[dst] = jsBoolean(v.isCell() ? v.asCell()->structure()->typeInfo().masqueradesAsUndefined() : v.isUndefined());
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -2211,7 +1888,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        callFrame[dst] = jsBoolean(callFrame[src].jsValue(callFrame)->isBoolean());
+        callFrame[dst] = jsBoolean(callFrame[src].jsValue().isBoolean());
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -2225,7 +1902,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        callFrame[dst] = jsBoolean(callFrame[src].jsValue(callFrame)->isNumber());
+        callFrame[dst] = jsBoolean(callFrame[src].jsValue().isNumber());
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -2239,7 +1916,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        callFrame[dst] = jsBoolean(callFrame[src].jsValue(callFrame)->isString());
+        callFrame[dst] = jsBoolean(callFrame[src].jsValue().isString());
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -2253,7 +1930,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        callFrame[dst] = jsBoolean(jsIsObjectType(callFrame[src].jsValue(callFrame)));
+        callFrame[dst] = jsBoolean(jsIsObjectType(callFrame[src].jsValue()));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -2267,7 +1944,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        callFrame[dst] = jsBoolean(jsIsFunctionType(callFrame[src].jsValue(callFrame)));
+        callFrame[dst] = jsBoolean(jsIsFunctionType(callFrame[src].jsValue()));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -2285,19 +1962,19 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int property = (++vPC)->u.operand;
         int base = (++vPC)->u.operand;
 
-        JSValuePtr baseVal = callFrame[base].jsValue(callFrame);
-        if (isNotObject(callFrame, false, callFrame->codeBlock(), vPC, baseVal, exceptionValue))
+        JSValue baseVal = callFrame[base].jsValue();
+        if (isInvalidParamForIn(callFrame, callFrame->codeBlock(), vPC, baseVal, exceptionValue))
             goto vm_throw;
 
         JSObject* baseObj = asObject(baseVal);
 
-        JSValuePtr propName = callFrame[property].jsValue(callFrame);
+        JSValue propName = callFrame[property].jsValue();
 
         uint32_t i;
-        if (propName->getUInt32(i))
+        if (propName.getUInt32(i))
             callFrame[dst] = jsBoolean(baseObj->hasProperty(callFrame, i));
         else {
-            Identifier property(callFrame, propName->toString(callFrame));
+            Identifier property(callFrame, propName.toString(callFrame));
             CHECK_FOR_EXCEPTION();
             callFrame[dst] = jsBoolean(baseObj->hasProperty(callFrame, property));
         }
@@ -2348,18 +2025,17 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_global_var) {
-        /* get_global_var dst(r) globalObject(c) index(n) nop(n) nop(n)
+        /* get_global_var dst(r) globalObject(c) index(n)
 
            Gets the global var at global slot index and places it in register dst.
          */
-        int dst = vPC[1].u.operand;
-        JSGlobalObject* scope = static_cast<JSGlobalObject*>(vPC[2].u.jsCell);
+        int dst = (++vPC)->u.operand;
+        JSGlobalObject* scope = static_cast<JSGlobalObject*>((++vPC)->u.jsCell);
         ASSERT(scope->isGlobalObject());
-        int index = vPC[3].u.operand;
+        int index = (++vPC)->u.operand;
 
         callFrame[dst] = scope->registerAt(index);
-
-        vPC += OPCODE_LENGTH(op_resolve_global);
+        ++vPC;
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_put_global_var) {
@@ -2372,7 +2048,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int index = (++vPC)->u.operand;
         int value = (++vPC)->u.operand;
         
-        scope->registerAt(index) = JSValuePtr(callFrame[value].jsValue(callFrame));
+        scope->registerAt(index) = JSValue(callFrame[value].jsValue());
         ++vPC;
         NEXT_INSTRUCTION();
     }            
@@ -2420,7 +2096,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
 
         ASSERT((*iter)->isVariableObject());
         JSVariableObject* scope = static_cast<JSVariableObject*>(*iter);
-        scope->registerAt(index) = JSValuePtr(callFrame[value].jsValue(callFrame));
+        scope->registerAt(index) = JSValue(callFrame[value].jsValue());
         ++vPC;
         NEXT_INSTRUCTION();
     }
@@ -2488,9 +2164,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
 
         CodeBlock* codeBlock = callFrame->codeBlock();
         Identifier& ident = codeBlock->identifier(property);
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
         PropertySlot slot(baseValue);
-        JSValuePtr result = baseValue->get(callFrame, ident, slot);
+        JSValue result = baseValue.get(callFrame, ident, slot);
         CHECK_FOR_EXCEPTION();
 
         tryCacheGetByID(callFrame, codeBlock, vPC, baseValue, ident, slot);
@@ -2507,9 +2183,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            op_get_by_id.
         */
         int base = vPC[2].u.operand;
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
 
-        if (LIKELY(!JSImmediate::isImmediate(baseValue))) {
+        if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = asCell(baseValue);
             Structure* structure = vPC[4].u.structure;
 
@@ -2520,7 +2196,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
                 int offset = vPC[5].u.operand;
 
                 ASSERT(baseObject->get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == baseObject->getDirectOffset(offset));
-                callFrame[dst] = JSValuePtr(baseObject->getDirectOffset(offset));
+                callFrame[dst] = JSValue(baseObject->getDirectOffset(offset));
 
                 vPC += 8;
                 NEXT_INSTRUCTION();
@@ -2538,14 +2214,14 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            reverts to op_get_by_id.
         */
         int base = vPC[2].u.operand;
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
 
-        if (LIKELY(!JSImmediate::isImmediate(baseValue))) {
+        if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = asCell(baseValue);
             Structure* structure = vPC[4].u.structure;
 
             if (LIKELY(baseCell->structure() == structure)) {
-                ASSERT(structure->prototypeForLookup(callFrame)->isObject());
+                ASSERT(structure->prototypeForLookup(callFrame).isObject());
                 JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
                 Structure* prototypeStructure = vPC[5].u.structure;
 
@@ -2554,7 +2230,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
                     int offset = vPC[6].u.operand;
 
                     ASSERT(protoObject->get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == protoObject->getDirectOffset(offset));
-                    callFrame[dst] = JSValuePtr(protoObject->getDirectOffset(offset));
+                    callFrame[dst] = JSValue(protoObject->getDirectOffset(offset));
 
                     vPC += 8;
                     NEXT_INSTRUCTION();
@@ -2587,9 +2263,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            reverts to op_get_by_id.
         */
         int base = vPC[2].u.operand;
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
 
-        if (LIKELY(!JSImmediate::isImmediate(baseValue))) {
+        if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = asCell(baseValue);
             Structure* structure = vPC[4].u.structure;
 
@@ -2598,9 +2274,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
                 size_t count = vPC[6].u.operand;
                 RefPtr<Structure>* end = it + count;
 
-                JSObject* baseObject = asObject(baseCell);
-                while (1) {
-                    baseObject = asObject(baseObject->structure()->prototypeForLookup(callFrame));
+                while (true) {
+                    JSObject* baseObject = asObject(baseCell->structure()->prototypeForLookup(callFrame));
+
                     if (UNLIKELY(baseObject->structure() != (*it).get()))
                         break;
 
@@ -2609,11 +2285,14 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
                         int offset = vPC[7].u.operand;
 
                         ASSERT(baseObject->get(callFrame, callFrame->codeBlock()->identifier(vPC[3].u.operand)) == baseObject->getDirectOffset(offset));
-                        callFrame[dst] = JSValuePtr(baseObject->getDirectOffset(offset));
+                        callFrame[dst] = JSValue(baseObject->getDirectOffset(offset));
 
                         vPC += 8;
                         NEXT_INSTRUCTION();
                     }
+
+                    // Update baseCell, so that next time around the loop we'll pick up the prototype's prototype.
+                    baseCell = baseObject;
                 }
             }
         }
@@ -2632,9 +2311,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int property = vPC[3].u.operand;
 
         Identifier& ident = callFrame->codeBlock()->identifier(property);
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
         PropertySlot slot(baseValue);
-        JSValuePtr result = baseValue->get(callFrame, ident, slot);
+        JSValue result = baseValue.get(callFrame, ident, slot);
         CHECK_FOR_EXCEPTION();
 
         callFrame[dst] = result;
@@ -2650,10 +2329,10 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
 
         int base = vPC[2].u.operand;
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
-        if (LIKELY(isJSArray(baseValue))) {
+        JSValue baseValue = callFrame[base].jsValue();
+        if (LIKELY(isJSArray(globalData, baseValue))) {
             int dst = vPC[1].u.operand;
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, asArray(baseValue)->length()));
+            callFrame[dst] = JSValue(jsNumber(callFrame, asArray(baseValue)->length()));
             vPC += 8;
             NEXT_INSTRUCTION();
         }
@@ -2670,10 +2349,10 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
 
         int base = vPC[2].u.operand;
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
-        if (LIKELY(isJSString(baseValue))) {
+        JSValue baseValue = callFrame[base].jsValue();
+        if (LIKELY(isJSString(globalData, baseValue))) {
             int dst = vPC[1].u.operand;
-            callFrame[dst] = JSValuePtr(jsNumber(callFrame, asString(baseValue)->value().size()));
+            callFrame[dst] = JSValue(jsNumber(callFrame, asString(baseValue)->value().size()));
             vPC += 8;
             NEXT_INSTRUCTION();
         }
@@ -2696,10 +2375,10 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int value = vPC[3].u.operand;
 
         CodeBlock* codeBlock = callFrame->codeBlock();
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
         Identifier& ident = codeBlock->identifier(property);
         PutPropertySlot slot;
-        baseValue->put(callFrame, ident, callFrame[value].jsValue(callFrame), slot);
+        baseValue.put(callFrame, ident, callFrame[value].jsValue(), slot);
         CHECK_FOR_EXCEPTION();
 
         tryCachePutByID(callFrame, codeBlock, vPC, baseValue, slot);
@@ -2719,9 +2398,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            the register file.
          */
         int base = vPC[1].u.operand;
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
         
-        if (LIKELY(!JSImmediate::isImmediate(baseValue))) {
+        if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = asCell(baseValue);
             Structure* oldStructure = vPC[4].u.structure;
             Structure* newStructure = vPC[5].u.structure;
@@ -2732,8 +2411,8 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
 
                 RefPtr<Structure>* it = vPC[6].u.structureChain->head();
 
-                JSValuePtr proto = baseObject->structure()->prototypeForLookup(callFrame);
-                while (!proto->isNull()) {
+                JSValue proto = baseObject->structure()->prototypeForLookup(callFrame);
+                while (!proto.isNull()) {
                     if (UNLIKELY(asObject(proto)->structure() != (*it).get())) {
                         uncachePutByID(callFrame->codeBlock(), vPC);
                         NEXT_INSTRUCTION();
@@ -2747,7 +2426,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
                 int value = vPC[3].u.operand;
                 unsigned offset = vPC[7].u.operand;
                 ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(callFrame->codeBlock()->identifier(vPC[2].u.operand))) == offset);
-                baseObject->putDirectOffset(offset, callFrame[value].jsValue(callFrame));
+                baseObject->putDirectOffset(offset, callFrame[value].jsValue());
 
                 vPC += 8;
                 NEXT_INSTRUCTION();
@@ -2769,9 +2448,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            the register file.
         */
         int base = vPC[1].u.operand;
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
 
-        if (LIKELY(!JSImmediate::isImmediate(baseValue))) {
+        if (LIKELY(baseValue.isCell())) {
             JSCell* baseCell = asCell(baseValue);
             Structure* structure = vPC[4].u.structure;
 
@@ -2782,7 +2461,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
                 unsigned offset = vPC[5].u.operand;
                 
                 ASSERT(baseObject->offsetForLocation(baseObject->getDirectLocation(callFrame->codeBlock()->identifier(vPC[2].u.operand))) == offset);
-                baseObject->putDirectOffset(offset, callFrame[value].jsValue(callFrame));
+                baseObject->putDirectOffset(offset, callFrame[value].jsValue());
 
                 vPC += 8;
                 NEXT_INSTRUCTION();
@@ -2805,10 +2484,10 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int property = vPC[2].u.operand;
         int value = vPC[3].u.operand;
 
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
         Identifier& ident = callFrame->codeBlock()->identifier(property);
         PutPropertySlot slot;
-        baseValue->put(callFrame, ident, callFrame[value].jsValue(callFrame), slot);
+        baseValue.put(callFrame, ident, callFrame[value].jsValue(), slot);
         CHECK_FOR_EXCEPTION();
 
         vPC += 8;
@@ -2826,9 +2505,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int base = (++vPC)->u.operand;
         int property = (++vPC)->u.operand;
 
-        JSObject* baseObj = callFrame[base].jsValue(callFrame)->toObject(callFrame);
+        JSObject* baseObj = callFrame[base].jsValue().toObject(callFrame);
         Identifier& ident = callFrame->codeBlock()->identifier(property);
-        JSValuePtr result = jsBoolean(baseObj->deleteProperty(callFrame, ident));
+        JSValue result = jsBoolean(baseObj->deleteProperty(callFrame, ident));
         CHECK_FOR_EXCEPTION();
         callFrame[dst] = result;
         ++vPC;
@@ -2846,29 +2525,28 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int base = (++vPC)->u.operand;
         int property = (++vPC)->u.operand;
         
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
-        JSValuePtr subscript = callFrame[property].jsValue(callFrame);
+        JSValue baseValue = callFrame[base].jsValue();
+        JSValue subscript = callFrame[property].jsValue();
 
-        JSValuePtr result;
-        unsigned i;
+        JSValue result;
 
-        bool isUInt32 = JSImmediate::getUInt32(subscript, i);
-        if (LIKELY(isUInt32)) {
-            if (isJSArray(baseValue)) {
+        if (LIKELY(subscript.isUInt32Fast())) {
+            uint32_t i = subscript.getUInt32Fast();
+            if (isJSArray(globalData, baseValue)) {
                 JSArray* jsArray = asArray(baseValue);
                 if (jsArray->canGetIndex(i))
                     result = jsArray->getIndex(i);
                 else
                     result = jsArray->JSArray::get(callFrame, i);
-            } else if (isJSString(baseValue) && asString(baseValue)->canGetIndex(i))
+            } else if (isJSString(globalData, baseValue) && asString(baseValue)->canGetIndex(i))
                 result = asString(baseValue)->getIndex(&callFrame->globalData(), i);
-            else if (isJSByteArray(baseValue) && asByteArray(baseValue)->canAccessIndex(i))
-                result = asByteArray(baseValue)->getIndex(i);
+            else if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i))
+                result = asByteArray(baseValue)->getIndex(callFrame, i);
             else
-                result = baseValue->get(callFrame, i);
+                result = baseValue.get(callFrame, i);
         } else {
-            Identifier property(callFrame, subscript->toString(callFrame));
-            result = baseValue->get(callFrame, property);
+            Identifier property(callFrame, subscript.toString(callFrame));
+            result = baseValue.get(callFrame, property);
         }
 
         CHECK_FOR_EXCEPTION();
@@ -2891,36 +2569,34 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int property = (++vPC)->u.operand;
         int value = (++vPC)->u.operand;
 
-        JSValuePtr baseValue = callFrame[base].jsValue(callFrame);
-        JSValuePtr subscript = callFrame[property].jsValue(callFrame);
-
-        unsigned i;
+        JSValue baseValue = callFrame[base].jsValue();
+        JSValue subscript = callFrame[property].jsValue();
 
-        bool isUInt32 = JSImmediate::getUInt32(subscript, i);
-        if (LIKELY(isUInt32)) {
-            if (isJSArray(baseValue)) {
+        if (LIKELY(subscript.isUInt32Fast())) {
+            uint32_t i = subscript.getUInt32Fast();
+            if (isJSArray(globalData, baseValue)) {
                 JSArray* jsArray = asArray(baseValue);
                 if (jsArray->canSetIndex(i))
-                    jsArray->setIndex(i, callFrame[value].jsValue(callFrame));
+                    jsArray->setIndex(i, callFrame[value].jsValue());
                 else
-                    jsArray->JSArray::put(callFrame, i, callFrame[value].jsValue(callFrame));
-            } else if (isJSByteArray(baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
+                    jsArray->JSArray::put(callFrame, i, callFrame[value].jsValue());
+            } else if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
                 JSByteArray* jsByteArray = asByteArray(baseValue);
                 double dValue = 0;
-                JSValuePtr jsValue = callFrame[value].jsValue(callFrame);
-                if (JSImmediate::isNumber(jsValue))
-                    jsByteArray->setIndex(i, JSImmediate::getTruncatedInt32(jsValue));
-                else if (fastIsNumber(jsValue, dValue))
+                JSValue jsValue = callFrame[value].jsValue();
+                if (jsValue.isInt32Fast())
+                    jsByteArray->setIndex(i, jsValue.getInt32Fast());
+                else if (jsValue.getNumber(dValue))
                     jsByteArray->setIndex(i, dValue);
                 else
-                    baseValue->put(callFrame, i, jsValue);
+                    baseValue.put(callFrame, i, jsValue);
             } else
-                baseValue->put(callFrame, i, callFrame[value].jsValue(callFrame));
+                baseValue.put(callFrame, i, callFrame[value].jsValue());
         } else {
-            Identifier property(callFrame, subscript->toString(callFrame));
+            Identifier property(callFrame, subscript.toString(callFrame));
             if (!globalData->exception) { // Don't put to an object if toString threw an exception.
                 PutPropertySlot slot;
-                baseValue->put(callFrame, property, callFrame[value].jsValue(callFrame), slot);
+                baseValue.put(callFrame, property, callFrame[value].jsValue(), slot);
             }
         }
 
@@ -2940,16 +2616,16 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int base = (++vPC)->u.operand;
         int property = (++vPC)->u.operand;
 
-        JSObject* baseObj = callFrame[base].jsValue(callFrame)->toObject(callFrame); // may throw
+        JSObject* baseObj = callFrame[base].jsValue().toObject(callFrame); // may throw
 
-        JSValuePtr subscript = callFrame[property].jsValue(callFrame);
-        JSValuePtr result;
+        JSValue subscript = callFrame[property].jsValue();
+        JSValue result;
         uint32_t i;
-        if (subscript->getUInt32(i))
+        if (subscript.getUInt32(i))
             result = jsBoolean(baseObj->deleteProperty(callFrame, i));
         else {
             CHECK_FOR_EXCEPTION();
-            Identifier property(callFrame, subscript->toString(callFrame));
+            Identifier property(callFrame, subscript.toString(callFrame));
             CHECK_FOR_EXCEPTION();
             result = jsBoolean(baseObj->deleteProperty(callFrame, property));
         }
@@ -2975,7 +2651,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         unsigned property = (++vPC)->u.operand;
         int value = (++vPC)->u.operand;
 
-        callFrame[base].jsValue(callFrame)->put(callFrame, property, callFrame[value].jsValue(callFrame));
+        callFrame[base].jsValue().put(callFrame, property, callFrame[value].jsValue());
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3022,7 +2698,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
          */
         int cond = (++vPC)->u.operand;
         int target = (++vPC)->u.operand;
-        if (callFrame[cond].jsValue(callFrame)->toBoolean(callFrame)) {
+        if (callFrame[cond].jsValue().toBoolean(callFrame)) {
             vPC += target;
             CHECK_FOR_TIMEOUT();
             NEXT_INSTRUCTION();
@@ -3039,7 +2715,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int cond = (++vPC)->u.operand;
         int target = (++vPC)->u.operand;
-        if (callFrame[cond].jsValue(callFrame)->toBoolean(callFrame)) {
+        if (callFrame[cond].jsValue().toBoolean(callFrame)) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
@@ -3055,7 +2731,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int cond = (++vPC)->u.operand;
         int target = (++vPC)->u.operand;
-        if (!callFrame[cond].jsValue(callFrame)->toBoolean(callFrame)) {
+        if (!callFrame[cond].jsValue().toBoolean(callFrame)) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
@@ -3071,9 +2747,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int src = (++vPC)->u.operand;
         int target = (++vPC)->u.operand;
-        JSValuePtr srcValue = callFrame[src].jsValue(callFrame);
+        JSValue srcValue = callFrame[src].jsValue();
 
-        if (srcValue->isUndefinedOrNull() || (!JSImmediate::isImmediate(srcValue) && srcValue->asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
+        if (srcValue.isUndefinedOrNull() || (srcValue.isCell() && srcValue.asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
@@ -3089,9 +2765,27 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int src = (++vPC)->u.operand;
         int target = (++vPC)->u.operand;
-        JSValuePtr srcValue = callFrame[src].jsValue(callFrame);
+        JSValue srcValue = callFrame[src].jsValue();
 
-        if (!srcValue->isUndefinedOrNull() || (!JSImmediate::isImmediate(srcValue) && !srcValue->asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
+        if (!srcValue.isUndefinedOrNull() || (srcValue.isCell() && !srcValue.asCell()->structure()->typeInfo().masqueradesAsUndefined())) {
+            vPC += target;
+            NEXT_INSTRUCTION();
+        }
+
+        ++vPC;
+        NEXT_INSTRUCTION();
+    }
+    DEFINE_OPCODE(op_jneq_ptr) {
+        /* jneq_ptr src(r) ptr(jsCell) target(offset)
+         
+           Jumps to offset target from the current instruction, if the value r is equal
+           to ptr, using pointer equality.
+         */
+        int src = (++vPC)->u.operand;
+        JSValue ptr = JSValue((++vPC)->u.jsCell);
+        int target = (++vPC)->u.operand;
+        JSValue srcValue = callFrame[src].jsValue();
+        if (srcValue != ptr) {
             vPC += target;
             NEXT_INSTRUCTION();
         }
@@ -3110,8 +2804,8 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            Additionally this loop instruction may terminate JS execution is
            the JS timeout is reached.
          */
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         int target = (++vPC)->u.operand;
         
         bool result = jsLess(callFrame, src1, src2);
@@ -3137,8 +2831,8 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            Additionally this loop instruction may terminate JS execution is
            the JS timeout is reached.
         */
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         int target = (++vPC)->u.operand;
         
         bool result = jsLessEq(callFrame, src1, src2);
@@ -3161,8 +2855,8 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            target from the current instruction, if and only if the 
            result of the comparison is false.
         */
-        JSValuePtr src1 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        JSValuePtr src2 = callFrame[(++vPC)->u.operand].jsValue(callFrame);
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
         int target = (++vPC)->u.operand;
 
         bool result = jsLess(callFrame, src1, src2);
@@ -3176,6 +2870,29 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         ++vPC;
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_jnlesseq) {
+        /* jnlesseq src1(r) src2(r) target(offset)
+
+           Checks whether register src1 is less than or equal to
+           register src2, as with the ECMAScript '<=' operator,
+           and then jumps to offset target from the current instruction,
+           if and only if theresult of the comparison is false.
+        */
+        JSValue src1 = callFrame[(++vPC)->u.operand].jsValue();
+        JSValue src2 = callFrame[(++vPC)->u.operand].jsValue();
+        int target = (++vPC)->u.operand;
+
+        bool result = jsLessEq(callFrame, src1, src2);
+        CHECK_FOR_EXCEPTION();
+        
+        if (!result) {
+            vPC += target;
+            NEXT_INSTRUCTION();
+        }
+
+        ++vPC;
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_switch_imm) {
         /* switch_imm tableIndex(n) defaultOffset(offset) scrutinee(r)
 
@@ -3187,12 +2904,16 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
          */
         int tableIndex = (++vPC)->u.operand;
         int defaultOffset = (++vPC)->u.operand;
-        JSValuePtr scrutinee = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        if (!JSImmediate::isNumber(scrutinee))
-            vPC += defaultOffset;
+        JSValue scrutinee = callFrame[(++vPC)->u.operand].jsValue();
+        if (scrutinee.isInt32Fast())
+            vPC += callFrame->codeBlock()->immediateSwitchJumpTable(tableIndex).offsetForValue(scrutinee.getInt32Fast(), defaultOffset);
         else {
-            int32_t value = JSImmediate::getTruncatedInt32(scrutinee);
-            vPC += callFrame->codeBlock()->immediateSwitchJumpTable(tableIndex).offsetForValue(value, defaultOffset);
+            double value;
+            int32_t intValue;
+            if (scrutinee.getNumber(value) && ((intValue = static_cast<int32_t>(value)) == value))
+                vPC += callFrame->codeBlock()->immediateSwitchJumpTable(tableIndex).offsetForValue(intValue, defaultOffset);
+            else
+                vPC += defaultOffset;
         }
         NEXT_INSTRUCTION();
     }
@@ -3207,8 +2928,8 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
          */
         int tableIndex = (++vPC)->u.operand;
         int defaultOffset = (++vPC)->u.operand;
-        JSValuePtr scrutinee = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        if (!scrutinee->isString())
+        JSValue scrutinee = callFrame[(++vPC)->u.operand].jsValue();
+        if (!scrutinee.isString())
             vPC += defaultOffset;
         else {
             UString::Rep* value = asString(scrutinee)->value().rep();
@@ -3230,8 +2951,8 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
          */
         int tableIndex = (++vPC)->u.operand;
         int defaultOffset = (++vPC)->u.operand;
-        JSValuePtr scrutinee = callFrame[(++vPC)->u.operand].jsValue(callFrame);
-        if (!scrutinee->isString())
+        JSValue scrutinee = callFrame[(++vPC)->u.operand].jsValue();
+        if (!scrutinee.isString())
             vPC += defaultOffset;
         else 
             vPC += callFrame->codeBlock()->stringSwitchJumpTable(tableIndex).offsetForValue(asString(scrutinee)->value().rep(), defaultOffset);
@@ -3286,15 +3007,15 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int argCount = vPC[3].u.operand;
         int registerOffset = vPC[4].u.operand;
 
-        JSValuePtr funcVal = callFrame[func].jsValue(callFrame);
+        JSValue funcVal = callFrame[func].jsValue();
 
         Register* newCallFrame = callFrame->registers() + registerOffset;
         Register* argv = newCallFrame - RegisterFile::CallFrameHeaderSize - argCount;
-        JSValuePtr thisValue = argv[0].jsValue(callFrame);
+        JSValue thisValue = argv[0].jsValue();
         JSGlobalObject* globalObject = callFrame->scopeChain()->globalObject();
 
         if (thisValue == globalObject && funcVal == globalObject->evalFunction()) {
-            JSValuePtr result = callEval(callFrame, registerFile, argv, argCount, registerOffset, exceptionValue);
+            JSValue result = callEval(callFrame, registerFile, argv, argCount, registerOffset, exceptionValue);
             if (exceptionValue)
                 goto vm_throw;
             callFrame[dst] = result;
@@ -3323,10 +3044,10 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int argCount = vPC[3].u.operand;
         int registerOffset = vPC[4].u.operand;
 
-        JSValuePtr v = callFrame[func].jsValue(callFrame);
+        JSValue v = callFrame[func].jsValue();
 
         CallData callData;
-        CallType callType = v->getCallData(callData);
+        CallType callType = v.getCallData(callData);
 
         if (callType == CallTypeJS) {
             ScopeChainNode* callDataScopeChain = callData.js.scopeChain;
@@ -3361,18 +3082,18 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
             ArgList args(thisRegister + 1, argCount - 1);
 
             // FIXME: All host methods should be calling toThisObject, but this is not presently the case.
-            JSValuePtr thisValue = thisRegister->jsValue(callFrame);
+            JSValue thisValue = thisRegister->jsValue();
             if (thisValue == jsNull())
                 thisValue = callFrame->globalThisValue();
 
-            JSValuePtr returnValue;
+            JSValue returnValue;
             {
                 SamplingTool::HostCallRecord callRecord(m_sampler);
                 returnValue = callData.native.function(newCallFrame, asObject(v), thisValue, args);
             }
             CHECK_FOR_EXCEPTION();
 
-            callFrame[dst] = JSValuePtr(returnValue);
+            callFrame[dst] = JSValue(returnValue);
 
             vPC += 5;
             NEXT_INSTRUCTION();
@@ -3383,6 +3104,160 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         exceptionValue = createNotAFunctionError(callFrame, v, vPC - callFrame->codeBlock()->instructions().begin(), callFrame->codeBlock());
         goto vm_throw;
     }
+    DEFINE_OPCODE(op_load_varargs) {
+        int argCountDst = (++vPC)->u.operand;
+        int argsOffset = (++vPC)->u.operand;
+        
+        JSValue arguments = callFrame[argsOffset].jsValue();
+        uint32_t argCount = 0;
+        if (!arguments) {
+            argCount = (uint32_t)(callFrame[RegisterFile::ArgumentCount].u.i) - 1;
+            int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+            Register* newEnd = callFrame->registers() + sizeDelta;
+            if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+                exceptionValue = createStackOverflowError(callFrame);
+                goto vm_throw;
+            }
+            uint32_t expectedParams = asFunction(callFrame[RegisterFile::Callee].jsValue())->body()->parameterCount();
+            uint32_t inplaceArgs = min(argCount, expectedParams);
+            uint32_t i = 0;
+            Register* argStore = callFrame->registers() + argsOffset;
+
+            // First step is to copy the "expected" parameters from their normal location relative to the callframe
+            for (; i < inplaceArgs; i++)
+                argStore[i] = callFrame->registers()[i - RegisterFile::CallFrameHeaderSize - expectedParams];
+            // Then we copy any additional arguments that may be further up the stack ('-1' to account for 'this')
+            for (; i < argCount; i++)
+                argStore[i] = callFrame->registers()[i - RegisterFile::CallFrameHeaderSize - expectedParams - argCount - 1];
+        } else if (!arguments.isUndefinedOrNull()) {
+            if (!arguments.isObject()) {
+                exceptionValue = createInvalidParamError(callFrame, "Function.prototype.apply", arguments, vPC - callFrame->codeBlock()->instructions().begin(), callFrame->codeBlock());
+                goto vm_throw;
+            }
+            if (asObject(arguments)->classInfo() == &Arguments::info) {
+                Arguments* args = asArguments(arguments);
+                argCount = args->numProvidedArguments(callFrame);
+                int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+                Register* newEnd = callFrame->registers() + sizeDelta;
+                if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+                    exceptionValue = createStackOverflowError(callFrame);
+                    goto vm_throw;
+                }
+                args->copyToRegisters(callFrame, callFrame->registers() + argsOffset, argCount);
+            } else if (isJSArray(&callFrame->globalData(), arguments)) {
+                JSArray* array = asArray(arguments);
+                argCount = array->length();
+                int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+                Register* newEnd = callFrame->registers() + sizeDelta;
+                if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+                    exceptionValue = createStackOverflowError(callFrame);
+                    goto vm_throw;
+                }
+                array->copyToRegisters(callFrame, callFrame->registers() + argsOffset, argCount);
+            } else if (asObject(arguments)->inherits(&JSArray::info)) {
+                JSObject* argObject = asObject(arguments);
+                argCount = argObject->get(callFrame, callFrame->propertyNames().length).toUInt32(callFrame);
+                int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+                Register* newEnd = callFrame->registers() + sizeDelta;
+                if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+                    exceptionValue = createStackOverflowError(callFrame);
+                    goto vm_throw;
+                }
+                Register* argsBuffer = callFrame->registers() + argsOffset;
+                for (unsigned i = 0; i < argCount; ++i) {
+                    argsBuffer[i] = asObject(arguments)->get(callFrame, i);
+                    CHECK_FOR_EXCEPTION();
+                }
+            } else {
+                if (!arguments.isObject()) {
+                    exceptionValue = createInvalidParamError(callFrame, "Function.prototype.apply", arguments, vPC - callFrame->codeBlock()->instructions().begin(), callFrame->codeBlock());
+                    goto vm_throw;
+                }
+            }
+        }
+        CHECK_FOR_EXCEPTION();
+        callFrame[argCountDst] = argCount + 1;
+        ++vPC;
+        NEXT_INSTRUCTION();
+    }
+    DEFINE_OPCODE(op_call_varargs) {
+        /* call_varargs dst(r) func(r) argCountReg(r) baseRegisterOffset(n)
+         
+         Perform a function call with a dynamic set of arguments.
+         
+         registerOffset is the distance the callFrame pointer should move
+         before the VM initializes the new call frame's header, excluding
+         space for arguments.
+         
+         dst is where op_ret should store its result.
+         */
+        
+        int dst = vPC[1].u.operand;
+        int func = vPC[2].u.operand;
+        int argCountReg = vPC[3].u.operand;
+        int registerOffset = vPC[4].u.operand;
+        
+        JSValue v = callFrame[func].jsValue();
+        int argCount = callFrame[argCountReg].i();
+        registerOffset += argCount;
+        CallData callData;
+        CallType callType = v.getCallData(callData);
+        
+        if (callType == CallTypeJS) {
+            ScopeChainNode* callDataScopeChain = callData.js.scopeChain;
+            FunctionBodyNode* functionBodyNode = callData.js.functionBody;
+            CodeBlock* newCodeBlock = &functionBodyNode->bytecode(callDataScopeChain);
+            
+            CallFrame* previousCallFrame = callFrame;
+            
+            callFrame = slideRegisterWindowForCall(newCodeBlock, registerFile, callFrame, registerOffset, argCount);
+            if (UNLIKELY(!callFrame)) {
+                callFrame = previousCallFrame;
+                exceptionValue = createStackOverflowError(callFrame);
+                goto vm_throw;
+            }
+            
+            callFrame->init(newCodeBlock, vPC + 5, callDataScopeChain, previousCallFrame, dst, argCount, asFunction(v));
+            vPC = newCodeBlock->instructions().begin();
+            
+#if ENABLE(OPCODE_STATS)
+            OpcodeStats::resetLastInstruction();
+#endif
+            
+            NEXT_INSTRUCTION();
+        }
+        
+        if (callType == CallTypeHost) {
+            ScopeChainNode* scopeChain = callFrame->scopeChain();
+            CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + registerOffset);
+            newCallFrame->init(0, vPC + 5, scopeChain, callFrame, dst, argCount, 0);
+            
+            Register* thisRegister = newCallFrame->registers() - RegisterFile::CallFrameHeaderSize - argCount;
+            ArgList args(thisRegister + 1, argCount - 1);
+            
+            // FIXME: All host methods should be calling toThisObject, but this is not presently the case.
+            JSValue thisValue = thisRegister->jsValue();
+            if (thisValue == jsNull())
+                thisValue = callFrame->globalThisValue();
+            
+            JSValue returnValue;
+            {
+                SamplingTool::HostCallRecord callRecord(m_sampler);
+                returnValue = callData.native.function(newCallFrame, asObject(v), thisValue, args);
+            }
+            CHECK_FOR_EXCEPTION();
+            
+            callFrame[dst] = JSValue(returnValue);
+            
+            vPC += 5;
+            NEXT_INSTRUCTION();
+        }
+        
+        ASSERT(callType == CallTypeNone);
+        
+        exceptionValue = createNotAFunctionError(callFrame, v, vPC - callFrame->codeBlock()->instructions().begin(), callFrame->codeBlock());
+        goto vm_throw;
+    }
     DEFINE_OPCODE(op_tear_off_activation) {
         /* tear_off_activation activation(r)
 
@@ -3399,7 +3274,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int src = (++vPC)->u.operand;
         ASSERT(callFrame->codeBlock()->needsFullScopeChain());
 
-        asActivation(callFrame[src].getJSValue())->copyRegisters(callFrame->optionalCalleeArguments());
+        asActivation(callFrame[src].jsValue())->copyRegisters(callFrame->optionalCalleeArguments());
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3418,8 +3293,8 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
 
         ASSERT(callFrame->codeBlock()->usesArguments() && !callFrame->codeBlock()->needsFullScopeChain());
-
-        callFrame->optionalCalleeArguments()->copyRegisters();
+        if (callFrame->optionalCalleeArguments())
+            callFrame->optionalCalleeArguments()->copyRegisters();
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3439,7 +3314,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         if (callFrame->codeBlock()->needsFullScopeChain())
             callFrame->scopeChain()->deref();
 
-        JSValuePtr returnValue = callFrame[result].jsValue(callFrame);
+        JSValue returnValue = callFrame[result].jsValue();
 
         vPC = callFrame->returnPC();
         int dst = callFrame->returnValueRegister();
@@ -3448,7 +3323,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         if (callFrame->hasHostCallFrameFlag())
             return returnValue;
 
-        callFrame[dst] = JSValuePtr(returnValue);
+        callFrame[dst] = JSValue(returnValue);
 
         NEXT_INSTRUCTION();
     }
@@ -3518,28 +3393,40 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
 
         int thisRegister = (++vPC)->u.operand;
-        JSValuePtr thisVal = callFrame[thisRegister].getJSValue();
-        if (thisVal->needsThisConversion())
-            callFrame[thisRegister] = JSValuePtr(thisVal->toThisObject(callFrame));
+        JSValue thisVal = callFrame[thisRegister].jsValue();
+        if (thisVal.needsThisConversion())
+            callFrame[thisRegister] = JSValue(thisVal.toThisObject(callFrame));
 
         ++vPC;
         NEXT_INSTRUCTION();
     }
-    DEFINE_OPCODE(op_create_arguments) {
+    DEFINE_OPCODE(op_init_arguments) {
         /* create_arguments
 
-           Creates the 'arguments' object and places it in both the
-           'arguments' call frame slot and the local 'arguments'
-           register.
+           Initialises the arguments object reference to null to ensure
+           we can correctly detect that we need to create it later (or
+           avoid creating it altogether).
 
            This opcode should only be used at the beginning of a code
            block.
-        */
+         */
+        callFrame[RegisterFile::ArgumentsRegister] = JSValue();
+        ++vPC;
+        NEXT_INSTRUCTION();
+    }
+    DEFINE_OPCODE(op_create_arguments) {
+        /* create_arguments
 
-        Arguments* arguments = new (globalData) Arguments(callFrame);
-        callFrame->setCalleeArguments(arguments);
-        callFrame[RegisterFile::ArgumentsRegister] = arguments;
+           Creates the 'arguments' object and places it in both the
+           'arguments' call frame slot and the local 'arguments'
+           register, if it has not already been initialised.
+         */
         
+         if (!callFrame->optionalCalleeArguments()) {
+             Arguments* arguments = new (globalData) Arguments(callFrame);
+             callFrame->setCalleeArguments(arguments);
+             callFrame[RegisterFile::ArgumentsRegister] = arguments;
+         }
         ++vPC;
         NEXT_INSTRUCTION();
     }
@@ -3565,10 +3452,10 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int proto = vPC[5].u.operand;
         int thisRegister = vPC[6].u.operand;
 
-        JSValuePtr v = callFrame[func].jsValue(callFrame);
+        JSValue v = callFrame[func].jsValue();
 
         ConstructData constructData;
-        ConstructType constructType = v->getConstructData(constructData);
+        ConstructType constructType = v.getConstructData(constructData);
 
         if (constructType == ConstructTypeJS) {
             ScopeChainNode* callDataScopeChain = constructData.js.scopeChain;
@@ -3576,14 +3463,14 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
             CodeBlock* newCodeBlock = &functionBodyNode->bytecode(callDataScopeChain);
 
             Structure* structure;
-            JSValuePtr prototype = callFrame[proto].jsValue(callFrame);
-            if (prototype->isObject())
+            JSValue prototype = callFrame[proto].jsValue();
+            if (prototype.isObject())
                 structure = asObject(prototype)->inheritorID();
             else
                 structure = callDataScopeChain->globalObject()->emptyObjectStructure();
             JSObject* newObject = new (globalData) JSObject(structure);
 
-            callFrame[thisRegister] = JSValuePtr(newObject); // "this" value
+            callFrame[thisRegister] = JSValue(newObject); // "this" value
 
             CallFrame* previousCallFrame = callFrame;
 
@@ -3611,13 +3498,13 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
             CallFrame* newCallFrame = CallFrame::create(callFrame->registers() + registerOffset);
             newCallFrame->init(0, vPC + 7, scopeChain, callFrame, dst, argCount, 0);
 
-            JSValuePtr returnValue;
+            JSValue returnValue;
             {
                 SamplingTool::HostCallRecord callRecord(m_sampler);
                 returnValue = constructData.native.function(newCallFrame, asObject(v), args);
             }
             CHECK_FOR_EXCEPTION();
-            callFrame[dst] = JSValuePtr(returnValue);
+            callFrame[dst] = JSValue(returnValue);
 
             vPC += 7;
             NEXT_INSTRUCTION();
@@ -3635,8 +3522,8 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            the object in register override to register dst.
         */
 
-        int dst = vPC[1].u.operand;;
-        if (LIKELY(callFrame[dst].jsValue(callFrame)->isObject())) {
+        int dst = vPC[1].u.operand;
+        if (LIKELY(callFrame[dst].jsValue().isObject())) {
             vPC += 3;
             NEXT_INSTRUCTION();
         }
@@ -3647,6 +3534,25 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         vPC += 3;
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_strcat) {
+        int dst = (++vPC)->u.operand;
+        int src = (++vPC)->u.operand;
+        int count = (++vPC)->u.operand;
+
+        callFrame[dst] = concatenateStrings(callFrame, &callFrame->registers()[src], count);
+        ++vPC;
+
+        NEXT_INSTRUCTION();
+    }
+    DEFINE_OPCODE(op_to_primitive) {
+        int dst = (++vPC)->u.operand;
+        int src = (++vPC)->u.operand;
+
+        callFrame[dst] = callFrame[src].jsValue().toPrimitive(callFrame);
+        ++vPC;
+
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_push_scope) {
         /* push_scope scope(r)
 
@@ -3655,11 +3561,11 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
            are replaced by the result of toObject conversion of the scope.
         */
         int scope = (++vPC)->u.operand;
-        JSValuePtr v = callFrame[scope].jsValue(callFrame);
-        JSObject* o = v->toObject(callFrame);
+        JSValue v = callFrame[scope].jsValue();
+        JSObject* o = v.toObject(callFrame);
         CHECK_FOR_EXCEPTION();
 
-        callFrame[scope] = JSValuePtr(o);
+        callFrame[scope] = JSValue(o);
         callFrame->setScopeChain(callFrame->scopeChain()->push(o));
 
         ++vPC;
@@ -3686,7 +3592,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int dst = (++vPC)->u.operand;
         int base = (++vPC)->u.operand;
 
-        callFrame[dst] = JSPropertyNameIterator::create(callFrame, callFrame[base].jsValue(callFrame));
+        callFrame[dst] = JSPropertyNameIterator::create(callFrame, callFrame[base].jsValue());
         ++vPC;
         NEXT_INSTRUCTION();
     }
@@ -3704,9 +3610,9 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int target = (++vPC)->u.operand;
 
         JSPropertyNameIterator* it = callFrame[iter].propertyNameIterator();
-        if (JSValuePtr temp = it->next(callFrame)) {
+        if (JSValue temp = it->next(callFrame)) {
             CHECK_FOR_TIMEOUT();
-            callFrame[dst] = JSValuePtr(temp);
+            callFrame[dst] = JSValue(temp);
             vPC += target;
             NEXT_INSTRUCTION();
         }
@@ -3755,7 +3661,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
     DEFINE_OPCODE(op_catch) {
         /* catch ex(r)
 
-           Retrieves the VMs current exception and puts it in register
+           Retrieves the VM's current exception and puts it in register
            ex. This is only valid after an exception has been raised,
            and usually forms the beginning of an exception handler.
         */
@@ -3763,7 +3669,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         ASSERT(!globalData->exception);
         int ex = (++vPC)->u.operand;
         callFrame[ex] = exceptionValue;
-        exceptionValue = noValue();
+        exceptionValue = JSValue();
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3780,7 +3686,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
 
         int ex = (++vPC)->u.operand;
-        exceptionValue = callFrame[ex].jsValue(callFrame);
+        exceptionValue = callFrame[ex].jsValue();
 
         handler = throwException(callFrame, exceptionValue, vPC - callFrame->codeBlock()->instructions().begin(), true);
         if (!handler) {
@@ -3798,7 +3704,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         */
         int dst = (++vPC)->u.operand;
         int src = (++vPC)->u.operand;
-        callFrame[dst] = JSValuePtr(callFrame->codeBlock()->unexpectedConstant(src));
+        callFrame[dst] = JSValue(callFrame->codeBlock()->unexpectedConstant(src));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3816,7 +3722,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int message = (++vPC)->u.operand;
 
         CodeBlock* codeBlock = callFrame->codeBlock();
-        callFrame[dst] = JSValuePtr(Error::create(callFrame, (ErrorType)type, codeBlock->unexpectedConstant(message)->toString(callFrame), codeBlock->lineNumberForBytecodeOffset(callFrame, vPC - codeBlock->instructions().begin()), codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL()));
+        callFrame[dst] = JSValue(Error::create(callFrame, (ErrorType)type, codeBlock->unexpectedConstant(message).toString(callFrame), codeBlock->lineNumberForBytecodeOffset(callFrame, vPC - codeBlock->instructions().begin()), codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL()));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3834,7 +3740,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
             scopeChain->deref();
         }
         int result = (++vPC)->u.operand;
-        return callFrame[result].jsValue(callFrame);
+        return callFrame[result].jsValue();
     }
     DEFINE_OPCODE(op_put_getter) {
         /* put_getter base(r) property(id) function(r)
@@ -3851,11 +3757,11 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int property = (++vPC)->u.operand;
         int function = (++vPC)->u.operand;
 
-        ASSERT(callFrame[base].jsValue(callFrame)->isObject());
-        JSObject* baseObj = asObject(callFrame[base].jsValue(callFrame));
+        ASSERT(callFrame[base].jsValue().isObject());
+        JSObject* baseObj = asObject(callFrame[base].jsValue());
         Identifier& ident = callFrame->codeBlock()->identifier(property);
-        ASSERT(callFrame[function].jsValue(callFrame)->isObject());
-        baseObj->defineGetter(callFrame, ident, asObject(callFrame[function].jsValue(callFrame)));
+        ASSERT(callFrame[function].jsValue().isObject());
+        baseObj->defineGetter(callFrame, ident, asObject(callFrame[function].jsValue()));
 
         ++vPC;
         NEXT_INSTRUCTION();
@@ -3875,15 +3781,19 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int property = (++vPC)->u.operand;
         int function = (++vPC)->u.operand;
 
-        ASSERT(callFrame[base].jsValue(callFrame)->isObject());
-        JSObject* baseObj = asObject(callFrame[base].jsValue(callFrame));
+        ASSERT(callFrame[base].jsValue().isObject());
+        JSObject* baseObj = asObject(callFrame[base].jsValue());
         Identifier& ident = callFrame->codeBlock()->identifier(property);
-        ASSERT(callFrame[function].jsValue(callFrame)->isObject());
-        baseObj->defineSetter(callFrame, ident, asObject(callFrame[function].jsValue(callFrame)));
+        ASSERT(callFrame[function].jsValue().isObject());
+        baseObj->defineSetter(callFrame, ident, asObject(callFrame[function].jsValue()));
 
         ++vPC;
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_method_check) {
+        vPC++;
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_jsr) {
         /* jsr retAddrDst(r) target(offset)
 
@@ -3932,7 +3842,7 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int function = vPC[1].u.operand;
 
         if (*enabledProfilerReference)
-            (*enabledProfilerReference)->willExecute(callFrame, callFrame[function].jsValue(callFrame));
+            (*enabledProfilerReference)->willExecute(callFrame, callFrame[function].jsValue());
 
         vPC += 2;
         NEXT_INSTRUCTION();
@@ -3946,13 +3856,13 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
         int function = vPC[1].u.operand;
 
         if (*enabledProfilerReference)
-            (*enabledProfilerReference)->didExecute(callFrame, callFrame[function].jsValue(callFrame));
+            (*enabledProfilerReference)->didExecute(callFrame, callFrame[function].jsValue());
 
         vPC += 2;
         NEXT_INSTRUCTION();
     }
     vm_throw: {
-        globalData->exception = noValue();
+        globalData->exception = JSValue();
         if (!tickCount) {
             // The exceptionValue is a lie! (GCC produces bad code for reasons I 
             // cannot fathom if we don't assign to the exceptionValue before branching)
@@ -3971,13 +3881,14 @@ JSValuePtr Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registe
 #if !HAVE(COMPUTED_GOTO)
     } // iterator loop ends
 #endif
+#endif // USE(INTERPRETER)
     #undef NEXT_INSTRUCTION
     #undef DEFINE_OPCODE
     #undef CHECK_FOR_EXCEPTION
     #undef CHECK_FOR_TIMEOUT
 }
 
-JSValuePtr Interpreter::retrieveArguments(CallFrame* callFrame, JSFunction* function) const
+JSValue Interpreter::retrieveArguments(CallFrame* callFrame, JSFunction* function) const
 {
     CallFrame* functionCallFrame = findFunctionCallFrame(callFrame, function);
     if (!functionCallFrame)
@@ -3988,7 +3899,12 @@ JSValuePtr Interpreter::retrieveArguments(CallFrame* callFrame, JSFunction* func
         ASSERT(codeBlock->codeType() == FunctionCode);
         SymbolTable& symbolTable = codeBlock->symbolTable();
         int argumentsIndex = symbolTable.get(functionCallFrame->propertyNames().arguments.ustring().rep()).getIndex();
-        return functionCallFrame[argumentsIndex].jsValue(callFrame);
+        if (!functionCallFrame[argumentsIndex].arguments()) {
+            Arguments* arguments = new (callFrame) Arguments(functionCallFrame);
+            functionCallFrame->setCalleeArguments(arguments);
+            functionCallFrame[RegisterFile::ArgumentsRegister] = arguments;
+        }
+        return functionCallFrame[argumentsIndex].jsValue();
     }
 
     Arguments* arguments = functionCallFrame->optionalCalleeArguments();
@@ -4001,7 +3917,7 @@ JSValuePtr Interpreter::retrieveArguments(CallFrame* callFrame, JSFunction* func
     return arguments;
 }
 
-JSValuePtr Interpreter::retrieveCaller(CallFrame* callFrame, InternalFunction* function) const
+JSValue Interpreter::retrieveCaller(CallFrame* callFrame, InternalFunction* function) const
 {
     CallFrame* functionCallFrame = findFunctionCallFrame(callFrame, function);
     if (!functionCallFrame)
@@ -4011,16 +3927,16 @@ JSValuePtr Interpreter::retrieveCaller(CallFrame* callFrame, InternalFunction* f
     if (callerFrame->hasHostCallFrameFlag())
         return jsNull();
 
-    JSValuePtr caller = callerFrame->callee();
+    JSValue caller = callerFrame->callee();
     if (!caller)
         return jsNull();
 
     return caller;
 }
 
-void Interpreter::retrieveLastCaller(CallFrame* callFrame, int& lineNumber, intptr_t& sourceID, UString& sourceURL, JSValuePtr& function) const
+void Interpreter::retrieveLastCaller(CallFrame* callFrame, int& lineNumber, intptr_t& sourceID, UString& sourceURL, JSValue& function) const
 {
-    function = noValue();
+    function = JSValue();
     lineNumber = -1;
     sourceURL = UString();
 
@@ -4032,7 +3948,7 @@ void Interpreter::retrieveLastCaller(CallFrame* callFrame, int& lineNumber, intp
     if (!callerCodeBlock)
         return;
 
-    unsigned bytecodeOffset = bytecodeOffsetForPC(callerCodeBlock, callFrame->returnPC());
+    unsigned bytecodeOffset = bytecodeOffsetForPC(callerFrame, callerCodeBlock, callFrame->returnPC());
     lineNumber = callerCodeBlock->lineNumberForBytecodeOffset(callerFrame, bytecodeOffset - 1);
     sourceID = callerCodeBlock->ownerNode()->sourceID();
     sourceURL = callerCodeBlock->ownerNode()->sourceURL();
@@ -4048,2061 +3964,4 @@ CallFrame* Interpreter::findFunctionCallFrame(CallFrame* callFrame, InternalFunc
     return 0;
 }
 
-#if ENABLE(JIT)
-
-#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-
-NEVER_INLINE void Interpreter::tryCTICachePutByID(CallFrame* callFrame, CodeBlock* codeBlock, void* returnAddress, JSValuePtr baseValue, const PutPropertySlot& slot)
-{
-    // The interpreter checks for recursion here; I do not believe this can occur in CTI.
-
-    if (JSImmediate::isImmediate(baseValue))
-        return;
-
-    // Uncacheable: give up.
-    if (!slot.isCacheable()) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(cti_op_put_by_id_generic));
-        return;
-    }
-    
-    JSCell* baseCell = asCell(baseValue);
-    Structure* structure = baseCell->structure();
-
-    if (structure->isDictionary()) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(cti_op_put_by_id_generic));
-        return;
-    }
-
-    // If baseCell != base, then baseCell must be a proxy for another object.
-    if (baseCell != slot.base()) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(cti_op_put_by_id_generic));
-        return;
-    }
-
-    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(returnAddress);
-
-    // Cache hit: Specialize instruction and ref Structures.
-
-    // Structure transition, cache transition info
-    if (slot.type() == PutPropertySlot::NewProperty) {
-        StructureChain* chain = structure->cachedPrototypeChain();
-        if (!chain) {
-            chain = cachePrototypeChain(callFrame, structure);
-            if (!chain) {
-                // This happens if someone has manually inserted null into the prototype chain 
-                stubInfo->opcodeID = op_put_by_id_generic;
-                return;
-            }
-        }
-        stubInfo->initPutByIdTransition(structure->previousID(), structure, chain);
-        JIT::compilePutByIdTransition(callFrame->scopeChain()->globalData, codeBlock, stubInfo, structure->previousID(), structure, slot.cachedOffset(), chain, returnAddress);
-        return;
-    }
-    
-    stubInfo->initPutByIdReplace(structure);
-
-#if USE(CTI_REPATCH_PIC)
-    UNUSED_PARAM(callFrame);
-    JIT::patchPutByIdReplace(stubInfo, structure, slot.cachedOffset(), returnAddress);
-#else
-    JIT::compilePutByIdReplace(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, slot.cachedOffset(), returnAddress);
-#endif
-}
-
-NEVER_INLINE void Interpreter::tryCTICacheGetByID(CallFrame* callFrame, CodeBlock* codeBlock, void* returnAddress, JSValuePtr baseValue, const Identifier& propertyName, const PropertySlot& slot)
-{
-    // FIXME: Write a test that proves we need to check for recursion here just
-    // like the interpreter does, then add a check for recursion.
-
-    // FIXME: Cache property access for immediates.
-    if (JSImmediate::isImmediate(baseValue)) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(cti_op_get_by_id_generic));
-        return;
-    }
-
-    if (isJSArray(baseValue) && propertyName == callFrame->propertyNames().length) {
-#if USE(CTI_REPATCH_PIC)
-        JIT::compilePatchGetArrayLength(callFrame->scopeChain()->globalData, codeBlock, returnAddress);
-#else
-        ctiPatchCallByReturnAddress(returnAddress, m_ctiArrayLengthTrampoline);
-#endif
-        return;
-    }
-    if (isJSString(baseValue) && propertyName == callFrame->propertyNames().length) {
-        // The tradeoff of compiling an patched inline string length access routine does not seem
-        // to pay off, so we currently only do this for arrays.
-        ctiPatchCallByReturnAddress(returnAddress, m_ctiStringLengthTrampoline);
-        return;
-    }
-
-    // Uncacheable: give up.
-    if (!slot.isCacheable()) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(cti_op_get_by_id_generic));
-        return;
-    }
-
-    JSCell* baseCell = asCell(baseValue);
-    Structure* structure = baseCell->structure();
-
-    if (structure->isDictionary()) {
-        ctiPatchCallByReturnAddress(returnAddress, reinterpret_cast<void*>(cti_op_get_by_id_generic));
-        return;
-    }
-
-    // In the interpreter the last structure is trapped here; in CTI we use the
-    // *_second method to achieve a similar (but not quite the same) effect.
-
-    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(returnAddress);
-
-    // Cache hit: Specialize instruction and ref Structures.
-
-    if (slot.slotBase() == baseValue) {
-        // set this up, so derefStructures can do it's job.
-        stubInfo->initGetByIdSelf(structure);
-        
-#if USE(CTI_REPATCH_PIC)
-        JIT::patchGetByIdSelf(stubInfo, structure, slot.cachedOffset(), returnAddress);
-#else
-        JIT::compileGetByIdSelf(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, slot.cachedOffset(), returnAddress);
-#endif
-        return;
-    }
-
-    if (slot.slotBase() == structure->prototypeForLookup(callFrame)) {
-        ASSERT(slot.slotBase()->isObject());
-
-        JSObject* slotBaseObject = asObject(slot.slotBase());
-
-        // Since we're accessing a prototype in a loop, it's a good bet that it
-        // should not be treated as a dictionary.
-        if (slotBaseObject->structure()->isDictionary()) {
-            RefPtr<Structure> transition = Structure::fromDictionaryTransition(slotBaseObject->structure());
-            slotBaseObject->setStructure(transition.release());
-            asCell(baseValue)->structure()->setCachedPrototypeChain(0);
-        }
-        
-        stubInfo->initGetByIdProto(structure, slotBaseObject->structure());
-
-        JIT::compileGetByIdProto(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, slotBaseObject->structure(), slot.cachedOffset(), returnAddress);
-        return;
-    }
-
-    size_t count = countPrototypeChainEntriesAndCheckForProxies(callFrame, baseValue, slot);
-    if (!count) {
-        stubInfo->opcodeID = op_get_by_id_generic;
-        return;
-    }
-
-    StructureChain* chain = structure->cachedPrototypeChain();
-    if (!chain)
-        chain = cachePrototypeChain(callFrame, structure);
-    ASSERT(chain);
-
-    stubInfo->initGetByIdChain(structure, chain);
-
-    JIT::compileGetByIdChain(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, chain, count, slot.cachedOffset(), returnAddress);
-}
-
-#endif
-
-#if USE(JIT_STUB_ARGUMENT_VA_LIST)
-#define SETUP_VA_LISTL_ARGS va_list vl_args; va_start(vl_args, args)
-#else // JIT_STUB_ARGUMENT_REGISTER or JIT_STUB_ARGUMENT_STACK
-#define SETUP_VA_LISTL_ARGS
-#endif
-
-#ifndef NDEBUG
-
-extern "C" {
-
-static void jscGeneratedNativeCode() 
-{
-    // When executing a CTI function (which might do an allocation), we hack the return address
-    // to pretend to be executing this function, to keep stack logging tools from blowing out
-    // memory.
-}
-
-}
-
-struct StackHack {
-    ALWAYS_INLINE StackHack(void** location) 
-    { 
-        returnAddressLocation = location;
-        savedReturnAddress = *returnAddressLocation;
-        ctiSetReturnAddress(returnAddressLocation, reinterpret_cast<void*>(jscGeneratedNativeCode));
-    }
-    ALWAYS_INLINE ~StackHack() 
-    { 
-        ctiSetReturnAddress(returnAddressLocation, savedReturnAddress);
-    }
-
-    void** returnAddressLocation;
-    void* savedReturnAddress;
-};
-
-#define BEGIN_STUB_FUNCTION() SETUP_VA_LISTL_ARGS; StackHack stackHack(&STUB_RETURN_ADDRESS_SLOT)
-#define STUB_SET_RETURN_ADDRESS(address) stackHack.savedReturnAddress = address
-#define STUB_RETURN_ADDRESS stackHack.savedReturnAddress
-
-#else
-
-#define BEGIN_STUB_FUNCTION() SETUP_VA_LISTL_ARGS
-#define STUB_SET_RETURN_ADDRESS(address) ctiSetReturnAddress(&STUB_RETURN_ADDRESS_SLOT, address);
-#define STUB_RETURN_ADDRESS STUB_RETURN_ADDRESS_SLOT
-
-#endif
-
-// The reason this is not inlined is to avoid having to do a PIC branch
-// to get the address of the ctiVMThrowTrampoline function. It's also
-// good to keep the code size down by leaving as much of the exception
-// handling code out of line as possible.
-static NEVER_INLINE void returnToThrowTrampoline(JSGlobalData* globalData, void* exceptionLocation, void*& returnAddressSlot)
-{
-    ASSERT(globalData->exception);
-    globalData->exceptionLocation = exceptionLocation;
-    ctiSetReturnAddress(&returnAddressSlot, reinterpret_cast<void*>(ctiVMThrowTrampoline));
-}
-
-static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalData* globalData, void* exceptionLocation, void*& returnAddressSlot)
-{
-    globalData->exception = createStackOverflowError(callFrame);
-    returnToThrowTrampoline(globalData, exceptionLocation, returnAddressSlot);
-}
-
-#define VM_THROW_EXCEPTION() \
-    do { \
-        VM_THROW_EXCEPTION_AT_END(); \
-        return 0; \
-    } while (0)
-#define VM_THROW_EXCEPTION_2() \
-    do { \
-        VM_THROW_EXCEPTION_AT_END(); \
-        RETURN_PAIR(0, 0); \
-    } while (0)
-#define VM_THROW_EXCEPTION_AT_END() \
-    returnToThrowTrampoline(ARG_globalData, STUB_RETURN_ADDRESS, STUB_RETURN_ADDRESS)
-
-#define CHECK_FOR_EXCEPTION() \
-    do { \
-        if (UNLIKELY(ARG_globalData->exception != noValue())) \
-            VM_THROW_EXCEPTION(); \
-    } while (0)
-#define CHECK_FOR_EXCEPTION_AT_END() \
-    do { \
-        if (UNLIKELY(ARG_globalData->exception != noValue())) \
-            VM_THROW_EXCEPTION_AT_END(); \
-    } while (0)
-#define CHECK_FOR_EXCEPTION_VOID() \
-    do { \
-        if (UNLIKELY(ARG_globalData->exception != noValue())) { \
-            VM_THROW_EXCEPTION_AT_END(); \
-            return; \
-        } \
-    } while (0)
-
-JSObject* Interpreter::cti_op_convert_this(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr v1 = ARG_src1;
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSObject* result = v1->toThisObject(callFrame);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-
-void Interpreter::cti_op_end(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ScopeChainNode* scopeChain = ARG_callFrame->scopeChain();
-    ASSERT(scopeChain->refCount > 1);
-    scopeChain->deref();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_add(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr v1 = ARG_src1;
-    JSValuePtr v2 = ARG_src2;
-
-    double left;
-    double right = 0.0;
-
-    bool rightIsNumber = fastIsNumber(v2, right);
-    if (rightIsNumber && fastIsNumber(v1, left))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left + right));
-    
-    CallFrame* callFrame = ARG_callFrame;
-
-    bool leftIsString = v1->isString();
-    if (leftIsString && v2->isString()) {
-        RefPtr<UString::Rep> value = concatenate(asString(v1)->value().rep(), asString(v2)->value().rep());
-        if (UNLIKELY(!value)) {
-            throwOutOfMemoryError(callFrame);
-            VM_THROW_EXCEPTION();
-        }
-
-        return JSValuePtr::encode(jsString(ARG_globalData, value.release()));
-    }
-
-    if (rightIsNumber & leftIsString) {
-        RefPtr<UString::Rep> value = JSImmediate::isImmediate(v2) ?
-            concatenate(asString(v1)->value().rep(), JSImmediate::getTruncatedInt32(v2)) :
-            concatenate(asString(v1)->value().rep(), right);
-
-        if (UNLIKELY(!value)) {
-            throwOutOfMemoryError(callFrame);
-            VM_THROW_EXCEPTION();
-        }
-        return JSValuePtr::encode(jsString(ARG_globalData, value.release()));
-    }
-
-    // All other cases are pretty uncommon
-    JSValuePtr result = jsAddSlowCase(callFrame, v1, v2);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_pre_inc(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr v = ARG_src1;
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, v->toNumber(callFrame) + 1);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-int Interpreter::cti_timeout_check(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-    Interpreter* interpreter = ARG_globalData->interpreter;
-
-    if (interpreter->checkTimeout(ARG_callFrame->dynamicGlobalObject())) {
-        ARG_globalData->exception = createInterruptedExecutionException(ARG_globalData);
-        VM_THROW_EXCEPTION_AT_END();
-    }
-    
-    return interpreter->m_ticksUntilNextTimeoutCheck;
-}
-
-void Interpreter::cti_register_file_check(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    if (LIKELY(ARG_registerFile->grow(ARG_callFrame + ARG_callFrame->codeBlock()->m_numCalleeRegisters)))
-        return;
-
-    // Rewind to the previous call frame because op_call already optimistically
-    // moved the call frame forward.
-    CallFrame* oldCallFrame = ARG_callFrame->callerFrame();
-    ARG_setCallFrame(oldCallFrame);
-    throwStackOverflowError(oldCallFrame, ARG_globalData, oldCallFrame->returnPC(), STUB_RETURN_ADDRESS);
-}
-
-int Interpreter::cti_op_loop_if_less(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-    CallFrame* callFrame = ARG_callFrame;
-
-    bool result = jsLess(callFrame, src1, src2);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-
-int Interpreter::cti_op_loop_if_lesseq(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-    CallFrame* callFrame = ARG_callFrame;
-
-    bool result = jsLessEq(callFrame, src1, src2);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-
-JSObject* Interpreter::cti_op_new_object(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return constructEmptyObject(ARG_callFrame);
-}
-
-void Interpreter::cti_op_put_by_id_generic(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    PutPropertySlot slot;
-    ARG_src1->put(ARG_callFrame, *ARG_id2, ARG_src3, slot);
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_generic(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue->get(callFrame, ident, slot);
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-
-void Interpreter::cti_op_put_by_id(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
-
-    PutPropertySlot slot;
-    ARG_src1->put(callFrame, ident, ARG_src3, slot);
-
-    ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_put_by_id_second));
-
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
-void Interpreter::cti_op_put_by_id_second(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    PutPropertySlot slot;
-    ARG_src1->put(ARG_callFrame, *ARG_id2, ARG_src3, slot);
-    ARG_globalData->interpreter->tryCTICachePutByID(ARG_callFrame, ARG_callFrame->codeBlock(), STUB_RETURN_ADDRESS, ARG_src1, slot);
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
-void Interpreter::cti_op_put_by_id_fail(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
-
-    PutPropertySlot slot;
-    ARG_src1->put(callFrame, ident, ARG_src3, slot);
-
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue->get(callFrame, ident, slot);
-
-    ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_second));
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_second(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue->get(callFrame, ident, slot);
-
-    ARG_globalData->interpreter->tryCTICacheGetByID(callFrame, callFrame->codeBlock(), STUB_RETURN_ADDRESS, baseValue, ident, slot);
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_self_fail(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Identifier& ident = *ARG_id2;
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue->get(callFrame, ident, slot);
-
-    CHECK_FOR_EXCEPTION();
-
-    if (!JSImmediate::isImmediate(baseValue)
-        && slot.isCacheable()
-        && !asCell(baseValue)->structure()->isDictionary()
-        && slot.slotBase() == baseValue) {
-
-        CodeBlock* codeBlock = callFrame->codeBlock();
-        StructureStubInfo* stubInfo = &codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
-
-        ASSERT(slot.slotBase()->isObject());
-
-        PolymorphicAccessStructureList* polymorphicStructureList;
-        int listIndex = 1;
-
-        if (stubInfo->opcodeID == op_get_by_id_self) {
-            ASSERT(!stubInfo->stubRoutine);
-            polymorphicStructureList = new PolymorphicAccessStructureList(0, stubInfo->u.getByIdSelf.baseObjectStructure);
-            stubInfo->initGetByIdSelfList(polymorphicStructureList, 2);
-        } else {
-            polymorphicStructureList = stubInfo->u.getByIdSelfList.structureList;
-            listIndex = stubInfo->u.getByIdSelfList.listSize;
-            stubInfo->u.getByIdSelfList.listSize++;
-        }
-
-        JIT::compileGetByIdSelfList(callFrame->scopeChain()->globalData, codeBlock, stubInfo, polymorphicStructureList, listIndex, asCell(baseValue)->structure(), slot.cachedOffset());
-
-        if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
-            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_generic));
-    } else {
-        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_generic));
-    }
-    return JSValuePtr::encode(result);
-}
-
-static PolymorphicAccessStructureList* getPolymorphicAccessStructureListSlot(StructureStubInfo* stubInfo, int& listIndex)
-{
-    PolymorphicAccessStructureList* prototypeStructureList = 0;
-    listIndex = 1;
-
-    switch (stubInfo->opcodeID) {
-    case op_get_by_id_proto:
-        prototypeStructureList = new PolymorphicAccessStructureList(stubInfo->stubRoutine, stubInfo->u.getByIdProto.baseObjectStructure, stubInfo->u.getByIdProto.prototypeStructure);
-        stubInfo->stubRoutine = 0;
-        stubInfo->initGetByIdProtoList(prototypeStructureList, 2);
-        break;
-    case op_get_by_id_chain:
-        prototypeStructureList = new PolymorphicAccessStructureList(stubInfo->stubRoutine, stubInfo->u.getByIdChain.baseObjectStructure, stubInfo->u.getByIdChain.chain);
-        stubInfo->stubRoutine = 0;
-        stubInfo->initGetByIdProtoList(prototypeStructureList, 2);
-        break;
-    case op_get_by_id_proto_list:
-        prototypeStructureList = stubInfo->u.getByIdProtoList.structureList;
-        listIndex = stubInfo->u.getByIdProtoList.listSize;
-        stubInfo->u.getByIdProtoList.listSize++;
-        break;
-    default:
-        ASSERT_NOT_REACHED();
-    }
-    
-    ASSERT(listIndex < POLYMORPHIC_LIST_CACHE_SIZE);
-    return prototypeStructureList;
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_proto_list(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue->get(callFrame, *ARG_id2, slot);
-
-    CHECK_FOR_EXCEPTION();
-
-    if (JSImmediate::isImmediate(baseValue) || !slot.isCacheable() || asCell(baseValue)->structure()->isDictionary()) {
-        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_proto_fail));
-        return JSValuePtr::encode(result);
-    }
-
-    Structure* structure = asCell(baseValue)->structure();
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
-
-    ASSERT(slot.slotBase()->isObject());
-    JSObject* slotBaseObject = asObject(slot.slotBase());
-
-    if (slot.slotBase() == baseValue)
-        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_proto_fail));
-    else if (slot.slotBase() == asCell(baseValue)->structure()->prototypeForLookup(callFrame)) {
-        // Since we're accessing a prototype in a loop, it's a good bet that it
-        // should not be treated as a dictionary.
-        if (slotBaseObject->structure()->isDictionary()) {
-            RefPtr<Structure> transition = Structure::fromDictionaryTransition(slotBaseObject->structure());
-            slotBaseObject->setStructure(transition.release());
-            asCell(baseValue)->structure()->setCachedPrototypeChain(0);
-        }
-
-        int listIndex;
-        PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
-
-        JIT::compileGetByIdProtoList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, slotBaseObject->structure(), slot.cachedOffset());
-
-        if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
-            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_proto_list_full));
-    } else if (size_t count = countPrototypeChainEntriesAndCheckForProxies(callFrame, baseValue, slot)) {
-        StructureChain* chain = structure->cachedPrototypeChain();
-        if (!chain)
-            chain = cachePrototypeChain(callFrame, structure);
-        ASSERT(chain);
-
-        int listIndex;
-        PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
-
-        JIT::compileGetByIdChainList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, chain, count, slot.cachedOffset());
-
-        if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
-            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_proto_list_full));
-    } else
-        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, reinterpret_cast<void*>(cti_op_get_by_id_proto_fail));
-
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_proto_list_full(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue->get(ARG_callFrame, *ARG_id2, slot);
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_proto_fail(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue->get(ARG_callFrame, *ARG_id2, slot);
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_array_fail(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue->get(ARG_callFrame, *ARG_id2, slot);
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_id_string_fail(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr baseValue = ARG_src1;
-    PropertySlot slot(baseValue);
-    JSValuePtr result = baseValue->get(ARG_callFrame, *ARG_id2, slot);
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-#endif
-
-JSValueEncodedAsPointer* Interpreter::cti_op_instanceof(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr value = ARG_src1;
-    JSValuePtr baseVal = ARG_src2;
-    JSValuePtr proto = ARG_src3;
-
-    // at least one of these checks must have failed to get to the slow case
-    ASSERT(JSImmediate::isAnyImmediate(value, baseVal, proto) 
-           || !value->isObject() || !baseVal->isObject() || !proto->isObject() 
-           || (asObject(baseVal)->structure()->typeInfo().flags() & (ImplementsHasInstance | OverridesHasInstance)) != ImplementsHasInstance);
-
-    if (!baseVal->isObject()) {
-        CallFrame* callFrame = ARG_callFrame;
-        CodeBlock* codeBlock = callFrame->codeBlock();
-        unsigned vPCIndex = codeBlock->getBytecodeIndex(STUB_RETURN_ADDRESS);
-        ARG_globalData->exception = createInvalidParamError(callFrame, "instanceof", baseVal, vPCIndex, codeBlock);
-        VM_THROW_EXCEPTION();
-    }
-
-    if (!asObject(baseVal)->structure()->typeInfo().implementsHasInstance())
-        return JSValuePtr::encode(jsBoolean(false));
-
-    if (!proto->isObject()) {
-        throwError(callFrame, TypeError, "instanceof called on an object with an invalid prototype property.");
-        VM_THROW_EXCEPTION();
-    }
-        
-    if (!value->isObject())
-        return JSValuePtr::encode(jsBoolean(false));
-
-    JSValuePtr result = jsBoolean(asObject(baseVal)->hasInstance(callFrame, value, proto));
-    CHECK_FOR_EXCEPTION_AT_END();
-
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_del_by_id(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    
-    JSObject* baseObj = ARG_src1->toObject(callFrame);
-
-    JSValuePtr result = jsBoolean(baseObj->deleteProperty(callFrame, *ARG_id2));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_mul(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    double left;
-    double right;
-    if (fastIsNumber(src1, left) && fastIsNumber(src2, right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left * right));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, src1->toNumber(callFrame) * src2->toNumber(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSObject* Interpreter::cti_op_new_func(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return ARG_func1->makeFunction(ARG_callFrame, ARG_callFrame->scopeChain());
-}
-
-void* Interpreter::cti_op_call_JSFunction(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-#ifndef NDEBUG
-    CallData callData;
-    ASSERT(ARG_src1->getCallData(callData) == CallTypeJS);
-#endif
-
-    ScopeChainNode* callDataScopeChain = asFunction(ARG_src1)->m_scopeChain.node();
-    CodeBlock* newCodeBlock = &asFunction(ARG_src1)->body()->bytecode(callDataScopeChain);
-
-    if (!newCodeBlock->jitCode())
-        JIT::compile(ARG_globalData, newCodeBlock);
-
-    return newCodeBlock;
-}
-
-VoidPtrPair Interpreter::cti_op_call_arityCheck(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    CodeBlock* newCodeBlock = ARG_codeBlock4;
-    int argCount = ARG_int3;
-
-    ASSERT(argCount != newCodeBlock->m_numParameters);
-
-    CallFrame* oldCallFrame = callFrame->callerFrame();
-
-    if (argCount > newCodeBlock->m_numParameters) {
-        size_t numParameters = newCodeBlock->m_numParameters;
-        Register* r = callFrame->registers() + numParameters;
-
-        Register* argv = r - RegisterFile::CallFrameHeaderSize - numParameters - argCount;
-        for (size_t i = 0; i < numParameters; ++i)
-            argv[i + argCount] = argv[i];
-
-        callFrame = CallFrame::create(r);
-        callFrame->setCallerFrame(oldCallFrame);
-    } else {
-        size_t omittedArgCount = newCodeBlock->m_numParameters - argCount;
-        Register* r = callFrame->registers() + omittedArgCount;
-        Register* newEnd = r + newCodeBlock->m_numCalleeRegisters;
-        if (!ARG_registerFile->grow(newEnd)) {
-            // Rewind to the previous call frame because op_call already optimistically
-            // moved the call frame forward.
-            ARG_setCallFrame(oldCallFrame);
-            throwStackOverflowError(oldCallFrame, ARG_globalData, ARG_returnAddress2, STUB_RETURN_ADDRESS);
-            RETURN_PAIR(0, 0);
-        }
-
-        Register* argv = r - RegisterFile::CallFrameHeaderSize - omittedArgCount;
-        for (size_t i = 0; i < omittedArgCount; ++i)
-            argv[i] = jsUndefined();
-
-        callFrame = CallFrame::create(r);
-        callFrame->setCallerFrame(oldCallFrame);
-    }
-
-    RETURN_PAIR(newCodeBlock, callFrame);
-}
-
-void* Interpreter::cti_vm_dontLazyLinkCall(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSFunction* callee = asFunction(ARG_src1);
-    CodeBlock* codeBlock = &callee->body()->bytecode(callee->m_scopeChain.node());
-    if (!codeBlock->jitCode())
-        JIT::compile(ARG_globalData, codeBlock);
-
-    ctiPatchCallByReturnAddress(ARG_returnAddress2, ARG_globalData->interpreter->m_ctiVirtualCallLink);
-
-    return codeBlock->jitCode();
-}
-
-void* Interpreter::cti_vm_lazyLinkCall(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSFunction* callee = asFunction(ARG_src1);
-    CodeBlock* codeBlock = &callee->body()->bytecode(callee->m_scopeChain.node());
-    if (!codeBlock->jitCode())
-        JIT::compile(ARG_globalData, codeBlock);
-
-    CallLinkInfo* callLinkInfo = &ARG_callFrame->callerFrame()->codeBlock()->getCallLinkInfo(ARG_returnAddress2);
-    JIT::linkCall(callee, codeBlock, codeBlock->jitCode(), callLinkInfo, ARG_int3);
-
-    return codeBlock->jitCode();
-}
-
-JSObject* Interpreter::cti_op_push_activation(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSActivation* activation = new (ARG_globalData) JSActivation(ARG_callFrame, static_cast<FunctionBodyNode*>(ARG_callFrame->codeBlock()->ownerNode()));
-    ARG_callFrame->setScopeChain(ARG_callFrame->scopeChain()->copy()->push(activation));
-    return activation;
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_call_NotJSFunction(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr funcVal = ARG_src1;
-
-    CallData callData;
-    CallType callType = funcVal->getCallData(callData);
-
-    ASSERT(callType != CallTypeJS);
-
-    if (callType == CallTypeHost) {
-        int registerOffset = ARG_int2;
-        int argCount = ARG_int3;
-        CallFrame* previousCallFrame = ARG_callFrame;
-        CallFrame* callFrame = CallFrame::create(previousCallFrame->registers() + registerOffset);
-
-        callFrame->init(0, static_cast<Instruction*>(STUB_RETURN_ADDRESS), previousCallFrame->scopeChain(), previousCallFrame, 0, argCount, 0);
-        ARG_setCallFrame(callFrame);
-
-        Register* argv = ARG_callFrame->registers() - RegisterFile::CallFrameHeaderSize - argCount;
-        ArgList argList(argv + 1, argCount - 1);
-
-        JSValuePtr returnValue;
-        {
-            SamplingTool::HostCallRecord callRecord(CTI_SAMPLER);
-
-            // FIXME: All host methods should be calling toThisObject, but this is not presently the case.
-            JSValuePtr thisValue = argv[0].jsValue(callFrame);
-            if (thisValue == jsNull())
-                thisValue = callFrame->globalThisValue();
-
-            returnValue = callData.native.function(callFrame, asObject(funcVal), thisValue, argList);
-        }
-        ARG_setCallFrame(previousCallFrame);
-        CHECK_FOR_EXCEPTION();
-
-        return JSValuePtr::encode(returnValue);
-    }
-
-    ASSERT(callType == CallTypeNone);
-
-    CodeBlock* codeBlock = ARG_callFrame->codeBlock();
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createNotAFunctionError(ARG_callFrame, funcVal, vPCIndex, codeBlock);
-    VM_THROW_EXCEPTION();
-}
-
-void Interpreter::cti_op_create_arguments(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    Arguments* arguments = new (ARG_globalData) Arguments(ARG_callFrame);
-    ARG_callFrame->setCalleeArguments(arguments);
-    ARG_callFrame[RegisterFile::ArgumentsRegister] = arguments;
-}
-
-void Interpreter::cti_op_create_arguments_no_params(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    Arguments* arguments = new (ARG_globalData) Arguments(ARG_callFrame, Arguments::NoParameters);
-    ARG_callFrame->setCalleeArguments(arguments);
-    ARG_callFrame[RegisterFile::ArgumentsRegister] = arguments;
-}
-
-void Interpreter::cti_op_tear_off_activation(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ASSERT(ARG_callFrame->codeBlock()->needsFullScopeChain());
-    asActivation(ARG_src1)->copyRegisters(ARG_callFrame->optionalCalleeArguments());
-}
-
-void Interpreter::cti_op_tear_off_arguments(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ASSERT(ARG_callFrame->codeBlock()->usesArguments() && !ARG_callFrame->codeBlock()->needsFullScopeChain());
-    ARG_callFrame->optionalCalleeArguments()->copyRegisters();
-}
-
-void Interpreter::cti_op_profile_will_call(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ASSERT(*ARG_profilerReference);
-    (*ARG_profilerReference)->willExecute(ARG_callFrame, ARG_src1);
-}
-
-void Interpreter::cti_op_profile_did_call(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ASSERT(*ARG_profilerReference);
-    (*ARG_profilerReference)->didExecute(ARG_callFrame, ARG_src1);
-}
-
-void Interpreter::cti_op_ret_scopeChain(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ASSERT(ARG_callFrame->codeBlock()->needsFullScopeChain());
-    ARG_callFrame->scopeChain()->deref();
-}
-
-JSObject* Interpreter::cti_op_new_array(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ArgList argList(&ARG_callFrame->registers()[ARG_int1], ARG_int2);
-    return constructArray(ARG_callFrame, argList);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_resolve(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-    ASSERT(iter != end);
-
-    Identifier& ident = *ARG_id1;
-    do {
-        JSObject* o = *iter;
-        PropertySlot slot(o);
-        if (o->getPropertySlot(callFrame, ident, slot)) {
-            JSValuePtr result = slot.getValue(callFrame, ident);
-            CHECK_FOR_EXCEPTION_AT_END();
-            return JSValuePtr::encode(result);
-        }
-    } while (++iter != end);
-
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
-    VM_THROW_EXCEPTION();
-}
-
-JSObject* Interpreter::cti_op_construct_JSConstruct(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-#ifndef NDEBUG
-    ConstructData constructData;
-    ASSERT(asFunction(ARG_src1)->getConstructData(constructData) == ConstructTypeJS);
-#endif
-
-    Structure* structure;
-    if (ARG_src4->isObject())
-        structure = asObject(ARG_src4)->inheritorID();
-    else
-        structure = asFunction(ARG_src1)->m_scopeChain.node()->globalObject()->emptyObjectStructure();
-    return new (ARG_globalData) JSObject(structure);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_construct_NotJSConstruct(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr constrVal = ARG_src1;
-    int argCount = ARG_int3;
-    int thisRegister = ARG_int5;
-
-    ConstructData constructData;
-    ConstructType constructType = constrVal->getConstructData(constructData);
-
-    if (constructType == ConstructTypeHost) {
-        ArgList argList(callFrame->registers() + thisRegister + 1, argCount - 1);
-
-        JSValuePtr returnValue;
-        {
-            SamplingTool::HostCallRecord callRecord(CTI_SAMPLER);
-            returnValue = constructData.native.function(callFrame, asObject(constrVal), argList);
-        }
-        CHECK_FOR_EXCEPTION();
-
-        return JSValuePtr::encode(returnValue);
-    }
-
-    ASSERT(constructType == ConstructTypeNone);
-
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createNotAConstructorError(callFrame, constrVal, vPCIndex, codeBlock);
-    VM_THROW_EXCEPTION();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_get_by_val(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Interpreter* interpreter = ARG_globalData->interpreter;
-
-    JSValuePtr baseValue = ARG_src1;
-    JSValuePtr subscript = ARG_src2;
-
-    JSValuePtr result;
-    unsigned i;
-
-    bool isUInt32 = JSImmediate::getUInt32(subscript, i);
-    if (LIKELY(isUInt32)) {
-        if (interpreter->isJSArray(baseValue)) {
-            JSArray* jsArray = asArray(baseValue);
-            if (jsArray->canGetIndex(i))
-                result = jsArray->getIndex(i);
-            else
-                result = jsArray->JSArray::get(callFrame, i);
-        } else if (interpreter->isJSString(baseValue) && asString(baseValue)->canGetIndex(i))
-            return JSValuePtr::encode(asString(baseValue)->getIndex(ARG_globalData, i));
-        else if (interpreter->isJSByteArray(baseValue) && asByteArray(baseValue)->canAccessIndex(i))
-            return JSValuePtr::encode(asByteArray(baseValue)->getIndex(i));
-        else
-            result = baseValue->get(callFrame, i);
-    } else {
-        Identifier property(callFrame, subscript->toString(callFrame));
-        result = baseValue->get(callFrame, property);
-    }
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-VoidPtrPair Interpreter::cti_op_resolve_func(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-
-    // FIXME: add scopeDepthIsZero optimization
-
-    ASSERT(iter != end);
-
-    Identifier& ident = *ARG_id1;
-    JSObject* base;
-    do {
-        base = *iter;
-        PropertySlot slot(base);
-        if (base->getPropertySlot(callFrame, ident, slot)) {            
-            // ECMA 11.2.3 says that if we hit an activation the this value should be null.
-            // However, section 10.2.3 says that in the case where the value provided
-            // by the caller is null, the global object should be used. It also says
-            // that the section does not apply to internal functions, but for simplicity
-            // of implementation we use the global object anyway here. This guarantees
-            // that in host objects you always get a valid object for this.
-            // We also handle wrapper substitution for the global object at the same time.
-            JSObject* thisObj = base->toThisObject(callFrame);
-            JSValuePtr result = slot.getValue(callFrame, ident);
-            CHECK_FOR_EXCEPTION_AT_END();
-
-            RETURN_PAIR(thisObj, JSValuePtr::encode(result));
-        }
-        ++iter;
-    } while (iter != end);
-
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
-    VM_THROW_EXCEPTION_2();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_sub(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    double left;
-    double right;
-    if (fastIsNumber(src1, left) && fastIsNumber(src2, right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left - right));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, src1->toNumber(callFrame) - src2->toNumber(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-void Interpreter::cti_op_put_by_val(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    Interpreter* interpreter = ARG_globalData->interpreter;
-
-    JSValuePtr baseValue = ARG_src1;
-    JSValuePtr subscript = ARG_src2;
-    JSValuePtr value = ARG_src3;
-
-    unsigned i;
-
-    bool isUInt32 = JSImmediate::getUInt32(subscript, i);
-    if (LIKELY(isUInt32)) {
-        if (interpreter->isJSArray(baseValue)) {
-            JSArray* jsArray = asArray(baseValue);
-            if (jsArray->canSetIndex(i))
-                jsArray->setIndex(i, value);
-            else
-                jsArray->JSArray::put(callFrame, i, value);
-        } else if (interpreter->isJSByteArray(baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
-            JSByteArray* jsByteArray = asByteArray(baseValue);
-            double dValue = 0;
-            if (JSImmediate::isNumber(value)) {
-                jsByteArray->setIndex(i, JSImmediate::getTruncatedInt32(value));
-                return;
-            } else if (fastIsNumber(value, dValue)) {
-                jsByteArray->setIndex(i, dValue);
-                return;
-            } else
-                baseValue->put(callFrame, i, value);
-        } else
-            baseValue->put(callFrame, i, value);
-    } else {
-        Identifier property(callFrame, subscript->toString(callFrame));
-        if (!ARG_globalData->exception) { // Don't put to an object if toString threw an exception.
-            PutPropertySlot slot;
-            baseValue->put(callFrame, property, value, slot);
-        }
-    }
-
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
-void Interpreter::cti_op_put_by_val_array(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr baseValue = ARG_src1;
-    int i = ARG_int2;
-    JSValuePtr value = ARG_src3;
-
-    ASSERT(ARG_globalData->interpreter->isJSArray(baseValue));
-
-    if (LIKELY(i >= 0))
-        asArray(baseValue)->JSArray::put(callFrame, i, value);
-    else {
-        Identifier property(callFrame, JSImmediate::from(i)->toString(callFrame));
-        // FIXME: can toString throw an exception here?
-        if (!ARG_globalData->exception) { // Don't put to an object if toString threw an exception.
-            PutPropertySlot slot;
-            baseValue->put(callFrame, property, value, slot);
-        }
-    }
-
-    CHECK_FOR_EXCEPTION_AT_END();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_lesseq(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsBoolean(jsLessEq(callFrame, ARG_src1, ARG_src2));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-int Interpreter::cti_op_loop_if_true(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    bool result = src1->toBoolean(callFrame);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_negate(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src = ARG_src1;
-
-    double v;
-    if (fastIsNumber(src, v))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, -v));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, -src->toNumber(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_resolve_base(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSValuePtr::encode(inlineResolveBase(ARG_callFrame, *ARG_id1, ARG_callFrame->scopeChain()));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_resolve_skip(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-
-    int skip = ARG_int2;
-
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-    ASSERT(iter != end);
-    while (skip--) {
-        ++iter;
-        ASSERT(iter != end);
-    }
-    Identifier& ident = *ARG_id1;
-    do {
-        JSObject* o = *iter;
-        PropertySlot slot(o);
-        if (o->getPropertySlot(callFrame, ident, slot)) {
-            JSValuePtr result = slot.getValue(callFrame, ident);
-            CHECK_FOR_EXCEPTION_AT_END();
-            return JSValuePtr::encode(result);
-        }
-    } while (++iter != end);
-
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
-    VM_THROW_EXCEPTION();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_resolve_global(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSGlobalObject* globalObject = asGlobalObject(ARG_src1);
-    Identifier& ident = *ARG_id2;
-    unsigned globalResolveInfoIndex = ARG_int3;
-    ASSERT(globalObject->isGlobalObject());
-
-    PropertySlot slot(globalObject);
-    if (globalObject->getPropertySlot(callFrame, ident, slot)) {
-        JSValuePtr result = slot.getValue(callFrame, ident);
-        if (slot.isCacheable() && !globalObject->structure()->isDictionary()) {
-            GlobalResolveInfo& globalResolveInfo = callFrame->codeBlock()->globalResolveInfo(globalResolveInfoIndex);
-            if (globalResolveInfo.structure)
-                globalResolveInfo.structure->deref();
-            globalObject->structure()->ref();
-            globalResolveInfo.structure = globalObject->structure();
-            globalResolveInfo.offset = slot.cachedOffset();
-            return JSValuePtr::encode(result);
-        }
-
-        CHECK_FOR_EXCEPTION_AT_END();
-        return JSValuePtr::encode(result);
-    }
-
-    unsigned vPCIndex = ARG_callFrame->codeBlock()->getBytecodeIndex(STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, callFrame->codeBlock());
-    VM_THROW_EXCEPTION();
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_div(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    double left;
-    double right;
-    if (fastIsNumber(src1, left) && fastIsNumber(src2, right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left / right));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, src1->toNumber(callFrame) / src2->toNumber(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_pre_dec(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr v = ARG_src1;
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, v->toNumber(callFrame) - 1);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-int Interpreter::cti_op_jless(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-    CallFrame* callFrame = ARG_callFrame;
-
-    bool result = jsLess(callFrame, src1, src2);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_not(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src = ARG_src1;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr result = jsBoolean(!src->toBoolean(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-int Interpreter::cti_op_jtrue(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    bool result = src1->toBoolean(callFrame);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return result;
-}
-
-VoidPtrPair Interpreter::cti_op_post_inc(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr v = ARG_src1;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr number = v->toJSNumber(callFrame);
-    CHECK_FOR_EXCEPTION_AT_END();
-
-    RETURN_PAIR(JSValuePtr::encode(number), JSValuePtr::encode(jsNumber(ARG_globalData, number->uncheckedGetNumber() + 1)));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_eq(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    ASSERT(!JSImmediate::areBothImmediateNumbers(src1, src2));
-    JSValuePtr result = jsBoolean(equalSlowCaseInline(callFrame, src1, src2));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_lshift(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr val = ARG_src1;
-    JSValuePtr shift = ARG_src2;
-
-    int32_t left;
-    uint32_t right;
-    if (JSImmediate::areBothImmediateNumbers(val, shift))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, JSImmediate::getTruncatedInt32(val) << (JSImmediate::getTruncatedUInt32(shift) & 0x1f)));
-    if (fastToInt32(val, left) && fastToUInt32(shift, right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left << (right & 0x1f)));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, (val->toInt32(callFrame)) << (shift->toUInt32(callFrame) & 0x1f));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_bitand(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    int32_t left;
-    int32_t right;
-    if (fastToInt32(src1, left) && fastToInt32(src2, right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left & right));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, src1->toInt32(callFrame) & src2->toInt32(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_rshift(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr val = ARG_src1;
-    JSValuePtr shift = ARG_src2;
-
-    int32_t left;
-    uint32_t right;
-    if (JSImmediate::areBothImmediateNumbers(val, shift))
-        return JSValuePtr::encode(JSImmediate::rightShiftImmediateNumbers(val, shift));
-    if (fastToInt32(val, left) && fastToUInt32(shift, right))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, left >> (right & 0x1f)));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, (val->toInt32(callFrame)) >> (shift->toUInt32(callFrame) & 0x1f));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_bitnot(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src = ARG_src1;
-
-    int value;
-    if (fastToInt32(src, value))
-        return JSValuePtr::encode(jsNumber(ARG_globalData, ~value));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsNumber(ARG_globalData, ~src->toInt32(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-VoidPtrPair Interpreter::cti_op_resolve_with_base(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    ScopeChainNode* scopeChain = callFrame->scopeChain();
-
-    ScopeChainIterator iter = scopeChain->begin();
-    ScopeChainIterator end = scopeChain->end();
-
-    // FIXME: add scopeDepthIsZero optimization
-
-    ASSERT(iter != end);
-
-    Identifier& ident = *ARG_id1;
-    JSObject* base;
-    do {
-        base = *iter;
-        PropertySlot slot(base);
-        if (base->getPropertySlot(callFrame, ident, slot)) {
-            JSValuePtr result = slot.getValue(callFrame, ident);
-            CHECK_FOR_EXCEPTION_AT_END();
-
-            RETURN_PAIR(base, JSValuePtr::encode(result));
-        }
-        ++iter;
-    } while (iter != end);
-
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(STUB_RETURN_ADDRESS);
-    ARG_globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
-    VM_THROW_EXCEPTION_2();
-}
-
-JSObject* Interpreter::cti_op_new_func_exp(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return ARG_funcexp1->makeFunction(ARG_callFrame, ARG_callFrame->scopeChain());
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_mod(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr dividendValue = ARG_src1;
-    JSValuePtr divisorValue = ARG_src2;
-
-    CallFrame* callFrame = ARG_callFrame;
-    double d = dividendValue->toNumber(callFrame);
-    JSValuePtr result = jsNumber(ARG_globalData, fmod(d, divisorValue->toNumber(callFrame)));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_less(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsBoolean(jsLess(callFrame, ARG_src1, ARG_src2));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_neq(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    ASSERT(!JSImmediate::areBothImmediateNumbers(src1, src2));
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr result = jsBoolean(!equalSlowCaseInline(callFrame, src1, src2));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-VoidPtrPair Interpreter::cti_op_post_dec(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr v = ARG_src1;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr number = v->toJSNumber(callFrame);
-    CHECK_FOR_EXCEPTION_AT_END();
-
-    RETURN_PAIR(JSValuePtr::encode(number), JSValuePtr::encode(jsNumber(ARG_globalData, number->uncheckedGetNumber() - 1)));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_urshift(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr val = ARG_src1;
-    JSValuePtr shift = ARG_src2;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    if (JSImmediate::areBothImmediateNumbers(val, shift) && !JSImmediate::isNegative(val))
-        return JSValuePtr::encode(JSImmediate::rightShiftImmediateNumbers(val, shift));
-    else {
-        JSValuePtr result = jsNumber(ARG_globalData, (val->toUInt32(callFrame)) >> (shift->toUInt32(callFrame) & 0x1f));
-        CHECK_FOR_EXCEPTION_AT_END();
-        return JSValuePtr::encode(result);
-    }
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_bitxor(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr result = jsNumber(ARG_globalData, src1->toInt32(callFrame) ^ src2->toInt32(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSObject* Interpreter::cti_op_new_regexp(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return new (ARG_globalData) RegExpObject(ARG_callFrame->lexicalGlobalObject()->regExpStructure(), ARG_regexp1);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_bitor(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr result = jsNumber(ARG_globalData, src1->toInt32(callFrame) | src2->toInt32(callFrame));
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_call_eval(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    RegisterFile* registerFile = ARG_registerFile;
-
-    Interpreter* interpreter = ARG_globalData->interpreter;
-    
-    JSValuePtr funcVal = ARG_src1;
-    int registerOffset = ARG_int2;
-    int argCount = ARG_int3;
-
-    Register* newCallFrame = callFrame->registers() + registerOffset;
-    Register* argv = newCallFrame - RegisterFile::CallFrameHeaderSize - argCount;
-    JSValuePtr thisValue = argv[0].jsValue(callFrame);
-    JSGlobalObject* globalObject = callFrame->scopeChain()->globalObject();
-
-    if (thisValue == globalObject && funcVal == globalObject->evalFunction()) {
-        JSValuePtr exceptionValue = noValue();
-        JSValuePtr result = interpreter->callEval(callFrame, registerFile, argv, argCount, registerOffset, exceptionValue);
-        if (UNLIKELY(exceptionValue != noValue())) {
-            ARG_globalData->exception = exceptionValue;
-            VM_THROW_EXCEPTION_AT_END();
-        }
-        return JSValuePtr::encode(result);
-    }
-
-    return JSValuePtr::encode(JSImmediate::impossibleValue());
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_throw(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(STUB_RETURN_ADDRESS);
-
-    JSValuePtr exceptionValue = ARG_src1;
-    ASSERT(exceptionValue);
-
-    HandlerInfo* handler = ARG_globalData->interpreter->throwException(callFrame, exceptionValue, vPCIndex, true);
-
-    if (!handler) {
-        *ARG_exception = exceptionValue;
-        return JSValuePtr::encode(JSImmediate::nullImmediate());
-    }
-
-    ARG_setCallFrame(callFrame);
-    void* catchRoutine = handler->nativeCode;
-    ASSERT(catchRoutine);
-    STUB_SET_RETURN_ADDRESS(catchRoutine);
-    return JSValuePtr::encode(exceptionValue);
-}
-
-JSPropertyNameIterator* Interpreter::cti_op_get_pnames(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSPropertyNameIterator::create(ARG_callFrame, ARG_src1);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_next_pname(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSPropertyNameIterator* it = ARG_pni1;
-    JSValuePtr temp = it->next(ARG_callFrame);
-    if (!temp)
-        it->invalidate();
-    return JSValuePtr::encode(temp);
-}
-
-JSObject* Interpreter::cti_op_push_scope(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSObject* o = ARG_src1->toObject(ARG_callFrame);
-    CHECK_FOR_EXCEPTION();
-    ARG_callFrame->setScopeChain(ARG_callFrame->scopeChain()->push(o));
-    return o;
-}
-
-void Interpreter::cti_op_pop_scope(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    ARG_callFrame->setScopeChain(ARG_callFrame->scopeChain()->pop());
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_typeof(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSValuePtr::encode(jsTypeStringForValue(ARG_callFrame, ARG_src1));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_is_undefined(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr v = ARG_src1;
-    return JSValuePtr::encode(jsBoolean(JSImmediate::isImmediate(v) ? v->isUndefined() : v->asCell()->structure()->typeInfo().masqueradesAsUndefined()));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_is_boolean(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSValuePtr::encode(jsBoolean(ARG_src1->isBoolean()));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_is_number(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSValuePtr::encode(jsBoolean(ARG_src1->isNumber()));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_is_string(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSValuePtr::encode(jsBoolean(ARG_globalData->interpreter->isJSString(ARG_src1)));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_is_object(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSValuePtr::encode(jsBoolean(jsIsObjectType(ARG_src1)));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_is_function(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    return JSValuePtr::encode(jsBoolean(jsIsFunctionType(ARG_src1)));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_stricteq(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    // handled inline as fast cases
-    ASSERT(!JSImmediate::areBothImmediate(src1, src2));
-    ASSERT(!(JSImmediate::isEitherImmediate(src1, src2) & (src1 != JSImmediate::zeroImmediate()) & (src2 != JSImmediate::zeroImmediate())));
-
-    return JSValuePtr::encode(jsBoolean(strictEqualSlowCaseInline(src1, src2)));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_nstricteq(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src1 = ARG_src1;
-    JSValuePtr src2 = ARG_src2;
-
-    // handled inline as fast cases
-    ASSERT(!JSImmediate::areBothImmediate(src1, src2));
-    ASSERT(!(JSImmediate::isEitherImmediate(src1, src2) & (src1 != JSImmediate::zeroImmediate()) & (src2 != JSImmediate::zeroImmediate())));
-    
-    return JSValuePtr::encode(jsBoolean(!strictEqualSlowCaseInline(src1, src2)));
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_to_jsnumber(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr src = ARG_src1;
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr result = src->toJSNumber(callFrame);
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_in(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    JSValuePtr baseVal = ARG_src2;
-
-    if (!baseVal->isObject()) {
-        CallFrame* callFrame = ARG_callFrame;
-        CodeBlock* codeBlock = callFrame->codeBlock();
-        unsigned vPCIndex = codeBlock->getBytecodeIndex(STUB_RETURN_ADDRESS);
-        ARG_globalData->exception = createInvalidParamError(callFrame, "in", baseVal, vPCIndex, codeBlock);
-        VM_THROW_EXCEPTION();
-    }
-
-    JSValuePtr propName = ARG_src1;
-    JSObject* baseObj = asObject(baseVal);
-
-    uint32_t i;
-    if (propName->getUInt32(i))
-        return JSValuePtr::encode(jsBoolean(baseObj->hasProperty(callFrame, i)));
-
-    Identifier property(callFrame, propName->toString(callFrame));
-    CHECK_FOR_EXCEPTION();
-    return JSValuePtr::encode(jsBoolean(baseObj->hasProperty(callFrame, property)));
-}
-
-JSObject* Interpreter::cti_op_push_new_scope(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSObject* scope = new (ARG_globalData) JSStaticScopeObject(ARG_callFrame, *ARG_id1, ARG_src2, DontDelete);
-
-    CallFrame* callFrame = ARG_callFrame;
-    callFrame->setScopeChain(callFrame->scopeChain()->push(scope));
-    return scope;
-}
-
-void Interpreter::cti_op_jmp_scopes(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    unsigned count = ARG_int1;
-    CallFrame* callFrame = ARG_callFrame;
-
-    ScopeChainNode* tmp = callFrame->scopeChain();
-    while (count--)
-        tmp = tmp->pop();
-    callFrame->setScopeChain(tmp);
-}
-
-void Interpreter::cti_op_put_by_index(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    unsigned property = ARG_int2;
-
-    ARG_src1->put(callFrame, property, ARG_src3);
-}
-
-void* Interpreter::cti_op_switch_imm(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr scrutinee = ARG_src1;
-    unsigned tableIndex = ARG_int2;
-    CallFrame* callFrame = ARG_callFrame;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-
-    if (JSImmediate::isNumber(scrutinee)) {
-        int32_t value = JSImmediate::getTruncatedInt32(scrutinee);
-        return codeBlock->immediateSwitchJumpTable(tableIndex).ctiForValue(value);
-    }
-
-    return codeBlock->immediateSwitchJumpTable(tableIndex).ctiDefault;
-}
-
-void* Interpreter::cti_op_switch_char(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr scrutinee = ARG_src1;
-    unsigned tableIndex = ARG_int2;
-    CallFrame* callFrame = ARG_callFrame;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-
-    void* result = codeBlock->characterSwitchJumpTable(tableIndex).ctiDefault;
-
-    if (scrutinee->isString()) {
-        UString::Rep* value = asString(scrutinee)->value().rep();
-        if (value->size() == 1)
-            result = codeBlock->characterSwitchJumpTable(tableIndex).ctiForValue(value->data()[0]);
-    }
-
-    return result;
-}
-
-void* Interpreter::cti_op_switch_string(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    JSValuePtr scrutinee = ARG_src1;
-    unsigned tableIndex = ARG_int2;
-    CallFrame* callFrame = ARG_callFrame;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-
-    void* result = codeBlock->stringSwitchJumpTable(tableIndex).ctiDefault;
-
-    if (scrutinee->isString()) {
-        UString::Rep* value = asString(scrutinee)->value().rep();
-        result = codeBlock->stringSwitchJumpTable(tableIndex).ctiForValue(value);
-    }
-
-    return result;
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_op_del_by_val(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    JSValuePtr baseValue = ARG_src1;
-    JSObject* baseObj = baseValue->toObject(callFrame); // may throw
-
-    JSValuePtr subscript = ARG_src2;
-    JSValuePtr result;
-    uint32_t i;
-    if (subscript->getUInt32(i))
-        result = jsBoolean(baseObj->deleteProperty(callFrame, i));
-    else {
-        CHECK_FOR_EXCEPTION();
-        Identifier property(callFrame, subscript->toString(callFrame));
-        CHECK_FOR_EXCEPTION();
-        result = jsBoolean(baseObj->deleteProperty(callFrame, property));
-    }
-
-    CHECK_FOR_EXCEPTION_AT_END();
-    return JSValuePtr::encode(result);
-}
-
-void Interpreter::cti_op_put_getter(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    ASSERT(ARG_src1->isObject());
-    JSObject* baseObj = asObject(ARG_src1);
-    ASSERT(ARG_src3->isObject());
-    baseObj->defineGetter(callFrame, *ARG_id2, asObject(ARG_src3));
-}
-
-void Interpreter::cti_op_put_setter(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    ASSERT(ARG_src1->isObject());
-    JSObject* baseObj = asObject(ARG_src1);
-    ASSERT(ARG_src3->isObject());
-    baseObj->defineSetter(callFrame, *ARG_id2, asObject(ARG_src3));
-}
-
-JSObject* Interpreter::cti_op_new_error(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    unsigned type = ARG_int1;
-    JSValuePtr message = ARG_src2;
-    unsigned bytecodeOffset = ARG_int3;
-
-    unsigned lineNumber = codeBlock->lineNumberForBytecodeOffset(callFrame, bytecodeOffset);
-    return Error::create(callFrame, static_cast<ErrorType>(type), message->toString(callFrame), lineNumber, codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL());
-}
-
-void Interpreter::cti_op_debug(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-
-    int debugHookID = ARG_int1;
-    int firstLine = ARG_int2;
-    int lastLine = ARG_int3;
-
-    ARG_globalData->interpreter->debug(callFrame, static_cast<DebugHookID>(debugHookID), firstLine, lastLine);
-}
-
-JSValueEncodedAsPointer* Interpreter::cti_vm_throw(STUB_ARGS)
-{
-    BEGIN_STUB_FUNCTION();
-
-    CallFrame* callFrame = ARG_callFrame;
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    JSGlobalData* globalData = ARG_globalData;
-
-    unsigned vPCIndex = codeBlock->getBytecodeIndex(globalData->exceptionLocation);
-
-    JSValuePtr exceptionValue = globalData->exception;
-    ASSERT(exceptionValue);
-    globalData->exception = noValue();
-
-    HandlerInfo* handler = globalData->interpreter->throwException(callFrame, exceptionValue, vPCIndex, false);
-
-    if (!handler) {
-        *ARG_exception = exceptionValue;
-        return JSValuePtr::encode(JSImmediate::nullImmediate());
-    }
-
-    ARG_setCallFrame(callFrame);
-    void* catchRoutine = handler->nativeCode;
-    ASSERT(catchRoutine);
-    STUB_SET_RETURN_ADDRESS(catchRoutine);
-    return JSValuePtr::encode(exceptionValue);
-}
-
-#undef STUB_RETURN_ADDRESS
-#undef STUB_SET_RETURN_ADDRESS
-#undef BEGIN_STUB_FUNCTION
-#undef CHECK_FOR_EXCEPTION
-#undef CHECK_FOR_EXCEPTION_AT_END
-#undef CHECK_FOR_EXCEPTION_VOID
-#undef VM_THROW_EXCEPTION
-#undef VM_THROW_EXCEPTION_2
-#undef VM_THROW_EXCEPTION_AT_END
-
-#endif // ENABLE(JIT)
-
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
index 26d6732..702c89c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Interpreter.h
@@ -30,11 +30,13 @@
 #define Interpreter_h
 
 #include "ArgList.h"
+#include "FastAllocBase.h"
+#include "HashMap.h"
 #include "JSCell.h"
 #include "JSValue.h"
+#include "JSObject.h"
 #include "Opcode.h"
 #include "RegisterFile.h"
-#include <wtf/HashMap.h>
 
 namespace JSC {
 
@@ -50,54 +52,9 @@ namespace JSC {
     class Register;
     class ScopeChainNode;
     class SamplingTool;
+    struct CallFrameClosure;
     struct HandlerInfo;
 
-#if ENABLE(JIT)
-
-#if USE(JIT_STUB_ARGUMENT_VA_LIST)
-    #define STUB_ARGS void* args, ...
-    #define ARGS (reinterpret_cast<void**>(vl_args) - 1)
-#else // JIT_STUB_ARGUMENT_REGISTER or JIT_STUB_ARGUMENT_STACK
-    #define STUB_ARGS void** args
-    #define ARGS (args)
-#endif
-
-#if USE(JIT_STUB_ARGUMENT_REGISTER)
-    #if PLATFORM(X86_64)
-    #define JIT_STUB
-    #elif COMPILER(MSVC)
-    #define JIT_STUB __fastcall
-    #elif COMPILER(GCC)
-    #define JIT_STUB  __attribute__ ((fastcall))
-    #else
-    #error Need to support register calling convention in this compiler
-    #endif
-#else // JIT_STUB_ARGUMENT_VA_LIST or JIT_STUB_ARGUMENT_STACK
-    #if COMPILER(MSVC)
-    #define JIT_STUB __cdecl
-    #else
-    #define JIT_STUB
-    #endif
-#endif
-
-// The Mac compilers are fine with this, 
-#if PLATFORM(MAC)
-    struct VoidPtrPair {
-        void* first;
-        void* second;
-    };
-#define RETURN_PAIR(a,b) VoidPtrPair pair = { a, b }; return pair
-#else
-    typedef uint64_t VoidPtrPair;
-    union VoidPtrPairValue {
-        struct { void* first; void* second; } s;
-        VoidPtrPair i;
-    };
-#define RETURN_PAIR(a,b) VoidPtrPairValue pair = {{ a, b }}; return pair.i
-#endif
-
-#endif // ENABLE(JIT)
-
     enum DebugHookID {
         WillExecuteProgram,
         DidExecuteProgram,
@@ -107,16 +64,14 @@ namespace JSC {
         WillExecuteStatement
     };
 
-    enum { MaxReentryDepth = 128 };
+    enum { MaxMainThreadReentryDepth = 256, MaxSecondaryThreadReentryDepth = 32 };
 
-    class Interpreter {
+    class Interpreter : public FastAllocBase {
         friend class JIT;
+        friend class CachedCall;
     public:
         Interpreter();
-        ~Interpreter();
 
-        void initialize(JSGlobalData*);
-        
         RegisterFile& registerFile() { return m_registerFile; }
         
         Opcode getOpcode(OpcodeID id)
@@ -140,236 +95,72 @@ namespace JSC {
 
         bool isOpcode(Opcode);
         
-        JSValuePtr execute(ProgramNode*, CallFrame*, ScopeChainNode*, JSObject* thisObj, JSValuePtr* exception);
-        JSValuePtr execute(FunctionBodyNode*, CallFrame*, JSFunction*, JSObject* thisObj, const ArgList& args, ScopeChainNode*, JSValuePtr* exception);
-        JSValuePtr execute(EvalNode* evalNode, CallFrame* exec, JSObject* thisObj, ScopeChainNode* scopeChain, JSValuePtr* exception);
+        JSValue execute(ProgramNode*, CallFrame*, ScopeChainNode*, JSObject* thisObj, JSValue* exception);
+        JSValue execute(FunctionBodyNode*, CallFrame*, JSFunction*, JSObject* thisObj, const ArgList& args, ScopeChainNode*, JSValue* exception);
+        JSValue execute(EvalNode* evalNode, CallFrame* exec, JSObject* thisObj, ScopeChainNode* scopeChain, JSValue* exception);
 
-        JSValuePtr retrieveArguments(CallFrame*, JSFunction*) const;
-        JSValuePtr retrieveCaller(CallFrame*, InternalFunction*) const;
-        void retrieveLastCaller(CallFrame*, int& lineNumber, intptr_t& sourceID, UString& sourceURL, JSValuePtr& function) const;
+        JSValue retrieveArguments(CallFrame*, JSFunction*) const;
+        JSValue retrieveCaller(CallFrame*, InternalFunction*) const;
+        void retrieveLastCaller(CallFrame*, int& lineNumber, intptr_t& sourceID, UString& sourceURL, JSValue& function) const;
         
         void getArgumentsData(CallFrame*, JSFunction*&, ptrdiff_t& firstParameterIndex, Register*& argv, int& argc);
-        void setTimeoutTime(unsigned timeoutTime) { m_timeoutTime = timeoutTime; }
         
-        void startTimeoutCheck()
-        {
-            if (!m_timeoutCheckCount)
-                resetTimeoutCheck();
-            
-            ++m_timeoutCheckCount;
-        }
-        
-        void stopTimeoutCheck()
-        {
-            ASSERT(m_timeoutCheckCount);
-            --m_timeoutCheckCount;
-        }
-
-        inline void initTimeout()
-        {
-            ASSERT(!m_timeoutCheckCount);
-            resetTimeoutCheck();
-            m_timeoutTime = 0;
-            m_timeoutCheckCount = 0;
-        }
-
         void setSampler(SamplingTool* sampler) { m_sampler = sampler; }
         SamplingTool* sampler() { return m_sampler; }
 
-#if ENABLE(JIT)
-
-        static int JIT_STUB cti_timeout_check(STUB_ARGS);
-        static void JIT_STUB cti_register_file_check(STUB_ARGS);
-
-        static JSObject* JIT_STUB cti_op_convert_this(STUB_ARGS);
-        static void JIT_STUB cti_op_end(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_add(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_pre_inc(STUB_ARGS);
-        static int JIT_STUB cti_op_loop_if_less(STUB_ARGS);
-        static int JIT_STUB cti_op_loop_if_lesseq(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_new_object(STUB_ARGS);
-        static void JIT_STUB cti_op_put_by_id(STUB_ARGS);
-        static void JIT_STUB cti_op_put_by_id_second(STUB_ARGS);
-        static void JIT_STUB cti_op_put_by_id_generic(STUB_ARGS);
-        static void JIT_STUB cti_op_put_by_id_fail(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_second(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_generic(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_self_fail(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_proto_list(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_proto_list_full(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_proto_fail(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_array_fail(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_id_string_fail(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_del_by_id(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_instanceof(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_mul(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_new_func(STUB_ARGS);
-        static void* JIT_STUB cti_op_call_JSFunction(STUB_ARGS);
-        static VoidPtrPair JIT_STUB cti_op_call_arityCheck(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_call_NotJSFunction(STUB_ARGS);
-        static void JIT_STUB cti_op_create_arguments(STUB_ARGS);
-        static void JIT_STUB cti_op_create_arguments_no_params(STUB_ARGS);
-        static void JIT_STUB cti_op_tear_off_activation(STUB_ARGS);
-        static void JIT_STUB cti_op_tear_off_arguments(STUB_ARGS);
-        static void JIT_STUB cti_op_profile_will_call(STUB_ARGS);
-        static void JIT_STUB cti_op_profile_did_call(STUB_ARGS);
-        static void JIT_STUB cti_op_ret_scopeChain(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_new_array(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_resolve(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_resolve_global(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_construct_JSConstruct(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_construct_NotJSConstruct(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_get_by_val(STUB_ARGS);
-        static VoidPtrPair JIT_STUB cti_op_resolve_func(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_sub(STUB_ARGS);
-        static void JIT_STUB cti_op_put_by_val(STUB_ARGS);
-        static void JIT_STUB cti_op_put_by_val_array(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_lesseq(STUB_ARGS);
-        static int JIT_STUB cti_op_loop_if_true(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_resolve_base(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_negate(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_resolve_skip(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_div(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_pre_dec(STUB_ARGS);
-        static int JIT_STUB cti_op_jless(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_not(STUB_ARGS);
-        static int JIT_STUB cti_op_jtrue(STUB_ARGS);
-        static VoidPtrPair JIT_STUB cti_op_post_inc(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_eq(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_lshift(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_bitand(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_rshift(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_bitnot(STUB_ARGS);
-        static VoidPtrPair JIT_STUB cti_op_resolve_with_base(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_new_func_exp(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_mod(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_less(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_neq(STUB_ARGS);
-        static VoidPtrPair JIT_STUB cti_op_post_dec(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_urshift(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_bitxor(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_new_regexp(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_bitor(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_call_eval(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_throw(STUB_ARGS);
-        static JSPropertyNameIterator* JIT_STUB cti_op_get_pnames(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_next_pname(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_push_scope(STUB_ARGS);
-        static void JIT_STUB cti_op_pop_scope(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_typeof(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_is_undefined(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_is_boolean(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_is_number(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_is_string(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_is_object(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_is_function(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_stricteq(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_nstricteq(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_to_jsnumber(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_in(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_push_new_scope(STUB_ARGS);
-        static void JIT_STUB cti_op_jmp_scopes(STUB_ARGS);
-        static void JIT_STUB cti_op_put_by_index(STUB_ARGS);
-        static void* JIT_STUB cti_op_switch_imm(STUB_ARGS);
-        static void* JIT_STUB cti_op_switch_char(STUB_ARGS);
-        static void* JIT_STUB cti_op_switch_string(STUB_ARGS);
-        static JSValueEncodedAsPointer* JIT_STUB cti_op_del_by_val(STUB_ARGS);
-        static void JIT_STUB cti_op_put_getter(STUB_ARGS);
-        static void JIT_STUB cti_op_put_setter(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_new_error(STUB_ARGS);
-        static void JIT_STUB cti_op_debug(STUB_ARGS);
-
-        static JSValueEncodedAsPointer* JIT_STUB cti_vm_throw(STUB_ARGS);
-        static void* JIT_STUB cti_vm_dontLazyLinkCall(STUB_ARGS);
-        static void* JIT_STUB cti_vm_lazyLinkCall(STUB_ARGS);
-        static JSObject* JIT_STUB cti_op_push_activation(STUB_ARGS);
-        
-#endif // ENABLE(JIT)
-
-        // Default number of ticks before a timeout check should be done.
-        static const int initialTickCountThreshold = 1024;
-
-        bool isJSArray(JSValuePtr v) { return !JSImmediate::isImmediate(v) && v->asCell()->vptr() == m_jsArrayVptr; }
-        bool isJSString(JSValuePtr v) { return !JSImmediate::isImmediate(v) && v->asCell()->vptr() == m_jsStringVptr; }
-        bool isJSByteArray(JSValuePtr v) { return !JSImmediate::isImmediate(v) && v->asCell()->vptr() == m_jsByteArrayVptr; }
+        NEVER_INLINE JSValue callEval(CallFrame*, RegisterFile*, Register* argv, int argc, int registerOffset, JSValue& exceptionValue);
+        NEVER_INLINE HandlerInfo* throwException(CallFrame*&, JSValue&, unsigned bytecodeOffset, bool);
+        NEVER_INLINE void debug(CallFrame*, DebugHookID, int firstLine, int lastLine);
 
     private:
         enum ExecutionFlag { Normal, InitializeAndReturn };
 
-        NEVER_INLINE JSValuePtr callEval(CallFrame*, RegisterFile*, Register* argv, int argc, int registerOffset, JSValuePtr& exceptionValue);
-        JSValuePtr execute(EvalNode*, CallFrame*, JSObject* thisObject, int globalRegisterOffset, ScopeChainNode*, JSValuePtr* exception);
+        CallFrameClosure prepareForRepeatCall(FunctionBodyNode*, CallFrame*, JSFunction*, int argCount, ScopeChainNode*, JSValue* exception);
+        void endRepeatCall(CallFrameClosure&);
+        JSValue execute(CallFrameClosure&, JSValue* exception);
 
-        NEVER_INLINE void debug(CallFrame*, DebugHookID, int firstLine, int lastLine);
+        JSValue execute(EvalNode*, CallFrame*, JSObject* thisObject, int globalRegisterOffset, ScopeChainNode*, JSValue* exception);
 
-        NEVER_INLINE bool resolve(CallFrame*, Instruction*, JSValuePtr& exceptionValue);
-        NEVER_INLINE bool resolveSkip(CallFrame*, Instruction*, JSValuePtr& exceptionValue);
-        NEVER_INLINE bool resolveGlobal(CallFrame*, Instruction*, JSValuePtr& exceptionValue);
+#if USE(INTERPRETER)
+        NEVER_INLINE bool resolve(CallFrame*, Instruction*, JSValue& exceptionValue);
+        NEVER_INLINE bool resolveSkip(CallFrame*, Instruction*, JSValue& exceptionValue);
+        NEVER_INLINE bool resolveGlobal(CallFrame*, Instruction*, JSValue& exceptionValue);
         NEVER_INLINE void resolveBase(CallFrame*, Instruction* vPC);
-        NEVER_INLINE bool resolveBaseAndProperty(CallFrame*, Instruction*, JSValuePtr& exceptionValue);
+        NEVER_INLINE bool resolveBaseAndProperty(CallFrame*, Instruction*, JSValue& exceptionValue);
+        NEVER_INLINE bool resolveBaseAndFunc(CallFrame*, Instruction*, JSValue& exceptionValue);
         NEVER_INLINE ScopeChainNode* createExceptionScope(CallFrame*, const Instruction* vPC);
 
-        NEVER_INLINE bool unwindCallFrame(CallFrame*&, JSValuePtr, unsigned& bytecodeOffset, CodeBlock*&);
-        NEVER_INLINE HandlerInfo* throwException(CallFrame*&, JSValuePtr&, unsigned bytecodeOffset, bool);
-        NEVER_INLINE bool resolveBaseAndFunc(CallFrame*, Instruction*, JSValuePtr& exceptionValue);
+        void tryCacheGetByID(CallFrame*, CodeBlock*, Instruction*, JSValue baseValue, const Identifier& propertyName, const PropertySlot&);
+        void uncacheGetByID(CodeBlock*, Instruction* vPC);
+        void tryCachePutByID(CallFrame*, CodeBlock*, Instruction*, JSValue baseValue, const PutPropertySlot&);
+        void uncachePutByID(CodeBlock*, Instruction* vPC);        
+#endif
+
+        NEVER_INLINE bool unwindCallFrame(CallFrame*&, JSValue, unsigned& bytecodeOffset, CodeBlock*&);
 
         static ALWAYS_INLINE CallFrame* slideRegisterWindowForCall(CodeBlock*, RegisterFile*, CallFrame*, size_t registerOffset, int argc);
 
         static CallFrame* findFunctionCallFrame(CallFrame*, InternalFunction*);
 
-        JSValuePtr privateExecute(ExecutionFlag, RegisterFile*, CallFrame*, JSValuePtr* exception);
+        JSValue privateExecute(ExecutionFlag, RegisterFile*, CallFrame*, JSValue* exception);
 
         void dumpCallFrame(CallFrame*);
         void dumpRegisters(CallFrame*);
-
-        bool checkTimeout(JSGlobalObject*);
-        void resetTimeoutCheck();
-
-        void tryCacheGetByID(CallFrame*, CodeBlock*, Instruction*, JSValuePtr baseValue, const Identifier& propertyName, const PropertySlot&);
-        void uncacheGetByID(CodeBlock*, Instruction* vPC);
-        void tryCachePutByID(CallFrame*, CodeBlock*, Instruction*, JSValuePtr baseValue, const PutPropertySlot&);
-        void uncachePutByID(CodeBlock*, Instruction* vPC);
         
         bool isCallBytecode(Opcode opcode) { return opcode == getOpcode(op_call) || opcode == getOpcode(op_construct) || opcode == getOpcode(op_call_eval); }
 
-#if ENABLE(JIT)
-        static void throwStackOverflowPreviousFrame(CallFrame**, JSGlobalData*, void*& returnAddress);
-
-        void tryCTICacheGetByID(CallFrame*, CodeBlock*, void* returnAddress, JSValuePtr baseValue, const Identifier& propertyName, const PropertySlot&);
-        void tryCTICachePutByID(CallFrame*, CodeBlock*, void* returnAddress, JSValuePtr baseValue, const PutPropertySlot&);
-#endif
-
         SamplingTool* m_sampler;
 
-#if ENABLE(JIT)
-        RefPtr<ExecutablePool> m_executablePool;
-        void* m_ctiArrayLengthTrampoline;
-        void* m_ctiStringLengthTrampoline;
-        void* m_ctiVirtualCallPreLink;
-        void* m_ctiVirtualCallLink;
-        void* m_ctiVirtualCall;
-#endif
-
         int m_reentryDepth;
-        unsigned m_timeoutTime;
-        unsigned m_timeAtLastCheckTimeout;
-        unsigned m_timeExecuting;
-        unsigned m_timeoutCheckCount;
-        unsigned m_ticksUntilNextTimeoutCheck;
 
         RegisterFile m_registerFile;
         
-        void* m_jsArrayVptr;
-        void* m_jsByteArrayVptr;
-        void* m_jsStringVptr;
-        void* m_jsFunctionVptr;
-
 #if HAVE(COMPUTED_GOTO)
         Opcode m_opcodeTable[numOpcodeIDs]; // Maps OpcodeID => Opcode for compiling
         HashMap<Opcode, OpcodeID> m_opcodeIDTable; // Maps Opcode => OpcodeID for decompiling
 #endif
     };
-
+    
 } // namespace JSC
 
 #endif // Interpreter_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
index 9ad1815..31f0c8b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/Register.h
@@ -30,6 +30,8 @@
 #define Register_h
 
 #include "JSValue.h"
+#include <wtf/Assertions.h>
+#include <wtf/FastAllocBase.h>
 #include <wtf/VectorTraits.h>
 
 namespace JSC {
@@ -46,27 +48,29 @@ namespace JSC {
 
     typedef ExecState CallFrame;
 
-    class Register {
+    class Register : public WTF::FastAllocBase {
     public:
         Register();
-        Register(JSValuePtr);
+        Register(JSValue);
+        Register(Arguments*);
 
-        JSValuePtr jsValue(CallFrame*) const;
-        JSValuePtr getJSValue() const;
+        JSValue jsValue() const;
 
         bool marked() const;
         void mark();
         
+        int32_t i() const;
+        void* v() const;
+
     private:
         friend class ExecState;
         friend class Interpreter;
 
-        // Only CallFrame and Interpreter should use these functions.
+        // Only CallFrame, Interpreter, and JITStubs should use these functions.
 
         Register(intptr_t);
 
         Register(JSActivation*);
-        Register(Arguments*);
         Register(CallFrame*);
         Register(CodeBlock*);
         Register(JSFunction*);
@@ -74,9 +78,6 @@ namespace JSC {
         Register(ScopeChainNode*);
         Register(Instruction*);
 
-        intptr_t i() const;
-        void* v() const;
-
         JSActivation* activation() const;
         Arguments* arguments() const;
         CallFrame* callFrame() const;
@@ -89,7 +90,7 @@ namespace JSC {
         union {
             intptr_t i;
             void* v;
-            JSValueEncodedAsPointer* value;
+            EncodedJSValue value;
 
             JSActivation* activation;
             Arguments* arguments;
@@ -100,136 +101,89 @@ namespace JSC {
             ScopeChainNode* scopeChain;
             Instruction* vPC;
         } u;
-
-#ifndef NDEBUG
-        enum {
-            EmptyType,
-
-            IntType,
-            ValueType,
-
-            ActivationType,
-            ArgumentsType,
-            CallFrameType,
-            CodeBlockType,
-            FunctionType,
-            InstructionType,
-            PropertyNameIteratorType,
-            RegisterType,
-            ScopeChainNodeType
-        } m_type;
-#endif
     };
 
-#ifndef NDEBUG
-    #define SET_TYPE(type) m_type = (type)
-    // FIXME: The CTI code to put value into registers doesn't set m_type.
-    // Once it does, we can turn this assertion back on.
-    #define ASSERT_TYPE(type)
-#else
-    #define SET_TYPE(type)
-    #define ASSERT_TYPE(type)
-#endif
-
     ALWAYS_INLINE Register::Register()
     {
 #ifndef NDEBUG
-        SET_TYPE(EmptyType);
-        u.value = JSValuePtr::encode(noValue());
+        u.value = JSValue::encode(JSValue());
 #endif
     }
 
-    ALWAYS_INLINE Register::Register(JSValuePtr v)
+    ALWAYS_INLINE Register::Register(JSValue v)
     {
-        SET_TYPE(ValueType);
-        u.value = JSValuePtr::encode(v);
+        u.value = JSValue::encode(v);
     }
 
-    // This function is scaffolding for legacy clients. It will eventually go away.
-    ALWAYS_INLINE JSValuePtr Register::jsValue(CallFrame*) const
+    ALWAYS_INLINE JSValue Register::jsValue() const
     {
-        // Once registers hold doubles, this function will allocate a JSValue*
-        // if the register doesn't hold one already. 
-        ASSERT_TYPE(ValueType);
-        return JSValuePtr::decode(u.value);
-    }
-    
-    ALWAYS_INLINE JSValuePtr Register::getJSValue() const
-    {
-        ASSERT_TYPE(JSValueType);
-        return JSValuePtr::decode(u.value);
+        return JSValue::decode(u.value);
     }
     
     ALWAYS_INLINE bool Register::marked() const
     {
-        return getJSValue()->marked();
+        return jsValue().marked();
     }
 
     ALWAYS_INLINE void Register::mark()
     {
-        getJSValue()->mark();
+        jsValue().mark();
     }
     
     // Interpreter functions
 
     ALWAYS_INLINE Register::Register(Arguments* arguments)
     {
-        SET_TYPE(ArgumentsType);
         u.arguments = arguments;
     }
 
     ALWAYS_INLINE Register::Register(JSActivation* activation)
     {
-        SET_TYPE(ActivationType);
         u.activation = activation;
     }
 
     ALWAYS_INLINE Register::Register(CallFrame* callFrame)
     {
-        SET_TYPE(CallFrameType);
         u.callFrame = callFrame;
     }
 
     ALWAYS_INLINE Register::Register(CodeBlock* codeBlock)
     {
-        SET_TYPE(CodeBlockType);
         u.codeBlock = codeBlock;
     }
 
     ALWAYS_INLINE Register::Register(JSFunction* function)
     {
-        SET_TYPE(FunctionType);
         u.function = function;
     }
 
     ALWAYS_INLINE Register::Register(Instruction* vPC)
     {
-        SET_TYPE(InstructionType);
         u.vPC = vPC;
     }
 
     ALWAYS_INLINE Register::Register(ScopeChainNode* scopeChain)
     {
-        SET_TYPE(ScopeChainNodeType);
         u.scopeChain = scopeChain;
     }
 
     ALWAYS_INLINE Register::Register(JSPropertyNameIterator* propertyNameIterator)
     {
-        SET_TYPE(PropertyNameIteratorType);
         u.propertyNameIterator = propertyNameIterator;
     }
 
     ALWAYS_INLINE Register::Register(intptr_t i)
     {
-        SET_TYPE(IntType);
+        // See comment on 'i()' below.
+        ASSERT(i == static_cast<int32_t>(i));
         u.i = i;
     }
 
-    ALWAYS_INLINE intptr_t Register::i() const
+    // Read 'i' as a 32-bit integer; we only use it to hold 32-bit values,
+    // and we only write 32-bits when writing the arg count from JIT code.
+    ALWAYS_INLINE int32_t Register::i() const
     {
-        ASSERT_TYPE(IntType);
-        return u.i;
+        return static_cast<int32_t>(u.i);
     }
     
     ALWAYS_INLINE void* Register::v() const
@@ -239,55 +193,44 @@ namespace JSC {
 
     ALWAYS_INLINE JSActivation* Register::activation() const
     {
-        ASSERT_TYPE(ActivationType);
         return u.activation;
     }
     
     ALWAYS_INLINE Arguments* Register::arguments() const
     {
-        ASSERT_TYPE(ArgumentsType);
         return u.arguments;
     }
     
     ALWAYS_INLINE CallFrame* Register::callFrame() const
     {
-        ASSERT_TYPE(CallFrameType);
         return u.callFrame;
     }
     
     ALWAYS_INLINE CodeBlock* Register::codeBlock() const
     {
-        ASSERT_TYPE(CodeBlockType);
         return u.codeBlock;
     }
     
     ALWAYS_INLINE JSFunction* Register::function() const
     {
-        ASSERT_TYPE(FunctionType);
         return u.function;
     }
     
     ALWAYS_INLINE JSPropertyNameIterator* Register::propertyNameIterator() const
     {
-        ASSERT_TYPE(PropertyNameIteratorType);
         return u.propertyNameIterator;
     }
     
     ALWAYS_INLINE ScopeChainNode* Register::scopeChain() const
     {
-        ASSERT_TYPE(ScopeChainNodeType);
         return u.scopeChain;
     }
     
     ALWAYS_INLINE Instruction* Register::vPC() const
     {
-        ASSERT_TYPE(InstructionType);
         return u.vPC;
     }
 
-    #undef SET_TYPE
-    #undef ASSERT_TYPE
-
 } // namespace JSC
 
 namespace WTF {
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp
index 50698f5..cfcf1d3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.cpp
@@ -42,4 +42,15 @@ RegisterFile::~RegisterFile()
 #endif
 }
 
+void RegisterFile::releaseExcessCapacity()
+{
+#if HAVE(MMAP) && HAVE(MADV_FREE) && !HAVE(VIRTUALALLOC)
+    while (madvise(m_start, (m_max - m_start) * sizeof(Register), MADV_FREE) == -1 && errno == EAGAIN) { }
+#elif HAVE(VIRTUALALLOC)
+    VirtualFree(m_start, (m_max - m_start) * sizeof(Register), MEM_DECOMMIT);
+    m_commitEnd = m_start;
+#endif
+    m_maxUsed = m_start;
+}
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h
index 9a792ee..3a6e63b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h
+++ b/src/3rdparty/webkit/JavaScriptCore/interpreter/RegisterFile.h
@@ -29,9 +29,11 @@
 #ifndef RegisterFile_h
 #define RegisterFile_h
 
-#include "Register.h"
 #include "Collector.h"
+#include "ExecutableAllocator.h"
+#include "Register.h"
 #include <wtf/Noncopyable.h>
+#include <wtf/VMTags.h>
 
 #if HAVE(MMAP)
 #include <errno.h>
@@ -111,52 +113,11 @@ namespace JSC {
 
         static const size_t defaultCapacity = 524288;
         static const size_t defaultMaxGlobals = 8192;
-        static const size_t allocationSize = 1 << 14;
-        static const size_t allocationSizeMask = allocationSize - 1;
-
-        RegisterFile(size_t capacity = defaultCapacity, size_t maxGlobals = defaultMaxGlobals)
-            : m_numGlobals(0)
-            , m_maxGlobals(maxGlobals)
-            , m_start(0)
-            , m_end(0)
-            , m_max(0)
-            , m_buffer(0)
-            , m_globalObject(0)
-        {
-            size_t bufferLength = (capacity + maxGlobals) * sizeof(Register);
-#if HAVE(MMAP)
-            m_buffer = static_cast<Register*>(mmap(0, bufferLength, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, -1, 0));
-            if (m_buffer == MAP_FAILED) {
-                fprintf(stderr, "Could not allocate register file: %d\n", errno);
-                CRASH();
-            }
-#elif HAVE(VIRTUALALLOC)
-            // Ensure bufferLength is a multiple of allocation size
-            bufferLength = (bufferLength + allocationSizeMask) & ~allocationSizeMask;
-            m_buffer = static_cast<Register*>(VirtualAlloc(0, bufferLength, MEM_RESERVE, PAGE_READWRITE));
-            if (!m_buffer) {
-#if !PLATFORM(WIN_CE)
-                fprintf(stderr, "Could not allocate register file: %d\n", errno);
-#endif
-                CRASH();
-            }
-            int initialAllocation = (maxGlobals * sizeof(Register) + allocationSizeMask) & ~allocationSizeMask;
-            void* commitCheck = VirtualAlloc(m_buffer, initialAllocation, MEM_COMMIT, PAGE_READWRITE);
-            if (commitCheck != m_buffer) {
-#if !PLATFORM(WIN_CE)
-                fprintf(stderr, "Could not allocate register file: %d\n", errno);
-#endif
-                CRASH();
-            }
-            m_maxCommitted = reinterpret_cast<Register*>(reinterpret_cast<char*>(m_buffer) + initialAllocation);
-#else
-            #error "Don't know how to reserve virtual memory on this platform."
-#endif
-            m_start = m_buffer + maxGlobals;
-            m_end = m_start;
-            m_max = m_start + capacity;
-        }
+        static const size_t commitSize = 1 << 14;
+        // Allow 8k of excess registers before we start trying to reap the registerfile
+        static const ptrdiff_t maxExcessCapacity = 8 * 1024;
 
+        RegisterFile(size_t capacity = defaultCapacity, size_t maxGlobals = defaultMaxGlobals);
         ~RegisterFile();
 
         Register* start() const { return m_start; }
@@ -166,33 +127,8 @@ namespace JSC {
         void setGlobalObject(JSGlobalObject* globalObject) { m_globalObject = globalObject; }
         JSGlobalObject* globalObject() { return m_globalObject; }
 
-        void shrink(Register* newEnd)
-        {
-            if (newEnd < m_end)
-                m_end = newEnd;
-        }
-
-        bool grow(Register* newEnd)
-        {
-            if (newEnd > m_end) {
-                if (newEnd > m_max)
-                    return false;
-#if !HAVE(MMAP) && HAVE(VIRTUALALLOC)
-                if (newEnd > m_maxCommitted) {
-                    ptrdiff_t additionalAllocation = ((reinterpret_cast<char*>(newEnd)  - reinterpret_cast<char*>(m_maxCommitted)) + allocationSizeMask) & ~allocationSizeMask;
-                    if (!VirtualAlloc(m_maxCommitted, additionalAllocation, MEM_COMMIT, PAGE_READWRITE)) {
-#if !PLATFORM(WIN_CE)
-                        fprintf(stderr, "Could not allocate register file: %d\n", errno);
-#endif
-                        CRASH();
-                    }
-                    m_maxCommitted = reinterpret_cast<Register*>(reinterpret_cast<char*>(m_maxCommitted) + additionalAllocation);
-                }
-#endif
-                m_end = newEnd;
-            }
-            return true;
-        }
+        bool grow(Register* newEnd);
+        void shrink(Register* newEnd);
         
         void setNumGlobals(size_t numGlobals) { m_numGlobals = numGlobals; }
         int numGlobals() const { return m_numGlobals; }
@@ -204,19 +140,118 @@ namespace JSC {
         void markCallFrames(Heap* heap) { heap->markConservatively(m_start, m_end); }
 
     private:
+        void releaseExcessCapacity();
         size_t m_numGlobals;
         const size_t m_maxGlobals;
         Register* m_start;
         Register* m_end;
         Register* m_max;
         Register* m_buffer;
+        Register* m_maxUsed;
+
 #if HAVE(VIRTUALALLOC)
-        Register* m_maxCommitted;
+        Register* m_commitEnd;
 #endif
 
         JSGlobalObject* m_globalObject; // The global object whose vars are currently stored in the register file.
     };
 
+    // FIXME: Add a generic getpagesize() to WTF, then move this function to WTF as well.
+    inline bool isPageAligned(size_t size) { return size != 0 && size % (8 * 1024) == 0; }
+
+    inline RegisterFile::RegisterFile(size_t capacity, size_t maxGlobals)
+        : m_numGlobals(0)
+        , m_maxGlobals(maxGlobals)
+        , m_start(0)
+        , m_end(0)
+        , m_max(0)
+        , m_buffer(0)
+        , m_globalObject(0)
+    {
+        // Verify that our values will play nice with mmap and VirtualAlloc.
+        ASSERT(isPageAligned(maxGlobals));
+        ASSERT(isPageAligned(capacity));
+
+        size_t bufferLength = (capacity + maxGlobals) * sizeof(Register);
+    #if HAVE(MMAP)
+        m_buffer = static_cast<Register*>(mmap(0, bufferLength, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANON, VM_TAG_FOR_REGISTERFILE_MEMORY, 0));
+        if (m_buffer == MAP_FAILED) {
+#if PLATFORM(WINCE)
+            fprintf(stderr, "Could not allocate register file: %d\n", GetLastError());
+#else
+            fprintf(stderr, "Could not allocate register file: %d\n", errno);
+#endif
+            CRASH();
+        }
+    #elif HAVE(VIRTUALALLOC)
+        m_buffer = static_cast<Register*>(VirtualAlloc(0, roundUpAllocationSize(bufferLength, commitSize), MEM_RESERVE, PAGE_READWRITE));
+        if (!m_buffer) {
+#if PLATFORM(WINCE)
+            fprintf(stderr, "Could not allocate register file: %d\n", GetLastError());
+#else
+            fprintf(stderr, "Could not allocate register file: %d\n", errno);
+#endif
+            CRASH();
+        }
+        size_t committedSize = roundUpAllocationSize(maxGlobals * sizeof(Register), commitSize);
+        void* commitCheck = VirtualAlloc(m_buffer, committedSize, MEM_COMMIT, PAGE_READWRITE);
+        if (commitCheck != m_buffer) {
+#if PLATFORM(WINCE)
+            fprintf(stderr, "Could not allocate register file: %d\n", GetLastError());
+#else
+            fprintf(stderr, "Could not allocate register file: %d\n", errno);
+#endif
+            CRASH();
+        }
+        m_commitEnd = reinterpret_cast<Register*>(reinterpret_cast<char*>(m_buffer) + committedSize);
+    #else
+        #error "Don't know how to reserve virtual memory on this platform."
+    #endif
+        m_start = m_buffer + maxGlobals;
+        m_end = m_start;
+        m_maxUsed = m_end;
+        m_max = m_start + capacity;
+    }
+
+    inline void RegisterFile::shrink(Register* newEnd)
+    {
+        if (newEnd >= m_end)
+            return;
+        m_end = newEnd;
+        if (m_end == m_start && (m_maxUsed - m_start) > maxExcessCapacity)
+            releaseExcessCapacity();
+    }
+
+    inline bool RegisterFile::grow(Register* newEnd)
+    {
+        if (newEnd < m_end)
+            return true;
+
+        if (newEnd > m_max)
+            return false;
+
+#if !HAVE(MMAP) && HAVE(VIRTUALALLOC)
+        if (newEnd > m_commitEnd) {
+            size_t size = roundUpAllocationSize(reinterpret_cast<char*>(newEnd) - reinterpret_cast<char*>(m_commitEnd), commitSize);
+            if (!VirtualAlloc(m_commitEnd, size, MEM_COMMIT, PAGE_READWRITE)) {
+#if PLATFORM(WINCE)
+                fprintf(stderr, "Could not allocate register file: %d\n", GetLastError());
+#else
+                fprintf(stderr, "Could not allocate register file: %d\n", errno);
+#endif
+                CRASH();
+            }
+            m_commitEnd = reinterpret_cast<Register*>(reinterpret_cast<char*>(m_commitEnd) + size);
+        }
+#endif
+
+        if (newEnd > m_maxUsed)
+            m_maxUsed = newEnd;
+
+        m_end = newEnd;
+        return true;
+    }
+
 } // namespace JSC
 
 #endif // RegisterFile_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
index 1541256..0de4f79 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocator.h
@@ -26,18 +26,47 @@
 #ifndef ExecutableAllocator_h
 #define ExecutableAllocator_h
 
-#if ENABLE(ASSEMBLER)
-
+#include <limits>
 #include <wtf/Assertions.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
+#include <wtf/UnusedParam.h>
 #include <wtf/Vector.h>
 
-#include <limits>
+#if PLATFORM(IPHONE)
+#include <libkern/OSCacheControl.h>
+#include <sys/mman.h>
+#endif
 
 #define JIT_ALLOCATOR_PAGE_SIZE (ExecutableAllocator::pageSize)
 #define JIT_ALLOCATOR_LARGE_ALLOC_SIZE (ExecutableAllocator::pageSize * 4)
 
+#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
+#define PROTECTION_FLAGS_RW (PROT_READ | PROT_WRITE)
+#define PROTECTION_FLAGS_RX (PROT_READ | PROT_EXEC)
+#define INITIAL_PROTECTION_FLAGS PROTECTION_FLAGS_RX
+#else
+#define INITIAL_PROTECTION_FLAGS (PROT_READ | PROT_WRITE | PROT_EXEC)
+#endif
+
+namespace JSC {
+
+inline size_t roundUpAllocationSize(size_t request, size_t granularity)
+{
+    if ((std::numeric_limits<size_t>::max() - granularity) <= request)
+        CRASH(); // Allocation is too large
+    
+    // Round up to next page boundary
+    size_t size = request + (granularity - 1);
+    size = size & ~(granularity - 1);
+    ASSERT(size >= request);
+    return size;
+}
+
+}
+
+#if ENABLE(ASSEMBLER)
+
 namespace JSC {
 
 class ExecutablePool : public RefCounted<ExecutablePool> {
@@ -86,18 +115,6 @@ private:
     static Allocation systemAlloc(size_t n);
     static void systemRelease(const Allocation& alloc);
 
-    inline size_t roundUpAllocationSize(size_t request, size_t granularity)
-    {
-        if ((std::numeric_limits<size_t>::max() - granularity) <= request)
-            CRASH(); // Allocation is too large
-        
-        // Round up to next page boundary
-        size_t size = request + (granularity - 1);
-        size = size & ~(granularity - 1);
-        ASSERT(size >= request);
-        return size;
-    }
-
     ExecutablePool(size_t n);
 
     void* poolAllocate(size_t n);
@@ -108,6 +125,8 @@ private:
 };
 
 class ExecutableAllocator {
+    enum ProtectionSeting { Writable, Executable };
+
 public:
     static size_t pageSize;
     ExecutableAllocator()
@@ -137,7 +156,69 @@ public:
         return pool.release();
     }
 
+#if ENABLE(ASSEMBLER_WX_EXCLUSIVE) || !(PLATFORM(X86) || PLATFORM(X86_64))
+    static void makeWritable(void* start, size_t size)
+    {
+        reprotectRegion(start, size, Writable);
+    }
+
+    static void makeExecutable(void* start, size_t size)
+    {
+        reprotectRegion(start, size, Executable);
+        cacheFlush(start, size);
+    }
+
+    // If ASSEMBLER_WX_EXCLUSIVE protection is turned on, or on non-x86 platforms,
+    // we need to track start & size so we can makeExecutable/cacheFlush at the end.
+    class MakeWritable {
+    public:
+        MakeWritable(void* start, size_t size)
+            : m_start(start)
+            , m_size(size)
+        {
+            makeWritable(start, size);
+        }
+
+        ~MakeWritable()
+        {
+            makeExecutable(m_start, m_size);
+        }
+
+    private:
+        void* m_start;
+        size_t m_size;
+    };
+#else
+    static void makeWritable(void*, size_t) {}
+    static void makeExecutable(void*, size_t) {}
+
+    // On x86, without ASSEMBLER_WX_EXCLUSIVE, there is nothing to do here.
+    class MakeWritable { public: MakeWritable(void*, size_t) {} };
+#endif
+
 private:
+
+#if ENABLE(ASSEMBLER_WX_EXCLUSIVE) || !(PLATFORM(X86) || PLATFORM(X86_64))
+#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
+    static void reprotectRegion(void*, size_t, ProtectionSeting);
+#else
+    static void reprotectRegion(void*, size_t, ProtectionSeting) {}
+#endif
+
+   static void cacheFlush(void* code, size_t size)
+    {
+#if PLATFORM(X86) || PLATFORM(X86_64)
+        UNUSED_PARAM(code);
+        UNUSED_PARAM(size);
+#elif PLATFORM_ARM_ARCH(7) && PLATFORM(IPHONE)
+        sys_dcache_flush(code, size);
+        sys_icache_invalidate(code, size);
+#else
+#error "ExecutableAllocator::cacheFlush not implemented on this platform."
+#endif
+    }
+#endif
+
     RefPtr<ExecutablePool> m_smallAllocationPool;
     static void intializePageSize();
 };
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
new file mode 100644
index 0000000..7682b9c
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorFixedVMPool.cpp
@@ -0,0 +1,447 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#include "ExecutableAllocator.h"
+
+#include <errno.h>
+
+#if ENABLE(ASSEMBLER) && PLATFORM(MAC) && PLATFORM(X86_64)
+
+#include "TCSpinLock.h"
+#include <mach/mach_init.h>
+#include <mach/vm_map.h>
+#include <sys/mman.h>
+#include <unistd.h>
+#include <wtf/AVLTree.h>
+#include <wtf/VMTags.h>
+
+using namespace WTF;
+
+namespace JSC {
+
+#define TWO_GB (2u * 1024u * 1024u * 1024u)
+#define SIXTEEN_MB (16u * 1024u * 1024u)
+
+// FreeListEntry describes a free chunk of memory, stored in the freeList.
+struct FreeListEntry {
+    FreeListEntry(void* pointer, size_t size)
+        : pointer(pointer)
+        , size(size)
+        , nextEntry(0)
+        , less(0)
+        , greater(0)
+        , balanceFactor(0)
+    {
+    }
+
+    // All entries of the same size share a single entry
+    // in the AVLTree, and are linked together in a linked
+    // list, using nextEntry.
+    void* pointer;
+    size_t size;
+    FreeListEntry* nextEntry;
+
+    // These fields are used by AVLTree.
+    FreeListEntry* less;
+    FreeListEntry* greater;
+    int balanceFactor;
+};
+
+// Abstractor class for use in AVLTree.
+// Nodes in the AVLTree are of type FreeListEntry, keyed on
+// (and thus sorted by) their size.
+struct AVLTreeAbstractorForFreeList {
+    typedef FreeListEntry* handle;
+    typedef int32_t size;
+    typedef size_t key;
+
+    handle get_less(handle h) { return h->less; }
+    void set_less(handle h, handle lh) { h->less = lh; }
+    handle get_greater(handle h) { return h->greater; }
+    void set_greater(handle h, handle gh) { h->greater = gh; }
+    int get_balance_factor(handle h) { return h->balanceFactor; }
+    void set_balance_factor(handle h, int bf) { h->balanceFactor = bf; }
+
+    static handle null() { return 0; }
+
+    int compare_key_key(key va, key vb) { return va - vb; }
+    int compare_key_node(key k, handle h) { return compare_key_key(k, h->size); }
+    int compare_node_node(handle h1, handle h2) { return compare_key_key(h1->size, h2->size); }
+};
+
+// Used to reverse sort an array of FreeListEntry pointers.
+static int reverseSortFreeListEntriesByPointer(const void* leftPtr, const void* rightPtr)
+{
+    FreeListEntry* left = *(FreeListEntry**)leftPtr;
+    FreeListEntry* right = *(FreeListEntry**)rightPtr;
+
+    return (intptr_t)(right->pointer) - (intptr_t)(left->pointer);
+}
+
+// Used to reverse sort an array of pointers.
+static int reverseSortCommonSizedAllocations(const void* leftPtr, const void* rightPtr)
+{
+    void* left = *(void**)leftPtr;
+    void* right = *(void**)rightPtr;
+
+    return (intptr_t)right - (intptr_t)left;
+}
+
+class FixedVMPoolAllocator
+{
+    // The free list is stored in a sorted tree.
+    typedef AVLTree<AVLTreeAbstractorForFreeList, 40> SizeSortedFreeTree;
+
+    // Use madvise as apropriate to prevent freed pages from being spilled,
+    // and to attempt to ensure that used memory is reported correctly.
+#if HAVE(MADV_FREE_REUSE)
+    void release(void* position, size_t size)
+    {
+        while (madvise(position, size, MADV_FREE_REUSABLE) == -1 && errno == EAGAIN) { }
+    }
+
+    void reuse(void* position, size_t size)
+    {
+        while (madvise(position, size, MADV_FREE_REUSE) == -1 && errno == EAGAIN) { }
+    }
+#elif HAVE(MADV_DONTNEED)
+    void release(void* position, size_t size)
+    {
+        while (madvise(position, size, MADV_DONTNEED) == -1 && errno == EAGAIN) { }
+    }
+
+    void reuse(void*, size_t) {}
+#else
+    void release(void*, size_t) {}
+    void reuse(void*, size_t) {}
+#endif
+
+    // All addition to the free list should go through this method, rather than
+    // calling insert directly, to avoid multiple entries beging added with the
+    // same key.  All nodes being added should be singletons, they should not
+    // already be a part of a chain.
+    void addToFreeList(FreeListEntry* entry)
+    {
+        ASSERT(!entry->nextEntry);
+
+        if (entry->size == m_commonSize) {
+            m_commonSizedAllocations.append(entry->pointer);
+            delete entry;
+        } else if (FreeListEntry* entryInFreeList = m_freeList.search(entry->size, m_freeList.EQUAL)) {
+            // m_freeList already contain an entry for this size - insert this node into the chain.
+            entry->nextEntry = entryInFreeList->nextEntry;
+            entryInFreeList->nextEntry = entry;
+        } else
+            m_freeList.insert(entry);
+    }
+
+    // We do not attempt to coalesce addition, which may lead to fragmentation;
+    // instead we periodically perform a sweep to try to coalesce neigboring
+    // entries in m_freeList.  Presently this is triggered at the point 16MB
+    // of memory has been released.
+    void coalesceFreeSpace()
+    {
+        Vector<FreeListEntry*> freeListEntries;
+        SizeSortedFreeTree::Iterator iter;
+        iter.start_iter_least(m_freeList);
+
+        // Empty m_freeList into a Vector.
+        for (FreeListEntry* entry; (entry = *iter); ++iter) {
+            // Each entry in m_freeList might correspond to multiple
+            // free chunks of memory (of the same size).  Walk the chain
+            // (this is likely of couse only be one entry long!) adding
+            // each entry to the Vector (at reseting the next in chain
+            // pointer to separate each node out).
+            FreeListEntry* next;
+            do {
+                next = entry->nextEntry;
+                entry->nextEntry = 0;
+                freeListEntries.append(entry);
+            } while ((entry = next));
+        }
+        // All entries are now in the Vector; purge the tree.
+        m_freeList.purge();
+
+        // Reverse-sort the freeListEntries and m_commonSizedAllocations Vectors.
+        // We reverse-sort so that we can logically work forwards through memory,
+        // whilst popping items off the end of the Vectors using last() and removeLast().
+        qsort(freeListEntries.begin(), freeListEntries.size(), sizeof(FreeListEntry*), reverseSortFreeListEntriesByPointer);
+        qsort(m_commonSizedAllocations.begin(), m_commonSizedAllocations.size(), sizeof(void*), reverseSortCommonSizedAllocations);
+
+        // The entries from m_commonSizedAllocations that cannot be
+        // coalesced into larger chunks will be temporarily stored here.
+        Vector<void*> newCommonSizedAllocations;
+
+        // Keep processing so long as entries remain in either of the vectors.
+        while (freeListEntries.size() || m_commonSizedAllocations.size()) {
+            // We're going to try to find a FreeListEntry node that we can coalesce onto.
+            FreeListEntry* coalescionEntry = 0;
+
+            // Is the lowest addressed chunk of free memory of common-size, or is it in the free list?
+            if (m_commonSizedAllocations.size() && (!freeListEntries.size() || (m_commonSizedAllocations.last() < freeListEntries.last()->pointer))) {
+                // Pop an item from the m_commonSizedAllocations vector - this is the lowest
+                // addressed free chunk.  Find out the begin and end addresses of the memory chunk.
+                void* begin = m_commonSizedAllocations.last();
+                void* end = (void*)((intptr_t)begin + m_commonSize);
+                m_commonSizedAllocations.removeLast();
+
+                // Try to find another free chunk abutting onto the end of the one we have already found.
+                if (freeListEntries.size() && (freeListEntries.last()->pointer == end)) {
+                    // There is an existing FreeListEntry for the next chunk of memory!
+                    // we can reuse this.  Pop it off the end of m_freeList.
+                    coalescionEntry = freeListEntries.last();
+                    freeListEntries.removeLast();
+                    // Update the existing node to include the common-sized chunk that we also found. 
+                    coalescionEntry->pointer = (void*)((intptr_t)coalescionEntry->pointer - m_commonSize);
+                    coalescionEntry->size += m_commonSize;
+                } else if (m_commonSizedAllocations.size() && (m_commonSizedAllocations.last() == end)) {
+                    // There is a second common-sized chunk that can be coalesced.
+                    // Allocate a new node.
+                    m_commonSizedAllocations.removeLast();
+                    coalescionEntry = new FreeListEntry(begin, 2 * m_commonSize);
+                } else {
+                    // Nope - this poor little guy is all on his own. :-(
+                    // Add him into the newCommonSizedAllocations vector for now, we're
+                    // going to end up adding him back into the m_commonSizedAllocations
+                    // list when we're done.
+                    newCommonSizedAllocations.append(begin);
+                    continue;
+                }
+            } else {
+                ASSERT(freeListEntries.size());
+                ASSERT(!m_commonSizedAllocations.size() || (freeListEntries.last()->pointer < m_commonSizedAllocations.last()));
+                // The lowest addressed item is from m_freeList; pop it from the Vector.
+                coalescionEntry = freeListEntries.last();
+                freeListEntries.removeLast();
+            }
+            
+            // Right, we have a FreeListEntry, we just need check if there is anything else
+            // to coalesce onto the end.
+            ASSERT(coalescionEntry);
+            while (true) {
+                // Calculate the end address of the chunk we have found so far.
+                void* end = (void*)((intptr_t)coalescionEntry->pointer - coalescionEntry->size);
+
+                // Is there another chunk adjacent to the one we already have?
+                if (freeListEntries.size() && (freeListEntries.last()->pointer == end)) {
+                    // Yes - another FreeListEntry -pop it from the list.
+                    FreeListEntry* coalescee = freeListEntries.last();
+                    freeListEntries.removeLast();
+                    // Add it's size onto our existing node.
+                    coalescionEntry->size += coalescee->size;
+                    delete coalescee;
+                } else if (m_commonSizedAllocations.size() && (m_commonSizedAllocations.last() == end)) {
+                    // We can coalesce the next common-sized chunk.
+                    m_commonSizedAllocations.removeLast();
+                    coalescionEntry->size += m_commonSize;
+                } else
+                    break; // Nope, nothing to be added - stop here.
+            }
+
+            // We've coalesced everything we can onto the current chunk.
+            // Add it back into m_freeList.
+            addToFreeList(coalescionEntry);
+        }
+
+        // All chunks of free memory larger than m_commonSize should be
+        // back in m_freeList by now.  All that remains to be done is to
+        // copy the contents on the newCommonSizedAllocations back into
+        // the m_commonSizedAllocations Vector.
+        ASSERT(m_commonSizedAllocations.size() == 0);
+        m_commonSizedAllocations.append(newCommonSizedAllocations);
+    }
+
+public:
+
+    FixedVMPoolAllocator(size_t commonSize, size_t totalHeapSize)
+        : m_commonSize(commonSize)
+        , m_countFreedSinceLastCoalesce(0)
+        , m_totalHeapSize(totalHeapSize)
+    {
+        // Cook up an address to allocate at, using the following recipe:
+        //   17 bits of zero, stay in userspace kids.
+        //   26 bits of randomness for ASLR.
+        //   21 bits of zero, at least stay aligned within one level of the pagetables.
+        //
+        // But! - as a temporary workaround for some plugin problems (rdar://problem/6812854),
+        // for now instead of 2^26 bits of ASLR lets stick with 25 bits of randomization plus
+        // 2^24, which should put up somewhere in the middle of usespace (in the address range
+        // 0x200000000000 .. 0x5fffffffffff).
+        intptr_t randomLocation = arc4random() & ((1 << 25) - 1);
+        randomLocation += (1 << 24);
+        randomLocation <<= 21;
+        m_base = mmap(reinterpret_cast<void*>(randomLocation), m_totalHeapSize, INITIAL_PROTECTION_FLAGS, MAP_PRIVATE | MAP_ANON, VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY, 0);
+        if (!m_base)
+            CRASH();
+
+        // For simplicity, we keep all memory in m_freeList in a 'released' state.
+        // This means that we can simply reuse all memory when allocating, without
+        // worrying about it's previous state, and also makes coalescing m_freeList
+        // simpler since we need not worry about the possibility of coalescing released
+        // chunks with non-released ones.
+        release(m_base, m_totalHeapSize);
+        m_freeList.insert(new FreeListEntry(m_base, m_totalHeapSize));
+    }
+
+    void* alloc(size_t size)
+    {
+        void* result;
+
+        // Freed allocations of the common size are not stored back into the main
+        // m_freeList, but are instead stored in a separate vector.  If the request
+        // is for a common sized allocation, check this list.
+        if ((size == m_commonSize) && m_commonSizedAllocations.size()) {
+            result = m_commonSizedAllocations.last();
+            m_commonSizedAllocations.removeLast();
+        } else {
+            // Serach m_freeList for a suitable sized chunk to allocate memory from.
+            FreeListEntry* entry = m_freeList.search(size, m_freeList.GREATER_EQUAL);
+
+            // This would be bad news.
+            if (!entry) {
+                // Errk!  Lets take a last-ditch desparation attempt at defragmentation...
+                coalesceFreeSpace();
+                // Did that free up a large enough chunk?
+                entry = m_freeList.search(size, m_freeList.GREATER_EQUAL);
+                // No?...  *BOOM!*
+                if (!entry)
+                    CRASH();
+            }
+            ASSERT(entry->size != m_commonSize);
+
+            // Remove the entry from m_freeList.  But! -
+            // Each entry in the tree may represent a chain of multiple chunks of the
+            // same size, and we only want to remove one on them.  So, if this entry
+            // does have a chain, just remove the first-but-one item from the chain.
+            if (FreeListEntry* next = entry->nextEntry) {
+                // We're going to leave 'entry' in the tree; remove 'next' from its chain.
+                entry->nextEntry = next->nextEntry;
+                next->nextEntry = 0;
+                entry = next;
+            } else
+                m_freeList.remove(entry->size);
+
+            // Whoo!, we have a result!
+            ASSERT(entry->size >= size);
+            result = entry->pointer;
+
+            // If the allocation exactly fits the chunk we found in the,
+            // m_freeList then the FreeListEntry node is no longer needed.
+            if (entry->size == size)
+                delete entry;
+            else {
+                // There is memory left over, and it is not of the common size.
+                // We can reuse the existing FreeListEntry node to add this back
+                // into m_freeList.
+                entry->pointer = (void*)((intptr_t)entry->pointer + size);
+                entry->size -= size;
+                addToFreeList(entry);
+            }
+        }
+
+        // Call reuse to report to the operating system that this memory is in use.
+        ASSERT(isWithinVMPool(result, size));
+        reuse(result, size);
+        return result;
+    }
+
+    void free(void* pointer, size_t size)
+    {
+        // Call release to report to the operating system that this
+        // memory is no longer in use, and need not be paged out.
+        ASSERT(isWithinVMPool(pointer, size));
+        release(pointer, size);
+
+        // Common-sized allocations are stored in the m_commonSizedAllocations
+        // vector; all other freed chunks are added to m_freeList.
+        if (size == m_commonSize)
+            m_commonSizedAllocations.append(pointer);
+        else
+            addToFreeList(new FreeListEntry(pointer, size));
+
+        // Do some housekeeping.  Every time we reach a point that
+        // 16MB of allocations have been freed, sweep m_freeList
+        // coalescing any neighboring fragments.
+        m_countFreedSinceLastCoalesce += size;
+        if (m_countFreedSinceLastCoalesce >= SIXTEEN_MB) {
+            m_countFreedSinceLastCoalesce = 0;
+            coalesceFreeSpace();
+        }
+    }
+
+private:
+
+#ifndef NDEBUG
+    bool isWithinVMPool(void* pointer, size_t size)
+    {
+        return pointer >= m_base && (reinterpret_cast<char*>(pointer) + size <= reinterpret_cast<char*>(m_base) + m_totalHeapSize);
+    }
+#endif
+
+    // Freed space from the most common sized allocations will be held in this list, ...
+    const size_t m_commonSize;
+    Vector<void*> m_commonSizedAllocations;
+
+    // ... and all other freed allocations are held in m_freeList.
+    SizeSortedFreeTree m_freeList;
+
+    // This is used for housekeeping, to trigger defragmentation of the freed lists.
+    size_t m_countFreedSinceLastCoalesce;
+
+    void* m_base;
+    size_t m_totalHeapSize;
+};
+
+void ExecutableAllocator::intializePageSize()
+{
+    ExecutableAllocator::pageSize = getpagesize();
+}
+
+static FixedVMPoolAllocator* allocator = 0;
+static SpinLock spinlock = SPINLOCK_INITIALIZER;
+
+ExecutablePool::Allocation ExecutablePool::systemAlloc(size_t size)
+{
+  SpinLockHolder lock_holder(&spinlock);
+
+    if (!allocator)
+        allocator = new FixedVMPoolAllocator(JIT_ALLOCATOR_LARGE_ALLOC_SIZE, TWO_GB);
+    ExecutablePool::Allocation alloc = {reinterpret_cast<char*>(allocator->alloc(size)), size};
+    return alloc;
+}
+
+void ExecutablePool::systemRelease(const ExecutablePool::Allocation& allocation) 
+{
+  SpinLockHolder lock_holder(&spinlock);
+
+    ASSERT(allocator);
+    allocator->free(allocation.pages, allocation.size);
+}
+
+}
+
+#endif // HAVE(ASSEMBLER)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
index 21955d7..4bd5a2c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorPosix.cpp
@@ -31,9 +31,12 @@
 
 #include <sys/mman.h>
 #include <unistd.h>
+#include <wtf/VMTags.h>
 
 namespace JSC {
 
+#if !(PLATFORM(MAC) && PLATFORM(X86_64))
+
 void ExecutableAllocator::intializePageSize()
 {
     ExecutableAllocator::pageSize = getpagesize();
@@ -41,16 +44,39 @@ void ExecutableAllocator::intializePageSize()
 
 ExecutablePool::Allocation ExecutablePool::systemAlloc(size_t n)
 {
-    ExecutablePool::Allocation alloc = {reinterpret_cast<char*>(mmap(NULL, n, PROT_READ | PROT_WRITE | PROT_EXEC, MAP_PRIVATE | MAP_ANON, -1, 0)), n};
+    ExecutablePool::Allocation alloc = { reinterpret_cast<char*>(mmap(NULL, n, INITIAL_PROTECTION_FLAGS, MAP_PRIVATE | MAP_ANON, VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY, 0)), n };
     return alloc;
 }
 
-void ExecutablePool::systemRelease(const ExecutablePool::Allocation& alloc) 
+void ExecutablePool::systemRelease(const ExecutablePool::Allocation& alloc)
 { 
     int result = munmap(alloc.pages, alloc.size);
     ASSERT_UNUSED(result, !result);
 }
 
+#endif // !(PLATFORM(MAC) && PLATFORM(X86_64))
+
+#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
+void ExecutableAllocator::reprotectRegion(void* start, size_t size, ProtectionSeting setting)
+{
+    if (!pageSize)
+        intializePageSize();
+
+    // Calculate the start of the page containing this region,
+    // and account for this extra memory within size.
+    intptr_t startPtr = reinterpret_cast<intptr_t>(start);
+    intptr_t pageStartPtr = startPtr & ~(pageSize - 1);
+    void* pageStart = reinterpret_cast<void*>(pageStartPtr);
+    size += (startPtr - pageStartPtr);
+
+    // Round size up
+    size += (pageSize - 1);
+    size &= ~(pageSize - 1);
+
+    mprotect(pageStart, size, (setting == Writable) ? PROTECTION_FLAGS_RW : PROTECTION_FLAGS_RX);
+}
+#endif
+
 }
 
 #endif // HAVE(ASSEMBLER)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
index 7467f81..a9ba7d0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/ExecutableAllocatorWin.cpp
@@ -51,6 +51,10 @@ void ExecutablePool::systemRelease(const ExecutablePool::Allocation& alloc)
     VirtualFree(alloc.pages, 0, MEM_RELEASE); 
 }
 
+#if ENABLE(ASSEMBLER_WX_EXCLUSIVE)
+#error "ASSEMBLER_WX_EXCLUSIVE not yet suported on this platform."
+#endif
+
 }
 
 #endif // HAVE(ASSEMBLER)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
index 0ce9bc1..02cb09b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.cpp
@@ -29,10 +29,11 @@
 #if ENABLE(JIT)
 
 #include "CodeBlock.h"
+#include "Interpreter.h"
 #include "JITInlineMethods.h"
+#include "JITStubCall.h"
 #include "JSArray.h"
 #include "JSFunction.h"
-#include "Interpreter.h"
 #include "ResultType.h"
 #include "SamplingTool.h"
 
@@ -44,159 +45,22 @@ using namespace std;
 
 namespace JSC {
 
-COMPILE_ASSERT(STUB_ARGS_code == 0xC, STUB_ARGS_code_is_C);
-COMPILE_ASSERT(STUB_ARGS_callFrame == 0xE, STUB_ARGS_callFrame_is_E);
-
-#if COMPILER(GCC) && PLATFORM(X86)
-
-#if PLATFORM(DARWIN)
-#define SYMBOL_STRING(name) "_" #name
-#else
-#define SYMBOL_STRING(name) #name
-#endif
-
-asm(
-".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-SYMBOL_STRING(ctiTrampoline) ":" "\n"
-    "pushl %ebp" "\n"
-    "movl %esp, %ebp" "\n"
-    "pushl %esi" "\n"
-    "pushl %edi" "\n"
-    "pushl %ebx" "\n"
-    "subl $0x1c, %esp" "\n"
-    "movl $512, %esi" "\n"
-    "movl 0x38(%esp), %edi" "\n" // Ox38 = 0x0E * 4, 0x0E = STUB_ARGS_callFrame (see assertion above)
-    "call *0x30(%esp)" "\n" // Ox30 = 0x0C * 4, 0x0C = STUB_ARGS_code (see assertion above)
-    "addl $0x1c, %esp" "\n"
-    "popl %ebx" "\n"
-    "popl %edi" "\n"
-    "popl %esi" "\n"
-    "popl %ebp" "\n"
-    "ret" "\n"
-);
-
-asm(
-".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
-#if USE(JIT_STUB_ARGUMENT_VA_LIST)
-    "call " SYMBOL_STRING(_ZN3JSC11Interpreter12cti_vm_throwEPvz) "\n"
-#else
-#if USE(JIT_STUB_ARGUMENT_REGISTER)
-    "movl %esp, %ecx" "\n"
-#else // JIT_STUB_ARGUMENT_STACK
-    "movl %esp, 0(%esp)" "\n"
-#endif
-    "call " SYMBOL_STRING(_ZN3JSC11Interpreter12cti_vm_throwEPPv) "\n"
-#endif
-    "addl $0x1c, %esp" "\n"
-    "popl %ebx" "\n"
-    "popl %edi" "\n"
-    "popl %esi" "\n"
-    "popl %ebp" "\n"
-    "ret" "\n"
-);
-    
-#elif COMPILER(GCC) && PLATFORM(X86_64)
-
-#if PLATFORM(DARWIN)
-#define SYMBOL_STRING(name) "_" #name
-#else
-#define SYMBOL_STRING(name) #name
-#endif
-
-asm(
-".globl " SYMBOL_STRING(ctiTrampoline) "\n"
-SYMBOL_STRING(ctiTrampoline) ":" "\n"
-    "pushq %rbp" "\n"
-    "movq %rsp, %rbp" "\n"
-    "pushq %r12" "\n"
-    "pushq %r13" "\n"
-    "pushq %rbx" "\n"
-    "subq $0x38, %rsp" "\n"
-    "movq $512, %r12" "\n"
-    "movq 0x70(%rsp), %r13" "\n" // Ox70 = 0x0E * 8, 0x0E = STUB_ARGS_callFrame (see assertion above)
-    "call *0x60(%rsp)" "\n" // Ox60 = 0x0C * 8, 0x0C = STUB_ARGS_code (see assertion above)
-    "addq $0x38, %rsp" "\n"
-    "popq %rbx" "\n"
-    "popq %r13" "\n"
-    "popq %r12" "\n"
-    "popq %rbp" "\n"
-    "ret" "\n"
-);
-
-asm(
-".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
-SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
-#if USE(JIT_STUB_ARGUMENT_REGISTER)
-    "movq %rsp, %rdi" "\n"
-    "call " SYMBOL_STRING(_ZN3JSC11Interpreter12cti_vm_throwEPPv) "\n"
-#else // JIT_STUB_ARGUMENT_VA_LIST or JIT_STUB_ARGUMENT_STACK
-#error "JIT_STUB_ARGUMENT configuration not supported."
-#endif
-    "addq $0x38, %rsp" "\n"
-    "popq %rbx" "\n"
-    "popq %r13" "\n"
-    "popq %r12" "\n"
-    "popq %rbp" "\n"
-    "ret" "\n"
-);
-    
-#elif COMPILER(MSVC)
-
-extern "C" {
-    
-    __declspec(naked) JSValueEncodedAsPointer* ctiTrampoline(void* code, RegisterFile*, CallFrame*, JSValuePtr* exception, Profiler**, JSGlobalData*)
-    {
-        __asm {
-            push ebp;
-            mov ebp, esp;
-            push esi;
-            push edi;
-            push ebx;
-            sub esp, 0x1c;
-            mov esi, 512;
-            mov ecx, esp;
-            mov edi, [esp + 0x38];
-            call [esp + 0x30]; // Ox30 = 0x0C * 4, 0x0C = STUB_ARGS_code (see assertion above)
-            add esp, 0x1c;
-            pop ebx;
-            pop edi;
-            pop esi;
-            pop ebp;
-            ret;
-        }
-    }
-    
-    __declspec(naked) void ctiVMThrowTrampoline()
-    {
-        __asm {
-#if USE(JIT_STUB_ARGUMENT_REGISTER)
-            mov ecx, esp;
-#else // JIT_STUB_ARGUMENT_VA_LIST or JIT_STUB_ARGUMENT_STACK
-#error "JIT_STUB_ARGUMENT configuration not supported."
-#endif
-            call JSC::Interpreter::cti_vm_throw;
-            add esp, 0x1c;
-            pop ebx;
-            pop edi;
-            pop esi;
-            pop ebp;
-            ret;
-        }
-    }
-    
+void ctiPatchNearCallByReturnAddress(ReturnAddressPtr returnAddress, MacroAssemblerCodePtr newCalleeFunction)
+{
+    MacroAssembler::RepatchBuffer repatchBuffer;
+    repatchBuffer.relinkNearCallerToTrampoline(returnAddress, newCalleeFunction);
 }
 
-#endif
-
-void ctiSetReturnAddress(void** where, void* what)
+void ctiPatchCallByReturnAddress(ReturnAddressPtr returnAddress, MacroAssemblerCodePtr newCalleeFunction)
 {
-    *where = what;
+    MacroAssembler::RepatchBuffer repatchBuffer;
+    repatchBuffer.relinkCallerToTrampoline(returnAddress, newCalleeFunction);
 }
 
-void ctiPatchCallByReturnAddress(void* where, void* what)
+void ctiPatchCallByReturnAddress(ReturnAddressPtr returnAddress, FunctionPtr newCalleeFunction)
 {
-    MacroAssembler::Jump::patch(where, what);
+    MacroAssembler::RepatchBuffer repatchBuffer;
+    repatchBuffer.relinkCallerToFunction(returnAddress, newCalleeFunction);
 }
 
 JIT::JIT(JSGlobalData* globalData, CodeBlock* codeBlock)
@@ -206,6 +70,7 @@ JIT::JIT(JSGlobalData* globalData, CodeBlock* codeBlock)
     , m_labels(codeBlock ? codeBlock->instructions().size() : 0)
     , m_propertyAccessCompilationInfo(codeBlock ? codeBlock->numberOfStructureStubInfos() : 0)
     , m_callStructureStubCompilationInfo(codeBlock ? codeBlock->numberOfCallLinkInfos() : 0)
+    , m_bytecodeIndex((unsigned)-1)
     , m_lastResultBytecodeRegister(std::numeric_limits<int>::max())
     , m_jumpTargetsPosition(0)
 {
@@ -213,51 +78,31 @@ JIT::JIT(JSGlobalData* globalData, CodeBlock* codeBlock)
 
 void JIT::compileOpStrictEq(Instruction* currentInstruction, CompileOpStrictEqType type)
 {
-    bool negated = (type == OpNStrictEq);
-
     unsigned dst = currentInstruction[1].u.operand;
     unsigned src1 = currentInstruction[2].u.operand;
     unsigned src2 = currentInstruction[3].u.operand;
 
-    emitGetVirtualRegisters(src1, X86::eax, src2, X86::edx);
-
-    // Check that bot are immediates, if so check if they're equal
-    Jump firstNotImmediate = emitJumpIfJSCell(X86::eax);
-    Jump secondNotImmediate = emitJumpIfJSCell(X86::edx);
-    Jump bothWereImmediatesButNotEqual = jne32(X86::edx, X86::eax);
-
-    // They are equal - set the result to true. (Or false, if negated).
-    move(ImmPtr(JSValuePtr::encode(jsBoolean(!negated))), X86::eax);
-    Jump bothWereImmediatesAndEqual = jump();
-
-    // eax was not an immediate, we haven't yet checked edx.
-    // If edx is also a JSCell, or is 0, then jump to a slow case,
-    // otherwise these values are not equal.
-    firstNotImmediate.link(this);
-    emitJumpSlowCaseIfJSCell(X86::edx);
-    addSlowCase(jePtr(X86::edx, ImmPtr(JSValuePtr::encode(JSImmediate::zeroImmediate()))));
-    Jump firstWasNotImmediate = jump();
-
-    // eax was an immediate, but edx wasn't.
-    // If eax is 0 jump to a slow case, otherwise these values are not equal.
-    secondNotImmediate.link(this);
-    addSlowCase(jePtr(X86::eax, ImmPtr(JSValuePtr::encode(JSImmediate::zeroImmediate()))));
-
-    // We get here if the two values are different immediates, or one is 0 and the other is a JSCell.
-    // Vaelues are not equal, set the result to false.
-    bothWereImmediatesButNotEqual.link(this);
-    firstWasNotImmediate.link(this);
-    move(ImmPtr(JSValuePtr::encode(jsBoolean(negated))), X86::eax);
-    
-    bothWereImmediatesAndEqual.link(this);
+    emitGetVirtualRegisters(src1, regT0, src2, regT1);
+
+    // Jump to a slow case if either operand is a number, or if both are JSCell*s.
+    move(regT0, regT2);
+    orPtr(regT1, regT2);
+    addSlowCase(emitJumpIfJSCell(regT2));
+    addSlowCase(emitJumpIfImmediateNumber(regT2));
+
+    if (type == OpStrictEq)
+        set32(Equal, regT1, regT0, regT0);
+    else
+        set32(NotEqual, regT1, regT0, regT0);
+    emitTagAsBoolImmediate(regT0);
+
     emitPutVirtualRegister(dst);
 }
 
-void JIT::emitSlowScriptCheck()
+void JIT::emitTimeoutCheck()
 {
-    Jump skipTimeout = jnzSub32(Imm32(1), timeoutCheckRegister);
-    emitCTICall(Interpreter::cti_timeout_check);
-    move(X86::eax, timeoutCheckRegister);
+    Jump skipTimeout = branchSub32(NonZero, Imm32(1), timeoutCheckRegister);
+    JITStubCall(this, JITStubs::cti_timeout_check).call(timeoutCheckRegister);
     skipTimeout.link(this);
 
     killLastResultRegister();
@@ -268,20 +113,32 @@ void JIT::emitSlowScriptCheck()
     m_bytecodeIndex += OPCODE_LENGTH(name); \
     break;
 
-#define CTI_COMPILE_BINARY_OP(name) \
+#define DEFINE_BINARY_OP(name) \
+    case name: { \
+        JITStubCall stubCall(this, JITStubs::cti_##name); \
+        stubCall.addArgument(currentInstruction[2].u.operand, regT2); \
+        stubCall.addArgument(currentInstruction[3].u.operand, regT2); \
+        stubCall.call(currentInstruction[1].u.operand); \
+        NEXT_OPCODE(name); \
+    }
+
+#define DEFINE_UNARY_OP(name) \
+    case name: { \
+        JITStubCall stubCall(this, JITStubs::cti_##name); \
+        stubCall.addArgument(currentInstruction[2].u.operand, regT2); \
+        stubCall.call(currentInstruction[1].u.operand); \
+        NEXT_OPCODE(name); \
+    }
+
+#define DEFINE_OP(name) \
     case name: { \
-        emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, X86::ecx); \
-        emitPutJITStubArgFromVirtualRegister(currentInstruction[3].u.operand, 2, X86::ecx); \
-        emitCTICall(Interpreter::cti_##name); \
-        emitPutVirtualRegister(currentInstruction[1].u.operand); \
+        emit_##name(currentInstruction); \
         NEXT_OPCODE(name); \
     }
 
-#define CTI_COMPILE_UNARY_OP(name) \
+#define DEFINE_SLOWCASE_OP(name) \
     case name: { \
-        emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, X86::ecx); \
-        emitCTICall(Interpreter::cti_##name); \
-        emitPutVirtualRegister(currentInstruction[1].u.operand); \
+        emitSlow_##name(currentInstruction, iter); \
         NEXT_OPCODE(name); \
     }
 
@@ -289,9 +146,10 @@ void JIT::privateCompileMainPass()
 {
     Instruction* instructionsBegin = m_codeBlock->instructions().begin();
     unsigned instructionCount = m_codeBlock->instructions().size();
-    unsigned propertyAccessInstructionIndex = 0;
-    unsigned globalResolveInfoIndex = 0;
-    unsigned callLinkInfoIndex = 0;
+
+    m_propertyAccessInstructionIndex = 0;
+    m_globalResolveInfoIndex = 0;
+    m_callLinkInfoIndex = 0;
 
     for (m_bytecodeIndex = 0; m_bytecodeIndex < instructionCount; ) {
         Instruction* currentInstruction = instructionsBegin + m_bytecodeIndex;
@@ -299,918 +157,126 @@ void JIT::privateCompileMainPass()
 
 #if ENABLE(OPCODE_SAMPLING)
         if (m_bytecodeIndex > 0) // Avoid the overhead of sampling op_enter twice.
-            store32(m_interpreter->sampler()->encodeSample(currentInstruction), m_interpreter->sampler()->sampleSlot());
+            sampleInstruction(currentInstruction);
 #endif
 
+        if (m_labels[m_bytecodeIndex].isUsed())
+            killLastResultRegister();
+        
         m_labels[m_bytecodeIndex] = label();
-        OpcodeID opcodeID = m_interpreter->getOpcodeID(currentInstruction->u.opcode);
-
-        switch (opcodeID) {
-        case op_mov: {
-            emitGetVirtualRegister(currentInstruction[2].u.operand, X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_mov);
-        }
-        case op_add: {
-            compileFastArith_op_add(currentInstruction);
-            NEXT_OPCODE(op_add);
-        }
-        case op_end: {
-            if (m_codeBlock->needsFullScopeChain())
-                emitCTICall(Interpreter::cti_op_end);
-            emitGetVirtualRegister(currentInstruction[1].u.operand, X86::eax);
-            push(Address(callFrameRegister, RegisterFile::ReturnPC * static_cast<int>(sizeof(Register))));
-            ret();
-            NEXT_OPCODE(op_end);
-        }
-        case op_jmp: {
-            unsigned target = currentInstruction[1].u.operand;
-            addJump(jump(), target + 1);
-            NEXT_OPCODE(op_jmp);
-        }
-        case op_pre_inc: {
-            compileFastArith_op_pre_inc(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_pre_inc);
-        }
-        case op_loop: {
-            emitSlowScriptCheck();
-
-            unsigned target = currentInstruction[1].u.operand;
-            addJump(jump(), target + 1);
-            NEXT_OPCODE(op_end);
-        }
-        case op_loop_if_less: {
-            emitSlowScriptCheck();
-
-            unsigned op1 = currentInstruction[1].u.operand;
-            unsigned op2 = currentInstruction[2].u.operand;
-            unsigned target = currentInstruction[3].u.operand;
-            if (isOperandConstantImmediateInt(op2)) {
-                emitGetVirtualRegister(op1, X86::eax);
-                emitJumpSlowCaseIfNotImmNum(X86::eax);
-#if USE(ALTERNATE_JSIMMEDIATE)
-                int32_t op2imm = JSImmediate::intValue(getConstantOperand(op2));
-#else
-                int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
-#endif
-                addJump(jl32(X86::eax, Imm32(op2imm)), target + 3);
-            } else {
-                emitGetVirtualRegisters(op1, X86::eax, op2, X86::edx);
-                emitJumpSlowCaseIfNotImmNum(X86::eax);
-                emitJumpSlowCaseIfNotImmNum(X86::edx);
-                addJump(jl32(X86::eax, X86::edx), target + 3);
-            }
-            NEXT_OPCODE(op_loop_if_less);
-        }
-        case op_loop_if_lesseq: {
-            emitSlowScriptCheck();
-
-            unsigned op1 = currentInstruction[1].u.operand;
-            unsigned op2 = currentInstruction[2].u.operand;
-            unsigned target = currentInstruction[3].u.operand;
-            if (isOperandConstantImmediateInt(op2)) {
-                emitGetVirtualRegister(op1, X86::eax);
-                emitJumpSlowCaseIfNotImmNum(X86::eax);
-#if USE(ALTERNATE_JSIMMEDIATE)
-                int32_t op2imm = JSImmediate::intValue(getConstantOperand(op2));
-#else
-                int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
-#endif
-                addJump(jle32(X86::eax, Imm32(op2imm)), target + 3);
-            } else {
-                emitGetVirtualRegisters(op1, X86::eax, op2, X86::edx);
-                emitJumpSlowCaseIfNotImmNum(X86::eax);
-                emitJumpSlowCaseIfNotImmNum(X86::edx);
-                addJump(jle32(X86::eax, X86::edx), target + 3);
-            }
-            NEXT_OPCODE(op_loop_if_less);
-        }
-        case op_new_object: {
-            emitCTICall(Interpreter::cti_op_new_object);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_new_object);
-        }
-        case op_put_by_id: {
-            compilePutByIdHotPath(currentInstruction[1].u.operand, &(m_codeBlock->identifier(currentInstruction[2].u.operand)), currentInstruction[3].u.operand, propertyAccessInstructionIndex++);
-            NEXT_OPCODE(op_put_by_id);
-        }
-        case op_get_by_id: {
-            compileGetByIdHotPath(currentInstruction[1].u.operand, currentInstruction[2].u.operand, &(m_codeBlock->identifier(currentInstruction[3].u.operand)), propertyAccessInstructionIndex++);
-            NEXT_OPCODE(op_get_by_id);
-        }
-        case op_instanceof: {
-            emitGetVirtualRegister(currentInstruction[2].u.operand, X86::eax); // value
-            emitGetVirtualRegister(currentInstruction[3].u.operand, X86::ecx); // baseVal
-            emitGetVirtualRegister(currentInstruction[4].u.operand, X86::edx); // proto
 
-            // check if any are immediates
-            move(X86::eax, X86::ebx);
-            orPtr(X86::ecx, X86::ebx);
-            orPtr(X86::edx, X86::ebx);
-            emitJumpSlowCaseIfNotJSCell(X86::ebx);
+        switch (m_interpreter->getOpcodeID(currentInstruction->u.opcode)) {
+        DEFINE_BINARY_OP(op_del_by_val)
+        DEFINE_BINARY_OP(op_div)
+        DEFINE_BINARY_OP(op_in)
+        DEFINE_BINARY_OP(op_less)
+        DEFINE_BINARY_OP(op_lesseq)
+        DEFINE_BINARY_OP(op_urshift)
+        DEFINE_UNARY_OP(op_get_pnames)
+        DEFINE_UNARY_OP(op_is_boolean)
+        DEFINE_UNARY_OP(op_is_function)
+        DEFINE_UNARY_OP(op_is_number)
+        DEFINE_UNARY_OP(op_is_object)
+        DEFINE_UNARY_OP(op_is_string)
+        DEFINE_UNARY_OP(op_is_undefined)
+        DEFINE_UNARY_OP(op_negate)
+        DEFINE_UNARY_OP(op_typeof)
+
+        DEFINE_OP(op_add)
+        DEFINE_OP(op_bitand)
+        DEFINE_OP(op_bitnot)
+        DEFINE_OP(op_bitor)
+        DEFINE_OP(op_bitxor)
+        DEFINE_OP(op_call)
+        DEFINE_OP(op_call_eval)
+        DEFINE_OP(op_call_varargs)
+        DEFINE_OP(op_catch)
+        DEFINE_OP(op_construct)
+        DEFINE_OP(op_construct_verify)
+        DEFINE_OP(op_convert_this)
+        DEFINE_OP(op_init_arguments)
+        DEFINE_OP(op_create_arguments)
+        DEFINE_OP(op_debug)
+        DEFINE_OP(op_del_by_id)
+        DEFINE_OP(op_end)
+        DEFINE_OP(op_enter)
+        DEFINE_OP(op_enter_with_activation)
+        DEFINE_OP(op_eq)
+        DEFINE_OP(op_eq_null)
+        DEFINE_OP(op_get_by_id)
+        DEFINE_OP(op_get_by_val)
+        DEFINE_OP(op_get_global_var)
+        DEFINE_OP(op_get_scoped_var)
+        DEFINE_OP(op_instanceof)
+        DEFINE_OP(op_jeq_null)
+        DEFINE_OP(op_jfalse)
+        DEFINE_OP(op_jmp)
+        DEFINE_OP(op_jmp_scopes)
+        DEFINE_OP(op_jneq_null)
+        DEFINE_OP(op_jneq_ptr)
+        DEFINE_OP(op_jnless)
+        DEFINE_OP(op_jnlesseq)
+        DEFINE_OP(op_jsr)
+        DEFINE_OP(op_jtrue)
+        DEFINE_OP(op_load_varargs)
+        DEFINE_OP(op_loop)
+        DEFINE_OP(op_loop_if_less)
+        DEFINE_OP(op_loop_if_lesseq)
+        DEFINE_OP(op_loop_if_true)
+        DEFINE_OP(op_lshift)
+        DEFINE_OP(op_method_check)
+        DEFINE_OP(op_mod)
+        DEFINE_OP(op_mov)
+        DEFINE_OP(op_mul)
+        DEFINE_OP(op_neq)
+        DEFINE_OP(op_neq_null)
+        DEFINE_OP(op_new_array)
+        DEFINE_OP(op_new_error)
+        DEFINE_OP(op_new_func)
+        DEFINE_OP(op_new_func_exp)
+        DEFINE_OP(op_new_object)
+        DEFINE_OP(op_new_regexp)
+        DEFINE_OP(op_next_pname)
+        DEFINE_OP(op_not)
+        DEFINE_OP(op_nstricteq)
+        DEFINE_OP(op_pop_scope)
+        DEFINE_OP(op_post_dec)
+        DEFINE_OP(op_post_inc)
+        DEFINE_OP(op_pre_dec)
+        DEFINE_OP(op_pre_inc)
+        DEFINE_OP(op_profile_did_call)
+        DEFINE_OP(op_profile_will_call)
+        DEFINE_OP(op_push_new_scope)
+        DEFINE_OP(op_push_scope)
+        DEFINE_OP(op_put_by_id)
+        DEFINE_OP(op_put_by_index)
+        DEFINE_OP(op_put_by_val)
+        DEFINE_OP(op_put_getter)
+        DEFINE_OP(op_put_global_var)
+        DEFINE_OP(op_put_scoped_var)
+        DEFINE_OP(op_put_setter)
+        DEFINE_OP(op_resolve)
+        DEFINE_OP(op_resolve_base)
+        DEFINE_OP(op_resolve_func)
+        DEFINE_OP(op_resolve_global)
+        DEFINE_OP(op_resolve_skip)
+        DEFINE_OP(op_resolve_with_base)
+        DEFINE_OP(op_ret)
+        DEFINE_OP(op_rshift)
+        DEFINE_OP(op_sret)
+        DEFINE_OP(op_strcat)
+        DEFINE_OP(op_stricteq)
+        DEFINE_OP(op_sub)
+        DEFINE_OP(op_switch_char)
+        DEFINE_OP(op_switch_imm)
+        DEFINE_OP(op_switch_string)
+        DEFINE_OP(op_tear_off_activation)
+        DEFINE_OP(op_tear_off_arguments)
+        DEFINE_OP(op_throw)
+        DEFINE_OP(op_to_jsnumber)
+        DEFINE_OP(op_to_primitive)
+        DEFINE_OP(op_unexpected_load)
 
-            // check that all are object type - this is a bit of a bithack to avoid excess branching;
-            // we check that the sum of the three type codes from Structures is exactly 3 * ObjectType,
-            // this works because NumberType and StringType are smaller
-            move(Imm32(3 * ObjectType), X86::ebx);
-            loadPtr(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), X86::eax);
-            loadPtr(Address(X86::ecx, FIELD_OFFSET(JSCell, m_structure)), X86::ecx);
-            loadPtr(Address(X86::edx, FIELD_OFFSET(JSCell, m_structure)), X86::edx);
-            sub32(Address(X86::eax, FIELD_OFFSET(Structure, m_typeInfo.m_type)), X86::ebx);
-            sub32(Address(X86::ecx, FIELD_OFFSET(Structure, m_typeInfo.m_type)), X86::ebx);
-            addSlowCase(jne32(Address(X86::edx, FIELD_OFFSET(Structure, m_typeInfo.m_type)), X86::ebx));
-
-            // check that baseVal's flags include ImplementsHasInstance but not OverridesHasInstance
-            load32(Address(X86::ecx, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), X86::ecx);
-            and32(Imm32(ImplementsHasInstance | OverridesHasInstance), X86::ecx);
-            addSlowCase(jne32(X86::ecx, Imm32(ImplementsHasInstance)));
-
-            emitGetVirtualRegister(currentInstruction[2].u.operand, X86::ecx); // reload value
-            emitGetVirtualRegister(currentInstruction[4].u.operand, X86::edx); // reload proto
-
-            // optimistically load true result
-            move(ImmPtr(JSValuePtr::encode(jsBoolean(true))), X86::eax);
-
-            Label loop(this);
-
-            // load value's prototype
-            loadPtr(Address(X86::ecx, FIELD_OFFSET(JSCell, m_structure)), X86::ecx);
-            loadPtr(Address(X86::ecx, FIELD_OFFSET(Structure, m_prototype)), X86::ecx);
-
-            Jump exit = jePtr(X86::ecx, X86::edx);
-
-            jnePtr(X86::ecx, ImmPtr(JSValuePtr::encode(jsNull())), loop);
-
-            move(ImmPtr(JSValuePtr::encode(jsBoolean(false))), X86::eax);
-
-            exit.link(this);
-
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-
-            NEXT_OPCODE(op_instanceof);
-        }
-        case op_del_by_id: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, X86::ecx);
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
-            emitPutJITStubArgConstant(ident, 2);
-            emitCTICall(Interpreter::cti_op_del_by_id);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_del_by_id);
-        }
-        case op_mul: {
-            compileFastArith_op_mul(currentInstruction);
-            NEXT_OPCODE(op_mul);
-        }
-        case op_new_func: {
-            FuncDeclNode* func = m_codeBlock->function(currentInstruction[2].u.operand);
-            emitPutJITStubArgConstant(func, 1);
-            emitCTICall(Interpreter::cti_op_new_func);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_new_func);
-        }
-        case op_call: {
-            compileOpCall(opcodeID, currentInstruction, callLinkInfoIndex++);
-            NEXT_OPCODE(op_call);
-        }
-        case op_call_eval: {
-            compileOpCall(opcodeID, currentInstruction, callLinkInfoIndex++);
-            NEXT_OPCODE(op_call_eval);
-        }
-        case op_construct: {
-            compileOpCall(opcodeID, currentInstruction, callLinkInfoIndex++);
-            NEXT_OPCODE(op_construct);
-        }
-        case op_get_global_var: {
-            JSVariableObject* globalObject = static_cast<JSVariableObject*>(currentInstruction[2].u.jsCell);
-            move(ImmPtr(globalObject), X86::eax);
-            emitGetVariableObjectRegister(X86::eax, currentInstruction[3].u.operand, X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_get_global_var);
-        }
-        case op_put_global_var: {
-            emitGetVirtualRegister(currentInstruction[3].u.operand, X86::edx);
-            JSVariableObject* globalObject = static_cast<JSVariableObject*>(currentInstruction[1].u.jsCell);
-            move(ImmPtr(globalObject), X86::eax);
-            emitPutVariableObjectRegister(X86::edx, X86::eax, currentInstruction[2].u.operand);
-            NEXT_OPCODE(op_put_global_var);
-        }
-        case op_get_scoped_var: {
-            int skip = currentInstruction[3].u.operand + m_codeBlock->needsFullScopeChain();
-
-            emitGetFromCallFrameHeader(RegisterFile::ScopeChain, X86::eax);
-            while (skip--)
-                loadPtr(Address(X86::eax, FIELD_OFFSET(ScopeChainNode, next)), X86::eax);
-
-            loadPtr(Address(X86::eax, FIELD_OFFSET(ScopeChainNode, object)), X86::eax);
-            emitGetVariableObjectRegister(X86::eax, currentInstruction[2].u.operand, X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_get_scoped_var);
-        }
-        case op_put_scoped_var: {
-            int skip = currentInstruction[2].u.operand + m_codeBlock->needsFullScopeChain();
-
-            emitGetFromCallFrameHeader(RegisterFile::ScopeChain, X86::edx);
-            emitGetVirtualRegister(currentInstruction[3].u.operand, X86::eax);
-            while (skip--)
-                loadPtr(Address(X86::edx, FIELD_OFFSET(ScopeChainNode, next)), X86::edx);
-
-            loadPtr(Address(X86::edx, FIELD_OFFSET(ScopeChainNode, object)), X86::edx);
-            emitPutVariableObjectRegister(X86::eax, X86::edx, currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_put_scoped_var);
-        }
-        case op_tear_off_activation: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, X86::ecx);
-            emitCTICall(Interpreter::cti_op_tear_off_activation);
-            NEXT_OPCODE(op_tear_off_activation);
-        }
-        case op_tear_off_arguments: {
-            emitCTICall(Interpreter::cti_op_tear_off_arguments);
-            NEXT_OPCODE(op_tear_off_arguments);
-        }
-        case op_ret: {
-            // We could JIT generate the deref, only calling out to C when the refcount hits zero.
-            if (m_codeBlock->needsFullScopeChain())
-                emitCTICall(Interpreter::cti_op_ret_scopeChain);
-
-            // Return the result in %eax.
-            emitGetVirtualRegister(currentInstruction[1].u.operand, X86::eax);
-
-            // Grab the return address.
-            emitGetFromCallFrameHeader(RegisterFile::ReturnPC, X86::edx);
-
-            // Restore our caller's "r".
-            emitGetFromCallFrameHeader(RegisterFile::CallerFrame, callFrameRegister);
-
-            // Return.
-            push(X86::edx);
-            ret();
-
-            NEXT_OPCODE(op_ret);
-        }
-        case op_new_array: {
-            emitPutJITStubArgConstant(currentInstruction[2].u.operand, 1);
-            emitPutJITStubArgConstant(currentInstruction[3].u.operand, 2);
-            emitCTICall(Interpreter::cti_op_new_array);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_new_array);
-        }
-        case op_resolve: {
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
-            emitPutJITStubArgConstant(ident, 1);
-            emitCTICall(Interpreter::cti_op_resolve);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_resolve);
-        }
-        case op_construct_verify: {
-            emitGetVirtualRegister(currentInstruction[1].u.operand, X86::eax);
-
-            emitJumpSlowCaseIfNotJSCell(X86::eax);
-            loadPtr(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), X86::ecx);
-            addSlowCase(jne32(Address(X86::ecx, FIELD_OFFSET(Structure, m_typeInfo) + FIELD_OFFSET(TypeInfo, m_type)), Imm32(ObjectType)));
-
-            NEXT_OPCODE(op_construct_verify);
-        }
-        case op_get_by_val: {
-            emitGetVirtualRegisters(currentInstruction[2].u.operand, X86::eax, currentInstruction[3].u.operand, X86::edx);
-            emitJumpSlowCaseIfNotImmNum(X86::edx);
-#if USE(ALTERNATE_JSIMMEDIATE)
-            // This is technically incorrect - we're zero-extending an int32.  On the hot path this doesn't matter.
-            // We check the value as if it was a uint32 against the m_fastAccessCutoff - which will always fail if
-            // number was signed since m_fastAccessCutoff is always less than intmax (since the total allocation
-            // size is always less than 4Gb).  As such zero extending wil have been correct (and extending the value
-            // to 64-bits is necessary since it's used in the address calculation.  We zero extend rather than sign
-            // extending since it makes it easier to re-tag the value in the slow case.
-            zeroExtend32ToPtr(X86::edx, X86::edx);
-#else
-            emitFastArithImmToInt(X86::edx);
-#endif
-            emitJumpSlowCaseIfNotJSCell(X86::eax);
-            addSlowCase(jnePtr(Address(X86::eax), ImmPtr(m_interpreter->m_jsArrayVptr)));
-
-            // This is an array; get the m_storage pointer into ecx, then check if the index is below the fast cutoff
-            loadPtr(Address(X86::eax, FIELD_OFFSET(JSArray, m_storage)), X86::ecx);
-            addSlowCase(jae32(X86::edx, Address(X86::eax, FIELD_OFFSET(JSArray, m_fastAccessCutoff))));
-
-            // Get the value from the vector
-            loadPtr(BaseIndex(X86::ecx, X86::edx, ScalePtr, FIELD_OFFSET(ArrayStorage, m_vector[0])), X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_get_by_val);
-        }
-        case op_resolve_func: {
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
-            emitPutJITStubArgConstant(ident, 1);
-            emitCTICall(Interpreter::cti_op_resolve_func);
-            emitPutVirtualRegister(currentInstruction[2].u.operand, X86::edx);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_resolve_func);
-        }
-        case op_sub: {
-            compileBinaryArithOp(op_sub, currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, OperandTypes::fromInt(currentInstruction[4].u.operand));
-            NEXT_OPCODE(op_sub);
-        }
-        case op_put_by_val: {
-            emitGetVirtualRegisters(currentInstruction[1].u.operand, X86::eax, currentInstruction[2].u.operand, X86::edx);
-            emitJumpSlowCaseIfNotImmNum(X86::edx);
-#if USE(ALTERNATE_JSIMMEDIATE)
-            // See comment in op_get_by_val.
-            zeroExtend32ToPtr(X86::edx, X86::edx);
-#else
-            emitFastArithImmToInt(X86::edx);
-#endif
-            emitJumpSlowCaseIfNotJSCell(X86::eax);
-            addSlowCase(jnePtr(Address(X86::eax), ImmPtr(m_interpreter->m_jsArrayVptr)));
-
-            // This is an array; get the m_storage pointer into ecx, then check if the index is below the fast cutoff
-            loadPtr(Address(X86::eax, FIELD_OFFSET(JSArray, m_storage)), X86::ecx);
-            Jump inFastVector = jb32(X86::edx, Address(X86::eax, FIELD_OFFSET(JSArray, m_fastAccessCutoff)));
-            // No; oh well, check if the access if within the vector - if so, we may still be okay.
-            addSlowCase(jae32(X86::edx, Address(X86::ecx, FIELD_OFFSET(ArrayStorage, m_vectorLength))));
-
-            // This is a write to the slow part of the vector; first, we have to check if this would be the first write to this location.
-            // FIXME: should be able to handle initial write to array; increment the the number of items in the array, and potentially update fast access cutoff. 
-            addSlowCase(jzPtr(BaseIndex(X86::ecx, X86::edx, ScalePtr, FIELD_OFFSET(ArrayStorage, m_vector[0]))));
-
-            // All good - put the value into the array.
-            inFastVector.link(this);
-            emitGetVirtualRegister(currentInstruction[3].u.operand, X86::eax);
-            storePtr(X86::eax, BaseIndex(X86::ecx, X86::edx, ScalePtr, FIELD_OFFSET(ArrayStorage, m_vector[0])));
-            NEXT_OPCODE(op_put_by_val);
-        }
-        CTI_COMPILE_BINARY_OP(op_lesseq)
-        case op_loop_if_true: {
-            emitSlowScriptCheck();
-
-            unsigned target = currentInstruction[2].u.operand;
-            emitGetVirtualRegister(currentInstruction[1].u.operand, X86::eax);
-
-            Jump isZero = jePtr(X86::eax, ImmPtr(JSValuePtr::encode(JSImmediate::zeroImmediate())));
-            addJump(emitJumpIfImmNum(X86::eax), target + 2);
-
-            addJump(jePtr(X86::eax, ImmPtr(JSValuePtr::encode(jsBoolean(true)))), target + 2);
-            addSlowCase(jnePtr(X86::eax, ImmPtr(JSValuePtr::encode(jsBoolean(false)))));
-
-            isZero.link(this);
-            NEXT_OPCODE(op_loop_if_true);
-        };
-        case op_resolve_base: {
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
-            emitPutJITStubArgConstant(ident, 1);
-            emitCTICall(Interpreter::cti_op_resolve_base);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_resolve_base);
-        }
-        case op_negate: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, X86::ecx);
-            emitCTICall(Interpreter::cti_op_negate);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_negate);
-        }
-        case op_resolve_skip: {
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
-            emitPutJITStubArgConstant(ident, 1);
-            emitPutJITStubArgConstant(currentInstruction[3].u.operand + m_codeBlock->needsFullScopeChain(), 2);
-            emitCTICall(Interpreter::cti_op_resolve_skip);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_resolve_skip);
-        }
-        case op_resolve_global: {
-            // Fast case
-            void* globalObject = currentInstruction[2].u.jsCell;
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
-            
-            unsigned currentIndex = globalResolveInfoIndex++;
-            void* structureAddress = &(m_codeBlock->globalResolveInfo(currentIndex).structure);
-            void* offsetAddr = &(m_codeBlock->globalResolveInfo(currentIndex).offset);
-
-            // Check Structure of global object
-            move(ImmPtr(globalObject), X86::eax);
-            loadPtr(structureAddress, X86::edx);
-            Jump noMatch = jnePtr(X86::edx, Address(X86::eax, FIELD_OFFSET(JSCell, m_structure))); // Structures don't match
-
-            // Load cached property
-            loadPtr(Address(X86::eax, FIELD_OFFSET(JSGlobalObject, m_propertyStorage)), X86::eax);
-            load32(offsetAddr, X86::edx);
-            loadPtr(BaseIndex(X86::eax, X86::edx, ScalePtr), X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            Jump end = jump();
-
-            // Slow case
-            noMatch.link(this);
-            emitPutJITStubArgConstant(globalObject, 1);
-            emitPutJITStubArgConstant(ident, 2);
-            emitPutJITStubArgConstant(currentIndex, 3);
-            emitCTICall(Interpreter::cti_op_resolve_global);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            end.link(this);
-            NEXT_OPCODE(op_resolve_global);
-        }
-        CTI_COMPILE_BINARY_OP(op_div)
-        case op_pre_dec: {
-            compileFastArith_op_pre_dec(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_pre_dec);
-        }
-        case op_jnless: {
-            unsigned op1 = currentInstruction[1].u.operand;
-            unsigned op2 = currentInstruction[2].u.operand;
-            unsigned target = currentInstruction[3].u.operand;
-            if (isOperandConstantImmediateInt(op2)) {
-                emitGetVirtualRegister(op1, X86::eax);
-                emitJumpSlowCaseIfNotImmNum(X86::eax);
-#if USE(ALTERNATE_JSIMMEDIATE)
-                int32_t op2imm = JSImmediate::intValue(getConstantOperand(op2));
-#else
-                int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
-#endif
-                addJump(jge32(X86::eax, Imm32(op2imm)), target + 3);
-            } else {
-                emitGetVirtualRegisters(op1, X86::eax, op2, X86::edx);
-                emitJumpSlowCaseIfNotImmNum(X86::eax);
-                emitJumpSlowCaseIfNotImmNum(X86::edx);
-                addJump(jge32(X86::eax, X86::edx), target + 3);
-            }
-            NEXT_OPCODE(op_jnless);
-        }
-        case op_not: {
-            emitGetVirtualRegister(currentInstruction[2].u.operand, X86::eax);
-            xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), X86::eax);
-            addSlowCase(jnzPtr(X86::eax, Imm32(static_cast<int32_t>(~JSImmediate::ExtendedPayloadBitBoolValue))));
-            xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool | JSImmediate::ExtendedPayloadBitBoolValue)), X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_not);
-        }
-        case op_jfalse: {
-            unsigned target = currentInstruction[2].u.operand;
-            emitGetVirtualRegister(currentInstruction[1].u.operand, X86::eax);
-
-            addJump(jePtr(X86::eax, ImmPtr(JSValuePtr::encode(JSImmediate::zeroImmediate()))), target + 2);
-            Jump isNonZero = emitJumpIfImmNum(X86::eax);
-
-            addJump(jePtr(X86::eax, ImmPtr(JSValuePtr::encode(jsBoolean(false)))), target + 2);
-            addSlowCase(jnePtr(X86::eax, ImmPtr(JSValuePtr::encode(jsBoolean(true)))));
-
-            isNonZero.link(this);
-            NEXT_OPCODE(op_jfalse);
-        };
-        case op_jeq_null: {
-            unsigned src = currentInstruction[1].u.operand;
-            unsigned target = currentInstruction[2].u.operand;
-
-            emitGetVirtualRegister(src, X86::eax);
-            Jump isImmediate = emitJumpIfNotJSCell(X86::eax);
-
-            // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
-            loadPtr(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), X86::ecx);
-            addJump(jnz32(Address(X86::ecx, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
-            Jump wasNotImmediate = jump();
-
-            // Now handle the immediate cases - undefined & null
-            isImmediate.link(this);
-            and32(Imm32(~JSImmediate::ExtendedTagBitUndefined), X86::eax);
-            addJump(jePtr(X86::eax, ImmPtr(JSValuePtr::encode(jsNull()))), target + 2);            
-
-            wasNotImmediate.link(this);
-            NEXT_OPCODE(op_jeq_null);
-        };
-        case op_jneq_null: {
-            unsigned src = currentInstruction[1].u.operand;
-            unsigned target = currentInstruction[2].u.operand;
-
-            emitGetVirtualRegister(src, X86::eax);
-            Jump isImmediate = emitJumpIfNotJSCell(X86::eax);
-
-            // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
-            loadPtr(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), X86::ecx);
-            addJump(jz32(Address(X86::ecx, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
-            Jump wasNotImmediate = jump();
-
-            // Now handle the immediate cases - undefined & null
-            isImmediate.link(this);
-            and32(Imm32(~JSImmediate::ExtendedTagBitUndefined), X86::eax);
-            addJump(jnePtr(X86::eax, ImmPtr(JSValuePtr::encode(jsNull()))), target + 2);            
-
-            wasNotImmediate.link(this);
-            NEXT_OPCODE(op_jneq_null);
-        }
-        case op_post_inc: {
-            compileFastArith_op_post_inc(currentInstruction[1].u.operand, currentInstruction[2].u.operand);
-            NEXT_OPCODE(op_post_inc);
-        }
-        case op_unexpected_load: {
-            JSValuePtr v = m_codeBlock->unexpectedConstant(currentInstruction[2].u.operand);
-            move(ImmPtr(JSValuePtr::encode(v)), X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_unexpected_load);
-        }
-        case op_jsr: {
-            int retAddrDst = currentInstruction[1].u.operand;
-            int target = currentInstruction[2].u.operand;
-            DataLabelPtr storeLocation = storePtrWithPatch(Address(callFrameRegister, sizeof(Register) * retAddrDst));
-            addJump(jump(), target + 2);
-            m_jsrSites.append(JSRInfo(storeLocation, label()));
-            NEXT_OPCODE(op_jsr);
-        }
-        case op_sret: {
-            jump(Address(callFrameRegister, sizeof(Register) * currentInstruction[1].u.operand));
-            NEXT_OPCODE(op_sret);
-        }
-        case op_eq: {
-            emitGetVirtualRegisters(currentInstruction[2].u.operand, X86::eax, currentInstruction[3].u.operand, X86::edx);
-            emitJumpSlowCaseIfNotImmNums(X86::eax, X86::edx, X86::ecx);
-            sete32(X86::edx, X86::eax);
-            emitTagAsBoolImmediate(X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_eq);
-        }
-        case op_lshift: {
-            compileFastArith_op_lshift(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand);
-            NEXT_OPCODE(op_lshift);
-        }
-        case op_bitand: {
-            compileFastArith_op_bitand(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand);
-            NEXT_OPCODE(op_bitand);
-        }
-        case op_rshift: {
-            compileFastArith_op_rshift(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand);
-            NEXT_OPCODE(op_rshift);
-        }
-        case op_bitnot: {
-            emitGetVirtualRegister(currentInstruction[2].u.operand, X86::eax);
-            emitJumpSlowCaseIfNotImmNum(X86::eax);
-#if USE(ALTERNATE_JSIMMEDIATE)
-            not32(X86::eax);
-            emitFastArithIntToImmNoCheck(X86::eax, X86::eax);
-#else
-            xorPtr(Imm32(~JSImmediate::TagTypeInteger), X86::eax);
-#endif
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_bitnot);
-        }
-        case op_resolve_with_base: {
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
-            emitPutJITStubArgConstant(ident, 1);
-            emitCTICall(Interpreter::cti_op_resolve_with_base);
-            emitPutVirtualRegister(currentInstruction[2].u.operand, X86::edx);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_resolve_with_base);
-        }
-        case op_new_func_exp: {
-            FuncExprNode* func = m_codeBlock->functionExpression(currentInstruction[2].u.operand);
-            emitPutJITStubArgConstant(func, 1);
-            emitCTICall(Interpreter::cti_op_new_func_exp);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_new_func_exp);
-        }
-        case op_mod: {
-            compileFastArith_op_mod(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand);
-            NEXT_OPCODE(op_mod);
-        }
-        case op_jtrue: {
-            unsigned target = currentInstruction[2].u.operand;
-            emitGetVirtualRegister(currentInstruction[1].u.operand, X86::eax);
-
-            Jump isZero = jePtr(X86::eax, ImmPtr(JSValuePtr::encode(JSImmediate::zeroImmediate())));
-            addJump(emitJumpIfImmNum(X86::eax), target + 2);
-
-            addJump(jePtr(X86::eax, ImmPtr(JSValuePtr::encode(jsBoolean(true)))), target + 2);
-            addSlowCase(jnePtr(X86::eax, ImmPtr(JSValuePtr::encode(jsBoolean(false)))));
-
-            isZero.link(this);
-            NEXT_OPCODE(op_jtrue);
-        }
-        CTI_COMPILE_BINARY_OP(op_less)
-        case op_neq: {
-            emitGetVirtualRegisters(currentInstruction[2].u.operand, X86::eax, currentInstruction[3].u.operand, X86::edx);
-            emitJumpSlowCaseIfNotImmNums(X86::eax, X86::edx, X86::ecx);
-            setne32(X86::edx, X86::eax);
-            emitTagAsBoolImmediate(X86::eax);
-
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-
-            NEXT_OPCODE(op_neq);
-        }
-        case op_post_dec: {
-            compileFastArith_op_post_dec(currentInstruction[1].u.operand, currentInstruction[2].u.operand);
-            NEXT_OPCODE(op_post_dec);
-        }
-        CTI_COMPILE_BINARY_OP(op_urshift)
-        case op_bitxor: {
-            emitGetVirtualRegisters(currentInstruction[2].u.operand, X86::eax, currentInstruction[3].u.operand, X86::edx);
-            emitJumpSlowCaseIfNotImmNums(X86::eax, X86::edx, X86::ecx);
-            xorPtr(X86::edx, X86::eax);
-            emitFastArithReTagImmediate(X86::eax, X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_bitxor);
-        }
-        case op_new_regexp: {
-            RegExp* regExp = m_codeBlock->regexp(currentInstruction[2].u.operand);
-            emitPutJITStubArgConstant(regExp, 1);
-            emitCTICall(Interpreter::cti_op_new_regexp);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_new_regexp);
-        }
-        case op_bitor: {
-            emitGetVirtualRegisters(currentInstruction[2].u.operand, X86::eax, currentInstruction[3].u.operand, X86::edx);
-            emitJumpSlowCaseIfNotImmNums(X86::eax, X86::edx, X86::ecx);
-            orPtr(X86::edx, X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_bitor);
-        }
-        case op_throw: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, X86::ecx);
-            emitCTICall(Interpreter::cti_op_throw);
-#if PLATFORM(X86_64)
-            addPtr(Imm32(0x38), X86::esp);
-            pop(X86::ebx);
-            pop(X86::r13);
-            pop(X86::r12);
-            pop(X86::ebp);
-            ret();
-#else
-            addPtr(Imm32(0x1c), X86::esp);
-            pop(X86::ebx);
-            pop(X86::edi);
-            pop(X86::esi);
-            pop(X86::ebp);
-            ret();
-#endif
-            NEXT_OPCODE(op_throw);
-        }
-        case op_get_pnames: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, X86::ecx);
-            emitCTICall(Interpreter::cti_op_get_pnames);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_get_pnames);
-        }
-        case op_next_pname: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, X86::ecx);
-            unsigned target = currentInstruction[3].u.operand;
-            emitCTICall(Interpreter::cti_op_next_pname);
-            Jump endOfIter = jzPtr(X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            addJump(jump(), target + 3);
-            endOfIter.link(this);
-            NEXT_OPCODE(op_next_pname);
-        }
-        case op_push_scope: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, X86::ecx);
-            emitCTICall(Interpreter::cti_op_push_scope);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_push_scope);
-        }
-        case op_pop_scope: {
-            emitCTICall(Interpreter::cti_op_pop_scope);
-            NEXT_OPCODE(op_pop_scope);
-        }
-        CTI_COMPILE_UNARY_OP(op_typeof)
-        CTI_COMPILE_UNARY_OP(op_is_undefined)
-        CTI_COMPILE_UNARY_OP(op_is_boolean)
-        CTI_COMPILE_UNARY_OP(op_is_number)
-        CTI_COMPILE_UNARY_OP(op_is_string)
-        CTI_COMPILE_UNARY_OP(op_is_object)
-        CTI_COMPILE_UNARY_OP(op_is_function)
-        case op_stricteq: {
-            compileOpStrictEq(currentInstruction, OpStrictEq);
-            NEXT_OPCODE(op_stricteq);
-        }
-        case op_nstricteq: {
-            compileOpStrictEq(currentInstruction, OpNStrictEq);
-            NEXT_OPCODE(op_nstricteq);
-        }
-        case op_to_jsnumber: {
-            int srcVReg = currentInstruction[2].u.operand;
-            emitGetVirtualRegister(srcVReg, X86::eax);
-            
-            Jump wasImmediate = emitJumpIfImmNum(X86::eax);
-
-            emitJumpSlowCaseIfNotJSCell(X86::eax, srcVReg);
-            loadPtr(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), X86::ecx);
-            addSlowCase(jne32(Address(X86::ecx, FIELD_OFFSET(Structure, m_typeInfo.m_type)), Imm32(NumberType)));
-            
-            wasImmediate.link(this);
-
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_to_jsnumber);
-        }
-        CTI_COMPILE_BINARY_OP(op_in)
-        case op_push_new_scope: {
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
-            emitPutJITStubArgConstant(ident, 1);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[3].u.operand, 2, X86::ecx);
-            emitCTICall(Interpreter::cti_op_push_new_scope);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_push_new_scope);
-        }
-        case op_catch: {
-            emitGetCTIParam(STUB_ARGS_callFrame, callFrameRegister);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_catch);
-        }
-        case op_jmp_scopes: {
-            unsigned count = currentInstruction[1].u.operand;
-            emitPutJITStubArgConstant(count, 1);
-            emitCTICall(Interpreter::cti_op_jmp_scopes);
-            unsigned target = currentInstruction[2].u.operand;
-            addJump(jump(), target + 2);
-            NEXT_OPCODE(op_jmp_scopes);
-        }
-        case op_put_by_index: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, X86::ecx);
-            emitPutJITStubArgConstant(currentInstruction[2].u.operand, 2);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[3].u.operand, 3, X86::ecx);
-            emitCTICall(Interpreter::cti_op_put_by_index);
-            NEXT_OPCODE(op_put_by_index);
-        }
-        case op_switch_imm: {
-            unsigned tableIndex = currentInstruction[1].u.operand;
-            unsigned defaultOffset = currentInstruction[2].u.operand;
-            unsigned scrutinee = currentInstruction[3].u.operand;
-
-            // create jump table for switch destinations, track this switch statement.
-            SimpleJumpTable* jumpTable = &m_codeBlock->immediateSwitchJumpTable(tableIndex);
-            m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset, SwitchRecord::Immediate));
-            jumpTable->ctiOffsets.grow(jumpTable->branchOffsets.size());
-
-            emitPutJITStubArgFromVirtualRegister(scrutinee, 1, X86::ecx);
-            emitPutJITStubArgConstant(tableIndex, 2);
-            emitCTICall(Interpreter::cti_op_switch_imm);
-            jump(X86::eax);
-            NEXT_OPCODE(op_switch_imm);
-        }
-        case op_switch_char: {
-            unsigned tableIndex = currentInstruction[1].u.operand;
-            unsigned defaultOffset = currentInstruction[2].u.operand;
-            unsigned scrutinee = currentInstruction[3].u.operand;
-
-            // create jump table for switch destinations, track this switch statement.
-            SimpleJumpTable* jumpTable = &m_codeBlock->characterSwitchJumpTable(tableIndex);
-            m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset, SwitchRecord::Character));
-            jumpTable->ctiOffsets.grow(jumpTable->branchOffsets.size());
-
-            emitPutJITStubArgFromVirtualRegister(scrutinee, 1, X86::ecx);
-            emitPutJITStubArgConstant(tableIndex, 2);
-            emitCTICall(Interpreter::cti_op_switch_char);
-            jump(X86::eax);
-            NEXT_OPCODE(op_switch_char);
-        }
-        case op_switch_string: {
-            unsigned tableIndex = currentInstruction[1].u.operand;
-            unsigned defaultOffset = currentInstruction[2].u.operand;
-            unsigned scrutinee = currentInstruction[3].u.operand;
-
-            // create jump table for switch destinations, track this switch statement.
-            StringJumpTable* jumpTable = &m_codeBlock->stringSwitchJumpTable(tableIndex);
-            m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset));
-
-            emitPutJITStubArgFromVirtualRegister(scrutinee, 1, X86::ecx);
-            emitPutJITStubArgConstant(tableIndex, 2);
-            emitCTICall(Interpreter::cti_op_switch_string);
-            jump(X86::eax);
-            NEXT_OPCODE(op_switch_string);
-        }
-        case op_del_by_val: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, X86::ecx);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[3].u.operand, 2, X86::ecx);
-            emitCTICall(Interpreter::cti_op_del_by_val);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_del_by_val);
-        }
-        case op_put_getter: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, X86::ecx);
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
-            emitPutJITStubArgConstant(ident, 2);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[3].u.operand, 3, X86::ecx);
-            emitCTICall(Interpreter::cti_op_put_getter);
-            NEXT_OPCODE(op_put_getter);
-        }
-        case op_put_setter: {
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, X86::ecx);
-            Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
-            emitPutJITStubArgConstant(ident, 2);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[3].u.operand, 3, X86::ecx);
-            emitCTICall(Interpreter::cti_op_put_setter);
-            NEXT_OPCODE(op_put_setter);
-        }
-        case op_new_error: {
-            JSValuePtr message = m_codeBlock->unexpectedConstant(currentInstruction[3].u.operand);
-            emitPutJITStubArgConstant(currentInstruction[2].u.operand, 1);
-            emitPutJITStubArgConstant(JSValuePtr::encode(message), 2);
-            emitPutJITStubArgConstant(m_bytecodeIndex, 3);
-            emitCTICall(Interpreter::cti_op_new_error);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_new_error);
-        }
-        case op_debug: {
-            emitPutJITStubArgConstant(currentInstruction[1].u.operand, 1);
-            emitPutJITStubArgConstant(currentInstruction[2].u.operand, 2);
-            emitPutJITStubArgConstant(currentInstruction[3].u.operand, 3);
-            emitCTICall(Interpreter::cti_op_debug);
-            NEXT_OPCODE(op_debug);
-        }
-        case op_eq_null: {
-            unsigned dst = currentInstruction[1].u.operand;
-            unsigned src1 = currentInstruction[2].u.operand;
-
-            emitGetVirtualRegister(src1, X86::eax);
-            Jump isImmediate = emitJumpIfNotJSCell(X86::eax);
-
-            loadPtr(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), X86::ecx);
-            setnz32(Address(X86::ecx, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), X86::eax);
-
-            Jump wasNotImmediate = jump();
-
-            isImmediate.link(this);
-
-            and32(Imm32(~JSImmediate::ExtendedTagBitUndefined), X86::eax);
-            sete32(Imm32(JSImmediate::FullTagTypeNull), X86::eax);
-
-            wasNotImmediate.link(this);
-
-            emitTagAsBoolImmediate(X86::eax);
-            emitPutVirtualRegister(dst);
-
-            NEXT_OPCODE(op_eq_null);
-        }
-        case op_neq_null: {
-            unsigned dst = currentInstruction[1].u.operand;
-            unsigned src1 = currentInstruction[2].u.operand;
-
-            emitGetVirtualRegister(src1, X86::eax);
-            Jump isImmediate = emitJumpIfNotJSCell(X86::eax);
-
-            loadPtr(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), X86::ecx);
-            setz32(Address(X86::ecx, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), X86::eax);
-
-            Jump wasNotImmediate = jump();
-
-            isImmediate.link(this);
-
-            and32(Imm32(~JSImmediate::ExtendedTagBitUndefined), X86::eax);
-            setne32(Imm32(JSImmediate::FullTagTypeNull), X86::eax);
-
-            wasNotImmediate.link(this);
-
-            emitTagAsBoolImmediate(X86::eax);
-            emitPutVirtualRegister(dst);
-
-            NEXT_OPCODE(op_neq_null);
-        }
-        case op_enter: {
-            // Even though CTI doesn't use them, we initialize our constant
-            // registers to zap stale pointers, to avoid unnecessarily prolonging
-            // object lifetime and increasing GC pressure.
-            size_t count = m_codeBlock->m_numVars + m_codeBlock->numberOfConstantRegisters();
-            for (size_t j = 0; j < count; ++j)
-                emitInitRegister(j);
-
-            NEXT_OPCODE(op_enter);
-        }
-        case op_enter_with_activation: {
-            // Even though CTI doesn't use them, we initialize our constant
-            // registers to zap stale pointers, to avoid unnecessarily prolonging
-            // object lifetime and increasing GC pressure.
-            size_t count = m_codeBlock->m_numVars + m_codeBlock->numberOfConstantRegisters();
-            for (size_t j = 0; j < count; ++j)
-                emitInitRegister(j);
-
-            emitCTICall(Interpreter::cti_op_push_activation);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-
-            NEXT_OPCODE(op_enter_with_activation);
-        }
-        case op_create_arguments: {
-            if (m_codeBlock->m_numParameters == 1)
-                emitCTICall(Interpreter::cti_op_create_arguments_no_params);
-            else
-                emitCTICall(Interpreter::cti_op_create_arguments);
-            NEXT_OPCODE(op_create_arguments);
-        }
-        case op_convert_this: {
-            emitGetVirtualRegister(currentInstruction[1].u.operand, X86::eax);
-
-            emitJumpSlowCaseIfNotJSCell(X86::eax);
-            loadPtr(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), X86::edx);
-            addSlowCase(jnz32(Address(X86::edx, FIELD_OFFSET(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
-
-            NEXT_OPCODE(op_convert_this);
-        }
-        case op_profile_will_call: {
-            emitGetCTIParam(STUB_ARGS_profilerReference, X86::eax);
-            Jump noProfiler = jzPtr(Address(X86::eax));
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, X86::eax);
-            emitCTICall(Interpreter::cti_op_profile_will_call);
-            noProfiler.link(this);
-
-            NEXT_OPCODE(op_profile_will_call);
-        }
-        case op_profile_did_call: {
-            emitGetCTIParam(STUB_ARGS_profilerReference, X86::eax);
-            Jump noProfiler = jzPtr(Address(X86::eax));
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[1].u.operand, 1, X86::eax);
-            emitCTICall(Interpreter::cti_op_profile_did_call);
-            noProfiler.link(this);
-
-            NEXT_OPCODE(op_profile_did_call);
-        }
         case op_get_array_length:
         case op_get_by_id_chain:
         case op_get_by_id_generic:
@@ -1226,11 +292,11 @@ void JIT::privateCompileMainPass()
         }
     }
 
-    ASSERT(propertyAccessInstructionIndex == m_codeBlock->numberOfStructureStubInfos());
-    ASSERT(callLinkInfoIndex == m_codeBlock->numberOfCallLinkInfos());
+    ASSERT(m_propertyAccessInstructionIndex == m_codeBlock->numberOfStructureStubInfos());
+    ASSERT(m_callLinkInfoIndex == m_codeBlock->numberOfCallLinkInfos());
 
 #ifndef NDEBUG
-    // reset this, in order to guard it's use with asserts
+    // Reset this, in order to guard its use with ASSERTs.
     m_bytecodeIndex = (unsigned)-1;
 #endif
 }
@@ -1247,8 +313,9 @@ void JIT::privateCompileLinkPass()
 void JIT::privateCompileSlowCases()
 {
     Instruction* instructionsBegin = m_codeBlock->instructions().begin();
-    unsigned propertyAccessInstructionIndex = 0;
-    unsigned callLinkInfoIndex = 0;
+
+    m_propertyAccessInstructionIndex = 0;
+    m_callLinkInfoIndex = 0;
 
     for (Vector<SlowCaseEntry>::iterator iter = m_slowCases.begin(); iter != m_slowCases.end();) {
         // FIXME: enable peephole optimizations for slow cases when applicable
@@ -1260,312 +327,47 @@ void JIT::privateCompileSlowCases()
 #endif
         Instruction* currentInstruction = instructionsBegin + m_bytecodeIndex;
 
-        switch (OpcodeID opcodeID = m_interpreter->getOpcodeID(currentInstruction->u.opcode)) {
-        case op_convert_this: {
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitPutJITStubArg(X86::eax, 1);
-            emitCTICall(Interpreter::cti_op_convert_this);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_convert_this);
-        }
-        case op_add: {
-            compileFastArithSlow_op_add(currentInstruction, iter);
-            NEXT_OPCODE(op_add);
-        }
-        case op_construct_verify: {
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitGetVirtualRegister(currentInstruction[2].u.operand, X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-
-            NEXT_OPCODE(op_construct_verify);
-        }
-        case op_get_by_val: {
-            // The slow case that handles accesses to arrays (below) may jump back up to here. 
-            Label beginGetByValSlow(this);
-
-            Jump notImm = getSlowCase(iter);
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitFastArithIntToImmNoCheck(X86::edx, X86::edx);
-            notImm.link(this);
-            emitPutJITStubArg(X86::eax, 1);
-            emitPutJITStubArg(X86::edx, 2);
-            emitCTICall(Interpreter::cti_op_get_by_val);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_get_by_val));
-
-            // This is slow case that handles accesses to arrays above the fast cut-off.
-            // First, check if this is an access to the vector
-            linkSlowCase(iter);
-            jae32(X86::edx, Address(X86::ecx, FIELD_OFFSET(ArrayStorage, m_vectorLength)), beginGetByValSlow);
-
-            // okay, missed the fast region, but it is still in the vector.  Get the value.
-            loadPtr(BaseIndex(X86::ecx, X86::edx, ScalePtr, FIELD_OFFSET(ArrayStorage, m_vector[0])), X86::ecx);
-            // Check whether the value loaded is zero; if so we need to return undefined.
-            jzPtr(X86::ecx, beginGetByValSlow);
-            move(X86::ecx, X86::eax);
-            emitPutVirtualRegister(currentInstruction[1].u.operand, X86::eax);
-
-            NEXT_OPCODE(op_get_by_val);
-        }
-        case op_sub: {
-            compileBinaryArithOpSlowCase(op_sub, iter, currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, OperandTypes::fromInt(currentInstruction[4].u.operand));
-            NEXT_OPCODE(op_sub);
-        }
-        case op_rshift: {
-            compileFastArithSlow_op_rshift(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, iter);
-            NEXT_OPCODE(op_rshift);
-        }
-        case op_lshift: {
-            compileFastArithSlow_op_lshift(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, iter);
-            NEXT_OPCODE(op_lshift);
-        }
-        case op_loop_if_less: {
-            unsigned op2 = currentInstruction[2].u.operand;
-            unsigned target = currentInstruction[3].u.operand;
-            if (isOperandConstantImmediateInt(op2)) {
-                linkSlowCase(iter);
-                emitPutJITStubArg(X86::eax, 1);
-                emitPutJITStubArgFromVirtualRegister(op2, 2, X86::ecx);
-                emitCTICall(Interpreter::cti_op_loop_if_less);
-                emitJumpSlowToHot(jnz32(X86::eax), target + 3);
-            } else {
-                linkSlowCase(iter);
-                linkSlowCase(iter);
-                emitPutJITStubArg(X86::eax, 1);
-                emitPutJITStubArg(X86::edx, 2);
-                emitCTICall(Interpreter::cti_op_loop_if_less);
-                emitJumpSlowToHot(jnz32(X86::eax), target + 3);
-            }
-            NEXT_OPCODE(op_loop_if_less);
-        }
-        case op_put_by_id: {
-            compilePutByIdSlowCase(currentInstruction[1].u.operand, &(m_codeBlock->identifier(currentInstruction[2].u.operand)), currentInstruction[3].u.operand, iter, propertyAccessInstructionIndex++);
-            NEXT_OPCODE(op_put_by_id);
-        }
-        case op_get_by_id: {
-            compileGetByIdSlowCase(currentInstruction[1].u.operand, currentInstruction[2].u.operand, &(m_codeBlock->identifier(currentInstruction[3].u.operand)), iter, propertyAccessInstructionIndex++);
-            NEXT_OPCODE(op_get_by_id);
-        }
-        case op_loop_if_lesseq: {
-            unsigned op2 = currentInstruction[2].u.operand;
-            unsigned target = currentInstruction[3].u.operand;
-            if (isOperandConstantImmediateInt(op2)) {
-                linkSlowCase(iter);
-                emitPutJITStubArg(X86::eax, 1);
-                emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 2, X86::ecx);
-                emitCTICall(Interpreter::cti_op_loop_if_lesseq);
-                emitJumpSlowToHot(jnz32(X86::eax), target + 3);
-            } else {
-                linkSlowCase(iter);
-                linkSlowCase(iter);
-                emitPutJITStubArg(X86::eax, 1);
-                emitPutJITStubArg(X86::edx, 2);
-                emitCTICall(Interpreter::cti_op_loop_if_lesseq);
-                emitJumpSlowToHot(jnz32(X86::eax), target + 3);
-            }
-            NEXT_OPCODE(op_loop_if_lesseq);
-        }
-        case op_pre_inc: {
-            compileFastArithSlow_op_pre_inc(currentInstruction[1].u.operand, iter);
-            NEXT_OPCODE(op_pre_inc);
-        }
-        case op_put_by_val: {
-            // Normal slow cases - either is not an immediate imm, or is an array.
-            Jump notImm = getSlowCase(iter);
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitFastArithIntToImmNoCheck(X86::edx, X86::edx);
-            notImm.link(this);
-            emitGetVirtualRegister(currentInstruction[3].u.operand, X86::ecx);
-            emitPutJITStubArg(X86::eax, 1);
-            emitPutJITStubArg(X86::edx, 2);
-            emitPutJITStubArg(X86::ecx, 3);
-            emitCTICall(Interpreter::cti_op_put_by_val);
-            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_put_by_val));
-
-            // slow cases for immediate int accesses to arrays
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitGetVirtualRegister(currentInstruction[3].u.operand, X86::ecx);
-            emitPutJITStubArg(X86::eax, 1);
-            emitPutJITStubArg(X86::edx, 2);
-            emitPutJITStubArg(X86::ecx, 3);
-            emitCTICall(Interpreter::cti_op_put_by_val_array);
-
-            NEXT_OPCODE(op_put_by_val);
-        }
-        case op_loop_if_true: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(X86::eax, 1);
-            emitCTICall(Interpreter::cti_op_jtrue);
-            unsigned target = currentInstruction[2].u.operand;
-            emitJumpSlowToHot(jnz32(X86::eax), target + 2);
-            NEXT_OPCODE(op_loop_if_true);
-        }
-        case op_pre_dec: {
-            compileFastArithSlow_op_pre_dec(currentInstruction[1].u.operand, iter);
-            NEXT_OPCODE(op_pre_dec);
-        }
-        case op_jnless: {
-            unsigned op2 = currentInstruction[2].u.operand;
-            unsigned target = currentInstruction[3].u.operand;
-            if (isOperandConstantImmediateInt(op2)) {
-                linkSlowCase(iter);
-                emitPutJITStubArg(X86::eax, 1);
-                emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 2, X86::ecx);
-                emitCTICall(Interpreter::cti_op_jless);
-                emitJumpSlowToHot(jz32(X86::eax), target + 3);
-            } else {
-                linkSlowCase(iter);
-                linkSlowCase(iter);
-                emitPutJITStubArg(X86::eax, 1);
-                emitPutJITStubArg(X86::edx, 2);
-                emitCTICall(Interpreter::cti_op_jless);
-                emitJumpSlowToHot(jz32(X86::eax), target + 3);
-            }
-            NEXT_OPCODE(op_jnless);
-        }
-        case op_not: {
-            linkSlowCase(iter);
-            xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), X86::eax);
-            emitPutJITStubArg(X86::eax, 1);
-            emitCTICall(Interpreter::cti_op_not);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_not);
-        }
-        case op_jfalse: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(X86::eax, 1);
-            emitCTICall(Interpreter::cti_op_jtrue);
-            unsigned target = currentInstruction[2].u.operand;
-            emitJumpSlowToHot(jz32(X86::eax), target + 2); // inverted!
-            NEXT_OPCODE(op_jfalse);
-        }
-        case op_post_inc: {
-            compileFastArithSlow_op_post_inc(currentInstruction[1].u.operand, currentInstruction[2].u.operand, iter);
-            NEXT_OPCODE(op_post_inc);
-        }
-        case op_bitnot: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(X86::eax, 1);
-            emitCTICall(Interpreter::cti_op_bitnot);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_bitnot);
-        }
-        case op_bitand: {
-            compileFastArithSlow_op_bitand(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, iter);
-            NEXT_OPCODE(op_bitand);
-        }
-        case op_jtrue: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(X86::eax, 1);
-            emitCTICall(Interpreter::cti_op_jtrue);
-            unsigned target = currentInstruction[2].u.operand;
-            emitJumpSlowToHot(jnz32(X86::eax), target + 2);
-            NEXT_OPCODE(op_jtrue);
-        }
-        case op_post_dec: {
-            compileFastArithSlow_op_post_dec(currentInstruction[1].u.operand, currentInstruction[2].u.operand, iter);
-            NEXT_OPCODE(op_post_dec);
-        }
-        case op_bitxor: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(X86::eax, 1);
-            emitPutJITStubArg(X86::edx, 2);
-            emitCTICall(Interpreter::cti_op_bitxor);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_bitxor);
-        }
-        case op_bitor: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(X86::eax, 1);
-            emitPutJITStubArg(X86::edx, 2);
-            emitCTICall(Interpreter::cti_op_bitor);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_bitor);
-        }
-        case op_eq: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(X86::eax, 1);
-            emitPutJITStubArg(X86::edx, 2);
-            emitCTICall(Interpreter::cti_op_eq);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_eq);
-        }
-        case op_neq: {
-            linkSlowCase(iter);
-            emitPutJITStubArg(X86::eax, 1);
-            emitPutJITStubArg(X86::edx, 2);
-            emitCTICall(Interpreter::cti_op_neq);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_neq);
-        }
-        case op_stricteq: {
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitPutJITStubArg(X86::eax, 1);
-            emitPutJITStubArg(X86::edx, 2);
-            emitCTICall(Interpreter::cti_op_stricteq);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_stricteq);
-        }
-        case op_nstricteq: {
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitPutJITStubArg(X86::eax, 1);
-            emitPutJITStubArg(X86::edx, 2);
-            emitCTICall(Interpreter::cti_op_nstricteq);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_nstricteq);
-        }
-        case op_instanceof: {
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[2].u.operand, 1, X86::ecx);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[3].u.operand, 2, X86::ecx);
-            emitPutJITStubArgFromVirtualRegister(currentInstruction[4].u.operand, 3, X86::ecx);
-            emitCTICall(Interpreter::cti_op_instanceof);
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_instanceof);
-        }
-        case op_mod: {
-            compileFastArithSlow_op_mod(currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, iter);
-            NEXT_OPCODE(op_mod);
-        }
-        case op_mul: {
-            compileFastArithSlow_op_mul(currentInstruction, iter);
-            NEXT_OPCODE(op_mul);
-        }
-
-        case op_call: {
-            compileOpCallSlowCase(currentInstruction, iter, callLinkInfoIndex++, opcodeID);
-            NEXT_OPCODE(op_call);
-        }
-        case op_call_eval: {
-            compileOpCallSlowCase(currentInstruction, iter, callLinkInfoIndex++, opcodeID);
-            NEXT_OPCODE(op_call_eval);
-        }
-        case op_construct: {
-            compileOpCallSlowCase(currentInstruction, iter, callLinkInfoIndex++, opcodeID);
-            NEXT_OPCODE(op_construct);
-        }
-        case op_to_jsnumber: {
-            linkSlowCaseIfNotJSCell(iter, currentInstruction[2].u.operand);
-            linkSlowCase(iter);
-
-            emitPutJITStubArg(X86::eax, 1);
-            emitCTICall(Interpreter::cti_op_to_jsnumber);
-
-            emitPutVirtualRegister(currentInstruction[1].u.operand);
-            NEXT_OPCODE(op_to_jsnumber);
-        }
-
+        switch (m_interpreter->getOpcodeID(currentInstruction->u.opcode)) {
+        DEFINE_SLOWCASE_OP(op_add)
+        DEFINE_SLOWCASE_OP(op_bitand)
+        DEFINE_SLOWCASE_OP(op_bitnot)
+        DEFINE_SLOWCASE_OP(op_bitor)
+        DEFINE_SLOWCASE_OP(op_bitxor)
+        DEFINE_SLOWCASE_OP(op_call)
+        DEFINE_SLOWCASE_OP(op_call_eval)
+        DEFINE_SLOWCASE_OP(op_call_varargs)
+        DEFINE_SLOWCASE_OP(op_construct)
+        DEFINE_SLOWCASE_OP(op_construct_verify)
+        DEFINE_SLOWCASE_OP(op_convert_this)
+        DEFINE_SLOWCASE_OP(op_eq)
+        DEFINE_SLOWCASE_OP(op_get_by_id)
+        DEFINE_SLOWCASE_OP(op_get_by_val)
+        DEFINE_SLOWCASE_OP(op_instanceof)
+        DEFINE_SLOWCASE_OP(op_jfalse)
+        DEFINE_SLOWCASE_OP(op_jnless)
+        DEFINE_SLOWCASE_OP(op_jnlesseq)
+        DEFINE_SLOWCASE_OP(op_jtrue)
+        DEFINE_SLOWCASE_OP(op_loop_if_less)
+        DEFINE_SLOWCASE_OP(op_loop_if_lesseq)
+        DEFINE_SLOWCASE_OP(op_loop_if_true)
+        DEFINE_SLOWCASE_OP(op_lshift)
+        DEFINE_SLOWCASE_OP(op_mod)
+        DEFINE_SLOWCASE_OP(op_mul)
+        DEFINE_SLOWCASE_OP(op_method_check)
+        DEFINE_SLOWCASE_OP(op_neq)
+        DEFINE_SLOWCASE_OP(op_not)
+        DEFINE_SLOWCASE_OP(op_nstricteq)
+        DEFINE_SLOWCASE_OP(op_post_dec)
+        DEFINE_SLOWCASE_OP(op_post_inc)
+        DEFINE_SLOWCASE_OP(op_pre_dec)
+        DEFINE_SLOWCASE_OP(op_pre_inc)
+        DEFINE_SLOWCASE_OP(op_put_by_id)
+        DEFINE_SLOWCASE_OP(op_put_by_val)
+        DEFINE_SLOWCASE_OP(op_rshift)
+        DEFINE_SLOWCASE_OP(op_stricteq)
+        DEFINE_SLOWCASE_OP(op_sub)
+        DEFINE_SLOWCASE_OP(op_to_jsnumber)
+        DEFINE_SLOWCASE_OP(op_to_primitive)
         default:
             ASSERT_NOT_REACHED();
         }
@@ -1577,28 +379,26 @@ void JIT::privateCompileSlowCases()
     }
 
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-    ASSERT(propertyAccessInstructionIndex == m_codeBlock->numberOfStructureStubInfos());
+    ASSERT(m_propertyAccessInstructionIndex == m_codeBlock->numberOfStructureStubInfos());
 #endif
-    ASSERT(callLinkInfoIndex == m_codeBlock->numberOfCallLinkInfos());
+    ASSERT(m_callLinkInfoIndex == m_codeBlock->numberOfCallLinkInfos());
 
 #ifndef NDEBUG
-    // reset this, in order to guard it's use with asserts
+    // Reset this, in order to guard its use with ASSERTs.
     m_bytecodeIndex = (unsigned)-1;
 #endif
 }
 
 void JIT::privateCompile()
 {
-#if ENABLE(CODEBLOCK_SAMPLING)
-        storePtr(ImmPtr(m_codeBlock), m_interpreter->sampler()->codeBlockSlot());
-#endif
+    sampleCodeBlock(m_codeBlock);
 #if ENABLE(OPCODE_SAMPLING)
-        store32(Imm32(m_interpreter->sampler()->encodeSample(m_codeBlock->instructions().begin())), m_interpreter->sampler()->sampleSlot());
+    sampleInstruction(m_codeBlock->instructions().begin());
 #endif
 
     // Could use a pop_m, but would need to offset the following instruction if so.
-    pop(X86::ecx);
-    emitPutToCallFrameHeader(X86::ecx, RegisterFile::ReturnPC);
+    preverveReturnAddressAfterCall(regT2);
+    emitPutToCallFrameHeader(regT2, RegisterFile::ReturnPC);
 
     Jump slowRegisterFileCheck;
     Label afterRegisterFileCheck;
@@ -1606,10 +406,10 @@ void JIT::privateCompile()
         // In the case of a fast linked call, we do not set this up in the caller.
         emitPutImmediateToCallFrameHeader(m_codeBlock, RegisterFile::CodeBlock);
 
-        emitGetCTIParam(STUB_ARGS_registerFile, X86::eax);
-        addPtr(Imm32(m_codeBlock->m_numCalleeRegisters * sizeof(Register)), callFrameRegister, X86::edx);
-        
-        slowRegisterFileCheck = jg32(X86::edx, Address(X86::eax, FIELD_OFFSET(RegisterFile, m_end)));
+        peek(regT0, OBJECT_OFFSETOF(JITStackFrame, registerFile) / sizeof (void*));
+        addPtr(Imm32(m_codeBlock->m_numCalleeRegisters * sizeof(Register)), callFrameRegister, regT1);
+
+        slowRegisterFileCheck = branchPtr(Above, regT1, Address(regT0, OBJECT_OFFSETOF(RegisterFile, m_end)));
         afterRegisterFileCheck = label();
     }
 
@@ -1619,22 +419,17 @@ void JIT::privateCompile()
 
     if (m_codeBlock->codeType() == FunctionCode) {
         slowRegisterFileCheck.link(this);
-        m_bytecodeIndex = 0; // emitCTICall will add to the map, but doesn't actually need this...
-        emitCTICall(Interpreter::cti_register_file_check);
+        m_bytecodeIndex = 0;
+        JITStubCall(this, JITStubs::cti_register_file_check).call();
 #ifndef NDEBUG
-        // reset this, in order to guard it's use with asserts
-        m_bytecodeIndex = (unsigned)-1;
+        m_bytecodeIndex = (unsigned)-1; // Reset this, in order to guard its use with ASSERTs.
 #endif
         jump(afterRegisterFileCheck);
     }
 
     ASSERT(m_jmpTable.isEmpty());
 
-    RefPtr<ExecutablePool> allocator = m_globalData->poolForSize(m_assembler.size());
-    void* code = m_assembler.executableCopy(allocator.get());
-    JITCodeRef codeRef(code, allocator);
- 
-    PatchBuffer patchBuffer(code);
+    LinkBuffer patchBuffer(this, m_globalData->executableAllocator.poolForSize(m_assembler.size()));
 
     // Translate vPC offsets into addresses in JIT generated code, for switch tables.
     for (unsigned i = 0; i < m_switches.size(); ++i) {
@@ -1645,87 +440,89 @@ void JIT::privateCompile()
             ASSERT(record.type == SwitchRecord::Immediate || record.type == SwitchRecord::Character); 
             ASSERT(record.jumpTable.simpleJumpTable->branchOffsets.size() == record.jumpTable.simpleJumpTable->ctiOffsets.size());
 
-            record.jumpTable.simpleJumpTable->ctiDefault = patchBuffer.addressOf(m_labels[bytecodeIndex + 3 + record.defaultOffset]);
+            record.jumpTable.simpleJumpTable->ctiDefault = patchBuffer.locationOf(m_labels[bytecodeIndex + 3 + record.defaultOffset]);
 
             for (unsigned j = 0; j < record.jumpTable.simpleJumpTable->branchOffsets.size(); ++j) {
                 unsigned offset = record.jumpTable.simpleJumpTable->branchOffsets[j];
-                record.jumpTable.simpleJumpTable->ctiOffsets[j] = offset ? patchBuffer.addressOf(m_labels[bytecodeIndex + 3 + offset]) : record.jumpTable.simpleJumpTable->ctiDefault;
+                record.jumpTable.simpleJumpTable->ctiOffsets[j] = offset ? patchBuffer.locationOf(m_labels[bytecodeIndex + 3 + offset]) : record.jumpTable.simpleJumpTable->ctiDefault;
             }
         } else {
             ASSERT(record.type == SwitchRecord::String);
 
-            record.jumpTable.stringJumpTable->ctiDefault = patchBuffer.addressOf(m_labels[bytecodeIndex + 3 + record.defaultOffset]);
+            record.jumpTable.stringJumpTable->ctiDefault = patchBuffer.locationOf(m_labels[bytecodeIndex + 3 + record.defaultOffset]);
 
             StringJumpTable::StringOffsetTable::iterator end = record.jumpTable.stringJumpTable->offsetTable.end();            
             for (StringJumpTable::StringOffsetTable::iterator it = record.jumpTable.stringJumpTable->offsetTable.begin(); it != end; ++it) {
                 unsigned offset = it->second.branchOffset;
-                it->second.ctiOffset = offset ? patchBuffer.addressOf(m_labels[bytecodeIndex + 3 + offset]) : record.jumpTable.stringJumpTable->ctiDefault;
+                it->second.ctiOffset = offset ? patchBuffer.locationOf(m_labels[bytecodeIndex + 3 + offset]) : record.jumpTable.stringJumpTable->ctiDefault;
             }
         }
     }
 
     for (size_t i = 0; i < m_codeBlock->numberOfExceptionHandlers(); ++i) {
         HandlerInfo& handler = m_codeBlock->exceptionHandler(i);
-        handler.nativeCode = patchBuffer.addressOf(m_labels[handler.target]);
+        handler.nativeCode = patchBuffer.locationOf(m_labels[handler.target]);
     }
 
-    m_codeBlock->pcVector().reserveCapacity(m_calls.size());
     for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter) {
         if (iter->to)
-            patchBuffer.link(iter->from, iter->to);
-        m_codeBlock->pcVector().append(PC(reinterpret_cast<void**>(patchBuffer.addressOf(iter->from)) - reinterpret_cast<void**>(code), iter->bytecodeIndex));
+            patchBuffer.link(iter->from, FunctionPtr(iter->to));
+    }
+
+    if (m_codeBlock->hasExceptionInfo()) {
+        m_codeBlock->callReturnIndexVector().reserveCapacity(m_calls.size());
+        for (Vector<CallRecord>::iterator iter = m_calls.begin(); iter != m_calls.end(); ++iter)
+            m_codeBlock->callReturnIndexVector().append(CallReturnOffsetToBytecodeIndex(patchBuffer.returnAddressOffset(iter->from), iter->bytecodeIndex));
     }
 
     // Link absolute addresses for jsr
     for (Vector<JSRInfo>::iterator iter = m_jsrSites.begin(); iter != m_jsrSites.end(); ++iter)
-        patchBuffer.setPtr(iter->storeLocation, patchBuffer.addressOf(iter->target));
+        patchBuffer.patch(iter->storeLocation, patchBuffer.locationOf(iter->target).executableAddress());
 
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
     for (unsigned i = 0; i < m_codeBlock->numberOfStructureStubInfos(); ++i) {
         StructureStubInfo& info = m_codeBlock->structureStubInfo(i);
-#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-        info.callReturnLocation = patchBuffer.addressOf(m_propertyAccessCompilationInfo[i].callReturnLocation);
-        info.hotPathBegin = patchBuffer.addressOf(m_propertyAccessCompilationInfo[i].hotPathBegin);
-#else
-        info.callReturnLocation = 0;
-        info.hotPathBegin = 0;
-#endif
+        info.callReturnLocation = patchBuffer.locationOf(m_propertyAccessCompilationInfo[i].callReturnLocation);
+        info.hotPathBegin = patchBuffer.locationOf(m_propertyAccessCompilationInfo[i].hotPathBegin);
     }
+#endif
+#if ENABLE(JIT_OPTIMIZE_CALL)
     for (unsigned i = 0; i < m_codeBlock->numberOfCallLinkInfos(); ++i) {
         CallLinkInfo& info = m_codeBlock->callLinkInfo(i);
-#if ENABLE(JIT_OPTIMIZE_CALL)
-        info.callReturnLocation = patchBuffer.addressOf(m_callStructureStubCompilationInfo[i].callReturnLocation);
-        info.hotPathBegin = patchBuffer.addressOf(m_callStructureStubCompilationInfo[i].hotPathBegin);
-        info.hotPathOther = patchBuffer.addressOf(m_callStructureStubCompilationInfo[i].hotPathOther);
-        info.coldPathOther = patchBuffer.addressOf(m_callStructureStubCompilationInfo[i].coldPathOther);
-#else
-        info.callReturnLocation = 0;
-        info.hotPathBegin = 0;
-        info.hotPathOther = 0;
-        info.coldPathOther = 0;
+        info.callReturnLocation = patchBuffer.locationOfNearCall(m_callStructureStubCompilationInfo[i].callReturnLocation);
+        info.hotPathBegin = patchBuffer.locationOf(m_callStructureStubCompilationInfo[i].hotPathBegin);
+        info.hotPathOther = patchBuffer.locationOfNearCall(m_callStructureStubCompilationInfo[i].hotPathOther);
+    }
 #endif
+    unsigned methodCallCount = m_methodCallCompilationInfo.size();
+    m_codeBlock->addMethodCallLinkInfos(methodCallCount);
+    for (unsigned i = 0; i < methodCallCount; ++i) {
+        MethodCallLinkInfo& info = m_codeBlock->methodCallLinkInfo(i);
+        info.structureLabel = patchBuffer.locationOf(m_methodCallCompilationInfo[i].structureToCompare);
+        info.callReturnLocation = m_codeBlock->structureStubInfo(m_methodCallCompilationInfo[i].propertyAccessIndex).callReturnLocation;
     }
 
-    m_codeBlock->setJITCode(codeRef);
+    m_codeBlock->setJITCode(patchBuffer.finalizeCode());
 }
 
-void JIT::privateCompileCTIMachineTrampolines()
+void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* globalData, CodePtr* ctiArrayLengthTrampoline, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallPreLink, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)
 {
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
     // (1) The first function provides fast property access for array length
     Label arrayLengthBegin = align();
 
     // Check eax is an array
-    Jump array_failureCases1 = emitJumpIfNotJSCell(X86::eax);
-    Jump array_failureCases2 = jnePtr(Address(X86::eax), ImmPtr(m_interpreter->m_jsArrayVptr));
+    Jump array_failureCases1 = emitJumpIfNotJSCell(regT0);
+    Jump array_failureCases2 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr));
 
     // Checks out okay! - get the length from the storage
-    loadPtr(Address(X86::eax, FIELD_OFFSET(JSArray, m_storage)), X86::eax);
-    load32(Address(X86::eax, FIELD_OFFSET(ArrayStorage, m_length)), X86::eax);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT0);
+    load32(Address(regT0, OBJECT_OFFSETOF(ArrayStorage, m_length)), regT0);
 
-    Jump array_failureCases3 = ja32(X86::eax, Imm32(JSImmediate::maxImmediateInt));
+    Jump array_failureCases3 = branch32(Above, regT0, Imm32(JSImmediate::maxImmediateInt));
 
-    // X86::eax contains a 64 bit value (is positive, is zero extended) so we don't need sign extend here.
-    emitFastArithIntToImmNoCheck(X86::eax, X86::eax);
+    // regT0 contains a 64 bit value (is positive, is zero extended) so we don't need sign extend here.
+    emitFastArithIntToImmNoCheck(regT0, regT0);
 
     ret();
 
@@ -1733,175 +530,414 @@ void JIT::privateCompileCTIMachineTrampolines()
     Label stringLengthBegin = align();
 
     // Check eax is a string
-    Jump string_failureCases1 = emitJumpIfNotJSCell(X86::eax);
-    Jump string_failureCases2 = jnePtr(Address(X86::eax), ImmPtr(m_interpreter->m_jsStringVptr));
+    Jump string_failureCases1 = emitJumpIfNotJSCell(regT0);
+    Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr));
 
     // Checks out okay! - get the length from the Ustring.
-    loadPtr(Address(X86::eax, FIELD_OFFSET(JSString, m_value) + FIELD_OFFSET(UString, m_rep)), X86::eax);
-    load32(Address(X86::eax, FIELD_OFFSET(UString::Rep, len)), X86::eax);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSString, m_value) + OBJECT_OFFSETOF(UString, m_rep)), regT0);
+    load32(Address(regT0, OBJECT_OFFSETOF(UString::Rep, len)), regT0);
 
-    Jump string_failureCases3 = ja32(X86::eax, Imm32(JSImmediate::maxImmediateInt));
+    Jump string_failureCases3 = branch32(Above, regT0, Imm32(JSImmediate::maxImmediateInt));
 
-    // X86::eax contains a 64 bit value (is positive, is zero extended) so we don't need sign extend here.
-    emitFastArithIntToImmNoCheck(X86::eax, X86::eax);
+    // regT0 contains a 64 bit value (is positive, is zero extended) so we don't need sign extend here.
+    emitFastArithIntToImmNoCheck(regT0, regT0);
     
     ret();
 #endif
 
     // (3) Trampolines for the slow cases of op_call / op_call_eval / op_construct.
-    
+    COMPILE_ASSERT(sizeof(CodeType) == 4, CodeTypeEnumMustBe32Bit);
+
     Label virtualCallPreLinkBegin = align();
 
     // Load the callee CodeBlock* into eax
-    loadPtr(Address(X86::ecx, FIELD_OFFSET(JSFunction, m_body)), X86::eax);
-    loadPtr(Address(X86::eax, FIELD_OFFSET(FunctionBodyNode, m_code)), X86::eax);
-    Jump hasCodeBlock1 = jnzPtr(X86::eax);
-    pop(X86::ebx);
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_body)), regT3);
+    loadPtr(Address(regT3, OBJECT_OFFSETOF(FunctionBodyNode, m_code)), regT0);
+    Jump hasCodeBlock1 = branchTestPtr(NonZero, regT0);
+    preverveReturnAddressAfterCall(regT3);
     restoreArgumentReference();
-    Jump callJSFunction1 = call();
-    emitGetJITStubArg(1, X86::ecx);
-    emitGetJITStubArg(3, X86::edx);
-    push(X86::ebx);
+    Call callJSFunction1 = call();
+    emitGetJITStubArg(1, regT2);
+    emitGetJITStubArg(3, regT1);
+    restoreReturnAddressBeforeReturn(regT3);
     hasCodeBlock1.link(this);
 
+    Jump isNativeFunc1 = branch32(Equal, Address(regT0, OBJECT_OFFSETOF(CodeBlock, m_codeType)), Imm32(NativeCode));
+
     // Check argCount matches callee arity.
-    Jump arityCheckOkay1 = je32(Address(X86::eax, FIELD_OFFSET(CodeBlock, m_numParameters)), X86::edx);
-    pop(X86::ebx);
-    emitPutJITStubArg(X86::ebx, 2);
-    emitPutJITStubArg(X86::eax, 4);
+    Jump arityCheckOkay1 = branch32(Equal, Address(regT0, OBJECT_OFFSETOF(CodeBlock, m_numParameters)), regT1);
+    preverveReturnAddressAfterCall(regT3);
+    emitPutJITStubArg(regT3, 2);
+    emitPutJITStubArg(regT0, 4);
     restoreArgumentReference();
-    Jump callArityCheck1 = call();
-    move(X86::edx, callFrameRegister);
-    emitGetJITStubArg(1, X86::ecx);
-    emitGetJITStubArg(3, X86::edx);
-    push(X86::ebx);
+    Call callArityCheck1 = call();
+    move(regT1, callFrameRegister);
+    emitGetJITStubArg(1, regT2);
+    emitGetJITStubArg(3, regT1);
+    restoreReturnAddressBeforeReturn(regT3);
     arityCheckOkay1.link(this);
+    isNativeFunc1.link(this);
     
     compileOpCallInitializeCallFrame();
 
-    pop(X86::ebx);
-    emitPutJITStubArg(X86::ebx, 2);
+    preverveReturnAddressAfterCall(regT3);
+    emitPutJITStubArg(regT3, 2);
     restoreArgumentReference();
-    Jump callDontLazyLinkCall = call();
-    push(X86::ebx);
+    Call callDontLazyLinkCall = call();
+    emitGetJITStubArg(1, regT2);
+    restoreReturnAddressBeforeReturn(regT3);
 
-    jump(X86::eax);
+    jump(regT0);
 
     Label virtualCallLinkBegin = align();
 
     // Load the callee CodeBlock* into eax
-    loadPtr(Address(X86::ecx, FIELD_OFFSET(JSFunction, m_body)), X86::eax);
-    loadPtr(Address(X86::eax, FIELD_OFFSET(FunctionBodyNode, m_code)), X86::eax);
-    Jump hasCodeBlock2 = jnzPtr(X86::eax);
-    pop(X86::ebx);
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_body)), regT3);
+    loadPtr(Address(regT3, OBJECT_OFFSETOF(FunctionBodyNode, m_code)), regT0);
+    Jump hasCodeBlock2 = branchTestPtr(NonZero, regT0);
+    preverveReturnAddressAfterCall(regT3);
     restoreArgumentReference();
-    Jump callJSFunction2 = call();
-    emitGetJITStubArg(1, X86::ecx);
-    emitGetJITStubArg(3, X86::edx);
-    push(X86::ebx);
+    Call callJSFunction2 = call();
+    emitGetJITStubArg(1, regT2);
+    emitGetJITStubArg(3, regT1);
+    restoreReturnAddressBeforeReturn(regT3);
     hasCodeBlock2.link(this);
 
+    Jump isNativeFunc2 = branch32(Equal, Address(regT0, OBJECT_OFFSETOF(CodeBlock, m_codeType)), Imm32(NativeCode));
+
     // Check argCount matches callee arity.
-    Jump arityCheckOkay2 = je32(Address(X86::eax, FIELD_OFFSET(CodeBlock, m_numParameters)), X86::edx);
-    pop(X86::ebx);
-    emitPutJITStubArg(X86::ebx, 2);
-    emitPutJITStubArg(X86::eax, 4);
+    Jump arityCheckOkay2 = branch32(Equal, Address(regT0, OBJECT_OFFSETOF(CodeBlock, m_numParameters)), regT1);
+    preverveReturnAddressAfterCall(regT3);
+    emitPutJITStubArg(regT3, 2);
+    emitPutJITStubArg(regT0, 4);
     restoreArgumentReference();
-    Jump callArityCheck2 = call();
-    move(X86::edx, callFrameRegister);
-    emitGetJITStubArg(1, X86::ecx);
-    emitGetJITStubArg(3, X86::edx);
-    push(X86::ebx);
+    Call callArityCheck2 = call();
+    move(regT1, callFrameRegister);
+    emitGetJITStubArg(1, regT2);
+    emitGetJITStubArg(3, regT1);
+    restoreReturnAddressBeforeReturn(regT3);
     arityCheckOkay2.link(this);
+    isNativeFunc2.link(this);
 
     compileOpCallInitializeCallFrame();
 
-    pop(X86::ebx);
-    emitPutJITStubArg(X86::ebx, 2);
+    preverveReturnAddressAfterCall(regT3);
+    emitPutJITStubArg(regT3, 2);
     restoreArgumentReference();
-    Jump callLazyLinkCall = call();
-    push(X86::ebx);
+    Call callLazyLinkCall = call();
+    restoreReturnAddressBeforeReturn(regT3);
 
-    jump(X86::eax);
+    jump(regT0);
 
     Label virtualCallBegin = align();
 
     // Load the callee CodeBlock* into eax
-    loadPtr(Address(X86::ecx, FIELD_OFFSET(JSFunction, m_body)), X86::eax);
-    loadPtr(Address(X86::eax, FIELD_OFFSET(FunctionBodyNode, m_code)), X86::eax);
-    Jump hasCodeBlock3 = jnzPtr(X86::eax);
-    pop(X86::ebx);
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_body)), regT3);
+    loadPtr(Address(regT3, OBJECT_OFFSETOF(FunctionBodyNode, m_code)), regT0);
+    Jump hasCodeBlock3 = branchTestPtr(NonZero, regT0);
+    preverveReturnAddressAfterCall(regT3);
     restoreArgumentReference();
-    Jump callJSFunction3 = call();
-    emitGetJITStubArg(1, X86::ecx);
-    emitGetJITStubArg(3, X86::edx);
-    push(X86::ebx);
+    Call callJSFunction3 = call();
+    emitGetJITStubArg(1, regT2);
+    emitGetJITStubArg(3, regT1);
+    restoreReturnAddressBeforeReturn(regT3);
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_body)), regT3); // reload the function body nody, so we can reload the code pointer.
     hasCodeBlock3.link(this);
+    
+    Jump isNativeFunc3 = branch32(Equal, Address(regT0, OBJECT_OFFSETOF(CodeBlock, m_codeType)), Imm32(NativeCode));
 
     // Check argCount matches callee arity.
-    Jump arityCheckOkay3 = je32(Address(X86::eax, FIELD_OFFSET(CodeBlock, m_numParameters)), X86::edx);
-    pop(X86::ebx);
-    emitPutJITStubArg(X86::ebx, 2);
-    emitPutJITStubArg(X86::eax, 4);
+    Jump arityCheckOkay3 = branch32(Equal, Address(regT0, OBJECT_OFFSETOF(CodeBlock, m_numParameters)), regT1);
+    preverveReturnAddressAfterCall(regT3);
+    emitPutJITStubArg(regT3, 2);
+    emitPutJITStubArg(regT0, 4);
     restoreArgumentReference();
-    Jump callArityCheck3 = call();
-    move(X86::edx, callFrameRegister);
-    emitGetJITStubArg(1, X86::ecx);
-    emitGetJITStubArg(3, X86::edx);
-    push(X86::ebx);
+    Call callArityCheck3 = call();
+    move(regT1, callFrameRegister);
+    emitGetJITStubArg(1, regT2);
+    emitGetJITStubArg(3, regT1);
+    restoreReturnAddressBeforeReturn(regT3);
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_body)), regT3); // reload the function body nody, so we can reload the code pointer.
     arityCheckOkay3.link(this);
+    isNativeFunc3.link(this);
 
+    // load ctiCode from the new codeBlock.
+    loadPtr(Address(regT3, OBJECT_OFFSETOF(FunctionBodyNode, m_jitCode)), regT0);
+    
     compileOpCallInitializeCallFrame();
+    jump(regT0);
 
-    // load ctiCode from the new codeBlock.
-    loadPtr(Address(X86::eax, FIELD_OFFSET(CodeBlock, m_jitCode)), X86::eax);
+    
+    Label nativeCallThunk = align();
+    preverveReturnAddressAfterCall(regT0);
+    emitPutToCallFrameHeader(regT0, RegisterFile::ReturnPC); // Push return address
+
+    // Load caller frame's scope chain into this callframe so that whatever we call can
+    // get to its global data.
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT1);
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT1);
+    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+    
+
+#if PLATFORM(X86_64)
+    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, X86::ecx);
+
+    // Allocate stack space for our arglist
+    subPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
+    COMPILE_ASSERT((sizeof(ArgList) & 0xf) == 0, ArgList_should_by_16byte_aligned);
+    
+    // Set up arguments
+    subPtr(Imm32(1), X86::ecx); // Don't include 'this' in argcount
+
+    // Push argcount
+    storePtr(X86::ecx, Address(stackPointerRegister, OBJECT_OFFSETOF(ArgList, m_argCount)));
+
+    // Calculate the start of the callframe header, and store in edx
+    addPtr(Imm32(-RegisterFile::CallFrameHeaderSize * (int32_t)sizeof(Register)), callFrameRegister, X86::edx);
+    
+    // Calculate start of arguments as callframe header - sizeof(Register) * argcount (ecx)
+    mul32(Imm32(sizeof(Register)), X86::ecx, X86::ecx);
+    subPtr(X86::ecx, X86::edx);
+
+    // push pointer to arguments
+    storePtr(X86::edx, Address(stackPointerRegister, OBJECT_OFFSETOF(ArgList, m_args)));
+    
+    // ArgList is passed by reference so is stackPointerRegister
+    move(stackPointerRegister, X86::ecx);
+    
+    // edx currently points to the first argument, edx-sizeof(Register) points to 'this'
+    loadPtr(Address(X86::edx, -(int32_t)sizeof(Register)), X86::edx);
+    
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86::esi);
+
+    move(callFrameRegister, X86::edi); 
+
+    call(Address(X86::esi, OBJECT_OFFSETOF(JSFunction, m_data)));
+    
+    addPtr(Imm32(sizeof(ArgList)), stackPointerRegister);
+#elif PLATFORM(X86)
+    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);
+
+    /* We have two structs that we use to describe the stackframe we set up for our
+     * call to native code.  NativeCallFrameStructure describes the how we set up the stack
+     * in advance of the call.  NativeFunctionCalleeSignature describes the callframe
+     * as the native code expects it.  We do this as we are using the fastcall calling
+     * convention which results in the callee popping its arguments off the stack, but
+     * not the rest of the callframe so we need a nice way to ensure we increment the
+     * stack pointer by the right amount after the call.
+     */
+#if COMPILER(MSVC) || PLATFORM(LINUX)
+    struct NativeCallFrameStructure {
+      //  CallFrame* callFrame; // passed in EDX
+        JSObject* callee;
+        JSValue thisValue;
+        ArgList* argPointer;
+        ArgList args;
+        JSValue result;
+    };
+    struct NativeFunctionCalleeSignature {
+        JSObject* callee;
+        JSValue thisValue;
+        ArgList* argPointer;
+    };
+#else
+    struct NativeCallFrameStructure {
+      //  CallFrame* callFrame; // passed in ECX
+      //  JSObject* callee; // passed in EDX
+        JSValue thisValue;
+        ArgList* argPointer;
+        ArgList args;
+    };
+    struct NativeFunctionCalleeSignature {
+        JSValue thisValue;
+        ArgList* argPointer;
+    };
+#endif
+    const int NativeCallFrameSize = (sizeof(NativeCallFrameStructure) + 15) & ~15;
+    // Allocate system stack frame
+    subPtr(Imm32(NativeCallFrameSize), stackPointerRegister);
+
+    // Set up arguments
+    subPtr(Imm32(1), regT0); // Don't include 'this' in argcount
+
+    // push argcount
+    storePtr(regT0, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, args) + OBJECT_OFFSETOF(ArgList, m_argCount)));
+    
+    // Calculate the start of the callframe header, and store in regT1
+    addPtr(Imm32(-RegisterFile::CallFrameHeaderSize * (int)sizeof(Register)), callFrameRegister, regT1);
+    
+    // Calculate start of arguments as callframe header - sizeof(Register) * argcount (regT0)
+    mul32(Imm32(sizeof(Register)), regT0, regT0);
+    subPtr(regT0, regT1);
+    storePtr(regT1, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, args) + OBJECT_OFFSETOF(ArgList, m_args)));
+
+    // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)
+    addPtr(Imm32(OBJECT_OFFSETOF(NativeCallFrameStructure, args)), stackPointerRegister, regT0);
+    storePtr(regT0, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, argPointer)));
+
+    // regT1 currently points to the first argument, regT1 - sizeof(Register) points to 'this'
+    loadPtr(Address(regT1, -(int)sizeof(Register)), regT1);
+    storePtr(regT1, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, thisValue)));
 
-    jump(X86::eax);
+#if COMPILER(MSVC) || PLATFORM(LINUX)
+    // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)
+    addPtr(Imm32(OBJECT_OFFSETOF(NativeCallFrameStructure, result)), stackPointerRegister, X86::ecx);
+
+    // Plant callee
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86::eax);
+    storePtr(X86::eax, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, callee)));
+
+    // Plant callframe
+    move(callFrameRegister, X86::edx);
+
+    call(Address(X86::eax, OBJECT_OFFSETOF(JSFunction, m_data)));
+
+    // JSValue is a non-POD type
+    loadPtr(Address(X86::eax), X86::eax);
+#else
+    // Plant callee
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86::edx);
+
+    // Plant callframe
+    move(callFrameRegister, X86::ecx);
+    call(Address(X86::edx, OBJECT_OFFSETOF(JSFunction, m_data)));
+#endif
+
+    // We've put a few temporaries on the stack in addition to the actual arguments
+    // so pull them off now
+    addPtr(Imm32(NativeCallFrameSize - sizeof(NativeFunctionCalleeSignature)), stackPointerRegister);
+
+#elif ENABLE(JIT_OPTIMIZE_NATIVE_CALL)
+#error "JIT_OPTIMIZE_NATIVE_CALL not yet supported on this platform."
+#else
+    breakpoint();
+#endif
+
+    // Check for an exception
+    loadPtr(&(globalData->exception), regT2);
+    Jump exceptionHandler = branchTestPtr(NonZero, regT2);
+
+    // Grab the return address.
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
+    
+    // Restore our caller's "r".
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
+    
+    // Return.
+    restoreReturnAddressBeforeReturn(regT1);
+    ret();
+
+    // Handle an exception
+    exceptionHandler.link(this);
+    // Grab the return address.
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
+    move(ImmPtr(&globalData->exceptionLocation), regT2);
+    storePtr(regT1, regT2);
+    move(ImmPtr(reinterpret_cast<void*>(ctiVMThrowTrampoline)), regT2);
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
+    poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof (void*));
+    restoreReturnAddressBeforeReturn(regT2);
+    ret();
+    
+
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+    Call array_failureCases1Call = makeTailRecursiveCall(array_failureCases1);
+    Call array_failureCases2Call = makeTailRecursiveCall(array_failureCases2);
+    Call array_failureCases3Call = makeTailRecursiveCall(array_failureCases3);
+    Call string_failureCases1Call = makeTailRecursiveCall(string_failureCases1);
+    Call string_failureCases2Call = makeTailRecursiveCall(string_failureCases2);
+    Call string_failureCases3Call = makeTailRecursiveCall(string_failureCases3);
+#endif
 
     // All trampolines constructed! copy the code, link up calls, and set the pointers on the Machine object.
-    m_interpreter->m_executablePool = m_globalData->poolForSize(m_assembler.size());
-    void* code = m_assembler.executableCopy(m_interpreter->m_executablePool.get());
-    PatchBuffer patchBuffer(code);
+    LinkBuffer patchBuffer(this, m_globalData->executableAllocator.poolForSize(m_assembler.size()));
 
 #if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
-    patchBuffer.link(array_failureCases1, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_array_fail));
-    patchBuffer.link(array_failureCases2, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_array_fail));
-    patchBuffer.link(array_failureCases3, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_array_fail));
-    patchBuffer.link(string_failureCases1, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_string_fail));
-    patchBuffer.link(string_failureCases2, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_string_fail));
-    patchBuffer.link(string_failureCases3, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_string_fail));
-
-    m_interpreter->m_ctiArrayLengthTrampoline = patchBuffer.addressOf(arrayLengthBegin);
-    m_interpreter->m_ctiStringLengthTrampoline = patchBuffer.addressOf(stringLengthBegin);
+    patchBuffer.link(array_failureCases1Call, FunctionPtr(JITStubs::cti_op_get_by_id_array_fail));
+    patchBuffer.link(array_failureCases2Call, FunctionPtr(JITStubs::cti_op_get_by_id_array_fail));
+    patchBuffer.link(array_failureCases3Call, FunctionPtr(JITStubs::cti_op_get_by_id_array_fail));
+    patchBuffer.link(string_failureCases1Call, FunctionPtr(JITStubs::cti_op_get_by_id_string_fail));
+    patchBuffer.link(string_failureCases2Call, FunctionPtr(JITStubs::cti_op_get_by_id_string_fail));
+    patchBuffer.link(string_failureCases3Call, FunctionPtr(JITStubs::cti_op_get_by_id_string_fail));
+#endif
+    patchBuffer.link(callArityCheck1, FunctionPtr(JITStubs::cti_op_call_arityCheck));
+    patchBuffer.link(callArityCheck2, FunctionPtr(JITStubs::cti_op_call_arityCheck));
+    patchBuffer.link(callArityCheck3, FunctionPtr(JITStubs::cti_op_call_arityCheck));
+    patchBuffer.link(callJSFunction1, FunctionPtr(JITStubs::cti_op_call_JSFunction));
+    patchBuffer.link(callJSFunction2, FunctionPtr(JITStubs::cti_op_call_JSFunction));
+    patchBuffer.link(callJSFunction3, FunctionPtr(JITStubs::cti_op_call_JSFunction));
+    patchBuffer.link(callDontLazyLinkCall, FunctionPtr(JITStubs::cti_vm_dontLazyLinkCall));
+    patchBuffer.link(callLazyLinkCall, FunctionPtr(JITStubs::cti_vm_lazyLinkCall));
+
+    CodeRef finalCode = patchBuffer.finalizeCode();
+    *executablePool = finalCode.m_executablePool;
+
+    *ctiVirtualCallPreLink = trampolineAt(finalCode, virtualCallPreLinkBegin);
+    *ctiVirtualCallLink = trampolineAt(finalCode, virtualCallLinkBegin);
+    *ctiVirtualCall = trampolineAt(finalCode, virtualCallBegin);
+    *ctiNativeCallThunk = trampolineAt(finalCode, nativeCallThunk);
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+    *ctiArrayLengthTrampoline = trampolineAt(finalCode, arrayLengthBegin);
+    *ctiStringLengthTrampoline = trampolineAt(finalCode, stringLengthBegin);
+#else
+    UNUSED_PARAM(ctiArrayLengthTrampoline);
+    UNUSED_PARAM(ctiStringLengthTrampoline);
 #endif
-    patchBuffer.link(callArityCheck1, reinterpret_cast<void*>(Interpreter::cti_op_call_arityCheck));
-    patchBuffer.link(callArityCheck2, reinterpret_cast<void*>(Interpreter::cti_op_call_arityCheck));
-    patchBuffer.link(callArityCheck3, reinterpret_cast<void*>(Interpreter::cti_op_call_arityCheck));
-    patchBuffer.link(callJSFunction1, reinterpret_cast<void*>(Interpreter::cti_op_call_JSFunction));
-    patchBuffer.link(callJSFunction2, reinterpret_cast<void*>(Interpreter::cti_op_call_JSFunction));
-    patchBuffer.link(callJSFunction3, reinterpret_cast<void*>(Interpreter::cti_op_call_JSFunction));
-    patchBuffer.link(callDontLazyLinkCall, reinterpret_cast<void*>(Interpreter::cti_vm_dontLazyLinkCall));
-    patchBuffer.link(callLazyLinkCall, reinterpret_cast<void*>(Interpreter::cti_vm_lazyLinkCall));
-
-    m_interpreter->m_ctiVirtualCallPreLink = patchBuffer.addressOf(virtualCallPreLinkBegin);
-    m_interpreter->m_ctiVirtualCallLink = patchBuffer.addressOf(virtualCallLinkBegin);
-    m_interpreter->m_ctiVirtualCall = patchBuffer.addressOf(virtualCallBegin);
 }
 
 void JIT::emitGetVariableObjectRegister(RegisterID variableObject, int index, RegisterID dst)
 {
-    loadPtr(Address(variableObject, FIELD_OFFSET(JSVariableObject, d)), dst);
-    loadPtr(Address(dst, FIELD_OFFSET(JSVariableObject::JSVariableObjectData, registers)), dst);
+    loadPtr(Address(variableObject, OBJECT_OFFSETOF(JSVariableObject, d)), dst);
+    loadPtr(Address(dst, OBJECT_OFFSETOF(JSVariableObject::JSVariableObjectData, registers)), dst);
     loadPtr(Address(dst, index * sizeof(Register)), dst);
 }
 
 void JIT::emitPutVariableObjectRegister(RegisterID src, RegisterID variableObject, int index)
 {
-    loadPtr(Address(variableObject, FIELD_OFFSET(JSVariableObject, d)), variableObject);
-    loadPtr(Address(variableObject, FIELD_OFFSET(JSVariableObject::JSVariableObjectData, registers)), variableObject);
+    loadPtr(Address(variableObject, OBJECT_OFFSETOF(JSVariableObject, d)), variableObject);
+    loadPtr(Address(variableObject, OBJECT_OFFSETOF(JSVariableObject::JSVariableObjectData, registers)), variableObject);
     storePtr(src, Address(variableObject, index * sizeof(Register)));
 }
 
+void JIT::unlinkCall(CallLinkInfo* callLinkInfo)
+{
+    // When the JSFunction is deleted the pointer embedded in the instruction stream will no longer be valid
+    // (and, if a new JSFunction happened to be constructed at the same location, we could get a false positive
+    // match).  Reset the check so it no longer matches.
+    RepatchBuffer repatchBuffer;
+    repatchBuffer.repatch(callLinkInfo->hotPathBegin, JSValue::encode(JSValue()));
+}
+
+void JIT::linkCall(JSFunction* callee, CodeBlock* calleeCodeBlock, JITCode& code, CallLinkInfo* callLinkInfo, int callerArgCount, JSGlobalData* globalData)
+{
+    ASSERT(calleeCodeBlock);
+    RepatchBuffer repatchBuffer;
+
+    // Currently we only link calls with the exact number of arguments.
+    // If this is a native call calleeCodeBlock is null so the number of parameters is unimportant
+    if (callerArgCount == calleeCodeBlock->m_numParameters || calleeCodeBlock->codeType() == NativeCode) {
+        ASSERT(!callLinkInfo->isLinked());
+    
+        if (calleeCodeBlock)
+            calleeCodeBlock->addCaller(callLinkInfo);
+    
+        repatchBuffer.repatch(callLinkInfo->hotPathBegin, callee);
+        repatchBuffer.relink(callLinkInfo->hotPathOther, code.addressForCall());
+    }
+
+    // patch the call so we do not continue to try to link.
+    repatchBuffer.relink(callLinkInfo->callReturnLocation, globalData->jitStubs.ctiVirtualCall());
+}
+
 } // namespace JSC
 
 #endif // ENABLE(JIT)
+
+// This probably does not belong here; adding here for now as a quick Windows build fix.
+#if ENABLE(ASSEMBLER)
+
+#if PLATFORM(X86) && !PLATFORM(MAC)
+JSC::MacroAssemblerX86Common::SSE2CheckState JSC::MacroAssemblerX86Common::s_sse2CheckState = NotCheckedSSE2;
+#endif
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
index 931eb3b..db3f38a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JIT.h
@@ -28,61 +28,37 @@
 
 #include <wtf/Platform.h>
 
+// OBJECT_OFFSETOF: Like the C++ offsetof macro, but you can use it with classes.
+// The magic number 0x4000 is insignificant. We use it to avoid using NULL, since
+// NULL can cause compiler problems, especially in cases of multiple inheritance.
+#define OBJECT_OFFSETOF(class, field) (reinterpret_cast<ptrdiff_t>(&(reinterpret_cast<class*>(0x4000)->field)) - 0x4000)
+
 #if ENABLE(JIT)
 
-#define WTF_USE_CTI_REPATCH_PIC 1
+// We've run into some problems where changing the size of the class JIT leads to
+// performance fluctuations.  Try forcing alignment in an attempt to stabalize this.
+#if COMPILER(GCC)
+#define JIT_CLASS_ALIGNMENT __attribute__ ((aligned (32)))
+#else
+#define JIT_CLASS_ALIGNMENT
+#endif
 
+#include "CodeBlock.h"
 #include "Interpreter.h"
+#include "JITCode.h"
+#include "JITStubs.h"
 #include "Opcode.h"
 #include "RegisterFile.h"
 #include "MacroAssembler.h"
 #include "Profiler.h"
+#include <bytecode/SamplingTool.h>
 #include <wtf/AlwaysInline.h>
 #include <wtf/Vector.h>
 
-#define STUB_ARGS_offset 0x0C
-#define STUB_ARGS_code (STUB_ARGS_offset)
-#define STUB_ARGS_registerFile (STUB_ARGS_offset + 1)
-#define STUB_ARGS_callFrame (STUB_ARGS_offset + 2)
-#define STUB_ARGS_exception (STUB_ARGS_offset + 3)
-#define STUB_ARGS_profilerReference (STUB_ARGS_offset + 4)
-#define STUB_ARGS_globalData (STUB_ARGS_offset + 5)
-
-#define ARG_callFrame static_cast<CallFrame*>(ARGS[STUB_ARGS_callFrame])
-#define ARG_registerFile static_cast<RegisterFile*>(ARGS[STUB_ARGS_registerFile])
-#define ARG_exception static_cast<JSValuePtr*>(ARGS[STUB_ARGS_exception])
-#define ARG_profilerReference static_cast<Profiler**>(ARGS[STUB_ARGS_profilerReference])
-#define ARG_globalData static_cast<JSGlobalData*>(ARGS[STUB_ARGS_globalData])
-
-#define ARG_setCallFrame(newCallFrame) (ARGS[STUB_ARGS_callFrame] = (newCallFrame))
-
-#define ARG_src1 JSValuePtr::decode(static_cast<JSValueEncodedAsPointer*>(ARGS[1]))
-#define ARG_src2 JSValuePtr::decode(static_cast<JSValueEncodedAsPointer*>(ARGS[2]))
-#define ARG_src3 JSValuePtr::decode(static_cast<JSValueEncodedAsPointer*>(ARGS[3]))
-#define ARG_src4 JSValuePtr::decode(static_cast<JSValueEncodedAsPointer*>(ARGS[4]))
-#define ARG_src5 JSValuePtr::decode(static_cast<JSValueEncodedAsPointer*>(ARGS[5]))
-#define ARG_id1 static_cast<Identifier*>(ARGS[1])
-#define ARG_id2 static_cast<Identifier*>(ARGS[2])
-#define ARG_id3 static_cast<Identifier*>(ARGS[3])
-#define ARG_id4 static_cast<Identifier*>(ARGS[4])
-#define ARG_int1 static_cast<int32_t>(reinterpret_cast<intptr_t>(ARGS[1]))
-#define ARG_int2 static_cast<int32_t>(reinterpret_cast<intptr_t>(ARGS[2]))
-#define ARG_int3 static_cast<int32_t>(reinterpret_cast<intptr_t>(ARGS[3]))
-#define ARG_int4 static_cast<int32_t>(reinterpret_cast<intptr_t>(ARGS[4]))
-#define ARG_int5 static_cast<int32_t>(reinterpret_cast<intptr_t>(ARGS[5]))
-#define ARG_int6 static_cast<int32_t>(reinterpret_cast<intptr_t>(ARGS[6]))
-#define ARG_func1 static_cast<FuncDeclNode*>(ARGS[1])
-#define ARG_funcexp1 static_cast<FuncExprNode*>(ARGS[1])
-#define ARG_regexp1 static_cast<RegExp*>(ARGS[1])
-#define ARG_pni1 static_cast<JSPropertyNameIterator*>(ARGS[1])
-#define ARG_returnAddress2 static_cast<void*>(ARGS[2])
-#define ARG_codeBlock4 static_cast<CodeBlock*>(ARGS[4])
-
-#define STUB_RETURN_ADDRESS_SLOT (ARGS[-1])
-
 namespace JSC {
 
     class CodeBlock;
+    class JIT;
     class JSPropertyNameIterator;
     class Interpreter;
     class Register;
@@ -98,16 +74,8 @@ namespace JSC {
     struct PolymorphicAccessStructureList;
     struct StructureStubInfo;
 
-    typedef JSValueEncodedAsPointer* (JIT_STUB *CTIHelper_j)(STUB_ARGS);
-    typedef JSObject* (JIT_STUB *CTIHelper_o)(STUB_ARGS);
-    typedef JSPropertyNameIterator* (JIT_STUB *CTIHelper_p)(STUB_ARGS);
-    typedef void (JIT_STUB *CTIHelper_v)(STUB_ARGS);
-    typedef void* (JIT_STUB *CTIHelper_s)(STUB_ARGS);
-    typedef int (JIT_STUB *CTIHelper_b)(STUB_ARGS);
-    typedef VoidPtrPair (JIT_STUB *CTIHelper_2)(STUB_ARGS);
-
     struct CallRecord {
-        MacroAssembler::Jump from;
+        MacroAssembler::Call from;
         unsigned bytecodeIndex;
         void* to;
 
@@ -115,7 +83,7 @@ namespace JSC {
         {
         }
 
-        CallRecord(MacroAssembler::Jump from, unsigned bytecodeIndex, void* to = 0)
+        CallRecord(MacroAssembler::Call from, unsigned bytecodeIndex, void* to = 0)
             : from(from)
             , bytecodeIndex(bytecodeIndex)
             , to(to)
@@ -182,42 +150,106 @@ namespace JSC {
     };
 
     struct PropertyStubCompilationInfo {
-        MacroAssembler::Jump callReturnLocation;
+        MacroAssembler::Call callReturnLocation;
         MacroAssembler::Label hotPathBegin;
     };
 
     struct StructureStubCompilationInfo {
         MacroAssembler::DataLabelPtr hotPathBegin;
-        MacroAssembler::Jump hotPathOther;
-        MacroAssembler::Jump callReturnLocation;
-        MacroAssembler::Label coldPathOther;
+        MacroAssembler::Call hotPathOther;
+        MacroAssembler::Call callReturnLocation;
     };
 
-    extern "C" {
-        JSValueEncodedAsPointer* ctiTrampoline(
-#if PLATFORM(X86_64)
-            // FIXME: (bug #22910) this will force all arguments onto the stack (regparm(0) does not appear to have any effect).
-            // We can allow register passing here, and move the writes of these values into the trampoline.
-            void*, void*, void*, void*, void*, void*,
-#endif
-            void* code, RegisterFile*, CallFrame*, JSValuePtr* exception, Profiler**, JSGlobalData*);
-        void ctiVMThrowTrampoline();
+    struct MethodCallCompilationInfo {
+        MethodCallCompilationInfo(unsigned propertyAccessIndex)
+            : propertyAccessIndex(propertyAccessIndex)
+        {
+        }
+
+        MacroAssembler::DataLabelPtr structureToCompare;
+        unsigned propertyAccessIndex;
     };
 
-    void ctiSetReturnAddress(void** where, void* what);
-    void ctiPatchCallByReturnAddress(void* where, void* what);
+    // Near calls can only be patched to other JIT code, regular calls can be patched to JIT code or relinked to stub functions.
+    void ctiPatchNearCallByReturnAddress(ReturnAddressPtr returnAddress, MacroAssemblerCodePtr newCalleeFunction);
+    void ctiPatchCallByReturnAddress(ReturnAddressPtr returnAddress, MacroAssemblerCodePtr newCalleeFunction);
+    void ctiPatchCallByReturnAddress(ReturnAddressPtr returnAddress, FunctionPtr newCalleeFunction);
 
     class JIT : private MacroAssembler {
+        friend class JITStubCall;
+        friend class CallEvalJITStub;
+
         using MacroAssembler::Jump;
         using MacroAssembler::JumpList;
         using MacroAssembler::Label;
 
+        // NOTES:
+        //
+        // regT0 has two special meanings.  The return value from a stub
+        // call will always be in regT0, and by default (unless
+        // a register is specified) emitPutVirtualRegister() will store
+        // the value from regT0.
+        //
+        // regT3 is required to be callee-preserved.
+        //
+        // tempRegister2 is has no such dependencies.  It is important that
+        // on x86/x86-64 it is ecx for performance reasons, since the
+        // MacroAssembler will need to plant register swaps if it is not -
+        // however the code will still function correctly.
 #if PLATFORM(X86_64)
+        static const RegisterID returnValueRegister = X86::eax;
+        static const RegisterID cachedResultRegister = X86::eax;
+        static const RegisterID firstArgumentRegister = X86::edi;
+
         static const RegisterID timeoutCheckRegister = X86::r12;
         static const RegisterID callFrameRegister = X86::r13;
-#else
+        static const RegisterID tagTypeNumberRegister = X86::r14;
+        static const RegisterID tagMaskRegister = X86::r15;
+
+        static const RegisterID regT0 = X86::eax;
+        static const RegisterID regT1 = X86::edx;
+        static const RegisterID regT2 = X86::ecx;
+        static const RegisterID regT3 = X86::ebx;
+
+        static const FPRegisterID fpRegT0 = X86::xmm0;
+        static const FPRegisterID fpRegT1 = X86::xmm1;
+        static const FPRegisterID fpRegT2 = X86::xmm2;
+#elif PLATFORM(X86)
+        static const RegisterID returnValueRegister = X86::eax;
+        static const RegisterID cachedResultRegister = X86::eax;
+        // On x86 we always use fastcall conventions = but on
+        // OS X if might make more sense to just use regparm.
+        static const RegisterID firstArgumentRegister = X86::ecx;
+
         static const RegisterID timeoutCheckRegister = X86::esi;
         static const RegisterID callFrameRegister = X86::edi;
+
+        static const RegisterID regT0 = X86::eax;
+        static const RegisterID regT1 = X86::edx;
+        static const RegisterID regT2 = X86::ecx;
+        static const RegisterID regT3 = X86::ebx;
+
+        static const FPRegisterID fpRegT0 = X86::xmm0;
+        static const FPRegisterID fpRegT1 = X86::xmm1;
+        static const FPRegisterID fpRegT2 = X86::xmm2;
+#elif PLATFORM_ARM_ARCH(7)
+        static const RegisterID returnValueRegister = ARM::r0;
+        static const RegisterID cachedResultRegister = ARM::r0;
+        static const RegisterID firstArgumentRegister = ARM::r0;
+
+        static const RegisterID regT0 = ARM::r0;
+        static const RegisterID regT1 = ARM::r1;
+        static const RegisterID regT2 = ARM::r2;
+        static const RegisterID regT3 = ARM::r4;
+
+        static const RegisterID callFrameRegister = ARM::r5;
+        static const RegisterID timeoutCheckRegister = ARM::r6;
+
+        static const FPRegisterID fpRegT0 = ARM::d0;
+        static const FPRegisterID fpRegT1 = ARM::d1;
+        static const FPRegisterID fpRegT2 = ARM::d2;
+#else
+    #error "JIT not supported on this platform."
 #endif
 
         static const int patchGetByIdDefaultStructure = -1;
@@ -225,48 +257,79 @@ namespace JSC {
         // will compress the displacement, and we may not be able to fit a patched offset.
         static const int patchGetByIdDefaultOffset = 256;
 
-#if USE(JIT_STUB_ARGUMENT_REGISTER)
-#if PLATFORM(X86_64)
-        static const int ctiArgumentInitSize = 3;
-#else
-        static const int ctiArgumentInitSize = 2;
-#endif
-#elif USE(JIT_STUB_ARGUMENT_STACK)
-        static const int ctiArgumentInitSize = 4;
-#else // JIT_STUB_ARGUMENT_VA_LIST
-        static const int ctiArgumentInitSize = 0;
-#endif
-
 #if PLATFORM(X86_64)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 10;
+        static const int patchOffsetPutByIdExternalLoad = 20;
+        static const int patchLengthPutByIdExternalLoad = 4;
         static const int patchOffsetPutByIdPropertyMapOffset = 31;
         // These architecture specific value are used to enable patching - see comment on op_get_by_id.
         static const int patchOffsetGetByIdStructure = 10;
         static const int patchOffsetGetByIdBranchToSlowCase = 20;
+        static const int patchOffsetGetByIdExternalLoad = 20;
+        static const int patchLengthGetByIdExternalLoad = 4;
         static const int patchOffsetGetByIdPropertyMapOffset = 31;
         static const int patchOffsetGetByIdPutResult = 31;
 #if ENABLE(OPCODE_SAMPLING)
-        static const int patchOffsetGetByIdSlowCaseCall = 40 + ctiArgumentInitSize;
+        static const int patchOffsetGetByIdSlowCaseCall = 66;
 #else
-        static const int patchOffsetGetByIdSlowCaseCall = 30 + ctiArgumentInitSize;
+        static const int patchOffsetGetByIdSlowCaseCall = 44;
 #endif
         static const int patchOffsetOpCallCompareToJump = 9;
-#else
+
+        static const int patchOffsetMethodCheckProtoObj = 20;
+        static const int patchOffsetMethodCheckProtoStruct = 30;
+        static const int patchOffsetMethodCheckPutFunction = 50;
+#elif PLATFORM(X86)
         // These architecture specific value are used to enable patching - see comment on op_put_by_id.
         static const int patchOffsetPutByIdStructure = 7;
+        static const int patchOffsetPutByIdExternalLoad = 13;
+        static const int patchLengthPutByIdExternalLoad = 3;
         static const int patchOffsetPutByIdPropertyMapOffset = 22;
         // These architecture specific value are used to enable patching - see comment on op_get_by_id.
         static const int patchOffsetGetByIdStructure = 7;
         static const int patchOffsetGetByIdBranchToSlowCase = 13;
+        static const int patchOffsetGetByIdExternalLoad = 13;
+        static const int patchLengthGetByIdExternalLoad = 3;
         static const int patchOffsetGetByIdPropertyMapOffset = 22;
         static const int patchOffsetGetByIdPutResult = 22;
-#if ENABLE(OPCODE_SAMPLING)
-        static const int patchOffsetGetByIdSlowCaseCall = 31 + ctiArgumentInitSize;
+#if ENABLE(OPCODE_SAMPLING) && USE(JIT_STUB_ARGUMENT_VA_LIST)
+        static const int patchOffsetGetByIdSlowCaseCall = 31;
+#elif ENABLE(OPCODE_SAMPLING)
+        static const int patchOffsetGetByIdSlowCaseCall = 33;
+#elif USE(JIT_STUB_ARGUMENT_VA_LIST)
+        static const int patchOffsetGetByIdSlowCaseCall = 21;
 #else
-        static const int patchOffsetGetByIdSlowCaseCall = 21 + ctiArgumentInitSize;
+        static const int patchOffsetGetByIdSlowCaseCall = 23;
 #endif
         static const int patchOffsetOpCallCompareToJump = 6;
+
+        static const int patchOffsetMethodCheckProtoObj = 11;
+        static const int patchOffsetMethodCheckProtoStruct = 18;
+        static const int patchOffsetMethodCheckPutFunction = 29;
+#elif PLATFORM_ARM_ARCH(7)
+        // These architecture specific value are used to enable patching - see comment on op_put_by_id.
+        static const int patchOffsetPutByIdStructure = 10;
+        static const int patchOffsetPutByIdExternalLoad = 20;
+        static const int patchLengthPutByIdExternalLoad = 12;
+        static const int patchOffsetPutByIdPropertyMapOffset = 40;
+        // These architecture specific value are used to enable patching - see comment on op_get_by_id.
+        static const int patchOffsetGetByIdStructure = 10;
+        static const int patchOffsetGetByIdBranchToSlowCase = 20;
+        static const int patchOffsetGetByIdExternalLoad = 20;
+        static const int patchLengthGetByIdExternalLoad = 12;
+        static const int patchOffsetGetByIdPropertyMapOffset = 40;
+        static const int patchOffsetGetByIdPutResult = 44;
+#if ENABLE(OPCODE_SAMPLING)
+        static const int patchOffsetGetByIdSlowCaseCall = 0; // FIMXE
+#else
+        static const int patchOffsetGetByIdSlowCaseCall = 28;
+#endif
+        static const int patchOffsetOpCallCompareToJump = 10;
+
+        static const int patchOffsetMethodCheckProtoObj = 18;
+        static const int patchOffsetMethodCheckProtoStruct = 28;
+        static const int patchOffsetMethodCheckPutFunction = 46;
 #endif
 
     public:
@@ -276,19 +339,12 @@ namespace JSC {
             jit.privateCompile();
         }
 
-        static void compileGetByIdSelf(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, void* returnAddress)
-        {
-            JIT jit(globalData, codeBlock);
-            jit.privateCompileGetByIdSelf(stubInfo, structure, cachedOffset, returnAddress);
-        }
-
-        static void compileGetByIdProto(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, void* returnAddress)
+        static void compileGetByIdProto(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
             jit.privateCompileGetByIdProto(stubInfo, structure, prototypeStructure, cachedOffset, returnAddress, callFrame);
         }
 
-#if USE(CTI_REPATCH_PIC)
         static void compileGetByIdSelfList(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, size_t cachedOffset)
         {
             JIT jit(globalData, codeBlock);
@@ -304,118 +360,237 @@ namespace JSC {
             JIT jit(globalData, codeBlock);
             jit.privateCompileGetByIdChainList(stubInfo, prototypeStructureList, currentIndex, structure, chain, count, cachedOffset, callFrame);
         }
-#endif
 
-        static void compileGetByIdChain(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, void* returnAddress)
+        static void compileGetByIdChain(JSGlobalData* globalData, CallFrame* callFrame, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
             jit.privateCompileGetByIdChain(stubInfo, structure, chain, count, cachedOffset, returnAddress, callFrame);
         }
-
-        static void compilePutByIdReplace(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, void* returnAddress)
-        {
-            JIT jit(globalData, codeBlock);
-            jit.privateCompilePutByIdReplace(stubInfo, structure, cachedOffset, returnAddress);
-        }
         
-        static void compilePutByIdTransition(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, void* returnAddress)
+        static void compilePutByIdTransition(JSGlobalData* globalData, CodeBlock* codeBlock, StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
             jit.privateCompilePutByIdTransition(stubInfo, oldStructure, newStructure, cachedOffset, chain, returnAddress);
         }
 
-        static void compileCTIMachineTrampolines(JSGlobalData* globalData)
+        static void compileCTIMachineTrampolines(JSGlobalData* globalData, RefPtr<ExecutablePool>* executablePool, CodePtr* ctiArrayLengthTrampoline, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallPreLink, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)
         {
             JIT jit(globalData);
-            jit.privateCompileCTIMachineTrampolines();
+            jit.privateCompileCTIMachineTrampolines(executablePool, globalData, ctiArrayLengthTrampoline, ctiStringLengthTrampoline, ctiVirtualCallPreLink, ctiVirtualCallLink, ctiVirtualCall, ctiNativeCallThunk);
         }
 
-        static void patchGetByIdSelf(StructureStubInfo*, Structure*, size_t cachedOffset, void* returnAddress);
-        static void patchPutByIdReplace(StructureStubInfo*, Structure*, size_t cachedOffset, void* returnAddress);
+        static void patchGetByIdSelf(StructureStubInfo*, Structure*, size_t cachedOffset, ReturnAddressPtr returnAddress);
+        static void patchPutByIdReplace(StructureStubInfo*, Structure*, size_t cachedOffset, ReturnAddressPtr returnAddress);
+        static void patchMethodCallProto(MethodCallLinkInfo&, JSFunction*, Structure*, JSObject*);
 
-        static void compilePatchGetArrayLength(JSGlobalData* globalData, CodeBlock* codeBlock, void* returnAddress)
+        static void compilePatchGetArrayLength(JSGlobalData* globalData, CodeBlock* codeBlock, ReturnAddressPtr returnAddress)
         {
             JIT jit(globalData, codeBlock);
             return jit.privateCompilePatchGetArrayLength(returnAddress);
         }
 
-        static void linkCall(JSFunction* callee, CodeBlock* calleeCodeBlock, void* ctiCode, CallLinkInfo* callLinkInfo, int callerArgCount);
+        static void linkCall(JSFunction* callee, CodeBlock* calleeCodeBlock, JITCode&, CallLinkInfo*, int callerArgCount, JSGlobalData*);
         static void unlinkCall(CallLinkInfo*);
 
-        inline static JSValuePtr execute(void* code, RegisterFile* registerFile, CallFrame* callFrame, JSGlobalData* globalData, JSValuePtr* exception)
-        {
-            return JSValuePtr::decode(ctiTrampoline(
-#if PLATFORM(X86_64)
-                0, 0, 0, 0, 0, 0,
-#endif
-                code, registerFile, callFrame, exception, Profiler::enabledProfilerReference(), globalData));
-        }
-
     private:
+        struct JSRInfo {
+            DataLabelPtr storeLocation;
+            Label target;
+
+            JSRInfo(DataLabelPtr storeLocation, Label targetLocation)
+                : storeLocation(storeLocation)
+                , target(targetLocation)
+            {
+            }
+        };
+
         JIT(JSGlobalData*, CodeBlock* = 0);
 
         void privateCompileMainPass();
         void privateCompileLinkPass();
         void privateCompileSlowCases();
         void privateCompile();
-        void privateCompileGetByIdSelf(StructureStubInfo*, Structure*, size_t cachedOffset, void* returnAddress);
-        void privateCompileGetByIdProto(StructureStubInfo*, Structure*, Structure* prototypeStructure, size_t cachedOffset, void* returnAddress, CallFrame* callFrame);
-#if USE(CTI_REPATCH_PIC)
+        void privateCompileGetByIdProto(StructureStubInfo*, Structure*, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame);
         void privateCompileGetByIdSelfList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, size_t cachedOffset);
         void privateCompileGetByIdProtoList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, Structure* prototypeStructure, size_t cachedOffset, CallFrame* callFrame);
         void privateCompileGetByIdChainList(StructureStubInfo*, PolymorphicAccessStructureList*, int, Structure*, StructureChain* chain, size_t count, size_t cachedOffset, CallFrame* callFrame);
-#endif
-        void privateCompileGetByIdChain(StructureStubInfo*, Structure*, StructureChain*, size_t count, size_t cachedOffset, void* returnAddress, CallFrame* callFrame);
-        void privateCompilePutByIdReplace(StructureStubInfo*, Structure*, size_t cachedOffset, void* returnAddress);
-        void privateCompilePutByIdTransition(StructureStubInfo*, Structure*, Structure*, size_t cachedOffset, StructureChain*, void* returnAddress);
+        void privateCompileGetByIdChain(StructureStubInfo*, Structure*, StructureChain*, size_t count, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame);
+        void privateCompilePutByIdTransition(StructureStubInfo*, Structure*, Structure*, size_t cachedOffset, StructureChain*, ReturnAddressPtr returnAddress);
 
-        void privateCompileCTIMachineTrampolines();
-        void privateCompilePatchGetArrayLength(void* returnAddress);
+        void privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* data, CodePtr* ctiArrayLengthTrampoline, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallPreLink, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk);
+        void privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress);
 
         void addSlowCase(Jump);
         void addJump(Jump, int);
         void emitJumpSlowToHot(Jump, int);
 
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
         void compileGetByIdHotPath(int resultVReg, int baseVReg, Identifier* ident, unsigned propertyAccessInstructionIndex);
-        void compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, unsigned propertyAccessInstructionIndex);
-        void compilePutByIdHotPath(int baseVReg, Identifier* ident, int valueVReg, unsigned propertyAccessInstructionIndex);
-        void compilePutByIdSlowCase(int baseVReg, Identifier* ident, int valueVReg, Vector<SlowCaseEntry>::iterator& iter, unsigned propertyAccessInstructionIndex);
+        void compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, unsigned propertyAccessInstructionIndex, bool isMethodCheck = false);
+#endif
         void compileOpCall(OpcodeID, Instruction* instruction, unsigned callLinkInfoIndex);
+        void compileOpCallVarargs(Instruction* instruction);
         void compileOpCallInitializeCallFrame();
         void compileOpCallSetupArgs(Instruction*);
-        void compileOpCallEvalSetupArgs(Instruction*);
+        void compileOpCallVarargsSetupArgs(Instruction*);
         void compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>::iterator& iter, unsigned callLinkInfoIndex, OpcodeID opcodeID);
+        void compileOpCallVarargsSlowCase(Instruction* instruction, Vector<SlowCaseEntry>::iterator& iter);
         void compileOpConstructSetupArgs(Instruction*);
         enum CompileOpStrictEqType { OpStrictEq, OpNStrictEq };
         void compileOpStrictEq(Instruction* instruction, CompileOpStrictEqType type);
-        void putDoubleResultToJSNumberCellOrJSImmediate(X86Assembler::XMMRegisterID xmmSource, RegisterID jsNumberCell, unsigned dst, X86Assembler::JmpSrc* wroteJSNumberCell, X86Assembler::XMMRegisterID tempXmm, RegisterID tempReg1, RegisterID tempReg2);
-
-        void compileFastArith_op_add(Instruction*);
-        void compileFastArith_op_mul(Instruction*);
-        void compileFastArith_op_mod(unsigned result, unsigned op1, unsigned op2);
-        void compileFastArith_op_bitand(unsigned result, unsigned op1, unsigned op2);
-        void compileFastArith_op_lshift(unsigned result, unsigned op1, unsigned op2);
-        void compileFastArith_op_rshift(unsigned result, unsigned op1, unsigned op2);
-        void compileFastArith_op_pre_inc(unsigned srcDst);
-        void compileFastArith_op_pre_dec(unsigned srcDst);
-        void compileFastArith_op_post_inc(unsigned result, unsigned srcDst);
-        void compileFastArith_op_post_dec(unsigned result, unsigned srcDst);
-        void compileFastArithSlow_op_add(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_mul(Instruction*, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_mod(unsigned result, unsigned op1, unsigned op2, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_bitand(unsigned result, unsigned op1, unsigned op2, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_lshift(unsigned result, unsigned op1, unsigned op2, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_rshift(unsigned result, unsigned op1, unsigned op2, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_pre_inc(unsigned srcDst, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_pre_dec(unsigned srcDst, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_post_inc(unsigned result, unsigned srcDst, Vector<SlowCaseEntry>::iterator&);
-        void compileFastArithSlow_op_post_dec(unsigned result, unsigned srcDst, Vector<SlowCaseEntry>::iterator&);
+
+        void compileGetDirectOffset(RegisterID base, RegisterID result, Structure* structure, size_t cachedOffset);
+        void compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID result, size_t cachedOffset);
+        void compilePutDirectOffset(RegisterID base, RegisterID value, Structure* structure, size_t cachedOffset);
+
+        // Arithmetic Ops
+
+        void emit_op_add(Instruction*);
+        void emit_op_sub(Instruction*);
+        void emit_op_mul(Instruction*);
+        void emit_op_mod(Instruction*);
+        void emit_op_bitand(Instruction*);
+        void emit_op_lshift(Instruction*);
+        void emit_op_rshift(Instruction*);
+        void emit_op_jnless(Instruction*);
+        void emit_op_jnlesseq(Instruction*);
+        void emit_op_pre_inc(Instruction*);
+        void emit_op_pre_dec(Instruction*);
+        void emit_op_post_inc(Instruction*);
+        void emit_op_post_dec(Instruction*);
+        void emitSlow_op_add(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_sub(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_mul(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_mod(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_bitand(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_lshift(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_rshift(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jnless(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jnlesseq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_pre_inc(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_pre_dec(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_post_inc(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_post_dec(Instruction*, Vector<SlowCaseEntry>::iterator&);
+
+        void emit_op_get_by_val(Instruction*);
+        void emit_op_put_by_val(Instruction*);
+        void emit_op_put_by_index(Instruction*);
+        void emit_op_put_getter(Instruction*);
+        void emit_op_put_setter(Instruction*);
+        void emit_op_del_by_id(Instruction*);
+
+        void emit_op_mov(Instruction*);
+        void emit_op_end(Instruction*);
+        void emit_op_jmp(Instruction*);
+        void emit_op_loop(Instruction*);
+        void emit_op_loop_if_less(Instruction*);
+        void emit_op_loop_if_lesseq(Instruction*);
+        void emit_op_new_object(Instruction*);
+        void emit_op_put_by_id(Instruction*);
+        void emit_op_get_by_id(Instruction*);
+        void emit_op_instanceof(Instruction*);
+        void emit_op_new_func(Instruction*);
+        void emit_op_call(Instruction*);
+        void emit_op_call_eval(Instruction*);
+        void emit_op_method_check(Instruction*);
+        void emit_op_load_varargs(Instruction*);
+        void emit_op_call_varargs(Instruction*);
+        void emit_op_construct(Instruction*);
+        void emit_op_get_global_var(Instruction*);
+        void emit_op_put_global_var(Instruction*);
+        void emit_op_get_scoped_var(Instruction*);
+        void emit_op_put_scoped_var(Instruction*);
+        void emit_op_tear_off_activation(Instruction*);
+        void emit_op_tear_off_arguments(Instruction*);
+        void emit_op_ret(Instruction*);
+        void emit_op_new_array(Instruction*);
+        void emit_op_resolve(Instruction*);
+        void emit_op_construct_verify(Instruction*);
+        void emit_op_to_primitive(Instruction*);
+        void emit_op_strcat(Instruction*);
+        void emit_op_resolve_func(Instruction*);
+        void emit_op_loop_if_true(Instruction*);
+        void emit_op_resolve_base(Instruction*);
+        void emit_op_resolve_skip(Instruction*);
+        void emit_op_resolve_global(Instruction*);
+        void emit_op_not(Instruction*);
+        void emit_op_jfalse(Instruction*);
+        void emit_op_jeq_null(Instruction*);
+        void emit_op_jneq_null(Instruction*);
+        void emit_op_jneq_ptr(Instruction*);
+        void emit_op_unexpected_load(Instruction*);
+        void emit_op_jsr(Instruction*);
+        void emit_op_sret(Instruction*);
+        void emit_op_eq(Instruction*);
+        void emit_op_bitnot(Instruction*);
+        void emit_op_resolve_with_base(Instruction*);
+        void emit_op_new_func_exp(Instruction*);
+        void emit_op_jtrue(Instruction*);
+        void emit_op_neq(Instruction*);
+        void emit_op_bitxor(Instruction*);
+        void emit_op_new_regexp(Instruction*);
+        void emit_op_bitor(Instruction*);
+        void emit_op_throw(Instruction*);
+        void emit_op_next_pname(Instruction*);
+        void emit_op_push_scope(Instruction*);
+        void emit_op_pop_scope(Instruction*);
+        void emit_op_stricteq(Instruction*);
+        void emit_op_nstricteq(Instruction*);
+        void emit_op_to_jsnumber(Instruction*);
+        void emit_op_push_new_scope(Instruction*);
+        void emit_op_catch(Instruction*);
+        void emit_op_jmp_scopes(Instruction*);
+        void emit_op_switch_imm(Instruction*);
+        void emit_op_switch_char(Instruction*);
+        void emit_op_switch_string(Instruction*);
+        void emit_op_new_error(Instruction*);
+        void emit_op_debug(Instruction*);
+        void emit_op_eq_null(Instruction*);
+        void emit_op_neq_null(Instruction*);
+        void emit_op_enter(Instruction*);
+        void emit_op_enter_with_activation(Instruction*);
+        void emit_op_init_arguments(Instruction*);
+        void emit_op_create_arguments(Instruction*);
+        void emit_op_convert_this(Instruction*);
+        void emit_op_profile_will_call(Instruction*);
+        void emit_op_profile_did_call(Instruction*);
+
+        void emitSlow_op_convert_this(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_construct_verify(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_to_primitive(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_get_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_loop_if_less(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_put_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_get_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_loop_if_lesseq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_put_by_val(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_loop_if_true(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_not(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jfalse(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_bitnot(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_jtrue(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_bitxor(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_bitor(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_eq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_neq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_stricteq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_nstricteq(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_instanceof(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_call(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_call_eval(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_call_varargs(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_construct(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_to_jsnumber(Instruction*, Vector<SlowCaseEntry>::iterator&);
+
+#if ENABLE(JIT_OPTIMIZE_ARITHMETIC)
         void compileBinaryArithOp(OpcodeID, unsigned dst, unsigned src1, unsigned src2, OperandTypes opi);
         void compileBinaryArithOpSlowCase(OpcodeID, Vector<SlowCaseEntry>::iterator&, unsigned dst, unsigned src1, unsigned src2, OperandTypes opi);
+#endif
 
         void emitGetVirtualRegister(int src, RegisterID dst);
         void emitGetVirtualRegisters(int src1, RegisterID dst1, int src2, RegisterID dst2);
-        void emitPutVirtualRegister(unsigned dst, RegisterID from = X86::eax);
+        void emitPutVirtualRegister(unsigned dst, RegisterID from = regT0);
 
         void emitPutJITStubArg(RegisterID src, unsigned argumentNumber);
         void emitPutJITStubArgFromVirtualRegister(unsigned src, unsigned argumentNumber, RegisterID scratch);
@@ -425,23 +600,35 @@ namespace JSC {
 
         void emitInitRegister(unsigned dst);
 
-        void emitPutCTIParam(void* value, unsigned name);
-        void emitPutCTIParam(RegisterID from, unsigned name);
-        void emitGetCTIParam(unsigned name, RegisterID to);
-
         void emitPutToCallFrameHeader(RegisterID from, RegisterFile::CallFrameHeaderEntry entry);
         void emitPutImmediateToCallFrameHeader(void* value, RegisterFile::CallFrameHeaderEntry entry);
-        void emitGetFromCallFrameHeader(RegisterFile::CallFrameHeaderEntry entry, RegisterID to);
+        void emitGetFromCallFrameHeaderPtr(RegisterFile::CallFrameHeaderEntry entry, RegisterID to, RegisterID from = callFrameRegister);
+        void emitGetFromCallFrameHeader32(RegisterFile::CallFrameHeaderEntry entry, RegisterID to, RegisterID from = callFrameRegister);
 
-        JSValuePtr getConstantOperand(unsigned src);
+        JSValue getConstantOperand(unsigned src);
         int32_t getConstantOperandImmediateInt(unsigned src);
         bool isOperandConstantImmediateInt(unsigned src);
 
         Jump emitJumpIfJSCell(RegisterID);
+        Jump emitJumpIfBothJSCells(RegisterID, RegisterID, RegisterID);
         void emitJumpSlowCaseIfJSCell(RegisterID);
         Jump emitJumpIfNotJSCell(RegisterID);
         void emitJumpSlowCaseIfNotJSCell(RegisterID);
         void emitJumpSlowCaseIfNotJSCell(RegisterID, int VReg);
+#if USE(ALTERNATE_JSIMMEDIATE)
+        JIT::Jump emitJumpIfImmediateNumber(RegisterID);
+        JIT::Jump emitJumpIfNotImmediateNumber(RegisterID);
+#else
+        JIT::Jump emitJumpIfImmediateNumber(RegisterID reg)
+        {
+            return emitJumpIfImmediateInteger(reg);
+        }
+        
+        JIT::Jump emitJumpIfNotImmediateNumber(RegisterID reg)
+        {
+            return emitJumpIfNotImmediateInteger(reg);
+        }
+#endif
 
         Jump getSlowCase(Vector<SlowCaseEntry>::iterator& iter)
         {
@@ -454,9 +641,11 @@ namespace JSC {
         }
         void linkSlowCaseIfNotJSCell(Vector<SlowCaseEntry>::iterator&, int vReg);
 
-        JIT::Jump emitJumpIfImmNum(RegisterID);
-        void emitJumpSlowCaseIfNotImmNum(RegisterID);
-        void emitJumpSlowCaseIfNotImmNums(RegisterID, RegisterID, RegisterID);
+        JIT::Jump emitJumpIfImmediateInteger(RegisterID);
+        JIT::Jump emitJumpIfNotImmediateInteger(RegisterID);
+        JIT::Jump emitJumpIfNotImmediateIntegers(RegisterID, RegisterID, RegisterID);
+        void emitJumpSlowCaseIfNotImmediateInteger(RegisterID);
+        void emitJumpSlowCaseIfNotImmediateIntegers(RegisterID, RegisterID, RegisterID);
 
         Jump checkStructure(RegisterID reg, Structure* structure);
 
@@ -473,27 +662,41 @@ namespace JSC {
         void restoreArgumentReference();
         void restoreArgumentReferenceForTrampoline();
 
-        Jump emitNakedCall(RegisterID);
-        Jump emitNakedCall(void* function);
-        Jump emitCTICall_internal(void*);
-        Jump emitCTICall(CTIHelper_j helper) { return emitCTICall_internal(reinterpret_cast<void*>(helper)); }
-        Jump emitCTICall(CTIHelper_o helper) { return emitCTICall_internal(reinterpret_cast<void*>(helper)); }
-        Jump emitCTICall(CTIHelper_p helper) { return emitCTICall_internal(reinterpret_cast<void*>(helper)); }
-        Jump emitCTICall(CTIHelper_v helper) { return emitCTICall_internal(reinterpret_cast<void*>(helper)); }
-        Jump emitCTICall(CTIHelper_s helper) { return emitCTICall_internal(reinterpret_cast<void*>(helper)); }
-        Jump emitCTICall(CTIHelper_b helper) { return emitCTICall_internal(reinterpret_cast<void*>(helper)); }
-        Jump emitCTICall(CTIHelper_2 helper) { return emitCTICall_internal(reinterpret_cast<void*>(helper)); }
+        Call emitNakedCall(CodePtr function = CodePtr());
+        void preverveReturnAddressAfterCall(RegisterID);
+        void restoreReturnAddressBeforeReturn(RegisterID);
+        void restoreReturnAddressBeforeReturn(Address);
 
         void emitGetVariableObjectRegister(RegisterID variableObject, int index, RegisterID dst);
         void emitPutVariableObjectRegister(RegisterID src, RegisterID variableObject, int index);
         
-        void emitSlowScriptCheck();
+        void emitTimeoutCheck();
 #ifndef NDEBUG
         void printBytecodeOperandTypes(unsigned src1, unsigned src2);
 #endif
 
         void killLastResultRegister();
 
+
+#if ENABLE(SAMPLING_FLAGS)
+        void setSamplingFlag(int32_t);
+        void clearSamplingFlag(int32_t);
+#endif
+
+#if ENABLE(SAMPLING_COUNTERS)
+        void emitCount(AbstractSamplingCounter&, uint32_t = 1);
+#endif
+
+#if ENABLE(OPCODE_SAMPLING)
+        void sampleInstruction(Instruction*, bool = false);
+#endif
+
+#if ENABLE(CODEBLOCK_SAMPLING)
+        void sampleCodeBlock(CodeBlock*);
+#else
+        void sampleCodeBlock(CodeBlock*) {}
+#endif
+
         Interpreter* m_interpreter;
         JSGlobalData* m_globalData;
         CodeBlock* m_codeBlock;
@@ -502,19 +705,9 @@ namespace JSC {
         Vector<Label> m_labels;
         Vector<PropertyStubCompilationInfo> m_propertyAccessCompilationInfo;
         Vector<StructureStubCompilationInfo> m_callStructureStubCompilationInfo;
+        Vector<MethodCallCompilationInfo> m_methodCallCompilationInfo;
         Vector<JumpTable> m_jmpTable;
 
-        struct JSRInfo {
-            DataLabelPtr storeLocation;
-            Label target;
-
-            JSRInfo(DataLabelPtr storeLocation, Label targetLocation)
-                : storeLocation(storeLocation)
-                , target(targetLocation)
-            {
-            }
-        };
-
         unsigned m_bytecodeIndex;
         Vector<JSRInfo> m_jsrSites;
         Vector<SlowCaseEntry> m_slowCases;
@@ -522,7 +715,12 @@ namespace JSC {
 
         int m_lastResultBytecodeRegister;
         unsigned m_jumpTargetsPosition;
-    };
+
+        unsigned m_propertyAccessInstructionIndex;
+        unsigned m_globalResolveInfoIndex;
+        unsigned m_callLinkInfoIndex;
+    } JIT_CLASS_ALIGNMENT;
+
 }
 
 #endif // ENABLE(JIT)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
index f95bab8..15808e2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITArithmetic.cpp
@@ -30,6 +30,7 @@
 
 #include "CodeBlock.h"
 #include "JITInlineMethods.h"
+#include "JITStubCall.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "Interpreter.h"
@@ -40,35 +41,43 @@
 #include <stdio.h>
 #endif
 
-#define __ m_assembler.
 
 using namespace std;
 
 namespace JSC {
 
-void JIT::compileFastArith_op_lshift(unsigned result, unsigned op1, unsigned op2)
+void JIT::emit_op_lshift(Instruction* currentInstruction)
 {
-    emitGetVirtualRegisters(op1, X86::eax, op2, X86::ecx);
-    // FIXME: would we be better using 'emitJumpSlowCaseIfNotImmNums'? - we *probably* ought to be consistent.
-    emitJumpSlowCaseIfNotImmNum(X86::eax);
-    emitJumpSlowCaseIfNotImmNum(X86::ecx);
-    emitFastArithImmToInt(X86::eax);
-    emitFastArithImmToInt(X86::ecx);
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    emitGetVirtualRegisters(op1, regT0, op2, regT2);
+    // FIXME: would we be better using 'emitJumpSlowCaseIfNotImmediateIntegers'? - we *probably* ought to be consistent.
+    emitJumpSlowCaseIfNotImmediateInteger(regT0);
+    emitJumpSlowCaseIfNotImmediateInteger(regT2);
+    emitFastArithImmToInt(regT0);
+    emitFastArithImmToInt(regT2);
 #if !PLATFORM(X86)
     // Mask with 0x1f as per ecma-262 11.7.2 step 7.
     // On 32-bit x86 this is not necessary, since the shift anount is implicitly masked in the instruction.
-    and32(Imm32(0x1f), X86::ecx);
+    and32(Imm32(0x1f), regT2);
 #endif
-    lshift32(X86::ecx, X86::eax);
+    lshift32(regT2, regT0);
 #if !USE(ALTERNATE_JSIMMEDIATE)
-    addSlowCase(joAdd32(X86::eax, X86::eax));
-    signExtend32ToPtr(X86::eax, X86::eax);
+    addSlowCase(branchAdd32(Overflow, regT0, regT0));
+    signExtend32ToPtr(regT0, regT0);
 #endif
-    emitFastArithReTagImmediate(X86::eax, X86::eax);
+    emitFastArithReTagImmediate(regT0, regT0);
     emitPutVirtualRegister(result);
 }
-void JIT::compileFastArithSlow_op_lshift(unsigned result, unsigned op1, unsigned op2, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_lshift(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
 #if USE(ALTERNATE_JSIMMEDIATE)
     UNUSED_PARAM(op1);
     UNUSED_PARAM(op2);
@@ -79,652 +88,1138 @@ void JIT::compileFastArithSlow_op_lshift(unsigned result, unsigned op1, unsigned
     Jump notImm1 = getSlowCase(iter);
     Jump notImm2 = getSlowCase(iter);
     linkSlowCase(iter);
-    emitGetVirtualRegisters(op1, X86::eax, op2, X86::ecx);
+    emitGetVirtualRegisters(op1, regT0, op2, regT2);
     notImm1.link(this);
     notImm2.link(this);
 #endif
-    emitPutJITStubArg(X86::eax, 1);
-    emitPutJITStubArg(X86::ecx, 2);
-    emitCTICall(Interpreter::cti_op_lshift);
-    emitPutVirtualRegister(result);
+    JITStubCall stubCall(this, JITStubs::cti_op_lshift);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT2);
+    stubCall.call(result);
 }
 
-void JIT::compileFastArith_op_rshift(unsigned result, unsigned op1, unsigned op2)
+void JIT::emit_op_rshift(Instruction* currentInstruction)
 {
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
     if (isOperandConstantImmediateInt(op2)) {
-        emitGetVirtualRegister(op1, X86::eax);
-        emitJumpSlowCaseIfNotImmNum(X86::eax);
+        // isOperandConstantImmediateInt(op2) => 1 SlowCase
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
         // Mask with 0x1f as per ecma-262 11.7.2 step 7.
 #if USE(ALTERNATE_JSIMMEDIATE)
-        rshift32(Imm32(JSImmediate::getTruncatedUInt32(getConstantOperand(op2)) & 0x1f), X86::eax);
+        rshift32(Imm32(getConstantOperandImmediateInt(op2) & 0x1f), regT0);
 #else
-        rshiftPtr(Imm32(JSImmediate::getTruncatedUInt32(getConstantOperand(op2)) & 0x1f), X86::eax);
+        rshiftPtr(Imm32(getConstantOperandImmediateInt(op2) & 0x1f), regT0);
 #endif
     } else {
-        emitGetVirtualRegisters(op1, X86::eax, op2, X86::ecx);
-        emitJumpSlowCaseIfNotImmNum(X86::eax);
-        emitJumpSlowCaseIfNotImmNum(X86::ecx);
-        emitFastArithImmToInt(X86::ecx);
+        emitGetVirtualRegisters(op1, regT0, op2, regT2);
+        if (supportsFloatingPointTruncate()) {
+            Jump lhsIsInt = emitJumpIfImmediateInteger(regT0);
+#if USE(ALTERNATE_JSIMMEDIATE)
+            // supportsFloatingPoint() && USE(ALTERNATE_JSIMMEDIATE) => 3 SlowCases
+            addSlowCase(emitJumpIfNotImmediateNumber(regT0));
+            addPtr(tagTypeNumberRegister, regT0);
+            movePtrToDouble(regT0, fpRegT0);
+            addSlowCase(branchTruncateDoubleToInt32(fpRegT0, regT0));
+#else
+            // supportsFloatingPoint() && !USE(ALTERNATE_JSIMMEDIATE) => 5 SlowCases (of which 1 IfNotJSCell)
+            emitJumpSlowCaseIfNotJSCell(regT0, op1);
+            addSlowCase(checkStructure(regT0, m_globalData->numberStructure.get()));
+            loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
+            addSlowCase(branchTruncateDoubleToInt32(fpRegT0, regT0));
+            addSlowCase(branchAdd32(Overflow, regT0, regT0));
+#endif
+            lhsIsInt.link(this);
+            emitJumpSlowCaseIfNotImmediateInteger(regT2);
+        } else {
+            // !supportsFloatingPoint() => 2 SlowCases
+            emitJumpSlowCaseIfNotImmediateInteger(regT0);
+            emitJumpSlowCaseIfNotImmediateInteger(regT2);
+        }
+        emitFastArithImmToInt(regT2);
 #if !PLATFORM(X86)
         // Mask with 0x1f as per ecma-262 11.7.2 step 7.
         // On 32-bit x86 this is not necessary, since the shift anount is implicitly masked in the instruction.
-        and32(Imm32(0x1f), X86::ecx);
+        and32(Imm32(0x1f), regT2);
 #endif
 #if USE(ALTERNATE_JSIMMEDIATE)
-        rshift32(X86::ecx, X86::eax);
+        rshift32(regT2, regT0);
 #else
-        rshiftPtr(X86::ecx, X86::eax);
+        rshiftPtr(regT2, regT0);
 #endif
     }
 #if USE(ALTERNATE_JSIMMEDIATE)
-    emitFastArithIntToImmNoCheck(X86::eax, X86::eax);
+    emitFastArithIntToImmNoCheck(regT0, regT0);
 #else
-    orPtr(Imm32(JSImmediate::TagTypeInteger), X86::eax);
+    orPtr(Imm32(JSImmediate::TagTypeNumber), regT0);
 #endif
     emitPutVirtualRegister(result);
 }
-void JIT::compileFastArithSlow_op_rshift(unsigned result, unsigned, unsigned op2, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_rshift(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    linkSlowCase(iter);
-    if (isOperandConstantImmediateInt(op2))
-        emitPutJITStubArgFromVirtualRegister(op2, 2, X86::ecx);
-    else {
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    JITStubCall stubCall(this, JITStubs::cti_op_rshift);
+
+    if (isOperandConstantImmediateInt(op2)) {
         linkSlowCase(iter);
-        emitPutJITStubArg(X86::ecx, 2);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(op2, regT2);
+    } else {
+        if (supportsFloatingPointTruncate()) {
+#if USE(ALTERNATE_JSIMMEDIATE)
+            linkSlowCase(iter);
+            linkSlowCase(iter);
+            linkSlowCase(iter);
+#else
+            linkSlowCaseIfNotJSCell(iter, op1);
+            linkSlowCase(iter);
+            linkSlowCase(iter);
+            linkSlowCase(iter);
+            linkSlowCase(iter);
+#endif
+            // We're reloading op1 to regT0 as we can no longer guarantee that
+            // we have not munged the operand.  It may have already been shifted
+            // correctly, but it still will not have been tagged.
+            stubCall.addArgument(op1, regT0);
+            stubCall.addArgument(regT2);
+        } else {
+            linkSlowCase(iter);
+            linkSlowCase(iter);
+            stubCall.addArgument(regT0);
+            stubCall.addArgument(regT2);
+        }
     }
 
-    emitPutJITStubArg(X86::eax, 1);
-    emitCTICall(Interpreter::cti_op_rshift);
-    emitPutVirtualRegister(result);
+    stubCall.call(result);
 }
 
-void JIT::compileFastArith_op_bitand(unsigned result, unsigned op1, unsigned op2)
+void JIT::emit_op_jnless(Instruction* currentInstruction)
 {
-    if (isOperandConstantImmediateInt(op1)) {
-        emitGetVirtualRegister(op2, X86::eax);
-        emitJumpSlowCaseIfNotImmNum(X86::eax);
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    // We generate inline code for the following cases in the fast path:
+    // - int immediate to constant int immediate
+    // - constant int immediate to int immediate
+    // - int immediate to int immediate
+
+    if (isOperandConstantImmediateInt(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
 #if USE(ALTERNATE_JSIMMEDIATE)
-        int32_t imm = JSImmediate::intValue(getConstantOperand(op1));
-        andPtr(Imm32(imm), X86::eax);
-        if (imm >= 0)
-            emitFastArithIntToImmNoCheck(X86::eax, X86::eax);
+        int32_t op2imm = getConstantOperandImmediateInt(op2);
 #else
-        andPtr(Imm32(static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)))), X86::eax);
+        int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
 #endif
-    } else if (isOperandConstantImmediateInt(op2)) {
-        emitGetVirtualRegister(op1, X86::eax);
-        emitJumpSlowCaseIfNotImmNum(X86::eax);
+        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(op2imm)), target + 3);
+    } else if (isOperandConstantImmediateInt(op1)) {
+        emitGetVirtualRegister(op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
 #if USE(ALTERNATE_JSIMMEDIATE)
-        int32_t imm = JSImmediate::intValue(getConstantOperand(op2));
-        andPtr(Imm32(imm), X86::eax);
-        if (imm >= 0)
-            emitFastArithIntToImmNoCheck(X86::eax, X86::eax);
+        int32_t op1imm = getConstantOperandImmediateInt(op1);
 #else
-        andPtr(Imm32(static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)))), X86::eax);
+        int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
 #endif
+        addJump(branch32(LessThanOrEqual, regT1, Imm32(op1imm)), target + 3);
     } else {
-        emitGetVirtualRegisters(op1, X86::eax, op2, X86::edx);
-        andPtr(X86::edx, X86::eax);
-        emitJumpSlowCaseIfNotImmNum(X86::eax);
+        emitGetVirtualRegisters(op1, regT0, op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
+
+        addJump(branch32(GreaterThanOrEqual, regT0, regT1), target + 3);
     }
-    emitPutVirtualRegister(result);
 }
-void JIT::compileFastArithSlow_op_bitand(unsigned result, unsigned op1, unsigned op2, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    linkSlowCase(iter);
-    if (isOperandConstantImmediateInt(op1)) {
-        emitPutJITStubArgFromVirtualRegister(op1, 1, X86::ecx);
-        emitPutJITStubArg(X86::eax, 2);
-    } else if (isOperandConstantImmediateInt(op2)) {
-        emitPutJITStubArg(X86::eax, 1);
-        emitPutJITStubArgFromVirtualRegister(op2, 2, X86::ecx);
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+
+    // We generate inline code for the following cases in the slow path:
+    // - floating-point number to constant int immediate
+    // - constant int immediate to floating-point number
+    // - floating-point number to floating-point number.
+
+    if (isOperandConstantImmediateInt(op2)) {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(ALTERNATE_JSIMMEDIATE)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
+            addPtr(tagTypeNumberRegister, regT0);
+            movePtrToDouble(regT0, fpRegT0);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1 = emitJumpIfNotJSCell(regT0);
+
+            Jump fail2 = checkStructure(regT0, m_globalData->numberStructure.get());
+            loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
+#endif
+            
+            int32_t op2imm = getConstantOperand(op2).getInt32Fast();;
+                    
+            move(Imm32(op2imm), regT1);
+            convertInt32ToDouble(regT1, fpRegT1);
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target + 3);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
+
+#if USE(ALTERNATE_JSIMMEDIATE)
+            fail1.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1.link(this);
+            fail2.link(this);
+#endif
+        }
+
+        JITStubCall stubCall(this, JITStubs::cti_op_jless);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+
+    } else if (isOperandConstantImmediateInt(op1)) {
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(ALTERNATE_JSIMMEDIATE)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT1);
+            addPtr(tagTypeNumberRegister, regT1);
+            movePtrToDouble(regT1, fpRegT1);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail1 = emitJumpIfNotJSCell(regT1);
+            
+            Jump fail2 = checkStructure(regT1, m_globalData->numberStructure.get());
+            loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
+#endif
+            
+            int32_t op1imm = getConstantOperand(op1).getInt32Fast();;
+                    
+            move(Imm32(op1imm), regT0);
+            convertInt32ToDouble(regT0, fpRegT0);
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target + 3);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
+
+#if USE(ALTERNATE_JSIMMEDIATE)
+            fail1.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail1.link(this);
+            fail2.link(this);
+#endif
+        }
+
+        JITStubCall stubCall(this, JITStubs::cti_op_jless);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+
     } else {
-        emitPutJITStubArgFromVirtualRegister(op1, 1, X86::ecx);
-        emitPutJITStubArg(X86::edx, 2);
-    }
-    emitCTICall(Interpreter::cti_op_bitand);
-    emitPutVirtualRegister(result);
-}
+        linkSlowCase(iter);
 
-void JIT::compileFastArith_op_mod(unsigned result, unsigned op1, unsigned op2)
-{
-    emitGetVirtualRegisters(op1, X86::eax, op2, X86::ecx);
-    emitJumpSlowCaseIfNotImmNum(X86::eax);
-    emitJumpSlowCaseIfNotImmNum(X86::ecx);
+        if (supportsFloatingPoint()) {
 #if USE(ALTERNATE_JSIMMEDIATE)
-    addSlowCase(jePtr(X86::ecx, ImmPtr(JSValuePtr::encode(JSImmediate::zeroImmediate()))));
-    mod32(X86::ecx, X86::eax, X86::edx);
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
+            Jump fail2 = emitJumpIfNotImmediateNumber(regT1);
+            Jump fail3 = emitJumpIfImmediateInteger(regT1);
+            addPtr(tagTypeNumberRegister, regT0);
+            addPtr(tagTypeNumberRegister, regT1);
+            movePtrToDouble(regT0, fpRegT0);
+            movePtrToDouble(regT1, fpRegT1);
 #else
-    emitFastArithDeTagImmediate(X86::eax);
-    addSlowCase(emitFastArithDeTagImmediateJumpIfZero(X86::ecx));
-    mod32(X86::ecx, X86::eax, X86::edx);
-    signExtend32ToPtr(X86::edx, X86::edx);
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1 = emitJumpIfNotJSCell(regT0);
+
+            Jump fail2;
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail2 = emitJumpIfNotJSCell(regT1);
+
+            Jump fail3 = checkStructure(regT0, m_globalData->numberStructure.get());
+            Jump fail4 = checkStructure(regT1, m_globalData->numberStructure.get());
+            loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
+            loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
 #endif
-    emitFastArithReTagImmediate(X86::edx, X86::eax);
-    emitPutVirtualRegister(result);
-}
-void JIT::compileFastArithSlow_op_mod(unsigned result, unsigned, unsigned, Vector<SlowCaseEntry>::iterator& iter)
-{
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqual, fpRegT1, fpRegT0), target + 3);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
+
 #if USE(ALTERNATE_JSIMMEDIATE)
-    linkSlowCase(iter);
-    linkSlowCase(iter);
-    linkSlowCase(iter);
+            fail1.link(this);
+            fail2.link(this);
+            fail3.link(this);
 #else
-    Jump notImm1 = getSlowCase(iter);
-    Jump notImm2 = getSlowCase(iter);
-    linkSlowCase(iter);
-    emitFastArithReTagImmediate(X86::eax, X86::eax);
-    emitFastArithReTagImmediate(X86::ecx, X86::ecx);
-    notImm1.link(this);
-    notImm2.link(this);
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1.link(this);
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail2.link(this);
+            fail3.link(this);
+            fail4.link(this);
 #endif
-    emitPutJITStubArg(X86::eax, 1);
-    emitPutJITStubArg(X86::ecx, 2);
-    emitCTICall(Interpreter::cti_op_mod);
-    emitPutVirtualRegister(result);
+        }
+
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, JITStubs::cti_op_jless);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+    }
 }
 
-void JIT::compileFastArith_op_add(Instruction* currentInstruction)
+void JIT::emit_op_jnlesseq(Instruction* currentInstruction)
 {
-    unsigned result = currentInstruction[1].u.operand;
-    unsigned op1 = currentInstruction[2].u.operand;
-    unsigned op2 = currentInstruction[3].u.operand;
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
 
-    if (isOperandConstantImmediateInt(op1)) {
-        emitGetVirtualRegister(op2, X86::eax);
-        emitJumpSlowCaseIfNotImmNum(X86::eax);
+    // We generate inline code for the following cases in the fast path:
+    // - int immediate to constant int immediate
+    // - constant int immediate to int immediate
+    // - int immediate to int immediate
+
+    if (isOperandConstantImmediateInt(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
 #if USE(ALTERNATE_JSIMMEDIATE)
-        // FIXME: investigate performing a 31-bit add here (can we preserve upper bit & detect overflow from low word to high?)
-        //        (or, detect carry? - if const is positive, will only carry when overflowing from negative to positive?)
-        addSlowCase(joAdd32(Imm32(getConstantOperandImmediateInt(op1)), X86::eax));
-        emitFastArithIntToImmNoCheck(X86::eax, X86::eax);
+        int32_t op2imm = getConstantOperandImmediateInt(op2);
 #else
-        addSlowCase(joAdd32(Imm32(getConstantOperandImmediateInt(op1) << JSImmediate::IntegerPayloadShift), X86::eax));
-        signExtend32ToPtr(X86::eax, X86::eax);
+        int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
 #endif
-        emitPutVirtualRegister(result);
-    } else if (isOperandConstantImmediateInt(op2)) {
-        emitGetVirtualRegister(op1, X86::eax);
-        emitJumpSlowCaseIfNotImmNum(X86::eax);
+        addJump(branch32(GreaterThan, regT0, Imm32(op2imm)), target + 3);
+    } else if (isOperandConstantImmediateInt(op1)) {
+        emitGetVirtualRegister(op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
 #if USE(ALTERNATE_JSIMMEDIATE)
-        emitFastArithImmToInt(X86::eax);
-        addSlowCase(joAdd32(Imm32(getConstantOperandImmediateInt(op2)), X86::eax));
-        emitFastArithIntToImmNoCheck(X86::eax, X86::eax);
+        int32_t op1imm = getConstantOperandImmediateInt(op1);
 #else
-        addSlowCase(joAdd32(Imm32(getConstantOperandImmediateInt(op2) << JSImmediate::IntegerPayloadShift), X86::eax));
-        signExtend32ToPtr(X86::eax, X86::eax);
+        int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
 #endif
-        emitPutVirtualRegister(result);
+        addJump(branch32(LessThan, regT1, Imm32(op1imm)), target + 3);
     } else {
-        OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
-        if (types.first().mightBeNumber() && types.second().mightBeNumber())
-            compileBinaryArithOp(op_add, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
-        else {
-            emitPutJITStubArgFromVirtualRegister(op1, 1, X86::ecx);
-            emitPutJITStubArgFromVirtualRegister(op2, 2, X86::ecx);
-            emitCTICall(Interpreter::cti_op_add);
-            emitPutVirtualRegister(result);
-        }
+        emitGetVirtualRegisters(op1, regT0, op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
+
+        addJump(branch32(GreaterThan, regT0, regT1), target + 3);
     }
 }
-void JIT::compileFastArithSlow_op_add(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_jnlesseq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    unsigned result = currentInstruction[1].u.operand;
-    unsigned op1 = currentInstruction[2].u.operand;
-    unsigned op2 = currentInstruction[3].u.operand;
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
 
-    if (isOperandConstantImmediateInt(op1)) {
-#if USE(ALTERNATE_JSIMMEDIATE)
-        linkSlowCase(iter);
+    // We generate inline code for the following cases in the slow path:
+    // - floating-point number to constant int immediate
+    // - constant int immediate to floating-point number
+    // - floating-point number to floating-point number.
+
+    if (isOperandConstantImmediateInt(op2)) {
         linkSlowCase(iter);
-        emitPutJITStubArgFromVirtualRegister(op1, 1, X86::ecx);
-        emitPutJITStubArgFromVirtualRegister(op2, 2, X86::ecx);
+
+        if (supportsFloatingPoint()) {
+#if USE(ALTERNATE_JSIMMEDIATE)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
+            addPtr(tagTypeNumberRegister, regT0);
+            movePtrToDouble(regT0, fpRegT0);
 #else
-        Jump notImm = getSlowCase(iter);
-        linkSlowCase(iter);
-        sub32(Imm32(getConstantOperandImmediateInt(op1) << JSImmediate::IntegerPayloadShift), X86::eax);
-        notImm.link(this);
-        emitPutJITStubArgFromVirtualRegister(op1, 1, X86::ecx);
-        emitPutJITStubArg(X86::eax, 2);
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1 = emitJumpIfNotJSCell(regT0);
+
+            Jump fail2 = checkStructure(regT0, m_globalData->numberStructure.get());
+            loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
 #endif
-        emitCTICall(Interpreter::cti_op_add);
-        emitPutVirtualRegister(result);
-    } else if (isOperandConstantImmediateInt(op2)) {
+            
+            int32_t op2imm = getConstantOperand(op2).getInt32Fast();;
+                    
+            move(Imm32(op2imm), regT1);
+            convertInt32ToDouble(regT1, fpRegT1);
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target + 3);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
+
 #if USE(ALTERNATE_JSIMMEDIATE)
-        linkSlowCase(iter);
-        linkSlowCase(iter);
-        emitPutJITStubArgFromVirtualRegister(op1, 1, X86::ecx);
-        emitPutJITStubArgFromVirtualRegister(op2, 2, X86::ecx);
+            fail1.link(this);
 #else
-        Jump notImm = getSlowCase(iter);
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1.link(this);
+            fail2.link(this);
+#endif
+        }
+
+        JITStubCall stubCall(this, JITStubs::cti_op_jlesseq);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+
+    } else if (isOperandConstantImmediateInt(op1)) {
         linkSlowCase(iter);
-        sub32(Imm32(getConstantOperandImmediateInt(op2) << JSImmediate::IntegerPayloadShift), X86::eax);
-        notImm.link(this);
-        emitPutJITStubArg(X86::eax, 1);
-        emitPutJITStubArgFromVirtualRegister(op2, 2, X86::ecx);
+
+        if (supportsFloatingPoint()) {
+#if USE(ALTERNATE_JSIMMEDIATE)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT1);
+            addPtr(tagTypeNumberRegister, regT1);
+            movePtrToDouble(regT1, fpRegT1);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail1 = emitJumpIfNotJSCell(regT1);
+            
+            Jump fail2 = checkStructure(regT1, m_globalData->numberStructure.get());
+            loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
 #endif
-        emitCTICall(Interpreter::cti_op_add);
-        emitPutVirtualRegister(result);
+            
+            int32_t op1imm = getConstantOperand(op1).getInt32Fast();;
+                    
+            move(Imm32(op1imm), regT0);
+            convertInt32ToDouble(regT0, fpRegT0);
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target + 3);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
+
+#if USE(ALTERNATE_JSIMMEDIATE)
+            fail1.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail1.link(this);
+            fail2.link(this);
+#endif
+        }
+
+        JITStubCall stubCall(this, JITStubs::cti_op_jlesseq);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
+
     } else {
-        OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
-        ASSERT(types.first().mightBeNumber() && types.second().mightBeNumber());
-        compileBinaryArithOpSlowCase(op_add, iter, result, op1, op2, types);
+        linkSlowCase(iter);
+
+        if (supportsFloatingPoint()) {
+#if USE(ALTERNATE_JSIMMEDIATE)
+            Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
+            Jump fail2 = emitJumpIfNotImmediateNumber(regT1);
+            Jump fail3 = emitJumpIfImmediateInteger(regT1);
+            addPtr(tagTypeNumberRegister, regT0);
+            addPtr(tagTypeNumberRegister, regT1);
+            movePtrToDouble(regT0, fpRegT0);
+            movePtrToDouble(regT1, fpRegT1);
+#else
+            Jump fail1;
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1 = emitJumpIfNotJSCell(regT0);
+
+            Jump fail2;
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail2 = emitJumpIfNotJSCell(regT1);
+
+            Jump fail3 = checkStructure(regT0, m_globalData->numberStructure.get());
+            Jump fail4 = checkStructure(regT1, m_globalData->numberStructure.get());
+            loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
+            loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
+#endif
+
+            emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT1, fpRegT0), target + 3);
+
+            emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
+
+#if USE(ALTERNATE_JSIMMEDIATE)
+            fail1.link(this);
+            fail2.link(this);
+            fail3.link(this);
+#else
+            if (!m_codeBlock->isKnownNotImmediate(op1))
+                fail1.link(this);
+            if (!m_codeBlock->isKnownNotImmediate(op2))
+                fail2.link(this);
+            fail3.link(this);
+            fail4.link(this);
+#endif
+        }
+
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, JITStubs::cti_op_jlesseq);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(Zero, regT0), target + 3);
     }
 }
 
-void JIT::compileFastArith_op_mul(Instruction* currentInstruction)
+void JIT::emit_op_bitand(Instruction* currentInstruction)
 {
     unsigned result = currentInstruction[1].u.operand;
     unsigned op1 = currentInstruction[2].u.operand;
     unsigned op2 = currentInstruction[3].u.operand;
 
-    // For now, only plant a fast int case if the constant operand is greater than zero.
-    int32_t value;
-    if (isOperandConstantImmediateInt(op1) && ((value = getConstantOperandImmediateInt(op1)) > 0)) {
-        emitGetVirtualRegister(op2, X86::eax);
-        emitJumpSlowCaseIfNotImmNum(X86::eax);
+    if (isOperandConstantImmediateInt(op1)) {
+        emitGetVirtualRegister(op2, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
 #if USE(ALTERNATE_JSIMMEDIATE)
-        addSlowCase(joMul32(Imm32(value), X86::eax, X86::eax));
+        int32_t imm = getConstantOperandImmediateInt(op1);
+        andPtr(Imm32(imm), regT0);
+        if (imm >= 0)
+            emitFastArithIntToImmNoCheck(regT0, regT0);
 #else
-        emitFastArithDeTagImmediate(X86::eax);
-        addSlowCase(joMul32(Imm32(value), X86::eax, X86::eax));
-        signExtend32ToPtr(X86::eax, X86::eax);
+        andPtr(Imm32(static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)))), regT0);
 #endif
-        emitFastArithReTagImmediate(X86::eax, X86::eax);
-        emitPutVirtualRegister(result);
-    } else if (isOperandConstantImmediateInt(op2) && ((value = getConstantOperandImmediateInt(op2)) > 0)) {
-        emitGetVirtualRegister(op1, X86::eax);
-        emitJumpSlowCaseIfNotImmNum(X86::eax);
+    } else if (isOperandConstantImmediateInt(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
 #if USE(ALTERNATE_JSIMMEDIATE)
-        addSlowCase(joMul32(Imm32(value), X86::eax, X86::eax));
+        int32_t imm = getConstantOperandImmediateInt(op2);
+        andPtr(Imm32(imm), regT0);
+        if (imm >= 0)
+            emitFastArithIntToImmNoCheck(regT0, regT0);
 #else
-        emitFastArithDeTagImmediate(X86::eax);
-        addSlowCase(joMul32(Imm32(value), X86::eax, X86::eax));
-        signExtend32ToPtr(X86::eax, X86::eax);
+        andPtr(Imm32(static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)))), regT0);
 #endif
-        emitFastArithReTagImmediate(X86::eax, X86::eax);
-        emitPutVirtualRegister(result);
-    } else
-        compileBinaryArithOp(op_mul, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
+    } else {
+        emitGetVirtualRegisters(op1, regT0, op2, regT1);
+        andPtr(regT1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+    }
+    emitPutVirtualRegister(result);
 }
-void JIT::compileFastArithSlow_op_mul(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_bitand(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    int result = currentInstruction[1].u.operand;
-    int op1 = currentInstruction[2].u.operand;
-    int op2 = currentInstruction[3].u.operand;
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
 
-    if ((isOperandConstantImmediateInt(op1) && (getConstantOperandImmediateInt(op1) > 0))
-        || (isOperandConstantImmediateInt(op2) && (getConstantOperandImmediateInt(op2) > 0))) {
-        linkSlowCase(iter);
-        linkSlowCase(iter);
-        // There is an extra slow case for (op1 * -N) or (-N * op2), to check for 0 since this should produce a result of -0.
-        emitPutJITStubArgFromVirtualRegister(op1, 1, X86::ecx);
-        emitPutJITStubArgFromVirtualRegister(op2, 2, X86::ecx);
-        emitCTICall(Interpreter::cti_op_mul);
-        emitPutVirtualRegister(result);
-    } else
-        compileBinaryArithOpSlowCase(op_mul, iter, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
+    linkSlowCase(iter);
+    if (isOperandConstantImmediateInt(op1)) {
+        JITStubCall stubCall(this, JITStubs::cti_op_bitand);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(regT0);
+        stubCall.call(result);
+    } else if (isOperandConstantImmediateInt(op2)) {
+        JITStubCall stubCall(this, JITStubs::cti_op_bitand);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call(result);
+    } else {
+        JITStubCall stubCall(this, JITStubs::cti_op_bitand);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(regT1);
+        stubCall.call(result);
+    }
 }
 
-void JIT::compileFastArith_op_post_inc(unsigned result, unsigned srcDst)
+void JIT::emit_op_post_inc(Instruction* currentInstruction)
 {
-    emitGetVirtualRegister(srcDst, X86::eax);
-    move(X86::eax, X86::edx);
-    emitJumpSlowCaseIfNotImmNum(X86::eax);
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned srcDst = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(srcDst, regT0);
+    move(regT0, regT1);
+    emitJumpSlowCaseIfNotImmediateInteger(regT0);
 #if USE(ALTERNATE_JSIMMEDIATE)
-    addSlowCase(joAdd32(Imm32(1), X86::edx));
-    emitFastArithIntToImmNoCheck(X86::edx, X86::edx);
+    addSlowCase(branchAdd32(Overflow, Imm32(1), regT1));
+    emitFastArithIntToImmNoCheck(regT1, regT1);
 #else
-    addSlowCase(joAdd32(Imm32(1 << JSImmediate::IntegerPayloadShift), X86::edx));
-    signExtend32ToPtr(X86::edx, X86::edx);
+    addSlowCase(branchAdd32(Overflow, Imm32(1 << JSImmediate::IntegerPayloadShift), regT1));
+    signExtend32ToPtr(regT1, regT1);
 #endif
-    emitPutVirtualRegister(srcDst, X86::edx);
+    emitPutVirtualRegister(srcDst, regT1);
     emitPutVirtualRegister(result);
 }
-void JIT::compileFastArithSlow_op_post_inc(unsigned result, unsigned srcDst, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_post_inc(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned srcDst = currentInstruction[2].u.operand;
+
     linkSlowCase(iter);
     linkSlowCase(iter);
-    emitPutJITStubArg(X86::eax, 1);
-    emitCTICall(Interpreter::cti_op_post_inc);
-    emitPutVirtualRegister(srcDst, X86::edx);
-    emitPutVirtualRegister(result);
+    JITStubCall stubCall(this, JITStubs::cti_op_post_inc);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(Imm32(srcDst));
+    stubCall.call(result);
 }
 
-void JIT::compileFastArith_op_post_dec(unsigned result, unsigned srcDst)
+void JIT::emit_op_post_dec(Instruction* currentInstruction)
 {
-    emitGetVirtualRegister(srcDst, X86::eax);
-    move(X86::eax, X86::edx);
-    emitJumpSlowCaseIfNotImmNum(X86::eax);
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned srcDst = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(srcDst, regT0);
+    move(regT0, regT1);
+    emitJumpSlowCaseIfNotImmediateInteger(regT0);
 #if USE(ALTERNATE_JSIMMEDIATE)
-    addSlowCase(joSub32(Imm32(1), X86::edx));
-    emitFastArithIntToImmNoCheck(X86::edx, X86::edx);
+    addSlowCase(branchSub32(Zero, Imm32(1), regT1));
+    emitFastArithIntToImmNoCheck(regT1, regT1);
 #else
-    addSlowCase(joSub32(Imm32(1 << JSImmediate::IntegerPayloadShift), X86::edx));
-    signExtend32ToPtr(X86::edx, X86::edx);
+    addSlowCase(branchSub32(Zero, Imm32(1 << JSImmediate::IntegerPayloadShift), regT1));
+    signExtend32ToPtr(regT1, regT1);
 #endif
-    emitPutVirtualRegister(srcDst, X86::edx);
+    emitPutVirtualRegister(srcDst, regT1);
     emitPutVirtualRegister(result);
 }
-void JIT::compileFastArithSlow_op_post_dec(unsigned result, unsigned srcDst, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_post_dec(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned srcDst = currentInstruction[2].u.operand;
+
     linkSlowCase(iter);
     linkSlowCase(iter);
-    emitPutJITStubArg(X86::eax, 1);
-    emitCTICall(Interpreter::cti_op_post_dec);
-    emitPutVirtualRegister(srcDst, X86::edx);
-    emitPutVirtualRegister(result);
+    JITStubCall stubCall(this, JITStubs::cti_op_post_dec);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(Imm32(srcDst));
+    stubCall.call(result);
 }
 
-void JIT::compileFastArith_op_pre_inc(unsigned srcDst)
+void JIT::emit_op_pre_inc(Instruction* currentInstruction)
 {
-    emitGetVirtualRegister(srcDst, X86::eax);
-    emitJumpSlowCaseIfNotImmNum(X86::eax);
+    unsigned srcDst = currentInstruction[1].u.operand;
+
+    emitGetVirtualRegister(srcDst, regT0);
+    emitJumpSlowCaseIfNotImmediateInteger(regT0);
 #if USE(ALTERNATE_JSIMMEDIATE)
-    // FIXME: Could add ptr & specify int64; no need to re-sign-extend?
-    addSlowCase(joAdd32(Imm32(1), X86::eax));
-    emitFastArithIntToImmNoCheck(X86::eax, X86::eax);
+    addSlowCase(branchAdd32(Overflow, Imm32(1), regT0));
+    emitFastArithIntToImmNoCheck(regT0, regT0);
 #else
-    addSlowCase(joAdd32(Imm32(1 << JSImmediate::IntegerPayloadShift), X86::eax));
-    signExtend32ToPtr(X86::eax, X86::eax);
+    addSlowCase(branchAdd32(Overflow, Imm32(1 << JSImmediate::IntegerPayloadShift), regT0));
+    signExtend32ToPtr(regT0, regT0);
 #endif
     emitPutVirtualRegister(srcDst);
 }
-void JIT::compileFastArithSlow_op_pre_inc(unsigned srcDst, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_pre_inc(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+    unsigned srcDst = currentInstruction[1].u.operand;
+
     Jump notImm = getSlowCase(iter);
     linkSlowCase(iter);
-    emitGetVirtualRegister(srcDst, X86::eax);
+    emitGetVirtualRegister(srcDst, regT0);
     notImm.link(this);
-    emitPutJITStubArg(X86::eax, 1);
-    emitCTICall(Interpreter::cti_op_pre_inc);
-    emitPutVirtualRegister(srcDst);
+    JITStubCall stubCall(this, JITStubs::cti_op_pre_inc);
+    stubCall.addArgument(regT0);
+    stubCall.call(srcDst);
 }
 
-void JIT::compileFastArith_op_pre_dec(unsigned srcDst)
+void JIT::emit_op_pre_dec(Instruction* currentInstruction)
 {
-    emitGetVirtualRegister(srcDst, X86::eax);
-    emitJumpSlowCaseIfNotImmNum(X86::eax);
+    unsigned srcDst = currentInstruction[1].u.operand;
+
+    emitGetVirtualRegister(srcDst, regT0);
+    emitJumpSlowCaseIfNotImmediateInteger(regT0);
 #if USE(ALTERNATE_JSIMMEDIATE)
-    addSlowCase(joSub32(Imm32(1), X86::eax));
-    emitFastArithIntToImmNoCheck(X86::eax, X86::eax);
+    addSlowCase(branchSub32(Zero, Imm32(1), regT0));
+    emitFastArithIntToImmNoCheck(regT0, regT0);
 #else
-    addSlowCase(joSub32(Imm32(1 << JSImmediate::IntegerPayloadShift), X86::eax));
-    signExtend32ToPtr(X86::eax, X86::eax);
+    addSlowCase(branchSub32(Zero, Imm32(1 << JSImmediate::IntegerPayloadShift), regT0));
+    signExtend32ToPtr(regT0, regT0);
 #endif
     emitPutVirtualRegister(srcDst);
 }
-void JIT::compileFastArithSlow_op_pre_dec(unsigned srcDst, Vector<SlowCaseEntry>::iterator& iter)
+
+void JIT::emitSlow_op_pre_dec(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+    unsigned srcDst = currentInstruction[1].u.operand;
+
     Jump notImm = getSlowCase(iter);
     linkSlowCase(iter);
-    emitGetVirtualRegister(srcDst, X86::eax);
+    emitGetVirtualRegister(srcDst, regT0);
     notImm.link(this);
-    emitPutJITStubArg(X86::eax, 1);
-    emitCTICall(Interpreter::cti_op_pre_dec);
-    emitPutVirtualRegister(srcDst);
+    JITStubCall stubCall(this, JITStubs::cti_op_pre_dec);
+    stubCall.addArgument(regT0);
+    stubCall.call(srcDst);
 }
 
+/* ------------------------------ BEGIN: OP_MOD ------------------------------ */
+
+#if PLATFORM(X86) || PLATFORM(X86_64)
+
+void JIT::emit_op_mod(Instruction* currentInstruction)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    emitGetVirtualRegisters(op1, X86::eax, op2, X86::ecx);
+    emitJumpSlowCaseIfNotImmediateInteger(X86::eax);
+    emitJumpSlowCaseIfNotImmediateInteger(X86::ecx);
+#if USE(ALTERNATE_JSIMMEDIATE)
+    addSlowCase(branchPtr(Equal, X86::ecx, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0)))));
+    m_assembler.cdq();
+    m_assembler.idivl_r(X86::ecx);
+#else
+    emitFastArithDeTagImmediate(X86::eax);
+    addSlowCase(emitFastArithDeTagImmediateJumpIfZero(X86::ecx));
+    m_assembler.cdq();
+    m_assembler.idivl_r(X86::ecx);
+    signExtend32ToPtr(X86::edx, X86::edx);
+#endif
+    emitFastArithReTagImmediate(X86::edx, X86::eax);
+    emitPutVirtualRegister(result);
+}
+
+void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned result = currentInstruction[1].u.operand;
+
+#if USE(ALTERNATE_JSIMMEDIATE)
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+#else
+    Jump notImm1 = getSlowCase(iter);
+    Jump notImm2 = getSlowCase(iter);
+    linkSlowCase(iter);
+    emitFastArithReTagImmediate(X86::eax, X86::eax);
+    emitFastArithReTagImmediate(X86::ecx, X86::ecx);
+    notImm1.link(this);
+    notImm2.link(this);
+#endif
+    JITStubCall stubCall(this, JITStubs::cti_op_mod);
+    stubCall.addArgument(X86::eax);
+    stubCall.addArgument(X86::ecx);
+    stubCall.call(result);
+}
+
+#else // PLATFORM(X86) || PLATFORM(X86_64)
+
+void JIT::emit_op_mod(Instruction* currentInstruction)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    JITStubCall stubCall(this, JITStubs::cti_op_mod);
+    stubCall.addArgument(op1, regT2);
+    stubCall.addArgument(op2, regT2);
+    stubCall.call(result);
+}
+
+void JIT::emitSlow_op_mod(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    ASSERT_NOT_REACHED();
+}
+
+#endif // PLATFORM(X86) || PLATFORM(X86_64)
+
+/* ------------------------------ END: OP_MOD ------------------------------ */
 
 #if !ENABLE(JIT_OPTIMIZE_ARITHMETIC)
 
-void JIT::compileBinaryArithOp(OpcodeID opcodeID, unsigned dst, unsigned src1, unsigned src2, OperandTypes)
+/* ------------------------------ BEGIN: !ENABLE(JIT_OPTIMIZE_ARITHMETIC) (OP_ADD, OP_SUB, OP_MUL) ------------------------------ */
+
+void JIT::emit_op_add(Instruction* currentInstruction)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    JITStubCall stubCall(this, JITStubs::cti_op_add);
+    stubCall.addArgument(op1, regT2);
+    stubCall.addArgument(op2, regT2);
+    stubCall.call(result);
+}
+
+void JIT::emitSlow_op_add(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    ASSERT_NOT_REACHED();
+}
+
+void JIT::emit_op_mul(Instruction* currentInstruction)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    JITStubCall stubCall(this, JITStubs::cti_op_mul);
+    stubCall.addArgument(op1, regT2);
+    stubCall.addArgument(op2, regT2);
+    stubCall.call(result);
+}
+
+void JIT::emitSlow_op_mul(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    ASSERT_NOT_REACHED();
+}
+
+void JIT::emit_op_sub(Instruction* currentInstruction)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    JITStubCall stubCall(this, JITStubs::cti_op_sub);
+    stubCall.addArgument(op1, regT2);
+    stubCall.addArgument(op2, regT2);
+    stubCall.call(result);
+}
+
+void JIT::emitSlow_op_sub(Instruction*, Vector<SlowCaseEntry>::iterator&)
+{
+    ASSERT_NOT_REACHED();
+}
+
+#elif USE(ALTERNATE_JSIMMEDIATE) // *AND* ENABLE(JIT_OPTIMIZE_ARITHMETIC)
+
+/* ------------------------------ BEGIN: USE(ALTERNATE_JSIMMEDIATE) (OP_ADD, OP_SUB, OP_MUL) ------------------------------ */
+
+void JIT::compileBinaryArithOp(OpcodeID opcodeID, unsigned, unsigned op1, unsigned op2, OperandTypes)
 {
-    emitPutJITStubArgFromVirtualRegister(src1, 1, X86::ecx);
-    emitPutJITStubArgFromVirtualRegister(src2, 2, X86::ecx);
+    emitGetVirtualRegisters(op1, regT0, op2, regT1);
+    emitJumpSlowCaseIfNotImmediateInteger(regT0);
+    emitJumpSlowCaseIfNotImmediateInteger(regT1);
     if (opcodeID == op_add)
-        emitCTICall(Interpreter::cti_op_add);
+        addSlowCase(branchAdd32(Overflow, regT1, regT0));
     else if (opcodeID == op_sub)
-        emitCTICall(Interpreter::cti_op_sub);
+        addSlowCase(branchSub32(Overflow, regT1, regT0));
     else {
         ASSERT(opcodeID == op_mul);
-        emitCTICall(Interpreter::cti_op_mul);
+        addSlowCase(branchMul32(Overflow, regT1, regT0));
+        addSlowCase(branchTest32(Zero, regT0));
     }
-    emitPutVirtualRegister(dst);
+    emitFastArithIntToImmNoCheck(regT0, regT0);
 }
 
-void JIT::compileBinaryArithOpSlowCase(OpcodeID, Vector<SlowCaseEntry>::iterator&, unsigned, unsigned, unsigned, OperandTypes)
+void JIT::compileBinaryArithOpSlowCase(OpcodeID opcodeID, Vector<SlowCaseEntry>::iterator& iter, unsigned result, unsigned op1, unsigned, OperandTypes types)
 {
-    ASSERT_NOT_REACHED();
+    // We assume that subtracting TagTypeNumber is equivalent to adding DoubleEncodeOffset.
+    COMPILE_ASSERT(((JSImmediate::TagTypeNumber + JSImmediate::DoubleEncodeOffset) == 0), TagTypeNumber_PLUS_DoubleEncodeOffset_EQUALS_0);
+
+    Jump notImm1 = getSlowCase(iter);
+    Jump notImm2 = getSlowCase(iter);
+
+    linkSlowCase(iter); // Integer overflow case - we could handle this in JIT code, but this is likely rare.
+    if (opcodeID == op_mul) // op_mul has an extra slow case to handle 0 * negative number.
+        linkSlowCase(iter);
+    emitGetVirtualRegister(op1, regT0);
+
+    Label stubFunctionCall(this);
+    JITStubCall stubCall(this, opcodeID == op_add ? JITStubs::cti_op_add : opcodeID == op_sub ? JITStubs::cti_op_sub : JITStubs::cti_op_mul);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(result);
+    Jump end = jump();
+
+    // if we get here, eax is not an int32, edx not yet checked.
+    notImm1.link(this);
+    if (!types.first().definitelyIsNumber())
+        emitJumpIfNotImmediateNumber(regT0).linkTo(stubFunctionCall, this);
+    if (!types.second().definitelyIsNumber())
+        emitJumpIfNotImmediateNumber(regT1).linkTo(stubFunctionCall, this);
+    addPtr(tagTypeNumberRegister, regT0);
+    movePtrToDouble(regT0, fpRegT1);
+    Jump op2isDouble = emitJumpIfNotImmediateInteger(regT1);
+    convertInt32ToDouble(regT1, fpRegT2);
+    Jump op2wasInteger = jump();
+
+    // if we get here, eax IS an int32, edx is not.
+    notImm2.link(this);
+    if (!types.second().definitelyIsNumber())
+        emitJumpIfNotImmediateNumber(regT1).linkTo(stubFunctionCall, this);
+    convertInt32ToDouble(regT0, fpRegT1);
+    op2isDouble.link(this);
+    addPtr(tagTypeNumberRegister, regT1);
+    movePtrToDouble(regT1, fpRegT2);
+    op2wasInteger.link(this);
+
+    if (opcodeID == op_add)
+        addDouble(fpRegT2, fpRegT1);
+    else if (opcodeID == op_sub)
+        subDouble(fpRegT2, fpRegT1);
+    else {
+        ASSERT(opcodeID == op_mul);
+        mulDouble(fpRegT2, fpRegT1);
+    }
+    moveDoubleToPtr(fpRegT1, regT0);
+    subPtr(tagTypeNumberRegister, regT0);
+    emitPutVirtualRegister(result, regT0);
+
+    end.link(this);
 }
 
-#else
+void JIT::emit_op_add(Instruction* currentInstruction)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
 
-typedef X86Assembler::JmpSrc JmpSrc;
-typedef X86Assembler::JmpDst JmpDst;
-typedef X86Assembler::XMMRegisterID XMMRegisterID;
+    if (!types.first().mightBeNumber() || !types.second().mightBeNumber()) {
+        JITStubCall stubCall(this, JITStubs::cti_op_add);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call(result);
+        return;
+    }
 
-#if PLATFORM(MAC)
+    if (isOperandConstantImmediateInt(op1)) {
+        emitGetVirtualRegister(op2, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        addSlowCase(branchAdd32(Overflow, Imm32(getConstantOperandImmediateInt(op1)), regT0));
+        emitFastArithIntToImmNoCheck(regT0, regT0);
+    } else if (isOperandConstantImmediateInt(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        addSlowCase(branchAdd32(Overflow, Imm32(getConstantOperandImmediateInt(op2)), regT0));
+        emitFastArithIntToImmNoCheck(regT0, regT0);
+    } else
+        compileBinaryArithOp(op_add, result, op1, op2, types);
+
+    emitPutVirtualRegister(result);
+}
 
-static inline bool isSSE2Present()
+void JIT::emitSlow_op_add(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    return true; // All X86 Macs are guaranteed to support at least SSE2
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    if (isOperandConstantImmediateInt(op1) || isOperandConstantImmediateInt(op2)) {
+        linkSlowCase(iter);
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, JITStubs::cti_op_add);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call(result);
+    } else
+        compileBinaryArithOpSlowCase(op_add, iter, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
 }
 
-#else
+void JIT::emit_op_mul(Instruction* currentInstruction)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
 
-static bool isSSE2Present()
-{
-    static const int SSE2FeatureBit = 1 << 26;
-    struct SSE2Check {
-        SSE2Check()
-        {
-            int flags;
-#if COMPILER(MSVC)
-            _asm {
-                mov eax, 1 // cpuid function 1 gives us the standard feature set
-                cpuid;
-                mov flags, edx;
-            }
-#else
-            flags = 0;
-            // FIXME: Add GCC code to do above asm
-#endif
-            present = (flags & SSE2FeatureBit) != 0;
-        }
-        bool present;
-    };
-    static SSE2Check check;
-    return check.present;
+    // For now, only plant a fast int case if the constant operand is greater than zero.
+    int32_t value;
+    if (isOperandConstantImmediateInt(op1) && ((value = getConstantOperandImmediateInt(op1)) > 0)) {
+        emitGetVirtualRegister(op2, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        addSlowCase(branchMul32(Overflow, Imm32(value), regT0, regT0));
+        emitFastArithReTagImmediate(regT0, regT0);
+    } else if (isOperandConstantImmediateInt(op2) && ((value = getConstantOperandImmediateInt(op2)) > 0)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        addSlowCase(branchMul32(Overflow, Imm32(value), regT0, regT0));
+        emitFastArithReTagImmediate(regT0, regT0);
+    } else
+        compileBinaryArithOp(op_mul, result, op1, op2, types);
+
+    emitPutVirtualRegister(result);
 }
 
-#endif
+void JIT::emitSlow_op_mul(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
 
-/*
-  This is required since number representation is canonical - values representable as a JSImmediate should not be stored in a JSNumberCell.
-  
-  In the common case, the double value from 'xmmSource' is written to the reusable JSNumberCell pointed to by 'jsNumberCell', then 'jsNumberCell'
-  is written to the output SF Register 'dst', and then a jump is planted (stored into *wroteJSNumberCell).
-  
-  However if the value from xmmSource is representable as a JSImmediate, then the JSImmediate value will be written to the output, and flow
-  control will fall through from the code planted.
-*/
-void JIT::putDoubleResultToJSNumberCellOrJSImmediate(X86::XMMRegisterID xmmSource, X86::RegisterID jsNumberCell, unsigned dst, JmpSrc* wroteJSNumberCell,  X86::XMMRegisterID tempXmm, X86::RegisterID tempReg1, X86::RegisterID tempReg2)
-{
-    // convert (double -> JSImmediate -> double), and check if the value is unchanged - in which case the value is representable as a JSImmediate.
-    __ cvttsd2si_rr(xmmSource, tempReg1);
-    __ addl_rr(tempReg1, tempReg1);
-    __ sarl_i8r(1, tempReg1);
-    __ cvtsi2sd_rr(tempReg1, tempXmm);
-    // Compare & branch if immediate. 
-    __ ucomis_rr(tempXmm, xmmSource);
-    JmpSrc resultIsImm = __ je();
-    JmpDst resultLookedLikeImmButActuallyIsnt = __ label();
-    
-    // Store the result to the JSNumberCell and jump.
-    __ movsd_rm(xmmSource, FIELD_OFFSET(JSNumberCell, m_value), jsNumberCell);
-    if (jsNumberCell != X86::eax)
-        __ movl_rr(jsNumberCell, X86::eax);
-    emitPutVirtualRegister(dst);
-    *wroteJSNumberCell = __ jmp();
-
-    __ link(resultIsImm, __ label());
-    // value == (double)(JSImmediate)value... or at least, it looks that way...
-    // ucomi will report that (0 == -0), and will report true if either input in NaN (result is unordered).
-    __ link(__ jp(), resultLookedLikeImmButActuallyIsnt); // Actually was a NaN
-    __ pextrw_irr(3, xmmSource, tempReg2);
-    __ cmpl_ir(0x8000, tempReg2);
-    __ link(__ je(), resultLookedLikeImmButActuallyIsnt); // Actually was -0
-    // Yes it really really really is representable as a JSImmediate.
-    emitFastArithIntToImmNoCheck(tempReg1, X86::eax);
-    emitPutVirtualRegister(dst);
+    if ((isOperandConstantImmediateInt(op1) && (getConstantOperandImmediateInt(op1) > 0))
+        || (isOperandConstantImmediateInt(op2) && (getConstantOperandImmediateInt(op2) > 0))) {
+        linkSlowCase(iter);
+        linkSlowCase(iter);
+        // There is an extra slow case for (op1 * -N) or (-N * op2), to check for 0 since this should produce a result of -0.
+        JITStubCall stubCall(this, JITStubs::cti_op_mul);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call(result);
+    } else
+        compileBinaryArithOpSlowCase(op_mul, iter, result, op1, op2, types);
 }
 
+void JIT::emit_op_sub(Instruction* currentInstruction)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+
+    compileBinaryArithOp(op_sub, result, op1, op2, types);
+
+    emitPutVirtualRegister(result);
+}
+
+void JIT::emitSlow_op_sub(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+
+    compileBinaryArithOpSlowCase(op_sub, iter, result, op1, op2, types);
+}
+
+#else // !ENABLE(JIT_OPTIMIZE_ARITHMETIC)
+
+/* ------------------------------ BEGIN: !ENABLE(JIT_OPTIMIZE_ARITHMETIC) (OP_ADD, OP_SUB, OP_MUL) ------------------------------ */
+
 void JIT::compileBinaryArithOp(OpcodeID opcodeID, unsigned dst, unsigned src1, unsigned src2, OperandTypes types)
 {
     Structure* numberStructure = m_globalData->numberStructure.get();
-    JmpSrc wasJSNumberCell1;
-    JmpSrc wasJSNumberCell1b;
-    JmpSrc wasJSNumberCell2;
-    JmpSrc wasJSNumberCell2b;
+    Jump wasJSNumberCell1;
+    Jump wasJSNumberCell2;
 
-    emitGetVirtualRegisters(src1, X86::eax, src2, X86::edx);
+    emitGetVirtualRegisters(src1, regT0, src2, regT1);
 
-    if (types.second().isReusable() && isSSE2Present()) {
+    if (types.second().isReusable() && supportsFloatingPoint()) {
         ASSERT(types.second().mightBeNumber());
 
         // Check op2 is a number
-        __ testl_i32r(JSImmediate::TagTypeInteger, X86::edx);
-        JmpSrc op2imm = __ jne();
+        Jump op2imm = emitJumpIfImmediateInteger(regT1);
         if (!types.second().definitelyIsNumber()) {
-            emitJumpSlowCaseIfNotJSCell(X86::edx, src2);
-            __ cmpl_im(reinterpret_cast<unsigned>(numberStructure), FIELD_OFFSET(JSCell, m_structure), X86::edx);
-            addSlowCase(__ jne());
+            emitJumpSlowCaseIfNotJSCell(regT1, src2);
+            addSlowCase(checkStructure(regT1, numberStructure));
         }
 
         // (1) In this case src2 is a reusable number cell.
         //     Slow case if src1 is not a number type.
-        __ testl_i32r(JSImmediate::TagTypeInteger, X86::eax);
-        JmpSrc op1imm = __ jne();
+        Jump op1imm = emitJumpIfImmediateInteger(regT0);
         if (!types.first().definitelyIsNumber()) {
-            emitJumpSlowCaseIfNotJSCell(X86::eax, src1);
-            __ cmpl_im(reinterpret_cast<unsigned>(numberStructure), FIELD_OFFSET(JSCell, m_structure), X86::eax);
-            addSlowCase(__ jne());
+            emitJumpSlowCaseIfNotJSCell(regT0, src1);
+            addSlowCase(checkStructure(regT0, numberStructure));
         }
 
         // (1a) if we get here, src1 is also a number cell
-        __ movsd_mr(FIELD_OFFSET(JSNumberCell, m_value), X86::eax, X86::xmm0);
-        JmpSrc loadedDouble = __ jmp();
+        loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
+        Jump loadedDouble = jump();
         // (1b) if we get here, src1 is an immediate
-        __ link(op1imm, __ label());
-        emitFastArithImmToInt(X86::eax);
-        __ cvtsi2sd_rr(X86::eax, X86::xmm0);
+        op1imm.link(this);
+        emitFastArithImmToInt(regT0);
+        convertInt32ToDouble(regT0, fpRegT0);
         // (1c) 
-        __ link(loadedDouble, __ label());
+        loadedDouble.link(this);
         if (opcodeID == op_add)
-            __ addsd_mr(FIELD_OFFSET(JSNumberCell, m_value), X86::edx, X86::xmm0);
+            addDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
         else if (opcodeID == op_sub)
-            __ subsd_mr(FIELD_OFFSET(JSNumberCell, m_value), X86::edx, X86::xmm0);
+            subDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
         else {
             ASSERT(opcodeID == op_mul);
-            __ mulsd_mr(FIELD_OFFSET(JSNumberCell, m_value), X86::edx, X86::xmm0);
+            mulDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
         }
 
-        putDoubleResultToJSNumberCellOrJSImmediate(X86::xmm0, X86::edx, dst, &wasJSNumberCell2, X86::xmm1, X86::ecx, X86::eax);
-        wasJSNumberCell2b = __ jmp();
+        // Store the result to the JSNumberCell and jump.
+        storeDouble(fpRegT0, Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)));
+        move(regT1, regT0);
+        emitPutVirtualRegister(dst);
+        wasJSNumberCell2 = jump();
 
         // (2) This handles cases where src2 is an immediate number.
         //     Two slow cases - either src1 isn't an immediate, or the subtract overflows.
-        __ link(op2imm, __ label());
-        emitJumpSlowCaseIfNotImmNum(X86::eax);
-    } else if (types.first().isReusable() && isSSE2Present()) {
+        op2imm.link(this);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+    } else if (types.first().isReusable() && supportsFloatingPoint()) {
         ASSERT(types.first().mightBeNumber());
 
         // Check op1 is a number
-        __ testl_i32r(JSImmediate::TagTypeInteger, X86::eax);
-        JmpSrc op1imm = __ jne();
+        Jump op1imm = emitJumpIfImmediateInteger(regT0);
         if (!types.first().definitelyIsNumber()) {
-            emitJumpSlowCaseIfNotJSCell(X86::eax, src1);
-            __ cmpl_im(reinterpret_cast<unsigned>(numberStructure), FIELD_OFFSET(JSCell, m_structure), X86::eax);
-            addSlowCase(__ jne());
+            emitJumpSlowCaseIfNotJSCell(regT0, src1);
+            addSlowCase(checkStructure(regT0, numberStructure));
         }
 
         // (1) In this case src1 is a reusable number cell.
         //     Slow case if src2 is not a number type.
-        __ testl_i32r(JSImmediate::TagTypeInteger, X86::edx);
-        JmpSrc op2imm = __ jne();
+        Jump op2imm = emitJumpIfImmediateInteger(regT1);
         if (!types.second().definitelyIsNumber()) {
-            emitJumpSlowCaseIfNotJSCell(X86::edx, src2);
-            __ cmpl_im(reinterpret_cast<unsigned>(numberStructure), FIELD_OFFSET(JSCell, m_structure), X86::edx);
-            addSlowCase(__ jne());
+            emitJumpSlowCaseIfNotJSCell(regT1, src2);
+            addSlowCase(checkStructure(regT1, numberStructure));
         }
 
         // (1a) if we get here, src2 is also a number cell
-        __ movsd_mr(FIELD_OFFSET(JSNumberCell, m_value), X86::edx, X86::xmm1);
-        JmpSrc loadedDouble = __ jmp();
+        loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
+        Jump loadedDouble = jump();
         // (1b) if we get here, src2 is an immediate
-        __ link(op2imm, __ label());
-        emitFastArithImmToInt(X86::edx);
-        __ cvtsi2sd_rr(X86::edx, X86::xmm1);
+        op2imm.link(this);
+        emitFastArithImmToInt(regT1);
+        convertInt32ToDouble(regT1, fpRegT1);
         // (1c) 
-        __ link(loadedDouble, __ label());
-        __ movsd_mr(FIELD_OFFSET(JSNumberCell, m_value), X86::eax, X86::xmm0);
+        loadedDouble.link(this);
+        loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
         if (opcodeID == op_add)
-            __ addsd_rr(X86::xmm1, X86::xmm0);
+            addDouble(fpRegT1, fpRegT0);
         else if (opcodeID == op_sub)
-            __ subsd_rr(X86::xmm1, X86::xmm0);
+            subDouble(fpRegT1, fpRegT0);
         else {
             ASSERT(opcodeID == op_mul);
-            __ mulsd_rr(X86::xmm1, X86::xmm0);
+            mulDouble(fpRegT1, fpRegT0);
         }
-        __ movsd_rm(X86::xmm0, FIELD_OFFSET(JSNumberCell, m_value), X86::eax);
+        storeDouble(fpRegT0, Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)));
         emitPutVirtualRegister(dst);
 
-        putDoubleResultToJSNumberCellOrJSImmediate(X86::xmm0, X86::eax, dst, &wasJSNumberCell1, X86::xmm1, X86::ecx, X86::edx);
-        wasJSNumberCell1b = __ jmp();
+        // Store the result to the JSNumberCell and jump.
+        storeDouble(fpRegT0, Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)));
+        emitPutVirtualRegister(dst);
+        wasJSNumberCell1 = jump();
 
         // (2) This handles cases where src1 is an immediate number.
         //     Two slow cases - either src2 isn't an immediate, or the subtract overflows.
-        __ link(op1imm, __ label());
-        emitJumpSlowCaseIfNotImmNum(X86::edx);
+        op1imm.link(this);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
     } else
-        emitJumpSlowCaseIfNotImmNums(X86::eax, X86::edx, X86::ecx);
+        emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
 
     if (opcodeID == op_add) {
-        emitFastArithDeTagImmediate(X86::eax);
-        __ addl_rr(X86::edx, X86::eax);
-        addSlowCase(__ jo());
+        emitFastArithDeTagImmediate(regT0);
+        addSlowCase(branchAdd32(Overflow, regT1, regT0));
     } else  if (opcodeID == op_sub) {
-        __ subl_rr(X86::edx, X86::eax);
-        addSlowCase(__ jo());
-        signExtend32ToPtr(X86::eax, X86::eax);
-        emitFastArithReTagImmediate(X86::eax, X86::eax);
+        addSlowCase(branchSub32(Overflow, regT1, regT0));
+        signExtend32ToPtr(regT0, regT0);
+        emitFastArithReTagImmediate(regT0, regT0);
     } else {
         ASSERT(opcodeID == op_mul);
         // convert eax & edx from JSImmediates to ints, and check if either are zero
-        emitFastArithImmToInt(X86::edx);
-        JmpSrc op1Zero = emitFastArithDeTagImmediateJumpIfZero(X86::eax);
-        __ testl_rr(X86::edx, X86::edx);
-        JmpSrc op2NonZero = __ jne();
-        __ link(op1Zero, __ label());
+        emitFastArithImmToInt(regT1);
+        Jump op1Zero = emitFastArithDeTagImmediateJumpIfZero(regT0);
+        Jump op2NonZero = branchTest32(NonZero, regT1);
+        op1Zero.link(this);
         // if either input is zero, add the two together, and check if the result is < 0.
         // If it is, we have a problem (N < 0), (N * 0) == -0, not representatble as a JSImmediate. 
-        __ movl_rr(X86::eax, X86::ecx);
-        __ addl_rr(X86::edx, X86::ecx);
-        addSlowCase(__ js());
+        move(regT0, regT2);
+        addSlowCase(branchAdd32(Signed, regT1, regT2));
         // Skip the above check if neither input is zero
-        __ link(op2NonZero, __ label());
-        __ imull_rr(X86::edx, X86::eax);
-        addSlowCase(__ jo());
-        signExtend32ToPtr(X86::eax, X86::eax);
-        emitFastArithReTagImmediate(X86::eax, X86::eax);
+        op2NonZero.link(this);
+        addSlowCase(branchMul32(Overflow, regT1, regT0));
+        signExtend32ToPtr(regT0, regT0);
+        emitFastArithReTagImmediate(regT0, regT0);
     }
     emitPutVirtualRegister(dst);
 
-    if (types.second().isReusable() && isSSE2Present()) {
-        __ link(wasJSNumberCell2, __ label());
-        __ link(wasJSNumberCell2b, __ label());
-    }
-    else if (types.first().isReusable() && isSSE2Present()) {
-        __ link(wasJSNumberCell1, __ label());
-        __ link(wasJSNumberCell1b, __ label());
-    }
+    if (types.second().isReusable() && supportsFloatingPoint())
+        wasJSNumberCell2.link(this);
+    else if (types.first().isReusable() && supportsFloatingPoint())
+        wasJSNumberCell1.link(this);
 }
 
 void JIT::compileBinaryArithOpSlowCase(OpcodeID opcodeID, Vector<SlowCaseEntry>::iterator& iter, unsigned dst, unsigned src1, unsigned src2, OperandTypes types)
 {
     linkSlowCase(iter);
-    if (types.second().isReusable() && isSSE2Present()) {
+    if (types.second().isReusable() && supportsFloatingPoint()) {
         if (!types.first().definitelyIsNumber()) {
             linkSlowCaseIfNotJSCell(iter, src1);
             linkSlowCase(iter);
@@ -733,7 +1228,7 @@ void JIT::compileBinaryArithOpSlowCase(OpcodeID opcodeID, Vector<SlowCaseEntry>:
             linkSlowCaseIfNotJSCell(iter, src2);
             linkSlowCase(iter);
         }
-    } else if (types.first().isReusable() && isSSE2Present()) {
+    } else if (types.first().isReusable() && supportsFloatingPoint()) {
         if (!types.first().definitelyIsNumber()) {
             linkSlowCaseIfNotJSCell(iter, src1);
             linkSlowCase(iter);
@@ -749,20 +1244,134 @@ void JIT::compileBinaryArithOpSlowCase(OpcodeID opcodeID, Vector<SlowCaseEntry>:
     if (opcodeID == op_mul)
         linkSlowCase(iter);
 
-    emitPutJITStubArgFromVirtualRegister(src1, 1, X86::ecx);
-    emitPutJITStubArgFromVirtualRegister(src2, 2, X86::ecx);
-    if (opcodeID == op_add)
-        emitCTICall(Interpreter::cti_op_add);
-    else if (opcodeID == op_sub)
-        emitCTICall(Interpreter::cti_op_sub);
-    else {
-        ASSERT(opcodeID == op_mul);
-        emitCTICall(Interpreter::cti_op_mul);
+    JITStubCall stubCall(this, opcodeID == op_add ? JITStubs::cti_op_add : opcodeID == op_sub ? JITStubs::cti_op_sub : JITStubs::cti_op_mul);
+    stubCall.addArgument(src1, regT2);
+    stubCall.addArgument(src2, regT2);
+    stubCall.call(dst);
+}
+
+void JIT::emit_op_add(Instruction* currentInstruction)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    if (isOperandConstantImmediateInt(op1)) {
+        emitGetVirtualRegister(op2, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        addSlowCase(branchAdd32(Overflow, Imm32(getConstantOperandImmediateInt(op1) << JSImmediate::IntegerPayloadShift), regT0));
+        signExtend32ToPtr(regT0, regT0);
+        emitPutVirtualRegister(result);
+    } else if (isOperandConstantImmediateInt(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        addSlowCase(branchAdd32(Overflow, Imm32(getConstantOperandImmediateInt(op2) << JSImmediate::IntegerPayloadShift), regT0));
+        signExtend32ToPtr(regT0, regT0);
+        emitPutVirtualRegister(result);
+    } else {
+        OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+        if (types.first().mightBeNumber() && types.second().mightBeNumber())
+            compileBinaryArithOp(op_add, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
+        else {
+            JITStubCall stubCall(this, JITStubs::cti_op_add);
+            stubCall.addArgument(op1, regT2);
+            stubCall.addArgument(op2, regT2);
+            stubCall.call(result);
+        }
     }
-    emitPutVirtualRegister(dst);
 }
 
-#endif
+void JIT::emitSlow_op_add(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    if (isOperandConstantImmediateInt(op1)) {
+        Jump notImm = getSlowCase(iter);
+        linkSlowCase(iter);
+        sub32(Imm32(getConstantOperandImmediateInt(op1) << JSImmediate::IntegerPayloadShift), regT0);
+        notImm.link(this);
+        JITStubCall stubCall(this, JITStubs::cti_op_add);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(regT0);
+        stubCall.call(result);
+    } else if (isOperandConstantImmediateInt(op2)) {
+        Jump notImm = getSlowCase(iter);
+        linkSlowCase(iter);
+        sub32(Imm32(getConstantOperandImmediateInt(op2) << JSImmediate::IntegerPayloadShift), regT0);
+        notImm.link(this);
+        JITStubCall stubCall(this, JITStubs::cti_op_add);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call(result);
+    } else {
+        OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
+        ASSERT(types.first().mightBeNumber() && types.second().mightBeNumber());
+        compileBinaryArithOpSlowCase(op_add, iter, result, op1, op2, types);
+    }
+}
+
+void JIT::emit_op_mul(Instruction* currentInstruction)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    // For now, only plant a fast int case if the constant operand is greater than zero.
+    int32_t value;
+    if (isOperandConstantImmediateInt(op1) && ((value = getConstantOperandImmediateInt(op1)) > 0)) {
+        emitGetVirtualRegister(op2, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        emitFastArithDeTagImmediate(regT0);
+        addSlowCase(branchMul32(Overflow, Imm32(value), regT0, regT0));
+        signExtend32ToPtr(regT0, regT0);
+        emitFastArithReTagImmediate(regT0, regT0);
+        emitPutVirtualRegister(result);
+    } else if (isOperandConstantImmediateInt(op2) && ((value = getConstantOperandImmediateInt(op2)) > 0)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        emitFastArithDeTagImmediate(regT0);
+        addSlowCase(branchMul32(Overflow, Imm32(value), regT0, regT0));
+        signExtend32ToPtr(regT0, regT0);
+        emitFastArithReTagImmediate(regT0, regT0);
+        emitPutVirtualRegister(result);
+    } else
+        compileBinaryArithOp(op_mul, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
+}
+
+void JIT::emitSlow_op_mul(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned result = currentInstruction[1].u.operand;
+    unsigned op1 = currentInstruction[2].u.operand;
+    unsigned op2 = currentInstruction[3].u.operand;
+
+    if ((isOperandConstantImmediateInt(op1) && (getConstantOperandImmediateInt(op1) > 0))
+        || (isOperandConstantImmediateInt(op2) && (getConstantOperandImmediateInt(op2) > 0))) {
+        linkSlowCase(iter);
+        linkSlowCase(iter);
+        // There is an extra slow case for (op1 * -N) or (-N * op2), to check for 0 since this should produce a result of -0.
+        JITStubCall stubCall(this, JITStubs::cti_op_mul);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call(result);
+    } else
+        compileBinaryArithOpSlowCase(op_mul, iter, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
+}
+
+void JIT::emit_op_sub(Instruction* currentInstruction)
+{
+    compileBinaryArithOp(op_sub, currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, OperandTypes::fromInt(currentInstruction[4].u.operand));
+}
+
+void JIT::emitSlow_op_sub(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileBinaryArithOpSlowCase(op_sub, iter, currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, OperandTypes::fromInt(currentInstruction[4].u.operand));
+}
+
+#endif // !ENABLE(JIT_OPTIMIZE_ARITHMETIC)
+
+/* ------------------------------ END: OP_ADD, OP_SUB, OP_MUL ------------------------------ */
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
index 0e85d75..abdb5ed 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITCall.cpp
@@ -30,6 +30,7 @@
 
 #include "CodeBlock.h"
 #include "JITInlineMethods.h"
+#include "JITStubCall.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "Interpreter.h"
@@ -44,40 +45,15 @@ using namespace std;
 
 namespace JSC {
 
-void JIT::unlinkCall(CallLinkInfo* callLinkInfo)
-{
-    // When the JSFunction is deleted the pointer embedded in the instruction stream will no longer be valid
-    // (and, if a new JSFunction happened to be constructed at the same location, we could get a false positive
-    // match).  Reset the check so it no longer matches.
-    DataLabelPtr::patch(callLinkInfo->hotPathBegin, JSValuePtr::encode(JSImmediate::impossibleValue()));
-}
-
-void JIT::linkCall(JSFunction* callee, CodeBlock* calleeCodeBlock, void* ctiCode, CallLinkInfo* callLinkInfo, int callerArgCount)
-{
-    // Currently we only link calls with the exact number of arguments.
-    if (callerArgCount == calleeCodeBlock->m_numParameters) {
-        ASSERT(!callLinkInfo->isLinked());
-    
-        calleeCodeBlock->addCaller(callLinkInfo);
-    
-        DataLabelPtr::patch(callLinkInfo->hotPathBegin, callee);
-        Jump::patch(callLinkInfo->hotPathOther, ctiCode);
-    }
-
-    // patch the instruction that jumps out to the cold path, so that we only try to link once.
-    void* patchCheck = reinterpret_cast<void*>(reinterpret_cast<ptrdiff_t>(callLinkInfo->hotPathBegin) + patchOffsetOpCallCompareToJump);
-    Jump::patch(patchCheck, callLinkInfo->coldPathOther);
-}
-
 void JIT::compileOpCallInitializeCallFrame()
 {
-    store32(X86::edx, Address(callFrameRegister, RegisterFile::ArgumentCount * static_cast<int>(sizeof(Register))));
+    store32(regT1, Address(callFrameRegister, RegisterFile::ArgumentCount * static_cast<int>(sizeof(Register))));
 
-    loadPtr(Address(X86::ecx, FIELD_OFFSET(JSFunction, m_scopeChain) + FIELD_OFFSET(ScopeChain, m_node)), X86::edx); // newScopeChain
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_data) + OBJECT_OFFSETOF(ScopeChain, m_node)), regT1); // newScopeChain
 
-    storePtr(ImmPtr(JSValuePtr::encode(noValue())), Address(callFrameRegister, RegisterFile::OptionalCalleeArguments * static_cast<int>(sizeof(Register))));
-    storePtr(X86::ecx, Address(callFrameRegister, RegisterFile::Callee * static_cast<int>(sizeof(Register))));
-    storePtr(X86::edx, Address(callFrameRegister, RegisterFile::ScopeChain * static_cast<int>(sizeof(Register))));
+    storePtr(ImmPtr(JSValue::encode(JSValue())), Address(callFrameRegister, RegisterFile::OptionalCalleeArguments * static_cast<int>(sizeof(Register))));
+    storePtr(regT2, Address(callFrameRegister, RegisterFile::Callee * static_cast<int>(sizeof(Register))));
+    storePtr(regT1, Address(callFrameRegister, RegisterFile::ScopeChain * static_cast<int>(sizeof(Register))));
 }
 
 void JIT::compileOpCallSetupArgs(Instruction* instruction)
@@ -86,20 +62,20 @@ void JIT::compileOpCallSetupArgs(Instruction* instruction)
     int registerOffset = instruction[4].u.operand;
 
     // ecx holds func
-    emitPutJITStubArg(X86::ecx, 1);
-    emitPutJITStubArgConstant(registerOffset, 2);
+    emitPutJITStubArg(regT2, 1);
     emitPutJITStubArgConstant(argCount, 3);
+    emitPutJITStubArgConstant(registerOffset, 2);
 }
-
-void JIT::compileOpCallEvalSetupArgs(Instruction* instruction)
+          
+void JIT::compileOpCallVarargsSetupArgs(Instruction* instruction)
 {
-    int argCount = instruction[3].u.operand;
     int registerOffset = instruction[4].u.operand;
-
+    
     // ecx holds func
-    emitPutJITStubArg(X86::ecx, 1);
-    emitPutJITStubArgConstant(registerOffset, 2);
-    emitPutJITStubArgConstant(argCount, 3);
+    emitPutJITStubArg(regT2, 1);
+    emitPutJITStubArg(regT1, 3);
+    addPtr(Imm32(registerOffset), regT1, regT0);
+    emitPutJITStubArg(regT0, 2);
 }
 
 void JIT::compileOpConstructSetupArgs(Instruction* instruction)
@@ -110,15 +86,58 @@ void JIT::compileOpConstructSetupArgs(Instruction* instruction)
     int thisRegister = instruction[6].u.operand;
 
     // ecx holds func
-    emitPutJITStubArg(X86::ecx, 1);
+    emitPutJITStubArg(regT2, 1);
     emitPutJITStubArgConstant(registerOffset, 2);
     emitPutJITStubArgConstant(argCount, 3);
-    emitPutJITStubArgFromVirtualRegister(proto, 4, X86::eax);
+    emitPutJITStubArgFromVirtualRegister(proto, 4, regT0);
     emitPutJITStubArgConstant(thisRegister, 5);
 }
 
+void JIT::compileOpCallVarargs(Instruction* instruction)
+{
+    int dst = instruction[1].u.operand;
+    int callee = instruction[2].u.operand;
+    int argCountRegister = instruction[3].u.operand;
+
+    emitGetVirtualRegister(argCountRegister, regT1);
+    emitGetVirtualRegister(callee, regT2);
+    compileOpCallVarargsSetupArgs(instruction);
+
+    // Check for JSFunctions.
+    emitJumpSlowCaseIfNotJSCell(regT2);
+    addSlowCase(branchPtr(NotEqual, Address(regT2), ImmPtr(m_globalData->jsFunctionVPtr)));
+    
+    // Speculatively roll the callframe, assuming argCount will match the arity.
+    mul32(Imm32(sizeof(Register)), regT0, regT0);
+    intptr_t offset = (intptr_t)sizeof(Register) * (intptr_t)RegisterFile::CallerFrame;
+    addPtr(Imm32((int32_t)offset), regT0, regT3);
+    addPtr(callFrameRegister, regT3);
+    storePtr(callFrameRegister, regT3);
+    addPtr(regT0, callFrameRegister);
+    emitNakedCall(m_globalData->jitStubs.ctiVirtualCall());
+
+    // Put the return value in dst. In the interpreter, op_ret does this.
+    emitPutVirtualRegister(dst);
+    
+    sampleCodeBlock(m_codeBlock);
+}
+
+void JIT::compileOpCallVarargsSlowCase(Instruction* instruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    int dst = instruction[1].u.operand;
+    
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_call_NotJSFunction);
+    stubCall.call(dst); // In the interpreter, the callee puts the return value in dst.
+    
+    sampleCodeBlock(m_codeBlock);
+}
+    
 #if !ENABLE(JIT_OPTIMIZE_CALL)
 
+/* ------------------------------ BEGIN: !ENABLE(JIT_OPTIMIZE_CALL) ------------------------------ */
+
 void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
 {
     int dst = instruction[1].u.operand;
@@ -129,14 +148,11 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
     // Handle eval
     Jump wasEval;
     if (opcodeID == op_call_eval) {
-        emitGetVirtualRegister(callee, X86::ecx);
-        compileOpCallEvalSetupArgs(instruction);
-
-        emitCTICall(Interpreter::cti_op_call_eval);
-        wasEval = jnePtr(X86::eax, ImmPtr(JSImmediate::impossibleValue()));
+        CallEvalJITStub(this, instruction).call();
+        wasEval = branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue())));
     }
 
-    emitGetVirtualRegister(callee, X86::ecx);
+    emitGetVirtualRegister(callee, regT2);
     // The arguments have been set up on the hot path for op_call_eval
     if (opcodeID == op_call)
         compileOpCallSetupArgs(instruction);
@@ -144,22 +160,21 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
         compileOpConstructSetupArgs(instruction);
 
     // Check for JSFunctions.
-    emitJumpSlowCaseIfNotJSCell(X86::ecx);
-    addSlowCase(jnePtr(Address(X86::ecx), ImmPtr(m_interpreter->m_jsFunctionVptr)));
+    emitJumpSlowCaseIfNotJSCell(regT2);
+    addSlowCase(branchPtr(NotEqual, Address(regT2), ImmPtr(m_globalData->jsFunctionVPtr)));
 
     // First, in the case of a construct, allocate the new object.
     if (opcodeID == op_construct) {
-        emitCTICall(Interpreter::cti_op_construct_JSConstruct);
-        emitPutVirtualRegister(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
-        emitGetVirtualRegister(callee, X86::ecx);
+        JITStubCall(this, JITStubs::cti_op_construct_JSConstruct).call(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
+        emitGetVirtualRegister(callee, regT2);
     }
 
     // Speculatively roll the callframe, assuming argCount will match the arity.
     storePtr(callFrameRegister, Address(callFrameRegister, (RegisterFile::CallerFrame + registerOffset) * static_cast<int>(sizeof(Register))));
     addPtr(Imm32(registerOffset * static_cast<int>(sizeof(Register))), callFrameRegister);
-    move(Imm32(argCount), X86::edx);
+    move(Imm32(argCount), regT1);
 
-    emitNakedCall(m_interpreter->m_ctiVirtualCall);
+    emitNakedCall(m_globalData->jitStubs.ctiVirtualCall());
 
     if (opcodeID == op_call_eval)
         wasEval.link(this);
@@ -167,9 +182,7 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned)
     // Put the return value in dst. In the interpreter, op_ret does this.
     emitPutVirtualRegister(dst);
 
-#if ENABLE(CODEBLOCK_SAMPLING)
-    storePtr(ImmPtr(m_codeBlock), m_interpreter->sampler()->codeBlockSlot());
-#endif
+    sampleCodeBlock(m_codeBlock);
 }
 
 void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>::iterator& iter, unsigned, OpcodeID opcodeID)
@@ -178,24 +191,15 @@ void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>:
 
     linkSlowCase(iter);
     linkSlowCase(iter);
+    JITStubCall stubCall(this, opcodeID == op_construct ? JITStubs::cti_op_construct_NotJSConstruct : JITStubs::cti_op_call_NotJSFunction);
+    stubCall.call(dst); // In the interpreter, the callee puts the return value in dst.
 
-    // This handles host functions
-    emitCTICall(((opcodeID == op_construct) ? Interpreter::cti_op_construct_NotJSConstruct : Interpreter::cti_op_call_NotJSFunction));
-    // Put the return value in dst. In the interpreter, op_ret does this.
-    emitPutVirtualRegister(dst);
-
-#if ENABLE(CODEBLOCK_SAMPLING)
-    storePtr(ImmPtr(m_codeBlock), m_interpreter->sampler()->codeBlockSlot());
-#endif
+    sampleCodeBlock(m_codeBlock);
 }
 
-#else
+#else // !ENABLE(JIT_OPTIMIZE_CALL)
 
-static void unreachable()
-{
-    ASSERT_NOT_REACHED();
-    exit(1);
-}
+/* ------------------------------ BEGIN: ENABLE(JIT_OPTIMIZE_CALL) ------------------------------ */
 
 void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned callLinkInfoIndex)
 {
@@ -207,18 +211,15 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     // Handle eval
     Jump wasEval;
     if (opcodeID == op_call_eval) {
-        emitGetVirtualRegister(callee, X86::ecx);
-        compileOpCallEvalSetupArgs(instruction);
-
-        emitCTICall(Interpreter::cti_op_call_eval);
-        wasEval = jnePtr(X86::eax, ImmPtr(JSValuePtr::encode(JSImmediate::impossibleValue())));
+        CallEvalJITStub(this, instruction).call();
+        wasEval = branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue())));
     }
 
     // This plants a check for a cached JSFunction value, so we can plant a fast link to the callee.
     // This deliberately leaves the callee in ecx, used when setting up the stack frame below
-    emitGetVirtualRegister(callee, X86::ecx);
+    emitGetVirtualRegister(callee, regT2);
     DataLabelPtr addressOfLinkedFunctionCheck;
-    Jump jumpToSlow = jnePtrWithPatch(X86::ecx, addressOfLinkedFunctionCheck, ImmPtr(JSValuePtr::encode(JSImmediate::impossibleValue())));
+    Jump jumpToSlow = branchPtrWithPatch(NotEqual, regT2, addressOfLinkedFunctionCheck, ImmPtr(JSValue::encode(JSValue())));
     addSlowCase(jumpToSlow);
     ASSERT(differenceBetween(addressOfLinkedFunctionCheck, jumpToSlow) == patchOffsetOpCallCompareToJump);
     m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathBegin = addressOfLinkedFunctionCheck;
@@ -230,25 +231,25 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
         int proto = instruction[5].u.operand;
         int thisRegister = instruction[6].u.operand;
 
-        emitPutJITStubArg(X86::ecx, 1);
-        emitPutJITStubArgFromVirtualRegister(proto, 4, X86::eax);
-        emitCTICall(Interpreter::cti_op_construct_JSConstruct);
-        emitPutVirtualRegister(thisRegister);
-        emitGetVirtualRegister(callee, X86::ecx);
+        emitPutJITStubArg(regT2, 1);
+        emitPutJITStubArgFromVirtualRegister(proto, 4, regT0);
+        JITStubCall stubCall(this, JITStubs::cti_op_construct_JSConstruct);
+        stubCall.call(thisRegister);
+        emitGetVirtualRegister(callee, regT2);
     }
 
     // Fast version of stack frame initialization, directly relative to edi.
     // Note that this omits to set up RegisterFile::CodeBlock, which is set in the callee
-    storePtr(ImmPtr(JSValuePtr::encode(noValue())), Address(callFrameRegister, (registerOffset + RegisterFile::OptionalCalleeArguments) * static_cast<int>(sizeof(Register))));
-    storePtr(X86::ecx, Address(callFrameRegister, (registerOffset + RegisterFile::Callee) * static_cast<int>(sizeof(Register))));
-    loadPtr(Address(X86::ecx, FIELD_OFFSET(JSFunction, m_scopeChain) + FIELD_OFFSET(ScopeChain, m_node)), X86::edx); // newScopeChain
+    storePtr(ImmPtr(JSValue::encode(JSValue())), Address(callFrameRegister, (registerOffset + RegisterFile::OptionalCalleeArguments) * static_cast<int>(sizeof(Register))));
+    storePtr(regT2, Address(callFrameRegister, (registerOffset + RegisterFile::Callee) * static_cast<int>(sizeof(Register))));
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSFunction, m_data) + OBJECT_OFFSETOF(ScopeChain, m_node)), regT1); // newScopeChain
     store32(Imm32(argCount), Address(callFrameRegister, (registerOffset + RegisterFile::ArgumentCount) * static_cast<int>(sizeof(Register))));
     storePtr(callFrameRegister, Address(callFrameRegister, (registerOffset + RegisterFile::CallerFrame) * static_cast<int>(sizeof(Register))));
-    storePtr(X86::edx, Address(callFrameRegister, (registerOffset + RegisterFile::ScopeChain) * static_cast<int>(sizeof(Register))));
+    storePtr(regT1, Address(callFrameRegister, (registerOffset + RegisterFile::ScopeChain) * static_cast<int>(sizeof(Register))));
     addPtr(Imm32(registerOffset * sizeof(Register)), callFrameRegister);
 
     // Call to the callee
-    m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathOther = emitNakedCall(reinterpret_cast<void*>(unreachable));
+    m_callStructureStubCompilationInfo[callLinkInfoIndex].hotPathOther = emitNakedCall();
     
     if (opcodeID == op_call_eval)
         wasEval.link(this);
@@ -256,9 +257,7 @@ void JIT::compileOpCall(OpcodeID opcodeID, Instruction* instruction, unsigned ca
     // Put the return value in dst. In the interpreter, op_ret does this.
     emitPutVirtualRegister(dst);
 
-#if ENABLE(CODEBLOCK_SAMPLING)
-        storePtr(ImmPtr(m_codeBlock), m_interpreter->sampler()->codeBlockSlot());
-#endif
+    sampleCodeBlock(m_codeBlock);
 }
 
 void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>::iterator& iter, unsigned callLinkInfoIndex, OpcodeID opcodeID)
@@ -277,76 +276,47 @@ void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>:
         compileOpConstructSetupArgs(instruction);
 
     // Fast check for JS function.
-    Jump callLinkFailNotObject = emitJumpIfNotJSCell(X86::ecx);
-    Jump callLinkFailNotJSFunction = jnePtr(Address(X86::ecx), ImmPtr(m_interpreter->m_jsFunctionVptr));
+    Jump callLinkFailNotObject = emitJumpIfNotJSCell(regT2);
+    Jump callLinkFailNotJSFunction = branchPtr(NotEqual, Address(regT2), ImmPtr(m_globalData->jsFunctionVPtr));
 
     // First, in the case of a construct, allocate the new object.
     if (opcodeID == op_construct) {
-        emitCTICall(Interpreter::cti_op_construct_JSConstruct);
-        emitPutVirtualRegister(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
-        emitGetVirtualRegister(callee, X86::ecx);
+        JITStubCall(this, JITStubs::cti_op_construct_JSConstruct).call(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
+        emitGetVirtualRegister(callee, regT2);
     }
 
-    move(Imm32(argCount), X86::edx);
-
     // Speculatively roll the callframe, assuming argCount will match the arity.
     storePtr(callFrameRegister, Address(callFrameRegister, (RegisterFile::CallerFrame + registerOffset) * static_cast<int>(sizeof(Register))));
     addPtr(Imm32(registerOffset * static_cast<int>(sizeof(Register))), callFrameRegister);
+    move(Imm32(argCount), regT1);
 
-    m_callStructureStubCompilationInfo[callLinkInfoIndex].callReturnLocation =
-        emitNakedCall(m_interpreter->m_ctiVirtualCallPreLink);
+    m_callStructureStubCompilationInfo[callLinkInfoIndex].callReturnLocation = emitNakedCall(m_globalData->jitStubs.ctiVirtualCallPreLink());
 
-    Jump storeResultForFirstRun = jump();
-
-// FIXME: this label can be removed, since it is a fixed offset from 'callReturnLocation'.
-    // This is the address for the cold path *after* the first run (which tries to link the call).
-    m_callStructureStubCompilationInfo[callLinkInfoIndex].coldPathOther = MacroAssembler::Label(this);
+    // Put the return value in dst.
+    emitPutVirtualRegister(dst);
+    sampleCodeBlock(m_codeBlock);
 
-    // The arguments have been set up on the hot path for op_call_eval
-    if (opcodeID == op_call)
-        compileOpCallSetupArgs(instruction);
-    else if (opcodeID == op_construct)
-        compileOpConstructSetupArgs(instruction);
+    // If not, we need an extra case in the if below!
+    ASSERT(OPCODE_LENGTH(op_call) == OPCODE_LENGTH(op_call_eval));
 
-    // Check for JSFunctions.
-    Jump isNotObject = emitJumpIfNotJSCell(X86::ecx);
-    Jump isJSFunction = jePtr(Address(X86::ecx), ImmPtr(m_interpreter->m_jsFunctionVptr));
+    // Done! - return back to the hot path.
+    if (opcodeID == op_construct)
+        emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_construct));
+    else
+        emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_call));
 
     // This handles host functions
-    isNotObject.link(this);
     callLinkFailNotObject.link(this);
     callLinkFailNotJSFunction.link(this);
-    emitCTICall(((opcodeID == op_construct) ? Interpreter::cti_op_construct_NotJSConstruct : Interpreter::cti_op_call_NotJSFunction));
-    Jump wasNotJSFunction = jump();
-
-    // Next, handle JSFunctions...
-    isJSFunction.link(this);
+    JITStubCall(this, opcodeID == op_construct ? JITStubs::cti_op_construct_NotJSConstruct : JITStubs::cti_op_call_NotJSFunction).call();
 
-    // First, in the case of a construct, allocate the new object.
-    if (opcodeID == op_construct) {
-        emitCTICall(Interpreter::cti_op_construct_JSConstruct);
-        emitPutVirtualRegister(registerOffset - RegisterFile::CallFrameHeaderSize - argCount);
-        emitGetVirtualRegister(callee, X86::ecx);
-    }
-
-    // Speculatively roll the callframe, assuming argCount will match the arity.
-    storePtr(callFrameRegister, Address(callFrameRegister, (RegisterFile::CallerFrame + registerOffset) * static_cast<int>(sizeof(Register))));
-    addPtr(Imm32(registerOffset * static_cast<int>(sizeof(Register))), callFrameRegister);
-    move(Imm32(argCount), X86::edx);
-
-    emitNakedCall(m_interpreter->m_ctiVirtualCall);
-
-    // Put the return value in dst. In the interpreter, op_ret does this.
-    wasNotJSFunction.link(this);
-    storeResultForFirstRun.link(this);
     emitPutVirtualRegister(dst);
-
-#if ENABLE(CODEBLOCK_SAMPLING)
-    storePtr(ImmPtr(m_codeBlock), m_interpreter->sampler()->codeBlockSlot());
-#endif
+    sampleCodeBlock(m_codeBlock);
 }
 
-#endif
+/* ------------------------------ END: !ENABLE / ENABLE(JIT_OPTIMIZE_CALL) ------------------------------ */
+
+#endif // !ENABLE(JIT_OPTIMIZE_CALL)
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITCode.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITCode.h
new file mode 100644
index 0000000..7ee644b
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITCode.h
@@ -0,0 +1,119 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JITCode_h
+#define JITCode_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(JIT)
+
+#include "CallFrame.h"
+#include "JSValue.h"
+#include "MacroAssemblerCodeRef.h"
+#include "Profiler.h"
+
+namespace JSC {
+
+    class JSGlobalData;
+    class RegisterFile;
+
+    class JITCode {
+        typedef MacroAssemblerCodeRef CodeRef;
+        typedef MacroAssemblerCodePtr CodePtr;
+    public:
+        JITCode()
+        {
+        }
+
+        JITCode(const CodeRef ref)
+            : m_ref(ref)
+        {
+        }
+
+        bool operator !() const
+        {
+            return !m_ref.m_code.executableAddress();
+        }
+
+        CodePtr addressForCall()
+        {
+            return m_ref.m_code;
+        }
+
+        // This function returns the offset in bytes of 'pointerIntoCode' into
+        // this block of code.  The pointer provided must be a pointer into this
+        // block of code.  It is ASSERTed that no codeblock >4gb in size.
+        unsigned offsetOf(void* pointerIntoCode)
+        {
+            intptr_t result = reinterpret_cast<intptr_t>(pointerIntoCode) - reinterpret_cast<intptr_t>(m_ref.m_code.executableAddress());
+            ASSERT(static_cast<intptr_t>(static_cast<unsigned>(result)) == result);
+            return static_cast<unsigned>(result);
+        }
+
+        // Execute the code!
+        inline JSValue execute(RegisterFile* registerFile, CallFrame* callFrame, JSGlobalData* globalData, JSValue* exception)
+        {
+            return JSValue::decode(ctiTrampoline(
+#if PLATFORM(X86_64)
+                0, 0, 0, 0, 0, 0,
+#endif
+                m_ref.m_code.executableAddress(), registerFile, callFrame, exception, Profiler::enabledProfilerReference(), globalData));
+        }
+
+#ifndef NDEBUG
+        size_t size()
+        {
+            ASSERT(m_ref.m_code.executableAddress());
+            return m_ref.m_size;
+        }
+#endif
+
+        ExecutablePool* getExecutablePool()
+        {
+            return m_ref.m_executablePool.get();
+        }
+
+        // Host functions are a bit special; they have a m_code pointer but they
+        // do not individully ref the executable pool containing the trampoline.
+        static JITCode HostFunction(CodePtr code)
+        {
+            return JITCode(code.dataLocation(), 0, 0);
+        }
+
+    private:
+        JITCode(void* code, PassRefPtr<ExecutablePool> executablePool, size_t size)
+            : m_ref(code, executablePool, size)
+        {
+        }
+
+        CodeRef m_ref;
+    };
+
+};
+
+#endif
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
index 3804ba9..deca0d1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITInlineMethods.h
@@ -30,15 +30,6 @@
 
 #if ENABLE(JIT)
 
-#if PLATFORM(WIN)
-#undef FIELD_OFFSET // Fix conflict with winnt.h.
-#endif
-
-// FIELD_OFFSET: Like the C++ offsetof macro, but you can use it with classes.
-// The magic number 0x4000 is insignificant. We use it to avoid using NULL, since
-// NULL can cause compiler problems, especially in cases of multiple inheritance.
-#define FIELD_OFFSET(class, field) (reinterpret_cast<ptrdiff_t>(&(reinterpret_cast<class*>(0x4000)->field)) - 0x4000)
-
 namespace JSC {
 
 ALWAYS_INLINE void JIT::killLastResultRegister()
@@ -53,8 +44,8 @@ ALWAYS_INLINE void JIT::emitGetVirtualRegister(int src, RegisterID dst)
 
     // TODO: we want to reuse values that are already in registers if we can - add a register allocator!
     if (m_codeBlock->isConstantRegisterIndex(src)) {
-        JSValuePtr value = m_codeBlock->getConstant(src);
-        move(ImmPtr(JSValuePtr::encode(value)), dst);
+        JSValue value = m_codeBlock->getConstant(src);
+        move(ImmPtr(JSValue::encode(value)), dst);
         killLastResultRegister();
         return;
     }
@@ -69,8 +60,8 @@ ALWAYS_INLINE void JIT::emitGetVirtualRegister(int src, RegisterID dst)
 
         if (!atJumpTarget) {
             // The argument we want is already stored in eax
-            if (dst != X86::eax)
-                move(X86::eax, dst);
+            if (dst != cachedResultRegister)
+                move(cachedResultRegister, dst);
             killLastResultRegister();
             return;
         }
@@ -112,7 +103,7 @@ ALWAYS_INLINE void JIT::emitGetJITStubArg(unsigned argumentNumber, RegisterID ds
     peek(dst, argumentNumber);
 }
 
-ALWAYS_INLINE JSValuePtr JIT::getConstantOperand(unsigned src)
+ALWAYS_INLINE JSValue JIT::getConstantOperand(unsigned src)
 {
     ASSERT(m_codeBlock->isConstantRegisterIndex(src));
     return m_codeBlock->getConstant(src);
@@ -120,20 +111,20 @@ ALWAYS_INLINE JSValuePtr JIT::getConstantOperand(unsigned src)
 
 ALWAYS_INLINE int32_t JIT::getConstantOperandImmediateInt(unsigned src)
 {
-    return static_cast<int32_t>(JSImmediate::intValue(getConstantOperand(src)));
+    return getConstantOperand(src).getInt32Fast();
 }
 
 ALWAYS_INLINE bool JIT::isOperandConstantImmediateInt(unsigned src)
 {
-    return m_codeBlock->isConstantRegisterIndex(src) && JSImmediate::isNumber(getConstantOperand(src));
+    return m_codeBlock->isConstantRegisterIndex(src) && getConstantOperand(src).isInt32Fast();
 }
 
 // get arg puts an arg from the SF register array onto the stack, as an arg to a context threaded function.
 ALWAYS_INLINE void JIT::emitPutJITStubArgFromVirtualRegister(unsigned src, unsigned argumentNumber, RegisterID scratch)
 {
     if (m_codeBlock->isConstantRegisterIndex(src)) {
-        JSValuePtr value = m_codeBlock->getConstant(src);
-        emitPutJITStubArgConstant(JSValuePtr::encode(value), argumentNumber);
+        JSValue value = m_codeBlock->getConstant(src);
+        emitPutJITStubArgConstant(JSValue::encode(value), argumentNumber);
     } else {
         loadPtr(Address(callFrameRegister, src * sizeof(Register)), scratch);
         emitPutJITStubArg(scratch, argumentNumber);
@@ -142,22 +133,6 @@ ALWAYS_INLINE void JIT::emitPutJITStubArgFromVirtualRegister(unsigned src, unsig
     killLastResultRegister();
 }
 
-ALWAYS_INLINE void JIT::emitPutCTIParam(void* value, unsigned name)
-{
-    poke(ImmPtr(value), name);
-}
-
-ALWAYS_INLINE void JIT::emitPutCTIParam(RegisterID from, unsigned name)
-{
-    poke(from, name);
-}
-
-ALWAYS_INLINE void JIT::emitGetCTIParam(unsigned name, RegisterID to)
-{
-    peek(to, name);
-    killLastResultRegister();
-}
-
 ALWAYS_INLINE void JIT::emitPutToCallFrameHeader(RegisterID from, RegisterFile::CallFrameHeaderEntry entry)
 {
     storePtr(from, Address(callFrameRegister, entry * sizeof(Register)));
@@ -168,108 +143,121 @@ ALWAYS_INLINE void JIT::emitPutImmediateToCallFrameHeader(void* value, RegisterF
     storePtr(ImmPtr(value), Address(callFrameRegister, entry * sizeof(Register)));
 }
 
-ALWAYS_INLINE void JIT::emitGetFromCallFrameHeader(RegisterFile::CallFrameHeaderEntry entry, RegisterID to)
+ALWAYS_INLINE void JIT::emitGetFromCallFrameHeaderPtr(RegisterFile::CallFrameHeaderEntry entry, RegisterID to, RegisterID from)
 {
-    loadPtr(Address(callFrameRegister, entry * sizeof(Register)), to);
+    loadPtr(Address(from, entry * sizeof(Register)), to);
+    killLastResultRegister();
+}
+
+ALWAYS_INLINE void JIT::emitGetFromCallFrameHeader32(RegisterFile::CallFrameHeaderEntry entry, RegisterID to, RegisterID from)
+{
+    load32(Address(from, entry * sizeof(Register)), to);
     killLastResultRegister();
 }
 
 ALWAYS_INLINE void JIT::emitPutVirtualRegister(unsigned dst, RegisterID from)
 {
     storePtr(from, Address(callFrameRegister, dst * sizeof(Register)));
-    m_lastResultBytecodeRegister = (from == X86::eax) ? dst : std::numeric_limits<int>::max();
+    m_lastResultBytecodeRegister = (from == cachedResultRegister) ? dst : std::numeric_limits<int>::max();
     // FIXME: #ifndef NDEBUG, Write the correct m_type to the register.
 }
 
 ALWAYS_INLINE void JIT::emitInitRegister(unsigned dst)
 {
-    storePtr(ImmPtr(JSValuePtr::encode(jsUndefined())), Address(callFrameRegister, dst * sizeof(Register)));
+    storePtr(ImmPtr(JSValue::encode(jsUndefined())), Address(callFrameRegister, dst * sizeof(Register)));
     // FIXME: #ifndef NDEBUG, Write the correct m_type to the register.
 }
 
-ALWAYS_INLINE JIT::Jump JIT::emitNakedCall(X86::RegisterID r)
+ALWAYS_INLINE JIT::Call JIT::emitNakedCall(CodePtr function)
 {
     ASSERT(m_bytecodeIndex != (unsigned)-1); // This method should only be called during hot/cold path generation, so that m_bytecodeIndex is set.
 
-    Jump nakedCall = call(r);
-    m_calls.append(CallRecord(nakedCall, m_bytecodeIndex));
+    Call nakedCall = nearCall();
+    m_calls.append(CallRecord(nakedCall, m_bytecodeIndex, function.executableAddress()));
     return nakedCall;
 }
 
-ALWAYS_INLINE JIT::Jump JIT::emitNakedCall(void* function)
+#if PLATFORM(X86) || PLATFORM(X86_64)
+
+ALWAYS_INLINE void JIT::preverveReturnAddressAfterCall(RegisterID reg)
 {
-    ASSERT(m_bytecodeIndex != (unsigned)-1); // This method should only be called during hot/cold path generation, so that m_bytecodeIndex is set.
+    pop(reg);
+}
 
-    Jump nakedCall = call();
-    m_calls.append(CallRecord(nakedCall, m_bytecodeIndex, function));
-    return nakedCall;
+ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(RegisterID reg)
+{
+    push(reg);
 }
 
-#if USE(JIT_STUB_ARGUMENT_REGISTER)
-ALWAYS_INLINE void JIT::restoreArgumentReference()
+ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(Address address)
 {
-#if PLATFORM(X86_64)
-    move(X86::esp, X86::edi);
-#else
-    move(X86::esp, X86::ecx);
-#endif
-    emitPutCTIParam(callFrameRegister, STUB_ARGS_callFrame);
+    push(address);
 }
-ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline()
+
+#elif PLATFORM_ARM_ARCH(7)
+
+ALWAYS_INLINE void JIT::preverveReturnAddressAfterCall(RegisterID reg)
 {
-    // In the trampoline on x86-64, the first argument register is not overwritten.
-#if !PLATFORM(X86_64)
-    move(X86::esp, X86::ecx);
-    addPtr(Imm32(sizeof(void*)), X86::ecx);
-#endif
+    move(linkRegister, reg);
 }
-#elif USE(JIT_STUB_ARGUMENT_STACK)
+
+ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(RegisterID reg)
+{
+    move(reg, linkRegister);
+}
+
+ALWAYS_INLINE void JIT::restoreReturnAddressBeforeReturn(Address address)
+{
+    loadPtr(address, linkRegister);
+}
+
+#endif
+
+#if USE(JIT_STUB_ARGUMENT_VA_LIST)
 ALWAYS_INLINE void JIT::restoreArgumentReference()
 {
-    storePtr(X86::esp, X86::esp);
-    emitPutCTIParam(callFrameRegister, STUB_ARGS_callFrame);
+    poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof (void*));
 }
 ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline() {}
-#else // JIT_STUB_ARGUMENT_VA_LIST
+#else
 ALWAYS_INLINE void JIT::restoreArgumentReference()
 {
-    emitPutCTIParam(callFrameRegister, STUB_ARGS_callFrame);
+    move(stackPointerRegister, firstArgumentRegister);
+    poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof (void*));
 }
-ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline() {}
-#endif
-
-ALWAYS_INLINE JIT::Jump JIT::emitCTICall_internal(void* helper)
+ALWAYS_INLINE void JIT::restoreArgumentReferenceForTrampoline()
 {
-    ASSERT(m_bytecodeIndex != (unsigned)-1); // This method should only be called during hot/cold path generation, so that m_bytecodeIndex is set.
-
-#if ENABLE(OPCODE_SAMPLING)
-    store32(Imm32(m_interpreter->sampler()->encodeSample(m_codeBlock->instructions().begin() + m_bytecodeIndex, true)), m_interpreter->sampler()->sampleSlot());
+#if PLATFORM(X86)
+    // Within a trampoline the return address will be on the stack at this point.
+    addPtr(Imm32(sizeof(void*)), stackPointerRegister, firstArgumentRegister);
+#elif PLATFORM_ARM_ARCH(7)
+    move(stackPointerRegister, firstArgumentRegister);
 #endif
-    restoreArgumentReference();
-    Jump ctiCall = call();
-    m_calls.append(CallRecord(ctiCall, m_bytecodeIndex, helper));
-#if ENABLE(OPCODE_SAMPLING)
-    store32(Imm32(m_interpreter->sampler()->encodeSample(m_codeBlock->instructions().begin() + m_bytecodeIndex, false)), m_interpreter->sampler()->sampleSlot());
-#endif
-    killLastResultRegister();
-
-    return ctiCall;
+    // In the trampoline on x86-64, the first argument register is not overwritten.
 }
+#endif
 
 ALWAYS_INLINE JIT::Jump JIT::checkStructure(RegisterID reg, Structure* structure)
 {
-    return jnePtr(Address(reg, FIELD_OFFSET(JSCell, m_structure)), ImmPtr(structure));
+    return branchPtr(NotEqual, Address(reg, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(structure));
 }
 
 ALWAYS_INLINE JIT::Jump JIT::emitJumpIfJSCell(RegisterID reg)
 {
 #if USE(ALTERNATE_JSIMMEDIATE)
-    return jzPtr(reg, ImmPtr(reinterpret_cast<void*>(JSImmediate::TagMask)));
+    return branchTestPtr(Zero, reg, tagMaskRegister);
 #else
-    return jz32(reg, Imm32(JSImmediate::TagMask));
+    return branchTest32(Zero, reg, Imm32(JSImmediate::TagMask));
 #endif
 }
 
+ALWAYS_INLINE JIT::Jump JIT::emitJumpIfBothJSCells(RegisterID reg1, RegisterID reg2, RegisterID scratch)
+{
+    move(reg1, scratch);
+    orPtr(reg2, scratch);
+    return emitJumpIfJSCell(scratch);
+}
+
 ALWAYS_INLINE void JIT::emitJumpSlowCaseIfJSCell(RegisterID reg)
 {
     addSlowCase(emitJumpIfJSCell(reg));
@@ -278,9 +266,9 @@ ALWAYS_INLINE void JIT::emitJumpSlowCaseIfJSCell(RegisterID reg)
 ALWAYS_INLINE JIT::Jump JIT::emitJumpIfNotJSCell(RegisterID reg)
 {
 #if USE(ALTERNATE_JSIMMEDIATE)
-    return jnzPtr(reg, ImmPtr(reinterpret_cast<void*>(JSImmediate::TagMask)));
+    return branchTestPtr(NonZero, reg, tagMaskRegister);
 #else
-    return jnz32(reg, Imm32(JSImmediate::TagMask));
+    return branchTest32(NonZero, reg, Imm32(JSImmediate::TagMask));
 #endif
 }
 
@@ -301,40 +289,61 @@ ALWAYS_INLINE void JIT::linkSlowCaseIfNotJSCell(Vector<SlowCaseEntry>::iterator&
         linkSlowCase(iter);
 }
 
-ALWAYS_INLINE JIT::Jump JIT::emitJumpIfImmNum(RegisterID reg)
+#if USE(ALTERNATE_JSIMMEDIATE)
+ALWAYS_INLINE JIT::Jump JIT::emitJumpIfImmediateNumber(RegisterID reg)
+{
+    return branchTestPtr(NonZero, reg, tagTypeNumberRegister);
+}
+ALWAYS_INLINE JIT::Jump JIT::emitJumpIfNotImmediateNumber(RegisterID reg)
+{
+    return branchTestPtr(Zero, reg, tagTypeNumberRegister);
+}
+#endif
+
+ALWAYS_INLINE JIT::Jump JIT::emitJumpIfImmediateInteger(RegisterID reg)
 {
 #if USE(ALTERNATE_JSIMMEDIATE)
-    return jaePtr(reg, ImmPtr(reinterpret_cast<void*>(JSImmediate::TagTypeInteger)));
+    return branchPtr(AboveOrEqual, reg, tagTypeNumberRegister);
 #else
-    return jnz32(reg, Imm32(JSImmediate::TagTypeInteger));
+    return branchTest32(NonZero, reg, Imm32(JSImmediate::TagTypeNumber));
 #endif
 }
 
-ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotImmNum(RegisterID reg)
+ALWAYS_INLINE JIT::Jump JIT::emitJumpIfNotImmediateInteger(RegisterID reg)
 {
 #if USE(ALTERNATE_JSIMMEDIATE)
-    addSlowCase(jbPtr(reg, ImmPtr(reinterpret_cast<void*>(JSImmediate::TagTypeInteger))));
+    return branchPtr(Below, reg, tagTypeNumberRegister);
 #else
-    addSlowCase(jz32(reg, Imm32(JSImmediate::TagTypeInteger)));
+    return branchTest32(Zero, reg, Imm32(JSImmediate::TagTypeNumber));
 #endif
 }
 
-ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotImmNums(RegisterID reg1, RegisterID reg2, RegisterID scratch)
+ALWAYS_INLINE JIT::Jump JIT::emitJumpIfNotImmediateIntegers(RegisterID reg1, RegisterID reg2, RegisterID scratch)
 {
     move(reg1, scratch);
     andPtr(reg2, scratch);
-    emitJumpSlowCaseIfNotImmNum(scratch);
+    return emitJumpIfNotImmediateInteger(scratch);
+}
+
+ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotImmediateInteger(RegisterID reg)
+{
+    addSlowCase(emitJumpIfNotImmediateInteger(reg));
+}
+
+ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotImmediateIntegers(RegisterID reg1, RegisterID reg2, RegisterID scratch)
+{
+    addSlowCase(emitJumpIfNotImmediateIntegers(reg1, reg2, scratch));
 }
 
 #if !USE(ALTERNATE_JSIMMEDIATE)
 ALWAYS_INLINE void JIT::emitFastArithDeTagImmediate(RegisterID reg)
 {
-    subPtr(Imm32(JSImmediate::TagTypeInteger), reg);
+    subPtr(Imm32(JSImmediate::TagTypeNumber), reg);
 }
 
 ALWAYS_INLINE JIT::Jump JIT::emitFastArithDeTagImmediateJumpIfZero(RegisterID reg)
 {
-    return jzSubPtr(Imm32(JSImmediate::TagTypeInteger), reg);
+    return branchSubPtr(Zero, Imm32(JSImmediate::TagTypeNumber), reg);
 }
 #endif
 
@@ -345,7 +354,7 @@ ALWAYS_INLINE void JIT::emitFastArithReTagImmediate(RegisterID src, RegisterID d
 #else
     if (src != dest)
         move(src, dest);
-    addPtr(Imm32(JSImmediate::TagTypeInteger), dest);
+    addPtr(Imm32(JSImmediate::TagTypeNumber), dest);
 #endif
 }
 
@@ -364,7 +373,7 @@ ALWAYS_INLINE void JIT::emitFastArithIntToImmNoCheck(RegisterID src, RegisterID
 #if USE(ALTERNATE_JSIMMEDIATE)
     if (src != dest)
         move(src, dest);
-    orPtr(ImmPtr(reinterpret_cast<void*>(JSImmediate::TagTypeInteger)), dest);
+    orPtr(tagTypeNumberRegister, dest);
 #else
     signExtend32ToPtr(src, dest);
     addPtr(dest, dest);
@@ -399,6 +408,66 @@ ALWAYS_INLINE void JIT::emitJumpSlowToHot(Jump jump, int relativeOffset)
     jump.linkTo(m_labels[m_bytecodeIndex + relativeOffset], this);
 }
 
+#if ENABLE(SAMPLING_FLAGS)
+ALWAYS_INLINE void JIT::setSamplingFlag(int32_t flag)
+{
+    ASSERT(flag >= 1);
+    ASSERT(flag <= 32);
+    or32(Imm32(1u << (flag - 1)), AbsoluteAddress(&SamplingFlags::s_flags));
+}
+
+ALWAYS_INLINE void JIT::clearSamplingFlag(int32_t flag)
+{
+    ASSERT(flag >= 1);
+    ASSERT(flag <= 32);
+    and32(Imm32(~(1u << (flag - 1))), AbsoluteAddress(&SamplingFlags::s_flags));
+}
+#endif
+
+#if ENABLE(SAMPLING_COUNTERS)
+ALWAYS_INLINE void JIT::emitCount(AbstractSamplingCounter& counter, uint32_t count)
+{
+#if PLATFORM(X86_64) // Or any other 64-bit plattform.
+    addPtr(Imm32(count), AbsoluteAddress(&counter.m_counter));
+#elif PLATFORM(X86) // Or any other little-endian 32-bit plattform.
+    intptr_t hiWord = reinterpret_cast<intptr_t>(&counter.m_counter) + sizeof(int32_t);
+    add32(Imm32(count), AbsoluteAddress(&counter.m_counter));
+    addWithCarry32(Imm32(0), AbsoluteAddress(reinterpret_cast<void*>(hiWord)));
+#else
+#error "SAMPLING_FLAGS not implemented on this platform."
+#endif
+}
+#endif
+
+#if ENABLE(OPCODE_SAMPLING)
+#if PLATFORM(X86_64)
+ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostFunction)
+{
+    move(ImmPtr(m_interpreter->sampler()->sampleSlot()), X86::ecx);
+    storePtr(ImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), X86::ecx);
+}
+#else
+ALWAYS_INLINE void JIT::sampleInstruction(Instruction* instruction, bool inHostFunction)
+{
+    storePtr(ImmPtr(m_interpreter->sampler()->encodeSample(instruction, inHostFunction)), m_interpreter->sampler()->sampleSlot());
+}
+#endif
+#endif
+
+#if ENABLE(CODEBLOCK_SAMPLING)
+#if PLATFORM(X86_64)
+ALWAYS_INLINE void JIT::sampleCodeBlock(CodeBlock* codeBlock)
+{
+    move(ImmPtr(m_interpreter->sampler()->codeBlockSlot()), X86::ecx);
+    storePtr(ImmPtr(codeBlock), X86::ecx);
+}
+#else
+ALWAYS_INLINE void JIT::sampleCodeBlock(CodeBlock* codeBlock)
+{
+    storePtr(ImmPtr(codeBlock), m_interpreter->sampler()->codeBlockSlot());
+}
+#endif
+#endif
 }
 
 #endif // ENABLE(JIT)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
new file mode 100644
index 0000000..dbcb34d
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITOpcodes.cpp
@@ -0,0 +1,1183 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JIT.h"
+
+#if ENABLE(JIT)
+
+#include "JITInlineMethods.h"
+#include "JITStubCall.h"
+#include "JSArray.h"
+#include "JSCell.h"
+
+namespace JSC {
+
+#define RECORD_JUMP_TARGET(targetOffset) \
+   do { m_labels[m_bytecodeIndex + (targetOffset)].used(); } while (false)
+
+void JIT::emit_op_mov(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int src = currentInstruction[2].u.operand;
+
+    if (m_codeBlock->isConstantRegisterIndex(src)) {
+        storePtr(ImmPtr(JSValue::encode(getConstantOperand(src))), Address(callFrameRegister, dst * sizeof(Register)));
+        if (dst == m_lastResultBytecodeRegister)
+            killLastResultRegister();
+    } else if ((src == m_lastResultBytecodeRegister) || (dst == m_lastResultBytecodeRegister)) {
+        // If either the src or dst is the cached register go though
+        // get/put registers to make sure we track this correctly.
+        emitGetVirtualRegister(src, regT0);
+        emitPutVirtualRegister(dst);
+    } else {
+        // Perform the copy via regT1; do not disturb any mapping in regT0.
+        loadPtr(Address(callFrameRegister, src * sizeof(Register)), regT1);
+        storePtr(regT1, Address(callFrameRegister, dst * sizeof(Register)));
+    }
+}
+
+void JIT::emit_op_end(Instruction* currentInstruction)
+{
+    if (m_codeBlock->needsFullScopeChain())
+        JITStubCall(this, JITStubs::cti_op_end).call();
+    ASSERT(returnValueRegister != callFrameRegister);
+    emitGetVirtualRegister(currentInstruction[1].u.operand, returnValueRegister);
+    restoreReturnAddressBeforeReturn(Address(callFrameRegister, RegisterFile::ReturnPC * static_cast<int>(sizeof(Register))));
+    ret();
+}
+
+void JIT::emit_op_jmp(Instruction* currentInstruction)
+{
+    unsigned target = currentInstruction[1].u.operand;
+    addJump(jump(), target + 1);
+    RECORD_JUMP_TARGET(target + 1);
+}
+
+void JIT::emit_op_loop(Instruction* currentInstruction)
+{
+    emitTimeoutCheck();
+
+    unsigned target = currentInstruction[1].u.operand;
+    addJump(jump(), target + 1);
+}
+
+void JIT::emit_op_loop_if_less(Instruction* currentInstruction)
+{
+    emitTimeoutCheck();
+
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+    if (isOperandConstantImmediateInt(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+#if USE(ALTERNATE_JSIMMEDIATE)
+        int32_t op2imm = getConstantOperandImmediateInt(op2);
+#else
+        int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
+#endif
+        addJump(branch32(LessThan, regT0, Imm32(op2imm)), target + 3);
+    } else if (isOperandConstantImmediateInt(op1)) {
+        emitGetVirtualRegister(op2, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+#if USE(ALTERNATE_JSIMMEDIATE)
+        int32_t op1imm = getConstantOperandImmediateInt(op1);
+#else
+        int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
+#endif
+        addJump(branch32(GreaterThan, regT0, Imm32(op1imm)), target + 3);
+    } else {
+        emitGetVirtualRegisters(op1, regT0, op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
+        addJump(branch32(LessThan, regT0, regT1), target + 3);
+    }
+}
+
+void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
+{
+    emitTimeoutCheck();
+
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+    if (isOperandConstantImmediateInt(op2)) {
+        emitGetVirtualRegister(op1, regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+#if USE(ALTERNATE_JSIMMEDIATE)
+        int32_t op2imm = getConstantOperandImmediateInt(op2);
+#else
+        int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
+#endif
+        addJump(branch32(LessThanOrEqual, regT0, Imm32(op2imm)), target + 3);
+    } else {
+        emitGetVirtualRegisters(op1, regT0, op2, regT1);
+        emitJumpSlowCaseIfNotImmediateInteger(regT0);
+        emitJumpSlowCaseIfNotImmediateInteger(regT1);
+        addJump(branch32(LessThanOrEqual, regT0, regT1), target + 3);
+    }
+}
+
+void JIT::emit_op_new_object(Instruction* currentInstruction)
+{
+    JITStubCall(this, JITStubs::cti_op_new_object).call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_instanceof(Instruction* currentInstruction)
+{
+    // Load the operands (baseVal, proto, and value respectively) into registers.
+    // We use regT0 for baseVal since we will be done with this first, and we can then use it for the result.
+    emitGetVirtualRegister(currentInstruction[3].u.operand, regT0);
+    emitGetVirtualRegister(currentInstruction[4].u.operand, regT1);
+    emitGetVirtualRegister(currentInstruction[2].u.operand, regT2);
+
+    // Check that baseVal & proto are cells.
+    emitJumpSlowCaseIfNotJSCell(regT0);
+    emitJumpSlowCaseIfNotJSCell(regT1);
+
+    // Check that baseVal is an object, that it 'ImplementsHasInstance' but that it does not 'OverridesHasInstance'.
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
+    addSlowCase(branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+    addSlowCase(branchTest32(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));
+
+    // If value is not an Object, return false.
+    Jump valueIsImmediate = emitJumpIfNotJSCell(regT2);
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
+    Jump valueIsNotObject = branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType));
+
+    // Check proto is object.
+    loadPtr(Address(regT1, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);
+    addSlowCase(branch32(NotEqual, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
+
+    // Optimistically load the result true, and start looping.
+    // Initially, regT1 still contains proto and regT2 still contains value.
+    // As we loop regT2 will be updated with its prototype, recursively walking the prototype chain.
+    move(ImmPtr(JSValue::encode(jsBoolean(true))), regT0);
+    Label loop(this);
+
+    // Load the prototype of the object in regT2.  If this is equal to regT1 - WIN!
+    // Otherwise, check if we've hit null - if we have then drop out of the loop, if not go again.
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
+    Jump isInstance = branchPtr(Equal, regT2, regT1);
+    branchPtr(NotEqual, regT2, ImmPtr(JSValue::encode(jsNull())), loop);
+
+    // We get here either by dropping out of the loop, or if value was not an Object.  Result is false.
+    valueIsImmediate.link(this);
+    valueIsNotObject.link(this);
+    move(ImmPtr(JSValue::encode(jsBoolean(false))), regT0);
+
+    // isInstance jumps right down to here, to skip setting the result to false (it has already set true).
+    isInstance.link(this);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_new_func(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_new_func);
+    stubCall.addArgument(ImmPtr(m_codeBlock->function(currentInstruction[2].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_call(Instruction* currentInstruction)
+{
+    compileOpCall(op_call, currentInstruction, m_callLinkInfoIndex++);
+}
+
+void JIT::emit_op_call_eval(Instruction* currentInstruction)
+{
+    compileOpCall(op_call_eval, currentInstruction, m_callLinkInfoIndex++);
+}
+
+void JIT::emit_op_load_varargs(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_load_varargs);
+    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_call_varargs(Instruction* currentInstruction)
+{
+    compileOpCallVarargs(currentInstruction);
+}
+
+void JIT::emit_op_construct(Instruction* currentInstruction)
+{
+    compileOpCall(op_construct, currentInstruction, m_callLinkInfoIndex++);
+}
+
+void JIT::emit_op_get_global_var(Instruction* currentInstruction)
+{
+    JSVariableObject* globalObject = static_cast<JSVariableObject*>(currentInstruction[2].u.jsCell);
+    move(ImmPtr(globalObject), regT0);
+    emitGetVariableObjectRegister(regT0, currentInstruction[3].u.operand, regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_put_global_var(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[3].u.operand, regT1);
+    JSVariableObject* globalObject = static_cast<JSVariableObject*>(currentInstruction[1].u.jsCell);
+    move(ImmPtr(globalObject), regT0);
+    emitPutVariableObjectRegister(regT1, regT0, currentInstruction[2].u.operand);
+}
+
+void JIT::emit_op_get_scoped_var(Instruction* currentInstruction)
+{
+    int skip = currentInstruction[3].u.operand + m_codeBlock->needsFullScopeChain();
+
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT0);
+    while (skip--)
+        loadPtr(Address(regT0, OBJECT_OFFSETOF(ScopeChainNode, next)), regT0);
+
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(ScopeChainNode, object)), regT0);
+    emitGetVariableObjectRegister(regT0, currentInstruction[2].u.operand, regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_put_scoped_var(Instruction* currentInstruction)
+{
+    int skip = currentInstruction[2].u.operand + m_codeBlock->needsFullScopeChain();
+
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1);
+    emitGetVirtualRegister(currentInstruction[3].u.operand, regT0);
+    while (skip--)
+        loadPtr(Address(regT1, OBJECT_OFFSETOF(ScopeChainNode, next)), regT1);
+
+    loadPtr(Address(regT1, OBJECT_OFFSETOF(ScopeChainNode, object)), regT1);
+    emitPutVariableObjectRegister(regT0, regT1, currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_tear_off_activation(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_tear_off_activation);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT2);
+    stubCall.call();
+}
+
+void JIT::emit_op_tear_off_arguments(Instruction*)
+{
+    JITStubCall(this, JITStubs::cti_op_tear_off_arguments).call();
+}
+
+void JIT::emit_op_ret(Instruction* currentInstruction)
+{
+    // We could JIT generate the deref, only calling out to C when the refcount hits zero.
+    if (m_codeBlock->needsFullScopeChain())
+        JITStubCall(this, JITStubs::cti_op_ret_scopeChain).call();
+
+    ASSERT(callFrameRegister != regT1);
+    ASSERT(regT1 != returnValueRegister);
+    ASSERT(returnValueRegister != callFrameRegister);
+
+    // Return the result in %eax.
+    emitGetVirtualRegister(currentInstruction[1].u.operand, returnValueRegister);
+
+    // Grab the return address.
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);
+
+    // Restore our caller's "r".
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
+
+    // Return.
+    restoreReturnAddressBeforeReturn(regT1);
+    ret();
+}
+
+void JIT::emit_op_new_array(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_new_array);
+    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_resolve(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_resolve);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_construct_verify(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+
+    emitJumpSlowCaseIfNotJSCell(regT0);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    addSlowCase(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType)));
+
+}
+
+void JIT::emit_op_to_primitive(Instruction* currentInstruction)
+{
+    int dst = currentInstruction[1].u.operand;
+    int src = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(src, regT0);
+    
+    Jump isImm = emitJumpIfNotJSCell(regT0);
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr)));
+    isImm.link(this);
+
+    if (dst != src)
+        emitPutVirtualRegister(dst);
+
+}
+
+void JIT::emit_op_strcat(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_strcat);
+    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_resolve_func(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_resolve_func);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
+    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
+    stubCall.call(currentInstruction[2].u.operand);
+}
+
+void JIT::emit_op_loop_if_true(Instruction* currentInstruction)
+{
+    emitTimeoutCheck();
+
+    unsigned target = currentInstruction[2].u.operand;
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+
+    Jump isZero = branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0))));
+    addJump(emitJumpIfImmediateInteger(regT0), target + 2);
+
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target + 2);
+    addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))));
+
+    isZero.link(this);
+};
+void JIT::emit_op_resolve_base(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_resolve_base);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_resolve_skip(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_resolve_skip);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(Imm32(currentInstruction[3].u.operand + m_codeBlock->needsFullScopeChain()));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_resolve_global(Instruction* currentInstruction)
+{
+    // Fast case
+    void* globalObject = currentInstruction[2].u.jsCell;
+    Identifier* ident = &m_codeBlock->identifier(currentInstruction[3].u.operand);
+    
+    unsigned currentIndex = m_globalResolveInfoIndex++;
+    void* structureAddress = &(m_codeBlock->globalResolveInfo(currentIndex).structure);
+    void* offsetAddr = &(m_codeBlock->globalResolveInfo(currentIndex).offset);
+
+    // Check Structure of global object
+    move(ImmPtr(globalObject), regT0);
+    loadPtr(structureAddress, regT1);
+    Jump noMatch = branchPtr(NotEqual, regT1, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure))); // Structures don't match
+
+    // Load cached property
+    // Assume that the global object always uses external storage.
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSGlobalObject, m_externalStorage)), regT0);
+    load32(offsetAddr, regT1);
+    loadPtr(BaseIndex(regT0, regT1, ScalePtr), regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+    Jump end = jump();
+
+    // Slow case
+    noMatch.link(this);
+    JITStubCall stubCall(this, JITStubs::cti_op_resolve_global);
+    stubCall.addArgument(ImmPtr(globalObject));
+    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(Imm32(currentIndex));
+    stubCall.call(currentInstruction[1].u.operand);
+    end.link(this);
+}
+
+void JIT::emit_op_not(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
+    xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), regT0);
+    addSlowCase(branchTestPtr(NonZero, regT0, Imm32(static_cast<int32_t>(~JSImmediate::ExtendedPayloadBitBoolValue))));
+    xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool | JSImmediate::ExtendedPayloadBitBoolValue)), regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_jfalse(Instruction* currentInstruction)
+{
+    unsigned target = currentInstruction[2].u.operand;
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0)))), target + 2);
+    Jump isNonZero = emitJumpIfImmediateInteger(regT0);
+
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))), target + 2);
+    addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))));
+
+    isNonZero.link(this);
+    RECORD_JUMP_TARGET(target + 2);
+};
+void JIT::emit_op_jeq_null(Instruction* currentInstruction)
+{
+    unsigned src = currentInstruction[1].u.operand;
+    unsigned target = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(src, regT0);
+    Jump isImmediate = emitJumpIfNotJSCell(regT0);
+
+    // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    addJump(branchTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
+    Jump wasNotImmediate = jump();
+
+    // Now handle the immediate cases - undefined & null
+    isImmediate.link(this);
+    andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNull()))), target + 2);            
+
+    wasNotImmediate.link(this);
+    RECORD_JUMP_TARGET(target + 2);
+};
+void JIT::emit_op_jneq_null(Instruction* currentInstruction)
+{
+    unsigned src = currentInstruction[1].u.operand;
+    unsigned target = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(src, regT0);
+    Jump isImmediate = emitJumpIfNotJSCell(regT0);
+
+    // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    addJump(branchTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined)), target + 2);
+    Jump wasNotImmediate = jump();
+
+    // Now handle the immediate cases - undefined & null
+    isImmediate.link(this);
+    andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
+    addJump(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsNull()))), target + 2);            
+
+    wasNotImmediate.link(this);
+    RECORD_JUMP_TARGET(target + 2);
+}
+
+void JIT::emit_op_jneq_ptr(Instruction* currentInstruction)
+{
+    unsigned src = currentInstruction[1].u.operand;
+    JSCell* ptr = currentInstruction[2].u.jsCell;
+    unsigned target = currentInstruction[3].u.operand;
+    
+    emitGetVirtualRegister(src, regT0);
+    addJump(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(JSValue(ptr)))), target + 3);            
+
+    RECORD_JUMP_TARGET(target + 3);
+}
+
+void JIT::emit_op_unexpected_load(Instruction* currentInstruction)
+{
+    JSValue v = m_codeBlock->unexpectedConstant(currentInstruction[2].u.operand);
+    move(ImmPtr(JSValue::encode(v)), regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_jsr(Instruction* currentInstruction)
+{
+    int retAddrDst = currentInstruction[1].u.operand;
+    int target = currentInstruction[2].u.operand;
+    DataLabelPtr storeLocation = storePtrWithPatch(ImmPtr(0), Address(callFrameRegister, sizeof(Register) * retAddrDst));
+    addJump(jump(), target + 2);
+    m_jsrSites.append(JSRInfo(storeLocation, label()));
+    killLastResultRegister();
+    RECORD_JUMP_TARGET(target + 2);
+}
+
+void JIT::emit_op_sret(Instruction* currentInstruction)
+{
+    jump(Address(callFrameRegister, sizeof(Register) * currentInstruction[1].u.operand));
+    killLastResultRegister();
+}
+
+void JIT::emit_op_eq(Instruction* currentInstruction)
+{
+    emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
+    emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
+    set32(Equal, regT1, regT0, regT0);
+    emitTagAsBoolImmediate(regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_bitnot(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
+    emitJumpSlowCaseIfNotImmediateInteger(regT0);
+#if USE(ALTERNATE_JSIMMEDIATE)
+    not32(regT0);
+    emitFastArithIntToImmNoCheck(regT0, regT0);
+#else
+    xorPtr(Imm32(~JSImmediate::TagTypeNumber), regT0);
+#endif
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_resolve_with_base(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_resolve_with_base);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
+    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
+    stubCall.call(currentInstruction[2].u.operand);
+}
+
+void JIT::emit_op_new_func_exp(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_new_func_exp);
+    stubCall.addArgument(ImmPtr(m_codeBlock->functionExpression(currentInstruction[2].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_jtrue(Instruction* currentInstruction)
+{
+    unsigned target = currentInstruction[2].u.operand;
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+
+    Jump isZero = branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0))));
+    addJump(emitJumpIfImmediateInteger(regT0), target + 2);
+
+    addJump(branchPtr(Equal, regT0, ImmPtr(JSValue::encode(jsBoolean(true)))), target + 2);
+    addSlowCase(branchPtr(NotEqual, regT0, ImmPtr(JSValue::encode(jsBoolean(false)))));
+
+    isZero.link(this);
+    RECORD_JUMP_TARGET(target + 2);
+}
+
+void JIT::emit_op_neq(Instruction* currentInstruction)
+{
+    emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
+    emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
+    set32(NotEqual, regT1, regT0, regT0);
+    emitTagAsBoolImmediate(regT0);
+
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+
+}
+
+void JIT::emit_op_bitxor(Instruction* currentInstruction)
+{
+    emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
+    emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
+    xorPtr(regT1, regT0);
+    emitFastArithReTagImmediate(regT0, regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_new_regexp(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_new_regexp);
+    stubCall.addArgument(ImmPtr(m_codeBlock->regexp(currentInstruction[2].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_bitor(Instruction* currentInstruction)
+{
+    emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
+    emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
+    orPtr(regT1, regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_throw(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_throw);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT2);
+    stubCall.call();
+    ASSERT(regT0 == returnValueRegister);
+#ifndef NDEBUG
+    // cti_op_throw always changes it's return address,
+    // this point in the code should never be reached.
+    breakpoint();
+#endif
+}
+
+void JIT::emit_op_next_pname(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_next_pname);
+    stubCall.addArgument(currentInstruction[2].u.operand, regT2);
+    stubCall.call();
+    Jump endOfIter = branchTestPtr(Zero, regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+    addJump(jump(), currentInstruction[3].u.operand + 3);
+    endOfIter.link(this);
+}
+
+void JIT::emit_op_push_scope(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_push_scope);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT2);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_pop_scope(Instruction*)
+{
+    JITStubCall(this, JITStubs::cti_op_pop_scope).call();
+}
+
+void JIT::emit_op_stricteq(Instruction* currentInstruction)
+{
+    compileOpStrictEq(currentInstruction, OpStrictEq);
+}
+
+void JIT::emit_op_nstricteq(Instruction* currentInstruction)
+{
+    compileOpStrictEq(currentInstruction, OpNStrictEq);
+}
+
+void JIT::emit_op_to_jsnumber(Instruction* currentInstruction)
+{
+    int srcVReg = currentInstruction[2].u.operand;
+    emitGetVirtualRegister(srcVReg, regT0);
+    
+    Jump wasImmediate = emitJumpIfImmediateInteger(regT0);
+
+    emitJumpSlowCaseIfNotJSCell(regT0, srcVReg);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    addSlowCase(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(NumberType)));
+    
+    wasImmediate.link(this);
+
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_push_new_scope(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_push_new_scope);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(currentInstruction[3].u.operand, regT2);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_catch(Instruction* currentInstruction)
+{
+    killLastResultRegister(); // FIXME: Implicitly treat op_catch as a labeled statement, and remove this line of code.
+    peek(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof (void*));
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_jmp_scopes(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_jmp_scopes);
+    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
+    stubCall.call();
+    addJump(jump(), currentInstruction[2].u.operand + 2);
+    RECORD_JUMP_TARGET(currentInstruction[2].u.operand + 2);
+}
+
+void JIT::emit_op_switch_imm(Instruction* currentInstruction)
+{
+    unsigned tableIndex = currentInstruction[1].u.operand;
+    unsigned defaultOffset = currentInstruction[2].u.operand;
+    unsigned scrutinee = currentInstruction[3].u.operand;
+
+    // create jump table for switch destinations, track this switch statement.
+    SimpleJumpTable* jumpTable = &m_codeBlock->immediateSwitchJumpTable(tableIndex);
+    m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset, SwitchRecord::Immediate));
+    jumpTable->ctiOffsets.grow(jumpTable->branchOffsets.size());
+
+    JITStubCall stubCall(this, JITStubs::cti_op_switch_imm);
+    stubCall.addArgument(scrutinee, regT2);
+    stubCall.addArgument(Imm32(tableIndex));
+    stubCall.call();
+    jump(regT0);
+}
+
+void JIT::emit_op_switch_char(Instruction* currentInstruction)
+{
+    unsigned tableIndex = currentInstruction[1].u.operand;
+    unsigned defaultOffset = currentInstruction[2].u.operand;
+    unsigned scrutinee = currentInstruction[3].u.operand;
+
+    // create jump table for switch destinations, track this switch statement.
+    SimpleJumpTable* jumpTable = &m_codeBlock->characterSwitchJumpTable(tableIndex);
+    m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset, SwitchRecord::Character));
+    jumpTable->ctiOffsets.grow(jumpTable->branchOffsets.size());
+
+    JITStubCall stubCall(this, JITStubs::cti_op_switch_char);
+    stubCall.addArgument(scrutinee, regT2);
+    stubCall.addArgument(Imm32(tableIndex));
+    stubCall.call();
+    jump(regT0);
+}
+
+void JIT::emit_op_switch_string(Instruction* currentInstruction)
+{
+    unsigned tableIndex = currentInstruction[1].u.operand;
+    unsigned defaultOffset = currentInstruction[2].u.operand;
+    unsigned scrutinee = currentInstruction[3].u.operand;
+
+    // create jump table for switch destinations, track this switch statement.
+    StringJumpTable* jumpTable = &m_codeBlock->stringSwitchJumpTable(tableIndex);
+    m_switches.append(SwitchRecord(jumpTable, m_bytecodeIndex, defaultOffset));
+
+    JITStubCall stubCall(this, JITStubs::cti_op_switch_string);
+    stubCall.addArgument(scrutinee, regT2);
+    stubCall.addArgument(Imm32(tableIndex));
+    stubCall.call();
+    jump(regT0);
+}
+
+void JIT::emit_op_new_error(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_new_error);
+    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(ImmPtr(JSValue::encode(m_codeBlock->unexpectedConstant(currentInstruction[3].u.operand))));
+    stubCall.addArgument(Imm32(m_bytecodeIndex));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_debug(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_debug);
+    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
+    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(Imm32(currentInstruction[3].u.operand));
+    stubCall.call();
+}
+
+void JIT::emit_op_eq_null(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned src1 = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(src1, regT0);
+    Jump isImmediate = emitJumpIfNotJSCell(regT0);
+
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    setTest32(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
+
+    Jump wasNotImmediate = jump();
+
+    isImmediate.link(this);
+
+    andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
+    setPtr(Equal, regT0, Imm32(JSImmediate::FullTagTypeNull), regT0);
+
+    wasNotImmediate.link(this);
+
+    emitTagAsBoolImmediate(regT0);
+    emitPutVirtualRegister(dst);
+
+}
+
+void JIT::emit_op_neq_null(Instruction* currentInstruction)
+{
+    unsigned dst = currentInstruction[1].u.operand;
+    unsigned src1 = currentInstruction[2].u.operand;
+
+    emitGetVirtualRegister(src1, regT0);
+    Jump isImmediate = emitJumpIfNotJSCell(regT0);
+
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    setTest32(Zero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(MasqueradesAsUndefined), regT0);
+
+    Jump wasNotImmediate = jump();
+
+    isImmediate.link(this);
+
+    andPtr(Imm32(~JSImmediate::ExtendedTagBitUndefined), regT0);
+    setPtr(NotEqual, regT0, Imm32(JSImmediate::FullTagTypeNull), regT0);
+
+    wasNotImmediate.link(this);
+
+    emitTagAsBoolImmediate(regT0);
+    emitPutVirtualRegister(dst);
+
+}
+
+void JIT::emit_op_enter(Instruction*)
+{
+    // Even though CTI doesn't use them, we initialize our constant
+    // registers to zap stale pointers, to avoid unnecessarily prolonging
+    // object lifetime and increasing GC pressure.
+    size_t count = m_codeBlock->m_numVars + m_codeBlock->numberOfConstantRegisters();
+    for (size_t j = 0; j < count; ++j)
+        emitInitRegister(j);
+
+}
+
+void JIT::emit_op_enter_with_activation(Instruction* currentInstruction)
+{
+    // Even though CTI doesn't use them, we initialize our constant
+    // registers to zap stale pointers, to avoid unnecessarily prolonging
+    // object lifetime and increasing GC pressure.
+    size_t count = m_codeBlock->m_numVars + m_codeBlock->numberOfConstantRegisters();
+    for (size_t j = 0; j < count; ++j)
+        emitInitRegister(j);
+
+    JITStubCall(this, JITStubs::cti_op_push_activation).call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_create_arguments(Instruction*)
+{
+    Jump argsCreated = branchTestPtr(NonZero, Address(callFrameRegister, sizeof(Register) * RegisterFile::ArgumentsRegister));
+    if (m_codeBlock->m_numParameters == 1)
+        JITStubCall(this, JITStubs::cti_op_create_arguments_no_params).call();
+    else
+        JITStubCall(this, JITStubs::cti_op_create_arguments).call();
+    argsCreated.link(this);
+}
+    
+void JIT::emit_op_init_arguments(Instruction*)
+{
+    storePtr(ImmPtr(0), Address(callFrameRegister, sizeof(Register) * RegisterFile::ArgumentsRegister));
+}
+
+void JIT::emit_op_convert_this(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+
+    emitJumpSlowCaseIfNotJSCell(regT0);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT1);
+    addSlowCase(branchTest32(NonZero, Address(regT1, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
+
+}
+
+void JIT::emit_op_profile_will_call(Instruction* currentInstruction)
+{
+    peek(regT1, OBJECT_OFFSETOF(JITStackFrame, enabledProfilerReference) / sizeof (void*));
+    Jump noProfiler = branchTestPtr(Zero, Address(regT1));
+
+    JITStubCall stubCall(this, JITStubs::cti_op_profile_will_call);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT1);
+    stubCall.call();
+    noProfiler.link(this);
+
+}
+
+void JIT::emit_op_profile_did_call(Instruction* currentInstruction)
+{
+    peek(regT1, OBJECT_OFFSETOF(JITStackFrame, enabledProfilerReference) / sizeof (void*));
+    Jump noProfiler = branchTestPtr(Zero, Address(regT1));
+
+    JITStubCall stubCall(this, JITStubs::cti_op_profile_did_call);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT1);
+    stubCall.call();
+    noProfiler.link(this);
+}
+
+
+// Slow cases
+
+void JIT::emitSlow_op_convert_this(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_convert_this);
+    stubCall.addArgument(regT0);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_construct_verify(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_to_primitive(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+
+    JITStubCall stubCall(this, JITStubs::cti_op_to_primitive);
+    stubCall.addArgument(regT0);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_get_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    // The slow void JIT::emitSlow_that handles accesses to arrays (below) may jump back up to here. 
+    Label beginGetByValSlow(this);
+
+    Jump notImm = getSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    emitFastArithIntToImmNoCheck(regT1, regT1);
+
+    notImm.link(this);
+    JITStubCall stubCall(this, JITStubs::cti_op_get_by_val);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(currentInstruction[1].u.operand);
+    emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_get_by_val));
+
+    // This is slow void JIT::emitSlow_that handles accesses to arrays above the fast cut-off.
+    // First, check if this is an access to the vector
+    linkSlowCase(iter);
+    branch32(AboveOrEqual, regT1, Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_vectorLength)), beginGetByValSlow);
+
+    // okay, missed the fast region, but it is still in the vector.  Get the value.
+    loadPtr(BaseIndex(regT2, regT1, ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT2);
+    // Check whether the value loaded is zero; if so we need to return undefined.
+    branchTestPtr(Zero, regT2, beginGetByValSlow);
+    move(regT2, regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand, regT0);
+}
+
+void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned op1 = currentInstruction[1].u.operand;
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+    if (isOperandConstantImmediateInt(op2)) {
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, JITStubs::cti_op_loop_if_less);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(op2, regT2);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+    } else if (isOperandConstantImmediateInt(op1)) {
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, JITStubs::cti_op_loop_if_less);
+        stubCall.addArgument(op1, regT2);
+        stubCall.addArgument(regT0);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+    } else {
+        linkSlowCase(iter);
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, JITStubs::cti_op_loop_if_less);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+    }
+}
+
+void JIT::emitSlow_op_loop_if_lesseq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned op2 = currentInstruction[2].u.operand;
+    unsigned target = currentInstruction[3].u.operand;
+    if (isOperandConstantImmediateInt(op2)) {
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, JITStubs::cti_op_loop_if_lesseq);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(currentInstruction[2].u.operand, regT2);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+    } else {
+        linkSlowCase(iter);
+        linkSlowCase(iter);
+        JITStubCall stubCall(this, JITStubs::cti_op_loop_if_lesseq);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(regT1);
+        stubCall.call();
+        emitJumpSlowToHot(branchTest32(NonZero, regT0), target + 3);
+    }
+}
+
+void JIT::emitSlow_op_put_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    // Normal slow cases - either is not an immediate imm, or is an array.
+    Jump notImm = getSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    emitFastArithIntToImmNoCheck(regT1, regT1);
+
+    notImm.link(this); {
+        JITStubCall stubCall(this, JITStubs::cti_op_put_by_val);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(currentInstruction[3].u.operand, regT2);
+        stubCall.call();
+        emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_put_by_val));
+    }
+
+    // slow cases for immediate int accesses to arrays
+    linkSlowCase(iter);
+    linkSlowCase(iter); {
+        JITStubCall stubCall(this, JITStubs::cti_op_put_by_val_array);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(regT1);
+        stubCall.addArgument(currentInstruction[3].u.operand, regT2);
+        stubCall.call();
+    }
+}
+
+void JIT::emitSlow_op_loop_if_true(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_jtrue);
+    stubCall.addArgument(regT0);
+    stubCall.call();
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand + 2);
+}
+
+void JIT::emitSlow_op_not(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    xorPtr(Imm32(static_cast<int32_t>(JSImmediate::FullTagTypeBool)), regT0);
+    JITStubCall stubCall(this, JITStubs::cti_op_not);
+    stubCall.addArgument(regT0);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_jfalse(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_jtrue);
+    stubCall.addArgument(regT0);
+    stubCall.call();
+    emitJumpSlowToHot(branchTest32(Zero, regT0), currentInstruction[2].u.operand + 2); // inverted!
+}
+
+void JIT::emitSlow_op_bitnot(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_bitnot);
+    stubCall.addArgument(regT0);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_jtrue(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_jtrue);
+    stubCall.addArgument(regT0);
+    stubCall.call();
+    emitJumpSlowToHot(branchTest32(NonZero, regT0), currentInstruction[2].u.operand + 2);
+}
+
+void JIT::emitSlow_op_bitxor(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_bitxor);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_bitor(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_bitor);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_eq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_eq);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_neq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_neq);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_stricteq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_stricteq);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_nstricteq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_nstricteq);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(regT1);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_instanceof(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, JITStubs::cti_op_instanceof);
+    stubCall.addArgument(currentInstruction[2].u.operand, regT2);
+    stubCall.addArgument(currentInstruction[3].u.operand, regT2);
+    stubCall.addArgument(currentInstruction[4].u.operand, regT2);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emitSlow_op_call(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(currentInstruction, iter, m_callLinkInfoIndex++, op_call);
+}
+
+void JIT::emitSlow_op_call_eval(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(currentInstruction, iter, m_callLinkInfoIndex++, op_call_eval);
+}
+
+void JIT::emitSlow_op_call_varargs(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallVarargsSlowCase(currentInstruction, iter);
+}
+
+void JIT::emitSlow_op_construct(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    compileOpCallSlowCase(currentInstruction, iter, m_callLinkInfoIndex++, op_construct);
+}
+
+void JIT::emitSlow_op_to_jsnumber(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCaseIfNotJSCell(iter, currentInstruction[2].u.operand);
+    linkSlowCase(iter);
+
+    JITStubCall stubCall(this, JITStubs::cti_op_to_jsnumber);
+    stubCall.addArgument(regT0);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
index 6740bec..ed8f48f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -30,6 +30,7 @@
 
 #include "CodeBlock.h"
 #include "JITInlineMethods.h"
+#include "JITStubCall.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "Interpreter.h"
@@ -44,81 +45,273 @@ using namespace std;
 
 namespace JSC {
 
-#if !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+void JIT::emit_op_get_by_val(Instruction* currentInstruction)
+{
+    emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
+    emitJumpSlowCaseIfNotImmediateInteger(regT1);
+#if USE(ALTERNATE_JSIMMEDIATE)
+    // This is technically incorrect - we're zero-extending an int32.  On the hot path this doesn't matter.
+    // We check the value as if it was a uint32 against the m_fastAccessCutoff - which will always fail if
+    // number was signed since m_fastAccessCutoff is always less than intmax (since the total allocation
+    // size is always less than 4Gb).  As such zero extending wil have been correct (and extending the value
+    // to 64-bits is necessary since it's used in the address calculation.  We zero extend rather than sign
+    // extending since it makes it easier to re-tag the value in the slow case.
+    zeroExtend32ToPtr(regT1, regT1);
+#else
+    emitFastArithImmToInt(regT1);
+#endif
+    emitJumpSlowCaseIfNotJSCell(regT0);
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
+
+    // This is an array; get the m_storage pointer into ecx, then check if the index is below the fast cutoff
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT2);
+    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT0, OBJECT_OFFSETOF(JSArray, m_fastAccessCutoff))));
 
-void JIT::compileGetByIdHotPath(int resultVReg, int baseVReg, Identifier* ident, unsigned)
+    // Get the value from the vector
+    loadPtr(BaseIndex(regT2, regT1, ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])), regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_put_by_val(Instruction* currentInstruction)
 {
-    // As for put_by_id, get_by_id requires the offset of the Structure and the offset of the access to be patched.
-    // Additionally, for get_by_id we need patch the offset of the branch to the slow case (we patch this to jump
-    // to array-length / prototype access tranpolines, and finally we also the the property-map access offset as a label
-    // to jump back to if one of these trampolies finds a match.
+    emitGetVirtualRegisters(currentInstruction[1].u.operand, regT0, currentInstruction[2].u.operand, regT1);
+    emitJumpSlowCaseIfNotImmediateInteger(regT1);
+#if USE(ALTERNATE_JSIMMEDIATE)
+    // See comment in op_get_by_val.
+    zeroExtend32ToPtr(regT1, regT1);
+#else
+    emitFastArithImmToInt(regT1);
+#endif
+    emitJumpSlowCaseIfNotJSCell(regT0);
+    addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
+
+    // This is an array; get the m_storage pointer into ecx, then check if the index is below the fast cutoff
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT2);
+    Jump inFastVector = branch32(Below, regT1, Address(regT0, OBJECT_OFFSETOF(JSArray, m_fastAccessCutoff)));
+    // No; oh well, check if the access if within the vector - if so, we may still be okay.
+    addSlowCase(branch32(AboveOrEqual, regT1, Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_vectorLength))));
+
+    // This is a write to the slow part of the vector; first, we have to check if this would be the first write to this location.
+    // FIXME: should be able to handle initial write to array; increment the the number of items in the array, and potentially update fast access cutoff. 
+    addSlowCase(branchTestPtr(Zero, BaseIndex(regT2, regT1, ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0]))));
+
+    // All good - put the value into the array.
+    inFastVector.link(this);
+    emitGetVirtualRegister(currentInstruction[3].u.operand, regT0);
+    storePtr(regT0, BaseIndex(regT2, regT1, ScalePtr, OBJECT_OFFSETOF(ArrayStorage, m_vector[0])));
+}
 
-    emitGetVirtualRegister(baseVReg, X86::eax);
+void JIT::emit_op_put_by_index(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_put_by_index);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT2);
+    stubCall.addArgument(Imm32(currentInstruction[2].u.operand));
+    stubCall.addArgument(currentInstruction[3].u.operand, regT2);
+    stubCall.call();
+}
 
-    emitPutJITStubArg(X86::eax, 1);
-    emitPutJITStubArgConstant(ident, 2);
-    emitCTICall(Interpreter::cti_op_get_by_id_generic);
-    emitPutVirtualRegister(resultVReg);
+void JIT::emit_op_put_getter(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_put_getter);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT2);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(currentInstruction[3].u.operand, regT2);
+    stubCall.call();
 }
 
+void JIT::emit_op_put_setter(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_put_setter);
+    stubCall.addArgument(currentInstruction[1].u.operand, regT2);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.addArgument(currentInstruction[3].u.operand, regT2);
+    stubCall.call();
+}
 
-void JIT::compileGetByIdSlowCase(int, int, Identifier*, Vector<SlowCaseEntry>::iterator&, unsigned)
+void JIT::emit_op_del_by_id(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, JITStubs::cti_op_del_by_id);
+    stubCall.addArgument(currentInstruction[2].u.operand, regT2);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[3].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+
+#if !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+
+/* ------------------------------ BEGIN: !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
+
+// Treat these as nops - the call will be handed as a regular get_by_id/op_call pair.
+void JIT::emit_op_method_check(Instruction*) {}
+void JIT::emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&) { ASSERT_NOT_REACHED(); }
+#if ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
+#error "JIT_OPTIMIZE_METHOD_CALLS requires JIT_OPTIMIZE_PROPERTY_ACCESS"
+#endif
+
+void JIT::emit_op_get_by_id(Instruction* currentInstruction)
+{
+    unsigned resultVReg = currentInstruction[1].u.operand;
+    unsigned baseVReg = currentInstruction[2].u.operand;
+    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
+
+    emitGetVirtualRegister(baseVReg, regT0);
+    JITStubCall stubCall(this, JITStubs::cti_op_get_by_id_generic);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(ImmPtr(ident));
+    stubCall.call(resultVReg);
+
+    m_propertyAccessInstructionIndex++;
+}
+
+void JIT::emitSlow_op_get_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&)
 {
     ASSERT_NOT_REACHED();
 }
 
-void JIT::compilePutByIdHotPath(int baseVReg, Identifier* ident, int valueVReg, unsigned)
+void JIT::emit_op_put_by_id(Instruction* currentInstruction)
 {
-    // In order to be able to patch both the Structure, and the object offset, we store one pointer,
-    // to just after the arguments have been loaded into registers 'hotPathBegin', and we generate code
-    // such that the Structure & offset are always at the same distance from this.
+    unsigned baseVReg = currentInstruction[1].u.operand;
+    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
+    unsigned valueVReg = currentInstruction[3].u.operand;
+
+    emitGetVirtualRegisters(baseVReg, regT0, valueVReg, regT1);
 
-    emitGetVirtualRegisters(baseVReg, X86::eax, valueVReg, X86::edx);
+    JITStubCall stubCall(this, JITStubs::cti_op_put_by_id_generic);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(regT1);
+    stubCall.call();
 
-    emitPutJITStubArgConstant(ident, 2);
-    emitPutJITStubArg(X86::eax, 1);
-    emitPutJITStubArg(X86::edx, 3);
-    emitCTICall(Interpreter::cti_op_put_by_id_generic);
+    m_propertyAccessInstructionIndex++;
 }
 
-void JIT::compilePutByIdSlowCase(int, Identifier*, int, Vector<SlowCaseEntry>::iterator&, unsigned)
+void JIT::emitSlow_op_put_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&)
 {
     ASSERT_NOT_REACHED();
 }
 
-#else
+#else // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+
+/* ------------------------------ BEGIN: ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
+
+#if ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
+
+void JIT::emit_op_method_check(Instruction* currentInstruction)
+{
+    // Assert that the following instruction is a get_by_id.
+    ASSERT(m_interpreter->getOpcodeID((currentInstruction + OPCODE_LENGTH(op_method_check))->u.opcode) == op_get_by_id);
+
+    currentInstruction += OPCODE_LENGTH(op_method_check);
+    unsigned resultVReg = currentInstruction[1].u.operand;
+    unsigned baseVReg = currentInstruction[2].u.operand;
+    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
+
+    emitGetVirtualRegister(baseVReg, regT0);
+
+    // Do the method check - check the object & its prototype's structure inline (this is the common case).
+    m_methodCallCompilationInfo.append(MethodCallCompilationInfo(m_propertyAccessInstructionIndex));
+    MethodCallCompilationInfo& info = m_methodCallCompilationInfo.last();
+    Jump notCell = emitJumpIfNotJSCell(regT0);
+    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), info.structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    DataLabelPtr protoStructureToCompare, protoObj = moveWithPatch(ImmPtr(0), regT1);
+    Jump protoStructureCheck = branchPtrWithPatch(NotEqual, Address(regT1, OBJECT_OFFSETOF(JSCell, m_structure)), protoStructureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+
+    // This will be relinked to load the function without doing a load.
+    DataLabelPtr putFunction = moveWithPatch(ImmPtr(0), regT0);
+    Jump match = jump();
+
+    ASSERT(differenceBetween(info.structureToCompare, protoObj) == patchOffsetMethodCheckProtoObj);
+    ASSERT(differenceBetween(info.structureToCompare, protoStructureToCompare) == patchOffsetMethodCheckProtoStruct);
+    ASSERT(differenceBetween(info.structureToCompare, putFunction) == patchOffsetMethodCheckPutFunction);
+
+    // Link the failure cases here.
+    notCell.link(this);
+    structureCheck.link(this);
+    protoStructureCheck.link(this);
+
+    // Do a regular(ish) get_by_id (the slow case will be link to
+    // cti_op_get_by_id_method_check instead of cti_op_get_by_id.
+    compileGetByIdHotPath(resultVReg, baseVReg, ident, m_propertyAccessInstructionIndex++);
+
+    match.link(this);
+    emitPutVirtualRegister(resultVReg);
+
+    // We've already generated the following get_by_id, so make sure it's skipped over.
+    m_bytecodeIndex += OPCODE_LENGTH(op_get_by_id);
+}
+
+void JIT::emitSlow_op_method_check(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    currentInstruction += OPCODE_LENGTH(op_method_check);
+    unsigned resultVReg = currentInstruction[1].u.operand;
+    unsigned baseVReg = currentInstruction[2].u.operand;
+    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
+
+    compileGetByIdSlowCase(resultVReg, baseVReg, ident, iter, m_propertyAccessInstructionIndex++, true);
+
+    // We've already generated the following get_by_id, so make sure it's skipped over.
+    m_bytecodeIndex += OPCODE_LENGTH(op_get_by_id);
+}
+
+#else //!ENABLE(JIT_OPTIMIZE_METHOD_CALLS)
+
+// Treat these as nops - the call will be handed as a regular get_by_id/op_call pair.
+void JIT::emit_op_method_check(Instruction*) {}
+void JIT::emitSlow_op_method_check(Instruction*, Vector<SlowCaseEntry>::iterator&) { ASSERT_NOT_REACHED(); }
+
+#endif
+
+void JIT::emit_op_get_by_id(Instruction* currentInstruction)
+{
+    unsigned resultVReg = currentInstruction[1].u.operand;
+    unsigned baseVReg = currentInstruction[2].u.operand;
+    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
+
+    emitGetVirtualRegister(baseVReg, regT0);
+    compileGetByIdHotPath(resultVReg, baseVReg, ident, m_propertyAccessInstructionIndex++);
+    emitPutVirtualRegister(resultVReg);
+}
 
-void JIT::compileGetByIdHotPath(int resultVReg, int baseVReg, Identifier*, unsigned propertyAccessInstructionIndex)
+void JIT::compileGetByIdHotPath(int, int baseVReg, Identifier*, unsigned propertyAccessInstructionIndex)
 {
     // As for put_by_id, get_by_id requires the offset of the Structure and the offset of the access to be patched.
     // Additionally, for get_by_id we need patch the offset of the branch to the slow case (we patch this to jump
     // to array-length / prototype access tranpolines, and finally we also the the property-map access offset as a label
     // to jump back to if one of these trampolies finds a match.
 
-    emitGetVirtualRegister(baseVReg, X86::eax);
-
-    emitJumpSlowCaseIfNotJSCell(X86::eax, baseVReg);
+    emitJumpSlowCaseIfNotJSCell(regT0, baseVReg);
 
     Label hotPathBegin(this);
     m_propertyAccessCompilationInfo[propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
 
     DataLabelPtr structureToCompare;
-    Jump structureCheck = jnePtrWithPatch(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
+    Jump structureCheck = branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure)));
     addSlowCase(structureCheck);
     ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetGetByIdStructure);
     ASSERT(differenceBetween(hotPathBegin, structureCheck) == patchOffsetGetByIdBranchToSlowCase);
 
-    loadPtr(Address(X86::eax, FIELD_OFFSET(JSObject, m_propertyStorage)), X86::eax);
-    DataLabel32 displacementLabel = loadPtrWithAddressOffsetPatch(Address(X86::eax, patchGetByIdDefaultOffset), X86::eax);
+    Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT0);
+    Label externalLoadComplete(this);
+    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetGetByIdExternalLoad);
+    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthGetByIdExternalLoad);
+
+    DataLabel32 displacementLabel = loadPtrWithAddressOffsetPatch(Address(regT0, patchGetByIdDefaultOffset), regT0);
     ASSERT(differenceBetween(hotPathBegin, displacementLabel) == patchOffsetGetByIdPropertyMapOffset);
 
     Label putResult(this);
     ASSERT(differenceBetween(hotPathBegin, putResult) == patchOffsetGetByIdPutResult);
-    emitPutVirtualRegister(resultVReg);
 }
 
+void JIT::emitSlow_op_get_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned resultVReg = currentInstruction[1].u.operand;
+    unsigned baseVReg = currentInstruction[2].u.operand;
+    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[3].u.operand));
 
-void JIT::compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, unsigned propertyAccessInstructionIndex)
+    compileGetByIdSlowCase(resultVReg, baseVReg, ident, iter, m_propertyAccessInstructionIndex++, false);
+}
+
+void JIT::compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident, Vector<SlowCaseEntry>::iterator& iter, unsigned propertyAccessInstructionIndex, bool isMethodCheck)
 {
     // As for the hot path of get_by_id, above, we ensure that we can use an architecture specific offset
     // so that we only need track one pointer into the slow case code - we track a pointer to the location
@@ -132,10 +325,10 @@ void JIT::compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident
 #ifndef NDEBUG
     Label coldPathBegin(this);
 #endif
-    emitPutJITStubArg(X86::eax, 1);
-    emitPutJITStubArgConstant(ident, 2);
-    Jump call = emitCTICall(Interpreter::cti_op_get_by_id);
-    emitPutVirtualRegister(resultVReg);
+    JITStubCall stubCall(this, isMethodCheck ? JITStubs::cti_op_get_by_id_method_check : JITStubs::cti_op_get_by_id);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(ImmPtr(ident));
+    Call call = stubCall.call(resultVReg);
 
     ASSERT(differenceBetween(coldPathBegin, call) == patchOffsetGetByIdSlowCaseCall);
 
@@ -143,338 +336,341 @@ void JIT::compileGetByIdSlowCase(int resultVReg, int baseVReg, Identifier* ident
     m_propertyAccessCompilationInfo[propertyAccessInstructionIndex].callReturnLocation = call;
 }
 
-void JIT::compilePutByIdHotPath(int baseVReg, Identifier*, int valueVReg, unsigned propertyAccessInstructionIndex)
+void JIT::emit_op_put_by_id(Instruction* currentInstruction)
 {
+    unsigned baseVReg = currentInstruction[1].u.operand;
+    unsigned valueVReg = currentInstruction[3].u.operand;
+
+    unsigned propertyAccessInstructionIndex = m_propertyAccessInstructionIndex++;
+
     // In order to be able to patch both the Structure, and the object offset, we store one pointer,
     // to just after the arguments have been loaded into registers 'hotPathBegin', and we generate code
     // such that the Structure & offset are always at the same distance from this.
 
-    emitGetVirtualRegisters(baseVReg, X86::eax, valueVReg, X86::edx);
+    emitGetVirtualRegisters(baseVReg, regT0, valueVReg, regT1);
 
     // Jump to a slow case if either the base object is an immediate, or if the Structure does not match.
-    emitJumpSlowCaseIfNotJSCell(X86::eax, baseVReg);
+    emitJumpSlowCaseIfNotJSCell(regT0, baseVReg);
 
     Label hotPathBegin(this);
     m_propertyAccessCompilationInfo[propertyAccessInstructionIndex].hotPathBegin = hotPathBegin;
 
     // It is important that the following instruction plants a 32bit immediate, in order that it can be patched over.
     DataLabelPtr structureToCompare;
-    addSlowCase(jnePtrWithPatch(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
+    addSlowCase(branchPtrWithPatch(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), structureToCompare, ImmPtr(reinterpret_cast<void*>(patchGetByIdDefaultStructure))));
     ASSERT(differenceBetween(hotPathBegin, structureToCompare) == patchOffsetPutByIdStructure);
 
     // Plant a load from a bogus ofset in the object's property map; we will patch this later, if it is to be used.
-    loadPtr(Address(X86::eax, FIELD_OFFSET(JSObject, m_propertyStorage)), X86::eax);
-    DataLabel32 displacementLabel = storePtrWithAddressOffsetPatch(X86::edx, Address(X86::eax, patchGetByIdDefaultOffset));
+    Label externalLoad = loadPtrWithPatchToLEA(Address(regT0, OBJECT_OFFSETOF(JSObject, m_externalStorage)), regT0);
+    Label externalLoadComplete(this);
+    ASSERT(differenceBetween(hotPathBegin, externalLoad) == patchOffsetPutByIdExternalLoad);
+    ASSERT(differenceBetween(externalLoad, externalLoadComplete) == patchLengthPutByIdExternalLoad);
+
+    DataLabel32 displacementLabel = storePtrWithAddressOffsetPatch(regT1, Address(regT0, patchGetByIdDefaultOffset));
     ASSERT(differenceBetween(hotPathBegin, displacementLabel) == patchOffsetPutByIdPropertyMapOffset);
 }
 
-void JIT::compilePutByIdSlowCase(int baseVReg, Identifier* ident, int, Vector<SlowCaseEntry>::iterator& iter, unsigned propertyAccessInstructionIndex)
+void JIT::emitSlow_op_put_by_id(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
+    unsigned baseVReg = currentInstruction[1].u.operand;
+    Identifier* ident = &(m_codeBlock->identifier(currentInstruction[2].u.operand));
+
+    unsigned propertyAccessInstructionIndex = m_propertyAccessInstructionIndex++;
+
     linkSlowCaseIfNotJSCell(iter, baseVReg);
     linkSlowCase(iter);
 
-    emitPutJITStubArgConstant(ident, 2);
-    emitPutJITStubArg(X86::eax, 1);
-    emitPutJITStubArg(X86::edx, 3);
-    Jump call = emitCTICall(Interpreter::cti_op_put_by_id);
+    JITStubCall stubCall(this, JITStubs::cti_op_put_by_id);
+    stubCall.addArgument(regT0);
+    stubCall.addArgument(ImmPtr(ident));
+    stubCall.addArgument(regT1);
+    Call call = stubCall.call();
 
     // Track the location of the call; this will be used to recover patch information.
     m_propertyAccessCompilationInfo[propertyAccessInstructionIndex].callReturnLocation = call;
 }
 
-static JSObject* resizePropertyStorage(JSObject* baseObject, int32_t oldSize, int32_t newSize)
+// Compile a store into an object's property storage.  May overwrite the
+// value in objectReg.
+void JIT::compilePutDirectOffset(RegisterID base, RegisterID value, Structure* structure, size_t cachedOffset)
 {
-    baseObject->allocatePropertyStorage(oldSize, newSize);
-    return baseObject;
+    int offset = cachedOffset * sizeof(JSValue);
+    if (structure->isUsingInlineStorage())
+        offset += OBJECT_OFFSETOF(JSObject, m_inlineStorage);
+    else
+        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
+    storePtr(value, Address(base, offset));
 }
 
-static inline bool transitionWillNeedStorageRealloc(Structure* oldStructure, Structure* newStructure)
+// Compile a load from an object's property storage.  May overwrite base.
+void JIT::compileGetDirectOffset(RegisterID base, RegisterID result, Structure* structure, size_t cachedOffset)
 {
-    return oldStructure->propertyStorageCapacity() != newStructure->propertyStorageCapacity();
+    int offset = cachedOffset * sizeof(JSValue);
+    if (structure->isUsingInlineStorage())
+        offset += OBJECT_OFFSETOF(JSObject, m_inlineStorage);
+    else
+        loadPtr(Address(base, OBJECT_OFFSETOF(JSObject, m_externalStorage)), base);
+    loadPtr(Address(base, offset), result);
 }
 
-void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, void* returnAddress)
+void JIT::compileGetDirectOffset(JSObject* base, RegisterID temp, RegisterID result, size_t cachedOffset)
+{
+    if (base->isUsingInlineStorage())
+        loadPtr(static_cast<void*>(&base->m_inlineStorage[cachedOffset]), result);
+    else {
+        PropertyStorage* protoPropertyStorage = &base->m_externalStorage;
+        loadPtr(static_cast<void*>(protoPropertyStorage), temp);
+        loadPtr(Address(temp, cachedOffset * sizeof(JSValue)), result);
+    } 
+}
+
+void JIT::privateCompilePutByIdTransition(StructureStubInfo* stubInfo, Structure* oldStructure, Structure* newStructure, size_t cachedOffset, StructureChain* chain, ReturnAddressPtr returnAddress)
 {
     JumpList failureCases;
     // Check eax is an object of the right Structure.
-    failureCases.append(emitJumpIfNotJSCell(X86::eax));
-    failureCases.append(jnePtr(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), ImmPtr(oldStructure)));
+    failureCases.append(emitJumpIfNotJSCell(regT0));
+    failureCases.append(branchPtr(NotEqual, Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(oldStructure)));
     JumpList successCases;
 
-    //  ecx = baseObject
-    loadPtr(Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)), X86::ecx);
+    // ecx = baseObject
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
     // proto(ecx) = baseObject->structure()->prototype()
-    failureCases.append(jne32(Address(X86::ecx, FIELD_OFFSET(Structure, m_typeInfo) + FIELD_OFFSET(TypeInfo, m_type)), Imm32(ObjectType)));
+    failureCases.append(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType)));
 
-    loadPtr(Address(X86::ecx, FIELD_OFFSET(Structure, m_prototype)), X86::ecx);
+    loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
     
     // ecx = baseObject->m_structure
     for (RefPtr<Structure>* it = chain->head(); *it; ++it) {
         // null check the prototype
-        successCases.append(jePtr(X86::ecx, ImmPtr(JSValuePtr::encode(jsNull()))));
+        successCases.append(branchPtr(Equal, regT2, ImmPtr(JSValue::encode(jsNull()))));
 
         // Check the structure id
-        failureCases.append(jnePtr(Address(X86::ecx, FIELD_OFFSET(JSCell, m_structure)), ImmPtr(it->get())));
+        failureCases.append(branchPtr(NotEqual, Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), ImmPtr(it->get())));
         
-        loadPtr(Address(X86::ecx, FIELD_OFFSET(JSCell, m_structure)), X86::ecx);
-        failureCases.append(jne32(Address(X86::ecx, FIELD_OFFSET(Structure, m_typeInfo) + FIELD_OFFSET(TypeInfo, m_type)), Imm32(ObjectType)));
-        loadPtr(Address(X86::ecx, FIELD_OFFSET(Structure, m_prototype)), X86::ecx);
+        loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+        failureCases.append(branch32(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo) + OBJECT_OFFSETOF(TypeInfo, m_type)), Imm32(ObjectType)));
+        loadPtr(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype)), regT2);
     }
 
     successCases.link(this);
 
-    Jump callTarget;
+    Call callTarget;
 
     // emit a call only if storage realloc is needed
-    if (transitionWillNeedStorageRealloc(oldStructure, newStructure)) {
-        pop(X86::ebx);
-#if PLATFORM(X86_64)
-        move(Imm32(newStructure->propertyStorageCapacity()), X86::edx);
-        move(Imm32(oldStructure->propertyStorageCapacity()), X86::esi);
-        move(X86::eax, X86::edi);
-        callTarget = call();
-#else
-        push(Imm32(newStructure->propertyStorageCapacity()));
-        push(Imm32(oldStructure->propertyStorageCapacity()));
-        push(X86::eax);
-        callTarget = call();
-        addPtr(Imm32(3 * sizeof(void*)), X86::esp);
-#endif
-        emitGetJITStubArg(3, X86::edx);
-        push(X86::ebx);
+    bool willNeedStorageRealloc = oldStructure->propertyStorageCapacity() != newStructure->propertyStorageCapacity();
+    if (willNeedStorageRealloc) {
+        // This trampoline was called to like a JIT stub; before we can can call again we need to
+        // remove the return address from the stack, to prevent the stack from becoming misaligned.
+        preverveReturnAddressAfterCall(regT3);
+ 
+        JITStubCall stubCall(this, JITStubs::cti_op_put_by_id_transition_realloc);
+        stubCall.addArgument(regT0);
+        stubCall.addArgument(Imm32(oldStructure->propertyStorageCapacity()));
+        stubCall.addArgument(Imm32(newStructure->propertyStorageCapacity()));
+        stubCall.addArgument(regT1); // This argument is not used in the stub; we set it up on the stack so that it can be restored, below.
+        stubCall.call(regT0);
+        emitGetJITStubArg(4, regT1);
+
+        restoreReturnAddressBeforeReturn(regT3);
     }
 
     // Assumes m_refCount can be decremented easily, refcount decrement is safe as 
     // codeblock should ensure oldStructure->m_refCount > 0
     sub32(Imm32(1), AbsoluteAddress(oldStructure->addressOfCount()));
     add32(Imm32(1), AbsoluteAddress(newStructure->addressOfCount()));
-    storePtr(ImmPtr(newStructure), Address(X86::eax, FIELD_OFFSET(JSCell, m_structure)));
+    storePtr(ImmPtr(newStructure), Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)));
 
     // write the value
-    loadPtr(Address(X86::eax, FIELD_OFFSET(JSObject, m_propertyStorage)), X86::eax);
-    storePtr(X86::edx, Address(X86::eax, cachedOffset * sizeof(JSValuePtr)));
+    compilePutDirectOffset(regT0, regT1, newStructure, cachedOffset);
 
     ret();
     
-    Jump failureJump;
-    bool plantedFailureJump = false;
-    if (!failureCases.empty()) {
-        failureCases.link(this);
-        restoreArgumentReferenceForTrampoline();
-        failureJump = jump();
-        plantedFailureJump = true;
-    }
+    ASSERT(!failureCases.empty());
+    failureCases.link(this);
+    restoreArgumentReferenceForTrampoline();
+    Call failureCall = tailRecursiveCall();
 
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
 
-    if (plantedFailureJump)
-        patchBuffer.link(failureJump, reinterpret_cast<void*>(Interpreter::cti_op_put_by_id_fail));
+    patchBuffer.link(failureCall, FunctionPtr(JITStubs::cti_op_put_by_id_fail));
 
-    if (transitionWillNeedStorageRealloc(oldStructure, newStructure))
-        patchBuffer.link(callTarget, reinterpret_cast<void*>(resizePropertyStorage));
-    
-    stubInfo->stubRoutine = code;
+    if (willNeedStorageRealloc) {
+        ASSERT(m_calls.size() == 1);
+        patchBuffer.link(m_calls[0].from, FunctionPtr(JITStubs::cti_op_put_by_id_transition_realloc));
+    }
     
-    Jump::patch(returnAddress, code);
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
+    RepatchBuffer repatchBuffer;
+    repatchBuffer.relinkCallerToTrampoline(returnAddress, entryLabel);
 }
 
-void JIT::patchGetByIdSelf(StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, void* returnAddress)
+void JIT::patchGetByIdSelf(StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ReturnAddressPtr returnAddress)
 {
+    RepatchBuffer repatchBuffer;
+
     // We don't want to patch more than once - in future go to cti_op_get_by_id_generic.
-    // Should probably go to Interpreter::cti_op_get_by_id_fail, but that doesn't do anything interesting right now.
-    Jump::patch(returnAddress, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_self_fail));
+    // Should probably go to JITStubs::cti_op_get_by_id_fail, but that doesn't do anything interesting right now.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(JITStubs::cti_op_get_by_id_self_fail));
+
+    int offset = sizeof(JSValue) * cachedOffset;
+
+    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
+    // and makes the subsequent load's offset automatically correct
+    if (structure->isUsingInlineStorage())
+        repatchBuffer.repatchLoadPtrToLEA(stubInfo->hotPathBegin.instructionAtOffset(patchOffsetGetByIdExternalLoad));
 
     // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
-    void* structureAddress = reinterpret_cast<void*>(reinterpret_cast<intptr_t>(stubInfo->hotPathBegin) + patchOffsetGetByIdStructure);
-    void* displacementAddress = reinterpret_cast<void*>(reinterpret_cast<intptr_t>(stubInfo->hotPathBegin) + patchOffsetGetByIdPropertyMapOffset);
-    DataLabelPtr::patch(structureAddress, structure);
-    DataLabel32::patch(displacementAddress, cachedOffset * sizeof(JSValuePtr));
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetGetByIdStructure), structure);
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetGetByIdPropertyMapOffset), offset);
+}
+
+void JIT::patchMethodCallProto(MethodCallLinkInfo& methodCallLinkInfo, JSFunction* callee, Structure* structure, JSObject* proto)
+{
+    RepatchBuffer repatchBuffer;
+
+    ASSERT(!methodCallLinkInfo.cachedStructure);
+    methodCallLinkInfo.cachedStructure = structure;
+    structure->ref();
+
+    repatchBuffer.repatch(methodCallLinkInfo.structureLabel, structure);
+    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoObj), proto);
+    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckProtoStruct), proto->structure());
+    repatchBuffer.repatch(methodCallLinkInfo.structureLabel.dataLabelPtrAtOffset(patchOffsetMethodCheckPutFunction), callee);
 }
 
-void JIT::patchPutByIdReplace(StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, void* returnAddress)
+void JIT::patchPutByIdReplace(StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, ReturnAddressPtr returnAddress)
 {
+    RepatchBuffer repatchBuffer;
+
     // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    // Should probably go to Interpreter::cti_op_put_by_id_fail, but that doesn't do anything interesting right now.
-    Jump::patch(returnAddress, reinterpret_cast<void*>(Interpreter::cti_op_put_by_id_generic));
+    // Should probably go to JITStubs::cti_op_put_by_id_fail, but that doesn't do anything interesting right now.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(JITStubs::cti_op_put_by_id_generic));
+
+    int offset = sizeof(JSValue) * cachedOffset;
+
+    // If we're patching to use inline storage, convert the initial load to a lea; this avoids the extra load
+    // and makes the subsequent load's offset automatically correct
+    if (structure->isUsingInlineStorage())
+        repatchBuffer.repatchLoadPtrToLEA(stubInfo->hotPathBegin.instructionAtOffset(patchOffsetPutByIdExternalLoad));
 
     // Patch the offset into the propoerty map to load from, then patch the Structure to look for.
-    void* structureAddress = reinterpret_cast<char*>(stubInfo->hotPathBegin) + patchOffsetPutByIdStructure;
-    void* displacementAddress = reinterpret_cast<char*>(stubInfo->hotPathBegin) + patchOffsetPutByIdPropertyMapOffset;
-    DataLabelPtr::patch(structureAddress, structure);
-    DataLabel32::patch(displacementAddress, cachedOffset * sizeof(JSValuePtr));
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabelPtrAtOffset(patchOffsetPutByIdStructure), structure);
+    repatchBuffer.repatch(stubInfo->hotPathBegin.dataLabel32AtOffset(patchOffsetPutByIdPropertyMapOffset), offset);
 }
 
-void JIT::privateCompilePatchGetArrayLength(void* returnAddress)
+void JIT::privateCompilePatchGetArrayLength(ReturnAddressPtr returnAddress)
 {
     StructureStubInfo* stubInfo = &m_codeBlock->getStubInfo(returnAddress);
 
-    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    Jump::patch(returnAddress, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_array_fail));
-
     // Check eax is an array
-    Jump failureCases1 = jnePtr(Address(X86::eax), ImmPtr(m_interpreter->m_jsArrayVptr));
+    Jump failureCases1 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr));
 
     // Checks out okay! - get the length from the storage
-    loadPtr(Address(X86::eax, FIELD_OFFSET(JSArray, m_storage)), X86::ecx);
-    load32(Address(X86::ecx, FIELD_OFFSET(ArrayStorage, m_length)), X86::ecx);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSArray, m_storage)), regT2);
+    load32(Address(regT2, OBJECT_OFFSETOF(ArrayStorage, m_length)), regT2);
 
-    Jump failureCases2 = ja32(X86::ecx, Imm32(JSImmediate::maxImmediateInt));
+    Jump failureCases2 = branch32(Above, regT2, Imm32(JSImmediate::maxImmediateInt));
 
-    emitFastArithIntToImmNoCheck(X86::ecx, X86::eax);
+    emitFastArithIntToImmNoCheck(regT2, regT0);
     Jump success = jump();
 
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
 
     // Use the patch information to link the failure cases back to the original slow case routine.
-    void* slowCaseBegin = reinterpret_cast<char*>(stubInfo->callReturnLocation) - patchOffsetGetByIdSlowCaseCall;
+    CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
     patchBuffer.link(failureCases1, slowCaseBegin);
     patchBuffer.link(failureCases2, slowCaseBegin);
 
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    void* hotPathPutResult = reinterpret_cast<char*>(stubInfo->hotPathBegin) + patchOffsetGetByIdPutResult;
-    patchBuffer.link(success, hotPathPutResult);
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
 
     // Track the stub we have created so that it will be deleted later.
-    stubInfo->stubRoutine = code;
-
-    // Finally patch the jump to sow case back in the hot path to jump here instead.
-    void* jumpLocation = reinterpret_cast<char*>(stubInfo->hotPathBegin) + patchOffsetGetByIdBranchToSlowCase;
-    Jump::patch(jumpLocation, code);
-}
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
 
-void JIT::privateCompileGetByIdSelf(StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, void* returnAddress)
-{
-    // Check eax is an object of the right Structure.
-    Jump failureCases1 = emitJumpIfNotJSCell(X86::eax);
-    Jump failureCases2 = checkStructure(X86::eax, structure);
-
-    // Checks out okay! - getDirectOffset
-    loadPtr(Address(X86::eax, FIELD_OFFSET(JSObject, m_propertyStorage)), X86::eax);
-    loadPtr(Address(X86::eax, cachedOffset * sizeof(JSValuePtr)), X86::eax);
-    ret();
-
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
-
-    patchBuffer.link(failureCases1, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_self_fail));
-    patchBuffer.link(failureCases2, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_self_fail));
-
-    stubInfo->stubRoutine = code;
+    // Finally patch the jump to slow case back in the hot path to jump here instead.
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer;
+    repatchBuffer.relink(jumpLocation, entryLabel);
 
-    Jump::patch(returnAddress, code);
+    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(JITStubs::cti_op_get_by_id_array_fail));
 }
 
-void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, void* returnAddress, CallFrame* callFrame)
+void JIT::privateCompileGetByIdProto(StructureStubInfo* stubInfo, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
 {
-#if USE(CTI_REPATCH_PIC)
-    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    Jump::patch(returnAddress, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_proto_list));
-
     // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
     // referencing the prototype object - let's speculatively load it's table nice and early!)
     JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
-    PropertyStorage* protoPropertyStorage = &protoObject->m_propertyStorage;
-    loadPtr(static_cast<void*>(protoPropertyStorage), X86::edx);
 
     // Check eax is an object of the right Structure.
-    Jump failureCases1 = checkStructure(X86::eax, structure);
+    Jump failureCases1 = checkStructure(regT0, structure);
 
     // Check the prototype object's Structure had not changed.
     Structure** prototypeStructureAddress = &(protoObject->m_structure);
 #if PLATFORM(X86_64)
-    move(ImmPtr(prototypeStructure), X86::ebx);
-    Jump failureCases2 = jnePtr(X86::ebx, AbsoluteAddress(prototypeStructureAddress));
+    move(ImmPtr(prototypeStructure), regT3);
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
 #else
-    Jump failureCases2 = jnePtr(AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
 #endif
 
     // Checks out okay! - getDirectOffset
-    loadPtr(Address(X86::edx, cachedOffset * sizeof(JSValuePtr)), X86::eax);
+    compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
 
     Jump success = jump();
 
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
 
     // Use the patch information to link the failure cases back to the original slow case routine.
-    void* slowCaseBegin = reinterpret_cast<char*>(stubInfo->callReturnLocation) - patchOffsetGetByIdSlowCaseCall;
+    CodeLocationLabel slowCaseBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
     patchBuffer.link(failureCases1, slowCaseBegin);
     patchBuffer.link(failureCases2, slowCaseBegin);
 
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    intptr_t successDest = reinterpret_cast<intptr_t>(stubInfo->hotPathBegin) + patchOffsetGetByIdPutResult;
-    patchBuffer.link(success, reinterpret_cast<void*>(successDest));
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
 
     // Track the stub we have created so that it will be deleted later.
-    stubInfo->stubRoutine = code;
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
-    void* jumpLocation = reinterpret_cast<char*>(stubInfo->hotPathBegin) + patchOffsetGetByIdBranchToSlowCase;
-    Jump::patch(jumpLocation, code);
-#else
-    // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
-    // referencing the prototype object - let's speculatively load it's table nice and early!)
-    JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
-    PropertyStorage* protoPropertyStorage = &protoObject->m_propertyStorage;
-    loadPtr(protoPropertyStorage, X86::edx);
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer;
+    repatchBuffer.relink(jumpLocation, entryLabel);
 
-    // Check eax is an object of the right Structure.
-    Jump failureCases1 = emitJumpIfNotJSCell(X86::eax);
-    Jump failureCases2 = checkStructure(X86::eax, structure);
-
-    // Check the prototype object's Structure had not changed.
-    Structure** prototypeStructureAddress = &(protoObject->m_structure);
-    Jump failureCases3 = jnePtr(AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
-
-    // Checks out okay! - getDirectOffset
-    loadPtr(Address(X86::edx, cachedOffset * sizeof(JSValuePtr)), X86::eax);
-
-    ret();
-
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
-
-    patchBuffer.link(failureCases1, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_proto_fail));
-    patchBuffer.link(failureCases2, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_proto_fail));
-    patchBuffer.link(failureCases3, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_proto_fail));
-
-    stubInfo->stubRoutine = code;
-
-    Jump::patch(returnAddress, code);
-#endif
+    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(JITStubs::cti_op_get_by_id_proto_list));
 }
 
-#if USE(CTI_REPATCH_PIC)
 void JIT::privateCompileGetByIdSelfList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* polymorphicStructures, int currentIndex, Structure* structure, size_t cachedOffset)
 {
-    Jump failureCase = checkStructure(X86::eax, structure);
-    loadPtr(Address(X86::eax, FIELD_OFFSET(JSObject, m_propertyStorage)), X86::eax);
-    loadPtr(Address(X86::eax, cachedOffset * sizeof(JSValuePtr)), X86::eax);
+    Jump failureCase = checkStructure(regT0, structure);
+    compileGetDirectOffset(regT0, regT0, structure, cachedOffset);
     Jump success = jump();
 
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    ASSERT(code);
-    PatchBuffer patchBuffer(code);
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
 
     // Use the patch information to link the failure cases back to the original slow case routine.
-    void* lastProtoBegin = polymorphicStructures->list[currentIndex - 1].stubRoutine;
+    CodeLocationLabel lastProtoBegin = polymorphicStructures->list[currentIndex - 1].stubRoutine;
     if (!lastProtoBegin)
-        lastProtoBegin = reinterpret_cast<char*>(stubInfo->callReturnLocation) - patchOffsetGetByIdSlowCaseCall;
+        lastProtoBegin = stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall);
 
     patchBuffer.link(failureCase, lastProtoBegin);
 
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    intptr_t successDest = reinterpret_cast<intptr_t>(stubInfo->hotPathBegin) + patchOffsetGetByIdPutResult;
-    patchBuffer.link(success, reinterpret_cast<void*>(successDest));
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
 
     structure->ref();
-    polymorphicStructures->list[currentIndex].set(code, structure);
+    polymorphicStructures->list[currentIndex].set(entryLabel, structure);
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
-    void* jumpLocation = reinterpret_cast<char*>(stubInfo->hotPathBegin) + patchOffsetGetByIdBranchToSlowCase;
-    Jump::patch(jumpLocation, code);
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer;
+    repatchBuffer.relink(jumpLocation, entryLabel);
 }
 
 void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, Structure* prototypeStructure, size_t cachedOffset, CallFrame* callFrame)
@@ -482,45 +678,44 @@ void JIT::privateCompileGetByIdProtoList(StructureStubInfo* stubInfo, Polymorphi
     // The prototype object definitely exists (if this stub exists the CodeBlock is referencing a Structure that is
     // referencing the prototype object - let's speculatively load it's table nice and early!)
     JSObject* protoObject = asObject(structure->prototypeForLookup(callFrame));
-    PropertyStorage* protoPropertyStorage = &protoObject->m_propertyStorage;
-    loadPtr(protoPropertyStorage, X86::edx);
 
     // Check eax is an object of the right Structure.
-    Jump failureCases1 = checkStructure(X86::eax, structure);
+    Jump failureCases1 = checkStructure(regT0, structure);
 
     // Check the prototype object's Structure had not changed.
     Structure** prototypeStructureAddress = &(protoObject->m_structure);
 #if PLATFORM(X86_64)
-    move(ImmPtr(prototypeStructure), X86::ebx);
-    Jump failureCases2 = jnePtr(X86::ebx, AbsoluteAddress(prototypeStructureAddress));
+    move(ImmPtr(prototypeStructure), regT3);
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3);
 #else
-    Jump failureCases2 = jnePtr(AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
+    Jump failureCases2 = branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(prototypeStructure));
 #endif
 
     // Checks out okay! - getDirectOffset
-    loadPtr(Address(X86::edx, cachedOffset * sizeof(JSValuePtr)), X86::eax);
+    compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
 
     Jump success = jump();
 
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
 
     // Use the patch information to link the failure cases back to the original slow case routine.
-    void* lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
+    CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
     patchBuffer.link(failureCases1, lastProtoBegin);
     patchBuffer.link(failureCases2, lastProtoBegin);
 
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    intptr_t successDest = reinterpret_cast<intptr_t>(stubInfo->hotPathBegin) + patchOffsetGetByIdPutResult;
-    patchBuffer.link(success, reinterpret_cast<void*>(successDest));
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
 
     structure->ref();
     prototypeStructure->ref();
-    prototypeStructures->list[currentIndex].set(code, structure, prototypeStructure);
+    prototypeStructures->list[currentIndex].set(entryLabel, structure, prototypeStructure);
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
-    void* jumpLocation = reinterpret_cast<char*>(stubInfo->hotPathBegin) + patchOffsetGetByIdBranchToSlowCase;
-    Jump::patch(jumpLocation, code);
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer;
+    repatchBuffer.relink(jumpLocation, entryLabel);
 }
 
 void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, PolymorphicAccessStructureList* prototypeStructures, int currentIndex, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, CallFrame* callFrame)
@@ -530,7 +725,7 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
     JumpList bucketsOfFail;
 
     // Check eax is an object of the right Structure.
-    Jump baseObjectCheck = checkStructure(X86::eax, structure);
+    Jump baseObjectCheck = checkStructure(regT0, structure);
     bucketsOfFail.append(baseObjectCheck);
 
     Structure* currStructure = structure;
@@ -543,54 +738,48 @@ void JIT::privateCompileGetByIdChainList(StructureStubInfo* stubInfo, Polymorphi
         // Check the prototype object's Structure had not changed.
         Structure** prototypeStructureAddress = &(protoObject->m_structure);
 #if PLATFORM(X86_64)
-        move(ImmPtr(currStructure), X86::ebx);
-        bucketsOfFail.append(jnePtr(X86::ebx, AbsoluteAddress(prototypeStructureAddress)));
+        move(ImmPtr(currStructure), regT3);
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
 #else
-        bucketsOfFail.append(jnePtr(AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
 #endif
     }
     ASSERT(protoObject);
 
-    PropertyStorage* protoPropertyStorage = &protoObject->m_propertyStorage;
-    loadPtr(protoPropertyStorage, X86::edx);
-    loadPtr(Address(X86::edx, cachedOffset * sizeof(JSValuePtr)), X86::eax);
+    compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
     Jump success = jump();
 
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
 
     // Use the patch information to link the failure cases back to the original slow case routine.
-    void* lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
+    CodeLocationLabel lastProtoBegin = prototypeStructures->list[currentIndex - 1].stubRoutine;
 
     patchBuffer.link(bucketsOfFail, lastProtoBegin);
 
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    intptr_t successDest = reinterpret_cast<intptr_t>(stubInfo->hotPathBegin) + patchOffsetGetByIdPutResult;
-    patchBuffer.link(success, reinterpret_cast<void*>(successDest));
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
+
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
 
     // Track the stub we have created so that it will be deleted later.
     structure->ref();
     chain->ref();
-    prototypeStructures->list[currentIndex].set(code, structure, chain);
+    prototypeStructures->list[currentIndex].set(entryLabel, structure, chain);
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
-    void* jumpLocation = reinterpret_cast<char*>(stubInfo->hotPathBegin) + patchOffsetGetByIdBranchToSlowCase;
-    Jump::patch(jumpLocation, code);
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer;
+    repatchBuffer.relink(jumpLocation, entryLabel);
 }
-#endif
 
-void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, void* returnAddress, CallFrame* callFrame)
+void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* structure, StructureChain* chain, size_t count, size_t cachedOffset, ReturnAddressPtr returnAddress, CallFrame* callFrame)
 {
-#if USE(CTI_REPATCH_PIC)
-    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
-    Jump::patch(returnAddress, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_proto_list));
-
     ASSERT(count);
     
     JumpList bucketsOfFail;
 
     // Check eax is an object of the right Structure.
-    bucketsOfFail.append(checkStructure(X86::eax, structure));
+    bucketsOfFail.append(checkStructure(regT0, structure));
 
     Structure* currStructure = structure;
     RefPtr<Structure>* chainEntries = chain->head();
@@ -602,102 +791,41 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
         // Check the prototype object's Structure had not changed.
         Structure** prototypeStructureAddress = &(protoObject->m_structure);
 #if PLATFORM(X86_64)
-        move(ImmPtr(currStructure), X86::ebx);
-        bucketsOfFail.append(jnePtr(X86::ebx, AbsoluteAddress(prototypeStructureAddress)));
+        move(ImmPtr(currStructure), regT3);
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), regT3));
 #else
-        bucketsOfFail.append(jnePtr(AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
+        bucketsOfFail.append(branchPtr(NotEqual, AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
 #endif
     }
     ASSERT(protoObject);
 
-    PropertyStorage* protoPropertyStorage = &protoObject->m_propertyStorage;
-    loadPtr(protoPropertyStorage, X86::edx);
-    loadPtr(Address(X86::edx, cachedOffset * sizeof(JSValuePtr)), X86::eax);
+    compileGetDirectOffset(protoObject, regT1, regT0, cachedOffset);
     Jump success = jump();
 
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
+    LinkBuffer patchBuffer(this, m_codeBlock->executablePool());
 
     // Use the patch information to link the failure cases back to the original slow case routine.
-    void* slowCaseBegin = reinterpret_cast<char*>(stubInfo->callReturnLocation) - patchOffsetGetByIdSlowCaseCall;
-
-    patchBuffer.link(bucketsOfFail, slowCaseBegin);
+    patchBuffer.link(bucketsOfFail, stubInfo->callReturnLocation.labelAtOffset(-patchOffsetGetByIdSlowCaseCall));
 
     // On success return back to the hot patch code, at a point it will perform the store to dest for us.
-    intptr_t successDest = reinterpret_cast<intptr_t>(stubInfo->hotPathBegin) + patchOffsetGetByIdPutResult;
-    patchBuffer.link(success, reinterpret_cast<void*>(successDest));
+    patchBuffer.link(success, stubInfo->hotPathBegin.labelAtOffset(patchOffsetGetByIdPutResult));
 
     // Track the stub we have created so that it will be deleted later.
-    stubInfo->stubRoutine = code;
+    CodeLocationLabel entryLabel = patchBuffer.finalizeCodeAddendum();
+    stubInfo->stubRoutine = entryLabel;
 
     // Finally patch the jump to slow case back in the hot path to jump here instead.
-    void* jumpLocation = reinterpret_cast<char*>(stubInfo->hotPathBegin) + patchOffsetGetByIdBranchToSlowCase;
-    Jump::patch(jumpLocation, code);
-#else
-    ASSERT(count);
-    
-    JumpList bucketsOfFail;
-
-    // Check eax is an object of the right Structure.
-    bucketsOfFail.append(emitJumpIfNotJSCell(X86::eax));
-    bucketsOfFail.append(checkStructure(X86::eax, structure));
+    CodeLocationJump jumpLocation = stubInfo->hotPathBegin.jumpAtOffset(patchOffsetGetByIdBranchToSlowCase);
+    RepatchBuffer repatchBuffer;
+    repatchBuffer.relink(jumpLocation, entryLabel);
 
-    Structure* currStructure = structure;
-    RefPtr<Structure>* chainEntries = chain->head();
-    JSObject* protoObject = 0;
-    for (unsigned i = 0; i < count; ++i) {
-        protoObject = asObject(currStructure->prototypeForLookup(callFrame));
-        currStructure = chainEntries[i].get();
-
-        // Check the prototype object's Structure had not changed.
-        Structure** prototypeStructureAddress = &(protoObject->m_structure);
-#if PLATFORM(X86_64)
-        move(ImmPtr(currStructure), X86::ebx);
-        bucketsOfFail.append(jnePtr(X86::ebx, AbsoluteAddress(prototypeStructureAddress)));
-#else
-        bucketsOfFail.append(jnePtr(AbsoluteAddress(prototypeStructureAddress), ImmPtr(currStructure)));
-#endif
-    }
-    ASSERT(protoObject);
-
-    PropertyStorage* protoPropertyStorage = &protoObject->m_propertyStorage;
-    loadPtr(protoPropertyStorage, X86::edx);
-    loadPtr(Address(X86::edx, cachedOffset * sizeof(JSValuePtr)), X86::eax);
-    ret();
-
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-
-    patchBuffer.link(bucketsOfFail, reinterpret_cast<void*>(Interpreter::cti_op_get_by_id_proto_fail));
-
-    stubInfo->stubRoutine = code;
-
-    Jump::patch(returnAddress, code);
-#endif
+    // We don't want to patch more than once - in future go to cti_op_put_by_id_generic.
+    repatchBuffer.relinkCallerToFunction(returnAddress, FunctionPtr(JITStubs::cti_op_get_by_id_proto_list));
 }
 
-void JIT::privateCompilePutByIdReplace(StructureStubInfo* stubInfo, Structure* structure, size_t cachedOffset, void* returnAddress)
-{
-    // Check eax is an object of the right Structure.
-    Jump failureCases1 = emitJumpIfNotJSCell(X86::eax);
-    Jump failureCases2 = checkStructure(X86::eax, structure);
-
-    // checks out okay! - putDirectOffset
-    loadPtr(Address(X86::eax, FIELD_OFFSET(JSObject, m_propertyStorage)), X86::eax);
-    storePtr(X86::edx, Address(X86::eax, cachedOffset * sizeof(JSValuePtr)));
-    ret();
-
-    void* code = m_assembler.executableCopy(m_codeBlock->executablePool());
-    PatchBuffer patchBuffer(code);
-    
-    patchBuffer.link(failureCases1, reinterpret_cast<void*>(Interpreter::cti_op_put_by_id_fail));
-    patchBuffer.link(failureCases2, reinterpret_cast<void*>(Interpreter::cti_op_put_by_id_fail));
+/* ------------------------------ END: !ENABLE / ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS) ------------------------------ */
 
-    stubInfo->stubRoutine = code;
-    
-    Jump::patch(returnAddress, code);
-}
-
-#endif
+#endif // !ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
new file mode 100644
index 0000000..bc07178
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubCall.h
@@ -0,0 +1,170 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JITStubCall_h
+#define JITStubCall_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(JIT)
+
+namespace JSC {
+
+    class JITStubCall {
+    public:
+        JITStubCall(JIT* jit, JSObject* (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
+            : m_jit(jit)
+            , m_stub(reinterpret_cast<void*>(stub))
+            , m_returnType(Value)
+            , m_argumentIndex(1) // Index 0 is reserved for restoreArgumentReference();
+        {
+        }
+
+        JITStubCall(JIT* jit, JSPropertyNameIterator* (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
+            : m_jit(jit)
+            , m_stub(reinterpret_cast<void*>(stub))
+            , m_returnType(Value)
+            , m_argumentIndex(1) // Index 0 is reserved for restoreArgumentReference();
+        {
+        }
+
+        JITStubCall(JIT* jit, void* (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
+            : m_jit(jit)
+            , m_stub(reinterpret_cast<void*>(stub))
+            , m_returnType(Value)
+            , m_argumentIndex(1) // Index 0 is reserved for restoreArgumentReference();
+        {
+        }
+
+        JITStubCall(JIT* jit, int (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
+            : m_jit(jit)
+            , m_stub(reinterpret_cast<void*>(stub))
+            , m_returnType(Value)
+            , m_argumentIndex(1) // Index 0 is reserved for restoreArgumentReference();
+        {
+        }
+
+        JITStubCall(JIT* jit, void (JIT_STUB *stub)(STUB_ARGS_DECLARATION))
+            : m_jit(jit)
+            , m_stub(reinterpret_cast<void*>(stub))
+            , m_returnType(Void)
+            , m_argumentIndex(1) // Index 0 is reserved for restoreArgumentReference();
+        {
+        }
+
+        // Arguments are added first to last.
+
+        void addArgument(JIT::Imm32 argument)
+        {
+            m_jit->poke(argument, m_argumentIndex);
+            ++m_argumentIndex;
+        }
+
+        void addArgument(JIT::ImmPtr argument)
+        {
+            m_jit->poke(argument, m_argumentIndex);
+            ++m_argumentIndex;
+        }
+
+        void addArgument(JIT::RegisterID argument)
+        {
+            m_jit->poke(argument, m_argumentIndex);
+            ++m_argumentIndex;
+        }
+
+        void addArgument(unsigned src, JIT::RegisterID scratchRegister) // src is a virtual register.
+        {
+            if (m_jit->m_codeBlock->isConstantRegisterIndex(src))
+                addArgument(JIT::ImmPtr(JSValue::encode(m_jit->m_codeBlock->getConstant(src))));
+            else {
+                m_jit->loadPtr(JIT::Address(JIT::callFrameRegister, src * sizeof(Register)), scratchRegister);
+                addArgument(scratchRegister);
+            }
+            m_jit->killLastResultRegister();
+        }
+
+        JIT::Call call()
+        {
+#if ENABLE(OPCODE_SAMPLING)
+            if (m_jit->m_bytecodeIndex != (unsigned)-1)
+                m_jit->sampleInstruction(m_jit->m_codeBlock->instructions().begin() + m_jit->m_bytecodeIndex, true);
+#endif
+
+            m_jit->restoreArgumentReference();
+            JIT::Call call = m_jit->call();
+            m_jit->m_calls.append(CallRecord(call, m_jit->m_bytecodeIndex, m_stub));
+
+#if ENABLE(OPCODE_SAMPLING)
+            if (m_jit->m_bytecodeIndex != (unsigned)-1)
+                m_jit->sampleInstruction(m_jit->m_codeBlock->instructions().begin() + m_jit->m_bytecodeIndex, false);
+#endif
+
+            m_jit->killLastResultRegister();
+            return call;
+        }
+
+        JIT::Call call(unsigned dst) // dst is a virtual register.
+        {
+            ASSERT(m_returnType == Value);
+            JIT::Call call = this->call();
+            m_jit->emitPutVirtualRegister(dst);
+            return call;
+        }
+
+        JIT::Call call(JIT::RegisterID dst)
+        {
+            ASSERT(m_returnType == Value);
+            JIT::Call call = this->call();
+            if (dst != JIT::returnValueRegister)
+                m_jit->move(JIT::returnValueRegister, dst);
+            return call;
+        }
+
+    private:
+        JIT* m_jit;
+        void* m_stub;
+        enum { Value, Void } m_returnType;
+        size_t m_argumentIndex;
+    };
+
+    class CallEvalJITStub : public JITStubCall {
+    public:
+        CallEvalJITStub(JIT* jit, Instruction* instruction)
+            : JITStubCall(jit, JITStubs::cti_op_call_eval)
+        {
+            int callee = instruction[2].u.operand;
+            int argCount = instruction[3].u.operand;
+            int registerOffset = instruction[4].u.operand;
+
+            addArgument(callee, JIT::regT2);
+            addArgument(JIT::Imm32(registerOffset));
+            addArgument(JIT::Imm32(argCount));
+        }
+    };
+}
+
+#endif // ENABLE(JIT)
+
+#endif // JITStubCall_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
new file mode 100644
index 0000000..02bf7c0
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.cpp
@@ -0,0 +1,2745 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JITStubs.h"
+
+#if ENABLE(JIT)
+
+#include "Arguments.h"
+#include "CallFrame.h"
+#include "CodeBlock.h"
+#include "Collector.h"
+#include "Debugger.h"
+#include "ExceptionHelpers.h"
+#include "GlobalEvalFunction.h"
+#include "JIT.h"
+#include "JSActivation.h"
+#include "JSArray.h"
+#include "JSByteArray.h"
+#include "JSFunction.h"
+#include "JSNotAnObject.h"
+#include "JSPropertyNameIterator.h"
+#include "JSStaticScopeObject.h"
+#include "JSString.h"
+#include "ObjectPrototype.h"
+#include "Operations.h"
+#include "Parser.h"
+#include "Profiler.h"
+#include "RegExpObject.h"
+#include "RegExpPrototype.h"
+#include "Register.h"
+#include "SamplingTool.h"
+#include <stdio.h>
+
+using namespace std;
+
+namespace JSC {
+
+
+#if PLATFORM(DARWIN) || PLATFORM(WIN_OS)
+#define SYMBOL_STRING(name) "_" #name
+#else
+#define SYMBOL_STRING(name) #name
+#endif
+
+#if COMPILER(GCC) && PLATFORM(X86)
+
+// These ASSERTs remind you that, if you change the layout of JITStackFrame, you
+// need to change the assembly trampolines below to match.
+COMPILE_ASSERT(offsetof(struct JITStackFrame, callFrame) == 0x38, JITStackFrame_callFrame_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x30, JITStackFrame_code_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, savedEBX) == 0x1c, JITStackFrame_stub_argument_space_matches_ctiTrampoline);
+
+asm volatile (
+".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+SYMBOL_STRING(ctiTrampoline) ":" "\n"
+    "pushl %ebp" "\n"
+    "movl %esp, %ebp" "\n"
+    "pushl %esi" "\n"
+    "pushl %edi" "\n"
+    "pushl %ebx" "\n"
+    "subl $0x1c, %esp" "\n"
+    "movl $512, %esi" "\n"
+    "movl 0x38(%esp), %edi" "\n"
+    "call *0x30(%esp)" "\n"
+    "addl $0x1c, %esp" "\n"
+    "popl %ebx" "\n"
+    "popl %edi" "\n"
+    "popl %esi" "\n"
+    "popl %ebp" "\n"
+    "ret" "\n"
+);
+
+asm volatile (
+".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
+#if !USE(JIT_STUB_ARGUMENT_VA_LIST)
+    "movl %esp, %ecx" "\n"
+#endif
+    "call " SYMBOL_STRING(cti_vm_throw) "\n"
+    "addl $0x1c, %esp" "\n"
+    "popl %ebx" "\n"
+    "popl %edi" "\n"
+    "popl %esi" "\n"
+    "popl %ebp" "\n"
+    "ret" "\n"
+);
+    
+asm volatile (
+".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
+    "addl $0x1c, %esp" "\n"
+    "popl %ebx" "\n"
+    "popl %edi" "\n"
+    "popl %esi" "\n"
+    "popl %ebp" "\n"
+    "ret" "\n"
+);
+    
+#elif COMPILER(GCC) && PLATFORM(X86_64)
+
+#if USE(JIT_STUB_ARGUMENT_VA_LIST)
+#error "JIT_STUB_ARGUMENT_VA_LIST not supported on x86-64."
+#endif
+
+// These ASSERTs remind you that, if you change the layout of JITStackFrame, you
+// need to change the assembly trampolines below to match.
+COMPILE_ASSERT(offsetof(struct JITStackFrame, callFrame) == 0x90, JITStackFrame_callFrame_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x80, JITStackFrame_code_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, savedRBX) == 0x48, JITStackFrame_stub_argument_space_matches_ctiTrampoline);
+
+asm volatile (
+".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+SYMBOL_STRING(ctiTrampoline) ":" "\n"
+    "pushq %rbp" "\n"
+    "movq %rsp, %rbp" "\n"
+    "pushq %r12" "\n"
+    "pushq %r13" "\n"
+    "pushq %r14" "\n"
+    "pushq %r15" "\n"
+    "pushq %rbx" "\n"
+    "subq $0x48, %rsp" "\n"
+    "movq $512, %r12" "\n"
+    "movq $0xFFFF000000000000, %r14" "\n"
+    "movq $0xFFFF000000000002, %r15" "\n"
+    "movq 0x90(%rsp), %r13" "\n"
+    "call *0x80(%rsp)" "\n"
+    "addq $0x48, %rsp" "\n"
+    "popq %rbx" "\n"
+    "popq %r15" "\n"
+    "popq %r14" "\n"
+    "popq %r13" "\n"
+    "popq %r12" "\n"
+    "popq %rbp" "\n"
+    "ret" "\n"
+);
+
+asm volatile (
+".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
+    "movq %rsp, %rdi" "\n"
+    "call " SYMBOL_STRING(cti_vm_throw) "\n"
+    "addq $0x48, %rsp" "\n"
+    "popq %rbx" "\n"
+    "popq %r15" "\n"
+    "popq %r14" "\n"
+    "popq %r13" "\n"
+    "popq %r12" "\n"
+    "popq %rbp" "\n"
+    "ret" "\n"
+);
+
+asm volatile (
+".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
+    "addq $0x48, %rsp" "\n"
+    "popq %rbx" "\n"
+    "popq %r15" "\n"
+    "popq %r14" "\n"
+    "popq %r13" "\n"
+    "popq %r12" "\n"
+    "popq %rbp" "\n"
+    "ret" "\n"
+);
+
+#elif COMPILER(GCC) && PLATFORM_ARM_ARCH(7)
+
+#if USE(JIT_STUB_ARGUMENT_VA_LIST)
+#error "JIT_STUB_ARGUMENT_VA_LIST not supported on ARMv7."
+#endif
+
+asm volatile (
+".text" "\n"
+".align 2" "\n"
+".globl " SYMBOL_STRING(ctiTrampoline) "\n"
+".thumb" "\n"
+".thumb_func " SYMBOL_STRING(ctiTrampoline) "\n"
+SYMBOL_STRING(ctiTrampoline) ":" "\n"
+    "sub sp, sp, #0x3c" "\n"
+    "str lr, [sp, #0x20]" "\n"
+    "str r4, [sp, #0x24]" "\n"
+    "str r5, [sp, #0x28]" "\n"
+    "str r6, [sp, #0x2c]" "\n"
+    "str r1, [sp, #0x30]" "\n"
+    "str r2, [sp, #0x34]" "\n"
+    "str r3, [sp, #0x38]" "\n"
+    "cpy r5, r2" "\n"
+    "mov r6, #512" "\n"
+    "blx r0" "\n"
+    "ldr r6, [sp, #0x2c]" "\n"
+    "ldr r5, [sp, #0x28]" "\n"
+    "ldr r4, [sp, #0x24]" "\n"
+    "ldr lr, [sp, #0x20]" "\n"
+    "add sp, sp, #0x3c" "\n"
+    "bx lr" "\n"
+);
+
+asm volatile (
+".text" "\n"
+".align 2" "\n"
+".globl " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+".thumb" "\n"
+".thumb_func " SYMBOL_STRING(ctiVMThrowTrampoline) "\n"
+SYMBOL_STRING(ctiVMThrowTrampoline) ":" "\n"
+    "cpy r0, sp" "\n"
+    "bl " SYMBOL_STRING(cti_vm_throw) "\n"
+    "ldr r6, [sp, #0x2c]" "\n"
+    "ldr r5, [sp, #0x28]" "\n"
+    "ldr r4, [sp, #0x24]" "\n"
+    "ldr lr, [sp, #0x20]" "\n"
+    "add sp, sp, #0x3c" "\n"
+    "bx lr" "\n"
+);
+
+asm volatile (
+".text" "\n"
+".align 2" "\n"
+".globl " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+".thumb" "\n"
+".thumb_func " SYMBOL_STRING(ctiOpThrowNotCaught) "\n"
+SYMBOL_STRING(ctiOpThrowNotCaught) ":" "\n"
+    "ldr r6, [sp, #0x2c]" "\n"
+    "ldr r5, [sp, #0x28]" "\n"
+    "ldr r4, [sp, #0x24]" "\n"
+    "ldr lr, [sp, #0x20]" "\n"
+    "add sp, sp, #0x3c" "\n"
+    "bx lr" "\n"
+);
+
+#elif COMPILER(MSVC)
+
+#if USE(JIT_STUB_ARGUMENT_VA_LIST)
+#error "JIT_STUB_ARGUMENT_VA_LIST configuration not supported on MSVC."
+#endif
+
+// These ASSERTs remind you that, if you change the layout of JITStackFrame, you
+// need to change the assembly trampolines below to match.
+COMPILE_ASSERT(offsetof(struct JITStackFrame, callFrame) == 0x38, JITStackFrame_callFrame_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, code) == 0x30, JITStackFrame_code_offset_matches_ctiTrampoline);
+COMPILE_ASSERT(offsetof(struct JITStackFrame, savedEBX) == 0x1c, JITStackFrame_stub_argument_space_matches_ctiTrampoline);
+
+extern "C" {
+
+    __declspec(naked) EncodedJSValue ctiTrampoline(void* code, RegisterFile*, CallFrame*, JSValue* exception, Profiler**, JSGlobalData*)
+    {
+        __asm {
+            push ebp;
+            mov ebp, esp;
+            push esi;
+            push edi;
+            push ebx;
+            sub esp, 0x1c;
+            mov esi, 512;
+            mov ecx, esp;
+            mov edi, [esp + 0x38];
+            call [esp + 0x30];
+            add esp, 0x1c;
+            pop ebx;
+            pop edi;
+            pop esi;
+            pop ebp;
+            ret;
+        }
+    }
+
+    __declspec(naked) void ctiVMThrowTrampoline()
+    {
+        __asm {
+            mov ecx, esp;
+            call JITStubs::cti_vm_throw;
+            add esp, 0x1c;
+            pop ebx;
+            pop edi;
+            pop esi;
+            pop ebp;
+            ret;
+        }
+    }
+     
+     __declspec(naked) void ctiOpThrowNotCaught()
+     {
+         __asm {
+             add esp, 0x1c;
+             pop ebx;
+             pop edi;
+             pop esi;
+             pop ebp;
+             ret;
+         }
+     }
+}
+
+#endif
+
+#if ENABLE(OPCODE_SAMPLING)
+    #define CTI_SAMPLER stackFrame.globalData->interpreter->sampler()
+#else
+    #define CTI_SAMPLER 0
+#endif
+
+JITThunks::JITThunks(JSGlobalData* globalData)
+{
+    JIT::compileCTIMachineTrampolines(globalData, &m_executablePool, &m_ctiArrayLengthTrampoline, &m_ctiStringLengthTrampoline, &m_ctiVirtualCallPreLink, &m_ctiVirtualCallLink, &m_ctiVirtualCall, &m_ctiNativeCallThunk);
+
+#if PLATFORM_ARM_ARCH(7)
+    // Unfortunate the arm compiler does not like the use of offsetof on JITStackFrame (since it contains non POD types),
+    // and the OBJECT_OFFSETOF macro does not appear constantish enough for it to be happy with its use in COMPILE_ASSERT
+    // macros.
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedReturnAddress) == 0x20);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR4) == 0x24);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR5) == 0x28);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, preservedR6) == 0x2c);
+
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, registerFile) == 0x30);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, callFrame) == 0x34);
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, exception) == 0x38);
+    // The fifth argument is the first item already on the stack.
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, enabledProfilerReference) == 0x3c);
+
+    ASSERT(OBJECT_OFFSETOF(struct JITStackFrame, thunkReturnAddress) == 0x1C);
+#endif
+}
+
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+
+NEVER_INLINE void JITThunks::tryCachePutByID(CallFrame* callFrame, CodeBlock* codeBlock, ReturnAddressPtr returnAddress, JSValue baseValue, const PutPropertySlot& slot)
+{
+    // The interpreter checks for recursion here; I do not believe this can occur in CTI.
+
+    if (!baseValue.isCell())
+        return;
+
+    // Uncacheable: give up.
+    if (!slot.isCacheable()) {
+        ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(JITStubs::cti_op_put_by_id_generic));
+        return;
+    }
+    
+    JSCell* baseCell = asCell(baseValue);
+    Structure* structure = baseCell->structure();
+
+    if (structure->isDictionary()) {
+        ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(JITStubs::cti_op_put_by_id_generic));
+        return;
+    }
+
+    // If baseCell != base, then baseCell must be a proxy for another object.
+    if (baseCell != slot.base()) {
+        ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(JITStubs::cti_op_put_by_id_generic));
+        return;
+    }
+
+    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(returnAddress);
+
+    // Cache hit: Specialize instruction and ref Structures.
+
+    // Structure transition, cache transition info
+    if (slot.type() == PutPropertySlot::NewProperty) {
+        StructureChain* prototypeChain = structure->prototypeChain(callFrame);
+        if (!prototypeChain->isCacheable()) {
+            ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(JITStubs::cti_op_put_by_id_generic));
+            return;
+        }
+        stubInfo->initPutByIdTransition(structure->previousID(), structure, prototypeChain);
+        JIT::compilePutByIdTransition(callFrame->scopeChain()->globalData, codeBlock, stubInfo, structure->previousID(), structure, slot.cachedOffset(), prototypeChain, returnAddress);
+        return;
+    }
+    
+    stubInfo->initPutByIdReplace(structure);
+
+    JIT::patchPutByIdReplace(stubInfo, structure, slot.cachedOffset(), returnAddress);
+}
+
+NEVER_INLINE void JITThunks::tryCacheGetByID(CallFrame* callFrame, CodeBlock* codeBlock, ReturnAddressPtr returnAddress, JSValue baseValue, const Identifier& propertyName, const PropertySlot& slot)
+{
+    // FIXME: Write a test that proves we need to check for recursion here just
+    // like the interpreter does, then add a check for recursion.
+
+    // FIXME: Cache property access for immediates.
+    if (!baseValue.isCell()) {
+        ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(JITStubs::cti_op_get_by_id_generic));
+        return;
+    }
+    
+    JSGlobalData* globalData = &callFrame->globalData();
+
+    if (isJSArray(globalData, baseValue) && propertyName == callFrame->propertyNames().length) {
+        JIT::compilePatchGetArrayLength(callFrame->scopeChain()->globalData, codeBlock, returnAddress);
+        return;
+    }
+    
+    if (isJSString(globalData, baseValue) && propertyName == callFrame->propertyNames().length) {
+        // The tradeoff of compiling an patched inline string length access routine does not seem
+        // to pay off, so we currently only do this for arrays.
+        ctiPatchCallByReturnAddress(returnAddress, globalData->jitStubs.ctiStringLengthTrampoline());
+        return;
+    }
+
+    // Uncacheable: give up.
+    if (!slot.isCacheable()) {
+        ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(JITStubs::cti_op_get_by_id_generic));
+        return;
+    }
+
+    JSCell* baseCell = asCell(baseValue);
+    Structure* structure = baseCell->structure();
+
+    if (structure->isDictionary()) {
+        ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(JITStubs::cti_op_get_by_id_generic));
+        return;
+    }
+
+    // In the interpreter the last structure is trapped here; in CTI we use the
+    // *_second method to achieve a similar (but not quite the same) effect.
+
+    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(returnAddress);
+
+    // Cache hit: Specialize instruction and ref Structures.
+
+    if (slot.slotBase() == baseValue) {
+        // set this up, so derefStructures can do it's job.
+        stubInfo->initGetByIdSelf(structure);
+
+        JIT::patchGetByIdSelf(stubInfo, structure, slot.cachedOffset(), returnAddress);
+        return;
+    }
+
+    if (slot.slotBase() == structure->prototypeForLookup(callFrame)) {
+        ASSERT(slot.slotBase().isObject());
+
+        JSObject* slotBaseObject = asObject(slot.slotBase());
+
+        // Since we're accessing a prototype in a loop, it's a good bet that it
+        // should not be treated as a dictionary.
+        if (slotBaseObject->structure()->isDictionary())
+            slotBaseObject->setStructure(Structure::fromDictionaryTransition(slotBaseObject->structure()));
+        
+        stubInfo->initGetByIdProto(structure, slotBaseObject->structure());
+
+        JIT::compileGetByIdProto(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, slotBaseObject->structure(), slot.cachedOffset(), returnAddress);
+        return;
+    }
+
+    size_t count = countPrototypeChainEntriesAndCheckForProxies(callFrame, baseValue, slot);
+    if (!count) {
+        stubInfo->opcodeID = op_get_by_id_generic;
+        return;
+    }
+
+    StructureChain* prototypeChain = structure->prototypeChain(callFrame);
+    if (!prototypeChain->isCacheable()) {
+        ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(JITStubs::cti_op_get_by_id_generic));
+        return;
+    }
+    stubInfo->initGetByIdChain(structure, prototypeChain);
+    JIT::compileGetByIdChain(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, structure, prototypeChain, count, slot.cachedOffset(), returnAddress);
+}
+
+#endif
+
+#if USE(JIT_STUB_ARGUMENT_VA_LIST)
+#define SETUP_VA_LISTL_ARGS va_list vl_args; va_start(vl_args, args)
+#else
+#define SETUP_VA_LISTL_ARGS
+#endif
+
+#ifndef NDEBUG
+
+extern "C" {
+
+static void jscGeneratedNativeCode() 
+{
+    // When executing a JIT stub function (which might do an allocation), we hack the return address
+    // to pretend to be executing this function, to keep stack logging tools from blowing out
+    // memory.
+}
+
+}
+
+struct StackHack {
+    ALWAYS_INLINE StackHack(JITStackFrame& stackFrame) 
+        : stackFrame(stackFrame)
+        , savedReturnAddress(*stackFrame.returnAddressSlot())
+    {
+        *stackFrame.returnAddressSlot() = ReturnAddressPtr(FunctionPtr(jscGeneratedNativeCode));
+    }
+
+    ALWAYS_INLINE ~StackHack() 
+    { 
+        *stackFrame.returnAddressSlot() = savedReturnAddress;
+    }
+
+    JITStackFrame& stackFrame;
+    ReturnAddressPtr savedReturnAddress;
+};
+
+#define STUB_INIT_STACK_FRAME(stackFrame) SETUP_VA_LISTL_ARGS; JITStackFrame& stackFrame = *reinterpret_cast<JITStackFrame*>(STUB_ARGS); StackHack stackHack(stackFrame)
+#define STUB_SET_RETURN_ADDRESS(returnAddress) stackHack.savedReturnAddress = ReturnAddressPtr(returnAddress)
+#define STUB_RETURN_ADDRESS stackHack.savedReturnAddress
+
+#else
+
+#define STUB_INIT_STACK_FRAME(stackFrame) SETUP_VA_LISTL_ARGS; JITStackFrame& stackFrame = *reinterpret_cast<JITStackFrame*>(STUB_ARGS)
+#define STUB_SET_RETURN_ADDRESS(returnAddress) *stackFrame.returnAddressSlot() = ReturnAddressPtr(returnAddress)
+#define STUB_RETURN_ADDRESS *stackFrame.returnAddressSlot()
+
+#endif
+
+// The reason this is not inlined is to avoid having to do a PIC branch
+// to get the address of the ctiVMThrowTrampoline function. It's also
+// good to keep the code size down by leaving as much of the exception
+// handling code out of line as possible.
+static NEVER_INLINE void returnToThrowTrampoline(JSGlobalData* globalData, ReturnAddressPtr exceptionLocation, ReturnAddressPtr& returnAddressSlot)
+{
+    ASSERT(globalData->exception);
+    globalData->exceptionLocation = exceptionLocation;
+    returnAddressSlot = ReturnAddressPtr(FunctionPtr(ctiVMThrowTrampoline));
+}
+
+static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalData* globalData, ReturnAddressPtr exceptionLocation, ReturnAddressPtr& returnAddressSlot)
+{
+    globalData->exception = createStackOverflowError(callFrame);
+    returnToThrowTrampoline(globalData, exceptionLocation, returnAddressSlot);
+}
+
+#define VM_THROW_EXCEPTION() \
+    do { \
+        VM_THROW_EXCEPTION_AT_END(); \
+        return 0; \
+    } while (0)
+#define VM_THROW_EXCEPTION_AT_END() \
+    returnToThrowTrampoline(stackFrame.globalData, STUB_RETURN_ADDRESS, STUB_RETURN_ADDRESS)
+
+#define CHECK_FOR_EXCEPTION() \
+    do { \
+        if (UNLIKELY(stackFrame.globalData->exception != JSValue())) \
+            VM_THROW_EXCEPTION(); \
+    } while (0)
+#define CHECK_FOR_EXCEPTION_AT_END() \
+    do { \
+        if (UNLIKELY(stackFrame.globalData->exception != JSValue())) \
+            VM_THROW_EXCEPTION_AT_END(); \
+    } while (0)
+#define CHECK_FOR_EXCEPTION_VOID() \
+    do { \
+        if (UNLIKELY(stackFrame.globalData->exception != JSValue())) { \
+            VM_THROW_EXCEPTION_AT_END(); \
+            return; \
+        } \
+    } while (0)
+
+namespace JITStubs {
+
+#if PLATFORM_ARM_ARCH(7)
+
+#define DEFINE_STUB_FUNCTION(rtype, op) \
+    extern "C" { \
+        rtype JITStubThunked_##op(STUB_ARGS_DECLARATION); \
+    }; \
+    asm volatile ( \
+        ".text" "\n" \
+        ".align 2" "\n" \
+        ".globl " SYMBOL_STRING(cti_##op) "\n" \
+        ".thumb" "\n" \
+        ".thumb_func " SYMBOL_STRING(cti_##op) "\n" \
+        SYMBOL_STRING(cti_##op) ":" "\n" \
+        "str lr, [sp, #0x1c]" "\n" \
+        "bl " SYMBOL_STRING(JITStubThunked_##op) "\n" \
+        "ldr lr, [sp, #0x1c]" "\n" \
+        "bx lr" "\n" \
+        ); \
+    rtype JITStubThunked_##op(STUB_ARGS_DECLARATION) \
+
+#else
+#define DEFINE_STUB_FUNCTION(rtype, op) rtype JIT_STUB cti_##op(STUB_ARGS_DECLARATION)
+#endif
+
+DEFINE_STUB_FUNCTION(JSObject*, op_convert_this)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue v1 = stackFrame.args[0].jsValue();
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    JSObject* result = v1.toThisObject(callFrame);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return result;
+}
+
+DEFINE_STUB_FUNCTION(void, op_end)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    ScopeChainNode* scopeChain = stackFrame.callFrame->scopeChain();
+    ASSERT(scopeChain->refCount > 1);
+    scopeChain->deref();
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_add)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue v1 = stackFrame.args[0].jsValue();
+    JSValue v2 = stackFrame.args[1].jsValue();
+
+    double left;
+    double right = 0.0;
+
+    bool rightIsNumber = v2.getNumber(right);
+    if (rightIsNumber && v1.getNumber(left))
+        return JSValue::encode(jsNumber(stackFrame.globalData, left + right));
+    
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    bool leftIsString = v1.isString();
+    if (leftIsString && v2.isString()) {
+        RefPtr<UString::Rep> value = concatenate(asString(v1)->value().rep(), asString(v2)->value().rep());
+        if (UNLIKELY(!value)) {
+            throwOutOfMemoryError(callFrame);
+            VM_THROW_EXCEPTION();
+        }
+
+        return JSValue::encode(jsString(stackFrame.globalData, value.release()));
+    }
+
+    if (rightIsNumber & leftIsString) {
+        RefPtr<UString::Rep> value = v2.isInt32Fast() ?
+            concatenate(asString(v1)->value().rep(), v2.getInt32Fast()) :
+            concatenate(asString(v1)->value().rep(), right);
+
+        if (UNLIKELY(!value)) {
+            throwOutOfMemoryError(callFrame);
+            VM_THROW_EXCEPTION();
+        }
+        return JSValue::encode(jsString(stackFrame.globalData, value.release()));
+    }
+
+    // All other cases are pretty uncommon
+    JSValue result = jsAddSlowCase(callFrame, v1, v2);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_pre_inc)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue v = stackFrame.args[0].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, v.toNumber(callFrame) + 1);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(int, timeout_check)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+    
+    JSGlobalData* globalData = stackFrame.globalData;
+    TimeoutChecker& timeoutChecker = globalData->timeoutChecker;
+
+    if (timeoutChecker.didTimeOut(stackFrame.callFrame)) {
+        globalData->exception = createInterruptedExecutionException(globalData);
+        VM_THROW_EXCEPTION_AT_END();
+    }
+    
+    return timeoutChecker.ticksUntilNextCheck();
+}
+
+DEFINE_STUB_FUNCTION(void, register_file_check)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    if (LIKELY(stackFrame.registerFile->grow(&stackFrame.callFrame->registers()[stackFrame.callFrame->codeBlock()->m_numCalleeRegisters])))
+        return;
+
+    // Rewind to the previous call frame because op_call already optimistically
+    // moved the call frame forward.
+    CallFrame* oldCallFrame = stackFrame.callFrame->callerFrame();
+    stackFrame.callFrame = oldCallFrame;
+    throwStackOverflowError(oldCallFrame, stackFrame.globalData, ReturnAddressPtr(oldCallFrame->returnPC()), STUB_RETURN_ADDRESS);
+}
+
+DEFINE_STUB_FUNCTION(int, op_loop_if_less)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    bool result = jsLess(callFrame, src1, src2);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return result;
+}
+
+DEFINE_STUB_FUNCTION(int, op_loop_if_lesseq)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    bool result = jsLessEq(callFrame, src1, src2);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return result;
+}
+
+DEFINE_STUB_FUNCTION(JSObject*, op_new_object)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return constructEmptyObject(stackFrame.callFrame);
+}
+
+DEFINE_STUB_FUNCTION(void, op_put_by_id_generic)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    PutPropertySlot slot;
+    stackFrame.args[0].jsValue().put(stackFrame.callFrame, stackFrame.args[1].identifier(), stackFrame.args[2].jsValue(), slot);
+    CHECK_FOR_EXCEPTION_AT_END();
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_generic)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(callFrame, ident, slot);
+
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)
+
+DEFINE_STUB_FUNCTION(void, op_put_by_id)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
+
+    PutPropertySlot slot;
+    stackFrame.args[0].jsValue().put(callFrame, ident, stackFrame.args[2].jsValue(), slot);
+
+    ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_put_by_id_second));
+
+    CHECK_FOR_EXCEPTION_AT_END();
+}
+
+DEFINE_STUB_FUNCTION(void, op_put_by_id_second)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    PutPropertySlot slot;
+    stackFrame.args[0].jsValue().put(stackFrame.callFrame, stackFrame.args[1].identifier(), stackFrame.args[2].jsValue(), slot);
+    JITThunks::tryCachePutByID(stackFrame.callFrame, stackFrame.callFrame->codeBlock(), STUB_RETURN_ADDRESS, stackFrame.args[0].jsValue(), slot);
+    CHECK_FOR_EXCEPTION_AT_END();
+}
+
+DEFINE_STUB_FUNCTION(void, op_put_by_id_fail)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
+
+    PutPropertySlot slot;
+    stackFrame.args[0].jsValue().put(callFrame, ident, stackFrame.args[2].jsValue(), slot);
+
+    CHECK_FOR_EXCEPTION_AT_END();
+}
+
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_put_by_id_transition_realloc)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    int32_t oldSize = stackFrame.args[1].int32();
+    int32_t newSize = stackFrame.args[2].int32();
+
+    ASSERT(baseValue.isObject());
+    asObject(baseValue)->allocatePropertyStorage(oldSize, newSize);
+
+    return JSValue::encode(baseValue);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(callFrame, ident, slot);
+
+    ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_second));
+
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(callFrame, ident, slot);
+
+    ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_method_check_second));
+
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_method_check_second)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(callFrame, ident, slot);
+
+    CHECK_FOR_EXCEPTION();
+
+    // If we successfully got something, then the base from which it is being accessed must
+    // be an object.  (Assertion to ensure asObject() call below is safe, which comes after
+    // an isCacheable() chceck.
+    ASSERT(!slot.isCacheable() || slot.slotBase().isObject());
+
+    // Check that:
+    //   * We're dealing with a JSCell,
+    //   * the property is cachable,
+    //   * it's not a dictionary
+    //   * there is a function cached.
+    Structure* structure;
+    JSCell* specific;
+    JSObject* slotBaseObject;
+    if (baseValue.isCell()
+        && slot.isCacheable()
+        && !(structure = asCell(baseValue)->structure())->isDictionary()
+        && (slotBaseObject = asObject(slot.slotBase()))->getPropertySpecificValue(callFrame, ident, specific)
+        && specific
+        ) {
+
+        JSFunction* callee = (JSFunction*)specific;
+
+        // Since we're accessing a prototype in a loop, it's a good bet that it
+        // should not be treated as a dictionary.
+        if (slotBaseObject->structure()->isDictionary())
+            slotBaseObject->setStructure(Structure::fromDictionaryTransition(slotBaseObject->structure()));
+
+        // The result fetched should always be the callee!
+        ASSERT(result == JSValue(callee));
+        MethodCallLinkInfo& methodCallLinkInfo = callFrame->codeBlock()->getMethodCallLinkInfo(STUB_RETURN_ADDRESS);
+
+        // Check to see if the function is on the object's prototype.  Patch up the code to optimize.
+        if (slot.slotBase() == structure->prototypeForLookup(callFrame))
+            JIT::patchMethodCallProto(methodCallLinkInfo, callee, structure, slotBaseObject);
+        // Check to see if the function is on the object itself.
+        // Since we generate the method-check to check both the structure and a prototype-structure (since this
+        // is the common case) we have a problem - we need to patch the prototype structure check to do something
+        // useful.  We could try to nop it out altogether, but that's a little messy, so lets do something simpler
+        // for now.  For now it performs a check on a special object on the global object only used for this
+        // purpose.  The object is in no way exposed, and as such the check will always pass.
+        else if (slot.slotBase() == baseValue)
+            JIT::patchMethodCallProto(methodCallLinkInfo, callee, structure, callFrame->scopeChain()->globalObject()->methodCallDummy());
+
+        // For now let any other case be cached as a normal get_by_id.
+    }
+
+    // Revert the get_by_id op back to being a regular get_by_id - allow it to cache like normal, if it needs to.
+    ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id));
+
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_second)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(callFrame, ident, slot);
+
+    JITThunks::tryCacheGetByID(callFrame, callFrame->codeBlock(), STUB_RETURN_ADDRESS, baseValue, ident, slot);
+
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_self_fail)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    Identifier& ident = stackFrame.args[1].identifier();
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(callFrame, ident, slot);
+
+    CHECK_FOR_EXCEPTION();
+
+    if (baseValue.isCell()
+        && slot.isCacheable()
+        && !asCell(baseValue)->structure()->isDictionary()
+        && slot.slotBase() == baseValue) {
+
+        CodeBlock* codeBlock = callFrame->codeBlock();
+        StructureStubInfo* stubInfo = &codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
+
+        ASSERT(slot.slotBase().isObject());
+
+        PolymorphicAccessStructureList* polymorphicStructureList;
+        int listIndex = 1;
+
+        if (stubInfo->opcodeID == op_get_by_id_self) {
+            ASSERT(!stubInfo->stubRoutine);
+            polymorphicStructureList = new PolymorphicAccessStructureList(CodeLocationLabel(), stubInfo->u.getByIdSelf.baseObjectStructure);
+            stubInfo->initGetByIdSelfList(polymorphicStructureList, 2);
+        } else {
+            polymorphicStructureList = stubInfo->u.getByIdSelfList.structureList;
+            listIndex = stubInfo->u.getByIdSelfList.listSize;
+            stubInfo->u.getByIdSelfList.listSize++;
+        }
+
+        JIT::compileGetByIdSelfList(callFrame->scopeChain()->globalData, codeBlock, stubInfo, polymorphicStructureList, listIndex, asCell(baseValue)->structure(), slot.cachedOffset());
+
+        if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_generic));
+    } else {
+        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_generic));
+    }
+    return JSValue::encode(result);
+}
+
+static PolymorphicAccessStructureList* getPolymorphicAccessStructureListSlot(StructureStubInfo* stubInfo, int& listIndex)
+{
+    PolymorphicAccessStructureList* prototypeStructureList = 0;
+    listIndex = 1;
+
+    switch (stubInfo->opcodeID) {
+    case op_get_by_id_proto:
+        prototypeStructureList = new PolymorphicAccessStructureList(stubInfo->stubRoutine, stubInfo->u.getByIdProto.baseObjectStructure, stubInfo->u.getByIdProto.prototypeStructure);
+        stubInfo->stubRoutine = CodeLocationLabel();
+        stubInfo->initGetByIdProtoList(prototypeStructureList, 2);
+        break;
+    case op_get_by_id_chain:
+        prototypeStructureList = new PolymorphicAccessStructureList(stubInfo->stubRoutine, stubInfo->u.getByIdChain.baseObjectStructure, stubInfo->u.getByIdChain.chain);
+        stubInfo->stubRoutine = CodeLocationLabel();
+        stubInfo->initGetByIdProtoList(prototypeStructureList, 2);
+        break;
+    case op_get_by_id_proto_list:
+        prototypeStructureList = stubInfo->u.getByIdProtoList.structureList;
+        listIndex = stubInfo->u.getByIdProtoList.listSize;
+        stubInfo->u.getByIdProtoList.listSize++;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+    
+    ASSERT(listIndex < POLYMORPHIC_LIST_CACHE_SIZE);
+    return prototypeStructureList;
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(callFrame, stackFrame.args[1].identifier(), slot);
+
+    CHECK_FOR_EXCEPTION();
+
+    if (!baseValue.isCell() || !slot.isCacheable() || asCell(baseValue)->structure()->isDictionary()) {
+        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
+        return JSValue::encode(result);
+    }
+
+    Structure* structure = asCell(baseValue)->structure();
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    StructureStubInfo* stubInfo = &codeBlock->getStubInfo(STUB_RETURN_ADDRESS);
+
+    ASSERT(slot.slotBase().isObject());
+    JSObject* slotBaseObject = asObject(slot.slotBase());
+
+    if (slot.slotBase() == baseValue)
+        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
+    else if (slot.slotBase() == asCell(baseValue)->structure()->prototypeForLookup(callFrame)) {
+        // Since we're accessing a prototype in a loop, it's a good bet that it
+        // should not be treated as a dictionary.
+        if (slotBaseObject->structure()->isDictionary())
+            slotBaseObject->setStructure(Structure::fromDictionaryTransition(slotBaseObject->structure()));
+
+        int listIndex;
+        PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
+
+        JIT::compileGetByIdProtoList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, slotBaseObject->structure(), slot.cachedOffset());
+
+        if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
+    } else if (size_t count = countPrototypeChainEntriesAndCheckForProxies(callFrame, baseValue, slot)) {
+        StructureChain* protoChain = structure->prototypeChain(callFrame);
+        if (!protoChain->isCacheable()) {
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
+            return JSValue::encode(result);
+        }
+        
+        int listIndex;
+        PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
+        JIT::compileGetByIdChainList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, protoChain, count, slot.cachedOffset());
+
+        if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
+    } else
+        ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
+
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list_full)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(stackFrame.callFrame, stackFrame.args[1].identifier(), slot);
+
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_fail)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(stackFrame.callFrame, stackFrame.args[1].identifier(), slot);
+
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_array_fail)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(stackFrame.callFrame, stackFrame.args[1].identifier(), slot);
+
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_string_fail)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    PropertySlot slot(baseValue);
+    JSValue result = baseValue.get(stackFrame.callFrame, stackFrame.args[1].identifier(), slot);
+
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+#endif
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_instanceof)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue value = stackFrame.args[0].jsValue();
+    JSValue baseVal = stackFrame.args[1].jsValue();
+    JSValue proto = stackFrame.args[2].jsValue();
+
+    // At least one of these checks must have failed to get to the slow case.
+    ASSERT(!value.isCell() || !baseVal.isCell() || !proto.isCell()
+           || !value.isObject() || !baseVal.isObject() || !proto.isObject() 
+           || (asObject(baseVal)->structure()->typeInfo().flags() & (ImplementsHasInstance | OverridesHasInstance)) != ImplementsHasInstance);
+
+
+    // ECMA-262 15.3.5.3:
+    // Throw an exception either if baseVal is not an object, or if it does not implement 'HasInstance' (i.e. is a function).
+    TypeInfo typeInfo(UnspecifiedType, 0);
+    if (!baseVal.isObject() || !(typeInfo = asObject(baseVal)->structure()->typeInfo()).implementsHasInstance()) {
+        CallFrame* callFrame = stackFrame.callFrame;
+        CodeBlock* codeBlock = callFrame->codeBlock();
+        unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+        stackFrame.globalData->exception = createInvalidParamError(callFrame, "instanceof", baseVal, vPCIndex, codeBlock);
+        VM_THROW_EXCEPTION();
+    }
+    ASSERT(typeInfo.type() != UnspecifiedType);
+
+    if (!typeInfo.overridesHasInstance()) {
+        if (!value.isObject())
+            return JSValue::encode(jsBoolean(false));
+
+        if (!proto.isObject()) {
+            throwError(callFrame, TypeError, "instanceof called on an object with an invalid prototype property.");
+            VM_THROW_EXCEPTION();
+        }
+    }
+
+    JSValue result = jsBoolean(asObject(baseVal)->hasInstance(callFrame, value, proto));
+    CHECK_FOR_EXCEPTION_AT_END();
+
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_del_by_id)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    
+    JSObject* baseObj = stackFrame.args[0].jsValue().toObject(callFrame);
+
+    JSValue result = jsBoolean(baseObj->deleteProperty(callFrame, stackFrame.args[1].identifier()));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_mul)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+
+    double left;
+    double right;
+    if (src1.getNumber(left) && src2.getNumber(right))
+        return JSValue::encode(jsNumber(stackFrame.globalData, left * right));
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, src1.toNumber(callFrame) * src2.toNumber(callFrame));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(JSObject*, op_new_func)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return stackFrame.args[0].funcDeclNode()->makeFunction(stackFrame.callFrame, stackFrame.callFrame->scopeChain());
+}
+
+DEFINE_STUB_FUNCTION(void*, op_call_JSFunction)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+#ifndef NDEBUG
+    CallData callData;
+    ASSERT(stackFrame.args[0].jsValue().getCallData(callData) == CallTypeJS);
+#endif
+
+    JSFunction* function = asFunction(stackFrame.args[0].jsValue());
+    ASSERT(!function->isHostFunction());
+    FunctionBodyNode* body = function->body();
+    ScopeChainNode* callDataScopeChain = function->scope().node();
+    body->jitCode(callDataScopeChain);
+
+    return &(body->generatedBytecode());
+}
+
+DEFINE_STUB_FUNCTION(VoidPtrPair, op_call_arityCheck)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    CodeBlock* newCodeBlock = stackFrame.args[3].codeBlock();
+    ASSERT(newCodeBlock->codeType() != NativeCode);
+    int argCount = stackFrame.args[2].int32();
+
+    ASSERT(argCount != newCodeBlock->m_numParameters);
+
+    CallFrame* oldCallFrame = callFrame->callerFrame();
+
+    if (argCount > newCodeBlock->m_numParameters) {
+        size_t numParameters = newCodeBlock->m_numParameters;
+        Register* r = callFrame->registers() + numParameters;
+
+        Register* argv = r - RegisterFile::CallFrameHeaderSize - numParameters - argCount;
+        for (size_t i = 0; i < numParameters; ++i)
+            argv[i + argCount] = argv[i];
+
+        callFrame = CallFrame::create(r);
+        callFrame->setCallerFrame(oldCallFrame);
+    } else {
+        size_t omittedArgCount = newCodeBlock->m_numParameters - argCount;
+        Register* r = callFrame->registers() + omittedArgCount;
+        Register* newEnd = r + newCodeBlock->m_numCalleeRegisters;
+        if (!stackFrame.registerFile->grow(newEnd)) {
+            // Rewind to the previous call frame because op_call already optimistically
+            // moved the call frame forward.
+            stackFrame.callFrame = oldCallFrame;
+            throwStackOverflowError(oldCallFrame, stackFrame.globalData, stackFrame.args[1].returnAddress(), STUB_RETURN_ADDRESS);
+            RETURN_POINTER_PAIR(0, 0);
+        }
+
+        Register* argv = r - RegisterFile::CallFrameHeaderSize - omittedArgCount;
+        for (size_t i = 0; i < omittedArgCount; ++i)
+            argv[i] = jsUndefined();
+
+        callFrame = CallFrame::create(r);
+        callFrame->setCallerFrame(oldCallFrame);
+    }
+
+    RETURN_POINTER_PAIR(newCodeBlock, callFrame);
+}
+
+DEFINE_STUB_FUNCTION(void*, vm_dontLazyLinkCall)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSGlobalData* globalData = stackFrame.globalData;
+    JSFunction* callee = asFunction(stackFrame.args[0].jsValue());
+
+    ctiPatchNearCallByReturnAddress(stackFrame.args[1].returnAddress(), globalData->jitStubs.ctiVirtualCallLink());
+
+    return callee->body()->generatedJITCode().addressForCall().executableAddress();
+}
+
+DEFINE_STUB_FUNCTION(void*, vm_lazyLinkCall)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSFunction* callee = asFunction(stackFrame.args[0].jsValue());
+    JITCode& jitCode = callee->body()->generatedJITCode();
+    
+    CodeBlock* codeBlock = 0;
+    if (!callee->isHostFunction())
+        codeBlock = &callee->body()->bytecode(callee->scope().node());
+    else
+        codeBlock = &callee->body()->generatedBytecode();
+
+    CallLinkInfo* callLinkInfo = &stackFrame.callFrame->callerFrame()->codeBlock()->getCallLinkInfo(stackFrame.args[1].returnAddress());
+    JIT::linkCall(callee, codeBlock, jitCode, callLinkInfo, stackFrame.args[2].int32(), stackFrame.globalData);
+
+    return jitCode.addressForCall().executableAddress();
+}
+
+DEFINE_STUB_FUNCTION(JSObject*, op_push_activation)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSActivation* activation = new (stackFrame.globalData) JSActivation(stackFrame.callFrame, static_cast<FunctionBodyNode*>(stackFrame.callFrame->codeBlock()->ownerNode()));
+    stackFrame.callFrame->setScopeChain(stackFrame.callFrame->scopeChain()->copy()->push(activation));
+    return activation;
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_call_NotJSFunction)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue funcVal = stackFrame.args[0].jsValue();
+
+    CallData callData;
+    CallType callType = funcVal.getCallData(callData);
+
+    ASSERT(callType != CallTypeJS);
+
+    if (callType == CallTypeHost) {
+        int registerOffset = stackFrame.args[1].int32();
+        int argCount = stackFrame.args[2].int32();
+        CallFrame* previousCallFrame = stackFrame.callFrame;
+        CallFrame* callFrame = CallFrame::create(previousCallFrame->registers() + registerOffset);
+
+        callFrame->init(0, static_cast<Instruction*>((STUB_RETURN_ADDRESS).value()), previousCallFrame->scopeChain(), previousCallFrame, 0, argCount, 0);
+        stackFrame.callFrame = callFrame;
+
+        Register* argv = stackFrame.callFrame->registers() - RegisterFile::CallFrameHeaderSize - argCount;
+        ArgList argList(argv + 1, argCount - 1);
+
+        JSValue returnValue;
+        {
+            SamplingTool::HostCallRecord callRecord(CTI_SAMPLER);
+
+            // FIXME: All host methods should be calling toThisObject, but this is not presently the case.
+            JSValue thisValue = argv[0].jsValue();
+            if (thisValue == jsNull())
+                thisValue = callFrame->globalThisValue();
+
+            returnValue = callData.native.function(callFrame, asObject(funcVal), thisValue, argList);
+        }
+        stackFrame.callFrame = previousCallFrame;
+        CHECK_FOR_EXCEPTION();
+
+        return JSValue::encode(returnValue);
+    }
+
+    ASSERT(callType == CallTypeNone);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+    stackFrame.globalData->exception = createNotAFunctionError(stackFrame.callFrame, funcVal, vPCIndex, codeBlock);
+    VM_THROW_EXCEPTION();
+}
+
+DEFINE_STUB_FUNCTION(void, op_create_arguments)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    Arguments* arguments = new (stackFrame.globalData) Arguments(stackFrame.callFrame);
+    stackFrame.callFrame->setCalleeArguments(arguments);
+    stackFrame.callFrame[RegisterFile::ArgumentsRegister] = arguments;
+}
+
+DEFINE_STUB_FUNCTION(void, op_create_arguments_no_params)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    Arguments* arguments = new (stackFrame.globalData) Arguments(stackFrame.callFrame, Arguments::NoParameters);
+    stackFrame.callFrame->setCalleeArguments(arguments);
+    stackFrame.callFrame[RegisterFile::ArgumentsRegister] = arguments;
+}
+
+DEFINE_STUB_FUNCTION(void, op_tear_off_activation)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    ASSERT(stackFrame.callFrame->codeBlock()->needsFullScopeChain());
+    asActivation(stackFrame.args[0].jsValue())->copyRegisters(stackFrame.callFrame->optionalCalleeArguments());
+}
+
+DEFINE_STUB_FUNCTION(void, op_tear_off_arguments)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    ASSERT(stackFrame.callFrame->codeBlock()->usesArguments() && !stackFrame.callFrame->codeBlock()->needsFullScopeChain());
+    if (stackFrame.callFrame->optionalCalleeArguments())
+        stackFrame.callFrame->optionalCalleeArguments()->copyRegisters();
+}
+
+DEFINE_STUB_FUNCTION(void, op_profile_will_call)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    ASSERT(*stackFrame.enabledProfilerReference);
+    (*stackFrame.enabledProfilerReference)->willExecute(stackFrame.callFrame, stackFrame.args[0].jsValue());
+}
+
+DEFINE_STUB_FUNCTION(void, op_profile_did_call)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    ASSERT(*stackFrame.enabledProfilerReference);
+    (*stackFrame.enabledProfilerReference)->didExecute(stackFrame.callFrame, stackFrame.args[0].jsValue());
+}
+
+DEFINE_STUB_FUNCTION(void, op_ret_scopeChain)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    ASSERT(stackFrame.callFrame->codeBlock()->needsFullScopeChain());
+    stackFrame.callFrame->scopeChain()->deref();
+}
+
+DEFINE_STUB_FUNCTION(JSObject*, op_new_array)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    ArgList argList(&stackFrame.callFrame->registers()[stackFrame.args[0].int32()], stackFrame.args[1].int32());
+    return constructArray(stackFrame.callFrame, argList);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    ScopeChainNode* scopeChain = callFrame->scopeChain();
+
+    ScopeChainIterator iter = scopeChain->begin();
+    ScopeChainIterator end = scopeChain->end();
+    ASSERT(iter != end);
+
+    Identifier& ident = stackFrame.args[0].identifier();
+    do {
+        JSObject* o = *iter;
+        PropertySlot slot(o);
+        if (o->getPropertySlot(callFrame, ident, slot)) {
+            JSValue result = slot.getValue(callFrame, ident);
+            CHECK_FOR_EXCEPTION_AT_END();
+            return JSValue::encode(result);
+        }
+    } while (++iter != end);
+
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+    stackFrame.globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
+    VM_THROW_EXCEPTION();
+}
+
+DEFINE_STUB_FUNCTION(JSObject*, op_construct_JSConstruct)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSFunction* constructor = asFunction(stackFrame.args[0].jsValue());
+    if (constructor->isHostFunction()) {
+        CallFrame* callFrame = stackFrame.callFrame;
+        CodeBlock* codeBlock = callFrame->codeBlock();
+        unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+        stackFrame.globalData->exception = createNotAConstructorError(callFrame, constructor, vPCIndex, codeBlock);
+        VM_THROW_EXCEPTION();
+    }
+
+#ifndef NDEBUG
+    ConstructData constructData;
+    ASSERT(constructor->getConstructData(constructData) == ConstructTypeJS);
+#endif
+
+    Structure* structure;
+    if (stackFrame.args[3].jsValue().isObject())
+        structure = asObject(stackFrame.args[3].jsValue())->inheritorID();
+    else
+        structure = constructor->scope().node()->globalObject()->emptyObjectStructure();
+    return new (stackFrame.globalData) JSObject(structure);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_construct_NotJSConstruct)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    JSValue constrVal = stackFrame.args[0].jsValue();
+    int argCount = stackFrame.args[2].int32();
+    int thisRegister = stackFrame.args[4].int32();
+
+    ConstructData constructData;
+    ConstructType constructType = constrVal.getConstructData(constructData);
+
+    if (constructType == ConstructTypeHost) {
+        ArgList argList(callFrame->registers() + thisRegister + 1, argCount - 1);
+
+        JSValue returnValue;
+        {
+            SamplingTool::HostCallRecord callRecord(CTI_SAMPLER);
+            returnValue = constructData.native.function(callFrame, asObject(constrVal), argList);
+        }
+        CHECK_FOR_EXCEPTION();
+
+        return JSValue::encode(returnValue);
+    }
+
+    ASSERT(constructType == ConstructTypeNone);
+
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+    stackFrame.globalData->exception = createNotAConstructorError(callFrame, constrVal, vPCIndex, codeBlock);
+    VM_THROW_EXCEPTION();
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSGlobalData* globalData = stackFrame.globalData;
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    JSValue subscript = stackFrame.args[1].jsValue();
+
+    JSValue result;
+
+    if (LIKELY(subscript.isUInt32Fast())) {
+        uint32_t i = subscript.getUInt32Fast();
+        if (isJSArray(globalData, baseValue)) {
+            JSArray* jsArray = asArray(baseValue);
+            if (jsArray->canGetIndex(i))
+                result = jsArray->getIndex(i);
+            else
+                result = jsArray->JSArray::get(callFrame, i);
+        } else if (isJSString(globalData, baseValue) && asString(baseValue)->canGetIndex(i)) {
+            // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_val_string));
+            result = asString(baseValue)->getIndex(stackFrame.globalData, i);
+        } else if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
+            // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_val_byte_array));
+            return JSValue::encode(asByteArray(baseValue)->getIndex(callFrame, i));
+        } else
+            result = baseValue.get(callFrame, i);
+    } else {
+        Identifier property(callFrame, subscript.toString(callFrame));
+        result = baseValue.get(callFrame, property);
+    }
+
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+    
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val_string)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+    
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSGlobalData* globalData = stackFrame.globalData;
+    
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    JSValue subscript = stackFrame.args[1].jsValue();
+    
+    JSValue result;
+    
+    if (LIKELY(subscript.isUInt32Fast())) {
+        uint32_t i = subscript.getUInt32Fast();
+        if (isJSString(globalData, baseValue) && asString(baseValue)->canGetIndex(i))
+            result = asString(baseValue)->getIndex(stackFrame.globalData, i);
+        else {
+            result = baseValue.get(callFrame, i);
+            if (!isJSString(globalData, baseValue))
+                ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_val));
+        }
+    } else {
+        Identifier property(callFrame, subscript.toString(callFrame));
+        result = baseValue.get(callFrame, property);
+    }
+    
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+    
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_val_byte_array)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+    
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSGlobalData* globalData = stackFrame.globalData;
+    
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    JSValue subscript = stackFrame.args[1].jsValue();
+    
+    JSValue result;
+
+    if (LIKELY(subscript.isUInt32Fast())) {
+        uint32_t i = subscript.getUInt32Fast();
+        if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
+            // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
+            return JSValue::encode(asByteArray(baseValue)->getIndex(callFrame, i));
+        }
+
+        result = baseValue.get(callFrame, i);
+        if (!isJSByteArray(globalData, baseValue))
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_val));
+    } else {
+        Identifier property(callFrame, subscript.toString(callFrame));
+        result = baseValue.get(callFrame, property);
+    }
+    
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_func)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    ScopeChainNode* scopeChain = callFrame->scopeChain();
+
+    ScopeChainIterator iter = scopeChain->begin();
+    ScopeChainIterator end = scopeChain->end();
+
+    // FIXME: add scopeDepthIsZero optimization
+
+    ASSERT(iter != end);
+
+    Identifier& ident = stackFrame.args[0].identifier();
+    JSObject* base;
+    do {
+        base = *iter;
+        PropertySlot slot(base);
+        if (base->getPropertySlot(callFrame, ident, slot)) {            
+            // ECMA 11.2.3 says that if we hit an activation the this value should be null.
+            // However, section 10.2.3 says that in the case where the value provided
+            // by the caller is null, the global object should be used. It also says
+            // that the section does not apply to internal functions, but for simplicity
+            // of implementation we use the global object anyway here. This guarantees
+            // that in host objects you always get a valid object for this.
+            // We also handle wrapper substitution for the global object at the same time.
+            JSObject* thisObj = base->toThisObject(callFrame);
+            JSValue result = slot.getValue(callFrame, ident);
+            CHECK_FOR_EXCEPTION_AT_END();
+
+            callFrame->registers()[stackFrame.args[1].int32()] = JSValue(thisObj);
+            return JSValue::encode(result);
+        }
+        ++iter;
+    } while (iter != end);
+
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+    stackFrame.globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
+    VM_THROW_EXCEPTION_AT_END();
+    return JSValue::encode(JSValue());
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_sub)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+
+    double left;
+    double right;
+    if (src1.getNumber(left) && src2.getNumber(right))
+        return JSValue::encode(jsNumber(stackFrame.globalData, left - right));
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, src1.toNumber(callFrame) - src2.toNumber(callFrame));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(void, op_put_by_val)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSGlobalData* globalData = stackFrame.globalData;
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    JSValue subscript = stackFrame.args[1].jsValue();
+    JSValue value = stackFrame.args[2].jsValue();
+
+    if (LIKELY(subscript.isUInt32Fast())) {
+        uint32_t i = subscript.getUInt32Fast();
+        if (isJSArray(globalData, baseValue)) {
+            JSArray* jsArray = asArray(baseValue);
+            if (jsArray->canSetIndex(i))
+                jsArray->setIndex(i, value);
+            else
+                jsArray->JSArray::put(callFrame, i, value);
+        } else if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
+            JSByteArray* jsByteArray = asByteArray(baseValue);
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_put_by_val_byte_array));
+            // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
+            if (value.isInt32Fast()) {
+                jsByteArray->setIndex(i, value.getInt32Fast());
+                return;
+            } else {
+                double dValue = 0;
+                if (value.getNumber(dValue)) {
+                    jsByteArray->setIndex(i, dValue);
+                    return;
+                }
+            }
+
+            baseValue.put(callFrame, i, value);
+        } else
+            baseValue.put(callFrame, i, value);
+    } else {
+        Identifier property(callFrame, subscript.toString(callFrame));
+        if (!stackFrame.globalData->exception) { // Don't put to an object if toString threw an exception.
+            PutPropertySlot slot;
+            baseValue.put(callFrame, property, value, slot);
+        }
+    }
+
+    CHECK_FOR_EXCEPTION_AT_END();
+}
+
+DEFINE_STUB_FUNCTION(void, op_put_by_val_array)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    int i = stackFrame.args[1].int32();
+    JSValue value = stackFrame.args[2].jsValue();
+
+    ASSERT(isJSArray(stackFrame.globalData, baseValue));
+
+    if (LIKELY(i >= 0))
+        asArray(baseValue)->JSArray::put(callFrame, i, value);
+    else {
+        // This should work since we're re-boxing an immediate unboxed in JIT code.
+        ASSERT(JSValue::makeInt32Fast(i));
+        Identifier property(callFrame, JSValue::makeInt32Fast(i).toString(callFrame));
+        // FIXME: can toString throw an exception here?
+        if (!stackFrame.globalData->exception) { // Don't put to an object if toString threw an exception.
+            PutPropertySlot slot;
+            baseValue.put(callFrame, property, value, slot);
+        }
+    }
+
+    CHECK_FOR_EXCEPTION_AT_END();
+}
+
+DEFINE_STUB_FUNCTION(void, op_put_by_val_byte_array)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+    
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSGlobalData* globalData = stackFrame.globalData;
+    
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    JSValue subscript = stackFrame.args[1].jsValue();
+    JSValue value = stackFrame.args[2].jsValue();
+    
+    if (LIKELY(subscript.isUInt32Fast())) {
+        uint32_t i = subscript.getUInt32Fast();
+        if (isJSByteArray(globalData, baseValue) && asByteArray(baseValue)->canAccessIndex(i)) {
+            JSByteArray* jsByteArray = asByteArray(baseValue);
+            
+            // All fast byte array accesses are safe from exceptions so return immediately to avoid exception checks.
+            if (value.isInt32Fast()) {
+                jsByteArray->setIndex(i, value.getInt32Fast());
+                return;
+            } else {
+                double dValue = 0;                
+                if (value.getNumber(dValue)) {
+                    jsByteArray->setIndex(i, dValue);
+                    return;
+                }
+            }
+        }
+
+        if (!isJSByteArray(globalData, baseValue))
+            ctiPatchCallByReturnAddress(STUB_RETURN_ADDRESS, FunctionPtr(cti_op_put_by_val));
+        baseValue.put(callFrame, i, value);
+    } else {
+        Identifier property(callFrame, subscript.toString(callFrame));
+        if (!stackFrame.globalData->exception) { // Don't put to an object if toString threw an exception.
+            PutPropertySlot slot;
+            baseValue.put(callFrame, property, value, slot);
+        }
+    }
+    
+    CHECK_FOR_EXCEPTION_AT_END();
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_lesseq)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsBoolean(jsLessEq(callFrame, stackFrame.args[0].jsValue(), stackFrame.args[1].jsValue()));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(int, op_loop_if_true)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    bool result = src1.toBoolean(callFrame);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return result;
+}
+    
+DEFINE_STUB_FUNCTION(int, op_load_varargs)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+    CallFrame* callFrame = stackFrame.callFrame;
+    RegisterFile* registerFile = stackFrame.registerFile;
+    int argsOffset = stackFrame.args[0].int32();
+    JSValue arguments = callFrame->registers()[argsOffset].jsValue();
+    uint32_t argCount = 0;
+    if (!arguments) {
+        int providedParams = callFrame->registers()[RegisterFile::ArgumentCount].i() - 1;
+        argCount = providedParams;
+        int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+        Register* newEnd = callFrame->registers() + sizeDelta;
+        if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+            stackFrame.globalData->exception = createStackOverflowError(callFrame);
+            VM_THROW_EXCEPTION();
+        }
+        int32_t expectedParams = asFunction(callFrame->registers()[RegisterFile::Callee].jsValue())->body()->parameterCount();
+        int32_t inplaceArgs = min(providedParams, expectedParams);
+        
+        Register* inplaceArgsDst = callFrame->registers() + argsOffset;
+
+        Register* inplaceArgsEnd = inplaceArgsDst + inplaceArgs;
+        Register* inplaceArgsEnd2 = inplaceArgsDst + providedParams;
+
+        Register* inplaceArgsSrc = callFrame->registers() - RegisterFile::CallFrameHeaderSize - expectedParams;
+        Register* inplaceArgsSrc2 = inplaceArgsSrc - providedParams - 1 + inplaceArgs;
+ 
+        // First step is to copy the "expected" parameters from their normal location relative to the callframe
+        while (inplaceArgsDst < inplaceArgsEnd)
+            *inplaceArgsDst++ = *inplaceArgsSrc++;
+
+        // Then we copy any additional arguments that may be further up the stack ('-1' to account for 'this')
+        while (inplaceArgsDst < inplaceArgsEnd2)
+            *inplaceArgsDst++ = *inplaceArgsSrc2++;
+
+    } else if (!arguments.isUndefinedOrNull()) {
+        if (!arguments.isObject()) {
+            CodeBlock* codeBlock = callFrame->codeBlock();
+            unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+            stackFrame.globalData->exception = createInvalidParamError(callFrame, "Function.prototype.apply", arguments, vPCIndex, codeBlock);
+            VM_THROW_EXCEPTION();
+        }
+        if (asObject(arguments)->classInfo() == &Arguments::info) {
+            Arguments* argsObject = asArguments(arguments);
+            argCount = argsObject->numProvidedArguments(callFrame);
+            int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+            Register* newEnd = callFrame->registers() + sizeDelta;
+            if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+                stackFrame.globalData->exception = createStackOverflowError(callFrame);
+                VM_THROW_EXCEPTION();
+            }
+            argsObject->copyToRegisters(callFrame, callFrame->registers() + argsOffset, argCount);
+        } else if (isJSArray(&callFrame->globalData(), arguments)) {
+            JSArray* array = asArray(arguments);
+            argCount = array->length();
+            int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+            Register* newEnd = callFrame->registers() + sizeDelta;
+            if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+                stackFrame.globalData->exception = createStackOverflowError(callFrame);
+                VM_THROW_EXCEPTION();
+            }
+            array->copyToRegisters(callFrame, callFrame->registers() + argsOffset, argCount);
+        } else if (asObject(arguments)->inherits(&JSArray::info)) {
+            JSObject* argObject = asObject(arguments);
+            argCount = argObject->get(callFrame, callFrame->propertyNames().length).toUInt32(callFrame);
+            int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
+            Register* newEnd = callFrame->registers() + sizeDelta;
+            if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
+                stackFrame.globalData->exception = createStackOverflowError(callFrame);
+                VM_THROW_EXCEPTION();
+            }
+            Register* argsBuffer = callFrame->registers() + argsOffset;
+            for (unsigned i = 0; i < argCount; ++i) {
+                argsBuffer[i] = asObject(arguments)->get(callFrame, i);
+                CHECK_FOR_EXCEPTION();
+            }
+        } else {
+            CodeBlock* codeBlock = callFrame->codeBlock();
+            unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+            stackFrame.globalData->exception = createInvalidParamError(callFrame, "Function.prototype.apply", arguments, vPCIndex, codeBlock);
+            VM_THROW_EXCEPTION();
+        }
+    }
+
+    return argCount + 1;
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_negate)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src = stackFrame.args[0].jsValue();
+
+    double v;
+    if (src.getNumber(v))
+        return JSValue::encode(jsNumber(stackFrame.globalData, -v));
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, -src.toNumber(callFrame));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_base)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return JSValue::encode(JSC::resolveBase(stackFrame.callFrame, stackFrame.args[0].identifier(), stackFrame.callFrame->scopeChain()));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_skip)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    ScopeChainNode* scopeChain = callFrame->scopeChain();
+
+    int skip = stackFrame.args[1].int32();
+
+    ScopeChainIterator iter = scopeChain->begin();
+    ScopeChainIterator end = scopeChain->end();
+    ASSERT(iter != end);
+    while (skip--) {
+        ++iter;
+        ASSERT(iter != end);
+    }
+    Identifier& ident = stackFrame.args[0].identifier();
+    do {
+        JSObject* o = *iter;
+        PropertySlot slot(o);
+        if (o->getPropertySlot(callFrame, ident, slot)) {
+            JSValue result = slot.getValue(callFrame, ident);
+            CHECK_FOR_EXCEPTION_AT_END();
+            return JSValue::encode(result);
+        }
+    } while (++iter != end);
+
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+    stackFrame.globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
+    VM_THROW_EXCEPTION();
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_global)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSGlobalObject* globalObject = asGlobalObject(stackFrame.args[0].jsValue());
+    Identifier& ident = stackFrame.args[1].identifier();
+    unsigned globalResolveInfoIndex = stackFrame.args[2].int32();
+    ASSERT(globalObject->isGlobalObject());
+
+    PropertySlot slot(globalObject);
+    if (globalObject->getPropertySlot(callFrame, ident, slot)) {
+        JSValue result = slot.getValue(callFrame, ident);
+        if (slot.isCacheable() && !globalObject->structure()->isDictionary() && slot.slotBase() == globalObject) {
+            GlobalResolveInfo& globalResolveInfo = callFrame->codeBlock()->globalResolveInfo(globalResolveInfoIndex);
+            if (globalResolveInfo.structure)
+                globalResolveInfo.structure->deref();
+            globalObject->structure()->ref();
+            globalResolveInfo.structure = globalObject->structure();
+            globalResolveInfo.offset = slot.cachedOffset();
+            return JSValue::encode(result);
+        }
+
+        CHECK_FOR_EXCEPTION_AT_END();
+        return JSValue::encode(result);
+    }
+
+    unsigned vPCIndex = callFrame->codeBlock()->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+    stackFrame.globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, callFrame->codeBlock());
+    VM_THROW_EXCEPTION();
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_div)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+
+    double left;
+    double right;
+    if (src1.getNumber(left) && src2.getNumber(right))
+        return JSValue::encode(jsNumber(stackFrame.globalData, left / right));
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, src1.toNumber(callFrame) / src2.toNumber(callFrame));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_pre_dec)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue v = stackFrame.args[0].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, v.toNumber(callFrame) - 1);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(int, op_jless)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    bool result = jsLess(callFrame, src1, src2);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return result;
+}
+
+DEFINE_STUB_FUNCTION(int, op_jlesseq)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    bool result = jsLessEq(callFrame, src1, src2);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return result;
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_not)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src = stackFrame.args[0].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    JSValue result = jsBoolean(!src.toBoolean(callFrame));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(int, op_jtrue)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    bool result = src1.toBoolean(callFrame);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return result;
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_post_inc)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue v = stackFrame.args[0].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    JSValue number = v.toJSNumber(callFrame);
+    CHECK_FOR_EXCEPTION_AT_END();
+
+    callFrame->registers()[stackFrame.args[1].int32()] = jsNumber(stackFrame.globalData, number.uncheckedGetNumber() + 1);
+    return JSValue::encode(number);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_eq)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    ASSERT(!JSValue::areBothInt32Fast(src1, src2));
+    JSValue result = jsBoolean(JSValue::equalSlowCaseInline(callFrame, src1, src2));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_lshift)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue val = stackFrame.args[0].jsValue();
+    JSValue shift = stackFrame.args[1].jsValue();
+
+    int32_t left;
+    uint32_t right;
+    if (JSValue::areBothInt32Fast(val, shift))
+        return JSValue::encode(jsNumber(stackFrame.globalData, val.getInt32Fast() << (shift.getInt32Fast() & 0x1f)));
+    if (val.numberToInt32(left) && shift.numberToUInt32(right))
+        return JSValue::encode(jsNumber(stackFrame.globalData, left << (right & 0x1f)));
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, (val.toInt32(callFrame)) << (shift.toUInt32(callFrame) & 0x1f));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_bitand)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+
+    int32_t left;
+    int32_t right;
+    if (src1.numberToInt32(left) && src2.numberToInt32(right))
+        return JSValue::encode(jsNumber(stackFrame.globalData, left & right));
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, src1.toInt32(callFrame) & src2.toInt32(callFrame));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_rshift)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue val = stackFrame.args[0].jsValue();
+    JSValue shift = stackFrame.args[1].jsValue();
+
+    int32_t left;
+    uint32_t right;
+    if (JSFastMath::canDoFastRshift(val, shift))
+        return JSValue::encode(JSFastMath::rightShiftImmediateNumbers(val, shift));
+    if (val.numberToInt32(left) && shift.numberToUInt32(right))
+        return JSValue::encode(jsNumber(stackFrame.globalData, left >> (right & 0x1f)));
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, (val.toInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_bitnot)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src = stackFrame.args[0].jsValue();
+
+    int value;
+    if (src.numberToInt32(value))
+        return JSValue::encode(jsNumber(stackFrame.globalData, ~value));
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsNumber(stackFrame.globalData, ~src.toInt32(callFrame));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_with_base)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    ScopeChainNode* scopeChain = callFrame->scopeChain();
+
+    ScopeChainIterator iter = scopeChain->begin();
+    ScopeChainIterator end = scopeChain->end();
+
+    // FIXME: add scopeDepthIsZero optimization
+
+    ASSERT(iter != end);
+
+    Identifier& ident = stackFrame.args[0].identifier();
+    JSObject* base;
+    do {
+        base = *iter;
+        PropertySlot slot(base);
+        if (base->getPropertySlot(callFrame, ident, slot)) {
+            JSValue result = slot.getValue(callFrame, ident);
+            CHECK_FOR_EXCEPTION_AT_END();
+
+            callFrame->registers()[stackFrame.args[1].int32()] = JSValue(base);
+            return JSValue::encode(result);
+        }
+        ++iter;
+    } while (iter != end);
+
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+    stackFrame.globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
+    VM_THROW_EXCEPTION_AT_END();
+    return JSValue::encode(JSValue());
+}
+
+DEFINE_STUB_FUNCTION(JSObject*, op_new_func_exp)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return stackFrame.args[0].funcExprNode()->makeFunction(stackFrame.callFrame, stackFrame.callFrame->scopeChain());
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_mod)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue dividendValue = stackFrame.args[0].jsValue();
+    JSValue divisorValue = stackFrame.args[1].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    double d = dividendValue.toNumber(callFrame);
+    JSValue result = jsNumber(stackFrame.globalData, fmod(d, divisorValue.toNumber(callFrame)));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_less)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsBoolean(jsLess(callFrame, stackFrame.args[0].jsValue(), stackFrame.args[1].jsValue()));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_neq)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+
+    ASSERT(!JSValue::areBothInt32Fast(src1, src2));
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue result = jsBoolean(!JSValue::equalSlowCaseInline(callFrame, src1, src2));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_post_dec)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue v = stackFrame.args[0].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    JSValue number = v.toJSNumber(callFrame);
+    CHECK_FOR_EXCEPTION_AT_END();
+
+    callFrame->registers()[stackFrame.args[1].int32()] = jsNumber(stackFrame.globalData, number.uncheckedGetNumber() - 1);
+    return JSValue::encode(number);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_urshift)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue val = stackFrame.args[0].jsValue();
+    JSValue shift = stackFrame.args[1].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    if (JSFastMath::canDoFastUrshift(val, shift))
+        return JSValue::encode(JSFastMath::rightShiftImmediateNumbers(val, shift));
+    else {
+        JSValue result = jsNumber(stackFrame.globalData, (val.toUInt32(callFrame)) >> (shift.toUInt32(callFrame) & 0x1f));
+        CHECK_FOR_EXCEPTION_AT_END();
+        return JSValue::encode(result);
+    }
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_bitxor)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    JSValue result = jsNumber(stackFrame.globalData, src1.toInt32(callFrame) ^ src2.toInt32(callFrame));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(JSObject*, op_new_regexp)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return new (stackFrame.globalData) RegExpObject(stackFrame.callFrame->lexicalGlobalObject()->regExpStructure(), stackFrame.args[0].regExp());
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_bitor)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    JSValue result = jsNumber(stackFrame.globalData, src1.toInt32(callFrame) | src2.toInt32(callFrame));
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_call_eval)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    RegisterFile* registerFile = stackFrame.registerFile;
+
+    Interpreter* interpreter = stackFrame.globalData->interpreter;
+    
+    JSValue funcVal = stackFrame.args[0].jsValue();
+    int registerOffset = stackFrame.args[1].int32();
+    int argCount = stackFrame.args[2].int32();
+
+    Register* newCallFrame = callFrame->registers() + registerOffset;
+    Register* argv = newCallFrame - RegisterFile::CallFrameHeaderSize - argCount;
+    JSValue thisValue = argv[0].jsValue();
+    JSGlobalObject* globalObject = callFrame->scopeChain()->globalObject();
+
+    if (thisValue == globalObject && funcVal == globalObject->evalFunction()) {
+        JSValue exceptionValue;
+        JSValue result = interpreter->callEval(callFrame, registerFile, argv, argCount, registerOffset, exceptionValue);
+        if (UNLIKELY(exceptionValue != JSValue())) {
+            stackFrame.globalData->exception = exceptionValue;
+            VM_THROW_EXCEPTION_AT_END();
+        }
+        return JSValue::encode(result);
+    }
+
+    return JSValue::encode(JSValue());
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_throw)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    CodeBlock* codeBlock = callFrame->codeBlock();
+
+    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+
+    JSValue exceptionValue = stackFrame.args[0].jsValue();
+    ASSERT(exceptionValue);
+
+    HandlerInfo* handler = stackFrame.globalData->interpreter->throwException(callFrame, exceptionValue, vPCIndex, true);
+
+    if (!handler) {
+        *stackFrame.exception = exceptionValue;
+        STUB_SET_RETURN_ADDRESS(reinterpret_cast<void*>(ctiOpThrowNotCaught));
+        return JSValue::encode(jsNull());
+    }
+
+    stackFrame.callFrame = callFrame;
+    void* catchRoutine = handler->nativeCode.executableAddress();
+    ASSERT(catchRoutine);
+    STUB_SET_RETURN_ADDRESS(catchRoutine);
+    return JSValue::encode(exceptionValue);
+}
+
+DEFINE_STUB_FUNCTION(JSPropertyNameIterator*, op_get_pnames)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return JSPropertyNameIterator::create(stackFrame.callFrame, stackFrame.args[0].jsValue());
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_next_pname)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSPropertyNameIterator* it = stackFrame.args[0].propertyNameIterator();
+    JSValue temp = it->next(stackFrame.callFrame);
+    if (!temp)
+        it->invalidate();
+    return JSValue::encode(temp);
+}
+
+DEFINE_STUB_FUNCTION(JSObject*, op_push_scope)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSObject* o = stackFrame.args[0].jsValue().toObject(stackFrame.callFrame);
+    CHECK_FOR_EXCEPTION();
+    stackFrame.callFrame->setScopeChain(stackFrame.callFrame->scopeChain()->push(o));
+    return o;
+}
+
+DEFINE_STUB_FUNCTION(void, op_pop_scope)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    stackFrame.callFrame->setScopeChain(stackFrame.callFrame->scopeChain()->pop());
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_typeof)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return JSValue::encode(jsTypeStringForValue(stackFrame.callFrame, stackFrame.args[0].jsValue()));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_is_undefined)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue v = stackFrame.args[0].jsValue();
+    return JSValue::encode(jsBoolean(v.isCell() ? v.asCell()->structure()->typeInfo().masqueradesAsUndefined() : v.isUndefined()));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_is_boolean)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return JSValue::encode(jsBoolean(stackFrame.args[0].jsValue().isBoolean()));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_is_number)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return JSValue::encode(jsBoolean(stackFrame.args[0].jsValue().isNumber()));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_is_string)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return JSValue::encode(jsBoolean(isJSString(stackFrame.globalData, stackFrame.args[0].jsValue())));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_is_object)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return JSValue::encode(jsBoolean(jsIsObjectType(stackFrame.args[0].jsValue())));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_is_function)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return JSValue::encode(jsBoolean(jsIsFunctionType(stackFrame.args[0].jsValue())));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_stricteq)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+
+    return JSValue::encode(jsBoolean(JSValue::strictEqual(src1, src2)));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_to_primitive)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return JSValue::encode(stackFrame.args[0].jsValue().toPrimitive(stackFrame.callFrame));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_strcat)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    return JSValue::encode(concatenateStrings(stackFrame.callFrame, &stackFrame.callFrame->registers()[stackFrame.args[0].int32()], stackFrame.args[1].int32()));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_nstricteq)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src1 = stackFrame.args[0].jsValue();
+    JSValue src2 = stackFrame.args[1].jsValue();
+
+    return JSValue::encode(jsBoolean(!JSValue::strictEqual(src1, src2)));
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_to_jsnumber)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue src = stackFrame.args[0].jsValue();
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    JSValue result = src.toJSNumber(callFrame);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_in)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    JSValue baseVal = stackFrame.args[1].jsValue();
+
+    if (!baseVal.isObject()) {
+        CallFrame* callFrame = stackFrame.callFrame;
+        CodeBlock* codeBlock = callFrame->codeBlock();
+        unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, STUB_RETURN_ADDRESS);
+        stackFrame.globalData->exception = createInvalidParamError(callFrame, "in", baseVal, vPCIndex, codeBlock);
+        VM_THROW_EXCEPTION();
+    }
+
+    JSValue propName = stackFrame.args[0].jsValue();
+    JSObject* baseObj = asObject(baseVal);
+
+    uint32_t i;
+    if (propName.getUInt32(i))
+        return JSValue::encode(jsBoolean(baseObj->hasProperty(callFrame, i)));
+
+    Identifier property(callFrame, propName.toString(callFrame));
+    CHECK_FOR_EXCEPTION();
+    return JSValue::encode(jsBoolean(baseObj->hasProperty(callFrame, property)));
+}
+
+DEFINE_STUB_FUNCTION(JSObject*, op_push_new_scope)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSObject* scope = new (stackFrame.globalData) JSStaticScopeObject(stackFrame.callFrame, stackFrame.args[0].identifier(), stackFrame.args[1].jsValue(), DontDelete);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    callFrame->setScopeChain(callFrame->scopeChain()->push(scope));
+    return scope;
+}
+
+DEFINE_STUB_FUNCTION(void, op_jmp_scopes)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    unsigned count = stackFrame.args[0].int32();
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    ScopeChainNode* tmp = callFrame->scopeChain();
+    while (count--)
+        tmp = tmp->pop();
+    callFrame->setScopeChain(tmp);
+}
+
+DEFINE_STUB_FUNCTION(void, op_put_by_index)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    unsigned property = stackFrame.args[1].int32();
+
+    stackFrame.args[0].jsValue().put(callFrame, property, stackFrame.args[2].jsValue());
+}
+
+DEFINE_STUB_FUNCTION(void*, op_switch_imm)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue scrutinee = stackFrame.args[0].jsValue();
+    unsigned tableIndex = stackFrame.args[1].int32();
+    CallFrame* callFrame = stackFrame.callFrame;
+    CodeBlock* codeBlock = callFrame->codeBlock();
+
+    if (scrutinee.isInt32Fast())
+        return codeBlock->immediateSwitchJumpTable(tableIndex).ctiForValue(scrutinee.getInt32Fast()).executableAddress();
+    else {
+        double value;
+        int32_t intValue;
+        if (scrutinee.getNumber(value) && ((intValue = static_cast<int32_t>(value)) == value))
+            return codeBlock->immediateSwitchJumpTable(tableIndex).ctiForValue(intValue).executableAddress();
+        else
+            return codeBlock->immediateSwitchJumpTable(tableIndex).ctiDefault.executableAddress();
+    }
+}
+
+DEFINE_STUB_FUNCTION(void*, op_switch_char)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue scrutinee = stackFrame.args[0].jsValue();
+    unsigned tableIndex = stackFrame.args[1].int32();
+    CallFrame* callFrame = stackFrame.callFrame;
+    CodeBlock* codeBlock = callFrame->codeBlock();
+
+    void* result = codeBlock->characterSwitchJumpTable(tableIndex).ctiDefault.executableAddress();
+
+    if (scrutinee.isString()) {
+        UString::Rep* value = asString(scrutinee)->value().rep();
+        if (value->size() == 1)
+            result = codeBlock->characterSwitchJumpTable(tableIndex).ctiForValue(value->data()[0]).executableAddress();
+    }
+
+    return result;
+}
+
+DEFINE_STUB_FUNCTION(void*, op_switch_string)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    JSValue scrutinee = stackFrame.args[0].jsValue();
+    unsigned tableIndex = stackFrame.args[1].int32();
+    CallFrame* callFrame = stackFrame.callFrame;
+    CodeBlock* codeBlock = callFrame->codeBlock();
+
+    void* result = codeBlock->stringSwitchJumpTable(tableIndex).ctiDefault.executableAddress();
+
+    if (scrutinee.isString()) {
+        UString::Rep* value = asString(scrutinee)->value().rep();
+        result = codeBlock->stringSwitchJumpTable(tableIndex).ctiForValue(value).executableAddress();
+    }
+
+    return result;
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_del_by_val)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    JSValue baseValue = stackFrame.args[0].jsValue();
+    JSObject* baseObj = baseValue.toObject(callFrame); // may throw
+
+    JSValue subscript = stackFrame.args[1].jsValue();
+    JSValue result;
+    uint32_t i;
+    if (subscript.getUInt32(i))
+        result = jsBoolean(baseObj->deleteProperty(callFrame, i));
+    else {
+        CHECK_FOR_EXCEPTION();
+        Identifier property(callFrame, subscript.toString(callFrame));
+        CHECK_FOR_EXCEPTION();
+        result = jsBoolean(baseObj->deleteProperty(callFrame, property));
+    }
+
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
+DEFINE_STUB_FUNCTION(void, op_put_getter)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    ASSERT(stackFrame.args[0].jsValue().isObject());
+    JSObject* baseObj = asObject(stackFrame.args[0].jsValue());
+    ASSERT(stackFrame.args[2].jsValue().isObject());
+    baseObj->defineGetter(callFrame, stackFrame.args[1].identifier(), asObject(stackFrame.args[2].jsValue()));
+}
+
+DEFINE_STUB_FUNCTION(void, op_put_setter)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    ASSERT(stackFrame.args[0].jsValue().isObject());
+    JSObject* baseObj = asObject(stackFrame.args[0].jsValue());
+    ASSERT(stackFrame.args[2].jsValue().isObject());
+    baseObj->defineSetter(callFrame, stackFrame.args[1].identifier(), asObject(stackFrame.args[2].jsValue()));
+}
+
+DEFINE_STUB_FUNCTION(JSObject*, op_new_error)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    unsigned type = stackFrame.args[0].int32();
+    JSValue message = stackFrame.args[1].jsValue();
+    unsigned bytecodeOffset = stackFrame.args[2].int32();
+
+    unsigned lineNumber = codeBlock->lineNumberForBytecodeOffset(callFrame, bytecodeOffset);
+    return Error::create(callFrame, static_cast<ErrorType>(type), message.toString(callFrame), lineNumber, codeBlock->ownerNode()->sourceID(), codeBlock->ownerNode()->sourceURL());
+}
+
+DEFINE_STUB_FUNCTION(void, op_debug)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    int debugHookID = stackFrame.args[0].int32();
+    int firstLine = stackFrame.args[1].int32();
+    int lastLine = stackFrame.args[2].int32();
+
+    stackFrame.globalData->interpreter->debug(callFrame, static_cast<DebugHookID>(debugHookID), firstLine, lastLine);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, vm_throw)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+
+    CallFrame* callFrame = stackFrame.callFrame;
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    JSGlobalData* globalData = stackFrame.globalData;
+
+    unsigned vPCIndex = codeBlock->getBytecodeIndex(callFrame, globalData->exceptionLocation);
+
+    JSValue exceptionValue = globalData->exception;
+    ASSERT(exceptionValue);
+    globalData->exception = JSValue();
+
+    HandlerInfo* handler = globalData->interpreter->throwException(callFrame, exceptionValue, vPCIndex, false);
+
+    if (!handler) {
+        *stackFrame.exception = exceptionValue;
+        return JSValue::encode(jsNull());
+    }
+
+    stackFrame.callFrame = callFrame;
+    void* catchRoutine = handler->nativeCode.executableAddress();
+    ASSERT(catchRoutine);
+    STUB_SET_RETURN_ADDRESS(catchRoutine);
+    return JSValue::encode(exceptionValue);
+}
+
+} // namespace JITStubs
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
diff --git a/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
new file mode 100644
index 0000000..0493189
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/jit/JITStubs.h
@@ -0,0 +1,342 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JITStubs_h
+#define JITStubs_h
+
+#include <wtf/Platform.h>
+
+#include "MacroAssemblerCodeRef.h"
+#include "Register.h"
+
+#if ENABLE(JIT)
+
+namespace JSC {
+
+    class CodeBlock;
+    class ExecutablePool;
+    class Identifier;
+    class JSGlobalData;
+    class JSGlobalData;
+    class JSObject;
+    class JSPropertyNameIterator;
+    class JSValue;
+    class JSValueEncodedAsPointer;
+    class Profiler;
+    class PropertySlot;
+    class PutPropertySlot;
+    class RegisterFile;
+    class FuncDeclNode;
+    class FuncExprNode;
+    class RegExp;
+
+    union JITStubArg {
+        void* asPointer;
+        EncodedJSValue asEncodedJSValue;
+        int32_t asInt32;
+
+        JSValue jsValue() { return JSValue::decode(asEncodedJSValue); }
+        Identifier& identifier() { return *static_cast<Identifier*>(asPointer); }
+        int32_t int32() { return asInt32; }
+        CodeBlock* codeBlock() { return static_cast<CodeBlock*>(asPointer); }
+        FuncDeclNode* funcDeclNode() { return static_cast<FuncDeclNode*>(asPointer); }
+        FuncExprNode* funcExprNode() { return static_cast<FuncExprNode*>(asPointer); }
+        RegExp* regExp() { return static_cast<RegExp*>(asPointer); }
+        JSPropertyNameIterator* propertyNameIterator() { return static_cast<JSPropertyNameIterator*>(asPointer); }
+        ReturnAddressPtr returnAddress() { return ReturnAddressPtr(asPointer); }
+    };
+
+#if PLATFORM(X86_64)
+    struct JITStackFrame {
+        JITStubArg padding; // Unused
+        JITStubArg args[8];
+
+        void* savedRBX;
+        void* savedR15;
+        void* savedR14;
+        void* savedR13;
+        void* savedR12;
+        void* savedRBP;
+        void* savedRIP;
+
+        void* code;
+        RegisterFile* registerFile;
+        CallFrame* callFrame;
+        JSValue* exception;
+        Profiler** enabledProfilerReference;
+        JSGlobalData* globalData;
+
+        // When JIT code makes a call, it pushes its return address just below the rest of the stack.
+        ReturnAddressPtr* returnAddressSlot() { return reinterpret_cast<ReturnAddressPtr*>(this) - 1; }
+    };
+#elif PLATFORM(X86)
+    struct JITStackFrame {
+        JITStubArg padding; // Unused
+        JITStubArg args[6];
+
+        void* savedEBX;
+        void* savedEDI;
+        void* savedESI;
+        void* savedEBP;
+        void* savedEIP;
+
+        void* code;
+        RegisterFile* registerFile;
+        CallFrame* callFrame;
+        JSValue* exception;
+        Profiler** enabledProfilerReference;
+        JSGlobalData* globalData;
+        
+        // When JIT code makes a call, it pushes its return address just below the rest of the stack.
+        ReturnAddressPtr* returnAddressSlot() { return reinterpret_cast<ReturnAddressPtr*>(this) - 1; }
+    };
+#elif PLATFORM_ARM_ARCH(7)
+    struct JITStackFrame {
+        JITStubArg padding; // Unused
+        JITStubArg args[6];
+
+        ReturnAddressPtr thunkReturnAddress;
+
+        void* preservedReturnAddress;
+        void* preservedR4;
+        void* preservedR5;
+        void* preservedR6;
+
+        // These arguments passed in r1..r3 (r0 contained the entry code pointed, which is not preserved)
+        RegisterFile* registerFile;
+        CallFrame* callFrame;
+        JSValue* exception;
+
+        // These arguments passed on the stack.
+        Profiler** enabledProfilerReference;
+        JSGlobalData* globalData;
+        
+        ReturnAddressPtr* returnAddressSlot() { return &thunkReturnAddress; }
+    };
+#else
+#error "JITStackFrame not defined for this platform."
+#endif
+
+#if USE(JIT_STUB_ARGUMENT_VA_LIST)
+    #define STUB_ARGS_DECLARATION void* args, ...
+    #define STUB_ARGS (reinterpret_cast<void**>(vl_args) - 1)
+
+    #if COMPILER(MSVC)
+    #define JIT_STUB __cdecl
+    #else
+    #define JIT_STUB
+    #endif
+#else
+    #define STUB_ARGS_DECLARATION void** args
+    #define STUB_ARGS (args)
+
+    #if PLATFORM(X86) && COMPILER(MSVC)
+    #define JIT_STUB __fastcall
+    #elif PLATFORM(X86) && COMPILER(GCC)
+    #define JIT_STUB  __attribute__ ((fastcall))
+    #else
+    #define JIT_STUB
+    #endif
+#endif
+
+#if PLATFORM(X86_64)
+    struct VoidPtrPair {
+        void* first;
+        void* second;
+    };
+    #define RETURN_POINTER_PAIR(a,b) VoidPtrPair pair = { a, b }; return pair
+#else
+    // MSVC doesn't support returning a two-value struct in two registers, so
+    // we cast the struct to int64_t instead.
+    typedef uint64_t VoidPtrPair;
+    union VoidPtrPairUnion {
+        struct { void* first; void* second; } s;
+        VoidPtrPair i;
+    };
+    #define RETURN_POINTER_PAIR(a,b) VoidPtrPairUnion pair = {{ a, b }}; return pair.i
+#endif
+
+    extern "C" void ctiVMThrowTrampoline();
+    extern "C" void ctiOpThrowNotCaught();
+    extern "C" EncodedJSValue ctiTrampoline(
+#if PLATFORM(X86_64)
+            // FIXME: (bug #22910) this will force all arguments onto the stack (regparm(0) does not appear to have any effect).
+            // We can allow register passing here, and move the writes of these values into the trampoline.
+            void*, void*, void*, void*, void*, void*,
+#endif
+            void* code, RegisterFile*, CallFrame*, JSValue* exception, Profiler**, JSGlobalData*);
+
+    class JITThunks {
+    public:
+        JITThunks(JSGlobalData*);
+
+        static void tryCacheGetByID(CallFrame*, CodeBlock*, ReturnAddressPtr returnAddress, JSValue baseValue, const Identifier& propertyName, const PropertySlot&);
+        static void tryCachePutByID(CallFrame*, CodeBlock*, ReturnAddressPtr returnAddress, JSValue baseValue, const PutPropertySlot&);
+        
+        MacroAssemblerCodePtr ctiArrayLengthTrampoline() { return m_ctiArrayLengthTrampoline; }
+        MacroAssemblerCodePtr ctiStringLengthTrampoline() { return m_ctiStringLengthTrampoline; }
+        MacroAssemblerCodePtr ctiVirtualCallPreLink() { return m_ctiVirtualCallPreLink; }
+        MacroAssemblerCodePtr ctiVirtualCallLink() { return m_ctiVirtualCallLink; }
+        MacroAssemblerCodePtr ctiVirtualCall() { return m_ctiVirtualCall; }
+        MacroAssemblerCodePtr ctiNativeCallThunk() { return m_ctiNativeCallThunk; }
+
+    private:
+        RefPtr<ExecutablePool> m_executablePool;
+
+        MacroAssemblerCodePtr m_ctiArrayLengthTrampoline;
+        MacroAssemblerCodePtr m_ctiStringLengthTrampoline;
+        MacroAssemblerCodePtr m_ctiVirtualCallPreLink;
+        MacroAssemblerCodePtr m_ctiVirtualCallLink;
+        MacroAssemblerCodePtr m_ctiVirtualCall;
+        MacroAssemblerCodePtr m_ctiNativeCallThunk;
+    };
+
+namespace JITStubs { extern "C" {
+
+    void JIT_STUB cti_op_create_arguments(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_create_arguments_no_params(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_debug(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_end(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_jmp_scopes(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_pop_scope(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_profile_did_call(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_profile_will_call(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_id(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_id_fail(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_id_generic(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_id_second(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_index(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_val(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_val_array(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_by_val_byte_array(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_getter(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_put_setter(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_ret_scopeChain(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_tear_off_activation(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_op_tear_off_arguments(STUB_ARGS_DECLARATION);
+    void JIT_STUB cti_register_file_check(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_jless(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_jlesseq(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_jtrue(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_load_varargs(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_loop_if_less(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_loop_if_lesseq(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_op_loop_if_true(STUB_ARGS_DECLARATION);
+    int JIT_STUB cti_timeout_check(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_op_call_JSFunction(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_op_switch_char(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_op_switch_imm(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_op_switch_string(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_vm_dontLazyLinkCall(STUB_ARGS_DECLARATION);
+    void* JIT_STUB cti_vm_lazyLinkCall(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_construct_JSConstruct(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_convert_this(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_array(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_error(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_func(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_func_exp(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_object(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_new_regexp(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_push_activation(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_push_new_scope(STUB_ARGS_DECLARATION);
+    JSObject* JIT_STUB cti_op_push_scope(STUB_ARGS_DECLARATION);
+    JSPropertyNameIterator* JIT_STUB cti_op_get_pnames(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_add(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_bitand(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_bitnot(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_bitor(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_bitxor(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_call_NotJSFunction(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_call_eval(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_construct_NotJSConstruct(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_del_by_id(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_del_by_val(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_div(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_eq(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_method_check(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_method_check_second(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_array_fail(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_generic(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_proto_fail(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_proto_list(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_proto_list_full(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_second(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_self_fail(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_id_string_fail(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_val(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_val_byte_array(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_get_by_val_string(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_put_by_id_transition_realloc(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_in(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_instanceof(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_is_boolean(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_is_function(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_is_number(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_is_object(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_is_string(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_is_undefined(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_less(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_lesseq(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_lshift(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_mod(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_mul(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_negate(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_neq(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_next_pname(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_not(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_nstricteq(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_pre_dec(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_pre_inc(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_resolve(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_resolve_base(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_resolve_global(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_resolve_skip(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_rshift(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_strcat(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_stricteq(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_sub(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_throw(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_to_jsnumber(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_to_primitive(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_typeof(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_urshift(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_vm_throw(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_post_dec(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_post_inc(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_resolve_func(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_resolve_with_base(STUB_ARGS_DECLARATION);
+    VoidPtrPair JIT_STUB cti_op_call_arityCheck(STUB_ARGS_DECLARATION);
+
+}; } // extern "C" namespace JITStubs
+
+} // namespace JSC
+
+#endif // ENABLE(JIT)
+
+#endif // JITStubs_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/jsc.cpp b/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
index c8b796d..20d6694 100644
--- a/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/jsc.cpp
@@ -26,6 +26,7 @@
 #include "Completion.h"
 #include "InitializeThreading.h"
 #include "JSArray.h"
+#include "JSFunction.h"
 #include "JSLock.h"
 #include "PrototypeFunction.h"
 #include "SamplingTool.h"
@@ -51,9 +52,10 @@
 #include <signal.h>
 #endif
 
-#if COMPILER(MSVC) && !PLATFORM(WIN_CE)
+#if COMPILER(MSVC) && !PLATFORM(WINCE)
 #include <crtdbg.h>
 #include <windows.h>
+#include <mmsystem.h>
 #endif
 
 #if PLATFORM(QT)
@@ -67,14 +69,31 @@ using namespace WTF;
 static void cleanupGlobalData(JSGlobalData*);
 static bool fillBufferWithContentsOfFile(const UString& fileName, Vector<char>& buffer);
 
-static JSValuePtr functionPrint(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionDebug(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionGC(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionVersion(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionRun(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionLoad(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionReadline(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionQuit(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL functionPrint(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionDebug(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionGC(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionVersion(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionRun(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionLoad(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionCheckSyntax(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionReadline(ExecState*, JSObject*, JSValue, const ArgList&);
+static NO_RETURN JSValue JSC_HOST_CALL functionQuit(ExecState*, JSObject*, JSValue, const ArgList&);
+
+#if ENABLE(SAMPLING_FLAGS)
+static JSValue JSC_HOST_CALL functionSetSamplingFlags(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionClearSamplingFlags(ExecState*, JSObject*, JSValue, const ArgList&);
+#endif
+
+struct Script {
+    bool isFile;
+    char *argument;
+    
+    Script(bool isFile, char *argument)
+        : isFile(isFile)
+        , argument(argument)
+    {
+    }
+};
 
 struct Options {
     Options()
@@ -85,7 +104,7 @@ struct Options {
 
     bool interactive;
     bool dump;
-    Vector<UString> fileNames;
+    Vector<Script> scripts;
     Vector<UString> arguments;
 };
 
@@ -159,14 +178,20 @@ ASSERT_CLASS_FITS_IN_CELL(GlobalObject);
 GlobalObject::GlobalObject(const Vector<UString>& arguments)
     : JSGlobalObject()
 {
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "debug"), functionDebug));
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "print"), functionPrint));
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 0, Identifier(globalExec(), "quit"), functionQuit));
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 0, Identifier(globalExec(), "gc"), functionGC));
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "version"), functionVersion));
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "run"), functionRun));
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "load"), functionLoad));
-    putDirectFunction(globalExec(), new (globalExec()) PrototypeFunction(globalExec(), prototypeFunctionStructure(), 0, Identifier(globalExec(), "readline"), functionReadline));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "debug"), functionDebug));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "print"), functionPrint));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 0, Identifier(globalExec(), "quit"), functionQuit));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 0, Identifier(globalExec(), "gc"), functionGC));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "version"), functionVersion));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "run"), functionRun));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "load"), functionLoad));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "checkSyntax"), functionCheckSyntax));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 0, Identifier(globalExec(), "readline"), functionReadline));
+
+#if ENABLE(SAMPLING_FLAGS)
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "setSamplingFlags"), functionSetSamplingFlags));
+    putDirectFunction(globalExec(), new (globalExec()) NativeFunctionWrapper(globalExec(), prototypeFunctionStructure(), 1, Identifier(globalExec(), "clearSamplingFlags"), functionClearSamplingFlags));
+#endif
 
     JSObject* array = constructEmptyArray(globalExec());
     for (size_t i = 0; i < arguments.size(); ++i)
@@ -174,13 +199,13 @@ GlobalObject::GlobalObject(const Vector<UString>& arguments)
     putDirect(Identifier(globalExec(), "arguments"), array);
 }
 
-JSValuePtr functionPrint(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL functionPrint(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     for (unsigned i = 0; i < args.size(); ++i) {
         if (i != 0)
             putchar(' ');
         
-        printf("%s", args.at(exec, i)->toString(exec).UTF8String().c_str());
+        printf("%s", args.at(i).toString(exec).UTF8String().c_str());
     }
     
     putchar('\n');
@@ -188,30 +213,30 @@ JSValuePtr functionPrint(ExecState* exec, JSObject*, JSValuePtr, const ArgList&
     return jsUndefined();
 }
 
-JSValuePtr functionDebug(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL functionDebug(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    fprintf(stderr, "--> %s\n", args.at(exec, 0)->toString(exec).UTF8String().c_str());
+    fprintf(stderr, "--> %s\n", args.at(0).toString(exec).UTF8String().c_str());
     return jsUndefined();
 }
 
-JSValuePtr functionGC(ExecState* exec, JSObject*, JSValuePtr, const ArgList&)
+JSValue JSC_HOST_CALL functionGC(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
     JSLock lock(false);
     exec->heap()->collect();
     return jsUndefined();
 }
 
-JSValuePtr functionVersion(ExecState*, JSObject*, JSValuePtr, const ArgList&)
+JSValue JSC_HOST_CALL functionVersion(ExecState*, JSObject*, JSValue, const ArgList&)
 {
     // We need this function for compatibility with the Mozilla JS tests but for now
     // we don't actually do any version-specific handling
     return jsUndefined();
 }
 
-JSValuePtr functionRun(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL functionRun(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     StopWatch stopWatch;
-    UString fileName = args.at(exec, 0)->toString(exec);
+    UString fileName = args.at(0).toString(exec);
     Vector<char> script;
     if (!fillBufferWithContentsOfFile(fileName, script))
         return throwError(exec, GeneralError, "Could not open file.");
@@ -225,20 +250,61 @@ JSValuePtr functionRun(ExecState* exec, JSObject*, JSValuePtr, const ArgList& ar
     return jsNumber(globalObject->globalExec(), stopWatch.getElapsedMS());
 }
 
-JSValuePtr functionLoad(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL functionLoad(ExecState* exec, JSObject* o, JSValue v, const ArgList& args)
 {
-    UString fileName = args.at(exec, 0)->toString(exec);
+    UNUSED_PARAM(o);
+    UNUSED_PARAM(v);
+    UString fileName = args.at(0).toString(exec);
     Vector<char> script;
     if (!fillBufferWithContentsOfFile(fileName, script))
         return throwError(exec, GeneralError, "Could not open file.");
 
     JSGlobalObject* globalObject = exec->lexicalGlobalObject();
-    evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(script.data(), fileName));
+    Completion result = evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(script.data(), fileName));
+    if (result.complType() == Throw)
+        exec->setException(result.value());
+    return result.value();
+}
 
-    return jsUndefined();
+JSValue JSC_HOST_CALL functionCheckSyntax(ExecState* exec, JSObject* o, JSValue v, const ArgList& args)
+{
+    UNUSED_PARAM(o);
+    UNUSED_PARAM(v);
+    UString fileName = args.at(0).toString(exec);
+    Vector<char> script;
+    if (!fillBufferWithContentsOfFile(fileName, script))
+        return throwError(exec, GeneralError, "Could not open file.");
+
+    JSGlobalObject* globalObject = exec->lexicalGlobalObject();
+    Completion result = checkSyntax(globalObject->globalExec(), makeSource(script.data(), fileName));
+    if (result.complType() == Throw)
+        exec->setException(result.value());
+    return result.value();
+}
+
+#if ENABLE(SAMPLING_FLAGS)
+JSValue JSC_HOST_CALL functionSetSamplingFlags(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+{
+    for (unsigned i = 0; i < args.size(); ++i) {
+        unsigned flag = static_cast<unsigned>(args.at(i).toNumber(exec));
+        if ((flag >= 1) && (flag <= 32))
+            SamplingFlags::setFlag(flag);
+    }
+    return jsNull();
 }
 
-JSValuePtr functionReadline(ExecState* exec, JSObject*, JSValuePtr, const ArgList&)
+JSValue JSC_HOST_CALL functionClearSamplingFlags(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+{
+    for (unsigned i = 0; i < args.size(); ++i) {
+        unsigned flag = static_cast<unsigned>(args.at(i).toNumber(exec));
+        if ((flag >= 1) && (flag <= 32))
+            SamplingFlags::clearFlag(flag);
+    }
+    return jsNull();
+}
+#endif
+
+JSValue JSC_HOST_CALL functionReadline(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
     Vector<char, 256> line;
     int c;
@@ -252,14 +318,10 @@ JSValuePtr functionReadline(ExecState* exec, JSObject*, JSValuePtr, const ArgLis
     return jsString(exec, line.data());
 }
 
-JSValuePtr functionQuit(ExecState* exec, JSObject*, JSValuePtr, const ArgList&)
+JSValue JSC_HOST_CALL functionQuit(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
     cleanupGlobalData(&exec->globalData());
     exit(EXIT_SUCCESS);
-#if !COMPILER(MSVC) && !PLATFORM(WIN_CE)
-    // MSVC knows that exit(0) never returns, so it flags this return statement as unreachable.
-    return jsUndefined();
-#endif
 }
 
 // Use SEH for Release builds only to get rid of the crash report dialog
@@ -288,10 +350,17 @@ int main(int argc, char** argv)
     _CrtSetReportMode(_CRT_ASSERT, _CRTDBG_MODE_FILE);
 #endif
 
+#if COMPILER(MSVC) && !PLATFORM(WINCE)
+    timeBeginPeriod(1);
+#endif
+
 #if PLATFORM(QT)
     QCoreApplication app(argc, argv);
 #endif
 
+    // Initialize JSC before getting JSGlobalData.
+    JSC::initializeThreading();
+
     // We can't use destructors in the following code because it uses Windows
     // Structured Exception Handling
     int res = 0;
@@ -311,9 +380,11 @@ static void cleanupGlobalData(JSGlobalData* globalData)
     globalData->deref();
 }
 
-static bool runWithScripts(GlobalObject* globalObject, const Vector<UString>& fileNames, bool dump)
+static bool runWithScripts(GlobalObject* globalObject, const Vector<Script>& scripts, bool dump)
 {
-    Vector<char> script;
+    UString script;
+    UString fileName;
+    Vector<char> scriptBuffer;
 
     if (dump)
         BytecodeGenerator::setDumpsGeneratedCode(true);
@@ -321,42 +392,62 @@ static bool runWithScripts(GlobalObject* globalObject, const Vector<UString>& fi
 #if ENABLE(OPCODE_SAMPLING)
     Interpreter* interpreter = globalObject->globalData()->interpreter;
     interpreter->setSampler(new SamplingTool(interpreter));
+    interpreter->sampler()->setup();
+#endif
+#if ENABLE(SAMPLING_FLAGS)
+    SamplingFlags::start();
 #endif
 
     bool success = true;
-    for (size_t i = 0; i < fileNames.size(); i++) {
-        UString fileName = fileNames[i];
-
-        if (!fillBufferWithContentsOfFile(fileName, script))
-            return false; // fail early so we can catch missing files
+    for (size_t i = 0; i < scripts.size(); i++) {
+        if (scripts[i].isFile) {
+            fileName = scripts[i].argument;
+            if (!fillBufferWithContentsOfFile(fileName, scriptBuffer))
+                return false; // fail early so we can catch missing files
+            script = scriptBuffer.data();
+        } else {
+            script = scripts[i].argument;
+            fileName = "[Command Line]";
+        }
 
-#if ENABLE(OPCODE_SAMPLING)
-        interpreter->sampler()->start();
+#if ENABLE(SAMPLING_THREAD)
+        SamplingThread::start();
 #endif
-        Completion completion = evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(script.data(), fileName));
+
+        Completion completion = evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(script, fileName));
         success = success && completion.complType() != Throw;
         if (dump) {
             if (completion.complType() == Throw)
-                printf("Exception: %s\n", completion.value()->toString(globalObject->globalExec()).ascii());
+                printf("Exception: %s\n", completion.value().toString(globalObject->globalExec()).ascii());
             else
-                printf("End: %s\n", completion.value()->toString(globalObject->globalExec()).ascii());
+                printf("End: %s\n", completion.value().toString(globalObject->globalExec()).ascii());
         }
 
-        globalObject->globalExec()->clearException();
-
-#if ENABLE(OPCODE_SAMPLING)
-        interpreter->sampler()->stop();
+#if ENABLE(SAMPLING_THREAD)
+        SamplingThread::stop();
 #endif
+
+        globalObject->globalExec()->clearException();
     }
 
+#if ENABLE(SAMPLING_FLAGS)
+    SamplingFlags::stop();
+#endif
 #if ENABLE(OPCODE_SAMPLING)
     interpreter->sampler()->dump(globalObject->globalExec());
     delete interpreter->sampler();
 #endif
+#if ENABLE(SAMPLING_COUNTERS)
+    AbstractSamplingCounter::dump();
+#endif
     return success;
 }
 
-static void runInteractive(GlobalObject* globalObject)
+static
+#if !HAVE(READLINE)
+NO_RETURN
+#endif
+void runInteractive(GlobalObject* globalObject)
 {
     while (true) {
 #if HAVE(READLINE)
@@ -381,39 +472,48 @@ static void runInteractive(GlobalObject* globalObject)
         Completion completion = evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(line.data(), interpreterName));
 #endif
         if (completion.complType() == Throw)
-            printf("Exception: %s\n", completion.value()->toString(globalObject->globalExec()).ascii());
+            printf("Exception: %s\n", completion.value().toString(globalObject->globalExec()).ascii());
         else
-            printf("%s\n", completion.value()->toString(globalObject->globalExec()).UTF8String().c_str());
+            printf("%s\n", completion.value().toString(globalObject->globalExec()).UTF8String().c_str());
 
         globalObject->globalExec()->clearException();
     }
     printf("\n");
 }
 
-static void printUsageStatement()
+static NO_RETURN void printUsageStatement(JSGlobalData* globalData, bool help = false)
 {
     fprintf(stderr, "Usage: jsc [options] [files] [-- arguments]\n");
     fprintf(stderr, "  -d         Dumps bytecode (debug builds only)\n");
+    fprintf(stderr, "  -e         Evaluate argument as script code\n");
     fprintf(stderr, "  -f         Specifies a source file (deprecated)\n");
     fprintf(stderr, "  -h|--help  Prints this help message\n");
     fprintf(stderr, "  -i         Enables interactive mode (default if no files are specified)\n");
     fprintf(stderr, "  -s         Installs signal handlers that exit on a crash (Unix platforms only)\n");
-    exit(EXIT_FAILURE);
+
+    cleanupGlobalData(globalData);
+    exit(help ? EXIT_SUCCESS : EXIT_FAILURE);
 }
 
-static void parseArguments(int argc, char** argv, Options& options)
+static void parseArguments(int argc, char** argv, Options& options, JSGlobalData* globalData)
 {
     int i = 1;
     for (; i < argc; ++i) {
         const char* arg = argv[i];
         if (strcmp(arg, "-f") == 0) {
             if (++i == argc)
-                printUsageStatement();
-            options.fileNames.append(argv[i]);
+                printUsageStatement(globalData);
+            options.scripts.append(Script(true, argv[i]));
+            continue;
+        }
+        if (strcmp(arg, "-e") == 0) {
+            if (++i == argc)
+                printUsageStatement(globalData);
+            options.scripts.append(Script(false, argv[i]));
             continue;
         }
         if (strcmp(arg, "-h") == 0 || strcmp(arg, "--help") == 0) {
-            printUsageStatement();
+            printUsageStatement(globalData, true);
         }
         if (strcmp(arg, "-i") == 0) {
             options.interactive = true;
@@ -436,10 +536,10 @@ static void parseArguments(int argc, char** argv, Options& options)
             ++i;
             break;
         }
-        options.fileNames.append(argv[i]);
+        options.scripts.append(Script(true, argv[i]));
     }
     
-    if (options.fileNames.isEmpty())
+    if (options.scripts.isEmpty())
         options.interactive = true;
     
     for (; i < argc; ++i)
@@ -448,15 +548,13 @@ static void parseArguments(int argc, char** argv, Options& options)
 
 int jscmain(int argc, char** argv, JSGlobalData* globalData)
 {
-    JSC::initializeThreading();
-
     JSLock lock(false);
 
     Options options;
-    parseArguments(argc, argv, options);
+    parseArguments(argc, argv, options, globalData);
 
     GlobalObject* globalObject = new (globalData) GlobalObject(options.arguments);
-    bool success = runWithScripts(globalObject, options.fileNames, options.dump);
+    bool success = runWithScripts(globalObject, options.scripts, options.dump);
     if (options.interactive && success)
         runInteractive(globalObject);
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y b/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
index ae787f6..c5ca425 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Grammar.y
@@ -29,7 +29,7 @@
 #include <stdlib.h>
 #include "JSValue.h"
 #include "JSObject.h"
-#include "Nodes.h"
+#include "NodeConstructors.h"
 #include "Lexer.h"
 #include "JSString.h"
 #include "JSGlobalData.h"
@@ -80,7 +80,7 @@ static ExpressionNode* makeSubNode(void*, ExpressionNode*, ExpressionNode*, bool
 static ExpressionNode* makeLeftShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
 static ExpressionNode* makeRightShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
 static StatementNode* makeVarStatementNode(void*, ExpressionNode*);
-static ExpressionNode* combineVarInitializers(void*, ExpressionNode* list, AssignResolveNode* init);
+static ExpressionNode* combineCommaNodes(void*, ExpressionNode* list, ExpressionNode* init);
 
 #if COMPILER(MSVC)
 
@@ -99,24 +99,24 @@ static ExpressionNode* combineVarInitializers(void*, ExpressionNode* list, Assig
 #define YYPARSE_PARAM globalPtr
 #define YYLEX_PARAM globalPtr
 
-template <typename T> NodeDeclarationInfo<T> createNodeDeclarationInfo(T node, ParserRefCountedData<DeclarationStacks::VarStack>* varDecls, 
-                                                                       ParserRefCountedData<DeclarationStacks::FunctionStack>* funcDecls,
+template <typename T> NodeDeclarationInfo<T> createNodeDeclarationInfo(T node, ParserArenaData<DeclarationStacks::VarStack>* varDecls, 
+                                                                       ParserArenaData<DeclarationStacks::FunctionStack>* funcDecls,
                                                                        CodeFeatures info,
                                                                        int numConstants) 
 {
     ASSERT((info & ~AllFeatures) == 0);
-    NodeDeclarationInfo<T> result = {node, varDecls, funcDecls, info, numConstants};
+    NodeDeclarationInfo<T> result = { node, varDecls, funcDecls, info, numConstants };
     return result;
 }
 
 template <typename T> NodeInfo<T> createNodeInfo(T node, CodeFeatures info, int numConstants)
 {
     ASSERT((info & ~AllFeatures) == 0);
-    NodeInfo<T> result = {node, info, numConstants};
+    NodeInfo<T> result = { node, info, numConstants };
     return result;
 }
 
-template <typename T> T mergeDeclarationLists(T decls1, T decls2) 
+template <typename T> inline T mergeDeclarationLists(T decls1, T decls2) 
 {
     // decls1 or both are null
     if (!decls1)
@@ -128,28 +128,28 @@ template <typename T> T mergeDeclarationLists(T decls1, T decls2)
     // Both are non-null
     decls1->data.append(decls2->data);
     
-    // We manually release the declaration lists to avoid accumulating many many
-    // unused heap allocated vectors
-    decls2->ref();
-    decls2->deref();
+    // Manually release as much as possible from the now-defunct declaration lists
+    // to avoid accumulating so many unused heap allocated vectors.
+    decls2->data.clear();
+
     return decls1;
 }
 
-static void appendToVarDeclarationList(void* globalPtr, ParserRefCountedData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
+static void appendToVarDeclarationList(void* globalPtr, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
 {
     if (!varDecls)
-        varDecls = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+        varDecls = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
 
     varDecls->data.append(make_pair(ident, attrs));
 
 }
 
-static inline void appendToVarDeclarationList(void* globalPtr, ParserRefCountedData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
+static inline void appendToVarDeclarationList(void* globalPtr, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
 {
     unsigned attrs = DeclarationStacks::IsConstant;
-    if (decl->m_init)
+    if (decl->hasInitializer())
         attrs |= DeclarationStacks::HasInitializer;        
-    appendToVarDeclarationList(globalPtr, varDecls, decl->m_ident, attrs);
+    appendToVarDeclarationList(globalPtr, varDecls, decl->ident(), attrs);
 }
 
 %}
@@ -218,7 +218,7 @@ static inline void appendToVarDeclarationList(void* globalPtr, ParserRefCountedD
 %token ANDEQUAL MODEQUAL           /* &= and %= */
 %token XOREQUAL OREQUAL            /* ^= and |= */
 %token <intValue> OPENBRACE        /* { (with char offset) */
-%token <intValue> CLOSEBRACE        /* { (with char offset) */
+%token <intValue> CLOSEBRACE       /* } (with char offset) */
 
 /* terminal types */
 %token <doubleValue> NUMBER
@@ -264,7 +264,7 @@ static inline void appendToVarDeclarationList(void* globalPtr, ParserRefCountedD
 %type <expressionNode>  Initializer InitializerNoIn
 %type <statementNode>   FunctionDeclaration
 %type <funcExprNode>    FunctionExpr
-%type <functionBodyNode>  FunctionBody
+%type <functionBodyNode> FunctionBody
 %type <sourceElements>  SourceElements
 %type <parameterList>   FormalParameterList
 %type <op>              AssignmentOperator
@@ -287,16 +287,16 @@ static inline void appendToVarDeclarationList(void* globalPtr, ParserRefCountedD
 // In the mean time, make sure to make any changes to the grammar in both versions.
 
 Literal:
-    NULLTOKEN                           { $$ = createNodeInfo<ExpressionNode*>(new NullNode(GLOBAL_DATA), 0, 1); }
-  | TRUETOKEN                           { $$ = createNodeInfo<ExpressionNode*>(new BooleanNode(GLOBAL_DATA, true), 0, 1); }
-  | FALSETOKEN                          { $$ = createNodeInfo<ExpressionNode*>(new BooleanNode(GLOBAL_DATA, false), 0, 1); }
+    NULLTOKEN                           { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NullNode(GLOBAL_DATA), 0, 1); }
+  | TRUETOKEN                           { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, true), 0, 1); }
+  | FALSETOKEN                          { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, false), 0, 1); }
   | NUMBER                              { $$ = createNodeInfo<ExpressionNode*>(makeNumberNode(GLOBAL_DATA, $1), 0, 1); }
-  | STRING                              { $$ = createNodeInfo<ExpressionNode*>(new StringNode(GLOBAL_DATA, *$1), 0, 1); }
+  | STRING                              { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StringNode(GLOBAL_DATA, *$1), 0, 1); }
   | '/' /* regexp */                    {
                                             Lexer& l = *LEXER;
                                             if (!l.scanRegExp())
                                                 YYABORT;
-                                            RegExpNode* node = new RegExpNode(GLOBAL_DATA, l.pattern(), l.flags());
+                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, l.pattern(), l.flags());
                                             int size = l.pattern().size() + 2; // + 2 for the two /'s
                                             SET_EXCEPTION_LOCATION(node, @1.first_column, @1.first_column + size, @1.first_column + size);
                                             $$ = createNodeInfo<ExpressionNode*>(node, 0, 0);
@@ -305,7 +305,7 @@ Literal:
                                             Lexer& l = *LEXER;
                                             if (!l.scanRegExp())
                                                 YYABORT;
-                                            RegExpNode* node = new RegExpNode(GLOBAL_DATA, "=" + l.pattern(), l.flags());
+                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, "=" + l.pattern(), l.flags());
                                             int size = l.pattern().size() + 2; // + 2 for the two /'s
                                             SET_EXCEPTION_LOCATION(node, @1.first_column, @1.first_column + size, @1.first_column + size);
                                             $$ = createNodeInfo<ExpressionNode*>(node, 0, 0);
@@ -313,9 +313,9 @@ Literal:
 ;
 
 Property:
-    IDENT ':' AssignmentExpr            { $$ = createNodeInfo<PropertyNode*>(new PropertyNode(GLOBAL_DATA, *$1, $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
-  | STRING ':' AssignmentExpr           { $$ = createNodeInfo<PropertyNode*>(new PropertyNode(GLOBAL_DATA, *$1, $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
-  | NUMBER ':' AssignmentExpr           { $$ = createNodeInfo<PropertyNode*>(new PropertyNode(GLOBAL_DATA, Identifier(GLOBAL_DATA, UString::from($1)), $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
+    IDENT ':' AssignmentExpr            { $$ = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *$1, $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
+  | STRING ':' AssignmentExpr           { $$ = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *$1, $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
+  | NUMBER ':' AssignmentExpr           { $$ = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, Identifier(GLOBAL_DATA, UString::from($1)), $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
   | IDENT IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE    { $$ = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(globalPtr, *$1, *$2, 0, $6, LEXER->sourceCode($5, $7, @5.first_line)), ClosureFeature, 0); DBG($6, @5, @7); if (!$$.m_node) YYABORT; }
   | IDENT IDENT '(' FormalParameterList ')' OPENBRACE FunctionBody CLOSEBRACE
                                                              {
@@ -329,46 +329,46 @@ Property:
 ;
 
 PropertyList:
-    Property                            { $$.m_node.head = new PropertyListNode(GLOBAL_DATA, $1.m_node); 
+    Property                            { $$.m_node.head = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, $1.m_node); 
                                           $$.m_node.tail = $$.m_node.head;
                                           $$.m_features = $1.m_features;
                                           $$.m_numConstants = $1.m_numConstants; }
   | PropertyList ',' Property           { $$.m_node.head = $1.m_node.head;
-                                          $$.m_node.tail = new PropertyListNode(GLOBAL_DATA, $3.m_node, $1.m_node.tail);
+                                          $$.m_node.tail = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, $3.m_node, $1.m_node.tail);
                                           $$.m_features = $1.m_features | $3.m_features;
                                           $$.m_numConstants = $1.m_numConstants + $3.m_numConstants; }
 ;
 
 PrimaryExpr:
     PrimaryExprNoBrace
-  | OPENBRACE CLOSEBRACE                             { $$ = createNodeInfo<ExpressionNode*>(new ObjectLiteralNode(GLOBAL_DATA), 0, 0); }
-  | OPENBRACE PropertyList CLOSEBRACE                { $$ = createNodeInfo<ExpressionNode*>(new ObjectLiteralNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
+  | OPENBRACE CLOSEBRACE                             { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA), 0, 0); }
+  | OPENBRACE PropertyList CLOSEBRACE                { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
   /* allow extra comma, see http://bugs.webkit.org/show_bug.cgi?id=5939 */
-  | OPENBRACE PropertyList ',' CLOSEBRACE            { $$ = createNodeInfo<ExpressionNode*>(new ObjectLiteralNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
+  | OPENBRACE PropertyList ',' CLOSEBRACE            { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
 ;
 
 PrimaryExprNoBrace:
-    THISTOKEN                           { $$ = createNodeInfo<ExpressionNode*>(new ThisNode(GLOBAL_DATA), ThisFeature, 0); }
+    THISTOKEN                           { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ThisNode(GLOBAL_DATA), ThisFeature, 0); }
   | Literal
   | ArrayLiteral
-  | IDENT                               { $$ = createNodeInfo<ExpressionNode*>(new ResolveNode(GLOBAL_DATA, *$1, @1.first_column), (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); }
+  | IDENT                               { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ResolveNode(GLOBAL_DATA, *$1, @1.first_column), (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); }
   | '(' Expr ')'                        { $$ = $2; }
 ;
 
 ArrayLiteral:
-    '[' ElisionOpt ']'                  { $$ = createNodeInfo<ExpressionNode*>(new ArrayNode(GLOBAL_DATA, $2), 0, $2 ? 1 : 0); }
-  | '[' ElementList ']'                 { $$ = createNodeInfo<ExpressionNode*>(new ArrayNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
-  | '[' ElementList ',' ElisionOpt ']'  { $$ = createNodeInfo<ExpressionNode*>(new ArrayNode(GLOBAL_DATA, $4, $2.m_node.head), $2.m_features, $4 ? $2.m_numConstants + 1 : $2.m_numConstants); }
+    '[' ElisionOpt ']'                  { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, $2), 0, $2 ? 1 : 0); }
+  | '[' ElementList ']'                 { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
+  | '[' ElementList ',' ElisionOpt ']'  { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, $4, $2.m_node.head), $2.m_features, $4 ? $2.m_numConstants + 1 : $2.m_numConstants); }
 ;
 
 ElementList:
-    ElisionOpt AssignmentExpr           { $$.m_node.head = new ElementNode(GLOBAL_DATA, $1, $2.m_node);
+    ElisionOpt AssignmentExpr           { $$.m_node.head = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, $1, $2.m_node);
                                           $$.m_node.tail = $$.m_node.head;
                                           $$.m_features = $2.m_features;
                                           $$.m_numConstants = $2.m_numConstants; }
   | ElementList ',' ElisionOpt AssignmentExpr
                                         { $$.m_node.head = $1.m_node.head;
-                                          $$.m_node.tail = new ElementNode(GLOBAL_DATA, $1.m_node.tail, $3, $4.m_node);
+                                          $$.m_node.tail = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, $1.m_node.tail, $3, $4.m_node);
                                           $$.m_features = $1.m_features | $4.m_features;
                                           $$.m_numConstants = $1.m_numConstants + $4.m_numConstants; }
 ;
@@ -386,15 +386,15 @@ Elision:
 MemberExpr:
     PrimaryExpr
   | FunctionExpr                        { $$ = createNodeInfo<ExpressionNode*>($1.m_node, $1.m_features, $1.m_numConstants); }
-  | MemberExpr '[' Expr ']'             { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+  | MemberExpr '[' Expr ']'             { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @4.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
                                         }
-  | MemberExpr '.' IDENT                { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
+  | MemberExpr '.' IDENT                { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants);
                                         }
-  | NEW MemberExpr Arguments            { NewExprNode* node = new NewExprNode(GLOBAL_DATA, $2.m_node, $3.m_node);
+  | NEW MemberExpr Arguments            { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node, $3.m_node);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features | $3.m_features, $2.m_numConstants + $3.m_numConstants);
                                         }
@@ -402,15 +402,15 @@ MemberExpr:
 
 MemberExprNoBF:
     PrimaryExprNoBrace
-  | MemberExprNoBF '[' Expr ']'         { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+  | MemberExprNoBF '[' Expr ']'         { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @4.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
                                         }
-  | MemberExprNoBF '.' IDENT            { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
+  | MemberExprNoBF '.' IDENT            { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants);
                                         }
-  | NEW MemberExpr Arguments            { NewExprNode* node = new NewExprNode(GLOBAL_DATA, $2.m_node, $3.m_node);
+  | NEW MemberExpr Arguments            { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node, $3.m_node);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features | $3.m_features, $2.m_numConstants + $3.m_numConstants);
                                         }
@@ -418,7 +418,7 @@ MemberExprNoBF:
 
 NewExpr:
     MemberExpr
-  | NEW NewExpr                         { NewExprNode* node = new NewExprNode(GLOBAL_DATA, $2.m_node);
+  | NEW NewExpr                         { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features, $2.m_numConstants); 
                                         }
@@ -426,7 +426,7 @@ NewExpr:
 
 NewExprNoBF:
     MemberExprNoBF
-  | NEW NewExpr                         { NewExprNode* node = new NewExprNode(GLOBAL_DATA, $2.m_node);
+  | NEW NewExpr                         { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features, $2.m_numConstants);
                                         }
@@ -435,11 +435,11 @@ NewExprNoBF:
 CallExpr:
     MemberExpr Arguments                { $$ = makeFunctionCallNode(globalPtr, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
   | CallExpr Arguments                  { $$ = makeFunctionCallNode(globalPtr, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
-  | CallExpr '[' Expr ']'               { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+  | CallExpr '[' Expr ']'               { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @4.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
                                         }
-  | CallExpr '.' IDENT                  { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
+  | CallExpr '.' IDENT                  { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants); }
 ;
@@ -447,28 +447,28 @@ CallExpr:
 CallExprNoBF:
     MemberExprNoBF Arguments            { $$ = makeFunctionCallNode(globalPtr, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
   | CallExprNoBF Arguments              { $$ = makeFunctionCallNode(globalPtr, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
-  | CallExprNoBF '[' Expr ']'           { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+  | CallExprNoBF '[' Expr ']'           { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @4.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
                                         }
-  | CallExprNoBF '.' IDENT              { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
+  | CallExprNoBF '.' IDENT              { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @3.last_column);
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants); 
                                         }
 ;
 
 Arguments:
-    '(' ')'                             { $$ = createNodeInfo<ArgumentsNode*>(new ArgumentsNode(GLOBAL_DATA), 0, 0); }
-  | '(' ArgumentList ')'                { $$ = createNodeInfo<ArgumentsNode*>(new ArgumentsNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
+    '(' ')'                             { $$ = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA), 0, 0); }
+  | '(' ArgumentList ')'                { $$ = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
 ;
 
 ArgumentList:
-    AssignmentExpr                      { $$.m_node.head = new ArgumentListNode(GLOBAL_DATA, $1.m_node);
+    AssignmentExpr                      { $$.m_node.head = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, $1.m_node);
                                           $$.m_node.tail = $$.m_node.head;
                                           $$.m_features = $1.m_features;
                                           $$.m_numConstants = $1.m_numConstants; }
   | ArgumentList ',' AssignmentExpr     { $$.m_node.head = $1.m_node.head;
-                                          $$.m_node.tail = new ArgumentListNode(GLOBAL_DATA, $1.m_node.tail, $3.m_node);
+                                          $$.m_node.tail = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, $1.m_node.tail, $3.m_node);
                                           $$.m_features = $1.m_features | $3.m_features;
                                           $$.m_numConstants = $1.m_numConstants + $3.m_numConstants; }
 ;
@@ -497,16 +497,16 @@ PostfixExprNoBF:
 
 UnaryExprCommon:
     DELETETOKEN UnaryExpr               { $$ = createNodeInfo<ExpressionNode*>(makeDeleteNode(GLOBAL_DATA, $2.m_node, @1.first_column, @2.last_column, @2.last_column), $2.m_features, $2.m_numConstants); }
-  | VOIDTOKEN UnaryExpr                 { $$ = createNodeInfo<ExpressionNode*>(new VoidNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants + 1); }
+  | VOIDTOKEN UnaryExpr                 { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) VoidNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants + 1); }
   | TYPEOF UnaryExpr                    { $$ = createNodeInfo<ExpressionNode*>(makeTypeOfNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
   | PLUSPLUS UnaryExpr                  { $$ = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, $2.m_node, OpPlusPlus, @1.first_column, @2.first_column + 1, @2.last_column), $2.m_features | AssignFeature, $2.m_numConstants); }
   | AUTOPLUSPLUS UnaryExpr              { $$ = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, $2.m_node, OpPlusPlus, @1.first_column, @2.first_column + 1, @2.last_column), $2.m_features | AssignFeature, $2.m_numConstants); }
   | MINUSMINUS UnaryExpr                { $$ = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, $2.m_node, OpMinusMinus, @1.first_column, @2.first_column + 1, @2.last_column), $2.m_features | AssignFeature, $2.m_numConstants); }
   | AUTOMINUSMINUS UnaryExpr            { $$ = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, $2.m_node, OpMinusMinus, @1.first_column, @2.first_column + 1, @2.last_column), $2.m_features | AssignFeature, $2.m_numConstants); }
-  | '+' UnaryExpr                       { $$ = createNodeInfo<ExpressionNode*>(new UnaryPlusNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
+  | '+' UnaryExpr                       { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
   | '-' UnaryExpr                       { $$ = createNodeInfo<ExpressionNode*>(makeNegateNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
   | '~' UnaryExpr                       { $$ = createNodeInfo<ExpressionNode*>(makeBitwiseNotNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
-  | '!' UnaryExpr                       { $$ = createNodeInfo<ExpressionNode*>(new LogicalNotNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
+  | '!' UnaryExpr                       { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalNotNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
 
 UnaryExpr:
     PostfixExpr
@@ -522,7 +522,7 @@ MultiplicativeExpr:
     UnaryExpr
   | MultiplicativeExpr '*' UnaryExpr    { $$ = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | MultiplicativeExpr '/' UnaryExpr    { $$ = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | MultiplicativeExpr '%' UnaryExpr    { $$ = createNodeInfo<ExpressionNode*>(new ModNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | MultiplicativeExpr '%' UnaryExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 MultiplicativeExprNoBF:
@@ -532,7 +532,7 @@ MultiplicativeExprNoBF:
   | MultiplicativeExprNoBF '/' UnaryExpr
                                         { $$ = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | MultiplicativeExprNoBF '%' UnaryExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new ModNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 AdditiveExpr:
@@ -553,188 +553,188 @@ ShiftExpr:
     AdditiveExpr
   | ShiftExpr LSHIFT AdditiveExpr       { $$ = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | ShiftExpr RSHIFT AdditiveExpr       { $$ = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | ShiftExpr URSHIFT AdditiveExpr      { $$ = createNodeInfo<ExpressionNode*>(new UnsignedRightShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | ShiftExpr URSHIFT AdditiveExpr      { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 ShiftExprNoBF:
     AdditiveExprNoBF
   | ShiftExprNoBF LSHIFT AdditiveExpr   { $$ = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | ShiftExprNoBF RSHIFT AdditiveExpr   { $$ = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | ShiftExprNoBF URSHIFT AdditiveExpr  { $$ = createNodeInfo<ExpressionNode*>(new UnsignedRightShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | ShiftExprNoBF URSHIFT AdditiveExpr  { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 RelationalExpr:
     ShiftExpr
-  | RelationalExpr '<' ShiftExpr        { $$ = createNodeInfo<ExpressionNode*>(new LessNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExpr '>' ShiftExpr        { $$ = createNodeInfo<ExpressionNode*>(new GreaterNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExpr LE ShiftExpr         { $$ = createNodeInfo<ExpressionNode*>(new LessEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExpr GE ShiftExpr         { $$ = createNodeInfo<ExpressionNode*>(new GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExpr INSTANCEOF ShiftExpr { InstanceOfNode* node = new InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+  | RelationalExpr '<' ShiftExpr        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExpr '>' ShiftExpr        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExpr LE ShiftExpr         { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExpr GE ShiftExpr         { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExpr INSTANCEOF ShiftExpr { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExpr INTOKEN ShiftExpr    { InNode* node = new InNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+  | RelationalExpr INTOKEN ShiftExpr    { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 RelationalExprNoIn:
     ShiftExpr
-  | RelationalExprNoIn '<' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new LessNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoIn '>' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new GreaterNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoIn LE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new LessEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoIn GE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoIn '<' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoIn '>' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoIn LE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoIn GE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | RelationalExprNoIn INSTANCEOF ShiftExpr
-                                        { InstanceOfNode* node = new InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+                                        { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 RelationalExprNoBF:
     ShiftExprNoBF
-  | RelationalExprNoBF '<' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new LessNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoBF '>' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new GreaterNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoBF LE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new LessEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoBF GE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoBF '<' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoBF '>' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoBF LE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | RelationalExprNoBF GE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | RelationalExprNoBF INSTANCEOF ShiftExpr
-                                        { InstanceOfNode* node = new InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+                                        { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | RelationalExprNoBF INTOKEN ShiftExpr 
-                                        { InNode* node = new InNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
+                                        { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @3.first_column, @3.last_column);  
                                           $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 EqualityExpr:
     RelationalExpr
-  | EqualityExpr EQEQ RelationalExpr    { $$ = createNodeInfo<ExpressionNode*>(new EqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | EqualityExpr NE RelationalExpr      { $$ = createNodeInfo<ExpressionNode*>(new NotEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | EqualityExpr STREQ RelationalExpr   { $$ = createNodeInfo<ExpressionNode*>(new StrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | EqualityExpr STRNEQ RelationalExpr  { $$ = createNodeInfo<ExpressionNode*>(new NotStrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | EqualityExpr EQEQ RelationalExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | EqualityExpr NE RelationalExpr      { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | EqualityExpr STREQ RelationalExpr   { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | EqualityExpr STRNEQ RelationalExpr  { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 EqualityExprNoIn:
     RelationalExprNoIn
   | EqualityExprNoIn EQEQ RelationalExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new EqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | EqualityExprNoIn NE RelationalExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new NotEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | EqualityExprNoIn STREQ RelationalExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new StrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | EqualityExprNoIn STRNEQ RelationalExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new NotStrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 EqualityExprNoBF:
     RelationalExprNoBF
   | EqualityExprNoBF EQEQ RelationalExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new EqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | EqualityExprNoBF NE RelationalExpr  { $$ = createNodeInfo<ExpressionNode*>(new NotEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | EqualityExprNoBF NE RelationalExpr  { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | EqualityExprNoBF STREQ RelationalExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new StrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
   | EqualityExprNoBF STRNEQ RelationalExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new NotStrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseANDExpr:
     EqualityExpr
-  | BitwiseANDExpr '&' EqualityExpr     { $$ = createNodeInfo<ExpressionNode*>(new BitAndNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | BitwiseANDExpr '&' EqualityExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseANDExprNoIn:
     EqualityExprNoIn
   | BitwiseANDExprNoIn '&' EqualityExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new BitAndNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseANDExprNoBF:
     EqualityExprNoBF
-  | BitwiseANDExprNoBF '&' EqualityExpr { $$ = createNodeInfo<ExpressionNode*>(new BitAndNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | BitwiseANDExprNoBF '&' EqualityExpr { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseXORExpr:
     BitwiseANDExpr
-  | BitwiseXORExpr '^' BitwiseANDExpr   { $$ = createNodeInfo<ExpressionNode*>(new BitXOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | BitwiseXORExpr '^' BitwiseANDExpr   { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseXORExprNoIn:
     BitwiseANDExprNoIn
   | BitwiseXORExprNoIn '^' BitwiseANDExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new BitXOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseXORExprNoBF:
     BitwiseANDExprNoBF
   | BitwiseXORExprNoBF '^' BitwiseANDExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new BitXOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseORExpr:
     BitwiseXORExpr
-  | BitwiseORExpr '|' BitwiseXORExpr    { $$ = createNodeInfo<ExpressionNode*>(new BitOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | BitwiseORExpr '|' BitwiseXORExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseORExprNoIn:
     BitwiseXORExprNoIn
   | BitwiseORExprNoIn '|' BitwiseXORExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new BitOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 BitwiseORExprNoBF:
     BitwiseXORExprNoBF
   | BitwiseORExprNoBF '|' BitwiseXORExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new BitOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 LogicalANDExpr:
     BitwiseORExpr
-  | LogicalANDExpr AND BitwiseORExpr    { $$ = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalAnd), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | LogicalANDExpr AND BitwiseORExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalAnd), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 LogicalANDExprNoIn:
     BitwiseORExprNoIn
   | LogicalANDExprNoIn AND BitwiseORExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalAnd), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalAnd), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 LogicalANDExprNoBF:
     BitwiseORExprNoBF
   | LogicalANDExprNoBF AND BitwiseORExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalAnd), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalAnd), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 LogicalORExpr:
     LogicalANDExpr
-  | LogicalORExpr OR LogicalANDExpr     { $$ = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalOr), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | LogicalORExpr OR LogicalANDExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalOr), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 LogicalORExprNoIn:
     LogicalANDExprNoIn
   | LogicalORExprNoIn OR LogicalANDExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalOr), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalOr), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 LogicalORExprNoBF:
     LogicalANDExprNoBF
-  | LogicalORExprNoBF OR LogicalANDExpr { $$ = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalOr), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | LogicalORExprNoBF OR LogicalANDExpr { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalOr), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 ConditionalExpr:
     LogicalORExpr
   | LogicalORExpr '?' AssignmentExpr ':' AssignmentExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new ConditionalNode(GLOBAL_DATA, $1.m_node, $3.m_node, $5.m_node), $1.m_features | $3.m_features | $5.m_features, $1.m_numConstants + $3.m_numConstants + $5.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, $1.m_node, $3.m_node, $5.m_node), $1.m_features | $3.m_features | $5.m_features, $1.m_numConstants + $3.m_numConstants + $5.m_numConstants); }
 ;
 
 ConditionalExprNoIn:
     LogicalORExprNoIn
   | LogicalORExprNoIn '?' AssignmentExprNoIn ':' AssignmentExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new ConditionalNode(GLOBAL_DATA, $1.m_node, $3.m_node, $5.m_node), $1.m_features | $3.m_features | $5.m_features, $1.m_numConstants + $3.m_numConstants + $5.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, $1.m_node, $3.m_node, $5.m_node), $1.m_features | $3.m_features | $5.m_features, $1.m_numConstants + $3.m_numConstants + $5.m_numConstants); }
 ;
 
 ConditionalExprNoBF:
     LogicalORExprNoBF
   | LogicalORExprNoBF '?' AssignmentExpr ':' AssignmentExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new ConditionalNode(GLOBAL_DATA, $1.m_node, $3.m_node, $5.m_node), $1.m_features | $3.m_features | $5.m_features, $1.m_numConstants + $3.m_numConstants + $5.m_numConstants); }
+                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, $1.m_node, $3.m_node, $5.m_node), $1.m_features | $3.m_features | $5.m_features, $1.m_numConstants + $3.m_numConstants + $5.m_numConstants); }
 ;
 
 AssignmentExpr:
@@ -778,17 +778,17 @@ AssignmentOperator:
 
 Expr:
     AssignmentExpr
-  | Expr ',' AssignmentExpr             { $$ = createNodeInfo<ExpressionNode*>(new CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | Expr ',' AssignmentExpr             { $$ = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 ExprNoIn:
     AssignmentExprNoIn
-  | ExprNoIn ',' AssignmentExprNoIn     { $$ = createNodeInfo<ExpressionNode*>(new CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | ExprNoIn ',' AssignmentExprNoIn     { $$ = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 ExprNoBF:
     AssignmentExprNoBF
-  | ExprNoBF ',' AssignmentExpr         { $$ = createNodeInfo<ExpressionNode*>(new CommaNode(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
+  | ExprNoBF ',' AssignmentExpr         { $$ = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
 ;
 
 Statement:
@@ -812,9 +812,9 @@ Statement:
 ;
 
 Block:
-    OPENBRACE CLOSEBRACE                             { $$ = createNodeDeclarationInfo<StatementNode*>(new BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
+    OPENBRACE CLOSEBRACE                             { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
                                           DBG($$.m_node, @1, @2); }
-  | OPENBRACE SourceElements CLOSEBRACE              { $$ = createNodeDeclarationInfo<StatementNode*>(new BlockNode(GLOBAL_DATA, $2.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
+  | OPENBRACE SourceElements CLOSEBRACE              { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, $2.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
                                           DBG($$.m_node, @1, @3); }
 ;
 
@@ -828,16 +828,16 @@ VariableStatement:
 
 VariableDeclarationList:
     IDENT                               { $$.m_node = 0;
-                                          $$.m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$1, 0);
                                           $$.m_funcDeclarations = 0;
                                           $$.m_features = (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
                                           $$.m_numConstants = 0;
                                         }
-  | IDENT Initializer                   { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *$1, $2.m_node, $2.m_features & AssignFeature);
+  | IDENT Initializer                   { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$1, $2.m_node, $2.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.first_column + 1, @2.last_column);
                                           $$.m_node = node;
-                                          $$.m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$1, DeclarationStacks::HasInitializer);
                                           $$.m_funcDeclarations = 0;
                                           $$.m_features = ((*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $2.m_features;
@@ -852,9 +852,9 @@ VariableDeclarationList:
                                           $$.m_numConstants = $1.m_numConstants;
                                         }
   | VariableDeclarationList ',' IDENT Initializer
-                                        { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
+                                        { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @3.first_column, @4.first_column + 1, @4.last_column);
-                                          $$.m_node = combineVarInitializers(GLOBAL_DATA, $1.m_node, node);
+                                          $$.m_node = combineCommaNodes(GLOBAL_DATA, $1.m_node, node);
                                           $$.m_varDeclarations = $1.m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$3, DeclarationStacks::HasInitializer);
                                           $$.m_funcDeclarations = 0;
@@ -865,16 +865,16 @@ VariableDeclarationList:
 
 VariableDeclarationListNoIn:
     IDENT                               { $$.m_node = 0;
-                                          $$.m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$1, 0);
                                           $$.m_funcDeclarations = 0;
                                           $$.m_features = (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
                                           $$.m_numConstants = 0;
                                         }
-  | IDENT InitializerNoIn               { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *$1, $2.m_node, $2.m_features & AssignFeature);
+  | IDENT InitializerNoIn               { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$1, $2.m_node, $2.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.first_column + 1, @2.last_column);
                                           $$.m_node = node;
-                                          $$.m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$1, DeclarationStacks::HasInitializer);
                                           $$.m_funcDeclarations = 0;
                                           $$.m_features = ((*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $2.m_features;
@@ -889,9 +889,9 @@ VariableDeclarationListNoIn:
                                           $$.m_numConstants = $1.m_numConstants;
                                         }
   | VariableDeclarationListNoIn ',' IDENT InitializerNoIn
-                                        { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
+                                        { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, @3.first_column, @4.first_column + 1, @4.last_column);
-                                          $$.m_node = combineVarInitializers(GLOBAL_DATA, $1.m_node, node);
+                                          $$.m_node = combineCommaNodes(GLOBAL_DATA, $1.m_node, node);
                                           $$.m_varDeclarations = $1.m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$3, DeclarationStacks::HasInitializer);
                                           $$.m_funcDeclarations = 0;
@@ -901,24 +901,24 @@ VariableDeclarationListNoIn:
 ;
 
 ConstStatement:
-    CONSTTOKEN ConstDeclarationList ';' { $$ = createNodeDeclarationInfo<StatementNode*>(new ConstStatementNode(GLOBAL_DATA, $2.m_node.head), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
+    CONSTTOKEN ConstDeclarationList ';' { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, $2.m_node.head), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
                                           DBG($$.m_node, @1, @3); }
   | CONSTTOKEN ConstDeclarationList error
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new ConstStatementNode(GLOBAL_DATA, $2.m_node.head), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
+                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, $2.m_node.head), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
                                           DBG($$.m_node, @1, @2); AUTO_SEMICOLON; }
 ;
 
 ConstDeclarationList:
     ConstDeclaration                    { $$.m_node.head = $1.m_node;
                                           $$.m_node.tail = $$.m_node.head;
-                                          $$.m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, $1.m_node);
                                           $$.m_funcDeclarations = 0; 
                                           $$.m_features = $1.m_features;
                                           $$.m_numConstants = $1.m_numConstants;
     }
   | ConstDeclarationList ',' ConstDeclaration
-                                        {  $$.m_node.head = $1.m_node.head;
+                                        { $$.m_node.head = $1.m_node.head;
                                           $1.m_node.tail->m_next = $3.m_node;
                                           $$.m_node.tail = $3.m_node;
                                           $$.m_varDeclarations = $1.m_varDeclarations;
@@ -929,8 +929,8 @@ ConstDeclarationList:
 ;
 
 ConstDeclaration:
-    IDENT                               { $$ = createNodeInfo<ConstDeclNode*>(new ConstDeclNode(GLOBAL_DATA, *$1, 0), (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); }
-  | IDENT Initializer                   { $$ = createNodeInfo<ConstDeclNode*>(new ConstDeclNode(GLOBAL_DATA, *$1, $2.m_node), ((*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $2.m_features, $2.m_numConstants); }
+    IDENT                               { $$ = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *$1, 0), (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); }
+  | IDENT Initializer                   { $$ = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *$1, $2.m_node), ((*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $2.m_features, $2.m_numConstants); }
 ;
 
 Initializer:
@@ -942,43 +942,44 @@ InitializerNoIn:
 ;
 
 EmptyStatement:
-    ';'                                 { $$ = createNodeDeclarationInfo<StatementNode*>(new EmptyStatementNode(GLOBAL_DATA), 0, 0, 0, 0); }
+    ';'                                 { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA), 0, 0, 0, 0); }
 ;
 
 ExprStatement:
-    ExprNoBF ';'                        { $$ = createNodeDeclarationInfo<StatementNode*>(new ExprStatementNode(GLOBAL_DATA, $1.m_node), 0, 0, $1.m_features, $1.m_numConstants);
+    ExprNoBF ';'                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, $1.m_node), 0, 0, $1.m_features, $1.m_numConstants);
                                           DBG($$.m_node, @1, @2); }
-  | ExprNoBF error                      { $$ = createNodeDeclarationInfo<StatementNode*>(new ExprStatementNode(GLOBAL_DATA, $1.m_node), 0, 0, $1.m_features, $1.m_numConstants);
+  | ExprNoBF error                      { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, $1.m_node), 0, 0, $1.m_features, $1.m_numConstants);
                                           DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
 ;
 
 IfStatement:
     IF '(' Expr ')' Statement %prec IF_WITHOUT_ELSE
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new IfNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
+                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
                                           DBG($$.m_node, @1, @4); }
   | IF '(' Expr ')' Statement ELSE Statement
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new IfElseNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node), 
-                                                                                         mergeDeclarationLists($5.m_varDeclarations, $7.m_varDeclarations), mergeDeclarationLists($5.m_funcDeclarations, $7.m_funcDeclarations),
+                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfElseNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node), 
+                                                                                         mergeDeclarationLists($5.m_varDeclarations, $7.m_varDeclarations),
+                                                                                         mergeDeclarationLists($5.m_funcDeclarations, $7.m_funcDeclarations),
                                                                                          $3.m_features | $5.m_features | $7.m_features,
                                                                                          $3.m_numConstants + $5.m_numConstants + $7.m_numConstants); 
                                           DBG($$.m_node, @1, @4); }
 ;
 
 IterationStatement:
-    DO Statement WHILE '(' Expr ')' ';'    { $$ = createNodeDeclarationInfo<StatementNode*>(new DoWhileNode(GLOBAL_DATA, $2.m_node, $5.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features | $5.m_features, $2.m_numConstants + $5.m_numConstants);
+    DO Statement WHILE '(' Expr ')' ';'    { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, $2.m_node, $5.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features | $5.m_features, $2.m_numConstants + $5.m_numConstants);
                                              DBG($$.m_node, @1, @3); }
-  | DO Statement WHILE '(' Expr ')' error  { $$ = createNodeDeclarationInfo<StatementNode*>(new DoWhileNode(GLOBAL_DATA, $2.m_node, $5.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features | $5.m_features, $2.m_numConstants + $5.m_numConstants);
+  | DO Statement WHILE '(' Expr ')' error  { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, $2.m_node, $5.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features | $5.m_features, $2.m_numConstants + $5.m_numConstants);
                                              DBG($$.m_node, @1, @3); } // Always performs automatic semicolon insertion.
-  | WHILE '(' Expr ')' Statement        { $$ = createNodeDeclarationInfo<StatementNode*>(new WhileNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
+  | WHILE '(' Expr ')' Statement        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WhileNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
                                           DBG($$.m_node, @1, @4); }
   | FOR '(' ExprNoInOpt ';' ExprOpt ';' ExprOpt ')' Statement
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new ForNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node, $9.m_node, false), $9.m_varDeclarations, $9.m_funcDeclarations, 
+                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node, $9.m_node, false), $9.m_varDeclarations, $9.m_funcDeclarations, 
                                                                                          $3.m_features | $5.m_features | $7.m_features | $9.m_features,
                                                                                          $3.m_numConstants + $5.m_numConstants + $7.m_numConstants + $9.m_numConstants);
                                           DBG($$.m_node, @1, @8); 
                                         }
   | FOR '(' VAR VariableDeclarationListNoIn ';' ExprOpt ';' ExprOpt ')' Statement
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new ForNode(GLOBAL_DATA, $4.m_node, $6.m_node, $8.m_node, $10.m_node, true),
+                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, $4.m_node, $6.m_node, $8.m_node, $10.m_node, true),
                                                                                          mergeDeclarationLists($4.m_varDeclarations, $10.m_varDeclarations),
                                                                                          mergeDeclarationLists($4.m_funcDeclarations, $10.m_funcDeclarations),
                                                                                          $4.m_features | $6.m_features | $8.m_features | $10.m_features,
@@ -986,7 +987,7 @@ IterationStatement:
                                           DBG($$.m_node, @1, @9); }
   | FOR '(' LeftHandSideExpr INTOKEN Expr ')' Statement
                                         {
-                                            ForInNode* node = new ForInNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node);
+                                            ForInNode* node = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node);
                                             SET_EXCEPTION_LOCATION(node, @3.first_column, @3.last_column, @5.last_column);
                                             $$ = createNodeDeclarationInfo<StatementNode*>(node, $7.m_varDeclarations, $7.m_funcDeclarations,
                                                                                            $3.m_features | $5.m_features | $7.m_features,
@@ -994,13 +995,13 @@ IterationStatement:
                                             DBG($$.m_node, @1, @6);
                                         }
   | FOR '(' VAR IDENT INTOKEN Expr ')' Statement
-                                        { ForInNode *forIn = new ForInNode(GLOBAL_DATA, *$4, 0, $6.m_node, $8.m_node, @5.first_column, @5.first_column - @4.first_column, @6.last_column - @5.first_column);
+                                        { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *$4, 0, $6.m_node, $8.m_node, @5.first_column, @5.first_column - @4.first_column, @6.last_column - @5.first_column);
                                           SET_EXCEPTION_LOCATION(forIn, @4.first_column, @5.first_column + 1, @6.last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, $8.m_varDeclarations, *$4, DeclarationStacks::HasInitializer);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(forIn, $8.m_varDeclarations, $8.m_funcDeclarations, ((*$4 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $6.m_features | $8.m_features, $6.m_numConstants + $8.m_numConstants);
                                           DBG($$.m_node, @1, @7); }
   | FOR '(' VAR IDENT InitializerNoIn INTOKEN Expr ')' Statement
-                                        { ForInNode *forIn = new ForInNode(GLOBAL_DATA, *$4, $5.m_node, $7.m_node, $9.m_node, @5.first_column, @5.first_column - @4.first_column, @5.last_column - @5.first_column);
+                                        { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *$4, $5.m_node, $7.m_node, $9.m_node, @5.first_column, @5.first_column - @4.first_column, @5.last_column - @5.first_column);
                                           SET_EXCEPTION_LOCATION(forIn, @4.first_column, @6.first_column + 1, @7.last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, $9.m_varDeclarations, *$4, DeclarationStacks::HasInitializer);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(forIn, $9.m_varDeclarations, $9.m_funcDeclarations,
@@ -1020,70 +1021,70 @@ ExprNoInOpt:
 ;
 
 ContinueStatement:
-    CONTINUE ';'                        { ContinueNode* node = new ContinueNode(GLOBAL_DATA);
+    CONTINUE ';'                        { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG($$.m_node, @1, @2); }
-  | CONTINUE error                      { ContinueNode* node = new ContinueNode(GLOBAL_DATA);
+  | CONTINUE error                      { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
-  | CONTINUE IDENT ';'                  { ContinueNode* node = new ContinueNode(GLOBAL_DATA, *$2);
+  | CONTINUE IDENT ';'                  { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *$2);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG($$.m_node, @1, @3); }
-  | CONTINUE IDENT error                { ContinueNode* node = new ContinueNode(GLOBAL_DATA, *$2);
+  | CONTINUE IDENT error                { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *$2);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG($$.m_node, @1, @2); AUTO_SEMICOLON; }
 ;
 
 BreakStatement:
-    BREAK ';'                           { BreakNode* node = new BreakNode(GLOBAL_DATA);
+    BREAK ';'                           { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG($$.m_node, @1, @2); }
-  | BREAK error                         { BreakNode* node = new BreakNode(GLOBAL_DATA);
+  | BREAK error                         { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(new BreakNode(GLOBAL_DATA), 0, 0, 0, 0); DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
-  | BREAK IDENT ';'                     { BreakNode* node = new BreakNode(GLOBAL_DATA, *$2);
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA), 0, 0, 0, 0); DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
+  | BREAK IDENT ';'                     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *$2);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG($$.m_node, @1, @3); }
-  | BREAK IDENT error                   { BreakNode* node = new BreakNode(GLOBAL_DATA, *$2);
+  | BREAK IDENT error                   { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *$2);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(new BreakNode(GLOBAL_DATA, *$2), 0, 0, 0, 0); DBG($$.m_node, @1, @2); AUTO_SEMICOLON; }
+                                          $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *$2), 0, 0, 0, 0); DBG($$.m_node, @1, @2); AUTO_SEMICOLON; }
 ;
 
 ReturnStatement:
-    RETURN ';'                          { ReturnNode* node = new ReturnNode(GLOBAL_DATA, 0); 
+    RETURN ';'                          { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG($$.m_node, @1, @2); }
-  | RETURN error                        { ReturnNode* node = new ReturnNode(GLOBAL_DATA, 0); 
+  | RETURN error                        { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @1.last_column, @1.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
-  | RETURN Expr ';'                     { ReturnNode* node = new ReturnNode(GLOBAL_DATA, $2.m_node); 
+  | RETURN Expr ';'                     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, $2.m_node); 
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); DBG($$.m_node, @1, @3); }
-  | RETURN Expr error                   { ReturnNode* node = new ReturnNode(GLOBAL_DATA, $2.m_node); 
+  | RETURN Expr error                   { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, $2.m_node); 
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column); 
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); DBG($$.m_node, @1, @2); AUTO_SEMICOLON; }
 ;
 
 WithStatement:
-    WITH '(' Expr ')' Statement         { $$ = createNodeDeclarationInfo<StatementNode*>(new WithNode(GLOBAL_DATA, $3.m_node, $5.m_node, @3.last_column, @3.last_column - @3.first_column),
+    WITH '(' Expr ')' Statement         { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WithNode(GLOBAL_DATA, $3.m_node, $5.m_node, @3.last_column, @3.last_column - @3.first_column),
                                                                                          $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features | WithFeature, $3.m_numConstants + $5.m_numConstants);
                                           DBG($$.m_node, @1, @4); }
 ;
 
 SwitchStatement:
-    SWITCH '(' Expr ')' CaseBlock       { $$ = createNodeDeclarationInfo<StatementNode*>(new SwitchNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations,
+    SWITCH '(' Expr ')' CaseBlock       { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) SwitchNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations,
                                                                                          $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
                                           DBG($$.m_node, @1, @4); }
 ;
 
 CaseBlock:
-    OPENBRACE CaseClausesOpt CLOSEBRACE              { $$ = createNodeDeclarationInfo<CaseBlockNode*>(new CaseBlockNode(GLOBAL_DATA, $2.m_node.head, 0, 0), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants); }
+    OPENBRACE CaseClausesOpt CLOSEBRACE              { $$ = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, $2.m_node.head, 0, 0), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants); }
   | OPENBRACE CaseClausesOpt DefaultClause CaseClausesOpt CLOSEBRACE
-                                        { $$ = createNodeDeclarationInfo<CaseBlockNode*>(new CaseBlockNode(GLOBAL_DATA, $2.m_node.head, $3.m_node, $4.m_node.head),
+                                        { $$ = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, $2.m_node.head, $3.m_node, $4.m_node.head),
                                                                                          mergeDeclarationLists(mergeDeclarationLists($2.m_varDeclarations, $3.m_varDeclarations), $4.m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists($2.m_funcDeclarations, $3.m_funcDeclarations), $4.m_funcDeclarations),
                                                                                          $2.m_features | $3.m_features | $4.m_features,
@@ -1096,14 +1097,14 @@ CaseClausesOpt:
 ;
 
 CaseClauses:
-    CaseClause                          { $$.m_node.head = new ClauseListNode(GLOBAL_DATA, $1.m_node);
+    CaseClause                          { $$.m_node.head = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, $1.m_node);
                                           $$.m_node.tail = $$.m_node.head;
                                           $$.m_varDeclarations = $1.m_varDeclarations;
                                           $$.m_funcDeclarations = $1.m_funcDeclarations; 
                                           $$.m_features = $1.m_features;
                                           $$.m_numConstants = $1.m_numConstants; }
   | CaseClauses CaseClause              { $$.m_node.head = $1.m_node.head;
-                                          $$.m_node.tail = new ClauseListNode(GLOBAL_DATA, $1.m_node.tail, $2.m_node);
+                                          $$.m_node.tail = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, $1.m_node.tail, $2.m_node);
                                           $$.m_varDeclarations = mergeDeclarationLists($1.m_varDeclarations, $2.m_varDeclarations);
                                           $$.m_funcDeclarations = mergeDeclarationLists($1.m_funcDeclarations, $2.m_funcDeclarations);
                                           $$.m_features = $1.m_features | $2.m_features;
@@ -1112,47 +1113,47 @@ CaseClauses:
 ;
 
 CaseClause:
-    CASE Expr ':'                       { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, $2.m_node), 0, 0, $2.m_features, $2.m_numConstants); }
-  | CASE Expr ':' SourceElements        { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, $2.m_node, $4.m_node), $4.m_varDeclarations, $4.m_funcDeclarations, $2.m_features | $4.m_features, $2.m_numConstants + $4.m_numConstants); }
+    CASE Expr ':'                       { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, $2.m_node), 0, 0, $2.m_features, $2.m_numConstants); }
+  | CASE Expr ':' SourceElements        { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, $2.m_node, $4.m_node), $4.m_varDeclarations, $4.m_funcDeclarations, $2.m_features | $4.m_features, $2.m_numConstants + $4.m_numConstants); }
 ;
 
 DefaultClause:
-    DEFAULT ':'                         { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, 0), 0, 0, 0, 0); }
-  | DEFAULT ':' SourceElements          { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, 0, $3.m_node), $3.m_varDeclarations, $3.m_funcDeclarations, $3.m_features, $3.m_numConstants); }
+    DEFAULT ':'                         { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0), 0, 0, 0, 0); }
+  | DEFAULT ':' SourceElements          { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0, $3.m_node), $3.m_varDeclarations, $3.m_funcDeclarations, $3.m_features, $3.m_numConstants); }
 ;
 
 LabelledStatement:
-    IDENT ':' Statement                 { LabelNode* node = new LabelNode(GLOBAL_DATA, *$1, $3.m_node);
+    IDENT ':' Statement                 { LabelNode* node = new (GLOBAL_DATA) LabelNode(GLOBAL_DATA, *$1, $3.m_node);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, $3.m_varDeclarations, $3.m_funcDeclarations, $3.m_features, $3.m_numConstants); }
 ;
 
 ThrowStatement:
-    THROW Expr ';'                      { ThrowNode* node = new ThrowNode(GLOBAL_DATA, $2.m_node);
+    THROW Expr ';'                      { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, $2.m_node);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); DBG($$.m_node, @1, @2);
                                         }
-  | THROW Expr error                    { ThrowNode* node = new ThrowNode(GLOBAL_DATA, $2.m_node);
+  | THROW Expr error                    { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, $2.m_node);
                                           SET_EXCEPTION_LOCATION(node, @1.first_column, @2.last_column, @2.last_column);
                                           $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); DBG($$.m_node, @1, @2); AUTO_SEMICOLON; 
                                         }
 ;
 
 TryStatement:
-    TRY Block FINALLY Block             { $$ = createNodeDeclarationInfo<StatementNode*>(new TryNode(GLOBAL_DATA, $2.m_node, GLOBAL_DATA->propertyNames->nullIdentifier, false, 0, $4.m_node),
+    TRY Block FINALLY Block             { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, $2.m_node, GLOBAL_DATA->propertyNames->nullIdentifier, false, 0, $4.m_node),
                                                                                          mergeDeclarationLists($2.m_varDeclarations, $4.m_varDeclarations),
                                                                                          mergeDeclarationLists($2.m_funcDeclarations, $4.m_funcDeclarations),
                                                                                          $2.m_features | $4.m_features,
                                                                                          $2.m_numConstants + $4.m_numConstants);
                                           DBG($$.m_node, @1, @2); }
-  | TRY Block CATCH '(' IDENT ')' Block { $$ = createNodeDeclarationInfo<StatementNode*>(new TryNode(GLOBAL_DATA, $2.m_node, *$5, ($7.m_features & EvalFeature) != 0, $7.m_node, 0),
+  | TRY Block CATCH '(' IDENT ')' Block { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, $2.m_node, *$5, ($7.m_features & EvalFeature) != 0, $7.m_node, 0),
                                                                                          mergeDeclarationLists($2.m_varDeclarations, $7.m_varDeclarations),
                                                                                          mergeDeclarationLists($2.m_funcDeclarations, $7.m_funcDeclarations),
                                                                                          $2.m_features | $7.m_features | CatchFeature,
                                                                                          $2.m_numConstants + $7.m_numConstants);
                                           DBG($$.m_node, @1, @2); }
   | TRY Block CATCH '(' IDENT ')' Block FINALLY Block
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new TryNode(GLOBAL_DATA, $2.m_node, *$5, ($7.m_features & EvalFeature) != 0, $7.m_node, $9.m_node),
+                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, $2.m_node, *$5, ($7.m_features & EvalFeature) != 0, $7.m_node, $9.m_node),
                                                                                          mergeDeclarationLists(mergeDeclarationLists($2.m_varDeclarations, $7.m_varDeclarations), $9.m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists($2.m_funcDeclarations, $7.m_funcDeclarations), $9.m_funcDeclarations),
                                                                                          $2.m_features | $7.m_features | $9.m_features | CatchFeature,
@@ -1161,17 +1162,17 @@ TryStatement:
 ;
 
 DebuggerStatement:
-    DEBUGGER ';'                        { $$ = createNodeDeclarationInfo<StatementNode*>(new DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
+    DEBUGGER ';'                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
                                           DBG($$.m_node, @1, @2); }
-  | DEBUGGER error                      { $$ = createNodeDeclarationInfo<StatementNode*>(new DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
+  | DEBUGGER error                      { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
                                           DBG($$.m_node, @1, @1); AUTO_SEMICOLON; }
 ;
 
 FunctionDeclaration:
-    FUNCTION IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE { $$ = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *$2, $6, LEXER->sourceCode($5, $7, @5.first_line)), 0, new ParserRefCountedData<DeclarationStacks::FunctionStack>(GLOBAL_DATA), ((*$2 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); DBG($6, @5, @7); $$.m_funcDeclarations->data.append(static_cast<FuncDeclNode*>($$.m_node)); }
+    FUNCTION IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE { $$ = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *$2, $6, LEXER->sourceCode($5, $7, @5.first_line)), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*$2 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); DBG($6, @5, @7); $$.m_funcDeclarations->data.append(static_cast<FuncDeclNode*>($$.m_node)); }
   | FUNCTION IDENT '(' FormalParameterList ')' OPENBRACE FunctionBody CLOSEBRACE
       { 
-          $$ = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *$2, $7, LEXER->sourceCode($6, $8, @6.first_line), $4.m_node.head), 0, new ParserRefCountedData<DeclarationStacks::FunctionStack>(GLOBAL_DATA), ((*$2 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $4.m_features | ClosureFeature, 0); 
+          $$ = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *$2, $7, LEXER->sourceCode($6, $8, @6.first_line), $4.m_node.head), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*$2 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $4.m_features | ClosureFeature, 0); 
           if ($4.m_features & ArgumentsFeature)
               $7->setUsesArguments(); 
           DBG($7, @6, @8);
@@ -1199,12 +1200,12 @@ FunctionExpr:
 ;
 
 FormalParameterList:
-    IDENT                               { $$.m_node.head = new ParameterNode(GLOBAL_DATA, *$1);
+    IDENT                               { $$.m_node.head = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, *$1);
                                           $$.m_features = (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
                                           $$.m_node.tail = $$.m_node.head; }
   | FormalParameterList ',' IDENT       { $$.m_node.head = $1.m_node.head;
                                           $$.m_features = $1.m_features | ((*$3 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0);
-                                          $$.m_node.tail = new ParameterNode(GLOBAL_DATA, $1.m_node.tail, *$3);  }
+                                          $$.m_node.tail = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, $1.m_node.tail, *$3);  }
 ;
 
 FunctionBody:
@@ -1213,13 +1214,13 @@ FunctionBody:
 ;
 
 Program:
-    /* not in spec */                   { GLOBAL_DATA->parser->didFinishParsing(new SourceElements(GLOBAL_DATA), 0, 0, NoFeatures, @0.last_line, 0); }
+    /* not in spec */                   { GLOBAL_DATA->parser->didFinishParsing(new (GLOBAL_DATA) SourceElements(GLOBAL_DATA), 0, 0, NoFeatures, @0.last_line, 0); }
     | SourceElements                    { GLOBAL_DATA->parser->didFinishParsing($1.m_node, $1.m_varDeclarations, $1.m_funcDeclarations, $1.m_features, 
                                                                                 @1.last_line, $1.m_numConstants); }
 ;
 
 SourceElements:
-    Statement                           { $$.m_node = new SourceElements(GLOBAL_DATA);
+    Statement                           { $$.m_node = new (GLOBAL_DATA) SourceElements(GLOBAL_DATA);
                                           $$.m_node->append($1.m_node);
                                           $$.m_varDeclarations = $1.m_varDeclarations;
                                           $$.m_funcDeclarations = $1.m_funcDeclarations;
@@ -1828,23 +1829,23 @@ SourceElements_NoNode:
 static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Operator op, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end)
 {
     if (!loc->isLocation())
-        return new AssignErrorNode(GLOBAL_DATA, loc, op, expr, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) AssignErrorNode(GLOBAL_DATA, loc, op, expr, divot, divot - start, end - divot);
 
     if (loc->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(loc);
         if (op == OpEqual) {
-            AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, resolve->identifier(), expr, exprHasAssignments);
+            AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, resolve->identifier(), expr, exprHasAssignments);
             SET_EXCEPTION_LOCATION(node, start, divot, end);
             return node;
         } else
-            return new ReadModifyResolveNode(GLOBAL_DATA, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+            return new (GLOBAL_DATA) ReadModifyResolveNode(GLOBAL_DATA, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     }
     if (loc->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(loc);
         if (op == OpEqual)
-            return new AssignBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
+            return new (GLOBAL_DATA) AssignBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
         else {
-            ReadModifyBracketNode* node = new ReadModifyBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
+            ReadModifyBracketNode* node = new (GLOBAL_DATA) ReadModifyBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
             node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
             return node;
         }
@@ -1852,9 +1853,9 @@ static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Oper
     ASSERT(loc->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(loc);
     if (op == OpEqual)
-        return new AssignDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
+        return new (GLOBAL_DATA) AssignDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
 
-    ReadModifyDotNode* node = new ReadModifyDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+    ReadModifyDotNode* node = new (GLOBAL_DATA) ReadModifyDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
@@ -1862,21 +1863,21 @@ static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Oper
 static ExpressionNode* makePrefixNode(void* globalPtr, ExpressionNode* expr, Operator op, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new PrefixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PrefixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
     
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new PrefixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PrefixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PrefixBracketNode* node = new PrefixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PrefixBracketNode* node = new (GLOBAL_DATA) PrefixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->startOffset());
         return node;
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PrefixDotNode* node = new PrefixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PrefixDotNode* node = new (GLOBAL_DATA) PrefixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->startOffset());
     return node;
 }
@@ -1884,22 +1885,22 @@ static ExpressionNode* makePrefixNode(void* globalPtr, ExpressionNode* expr, Ope
 static ExpressionNode* makePostfixNode(void* globalPtr, ExpressionNode* expr, Operator op, int start, int divot, int end)
 { 
     if (!expr->isLocation())
-        return new PostfixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PostfixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
     
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new PostfixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PostfixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PostfixBracketNode* node = new PostfixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PostfixBracketNode* node = new (GLOBAL_DATA) PostfixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return node;
         
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PostfixDotNode* node = new PostfixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PostfixDotNode* node = new (GLOBAL_DATA) PostfixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
@@ -1909,23 +1910,29 @@ static ExpressionNodeInfo makeFunctionCallNode(void* globalPtr, ExpressionNodeIn
     CodeFeatures features = func.m_features | args.m_features;
     int numConstants = func.m_numConstants + args.m_numConstants;
     if (!func.m_node->isLocation())
-        return createNodeInfo<ExpressionNode*>(new FunctionCallValueNode(GLOBAL_DATA, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
+        return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) FunctionCallValueNode(GLOBAL_DATA, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
     if (func.m_node->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(func.m_node);
         const Identifier& identifier = resolve->identifier();
         if (identifier == GLOBAL_DATA->propertyNames->eval)
-            return createNodeInfo<ExpressionNode*>(new EvalFunctionCallNode(GLOBAL_DATA, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
-        return createNodeInfo<ExpressionNode*>(new FunctionCallResolveNode(GLOBAL_DATA, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
+            return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EvalFunctionCallNode(GLOBAL_DATA, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
+        return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) FunctionCallResolveNode(GLOBAL_DATA, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
     }
     if (func.m_node->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(func.m_node);
-        FunctionCallBracketNode* node = new FunctionCallBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
+        FunctionCallBracketNode* node = new (GLOBAL_DATA) FunctionCallBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return createNodeInfo<ExpressionNode*>(node, features, numConstants);
     }
     ASSERT(func.m_node->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(func.m_node);
-    FunctionCallDotNode* node = new FunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    FunctionCallDotNode* node;
+    if (dot->identifier() == GLOBAL_DATA->propertyNames->call)
+        node = new (GLOBAL_DATA) CallFunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    else if (dot->identifier() == GLOBAL_DATA->propertyNames->apply)
+        node = new (GLOBAL_DATA) ApplyFunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    else
+        node = new (GLOBAL_DATA) FunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return createNodeInfo<ExpressionNode*>(node, features, numConstants);
 }
@@ -1934,26 +1941,26 @@ static ExpressionNode* makeTypeOfNode(void* globalPtr, ExpressionNode* expr)
 {
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new TypeOfResolveNode(GLOBAL_DATA, resolve->identifier());
+        return new (GLOBAL_DATA) TypeOfResolveNode(GLOBAL_DATA, resolve->identifier());
     }
-    return new TypeOfValueNode(GLOBAL_DATA, expr);
+    return new (GLOBAL_DATA) TypeOfValueNode(GLOBAL_DATA, expr);
 }
 
 static ExpressionNode* makeDeleteNode(void* globalPtr, ExpressionNode* expr, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new DeleteValueNode(GLOBAL_DATA, expr);
+        return new (GLOBAL_DATA) DeleteValueNode(GLOBAL_DATA, expr);
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new DeleteResolveNode(GLOBAL_DATA, resolve->identifier(), divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) DeleteResolveNode(GLOBAL_DATA, resolve->identifier(), divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        return new DeleteBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) DeleteBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    return new DeleteDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), divot, divot - start, end - divot);
+    return new (GLOBAL_DATA) DeleteDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), divot, divot - start, end - divot);
 }
 
 static PropertyNode* makeGetterOrSetterPropertyNode(void* globalPtr, const Identifier& getOrSet, const Identifier& name, ParameterNode* params, FunctionBodyNode* body, const SourceCode& source)
@@ -1965,7 +1972,7 @@ static PropertyNode* makeGetterOrSetterPropertyNode(void* globalPtr, const Ident
         type = PropertyNode::Setter;
     else
         return 0;
-    return new PropertyNode(GLOBAL_DATA, name, new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, body, source, params), type);
+    return new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, name, new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, body, source, params), type);
 }
 
 static ExpressionNode* makeNegateNode(void* globalPtr, ExpressionNode* n)
@@ -1979,19 +1986,19 @@ static ExpressionNode* makeNegateNode(void* globalPtr, ExpressionNode* n)
         }
     }
 
-    return new NegateNode(GLOBAL_DATA, n);
+    return new (GLOBAL_DATA) NegateNode(GLOBAL_DATA, n);
 }
 
 static NumberNode* makeNumberNode(void* globalPtr, double d)
 {
-    return new NumberNode(GLOBAL_DATA, d);
+    return new (GLOBAL_DATA) NumberNode(GLOBAL_DATA, d);
 }
 
 static ExpressionNode* makeBitwiseNotNode(void* globalPtr, ExpressionNode* expr)
 {
     if (expr->isNumber())
         return makeNumberNode(globalPtr, ~toInt32(static_cast<NumberNode*>(expr)->value()));
-    return new BitwiseNotNode(GLOBAL_DATA, expr);
+    return new (GLOBAL_DATA) BitwiseNotNode(GLOBAL_DATA, expr);
 }
 
 static ExpressionNode* makeMultNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
@@ -2003,12 +2010,12 @@ static ExpressionNode* makeMultNode(void* globalPtr, ExpressionNode* expr1, Expr
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() * static_cast<NumberNode*>(expr2)->value());
 
     if (expr1->isNumber() && static_cast<NumberNode*>(expr1)->value() == 1)
-        return new UnaryPlusNode(GLOBAL_DATA, expr2);
+        return new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, expr2);
 
     if (expr2->isNumber() && static_cast<NumberNode*>(expr2)->value() == 1)
-        return new UnaryPlusNode(GLOBAL_DATA, expr1);
+        return new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, expr1);
 
-    return new MultNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) MultNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeDivNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
@@ -2018,14 +2025,14 @@ static ExpressionNode* makeDivNode(void* globalPtr, ExpressionNode* expr1, Expre
 
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() / static_cast<NumberNode*>(expr2)->value());
-    return new DivNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) DivNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeAddNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() + static_cast<NumberNode*>(expr2)->value());
-    return new AddNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) AddNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeSubNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
@@ -2035,21 +2042,21 @@ static ExpressionNode* makeSubNode(void* globalPtr, ExpressionNode* expr1, Expre
 
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() - static_cast<NumberNode*>(expr2)->value());
-    return new SubNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) SubNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeLeftShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) << (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new LeftShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) LeftShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeRightShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) >> (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new RightShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) RightShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 /* called by yyparse on error */
@@ -2064,11 +2071,15 @@ static bool allowAutomaticSemicolon(Lexer& lexer, int yychar)
     return yychar == CLOSEBRACE || yychar == 0 || lexer.prevTerminator();
 }
 
-static ExpressionNode* combineVarInitializers(void* globalPtr, ExpressionNode* list, AssignResolveNode* init)
+static ExpressionNode* combineCommaNodes(void* globalPtr, ExpressionNode* list, ExpressionNode* init)
 {
     if (!list)
         return init;
-    return new VarDeclCommaNode(GLOBAL_DATA, list, init);
+    if (list->isCommaNode()) {
+        static_cast<CommaNode*>(list)->append(init);
+        return list;
+    }
+    return new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, list, init);
 }
 
 // We turn variable declarations into either assignments or empty
@@ -2077,8 +2088,8 @@ static ExpressionNode* combineVarInitializers(void* globalPtr, ExpressionNode* l
 static StatementNode* makeVarStatementNode(void* globalPtr, ExpressionNode* expr)
 {
     if (!expr)
-        return new EmptyStatementNode(GLOBAL_DATA);
-    return new VarStatementNode(GLOBAL_DATA, expr);
+        return new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA);
+    return new (GLOBAL_DATA) VarStatementNode(GLOBAL_DATA, expr);
 }
 
 #undef GLOBAL_DATA
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
index 0bacb22..8e89c18 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.cpp
@@ -31,14 +31,12 @@
 #include <ctype.h>
 #include <limits.h>
 #include <string.h>
-#include <wtf/ASCIICType.h>
 #include <wtf/Assertions.h>
-#include <wtf/unicode/Unicode.h>
 
 using namespace WTF;
 using namespace Unicode;
 
-// we can't specify the namespace in yacc's C output, so do it here
+// We can't specify the namespace in yacc's C output, so do it here instead.
 using namespace JSC;
 
 #ifndef KDE_USE_FINAL
@@ -48,7 +46,7 @@ using namespace JSC;
 #include "Lookup.h"
 #include "Lexer.lut.h"
 
-// a bridge for yacc from the C world to C++
+// A bridge for yacc from the C world to the C++ world.
 int jscyylex(void* lvalp, void* llocp, void* globalData)
 {
     return static_cast<JSGlobalData*>(globalData)->lexer->lex(lvalp, llocp);
@@ -56,825 +54,895 @@ int jscyylex(void* lvalp, void* llocp, void* globalData)
 
 namespace JSC {
 
-static bool isDecimalDigit(int);
+static const UChar byteOrderMark = 0xFEFF;
 
 Lexer::Lexer(JSGlobalData* globalData)
-    : yylineno(1)
-    , m_restrKeyword(false)
-    , m_eatNextIdentifier(false)
-    , m_stackToken(-1)
-    , m_lastToken(-1)
-    , m_position(0)
-    , m_code(0)
-    , m_length(0)
-    , m_isReparsing(false)
-    , m_atLineStart(true)
-    , m_current(0)
-    , m_next1(0)
-    , m_next2(0)
-    , m_next3(0)
-    , m_currentOffset(0)
-    , m_nextOffset1(0)
-    , m_nextOffset2(0)
-    , m_nextOffset3(0)
+    : m_isReparsing(false)
     , m_globalData(globalData)
-    , m_mainTable(JSC::mainTable)
+    , m_keywordTable(JSC::mainTable)
 {
-    m_buffer8.reserveCapacity(initialReadBufferCapacity);
-    m_buffer16.reserveCapacity(initialReadBufferCapacity);
+    m_buffer8.reserveInitialCapacity(initialReadBufferCapacity);
+    m_buffer16.reserveInitialCapacity(initialReadBufferCapacity);
 }
 
 Lexer::~Lexer()
 {
-    m_mainTable.deleteTable();
+    m_keywordTable.deleteTable();
+}
+
+inline const UChar* Lexer::currentCharacter() const
+{
+    return m_code - 4;
+}
+
+inline int Lexer::currentOffset() const
+{
+    return currentCharacter() - m_codeStart;
+}
+
+ALWAYS_INLINE void Lexer::shift1()
+{
+    m_current = m_next1;
+    m_next1 = m_next2;
+    m_next2 = m_next3;
+    if (LIKELY(m_code < m_codeEnd))
+        m_next3 = m_code[0];
+    else
+        m_next3 = -1;
+
+    ++m_code;
+}
+
+ALWAYS_INLINE void Lexer::shift2()
+{
+    m_current = m_next2;
+    m_next1 = m_next3;
+    if (LIKELY(m_code + 1 < m_codeEnd)) {
+        m_next2 = m_code[0];
+        m_next3 = m_code[1];
+    } else {
+        m_next2 = m_code < m_codeEnd ? m_code[0] : -1;
+        m_next3 = -1;
+    }
+
+    m_code += 2;
+}
+
+ALWAYS_INLINE void Lexer::shift3()
+{
+    m_current = m_next3;
+    if (LIKELY(m_code + 2 < m_codeEnd)) {
+        m_next1 = m_code[0];
+        m_next2 = m_code[1];
+        m_next3 = m_code[2];
+    } else {
+        m_next1 = m_code < m_codeEnd ? m_code[0] : -1;
+        m_next2 = m_code + 1 < m_codeEnd ? m_code[1] : -1;
+        m_next3 = -1;
+    }
+
+    m_code += 3;
+}
+
+ALWAYS_INLINE void Lexer::shift4()
+{
+    if (LIKELY(m_code + 3 < m_codeEnd)) {
+        m_current = m_code[0];
+        m_next1 = m_code[1];
+        m_next2 = m_code[2];
+        m_next3 = m_code[3];
+    } else {
+        m_current = m_code < m_codeEnd ? m_code[0] : -1;
+        m_next1 = m_code + 1 < m_codeEnd ? m_code[1] : -1;
+        m_next2 = m_code + 2 < m_codeEnd ? m_code[2] : -1;
+        m_next3 = -1;
+    }
+
+    m_code += 4;
 }
 
 void Lexer::setCode(const SourceCode& source)
 {
-    yylineno = source.firstLine();
-    m_restrKeyword = false;
+    m_lineNumber = source.firstLine();
     m_delimited = false;
-    m_eatNextIdentifier = false;
-    m_stackToken = -1;
     m_lastToken = -1;
 
-    m_position = source.startOffset();
+    const UChar* data = source.provider()->data();
+
     m_source = &source;
-    m_code = source.provider()->data();
-    m_length = source.endOffset();
-    m_skipLF = false;
-    m_skipCR = false;
+    m_codeStart = data;
+    m_code = data + source.startOffset();
+    m_codeEnd = data + source.endOffset();
     m_error = false;
     m_atLineStart = true;
 
-    // read first characters
-    shift(4);
+    // ECMA-262 calls for stripping all Cf characters, but we only strip BOM characters.
+    // See <https://bugs.webkit.org/show_bug.cgi?id=4931> for details.
+    if (source.provider()->hasBOMs()) {
+        for (const UChar* p = m_codeStart; p < m_codeEnd; ++p) {
+            if (UNLIKELY(*p == byteOrderMark)) {
+                copyCodeWithoutBOMs();
+                break;
+            }
+        }
+    }
+
+    // Read the first characters into the 4-character buffer.
+    shift4();
+    ASSERT(currentOffset() == source.startOffset());
 }
 
-void Lexer::shift(unsigned p)
+void Lexer::copyCodeWithoutBOMs()
 {
-    // ECMA-262 calls for stripping Cf characters here, but we only do this for BOM,
-    // see <https://bugs.webkit.org/show_bug.cgi?id=4931>.
-
-    while (p--) {
-        m_current = m_next1;
-        m_next1 = m_next2;
-        m_next2 = m_next3;
-        m_currentOffset = m_nextOffset1;
-        m_nextOffset1 = m_nextOffset2;
-        m_nextOffset2 = m_nextOffset3;
-        do {
-            if (m_position >= m_length) {
-                m_nextOffset3 = m_position;
-                m_position++;
-                m_next3 = -1;
-                break;
-            }
-            m_nextOffset3 = m_position;
-            m_next3 = m_code[m_position++];
-        } while (m_next3 == 0xFEFF);
+    // Note: In this case, the character offset data for debugging will be incorrect.
+    // If it's important to correctly debug code with extraneous BOMs, then the caller
+    // should strip the BOMs when creating the SourceProvider object and do its own
+    // mapping of offsets within the stripped text to original text offset.
+
+    m_codeWithoutBOMs.reserveCapacity(m_codeEnd - m_code);
+    for (const UChar* p = m_code; p < m_codeEnd; ++p) {
+        UChar c = *p;
+        if (c != byteOrderMark)
+            m_codeWithoutBOMs.append(c);
+    }
+    ptrdiff_t startDelta = m_codeStart - m_code;
+    m_code = m_codeWithoutBOMs.data();
+    m_codeStart = m_code + startDelta;
+    m_codeEnd = m_codeWithoutBOMs.data() + m_codeWithoutBOMs.size();
+}
+
+void Lexer::shiftLineTerminator()
+{
+    ASSERT(isLineTerminator(m_current));
+
+    // Allow both CRLF and LFCR.
+    if (m_current + m_next1 == '\n' + '\r')
+        shift2();
+    else
+        shift1();
+
+    ++m_lineNumber;
+}
+
+ALWAYS_INLINE Identifier* Lexer::makeIdentifier(const UChar* characters, size_t length)
+{
+    m_identifiers.append(Identifier(m_globalData, characters, length));
+    return &m_identifiers.last();
+}
+
+inline bool Lexer::lastTokenWasRestrKeyword() const
+{
+    return m_lastToken == CONTINUE || m_lastToken == BREAK || m_lastToken == RETURN || m_lastToken == THROW;
+}
+
+static NEVER_INLINE bool isNonASCIIIdentStart(int c)
+{
+    return category(c) & (Letter_Uppercase | Letter_Lowercase | Letter_Titlecase | Letter_Modifier | Letter_Other);
+}
+
+static inline bool isIdentStart(int c)
+{
+    return isASCII(c) ? isASCIIAlpha(c) || c == '$' || c == '_' : isNonASCIIIdentStart(c);
+}
+
+static NEVER_INLINE bool isNonASCIIIdentPart(int c)
+{
+    return category(c) & (Letter_Uppercase | Letter_Lowercase | Letter_Titlecase | Letter_Modifier | Letter_Other
+        | Mark_NonSpacing | Mark_SpacingCombining | Number_DecimalDigit | Punctuation_Connector);
+}
+
+static inline bool isIdentPart(int c)
+{
+    return isASCII(c) ? isASCIIAlphanumeric(c) || c == '$' || c == '_' : isNonASCIIIdentPart(c);
+}
+
+static inline int singleEscape(int c)
+{
+    switch (c) {
+        case 'b':
+            return 0x08;
+        case 't':
+            return 0x09;
+        case 'n':
+            return 0x0A;
+        case 'v':
+            return 0x0B;
+        case 'f':
+            return 0x0C;
+        case 'r':
+            return 0x0D;
+        default:
+            return c;
     }
 }
 
-// called on each new line
-void Lexer::nextLine()
+inline void Lexer::record8(int c)
 {
-    yylineno++;
-    m_atLineStart = true;
+    ASSERT(c >= 0);
+    ASSERT(c <= 0xFF);
+    m_buffer8.append(static_cast<char>(c));
 }
 
-void Lexer::setDone(State s)
+inline void Lexer::record16(UChar c)
 {
-    m_state = s;
-    m_done = true;
+    m_buffer16.append(c);
+}
+
+inline void Lexer::record16(int c)
+{
+    ASSERT(c >= 0);
+    ASSERT(c <= USHRT_MAX);
+    record16(UChar(static_cast<unsigned short>(c)));
 }
 
 int Lexer::lex(void* p1, void* p2)
 {
+    ASSERT(!m_error);
+    ASSERT(m_buffer8.isEmpty());
+    ASSERT(m_buffer16.isEmpty());
+
     YYSTYPE* lvalp = static_cast<YYSTYPE*>(p1);
     YYLTYPE* llocp = static_cast<YYLTYPE*>(p2);
     int token = 0;
-    m_state = Start;
-    unsigned short stringType = 0; // either single or double quotes
-    m_buffer8.clear();
-    m_buffer16.clear();
-    m_done = false;
     m_terminator = false;
-    m_skipLF = false;
-    m_skipCR = false;
-
-    // did we push a token on the stack previously ?
-    // (after an automatic semicolon insertion)
-    if (m_stackToken >= 0) {
-        setDone(Other);
-        token = m_stackToken;
-        m_stackToken = 0;
-    }
-    int startOffset = m_currentOffset;
-    while (!m_done) {
-        if (m_skipLF && m_current != '\n') // found \r but not \n afterwards
-            m_skipLF = false;
-        if (m_skipCR && m_current != '\r') // found \n but not \r afterwards
-            m_skipCR = false;
-        if (m_skipLF || m_skipCR) { // found \r\n or \n\r -> eat the second one
-            m_skipLF = false;
-            m_skipCR = false;
-            shift(1);
+
+start:
+    while (isWhiteSpace(m_current))
+        shift1();
+
+    int startOffset = currentOffset();
+
+    if (m_current == -1) {
+        if (!m_terminator && !m_delimited && !m_isReparsing) {
+            // automatic semicolon insertion if program incomplete
+            token = ';';
+            goto doneSemicolon;
         }
-        switch (m_state) {
-            case Start:
-                startOffset = m_currentOffset;
-                if (isWhiteSpace()) {
-                    // do nothing
-                } else if (m_current == '/' && m_next1 == '/') {
-                    shift(1);
-                    m_state = InSingleLineComment;
-                } else if (m_current == '/' && m_next1 == '*') {
-                    shift(1);
-                    m_state = InMultiLineComment;
-                } else if (m_current == -1) {
-                    if (!m_terminator && !m_delimited && !m_isReparsing) {
-                        // automatic semicolon insertion if program incomplete
-                        token = ';';
-                        m_stackToken = 0;
-                        setDone(Other);
-                    } else
-                        setDone(Eof);
-                } else if (isLineTerminator()) {
-                    nextLine();
-                    m_terminator = true;
-                    if (m_restrKeyword) {
-                        token = ';';
-                        setDone(Other);
-                    }
-                } else if (m_current == '"' || m_current == '\'') {
-                    m_state = InString;
-                    stringType = static_cast<unsigned short>(m_current);
-                } else if (isIdentStart(m_current)) {
-                    record16(m_current);
-                    m_state = InIdentifierOrKeyword;
-                } else if (m_current == '\\')
-                    m_state = InIdentifierStartUnicodeEscapeStart;
-                else if (m_current == '0') {
-                    record8(m_current);
-                    m_state = InNum0;
-                } else if (isDecimalDigit(m_current)) {
-                    record8(m_current);
-                    m_state = InNum;
-                } else if (m_current == '.' && isDecimalDigit(m_next1)) {
-                    record8(m_current);
-                    m_state = InDecimal;
-                    // <!-- marks the beginning of a line comment (for www usage)
-                } else if (m_current == '<' && m_next1 == '!' && m_next2 == '-' && m_next3 == '-') {
-                    shift(3);
-                    m_state = InSingleLineComment;
-                    // same for -->
-                } else if (m_atLineStart && m_current == '-' && m_next1 == '-' &&  m_next2 == '>') {
-                    shift(2);
-                    m_state = InSingleLineComment;
-                } else {
-                    token = matchPunctuator(lvalp->intValue, m_current, m_next1, m_next2, m_next3);
-                    if (token != -1)
-                        setDone(Other);
-                    else
-                        setDone(Bad);
+        return 0;
+    }
+
+    m_delimited = false;
+    switch (m_current) {
+        case '>':
+            if (m_next1 == '>' && m_next2 == '>') {
+                if (m_next3 == '=') {
+                    shift4();
+                    token = URSHIFTEQUAL;
+                    break;
                 }
+                shift3();
+                token = URSHIFT;
                 break;
-            case InString:
-                if (m_current == stringType) {
-                    shift(1);
-                    setDone(String);
-                } else if (isLineTerminator() || m_current == -1)
-                    setDone(Bad);
-                else if (m_current == '\\')
-                    m_state = InEscapeSequence;
-                else
-                    record16(m_current);
+            }
+            if (m_next1 == '>') {
+                if (m_next2 == '=') {
+                    shift3();
+                    token = RSHIFTEQUAL;
+                    break;
+                }
+                shift2();
+                token = RSHIFT;
                 break;
-            // Escape Sequences inside of strings
-            case InEscapeSequence:
-                if (isOctalDigit(m_current)) {
-                    if (m_current >= '0' && m_current <= '3' &&
-                        isOctalDigit(m_next1) && isOctalDigit(m_next2)) {
-                        record16(convertOctal(m_current, m_next1, m_next2));
-                        shift(2);
-                        m_state = InString;
-                    } else if (isOctalDigit(m_current) && isOctalDigit(m_next1)) {
-                        record16(convertOctal('0', m_current, m_next1));
-                        shift(1);
-                        m_state = InString;
-                    } else if (isOctalDigit(m_current)) {
-                        record16(convertOctal('0', '0', m_current));
-                        m_state = InString;
-                    } else
-                        setDone(Bad);
-                } else if (m_current == 'x')
-                    m_state = InHexEscape;
-                else if (m_current == 'u')
-                    m_state = InUnicodeEscape;
-                else if (isLineTerminator()) {
-                    nextLine();
-                    m_state = InString;
-                } else {
-                    record16(singleEscape(static_cast<unsigned short>(m_current)));
-                    m_state = InString;
+            }
+            if (m_next1 == '=') {
+                shift2();
+                token = GE;
+                break;
+            }
+            shift1();
+            token = '>';
+            break;
+        case '=':
+            if (m_next1 == '=') {
+                if (m_next2 == '=') {
+                    shift3();
+                    token = STREQ;
+                    break;
                 }
+                shift2();
+                token = EQEQ;
                 break;
-            case InHexEscape:
-                if (isHexDigit(m_current) && isHexDigit(m_next1)) {
-                    m_state = InString;
-                    record16(convertHex(m_current, m_next1));
-                    shift(1);
-                } else if (m_current == stringType) {
-                    record16('x');
-                    shift(1);
-                    setDone(String);
-                } else {
-                    record16('x');
-                    record16(m_current);
-                    m_state = InString;
+            }
+            shift1();
+            token = '=';
+            break;
+        case '!':
+            if (m_next1 == '=') {
+                if (m_next2 == '=') {
+                    shift3();
+                    token = STRNEQ;
+                    break;
                 }
+                shift2();
+                token = NE;
                 break;
-            case InUnicodeEscape:
-                if (isHexDigit(m_current) && isHexDigit(m_next1) && isHexDigit(m_next2) && isHexDigit(m_next3)) {
-                    record16(convertUnicode(m_current, m_next1, m_next2, m_next3));
-                    shift(3);
-                    m_state = InString;
-                } else if (m_current == stringType) {
-                    record16('u');
-                    shift(1);
-                    setDone(String);
-                } else
-                    setDone(Bad);
+            }
+            shift1();
+            token = '!';
+            break;
+        case '<':
+            if (m_next1 == '!' && m_next2 == '-' && m_next3 == '-') {
+                // <!-- marks the beginning of a line comment (for www usage)
+                shift4();
+                goto inSingleLineComment;
+            }
+            if (m_next1 == '<') {
+                if (m_next2 == '=') {
+                    shift3();
+                    token = LSHIFTEQUAL;
+                    break;
+                }
+                shift2();
+                token = LSHIFT;
                 break;
-            case InSingleLineComment:
-                if (isLineTerminator()) {
-                    nextLine();
-                    m_terminator = true;
-                    if (m_restrKeyword) {
-                        token = ';';
-                        setDone(Other);
-                    } else
-                        m_state = Start;
-                } else if (m_current == -1)
-                    setDone(Eof);
+            }
+            if (m_next1 == '=') {
+                shift2();
+                token = LE;
                 break;
-            case InMultiLineComment:
-                if (m_current == -1)
-                    setDone(Bad);
-                else if (isLineTerminator())
-                    nextLine();
-                else if (m_current == '*' && m_next1 == '/') {
-                    m_state = Start;
-                    shift(1);
+            }
+            shift1();
+            token = '<';
+            break;
+        case '+':
+            if (m_next1 == '+') {
+                shift2();
+                if (m_terminator) {
+                    token = AUTOPLUSPLUS;
+                    break;
                 }
+                token = PLUSPLUS;
                 break;
-            case InIdentifierOrKeyword:
-            case InIdentifier:
-                if (isIdentPart(m_current))
-                    record16(m_current);
-                else if (m_current == '\\')
-                    m_state = InIdentifierPartUnicodeEscapeStart;
-                else
-                    setDone(m_state == InIdentifierOrKeyword ? IdentifierOrKeyword : Identifier);
+            }
+            if (m_next1 == '=') {
+                shift2();
+                token = PLUSEQUAL;
                 break;
-            case InNum0:
-                if (m_current == 'x' || m_current == 'X') {
-                    record8(m_current);
-                    m_state = InHex;
-                } else if (m_current == '.') {
-                    record8(m_current);
-                    m_state = InDecimal;
-                } else if (m_current == 'e' || m_current == 'E') {
-                    record8(m_current);
-                    m_state = InExponentIndicator;
-                } else if (isOctalDigit(m_current)) {
-                    record8(m_current);
-                    m_state = InOctal;
-                } else if (isDecimalDigit(m_current)) {
-                    record8(m_current);
-                    m_state = InDecimal;
-                } else
-                    setDone(Number);
+            }
+            shift1();
+            token = '+';
+            break;
+        case '-':
+            if (m_next1 == '-') {
+                if (m_atLineStart && m_next2 == '>') {
+                    shift3();
+                    goto inSingleLineComment;
+                }
+                shift2();
+                if (m_terminator) {
+                    token = AUTOMINUSMINUS;
+                    break;
+                }
+                token = MINUSMINUS;
                 break;
-            case InHex:
-                if (isHexDigit(m_current))
-                    record8(m_current);
-                else
-                    setDone(Hex);
+            }
+            if (m_next1 == '=') {
+                shift2();
+                token = MINUSEQUAL;
                 break;
-            case InOctal:
-                if (isOctalDigit(m_current))
-                    record8(m_current);
-                else if (isDecimalDigit(m_current)) {
-                    record8(m_current);
-                    m_state = InDecimal;
-                } else
-                    setDone(Octal);
+            }
+            shift1();
+            token = '-';
+            break;
+        case '*':
+            if (m_next1 == '=') {
+                shift2();
+                token = MULTEQUAL;
                 break;
-            case InNum:
-                if (isDecimalDigit(m_current))
-                    record8(m_current);
-                else if (m_current == '.') {
-                    record8(m_current);
-                    m_state = InDecimal;
-                } else if (m_current == 'e' || m_current == 'E') {
-                    record8(m_current);
-                    m_state = InExponentIndicator;
-                } else
-                    setDone(Number);
+            }
+            shift1();
+            token = '*';
+            break;
+        case '/':
+            if (m_next1 == '/') {
+                shift2();
+                goto inSingleLineComment;
+            }
+            if (m_next1 == '*')
+                goto inMultiLineComment;
+            if (m_next1 == '=') {
+                shift2();
+                token = DIVEQUAL;
                 break;
-            case InDecimal:
-                if (isDecimalDigit(m_current))
-                    record8(m_current);
-                else if (m_current == 'e' || m_current == 'E') {
-                    record8(m_current);
-                    m_state = InExponentIndicator;
-                } else
-                    setDone(Number);
+            }
+            shift1();
+            token = '/';
+            break;
+        case '&':
+            if (m_next1 == '&') {
+                shift2();
+                token = AND;
                 break;
-            case InExponentIndicator:
-                if (m_current == '+' || m_current == '-')
-                    record8(m_current);
-                else if (isDecimalDigit(m_current)) {
-                    record8(m_current);
-                    m_state = InExponent;
-                } else
-                    setDone(Bad);
+            }
+            if (m_next1 == '=') {
+                shift2();
+                token = ANDEQUAL;
                 break;
-            case InExponent:
-                if (isDecimalDigit(m_current))
-                    record8(m_current);
-                else
-                    setDone(Number);
+            }
+            shift1();
+            token = '&';
+            break;
+        case '^':
+            if (m_next1 == '=') {
+                shift2();
+                token = XOREQUAL;
                 break;
-            case InIdentifierStartUnicodeEscapeStart:
-                if (m_current == 'u')
-                    m_state = InIdentifierStartUnicodeEscape;
-                else
-                    setDone(Bad);
+            }
+            shift1();
+            token = '^';
+            break;
+        case '%':
+            if (m_next1 == '=') {
+                shift2();
+                token = MODEQUAL;
                 break;
-            case InIdentifierPartUnicodeEscapeStart:
-                if (m_current == 'u')
-                    m_state = InIdentifierPartUnicodeEscape;
-                else
-                    setDone(Bad);
+            }
+            shift1();
+            token = '%';
+            break;
+        case '|':
+            if (m_next1 == '=') {
+                shift2();
+                token = OREQUAL;
                 break;
-            case InIdentifierStartUnicodeEscape:
-                if (!isHexDigit(m_current) || !isHexDigit(m_next1) || !isHexDigit(m_next2) || !isHexDigit(m_next3)) {
-                    setDone(Bad);
-                    break;
-                }
-                token = convertUnicode(m_current, m_next1, m_next2, m_next3);
-                shift(3);
-                if (!isIdentStart(token)) {
-                    setDone(Bad);
-                    break;
-                }
-                record16(token);
-                m_state = InIdentifier;
+            }
+            if (m_next1 == '|') {
+                shift2();
+                token = OR;
                 break;
-            case InIdentifierPartUnicodeEscape:
-                if (!isHexDigit(m_current) || !isHexDigit(m_next1) || !isHexDigit(m_next2) || !isHexDigit(m_next3)) {
-                    setDone(Bad);
-                    break;
-                }
-                token = convertUnicode(m_current, m_next1, m_next2, m_next3);
-                shift(3);
-                if (!isIdentPart(token)) {
-                    setDone(Bad);
-                    break;
+            }
+            shift1();
+            token = '|';
+            break;
+        case '.':
+            if (isASCIIDigit(m_next1)) {
+                record8('.');
+                shift1();
+                goto inNumberAfterDecimalPoint;
+            }
+            token = '.';
+            shift1();
+            break;
+        case ',':
+        case '~':
+        case '?':
+        case ':':
+        case '(':
+        case ')':
+        case '[':
+        case ']':
+            token = m_current;
+            shift1();
+            break;
+        case ';':
+            shift1();
+            m_delimited = true;
+            token = ';';
+            break;
+        case '{':
+            lvalp->intValue = currentOffset();
+            shift1();
+            token = OPENBRACE;
+            break;
+        case '}':
+            lvalp->intValue = currentOffset();
+            shift1();
+            m_delimited = true;
+            token = CLOSEBRACE;
+            break;
+        case '\\':
+            goto startIdentifierWithBackslash;
+        case '0':
+            goto startNumberWithZeroDigit;
+        case '1':
+        case '2':
+        case '3':
+        case '4':
+        case '5':
+        case '6':
+        case '7':
+        case '8':
+        case '9':
+            goto startNumber;
+        case '"':
+        case '\'':
+            goto startString;
+        default:
+            if (isIdentStart(m_current))
+                goto startIdentifierOrKeyword;
+            if (isLineTerminator(m_current)) {
+                shiftLineTerminator();
+                m_atLineStart = true;
+                m_terminator = true;
+                if (lastTokenWasRestrKeyword()) {
+                    token = ';';
+                    goto doneSemicolon;
                 }
-                record16(token);
-                m_state = InIdentifier;
-                break;
-            default:
-                ASSERT(!"Unhandled state in switch statement");
-        }
-
-        // move on to the next character
-        if (!m_done)
-            shift(1);
-        if (m_state != Start && m_state != InSingleLineComment)
-            m_atLineStart = false;
+                goto start;
+            }
+            goto returnError;
     }
 
-    // no identifiers allowed directly after numeric literal, e.g. "3in" is bad
-    if ((m_state == Number || m_state == Octal || m_state == Hex) && isIdentStart(m_current))
-        m_state = Bad;
+    m_atLineStart = false;
+    goto returnToken;
 
-    // terminate string
-    m_buffer8.append('\0');
-
-#ifdef JSC_DEBUG_LEX
-    fprintf(stderr, "line: %d ", lineNo());
-    fprintf(stderr, "yytext (%x): ", m_buffer8[0]);
-    fprintf(stderr, "%s ", m_buffer8.data());
-#endif
+startString: {
+    int stringQuoteCharacter = m_current;
+    shift1();
 
-    double dval = 0;
-    if (m_state == Number)
-        dval = WTF::strtod(m_buffer8.data(), 0L);
-    else if (m_state == Hex) { // scan hex numbers
-        const char* p = m_buffer8.data() + 2;
-        while (char c = *p++) {
-            dval *= 16;
-            dval += convertHex(c);
+    const UChar* stringStart = currentCharacter();
+    while (m_current != stringQuoteCharacter) {
+        // Fast check for characters that require special handling.
+        // Catches -1, \n, \r, \, 0x2028, and 0x2029 as efficiently
+        // as possible, and lets through all common ASCII characters.
+        if (UNLIKELY(m_current == '\\') || UNLIKELY(((static_cast<unsigned>(m_current) - 0xE) & 0x2000))) {
+            m_buffer16.append(stringStart, currentCharacter() - stringStart);
+            goto inString;
+        }
+        shift1();
+    }
+    lvalp->ident = makeIdentifier(stringStart, currentCharacter() - stringStart);
+    shift1();
+    m_atLineStart = false;
+    m_delimited = false;
+    token = STRING;
+    goto returnToken;
+
+inString:
+    while (m_current != stringQuoteCharacter) {
+        if (m_current == '\\')
+            goto inStringEscapeSequence;
+        if (UNLIKELY(isLineTerminator(m_current)))
+            goto returnError;
+        if (UNLIKELY(m_current == -1))
+            goto returnError;
+        record16(m_current);
+        shift1();
+    }
+    goto doneString;
+
+inStringEscapeSequence:
+    shift1();
+    if (m_current == 'x') {
+        shift1();
+        if (isASCIIHexDigit(m_current) && isASCIIHexDigit(m_next1)) {
+            record16(convertHex(m_current, m_next1));
+            shift2();
+            goto inString;
         }
+        record16('x');
+        if (m_current == stringQuoteCharacter)
+            goto doneString;
+        goto inString;
+    }
+    if (m_current == 'u') {
+        shift1();
+        if (isASCIIHexDigit(m_current) && isASCIIHexDigit(m_next1) && isASCIIHexDigit(m_next2) && isASCIIHexDigit(m_next3)) {
+            record16(convertUnicode(m_current, m_next1, m_next2, m_next3));
+            shift4();
+            goto inString;
+        }
+        if (m_current == stringQuoteCharacter) {
+            record16('u');
+            goto doneString;
+        }
+        goto returnError;
+    }
+    if (isASCIIOctalDigit(m_current)) {
+        if (m_current >= '0' && m_current <= '3' && isASCIIOctalDigit(m_next1) && isASCIIOctalDigit(m_next2)) {
+            record16((m_current - '0') * 64 + (m_next1 - '0') * 8 + m_next2 - '0');
+            shift3();
+            goto inString;
+        }
+        if (isASCIIOctalDigit(m_next1)) {
+            record16((m_current - '0') * 8 + m_next1 - '0');
+            shift2();
+            goto inString;
+        }
+        record16(m_current - '0');
+        shift1();
+        goto inString;
+    }
+    if (isLineTerminator(m_current)) {
+        shiftLineTerminator();
+        goto inString;
+    }
+    record16(singleEscape(m_current));
+    shift1();
+    goto inString;
+}
 
-        if (dval >= mantissaOverflowLowerBound)
-            dval = parseIntOverflow(m_buffer8.data() + 2, p - (m_buffer8.data() + 3), 16);
+startIdentifierWithBackslash:
+    shift1();
+    if (UNLIKELY(m_current != 'u'))
+        goto returnError;
+    shift1();
+    if (UNLIKELY(!isASCIIHexDigit(m_current) || !isASCIIHexDigit(m_next1) || !isASCIIHexDigit(m_next2) || !isASCIIHexDigit(m_next3)))
+        goto returnError;
+    token = convertUnicode(m_current, m_next1, m_next2, m_next3);
+    if (UNLIKELY(!isIdentStart(token)))
+        goto returnError;
+    goto inIdentifierAfterCharacterCheck;
+
+startIdentifierOrKeyword: {
+    const UChar* identifierStart = currentCharacter();
+    shift1();
+    while (isIdentPart(m_current))
+        shift1();
+    if (LIKELY(m_current != '\\')) {
+        lvalp->ident = makeIdentifier(identifierStart, currentCharacter() - identifierStart);
+        goto doneIdentifierOrKeyword;
+    }
+    m_buffer16.append(identifierStart, currentCharacter() - identifierStart);
+}
 
-        m_state = Number;
-    } else if (m_state == Octal) {   // scan octal number
-        const char* p = m_buffer8.data() + 1;
-        while (char c = *p++) {
-            dval *= 8;
-            dval += c - '0';
+    do {
+        shift1();
+        if (UNLIKELY(m_current != 'u'))
+            goto returnError;
+        shift1();
+        if (UNLIKELY(!isASCIIHexDigit(m_current) || !isASCIIHexDigit(m_next1) || !isASCIIHexDigit(m_next2) || !isASCIIHexDigit(m_next3)))
+            goto returnError;
+        token = convertUnicode(m_current, m_next1, m_next2, m_next3);
+        if (UNLIKELY(!isIdentPart(token)))
+            goto returnError;
+inIdentifierAfterCharacterCheck:
+        record16(token);
+        shift4();
+
+        while (isIdentPart(m_current)) {
+            record16(m_current);
+            shift1();
         }
+    } while (UNLIKELY(m_current == '\\'));
+    goto doneIdentifier;
 
-        if (dval >= mantissaOverflowLowerBound)
-            dval = parseIntOverflow(m_buffer8.data() + 1, p - (m_buffer8.data() + 2), 8);
-
-        m_state = Number;
+inSingleLineComment:
+    while (!isLineTerminator(m_current)) {
+        if (UNLIKELY(m_current == -1))
+            return 0;
+        shift1();
     }
-
-#ifdef JSC_DEBUG_LEX
-    switch (m_state) {
-        case Eof:
-            printf("(EOF)\n");
-            break;
-        case Other:
-            printf("(Other)\n");
-            break;
-        case Identifier:
-            printf("(Identifier)/(Keyword)\n");
-            break;
-        case String:
-            printf("(String)\n");
-            break;
-        case Number:
-            printf("(Number)\n");
-            break;
-        default:
-            printf("(unknown)");
+    shiftLineTerminator();
+    m_atLineStart = true;
+    m_terminator = true;
+    if (lastTokenWasRestrKeyword())
+        goto doneSemicolon;
+    goto start;
+
+inMultiLineComment:
+    shift2();
+    while (m_current != '*' || m_next1 != '/') {
+        if (isLineTerminator(m_current))
+            shiftLineTerminator();
+        else {
+            shift1();
+            if (UNLIKELY(m_current == -1))
+                goto returnError;
+        }
     }
-#endif
+    shift2();
+    m_atLineStart = false;
+    goto start;
+
+startNumberWithZeroDigit:
+    shift1();
+    if ((m_current | 0x20) == 'x' && isASCIIHexDigit(m_next1)) {
+        shift1();
+        goto inHex;
+    }
+    if (m_current == '.') {
+        record8('0');
+        record8('.');
+        shift1();
+        goto inNumberAfterDecimalPoint;
+    }
+    if ((m_current | 0x20) == 'e') {
+        record8('0');
+        record8('e');
+        shift1();
+        goto inExponentIndicator;
+    }
+    if (isASCIIOctalDigit(m_current))
+        goto inOctal;
+    if (isASCIIDigit(m_current))
+        goto startNumber;
+    lvalp->doubleValue = 0;
+    goto doneNumeric;
+
+inNumberAfterDecimalPoint:
+    while (isASCIIDigit(m_current)) {
+        record8(m_current);
+        shift1();
+    }
+    if ((m_current | 0x20) == 'e') {
+        record8('e');
+        shift1();
+        goto inExponentIndicator;
+    }
+    goto doneNumber;
+
+inExponentIndicator:
+    if (m_current == '+' || m_current == '-') {
+        record8(m_current);
+        shift1();
+    }
+    if (!isASCIIDigit(m_current))
+        goto returnError;
+    do {
+        record8(m_current);
+        shift1();
+    } while (isASCIIDigit(m_current));
+    goto doneNumber;
+
+inOctal: {
+    do {
+        record8(m_current);
+        shift1();
+    } while (isASCIIOctalDigit(m_current));
+    if (isASCIIDigit(m_current))
+        goto startNumber;
 
-    if (m_state != Identifier)
-        m_eatNextIdentifier = false;
+    double dval = 0;
 
-    m_restrKeyword = false;
-    m_delimited = false;
-    llocp->first_line = yylineno;
-    llocp->last_line = yylineno;
-    llocp->first_column = startOffset;
-    llocp->last_column = m_currentOffset;
-    switch (m_state) {
-        case Eof:
-            token = 0;
-            break;
-        case Other:
-            if (token == '}' || token == ';')
-                m_delimited = true;
-            break;
-        case Identifier:
-            // Apply anonymous-function hack below (eat the identifier).
-            if (m_eatNextIdentifier) {
-                m_eatNextIdentifier = false;
-                token = lex(lvalp, llocp);
-                break;
-            }
-            lvalp->ident = makeIdentifier(m_buffer16);
-            token = IDENT;
-            break;
-        case IdentifierOrKeyword: {
-            lvalp->ident = makeIdentifier(m_buffer16);
-            const HashEntry* entry = m_mainTable.entry(m_globalData, *lvalp->ident);
-            if (!entry) {
-                // Lookup for keyword failed, means this is an identifier.
-                token = IDENT;
-                break;
-            }
-            token = entry->lexerValue();
-            // Hack for "f = function somename() { ... }"; too hard to get into the grammar.
-            m_eatNextIdentifier = token == FUNCTION && m_lastToken == '=';
-            if (token == CONTINUE || token == BREAK || token == RETURN || token == THROW)
-                m_restrKeyword = true;
-            break;
-        }
-        case String:
-            // Atomize constant strings in case they're later used in property lookup.
-            lvalp->ident = makeIdentifier(m_buffer16);
-            token = STRING;
-            break;
-        case Number:
-            lvalp->doubleValue = dval;
-            token = NUMBER;
-            break;
-        case Bad:
-#ifdef JSC_DEBUG_LEX
-            fprintf(stderr, "yylex: ERROR.\n");
-#endif
-            m_error = true;
-            return -1;
-        default:
-            ASSERT(!"unhandled numeration value in switch");
-            m_error = true;
-            return -1;
+    const char* end = m_buffer8.end();
+    for (const char* p = m_buffer8.data(); p < end; ++p) {
+        dval *= 8;
+        dval += *p - '0';
     }
-    m_lastToken = token;
-    return token;
-}
+    if (dval >= mantissaOverflowLowerBound)
+        dval = parseIntOverflow(m_buffer8.data(), end - m_buffer8.data(), 8);
 
-bool Lexer::isWhiteSpace() const
-{
-    return m_current == '\t' || m_current == 0x0b || m_current == 0x0c || isSeparatorSpace(m_current);
-}
+    m_buffer8.resize(0);
 
-bool Lexer::isLineTerminator()
-{
-    bool cr = (m_current == '\r');
-    bool lf = (m_current == '\n');
-    if (cr)
-        m_skipLF = true;
-    else if (lf)
-        m_skipCR = true;
-    return cr || lf || m_current == 0x2028 || m_current == 0x2029;
+    lvalp->doubleValue = dval;
+    goto doneNumeric;
 }
 
-bool Lexer::isIdentStart(int c)
-{
-    return isASCIIAlpha(c) || c == '$' || c == '_' || (!isASCII(c) && (category(c) & (Letter_Uppercase | Letter_Lowercase | Letter_Titlecase | Letter_Modifier | Letter_Other)));
-}
+inHex: {
+    do {
+        record8(m_current);
+        shift1();
+    } while (isASCIIHexDigit(m_current));
 
-bool Lexer::isIdentPart(int c)
-{
-    return isASCIIAlphanumeric(c) || c == '$' || c == '_' || (!isASCII(c) && (category(c) & (Letter_Uppercase | Letter_Lowercase | Letter_Titlecase | Letter_Modifier | Letter_Other
-                            | Mark_NonSpacing | Mark_SpacingCombining | Number_DecimalDigit | Punctuation_Connector)));
-}
+    double dval = 0;
 
-static bool isDecimalDigit(int c)
-{
-    return isASCIIDigit(c);
-}
+    const char* end = m_buffer8.end();
+    for (const char* p = m_buffer8.data(); p < end; ++p) {
+        dval *= 16;
+        dval += toASCIIHexValue(*p);
+    }
+    if (dval >= mantissaOverflowLowerBound)
+        dval = parseIntOverflow(m_buffer8.data(), end - m_buffer8.data(), 16);
 
-bool Lexer::isHexDigit(int c)
-{
-    return isASCIIHexDigit(c); 
-}
+    m_buffer8.resize(0);
 
-bool Lexer::isOctalDigit(int c)
-{
-    return isASCIIOctalDigit(c);
+    lvalp->doubleValue = dval;
+    goto doneNumeric;
 }
 
-int Lexer::matchPunctuator(int& charPos, int c1, int c2, int c3, int c4)
-{
-    if (c1 == '>' && c2 == '>' && c3 == '>' && c4 == '=') {
-        shift(4);
-        return URSHIFTEQUAL;
-    }
-    if (c1 == '=' && c2 == '=' && c3 == '=') {
-        shift(3);
-        return STREQ;
-    }
-    if (c1 == '!' && c2 == '=' && c3 == '=') {
-        shift(3);
-        return STRNEQ;
-    }
-    if (c1 == '>' && c2 == '>' && c3 == '>') {
-        shift(3);
-        return URSHIFT;
-    }
-    if (c1 == '<' && c2 == '<' && c3 == '=') {
-        shift(3);
-        return LSHIFTEQUAL;
-    }
-    if (c1 == '>' && c2 == '>' && c3 == '=') {
-        shift(3);
-        return RSHIFTEQUAL;
-    }
-    if (c1 == '<' && c2 == '=') {
-        shift(2);
-        return LE;
-    }
-    if (c1 == '>' && c2 == '=') {
-        shift(2);
-        return GE;
-    }
-    if (c1 == '!' && c2 == '=') {
-        shift(2);
-        return NE;
-    }
-    if (c1 == '+' && c2 == '+') {
-        shift(2);
-        if (m_terminator)
-            return AUTOPLUSPLUS;
-        return PLUSPLUS;
-    }
-    if (c1 == '-' && c2 == '-') {
-        shift(2);
-        if (m_terminator)
-            return AUTOMINUSMINUS;
-        return MINUSMINUS;
-    }
-    if (c1 == '=' && c2 == '=') {
-        shift(2);
-        return EQEQ;
-    }
-    if (c1 == '+' && c2 == '=') {
-        shift(2);
-        return PLUSEQUAL;
-    }
-    if (c1 == '-' && c2 == '=') {
-        shift(2);
-        return MINUSEQUAL;
-    }
-    if (c1 == '*' && c2 == '=') {
-        shift(2);
-        return MULTEQUAL;
-    }
-    if (c1 == '/' && c2 == '=') {
-        shift(2);
-        return DIVEQUAL;
-    }
-    if (c1 == '&' && c2 == '=') {
-        shift(2);
-        return ANDEQUAL;
-    }
-    if (c1 == '^' && c2 == '=') {
-        shift(2);
-        return XOREQUAL;
-    }
-    if (c1 == '%' && c2 == '=') {
-        shift(2);
-        return MODEQUAL;
-    }
-    if (c1 == '|' && c2 == '=') {
-        shift(2);
-        return OREQUAL;
-    }
-    if (c1 == '<' && c2 == '<') {
-        shift(2);
-        return LSHIFT;
-    }
-    if (c1 == '>' && c2 == '>') {
-        shift(2);
-        return RSHIFT;
+startNumber:
+    record8(m_current);
+    shift1();
+    while (isASCIIDigit(m_current)) {
+        record8(m_current);
+        shift1();
     }
-    if (c1 == '&' && c2 == '&') {
-        shift(2);
-        return AND;
+    if (m_current == '.') {
+        record8('.');
+        shift1();
+        goto inNumberAfterDecimalPoint;
     }
-    if (c1 == '|' && c2 == '|') {
-        shift(2);
-        return OR;
+    if ((m_current | 0x20) == 'e') {
+        record8('e');
+        shift1();
+        goto inExponentIndicator;
     }
 
-    switch (c1) {
-        case '=':
-        case '>':
-        case '<':
-        case ',':
-        case '!':
-        case '~':
-        case '?':
-        case ':':
-        case '.':
-        case '+':
-        case '-':
-        case '*':
-        case '/':
-        case '&':
-        case '|':
-        case '^':
-        case '%':
-        case '(':
-        case ')':
-        case '[':
-        case ']':
-        case ';':
-            shift(1);
-            return static_cast<int>(c1);
-        case '{':
-            charPos = m_position - 4;
-            shift(1);
-            return OPENBRACE;
-        case '}':
-            charPos = m_position - 4;
-            shift(1);
-            return CLOSEBRACE;
-        default:
-            return -1;
-    }
-}
+    // Fall through into doneNumber.
 
-unsigned short Lexer::singleEscape(unsigned short c)
-{
-    switch (c) {
-        case 'b':
-            return 0x08;
-        case 't':
-            return 0x09;
-        case 'n':
-            return 0x0A;
-        case 'v':
-            return 0x0B;
-        case 'f':
-            return 0x0C;
-        case 'r':
-            return 0x0D;
-        case '"':
-            return 0x22;
-        case '\'':
-            return 0x27;
-        case '\\':
-            return 0x5C;
-        default:
-            return c;
-    }
-}
+doneNumber:
+    // Null-terminate string for strtod.
+    m_buffer8.append('\0');
+    lvalp->doubleValue = WTF::strtod(m_buffer8.data(), 0);
+    m_buffer8.resize(0);
 
-unsigned short Lexer::convertOctal(int c1, int c2, int c3)
-{
-    return static_cast<unsigned short>((c1 - '0') * 64 + (c2 - '0') * 8 + c3 - '0');
-}
+    // Fall through into doneNumeric.
 
-unsigned char Lexer::convertHex(int c)
-{
-    if (c >= '0' && c <= '9')
-        return static_cast<unsigned char>(c - '0');
-    if (c >= 'a' && c <= 'f')
-        return static_cast<unsigned char>(c - 'a' + 10);
-    return static_cast<unsigned char>(c - 'A' + 10);
-}
+doneNumeric:
+    // No identifiers allowed directly after numeric literal, e.g. "3in" is bad.
+    if (UNLIKELY(isIdentStart(m_current)))
+        goto returnError;
 
-unsigned char Lexer::convertHex(int c1, int c2)
-{
-    return ((convertHex(c1) << 4) + convertHex(c2));
-}
+    m_atLineStart = false;
+    m_delimited = false;
+    token = NUMBER;
+    goto returnToken;
 
-UChar Lexer::convertUnicode(int c1, int c2, int c3, int c4)
-{
-    unsigned char highByte = (convertHex(c1) << 4) + convertHex(c2);
-    unsigned char lowByte = (convertHex(c3) << 4) + convertHex(c4);
-    return (highByte << 8 | lowByte);
-}
+doneSemicolon:
+    token = ';';
+    m_delimited = true;
+    goto returnToken;
 
-void Lexer::record8(int c)
-{
-    ASSERT(c >= 0);
-    ASSERT(c <= 0xff);
-    m_buffer8.append(static_cast<char>(c));
+doneIdentifier:
+    m_atLineStart = false;
+    m_delimited = false;
+    lvalp->ident = makeIdentifier(m_buffer16.data(), m_buffer16.size());
+    m_buffer16.resize(0);
+    token = IDENT;
+    goto returnToken;
+
+doneIdentifierOrKeyword: {
+    m_atLineStart = false;
+    m_delimited = false;
+    m_buffer16.resize(0);
+    const HashEntry* entry = m_keywordTable.entry(m_globalData, *lvalp->ident);
+    token = entry ? entry->lexerValue() : IDENT;
+    goto returnToken;
 }
 
-void Lexer::record16(int c)
-{
-    ASSERT(c >= 0);
-    ASSERT(c <= USHRT_MAX);
-    record16(UChar(static_cast<unsigned short>(c)));
+doneString:
+    // Atomize constant strings in case they're later used in property lookup.
+    shift1();
+    m_atLineStart = false;
+    m_delimited = false;
+    lvalp->ident = makeIdentifier(m_buffer16.data(), m_buffer16.size());
+    m_buffer16.resize(0);
+    token = STRING;
+
+    // Fall through into returnToken.
+
+returnToken: {
+    int lineNumber = m_lineNumber;
+    llocp->first_line = lineNumber;
+    llocp->last_line = lineNumber;
+    llocp->first_column = startOffset;
+    llocp->last_column = currentOffset();
+
+    m_lastToken = token;
+    return token;
 }
 
-void Lexer::record16(UChar c)
-{
-    m_buffer16.append(c);
+returnError:
+    m_error = true;
+    return -1;
 }
 
 bool Lexer::scanRegExp()
 {
-    m_buffer16.clear();
+    ASSERT(m_buffer16.isEmpty());
+
     bool lastWasEscape = false;
     bool inBrackets = false;
 
-    while (1) {
-        if (isLineTerminator() || m_current == -1)
+    while (true) {
+        if (isLineTerminator(m_current) || m_current == -1)
             return false;
-        else if (m_current != '/' || lastWasEscape == true || inBrackets == true) {
+        if (m_current != '/' || lastWasEscape || inBrackets) {
             // keep track of '[' and ']'
             if (!lastWasEscape) {
-                if ( m_current == '[' && !inBrackets )
+                if (m_current == '[' && !inBrackets)
                     inBrackets = true;
-                if ( m_current == ']' && inBrackets )
+                if (m_current == ']' && inBrackets)
                     inBrackets = false;
             }
             record16(m_current);
-            lastWasEscape =
-            !lastWasEscape && (m_current == '\\');
+            lastWasEscape = !lastWasEscape && m_current == '\\';
         } else { // end of regexp
             m_pattern = UString(m_buffer16);
-            m_buffer16.clear();
-            shift(1);
+            m_buffer16.resize(0);
+            shift1();
             break;
         }
-        shift(1);
+        shift1();
     }
 
     while (isIdentPart(m_current)) {
         record16(m_current);
-        shift(1);
+        shift1();
     }
     m_flags = UString(m_buffer16);
+    m_buffer16.resize(0);
 
     return true;
 }
@@ -882,19 +950,42 @@ bool Lexer::scanRegExp()
 void Lexer::clear()
 {
     m_identifiers.clear();
+    m_codeWithoutBOMs.clear();
 
     Vector<char> newBuffer8;
-    newBuffer8.reserveCapacity(initialReadBufferCapacity);
+    newBuffer8.reserveInitialCapacity(initialReadBufferCapacity);
     m_buffer8.swap(newBuffer8);
 
     Vector<UChar> newBuffer16;
-    newBuffer16.reserveCapacity(initialReadBufferCapacity);
+    newBuffer16.reserveInitialCapacity(initialReadBufferCapacity);
     m_buffer16.swap(newBuffer16);
 
     m_isReparsing = false;
 
-    m_pattern = 0;
-    m_flags = 0;
+    m_pattern = UString();
+    m_flags = UString();
+}
+
+SourceCode Lexer::sourceCode(int openBrace, int closeBrace, int firstLine)
+{
+    if (m_codeWithoutBOMs.isEmpty())
+        return SourceCode(m_source->provider(), openBrace, closeBrace + 1, firstLine);
+
+    const UChar* data = m_source->provider()->data();
+
+    ASSERT(openBrace < closeBrace);
+
+    int numBOMsBeforeOpenBrace = 0;
+    int numBOMsBetweenBraces = 0;
+
+    int i;
+    for (i = m_source->startOffset(); i < openBrace; ++i)
+        numBOMsBeforeOpenBrace += data[i] == byteOrderMark;
+    for (; i < closeBrace; ++i)
+        numBOMsBetweenBraces += data[i] == byteOrderMark;
+
+    return SourceCode(m_source->provider(), openBrace + numBOMsBeforeOpenBrace,
+        closeBrace + numBOMsBeforeOpenBrace + numBOMsBetweenBraces + 1, firstLine);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.h b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.h
index afcf09f..0e1b618 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Lexer.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2002, 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -22,11 +22,12 @@
 #ifndef Lexer_h
 #define Lexer_h
 
-#include "Identifier.h"
 #include "Lookup.h"
-#include "SegmentedVector.h"
 #include "SourceCode.h"
+#include <wtf/ASCIICType.h>
+#include <wtf/SegmentedVector.h>
 #include <wtf/Vector.h>
+#include <wtf/unicode/Unicode.h>
 
 namespace JSC {
 
@@ -34,115 +35,71 @@ namespace JSC {
 
     class Lexer : Noncopyable {
     public:
+        // Character manipulation functions.
+        static bool isWhiteSpace(int character);
+        static bool isLineTerminator(int character);
+        static unsigned char convertHex(int c1, int c2);
+        static UChar convertUnicode(int c1, int c2, int c3, int c4);
+
+        // Functions to set up parsing.
         void setCode(const SourceCode&);
         void setIsReparsing() { m_isReparsing = true; }
-        int lex(void* lvalp, void* llocp);
-
-        int lineNo() const { return yylineno; }
 
+        // Functions for the parser itself.
+        int lex(void* lvalp, void* llocp);
+        int lineNumber() const { return m_lineNumber; }
         bool prevTerminator() const { return m_terminator; }
-
-        enum State {
-            Start,
-            IdentifierOrKeyword,
-            Identifier,
-            InIdentifierOrKeyword,
-            InIdentifier,
-            InIdentifierStartUnicodeEscapeStart,
-            InIdentifierStartUnicodeEscape,
-            InIdentifierPartUnicodeEscapeStart,
-            InIdentifierPartUnicodeEscape,
-            InSingleLineComment,
-            InMultiLineComment,
-            InNum,
-            InNum0,
-            InHex,
-            InOctal,
-            InDecimal,
-            InExponentIndicator,
-            InExponent,
-            Hex,
-            Octal,
-            Number,
-            String,
-            Eof,
-            InString,
-            InEscapeSequence,
-            InHexEscape,
-            InUnicodeEscape,
-            Other,
-            Bad
-        };
-
+        SourceCode sourceCode(int openBrace, int closeBrace, int firstLine);
         bool scanRegExp();
         const UString& pattern() const { return m_pattern; }
         const UString& flags() const { return m_flags; }
 
-        static unsigned char convertHex(int);
-        static unsigned char convertHex(int c1, int c2);
-        static UChar convertUnicode(int c1, int c2, int c3, int c4);
-        static bool isIdentStart(int);
-        static bool isIdentPart(int);
-        static bool isHexDigit(int);
-
+        // Functions for use after parsing.
         bool sawError() const { return m_error; }
-
         void clear();
-        SourceCode sourceCode(int openBrace, int closeBrace, int firstLine) { return SourceCode(m_source->provider(), openBrace, closeBrace + 1, firstLine); }
 
     private:
         friend class JSGlobalData;
+
         Lexer(JSGlobalData*);
         ~Lexer();
 
-        void setDone(State);
-        void shift(unsigned int p);
-        void nextLine();
-        int lookupKeyword(const char *);
-
-        bool isWhiteSpace() const;
-        bool isLineTerminator();
-        static bool isOctalDigit(int);
-
-        int matchPunctuator(int& charPos, int c1, int c2, int c3, int c4);
-        static unsigned short singleEscape(unsigned short);
-        static unsigned short convertOctal(int c1, int c2, int c3);
+        void shift1();
+        void shift2();
+        void shift3();
+        void shift4();
+        void shiftLineTerminator();
 
         void record8(int);
         void record16(int);
         void record16(UChar);
 
-        JSC::Identifier* makeIdentifier(const Vector<UChar>& buffer)
-        {
-            m_identifiers.append(JSC::Identifier(m_globalData, buffer.data(), buffer.size()));
-            return &m_identifiers.last();
-        }
+        void copyCodeWithoutBOMs();
+
+        int currentOffset() const;
+        const UChar* currentCharacter() const;
+
+        JSC::Identifier* makeIdentifier(const UChar* buffer, size_t length);
+
+        bool lastTokenWasRestrKeyword() const;
 
         static const size_t initialReadBufferCapacity = 32;
         static const size_t initialIdentifierTableCapacity = 64;
 
-        int yylineno;
-        int yycolumn;
+        int m_lineNumber;
 
-        bool m_done;
         Vector<char> m_buffer8;
         Vector<UChar> m_buffer16;
         bool m_terminator;
-        bool m_restrKeyword;
         bool m_delimited; // encountered delimiter like "'" and "}" on last run
-        bool m_skipLF;
-        bool m_skipCR;
-        bool m_eatNextIdentifier;
-        int m_stackToken;
         int m_lastToken;
 
-        State m_state;
-        unsigned int m_position;
         const SourceCode* m_source;
         const UChar* m_code;
-        unsigned int m_length;
+        const UChar* m_codeStart;
+        const UChar* m_codeEnd;
         bool m_isReparsing;
-        int m_atLineStart;
+        bool m_atLineStart;
         bool m_error;
 
         // current and following unicode characters (int to allow for -1 for end-of-file marker)
@@ -151,21 +108,38 @@ namespace JSC {
         int m_next2;
         int m_next3;
         
-        int m_currentOffset;
-        int m_nextOffset1;
-        int m_nextOffset2;
-        int m_nextOffset3;
-        
-        SegmentedVector<JSC::Identifier, initialIdentifierTableCapacity> m_identifiers;
+        WTF::SegmentedVector<JSC::Identifier, initialIdentifierTableCapacity> m_identifiers;
 
         JSGlobalData* m_globalData;
 
         UString m_pattern;
         UString m_flags;
 
-        const HashTable m_mainTable;
+        const HashTable m_keywordTable;
+
+        Vector<UChar> m_codeWithoutBOMs;
     };
 
+    inline bool Lexer::isWhiteSpace(int ch)
+    {
+        return isASCII(ch) ? (ch == ' ' || ch == '\t' || ch == 0xB || ch == 0xC) : WTF::Unicode::isSeparatorSpace(ch);
+    }
+
+    inline bool Lexer::isLineTerminator(int ch)
+    {
+        return ch == '\r' || ch == '\n' || (ch & ~1) == 0x2028;
+    }
+
+    inline unsigned char Lexer::convertHex(int c1, int c2)
+    {
+        return (toASCIIHexValue(c1) << 4) | toASCIIHexValue(c2);
+    }
+
+    inline UChar Lexer::convertUnicode(int c1, int c2, int c3, int c4)
+    {
+        return (convertHex(c1, c2) << 8) | convertHex(c3, c4);
+    }
+
 } // namespace JSC
 
 #endif // Lexer_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/NodeConstructors.h b/src/3rdparty/webkit/JavaScriptCore/parser/NodeConstructors.h
new file mode 100644
index 0000000..d17da69
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/NodeConstructors.h
@@ -0,0 +1,911 @@
+/*
+ *  Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef NodeConstructors_h
+#define NodeConstructors_h
+
+#include "Nodes.h"
+#include "Lexer.h"
+#include "Parser.h"
+
+namespace JSC {
+
+    inline void* ParserArenaDeletable::operator new(size_t size, JSGlobalData* globalData)
+    {
+        ParserArenaDeletable* deletable = static_cast<ParserArenaDeletable*>(fastMalloc(size));
+        globalData->parser->arena().deleteWithArena(deletable);
+        return deletable;
+    }
+
+    inline void* ParserArenaDeletable::operator new(size_t size)
+    {
+        return fastMalloc(size);
+    }
+
+    inline ParserArenaRefCounted::ParserArenaRefCounted(JSGlobalData* globalData)
+    {
+        globalData->parser->arena().derefWithArena(adoptRef(this));
+    }
+
+    inline Node::Node(JSGlobalData* globalData)
+        : m_line(globalData->lexer->lineNumber())
+    {
+    }
+
+    inline ExpressionNode::ExpressionNode(JSGlobalData* globalData, ResultType resultType)
+        : Node(globalData)
+        , m_resultType(resultType)
+    {
+    }
+
+    inline StatementNode::StatementNode(JSGlobalData* globalData)
+        : Node(globalData)
+        , m_lastLine(-1)
+    {
+    }
+
+    inline NullNode::NullNode(JSGlobalData* globalData)
+        : ExpressionNode(globalData, ResultType::nullType())
+    {
+    }
+
+    inline BooleanNode::BooleanNode(JSGlobalData* globalData, bool value)
+        : ExpressionNode(globalData, ResultType::booleanType())
+        , m_value(value)
+    {
+    }
+
+    inline NumberNode::NumberNode(JSGlobalData* globalData, double v)
+        : ExpressionNode(globalData, ResultType::numberType())
+        , m_double(v)
+    {
+    }
+
+    inline StringNode::StringNode(JSGlobalData* globalData, const Identifier& v)
+        : ExpressionNode(globalData, ResultType::stringType())
+        , m_value(v)
+    {
+    }
+
+    inline RegExpNode::RegExpNode(JSGlobalData* globalData, const UString& pattern, const UString& flags)
+        : ExpressionNode(globalData)
+        , m_pattern(pattern)
+        , m_flags(flags)
+    {
+    }
+
+    inline ThisNode::ThisNode(JSGlobalData* globalData)
+        : ExpressionNode(globalData)
+    {
+    }
+
+    inline ResolveNode::ResolveNode(JSGlobalData* globalData, const Identifier& ident, int startOffset)
+        : ExpressionNode(globalData)
+        , m_ident(ident)
+        , m_startOffset(startOffset)
+    {
+    }
+
+    inline ElementNode::ElementNode(JSGlobalData*, int elision, ExpressionNode* node)
+        : m_next(0)
+        , m_elision(elision)
+        , m_node(node)
+    {
+    }
+
+    inline ElementNode::ElementNode(JSGlobalData*, ElementNode* l, int elision, ExpressionNode* node)
+        : m_next(0)
+        , m_elision(elision)
+        , m_node(node)
+    {
+        l->m_next = this;
+    }
+
+    inline ArrayNode::ArrayNode(JSGlobalData* globalData, int elision)
+        : ExpressionNode(globalData)
+        , m_element(0)
+        , m_elision(elision)
+        , m_optional(true)
+    {
+    }
+
+    inline ArrayNode::ArrayNode(JSGlobalData* globalData, ElementNode* element)
+        : ExpressionNode(globalData)
+        , m_element(element)
+        , m_elision(0)
+        , m_optional(false)
+    {
+    }
+
+    inline ArrayNode::ArrayNode(JSGlobalData* globalData, int elision, ElementNode* element)
+        : ExpressionNode(globalData)
+        , m_element(element)
+        , m_elision(elision)
+        , m_optional(true)
+    {
+    }
+
+    inline PropertyNode::PropertyNode(JSGlobalData*, const Identifier& name, ExpressionNode* assign, Type type)
+        : m_name(name)
+        , m_assign(assign)
+        , m_type(type)
+    {
+    }
+
+    inline PropertyListNode::PropertyListNode(JSGlobalData* globalData, PropertyNode* node)
+        : Node(globalData)
+        , m_node(node)
+        , m_next(0)
+    {
+    }
+
+    inline PropertyListNode::PropertyListNode(JSGlobalData* globalData, PropertyNode* node, PropertyListNode* list)
+        : Node(globalData)
+        , m_node(node)
+        , m_next(0)
+    {
+        list->m_next = this;
+    }
+
+    inline ObjectLiteralNode::ObjectLiteralNode(JSGlobalData* globalData)
+        : ExpressionNode(globalData)
+        , m_list(0)
+    {
+    }
+
+    inline ObjectLiteralNode::ObjectLiteralNode(JSGlobalData* globalData, PropertyListNode* list)
+        : ExpressionNode(globalData)
+        , m_list(list)
+    {
+    }
+
+    inline BracketAccessorNode::BracketAccessorNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, bool subscriptHasAssignments)
+        : ExpressionNode(globalData)
+        , m_base(base)
+        , m_subscript(subscript)
+        , m_subscriptHasAssignments(subscriptHasAssignments)
+    {
+    }
+
+    inline DotAccessorNode::DotAccessorNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident)
+        : ExpressionNode(globalData)
+        , m_base(base)
+        , m_ident(ident)
+    {
+    }
+
+    inline ArgumentListNode::ArgumentListNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : Node(globalData)
+        , m_next(0)
+        , m_expr(expr)
+    {
+    }
+
+    inline ArgumentListNode::ArgumentListNode(JSGlobalData* globalData, ArgumentListNode* listNode, ExpressionNode* expr)
+        : Node(globalData)
+        , m_next(0)
+        , m_expr(expr)
+    {
+        listNode->m_next = this;
+    }
+
+    inline ArgumentsNode::ArgumentsNode(JSGlobalData*)
+        : m_listNode(0)
+    {
+    }
+
+    inline ArgumentsNode::ArgumentsNode(JSGlobalData*, ArgumentListNode* listNode)
+        : m_listNode(listNode)
+    {
+    }
+
+    inline NewExprNode::NewExprNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : ExpressionNode(globalData)
+        , m_expr(expr)
+        , m_args(0)
+    {
+    }
+
+    inline NewExprNode::NewExprNode(JSGlobalData* globalData, ExpressionNode* expr, ArgumentsNode* args)
+        : ExpressionNode(globalData)
+        , m_expr(expr)
+        , m_args(args)
+    {
+    }
+
+    inline EvalFunctionCallNode::EvalFunctionCallNode(JSGlobalData* globalData, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_args(args)
+    {
+    }
+
+    inline FunctionCallValueNode::FunctionCallValueNode(JSGlobalData* globalData, ExpressionNode* expr, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_expr(expr)
+        , m_args(args)
+    {
+    }
+
+    inline FunctionCallResolveNode::FunctionCallResolveNode(JSGlobalData* globalData, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_ident(ident)
+        , m_args(args)
+    {
+    }
+
+    inline FunctionCallBracketNode::FunctionCallBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_subscript(subscript)
+        , m_args(args)
+    {
+    }
+
+    inline FunctionCallDotNode::FunctionCallDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_ident(ident)
+        , m_args(args)
+    {
+    }
+
+    inline CallFunctionCallDotNode::CallFunctionCallDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : FunctionCallDotNode(globalData, base, ident, args, divot, startOffset, endOffset)
+    {
+    }
+
+    inline ApplyFunctionCallDotNode::ApplyFunctionCallDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : FunctionCallDotNode(globalData, base, ident, args, divot, startOffset, endOffset)
+    {
+    }
+
+    inline PrePostResolveNode::PrePostResolveNode(JSGlobalData* globalData, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData, ResultType::numberType()) // could be reusable for pre?
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_ident(ident)
+    {
+    }
+
+    inline PostfixResolveNode::PostfixResolveNode(JSGlobalData* globalData, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : PrePostResolveNode(globalData, ident, divot, startOffset, endOffset)
+        , m_operator(oper)
+    {
+    }
+
+    inline PostfixBracketNode::PostfixBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_subscript(subscript)
+        , m_operator(oper)
+    {
+    }
+
+    inline PostfixDotNode::PostfixDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_ident(ident)
+        , m_operator(oper)
+    {
+    }
+
+    inline PostfixErrorNode::PostfixErrorNode(JSGlobalData* globalData, ExpressionNode* expr, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableSubExpressionData(divot, startOffset, endOffset)
+        , m_expr(expr)
+        , m_operator(oper)
+    {
+    }
+
+    inline DeleteResolveNode::DeleteResolveNode(JSGlobalData* globalData, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_ident(ident)
+    {
+    }
+
+    inline DeleteBracketNode::DeleteBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_subscript(subscript)
+    {
+    }
+
+    inline DeleteDotNode::DeleteDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_ident(ident)
+    {
+    }
+
+    inline DeleteValueNode::DeleteValueNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : ExpressionNode(globalData)
+        , m_expr(expr)
+    {
+    }
+
+    inline VoidNode::VoidNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : ExpressionNode(globalData)
+        , m_expr(expr)
+    {
+    }
+
+    inline TypeOfResolveNode::TypeOfResolveNode(JSGlobalData* globalData, const Identifier& ident)
+        : ExpressionNode(globalData, ResultType::stringType())
+        , m_ident(ident)
+    {
+    }
+
+    inline TypeOfValueNode::TypeOfValueNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : ExpressionNode(globalData, ResultType::stringType())
+        , m_expr(expr)
+    {
+    }
+
+    inline PrefixResolveNode::PrefixResolveNode(JSGlobalData* globalData, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : PrePostResolveNode(globalData, ident, divot, startOffset, endOffset)
+        , m_operator(oper)
+    {
+    }
+
+    inline PrefixBracketNode::PrefixBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowablePrefixedSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_subscript(subscript)
+        , m_operator(oper)
+    {
+    }
+
+    inline PrefixDotNode::PrefixDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowablePrefixedSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_ident(ident)
+        , m_operator(oper)
+    {
+    }
+
+    inline PrefixErrorNode::PrefixErrorNode(JSGlobalData* globalData, ExpressionNode* expr, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_expr(expr)
+        , m_operator(oper)
+    {
+    }
+
+    inline UnaryOpNode::UnaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr, OpcodeID opcodeID)
+        : ExpressionNode(globalData, type)
+        , m_expr(expr)
+        , m_opcodeID(opcodeID)
+    {
+    }
+
+    inline UnaryPlusNode::UnaryPlusNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : UnaryOpNode(globalData, ResultType::numberType(), expr, op_to_jsnumber)
+    {
+    }
+
+    inline NegateNode::NegateNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : UnaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr, op_negate)
+    {
+    }
+
+    inline BitwiseNotNode::BitwiseNotNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : UnaryOpNode(globalData, ResultType::forBitOp(), expr, op_bitnot)
+    {
+    }
+
+    inline LogicalNotNode::LogicalNotNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : UnaryOpNode(globalData, ResultType::booleanType(), expr, op_not)
+    {
+    }
+
+    inline BinaryOpNode::BinaryOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : ExpressionNode(globalData)
+        , m_expr1(expr1)
+        , m_expr2(expr2)
+        , m_opcodeID(opcodeID)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline BinaryOpNode::BinaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : ExpressionNode(globalData, type)
+        , m_expr1(expr1)
+        , m_expr2(expr2)
+        , m_opcodeID(opcodeID)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline ReverseBinaryOpNode::ReverseBinaryOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : BinaryOpNode(globalData, expr1, expr2, opcodeID, rightHasAssignments)
+    {
+    }
+
+    inline ReverseBinaryOpNode::ReverseBinaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : BinaryOpNode(globalData, type, expr1, expr2, opcodeID, rightHasAssignments)
+    {
+    }
+
+    inline MultNode::MultNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr1, expr2, op_mul, rightHasAssignments)
+    {
+    }
+
+    inline DivNode::DivNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr1, expr2, op_div, rightHasAssignments)
+    {
+    }
+
+
+    inline ModNode::ModNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr1, expr2, op_mod, rightHasAssignments)
+    {
+    }
+
+    inline AddNode::AddNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::forAdd(expr1->resultDescriptor(), expr2->resultDescriptor()), expr1, expr2, op_add, rightHasAssignments)
+    {
+    }
+
+    inline SubNode::SubNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr1, expr2, op_sub, rightHasAssignments)
+    {
+    }
+
+    inline LeftShiftNode::LeftShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::forBitOp(), expr1, expr2, op_lshift, rightHasAssignments)
+    {
+    }
+
+    inline RightShiftNode::RightShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::forBitOp(), expr1, expr2, op_rshift, rightHasAssignments)
+    {
+    }
+
+    inline UnsignedRightShiftNode::UnsignedRightShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::numberTypeCanReuse(), expr1, expr2, op_urshift, rightHasAssignments)
+    {
+    }
+
+    inline LessNode::LessNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_less, rightHasAssignments)
+    {
+    }
+
+    inline GreaterNode::GreaterNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : ReverseBinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_less, rightHasAssignments)
+    {
+    }
+
+    inline LessEqNode::LessEqNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_lesseq, rightHasAssignments)
+    {
+    }
+
+    inline GreaterEqNode::GreaterEqNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : ReverseBinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_lesseq, rightHasAssignments)
+    {
+    }
+
+    inline ThrowableBinaryOpNode::ThrowableBinaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : BinaryOpNode(globalData, type, expr1, expr2, opcodeID, rightHasAssignments)
+    {
+    }
+
+    inline ThrowableBinaryOpNode::ThrowableBinaryOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID opcodeID, bool rightHasAssignments)
+        : BinaryOpNode(globalData, expr1, expr2, opcodeID, rightHasAssignments)
+    {
+    }
+
+    inline InstanceOfNode::InstanceOfNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : ThrowableBinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_instanceof, rightHasAssignments)
+    {
+    }
+
+    inline InNode::InNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : ThrowableBinaryOpNode(globalData, expr1, expr2, op_in, rightHasAssignments)
+    {
+    }
+
+    inline EqualNode::EqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_eq, rightHasAssignments)
+    {
+    }
+
+    inline NotEqualNode::NotEqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_neq, rightHasAssignments)
+    {
+    }
+
+    inline StrictEqualNode::StrictEqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_stricteq, rightHasAssignments)
+    {
+    }
+
+    inline NotStrictEqualNode::NotStrictEqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::booleanType(), expr1, expr2, op_nstricteq, rightHasAssignments)
+    {
+    }
+
+    inline BitAndNode::BitAndNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::forBitOp(), expr1, expr2, op_bitand, rightHasAssignments)
+    {
+    }
+
+    inline BitOrNode::BitOrNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::forBitOp(), expr1, expr2, op_bitor, rightHasAssignments)
+    {
+    }
+
+    inline BitXOrNode::BitXOrNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
+        : BinaryOpNode(globalData, ResultType::forBitOp(), expr1, expr2, op_bitxor, rightHasAssignments)
+    {
+    }
+
+    inline LogicalOpNode::LogicalOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, LogicalOperator oper)
+        : ExpressionNode(globalData, ResultType::booleanType())
+        , m_expr1(expr1)
+        , m_expr2(expr2)
+        , m_operator(oper)
+    {
+    }
+
+    inline ConditionalNode::ConditionalNode(JSGlobalData* globalData, ExpressionNode* logical, ExpressionNode* expr1, ExpressionNode* expr2)
+        : ExpressionNode(globalData)
+        , m_logical(logical)
+        , m_expr1(expr1)
+        , m_expr2(expr2)
+    {
+    }
+
+    inline ReadModifyResolveNode::ReadModifyResolveNode(JSGlobalData* globalData, const Identifier& ident, Operator oper, ExpressionNode*  right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_ident(ident)
+        , m_right(right)
+        , m_operator(oper)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline AssignResolveNode::AssignResolveNode(JSGlobalData* globalData, const Identifier& ident, ExpressionNode* right, bool rightHasAssignments)
+        : ExpressionNode(globalData)
+        , m_ident(ident)
+        , m_right(right)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline ReadModifyBracketNode::ReadModifyBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, Operator oper, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_subscript(subscript)
+        , m_right(right)
+        , m_operator(oper)
+        , m_subscriptHasAssignments(subscriptHasAssignments)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline AssignBracketNode::AssignBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_subscript(subscript)
+        , m_right(right)
+        , m_subscriptHasAssignments(subscriptHasAssignments)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline AssignDotNode::AssignDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_ident(ident)
+        , m_right(right)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline ReadModifyDotNode::ReadModifyDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, Operator oper, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableSubExpressionData(divot, startOffset, endOffset)
+        , m_base(base)
+        , m_ident(ident)
+        , m_right(right)
+        , m_operator(oper)
+        , m_rightHasAssignments(rightHasAssignments)
+    {
+    }
+
+    inline AssignErrorNode::AssignErrorNode(JSGlobalData* globalData, ExpressionNode* left, Operator oper, ExpressionNode* right, unsigned divot, unsigned startOffset, unsigned endOffset)
+        : ExpressionNode(globalData)
+        , ThrowableExpressionData(divot, startOffset, endOffset)
+        , m_left(left)
+        , m_operator(oper)
+        , m_right(right)
+    {
+    }
+
+    inline CommaNode::CommaNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2)
+        : ExpressionNode(globalData)
+    {
+        m_expressions.append(expr1);
+        m_expressions.append(expr2);
+    }
+
+    inline ConstStatementNode::ConstStatementNode(JSGlobalData* globalData, ConstDeclNode* next)
+        : StatementNode(globalData)
+        , m_next(next)
+    {
+    }
+
+    inline SourceElements::SourceElements(JSGlobalData*)
+    {
+    }
+
+    inline EmptyStatementNode::EmptyStatementNode(JSGlobalData* globalData)
+        : StatementNode(globalData)
+    {
+    }
+
+    inline DebuggerStatementNode::DebuggerStatementNode(JSGlobalData* globalData)
+        : StatementNode(globalData)
+    {
+    }
+    
+    inline ExprStatementNode::ExprStatementNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : StatementNode(globalData)
+        , m_expr(expr)
+    {
+    }
+
+    inline VarStatementNode::VarStatementNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : StatementNode(globalData)
+        , m_expr(expr)
+    {
+    }
+    
+    inline IfNode::IfNode(JSGlobalData* globalData, ExpressionNode* condition, StatementNode* ifBlock)
+        : StatementNode(globalData)
+        , m_condition(condition)
+        , m_ifBlock(ifBlock)
+    {
+    }
+
+    inline IfElseNode::IfElseNode(JSGlobalData* globalData, ExpressionNode* condition, StatementNode* ifBlock, StatementNode* elseBlock)
+        : IfNode(globalData, condition, ifBlock)
+        , m_elseBlock(elseBlock)
+    {
+    }
+
+    inline DoWhileNode::DoWhileNode(JSGlobalData* globalData, StatementNode* statement, ExpressionNode* expr)
+        : StatementNode(globalData)
+        , m_statement(statement)
+        , m_expr(expr)
+    {
+    }
+
+    inline WhileNode::WhileNode(JSGlobalData* globalData, ExpressionNode* expr, StatementNode* statement)
+        : StatementNode(globalData)
+        , m_expr(expr)
+        , m_statement(statement)
+    {
+    }
+
+    inline ForNode::ForNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode* statement, bool expr1WasVarDecl)
+        : StatementNode(globalData)
+        , m_expr1(expr1)
+        , m_expr2(expr2)
+        , m_expr3(expr3)
+        , m_statement(statement)
+        , m_expr1WasVarDecl(expr1 && expr1WasVarDecl)
+    {
+        ASSERT(statement);
+    }
+
+    inline ContinueNode::ContinueNode(JSGlobalData* globalData)
+        : StatementNode(globalData)
+    {
+    }
+
+    inline ContinueNode::ContinueNode(JSGlobalData* globalData, const Identifier& ident)
+        : StatementNode(globalData)
+        , m_ident(ident)
+    {
+    }
+    
+    inline BreakNode::BreakNode(JSGlobalData* globalData)
+        : StatementNode(globalData)
+    {
+    }
+
+    inline BreakNode::BreakNode(JSGlobalData* globalData, const Identifier& ident)
+        : StatementNode(globalData)
+        , m_ident(ident)
+    {
+    }
+    
+    inline ReturnNode::ReturnNode(JSGlobalData* globalData, ExpressionNode* value)
+        : StatementNode(globalData)
+        , m_value(value)
+    {
+    }
+
+    inline WithNode::WithNode(JSGlobalData* globalData, ExpressionNode* expr, StatementNode* statement, uint32_t divot, uint32_t expressionLength)
+        : StatementNode(globalData)
+        , m_expr(expr)
+        , m_statement(statement)
+        , m_divot(divot)
+        , m_expressionLength(expressionLength)
+    {
+    }
+
+    inline LabelNode::LabelNode(JSGlobalData* globalData, const Identifier& name, StatementNode* statement)
+        : StatementNode(globalData)
+        , m_name(name)
+        , m_statement(statement)
+    {
+    }
+
+    inline ThrowNode::ThrowNode(JSGlobalData* globalData, ExpressionNode* expr)
+        : StatementNode(globalData)
+        , m_expr(expr)
+    {
+    }
+
+    inline TryNode::TryNode(JSGlobalData* globalData, StatementNode* tryBlock, const Identifier& exceptionIdent, bool catchHasEval, StatementNode* catchBlock, StatementNode* finallyBlock)
+        : StatementNode(globalData)
+        , m_tryBlock(tryBlock)
+        , m_exceptionIdent(exceptionIdent)
+        , m_catchBlock(catchBlock)
+        , m_finallyBlock(finallyBlock)
+        , m_catchHasEval(catchHasEval)
+    {
+    }
+
+    inline ParameterNode::ParameterNode(JSGlobalData*, const Identifier& ident)
+        : m_ident(ident)
+        , m_next(0)
+    {
+    }
+
+    inline ParameterNode::ParameterNode(JSGlobalData*, ParameterNode* l, const Identifier& ident)
+        : m_ident(ident)
+        , m_next(0)
+    {
+        l->m_next = this;
+    }
+
+    inline FuncExprNode::FuncExprNode(JSGlobalData* globalData, const Identifier& ident, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter)
+        : ExpressionNode(globalData)
+        , ParserArenaRefCounted(globalData)
+        , m_ident(ident)
+        , m_body(body)
+    {
+        m_body->finishParsing(source, parameter);
+    }
+
+    inline FuncDeclNode::FuncDeclNode(JSGlobalData* globalData, const Identifier& ident, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter)
+        : StatementNode(globalData)
+        , ParserArenaRefCounted(globalData)
+        , m_ident(ident)
+        , m_body(body)
+    {
+        m_body->finishParsing(source, parameter);
+    }
+
+    inline CaseClauseNode::CaseClauseNode(JSGlobalData*, ExpressionNode* expr)
+        : m_expr(expr)
+    {
+    }
+
+    inline CaseClauseNode::CaseClauseNode(JSGlobalData*, ExpressionNode* expr, SourceElements* children)
+        : m_expr(expr)
+    {
+        if (children)
+            children->releaseContentsIntoVector(m_children);
+    }
+
+    inline ClauseListNode::ClauseListNode(JSGlobalData*, CaseClauseNode* clause)
+        : m_clause(clause)
+        , m_next(0)
+    {
+    }
+
+    inline ClauseListNode::ClauseListNode(JSGlobalData*, ClauseListNode* clauseList, CaseClauseNode* clause)
+        : m_clause(clause)
+        , m_next(0)
+    {
+        clauseList->m_next = this;
+    }
+
+    inline CaseBlockNode::CaseBlockNode(JSGlobalData*, ClauseListNode* list1, CaseClauseNode* defaultClause, ClauseListNode* list2)
+        : m_list1(list1)
+        , m_defaultClause(defaultClause)
+        , m_list2(list2)
+    {
+    }
+
+    inline SwitchNode::SwitchNode(JSGlobalData* globalData, ExpressionNode* expr, CaseBlockNode* block)
+        : StatementNode(globalData)
+        , m_expr(expr)
+        , m_block(block)
+    {
+    }
+
+    inline ConstDeclNode::ConstDeclNode(JSGlobalData* globalData, const Identifier& ident, ExpressionNode* init)
+        : ExpressionNode(globalData)
+        , m_ident(ident)
+        , m_next(0)
+        , m_init(init)
+    {
+    }
+
+    inline BlockNode::BlockNode(JSGlobalData* globalData, SourceElements* children)
+        : StatementNode(globalData)
+    {
+        if (children)
+            children->releaseContentsIntoVector(m_children);
+    }
+
+    inline ForInNode::ForInNode(JSGlobalData* globalData, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement)
+        : StatementNode(globalData)
+        , m_init(0)
+        , m_lexpr(l)
+        , m_expr(expr)
+        , m_statement(statement)
+        , m_identIsVarDecl(false)
+    {
+    }
+
+    inline ForInNode::ForInNode(JSGlobalData* globalData, const Identifier& ident, ExpressionNode* in, ExpressionNode* expr, StatementNode* statement, int divot, int startOffset, int endOffset)
+        : StatementNode(globalData)
+        , m_ident(ident)
+        , m_init(0)
+        , m_lexpr(new (globalData) ResolveNode(globalData, ident, divot - startOffset))
+        , m_expr(expr)
+        , m_statement(statement)
+        , m_identIsVarDecl(true)
+    {
+        if (in) {
+            AssignResolveNode* node = new (globalData) AssignResolveNode(globalData, ident, in, true);
+            node->setExceptionSourceCode(divot, divot - startOffset, endOffset - divot);
+            m_init = node;
+        }
+        // for( var foo = bar in baz )
+    }
+
+} // namespace JSC
+
+#endif // NodeConstructors_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/NodeInfo.h b/src/3rdparty/webkit/JavaScriptCore/parser/NodeInfo.h
index a518b23..7f4deff 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/NodeInfo.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/NodeInfo.h
@@ -43,8 +43,8 @@ namespace JSC {
     
     template <typename T> struct NodeDeclarationInfo {
         T m_node;
-        ParserRefCountedData<DeclarationStacks::VarStack>* m_varDeclarations;
-        ParserRefCountedData<DeclarationStacks::FunctionStack>* m_funcDeclarations;
+        ParserArenaData<DeclarationStacks::VarStack>* m_varDeclarations;
+        ParserArenaData<DeclarationStacks::FunctionStack>* m_funcDeclarations;
         CodeFeatures m_features;
         int m_numConstants;
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
index 201af28..ba6e1e0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.cpp
@@ -25,24 +25,23 @@
 
 #include "config.h"
 #include "Nodes.h"
+#include "NodeConstructors.h"
 
 #include "BytecodeGenerator.h"
 #include "CallFrame.h"
+#include "Debugger.h"
+#include "JIT.h"
+#include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "JSStaticScopeObject.h"
 #include "LabelScope.h"
+#include "Lexer.h"
+#include "Operations.h"
 #include "Parser.h"
 #include "PropertyNameArray.h"
 #include "RegExpObject.h"
 #include "SamplingTool.h"
-#include "Debugger.h"
-#include "Lexer.h"
-#include "Operations.h"
-#include <math.h>
 #include <wtf/Assertions.h>
-#include <wtf/HashCountedSet.h>
-#include <wtf/HashSet.h>
-#include <wtf/MathExtras.h>
 #include <wtf/RefCountedLeakCounter.h>
 #include <wtf/Threading.h>
 
@@ -50,173 +49,7 @@ using namespace WTF;
 
 namespace JSC {
 
-static void substitute(UString& string, const UString& substring) JSC_FAST_CALL;
-
-// ------------------------------ NodeReleaser --------------------------------
-
-class NodeReleaser : Noncopyable {
-public:
-    // Call this function inside the destructor of a class derived from Node.
-    // This will traverse the tree below this node, destroying all of those nodes,
-    // but without relying on recursion.
-    static void releaseAllNodes(ParserRefCounted* root);
-
-    // Call this on each node in a the releaseNodes virtual function.
-    // It gives the node to the NodeReleaser, which will then release the
-    // node later at the end of the releaseAllNodes process.
-    template <typename T> void release(RefPtr<T>& node) { if (node) adopt(node.release()); }
-    void release(RefPtr<FunctionBodyNode>& node) { if (node) adoptFunctionBodyNode(node); }
-
-private:
-    NodeReleaser() { }
-    ~NodeReleaser() { }
-
-    void adopt(PassRefPtr<ParserRefCounted>);
-    void adoptFunctionBodyNode(RefPtr<FunctionBodyNode>&);
-
-    typedef Vector<RefPtr<ParserRefCounted> > NodeReleaseVector;
-    OwnPtr<NodeReleaseVector> m_vector;
-};
-
-void NodeReleaser::releaseAllNodes(ParserRefCounted* root)
-{
-    ASSERT(root);
-    NodeReleaser releaser;
-    root->releaseNodes(releaser);
-    if (!releaser.m_vector)
-        return;
-    // Note: The call to release.m_vector->size() is intentionally inside
-    // the loop, since calls to releaseNodes are expected to increase the size.
-    for (size_t i = 0; i < releaser.m_vector->size(); ++i) {
-        ParserRefCounted* node = (*releaser.m_vector)[i].get();
-        if (node->hasOneRef())
-            node->releaseNodes(releaser);
-    }
-}
-
-void NodeReleaser::adopt(PassRefPtr<ParserRefCounted> node)
-{
-    ASSERT(node);
-    if (!node->hasOneRef())
-        return;
-    if (!m_vector)
-        m_vector.set(new NodeReleaseVector);
-    m_vector->append(node);
-}
-
-void NodeReleaser::adoptFunctionBodyNode(RefPtr<FunctionBodyNode>& functionBodyNode)
-{
-    // This sidesteps a problem where if you assign a PassRefPtr<FunctionBodyNode>
-    // to a PassRefPtr<Node> we leave the two reference counts (FunctionBodyNode
-    // and ParserRefCounted) unbalanced. It would be nice to fix this problem in
-    // a cleaner way -- perhaps we could remove the FunctionBodyNode reference
-    // count at some point.
-    RefPtr<Node> node = functionBodyNode;
-    functionBodyNode = 0;
-    adopt(node.release());
-}
-
-// ------------------------------ ParserRefCounted -----------------------------------------
-
-#ifndef NDEBUG
-static RefCountedLeakCounter parserRefCountedCounter("JSC::Node");
-#endif
-
-ParserRefCounted::ParserRefCounted(JSGlobalData* globalData)
-    : m_globalData(globalData)
-{
-#ifndef NDEBUG
-    parserRefCountedCounter.increment();
-#endif
-    if (!m_globalData->newParserObjects)
-        m_globalData->newParserObjects = new HashSet<ParserRefCounted*>;
-    m_globalData->newParserObjects->add(this);
-    ASSERT(m_globalData->newParserObjects->contains(this));
-}
-
-ParserRefCounted::~ParserRefCounted()
-{
-#ifndef NDEBUG
-    parserRefCountedCounter.decrement();
-#endif
-}
-
-void ParserRefCounted::releaseNodes(NodeReleaser&)
-{
-}
-
-void ParserRefCounted::ref()
-{
-    // bumping from 0 to 1 is just removing from the new nodes set
-    if (m_globalData->newParserObjects) {
-        HashSet<ParserRefCounted*>::iterator it = m_globalData->newParserObjects->find(this);
-        if (it != m_globalData->newParserObjects->end()) {
-            m_globalData->newParserObjects->remove(it);
-            ASSERT(!m_globalData->parserObjectExtraRefCounts || !m_globalData->parserObjectExtraRefCounts->contains(this));
-            return;
-        }
-    }
-
-    ASSERT(!m_globalData->newParserObjects || !m_globalData->newParserObjects->contains(this));
-
-    if (!m_globalData->parserObjectExtraRefCounts)
-        m_globalData->parserObjectExtraRefCounts = new HashCountedSet<ParserRefCounted*>;
-    m_globalData->parserObjectExtraRefCounts->add(this);
-}
-
-void ParserRefCounted::deref()
-{
-    ASSERT(!m_globalData->newParserObjects || !m_globalData->newParserObjects->contains(this));
-
-    if (!m_globalData->parserObjectExtraRefCounts) {
-        delete this;
-        return;
-    }
-
-    HashCountedSet<ParserRefCounted*>::iterator it = m_globalData->parserObjectExtraRefCounts->find(this);
-    if (it == m_globalData->parserObjectExtraRefCounts->end())
-        delete this;
-    else
-        m_globalData->parserObjectExtraRefCounts->remove(it);
-}
-
-bool ParserRefCounted::hasOneRef()
-{
-    if (m_globalData->newParserObjects && m_globalData->newParserObjects->contains(this)) {
-        ASSERT(!m_globalData->parserObjectExtraRefCounts || !m_globalData->parserObjectExtraRefCounts->contains(this));
-        return false;
-    }
-
-    ASSERT(!m_globalData->newParserObjects || !m_globalData->newParserObjects->contains(this));
-
-    if (!m_globalData->parserObjectExtraRefCounts)
-        return true;
-
-    return !m_globalData->parserObjectExtraRefCounts->contains(this);
-}
-
-void ParserRefCounted::deleteNewObjects(JSGlobalData* globalData)
-{
-    if (!globalData->newParserObjects)
-        return;
-
-#ifndef NDEBUG
-    HashSet<ParserRefCounted*>::iterator end = globalData->newParserObjects->end();
-    for (HashSet<ParserRefCounted*>::iterator it = globalData->newParserObjects->begin(); it != end; ++it)
-        ASSERT(!globalData->parserObjectExtraRefCounts || !globalData->parserObjectExtraRefCounts->contains(*it));
-#endif
-    deleteAllValues(*globalData->newParserObjects);
-    delete globalData->newParserObjects;
-    globalData->newParserObjects = 0;
-}
-
-// ------------------------------ Node --------------------------------
-
-Node::Node(JSGlobalData* globalData)
-    : ParserRefCounted(globalData)
-{
-    m_line = globalData->lexer->lineNo();
-}
+static void substitute(UString& string, const UString& substring);
 
 // ------------------------------ ThrowableExpressionData --------------------------------
 
@@ -247,14 +80,8 @@ RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator
     generator.emitThrow(exception);
     return exception;
 }
-    
-// ------------------------------ StatementNode --------------------------------
 
-StatementNode::StatementNode(JSGlobalData* globalData)
-    : Node(globalData)
-    , m_lastLine(-1)
-{
-}
+// ------------------------------ StatementNode --------------------------------
 
 void StatementNode::setLoc(int firstLine, int lastLine)
 {
@@ -264,11 +91,10 @@ void StatementNode::setLoc(int firstLine, int lastLine)
 
 // ------------------------------ SourceElements --------------------------------
 
-void SourceElements::append(PassRefPtr<StatementNode> statement)
+void SourceElements::append(StatementNode* statement)
 {
     if (statement->isEmptyStatement())
         return;
-
     m_statements.append(statement);
 }
 
@@ -348,47 +174,24 @@ RegisterID* ResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID*
     return generator.emitResolve(generator.finalDestination(dst), m_ident);
 }
 
-// ------------------------------ ElementNode ------------------------------------
-
-ElementNode::~ElementNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ElementNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_next);
-    releaser.release(m_node);
-}
-
 // ------------------------------ ArrayNode ------------------------------------
 
-ArrayNode::~ArrayNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ArrayNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_element);
-}
-
 RegisterID* ArrayNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     // FIXME: Should we put all of this code into emitNewArray?
 
     unsigned length = 0;
     ElementNode* firstPutElement;
-    for (firstPutElement = m_element.get(); firstPutElement; firstPutElement = firstPutElement->next()) {
+    for (firstPutElement = m_element; firstPutElement; firstPutElement = firstPutElement->next()) {
         if (firstPutElement->elision())
             break;
         ++length;
     }
 
     if (!firstPutElement && !m_elision)
-        return generator.emitNewArray(generator.finalDestination(dst), m_element.get());
+        return generator.emitNewArray(generator.finalDestination(dst), m_element);
 
-    RefPtr<RegisterID> array = generator.emitNewArray(generator.tempDestination(dst), m_element.get());
+    RefPtr<RegisterID> array = generator.emitNewArray(generator.tempDestination(dst), m_element);
 
     for (ElementNode* n = firstPutElement; n; n = n->next()) {
         RegisterID* value = generator.emitNode(n->value());
@@ -404,30 +207,35 @@ RegisterID* ArrayNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
     return generator.moveToDestinationIfNeeded(dst, array.get());
 }
 
-// ------------------------------ PropertyNode ----------------------------
-
-PropertyNode::~PropertyNode()
+bool ArrayNode::isSimpleArray() const
 {
-    NodeReleaser::releaseAllNodes(this);
+    if (m_elision || m_optional)
+        return false;
+    for (ElementNode* ptr = m_element; ptr; ptr = ptr->next()) {
+        if (ptr->elision())
+            return false;
+    }
+    return true;
 }
 
-void PropertyNode::releaseNodes(NodeReleaser& releaser)
+ArgumentListNode* ArrayNode::toArgumentList(JSGlobalData* globalData) const
 {
-    releaser.release(m_assign);
+    ASSERT(!m_elision && !m_optional);
+    ElementNode* ptr = m_element;
+    if (!ptr)
+        return 0;
+    ArgumentListNode* head = new (globalData) ArgumentListNode(globalData, ptr->value());
+    ArgumentListNode* tail = head;
+    ptr = ptr->next();
+    for (; ptr; ptr = ptr->next()) {
+        ASSERT(!ptr->elision());
+        tail = new (globalData) ArgumentListNode(globalData, tail, ptr->value());
+    }
+    return head;
 }
 
 // ------------------------------ ObjectLiteralNode ----------------------------
 
-ObjectLiteralNode::~ObjectLiteralNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ObjectLiteralNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_list);
-}
-
 RegisterID* ObjectLiteralNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
      if (!m_list) {
@@ -435,30 +243,19 @@ RegisterID* ObjectLiteralNode::emitBytecode(BytecodeGenerator& generator, Regist
              return 0;
          return generator.emitNewObject(generator.finalDestination(dst));
      }
-     return generator.emitNode(dst, m_list.get());
+     return generator.emitNode(dst, m_list);
 }
 
 // ------------------------------ PropertyListNode -----------------------------
 
-PropertyListNode::~PropertyListNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void PropertyListNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_node);
-    releaser.release(m_next);
-}
-
 RegisterID* PropertyListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     RefPtr<RegisterID> newObj = generator.tempDestination(dst);
     
     generator.emitNewObject(newObj.get());
     
-    for (PropertyListNode* p = this; p; p = p->m_next.get()) {
-        RegisterID* value = generator.emitNode(p->m_node->m_assign.get());
+    for (PropertyListNode* p = this; p; p = p->m_next) {
+        RegisterID* value = generator.emitNode(p->m_node->m_assign);
         
         switch (p->m_node->m_type) {
             case PropertyNode::Constant: {
@@ -483,152 +280,66 @@ RegisterID* PropertyListNode::emitBytecode(BytecodeGenerator& generator, Registe
 
 // ------------------------------ BracketAccessorNode --------------------------------
 
-BracketAccessorNode::~BracketAccessorNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void BracketAccessorNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_subscript);
-}
-
 RegisterID* BracketAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base.get(), m_subscriptHasAssignments, m_subscript->isPure(generator));
-    RegisterID* property = generator.emitNode(m_subscript.get());
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments, m_subscript->isPure(generator));
+    RegisterID* property = generator.emitNode(m_subscript);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     return generator.emitGetByVal(generator.finalDestination(dst), base.get(), property);
 }
 
 // ------------------------------ DotAccessorNode --------------------------------
 
-DotAccessorNode::~DotAccessorNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void DotAccessorNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-}
-
 RegisterID* DotAccessorNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RegisterID* base = generator.emitNode(m_base.get());
+    RegisterID* base = generator.emitNode(m_base);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     return generator.emitGetById(generator.finalDestination(dst), base, m_ident);
 }
 
 // ------------------------------ ArgumentListNode -----------------------------
 
-ArgumentListNode::~ArgumentListNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ArgumentListNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_next);
-    releaser.release(m_expr);
-}
-
 RegisterID* ArgumentListNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     ASSERT(m_expr);
-    return generator.emitNode(dst, m_expr.get());
-}
-
-// ------------------------------ ArgumentsNode -----------------------------
-
-ArgumentsNode::~ArgumentsNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ArgumentsNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_listNode);
+    return generator.emitNode(dst, m_expr);
 }
 
 // ------------------------------ NewExprNode ----------------------------------
 
-NewExprNode::~NewExprNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void NewExprNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-    releaser.release(m_args);
-}
-
 RegisterID* NewExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> func = generator.emitNode(m_expr.get());
-    return generator.emitConstruct(generator.finalDestination(dst), func.get(), m_args.get(), divot(), startOffset(), endOffset());
+    RefPtr<RegisterID> func = generator.emitNode(m_expr);
+    return generator.emitConstruct(generator.finalDestination(dst), func.get(), m_args, divot(), startOffset(), endOffset());
 }
 
 // ------------------------------ EvalFunctionCallNode ----------------------------------
 
-EvalFunctionCallNode::~EvalFunctionCallNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void EvalFunctionCallNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_args);
-}
-
 RegisterID* EvalFunctionCallNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     RefPtr<RegisterID> func = generator.tempDestination(dst);
     RefPtr<RegisterID> thisRegister = generator.newTemporary();
     generator.emitExpressionInfo(divot() - startOffset() + 4, 4, 0);
     generator.emitResolveWithBase(thisRegister.get(), func.get(), generator.propertyNames().eval);
-    return generator.emitCallEval(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args.get(), divot(), startOffset(), endOffset());
+    return generator.emitCallEval(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 }
 
 // ------------------------------ FunctionCallValueNode ----------------------------------
 
-FunctionCallValueNode::~FunctionCallValueNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void FunctionCallValueNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-    releaser.release(m_args);
-}
-
 RegisterID* FunctionCallValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> func = generator.emitNode(m_expr.get());
+    RefPtr<RegisterID> func = generator.emitNode(m_expr);
     RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
-    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args.get(), divot(), startOffset(), endOffset());
+    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 }
 
 // ------------------------------ FunctionCallResolveNode ----------------------------------
 
-FunctionCallResolveNode::~FunctionCallResolveNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void FunctionCallResolveNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_args);
-}
-
 RegisterID* FunctionCallResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     if (RefPtr<RegisterID> local = generator.registerFor(m_ident)) {
         RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
-        return generator.emitCall(generator.finalDestination(dst, thisRegister.get()), local.get(), thisRegister.get(), m_args.get(), divot(), startOffset(), endOffset());
+        return generator.emitCall(generator.finalDestination(dst, thisRegister.get()), local.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
     }
 
     int index = 0;
@@ -637,61 +348,142 @@ RegisterID* FunctionCallResolveNode::emitBytecode(BytecodeGenerator& generator,
     if (generator.findScopedProperty(m_ident, index, depth, false, globalObject) && index != missingSymbolMarker()) {
         RefPtr<RegisterID> func = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
         RefPtr<RegisterID> thisRegister = generator.emitLoad(generator.newTemporary(), jsNull());
-        return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args.get(), divot(), startOffset(), endOffset());
+        return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
     }
 
-    RefPtr<RegisterID> func = generator.tempDestination(dst);
+    RefPtr<RegisterID> func = generator.newTemporary();
     RefPtr<RegisterID> thisRegister = generator.newTemporary();
     int identifierStart = divot() - startOffset();
     generator.emitExpressionInfo(identifierStart + m_ident.size(), m_ident.size(), 0);
     generator.emitResolveFunction(thisRegister.get(), func.get(), m_ident);
-    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args.get(), divot(), startOffset(), endOffset());
+    return generator.emitCall(generator.finalDestination(dst, func.get()), func.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 }
 
 // ------------------------------ FunctionCallBracketNode ----------------------------------
 
-FunctionCallBracketNode::~FunctionCallBracketNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void FunctionCallBracketNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_subscript);
-    releaser.release(m_args);
-}
-
 RegisterID* FunctionCallBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base.get());
-    RegisterID* property = generator.emitNode(m_subscript.get());
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RegisterID* property = generator.emitNode(m_subscript);
     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
     RefPtr<RegisterID> function = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property);
     RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
-    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args.get(), divot(), startOffset(), endOffset());
+    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 }
 
 // ------------------------------ FunctionCallDotNode ----------------------------------
 
-FunctionCallDotNode::~FunctionCallDotNode()
+RegisterID* FunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    NodeReleaser::releaseAllNodes(this);
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    generator.emitMethodCheck();
+    RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
+    RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
+    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
 }
 
-void FunctionCallDotNode::releaseNodes(NodeReleaser& releaser)
+RegisterID* CallFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+{
+    RefPtr<Label> realCall = generator.newLabel();
+    RefPtr<Label> end = generator.newLabel();
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
+    RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
+    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
+    generator.emitJumpIfNotFunctionCall(function.get(), realCall.get());
+    {
+        RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
+        RefPtr<RegisterID> thisRegister = generator.newTemporary();
+        ArgumentListNode* oldList = m_args->m_listNode;
+        if (m_args->m_listNode && m_args->m_listNode->m_expr) {
+            generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
+            m_args->m_listNode = m_args->m_listNode->m_next;
+        } else
+            generator.emitLoad(thisRegister.get(), jsNull());
+
+        generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+        generator.emitJump(end.get());
+        m_args->m_listNode = oldList;
+    }
+    generator.emitLabel(realCall.get());
+    {
+        RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
+        generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+    }
+    generator.emitLabel(end.get());
+    return finalDestination.get();
+}
+    
+static bool areTrivialApplyArguments(ArgumentsNode* args)
 {
-    releaser.release(m_base);
-    releaser.release(m_args);
+    return !args->m_listNode || !args->m_listNode->m_expr || !args->m_listNode->m_next
+        || (!args->m_listNode->m_next->m_next && args->m_listNode->m_next->m_expr->isSimpleArray());
 }
 
-RegisterID* FunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
+RegisterID* ApplyFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base.get());
+    // A few simple cases can be trivially handled as ordinary function calls.
+    // function.apply(), function.apply(arg) -> identical to function.call
+    // function.apply(thisArg, [arg0, arg1, ...]) -> can be trivially coerced into function.call(thisArg, arg0, arg1, ...) and saves object allocation
+    bool mayBeCall = areTrivialApplyArguments(m_args);
+
+    RefPtr<Label> realCall = generator.newLabel();
+    RefPtr<Label> end = generator.newLabel();
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
     RefPtr<RegisterID> function = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
-    RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
-    return generator.emitCall(generator.finalDestination(dst, function.get()), function.get(), thisRegister.get(), m_args.get(), divot(), startOffset(), endOffset());
+    RefPtr<RegisterID> finalDestination = generator.finalDestination(dst, function.get());
+    generator.emitJumpIfNotFunctionApply(function.get(), realCall.get());
+    {
+        if (mayBeCall) {
+            RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
+            RefPtr<RegisterID> thisRegister = generator.newTemporary();
+            ArgumentListNode* oldList = m_args->m_listNode;
+            if (m_args->m_listNode && m_args->m_listNode->m_expr) {
+                generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
+                m_args->m_listNode = m_args->m_listNode->m_next;
+                if (m_args->m_listNode) {
+                    ASSERT(m_args->m_listNode->m_expr->isSimpleArray());
+                    ASSERT(!m_args->m_listNode->m_next);
+                    m_args->m_listNode = static_cast<ArrayNode*>(m_args->m_listNode->m_expr)->toArgumentList(generator.globalData());
+                }
+            } else
+                generator.emitLoad(thisRegister.get(), jsNull());
+            generator.emitCall(finalDestination.get(), realFunction.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+            m_args->m_listNode = oldList;
+        } else {
+            ASSERT(m_args->m_listNode && m_args->m_listNode->m_next);
+            RefPtr<RegisterID> realFunction = generator.emitMove(generator.newTemporary(), base.get());
+            RefPtr<RegisterID> argsCountRegister = generator.newTemporary();
+            RefPtr<RegisterID> thisRegister = generator.newTemporary();
+            RefPtr<RegisterID> argsRegister = generator.newTemporary();
+            generator.emitNode(thisRegister.get(), m_args->m_listNode->m_expr);
+            ArgumentListNode* args = m_args->m_listNode->m_next;
+            bool isArgumentsApply = false;
+            if (args->m_expr->isResolveNode()) {
+                ResolveNode* resolveNode = static_cast<ResolveNode*>(args->m_expr);
+                isArgumentsApply = generator.willResolveToArguments(resolveNode->identifier());
+                if (isArgumentsApply)
+                    generator.emitMove(argsRegister.get(), generator.uncheckedRegisterForArguments());
+            }
+            if (!isArgumentsApply)
+                generator.emitNode(argsRegister.get(), args->m_expr);
+            while ((args = args->m_next))
+                generator.emitNode(args->m_expr);
+
+            generator.emitLoadVarargs(argsCountRegister.get(), argsRegister.get());
+            generator.emitCallVarargs(finalDestination.get(), realFunction.get(), thisRegister.get(), argsCountRegister.get(), divot(), startOffset(), endOffset());
+        }
+        generator.emitJump(end.get());
+    }
+    generator.emitLabel(realCall.get());
+    {
+        RefPtr<RegisterID> thisRegister = generator.emitMove(generator.newTemporary(), base.get());
+        generator.emitCall(finalDestination.get(), function.get(), thisRegister.get(), m_args, divot(), startOffset(), endOffset());
+    }
+    generator.emitLabel(end.get());
+    return finalDestination.get();
 }
 
 // ------------------------------ PostfixResolveNode ----------------------------------
@@ -752,21 +544,10 @@ RegisterID* PostfixResolveNode::emitBytecode(BytecodeGenerator& generator, Regis
 
 // ------------------------------ PostfixBracketNode ----------------------------------
 
-PostfixBracketNode::~PostfixBracketNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void PostfixBracketNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_subscript);
-}
-
 RegisterID* PostfixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base.get());
-    RefPtr<RegisterID> property = generator.emitNode(m_subscript.get());
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
 
     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
     RefPtr<RegisterID> value = generator.emitGetByVal(generator.newTemporary(), base.get(), property.get());
@@ -787,19 +568,9 @@ RegisterID* PostfixBracketNode::emitBytecode(BytecodeGenerator& generator, Regis
 
 // ------------------------------ PostfixDotNode ----------------------------------
 
-PostfixDotNode::~PostfixDotNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void PostfixDotNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-}
-
 RegisterID* PostfixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base.get());
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
 
     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
     RefPtr<RegisterID> value = generator.emitGetById(generator.newTemporary(), base.get(), m_ident);
@@ -820,16 +591,6 @@ RegisterID* PostfixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterI
 
 // ------------------------------ PostfixErrorNode -----------------------------------
 
-PostfixErrorNode::~PostfixErrorNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void PostfixErrorNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* PostfixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
     return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus ? "Postfix ++ operator applied to value that is not a reference." : "Postfix -- operator applied to value that is not a reference.");
@@ -849,21 +610,10 @@ RegisterID* DeleteResolveNode::emitBytecode(BytecodeGenerator& generator, Regist
 
 // ------------------------------ DeleteBracketNode -----------------------------------
 
-DeleteBracketNode::~DeleteBracketNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void DeleteBracketNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_subscript);
-}
-
 RegisterID* DeleteBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> r0 = generator.emitNode(m_base.get());
-    RegisterID* r1 = generator.emitNode(m_subscript.get());
+    RefPtr<RegisterID> r0 = generator.emitNode(m_base);
+    RegisterID* r1 = generator.emitNode(m_subscript);
 
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     return generator.emitDeleteByVal(generator.finalDestination(dst), r0.get(), r1);
@@ -871,19 +621,9 @@ RegisterID* DeleteBracketNode::emitBytecode(BytecodeGenerator& generator, Regist
 
 // ------------------------------ DeleteDotNode -----------------------------------
 
-DeleteDotNode::~DeleteDotNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void DeleteDotNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-}
-
 RegisterID* DeleteDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RegisterID* r0 = generator.emitNode(m_base.get());
+    RegisterID* r0 = generator.emitNode(m_base);
 
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     return generator.emitDeleteById(generator.finalDestination(dst), r0, m_ident);
@@ -891,19 +631,9 @@ RegisterID* DeleteDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID
 
 // ------------------------------ DeleteValueNode -----------------------------------
 
-DeleteValueNode::~DeleteValueNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void DeleteValueNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* DeleteValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitNode(generator.ignoredResult(), m_expr.get());
+    generator.emitNode(generator.ignoredResult(), m_expr);
 
     // delete on a non-location expression ignores the value and returns true
     return generator.emitUnexpectedLoad(generator.finalDestination(dst), true);
@@ -911,23 +641,13 @@ RegisterID* DeleteValueNode::emitBytecode(BytecodeGenerator& generator, Register
 
 // ------------------------------ VoidNode -------------------------------------
 
-VoidNode::~VoidNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void VoidNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* VoidNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     if (dst == generator.ignoredResult()) {
-        generator.emitNode(generator.ignoredResult(), m_expr.get());
+        generator.emitNode(generator.ignoredResult(), m_expr);
         return 0;
     }
-    RefPtr<RegisterID> r0 = generator.emitNode(m_expr.get());
+    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
     return generator.emitLoad(dst, jsUndefined());
 }
 
@@ -950,23 +670,13 @@ RegisterID* TypeOfResolveNode::emitBytecode(BytecodeGenerator& generator, Regist
 
 // ------------------------------ TypeOfValueNode -----------------------------------
 
-TypeOfValueNode::~TypeOfValueNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void TypeOfValueNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* TypeOfValueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     if (dst == generator.ignoredResult()) {
-        generator.emitNode(generator.ignoredResult(), m_expr.get());
+        generator.emitNode(generator.ignoredResult(), m_expr);
         return 0;
     }
-    RefPtr<RegisterID> src = generator.emitNode(m_expr.get());
+    RefPtr<RegisterID> src = generator.emitNode(m_expr);
     return generator.emitTypeOf(generator.finalDestination(dst), src.get());
 }
 
@@ -1006,21 +716,10 @@ RegisterID* PrefixResolveNode::emitBytecode(BytecodeGenerator& generator, Regist
 
 // ------------------------------ PrefixBracketNode ----------------------------------
 
-PrefixBracketNode::~PrefixBracketNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void PrefixBracketNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_subscript);
-}
-
 RegisterID* PrefixBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base.get());
-    RefPtr<RegisterID> property = generator.emitNode(m_subscript.get());
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
+    RefPtr<RegisterID> property = generator.emitNode(m_subscript);
     RefPtr<RegisterID> propDst = generator.tempDestination(dst);
 
     generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
@@ -1036,19 +735,9 @@ RegisterID* PrefixBracketNode::emitBytecode(BytecodeGenerator& generator, Regist
 
 // ------------------------------ PrefixDotNode ----------------------------------
 
-PrefixDotNode::~PrefixDotNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void PrefixDotNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-}
-
 RegisterID* PrefixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNode(m_base.get());
+    RefPtr<RegisterID> base = generator.emitNode(m_base);
     RefPtr<RegisterID> propDst = generator.tempDestination(dst);
 
     generator.emitExpressionInfo(divot() + m_subexpressionDivotOffset, m_subexpressionStartOffset, endOffset() - m_subexpressionDivotOffset);
@@ -1064,16 +753,6 @@ RegisterID* PrefixDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID
 
 // ------------------------------ PrefixErrorNode -----------------------------------
 
-PrefixErrorNode::~PrefixErrorNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void PrefixErrorNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* PrefixErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
     return emitThrowError(generator, ReferenceError, m_operator == OpPlusPlus ? "Prefix ++ operator applied to value that is not a reference." : "Prefix -- operator applied to value that is not a reference.");
@@ -1081,48 +760,149 @@ RegisterID* PrefixErrorNode::emitBytecode(BytecodeGenerator& generator, Register
 
 // ------------------------------ Unary Operation Nodes -----------------------------------
 
-UnaryOpNode::~UnaryOpNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void UnaryOpNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* UnaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RegisterID* src = generator.emitNode(m_expr.get());
+    RegisterID* src = generator.emitNode(m_expr);
     return generator.emitUnaryOp(opcodeID(), generator.finalDestination(dst), src);
 }
 
 // ------------------------------ Binary Operation Nodes -----------------------------------
 
-BinaryOpNode::~BinaryOpNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
+// BinaryOpNode::emitStrcat:
+//
+// This node generates an op_strcat operation.  This opcode can handle concatenation of three or
+// more values, where we can determine a set of separate op_add operations would be operating on
+// string values.
+//
+// This function expects to be operating on a graph of AST nodes looking something like this:
+//
+//     (a)...     (b)
+//          \   /
+//           (+)     (c)
+//              \   /
+//      [d]     ((+))
+//         \    /
+//          [+=]
+//
+// The assignment operation is optional, if it exists the register holding the value on the
+// lefthand side of the assignment should be passing as the optional 'lhs' argument.
+//
+// The method should be called on the node at the root of the tree of regular binary add
+// operations (marked in the diagram with a double set of parentheses).  This node must
+// be performing a string concatenation (determined by statically detecting that at least
+// one child must be a string).  
+//
+// Since the minimum number of values being concatenated together is expected to be 3, if
+// a lhs to a concatenating assignment is not provided then the  root add should have at
+// least one left child that is also an add that can be determined to be operating on strings.
+//
+RegisterID* BinaryOpNode::emitStrcat(BytecodeGenerator& generator, RegisterID* dst, RegisterID* lhs, ReadModifyResolveNode* emitExpressionInfoForMe)
+{
+    ASSERT(isAdd());
+    ASSERT(resultDescriptor().definitelyIsString());
+
+    // Create a list of expressions for all the adds in the tree of nodes we can convert into
+    // a string concatenation.  The rightmost node (c) is added first.  The rightmost node is
+    // added first, and the leftmost child is never added, so the vector produced for the
+    // example above will be [ c, b ].
+    Vector<ExpressionNode*, 16> reverseExpressionList;
+    reverseExpressionList.append(m_expr2);
+
+    // Examine the left child of the add.  So long as this is a string add, add its right-child
+    // to the list, and keep processing along the left fork.
+    ExpressionNode* leftMostAddChild = m_expr1;
+    while (leftMostAddChild->isAdd() && leftMostAddChild->resultDescriptor().definitelyIsString()) {
+        reverseExpressionList.append(static_cast<AddNode*>(leftMostAddChild)->m_expr2);
+        leftMostAddChild = static_cast<AddNode*>(leftMostAddChild)->m_expr1;
+    }
 
-void BinaryOpNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr1);
-    releaser.release(m_expr2);
+    Vector<RefPtr<RegisterID>, 16> temporaryRegisters;
+
+    // If there is an assignment, allocate a temporary to hold the lhs after conversion.
+    // We could possibly avoid this (the lhs is converted last anyway, we could let the
+    // op_strcat node handle its conversion if required).
+    if (lhs)
+        temporaryRegisters.append(generator.newTemporary());
+
+    // Emit code for the leftmost node ((a) in the example).
+    temporaryRegisters.append(generator.newTemporary());
+    RegisterID* leftMostAddChildTempRegister = temporaryRegisters.last().get();
+    generator.emitNode(leftMostAddChildTempRegister, leftMostAddChild);
+
+    // Note on ordering of conversions:
+    //
+    // We maintain the same ordering of conversions as we would see if the concatenations
+    // was performed as a sequence of adds (otherwise this optimization could change
+    // behaviour should an object have been provided a valueOf or toString method).
+    //
+    // Considering the above example, the sequnce of execution is:
+    //     * evaluate operand (a)
+    //     * evaluate operand (b)
+    //     * convert (a) to primitive   <-  (this would be triggered by the first add)
+    //     * convert (b) to primitive   <-  (ditto)
+    //     * evaluate operand (c)
+    //     * convert (c) to primitive   <-  (this would be triggered by the second add)
+    // And optionally, if there is an assignment:
+    //     * convert (d) to primitive   <-  (this would be triggered by the assigning addition)
+    //
+    // As such we do not plant an op to convert the leftmost child now.  Instead, use
+    // 'leftMostAddChildTempRegister' as a flag to trigger generation of the conversion
+    // once the second node has been generated.  However, if the leftmost child is an
+    // immediate we can trivially determine that no conversion will be required.
+    // If this is the case
+    if (leftMostAddChild->isString())
+        leftMostAddChildTempRegister = 0;
+
+    while (reverseExpressionList.size()) {
+        ExpressionNode* node = reverseExpressionList.last();
+        reverseExpressionList.removeLast();
+
+        // Emit the code for the current node.
+        temporaryRegisters.append(generator.newTemporary());
+        generator.emitNode(temporaryRegisters.last().get(), node);
+
+        // On the first iteration of this loop, when we first reach this point we have just
+        // generated the second node, which means it is time to convert the leftmost operand.
+        if (leftMostAddChildTempRegister) {
+            generator.emitToPrimitive(leftMostAddChildTempRegister, leftMostAddChildTempRegister);
+            leftMostAddChildTempRegister = 0; // Only do this once.
+        }
+        // Plant a conversion for this node, if necessary.
+        if (!node->isString())
+            generator.emitToPrimitive(temporaryRegisters.last().get(), temporaryRegisters.last().get());
+    }
+    ASSERT(temporaryRegisters.size() >= 3);
+
+    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
+    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
+    if (emitExpressionInfoForMe)
+        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
+
+    // If there is an assignment convert the lhs now.  This will also copy lhs to
+    // the temporary register we allocated for it.
+    if (lhs)
+        generator.emitToPrimitive(temporaryRegisters[0].get(), lhs);
+
+    return generator.emitStrcat(generator.finalDestination(dst, temporaryRegisters[0].get()), temporaryRegisters[0].get(), temporaryRegisters.size());
 }
 
 RegisterID* BinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     OpcodeID opcodeID = this->opcodeID();
+
+    if (opcodeID == op_add && m_expr1->isAdd() && m_expr1->resultDescriptor().definitelyIsString())
+        return emitStrcat(generator, dst);
+
     if (opcodeID == op_neq) {
         if (m_expr1->isNull() || m_expr2->isNull()) {
             RefPtr<RegisterID> src = generator.tempDestination(dst);
-            generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2.get() : m_expr1.get());
+            generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
             return generator.emitUnaryOp(op_neq_null, generator.finalDestination(dst, src.get()), src.get());
         }
     }
 
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1.get(), m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2.get());
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
     return generator.emitBinaryOp(opcodeID, generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
 }
 
@@ -1130,41 +910,41 @@ RegisterID* EqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 {
     if (m_expr1->isNull() || m_expr2->isNull()) {
         RefPtr<RegisterID> src = generator.tempDestination(dst);
-        generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2.get() : m_expr1.get());
+        generator.emitNode(src.get(), m_expr1->isNull() ? m_expr2 : m_expr1);
         return generator.emitUnaryOp(op_eq_null, generator.finalDestination(dst, src.get()), src.get());
     }
 
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1.get(), m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2.get());
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
     return generator.emitEqualityOp(op_eq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
 }
 
 RegisterID* StrictEqualNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1.get(), m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2.get());
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
     return generator.emitEqualityOp(op_stricteq, generator.finalDestination(dst, src1.get()), src1.get(), src2);
 }
 
 RegisterID* ReverseBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1.get(), m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2.get());
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
     return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src2, src1.get(), OperandTypes(m_expr2->resultDescriptor(), m_expr1->resultDescriptor()));
 }
 
 RegisterID* ThrowableBinaryOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1.get(), m_rightHasAssignments, m_expr2->isPure(generator));
-    RegisterID* src2 = generator.emitNode(m_expr2.get());
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RegisterID* src2 = generator.emitNode(m_expr2);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     return generator.emitBinaryOp(opcodeID(), generator.finalDestination(dst, src1.get()), src1.get(), src2, OperandTypes(m_expr1->resultDescriptor(), m_expr2->resultDescriptor()));
 }
 
 RegisterID* InstanceOfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1.get(), m_rightHasAssignments, m_expr2->isPure(generator));
-    RefPtr<RegisterID> src2 = generator.emitNode(m_expr2.get());
+    RefPtr<RegisterID> src1 = generator.emitNodeForLeftHandSide(m_expr1, m_rightHasAssignments, m_expr2->isPure(generator));
+    RefPtr<RegisterID> src2 = generator.emitNode(m_expr2);
 
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     generator.emitGetByIdExceptionInfo(op_instanceof);
@@ -1176,28 +956,17 @@ RegisterID* InstanceOfNode::emitBytecode(BytecodeGenerator& generator, RegisterI
 
 // ------------------------------ LogicalOpNode ----------------------------
 
-LogicalOpNode::~LogicalOpNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void LogicalOpNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr1);
-    releaser.release(m_expr2);
-}
-
 RegisterID* LogicalOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     RefPtr<RegisterID> temp = generator.tempDestination(dst);
     RefPtr<Label> target = generator.newLabel();
     
-    generator.emitNode(temp.get(), m_expr1.get());
+    generator.emitNode(temp.get(), m_expr1);
     if (m_operator == OpLogicalAnd)
         generator.emitJumpIfFalse(temp.get(), target.get());
     else
         generator.emitJumpIfTrue(temp.get(), target.get());
-    generator.emitNode(temp.get(), m_expr2.get());
+    generator.emitNode(temp.get(), m_expr2);
     generator.emitLabel(target.get());
 
     return generator.moveToDestinationIfNeeded(dst, temp.get());
@@ -1205,32 +974,20 @@ RegisterID* LogicalOpNode::emitBytecode(BytecodeGenerator& generator, RegisterID
 
 // ------------------------------ ConditionalNode ------------------------------
 
-ConditionalNode::~ConditionalNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ConditionalNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_logical);
-    releaser.release(m_expr1);
-    releaser.release(m_expr2);
-}
-
 RegisterID* ConditionalNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     RefPtr<RegisterID> newDst = generator.finalDestination(dst);
     RefPtr<Label> beforeElse = generator.newLabel();
     RefPtr<Label> afterElse = generator.newLabel();
 
-    RegisterID* cond = generator.emitNode(m_logical.get());
+    RegisterID* cond = generator.emitNode(m_logical);
     generator.emitJumpIfFalse(cond, beforeElse.get());
 
-    generator.emitNode(newDst.get(), m_expr1.get());
+    generator.emitNode(newDst.get(), m_expr1);
     generator.emitJump(afterElse.get());
 
     generator.emitLabel(beforeElse.get());
-    generator.emitNode(newDst.get(), m_expr2.get());
+    generator.emitNode(newDst.get(), m_expr2);
 
     generator.emitLabel(afterElse.get());
 
@@ -1239,18 +996,8 @@ RegisterID* ConditionalNode::emitBytecode(BytecodeGenerator& generator, Register
 
 // ------------------------------ ReadModifyResolveNode -----------------------------------
 
-ReadModifyResolveNode::~ReadModifyResolveNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ReadModifyResolveNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_right);
-}
-
 // FIXME: should this be moved to be a method on BytecodeGenerator?
-static ALWAYS_INLINE RegisterID* emitReadModifyAssignment(BytecodeGenerator& generator, RegisterID* dst, RegisterID* src1, RegisterID* src2, Operator oper, OperandTypes types)
+static ALWAYS_INLINE RegisterID* emitReadModifyAssignment(BytecodeGenerator& generator, RegisterID* dst, RegisterID* src1, ExpressionNode* m_right, Operator oper, OperandTypes types, ReadModifyResolveNode* emitExpressionInfoForMe = 0)
 {
     OpcodeID opcodeID;
     switch (oper) {
@@ -1261,6 +1008,8 @@ static ALWAYS_INLINE RegisterID* emitReadModifyAssignment(BytecodeGenerator& gen
             opcodeID = op_div;
             break;
         case OpPlusEq:
+            if (m_right->isAdd() && m_right->resultDescriptor().definitelyIsString())
+                return static_cast<AddNode*>(m_right)->emitStrcat(generator, dst, src1, emitExpressionInfoForMe);
             opcodeID = op_add;
             break;
         case OpMinusEq:
@@ -1291,7 +1040,14 @@ static ALWAYS_INLINE RegisterID* emitReadModifyAssignment(BytecodeGenerator& gen
             ASSERT_NOT_REACHED();
             return dst;
     }
-    
+
+    RegisterID* src2 = generator.emitNode(m_right);
+
+    // Certain read-modify nodes require expression info to be emitted *after* m_right has been generated.
+    // If this is required the node is passed as 'emitExpressionInfoForMe'; do so now.
+    if (emitExpressionInfoForMe)
+        generator.emitExpressionInfo(emitExpressionInfoForMe->divot(), emitExpressionInfoForMe->startOffset(), emitExpressionInfoForMe->endOffset());
+
     return generator.emitBinaryOp(opcodeID, dst, src1, src2, types);
 }
 
@@ -1299,21 +1055,18 @@ RegisterID* ReadModifyResolveNode::emitBytecode(BytecodeGenerator& generator, Re
 {
     if (RegisterID* local = generator.registerFor(m_ident)) {
         if (generator.isLocalConstant(m_ident)) {
-            RegisterID* src2 = generator.emitNode(m_right.get());
-            return emitReadModifyAssignment(generator, generator.finalDestination(dst), local, src2, m_operator, OperandTypes(ResultType::unknown(), m_right->resultDescriptor()));
+            return emitReadModifyAssignment(generator, generator.finalDestination(dst), local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
         }
         
         if (generator.leftHandSideNeedsCopy(m_rightHasAssignments, m_right->isPure(generator))) {
             RefPtr<RegisterID> result = generator.newTemporary();
             generator.emitMove(result.get(), local);
-            RegisterID* src2 = generator.emitNode(m_right.get());
-            emitReadModifyAssignment(generator, result.get(), result.get(), src2, m_operator, OperandTypes(ResultType::unknown(), m_right->resultDescriptor()));
+            emitReadModifyAssignment(generator, result.get(), result.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
             generator.emitMove(local, result.get());
             return generator.moveToDestinationIfNeeded(dst, result.get());
         }
         
-        RegisterID* src2 = generator.emitNode(m_right.get());
-        RegisterID* result = emitReadModifyAssignment(generator, local, local, src2, m_operator, OperandTypes(ResultType::unknown(), m_right->resultDescriptor()));
+        RegisterID* result = emitReadModifyAssignment(generator, local, local, m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
         return generator.moveToDestinationIfNeeded(dst, result);
     }
 
@@ -1322,8 +1075,7 @@ RegisterID* ReadModifyResolveNode::emitBytecode(BytecodeGenerator& generator, Re
     JSObject* globalObject = 0;
     if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
         RefPtr<RegisterID> src1 = generator.emitGetScopedVar(generator.tempDestination(dst), depth, index, globalObject);
-        RegisterID* src2 = generator.emitNode(m_right.get());
-        RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), src2, m_operator, OperandTypes(ResultType::unknown(), m_right->resultDescriptor()));
+        RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
         generator.emitPutScopedVar(depth, index, result, globalObject);
         return result;
     }
@@ -1331,31 +1083,19 @@ RegisterID* ReadModifyResolveNode::emitBytecode(BytecodeGenerator& generator, Re
     RefPtr<RegisterID> src1 = generator.tempDestination(dst);
     generator.emitExpressionInfo(divot() - startOffset() + m_ident.size(), m_ident.size(), 0);
     RefPtr<RegisterID> base = generator.emitResolveWithBase(generator.newTemporary(), src1.get(), m_ident);
-    RegisterID* src2 = generator.emitNode(m_right.get());
-    generator.emitExpressionInfo(divot(), startOffset(), endOffset());
-    RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), src2, m_operator, OperandTypes(ResultType::unknown(), m_right->resultDescriptor()));
+    RegisterID* result = emitReadModifyAssignment(generator, generator.finalDestination(dst, src1.get()), src1.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()), this);
     return generator.emitPutById(base.get(), m_ident, result);
 }
 
 // ------------------------------ AssignResolveNode -----------------------------------
 
-AssignResolveNode::~AssignResolveNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void AssignResolveNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_right);
-}
-
 RegisterID* AssignResolveNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     if (RegisterID* local = generator.registerFor(m_ident)) {
         if (generator.isLocalConstant(m_ident))
-            return generator.emitNode(dst, m_right.get());
+            return generator.emitNode(dst, m_right);
         
-        RegisterID* result = generator.emitNode(local, m_right.get());
+        RegisterID* result = generator.emitNode(local, m_right);
         return generator.moveToDestinationIfNeeded(dst, result);
     }
 
@@ -1365,7 +1105,7 @@ RegisterID* AssignResolveNode::emitBytecode(BytecodeGenerator& generator, Regist
     if (generator.findScopedProperty(m_ident, index, depth, true, globalObject) && index != missingSymbolMarker()) {
         if (dst == generator.ignoredResult())
             dst = 0;
-        RegisterID* value = generator.emitNode(dst, m_right.get());
+        RegisterID* value = generator.emitNode(dst, m_right);
         generator.emitPutScopedVar(depth, index, value, globalObject);
         return value;
     }
@@ -1373,29 +1113,18 @@ RegisterID* AssignResolveNode::emitBytecode(BytecodeGenerator& generator, Regist
     RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
     if (dst == generator.ignoredResult())
         dst = 0;
-    RegisterID* value = generator.emitNode(dst, m_right.get());
+    RegisterID* value = generator.emitNode(dst, m_right);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     return generator.emitPutById(base.get(), m_ident, value);
 }
 
 // ------------------------------ AssignDotNode -----------------------------------
 
-AssignDotNode::~AssignDotNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void AssignDotNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_right);
-}
-
 RegisterID* AssignDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base.get(), m_rightHasAssignments, m_right->isPure(generator));
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
     RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
-    RegisterID* result = generator.emitNode(value.get(), m_right.get());
+    RegisterID* result = generator.emitNode(value.get(), m_right);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     generator.emitPutById(base.get(), m_ident, result);
     return generator.moveToDestinationIfNeeded(dst, result);
@@ -1403,25 +1132,13 @@ RegisterID* AssignDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID
 
 // ------------------------------ ReadModifyDotNode -----------------------------------
 
-ReadModifyDotNode::~ReadModifyDotNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ReadModifyDotNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_right);
-}
-
 RegisterID* ReadModifyDotNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base.get(), m_rightHasAssignments, m_right->isPure(generator));
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_rightHasAssignments, m_right->isPure(generator));
 
     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
     RefPtr<RegisterID> value = generator.emitGetById(generator.tempDestination(dst), base.get(), m_ident);
-    RegisterID* change = generator.emitNode(m_right.get());
-    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), change, m_operator, OperandTypes(ResultType::unknown(), m_right->resultDescriptor()));
+    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
 
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     return generator.emitPutById(base.get(), m_ident, updatedValue);
@@ -1429,17 +1146,6 @@ RegisterID* ReadModifyDotNode::emitBytecode(BytecodeGenerator& generator, Regist
 
 // ------------------------------ AssignErrorNode -----------------------------------
 
-AssignErrorNode::~AssignErrorNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void AssignErrorNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_left);
-    releaser.release(m_right);
-}
-
 RegisterID* AssignErrorNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
     return emitThrowError(generator, ReferenceError, "Left side of assignment is not a reference.");
@@ -1447,24 +1153,12 @@ RegisterID* AssignErrorNode::emitBytecode(BytecodeGenerator& generator, Register
 
 // ------------------------------ AssignBracketNode -----------------------------------
 
-AssignBracketNode::~AssignBracketNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void AssignBracketNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_subscript);
-    releaser.release(m_right);
-}
-
 RegisterID* AssignBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base.get(), m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
-    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript.get(), m_rightHasAssignments, m_right->isPure(generator));
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
+    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
     RefPtr<RegisterID> value = generator.destinationForAssignResult(dst);
-    RegisterID* result = generator.emitNode(value.get(), m_right.get());
+    RegisterID* result = generator.emitNode(value.get(), m_right);
 
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     generator.emitPutByVal(base.get(), property.get(), result);
@@ -1473,27 +1167,14 @@ RegisterID* AssignBracketNode::emitBytecode(BytecodeGenerator& generator, Regist
 
 // ------------------------------ ReadModifyBracketNode -----------------------------------
 
-ReadModifyBracketNode::~ReadModifyBracketNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ReadModifyBracketNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_base);
-    releaser.release(m_subscript);
-    releaser.release(m_right);
-}
-
 RegisterID* ReadModifyBracketNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base.get(), m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
-    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript.get(), m_rightHasAssignments, m_right->isPure(generator));
+    RefPtr<RegisterID> base = generator.emitNodeForLeftHandSide(m_base, m_subscriptHasAssignments || m_rightHasAssignments, m_subscript->isPure(generator) && m_right->isPure(generator));
+    RefPtr<RegisterID> property = generator.emitNodeForLeftHandSide(m_subscript, m_rightHasAssignments, m_right->isPure(generator));
 
     generator.emitExpressionInfo(divot() - m_subexpressionDivotOffset, startOffset() - m_subexpressionDivotOffset, m_subexpressionEndOffset);
     RefPtr<RegisterID> value = generator.emitGetByVal(generator.tempDestination(dst), base.get(), property.get());
-    RegisterID* change = generator.emitNode(m_right.get());
-    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), change, m_operator, OperandTypes(ResultType::unknown(), m_right->resultDescriptor()));
+    RegisterID* updatedValue = emitReadModifyAssignment(generator, generator.finalDestination(dst, value.get()), value.get(), m_right, m_operator, OperandTypes(ResultType::unknownType(), m_right->resultDescriptor()));
 
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     generator.emitPutByVal(base.get(), property.get(), updatedValue);
@@ -1503,63 +1184,36 @@ RegisterID* ReadModifyBracketNode::emitBytecode(BytecodeGenerator& generator, Re
 
 // ------------------------------ CommaNode ------------------------------------
 
-CommaNode::~CommaNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void CommaNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr1);
-    releaser.release(m_expr2);
-}
-
 RegisterID* CommaNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    generator.emitNode(generator.ignoredResult(), m_expr1.get());
-    return generator.emitNode(dst, m_expr2.get());
+    ASSERT(m_expressions.size() > 1);
+    for (size_t i = 0; i < m_expressions.size() - 1; i++)
+        generator.emitNode(generator.ignoredResult(), m_expressions[i]);
+    return generator.emitNode(dst, m_expressions.last());
 }
 
 // ------------------------------ ConstDeclNode ------------------------------------
 
-ConstDeclNode::~ConstDeclNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ConstDeclNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_next);
-    releaser.release(m_init);
-}
-
-ConstDeclNode::ConstDeclNode(JSGlobalData* globalData, const Identifier& ident, ExpressionNode* init)
-    : ExpressionNode(globalData)
-    , m_ident(ident)
-    , m_init(init)
-{
-}
-
 RegisterID* ConstDeclNode::emitCodeSingle(BytecodeGenerator& generator)
 {
     if (RegisterID* local = generator.constRegisterFor(m_ident)) {
         if (!m_init)
             return local;
 
-        return generator.emitNode(local, m_init.get());
+        return generator.emitNode(local, m_init);
     }
     
     // FIXME: While this code should only be hit in eval code, it will potentially
     // assign to the wrong base if m_ident exists in an intervening dynamic scope.
     RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
-    RegisterID* value = m_init ? generator.emitNode(m_init.get()) : generator.emitLoad(0, jsUndefined());
+    RegisterID* value = m_init ? generator.emitNode(m_init) : generator.emitLoad(0, jsUndefined());
     return generator.emitPutById(base.get(), m_ident, value);
 }
 
 RegisterID* ConstDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
     RegisterID* result = 0;
-    for (ConstDeclNode* n = this; n; n = n->m_next.get())
+    for (ConstDeclNode* n = this; n; n = n->m_next)
         result = n->emitCodeSingle(generator);
 
     return result;
@@ -1567,65 +1221,34 @@ RegisterID* ConstDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID
 
 // ------------------------------ ConstStatementNode -----------------------------
 
-ConstStatementNode::~ConstStatementNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ConstStatementNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_next);
-}
-
 RegisterID* ConstStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
-    return generator.emitNode(m_next.get());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    return generator.emitNode(m_next);
 }
 
 // ------------------------------ Helper functions for handling Vectors of StatementNode -------------------------------
 
-static inline RegisterID* statementListEmitCode(const StatementVector& statements, BytecodeGenerator& generator, RegisterID* dst)
-{
-    StatementVector::const_iterator end = statements.end();
-    for (StatementVector::const_iterator it = statements.begin(); it != end; ++it) {
-        StatementNode* n = it->get();
-        if (!n->isLoop())
-            generator.emitDebugHook(WillExecuteStatement, n->firstLine(), n->lastLine());
-        generator.emitNode(dst, n);
-    }
-    return 0;
-}
-
-// ------------------------------ BlockNode ------------------------------------
-
-BlockNode::~BlockNode()
+static inline void statementListEmitCode(const StatementVector& statements, BytecodeGenerator& generator, RegisterID* dst)
 {
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void BlockNode::releaseNodes(NodeReleaser& releaser)
-{
-    size_t size = m_children.size();
+    size_t size = statements.size();
     for (size_t i = 0; i < size; ++i)
-        releaser.release(m_children[i]);
+        generator.emitNode(dst, statements[i]);
 }
 
-BlockNode::BlockNode(JSGlobalData* globalData, SourceElements* children)
-    : StatementNode(globalData)
-{
-    if (children)
-        children->releaseContentsIntoVector(m_children);
-}
+// ------------------------------ BlockNode ------------------------------------
 
 RegisterID* BlockNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
-    return statementListEmitCode(m_children, generator, dst);
+    statementListEmitCode(m_children, generator, dst);
+    return 0;
 }
 
 // ------------------------------ EmptyStatementNode ---------------------------
 
-RegisterID* EmptyStatementNode::emitBytecode(BytecodeGenerator&, RegisterID* dst)
+RegisterID* EmptyStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     return dst;
 }
 
@@ -1642,51 +1265,31 @@ RegisterID* DebuggerStatementNode::emitBytecode(BytecodeGenerator& generator, Re
 RegisterID* ExprStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     ASSERT(m_expr);
-    return generator.emitNode(dst, m_expr.get());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine()); 
+    return generator.emitNode(dst, m_expr);
 }
 
 // ------------------------------ VarStatementNode ----------------------------
 
-VarStatementNode::~VarStatementNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void VarStatementNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* VarStatementNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
 {
     ASSERT(m_expr);
-    return generator.emitNode(m_expr.get());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    return generator.emitNode(m_expr);
 }
 
 // ------------------------------ IfNode ---------------------------------------
 
-IfNode::~IfNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void IfNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_condition);
-    releaser.release(m_ifBlock);
-}
-
 RegisterID* IfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
     RefPtr<Label> afterThen = generator.newLabel();
 
-    RegisterID* cond = generator.emitNode(m_condition.get());
+    RegisterID* cond = generator.emitNode(m_condition);
     generator.emitJumpIfFalse(cond, afterThen.get());
 
-    if (!m_ifBlock->isBlock())
-        generator.emitDebugHook(WillExecuteStatement, m_ifBlock->firstLine(), m_ifBlock->lastLine());
-
-    generator.emitNode(dst, m_ifBlock.get());
+    generator.emitNode(dst, m_ifBlock);
     generator.emitLabel(afterThen.get());
 
     // FIXME: This should return the last statement executed so that it can be returned as a Completion.
@@ -1695,37 +1298,22 @@ RegisterID* IfNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 
 // ------------------------------ IfElseNode ---------------------------------------
 
-IfElseNode::~IfElseNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void IfElseNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_elseBlock);
-    IfNode::releaseNodes(releaser);
-}
-
 RegisterID* IfElseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
     RefPtr<Label> beforeElse = generator.newLabel();
     RefPtr<Label> afterElse = generator.newLabel();
 
-    RegisterID* cond = generator.emitNode(m_condition.get());
+    RegisterID* cond = generator.emitNode(m_condition);
     generator.emitJumpIfFalse(cond, beforeElse.get());
 
-    if (!m_ifBlock->isBlock())
-        generator.emitDebugHook(WillExecuteStatement, m_ifBlock->firstLine(), m_ifBlock->lastLine());
-
-    generator.emitNode(dst, m_ifBlock.get());
+    generator.emitNode(dst, m_ifBlock);
     generator.emitJump(afterElse.get());
 
     generator.emitLabel(beforeElse.get());
 
-    if (!m_elseBlock->isBlock())
-        generator.emitDebugHook(WillExecuteStatement, m_elseBlock->firstLine(), m_elseBlock->lastLine());
-
-    generator.emitNode(dst, m_elseBlock.get());
+    generator.emitNode(dst, m_elseBlock);
 
     generator.emitLabel(afterElse.get());
 
@@ -1735,17 +1323,6 @@ RegisterID* IfElseNode::emitBytecode(BytecodeGenerator& generator, RegisterID* d
 
 // ------------------------------ DoWhileNode ----------------------------------
 
-DoWhileNode::~DoWhileNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void DoWhileNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_statement);
-    releaser.release(m_expr);
-}
-
 RegisterID* DoWhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
@@ -1754,15 +1331,12 @@ RegisterID* DoWhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID*
     generator.emitLabel(topOfLoop.get());
 
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
-
-    if (!m_statement->isBlock())
-        generator.emitDebugHook(WillExecuteStatement, m_statement->firstLine(), m_statement->lastLine());
-        
-    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement.get());
+   
+    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
 
     generator.emitLabel(scope->continueTarget());
     generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
-    RegisterID* cond = generator.emitNode(m_expr.get());
+    RegisterID* cond = generator.emitNode(m_expr);
     generator.emitJumpIfTrue(cond, topOfLoop.get());
 
     generator.emitLabel(scope->breakTarget());
@@ -1771,17 +1345,6 @@ RegisterID* DoWhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID*
 
 // ------------------------------ WhileNode ------------------------------------
 
-WhileNode::~WhileNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void WhileNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-    releaser.release(m_statement);
-}
-
 RegisterID* WhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
@@ -1790,15 +1353,12 @@ RegisterID* WhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
     RefPtr<Label> topOfLoop = generator.newLabel();
     generator.emitLabel(topOfLoop.get());
-
-    if (!m_statement->isBlock())
-        generator.emitDebugHook(WillExecuteStatement, m_statement->firstLine(), m_statement->lastLine());
- 
-    generator.emitNode(dst, m_statement.get());
+    
+    generator.emitNode(dst, m_statement);
 
     generator.emitLabel(scope->continueTarget());
     generator.emitDebugHook(WillExecuteStatement, m_expr->lineNo(), m_expr->lineNo());
-    RegisterID* cond = generator.emitNode(m_expr.get());
+    RegisterID* cond = generator.emitNode(m_expr);
     generator.emitJumpIfTrue(cond, topOfLoop.get());
 
     generator.emitLabel(scope->breakTarget());
@@ -1809,19 +1369,6 @@ RegisterID* WhileNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
 // ------------------------------ ForNode --------------------------------------
 
-ForNode::~ForNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ForNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr1);
-    releaser.release(m_expr2);
-    releaser.release(m_expr3);
-    releaser.release(m_statement);
-}
-
 RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     if (dst == generator.ignoredResult())
@@ -1832,7 +1379,7 @@ RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
 
     if (m_expr1)
-        generator.emitNode(generator.ignoredResult(), m_expr1.get());
+        generator.emitNode(generator.ignoredResult(), m_expr1);
 
     RefPtr<Label> condition = generator.newLabel();
     generator.emitJump(condition.get());
@@ -1840,17 +1387,16 @@ RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
     RefPtr<Label> topOfLoop = generator.newLabel();
     generator.emitLabel(topOfLoop.get());
 
-    if (!m_statement->isBlock())
-        generator.emitDebugHook(WillExecuteStatement, m_statement->firstLine(), m_statement->lastLine());
-    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement.get());
+    RefPtr<RegisterID> result = generator.emitNode(dst, m_statement);
 
     generator.emitLabel(scope->continueTarget());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     if (m_expr3)
-        generator.emitNode(generator.ignoredResult(), m_expr3.get());
+        generator.emitNode(generator.ignoredResult(), m_expr3);
 
     generator.emitLabel(condition.get());
     if (m_expr2) {
-        RegisterID* cond = generator.emitNode(m_expr2.get());
+        RegisterID* cond = generator.emitNode(m_expr2);
         generator.emitJumpIfTrue(cond, topOfLoop.get());
     } else
         generator.emitJump(topOfLoop.get());
@@ -1861,45 +1407,6 @@ RegisterID* ForNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 
 // ------------------------------ ForInNode ------------------------------------
 
-ForInNode::~ForInNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ForInNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_init);
-    releaser.release(m_lexpr);
-    releaser.release(m_expr);
-    releaser.release(m_statement);
-}
-
-ForInNode::ForInNode(JSGlobalData* globalData, ExpressionNode* l, ExpressionNode* expr, StatementNode* statement)
-    : StatementNode(globalData)
-    , m_init(0L)
-    , m_lexpr(l)
-    , m_expr(expr)
-    , m_statement(statement)
-    , m_identIsVarDecl(false)
-{
-}
-
-ForInNode::ForInNode(JSGlobalData* globalData, const Identifier& ident, ExpressionNode* in, ExpressionNode* expr, StatementNode* statement, int divot, int startOffset, int endOffset)
-    : StatementNode(globalData)
-    , m_ident(ident)
-    , m_lexpr(new ResolveNode(globalData, ident, divot - startOffset))
-    , m_expr(expr)
-    , m_statement(statement)
-    , m_identIsVarDecl(true)
-{
-    if (in) {
-        AssignResolveNode* node = new AssignResolveNode(globalData, ident, in, true);
-        node->setExceptionSourceCode(divot, divot - startOffset, endOffset - divot);
-        m_init = node;
-    }
-    // for( var foo = bar in baz )
-}
-
 RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Loop);
@@ -1912,8 +1419,8 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
     generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
 
     if (m_init)
-        generator.emitNode(generator.ignoredResult(), m_init.get());
-    RegisterID* forInBase = generator.emitNode(m_expr.get());
+        generator.emitNode(generator.ignoredResult(), m_init);
+    RegisterID* forInBase = generator.emitNode(m_expr);
     RefPtr<RegisterID> iter = generator.emitGetPropertyNames(generator.newTemporary(), forInBase);
     generator.emitJump(scope->continueTarget());
 
@@ -1922,7 +1429,7 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
     RegisterID* propertyName;
     if (m_lexpr->isResolveNode()) {
-        const Identifier& ident = static_cast<ResolveNode*>(m_lexpr.get())->identifier();
+        const Identifier& ident = static_cast<ResolveNode*>(m_lexpr)->identifier();
         propertyName = generator.registerFor(ident);
         if (!propertyName) {
             propertyName = generator.newTemporary();
@@ -1933,7 +1440,7 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
             generator.emitPutById(base, ident, propertyName);
         }
     } else if (m_lexpr->isDotAccessorNode()) {
-        DotAccessorNode* assignNode = static_cast<DotAccessorNode*>(m_lexpr.get());
+        DotAccessorNode* assignNode = static_cast<DotAccessorNode*>(m_lexpr);
         const Identifier& ident = assignNode->identifier();
         propertyName = generator.newTemporary();
         RefPtr<RegisterID> protect = propertyName;
@@ -1943,7 +1450,7 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
         generator.emitPutById(base, ident, propertyName);
     } else {
         ASSERT(m_lexpr->isBracketAccessorNode());
-        BracketAccessorNode* assignNode = static_cast<BracketAccessorNode*>(m_lexpr.get());
+        BracketAccessorNode* assignNode = static_cast<BracketAccessorNode*>(m_lexpr);
         propertyName = generator.newTemporary();
         RefPtr<RegisterID> protect = propertyName;
         RefPtr<RegisterID> base = generator.emitNode(assignNode->base());
@@ -1953,12 +1460,11 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
         generator.emitPutByVal(base.get(), subscript, propertyName);
     }   
 
-    if (!m_statement->isBlock())
-        generator.emitDebugHook(WillExecuteStatement, m_statement->firstLine(), m_statement->lastLine());
-    generator.emitNode(dst, m_statement.get());
+    generator.emitNode(dst, m_statement);
 
     generator.emitLabel(scope->continueTarget());
     generator.emitNextPropertyName(propertyName, iter.get(), loopStart.get());
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     generator.emitLabel(scope->breakTarget());
     return dst;
 }
@@ -1968,6 +1474,8 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 // ECMA 12.7
 RegisterID* ContinueNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
     LabelScope* scope = generator.continueTarget(m_ident);
 
     if (!scope)
@@ -1984,6 +1492,8 @@ RegisterID* ContinueNode::emitBytecode(BytecodeGenerator& generator, RegisterID*
 // ECMA 12.8
 RegisterID* BreakNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
     LabelScope* scope = generator.breakTarget(m_ident);
     
     if (!scope)
@@ -1997,26 +1507,22 @@ RegisterID* BreakNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
 // ------------------------------ ReturnNode -----------------------------------
 
-ReturnNode::~ReturnNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ReturnNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_value);
-}
-
 RegisterID* ReturnNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
     if (generator.codeType() != FunctionCode)
         return emitThrowError(generator, SyntaxError, "Invalid return statement.");
 
     if (dst == generator.ignoredResult())
         dst = 0;
-    RegisterID* r0 = m_value ? generator.emitNode(dst, m_value.get()) : generator.emitLoad(dst, jsUndefined());
+    RegisterID* r0 = m_value ? generator.emitNode(dst, m_value) : generator.emitLoad(dst, jsUndefined());
+    RefPtr<RegisterID> returnRegister;
     if (generator.scopeDepth()) {
         RefPtr<Label> l0 = generator.newLabel();
+        if (generator.hasFinaliser() && !r0->isTemporary()) {
+            returnRegister = generator.emitMove(generator.newTemporary(), r0);
+            r0 = returnRegister.get();
+        }
         generator.emitJumpScopes(l0.get(), 0);
         generator.emitLabel(l0.get());
     }
@@ -2026,67 +1532,21 @@ RegisterID* ReturnNode::emitBytecode(BytecodeGenerator& generator, RegisterID* d
 
 // ------------------------------ WithNode -------------------------------------
 
-WithNode::~WithNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void WithNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-    releaser.release(m_statement);
-}
-
 RegisterID* WithNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
     RefPtr<RegisterID> scope = generator.newTemporary();
-    generator.emitNode(scope.get(), m_expr.get()); // scope must be protected until popped
+    generator.emitNode(scope.get(), m_expr); // scope must be protected until popped
     generator.emitExpressionInfo(m_divot, m_expressionLength, 0);
     generator.emitPushScope(scope.get());
-    RegisterID* result = generator.emitNode(dst, m_statement.get());
+    RegisterID* result = generator.emitNode(dst, m_statement);
     generator.emitPopScope();
     return result;
 }
 
-// ------------------------------ CaseClauseNode --------------------------------
-
-CaseClauseNode::~CaseClauseNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void CaseClauseNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
-// ------------------------------ ClauseListNode --------------------------------
-
-ClauseListNode::~ClauseListNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ClauseListNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_clause);
-    releaser.release(m_next);
-}
-
 // ------------------------------ CaseBlockNode --------------------------------
 
-CaseBlockNode::~CaseBlockNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void CaseBlockNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_list1);
-    releaser.release(m_defaultClause);
-    releaser.release(m_list2);
-}
-
 enum SwitchKind { 
     SwitchUnset = 0,
     SwitchNumber = 1, 
@@ -2101,7 +1561,8 @@ static void processClauseList(ClauseListNode* list, Vector<ExpressionNode*, 8>&
         literalVector.append(clauseExpression);
         if (clauseExpression->isNumber()) {
             double value = static_cast<NumberNode*>(clauseExpression)->value();
-            if ((typeForTable & ~SwitchNumber) || !JSImmediate::from(value)) {
+            JSValue jsValue = JSValue::makeInt32Fast(static_cast<int32_t>(value));
+            if ((typeForTable & ~SwitchNumber) || !jsValue || (jsValue.getInt32Fast() != value)) {
                 typeForTable = SwitchNeither;
                 break;
             }
@@ -2140,8 +1601,8 @@ SwitchInfo::SwitchType CaseBlockNode::tryOptimizedSwitch(Vector<ExpressionNode*,
     SwitchKind typeForTable = SwitchUnset;
     bool singleCharacterSwitch = true;
     
-    processClauseList(m_list1.get(), literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
-    processClauseList(m_list2.get(), literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
+    processClauseList(m_list1, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
+    processClauseList(m_list2, literalVector, typeForTable, singleCharacterSwitch, min_num, max_num);
     
     if (typeForTable == SwitchUnset || typeForTable == SwitchNeither)
         return SwitchInfo::SwitchNone;
@@ -2181,7 +1642,7 @@ RegisterID* CaseBlockNode::emitBytecodeForBlock(BytecodeGenerator& generator, Re
         generator.beginSwitch(switchExpression, switchType);
     } else {
         // Setup jumps
-        for (ClauseListNode* list = m_list1.get(); list; list = list->getNext()) {
+        for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
             RefPtr<RegisterID> clauseVal = generator.newTemporary();
             generator.emitNode(clauseVal.get(), list->getClause()->expr());
             generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
@@ -2189,7 +1650,7 @@ RegisterID* CaseBlockNode::emitBytecodeForBlock(BytecodeGenerator& generator, Re
             generator.emitJumpIfTrue(clauseVal.get(), labelVector[labelVector.size() - 1].get());
         }
         
-        for (ClauseListNode* list = m_list2.get(); list; list = list->getNext()) {
+        for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
             RefPtr<RegisterID> clauseVal = generator.newTemporary();
             generator.emitNode(clauseVal.get(), list->getClause()->expr());
             generator.emitBinaryOp(op_stricteq, clauseVal.get(), clauseVal.get(), switchExpression, OperandTypes());
@@ -2203,19 +1664,19 @@ RegisterID* CaseBlockNode::emitBytecodeForBlock(BytecodeGenerator& generator, Re
     RegisterID* result = 0;
 
     size_t i = 0;
-    for (ClauseListNode* list = m_list1.get(); list; list = list->getNext()) {
+    for (ClauseListNode* list = m_list1; list; list = list->getNext()) {
         generator.emitLabel(labelVector[i++].get());
-        result = statementListEmitCode(list->getClause()->children(), generator, dst);
+        statementListEmitCode(list->getClause()->children(), generator, dst);
     }
 
     if (m_defaultClause) {
         generator.emitLabel(defaultLabel.get());
-        result = statementListEmitCode(m_defaultClause->children(), generator, dst);
+        statementListEmitCode(m_defaultClause->children(), generator, dst);
     }
 
-    for (ClauseListNode* list = m_list2.get(); list; list = list->getNext()) {
+    for (ClauseListNode* list = m_list2; list; list = list->getNext()) {
         generator.emitLabel(labelVector[i++].get());
-        result = statementListEmitCode(list->getClause()->children(), generator, dst);
+        statementListEmitCode(list->getClause()->children(), generator, dst);
     }
     if (!m_defaultClause)
         generator.emitLabel(defaultLabel.get());
@@ -2230,22 +1691,13 @@ RegisterID* CaseBlockNode::emitBytecodeForBlock(BytecodeGenerator& generator, Re
 
 // ------------------------------ SwitchNode -----------------------------------
 
-SwitchNode::~SwitchNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void SwitchNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-    releaser.release(m_block);
-}
-
 RegisterID* SwitchNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+    
     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::Switch);
 
-    RefPtr<RegisterID> r0 = generator.emitNode(m_expr.get());
+    RefPtr<RegisterID> r0 = generator.emitNode(m_expr);
     RegisterID* r1 = m_block->emitBytecodeForBlock(generator, r0.get(), dst);
 
     generator.emitLabel(scope->breakTarget());
@@ -2254,23 +1706,15 @@ RegisterID* SwitchNode::emitBytecode(BytecodeGenerator& generator, RegisterID* d
 
 // ------------------------------ LabelNode ------------------------------------
 
-LabelNode::~LabelNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void LabelNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_statement);
-}
-
 RegisterID* LabelNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
     if (generator.breakTarget(m_name))
         return emitThrowError(generator, SyntaxError, "Duplicate label: %s.", m_name);
 
     RefPtr<LabelScope> scope = generator.newLabelScope(LabelScope::NamedLabel, &m_name);
-    RegisterID* r0 = generator.emitNode(dst, m_statement.get());
+    RegisterID* r0 = generator.emitNode(dst, m_statement);
 
     generator.emitLabel(scope->breakTarget());
     return r0;
@@ -2278,42 +1722,24 @@ RegisterID* LabelNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
 
 // ------------------------------ ThrowNode ------------------------------------
 
-ThrowNode::~ThrowNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ThrowNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_expr);
-}
-
 RegisterID* ThrowNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
     if (dst == generator.ignoredResult())
         dst = 0;
-    RefPtr<RegisterID> expr = generator.emitNode(dst, m_expr.get());
+    RefPtr<RegisterID> expr = generator.emitNode(m_expr);
     generator.emitExpressionInfo(divot(), startOffset(), endOffset());
     generator.emitThrow(expr.get());
-    return dst;
+    return 0;
 }
 
 // ------------------------------ TryNode --------------------------------------
 
-TryNode::~TryNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void TryNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_tryBlock);
-    releaser.release(m_catchBlock);
-    releaser.release(m_finallyBlock);
-}
-
 RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
+    generator.emitDebugHook(WillExecuteStatement, firstLine(), lastLine());
+
     RefPtr<Label> tryStartLabel = generator.newLabel();
     RefPtr<Label> tryEndLabel = generator.newLabel();
     RefPtr<Label> finallyStart;
@@ -2324,7 +1750,7 @@ RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
         generator.pushFinallyContext(finallyStart.get(), finallyReturnAddr.get());
     }
     generator.emitLabel(tryStartLabel.get());
-    generator.emitNode(dst, m_tryBlock.get());
+    generator.emitNode(dst, m_tryBlock);
     generator.emitLabel(tryEndLabel.get());
 
     if (m_catchBlock) {
@@ -2338,7 +1764,7 @@ RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
             generator.emitPushScope(exceptionRegister.get());
         } else
             generator.emitPushNewScope(exceptionRegister.get(), m_exceptionIdent, exceptionRegister.get());
-        generator.emitNode(dst, m_catchBlock.get());
+        generator.emitNode(dst, m_catchBlock);
         generator.emitPopScope();
         generator.emitLabel(handlerEndLabel.get());
     }
@@ -2367,7 +1793,7 @@ RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 
         // emit the finally block itself
         generator.emitLabel(finallyStart.get());
-        generator.emitNode(dst, m_finallyBlock.get());
+        generator.emitNode(dst, m_finallyBlock);
         generator.emitSubroutineReturn(finallyReturnAddr.get());
 
         generator.emitLabel(finallyEndLabel.get());
@@ -2376,77 +1802,73 @@ RegisterID* TryNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
     return dst;
 }
 
-// ------------------------------ ParameterNode -----------------------------
-
-ParameterNode::~ParameterNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ParameterNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_next);
-}
-
 // -----------------------------ScopeNodeData ---------------------------
 
-ScopeNodeData::ScopeNodeData(SourceElements* children, VarStack* varStack, FunctionStack* funcStack, int numConstants)
+ScopeNodeData::ScopeNodeData(ParserArena& arena, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, int numConstants)
     : m_numConstants(numConstants)
 {
+    m_arena.swap(arena);
     if (varStack)
-        m_varStack = *varStack;
+        m_varStack.swap(*varStack);
     if (funcStack)
-        m_functionStack = *funcStack;
+        m_functionStack.swap(*funcStack);
     if (children)
         children->releaseContentsIntoVector(m_children);
 }
 
+void ScopeNodeData::mark()
+{
+    FunctionStack::iterator end = m_functionStack.end();
+    for (FunctionStack::iterator ptr = m_functionStack.begin(); ptr != end; ++ptr) {
+        FunctionBodyNode* body = (*ptr)->body();
+        if (!body->isGenerated())
+            continue;
+        body->generatedBytecode().mark();
+    }
+}
+
 // ------------------------------ ScopeNode -----------------------------
 
 ScopeNode::ScopeNode(JSGlobalData* globalData)
     : StatementNode(globalData)
+    , ParserArenaRefCounted(globalData)
     , m_features(NoFeatures)
 {
-#if ENABLE(OPCODE_SAMPLING)
-    globalData->interpreter->sampler()->notifyOfScope(this);
+#if ENABLE(CODEBLOCK_SAMPLING)
+    if (SamplingTool* sampler = globalData->interpreter->sampler())
+        sampler->notifyOfScope(this);
 #endif
 }
 
 ScopeNode::ScopeNode(JSGlobalData* globalData, const SourceCode& source, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, CodeFeatures features, int numConstants)
     : StatementNode(globalData)
-    , m_data(new ScopeNodeData(children, varStack, funcStack, numConstants))
+    , ParserArenaRefCounted(globalData)
+    , m_data(new ScopeNodeData(globalData->parser->arena(), children, varStack, funcStack, numConstants))
     , m_features(features)
     , m_source(source)
 {
-#if ENABLE(OPCODE_SAMPLING)
-    globalData->interpreter->sampler()->notifyOfScope(this);
+#if ENABLE(CODEBLOCK_SAMPLING)
+    if (SamplingTool* sampler = globalData->interpreter->sampler())
+        sampler->notifyOfScope(this);
 #endif
 }
 
-ScopeNode::~ScopeNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void ScopeNode::releaseNodes(NodeReleaser& releaser)
-{
-    if (!m_data)
-        return;
-    size_t size = m_data->m_children.size();
-    for (size_t i = 0; i < size; ++i)
-        releaser.release(m_data->m_children[i]);
-}
-
 // ------------------------------ ProgramNode -----------------------------
 
-ProgramNode::ProgramNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
+inline ProgramNode::ProgramNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
     : ScopeNode(globalData, source, children, varStack, funcStack, features, numConstants)
 {
 }
 
-ProgramNode* ProgramNode::create(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
+PassRefPtr<ProgramNode> ProgramNode::create(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
 {
-    return new ProgramNode(globalData, children, varStack, funcStack, source, features, numConstants);
+    RefPtr<ProgramNode> node = new ProgramNode(globalData, children, varStack, funcStack, source, features, numConstants);
+
+    ASSERT(node->data()->m_arena.last() == node);
+    node->data()->m_arena.removeLast();
+    ASSERT(!node->data()->m_arena.contains(node.get()));
+
+    return node.release();
 }
 
 RegisterID* ProgramNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
@@ -2469,22 +1891,39 @@ void ProgramNode::generateBytecode(ScopeChainNode* scopeChainNode)
     
     m_code.set(new ProgramCodeBlock(this, GlobalCode, globalObject, source().provider()));
     
-    BytecodeGenerator generator(this, globalObject->debugger(), scopeChain, &globalObject->symbolTable(), m_code.get());
-    generator.generate();
+    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(this, globalObject->debugger(), scopeChain, &globalObject->symbolTable(), m_code.get()));
+    generator->generate();
 
     destroyData();
 }
 
+#if ENABLE(JIT)
+void ProgramNode::generateJITCode(ScopeChainNode* scopeChainNode)
+{
+    bytecode(scopeChainNode);
+    ASSERT(m_code);
+    ASSERT(!m_jitCode);
+    JIT::compile(scopeChainNode->globalData, m_code.get());
+    ASSERT(m_jitCode);
+}
+#endif
+
 // ------------------------------ EvalNode -----------------------------
 
-EvalNode::EvalNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
+inline EvalNode::EvalNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
     : ScopeNode(globalData, source, children, varStack, funcStack, features, numConstants)
 {
 }
 
-EvalNode* EvalNode::create(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
+PassRefPtr<EvalNode> EvalNode::create(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& source, CodeFeatures features, int numConstants)
 {
-    return new EvalNode(globalData, children, varStack, funcStack, source, features, numConstants);
+    RefPtr<EvalNode> node = new EvalNode(globalData, children, varStack, funcStack, source, features, numConstants);
+
+    ASSERT(node->data()->m_arena.last() == node);
+    node->data()->m_arena.removeLast();
+    ASSERT(!node->data()->m_arena.contains(node.get()));
+
+    return node.release();
 }
 
 RegisterID* EvalNode::emitBytecode(BytecodeGenerator& generator, RegisterID*)
@@ -2505,53 +1944,67 @@ void EvalNode::generateBytecode(ScopeChainNode* scopeChainNode)
     ScopeChain scopeChain(scopeChainNode);
     JSGlobalObject* globalObject = scopeChain.globalObject();
 
-    m_code.set(new EvalCodeBlock(this, globalObject, source().provider()));
+    m_code.set(new EvalCodeBlock(this, globalObject, source().provider(), scopeChain.localDepth()));
 
-    BytecodeGenerator generator(this, globalObject->debugger(), scopeChain, &m_code->symbolTable(), m_code.get());
-    generator.generate();
+    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(this, globalObject->debugger(), scopeChain, &m_code->symbolTable(), m_code.get()));
+    generator->generate();
 
     // Eval code needs to hang on to its declaration stacks to keep declaration info alive until Interpreter::execute time,
     // so the entire ScopeNodeData cannot be destoyed.
     children().clear();
 }
 
-EvalCodeBlock& EvalNode::bytecodeForExceptionInfoReparse(ScopeChainNode* scopeChainNode)
+EvalCodeBlock& EvalNode::bytecodeForExceptionInfoReparse(ScopeChainNode* scopeChainNode, CodeBlock* codeBlockBeingRegeneratedFrom)
 {
     ASSERT(!m_code);
 
     ScopeChain scopeChain(scopeChainNode);
     JSGlobalObject* globalObject = scopeChain.globalObject();
 
-    m_code.set(new EvalCodeBlock(this, globalObject, source().provider()));
+    m_code.set(new EvalCodeBlock(this, globalObject, source().provider(), scopeChain.localDepth()));
 
-    BytecodeGenerator generator(this, globalObject->debugger(), scopeChain, &m_code->symbolTable(), m_code.get());
-    generator.setRegeneratingForExceptionInfo();
-    generator.generate();
+    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(this, globalObject->debugger(), scopeChain, &m_code->symbolTable(), m_code.get()));
+    generator->setRegeneratingForExceptionInfo(codeBlockBeingRegeneratedFrom);
+    generator->generate();
 
     return *m_code;
 }
 
+void EvalNode::mark()
+{
+    // We don't need to mark our own CodeBlock as the JSGlobalObject takes care of that
+    data()->mark();
+}
+
+#if ENABLE(JIT)
+void EvalNode::generateJITCode(ScopeChainNode* scopeChainNode)
+{
+    bytecode(scopeChainNode);
+    ASSERT(m_code);
+    ASSERT(!m_jitCode);
+    JIT::compile(scopeChainNode->globalData, m_code.get());
+    ASSERT(m_jitCode);
+}
+#endif
+
 // ------------------------------ FunctionBodyNode -----------------------------
 
-FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData)
+inline FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData)
     : ScopeNode(globalData)
     , m_parameters(0)
     , m_parameterCount(0)
-    , m_refCount(0)
 {
 }
 
-FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
+inline FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
     : ScopeNode(globalData, sourceCode, children, varStack, funcStack, features, numConstants)
     , m_parameters(0)
     , m_parameterCount(0)
-    , m_refCount(0)
 {
 }
 
 FunctionBodyNode::~FunctionBodyNode()
 {
-    ASSERT(!m_refCount);
     for (size_t i = 0; i < m_parameterCount; ++i)
         m_parameters[i].~Identifier();
     fastFree(m_parameters);
@@ -2581,14 +2034,36 @@ void FunctionBodyNode::mark()
         m_code->mark();
 }
 
+#if ENABLE(JIT)
+PassRefPtr<FunctionBodyNode> FunctionBodyNode::createNativeThunk(JSGlobalData* globalData)
+{
+    RefPtr<FunctionBodyNode> body = new FunctionBodyNode(globalData);
+    globalData->parser->arena().reset();
+    body->m_code.set(new CodeBlock(body.get()));
+    body->m_jitCode = JITCode(JITCode::HostFunction(globalData->jitStubs.ctiNativeCallThunk()));
+    return body.release();
+}
+#endif
+
+bool FunctionBodyNode::isHostFunction() const
+{
+    return m_code && m_code->codeType() == NativeCode;
+}
+
 FunctionBodyNode* FunctionBodyNode::create(JSGlobalData* globalData)
 {
     return new FunctionBodyNode(globalData);
 }
 
-FunctionBodyNode* FunctionBodyNode::create(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
+PassRefPtr<FunctionBodyNode> FunctionBodyNode::create(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
 {
-    return new FunctionBodyNode(globalData, children, varStack, funcStack, sourceCode, features, numConstants);
+    RefPtr<FunctionBodyNode> node = new FunctionBodyNode(globalData, children, varStack, funcStack, sourceCode, features, numConstants);
+
+    ASSERT(node->data()->m_arena.last() == node);
+    node->data()->m_arena.removeLast();
+    ASSERT(!node->data()->m_arena.contains(node.get()));
+
+    return node.release();
 }
 
 void FunctionBodyNode::generateBytecode(ScopeChainNode* scopeChainNode)
@@ -2604,13 +2079,24 @@ void FunctionBodyNode::generateBytecode(ScopeChainNode* scopeChainNode)
 
     m_code.set(new CodeBlock(this, FunctionCode, source().provider(), source().startOffset()));
 
-    BytecodeGenerator generator(this, globalObject->debugger(), scopeChain, &m_code->symbolTable(), m_code.get());
-    generator.generate();
+    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(this, globalObject->debugger(), scopeChain, &m_code->symbolTable(), m_code.get()));
+    generator->generate();
 
     destroyData();
 }
 
-CodeBlock& FunctionBodyNode::bytecodeForExceptionInfoReparse(ScopeChainNode* scopeChainNode)
+#if ENABLE(JIT)
+void FunctionBodyNode::generateJITCode(ScopeChainNode* scopeChainNode)
+{
+    bytecode(scopeChainNode);
+    ASSERT(m_code);
+    ASSERT(!m_jitCode);
+    JIT::compile(scopeChainNode->globalData, m_code.get());
+    ASSERT(m_jitCode);
+}
+#endif
+
+CodeBlock& FunctionBodyNode::bytecodeForExceptionInfoReparse(ScopeChainNode* scopeChainNode, CodeBlock* codeBlockBeingRegeneratedFrom)
 {
     ASSERT(!m_code);
 
@@ -2619,9 +2105,9 @@ CodeBlock& FunctionBodyNode::bytecodeForExceptionInfoReparse(ScopeChainNode* sco
 
     m_code.set(new CodeBlock(this, FunctionCode, source().provider(), source().startOffset()));
 
-    BytecodeGenerator generator(this, globalObject->debugger(), scopeChain, &m_code->symbolTable(), m_code.get());
-    generator.setRegeneratingForExceptionInfo();
-    generator.generate();
+    OwnPtr<BytecodeGenerator> generator(new BytecodeGenerator(this, globalObject->debugger(), scopeChain, &m_code->symbolTable(), m_code.get()));
+    generator->setRegeneratingForExceptionInfo(codeBlockBeingRegeneratedFrom);
+    generator->generate();
 
     return *m_code;
 }
@@ -2630,11 +2116,15 @@ RegisterID* FunctionBodyNode::emitBytecode(BytecodeGenerator& generator, Registe
 {
     generator.emitDebugHook(DidEnterCallFrame, firstLine(), lastLine());
     statementListEmitCode(children(), generator, generator.ignoredResult());
-    if (!children().size() || !children().last()->isReturnNode()) {
-        RegisterID* r0 = generator.emitLoad(0, jsUndefined());
-        generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
-        generator.emitReturn(r0);
+    if (children().size() && children().last()->isBlock()) {
+        BlockNode* blockNode = static_cast<BlockNode*>(children().last());
+        if (blockNode->children().size() && blockNode->children().last()->isReturnNode())
+            return 0;
     }
+
+    RegisterID* r0 = generator.emitLoad(0, jsUndefined());
+    generator.emitDebugHook(WillLeaveCallFrame, firstLine(), lastLine());
+    generator.emitReturn(r0);
     return 0;
 }
 
@@ -2659,17 +2149,6 @@ Identifier* FunctionBodyNode::copyParameters()
 
 // ------------------------------ FuncDeclNode ---------------------------------
 
-FuncDeclNode::~FuncDeclNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void FuncDeclNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_parameter);
-    releaser.release(m_body);
-}
-
 JSFunction* FuncDeclNode::makeFunction(ExecState* exec, ScopeChainNode* scopeChain)
 {
     return new (exec) JSFunction(exec, m_ident, m_body.get(), scopeChain);
@@ -2684,17 +2163,6 @@ RegisterID* FuncDeclNode::emitBytecode(BytecodeGenerator& generator, RegisterID*
 
 // ------------------------------ FuncExprNode ---------------------------------
 
-FuncExprNode::~FuncExprNode()
-{
-    NodeReleaser::releaseAllNodes(this);
-}
-
-void FuncExprNode::releaseNodes(NodeReleaser& releaser)
-{
-    releaser.release(m_parameter);
-    releaser.release(m_body);
-}
-
 RegisterID* FuncExprNode::emitBytecode(BytecodeGenerator& generator, RegisterID* dst)
 {
     return generator.emitNewFunctionExpression(generator.finalDestination(dst), this);
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
index 20885c3..a9f88b7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Nodes.h
@@ -23,34 +23,30 @@
  *
  */
 
-#ifndef NODES_H_
-#define NODES_H_
+#ifndef Nodes_h
+#define Nodes_h
 
 #include "Error.h"
+#include "JITCode.h"
 #include "Opcode.h"
+#include "ParserArena.h"
 #include "ResultType.h"
 #include "SourceCode.h"
 #include "SymbolTable.h"
 #include <wtf/MathExtras.h>
 #include <wtf/OwnPtr.h>
-#include <wtf/Vector.h>
-
-#if PLATFORM(X86) && COMPILER(GCC)
-#define JSC_FAST_CALL __attribute__((regparm(3)))
-#else
-#define JSC_FAST_CALL
-#endif
 
 namespace JSC {
 
+    class ArgumentListNode;
     class CodeBlock;
     class BytecodeGenerator;
     class FuncDeclNode;
     class EvalCodeBlock;
     class JSFunction;
-    class NodeReleaser;
     class ProgramCodeBlock;
     class PropertyListNode;
+    class ReadModifyResolveNode;
     class RegisterID;
     class ScopeChainNode;
 
@@ -91,7 +87,7 @@ namespace JSC {
     namespace DeclarationStacks {
         enum VarAttrs { IsConstant = 1, HasInitializer = 2 };
         typedef Vector<std::pair<Identifier, unsigned> > VarStack;
-        typedef Vector<RefPtr<FuncDeclNode> > FunctionStack;
+        typedef Vector<FuncDeclNode*> FunctionStack;
     }
 
     struct SwitchInfo {
@@ -100,30 +96,37 @@ namespace JSC {
         SwitchType switchType;
     };
 
-    class ParserRefCounted : Noncopyable {
+    class ParserArenaDeletable {
     protected:
-        ParserRefCounted(JSGlobalData*) JSC_FAST_CALL;
+        ParserArenaDeletable() { }
 
     public:
-        virtual ~ParserRefCounted();
+        virtual ~ParserArenaDeletable() { }
 
-        // Nonrecursive destruction.
-        virtual void releaseNodes(NodeReleaser&);
+        // Objects created with this version of new are deleted when the arena is deleted.
+        void* operator new(size_t, JSGlobalData*);
 
-        void ref() JSC_FAST_CALL;
-        void deref() JSC_FAST_CALL;
-        bool hasOneRef() JSC_FAST_CALL;
+        // Objects created with this version of new are not deleted when the arena is deleted.
+        // Other arrangements must be made.
+        void* operator new(size_t);
+    };
 
-        static void deleteNewObjects(JSGlobalData*) JSC_FAST_CALL;
+    class ParserArenaRefCounted : public RefCounted<ParserArenaRefCounted> {
+    protected:
+        ParserArenaRefCounted(JSGlobalData*);
 
-    private:
-        JSGlobalData* m_globalData;
+    public:
+        virtual ~ParserArenaRefCounted()
+        {
+            ASSERT(deletionHasBegun());
+        }
     };
 
-    class Node : public ParserRefCounted {
-    public:
-        Node(JSGlobalData*) JSC_FAST_CALL;
+    class Node : public ParserArenaDeletable {
+    protected:
+        Node(JSGlobalData*);
 
+    public:
         /*
             Return value: The register holding the production's value.
                      dst: An optional parameter specifying the most efficient
@@ -146,7 +149,7 @@ namespace JSC {
             because the assignment node, "x =", passes r[x] as dst to the number
             node, "1".
         */
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* dst = 0) JSC_FAST_CALL = 0;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* dst = 0) = 0;
 
         int lineNo() const { return m_line; }
 
@@ -156,46 +159,45 @@ namespace JSC {
 
     class ExpressionNode : public Node {
     public:
-        ExpressionNode(JSGlobalData* globalData, ResultType resultDesc = ResultType::unknown()) JSC_FAST_CALL
-            : Node(globalData)
-            , m_resultDesc(resultDesc)
-        {
-        }
-
-        virtual bool isNumber() const JSC_FAST_CALL { return false; }
-        virtual bool isString() const JSC_FAST_CALL { return false; }
-        virtual bool isNull() const JSC_FAST_CALL { return false; }
-        virtual bool isPure(BytecodeGenerator&) const JSC_FAST_CALL { return false; }        
-        virtual bool isLocation() const JSC_FAST_CALL { return false; }
-        virtual bool isResolveNode() const JSC_FAST_CALL { return false; }
-        virtual bool isBracketAccessorNode() const JSC_FAST_CALL { return false; }
-        virtual bool isDotAccessorNode() const JSC_FAST_CALL { return false; }
-        virtual bool isFuncExprNode() const JSC_FAST_CALL { return false; } 
+        ExpressionNode(JSGlobalData*, ResultType = ResultType::unknownType());
+
+        virtual bool isNumber() const { return false; }
+        virtual bool isString() const { return false; }
+        virtual bool isNull() const { return false; }
+        virtual bool isPure(BytecodeGenerator&) const { return false; }        
+        virtual bool isLocation() const { return false; }
+        virtual bool isResolveNode() const { return false; }
+        virtual bool isBracketAccessorNode() const { return false; }
+        virtual bool isDotAccessorNode() const { return false; }
+        virtual bool isFuncExprNode() const { return false; }
+        virtual bool isCommaNode() const { return false; }
+        virtual bool isSimpleArray() const { return false; }
+        virtual bool isAdd() const { return false; }
 
         virtual ExpressionNode* stripUnaryPlus() { return this; }
 
-        ResultType resultDescriptor() const JSC_FAST_CALL { return m_resultDesc; }
+        ResultType resultDescriptor() const { return m_resultType; }
 
         // This needs to be in public in order to compile using GCC 3.x 
         typedef enum { EvalOperator, FunctionCall } CallerType;
 
     private:
-        ResultType m_resultDesc;
+        ResultType m_resultType;
     };
 
     class StatementNode : public Node {
     public:
-        StatementNode(JSGlobalData*) JSC_FAST_CALL;
-        void setLoc(int line0, int line1) JSC_FAST_CALL;
-        int firstLine() const JSC_FAST_CALL { return lineNo(); }
-        int lastLine() const JSC_FAST_CALL { return m_lastLine; }
+        StatementNode(JSGlobalData*);
 
-        virtual bool isEmptyStatement() const JSC_FAST_CALL { return false; }
-        virtual bool isReturnNode() const JSC_FAST_CALL { return false; }
-        virtual bool isExprStatement() const JSC_FAST_CALL { return false; }
+        void setLoc(int line0, int line1);
+        int firstLine() const { return lineNo(); }
+        int lastLine() const { return m_lastLine; }
 
-        virtual bool isBlock() const JSC_FAST_CALL { return false; }
-        virtual bool isLoop() const JSC_FAST_CALL { return false; }
+        virtual bool isEmptyStatement() const { return false; }
+        virtual bool isReturnNode() const { return false; }
+        virtual bool isExprStatement() const { return false; }
+
+        virtual bool isBlock() const { return false; }
 
     private:
         int m_lastLine;
@@ -203,66 +205,54 @@ namespace JSC {
 
     class NullNode : public ExpressionNode {
     public:
-        NullNode(JSGlobalData* globalData) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::nullType())
-        {
-        }
+        NullNode(JSGlobalData*);
 
-        virtual bool isNull() const JSC_FAST_CALL { return true; }
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        virtual bool isNull() const { return true; }
     };
 
     class BooleanNode : public ExpressionNode {
     public:
-        BooleanNode(JSGlobalData* globalData, bool value) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::boolean())
-            , m_value(value)
-        {
-        }
+        BooleanNode(JSGlobalData*, bool value);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        virtual bool isPure(BytecodeGenerator&) const JSC_FAST_CALL { return true; }
+        virtual bool isPure(BytecodeGenerator&) const { return true; }
 
-    private:
         bool m_value;
     };
 
     class NumberNode : public ExpressionNode {
     public:
-        NumberNode(JSGlobalData* globalData, double v) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::constNumber())
-            , m_double(v)
-        {
-        }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        NumberNode(JSGlobalData*, double v);
 
-        virtual bool isNumber() const JSC_FAST_CALL { return true; }
-        virtual bool isPure(BytecodeGenerator&) const JSC_FAST_CALL { return true; }
-        double value() const JSC_FAST_CALL { return m_double; }
-        void setValue(double d) JSC_FAST_CALL { m_double = d; }
+        double value() const { return m_double; }
+        void setValue(double d) { m_double = d; }
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        virtual bool isNumber() const { return true; }
+        virtual bool isPure(BytecodeGenerator&) const { return true; }
+
         double m_double;
     };
 
     class StringNode : public ExpressionNode {
     public:
-        StringNode(JSGlobalData* globalData, const Identifier& v) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::string())
-            , m_value(v)
-        {
-        }
+        StringNode(JSGlobalData*, const Identifier& v);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        
-        virtual bool isString() const JSC_FAST_CALL { return true; }
         const Identifier& value() { return m_value; }
-        virtual bool isPure(BytecodeGenerator&) const JSC_FAST_CALL { return true; }
+        virtual bool isPure(BytecodeGenerator&) const { return true; }
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+        
+        virtual bool isString() const { return true; }
+
         Identifier m_value;
     };
     
@@ -365,1158 +355,682 @@ namespace JSC {
 
     class RegExpNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        RegExpNode(JSGlobalData* globalData, const UString& pattern, const UString& flags) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_pattern(pattern)
-            , m_flags(flags)
-        {
-        }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        RegExpNode(JSGlobalData*, const UString& pattern, const UString& flags);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         UString m_pattern;
         UString m_flags;
     };
 
     class ThisNode : public ExpressionNode {
     public:
-        ThisNode(JSGlobalData* globalData) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-        {
-        }
+        ThisNode(JSGlobalData*);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
     class ResolveNode : public ExpressionNode {
     public:
-        ResolveNode(JSGlobalData* globalData, const Identifier& ident, int startOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_ident(ident)
-            , m_startOffset(startOffset)
-        {
-        }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ResolveNode(JSGlobalData*, const Identifier&, int startOffset);
 
-        virtual bool isPure(BytecodeGenerator&) const JSC_FAST_CALL;
-        virtual bool isLocation() const JSC_FAST_CALL { return true; }
-        virtual bool isResolveNode() const JSC_FAST_CALL { return true; }
-        const Identifier& identifier() const JSC_FAST_CALL { return m_ident; }
+        const Identifier& identifier() const { return m_ident; }
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        virtual bool isPure(BytecodeGenerator&) const ;
+        virtual bool isLocation() const { return true; }
+        virtual bool isResolveNode() const { return true; }
+
         Identifier m_ident;
         int32_t m_startOffset;
     };
 
-    class ElementNode : public ParserRefCounted {
+    class ElementNode : public ParserArenaDeletable {
     public:
-        ElementNode(JSGlobalData* globalData, int elision, ExpressionNode* node) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_elision(elision)
-            , m_node(node)
-        {
-        }
-
-        ElementNode(JSGlobalData* globalData, ElementNode* l, int elision, ExpressionNode* node) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_elision(elision)
-            , m_node(node)
-        {
-            l->m_next = this;
-        }
-
-        virtual ~ElementNode();
-        virtual void releaseNodes(NodeReleaser&);
+        ElementNode(JSGlobalData*, int elision, ExpressionNode*);
+        ElementNode(JSGlobalData*, ElementNode*, int elision, ExpressionNode*);
 
         int elision() const { return m_elision; }
-        ExpressionNode* value() { return m_node.get(); }
-
-        ElementNode* next() { return m_next.get(); }
+        ExpressionNode* value() { return m_node; }
+        ElementNode* next() { return m_next; }
 
     private:
-        RefPtr<ElementNode> m_next;
+        ElementNode* m_next;
         int m_elision;
-        RefPtr<ExpressionNode> m_node;
+        ExpressionNode* m_node;
     };
 
     class ArrayNode : public ExpressionNode {
     public:
-        ArrayNode(JSGlobalData* globalData, int elision) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_elision(elision)
-            , m_optional(true)
-        {
-        }
+        ArrayNode(JSGlobalData*, int elision);
+        ArrayNode(JSGlobalData*, ElementNode*);
+        ArrayNode(JSGlobalData*, int elision, ElementNode*);
 
-        ArrayNode(JSGlobalData* globalData, ElementNode* element) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_element(element)
-            , m_elision(0)
-            , m_optional(false)
-        {
-        }
-
-        ArrayNode(JSGlobalData* globalData, int elision, ElementNode* element) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_element(element)
-            , m_elision(elision)
-            , m_optional(true)
-        {
-        }
+        ArgumentListNode* toArgumentList(JSGlobalData*) const;
 
-        virtual ~ArrayNode();
-        virtual void releaseNodes(NodeReleaser&);
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        virtual bool isSimpleArray() const ;
 
-    private:
-        RefPtr<ElementNode> m_element;
+        ElementNode* m_element;
         int m_elision;
         bool m_optional;
     };
 
-    class PropertyNode : public ParserRefCounted {
+    class PropertyNode : public ParserArenaDeletable {
     public:
         enum Type { Constant, Getter, Setter };
 
-        PropertyNode(JSGlobalData* globalData, const Identifier& name, ExpressionNode* assign, Type type) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_name(name)
-            , m_assign(assign)
-            , m_type(type)
-        {
-        }
-
-        virtual ~PropertyNode();
-        virtual void releaseNodes(NodeReleaser&);
+        PropertyNode(JSGlobalData*, const Identifier& name, ExpressionNode* value, Type);
 
         const Identifier& name() const { return m_name; }
 
     private:
         friend class PropertyListNode;
         Identifier m_name;
-        RefPtr<ExpressionNode> m_assign;
+        ExpressionNode* m_assign;
         Type m_type;
     };
 
     class PropertyListNode : public Node {
     public:
-        PropertyListNode(JSGlobalData* globalData, PropertyNode* node) JSC_FAST_CALL
-            : Node(globalData)
-            , m_node(node)
-        {
-        }
+        PropertyListNode(JSGlobalData*, PropertyNode*);
+        PropertyListNode(JSGlobalData*, PropertyNode*, PropertyListNode*);
 
-        PropertyListNode(JSGlobalData* globalData, PropertyNode* node, PropertyListNode* list) JSC_FAST_CALL
-            : Node(globalData)
-            , m_node(node)
-        {
-            list->m_next = this;
-        }
-
-        virtual ~PropertyListNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
     private:
-        RefPtr<PropertyNode> m_node;
-        RefPtr<PropertyListNode> m_next;
+        PropertyNode* m_node;
+        PropertyListNode* m_next;
     };
 
     class ObjectLiteralNode : public ExpressionNode {
     public:
-        ObjectLiteralNode(JSGlobalData* globalData) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-        {
-        }
-
-        ObjectLiteralNode(JSGlobalData* globalData, PropertyListNode* list) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_list(list)
-        {
-        }
-
-        virtual ~ObjectLiteralNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ObjectLiteralNode(JSGlobalData*);
+        ObjectLiteralNode(JSGlobalData*, PropertyListNode*);
 
     private:
-        RefPtr<PropertyListNode> m_list;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        PropertyListNode* m_list;
     };
     
     class BracketAccessorNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        BracketAccessorNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, bool subscriptHasAssignments) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_base(base)
-            , m_subscript(subscript)
-            , m_subscriptHasAssignments(subscriptHasAssignments)
-        {
-        }
+        BracketAccessorNode(JSGlobalData*, ExpressionNode* base, ExpressionNode* subscript, bool subscriptHasAssignments);
 
-        virtual ~BracketAccessorNode();
-        virtual void releaseNodes(NodeReleaser&);
+        ExpressionNode* base() const { return m_base; }
+        ExpressionNode* subscript() const { return m_subscript; }
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        virtual bool isLocation() const JSC_FAST_CALL { return true; }
-        virtual bool isBracketAccessorNode() const JSC_FAST_CALL { return true; }
-        ExpressionNode* base() JSC_FAST_CALL { return m_base.get(); }
-        ExpressionNode* subscript() JSC_FAST_CALL { return m_subscript.get(); }
+        virtual bool isLocation() const { return true; }
+        virtual bool isBracketAccessorNode() const { return true; }
 
-    private:
-        RefPtr<ExpressionNode> m_base;
-        RefPtr<ExpressionNode> m_subscript;
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
         bool m_subscriptHasAssignments;
     };
 
     class DotAccessorNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        DotAccessorNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_base(base)
-            , m_ident(ident)
-        {
-        }
+        DotAccessorNode(JSGlobalData*, ExpressionNode* base, const Identifier&);
 
-        virtual ~DotAccessorNode();
-        virtual void releaseNodes(NodeReleaser&);
+        ExpressionNode* base() const { return m_base; }
+        const Identifier& identifier() const { return m_ident; }
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        virtual bool isLocation() const JSC_FAST_CALL { return true; }
-        virtual bool isDotAccessorNode() const JSC_FAST_CALL { return true; }
-        ExpressionNode* base() const JSC_FAST_CALL { return m_base.get(); }
-        const Identifier& identifier() const JSC_FAST_CALL { return m_ident; }
+        virtual bool isLocation() const { return true; }
+        virtual bool isDotAccessorNode() const { return true; }
 
-    private:
-        RefPtr<ExpressionNode> m_base;
+        ExpressionNode* m_base;
         Identifier m_ident;
     };
 
     class ArgumentListNode : public Node {
     public:
-        ArgumentListNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : Node(globalData)
-            , m_expr(expr)
-        {
-        }
-
-        ArgumentListNode(JSGlobalData* globalData, ArgumentListNode* listNode, ExpressionNode* expr) JSC_FAST_CALL
-            : Node(globalData)
-            , m_expr(expr)
-        {
-            listNode->m_next = this;
-        }
-
-        virtual ~ArgumentListNode();
-        virtual void releaseNodes(NodeReleaser&);
+        ArgumentListNode(JSGlobalData*, ExpressionNode*);
+        ArgumentListNode(JSGlobalData*, ArgumentListNode*, ExpressionNode*);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ArgumentListNode* m_next;
+        ExpressionNode* m_expr;
 
-        RefPtr<ArgumentListNode> m_next;
-        RefPtr<ExpressionNode> m_expr;
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
-    class ArgumentsNode : public ParserRefCounted {
+    class ArgumentsNode : public ParserArenaDeletable {
     public:
-        ArgumentsNode(JSGlobalData* globalData) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-        {
-        }
-
-        ArgumentsNode(JSGlobalData* globalData, ArgumentListNode* listNode) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_listNode(listNode)
-        {
-        }
-
-        virtual ~ArgumentsNode();
-        virtual void releaseNodes(NodeReleaser&);
+        ArgumentsNode(JSGlobalData*);
+        ArgumentsNode(JSGlobalData*, ArgumentListNode*);
 
-        RefPtr<ArgumentListNode> m_listNode;
+        ArgumentListNode* m_listNode;
     };
 
     class NewExprNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        NewExprNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_expr(expr)
-        {
-        }
-
-        NewExprNode(JSGlobalData* globalData, ExpressionNode* expr, ArgumentsNode* args) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_expr(expr)
-            , m_args(args)
-        {
-        }
-
-        virtual ~NewExprNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        NewExprNode(JSGlobalData*, ExpressionNode*);
+        NewExprNode(JSGlobalData*, ExpressionNode*, ArgumentsNode*);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
-        RefPtr<ArgumentsNode> m_args;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
+        ArgumentsNode* m_args;
     };
 
     class EvalFunctionCallNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        EvalFunctionCallNode(JSGlobalData* globalData, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_args(args)
-        {
-        }
-
-        virtual ~EvalFunctionCallNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        EvalFunctionCallNode(JSGlobalData*, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ArgumentsNode> m_args;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ArgumentsNode* m_args;
     };
 
     class FunctionCallValueNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        FunctionCallValueNode(JSGlobalData* globalData, ExpressionNode* expr, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_expr(expr)
-            , m_args(args)
-        {
-        }
-
-        virtual ~FunctionCallValueNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        FunctionCallValueNode(JSGlobalData*, ExpressionNode*, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
-        RefPtr<ArgumentsNode> m_args;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
+        ArgumentsNode* m_args;
     };
 
     class FunctionCallResolveNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        FunctionCallResolveNode(JSGlobalData* globalData, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_ident(ident)
-            , m_args(args)
-        {
-        }
-
-        virtual ~FunctionCallResolveNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        FunctionCallResolveNode(JSGlobalData*, const Identifier&, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
-        RefPtr<ArgumentsNode> m_args;
+        ArgumentsNode* m_args;
         size_t m_index; // Used by LocalVarFunctionCallNode.
         size_t m_scopeDepth; // Used by ScopedVarFunctionCallNode and NonLocalVarFunctionCallNode
     };
     
     class FunctionCallBracketNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        FunctionCallBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_subscript(subscript)
-            , m_args(args)
-        {
-        }
-
-        virtual ~FunctionCallBracketNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        FunctionCallBracketNode(JSGlobalData*, ExpressionNode* base, ExpressionNode* subscript, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
-        RefPtr<ExpressionNode> m_subscript;
-        RefPtr<ArgumentsNode> m_args;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
+        ArgumentsNode* m_args;
     };
 
     class FunctionCallDotNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        FunctionCallDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, ArgumentsNode* args, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_ident(ident)
-            , m_args(args)
-        {
-        }
+        FunctionCallDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
-        virtual ~FunctionCallDotNode();
-        virtual void releaseNodes(NodeReleaser&);
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    protected:
+        ExpressionNode* m_base;
+        const Identifier m_ident;
+        ArgumentsNode* m_args;
+    };
+
+    class CallFunctionCallDotNode : public FunctionCallDotNode {
+    public:
+        CallFunctionCallDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
-        Identifier m_ident;
-        RefPtr<ArgumentsNode> m_args;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+    };
+    
+    class ApplyFunctionCallDotNode : public FunctionCallDotNode {
+    public:
+        ApplyFunctionCallDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, ArgumentsNode*, unsigned divot, unsigned startOffset, unsigned endOffset);
+
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
     class PrePostResolveNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        PrePostResolveNode(JSGlobalData* globalData, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::constNumber()) // could be reusable for pre?
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_ident(ident)
-        {
-        }
+        PrePostResolveNode(JSGlobalData*, const Identifier&, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     protected:
-        Identifier m_ident;
+        const Identifier m_ident;
     };
 
     class PostfixResolveNode : public PrePostResolveNode {
     public:
-        PostfixResolveNode(JSGlobalData* globalData, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : PrePostResolveNode(globalData, ident, divot, startOffset, endOffset)
-            , m_operator(oper)
-        {
-        }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PostfixResolveNode(JSGlobalData*, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Operator m_operator;
     };
 
     class PostfixBracketNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        PostfixBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_subscript(subscript)
-            , m_operator(oper)
-        {
-        }
-
-        virtual ~PostfixBracketNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PostfixBracketNode(JSGlobalData*, ExpressionNode* base, ExpressionNode* subscript, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
-        RefPtr<ExpressionNode> m_subscript;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
         Operator m_operator;
     };
 
     class PostfixDotNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        PostfixDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_ident(ident)
-            , m_operator(oper)
-        {
-        }
-
-        virtual ~PostfixDotNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PostfixDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
         Identifier m_ident;
         Operator m_operator;
     };
 
     class PostfixErrorNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        PostfixErrorNode(JSGlobalData* globalData, ExpressionNode* expr, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableSubExpressionData(divot, startOffset, endOffset)
-            , m_expr(expr)
-            , m_operator(oper)
-        {
-        }
-
-        virtual ~PostfixErrorNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PostfixErrorNode(JSGlobalData*, ExpressionNode*, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
         Operator m_operator;
     };
 
     class DeleteResolveNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        DeleteResolveNode(JSGlobalData* globalData, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_ident(ident)
-        {
-        }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        DeleteResolveNode(JSGlobalData*, const Identifier&, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
     };
 
     class DeleteBracketNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        DeleteBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_subscript(subscript)
-        {
-        }
-
-        virtual ~DeleteBracketNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        DeleteBracketNode(JSGlobalData*, ExpressionNode* base, ExpressionNode* subscript, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
-        RefPtr<ExpressionNode> m_subscript;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
     };
 
     class DeleteDotNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        DeleteDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_ident(ident)
-        {
-        }
-
-        virtual ~DeleteDotNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        DeleteDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
         Identifier m_ident;
     };
 
     class DeleteValueNode : public ExpressionNode {
     public:
-        DeleteValueNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_expr(expr)
-        {
-        }
-
-        virtual ~DeleteValueNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        DeleteValueNode(JSGlobalData*, ExpressionNode*);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
     };
 
     class VoidNode : public ExpressionNode {
     public:
-        VoidNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_expr(expr)
-        {
-        }
-
-        virtual ~VoidNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        VoidNode(JSGlobalData*, ExpressionNode*);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
     };
 
     class TypeOfResolveNode : public ExpressionNode {
     public:
-        TypeOfResolveNode(JSGlobalData* globalData, const Identifier& ident) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::string())
-            , m_ident(ident)
-        {
-        }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        TypeOfResolveNode(JSGlobalData*, const Identifier&);
 
-        const Identifier& identifier() const JSC_FAST_CALL { return m_ident; }
+        const Identifier& identifier() const { return m_ident; }
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
     };
 
     class TypeOfValueNode : public ExpressionNode {
     public:
-        TypeOfValueNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::string())
-            , m_expr(expr)
-        {
-        }
-
-        virtual ~TypeOfValueNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        TypeOfValueNode(JSGlobalData*, ExpressionNode*);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
     };
 
     class PrefixResolveNode : public PrePostResolveNode {
     public:
-        PrefixResolveNode(JSGlobalData* globalData, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : PrePostResolveNode(globalData, ident, divot, startOffset, endOffset)
-            , m_operator(oper)
-        {
-        }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PrefixResolveNode(JSGlobalData*, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Operator m_operator;
     };
 
     class PrefixBracketNode : public ExpressionNode, public ThrowablePrefixedSubExpressionData {
     public:
-        PrefixBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowablePrefixedSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_subscript(subscript)
-            , m_operator(oper)
-        {
-        }
-
-        virtual ~PrefixBracketNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PrefixBracketNode(JSGlobalData*, ExpressionNode* base, ExpressionNode* subscript, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
-        RefPtr<ExpressionNode> m_subscript;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
         Operator m_operator;
     };
 
     class PrefixDotNode : public ExpressionNode, public ThrowablePrefixedSubExpressionData {
     public:
-        PrefixDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowablePrefixedSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_ident(ident)
-            , m_operator(oper)
-        {
-        }
-
-        virtual ~PrefixDotNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PrefixDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
         Identifier m_ident;
         Operator m_operator;
     };
 
     class PrefixErrorNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        PrefixErrorNode(JSGlobalData* globalData, ExpressionNode* expr, Operator oper, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_expr(expr)
-            , m_operator(oper)
-        {
-        }
-
-        virtual ~PrefixErrorNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        PrefixErrorNode(JSGlobalData*, ExpressionNode*, Operator, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
         Operator m_operator;
     };
 
     class UnaryOpNode : public ExpressionNode {
     public:
-        UnaryOpNode(JSGlobalData* globalData, ExpressionNode* expr)
-            : ExpressionNode(globalData)
-            , m_expr(expr)
-        {
-        }
+        UnaryOpNode(JSGlobalData*, ResultType, ExpressionNode*, OpcodeID);
 
-        UnaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr)
-            : ExpressionNode(globalData, type)
-            , m_expr(expr)
-        {
-        }
+    protected:
+        ExpressionNode* expr() { return m_expr; }
 
-        virtual ~UnaryOpNode();
-        virtual void releaseNodes(NodeReleaser&);
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL = 0;
+        OpcodeID opcodeID() const { return m_opcodeID; }
 
-    protected:
-        RefPtr<ExpressionNode> m_expr;
+        ExpressionNode* m_expr;
+        OpcodeID m_opcodeID;
     };
 
     class UnaryPlusNode : public UnaryOpNode {
     public:
-        UnaryPlusNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : UnaryOpNode(globalData, ResultType::constNumber(), expr)
-        {
-        }
+        UnaryPlusNode(JSGlobalData*, ExpressionNode*);
 
-        virtual ExpressionNode* stripUnaryPlus() { return m_expr.get(); }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_to_jsnumber; }
+    private:
+        virtual ExpressionNode* stripUnaryPlus() { return expr(); }
     };
 
     class NegateNode : public UnaryOpNode {
     public:
-        NegateNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : UnaryOpNode(globalData, ResultType::reusableNumber(), expr)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_negate; }
+        NegateNode(JSGlobalData*, ExpressionNode*);
     };
 
     class BitwiseNotNode : public UnaryOpNode {
     public:
-        BitwiseNotNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : UnaryOpNode(globalData, ResultType::reusableNumber(), expr)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_bitnot; }
+        BitwiseNotNode(JSGlobalData*, ExpressionNode*);
     };
 
     class LogicalNotNode : public UnaryOpNode {
     public:
-        LogicalNotNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : UnaryOpNode(globalData, ResultType::boolean(), expr)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_not; }
+        LogicalNotNode(JSGlobalData*, ExpressionNode*);
     };
 
     class BinaryOpNode : public ExpressionNode {
     public:
-        BinaryOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-            : ExpressionNode(globalData)
-            , m_expr1(expr1)
-            , m_expr2(expr2)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
+        BinaryOpNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
+        BinaryOpNode(JSGlobalData*, ResultType, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
 
-        BinaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-            : ExpressionNode(globalData, type)
-            , m_expr1(expr1)
-            , m_expr2(expr2)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
+        RegisterID* emitStrcat(BytecodeGenerator& generator, RegisterID* dst, RegisterID* lhs = 0, ReadModifyResolveNode* emitExpressionInfoForMe = 0);
 
-        virtual ~BinaryOpNode();
-        virtual void releaseNodes(NodeReleaser&);
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL = 0;
+    protected:
+        OpcodeID opcodeID() const { return m_opcodeID; }
 
     protected:
-        RefPtr<ExpressionNode> m_expr1;
-        RefPtr<ExpressionNode> m_expr2;
+        ExpressionNode* m_expr1;
+        ExpressionNode* m_expr2;
+    private:
+        OpcodeID m_opcodeID;
+    protected:
         bool m_rightHasAssignments;
     };
 
     class ReverseBinaryOpNode : public BinaryOpNode {
     public:
-        ReverseBinaryOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-            : BinaryOpNode(globalData, expr1, expr2, rightHasAssignments)
-        {
-        }
+        ReverseBinaryOpNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
+        ReverseBinaryOpNode(JSGlobalData*, ResultType, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
 
-        ReverseBinaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-            : BinaryOpNode(globalData, type, expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
     class MultNode : public BinaryOpNode {
     public:
-        MultNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::reusableNumber(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_mul; }
+        MultNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class DivNode : public BinaryOpNode {
     public:
-        DivNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::reusableNumber(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_div; }
+        DivNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class ModNode : public BinaryOpNode {
     public:
-        ModNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::reusableNumber(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_mod; }
+        ModNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class AddNode : public BinaryOpNode {
     public:
-        AddNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::forAdd(expr1->resultDescriptor(), expr2->resultDescriptor()), expr1, expr2, rightHasAssignments)
-        {
-        }
+        AddNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
 
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_add; }
+        virtual bool isAdd() const { return true; }
     };
 
     class SubNode : public BinaryOpNode {
     public:
-        SubNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::reusableNumber(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_sub; }
+        SubNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class LeftShiftNode : public BinaryOpNode {
     public:
-        LeftShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::reusableNumber(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_lshift; }
+        LeftShiftNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class RightShiftNode : public BinaryOpNode {
     public:
-        RightShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::reusableNumber(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_rshift; }
+        RightShiftNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class UnsignedRightShiftNode : public BinaryOpNode {
     public:
-        UnsignedRightShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::reusableNumber(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_urshift; }
+        UnsignedRightShiftNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class LessNode : public BinaryOpNode {
     public:
-        LessNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::boolean(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_less; }
+        LessNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class GreaterNode : public ReverseBinaryOpNode {
     public:
-        GreaterNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : ReverseBinaryOpNode(globalData, ResultType::boolean(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_less; }
+        GreaterNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class LessEqNode : public BinaryOpNode {
     public:
-        LessEqNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::boolean(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_lesseq; }
+        LessEqNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class GreaterEqNode : public ReverseBinaryOpNode {
     public:
-        GreaterEqNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : ReverseBinaryOpNode(globalData, ResultType::boolean(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_lesseq; }
+        GreaterEqNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class ThrowableBinaryOpNode : public BinaryOpNode, public ThrowableExpressionData {
     public:
-        ThrowableBinaryOpNode(JSGlobalData* globalData, ResultType type, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, type, expr1, expr2, rightHasAssignments)
-        {
-        }
-        ThrowableBinaryOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, expr1, expr2, rightHasAssignments)
-        {
-        }
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ThrowableBinaryOpNode(JSGlobalData*, ResultType, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
+        ThrowableBinaryOpNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, OpcodeID, bool rightHasAssignments);
+
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
     
     class InstanceOfNode : public ThrowableBinaryOpNode {
     public:
-        InstanceOfNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : ThrowableBinaryOpNode(globalData, ResultType::boolean(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_instanceof; }
+        InstanceOfNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
     class InNode : public ThrowableBinaryOpNode {
     public:
-        InNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : ThrowableBinaryOpNode(globalData, expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_in; }
+        InNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class EqualNode : public BinaryOpNode {
     public:
-        EqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::boolean(), expr1, expr2, rightHasAssignments)
-        {
-        }
+        EqualNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_eq; }
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
     class NotEqualNode : public BinaryOpNode {
     public:
-        NotEqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::boolean(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_neq; }
+        NotEqualNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class StrictEqualNode : public BinaryOpNode {
     public:
-        StrictEqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::boolean(), expr1, expr2, rightHasAssignments)
-        {
-        }
+        StrictEqualNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_stricteq; }
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
     class NotStrictEqualNode : public BinaryOpNode {
     public:
-        NotStrictEqualNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::boolean(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_nstricteq; }
+        NotStrictEqualNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class BitAndNode : public BinaryOpNode {
     public:
-        BitAndNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::reusableNumber(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_bitand; }
+        BitAndNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class BitOrNode : public BinaryOpNode {
     public:
-        BitOrNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::reusableNumber(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_bitor; }
+        BitOrNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
     class BitXOrNode : public BinaryOpNode {
     public:
-        BitXOrNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments) JSC_FAST_CALL
-            : BinaryOpNode(globalData, ResultType::reusableNumber(), expr1, expr2, rightHasAssignments)
-        {
-        }
-
-        virtual OpcodeID opcodeID() const JSC_FAST_CALL { return op_bitxor; }
+        BitXOrNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments);
     };
 
-    /**
-     * m_expr1 && m_expr2, m_expr1 || m_expr2
-     */
+    // m_expr1 && m_expr2, m_expr1 || m_expr2
     class LogicalOpNode : public ExpressionNode {
     public:
-        LogicalOpNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, LogicalOperator oper) JSC_FAST_CALL
-            : ExpressionNode(globalData, ResultType::boolean())
-            , m_expr1(expr1)
-            , m_expr2(expr2)
-            , m_operator(oper)
-        {
-        }
-
-        virtual ~LogicalOpNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        LogicalOpNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, LogicalOperator);
 
     private:
-        RefPtr<ExpressionNode> m_expr1;
-        RefPtr<ExpressionNode> m_expr2;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr1;
+        ExpressionNode* m_expr2;
         LogicalOperator m_operator;
     };
 
-    /**
-     * The ternary operator, "m_logical ? m_expr1 : m_expr2"
-     */
+    // The ternary operator, "m_logical ? m_expr1 : m_expr2"
     class ConditionalNode : public ExpressionNode {
     public:
-        ConditionalNode(JSGlobalData* globalData, ExpressionNode* logical, ExpressionNode* expr1, ExpressionNode* expr2) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_logical(logical)
-            , m_expr1(expr1)
-            , m_expr2(expr2)
-        {
-        }
-
-        virtual ~ConditionalNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ConditionalNode(JSGlobalData*, ExpressionNode* logical, ExpressionNode* expr1, ExpressionNode* expr2);
 
     private:
-        RefPtr<ExpressionNode> m_logical;
-        RefPtr<ExpressionNode> m_expr1;
-        RefPtr<ExpressionNode> m_expr2;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_logical;
+        ExpressionNode* m_expr1;
+        ExpressionNode* m_expr2;
     };
 
     class ReadModifyResolveNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        ReadModifyResolveNode(JSGlobalData* globalData, const Identifier& ident, Operator oper, ExpressionNode*  right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_ident(ident)
-            , m_right(right)
-            , m_operator(oper)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
-
-        virtual ~ReadModifyResolveNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ReadModifyResolveNode(JSGlobalData*, const Identifier&, Operator, ExpressionNode*  right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
-        RefPtr<ExpressionNode> m_right;
+        ExpressionNode* m_right;
         size_t m_index; // Used by ReadModifyLocalVarNode.
-        Operator m_operator : 31;
-        bool m_rightHasAssignments : 1;
+        Operator m_operator;
+        bool m_rightHasAssignments;
     };
 
     class AssignResolveNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        AssignResolveNode(JSGlobalData* globalData, const Identifier& ident, ExpressionNode* right, bool rightHasAssignments) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_ident(ident)
-            , m_right(right)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
-
-        virtual ~AssignResolveNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        AssignResolveNode(JSGlobalData*, const Identifier&, ExpressionNode* right, bool rightHasAssignments);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
-        RefPtr<ExpressionNode> m_right;
+        ExpressionNode* m_right;
         size_t m_index; // Used by ReadModifyLocalVarNode.
         bool m_rightHasAssignments;
     };
 
     class ReadModifyBracketNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        ReadModifyBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, Operator oper, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_subscript(subscript)
-            , m_right(right)
-            , m_operator(oper)
-            , m_subscriptHasAssignments(subscriptHasAssignments)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
-
-        virtual ~ReadModifyBracketNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ReadModifyBracketNode(JSGlobalData*, ExpressionNode* base, ExpressionNode* subscript, Operator, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
-        RefPtr<ExpressionNode> m_subscript;
-        RefPtr<ExpressionNode> m_right;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
+        ExpressionNode* m_right;
         Operator m_operator : 30;
         bool m_subscriptHasAssignments : 1;
         bool m_rightHasAssignments : 1;
@@ -1524,168 +1038,109 @@ namespace JSC {
 
     class AssignBracketNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        AssignBracketNode(JSGlobalData* globalData, ExpressionNode* base, ExpressionNode* subscript, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_subscript(subscript)
-            , m_right(right)
-            , m_subscriptHasAssignments(subscriptHasAssignments)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
-
-        virtual ~AssignBracketNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        AssignBracketNode(JSGlobalData*, ExpressionNode* base, ExpressionNode* subscript, ExpressionNode* right, bool subscriptHasAssignments, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
-        RefPtr<ExpressionNode> m_subscript;
-        RefPtr<ExpressionNode> m_right;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
+        ExpressionNode* m_subscript;
+        ExpressionNode* m_right;
         bool m_subscriptHasAssignments : 1;
         bool m_rightHasAssignments : 1;
     };
 
     class AssignDotNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        AssignDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_ident(ident)
-            , m_right(right)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
-
-        virtual ~AssignDotNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        AssignDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
         Identifier m_ident;
-        RefPtr<ExpressionNode> m_right;
+        ExpressionNode* m_right;
         bool m_rightHasAssignments;
     };
 
     class ReadModifyDotNode : public ExpressionNode, public ThrowableSubExpressionData {
     public:
-        ReadModifyDotNode(JSGlobalData* globalData, ExpressionNode* base, const Identifier& ident, Operator oper, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableSubExpressionData(divot, startOffset, endOffset)
-            , m_base(base)
-            , m_ident(ident)
-            , m_right(right)
-            , m_operator(oper)
-            , m_rightHasAssignments(rightHasAssignments)
-        {
-        }
-
-        virtual ~ReadModifyDotNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ReadModifyDotNode(JSGlobalData*, ExpressionNode* base, const Identifier&, Operator, ExpressionNode* right, bool rightHasAssignments, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_base;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_base;
         Identifier m_ident;
-        RefPtr<ExpressionNode> m_right;
+        ExpressionNode* m_right;
         Operator m_operator : 31;
         bool m_rightHasAssignments : 1;
     };
 
     class AssignErrorNode : public ExpressionNode, public ThrowableExpressionData {
     public:
-        AssignErrorNode(JSGlobalData* globalData, ExpressionNode* left, Operator oper, ExpressionNode* right, unsigned divot, unsigned startOffset, unsigned endOffset) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , ThrowableExpressionData(divot, startOffset, endOffset)
-            , m_left(left)
-            , m_operator(oper)
-            , m_right(right)
-        {
-        }
-
-        virtual ~AssignErrorNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        AssignErrorNode(JSGlobalData*, ExpressionNode* left, Operator, ExpressionNode* right, unsigned divot, unsigned startOffset, unsigned endOffset);
 
     private:
-        RefPtr<ExpressionNode> m_left;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_left;
         Operator m_operator;
-        RefPtr<ExpressionNode> m_right;
+        ExpressionNode* m_right;
     };
+    
+    typedef Vector<ExpressionNode*, 8> ExpressionVector;
 
     class CommaNode : public ExpressionNode {
     public:
-        CommaNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_expr1(expr1)
-            , m_expr2(expr2)
-        {
-        }
-
-        virtual ~CommaNode();
-        virtual void releaseNodes(NodeReleaser&);
+        CommaNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        void append(ExpressionNode* expr) { m_expressions.append(expr); }
 
     private:
-        RefPtr<ExpressionNode> m_expr1;
-        RefPtr<ExpressionNode> m_expr2;
+        virtual bool isCommaNode() const { return true; }
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionVector m_expressions;
     };
     
-    class VarDeclCommaNode : public CommaNode {
-    public:
-        VarDeclCommaNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2) JSC_FAST_CALL
-            : CommaNode(globalData, expr1, expr2)
-        {
-        }
-    };
-
     class ConstDeclNode : public ExpressionNode {
     public:
-        ConstDeclNode(JSGlobalData* globalData, const Identifier& ident, ExpressionNode* in) JSC_FAST_CALL;
+        ConstDeclNode(JSGlobalData*, const Identifier&, ExpressionNode*);
+
+        bool hasInitializer() const { return m_init; }
+        const Identifier& ident() { return m_ident; }
 
-        virtual ~ConstDeclNode();
-        virtual void releaseNodes(NodeReleaser&);
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+        virtual RegisterID* emitCodeSingle(BytecodeGenerator&);
 
         Identifier m_ident;
-        RefPtr<ConstDeclNode> m_next;
-        RefPtr<ExpressionNode> m_init;
-        
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        virtual RegisterID* emitCodeSingle(BytecodeGenerator&) JSC_FAST_CALL;
-    };
 
-    class ConstStatementNode : public StatementNode {
     public:
-        ConstStatementNode(JSGlobalData* globalData, ConstDeclNode* next) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_next(next)
-        {
-        }
+        ConstDeclNode* m_next;
 
-        virtual ~ConstStatementNode();
-        virtual void releaseNodes(NodeReleaser&);
+    private:
+        ExpressionNode* m_init;
+    };
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    class ConstStatementNode : public StatementNode {
+    public:
+        ConstStatementNode(JSGlobalData*, ConstDeclNode* next);
 
     private:
-        RefPtr<ConstDeclNode> m_next;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ConstDeclNode* m_next;
     };
 
-    typedef Vector<RefPtr<StatementNode> > StatementVector;
+    typedef Vector<StatementNode*> StatementVector;
 
-    class SourceElements : public ParserRefCounted {
+    class SourceElements : public ParserArenaDeletable {
     public:
-        SourceElements(JSGlobalData* globalData) : ParserRefCounted(globalData) {}
+        SourceElements(JSGlobalData*);
 
-        void append(PassRefPtr<StatementNode>);
+        void append(StatementNode*);
         void releaseContentsIntoVector(StatementVector& destination)
         {
             ASSERT(destination.isEmpty());
@@ -1699,399 +1154,262 @@ namespace JSC {
 
     class BlockNode : public StatementNode {
     public:
-        BlockNode(JSGlobalData*, SourceElements* children) JSC_FAST_CALL;
-
-        virtual ~BlockNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        BlockNode(JSGlobalData*, SourceElements* children);
 
         StatementVector& children() { return m_children; }
 
-        virtual bool isBlock() const JSC_FAST_CALL { return true; }
-
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        virtual bool isBlock() const { return true; }
+
         StatementVector m_children;
     };
 
     class EmptyStatementNode : public StatementNode {
     public:
-        EmptyStatementNode(JSGlobalData* globalData) JSC_FAST_CALL // debug
-            : StatementNode(globalData)
-        {
-        }
+        EmptyStatementNode(JSGlobalData*);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        virtual bool isEmptyStatement() const JSC_FAST_CALL { return true; }
+        virtual bool isEmptyStatement() const { return true; }
     };
     
     class DebuggerStatementNode : public StatementNode {
     public:
-        DebuggerStatementNode(JSGlobalData* globalData) JSC_FAST_CALL
-            : StatementNode(globalData)
-        {
-        }
+        DebuggerStatementNode(JSGlobalData*);
         
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
     };
 
     class ExprStatementNode : public StatementNode {
     public:
-        ExprStatementNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_expr(expr)
-        {
-        }
+        ExprStatementNode(JSGlobalData*, ExpressionNode*);
 
-        virtual bool isExprStatement() const JSC_FAST_CALL { return true; }
+        ExpressionNode* expr() const { return m_expr; }
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+    private:
+        virtual bool isExprStatement() const { return true; }
 
-        ExpressionNode* expr() const { return m_expr.get(); }
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-    private:
-        RefPtr<ExpressionNode> m_expr;
+        ExpressionNode* m_expr;
     };
 
     class VarStatementNode : public StatementNode {
     public:
-        VarStatementNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_expr(expr)
-        {
-        }
-        
-        virtual ~VarStatementNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        VarStatementNode(JSGlobalData*, ExpressionNode*);        
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
     };
 
     class IfNode : public StatementNode {
     public:
-        IfNode(JSGlobalData* globalData, ExpressionNode* condition, StatementNode* ifBlock) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_condition(condition)
-            , m_ifBlock(ifBlock)
-        {
-        }
-
-        virtual ~IfNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        IfNode(JSGlobalData*, ExpressionNode* condition, StatementNode* ifBlock);
 
     protected:
-        RefPtr<ExpressionNode> m_condition;
-        RefPtr<StatementNode> m_ifBlock;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_condition;
+        StatementNode* m_ifBlock;
     };
 
     class IfElseNode : public IfNode {
     public:
-        IfElseNode(JSGlobalData* globalData, ExpressionNode* condition, StatementNode* ifBlock, StatementNode* elseBlock) JSC_FAST_CALL
-            : IfNode(globalData, condition, ifBlock)
-            , m_elseBlock(elseBlock)
-        {
-        }
-
-        virtual ~IfElseNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        IfElseNode(JSGlobalData*, ExpressionNode* condition, StatementNode* ifBlock, StatementNode* elseBlock);
 
     private:
-        RefPtr<StatementNode> m_elseBlock;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        StatementNode* m_elseBlock;
     };
 
     class DoWhileNode : public StatementNode {
     public:
-        DoWhileNode(JSGlobalData* globalData, StatementNode* statement, ExpressionNode* expr) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_statement(statement)
-            , m_expr(expr)
-        {
-        }
-
-        virtual ~DoWhileNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-
-        virtual bool isLoop() const JSC_FAST_CALL { return true; }
+        DoWhileNode(JSGlobalData*, StatementNode* statement, ExpressionNode*);
 
     private:
-        RefPtr<StatementNode> m_statement;
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        StatementNode* m_statement;
+        ExpressionNode* m_expr;
     };
 
     class WhileNode : public StatementNode {
     public:
-        WhileNode(JSGlobalData* globalData, ExpressionNode* expr, StatementNode* statement) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_expr(expr)
-            , m_statement(statement)
-        {
-        }
-
-        virtual ~WhileNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-
-        virtual bool isLoop() const JSC_FAST_CALL { return true; }
+        WhileNode(JSGlobalData*, ExpressionNode*, StatementNode* statement);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
-        RefPtr<StatementNode> m_statement;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
+        StatementNode* m_statement;
     };
 
     class ForNode : public StatementNode {
     public:
-        ForNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode* statement, bool expr1WasVarDecl) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_expr1(expr1)
-            , m_expr2(expr2)
-            , m_expr3(expr3)
-            , m_statement(statement)
-            , m_expr1WasVarDecl(expr1 && expr1WasVarDecl)
-        {
-            ASSERT(statement);
-        }
-
-        virtual ~ForNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-
-        virtual bool isLoop() const JSC_FAST_CALL { return true; }
+        ForNode(JSGlobalData*, ExpressionNode* expr1, ExpressionNode* expr2, ExpressionNode* expr3, StatementNode* statement, bool expr1WasVarDecl);
 
     private:
-        RefPtr<ExpressionNode> m_expr1;
-        RefPtr<ExpressionNode> m_expr2;
-        RefPtr<ExpressionNode> m_expr3;
-        RefPtr<StatementNode> m_statement;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr1;
+        ExpressionNode* m_expr2;
+        ExpressionNode* m_expr3;
+        StatementNode* m_statement;
         bool m_expr1WasVarDecl;
     };
 
     class ForInNode : public StatementNode, public ThrowableExpressionData {
     public:
-        ForInNode(JSGlobalData*, ExpressionNode*, ExpressionNode*, StatementNode*) JSC_FAST_CALL;
-        ForInNode(JSGlobalData*, const Identifier&, ExpressionNode*, ExpressionNode*, StatementNode*, int divot, int startOffset, int endOffset) JSC_FAST_CALL;
-        
-        virtual ~ForInNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-
-        virtual bool isLoop() const JSC_FAST_CALL { return true; }
+        ForInNode(JSGlobalData*, ExpressionNode*, ExpressionNode*, StatementNode*);
+        ForInNode(JSGlobalData*, const Identifier&, ExpressionNode*, ExpressionNode*, StatementNode*, int divot, int startOffset, int endOffset);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
-        RefPtr<ExpressionNode> m_init;
-        RefPtr<ExpressionNode> m_lexpr;
-        RefPtr<ExpressionNode> m_expr;
-        RefPtr<StatementNode> m_statement;
+        ExpressionNode* m_init;
+        ExpressionNode* m_lexpr;
+        ExpressionNode* m_expr;
+        StatementNode* m_statement;
         bool m_identIsVarDecl;
     };
 
     class ContinueNode : public StatementNode, public ThrowableExpressionData {
     public:
-        ContinueNode(JSGlobalData* globalData) JSC_FAST_CALL
-            : StatementNode(globalData)
-        {
-        }
-
-        ContinueNode(JSGlobalData* globalData, const Identifier& ident) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_ident(ident)
-        {
-        }
+        ContinueNode(JSGlobalData*);
+        ContinueNode(JSGlobalData*, const Identifier&);
         
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
     };
 
     class BreakNode : public StatementNode, public ThrowableExpressionData {
     public:
-        BreakNode(JSGlobalData* globalData) JSC_FAST_CALL
-            : StatementNode(globalData)
-        {
-        }
-
-        BreakNode(JSGlobalData* globalData, const Identifier& ident) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_ident(ident)
-        {
-        }
+        BreakNode(JSGlobalData*);
+        BreakNode(JSGlobalData*, const Identifier&);
         
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_ident;
     };
 
     class ReturnNode : public StatementNode, public ThrowableExpressionData {
     public:
-        ReturnNode(JSGlobalData* globalData, ExpressionNode* value) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_value(value)
-        {
-        }
+        ReturnNode(JSGlobalData*, ExpressionNode* value);
 
-        virtual ~ReturnNode();
-        virtual void releaseNodes(NodeReleaser&);
+    private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        virtual bool isReturnNode() const JSC_FAST_CALL { return true; }
+        virtual bool isReturnNode() const { return true; }
 
-    private:
-        RefPtr<ExpressionNode> m_value;
+        ExpressionNode* m_value;
     };
 
     class WithNode : public StatementNode {
     public:
-        WithNode(JSGlobalData* globalData, ExpressionNode* expr, StatementNode* statement, uint32_t divot, uint32_t expressionLength) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_expr(expr)
-            , m_statement(statement)
-            , m_divot(divot)
-            , m_expressionLength(expressionLength)
-        {
-        }
-
-        virtual ~WithNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        WithNode(JSGlobalData*, ExpressionNode*, StatementNode*, uint32_t divot, uint32_t expressionLength);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
-        RefPtr<StatementNode> m_statement;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
+        StatementNode* m_statement;
         uint32_t m_divot;
         uint32_t m_expressionLength;
     };
 
     class LabelNode : public StatementNode, public ThrowableExpressionData {
     public:
-        LabelNode(JSGlobalData* globalData, const Identifier& name, StatementNode* statement) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_name(name)
-            , m_statement(statement)
-        {
-        }
-
-        virtual ~LabelNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        LabelNode(JSGlobalData*, const Identifier& name, StatementNode*);
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         Identifier m_name;
-        RefPtr<StatementNode> m_statement;
+        StatementNode* m_statement;
     };
 
     class ThrowNode : public StatementNode, public ThrowableExpressionData {
     public:
-        ThrowNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_expr(expr)
-        {
-        }
-
-        virtual ~ThrowNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        ThrowNode(JSGlobalData*, ExpressionNode*);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
     };
 
     class TryNode : public StatementNode {
     public:
-        TryNode(JSGlobalData* globalData, StatementNode* tryBlock, const Identifier& exceptionIdent, bool catchHasEval, StatementNode* catchBlock, StatementNode* finallyBlock) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_tryBlock(tryBlock)
-            , m_exceptionIdent(exceptionIdent)
-            , m_catchBlock(catchBlock)
-            , m_finallyBlock(finallyBlock)
-            , m_catchHasEval(catchHasEval)
-        {
-        }
-
-        virtual ~TryNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* dst = 0) JSC_FAST_CALL;
+        TryNode(JSGlobalData*, StatementNode* tryBlock, const Identifier& exceptionIdent, bool catchHasEval, StatementNode* catchBlock, StatementNode* finallyBlock);
 
     private:
-        RefPtr<StatementNode> m_tryBlock;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* dst = 0);
+
+        StatementNode* m_tryBlock;
         Identifier m_exceptionIdent;
-        RefPtr<StatementNode> m_catchBlock;
-        RefPtr<StatementNode> m_finallyBlock;
+        StatementNode* m_catchBlock;
+        StatementNode* m_finallyBlock;
         bool m_catchHasEval;
     };
 
-    class ParameterNode : public ParserRefCounted {
+    class ParameterNode : public ParserArenaDeletable {
     public:
-        ParameterNode(JSGlobalData* globalData, const Identifier& ident) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_ident(ident)
-        {
-        }
-
-        ParameterNode(JSGlobalData* globalData, ParameterNode* l, const Identifier& ident) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_ident(ident)
-        {
-            l->m_next = this;
-        }
+        ParameterNode(JSGlobalData*, const Identifier&);
+        ParameterNode(JSGlobalData*, ParameterNode*, const Identifier&);
 
-        virtual ~ParameterNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        const Identifier& ident() const JSC_FAST_CALL { return m_ident; }
-        ParameterNode* nextParam() const JSC_FAST_CALL { return m_next.get(); }
+        const Identifier& ident() const { return m_ident; }
+        ParameterNode* nextParam() const { return m_next; }
 
     private:
         Identifier m_ident;
-        RefPtr<ParameterNode> m_next;
+        ParameterNode* m_next;
     };
 
     struct ScopeNodeData {
         typedef DeclarationStacks::VarStack VarStack;
         typedef DeclarationStacks::FunctionStack FunctionStack;
 
-        ScopeNodeData(SourceElements*, VarStack*, FunctionStack*, int numConstants);
+        ScopeNodeData(ParserArena&, SourceElements*, VarStack*, FunctionStack*, int numConstants);
 
+        ParserArena m_arena;
         VarStack m_varStack;
         FunctionStack m_functionStack;
         int m_numConstants;
         StatementVector m_children;
+
+        void mark();
     };
 
-    class ScopeNode : public StatementNode {
+    class ScopeNode : public StatementNode, public ParserArenaRefCounted {
     public:
         typedef DeclarationStacks::VarStack VarStack;
         typedef DeclarationStacks::FunctionStack FunctionStack;
 
-        ScopeNode(JSGlobalData*) JSC_FAST_CALL;
-        ScopeNode(JSGlobalData*, const SourceCode&, SourceElements*, VarStack*, FunctionStack*, CodeFeatures, int numConstants) JSC_FAST_CALL;
-        virtual ~ScopeNode();
-        virtual void releaseNodes(NodeReleaser&);
+        ScopeNode(JSGlobalData*);
+        ScopeNode(JSGlobalData*, const SourceCode&, SourceElements*, VarStack*, FunctionStack*, CodeFeatures, int numConstants);
 
-        void adoptData(std::auto_ptr<ScopeNodeData> data) { m_data.adopt(data); }
+        void adoptData(std::auto_ptr<ScopeNodeData> data)
+        {
+            ASSERT(!data->m_arena.contains(this));
+            ASSERT(!m_data);
+            m_data.adopt(data);
+        }
         ScopeNodeData* data() const { return m_data.get(); }
         void destroyData() { m_data.clear(); }
 
         const SourceCode& source() const { return m_source; }
-        const UString& sourceURL() const JSC_FAST_CALL { return m_source.provider()->url(); }
+        const UString& sourceURL() const { return m_source.provider()->url(); }
         intptr_t sourceID() const { return m_source.provider()->asID(); }
 
         void setFeatures(CodeFeatures features) { m_features = features; }
@@ -2116,9 +1434,33 @@ namespace JSC {
             return m_data->m_numConstants + 2;
         }
 
+        virtual void mark() { }
+
+#if ENABLE(JIT)
+        JITCode& generatedJITCode()
+        {
+            ASSERT(m_jitCode);
+            return m_jitCode;
+        }
+
+        ExecutablePool* getExecutablePool()
+        {
+            return m_jitCode.getExecutablePool();
+        }
+
+        void setJITCode(const JITCode jitCode)
+        {
+            m_jitCode = jitCode;
+        }
+#endif
+
     protected:
         void setSource(const SourceCode& source) { m_source = source; }
 
+#if ENABLE(JIT)
+        JITCode m_jitCode;
+#endif
+
     private:
         OwnPtr<ScopeNodeData> m_data;
         CodeFeatures m_features;
@@ -2127,42 +1469,70 @@ namespace JSC {
 
     class ProgramNode : public ScopeNode {
     public:
-        static ProgramNode* create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants) JSC_FAST_CALL;
+        static PassRefPtr<ProgramNode> create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
 
-        ProgramCodeBlock& bytecode(ScopeChainNode* scopeChain) JSC_FAST_CALL
+        ProgramCodeBlock& bytecode(ScopeChainNode* scopeChain) 
         {
             if (!m_code)
                 generateBytecode(scopeChain);
             return *m_code;
         }
 
+#if ENABLE(JIT)
+        JITCode& jitCode(ScopeChainNode* scopeChain)
+        {
+            if (!m_jitCode)
+                generateJITCode(scopeChain);
+            return m_jitCode;
+        }
+#endif
+
     private:
-        ProgramNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants) JSC_FAST_CALL;
+        ProgramNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
 
-        void generateBytecode(ScopeChainNode*) JSC_FAST_CALL;
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        void generateBytecode(ScopeChainNode*);
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+#if ENABLE(JIT)
+        void generateJITCode(ScopeChainNode*);
+#endif
 
         OwnPtr<ProgramCodeBlock> m_code;
     };
 
     class EvalNode : public ScopeNode {
     public:
-        static EvalNode* create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants) JSC_FAST_CALL;
+        static PassRefPtr<EvalNode> create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
 
-        EvalCodeBlock& bytecode(ScopeChainNode* scopeChain) JSC_FAST_CALL
+        EvalCodeBlock& bytecode(ScopeChainNode* scopeChain) 
         {
             if (!m_code)
                 generateBytecode(scopeChain);
             return *m_code;
         }
 
-        EvalCodeBlock& bytecodeForExceptionInfoReparse(ScopeChainNode*) JSC_FAST_CALL;
+        EvalCodeBlock& bytecodeForExceptionInfoReparse(ScopeChainNode*, CodeBlock*);
+
+        virtual void mark();
+
+#if ENABLE(JIT)
+        JITCode& jitCode(ScopeChainNode* scopeChain)
+        {
+            if (!m_jitCode)
+                generateJITCode(scopeChain);
+            return m_jitCode;
+        }
+#endif
 
     private:
-        EvalNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants) JSC_FAST_CALL;
+        EvalNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
 
-        void generateBytecode(ScopeChainNode*) JSC_FAST_CALL;
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        void generateBytecode(ScopeChainNode*);
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+#if ENABLE(JIT)
+        void generateJITCode(ScopeChainNode*);
+#endif
         
         OwnPtr<EvalCodeBlock> m_code;
     };
@@ -2170,217 +1540,152 @@ namespace JSC {
     class FunctionBodyNode : public ScopeNode {
         friend class JIT;
     public:
-        static FunctionBodyNode* create(JSGlobalData*) JSC_FAST_CALL;
-        static FunctionBodyNode* create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants) JSC_FAST_CALL;
+#if ENABLE(JIT)
+        static PassRefPtr<FunctionBodyNode> createNativeThunk(JSGlobalData*);
+#endif
+        static FunctionBodyNode* create(JSGlobalData*);
+        static PassRefPtr<FunctionBodyNode> create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
         virtual ~FunctionBodyNode();
 
-        const Identifier* parameters() const JSC_FAST_CALL { return m_parameters; }
+        const Identifier* parameters() const { return m_parameters; }
         size_t parameterCount() const { return m_parameterCount; }
-        UString paramString() const JSC_FAST_CALL;
+        UString paramString() const ;
         Identifier* copyParameters();
 
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        
-        CodeBlock& bytecode(ScopeChainNode* scopeChain) JSC_FAST_CALL
-        {
-            ASSERT(scopeChain);
-            if (!m_code)
-                generateBytecode(scopeChain);
-            return *m_code;
-        }
-
-        CodeBlock& generatedBytecode() JSC_FAST_CALL
-        {
-            ASSERT(m_code);
-            return *m_code;
-        }
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
 
-        bool isGenerated() JSC_FAST_CALL
+        bool isGenerated() const
         {
             return m_code;
         }
 
-        void mark();
+        bool isHostFunction() const;
+
+        virtual void mark();
 
         void finishParsing(const SourceCode&, ParameterNode*);
         void finishParsing(Identifier* parameters, size_t parameterCount);
         
-        UString toSourceString() const JSC_FAST_CALL { return source().toString(); }
+        UString toSourceString() const { return source().toString(); }
 
-        // These objects are ref/deref'd a lot in the scope chain, so this is a faster ref/deref.
-        // If the virtual machine changes so this doesn't happen as much we can change back.
-        void ref()
+        CodeBlock& bytecodeForExceptionInfoReparse(ScopeChainNode*, CodeBlock*);
+#if ENABLE(JIT)
+        JITCode& jitCode(ScopeChainNode* scopeChain)
         {
-            if (++m_refCount == 1)
-                ScopeNode::ref();
+            if (!m_jitCode)
+                generateJITCode(scopeChain);
+            return m_jitCode;
         }
-        void deref()
+#endif
+
+        CodeBlock& bytecode(ScopeChainNode* scopeChain) 
         {
-            ASSERT(m_refCount);
-            if (!--m_refCount)
-                ScopeNode::deref();
+            ASSERT(scopeChain);
+            if (!m_code)
+                generateBytecode(scopeChain);
+            return *m_code;
         }
-
-        CodeBlock& bytecodeForExceptionInfoReparse(ScopeChainNode* scopeChain) JSC_FAST_CALL;
-
+        
+        CodeBlock& generatedBytecode()
+        {
+            ASSERT(m_code);
+            return *m_code;
+        }
+        
     private:
-        FunctionBodyNode(JSGlobalData*) JSC_FAST_CALL;
-        FunctionBodyNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants) JSC_FAST_CALL;
-
-        void generateBytecode(ScopeChainNode*) JSC_FAST_CALL;
+        FunctionBodyNode(JSGlobalData*);
+        FunctionBodyNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, const SourceCode&, CodeFeatures, int numConstants);
 
+        void generateBytecode(ScopeChainNode*);
+#if ENABLE(JIT)
+        void generateJITCode(ScopeChainNode*);
+#endif
         Identifier* m_parameters;
         size_t m_parameterCount;
         OwnPtr<CodeBlock> m_code;
-        unsigned m_refCount;
     };
 
-    class FuncExprNode : public ExpressionNode {
+    class FuncExprNode : public ExpressionNode, public ParserArenaRefCounted {
     public:
-        FuncExprNode(JSGlobalData* globalData, const Identifier& ident, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter = 0) JSC_FAST_CALL
-            : ExpressionNode(globalData)
-            , m_ident(ident)
-            , m_parameter(parameter)
-            , m_body(body)
-        {
-            m_body->finishParsing(source, m_parameter.get());
-        }
-
-        virtual ~FuncExprNode();
-        virtual void releaseNodes(NodeReleaser&);
+        FuncExprNode(JSGlobalData*, const Identifier&, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter = 0);
 
-        virtual bool isFuncExprNode() const JSC_FAST_CALL { return true; } 
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
-        JSFunction* makeFunction(ExecState*, ScopeChainNode*) JSC_FAST_CALL;
+        JSFunction* makeFunction(ExecState*, ScopeChainNode*);
 
         FunctionBodyNode* body() { return m_body.get(); }
 
     private:
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        virtual bool isFuncExprNode() const { return true; } 
+
         Identifier m_ident;
-        RefPtr<ParameterNode> m_parameter;
         RefPtr<FunctionBodyNode> m_body;
     };
 
-    class FuncDeclNode : public StatementNode {
+    class FuncDeclNode : public StatementNode, public ParserArenaRefCounted {
     public:
-        FuncDeclNode(JSGlobalData* globalData, const Identifier& ident, FunctionBodyNode* body, const SourceCode& source, ParameterNode* parameter = 0) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_ident(ident)
-            , m_parameter(parameter)
-            , m_body(body)
-        {
-            m_body->finishParsing(source, m_parameter.get());
-        }
-
-        virtual ~FuncDeclNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        FuncDeclNode(JSGlobalData*, const Identifier&, FunctionBodyNode*, const SourceCode&, ParameterNode* = 0);
 
-        JSFunction* makeFunction(ExecState*, ScopeChainNode*) JSC_FAST_CALL;
+        JSFunction* makeFunction(ExecState*, ScopeChainNode*);
 
         Identifier m_ident;
 
         FunctionBodyNode* body() { return m_body.get(); }
 
     private:
-        RefPtr<ParameterNode> m_parameter;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
         RefPtr<FunctionBodyNode> m_body;
     };
 
-    class CaseClauseNode : public ParserRefCounted {
+    class CaseClauseNode : public ParserArenaDeletable {
     public:
-        CaseClauseNode(JSGlobalData* globalData, ExpressionNode* expr) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_expr(expr)
-        {
-        }
+        CaseClauseNode(JSGlobalData*, ExpressionNode*);
+        CaseClauseNode(JSGlobalData*, ExpressionNode*, SourceElements*);
 
-        CaseClauseNode(JSGlobalData* globalData, ExpressionNode* expr, SourceElements* children) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_expr(expr)
-        {
-            if (children)
-                children->releaseContentsIntoVector(m_children);
-        }
-
-        virtual ~CaseClauseNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        ExpressionNode* expr() const { return m_expr.get(); }
+        ExpressionNode* expr() const { return m_expr; }
         StatementVector& children() { return m_children; }
 
     private:
-        RefPtr<ExpressionNode> m_expr;
+        ExpressionNode* m_expr;
         StatementVector m_children;
     };
 
-    class ClauseListNode : public ParserRefCounted {
+    class ClauseListNode : public ParserArenaDeletable {
     public:
-        ClauseListNode(JSGlobalData* globalData, CaseClauseNode* clause) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_clause(clause)
-        {
-        }
-
-        ClauseListNode(JSGlobalData* globalData, ClauseListNode* clauseList, CaseClauseNode* clause) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_clause(clause)
-        {
-            clauseList->m_next = this;
-        }
-
-        virtual ~ClauseListNode();
-        virtual void releaseNodes(NodeReleaser&);
+        ClauseListNode(JSGlobalData*, CaseClauseNode*);
+        ClauseListNode(JSGlobalData*, ClauseListNode*, CaseClauseNode*);
 
-        CaseClauseNode* getClause() const JSC_FAST_CALL { return m_clause.get(); }
-        ClauseListNode* getNext() const JSC_FAST_CALL { return m_next.get(); }
+        CaseClauseNode* getClause() const { return m_clause; }
+        ClauseListNode* getNext() const { return m_next; }
 
     private:
-        RefPtr<CaseClauseNode> m_clause;
-        RefPtr<ClauseListNode> m_next;
+        CaseClauseNode* m_clause;
+        ClauseListNode* m_next;
     };
 
-    class CaseBlockNode : public ParserRefCounted {
+    class CaseBlockNode : public ParserArenaDeletable {
     public:
-        CaseBlockNode(JSGlobalData* globalData, ClauseListNode* list1, CaseClauseNode* defaultClause, ClauseListNode* list2) JSC_FAST_CALL
-            : ParserRefCounted(globalData)
-            , m_list1(list1)
-            , m_defaultClause(defaultClause)
-            , m_list2(list2)
-        {
-        }
+        CaseBlockNode(JSGlobalData*, ClauseListNode* list1, CaseClauseNode* defaultClause, ClauseListNode* list2);
 
-        virtual ~CaseBlockNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        RegisterID* emitBytecodeForBlock(BytecodeGenerator&, RegisterID* input, RegisterID* dst = 0) JSC_FAST_CALL;
+        RegisterID* emitBytecodeForBlock(BytecodeGenerator&, RegisterID* input, RegisterID* dst = 0);
 
     private:
         SwitchInfo::SwitchType tryOptimizedSwitch(Vector<ExpressionNode*, 8>& literalVector, int32_t& min_num, int32_t& max_num);
-        RefPtr<ClauseListNode> m_list1;
-        RefPtr<CaseClauseNode> m_defaultClause;
-        RefPtr<ClauseListNode> m_list2;
+        ClauseListNode* m_list1;
+        CaseClauseNode* m_defaultClause;
+        ClauseListNode* m_list2;
     };
 
     class SwitchNode : public StatementNode {
     public:
-        SwitchNode(JSGlobalData* globalData, ExpressionNode* expr, CaseBlockNode* block) JSC_FAST_CALL
-            : StatementNode(globalData)
-            , m_expr(expr)
-            , m_block(block)
-        {
-        }
-
-        virtual ~SwitchNode();
-        virtual void releaseNodes(NodeReleaser&);
-
-        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0) JSC_FAST_CALL;
+        SwitchNode(JSGlobalData*, ExpressionNode*, CaseBlockNode*);
 
     private:
-        RefPtr<ExpressionNode> m_expr;
-        RefPtr<CaseBlockNode> m_block;
+        virtual RegisterID* emitBytecode(BytecodeGenerator&, RegisterID* = 0);
+
+        ExpressionNode* m_expr;
+        CaseBlockNode* m_block;
     };
 
     struct ElementList {
@@ -2415,4 +1720,4 @@ namespace JSC {
 
 } // namespace JSC
 
-#endif // NODES_H_
+#endif // Nodes_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp
index 1b1e4d7..96f4ae6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Parser.cpp
@@ -31,13 +31,15 @@
 
 using std::auto_ptr;
 
+#ifndef yyparse
 extern int jscyyparse(void*);
+#endif
 
 namespace JSC {
 
 void Parser::parse(JSGlobalData* globalData, int* errLine, UString* errMsg)
 {
-    ASSERT(!m_sourceElements);
+    m_sourceElements = 0;
 
     int defaultErrLine;
     UString defaultErrMsg;
@@ -55,14 +57,13 @@ void Parser::parse(JSGlobalData* globalData, int* errLine, UString* errMsg)
 
     int parseError = jscyyparse(globalData);
     bool lexError = lexer.sawError();
+    int lineNumber = lexer.lineNumber();
     lexer.clear();
 
-    ParserRefCounted::deleteNewObjects(globalData);
-
     if (parseError || lexError) {
-        *errLine = lexer.lineNo();
+        *errLine = lineNumber;
         *errMsg = "Parse error";
-        m_sourceElements.clear();
+        m_sourceElements = 0;
     }
 }
 
@@ -75,23 +76,26 @@ void Parser::reparseInPlace(JSGlobalData* globalData, FunctionBodyNode* function
     parse(globalData, 0, 0);
     ASSERT(m_sourceElements);
 
-    functionBodyNode->adoptData(std::auto_ptr<ScopeNodeData>(new ScopeNodeData(m_sourceElements.get(),
-                                                                               m_varDeclarations ? &m_varDeclarations->data : 0, 
-                                                                               m_funcDeclarations ? &m_funcDeclarations->data : 0,
-                                                                               m_numConstants)));
+    functionBodyNode->adoptData(std::auto_ptr<ScopeNodeData>(new ScopeNodeData(globalData->parser->arena(),
+        m_sourceElements,
+        m_varDeclarations ? &m_varDeclarations->data : 0, 
+        m_funcDeclarations ? &m_funcDeclarations->data : 0,
+        m_numConstants)));
     bool usesArguments = functionBodyNode->usesArguments();
     functionBodyNode->setFeatures(m_features);
     if (usesArguments && !functionBodyNode->usesArguments())
         functionBodyNode->setUsesArguments();
 
+    ASSERT(globalData->parser->arena().isEmpty());
+
     m_source = 0;
     m_sourceElements = 0;
     m_varDeclarations = 0;
     m_funcDeclarations = 0;
 }
 
-void Parser::didFinishParsing(SourceElements* sourceElements, ParserRefCountedData<DeclarationStacks::VarStack>* varStack, 
-                              ParserRefCountedData<DeclarationStacks::FunctionStack>* funcStack, CodeFeatures features, int lastLine, int numConstants)
+void Parser::didFinishParsing(SourceElements* sourceElements, ParserArenaData<DeclarationStacks::VarStack>* varStack, 
+                              ParserArenaData<DeclarationStacks::FunctionStack>* funcStack, CodeFeatures features, int lastLine, int numConstants)
 {
     m_sourceElements = sourceElements;
     m_varDeclarations = varStack;
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/Parser.h b/src/3rdparty/webkit/JavaScriptCore/parser/Parser.h
index 6191ccb..6f4c2b7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/Parser.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/Parser.h
@@ -23,9 +23,9 @@
 #ifndef Parser_h
 #define Parser_h
 
-#include "SourceProvider.h"
 #include "Debugger.h"
 #include "Nodes.h"
+#include "SourceProvider.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
@@ -37,15 +37,7 @@ namespace JSC {
     class ProgramNode;
     class UString;
 
-    template <typename T>
-    struct ParserRefCountedData : ParserRefCounted {
-        ParserRefCountedData(JSGlobalData* globalData)
-            : ParserRefCounted(globalData)
-        {
-        }
-
-        T data;
-    };
+    template <typename T> struct ParserArenaData : ParserArenaDeletable { T data; };
 
     class Parser : Noncopyable {
     public:
@@ -53,16 +45,19 @@ namespace JSC {
         template <class ParsedNode> PassRefPtr<ParsedNode> reparse(JSGlobalData*, ParsedNode*);
         void reparseInPlace(JSGlobalData*, FunctionBodyNode*);
 
-        void didFinishParsing(SourceElements*, ParserRefCountedData<DeclarationStacks::VarStack>*, 
-                              ParserRefCountedData<DeclarationStacks::FunctionStack>*, CodeFeatures features, int lastLine, int numConstants);
+        void didFinishParsing(SourceElements*, ParserArenaData<DeclarationStacks::VarStack>*, 
+                              ParserArenaData<DeclarationStacks::FunctionStack>*, CodeFeatures features, int lastLine, int numConstants);
+
+        ParserArena& arena() { return m_arena; }
 
     private:
         void parse(JSGlobalData*, int* errLine, UString* errMsg);
 
+        ParserArena m_arena;
         const SourceCode* m_source;
-        RefPtr<SourceElements> m_sourceElements;
-        RefPtr<ParserRefCountedData<DeclarationStacks::VarStack> > m_varDeclarations;
-        RefPtr<ParserRefCountedData<DeclarationStacks::FunctionStack> > m_funcDeclarations;
+        SourceElements* m_sourceElements;
+        ParserArenaData<DeclarationStacks::VarStack>* m_varDeclarations;
+        ParserArenaData<DeclarationStacks::FunctionStack>* m_funcDeclarations;
         CodeFeatures m_features;
         int m_lastLine;
         int m_numConstants;
@@ -75,7 +70,7 @@ namespace JSC {
         RefPtr<ParsedNode> result;
         if (m_sourceElements) {
             result = ParsedNode::create(&exec->globalData(),
-                                         m_sourceElements.get(),
+                                         m_sourceElements,
                                          m_varDeclarations ? &m_varDeclarations->data : 0, 
                                          m_funcDeclarations ? &m_funcDeclarations->data : 0,
                                          *m_source,
@@ -84,8 +79,9 @@ namespace JSC {
             result->setLoc(m_source->firstLine(), m_lastLine);
         }
 
+        m_arena.reset();
+
         m_source = 0;
-        m_sourceElements = 0;
         m_varDeclarations = 0;
         m_funcDeclarations = 0;
 
@@ -101,7 +97,7 @@ namespace JSC {
         RefPtr<ParsedNode> result;
         if (m_sourceElements) {
             result = ParsedNode::create(globalData,
-                                        m_sourceElements.get(),
+                                        m_sourceElements,
                                         m_varDeclarations ? &m_varDeclarations->data : 0, 
                                         m_funcDeclarations ? &m_funcDeclarations->data : 0,
                                         *m_source,
@@ -110,8 +106,9 @@ namespace JSC {
             result->setLoc(m_source->firstLine(), m_lastLine);
         }
 
+        m_arena.reset();
+
         m_source = 0;
-        m_sourceElements = 0;
         m_varDeclarations = 0;
         m_funcDeclarations = 0;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.cpp b/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.cpp
new file mode 100644
index 0000000..2617506
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ParserArena.h"
+
+#include "Nodes.h"
+
+namespace JSC {
+
+ParserArena::~ParserArena()
+{
+    deleteAllValues(m_deletableObjects);
+}
+
+bool ParserArena::contains(ParserArenaRefCounted* object) const
+{
+    return m_refCountedObjects.find(object) != notFound;
+}
+
+ParserArenaRefCounted* ParserArena::last() const
+{
+    return m_refCountedObjects.last().get();
+}
+
+void ParserArena::removeLast()
+{
+    m_refCountedObjects.removeLast();
+}
+
+void ParserArena::reset()
+{
+    deleteAllValues(m_deletableObjects);
+    m_deletableObjects.shrink(0);
+    m_refCountedObjects.shrink(0);
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/storage/SessionStorageArea.h b/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.h
index 3dad1af..66c8529 100644
--- a/src/3rdparty/webkit/WebCore/storage/SessionStorageArea.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/ParserArena.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,35 +23,42 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef SessionStorageArea_h
-#define SessionStorageArea_h
+#ifndef ParserArena_h
+#define ParserArena_h
 
-#include "StorageArea.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
 
-namespace WebCore {
+namespace JSC {
 
-    class Page;
-    
-    class SessionStorageArea : public StorageArea {
+    class ParserArenaDeletable;
+    class ParserArenaRefCounted;
+
+    class ParserArena {
     public:
-        static PassRefPtr<SessionStorageArea> create(SecurityOrigin* origin, Page* page) { return adoptRef(new SessionStorageArea(origin, page)); }
-        PassRefPtr<SessionStorageArea> copy(SecurityOrigin*, Page*);
-                
-        Page* page() { return m_page; }
+        void swap(ParserArena& otherArena)
+        {
+            m_deletableObjects.swap(otherArena.m_deletableObjects);
+            m_refCountedObjects.swap(otherArena.m_refCountedObjects);
+        }
+        ~ParserArena();
 
-    private:
-        SessionStorageArea(SecurityOrigin*, Page*);
-        SessionStorageArea(SecurityOrigin*, Page*, SessionStorageArea*);
+        void deleteWithArena(ParserArenaDeletable* object) { m_deletableObjects.append(object); }
+        void derefWithArena(PassRefPtr<ParserArenaRefCounted> object) { m_refCountedObjects.append(object); }
 
-        virtual void itemChanged(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
-        virtual void itemRemoved(const String& key, const String& oldValue, Frame* sourceFrame);
-        virtual void areaCleared(Frame* sourceFrame);
+        bool contains(ParserArenaRefCounted*) const;
+        ParserArenaRefCounted* last() const;
+        void removeLast();
 
-        void dispatchStorageEvent(const String& key, const String& oldValue, const String& newValue, Frame* sourceFrame);
-        
-        Page* m_page;
+        bool isEmpty() const { return m_deletableObjects.isEmpty() && m_refCountedObjects.isEmpty(); }
+        void reset();
+
+    private:
+        Vector<ParserArenaDeletable*> m_deletableObjects;
+        Vector<RefPtr<ParserArenaRefCounted> > m_refCountedObjects;
     };
 
-} // namespace WebCore
+}
 
-#endif // SessionStorageArea_h
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/ResultType.h b/src/3rdparty/webkit/JavaScriptCore/parser/ResultType.h
index 4913887..27b8112 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/ResultType.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/ResultType.h
@@ -33,16 +33,16 @@ namespace JSC {
 
         typedef char Type;
         static const Type TypeReusable = 1;
+        static const Type TypeInt32    = 2;
         
-        static const Type TypeMaybeNumber = 2;
-        static const Type TypeMaybeString = 4;
-        static const Type TypeMaybeNull = 8;
-        static const Type TypeMaybeBool = 16;
-        static const Type TypeMaybeOther = 32;
-
-        static const Type TypeReusableNumber = 3;
-        static const Type TypeStringOrReusableNumber = 4;
-    
+        static const Type TypeMaybeNumber = 0x04;
+        static const Type TypeMaybeString = 0x08;
+        static const Type TypeMaybeNull   = 0x10;
+        static const Type TypeMaybeBool   = 0x20;
+        static const Type TypeMaybeOther  = 0x40;
+
+        static const Type TypeBits = TypeMaybeNumber | TypeMaybeString | TypeMaybeNull | TypeMaybeBool | TypeMaybeOther;
+
         explicit ResultType(Type type)
             : m_type(type)
         {
@@ -50,66 +50,86 @@ namespace JSC {
         
         bool isReusable()
         {
-            return (m_type & TypeReusable);
+            return m_type & TypeReusable;
+        }
+
+        bool isInt32()
+        {
+            return m_type & TypeInt32;
         }
 
         bool definitelyIsNumber()
         {
-            return ((m_type & ~TypeReusable) == TypeMaybeNumber);
+            return (m_type & TypeBits) == TypeMaybeNumber;
         }
         
-        bool isNotNumber()
+        bool definitelyIsString()
         {
-            return ((m_type & TypeMaybeNumber) == 0);
+            return (m_type & TypeBits) == TypeMaybeString;
         }
-        
+
         bool mightBeNumber()
         {
-            return !isNotNumber();
+            return m_type & TypeMaybeNumber;
         }
 
+        bool isNotNumber()
+        {
+            return !mightBeNumber();
+        }
+        
         static ResultType nullType()
         {
             return ResultType(TypeMaybeNull);
         }
         
-        static ResultType boolean()
+        static ResultType booleanType()
         {
             return ResultType(TypeMaybeBool);
         }
         
-        static ResultType constNumber()
+        static ResultType numberType()
         {
             return ResultType(TypeMaybeNumber);
         }
         
-        static ResultType reusableNumber()
+        static ResultType numberTypeCanReuse()
         {
             return ResultType(TypeReusable | TypeMaybeNumber);
         }
         
-        static ResultType reusableNumberOrString()
+        static ResultType numberTypeCanReuseIsInt32()
+        {
+            return ResultType(TypeReusable | TypeInt32 | TypeMaybeNumber);
+        }
+        
+        static ResultType stringOrNumberTypeCanReuse()
         {
             return ResultType(TypeReusable | TypeMaybeNumber | TypeMaybeString);
         }
         
-        static ResultType string()
+        static ResultType stringType()
         {
             return ResultType(TypeMaybeString);
         }
         
-        static ResultType unknown()
+        static ResultType unknownType()
         {
-            return ResultType(TypeMaybeNumber | TypeMaybeString | TypeMaybeNull | TypeMaybeBool | TypeMaybeOther);
+            return ResultType(TypeBits);
         }
         
         static ResultType forAdd(ResultType op1, ResultType op2)
         {
             if (op1.definitelyIsNumber() && op2.definitelyIsNumber())
-                return reusableNumber();
-            if (op1.isNotNumber() || op2.isNotNumber())
-                return string();
-            return reusableNumberOrString();
+                return numberTypeCanReuse();
+            if (op1.definitelyIsString() || op2.definitelyIsString())
+                return stringType();
+            return stringOrNumberTypeCanReuse();
+        }
+        
+        static ResultType forBitOp()
+        {
+            return numberTypeCanReuseIsInt32();
         }
 
     private:
@@ -118,8 +138,11 @@ namespace JSC {
     
     struct OperandTypes
     {
-        OperandTypes(ResultType first = ResultType::unknown(), ResultType second = ResultType::unknown())
+        OperandTypes(ResultType first = ResultType::unknownType(), ResultType second = ResultType::unknownType())
         {
+            // We have to initialize one of the int to ensure that
+            // the entire struct is initialized.
+            m_u.i = 0;
             m_u.rds.first = first.m_type;
             m_u.rds.second = second.m_type;
         }
diff --git a/src/3rdparty/webkit/JavaScriptCore/parser/SourceProvider.h b/src/3rdparty/webkit/JavaScriptCore/parser/SourceProvider.h
index 07da9e0..1c59eed 100644
--- a/src/3rdparty/webkit/JavaScriptCore/parser/SourceProvider.h
+++ b/src/3rdparty/webkit/JavaScriptCore/parser/SourceProvider.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,10 +34,13 @@
 
 namespace JSC {
 
+    enum SourceBOMPresence { SourceHasNoBOMs, SourceCouldHaveBOMs };
+
     class SourceProvider : public RefCounted<SourceProvider> {
     public:
-        SourceProvider(const UString& url)
+        SourceProvider(const UString& url, SourceBOMPresence hasBOMs = SourceCouldHaveBOMs)
             : m_url(url)
+            , m_hasBOMs(hasBOMs)
         {
         }
         virtual ~SourceProvider() { }
@@ -49,8 +52,11 @@ namespace JSC {
         const UString& url() { return m_url; }
         intptr_t asID() { return reinterpret_cast<intptr_t>(this); }
 
+        SourceBOMPresence hasBOMs() const { return m_hasBOMs; }
+
     private:
         UString m_url;
+        SourceBOMPresence m_hasBOMs;
     };
 
     class UStringSourceProvider : public SourceProvider {
diff --git a/src/3rdparty/webkit/JavaScriptCore/pcre/dftables b/src/3rdparty/webkit/JavaScriptCore/pcre/dftables
index de2f5bb..8a2d140 100755
--- a/src/3rdparty/webkit/JavaScriptCore/pcre/dftables
+++ b/src/3rdparty/webkit/JavaScriptCore/pcre/dftables
@@ -244,7 +244,7 @@ sub readHeaderValues()
  
     my ($fh, $tempFile) = tempfile(
         basename($0) . "-XXXXXXXX",
-        DIR => ($ENV{'TMPDIR'} || "/tmp"),
+        DIR => File::Spec->tmpdir,
         SUFFIX => ".in",
         UNLINK => 0,
     );
diff --git a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_compile.cpp b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_compile.cpp
index 7ad5676..2bedca6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_compile.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_compile.cpp
@@ -303,7 +303,10 @@ static int checkEscape(const UChar** ptrPtr, const UChar* patternEnd, ErrorCode*
                 }
                 
                 c = *ptr;
-                if (!isASCIIAlpha(c)) {
+
+                /* To match Firefox, inside a character class, we also accept
+                   numbers and '_' as control characters */
+                if ((!isClass && !isASCIIAlpha(c)) || (!isASCIIAlphanumeric(c) && c != '_')) {
                     c = '\\';
                     ptr -= 2;
                     break;
@@ -1058,11 +1061,6 @@ compileBranch(int options, int* brackets, unsigned char** codePtr,
                 
                 reqvary = (repeatMin == repeat_max) ? 0 : REQ_VARY;
                 
-                // A quantifier after an assertion is meaningless, since assertions
-                // don't move index forward. So, we discard it.
-                if (*previous == OP_ASSERT || *previous == OP_ASSERT_NOT)
-                    goto END_REPEAT;
-                
                 opType = 0;                    /* Default single-char op codes */
                 
                 /* Save start of previous item, in case we have to move it up to make space
@@ -1416,6 +1414,15 @@ compileBranch(int options, int* brackets, unsigned char** codePtr,
                         code[-ketoffset] = OP_KETRMAX + repeatType;
                 }
                 
+                // A quantifier after an assertion is mostly meaningless, but it
+                // can nullify the assertion if it has a 0 minimum.
+                else if (*previous == OP_ASSERT || *previous == OP_ASSERT_NOT) {
+                    if (repeatMin == 0) {
+                        code = previous;
+                        goto END_REPEAT;
+                    }
+                }
+                
                 /* Else there's some kind of shambles */
                 
                 else {
@@ -2209,7 +2216,7 @@ static int calculateCompiledPatternLength(const UChar* pattern, int patternLengt
                         
                         int d = -1;
                         if (safelyCheckNextChar(ptr, patternEnd, '-')) {
-                            UChar const *hyptr = ptr++;
+                            const UChar* hyptr = ptr++;
                             if (safelyCheckNextChar(ptr, patternEnd, '\\')) {
                                 ptr++;
                                 d = checkEscape(&ptr, patternEnd, &errorcode, cd.numCapturingBrackets, true);
@@ -2600,7 +2607,7 @@ JSRegExp* jsRegExpCompile(const UChar* pattern, int patternLength,
     
     const UChar* ptr = (const UChar*)pattern;
     const UChar* patternEnd = pattern + patternLength;
-    unsigned char* code = (unsigned char*)codeStart;
+    unsigned char* code = const_cast<unsigned char*>(codeStart);
     int firstByte, reqByte;
     int bracketCount = 0;
     if (!cd.needOuterBracket)
diff --git a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_exec.cpp b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_exec.cpp
index cec3417..af770f3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_exec.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_exec.cpp
@@ -50,7 +50,7 @@ the JavaScript specification. There are also some supporting functions. */
 #include <wtf/Vector.h>
 
 #if REGEXP_HISTOGRAM
-#include <parser/DateMath.h>
+#include <wtf/DateMath.h>
 #include <runtime/UString.h>
 #endif
 
@@ -175,7 +175,7 @@ reqByte match. */
 /* The below limit restricts the number of "recursive" match calls in order to
 avoid spending exponential time on complex regular expressions. */
 
-static const unsigned matchLimit = 100000;
+static const unsigned matchLimit = 1000000;
 
 #ifdef DEBUG
 /*************************************************
@@ -447,6 +447,7 @@ static int match(const UChar* subjectPtr, const unsigned char* instructionPtr, i
     int min;
     bool minimize = false; /* Initialization not really needed, but some compilers think so. */
     unsigned remainingMatchCount = matchLimit;
+    int othercase; /* Declare here to avoid errors during jumps */
     
     MatchStack stack;
 
@@ -1186,7 +1187,7 @@ RECURSE:
                 stack.currentFrame->args.instructionPtr += stack.currentFrame->locals.length;
                 
                 if (stack.currentFrame->locals.fc <= 0xFFFF) {
-                    int othercase = md.ignoreCase ? jsc_pcre_ucp_othercase(stack.currentFrame->locals.fc) : -1;
+                    othercase = md.ignoreCase ? jsc_pcre_ucp_othercase(stack.currentFrame->locals.fc) : -1;
                     
                     for (int i = 1; i <= min; i++) {
                         if (*stack.currentFrame->args.subjectPtr != stack.currentFrame->locals.fc && *stack.currentFrame->args.subjectPtr != othercase)
diff --git a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_internal.h b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_internal.h
index 2916765..0016bb5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_internal.h
+++ b/src/3rdparty/webkit/JavaScriptCore/pcre/pcre_internal.h
@@ -85,7 +85,7 @@ total length. */
 offsets within the compiled regex. The default is 2, which allows for compiled
 patterns up to 64K long. */
 
-#define LINK_SIZE   2
+#define LINK_SIZE   3
 
 /* Define DEBUG to get debugging output on stdout. */
 
@@ -124,28 +124,60 @@ static inline void put2ByteValue(unsigned char* opcodePtr, int value)
     opcodePtr[1] = value;
 }
 
+static inline void put3ByteValue(unsigned char* opcodePtr, int value)
+{
+    ASSERT(value >= 0 && value <= 0xFFFFFF);
+    opcodePtr[0] = value >> 16;
+    opcodePtr[1] = value >> 8;
+    opcodePtr[2] = value;
+}
+
 static inline int get2ByteValue(const unsigned char* opcodePtr)
 {
     return (opcodePtr[0] << 8) | opcodePtr[1];
 }
 
+static inline int get3ByteValue(const unsigned char* opcodePtr)
+{
+    return (opcodePtr[0] << 16) | (opcodePtr[1] << 8) | opcodePtr[2];
+}
+
 static inline void put2ByteValueAndAdvance(unsigned char*& opcodePtr, int value)
 {
     put2ByteValue(opcodePtr, value);
     opcodePtr += 2;
 }
 
+static inline void put3ByteValueAndAdvance(unsigned char*& opcodePtr, int value)
+{
+    put3ByteValue(opcodePtr, value);
+    opcodePtr += 3;
+}
+
 static inline void putLinkValueAllowZero(unsigned char* opcodePtr, int value)
 {
+#if LINK_SIZE == 3
+    put3ByteValue(opcodePtr, value);
+#elif LINK_SIZE == 2
     put2ByteValue(opcodePtr, value);
+#else
+#   error LINK_SIZE not supported.
+#endif
 }
 
 static inline int getLinkValueAllowZero(const unsigned char* opcodePtr)
 {
+#if LINK_SIZE == 3
+    return get3ByteValue(opcodePtr);
+#elif LINK_SIZE == 2
     return get2ByteValue(opcodePtr);
+#else
+#   error LINK_SIZE not supported.
+#endif
 }
 
-#define MAX_PATTERN_SIZE (1 << 16)
+#define MAX_PATTERN_SIZE 1024 * 1024 // Derived by empirical testing of compile time in PCRE and WREC.
+COMPILE_ASSERT(MAX_PATTERN_SIZE < (1 << (8 * LINK_SIZE)), pcre_max_pattern_fits_in_bytecode);
 
 static inline void putLinkValue(unsigned char* opcodePtr, int value)
 {
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/CallIdentifier.h b/src/3rdparty/webkit/JavaScriptCore/profiler/CallIdentifier.h
index 6ceef13..ba48c55 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/CallIdentifier.h
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/CallIdentifier.h
@@ -28,10 +28,11 @@
 #define CallIdentifier_h
 
 #include <runtime/UString.h>
+#include "FastAllocBase.h"
 
 namespace JSC {
 
-    struct CallIdentifier {
+    struct CallIdentifier : public FastAllocBase {
         UString m_name;
         UString m_url;
         unsigned m_lineNumber;
@@ -51,32 +52,34 @@ namespace JSC {
         inline bool operator==(const CallIdentifier& ci) const { return ci.m_lineNumber == m_lineNumber && ci.m_name == m_name && ci.m_url == m_url; }
         inline bool operator!=(const CallIdentifier& ci) const { return !(*this == ci); }
 
+        struct Hash {
+            static unsigned hash(const CallIdentifier& key)
+            {
+                unsigned hashCodes[3] = {
+                    key.m_name.rep()->hash(),
+                    key.m_url.rep()->hash(),
+                    key.m_lineNumber
+                };
+                return UString::Rep::computeHash(reinterpret_cast<char*>(hashCodes), sizeof(hashCodes));
+            }
+
+            static bool equal(const CallIdentifier& a, const CallIdentifier& b) { return a == b; }
+            static const bool safeToCompareToEmptyOrDeleted = true;
+        };
+
+        unsigned hash() const { return Hash::hash(*this); }
+
 #ifndef NDEBUG
         operator const char*() const { return c_str(); }
         const char* c_str() const { return m_name.UTF8String().c_str(); }
 #endif
     };
 
-    struct CallIdentifierHash {
-        static unsigned hash(const CallIdentifier& key)
-        {
-            unsigned hashCodes[3] = {
-                key.m_name.rep()->hash(),
-                key.m_url.rep()->hash(),
-                key.m_lineNumber
-            };
-            return UString::Rep::computeHash(reinterpret_cast<char*>(hashCodes), sizeof(hashCodes));
-        }
-
-        static bool equal(const CallIdentifier& a, const CallIdentifier& b) { return a == b; }
-        static const bool safeToCompareToEmptyOrDeleted = true;
-    };
-
 } // namespace JSC
 
 namespace WTF {
 
-    template<> struct DefaultHash<JSC::CallIdentifier> { typedef JSC::CallIdentifierHash Hash; };
+    template<> struct DefaultHash<JSC::CallIdentifier> { typedef JSC::CallIdentifier::Hash Hash; };
 
     template<> struct HashTraits<JSC::CallIdentifier> : GenericHashTraits<JSC::CallIdentifier> {
         static void constructDeletedValue(JSC::CallIdentifier& slot)
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.cpp
index 5ea9d3b..e69de29 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.cpp
@@ -1,115 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "HeavyProfile.h"
-
-#include "TreeProfile.h"
-
-namespace JSC {
-
-HeavyProfile::HeavyProfile(TreeProfile* treeProfile)
-    : Profile(treeProfile->title(), treeProfile->uid())
-{
-    m_treeProfile = treeProfile;
-    head()->setTotalTime(m_treeProfile->head()->actualTotalTime());
-    head()->setSelfTime(m_treeProfile->head()->actualSelfTime());
-    generateHeavyStructure();
-}
-
-void HeavyProfile::generateHeavyStructure()
-{
-    ProfileNode* treeHead = m_treeProfile->head();
-    ProfileNode* currentNode = treeHead->firstChild();
-    for (ProfileNode* nextNode = currentNode; nextNode; nextNode = nextNode->firstChild())
-        currentNode = nextNode;
-
-    // For each node
-    HashMap<CallIdentifier, ProfileNode*> foundChildren;
-    while (currentNode && currentNode != treeHead) {
-        ProfileNode* child = foundChildren.get(currentNode->callIdentifier());
-        if (child) // currentNode is in the set already
-            mergeProfiles(child, currentNode);
-        else { // currentNode is not in the set
-            child = addNode(currentNode);
-            foundChildren.set(currentNode->callIdentifier(), child);
-        }
-
-        currentNode = currentNode->traverseNextNodePostOrder();
-    }
-}
-
-ProfileNode* HeavyProfile::addNode(ProfileNode* currentNode)
-{
-    RefPtr<ProfileNode> node = ProfileNode::create(head(), currentNode);
-    head()->addChild(node);
-
-    addAncestorsAsChildren(currentNode->parent(), node.get());
-    return node.get();
-}
-
-void HeavyProfile::mergeProfiles(ProfileNode* heavyProfileHead, ProfileNode* treeProfileHead)
-{
-    ASSERT_ARG(heavyProfileHead, heavyProfileHead);
-    ASSERT_ARG(treeProfileHead, treeProfileHead);
-
-    ProfileNode* currentTreeNode = treeProfileHead;
-    ProfileNode* currentHeavyNode = heavyProfileHead;
-    ProfileNode* previousHeavyNode = 0;
-    
-    while (currentHeavyNode) {
-        previousHeavyNode = currentHeavyNode;
-
-        currentHeavyNode->setTotalTime(currentHeavyNode->actualTotalTime() + currentTreeNode->actualTotalTime());
-        currentHeavyNode->setSelfTime(currentHeavyNode->actualSelfTime() + currentTreeNode->actualSelfTime());
-        currentHeavyNode->setNumberOfCalls(currentHeavyNode->numberOfCalls() + currentTreeNode->numberOfCalls());
-
-        currentTreeNode = currentTreeNode->parent();
-        currentHeavyNode = currentHeavyNode->findChild(currentTreeNode);
-    }
-
-    // If currentTreeNode is null then we already have the whole tree we wanted to copy.
-    // If not we need to copy the subset of the tree that remains different between the two.
-    if (currentTreeNode)
-        addAncestorsAsChildren(currentTreeNode, previousHeavyNode);
-}
-
-void HeavyProfile::addAncestorsAsChildren(ProfileNode* getFrom, ProfileNode* addTo)
-{
-    ASSERT_ARG(getFrom, getFrom);
-    ASSERT_ARG(addTo, addTo);
-
-    if (!getFrom->head())
-        return;
-
-    RefPtr<ProfileNode> currentNode = addTo;
-    for (ProfileNode* treeAncestor = getFrom; treeAncestor && treeAncestor != getFrom->head(); treeAncestor = treeAncestor->parent()) {
-        RefPtr<ProfileNode> newChild = ProfileNode::create(currentNode->head(), treeAncestor);
-        currentNode->addChild(newChild);
-        currentNode = newChild.release();
-    }
-}
-
-}   // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.h b/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.h
index 903d091..e69de29 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.h
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/HeavyProfile.h
@@ -1,63 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
- 
-#ifndef HeavyProfile_h
-#define HeavyProfile_h
-
-#include "Profile.h"
-#include "ProfileNode.h"
-#include "TreeProfile.h"
-
-namespace JSC {
-
-    class UString;
-
-    class HeavyProfile : public Profile {
-    public:
-        static PassRefPtr<HeavyProfile> create(TreeProfile* treeProfile)
-        {
-            return adoptRef(new HeavyProfile(treeProfile));
-        }
-
-        virtual Profile* heavyProfile() { return this; }
-        virtual Profile* treeProfile()
-        {
-            return m_treeProfile;
-        }
-
-
-    private:
-        HeavyProfile(TreeProfile*);
-        void generateHeavyStructure();
-        ProfileNode* addNode(ProfileNode*);
-        void mergeProfiles(ProfileNode* heavyProfileHead, ProfileNode* treeProfileHead);
-        void addAncestorsAsChildren(ProfileNode* getFrom, ProfileNode* addTo);
-
-        TreeProfile* m_treeProfile;
-    };
-
-} // namespace JSC
-
-#endif // HeavyProfile_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.cpp
index 72e6d21..de75e71 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.cpp
@@ -27,14 +27,13 @@
 #include "Profile.h"
 
 #include "ProfileNode.h"
-#include "TreeProfile.h"
 #include <stdio.h>
 
 namespace JSC {
 
 PassRefPtr<Profile> Profile::create(const UString& title, unsigned uid)
 {
-    return TreeProfile::create(title, uid);
+    return adoptRef(new Profile(title, uid));
 }
 
 Profile::Profile(const UString& title, unsigned uid)
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.h b/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.h
index dd96f77..6bf29f7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.h
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/Profile.h
@@ -45,22 +45,11 @@ namespace JSC {
         unsigned int uid() const { return m_uid; }
 
         void forEach(void (ProfileNode::*)());
-        void sortTotalTimeDescending() { forEach(&ProfileNode::sortTotalTimeDescending); }
-        void sortTotalTimeAscending() { forEach(&ProfileNode::sortTotalTimeAscending); }
-        void sortSelfTimeDescending() { forEach(&ProfileNode::sortSelfTimeDescending); }
-        void sortSelfTimeAscending() { forEach(&ProfileNode::sortSelfTimeAscending); }
-        void sortCallsDescending() { forEach(&ProfileNode::sortCallsDescending); }
-        void sortCallsAscending() { forEach(&ProfileNode::sortCallsAscending); }
-        void sortFunctionNameDescending() { forEach(&ProfileNode::sortFunctionNameDescending); }
-        void sortFunctionNameAscending() { forEach(&ProfileNode::sortFunctionNameAscending); }
 
         void focus(const ProfileNode*);
         void exclude(const ProfileNode*);
         void restoreAll();
 
-        virtual Profile* heavyProfile() = 0;
-        virtual Profile* treeProfile() = 0; 
-
 #ifndef NDEBUG
         void debugPrintData() const;
         void debugPrintDataSampleStyle() const;
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp
index 62e9fe3..1a061cb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.cpp
@@ -59,10 +59,10 @@ void ProfileGenerator::addParentForConsoleStart(ExecState* exec)
     int lineNumber;
     intptr_t sourceID;
     UString sourceURL;
-    JSValuePtr function;
+    JSValue function;
 
     exec->interpreter()->retrieveLastCaller(exec, lineNumber, sourceID, sourceURL, function);
-    m_currentNode = ProfileNode::create(Profiler::createCallIdentifier(&exec->globalData(), function ? function->toThisObject(exec) : 0, sourceURL, lineNumber), m_head.get(), m_head.get());
+    m_currentNode = ProfileNode::create(Profiler::createCallIdentifier(&exec->globalData(), function ? function.toThisObject(exec) : 0, sourceURL, lineNumber), m_head.get(), m_head.get());
     m_head->insertNode(m_currentNode.get());
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.h b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.h
index 54d4565..cccb502 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileGenerator.h
@@ -26,6 +26,7 @@
 #ifndef ProfileGenerator_h
 #define ProfileGenerator_h
 
+#include "Profile.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.cpp
index 3458902..19050aa 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.cpp
@@ -29,9 +29,9 @@
 #include "config.h"
 #include "ProfileNode.h"
 
-#include "DateMath.h"
 #include "Profiler.h"
 #include <stdio.h>
+#include <wtf/DateMath.h>
 
 #if PLATFORM(WIN_OS)
 #include <windows.h>
@@ -49,7 +49,7 @@ static double getCount()
     QueryPerformanceCounter(&counter);
     return static_cast<double>(counter.QuadPart) / frequency.QuadPart;
 #else
-    return getCurrentUTCTimeWithMicroseconds();
+    return WTF::getCurrentUTCTimeWithMicroseconds();
 #endif
 }
 
@@ -204,12 +204,6 @@ ProfileNode* ProfileNode::traverseNextNodePreOrder(bool processChildren) const
     return next;
 }
 
-void ProfileNode::sort(bool comparator(const RefPtr<ProfileNode>& , const RefPtr<ProfileNode>& ))
-{
-    std::sort(childrenBegin(), childrenEnd(), comparator);    
-    resetChildrensSiblings();
-}
-
 void ProfileNode::setTreeVisible(ProfileNode* node, bool visible)
 {
     ProfileNode* nodeParent = node->parent();
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.h b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.h
index b416011..2b5a936 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfileNode.h
@@ -112,16 +112,6 @@ namespace JSC {
         ProfileNode* traverseNextNodePostOrder() const;
         ProfileNode* traverseNextNodePreOrder(bool processChildren = true) const;
 
-        void sort(bool (*)(const RefPtr<ProfileNode>&, const RefPtr<ProfileNode>&));
-        void sortTotalTimeDescending() { sort(totalTimeDescendingComparator); }
-        void sortTotalTimeAscending() { sort(totalTimeAscendingComparator); }
-        void sortSelfTimeDescending() { sort(selfTimeDescendingComparator); }
-        void sortSelfTimeAscending() { sort(selfTimeAscendingComparator); }
-        void sortCallsDescending() { sort(callsDescendingComparator); }
-        void sortCallsAscending() { sort(callsAscendingComparator); }
-        void sortFunctionNameDescending() { sort(functionNameDescendingComparator); }
-        void sortFunctionNameAscending() { sort(functionNameAscendingComparator); }
-
         // Views
         void calculateVisibleTotalTime();
         bool focus(const CallIdentifier&);
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp
index 3df3b3f..e103fd1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.cpp
@@ -33,6 +33,7 @@
 #include "CallFrame.h"
 #include "JSFunction.h"
 #include "JSGlobalObject.h"
+#include "Nodes.h"
 #include "Profile.h"
 #include "ProfileGenerator.h"
 #include "ProfileNode.h"
@@ -58,6 +59,8 @@ Profiler* Profiler::profiler()
 
 void Profiler::startProfiling(ExecState* exec, const UString& title)
 {
+    ASSERT_ARG(title, !title.isNull());
+
     // Check if we currently have a Profile for this global ExecState and title.
     // If so return early and don't create a new Profile.
     ExecState* globalExec = exec ? exec->lexicalGlobalObject()->globalExec() : 0;
@@ -101,7 +104,7 @@ static inline void dispatchFunctionToProfiles(const Vector<RefPtr<ProfileGenerat
     }
 }
 
-void Profiler::willExecute(ExecState* exec, JSValuePtr function)
+void Profiler::willExecute(ExecState* exec, JSValue function)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
@@ -112,12 +115,12 @@ void Profiler::willExecute(ExecState* exec, const UString& sourceURL, int starti
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
-    CallIdentifier callIdentifier = createCallIdentifier(&exec->globalData(), noValue(), sourceURL, startingLineNumber);
+    CallIdentifier callIdentifier = createCallIdentifier(&exec->globalData(), JSValue(), sourceURL, startingLineNumber);
 
     dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::willExecute, callIdentifier, exec->lexicalGlobalObject()->profileGroup());
 }
 
-void Profiler::didExecute(ExecState* exec, JSValuePtr function)
+void Profiler::didExecute(ExecState* exec, JSValue function)
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
@@ -128,17 +131,20 @@ void Profiler::didExecute(ExecState* exec, const UString& sourceURL, int startin
 {
     ASSERT(!m_currentProfiles.isEmpty());
 
-    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(&exec->globalData(), noValue(), sourceURL, startingLineNumber), exec->lexicalGlobalObject()->profileGroup());
+    dispatchFunctionToProfiles(m_currentProfiles, &ProfileGenerator::didExecute, createCallIdentifier(&exec->globalData(), JSValue(), sourceURL, startingLineNumber), exec->lexicalGlobalObject()->profileGroup());
 }
 
-CallIdentifier Profiler::createCallIdentifier(JSGlobalData* globalData, JSValuePtr function, const UString& defaultSourceURL, int defaultLineNumber)
+CallIdentifier Profiler::createCallIdentifier(JSGlobalData* globalData, JSValue function, const UString& defaultSourceURL, int defaultLineNumber)
 {
     if (!function)
         return CallIdentifier(GlobalCodeExecution, defaultSourceURL, defaultLineNumber);
-    if (!function->isObject())
+    if (!function.isObject())
         return CallIdentifier("(unknown)", defaultSourceURL, defaultLineNumber);
-    if (asObject(function)->inherits(&JSFunction::info))
-        return createCallIdentifierFromFunctionImp(globalData, asFunction(function));
+    if (asObject(function)->inherits(&JSFunction::info)) {
+        JSFunction* func = asFunction(function);
+        if (!func->isHostFunction())
+            return createCallIdentifierFromFunctionImp(globalData, func);
+    }
     if (asObject(function)->inherits(&InternalFunction::info))
         return CallIdentifier(static_cast<InternalFunction*>(asObject(function))->name(globalData), defaultSourceURL, defaultLineNumber);
     return CallIdentifier("(" + asObject(function)->className() + " object)", defaultSourceURL, defaultLineNumber);
@@ -146,7 +152,7 @@ CallIdentifier Profiler::createCallIdentifier(JSGlobalData* globalData, JSValueP
 
 CallIdentifier createCallIdentifierFromFunctionImp(JSGlobalData* globalData, JSFunction* function)
 {
-    const UString& name = function->name(globalData);
+    const UString& name = function->calculatedDisplayName(globalData);
     return CallIdentifier(name.isEmpty() ? AnonymousFunction : name, function->body()->sourceURL(), function->body()->lineNo());
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h
index d00bccf..b37f613 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/Profiler.h
@@ -40,7 +40,7 @@ namespace JSC {
     class ExecState;
     class JSGlobalData;
     class JSObject;
-    class JSValuePtr;
+    class JSValue;
     class ProfileGenerator;
     class UString;
 
@@ -52,14 +52,14 @@ namespace JSC {
         }
 
         static Profiler* profiler(); 
-        static CallIdentifier createCallIdentifier(JSGlobalData*, JSValuePtr, const UString& sourceURL, int lineNumber);
+        static CallIdentifier createCallIdentifier(JSGlobalData*, JSValue, const UString& sourceURL, int lineNumber);
 
         void startProfiling(ExecState*, const UString& title);
         PassRefPtr<Profile> stopProfiling(ExecState*, const UString& title);
 
-        void willExecute(ExecState*, JSValuePtr function);
+        void willExecute(ExecState*, JSValue function);
         void willExecute(ExecState*, const UString& sourceURL, int startingLineNumber);
-        void didExecute(ExecState*, JSValuePtr function);
+        void didExecute(ExecState*, JSValue function);
         void didExecute(ExecState*, const UString& sourceURL, int startingLineNumber);
 
         const Vector<RefPtr<ProfileGenerator> >& currentProfiles() { return m_currentProfiles; };
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfilerServer.mm b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfilerServer.mm
index ef16f4c..a3944de 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/ProfilerServer.mm
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/ProfilerServer.mm
@@ -28,9 +28,12 @@
 
 #import "JSProfilerPrivate.h"
 #import "JSRetainPtr.h"
-
 #import <Foundation/Foundation.h>
 
+#if PLATFORM(IPHONE_SIMULATOR)
+#import <Foundation/NSDistributedNotificationCenter.h>
+#endif
+
 @interface ProfilerServer : NSObject {
 @private
     NSString *_serverName;
@@ -62,16 +65,22 @@
     if ([defaults boolForKey:@"EnableJSProfiling"])
         [self startProfiling];
 
+#if !PLATFORM(IPHONE) || PLATFORM(IPHONE_SIMULATOR)
+    // FIXME: <rdar://problem/6546135>
     // The catch-all notifications
     [[NSDistributedNotificationCenter defaultCenter] addObserver:self selector:@selector(startProfiling) name:@"ProfilerServerStartNotification" object:nil];
     [[NSDistributedNotificationCenter defaultCenter] addObserver:self selector:@selector(stopProfiling) name:@"ProfilerServerStopNotification" object:nil];
+#endif
 
     // The specific notifications
     NSProcessInfo *processInfo = [NSProcessInfo processInfo];
     _serverName = [[NSString alloc] initWithFormat:@"ProfilerServer-%d", [processInfo processIdentifier]];
 
+#if !PLATFORM(IPHONE) || PLATFORM(IPHONE_SIMULATOR)
+    // FIXME: <rdar://problem/6546135>
     [[NSDistributedNotificationCenter defaultCenter] addObserver:self selector:@selector(startProfiling) name:[_serverName stringByAppendingString:@"-Start"] object:nil];
     [[NSDistributedNotificationCenter defaultCenter] addObserver:self selector:@selector(stopProfiling) name:[_serverName stringByAppendingString:@"-Stop"] object:nil];
+#endif
 
     [pool drain];
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.cpp b/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.cpp
index 0c7fedb..e69de29 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.cpp
@@ -1,51 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "TreeProfile.h"
-
-#include "HeavyProfile.h"
-
-namespace JSC {
-
-PassRefPtr<TreeProfile> TreeProfile::create(const UString& title, unsigned uid)
-{
-    return adoptRef(new TreeProfile(title, uid));
-}
-
-TreeProfile::TreeProfile(const UString& title, unsigned uid)
-    : Profile(title, uid)
-{
-}
-
-Profile* TreeProfile::heavyProfile()
-{
-    if (!m_heavyProfile)
-        m_heavyProfile = HeavyProfile::create(this);
-
-    return m_heavyProfile.get();
-}
-
-} // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.h b/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.h
index ebef4d8..e69de29 100644
--- a/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.h
+++ b/src/3rdparty/webkit/JavaScriptCore/profiler/TreeProfile.h
@@ -1,51 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
- 
-#ifndef TreeProfile_h
-#define TreeProfile_h
-
-#include "Profile.h"
-
-namespace JSC {
-
-    class ExecState;
-    class HeavyProfile;
-    class UString;
-
-    class TreeProfile : public Profile {
-    public:
-        static PassRefPtr<TreeProfile> create(const UString& title, unsigned uid);
-
-        virtual Profile* heavyProfile();
-        virtual Profile* treeProfile() { return this; }
-
-    private:
-        TreeProfile(const UString& title, unsigned uid);
-        RefPtr<HeavyProfile> m_heavyProfile;
-    };
-
-} // namespace JSC
-
-#endif // TreeProfiler_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.cpp
index 5ead733..0b5d958 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.cpp
@@ -30,19 +30,18 @@ namespace JSC {
 
 void ArgList::getSlice(int startIndex, ArgList& result) const
 {
-    ASSERT(!result.m_isReadOnly);
-
-    const_iterator start = min(begin() + startIndex, end());
-    result.m_vector.appendRange(start, end());
-    result.m_size = result.m_vector.size();
-    result.m_buffer = result.m_vector.data();
+    if (startIndex <= 0 || static_cast<unsigned>(startIndex) >= m_argCount) {
+        result = ArgList(m_args, 0);
+        return;
+    }
+    result = ArgList(m_args + startIndex, m_argCount - startIndex);
 }
 
-void ArgList::markLists(ListSet& markSet)
+void MarkedArgumentBuffer::markLists(ListSet& markSet)
 {
     ListSet::iterator end = markSet.end();
     for (ListSet::iterator it = markSet.begin(); it != end; ++it) {
-        ArgList* list = *it;
+        MarkedArgumentBuffer* list = *it;
 
         iterator end2 = list->end();
         for (iterator it2 = list->begin(); it2 != end2; ++it2)
@@ -51,7 +50,7 @@ void ArgList::markLists(ListSet& markSet)
     }
 }
 
-void ArgList::slowAppend(JSValuePtr v)
+void MarkedArgumentBuffer::slowAppend(JSValue v)
 {
     // As long as our size stays within our Vector's inline 
     // capacity, all our values are allocated on the stack, and 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h
index a1763e0..4d571fc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArgList.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2007, 2008 Apple Computer, Inc.
+ *  Copyright (C) 2003, 2007, 2008, 2009 Apple Computer, Inc.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -31,11 +31,11 @@
 
 namespace JSC {
     
-    class ArgList : Noncopyable {
+    class MarkedArgumentBuffer : Noncopyable {
     private:
         static const unsigned inlineCapacity = 8;
         typedef Vector<Register, inlineCapacity> VectorType;
-        typedef HashSet<ArgList*> ListSet;
+        typedef HashSet<MarkedArgumentBuffer*> ListSet;
 
     public:
         typedef VectorType::iterator iterator;
@@ -43,8 +43,9 @@ namespace JSC {
 
         // Constructor for a read-write list, to which you may append values.
         // FIXME: Remove all clients of this API, then remove this API.
-        ArgList()
-            : m_markSet(0)
+        MarkedArgumentBuffer()
+            : m_isUsingInlineBuffer(true)
+            , m_markSet(0)
 #ifndef NDEBUG
             , m_isReadOnly(false)
 #endif
@@ -54,9 +55,10 @@ namespace JSC {
         }
 
         // Constructor for a read-only list whose data has already been allocated elsewhere.
-        ArgList(Register* buffer, size_t size)
+        MarkedArgumentBuffer(Register* buffer, size_t size)
             : m_buffer(buffer)
             , m_size(size)
+            , m_isUsingInlineBuffer(true)
             , m_markSet(0)
 #ifndef NDEBUG
             , m_isReadOnly(true)
@@ -76,7 +78,7 @@ namespace JSC {
 #endif
         }
 
-        ~ArgList()
+        ~MarkedArgumentBuffer()
         {
             if (m_markSet)
                 m_markSet->remove(this);
@@ -85,10 +87,10 @@ namespace JSC {
         size_t size() const { return m_size; }
         bool isEmpty() const { return !m_size; }
 
-        JSValuePtr at(ExecState* exec, size_t i) const
+        JSValue at(size_t i) const
         {
             if (i < m_size)
-                return m_buffer[i].jsValue(exec);
+                return m_buffer[i].jsValue();
             return jsUndefined();
         }
 
@@ -99,11 +101,11 @@ namespace JSC {
             m_size = 0;
         }
 
-        void append(JSValuePtr v)
+        void append(JSValue v)
         {
             ASSERT(!m_isReadOnly);
             
-            if (m_size < inlineCapacity) {
+            if (m_isUsingInlineBuffer && m_size < inlineCapacity) {
                 m_vector.uncheckedAppend(v);
                 ++m_size;
             } else {
@@ -111,11 +113,23 @@ namespace JSC {
                 // the performance of the fast "just append to inline buffer" case.
                 slowAppend(v);
                 ++m_size;
+                m_isUsingInlineBuffer = false;
             }
         }
 
-        void getSlice(int startIndex, ArgList& result) const;
+        void removeLast()
+        { 
+            ASSERT(m_size);
+            m_size--;
+            m_vector.removeLast();
+        }
 
+        JSValue last() 
+        {
+            ASSERT(m_size);
+            return m_buffer[m_size - 1].jsValue();
+        }
+        
         iterator begin() { return m_buffer; }
         iterator end() { return m_buffer + m_size; }
 
@@ -125,10 +139,11 @@ namespace JSC {
         static void markLists(ListSet&);
 
     private:
-        void slowAppend(JSValuePtr);
+        void slowAppend(JSValue);
         
         Register* m_buffer;
         size_t m_size;
+        bool m_isUsingInlineBuffer;
 
         VectorType m_vector;
         ListSet* m_markSet;
@@ -156,6 +171,60 @@ namespace JSC {
         void operator delete(void*, size_t);
     };
 
+    class ArgList {
+        friend class JIT;
+    public:
+        typedef JSValue* iterator;
+        typedef const JSValue* const_iterator;
+
+        ArgList()
+            : m_args(0)
+            , m_argCount(0)
+        {
+        }
+        
+        ArgList(JSValue* args, unsigned argCount)
+            : m_args(args)
+            , m_argCount(argCount)
+        {
+        }
+        
+        ArgList(Register* args, int argCount)
+            : m_args(reinterpret_cast<JSValue*>(args))
+            , m_argCount(argCount)
+        {
+            ASSERT(argCount >= 0);
+        }
+
+        ArgList(const MarkedArgumentBuffer& args)
+            : m_args(reinterpret_cast<JSValue*>(const_cast<Register*>(args.begin())))
+            , m_argCount(args.size())
+        {
+        }
+
+        JSValue at(size_t idx) const
+        {
+            if (idx < m_argCount)
+                return m_args[idx];
+            return jsUndefined();
+        }
+
+        bool isEmpty() const { return !m_argCount; }
+
+        size_t size() const { return m_argCount; }
+        
+        iterator begin() { return m_args; }
+        iterator end() { return m_args + m_argCount; }
+        
+        const_iterator begin() const { return m_args; }
+        const_iterator end() const { return m_args + m_argCount; }
+
+        void getSlice(int startIndex, ArgList& result) const;
+    private:
+        JSValue* m_args;
+        size_t m_argCount;
+    };
+
 } // namespace JSC
 
 #endif // ArgList_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp
index b0429a9..f867fe8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.cpp
@@ -69,8 +69,50 @@ void Arguments::mark()
         d->activation->mark();
 }
 
-void Arguments::fillArgList(ExecState* exec, ArgList& args)
+void Arguments::copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSize)
 {
+    if (UNLIKELY(d->overrodeLength)) {
+        unsigned length = min(get(exec, exec->propertyNames().length).toUInt32(exec), maxSize);
+        for (unsigned i = 0; i < length; i++)
+            buffer[i] = get(exec, i);
+        return;
+    }
+
+    if (LIKELY(!d->deletedArguments)) {
+        unsigned parametersLength = min(min(d->numParameters, d->numArguments), maxSize);
+        unsigned i = 0;
+        for (; i < parametersLength; ++i)
+            buffer[i] = d->registers[d->firstParameterIndex + i].jsValue();
+        for (; i < d->numArguments; ++i)
+            buffer[i] = d->extraArguments[i - d->numParameters].jsValue();
+        return;
+    }
+    
+    unsigned parametersLength = min(min(d->numParameters, d->numArguments), maxSize);
+    unsigned i = 0;
+    for (; i < parametersLength; ++i) {
+        if (!d->deletedArguments[i])
+            buffer[i] = d->registers[d->firstParameterIndex + i].jsValue();
+        else
+            buffer[i] = get(exec, i);
+    }
+    for (; i < d->numArguments; ++i) {
+        if (!d->deletedArguments[i])
+            buffer[i] = d->extraArguments[i - d->numParameters].jsValue();
+        else
+            buffer[i] = get(exec, i);
+    }
+}
+
+void Arguments::fillArgList(ExecState* exec, MarkedArgumentBuffer& args)
+{
+    if (UNLIKELY(d->overrodeLength)) {
+        unsigned length = get(exec, exec->propertyNames().length).toUInt32(exec); 
+        for (unsigned i = 0; i < length; i++) 
+            args.append(get(exec, i)); 
+        return;
+    }
+
     if (LIKELY(!d->deletedArguments)) {
         if (LIKELY(!d->numParameters)) {
             args.initialize(d->extraArguments, d->numArguments);
@@ -85,9 +127,9 @@ void Arguments::fillArgList(ExecState* exec, ArgList& args)
         unsigned parametersLength = min(d->numParameters, d->numArguments);
         unsigned i = 0;
         for (; i < parametersLength; ++i)
-            args.append(d->registers[d->firstParameterIndex + i].jsValue(exec));
+            args.append(d->registers[d->firstParameterIndex + i].jsValue());
         for (; i < d->numArguments; ++i)
-            args.append(d->extraArguments[i - d->numParameters].jsValue(exec));
+            args.append(d->extraArguments[i - d->numParameters].jsValue());
         return;
     }
 
@@ -95,13 +137,13 @@ void Arguments::fillArgList(ExecState* exec, ArgList& args)
     unsigned i = 0;
     for (; i < parametersLength; ++i) {
         if (!d->deletedArguments[i])
-            args.append(d->registers[d->firstParameterIndex + i].jsValue(exec));
+            args.append(d->registers[d->firstParameterIndex + i].jsValue());
         else
             args.append(get(exec, i));
     }
     for (; i < d->numArguments; ++i) {
         if (!d->deletedArguments[i])
-            args.append(d->extraArguments[i - d->numParameters].jsValue(exec));
+            args.append(d->extraArguments[i - d->numParameters].jsValue());
         else
             args.append(get(exec, i));
     }
@@ -113,7 +155,7 @@ bool Arguments::getOwnPropertySlot(ExecState* exec, unsigned i, PropertySlot& sl
         if (i < d->numParameters) {
             slot.setRegisterSlot(&d->registers[d->firstParameterIndex + i]);
         } else
-            slot.setValue(d->extraArguments[i - d->numParameters].jsValue(exec));
+            slot.setValue(d->extraArguments[i - d->numParameters].jsValue());
         return true;
     }
 
@@ -128,7 +170,7 @@ bool Arguments::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
         if (i < d->numParameters) {
             slot.setRegisterSlot(&d->registers[d->firstParameterIndex + i]);
         } else
-            slot.setValue(d->extraArguments[i - d->numParameters].jsValue(exec));
+            slot.setValue(d->extraArguments[i - d->numParameters].jsValue());
         return true;
     }
 
@@ -145,28 +187,28 @@ bool Arguments::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return JSObject::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-void Arguments::put(ExecState* exec, unsigned i, JSValuePtr value, PutPropertySlot& slot)
+void Arguments::put(ExecState* exec, unsigned i, JSValue value, PutPropertySlot& slot)
 {
     if (i < d->numArguments && (!d->deletedArguments || !d->deletedArguments[i])) {
         if (i < d->numParameters)
-            d->registers[d->firstParameterIndex + i] = JSValuePtr(value);
+            d->registers[d->firstParameterIndex + i] = JSValue(value);
         else
-            d->extraArguments[i - d->numParameters] = JSValuePtr(value);
+            d->extraArguments[i - d->numParameters] = JSValue(value);
         return;
     }
 
     JSObject::put(exec, Identifier(exec, UString::from(i)), value, slot);
 }
 
-void Arguments::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void Arguments::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     bool isArrayIndex;
     unsigned i = propertyName.toArrayIndex(&isArrayIndex);
     if (isArrayIndex && i < d->numArguments && (!d->deletedArguments || !d->deletedArguments[i])) {
         if (i < d->numParameters)
-            d->registers[d->firstParameterIndex + i] = JSValuePtr(value);
+            d->registers[d->firstParameterIndex + i] = JSValue(value);
         else
-            d->extraArguments[i - d->numParameters] = JSValuePtr(value);
+            d->extraArguments[i - d->numParameters] = JSValue(value);
         return;
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
index ebea6ad..72697eb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Arguments.h
@@ -63,8 +63,16 @@ namespace JSC {
 
         virtual void mark();
 
-        void fillArgList(ExecState*, ArgList&);
+        void fillArgList(ExecState*, MarkedArgumentBuffer&);
 
+        uint32_t numProvidedArguments(ExecState* exec) const 
+        {
+            if (UNLIKELY(d->overrodeLength))
+                return get(exec, exec->propertyNames().length).toUInt32(exec);
+            return d->numArguments; 
+        }
+        
+        void copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSize);
         void copyRegisters();
         bool isTornOff() const { return d->registerArray; }
         void setActivation(JSActivation* activation)
@@ -73,7 +81,7 @@ namespace JSC {
             d->registers = &activation->registerAt(0);
         }
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype) 
+        static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
             return Structure::create(prototype, TypeInfo(ObjectType)); 
         }
@@ -82,8 +90,8 @@ namespace JSC {
         void getArgumentsData(CallFrame*, JSFunction*&, ptrdiff_t& firstParameterIndex, Register*& argv, int& argc);
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
-        virtual void put(ExecState*, unsigned propertyName, JSValuePtr, PutPropertySlot&);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
+        virtual void put(ExecState*, unsigned propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
 
@@ -94,9 +102,9 @@ namespace JSC {
         OwnPtr<ArgumentsData> d;
     };
 
-    Arguments* asArguments(JSValuePtr);
+    Arguments* asArguments(JSValue);
 
-    inline Arguments* asArguments(JSValuePtr value)
+    inline Arguments* asArguments(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&Arguments::info));
         return static_cast<Arguments*>(asObject(value));
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.cpp
index e63abbc..e96bdfc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayConstructor.cpp
@@ -26,6 +26,7 @@
 
 #include "ArrayPrototype.h"
 #include "JSArray.h"
+#include "JSFunction.h"
 #include "Lookup.h"
 
 namespace JSC {
@@ -45,15 +46,15 @@ ArrayConstructor::ArrayConstructor(ExecState* exec, PassRefPtr<Structure> struct
 static JSObject* constructArrayWithSizeQuirk(ExecState* exec, const ArgList& args)
 {
     // a single numeric argument denotes the array size (!)
-    if (args.size() == 1 && args.at(exec, 0)->isNumber()) {
-        uint32_t n = args.at(exec, 0)->toUInt32(exec);
-        if (n != args.at(exec, 0)->toNumber(exec))
+    if (args.size() == 1 && args.at(0).isNumber()) {
+        uint32_t n = args.at(0).toUInt32(exec);
+        if (n != args.at(0).toNumber(exec))
             return throwError(exec, RangeError, "Array size is not a small enough positive integer.");
         return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), n);
     }
 
     // otherwise the array is constructed with the arguments in it
-    return new (exec) JSArray(exec, exec->lexicalGlobalObject()->arrayStructure(), args);
+    return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), args);
 }
 
 static JSObject* constructWithArrayConstructor(ExecState* exec, JSObject*, const ArgList& args)
@@ -68,7 +69,7 @@ ConstructType ArrayConstructor::getConstructData(ConstructData& constructData)
     return ConstructTypeHost;
 }
 
-static JSValuePtr callArrayConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callArrayConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     return constructArrayWithSizeQuirk(exec, args);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
index 0d6ebdd..807e59a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *  Copyright (C) 2003 Peter Kelly (pmk@post.com)
  *  Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
@@ -24,7 +24,10 @@
 #include "config.h"
 #include "ArrayPrototype.h"
 
+#include "CodeBlock.h"
+#include "CachedCall.h"
 #include "Interpreter.h"
+#include "JIT.h"
 #include "ObjectPrototype.h"
 #include "Lookup.h"
 #include "Operations.h"
@@ -36,25 +39,27 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(ArrayPrototype);
 
-static JSValuePtr arrayProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncToLocaleString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncConcat(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncJoin(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncPop(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncPush(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncReverse(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncShift(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncSlice(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncSort(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncSplice(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncUnShift(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncEvery(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncForEach(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncSome(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncIndexOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncFilter(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncMap(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr arrayProtoFuncLastIndexOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncConcat(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncPop(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncPush(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncReverse(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncShift(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncSlice(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncSort(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncUnShift(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncForEach(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncIndexOf(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncFilter(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncMap(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncReduce(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncReduceRight(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL arrayProtoFuncLastIndexOf(ExecState*, JSObject*, JSValue, const ArgList&);
 
 }
 
@@ -62,6 +67,23 @@ static JSValuePtr arrayProtoFuncLastIndexOf(ExecState*, JSObject*, JSValuePtr, c
 
 namespace JSC {
 
+static inline bool isNumericCompareFunction(CallType callType, const CallData& callData)
+{
+    if (callType != CallTypeJS)
+        return false;
+
+#if ENABLE(JIT)
+    // If the JIT is enabled then we need to preserve the invariant that every
+    // function with a CodeBlock also has JIT code.
+    callData.js.functionBody->jitCode(callData.js.scopeChain);
+    CodeBlock& codeBlock = callData.js.functionBody->generatedBytecode();
+#else
+    CodeBlock& codeBlock = callData.js.functionBody->bytecode(callData.js.scopeChain);
+#endif
+
+    return codeBlock.isNumericCompareFunction();
+}
+
 // ------------------------------ ArrayPrototype ----------------------------
 
 const ClassInfo ArrayPrototype::info = {"Array", &JSArray::info, 0, ExecState::arrayTable};
@@ -86,6 +108,8 @@ const ClassInfo ArrayPrototype::info = {"Array", &JSArray::info, 0, ExecState::a
   indexOf        arrayProtoFuncIndexOf        DontEnum|Function 1
   lastIndexOf    arrayProtoFuncLastIndexOf    DontEnum|Function 1
   filter         arrayProtoFuncFilter         DontEnum|Function 1
+  reduce         arrayProtoFuncReduce         DontEnum|Function 1
+  reduceRight    arrayProtoFuncReduceRight    DontEnum|Function 1
   map            arrayProtoFuncMap            DontEnum|Function 1
 @end
 */
@@ -104,36 +128,38 @@ bool ArrayPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& prope
 // ------------------------------ Array Functions ----------------------------
 
 // Helper function
-static JSValuePtr getProperty(ExecState* exec, JSObject* obj, unsigned index)
+static JSValue getProperty(ExecState* exec, JSObject* obj, unsigned index)
 {
     PropertySlot slot(obj);
     if (!obj->getPropertySlot(exec, index, slot))
-        return noValue();
+        return JSValue();
     return slot.getValue(exec, index);
 }
 
-static void putProperty(ExecState* exec, JSObject* obj, const Identifier& propertyName, JSValuePtr value)
+static void putProperty(ExecState* exec, JSObject* obj, const Identifier& propertyName, JSValue value)
 {
     PutPropertySlot slot;
     obj->put(exec, propertyName, value, slot);
 }
 
-JSValuePtr arrayProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&JSArray::info))
+    if (!thisValue.isObject(&JSArray::info))
         return throwError(exec, TypeError);
     JSObject* thisObj = asArray(thisValue);
 
     HashSet<JSObject*>& arrayVisitedElements = exec->globalData().arrayVisitedElements;
-    if (arrayVisitedElements.size() > MaxReentryDepth)
-        return throwError(exec, RangeError, "Maximum call stack size exceeded.");
+    if (arrayVisitedElements.size() >= MaxSecondaryThreadReentryDepth) {
+        if (!isMainThread() || arrayVisitedElements.size() >= MaxMainThreadReentryDepth)
+            return throwError(exec, RangeError, "Maximum call stack size exceeded.");
+    }
 
     bool alreadyVisited = !arrayVisitedElements.add(thisObj).second;
     if (alreadyVisited)
         return jsEmptyString(exec); // return an empty string, avoiding infinite recursion.
 
     Vector<UChar, 256> strBuffer;
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     for (unsigned k = 0; k < length; k++) {
         if (k >= 1)
             strBuffer.append(',');
@@ -143,11 +169,11 @@ JSValuePtr arrayProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisVal
             break;
         }
 
-        JSValuePtr element = thisObj->get(exec, k);
-        if (element->isUndefinedOrNull())
+        JSValue element = thisObj->get(exec, k);
+        if (element.isUndefinedOrNull())
             continue;
 
-        UString str = element->toString(exec);
+        UString str = element.toString(exec);
         strBuffer.append(str.data(), str.size());
 
         if (!strBuffer.data()) {
@@ -162,22 +188,24 @@ JSValuePtr arrayProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisVal
     return jsString(exec, UString(strBuffer.data(), strBuffer.data() ? strBuffer.size() : 0));
 }
 
-JSValuePtr arrayProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL arrayProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&JSArray::info))
+    if (!thisValue.isObject(&JSArray::info))
         return throwError(exec, TypeError);
     JSObject* thisObj = asArray(thisValue);
 
     HashSet<JSObject*>& arrayVisitedElements = exec->globalData().arrayVisitedElements;
-    if (arrayVisitedElements.size() > MaxReentryDepth)
-        return throwError(exec, RangeError, "Maximum call stack size exceeded.");
+    if (arrayVisitedElements.size() >= MaxSecondaryThreadReentryDepth) {
+        if (!isMainThread() || arrayVisitedElements.size() >= MaxMainThreadReentryDepth)
+            return throwError(exec, RangeError, "Maximum call stack size exceeded.");
+    }
 
     bool alreadyVisited = !arrayVisitedElements.add(thisObj).second;
     if (alreadyVisited)
         return jsEmptyString(exec); // return an empty string, avoding infinite recursion.
 
     Vector<UChar, 256> strBuffer;
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     for (unsigned k = 0; k < length; k++) {
         if (k >= 1)
             strBuffer.append(',');
@@ -187,19 +215,19 @@ JSValuePtr arrayProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValuePtr t
             break;
         }
 
-        JSValuePtr element = thisObj->get(exec, k);
-        if (element->isUndefinedOrNull())
+        JSValue element = thisObj->get(exec, k);
+        if (element.isUndefinedOrNull())
             continue;
 
-        JSObject* o = element->toObject(exec);
-        JSValuePtr conversionFunction = o->get(exec, exec->propertyNames().toLocaleString);
+        JSObject* o = element.toObject(exec);
+        JSValue conversionFunction = o->get(exec, exec->propertyNames().toLocaleString);
         UString str;
         CallData callData;
-        CallType callType = conversionFunction->getCallData(callData);
+        CallType callType = conversionFunction.getCallData(callData);
         if (callType != CallTypeNone)
-            str = call(exec, conversionFunction, callType, callData, element, exec->emptyList())->toString(exec);
+            str = call(exec, conversionFunction, callType, callData, element, exec->emptyList()).toString(exec);
         else
-            str = element->toString(exec);
+            str = element.toString(exec);
         strBuffer.append(str.data(), str.size());
 
         if (!strBuffer.data()) {
@@ -214,13 +242,15 @@ JSValuePtr arrayProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValuePtr t
     return jsString(exec, UString(strBuffer.data(), strBuffer.data() ? strBuffer.size() : 0));
 }
 
-JSValuePtr arrayProtoFuncJoin(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncJoin(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
     HashSet<JSObject*>& arrayVisitedElements = exec->globalData().arrayVisitedElements;
-    if (arrayVisitedElements.size() > MaxReentryDepth)
-        return throwError(exec, RangeError, "Maximum call stack size exceeded.");
+    if (arrayVisitedElements.size() >= MaxSecondaryThreadReentryDepth) {
+        if (!isMainThread() || arrayVisitedElements.size() >= MaxMainThreadReentryDepth)
+            return throwError(exec, RangeError, "Maximum call stack size exceeded.");
+    }
 
     bool alreadyVisited = !arrayVisitedElements.add(thisObj).second;
     if (alreadyVisited)
@@ -229,9 +259,9 @@ JSValuePtr arrayProtoFuncJoin(ExecState* exec, JSObject*, JSValuePtr thisValue,
     Vector<UChar, 256> strBuffer;
 
     UChar comma = ',';
-    UString separator = args.at(exec, 0)->isUndefined() ? UString(&comma, 1) : args.at(exec, 0)->toString(exec);
+    UString separator = args.at(0).isUndefined() ? UString(&comma, 1) : args.at(0).toString(exec);
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     for (unsigned k = 0; k < length; k++) {
         if (k >= 1)
             strBuffer.append(separator.data(), separator.size());
@@ -241,11 +271,11 @@ JSValuePtr arrayProtoFuncJoin(ExecState* exec, JSObject*, JSValuePtr thisValue,
             break;
         }
 
-        JSValuePtr element = thisObj->get(exec, k);
-        if (element->isUndefinedOrNull())
+        JSValue element = thisObj->get(exec, k);
+        if (element.isUndefinedOrNull())
             continue;
 
-        UString str = element->toString(exec);
+        UString str = element.toString(exec);
         strBuffer.append(str.data(), str.size());
 
         if (!strBuffer.data()) {
@@ -260,19 +290,19 @@ JSValuePtr arrayProtoFuncJoin(ExecState* exec, JSObject*, JSValuePtr thisValue,
     return jsString(exec, UString(strBuffer.data(), strBuffer.data() ? strBuffer.size() : 0));
 }
 
-JSValuePtr arrayProtoFuncConcat(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncConcat(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     JSArray* arr = constructEmptyArray(exec);
     int n = 0;
-    JSValuePtr curArg = thisValue->toThisObject(exec);
+    JSValue curArg = thisValue.toThisObject(exec);
     ArgList::const_iterator it = args.begin();
     ArgList::const_iterator end = args.end();
     while (1) {
-        if (curArg->isObject(&JSArray::info)) {
-            JSArray* curArray = asArray(curArg);
-            unsigned length = curArray->length();
+        if (curArg.isObject(&JSArray::info)) {
+            unsigned length = curArg.get(exec, exec->propertyNames().length).toUInt32(exec);
+            JSObject* curObject = curArg.toObject(exec);
             for (unsigned k = 0; k < length; ++k) {
-                if (JSValuePtr v = getProperty(exec, curArray, k))
+                if (JSValue v = getProperty(exec, curObject, k))
                     arr->put(exec, n, v);
                 n++;
             }
@@ -282,21 +312,21 @@ JSValuePtr arrayProtoFuncConcat(ExecState* exec, JSObject*, JSValuePtr thisValue
         }
         if (it == end)
             break;
-        curArg = (*it).jsValue(exec);
+        curArg = (*it);
         ++it;
     }
     arr->setLength(n);
     return arr;
 }
 
-JSValuePtr arrayProtoFuncPop(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL arrayProtoFuncPop(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (exec->interpreter()->isJSArray(thisValue))
+    if (isJSArray(&exec->globalData(), thisValue))
         return asArray(thisValue)->pop();
 
-    JSObject* thisObj = thisValue->toThisObject(exec);
-    JSValuePtr result;
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
+    JSValue result;
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (length == 0) {
         putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(exec, length));
         result = jsUndefined();
@@ -308,33 +338,33 @@ JSValuePtr arrayProtoFuncPop(ExecState* exec, JSObject*, JSValuePtr thisValue, c
     return result;
 }
 
-JSValuePtr arrayProtoFuncPush(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncPush(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (exec->interpreter()->isJSArray(thisValue) && args.size() == 1) {
+    if (isJSArray(&exec->globalData(), thisValue) && args.size() == 1) {
         JSArray* array = asArray(thisValue);
-        array->push(exec, args.begin()->jsValue(exec));
+        array->push(exec, *args.begin());
         return jsNumber(exec, array->length());
     }
 
-    JSObject* thisObj = thisValue->toThisObject(exec);
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     for (unsigned n = 0; n < args.size(); n++)
-        thisObj->put(exec, length + n, args.at(exec, n));
+        thisObj->put(exec, length + n, args.at(n));
     length += args.size();
     putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(exec, length));
     return jsNumber(exec, length);
 }
 
-JSValuePtr arrayProtoFuncReverse(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL arrayProtoFuncReverse(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     unsigned middle = length / 2;
 
     for (unsigned k = 0; k < middle; k++) {
         unsigned lk1 = length - k - 1;
-        JSValuePtr obj2 = getProperty(exec, thisObj, lk1);
-        JSValuePtr obj = getProperty(exec, thisObj, k);
+        JSValue obj2 = getProperty(exec, thisObj, lk1);
+        JSValue obj = getProperty(exec, thisObj, k);
 
         if (obj2)
             thisObj->put(exec, k, obj2);
@@ -349,19 +379,19 @@ JSValuePtr arrayProtoFuncReverse(ExecState* exec, JSObject*, JSValuePtr thisValu
     return thisObj;
 }
 
-JSValuePtr arrayProtoFuncShift(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL arrayProtoFuncShift(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
-    JSValuePtr result;
+    JSObject* thisObj = thisValue.toThisObject(exec);
+    JSValue result;
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (length == 0) {
         putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(exec, length));
         result = jsUndefined();
     } else {
         result = thisObj->get(exec, 0);
         for (unsigned k = 1; k < length; k++) {
-            if (JSValuePtr obj = getProperty(exec, thisObj, k))
+            if (JSValue obj = getProperty(exec, thisObj, k))
                 thisObj->put(exec, k - 1, obj);
             else
                 thisObj->deleteProperty(exec, k - 1);
@@ -372,17 +402,17 @@ JSValuePtr arrayProtoFuncShift(ExecState* exec, JSObject*, JSValuePtr thisValue,
     return result;
 }
 
-JSValuePtr arrayProtoFuncSlice(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncSlice(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     // http://developer.netscape.com/docs/manuals/js/client/jsref/array.htm#1193713 or 15.4.4.10
 
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
     // We return a new array
     JSArray* resObj = constructEmptyArray(exec);
-    JSValuePtr result = resObj;
-    double begin = args.at(exec, 0)->toInteger(exec);
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    JSValue result = resObj;
+    double begin = args.at(0).toInteger(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (begin >= 0) {
         if (begin > length)
             begin = length;
@@ -392,10 +422,10 @@ JSValuePtr arrayProtoFuncSlice(ExecState* exec, JSObject*, JSValuePtr thisValue,
             begin = 0;
     }
     double end;
-    if (args.at(exec, 1)->isUndefined())
+    if (args.at(1).isUndefined())
         end = length;
     else {
-        end = args.at(exec, 1)->toInteger(exec);
+        end = args.at(1).toInteger(exec);
         if (end < 0) {
             end += length;
             if (end < 0)
@@ -410,30 +440,32 @@ JSValuePtr arrayProtoFuncSlice(ExecState* exec, JSObject*, JSValuePtr thisValue,
     int b = static_cast<int>(begin);
     int e = static_cast<int>(end);
     for (int k = b; k < e; k++, n++) {
-        if (JSValuePtr v = getProperty(exec, thisObj, k))
+        if (JSValue v = getProperty(exec, thisObj, k))
             resObj->put(exec, n, v);
     }
     resObj->setLength(n);
     return result;
 }
 
-JSValuePtr arrayProtoFuncSort(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncSort(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
-    JSValuePtr function = args.at(exec, 0);
+    JSValue function = args.at(0);
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
 
     if (thisObj->classInfo() == &JSArray::info) {
-        if (callType != CallTypeNone)
+        if (isNumericCompareFunction(callType, callData))
+            asArray(thisObj)->sortNumeric(exec, function, callType, callData);
+        else if (callType != CallTypeNone)
             asArray(thisObj)->sort(exec, function, callType, callData);
         else
             asArray(thisObj)->sort(exec);
         return thisObj;
     }
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
 
     if (!length)
         return thisObj;
@@ -441,23 +473,23 @@ JSValuePtr arrayProtoFuncSort(ExecState* exec, JSObject*, JSValuePtr thisValue,
     // "Min" sort. Not the fastest, but definitely less code than heapsort
     // or quicksort, and much less swapping than bubblesort/insertionsort.
     for (unsigned i = 0; i < length - 1; ++i) {
-        JSValuePtr iObj = thisObj->get(exec, i);
+        JSValue iObj = thisObj->get(exec, i);
         unsigned themin = i;
-        JSValuePtr minObj = iObj;
+        JSValue minObj = iObj;
         for (unsigned j = i + 1; j < length; ++j) {
-            JSValuePtr jObj = thisObj->get(exec, j);
+            JSValue jObj = thisObj->get(exec, j);
             double compareResult;
-            if (jObj->isUndefined())
+            if (jObj.isUndefined())
                 compareResult = 1; // don't check minObj because there's no need to differentiate == (0) from > (1)
-            else if (minObj->isUndefined())
+            else if (minObj.isUndefined())
                 compareResult = -1;
             else if (callType != CallTypeNone) {
-                ArgList l;
+                MarkedArgumentBuffer l;
                 l.append(jObj);
                 l.append(minObj);
-                compareResult = call(exec, function, callType, callData, exec->globalThisValue(), l)->toNumber(exec);
+                compareResult = call(exec, function, callType, callData, exec->globalThisValue(), l).toNumber(exec);
             } else
-                compareResult = (jObj->toString(exec) < minObj->toString(exec)) ? -1 : 1;
+                compareResult = (jObj.toString(exec) < minObj.toString(exec)) ? -1 : 1;
 
             if (compareResult < 0) {
                 themin = j;
@@ -473,17 +505,17 @@ JSValuePtr arrayProtoFuncSort(ExecState* exec, JSObject*, JSValuePtr thisValue,
     return thisObj;
 }
 
-JSValuePtr arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
     // 15.4.4.12
     JSArray* resObj = constructEmptyArray(exec);
-    JSValuePtr result = resObj;
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    JSValue result = resObj;
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (!args.size())
         return jsUndefined();
-    int begin = args.at(exec, 0)->toUInt32(exec);
+    int begin = args.at(0).toUInt32(exec);
     if (begin < 0)
         begin = std::max<int>(begin + length, 0);
     else
@@ -491,12 +523,12 @@ JSValuePtr arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValuePtr thisValue
 
     unsigned deleteCount;
     if (args.size() > 1)
-        deleteCount = std::min<int>(std::max<int>(args.at(exec, 1)->toUInt32(exec), 0), length - begin);
+        deleteCount = std::min<int>(std::max<int>(args.at(1).toUInt32(exec), 0), length - begin);
     else
         deleteCount = length - begin;
 
     for (unsigned k = 0; k < deleteCount; k++) {
-        if (JSValuePtr v = getProperty(exec, thisObj, k + begin))
+        if (JSValue v = getProperty(exec, thisObj, k + begin))
             resObj->put(exec, k, v);
     }
     resObj->setLength(deleteCount);
@@ -505,7 +537,7 @@ JSValuePtr arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValuePtr thisValue
     if (additionalArgs != deleteCount) {
         if (additionalArgs < deleteCount) {
             for (unsigned k = begin; k < length - deleteCount; ++k) {
-                if (JSValuePtr v = getProperty(exec, thisObj, k + deleteCount))
+                if (JSValue v = getProperty(exec, thisObj, k + deleteCount))
                     thisObj->put(exec, k + additionalArgs, v);
                 else
                     thisObj->deleteProperty(exec, k + additionalArgs);
@@ -514,7 +546,7 @@ JSValuePtr arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValuePtr thisValue
                 thisObj->deleteProperty(exec, k - 1);
         } else {
             for (unsigned k = length - deleteCount; (int)k > begin; --k) {
-                if (JSValuePtr obj = getProperty(exec, thisObj, k + deleteCount - 1))
+                if (JSValue obj = getProperty(exec, thisObj, k + deleteCount - 1))
                     thisObj->put(exec, k + additionalArgs - 1, obj);
                 else
                     thisObj->deleteProperty(exec, k + additionalArgs - 1);
@@ -522,101 +554,138 @@ JSValuePtr arrayProtoFuncSplice(ExecState* exec, JSObject*, JSValuePtr thisValue
         }
     }
     for (unsigned k = 0; k < additionalArgs; ++k)
-        thisObj->put(exec, k + begin, args.at(exec, k + 2));
+        thisObj->put(exec, k + begin, args.at(k + 2));
 
     putProperty(exec, thisObj, exec->propertyNames().length, jsNumber(exec, length - deleteCount + additionalArgs));
     return result;
 }
 
-JSValuePtr arrayProtoFuncUnShift(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncUnShift(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
     // 15.4.4.13
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     unsigned nrArgs = args.size();
     if (nrArgs) {
         for (unsigned k = length; k > 0; --k) {
-            if (JSValuePtr v = getProperty(exec, thisObj, k - 1))
+            if (JSValue v = getProperty(exec, thisObj, k - 1))
                 thisObj->put(exec, k + nrArgs - 1, v);
             else
                 thisObj->deleteProperty(exec, k + nrArgs - 1);
         }
     }
     for (unsigned k = 0; k < nrArgs; ++k)
-        thisObj->put(exec, k, args.at(exec, k));
-    JSValuePtr result = jsNumber(exec, length + nrArgs);
+        thisObj->put(exec, k, args.at(k));
+    JSValue result = jsNumber(exec, length + nrArgs);
     putProperty(exec, thisObj, exec->propertyNames().length, result);
     return result;
 }
 
-JSValuePtr arrayProtoFuncFilter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncFilter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
-    JSValuePtr function = args.at(exec, 0);
+    JSValue function = args.at(0);
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone)
         return throwError(exec, TypeError);
 
-    JSObject* applyThis = args.at(exec, 1)->isUndefinedOrNull() ? exec->globalThisValue() : args.at(exec, 1)->toObject(exec);
+    JSObject* applyThis = args.at(1).isUndefinedOrNull() ? exec->globalThisValue() : args.at(1).toObject(exec);
     JSArray* resultArray = constructEmptyArray(exec);
 
     unsigned filterIndex = 0;
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
-    for (unsigned k = 0; k < length && !exec->hadException(); ++k) {
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    unsigned k = 0;
+    if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
+        JSFunction* f = asFunction(function);
+        JSArray* array = asArray(thisObj);
+        CachedCall cachedCall(exec, f, 3, exec->exceptionSlot());
+        for (; k < length && !exec->hadException(); ++k) {
+            if (!array->canGetIndex(k))
+                break;
+            JSValue v = array->getIndex(k);
+            cachedCall.setThis(applyThis);
+            cachedCall.setArgument(0, v);
+            cachedCall.setArgument(1, jsNumber(exec, k));
+            cachedCall.setArgument(2, thisObj);
+            
+            JSValue result = cachedCall.call();
+            if (result.toBoolean(exec))
+                resultArray->put(exec, filterIndex++, v);
+        }
+        if (k == length)
+            return resultArray;
+    }
+    for (; k < length && !exec->hadException(); ++k) {
         PropertySlot slot(thisObj);
 
         if (!thisObj->getPropertySlot(exec, k, slot))
             continue;
 
-        JSValuePtr v = slot.getValue(exec, k);
+        JSValue v = slot.getValue(exec, k);
 
-        ArgList eachArguments;
+        MarkedArgumentBuffer eachArguments;
 
         eachArguments.append(v);
         eachArguments.append(jsNumber(exec, k));
         eachArguments.append(thisObj);
 
-        JSValuePtr result = call(exec, function, callType, callData, applyThis, eachArguments);
+        JSValue result = call(exec, function, callType, callData, applyThis, eachArguments);
 
-        if (result->toBoolean(exec))
+        if (result.toBoolean(exec))
             resultArray->put(exec, filterIndex++, v);
     }
     return resultArray;
 }
 
-JSValuePtr arrayProtoFuncMap(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncMap(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
-    JSValuePtr function = args.at(exec, 0);
+    JSValue function = args.at(0);
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone)
         return throwError(exec, TypeError);
 
-    JSObject* applyThis = args.at(exec, 1)->isUndefinedOrNull() ? exec->globalThisValue() : args.at(exec, 1)->toObject(exec);
+    JSObject* applyThis = args.at(1).isUndefinedOrNull() ? exec->globalThisValue() : args.at(1).toObject(exec);
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
 
     JSArray* resultArray = constructEmptyArray(exec, length);
-
-    for (unsigned k = 0; k < length && !exec->hadException(); ++k) {
+    unsigned k = 0;
+    if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
+        JSFunction* f = asFunction(function);
+        JSArray* array = asArray(thisObj);
+        CachedCall cachedCall(exec, f, 3, exec->exceptionSlot());
+        for (; k < length && !exec->hadException(); ++k) {
+            if (UNLIKELY(!array->canGetIndex(k)))
+                break;
+
+            cachedCall.setThis(applyThis);
+            cachedCall.setArgument(0, array->getIndex(k));
+            cachedCall.setArgument(1, jsNumber(exec, k));
+            cachedCall.setArgument(2, thisObj);
+
+            resultArray->JSArray::put(exec, k, cachedCall.call());
+        }
+    }
+    for (; k < length && !exec->hadException(); ++k) {
         PropertySlot slot(thisObj);
         if (!thisObj->getPropertySlot(exec, k, slot))
             continue;
 
-        JSValuePtr v = slot.getValue(exec, k);
+        JSValue v = slot.getValue(exec, k);
 
-        ArgList eachArguments;
+        MarkedArgumentBuffer eachArguments;
 
         eachArguments.append(v);
         eachArguments.append(jsNumber(exec, k));
         eachArguments.append(thisObj);
 
-        JSValuePtr result = call(exec, function, callType, callData, applyThis, eachArguments);
+        JSValue result = call(exec, function, callType, callData, applyThis, eachArguments);
         resultArray->put(exec, k, result);
     }
 
@@ -628,34 +697,52 @@ JSValuePtr arrayProtoFuncMap(ExecState* exec, JSObject*, JSValuePtr thisValue, c
 // http://developer-test.mozilla.org/en/docs/Core_JavaScript_1.5_Reference:Objects:Array:forEach
 // http://developer-test.mozilla.org/en/docs/Core_JavaScript_1.5_Reference:Objects:Array:some
 
-JSValuePtr arrayProtoFuncEvery(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncEvery(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
-    JSValuePtr function = args.at(exec, 0);
+    JSValue function = args.at(0);
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone)
         return throwError(exec, TypeError);
 
-    JSObject* applyThis = args.at(exec, 1)->isUndefinedOrNull() ? exec->globalThisValue() : args.at(exec, 1)->toObject(exec);
-
-    JSValuePtr result = jsBoolean(true);
-
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
-    for (unsigned k = 0; k < length && !exec->hadException(); ++k) {
+    JSObject* applyThis = args.at(1).isUndefinedOrNull() ? exec->globalThisValue() : args.at(1).toObject(exec);
+
+    JSValue result = jsBoolean(true);
+
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    unsigned k = 0;
+    if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
+        JSFunction* f = asFunction(function);
+        JSArray* array = asArray(thisObj);
+        CachedCall cachedCall(exec, f, 3, exec->exceptionSlot());
+        for (; k < length && !exec->hadException(); ++k) {
+            if (UNLIKELY(!array->canGetIndex(k)))
+                break;
+            
+            cachedCall.setThis(applyThis);
+            cachedCall.setArgument(0, array->getIndex(k));
+            cachedCall.setArgument(1, jsNumber(exec, k));
+            cachedCall.setArgument(2, thisObj);
+            
+            if (!cachedCall.call().toBoolean(exec))
+                return jsBoolean(false);
+        }
+    }
+    for (; k < length && !exec->hadException(); ++k) {
         PropertySlot slot(thisObj);
 
         if (!thisObj->getPropertySlot(exec, k, slot))
             continue;
 
-        ArgList eachArguments;
+        MarkedArgumentBuffer eachArguments;
 
         eachArguments.append(slot.getValue(exec, k));
         eachArguments.append(jsNumber(exec, k));
         eachArguments.append(thisObj);
 
-        bool predicateResult = call(exec, function, callType, callData, applyThis, eachArguments)->toBoolean(exec);
+        bool predicateResult = call(exec, function, callType, callData, applyThis, eachArguments).toBoolean(exec);
 
         if (!predicateResult) {
             result = jsBoolean(false);
@@ -666,25 +753,42 @@ JSValuePtr arrayProtoFuncEvery(ExecState* exec, JSObject*, JSValuePtr thisValue,
     return result;
 }
 
-JSValuePtr arrayProtoFuncForEach(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncForEach(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
-    JSValuePtr function = args.at(exec, 0);
+    JSValue function = args.at(0);
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone)
         return throwError(exec, TypeError);
 
-    JSObject* applyThis = args.at(exec, 1)->isUndefinedOrNull() ? exec->globalThisValue() : args.at(exec, 1)->toObject(exec);
+    JSObject* applyThis = args.at(1).isUndefinedOrNull() ? exec->globalThisValue() : args.at(1).toObject(exec);
+
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    unsigned k = 0;
+    if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
+        JSFunction* f = asFunction(function);
+        JSArray* array = asArray(thisObj);
+        CachedCall cachedCall(exec, f, 3, exec->exceptionSlot());
+        for (; k < length && !exec->hadException(); ++k) {
+            if (UNLIKELY(!array->canGetIndex(k)))
+                break;
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
-    for (unsigned k = 0; k < length && !exec->hadException(); ++k) {
+            cachedCall.setThis(applyThis);
+            cachedCall.setArgument(0, array->getIndex(k));
+            cachedCall.setArgument(1, jsNumber(exec, k));
+            cachedCall.setArgument(2, thisObj);
+
+            cachedCall.call();
+        }
+    }
+    for (; k < length && !exec->hadException(); ++k) {
         PropertySlot slot(thisObj);
         if (!thisObj->getPropertySlot(exec, k, slot))
             continue;
 
-        ArgList eachArguments;
+        MarkedArgumentBuffer eachArguments;
         eachArguments.append(slot.getValue(exec, k));
         eachArguments.append(jsNumber(exec, k));
         eachArguments.append(thisObj);
@@ -694,32 +798,50 @@ JSValuePtr arrayProtoFuncForEach(ExecState* exec, JSObject*, JSValuePtr thisValu
     return jsUndefined();
 }
 
-JSValuePtr arrayProtoFuncSome(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncSome(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
-    JSValuePtr function = args.at(exec, 0);
+    JSValue function = args.at(0);
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone)
         return throwError(exec, TypeError);
 
-    JSObject* applyThis = args.at(exec, 1)->isUndefinedOrNull() ? exec->globalThisValue() : args.at(exec, 1)->toObject(exec);
-
-    JSValuePtr result = jsBoolean(false);
-
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
-    for (unsigned k = 0; k < length && !exec->hadException(); ++k) {
+    JSObject* applyThis = args.at(1).isUndefinedOrNull() ? exec->globalThisValue() : args.at(1).toObject(exec);
+
+    JSValue result = jsBoolean(false);
+
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    unsigned k = 0;
+    if (callType == CallTypeJS && isJSArray(&exec->globalData(), thisObj)) {
+        JSFunction* f = asFunction(function);
+        JSArray* array = asArray(thisObj);
+        CachedCall cachedCall(exec, f, 3, exec->exceptionSlot());
+        for (; k < length && !exec->hadException(); ++k) {
+            if (UNLIKELY(!array->canGetIndex(k)))
+                break;
+            
+            cachedCall.setThis(applyThis);
+            cachedCall.setArgument(0, array->getIndex(k));
+            cachedCall.setArgument(1, jsNumber(exec, k));
+            cachedCall.setArgument(2, thisObj);
+            
+            if (cachedCall.call().toBoolean(exec))
+                return jsBoolean(true);
+        }
+    }
+    for (; k < length && !exec->hadException(); ++k) {
         PropertySlot slot(thisObj);
         if (!thisObj->getPropertySlot(exec, k, slot))
             continue;
 
-        ArgList eachArguments;
+        MarkedArgumentBuffer eachArguments;
         eachArguments.append(slot.getValue(exec, k));
         eachArguments.append(jsNumber(exec, k));
         eachArguments.append(thisObj);
 
-        bool predicateResult = call(exec, function, callType, callData, applyThis, eachArguments)->toBoolean(exec);
+        bool predicateResult = call(exec, function, callType, callData, applyThis, eachArguments).toBoolean(exec);
 
         if (predicateResult) {
             result = jsBoolean(true);
@@ -729,16 +851,155 @@ JSValuePtr arrayProtoFuncSome(ExecState* exec, JSObject*, JSValuePtr thisValue,
     return result;
 }
 
-JSValuePtr arrayProtoFuncIndexOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncReduce(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    JSObject* thisObj = thisValue.toThisObject(exec);
+    
+    JSValue function = args.at(0);
+    CallData callData;
+    CallType callType = function.getCallData(callData);
+    if (callType == CallTypeNone)
+        return throwError(exec, TypeError);
+
+    unsigned i = 0;
+    JSValue rv;
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (!length && args.size() == 1)
+        return throwError(exec, TypeError);
+    JSArray* array = 0;
+    if (isJSArray(&exec->globalData(), thisObj))
+        array = asArray(thisObj);
+
+    if (args.size() >= 2)
+        rv = args.at(1);
+    else if (array && array->canGetIndex(0)){
+        rv = array->getIndex(0);
+        i = 1;
+    } else {
+        for (i = 0; i < length; i++) {
+            rv = getProperty(exec, thisObj, i);
+            if (rv)
+                break;
+        }
+        if (!rv)
+            return throwError(exec, TypeError);
+        i++;
+    }
+
+    if (callType == CallTypeJS && array) {
+        CachedCall cachedCall(exec, asFunction(function), 4, exec->exceptionSlot());
+        for (; i < length && !exec->hadException(); ++i) {
+            cachedCall.setThis(jsNull());
+            cachedCall.setArgument(0, rv);
+            JSValue v;
+            if (LIKELY(array->canGetIndex(i)))
+                v = array->getIndex(i);
+            else
+                break; // length has been made unsafe while we enumerate fallback to slow path
+            cachedCall.setArgument(1, v);
+            cachedCall.setArgument(2, jsNumber(exec, i));
+            cachedCall.setArgument(3, array);
+            rv = cachedCall.call();
+        }
+        if (i == length) // only return if we reached the end of the array
+            return rv;
+    }
+
+    for (; i < length && !exec->hadException(); ++i) {
+        JSValue prop = getProperty(exec, thisObj, i);
+        if (!prop)
+            continue;
+        
+        MarkedArgumentBuffer eachArguments;
+        eachArguments.append(rv);
+        eachArguments.append(prop);
+        eachArguments.append(jsNumber(exec, i));
+        eachArguments.append(thisObj);
+        
+        rv = call(exec, function, callType, callData, jsNull(), eachArguments);
+    }
+    return rv;
+}
+
+JSValue JSC_HOST_CALL arrayProtoFuncReduceRight(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    JSObject* thisObj = thisValue.toThisObject(exec);
+    
+    JSValue function = args.at(0);
+    CallData callData;
+    CallType callType = function.getCallData(callData);
+    if (callType == CallTypeNone)
+        return throwError(exec, TypeError);
+    
+    unsigned i = 0;
+    JSValue rv;
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
+    if (!length && args.size() == 1)
+        return throwError(exec, TypeError);
+    JSArray* array = 0;
+    if (isJSArray(&exec->globalData(), thisObj))
+        array = asArray(thisObj);
+    
+    if (args.size() >= 2)
+        rv = args.at(1);
+    else if (array && array->canGetIndex(length - 1)){
+        rv = array->getIndex(length - 1);
+        i = 1;
+    } else {
+        for (i = 0; i < length; i++) {
+            rv = getProperty(exec, thisObj, length - i - 1);
+            if (rv)
+                break;
+        }
+        if (!rv)
+            return throwError(exec, TypeError);
+        i++;
+    }
+    
+    if (callType == CallTypeJS && array) {
+        CachedCall cachedCall(exec, asFunction(function), 4, exec->exceptionSlot());
+        for (; i < length && !exec->hadException(); ++i) {
+            unsigned idx = length - i - 1;
+            cachedCall.setThis(jsNull());
+            cachedCall.setArgument(0, rv);
+            if (UNLIKELY(!array->canGetIndex(idx)))
+                break; // length has been made unsafe while we enumerate fallback to slow path
+            cachedCall.setArgument(1, array->getIndex(idx));
+            cachedCall.setArgument(2, jsNumber(exec, idx));
+            cachedCall.setArgument(3, array);
+            rv = cachedCall.call();
+        }
+        if (i == length) // only return if we reached the end of the array
+            return rv;
+    }
+    
+    for (; i < length && !exec->hadException(); ++i) {
+        unsigned idx = length - i - 1;
+        JSValue prop = getProperty(exec, thisObj, idx);
+        if (!prop)
+            continue;
+        
+        MarkedArgumentBuffer eachArguments;
+        eachArguments.append(rv);
+        eachArguments.append(prop);
+        eachArguments.append(jsNumber(exec, idx));
+        eachArguments.append(thisObj);
+        
+        rv = call(exec, function, callType, callData, jsNull(), eachArguments);
+    }
+    return rv;        
+}
+
+JSValue JSC_HOST_CALL arrayProtoFuncIndexOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     // JavaScript 1.5 Extension by Mozilla
     // Documentation: http://developer.mozilla.org/en/docs/Core_JavaScript_1.5_Reference:Global_Objects:Array:indexOf
 
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
     unsigned index = 0;
-    double d = args.at(exec, 1)->toInteger(exec);
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    double d = args.at(1).toInteger(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     if (d < 0)
         d += length;
     if (d > 0) {
@@ -748,28 +1009,28 @@ JSValuePtr arrayProtoFuncIndexOf(ExecState* exec, JSObject*, JSValuePtr thisValu
             index = static_cast<unsigned>(d);
     }
 
-    JSValuePtr searchElement = args.at(exec, 0);
+    JSValue searchElement = args.at(0);
     for (; index < length; ++index) {
-        JSValuePtr e = getProperty(exec, thisObj, index);
+        JSValue e = getProperty(exec, thisObj, index);
         if (!e)
             continue;
-        if (strictEqual(searchElement, e))
+        if (JSValue::strictEqual(searchElement, e))
             return jsNumber(exec, index);
     }
 
     return jsNumber(exec, -1);
 }
 
-JSValuePtr arrayProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL arrayProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     // JavaScript 1.6 Extension by Mozilla
     // Documentation: http://developer.mozilla.org/en/docs/Core_JavaScript_1.5_Reference:Global_Objects:Array:lastIndexOf
 
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
-    unsigned length = thisObj->get(exec, exec->propertyNames().length)->toUInt32(exec);
+    unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     int index = length - 1;
-    double d = args.at(exec, 1)->toIntegerPreserveNaN(exec);
+    double d = args.at(1).toIntegerPreserveNaN(exec);
 
     if (d < 0) {
         d += length;
@@ -779,12 +1040,12 @@ JSValuePtr arrayProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSValuePtr this
     if (d < length)
         index = static_cast<int>(d);
 
-    JSValuePtr searchElement = args.at(exec, 0);
+    JSValue searchElement = args.at(0);
     for (; index >= 0; --index) {
-        JSValuePtr e = getProperty(exec, thisObj, index);
+        JSValue e = getProperty(exec, thisObj, index);
         if (!e)
             continue;
-        if (strictEqual(searchElement, e))
+        if (JSValue::strictEqual(searchElement, e))
             return jsNumber(exec, index);
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanConstructor.cpp
index aa245bb..9fcba37 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanConstructor.cpp
@@ -41,7 +41,7 @@ BooleanConstructor::BooleanConstructor(ExecState* exec, PassRefPtr<Structure> st
 JSObject* constructBoolean(ExecState* exec, const ArgList& args)
 {
     BooleanObject* obj = new (exec) BooleanObject(exec->lexicalGlobalObject()->booleanObjectStructure());
-    obj->setInternalValue(jsBoolean(args.at(exec, 0)->toBoolean(exec)));
+    obj->setInternalValue(jsBoolean(args.at(0).toBoolean(exec)));
     return obj;
 }
 
@@ -57,9 +57,9 @@ ConstructType BooleanConstructor::getConstructData(ConstructData& constructData)
 }
 
 // ECMA 15.6.1
-static JSValuePtr callBooleanConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callBooleanConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsBoolean(args.at(exec, 0)->toBoolean(exec));
+    return jsBoolean(args.at(0).toBoolean(exec));
 }
 
 CallType BooleanConstructor::getCallData(CallData& callData)
@@ -68,7 +68,7 @@ CallType BooleanConstructor::getCallData(CallData& callData)
     return CallTypeHost;
 }
 
-JSObject* constructBooleanFromImmediateBoolean(ExecState* exec, JSValuePtr immediateBooleanValue)
+JSObject* constructBooleanFromImmediateBoolean(ExecState* exec, JSValue immediateBooleanValue)
 {
     BooleanObject* obj = new (exec) BooleanObject(exec->lexicalGlobalObject()->booleanObjectStructure());
     obj->setInternalValue(immediateBooleanValue);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanConstructor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanConstructor.h
index db4e8e2..d9f51ab 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanConstructor.h
@@ -36,7 +36,7 @@ namespace JSC {
         virtual CallType getCallData(CallData&);
     };
 
-    JSObject* constructBooleanFromImmediateBoolean(ExecState*, JSValuePtr);
+    JSObject* constructBooleanFromImmediateBoolean(ExecState*, JSValue);
     JSObject* constructBoolean(ExecState*, const ArgList&);
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
index 68941e3..cfd55fe 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanObject.h
@@ -33,9 +33,9 @@ namespace JSC {
         static const ClassInfo info;
     };
 
-    BooleanObject* asBooleanObject(JSValuePtr);
+    BooleanObject* asBooleanObject(JSValue);
 
-    inline BooleanObject* asBooleanObject(JSValuePtr value)
+    inline BooleanObject* asBooleanObject(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&BooleanObject::info));
         return static_cast<BooleanObject*>(asObject(value));
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanPrototype.cpp
index 77a7a1e..703a568 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/BooleanPrototype.cpp
@@ -22,6 +22,7 @@
 #include "BooleanPrototype.h"
 
 #include "Error.h"
+#include "JSFunction.h"
 #include "JSString.h"
 #include "ObjectPrototype.h"
 #include "PrototypeFunction.h"
@@ -31,8 +32,8 @@ namespace JSC {
 ASSERT_CLASS_FITS_IN_CELL(BooleanPrototype);
 
 // Functions
-static JSValuePtr booleanProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr booleanProtoFuncValueOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL booleanProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL booleanProtoFuncValueOf(ExecState*, JSObject*, JSValue, const ArgList&);
 
 // ECMA 15.6.4
 
@@ -41,8 +42,8 @@ BooleanPrototype::BooleanPrototype(ExecState* exec, PassRefPtr<Structure> struct
 {
     setInternalValue(jsBoolean(false));
 
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, booleanProtoFuncToString), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().valueOf, booleanProtoFuncValueOf), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, booleanProtoFuncToString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().valueOf, booleanProtoFuncValueOf), DontEnum);
 }
 
 
@@ -50,7 +51,7 @@ BooleanPrototype::BooleanPrototype(ExecState* exec, PassRefPtr<Structure> struct
 
 // ECMA 15.6.4.2 + 15.6.4.3
 
-JSValuePtr booleanProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL booleanProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     if (thisValue == jsBoolean(false))
         return jsNontrivialString(exec, "false");
@@ -58,7 +59,7 @@ JSValuePtr booleanProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisV
     if (thisValue == jsBoolean(true))
         return jsNontrivialString(exec, "true");
 
-    if (!thisValue->isObject(&BooleanObject::info))
+    if (!thisValue.isObject(&BooleanObject::info))
         return throwError(exec, TypeError);
 
     if (asBooleanObject(thisValue)->internalValue() == jsBoolean(false))
@@ -68,12 +69,12 @@ JSValuePtr booleanProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisV
     return jsNontrivialString(exec, "true");
 }
 
-JSValuePtr booleanProtoFuncValueOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL booleanProtoFuncValueOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (JSImmediate::isBoolean(thisValue))
+    if (thisValue.isBoolean())
         return thisValue;
 
-    if (!thisValue->isObject(&BooleanObject::info))
+    if (!thisValue.isObject(&BooleanObject::info))
         return throwError(exec, TypeError);
 
     return asBooleanObject(thisValue)->internalValue();
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.cpp
index fbb6392..62e42fe 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.cpp
@@ -30,7 +30,7 @@
 
 namespace JSC {
 
-JSValuePtr call(ExecState* exec, JSValuePtr functionObject, CallType callType, const CallData& callData, JSValuePtr thisValue, const ArgList& args)
+JSValue call(ExecState* exec, JSValue functionObject, CallType callType, const CallData& callData, JSValue thisValue, const ArgList& args)
 {
     if (callType == CallTypeHost)
         return callData.native.function(exec, asObject(functionObject), thisValue, args);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.h b/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.h
index b8d84cd..d5b0172 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/CallData.h
@@ -29,13 +29,15 @@
 #ifndef CallData_h
 #define CallData_h
 
+#include "NativeFunctionWrapper.h"
+
 namespace JSC {
 
     class ArgList;
     class ExecState;
     class FunctionBodyNode;
     class JSObject;
-    class JSValuePtr;
+    class JSValue;
     class ScopeChainNode;
 
     enum CallType {
@@ -44,7 +46,7 @@ namespace JSC {
         CallTypeJS
     };
 
-    typedef JSValuePtr (*NativeFunction)(ExecState*, JSObject*, JSValuePtr thisValue, const ArgList&);
+    typedef JSValue (JSC_HOST_CALL *NativeFunction)(ExecState*, JSObject*, JSValue thisValue, const ArgList&);
 
     union CallData {
         struct {
@@ -56,7 +58,7 @@ namespace JSC {
         } js;
     };
 
-    JSValuePtr call(ExecState*, JSValuePtr functionObject, CallType, const CallData&, JSValuePtr thisValue, const ArgList&);
+    JSValue call(ExecState*, JSValue functionObject, CallType, const CallData&, JSValue thisValue, const ArgList&);
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
index 69cb05e..0ff97b8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.cpp
@@ -1,7 +1,6 @@
 /*
  *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  *  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
- *  Copyright (C) 2008 Torch Mobile, Inc.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -23,13 +22,15 @@
 #include "Collector.h"
 
 #include "ArgList.h"
-#include "CollectorHeapIterator.h"
 #include "CallFrame.h"
+#include "CollectorHeapIterator.h"
+#include "Interpreter.h"
 #include "JSGlobalObject.h"
 #include "JSLock.h"
+#include "JSONObject.h"
 #include "JSString.h"
 #include "JSValue.h"
-#include "Interpreter.h"
+#include "Nodes.h"
 #include "Tracing.h"
 #include <algorithm>
 #include <setjmp.h>
@@ -37,11 +38,12 @@
 #include <wtf/FastMalloc.h>
 #include <wtf/HashCountedSet.h>
 #include <wtf/UnusedParam.h>
+#include <wtf/VMTags.h>
 
 #if PLATFORM(DARWIN)
 
-#include <mach/mach_port.h>
 #include <mach/mach_init.h>
+#include <mach/mach_port.h>
 #include <mach/task.h>
 #include <mach/thread_act.h>
 #include <mach/vm_map.h>
@@ -74,9 +76,7 @@ extern int *__libc_stack_end;
 
 #if PLATFORM(SOLARIS)
 #include <thread.h>
-#endif
-
-#if PLATFORM(OPENBSD)
+#else
 #include <pthread.h>
 #endif
 
@@ -199,7 +199,7 @@ static NEVER_INLINE CollectorBlock* allocateBlock()
 #if PLATFORM(DARWIN)
     vm_address_t address = 0;
     // FIXME: tag the region as a JavaScriptCore heap when we get a registered VM tag: <rdar://problem/6054788>.
-    vm_map(current_task(), &address, BLOCK_SIZE, BLOCK_OFFSET_MASK, VM_FLAGS_ANYWHERE, MEMORY_OBJECT_NULL, 0, FALSE, VM_PROT_DEFAULT, VM_PROT_DEFAULT, VM_INHERIT_DEFAULT);
+    vm_map(current_task(), &address, BLOCK_SIZE, BLOCK_OFFSET_MASK, VM_FLAGS_ANYWHERE | VM_TAG_FOR_COLLECTOR_MEMORY, MEMORY_OBJECT_NULL, 0, FALSE, VM_PROT_DEFAULT, VM_PROT_DEFAULT, VM_INHERIT_DEFAULT);
 #elif PLATFORM(SYMBIAN)
     // no memory map in symbian, need to hack with fastMalloc
     void* address = fastMalloc(BLOCK_SIZE);
@@ -365,6 +365,9 @@ collect:
         // didn't find a block, and GC didn't reclaim anything, need to allocate a new block
         size_t numBlocks = heap.numBlocks;
         if (usedBlocks == numBlocks) {
+            static const size_t maxNumBlocks = ULONG_MAX / sizeof(CollectorBlock*) / GROWTH_FACTOR;
+            if (numBlocks > maxNumBlocks)
+                CRASH();
             numBlocks = max(MIN_ARRAY_SIZE, numBlocks * GROWTH_FACTOR);
             heap.numBlocks = numBlocks;
             heap.blocks = static_cast<CollectorBlock**>(fastRealloc(heap.blocks, numBlocks * sizeof(CollectorBlock*)));
@@ -406,54 +409,68 @@ void* Heap::allocateNumber(size_t s)
     return heapAllocate<NumberHeap>(s);
 }
 
-#if PLATFORM(WIN_CE)
-// Return the number of bytes that are writable starting at p.
-// The pointer p is assumed to be page aligned.
-static inline DWORD numberOfWritableBytes(void* p)
-{
-    MEMORY_BASIC_INFORMATION buf;
-    DWORD result = VirtualQuery(p, &buf, sizeof(buf));
-    ASSERT(result == sizeof(buf));
-    DWORD protect = (buf.Protect & ~(PAGE_GUARD | PAGE_NOCACHE));
-
-    // check if the page is writable
-    if (protect != PAGE_READWRITE && protect != PAGE_WRITECOPY &&
-        protect != PAGE_EXECUTE_READWRITE && protect != PAGE_EXECUTE_WRITECOPY)
-        return 0;
+#if PLATFORM(WINCE)
+void* g_stackBase = 0;
 
-    if (buf.State != MEM_COMMIT)
-        return 0;
-
-    return buf.RegionSize;
-}
-
-static DWORD systemPageSize()
- {
-    SYSTEM_INFO sysInfo;
-    GetSystemInfo(&sysInfo);
-    return sysInfo.dwPageSize;
+inline bool isPageWritable(void* page)
+{
+    MEMORY_BASIC_INFORMATION memoryInformation;
+    DWORD result = VirtualQuery(page, &memoryInformation, sizeof(memoryInformation));
+
+    // return false on error, including ptr outside memory
+    if (result != sizeof(memoryInformation))
+        return false;
+
+    DWORD protect = memoryInformation.Protect & ~(PAGE_GUARD | PAGE_NOCACHE);
+    return protect == PAGE_READWRITE
+        || protect == PAGE_WRITECOPY
+        || protect == PAGE_EXECUTE_READWRITE
+        || protect == PAGE_EXECUTE_WRITECOPY;
 }
 
-static inline void* currentThreadStackBaseWinCE()
+static void* getStackBase(void* previousFrame)
 {
-    static DWORD pageSize = systemPageSize();
-    int dummy;
-    void* sp = &dummy;
-    char* alignedStackPtr = reinterpret_cast<char*>((DWORD)sp & ~(pageSize - 1));
-    DWORD size = 0;
-    while (size = numberOfWritableBytes(alignedStackPtr))
-        alignedStackPtr += size;
-    return alignedStackPtr;
+    // find the address of this stack frame by taking the address of a local variable
+    bool isGrowingDownward;
+    void* thisFrame = (void*)(&isGrowingDownward);
+
+    isGrowingDownward = previousFrame < &thisFrame;
+    static DWORD pageSize = 0;
+    if (!pageSize) {
+        SYSTEM_INFO systemInfo;
+        GetSystemInfo(&systemInfo);
+        pageSize = systemInfo.dwPageSize;
+    }
+
+    // scan all of memory starting from this frame, and return the last writeable page found
+    register char* currentPage = (char*)((DWORD)thisFrame & ~(pageSize - 1));
+    if (isGrowingDownward) {
+        while (currentPage > 0) {
+            // check for underflow
+            if (currentPage >= (char*)pageSize)
+                currentPage -= pageSize;
+            else
+                currentPage = 0;
+            if (!isPageWritable(currentPage))
+                return currentPage + pageSize;
+        }
+        return 0;
+    } else {
+        while (true) {
+            // guaranteed to complete because isPageWritable returns false at end of memory
+            currentPage += pageSize;
+            if (!isPageWritable(currentPage))
+                return currentPage;
+        }
+    }
 }
-#endif // PLATFORM(WIN_CE)
+#endif
 
 static inline void* currentThreadStackBase()
 {
 #if PLATFORM(DARWIN)
     pthread_t thread = pthread_self();
     return pthread_get_stackaddr_np(thread);
-#elif PLATFORM(WIN_CE)
-    return currentThreadStackBaseWinCE();
 #elif PLATFORM(WIN_OS) && PLATFORM(X86) && COMPILER(MSVC)
     // offset 0x18 from the FS segment register gives a pointer to
     // the thread information block for the current thread
@@ -483,6 +500,15 @@ static inline void* currentThreadStackBase()
     stack_t stack;
     pthread_stackseg_np(thread, &stack);
     return stack.ss_sp;
+#elif PLATFORM(SYMBIAN)
+    static void* stackBase = 0;
+    if (stackBase == 0) {
+        TThreadStackInfo info;
+        RThread thread;
+        thread.StackInfo(info);
+        stackBase = (void*)info.iBase;
+    }
+    return (void*)stackBase;
 #elif PLATFORM(UNIX)
 #ifdef UCLIBC_USE_PROC_SELF_MAPS
     // Read /proc/self/maps and locate the line whose address
@@ -548,15 +574,13 @@ static inline void* currentThreadStackBase()
     }
     return static_cast<char*>(stackBase) + stackSize;
 #endif
-#elif PLATFORM(SYMBIAN)
-    static void* stackBase = 0;
-    if (stackBase == 0) {
-        TThreadStackInfo info;
-        RThread thread;
-        thread.StackInfo(info);
-        stackBase = (void*)info.iBase;
+#elif PLATFORM(WINCE)
+    if (g_stackBase)
+        return g_stackBase;
+    else {
+        int dummy;
+        return getStackBase(&dummy);
     }
-    return (void*)stackBase;
 #else
 #error Need a way to get the stack base on this platform
 #endif
@@ -768,7 +792,7 @@ typedef CONTEXT PlatformThreadRegisters;
 #error Need a thread register struct for this platform
 #endif
 
-size_t getPlatformThreadRegisters(const PlatformThread& platformThread, PlatformThreadRegisters& regs)
+static size_t getPlatformThreadRegisters(const PlatformThread& platformThread, PlatformThreadRegisters& regs)
 {
 #if PLATFORM(DARWIN)
 
@@ -906,45 +930,45 @@ void Heap::setGCProtectNeedsLocking()
         m_protectedValuesMutex.set(new Mutex);
 }
 
-void Heap::protect(JSValuePtr k)
+void Heap::protect(JSValue k)
 {
     ASSERT(k);
     ASSERT(JSLock::currentThreadIsHoldingLock() || !m_globalData->isSharedInstance);
 
-    if (JSImmediate::isImmediate(k))
+    if (!k.isCell())
         return;
 
     if (m_protectedValuesMutex)
         m_protectedValuesMutex->lock();
 
-    m_protectedValues.add(k->asCell());
+    m_protectedValues.add(k.asCell());
 
     if (m_protectedValuesMutex)
         m_protectedValuesMutex->unlock();
 }
 
-void Heap::unprotect(JSValuePtr k)
+void Heap::unprotect(JSValue k)
 {
     ASSERT(k);
     ASSERT(JSLock::currentThreadIsHoldingLock() || !m_globalData->isSharedInstance);
 
-    if (JSImmediate::isImmediate(k))
+    if (!k.isCell())
         return;
 
     if (m_protectedValuesMutex)
         m_protectedValuesMutex->lock();
 
-    m_protectedValues.remove(k->asCell());
+    m_protectedValues.remove(k.asCell());
 
     if (m_protectedValuesMutex)
         m_protectedValuesMutex->unlock();
 }
 
-Heap* Heap::heap(JSValuePtr v)
+Heap* Heap::heap(JSValue v)
 {
-    if (JSImmediate::isImmediate(v))
+    if (!v.isCell())
         return 0;
-    return Heap::cellBlock(v->asCell())->heap;
+    return Heap::cellBlock(v.asCell())->heap;
 }
 
 void Heap::markProtectedObjects()
@@ -1084,11 +1108,15 @@ bool Heap::collect()
     markStackObjectsConservatively();
     markProtectedObjects();
     if (m_markListSet && m_markListSet->size())
-        ArgList::markLists(*m_markListSet);
-    if (m_globalData->exception && !m_globalData->exception->marked())
-        m_globalData->exception->mark();
+        MarkedArgumentBuffer::markLists(*m_markListSet);
+    if (m_globalData->exception && !m_globalData->exception.marked())
+        m_globalData->exception.mark();
     m_globalData->interpreter->registerFile().markCallFrames(this);
     m_globalData->smallStrings.mark();
+    if (m_globalData->scopeNodeBeingReparsed)
+        m_globalData->scopeNodeBeingReparsed->mark();
+    if (m_globalData->firstStringifierToMark)
+        JSONObject::markStringifiers(m_globalData->firstStringifierToMark);
 
     JAVASCRIPTCORE_GC_MARKED();
 
@@ -1105,7 +1133,7 @@ bool Heap::collect()
 
 size_t Heap::objectCount() 
 {
-    return primaryHeap.numLiveObjects + numberHeap.numLiveObjects; 
+    return primaryHeap.numLiveObjects + numberHeap.numLiveObjects - m_globalData->smallStrings.count(); 
 }
 
 template <HeapType heapType> 
@@ -1175,16 +1203,16 @@ size_t Heap::protectedObjectCount()
     return result;
 }
 
-static const char* typeName(JSCell* val)
+static const char* typeName(JSCell* cell)
 {
-    if (val->isString())
+    if (cell->isString())
         return "string";
-    if (val->isNumber())
+    if (cell->isNumber())
         return "number";
-    if (val->isGetterSetter())
+    if (cell->isGetterSetter())
         return "gettersetter";
-    ASSERT(val->isObject());
-    const ClassInfo* info = static_cast<JSObject*>(val)->classInfo();
+    ASSERT(cell->isObject());
+    const ClassInfo* info = static_cast<JSObject*>(cell)->classInfo();
     return info ? info->className : "Object";
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
index ba41d60..23f9f15 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Collector.h
@@ -39,11 +39,11 @@
 
 namespace JSC {
 
-    class ArgList;
+    class MarkedArgumentBuffer;
     class CollectorBlock;
     class JSCell;
     class JSGlobalData;
-    class JSValuePtr;
+    class JSValue;
 
     enum OperationInProgress { NoOperation, Allocation, Collection };
     enum HeapType { PrimaryHeap, NumberHeap };
@@ -96,10 +96,10 @@ namespace JSC {
         Statistics statistics() const;
 
         void setGCProtectNeedsLocking();
-        void protect(JSValuePtr);
-        void unprotect(JSValuePtr);
+        void protect(JSValue);
+        void unprotect(JSValue);
 
-        static Heap* heap(JSValuePtr); // 0 for immediate values
+        static Heap* heap(JSValue); // 0 for immediate values
 
         size_t globalObjectCount();
         size_t protectedObjectCount();
@@ -113,7 +113,7 @@ namespace JSC {
 
         void markConservatively(void* start, void* end);
 
-        HashSet<ArgList*>& markListSet() { if (!m_markListSet) m_markListSet = new HashSet<ArgList*>; return *m_markListSet; }
+        HashSet<MarkedArgumentBuffer*>& markListSet() { if (!m_markListSet) m_markListSet = new HashSet<MarkedArgumentBuffer*>; return *m_markListSet; }
 
         JSGlobalData* globalData() const { return m_globalData; }
         static bool isNumber(JSCell*);
@@ -147,7 +147,7 @@ namespace JSC {
         OwnPtr<Mutex> m_protectedValuesMutex; // Only non-null if the client explicitly requested it via setGCPrtotectNeedsLocking().
         ProtectCountSet m_protectedValues;
 
-        HashSet<ArgList*>* m_markListSet;
+        HashSet<MarkedArgumentBuffer*>* m_markListSet;
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
         void makeUsableFromMultipleThreads();
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.cpp
index fe0a830..3837817 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.cpp
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2003, 2007 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2007, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -23,12 +23,13 @@
 
 namespace JSC {
 
-const char* const nullCString = 0;
+static const char* const nullCString = 0;
 
 #define INITIALIZE_PROPERTY_NAME(name) , name(globalData, #name)
 
 CommonIdentifiers::CommonIdentifiers(JSGlobalData* globalData)
     : nullIdentifier(globalData, nullCString)
+    , emptyIdentifier(globalData, "")
     , underscoreProto(globalData, "__proto__")
     , thisIdentifier(globalData, "this")
     JSC_COMMON_IDENTIFIERS_EACH_PROPERTY_NAME(INITIALIZE_PROPERTY_NAME)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h b/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h
index 45b99a8..408d819 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/CommonIdentifiers.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2003,2007 Apple Computer, Inc
+ *  Copyright (C) 2003, 2007, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -24,7 +24,7 @@
 #include "Identifier.h"
 #include <wtf/Noncopyable.h>
 
-// ArgList of property names, passed to a macro so we can do set them up various
+// MarkedArgumentBuffer of property names, passed to a macro so we can do set them up various
 // ways without repeating the list.
 #define JSC_COMMON_IDENTIFIERS_EACH_PROPERTY_NAME(macro) \
     macro(__defineGetter__) \
@@ -59,11 +59,14 @@
     macro(test) \
     macro(toExponential) \
     macro(toFixed) \
+    macro(toISOString) \
+    macro(toJSON) \
     macro(toLocaleString) \
     macro(toPrecision) \
     macro(toString) \
     macro(UTC) \
-    macro(valueOf)
+    macro(valueOf) \
+    macro(displayName)
 
 namespace JSC {
 
@@ -74,6 +77,7 @@ namespace JSC {
 
     public:
         const Identifier nullIdentifier;
+        const Identifier emptyIdentifier;
         const Identifier underscoreProto;
         const Identifier thisIdentifier;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp
index b4923f7..b8b1581 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.cpp
@@ -50,7 +50,7 @@ Completion checkSyntax(ExecState* exec, const SourceCode& source)
     return Completion(Normal);
 }
 
-Completion evaluate(ExecState* exec, ScopeChain& scopeChain, const SourceCode& source, JSValuePtr thisValue)
+Completion evaluate(ExecState* exec, ScopeChain& scopeChain, const SourceCode& source, JSValue thisValue)
 {
     JSLock lock(exec);
     
@@ -61,14 +61,14 @@ Completion evaluate(ExecState* exec, ScopeChain& scopeChain, const SourceCode& s
     if (!programNode)
         return Completion(Throw, Error::create(exec, SyntaxError, errMsg, errLine, source.provider()->asID(), source.provider()->url()));
 
-    JSObject* thisObj = (!thisValue || thisValue->isUndefinedOrNull()) ? exec->dynamicGlobalObject() : thisValue->toObject(exec);
+    JSObject* thisObj = (!thisValue || thisValue.isUndefinedOrNull()) ? exec->dynamicGlobalObject() : thisValue.toObject(exec);
 
-    JSValuePtr exception = noValue();
-    JSValuePtr result = exec->interpreter()->execute(programNode.get(), exec, scopeChain.node(), thisObj, &exception);
+    JSValue exception;
+    JSValue result = exec->interpreter()->execute(programNode.get(), exec, scopeChain.node(), thisObj, &exception);
 
     if (exception) {
-        if (exception->isObject() && asObject(exception)->isWatchdogException())
-            return Completion(Interrupted, result);
+        if (exception.isObject() && asObject(exception)->isWatchdogException())
+            return Completion(Interrupted, exception);
         return Completion(Throw, exception);
     }
     return Completion(Normal, result);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.h
index 9631b50..41c9a64 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Completion.h
@@ -39,24 +39,24 @@ namespace JSC {
      */
     class Completion {
     public:
-        Completion(ComplType type = Normal, JSValuePtr value = noValue())
+        Completion(ComplType type = Normal, JSValue value = JSValue())
             : m_type(type)
             , m_value(value)
         {
         }
 
         ComplType complType() const { return m_type; }
-        JSValuePtr value() const { return m_value; }
-        void setValue(JSValuePtr v) { m_value = v; }
+        JSValue value() const { return m_value; }
+        void setValue(JSValue v) { m_value = v; }
         bool isValueCompletion() const { return m_value; }
 
     private:
         ComplType m_type;
-        JSValuePtr m_value;
+        JSValue m_value;
     };
 
     Completion checkSyntax(ExecState*, const SourceCode&);
-    Completion evaluate(ExecState*, ScopeChain&, const SourceCode&, JSValuePtr thisValue = noValue());
+    Completion evaluate(ExecState*, ScopeChain&, const SourceCode&, JSValue thisValue = JSValue());
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.cpp
index 7a729ae..7ee59d7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.cpp
@@ -30,7 +30,7 @@
 
 namespace JSC {
 
-JSObject* construct(ExecState* exec, JSValuePtr object, ConstructType constructType, const ConstructData& constructData, const ArgList& args)
+JSObject* construct(ExecState* exec, JSValue object, ConstructType constructType, const ConstructData& constructData, const ArgList& args)
 {
     if (constructType == ConstructTypeHost)
         return constructData.native.function(exec, asObject(object), args);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.h
index 559c1bd..9d580d5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ConstructData.h
@@ -35,7 +35,7 @@ namespace JSC {
     class ExecState;
     class FunctionBodyNode;
     class JSObject;
-    class JSValuePtr;
+    class JSValue;
     class ScopeChainNode;
 
     enum ConstructType {
@@ -56,7 +56,7 @@ namespace JSC {
         } js;
     };
 
-    JSObject* construct(ExecState*, JSValuePtr constructor, ConstructType, const ConstructData&, const ArgList&);
+    JSObject* construct(ExecState*, JSValue constructor, ConstructType, const ConstructData&, const ArgList&);
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp
index 6510f4b..6d7d934 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConstructor.cpp
@@ -22,17 +22,23 @@
 #include "config.h"
 #include "DateConstructor.h"
 
+#include "DateConversion.h"
 #include "DateInstance.h"
-#include "DateMath.h"
 #include "DatePrototype.h"
+#include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "JSString.h"
 #include "ObjectPrototype.h"
 #include "PrototypeFunction.h"
 #include <math.h>
 #include <time.h>
+#include <wtf/DateMath.h>
 #include <wtf/MathExtras.h>
 
+#if PLATFORM(WINCE) && !PLATFORM(QT)
+extern "C" time_t time(time_t* timer); //provided by libce
+#endif
+
 #if HAVE(SYS_TIME_H)
 #include <sys/time.h>
 #endif
@@ -41,24 +47,26 @@
 #include <sys/timeb.h>
 #endif
 
+using namespace WTF;
+
 namespace JSC {
 
 // TODO: MakeTime (15.9.11.1) etc. ?
 
 ASSERT_CLASS_FITS_IN_CELL(DateConstructor);
 
-static JSValuePtr dateParse(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateNow(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateUTC(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL dateParse(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateNow(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateUTC(ExecState*, JSObject*, JSValue, const ArgList&);
 
 DateConstructor::DateConstructor(ExecState* exec, PassRefPtr<Structure> structure, Structure* prototypeFunctionStructure, DatePrototype* datePrototype)
     : InternalFunction(&exec->globalData(), structure, Identifier(exec, datePrototype->classInfo()->className))
 {
       putDirectWithoutTransition(exec->propertyNames().prototype, datePrototype, DontEnum|DontDelete|ReadOnly);
 
-      putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().parse, dateParse), DontEnum);
-      putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 7, exec->propertyNames().UTC, dateUTC), DontEnum);
-      putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().now, dateNow), DontEnum);
+      putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().parse, dateParse), DontEnum);
+      putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 7, exec->propertyNames().UTC, dateUTC), DontEnum);
+      putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().now, dateNow), DontEnum);
 
       putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 7), ReadOnly | DontEnum | DontDelete);
 }
@@ -73,35 +81,35 @@ JSObject* constructDate(ExecState* exec, const ArgList& args)
     if (numArgs == 0) // new Date() ECMA 15.9.3.3
         value = getCurrentUTCTime();
     else if (numArgs == 1) {
-        if (args.at(exec, 0)->isObject(&DateInstance::info))
-            value = asDateInstance(args.at(exec, 0))->internalNumber();
+        if (args.at(0).isObject(&DateInstance::info))
+            value = asDateInstance(args.at(0))->internalNumber();
         else {
-            JSValuePtr primitive = args.at(exec, 0)->toPrimitive(exec);
-            if (primitive->isString())
-                value = parseDate(primitive->getString());
+            JSValue primitive = args.at(0).toPrimitive(exec);
+            if (primitive.isString())
+                value = parseDate(primitive.getString());
             else
-                value = primitive->toNumber(exec);
+                value = primitive.toNumber(exec);
         }
     } else {
-        if (isnan(args.at(exec, 0)->toNumber(exec))
-                || isnan(args.at(exec, 1)->toNumber(exec))
-                || (numArgs >= 3 && isnan(args.at(exec, 2)->toNumber(exec)))
-                || (numArgs >= 4 && isnan(args.at(exec, 3)->toNumber(exec)))
-                || (numArgs >= 5 && isnan(args.at(exec, 4)->toNumber(exec)))
-                || (numArgs >= 6 && isnan(args.at(exec, 5)->toNumber(exec)))
-                || (numArgs >= 7 && isnan(args.at(exec, 6)->toNumber(exec))))
+        if (isnan(args.at(0).toNumber(exec))
+                || isnan(args.at(1).toNumber(exec))
+                || (numArgs >= 3 && isnan(args.at(2).toNumber(exec)))
+                || (numArgs >= 4 && isnan(args.at(3).toNumber(exec)))
+                || (numArgs >= 5 && isnan(args.at(4).toNumber(exec)))
+                || (numArgs >= 6 && isnan(args.at(5).toNumber(exec)))
+                || (numArgs >= 7 && isnan(args.at(6).toNumber(exec))))
             value = NaN;
         else {
           GregorianDateTime t;
-          int year = args.at(exec, 0)->toInt32(exec);
+          int year = args.at(0).toInt32(exec);
           t.year = (year >= 0 && year <= 99) ? year : year - 1900;
-          t.month = args.at(exec, 1)->toInt32(exec);
-          t.monthDay = (numArgs >= 3) ? args.at(exec, 2)->toInt32(exec) : 1;
-          t.hour = args.at(exec, 3)->toInt32(exec);
-          t.minute = args.at(exec, 4)->toInt32(exec);
-          t.second = args.at(exec, 5)->toInt32(exec);
+          t.month = args.at(1).toInt32(exec);
+          t.monthDay = (numArgs >= 3) ? args.at(2).toInt32(exec) : 1;
+          t.hour = args.at(3).toInt32(exec);
+          t.minute = args.at(4).toInt32(exec);
+          t.second = args.at(5).toInt32(exec);
           t.isDST = -1;
-          double ms = (numArgs >= 7) ? args.at(exec, 6)->toNumber(exec) : 0;
+          double ms = (numArgs >= 7) ? args.at(6).toNumber(exec) : 0;
           value = gregorianDateTimeToMS(t, ms, false);
         }
     }
@@ -123,7 +131,7 @@ ConstructType DateConstructor::getConstructData(ConstructData& constructData)
 }
 
 // ECMA 15.9.2
-static JSValuePtr callDate(ExecState* exec, JSObject*, JSValuePtr, const ArgList&)
+static JSValue JSC_HOST_CALL callDate(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
     time_t localTime = time(0);
     tm localTM;
@@ -138,37 +146,37 @@ CallType DateConstructor::getCallData(CallData& callData)
     return CallTypeHost;
 }
 
-static JSValuePtr dateParse(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL dateParse(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, parseDate(args.at(exec, 0)->toString(exec)));
+    return jsNumber(exec, parseDate(args.at(0).toString(exec)));
 }
 
-static JSValuePtr dateNow(ExecState* exec, JSObject*, JSValuePtr, const ArgList&)
+static JSValue JSC_HOST_CALL dateNow(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
     return jsNumber(exec, getCurrentUTCTime());
 }
 
-static JSValuePtr dateUTC(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL dateUTC(ExecState* exec, JSObject*, JSValue, const ArgList& args) 
 {
     int n = args.size();
-    if (isnan(args.at(exec, 0)->toNumber(exec))
-            || isnan(args.at(exec, 1)->toNumber(exec))
-            || (n >= 3 && isnan(args.at(exec, 2)->toNumber(exec)))
-            || (n >= 4 && isnan(args.at(exec, 3)->toNumber(exec)))
-            || (n >= 5 && isnan(args.at(exec, 4)->toNumber(exec)))
-            || (n >= 6 && isnan(args.at(exec, 5)->toNumber(exec)))
-            || (n >= 7 && isnan(args.at(exec, 6)->toNumber(exec))))
+    if (isnan(args.at(0).toNumber(exec))
+            || isnan(args.at(1).toNumber(exec))
+            || (n >= 3 && isnan(args.at(2).toNumber(exec)))
+            || (n >= 4 && isnan(args.at(3).toNumber(exec)))
+            || (n >= 5 && isnan(args.at(4).toNumber(exec)))
+            || (n >= 6 && isnan(args.at(5).toNumber(exec)))
+            || (n >= 7 && isnan(args.at(6).toNumber(exec))))
         return jsNaN(exec);
 
     GregorianDateTime t;
-    int year = args.at(exec, 0)->toInt32(exec);
+    int year = args.at(0).toInt32(exec);
     t.year = (year >= 0 && year <= 99) ? year : year - 1900;
-    t.month = args.at(exec, 1)->toInt32(exec);
-    t.monthDay = (n >= 3) ? args.at(exec, 2)->toInt32(exec) : 1;
-    t.hour = args.at(exec, 3)->toInt32(exec);
-    t.minute = args.at(exec, 4)->toInt32(exec);
-    t.second = args.at(exec, 5)->toInt32(exec);
-    double ms = (n >= 7) ? args.at(exec, 6)->toNumber(exec) : 0;
+    t.month = args.at(1).toInt32(exec);
+    t.monthDay = (n >= 3) ? args.at(2).toInt32(exec) : 1;
+    t.hour = args.at(3).toInt32(exec);
+    t.minute = args.at(4).toInt32(exec);
+    t.second = args.at(5).toInt32(exec);
+    double ms = (n >= 7) ? args.at(6).toNumber(exec) : 0;
     return jsNumber(exec, gregorianDateTimeToMS(t, ms, true));
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.cpp
new file mode 100644
index 0000000..a725478
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.cpp
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * The Original Code is Mozilla Communicator client code, released
+ * March 31, 1998.
+ *
+ * The Initial Developer of the Original Code is
+ * Netscape Communications Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 1998
+ * the Initial Developer. All Rights Reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ *
+ * Alternatively, the contents of this file may be used under the terms
+ * of either the Mozilla Public License Version 1.1, found at
+ * http://www.mozilla.org/MPL/ (the "MPL") or the GNU General Public
+ * License Version 2.0, found at http://www.fsf.org/copyleft/gpl.html
+ * (the "GPL"), in which case the provisions of the MPL or the GPL are
+ * applicable instead of those above.  If you wish to allow use of your
+ * version of this file only under the terms of one of those two
+ * licenses (the MPL or the GPL) and not to allow others to use your
+ * version of this file under the LGPL, indicate your decision by
+ * deletingthe provisions above and replace them with the notice and
+ * other provisions required by the MPL or the GPL, as the case may be.
+ * If you do not delete the provisions above, a recipient may use your
+ * version of this file under any of the LGPL, the MPL or the GPL.
+ */
+
+#include "config.h"
+#include "DateConversion.h"
+
+#include "UString.h"
+#include <wtf/DateMath.h>
+#include <wtf/StringExtras.h>
+
+using namespace WTF;
+
+namespace JSC {
+
+double parseDate(const UString &date)
+{
+    return parseDateFromNullTerminatedCharacters(date.UTF8String().c_str());
+}
+
+UString formatDate(const GregorianDateTime &t)
+{
+    char buffer[100];
+    snprintf(buffer, sizeof(buffer), "%s %s %02d %04d",
+        weekdayName[(t.weekDay + 6) % 7],
+        monthName[t.month], t.monthDay, t.year + 1900);
+    return buffer;
+}
+
+UString formatDateUTCVariant(const GregorianDateTime &t)
+{
+    char buffer[100];
+    snprintf(buffer, sizeof(buffer), "%s, %02d %s %04d",
+        weekdayName[(t.weekDay + 6) % 7],
+        t.monthDay, monthName[t.month], t.year + 1900);
+    return buffer;
+}
+
+UString formatTime(const GregorianDateTime &t, bool utc)
+{
+    char buffer[100];
+    if (utc) {
+        snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT", t.hour, t.minute, t.second);
+    } else {
+        int offset = abs(gmtoffset(t));
+        char timeZoneName[70];
+        struct tm gtm = t;
+        strftime(timeZoneName, sizeof(timeZoneName), "%Z", &gtm);
+
+        if (timeZoneName[0]) {
+            snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT%c%02d%02d (%s)",
+                t.hour, t.minute, t.second,
+                gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60, timeZoneName);
+        } else {
+            snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT%c%02d%02d",
+                t.hour, t.minute, t.second,
+                gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60);
+        }
+    }
+    return UString(buffer);
+}
+
+} // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.h
new file mode 100644
index 0000000..0d12815
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateConversion.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
+ * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla Communicator client code, released
+ * March 31, 1998.
+ *
+ * The Initial Developer of the Original Code is
+ * Netscape Communications Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 1998
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either of the GNU General Public License Version 2 or later (the "GPL"),
+ * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ */
+
+#ifndef DateConversion_h
+#define DateConversion_h
+
+namespace WTF {
+    struct GregorianDateTime;
+}
+
+namespace JSC {
+
+class UString;
+
+double parseDate(const UString&);
+UString formatDate(const WTF::GregorianDateTime&);
+UString formatDateUTCVariant(const WTF::GregorianDateTime&);
+UString formatTime(const WTF::GregorianDateTime&, bool inputIsUTC);
+
+} // namespace JSC
+
+#endif // DateConversion_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
index 8806dec..62791ae 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.cpp
@@ -22,10 +22,12 @@
 #include "config.h"
 #include "DateInstance.h"
 
-#include "DateMath.h"
 #include <math.h>
+#include <wtf/DateMath.h>
 #include <wtf/MathExtras.h>
 
+using namespace WTF;
+
 namespace JSC {
 
 struct DateInstance::Cache {
@@ -58,13 +60,13 @@ void DateInstance::msToGregorianDateTime(double milli, bool outputIsUTC, Gregori
 
     if (outputIsUTC) {
         if (m_cache->m_gregorianDateTimeUTCCachedForMS != milli) {
-            JSC::msToGregorianDateTime(milli, true, m_cache->m_cachedGregorianDateTimeUTC);
+            WTF::msToGregorianDateTime(milli, true, m_cache->m_cachedGregorianDateTimeUTC);
             m_cache->m_gregorianDateTimeUTCCachedForMS = milli;
         }
         t.copyFrom(m_cache->m_cachedGregorianDateTimeUTC);
     } else {
         if (m_cache->m_gregorianDateTimeCachedForMS != milli) {
-            JSC::msToGregorianDateTime(milli, false, m_cache->m_cachedGregorianDateTime);
+            WTF::msToGregorianDateTime(milli, false, m_cache->m_cachedGregorianDateTime);
             m_cache->m_gregorianDateTimeCachedForMS = milli;
         }
         t.copyFrom(m_cache->m_cachedGregorianDateTime);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
index 8dbca81..3b73521 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DateInstance.h
@@ -23,25 +23,27 @@
 
 #include "JSWrapperObject.h"
 
-namespace JSC {
-
+namespace WTF {
     struct GregorianDateTime;
+}
+
+namespace JSC {
 
     class DateInstance : public JSWrapperObject {
     public:
         explicit DateInstance(PassRefPtr<Structure>);
         virtual ~DateInstance();
 
-        double internalNumber() const { return internalValue()->uncheckedGetNumber(); }
+        double internalNumber() const { return internalValue().uncheckedGetNumber(); }
 
-        bool getTime(GregorianDateTime&, int& offset) const;
-        bool getUTCTime(GregorianDateTime&) const;
+        bool getTime(WTF::GregorianDateTime&, int& offset) const;
+        bool getUTCTime(WTF::GregorianDateTime&) const;
         bool getTime(double& milliseconds, int& offset) const;
         bool getUTCTime(double& milliseconds) const;
 
         static const ClassInfo info;
 
-        void msToGregorianDateTime(double, bool outputIsUTC, GregorianDateTime&) const;
+        void msToGregorianDateTime(double, bool outputIsUTC, WTF::GregorianDateTime&) const;
 
     private:
         virtual const ClassInfo* classInfo() const { return &info; }
@@ -52,9 +54,9 @@ namespace JSC {
         mutable Cache* m_cache;
     };
 
-    DateInstance* asDateInstance(JSValuePtr);
+    DateInstance* asDateInstance(JSValue);
 
-    inline DateInstance* asDateInstance(JSValuePtr value)
+    inline DateInstance* asDateInstance(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&DateInstance::info));
         return static_cast<DateInstance*>(asObject(value));
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp
index 79ab2a2..e2482f4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.cpp
@@ -1,6 +1,7 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
  *  Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2008, 2009 Torch Mobile, Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -22,16 +23,23 @@
 #include "config.h"
 #include "DatePrototype.h"
 
-#include "DateMath.h"
+#include "DateConversion.h"
+#include "Error.h"
 #include "JSString.h"
 #include "ObjectPrototype.h"
 #include "DateInstance.h"
 #include <float.h>
+
+#if !PLATFORM(MAC) && HAVE(LANGINFO_H)
+#include <langinfo.h>
+#endif
+
 #include <limits.h>
 #include <locale.h>
 #include <math.h>
 #include <time.h>
 #include <wtf/Assertions.h>
+#include <wtf/DateMath.h>
 #include <wtf/MathExtras.h>
 #include <wtf/StringExtras.h>
 #include <wtf/UnusedParam.h>
@@ -52,56 +60,62 @@
 #include <CoreFoundation/CoreFoundation.h>
 #endif
 
+#if PLATFORM(WINCE) && !PLATFORM(QT)
+extern "C" size_t strftime(char * const s, const size_t maxsize, const char * const format, const struct tm * const t); //provided by libce
+#endif
+
 using namespace WTF;
 
 namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(DatePrototype);
 
-static JSValuePtr dateProtoFuncGetDate(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetDay(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetFullYear(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetHours(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetMilliSeconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetMinutes(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetMonth(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetSeconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetTime(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetTimezoneOffset(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCDate(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCDay(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCFullYear(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCHours(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCMilliseconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCMinutes(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCMonth(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetUTCSeconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncGetYear(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetDate(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetFullYear(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetHours(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetMilliSeconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetMinutes(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetMonth(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetSeconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetTime(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetUTCDate(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetUTCFullYear(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetUTCHours(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetUTCMilliseconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetUTCMinutes(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetUTCMonth(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetUTCSeconds(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncSetYear(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToDateString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToGMTString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToLocaleDateString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToLocaleString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToLocaleTimeString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToTimeString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncToUTCString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr dateProtoFuncValueOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetTime(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCMilliseconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncGetYear(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetDate(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetFullYear(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetHours(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetMilliSeconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetMinutes(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetMonth(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetSeconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetUTCDate(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetUTCFullYear(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetUTCHours(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetUTCMilliseconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetUTCMinutes(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetUTCMonth(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetUTCSeconds(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToDateString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToLocaleDateString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToLocaleTimeString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState*, JSObject*, JSValue, const ArgList&);
+
+static JSValue JSC_HOST_CALL dateProtoFuncToJSON(ExecState*, JSObject*, JSValue, const ArgList&);
 
 }
 
@@ -109,8 +123,13 @@ static JSValuePtr dateProtoFuncValueOf(ExecState*, JSObject*, JSValuePtr, const
 
 namespace JSC {
 
+enum LocaleDateTimeFormat { LocaleDateAndTime, LocaleDate, LocaleTime };
+ 
 #if PLATFORM(MAC)
 
+// FIXME: Since this is superior to the strftime-based version, why limit this to PLATFORM(MAC)?
+// Instead we should consider using this whenever PLATFORM(CF) is true.
+
 static CFDateFormatterStyle styleFromArgString(const UString& string, CFDateFormatterStyle defaultStyle)
 {
     if (string == "short")
@@ -124,24 +143,24 @@ static CFDateFormatterStyle styleFromArgString(const UString& string, CFDateForm
     return defaultStyle;
 }
 
-static UString formatLocaleDate(ExecState* exec, double time, bool includeDate, bool includeTime, const ArgList& args)
+static JSCell* formatLocaleDate(ExecState* exec, DateInstance*, double timeInMilliseconds, LocaleDateTimeFormat format, const ArgList& args)
 {
-    CFDateFormatterStyle dateStyle = (includeDate ? kCFDateFormatterLongStyle : kCFDateFormatterNoStyle);
-    CFDateFormatterStyle timeStyle = (includeTime ? kCFDateFormatterLongStyle : kCFDateFormatterNoStyle);
+    CFDateFormatterStyle dateStyle = (format != LocaleTime ? kCFDateFormatterLongStyle : kCFDateFormatterNoStyle);
+    CFDateFormatterStyle timeStyle = (format != LocaleDate ? kCFDateFormatterLongStyle : kCFDateFormatterNoStyle);
 
     bool useCustomFormat = false;
     UString customFormatString;
 
-    UString arg0String = args.at(exec, 0)->toString(exec);
-    if (arg0String == "custom" && !args.at(exec, 1)->isUndefined()) {
+    UString arg0String = args.at(0).toString(exec);
+    if (arg0String == "custom" && !args.at(1).isUndefined()) {
         useCustomFormat = true;
-        customFormatString = args.at(exec, 1)->toString(exec);
-    } else if (includeDate && includeTime && !args.at(exec, 1)->isUndefined()) {
+        customFormatString = args.at(1).toString(exec);
+    } else if (format == LocaleDateAndTime && !args.at(1).isUndefined()) {
         dateStyle = styleFromArgString(arg0String, dateStyle);
-        timeStyle = styleFromArgString(args.at(exec, 1)->toString(exec), timeStyle);
-    } else if (includeDate && !args.at(exec, 0)->isUndefined())
+        timeStyle = styleFromArgString(args.at(1).toString(exec), timeStyle);
+    } else if (format != LocaleTime && !args.at(0).isUndefined())
         dateStyle = styleFromArgString(arg0String, dateStyle);
-    else if (includeTime && !args.at(exec, 0)->isUndefined())
+    else if (format != LocaleDate && !args.at(0).isUndefined())
         timeStyle = styleFromArgString(arg0String, timeStyle);
 
     CFLocaleRef locale = CFLocaleCopyCurrent();
@@ -149,12 +168,12 @@ static UString formatLocaleDate(ExecState* exec, double time, bool includeDate,
     CFRelease(locale);
 
     if (useCustomFormat) {
-        CFStringRef customFormatCFString = CFStringCreateWithCharacters(0, (UniChar *)customFormatString.data(), customFormatString.size());
+        CFStringRef customFormatCFString = CFStringCreateWithCharacters(0, customFormatString.data(), customFormatString.size());
         CFDateFormatterSetFormat(formatter, customFormatCFString);
         CFRelease(customFormatCFString);
     }
 
-    CFStringRef string = CFDateFormatterCreateStringWithAbsoluteTime(0, formatter, time - kCFAbsoluteTimeIntervalSince1970);
+    CFStringRef string = CFDateFormatterCreateStringWithAbsoluteTime(0, formatter, floor(timeInMilliseconds / msPerSecond) - kCFAbsoluteTimeIntervalSince1970);
 
     CFRelease(formatter);
 
@@ -166,20 +185,25 @@ static UString formatLocaleDate(ExecState* exec, double time, bool includeDate,
     ASSERT(length <= bufferLength);
     if (length > bufferLength)
         length = bufferLength;
-    CFStringGetCharacters(string, CFRangeMake(0, length), reinterpret_cast<UniChar *>(buffer));
+    CFStringGetCharacters(string, CFRangeMake(0, length), buffer);
 
     CFRelease(string);
 
-    return UString(buffer, length);
+    return jsNontrivialString(exec, UString(buffer, length));
 }
 
-#else
+#else // !PLATFORM(MAC)
 
-enum LocaleDateTimeFormat { LocaleDateAndTime, LocaleDate, LocaleTime };
- 
-static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, const LocaleDateTimeFormat format)
+static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, LocaleDateTimeFormat format)
 {
-    static const char* formatStrings[] = {"%#c", "%#x", "%X"};
+#if HAVE(LANGINFO_H)
+    static const nl_item formats[] = { D_T_FMT, D_FMT, T_FMT };
+#elif PLATFORM(WINCE) && !PLATFORM(QT)
+    // strftime() we are using does not support #
+    static const char* const formatStrings[] = { "%c", "%x", "%X" };
+#else
+    static const char* const formatStrings[] = { "%#c", "%#x", "%X" };
+#endif
  
     // Offset year if needed
     struct tm localTM = gdt;
@@ -188,10 +212,26 @@ static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, c
     if (yearNeedsOffset)
         localTM.tm_year = equivalentYearForDST(year) - 1900;
  
+#if HAVE(LANGINFO_H)
+    // We do not allow strftime to generate dates with 2-digits years,
+    // both to avoid ambiguity, and a crash in strncpy, for years that
+    // need offset.
+    char* formatString = strdup(nl_langinfo(formats[format]));
+    char* yPos = strchr(formatString, 'y');
+    if (yPos)
+        *yPos = 'Y';
+#endif
+
     // Do the formatting
     const int bufsize = 128;
     char timebuffer[bufsize];
+
+#if HAVE(LANGINFO_H)
+    size_t ret = strftime(timebuffer, bufsize, formatString, &localTM);
+    free(formatString);
+#else
     size_t ret = strftime(timebuffer, bufsize, formatStrings[format], &localTM);
+#endif
  
     if (ret == 0)
         return jsEmptyString(exec);
@@ -211,7 +251,15 @@ static JSCell* formatLocaleDate(ExecState* exec, const GregorianDateTime& gdt, c
     return jsNontrivialString(exec, timebuffer);
 }
 
-#endif // PLATFORM(WIN_OS)
+static JSCell* formatLocaleDate(ExecState* exec, DateInstance* dateObject, double timeInMilliseconds, LocaleDateTimeFormat format, const ArgList&)
+{
+    GregorianDateTime gregorianDateTime;
+    const bool notUTC = false;
+    dateObject->msToGregorianDateTime(timeInMilliseconds, notUTC, gregorianDateTime);
+    return formatLocaleDate(exec, gregorianDateTime, format);
+}
+
+#endif // !PLATFORM(MAC)
 
 // Converts a list of arguments sent to a Date member function into milliseconds, updating
 // ms (representing milliseconds) and t (representing the rest of the date structure) appropriately.
@@ -231,19 +279,19 @@ static bool fillStructuresUsingTimeArgs(ExecState* exec, const ArgList& args, in
     // hours
     if (maxArgs >= 4 && idx < numArgs) {
         t->hour = 0;
-        milliseconds += args.at(exec, idx++)->toInt32(exec, ok) * msPerHour;
+        milliseconds += args.at(idx++).toInt32(exec, ok) * msPerHour;
     }
 
     // minutes
     if (maxArgs >= 3 && idx < numArgs && ok) {
         t->minute = 0;
-        milliseconds += args.at(exec, idx++)->toInt32(exec, ok) * msPerMinute;
+        milliseconds += args.at(idx++).toInt32(exec, ok) * msPerMinute;
     }
     
     // seconds
     if (maxArgs >= 2 && idx < numArgs && ok) {
         t->second = 0;
-        milliseconds += args.at(exec, idx++)->toInt32(exec, ok) * msPerSecond;
+        milliseconds += args.at(idx++).toInt32(exec, ok) * msPerSecond;
     }
     
     if (!ok)
@@ -251,7 +299,7 @@ static bool fillStructuresUsingTimeArgs(ExecState* exec, const ArgList& args, in
         
     // milliseconds
     if (idx < numArgs) {
-        double millis = args.at(exec, idx)->toNumber(exec);
+        double millis = args.at(idx).toNumber(exec);
         ok = isfinite(millis);
         milliseconds += millis;
     } else
@@ -277,16 +325,16 @@ static bool fillStructuresUsingDateArgs(ExecState *exec, const ArgList& args, in
   
     // years
     if (maxArgs >= 3 && idx < numArgs)
-        t->year = args.at(exec, idx++)->toInt32(exec, ok) - 1900;
+        t->year = args.at(idx++).toInt32(exec, ok) - 1900;
     
     // months
     if (maxArgs >= 2 && idx < numArgs && ok)   
-        t->month = args.at(exec, idx++)->toInt32(exec, ok);
+        t->month = args.at(idx++).toInt32(exec, ok);
     
     // days
     if (idx < numArgs && ok) {   
         t->monthDay = 0;
-        *ms += args.at(exec, idx)->toInt32(exec, ok) * msPerDay;
+        *ms += args.at(idx).toInt32(exec, ok) * msPerDay;
     }
     
     return ok;
@@ -295,16 +343,16 @@ static bool fillStructuresUsingDateArgs(ExecState *exec, const ArgList& args, in
 const ClassInfo DatePrototype::info = {"Date", &DateInstance::info, 0, ExecState::dateTable};
 
 /* Source for DatePrototype.lut.h
-   FIXME: We could use templates to simplify the UTC variants.
 @begin dateTable
   toString              dateProtoFuncToString                DontEnum|Function       0
+  toISOString           dateProtoFuncToISOString             DontEnum|Function       0
   toUTCString           dateProtoFuncToUTCString             DontEnum|Function       0
   toDateString          dateProtoFuncToDateString            DontEnum|Function       0
   toTimeString          dateProtoFuncToTimeString            DontEnum|Function       0
   toLocaleString        dateProtoFuncToLocaleString          DontEnum|Function       0
   toLocaleDateString    dateProtoFuncToLocaleDateString      DontEnum|Function       0
   toLocaleTimeString    dateProtoFuncToLocaleTimeString      DontEnum|Function       0
-  valueOf               dateProtoFuncValueOf                 DontEnum|Function       0
+  valueOf               dateProtoFuncGetTime                 DontEnum|Function       0
   getTime               dateProtoFuncGetTime                 DontEnum|Function       0
   getFullYear           dateProtoFuncGetFullYear             DontEnum|Function       0
   getUTCFullYear        dateProtoFuncGetUTCFullYear          DontEnum|Function       0
@@ -341,8 +389,10 @@ const ClassInfo DatePrototype::info = {"Date", &DateInstance::info, 0, ExecState
   setUTCFullYear        dateProtoFuncSetUTCFullYear          DontEnum|Function       3
   setYear               dateProtoFuncSetYear                 DontEnum|Function       1
   getYear               dateProtoFuncGetYear                 DontEnum|Function       0
+  toJSON                dateProtoFuncToJSON                  DontEnum|Function       0
 @end
 */
+
 // ECMA 15.9.4
 
 DatePrototype::DatePrototype(ExecState* exec, PassRefPtr<Structure> structure)
@@ -359,9 +409,9 @@ bool DatePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& proper
 
 // Functions
 
-JSValuePtr dateProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -376,9 +426,9 @@ JSValuePtr dateProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValu
     return jsNontrivialString(exec, formatDate(t) + " " + formatTime(t, utc));
 }
 
-JSValuePtr dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -393,26 +443,31 @@ JSValuePtr dateProtoFuncToUTCString(ExecState* exec, JSObject*, JSValuePtr thisV
     return jsNontrivialString(exec, formatDateUTCVariant(t) + " " + formatTime(t, utc));
 }
 
-JSValuePtr dateProtoFuncToDateString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncToISOString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
-
-    const bool utc = false;
-
+    
+    const bool utc = true;
+    
     DateInstance* thisDateObj = asDateInstance(thisValue); 
     double milli = thisDateObj->internalNumber();
-    if (isnan(milli))
+    if (!isfinite(milli))
         return jsNontrivialString(exec, "Invalid Date");
-
+    
     GregorianDateTime t;
     thisDateObj->msToGregorianDateTime(milli, utc, t);
-    return jsNontrivialString(exec, formatDate(t));
+    // Maximum amount of space we need in buffer: 6 (max. digits in year) + 2 * 5 (2 characters each for month, day, hour, minute, second)
+    // 6 for formatting and one for null termination = 23.  We add one extra character to allow us to force null termination.
+    char buffer[24];
+    snprintf(buffer, sizeof(buffer) - 1, "%04d-%02d-%02dT%02d:%02d:%02dZ", 1900 + t.year, t.month + 1, t.monthDay, t.hour, t.minute, t.second);
+    buffer[sizeof(buffer) - 1] = 0;
+    return jsNontrivialString(exec, buffer);
 }
 
-JSValuePtr dateProtoFuncToTimeString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncToDateString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -424,36 +479,29 @@ JSValuePtr dateProtoFuncToTimeString(ExecState* exec, JSObject*, JSValuePtr this
 
     GregorianDateTime t;
     thisDateObj->msToGregorianDateTime(milli, utc, t);
-    return jsNontrivialString(exec, formatTime(t, utc));
+    return jsNontrivialString(exec, formatDate(t));
 }
 
-JSValuePtr dateProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncToTimeString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
+    const bool utc = false;
+
     DateInstance* thisDateObj = asDateInstance(thisValue); 
     double milli = thisDateObj->internalNumber();
     if (isnan(milli))
         return jsNontrivialString(exec, "Invalid Date");
 
-#if PLATFORM(MAC)
-    double secs = floor(milli / msPerSecond);
-    return jsNontrivialString(exec, formatLocaleDate(exec, secs, true, true, args));
-#else
-    UNUSED_PARAM(args);
-
-    const bool utc = false;
-
     GregorianDateTime t;
     thisDateObj->msToGregorianDateTime(milli, utc, t);
-    return formatLocaleDate(exec, t, LocaleDateAndTime);
-#endif
+    return jsNontrivialString(exec, formatTime(t, utc));
 }
 
-JSValuePtr dateProtoFuncToLocaleDateString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -461,23 +509,12 @@ JSValuePtr dateProtoFuncToLocaleDateString(ExecState* exec, JSObject*, JSValuePt
     if (isnan(milli))
         return jsNontrivialString(exec, "Invalid Date");
 
-#if PLATFORM(MAC)
-    double secs = floor(milli / msPerSecond);
-    return jsNontrivialString(exec, formatLocaleDate(exec, secs, true, false, args));
-#else
-    UNUSED_PARAM(args);
-
-    const bool utc = false;
-
-    GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
-    return formatLocaleDate(exec, t, LocaleDate);
-#endif
+    return formatLocaleDate(exec, thisDateObj, milli, LocaleDateAndTime, args);
 }
 
-JSValuePtr dateProtoFuncToLocaleTimeString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncToLocaleDateString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -485,36 +522,25 @@ JSValuePtr dateProtoFuncToLocaleTimeString(ExecState* exec, JSObject*, JSValuePt
     if (isnan(milli))
         return jsNontrivialString(exec, "Invalid Date");
 
-#if PLATFORM(MAC)
-    double secs = floor(milli / msPerSecond);
-    return jsNontrivialString(exec, formatLocaleDate(exec, secs, false, true, args));
-#else
-    UNUSED_PARAM(args);
-
-    const bool utc = false;
-
-    GregorianDateTime t;
-    thisDateObj->msToGregorianDateTime(milli, utc, t);
-    return formatLocaleDate(exec, t, LocaleTime);
-#endif
+    return formatLocaleDate(exec, thisDateObj, milli, LocaleDate, args);
 }
 
-JSValuePtr dateProtoFuncValueOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncToLocaleTimeString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
     double milli = thisDateObj->internalNumber();
     if (isnan(milli))
-        return jsNaN(exec);
+        return jsNontrivialString(exec, "Invalid Date");
 
-    return jsNumber(exec, milli);
+    return formatLocaleDate(exec, thisDateObj, milli, LocaleTime, args);
 }
 
-JSValuePtr dateProtoFuncGetTime(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -525,9 +551,9 @@ JSValuePtr dateProtoFuncGetTime(ExecState* exec, JSObject*, JSValuePtr thisValue
     return jsNumber(exec, milli);
 }
 
-JSValuePtr dateProtoFuncGetFullYear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetFullYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -542,9 +568,9 @@ JSValuePtr dateProtoFuncGetFullYear(ExecState* exec, JSObject*, JSValuePtr thisV
     return jsNumber(exec, 1900 + t.year);
 }
 
-JSValuePtr dateProtoFuncGetUTCFullYear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCFullYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -559,9 +585,9 @@ JSValuePtr dateProtoFuncGetUTCFullYear(ExecState* exec, JSObject*, JSValuePtr th
     return jsNumber(exec, 1900 + t.year);
 }
 
-JSValuePtr dateProtoFuncToGMTString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncToGMTString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -576,9 +602,9 @@ JSValuePtr dateProtoFuncToGMTString(ExecState* exec, JSObject*, JSValuePtr thisV
     return jsNontrivialString(exec, formatDateUTCVariant(t) + " " + formatTime(t, utc));
 }
 
-JSValuePtr dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -593,9 +619,9 @@ JSValuePtr dateProtoFuncGetMonth(ExecState* exec, JSObject*, JSValuePtr thisValu
     return jsNumber(exec, t.month);
 }
 
-JSValuePtr dateProtoFuncGetUTCMonth(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -610,9 +636,9 @@ JSValuePtr dateProtoFuncGetUTCMonth(ExecState* exec, JSObject*, JSValuePtr thisV
     return jsNumber(exec, t.month);
 }
 
-JSValuePtr dateProtoFuncGetDate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -627,9 +653,9 @@ JSValuePtr dateProtoFuncGetDate(ExecState* exec, JSObject*, JSValuePtr thisValue
     return jsNumber(exec, t.monthDay);
 }
 
-JSValuePtr dateProtoFuncGetUTCDate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -644,9 +670,9 @@ JSValuePtr dateProtoFuncGetUTCDate(ExecState* exec, JSObject*, JSValuePtr thisVa
     return jsNumber(exec, t.monthDay);
 }
 
-JSValuePtr dateProtoFuncGetDay(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetDay(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -661,9 +687,9 @@ JSValuePtr dateProtoFuncGetDay(ExecState* exec, JSObject*, JSValuePtr thisValue,
     return jsNumber(exec, t.weekDay);
 }
 
-JSValuePtr dateProtoFuncGetUTCDay(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCDay(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -678,9 +704,9 @@ JSValuePtr dateProtoFuncGetUTCDay(ExecState* exec, JSObject*, JSValuePtr thisVal
     return jsNumber(exec, t.weekDay);
 }
 
-JSValuePtr dateProtoFuncGetHours(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -695,9 +721,9 @@ JSValuePtr dateProtoFuncGetHours(ExecState* exec, JSObject*, JSValuePtr thisValu
     return jsNumber(exec, t.hour);
 }
 
-JSValuePtr dateProtoFuncGetUTCHours(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -712,9 +738,9 @@ JSValuePtr dateProtoFuncGetUTCHours(ExecState* exec, JSObject*, JSValuePtr thisV
     return jsNumber(exec, t.hour);
 }
 
-JSValuePtr dateProtoFuncGetMinutes(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -729,9 +755,9 @@ JSValuePtr dateProtoFuncGetMinutes(ExecState* exec, JSObject*, JSValuePtr thisVa
     return jsNumber(exec, t.minute);
 }
 
-JSValuePtr dateProtoFuncGetUTCMinutes(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -746,9 +772,9 @@ JSValuePtr dateProtoFuncGetUTCMinutes(ExecState* exec, JSObject*, JSValuePtr thi
     return jsNumber(exec, t.minute);
 }
 
-JSValuePtr dateProtoFuncGetSeconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -763,9 +789,9 @@ JSValuePtr dateProtoFuncGetSeconds(ExecState* exec, JSObject*, JSValuePtr thisVa
     return jsNumber(exec, t.second);
 }
 
-JSValuePtr dateProtoFuncGetUTCSeconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = true;
@@ -780,9 +806,9 @@ JSValuePtr dateProtoFuncGetUTCSeconds(ExecState* exec, JSObject*, JSValuePtr thi
     return jsNumber(exec, t.second);
 }
 
-JSValuePtr dateProtoFuncGetMilliSeconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetMilliSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -795,9 +821,9 @@ JSValuePtr dateProtoFuncGetMilliSeconds(ExecState* exec, JSObject*, JSValuePtr t
     return jsNumber(exec, ms);
 }
 
-JSValuePtr dateProtoFuncGetUTCMilliseconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetUTCMilliseconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
@@ -810,9 +836,9 @@ JSValuePtr dateProtoFuncGetUTCMilliseconds(ExecState* exec, JSObject*, JSValuePt
     return jsNumber(exec, ms);
 }
 
-JSValuePtr dateProtoFuncGetTimezoneOffset(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetTimezoneOffset(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -827,29 +853,29 @@ JSValuePtr dateProtoFuncGetTimezoneOffset(ExecState* exec, JSObject*, JSValuePtr
     return jsNumber(exec, -gmtoffset(t) / minutesPerHour);
 }
 
-JSValuePtr dateProtoFuncSetTime(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue); 
 
-    double milli = timeClip(args.at(exec, 0)->toNumber(exec));
-    JSValuePtr result = jsNumber(exec, milli);
+    double milli = timeClip(args.at(0).toNumber(exec));
+    JSValue result = jsNumber(exec, milli);
     thisDateObj->setInternalValue(result);
     return result;
 }
 
-static JSValuePtr setNewValueFromTimeArgs(ExecState* exec, JSValuePtr thisValue, const ArgList& args, int numArgsToUse, bool inputIsUTC)
+static JSValue setNewValueFromTimeArgs(ExecState* exec, JSValue thisValue, const ArgList& args, int numArgsToUse, bool inputIsUTC)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue);
     double milli = thisDateObj->internalNumber();
     
     if (args.isEmpty() || isnan(milli)) {
-        JSValuePtr result = jsNaN(exec);
+        JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     }
@@ -861,24 +887,24 @@ static JSValuePtr setNewValueFromTimeArgs(ExecState* exec, JSValuePtr thisValue,
     thisDateObj->msToGregorianDateTime(milli, inputIsUTC, t);
 
     if (!fillStructuresUsingTimeArgs(exec, args, numArgsToUse, &ms, &t)) {
-        JSValuePtr result = jsNaN(exec);
+        JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     } 
     
-    JSValuePtr result = jsNumber(exec, gregorianDateTimeToMS(t, ms, inputIsUTC));
+    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, inputIsUTC));
     thisDateObj->setInternalValue(result);
     return result;
 }
 
-static JSValuePtr setNewValueFromDateArgs(ExecState* exec, JSValuePtr thisValue, const ArgList& args, int numArgsToUse, bool inputIsUTC)
+static JSValue setNewValueFromDateArgs(ExecState* exec, JSValue thisValue, const ArgList& args, int numArgsToUse, bool inputIsUTC)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     DateInstance* thisDateObj = asDateInstance(thisValue);
     if (args.isEmpty()) {
-        JSValuePtr result = jsNaN(exec);
+        JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     }      
@@ -898,110 +924,110 @@ static JSValuePtr setNewValueFromDateArgs(ExecState* exec, JSValuePtr thisValue,
     }
     
     if (!fillStructuresUsingDateArgs(exec, args, numArgsToUse, &ms, &t)) {
-        JSValuePtr result = jsNaN(exec);
+        JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     } 
            
-    JSValuePtr result = jsNumber(exec, gregorianDateTimeToMS(t, ms, inputIsUTC));
+    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, inputIsUTC));
     thisDateObj->setInternalValue(result);
     return result;
 }
 
-JSValuePtr dateProtoFuncSetMilliSeconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetMilliSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = false;
     return setNewValueFromTimeArgs(exec, thisValue, args, 1, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetUTCMilliseconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetUTCMilliseconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = true;
     return setNewValueFromTimeArgs(exec, thisValue, args, 1, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetSeconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = false;
     return setNewValueFromTimeArgs(exec, thisValue, args, 2, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetUTCSeconds(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetUTCSeconds(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = true;
     return setNewValueFromTimeArgs(exec, thisValue, args, 2, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetMinutes(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = false;
     return setNewValueFromTimeArgs(exec, thisValue, args, 3, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetUTCMinutes(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetUTCMinutes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = true;
     return setNewValueFromTimeArgs(exec, thisValue, args, 3, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetHours(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = false;
     return setNewValueFromTimeArgs(exec, thisValue, args, 4, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetUTCHours(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetUTCHours(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = true;
     return setNewValueFromTimeArgs(exec, thisValue, args, 4, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetDate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = false;
     return setNewValueFromDateArgs(exec, thisValue, args, 1, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetUTCDate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetUTCDate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = true;
     return setNewValueFromDateArgs(exec, thisValue, args, 1, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetMonth(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = false;
     return setNewValueFromDateArgs(exec, thisValue, args, 2, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetUTCMonth(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetUTCMonth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = true;
     return setNewValueFromDateArgs(exec, thisValue, args, 2, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetFullYear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetFullYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = false;
     return setNewValueFromDateArgs(exec, thisValue, args, 3, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetUTCFullYear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetUTCFullYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     const bool inputIsUTC = true;
     return setNewValueFromDateArgs(exec, thisValue, args, 3, inputIsUTC);
 }
 
-JSValuePtr dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
 
     DateInstance* thisDateObj = asDateInstance(thisValue);     
     if (args.isEmpty()) { 
-        JSValuePtr result = jsNaN(exec);
+        JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     }
@@ -1021,22 +1047,22 @@ JSValuePtr dateProtoFuncSetYear(ExecState* exec, JSObject*, JSValuePtr thisValue
     }
     
     bool ok = true;
-    int32_t year = args.at(exec, 0)->toInt32(exec, ok);
+    int32_t year = args.at(0).toInt32(exec, ok);
     if (!ok) {
-        JSValuePtr result = jsNaN(exec);
+        JSValue result = jsNaN(exec);
         thisDateObj->setInternalValue(result);
         return result;
     }
             
     t.year = (year > 99 || year < 0) ? year - 1900 : year;
-    JSValuePtr result = jsNumber(exec, gregorianDateTimeToMS(t, ms, utc));
+    JSValue result = jsNumber(exec, gregorianDateTimeToMS(t, ms, utc));
     thisDateObj->setInternalValue(result);
     return result;
 }
 
-JSValuePtr dateProtoFuncGetYear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL dateProtoFuncGetYear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&DateInstance::info))
+    if (!thisValue.isObject(&DateInstance::info))
         return throwError(exec, TypeError);
 
     const bool utc = false;
@@ -1053,4 +1079,27 @@ JSValuePtr dateProtoFuncGetYear(ExecState* exec, JSObject*, JSValuePtr thisValue
     return jsNumber(exec, t.year);
 }
 
+JSValue JSC_HOST_CALL dateProtoFuncToJSON(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
+{
+    JSObject* object = thisValue.toThisObject(exec);
+    if (exec->hadException())
+        return jsNull();
+    
+    JSValue toISOValue = object->get(exec, exec->globalData().propertyNames->toISOString);
+    if (exec->hadException())
+        return jsNull();
+
+    CallData callData;
+    CallType callType = toISOValue.getCallData(callData);
+    if (callType == CallTypeNone)
+        return throwError(exec, TypeError, "toISOString is not a function");
+
+    JSValue result = call(exec, asObject(toISOValue), callType, callData, object, exec->emptyList());
+    if (exec->hadException())
+        return jsNull();
+    if (result.isObject())
+        return throwError(exec, TypeError, "toISOString did not return a primitive value");
+    return result;
+}
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
index a6bbdf2..5f4d0ec 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/DatePrototype.h
@@ -36,7 +36,7 @@ namespace JSC {
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType));
         }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp
index 5e21c8e..db1d8cc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Error.cpp
@@ -26,6 +26,7 @@
 
 #include "ConstructData.h"
 #include "ErrorConstructor.h"
+#include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "JSObject.h"
 #include "JSString.h"
@@ -72,7 +73,7 @@ JSObject* Error::create(ExecState* exec, ErrorType type, const UString& message,
             break;
     }
 
-    ArgList args;
+    MarkedArgumentBuffer args;
     if (message.isEmpty())
         args.append(jsString(exec, name));
     else
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorConstructor.cpp
index 2e8a523..07b7e23 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorConstructor.cpp
@@ -41,8 +41,8 @@ ErrorConstructor::ErrorConstructor(ExecState* exec, PassRefPtr<Structure> struct
 ErrorInstance* constructError(ExecState* exec, const ArgList& args)
 {
     ErrorInstance* obj = new (exec) ErrorInstance(exec->lexicalGlobalObject()->errorStructure());
-    if (!args.at(exec, 0)->isUndefined())
-        obj->putDirect(exec->propertyNames().message, jsString(exec, args.at(exec, 0)->toString(exec)));
+    if (!args.at(0).isUndefined())
+        obj->putDirect(exec->propertyNames().message, jsString(exec, args.at(0).toString(exec)));
     return obj;
 }
 
@@ -58,7 +58,7 @@ ConstructType ErrorConstructor::getConstructData(ConstructData& constructData)
 }
 
 // ECMA 15.9.2
-static JSValuePtr callErrorConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callErrorConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     // "Error()" gives the sames result as "new Error()"
     return constructError(exec, args);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorPrototype.cpp
index 35358f7..599390e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ErrorPrototype.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "ErrorPrototype.h"
 
+#include "JSFunction.h"
 #include "JSString.h"
 #include "ObjectPrototype.h"
 #include "PrototypeFunction.h"
@@ -30,7 +31,7 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(ErrorPrototype);
 
-static JSValuePtr errorProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL errorProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
 
 // ECMA 15.9.4
 ErrorPrototype::ErrorPrototype(ExecState* exec, PassRefPtr<Structure> structure, Structure* prototypeFunctionStructure)
@@ -41,24 +42,24 @@ ErrorPrototype::ErrorPrototype(ExecState* exec, PassRefPtr<Structure> structure,
     putDirectWithoutTransition(exec->propertyNames().name, jsNontrivialString(exec, "Error"), DontEnum);
     putDirectWithoutTransition(exec->propertyNames().message, jsNontrivialString(exec, "Unknown error"), DontEnum);
 
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, errorProtoFuncToString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, errorProtoFuncToString), DontEnum);
 }
 
-JSValuePtr errorProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL errorProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
     UString s = "Error";
 
-    JSValuePtr v = thisObj->get(exec, exec->propertyNames().name);
-    if (!v->isUndefined())
-        s = v->toString(exec);
+    JSValue v = thisObj->get(exec, exec->propertyNames().name);
+    if (!v.isUndefined())
+        s = v.toString(exec);
 
     v = thisObj->get(exec, exec->propertyNames().message);
-    if (!v->isUndefined()) {
+    if (!v.isUndefined()) {
         // Mozilla-compatible format.
         s += ": ";
-        s += v->toString(exec);
+        s += v.toString(exec);
     }
 
     return jsNontrivialString(exec, s);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
index 42ddf04..e63594c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.cpp
@@ -31,6 +31,7 @@
 
 #include "CodeBlock.h"
 #include "CallFrame.h"
+#include "JSGlobalObjectFunctions.h"
 #include "JSObject.h"
 #include "JSNotAnObject.h"
 #include "Interpreter.h"
@@ -38,16 +39,6 @@
 
 namespace JSC {
 
-static void substitute(UString& string, const UString& substring)
-{
-    int position = string.find("%s");
-    ASSERT(position != -1);
-    UString newString = string.substr(0, position);
-    newString.append(substring);
-    newString.append(string.substr(position + 2));
-    string = newString;
-}
-
 class InterruptedExecutionError : public JSObject {
 public:
     InterruptedExecutionError(JSGlobalData* globalData)
@@ -56,38 +47,26 @@ public:
     }
 
     virtual bool isWatchdogException() const { return true; }
+
+    virtual UString toString(ExecState*) const { return "JavaScript execution exceeded timeout."; }
 };
 
-JSValuePtr createInterruptedExecutionException(JSGlobalData* globalData)
+JSValue createInterruptedExecutionException(JSGlobalData* globalData)
 {
     return new (globalData) InterruptedExecutionError(globalData);
 }
 
-JSValuePtr createError(ExecState* exec, ErrorType e, const char* msg)
+static JSValue createError(ExecState* exec, ErrorType e, const char* msg)
 {
     return Error::create(exec, e, msg, -1, -1, 0);
 }
 
-JSValuePtr createError(ExecState* exec, ErrorType e, const char* msg, const Identifier& label)
-{
-    UString message = msg;
-    substitute(message, label.ustring());
-    return Error::create(exec, e, message, -1, -1, 0);
-}
-
-JSValuePtr createError(ExecState* exec, ErrorType e, const char* msg, JSValuePtr v)
-{
-    UString message = msg;
-    substitute(message, v->toString(exec));
-    return Error::create(exec, e, message, -1, -1, 0);
-}
-
-JSValuePtr createStackOverflowError(ExecState* exec)
+JSValue createStackOverflowError(ExecState* exec)
 {
     return createError(exec, RangeError, "Maximum call stack size exceeded.");
 }
 
-JSValuePtr createUndefinedVariableError(ExecState* exec, const Identifier& ident, unsigned bytecodeOffset, CodeBlock* codeBlock)
+JSValue createUndefinedVariableError(ExecState* exec, const Identifier& ident, unsigned bytecodeOffset, CodeBlock* codeBlock)
 {
     int startOffset = 0;
     int endOffset = 0;
@@ -102,12 +81,10 @@ JSValuePtr createUndefinedVariableError(ExecState* exec, const Identifier& ident
     return exception;
 }
     
-bool isStrWhiteSpace(UChar c);
-
-static UString createErrorMessage(ExecState* exec, CodeBlock* codeBlock, int, int expressionStart, int expressionStop, JSValuePtr value, UString error)
+static UString createErrorMessage(ExecState* exec, CodeBlock* codeBlock, int, int expressionStart, int expressionStop, JSValue value, UString error)
 {
     if (!expressionStop || expressionStart > codeBlock->source()->length()) {
-        UString errorText = value->toString(exec);
+        UString errorText = value.toString(exec);
         errorText.append(" is ");
         errorText.append(error);
         return errorText;
@@ -119,7 +96,7 @@ static UString createErrorMessage(ExecState* exec, CodeBlock* codeBlock, int, in
         errorText.append('\'');
         errorText.append(codeBlock->source()->getRange(expressionStart, expressionStop));
         errorText.append("' [");
-        errorText.append(value->toString(exec));
+        errorText.append(value.toString(exec));
         errorText.append("] is ");
     } else {
         // No range information, so give a few characters of context
@@ -140,7 +117,7 @@ static UString createErrorMessage(ExecState* exec, CodeBlock* codeBlock, int, in
         errorText.append("near '...");
         errorText.append(codeBlock->source()->getRange(start, stop));
         errorText.append("...' [");
-        errorText.append(value->toString(exec));
+        errorText.append(value.toString(exec));
         errorText.append("] is ");
     }
     errorText.append(error);
@@ -148,7 +125,7 @@ static UString createErrorMessage(ExecState* exec, CodeBlock* codeBlock, int, in
     return errorText;
 }
 
-JSObject* createInvalidParamError(ExecState* exec, const char* op, JSValuePtr value, unsigned bytecodeOffset, CodeBlock* codeBlock)
+JSObject* createInvalidParamError(ExecState* exec, const char* op, JSValue value, unsigned bytecodeOffset, CodeBlock* codeBlock)
 {
     UString message = "not a valid argument for '";
     message.append(op);
@@ -166,7 +143,7 @@ JSObject* createInvalidParamError(ExecState* exec, const char* op, JSValuePtr va
     return exception;
 }
 
-JSObject* createNotAConstructorError(ExecState* exec, JSValuePtr value, unsigned bytecodeOffset, CodeBlock* codeBlock)
+JSObject* createNotAConstructorError(ExecState* exec, JSValue value, unsigned bytecodeOffset, CodeBlock* codeBlock)
 {
     int startOffset = 0;
     int endOffset = 0;
@@ -187,7 +164,7 @@ JSObject* createNotAConstructorError(ExecState* exec, JSValuePtr value, unsigned
     return exception;
 }
 
-JSValuePtr createNotAFunctionError(ExecState* exec, JSValuePtr value, unsigned bytecodeOffset, CodeBlock* codeBlock)
+JSValue createNotAFunctionError(ExecState* exec, JSValue value, unsigned bytecodeOffset, CodeBlock* codeBlock)
 {
     int startOffset = 0;
     int endOffset = 0;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
index d4dfdd8..09d99dc 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ExceptionHelpers.h
@@ -40,16 +40,16 @@ namespace JSC {
     class JSGlobalData;
     class JSNotAnObjectErrorStub;
     class JSObject;
-    class JSValuePtr;
+    class JSValue;
     class Node;
 
-    JSValuePtr createInterruptedExecutionException(JSGlobalData*);
-    JSValuePtr createStackOverflowError(ExecState*);
-    JSValuePtr createUndefinedVariableError(ExecState*, const Identifier&, unsigned bytecodeOffset, CodeBlock*);
+    JSValue createInterruptedExecutionException(JSGlobalData*);
+    JSValue createStackOverflowError(ExecState*);
+    JSValue createUndefinedVariableError(ExecState*, const Identifier&, unsigned bytecodeOffset, CodeBlock*);
     JSNotAnObjectErrorStub* createNotAnObjectErrorStub(ExecState*, bool isNull);
-    JSObject* createInvalidParamError(ExecState*, const char* op, JSValuePtr, unsigned bytecodeOffset, CodeBlock*);
-    JSObject* createNotAConstructorError(ExecState*, JSValuePtr, unsigned bytecodeOffset, CodeBlock*);
-    JSValuePtr createNotAFunctionError(ExecState*, JSValuePtr, unsigned bytecodeOffset, CodeBlock*);
+    JSObject* createInvalidParamError(ExecState*, const char* op, JSValue, unsigned bytecodeOffset, CodeBlock*);
+    JSObject* createNotAConstructorError(ExecState*, JSValue, unsigned bytecodeOffset, CodeBlock*);
+    JSValue createNotAFunctionError(ExecState*, JSValue, unsigned bytecodeOffset, CodeBlock*);
     JSObject* createNotAnObjectError(ExecState*, JSNotAnObjectErrorStub*, unsigned bytecodeOffset, CodeBlock*);
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp
index e8cfe65..f4f5cc8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.cpp
@@ -54,7 +54,7 @@ ConstructType FunctionConstructor::getConstructData(ConstructData& constructData
     return ConstructTypeHost;
 }
 
-static JSValuePtr callFunctionConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callFunctionConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     return constructFunction(exec, args);
 }
@@ -66,7 +66,7 @@ CallType FunctionConstructor::getCallData(CallData& callData)
     return CallTypeHost;
 }
 
-static FunctionBodyNode* functionBody(ProgramNode* program)
+FunctionBodyNode* extractFunctionBody(ProgramNode* program)
 {
     if (!program)
         return 0;
@@ -75,17 +75,19 @@ static FunctionBodyNode* functionBody(ProgramNode* program)
     if (children.size() != 1)
         return 0;
 
-    ExprStatementNode* exprStatement = static_cast<ExprStatementNode*>(children[0].get()); 
+    StatementNode* exprStatement = children[0];
+    ASSERT(exprStatement);
     ASSERT(exprStatement->isExprStatement());
     if (!exprStatement || !exprStatement->isExprStatement())
         return 0;
 
-    FuncExprNode* funcExpr = static_cast<FuncExprNode*>(exprStatement->expr());
+    ExpressionNode* funcExpr = static_cast<ExprStatementNode*>(exprStatement)->expr();
+    ASSERT(funcExpr);
     ASSERT(funcExpr->isFuncExprNode());
     if (!funcExpr || !funcExpr->isFuncExprNode())
         return 0;
 
-    FunctionBodyNode* body = funcExpr->body();
+    FunctionBodyNode* body = static_cast<FuncExprNode*>(funcExpr)->body();
     ASSERT(body);
     return body;
 }
@@ -93,16 +95,19 @@ static FunctionBodyNode* functionBody(ProgramNode* program)
 // ECMA 15.3.2 The Function Constructor
 JSObject* constructFunction(ExecState* exec, const ArgList& args, const Identifier& functionName, const UString& sourceURL, int lineNumber)
 {
+    // Functions need to have a space following the opening { due to for web compatibility
+    // see https://bugs.webkit.org/show_bug.cgi?id=24350
+    // We also need \n before the closing } to handle // comments at the end of the last line
     UString program;
     if (args.isEmpty())
-        program = "(function(){})";
+        program = "(function() { \n})";
     else if (args.size() == 1)
-        program = "(function(){" + args.at(exec, 0)->toString(exec) + "})";
+        program = "(function() { " + args.at(0).toString(exec) + "\n})";
     else {
-        program = "(function(" + args.at(exec, 0)->toString(exec);
+        program = "(function(" + args.at(0).toString(exec);
         for (size_t i = 1; i < args.size() - 1; i++)
-            program += "," + args.at(exec, i)->toString(exec);
-        program += "){" + args.at(exec, args.size() - 1)->toString(exec) + "})";
+            program += "," + args.at(i).toString(exec);
+        program += ") { " + args.at(args.size() - 1).toString(exec) + "\n})";
     }
 
     int errLine;
@@ -110,7 +115,7 @@ JSObject* constructFunction(ExecState* exec, const ArgList& args, const Identifi
     SourceCode source = makeSource(program, sourceURL, lineNumber);
     RefPtr<ProgramNode> programNode = exec->globalData().parser->parse<ProgramNode>(exec, exec->dynamicGlobalObject()->debugger(), source, &errLine, &errMsg);
 
-    FunctionBodyNode* body = functionBody(programNode.get());
+    FunctionBodyNode* body = extractFunctionBody(programNode.get());
     if (!body)
         return throwError(exec, SyntaxError, errMsg, errLine, source.provider()->asID(), source.provider()->url());
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.h
index e8486dc..124b354 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionConstructor.h
@@ -26,6 +26,8 @@
 namespace JSC {
 
     class FunctionPrototype;
+    class ProgramNode;
+    class FunctionBodyNode;
 
     class FunctionConstructor : public InternalFunction {
     public:
@@ -39,6 +41,8 @@ namespace JSC {
     JSObject* constructFunction(ExecState*, const ArgList&, const Identifier& functionName, const UString& sourceURL, int lineNumber);
     JSObject* constructFunction(ExecState*, const ArgList&);
 
+    FunctionBodyNode* extractFunctionBody(ProgramNode*);
+
 } // namespace JSC
 
 #endif // FunctionConstructor_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp
index 4d9d682..9ba2144 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.cpp
@@ -26,15 +26,16 @@
 #include "JSFunction.h"
 #include "JSString.h"
 #include "Interpreter.h"
+#include "Lexer.h"
 #include "PrototypeFunction.h"
 
 namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(FunctionPrototype);
 
-static JSValuePtr functionProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionProtoFuncApply(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr functionProtoFuncCall(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL functionProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionProtoFuncApply(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL functionProtoFuncCall(ExecState*, JSObject*, JSValue, const ArgList&);
 
 FunctionPrototype::FunctionPrototype(ExecState* exec, PassRefPtr<Structure> structure)
     : InternalFunction(&exec->globalData(), structure, exec->propertyNames().nullIdentifier)
@@ -42,14 +43,16 @@ FunctionPrototype::FunctionPrototype(ExecState* exec, PassRefPtr<Structure> stru
     putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 0), DontDelete | ReadOnly | DontEnum);
 }
 
-void FunctionPrototype::addFunctionProperties(ExecState* exec, Structure* prototypeFunctionStructure)
+void FunctionPrototype::addFunctionProperties(ExecState* exec, Structure* prototypeFunctionStructure, NativeFunctionWrapper** callFunction, NativeFunctionWrapper** applyFunction)
 {
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, functionProtoFuncToString), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 2, exec->propertyNames().apply, functionProtoFuncApply), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().call, functionProtoFuncCall), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, functionProtoFuncToString), DontEnum);
+    *applyFunction = new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 2, exec->propertyNames().apply, functionProtoFuncApply);
+    putDirectFunctionWithoutTransition(exec, *applyFunction, DontEnum);
+    *callFunction = new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().call, functionProtoFuncCall);
+    putDirectFunctionWithoutTransition(exec, *callFunction, DontEnum);
 }
 
-static JSValuePtr callFunctionPrototype(ExecState*, JSObject*, JSValuePtr, const ArgList&)
+static JSValue JSC_HOST_CALL callFunctionPrototype(ExecState*, JSObject*, JSValue, const ArgList&)
 {
     return jsUndefined();
 }
@@ -63,14 +66,34 @@ CallType FunctionPrototype::getCallData(CallData& callData)
 
 // Functions
 
-JSValuePtr functionProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+// Compatibility hack for the Optimost JavaScript library. (See <rdar://problem/6595040>.)
+static inline void insertSemicolonIfNeeded(UString& functionBody)
 {
-    if (thisValue->isObject(&JSFunction::info)) {
+    ASSERT(functionBody[0] == '{');
+    ASSERT(functionBody[functionBody.size() - 1] == '}');
+
+    for (size_t i = functionBody.size() - 2; i > 0; --i) {
+        UChar ch = functionBody[i];
+        if (!Lexer::isWhiteSpace(ch) && !Lexer::isLineTerminator(ch)) {
+            if (ch != ';' && ch != '}')
+                functionBody = functionBody.substr(0, i + 1) + ";" + functionBody.substr(i + 1, functionBody.size() - (i + 1));
+            return;
+        }
+    }
+}
+
+JSValue JSC_HOST_CALL functionProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
+{
+    if (thisValue.isObject(&JSFunction::info)) {
         JSFunction* function = asFunction(thisValue);
-        return jsString(exec, "function " + function->name(&exec->globalData()) + "(" + function->body()->paramString() + ") " + function->body()->toSourceString());
+        if (!function->isHostFunction()) {
+            UString functionBody = function->body()->toSourceString();
+            insertSemicolonIfNeeded(functionBody);
+            return jsString(exec, "function " + function->name(&exec->globalData()) + "(" + function->body()->paramString() + ") " + functionBody);
+        }
     }
 
-    if (thisValue->isObject(&InternalFunction::info)) {
+    if (thisValue.isObject(&InternalFunction::info)) {
         InternalFunction* function = asInternalFunction(thisValue);
         return jsString(exec, "function " + function->name(&exec->globalData()) + "() {\n    [native code]\n}");
     }
@@ -78,59 +101,44 @@ JSValuePtr functionProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr this
     return throwError(exec, TypeError);
 }
 
-JSValuePtr functionProtoFuncApply(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL functionProtoFuncApply(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     CallData callData;
-    CallType callType = thisValue->getCallData(callData);
+    CallType callType = thisValue.getCallData(callData);
     if (callType == CallTypeNone)
         return throwError(exec, TypeError);
 
-    JSValuePtr thisArg = args.at(exec, 0);
-    JSValuePtr argArray = args.at(exec, 1);
+    JSValue array = args.at(1);
 
-    JSValuePtr applyThis;
-    if (thisArg->isUndefinedOrNull())
-        applyThis = exec->globalThisValue();
-    else
-        applyThis = thisArg->toObject(exec);
-
-    ArgList applyArgs;
-    if (!argArray->isUndefinedOrNull()) {
-        if (!argArray->isObject())
+    MarkedArgumentBuffer applyArgs;
+    if (!array.isUndefinedOrNull()) {
+        if (!array.isObject())
             return throwError(exec, TypeError);
-        if (asObject(argArray)->classInfo() == &Arguments::info)
-            asArguments(argArray)->fillArgList(exec, applyArgs);
-        else if (exec->interpreter()->isJSArray(argArray))
-            asArray(argArray)->fillArgList(exec, applyArgs);
-        else if (asObject(argArray)->inherits(&JSArray::info)) {
-            unsigned length = asArray(argArray)->get(exec, exec->propertyNames().length)->toUInt32(exec);
+        if (asObject(array)->classInfo() == &Arguments::info)
+            asArguments(array)->fillArgList(exec, applyArgs);
+        else if (isJSArray(&exec->globalData(), array))
+            asArray(array)->fillArgList(exec, applyArgs);
+        else if (asObject(array)->inherits(&JSArray::info)) {
+            unsigned length = asArray(array)->get(exec, exec->propertyNames().length).toUInt32(exec);
             for (unsigned i = 0; i < length; ++i)
-                applyArgs.append(asArray(argArray)->get(exec, i));
+                applyArgs.append(asArray(array)->get(exec, i));
         } else
             return throwError(exec, TypeError);
     }
 
-    return call(exec, thisValue, callType, callData, applyThis, applyArgs);
+    return call(exec, thisValue, callType, callData, args.at(0), applyArgs);
 }
 
-JSValuePtr functionProtoFuncCall(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL functionProtoFuncCall(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     CallData callData;
-    CallType callType = thisValue->getCallData(callData);
+    CallType callType = thisValue.getCallData(callData);
     if (callType == CallTypeNone)
         return throwError(exec, TypeError);
 
-    JSValuePtr thisArg = args.at(exec, 0);
-
-    JSObject* callThis;
-    if (thisArg->isUndefinedOrNull())
-        callThis = exec->globalThisValue();
-    else
-        callThis = thisArg->toObject(exec);
-
-    ArgList argsTail;
-    args.getSlice(1, argsTail);
-    return call(exec, thisValue, callType, callData, callThis, argsTail);
+    ArgList callArgs;
+    args.getSlice(1, callArgs);
+    return call(exec, thisValue, callType, callData, args.at(0), callArgs);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
index 33d68b7..607ddab 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/FunctionPrototype.h
@@ -25,12 +25,14 @@
 
 namespace JSC {
 
+    class PrototypeFunction;
+
     class FunctionPrototype : public InternalFunction {
     public:
         FunctionPrototype(ExecState*, PassRefPtr<Structure>);
-        void addFunctionProperties(ExecState*, Structure* prototypeFunctionStructure);
+        void addFunctionProperties(ExecState*, Structure* prototypeFunctionStructure, NativeFunctionWrapper** callFunction, NativeFunctionWrapper** applyFunction);
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto)
+        static PassRefPtr<Structure> createStructure(JSValue proto)
         {
             return Structure::create(proto, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot));
         }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.cpp
index d24a024..cd1b40a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.cpp
@@ -38,17 +38,17 @@ void GetterSetter::mark()
         m_setter->mark();
 }
 
-JSValuePtr GetterSetter::toPrimitive(ExecState*, PreferredPrimitiveType) const
+JSValue GetterSetter::toPrimitive(ExecState*, PreferredPrimitiveType) const
 {
     ASSERT_NOT_REACHED();
     return jsNull();
 }
 
-bool GetterSetter::getPrimitiveNumber(ExecState*, double& number, JSValuePtr& value)
+bool GetterSetter::getPrimitiveNumber(ExecState*, double& number, JSValue& value)
 {
     ASSERT_NOT_REACHED();
     number = 0;
-    value = noValue();
+    value = JSValue();
     return true;
 }
 
@@ -73,7 +73,7 @@ UString GetterSetter::toString(ExecState*) const
 JSObject* GetterSetter::toObject(ExecState* exec) const
 {
     ASSERT_NOT_REACHED();
-    return jsNull()->toObject(exec);
+    return jsNull().toObject(exec);
 }
 
 bool GetterSetter::isGetterSetter() const
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h b/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
index 48e1baf..e6b74a1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/GetterSetter.h
@@ -50,8 +50,8 @@ namespace JSC {
     private:
         virtual bool isGetterSetter() const;
 
-        virtual JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType) const;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValuePtr& value);
+        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
+        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual UString toString(ExecState*) const;
@@ -61,9 +61,9 @@ namespace JSC {
         JSObject* m_setter;  
     };
 
-    GetterSetter* asGetterSetter(JSValuePtr);
+    GetterSetter* asGetterSetter(JSValue);
 
-    inline GetterSetter* asGetterSetter(JSValuePtr value)
+    inline GetterSetter* asGetterSetter(JSValue value)
     {
         ASSERT(asCell(value)->isGetterSetter());
         return static_cast<GetterSetter*>(asCell(value));
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp
index 8372010..040c123 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Identifier.cpp
@@ -124,12 +124,12 @@ struct CStringTranslator {
 PassRefPtr<UString::Rep> Identifier::add(JSGlobalData* globalData, const char* c)
 {
     if (!c) {
-        UString::Rep::null.hash();
-        return &UString::Rep::null;
+        UString::Rep::null().hash();
+        return &UString::Rep::null();
     }
     if (!c[0]) {
-        UString::Rep::empty.hash();
-        return &UString::Rep::empty;
+        UString::Rep::empty().hash();
+        return &UString::Rep::empty();
     }
     if (!c[1])
         return add(globalData, globalData->smallStrings.singleCharacterStringRep(static_cast<unsigned char>(c[0])));
@@ -194,8 +194,8 @@ PassRefPtr<UString::Rep> Identifier::add(JSGlobalData* globalData, const UChar*
             return add(globalData, globalData->smallStrings.singleCharacterStringRep(c));
     }
     if (!length) {
-        UString::Rep::empty.hash();
-        return &UString::Rep::empty;
+        UString::Rep::empty().hash();
+        return &UString::Rep::empty();
     }
     UCharBuffer buf = {s, length}; 
     pair<HashSet<UString::Rep*>::iterator, bool> addResult = globalData->identifierTable->add<UCharBuffer, UCharBufferTranslator>(buf);
@@ -225,8 +225,8 @@ PassRefPtr<UString::Rep> Identifier::addSlowCase(JSGlobalData* globalData, UStri
             }
     }
     if (!r->len) {
-        UString::Rep::empty.hash();
-        return &UString::Rep::empty;
+        UString::Rep::empty().hash();
+        return &UString::Rep::empty();
     }
     return *globalData->identifierTable->add(r).first;
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp
index a17c386..a0620e7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/InitializeThreading.cpp
@@ -31,11 +31,11 @@
 
 #include "JSImmediate.h"
 #include "Collector.h"
-#include "DateMath.h"
 #include "dtoa.h"
 #include "Identifier.h"
 #include "JSGlobalObject.h"
 #include "UString.h"
+#include <wtf/DateMath.h>
 #include <wtf/Threading.h>
 
 using namespace WTF;
@@ -49,10 +49,10 @@ static pthread_once_t initializeThreadingKeyOnce = PTHREAD_ONCE_INIT;
 static void initializeThreadingOnce()
 {
     WTF::initializeThreading();
+    initializeUString();
 #if ENABLE(JSC_MULTIPLE_THREADS)
     s_dtoaP5Mutex = new Mutex;
-    UString::null();
-    initDateMath();
+    WTF::initializeDates();
 #endif
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.cpp
index 6714cf5..b5c9571 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.cpp
@@ -48,4 +48,24 @@ const UString& InternalFunction::name(JSGlobalData* globalData)
     return asString(getDirect(globalData->propertyNames->name))->value();
 }
 
+const UString InternalFunction::displayName(JSGlobalData* globalData)
+{
+    JSValue displayName = getDirect(globalData->propertyNames->displayName);
+    
+    if (displayName && isJSString(globalData, displayName))
+        return asString(displayName)->value();
+    
+    return UString::null();
+}
+
+const UString InternalFunction::calculatedDisplayName(JSGlobalData* globalData)
+{
+    const UString explicitName = displayName(globalData);
+    
+    if (!explicitName.isEmpty())
+        return explicitName;
+    
+    return name(globalData);
+}
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
index cc4b917..310644c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/InternalFunction.h
@@ -34,11 +34,13 @@ namespace JSC {
     class InternalFunction : public JSObject {
     public:
         virtual const ClassInfo* classInfo() const; 
-        static const ClassInfo info;
+        static JS_EXPORTDATA const ClassInfo info;
 
         const UString& name(JSGlobalData*);
+        const UString displayName(JSGlobalData*);
+        const UString calculatedDisplayName(JSGlobalData*);
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+        static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
             return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance | HasStandardGetOwnPropertySlot)); 
         }
@@ -51,9 +53,9 @@ namespace JSC {
         virtual CallType getCallData(CallData&) = 0;
     };
 
-    InternalFunction* asInternalFunction(JSValuePtr);
+    InternalFunction* asInternalFunction(JSValue);
 
-    inline InternalFunction* asInternalFunction(JSValuePtr value)
+    inline InternalFunction* asInternalFunction(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&InternalFunction::info));
         return static_cast<InternalFunction*>(asObject(value));
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp
index d03b3f0..8996629 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.cpp
@@ -75,7 +75,7 @@ void JSActivation::mark()
 
     for ( ; i < count; ++i) {
         Register& r = registerArray[i];
-        if (!r.marked())
+        if (r.jsValue() && !r.marked())
             r.mark();
     }
 }
@@ -85,7 +85,7 @@ bool JSActivation::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     if (symbolTableGet(propertyName, slot))
         return true;
 
-    if (JSValuePtr* location = getDirectLocation(propertyName)) {
+    if (JSValue* location = getDirectLocation(propertyName)) {
         slot.setValueSlot(location);
         return true;
     }
@@ -99,11 +99,11 @@ bool JSActivation::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     // We don't call through to JSObject because there's no way to give an 
     // activation object getter properties or a prototype.
     ASSERT(!hasGetterSetterProperties());
-    ASSERT(prototype()->isNull());
+    ASSERT(prototype().isNull());
     return false;
 }
 
-void JSActivation::put(ExecState*, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSActivation::put(ExecState*, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
@@ -118,7 +118,7 @@ void JSActivation::put(ExecState*, const Identifier& propertyName, JSValuePtr va
 }
 
 // FIXME: Make this function honor ReadOnly (const) and DontEnum
-void JSActivation::putWithAttributes(ExecState*, const Identifier& propertyName, JSValuePtr value, unsigned attributes)
+void JSActivation::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValue value, unsigned attributes)
 {
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
@@ -130,7 +130,7 @@ void JSActivation::putWithAttributes(ExecState*, const Identifier& propertyName,
     // expose in the activation object.
     ASSERT(!hasGetterSetterProperties());
     PutPropertySlot slot;
-    putDirect(propertyName, value, attributes, true, slot);
+    JSObject::putWithAttributes(exec, propertyName, value, attributes, true, slot);
 }
 
 bool JSActivation::deleteProperty(ExecState* exec, const Identifier& propertyName)
@@ -151,7 +151,7 @@ bool JSActivation::isDynamicScope() const
     return d()->functionBody->usesEval();
 }
 
-JSValuePtr JSActivation::argumentsGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSActivation::argumentsGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSActivation* activation = asActivation(slot.slotBase());
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
index 222f423..c183dac 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSActivation.h
@@ -50,11 +50,13 @@ namespace JSC {
 
         virtual bool isDynamicScope() const;
 
+        virtual bool isActivationObject() const { return true; }
+
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
 
-        virtual void put(ExecState*, const Identifier&, JSValuePtr, PutPropertySlot&);
+        virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
 
-        virtual void putWithAttributes(ExecState*, const Identifier&, JSValuePtr, unsigned attributes);
+        virtual void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
 
         virtual JSObject* toThisObject(ExecState*) const;
@@ -64,7 +66,7 @@ namespace JSC {
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto) { return Structure::create(proto, TypeInfo(ObjectType, NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, NeedsThisConversion)); }
 
     private:
         struct JSActivationData : public JSVariableObjectData {
@@ -77,15 +79,15 @@ namespace JSC {
             RefPtr<FunctionBodyNode> functionBody;
         };
         
-        static JSValuePtr argumentsGetter(ExecState*, const Identifier&, const PropertySlot&);
+        static JSValue argumentsGetter(ExecState*, const Identifier&, const PropertySlot&);
         NEVER_INLINE PropertySlot::GetValueFunc getArgumentsGetter();
 
         JSActivationData* d() const { return static_cast<JSActivationData*>(JSVariableObject::d); }
     };
 
-    JSActivation* asActivation(JSValuePtr);
+    JSActivation* asActivation(JSValue);
 
-    inline JSActivation* asActivation(JSValuePtr value)
+    inline JSActivation* asActivation(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&JSActivation::info));
         return static_cast<JSActivation*>(asObject(value));
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
index 35d0dec..296ac9d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.cpp
@@ -24,9 +24,11 @@
 #include "JSArray.h"
 
 #include "ArrayPrototype.h"
+#include "CachedCall.h"
 #include "PropertyNameArray.h"
 #include <wtf/AVLTree.h>
 #include <wtf/Assertions.h>
+#include <wtf/OwnPtr.h>
 #include <Operations.h>
 
 #define CHECK_ARRAY_CONSISTENCY 0
@@ -65,9 +67,9 @@ ASSERT_CLASS_FITS_IN_CELL(JSArray);
 
 // The definition of MAX_STORAGE_VECTOR_LENGTH is dependant on the definition storageSize
 // function below - the MAX_STORAGE_VECTOR_LENGTH limit is defined such that the storage
-// size calculation cannot overflow.  (sizeof(ArrayStorage) - sizeof(JSValuePtr)) +
-// (vectorLength * sizeof(JSValuePtr)) must be <= 0xFFFFFFFFU (which is maximum value of size_t).
-#define MAX_STORAGE_VECTOR_LENGTH static_cast<unsigned>((0xFFFFFFFFU - (sizeof(ArrayStorage) - sizeof(JSValuePtr))) / sizeof(JSValuePtr))
+// size calculation cannot overflow.  (sizeof(ArrayStorage) - sizeof(JSValue)) +
+// (vectorLength * sizeof(JSValue)) must be <= 0xFFFFFFFFU (which is maximum value of size_t).
+#define MAX_STORAGE_VECTOR_LENGTH static_cast<unsigned>((0xFFFFFFFFU - (sizeof(ArrayStorage) - sizeof(JSValue))) / sizeof(JSValue))
 
 // These values have to be macros to be used in max() and min() without introducing
 // a PIC branch in Mach-O binaries, see <rdar://problem/5971391>.
@@ -90,10 +92,10 @@ static inline size_t storageSize(unsigned vectorLength)
 
     // MAX_STORAGE_VECTOR_LENGTH is defined such that provided (vectorLength <= MAX_STORAGE_VECTOR_LENGTH)
     // - as asserted above - the following calculation cannot overflow.
-    size_t size = (sizeof(ArrayStorage) - sizeof(JSValuePtr)) + (vectorLength * sizeof(JSValuePtr));
+    size_t size = (sizeof(ArrayStorage) - sizeof(JSValue)) + (vectorLength * sizeof(JSValue));
     // Assertion to detect integer overflow in previous calculation (should not be possible, provided that
     // MAX_STORAGE_VECTOR_LENGTH is correctly defined).
-    ASSERT(((size - (sizeof(ArrayStorage) - sizeof(JSValuePtr))) / sizeof(JSValuePtr) == vectorLength) && (size >= (sizeof(ArrayStorage) - sizeof(JSValuePtr))));
+    ASSERT(((size - (sizeof(ArrayStorage) - sizeof(JSValue))) / sizeof(JSValue) == vectorLength) && (size >= (sizeof(ArrayStorage) - sizeof(JSValue))));
 
     return size;
 }
@@ -149,12 +151,12 @@ JSArray::JSArray(PassRefPtr<Structure> structure, unsigned initialLength)
     m_storage->m_vectorLength = initialCapacity;
     m_storage->m_length = initialLength;
 
-    Heap::heap(this)->reportExtraMemoryCost(initialCapacity * sizeof(JSValuePtr));
+    Heap::heap(this)->reportExtraMemoryCost(initialCapacity * sizeof(JSValue));
 
     checkConsistency();
 }
 
-JSArray::JSArray(ExecState* exec, PassRefPtr<Structure> structure, const ArgList& list)
+JSArray::JSArray(PassRefPtr<Structure> structure, const ArgList& list)
     : JSObject(structure)
 {
     unsigned length = list.size();
@@ -171,12 +173,11 @@ JSArray::JSArray(ExecState* exec, PassRefPtr<Structure> structure, const ArgList
     size_t i = 0;
     ArgList::const_iterator end = list.end();
     for (ArgList::const_iterator it = list.begin(); it != end; ++it, ++i)
-        storage->m_vector[i] = (*it).jsValue(exec);
+        storage->m_vector[i] = *it;
 
     m_storage = storage;
 
-    // When the array is created non-empty, its cells are filled, so it's really no worse than
-    // a property map. Therefore don't report extra memory cost.
+    Heap::heap(this)->reportExtraMemoryCost(storageSize(length));
 
     checkConsistency();
 }
@@ -200,7 +201,7 @@ bool JSArray::getOwnPropertySlot(ExecState* exec, unsigned i, PropertySlot& slot
     }
 
     if (i < storage->m_vectorLength) {
-        JSValuePtr& valueSlot = storage->m_vector[i];
+        JSValue& valueSlot = storage->m_vector[i];
         if (valueSlot) {
             slot.setValueSlot(&valueSlot);
             return true;
@@ -234,7 +235,7 @@ bool JSArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName
 }
 
 // ECMA 15.4.5.1
-void JSArray::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     bool isArrayIndex;
     unsigned i = propertyName.toArrayIndex(&isArrayIndex);
@@ -244,8 +245,8 @@ void JSArray::put(ExecState* exec, const Identifier& propertyName, JSValuePtr va
     }
 
     if (propertyName == exec->propertyNames().length) {
-        unsigned newLength = value->toUInt32(exec);
-        if (value->toNumber(exec) != static_cast<double>(newLength)) {
+        unsigned newLength = value.toUInt32(exec);
+        if (value.toNumber(exec) != static_cast<double>(newLength)) {
             throwError(exec, RangeError, "Invalid array length.");
             return;
         }
@@ -256,7 +257,7 @@ void JSArray::put(ExecState* exec, const Identifier& propertyName, JSValuePtr va
     JSObject::put(exec, propertyName, value, slot);
 }
 
-void JSArray::put(ExecState* exec, unsigned i, JSValuePtr value)
+void JSArray::put(ExecState* exec, unsigned i, JSValue value)
 {
     checkConsistency();
 
@@ -267,7 +268,7 @@ void JSArray::put(ExecState* exec, unsigned i, JSValuePtr value)
     }
 
     if (i < m_storage->m_vectorLength) {
-        JSValuePtr& valueSlot = m_storage->m_vector[i];
+        JSValue& valueSlot = m_storage->m_vector[i];
         if (valueSlot) {
             valueSlot = value;
             checkConsistency();
@@ -283,7 +284,7 @@ void JSArray::put(ExecState* exec, unsigned i, JSValuePtr value)
     putSlowCase(exec, i, value);
 }
 
-NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValuePtr value)
+NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValue value)
 {
     ArrayStorage* storage = m_storage;
     SparseArrayValueMap* map = storage->m_sparseValueMap;
@@ -349,14 +350,17 @@ NEVER_INLINE void JSArray::putSlowCase(ExecState* exec, unsigned i, JSValuePtr v
     }
 
     unsigned vectorLength = storage->m_vectorLength;
+
+    Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
+
     if (newNumValuesInVector == storage->m_numValuesInVector + 1) {
         for (unsigned j = vectorLength; j < newVectorLength; ++j)
-            storage->m_vector[j] = noValue();
+            storage->m_vector[j] = JSValue();
         if (i > MIN_SPARSE_ARRAY_INDEX)
             map->remove(i);
     } else {
         for (unsigned j = vectorLength; j < max(vectorLength, MIN_SPARSE_ARRAY_INDEX); ++j)
-            storage->m_vector[j] = noValue();
+            storage->m_vector[j] = JSValue();
         for (unsigned j = max(vectorLength, MIN_SPARSE_ARRAY_INDEX); j < newVectorLength; ++j)
             storage->m_vector[j] = map->take(j);
     }
@@ -391,12 +395,12 @@ bool JSArray::deleteProperty(ExecState* exec, unsigned i)
     ArrayStorage* storage = m_storage;
 
     if (i < storage->m_vectorLength) {
-        JSValuePtr& valueSlot = storage->m_vector[i];
+        JSValue& valueSlot = storage->m_vector[i];
         if (!valueSlot) {
             checkConsistency();
             return false;
         }
-        valueSlot = noValue();
+        valueSlot = JSValue();
         --storage->m_numValuesInVector;
         if (m_fastAccessCutoff > i)
             m_fastAccessCutoff = i;
@@ -462,10 +466,11 @@ bool JSArray::increaseVectorLength(unsigned newLength)
     if (!storage)
         return false;
 
+    Heap::heap(this)->reportExtraMemoryCost(storageSize(newVectorLength) - storageSize(vectorLength));
     storage->m_vectorLength = newVectorLength;
 
     for (unsigned i = vectorLength; i < newVectorLength; ++i)
-        storage->m_vector[i] = noValue();
+        storage->m_vector[i] = JSValue();
 
     m_storage = storage;
     return true;
@@ -485,9 +490,9 @@ void JSArray::setLength(unsigned newLength)
 
         unsigned usedVectorLength = min(length, storage->m_vectorLength);
         for (unsigned i = newLength; i < usedVectorLength; ++i) {
-            JSValuePtr& valueSlot = storage->m_vector[i];
+            JSValue& valueSlot = storage->m_vector[i];
             bool hadValue = valueSlot;
-            valueSlot = noValue();
+            valueSlot = JSValue();
             storage->m_numValuesInVector -= hadValue;
         }
 
@@ -510,7 +515,7 @@ void JSArray::setLength(unsigned newLength)
     checkConsistency();
 }
 
-JSValuePtr JSArray::pop()
+JSValue JSArray::pop()
 {
     checkConsistency();
 
@@ -520,19 +525,19 @@ JSValuePtr JSArray::pop()
 
     --length;
 
-    JSValuePtr result;
+    JSValue result;
 
     if (m_fastAccessCutoff > length) {
-        JSValuePtr& valueSlot = m_storage->m_vector[length];
+        JSValue& valueSlot = m_storage->m_vector[length];
         result = valueSlot;
         ASSERT(result);
-        valueSlot = noValue();
+        valueSlot = JSValue();
         --m_storage->m_numValuesInVector;
         m_fastAccessCutoff = length;
     } else if (length < m_storage->m_vectorLength) {
-        JSValuePtr& valueSlot = m_storage->m_vector[length];
+        JSValue& valueSlot = m_storage->m_vector[length];
         result = valueSlot;
-        valueSlot = noValue();
+        valueSlot = JSValue();
         if (result)
             --m_storage->m_numValuesInVector;
         else
@@ -559,7 +564,7 @@ JSValuePtr JSArray::pop()
     return result;
 }
 
-void JSArray::push(ExecState* exec, JSValuePtr value)
+void JSArray::push(ExecState* exec, JSValue value)
 {
     checkConsistency();
 
@@ -599,30 +604,68 @@ void JSArray::mark()
 
     unsigned usedVectorLength = min(storage->m_length, storage->m_vectorLength);
     for (unsigned i = 0; i < usedVectorLength; ++i) {
-        JSValuePtr value = storage->m_vector[i];
-        if (value && !value->marked())
-            value->mark();
+        JSValue value = storage->m_vector[i];
+        if (value && !value.marked())
+            value.mark();
     }
 
     if (SparseArrayValueMap* map = storage->m_sparseValueMap) {
         SparseArrayValueMap::iterator end = map->end();
         for (SparseArrayValueMap::iterator it = map->begin(); it != end; ++it) {
-            JSValuePtr value = it->second;
-            if (!value->marked())
-                value->mark();
+            JSValue value = it->second;
+            if (!value.marked())
+                value.mark();
         }
     }
 }
 
-typedef std::pair<JSValuePtr, UString> ArrayQSortPair;
+static int compareNumbersForQSort(const void* a, const void* b)
+{
+    double da = static_cast<const JSValue*>(a)->uncheckedGetNumber();
+    double db = static_cast<const JSValue*>(b)->uncheckedGetNumber();
+    return (da > db) - (da < db);
+}
+
+typedef std::pair<JSValue, UString> ValueStringPair;
 
 static int compareByStringPairForQSort(const void* a, const void* b)
 {
-    const ArrayQSortPair* va = static_cast<const ArrayQSortPair*>(a);
-    const ArrayQSortPair* vb = static_cast<const ArrayQSortPair*>(b);
+    const ValueStringPair* va = static_cast<const ValueStringPair*>(a);
+    const ValueStringPair* vb = static_cast<const ValueStringPair*>(b);
     return compare(va->second, vb->second);
 }
 
+void JSArray::sortNumeric(ExecState* exec, JSValue compareFunction, CallType callType, const CallData& callData)
+{
+    unsigned lengthNotIncludingUndefined = compactForSorting();
+    if (m_storage->m_sparseValueMap) {
+        throwOutOfMemoryError(exec);
+        return;
+    }
+
+    if (!lengthNotIncludingUndefined)
+        return;
+        
+    bool allValuesAreNumbers = true;
+    size_t size = m_storage->m_numValuesInVector;
+    for (size_t i = 0; i < size; ++i) {
+        if (!m_storage->m_vector[i].isNumber()) {
+            allValuesAreNumbers = false;
+            break;
+        }
+    }
+
+    if (!allValuesAreNumbers)
+        return sort(exec, compareFunction, callType, callData);
+
+    // For numeric comparison, which is fast, qsort is faster than mergesort. We
+    // also don't require mergesort's stability, since there's no user visible
+    // side-effect from swapping the order of equal primitive values.
+    qsort(m_storage->m_vector, size, sizeof(JSValue), compareNumbersForQSort);
+
+    checkConsistency(SortConsistencyCheck);
+}
+
 void JSArray::sort(ExecState* exec)
 {
     unsigned lengthNotIncludingUndefined = compactForSorting();
@@ -639,15 +682,15 @@ void JSArray::sort(ExecState* exec)
     // buffer. Besides, this protects us from crashing if some objects have custom toString methods that return
     // random or otherwise changing results, effectively making compare function inconsistent.
 
-    Vector<ArrayQSortPair> values(lengthNotIncludingUndefined);
+    Vector<ValueStringPair> values(lengthNotIncludingUndefined);
     if (!values.begin()) {
         throwOutOfMemoryError(exec);
         return;
     }
 
     for (size_t i = 0; i < lengthNotIncludingUndefined; i++) {
-        JSValuePtr value = m_storage->m_vector[i];
-        ASSERT(!value->isUndefined());
+        JSValue value = m_storage->m_vector[i];
+        ASSERT(!value.isUndefined());
         values[i].first = value;
     }
 
@@ -658,7 +701,7 @@ void JSArray::sort(ExecState* exec)
     // a toString call raises an exception.
 
     for (size_t i = 0; i < lengthNotIncludingUndefined; i++)
-        values[i].second = values[i].first->toString(exec);
+        values[i].second = values[i].first.toString(exec);
 
     if (exec->hadException())
         return;
@@ -667,11 +710,11 @@ void JSArray::sort(ExecState* exec)
     // than O(N log N).
 
 #if HAVE(MERGESORT)
-    mergesort(values.begin(), values.size(), sizeof(ArrayQSortPair), compareByStringPairForQSort);
+    mergesort(values.begin(), values.size(), sizeof(ValueStringPair), compareByStringPairForQSort);
 #else
     // FIXME: The qsort library function is likely to not be a stable sort.
     // ECMAScript-262 does not specify a stable sort, but in practice, browsers perform a stable sort.
-    qsort(values.begin(), values.size(), sizeof(ArrayQSortPair), compareByStringPairForQSort);
+    qsort(values.begin(), values.size(), sizeof(ValueStringPair), compareByStringPairForQSort);
 #endif
 
     // FIXME: If the toString function changed the length of the array, this might be
@@ -684,7 +727,7 @@ void JSArray::sort(ExecState* exec)
 }
 
 struct AVLTreeNodeForArrayCompare {
-    JSValuePtr value;
+    JSValue value;
 
     // Child pointers.  The high bit of gt is robbed and used as the
     // balance factor sign.  The high bit of lt is robbed and used as
@@ -695,15 +738,16 @@ struct AVLTreeNodeForArrayCompare {
 
 struct AVLTreeAbstractorForArrayCompare {
     typedef int32_t handle; // Handle is an index into m_nodes vector.
-    typedef JSValuePtr key;
+    typedef JSValue key;
     typedef int32_t size;
 
     Vector<AVLTreeNodeForArrayCompare> m_nodes;
     ExecState* m_exec;
-    JSValuePtr m_compareFunction;
+    JSValue m_compareFunction;
     CallType m_compareCallType;
     const CallData* m_compareCallData;
-    JSValuePtr m_globalThisValue;
+    JSValue m_globalThisValue;
+    OwnPtr<CachedCall> m_cachedCall;
 
     handle get_less(handle h) { return m_nodes[h].lt & 0x7FFFFFFF; }
     void set_less(handle h, handle lh) { m_nodes[h].lt &= 0x80000000; m_nodes[h].lt |= lh; }
@@ -733,16 +777,24 @@ struct AVLTreeAbstractorForArrayCompare {
 
     int compare_key_key(key va, key vb)
     {
-        ASSERT(!va->isUndefined());
-        ASSERT(!vb->isUndefined());
+        ASSERT(!va.isUndefined());
+        ASSERT(!vb.isUndefined());
 
         if (m_exec->hadException())
             return 1;
 
-        ArgList arguments;
-        arguments.append(va);
-        arguments.append(vb);
-        double compareResult = call(m_exec, m_compareFunction, m_compareCallType, *m_compareCallData, m_globalThisValue, arguments)->toNumber(m_exec);
+        double compareResult;
+        if (m_cachedCall) {
+            m_cachedCall->setThis(m_globalThisValue);
+            m_cachedCall->setArgument(0, va);
+            m_cachedCall->setArgument(1, vb);
+            compareResult = m_cachedCall->call().toNumber(m_cachedCall->newCallFrame());
+        } else {
+            MarkedArgumentBuffer arguments;
+            arguments.append(va);
+            arguments.append(vb);
+            compareResult = call(m_exec, m_compareFunction, m_compareCallType, *m_compareCallData, m_globalThisValue, arguments).toNumber(m_exec);
+        }
         return (compareResult < 0) ? -1 : 1; // Not passing equality through, because we need to store all values, even if equivalent.
     }
 
@@ -752,7 +804,7 @@ struct AVLTreeAbstractorForArrayCompare {
     static handle null() { return 0x7FFFFFFF; }
 };
 
-void JSArray::sort(ExecState* exec, JSValuePtr compareFunction, CallType callType, const CallData& callData)
+void JSArray::sort(ExecState* exec, JSValue compareFunction, CallType callType, const CallData& callData)
 {
     checkConsistency();
 
@@ -777,6 +829,9 @@ void JSArray::sort(ExecState* exec, JSValuePtr compareFunction, CallType callTyp
     tree.abstractor().m_globalThisValue = exec->globalThisValue();
     tree.abstractor().m_nodes.resize(usedVectorLength + (m_storage->m_sparseValueMap ? m_storage->m_sparseValueMap->size() : 0));
 
+    if (callType == CallTypeJS)
+        tree.abstractor().m_cachedCall.set(new CachedCall(exec, asFunction(compareFunction), 2, exec->exceptionSlot()));
+
     if (!tree.abstractor().m_nodes.begin()) {
         throwOutOfMemoryError(exec);
         return;
@@ -790,16 +845,16 @@ void JSArray::sort(ExecState* exec, JSValuePtr compareFunction, CallType callTyp
 
     // Iterate over the array, ignoring missing values, counting undefined ones, and inserting all other ones into the tree.
     for (; numDefined < usedVectorLength; ++numDefined) {
-        JSValuePtr v = m_storage->m_vector[numDefined];
-        if (!v || v->isUndefined())
+        JSValue v = m_storage->m_vector[numDefined];
+        if (!v || v.isUndefined())
             break;
         tree.abstractor().m_nodes[numDefined].value = v;
         tree.insert(numDefined);
     }
     for (unsigned i = numDefined; i < usedVectorLength; ++i) {
-        JSValuePtr v = m_storage->m_vector[i];
+        JSValue v = m_storage->m_vector[i];
         if (v) {
-            if (v->isUndefined())
+            if (v.isUndefined())
                 ++numUndefined;
             else {
                 tree.abstractor().m_nodes[numDefined].value = v;
@@ -851,7 +906,7 @@ void JSArray::sort(ExecState* exec, JSValuePtr compareFunction, CallType callTyp
 
     // Ensure that unused values in the vector are zeroed out.
     for (unsigned i = newUsedVectorLength; i < usedVectorLength; ++i)
-        m_storage->m_vector[i] = noValue();
+        m_storage->m_vector[i] = JSValue();
 
     m_fastAccessCutoff = newUsedVectorLength;
     m_storage->m_numValuesInVector = newUsedVectorLength;
@@ -859,7 +914,7 @@ void JSArray::sort(ExecState* exec, JSValuePtr compareFunction, CallType callTyp
     checkConsistency(SortConsistencyCheck);
 }
 
-void JSArray::fillArgList(ExecState* exec, ArgList& args)
+void JSArray::fillArgList(ExecState* exec, MarkedArgumentBuffer& args)
 {
     unsigned fastAccessLength = min(m_storage->m_length, m_fastAccessCutoff);
     unsigned i = 0;
@@ -869,6 +924,19 @@ void JSArray::fillArgList(ExecState* exec, ArgList& args)
         args.append(get(exec, i));
 }
 
+void JSArray::copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSize)
+{
+    ASSERT(m_storage->m_length == maxSize);
+    UNUSED_PARAM(maxSize);
+    unsigned fastAccessLength = min(m_storage->m_length, m_fastAccessCutoff);
+    unsigned i = 0;
+    for (; i < fastAccessLength; ++i)
+        buffer[i] = getIndex(i);
+    uint32_t size = m_storage->m_length;
+    for (; i < size; ++i)
+        buffer[i] = get(exec, i);
+}
+
 unsigned JSArray::compactForSorting()
 {
     checkConsistency();
@@ -881,14 +949,14 @@ unsigned JSArray::compactForSorting()
     unsigned numUndefined = 0;
 
     for (; numDefined < usedVectorLength; ++numDefined) {
-        JSValuePtr v = storage->m_vector[numDefined];
-        if (!v || v->isUndefined())
+        JSValue v = storage->m_vector[numDefined];
+        if (!v || v.isUndefined())
             break;
     }
     for (unsigned i = numDefined; i < usedVectorLength; ++i) {
-        JSValuePtr v = storage->m_vector[i];
+        JSValue v = storage->m_vector[i];
         if (v) {
-            if (v->isUndefined())
+            if (v.isUndefined())
                 ++numUndefined;
             else
                 storage->m_vector[numDefined++] = v;
@@ -918,7 +986,7 @@ unsigned JSArray::compactForSorting()
     for (unsigned i = numDefined; i < newUsedVectorLength; ++i)
         storage->m_vector[i] = jsUndefined();
     for (unsigned i = newUsedVectorLength; i < usedVectorLength; ++i)
-        storage->m_vector[i] = noValue();
+        storage->m_vector[i] = JSValue();
 
     m_fastAccessCutoff = newUsedVectorLength;
     storage->m_numValuesInVector = newUsedVectorLength;
@@ -951,7 +1019,7 @@ void JSArray::checkConsistency(ConsistencyCheckType type)
 
     unsigned numValuesInVector = 0;
     for (unsigned i = 0; i < m_storage->m_vectorLength; ++i) {
-        if (JSValuePtr value = m_storage->m_vector[i]) {
+        if (JSValue value = m_storage->m_vector[i]) {
             ASSERT(i < m_storage->m_length);
             if (type != DestructorConsistencyCheck)
                 value->type(); // Likely to crash if the object was deallocated.
@@ -990,16 +1058,16 @@ JSArray* constructEmptyArray(ExecState* exec, unsigned initialLength)
     return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), initialLength);
 }
 
-JSArray* constructArray(ExecState* exec, JSValuePtr singleItemValue)
+JSArray* constructArray(ExecState* exec, JSValue singleItemValue)
 {
-    ArgList values;
+    MarkedArgumentBuffer values;
     values.append(singleItemValue);
-    return new (exec) JSArray(exec, exec->lexicalGlobalObject()->arrayStructure(), values);
+    return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), values);
 }
 
 JSArray* constructArray(ExecState* exec, const ArgList& values)
 {
-    return new (exec) JSArray(exec, exec->lexicalGlobalObject()->arrayStructure(), values);
+    return new (exec) JSArray(exec->lexicalGlobalObject()->arrayStructure(), values);
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
index e280022..ea490d8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSArray.h
@@ -25,7 +25,7 @@
 
 namespace JSC {
 
-    typedef HashMap<unsigned, JSValuePtr> SparseArrayValueMap;
+    typedef HashMap<unsigned, JSValue> SparseArrayValueMap;
 
     struct ArrayStorage {
         unsigned m_length;
@@ -33,7 +33,7 @@ namespace JSC {
         unsigned m_numValuesInVector;
         SparseArrayValueMap* m_sparseValueMap;
         void* lazyCreationData; // A JSArray subclass can use this to fill the vector lazily.
-        JSValuePtr m_vector[1];
+        JSValue m_vector[1];
     };
 
     class JSArray : public JSObject {
@@ -42,47 +42,49 @@ namespace JSC {
     public:
         explicit JSArray(PassRefPtr<Structure>);
         JSArray(PassRefPtr<Structure>, unsigned initialLength);
-        JSArray(ExecState*, PassRefPtr<Structure>, const ArgList& initialValues);
+        JSArray(PassRefPtr<Structure>, const ArgList& initialValues);
         virtual ~JSArray();
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
-        virtual void put(ExecState*, unsigned propertyName, JSValuePtr); // FIXME: Make protected and add setItem.
+        virtual void put(ExecState*, unsigned propertyName, JSValue); // FIXME: Make protected and add setItem.
 
-        static const ClassInfo info;
+        static JS_EXPORTDATA const ClassInfo info;
 
         unsigned length() const { return m_storage->m_length; }
         void setLength(unsigned); // OK to use on new arrays, but not if it might be a RegExpMatchArray.
 
         void sort(ExecState*);
-        void sort(ExecState*, JSValuePtr compareFunction, CallType, const CallData&);
+        void sort(ExecState*, JSValue compareFunction, CallType, const CallData&);
+        void sortNumeric(ExecState*, JSValue compareFunction, CallType, const CallData&);
 
-        void push(ExecState*, JSValuePtr);
-        JSValuePtr pop();
+        void push(ExecState*, JSValue);
+        JSValue pop();
 
         bool canGetIndex(unsigned i) { return i < m_fastAccessCutoff; }
-        JSValuePtr getIndex(unsigned i)
+        JSValue getIndex(unsigned i)
         {
             ASSERT(canGetIndex(i));
             return m_storage->m_vector[i];
         }
 
         bool canSetIndex(unsigned i) { return i < m_fastAccessCutoff; }
-        JSValuePtr setIndex(unsigned i, JSValuePtr v)
+        JSValue setIndex(unsigned i, JSValue v)
         {
             ASSERT(canSetIndex(i));
             return m_storage->m_vector[i] = v;
         }
 
-        void fillArgList(ExecState*, ArgList&);
+        void fillArgList(ExecState*, MarkedArgumentBuffer&);
+        void copyToRegisters(ExecState*, Register*, uint32_t);
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType));
         }
 
     protected:
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
         virtual void getPropertyNames(ExecState*, PropertyNameArray&);
@@ -95,7 +97,7 @@ namespace JSC {
         virtual const ClassInfo* classInfo() const { return &info; }
 
         bool getOwnPropertySlotSlowCase(ExecState*, unsigned propertyName, PropertySlot&);
-        void putSlowCase(ExecState*, unsigned propertyName, JSValuePtr);
+        void putSlowCase(ExecState*, unsigned propertyName, JSValue);
 
         bool increaseVectorLength(unsigned newLength);
         
@@ -108,19 +110,21 @@ namespace JSC {
         ArrayStorage* m_storage;
     };
 
-    JSArray* asArray(JSValuePtr);
+    JSArray* asArray(JSValue);
 
     JSArray* constructEmptyArray(ExecState*);
     JSArray* constructEmptyArray(ExecState*, unsigned initialLength);
-    JSArray* constructArray(ExecState*, JSValuePtr singleItemValue);
+    JSArray* constructArray(ExecState*, JSValue singleItemValue);
     JSArray* constructArray(ExecState*, const ArgList& values);
 
-    inline JSArray* asArray(JSValuePtr value)
+    inline JSArray* asArray(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&JSArray::info));
         return static_cast<JSArray*>(asObject(value));
     }
 
+    inline bool isJSArray(JSGlobalData* globalData, JSValue v) { return v.isCell() && v.asCell()->vptr() == globalData->jsArrayVPtr; }
+
 } // namespace JSC
 
 #endif // JSArray_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
index 4a19038..2a5e72f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.cpp
@@ -29,6 +29,8 @@
 #include "JSGlobalObject.h"
 #include "PropertyNameArray.h"
 
+using namespace WTF;
+
 namespace JSC {
 
 const ClassInfo JSByteArray::s_defaultInfo = { "ByteArray", 0, 0, 0 };
@@ -41,7 +43,7 @@ JSByteArray::JSByteArray(ExecState* exec, PassRefPtr<Structure> structure, ByteA
     putDirect(exec->globalData().propertyNames->length, jsNumber(exec, m_storage->length()), ReadOnly | DontDelete);
 }
     
-PassRefPtr<Structure> JSByteArray::createStructure(JSValuePtr prototype)
+PassRefPtr<Structure> JSByteArray::createStructure(JSValue prototype)
 {
     PassRefPtr<Structure> result = Structure::create(prototype, TypeInfo(ObjectType));
     return result;
@@ -52,7 +54,7 @@ bool JSByteArray::getOwnPropertySlot(ExecState* exec, const Identifier& property
     bool ok;
     unsigned index = propertyName.toUInt32(&ok, false);
     if (ok && canAccessIndex(index)) {
-        slot.setValue(getIndex(index));
+        slot.setValue(getIndex(exec, index));
         return true;
     }
     return JSObject::getOwnPropertySlot(exec, propertyName, slot);
@@ -61,13 +63,13 @@ bool JSByteArray::getOwnPropertySlot(ExecState* exec, const Identifier& property
 bool JSByteArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
 {
     if (canAccessIndex(propertyName)) {
-        slot.setValue(getIndex(propertyName));
+        slot.setValue(getIndex(exec, propertyName));
         return true;
     }
     return JSObject::getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-void JSByteArray::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSByteArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     bool ok;
     unsigned index = propertyName.toUInt32(&ok, false);
@@ -78,7 +80,7 @@ void JSByteArray::put(ExecState* exec, const Identifier& propertyName, JSValuePt
     JSObject::put(exec, propertyName, value, slot);
 }
 
-void JSByteArray::put(ExecState* exec, unsigned propertyName, JSValuePtr value)
+void JSByteArray::put(ExecState* exec, unsigned propertyName, JSValue value)
 {
     setIndex(exec, propertyName, value);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
index 895200b..57374e0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSByteArray.h
@@ -26,19 +26,20 @@
 #ifndef JSByteArray_h
 #define JSByteArray_h
 
-#include "ByteArray.h"
 #include "JSObject.h"
 
+#include <wtf/ByteArray.h>
+
 namespace JSC {
 
     class JSByteArray : public JSObject {
-        friend class Interpreter;
+        friend class VPtrSet;
     public:
         bool canAccessIndex(unsigned i) { return i < m_storage->length(); }
-        JSValuePtr getIndex(unsigned i)
+        JSValue getIndex(ExecState* exec, unsigned i)
         {
             ASSERT(canAccessIndex(i));
-            return JSImmediate::from(m_storage->data()[i]);
+            return jsNumber(exec, m_storage->data()[i]);
         }
 
         void setIndex(unsigned i, int value)
@@ -63,22 +64,22 @@ namespace JSC {
             m_storage->data()[i] = static_cast<unsigned char>(value + 0.5);
         }
         
-        void setIndex(ExecState* exec, unsigned i, JSValuePtr value)
+        void setIndex(ExecState* exec, unsigned i, JSValue value)
         {
-            double byteValue = value->toNumber(exec);
+            double byteValue = value.toNumber(exec);
             if (exec->hadException())
                 return;
             if (canAccessIndex(i))
                 setIndex(i, byteValue);
         }
 
-        JSByteArray(ExecState* exec, PassRefPtr<Structure>, ByteArray* storage, const JSC::ClassInfo* = &s_defaultInfo);
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype);
+        JSByteArray(ExecState* exec, PassRefPtr<Structure>, WTF::ByteArray* storage, const JSC::ClassInfo* = &s_defaultInfo);
+        static PassRefPtr<Structure> createStructure(JSValue prototype);
         
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
         virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
-        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-        virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValuePtr);
+        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+        virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
 
         virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
 
@@ -87,7 +88,7 @@ namespace JSC {
         
         size_t length() const { return m_storage->length(); }
 
-        ByteArray* storage() const { return m_storage.get(); }
+        WTF::ByteArray* storage() const { return m_storage.get(); }
 
     private:
         enum VPtrStealingHackType { VPtrStealingHack };
@@ -97,15 +98,18 @@ namespace JSC {
         {
         }
 
-        RefPtr<ByteArray> m_storage;
+        RefPtr<WTF::ByteArray> m_storage;
         const ClassInfo* m_classInfo;
     };
     
-    JSByteArray* asByteArray(JSValuePtr value);
-    inline JSByteArray* asByteArray(JSValuePtr value)
+    JSByteArray* asByteArray(JSValue value);
+    inline JSByteArray* asByteArray(JSValue value)
     {
         return static_cast<JSByteArray*>(asCell(value));
     }
-}
 
-#endif
+    inline bool isJSByteArray(JSGlobalData* globalData, JSValue v) { return v.isCell() && v.asCell()->vptr() == globalData->jsByteArrayVPtr; }
+
+} // namespace JSC
+
+#endif // JSByteArray_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
index c1c1ce4..8cf7943 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.cpp
@@ -100,19 +100,6 @@ bool JSCell::getTruncatedUInt32(uint32_t&) const
     return false;
 }
 
-bool JSCell::getNumber(double& numericValue) const
-{
-    if (!isNumber())
-        return false;
-    numericValue = static_cast<const JSNumberCell*>(this)->value();
-    return true;
-}
-
-double JSCell::getNumber() const
-{
-    return isNumber() ? static_cast<const JSNumberCell*>(this)->value() : NaN;
-}
-
 bool JSCell::getString(UString&stringValue) const
 {
     if (!isString())
@@ -170,12 +157,12 @@ bool JSCell::getOwnPropertySlot(ExecState* exec, unsigned identifier, PropertySl
     return true;
 }
 
-void JSCell::put(ExecState* exec, const Identifier& identifier, JSValuePtr value, PutPropertySlot& slot)
+void JSCell::put(ExecState* exec, const Identifier& identifier, JSValue value, PutPropertySlot& slot)
 {
     toObject(exec)->put(exec, identifier, value, slot);
 }
 
-void JSCell::put(ExecState* exec, unsigned identifier, JSValuePtr value)
+void JSCell::put(ExecState* exec, unsigned identifier, JSValue value)
 {
     toObject(exec)->put(exec, identifier, value);
 }
@@ -210,9 +197,9 @@ const ClassInfo* JSCell::classInfo() const
     return 0;
 }
 
-JSValuePtr JSCell::getJSNumber()
+JSValue JSCell::getJSNumber()
 {
-    return noValue();
+    return JSValue();
 }
 
 bool JSCell::isGetterSetter() const
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
index 6d963b3..e0a9b4d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSCell.h
@@ -23,6 +23,7 @@
 #ifndef JSCell_h
 #define JSCell_h
 
+#include <wtf/Noncopyable.h>
 #include "Structure.h"
 #include "JSValue.h"
 #include "JSImmediate.h"
@@ -30,16 +31,16 @@
 
 namespace JSC {
 
-    class JSCell : public JSValue {
-        friend class JIT;
+    class JSCell : Noncopyable {
         friend class GetterSetter;
         friend class Heap;
+        friend class JIT;
         friend class JSNumberCell;
         friend class JSObject;
         friend class JSPropertyNameIterator;
         friend class JSString;
         friend class JSValue;
-        friend class Interpreter;
+        friend class VPtrSet;
 
     private:
         explicit JSCell(Structure*);
@@ -56,8 +57,6 @@ namespace JSC {
         Structure* structure() const;
 
         // Extracting the value.
-        bool getNumber(double&) const;
-        double getNumber() const; // NaN if not a number
         bool getString(UString&) const;
         UString getString() const; // null string if not a string
         JSObject* getObject(); // NULL if not an object
@@ -67,13 +66,14 @@ namespace JSC {
         virtual ConstructType getConstructData(ConstructData&);
 
         // Extracting integer values.
+        // FIXME: remove these methods, can check isNumberCell in JSValue && then call asNumberCell::*.
         virtual bool getUInt32(uint32_t&) const;
         virtual bool getTruncatedInt32(int32_t&) const;
         virtual bool getTruncatedUInt32(uint32_t&) const;
 
         // Basic conversions.
-        virtual JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType) const = 0;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValuePtr&) = 0;
+        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const = 0;
+        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue&) = 0;
         virtual bool toBoolean(ExecState*) const = 0;
         virtual double toNumber(ExecState*) const = 0;
         virtual UString toString(ExecState*) const = 0;
@@ -88,15 +88,15 @@ namespace JSC {
 
         // Object operations, with the toObject operation included.
         virtual const ClassInfo* classInfo() const;
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
-        virtual void put(ExecState*, unsigned propertyName, JSValuePtr);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
+        virtual void put(ExecState*, unsigned propertyName, JSValue);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
 
         virtual JSObject* toThisObject(ExecState*) const;
         virtual UString toThisString(ExecState*) const;
         virtual JSString* toThisJSString(ExecState*);
-        virtual JSValuePtr getJSNumber();
+        virtual JSValue getJSNumber();
         void* vptr() { return *reinterpret_cast<void**>(this); }
 
     private:
@@ -108,12 +108,11 @@ namespace JSC {
         Structure* m_structure;
     };
 
-    JSCell* asCell(JSValuePtr);
+    JSCell* asCell(JSValue);
 
-    inline JSCell* asCell(JSValuePtr value)
+    inline JSCell* asCell(JSValue value)
     {
-        ASSERT(!JSImmediate::isImmediate(value));
-        return value->asCell();
+        return value.asCell();
     }
 
     inline JSCell::JSCell(Structure* structure)
@@ -157,8 +156,8 @@ namespace JSC {
 
     ALWAYS_INLINE JSCell* JSValue::asCell() const
     {
-        ASSERT(!JSImmediate::isImmediate(asValue()));
-        return const_cast<JSCell*>(reinterpret_cast<const JSCell*>(this));
+        ASSERT(isCell());
+        return m_ptr;
     }
 
     inline void* JSCell::operator new(size_t size, JSGlobalData* globalData)
@@ -172,11 +171,6 @@ namespace JSC {
 
     // --- JSValue inlines ----------------------------
 
-    inline bool JSValue::isNumber() const
-    {
-        return JSImmediate::isNumber(asValue()) || (!JSImmediate::isImmediate(asValue()) && asCell()->isNumber());
-    }
-
     inline bool JSValue::isString() const
     {
         return !JSImmediate::isImmediate(asValue()) && asCell()->isString();
@@ -192,11 +186,6 @@ namespace JSC {
         return !JSImmediate::isImmediate(asValue()) && asCell()->isObject();
     }
 
-    inline double JSValue::getNumber() const
-    {
-        return JSImmediate::isImmediate(asValue()) ? JSImmediate::toDouble(asValue()) : asCell()->getNumber();
-    }
-
     inline bool JSValue::getString(UString& s) const
     {
         return !JSImmediate::isImmediate(asValue()) && asCell()->getString(s);
@@ -247,12 +236,12 @@ namespace JSC {
         return JSImmediate::isImmediate(asValue()) || asCell()->marked();
     }
 
-    inline JSValuePtr JSValue::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
+    inline JSValue JSValue::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
     {
         return JSImmediate::isImmediate(asValue()) ? asValue() : asCell()->toPrimitive(exec, preferredType);
     }
 
-    inline bool JSValue::getPrimitiveNumber(ExecState* exec, double& number, JSValuePtr& value)
+    inline bool JSValue::getPrimitiveNumber(ExecState* exec, double& number, JSValue& value)
     {
         if (JSImmediate::isImmediate(asValue())) {
             number = JSImmediate::toDouble(asValue());
@@ -301,9 +290,9 @@ namespace JSC {
         return JSImmediate::isImmediate(asValue()) ? JSImmediate::toString(asValue()) : asCell()->toThisString(exec);
     }
 
-    inline JSValuePtr JSValue::getJSNumber()
+    inline JSValue JSValue::getJSNumber()
     {
-        return JSImmediate::isNumber(asValue()) ? asValue() : JSImmediate::isImmediate(asValue()) ? noValue() : asCell()->getJSNumber();
+        return JSImmediate::isNumber(asValue()) ? asValue() : JSImmediate::isImmediate(asValue()) ? JSValue() : asCell()->getJSNumber();
     }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp
index a22cb34..b79074f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.cpp
@@ -45,11 +45,29 @@ ASSERT_CLASS_FITS_IN_CELL(JSFunction);
 
 const ClassInfo JSFunction::info = { "Function", &InternalFunction::info, 0, 0 };
 
+JSFunction::JSFunction(ExecState* exec, PassRefPtr<Structure> structure, int length, const Identifier& name, NativeFunction func)
+    : Base(&exec->globalData(), structure, name)
+#if ENABLE(JIT)
+    , m_body(FunctionBodyNode::createNativeThunk(&exec->globalData()))
+#else
+    , m_body(0)
+#endif
+{
+#if ENABLE(JIT)
+    setNativeFunction(func);
+    putDirect(exec->propertyNames().length, jsNumber(exec, length), DontDelete | ReadOnly | DontEnum);
+#else
+    UNUSED_PARAM(length);
+    UNUSED_PARAM(func);
+    ASSERT_NOT_REACHED();
+#endif
+}
+
 JSFunction::JSFunction(ExecState* exec, const Identifier& name, FunctionBodyNode* body, ScopeChainNode* scopeChainNode)
     : Base(&exec->globalData(), exec->lexicalGlobalObject()->functionStructure(), name)
     , m_body(body)
-    , m_scopeChain(scopeChainNode)
 {
+    setScopeChain(scopeChainNode);
 }
 
 JSFunction::~JSFunction()
@@ -61,52 +79,66 @@ JSFunction::~JSFunction()
     if (m_body && m_body->isGenerated())
         m_body->generatedBytecode().unlinkCallers();
 #endif
+    if (!isHostFunction())
+        scopeChain().~ScopeChain();
 }
 
 void JSFunction::mark()
 {
     Base::mark();
     m_body->mark();
-    m_scopeChain.mark();
+    if (!isHostFunction())
+        scopeChain().mark();
 }
 
 CallType JSFunction::getCallData(CallData& callData)
 {
+    if (isHostFunction()) {
+        callData.native.function = nativeFunction();
+        return CallTypeHost;
+    }
     callData.js.functionBody = m_body.get();
-    callData.js.scopeChain = m_scopeChain.node();
+    callData.js.scopeChain = scopeChain().node();
     return CallTypeJS;
 }
 
-JSValuePtr JSFunction::call(ExecState* exec, JSValuePtr thisValue, const ArgList& args)
+JSValue JSFunction::call(ExecState* exec, JSValue thisValue, const ArgList& args)
 {
-    return exec->interpreter()->execute(m_body.get(), exec, this, thisValue->toThisObject(exec), args, m_scopeChain.node(), exec->exceptionSlot());
+    ASSERT(!isHostFunction());
+    return exec->interpreter()->execute(m_body.get(), exec, this, thisValue.toThisObject(exec), args, scopeChain().node(), exec->exceptionSlot());
 }
 
-JSValuePtr JSFunction::argumentsGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSFunction::argumentsGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSFunction* thisObj = asFunction(slot.slotBase());
+    ASSERT(!thisObj->isHostFunction());
     return exec->interpreter()->retrieveArguments(exec, thisObj);
 }
 
-JSValuePtr JSFunction::callerGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSFunction::callerGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSFunction* thisObj = asFunction(slot.slotBase());
+    ASSERT(!thisObj->isHostFunction());
     return exec->interpreter()->retrieveCaller(exec, thisObj);
 }
 
-JSValuePtr JSFunction::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSFunction::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSFunction* thisObj = asFunction(slot.slotBase());
+    ASSERT(!thisObj->isHostFunction());
     return jsNumber(exec, thisObj->m_body->parameterCount());
 }
 
 bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
+    if (isHostFunction())
+        return Base::getOwnPropertySlot(exec, propertyName, slot);
+
     if (propertyName == exec->propertyNames().prototype) {
-        JSValuePtr* location = getDirectLocation(propertyName);
+        JSValue* location = getDirectLocation(propertyName);
 
         if (!location) {
-            JSObject* prototype = new (exec) JSObject(m_scopeChain.globalObject()->emptyObjectStructure());
+            JSObject* prototype = new (exec) JSObject(scopeChain().globalObject()->emptyObjectStructure());
             prototype->putDirect(exec->propertyNames().constructor, this, DontEnum);
             putDirect(exec->propertyNames().prototype, prototype, DontDelete);
             location = getDirectLocation(propertyName);
@@ -133,8 +165,12 @@ bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return Base::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-void JSFunction::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSFunction::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
+    if (isHostFunction()) {
+        Base::put(exec, propertyName, value, slot);
+        return;
+    }
     if (propertyName == exec->propertyNames().arguments || propertyName == exec->propertyNames().length)
         return;
     Base::put(exec, propertyName, value, slot);
@@ -142,6 +178,8 @@ void JSFunction::put(ExecState* exec, const Identifier& propertyName, JSValuePtr
 
 bool JSFunction::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
+    if (isHostFunction())
+        return Base::deleteProperty(exec, propertyName);
     if (propertyName == exec->propertyNames().arguments || propertyName == exec->propertyNames().length)
         return false;
     return Base::deleteProperty(exec, propertyName);
@@ -150,23 +188,26 @@ bool JSFunction::deleteProperty(ExecState* exec, const Identifier& propertyName)
 // ECMA 13.2.2 [[Construct]]
 ConstructType JSFunction::getConstructData(ConstructData& constructData)
 {
+    if (isHostFunction())
+        return ConstructTypeNone;
     constructData.js.functionBody = m_body.get();
-    constructData.js.scopeChain = m_scopeChain.node();
+    constructData.js.scopeChain = scopeChain().node();
     return ConstructTypeJS;
 }
 
 JSObject* JSFunction::construct(ExecState* exec, const ArgList& args)
 {
+    ASSERT(!isHostFunction());
     Structure* structure;
-    JSValuePtr prototype = get(exec, exec->propertyNames().prototype);
-    if (prototype->isObject())
+    JSValue prototype = get(exec, exec->propertyNames().prototype);
+    if (prototype.isObject())
         structure = asObject(prototype)->inheritorID();
     else
         structure = exec->lexicalGlobalObject()->emptyObjectStructure();
     JSObject* thisObj = new (exec) JSObject(structure);
 
-    JSValuePtr result = exec->interpreter()->execute(m_body.get(), exec, this, thisObj, args, m_scopeChain.node(), exec->exceptionSlot());
-    if (exec->hadException() || !result->isObject())
+    JSValue result = exec->interpreter()->execute(m_body.get(), exec, this, thisObj, args, scopeChain().node(), exec->exceptionSlot());
+    if (exec->hadException() || !result.isObject())
         return thisObj;
     return asObject(result);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
index 6a43737..b27e515 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSFunction.h
@@ -39,29 +39,30 @@ namespace JSC {
 
     class JSFunction : public InternalFunction {
         friend class JIT;
-        friend class Interpreter;
+        friend class VPtrSet;
 
         typedef InternalFunction Base;
 
         JSFunction(PassRefPtr<Structure> structure)
             : InternalFunction(structure)
-            , m_scopeChain(NoScopeChain())
         {
+            clearScopeChain();
         }
 
     public:
+        JSFunction(ExecState*, PassRefPtr<Structure>, int length, const Identifier&, NativeFunction);
         JSFunction(ExecState*, const Identifier&, FunctionBodyNode*, ScopeChainNode*);
         ~JSFunction();
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
 
         JSObject* construct(ExecState*, const ArgList&);
-        JSValuePtr call(ExecState*, JSValuePtr thisValue, const ArgList&);
+        JSValue call(ExecState*, JSValue thisValue, const ArgList&);
 
-        void setScope(const ScopeChain& scopeChain) { m_scopeChain = scopeChain; }
-        ScopeChain& scope() { return m_scopeChain; }
+        void setScope(const ScopeChain& scopeChain) { setScopeChain(scopeChain); }
+        ScopeChain& scope() { return scopeChain(); }
 
         void setBody(FunctionBodyNode* body) { m_body = body; }
         void setBody(PassRefPtr<FunctionBodyNode> body) { m_body = body; }
@@ -69,30 +70,64 @@ namespace JSC {
 
         virtual void mark();
 
-        static const ClassInfo info;
+        static JS_EXPORTDATA const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype) 
+        static PassRefPtr<Structure> createStructure(JSValue prototype) 
         { 
             return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance)); 
         }
 
-    private:
-        virtual const ClassInfo* classInfo() const { return &info; }
+#if ENABLE(JIT)
+        bool isHostFunction() const { return m_body && m_body->isHostFunction(); }
+#else
+        bool isHostFunction() const { return false; }
+#endif
+        NativeFunction nativeFunction()
+        {
+            return *reinterpret_cast<NativeFunction*>(m_data);
+        }
 
         virtual ConstructType getConstructData(ConstructData&);
         virtual CallType getCallData(CallData&);
 
-        static JSValuePtr argumentsGetter(ExecState*, const Identifier&, const PropertySlot&);
-        static JSValuePtr callerGetter(ExecState*, const Identifier&, const PropertySlot&);
-        static JSValuePtr lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+    private:
+        virtual const ClassInfo* classInfo() const { return &info; }
+
+        static JSValue argumentsGetter(ExecState*, const Identifier&, const PropertySlot&);
+        static JSValue callerGetter(ExecState*, const Identifier&, const PropertySlot&);
+        static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
 
         RefPtr<FunctionBodyNode> m_body;
-        ScopeChain m_scopeChain;
+        ScopeChain& scopeChain()
+        {
+            ASSERT(!isHostFunction());
+            return *reinterpret_cast<ScopeChain*>(m_data);
+        }
+        void clearScopeChain()
+        {
+            ASSERT(!isHostFunction());
+            new (m_data) ScopeChain(NoScopeChain());
+        }
+        void setScopeChain(ScopeChainNode* sc)
+        {
+            ASSERT(!isHostFunction());
+            new (m_data) ScopeChain(sc);
+        }
+        void setScopeChain(const ScopeChain& sc)
+        {
+            ASSERT(!isHostFunction());
+            *reinterpret_cast<ScopeChain*>(m_data) = sc;
+        }
+        void setNativeFunction(NativeFunction func)
+        {
+            *reinterpret_cast<NativeFunction*>(m_data) = func;
+        }
+        unsigned char m_data[sizeof(void*)];
     };
 
-    JSFunction* asFunction(JSValuePtr);
+    JSFunction* asFunction(JSValue);
 
-    inline JSFunction* asFunction(JSValuePtr value)
+    inline JSFunction* asFunction(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&JSFunction::info));
         return static_cast<JSFunction*>(asObject(value));
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp
index 62df65e..d5c4ee4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.cpp
@@ -30,15 +30,19 @@
 #include "JSGlobalData.h"
 
 #include "ArgList.h"
+#include "Collector.h"
 #include "CommonIdentifiers.h"
+#include "FunctionConstructor.h"
+#include "Interpreter.h"
 #include "JSActivation.h"
+#include "JSArray.h"
+#include "JSByteArray.h"
 #include "JSClassRef.h"
+#include "JSFunction.h"
 #include "JSLock.h"
 #include "JSNotAnObject.h"
 #include "JSStaticScopeObject.h"
-#include "Interpreter.h"
 #include "Parser.h"
-#include "Collector.h"
 #include "Lexer.h"
 #include "Lookup.h"
 #include "Nodes.h"
@@ -56,6 +60,7 @@ using namespace WTF;
 namespace JSC {
 
 extern const HashTable arrayTable;
+extern const HashTable jsonTable;
 extern const HashTable dateTable;
 extern const HashTable mathTable;
 extern const HashTable numberTable;
@@ -63,40 +68,82 @@ extern const HashTable regExpTable;
 extern const HashTable regExpConstructorTable;
 extern const HashTable stringTable;
 
-JSGlobalData::JSGlobalData(bool isShared)
-    : interpreter(new Interpreter)
-    , exception(noValue())
-    , arrayTable(new HashTable(JSC::arrayTable))
-    , dateTable(new HashTable(JSC::dateTable))
-    , mathTable(new HashTable(JSC::mathTable))
-    , numberTable(new HashTable(JSC::numberTable))
-    , regExpTable(new HashTable(JSC::regExpTable))
-    , regExpConstructorTable(new HashTable(JSC::regExpConstructorTable))
-    , stringTable(new HashTable(JSC::stringTable))
+struct VPtrSet {
+    VPtrSet();
+
+    void* jsArrayVPtr;
+    void* jsByteArrayVPtr;
+    void* jsStringVPtr;
+    void* jsFunctionVPtr;
+};
+
+VPtrSet::VPtrSet()
+{
+    // Bizarrely, calling fastMalloc here is faster than allocating space on the stack.
+    void* storage = fastMalloc(sizeof(CollectorBlock));
+
+    JSCell* jsArray = new (storage) JSArray(JSArray::createStructure(jsNull()));
+    jsArrayVPtr = jsArray->vptr();
+    jsArray->~JSCell();
+
+    JSCell* jsByteArray = new (storage) JSByteArray(JSByteArray::VPtrStealingHack);
+    jsByteArrayVPtr = jsByteArray->vptr();
+    jsByteArray->~JSCell();
+
+    JSCell* jsString = new (storage) JSString(JSString::VPtrStealingHack);
+    jsStringVPtr = jsString->vptr();
+    jsString->~JSCell();
+
+    JSCell* jsFunction = new (storage) JSFunction(JSFunction::createStructure(jsNull()));
+    jsFunctionVPtr = jsFunction->vptr();
+    jsFunction->~JSCell();
+
+    fastFree(storage);
+}
+
+JSGlobalData::JSGlobalData(bool isShared, const VPtrSet& vptrSet)
+    : isSharedInstance(isShared)
+    , clientData(0)
+    , arrayTable(fastNew<HashTable>(JSC::arrayTable))
+    , dateTable(fastNew<HashTable>(JSC::dateTable))
+    , jsonTable(fastNew<HashTable>(JSC::jsonTable))
+    , mathTable(fastNew<HashTable>(JSC::mathTable))
+    , numberTable(fastNew<HashTable>(JSC::numberTable))
+    , regExpTable(fastNew<HashTable>(JSC::regExpTable))
+    , regExpConstructorTable(fastNew<HashTable>(JSC::regExpConstructorTable))
+    , stringTable(fastNew<HashTable>(JSC::stringTable))
     , activationStructure(JSActivation::createStructure(jsNull()))
     , interruptedExecutionErrorStructure(JSObject::createStructure(jsNull()))
     , staticScopeStructure(JSStaticScopeObject::createStructure(jsNull()))
     , stringStructure(JSString::createStructure(jsNull()))
     , notAnObjectErrorStubStructure(JSNotAnObjectErrorStub::createStructure(jsNull()))
     , notAnObjectStructure(JSNotAnObject::createStructure(jsNull()))
+#if !USE(ALTERNATE_JSIMMEDIATE)
     , numberStructure(JSNumberCell::createStructure(jsNull()))
+#endif
+    , jsArrayVPtr(vptrSet.jsArrayVPtr)
+    , jsByteArrayVPtr(vptrSet.jsByteArrayVPtr)
+    , jsStringVPtr(vptrSet.jsStringVPtr)
+    , jsFunctionVPtr(vptrSet.jsFunctionVPtr)
     , identifierTable(createIdentifierTable())
     , propertyNames(new CommonIdentifiers(this))
-    , emptyList(new ArgList)
-    , newParserObjects(0)
-    , parserObjectExtraRefCounts(0)
+    , emptyList(new MarkedArgumentBuffer)
     , lexer(new Lexer(this))
     , parser(new Parser)
+    , interpreter(new Interpreter)
+#if ENABLE(JIT)
+    , jitStubs(this)
+#endif
+    , heap(this)
+    , initializingLazyNumericCompareFunction(false)
     , head(0)
     , dynamicGlobalObject(0)
-    , isSharedInstance(isShared)
-    , clientData(0)
-    , heap(this)
+    , scopeNodeBeingReparsed(0)
+    , firstStringifierToMark(0)
 {
 #if PLATFORM(MAC)
     startProfilerServerIfNeeded();
 #endif
-    interpreter->initialize(this);
 }
 
 JSGlobalData::~JSGlobalData()
@@ -111,18 +158,21 @@ JSGlobalData::~JSGlobalData()
 
     arrayTable->deleteTable();
     dateTable->deleteTable();
+    jsonTable->deleteTable();
     mathTable->deleteTable();
     numberTable->deleteTable();
     regExpTable->deleteTable();
     regExpConstructorTable->deleteTable();
     stringTable->deleteTable();
-    delete arrayTable;
-    delete dateTable;
-    delete mathTable;
-    delete numberTable;
-    delete regExpTable;
-    delete regExpConstructorTable;
-    delete stringTable;
+
+    fastDelete(const_cast<HashTable*>(arrayTable));
+    fastDelete(const_cast<HashTable*>(dateTable));
+    fastDelete(const_cast<HashTable*>(jsonTable));
+    fastDelete(const_cast<HashTable*>(mathTable));
+    fastDelete(const_cast<HashTable*>(numberTable));
+    fastDelete(const_cast<HashTable*>(regExpTable));
+    fastDelete(const_cast<HashTable*>(regExpConstructorTable));
+    fastDelete(const_cast<HashTable*>(stringTable));
 
     delete parser;
     delete lexer;
@@ -134,27 +184,20 @@ JSGlobalData::~JSGlobalData()
     delete propertyNames;
     deleteIdentifierTable(identifierTable);
 
-    delete newParserObjects;
-    delete parserObjectExtraRefCounts;
-    
     delete clientData;
 }
 
-PassRefPtr<JSGlobalData> JSGlobalData::create()
+PassRefPtr<JSGlobalData> JSGlobalData::create(bool isShared)
 {
-    return adoptRef(new JSGlobalData);
+    return adoptRef(new JSGlobalData(isShared, VPtrSet()));
 }
 
 PassRefPtr<JSGlobalData> JSGlobalData::createLeaked()
 {
-#ifndef NDEBUG
     Structure::startIgnoringLeaks();
     RefPtr<JSGlobalData> data = create();
     Structure::stopIgnoringLeaks();
     return data.release();
-#else
-    return create();
-#endif
 }
 
 bool JSGlobalData::sharedInstanceExists()
@@ -166,7 +209,7 @@ JSGlobalData& JSGlobalData::sharedInstance()
 {
     JSGlobalData*& instance = sharedInstanceInternal();
     if (!instance) {
-        instance = new JSGlobalData(true);
+        instance = create(true).releaseRef();
 #if ENABLE(JSC_MULTIPLE_THREADS)
         instance->makeUsableFromMultipleThreads();
 #endif
@@ -181,8 +224,22 @@ JSGlobalData*& JSGlobalData::sharedInstanceInternal()
     return sharedInstance;
 }
 
-JSGlobalData::ClientData::~ClientData()
+// FIXME: We can also detect forms like v1 < v2 ? -1 : 0, reverse comparison, etc.
+const Vector<Instruction>& JSGlobalData::numericCompareFunction(ExecState* exec)
 {
+    if (!lazyNumericCompareFunction.size() && !initializingLazyNumericCompareFunction) {
+        initializingLazyNumericCompareFunction = true;
+        RefPtr<ProgramNode> programNode = parser->parse<ProgramNode>(exec, 0, makeSource(UString("(function (v1, v2) { return v1 - v2; })")), 0, 0);
+        RefPtr<FunctionBodyNode> functionBody = extractFunctionBody(programNode.get());
+        lazyNumericCompareFunction = functionBody->bytecode(exec->scopeChain()).instructions();
+        initializingLazyNumericCompareFunction = false;
+    }
+
+    return lazyNumericCompareFunction;
 }
 
+JSGlobalData::ClientData::~ClientData()
+{
 }
+
+} // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h
index 67f4178..96a3c2c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalData.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,39 +29,48 @@
 #ifndef JSGlobalData_h
 #define JSGlobalData_h
 
-#include <wtf/Forward.h>
-#include <wtf/HashMap.h>
-#include <wtf/RefCounted.h>
 #include "Collector.h"
 #include "ExecutableAllocator.h"
-#include "SmallStrings.h"
+#include "JITStubs.h"
 #include "JSValue.h"
+#include "SmallStrings.h"
+#include "TimeoutChecker.h"
+#include <wtf/Forward.h>
+#include <wtf/HashMap.h>
+#include <wtf/RefCounted.h>
 
 struct OpaqueJSClass;
 struct OpaqueJSClassContextData;
 
 namespace JSC {
 
-    class ArgList;
     class CommonIdentifiers;
-    class Heap;
+    class FunctionBodyNode;
     class IdentifierTable;
+    class Instruction;
+    class Interpreter;
     class JSGlobalObject;
     class JSObject;
     class Lexer;
-    class Interpreter;
     class Parser;
-    class ParserRefCounted;
+    class ScopeNode;
+    class Stringifier;
     class Structure;
     class UString;
+
     struct HashTable;
+    struct VPtrSet;
 
     class JSGlobalData : public RefCounted<JSGlobalData> {
     public:
+        struct ClientData {
+            virtual ~ClientData() = 0;
+        };
+
         static bool sharedInstanceExists();
         static JSGlobalData& sharedInstance();
 
-        static PassRefPtr<JSGlobalData> create();
+        static PassRefPtr<JSGlobalData> create(bool isShared = false);
         static PassRefPtr<JSGlobalData> createLeaked();
         ~JSGlobalData();
 
@@ -70,15 +79,12 @@ namespace JSC {
         void makeUsableFromMultipleThreads() { heap.makeUsableFromMultipleThreads(); }
 #endif
 
-        Interpreter* interpreter;
-
-        JSValuePtr exception;
-#if ENABLE(JIT)
-        void* exceptionLocation;
-#endif
+        bool isSharedInstance;
+        ClientData* clientData;
 
         const HashTable* arrayTable;
         const HashTable* dateTable;
+        const HashTable* jsonTable;
         const HashTable* mathTable;
         const HashTable* numberTable;
         const HashTable* regExpTable;
@@ -91,48 +97,58 @@ namespace JSC {
         RefPtr<Structure> stringStructure;
         RefPtr<Structure> notAnObjectErrorStubStructure;
         RefPtr<Structure> notAnObjectStructure;
+#if !USE(ALTERNATE_JSIMMEDIATE)
         RefPtr<Structure> numberStructure;
+#endif
+
+        void* jsArrayVPtr;
+        void* jsByteArrayVPtr;
+        void* jsStringVPtr;
+        void* jsFunctionVPtr;
 
         IdentifierTable* identifierTable;
         CommonIdentifiers* propertyNames;
-        const ArgList* emptyList; // Lists are supposed to be allocated on the stack to have their elements properly marked, which is not the case here - but this list has nothing to mark.
-
+        const MarkedArgumentBuffer* emptyList; // Lists are supposed to be allocated on the stack to have their elements properly marked, which is not the case here - but this list has nothing to mark.
         SmallStrings smallStrings;
-        
-        HashMap<OpaqueJSClass*, OpaqueJSClassContextData*> opaqueJSClassData;
 
-        HashSet<ParserRefCounted*>* newParserObjects;
-        HashCountedSet<ParserRefCounted*>* parserObjectExtraRefCounts;
+#if ENABLE(ASSEMBLER)
+        ExecutableAllocator executableAllocator;
+#endif
 
         Lexer* lexer;
         Parser* parser;
+        Interpreter* interpreter;
+#if ENABLE(JIT)
+        JITThunks jitStubs;
+#endif
+        TimeoutChecker timeoutChecker;
+        Heap heap;
 
-        JSGlobalObject* head;
-        JSGlobalObject* dynamicGlobalObject;
+        JSValue exception;
+#if ENABLE(JIT)
+        ReturnAddressPtr exceptionLocation;
+#endif
 
-        bool isSharedInstance;
+        const Vector<Instruction>& numericCompareFunction(ExecState*);
+        Vector<Instruction> lazyNumericCompareFunction;
+        bool initializingLazyNumericCompareFunction;
 
-        struct ClientData {
-            virtual ~ClientData() = 0;
-        };
+        HashMap<OpaqueJSClass*, OpaqueJSClassContextData*> opaqueJSClassData;
 
-        ClientData* clientData;
+        JSGlobalObject* head;
+        JSGlobalObject* dynamicGlobalObject;
 
         HashSet<JSObject*> arrayVisitedElements;
 
-        Heap heap;
-#if ENABLE(ASSEMBLER)
-        PassRefPtr<ExecutablePool> poolForSize(size_t n) { return m_executableAllocator.poolForSize(n); }
-#endif
-    private:
-        JSGlobalData(bool isShared = false);
-#if ENABLE(ASSEMBLER)
-        ExecutableAllocator m_executableAllocator;
-#endif
+        ScopeNode* scopeNodeBeingReparsed;
+        Stringifier* firstStringifierToMark;
 
+    private:
+        JSGlobalData(bool isShared, const VPtrSet&);
         static JSGlobalData*& sharedInstanceInternal();
+        void createNativeThunk();
     };
 
-}
+} // namespace JSC
 
-#endif
+#endif // JSGlobalData_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
index dfe291c..c56b84b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -47,8 +47,10 @@
 #include "FunctionConstructor.h"
 #include "FunctionPrototype.h"
 #include "GlobalEvalFunction.h"
+#include "JSFunction.h"
 #include "JSGlobalObjectFunctions.h"
 #include "JSLock.h"
+#include "JSONObject.h"
 #include "Interpreter.h"
 #include "MathObject.h"
 #include "NativeErrorConstructor.h"
@@ -78,10 +80,10 @@ static const int initialTickCountThreshold = 255;
 // Preferred number of milliseconds between each timeout check
 static const int preferredScriptCheckTimeInterval = 1000;
 
-static inline void markIfNeeded(JSValuePtr v)
+static inline void markIfNeeded(JSValue v)
 {
-    if (v && !v->marked())
-        v->mark();
+    if (v && !v.marked())
+        v.mark();
 }
 
 static inline void markIfNeeded(const RefPtr<Structure>& s)
@@ -147,7 +149,7 @@ void JSGlobalObject::init(JSObject* thisValue)
     reset(prototype());
 }
 
-void JSGlobalObject::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSGlobalObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
@@ -156,20 +158,20 @@ void JSGlobalObject::put(ExecState* exec, const Identifier& propertyName, JSValu
     JSVariableObject::put(exec, propertyName, value, slot);
 }
 
-void JSGlobalObject::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValuePtr value, unsigned attributes)
+void JSGlobalObject::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValue value, unsigned attributes)
 {
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
     if (symbolTablePutWithAttributes(propertyName, value, attributes))
         return;
 
-    JSValuePtr valueBefore = getDirect(propertyName);
+    JSValue valueBefore = getDirect(propertyName);
     PutPropertySlot slot;
     JSVariableObject::put(exec, propertyName, value, slot);
     if (!valueBefore) {
-        JSValuePtr valueAfter = getDirect(propertyName);
+        JSValue valueAfter = getDirect(propertyName);
         if (valueAfter)
-            putDirect(propertyName, valueAfter, attributes);
+            JSObject::putWithAttributes(exec, propertyName, valueAfter, attributes);
     }
 }
 
@@ -190,12 +192,12 @@ void JSGlobalObject::defineSetter(ExecState* exec, const Identifier& propertyNam
 static inline JSObject* lastInPrototypeChain(JSObject* object)
 {
     JSObject* o = object;
-    while (o->prototype()->isObject())
+    while (o->prototype().isObject())
         o = asObject(o->prototype());
     return o;
 }
 
-void JSGlobalObject::reset(JSValuePtr prototype)
+void JSGlobalObject::reset(JSValue prototype)
 {
     ExecState* exec = JSGlobalObject::globalExec();
 
@@ -203,7 +205,11 @@ void JSGlobalObject::reset(JSValuePtr prototype)
 
     d()->functionPrototype = new (exec) FunctionPrototype(exec, FunctionPrototype::createStructure(jsNull())); // The real prototype will be set once ObjectPrototype is created.
     d()->prototypeFunctionStructure = PrototypeFunction::createStructure(d()->functionPrototype);
-    d()->functionPrototype->addFunctionProperties(exec, d()->prototypeFunctionStructure.get());
+    NativeFunctionWrapper* callFunction = 0;
+    NativeFunctionWrapper* applyFunction = 0;
+    d()->functionPrototype->addFunctionProperties(exec, d()->prototypeFunctionStructure.get(), &callFunction, &applyFunction);
+    d()->callFunction = callFunction;
+    d()->applyFunction = applyFunction;
     d()->objectPrototype = new (exec) ObjectPrototype(exec, ObjectPrototype::createStructure(jsNull()), d()->prototypeFunctionStructure.get());
     d()->functionPrototype->structure()->setPrototypeWithoutTransition(d()->objectPrototype);
 
@@ -234,6 +240,8 @@ void JSGlobalObject::reset(JSValuePtr prototype)
     d()->regExpPrototype = new (exec) RegExpPrototype(exec, RegExpPrototype::createStructure(d()->objectPrototype), d()->prototypeFunctionStructure.get());
     d()->regExpStructure = RegExpObject::createStructure(d()->regExpPrototype);
 
+    d()->methodCallDummy = constructEmptyObject(exec);
+
     ErrorPrototype* errorPrototype = new (exec) ErrorPrototype(exec, ErrorPrototype::createStructure(d()->objectPrototype), d()->prototypeFunctionStructure.get());
     d()->errorStructure = ErrorInstance::createStructure(errorPrototype);
 
@@ -248,13 +256,13 @@ void JSGlobalObject::reset(JSValuePtr prototype)
 
     // Constructors
 
-    JSValuePtr objectConstructor = new (exec) ObjectConstructor(exec, ObjectConstructor::createStructure(d()->functionPrototype), d()->objectPrototype);
-    JSValuePtr functionConstructor = new (exec) FunctionConstructor(exec, FunctionConstructor::createStructure(d()->functionPrototype), d()->functionPrototype);
-    JSValuePtr arrayConstructor = new (exec) ArrayConstructor(exec, ArrayConstructor::createStructure(d()->functionPrototype), d()->arrayPrototype);
-    JSValuePtr stringConstructor = new (exec) StringConstructor(exec, StringConstructor::createStructure(d()->functionPrototype), d()->prototypeFunctionStructure.get(), d()->stringPrototype);
-    JSValuePtr booleanConstructor = new (exec) BooleanConstructor(exec, BooleanConstructor::createStructure(d()->functionPrototype), d()->booleanPrototype);
-    JSValuePtr numberConstructor = new (exec) NumberConstructor(exec, NumberConstructor::createStructure(d()->functionPrototype), d()->numberPrototype);
-    JSValuePtr dateConstructor = new (exec) DateConstructor(exec, DateConstructor::createStructure(d()->functionPrototype), d()->prototypeFunctionStructure.get(), d()->datePrototype);
+    JSCell* objectConstructor = new (exec) ObjectConstructor(exec, ObjectConstructor::createStructure(d()->functionPrototype), d()->objectPrototype);
+    JSCell* functionConstructor = new (exec) FunctionConstructor(exec, FunctionConstructor::createStructure(d()->functionPrototype), d()->functionPrototype);
+    JSCell* arrayConstructor = new (exec) ArrayConstructor(exec, ArrayConstructor::createStructure(d()->functionPrototype), d()->arrayPrototype);
+    JSCell* stringConstructor = new (exec) StringConstructor(exec, StringConstructor::createStructure(d()->functionPrototype), d()->prototypeFunctionStructure.get(), d()->stringPrototype);
+    JSCell* booleanConstructor = new (exec) BooleanConstructor(exec, BooleanConstructor::createStructure(d()->functionPrototype), d()->booleanPrototype);
+    JSCell* numberConstructor = new (exec) NumberConstructor(exec, NumberConstructor::createStructure(d()->functionPrototype), d()->numberPrototype);
+    JSCell* dateConstructor = new (exec) DateConstructor(exec, DateConstructor::createStructure(d()->functionPrototype), d()->prototypeFunctionStructure.get(), d()->datePrototype);
 
     d()->regExpConstructor = new (exec) RegExpConstructor(exec, RegExpConstructor::createStructure(d()->functionPrototype), d()->regExpPrototype);
 
@@ -269,15 +277,15 @@ void JSGlobalObject::reset(JSValuePtr prototype)
     d()->typeErrorConstructor = new (exec) NativeErrorConstructor(exec, nativeErrorStructure, typeErrorPrototype);
     d()->URIErrorConstructor = new (exec) NativeErrorConstructor(exec, nativeErrorStructure, URIErrorPrototype);
 
-    d()->objectPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, objectConstructor, DontEnum);
-    d()->functionPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, functionConstructor, DontEnum);
-    d()->arrayPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, arrayConstructor, DontEnum);
-    d()->booleanPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, booleanConstructor, DontEnum);
-    d()->stringPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, stringConstructor, DontEnum);
-    d()->numberPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, numberConstructor, DontEnum);
-    d()->datePrototype->putDirectWithoutTransition(exec->propertyNames().constructor, dateConstructor, DontEnum);
-    d()->regExpPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, d()->regExpConstructor, DontEnum);
-    errorPrototype->putDirectWithoutTransition(exec->propertyNames().constructor, d()->errorConstructor, DontEnum);
+    d()->objectPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, objectConstructor, DontEnum);
+    d()->functionPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, functionConstructor, DontEnum);
+    d()->arrayPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, arrayConstructor, DontEnum);
+    d()->booleanPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, booleanConstructor, DontEnum);
+    d()->stringPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, stringConstructor, DontEnum);
+    d()->numberPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, numberConstructor, DontEnum);
+    d()->datePrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, dateConstructor, DontEnum);
+    d()->regExpPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, d()->regExpConstructor, DontEnum);
+    errorPrototype->putDirectFunctionWithoutTransition(exec->propertyNames().constructor, d()->errorConstructor, DontEnum);
 
     evalErrorPrototype->putDirect(exec->propertyNames().constructor, d()->evalErrorConstructor, DontEnum);
     rangeErrorPrototype->putDirect(exec->propertyNames().constructor, d()->rangeErrorConstructor, DontEnum);
@@ -290,28 +298,29 @@ void JSGlobalObject::reset(JSValuePtr prototype)
 
     // FIXME: These properties could be handled by a static hash table.
 
-    putDirectWithoutTransition(Identifier(exec, "Object"), objectConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "Function"), functionConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "Array"), arrayConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "Boolean"), booleanConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "String"), stringConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "Number"), numberConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "Date"), dateConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "RegExp"), d()->regExpConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "Error"), d()->errorConstructor, DontEnum);
-    putDirectWithoutTransition(Identifier(exec, "EvalError"), d()->evalErrorConstructor);
-    putDirectWithoutTransition(Identifier(exec, "RangeError"), d()->rangeErrorConstructor);
-    putDirectWithoutTransition(Identifier(exec, "ReferenceError"), d()->referenceErrorConstructor);
-    putDirectWithoutTransition(Identifier(exec, "SyntaxError"), d()->syntaxErrorConstructor);
-    putDirectWithoutTransition(Identifier(exec, "TypeError"), d()->typeErrorConstructor);
-    putDirectWithoutTransition(Identifier(exec, "URIError"), d()->URIErrorConstructor);
+    putDirectFunctionWithoutTransition(Identifier(exec, "Object"), objectConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "Function"), functionConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "Array"), arrayConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "Boolean"), booleanConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "String"), stringConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "Number"), numberConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "Date"), dateConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "RegExp"), d()->regExpConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "Error"), d()->errorConstructor, DontEnum);
+    putDirectFunctionWithoutTransition(Identifier(exec, "EvalError"), d()->evalErrorConstructor);
+    putDirectFunctionWithoutTransition(Identifier(exec, "RangeError"), d()->rangeErrorConstructor);
+    putDirectFunctionWithoutTransition(Identifier(exec, "ReferenceError"), d()->referenceErrorConstructor);
+    putDirectFunctionWithoutTransition(Identifier(exec, "SyntaxError"), d()->syntaxErrorConstructor);
+    putDirectFunctionWithoutTransition(Identifier(exec, "TypeError"), d()->typeErrorConstructor);
+    putDirectFunctionWithoutTransition(Identifier(exec, "URIError"), d()->URIErrorConstructor);
 
     // Set global values.
     GlobalPropertyInfo staticGlobals[] = {
         GlobalPropertyInfo(Identifier(exec, "Math"), new (exec) MathObject(exec, MathObject::createStructure(d()->objectPrototype)), DontEnum | DontDelete),
         GlobalPropertyInfo(Identifier(exec, "NaN"), jsNaN(exec), DontEnum | DontDelete),
         GlobalPropertyInfo(Identifier(exec, "Infinity"), jsNumber(exec, Inf), DontEnum | DontDelete),
-        GlobalPropertyInfo(Identifier(exec, "undefined"), jsUndefined(), DontEnum | DontDelete)
+        GlobalPropertyInfo(Identifier(exec, "undefined"), jsUndefined(), DontEnum | DontDelete),
+        GlobalPropertyInfo(Identifier(exec, "JSON"), new (exec) JSONObject(JSONObject::createStructure(d()->objectPrototype)), DontEnum | DontDelete)
     };
 
     addStaticGlobals(staticGlobals, sizeof(staticGlobals) / sizeof(GlobalPropertyInfo));
@@ -320,43 +329,32 @@ void JSGlobalObject::reset(JSValuePtr prototype)
 
     d()->evalFunction = new (exec) GlobalEvalFunction(exec, GlobalEvalFunction::createStructure(d()->functionPrototype), 1, exec->propertyNames().eval, globalFuncEval, this);
     putDirectFunctionWithoutTransition(exec, d()->evalFunction, DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 2, Identifier(exec, "parseInt"), globalFuncParseInt), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "parseFloat"), globalFuncParseFloat), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "isNaN"), globalFuncIsNaN), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "isFinite"), globalFuncIsFinite), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "escape"), globalFuncEscape), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "unescape"), globalFuncUnescape), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "decodeURI"), globalFuncDecodeURI), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "decodeURIComponent"), globalFuncDecodeURIComponent), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "encodeURI"), globalFuncEncodeURI), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "encodeURIComponent"), globalFuncEncodeURIComponent), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 2, Identifier(exec, "parseInt"), globalFuncParseInt), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "parseFloat"), globalFuncParseFloat), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "isNaN"), globalFuncIsNaN), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "isFinite"), globalFuncIsFinite), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "escape"), globalFuncEscape), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "unescape"), globalFuncUnescape), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "decodeURI"), globalFuncDecodeURI), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "decodeURIComponent"), globalFuncDecodeURIComponent), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "encodeURI"), globalFuncEncodeURI), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "encodeURIComponent"), globalFuncEncodeURIComponent), DontEnum);
 #ifndef NDEBUG
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "jscprint"), globalFuncJSCPrint), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, d()->prototypeFunctionStructure.get(), 1, Identifier(exec, "jscprint"), globalFuncJSCPrint), DontEnum);
 #endif
 
     resetPrototype(prototype);
 }
 
 // Set prototype, and also insert the object prototype at the end of the chain.
-void JSGlobalObject::resetPrototype(JSValuePtr prototype)
+void JSGlobalObject::resetPrototype(JSValue prototype)
 {
     setPrototype(prototype);
-    lastInPrototypeChain(this)->setPrototype(d()->objectPrototype);
-}
-
-void JSGlobalObject::setTimeoutTime(unsigned timeoutTime)
-{
-    globalData()->interpreter->setTimeoutTime(timeoutTime);
-}
 
-void JSGlobalObject::startTimeoutCheck()
-{
-    globalData()->interpreter->startTimeoutCheck();
-}
-
-void JSGlobalObject::stopTimeoutCheck()
-{
-    globalData()->interpreter->stopTimeoutCheck();
+    JSObject* oldLastInPrototypeChain = lastInPrototypeChain(this);
+    JSObject* objectPrototype = d()->objectPrototype;
+    if (oldLastInPrototypeChain != objectPrototype)
+        oldLastInPrototypeChain->setPrototype(objectPrototype);
 }
 
 void JSGlobalObject::mark()
@@ -381,6 +379,8 @@ void JSGlobalObject::mark()
     markIfNeeded(d()->URIErrorConstructor);
 
     markIfNeeded(d()->evalFunction);
+    markIfNeeded(d()->callFunction);
+    markIfNeeded(d()->applyFunction);
 
     markIfNeeded(d()->objectPrototype);
     markIfNeeded(d()->functionPrototype);
@@ -391,6 +391,8 @@ void JSGlobalObject::mark()
     markIfNeeded(d()->datePrototype);
     markIfNeeded(d()->regExpPrototype);
 
+    markIfNeeded(d()->methodCallDummy);
+
     markIfNeeded(d()->errorStructure);
 
     // No need to mark the other structures, because their prototypes are all
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
index 4a10f64..983274b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObject.h
@@ -24,6 +24,7 @@
 
 #include "JSGlobalData.h"
 #include "JSVariableObject.h"
+#include "NativeFunctionWrapper.h"
 #include "NumberPrototype.h"
 #include "StringPrototype.h"
 #include <wtf/HashSet.h>
@@ -40,6 +41,7 @@ namespace JSC {
     class GlobalEvalFunction;
     class NativeErrorConstructor;
     class ProgramCodeBlock;
+    class PrototypeFunction;
     class RegExpConstructor;
     class RegExpPrototype;
     class RegisterFile;
@@ -67,6 +69,8 @@ namespace JSC {
                 , typeErrorConstructor(0)
                 , URIErrorConstructor(0)
                 , evalFunction(0)
+                , callFunction(0)
+                , applyFunction(0)
                 , objectPrototype(0)
                 , functionPrototype(0)
                 , arrayPrototype(0)
@@ -75,6 +79,7 @@ namespace JSC {
                 , numberPrototype(0)
                 , datePrototype(0)
                 , regExpPrototype(0)
+                , methodCallDummy(0)
             {
             }
             
@@ -104,6 +109,8 @@ namespace JSC {
             NativeErrorConstructor* URIErrorConstructor;
 
             GlobalEvalFunction* evalFunction;
+            NativeFunctionWrapper* callFunction;
+            NativeFunctionWrapper* applyFunction;
 
             ObjectPrototype* objectPrototype;
             FunctionPrototype* functionPrototype;
@@ -114,6 +121,8 @@ namespace JSC {
             DatePrototype* datePrototype;
             RegExpPrototype* regExpPrototype;
 
+            JSObject* methodCallDummy;
+
             RefPtr<Structure> argumentsStructure;
             RefPtr<Structure> arrayStructure;
             RefPtr<Structure> booleanObjectStructure;
@@ -160,9 +169,9 @@ namespace JSC {
         virtual void mark();
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
-        virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&, bool& slotIsWriteable);
-        virtual void put(ExecState*, const Identifier&, JSValuePtr, PutPropertySlot&);
-        virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValuePtr value, unsigned attributes);
+        virtual bool hasOwnPropertyForWrite(ExecState*, const Identifier&);
+        virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
+        virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValue value, unsigned attributes);
 
         virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunc);
         virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunc);
@@ -195,6 +204,8 @@ namespace JSC {
         DatePrototype* datePrototype() const { return d()->datePrototype; }
         RegExpPrototype* regExpPrototype() const { return d()->regExpPrototype; }
 
+        JSObject* methodCallDummy() const { return d()->methodCallDummy; }
+
         Structure* argumentsStructure() const { return d()->argumentsStructure.get(); }
         Structure* arrayStructure() const { return d()->arrayStructure.get(); }
         Structure* booleanObjectStructure() const { return d()->booleanObjectStructure.get(); }
@@ -214,10 +225,6 @@ namespace JSC {
         void setProfileGroup(unsigned value) { d()->profileGroup = value; }
         unsigned profileGroup() const { return d()->profileGroup; }
 
-        void setTimeoutTime(unsigned timeoutTime);
-        void startTimeoutCheck();
-        void stopTimeoutCheck();
-
         Debugger* debugger() const { return d()->debugger; }
         void setDebugger(Debugger* debugger) { d()->debugger = debugger; }
         
@@ -244,19 +251,19 @@ namespace JSC {
         void copyGlobalsFrom(RegisterFile&);
         void copyGlobalsTo(RegisterFile&);
         
-        void resetPrototype(JSValuePtr prototype);
+        void resetPrototype(JSValue prototype);
 
         JSGlobalData* globalData() { return d()->globalData.get(); }
         JSGlobalObjectData* d() const { return static_cast<JSGlobalObjectData*>(JSVariableObject::d); }
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType));
         }
 
     protected:
         struct GlobalPropertyInfo {
-            GlobalPropertyInfo(const Identifier& i, JSValuePtr v, unsigned a)
+            GlobalPropertyInfo(const Identifier& i, JSValue v, unsigned a)
                 : identifier(i)
                 , value(v)
                 , attributes(a)
@@ -264,7 +271,7 @@ namespace JSC {
             }
 
             const Identifier identifier;
-            JSValuePtr value;
+            JSValue value;
             unsigned attributes;
         };
         void addStaticGlobals(GlobalPropertyInfo*, int count);
@@ -272,16 +279,16 @@ namespace JSC {
     private:
         // FIXME: Fold reset into init.
         void init(JSObject* thisValue);
-        void reset(JSValuePtr prototype);
+        void reset(JSValue prototype);
 
         void setRegisters(Register* registers, Register* registerArray, size_t count);
 
         void* operator new(size_t); // can only be allocated with JSGlobalData
     };
 
-    JSGlobalObject* asGlobalObject(JSValuePtr);
+    JSGlobalObject* asGlobalObject(JSValue);
 
-    inline JSGlobalObject* asGlobalObject(JSValuePtr value)
+    inline JSGlobalObject* asGlobalObject(JSValue value)
     {
         ASSERT(asObject(value)->isGlobalObject());
         return static_cast<JSGlobalObject*>(asObject(value));
@@ -318,10 +325,12 @@ namespace JSC {
         return symbolTableGet(propertyName, slot);
     }
 
-    inline bool JSGlobalObject::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot, bool& slotIsWriteable)
+    inline bool JSGlobalObject::hasOwnPropertyForWrite(ExecState* exec, const Identifier& propertyName)
     {
-        if (JSVariableObject::getOwnPropertySlotForWrite(exec, propertyName, slot, slotIsWriteable))
+        PropertySlot slot;
+        if (JSVariableObject::getOwnPropertySlot(exec, propertyName, slot))
             return true;
+        bool slotIsWriteable;
         return symbolTableGet(propertyName, slot, slotIsWriteable);
     }
 
@@ -333,7 +342,7 @@ namespace JSC {
         return asGlobalObject(n->object);
     }
 
-    inline JSValuePtr Structure::prototypeForLookup(ExecState* exec)
+    inline JSValue Structure::prototypeForLookup(ExecState* exec) const
     {
         if (typeInfo().type() == ObjectType)
             return m_prototype;
@@ -345,6 +354,32 @@ namespace JSC {
         return exec->lexicalGlobalObject()->numberPrototype();
     }
 
+    inline StructureChain* Structure::prototypeChain(ExecState* exec) const
+    {
+        // We cache our prototype chain so our clients can share it.
+        if (!isValid(exec, m_cachedPrototypeChain.get())) {
+            JSValue prototype = prototypeForLookup(exec);
+            m_cachedPrototypeChain = StructureChain::create(prototype.isNull() ? 0 : asObject(prototype)->structure());
+        }
+        return m_cachedPrototypeChain.get();
+    }
+
+    inline bool Structure::isValid(ExecState* exec, StructureChain* cachedPrototypeChain) const
+    {
+        if (!cachedPrototypeChain)
+            return false;
+
+        JSValue prototype = prototypeForLookup(exec);
+        RefPtr<Structure>* cachedStructure = cachedPrototypeChain->head();
+        while(*cachedStructure && !prototype.isNull()) {
+            if (asObject(prototype)->structure() != *cachedStructure)
+                return false;
+            ++cachedStructure;
+            prototype = asObject(prototype)->prototype();
+        }
+        return prototype.isNull() && !*cachedStructure;
+    }
+
     inline JSGlobalObject* ExecState::dynamicGlobalObject()
     {
         if (this == lexicalGlobalObject()->globalExec())
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
index ecdddcf..85f92f2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
@@ -28,6 +28,7 @@
 #include "CallFrame.h"
 #include "GlobalEvalFunction.h"
 #include "JSGlobalObject.h"
+#include "LiteralParser.h"
 #include "JSString.h"
 #include "Interpreter.h"
 #include "Parser.h"
@@ -47,9 +48,9 @@ using namespace Unicode;
 
 namespace JSC {
 
-static JSValuePtr encode(ExecState* exec, const ArgList& args, const char* doNotEscape)
+static JSValue encode(ExecState* exec, const ArgList& args, const char* doNotEscape)
 {
-    UString str = args.at(exec, 0)->toString(exec);
+    UString str = args.at(0).toString(exec);
     CString cstr = str.UTF8String(true);
     if (!cstr.c_str())
         return throwError(exec, URIError, "String contained an illegal UTF-16 sequence.");
@@ -69,10 +70,10 @@ static JSValuePtr encode(ExecState* exec, const ArgList& args, const char* doNot
     return jsString(exec, result);
 }
 
-static JSValuePtr decode(ExecState* exec, const ArgList& args, const char* doNotUnescape, bool strict)
+static JSValue decode(ExecState* exec, const ArgList& args, const char* doNotUnescape, bool strict)
 {
     UString result = "";
-    UString str = args.at(exec, 0)->toString(exec);
+    UString str = args.at(0).toString(exec);
     int k = 0;
     int len = str.size();
     const UChar* d = str.data();
@@ -268,18 +269,22 @@ static double parseFloat(const UString& s)
     return s.toDouble(true /*tolerant*/, false /* NaN for empty string */);
 }
 
-JSValuePtr globalFuncEval(ExecState* exec, JSObject* function, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncEval(ExecState* exec, JSObject* function, JSValue thisValue, const ArgList& args)
 {
-    JSObject* thisObject = thisValue->toThisObject(exec);
+    JSObject* thisObject = thisValue.toThisObject(exec);
     JSObject* unwrappedObject = thisObject->unwrappedObject();
     if (!unwrappedObject->isGlobalObject() || static_cast<JSGlobalObject*>(unwrappedObject)->evalFunction() != function)
         return throwError(exec, EvalError, "The \"this\" value passed to eval must be the global object from which eval originated");
 
-    JSValuePtr x = args.at(exec, 0);
-    if (!x->isString())
+    JSValue x = args.at(0);
+    if (!x.isString())
         return x;
 
-    UString s = x->toString(exec);
+    UString s = x.toString(exec);
+
+    LiteralParser preparser(exec, s, LiteralParser::NonStrictJSON);
+    if (JSValue parsedObject = preparser.tryLiteralParse())
+        return parsedObject;
 
     int errLine;
     UString errMsg;
@@ -293,42 +298,42 @@ JSValuePtr globalFuncEval(ExecState* exec, JSObject* function, JSValuePtr thisVa
     return exec->interpreter()->execute(evalNode.get(), exec, thisObject, static_cast<JSGlobalObject*>(unwrappedObject)->globalScopeChain().node(), exec->exceptionSlot());
 }
 
-JSValuePtr globalFuncParseInt(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncParseInt(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    JSValuePtr value = args.at(exec, 0);
-    int32_t radix = args.at(exec, 1)->toInt32(exec);
+    JSValue value = args.at(0);
+    int32_t radix = args.at(1).toInt32(exec);
 
-    if (value->isNumber() && (radix == 0 || radix == 10)) {
-        if (JSImmediate::isImmediate(value))
+    if (value.isNumber() && (radix == 0 || radix == 10)) {
+        if (value.isInt32Fast())
             return value;
-        double d = value->uncheckedGetNumber();
+        double d = value.uncheckedGetNumber();
         if (isfinite(d))
-            return jsNumber(exec, floor(d));
+            return jsNumber(exec, (d > 0) ? floor(d) : ceil(d));
         if (isnan(d) || isinf(d))
             return jsNaN(&exec->globalData());
-        return JSImmediate::zeroImmediate();
+        return jsNumber(exec, 0);
     }
 
-    return jsNumber(exec, parseInt(value->toString(exec), radix));
+    return jsNumber(exec, parseInt(value.toString(exec), radix));
 }
 
-JSValuePtr globalFuncParseFloat(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncParseFloat(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, parseFloat(args.at(exec, 0)->toString(exec)));
+    return jsNumber(exec, parseFloat(args.at(0).toString(exec)));
 }
 
-JSValuePtr globalFuncIsNaN(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncIsNaN(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsBoolean(isnan(args.at(exec, 0)->toNumber(exec)));
+    return jsBoolean(isnan(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr globalFuncIsFinite(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncIsFinite(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    double n = args.at(exec, 0)->toNumber(exec);
+    double n = args.at(0).toNumber(exec);
     return jsBoolean(!isnan(n) && !isinf(n));
 }
 
-JSValuePtr globalFuncDecodeURI(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncDecodeURI(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     static const char do_not_unescape_when_decoding_URI[] =
         "#$&+,/:;=?@";
@@ -336,12 +341,12 @@ JSValuePtr globalFuncDecodeURI(ExecState* exec, JSObject*, JSValuePtr, const Arg
     return decode(exec, args, do_not_unescape_when_decoding_URI, true);
 }
 
-JSValuePtr globalFuncDecodeURIComponent(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncDecodeURIComponent(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     return decode(exec, args, "", true);
 }
 
-JSValuePtr globalFuncEncodeURI(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncEncodeURI(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     static const char do_not_escape_when_encoding_URI[] =
         "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
@@ -352,7 +357,7 @@ JSValuePtr globalFuncEncodeURI(ExecState* exec, JSObject*, JSValuePtr, const Arg
     return encode(exec, args, do_not_escape_when_encoding_URI);
 }
 
-JSValuePtr globalFuncEncodeURIComponent(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncEncodeURIComponent(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     static const char do_not_escape_when_encoding_URI_component[] =
         "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
@@ -363,7 +368,7 @@ JSValuePtr globalFuncEncodeURIComponent(ExecState* exec, JSObject*, JSValuePtr,
     return encode(exec, args, do_not_escape_when_encoding_URI_component);
 }
 
-JSValuePtr globalFuncEscape(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncEscape(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     static const char do_not_escape[] =
         "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
@@ -373,7 +378,7 @@ JSValuePtr globalFuncEscape(ExecState* exec, JSObject*, JSValuePtr, const ArgLis
 
     UString result = "";
     UString s;
-    UString str = args.at(exec, 0)->toString(exec);
+    UString str = args.at(0).toString(exec);
     const UChar* c = str.data();
     for (int k = 0; k < str.size(); k++, c++) {
         int u = c[0];
@@ -394,22 +399,22 @@ JSValuePtr globalFuncEscape(ExecState* exec, JSObject*, JSValuePtr, const ArgLis
     return jsString(exec, result);
 }
 
-JSValuePtr globalFuncUnescape(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncUnescape(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     UString result = "";
-    UString str = args.at(exec, 0)->toString(exec);
+    UString str = args.at(0).toString(exec);
     int k = 0;
     int len = str.size();
     while (k < len) {
         const UChar* c = str.data() + k;
         UChar u;
         if (c[0] == '%' && k <= len - 6 && c[1] == 'u') {
-            if (Lexer::isHexDigit(c[2]) && Lexer::isHexDigit(c[3]) && Lexer::isHexDigit(c[4]) && Lexer::isHexDigit(c[5])) {
+            if (isASCIIHexDigit(c[2]) && isASCIIHexDigit(c[3]) && isASCIIHexDigit(c[4]) && isASCIIHexDigit(c[5])) {
                 u = Lexer::convertUnicode(c[2], c[3], c[4], c[5]);
                 c = &u;
                 k += 5;
             }
-        } else if (c[0] == '%' && k <= len - 3 && Lexer::isHexDigit(c[1]) && Lexer::isHexDigit(c[2])) {
+        } else if (c[0] == '%' && k <= len - 3 && isASCIIHexDigit(c[1]) && isASCIIHexDigit(c[2])) {
             u = UChar(Lexer::convertHex(c[1], c[2]));
             c = &u;
             k += 2;
@@ -422,10 +427,10 @@ JSValuePtr globalFuncUnescape(ExecState* exec, JSObject*, JSValuePtr, const ArgL
 }
 
 #ifndef NDEBUG
-JSValuePtr globalFuncJSCPrint(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL globalFuncJSCPrint(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     CStringBuffer string;
-    args.at(exec, 0)->toString(exec).getCString(string);
+    args.at(0).toString(exec).getCString(string);
     puts(string.data());
     return jsUndefined();
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.h
index ea1f106..b1046f2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSGlobalObjectFunctions.h
@@ -24,34 +24,36 @@
 #ifndef JSGlobalObjectFunctions_h
 #define JSGlobalObjectFunctions_h
 
-#include "JSImmediate.h" // temporary until JSValue* becomes a class we can forward-declare
+#include <wtf/unicode/Unicode.h>
 
 namespace JSC {
 
     class ArgList;
     class ExecState;
     class JSObject;
+    class JSValue;
 
     // FIXME: These functions should really be in JSGlobalObject.cpp, but putting them there
     // is a 0.5% reduction.
 
-    JSValuePtr globalFuncEval(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncParseInt(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncParseFloat(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncIsNaN(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncIsFinite(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncDecodeURI(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncDecodeURIComponent(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncEncodeURI(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncEncodeURIComponent(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncEscape(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-    JSValuePtr globalFuncUnescape(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncEval(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncParseInt(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncParseFloat(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncIsNaN(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncIsFinite(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncDecodeURI(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncDecodeURIComponent(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncEncodeURI(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncEncodeURIComponent(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncEscape(ExecState*, JSObject*, JSValue, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncUnescape(ExecState*, JSObject*, JSValue, const ArgList&);
 #ifndef NDEBUG
-    JSValuePtr globalFuncJSCPrint(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+    JSValue JSC_HOST_CALL globalFuncJSCPrint(ExecState*, JSObject*, JSValue, const ArgList&);
 #endif
 
     static const double mantissaOverflowLowerBound = 9007199254740992.0;
     double parseIntOverflow(const char*, int length, int radix);
+    bool isStrWhiteSpace(UChar);
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.cpp
index 09b3750..201e56c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.cpp
@@ -32,35 +32,31 @@
 
 namespace JSC {
 
-JSObject* JSImmediate::toThisObject(JSValuePtr v, ExecState* exec)
+JSObject* JSImmediate::toThisObject(JSValue v, ExecState* exec)
 {
     ASSERT(isImmediate(v));
     if (isNumber(v))
-        return constructNumberFromImmediateNumber(exec, v);
+        return constructNumber(exec, v);
     if (isBoolean(v))
         return constructBooleanFromImmediateBoolean(exec, v);
-    if (v->isNull())
-        return exec->globalThisValue();
-    
-    JSNotAnObjectErrorStub* exception = createNotAnObjectErrorStub(exec, v->isNull());
-    exec->setException(exception);
-    return new (exec) JSNotAnObject(exec, exception);
+    ASSERT(v.isUndefinedOrNull());
+    return exec->globalThisValue();
 }
 
-JSObject* JSImmediate::toObject(JSValuePtr v, ExecState* exec)
+JSObject* JSImmediate::toObject(JSValue v, ExecState* exec)
 {
     ASSERT(isImmediate(v));
     if (isNumber(v))
-        return constructNumberFromImmediateNumber(exec, v);
+        return constructNumber(exec, v);
     if (isBoolean(v))
         return constructBooleanFromImmediateBoolean(exec, v);
     
-    JSNotAnObjectErrorStub* exception = createNotAnObjectErrorStub(exec, v->isNull());
+    JSNotAnObjectErrorStub* exception = createNotAnObjectErrorStub(exec, v.isNull());
     exec->setException(exception);
     return new (exec) JSNotAnObject(exec, exception);
 }
 
-JSObject* JSImmediate::prototype(JSValuePtr v, ExecState* exec)
+JSObject* JSImmediate::prototype(JSValue v, ExecState* exec)
 {
     ASSERT(isImmediate(v));
     if (isNumber(v))
@@ -68,23 +64,34 @@ JSObject* JSImmediate::prototype(JSValuePtr v, ExecState* exec)
     if (isBoolean(v))
         return exec->lexicalGlobalObject()->booleanPrototype();
 
-    JSNotAnObjectErrorStub* exception = createNotAnObjectErrorStub(exec, v->isNull());
+    JSNotAnObjectErrorStub* exception = createNotAnObjectErrorStub(exec, v.isNull());
     exec->setException(exception);
     return new (exec) JSNotAnObject(exec, exception);
 }
 
-UString JSImmediate::toString(JSValuePtr v)
+UString JSImmediate::toString(JSValue v)
 {
     ASSERT(isImmediate(v));
-    if (isNumber(v))
+    if (isIntegerNumber(v))
         return UString::from(getTruncatedInt32(v));
+#if USE(ALTERNATE_JSIMMEDIATE)
+    if (isNumber(v)) {
+        ASSERT(isDoubleNumber(v));
+        double value = doubleValue(v);
+        if (value == 0.0) // +0.0 or -0.0
+            return "0";
+        return UString::from(value);
+    }
+#else
+        ASSERT(!isNumber(v));
+#endif
     if (jsBoolean(false) == v)
         return "false";
     if (jsBoolean(true) == v)
         return "true";
-    if (v->isNull())
+    if (v.isNull())
         return "null";
-    ASSERT(v->isUndefined());
+    ASSERT(v.isUndefined());
     return "undefined";
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h
index 37bca2a..706396e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSImmediate.h
@@ -25,6 +25,7 @@
 #include <wtf/Assertions.h>
 #include <wtf/AlwaysInline.h>
 #include <wtf/MathExtras.h>
+#include <wtf/StdLibExtras.h>
 #include "JSValue.h"
 #include <limits>
 #include <limits.h>
@@ -36,10 +37,23 @@ namespace JSC {
 
     class ExecState;
     class JSCell;
+    class JSFastMath;
+    class JSGlobalData;
     class JSObject;
-    class JSValue;
     class UString;
 
+#if USE(ALTERNATE_JSIMMEDIATE)
+    inline intptr_t reinterpretDoubleToIntptr(double value)
+    {
+        return WTF::bitwise_cast<intptr_t>(value);
+    }
+
+    inline double reinterpretIntptrToDouble(intptr_t value)
+    {
+        return WTF::bitwise_cast<double>(value);
+    }
+#endif
+
     /*
      * A JSValue* is either a pointer to a cell (a heap-allocated object) or an immediate (a type-tagged 
      * value masquerading as a pointer). The low two bits in a JSValue* are available for type tagging
@@ -84,14 +98,33 @@ namespace JSC {
 
     /*
      * On 64-bit platforms, we support an alternative encoding form for immediates, if
-     * USE(ALTERNATE_JSIMMEDIATE) is defined.
+     * USE(ALTERNATE_JSIMMEDIATE) is defined.  When this format is used, double precision
+     * floating point values may also be encoded as JSImmediates.
+     *
+     * The encoding makes use of unused NaN space in the IEEE754 representation.  Any value
+     * with the top 13 bits set represents a QNaN (with the sign bit set).  QNaN values
+     * can encode a 51-bit payload.  Hardware produced and C-library payloads typically
+     * have a payload of zero.  We assume that non-zero payloads are available to encode
+     * pointer and integer values.  Since any 64-bit bit pattern where the top 15 bits are
+     * all set represents a NaN with a non-zero payload, we can use this space in the NaN
+     * ranges to encode other values (however there are also other ranges of NaN space that
+     * could have been selected).  This range of NaN space is represented by 64-bit numbers
+     * begining with the 16-bit hex patterns 0xFFFE and 0xFFFF - we rely on the fact that no
+     * valid double-precision numbers will begin fall in these ranges.
      *
-     * The top 16-bits denote the type:
+     * The scheme we have implemented encodes double precision values by adding 2^48 to the
+     * 64-bit integer representation of the number.  After this manipulation, no encoded
+     * double-precision value will begin with the pattern 0x0000 or 0xFFFF.
+     *
+     * The top 16-bits denote the type of the encoded JSImmediate:
      *
      * Pointer: 0000:PPPP:PPPP:PPPP
+     *          0001:****:****:****
+     * Double:{         ...
+     *          FFFE:****:****:****
      * Integer: FFFF:0000:IIII:IIII
      *
-     * 32-bit signed integers are marked with the 16-bit tag '0xFFFF'.  The tag '0x0000'
+     * 32-bit signed integers are marked with the 16-bit tag 0xFFFF.  The tag 0x0000
      * denotes a pointer, or another form of tagged immediate.  Boolean, null and undefined
      * values are encoded in the same manner as the default format.
      */
@@ -99,14 +132,41 @@ namespace JSC {
     class JSImmediate {
     private:
         friend class JIT;
-    
+        friend class JSValue;
+        friend class JSFastMath;
+        friend JSValue jsNumber(ExecState* exec, double d);
+        friend JSValue jsNumber(ExecState*, char i);
+        friend JSValue jsNumber(ExecState*, unsigned char i);
+        friend JSValue jsNumber(ExecState*, short i);
+        friend JSValue jsNumber(ExecState*, unsigned short i);
+        friend JSValue jsNumber(ExecState* exec, int i);
+        friend JSValue jsNumber(ExecState* exec, unsigned i);
+        friend JSValue jsNumber(ExecState* exec, long i);
+        friend JSValue jsNumber(ExecState* exec, unsigned long i);
+        friend JSValue jsNumber(ExecState* exec, long long i);
+        friend JSValue jsNumber(ExecState* exec, unsigned long long i);
+        friend JSValue jsNumber(JSGlobalData* globalData, double d);
+        friend JSValue jsNumber(JSGlobalData* globalData, short i);
+        friend JSValue jsNumber(JSGlobalData* globalData, unsigned short i);
+        friend JSValue jsNumber(JSGlobalData* globalData, int i);
+        friend JSValue jsNumber(JSGlobalData* globalData, unsigned i);
+        friend JSValue jsNumber(JSGlobalData* globalData, long i);
+        friend JSValue jsNumber(JSGlobalData* globalData, unsigned long i);
+        friend JSValue jsNumber(JSGlobalData* globalData, long long i);
+        friend JSValue jsNumber(JSGlobalData* globalData, unsigned long long i);
+
 #if USE(ALTERNATE_JSIMMEDIATE)
-        static const intptr_t TagTypeInteger = 0xffff000000000000ll; // bottom bit set indicates integer, this dominates the following bit
+        // If all bits in the mask are set, this indicates an integer number,
+        // if any but not all are set this value is a double precision number.
+        static const intptr_t TagTypeNumber = 0xffff000000000000ll;
+        // This value is 2^48, used to encode doubles such that the encoded value will begin
+        // with a 16-bit pattern within the range 0x0001..0xFFFE.
+        static const intptr_t DoubleEncodeOffset = 0x1000000000000ll;
 #else
-        static const intptr_t TagTypeInteger = 0x1; // bottom bit set indicates integer, this dominates the following bit
+        static const intptr_t TagTypeNumber = 0x1; // bottom bit set indicates integer, this dominates the following bit
 #endif
         static const intptr_t TagBitTypeOther   = 0x2; // second bit set indicates immediate other than an integer
-        static const intptr_t TagMask           = TagTypeInteger | TagBitTypeOther;
+        static const intptr_t TagMask           = TagTypeNumber | TagBitTypeOther;
 
         static const intptr_t ExtendedTagMask         = 0xC; // extended tag holds a further two bits
         static const intptr_t ExtendedTagBitBool      = 0x4;
@@ -128,157 +188,102 @@ namespace JSC {
 
         static const int32_t signBit = 0x80000000;
  
-    public:
-        static ALWAYS_INLINE bool isImmediate(JSValuePtr v)
+        static ALWAYS_INLINE bool isImmediate(JSValue v)
         {
             return rawValue(v) & TagMask;
         }
         
-        static ALWAYS_INLINE bool isNumber(JSValuePtr v)
+        static ALWAYS_INLINE bool isNumber(JSValue v)
+        {
+            return rawValue(v) & TagTypeNumber;
+        }
+
+        static ALWAYS_INLINE bool isIntegerNumber(JSValue v)
+        {
+#if USE(ALTERNATE_JSIMMEDIATE)
+            return (rawValue(v) & TagTypeNumber) == TagTypeNumber;
+#else
+            return isNumber(v);
+#endif
+        }
+
+#if USE(ALTERNATE_JSIMMEDIATE)
+        static ALWAYS_INLINE bool isDoubleNumber(JSValue v)
         {
-            return rawValue(v) & TagTypeInteger;
+            return isNumber(v) && !isIntegerNumber(v);
         }
+#endif
 
-        static ALWAYS_INLINE bool isPositiveNumber(JSValuePtr v)
+        static ALWAYS_INLINE bool isPositiveIntegerNumber(JSValue v)
         {
             // A single mask to check for the sign bit and the number tag all at once.
-            return (rawValue(v) & (signBit | TagTypeInteger)) == TagTypeInteger;
+            return (rawValue(v) & (signBit | TagTypeNumber)) == TagTypeNumber;
         }
         
-        static ALWAYS_INLINE bool isBoolean(JSValuePtr v)
+        static ALWAYS_INLINE bool isBoolean(JSValue v)
         {
             return (rawValue(v) & FullTagTypeMask) == FullTagTypeBool;
         }
         
-        static ALWAYS_INLINE bool isUndefinedOrNull(JSValuePtr v)
+        static ALWAYS_INLINE bool isUndefinedOrNull(JSValue v)
         {
             // Undefined and null share the same value, bar the 'undefined' bit in the extended tag.
             return (rawValue(v) & ~ExtendedTagBitUndefined) == FullTagTypeNull;
         }
 
-        static bool isNegative(JSValuePtr v)
-        {
-            ASSERT(isNumber(v));
-            return rawValue(v) & signBit;
-        }
-
-        static JSValuePtr from(char);
-        static JSValuePtr from(signed char);
-        static JSValuePtr from(unsigned char);
-        static JSValuePtr from(short);
-        static JSValuePtr from(unsigned short);
-        static JSValuePtr from(int);
-        static JSValuePtr from(unsigned);
-        static JSValuePtr from(long);
-        static JSValuePtr from(unsigned long);
-        static JSValuePtr from(long long);
-        static JSValuePtr from(unsigned long long);
-        static JSValuePtr from(double);
-
-        static ALWAYS_INLINE bool isEitherImmediate(JSValuePtr v1, JSValuePtr v2)
+        static JSValue from(char);
+        static JSValue from(signed char);
+        static JSValue from(unsigned char);
+        static JSValue from(short);
+        static JSValue from(unsigned short);
+        static JSValue from(int);
+        static JSValue from(unsigned);
+        static JSValue from(long);
+        static JSValue from(unsigned long);
+        static JSValue from(long long);
+        static JSValue from(unsigned long long);
+        static JSValue from(double);
+
+        static ALWAYS_INLINE bool isEitherImmediate(JSValue v1, JSValue v2)
         {
             return (rawValue(v1) | rawValue(v2)) & TagMask;
         }
 
-        static ALWAYS_INLINE bool isAnyImmediate(JSValuePtr v1, JSValuePtr v2, JSValuePtr v3)
-        {
-            return (rawValue(v1) | rawValue(v2) | rawValue(v3)) & TagMask;
-        }
-
-        static ALWAYS_INLINE bool areBothImmediate(JSValuePtr v1, JSValuePtr v2)
+        static ALWAYS_INLINE bool areBothImmediate(JSValue v1, JSValue v2)
         {
             return isImmediate(v1) & isImmediate(v2);
         }
 
-        static ALWAYS_INLINE bool areBothImmediateNumbers(JSValuePtr v1, JSValuePtr v2)
-        {
-            return rawValue(v1) & rawValue(v2) & TagTypeInteger;
-        }
-
-        static ALWAYS_INLINE JSValuePtr andImmediateNumbers(JSValuePtr v1, JSValuePtr v2)
-        {
-            ASSERT(areBothImmediateNumbers(v1, v2));
-            return makeValue(rawValue(v1) & rawValue(v2));
-        }
-
-        static ALWAYS_INLINE JSValuePtr xorImmediateNumbers(JSValuePtr v1, JSValuePtr v2)
-        {
-            ASSERT(areBothImmediateNumbers(v1, v2));
-            return makeValue((rawValue(v1) ^ rawValue(v2)) | TagTypeInteger);
-        }
-
-        static ALWAYS_INLINE JSValuePtr orImmediateNumbers(JSValuePtr v1, JSValuePtr v2)
-        {
-            ASSERT(areBothImmediateNumbers(v1, v2));
-            return makeValue(rawValue(v1) | rawValue(v2));
-        }
-
-        static ALWAYS_INLINE JSValuePtr rightShiftImmediateNumbers(JSValuePtr val, JSValuePtr shift)
+        static ALWAYS_INLINE bool areBothImmediateIntegerNumbers(JSValue v1, JSValue v2)
         {
-            ASSERT(areBothImmediateNumbers(val, shift));
 #if USE(ALTERNATE_JSIMMEDIATE)
-            return makeValue(static_cast<intptr_t>(static_cast<uint32_t>(static_cast<int32_t>(rawValue(val)) >> ((rawValue(shift) >> IntegerPayloadShift) & 0x1f))) | TagTypeInteger);
+            return (rawValue(v1) & rawValue(v2) & TagTypeNumber) == TagTypeNumber;
 #else
-            return makeValue((rawValue(val) >> ((rawValue(shift) >> IntegerPayloadShift) & 0x1f)) | TagTypeInteger);
+            return rawValue(v1) & rawValue(v2) & TagTypeNumber;
 #endif
         }
 
-        static ALWAYS_INLINE bool canDoFastAdditiveOperations(JSValuePtr v)
-        {
-            // Number is non-negative and an operation involving two of these can't overflow.
-            // Checking for allowed negative numbers takes more time than it's worth on SunSpider.
-            return (rawValue(v) & (TagTypeInteger + (signBit | (signBit >> 1)))) == TagTypeInteger;
-        }
-
-        static ALWAYS_INLINE JSValuePtr addImmediateNumbers(JSValuePtr v1, JSValuePtr v2)
-        {
-            ASSERT(canDoFastAdditiveOperations(v1));
-            ASSERT(canDoFastAdditiveOperations(v2));
-            return makeValue(rawValue(v1) + rawValue(v2) - TagTypeInteger);
-        }
-
-        static ALWAYS_INLINE JSValuePtr subImmediateNumbers(JSValuePtr v1, JSValuePtr v2)
-        {
-            ASSERT(canDoFastAdditiveOperations(v1));
-            ASSERT(canDoFastAdditiveOperations(v2));
-            return makeValue(rawValue(v1) - rawValue(v2) + TagTypeInteger);
-        }
-
-        static ALWAYS_INLINE JSValuePtr incImmediateNumber(JSValuePtr v)
-        {
-            ASSERT(canDoFastAdditiveOperations(v));
-            return makeValue(rawValue(v) + (1 << IntegerPayloadShift));
-        }
-
-        static ALWAYS_INLINE JSValuePtr decImmediateNumber(JSValuePtr v)
-        {
-            ASSERT(canDoFastAdditiveOperations(v));
-            return makeValue(rawValue(v) - (1 << IntegerPayloadShift));
-        }
-
-        static double toDouble(JSValuePtr);
-        static bool toBoolean(JSValuePtr);
-        static JSObject* toObject(JSValuePtr, ExecState*);
-        static JSObject* toThisObject(JSValuePtr, ExecState*);
-        static UString toString(JSValuePtr);
+        static double toDouble(JSValue);
+        static bool toBoolean(JSValue);
+        static JSObject* toObject(JSValue, ExecState*);
+        static JSObject* toThisObject(JSValue, ExecState*);
+        static UString toString(JSValue);
 
-        static bool getUInt32(JSValuePtr, uint32_t&);
-        static bool getTruncatedInt32(JSValuePtr, int32_t&);
-        static bool getTruncatedUInt32(JSValuePtr, uint32_t&);
+        static bool getUInt32(JSValue, uint32_t&);
+        static bool getTruncatedInt32(JSValue, int32_t&);
+        static bool getTruncatedUInt32(JSValue, uint32_t&);
 
-        static int32_t getTruncatedInt32(JSValuePtr);
-        static uint32_t getTruncatedUInt32(JSValuePtr);
+        static int32_t getTruncatedInt32(JSValue);
+        static uint32_t getTruncatedUInt32(JSValue);
 
-        static JSValuePtr trueImmediate();
-        static JSValuePtr falseImmediate();
-        static JSValuePtr undefinedImmediate();
-        static JSValuePtr nullImmediate();
-        static JSValuePtr zeroImmediate();
-        static JSValuePtr oneImmediate();
+        static JSValue trueImmediate();
+        static JSValue falseImmediate();
+        static JSValue undefinedImmediate();
+        static JSValue nullImmediate();
+        static JSValue zeroImmediate();
+        static JSValue oneImmediate();
 
-        static JSValuePtr impossibleValue();
-        
-        static JSObject* prototype(JSValuePtr, ExecState*);
+        static JSObject* prototype(JSValue, ExecState*);
 
     private:
 #if USE(ALTERNATE_JSIMMEDIATE)
@@ -290,51 +295,71 @@ namespace JSC {
 #endif
         static const unsigned maxImmediateUInt = maxImmediateInt;
 
-        static ALWAYS_INLINE JSValuePtr makeValue(intptr_t integer)
+        static ALWAYS_INLINE JSValue makeValue(intptr_t integer)
         {
-            return JSValuePtr::makeImmediate(integer);
+            return JSValue::makeImmediate(integer);
         }
 
+        // With USE(ALTERNATE_JSIMMEDIATE) we want the argument to be zero extended, so the
+        // integer doesn't interfere with the tag bits in the upper word.  In the default encoding,
+        // if intptr_t id larger then int32_t we sign extend the value through the upper word.
 #if USE(ALTERNATE_JSIMMEDIATE)
-        static ALWAYS_INLINE JSValuePtr makeInt(uint32_t value)
+        static ALWAYS_INLINE JSValue makeInt(uint32_t value)
 #else
-        static ALWAYS_INLINE JSValuePtr makeInt(int32_t value)
+        static ALWAYS_INLINE JSValue makeInt(int32_t value)
 #endif
         {
-            return makeValue((static_cast<intptr_t>(value) << IntegerPayloadShift) | TagTypeInteger);
+            return makeValue((static_cast<intptr_t>(value) << IntegerPayloadShift) | TagTypeNumber);
+        }
+        
+#if USE(ALTERNATE_JSIMMEDIATE)
+        static ALWAYS_INLINE JSValue makeDouble(double value)
+        {
+            return makeValue(reinterpretDoubleToIntptr(value) + DoubleEncodeOffset);
         }
+#endif
         
-        static ALWAYS_INLINE JSValuePtr makeBool(bool b)
+        static ALWAYS_INLINE JSValue makeBool(bool b)
         {
             return makeValue((static_cast<intptr_t>(b) << ExtendedPayloadShift) | FullTagTypeBool);
         }
         
-        static ALWAYS_INLINE JSValuePtr makeUndefined()
+        static ALWAYS_INLINE JSValue makeUndefined()
         {
             return makeValue(FullTagTypeUndefined);
         }
         
-        static ALWAYS_INLINE JSValuePtr makeNull()
+        static ALWAYS_INLINE JSValue makeNull()
         {
             return makeValue(FullTagTypeNull);
         }
-        
-        static ALWAYS_INLINE int32_t intValue(JSValuePtr v)
+
+        template<typename T>
+        static JSValue fromNumberOutsideIntegerRange(T);
+
+#if USE(ALTERNATE_JSIMMEDIATE)
+        static ALWAYS_INLINE double doubleValue(JSValue v)
+        {
+            return reinterpretIntptrToDouble(rawValue(v) - DoubleEncodeOffset);
+        }
+#endif
+
+        static ALWAYS_INLINE int32_t intValue(JSValue v)
         {
             return static_cast<int32_t>(rawValue(v) >> IntegerPayloadShift);
         }
         
-        static ALWAYS_INLINE uint32_t uintValue(JSValuePtr v)
+        static ALWAYS_INLINE uint32_t uintValue(JSValue v)
         {
             return static_cast<uint32_t>(rawValue(v) >> IntegerPayloadShift);
         }
         
-        static ALWAYS_INLINE bool boolValue(JSValuePtr v)
+        static ALWAYS_INLINE bool boolValue(JSValue v)
         {
             return rawValue(v) & ExtendedPayloadBitBoolValue;
         }
         
-        static ALWAYS_INLINE intptr_t rawValue(JSValuePtr v)
+        static ALWAYS_INLINE intptr_t rawValue(JSValue v)
         {
             return v.immediateValue();
         }
@@ -342,177 +367,204 @@ namespace JSC {
         static double nonInlineNaN();
     };
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::trueImmediate() { return makeBool(true); }
-    ALWAYS_INLINE JSValuePtr JSImmediate::falseImmediate() { return makeBool(false); }
-    ALWAYS_INLINE JSValuePtr JSImmediate::undefinedImmediate() { return makeUndefined(); }
-    ALWAYS_INLINE JSValuePtr JSImmediate::nullImmediate() { return makeNull(); }
-    ALWAYS_INLINE JSValuePtr JSImmediate::zeroImmediate() { return makeInt(0); }
-    ALWAYS_INLINE JSValuePtr JSImmediate::oneImmediate() { return makeInt(1); }
+    ALWAYS_INLINE JSValue JSImmediate::trueImmediate() { return makeBool(true); }
+    ALWAYS_INLINE JSValue JSImmediate::falseImmediate() { return makeBool(false); }
+    ALWAYS_INLINE JSValue JSImmediate::undefinedImmediate() { return makeUndefined(); }
+    ALWAYS_INLINE JSValue JSImmediate::nullImmediate() { return makeNull(); }
+    ALWAYS_INLINE JSValue JSImmediate::zeroImmediate() { return makeInt(0); }
+    ALWAYS_INLINE JSValue JSImmediate::oneImmediate() { return makeInt(1); }
 
-    // This value is impossible because 0x4 is not a valid pointer but a tag of 0 would indicate non-immediate
-    ALWAYS_INLINE JSValuePtr JSImmediate::impossibleValue() { return makeValue(0x4); }
+#if USE(ALTERNATE_JSIMMEDIATE)
+    inline bool doubleToBoolean(double value)
+    {
+        return value < 0.0 || value > 0.0;
+    }
 
-    ALWAYS_INLINE bool JSImmediate::toBoolean(JSValuePtr v)
+    ALWAYS_INLINE bool JSImmediate::toBoolean(JSValue v)
+    {
+        ASSERT(isImmediate(v));
+        return isNumber(v) ? isIntegerNumber(v) ? v != zeroImmediate()
+            : doubleToBoolean(doubleValue(v)) : v == trueImmediate();
+    }
+#else
+    ALWAYS_INLINE bool JSImmediate::toBoolean(JSValue v)
     {
         ASSERT(isImmediate(v));
-        intptr_t bits = rawValue(v);
-        return (bits & TagTypeInteger)
-            ? bits != TagTypeInteger // !0 ints
-            : bits == (FullTagTypeBool | ExtendedPayloadBitBoolValue); // bool true
+        return isIntegerNumber(v) ? v != zeroImmediate() : v == trueImmediate();
     }
+#endif
 
-    ALWAYS_INLINE uint32_t JSImmediate::getTruncatedUInt32(JSValuePtr v)
+    ALWAYS_INLINE uint32_t JSImmediate::getTruncatedUInt32(JSValue v)
     {
-        ASSERT(isNumber(v));
+        // FIXME: should probably be asserting isPositiveIntegerNumber here.
+        ASSERT(isIntegerNumber(v));
         return intValue(v);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(char i)
+#if USE(ALTERNATE_JSIMMEDIATE)
+    template<typename T>
+    inline JSValue JSImmediate::fromNumberOutsideIntegerRange(T value)
+    {
+        return makeDouble(static_cast<double>(value));
+    }
+#else
+    template<typename T>
+    inline JSValue JSImmediate::fromNumberOutsideIntegerRange(T)
+    {
+        return JSValue();
+    }
+#endif
+
+    ALWAYS_INLINE JSValue JSImmediate::from(char i)
     {
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(signed char i)
+    ALWAYS_INLINE JSValue JSImmediate::from(signed char i)
     {
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(unsigned char i)
+    ALWAYS_INLINE JSValue JSImmediate::from(unsigned char i)
     {
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(short i)
+    ALWAYS_INLINE JSValue JSImmediate::from(short i)
     {
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(unsigned short i)
+    ALWAYS_INLINE JSValue JSImmediate::from(unsigned short i)
     {
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(int i)
+    ALWAYS_INLINE JSValue JSImmediate::from(int i)
     {
+#if !USE(ALTERNATE_JSIMMEDIATE)
         if ((i < minImmediateInt) | (i > maxImmediateInt))
-            return noValue();
+            return fromNumberOutsideIntegerRange(i);
+#endif
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(unsigned i)
+    ALWAYS_INLINE JSValue JSImmediate::from(unsigned i)
     {
         if (i > maxImmediateUInt)
-            return noValue();
+            return fromNumberOutsideIntegerRange(i);
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(long i)
+    ALWAYS_INLINE JSValue JSImmediate::from(long i)
     {
         if ((i < minImmediateInt) | (i > maxImmediateInt))
-            return noValue();
+            return fromNumberOutsideIntegerRange(i);
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(unsigned long i)
+    ALWAYS_INLINE JSValue JSImmediate::from(unsigned long i)
     {
         if (i > maxImmediateUInt)
-            return noValue();
+            return fromNumberOutsideIntegerRange(i);
         return makeInt(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(long long i)
+    ALWAYS_INLINE JSValue JSImmediate::from(long long i)
     {
         if ((i < minImmediateInt) | (i > maxImmediateInt))
-            return noValue();
+            return JSValue();
         return makeInt(static_cast<intptr_t>(i));
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(unsigned long long i)
+    ALWAYS_INLINE JSValue JSImmediate::from(unsigned long long i)
     {
         if (i > maxImmediateUInt)
-            return noValue();
+            return fromNumberOutsideIntegerRange(i);
         return makeInt(static_cast<intptr_t>(i));
     }
 
-    ALWAYS_INLINE JSValuePtr JSImmediate::from(double d)
+    ALWAYS_INLINE JSValue JSImmediate::from(double d)
     {
         const int intVal = static_cast<int>(d);
 
-        if ((intVal < minImmediateInt) | (intVal > maxImmediateInt))
-            return noValue();
-
         // Check for data loss from conversion to int.
         if (intVal != d || (!intVal && signbit(d)))
-            return noValue();
+            return fromNumberOutsideIntegerRange(d);
 
-        return makeInt(intVal);
+        return from(intVal);
     }
 
-    ALWAYS_INLINE int32_t JSImmediate::getTruncatedInt32(JSValuePtr v)
+    ALWAYS_INLINE int32_t JSImmediate::getTruncatedInt32(JSValue v)
     {
-        ASSERT(isNumber(v));
+        ASSERT(isIntegerNumber(v));
         return intValue(v);
     }
 
-    ALWAYS_INLINE double JSImmediate::toDouble(JSValuePtr v)
+    ALWAYS_INLINE double JSImmediate::toDouble(JSValue v)
     {
         ASSERT(isImmediate(v));
-        int i;
-        if (isNumber(v))
-            i = intValue(v);
-        else if (rawValue(v) == FullTagTypeUndefined)
+
+        if (isIntegerNumber(v))
+            return intValue(v);
+
+#if USE(ALTERNATE_JSIMMEDIATE)
+        if (isNumber(v)) {
+            ASSERT(isDoubleNumber(v));
+            return doubleValue(v);
+        }
+#else
+        ASSERT(!isNumber(v));
+#endif
+
+        if (rawValue(v) == FullTagTypeUndefined)
             return nonInlineNaN();
-        else
-            i = rawValue(v) >> ExtendedPayloadShift;
-        return i;
+
+        ASSERT(JSImmediate::isBoolean(v) || (v == JSImmediate::nullImmediate()));
+        return rawValue(v) >> ExtendedPayloadShift;
     }
 
-    ALWAYS_INLINE bool JSImmediate::getUInt32(JSValuePtr v, uint32_t& i)
+    ALWAYS_INLINE bool JSImmediate::getUInt32(JSValue v, uint32_t& i)
     {
         i = uintValue(v);
-        return isPositiveNumber(v);
+        return isPositiveIntegerNumber(v);
     }
 
-    ALWAYS_INLINE bool JSImmediate::getTruncatedInt32(JSValuePtr v, int32_t& i)
+    ALWAYS_INLINE bool JSImmediate::getTruncatedInt32(JSValue v, int32_t& i)
     {
         i = intValue(v);
-        return isNumber(v);
+        return isIntegerNumber(v);
     }
 
-    ALWAYS_INLINE bool JSImmediate::getTruncatedUInt32(JSValuePtr v, uint32_t& i)
+    ALWAYS_INLINE bool JSImmediate::getTruncatedUInt32(JSValue v, uint32_t& i)
     {
         return getUInt32(v, i);
     }
 
-    inline JSValuePtr jsNull()
-    {
-        return JSImmediate::nullImmediate();
-    }
+    // These are identical logic to the JSValue functions above, and faster than jsNumber(number).toInt32().
+    int32_t toInt32(double);
+    uint32_t toUInt32(double);
+    int32_t toInt32SlowCase(double, bool& ok);
+    uint32_t toUInt32SlowCase(double, bool& ok);
 
-    inline JSValuePtr jsBoolean(bool b)
+    inline JSValue::JSValue(JSNullTag)
     {
-        return b ? JSImmediate::trueImmediate() : JSImmediate::falseImmediate();
+        *this = JSImmediate::nullImmediate();
     }
-
-    inline JSValuePtr jsUndefined()
+    
+    inline JSValue::JSValue(JSUndefinedTag)
     {
-        return JSImmediate::undefinedImmediate();
+        *this = JSImmediate::undefinedImmediate();
     }
 
-    // These are identical logic to the JSValue functions above, and faster than jsNumber(number)->toInt32().
-    int32_t toInt32(double);
-    uint32_t toUInt32(double);
-    int32_t toInt32SlowCase(double, bool& ok);
-    uint32_t toUInt32SlowCase(double, bool& ok);
-
-    inline bool JSValue::isUndefined() const
+    inline JSValue::JSValue(JSTrueTag)
     {
-        return asValue() == jsUndefined();
+        *this = JSImmediate::trueImmediate();
     }
 
-    inline bool JSValue::isNull() const
+    inline JSValue::JSValue(JSFalseTag)
     {
-        return asValue() == jsNull();
+        *this = JSImmediate::falseImmediate();
     }
 
     inline bool JSValue::isUndefinedOrNull() const
@@ -545,8 +597,8 @@ namespace JSC {
         int32_t i;
         if (getTruncatedInt32(i))
             return i;
-        bool ok;
-        return toInt32SlowCase(exec, ok);
+        bool ignored;
+        return toInt32SlowCase(toNumber(exec), ignored);
     }
 
     inline uint32_t JSValue::toUInt32(ExecState* exec) const
@@ -554,8 +606,8 @@ namespace JSC {
         uint32_t i;
         if (getTruncatedUInt32(i))
             return i;
-        bool ok;
-        return toUInt32SlowCase(exec, ok);
+        bool ignored;
+        return toUInt32SlowCase(toNumber(exec), ignored);
     }
 
     inline int32_t toInt32(double val)
@@ -583,7 +635,7 @@ namespace JSC {
             ok = true;
             return i;
         }
-        return toInt32SlowCase(exec, ok);
+        return toInt32SlowCase(toNumber(exec), ok);
     }
 
     inline uint32_t JSValue::toUInt32(ExecState* exec, bool& ok) const
@@ -593,9 +645,142 @@ namespace JSC {
             ok = true;
             return i;
         }
-        return toUInt32SlowCase(exec, ok);
+        return toUInt32SlowCase(toNumber(exec), ok);
+    }
+
+    inline bool JSValue::isCell() const
+    {
+        return !JSImmediate::isImmediate(asValue());
+    }
+
+    inline bool JSValue::isInt32Fast() const
+    {
+        return JSImmediate::isIntegerNumber(asValue());
+    }
+
+    inline int32_t JSValue::getInt32Fast() const
+    {
+        ASSERT(isInt32Fast());
+        return JSImmediate::getTruncatedInt32(asValue());
+    }
+
+    inline bool JSValue::isUInt32Fast() const
+    {
+        return JSImmediate::isPositiveIntegerNumber(asValue());
+    }
+
+    inline uint32_t JSValue::getUInt32Fast() const
+    {
+        ASSERT(isUInt32Fast());
+        return JSImmediate::getTruncatedUInt32(asValue());
+    }
+
+    inline JSValue JSValue::makeInt32Fast(int32_t i)
+    {
+        return JSImmediate::from(i);
+    }
+
+    inline bool JSValue::areBothInt32Fast(JSValue v1, JSValue v2)
+    {
+        return JSImmediate::areBothImmediateIntegerNumbers(v1, v2);
     }
 
+    class JSFastMath {
+    public:
+        static ALWAYS_INLINE bool canDoFastBitwiseOperations(JSValue v1, JSValue v2)
+        {
+            return JSImmediate::areBothImmediateIntegerNumbers(v1, v2);
+        }
+
+        static ALWAYS_INLINE JSValue equal(JSValue v1, JSValue v2)
+        {
+            ASSERT(canDoFastBitwiseOperations(v1, v2));
+            return jsBoolean(v1 == v2);
+        }
+
+        static ALWAYS_INLINE JSValue notEqual(JSValue v1, JSValue v2)
+        {
+            ASSERT(canDoFastBitwiseOperations(v1, v2));
+            return jsBoolean(v1 != v2);
+        }
+
+        static ALWAYS_INLINE JSValue andImmediateNumbers(JSValue v1, JSValue v2)
+        {
+            ASSERT(canDoFastBitwiseOperations(v1, v2));
+            return JSImmediate::makeValue(JSImmediate::rawValue(v1) & JSImmediate::rawValue(v2));
+        }
+
+        static ALWAYS_INLINE JSValue xorImmediateNumbers(JSValue v1, JSValue v2)
+        {
+            ASSERT(canDoFastBitwiseOperations(v1, v2));
+            return JSImmediate::makeValue((JSImmediate::rawValue(v1) ^ JSImmediate::rawValue(v2)) | JSImmediate::TagTypeNumber);
+        }
+
+        static ALWAYS_INLINE JSValue orImmediateNumbers(JSValue v1, JSValue v2)
+        {
+            ASSERT(canDoFastBitwiseOperations(v1, v2));
+            return JSImmediate::makeValue(JSImmediate::rawValue(v1) | JSImmediate::rawValue(v2));
+        }
+
+        static ALWAYS_INLINE bool canDoFastRshift(JSValue v1, JSValue v2)
+        {
+            return JSImmediate::areBothImmediateIntegerNumbers(v1, v2);
+        }
+
+        static ALWAYS_INLINE bool canDoFastUrshift(JSValue v1, JSValue v2)
+        {
+            return JSImmediate::areBothImmediateIntegerNumbers(v1, v2) && !(JSImmediate::rawValue(v1) & JSImmediate::signBit);
+        }
+
+        static ALWAYS_INLINE JSValue rightShiftImmediateNumbers(JSValue val, JSValue shift)
+        {
+            ASSERT(canDoFastRshift(val, shift) || canDoFastUrshift(val, shift));
+#if USE(ALTERNATE_JSIMMEDIATE)
+            return JSImmediate::makeValue(static_cast<intptr_t>(static_cast<uint32_t>(static_cast<int32_t>(JSImmediate::rawValue(val)) >> ((JSImmediate::rawValue(shift) >> JSImmediate::IntegerPayloadShift) & 0x1f))) | JSImmediate::TagTypeNumber);
+#else
+            return JSImmediate::makeValue((JSImmediate::rawValue(val) >> ((JSImmediate::rawValue(shift) >> JSImmediate::IntegerPayloadShift) & 0x1f)) | JSImmediate::TagTypeNumber);
+#endif
+        }
+
+        static ALWAYS_INLINE bool canDoFastAdditiveOperations(JSValue v)
+        {
+            // Number is non-negative and an operation involving two of these can't overflow.
+            // Checking for allowed negative numbers takes more time than it's worth on SunSpider.
+            return (JSImmediate::rawValue(v) & (JSImmediate::TagTypeNumber + (JSImmediate::signBit | (JSImmediate::signBit >> 1)))) == JSImmediate::TagTypeNumber;
+        }
+
+        static ALWAYS_INLINE bool canDoFastAdditiveOperations(JSValue v1, JSValue v2)
+        {
+            // Number is non-negative and an operation involving two of these can't overflow.
+            // Checking for allowed negative numbers takes more time than it's worth on SunSpider.
+            return canDoFastAdditiveOperations(v1) && canDoFastAdditiveOperations(v2);
+        }
+
+        static ALWAYS_INLINE JSValue addImmediateNumbers(JSValue v1, JSValue v2)
+        {
+            ASSERT(canDoFastAdditiveOperations(v1, v2));
+            return JSImmediate::makeValue(JSImmediate::rawValue(v1) + JSImmediate::rawValue(v2) - JSImmediate::TagTypeNumber);
+        }
+
+        static ALWAYS_INLINE JSValue subImmediateNumbers(JSValue v1, JSValue v2)
+        {
+            ASSERT(canDoFastAdditiveOperations(v1, v2));
+            return JSImmediate::makeValue(JSImmediate::rawValue(v1) - JSImmediate::rawValue(v2) + JSImmediate::TagTypeNumber);
+        }
+
+        static ALWAYS_INLINE JSValue incImmediateNumber(JSValue v)
+        {
+            ASSERT(canDoFastAdditiveOperations(v));
+            return JSImmediate::makeValue(JSImmediate::rawValue(v) + (1 << JSImmediate::IntegerPayloadShift));
+        }
+
+        static ALWAYS_INLINE JSValue decImmediateNumber(JSValue v)
+        {
+            ASSERT(canDoFastAdditiveOperations(v));
+            return JSImmediate::makeValue(JSImmediate::rawValue(v) - (1 << JSImmediate::IntegerPayloadShift));
+        }
+    };
+
 } // namespace JSC
 
 #endif // JSImmediate_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSLock.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSLock.cpp
index 5662a41..7ece5da 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSLock.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSLock.cpp
@@ -119,11 +119,58 @@ bool JSLock::currentThreadIsHoldingLock()
     return !!pthread_getspecific(JSLockCount);
 }
 
+// This is fairly nasty.  We allow multiple threads to run on the same
+// context, and we do not require any locking semantics in doing so -
+// clients of the API may simply use the context from multiple threads
+// concurently, and assume this will work.  In order to make this work,
+// We lock the context when a thread enters, and unlock it when it leaves.
+// However we do not only unlock when the thread returns from its
+// entry point (evaluate script or call function), we also unlock the
+// context if the thread leaves JSC by making a call out to an external
+// function through a callback.
+//
+// All threads using the context share the same JS stack (the RegisterFile).
+// Whenever a thread calls into JSC it starts using the RegisterFile from the
+// previous 'high water mark' - the maximum point the stack has ever grown to
+// (returned by RegisterFile::end()).  So if a first thread calls out to a
+// callback, and a second thread enters JSC, then also exits by calling out
+// to a callback, we can be left with stackframes from both threads in the
+// RegisterFile.  As such, a problem may occur should the first thread's
+// callback complete first, and attempt to return to JSC.  Were we to allow
+// this to happen, and were its stack to grow further, then it may potentially
+// write over the second thread's call frames.
+//
+// In avoid JS stack corruption we enforce a policy of only ever allowing two
+// threads to use a JS context concurrently, and only allowing the second of
+// these threads to execute until it has completed and fully returned from its
+// outermost call into JSC.  We enforce this policy using 'lockDropDepth'.  The
+// first time a thread exits it will call DropAllLocks - which will do as expected
+// and drop locks allowing another thread to enter.  Should another thread, or the
+// same thread again, enter JSC (through evaluate script or call function), and exit
+// again through a callback, then the locks will not be dropped when DropAllLocks
+// is called (since lockDropDepth is non-zero).  Since this thread is still holding
+// the locks, only it will re able to re-enter JSC (either be returning from the
+// callback, or by re-entering through another call to evaulate script or call
+// function).
+//
+// This policy is slightly more restricive than it needs to be for correctness -
+// we could validly allow futher entries into JSC from other threads, we only
+// need ensure that callbacks return in the reverse chronological order of the
+// order in which they were made - though implementing the less restrictive policy
+// would likely increase complexity and overhead.
+//
+static unsigned lockDropDepth = 0;
+
 JSLock::DropAllLocks::DropAllLocks(ExecState* exec)
     : m_lockingForReal(exec->globalData().isSharedInstance)
 {
     pthread_once(&createJSLockCountOnce, createJSLockCount);
 
+    if (lockDropDepth++) {
+        m_lockCount = 0;
+        return;
+    }
+
     m_lockCount = JSLock::lockCount();
     for (intptr_t i = 0; i < m_lockCount; i++)
         JSLock::unlock(m_lockingForReal);
@@ -134,6 +181,11 @@ JSLock::DropAllLocks::DropAllLocks(bool lockingForReal)
 {
     pthread_once(&createJSLockCountOnce, createJSLockCount);
 
+    if (lockDropDepth++) {
+        m_lockCount = 0;
+        return;
+    }
+
     // It is necessary to drop even "unreal" locks, because having a non-zero lock count
     // will prevent a real lock from being taken.
 
@@ -146,6 +198,8 @@ JSLock::DropAllLocks::~DropAllLocks()
 {
     for (intptr_t i = 0; i < m_lockCount; i++)
         JSLock::lock(m_lockingForReal);
+
+    --lockDropDepth;
 }
 
 #else
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp
index d4310fc..937dc2b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.cpp
@@ -37,13 +37,13 @@ namespace JSC {
 ASSERT_CLASS_FITS_IN_CELL(JSNotAnObject);
 
 // JSValue methods
-JSValuePtr JSNotAnObject::toPrimitive(ExecState* exec, PreferredPrimitiveType) const
+JSValue JSNotAnObject::toPrimitive(ExecState* exec, PreferredPrimitiveType) const
 {
     ASSERT_UNUSED(exec, exec->hadException() && exec->exception() == m_exception);
     return m_exception;
 }
 
-bool JSNotAnObject::getPrimitiveNumber(ExecState* exec, double&, JSValuePtr&)
+bool JSNotAnObject::getPrimitiveNumber(ExecState* exec, double&, JSValue&)
 {
     ASSERT_UNUSED(exec, exec->hadException() && exec->exception() == m_exception);
     return false;
@@ -69,8 +69,7 @@ UString JSNotAnObject::toString(ExecState* exec) const
 
 JSObject* JSNotAnObject::toObject(ExecState* exec) const
 {
-    UNUSED_PARAM(exec);
-    ASSERT(exec->hadException() && exec->exception() == m_exception);
+    ASSERT_UNUSED(exec, exec->hadException() && exec->exception() == m_exception);
     return m_exception;
 }
 
@@ -95,12 +94,12 @@ bool JSNotAnObject::getOwnPropertySlot(ExecState* exec, unsigned, PropertySlot&)
     return false;
 }
 
-void JSNotAnObject::put(ExecState* exec, const Identifier& , JSValuePtr, PutPropertySlot&)
+void JSNotAnObject::put(ExecState* exec, const Identifier& , JSValue, PutPropertySlot&)
 {
     ASSERT_UNUSED(exec, exec->hadException() && exec->exception() == m_exception);
 }
 
-void JSNotAnObject::put(ExecState* exec, unsigned, JSValuePtr)
+void JSNotAnObject::put(ExecState* exec, unsigned, JSValue)
 {
     ASSERT_UNUSED(exec, exec->hadException() && exec->exception() == m_exception);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
index c69593f..a8e36bd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNotAnObject.h
@@ -60,15 +60,15 @@ namespace JSC {
         {
         }
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType));
         }
 
      private:
         // JSValue methods
-        virtual JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType) const;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValuePtr&);
+        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
+        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue&);
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual UString toString(ExecState*) const;
@@ -81,8 +81,8 @@ namespace JSC {
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
 
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
-        virtual void put(ExecState*, unsigned propertyName, JSValuePtr);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
+        virtual void put(ExecState*, unsigned propertyName, JSValue);
 
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.cpp
index efda0c6..669440b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.cpp
@@ -28,12 +28,14 @@
 
 namespace JSC {
 
-JSValuePtr JSNumberCell::toPrimitive(ExecState*, PreferredPrimitiveType) const
+#if !USE(ALTERNATE_JSIMMEDIATE)
+
+JSValue JSNumberCell::toPrimitive(ExecState*, PreferredPrimitiveType) const
 {
     return const_cast<JSNumberCell*>(this);
 }
 
-bool JSNumberCell::getPrimitiveNumber(ExecState*, double& number, JSValuePtr& value)
+bool JSNumberCell::getPrimitiveNumber(ExecState*, double& number, JSValue& value)
 {
     number = m_value;
     value = this;
@@ -96,29 +98,40 @@ bool JSNumberCell::getTruncatedUInt32(uint32_t& uint32) const
     return true;
 }
 
-JSValuePtr JSNumberCell::getJSNumber()
+JSValue JSNumberCell::getJSNumber()
 {
     return this;
 }
 
-NEVER_INLINE JSValuePtr jsNumberCell(ExecState* exec, double d)
+JSValue jsNumberCell(ExecState* exec, double d)
 {
     return new (exec) JSNumberCell(exec, d);
 }
 
-NEVER_INLINE JSValuePtr jsNaN(ExecState* exec)
+JSValue jsNumberCell(JSGlobalData* globalData, double d)
 {
-    return new (exec) JSNumberCell(exec, NaN);
+    return new (globalData) JSNumberCell(globalData, d);
 }
 
-NEVER_INLINE JSValuePtr jsNumberCell(JSGlobalData* globalData, double d)
+JSValue jsAPIMangledNumber(ExecState* exec, double d)
 {
-    return new (globalData) JSNumberCell(globalData, d);
+    return new (exec) JSNumberCell(JSNumberCell::APIMangled, d);
+}
+
+#else
+
+JSValue jsNumberCell(ExecState*, double)
+{
+    ASSERT_NOT_REACHED();
+    return JSValue();
 }
 
-NEVER_INLINE JSValuePtr jsNaN(JSGlobalData* globalData)
+JSValue jsAPIMangledNumber(ExecState*, double)
 {
-    return new (globalData) JSNumberCell(globalData, NaN);
+    ASSERT_NOT_REACHED();
+    return JSValue();
 }
 
+#endif
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
index 00d190d..a35e210 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSNumberCell.h
@@ -32,6 +32,14 @@
 
 namespace JSC {
 
+    extern const double NaN;
+    extern const double Inf;
+
+    JSValue jsNumberCell(ExecState*, double);
+    JSValue jsAPIMangledNumber(ExecState*, double);
+
+#if !USE(ALTERNATE_JSIMMEDIATE)
+
     class Identifier;
     class JSCell;
     class JSObject;
@@ -43,15 +51,14 @@ namespace JSC {
 
     class JSNumberCell : public JSCell {
         friend class JIT;
-        friend JSValuePtr jsNumberCell(JSGlobalData*, double);
-        friend JSValuePtr jsNaN(JSGlobalData*);
-        friend JSValuePtr jsNumberCell(ExecState*, double);
-        friend JSValuePtr jsNaN(ExecState*);
+        friend JSValue jsNumberCell(JSGlobalData*, double);
+        friend JSValue jsNumberCell(ExecState*, double);
+        friend JSValue jsAPIMangledNumber(ExecState*, double);
     public:
         double value() const { return m_value; }
 
-        virtual JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType) const;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValuePtr& value);
+        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
+        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual UString toString(ExecState*) const;
@@ -59,10 +66,10 @@ namespace JSC {
 
         virtual UString toThisString(ExecState*) const;
         virtual JSObject* toThisObject(ExecState*) const;
-        virtual JSValuePtr getJSNumber();
+        virtual JSValue getJSNumber();
 
-        int32_t toInt32() const;
-        uint32_t toUInt32() const;
+        static const uintptr_t JSAPIMangledMagicNumber = 0xbbadbeef;
+        bool isAPIMangledNumber() const { return m_structure == reinterpret_cast<Structure*>(JSAPIMangledMagicNumber); }
 
         void* operator new(size_t size, ExecState* exec)
         {
@@ -82,7 +89,7 @@ namespace JSC {
     #endif
         }
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto) { return Structure::create(proto, TypeInfo(NumberType, NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(NumberType, NeedsThisConversion)); }
 
     private:
         JSNumberCell(JSGlobalData* globalData, double value)
@@ -97,6 +104,13 @@ namespace JSC {
         {
         }
 
+        enum APIMangledTag { APIMangled };
+        JSNumberCell(APIMangledTag, double value)
+            : JSCell(reinterpret_cast<Structure*>(JSAPIMangledMagicNumber))
+            , m_value(value)
+        {
+        }
+
         virtual bool getUInt32(uint32_t&) const;
         virtual bool getTruncatedInt32(int32_t&) const;
         virtual bool getTruncatedUInt32(uint32_t&) const;
@@ -104,157 +118,361 @@ namespace JSC {
         double m_value;
     };
 
-    extern const double NaN;
-    extern const double Inf;
+    JSValue jsNumberCell(JSGlobalData*, double);
 
-    JSNumberCell* asNumberCell(JSValuePtr);
+    inline bool isNumberCell(JSValue v)
+    {
+        return v.isCell() && v.asCell()->isNumber();
+    }
+
+    inline JSNumberCell* asNumberCell(JSValue v)
+    {
+        ASSERT(isNumberCell(v));
+        return static_cast<JSNumberCell*>(v.asCell());
+    }
 
-    JSValuePtr jsNumberCell(JSGlobalData*, double);
-    JSValuePtr jsNaN(JSGlobalData*);
-    JSValuePtr jsNumberCell(ExecState*, double);
-    JSValuePtr jsNaN(ExecState*);
 
-    inline JSNumberCell* asNumberCell(JSValuePtr value)
+    inline JSValue::JSValue(ExecState* exec, double d)
     {
-        ASSERT(asCell(value)->isNumber());
-        return static_cast<JSNumberCell*>(asCell(value));
+        JSValue v = JSImmediate::from(d);
+        *this = v ? v : jsNumberCell(exec, d);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, double d)
+    inline JSValue::JSValue(ExecState* exec, int i)
     {
-        JSValuePtr v = JSImmediate::from(d);
-        return v ? v : jsNumberCell(exec, d);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(exec, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, short i)
+    inline JSValue::JSValue(ExecState* exec, unsigned i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(exec, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(exec, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, unsigned short i)
+    inline JSValue::JSValue(ExecState* exec, long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(exec, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(exec, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, int i)
+    inline JSValue::JSValue(ExecState* exec, unsigned long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(exec, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(exec, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, unsigned i)
+    inline JSValue::JSValue(ExecState* exec, long long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(exec, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(exec, static_cast<double>(i));
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, long i)
+    inline JSValue::JSValue(ExecState* exec, unsigned long long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(exec, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(exec, static_cast<double>(i));
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, unsigned long i)
+    inline JSValue::JSValue(JSGlobalData* globalData, double d)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(exec, i);
+        JSValue v = JSImmediate::from(d);
+        *this = v ? v : jsNumberCell(globalData, d);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, long long i)
+    inline JSValue::JSValue(JSGlobalData* globalData, int i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(exec, static_cast<double>(i));
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(globalData, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(ExecState* exec, unsigned long long i)
+    inline JSValue::JSValue(JSGlobalData* globalData, unsigned i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(exec, static_cast<double>(i));
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(globalData, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, double d)
+    inline JSValue::JSValue(JSGlobalData* globalData, long i)
     {
-        JSValuePtr v = JSImmediate::from(d);
-        return v ? v : jsNumberCell(globalData, d);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(globalData, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, short i)
+    inline JSValue::JSValue(JSGlobalData* globalData, unsigned long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(globalData, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(globalData, i);
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, unsigned short i)
+    inline JSValue::JSValue(JSGlobalData* globalData, long long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(globalData, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(globalData, static_cast<double>(i));
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, int i)
+    inline JSValue::JSValue(JSGlobalData* globalData, unsigned long long i)
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(globalData, i);
+        JSValue v = JSImmediate::from(i);
+        *this = v ? v : jsNumberCell(globalData, static_cast<double>(i));
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, unsigned i)
+    inline bool JSValue::isDoubleNumber() const
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(globalData, i);
+        return isNumberCell(asValue());
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, long i)
+    inline double JSValue::getDoubleNumber() const
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(globalData, i);
+        return asNumberCell(asValue())->value();
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, unsigned long i)
+    inline bool JSValue::isNumber() const
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(globalData, i);
+        return JSImmediate::isNumber(asValue()) || isDoubleNumber();
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, long long i)
+    inline double JSValue::uncheckedGetNumber() const
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(globalData, static_cast<double>(i));
+        ASSERT(isNumber());
+        return JSImmediate::isImmediate(asValue()) ? JSImmediate::toDouble(asValue()) : getDoubleNumber();
     }
 
-    ALWAYS_INLINE JSValuePtr jsNumber(JSGlobalData* globalData, unsigned long long i)
+    inline bool JSValue::isAPIMangledNumber()
     {
-        JSValuePtr v = JSImmediate::from(i);
-        return v ? v : jsNumberCell(globalData, static_cast<double>(i));
+        ASSERT(isNumber());
+        return JSImmediate::isImmediate(asValue()) ? false : asNumberCell(asValue())->isAPIMangledNumber();
     }
 
-    // --- JSValue inlines ----------------------------
+#else
+
+    inline JSValue::JSValue(ExecState*, double d)
+    {
+        JSValue v = JSImmediate::from(d);
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(ExecState*, int i)
+    {
+        JSValue v = JSImmediate::from(i);
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(ExecState*, unsigned i)
+    {
+        JSValue v = JSImmediate::from(i);
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(ExecState*, long i)
+    {
+        JSValue v = JSImmediate::from(i);
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(ExecState*, unsigned long i)
+    {
+        JSValue v = JSImmediate::from(i);
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(ExecState*, long long i)
+    {
+        JSValue v = JSImmediate::from(static_cast<double>(i));
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(ExecState*, unsigned long long i)
+    {
+        JSValue v = JSImmediate::from(static_cast<double>(i));
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(JSGlobalData*, double d)
+    {
+        JSValue v = JSImmediate::from(d);
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(JSGlobalData*, int i)
+    {
+        JSValue v = JSImmediate::from(i);
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(JSGlobalData*, unsigned i)
+    {
+        JSValue v = JSImmediate::from(i);
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(JSGlobalData*, long i)
+    {
+        JSValue v = JSImmediate::from(i);
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(JSGlobalData*, unsigned long i)
+    {
+        JSValue v = JSImmediate::from(i);
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(JSGlobalData*, long long i)
+    {
+        JSValue v = JSImmediate::from(static_cast<double>(i));
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline JSValue::JSValue(JSGlobalData*, unsigned long long i)
+    {
+        JSValue v = JSImmediate::from(static_cast<double>(i));
+        ASSERT(v);
+        *this = v;
+    }
+
+    inline bool JSValue::isDoubleNumber() const
+    {
+        return JSImmediate::isDoubleNumber(asValue());
+    }
+
+    inline double JSValue::getDoubleNumber() const
+    {
+        return JSImmediate::doubleValue(asValue());
+    }
+
+    inline bool JSValue::isNumber() const
+    {
+        return JSImmediate::isNumber(asValue());
+    }
 
     inline double JSValue::uncheckedGetNumber() const
     {
-        ASSERT(JSImmediate::isImmediate(asValue()) || asCell()->isNumber());
-        return JSImmediate::isImmediate(asValue()) ? JSImmediate::toDouble(asValue()) : asNumberCell(asValue())->value();
+        ASSERT(isNumber());
+        return JSImmediate::toDouble(asValue());
+    }
+
+#endif
+
+    inline JSValue::JSValue(ExecState*, char i)
+    {
+        ASSERT(JSImmediate::from(i));
+        *this = JSImmediate::from(i);
+    }
+
+    inline JSValue::JSValue(ExecState*, unsigned char i)
+    {
+        ASSERT(JSImmediate::from(i));
+        *this = JSImmediate::from(i);
+    }
+
+    inline JSValue::JSValue(ExecState*, short i)
+    {
+        ASSERT(JSImmediate::from(i));
+        *this = JSImmediate::from(i);
+    }
+
+    inline JSValue::JSValue(ExecState*, unsigned short i)
+    {
+        ASSERT(JSImmediate::from(i));
+        *this = JSImmediate::from(i);
+    }
+
+    inline JSValue::JSValue(JSGlobalData*, char i)
+    {
+        ASSERT(JSImmediate::from(i));
+        *this = JSImmediate::from(i);
+    }
+
+    inline JSValue::JSValue(JSGlobalData*, unsigned char i)
+    {
+        ASSERT(JSImmediate::from(i));
+        *this = JSImmediate::from(i);
     }
 
-    inline int32_t JSNumberCell::toInt32() const
+    inline JSValue::JSValue(JSGlobalData*, short i)
     {
-        if (m_value >= -2147483648.0 && m_value < 2147483648.0)
-            return static_cast<int32_t>(m_value);
-        bool scratch;
-        return JSC::toInt32SlowCase(m_value, scratch);
+        ASSERT(JSImmediate::from(i));
+        *this = JSImmediate::from(i);
     }
 
-    inline uint32_t JSNumberCell::toUInt32() const
+    inline JSValue::JSValue(JSGlobalData*, unsigned short i)
     {
-        if (m_value >= 0.0 && m_value < 4294967296.0)
-            return static_cast<uint32_t>(m_value);
-        bool scratch;
-        return JSC::toUInt32SlowCase(m_value, scratch);
+        ASSERT(JSImmediate::from(i));
+        *this = JSImmediate::from(i);
     }
 
-    ALWAYS_INLINE JSValuePtr JSValue::toJSNumber(ExecState* exec) const
+    inline JSValue jsNaN(ExecState* exec)
     {
-        return JSImmediate::isNumber(asValue()) ? asValue() : jsNumber(exec, this->toNumber(exec));
+        return jsNumber(exec, NaN);
+    }
+
+    inline JSValue jsNaN(JSGlobalData* globalData)
+    {
+        return jsNumber(globalData, NaN);
+    }
+
+    // --- JSValue inlines ----------------------------
+
+    ALWAYS_INLINE JSValue JSValue::toJSNumber(ExecState* exec) const
+    {
+        return isNumber() ? asValue() : jsNumber(exec, this->toNumber(exec));
+    }
+
+    inline bool JSValue::getNumber(double &result) const
+    {
+        if (isInt32Fast())
+            result = getInt32Fast();
+        else if (LIKELY(isDoubleNumber()))
+            result = getDoubleNumber();
+        else {
+            ASSERT(!isNumber());
+            return false;
+        }
+        return true;
+    }
+
+    inline bool JSValue::numberToInt32(int32_t& arg)
+    {
+        if (isInt32Fast())
+            arg = getInt32Fast();
+        else if (LIKELY(isDoubleNumber()))
+            arg = JSC::toInt32(getDoubleNumber());
+        else {
+            ASSERT(!isNumber());
+            return false;
+        }
+        return true;
+    }
+
+    inline bool JSValue::numberToUInt32(uint32_t& arg)
+    {
+        if (isUInt32Fast())
+            arg = getUInt32Fast();
+        else if (LIKELY(isDoubleNumber()))
+            arg = JSC::toUInt32(getDoubleNumber());
+        else if (isInt32Fast()) {
+            // FIXME: I think this case can be merged with the uint case; toUInt32SlowCase
+            // on a negative value is equivalent to simple static_casting.
+            bool ignored;
+            arg = toUInt32SlowCase(getInt32Fast(), ignored);
+        } else {
+            ASSERT(!isNumber());
+            return false;
+        }
+        return true;
     }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.cpp
new file mode 100644
index 0000000..4a89c55
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.cpp
@@ -0,0 +1,766 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSONObject.h"
+
+#include "BooleanObject.h"
+#include "Error.h"
+#include "ExceptionHelpers.h"
+#include "JSArray.h"
+#include "LiteralParser.h"
+#include "PropertyNameArray.h"
+#include <wtf/MathExtras.h>
+
+namespace JSC {
+
+ASSERT_CLASS_FITS_IN_CELL(JSONObject);
+
+static JSValue JSC_HOST_CALL JSONProtoFuncParse(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL JSONProtoFuncStringify(ExecState*, JSObject*, JSValue, const ArgList&);
+
+}
+
+#include "JSONObject.lut.h"
+
+namespace JSC {
+
+// PropertyNameForFunctionCall objects must be on the stack, since the JSValue that they create is not marked.
+class PropertyNameForFunctionCall {
+public:
+    PropertyNameForFunctionCall(const Identifier&);
+    PropertyNameForFunctionCall(unsigned);
+
+    JSValue value(ExecState*) const;
+
+private:
+    const Identifier* m_identifier;
+    unsigned m_number;
+    mutable JSValue m_value;
+};
+
+class Stringifier : Noncopyable {
+public:
+    Stringifier(ExecState*, JSValue replacer, JSValue space);
+    ~Stringifier();
+    JSValue stringify(JSValue);
+
+    void mark();
+
+private:
+    typedef UString StringBuilder;
+
+    class Holder {
+    public:
+        Holder(JSObject*);
+
+        JSObject* object() const { return m_object; }
+
+        bool appendNextProperty(Stringifier&, StringBuilder&);
+
+    private:
+        JSObject* const m_object;
+        const bool m_isArray;
+        bool m_isJSArray;
+        unsigned m_index;
+        unsigned m_size;
+        RefPtr<PropertyNameArrayData> m_propertyNames;
+    };
+
+    friend class Holder;
+
+    static void appendQuotedString(StringBuilder&, const UString&);
+
+    JSValue toJSON(JSValue, const PropertyNameForFunctionCall&);
+
+    enum StringifyResult { StringifyFailed, StringifySucceeded, StringifyFailedDueToUndefinedValue };
+    StringifyResult appendStringifiedValue(StringBuilder&, JSValue, JSObject* holder, const PropertyNameForFunctionCall&);
+
+    bool willIndent() const;
+    void indent();
+    void unindent();
+    void startNewLine(StringBuilder&) const;
+
+    Stringifier* const m_nextStringifierToMark;
+    ExecState* const m_exec;
+    const JSValue m_replacer;
+    bool m_usingArrayReplacer;
+    PropertyNameArray m_arrayReplacerPropertyNames;
+    CallType m_replacerCallType;
+    CallData m_replacerCallData;
+    const UString m_gap;
+
+    HashSet<JSObject*> m_holderCycleDetector;
+    Vector<Holder, 16> m_holderStack;
+    UString m_repeatedGap;
+    UString m_indent;
+};
+
+// ------------------------------ helper functions --------------------------------
+
+static inline JSValue unwrapBoxedPrimitive(JSValue value)
+{
+    if (!value.isObject())
+        return value;
+    if (!asObject(value)->inherits(&NumberObject::info) && !asObject(value)->inherits(&StringObject::info) && !asObject(value)->inherits(&BooleanObject::info))
+        return value;
+    return static_cast<JSWrapperObject*>(asObject(value))->internalValue();
+}
+
+static inline UString gap(JSValue space)
+{
+    space = unwrapBoxedPrimitive(space);
+
+    // If the space value is a number, create a gap string with that number of spaces.
+    double spaceCount;
+    if (space.getNumber(spaceCount)) {
+        const int maxSpaceCount = 100;
+        int count;
+        if (spaceCount > maxSpaceCount)
+            count = maxSpaceCount;
+        else if (!(spaceCount > 0))
+            count = 0;
+        else
+            count = static_cast<int>(spaceCount);
+        UChar spaces[maxSpaceCount];
+        for (int i = 0; i < count; ++i)
+            spaces[i] = ' ';
+        return UString(spaces, count);
+    }
+
+    // If the space value is a string, use it as the gap string, otherwise use no gap string.
+    return space.getString();
+}
+
+// ------------------------------ PropertyNameForFunctionCall --------------------------------
+
+inline PropertyNameForFunctionCall::PropertyNameForFunctionCall(const Identifier& identifier)
+    : m_identifier(&identifier)
+{
+}
+
+inline PropertyNameForFunctionCall::PropertyNameForFunctionCall(unsigned number)
+    : m_identifier(0)
+    , m_number(number)
+{
+}
+
+JSValue PropertyNameForFunctionCall::value(ExecState* exec) const
+{
+    if (!m_value) {
+        if (m_identifier)
+            m_value = jsString(exec, m_identifier->ustring());
+        else
+            m_value = jsNumber(exec, m_number);
+    }
+    return m_value;
+}
+
+// ------------------------------ Stringifier --------------------------------
+
+Stringifier::Stringifier(ExecState* exec, JSValue replacer, JSValue space)
+    : m_nextStringifierToMark(exec->globalData().firstStringifierToMark)
+    , m_exec(exec)
+    , m_replacer(replacer)
+    , m_usingArrayReplacer(false)
+    , m_arrayReplacerPropertyNames(exec)
+    , m_replacerCallType(CallTypeNone)
+    , m_gap(gap(space))
+{
+    exec->globalData().firstStringifierToMark = this;
+
+    if (!m_replacer.isObject())
+        return;
+
+    if (asObject(m_replacer)->inherits(&JSArray::info)) {
+        m_usingArrayReplacer = true;
+        JSObject* array = asObject(m_replacer);
+        unsigned length = array->get(exec, exec->globalData().propertyNames->length).toUInt32(exec);
+        for (unsigned i = 0; i < length; ++i) {
+            JSValue name = array->get(exec, i);
+            if (exec->hadException())
+                break;
+            UString propertyName;
+            if (!name.getString(propertyName))
+                continue;
+            if (exec->hadException())
+                return;
+            m_arrayReplacerPropertyNames.add(Identifier(exec, propertyName));
+        }
+        return;
+    }
+
+    m_replacerCallType = asObject(m_replacer)->getCallData(m_replacerCallData);
+}
+
+Stringifier::~Stringifier()
+{
+    ASSERT(m_exec->globalData().firstStringifierToMark == this);
+    m_exec->globalData().firstStringifierToMark = m_nextStringifierToMark;
+}
+
+void Stringifier::mark()
+{
+    for (Stringifier* stringifier = this; stringifier; stringifier = stringifier->m_nextStringifierToMark) {
+        size_t size = m_holderStack.size();
+        for (size_t i = 0; i < size; ++i) {
+            JSObject* object = m_holderStack[i].object();
+            if (!object->marked())
+                object->mark();
+        }
+    }
+}
+
+JSValue Stringifier::stringify(JSValue value)
+{
+    JSObject* object = constructEmptyObject(m_exec);
+    if (m_exec->hadException())
+        return jsNull();
+
+    PropertyNameForFunctionCall emptyPropertyName(m_exec->globalData().propertyNames->emptyIdentifier);
+    object->putDirect(m_exec->globalData().propertyNames->emptyIdentifier, value);
+
+    StringBuilder result;
+    if (appendStringifiedValue(result, value, object, emptyPropertyName) != StringifySucceeded)
+        return jsUndefined();
+    if (m_exec->hadException())
+        return jsNull();
+
+    return jsString(m_exec, result);
+}
+
+void Stringifier::appendQuotedString(StringBuilder& builder, const UString& value)
+{
+    int length = value.size();
+
+    // String length plus 2 for quote marks plus 8 so we can accomodate a few escaped characters.
+    builder.reserveCapacity(builder.size() + length + 2 + 8);
+
+    builder.append('"');
+
+    const UChar* data = value.data();
+    for (int i = 0; i < length; ++i) {
+        int start = i;
+        while (i < length && (data[i] > 0x1F && data[i] != '"' && data[i] != '\\'))
+            ++i;
+        builder.append(data + start, i - start);
+        if (i >= length)
+            break;
+        switch (data[i]) {
+            case '\t':
+                builder.append('\\');
+                builder.append('t');
+                break;
+            case '\r':
+                builder.append('\\');
+                builder.append('r');
+                break;
+            case '\n':
+                builder.append('\\');
+                builder.append('n');
+                break;
+            case '\f':
+                builder.append('\\');
+                builder.append('f');
+                break;
+            case '\b':
+                builder.append('\\');
+                builder.append('b');
+                break;
+            case '"':
+                builder.append('\\');
+                builder.append('"');
+                break;
+            case '\\':
+                builder.append('\\');
+                builder.append('\\');
+                break;
+            default:
+                static const char hexDigits[] = "0123456789abcdef";
+                UChar ch = data[i];
+                UChar hex[] = { '\\', 'u', hexDigits[(ch >> 12) & 0xF], hexDigits[(ch >> 8) & 0xF], hexDigits[(ch >> 4) & 0xF], hexDigits[ch & 0xF] };
+                builder.append(hex, sizeof(hex) / sizeof(UChar));
+                break;
+        }
+    }
+
+    builder.append('"');
+}
+
+inline JSValue Stringifier::toJSON(JSValue value, const PropertyNameForFunctionCall& propertyName)
+{
+    ASSERT(!m_exec->hadException());
+    if (!value.isObject() || !asObject(value)->hasProperty(m_exec, m_exec->globalData().propertyNames->toJSON))
+        return value;
+
+    JSValue toJSONFunction = asObject(value)->get(m_exec, m_exec->globalData().propertyNames->toJSON);
+    if (m_exec->hadException())
+        return jsNull();
+
+    if (!toJSONFunction.isObject())
+        return value;
+
+    JSObject* object = asObject(toJSONFunction);
+    CallData callData;
+    CallType callType = object->getCallData(callData);
+    if (callType == CallTypeNone)
+        return value;
+
+    JSValue list[] = { propertyName.value(m_exec) };
+    ArgList args(list, sizeof(list) / sizeof(JSValue));
+    return call(m_exec, object, callType, callData, value, args);
+}
+
+Stringifier::StringifyResult Stringifier::appendStringifiedValue(StringBuilder& builder, JSValue value, JSObject* holder, const PropertyNameForFunctionCall& propertyName)
+{
+    // Call the toJSON function.
+    value = toJSON(value, propertyName);
+    if (m_exec->hadException())
+        return StringifyFailed;
+    if (value.isUndefined() && !holder->inherits(&JSArray::info))
+        return StringifyFailedDueToUndefinedValue;
+
+    // Call the replacer function.
+    if (m_replacerCallType != CallTypeNone) {
+        JSValue list[] = { propertyName.value(m_exec), value };
+        ArgList args(list, sizeof(list) / sizeof(JSValue));
+        value = call(m_exec, m_replacer, m_replacerCallType, m_replacerCallData, holder, args);
+        if (m_exec->hadException())
+            return StringifyFailed;
+    }
+
+    if (value.isNull()) {
+        builder.append("null");
+        return StringifySucceeded;
+    }
+
+    value = unwrapBoxedPrimitive(value);
+
+    if (value.isBoolean()) {
+        builder.append(value.getBoolean() ? "true" : "false");
+        return StringifySucceeded;
+    }
+
+    UString stringValue;
+    if (value.getString(stringValue)) {
+        appendQuotedString(builder, stringValue);
+        return StringifySucceeded;
+    }
+
+    double numericValue;
+    if (value.getNumber(numericValue)) {
+        if (!isfinite(numericValue))
+            builder.append("null");
+        else
+            builder.append(UString::from(numericValue));
+        return StringifySucceeded;
+    }
+
+    if (!value.isObject())
+        return StringifyFailed;
+
+    JSObject* object = asObject(value);
+
+    // Handle cycle detection, and put the holder on the stack.
+    if (!m_holderCycleDetector.add(object).second) {
+        throwError(m_exec, TypeError);
+        return StringifyFailed;
+    }
+    bool holderStackWasEmpty = m_holderStack.isEmpty();
+    m_holderStack.append(object);
+    if (!holderStackWasEmpty)
+        return StringifySucceeded;
+
+    // If this is the outermost call, then loop to handle everything on the holder stack.
+    TimeoutChecker localTimeoutChecker(m_exec->globalData().timeoutChecker);
+    localTimeoutChecker.reset();
+    unsigned tickCount = localTimeoutChecker.ticksUntilNextCheck();
+    do {
+        while (m_holderStack.last().appendNextProperty(*this, builder)) {
+            if (m_exec->hadException())
+                return StringifyFailed;
+            if (!--tickCount) {
+                if (localTimeoutChecker.didTimeOut(m_exec)) {
+                    m_exec->setException(createInterruptedExecutionException(&m_exec->globalData()));
+                    return StringifyFailed;
+                }
+                tickCount = localTimeoutChecker.ticksUntilNextCheck();
+            }
+        }
+        m_holderCycleDetector.remove(m_holderStack.last().object());
+        m_holderStack.removeLast();
+    } while (!m_holderStack.isEmpty());
+    return StringifySucceeded;
+}
+
+inline bool Stringifier::willIndent() const
+{
+    return !m_gap.isEmpty();
+}
+
+inline void Stringifier::indent()
+{
+    // Use a single shared string, m_repeatedGap, so we don't keep allocating new ones as we indent and unindent.
+    int newSize = m_indent.size() + m_gap.size();
+    if (newSize > m_repeatedGap.size())
+        m_repeatedGap.append(m_gap);
+    ASSERT(newSize <= m_repeatedGap.size());
+    m_indent = m_repeatedGap.substr(0, newSize);
+}
+
+inline void Stringifier::unindent()
+{
+    ASSERT(m_indent.size() >= m_gap.size());
+    m_indent = m_repeatedGap.substr(0, m_indent.size() - m_gap.size());
+}
+
+inline void Stringifier::startNewLine(StringBuilder& builder) const
+{
+    if (m_gap.isEmpty())
+        return;
+    builder.append('\n');
+    builder.append(m_indent);
+}
+
+inline Stringifier::Holder::Holder(JSObject* object)
+    : m_object(object)
+    , m_isArray(object->inherits(&JSArray::info))
+    , m_index(0)
+{
+}
+
+bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBuilder& builder)
+{
+    ASSERT(m_index <= m_size);
+
+    ExecState* exec = stringifier.m_exec;
+
+    // First time through, initialize.
+    if (!m_index) {
+        if (m_isArray) {
+            m_isJSArray = isJSArray(&exec->globalData(), m_object);
+            m_size = m_object->get(exec, exec->globalData().propertyNames->length).toUInt32(exec);
+            builder.append('[');
+        } else {
+            if (stringifier.m_usingArrayReplacer)
+                m_propertyNames = stringifier.m_arrayReplacerPropertyNames.data();
+            else {
+                PropertyNameArray objectPropertyNames(exec);
+                m_object->getPropertyNames(exec, objectPropertyNames);
+                m_propertyNames = objectPropertyNames.releaseData();
+            }
+            m_size = m_propertyNames->propertyNameVector().size();
+            builder.append('{');
+        }
+        stringifier.indent();
+    }
+
+    // Last time through, finish up and return false.
+    if (m_index == m_size) {
+        stringifier.unindent();
+        if (m_size && builder[builder.size() - 1] != '{')
+            stringifier.startNewLine(builder);
+        builder.append(m_isArray ? ']' : '}');
+        return false;
+    }
+
+    // Handle a single element of the array or object.
+    unsigned index = m_index++;
+    unsigned rollBackPoint = 0;
+    StringifyResult stringifyResult;
+    if (m_isArray) {
+        // Get the value.
+        JSValue value;
+        if (m_isJSArray && asArray(m_object)->canGetIndex(index))
+            value = asArray(m_object)->getIndex(index);
+        else {
+            PropertySlot slot(m_object);
+            if (!m_object->getOwnPropertySlot(exec, index, slot))
+                slot.setUndefined();
+            if (exec->hadException())
+                return false;
+            value = slot.getValue(exec, index);
+        }
+
+        // Append the separator string.
+        if (index)
+            builder.append(',');
+        stringifier.startNewLine(builder);
+
+        // Append the stringified value.
+        stringifyResult = stringifier.appendStringifiedValue(builder, value, m_object, index);
+    } else {
+        // Get the value.
+        PropertySlot slot(m_object);
+        Identifier& propertyName = m_propertyNames->propertyNameVector()[index];
+        if (!m_object->getOwnPropertySlot(exec, propertyName, slot))
+            return true;
+        JSValue value = slot.getValue(exec, propertyName);
+        if (exec->hadException())
+            return false;
+
+        rollBackPoint = builder.size();
+
+        // Append the separator string.
+        if (builder[rollBackPoint - 1] != '{')
+            builder.append(',');
+        stringifier.startNewLine(builder);
+
+        // Append the property name.
+        appendQuotedString(builder, propertyName.ustring());
+        builder.append(':');
+        if (stringifier.willIndent())
+            builder.append(' ');
+
+        // Append the stringified value.
+        stringifyResult = stringifier.appendStringifiedValue(builder, value, m_object, propertyName);
+    }
+
+    // From this point on, no access to the this pointer or to any members, because the
+    // Holder object may have moved if the call to stringify pushed a new Holder onto
+    // m_holderStack.
+
+    switch (stringifyResult) {
+        case StringifyFailed:
+            builder.append("null");
+            break;
+        case StringifySucceeded:
+            break;
+        case StringifyFailedDueToUndefinedValue:
+            // This only occurs when get an undefined value for an object property.
+            // In this case we don't want the separator and property name that we
+            // already appended, so roll back.
+            builder = builder.substr(0, rollBackPoint);
+            break;
+    }
+
+    return true;
+}
+
+// ------------------------------ JSONObject --------------------------------
+
+const ClassInfo JSONObject::info = { "JSON", 0, 0, ExecState::jsonTable };
+
+/* Source for JSONObject.lut.h
+@begin jsonTable
+  parse         JSONProtoFuncParse             DontEnum|Function 1
+  stringify     JSONProtoFuncStringify         DontEnum|Function 1
+@end
+*/
+
+// ECMA 15.8
+
+bool JSONObject::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    const HashEntry* entry = ExecState::jsonTable(exec)->entry(exec, propertyName);
+    if (!entry)
+        return JSObject::getOwnPropertySlot(exec, propertyName, slot);
+
+    ASSERT(entry->attributes() & Function);
+    setUpStaticFunctionSlot(exec, entry, this, propertyName, slot);
+    return true;
+}
+
+void JSONObject::markStringifiers(Stringifier* stringifier)
+{
+    stringifier->mark();
+}
+
+class Walker {
+public:
+    Walker(ExecState* exec, JSObject* function, CallType callType, CallData callData)
+        : m_exec(exec)
+        , m_function(function)
+        , m_callType(callType)
+        , m_callData(callData)
+    {
+    }
+    JSValue walk(JSValue unfiltered);
+private:
+    JSValue callReviver(JSValue property, JSValue unfiltered)
+    {
+        JSValue args[] = { property, unfiltered };
+        ArgList argList(args, 2);
+        return call(m_exec, m_function, m_callType, m_callData, jsNull(), argList);
+    }
+
+    friend class Holder;
+
+    ExecState* m_exec;
+    JSObject* m_function;
+    CallType m_callType;
+    CallData m_callData;
+};
+    
+enum WalkerState { StateUnknown, ArrayStartState, ArrayStartVisitMember, ArrayEndVisitMember, 
+                                 ObjectStartState, ObjectStartVisitMember, ObjectEndVisitMember };
+NEVER_INLINE JSValue Walker::walk(JSValue unfiltered)
+{
+    Vector<PropertyNameArray, 16> propertyStack;
+    Vector<uint32_t, 16> indexStack;
+    Vector<JSObject*, 16> objectStack;
+    Vector<JSArray*, 16> arrayStack;
+    
+    Vector<WalkerState, 16> stateStack;
+    WalkerState state = StateUnknown;
+    JSValue inValue = unfiltered;
+    JSValue outValue = jsNull();
+    while (1) {
+        switch (state) {
+            arrayStartState:
+            case ArrayStartState: {
+                ASSERT(inValue.isObject());
+                ASSERT(isJSArray(&m_exec->globalData(), asObject(inValue)));
+                JSArray* array = asArray(inValue);
+                arrayStack.append(array);
+                indexStack.append(0);
+                // fallthrough
+            }
+            arrayStartVisitMember:
+            case ArrayStartVisitMember: {
+                JSArray* array = arrayStack.last();
+                uint32_t index = indexStack.last();
+                if (index == array->length()) {
+                    outValue = array;
+                    arrayStack.removeLast();
+                    indexStack.removeLast();
+                    break;
+                }
+                inValue = array->getIndex(index);
+                if (inValue.isObject()) {
+                    stateStack.append(ArrayEndVisitMember);
+                    goto stateUnknown;
+                } else
+                    outValue = inValue;
+                // fallthrough
+            }
+            case ArrayEndVisitMember: {
+                JSArray* array = arrayStack.last();
+                array->setIndex(indexStack.last(), callReviver(jsString(m_exec, UString::from(indexStack.last())), outValue));
+                if (m_exec->hadException())
+                    return jsNull();
+                indexStack.last()++;
+                goto arrayStartVisitMember;
+            }
+            objectStartState:
+            case ObjectStartState: {
+                ASSERT(inValue.isObject());
+                ASSERT(!isJSArray(&m_exec->globalData(), asObject(inValue)));
+                JSObject* object = asObject(inValue);
+                objectStack.append(object);
+                indexStack.append(0);
+                propertyStack.append(PropertyNameArray(m_exec));
+                object->getPropertyNames(m_exec, propertyStack.last());
+                // fallthrough
+            }
+            objectStartVisitMember:
+            case ObjectStartVisitMember: {
+                JSObject* object = objectStack.last();
+                uint32_t index = indexStack.last();
+                PropertyNameArray& properties = propertyStack.last();
+                if (index == properties.size()) {
+                    outValue = object;
+                    objectStack.removeLast();
+                    indexStack.removeLast();
+                    propertyStack.removeLast();
+                    break;
+                }
+                PropertySlot slot;
+                object->getOwnPropertySlot(m_exec, properties[index], slot);
+                inValue = slot.getValue(m_exec, properties[index]);
+                ASSERT(!m_exec->hadException());
+                if (inValue.isObject()) {
+                    stateStack.append(ObjectEndVisitMember);
+                    goto stateUnknown;
+                } else
+                    outValue = inValue;
+                // fallthrough
+            }
+            case ObjectEndVisitMember: {
+                JSObject* object = objectStack.last();
+                Identifier prop = propertyStack.last()[indexStack.last()];
+                PutPropertySlot slot;
+                object->put(m_exec, prop, callReviver(jsString(m_exec, prop.ustring()), outValue), slot);
+                if (m_exec->hadException())
+                    return jsNull();
+                indexStack.last()++;
+                goto objectStartVisitMember;
+            }
+            stateUnknown:
+            case StateUnknown:
+                if (!inValue.isObject()) {
+                    outValue = inValue;
+                    break;
+                }
+                if (isJSArray(&m_exec->globalData(), asObject(inValue)))
+                    goto arrayStartState;
+                goto objectStartState;
+        }
+        if (stateStack.isEmpty())
+            break;
+        state = stateStack.last();
+        stateStack.removeLast();
+    }
+    return callReviver(jsEmptyString(m_exec), outValue);
+}
+
+// ECMA-262 v5 15.12.2
+JSValue JSC_HOST_CALL JSONProtoFuncParse(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+{
+    if (args.isEmpty())
+        return throwError(exec, GeneralError, "JSON.parse requires at least one parameter");
+    JSValue value = args.at(0);
+    UString source = value.toString(exec);
+    if (exec->hadException())
+        return jsNull();
+    
+    LiteralParser jsonParser(exec, source, LiteralParser::StrictJSON);
+    JSValue unfiltered = jsonParser.tryLiteralParse();
+    if (!unfiltered)
+        return throwError(exec, SyntaxError, "Unable to parse JSON string");
+    
+    if (args.size() < 2)
+        return unfiltered;
+    
+    JSValue function = args.at(1);
+    CallData callData;
+    CallType callType = function.getCallData(callData);
+    if (callType == CallTypeNone)
+        return unfiltered;
+    return Walker(exec, asObject(function), callType, callData).walk(unfiltered);
+}
+
+// ECMA-262 v5 15.12.3
+JSValue JSC_HOST_CALL JSONProtoFuncStringify(ExecState* exec, JSObject*, JSValue, const ArgList& args)
+{
+    if (args.isEmpty())
+        return throwError(exec, GeneralError, "No input to stringify");
+    JSValue value = args.at(0);
+    JSValue replacer = args.at(1);
+    JSValue space = args.at(2);
+    return Stringifier(exec, replacer, space).stringify(value);
+}
+
+} // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h
new file mode 100644
index 0000000..8d5364a
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSONObject.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSONObject_h
+#define JSONObject_h
+
+#include "JSObject.h"
+
+namespace JSC {
+
+    class Stringifier;
+
+    class JSONObject : public JSObject {
+    public:
+        JSONObject(PassRefPtr<Structure> structure)
+            : JSObject(structure)
+        {
+        }
+
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
+        {
+            return Structure::create(prototype, TypeInfo(ObjectType));
+        }
+
+        static void markStringifiers(Stringifier*);
+
+    private:
+        virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+
+        virtual const ClassInfo* classInfo() const { return &info; }
+        static const ClassInfo info;
+    };
+
+} // namespace JSC
+
+#endif // JSONObject_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
index d38c325..415c25d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.cpp
@@ -69,11 +69,13 @@ void JSObject::mark()
     JSCell::mark();
     m_structure->mark();
 
+    PropertyStorage storage = propertyStorage();
+
     size_t storageSize = m_structure->propertyStorageSize();
     for (size_t i = 0; i < storageSize; ++i) {
-        JSValuePtr v = m_propertyStorage[i];
-        if (!v->marked())
-            v->mark();
+        JSValue v = JSValue::decode(storage[i]);
+        if (!v.marked())
+            v.mark();
     }
 
     JSOBJECT_MARK_END();
@@ -98,18 +100,18 @@ static void throwSetterError(ExecState* exec)
 }
 
 // ECMA 8.6.2.2
-void JSObject::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     ASSERT(value);
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
     if (propertyName == exec->propertyNames().underscoreProto) {
         // Setting __proto__ to a non-object, non-null value is silently ignored to match Mozilla.
-        if (!value->isObject() && !value->isNull())
+        if (!value.isObject() && !value.isNull())
             return;
 
-        JSValuePtr nextPrototypeValue = value;
-        while (nextPrototypeValue && nextPrototypeValue->isObject()) {
+        JSValue nextPrototypeValue = value;
+        while (nextPrototypeValue && nextPrototypeValue.isObject()) {
             JSObject* nextPrototype = asObject(nextPrototypeValue)->unwrappedObject();
             if (nextPrototype == this) {
                 throwError(exec, GeneralError, "cyclic __proto__ value");
@@ -123,22 +125,23 @@ void JSObject::put(ExecState* exec, const Identifier& propertyName, JSValuePtr v
     }
 
     // Check if there are any setters or getters in the prototype chain
-    JSValuePtr prototype;
+    JSValue prototype;
     for (JSObject* obj = this; !obj->structure()->hasGetterSetterProperties(); obj = asObject(prototype)) {
         prototype = obj->prototype();
-        if (prototype->isNull()) {
-            putDirect(propertyName, value, 0, true, slot);
+        if (prototype.isNull()) {
+            putDirectInternal(exec->globalData(), propertyName, value, 0, true, slot);
             return;
         }
     }
     
     unsigned attributes;
-    if ((m_structure->get(propertyName, attributes) != WTF::notFound) && attributes & ReadOnly)
+    JSCell* specificValue;
+    if ((m_structure->get(propertyName, attributes, specificValue) != WTF::notFound) && attributes & ReadOnly)
         return;
 
     for (JSObject* obj = this; ; obj = asObject(prototype)) {
-        if (JSValuePtr gs = obj->getDirect(propertyName)) {
-            if (gs->isGetterSetter()) {
+        if (JSValue gs = obj->getDirect(propertyName)) {
+            if (gs.isGetterSetter()) {
                 JSObject* setterFunc = asGetterSetter(gs)->setter();        
                 if (!setterFunc) {
                     throwSetterError(exec);
@@ -147,7 +150,7 @@ void JSObject::put(ExecState* exec, const Identifier& propertyName, JSValuePtr v
                 
                 CallData callData;
                 CallType callType = setterFunc->getCallData(callData);
-                ArgList args;
+                MarkedArgumentBuffer args;
                 args.append(value);
                 call(exec, setterFunc, callType, callData, this, args);
                 return;
@@ -159,26 +162,31 @@ void JSObject::put(ExecState* exec, const Identifier& propertyName, JSValuePtr v
         }
 
         prototype = obj->prototype();
-        if (prototype->isNull())
+        if (prototype.isNull())
             break;
     }
 
-    putDirect(propertyName, value, 0, true, slot);
+    putDirectInternal(exec->globalData(), propertyName, value, 0, true, slot);
     return;
 }
 
-void JSObject::put(ExecState* exec, unsigned propertyName, JSValuePtr value)
+void JSObject::put(ExecState* exec, unsigned propertyName, JSValue value)
 {
     PutPropertySlot slot;
     put(exec, Identifier::from(exec, propertyName), value, slot);
 }
 
-void JSObject::putWithAttributes(ExecState*, const Identifier& propertyName, JSValuePtr value, unsigned attributes)
+void JSObject::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
 {
-    putDirect(propertyName, value, attributes);
+    putDirectInternal(exec->globalData(), propertyName, value, attributes, checkReadOnly, slot);
 }
 
-void JSObject::putWithAttributes(ExecState* exec, unsigned propertyName, JSValuePtr value, unsigned attributes)
+void JSObject::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValue value, unsigned attributes)
+{
+    putDirectInternal(exec->globalData(), propertyName, value, attributes);
+}
+
+void JSObject::putWithAttributes(ExecState* exec, unsigned propertyName, JSValue value, unsigned attributes)
 {
     putWithAttributes(exec, Identifier::from(exec, propertyName), value, attributes);
 }
@@ -199,7 +207,8 @@ bool JSObject::hasProperty(ExecState* exec, unsigned propertyName) const
 bool JSObject::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     unsigned attributes;
-    if (m_structure->get(propertyName, attributes) != WTF::notFound) {
+    JSCell* specificValue;
+    if (m_structure->get(propertyName, attributes, specificValue) != WTF::notFound) {
         if ((attributes & DontDelete))
             return false;
         removeDirect(propertyName);
@@ -226,11 +235,11 @@ bool JSObject::deleteProperty(ExecState* exec, unsigned propertyName)
     return deleteProperty(exec, Identifier::from(exec, propertyName));
 }
 
-static ALWAYS_INLINE JSValuePtr callDefaultValueFunction(ExecState* exec, const JSObject* object, const Identifier& propertyName)
+static ALWAYS_INLINE JSValue callDefaultValueFunction(ExecState* exec, const JSObject* object, const Identifier& propertyName)
 {
-    JSValuePtr function = object->get(exec, propertyName);
+    JSValue function = object->get(exec, propertyName);
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone)
         return exec->exception();
 
@@ -239,35 +248,35 @@ static ALWAYS_INLINE JSValuePtr callDefaultValueFunction(ExecState* exec, const
     if (exec->hadException())
         return exec->exception();
 
-    JSValuePtr result = call(exec, function, callType, callData, const_cast<JSObject*>(object), exec->emptyList());
-    ASSERT(!result->isGetterSetter());
+    JSValue result = call(exec, function, callType, callData, const_cast<JSObject*>(object), exec->emptyList());
+    ASSERT(!result.isGetterSetter());
     if (exec->hadException())
         return exec->exception();
-    if (result->isObject())
-        return noValue();
+    if (result.isObject())
+        return JSValue();
     return result;
 }
 
-bool JSObject::getPrimitiveNumber(ExecState* exec, double& number, JSValuePtr& result)
+bool JSObject::getPrimitiveNumber(ExecState* exec, double& number, JSValue& result)
 {
     result = defaultValue(exec, PreferNumber);
-    number = result->toNumber(exec);
-    return !result->isString();
+    number = result.toNumber(exec);
+    return !result.isString();
 }
 
 // ECMA 8.6.2.6
-JSValuePtr JSObject::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
+JSValue JSObject::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
     // Must call toString first for Date objects.
     if ((hint == PreferString) || (hint != PreferNumber && prototype() == exec->lexicalGlobalObject()->datePrototype())) {
-        JSValuePtr value = callDefaultValueFunction(exec, this, exec->propertyNames().toString);
+        JSValue value = callDefaultValueFunction(exec, this, exec->propertyNames().toString);
         if (value)
             return value;
         value = callDefaultValueFunction(exec, this, exec->propertyNames().valueOf);
         if (value)
             return value;
     } else {
-        JSValuePtr value = callDefaultValueFunction(exec, this, exec->propertyNames().valueOf);
+        JSValue value = callDefaultValueFunction(exec, this, exec->propertyNames().valueOf);
         if (value)
             return value;
         value = callDefaultValueFunction(exec, this, exec->propertyNames().toString);
@@ -293,8 +302,8 @@ const HashEntry* JSObject::findPropertyHashEntry(ExecState* exec, const Identifi
 
 void JSObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
 {
-    JSValuePtr object = getDirect(propertyName);
-    if (object && object->isGetterSetter()) {
+    JSValue object = getDirect(propertyName);
+    if (object && object.isGetterSetter()) {
         ASSERT(m_structure->hasGetterSetterProperties());
         asGetterSetter(object)->setGetter(getterFunction);
         return;
@@ -302,7 +311,7 @@ void JSObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSO
 
     PutPropertySlot slot;
     GetterSetter* getterSetter = new (exec) GetterSetter;
-    putDirect(propertyName, getterSetter, None, true, slot);
+    putDirectInternal(exec->globalData(), propertyName, getterSetter, Getter, true, slot);
 
     // putDirect will change our Structure if we add a new property. For
     // getters and setters, though, we also need to change our Structure
@@ -320,8 +329,8 @@ void JSObject::defineGetter(ExecState* exec, const Identifier& propertyName, JSO
 
 void JSObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSObject* setterFunction)
 {
-    JSValuePtr object = getDirect(propertyName);
-    if (object && object->isGetterSetter()) {
+    JSValue object = getDirect(propertyName);
+    if (object && object.isGetterSetter()) {
         ASSERT(m_structure->hasGetterSetterProperties());
         asGetterSetter(object)->setSetter(setterFunction);
         return;
@@ -329,7 +338,7 @@ void JSObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSO
 
     PutPropertySlot slot;
     GetterSetter* getterSetter = new (exec) GetterSetter;
-    putDirect(propertyName, getterSetter, None, true, slot);
+    putDirectInternal(exec->globalData(), propertyName, getterSetter, Setter, true, slot);
 
     // putDirect will change our Structure if we add a new property. For
     // getters and setters, though, we also need to change our Structure
@@ -345,12 +354,12 @@ void JSObject::defineSetter(ExecState* exec, const Identifier& propertyName, JSO
     getterSetter->setSetter(setterFunction);
 }
 
-JSValuePtr JSObject::lookupGetter(ExecState*, const Identifier& propertyName)
+JSValue JSObject::lookupGetter(ExecState*, const Identifier& propertyName)
 {
     JSObject* object = this;
     while (true) {
-        if (JSValuePtr value = object->getDirect(propertyName)) {
-            if (!value->isGetterSetter())
+        if (JSValue value = object->getDirect(propertyName)) {
+            if (!value.isGetterSetter())
                 return jsUndefined();
             JSObject* functionObject = asGetterSetter(value)->getter();
             if (!functionObject)
@@ -358,18 +367,18 @@ JSValuePtr JSObject::lookupGetter(ExecState*, const Identifier& propertyName)
             return functionObject;
         }
 
-        if (!object->prototype() || !object->prototype()->isObject())
+        if (!object->prototype() || !object->prototype().isObject())
             return jsUndefined();
         object = asObject(object->prototype());
     }
 }
 
-JSValuePtr JSObject::lookupSetter(ExecState*, const Identifier& propertyName)
+JSValue JSObject::lookupSetter(ExecState*, const Identifier& propertyName)
 {
     JSObject* object = this;
     while (true) {
-        if (JSValuePtr value = object->getDirect(propertyName)) {
-            if (!value->isGetterSetter())
+        if (JSValue value = object->getDirect(propertyName)) {
+            if (!value.isGetterSetter())
                 return jsUndefined();
             JSObject* functionObject = asGetterSetter(value)->setter();
             if (!functionObject)
@@ -377,24 +386,24 @@ JSValuePtr JSObject::lookupSetter(ExecState*, const Identifier& propertyName)
             return functionObject;
         }
 
-        if (!object->prototype() || !object->prototype()->isObject())
+        if (!object->prototype() || !object->prototype().isObject())
             return jsUndefined();
         object = asObject(object->prototype());
     }
 }
 
-bool JSObject::hasInstance(ExecState* exec, JSValuePtr value, JSValuePtr proto)
+bool JSObject::hasInstance(ExecState* exec, JSValue value, JSValue proto)
 {
-    if (!proto->isObject()) {
-        throwError(exec, TypeError, "instanceof called on an object with an invalid prototype property.");
+    if (!value.isObject())
         return false;
-    }
 
-    if (!value->isObject())
+    if (!proto.isObject()) {
+        throwError(exec, TypeError, "instanceof called on an object with an invalid prototype property.");
         return false;
+    }
 
     JSObject* object = asObject(value);
-    while ((object = object->prototype()->getObject())) {
+    while ((object = object->prototype().getObject())) {
         if (proto == object)
             return true;
     }
@@ -411,7 +420,8 @@ bool JSObject::propertyIsEnumerable(ExecState* exec, const Identifier& propertyN
 
 bool JSObject::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
 {
-    if (m_structure->get(propertyName, attributes) != WTF::notFound)
+    JSCell* specificValue;
+    if (m_structure->get(propertyName, attributes, specificValue) != WTF::notFound)
         return true;
     
     // Look in the static hashtable of properties
@@ -424,6 +434,19 @@ bool JSObject::getPropertyAttributes(ExecState* exec, const Identifier& property
     return false;
 }
 
+bool JSObject::getPropertySpecificValue(ExecState*, const Identifier& propertyName, JSCell*& specificValue) const
+{
+    unsigned attributes;
+    if (m_structure->get(propertyName, attributes, specificValue) != WTF::notFound)
+        return true;
+
+    // This could be a function within the static table? - should probably
+    // also look in the hash?  This currently should not be a problem, since
+    // we've currently always call 'get' first, which should have populated
+    // the normal storage.
+    return false;
+}
+
 void JSObject::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     m_structure->getEnumerablePropertyNames(exec, propertyNames, this);
@@ -436,18 +459,18 @@ bool JSObject::toBoolean(ExecState*) const
 
 double JSObject::toNumber(ExecState* exec) const
 {
-    JSValuePtr primitive = toPrimitive(exec, PreferNumber);
+    JSValue primitive = toPrimitive(exec, PreferNumber);
     if (exec->hadException()) // should be picked up soon in Nodes.cpp
         return 0.0;
-    return primitive->toNumber(exec);
+    return primitive.toNumber(exec);
 }
 
 UString JSObject::toString(ExecState* exec) const
 {
-    JSValuePtr primitive = toPrimitive(exec, PreferString);
+    JSValue primitive = toPrimitive(exec, PreferString);
     if (exec->hadException())
         return "";
-    return primitive->toString(exec);
+    return primitive.toString(exec);
 }
 
 JSObject* JSObject::toObject(ExecState*) const
@@ -471,27 +494,27 @@ void JSObject::removeDirect(const Identifier& propertyName)
     if (m_structure->isDictionary()) {
         offset = m_structure->removePropertyWithoutTransition(propertyName);
         if (offset != WTF::notFound)
-            m_propertyStorage[offset] = jsUndefined();
+            putDirectOffset(offset, jsUndefined());
         return;
     }
 
     RefPtr<Structure> structure = Structure::removePropertyTransition(m_structure, propertyName, offset);
-    if (offset != WTF::notFound)
-        m_propertyStorage[offset] = jsUndefined();
     setStructure(structure.release());
+    if (offset != WTF::notFound)
+        putDirectOffset(offset, jsUndefined());
 }
 
 void JSObject::putDirectFunction(ExecState* exec, InternalFunction* function, unsigned attr)
 {
-    putDirect(Identifier(exec, function->name(&exec->globalData())), function, attr);
+    putDirectFunction(Identifier(exec, function->name(&exec->globalData())), function, attr);
 }
 
 void JSObject::putDirectFunctionWithoutTransition(ExecState* exec, InternalFunction* function, unsigned attr)
 {
-    putDirectWithoutTransition(Identifier(exec, function->name(&exec->globalData())), function, attr);
+    putDirectFunctionWithoutTransition(Identifier(exec, function->name(&exec->globalData())), function, attr);
 }
 
-NEVER_INLINE void JSObject::fillGetterPropertySlot(PropertySlot& slot, JSValuePtr* location)
+NEVER_INLINE void JSObject::fillGetterPropertySlot(PropertySlot& slot, JSValue* location)
 {
     if (JSObject* getterFunction = asGetterSetter(*location)->getter())
         slot.setGetterSlot(getterFunction);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
index 5918b9d..db47ac7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSObject.h
@@ -32,9 +32,17 @@
 #include "PutPropertySlot.h"
 #include "ScopeChain.h"
 #include "Structure.h"
+#include "JSGlobalData.h"
 
 namespace JSC {
 
+    inline JSCell* getJSFunction(JSGlobalData& globalData, JSValue value)
+    {
+        if (value.isCell() && (value.asCell()->vptr() == globalData.jsFunctionVPtr))
+            return value.asCell();
+        return 0;
+    }
+
     class InternalFunction;
     class PropertyNameArray;
     class Structure;
@@ -49,9 +57,12 @@ namespace JSC {
         DontEnum     = 1 << 2,  // property doesn't appear in (for .. in ..)
         DontDelete   = 1 << 3,  // property can't be deleted
         Function     = 1 << 4,  // property is a function - only used by static hashtables
+        Getter       = 1 << 5,  // property is a getter
+        Setter       = 1 << 6   // property is a setter
     };
 
-    typedef JSValuePtr* PropertyStorage;
+    typedef EncodedJSValue* PropertyStorage;
+    typedef const EncodedJSValue* ConstPropertyStorage;
 
     class JSObject : public JSCell {
         friend class BatchedTransitionOptimizer;
@@ -69,18 +80,16 @@ namespace JSC {
 
         bool inherits(const ClassInfo* classInfo) const { return JSCell::isObject(classInfo); }
 
-        JSValuePtr prototype() const;
-        void setPrototype(JSValuePtr prototype);
+        JSValue prototype() const;
+        void setPrototype(JSValue prototype);
         
         void setStructure(PassRefPtr<Structure>);
         Structure* inheritorID();
 
-        PropertyStorage& propertyStorage() { return m_propertyStorage; }
-
         virtual UString className() const;
 
-        JSValuePtr get(ExecState*, const Identifier& propertyName) const;
-        JSValuePtr get(ExecState*, unsigned propertyName) const;
+        JSValue get(ExecState*, const Identifier& propertyName) const;
+        JSValue get(ExecState*, unsigned propertyName) const;
 
         bool getPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         bool getPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
@@ -88,11 +97,12 @@ namespace JSC {
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
 
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr value, PutPropertySlot&);
-        virtual void put(ExecState*, unsigned propertyName, JSValuePtr value);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue value, PutPropertySlot&);
+        virtual void put(ExecState*, unsigned propertyName, JSValue value);
 
-        virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValuePtr value, unsigned attributes);
-        virtual void putWithAttributes(ExecState*, unsigned propertyName, JSValuePtr value, unsigned attributes);
+        virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot);
+        virtual void putWithAttributes(ExecState*, const Identifier& propertyName, JSValue value, unsigned attributes);
+        virtual void putWithAttributes(ExecState*, unsigned propertyName, JSValue value, unsigned attributes);
 
         bool propertyIsEnumerable(ExecState*, const Identifier& propertyName) const;
 
@@ -103,14 +113,14 @@ namespace JSC {
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
 
-        virtual JSValuePtr defaultValue(ExecState*, PreferredPrimitiveType) const;
+        virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
 
-        virtual bool hasInstance(ExecState*, JSValuePtr, JSValuePtr prototypeProperty);
+        virtual bool hasInstance(ExecState*, JSValue, JSValue prototypeProperty);
 
         virtual void getPropertyNames(ExecState*, PropertyNameArray&);
 
-        virtual JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValuePtr& value);
+        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
+        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual UString toString(ExecState*) const;
@@ -120,34 +130,31 @@ namespace JSC {
         virtual JSObject* unwrappedObject();
 
         virtual bool getPropertyAttributes(ExecState*, const Identifier& propertyName, unsigned& attributes) const;
+        bool getPropertySpecificValue(ExecState* exec, const Identifier& propertyName, JSCell*& specificFunction) const;
 
         // This get function only looks at the property map.
-        JSValuePtr getDirect(const Identifier& propertyName) const
+        JSValue getDirect(const Identifier& propertyName) const
         {
             size_t offset = m_structure->get(propertyName);
-            return offset != WTF::notFound ? m_propertyStorage[offset] : noValue();
+            return offset != WTF::notFound ? getDirectOffset(offset) : JSValue();
         }
 
-        JSValuePtr* getDirectLocation(const Identifier& propertyName)
+        JSValue* getDirectLocation(const Identifier& propertyName)
         {
             size_t offset = m_structure->get(propertyName);
             return offset != WTF::notFound ? locationForOffset(offset) : 0;
         }
 
-        JSValuePtr* getDirectLocation(const Identifier& propertyName, unsigned& attributes)
+        JSValue* getDirectLocation(const Identifier& propertyName, unsigned& attributes)
         {
-            size_t offset = m_structure->get(propertyName, attributes);
+            JSCell* specificFunction;
+            size_t offset = m_structure->get(propertyName, attributes, specificFunction);
             return offset != WTF::notFound ? locationForOffset(offset) : 0;
         }
 
-        size_t offsetForLocation(JSValuePtr* location)
-        {
-            return location - m_propertyStorage;
-        }
-
-        JSValuePtr* locationForOffset(size_t offset)
+        size_t offsetForLocation(JSValue* location) const
         {
-            return &m_propertyStorage[offset];
+            return location - reinterpret_cast<const JSValue*>(propertyStorage());
         }
 
         void transitionTo(Structure*);
@@ -156,44 +163,64 @@ namespace JSC {
         bool hasCustomProperties() { return !m_structure->isEmpty(); }
         bool hasGetterSetterProperties() { return m_structure->hasGetterSetterProperties(); }
 
-        void putDirect(const Identifier& propertyName, JSValuePtr value, unsigned attr = 0);
-        void putDirect(const Identifier& propertyName, JSValuePtr value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot);
+        void putDirect(const Identifier& propertyName, JSValue value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot);
+        void putDirect(const Identifier& propertyName, JSValue value, unsigned attr = 0);
+
+        void putDirectFunction(const Identifier& propertyName, JSCell* value, unsigned attr = 0);
+        void putDirectFunction(const Identifier& propertyName, JSCell* value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot);
         void putDirectFunction(ExecState* exec, InternalFunction* function, unsigned attr = 0);
-        void putDirectWithoutTransition(const Identifier& propertyName, JSValuePtr value, unsigned attr = 0);
+
+        void putDirectWithoutTransition(const Identifier& propertyName, JSValue value, unsigned attr = 0);
+        void putDirectFunctionWithoutTransition(const Identifier& propertyName, JSCell* value, unsigned attr = 0);
         void putDirectFunctionWithoutTransition(ExecState* exec, InternalFunction* function, unsigned attr = 0);
 
         // Fast access to known property offsets.
-        JSValuePtr getDirectOffset(size_t offset) { return m_propertyStorage[offset]; }
-        void putDirectOffset(size_t offset, JSValuePtr value) { m_propertyStorage[offset] = value; }
+        JSValue getDirectOffset(size_t offset) const { return JSValue::decode(propertyStorage()[offset]); }
+        void putDirectOffset(size_t offset, JSValue value) { propertyStorage()[offset] = JSValue::encode(value); }
 
-        void fillGetterPropertySlot(PropertySlot&, JSValuePtr* location);
+        void fillGetterPropertySlot(PropertySlot&, JSValue* location);
 
         virtual void defineGetter(ExecState*, const Identifier& propertyName, JSObject* getterFunction);
         virtual void defineSetter(ExecState*, const Identifier& propertyName, JSObject* setterFunction);
-        virtual JSValuePtr lookupGetter(ExecState*, const Identifier& propertyName);
-        virtual JSValuePtr lookupSetter(ExecState*, const Identifier& propertyName);
+        virtual JSValue lookupGetter(ExecState*, const Identifier& propertyName);
+        virtual JSValue lookupSetter(ExecState*, const Identifier& propertyName);
 
         virtual bool isGlobalObject() const { return false; }
         virtual bool isVariableObject() const { return false; }
+        virtual bool isActivationObject() const { return false; }
         virtual bool isWatchdogException() const { return false; }
         virtual bool isNotAnObjectErrorStub() const { return false; }
 
         void allocatePropertyStorage(size_t oldSize, size_t newSize);
         void allocatePropertyStorageInline(size_t oldSize, size_t newSize);
-        bool usingInlineStorage() const { return m_propertyStorage == m_inlineStorage; }
+        bool isUsingInlineStorage() const { return m_structure->isUsingInlineStorage(); }
 
-        static const size_t inlineStorageCapacity = 2;
+        static const size_t inlineStorageCapacity = 3;
         static const size_t nonInlineBaseStorageCapacity = 16;
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType, HasStandardGetOwnPropertySlot));
         }
 
-    protected:
-        bool getOwnPropertySlotForWrite(ExecState*, const Identifier&, PropertySlot&, bool& slotIsWriteable);
-
     private:
+        ConstPropertyStorage propertyStorage() const { return (isUsingInlineStorage() ? m_inlineStorage : m_externalStorage); }
+        PropertyStorage propertyStorage() { return (isUsingInlineStorage() ? m_inlineStorage : m_externalStorage); }
+
+        const JSValue* locationForOffset(size_t offset) const
+        {
+            return reinterpret_cast<const JSValue*>(&propertyStorage()[offset]);
+        }
+
+        JSValue* locationForOffset(size_t offset)
+        {
+            return reinterpret_cast<JSValue*>(&propertyStorage()[offset]);
+        }
+
+        void putDirectInternal(const Identifier& propertyName, JSValue value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot, JSCell*);
+        void putDirectInternal(JSGlobalData&, const Identifier& propertyName, JSValue value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot);
+        void putDirectInternal(JSGlobalData&, const Identifier& propertyName, JSValue value, unsigned attr = 0);
+
         bool inlineGetOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
 
         const HashEntry* findPropertyHashEntry(ExecState*, const Identifier& propertyName) const;
@@ -201,15 +228,17 @@ namespace JSC {
 
         RefPtr<Structure> m_inheritorID;
 
-        PropertyStorage m_propertyStorage;        
-        JSValuePtr m_inlineStorage[inlineStorageCapacity];
+        union {
+            PropertyStorage m_externalStorage;
+            EncodedJSValue m_inlineStorage[inlineStorageCapacity];
+        };
     };
 
-    JSObject* asObject(JSValuePtr);
+    JSObject* asObject(JSValue);
 
     JSObject* constructEmptyObject(ExecState*);
 
-inline JSObject* asObject(JSValuePtr value)
+inline JSObject* asObject(JSValue value)
 {
     ASSERT(asCell(value)->isObject());
     return static_cast<JSObject*>(asCell(value));
@@ -217,28 +246,27 @@ inline JSObject* asObject(JSValuePtr value)
 
 inline JSObject::JSObject(PassRefPtr<Structure> structure)
     : JSCell(structure.releaseRef()) // ~JSObject balances this ref()
-    , m_propertyStorage(m_inlineStorage)
 {
     ASSERT(m_structure);
     ASSERT(m_structure->propertyStorageCapacity() == inlineStorageCapacity);
     ASSERT(m_structure->isEmpty());
-    ASSERT(prototype()->isNull() || Heap::heap(this) == Heap::heap(prototype()));
+    ASSERT(prototype().isNull() || Heap::heap(this) == Heap::heap(prototype()));
 }
 
 inline JSObject::~JSObject()
 {
     ASSERT(m_structure);
-    if (m_propertyStorage != m_inlineStorage)
-        delete [] m_propertyStorage;
+    if (!isUsingInlineStorage())
+        delete [] m_externalStorage;
     m_structure->deref();
 }
 
-inline JSValuePtr JSObject::prototype() const
+inline JSValue JSObject::prototype() const
 {
     return m_structure->storedPrototype();
 }
 
-inline void JSObject::setPrototype(JSValuePtr prototype)
+inline void JSObject::setPrototype(JSValue prototype)
 {
     ASSERT(prototype);
     RefPtr<Structure> newStructure = Structure::changePrototypeTransition(m_structure, prototype);
@@ -258,6 +286,11 @@ inline Structure* JSObject::inheritorID()
     return createInheritorID();
 }
 
+inline bool Structure::isUsingInlineStorage() const
+{
+    return (propertyStorageCapacity() == JSObject::inlineStorageCapacity);
+}
+
 inline bool JSCell::isObject(const ClassInfo* info) const
 {
     for (const ClassInfo* ci = classInfo(); ci; ci = ci->parentClass) {
@@ -270,13 +303,13 @@ inline bool JSCell::isObject(const ClassInfo* info) const
 // this method is here to be after the inline declaration of JSCell::isObject
 inline bool JSValue::isObject(const ClassInfo* classInfo) const
 {
-    return !JSImmediate::isImmediate(asValue()) && asCell()->isObject(classInfo);
+    return isCell() && asCell()->isObject(classInfo);
 }
 
 ALWAYS_INLINE bool JSObject::inlineGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    if (JSValuePtr* location = getDirectLocation(propertyName)) {
-        if (m_structure->hasGetterSetterProperties() && location[0]->isGetterSetter())
+    if (JSValue* location = getDirectLocation(propertyName)) {
+        if (m_structure->hasGetterSetterProperties() && location[0].isGetterSetter())
             fillGetterPropertySlot(slot, location);
         else
             slot.setValueSlot(this, location, offsetForLocation(location));
@@ -292,30 +325,6 @@ ALWAYS_INLINE bool JSObject::inlineGetOwnPropertySlot(ExecState* exec, const Ide
     return false;
 }
 
-ALWAYS_INLINE bool JSObject::getOwnPropertySlotForWrite(ExecState* exec, const Identifier& propertyName, PropertySlot& slot, bool& slotIsWriteable)
-{
-    unsigned attributes;
-    if (JSValuePtr* location = getDirectLocation(propertyName, attributes)) {
-        if (m_structure->hasGetterSetterProperties() && location[0]->isGetterSetter()) {
-            slotIsWriteable = false;
-            fillGetterPropertySlot(slot, location);
-        } else {
-            slotIsWriteable = !(attributes & ReadOnly);
-            slot.setValueSlot(this, location, offsetForLocation(location));
-        }
-        return true;
-    }
-
-    // non-standard Netscape extension
-    if (propertyName == exec->propertyNames().underscoreProto) {
-        slot.setValue(prototype());
-        slotIsWriteable = false;
-        return true;
-    }
-
-    return false;
-}
-
 // It may seem crazy to inline a function this large, especially a virtual function,
 // but it makes a big difference to property lookup that derived classes can inline their
 // base class call to this.
@@ -339,8 +348,8 @@ inline bool JSObject::getPropertySlot(ExecState* exec, const Identifier& propert
     while (true) {
         if (object->fastGetOwnPropertySlot(exec, propertyName, slot))
             return true;
-        JSValuePtr prototype = object->prototype();
-        if (!prototype->isObject())
+        JSValue prototype = object->prototype();
+        if (!prototype.isObject())
             return false;
         object = asObject(prototype);
     }
@@ -352,14 +361,14 @@ inline bool JSObject::getPropertySlot(ExecState* exec, unsigned propertyName, Pr
     while (true) {
         if (object->getOwnPropertySlot(exec, propertyName, slot))
             return true;
-        JSValuePtr prototype = object->prototype();
-        if (!prototype->isObject())
+        JSValue prototype = object->prototype();
+        if (!prototype.isObject())
             return false;
         object = asObject(prototype);
     }
 }
 
-inline JSValuePtr JSObject::get(ExecState* exec, const Identifier& propertyName) const
+inline JSValue JSObject::get(ExecState* exec, const Identifier& propertyName) const
 {
     PropertySlot slot(this);
     if (const_cast<JSObject*>(this)->getPropertySlot(exec, propertyName, slot))
@@ -368,7 +377,7 @@ inline JSValuePtr JSObject::get(ExecState* exec, const Identifier& propertyName)
     return jsUndefined();
 }
 
-inline JSValuePtr JSObject::get(ExecState* exec, unsigned propertyName) const
+inline JSValue JSObject::get(ExecState* exec, unsigned propertyName) const
 {
     PropertySlot slot(this);
     if (const_cast<JSObject*>(this)->getPropertySlot(exec, propertyName, slot))
@@ -377,80 +386,139 @@ inline JSValuePtr JSObject::get(ExecState* exec, unsigned propertyName) const
     return jsUndefined();
 }
 
-inline void JSObject::putDirect(const Identifier& propertyName, JSValuePtr value, unsigned attr)
-{
-    PutPropertySlot slot;
-    putDirect(propertyName, value, attr, false, slot);
-}
-
-inline void JSObject::putDirect(const Identifier& propertyName, JSValuePtr value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
+inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot, JSCell* specificFunction)
 {
+    ASSERT(value);
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
     if (m_structure->isDictionary()) {
         unsigned currentAttributes;
-        size_t offset = m_structure->get(propertyName, currentAttributes);
+        JSCell* currentSpecificFunction;
+        size_t offset = m_structure->get(propertyName, currentAttributes, currentSpecificFunction);
         if (offset != WTF::notFound) {
+            if (currentSpecificFunction && (specificFunction != currentSpecificFunction))
+                m_structure->despecifyDictionaryFunction(propertyName);
             if (checkReadOnly && currentAttributes & ReadOnly)
                 return;
-            m_propertyStorage[offset] = value;
-            slot.setExistingProperty(this, offset);
+            putDirectOffset(offset, value);
+            if (!specificFunction && !currentSpecificFunction)
+                slot.setExistingProperty(this, offset);
             return;
         }
 
         size_t currentCapacity = m_structure->propertyStorageCapacity();
-        offset = m_structure->addPropertyWithoutTransition(propertyName, attributes);
+        offset = m_structure->addPropertyWithoutTransition(propertyName, attributes, specificFunction);
         if (currentCapacity != m_structure->propertyStorageCapacity())
             allocatePropertyStorage(currentCapacity, m_structure->propertyStorageCapacity());
 
         ASSERT(offset < m_structure->propertyStorageCapacity());
-        m_propertyStorage[offset] = value;
-        slot.setNewProperty(this, offset);
+        putDirectOffset(offset, value);
+        // See comment on setNewProperty call below.
+        if (!specificFunction)
+            slot.setNewProperty(this, offset);
         return;
     }
 
     size_t offset;
     size_t currentCapacity = m_structure->propertyStorageCapacity();
-    if (RefPtr<Structure> structure = Structure::addPropertyTransitionToExistingStructure(m_structure, propertyName, attributes, offset)) {
+    if (RefPtr<Structure> structure = Structure::addPropertyTransitionToExistingStructure(m_structure, propertyName, attributes, specificFunction, offset)) {    
         if (currentCapacity != structure->propertyStorageCapacity())
             allocatePropertyStorage(currentCapacity, structure->propertyStorageCapacity());
 
         ASSERT(offset < structure->propertyStorageCapacity());
-        m_propertyStorage[offset] = value;
-        slot.setNewProperty(this, offset);
-        slot.setWasTransition(true);
         setStructure(structure.release());
+        putDirectOffset(offset, value);
+        // See comment on setNewProperty call below.
+        if (!specificFunction)
+            slot.setNewProperty(this, offset);
         return;
     }
 
     unsigned currentAttributes;
-    offset = m_structure->get(propertyName, currentAttributes);
+    JSCell* currentSpecificFunction;
+    offset = m_structure->get(propertyName, currentAttributes, currentSpecificFunction);
     if (offset != WTF::notFound) {
         if (checkReadOnly && currentAttributes & ReadOnly)
             return;
-        m_propertyStorage[offset] = value;
+
+        if (currentSpecificFunction && (specificFunction != currentSpecificFunction)) {
+            setStructure(Structure::despecifyFunctionTransition(m_structure, propertyName));
+            putDirectOffset(offset, value);
+            // Function transitions are not currently cachable, so leave the slot in an uncachable state.
+            return;
+        }
+        putDirectOffset(offset, value);
         slot.setExistingProperty(this, offset);
         return;
     }
 
-    RefPtr<Structure> structure = Structure::addPropertyTransition(m_structure, propertyName, attributes, offset);
+    RefPtr<Structure> structure = Structure::addPropertyTransition(m_structure, propertyName, attributes, specificFunction, offset);
     if (currentCapacity != structure->propertyStorageCapacity())
         allocatePropertyStorage(currentCapacity, structure->propertyStorageCapacity());
 
     ASSERT(offset < structure->propertyStorageCapacity());
-    m_propertyStorage[offset] = value;
-    slot.setNewProperty(this, offset);
-    slot.setWasTransition(true);
     setStructure(structure.release());
+    putDirectOffset(offset, value);
+    // Function transitions are not currently cachable, so leave the slot in an uncachable state.
+    if (!specificFunction)
+        slot.setNewProperty(this, offset);
+}
+
+inline void JSObject::putDirectInternal(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
+{
+    ASSERT(value);
+    ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
+
+    putDirectInternal(propertyName, value, attributes, checkReadOnly, slot, getJSFunction(globalData, value));
+}
+
+inline void JSObject::putDirectInternal(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, unsigned attributes)
+{
+    PutPropertySlot slot;
+    putDirectInternal(propertyName, value, attributes, false, slot, getJSFunction(globalData, value));
+}
+
+inline void JSObject::putDirect(const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
+{
+    ASSERT(value);
+    ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
+
+    putDirectInternal(propertyName, value, attributes, checkReadOnly, slot, 0);
+}
+
+inline void JSObject::putDirect(const Identifier& propertyName, JSValue value, unsigned attributes)
+{
+    PutPropertySlot slot;
+    putDirectInternal(propertyName, value, attributes, false, slot, 0);
+}
+
+inline void JSObject::putDirectFunction(const Identifier& propertyName, JSCell* value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
+{
+    putDirectInternal(propertyName, value, attributes, checkReadOnly, slot, value);
+}
+
+inline void JSObject::putDirectFunction(const Identifier& propertyName, JSCell* value, unsigned attr)
+{
+    PutPropertySlot slot;
+    putDirectInternal(propertyName, value, attr, false, slot, value);
 }
 
-inline void JSObject::putDirectWithoutTransition(const Identifier& propertyName, JSValuePtr value, unsigned attributes)
+inline void JSObject::putDirectWithoutTransition(const Identifier& propertyName, JSValue value, unsigned attributes)
 {
     size_t currentCapacity = m_structure->propertyStorageCapacity();
-    size_t offset = m_structure->addPropertyWithoutTransition(propertyName, attributes);
+    size_t offset = m_structure->addPropertyWithoutTransition(propertyName, attributes, 0);
     if (currentCapacity != m_structure->propertyStorageCapacity())
         allocatePropertyStorage(currentCapacity, m_structure->propertyStorageCapacity());
-    m_propertyStorage[offset] = value;
+    putDirectOffset(offset, value);
+}
+
+inline void JSObject::putDirectFunctionWithoutTransition(const Identifier& propertyName, JSCell* value, unsigned attributes)
+{
+    size_t currentCapacity = m_structure->propertyStorageCapacity();
+    size_t offset = m_structure->addPropertyWithoutTransition(propertyName, attributes, value);
+    if (currentCapacity != m_structure->propertyStorageCapacity())
+        allocatePropertyStorage(currentCapacity, m_structure->propertyStorageCapacity());
+    putDirectOffset(offset, value);
 }
 
 inline void JSObject::transitionTo(Structure* newStructure)
@@ -460,21 +528,23 @@ inline void JSObject::transitionTo(Structure* newStructure)
     setStructure(newStructure);
 }
 
-inline JSValuePtr JSObject::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
+inline JSValue JSObject::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
 {
     return defaultValue(exec, preferredType);
 }
 
-inline JSValuePtr JSValue::get(ExecState* exec, const Identifier& propertyName) const
+inline JSValue JSValue::get(ExecState* exec, const Identifier& propertyName) const
 {
-    PropertySlot slot(this);
+    PropertySlot slot(asValue());
     return get(exec, propertyName, slot);
 }
 
-inline JSValuePtr JSValue::get(ExecState* exec, const Identifier& propertyName, PropertySlot& slot) const
+inline JSValue JSValue::get(ExecState* exec, const Identifier& propertyName, PropertySlot& slot) const
 {
-    if (UNLIKELY(JSImmediate::isImmediate(asValue()))) {
+    if (UNLIKELY(!isCell())) {
         JSObject* prototype = JSImmediate::prototype(asValue(), exec);
+        if (propertyName == exec->propertyNames().underscoreProto)
+            return prototype;
         if (!prototype->getPropertySlot(exec, propertyName, slot))
             return jsUndefined();
         return slot.getValue(exec, propertyName);
@@ -484,22 +554,22 @@ inline JSValuePtr JSValue::get(ExecState* exec, const Identifier& propertyName,
         if (cell->fastGetOwnPropertySlot(exec, propertyName, slot))
             return slot.getValue(exec, propertyName);
         ASSERT(cell->isObject());
-        JSValuePtr prototype = static_cast<JSObject*>(cell)->prototype();
-        if (!prototype->isObject())
+        JSValue prototype = static_cast<JSObject*>(cell)->prototype();
+        if (!prototype.isObject())
             return jsUndefined();
         cell = asObject(prototype);
     }
 }
 
-inline JSValuePtr JSValue::get(ExecState* exec, unsigned propertyName) const
+inline JSValue JSValue::get(ExecState* exec, unsigned propertyName) const
 {
-    PropertySlot slot(this);
+    PropertySlot slot(asValue());
     return get(exec, propertyName, slot);
 }
 
-inline JSValuePtr JSValue::get(ExecState* exec, unsigned propertyName, PropertySlot& slot) const
+inline JSValue JSValue::get(ExecState* exec, unsigned propertyName, PropertySlot& slot) const
 {
-    if (UNLIKELY(JSImmediate::isImmediate(asValue()))) {
+    if (UNLIKELY(!isCell())) {
         JSObject* prototype = JSImmediate::prototype(asValue(), exec);
         if (!prototype->getPropertySlot(exec, propertyName, slot))
             return jsUndefined();
@@ -510,25 +580,25 @@ inline JSValuePtr JSValue::get(ExecState* exec, unsigned propertyName, PropertyS
         if (cell->getOwnPropertySlot(exec, propertyName, slot))
             return slot.getValue(exec, propertyName);
         ASSERT(cell->isObject());
-        JSValuePtr prototype = static_cast<JSObject*>(cell)->prototype();
-        if (!prototype->isObject())
+        JSValue prototype = static_cast<JSObject*>(cell)->prototype();
+        if (!prototype.isObject())
             return jsUndefined();
-        cell = prototype->asCell();
+        cell = prototype.asCell();
     }
 }
 
-inline void JSValue::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+inline void JSValue::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    if (UNLIKELY(JSImmediate::isImmediate(asValue()))) {
+    if (UNLIKELY(!isCell())) {
         JSImmediate::toObject(asValue(), exec)->put(exec, propertyName, value, slot);
         return;
     }
     asCell()->put(exec, propertyName, value, slot);
 }
 
-inline void JSValue::put(ExecState* exec, unsigned propertyName, JSValuePtr value)
+inline void JSValue::put(ExecState* exec, unsigned propertyName, JSValue value)
 {
-    if (UNLIKELY(JSImmediate::isImmediate(asValue()))) {
+    if (UNLIKELY(!isCell())) {
         JSImmediate::toObject(asValue(), exec)->put(exec, propertyName, value);
         return;
     }
@@ -539,14 +609,20 @@ ALWAYS_INLINE void JSObject::allocatePropertyStorageInline(size_t oldSize, size_
 {
     ASSERT(newSize > oldSize);
 
-    JSValuePtr* oldPropertyStorage = m_propertyStorage;
-    m_propertyStorage = new JSValuePtr[newSize];
+    // It's important that this function not rely on m_structure, since
+    // we might be in the middle of a transition.
+    bool wasInline = (oldSize == JSObject::inlineStorageCapacity);
+
+    PropertyStorage oldPropertyStorage = (wasInline ? m_inlineStorage : m_externalStorage);
+    PropertyStorage newPropertyStorage = new EncodedJSValue[newSize];
 
     for (unsigned i = 0; i < oldSize; ++i)
-        m_propertyStorage[i] = oldPropertyStorage[i];
+       newPropertyStorage[i] = oldPropertyStorage[i];
 
-    if (oldPropertyStorage != m_inlineStorage)
+    if (!wasInline)
         delete [] oldPropertyStorage;
+
+    m_externalStorage = newPropertyStorage;
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
index ec8efea..8c7b53d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.cpp
@@ -37,13 +37,13 @@ JSPropertyNameIterator::~JSPropertyNameIterator()
 {
 }
 
-JSValuePtr JSPropertyNameIterator::toPrimitive(ExecState*, PreferredPrimitiveType) const
+JSValue JSPropertyNameIterator::toPrimitive(ExecState*, PreferredPrimitiveType) const
 {
     ASSERT_NOT_REACHED();
-    return noValue();
+    return JSValue();
 }
 
-bool JSPropertyNameIterator::getPrimitiveNumber(ExecState*, double&, JSValuePtr&)
+bool JSPropertyNameIterator::getPrimitiveNumber(ExecState*, double&, JSValue&)
 {
     ASSERT_NOT_REACHED();
     return false;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
index fddb4f6..9817c07 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSPropertyNameIterator.h
@@ -40,12 +40,12 @@ namespace JSC {
 
     class JSPropertyNameIterator : public JSCell {
     public:
-        static JSPropertyNameIterator* create(ExecState*, JSValuePtr);
+        static JSPropertyNameIterator* create(ExecState*, JSValue);
 
         virtual ~JSPropertyNameIterator();
 
-        virtual JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType) const;
-        virtual bool getPrimitiveNumber(ExecState*, double&, JSValuePtr&);
+        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
+        virtual bool getPrimitiveNumber(ExecState*, double&, JSValue&);
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual UString toString(ExecState*) const;
@@ -53,7 +53,7 @@ namespace JSC {
 
         virtual void mark();
 
-        JSValuePtr next(ExecState*);
+        JSValue next(ExecState*);
         void invalidate();
 
     private:
@@ -83,23 +83,23 @@ inline JSPropertyNameIterator::JSPropertyNameIterator(JSObject* object, PassRefP
 {
 }
 
-inline JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSValuePtr v)
+inline JSPropertyNameIterator* JSPropertyNameIterator::create(ExecState* exec, JSValue v)
 {
-    if (v->isUndefinedOrNull())
+    if (v.isUndefinedOrNull())
         return new (exec) JSPropertyNameIterator;
 
-    JSObject* o = v->toObject(exec);
+    JSObject* o = v.toObject(exec);
     PropertyNameArray propertyNames(exec);
     o->getPropertyNames(exec, propertyNames);
     return new (exec) JSPropertyNameIterator(o, propertyNames.releaseData());
 }
 
-inline JSValuePtr JSPropertyNameIterator::next(ExecState* exec)
+inline JSValue JSPropertyNameIterator::next(ExecState* exec)
 {
     if (m_position == m_end)
-        return noValue();
+        return JSValue();
 
-    if (m_data->cachedStructure() == m_object->structure() && structureChainsAreEqual(m_data->cachedPrototypeChain(), m_object->structure()->cachedPrototypeChain()))
+    if (m_data->cachedStructure() == m_object->structure() && m_data->cachedPrototypeChain() == m_object->structure()->prototypeChain(exec))
         return jsOwnedString(exec, (*m_position++).ustring());
 
     do {
@@ -108,7 +108,7 @@ inline JSValuePtr JSPropertyNameIterator::next(ExecState* exec)
         m_position++;
     } while (m_position != m_end);
 
-    return noValue();
+    return JSValue();
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.cpp
index 4196822..85907c8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.cpp
@@ -44,7 +44,7 @@ JSObject* JSStaticScopeObject::toThisObject(ExecState* exec) const
     return exec->globalThisValue();
 }
 
-void JSStaticScopeObject::put(ExecState*, const Identifier& propertyName, JSValuePtr value, PutPropertySlot&)
+void JSStaticScopeObject::put(ExecState*, const Identifier& propertyName, JSValue value, PutPropertySlot&)
 {
     if (symbolTablePut(propertyName, value))
         return;
@@ -52,7 +52,7 @@ void JSStaticScopeObject::put(ExecState*, const Identifier& propertyName, JSValu
     ASSERT_NOT_REACHED();
 }
 
-void JSStaticScopeObject::putWithAttributes(ExecState*, const Identifier& propertyName, JSValuePtr value, unsigned attributes)
+void JSStaticScopeObject::putWithAttributes(ExecState*, const Identifier& propertyName, JSValue value, unsigned attributes)
 {
     if (symbolTablePutWithAttributes(propertyName, value, attributes))
         return;
@@ -76,9 +76,4 @@ inline bool JSStaticScopeObject::getOwnPropertySlot(ExecState*, const Identifier
     return symbolTableGet(propertyName, slot);
 }
 
-inline bool JSStaticScopeObject::getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot& slot, bool& slotIsWriteable)
-{
-    return symbolTableGet(propertyName, slot, slotIsWriteable);
-}
-
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
index e1400b7..2caf540 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSStaticScopeObject.h
@@ -43,7 +43,7 @@ namespace JSC{
         };
         
     public:
-        JSStaticScopeObject(ExecState* exec, const Identifier& ident, JSValuePtr value, unsigned attributes)
+        JSStaticScopeObject(ExecState* exec, const Identifier& ident, JSValue value, unsigned attributes)
             : JSVariableObject(exec->globalData().staticScopeStructure, new JSStaticScopeObjectData())
         {
             d()->registerStore = value;
@@ -54,11 +54,10 @@ namespace JSC{
         bool isDynamicScope() const;
         virtual JSObject* toThisObject(ExecState*) const;
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
-        virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&, bool& slotIsWriteable);
-        virtual void put(ExecState*, const Identifier&, JSValuePtr, PutPropertySlot&);
-        void putWithAttributes(ExecState*, const Identifier&, JSValuePtr, unsigned attributes);
+        virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
+        void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes);
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto) { return Structure::create(proto, TypeInfo(ObjectType, NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(ObjectType, NeedsThisConversion)); }
 
     private:
         JSStaticScopeObjectData* d() { return static_cast<JSStaticScopeObjectData*>(JSVariableObject::d); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
index e644bf6..86f95e0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.cpp
@@ -30,12 +30,12 @@
 
 namespace JSC {
 
-JSValuePtr JSString::toPrimitive(ExecState*, PreferredPrimitiveType) const
+JSValue JSString::toPrimitive(ExecState*, PreferredPrimitiveType) const
 {
     return const_cast<JSString*>(this);
 }
 
-bool JSString::getPrimitiveNumber(ExecState*, double& number, JSValuePtr& value)
+bool JSString::getPrimitiveNumber(ExecState*, double& number, JSValue& value)
 {
     value = this;
     number = m_value.toDouble();
@@ -88,9 +88,13 @@ bool JSString::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNam
     // This function should only be called by JSValue::get.
     if (getStringPropertySlot(exec, propertyName, slot))
         return true;
+    if (propertyName == exec->propertyNames().underscoreProto) {
+        slot.setValue(exec->lexicalGlobalObject()->stringPrototype());
+        return true;
+    }
     slot.setBase(this);
     JSObject* object;
-    for (JSValuePtr prototype = exec->lexicalGlobalObject()->stringPrototype(); !prototype->isNull(); prototype = object->prototype()) {
+    for (JSValue prototype = exec->lexicalGlobalObject()->stringPrototype(); !prototype.isNull(); prototype = object->prototype()) {
         object = asObject(prototype);
         if (object->getOwnPropertySlot(exec, propertyName, slot))
             return true;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
index a584a3c..900c565 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSString.h
@@ -60,7 +60,7 @@ namespace JSC {
 
     class JSString : public JSCell {
         friend class JIT;
-        friend class Interpreter;
+        friend class VPtrSet;
 
     public:
         JSString(JSGlobalData* globalData, const UString& value)
@@ -90,7 +90,7 @@ namespace JSC {
         bool canGetIndex(unsigned i) { return i < static_cast<unsigned>(m_value.size()); }
         JSString* getIndex(JSGlobalData*, unsigned);
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto) { return Structure::create(proto, TypeInfo(StringType, NeedsThisConversion)); }
+        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(StringType, NeedsThisConversion)); }
 
     private:
         enum VPtrStealingHackType { VPtrStealingHack };
@@ -99,8 +99,8 @@ namespace JSC {
         {
         }
 
-        virtual JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType) const;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValuePtr& value);
+        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
+        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
         virtual bool toBoolean(ExecState*) const;
         virtual double toNumber(ExecState*) const;
         virtual JSObject* toObject(ExecState*) const;
@@ -117,9 +117,9 @@ namespace JSC {
         UString m_value;
     };
 
-    JSString* asString(JSValuePtr);
+    JSString* asString(JSValue);
 
-    inline JSString* asString(JSValuePtr value)
+    inline JSString* asString(JSValue value)
     {
         ASSERT(asCell(value)->isString());
         return static_cast<JSString*>(asCell(value));
@@ -202,6 +202,8 @@ namespace JSC {
         return false;
     }
 
+    inline bool isJSString(JSGlobalData* globalData, JSValue v) { return v.isCell() && v.asCell()->vptr() == globalData->jsStringVPtr; }
+
     // --- JSValue inlines ----------------------------
 
     inline JSString* JSValue::toThisJSString(ExecState* exec)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
index 73580b0..885914d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.cpp
@@ -33,18 +33,16 @@ static const double D32 = 4294967296.0;
 // ECMA 9.4
 double JSValue::toInteger(ExecState* exec) const
 {
-    int32_t i;
-    if (getTruncatedInt32(i))
-        return i;
+    if (isInt32Fast())
+        return getInt32Fast();
     double d = toNumber(exec);
     return isnan(d) ? 0.0 : trunc(d);
 }
 
 double JSValue::toIntegerPreserveNaN(ExecState* exec) const
 {
-    int32_t i;
-    if (getTruncatedInt32(i))
-        return i;
+    if (isInt32Fast())
+        return getInt32Fast();
     return trunc(toNumber(exec));
 }
 
@@ -68,11 +66,6 @@ int32_t toInt32SlowCase(double d, bool& ok)
     return static_cast<int32_t>(d32);
 }
 
-int32_t JSValue::toInt32SlowCase(ExecState* exec, bool& ok) const
-{
-    return JSC::toInt32SlowCase(toNumber(exec), ok);
-}
-
 uint32_t toUInt32SlowCase(double d, bool& ok)
 {
     ok = true;
@@ -91,14 +84,4 @@ uint32_t toUInt32SlowCase(double d, bool& ok)
     return static_cast<uint32_t>(d32);
 }
 
-uint32_t JSValue::toUInt32SlowCase(ExecState* exec, bool& ok) const
-{
-    return JSC::toUInt32SlowCase(toNumber(exec), ok);
-}
-
-float JSValue::toFloat(ExecState* exec) const
-{
-    return static_cast<float>(toNumber(exec));
-}
-
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
index f04b67f..391425c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSValue.h
@@ -28,12 +28,15 @@
 
 #include "CallData.h"
 #include "ConstructData.h"
-#include <wtf/Noncopyable.h>
+#include <wtf/HashTraits.h>
+#include <wtf/AlwaysInline.h>
 
 namespace JSC {
 
     class Identifier;
     class JSCell;
+    class JSGlobalData;
+    class JSImmediate;
     class JSObject;
     class JSString;
     class PropertySlot;
@@ -45,12 +48,67 @@ namespace JSC {
 
     enum PreferredPrimitiveType { NoPreference, PreferNumber, PreferString };
 
-    class JSValue : Noncopyable {
-    protected:
-        JSValue() { }
-        virtual ~JSValue() { }
+    typedef void* EncodedJSValue;
+
+    class JSValue {
+        friend class JSImmediate;
+        friend struct JSValueHashTraits;
 
+        static JSValue makeImmediate(intptr_t value)
+        {
+            return JSValue(reinterpret_cast<JSCell*>(value));
+        }
+
+        intptr_t immediateValue()
+        {
+            return reinterpret_cast<intptr_t>(m_ptr);
+        }
+        
     public:
+        enum JSNullTag { JSNull };
+        enum JSUndefinedTag { JSUndefined };
+        enum JSTrueTag { JSTrue };
+        enum JSFalseTag { JSFalse };
+
+        static EncodedJSValue encode(JSValue value);
+        static JSValue decode(EncodedJSValue ptr);
+
+        JSValue();
+        JSValue(JSNullTag);
+        JSValue(JSUndefinedTag);
+        JSValue(JSTrueTag);
+        JSValue(JSFalseTag);
+        JSValue(JSCell* ptr);
+        JSValue(const JSCell* ptr);
+
+        // Numbers
+        JSValue(ExecState*, double);
+        JSValue(ExecState*, char);
+        JSValue(ExecState*, unsigned char);
+        JSValue(ExecState*, short);
+        JSValue(ExecState*, unsigned short);
+        JSValue(ExecState*, int);
+        JSValue(ExecState*, unsigned);
+        JSValue(ExecState*, long);
+        JSValue(ExecState*, unsigned long);
+        JSValue(ExecState*, long long);
+        JSValue(ExecState*, unsigned long long);
+        JSValue(JSGlobalData*, double);
+        JSValue(JSGlobalData*, char);
+        JSValue(JSGlobalData*, unsigned char);
+        JSValue(JSGlobalData*, short);
+        JSValue(JSGlobalData*, unsigned short);
+        JSValue(JSGlobalData*, int);
+        JSValue(JSGlobalData*, unsigned);
+        JSValue(JSGlobalData*, long);
+        JSValue(JSGlobalData*, unsigned long);
+        JSValue(JSGlobalData*, long long);
+        JSValue(JSGlobalData*, unsigned long long);
+
+        operator bool() const;
+        bool operator==(const JSValue other) const;
+        bool operator!=(const JSValue other) const;
+
         // Querying the type.
         bool isUndefined() const;
         bool isNull() const;
@@ -65,7 +123,7 @@ namespace JSC {
         // Extracting the value.
         bool getBoolean(bool&) const;
         bool getBoolean() const; // false if not a boolean
-        double getNumber() const; // NaN if not a number
+        bool getNumber(double&) const;
         double uncheckedGetNumber() const;
         bool getString(UString&) const;
         UString getString() const; // null string if not a string
@@ -80,143 +138,282 @@ namespace JSC {
         bool getTruncatedUInt32(uint32_t&) const;
         
         // Basic conversions.
-        JSValuePtr toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
-        bool getPrimitiveNumber(ExecState*, double& number, JSValuePtr&);
+        JSValue toPrimitive(ExecState*, PreferredPrimitiveType = NoPreference) const;
+        bool getPrimitiveNumber(ExecState*, double& number, JSValue&);
 
         bool toBoolean(ExecState*) const;
 
         // toNumber conversion is expected to be side effect free if an exception has
         // been set in the ExecState already.
         double toNumber(ExecState*) const;
-        JSValuePtr toJSNumber(ExecState*) const; // Fast path for when you expect that the value is an immediate number.
-
+        JSValue toJSNumber(ExecState*) const; // Fast path for when you expect that the value is an immediate number.
         UString toString(ExecState*) const;
         JSObject* toObject(ExecState*) const;
 
         // Integer conversions.
+        // 'x.numberToInt32(output)' is equivalent to 'x.isNumber() && x.toInt32(output)'
         double toInteger(ExecState*) const;
         double toIntegerPreserveNaN(ExecState*) const;
         int32_t toInt32(ExecState*) const;
         int32_t toInt32(ExecState*, bool& ok) const;
+        bool numberToInt32(int32_t& arg);
         uint32_t toUInt32(ExecState*) const;
         uint32_t toUInt32(ExecState*, bool& ok) const;
-
-        // Floating point conversions.
-        float toFloat(ExecState*) const;
+        bool numberToUInt32(uint32_t& arg);
+
+        // Fast integer operations; these values return results where the value is trivially available
+        // in a convenient form, for use in optimizations.  No assumptions should be made based on the
+        // results of these operations, for example !isInt32Fast() does not necessarily indicate the
+        // result of getNumber will not be 0.
+        bool isInt32Fast() const;
+        int32_t getInt32Fast() const;
+        bool isUInt32Fast() const;
+        uint32_t getUInt32Fast() const;
+        static JSValue makeInt32Fast(int32_t);
+        static bool areBothInt32Fast(JSValue, JSValue);
+
+        // Floating point conversions (this is a convenience method for webcore;
+        // signle precision float is not a representation used in JS or JSC).
+        float toFloat(ExecState* exec) const { return static_cast<float>(toNumber(exec)); }
+
+        // API Mangled Numbers
+        bool isAPIMangledNumber();
 
         // Garbage collection.
         void mark();
         bool marked() const;
 
         // Object operations, with the toObject operation included.
-        JSValuePtr get(ExecState*, const Identifier& propertyName) const;
-        JSValuePtr get(ExecState*, const Identifier& propertyName, PropertySlot&) const;
-        JSValuePtr get(ExecState*, unsigned propertyName) const;
-        JSValuePtr get(ExecState*, unsigned propertyName, PropertySlot&) const;
-        void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
-        void put(ExecState*, unsigned propertyName, JSValuePtr);
-        bool deleteProperty(ExecState*, const Identifier& propertyName);
-        bool deleteProperty(ExecState*, unsigned propertyName);
+        JSValue get(ExecState*, const Identifier& propertyName) const;
+        JSValue get(ExecState*, const Identifier& propertyName, PropertySlot&) const;
+        JSValue get(ExecState*, unsigned propertyName) const;
+        JSValue get(ExecState*, unsigned propertyName, PropertySlot&) const;
+        void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
+        void put(ExecState*, unsigned propertyName, JSValue);
 
         bool needsThisConversion() const;
         JSObject* toThisObject(ExecState*) const;
         UString toThisString(ExecState*) const;
         JSString* toThisJSString(ExecState*);
 
-        JSValuePtr getJSNumber(); // 0 if this is not a JSNumber or number object
+        static bool equal(ExecState* exec, JSValue v1, JSValue v2);
+        static bool equalSlowCase(ExecState* exec, JSValue v1, JSValue v2);
+        static bool equalSlowCaseInline(ExecState* exec, JSValue v1, JSValue v2);
+        static bool strictEqual(JSValue v1, JSValue v2);
+        static bool strictEqualSlowCase(JSValue v1, JSValue v2);
+        static bool strictEqualSlowCaseInline(JSValue v1, JSValue v2);
 
-        JSValuePtr asValue() const;
+        JSValue getJSNumber(); // JSValue() if this is not a JSNumber or number object
 
+        bool isCell() const;
         JSCell* asCell() const;
 
     private:
-        bool getPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
-        bool getPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
-        int32_t toInt32SlowCase(ExecState*, bool& ok) const;
-        uint32_t toUInt32SlowCase(ExecState*, bool& ok) const;
+        enum HashTableDeletedValueTag { HashTableDeletedValue };
+        JSValue(HashTableDeletedValueTag);
+
+        inline const JSValue asValue() const { return *this; }
+
+        bool isDoubleNumber() const;
+        double getDoubleNumber() const;
+
+        JSCell* m_ptr;
     };
 
-    class JSImmediate;
-    class JSValueEncodedAsPointer;
+    struct JSValueHashTraits : HashTraits<EncodedJSValue> {
+        static void constructDeletedValue(EncodedJSValue& slot) { slot = JSValue::encode(JSValue(JSValue::HashTableDeletedValue)); }
+        static bool isDeletedValue(EncodedJSValue value) { return value == JSValue::encode(JSValue(JSValue::HashTableDeletedValue)); }
+    };
 
-    class JSValuePtr {
-        friend class JSImmediate;
+    // Stand-alone helper functions.
+    inline JSValue jsNull()
+    {
+        return JSValue(JSValue::JSNull);
+    }
 
-        static JSValuePtr makeImmediate(intptr_t value)
-        {
-            return JSValuePtr(reinterpret_cast<JSValue*>(value));
-        }
+    inline JSValue jsUndefined()
+    {
+        return JSValue(JSValue::JSUndefined);
+    }
 
-        intptr_t immediateValue()
-        {
-            return reinterpret_cast<intptr_t>(m_ptr);
-        }
-        
-    public:
-        JSValuePtr()
-            : m_ptr(0)
-        {
-        }
+    inline JSValue jsBoolean(bool b)
+    {
+        return b ? JSValue(JSValue::JSTrue) : JSValue(JSValue::JSFalse);
+    }
 
-        JSValuePtr(JSValue* ptr)
-            : m_ptr(ptr)
-        {
-        }
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, double d)
+    {
+        return JSValue(exec, d);
+    }
 
-        JSValuePtr(const JSValue* ptr)
-            : m_ptr(const_cast<JSValue*>(ptr))
-        {
-        }
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, char i)
+    {
+        return JSValue(exec, i);
+    }
 
-        JSValue* operator->() const
-        {
-            return m_ptr;
-        }
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, unsigned char i)
+    {
+        return JSValue(exec, i);
+    }
 
-        operator bool() const
-        {
-            return m_ptr;
-        }
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, short i)
+    {
+        return JSValue(exec, i);
+    }
 
-        bool operator==(const JSValuePtr other) const
-        {
-            return m_ptr == other.m_ptr;
-        }
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, unsigned short i)
+    {
+        return JSValue(exec, i);
+    }
 
-        bool operator!=(const JSValuePtr other) const
-        {
-            return m_ptr != other.m_ptr;
-        }
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, int i)
+    {
+        return JSValue(exec, i);
+    }
 
-        static JSValueEncodedAsPointer* encode(JSValuePtr value)
-        {
-            return reinterpret_cast<JSValueEncodedAsPointer*>(value.m_ptr);
-        }
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, unsigned i)
+    {
+        return JSValue(exec, i);
+    }
 
-        static JSValuePtr decode(JSValueEncodedAsPointer* ptr)
-        {
-            return JSValuePtr(reinterpret_cast<JSValue*>(ptr));
-        }
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, long i)
+    {
+        return JSValue(exec, i);
+    }
 
-    private:
-        JSValue* m_ptr;
-    };
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, unsigned long i)
+    {
+        return JSValue(exec, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, long long i)
+    {
+        return JSValue(exec, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(ExecState* exec, unsigned long long i)
+    {
+        return JSValue(exec, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, double d)
+    {
+        return JSValue(globalData, d);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, char i)
+    {
+        return JSValue(globalData, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, unsigned char i)
+    {
+        return JSValue(globalData, i);
+    }
 
-    inline JSValuePtr JSValue::asValue() const
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, short i)
     {
-        return JSValuePtr(this);
+        return JSValue(globalData, i);
     }
 
-    inline JSValuePtr noValue()
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, unsigned short i)
     {
-        return JSValuePtr();
+        return JSValue(globalData, i);
     }
 
-    inline bool operator==(const JSValuePtr a, const JSValue* b) { return a == JSValuePtr(b); }
-    inline bool operator==(const JSValue* a, const JSValuePtr b) { return JSValuePtr(a) == b; }
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, int i)
+    {
+        return JSValue(globalData, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, unsigned i)
+    {
+        return JSValue(globalData, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, long i)
+    {
+        return JSValue(globalData, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, unsigned long i)
+    {
+        return JSValue(globalData, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, long long i)
+    {
+        return JSValue(globalData, i);
+    }
+
+    ALWAYS_INLINE JSValue jsNumber(JSGlobalData* globalData, unsigned long long i)
+    {
+        return JSValue(globalData, i);
+    }
 
-    inline bool operator!=(const JSValuePtr a, const JSValue* b) { return a != JSValuePtr(b); }
-    inline bool operator!=(const JSValue* a, const JSValuePtr b) { return JSValuePtr(a) != b; }
+    inline bool operator==(const JSValue a, const JSCell* b) { return a == JSValue(b); }
+    inline bool operator==(const JSCell* a, const JSValue b) { return JSValue(a) == b; }
+
+    inline bool operator!=(const JSValue a, const JSCell* b) { return a != JSValue(b); }
+    inline bool operator!=(const JSCell* a, const JSValue b) { return JSValue(a) != b; }
+
+    // JSValue member functions.
+    inline EncodedJSValue JSValue::encode(JSValue value)
+    {
+        return reinterpret_cast<EncodedJSValue>(value.m_ptr);
+    }
+
+    inline JSValue JSValue::decode(EncodedJSValue ptr)
+    {
+        return JSValue(reinterpret_cast<JSCell*>(ptr));
+    }
+
+    // 0x0 can never occur naturally because it has a tag of 00, indicating a pointer value, but a payload of 0x0, which is in the (invalid) zero page.
+    inline JSValue::JSValue()
+        : m_ptr(0)
+    {
+    }
+
+    // 0x4 can never occur naturally because it has a tag of 00, indicating a pointer value, but a payload of 0x4, which is in the (invalid) zero page.
+    inline JSValue::JSValue(HashTableDeletedValueTag)
+        : m_ptr(reinterpret_cast<JSCell*>(0x4))
+    {
+    }
+
+    inline JSValue::JSValue(JSCell* ptr)
+        : m_ptr(ptr)
+    {
+    }
+
+    inline JSValue::JSValue(const JSCell* ptr)
+        : m_ptr(const_cast<JSCell*>(ptr))
+    {
+    }
+
+    inline JSValue::operator bool() const
+    {
+        return m_ptr;
+    }
+
+    inline bool JSValue::operator==(const JSValue other) const
+    {
+        return m_ptr == other.m_ptr;
+    }
+
+    inline bool JSValue::operator!=(const JSValue other) const
+    {
+        return m_ptr != other.m_ptr;
+    }
+
+    inline bool JSValue::isUndefined() const
+    {
+        return asValue() == jsUndefined();
+    }
+
+    inline bool JSValue::isNull() const
+    {
+        return asValue() == jsNull();
+    }
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
index 9bf5c4f..b969da5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSVariableObject.h
@@ -46,7 +46,7 @@ namespace JSC {
     public:
         SymbolTable& symbolTable() const { return *d->symbolTable; }
 
-        virtual void putWithAttributes(ExecState*, const Identifier&, JSValuePtr, unsigned attributes) = 0;
+        virtual void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes) = 0;
 
         virtual bool deleteProperty(ExecState*, const Identifier&);
         virtual void getPropertyNames(ExecState*, PropertyNameArray&);
@@ -90,8 +90,8 @@ namespace JSC {
 
         bool symbolTableGet(const Identifier&, PropertySlot&);
         bool symbolTableGet(const Identifier&, PropertySlot&, bool& slotIsWriteable);
-        bool symbolTablePut(const Identifier&, JSValuePtr);
-        bool symbolTablePutWithAttributes(const Identifier&, JSValuePtr, unsigned attributes);
+        bool symbolTablePut(const Identifier&, JSValue);
+        bool symbolTablePutWithAttributes(const Identifier&, JSValue, unsigned attributes);
 
         JSVariableObjectData* d;
     };
@@ -117,7 +117,7 @@ namespace JSC {
         return false;
     }
 
-    inline bool JSVariableObject::symbolTablePut(const Identifier& propertyName, JSValuePtr value)
+    inline bool JSVariableObject::symbolTablePut(const Identifier& propertyName, JSValue value)
     {
         ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
@@ -130,7 +130,7 @@ namespace JSC {
         return true;
     }
 
-    inline bool JSVariableObject::symbolTablePutWithAttributes(const Identifier& propertyName, JSValuePtr value, unsigned attributes)
+    inline bool JSVariableObject::symbolTablePutWithAttributes(const Identifier& propertyName, JSValue value, unsigned attributes)
     {
         ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.cpp
index c791d93..fb57018 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.cpp
@@ -29,8 +29,8 @@ ASSERT_CLASS_FITS_IN_CELL(JSWrapperObject);
 void JSWrapperObject::mark() 
 {
     JSObject::mark();
-    if (m_internalValue && !m_internalValue->marked())
-        m_internalValue->mark();
+    if (m_internalValue && !m_internalValue.marked())
+        m_internalValue.mark();
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
index 4ca96f4..2a2e3c6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/JSWrapperObject.h
@@ -33,25 +33,24 @@ namespace JSC {
         explicit JSWrapperObject(PassRefPtr<Structure>);
 
     public:
-        JSValuePtr internalValue() const { return m_internalValue; }
-        void setInternalValue(JSValuePtr);
+        JSValue internalValue() const { return m_internalValue; }
+        void setInternalValue(JSValue);
         
         virtual void mark();
         
     private:
-        JSValuePtr m_internalValue;
+        JSValue m_internalValue;
     };
     
     inline JSWrapperObject::JSWrapperObject(PassRefPtr<Structure> structure)
         : JSObject(structure)
-        , m_internalValue(noValue())
     {
     }
     
-    inline void JSWrapperObject::setInternalValue(JSValuePtr value)
+    inline void JSWrapperObject::setInternalValue(JSValue value)
     {
         ASSERT(value);
-        ASSERT(!value->isObject());
+        ASSERT(!value.isObject());
         m_internalValue = value;
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.cpp
new file mode 100644
index 0000000..3f3fab9
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.cpp
@@ -0,0 +1,449 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "LiteralParser.h"
+
+#include "JSArray.h"
+#include "JSString.h"
+#include "Lexer.h"
+#include <wtf/ASCIICType.h>
+#include <wtf/dtoa.h>
+
+namespace JSC {
+
+LiteralParser::TokenType LiteralParser::Lexer::lex(LiteralParserToken& token)
+{
+    while (m_ptr < m_end && isASCIISpace(*m_ptr))
+        ++m_ptr;
+
+    ASSERT(m_ptr <= m_end);
+    if (m_ptr >= m_end) {
+        token.type = TokEnd;
+        token.start = token.end = m_ptr;
+        return TokEnd;
+    }
+    token.type = TokError;
+    token.start = m_ptr;
+    switch (*m_ptr) {
+        case '[':
+            token.type = TokLBracket;
+            token.end = ++m_ptr;
+            return TokLBracket;
+        case ']':
+            token.type = TokRBracket;
+            token.end = ++m_ptr;
+            return TokRBracket;
+        case '(':
+            token.type = TokLParen;
+            token.end = ++m_ptr;
+            return TokLBracket;
+        case ')':
+            token.type = TokRParen;
+            token.end = ++m_ptr;
+            return TokRBracket;
+        case '{':
+            token.type = TokLBrace;
+            token.end = ++m_ptr;
+            return TokLBrace;
+        case '}':
+            token.type = TokRBrace;
+            token.end = ++m_ptr;
+            return TokRBrace;
+        case ',':
+            token.type = TokComma;
+            token.end = ++m_ptr;
+            return TokComma;
+        case ':':
+            token.type = TokColon;
+            token.end = ++m_ptr;
+            return TokColon;
+        case '"':
+            if (m_mode == StrictJSON)
+                return lexString<StrictJSON>(token);
+            return lexString<NonStrictJSON>(token);
+        case 't':
+            if (m_end - m_ptr >= 4 && m_ptr[1] == 'r' && m_ptr[2] == 'u' && m_ptr[3] == 'e') {
+                m_ptr += 4;
+                token.type = TokTrue;
+                token.end = m_ptr;
+                return TokTrue;
+            }
+            break;
+        case 'f':
+            if (m_end - m_ptr >= 5 && m_ptr[1] == 'a' && m_ptr[2] == 'l' && m_ptr[3] == 's' && m_ptr[4] == 'e') {
+                m_ptr += 5;
+                token.type = TokFalse;
+                token.end = m_ptr;
+                return TokFalse;
+            }
+            break;
+        case 'n':
+            if (m_end - m_ptr >= 4 && m_ptr[1] == 'u' && m_ptr[2] == 'l' && m_ptr[3] == 'l') {
+                m_ptr += 4;
+                token.type = TokNull;
+                token.end = m_ptr;
+                return TokNull;
+            }
+            break;    
+        case '-':
+        case '0':
+        case '1':
+        case '2':
+        case '3':
+        case '4':
+        case '5':
+        case '6':
+        case '7':
+        case '8':
+        case '9':
+            return lexNumber(token);
+    }
+    return TokError;
+}
+
+static inline bool isSafeStringCharacter(UChar c)
+{
+    return (c >= ' ' && c <= 0xff && c != '\\' && c != '"') || c == '\t';
+}
+
+template <LiteralParser::ParserMode mode> LiteralParser::TokenType LiteralParser::Lexer::lexString(LiteralParserToken& token)
+{
+    ++m_ptr;
+    const UChar* runStart;
+    token.stringToken = UString();
+    do {
+        runStart = m_ptr;
+        while (m_ptr < m_end && isSafeStringCharacter(*m_ptr))
+            ++m_ptr;
+        if (runStart < m_ptr)
+            token.stringToken.append(runStart, m_ptr - runStart);
+        if ((mode == StrictJSON) && m_ptr < m_end && *m_ptr == '\\') {
+            ++m_ptr;
+            if (m_ptr >= m_end)
+                return TokError;
+            switch (*m_ptr) {
+                case '"':
+                    token.stringToken.append('"');
+                    m_ptr++;
+                    break;
+                case '\\':
+                    token.stringToken.append('\\');
+                    m_ptr++;
+                    break;
+                case '/':
+                    token.stringToken.append('/');
+                    m_ptr++;
+                    break;
+                case 'b':
+                    token.stringToken.append('\b');
+                    m_ptr++;
+                    break;
+                case 'f':
+                    token.stringToken.append('\f');
+                    m_ptr++;
+                    break;
+                case 'n':
+                    token.stringToken.append('\n');
+                    m_ptr++;
+                    break;
+                case 'r':
+                    token.stringToken.append('\r');
+                    m_ptr++;
+                    break;
+                case 't':
+                    token.stringToken.append('\t');
+                    m_ptr++;
+                    break;
+
+                case 'u':
+                    if ((m_end - m_ptr) < 5) // uNNNN == 5 characters
+                        return TokError;
+                    for (int i = 1; i < 5; i++) {
+                        if (!isASCIIHexDigit(m_ptr[i]))
+                            return TokError;
+                    }
+                    token.stringToken.append(JSC::Lexer::convertUnicode(m_ptr[1], m_ptr[2], m_ptr[3], m_ptr[4]));
+                    m_ptr += 5;
+                    break;
+
+                default:
+                    return TokError;
+            }
+        }
+    } while ((mode == StrictJSON) && m_ptr != runStart && (m_ptr < m_end) && *m_ptr != '"');
+
+    if (m_ptr >= m_end || *m_ptr != '"')
+        return TokError;
+
+    token.type = TokString;
+    token.end = ++m_ptr;
+    return TokString;
+}
+
+LiteralParser::TokenType LiteralParser::Lexer::lexNumber(LiteralParserToken& token)
+{
+    // ES5 and json.org define numbers as
+    // number
+    //     int
+    //     int frac? exp?
+    //
+    // int
+    //     -? 0
+    //     -? digit1-9 digits?
+    //
+    // digits
+    //     digit digits?
+    //
+    // -?(0 | [1-9][0-9]*) ('.' [0-9]+)? ([eE][+-]? [0-9]+)?
+
+    if (m_ptr < m_end && *m_ptr == '-') // -?
+        ++m_ptr;
+    
+    // (0 | [1-9][0-9]*)
+    if (m_ptr < m_end && *m_ptr == '0') // 0
+        ++m_ptr;
+    else if (m_ptr < m_end && *m_ptr >= '1' && *m_ptr <= '9') { // [1-9]
+        ++m_ptr;
+        // [0-9]*
+        while (m_ptr < m_end && isASCIIDigit(*m_ptr))
+            ++m_ptr;
+    } else
+        return TokError;
+
+    // ('.' [0-9]+)?
+    if (m_ptr < m_end && *m_ptr == '.') {
+        ++m_ptr;
+        // [0-9]+
+        if (m_ptr >= m_end || !isASCIIDigit(*m_ptr))
+            return TokError;
+
+        ++m_ptr;
+        while (m_ptr < m_end && isASCIIDigit(*m_ptr))
+            ++m_ptr;
+    }
+
+    //  ([eE][+-]? [0-9]+)?
+    if (m_ptr < m_end && (*m_ptr == 'e' || *m_ptr == 'E')) { // [eE]
+        ++m_ptr;
+
+        // [-+]?
+        if (m_ptr < m_end && (*m_ptr == '-' || *m_ptr == '+'))
+            ++m_ptr;
+
+        // [0-9]+
+        if (m_ptr >= m_end || !isASCIIDigit(*m_ptr))
+            return TokError;
+        
+        ++m_ptr;
+        while (m_ptr < m_end && isASCIIDigit(*m_ptr))
+            ++m_ptr;
+    }
+    
+    token.type = TokNumber;
+    token.end = m_ptr;
+    Vector<char, 64> buffer(token.end - token.start + 1);
+    int i;
+    for (i = 0; i < token.end - token.start; i++) {
+        ASSERT(static_cast<char>(token.start[i]) == token.start[i]);
+        buffer[i] = static_cast<char>(token.start[i]);
+    }
+    buffer[i] = 0;
+    char* end;
+    token.numberToken = WTF::strtod(buffer.data(), &end);
+    ASSERT(buffer.data() + (token.end - token.start) == end);
+    return TokNumber;
+}
+
+JSValue LiteralParser::parse(ParserState initialState)
+{
+    ParserState state = initialState;
+    MarkedArgumentBuffer objectStack;
+    JSValue lastValue;
+    Vector<ParserState, 16> stateStack;
+    Vector<Identifier, 16> identifierStack;
+    while (1) {
+        switch(state) {
+            startParseArray:
+            case StartParseArray: {
+                JSArray* array = constructEmptyArray(m_exec);
+                objectStack.append(array);
+                // fallthrough
+            }
+            doParseArrayStartExpression:
+            case DoParseArrayStartExpression: {
+                if (m_lexer.next() == TokRBracket) {
+                    m_lexer.next();
+                    lastValue = objectStack.last();
+                    objectStack.removeLast();
+                    break;
+                }
+
+                stateStack.append(DoParseArrayEndExpression);
+                goto startParseExpression;
+            }
+            case DoParseArrayEndExpression: {
+                 asArray(objectStack.last())->push(m_exec, lastValue);
+                
+                if (m_lexer.currentToken().type == TokComma)
+                    goto doParseArrayStartExpression;
+
+                if (m_lexer.currentToken().type != TokRBracket)
+                    return JSValue();
+                
+                m_lexer.next();
+                lastValue = objectStack.last();
+                objectStack.removeLast();
+                break;
+            }
+            startParseObject:
+            case StartParseObject: {
+                JSObject* object = constructEmptyObject(m_exec);
+                objectStack.append(object);
+
+                TokenType type = m_lexer.next();
+                if (type == TokString) {
+                    Lexer::LiteralParserToken identifierToken = m_lexer.currentToken();
+
+                    // Check for colon
+                    if (m_lexer.next() != TokColon)
+                        return JSValue();
+                    
+                    m_lexer.next();
+                    identifierStack.append(Identifier(m_exec, identifierToken.stringToken));
+                    stateStack.append(DoParseObjectEndExpression);
+                    goto startParseExpression;
+                } else if (type != TokRBrace) 
+                    return JSValue();
+                m_lexer.next();
+                lastValue = objectStack.last();
+                objectStack.removeLast();
+                break;
+            }
+            doParseObjectStartExpression:
+            case DoParseObjectStartExpression: {
+                TokenType type = m_lexer.next();
+                if (type != TokString)
+                    return JSValue();
+                Lexer::LiteralParserToken identifierToken = m_lexer.currentToken();
+
+                // Check for colon
+                if (m_lexer.next() != TokColon)
+                    return JSValue();
+
+                m_lexer.next();
+                identifierStack.append(Identifier(m_exec, identifierToken.stringToken));
+                stateStack.append(DoParseObjectEndExpression);
+                goto startParseExpression;
+            }
+            case DoParseObjectEndExpression:
+            {
+                asObject(objectStack.last())->putDirect(identifierStack.last(), lastValue);
+                identifierStack.removeLast();
+                if (m_lexer.currentToken().type == TokComma)
+                    goto doParseObjectStartExpression;
+                if (m_lexer.currentToken().type != TokRBrace)
+                    return JSValue();
+                m_lexer.next();
+                lastValue = objectStack.last();
+                objectStack.removeLast();
+                break;
+            }
+            startParseExpression:
+            case StartParseExpression: {
+                switch (m_lexer.currentToken().type) {
+                    case TokLBracket:
+                        goto startParseArray;
+                    case TokLBrace:
+                        goto startParseObject;
+                    case TokString: {
+                        Lexer::LiteralParserToken stringToken = m_lexer.currentToken();
+                        m_lexer.next();
+                        lastValue = jsString(m_exec, stringToken.stringToken);
+                        break;
+                    }
+                    case TokNumber: {
+                        Lexer::LiteralParserToken numberToken = m_lexer.currentToken();
+                        m_lexer.next();
+                        lastValue = jsNumber(m_exec, numberToken.numberToken);
+                        break;
+                    }
+                    case TokNull:
+                        m_lexer.next();
+                        lastValue = jsNull();
+                        break;
+
+                    case TokTrue:
+                        m_lexer.next();
+                        lastValue = jsBoolean(true);
+                        break;
+
+                    case TokFalse:
+                        m_lexer.next();
+                        lastValue = jsBoolean(false);
+                        break;
+
+                    default:
+                        // Error
+                        return JSValue();
+                }
+                break;
+            }
+            case StartParseStatement: {
+                switch (m_lexer.currentToken().type) {
+                    case TokLBracket:
+                    case TokNumber:
+                    case TokString:
+                        goto startParseExpression;
+
+                    case TokLParen: {
+                        m_lexer.next();
+                        stateStack.append(StartParseStatementEndStatement);
+                        goto startParseExpression;
+                    }
+                    default:
+                        return JSValue();
+                }
+            }
+            case StartParseStatementEndStatement: {
+                ASSERT(stateStack.isEmpty());
+                if (m_lexer.currentToken().type != TokRParen)
+                    return JSValue();
+                if (m_lexer.next() == TokEnd)
+                    return lastValue;
+                return JSValue();
+            }
+            default:
+                ASSERT_NOT_REACHED();
+        }
+        if (stateStack.isEmpty())
+            return lastValue;
+        state = stateStack.last();
+        stateStack.removeLast();
+        continue;
+    }
+}
+
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.h b/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.h
new file mode 100644
index 0000000..bceee7c
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/LiteralParser.h
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef LiteralParser_h
+#define LiteralParser_h
+
+#include "JSGlobalObjectFunctions.h"
+#include "JSValue.h"
+#include "UString.h"
+
+namespace JSC {
+
+    class LiteralParser {
+    public:
+        typedef enum { StrictJSON, NonStrictJSON } ParserMode;
+        LiteralParser(ExecState* exec, const UString& s, ParserMode mode)
+            : m_exec(exec)
+            , m_lexer(s, mode)
+            , m_mode(mode)
+        {
+        }
+        
+        JSValue tryLiteralParse()
+        {
+            m_lexer.next();
+            JSValue result = parse(m_mode == StrictJSON ? StartParseExpression : StartParseStatement);
+            if (m_lexer.currentToken().type != TokEnd)
+                return JSValue();
+            return result;
+        }
+    private:
+        enum ParserState { StartParseObject, StartParseArray, StartParseExpression, 
+                           StartParseStatement, StartParseStatementEndStatement, 
+                           DoParseObjectStartExpression, DoParseObjectEndExpression,
+                           DoParseArrayStartExpression, DoParseArrayEndExpression };
+        enum TokenType { TokLBracket, TokRBracket, TokLBrace, TokRBrace, 
+                         TokString, TokIdentifier, TokNumber, TokColon, 
+                         TokLParen, TokRParen, TokComma, TokTrue, TokFalse,
+                         TokNull, TokEnd, TokError };
+
+        class Lexer {
+        public:
+            struct LiteralParserToken {
+                TokenType type;
+                const UChar* start;
+                const UChar* end;
+                UString stringToken;
+                double numberToken;
+            };
+            Lexer(const UString& s, ParserMode mode)
+                : m_string(s)
+                , m_mode(mode)
+                , m_ptr(s.data())
+                , m_end(s.data() + s.size())
+            {
+            }
+            
+            TokenType next()
+            {
+                return lex(m_currentToken);
+            }
+            
+            const LiteralParserToken& currentToken()
+            {
+                return m_currentToken;
+            }
+            
+        private:
+            TokenType lex(LiteralParserToken&);
+            template <ParserMode parserMode> TokenType lexString(LiteralParserToken&);
+            TokenType lexNumber(LiteralParserToken&);
+            LiteralParserToken m_currentToken;
+            UString m_string;
+            ParserMode m_mode;
+            const UChar* m_ptr;
+            const UChar* m_end;
+        };
+        
+        class StackGuard;
+        JSValue parse(ParserState);
+
+        ExecState* m_exec;
+        LiteralParser::Lexer m_lexer;
+        ParserMode m_mode;
+    };
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.cpp
index 98133a8..8359ff7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.cpp
@@ -20,25 +20,13 @@
 #include "config.h"
 #include "Lookup.h"
 
+#include "JSFunction.h"
 #include "PrototypeFunction.h"
 
 namespace JSC {
 
 void HashTable::createTable(JSGlobalData* globalData) const
 {
-#if ENABLE(PERFECT_HASH_SIZE)
-    ASSERT(!table);
-    HashEntry* entries = new HashEntry[hashSizeMask + 1];
-    for (int i = 0; i <= hashSizeMask; ++i)
-        entries[i].setKey(0);
-    for (int i = 0; values[i].key; ++i) {
-        UString::Rep* identifier = Identifier::add(globalData, values[i].key).releaseRef();
-        int hashIndex = identifier->computedHash() & hashSizeMask;
-        ASSERT(!entries[hashIndex].key());
-        entries[hashIndex].initialize(identifier, values[i].attributes, values[i].value1, values[i].value2);
-    }
-    table = entries;
-#else
     ASSERT(!table);
     int linkIndex = compactHashSizeMask + 1;
     HashEntry* entries = new HashEntry[compactSize];
@@ -61,17 +49,12 @@ void HashTable::createTable(JSGlobalData* globalData) const
         entry->initialize(identifier, values[i].attributes, values[i].value1, values[i].value2);
     }
     table = entries;
-#endif
 }
 
 void HashTable::deleteTable() const
 {
     if (table) {
-#if ENABLE(PERFECT_HASH_SIZE)
-        int max = hashSizeMask + 1;
-#else
         int max = compactSize;
-#endif
         for (int i = 0; i != max; ++i) {
             if (UString::Rep* key = table[i].key())
                 key->deref();
@@ -84,11 +67,12 @@ void HashTable::deleteTable() const
 void setUpStaticFunctionSlot(ExecState* exec, const HashEntry* entry, JSObject* thisObj, const Identifier& propertyName, PropertySlot& slot)
 {
     ASSERT(entry->attributes() & Function);
-    JSValuePtr* location = thisObj->getDirectLocation(propertyName);
+    JSValue* location = thisObj->getDirectLocation(propertyName);
 
     if (!location) {
-        PrototypeFunction* function = new (exec) PrototypeFunction(exec, entry->functionLength(), propertyName, entry->function());
-        thisObj->putDirect(propertyName, function, entry->attributes());
+        InternalFunction* function = new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), entry->functionLength(), propertyName, entry->function());
+
+        thisObj->putDirectFunction(propertyName, function, entry->attributes());
         location = thisObj->getDirectLocation(propertyName);
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
index 55c3221..3b7353d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Lookup.h
@@ -23,17 +23,12 @@
 
 #include "CallFrame.h"
 #include "Identifier.h"
-#include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "JSObject.h"
 #include "PropertySlot.h"
 #include <stdio.h>
 #include <wtf/Assertions.h>
 
-// Set ENABLE_PERFECT_HASH_SIZE to 0 to save memory at the
-// cost of speed.  Test your platform as results may vary.
-#define ENABLE_PERFECT_HASH_SIZE 1
-
 namespace JSC {
 
     // Hash table generated by the create_hash_table script.
@@ -45,9 +40,9 @@ namespace JSC {
     };
 
     // FIXME: There is no reason this get function can't be simpler.
-    // ie. typedef JSValuePtr (*GetFunction)(ExecState*, JSObject* baseObject)
+    // ie. typedef JSValue (*GetFunction)(ExecState*, JSObject* baseObject)
     typedef PropertySlot::GetValueFunc GetFunction;
-    typedef void (*PutFunction)(ExecState*, JSObject* baseObject, JSValuePtr value);
+    typedef void (*PutFunction)(ExecState*, JSObject* baseObject, JSValue value);
 
     class HashEntry {
     public:
@@ -57,9 +52,7 @@ namespace JSC {
             m_attributes = attributes;
             m_u.store.value1 = v1;
             m_u.store.value2 = v2;
-#if !ENABLE(PERFECT_HASH_SIZE)
             m_next = 0;
-#endif
         }
 
         void setKey(UString::Rep* key) { m_key = key; }
@@ -75,10 +68,8 @@ namespace JSC {
 
         intptr_t lexerValue() const { ASSERT(!m_attributes); return m_u.lexer.value; }
 
-#if !ENABLE(PERFECT_HASH_SIZE)
         void setNext(HashEntry *next) { m_next = next; }
         HashEntry* next() const { return m_next; }
-#endif
 
     private:
         UString::Rep* m_key;
@@ -103,18 +94,14 @@ namespace JSC {
             } lexer;
         } m_u;
 
-#if !ENABLE(PERFECT_HASH_SIZE)
         HashEntry* m_next;
-#endif
     };
 
     struct HashTable {
-#if ENABLE(PERFECT_HASH_SIZE)
-        int hashSizeMask; // Precomputed size for the hash table (minus 1).
-#else
+
         int compactSize;
         int compactHashSizeMask;
-#endif
+
         const HashTableValue* values; // Fixed values generated by script.
         mutable const HashEntry* table; // Table allocated at runtime.
 
@@ -148,13 +135,6 @@ namespace JSC {
     private:
         ALWAYS_INLINE const HashEntry* entry(const Identifier& identifier) const
         {
-#if ENABLE(PERFECT_HASH_SIZE)
-            ASSERT(table);
-            const HashEntry* entry = &table[identifier.ustring().rep()->computedHash() & hashSizeMask];
-            if (entry->key() != identifier.ustring().rep())
-                return 0;
-            return entry;
-#else
             ASSERT(table);
 
             const HashEntry* entry = &table[identifier.ustring().rep()->computedHash() & compactHashSizeMask];
@@ -169,7 +149,6 @@ namespace JSC {
             } while (entry);
 
             return 0;
-#endif
         }
 
         // Convert the hash table keys to identifiers.
@@ -243,16 +222,19 @@ namespace JSC {
      * is found it sets the value and returns true, else it returns false.
      */
     template <class ThisImp>
-    inline bool lookupPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, const HashTable* table, ThisImp* thisObj)
+    inline bool lookupPut(ExecState* exec, const Identifier& propertyName, JSValue value, const HashTable* table, ThisImp* thisObj)
     {
         const HashEntry* entry = table->entry(exec, propertyName);
 
         if (!entry)
             return false;
 
-        if (entry->attributes() & Function) // function: put as override property
-            thisObj->putDirect(propertyName, value);
-        else if (!(entry->attributes() & ReadOnly))
+        if (entry->attributes() & Function) { // function: put as override property
+            if (LIKELY(value.isCell()))
+                thisObj->putDirectFunction(propertyName, value.asCell());
+            else
+                thisObj->putDirect(propertyName, value);
+        } else if (!(entry->attributes() & ReadOnly))
             entry->propertyPutter()(exec, thisObj, value);
 
         return true;
@@ -265,7 +247,7 @@ namespace JSC {
      * then it calls put() on the ParentImp class.
      */
     template <class ThisImp, class ParentImp>
-    inline void lookupPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, const HashTable* table, ThisImp* thisObj, PutPropertySlot& slot)
+    inline void lookupPut(ExecState* exec, const Identifier& propertyName, JSValue value, const HashTable* table, ThisImp* thisObj, PutPropertySlot& slot)
     {
         if (!lookupPut<ThisImp>(exec, propertyName, value, table, thisObj))
             thisObj->ParentImp::put(exec, propertyName, value, slot); // not found: forward to parent
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp
index 5bec2e6..2572bc9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.cpp
@@ -27,29 +27,30 @@
 #include <wtf/Assertions.h>
 #include <wtf/MathExtras.h>
 #include <wtf/RandomNumber.h>
+#include <wtf/RandomNumberSeed.h>
 
 namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(MathObject);
 
-static JSValuePtr mathProtoFuncAbs(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncACos(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncASin(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncATan(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncATan2(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncCeil(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncCos(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncExp(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncFloor(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncLog(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncMax(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncMin(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncPow(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncRandom(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncRound(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncSin(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncSqrt(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr mathProtoFuncTan(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncAbs(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncACos(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncASin(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncATan(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncATan2(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncCeil(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncCos(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncExp(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncFloor(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncLog(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncMax(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncMin(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncPow(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncRandom(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncRound(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncSin(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncSqrt(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL mathProtoFuncTan(ExecState*, JSObject*, JSValue, const ArgList&);
 
 }
 
@@ -95,6 +96,7 @@ MathObject::MathObject(ExecState* exec, PassRefPtr<Structure> structure)
     putDirectWithoutTransition(Identifier(exec, "PI"), jsNumber(exec, piDouble), DontDelete | DontEnum | ReadOnly);
     putDirectWithoutTransition(Identifier(exec, "SQRT1_2"), jsNumber(exec, sqrt(0.5)), DontDelete | DontEnum | ReadOnly);
     putDirectWithoutTransition(Identifier(exec, "SQRT2"), jsNumber(exec, sqrt(2.0)), DontDelete | DontEnum | ReadOnly);
+    WTF::initializeWeakRandomNumberGenerator();
 }
 
 // ECMA 15.8
@@ -113,62 +115,62 @@ bool MathObject::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
 
 // ------------------------------ Functions --------------------------------
 
-JSValuePtr mathProtoFuncAbs(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncAbs(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, fabs(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, fabs(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncACos(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncACos(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, acos(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, acos(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncASin(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncASin(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, asin(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, asin(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncATan(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncATan(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, atan(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, atan(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncATan2(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncATan2(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, atan2(args.at(exec, 0)->toNumber(exec), args.at(exec, 1)->toNumber(exec)));
+    return jsNumber(exec, atan2(args.at(0).toNumber(exec), args.at(1).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncCeil(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncCeil(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, ceil(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, ceil(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncCos(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncCos(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, cos(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, cos(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncExp(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncExp(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, exp(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, exp(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncFloor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncFloor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, floor(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, floor(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncLog(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncLog(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, log(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, log(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncMax(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncMax(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     unsigned argsCount = args.size();
     double result = -Inf;
     for (unsigned k = 0; k < argsCount; ++k) {
-        double val = args.at(exec, k)->toNumber(exec);
+        double val = args.at(k).toNumber(exec);
         if (isnan(val)) {
             result = NaN;
             break;
@@ -179,12 +181,12 @@ JSValuePtr mathProtoFuncMax(ExecState* exec, JSObject*, JSValuePtr, const ArgLis
     return jsNumber(exec, result);
 }
 
-JSValuePtr mathProtoFuncMin(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncMin(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     unsigned argsCount = args.size();
     double result = +Inf;
     for (unsigned k = 0; k < argsCount; ++k) {
-        double val = args.at(exec, k)->toNumber(exec);
+        double val = args.at(k).toNumber(exec);
         if (isnan(val)) {
             result = NaN;
             break;
@@ -195,12 +197,12 @@ JSValuePtr mathProtoFuncMin(ExecState* exec, JSObject*, JSValuePtr, const ArgLis
     return jsNumber(exec, result);
 }
 
-JSValuePtr mathProtoFuncPow(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncPow(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     // ECMA 15.8.2.1.13
 
-    double arg = args.at(exec, 0)->toNumber(exec);
-    double arg2 = args.at(exec, 1)->toNumber(exec);
+    double arg = args.at(0).toNumber(exec);
+    double arg2 = args.at(1).toNumber(exec);
 
     if (isnan(arg2))
         return jsNaN(exec);
@@ -209,32 +211,32 @@ JSValuePtr mathProtoFuncPow(ExecState* exec, JSObject*, JSValuePtr, const ArgLis
     return jsNumber(exec, pow(arg, arg2));
 }
 
-JSValuePtr mathProtoFuncRandom(ExecState* exec, JSObject*, JSValuePtr, const ArgList&)
+JSValue JSC_HOST_CALL mathProtoFuncRandom(ExecState* exec, JSObject*, JSValue, const ArgList&)
 {
-    return jsNumber(exec, WTF::randomNumber());
+    return jsNumber(exec, WTF::weakRandomNumber());
 }
 
-JSValuePtr mathProtoFuncRound(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncRound(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    double arg = args.at(exec, 0)->toNumber(exec);
+    double arg = args.at(0).toNumber(exec);
     if (signbit(arg) && arg >= -0.5)
          return jsNumber(exec, -0.0);
     return jsNumber(exec, floor(arg + 0.5));
 }
 
-JSValuePtr mathProtoFuncSin(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncSin(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, sin(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, sin(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncSqrt(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncSqrt(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, sqrt(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, sqrt(args.at(0).toNumber(exec)));
 }
 
-JSValuePtr mathProtoFuncTan(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+JSValue JSC_HOST_CALL mathProtoFuncTan(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, tan(args.at(exec, 0)->toNumber(exec)));
+    return jsNumber(exec, tan(args.at(0).toNumber(exec)));
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
index d6163fd..3557d1e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/MathObject.h
@@ -34,7 +34,7 @@ namespace JSC {
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType));
         }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorConstructor.cpp
index 3d043e9..0205fc5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NativeErrorConstructor.cpp
@@ -33,7 +33,7 @@ ASSERT_CLASS_FITS_IN_CELL(NativeErrorConstructor);
 const ClassInfo NativeErrorConstructor::info = { "Function", &InternalFunction::info, 0, 0 };
 
 NativeErrorConstructor::NativeErrorConstructor(ExecState* exec, PassRefPtr<Structure> structure, NativeErrorPrototype* nativeErrorPrototype)
-    : InternalFunction(&exec->globalData(), structure, Identifier(exec, nativeErrorPrototype->getDirect(exec->propertyNames().name)->getString()))
+    : InternalFunction(&exec->globalData(), structure, Identifier(exec, nativeErrorPrototype->getDirect(exec->propertyNames().name).getString()))
     , m_errorStructure(ErrorInstance::createStructure(nativeErrorPrototype))
 {
     putDirect(exec->propertyNames().length, jsNumber(exec, 1), DontDelete | ReadOnly | DontEnum); // ECMA 15.11.7.5
@@ -43,8 +43,8 @@ NativeErrorConstructor::NativeErrorConstructor(ExecState* exec, PassRefPtr<Struc
 ErrorInstance* NativeErrorConstructor::construct(ExecState* exec, const ArgList& args)
 {
     ErrorInstance* object = new (exec) ErrorInstance(m_errorStructure);
-    if (!args.at(exec, 0)->isUndefined())
-        object->putDirect(exec->propertyNames().message, jsString(exec, args.at(exec, 0)->toString(exec)));
+    if (!args.at(0).isUndefined())
+        object->putDirect(exec->propertyNames().message, jsString(exec, args.at(0).toString(exec)));
     return object;
 }
 
@@ -58,8 +58,8 @@ ConstructType NativeErrorConstructor::getConstructData(ConstructData& constructD
     constructData.native.function = constructWithNativeErrorConstructor;
     return ConstructTypeHost;
 }
-
-static JSValuePtr callNativeErrorConstructor(ExecState* exec, JSObject* constructor, JSValuePtr, const ArgList& args)
+    
+static JSValue JSC_HOST_CALL callNativeErrorConstructor(ExecState* exec, JSObject* constructor, JSValue, const ArgList& args)
 {
     return static_cast<NativeErrorConstructor*>(constructor)->construct(exec, args);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NativeFunctionWrapper.h b/src/3rdparty/webkit/JavaScriptCore/runtime/NativeFunctionWrapper.h
new file mode 100644
index 0000000..d4eeb3b
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NativeFunctionWrapper.h
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef NativeFunctionWrapper_h
+#define NativeFunctionWrapper_h
+
+namespace JSC {
+#if ENABLE(JIT) && ENABLE(JIT_OPTIMIZE_NATIVE_CALL)
+    class JSFunction;
+    typedef JSFunction NativeFunctionWrapper;
+#else
+    class PrototypeFunction;
+    typedef PrototypeFunction NativeFunctionWrapper;
+#endif
+}
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp
index 0da4d69..2840bf0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.cpp
@@ -29,11 +29,11 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(NumberConstructor);
 
-static JSValuePtr numberConstructorNaNValue(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr numberConstructorNegInfinity(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr numberConstructorPosInfinity(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr numberConstructorMaxValue(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr numberConstructorMinValue(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue numberConstructorNaNValue(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue numberConstructorNegInfinity(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue numberConstructorPosInfinity(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue numberConstructorMaxValue(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue numberConstructorMinValue(ExecState*, const Identifier&, const PropertySlot&);
 
 } // namespace JSC
 
@@ -68,36 +68,36 @@ bool NumberConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<NumberConstructor, InternalFunction>(exec, ExecState::numberTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr numberConstructorNaNValue(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorNaNValue(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNaN(exec);
 }
 
-JSValuePtr numberConstructorNegInfinity(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorNegInfinity(ExecState* exec, const Identifier&, const PropertySlot&)
 {
-    return jsNumberCell(exec, -Inf);
+    return jsNumber(exec, -Inf);
 }
 
-JSValuePtr numberConstructorPosInfinity(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorPosInfinity(ExecState* exec, const Identifier&, const PropertySlot&)
 {
-    return jsNumberCell(exec, Inf);
+    return jsNumber(exec, Inf);
 }
 
-JSValuePtr numberConstructorMaxValue(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorMaxValue(ExecState* exec, const Identifier&, const PropertySlot&)
 {
-    return jsNumberCell(exec, 1.7976931348623157E+308);
+    return jsNumber(exec, 1.7976931348623157E+308);
 }
 
-JSValuePtr numberConstructorMinValue(ExecState* exec, const Identifier&, const PropertySlot&)
+static JSValue numberConstructorMinValue(ExecState* exec, const Identifier&, const PropertySlot&)
 {
-    return jsNumberCell(exec, 5E-324);
+    return jsNumber(exec, 5E-324);
 }
 
 // ECMA 15.7.1
 static JSObject* constructWithNumberConstructor(ExecState* exec, JSObject*, const ArgList& args)
 {
     NumberObject* object = new (exec) NumberObject(exec->lexicalGlobalObject()->numberObjectStructure());
-    double n = args.isEmpty() ? 0 : args.at(exec, 0)->toNumber(exec);
+    double n = args.isEmpty() ? 0 : args.at(0).toNumber(exec);
     object->setInternalValue(jsNumber(exec, n));
     return object;
 }
@@ -109,9 +109,9 @@ ConstructType NumberConstructor::getConstructData(ConstructData& constructData)
 }
 
 // ECMA 15.7.2
-static JSValuePtr callNumberConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callNumberConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
-    return jsNumber(exec, args.isEmpty() ? 0 : args.at(exec, 0)->toNumber(exec));
+    return jsNumber(exec, args.isEmpty() ? 0 : args.at(0).toNumber(exec));
 }
 
 CallType NumberConstructor::getCallData(CallData& callData)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
index 070be5f..b1224ec 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberConstructor.h
@@ -32,11 +32,11 @@ namespace JSC {
         NumberConstructor(ExecState*, PassRefPtr<Structure>, NumberPrototype*);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
-        JSValuePtr getValueProperty(ExecState*, int token) const;
+        JSValue getValueProperty(ExecState*, int token) const;
 
         static const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+        static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
             return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
         }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.cpp
index 6613390..0e8df17 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.cpp
@@ -36,23 +36,16 @@ NumberObject::NumberObject(PassRefPtr<Structure> structure)
 {
 }
 
-JSValuePtr NumberObject::getJSNumber()
+JSValue NumberObject::getJSNumber()
 {
     return internalValue();
 }
 
-NumberObject* constructNumber(ExecState* exec, JSNumberCell* number)
+NumberObject* constructNumber(ExecState* exec, JSValue number)
 {
     NumberObject* object = new (exec) NumberObject(exec->lexicalGlobalObject()->numberObjectStructure());
     object->setInternalValue(number);
     return object;
 }
 
-NumberObject* constructNumberFromImmediateNumber(ExecState* exec, JSValuePtr value)
-{
-    NumberObject* object = new (exec) NumberObject(exec->lexicalGlobalObject()->numberObjectStructure());
-    object->setInternalValue(value);
-    return object;
-}
-
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
index 8cc2715..d354b9b 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberObject.h
@@ -25,8 +25,6 @@
 
 namespace JSC {
 
-    class JSNumberCell;
-
     class NumberObject : public JSWrapperObject {
     public:
         explicit NumberObject(PassRefPtr<Structure>);
@@ -36,11 +34,10 @@ namespace JSC {
     private:
         virtual const ClassInfo* classInfo() const { return &info; }
 
-        virtual JSValuePtr getJSNumber();
+        virtual JSValue getJSNumber();
     };
 
-    NumberObject* constructNumber(ExecState*, JSNumberCell*);
-    NumberObject* constructNumberFromImmediateNumber(ExecState*, JSValuePtr);
+    NumberObject* constructNumber(ExecState*, JSValue);
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberPrototype.cpp
index 8b45f54..947324c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/NumberPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/NumberPrototype.cpp
@@ -23,6 +23,7 @@
 #include "NumberPrototype.h"
 
 #include "Error.h"
+#include "JSFunction.h"
 #include "JSString.h"
 #include "PrototypeFunction.h"
 #include "dtoa.h"
@@ -35,12 +36,12 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(NumberPrototype);
 
-static JSValuePtr numberProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr numberProtoFuncToLocaleString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr numberProtoFuncValueOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr numberProtoFuncToFixed(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr numberProtoFuncToExponential(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr numberProtoFuncToPrecision(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL numberProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL numberProtoFuncToLocaleString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL numberProtoFuncValueOf(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL numberProtoFuncToFixed(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL numberProtoFuncToExponential(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState*, JSObject*, JSValue, const ArgList&);
 
 // ECMA 15.7.4
 
@@ -51,12 +52,12 @@ NumberPrototype::NumberPrototype(ExecState* exec, PassRefPtr<Structure> structur
 
     // The constructor will be added later, after NumberConstructor has been constructed
 
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().toString, numberProtoFuncToString), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().toLocaleString, numberProtoFuncToLocaleString), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().valueOf, numberProtoFuncValueOf), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().toFixed, numberProtoFuncToFixed), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().toExponential, numberProtoFuncToExponential), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().toPrecision, numberProtoFuncToPrecision), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().toString, numberProtoFuncToString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toLocaleString, numberProtoFuncToLocaleString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().valueOf, numberProtoFuncValueOf), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().toFixed, numberProtoFuncToFixed), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().toExponential, numberProtoFuncToExponential), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().toPrecision, numberProtoFuncToPrecision), DontEnum);
 }
 
 // ------------------------------ Functions ---------------------------
@@ -67,7 +68,8 @@ static UString integerPartNoExp(double d)
 {
     int decimalPoint;
     int sign;
-    char* result = WTF::dtoa(d, 0, &decimalPoint, &sign, NULL);
+    char result[80];
+    WTF::dtoa(result, d, 0, &decimalPoint, &sign, NULL);
     bool resultIsInfOrNan = (decimalPoint == 9999);
     size_t length = strlen(result);
 
@@ -80,17 +82,16 @@ static UString integerPartNoExp(double d)
         Vector<char, 1024> buf(decimalPoint + 1);
 
         if (static_cast<int>(length) <= decimalPoint) {
-            strcpy(buf.data(), result);
+            ASSERT(decimalPoint < 1024);
+            memcpy(buf.data(), result, length);
             memset(buf.data() + length, '0', decimalPoint - length);
         } else
             strncpy(buf.data(), result, decimalPoint);
-
         buf[decimalPoint] = '\0';
+
         str.append(buf.data());
     }
 
-    WTF::freedtoa(result);
-
     return str;
 }
 
@@ -133,15 +134,15 @@ static double intPow10(int e)
     return static_cast<double>(result);
 }
 
-JSValuePtr numberProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL numberProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSValuePtr v = thisValue->getJSNumber();
+    JSValue v = thisValue.getJSNumber();
     if (!v)
         return throwError(exec, TypeError);
 
-    double radixAsDouble = args.at(exec, 0)->toInteger(exec); // nan -> 0
-    if (radixAsDouble == 10 || args.at(exec, 0)->isUndefined())
-        return jsString(exec, v->toString(exec));
+    double radixAsDouble = args.at(0).toInteger(exec); // nan -> 0
+    if (radixAsDouble == 10 || args.at(0).isUndefined())
+        return jsString(exec, v.toString(exec));
 
     if (radixAsDouble < 2 || radixAsDouble > 36)
         return throwError(exec, RangeError, "toString() radix argument must be between 2 and 36");
@@ -153,7 +154,7 @@ JSValuePtr numberProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisVa
     // unless someone finds a precise rule.
     char s[2048 + 3];
     const char* lastCharInString = s + sizeof(s) - 1;
-    double x = v->uncheckedGetNumber();
+    double x = v.uncheckedGetNumber();
     if (isnan(x) || isinf(x))
         return jsString(exec, UString::from(x));
 
@@ -197,39 +198,39 @@ JSValuePtr numberProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisVa
     return jsString(exec, startOfResultString);
 }
 
-JSValuePtr numberProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL numberProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     // FIXME: Not implemented yet.
 
-    JSValuePtr v = thisValue->getJSNumber();
+    JSValue v = thisValue.getJSNumber();
     if (!v)
         return throwError(exec, TypeError);
 
-    return jsString(exec, v->toString(exec));
+    return jsString(exec, v.toString(exec));
 }
 
-JSValuePtr numberProtoFuncValueOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL numberProtoFuncValueOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    JSValuePtr v = thisValue->getJSNumber();
+    JSValue v = thisValue.getJSNumber();
     if (!v)
         return throwError(exec, TypeError);
 
     return v;
 }
 
-JSValuePtr numberProtoFuncToFixed(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL numberProtoFuncToFixed(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSValuePtr v = thisValue->getJSNumber();
+    JSValue v = thisValue.getJSNumber();
     if (!v)
         return throwError(exec, TypeError);
 
-    JSValuePtr fractionDigits = args.at(exec, 0);
-    double df = fractionDigits->toInteger(exec);
+    JSValue fractionDigits = args.at(0);
+    double df = fractionDigits.toInteger(exec);
     if (!(df >= 0 && df <= 20))
         return throwError(exec, RangeError, "toFixed() digits argument must be between 0 and 20");
     int f = static_cast<int>(df);
 
-    double x = v->uncheckedGetNumber();
+    double x = v.uncheckedGetNumber();
     if (isnan(x))
         return jsNontrivialString(exec, "NaN");
 
@@ -277,7 +278,8 @@ static void fractionalPartToString(char* buf, int& i, const char* result, int re
             strncpy(buf + i, result + 1, fractionalDigits);
             i += fractionalDigits;
         } else {
-            strcpy(buf + i, result + 1);
+            ASSERT(i + resultLength - 1 < 80);
+            memcpy(buf + i, result + 1, resultLength - 1);
             i += static_cast<int>(resultLength) - 1;
         }
     }
@@ -302,23 +304,23 @@ static void exponentialPartToString(char* buf, int& i, int decimalPoint)
     buf[i++] = static_cast<char>('0' + exponential % 10);
 }
 
-JSValuePtr numberProtoFuncToExponential(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL numberProtoFuncToExponential(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSValuePtr v = thisValue->getJSNumber();
+    JSValue v = thisValue.getJSNumber();
     if (!v)
         return throwError(exec, TypeError);
 
-    double x = v->uncheckedGetNumber();
+    double x = v.uncheckedGetNumber();
 
     if (isnan(x) || isinf(x))
         return jsString(exec, UString::from(x));
 
-    JSValuePtr fractionalDigitsValue = args.at(exec, 0);
-    double df = fractionalDigitsValue->toInteger(exec);
+    JSValue fractionalDigitsValue = args.at(0);
+    double df = fractionalDigitsValue.toInteger(exec);
     if (!(df >= 0 && df <= 20))
         return throwError(exec, RangeError, "toExponential() argument must between 0 and 20");
     int fractionalDigits = static_cast<int>(df);
-    bool includeAllDigits = fractionalDigitsValue->isUndefined();
+    bool includeAllDigits = fractionalDigitsValue.isUndefined();
 
     int decimalAdjust = 0;
     if (x && !includeAllDigits) {
@@ -344,7 +346,8 @@ JSValuePtr numberProtoFuncToExponential(ExecState* exec, JSObject*, JSValuePtr t
 
     int decimalPoint;
     int sign;
-    char* result = WTF::dtoa(x, 0, &decimalPoint, &sign, NULL);
+    char result[80];
+    WTF::dtoa(result, x, 0, &decimalPoint, &sign, NULL);
     size_t resultLength = strlen(result);
     decimalPoint += decimalAdjust;
 
@@ -353,9 +356,12 @@ JSValuePtr numberProtoFuncToExponential(ExecState* exec, JSObject*, JSValuePtr t
     if (sign)
         buf[i++] = '-';
 
-    if (decimalPoint == 999) // ? 9999 is the magical "result is Inf or NaN" value.  what's 999??
-        strcpy(buf + i, result);
-    else {
+    // ? 9999 is the magical "result is Inf or NaN" value.  what's 999??
+    if (decimalPoint == 999) {
+        ASSERT(i + resultLength < 80);
+        memcpy(buf + i, result, resultLength);
+        buf[i + resultLength] = '\0';
+    } else {
         buf[i++] = result[0];
 
         if (includeAllDigits)
@@ -367,21 +373,19 @@ JSValuePtr numberProtoFuncToExponential(ExecState* exec, JSObject*, JSValuePtr t
     }
     ASSERT(i <= 80);
 
-    WTF::freedtoa(result);
-
     return jsString(exec, buf);
 }
 
-JSValuePtr numberProtoFuncToPrecision(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSValuePtr v = thisValue->getJSNumber();
+    JSValue v = thisValue.getJSNumber();
     if (!v)
         return throwError(exec, TypeError);
 
-    double doublePrecision = args.at(exec, 0)->toIntegerPreserveNaN(exec);
-    double x = v->uncheckedGetNumber();
-    if (args.at(exec, 0)->isUndefined() || isnan(x) || isinf(x))
-        return jsString(exec, v->toString(exec));
+    double doublePrecision = args.at(0).toIntegerPreserveNaN(exec);
+    double x = v.uncheckedGetNumber();
+    if (args.at(0).isUndefined() || isnan(x) || isinf(x))
+        return jsString(exec, v.toString(exec));
 
     UString s;
     if (x < 0) {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
index ff97ca4..cf1790f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectConstructor.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "ObjectConstructor.h"
 
+#include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "ObjectPrototype.h"
 
@@ -41,10 +42,10 @@ ObjectConstructor::ObjectConstructor(ExecState* exec, PassRefPtr<Structure> stru
 // ECMA 15.2.2
 static ALWAYS_INLINE JSObject* constructObject(ExecState* exec, const ArgList& args)
 {
-    JSValuePtr arg = args.at(exec, 0);
-    if (arg->isUndefinedOrNull())
+    JSValue arg = args.at(0);
+    if (arg.isUndefinedOrNull())
         return new (exec) JSObject(exec->lexicalGlobalObject()->emptyObjectStructure());
-    return arg->toObject(exec);
+    return arg.toObject(exec);
 }
 
 static JSObject* constructWithObjectConstructor(ExecState* exec, JSObject*, const ArgList& args)
@@ -58,7 +59,7 @@ ConstructType ObjectConstructor::getConstructData(ConstructData& constructData)
     return ConstructTypeHost;
 }
 
-static JSValuePtr callObjectConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callObjectConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     return constructObject(exec, args);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp
index 696570b..98e4713 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.cpp
@@ -22,6 +22,7 @@
 #include "ObjectPrototype.h"
 
 #include "Error.h"
+#include "JSFunction.h"
 #include "JSString.h"
 #include "PrototypeFunction.h"
 
@@ -29,58 +30,58 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(ObjectPrototype);
 
-static JSValuePtr objectProtoFuncValueOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncHasOwnProperty(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncIsPrototypeOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncDefineGetter(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncDefineSetter(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncLookupGetter(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncLookupSetter(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncPropertyIsEnumerable(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr objectProtoFuncToLocaleString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncValueOf(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncHasOwnProperty(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncIsPrototypeOf(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncDefineGetter(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncDefineSetter(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncLookupGetter(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncLookupSetter(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncPropertyIsEnumerable(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL objectProtoFuncToLocaleString(ExecState*, JSObject*, JSValue, const ArgList&);
 
 ObjectPrototype::ObjectPrototype(ExecState* exec, PassRefPtr<Structure> stucture, Structure* prototypeFunctionStructure)
     : JSObject(stucture)
 {
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, objectProtoFuncToString), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().toLocaleString, objectProtoFuncToLocaleString), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().valueOf, objectProtoFuncValueOf), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().hasOwnProperty, objectProtoFuncHasOwnProperty), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().propertyIsEnumerable, objectProtoFuncPropertyIsEnumerable), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().isPrototypeOf, objectProtoFuncIsPrototypeOf), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, objectProtoFuncToString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toLocaleString, objectProtoFuncToLocaleString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().valueOf, objectProtoFuncValueOf), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().hasOwnProperty, objectProtoFuncHasOwnProperty), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().propertyIsEnumerable, objectProtoFuncPropertyIsEnumerable), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().isPrototypeOf, objectProtoFuncIsPrototypeOf), DontEnum);
 
     // Mozilla extensions
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 2, exec->propertyNames().__defineGetter__, objectProtoFuncDefineGetter), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 2, exec->propertyNames().__defineSetter__, objectProtoFuncDefineSetter), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().__lookupGetter__, objectProtoFuncLookupGetter), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().__lookupSetter__, objectProtoFuncLookupSetter), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 2, exec->propertyNames().__defineGetter__, objectProtoFuncDefineGetter), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 2, exec->propertyNames().__defineSetter__, objectProtoFuncDefineSetter), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().__lookupGetter__, objectProtoFuncLookupGetter), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().__lookupSetter__, objectProtoFuncLookupSetter), DontEnum);
 }
 
 // ------------------------------ Functions --------------------------------
 
 // ECMA 15.2.4.2, 15.2.4.4, 15.2.4.5, 15.2.4.7
 
-JSValuePtr objectProtoFuncValueOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL objectProtoFuncValueOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    return thisValue->toThisObject(exec);
+    return thisValue.toThisObject(exec);
 }
 
-JSValuePtr objectProtoFuncHasOwnProperty(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL objectProtoFuncHasOwnProperty(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    return jsBoolean(thisValue->toThisObject(exec)->hasOwnProperty(exec, Identifier(exec, args.at(exec, 0)->toString(exec))));
+    return jsBoolean(thisValue.toThisObject(exec)->hasOwnProperty(exec, Identifier(exec, args.at(0).toString(exec))));
 }
 
-JSValuePtr objectProtoFuncIsPrototypeOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL objectProtoFuncIsPrototypeOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSObject* thisObj = thisValue->toThisObject(exec);
+    JSObject* thisObj = thisValue.toThisObject(exec);
 
-    if (!args.at(exec, 0)->isObject())
+    if (!args.at(0).isObject())
         return jsBoolean(false);
 
-    JSValuePtr v = asObject(args.at(exec, 0))->prototype();
+    JSValue v = asObject(args.at(0))->prototype();
 
     while (true) {
-        if (!v->isObject())
+        if (!v.isObject())
             return jsBoolean(false);
         if (v == thisObj)
             return jsBoolean(true);
@@ -88,47 +89,47 @@ JSValuePtr objectProtoFuncIsPrototypeOf(ExecState* exec, JSObject*, JSValuePtr t
     }
 }
 
-JSValuePtr objectProtoFuncDefineGetter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL objectProtoFuncDefineGetter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     CallData callData;
-    if (args.at(exec, 1)->getCallData(callData) == CallTypeNone)
+    if (args.at(1).getCallData(callData) == CallTypeNone)
         return throwError(exec, SyntaxError, "invalid getter usage");
-    thisValue->toThisObject(exec)->defineGetter(exec, Identifier(exec, args.at(exec, 0)->toString(exec)), asObject(args.at(exec, 1)));
+    thisValue.toThisObject(exec)->defineGetter(exec, Identifier(exec, args.at(0).toString(exec)), asObject(args.at(1)));
     return jsUndefined();
 }
 
-JSValuePtr objectProtoFuncDefineSetter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL objectProtoFuncDefineSetter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     CallData callData;
-    if (args.at(exec, 1)->getCallData(callData) == CallTypeNone)
+    if (args.at(1).getCallData(callData) == CallTypeNone)
         return throwError(exec, SyntaxError, "invalid setter usage");
-    thisValue->toThisObject(exec)->defineSetter(exec, Identifier(exec, args.at(exec, 0)->toString(exec)), asObject(args.at(exec, 1)));
+    thisValue.toThisObject(exec)->defineSetter(exec, Identifier(exec, args.at(0).toString(exec)), asObject(args.at(1)));
     return jsUndefined();
 }
 
-JSValuePtr objectProtoFuncLookupGetter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL objectProtoFuncLookupGetter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    return thisValue->toThisObject(exec)->lookupGetter(exec, Identifier(exec, args.at(exec, 0)->toString(exec)));
+    return thisValue.toThisObject(exec)->lookupGetter(exec, Identifier(exec, args.at(0).toString(exec)));
 }
 
-JSValuePtr objectProtoFuncLookupSetter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL objectProtoFuncLookupSetter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    return thisValue->toThisObject(exec)->lookupSetter(exec, Identifier(exec, args.at(exec, 0)->toString(exec)));
+    return thisValue.toThisObject(exec)->lookupSetter(exec, Identifier(exec, args.at(0).toString(exec)));
 }
 
-JSValuePtr objectProtoFuncPropertyIsEnumerable(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL objectProtoFuncPropertyIsEnumerable(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    return jsBoolean(thisValue->toThisObject(exec)->propertyIsEnumerable(exec, Identifier(exec, args.at(exec, 0)->toString(exec))));
+    return jsBoolean(thisValue.toThisObject(exec)->propertyIsEnumerable(exec, Identifier(exec, args.at(0).toString(exec))));
 }
 
-JSValuePtr objectProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL objectProtoFuncToLocaleString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    return thisValue->toThisJSString(exec);
+    return thisValue.toThisJSString(exec);
 }
 
-JSValuePtr objectProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL objectProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    return jsNontrivialString(exec, "[object " + thisValue->toThisObject(exec)->className() + "]");
+    return jsNontrivialString(exec, "[object " + thisValue.toThisObject(exec)->className() + "]");
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.h
index 1c432fe..7790ae0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ObjectPrototype.h
@@ -30,7 +30,7 @@ namespace JSC {
         ObjectPrototype(ExecState*, PassRefPtr<Structure>, Structure* prototypeFunctionStructure);
     };
 
-    JSValuePtr objectProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+    JSValue JSC_HOST_CALL objectProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
 
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.cpp
index 6f84303..093bbec 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.cpp
@@ -35,41 +35,87 @@
 
 namespace JSC {
 
-// ECMA 11.9.3
-bool equal(ExecState* exec, JSValuePtr v1, JSValuePtr v2)
+bool JSValue::equalSlowCase(ExecState* exec, JSValue v1, JSValue v2)
 {
-    if (JSImmediate::areBothImmediateNumbers(v1, v2))
-        return v1 == v2;
-
     return equalSlowCaseInline(exec, v1, v2);
 }
 
-bool equalSlowCase(ExecState* exec, JSValuePtr v1, JSValuePtr v2)
+bool JSValue::strictEqualSlowCase(JSValue v1, JSValue v2)
 {
-    return equalSlowCaseInline(exec, v1, v2);
+    return strictEqualSlowCaseInline(v1, v2);
 }
 
-bool strictEqual(JSValuePtr v1, JSValuePtr v2)
+NEVER_INLINE JSValue throwOutOfMemoryError(ExecState* exec)
 {
-    if (JSImmediate::areBothImmediate(v1, v2))
-        return v1 == v2;
+    JSObject* error = Error::create(exec, GeneralError, "Out of memory");
+    exec->setException(error);
+    return error;
+}
 
-    if (JSImmediate::isEitherImmediate(v1, v2) & (v1 != JSImmediate::from(0)) & (v2 != JSImmediate::from(0)))
-        return false;
+NEVER_INLINE JSValue jsAddSlowCase(CallFrame* callFrame, JSValue v1, JSValue v2)
+{
+    // exception for the Date exception in defaultValue()
+    JSValue p1 = v1.toPrimitive(callFrame);
+    JSValue p2 = v2.toPrimitive(callFrame);
 
-    return strictEqualSlowCaseInline(v1, v2);
+    if (p1.isString() || p2.isString()) {
+        RefPtr<UString::Rep> value = concatenate(p1.toString(callFrame).rep(), p2.toString(callFrame).rep());
+        if (!value)
+            return throwOutOfMemoryError(callFrame);
+        return jsString(callFrame, value.release());
+    }
+
+    return jsNumber(callFrame, p1.toNumber(callFrame) + p2.toNumber(callFrame));
 }
 
-bool strictEqualSlowCase(JSValuePtr v1, JSValuePtr v2)
+JSValue jsTypeStringForValue(CallFrame* callFrame, JSValue v)
 {
-    return strictEqualSlowCaseInline(v1, v2);
+    if (v.isUndefined())
+        return jsNontrivialString(callFrame, "undefined");
+    if (v.isBoolean())
+        return jsNontrivialString(callFrame, "boolean");
+    if (v.isNumber())
+        return jsNontrivialString(callFrame, "number");
+    if (v.isString())
+        return jsNontrivialString(callFrame, "string");
+    if (v.isObject()) {
+        // Return "undefined" for objects that should be treated
+        // as null when doing comparisons.
+        if (asObject(v)->structure()->typeInfo().masqueradesAsUndefined())
+            return jsNontrivialString(callFrame, "undefined");
+        CallData callData;
+        if (asObject(v)->getCallData(callData) != CallTypeNone)
+            return jsNontrivialString(callFrame, "function");
+    }
+    return jsNontrivialString(callFrame, "object");
 }
 
-NEVER_INLINE JSValuePtr throwOutOfMemoryError(ExecState* exec)
+bool jsIsObjectType(JSValue v)
 {
-    JSObject* error = Error::create(exec, GeneralError, "Out of memory");
-    exec->setException(error);
-    return error;
+    if (!v.isCell())
+        return v.isNull();
+
+    JSType type = asCell(v)->structure()->typeInfo().type();
+    if (type == NumberType || type == StringType)
+        return false;
+    if (type == ObjectType) {
+        if (asObject(v)->structure()->typeInfo().masqueradesAsUndefined())
+            return false;
+        CallData callData;
+        if (asObject(v)->getCallData(callData) != CallTypeNone)
+            return false;
+    }
+    return true;
+}
+
+bool jsIsFunctionType(JSValue v)
+{
+    if (v.isObject()) {
+        CallData callData;
+        if (asObject(v)->getCallData(callData) != CallTypeNone)
+            return true;
+    }
+    return false;
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
index f627c52..acfc6c2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Operations.h
@@ -22,116 +22,313 @@
 #ifndef Operations_h
 #define Operations_h
 
+#include "Interpreter.h"
 #include "JSImmediate.h"
 #include "JSNumberCell.h"
 #include "JSString.h"
 
 namespace JSC {
 
-  // ECMA 11.9.3
-  bool equal(ExecState*, JSValuePtr, JSValuePtr);
-  bool equalSlowCase(ExecState*, JSValuePtr, JSValuePtr);
-
-  ALWAYS_INLINE bool equalSlowCaseInline(ExecState* exec, JSValuePtr v1, JSValuePtr v2)
-  {
-      ASSERT(!JSImmediate::areBothImmediateNumbers(v1, v2));
-
-      do {
-          if (v1->isNumber() && v2->isNumber())
-              return v1->uncheckedGetNumber() == v2->uncheckedGetNumber();
-
-          bool s1 = v1->isString();
-          bool s2 = v2->isString();
-          if (s1 && s2)
-              return asString(v1)->value() == asString(v2)->value();
-
-          if (v1->isUndefinedOrNull()) {
-              if (v2->isUndefinedOrNull())
-                  return true;
-              if (JSImmediate::isImmediate(v2))
-                  return false;
-              return v2->asCell()->structure()->typeInfo().masqueradesAsUndefined();
-          }
-
-          if (v2->isUndefinedOrNull()) {
-              if (JSImmediate::isImmediate(v1))
-                  return false;
-              return v1->asCell()->structure()->typeInfo().masqueradesAsUndefined();
-          }
-
-          if (v1->isObject()) {
-              if (v2->isObject())
-                  return v1 == v2;
-              JSValuePtr p1 = v1->toPrimitive(exec);
-              if (exec->hadException())
-                  return false;
-              v1 = p1;
-              if (JSImmediate::areBothImmediateNumbers(v1, v2))
-                  return v1 == v2;
-              continue;
-          }
-
-          if (v2->isObject()) {
-              JSValuePtr p2 = v2->toPrimitive(exec);
-              if (exec->hadException())
-                  return false;
-              v2 = p2;
-              if (JSImmediate::areBothImmediateNumbers(v1, v2))
-                  return v1 == v2;
-              continue;
-          }
-
-          if (s1 || s2) {
-              double d1 = v1->toNumber(exec);
-              double d2 = v2->toNumber(exec);
-              return d1 == d2;
-          }
-
-          if (v1->isBoolean()) {
-              if (v2->isNumber())
-                  return static_cast<double>(v1->getBoolean()) == v2->uncheckedGetNumber();
-          } else if (v2->isBoolean()) {
-              if (v1->isNumber())
-                  return v1->uncheckedGetNumber() == static_cast<double>(v2->getBoolean());
-          }
-
-          return v1 == v2;
-      } while (true);
-  }
-
-
-  bool strictEqual(JSValuePtr, JSValuePtr);
-  bool strictEqualSlowCase(JSValuePtr, JSValuePtr);
-
-  inline bool strictEqualSlowCaseInline(JSValuePtr v1, JSValuePtr v2)
-  {
-      ASSERT(!JSImmediate::areBothImmediate(v1, v2));
-      
-      if (JSImmediate::isEitherImmediate(v1, v2)) {
-          ASSERT(v1 == JSImmediate::zeroImmediate() || v2 == JSImmediate::zeroImmediate());
-          ASSERT(v1 != v2);
-
-          // The reason we can't just return false here is that 0 === -0,
-          // and while the former is an immediate number, the latter is not.
-          if (v1 == JSImmediate::zeroImmediate())
-              return asCell(v2)->isNumber() && asNumberCell(v2)->value() == 0;
-          return asCell(v1)->isNumber() && asNumberCell(v1)->value() == 0;
-      }
-      
-      if (asCell(v1)->isNumber()) {
-          return asCell(v2)->isNumber()
-              && asNumberCell(v1)->value() == asNumberCell(v2)->value();
-      }
-
-      if (asCell(v1)->isString()) {
-          return asCell(v2)->isString()
-              && asString(v1)->value() == asString(v2)->value();
-      }
-
-      return v1 == v2;
-  }
-
-  JSValuePtr throwOutOfMemoryError(ExecState*);
-}
-
-#endif
+    NEVER_INLINE JSValue throwOutOfMemoryError(ExecState*);
+    NEVER_INLINE JSValue jsAddSlowCase(CallFrame*, JSValue, JSValue);
+    JSValue jsTypeStringForValue(CallFrame*, JSValue);
+    bool jsIsObjectType(JSValue);
+    bool jsIsFunctionType(JSValue);
+
+    // ECMA 11.9.3
+    inline bool JSValue::equal(ExecState* exec, JSValue v1, JSValue v2)
+    {
+        if (JSImmediate::areBothImmediateIntegerNumbers(v1, v2))
+            return v1 == v2;
+
+        return equalSlowCase(exec, v1, v2);
+    }
+
+    ALWAYS_INLINE bool JSValue::equalSlowCaseInline(ExecState* exec, JSValue v1, JSValue v2)
+    {
+        ASSERT(!JSImmediate::areBothImmediateIntegerNumbers(v1, v2));
+
+        do {
+            if (v1.isNumber() && v2.isNumber())
+                return v1.uncheckedGetNumber() == v2.uncheckedGetNumber();
+
+            bool s1 = v1.isString();
+            bool s2 = v2.isString();
+            if (s1 && s2)
+                return asString(v1)->value() == asString(v2)->value();
+
+            if (v1.isUndefinedOrNull()) {
+                if (v2.isUndefinedOrNull())
+                    return true;
+                if (JSImmediate::isImmediate(v2))
+                    return false;
+                return v2.asCell()->structure()->typeInfo().masqueradesAsUndefined();
+            }
+
+            if (v2.isUndefinedOrNull()) {
+                if (JSImmediate::isImmediate(v1))
+                    return false;
+                return v1.asCell()->structure()->typeInfo().masqueradesAsUndefined();
+            }
+
+            if (v1.isObject()) {
+                if (v2.isObject())
+                    return v1 == v2;
+                JSValue p1 = v1.toPrimitive(exec);
+                if (exec->hadException())
+                    return false;
+                v1 = p1;
+                if (JSImmediate::areBothImmediateIntegerNumbers(v1, v2))
+                    return v1 == v2;
+                continue;
+            }
+
+            if (v2.isObject()) {
+                JSValue p2 = v2.toPrimitive(exec);
+                if (exec->hadException())
+                    return false;
+                v2 = p2;
+                if (JSImmediate::areBothImmediateIntegerNumbers(v1, v2))
+                    return v1 == v2;
+                continue;
+            }
+
+            if (s1 || s2) {
+                double d1 = v1.toNumber(exec);
+                double d2 = v2.toNumber(exec);
+                return d1 == d2;
+            }
+
+            if (v1.isBoolean()) {
+                if (v2.isNumber())
+                    return static_cast<double>(v1.getBoolean()) == v2.uncheckedGetNumber();
+            } else if (v2.isBoolean()) {
+                if (v1.isNumber())
+                    return v1.uncheckedGetNumber() == static_cast<double>(v2.getBoolean());
+            }
+
+            return v1 == v2;
+        } while (true);
+    }
+
+    // ECMA 11.9.3
+    ALWAYS_INLINE bool JSValue::strictEqualSlowCaseInline(JSValue v1, JSValue v2)
+    {
+        ASSERT(!JSImmediate::isEitherImmediate(v1, v2));
+
+        if (v1.asCell()->isString() && v2.asCell()->isString())
+            return asString(v1)->value() == asString(v2)->value();
+
+        return v1 == v2;
+    }
+
+    inline bool JSValue::strictEqual(JSValue v1, JSValue v2)
+    {
+        if (JSImmediate::areBothImmediateIntegerNumbers(v1, v2))
+            return v1 == v2;
+
+        if (v1.isNumber() && v2.isNumber())
+            return v1.uncheckedGetNumber() == v2.uncheckedGetNumber();
+
+        if (JSImmediate::isEitherImmediate(v1, v2))
+            return v1 == v2;
+
+        return strictEqualSlowCaseInline(v1, v2);
+    }
+
+    inline bool jsLess(CallFrame* callFrame, JSValue v1, JSValue v2)
+    {
+        if (JSValue::areBothInt32Fast(v1, v2))
+            return v1.getInt32Fast() < v2.getInt32Fast();
+
+        double n1;
+        double n2;
+        if (v1.getNumber(n1) && v2.getNumber(n2))
+            return n1 < n2;
+
+        JSGlobalData* globalData = &callFrame->globalData();
+        if (isJSString(globalData, v1) && isJSString(globalData, v2))
+            return asString(v1)->value() < asString(v2)->value();
+
+        JSValue p1;
+        JSValue p2;
+        bool wasNotString1 = v1.getPrimitiveNumber(callFrame, n1, p1);
+        bool wasNotString2 = v2.getPrimitiveNumber(callFrame, n2, p2);
+
+        if (wasNotString1 | wasNotString2)
+            return n1 < n2;
+
+        return asString(p1)->value() < asString(p2)->value();
+    }
+
+    inline bool jsLessEq(CallFrame* callFrame, JSValue v1, JSValue v2)
+    {
+        if (JSValue::areBothInt32Fast(v1, v2))
+            return v1.getInt32Fast() <= v2.getInt32Fast();
+
+        double n1;
+        double n2;
+        if (v1.getNumber(n1) && v2.getNumber(n2))
+            return n1 <= n2;
+
+        JSGlobalData* globalData = &callFrame->globalData();
+        if (isJSString(globalData, v1) && isJSString(globalData, v2))
+            return !(asString(v2)->value() < asString(v1)->value());
+
+        JSValue p1;
+        JSValue p2;
+        bool wasNotString1 = v1.getPrimitiveNumber(callFrame, n1, p1);
+        bool wasNotString2 = v2.getPrimitiveNumber(callFrame, n2, p2);
+
+        if (wasNotString1 | wasNotString2)
+            return n1 <= n2;
+
+        return !(asString(p2)->value() < asString(p1)->value());
+    }
+
+    // Fast-path choices here are based on frequency data from SunSpider:
+    //    <times> Add case: <t1> <t2>
+    //    ---------------------------
+    //    5626160 Add case: 3 3 (of these, 3637690 are for immediate values)
+    //    247412  Add case: 5 5
+    //    20900   Add case: 5 6
+    //    13962   Add case: 5 3
+    //    4000    Add case: 3 5
+
+    ALWAYS_INLINE JSValue jsAdd(CallFrame* callFrame, JSValue v1, JSValue v2)
+    {
+        double left;
+        double right = 0.0;
+
+        bool rightIsNumber = v2.getNumber(right);
+        if (rightIsNumber && v1.getNumber(left))
+            return jsNumber(callFrame, left + right);
+        
+        bool leftIsString = v1.isString();
+        if (leftIsString && v2.isString()) {
+            RefPtr<UString::Rep> value = concatenate(asString(v1)->value().rep(), asString(v2)->value().rep());
+            if (!value)
+                return throwOutOfMemoryError(callFrame);
+            return jsString(callFrame, value.release());
+        }
+
+        if (rightIsNumber & leftIsString) {
+            RefPtr<UString::Rep> value = v2.isInt32Fast() ?
+                concatenate(asString(v1)->value().rep(), v2.getInt32Fast()) :
+                concatenate(asString(v1)->value().rep(), right);
+
+            if (!value)
+                return throwOutOfMemoryError(callFrame);
+            return jsString(callFrame, value.release());
+        }
+
+        // All other cases are pretty uncommon
+        return jsAddSlowCase(callFrame, v1, v2);
+    }
+
+    inline size_t countPrototypeChainEntriesAndCheckForProxies(CallFrame* callFrame, JSValue baseValue, const PropertySlot& slot)
+    {
+        JSCell* cell = asCell(baseValue);
+        size_t count = 0;
+
+        while (slot.slotBase() != cell) {
+            JSValue v = cell->structure()->prototypeForLookup(callFrame);
+
+            // If we didn't find slotBase in baseValue's prototype chain, then baseValue
+            // must be a proxy for another object.
+
+            if (v.isNull())
+                return 0;
+
+            cell = asCell(v);
+
+            // Since we're accessing a prototype in a loop, it's a good bet that it
+            // should not be treated as a dictionary.
+            if (cell->structure()->isDictionary())
+                asObject(cell)->setStructure(Structure::fromDictionaryTransition(cell->structure()));
+
+            ++count;
+        }
+        
+        ASSERT(count);
+        return count;
+    }
+
+    ALWAYS_INLINE JSValue resolveBase(CallFrame* callFrame, Identifier& property, ScopeChainNode* scopeChain)
+    {
+        ScopeChainIterator iter = scopeChain->begin();
+        ScopeChainIterator next = iter;
+        ++next;
+        ScopeChainIterator end = scopeChain->end();
+        ASSERT(iter != end);
+
+        PropertySlot slot;
+        JSObject* base;
+        while (true) {
+            base = *iter;
+            if (next == end || base->getPropertySlot(callFrame, property, slot))
+                return base;
+
+            iter = next;
+            ++next;
+        }
+
+        ASSERT_NOT_REACHED();
+        return JSValue();
+    }
+
+    ALWAYS_INLINE JSValue concatenateStrings(CallFrame* callFrame, Register* strings, unsigned count)
+    {
+        ASSERT(count >= 3);
+
+        // Estimate the amount of space required to hold the entire string.  If all
+        // arguments are strings, we can easily calculate the exact amount of space
+        // required.  For any other arguments, for now let's assume they may require
+        // 11 UChars of storage.  This is enouch to hold any int, and likely is also
+        // reasonable for the other immediates.  We may want to come back and tune
+        // this value at some point.
+        unsigned bufferSize = 0;
+        for (unsigned i = 0; i < count; ++i) {
+            JSValue v = strings[i].jsValue();
+            if (LIKELY(v.isString()))
+                bufferSize += asString(v)->value().size();
+            else
+                bufferSize += 11;
+        }
+
+        // Allocate an output string to store the result.
+        // If the first argument is a String, and if it has the capacity (or can grow
+        // its capacity) to hold the entire result then use this as a base to concatenate
+        // onto.  Otherwise, allocate a new empty output buffer.
+        JSValue firstValue = strings[0].jsValue();
+        RefPtr<UString::Rep> resultRep;
+        if (firstValue.isString() && (resultRep = asString(firstValue)->value().rep())->reserveCapacity(bufferSize)) {
+            // We're going to concatenate onto the first string - remove it from the list of items to be appended.
+            ++strings;
+            --count;
+        } else
+            resultRep = UString::Rep::createEmptyBuffer(bufferSize);
+        UString result(resultRep);
+
+        // Loop over the openards, writing them into the output buffer.
+        for (unsigned i = 0; i < count; ++i) {
+            JSValue v = strings[i].jsValue();
+            if (LIKELY(v.isString()))
+                result.append(asString(v)->value());
+            else if (v.isInt32Fast())
+                result.appendNumeric(v.getInt32Fast());
+            else {
+                double d;
+                if (v.getNumber(d))
+                    result.appendNumeric(d);
+                else
+                    result.append(v.toString(callFrame));
+            }
+        }
+
+        return jsString(callFrame, result);
+    }
+
+} // namespace JSC
+
+#endif // Operations_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h
index 935df68..44dc2b8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyMapHashTable.h
@@ -30,20 +30,23 @@ namespace JSC {
         UString::Rep* key;
         unsigned offset;
         unsigned attributes;
+        JSCell* specificValue;
         unsigned index;
 
-        PropertyMapEntry(UString::Rep* key, unsigned attributes)
+        PropertyMapEntry(UString::Rep* key, unsigned attributes, JSCell* specificValue)
             : key(key)
             , offset(0)
             , attributes(attributes)
+            , specificValue(specificValue)
             , index(0)
         {
         }
 
-        PropertyMapEntry(UString::Rep* key, unsigned offset, unsigned attributes, unsigned index)
+        PropertyMapEntry(UString::Rep* key, unsigned offset, unsigned attributes, JSCell* specificValue, unsigned index)
             : key(key)
             , offset(offset)
             , attributes(attributes)
+            , specificValue(specificValue)
             , index(index)
         {
         }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp
index 47e9d84..0878e73 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.cpp
@@ -27,7 +27,7 @@ static const size_t setThreshold = 20;
 
 void PropertyNameArray::add(UString::Rep* identifier)
 {
-    ASSERT(identifier == &UString::Rep::null || identifier == &UString::Rep::empty || identifier->identifierTable());
+    ASSERT(identifier == &UString::Rep::null() || identifier == &UString::Rep::empty() || identifier->identifierTable());
 
     size_t size = m_data->propertyNameVector().size();
     if (size < setThreshold) {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.h
index 7dc14fe..b4382f4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertyNameArray.h
@@ -65,14 +65,14 @@ namespace JSC {
         PropertyNameArray(JSGlobalData* globalData)
             : m_data(PropertyNameArrayData::create())
             , m_globalData(globalData)
-            , m_cacheable(true)
+            , m_shouldCache(true)
         {
         }
 
         PropertyNameArray(ExecState* exec)
             : m_data(PropertyNameArrayData::create())
             , m_globalData(&exec->globalData())
-            , m_cacheable(true)
+            , m_shouldCache(true)
         {
         }
 
@@ -95,8 +95,8 @@ namespace JSC {
 
         PassRefPtr<PropertyNameArrayData> releaseData() { return m_data.release(); }
 
-        void setCacheable(bool cacheable) { m_cacheable = cacheable; }
-        bool cacheable() const { return m_cacheable; }
+        void setShouldCache(bool shouldCache) { m_shouldCache = shouldCache; }
+        bool shouldCache() const { return m_shouldCache; }
 
     private:
         typedef HashSet<UString::Rep*, PtrHash<UString::Rep*> > IdentifierSet;
@@ -104,7 +104,7 @@ namespace JSC {
         RefPtr<PropertyNameArrayData> m_data;
         IdentifierSet m_set;
         JSGlobalData* m_globalData;
-        bool m_cacheable;
+        bool m_shouldCache;
     };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp
index 175f271..36fa5d8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.cpp
@@ -27,7 +27,7 @@
 
 namespace JSC {
 
-JSValuePtr PropertySlot::functionGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue PropertySlot::functionGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     // Prevent getter functions from observing execution if an exception is pending.
     if (exec->hadException())
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h
index 1dd1afa..da0d152 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PropertySlot.h
@@ -45,30 +45,30 @@ namespace JSC {
             clearValue();
         }
 
-        explicit PropertySlot(const JSValuePtr base)
+        explicit PropertySlot(const JSValue base)
             : m_slotBase(base)
             , m_offset(WTF::notFound)
         {
             clearValue();
         }
 
-        typedef JSValuePtr (*GetValueFunc)(ExecState*, const Identifier&, const PropertySlot&);
+        typedef JSValue (*GetValueFunc)(ExecState*, const Identifier&, const PropertySlot&);
 
-        JSValuePtr getValue(ExecState* exec, const Identifier& propertyName) const
+        JSValue getValue(ExecState* exec, const Identifier& propertyName) const
         {
             if (m_getValue == JSC_VALUE_SLOT_MARKER)
                 return *m_data.valueSlot;
             if (m_getValue == JSC_REGISTER_SLOT_MARKER)
-                return (*m_data.registerSlot).jsValue(exec);
+                return (*m_data.registerSlot).jsValue();
             return m_getValue(exec, propertyName, *this);
         }
 
-        JSValuePtr getValue(ExecState* exec, unsigned propertyName) const
+        JSValue getValue(ExecState* exec, unsigned propertyName) const
         {
             if (m_getValue == JSC_VALUE_SLOT_MARKER)
                 return *m_data.valueSlot;
             if (m_getValue == JSC_REGISTER_SLOT_MARKER)
-                return (*m_data.registerSlot).jsValue(exec);
+                return (*m_data.registerSlot).jsValue();
             return m_getValue(exec, Identifier::from(exec, propertyName), *this);
         }
 
@@ -79,17 +79,7 @@ namespace JSC {
             return m_offset;
         }
 
-        void putValue(JSValuePtr value)
-        { 
-            if (m_getValue == JSC_VALUE_SLOT_MARKER) {
-                *m_data.valueSlot = value;
-                return;
-            }
-            ASSERT(m_getValue == JSC_REGISTER_SLOT_MARKER);
-            *m_data.registerSlot = JSValuePtr(value);
-        }
-
-        void setValueSlot(JSValuePtr* valueSlot) 
+        void setValueSlot(JSValue* valueSlot) 
         {
             ASSERT(valueSlot);
             m_getValue = JSC_VALUE_SLOT_MARKER;
@@ -97,7 +87,7 @@ namespace JSC {
             m_data.valueSlot = valueSlot;
         }
         
-        void setValueSlot(JSValuePtr slotBase, JSValuePtr* valueSlot)
+        void setValueSlot(JSValue slotBase, JSValue* valueSlot)
         {
             ASSERT(valueSlot);
             m_getValue = JSC_VALUE_SLOT_MARKER;
@@ -105,7 +95,7 @@ namespace JSC {
             m_data.valueSlot = valueSlot;
         }
         
-        void setValueSlot(JSValuePtr slotBase, JSValuePtr* valueSlot, size_t offset)
+        void setValueSlot(JSValue slotBase, JSValue* valueSlot, size_t offset)
         {
             ASSERT(valueSlot);
             m_getValue = JSC_VALUE_SLOT_MARKER;
@@ -114,7 +104,7 @@ namespace JSC {
             m_offset = offset;
         }
         
-        void setValue(JSValuePtr value)
+        void setValue(JSValue value)
         {
             ASSERT(value);
             m_getValue = JSC_VALUE_SLOT_MARKER;
@@ -131,7 +121,7 @@ namespace JSC {
             m_data.registerSlot = registerSlot;
         }
 
-        void setCustom(JSValuePtr slotBase, GetValueFunc getValue)
+        void setCustom(JSValue slotBase, GetValueFunc getValue)
         {
             ASSERT(slotBase);
             ASSERT(getValue);
@@ -139,7 +129,7 @@ namespace JSC {
             m_slotBase = slotBase;
         }
 
-        void setCustomIndex(JSValuePtr slotBase, unsigned index, GetValueFunc getValue)
+        void setCustomIndex(JSValue slotBase, unsigned index, GetValueFunc getValue)
         {
             ASSERT(slotBase);
             ASSERT(getValue);
@@ -161,13 +151,13 @@ namespace JSC {
             setValue(jsUndefined());
         }
 
-        JSValuePtr slotBase() const
+        JSValue slotBase() const
         {
             ASSERT(m_slotBase);
             return m_slotBase;
         }
 
-        void setBase(JSValuePtr base)
+        void setBase(JSValue base)
         {
             ASSERT(m_slotBase);
             ASSERT(base);
@@ -177,33 +167,33 @@ namespace JSC {
         void clearBase()
         {
 #ifndef NDEBUG
-            m_slotBase = noValue();
+            m_slotBase = JSValue();
 #endif
         }
 
         void clearValue()
         {
 #ifndef NDEBUG
-            m_value = noValue();
+            m_value = JSValue();
 #endif
         }
 
         unsigned index() const { return m_data.index; }
 
     private:
-        static JSValuePtr functionGetter(ExecState*, const Identifier&, const PropertySlot&);
+        static JSValue functionGetter(ExecState*, const Identifier&, const PropertySlot&);
 
         GetValueFunc m_getValue;
         
-        JSValuePtr m_slotBase;
+        JSValue m_slotBase;
         union {
             JSObject* getterFunc;
-            JSValuePtr* valueSlot;
+            JSValue* valueSlot;
             Register* registerSlot;
             unsigned index;
         } m_data;
 
-        JSValuePtr m_value;
+        JSValue m_value;
 
         size_t m_offset;
     };
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Protect.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Protect.h
index efbc4bb..224164d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Protect.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Protect.h
@@ -49,18 +49,16 @@ namespace JSC {
             gcUnprotect(val);
     }
     
-    inline void gcProtect(JSValuePtr value)
+    inline void gcProtect(JSValue value)
     {
-        if (!value || JSImmediate::isImmediate(value))
-            return;
-        gcProtect(asCell(value));
+        if (value && value.isCell())
+            gcProtect(asCell(value));
     }
 
-    inline void gcUnprotect(JSValuePtr value)
+    inline void gcUnprotect(JSValue value)
     {
-        if (!value || JSImmediate::isImmediate(value))
-            return;
-        gcUnprotect(asCell(value));
+        if (value && value.isCell())
+            gcUnprotect(asCell(value));
     }
 
     // FIXME: Share more code with RefPtr template? The only differences are the ref/deref operation
@@ -76,7 +74,7 @@ namespace JSC {
         
         T* get() const { return m_ptr; }
         operator T*() const { return m_ptr; }
-        operator JSValuePtr() const { return JSValuePtr(m_ptr); }
+        operator JSValue() const { return JSValue(m_ptr); }
         T* operator->() const { return m_ptr; }
         
         operator bool() const { return m_ptr; }
@@ -89,27 +87,27 @@ namespace JSC {
         T* m_ptr;
     };
 
-    class ProtectedJSValuePtr {
+    class ProtectedJSValue {
     public:
-        ProtectedJSValuePtr() {}
-        ProtectedJSValuePtr(JSValuePtr value);
-        ProtectedJSValuePtr(const ProtectedJSValuePtr&);
-        ~ProtectedJSValuePtr();
+        ProtectedJSValue() {}
+        ProtectedJSValue(JSValue value);
+        ProtectedJSValue(const ProtectedJSValue&);
+        ~ProtectedJSValue();
 
-        template <class U> ProtectedJSValuePtr(const ProtectedPtr<U>&);
+        template <class U> ProtectedJSValue(const ProtectedPtr<U>&);
         
-        JSValuePtr get() const { return m_value; }
-        operator JSValuePtr() const { return m_value; }
-        JSValuePtr operator->() const { return m_value; }
+        JSValue get() const { return m_value; }
+        operator JSValue() const { return m_value; }
+        JSValue operator->() const { return m_value; }
         
         operator bool() const { return m_value; }
         bool operator!() const { return !m_value; }
 
-        ProtectedJSValuePtr& operator=(const ProtectedJSValuePtr&);
-        ProtectedJSValuePtr& operator=(JSValuePtr);
+        ProtectedJSValue& operator=(const ProtectedJSValue&);
+        ProtectedJSValue& operator=(JSValue);
         
     private:
-        JSValuePtr m_value;
+        JSValue m_value;
     };
 
     template <class T> inline ProtectedPtr<T>::ProtectedPtr(T* ptr)
@@ -152,39 +150,39 @@ namespace JSC {
         return *this;
     }
 
-    inline ProtectedJSValuePtr::ProtectedJSValuePtr(JSValuePtr value)
+    inline ProtectedJSValue::ProtectedJSValue(JSValue value)
         : m_value(value)
     {
         gcProtect(m_value);
     }
 
-    inline ProtectedJSValuePtr::ProtectedJSValuePtr(const ProtectedJSValuePtr& o)
+    inline ProtectedJSValue::ProtectedJSValue(const ProtectedJSValue& o)
         : m_value(o.get())
     {
         gcProtect(m_value);
     }
 
-    inline ProtectedJSValuePtr::~ProtectedJSValuePtr()
+    inline ProtectedJSValue::~ProtectedJSValue()
     {
         gcUnprotect(m_value);
     }
 
-    template <class U> ProtectedJSValuePtr::ProtectedJSValuePtr(const ProtectedPtr<U>& o)
+    template <class U> ProtectedJSValue::ProtectedJSValue(const ProtectedPtr<U>& o)
         : m_value(o.get())
     {
         gcProtect(m_value);
     }
 
-    inline ProtectedJSValuePtr& ProtectedJSValuePtr::operator=(const ProtectedJSValuePtr& o) 
+    inline ProtectedJSValue& ProtectedJSValue::operator=(const ProtectedJSValue& o) 
     {
-        JSValuePtr ovalue = o.m_value;
+        JSValue ovalue = o.m_value;
         gcProtect(ovalue);
         gcUnprotect(m_value);
         m_value = ovalue;
         return *this;
     }
 
-    inline ProtectedJSValuePtr& ProtectedJSValuePtr::operator=(JSValuePtr ovalue)
+    inline ProtectedJSValue& ProtectedJSValue::operator=(JSValue ovalue)
     {
         gcProtect(ovalue);
         gcUnprotect(m_value);
@@ -200,17 +198,17 @@ namespace JSC {
     template <class T> inline bool operator!=(const ProtectedPtr<T>& a, const T* b) { return a.get() != b; }
     template <class T> inline bool operator!=(const T* a, const ProtectedPtr<T>& b) { return a != b.get(); }
 
-    inline bool operator==(const ProtectedJSValuePtr& a, const ProtectedJSValuePtr& b) { return a.get() == b.get(); }
-    inline bool operator==(const ProtectedJSValuePtr& a, const JSValuePtr b) { return a.get() == b; }
-    template <class T> inline bool operator==(const ProtectedJSValuePtr& a, const ProtectedPtr<T>& b) { return a.get() == JSValuePtr(b.get()); }
-    inline bool operator==(const JSValuePtr a, const ProtectedJSValuePtr& b) { return a == b.get(); }
-    template <class T> inline bool operator==(const ProtectedPtr<T>& a, const ProtectedJSValuePtr& b) { return JSValuePtr(a.get()) == b.get(); }
-
-    inline bool operator!=(const ProtectedJSValuePtr& a, const ProtectedJSValuePtr& b) { return a.get() != b.get(); }
-    inline bool operator!=(const ProtectedJSValuePtr& a, const JSValuePtr b) { return a.get() != b; }
-    template <class T> inline bool operator!=(const ProtectedJSValuePtr& a, const ProtectedPtr<T>& b) { return a.get() != JSValuePtr(b.get()); }
-    inline bool operator!=(const JSValuePtr a, const ProtectedJSValuePtr& b) { return a != b.get(); }
-    template <class T> inline bool operator!=(const ProtectedPtr<T>& a, const ProtectedJSValuePtr& b) { return JSValuePtr(a.get()) != b.get(); }
+    inline bool operator==(const ProtectedJSValue& a, const ProtectedJSValue& b) { return a.get() == b.get(); }
+    inline bool operator==(const ProtectedJSValue& a, const JSValue b) { return a.get() == b; }
+    template <class T> inline bool operator==(const ProtectedJSValue& a, const ProtectedPtr<T>& b) { return a.get() == JSValue(b.get()); }
+    inline bool operator==(const JSValue a, const ProtectedJSValue& b) { return a == b.get(); }
+    template <class T> inline bool operator==(const ProtectedPtr<T>& a, const ProtectedJSValue& b) { return JSValue(a.get()) == b.get(); }
+
+    inline bool operator!=(const ProtectedJSValue& a, const ProtectedJSValue& b) { return a.get() != b.get(); }
+    inline bool operator!=(const ProtectedJSValue& a, const JSValue b) { return a.get() != b; }
+    template <class T> inline bool operator!=(const ProtectedJSValue& a, const ProtectedPtr<T>& b) { return a.get() != JSValue(b.get()); }
+    inline bool operator!=(const JSValue a, const ProtectedJSValue& b) { return a != b.get(); }
+    template <class T> inline bool operator!=(const ProtectedPtr<T>& a, const ProtectedJSValue& b) { return JSValue(a.get()) != b.get(); }
  
 } // namespace JSC
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/PutPropertySlot.h b/src/3rdparty/webkit/JavaScriptCore/runtime/PutPropertySlot.h
index 1e2dfe9..eb8ea8a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/PutPropertySlot.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/PutPropertySlot.h
@@ -32,15 +32,15 @@
 namespace JSC {
     
     class JSObject;
+    class JSFunction;
     
     class PutPropertySlot {
     public:
-        enum Type { Invalid, ExistingProperty, NewProperty };
+        enum Type { Uncachable, ExistingProperty, NewProperty };
 
         PutPropertySlot()
-            : m_type(Invalid)
+            : m_type(Uncachable)
             , m_base(0)
-            , m_wasTransition(false)
         {
         }
 
@@ -61,18 +61,14 @@ namespace JSC {
         Type type() const { return m_type; }
         JSObject* base() const { return m_base; }
 
-        bool isCacheable() const { return m_type != Invalid; }
+        bool isCacheable() const { return m_type != Uncachable; }
         size_t cachedOffset() const {
             ASSERT(isCacheable());
             return m_offset;
         }
-        
-        bool wasTransition() const { return m_wasTransition; }
-        void setWasTransition(bool wasTransition) { m_wasTransition = wasTransition; }
     private:
         Type m_type;
         JSObject* m_base;
-        bool m_wasTransition;
         size_t m_offset;
     };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp
index 722914d8..857a316 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.cpp
@@ -20,17 +20,33 @@
 
 #include "config.h"
 #include "RegExp.h"
-
-#include "JIT.h"
 #include "Lexer.h"
-#include "WRECGenerator.h"
-#include <pcre/pcre.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <wtf/Assertions.h>
 #include <wtf/OwnArrayPtr.h>
 
+
+#if ENABLE(YARR)
+
+#include "yarr/RegexCompiler.h"
+#if ENABLE(YARR_JIT)
+#include "yarr/RegexJIT.h"
+#else
+#include "yarr/RegexInterpreter.h"
+#endif
+
+#else
+
+#if ENABLE(WREC)
+#include "JIT.h"
+#include "WRECGenerator.h"
+#endif
+#include <pcre/pcre.h>
+
+#endif
+
 namespace JSC {
 
 #if ENABLE(WREC)
@@ -40,62 +56,41 @@ using namespace WREC;
 inline RegExp::RegExp(JSGlobalData* globalData, const UString& pattern)
     : m_pattern(pattern)
     , m_flagBits(0)
-    , m_regExp(0)
     , m_constructionError(0)
     , m_numSubpatterns(0)
 {
-    UNUSED_PARAM(globalData);
-#if ENABLE(WREC)
-    m_wrecFunction = Generator::compileRegExp(globalData, pattern, &m_numSubpatterns, &m_constructionError, m_executablePool);
-    if (m_wrecFunction || m_constructionError)
-        return;
-    // Fall through to non-WREC case.
-#endif
-    m_regExp = jsRegExpCompile(reinterpret_cast<const UChar*>(pattern.data()), pattern.size(),
-        JSRegExpDoNotIgnoreCase, JSRegExpSingleLine, &m_numSubpatterns, &m_constructionError);
-}
-
-PassRefPtr<RegExp> RegExp::create(JSGlobalData* globalData, const UString& pattern)
-{
-    return adoptRef(new RegExp(globalData, pattern));
+    compile(globalData);
 }
 
 inline RegExp::RegExp(JSGlobalData* globalData, const UString& pattern, const UString& flags)
     : m_pattern(pattern)
     , m_flags(flags)
     , m_flagBits(0)
-    , m_regExp(0)
     , m_constructionError(0)
     , m_numSubpatterns(0)
 {
-    UNUSED_PARAM(globalData);
-
     // NOTE: The global flag is handled on a case-by-case basis by functions like
     // String::match and RegExpObject::match.
     if (flags.find('g') != -1)
         m_flagBits |= Global;
-
-    // FIXME: Eliminate duplication by adding a way ask a JSRegExp what its flags are?
-    JSRegExpIgnoreCaseOption ignoreCaseOption = JSRegExpDoNotIgnoreCase;
-    if (flags.find('i') != -1) {
+    if (flags.find('i') != -1)
         m_flagBits |= IgnoreCase;
-        ignoreCaseOption = JSRegExpIgnoreCase;
-    }
-
-    JSRegExpMultilineOption multilineOption = JSRegExpSingleLine;
-    if (flags.find('m') != -1) {
+    if (flags.find('m') != -1)
         m_flagBits |= Multiline;
-        multilineOption = JSRegExpMultiline;
-    }
 
-#if ENABLE(WREC)
-    m_wrecFunction = Generator::compileRegExp(globalData, pattern, &m_numSubpatterns, &m_constructionError, m_executablePool, (m_flagBits & IgnoreCase), (m_flagBits & Multiline));
-    if (m_wrecFunction || m_constructionError)
-        return;
-    // Fall through to non-WREC case.
+    compile(globalData);
+}
+
+#if !ENABLE(YARR)
+RegExp::~RegExp()
+{
+    jsRegExpFree(m_regExp);
+}
 #endif
-    m_regExp = jsRegExpCompile(reinterpret_cast<const UChar*>(pattern.data()), pattern.size(),
-        ignoreCaseOption, multilineOption, &m_numSubpatterns, &m_constructionError);
+
+PassRefPtr<RegExp> RegExp::create(JSGlobalData* globalData, const UString& pattern)
+{
+    return adoptRef(new RegExp(globalData, pattern));
 }
 
 PassRefPtr<RegExp> RegExp::create(JSGlobalData* globalData, const UString& pattern, const UString& flags)
@@ -103,9 +98,83 @@ PassRefPtr<RegExp> RegExp::create(JSGlobalData* globalData, const UString& patte
     return adoptRef(new RegExp(globalData, pattern, flags));
 }
 
-RegExp::~RegExp()
+#if ENABLE(YARR)
+
+void RegExp::compile(JSGlobalData* globalData)
 {
-    jsRegExpFree(m_regExp);
+#if ENABLE(YARR_JIT)
+    Yarr::jitCompileRegex(globalData, m_regExpJITCode, m_pattern, m_numSubpatterns, m_constructionError, ignoreCase(), multiline());
+#else
+    UNUSED_PARAM(globalData);
+    m_regExpBytecode.set(Yarr::byteCompileRegex(m_pattern, m_numSubpatterns, m_constructionError, ignoreCase(), multiline()));
+#endif
+}
+
+int RegExp::match(const UString& s, int startOffset, OwnArrayPtr<int>* ovector)
+{
+    if (startOffset < 0)
+        startOffset = 0;
+    if (ovector)
+        ovector->clear();
+
+    if (startOffset > s.size() || s.isNull())
+        return -1;
+
+#if ENABLE(YARR_JIT)
+    if (!!m_regExpJITCode) {
+#else
+    if (m_regExpBytecode) {
+#endif
+        int offsetVectorSize = (m_numSubpatterns + 1) * 3; // FIXME: should be 2 - but adding temporary fallback to pcre.
+        int* offsetVector = new int [offsetVectorSize];
+        ASSERT(offsetVector);
+        for (int j = 0; j < offsetVectorSize; ++j)
+            offsetVector[j] = -1;
+
+        OwnArrayPtr<int> nonReturnedOvector;
+        if (!ovector)
+            nonReturnedOvector.set(offsetVector);
+        else
+            ovector->set(offsetVector);
+
+#if ENABLE(YARR_JIT)
+        int result = Yarr::executeRegex(m_regExpJITCode, s.data(), startOffset, s.size(), offsetVector, offsetVectorSize);
+#else
+        int result = Yarr::interpretRegex(m_regExpBytecode.get(), s.data(), startOffset, s.size(), offsetVector);
+#endif
+
+        if (result < 0) {
+#ifndef NDEBUG
+            // TODO: define up a symbol, rather than magic -1
+            if (result != -1)
+                fprintf(stderr, "jsRegExpExecute failed with result %d\n", result);
+#endif
+            if (ovector)
+                ovector->clear();
+        }
+        return result;
+    }
+
+    return -1;
+}
+
+#else
+
+void RegExp::compile(JSGlobalData* globalData)
+{
+    m_regExp = 0;
+#if ENABLE(WREC)
+    m_wrecFunction = Generator::compileRegExp(globalData, m_pattern, &m_numSubpatterns, &m_constructionError, m_executablePool, ignoreCase(), multiline());
+    if (m_wrecFunction || m_constructionError)
+        return;
+    // Fall through to non-WREC case.
+#else
+    UNUSED_PARAM(globalData);
+#endif
+
+    JSRegExpIgnoreCaseOption ignoreCaseOption = ignoreCase() ? JSRegExpIgnoreCase : JSRegExpDoNotIgnoreCase;
+    JSRegExpMultilineOption multilineOption = multiline() ? JSRegExpMultiline : JSRegExpSingleLine;
+    m_regExp = jsRegExpCompile(reinterpret_cast<const UChar*>(m_pattern.data()), m_pattern.size(), ignoreCaseOption, multilineOption, &m_numSubpatterns, &m_constructionError);
 }
 
 int RegExp::match(const UString& s, int startOffset, OwnArrayPtr<int>* ovector)
@@ -122,6 +191,7 @@ int RegExp::match(const UString& s, int startOffset, OwnArrayPtr<int>* ovector)
     if (m_wrecFunction) {
         int offsetVectorSize = (m_numSubpatterns + 1) * 2;
         int* offsetVector = new int [offsetVectorSize];
+        ASSERT(offsetVector);
         for (int j = 0; j < offsetVectorSize; ++j)
             offsetVector[j] = -1;
 
@@ -178,4 +248,6 @@ int RegExp::match(const UString& s, int startOffset, OwnArrayPtr<int>* ovector)
     return -1;
 }
 
+#endif
+
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.h
index 139c754..f3be656 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExp.h
@@ -26,6 +26,8 @@
 #include "ExecutableAllocator.h"
 #include <wtf/Forward.h>
 #include <wtf/RefCounted.h>
+#include "yarr/RegexJIT.h"
+#include "yarr/RegexInterpreter.h"
 
 struct JSRegExp;
 
@@ -37,7 +39,9 @@ namespace JSC {
     public:
         static PassRefPtr<RegExp> create(JSGlobalData* globalData, const UString& pattern);
         static PassRefPtr<RegExp> create(JSGlobalData* globalData, const UString& pattern, const UString& flags);
+#if !ENABLE(YARR)
         ~RegExp();
+#endif
 
         bool global() const { return m_flagBits & Global; }
         bool ignoreCase() const { return m_flagBits & IgnoreCase; }
@@ -56,21 +60,27 @@ namespace JSC {
         RegExp(JSGlobalData* globalData, const UString& pattern);
         RegExp(JSGlobalData* globalData, const UString& pattern, const UString& flags);
 
-        void compile();
+        void compile(JSGlobalData*);
 
         enum FlagBits { Global = 1, IgnoreCase = 2, Multiline = 4 };
 
         UString m_pattern; // FIXME: Just decompile m_regExp instead of storing this.
         UString m_flags; // FIXME: Just decompile m_regExp instead of storing this.
         int m_flagBits;
-        JSRegExp* m_regExp;
         const char* m_constructionError;
         unsigned m_numSubpatterns;
 
+#if ENABLE(YARR_JIT)
+        Yarr::RegexCodeBlock m_regExpJITCode;
+#elif ENABLE(YARR)
+        OwnPtr<Yarr::BytecodePattern> m_regExpBytecode;
+#else
 #if ENABLE(WREC)
         WREC::CompiledRegExp m_wrecFunction;
         RefPtr<ExecutablePool> m_executablePool;
 #endif
+        JSRegExp* m_regExp;
+#endif
     };
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
index 84a297c..bcd0d07 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -33,24 +33,24 @@
 
 namespace JSC {
 
-static JSValuePtr regExpConstructorInput(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorMultiline(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorLastMatch(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorLastParen(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorLeftContext(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorRightContext(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar1(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar2(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar3(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar4(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar5(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar6(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar7(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar8(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpConstructorDollar9(ExecState*, const Identifier&, const PropertySlot&);
-
-static void setRegExpConstructorInput(ExecState*, JSObject*, JSValuePtr);
-static void setRegExpConstructorMultiline(ExecState*, JSObject*, JSValuePtr);
+static JSValue regExpConstructorInput(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorMultiline(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorLastMatch(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorLastParen(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorLeftContext(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorRightContext(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar1(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar2(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar3(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar4(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar5(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar6(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar7(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar8(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpConstructorDollar9(ExecState*, const Identifier&, const PropertySlot&);
+
+static void setRegExpConstructorInput(ExecState*, JSObject*, JSValue);
+static void setRegExpConstructorMultiline(ExecState*, JSObject*, JSValue);
 
 } // namespace JSC
 
@@ -185,7 +185,7 @@ JSObject* RegExpConstructor::arrayOfMatches(ExecState* exec) const
     return new (exec) RegExpMatchesArray(exec, d.get());
 }
 
-JSValuePtr RegExpConstructor::getBackref(ExecState* exec, unsigned i) const
+JSValue RegExpConstructor::getBackref(ExecState* exec, unsigned i) const
 {
     if (d->lastOvector && i <= d->lastNumSubPatterns) {
         int start = d->lastOvector[2 * i];
@@ -195,7 +195,7 @@ JSValuePtr RegExpConstructor::getBackref(ExecState* exec, unsigned i) const
     return jsEmptyString(exec);
 }
 
-JSValuePtr RegExpConstructor::getLastParen(ExecState* exec) const
+JSValue RegExpConstructor::getLastParen(ExecState* exec) const
 {
     unsigned i = d->lastNumSubPatterns;
     if (i > 0) {
@@ -207,14 +207,14 @@ JSValuePtr RegExpConstructor::getLastParen(ExecState* exec) const
     return jsEmptyString(exec);
 }
 
-JSValuePtr RegExpConstructor::getLeftContext(ExecState* exec) const
+JSValue RegExpConstructor::getLeftContext(ExecState* exec) const
 {
     if (d->lastOvector)
         return jsSubstring(exec, d->lastInput, 0, d->lastOvector[0]);
     return jsEmptyString(exec);
 }
 
-JSValuePtr RegExpConstructor::getRightContext(ExecState* exec) const
+JSValue RegExpConstructor::getRightContext(ExecState* exec) const
 {
     if (d->lastOvector)
         return jsSubstring(exec, d->lastInput, d->lastOvector[1], d->lastInput.size() - d->lastOvector[1]);
@@ -226,110 +226,110 @@ bool RegExpConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<RegExpConstructor, InternalFunction>(exec, ExecState::regExpConstructorTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr regExpConstructorDollar1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 1);
 }
 
-JSValuePtr regExpConstructorDollar2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 2);
 }
 
-JSValuePtr regExpConstructorDollar3(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar3(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 3);
 }
 
-JSValuePtr regExpConstructorDollar4(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar4(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 4);
 }
 
-JSValuePtr regExpConstructorDollar5(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar5(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 5);
 }
 
-JSValuePtr regExpConstructorDollar6(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar6(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 6);
 }
 
-JSValuePtr regExpConstructorDollar7(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar7(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 7);
 }
 
-JSValuePtr regExpConstructorDollar8(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar8(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 8);
 }
 
-JSValuePtr regExpConstructorDollar9(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorDollar9(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 9);
 }
 
-JSValuePtr regExpConstructorInput(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorInput(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return jsString(exec, asRegExpConstructor(slot.slotBase())->input());
 }
 
-JSValuePtr regExpConstructorMultiline(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorMultiline(ExecState*, const Identifier&, const PropertySlot& slot)
 {
     return jsBoolean(asRegExpConstructor(slot.slotBase())->multiline());
 }
 
-JSValuePtr regExpConstructorLastMatch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorLastMatch(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getBackref(exec, 0);
 }
 
-JSValuePtr regExpConstructorLastParen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorLastParen(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getLastParen(exec);
 }
 
-JSValuePtr regExpConstructorLeftContext(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorLeftContext(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getLeftContext(exec);
 }
 
-JSValuePtr regExpConstructorRightContext(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpConstructorRightContext(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return asRegExpConstructor(slot.slotBase())->getRightContext(exec);
 }
 
-void RegExpConstructor::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void RegExpConstructor::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<RegExpConstructor, InternalFunction>(exec, propertyName, value, ExecState::regExpConstructorTable(exec), this, slot);
 }
 
-void setRegExpConstructorInput(ExecState* exec, JSObject* baseObject, JSValuePtr value)
+void setRegExpConstructorInput(ExecState* exec, JSObject* baseObject, JSValue value)
 {
-    asRegExpConstructor(baseObject)->setInput(value->toString(exec));
+    asRegExpConstructor(baseObject)->setInput(value.toString(exec));
 }
 
-void setRegExpConstructorMultiline(ExecState* exec, JSObject* baseObject, JSValuePtr value)
+void setRegExpConstructorMultiline(ExecState* exec, JSObject* baseObject, JSValue value)
 {
-    asRegExpConstructor(baseObject)->setMultiline(value->toBoolean(exec));
+    asRegExpConstructor(baseObject)->setMultiline(value.toBoolean(exec));
 }
   
 // ECMA 15.10.4
 JSObject* constructRegExp(ExecState* exec, const ArgList& args)
 {
-    JSValuePtr arg0 = args.at(exec, 0);
-    JSValuePtr arg1 = args.at(exec, 1);
+    JSValue arg0 = args.at(0);
+    JSValue arg1 = args.at(1);
 
-    if (arg0->isObject(&RegExpObject::info)) {
-        if (!arg1->isUndefined())
+    if (arg0.isObject(&RegExpObject::info)) {
+        if (!arg1.isUndefined())
             return throwError(exec, TypeError, "Cannot supply flags when constructing one RegExp from another.");
         return asObject(arg0);
     }
 
-    UString pattern = arg0->isUndefined() ? UString("") : arg0->toString(exec);
-    UString flags = arg1->isUndefined() ? UString("") : arg1->toString(exec);
+    UString pattern = arg0.isUndefined() ? UString("") : arg0.toString(exec);
+    UString flags = arg1.isUndefined() ? UString("") : arg1.toString(exec);
 
     RefPtr<RegExp> regExp = RegExp::create(&exec->globalData(), pattern, flags);
     if (!regExp->isValid())
@@ -349,7 +349,7 @@ ConstructType RegExpConstructor::getConstructData(ConstructData& constructData)
 }
 
 // ECMA 15.10.3
-static JSValuePtr callRegExpConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callRegExpConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     return constructRegExp(exec, args);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
index f8c4366..6823f3f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpConstructor.h
@@ -34,12 +34,12 @@ namespace JSC {
     public:
         RegExpConstructor(ExecState*, PassRefPtr<Structure>, RegExpPrototype*);
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance));
         }
 
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
 
         static const ClassInfo info;
@@ -53,10 +53,10 @@ namespace JSC {
         void setMultiline(bool);
         bool multiline() const;
 
-        JSValuePtr getBackref(ExecState*, unsigned) const;
-        JSValuePtr getLastParen(ExecState*) const;
-        JSValuePtr getLeftContext(ExecState*) const;
-        JSValuePtr getRightContext(ExecState*) const;
+        JSValue getBackref(ExecState*, unsigned) const;
+        JSValue getLastParen(ExecState*) const;
+        JSValue getLeftContext(ExecState*) const;
+        JSValue getRightContext(ExecState*) const;
 
     private:
         virtual ConstructType getConstructData(ConstructData&);
@@ -67,11 +67,11 @@ namespace JSC {
         OwnPtr<RegExpConstructorPrivate> d;
     };
 
-    RegExpConstructor* asRegExpConstructor(JSValuePtr);
+    RegExpConstructor* asRegExpConstructor(JSValue);
 
     JSObject* constructRegExp(ExecState*, const ArgList&);
 
-    inline RegExpConstructor* asRegExpConstructor(JSValuePtr value)
+    inline RegExpConstructor* asRegExpConstructor(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&RegExpConstructor::info));
         return static_cast<RegExpConstructor*>(asObject(value));
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h
index 3583941..9ae18b9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpMatchesArray.h
@@ -44,14 +44,14 @@ namespace JSC {
             return JSArray::getOwnPropertySlot(exec, propertyName, slot);
         }
 
-        virtual void put(ExecState* exec, const Identifier& propertyName, JSValuePtr v, PutPropertySlot& slot)
+        virtual void put(ExecState* exec, const Identifier& propertyName, JSValue v, PutPropertySlot& slot)
         {
             if (lazyCreationData())
                 fillArrayInstance(exec);
             JSArray::put(exec, propertyName, v, slot);
         }
 
-        virtual void put(ExecState* exec, unsigned propertyName, JSValuePtr v)
+        virtual void put(ExecState* exec, unsigned propertyName, JSValue v)
         {
             if (lazyCreationData())
                 fillArrayInstance(exec);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
index 5a54ad0..687844e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "RegExpObject.h"
 
+#include "Error.h"
 #include "JSArray.h"
 #include "JSGlobalObject.h"
 #include "JSString.h"
@@ -29,12 +30,12 @@
 
 namespace JSC {
 
-static JSValuePtr regExpObjectGlobal(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpObjectIgnoreCase(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpObjectMultiline(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpObjectSource(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr regExpObjectLastIndex(ExecState*, const Identifier&, const PropertySlot&);
-static void setRegExpObjectLastIndex(ExecState*, JSObject*, JSValuePtr);
+static JSValue regExpObjectGlobal(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpObjectIgnoreCase(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpObjectMultiline(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpObjectSource(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue regExpObjectLastIndex(ExecState*, const Identifier&, const PropertySlot&);
+static void setRegExpObjectLastIndex(ExecState*, JSObject*, JSValue);
 
 } // namespace JSC
 
@@ -71,54 +72,54 @@ bool RegExpObject::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<RegExpObject, JSObject>(exec, ExecState::regExpTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr regExpObjectGlobal(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectGlobal(ExecState*, const Identifier&, const PropertySlot& slot)
 {
     return jsBoolean(asRegExpObject(slot.slotBase())->regExp()->global());
 }
 
-JSValuePtr regExpObjectIgnoreCase(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectIgnoreCase(ExecState*, const Identifier&, const PropertySlot& slot)
 {
     return jsBoolean(asRegExpObject(slot.slotBase())->regExp()->ignoreCase());
 }
  
-JSValuePtr regExpObjectMultiline(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectMultiline(ExecState*, const Identifier&, const PropertySlot& slot)
 {            
     return jsBoolean(asRegExpObject(slot.slotBase())->regExp()->multiline());
 }
 
-JSValuePtr regExpObjectSource(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectSource(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return jsString(exec, asRegExpObject(slot.slotBase())->regExp()->pattern());
 }
 
-JSValuePtr regExpObjectLastIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue regExpObjectLastIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return jsNumber(exec, asRegExpObject(slot.slotBase())->lastIndex());
 }
 
-void RegExpObject::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void RegExpObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<RegExpObject, JSObject>(exec, propertyName, value, ExecState::regExpTable(exec), this, slot);
 }
 
-void setRegExpObjectLastIndex(ExecState* exec, JSObject* baseObject, JSValuePtr value)
+void setRegExpObjectLastIndex(ExecState* exec, JSObject* baseObject, JSValue value)
 {
-    asRegExpObject(baseObject)->setLastIndex(value->toInteger(exec));
+    asRegExpObject(baseObject)->setLastIndex(value.toInteger(exec));
 }
 
-JSValuePtr RegExpObject::test(ExecState* exec, const ArgList& args)
+JSValue RegExpObject::test(ExecState* exec, const ArgList& args)
 {
     return jsBoolean(match(exec, args));
 }
 
-JSValuePtr RegExpObject::exec(ExecState* exec, const ArgList& args)
+JSValue RegExpObject::exec(ExecState* exec, const ArgList& args)
 {
     if (match(exec, args))
         return exec->lexicalGlobalObject()->regExpConstructor()->arrayOfMatches(exec);
     return jsNull();
 }
 
-static JSValuePtr callRegExpObject(ExecState* exec, JSObject* function, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callRegExpObject(ExecState* exec, JSObject* function, JSValue, const ArgList& args)
 {
     return asRegExpObject(function)->exec(exec, args);
 }
@@ -134,7 +135,7 @@ bool RegExpObject::match(ExecState* exec, const ArgList& args)
 {
     RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
 
-    UString input = args.isEmpty() ? regExpConstructor->input() : args.at(exec, 0)->toString(exec);
+    UString input = args.isEmpty() ? regExpConstructor->input() : args.at(0).toString(exec);
     if (input.isNull()) {
         throwError(exec, GeneralError, "No input to " + toString(exec) + ".");
         return false;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
index 4c99c30..fac9978 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpObject.h
@@ -37,16 +37,16 @@ namespace JSC {
         void setLastIndex(double lastIndex) { d->lastIndex = lastIndex; }
         double lastIndex() const { return d->lastIndex; }
 
-        JSValuePtr test(ExecState*, const ArgList&);
-        JSValuePtr exec(ExecState*, const ArgList&);
+        JSValue test(ExecState*, const ArgList&);
+        JSValue exec(ExecState*, const ArgList&);
 
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
-        virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
+        virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
 
         virtual const ClassInfo* classInfo() const { return &info; }
         static const ClassInfo info;
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType));
         }
@@ -70,9 +70,9 @@ namespace JSC {
         OwnPtr<RegExpObjectData> d;
     };
 
-    RegExpObject* asRegExpObject(JSValuePtr);
+    RegExpObject* asRegExpObject(JSValue);
 
-    inline RegExpObject* asRegExpObject(JSValuePtr value)
+    inline RegExpObject* asRegExpObject(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&RegExpObject::info));
         return static_cast<RegExpObject*>(asObject(value));
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp
index b47d489..b1ab889 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/RegExpPrototype.cpp
@@ -23,6 +23,7 @@
 
 #include "ArrayPrototype.h"
 #include "JSArray.h"
+#include "JSFunction.h"
 #include "JSObject.h"
 #include "JSString.h"
 #include "JSValue.h"
@@ -35,10 +36,10 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(RegExpPrototype);
 
-static JSValuePtr regExpProtoFuncTest(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr regExpProtoFuncExec(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr regExpProtoFuncCompile(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr regExpProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL regExpProtoFuncTest(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL regExpProtoFuncExec(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL regExpProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
 
 // ECMA 15.10.5
 
@@ -47,44 +48,44 @@ const ClassInfo RegExpPrototype::info = { "RegExpPrototype", 0, 0, 0 };
 RegExpPrototype::RegExpPrototype(ExecState* exec, PassRefPtr<Structure> structure, Structure* prototypeFunctionStructure)
     : JSObject(structure)
 {
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().compile, regExpProtoFuncCompile), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().exec, regExpProtoFuncExec), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().test, regExpProtoFuncTest), DontEnum);
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, regExpProtoFuncToString), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().compile, regExpProtoFuncCompile), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().exec, regExpProtoFuncExec), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().test, regExpProtoFuncTest), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 0, exec->propertyNames().toString, regExpProtoFuncToString), DontEnum);
 }
 
 // ------------------------------ Functions ---------------------------
     
-JSValuePtr regExpProtoFuncTest(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL regExpProtoFuncTest(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&RegExpObject::info))
+    if (!thisValue.isObject(&RegExpObject::info))
         return throwError(exec, TypeError);
     return asRegExpObject(thisValue)->test(exec, args);
 }
 
-JSValuePtr regExpProtoFuncExec(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL regExpProtoFuncExec(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&RegExpObject::info))
+    if (!thisValue.isObject(&RegExpObject::info))
         return throwError(exec, TypeError);
     return asRegExpObject(thisValue)->exec(exec, args);
 }
 
-JSValuePtr regExpProtoFuncCompile(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&RegExpObject::info))
+    if (!thisValue.isObject(&RegExpObject::info))
         return throwError(exec, TypeError);
 
     RefPtr<RegExp> regExp;
-    JSValuePtr arg0 = args.at(exec, 0);
-    JSValuePtr arg1 = args.at(exec, 1);
+    JSValue arg0 = args.at(0);
+    JSValue arg1 = args.at(1);
     
-    if (arg0->isObject(&RegExpObject::info)) {
-        if (!arg1->isUndefined())
+    if (arg0.isObject(&RegExpObject::info)) {
+        if (!arg1.isUndefined())
             return throwError(exec, TypeError, "Cannot supply flags when constructing one RegExp from another.");
         regExp = asRegExpObject(arg0)->regExp();
     } else {
-        UString pattern = args.isEmpty() ? UString("") : arg0->toString(exec);
-        UString flags = arg1->isUndefined() ? UString("") : arg1->toString(exec);
+        UString pattern = args.isEmpty() ? UString("") : arg0.toString(exec);
+        UString flags = arg1.isUndefined() ? UString("") : arg1.toString(exec);
         regExp = RegExp::create(&exec->globalData(), pattern, flags);
     }
 
@@ -96,21 +97,21 @@ JSValuePtr regExpProtoFuncCompile(ExecState* exec, JSObject*, JSValuePtr thisVal
     return jsUndefined();
 }
 
-JSValuePtr regExpProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL regExpProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    if (!thisValue->isObject(&RegExpObject::info)) {
-        if (thisValue->isObject(&RegExpPrototype::info))
+    if (!thisValue.isObject(&RegExpObject::info)) {
+        if (thisValue.isObject(&RegExpPrototype::info))
             return jsNontrivialString(exec, "//");
         return throwError(exec, TypeError);
     }
 
-    UString result = "/" + asRegExpObject(thisValue)->get(exec, exec->propertyNames().source)->toString(exec);
+    UString result = "/" + asRegExpObject(thisValue)->get(exec, exec->propertyNames().source).toString(exec);
     result.append('/');
-    if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().global)->toBoolean(exec))
+    if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().global).toBoolean(exec))
         result.append('g');
-    if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().ignoreCase)->toBoolean(exec))
+    if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().ignoreCase).toBoolean(exec))
         result.append('i');
-    if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().multiline)->toBoolean(exec))
+    if (asRegExpObject(thisValue)->get(exec, exec->propertyNames().multiline).toBoolean(exec))
         result.append('m');
     return jsNontrivialString(exec, result);
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h b/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
index 32b5e92..17aff24 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/ScopeChain.h
@@ -21,7 +21,7 @@
 #ifndef ScopeChain_h
 #define ScopeChain_h
 
-#include <wtf/Assertions.h>
+#include "FastAllocBase.h"
 
 namespace JSC {
 
@@ -30,7 +30,7 @@ namespace JSC {
     class JSObject;
     class ScopeChainIterator;
     
-    class ScopeChainNode {
+    class ScopeChainNode : public FastAllocBase {
     public:
         ScopeChainNode(ScopeChainNode* next, JSObject* object, JSGlobalData* globalData, JSObject* globalThis)
             : next(next)
@@ -41,6 +41,18 @@ namespace JSC {
         {
             ASSERT(globalData);
         }
+#ifndef NDEBUG
+        // Due to the number of subtle and timing dependent bugs that have occurred due
+        // to deleted but still "valid" ScopeChainNodes we now deliberately clobber the
+        // contents in debug builds.
+        ~ScopeChainNode()
+        {
+            next = 0;
+            object = 0;
+            globalData = 0;
+            globalThis = 0;
+        }
+#endif
 
         ScopeChainNode* next;
         JSObject* object;
@@ -171,6 +183,9 @@ namespace JSC {
         {
             if (m_node)
                 m_node->deref();
+#ifndef NDEBUG
+            m_node = 0;
+#endif
         }
 
         void swap(ScopeChain&);
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp
index 06811b9..87b49f0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.cpp
@@ -29,48 +29,52 @@
 #include "JSGlobalObject.h"
 #include "JSString.h"
 
+#include <wtf/Noncopyable.h>
+
 namespace JSC {
+static const unsigned numCharactersToStore = 0x100;
 
-class SmallStringsStorage {
+class SmallStringsStorage : Noncopyable {
 public:
     SmallStringsStorage();
-    ~SmallStringsStorage();
 
-    UString::Rep* rep(unsigned char character) { return &reps[character]; }
+    UString::Rep* rep(unsigned char character) { return &m_reps[character]; }
 
 private:
-    UChar characters[0x100];
-    UString::Rep* reps;
+    UChar m_characters[numCharactersToStore];
+    UString::BaseString m_base;
+    UString::Rep m_reps[numCharactersToStore];
 };
 
 SmallStringsStorage::SmallStringsStorage()
-    : reps(static_cast<UString::Rep*>(fastZeroedMalloc(sizeof(UString::Rep) * 0x100)))
+    : m_base(m_characters, numCharactersToStore)
 {
-    for (unsigned i = 0; i < 0x100; ++i) {
-        characters[i] = i;
-        reps[i].offset = i;
-        reps[i].len = 1;
-        reps[i].rc = 1;
-        reps[i].baseString = &reps[0];
-    }
-    reps[0].rc = 0x101;
-    reps[0].buf = characters;
-
+    m_base.rc = numCharactersToStore + 1;
     // make sure UString doesn't try to reuse the buffer by pretending we have one more character in it
-    reps[0].usedCapacity = 0x101;
-    reps[0].capacity = 0x101;
-}
+    m_base.usedCapacity = numCharactersToStore + 1;
+    m_base.capacity = numCharactersToStore + 1;
+    m_base.checkConsistency();
 
-SmallStringsStorage::~SmallStringsStorage()
-{
-    fastFree(reps);
+    for (unsigned i = 0; i < numCharactersToStore; ++i)
+        m_characters[i] = i;
+
+    memset(&m_reps, 0, sizeof(m_reps));
+    for (unsigned i = 0; i < numCharactersToStore; ++i) {
+        m_reps[i].offset = i;
+        m_reps[i].len = 1;
+        m_reps[i].rc = 1;
+        m_reps[i].setBaseString(&m_base);
+        m_reps[i].checkConsistency();
+    }
 }
 
 SmallStrings::SmallStrings()
     : m_emptyString(0)
     , m_storage(0)
 {
-    for (unsigned i = 0; i < 0x100; ++i)
+    COMPILE_ASSERT(numCharactersToStore == sizeof(m_singleCharacterStrings) / sizeof(m_singleCharacterStrings[0]), IsNumCharactersConstInSyncWithClassUsage);
+
+    for (unsigned i = 0; i < numCharactersToStore; ++i)
         m_singleCharacterStrings[i] = 0;
 }
 
@@ -82,12 +86,24 @@ void SmallStrings::mark()
 {
     if (m_emptyString && !m_emptyString->marked())
         m_emptyString->mark();
-    for (unsigned i = 0; i < 0x100; ++i) {
+    for (unsigned i = 0; i < numCharactersToStore; ++i) {
         if (m_singleCharacterStrings[i] && !m_singleCharacterStrings[i]->marked())
             m_singleCharacterStrings[i]->mark();
     }
 }
-    
+
+unsigned SmallStrings::count() const
+{
+    unsigned count = 0;
+    if (m_emptyString)
+        ++count;
+    for (unsigned i = 0; i < numCharactersToStore; ++i) {
+        if (m_singleCharacterStrings[i])
+            ++count;
+    }
+    return count;
+}
+
 void SmallStrings::createEmptyString(JSGlobalData* globalData)
 {
     ASSERT(!m_emptyString);
@@ -109,4 +125,4 @@ UString::Rep* SmallStrings::singleCharacterStringRep(unsigned char character)
     return m_storage->rep(character);
 }
 
-}
+} // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h
index 7e5f5c8..e7f1170 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/SmallStrings.h
@@ -55,9 +55,11 @@ namespace JSC {
         }
 
         UString::Rep* singleCharacterStringRep(unsigned char character);
-        
+
         void mark();
-        
+
+        unsigned count() const;
+
     private:
         void createEmptyString(JSGlobalData*);
         void createSingleCharacterString(JSGlobalData*, unsigned char);
@@ -66,7 +68,7 @@ namespace JSC {
         JSString* m_singleCharacterStrings[0x100];
         OwnPtr<SmallStringsStorage> m_storage;
     };
-    
-}
 
-#endif
+} // namespace JSC
+
+#endif // SmallStrings_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringConstructor.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StringConstructor.cpp
index bac819f..6380445 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringConstructor.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringConstructor.cpp
@@ -21,26 +21,27 @@
 #include "config.h"
 #include "StringConstructor.h"
 
+#include "JSFunction.h"
 #include "JSGlobalObject.h"
 #include "PrototypeFunction.h"
 #include "StringPrototype.h"
 
 namespace JSC {
 
-static NEVER_INLINE JSValuePtr stringFromCharCodeSlowCase(ExecState* exec, const ArgList& args)
+static NEVER_INLINE JSValue stringFromCharCodeSlowCase(ExecState* exec, const ArgList& args)
 {
     UChar* buf = static_cast<UChar*>(fastMalloc(args.size() * sizeof(UChar)));
     UChar* p = buf;
     ArgList::const_iterator end = args.end();
     for (ArgList::const_iterator it = args.begin(); it != end; ++it)
-        *p++ = static_cast<UChar>((*it).jsValue(exec)->toUInt32(exec));
+        *p++ = static_cast<UChar>((*it).toUInt32(exec));
     return jsString(exec, UString(buf, p - buf, false));
 }
 
-static JSValuePtr stringFromCharCode(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL stringFromCharCode(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     if (LIKELY(args.size() == 1))
-        return jsSingleCharacterString(exec, args.at(exec, 0)->toUInt32(exec));
+        return jsSingleCharacterString(exec, args.at(0).toUInt32(exec));
     return stringFromCharCodeSlowCase(exec, args);
 }
 
@@ -53,7 +54,7 @@ StringConstructor::StringConstructor(ExecState* exec, PassRefPtr<Structure> stru
     putDirectWithoutTransition(exec->propertyNames().prototype, stringPrototype, ReadOnly | DontEnum | DontDelete);
 
     // ECMA 15.5.3.2 fromCharCode()
-    putDirectFunctionWithoutTransition(exec, new (exec) PrototypeFunction(exec, prototypeFunctionStructure, 1, exec->propertyNames().fromCharCode, stringFromCharCode), DontEnum);
+    putDirectFunctionWithoutTransition(exec, new (exec) NativeFunctionWrapper(exec, prototypeFunctionStructure, 1, exec->propertyNames().fromCharCode, stringFromCharCode), DontEnum);
 
     // no. of arguments for constructor
     putDirectWithoutTransition(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly | DontEnum | DontDelete);
@@ -64,7 +65,7 @@ static JSObject* constructWithStringConstructor(ExecState* exec, JSObject*, cons
 {
     if (args.isEmpty())
         return new (exec) StringObject(exec, exec->lexicalGlobalObject()->stringObjectStructure());
-    return new (exec) StringObject(exec, exec->lexicalGlobalObject()->stringObjectStructure(), args.at(exec, 0)->toString(exec));
+    return new (exec) StringObject(exec, exec->lexicalGlobalObject()->stringObjectStructure(), args.at(0).toString(exec));
 }
 
 ConstructType StringConstructor::getConstructData(ConstructData& constructData)
@@ -74,11 +75,11 @@ ConstructType StringConstructor::getConstructData(ConstructData& constructData)
 }
 
 // ECMA 15.5.1
-static JSValuePtr callStringConstructor(ExecState* exec, JSObject*, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callStringConstructor(ExecState* exec, JSObject*, JSValue, const ArgList& args)
 {
     if (args.isEmpty())
         return jsEmptyString(exec);
-    return jsString(exec, args.at(exec, 0)->toString(exec));
+    return jsString(exec, args.at(0).toString(exec));
 }
 
 CallType StringConstructor::getCallData(CallData& callData)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp
index 093f5de..fb44498 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.cpp
@@ -61,7 +61,7 @@ bool StringObject::getOwnPropertySlot(ExecState* exec, unsigned propertyName, Pr
     return JSObject::getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-void StringObject::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void StringObject::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (propertyName == exec->propertyNames().length)
         return;
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
index 540c576..ea3a045 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObject.h
@@ -36,16 +36,16 @@ namespace JSC {
         virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
         virtual bool getOwnPropertySlot(ExecState*, unsigned propertyName, PropertySlot&);
 
-        virtual void put(ExecState* exec, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
+        virtual void put(ExecState* exec, const Identifier& propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual void getPropertyNames(ExecState*, PropertyNameArray&);
 
         virtual const ClassInfo* classInfo() const { return &info; }
-        static const ClassInfo info;
+        static const JS_EXPORTDATA ClassInfo info;
 
         JSString* internalValue() const { return asString(JSWrapperObject::internalValue());}
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+        static PassRefPtr<Structure> createStructure(JSValue prototype)
         {
             return Structure::create(prototype, TypeInfo(ObjectType));
         }
@@ -59,9 +59,9 @@ namespace JSC {
         virtual JSString* toThisJSString(ExecState*);
   };
 
-    StringObject* asStringObject(JSValuePtr);
+    StringObject* asStringObject(JSValue);
 
-    inline StringObject* asStringObject(JSValuePtr value)
+    inline StringObject* asStringObject(JSValue value)
     {
         ASSERT(asObject(value)->inherits(&StringObject::info));
         return static_cast<StringObject*>(asObject(value));
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
index 72c0f47..bc5c0a5 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h
@@ -42,7 +42,7 @@ namespace JSC {
         {
         }
 
-        static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+        static PassRefPtr<Structure> createStructure(JSValue proto) 
         { 
             return Structure::create(proto, TypeInfo(ObjectType, MasqueradesAsUndefined)); 
         }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
index 1f43cd6..d6939cb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StringPrototype.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "StringPrototype.h"
 
+#include "CachedCall.h"
 #include "JSArray.h"
 #include "JSFunction.h"
 #include "ObjectPrototype.h"
@@ -37,36 +38,36 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(StringPrototype);
 
-static JSValuePtr stringProtoFuncToString(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncCharAt(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncCharCodeAt(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncConcat(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncIndexOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncLastIndexOf(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncMatch(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncReplace(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSearch(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSlice(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSplit(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSubstr(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSubstring(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncToLowerCase(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncToUpperCase(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncLocaleCompare(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-
-static JSValuePtr stringProtoFuncBig(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSmall(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncBlink(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncBold(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncFixed(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncItalics(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncStrike(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSub(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncSup(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncFontcolor(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncFontsize(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncAnchor(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr stringProtoFuncLink(ExecState*, JSObject*, JSValuePtr, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncToString(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncCharAt(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncCharCodeAt(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncConcat(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncIndexOf(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncLastIndexOf(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSearch(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSlice(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSubstr(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSubstring(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncLocaleCompare(ExecState*, JSObject*, JSValue, const ArgList&);
+
+static JSValue JSC_HOST_CALL stringProtoFuncBig(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSmall(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncBlink(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncBold(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncFixed(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncItalics(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncStrike(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSub(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncSup(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncFontcolor(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncAnchor(ExecState*, JSObject*, JSValue, const ArgList&);
+static JSValue JSC_HOST_CALL stringProtoFuncLink(ExecState*, JSObject*, JSValue, const ArgList&);
 
 }
 
@@ -140,13 +141,12 @@ static inline UString substituteBackreferences(const UString& replacement, const
         if (i + 1 == replacement.size())
             break;
 
-        unsigned short ref = replacement[i + 1];
+        UChar ref = replacement[i + 1];
         if (ref == '$') {
             // "$$" -> "$"
             ++i;
             substitutedReplacement.append(replacement.data() + offset, i - offset);
             offset = i + 1;
-            substitutedReplacement.append('$');
             continue;
         }
 
@@ -205,21 +205,21 @@ static inline int localeCompare(const UString& a, const UString& b)
     return Collator::userDefault()->collate(reinterpret_cast<const ::UChar*>(a.data()), a.size(), reinterpret_cast<const ::UChar*>(b.data()), b.size());
 }
 
-JSValuePtr stringProtoFuncReplace(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSString* sourceVal = thisValue->toThisJSString(exec);
+    JSString* sourceVal = thisValue.toThisJSString(exec);
     const UString& source = sourceVal->value();
 
-    JSValuePtr pattern = args.at(exec, 0);
+    JSValue pattern = args.at(0);
 
-    JSValuePtr replacement = args.at(exec, 1);
+    JSValue replacement = args.at(1);
     UString replacementString;
     CallData callData;
-    CallType callType = replacement->getCallData(callData);
+    CallType callType = replacement.getCallData(callData);
     if (callType == CallTypeNone)
-        replacementString = replacement->toString(exec);
+        replacementString = replacement.toString(exec);
 
-    if (pattern->isObject(&RegExpObject::info)) {
+    if (pattern.isObject(&RegExpObject::info)) {
         RegExp* reg = asRegExpObject(pattern)->regExp();
         bool global = reg->global();
 
@@ -232,167 +232,223 @@ JSValuePtr stringProtoFuncReplace(ExecState* exec, JSObject*, JSValuePtr thisVal
         Vector<UString, 16> replacements;
 
         // This is either a loop (if global is set) or a one-way (if not).
-        do {
-            int matchIndex;
-            int matchLen;
-            int* ovector;
-            regExpConstructor->performMatch(reg, source, startPosition, matchIndex, matchLen, &ovector);
-            if (matchIndex < 0)
-                break;
-
-            sourceRanges.append(UString::Range(lastIndex, matchIndex - lastIndex));
+        if (global && callType == CallTypeJS) {
+            // reg->numSubpatterns() + 1 for pattern args, + 2 for match start and sourceValue
+            int argCount = reg->numSubpatterns() + 1 + 2;
+            JSFunction* func = asFunction(replacement);
+            CachedCall cachedCall(exec, func, argCount, exec->exceptionSlot());
+            if (exec->hadException())
+                return jsNull();
+            while (true) {
+                int matchIndex;
+                int matchLen;
+                int* ovector;
+                regExpConstructor->performMatch(reg, source, startPosition, matchIndex, matchLen, &ovector);
+                if (matchIndex < 0)
+                    break;
+                
+                sourceRanges.append(UString::Range(lastIndex, matchIndex - lastIndex));
 
-            if (callType != CallTypeNone) {
                 int completeMatchStart = ovector[0];
-                ArgList args;
-
-                for (unsigned i = 0; i < reg->numSubpatterns() + 1; ++i) {
+                unsigned i = 0;
+                for (; i < reg->numSubpatterns() + 1; ++i) {
                     int matchStart = ovector[i * 2];
                     int matchLen = ovector[i * 2 + 1] - matchStart;
 
                     if (matchStart < 0)
-                        args.append(jsUndefined());
+                        cachedCall.setArgument(i, jsUndefined());
                     else
-                        args.append(jsSubstring(exec, source, matchStart, matchLen));
+                        cachedCall.setArgument(i, jsSubstring(exec, source, matchStart, matchLen));
                 }
 
-                args.append(jsNumber(exec, completeMatchStart));
-                args.append(sourceVal);
-
-                replacements.append(call(exec, replacement, callType, callData, exec->globalThisValue(), args)->toString(exec));
+                cachedCall.setArgument(i++, jsNumber(exec, completeMatchStart));
+                cachedCall.setArgument(i++, sourceVal);
+                
+                cachedCall.setThis(exec->globalThisValue());
+                replacements.append(cachedCall.call().toString(cachedCall.newCallFrame()));
                 if (exec->hadException())
                     break;
-            } else
-                replacements.append(substituteBackreferences(replacementString, source, ovector, reg));
 
-            lastIndex = matchIndex + matchLen;
-            startPosition = lastIndex;
+                lastIndex = matchIndex + matchLen;
+                startPosition = lastIndex;
 
-            // special case of empty match
-            if (matchLen == 0) {
-                startPosition++;
-                if (startPosition > source.size())
+                // special case of empty match
+                if (matchLen == 0) {
+                    startPosition++;
+                    if (startPosition > source.size())
+                        break;
+                }
+            }            
+        } else {
+            do {
+                int matchIndex;
+                int matchLen;
+                int* ovector;
+                regExpConstructor->performMatch(reg, source, startPosition, matchIndex, matchLen, &ovector);
+                if (matchIndex < 0)
                     break;
-            }
-        } while (global);
 
-        if (lastIndex < source.size())
-            sourceRanges.append(UString::Range(lastIndex, source.size() - lastIndex));
+                sourceRanges.append(UString::Range(lastIndex, matchIndex - lastIndex));
 
-        UString result = source.spliceSubstringsWithSeparators(sourceRanges.data(), sourceRanges.size(), replacements.data(), replacements.size());
+                if (callType != CallTypeNone) {
+                    int completeMatchStart = ovector[0];
+                    MarkedArgumentBuffer args;
 
-        if (result == source)
+                    for (unsigned i = 0; i < reg->numSubpatterns() + 1; ++i) {
+                        int matchStart = ovector[i * 2];
+                        int matchLen = ovector[i * 2 + 1] - matchStart;
+
+                        if (matchStart < 0)
+                            args.append(jsUndefined());
+                        else
+                            args.append(jsSubstring(exec, source, matchStart, matchLen));
+                    }
+
+                    args.append(jsNumber(exec, completeMatchStart));
+                    args.append(sourceVal);
+
+                    replacements.append(call(exec, replacement, callType, callData, exec->globalThisValue(), args).toString(exec));
+                    if (exec->hadException())
+                        break;
+                } else
+                    replacements.append(substituteBackreferences(replacementString, source, ovector, reg));
+
+                lastIndex = matchIndex + matchLen;
+                startPosition = lastIndex;
+
+                // special case of empty match
+                if (matchLen == 0) {
+                    startPosition++;
+                    if (startPosition > source.size())
+                        break;
+                }
+            } while (global);
+        }
+
+        if (!lastIndex && replacements.isEmpty())
             return sourceVal;
 
-        return jsString(exec, result);
+        if (lastIndex < source.size())
+            sourceRanges.append(UString::Range(lastIndex, source.size() - lastIndex));
+
+        return jsString(exec, source.spliceSubstringsWithSeparators(sourceRanges.data(), sourceRanges.size(),
+            replacements.data(), replacements.size()));
     }
 
-    // First arg is a string
-    UString patternString = pattern->toString(exec);
+    // Not a regular expression, so treat the pattern as a string.
+
+    UString patternString = pattern.toString(exec);
     int matchPos = source.find(patternString);
-    int matchLen = patternString.size();
-    // Do the replacement
+
     if (matchPos == -1)
         return sourceVal;
 
+    int matchLen = patternString.size();
     if (callType != CallTypeNone) {
-        ArgList args;
+        MarkedArgumentBuffer args;
         args.append(jsSubstring(exec, source, matchPos, matchLen));
         args.append(jsNumber(exec, matchPos));
         args.append(sourceVal);
 
-        replacementString = call(exec, replacement, callType, callData, exec->globalThisValue(), args)->toString(exec);
+        replacementString = call(exec, replacement, callType, callData, exec->globalThisValue(), args).toString(exec);
     }
 
     int ovector[2] = { matchPos, matchPos + matchLen };
-    return jsString(exec, source.substr(0, matchPos)
-        + substituteBackreferences(replacementString, source, ovector, 0)
-        + source.substr(matchPos + matchLen));
+    return jsString(exec, source.replaceRange(matchPos, matchLen, substituteBackreferences(replacementString, source, ovector, 0)));
 }
 
-JSValuePtr stringProtoFuncToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
     // Also used for valueOf.
 
-    if (thisValue->isString())
+    if (thisValue.isString())
         return thisValue;
 
-    if (thisValue->isObject(&StringObject::info))
+    if (thisValue.isObject(&StringObject::info))
         return asStringObject(thisValue)->internalValue();
 
     return throwError(exec, TypeError);
 }
 
-JSValuePtr stringProtoFuncCharAt(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncCharAt(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
     unsigned len = s.size();
-    JSValuePtr a0 = args.at(exec, 0);
-    if (JSImmediate::isNumber(a0)) {
-        uint32_t i;
-        if (JSImmediate::getUInt32(a0, i) && i < len)
+    JSValue a0 = args.at(0);
+    if (a0.isUInt32Fast()) {
+        uint32_t i = a0.getUInt32Fast();
+        if (i < len)
             return jsSingleCharacterSubstring(exec, s, i);
         return jsEmptyString(exec);
     }
-    double dpos = a0->toInteger(exec);
+    double dpos = a0.toInteger(exec);
     if (dpos >= 0 && dpos < len)
         return jsSingleCharacterSubstring(exec, s, static_cast<unsigned>(dpos));
     return jsEmptyString(exec);
 }
 
-JSValuePtr stringProtoFuncCharCodeAt(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncCharCodeAt(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
     unsigned len = s.size();
-    JSValuePtr a0 = args.at(exec, 0);
-    if (JSImmediate::isNumber(a0)) {
-        uint32_t i;
-        if (JSImmediate::getUInt32(a0, i) && i < len)
+    JSValue a0 = args.at(0);
+    if (a0.isUInt32Fast()) {
+        uint32_t i = a0.getUInt32Fast();
+        if (i < len)
             return jsNumber(exec, s.data()[i]);
         return jsNaN(exec);
     }
-    double dpos = a0->toInteger(exec);
+    double dpos = a0.toInteger(exec);
     if (dpos >= 0 && dpos < len)
         return jsNumber(exec, s[static_cast<int>(dpos)]);
     return jsNaN(exec);
 }
 
-JSValuePtr stringProtoFuncConcat(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncConcat(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
 
     ArgList::const_iterator end = args.end();
     for (ArgList::const_iterator it = args.begin(); it != end; ++it)
-        s += (*it).jsValue(exec)->toString(exec);
+        s += (*it).toString(exec);
     return jsString(exec, s);
 }
 
-JSValuePtr stringProtoFuncIndexOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncIndexOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
     int len = s.size();
 
-    JSValuePtr a0 = args.at(exec, 0);
-    JSValuePtr a1 = args.at(exec, 1);
-    UString u2 = a0->toString(exec);
-    double dpos = a1->toInteger(exec);
-    if (dpos < 0)
-        dpos = 0;
-    else if (dpos > len)
-        dpos = len;
-    return jsNumber(exec, s.find(u2, static_cast<int>(dpos)));
+    JSValue a0 = args.at(0);
+    JSValue a1 = args.at(1);
+    UString u2 = a0.toString(exec);
+    int pos;
+    if (a1.isUndefined())
+        pos = 0;
+    else if (a1.isUInt32Fast())
+        pos = min<uint32_t>(a1.getUInt32Fast(), len);
+    else {
+        double dpos = a1.toInteger(exec);
+        if (dpos < 0)
+            dpos = 0;
+        else if (dpos > len)
+            dpos = len;
+        pos = static_cast<int>(dpos);
+    }
+
+    return jsNumber(exec, s.find(u2, pos));
 }
 
-JSValuePtr stringProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
     int len = s.size();
 
-    JSValuePtr a0 = args.at(exec, 0);
-    JSValuePtr a1 = args.at(exec, 1);
+    JSValue a0 = args.at(0);
+    JSValue a1 = args.at(1);
 
-    UString u2 = a0->toString(exec);
-    double dpos = a1->toIntegerPreserveNaN(exec);
+    UString u2 = a0.toString(exec);
+    double dpos = a1.toIntegerPreserveNaN(exec);
     if (dpos < 0)
         dpos = 0;
     else if (!(dpos <= len)) // true for NaN
@@ -400,16 +456,16 @@ JSValuePtr stringProtoFuncLastIndexOf(ExecState* exec, JSObject*, JSValuePtr thi
     return jsNumber(exec, s.rfind(u2, static_cast<int>(dpos)));
 }
 
-JSValuePtr stringProtoFuncMatch(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncMatch(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
 
-    JSValuePtr a0 = args.at(exec, 0);
+    JSValue a0 = args.at(0);
 
     UString u = s;
     RefPtr<RegExp> reg;
     RegExpObject* imp = 0;
-    if (a0->isObject(&RegExpObject::info))
+    if (a0.isObject(&RegExpObject::info))
         reg = asRegExpObject(a0)->regExp();
     else {
         /*
@@ -417,7 +473,7 @@ JSValuePtr stringProtoFuncMatch(ExecState* exec, JSObject*, JSValuePtr thisValue
          *  If regexp is not an object whose [[Class]] property is "RegExp", it is
          *  replaced with the result of the expression new RegExp(regexp).
          */
-        reg = RegExp::create(&exec->globalData(), a0->toString(exec));
+        reg = RegExp::create(&exec->globalData(), a0.toString(exec));
     }
     RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
     int pos;
@@ -431,7 +487,7 @@ JSValuePtr stringProtoFuncMatch(ExecState* exec, JSObject*, JSValuePtr thisValue
     }
 
     // return array of matches
-    ArgList list;
+    MarkedArgumentBuffer list;
     int lastIndex = 0;
     while (pos >= 0) {
         list.append(jsSubstring(exec, u, pos, matchLength));
@@ -451,15 +507,15 @@ JSValuePtr stringProtoFuncMatch(ExecState* exec, JSObject*, JSValuePtr thisValue
     return constructArray(exec, list);
 }
 
-JSValuePtr stringProtoFuncSearch(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncSearch(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
 
-    JSValuePtr a0 = args.at(exec, 0);
+    JSValue a0 = args.at(0);
 
     UString u = s;
     RefPtr<RegExp> reg;
-    if (a0->isObject(&RegExpObject::info))
+    if (a0.isObject(&RegExpObject::info))
         reg = asRegExpObject(a0)->regExp();
     else { 
         /*
@@ -467,7 +523,7 @@ JSValuePtr stringProtoFuncSearch(ExecState* exec, JSObject*, JSValuePtr thisValu
          *  If regexp is not an object whose [[Class]] property is "RegExp", it is
          *  replaced with the result of the expression new RegExp(regexp).
          */
-        reg = RegExp::create(&exec->globalData(), a0->toString(exec));
+        reg = RegExp::create(&exec->globalData(), a0.toString(exec));
     }
     RegExpConstructor* regExpConstructor = exec->lexicalGlobalObject()->regExpConstructor();
     int pos;
@@ -476,17 +532,17 @@ JSValuePtr stringProtoFuncSearch(ExecState* exec, JSObject*, JSValuePtr thisValu
     return jsNumber(exec, pos);
 }
 
-JSValuePtr stringProtoFuncSlice(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncSlice(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
     int len = s.size();
 
-    JSValuePtr a0 = args.at(exec, 0);
-    JSValuePtr a1 = args.at(exec, 1);
+    JSValue a0 = args.at(0);
+    JSValue a1 = args.at(1);
 
     // The arg processing is very much like ArrayProtoFunc::Slice
-    double start = a0->toInteger(exec);
-    double end = a1->isUndefined() ? len : a1->toInteger(exec);
+    double start = a0.toInteger(exec);
+    double end = a1.isUndefined() ? len : a1.toInteger(exec);
     double from = start < 0 ? len + start : start;
     double to = end < 0 ? len + end : end;
     if (to > from && to > 0 && from < len) {
@@ -500,18 +556,18 @@ JSValuePtr stringProtoFuncSlice(ExecState* exec, JSObject*, JSValuePtr thisValue
     return jsEmptyString(exec);
 }
 
-JSValuePtr stringProtoFuncSplit(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncSplit(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
 
-    JSValuePtr a0 = args.at(exec, 0);
-    JSValuePtr a1 = args.at(exec, 1);
+    JSValue a0 = args.at(0);
+    JSValue a1 = args.at(1);
 
     JSArray* result = constructEmptyArray(exec);
     unsigned i = 0;
     int p0 = 0;
-    unsigned limit = a1->isUndefined() ? 0xFFFFFFFFU : a1->toUInt32(exec);
-    if (a0->isObject(&RegExpObject::info)) {
+    unsigned limit = a1.isUndefined() ? 0xFFFFFFFFU : a1.toUInt32(exec);
+    if (a0.isObject(&RegExpObject::info)) {
         RegExp* reg = asRegExpObject(a0)->regExp();
         if (s.isEmpty() && reg->match(s, 0) >= 0) {
             // empty string matched by regexp -> empty array
@@ -538,7 +594,7 @@ JSValuePtr stringProtoFuncSplit(ExecState* exec, JSObject*, JSValuePtr thisValue
             }
         }
     } else {
-        UString u2 = a0->toString(exec);
+        UString u2 = a0.toString(exec);
         if (u2.isEmpty()) {
             if (s.isEmpty()) {
                 // empty separator matches empty string -> empty array
@@ -562,16 +618,16 @@ JSValuePtr stringProtoFuncSplit(ExecState* exec, JSObject*, JSValuePtr thisValue
     return result;
 }
 
-JSValuePtr stringProtoFuncSubstr(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncSubstr(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
     int len = s.size();
 
-    JSValuePtr a0 = args.at(exec, 0);
-    JSValuePtr a1 = args.at(exec, 1);
+    JSValue a0 = args.at(0);
+    JSValue a1 = args.at(1);
 
-    double start = a0->toInteger(exec);
-    double length = a1->isUndefined() ? len : a1->toInteger(exec);
+    double start = a0.toInteger(exec);
+    double length = a1.isUndefined() ? len : a1.toInteger(exec);
     if (start >= len || length <= 0)
         return jsEmptyString(exec);
     if (start < 0) {
@@ -584,16 +640,16 @@ JSValuePtr stringProtoFuncSubstr(ExecState* exec, JSObject*, JSValuePtr thisValu
     return jsSubstring(exec, s, static_cast<unsigned>(start), static_cast<unsigned>(length));
 }
 
-JSValuePtr stringProtoFuncSubstring(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncSubstring(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
     int len = s.size();
 
-    JSValuePtr a0 = args.at(exec, 0);
-    JSValuePtr a1 = args.at(exec, 1);
+    JSValue a0 = args.at(0);
+    JSValue a1 = args.at(1);
 
-    double start = a0->toNumber(exec);
-    double end = a1->toNumber(exec);
+    double start = a0.toNumber(exec);
+    double end = a1.toNumber(exec);
     if (isnan(start))
         start = 0;
     if (isnan(end))
@@ -606,7 +662,7 @@ JSValuePtr stringProtoFuncSubstring(ExecState* exec, JSObject*, JSValuePtr thisV
         start = len;
     if (end > len)
         end = len;
-    if (a1->isUndefined())
+    if (a1.isUndefined())
         end = len;
     if (start > end) {
         double temp = end;
@@ -616,9 +672,9 @@ JSValuePtr stringProtoFuncSubstring(ExecState* exec, JSObject*, JSValuePtr thisV
     return jsSubstring(exec, s, static_cast<unsigned>(start), static_cast<unsigned>(end) - static_cast<unsigned>(start));
 }
 
-JSValuePtr stringProtoFuncToLowerCase(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncToLowerCase(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    JSString* sVal = thisValue->toThisJSString(exec);
+    JSString* sVal = thisValue.toThisJSString(exec);
     const UString& s = sVal->value();
 
     int sSize = s.size();
@@ -650,9 +706,9 @@ JSValuePtr stringProtoFuncToLowerCase(ExecState* exec, JSObject*, JSValuePtr thi
     return jsString(exec, UString(buffer.releaseBuffer(), length, false));
 }
 
-JSValuePtr stringProtoFuncToUpperCase(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncToUpperCase(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    JSString* sVal = thisValue->toThisJSString(exec);
+    JSString* sVal = thisValue.toThisJSString(exec);
     const UString& s = sVal->value();
 
     int sSize = s.size();
@@ -684,96 +740,155 @@ JSValuePtr stringProtoFuncToUpperCase(ExecState* exec, JSObject*, JSValuePtr thi
     return jsString(exec, UString(buffer.releaseBuffer(), length, false));
 }
 
-JSValuePtr stringProtoFuncLocaleCompare(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncLocaleCompare(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
     if (args.size() < 1)
       return jsNumber(exec, 0);
 
-    UString s = thisValue->toThisString(exec);
-    JSValuePtr a0 = args.at(exec, 0);
-    return jsNumber(exec, localeCompare(s, a0->toString(exec)));
+    UString s = thisValue.toThisString(exec);
+    JSValue a0 = args.at(0);
+    return jsNumber(exec, localeCompare(s, a0.toString(exec)));
 }
 
-JSValuePtr stringProtoFuncBig(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncBig(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    UString s = thisValue->toThisString(exec);
-    return jsString(exec, "<big>" + s + "</big>");
+    UString s = thisValue.toThisString(exec);
+    return jsNontrivialString(exec, "<big>" + s + "</big>");
 }
 
-JSValuePtr stringProtoFuncSmall(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncSmall(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    UString s = thisValue->toThisString(exec);
-    return jsString(exec, "<small>" + s + "</small>");
+    UString s = thisValue.toThisString(exec);
+    return jsNontrivialString(exec, "<small>" + s + "</small>");
 }
 
-JSValuePtr stringProtoFuncBlink(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncBlink(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    UString s = thisValue->toThisString(exec);
-    return jsString(exec, "<blink>" + s + "</blink>");
+    UString s = thisValue.toThisString(exec);
+    return jsNontrivialString(exec, "<blink>" + s + "</blink>");
 }
 
-JSValuePtr stringProtoFuncBold(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncBold(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    UString s = thisValue->toThisString(exec);
-    return jsString(exec, "<b>" + s + "</b>");
+    UString s = thisValue.toThisString(exec);
+    return jsNontrivialString(exec, "<b>" + s + "</b>");
 }
 
-JSValuePtr stringProtoFuncFixed(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncFixed(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    UString s = thisValue->toThisString(exec);
+    UString s = thisValue.toThisString(exec);
     return jsString(exec, "<tt>" + s + "</tt>");
 }
 
-JSValuePtr stringProtoFuncItalics(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncItalics(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    UString s = thisValue->toThisString(exec);
-    return jsString(exec, "<i>" + s + "</i>");
+    UString s = thisValue.toThisString(exec);
+    return jsNontrivialString(exec, "<i>" + s + "</i>");
 }
 
-JSValuePtr stringProtoFuncStrike(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncStrike(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    UString s = thisValue->toThisString(exec);
-    return jsString(exec, "<strike>" + s + "</strike>");
+    UString s = thisValue.toThisString(exec);
+    return jsNontrivialString(exec, "<strike>" + s + "</strike>");
 }
 
-JSValuePtr stringProtoFuncSub(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncSub(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    UString s = thisValue->toThisString(exec);
-    return jsString(exec, "<sub>" + s + "</sub>");
+    UString s = thisValue.toThisString(exec);
+    return jsNontrivialString(exec, "<sub>" + s + "</sub>");
 }
 
-JSValuePtr stringProtoFuncSup(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
+JSValue JSC_HOST_CALL stringProtoFuncSup(ExecState* exec, JSObject*, JSValue thisValue, const ArgList&)
 {
-    UString s = thisValue->toThisString(exec);
-    return jsString(exec, "<sup>" + s + "</sup>");
+    UString s = thisValue.toThisString(exec);
+    return jsNontrivialString(exec, "<sup>" + s + "</sup>");
 }
 
-JSValuePtr stringProtoFuncFontcolor(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncFontcolor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
-    JSValuePtr a0 = args.at(exec, 0);
-    return jsString(exec, "<font color=\"" + a0->toString(exec) + "\">" + s + "</font>");
+    UString s = thisValue.toThisString(exec);
+    JSValue a0 = args.at(0);
+    return jsNontrivialString(exec, "<font color=\"" + a0.toString(exec) + "\">" + s + "</font>");
 }
 
-JSValuePtr stringProtoFuncFontsize(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL stringProtoFuncFontsize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    UString s = thisValue->toThisString(exec);
-    JSValuePtr a0 = args.at(exec, 0);
-    return jsString(exec, "<font size=\"" + a0->toString(exec) + "\">" + s + "</font>");
-}
+    UString s = thisValue.toThisString(exec);
+    JSValue a0 = args.at(0);
 
-JSValuePtr stringProtoFuncAnchor(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    UString s = thisValue->toThisString(exec);
-    JSValuePtr a0 = args.at(exec, 0);
-    return jsString(exec, "<a name=\"" + a0->toString(exec) + "\">" + s + "</a>");
-}
+    uint32_t smallInteger;
+    if (a0.getUInt32(smallInteger) && smallInteger <= 9) {
+        unsigned stringSize = s.size();
+        unsigned bufferSize = 22 + stringSize;
+        UChar* buffer = static_cast<UChar*>(tryFastMalloc(bufferSize * sizeof(UChar)));
+        if (!buffer)
+            return jsUndefined();
+        buffer[0] = '<';
+        buffer[1] = 'f';
+        buffer[2] = 'o';
+        buffer[3] = 'n';
+        buffer[4] = 't';
+        buffer[5] = ' ';
+        buffer[6] = 's';
+        buffer[7] = 'i';
+        buffer[8] = 'z';
+        buffer[9] = 'e';
+        buffer[10] = '=';
+        buffer[11] = '"';
+        buffer[12] = '0' + smallInteger;
+        buffer[13] = '"';
+        buffer[14] = '>';
+        memcpy(&buffer[15], s.data(), stringSize * sizeof(UChar));
+        buffer[15 + stringSize] = '<';
+        buffer[16 + stringSize] = '/';
+        buffer[17 + stringSize] = 'f';
+        buffer[18 + stringSize] = 'o';
+        buffer[19 + stringSize] = 'n';
+        buffer[20 + stringSize] = 't';
+        buffer[21 + stringSize] = '>';
+        return jsNontrivialString(exec, UString(buffer, bufferSize, false));
+    }
 
-JSValuePtr stringProtoFuncLink(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    UString s = thisValue->toThisString(exec);
-    JSValuePtr a0 = args.at(exec, 0);
-    return jsString(exec, "<a href=\"" + a0->toString(exec) + "\">" + s + "</a>");
+    return jsNontrivialString(exec, "<font size=\"" + a0.toString(exec) + "\">" + s + "</font>");
+}
+
+JSValue JSC_HOST_CALL stringProtoFuncAnchor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UString s = thisValue.toThisString(exec);
+    JSValue a0 = args.at(0);
+    return jsNontrivialString(exec, "<a name=\"" + a0.toString(exec) + "\">" + s + "</a>");
+}
+
+JSValue JSC_HOST_CALL stringProtoFuncLink(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UString s = thisValue.toThisString(exec);
+    JSValue a0 = args.at(0);
+    UString linkText = a0.toString(exec);
+
+    unsigned linkTextSize = linkText.size();
+    unsigned stringSize = s.size();
+    unsigned bufferSize = 15 + linkTextSize + stringSize;
+    UChar* buffer = static_cast<UChar*>(tryFastMalloc(bufferSize * sizeof(UChar)));
+    if (!buffer)
+        return jsUndefined();
+    buffer[0] = '<';
+    buffer[1] = 'a';
+    buffer[2] = ' ';
+    buffer[3] = 'h';
+    buffer[4] = 'r';
+    buffer[5] = 'e';
+    buffer[6] = 'f';
+    buffer[7] = '=';
+    buffer[8] = '"';
+    memcpy(&buffer[9], linkText.data(), linkTextSize * sizeof(UChar));
+    buffer[9 + linkTextSize] = '"';
+    buffer[10 + linkTextSize] = '>';
+    memcpy(&buffer[11 + linkTextSize], s.data(), stringSize * sizeof(UChar));
+    buffer[11 + linkTextSize + stringSize] = '<';
+    buffer[12 + linkTextSize + stringSize] = '/';
+    buffer[13 + linkTextSize + stringSize] = 'a';
+    buffer[14 + linkTextSize + stringSize] = '>';
+    return jsNontrivialString(exec, UString(buffer, bufferSize, false));
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
index 5fcde7b..5dfd919 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.cpp
@@ -65,15 +65,15 @@ static const unsigned newTableSize = 16;
 static WTF::RefCountedLeakCounter structureCounter("Structure");
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
-static Mutex ignoreSetMutex;
+static Mutex& ignoreSetMutex = *(new Mutex);
 #endif
 
 static bool shouldIgnoreLeaks;
-static HashSet<Structure*> ignoreSet;
+static HashSet<Structure*>& ignoreSet = *(new HashSet<Structure*>);
 #endif
 
 #if DUMP_STRUCTURE_ID_STATISTICS
-static HashSet<Structure*> liveStructureSet;
+static HashSet<Structure*>& liveStructureSet = *(new HashSet<Structure*>);
 #endif
 
 void Structure::dumpStatistics()
@@ -120,12 +120,10 @@ void Structure::dumpStatistics()
 #endif
 }
 
-Structure::Structure(JSValuePtr prototype, const TypeInfo& typeInfo)
+Structure::Structure(JSValue prototype, const TypeInfo& typeInfo)
     : m_typeInfo(typeInfo)
     , m_prototype(prototype)
-    , m_cachedPrototypeChain(0)
-    , m_previous(0)
-    , m_nameInPrevious(0)
+    , m_specificValueInPrevious(0)
     , m_propertyTable(0)
     , m_propertyStorageCapacity(JSObject::inlineStorageCapacity)
     , m_offset(noOffset)
@@ -136,7 +134,7 @@ Structure::Structure(JSValuePtr prototype, const TypeInfo& typeInfo)
     , m_attributesInPrevious(0)
 {
     ASSERT(m_prototype);
-    ASSERT(m_prototype->isObject() || m_prototype->isNull());
+    ASSERT(m_prototype.isObject() || m_prototype.isNull());
 
     m_transitions.singleTransition = 0;
 
@@ -161,8 +159,8 @@ Structure::~Structure()
         if (m_previous->m_usingSingleTransitionSlot) {
             m_previous->m_transitions.singleTransition = 0;
         } else {
-            ASSERT(m_previous->m_transitions.table->contains(make_pair(m_nameInPrevious.get(), m_attributesInPrevious)));
-            m_previous->m_transitions.table->remove(make_pair(m_nameInPrevious.get(), m_attributesInPrevious));
+            ASSERT(m_previous->m_transitions.table->contains(make_pair(m_nameInPrevious.get(), make_pair(m_attributesInPrevious, m_specificValueInPrevious))));
+            m_previous->m_transitions.table->remove(make_pair(m_nameInPrevious.get(), make_pair(m_attributesInPrevious, m_specificValueInPrevious)));
         }
     }
 
@@ -178,6 +176,8 @@ Structure::~Structure()
             if (UString::Rep* key = m_propertyTable->entries()[i].key)
                 key->deref();
         }
+
+        delete m_propertyTable->deletedOffsets;
         fastFree(m_propertyTable);
     }
 
@@ -280,59 +280,37 @@ void Structure::materializePropertyMap()
     for (ptrdiff_t i = structures.size() - 2; i >= 0; --i) {
         structure = structures[i];
         structure->m_nameInPrevious->ref();
-        PropertyMapEntry entry(structure->m_nameInPrevious.get(), structure->m_offset, structure->m_attributesInPrevious, ++m_propertyTable->lastIndexUsed); 
+        PropertyMapEntry entry(structure->m_nameInPrevious.get(), structure->m_offset, structure->m_attributesInPrevious, structure->m_specificValueInPrevious, ++m_propertyTable->lastIndexUsed);
         insertIntoPropertyMapHashTable(entry);
     }
 }
 
 void Structure::getEnumerablePropertyNames(ExecState* exec, PropertyNameArray& propertyNames, JSObject* baseObject)
 {
-    bool shouldCache = propertyNames.cacheable() && !(propertyNames.size() || m_isDictionary);
+    bool shouldCache = propertyNames.shouldCache() && !(propertyNames.size() || m_isDictionary);
 
-    if (shouldCache) {
-        if (m_cachedPropertyNameArrayData) {
-            if (structureChainsAreEqual(m_cachedPropertyNameArrayData->cachedPrototypeChain(), cachedPrototypeChain())) {
-                propertyNames.setData(m_cachedPropertyNameArrayData);
-                return;
-            }
+    if (shouldCache && m_cachedPropertyNameArrayData) {
+        if (m_cachedPropertyNameArrayData->cachedPrototypeChain() == prototypeChain(exec)) {
+            propertyNames.setData(m_cachedPropertyNameArrayData);
+            return;
         }
-        propertyNames.setCacheable(false);
+        clearEnumerationCache();
     }
 
-    getEnumerablePropertyNamesInternal(propertyNames);
+    getEnumerableNamesFromPropertyTable(propertyNames);
+    getEnumerableNamesFromClassInfoTable(exec, baseObject->classInfo(), propertyNames);
 
-    // Add properties from the static hashtables of properties
-    for (const ClassInfo* info = baseObject->classInfo(); info; info = info->parentClass) {
-        const HashTable* table = info->propHashTable(exec);
-        if (!table)
-            continue;
-        table->initializeIfNeeded(exec);
-        ASSERT(table->table);
-#if ENABLE(PERFECT_HASH_SIZE)
-        int hashSizeMask = table->hashSizeMask;
-#else
-        int hashSizeMask = table->compactSize - 1;
-#endif
-        const HashEntry* entry = table->table;
-        for (int i = 0; i <= hashSizeMask; ++i, ++entry) {
-            if (entry->key() && !(entry->attributes() & DontEnum))
-                propertyNames.add(entry->key());
-        }
-    }
-
-    if (m_prototype->isObject())
+    if (m_prototype.isObject()) {
+        propertyNames.setShouldCache(false); // No need for our prototypes to waste memory on caching, since they're not being enumerated directly.
         asObject(m_prototype)->getPropertyNames(exec, propertyNames);
+    }
 
     if (shouldCache) {
-        if (m_cachedPropertyNameArrayData)
-            m_cachedPropertyNameArrayData->setCachedStructure(0);
-
+        StructureChain* protoChain = prototypeChain(exec);
         m_cachedPropertyNameArrayData = propertyNames.data();
-
-        StructureChain* chain = cachedPrototypeChain();
-        if (!chain)
-            chain = createCachedPrototypeChain();
-        m_cachedPropertyNameArrayData->setCachedPrototypeChain(chain);
+        if (!protoChain->isCacheable())
+            return;
+        m_cachedPropertyNameArrayData->setCachedPrototypeChain(protoChain);
         m_cachedPropertyNameArrayData->setCachedStructure(this);
     }
 }
@@ -352,20 +330,69 @@ void Structure::growPropertyStorageCapacity()
         m_propertyStorageCapacity *= 2;
 }
 
-PassRefPtr<Structure> Structure::addPropertyTransitionToExistingStructure(Structure* structure, const Identifier& propertyName, unsigned attributes, size_t& offset)
+void Structure::despecifyDictionaryFunction(const Identifier& propertyName)
+{
+    const UString::Rep* rep = propertyName._ustring.rep();
+
+    materializePropertyMapIfNecessary();
+
+    ASSERT(m_isDictionary);
+    ASSERT(m_propertyTable);
+
+    unsigned i = rep->computedHash();
+
+#if DUMP_PROPERTYMAP_STATS
+    ++numProbes;
+#endif
+
+    unsigned entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
+    ASSERT(entryIndex != emptyEntryIndex);
+
+    if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
+        m_propertyTable->entries()[entryIndex - 1].specificValue = 0;
+        return;
+    }
+
+#if DUMP_PROPERTYMAP_STATS
+    ++numCollisions;
+#endif
+
+    unsigned k = 1 | doubleHash(rep->computedHash());
+
+    while (1) {
+        i += k;
+
+#if DUMP_PROPERTYMAP_STATS
+        ++numRehashes;
+#endif
+
+        entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
+        ASSERT(entryIndex != emptyEntryIndex);
+
+        if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
+            m_propertyTable->entries()[entryIndex - 1].specificValue = 0;
+            return;
+        }
+    }
+}
+
+PassRefPtr<Structure> Structure::addPropertyTransitionToExistingStructure(Structure* structure, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset)
 {
     ASSERT(!structure->m_isDictionary);
     ASSERT(structure->typeInfo().type() == ObjectType);
 
     if (structure->m_usingSingleTransitionSlot) {
         Structure* existingTransition = structure->m_transitions.singleTransition;
-        if (existingTransition && existingTransition->m_nameInPrevious.get() == propertyName.ustring().rep() && existingTransition->m_attributesInPrevious == attributes) {
+        if (existingTransition && existingTransition->m_nameInPrevious.get() == propertyName.ustring().rep()
+            && existingTransition->m_attributesInPrevious == attributes
+            && existingTransition->m_specificValueInPrevious == specificValue) {
+
             ASSERT(structure->m_transitions.singleTransition->m_offset != noOffset);
             offset = structure->m_transitions.singleTransition->m_offset;
             return existingTransition;
         }
     } else {
-        if (Structure* existingTransition = structure->m_transitions.table->get(make_pair(propertyName.ustring().rep(), attributes))) {
+        if (Structure* existingTransition = structure->m_transitions.table->get(make_pair(propertyName.ustring().rep(), make_pair(attributes, specificValue)))) {
             ASSERT(existingTransition->m_offset != noOffset);
             offset = existingTransition->m_offset;
             return existingTransition;
@@ -375,25 +402,28 @@ PassRefPtr<Structure> Structure::addPropertyTransitionToExistingStructure(Struct
     return 0;
 }
 
-PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, const Identifier& propertyName, unsigned attributes, size_t& offset)
+PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset)
 {
     ASSERT(!structure->m_isDictionary);
     ASSERT(structure->typeInfo().type() == ObjectType);
-    ASSERT(!Structure::addPropertyTransitionToExistingStructure(structure, propertyName, attributes, offset));
+    ASSERT(!Structure::addPropertyTransitionToExistingStructure(structure, propertyName, attributes, specificValue, offset));
 
     if (structure->transitionCount() > s_maxTransitionLength) {
         RefPtr<Structure> transition = toDictionaryTransition(structure);
-        offset = transition->put(propertyName, attributes);
+        ASSERT(structure != transition);
+        offset = transition->put(propertyName, attributes, specificValue);
         if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
             transition->growPropertyStorageCapacity();
         return transition.release();
     }
 
     RefPtr<Structure> transition = create(structure->m_prototype, structure->typeInfo());
+
     transition->m_cachedPrototypeChain = structure->m_cachedPrototypeChain;
     transition->m_previous = structure;
     transition->m_nameInPrevious = propertyName.ustring().rep();
     transition->m_attributesInPrevious = attributes;
+    transition->m_specificValueInPrevious = specificValue;
     transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
     transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
 
@@ -411,7 +441,7 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
             transition->createPropertyMapHashTable();
     }
 
-    offset = transition->put(propertyName, attributes);
+    offset = transition->put(propertyName, attributes, specificValue);
     if (transition->propertyStorageSize() > transition->propertyStorageCapacity())
         transition->growPropertyStorageCapacity();
 
@@ -427,9 +457,9 @@ PassRefPtr<Structure> Structure::addPropertyTransition(Structure* structure, con
         structure->m_usingSingleTransitionSlot = false;
         StructureTransitionTable* transitionTable = new StructureTransitionTable;
         structure->m_transitions.table = transitionTable;
-        transitionTable->add(make_pair(existingTransition->m_nameInPrevious.get(), existingTransition->m_attributesInPrevious), existingTransition);
+        transitionTable->add(make_pair(existingTransition->m_nameInPrevious.get(), make_pair(existingTransition->m_attributesInPrevious, existingTransition->m_specificValueInPrevious)), existingTransition);
     }
-    structure->m_transitions.table->add(make_pair(propertyName.ustring().rep(), attributes), transition.get());
+    structure->m_transitions.table->add(make_pair(propertyName.ustring().rep(), make_pair(attributes, specificValue)), transition.get());
     return transition.release();
 }
 
@@ -444,7 +474,7 @@ PassRefPtr<Structure> Structure::removePropertyTransition(Structure* structure,
     return transition.release();
 }
 
-PassRefPtr<Structure> Structure::changePrototypeTransition(Structure* structure, JSValuePtr prototype)
+PassRefPtr<Structure> Structure::changePrototypeTransition(Structure* structure, JSValue prototype)
 {
     RefPtr<Structure> transition = create(prototype, structure->typeInfo());
 
@@ -460,6 +490,25 @@ PassRefPtr<Structure> Structure::changePrototypeTransition(Structure* structure,
     return transition.release();
 }
 
+PassRefPtr<Structure> Structure::despecifyFunctionTransition(Structure* structure, const Identifier& replaceFunction)
+{
+    RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo());
+
+    transition->m_propertyStorageCapacity = structure->m_propertyStorageCapacity;
+    transition->m_hasGetterSetterProperties = structure->m_hasGetterSetterProperties;
+
+    // Don't set m_offset, as one can not transition to this.
+
+    structure->materializePropertyMapIfNecessary();
+    transition->m_propertyTable = structure->copyPropertyTable();
+    transition->m_isPinnedPropertyTable = true;
+
+    bool removed = transition->despecifyFunction(replaceFunction);
+    ASSERT_UNUSED(removed, removed);
+
+    return transition.release();
+}
+
 PassRefPtr<Structure> Structure::getterSetterTransition(Structure* structure)
 {
     RefPtr<Structure> transition = create(structure->storedPrototype(), structure->typeInfo());
@@ -507,14 +556,14 @@ PassRefPtr<Structure> Structure::fromDictionaryTransition(Structure* structure)
     return structure;
 }
 
-size_t Structure::addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes)
+size_t Structure::addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
 {
     ASSERT(!m_transitions.singleTransition);
 
     materializePropertyMapIfNecessary();
 
     m_isPinnedPropertyTable = true;
-    size_t offset = put(propertyName, attributes);
+    size_t offset = put(propertyName, attributes, specificValue);
     if (propertyStorageSize() > propertyStorageCapacity())
         growPropertyStorageCapacity();
     clearEnumerationCache();
@@ -534,20 +583,6 @@ size_t Structure::removePropertyWithoutTransition(const Identifier& propertyName
     return offset;
 }
 
-StructureChain* Structure::createCachedPrototypeChain()
-{
-    ASSERT(typeInfo().type() == ObjectType);
-    ASSERT(!m_cachedPrototypeChain);
-
-    JSValuePtr prototype = storedPrototype();
-    if (JSImmediate::isImmediate(prototype))
-        return 0;
-
-    RefPtr<StructureChain> chain = StructureChain::create(asObject(prototype)->structure());
-    setCachedPrototypeChain(chain.release());
-    return cachedPrototypeChain();
-}
-
 #if DUMP_PROPERTYMAP_STATS
 
 static int numProbes;
@@ -604,16 +639,12 @@ PropertyMapHashTable* Structure::copyPropertyTable()
     return newTable;
 }
 
-size_t Structure::get(const Identifier& propertyName, unsigned& attributes)
+size_t Structure::get(const UString::Rep* rep, unsigned& attributes, JSCell*& specificValue)
 {
-    ASSERT(!propertyName.isNull());
-
     materializePropertyMapIfNecessary();
     if (!m_propertyTable)
         return notFound;
 
-    UString::Rep* rep = propertyName._ustring.rep();
-
     unsigned i = rep->computedHash();
 
 #if DUMP_PROPERTYMAP_STATS
@@ -626,6 +657,7 @@ size_t Structure::get(const Identifier& propertyName, unsigned& attributes)
 
     if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
         attributes = m_propertyTable->entries()[entryIndex - 1].attributes;
+        specificValue = m_propertyTable->entries()[entryIndex - 1].specificValue;
         return m_propertyTable->entries()[entryIndex - 1].offset;
     }
 
@@ -648,12 +680,64 @@ size_t Structure::get(const Identifier& propertyName, unsigned& attributes)
 
         if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
             attributes = m_propertyTable->entries()[entryIndex - 1].attributes;
+            specificValue = m_propertyTable->entries()[entryIndex - 1].specificValue;
             return m_propertyTable->entries()[entryIndex - 1].offset;
         }
     }
 }
 
-size_t Structure::put(const Identifier& propertyName, unsigned attributes)
+bool Structure::despecifyFunction(const Identifier& propertyName)
+{
+    ASSERT(!propertyName.isNull());
+
+    materializePropertyMapIfNecessary();
+    if (!m_propertyTable)
+        return false;
+
+    UString::Rep* rep = propertyName._ustring.rep();
+
+    unsigned i = rep->computedHash();
+
+#if DUMP_PROPERTYMAP_STATS
+    ++numProbes;
+#endif
+
+    unsigned entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
+    if (entryIndex == emptyEntryIndex)
+        return false;
+
+    if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
+        ASSERT(m_propertyTable->entries()[entryIndex - 1].specificValue);
+        m_propertyTable->entries()[entryIndex - 1].specificValue = 0;
+        return true;
+    }
+
+#if DUMP_PROPERTYMAP_STATS
+    ++numCollisions;
+#endif
+
+    unsigned k = 1 | doubleHash(rep->computedHash());
+
+    while (1) {
+        i += k;
+
+#if DUMP_PROPERTYMAP_STATS
+        ++numRehashes;
+#endif
+
+        entryIndex = m_propertyTable->entryIndices[i & m_propertyTable->sizeMask];
+        if (entryIndex == emptyEntryIndex)
+            return false;
+
+        if (rep == m_propertyTable->entries()[entryIndex - 1].key) {
+            ASSERT(m_propertyTable->entries()[entryIndex - 1].specificValue);
+            m_propertyTable->entries()[entryIndex - 1].specificValue = 0;
+            return true;
+        }
+    }
+}
+
+size_t Structure::put(const Identifier& propertyName, unsigned attributes, JSCell* specificValue)
 {
     ASSERT(!propertyName.isNull());
     ASSERT(get(propertyName) == notFound);
@@ -723,6 +807,7 @@ size_t Structure::put(const Identifier& propertyName, unsigned attributes)
     rep->ref();
     m_propertyTable->entries()[entryIndex - 1].key = rep;
     m_propertyTable->entries()[entryIndex - 1].attributes = attributes;
+    m_propertyTable->entries()[entryIndex - 1].specificValue = specificValue;
     m_propertyTable->entries()[entryIndex - 1].index = ++m_propertyTable->lastIndexUsed;
 
     unsigned newOffset;
@@ -795,6 +880,7 @@ size_t Structure::remove(const Identifier& propertyName)
     key->deref();
     m_propertyTable->entries()[entryIndex - 1].key = 0;
     m_propertyTable->entries()[entryIndex - 1].attributes = 0;
+    m_propertyTable->entries()[entryIndex - 1].specificValue = 0;
     m_propertyTable->entries()[entryIndex - 1].offset = 0;
 
     if (!m_propertyTable->deletedOffsets)
@@ -922,7 +1008,7 @@ static int comparePropertyMapEntryIndices(const void* a, const void* b)
     return 0;
 }
 
-void Structure::getEnumerablePropertyNamesInternal(PropertyNameArray& propertyNames)
+void Structure::getEnumerableNamesFromPropertyTable(PropertyNameArray& propertyNames)
 {
     materializePropertyMapIfNecessary();
     if (!m_propertyTable)
@@ -979,6 +1065,25 @@ void Structure::getEnumerablePropertyNamesInternal(PropertyNameArray& propertyNa
     }
 }
 
+void Structure::getEnumerableNamesFromClassInfoTable(ExecState* exec, const ClassInfo* classInfo, PropertyNameArray& propertyNames)
+{
+    // Add properties from the static hashtables of properties
+    for (; classInfo; classInfo = classInfo->parentClass) {
+        const HashTable* table = classInfo->propHashTable(exec);
+        if (!table)
+            continue;
+        table->initializeIfNeeded(exec);
+        ASSERT(table->table);
+
+        int hashSizeMask = table->compactSize - 1;
+        const HashEntry* entry = table->table;
+        for (int i = 0; i <= hashSizeMask; ++i, ++entry) {
+            if (entry->key() && !(entry->attributes() & DontEnum))
+                propertyNames.add(entry->key());
+        }
+    }
+}
+
 #if DO_PROPERTYMAP_CONSTENCY_CHECK
 
 void Structure::checkConsistency()
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
index c326b3f..866999d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/Structure.h
@@ -51,7 +51,7 @@ namespace JSC {
     class Structure : public RefCounted<Structure> {
     public:
         friend class JIT;
-        static PassRefPtr<Structure> create(JSValuePtr prototype, const TypeInfo& typeInfo)
+        static PassRefPtr<Structure> create(JSValue prototype, const TypeInfo& typeInfo)
         {
             return adoptRef(new Structure(prototype, typeInfo));
         }
@@ -61,10 +61,11 @@ namespace JSC {
 
         static void dumpStatistics();
 
-        static PassRefPtr<Structure> addPropertyTransition(Structure*, const Identifier& propertyName, unsigned attributes, size_t& offset);
-        static PassRefPtr<Structure> addPropertyTransitionToExistingStructure(Structure*, const Identifier& propertyName, unsigned attributes, size_t& offset);
+        static PassRefPtr<Structure> addPropertyTransition(Structure*, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset);
+        static PassRefPtr<Structure> addPropertyTransitionToExistingStructure(Structure*, const Identifier& propertyName, unsigned attributes, JSCell* specificValue, size_t& offset);
         static PassRefPtr<Structure> removePropertyTransition(Structure*, const Identifier& propertyName, size_t& offset);
-        static PassRefPtr<Structure> changePrototypeTransition(Structure*, JSValuePtr prototype);
+        static PassRefPtr<Structure> changePrototypeTransition(Structure*, JSValue prototype);
+        static PassRefPtr<Structure> despecifyFunctionTransition(Structure*, const Identifier&);        
         static PassRefPtr<Structure> getterSetterTransition(Structure*);
         static PassRefPtr<Structure> toDictionaryTransition(Structure*);
         static PassRefPtr<Structure> fromDictionaryTransition(Structure*);
@@ -73,34 +74,38 @@ namespace JSC {
 
         void mark()
         {
-            if (!m_prototype->marked())
-                m_prototype->mark();
+            if (!m_prototype.marked())
+                m_prototype.mark();
         }
 
         // These should be used with caution.  
-        size_t addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes);
+        size_t addPropertyWithoutTransition(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
         size_t removePropertyWithoutTransition(const Identifier& propertyName);
-        void setPrototypeWithoutTransition(JSValuePtr prototype) { m_prototype = prototype; }
+        void setPrototypeWithoutTransition(JSValue prototype) { m_prototype = prototype; }
 
         bool isDictionary() const { return m_isDictionary; }
 
         const TypeInfo& typeInfo() const { return m_typeInfo; }
 
-        JSValuePtr storedPrototype() const { return m_prototype; }
-        JSValuePtr prototypeForLookup(ExecState*); 
+        JSValue storedPrototype() const { return m_prototype; }
+        JSValue prototypeForLookup(ExecState*) const;
+        StructureChain* prototypeChain(ExecState*) const;
 
         Structure* previousID() const { return m_previous.get(); }
 
-        StructureChain* createCachedPrototypeChain();
-        void setCachedPrototypeChain(PassRefPtr<StructureChain> cachedPrototypeChain) { m_cachedPrototypeChain = cachedPrototypeChain; }
-        StructureChain* cachedPrototypeChain() const { return m_cachedPrototypeChain.get(); }
-
         void growPropertyStorageCapacity();
         size_t propertyStorageCapacity() const { return m_propertyStorageCapacity; }
         size_t propertyStorageSize() const { return m_propertyTable ? m_propertyTable->keyCount + (m_propertyTable->deletedOffsets ? m_propertyTable->deletedOffsets->size() : 0) : m_offset + 1; }
+        bool isUsingInlineStorage() const;
 
         size_t get(const Identifier& propertyName);
-        size_t get(const Identifier& propertyName, unsigned& attributes);
+        size_t get(const UString::Rep* rep, unsigned& attributes, JSCell*& specificValue);
+        size_t get(const Identifier& propertyName, unsigned& attributes, JSCell*& specificValue)
+        {
+            ASSERT(!propertyName.isNull());
+            return get(propertyName._ustring.rep(), attributes, specificValue);
+        }
+
         void getEnumerablePropertyNames(ExecState*, PropertyNameArray&, JSObject*);
 
         bool hasGetterSetterProperties() const { return m_hasGetterSetterProperties; }
@@ -108,12 +113,16 @@ namespace JSC {
 
         bool isEmpty() const { return m_propertyTable ? !m_propertyTable->keyCount : m_offset == noOffset; }
 
+        JSCell* specificValue() { return m_specificValueInPrevious; }
+        void despecifyDictionaryFunction(const Identifier& propertyName);
+
     private:
-        Structure(JSValuePtr prototype, const TypeInfo&);
+        Structure(JSValue prototype, const TypeInfo&);
 
-        size_t put(const Identifier& propertyName, unsigned attributes);
+        size_t put(const Identifier& propertyName, unsigned attributes, JSCell* specificValue);
         size_t remove(const Identifier& propertyName);
-        void getEnumerablePropertyNamesInternal(PropertyNameArray&);
+        void getEnumerableNamesFromPropertyTable(PropertyNameArray&);
+        void getEnumerableNamesFromClassInfoTable(ExecState*, const ClassInfo*, PropertyNameArray&);
 
         void expandPropertyMapHashTable();
         void rehashPropertyMapHashTable();
@@ -123,6 +132,8 @@ namespace JSC {
         void insertIntoPropertyMapHashTable(const PropertyMapEntry&);
         void checkConsistency();
 
+        bool despecifyFunction(const Identifier&);
+
         PropertyMapHashTable* copyPropertyTable();
         void materializePropertyMap();
         void materializePropertyMapIfNecessary()
@@ -134,16 +145,13 @@ namespace JSC {
 
         void clearEnumerationCache();
 
-        void* addressOfCount()
-        {
-            return &m_refCount;
-        }
-
         signed char transitionCount() const
         {
             // Since the number of transitions is always the same as m_offset, we keep the size of Structure down by not storing both.
             return m_offset == noOffset ? 0 : m_offset + 1;
         }
+        
+        bool isValid(ExecState*, StructureChain* cachedPrototypeChain) const;
 
         static const unsigned emptyEntryIndex = 0;
     
@@ -153,8 +161,8 @@ namespace JSC {
 
         TypeInfo m_typeInfo;
 
-        JSValuePtr m_prototype;
-        RefPtr<StructureChain> m_cachedPrototypeChain;
+        JSValue m_prototype;
+        mutable RefPtr<StructureChain> m_cachedPrototypeChain;
 
         RefPtr<Structure> m_previous;
         RefPtr<UString::Rep> m_nameInPrevious;
@@ -163,6 +171,7 @@ namespace JSC {
             Structure* singleTransition;
             StructureTransitionTable* table;
         } m_transitions;
+        JSCell* m_specificValueInPrevious;
 
         RefPtr<PropertyNameArrayData> m_cachedPropertyNameArrayData;
 
@@ -175,7 +184,7 @@ namespace JSC {
         bool m_isPinnedPropertyTable : 1;
         bool m_hasGetterSetterProperties : 1;
         bool m_usingSingleTransitionSlot : 1;
-        unsigned m_attributesInPrevious : 5;
+        unsigned m_attributesInPrevious : 7;
     };
 
     inline size_t Structure::get(const Identifier& propertyName)
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp
index 84c67c3..85049b1 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.cpp
@@ -32,42 +32,29 @@
 
 namespace JSC {
 
-StructureChain::StructureChain(Structure* structure)
+StructureChain::StructureChain(Structure* head)
 {
-    size_t size = 1;
-
-    Structure* tmp = structure;
-    while (!tmp->storedPrototype()->isNull()) {
+    size_t size = 0;
+    for (Structure* current = head; current; current = current->storedPrototype().isNull() ? 0 : asObject(current->storedPrototype())->structure())
         ++size;
-        tmp = asCell(tmp->storedPrototype())->structure();
-    }
     
     m_vector.set(new RefPtr<Structure>[size + 1]);
 
-    size_t i;
-    for (i = 0; i < size - 1; ++i) {
-        m_vector[i] = structure;
-        structure = asObject(structure->storedPrototype())->structure();
-    }
-    m_vector[i] = structure;
-    m_vector[i + 1] = 0;
+    size_t i = 0;
+    for (Structure* current = head; current; current = current->storedPrototype().isNull() ? 0 : asObject(current->storedPrototype())->structure())
+        m_vector[i++] = current;
+    m_vector[i] = 0;
 }
 
-bool structureChainsAreEqual(StructureChain* chainA, StructureChain* chainB)
+bool StructureChain::isCacheable() const
 {
-    if (!chainA || !chainB)
-        return false;
-
-    RefPtr<Structure>* a = chainA->head();
-    RefPtr<Structure>* b = chainB->head();
-    while (1) {
-        if (*a != *b)
+    uint32_t i = 0;
+    
+    while (m_vector[i]) {
+        if (m_vector[i++]->isDictionary())
             return false;
-        if (!*a)
-            return true;
-        a++;
-        b++;
     }
+    return true;
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.h
index a3a1be2..c48749d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureChain.h
@@ -37,18 +37,16 @@ namespace JSC {
 
     class StructureChain : public RefCounted<StructureChain> {
     public:
-        static PassRefPtr<StructureChain> create(Structure* structure) { return adoptRef(new StructureChain(structure)); }
-
+        static PassRefPtr<StructureChain> create(Structure* head) { return adoptRef(new StructureChain(head)); }
         RefPtr<Structure>* head() { return m_vector.get(); }
+        bool isCacheable() const;
 
     private:
-        StructureChain(Structure* structure);
+        StructureChain(Structure* head);
 
         OwnArrayPtr<RefPtr<Structure> > m_vector;
     };
 
-    bool structureChainsAreEqual(StructureChain*, StructureChain*);
-
 } // namespace JSC
 
 #endif // StructureChain_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h
index 1543049..804cbeb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/StructureTransitionTable.h
@@ -37,7 +37,7 @@ namespace JSC {
     class Structure;
 
     struct StructureTransitionTableHash {
-        typedef std::pair<RefPtr<UString::Rep>, unsigned> Key;
+        typedef std::pair<RefPtr<UString::Rep>, std::pair<unsigned, JSCell*> > Key;
         static unsigned hash(const Key& p)
         {
             return p.first->computedHash();
@@ -53,13 +53,14 @@ namespace JSC {
 
     struct StructureTransitionTableHashTraits {
         typedef WTF::HashTraits<RefPtr<UString::Rep> > FirstTraits;
-        typedef WTF::GenericHashTraits<unsigned> SecondTraits;
-        typedef std::pair<FirstTraits::TraitType, SecondTraits::TraitType> TraitType;
+        typedef WTF::GenericHashTraits<unsigned> SecondFirstTraits;
+        typedef WTF::GenericHashTraits<JSCell*> SecondSecondTraits;
+        typedef std::pair<FirstTraits::TraitType, std::pair<SecondFirstTraits::TraitType, SecondSecondTraits::TraitType> > TraitType;
 
-        static const bool emptyValueIsZero = FirstTraits::emptyValueIsZero && SecondTraits::emptyValueIsZero;
-        static TraitType emptyValue() { return std::make_pair(FirstTraits::emptyValue(), SecondTraits::emptyValue()); }
+        static const bool emptyValueIsZero = FirstTraits::emptyValueIsZero && SecondFirstTraits::emptyValueIsZero && SecondSecondTraits::emptyValueIsZero;
+        static TraitType emptyValue() { return std::make_pair(FirstTraits::emptyValue(), std::make_pair(SecondFirstTraits::emptyValue(), SecondSecondTraits::emptyValue())); }
 
-        static const bool needsDestruction = FirstTraits::needsDestruction || SecondTraits::needsDestruction;
+        static const bool needsDestruction = FirstTraits::needsDestruction || SecondFirstTraits::needsDestruction || SecondSecondTraits::needsDestruction;
 
         static void constructDeletedValue(TraitType& slot) { FirstTraits::constructDeletedValue(slot.first); }
         static bool isDeletedValue(const TraitType& value) { return FirstTraits::isDeletedValue(value.first); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp
new file mode 100644
index 0000000..30ba6e9
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.cpp
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "TimeoutChecker.h"
+
+#include "CallFrame.h"
+#include "JSGlobalObject.h"
+
+#if PLATFORM(DARWIN)
+#include <mach/mach.h>
+#endif
+
+#if HAVE(SYS_TIME_H)
+#include <sys/time.h>
+#endif
+
+#if PLATFORM(WIN_OS)
+#include <windows.h>
+#endif
+
+#if PLATFORM(QT)
+#include <QDateTime>
+#endif
+
+using namespace std;
+
+namespace JSC {
+
+// Number of ticks before the first timeout check is done.
+static const int ticksUntilFirstCheck = 1024;
+
+// Number of milliseconds between each timeout check.
+static const int intervalBetweenChecks = 1000;
+
+// Returns the time the current thread has spent executing, in milliseconds.
+static inline unsigned getCPUTime()
+{
+#if PLATFORM(DARWIN)
+    mach_msg_type_number_t infoCount = THREAD_BASIC_INFO_COUNT;
+    thread_basic_info_data_t info;
+
+    // Get thread information
+    mach_port_t threadPort = mach_thread_self();
+    thread_info(threadPort, THREAD_BASIC_INFO, reinterpret_cast<thread_info_t>(&info), &infoCount);
+    mach_port_deallocate(mach_task_self(), threadPort);
+    
+    unsigned time = info.user_time.seconds * 1000 + info.user_time.microseconds / 1000;
+    time += info.system_time.seconds * 1000 + info.system_time.microseconds / 1000;
+    
+    return time;
+#elif HAVE(SYS_TIME_H)
+    // FIXME: This should probably use getrusage with the RUSAGE_THREAD flag.
+    struct timeval tv;
+    gettimeofday(&tv, 0);
+    return tv.tv_sec * 1000 + tv.tv_usec / 1000;
+#elif PLATFORM(QT)
+    QDateTime t = QDateTime::currentDateTime();
+    return t.toTime_t() * 1000 + t.time().msec();
+#elif PLATFORM(WIN_OS)
+    union {
+        FILETIME fileTime;
+        unsigned long long fileTimeAsLong;
+    } userTime, kernelTime;
+    
+    // GetThreadTimes won't accept NULL arguments so we pass these even though
+    // they're not used.
+    FILETIME creationTime, exitTime;
+    
+    GetThreadTimes(GetCurrentThread(), &creationTime, &exitTime, &kernelTime.fileTime, &userTime.fileTime);
+    
+    return userTime.fileTimeAsLong / 10000 + kernelTime.fileTimeAsLong / 10000;
+#else
+#error Platform does not have getCurrentTime function
+#endif
+}
+
+TimeoutChecker::TimeoutChecker()
+    : m_timeoutInterval(0)
+    , m_startCount(0)
+{
+    reset();
+}
+
+void TimeoutChecker::reset()
+{
+    m_ticksUntilNextCheck = ticksUntilFirstCheck;
+    m_timeAtLastCheck = 0;
+    m_timeExecuting = 0;
+}
+
+bool TimeoutChecker::didTimeOut(ExecState* exec)
+{
+    unsigned currentTime = getCPUTime();
+    
+    if (!m_timeAtLastCheck) {
+        // Suspicious amount of looping in a script -- start timing it
+        m_timeAtLastCheck = currentTime;
+        return false;
+    }
+    
+    unsigned timeDiff = currentTime - m_timeAtLastCheck;
+    
+    if (timeDiff == 0)
+        timeDiff = 1;
+    
+    m_timeExecuting += timeDiff;
+    m_timeAtLastCheck = currentTime;
+    
+    // Adjust the tick threshold so we get the next checkTimeout call in the
+    // interval specified in intervalBetweenChecks.
+    m_ticksUntilNextCheck = static_cast<unsigned>((static_cast<float>(intervalBetweenChecks) / timeDiff) * m_ticksUntilNextCheck);
+    // If the new threshold is 0 reset it to the default threshold. This can happen if the timeDiff is higher than the
+    // preferred script check time interval.
+    if (m_ticksUntilNextCheck == 0)
+        m_ticksUntilNextCheck = ticksUntilFirstCheck;
+    
+    if (m_timeoutInterval && m_timeExecuting > m_timeoutInterval) {
+        if (exec->dynamicGlobalObject()->shouldInterruptScript())
+            return true;
+        
+        reset();
+    }
+    
+    return false;
+}
+
+} // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.h b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.h
new file mode 100644
index 0000000..7bfa6d0
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/TimeoutChecker.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TimeoutChecker_h
+#define TimeoutChecker_h
+
+#include <wtf/Assertions.h>
+
+namespace JSC {
+
+    class ExecState;
+
+    class TimeoutChecker {
+    public:
+        TimeoutChecker();
+
+        void setTimeoutInterval(unsigned timeoutInterval) { m_timeoutInterval = timeoutInterval; }
+        
+        unsigned ticksUntilNextCheck() { return m_ticksUntilNextCheck; }
+        
+        void start()
+        {
+            if (!m_startCount)
+                reset();
+            ++m_startCount;
+        }
+
+        void stop()
+        {
+            ASSERT(m_startCount);
+            --m_startCount;
+        }
+
+        void reset();
+
+        bool didTimeOut(ExecState*);
+
+    private:
+        unsigned m_timeoutInterval;
+        unsigned m_timeAtLastCheck;
+        unsigned m_timeExecuting;
+        unsigned m_startCount;
+        unsigned m_ticksUntilNextCheck;
+    };
+
+} // namespace JSC
+
+#endif // TimeoutChecker_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/TypeInfo.h b/src/3rdparty/webkit/JavaScriptCore/runtime/TypeInfo.h
index 52da347..70aeed3 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/TypeInfo.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/TypeInfo.h
@@ -35,13 +35,22 @@ namespace JSC {
     static const unsigned MasqueradesAsUndefined = 1;
     static const unsigned ImplementsHasInstance = 1 << 1;
     static const unsigned OverridesHasInstance = 1 << 2;
-    static const unsigned NeedsThisConversion = 1 << 3;
-    static const unsigned HasStandardGetOwnPropertySlot = 1 << 4;
+    static const unsigned ImplementsDefaultHasInstance = 1 << 3;
+    static const unsigned NeedsThisConversion = 1 << 4;
+    static const unsigned HasStandardGetOwnPropertySlot = 1 << 5;
 
     class TypeInfo {
         friend class JIT;
     public:
-        TypeInfo(JSType type, unsigned flags = 0) : m_type(type), m_flags(flags) { }
+        TypeInfo(JSType type, unsigned flags = 0)
+            : m_type(type)
+        {
+            // ImplementsDefaultHasInstance means (ImplementsHasInstance & !OverridesHasInstance)
+            if ((flags & (ImplementsHasInstance | OverridesHasInstance)) == ImplementsHasInstance)
+                m_flags = flags | ImplementsDefaultHasInstance;
+            else
+                m_flags = flags;
+        }
 
         JSType type() const { return m_type; }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp
index 45df248..118751e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.cpp
@@ -1,7 +1,8 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
+ *  Copyright (C) 2009 Google Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -61,6 +62,9 @@ namespace JSC {
 extern const double NaN;
 extern const double Inf;
 
+// This number must be at least 2 to avoid sharing empty, null as well as 1 character strings from SmallStrings.
+static const int minLengthToShare = 10;
+
 static inline size_t overflowIndicator() { return std::numeric_limits<size_t>::max(); }
 static inline size_t maxUChars() { return std::numeric_limits<size_t>::max() / sizeof(UChar); }
 
@@ -92,7 +96,7 @@ static inline void copyChars(UChar* destination, const UChar* source, unsigned n
     memcpy(destination, source, numCharacters * sizeof(UChar));
 }
 
-COMPILE_ASSERT(sizeof(UChar) == 2, uchar_is_2_bytes)
+COMPILE_ASSERT(sizeof(UChar) == 2, uchar_is_2_bytes);
 
 CString::CString(const char* c)
     : m_length(strlen(c))
@@ -186,86 +190,68 @@ bool operator==(const CString& c1, const CString& c2)
 // These static strings are immutable, except for rc, whose initial value is chosen to 
 // reduce the possibility of it becoming zero due to ref/deref not being thread-safe.
 static UChar sharedEmptyChar;
-UString::Rep UString::Rep::null = { 0, 0, INT_MAX / 2, 0, 1, &UString::Rep::null, 0, 0, 0, 0, 0, 0 };
-UString::Rep UString::Rep::empty = { 0, 0, INT_MAX / 2, 0, 1, &UString::Rep::empty, 0, &sharedEmptyChar, 0, 0, 0, 0 };
-
-static char* statBuffer = 0; // Only used for debugging via UString::ascii().
+UString::BaseString* UString::Rep::nullBaseString;
+UString::BaseString* UString::Rep::emptyBaseString;
+UString* UString::nullUString;
 
-PassRefPtr<UString::Rep> UString::Rep::createCopying(const UChar* d, int l)
+static void initializeStaticBaseString(UString::BaseString& base)
 {
-    UChar* copyD = static_cast<UChar*>(fastMalloc(l * sizeof(UChar)));
-    copyChars(copyD, d, l);
-    return create(copyD, l);
+    base.rc = INT_MAX / 2;
+    base.m_identifierTableAndFlags.setFlag(UString::Rep::StaticFlag);
+    base.checkConsistency();
 }
 
-PassRefPtr<UString::Rep> UString::Rep::create(UChar* d, int l)
+void initializeUString()
 {
-    Rep* r = new Rep;
-    r->offset = 0;
-    r->len = l;
-    r->rc = 1;
-    r->_hash = 0;
-    r->m_identifierTable = 0;
-    r->baseString = r;
-    r->reportedCost = 0;
-    r->buf = d;
-    r->usedCapacity = l;
-    r->capacity = l;
-    r->usedPreCapacity = 0;
-    r->preCapacity = 0;
+    UString::Rep::nullBaseString = new UString::BaseString(0, 0);
+    initializeStaticBaseString(*UString::Rep::nullBaseString);
 
-    r->checkConsistency();
+    UString::Rep::emptyBaseString = new UString::BaseString(&sharedEmptyChar, 0);
+    initializeStaticBaseString(*UString::Rep::emptyBaseString);
 
-    // steal the single reference this Rep was created with
-    return adoptRef(r);
+    UString::nullUString = new UString;
 }
 
-PassRefPtr<UString::Rep> UString::Rep::create(PassRefPtr<Rep> base, int offset, int length)
-{
-    ASSERT(base);
-    base->checkConsistency();
-
-    int baseOffset = base->offset;
-
-    base = base->baseString;
-
-    ASSERT(-(offset + baseOffset) <= base->usedPreCapacity);
-    ASSERT(offset + baseOffset + length <= base->usedCapacity);
-
-    Rep* r = new Rep;
-    r->offset = baseOffset + offset;
-    r->len = length;
-    r->rc = 1;
-    r->_hash = 0;
-    r->m_identifierTable = 0;
-    r->baseString = base.releaseRef();
-    r->reportedCost = 0;
-    r->buf = 0;
-    r->usedCapacity = 0;
-    r->capacity = 0;
-    r->usedPreCapacity = 0;
-    r->preCapacity = 0;
-
-    r->checkConsistency();
+static char* statBuffer = 0; // Only used for debugging via UString::ascii().
 
-    // steal the single reference this Rep was created with
-    return adoptRef(r);
+PassRefPtr<UString::Rep> UString::Rep::createCopying(const UChar* d, int l)
+{
+    UChar* copyD = static_cast<UChar*>(fastMalloc(l * sizeof(UChar)));
+    copyChars(copyD, d, l);
+    return create(copyD, l);
 }
 
 PassRefPtr<UString::Rep> UString::Rep::createFromUTF8(const char* string)
 {
     if (!string)
-        return &UString::Rep::null;
+        return &UString::Rep::null();
 
     size_t length = strlen(string);
     Vector<UChar, 1024> buffer(length);
     UChar* p = buffer.data();
     if (conversionOK != convertUTF8ToUTF16(&string, string + length, &p, p + length))
-        return &UString::Rep::null;
+        return &UString::Rep::null();
 
     return UString::Rep::createCopying(buffer.data(), p - buffer.data());
 }
 
+PassRefPtr<UString::Rep> UString::Rep::create(UChar* string, int length, PassRefPtr<UString::SharedUChar> sharedBuffer)
+{
+    PassRefPtr<UString::Rep> rep = create(string, length);
+    rep->baseString()->setSharedBuffer(sharedBuffer);
+    rep->checkConsistency();
+    return rep;
+}
+
+UString::SharedUChar* UString::Rep::sharedBuffer()
+{
+    UString::BaseString* base = baseString();
+    if (len < minLengthToShare)
+        return 0;
+
+    return base->sharedBuffer();
+}
+
 void UString::Rep::destroy()
 {
     checkConsistency();
@@ -275,10 +261,15 @@ void UString::Rep::destroy()
     if (!isStatic()) {
         if (identifierTable())
             Identifier::remove(this);
-        if (baseString == this)
-            fastFree(buf);
-        else
-            baseString->deref();
+
+        UString::BaseString* base = baseString();
+        if (base == this) {
+            if (m_sharedBuffer)
+                m_sharedBuffer->deref();
+            else
+                fastFree(base->buf);
+        } else
+            base->deref();
 
         delete this;
     }
@@ -380,17 +371,10 @@ unsigned UString::Rep::computeHash(const char* s, int l)
 #ifndef NDEBUG
 void UString::Rep::checkConsistency() const
 {
-    // Only base strings have non-zero shared data.
-    if (this != baseString) {
-        ASSERT(!buf);
-        ASSERT(!usedCapacity);
-        ASSERT(!capacity);
-        ASSERT(!usedPreCapacity);
-        ASSERT(!preCapacity);
-    }
+    const UString::BaseString* base = baseString();
 
     // There is no recursion for base strings.
-    ASSERT(baseString == baseString->baseString);
+    ASSERT(base == base->baseString());
 
     if (isStatic()) {
         // There are only two static strings: null and empty.
@@ -401,63 +385,144 @@ void UString::Rep::checkConsistency() const
     }
 
     // The string fits in buffer.
-    ASSERT(baseString->usedPreCapacity <= baseString->preCapacity);
-    ASSERT(baseString->usedCapacity <= baseString->capacity);
-    ASSERT(-offset <= baseString->usedPreCapacity);
-    ASSERT(offset + len <= baseString->usedCapacity);
+    ASSERT(base->usedPreCapacity <= base->preCapacity);
+    ASSERT(base->usedCapacity <= base->capacity);
+    ASSERT(-offset <= base->usedPreCapacity);
+    ASSERT(offset + len <= base->usedCapacity);
 }
 #endif
 
-// put these early so they can be inlined
-static inline size_t expandedSize(size_t size, size_t otherSize)
+UString::SharedUChar* UString::BaseString::sharedBuffer()
 {
-    // Do the size calculation in two parts, returning overflowIndicator if
-    // we overflow the maximum value that we can handle.
-
-    if (size > maxUChars())
-        return overflowIndicator();
-
-    size_t expandedSize = ((size + 10) / 10 * 11) + 1;
-    if (maxUChars() - expandedSize < otherSize)
-        return overflowIndicator();
-
-    return expandedSize + otherSize;
+    if (!m_sharedBuffer)
+        setSharedBuffer(SharedUChar::create(new OwnFastMallocPtr<UChar>(buf)));
+    return m_sharedBuffer;
 }
 
-inline int UString::usedCapacity() const
+void UString::BaseString::setSharedBuffer(PassRefPtr<UString::SharedUChar> sharedBuffer)
 {
-    return m_rep->baseString->usedCapacity;
+    // The manual steps below are because m_sharedBuffer can't be a RefPtr. m_sharedBuffer
+    // is in a union with another variable to avoid making BaseString any larger.
+    if (m_sharedBuffer)
+        m_sharedBuffer->deref();
+    m_sharedBuffer = sharedBuffer.releaseRef();
 }
 
-inline int UString::usedPreCapacity() const
+bool UString::BaseString::slowIsBufferReadOnly()
 {
-    return m_rep->baseString->usedPreCapacity;
+    // The buffer may not be modified as soon as the underlying data has been shared with another class.
+    if (m_sharedBuffer->isShared())
+        return true;
+
+    // At this point, we know it that the underlying buffer isn't shared outside of this base class,
+    // so get rid of m_sharedBuffer.
+    OwnPtr<OwnFastMallocPtr<UChar> > mallocPtr(m_sharedBuffer->release());
+    UChar* unsharedBuf = const_cast<UChar*>(mallocPtr->release());
+    setSharedBuffer(0);
+    preCapacity += (buf - unsharedBuf);
+    buf = unsharedBuf;
+    return false;
 }
 
+// Put these early so they can be inlined.
+static inline size_t expandedSize(size_t capacitySize, size_t precapacitySize)
+{
+    // Combine capacitySize & precapacitySize to produce a single size to allocate,
+    // check that doing so does not result in overflow.
+    size_t size = capacitySize + precapacitySize;
+    if (size < capacitySize)
+        return overflowIndicator();
+
+    // Small Strings (up to 4 pages):
+    // Expand the allocation size to 112.5% of the amount requested.  This is largely sicking
+    // to our previous policy, however 112.5% is cheaper to calculate.
+    if (size < 0x4000) {
+        size_t expandedSize = ((size + (size >> 3)) | 15) + 1;
+        // Given the limited range within which we calculate the expansion in this
+        // fashion the above calculation should never overflow.
+        ASSERT(expandedSize >= size);
+        ASSERT(expandedSize < maxUChars());
+        return expandedSize;
+    }
+
+    // Medium Strings (up to 128 pages):
+    // For pages covering multiple pages over-allocation is less of a concern - any unused
+    // space will not be paged in if it is not used, so this is purely a VM overhead.  For
+    // these strings allocate 2x the requested size.
+    if (size < 0x80000) {
+        size_t expandedSize = ((size + size) | 0xfff) + 1;
+        // Given the limited range within which we calculate the expansion in this
+        // fashion the above calculation should never overflow.
+        ASSERT(expandedSize >= size);
+        ASSERT(expandedSize < maxUChars());
+        return expandedSize;
+    }
+
+    // Large Strings (to infinity and beyond!):
+    // Revert to our 112.5% policy - probably best to limit the amount of unused VM we allow
+    // any individual string be responsible for.
+    size_t expandedSize = ((size + (size >> 3)) | 0xfff) + 1;
+
+    // Check for overflow - any result that is at least as large as requested (but
+    // still below the limit) is okay.
+    if ((expandedSize >= size) && (expandedSize < maxUChars()))
+        return expandedSize;
+    return overflowIndicator();
+}
 
 static inline bool expandCapacity(UString::Rep* rep, int requiredLength)
 {
     rep->checkConsistency();
+    ASSERT(!rep->baseString()->isBufferReadOnly());
 
-    UString::Rep* r = rep->baseString;
+    UString::BaseString* base = rep->baseString();
 
-    if (requiredLength > r->capacity) {
-        size_t newCapacity = expandedSize(requiredLength, r->preCapacity);
-        UChar* oldBuf = r->buf;
-        r->buf = reallocChars(r->buf, newCapacity);
-        if (!r->buf) {
-            r->buf = oldBuf;
+    if (requiredLength > base->capacity) {
+        size_t newCapacity = expandedSize(requiredLength, base->preCapacity);
+        UChar* oldBuf = base->buf;
+        base->buf = reallocChars(base->buf, newCapacity);
+        if (!base->buf) {
+            base->buf = oldBuf;
             return false;
         }
-        r->capacity = newCapacity - r->preCapacity;
+        base->capacity = newCapacity - base->preCapacity;
     }
-    if (requiredLength > r->usedCapacity)
-        r->usedCapacity = requiredLength;
+    if (requiredLength > base->usedCapacity)
+        base->usedCapacity = requiredLength;
 
     rep->checkConsistency();
     return true;
 }
 
+bool UString::Rep::reserveCapacity(int capacity)
+{
+    // If this is an empty string there is no point 'growing' it - just allocate a new one.
+    // If the BaseString is shared with another string that is using more capacity than this
+    // string is, then growing the buffer won't help.
+    // If the BaseString's buffer is readonly, then it isn't allowed to grow.
+    UString::BaseString* base = baseString();
+    if (!base->buf || !base->capacity || (offset + len) != base->usedCapacity || base->isBufferReadOnly())
+        return false;
+    
+    // If there is already sufficient capacity, no need to grow!
+    if (capacity <= base->capacity)
+        return true;
+
+    checkConsistency();
+
+    size_t newCapacity = expandedSize(capacity, base->preCapacity);
+    UChar* oldBuf = base->buf;
+    base->buf = reallocChars(base->buf, newCapacity);
+    if (!base->buf) {
+        base->buf = oldBuf;
+        return false;
+    }
+    base->capacity = newCapacity - base->preCapacity;
+
+    checkConsistency();
+    return true;
+}
+
 void UString::expandCapacity(int requiredLength)
 {
     if (!JSC::expandCapacity(m_rep.get(), requiredLength))
@@ -467,42 +532,43 @@ void UString::expandCapacity(int requiredLength)
 void UString::expandPreCapacity(int requiredPreCap)
 {
     m_rep->checkConsistency();
+    ASSERT(!m_rep->baseString()->isBufferReadOnly());
 
-    Rep* r = m_rep->baseString;
+    BaseString* base = m_rep->baseString();
 
-    if (requiredPreCap > r->preCapacity) {
-        size_t newCapacity = expandedSize(requiredPreCap, r->capacity);
-        int delta = newCapacity - r->capacity - r->preCapacity;
+    if (requiredPreCap > base->preCapacity) {
+        size_t newCapacity = expandedSize(requiredPreCap, base->capacity);
+        int delta = newCapacity - base->capacity - base->preCapacity;
 
         UChar* newBuf = allocChars(newCapacity);
         if (!newBuf) {
             makeNull();
             return;
         }
-        copyChars(newBuf + delta, r->buf, r->capacity + r->preCapacity);
-        fastFree(r->buf);
-        r->buf = newBuf;
+        copyChars(newBuf + delta, base->buf, base->capacity + base->preCapacity);
+        fastFree(base->buf);
+        base->buf = newBuf;
 
-        r->preCapacity = newCapacity - r->capacity;
+        base->preCapacity = newCapacity - base->capacity;
     }
-    if (requiredPreCap > r->usedPreCapacity)
-        r->usedPreCapacity = requiredPreCap;
+    if (requiredPreCap > base->usedPreCapacity)
+        base->usedPreCapacity = requiredPreCap;
 
     m_rep->checkConsistency();
 }
 
-PassRefPtr<UString::Rep> createRep(const char* c)
+static PassRefPtr<UString::Rep> createRep(const char* c)
 {
     if (!c)
-        return &UString::Rep::null;
+        return &UString::Rep::null();
 
     if (!c[0])
-        return &UString::Rep::empty;
+        return &UString::Rep::empty();
 
     size_t length = strlen(c);
     UChar* d = allocChars(length);
     if (!d)
-        return &UString::Rep::null;
+        return &UString::Rep::null();
     else {
         for (size_t i = 0; i < length; i++)
             d[i] = static_cast<unsigned char>(c[i]); // use unsigned char to zero-extend instead of sign-extend
@@ -519,7 +585,7 @@ UString::UString(const char* c)
 UString::UString(const UChar* c, int length)
 {
     if (length == 0) 
-        m_rep = &Rep::empty;
+        m_rep = &Rep::empty();
     else
         m_rep = Rep::createCopying(c, length);
 }
@@ -527,7 +593,7 @@ UString::UString(const UChar* c, int length)
 UString::UString(UChar* c, int length, bool copy)
 {
     if (length == 0)
-        m_rep = &Rep::empty;
+        m_rep = &Rep::empty();
     else if (copy)
         m_rep = Rep::createCopying(c, length);
     else
@@ -537,11 +603,22 @@ UString::UString(UChar* c, int length, bool copy)
 UString::UString(const Vector<UChar>& buffer)
 {
     if (!buffer.size())
-        m_rep = &Rep::empty;
+        m_rep = &Rep::empty();
     else
         m_rep = Rep::createCopying(buffer.data(), buffer.size());
 }
 
+static ALWAYS_INLINE int newCapacityWithOverflowCheck(const int currentCapacity, const int extendLength, const bool plusOne = false)
+{
+    ASSERT_WITH_MESSAGE(extendLength >= 0, "extendedLength = %d", extendLength);
+
+    const int plusLength = plusOne ? 1 : 0;
+    if (currentCapacity > std::numeric_limits<int>::max() - extendLength - plusLength)
+        CRASH();
+
+    return currentCapacity + extendLength + plusLength;
+}
+
 static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Rep> r, const UChar* tData, int tSize)
 {
     RefPtr<UString::Rep> rep = r;
@@ -551,6 +628,7 @@ static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Re
     int thisSize = rep->size();
     int thisOffset = rep->offset;
     int length = thisSize + tSize;
+    UString::BaseString* base = rep->baseString();
 
     // possible cases:
     if (tSize == 0) {
@@ -558,34 +636,34 @@ static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Re
     } else if (thisSize == 0) {
         // this is empty
         rep = UString::Rep::createCopying(tData, tSize);
-    } else if (rep->baseIsSelf() && rep->rc == 1) {
+    } else if (rep == base && !base->isShared()) {
         // this is direct and has refcount of 1 (so we can just alter it directly)
-        if (!expandCapacity(rep.get(), thisOffset + length))
-            rep = &UString::Rep::null;
+        if (!expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length)))
+            rep = &UString::Rep::null();
         if (rep->data()) {
             copyChars(rep->data() + thisSize, tData, tSize);
             rep->len = length;
             rep->_hash = 0;
         }
-    } else if (thisOffset + thisSize == rep->baseString->usedCapacity && thisSize >= minShareSize) {
+    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize && !base->isBufferReadOnly()) {
         // this reaches the end of the buffer - extend it if it's long enough to append to
-        if (!expandCapacity(rep.get(), thisOffset + length))
-            rep = &UString::Rep::null;
+        if (!expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length)))
+            rep = &UString::Rep::null();
         if (rep->data()) {
             copyChars(rep->data() + thisSize, tData, tSize);
             rep = UString::Rep::create(rep, 0, length);
         }
     } else {
-        // this is shared with someone using more capacity, gotta make a whole new string
+        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
         size_t newCapacity = expandedSize(length, 0);
         UChar* d = allocChars(newCapacity);
         if (!d)
-            rep = &UString::Rep::null;
+            rep = &UString::Rep::null();
         else {
             copyChars(d, rep->data(), thisSize);
             copyChars(d + thisSize, tData, tSize);
             rep = UString::Rep::create(d, length);
-            rep->capacity = newCapacity;
+            rep->baseString()->capacity = newCapacity;
         }
     }
 
@@ -604,6 +682,7 @@ static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Re
     int thisOffset = rep->offset;
     int tSize = static_cast<int>(strlen(t));
     int length = thisSize + tSize;
+    UString::BaseString* base = rep->baseString();
 
     // possible cases:
     if (thisSize == 0) {
@@ -611,9 +690,9 @@ static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Re
         rep = createRep(t);
     } else if (tSize == 0) {
         // t is empty, we'll just return *this below.
-    } else if (rep->baseIsSelf() && rep->rc == 1) {
+    } else if (rep == base && !base->isShared()) {
         // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(rep.get(), thisOffset + length);
+        expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length));
         UChar* d = rep->data();
         if (d) {
             for (int i = 0; i < tSize; ++i)
@@ -621,9 +700,9 @@ static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Re
             rep->len = length;
             rep->_hash = 0;
         }
-    } else if (thisOffset + thisSize == rep->baseString->usedCapacity && thisSize >= minShareSize) {
+    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize && !base->isBufferReadOnly()) {
         // this string reaches the end of the buffer - extend it
-        expandCapacity(rep.get(), thisOffset + length);
+        expandCapacity(rep.get(), newCapacityWithOverflowCheck(thisOffset, length));
         UChar* d = rep->data();
         if (d) {
             for (int i = 0; i < tSize; ++i)
@@ -631,17 +710,17 @@ static ALWAYS_INLINE PassRefPtr<UString::Rep> concatenate(PassRefPtr<UString::Re
             rep = UString::Rep::create(rep, 0, length);
         }
     } else {
-        // this is shared with someone using more capacity, gotta make a whole new string
+        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
         size_t newCapacity = expandedSize(length, 0);
         UChar* d = allocChars(newCapacity);
         if (!d)
-            rep = &UString::Rep::null;
+            rep = &UString::Rep::null();
         else {
             copyChars(d, rep->data(), thisSize);
             for (int i = 0; i < tSize; ++i)
                 d[thisSize + i] = static_cast<unsigned char>(t[i]); // use unsigned char to zero-extend instead of sign-extend
             rep = UString::Rep::create(d, length);
-            rep->capacity = newCapacity;
+            rep->baseString()->capacity = newCapacity;
         }
     }
 
@@ -656,13 +735,19 @@ PassRefPtr<UString::Rep> concatenate(UString::Rep* a, UString::Rep* b)
     b->checkConsistency();
 
     int aSize = a->size();
-    int aOffset = a->offset;
     int bSize = b->size();
-    int bOffset = b->offset;
-    int length = aSize + bSize;
+    int aOffset = a->offset;
 
     // possible cases:
 
+    UString::BaseString* aBase = a->baseString();
+    if (bSize == 1 && aOffset + aSize == aBase->usedCapacity && aOffset + aSize < aBase->capacity && !aBase->isBufferReadOnly()) {
+        // b is a single character (common fast case)
+        ++aBase->usedCapacity;
+        a->data()[aSize] = b->data()[0];
+        return UString::Rep::create(a, 0, aSize + 1);
+    }
+
     // a is empty
     if (aSize == 0)
         return b;
@@ -670,21 +755,19 @@ PassRefPtr<UString::Rep> concatenate(UString::Rep* a, UString::Rep* b)
     if (bSize == 0)
         return a;
 
-    if (bSize == 1 && aOffset + aSize == a->baseString->usedCapacity && aOffset + length <= a->baseString->capacity) {
-        // b is a single character (common fast case)
-        a->baseString->usedCapacity = aOffset + length;
-        a->data()[aSize] = b->data()[0];
-        return UString::Rep::create(a, 0, length);
-    }
+    int bOffset = b->offset;
+    int length = aSize + bSize;
 
-    if (aOffset + aSize == a->baseString->usedCapacity && aSize >= minShareSize && 4 * aSize >= bSize &&
-               (-bOffset != b->baseString->usedPreCapacity || aSize >= bSize)) {
+    UString::BaseString* bBase = b->baseString();
+    if (aOffset + aSize == aBase->usedCapacity && aSize >= minShareSize && 4 * aSize >= bSize
+        && (-bOffset != bBase->usedPreCapacity || aSize >= bSize) && !aBase->isBufferReadOnly()) {
         // - a reaches the end of its buffer so it qualifies for shared append
         // - also, it's at least a quarter the length of b - appending to a much shorter
         //   string does more harm than good
         // - however, if b qualifies for prepend and is longer than a, we'd rather prepend
+        
         UString x(a);
-        x.expandCapacity(aOffset + length);
+        x.expandCapacity(newCapacityWithOverflowCheck(aOffset, length));
         if (!a->data() || !x.data())
             return 0;
         copyChars(a->data() + aSize, b->data(), bSize);
@@ -697,7 +780,7 @@ PassRefPtr<UString::Rep> concatenate(UString::Rep* a, UString::Rep* b)
         return result;
     }
 
-    if (-bOffset == b->baseString->usedPreCapacity && bSize >= minShareSize && 4 * bSize >= aSize) {
+    if (-bOffset == bBase->usedPreCapacity && bSize >= minShareSize && 4 * bSize >= aSize && !bBase->isBufferReadOnly()) {
         // - b reaches the beginning of its buffer so it qualifies for shared prepend
         // - also, it's at least a quarter the length of a - prepending to a much shorter
         //   string does more harm than good
@@ -723,7 +806,7 @@ PassRefPtr<UString::Rep> concatenate(UString::Rep* a, UString::Rep* b)
     copyChars(d, a->data(), aSize);
     copyChars(d + aSize, b->data(), bSize);
     PassRefPtr<UString::Rep> result = UString::Rep::create(d, length);
-    result->capacity = newCapacity;
+    result->baseString()->capacity = newCapacity;
 
     a->checkConsistency();
     b->checkConsistency();
@@ -775,7 +858,8 @@ PassRefPtr<UString::Rep> concatenate(UString::Rep* rep, double d)
     int decimalPoint;
     int sign;
 
-    char* result = WTF::dtoa(d, 0, &decimalPoint, &sign, NULL);
+    char result[80];
+    WTF::dtoa(result, d, 0, &decimalPoint, &sign, NULL);
     int length = static_cast<int>(strlen(result));
   
     int i = 0;
@@ -826,15 +910,7 @@ PassRefPtr<UString::Rep> concatenate(UString::Rep* rep, double d)
         buf[i++] = '\0';
     }
     
-  WTF::freedtoa(result);
-
-  return concatenate(rep, buf);
-}
-
-const UString& UString::null()
-{
-    static UString* n = new UString; // Should be called from main thread at least once to be safely initialized.
-    return *n;
+    return concatenate(rep, buf);
 }
 
 UString UString::from(int i)
@@ -922,8 +998,9 @@ UString UString::from(double d)
     char buf[80];
     int decimalPoint;
     int sign;
-
-    char* result = WTF::dtoa(d, 0, &decimalPoint, &sign, NULL);
+    
+    char result[80];
+    WTF::dtoa(result, d, 0, &decimalPoint, &sign, NULL);
     int length = static_cast<int>(strlen(result));
   
     int i = 0;
@@ -974,9 +1051,7 @@ UString UString::from(double d)
         buf[i++] = '\0';
     }
     
-  WTF::freedtoa(result);
-
-  return UString(buf);
+    return UString(buf);
 }
 
 UString UString::spliceSubstringsWithSeparators(const Range* substringRanges, int rangeCount, const UString* separators, int separatorCount) const
@@ -1021,6 +1096,28 @@ UString UString::spliceSubstringsWithSeparators(const Range* substringRanges, in
     return UString::Rep::create(buffer, totalLength);
 }
 
+UString UString::replaceRange(int rangeStart, int rangeLength, const UString& replacement) const
+{
+    m_rep->checkConsistency();
+
+    int replacementLength = replacement.size();
+    int totalLength = size() - rangeLength + replacementLength;
+    if (totalLength == 0)
+        return "";
+
+    UChar* buffer = allocChars(totalLength);
+    if (!buffer)
+        return null();
+
+    copyChars(buffer, data(), rangeStart);
+    copyChars(buffer + rangeStart, replacement.data(), replacementLength);
+    int rangeEnd = rangeStart + rangeLength;
+    copyChars(buffer + rangeStart + replacementLength, data() + rangeEnd, size() - rangeEnd);
+
+    return UString::Rep::create(buffer, totalLength);
+}
+
+
 UString& UString::append(const UString &t)
 {
     m_rep->checkConsistency();
@@ -1030,6 +1127,7 @@ UString& UString::append(const UString &t)
     int thisOffset = m_rep->offset;
     int tSize = t.size();
     int length = thisSize + tSize;
+    BaseString* base = m_rep->baseString();
 
     // possible cases:
     if (thisSize == 0) {
@@ -1037,23 +1135,23 @@ UString& UString::append(const UString &t)
         *this = t;
     } else if (tSize == 0) {
         // t is empty
-    } else if (m_rep->baseIsSelf() && m_rep->rc == 1) {
+    } else if (m_rep == base && !base->isShared()) {
         // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(thisOffset + length);
+        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length));
         if (data()) {
             copyChars(m_rep->data() + thisSize, t.data(), tSize);
             m_rep->len = length;
             m_rep->_hash = 0;
         }
-    } else if (thisOffset + thisSize == usedCapacity() && thisSize >= minShareSize) {
+    } else if (thisOffset + thisSize == base->usedCapacity && thisSize >= minShareSize && !base->isBufferReadOnly()) {
         // this reaches the end of the buffer - extend it if it's long enough to append to
-        expandCapacity(thisOffset + length);
+        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length));
         if (data()) {
             copyChars(m_rep->data() + thisSize, t.data(), tSize);
             m_rep = Rep::create(m_rep, 0, length);
         }
     } else {
-        // this is shared with someone using more capacity, gotta make a whole new string
+        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
         size_t newCapacity = expandedSize(length, 0);
         UChar* d = allocChars(newCapacity);
         if (!d)
@@ -1062,7 +1160,7 @@ UString& UString::append(const UString &t)
             copyChars(d, data(), thisSize);
             copyChars(d + thisSize, t.data(), tSize);
             m_rep = Rep::create(d, length);
-            m_rep->capacity = newCapacity;
+            m_rep->baseString()->capacity = newCapacity;
         }
     }
 
@@ -1078,6 +1176,18 @@ UString& UString::append(const UChar* tData, int tSize)
     return *this;
 }
 
+UString& UString::appendNumeric(int i)
+{
+    m_rep = concatenate(rep(), i);
+    return *this;
+}
+
+UString& UString::appendNumeric(double d)
+{
+    m_rep = concatenate(rep(), d);
+    return *this;
+}
+
 UString& UString::append(const char* t)
 {
     m_rep = concatenate(m_rep.release(), t);
@@ -1090,6 +1200,7 @@ UString& UString::append(UChar c)
 
     int thisOffset = m_rep->offset;
     int length = size();
+    BaseString* base = m_rep->baseString();
 
     // possible cases:
     if (length == 0) {
@@ -1101,27 +1212,27 @@ UString& UString::append(UChar c)
         else {
             d[0] = c;
             m_rep = Rep::create(d, 1);
-            m_rep->capacity = newCapacity;
+            m_rep->baseString()->capacity = newCapacity;
         }
-    } else if (m_rep->baseIsSelf() && m_rep->rc == 1) {
+    } else if (m_rep == base && !base->isShared()) {
         // this is direct and has refcount of 1 (so we can just alter it directly)
-        expandCapacity(thisOffset + length + 1);
+        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length, true));
         UChar* d = m_rep->data();
         if (d) {
             d[length] = c;
             m_rep->len = length + 1;
             m_rep->_hash = 0;
         }
-    } else if (thisOffset + length == usedCapacity() && length >= minShareSize) {
+    } else if (thisOffset + length == base->usedCapacity && length >= minShareSize && !base->isBufferReadOnly()) {
         // this reaches the end of the string - extend it and share
-        expandCapacity(thisOffset + length + 1);
+        expandCapacity(newCapacityWithOverflowCheck(thisOffset, length, true));
         UChar* d = m_rep->data();
         if (d) {
             d[length] = c;
             m_rep = Rep::create(m_rep, 0, length + 1);
         }
     } else {
-        // this is shared with someone using more capacity, gotta make a whole new string
+        // This is shared in some way that prevents us from modifying base, so we must make a whole new string.
         size_t newCapacity = expandedSize(length + 1, 0);
         UChar* d = allocChars(newCapacity);
         if (!d)
@@ -1130,7 +1241,7 @@ UString& UString::append(UChar c)
             copyChars(d, data(), length);
             d[length] = c;
             m_rep = Rep::create(d, length + 1);
-            m_rep->capacity = newCapacity;
+            m_rep->baseString()->capacity = newCapacity;
         }
     }
 
@@ -1185,19 +1296,20 @@ char* UString::ascii() const
 UString& UString::operator=(const char* c)
 {
     if (!c) {
-        m_rep = &Rep::null;
+        m_rep = &Rep::null();
         return *this;
     }
 
     if (!c[0]) {
-        m_rep = &Rep::empty;
+        m_rep = &Rep::empty();
         return *this;
     }
 
     int l = static_cast<int>(strlen(c));
     UChar* d;
-    if (m_rep->rc == 1 && l <= m_rep->capacity && m_rep->baseIsSelf() && m_rep->offset == 0 && m_rep->preCapacity == 0) {
-        d = m_rep->buf;
+    BaseString* base = m_rep->baseString();
+    if (!base->isShared() && l <= base->capacity && m_rep == base && m_rep->offset == 0 && base->preCapacity == 0) {
+        d = base->buf;
         m_rep->_hash = 0;
         m_rep->len = l;
     } else {
@@ -1413,12 +1525,24 @@ uint32_t UString::toStrictUInt32(bool* ok) const
 
 int UString::find(const UString& f, int pos) const
 {
-    int sz = size();
     int fsz = f.size();
-    if (sz < fsz)
-        return -1;
+
     if (pos < 0)
         pos = 0;
+
+    if (fsz == 1) {
+        UChar ch = f[0];
+        const UChar* end = data() + size();
+        for (const UChar* c = data() + pos; c < end; c++) {
+            if (*c == ch)
+                return static_cast<int>(c - data());
+        }
+        return -1;
+    }
+
+    int sz = size();
+    if (sz < fsz)
+        return -1;
     if (fsz == 0)
         return pos;
     const UChar* end = data() + sz - fsz;
@@ -1502,19 +1626,6 @@ UString UString::substr(int pos, int len) const
     return UString(Rep::create(m_rep, pos, len));
 }
 
-bool operator==(const UString& s1, const UString& s2)
-{
-    int size = s1.size();
-    switch (size) {
-        case 0:
-            return !s2.size();
-        case 1:
-            return s2.size() == 1 && s1.data()[0] == s2.data()[0];
-        default:
-            return s2.size() == size && memcmp(s1.data(), s2.data(), size * sizeof(UChar)) == 0;
-    }
-}
-
 bool operator==(const UString& s1, const char *s2)
 {
     if (s2 == 0)
@@ -1626,13 +1737,13 @@ CString UString::UTF8String(bool strict) const
 // For use in error handling code paths -- having this not be inlined helps avoid PIC branches to fetch the global on Mac OS X.
 NEVER_INLINE void UString::makeNull()
 {
-    m_rep = &Rep::null;
+    m_rep = &Rep::null();
 }
 
 // For use in error handling code paths -- having this not be inlined helps avoid PIC branches to fetch the global on Mac OS X.
 NEVER_INLINE UString::Rep* UString::nullRep()
 {
-    return &Rep::null;
+    return &Rep::null();
 }
 
 } // namespace JSC
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
index 75403c0..d01b75d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
+++ b/src/3rdparty/webkit/JavaScriptCore/runtime/UString.h
@@ -1,6 +1,7 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
  *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2009 Google Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -26,8 +27,10 @@
 #include <stdint.h>
 #include <string.h>
 #include <wtf/Assertions.h>
-#include <wtf/FastMalloc.h>
+#include <wtf/CrossThreadRefCounted.h>
+#include <wtf/OwnFastMallocPtr.h>
 #include <wtf/PassRefPtr.h>
+#include <wtf/PtrAndFlags.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 #include <wtf/unicode/Unicode.h>
@@ -74,10 +77,26 @@ namespace JSC {
         friend class JIT;
 
     public:
-        struct Rep {
+        typedef CrossThreadRefCounted<OwnFastMallocPtr<UChar> > SharedUChar;
+        struct BaseString;
+        struct Rep : Noncopyable {
             friend class JIT;
 
-            static PassRefPtr<Rep> create(UChar*, int);
+            static PassRefPtr<Rep> create(UChar* buffer, int length)
+            {
+                return adoptRef(new BaseString(buffer, length));
+            }
+
+            static PassRefPtr<Rep> createEmptyBuffer(size_t size)
+            {
+                // Guard against integer overflow
+                if (size < (std::numeric_limits<size_t>::max() / sizeof(UChar))) {
+                    if (void * buf = tryFastMalloc(size * sizeof(UChar)))
+                        return adoptRef(new BaseString(static_cast<UChar*>(buf), 0, size));
+                }
+                return adoptRef(new BaseString(0, 0, 0));
+            }
+
             static PassRefPtr<Rep> createCopying(const UChar*, int);
             static PassRefPtr<Rep> create(PassRefPtr<Rep> base, int offset, int length);
 
@@ -85,10 +104,14 @@ namespace JSC {
             // Returns UString::Rep::null for null input or conversion failure.
             static PassRefPtr<Rep> createFromUTF8(const char*);
 
+            // Uses SharedUChar to have joint ownership over the UChar*.
+            static PassRefPtr<Rep> create(UChar*, int, PassRefPtr<SharedUChar>);
+
+            SharedUChar* sharedBuffer();
             void destroy();
 
-            bool baseIsSelf() const { return baseString == this; }
-            UChar* data() const { return baseString->buf + baseString->preCapacity + offset; }
+            bool baseIsSelf() const { return m_identifierTableAndFlags.isFlagSet(BaseStringFlag); }
+            UChar* data() const;
             int size() const { return len; }
 
             unsigned hash() const { if (_hash == 0) _hash = computeHash(data(), len); return _hash; }
@@ -98,35 +121,115 @@ namespace JSC {
             static unsigned computeHash(const char*, int length);
             static unsigned computeHash(const char* s) { return computeHash(s, strlen(s)); }
 
-            IdentifierTable* identifierTable() const { return reinterpret_cast<IdentifierTable*>(m_identifierTable & ~static_cast<uintptr_t>(1)); }
-            void setIdentifierTable(IdentifierTable* table) { ASSERT(!isStatic()); m_identifierTable = reinterpret_cast<intptr_t>(table); }
+            IdentifierTable* identifierTable() const { return m_identifierTableAndFlags.get(); }
+            void setIdentifierTable(IdentifierTable* table) { ASSERT(!isStatic()); m_identifierTableAndFlags.set(table); }
 
-            bool isStatic() const { return m_identifierTable & 1; }
-            void setStatic(bool v) { ASSERT(!identifierTable()); m_identifierTable = v; }
+            bool isStatic() const { return m_identifierTableAndFlags.isFlagSet(StaticFlag); }
+            void setStatic(bool);
+            void setBaseString(PassRefPtr<BaseString>);
+            BaseString* baseString();
+            const BaseString* baseString() const;
 
             Rep* ref() { ++rc; return this; }
             ALWAYS_INLINE void deref() { if (--rc == 0) destroy(); }
 
             void checkConsistency() const;
+            enum UStringFlags {
+                StaticFlag,
+                BaseStringFlag
+            };
 
             // unshared data
             int offset;
             int len;
             int rc; // For null and empty static strings, this field does not reflect a correct count, because ref/deref are not thread-safe. A special case in destroy() guarantees that these do not get deleted.
             mutable unsigned _hash;
-            intptr_t m_identifierTable; // A pointer to identifier table. The lowest bit is used to indicate whether the string is static (null or empty).
-            UString::Rep* baseString;
-            size_t reportedCost;
+            PtrAndFlags<IdentifierTable, UStringFlags> m_identifierTableAndFlags;
+
+            static BaseString& null() { return *nullBaseString; }
+            static BaseString& empty() { return *emptyBaseString; }
 
-            // potentially shared data. 0 if backed up by a base string.
+            bool reserveCapacity(int capacity);
+
+        protected:
+            // Constructor for use by BaseString subclass; they use the union with m_baseString for another purpose.
+            Rep(int length)
+                : offset(0)
+                , len(length)
+                , rc(1)
+                , _hash(0)
+                , m_baseString(0)
+            {
+            }
+
+            Rep(PassRefPtr<BaseString> base, int offsetInBase, int length)
+                : offset(offsetInBase)
+                , len(length)
+                , rc(1)
+                , _hash(0)
+                , m_baseString(base.releaseRef())
+            {
+                checkConsistency();
+            }
+
+            union {
+                // If !baseIsSelf()
+                BaseString* m_baseString;
+                // If baseIsSelf()
+                SharedUChar* m_sharedBuffer;
+            };
+
+        private:
+            // For SmallStringStorage which allocates an array and does initialization manually.
+            Rep() { }
+
+            friend class SmallStringsStorage;
+            friend void initializeUString();
+            JS_EXPORTDATA static BaseString* nullBaseString;
+            JS_EXPORTDATA static BaseString* emptyBaseString;
+        };
+
+
+        struct BaseString : public Rep {
+            bool isShared() { return rc != 1 || isBufferReadOnly(); }
+            void setSharedBuffer(PassRefPtr<SharedUChar>);
+
+            bool isBufferReadOnly()
+            {
+                if (!m_sharedBuffer)
+                    return false;
+                return slowIsBufferReadOnly();
+            }
+
+            // potentially shared data.
             UChar* buf;
-            int usedCapacity;
-            int capacity;
-            int usedPreCapacity;
             int preCapacity;
+            int usedPreCapacity;
+            int capacity;
+            int usedCapacity;
+
+            size_t reportedCost;
+
+        private:
+            BaseString(UChar* buffer, int length, int additionalCapacity = 0)
+                : Rep(length)
+                , buf(buffer)
+                , preCapacity(0)
+                , usedPreCapacity(0)
+                , capacity(length + additionalCapacity)
+                , usedCapacity(length)
+                , reportedCost(0)
+            {
+                m_identifierTableAndFlags.setFlag(BaseStringFlag);
+                checkConsistency();
+            }
+
+            SharedUChar* sharedBuffer();
+            bool slowIsBufferReadOnly();
 
-            static Rep null;
-            static Rep empty;
+            friend struct Rep;
+            friend class SmallStringsStorage;
+            friend void initializeUString();
         };
 
     public:
@@ -175,11 +278,15 @@ namespace JSC {
 
         UString spliceSubstringsWithSeparators(const Range* substringRanges, int rangeCount, const UString* separators, int separatorCount) const;
 
+        UString replaceRange(int rangeStart, int RangeEnd, const UString& replacement) const;
+
         UString& append(const UString&);
         UString& append(const char*);
         UString& append(UChar);
         UString& append(char c) { return append(static_cast<UChar>(static_cast<unsigned char>(c))); }
         UString& append(const UChar*, int size);
+        UString& appendNumeric(int);
+        UString& appendNumeric(double);
 
         bool getCString(CStringBuffer&) const;
 
@@ -204,7 +311,7 @@ namespace JSC {
 
         const UChar* data() const { return m_rep->data(); }
 
-        bool isNull() const { return (m_rep == &Rep::null); }
+        bool isNull() const { return (m_rep == &Rep::null()); }
         bool isEmpty() const { return (!m_rep->len); }
 
         bool is8Bit() const;
@@ -230,7 +337,7 @@ namespace JSC {
 
         UString substr(int pos = 0, int len = -1) const;
 
-        static const UString& null();
+        static const UString& null() { return *nullUString; }
 
         Rep* rep() const { return m_rep.get(); }
         static Rep* nullRep();
@@ -243,15 +350,26 @@ namespace JSC {
 
         size_t cost() const;
 
+        // Attempt to grow this string such that it can grow to a total length of 'capacity'
+        // without reallocation.  This may fail a number of reasons - if the BasicString is
+        // shared and another string is using part of the capacity beyond our end point, if
+        // the realloc fails, or if this string is empty and has no storage.
+        //
+        // This method returns a boolean indicating success.
+        bool reserveCapacity(int capacity)
+        {
+            return m_rep->reserveCapacity(capacity);
+        }
+
     private:
-        int usedCapacity() const;
-        int usedPreCapacity() const;
         void expandCapacity(int requiredLength);
         void expandPreCapacity(int requiredPreCap);
         void makeNull();
 
         RefPtr<Rep> m_rep;
+        static UString* nullUString;
 
+        friend void initializeUString();
         friend bool operator==(const UString&, const UString&);
         friend PassRefPtr<Rep> concatenate(Rep*, Rep*); // returns 0 if out of memory
     };
@@ -259,7 +377,26 @@ namespace JSC {
     PassRefPtr<UString::Rep> concatenate(UString::Rep*, int);
     PassRefPtr<UString::Rep> concatenate(UString::Rep*, double);
 
-    bool operator==(const UString&, const UString&);
+    inline bool operator==(const UString& s1, const UString& s2)
+    {
+        int size = s1.size();
+        switch (size) {
+        case 0:
+            return !s2.size();
+        case 1:
+            return s2.size() == 1 && s1.data()[0] == s2.data()[0];
+        case 2: {
+            if (s2.size() != 2)
+                return false;
+            const UChar* d1 = s1.data();
+            const UChar* d2 = s2.data();
+            return (d1[0] == d2[0]) & (d1[1] == d2[1]);
+        }
+        default:
+            return s2.size() == size && memcmp(s1.data(), s2.data(), size * sizeof(UChar)) == 0;
+        }
+    }
+
 
     inline bool operator!=(const UString& s1, const UString& s2)
     {
@@ -298,6 +435,54 @@ namespace JSC {
 
     bool equal(const UString::Rep*, const UString::Rep*);
 
+    inline PassRefPtr<UString::Rep> UString::Rep::create(PassRefPtr<UString::Rep> rep, int offset, int length)
+    {
+        ASSERT(rep);
+        rep->checkConsistency();
+
+        int repOffset = rep->offset;
+
+        PassRefPtr<BaseString> base = rep->baseString();
+
+        ASSERT(-(offset + repOffset) <= base->usedPreCapacity);
+        ASSERT(offset + repOffset + length <= base->usedCapacity);
+
+        // Steal the single reference this Rep was created with.
+        return adoptRef(new Rep(base, repOffset + offset, length));
+    }
+
+    inline UChar* UString::Rep::data() const
+    {
+        const BaseString* base = baseString();
+        return base->buf + base->preCapacity + offset;
+    }
+
+    inline void UString::Rep::setStatic(bool v)
+    {
+        ASSERT(!identifierTable());
+        if (v)
+            m_identifierTableAndFlags.setFlag(StaticFlag);
+        else
+            m_identifierTableAndFlags.clearFlag(StaticFlag);
+    }
+
+    inline void UString::Rep::setBaseString(PassRefPtr<BaseString> base)
+    {
+        ASSERT(base != this);
+        ASSERT(!baseIsSelf());
+        m_baseString = base.releaseRef();
+    }
+
+    inline UString::BaseString* UString::Rep::baseString()
+    {
+        return !baseIsSelf() ? m_baseString : reinterpret_cast<BaseString*>(this) ;
+    }
+
+    inline const UString::BaseString* UString::Rep::baseString() const
+    {
+        return const_cast<Rep*>(this)->baseString();
+    }
+
 #ifdef NDEBUG
     inline void UString::Rep::checkConsistency() const
     {
@@ -305,7 +490,7 @@ namespace JSC {
 #endif
 
     inline UString::UString()
-        : m_rep(&Rep::null)
+        : m_rep(&Rep::null())
     {
     }
 
@@ -328,8 +513,9 @@ namespace JSC {
 
     inline size_t UString::cost() const
     {
-        size_t capacity = (m_rep->baseString->capacity + m_rep->baseString->preCapacity) * sizeof(UChar);
-        size_t reportedCost = m_rep->baseString->reportedCost;
+        BaseString* base = m_rep->baseString();
+        size_t capacity = (base->capacity + base->preCapacity) * sizeof(UChar);
+        size_t reportedCost = base->reportedCost;
         ASSERT(capacity >= reportedCost);
 
         size_t capacityDelta = capacity - reportedCost;
@@ -337,7 +523,7 @@ namespace JSC {
         if (capacityDelta < static_cast<size_t>(minShareSize))
             return 0;
 
-        m_rep->baseString->reportedCost = capacity;
+        base->reportedCost = capacity;
 
         return capacityDelta;
     }
@@ -347,6 +533,7 @@ namespace JSC {
         static unsigned hash(JSC::UString::Rep* key) { return key->computedHash(); }
     };
 
+    void initializeUString();
 } // namespace JSC
 
 namespace WTF {
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.cpp
index 099931b..145a1ce 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wrec/WREC.cpp
@@ -40,12 +40,9 @@ using namespace WTF;
 
 namespace JSC { namespace WREC {
 
-// Patterns longer than this can hang the compiler.
-static const int MaxPatternSize = (1 << 13);
-
 CompiledRegExp Generator::compileRegExp(JSGlobalData* globalData, const UString& pattern, unsigned* numSubpatterns_ptr, const char** error_ptr, RefPtr<ExecutablePool>& pool, bool ignoreCase, bool multiline)
 {
-    if (pattern.size() > MaxPatternSize) {
+    if (pattern.size() > MAX_PATTERN_SIZE) {
         *error_ptr = "regular expression too large";
         return 0;
     }
@@ -80,7 +77,7 @@ CompiledRegExp Generator::compileRegExp(JSGlobalData* globalData, const UString&
     }
 
     *numSubpatterns_ptr = parser.numSubpatterns();
-    pool = globalData->poolForSize(generator.size());
+    pool = globalData->executableAllocator.poolForSize(generator.size());
     return reinterpret_cast<CompiledRegExp>(generator.copyCode(pool.get()));
 }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.cpp
index dd48484..e2e8aba 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.cpp
@@ -40,16 +40,7 @@ namespace JSC { namespace WREC {
 
 void Generator::generateEnter()
 {
-#if PLATFORM(X86_64)
-    // On x86-64 edi and esi are caller preserved, so nothing to do here.
-    // The four arguments have been passed in the registers %rdi, %rsi,
-    // %rdx, %rcx - shuffle these into the expected locations.
-    move(X86::edi, input); // (arg 1) edi -> eax
-    move(X86::ecx, output); // (arg 4) ecx -> edi
-    move(X86::edx, length); // (arg 3) edx -> ecx
-    move(X86::esi, index); // (arg 2) esi -> edx
-
-#else
+#if PLATFORM(X86)
     // On x86 edi & esi are callee preserved registers.
     push(X86::edi);
     push(X86::esi);
@@ -67,24 +58,20 @@ void Generator::generateEnter()
     peek(output, 3);
 #endif
 #endif
-
-#ifndef NDEBUG
-    // ASSERT that the output register is not null.
-    Jump outputNotNull = jnzPtr(output);
-    breakpoint();
-    outputNotNull.link(this);
-#endif
 }
 
 void Generator::generateReturnSuccess()
 {
+    ASSERT(returnRegister != index);
+    ASSERT(returnRegister != output);
+
     // Set return value.
-    pop(X86::eax); // match begin
-    store32(X86::eax, output);
+    pop(returnRegister); // match begin
+    store32(returnRegister, output);
     store32(index, Address(output, 4)); // match end
     
     // Restore callee save registers.
-#if !PLATFORM(X86_64)
+#if PLATFORM(X86)
     pop(X86::esi);
     pop(X86::edi);
 #endif
@@ -100,14 +87,14 @@ void Generator::generateIncrementIndex(Jump* failure)
 {
     peek(index);
     if (failure)
-        *failure = je32(length, index);
+        *failure = branch32(Equal, length, index);
     add32(Imm32(1), index);
     poke(index);
 }
 
 void Generator::generateLoadCharacter(JumpList& failures)
 {
-    failures.append(je32(length, index));
+    failures.append(branch32(Equal, length, index));
     load16(BaseIndex(input, index, TimesTwo), character);
 }
 
@@ -115,14 +102,15 @@ void Generator::generateLoadCharacter(JumpList& failures)
 // were part of the input string.
 void Generator::generateJumpIfNotEndOfInput(Label target)
 {
-    jle32(index, length, target);
+    branch32(LessThanOrEqual, index, length, target);
 }
 
 void Generator::generateReturnFailure()
 {
     pop();
-    move(Imm32(-1), X86::eax);
-#if !PLATFORM(X86_64)
+    move(Imm32(-1), returnRegister);
+
+#if PLATFORM(X86)
     pop(X86::esi);
     pop(X86::edi);
 #endif
@@ -145,7 +133,7 @@ void Generator::generateBackreferenceQuantifier(JumpList& failures, Quantifier::
     GenerateBackreferenceFunctor functor(subpatternId);
 
     load32(Address(output, (2 * subpatternId) * sizeof(int)), character);
-    Jump skipIfEmpty = je32(Address(output, ((2 * subpatternId) + 1) * sizeof(int)), character);
+    Jump skipIfEmpty = branch32(Equal, Address(output, ((2 * subpatternId) + 1) * sizeof(int)), character);
 
     ASSERT(quantifierType == Quantifier::Greedy || quantifierType == Quantifier::NonGreedy);
     if (quantifierType == Quantifier::Greedy)
@@ -175,7 +163,7 @@ void Generator::generateNonGreedyQuantifier(JumpList& failures, GenerateAtomFunc
     Label alternativeFailed(this);
     pop(index);
     if (max != Quantifier::Infinity)
-        je32(repeatCount, Imm32(max), quantifierFailed);
+        branch32(Equal, repeatCount, Imm32(max), quantifierFailed);
 
     // (1) Read an atom.
     if (min)
@@ -187,7 +175,7 @@ void Generator::generateNonGreedyQuantifier(JumpList& failures, GenerateAtomFunc
     
     // (2) Keep reading if we're under the minimum.
     if (min > 1)
-        jl32(repeatCount, Imm32(min), readAtom);
+        branch32(LessThan, repeatCount, Imm32(min), readAtom);
 
     // (3) Test the rest of the alternative.
     if (!min)
@@ -221,7 +209,7 @@ void Generator::generateGreedyQuantifier(JumpList& failures, GenerateAtomFunctor
     else if (max == 1)
         doneReadingAtomsList.append(jump());
     else {
-        jne32(repeatCount, Imm32(max), readAtom);
+        branch32(NotEqual, repeatCount, Imm32(max), readAtom);
         doneReadingAtomsList.append(jump());
     }
 
@@ -238,7 +226,7 @@ void Generator::generateGreedyQuantifier(JumpList& failures, GenerateAtomFunctor
 
     // (2) Verify that we have enough atoms.
     doneReadingAtomsList.link(this);
-    jl32(repeatCount, Imm32(min), quantifierFailed);
+    branch32(LessThan, repeatCount, Imm32(min), quantifierFailed);
 
     // (3) Test the rest of the alternative.
     push(index);
@@ -277,7 +265,7 @@ bool Generator::generatePatternCharacterPair(JumpList& failures, int ch1, int ch
 
     // Optimistically consume 2 characters.
     add32(Imm32(2), index);
-    failures.append(jg32(index, length));
+    failures.append(branch32(GreaterThan, index, length));
 
     // Load the characters we just consumed, offset -2 characters from index.
     load32(BaseIndex(input, index, TimesTwo, -2 * 2), character);
@@ -306,7 +294,7 @@ bool Generator::generatePatternCharacterPair(JumpList& failures, int ch1, int ch
     }
     int pair = ch1 | (ch2 << 16);
 
-    failures.append(jne32(character, Imm32(pair)));
+    failures.append(branch32(NotEqual, character, Imm32(pair)));
     return true;
 }
 
@@ -328,14 +316,14 @@ void Generator::generatePatternCharacter(JumpList& failures, int ch)
             ch |= 32;
         } else if (!isASCII(ch) && ((lower = Unicode::toLower(ch)) != (upper = Unicode::toUpper(ch)))) {
             // handle unicode case sentitive characters - branch to success on upper
-            isUpper = je32(character, Imm32(upper));
+            isUpper = branch32(Equal, character, Imm32(upper));
             hasUpper = true;
             ch = lower;
         }
     }
     
     // checks for ch, or lower case version of ch, if insensitive
-    failures.append(jne32(character, Imm32((unsigned short)ch)));
+    failures.append(branch32(NotEqual, character, Imm32((unsigned short)ch)));
 
     if (m_parser.ignoreCase() && hasUpper) {
         // for unicode case insensitive matches, branch here if upper matches.
@@ -357,33 +345,33 @@ void Generator::generateCharacterClassInvertedRange(JumpList& failures, JumpList
         // check if there are any ranges or matches below lo.  If not, just jl to failure -
         // if there is anything else to check, check that first, if it falls through jmp to failure.
         if ((*matchIndex < matchCount) && (matches[*matchIndex] < lo)) {
-            Jump loOrAbove = jge32(character, Imm32((unsigned short)lo));
+            Jump loOrAbove = branch32(GreaterThanOrEqual, character, Imm32((unsigned short)lo));
             
             // generate code for all ranges before this one
             if (which)
                 generateCharacterClassInvertedRange(failures, matchDest, ranges, which, matchIndex, matches, matchCount);
             
-            do {
-                matchDest.append(je32(character, Imm32((unsigned short)matches[*matchIndex])));
+            while ((*matchIndex < matchCount) && (matches[*matchIndex] < lo)) {
+                matchDest.append(branch32(Equal, character, Imm32((unsigned short)matches[*matchIndex])));
                 ++*matchIndex;
-            } while ((*matchIndex < matchCount) && (matches[*matchIndex] < lo));
+            }
             failures.append(jump());
 
             loOrAbove.link(this);
         } else if (which) {
-            Jump loOrAbove = jge32(character, Imm32((unsigned short)lo));
+            Jump loOrAbove = branch32(GreaterThanOrEqual, character, Imm32((unsigned short)lo));
 
             generateCharacterClassInvertedRange(failures, matchDest, ranges, which, matchIndex, matches, matchCount);
             failures.append(jump());
 
             loOrAbove.link(this);
         } else
-            failures.append(jl32(character, Imm32((unsigned short)lo)));
+            failures.append(branch32(LessThan, character, Imm32((unsigned short)lo)));
 
         while ((*matchIndex < matchCount) && (matches[*matchIndex] <= hi))
             ++*matchIndex;
 
-        matchDest.append(jle32(character, Imm32((unsigned short)hi)));
+        matchDest.append(branch32(LessThanOrEqual, character, Imm32((unsigned short)hi)));
         // fall through to here, the value is above hi.
 
         // shuffle along & loop around if there are any more matches to handle.
@@ -397,12 +385,12 @@ void Generator::generateCharacterClassInverted(JumpList& matchDest, const Charac
 {
     Jump unicodeFail;
     if (charClass.numMatchesUnicode || charClass.numRangesUnicode) {
-        Jump isAscii = jle32(character, Imm32(0x7f));
+        Jump isAscii = branch32(LessThanOrEqual, character, Imm32(0x7f));
     
         if (charClass.numMatchesUnicode) {
             for (unsigned i = 0; i < charClass.numMatchesUnicode; ++i) {
                 UChar ch = charClass.matchesUnicode[i];
-                matchDest.append(je32(character, Imm32(ch)));
+                matchDest.append(branch32(Equal, character, Imm32(ch)));
             }
         }
         
@@ -411,8 +399,8 @@ void Generator::generateCharacterClassInverted(JumpList& matchDest, const Charac
                 UChar lo = charClass.rangesUnicode[i].begin;
                 UChar hi = charClass.rangesUnicode[i].end;
                 
-                Jump below = jl32(character, Imm32(lo));
-                matchDest.append(jle32(character, Imm32(hi)));
+                Jump below = branch32(LessThan, character, Imm32(lo));
+                matchDest.append(branch32(LessThanOrEqual, character, Imm32(hi)));
                 below.link(this);
             }
         }
@@ -426,7 +414,7 @@ void Generator::generateCharacterClassInverted(JumpList& matchDest, const Charac
         JumpList failures; 
         generateCharacterClassInvertedRange(failures, matchDest, charClass.ranges, charClass.numRanges, &matchIndex, charClass.matches, charClass.numMatches);
         while (matchIndex < charClass.numMatches)
-            matchDest.append(je32(character, Imm32((unsigned short)charClass.matches[matchIndex++])));
+            matchDest.append(branch32(Equal, character, Imm32((unsigned short)charClass.matches[matchIndex++])));
 
         failures.link(this);
     } else if (charClass.numMatches) {
@@ -443,13 +431,13 @@ void Generator::generateCharacterClassInverted(JumpList& matchDest, const Charac
                 if (isASCIIUpper(ch))
                     continue;
             }
-            matchDest.append(je32(character, Imm32((unsigned short)ch)));
+            matchDest.append(branch32(Equal, character, Imm32((unsigned short)ch)));
         }
 
         if (unsigned countAZaz = matchesAZaz.size()) {
             or32(Imm32(32), character);
             for (unsigned i = 0; i < countAZaz; ++i)
-                matchDest.append(je32(character, Imm32(matchesAZaz[i])));
+                matchDest.append(branch32(Equal, character, Imm32(matchesAZaz[i])));
         }
     }
 
@@ -533,7 +521,7 @@ void Generator::generateAssertionBOL(JumpList& failures)
         JumpList previousIsNewline;
 
         // begin of input == success
-        previousIsNewline.append(je32(index, Imm32(0)));
+        previousIsNewline.append(branch32(Equal, index, Imm32(0)));
 
         // now check prev char against newline characters.
         load16(BaseIndex(input, index, TimesTwo, -2), character);
@@ -543,7 +531,7 @@ void Generator::generateAssertionBOL(JumpList& failures)
 
         previousIsNewline.link(this);
     } else
-        failures.append(jne32(index, Imm32(0)));
+        failures.append(branch32(NotEqual, index, Imm32(0)));
 }
 
 void Generator::generateAssertionEOL(JumpList& failures)
@@ -556,7 +544,7 @@ void Generator::generateAssertionEOL(JumpList& failures)
         failures.append(jump());
         nextIsNewline.link(this);
     } else {
-        failures.append(jne32(length, index));
+        failures.append(branch32(NotEqual, length, index));
     }
 }
 
@@ -568,7 +556,7 @@ void Generator::generateAssertionWordBoundary(JumpList& failures, bool invert)
     // (1) Check if the previous value was a word char
 
     // (1.1) check for begin of input
-    Jump atBegin = je32(index, Imm32(0));
+    Jump atBegin = branch32(Equal, index, Imm32(0));
     // (1.2) load the last char, and chck if is word character
     load16(BaseIndex(input, index, TimesTwo, -2), character);
     JumpList previousIsWord;
@@ -625,14 +613,14 @@ void Generator::generateBackreference(JumpList& failures, unsigned subpatternId)
     skipIncrement.link(this);
 
     // check if we're at the end of backref (if we are, success!)
-    Jump endOfBackRef = je32(Address(output, ((2 * subpatternId) + 1) * sizeof(int)), repeatCount);
+    Jump endOfBackRef = branch32(Equal, Address(output, ((2 * subpatternId) + 1) * sizeof(int)), repeatCount);
 
     load16(BaseIndex(input, repeatCount, MacroAssembler::TimesTwo), character);
 
     // check if we've run out of input (this would be a can o'fail)
-    Jump endOfInput = je32(length, index);
+    Jump endOfInput = branch32(Equal, length, index);
 
-    je16(character, BaseIndex(input, index, TimesTwo), topOfLoop);
+    branch16(Equal, BaseIndex(input, index, TimesTwo), character, topOfLoop);
 
     endOfInput.link(this);
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.h b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.h
index af4101a..8562cac 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECGenerator.h
@@ -62,13 +62,29 @@ namespace JSC {
         {
         }
 
+#if PLATFORM(X86)
         static const RegisterID input = X86::eax;
-        static const RegisterID length = X86::ecx;
         static const RegisterID index = X86::edx;
-        static const RegisterID character = X86::esi;
+        static const RegisterID length = X86::ecx;
         static const RegisterID output = X86::edi;
+
+        static const RegisterID character = X86::esi;
         static const RegisterID repeatCount = X86::ebx; // How many times the current atom repeats in the current match.
-        
+
+        static const RegisterID returnRegister = X86::eax;
+#endif
+#if PLATFORM(X86_64)
+        static const RegisterID input = X86::edi;
+        static const RegisterID index = X86::esi;
+        static const RegisterID length = X86::edx;
+        static const RegisterID output = X86::ecx;
+
+        static const RegisterID character = X86::eax;
+        static const RegisterID repeatCount = X86::ebx; // How many times the current atom repeats in the current match.
+
+        static const RegisterID returnRegister = X86::eax;
+#endif
+
         void generateEnter();
         void generateSaveIndex();
         void generateIncrementIndex(Jump* failure = 0);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.cpp b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.cpp
index be42a34..1709bf9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wrec/WRECParser.cpp
@@ -233,38 +233,42 @@ bool Parser::parseParentheses(JumpList& failures)
     // unsupported parentheses, we fall back on PCRE.
 
     switch (type) {
-        case Generator::Assertion:
+        case Generator::Assertion: {
             m_generator.generateParenthesesAssertion(failures);
 
             if (consume() != ')') {
                 setError(ParenthesesUnmatched);
                 return false;
             }
-            
-            // A quantifier after an assertion is meaningless, since assertions
-            // don't move index forward. So, we discard it.
-            consumeQuantifier();
-            break;
 
-        case Generator::InvertedAssertion:
+            Quantifier quantifier = consumeQuantifier();
+            if (quantifier.type != Quantifier::None && quantifier.min == 0) {
+                setError(ParenthesesNotSupported);
+                return false;
+            }
+
+            return true;
+        }
+        case Generator::InvertedAssertion: {
             m_generator.generateParenthesesInvertedAssertion(failures);
 
             if (consume() != ')') {
                 setError(ParenthesesUnmatched);
                 return false;
             }
-            
-            // A quantifier after an assertion is meaningless, since assertions
-            // don't move index forward. So, we discard it.
-            consumeQuantifier();
-            break;
 
+            Quantifier quantifier = consumeQuantifier();
+            if (quantifier.type != Quantifier::None && quantifier.min == 0) {
+                setError(ParenthesesNotSupported);
+                return false;
+            }
+
+            return true;
+        }
         default:
             setError(ParenthesesNotSupported);
             return false;
     }
-
-    return true;
 }
 
 bool Parser::parseCharacterClass(JumpList& failures)
@@ -457,7 +461,9 @@ Escape Parser::consumeEscape(bool inCharacterClass)
         consume();
         
         int control = consume();
-        if (!isASCIIAlpha(control)) {
+        // To match Firefox, inside a character class, we also accept numbers
+        // and '_' as control characters.
+        if ((!inCharacterClass && !isASCIIAlpha(control)) || (!isASCIIAlphanumeric(control) && control != '_')) {
             state.restore();
             return PatternCharacterEscape('\\');
         }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ASCIICType.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ASCIICType.h
index 0c2ca70..0c3c29f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ASCIICType.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ASCIICType.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -149,4 +149,18 @@ namespace WTF {
     inline bool isASCIIPrintable(int c) { return c >= ' ' && c <= '~'; }
 }
 
+using WTF::isASCII;
+using WTF::isASCIIAlpha;
+using WTF::isASCIIAlphanumeric;
+using WTF::isASCIIDigit;
+using WTF::isASCIIHexDigit;
+using WTF::isASCIILower;
+using WTF::isASCIIOctalDigit;
+using WTF::isASCIIPrintable;
+using WTF::isASCIISpace;
+using WTF::isASCIIUpper;
+using WTF::toASCIIHexValue;
+using WTF::toASCIILower;
+using WTF::toASCIIUpper;
+
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/AVLTree.h b/src/3rdparty/webkit/JavaScriptCore/wtf/AVLTree.h
index 18db8ff..d7470e7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/AVLTree.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/AVLTree.h
@@ -764,7 +764,7 @@ AVLTree<Abstractor, maxDepth, BSet>::remove(key k)
 
     handle h = abs.root;
     handle parent = null(), child;
-    int cmp, cmp_shortened_sub_with_path;
+    int cmp, cmp_shortened_sub_with_path = 0;
 
     for (;;) {
         if (h == null())
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/AlwaysInline.h b/src/3rdparty/webkit/JavaScriptCore/wtf/AlwaysInline.h
index d39b2b9..64fdd99 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/AlwaysInline.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/AlwaysInline.h
@@ -22,7 +22,7 @@
 
 #ifndef ALWAYS_INLINE
 #if COMPILER(GCC) && defined(NDEBUG) && !COMPILER(MINGW)
-#define ALWAYS_INLINE inline __attribute__ ((__always_inline__))
+#define ALWAYS_INLINE inline __attribute__((__always_inline__))
 #elif COMPILER(MSVC) && defined(NDEBUG)
 #define ALWAYS_INLINE __forceinline
 #else
@@ -32,7 +32,7 @@
 
 #ifndef NEVER_INLINE
 #if COMPILER(GCC)
-#define NEVER_INLINE __attribute__ ((__noinline__))
+#define NEVER_INLINE __attribute__((__noinline__))
 #else
 #define NEVER_INLINE
 #endif
@@ -53,3 +53,11 @@
 #define LIKELY(x) (x)
 #endif
 #endif
+
+#ifndef NO_RETURN
+#if COMPILER(GCC)
+#define NO_RETURN __attribute((__noreturn__))
+#else
+#define NO_RETURN
+#endif
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.cpp
index 6e04fe1..098186e 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.cpp
@@ -34,7 +34,7 @@
 #include <CoreFoundation/CFString.h>
 #endif
 
-#if COMPILER(MSVC) && !PLATFORM(WIN_CE)
+#if COMPILER(MSVC) && !PLATFORM(WINCE)
 #ifndef WINVER
 #define WINVER 0x0500
 #endif
@@ -54,7 +54,7 @@ static void vprintf_stderr_common(const char* format, va_list args)
     if (strstr(format, "%@")) {
         CFStringRef cfFormat = CFStringCreateWithCString(NULL, format, kCFStringEncodingUTF8);
         CFStringRef str = CFStringCreateWithFormatAndArguments(NULL, NULL, cfFormat, args);
-        
+
         int length = CFStringGetMaximumSizeForEncoding(CFStringGetLength(str), kCFStringEncodingUTF8);
         char* buffer = (char*)malloc(length + 1);
 
@@ -66,7 +66,7 @@ static void vprintf_stderr_common(const char* format, va_list args)
         CFRelease(str);
         CFRelease(cfFormat);
     } else
-#elif COMPILER(MSVC) && !PLATFORM(WIN_CE)
+#elif COMPILER(MSVC) && !PLATFORM(WINCE)
     if (IsDebuggerPresent()) {
         size_t size = 1024;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h
index c17e501..ad66d06 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Assertions.h
@@ -128,7 +128,7 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
 
 /* ASSERT, ASSERT_WITH_MESSAGE, ASSERT_NOT_REACHED */
 
-#if PLATFORM(WIN_CE)
+#if PLATFORM(WINCE) && !PLATFORM(TORCHMOBILE)
 /* FIXME: We include this here only to avoid a conflict with the ASSERT macro. */
 #include <windows.h>
 #undef min
@@ -194,7 +194,7 @@ while (0)
 
 /* COMPILE_ASSERT */
 #ifndef COMPILE_ASSERT
-#define COMPILE_ASSERT(exp, name) typedef int dummy##name [(exp) ? 1 : -1];
+#define COMPILE_ASSERT(exp, name) typedef int dummy##name [(exp) ? 1 : -1]
 #endif
 
 /* FATAL */
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ByteArray.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ByteArray.cpp
index 4b88fd6..526f147 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ByteArray.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ByteArray.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 #include "ByteArray.h"
 
-namespace JSC {
+namespace WTF {
 
 PassRefPtr<ByteArray> ByteArray::create(size_t size)
 {
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/ByteArray.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ByteArray.h
index 7448942..33f0877 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/ByteArray.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ByteArray.h
@@ -29,8 +29,8 @@
 #include "wtf/PassRefPtr.h"
 #include "wtf/RefCounted.h"
 
-namespace JSC {
-    class ByteArray : public RefCounted<ByteArray> {
+namespace WTF {
+    class ByteArray : public RefCountedBase {
     public:
         unsigned length() const { return m_size; }
 
@@ -55,6 +55,16 @@ namespace JSC {
 
         unsigned char* data() { return m_data; }
 
+        void deref()
+        {
+            if (derefBase()) {
+                // We allocated with new unsigned char[] in create(),
+                // and then used placement new to construct the object.
+                this->~ByteArray();
+                delete[] reinterpret_cast<unsigned char*>(this);
+            }
+        }
+
         static PassRefPtr<ByteArray> create(size_t size);
 
     private:
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/CONTRIBUTORS.pthreads-win32 b/src/3rdparty/webkit/JavaScriptCore/wtf/CONTRIBUTORS.pthreads-win32
new file mode 100644
index 0000000..7de0f26
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/CONTRIBUTORS.pthreads-win32
@@ -0,0 +1,137 @@
+This is a copy of CONTRIBUTORS file for the Pthreads-win32 library, downloaded
+from http://sourceware.org/cgi-bin/cvsweb.cgi/~checkout~/pthreads/CONTRIBUTORS?rev=1.32&cvsroot=pthreads-win32
+
+Included here to compliment the Pthreads-win32 license header in wtf/ThreadingWin.cpp file.
+WebKit is using derived sources of ThreadCondition code from Pthreads-win32.
+
+-------------------------------------------------------------------------------
+
+Contributors (in approximate order of appearance)
+
+[See also the ChangeLog file where individuals are
+attributed in log entries. Likewise in the FAQ file.]
+
+Ben Elliston		bje at cygnus dot com
+					Initiated the project;
+					setup the project infrastructure (CVS, web page, etc.);
+					early prototype routines.
+Ross Johnson		rpj at callisto dot canberra dot edu dot au
+					early prototype routines;
+					ongoing project coordination/maintenance;
+					implementation of spin locks and barriers;
+					various enhancements;
+					bug fixes;
+					documentation;
+					testsuite.
+Robert Colquhoun	rjc at trump dot net dot au
+					Early bug fixes.
+John E. Bossom		John dot Bossom at cognos dot com
+					Contributed substantial original working implementation;
+					bug fixes;
+					ongoing guidance and standards interpretation.
+Anders Norlander	anorland at hem2 dot passagen dot se
+					Early enhancements and runtime checking for supported
+					Win32 routines.
+Tor Lillqvist		tml at iki dot fi
+					General enhancements;
+					early bug fixes to condition variables.
+Scott Lightner		scott at curriculum dot com
+					Bug fix.
+Kevin Ruland		Kevin dot Ruland at anheuser-busch dot com
+					Various bug fixes.
+Mike Russo		miker at eai dot com
+					Bug fix.
+Mark E. Armstrong	avail at pacbell dot net
+					Bug fixes.
+Lorin Hochstein 	lmh at xiphos dot ca
+					general bug fixes; bug fixes to condition variables.
+Peter Slacik		Peter dot Slacik at tatramed dot sk
+					Bug fixes.
+Mumit Khan		khan at xraylith dot wisc dot edu
+					Fixes to work with Mingw32.
+Milan Gardian		mg at tatramed dot sk
+					Bug fixes and reports/analyses of obscure problems.
+Aurelio Medina		aureliom at crt dot com
+					First implementation of read-write locks.
+Graham Dumpleton	Graham dot Dumpleton at ra dot pad dot otc dot telstra dot com dot au
+					Bug fix in condition variables.
+Tristan Savatier	tristan at mpegtv dot com
+					WinCE port.
+Erik Hensema		erik at hensema dot xs4all dot nl
+					Bug fixes.
+Rich Peters		rpeters at micro-magic dot com
+Todd Owen		towen at lucidcalm dot dropbear dot id dot au
+					Bug fixes to dll loading.
+Jason Nye		jnye at nbnet dot nb dot ca
+					Implementation of async cancelation.
+Fred Forester		fforest at eticomm dot net
+Kevin D. Clark		kclark at cabletron dot com
+David Baggett		dmb at itasoftware dot com
+					Bug fixes.
+Paul Redondo		paul at matchvision dot com
+Scott McCaskill 	scott at 3dfx dot com
+					Bug fixes.
+Jef Gearhart		jgearhart at tpssys dot com
+					Bug fix.
+Arthur Kantor		akantor at bexusa dot com
+					Mutex enhancements.
+Steven Reddie		smr at essemer dot com dot au
+					Bug fix.
+Alexander Terekhov	TEREKHOV at de dot ibm dot com
+					Re-implemented and improved read-write locks;
+					(with Louis Thomas) re-implemented and improved
+					condition variables;
+					enhancements to semaphores;
+					enhancements to mutexes;
+					new mutex implementation in 'futex' style;
+					suggested a robust implementation of pthread_once
+					similar to that implemented by V.Kliathcko;
+					system clock change handling re CV timeouts;
+					bug fixes.
+Thomas Pfaff		tpfaff at gmx dot net
+					Changes to make C version usable with C++ applications;
+					re-implemented mutex routines to avoid Win32 mutexes
+					and TryEnterCriticalSection;
+					procedure to fix Mingw32 thread-safety issues.
+Franco Bez		franco dot bez at gmx dot de
+					procedure to fix Mingw32 thread-safety issues.
+Louis Thomas		lthomas at arbitrade dot com
+					(with Alexander Terekhov) re-implemented and improved
+					condition variables.
+David Korn		dgk at research dot att dot com
+					Ported to UWIN.
+Phil Frisbie, Jr.	phil at hawksoft dot com
+					Bug fix.
+Ralf Brese		Ralf dot Brese at pdb4 dot siemens dot de
+					Bug fix.
+prionx at juno dot com 	prionx at juno dot com
+					Bug fixes.
+Max Woodbury		mtew at cds dot duke dot edu
+					POSIX versioning conditionals;
+					reduced namespace pollution;
+					idea to separate routines to reduce statically
+					linked image sizes.
+Rob Fanner		rfanner at stonethree dot com
+					Bug fix.
+Michael Johnson 	michaelj at maine dot rr dot com
+					Bug fix.
+Nicolas Barry		boozai at yahoo dot com
+					Bug fixes.
+Piet van Bruggen	pietvb at newbridges dot nl
+					Bug fix.
+Makoto Kato		raven at oldskool dot jp
+					AMD64 port.
+Panagiotis E. Hadjidoukas	peh at hpclab dot ceid dot upatras dot gr
+					Contributed the QueueUserAPCEx package which
+					makes preemptive async cancelation possible.
+Will Bryant		will dot bryant at ecosm dot com
+					Borland compiler patch and makefile.
+Anuj Goyal		anuj dot goyal at gmail dot com
+					Port to Digital Mars compiler.
+Gottlob Frege		gottlobfrege at  gmail dot com
+					re-implemented pthread_once (version 2)
+					(pthread_once cancellation added by rpj).
+Vladimir Kliatchko	vladimir at kliatchko dot com
+					reimplemented pthread_once with the same form
+					as described by A.Terekhov (later version 2);
+					implementation of MCS (Mellor-Crummey/Scott) locks.
\ No newline at end of file
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/CrossThreadRefCounted.h b/src/3rdparty/webkit/JavaScriptCore/wtf/CrossThreadRefCounted.h
new file mode 100644
index 0000000..281dfa6
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/CrossThreadRefCounted.h
@@ -0,0 +1,169 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CrossThreadRefCounted_h
+#define CrossThreadRefCounted_h
+
+#include <wtf/Noncopyable.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Threading.h>
+
+namespace WTF {
+
+    // Used to allowing sharing data across classes and threads (like ThreadedSafeShared).
+    //
+    // Why not just use ThreadSafeShared?
+    // ThreadSafeShared can have a significant perf impact when used in low level classes
+    // (like UString) that get ref/deref'ed a lot. This class has the benefit of doing fast ref
+    // counts like RefPtr whenever possible, but it has the downside that you need to copy it
+    // to use it on another thread.
+    //
+    // Is this class threadsafe?
+    // While each instance of the class is not threadsafe, the copied instance is threadsafe
+    // with respect to the original and any other copies.  The underlying m_data is jointly
+    // owned by the original instance and all copies.
+    template<class T>
+    class CrossThreadRefCounted : Noncopyable {
+    public:
+        static PassRefPtr<CrossThreadRefCounted<T> > create(T* data)
+        {
+            return adoptRef(new CrossThreadRefCounted<T>(data, 0));
+        }
+
+        // Used to make an instance that can be used on another thread.
+        PassRefPtr<CrossThreadRefCounted<T> > crossThreadCopy();
+
+        void ref();
+        void deref();
+        T* release();
+
+        bool isShared() const
+        {
+            return !m_refCounter.hasOneRef() || (m_threadSafeRefCounter && !m_threadSafeRefCounter->hasOneRef());
+        }
+
+#ifndef NDEBUG
+        bool mayBePassedToAnotherThread() const { ASSERT(!m_threadId); return m_refCounter.hasOneRef(); }
+#endif
+
+    private:
+        CrossThreadRefCounted(T* data, ThreadSafeSharedBase* threadedCounter)
+            : m_threadSafeRefCounter(threadedCounter)
+            , m_data(data)
+#ifndef NDEBUG
+            , m_threadId(0)
+#endif
+        {
+        }
+
+        ~CrossThreadRefCounted()
+        {
+            if (!m_threadSafeRefCounter)
+                delete m_data;
+        }
+
+        void threadSafeDeref();
+
+        RefCountedBase m_refCounter;
+        ThreadSafeSharedBase* m_threadSafeRefCounter;
+        T* m_data;
+#ifndef NDEBUG
+        ThreadIdentifier m_threadId;
+#endif
+    };
+
+    template<class T>
+    void CrossThreadRefCounted<T>::ref()
+    {
+        ASSERT(!m_threadId || m_threadId == currentThread());
+        m_refCounter.ref();
+#ifndef NDEBUG
+        // Store the threadId as soon as the ref count gets to 2.
+        // The class gets created with a ref count of 1 and then passed
+        // to another thread where to ref count get increased.  This
+        // is a heuristic but it seems to always work and has helped
+        // find some bugs.
+        if (!m_threadId && m_refCounter.refCount() == 2)
+            m_threadId = currentThread();
+#endif
+    }
+
+    template<class T>
+    void CrossThreadRefCounted<T>::deref()
+    {
+        ASSERT(!m_threadId || m_threadId == currentThread());
+        if (m_refCounter.derefBase()) {
+            threadSafeDeref();
+            delete this;
+        } else {
+#ifndef NDEBUG
+            // Clear the threadId when the ref goes to 1 because it
+            // is safe to be passed to another thread at this point.
+            if (m_threadId && m_refCounter.refCount() == 1)
+                m_threadId = 0;
+#endif
+        }
+    }
+
+    template<class T>
+    T* CrossThreadRefCounted<T>::release()
+    {
+        ASSERT(!isShared());
+
+        T* data = m_data;
+        m_data = 0;
+        return data;
+    }
+
+    template<class T>
+    PassRefPtr<CrossThreadRefCounted<T> > CrossThreadRefCounted<T>::crossThreadCopy()
+    {
+        if (m_threadSafeRefCounter)
+            m_threadSafeRefCounter->ref();
+        else
+            m_threadSafeRefCounter = new ThreadSafeSharedBase(2);
+        return adoptRef(new CrossThreadRefCounted<T>(m_data, m_threadSafeRefCounter));
+    }
+
+
+    template<class T>
+    void CrossThreadRefCounted<T>::threadSafeDeref()
+    {
+        if (m_threadSafeRefCounter && m_threadSafeRefCounter->derefBase()) {
+            delete m_threadSafeRefCounter;
+            m_threadSafeRefCounter = 0;
+        }
+    }
+} // namespace WTF
+
+using WTF::CrossThreadRefCounted;
+
+#endif // CrossThreadRefCounted_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp
new file mode 100644
index 0000000..73c2c5c
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.cpp
@@ -0,0 +1,232 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2008 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "CurrentTime.h"
+
+#if PLATFORM(WIN_OS)
+// Windows is first since we want to use hires timers, despite PLATFORM(CF)
+// being defined.
+// If defined, WIN32_LEAN_AND_MEAN disables timeBeginPeriod/timeEndPeriod.
+#undef WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#include <math.h>
+#include <stdint.h>
+#if HAVE(SYS_TIMEB_H)
+#include <sys/timeb.h>
+#endif
+#if !PLATFORM(WINCE)
+#include <sys/types.h>
+#endif
+#include <time.h>
+#elif PLATFORM(CF)
+#include <CoreFoundation/CFDate.h>
+#elif PLATFORM(GTK)
+#include <glib.h>
+#elif PLATFORM(WX)
+#include <wx/datetime.h>
+#else // Posix systems relying on the gettimeofday()
+#include <sys/time.h>
+#endif
+
+namespace WTF {
+
+const double msPerSecond = 1000.0;
+
+#if PLATFORM(WIN_OS)
+
+static LARGE_INTEGER qpcFrequency;
+static bool syncedTime;
+
+static double highResUpTime()
+{
+    // We use QPC, but only after sanity checking its result, due to bugs:
+    // http://support.microsoft.com/kb/274323
+    // http://support.microsoft.com/kb/895980
+    // http://msdn.microsoft.com/en-us/library/ms644904.aspx ("...you can get different results on different processors due to bugs in the basic input/output system (BIOS) or the hardware abstraction layer (HAL)."
+
+    static LARGE_INTEGER qpcLast;
+    static DWORD tickCountLast;
+    static bool inited;
+
+    LARGE_INTEGER qpc;
+    QueryPerformanceCounter(&qpc);
+    DWORD tickCount = GetTickCount();
+
+    if (inited) {
+        __int64 qpcElapsed = ((qpc.QuadPart - qpcLast.QuadPart) * 1000) / qpcFrequency.QuadPart;
+        __int64 tickCountElapsed;
+        if (tickCount >= tickCountLast)
+            tickCountElapsed = (tickCount - tickCountLast);
+        else {
+#if COMPILER(MINGW)
+            __int64 tickCountLarge = tickCount + 0x100000000ULL;
+#else
+            __int64 tickCountLarge = tickCount + 0x100000000I64;
+#endif
+            tickCountElapsed = tickCountLarge - tickCountLast;
+        }
+
+        // force a re-sync if QueryPerformanceCounter differs from GetTickCount by more than 500ms.
+        // (500ms value is from http://support.microsoft.com/kb/274323)
+        __int64 diff = tickCountElapsed - qpcElapsed;
+        if (diff > 500 || diff < -500)
+            syncedTime = false;
+    } else
+        inited = true;
+
+    qpcLast = qpc;
+    tickCountLast = tickCount;
+
+    return (1000.0 * qpc.QuadPart) / static_cast<double>(qpcFrequency.QuadPart);
+}
+
+static double lowResUTCTime()
+{
+#if PLATFORM(WINCE)
+    SYSTEMTIME systemTime;
+    GetSystemTime(&systemTime);
+    struct tm tmtime;
+    tmtime.tm_year = systemTime.wYear - 1900;
+    tmtime.tm_mon = systemTime.wMonth - 1;
+    tmtime.tm_mday = systemTime.wDay;
+    tmtime.tm_wday = systemTime.wDayOfWeek;
+    tmtime.tm_hour = systemTime.wHour;
+    tmtime.tm_min = systemTime.wMinute;
+    tmtime.tm_sec = systemTime.wSecond;
+    time_t timet = mktime(&tmtime);
+    return timet * msPerSecond + systemTime.wMilliseconds;
+#else
+    struct _timeb timebuffer;
+    _ftime(&timebuffer);
+    return timebuffer.time * msPerSecond + timebuffer.millitm;
+#endif
+}
+
+static bool qpcAvailable()
+{
+    static bool available;
+    static bool checked;
+
+    if (checked)
+        return available;
+
+    available = QueryPerformanceFrequency(&qpcFrequency);
+    checked = true;
+    return available;
+}
+
+double currentTime()
+{
+    // Use a combination of ftime and QueryPerformanceCounter.
+    // ftime returns the information we want, but doesn't have sufficient resolution.
+    // QueryPerformanceCounter has high resolution, but is only usable to measure time intervals.
+    // To combine them, we call ftime and QueryPerformanceCounter initially. Later calls will use QueryPerformanceCounter
+    // by itself, adding the delta to the saved ftime.  We periodically re-sync to correct for drift.
+    static bool started;
+    static double syncLowResUTCTime;
+    static double syncHighResUpTime;
+    static double lastUTCTime;
+
+    double lowResTime = lowResUTCTime();
+
+    if (!qpcAvailable())
+        return lowResTime / 1000.0;
+
+    double highResTime = highResUpTime();
+
+    if (!syncedTime) {
+        timeBeginPeriod(1); // increase time resolution around low-res time getter
+        syncLowResUTCTime = lowResTime = lowResUTCTime();
+        timeEndPeriod(1); // restore time resolution
+        syncHighResUpTime = highResTime;
+        syncedTime = true;
+    }
+
+    double highResElapsed = highResTime - syncHighResUpTime;
+    double utc = syncLowResUTCTime + highResElapsed;
+
+    // force a clock re-sync if we've drifted
+    double lowResElapsed = lowResTime - syncLowResUTCTime;
+    const double maximumAllowedDriftMsec = 15.625 * 2.0; // 2x the typical low-res accuracy
+    if (fabs(highResElapsed - lowResElapsed) > maximumAllowedDriftMsec)
+        syncedTime = false;
+
+    // make sure time doesn't run backwards (only correct if difference is < 2 seconds, since DST or clock changes could occur)
+    const double backwardTimeLimit = 2000.0;
+    if (utc < lastUTCTime && (lastUTCTime - utc) < backwardTimeLimit)
+        return lastUTCTime / 1000.0;
+    lastUTCTime = utc;
+    return utc / 1000.0;
+}
+
+#elif PLATFORM(CF)
+
+double currentTime()
+{
+    return CFAbsoluteTimeGetCurrent() + kCFAbsoluteTimeIntervalSince1970;
+}
+
+#elif PLATFORM(GTK)
+
+// Note: GTK on Windows will pick up the PLATFORM(WIN) implementation above which provides
+// better accuracy compared with Windows implementation of g_get_current_time:
+// (http://www.google.com/codesearch/p?hl=en#HHnNRjks1t0/glib-2.5.2/glib/gmain.c&q=g_get_current_time).
+// Non-Windows GTK builds could use gettimeofday() directly but for the sake of consistency lets use GTK function.
+double currentTime()
+{
+    GTimeVal now;
+    g_get_current_time(&now);
+    return static_cast<double>(now.tv_sec) + static_cast<double>(now.tv_usec / 1000000.0);
+}
+
+#elif PLATFORM(WX)
+
+double currentTime()
+{
+    wxDateTime now = wxDateTime::UNow();
+    return (double)now.GetTicks() + (double)(now.GetMillisecond() / 1000.0);
+}
+
+#else // Other Posix systems rely on the gettimeofday().
+
+double currentTime()
+{
+    struct timeval now;
+    struct timezone zone;
+
+    gettimeofday(&now, &zone);
+    return static_cast<double>(now.tv_sec) + (double)(now.tv_usec / 1000000.0);
+}
+
+#endif
+
+} // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.h b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.h
new file mode 100644
index 0000000..31f1ec8
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/CurrentTime.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2008 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CurrentTime_h
+#define CurrentTime_h
+
+namespace WTF {
+
+    // Returns the current system (UTC) time in seconds, starting January 1, 1970.
+    // Precision varies depending on a platform but usually is as good or better 
+    // than a millisecond.
+    double currentTime();
+
+} // namespace WTF
+
+using WTF::currentTime;
+
+#endif // CurrentTime_h
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateMath.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.cpp
index 9cfe256..47c9d44 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateMath.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.cpp
@@ -1,7 +1,8 @@
 /*
  * Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
  * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
- * 
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
  * The Original Code is Mozilla Communicator client code, released
  * March 31, 1998.
  *
@@ -42,14 +43,18 @@
 #include "config.h"
 #include "DateMath.h"
 
-#include "JSNumberCell.h"
-#include <math.h>
+#include "Assertions.h"
+#include "ASCIICType.h"
+#include "CurrentTime.h"
+#include "MathExtras.h"
+#include "StringExtras.h"
+
+#include <algorithm>
+#include <limits.h>
+#include <limits>
 #include <stdint.h>
 #include <time.h>
-#include <wtf/ASCIICType.h>
-#include <wtf/Assertions.h>
-#include <wtf/MathExtras.h>
-#include <wtf/StringExtras.h>
+
 
 #if HAVE(ERRNO_H)
 #include <errno.h>
@@ -67,13 +72,9 @@
 #include <sys/timeb.h>
 #endif
 
-#if HAVE(STRINGS_H)
-#include <strings.h>
-#endif
+#define NaN std::numeric_limits<double>::quiet_NaN()
 
-using namespace WTF;
-
-namespace JSC {
+namespace WTF {
 
 /* Constants */
 
@@ -291,144 +292,15 @@ double getCurrentUTCTime()
     return floor(getCurrentUTCTimeWithMicroseconds());
 }
 
-#if PLATFORM(WIN_OS)
-
-static LARGE_INTEGER qpcFrequency;
-static bool syncedTime;
-
-static double highResUpTime()
-{
-    // We use QPC, but only after sanity checking its result, due to bugs:
-    // http://support.microsoft.com/kb/274323
-    // http://support.microsoft.com/kb/895980
-    // http://msdn.microsoft.com/en-us/library/ms644904.aspx ("...you can get different results on different processors due to bugs in the basic input/output system (BIOS) or the hardware abstraction layer (HAL)."
-
-    static LARGE_INTEGER qpcLast;
-    static DWORD tickCountLast;
-    static bool inited;
-
-    LARGE_INTEGER qpc;
-    QueryPerformanceCounter(&qpc);
-    DWORD tickCount = GetTickCount();
-
-    if (inited) {
-        __int64 qpcElapsed = ((qpc.QuadPart - qpcLast.QuadPart) * 1000) / qpcFrequency.QuadPart;
-        __int64 tickCountElapsed;
-        if (tickCount >= tickCountLast)
-            tickCountElapsed = (tickCount - tickCountLast);
-        else {
-#if COMPILER(MINGW)
-            __int64 tickCountLarge = tickCount + 0x100000000ULL;
-#else
-            __int64 tickCountLarge = tickCount + 0x100000000I64;
-#endif
-            tickCountElapsed = tickCountLarge - tickCountLast;
-        }
-
-        // force a re-sync if QueryPerformanceCounter differs from GetTickCount by more than 500ms.
-        // (500ms value is from http://support.microsoft.com/kb/274323)
-        __int64 diff = tickCountElapsed - qpcElapsed;
-        if (diff > 500 || diff < -500)
-            syncedTime = false;
-    } else
-        inited = true;
-
-    qpcLast = qpc;
-    tickCountLast = tickCount;
-
-    return (1000.0 * qpc.QuadPart) / static_cast<double>(qpcFrequency.QuadPart);;
-}
-
-static double lowResUTCTime()
-{
-#if PLATFORM(WIN_CE)
-    SYSTEMTIME systemTime;
-    GetSystemTime(&systemTime);
-    struct tm tmtime;
-    tmtime.tm_year = systemTime.wYear - 1900;
-    tmtime.tm_mon = systemTime.wMonth - 1;
-    tmtime.tm_mday = systemTime.wDay;
-    tmtime.tm_wday = systemTime.wDayOfWeek;
-    tmtime.tm_hour = systemTime.wHour;
-    tmtime.tm_min = systemTime.wMinute;
-    tmtime.tm_sec = systemTime.wSecond;
-    time_t timet = mktime(&tmtime);
-    return timet * msPerSecond + systemTime.wMilliseconds;
-#else
-    struct _timeb timebuffer;
-    _ftime(&timebuffer);
-    return timebuffer.time * msPerSecond + timebuffer.millitm;
-#endif
-}
-
-static bool qpcAvailable()
-{
-    static bool available;
-    static bool checked;
-
-    if (checked)
-        return available;
-
-    available = QueryPerformanceFrequency(&qpcFrequency);
-    checked = true;
-    return available;
-}
-
-#endif
-
+// Returns current time in milliseconds since 1 Jan 1970.
 double getCurrentUTCTimeWithMicroseconds()
 {
-#if PLATFORM(WIN_OS)
-    // Use a combination of ftime and QueryPerformanceCounter.
-    // ftime returns the information we want, but doesn't have sufficient resolution.
-    // QueryPerformanceCounter has high resolution, but is only usable to measure time intervals.
-    // To combine them, we call ftime and QueryPerformanceCounter initially. Later calls will use QueryPerformanceCounter
-    // by itself, adding the delta to the saved ftime.  We periodically re-sync to correct for drift.
-    static bool started;
-    static double syncLowResUTCTime;
-    static double syncHighResUpTime;
-    static double lastUTCTime;
-
-    double lowResTime = lowResUTCTime();
-
-    if (!qpcAvailable())
-        return lowResTime;
-
-    double highResTime = highResUpTime();
-
-    if (!syncedTime) {
-        timeBeginPeriod(1); // increase time resolution around low-res time getter
-        syncLowResUTCTime = lowResTime = lowResUTCTime();
-        timeEndPeriod(1); // restore time resolution
-        syncHighResUpTime = highResTime;
-        syncedTime = true;
-    }
-
-    double highResElapsed = highResTime - syncHighResUpTime;
-    double utc = syncLowResUTCTime + highResElapsed;
-
-    // force a clock re-sync if we've drifted
-    double lowResElapsed = lowResTime - syncLowResUTCTime;
-    const double maximumAllowedDriftMsec = 15.625 * 2.0; // 2x the typical low-res accuracy
-    if (fabs(highResElapsed - lowResElapsed) > maximumAllowedDriftMsec)
-        syncedTime = false;
-
-    // make sure time doesn't run backwards (only correct if difference is < 2 seconds, since DST or clock changes could occur)
-    const double backwardTimeLimit = 2000.0;
-    if (utc < lastUTCTime && (lastUTCTime - utc) < backwardTimeLimit)
-        return lastUTCTime;
-    lastUTCTime = utc;
-#else
-    struct timeval tv;
-    gettimeofday(&tv, 0);
-    double utc = tv.tv_sec * msPerSecond + tv.tv_usec / 1000.0;
-#endif
-    return utc;
+    return currentTime() * 1000.0; 
 }
 
 void getLocalTime(const time_t* localTime, struct tm* localTM)
 {
-#if COMPILER(MSVC7) || COMPILER(MINGW) || PLATFORM(WIN_CE)
+#if COMPILER(MSVC7) || COMPILER(MINGW) || PLATFORM(WINCE)
     *localTM = *localtime(localTime);
 #elif COMPILER(MSVC)
     localtime_s(localTM, localTime);
@@ -489,13 +361,29 @@ int equivalentYearForDST(int year)
 
 static int32_t calculateUTCOffset()
 {
+    time_t localTime = time(0);
     tm localt;
-    memset(&localt, 0, sizeof(localt));
- 
-    // get the difference between this time zone and UTC on Jan 01, 2000 12:00:00 AM
+    getLocalTime(&localTime, &localt);
+
+    // Get the difference between this time zone and UTC on the 1st of January of this year.
+    localt.tm_sec = 0;
+    localt.tm_min = 0;
+    localt.tm_hour = 0;
     localt.tm_mday = 1;
-    localt.tm_year = 100;
-    time_t utcOffset = 946684800 - mktime(&localt);
+    localt.tm_mon = 0;
+    // Not setting localt.tm_year!
+    localt.tm_wday = 0;
+    localt.tm_yday = 0;
+    localt.tm_isdst = 0;
+#if PLATFORM(WIN_OS) || PLATFORM(SOLARIS) || COMPILER(RVCT)
+    // Using a canned date of 01/01/2009 on platforms with weaker date-handling foo.
+    localt.tm_year = 109;
+    time_t utcOffset = 1230768000 - mktime(&localt);
+#else
+    localt.tm_zone = 0;
+    localt.tm_gmtoff = 0;
+    time_t utcOffset = timegm(&localt) - mktime(&localt);
+#endif
 
     return static_cast<int32_t>(utcOffset * 1000);
 }
@@ -628,7 +516,7 @@ void msToGregorianDateTime(double ms, bool outputIsUTC, GregorianDateTime& tm)
     tm.timeZone = NULL;
 }
 
-void initDateMath()
+void initializeDates()
 {
 #ifndef NDEBUG
     static bool alreadyInitialized;
@@ -724,7 +612,7 @@ static bool parseLong(const char* string, char** stopPosition, int base, long* r
     return true;
 }
 
-double parseDate(const UString &date)
+double parseDateFromNullTerminatedCharacters(const char* dateString)
 {
     // This parses a date in the form:
     //     Tuesday, 09-Nov-99 23:12:40 GMT
@@ -739,9 +627,6 @@ double parseDate(const UString &date)
     //     [Wednesday] January 09 23:12:40 GMT 1999
     //
     // We ignore the weekday.
-
-    CString dateCString = date.UTF8String();
-    const char *dateString = dateCString.c_str();
      
     // Skip leading space
     skipSpacesAndComments(dateString);
@@ -847,7 +732,7 @@ double parseDate(const UString &date)
         if (!parseLong(dateString, &newPosStr, 10, &year))
             return NaN;
     }
-    
+
     // Don't fail if the time is missing.
     long hour = 0;
     long minute = 0;
@@ -904,7 +789,7 @@ double parseDate(const UString &date)
                 if (!parseLong(dateString, &newPosStr, 10, &second))
                     return NaN;
                 dateString = newPosStr;
-            
+
                 if (second < 0 || second > 59)
                     return NaN;
             }
@@ -980,9 +865,9 @@ double parseDate(const UString &date)
             return NaN;
         dateString = newPosStr;
     }
-     
+
     skipSpacesAndComments(dateString);
-     
+
     // Trailing garbage
     if (*dateString)
         return NaN;
@@ -1022,46 +907,5 @@ double timeClip(double t)
     return trunc(t);
 }
 
-UString formatDate(const GregorianDateTime &t)
-{
-    char buffer[100];
-    snprintf(buffer, sizeof(buffer), "%s %s %02d %04d",
-        weekdayName[(t.weekDay + 6) % 7],
-        monthName[t.month], t.monthDay, t.year + 1900);
-    return buffer;
-}
-
-UString formatDateUTCVariant(const GregorianDateTime &t)
-{
-    char buffer[100];
-    snprintf(buffer, sizeof(buffer), "%s, %02d %s %04d",
-        weekdayName[(t.weekDay + 6) % 7],
-        t.monthDay, monthName[t.month], t.year + 1900);
-    return buffer;
-}
-
-UString formatTime(const GregorianDateTime &t, bool utc)
-{
-    char buffer[100];
-    if (utc) {
-        snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT", t.hour, t.minute, t.second);
-    } else {
-        int offset = abs(gmtoffset(t));
-        char tzname[70];
-        struct tm gtm = t;
-        strftime(tzname, sizeof(tzname), "%Z", &gtm);
-
-        if (tzname[0]) {
-            snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT%c%02d%02d (%s)",
-                t.hour, t.minute, t.second,
-                gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60, tzname);
-        } else {
-            snprintf(buffer, sizeof(buffer), "%02d:%02d:%02d GMT%c%02d%02d",
-                t.hour, t.minute, t.second,
-                gmtoffset(t) < 0 ? '-' : '+', offset / (60*60), (offset / 60) % 60);
-        }
-    }
-    return UString(buffer);
-}
 
-} // namespace JSC
+} // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/runtime/DateMath.h b/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.h
index 8a15c80..8690a49 100644
--- a/src/3rdparty/webkit/JavaScriptCore/runtime/DateMath.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/DateMath.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
  * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
  *
@@ -45,12 +46,11 @@
 #include <string.h>
 #include <wtf/Noncopyable.h>
 
-namespace JSC {
+namespace WTF {
 
-class UString;
 struct GregorianDateTime;
 
-void initDateMath();
+void initializeDates();
 void msToGregorianDateTime(double, bool outputIsUTC, GregorianDateTime&);
 double gregorianDateTimeToMS(const GregorianDateTime&, double, bool inputIsUTC);
 double getUTCOffset();
@@ -60,12 +60,8 @@ double getCurrentUTCTimeWithMicroseconds();
 void getLocalTime(const time_t*, tm*);
 
 // Not really math related, but this is currently the only shared place to put these.  
-double parseDate(const UString&);
+double parseDateFromNullTerminatedCharacters(const char*);
 double timeClip(double);
-UString formatDate(const GregorianDateTime&);
-UString formatDateUTCVariant(const GregorianDateTime&);
-UString formatTime(const GregorianDateTime&, bool inputIsUTC);
-
 
 const char * const weekdayName[7] = { "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", "Sun" };
 const char * const monthName[12] = { "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec" };
@@ -186,6 +182,6 @@ static inline int gmtoffset(const GregorianDateTime& t)
     return t.utcOffset;
 }
 
-} // namespace JSC
+} // namespace WTF
 
 #endif // DateMath_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Deque.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Deque.h
index 70c546b..3c3d378 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Deque.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Deque.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -43,7 +44,7 @@ namespace WTF {
     template<typename T> class DequeConstReverseIterator;
 
     template<typename T>
-    class Deque {
+    class Deque : public FastAllocBase {
     public:
         typedef DequeIterator<T> iterator;
         typedef DequeConstIterator<T> const_iterator;
@@ -75,9 +76,14 @@ namespace WTF {
         template<typename U> void append(const U&);
         template<typename U> void prepend(const U&);
         void removeFirst();
+        void remove(iterator&);
+        void remove(const_iterator&);
 
         void clear();
 
+        template<typename Predicate>
+        iterator findIf(Predicate&);
+
     private:
         friend class DequeIteratorBase<T>;
 
@@ -85,6 +91,7 @@ namespace WTF {
         typedef VectorTypeOperations<T> TypeOperations;
         typedef DequeIteratorBase<T> IteratorBase;
 
+        void remove(size_t position);
         void invalidateIterators();
         void destroyAll();
         void checkValidity() const;
@@ -124,6 +131,7 @@ namespace WTF {
 
     private:
         void addToIteratorsList();
+        void removeFromIteratorsList();
         void checkValidity() const;
         void checkValidity(const Base&) const;
 
@@ -348,7 +356,7 @@ namespace WTF {
         destroyAll();
     }
 
-    template <typename T>
+    template<typename T>
     inline void Deque<T>::swap(Deque<T>& other)
     {
         checkValidity();
@@ -361,7 +369,7 @@ namespace WTF {
         other.checkValidity();
     }
 
-    template <typename T>
+    template<typename T>
     inline void Deque<T>::clear()
     {
         checkValidity();
@@ -373,6 +381,18 @@ namespace WTF {
     }
 
     template<typename T>
+    template<typename Predicate>
+    inline DequeIterator<T> Deque<T>::findIf(Predicate& predicate)
+    {
+        iterator end_iterator = end();
+        for (iterator it = begin(); it != end_iterator; ++it) {
+            if (predicate(*it))
+                return it;
+        }
+        return end_iterator;
+    }
+
+    template<typename T>
     inline void Deque<T>::expandCapacityIfNeeded()
     {
         if (m_start) {
@@ -447,10 +467,48 @@ namespace WTF {
         checkValidity();
     }
 
+    template<typename T>
+    inline void Deque<T>::remove(iterator& it)
+    {
+        it.checkValidity();
+        remove(it.m_index);
+    }
+
+    template<typename T>
+    inline void Deque<T>::remove(const_iterator& it)
+    {
+        it.checkValidity();
+        remove(it.m_index);
+    }
+
+    template<typename T>
+    inline void Deque<T>::remove(size_t position)
+    {
+        if (position == m_end)
+            return;
+
+        checkValidity();
+        invalidateIterators();
+
+        T* buffer = m_buffer.buffer();
+        TypeOperations::destruct(&buffer[position], &buffer[position + 1]);
+
+        // Find which segment of the circular buffer contained the remove element, and only move elements in that part.
+        if (position >= m_start) {
+            TypeOperations::moveOverlapping(buffer + m_start, buffer + position, buffer + m_start + 1);
+            m_start = (m_start + 1) % m_buffer.capacity();
+        } else {
+            TypeOperations::moveOverlapping(buffer + position + 1, buffer + m_end, buffer + position);
+            m_end = (m_end - 1 + m_buffer.capacity()) % m_buffer.capacity();
+        }
+        checkValidity();
+    }
+
 #ifdef NDEBUG
     template<typename T> inline void DequeIteratorBase<T>::checkValidity() const { }
     template<typename T> inline void DequeIteratorBase<T>::checkValidity(const DequeIteratorBase<T>&) const { }
     template<typename T> inline void DequeIteratorBase<T>::addToIteratorsList() { }
+    template<typename T> inline void DequeIteratorBase<T>::removeFromIteratorsList() { }
 #else
     template<typename T>
     void DequeIteratorBase<T>::checkValidity() const
@@ -480,6 +538,30 @@ namespace WTF {
         }
         m_previous = 0;
     }
+
+    template<typename T>
+    void DequeIteratorBase<T>::removeFromIteratorsList()
+    {
+        if (!m_deque) {
+            ASSERT(!m_next);
+            ASSERT(!m_previous);
+        } else {
+            if (m_next) {
+                ASSERT(m_next->m_previous == this);
+                m_next->m_previous = m_previous;
+            }
+            if (m_previous) {
+                ASSERT(m_deque->m_iterators != this);
+                ASSERT(m_previous->m_next == this);
+                m_previous->m_next = m_next;
+            } else {
+                ASSERT(m_deque->m_iterators == this);
+                m_deque->m_iterators = m_next;
+            }
+        }
+        m_next = 0;
+        m_previous = 0;
+    }
 #endif
 
     template<typename T>
@@ -507,30 +589,25 @@ namespace WTF {
     }
 
     template<typename T>
+    inline DequeIteratorBase<T>& DequeIteratorBase<T>::operator=(const Base& other)
+    {
+        checkValidity();
+        other.checkValidity();
+        removeFromIteratorsList();
+
+        m_deque = other.m_deque;
+        m_index = other.m_index;
+        addToIteratorsList();
+        checkValidity();
+        return *this;
+    }
+
+    template<typename T>
     inline DequeIteratorBase<T>::~DequeIteratorBase()
     {
 #ifndef NDEBUG
-        // Delete iterator from doubly-linked list of iterators.
-        if (!m_deque) {
-            ASSERT(!m_next);
-            ASSERT(!m_previous);
-        } else {
-            if (m_next) {
-                ASSERT(m_next->m_previous == this);
-                m_next->m_previous = m_previous;
-            }
-            if (m_previous) {
-                ASSERT(m_deque->m_iterators != this);
-                ASSERT(m_previous->m_next == this);
-                m_previous->m_next = m_next;
-            } else {
-                ASSERT(m_deque->m_iterators == this);
-                m_deque->m_iterators = m_next;
-            }
-        }
+        removeFromIteratorsList();
         m_deque = 0;
-        m_next = 0;
-        m_previous = 0;
 #endif
     }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastAllocBase.h b/src/3rdparty/webkit/JavaScriptCore/wtf/FastAllocBase.h
new file mode 100644
index 0000000..1c81856
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastAllocBase.h
@@ -0,0 +1,403 @@
+/*
+ * Copyright (C) 2008, 2009 Paul Pedriana <ppedriana@ea.com>. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef FastAllocBase_h
+#define FastAllocBase_h
+
+// Provides customizable overrides of fastMalloc/fastFree and operator new/delete
+//
+// Provided functionality:
+//    namespace WTF {
+//        class FastAllocBase;
+//
+//        T*    fastNew<T>();
+//        T*    fastNew<T>(arg);
+//        T*    fastNew<T>(arg, arg);
+//        T*    fastNewArray<T>(count);
+//        void  fastDelete(T* p);
+//        void  fastDeleteArray(T* p);
+//        void  fastNonNullDelete(T* p);
+//        void  fastNonNullDeleteArray(T* p);
+//    }
+//
+// FastDelete assumes that the underlying
+//
+// Example usage:
+//    class Widget : public FastAllocBase { ... };
+//
+//    char* charPtr = fastNew<char>();
+//    fastDelete(charPtr);
+//
+//    char* charArrayPtr = fastNewArray<char>(37);
+//    fastDeleteArray(charArrayPtr);
+//
+//    void** voidPtrPtr = fastNew<void*>();
+//    fastDelete(voidPtrPtr);
+//
+//    void** voidPtrArrayPtr = fastNewArray<void*>(37);
+//    fastDeleteArray(voidPtrArrayPtr);
+//
+//    POD* podPtr = fastNew<POD>();
+//    fastDelete(podPtr);
+//
+//    POD* podArrayPtr = fastNewArray<POD>(37);
+//    fastDeleteArray(podArrayPtr);
+//
+//    Object* objectPtr = fastNew<Object>();
+//    fastDelete(objectPtr);
+//
+//    Object* objectArrayPtr = fastNewArray<Object>(37);
+//    fastDeleteArray(objectArrayPtr);
+//
+
+#include <new>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+#include "FastMalloc.h"
+#include "TypeTraits.h"
+#include <wtf/Assertions.h>
+
+namespace WTF {
+
+    class FastAllocBase {
+    public:
+        // Placement operator new.
+        void* operator new(size_t, void* p) { return p; }
+        void* operator new[](size_t, void* p) { return p; }
+
+        void* operator new(size_t size)
+        {
+            void* p = fastMalloc(size);
+            fastMallocMatchValidateMalloc(p, Internal::AllocTypeClassNew);
+            return p;
+        }
+
+        void operator delete(void* p)
+        {
+            fastMallocMatchValidateFree(p, Internal::AllocTypeClassNew);
+            fastFree(p);
+        }
+
+        void* operator new[](size_t size)
+        {
+            void* p = fastMalloc(size);
+            fastMallocMatchValidateMalloc(p, Internal::AllocTypeClassNewArray);
+            return p;
+        }
+
+        void operator delete[](void* p)
+        {
+            fastMallocMatchValidateFree(p, Internal::AllocTypeClassNewArray);
+            fastFree(p);
+        }
+    };
+
+    // fastNew / fastDelete
+
+    template <typename T>
+    inline T* fastNew()
+    {
+        void* p = fastMalloc(sizeof(T));
+
+        if (!p)
+            return 0;
+
+        fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNew);
+        return ::new(p) T;
+    }
+
+    template <typename T, typename Arg1>
+    inline T* fastNew(Arg1 arg1)
+    {
+        void* p = fastMalloc(sizeof(T));
+
+        if (!p)
+            return 0;
+
+        fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNew);
+        return ::new(p) T(arg1);
+    }
+
+    template <typename T, typename Arg1, typename Arg2>
+    inline T* fastNew(Arg1 arg1, Arg2 arg2)
+    {
+        void* p = fastMalloc(sizeof(T));
+
+        if (!p)
+            return 0;
+
+        fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNew);
+        return ::new(p) T(arg1, arg2);
+    }
+
+    template <typename T, typename Arg1, typename Arg2, typename Arg3>
+    inline T* fastNew(Arg1 arg1, Arg2 arg2, Arg3 arg3)
+    {
+        void* p = fastMalloc(sizeof(T));
+
+        if (!p)
+            return 0;
+
+        fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNew);
+        return ::new(p) T(arg1, arg2, arg3);
+    }
+
+    template <typename T, typename Arg1, typename Arg2, typename Arg3, typename Arg4>
+    inline T* fastNew(Arg1 arg1, Arg2 arg2, Arg3 arg3, Arg4 arg4)
+    {
+        void* p = fastMalloc(sizeof(T));
+
+        if (!p)
+            return 0;
+
+        fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNew);
+        return ::new(p) T(arg1, arg2, arg3, arg4);
+    }
+
+    template <typename T, typename Arg1, typename Arg2, typename Arg3, typename Arg4, typename Arg5>
+    inline T* fastNew(Arg1 arg1, Arg2 arg2, Arg3 arg3, Arg4 arg4, Arg5 arg5)
+    {
+        void* p = fastMalloc(sizeof(T));
+
+        if (!p)
+            return 0;
+
+        fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNew);
+        return ::new(p) T(arg1, arg2, arg3, arg4, arg5);
+    }
+
+    namespace Internal {
+
+        // We define a union of pointer to an integer and pointer to T.
+        // When non-POD arrays are allocated we add a few leading bytes to tell what
+        // the size of the array is. We return to the user the pointer to T.
+        // The way to think of it is as if we allocate a struct like so:
+        //    struct Array {
+        //        AllocAlignmentInteger m_size;
+        //        T m_T[array count];
+        //    };
+
+        template <typename T>
+        union ArraySize {
+            AllocAlignmentInteger* size;
+            T* t;
+        };
+
+        // This is a support template for fastNewArray.
+        // This handles the case wherein T has a trivial ctor and a trivial dtor.
+        template <typename T, bool trivialCtor, bool trivialDtor>
+        struct NewArrayImpl {
+            static T* fastNewArray(size_t count)
+            {
+                T* p = static_cast<T*>(fastMalloc(sizeof(T) * count));
+                fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNewArray);
+                return p;
+            }
+        };
+
+        // This is a support template for fastNewArray.
+        // This handles the case wherein T has a non-trivial ctor and a trivial dtor.
+        template <typename T>
+        struct NewArrayImpl<T, false, true> {
+            static T* fastNewArray(size_t count)
+            {
+                T* p = static_cast<T*>(fastMalloc(sizeof(T) * count));
+
+                if (!p)
+                    return 0;
+
+                fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNewArray);
+
+                for (T* pObject = p, *pObjectEnd = pObject + count; pObject != pObjectEnd; ++pObject)
+                    ::new(pObject) T;
+
+                return p;
+            }
+        };
+
+        // This is a support template for fastNewArray.
+        // This handles the case wherein T has a trivial ctor and a non-trivial dtor.
+        template <typename T>
+        struct NewArrayImpl<T, true, false> {
+            static T* fastNewArray(size_t count)
+            {
+                void* p = fastMalloc(sizeof(AllocAlignmentInteger) + (sizeof(T) * count));
+                ArraySize<T> a = { static_cast<AllocAlignmentInteger*>(p) };
+
+                if (!p)
+                    return 0;
+
+                fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNewArray);
+                *a.size++ = count;
+                // No need to construct the objects in this case.
+
+                return a.t;
+            }
+        };
+
+        // This is a support template for fastNewArray.
+        // This handles the case wherein T has a non-trivial ctor and a non-trivial dtor.
+        template <typename T>
+        struct NewArrayImpl<T, false, false> {
+            static T* fastNewArray(size_t count)
+            {
+                void* p = fastMalloc(sizeof(AllocAlignmentInteger) + (sizeof(T) * count));
+                ArraySize<T> a = { static_cast<AllocAlignmentInteger*>(p) };
+
+                if (!p)
+                    return 0;
+
+                fastMallocMatchValidateMalloc(p, Internal::AllocTypeFastNewArray);
+                *a.size++ = count;
+
+                for (T* pT = a.t, *pTEnd = pT + count; pT != pTEnd; ++pT)
+                    ::new(pT) T;
+
+                return a.t;
+            }
+        };
+    } // namespace Internal
+
+    template <typename T>
+    inline T* fastNewArray(size_t count)
+    {
+        return Internal::NewArrayImpl<T, WTF::HasTrivialConstructor<T>::value, WTF::HasTrivialDestructor<T>::value>::fastNewArray(count);
+    }
+
+    template <typename T>
+    inline void fastDelete(T* p)
+    {
+        if (!p)
+            return;
+
+        fastMallocMatchValidateFree(p, Internal::AllocTypeFastNew);
+        p->~T();
+        fastFree(p);
+    }
+
+    namespace Internal {
+        // This is a support template for fastDeleteArray.
+        // This handles the case wherein T has a trivial dtor.
+        template <typename T, bool trivialDtor>
+        struct DeleteArrayImpl {
+            static void fastDeleteArray(void* p)
+            {
+                // No need to destruct the objects in this case.
+                // We expect that fastFree checks for null.
+                fastMallocMatchValidateFree(p, Internal::AllocTypeFastNewArray);
+                fastFree(p);
+            }
+        };
+
+        // This is a support template for fastDeleteArray.
+        // This handles the case wherein T has a non-trivial dtor.
+        template <typename T>
+        struct DeleteArrayImpl<T, false> {
+            static void fastDeleteArray(T* p)
+            {
+                if (!p)
+                    return;
+
+                ArraySize<T> a;
+                a.t = p;
+                a.size--; // Decrement size pointer
+
+                T* pEnd = p + *a.size;
+                while (pEnd-- != p)
+                    pEnd->~T();
+
+                fastMallocMatchValidateFree(a.size, Internal::AllocTypeFastNewArray);
+                fastFree(a.size);
+            }
+        };
+
+    } // namespace Internal
+
+    template <typename T>
+    void fastDeleteArray(T* p)
+    {
+        Internal::DeleteArrayImpl<T, WTF::HasTrivialDestructor<T>::value>::fastDeleteArray(p);
+    }
+
+
+    template <typename T>
+    inline void fastNonNullDelete(T* p)
+    {
+        fastMallocMatchValidateFree(p, Internal::AllocTypeFastNew);
+        p->~T();
+        fastFree(p);
+    }
+
+    namespace Internal {
+        // This is a support template for fastDeleteArray.
+        // This handles the case wherein T has a trivial dtor.
+        template <typename T, bool trivialDtor>
+        struct NonNullDeleteArrayImpl {
+            static void fastNonNullDeleteArray(void* p)
+            {
+                fastMallocMatchValidateFree(p, Internal::AllocTypeFastNewArray);
+                // No need to destruct the objects in this case.
+                fastFree(p);
+            }
+        };
+
+        // This is a support template for fastDeleteArray.
+        // This handles the case wherein T has a non-trivial dtor.
+        template <typename T>
+        struct NonNullDeleteArrayImpl<T, false> {
+            static void fastNonNullDeleteArray(T* p)
+            {
+                ArraySize<T> a;
+                a.t = p;
+                a.size--;
+
+                T* pEnd = p + *a.size;
+                while (pEnd-- != p)
+                    pEnd->~T();
+
+                fastMallocMatchValidateFree(a.size, Internal::AllocTypeFastNewArray);
+                fastFree(a.size);
+            }
+        };
+
+    } // namespace Internal
+
+    template <typename T>
+    void fastNonNullDeleteArray(T* p)
+    {
+        Internal::NonNullDeleteArrayImpl<T, WTF::HasTrivialDestructor<T>::value>::fastNonNullDeleteArray(p);
+    }
+
+
+} // namespace WTF
+
+// Using WTF::FastAllocBase to avoid using FastAllocBase's explicit qualification by WTF::.
+using WTF::FastAllocBase;
+
+#endif // FastAllocBase_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
index 4387d61..c65ba85 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.cpp
@@ -78,6 +78,7 @@
 #include "FastMalloc.h"
 
 #include "Assertions.h"
+#include <limits>
 #if ENABLE(JSC_MULTIPLE_THREADS)
 #include <pthread.h>
 #endif
@@ -94,7 +95,7 @@
 #define FORCE_SYSTEM_MALLOC 1
 #endif
 
-#define TCMALLOC_TRACK_DECOMMITED_SPANS (HAVE(VIRTUALALLOC))
+#define TCMALLOC_TRACK_DECOMMITED_SPANS (HAVE(VIRTUALALLOC) || HAVE(MADV_FREE_REUSE))
 
 #ifndef NDEBUG
 namespace WTF {
@@ -151,6 +152,19 @@ void fastMallocAllow()
 
 namespace WTF {
 
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+
+namespace Internal {
+
+void fastMallocMatchFailed(void*)
+{
+    CRASH();
+}
+
+} // namespace Internal
+
+#endif
+
 void* fastZeroedMalloc(size_t n) 
 {
     void* result = fastMalloc(n);
@@ -183,13 +197,34 @@ namespace WTF {
 void* tryFastMalloc(size_t n) 
 {
     ASSERT(!isForbidden());
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    if (std::numeric_limits<size_t>::max() - sizeof(AllocAlignmentInteger) <= n)  // If overflow would occur...
+        return 0;
+
+    void* result = malloc(n + sizeof(AllocAlignmentInteger));
+    if (!result)
+        return 0;
+
+    *static_cast<AllocAlignmentInteger*>(result) = Internal::AllocTypeMalloc;
+    result = static_cast<AllocAlignmentInteger*>(result) + 1;
+
+    return result;
+#else
     return malloc(n);
+#endif
 }
 
 void* fastMalloc(size_t n) 
 {
     ASSERT(!isForbidden());
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    void* result = tryFastMalloc(n);
+#else
     void* result = malloc(n);
+#endif
+
     if (!result)
         CRASH();
     return result;
@@ -198,13 +233,36 @@ void* fastMalloc(size_t n)
 void* tryFastCalloc(size_t n_elements, size_t element_size)
 {
     ASSERT(!isForbidden());
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    size_t totalBytes = n_elements * element_size;
+    if (n_elements > 1 && element_size && (totalBytes / element_size) != n_elements || (std::numeric_limits<size_t>::max() - sizeof(AllocAlignmentInteger) <= totalBytes))
+        return 0;
+
+    totalBytes += sizeof(AllocAlignmentInteger);
+    void* result = malloc(totalBytes);
+    if (!result)
+        return 0;
+
+    memset(result, 0, totalBytes);
+    *static_cast<AllocAlignmentInteger*>(result) = Internal::AllocTypeMalloc;
+    result = static_cast<AllocAlignmentInteger*>(result) + 1;
+    return result;
+#else
     return calloc(n_elements, element_size);
+#endif
 }
 
 void* fastCalloc(size_t n_elements, size_t element_size)
 {
     ASSERT(!isForbidden());
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    void* result = tryFastCalloc(n_elements, element_size);
+#else
     void* result = calloc(n_elements, element_size);
+#endif
+
     if (!result)
         CRASH();
     return result;
@@ -213,19 +271,57 @@ void* fastCalloc(size_t n_elements, size_t element_size)
 void fastFree(void* p)
 {
     ASSERT(!isForbidden());
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    if (!p)
+        return;
+
+    AllocAlignmentInteger* header = Internal::fastMallocMatchValidationValue(p);
+    if (*header != Internal::AllocTypeMalloc)
+        Internal::fastMallocMatchFailed(p);
+    free(header);
+#else
     free(p);
+#endif
 }
 
 void* tryFastRealloc(void* p, size_t n)
 {
     ASSERT(!isForbidden());
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    if (p) {
+        if (std::numeric_limits<size_t>::max() - sizeof(AllocAlignmentInteger) <= n)  // If overflow would occur...
+            return 0;
+        AllocAlignmentInteger* header = Internal::fastMallocMatchValidationValue(p);
+        if (*header != Internal::AllocTypeMalloc)
+            Internal::fastMallocMatchFailed(p);
+        void* result = realloc(header, n + sizeof(AllocAlignmentInteger));
+        if (!result)
+            return 0;
+
+        // This should not be needed because the value is already there:
+        // *static_cast<AllocAlignmentInteger*>(result) = Internal::AllocTypeMalloc;
+        result = static_cast<AllocAlignmentInteger*>(result) + 1;
+        return result;
+    } else {
+        return fastMalloc(n);
+    }
+#else
     return realloc(p, n);
+#endif
 }
 
 void* fastRealloc(void* p, size_t n)
 {
     ASSERT(!isForbidden());
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    void* result = tryFastRealloc(p, n);
+#else
     void* result = realloc(p, n);
+#endif
+
     if (!result)
         CRASH();
     return result;
@@ -265,6 +361,7 @@ extern "C" const int jscore_fastmalloc_introspection = 0;
 #include "TCSystemAlloc.h"
 #include <algorithm>
 #include <errno.h>
+#include <limits>
 #include <new>
 #include <pthread.h>
 #include <stdarg.h>
@@ -321,9 +418,11 @@ namespace WTF {
 #define CHECK_CONDITION ASSERT
 
 #if PLATFORM(DARWIN)
+class Span;
+class TCMalloc_Central_FreeListPadded;
 class TCMalloc_PageHeap;
 class TCMalloc_ThreadCache;
-class TCMalloc_Central_FreeListPadded;
+template <typename T> class PageHeapAllocator;
 
 class FastMallocZone {
 public:
@@ -339,7 +438,7 @@ public:
     static void statistics(malloc_zone_t*, malloc_statistics_t* stats) { memset(stats, 0, sizeof(malloc_statistics_t)); }
 
 private:
-    FastMallocZone(TCMalloc_PageHeap*, TCMalloc_ThreadCache**, TCMalloc_Central_FreeListPadded*);
+    FastMallocZone(TCMalloc_PageHeap*, TCMalloc_ThreadCache**, TCMalloc_Central_FreeListPadded*, PageHeapAllocator<Span>*, PageHeapAllocator<TCMalloc_ThreadCache>*);
     static size_t size(malloc_zone_t*, const void*);
     static void* zoneMalloc(malloc_zone_t*, size_t);
     static void* zoneCalloc(malloc_zone_t*, size_t numItems, size_t size);
@@ -352,6 +451,8 @@ private:
     TCMalloc_PageHeap* m_pageHeap;
     TCMalloc_ThreadCache** m_threadHeaps;
     TCMalloc_Central_FreeListPadded* m_centralCaches;
+    PageHeapAllocator<Span>* m_spanAllocator;
+    PageHeapAllocator<TCMalloc_ThreadCache>* m_pageHeapAllocator;
 };
 
 #endif
@@ -820,6 +921,9 @@ class PageHeapAllocator {
   char* free_area_;
   size_t free_avail_;
 
+  // Linked list of all regions allocated by this allocator
+  void* allocated_regions_;
+
   // Free list of already carved objects
   void* free_list_;
 
@@ -830,6 +934,7 @@ class PageHeapAllocator {
   void Init() {
     ASSERT(kAlignedSize <= kAllocIncrement);
     inuse_ = 0;
+    allocated_regions_ = 0;
     free_area_ = NULL;
     free_avail_ = 0;
     free_list_ = NULL;
@@ -844,9 +949,14 @@ class PageHeapAllocator {
     } else {
       if (free_avail_ < kAlignedSize) {
         // Need more room
-        free_area_ = reinterpret_cast<char*>(MetaDataAlloc(kAllocIncrement));
-        if (free_area_ == NULL) CRASH();
-        free_avail_ = kAllocIncrement;
+        char* new_allocation = reinterpret_cast<char*>(MetaDataAlloc(kAllocIncrement));
+        if (!new_allocation)
+          CRASH();
+
+        *(void**)new_allocation = allocated_regions_;
+        allocated_regions_ = new_allocation;
+        free_area_ = new_allocation + kAlignedSize;
+        free_avail_ = kAllocIncrement - kAlignedSize;
       }
       result = free_area_;
       free_area_ += kAlignedSize;
@@ -863,6 +973,18 @@ class PageHeapAllocator {
   }
 
   int inuse() const { return inuse_; }
+
+#if defined(WTF_CHANGES) && PLATFORM(DARWIN)
+  template <class Recorder>
+  void recordAdministrativeRegions(Recorder& recorder, const RemoteMemoryReader& reader)
+  {
+      vm_address_t adminAllocation = reinterpret_cast<vm_address_t>(allocated_regions_);
+      while (adminAllocation) {
+          recorder.recordRegion(adminAllocation, kAllocIncrement);
+          adminAllocation = *reader(reinterpret_cast<vm_address_t*>(adminAllocation));
+      }
+  }
+#endif
 };
 
 // -------------------------------------------------------------------------
@@ -1037,11 +1159,30 @@ template <int BITS> class MapSelector {
   typedef PackedCache<BITS, uint64_t> CacheType;
 };
 
+#if defined(WTF_CHANGES)
+#if PLATFORM(X86_64)
+// On all known X86-64 platforms, the upper 16 bits are always unused and therefore 
+// can be excluded from the PageMap key.
+// See http://en.wikipedia.org/wiki/X86-64#Virtual_address_space_details
+
+static const size_t kBitsUnusedOn64Bit = 16;
+#else
+static const size_t kBitsUnusedOn64Bit = 0;
+#endif
+
+// A three-level map for 64-bit machines
+template <> class MapSelector<64> {
+ public:
+  typedef TCMalloc_PageMap3<64 - kPageShift - kBitsUnusedOn64Bit> Type;
+  typedef PackedCache<64, uint64_t> CacheType;
+};
+#endif
+
 // A two-level map for 32-bit machines
 template <> class MapSelector<32> {
  public:
-  typedef TCMalloc_PageMap2<32-kPageShift> Type;
-  typedef PackedCache<32-kPageShift, uint16_t> CacheType;
+  typedef TCMalloc_PageMap2<32 - kPageShift> Type;
+  typedef PackedCache<32 - kPageShift, uint16_t> CacheType;
 };
 
 // -------------------------------------------------------------------------
@@ -1359,8 +1500,14 @@ static ALWAYS_INLINE void mergeDecommittedStates(Span*, Span*) { }
 #else
 static ALWAYS_INLINE void mergeDecommittedStates(Span* destination, Span* other)
 {
-    if (other->decommitted)
+    if (destination->decommitted && !other->decommitted) {
+        TCMalloc_SystemRelease(reinterpret_cast<void*>(other->start << kPageShift),
+                               static_cast<size_t>(other->length << kPageShift));
+    } else if (other->decommitted && !destination->decommitted) {
+        TCMalloc_SystemRelease(reinterpret_cast<void*>(destination->start << kPageShift),
+                               static_cast<size_t>(destination->length << kPageShift));
         destination->decommitted = true;
+    }
 }
 #endif
 
@@ -3244,7 +3391,20 @@ template <bool crashOnFailure>
 ALWAYS_INLINE
 #endif
 void* malloc(size_t size) {
-  void* result = do_malloc(size);
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    if (std::numeric_limits<size_t>::max() - sizeof(AllocAlignmentInteger) <= size)  // If overflow would occur...
+        return 0;
+    size += sizeof(AllocAlignmentInteger);
+    void* result = do_malloc(size);
+    if (!result)
+        return 0;
+
+    *static_cast<AllocAlignmentInteger*>(result) = Internal::AllocTypeMalloc;
+    result = static_cast<AllocAlignmentInteger*>(result) + 1;
+#else
+    void* result = do_malloc(size);
+#endif
+
 #ifndef WTF_CHANGES
   MallocHook::InvokeNewHook(result, size);
 #endif
@@ -3258,7 +3418,18 @@ void free(void* ptr) {
 #ifndef WTF_CHANGES
   MallocHook::InvokeDeleteHook(ptr);
 #endif
-  do_free(ptr);
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    if (!ptr)
+        return;
+
+    AllocAlignmentInteger* header = Internal::fastMallocMatchValidationValue(ptr);
+    if (*header != Internal::AllocTypeMalloc)
+        Internal::fastMallocMatchFailed(ptr);
+    do_free(header);
+#else
+    do_free(ptr);
+#endif
 }
 
 #ifndef WTF_CHANGES
@@ -3281,22 +3452,39 @@ template <bool crashOnFailure>
 ALWAYS_INLINE
 #endif
 void* calloc(size_t n, size_t elem_size) {
-  const size_t totalBytes = n * elem_size;
+  size_t totalBytes = n * elem_size;
     
   // Protect against overflow
   if (n > 1 && elem_size && (totalBytes / elem_size) != n)
     return 0;
-    
-  void* result = do_malloc(totalBytes);
-  if (result != NULL) {
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    if (std::numeric_limits<size_t>::max() - sizeof(AllocAlignmentInteger) <= totalBytes)  // If overflow would occur...
+        return 0;
+
+    totalBytes += sizeof(AllocAlignmentInteger);
+    void* result = do_malloc(totalBytes);
+    if (!result)
+        return 0;
+
     memset(result, 0, totalBytes);
-  }
+    *static_cast<AllocAlignmentInteger*>(result) = Internal::AllocTypeMalloc;
+    result = static_cast<AllocAlignmentInteger*>(result) + 1;
+#else
+    void* result = do_malloc(totalBytes);
+    if (result != NULL) {
+        memset(result, 0, totalBytes);
+    }
+#endif
+
 #ifndef WTF_CHANGES
   MallocHook::InvokeNewHook(result, totalBytes);
 #endif
   return result;
 }
 
+// Since cfree isn't used anywhere, we don't compile it in.
+#ifndef WTF_CHANGES
 #ifndef WTF_CHANGES
 extern "C" 
 #endif
@@ -3306,6 +3494,7 @@ void cfree(void* ptr) {
 #endif
   do_free(ptr);
 }
+#endif
 
 #ifndef WTF_CHANGES
 extern "C" 
@@ -3328,10 +3517,14 @@ ALWAYS_INLINE
 #endif
 void* realloc(void* old_ptr, size_t new_size) {
   if (old_ptr == NULL) {
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    void* result = malloc(new_size);
+#else
     void* result = do_malloc(new_size);
 #ifndef WTF_CHANGES
     MallocHook::InvokeNewHook(result, new_size);
 #endif
+#endif
     return result;
   }
   if (new_size == 0) {
@@ -3342,6 +3535,16 @@ void* realloc(void* old_ptr, size_t new_size) {
     return NULL;
   }
 
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    if (std::numeric_limits<size_t>::max() - sizeof(AllocAlignmentInteger) <= new_size)  // If overflow would occur...
+        return 0;
+    new_size += sizeof(AllocAlignmentInteger);
+    AllocAlignmentInteger* header = Internal::fastMallocMatchValidationValue(old_ptr);
+    if (*header != Internal::AllocTypeMalloc)
+        Internal::fastMallocMatchFailed(old_ptr);
+    old_ptr = header;
+#endif
+
   // Get the size of the old entry
   const PageID p = reinterpret_cast<uintptr_t>(old_ptr) >> kPageShift;
   size_t cl = pageheap->GetSizeClassIfCached(p);
@@ -3378,8 +3581,14 @@ void* realloc(void* old_ptr, size_t new_size) {
     // that we already know the sizeclass of old_ptr.  The benefit
     // would be small, so don't bother.
     do_free(old_ptr);
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    new_ptr = static_cast<AllocAlignmentInteger*>(new_ptr) + 1;
+#endif
     return new_ptr;
   } else {
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+    old_ptr = pByte + sizeof(AllocAlignmentInteger);  // Set old_ptr back to the user pointer.
+#endif
     return old_ptr;
   }
 }
@@ -3608,6 +3817,7 @@ public:
 
     void visit(void* ptr) { m_freeObjects.add(ptr); }
     bool isFreeObject(void* ptr) const { return m_freeObjects.contains(ptr); }
+    bool isFreeObject(vm_address_t ptr) const { return isFreeObject(reinterpret_cast<void*>(ptr)); }
     size_t freeObjectCount() const { return m_freeObjects.size(); }
 
     void findFreeObjects(TCMalloc_ThreadCache* threadCache)
@@ -3658,7 +3868,9 @@ class PageMapMemoryUsageRecorder {
     vm_range_recorder_t* m_recorder;
     const RemoteMemoryReader& m_reader;
     const FreeObjectFinder& m_freeObjectFinder;
-    mutable HashSet<void*> m_seenPointers;
+
+    HashSet<void*> m_seenPointers;
+    Vector<Span*> m_coalescedSpans;
 
 public:
     PageMapMemoryUsageRecorder(task_t task, void* context, unsigned typeMask, vm_range_recorder_t* recorder, const RemoteMemoryReader& reader, const FreeObjectFinder& freeObjectFinder)
@@ -3670,51 +3882,133 @@ public:
         , m_freeObjectFinder(freeObjectFinder)
     { }
 
-    int visit(void* ptr) const
+    ~PageMapMemoryUsageRecorder()
+    {
+        ASSERT(!m_coalescedSpans.size());
+    }
+
+    void recordPendingRegions()
+    {
+        Span* lastSpan = m_coalescedSpans[m_coalescedSpans.size() - 1];
+        vm_range_t ptrRange = { m_coalescedSpans[0]->start << kPageShift, 0 };
+        ptrRange.size = (lastSpan->start << kPageShift) - ptrRange.address + (lastSpan->length * kPageSize);
+
+        // Mark the memory region the spans represent as a candidate for containing pointers
+        if (m_typeMask & MALLOC_PTR_REGION_RANGE_TYPE)
+            (*m_recorder)(m_task, m_context, MALLOC_PTR_REGION_RANGE_TYPE, &ptrRange, 1);
+
+        if (!(m_typeMask & MALLOC_PTR_IN_USE_RANGE_TYPE)) {
+            m_coalescedSpans.clear();
+            return;
+        }
+
+        Vector<vm_range_t, 1024> allocatedPointers;
+        for (size_t i = 0; i < m_coalescedSpans.size(); ++i) {
+            Span *theSpan = m_coalescedSpans[i];
+            if (theSpan->free)
+                continue;
+
+            vm_address_t spanStartAddress = theSpan->start << kPageShift;
+            vm_size_t spanSizeInBytes = theSpan->length * kPageSize;
+
+            if (!theSpan->sizeclass) {
+                // If it's an allocated large object span, mark it as in use
+                if (!m_freeObjectFinder.isFreeObject(spanStartAddress))
+                    allocatedPointers.append((vm_range_t){spanStartAddress, spanSizeInBytes});
+            } else {
+                const size_t objectSize = ByteSizeForClass(theSpan->sizeclass);
+
+                // Mark each allocated small object within the span as in use
+                const vm_address_t endOfSpan = spanStartAddress + spanSizeInBytes;
+                for (vm_address_t object = spanStartAddress; object + objectSize <= endOfSpan; object += objectSize) {
+                    if (!m_freeObjectFinder.isFreeObject(object))
+                        allocatedPointers.append((vm_range_t){object, objectSize});
+                }
+            }
+        }
+
+        (*m_recorder)(m_task, m_context, MALLOC_PTR_IN_USE_RANGE_TYPE, allocatedPointers.data(), allocatedPointers.size());
+
+        m_coalescedSpans.clear();
+    }
+
+    int visit(void* ptr)
     {
         if (!ptr)
             return 1;
 
         Span* span = m_reader(reinterpret_cast<Span*>(ptr));
+        if (!span->start)
+            return 1;
+
         if (m_seenPointers.contains(ptr))
             return span->length;
         m_seenPointers.add(ptr);
 
-        // Mark the memory used for the Span itself as an administrative region
-        vm_range_t ptrRange = { reinterpret_cast<vm_address_t>(ptr), sizeof(Span) };
-        if (m_typeMask & (MALLOC_PTR_REGION_RANGE_TYPE | MALLOC_ADMIN_REGION_RANGE_TYPE))
-            (*m_recorder)(m_task, m_context, MALLOC_ADMIN_REGION_RANGE_TYPE, &ptrRange, 1);
+        if (!m_coalescedSpans.size()) {
+            m_coalescedSpans.append(span);
+            return span->length;
+        }
 
-        ptrRange.address = span->start << kPageShift;
-        ptrRange.size = span->length * kPageSize;
+        Span* previousSpan = m_coalescedSpans[m_coalescedSpans.size() - 1];
+        vm_address_t previousSpanStartAddress = previousSpan->start << kPageShift;
+        vm_size_t previousSpanSizeInBytes = previousSpan->length * kPageSize;
 
-        // Mark the memory region the span represents as candidates for containing pointers
-        if (m_typeMask & (MALLOC_PTR_REGION_RANGE_TYPE | MALLOC_ADMIN_REGION_RANGE_TYPE))
-            (*m_recorder)(m_task, m_context, MALLOC_PTR_REGION_RANGE_TYPE, &ptrRange, 1);
+        // If the new span is adjacent to the previous span, do nothing for now.
+        vm_address_t spanStartAddress = span->start << kPageShift;
+        if (spanStartAddress == previousSpanStartAddress + previousSpanSizeInBytes) {
+            m_coalescedSpans.append(span);
+            return span->length;
+        }
 
-        if (!span->free && (m_typeMask & MALLOC_PTR_IN_USE_RANGE_TYPE)) {
-            // If it's an allocated large object span, mark it as in use
-            if (span->sizeclass == 0 && !m_freeObjectFinder.isFreeObject(reinterpret_cast<void*>(ptrRange.address)))
-                (*m_recorder)(m_task, m_context, MALLOC_PTR_IN_USE_RANGE_TYPE, &ptrRange, 1);
-            else if (span->sizeclass) {
-                const size_t byteSize = ByteSizeForClass(span->sizeclass);
-                unsigned totalObjects = (span->length << kPageShift) / byteSize;
-                ASSERT(span->refcount <= totalObjects);
-                char* ptr = reinterpret_cast<char*>(span->start << kPageShift);
+        // New span is not adjacent to previous span, so record the spans coalesced so far.
+        recordPendingRegions();
+        m_coalescedSpans.append(span);
 
-                // Mark each allocated small object within the span as in use
-                for (unsigned i = 0; i < totalObjects; i++) {
-                    char* thisObject = ptr + (i * byteSize);
-                    if (m_freeObjectFinder.isFreeObject(thisObject))
-                        continue;
+        return span->length;
+    }
+};
 
-                    vm_range_t objectRange = { reinterpret_cast<vm_address_t>(thisObject), byteSize };
-                    (*m_recorder)(m_task, m_context, MALLOC_PTR_IN_USE_RANGE_TYPE, &objectRange, 1);
-                }
-            }
+class AdminRegionRecorder {
+    task_t m_task;
+    void* m_context;
+    unsigned m_typeMask;
+    vm_range_recorder_t* m_recorder;
+    const RemoteMemoryReader& m_reader;
+
+    Vector<vm_range_t, 1024> m_pendingRegions;
+
+public:
+    AdminRegionRecorder(task_t task, void* context, unsigned typeMask, vm_range_recorder_t* recorder, const RemoteMemoryReader& reader)
+        : m_task(task)
+        , m_context(context)
+        , m_typeMask(typeMask)
+        , m_recorder(recorder)
+        , m_reader(reader)
+    { }
+
+    void recordRegion(vm_address_t ptr, size_t size)
+    {
+        if (m_typeMask & MALLOC_ADMIN_REGION_RANGE_TYPE)
+            m_pendingRegions.append((vm_range_t){ ptr, size });
+    }
+
+    void visit(void *ptr, size_t size)
+    {
+        recordRegion(reinterpret_cast<vm_address_t>(ptr), size);
+    }
+
+    void recordPendingRegions()
+    {
+        if (m_pendingRegions.size()) {
+            (*m_recorder)(m_task, m_context, MALLOC_ADMIN_REGION_RANGE_TYPE, m_pendingRegions.data(), m_pendingRegions.size());
+            m_pendingRegions.clear();
         }
+    }
 
-        return span->length;
+    ~AdminRegionRecorder()
+    {
+        ASSERT(!m_pendingRegions.size());
     }
 };
 
@@ -3737,10 +4031,22 @@ kern_return_t FastMallocZone::enumerate(task_t task, void* context, unsigned typ
 
     TCMalloc_PageHeap::PageMap* pageMap = &pageHeap->pagemap_;
     PageMapFreeObjectFinder pageMapFinder(memoryReader, finder);
-    pageMap->visit(pageMapFinder, memoryReader);
+    pageMap->visitValues(pageMapFinder, memoryReader);
 
     PageMapMemoryUsageRecorder usageRecorder(task, context, typeMask, recorder, memoryReader, finder);
-    pageMap->visit(usageRecorder, memoryReader);
+    pageMap->visitValues(usageRecorder, memoryReader);
+    usageRecorder.recordPendingRegions();
+
+    AdminRegionRecorder adminRegionRecorder(task, context, typeMask, recorder, memoryReader);
+    pageMap->visitAllocations(adminRegionRecorder, memoryReader);
+
+    PageHeapAllocator<Span>* spanAllocator = memoryReader(mzone->m_spanAllocator);
+    PageHeapAllocator<TCMalloc_ThreadCache>* pageHeapAllocator = memoryReader(mzone->m_pageHeapAllocator);
+
+    spanAllocator->recordAdministrativeRegions(adminRegionRecorder, memoryReader);
+    pageHeapAllocator->recordAdministrativeRegions(adminRegionRecorder, memoryReader);
+
+    adminRegionRecorder.recordPendingRegions();
 
     return 0;
 }
@@ -3781,15 +4087,24 @@ void* FastMallocZone::zoneRealloc(malloc_zone_t*, void*, size_t)
 
 extern "C" {
 malloc_introspection_t jscore_fastmalloc_introspection = { &FastMallocZone::enumerate, &FastMallocZone::goodSize, &FastMallocZone::check, &FastMallocZone::print,
-    &FastMallocZone::log, &FastMallocZone::forceLock, &FastMallocZone::forceUnlock, &FastMallocZone::statistics };
+    &FastMallocZone::log, &FastMallocZone::forceLock, &FastMallocZone::forceUnlock, &FastMallocZone::statistics
+
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !PLATFORM(IPHONE)
+    , 0 // zone_locked will not be called on the zone unless it advertises itself as version five or higher.
+#endif
+
+    };
 }
 
-FastMallocZone::FastMallocZone(TCMalloc_PageHeap* pageHeap, TCMalloc_ThreadCache** threadHeaps, TCMalloc_Central_FreeListPadded* centralCaches)
+FastMallocZone::FastMallocZone(TCMalloc_PageHeap* pageHeap, TCMalloc_ThreadCache** threadHeaps, TCMalloc_Central_FreeListPadded* centralCaches, PageHeapAllocator<Span>* spanAllocator, PageHeapAllocator<TCMalloc_ThreadCache>* pageHeapAllocator)
     : m_pageHeap(pageHeap)
     , m_threadHeaps(threadHeaps)
     , m_centralCaches(centralCaches)
+    , m_spanAllocator(spanAllocator)
+    , m_pageHeapAllocator(pageHeapAllocator)
 {
     memset(&m_zone, 0, sizeof(m_zone));
+    m_zone.version = 4;
     m_zone.zone_name = "JavaScriptCore FastMalloc";
     m_zone.size = &FastMallocZone::size;
     m_zone.malloc = &FastMallocZone::zoneMalloc;
@@ -3805,7 +4120,7 @@ FastMallocZone::FastMallocZone(TCMalloc_PageHeap* pageHeap, TCMalloc_ThreadCache
 
 void FastMallocZone::init()
 {
-    static FastMallocZone zone(pageheap, &thread_heaps, static_cast<TCMalloc_Central_FreeListPadded*>(central_cache));
+    static FastMallocZone zone(pageheap, &thread_heaps, static_cast<TCMalloc_Central_FreeListPadded*>(central_cache), &span_allocator, &threadheap_allocator);
 }
 
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
index f1264ac..9e13cf9 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/FastMalloc.h
@@ -56,6 +56,95 @@ namespace WTF {
     };
     FastMallocStatistics fastMallocStatistics();
 
+    // This defines a type which holds an unsigned integer and is the same
+    // size as the minimally aligned memory allocation.
+    typedef unsigned long long AllocAlignmentInteger;
+
+    namespace Internal {
+        enum AllocType {                    // Start with an unusual number instead of zero, because zero is common.
+            AllocTypeMalloc = 0x375d6750,   // Encompasses fastMalloc, fastZeroedMalloc, fastCalloc, fastRealloc.
+            AllocTypeClassNew,              // Encompasses class operator new from FastAllocBase.
+            AllocTypeClassNewArray,         // Encompasses class operator new[] from FastAllocBase.
+            AllocTypeFastNew,               // Encompasses fastNew.
+            AllocTypeFastNewArray,          // Encompasses fastNewArray.
+            AllocTypeNew,                   // Encompasses global operator new.
+            AllocTypeNewArray               // Encompasses global operator new[].
+        };
+    }
+
+#if ENABLE(FAST_MALLOC_MATCH_VALIDATION)
+
+    // Malloc validation is a scheme whereby a tag is attached to an
+    // allocation which identifies how it was originally allocated.
+    // This allows us to verify that the freeing operation matches the
+    // allocation operation. If memory is allocated with operator new[]
+    // but freed with free or delete, this system would detect that.
+    // In the implementation here, the tag is an integer prepended to
+    // the allocation memory which is assigned one of the AllocType
+    // enumeration values. An alternative implementation of this
+    // scheme could store the tag somewhere else or ignore it.
+    // Users of FastMalloc don't need to know or care how this tagging
+    // is implemented.
+
+    namespace Internal {
+
+        // Return the AllocType tag associated with the allocated block p.
+        inline AllocType fastMallocMatchValidationType(const void* p)
+        {
+            const AllocAlignmentInteger* type = static_cast<const AllocAlignmentInteger*>(p) - 1;
+            return static_cast<AllocType>(*type);
+        }
+
+        // Return the address of the AllocType tag associated with the allocated block p.
+        inline AllocAlignmentInteger* fastMallocMatchValidationValue(void* p)
+        {
+            return reinterpret_cast<AllocAlignmentInteger*>(static_cast<char*>(p) - sizeof(AllocAlignmentInteger));
+        }
+
+        // Set the AllocType tag to be associaged with the allocated block p.
+        inline void setFastMallocMatchValidationType(void* p, AllocType allocType)
+        {
+            AllocAlignmentInteger* type = static_cast<AllocAlignmentInteger*>(p) - 1;
+            *type = static_cast<AllocAlignmentInteger>(allocType);
+        }
+
+        // Handle a detected alloc/free mismatch. By default this calls CRASH().
+        void fastMallocMatchFailed(void* p);
+
+    } // namespace Internal
+
+    // This is a higher level function which is used by FastMalloc-using code.
+    inline void fastMallocMatchValidateMalloc(void* p, Internal::AllocType allocType)
+    {
+        if (!p)
+            return;
+
+        Internal::setFastMallocMatchValidationType(p, allocType);
+    }
+
+    // This is a higher level function which is used by FastMalloc-using code.
+    inline void fastMallocMatchValidateFree(void* p, Internal::AllocType allocType)
+    {
+        if (!p)
+            return;
+
+        if (Internal::fastMallocMatchValidationType(p) != allocType)
+            Internal::fastMallocMatchFailed(p);
+        Internal::setFastMallocMatchValidationType(p, Internal::AllocTypeMalloc);  // Set it to this so that fastFree thinks it's OK.
+    }
+
+#else
+
+    inline void fastMallocMatchValidateMalloc(void*, Internal::AllocType)
+    {
+    }
+
+    inline void fastMallocMatchValidateFree(void*, Internal::AllocType)
+    {
+    }
+
+#endif
+
 } // namespace WTF
 
 using WTF::fastMalloc;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.cpp
index 58869f4..432885f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.cpp
@@ -56,4 +56,10 @@ template <> void freeOwnedGPtr<GDir>(GDir* ptr)
         g_dir_close(ptr);
 }
 
+template <> void freeOwnedGPtr<GHashTable>(GHashTable* ptr)
+{
+    if (ptr)
+        g_hash_table_unref(ptr);
+}
+
 } // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.h
index bbb793a..8d03ff2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/GOwnPtr.h
@@ -35,6 +35,7 @@ namespace WTF {
     template<> void freeOwnedGPtr<GMutex>(GMutex*);
     template<> void freeOwnedGPtr<GPatternSpec>(GPatternSpec*);
     template<> void freeOwnedGPtr<GDir>(GDir*);
+    template<> void freeOwnedGPtr<GHashTable>(GHashTable*);
 
     template <typename T> class GOwnPtr : Noncopyable {
     public:
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h
index 6fc0234..1a422d8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashCountedSet.h
@@ -22,13 +22,14 @@
 #define WTF_HashCountedSet_h
 
 #include "Assertions.h"
+#include "FastAllocBase.h"
 #include "HashMap.h"
 #include "Vector.h"
 
 namespace WTF {
 
     template<typename Value, typename HashFunctions = typename DefaultHash<Value>::Hash,
-        typename Traits = HashTraits<Value> > class HashCountedSet {
+        typename Traits = HashTraits<Value> > class HashCountedSet : public FastAllocBase {
     private:
         typedef HashMap<Value, unsigned, HashFunctions, Traits> ImplType;
     public:
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
index c5b75ff..3de5ee6 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashMap.h
@@ -29,7 +29,7 @@ namespace WTF {
 
     template<typename KeyArg, typename MappedArg, typename HashArg = typename DefaultHash<KeyArg>::Hash,
         typename KeyTraitsArg = HashTraits<KeyArg>, typename MappedTraitsArg = HashTraits<MappedArg> >
-    class HashMap {
+    class HashMap : public FastAllocBase {
     private:
         typedef KeyTraitsArg KeyTraits;
         typedef MappedTraitsArg MappedTraits;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashSet.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashSet.h
index da99f2c..d664c67 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashSet.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashSet.h
@@ -21,6 +21,7 @@
 #ifndef WTF_HashSet_h
 #define WTF_HashSet_h
 
+#include "FastAllocBase.h"
 #include "HashTable.h"
 
 namespace WTF {
@@ -32,7 +33,7 @@ namespace WTF {
     template<typename T> struct IdentityExtractor;
 
     template<typename ValueArg, typename HashArg = typename DefaultHash<ValueArg>::Hash,
-        typename TraitsArg = HashTraits<ValueArg> > class HashSet {
+        typename TraitsArg = HashTraits<ValueArg> > class HashSet : public FastAllocBase {
     private:
         typedef HashArg HashFunctions;
         typedef TraitsArg ValueTraits;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/HashTraits.h b/src/3rdparty/webkit/JavaScriptCore/wtf/HashTraits.h
index b3c0b7a..c8d40f7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/HashTraits.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/HashTraits.h
@@ -21,8 +21,8 @@
 #ifndef WTF_HashTraits_h
 #define WTF_HashTraits_h
 
-#include "Assertions.h"
 #include "HashFunctions.h"
+#include "TypeTraits.h"
 #include <utility>
 #include <limits>
 
@@ -31,47 +31,6 @@ namespace WTF {
     using std::pair;
     using std::make_pair;
 
-    template<typename T> struct IsInteger           { static const bool value = false; };
-    template<> struct IsInteger<bool>               { static const bool value = true; };
-    template<> struct IsInteger<char>               { static const bool value = true; };
-    template<> struct IsInteger<signed char>        { static const bool value = true; };
-    template<> struct IsInteger<unsigned char>      { static const bool value = true; };
-    template<> struct IsInteger<short>              { static const bool value = true; };
-    template<> struct IsInteger<unsigned short>     { static const bool value = true; };
-    template<> struct IsInteger<int>                { static const bool value = true; };
-    template<> struct IsInteger<unsigned int>       { static const bool value = true; };
-    template<> struct IsInteger<long>               { static const bool value = true; };
-    template<> struct IsInteger<unsigned long>      { static const bool value = true; };
-    template<> struct IsInteger<long long>          { static const bool value = true; };
-    template<> struct IsInteger<unsigned long long> { static const bool value = true; };
-
-#if !COMPILER(MSVC) || defined(_NATIVE_WCHAR_T_DEFINED)
-    template<> struct IsInteger<wchar_t>            { static const bool value = true; };
-#endif
-
-    COMPILE_ASSERT(IsInteger<bool>::value, WTF_IsInteger_bool_true);
-    COMPILE_ASSERT(IsInteger<char>::value, WTF_IsInteger_char_true);
-    COMPILE_ASSERT(IsInteger<signed char>::value, WTF_IsInteger_signed_char_true);
-    COMPILE_ASSERT(IsInteger<unsigned char>::value, WTF_IsInteger_unsigned_char_true);
-    COMPILE_ASSERT(IsInteger<short>::value, WTF_IsInteger_short_true);
-    COMPILE_ASSERT(IsInteger<unsigned short>::value, WTF_IsInteger_unsigned_short_true);
-    COMPILE_ASSERT(IsInteger<int>::value, WTF_IsInteger_int_true);
-    COMPILE_ASSERT(IsInteger<unsigned int>::value, WTF_IsInteger_unsigned_int_true);
-    COMPILE_ASSERT(IsInteger<long>::value, WTF_IsInteger_long_true);
-    COMPILE_ASSERT(IsInteger<unsigned long>::value, WTF_IsInteger_unsigned_long_true);
-    COMPILE_ASSERT(IsInteger<long long>::value, WTF_IsInteger_long_long_true);
-    COMPILE_ASSERT(IsInteger<unsigned long long>::value, WTF_IsInteger_unsigned_long_long_true);
-
-#if !COMPILER(MSVC) || defined(_NATIVE_WCHAR_T_DEFINED)
-    COMPILE_ASSERT(IsInteger<wchar_t>::value, WTF_IsInteger_wchar_t_true);
-#endif
-
-    COMPILE_ASSERT(!IsInteger<char*>::value, WTF_IsInteger_char_pointer_false);
-    COMPILE_ASSERT(!IsInteger<const char* >::value, WTF_IsInteger_const_char_pointer_false);
-    COMPILE_ASSERT(!IsInteger<volatile char* >::value, WTF_IsInteger_volatile_char_pointer__false);
-    COMPILE_ASSERT(!IsInteger<double>::value, WTF_IsInteger_double_false);
-    COMPILE_ASSERT(!IsInteger<float>::value, WTF_IsInteger_float_false);
-
     template<typename T> struct HashTraits;
 
     template<bool isInteger, typename T> struct GenericHashTraitsBase;
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp
index c7a6caa..3c19b7a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.cpp
@@ -29,26 +29,25 @@
 #include "config.h"
 #include "MainThread.h"
 
+#include "CurrentTime.h"
+#include "Deque.h"
 #include "StdLibExtras.h"
 #include "Threading.h"
-#include "Vector.h"
 
 namespace WTF {
 
 struct FunctionWithContext {
     MainThreadFunction* function;
     void* context;
-    ThreadCondition* syncFlag;
 
-    FunctionWithContext(MainThreadFunction* function = 0, void* context = 0, ThreadCondition* syncFlag = 0)
+    FunctionWithContext(MainThreadFunction* function = 0, void* context = 0)
         : function(function)
         , context(context)
-        , syncFlag(syncFlag)
     { 
     }
 };
 
-typedef Vector<FunctionWithContext> FunctionQueue;
+typedef Deque<FunctionWithContext> FunctionQueue;
 
 static bool callbacksPaused; // This global variable is only accessed from main thread.
 
@@ -64,12 +63,14 @@ static FunctionQueue& functionQueue()
     return staticFunctionQueue;
 }
 
-#if !PLATFORM(WIN)
 void initializeMainThread()
 {
     mainThreadFunctionQueueMutex();
+    initializeMainThreadPlatform();
 }
-#endif
+
+// 0.1 sec delays in UI is approximate threshold when they become noticeable. Have a limit that's half of that.
+static const double maxRunLoopSuspensionTime = 0.05;
 
 void dispatchFunctionsFromMainThread()
 {
@@ -78,52 +79,42 @@ void dispatchFunctionsFromMainThread()
     if (callbacksPaused)
         return;
 
-    FunctionQueue queueCopy;
-    {
-        MutexLocker locker(mainThreadFunctionQueueMutex());
-        queueCopy.swap(functionQueue());
-    }
+    double startTime = currentTime();
+
+    FunctionWithContext invocation;
+    while (true) {
+        {
+            MutexLocker locker(mainThreadFunctionQueueMutex());
+            if (!functionQueue().size())
+                break;
+            invocation = functionQueue().first();
+            functionQueue().removeFirst();
+        }
 
-    for (unsigned i = 0; i < queueCopy.size(); ++i) {
-        FunctionWithContext& invocation = queueCopy[i];
         invocation.function(invocation.context);
-        if (invocation.syncFlag)
-            invocation.syncFlag->signal();
+
+        // If we are running accumulated functions for too long so UI may become unresponsive, we need to
+        // yield so the user input can be processed. Otherwise user may not be able to even close the window.
+        // This code has effect only in case the scheduleDispatchFunctionsOnMainThread() is implemented in a way that
+        // allows input events to be processed before we are back here.
+        if (currentTime() - startTime > maxRunLoopSuspensionTime) {
+            scheduleDispatchFunctionsOnMainThread();
+            break;
+        }
     }
 }
 
 void callOnMainThread(MainThreadFunction* function, void* context)
 {
     ASSERT(function);
-
+    bool needToSchedule = false;
     {
         MutexLocker locker(mainThreadFunctionQueueMutex());
+        needToSchedule = functionQueue().size() == 0;
         functionQueue().append(FunctionWithContext(function, context));
     }
-
-    scheduleDispatchFunctionsOnMainThread();
-}
-
-void callOnMainThreadAndWait(MainThreadFunction* function, void* context)
-{
-    ASSERT(function);
-
-    if (isMainThread()) {
-        function(context);
-        return;
-    }
-
-    ThreadCondition syncFlag;
-    Mutex conditionMutex;
-
-    {
-        MutexLocker locker(mainThreadFunctionQueueMutex());
-        functionQueue().append(FunctionWithContext(function, context, &syncFlag));
-        conditionMutex.lock();
-    }
-
-    scheduleDispatchFunctionsOnMainThread();
-    syncFlag.wait(conditionMutex);
+    if (needToSchedule)
+        scheduleDispatchFunctionsOnMainThread();
 }
 
 void setMainThreadCallbacksPaused(bool paused)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h
index 953b986..01ce804 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MainThread.h
@@ -37,7 +37,6 @@ class Mutex;
 typedef void MainThreadFunction(void*);
 
 void callOnMainThread(MainThreadFunction*, void* context);
-void callOnMainThreadAndWait(MainThreadFunction*, void* context);
 
 void setMainThreadCallbacksPaused(bool paused);
 
@@ -45,9 +44,10 @@ void setMainThreadCallbacksPaused(bool paused);
 void initializeMainThread();
 
 // These functions are internal to the callOnMainThread implementation.
-void dispatchFunctionsFromMainThread();
+void initializeMainThreadPlatform();
 void scheduleDispatchFunctionsOnMainThread();
 Mutex& mainThreadFunctionQueueMutex();
+void dispatchFunctionsFromMainThread();
 
 } // namespace WTF
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h b/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h
index 76488b4..324300d 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MathExtras.h
@@ -39,10 +39,8 @@
 #endif
 
 #if COMPILER(MSVC)
-#if PLATFORM(WIN_CE)
+#if PLATFORM(WINCE)
 #include <stdlib.h>
-#else
-#include <xmath.h>
 #endif
 #include <limits>
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h b/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h
index 481211d..7721dba 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/MessageQueue.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,6 +30,7 @@
 #ifndef MessageQueue_h
 #define MessageQueue_h
 
+#include <limits>
 #include <wtf/Assertions.h>
 #include <wtf/Deque.h>
 #include <wtf/Noncopyable.h>
@@ -36,14 +38,23 @@
 
 namespace WTF {
 
+    enum MessageQueueWaitResult {
+        MessageQueueTerminated,       // Queue was destroyed while waiting for message.
+        MessageQueueTimeout,          // Timeout was specified and it expired.
+        MessageQueueMessageReceived,  // A message was successfully received and returned.
+    };
+
     template<typename DataType>
     class MessageQueue : Noncopyable {
     public:
-        MessageQueue() : m_killed(false) {}
+        MessageQueue() : m_killed(false) { }
         
         void append(const DataType&);
+        bool appendAndCheckEmpty(const DataType&);
         void prepend(const DataType&);
         bool waitForMessage(DataType&);
+        template<typename Predicate>
+        MessageQueueWaitResult waitForMessageFilteredWithTimeout(DataType&, Predicate&, double absoluteTime);
         void kill();
 
         bool tryGetMessage(DataType&);
@@ -52,7 +63,11 @@ namespace WTF {
         // The result of isEmpty() is only valid if no other thread is manipulating the queue at the same time.
         bool isEmpty();
 
+        static double infiniteTime() { return std::numeric_limits<double>::max(); }
+
     private:
+        static bool alwaysTruePredicate(DataType&) { return true; }
+
         mutable Mutex m_mutex;
         ThreadCondition m_condition;
         Deque<DataType> m_queue;
@@ -67,6 +82,17 @@ namespace WTF {
         m_condition.signal();
     }
 
+    // Returns true if the queue was empty before the item was added.
+    template<typename DataType>
+    inline bool MessageQueue<DataType>::appendAndCheckEmpty(const DataType& message)
+    {
+        MutexLocker lock(m_mutex);
+        bool wasEmpty = m_queue.isEmpty();
+        m_queue.append(message);
+        m_condition.signal();
+        return wasEmpty;
+    }
+
     template<typename DataType>
     inline void MessageQueue<DataType>::prepend(const DataType& message)
     {
@@ -78,18 +104,34 @@ namespace WTF {
     template<typename DataType>
     inline bool MessageQueue<DataType>::waitForMessage(DataType& result)
     {
+        MessageQueueWaitResult exitReason = waitForMessageFilteredWithTimeout(result, MessageQueue<DataType>::alwaysTruePredicate, infiniteTime());
+        ASSERT(exitReason == MessageQueueTerminated || exitReason == MessageQueueMessageReceived);
+        return exitReason == MessageQueueMessageReceived;
+    }
+
+    template<typename DataType>
+    template<typename Predicate>
+    inline MessageQueueWaitResult MessageQueue<DataType>::waitForMessageFilteredWithTimeout(DataType& result, Predicate& predicate, double absoluteTime)
+    {
         MutexLocker lock(m_mutex);
-        
-        while (!m_killed && m_queue.isEmpty())
-            m_condition.wait(m_mutex);
+        bool timedOut = false;
+
+        DequeConstIterator<DataType> found = m_queue.end();
+        while (!m_killed && !timedOut && (found = m_queue.findIf(predicate)) == m_queue.end())
+            timedOut = !m_condition.timedWait(m_mutex, absoluteTime);
+
+        ASSERT(!timedOut || absoluteTime != infiniteTime());
 
         if (m_killed)
-            return false;
+            return MessageQueueTerminated;
 
-        ASSERT(!m_queue.isEmpty());
-        result = m_queue.first();
-        m_queue.removeFirst();
-        return true;
+        if (timedOut)
+            return MessageQueueTimeout;
+
+        ASSERT(found != m_queue.end());
+        result = *found;
+        m_queue.remove(found);
+        return MessageQueueMessageReceived;
     }
 
     template<typename DataType>
@@ -129,8 +171,13 @@ namespace WTF {
         MutexLocker lock(m_mutex);
         return m_killed;
     }
-}
+} // namespace WTF
 
 using WTF::MessageQueue;
+// MessageQueueWaitResult enum and all its values.
+using WTF::MessageQueueWaitResult;
+using WTF::MessageQueueTerminated;
+using WTF::MessageQueueTimeout;
+using WTF::MessageQueueMessageReceived;
 
 #endif // MessageQueue_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/NotFound.h b/src/3rdparty/webkit/JavaScriptCore/wtf/NotFound.h
index f0bb866..4263bce 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/NotFound.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/NotFound.h
@@ -32,4 +32,6 @@ namespace WTF {
 
 } // namespace WTF
 
+using WTF::notFound;
+
 #endif // NotFound_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnFastMallocPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnFastMallocPtr.h
new file mode 100644
index 0000000..5c0d064
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnFastMallocPtr.h
@@ -0,0 +1,52 @@
+/*
+ *  Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ *  Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef OwnFastMallocPtr_h
+#define OwnFastMallocPtr_h
+
+#include "FastMalloc.h"
+#include "Noncopyable.h"
+
+namespace WTF {
+
+    template<class T> class OwnFastMallocPtr : Noncopyable {
+    public:
+        explicit OwnFastMallocPtr(T* ptr) : m_ptr(ptr)
+        {
+        }
+
+        ~OwnFastMallocPtr()
+        {
+            fastFree(m_ptr);
+        }
+
+        T* get() const { return m_ptr; }
+        T* release() { T* ptr = m_ptr; m_ptr = 0; return ptr; }
+
+    private:
+        T* m_ptr;
+    };
+
+} // namespace WTF
+
+using WTF::OwnFastMallocPtr;
+
+#endif // OwnFastMallocPtr_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtr.h
index 256b55c..9e4bd32 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtr.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ *  Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -21,53 +21,35 @@
 #ifndef WTF_OwnPtr_h
 #define WTF_OwnPtr_h
 
+#include "Assertions.h"
+#include "Noncopyable.h"
+#include "OwnPtrCommon.h"
+#include "TypeTraits.h"
 #include <algorithm>
 #include <memory>
-#include <wtf/Assertions.h>
-#include <wtf/Noncopyable.h>
-
-#if PLATFORM(WIN)
-
-typedef struct HBITMAP__* HBITMAP;
-typedef struct HBRUSH__* HBRUSH;
-typedef struct HFONT__* HFONT;
-typedef struct HPALETTE__* HPALETTE;
-typedef struct HPEN__* HPEN;
-typedef struct HRGN__* HRGN;
-
-#endif
 
 namespace WTF {
 
     // Unlike most of our smart pointers, OwnPtr can take either the pointer type or the pointed-to type.
 
-    // FIXME: Share a single RemovePointer class template with RetainPtr.
-    template <typename T> struct OwnPtrRemovePointer { typedef T type; };
-    template <typename T> struct OwnPtrRemovePointer<T*> { typedef T type; };
-
-    template <typename T> inline void deleteOwnedPtr(T* ptr)
-    {
-        typedef char known[sizeof(T) ? 1 : -1];
-        if (sizeof(known))
-            delete ptr;
-    }
-
-#if PLATFORM(WIN)
-    void deleteOwnedPtr(HBITMAP);
-    void deleteOwnedPtr(HBRUSH);
-    void deleteOwnedPtr(HFONT);
-    void deleteOwnedPtr(HPALETTE);
-    void deleteOwnedPtr(HPEN);
-    void deleteOwnedPtr(HRGN);
-#endif
+    template <typename T> class PassOwnPtr;
 
     template <typename T> class OwnPtr : Noncopyable {
     public:
-        typedef typename OwnPtrRemovePointer<T>::type ValueType;
+        typedef typename RemovePointer<T>::Type ValueType;
         typedef ValueType* PtrType;
 
         explicit OwnPtr(PtrType ptr = 0) : m_ptr(ptr) { }
         OwnPtr(std::auto_ptr<ValueType> autoPtr) : m_ptr(autoPtr.release()) { }
+        // See comment in PassOwnPtr.h for why this takes a const reference.
+        template <typename U> OwnPtr(const PassOwnPtr<U>& o);
+
+        // This copy constructor is used implicitly by gcc when it generates
+        // transients for assigning a PassOwnPtr<T> object to a stack-allocated
+        // OwnPtr<T> object.  It should never be called explicitly and gcc
+        // should optimize away the constructor when generating code.
+        OwnPtr(const OwnPtr<ValueType>& o);
+
         ~OwnPtr() { deleteOwnedPtr(m_ptr); }
 
         PtrType get() const { return m_ptr; }
@@ -89,19 +71,50 @@ namespace WTF {
         typedef PtrType OwnPtr::*UnspecifiedBoolType;
         operator UnspecifiedBoolType() const { return m_ptr ? &OwnPtr::m_ptr : 0; }
 
+        OwnPtr& operator=(const PassOwnPtr<T>&);
+        template <typename U> OwnPtr& operator=(const PassOwnPtr<U>&);
+
         void swap(OwnPtr& o) { std::swap(m_ptr, o.m_ptr); }
 
     private:
         PtrType m_ptr;
     };
-    
-    template <typename T> inline void swap(OwnPtr<T>& a, OwnPtr<T>& b) { a.swap(b); }
+
+    template <typename T> template <typename U> inline OwnPtr<T>::OwnPtr(const PassOwnPtr<U>& o)
+        : m_ptr(o.release())
+    {
+    }
+
+    template <typename T> inline OwnPtr<T>& OwnPtr<T>::operator=(const PassOwnPtr<T>& o)
+    {
+        T* ptr = m_ptr;
+        m_ptr = o.release();
+        ASSERT(!ptr || m_ptr != ptr);
+        if (ptr)
+            deleteOwnedPtr(ptr);
+        return *this;
+    }
+
+    template <typename T> template <typename U> inline OwnPtr<T>& OwnPtr<T>::operator=(const PassOwnPtr<U>& o)
+    {
+        T* ptr = m_ptr;
+        m_ptr = o.release();
+        ASSERT(!ptr || m_ptr != ptr);
+        if (ptr)
+            deleteOwnedPtr(ptr);
+        return *this;
+    }
+
+    template <typename T> inline void swap(OwnPtr<T>& a, OwnPtr<T>& b)
+    {
+        a.swap(b);
+    }
 
     template <typename T, typename U> inline bool operator==(const OwnPtr<T>& a, U* b)
-    { 
+    {
         return a.get() == b; 
     }
-    
+
     template <typename T, typename U> inline bool operator==(T* a, const OwnPtr<U>& b) 
     {
         return a == b.get(); 
@@ -113,10 +126,10 @@ namespace WTF {
     }
 
     template <typename T, typename U> inline bool operator!=(T* a, const OwnPtr<U>& b)
-    { 
+    {
         return a != b.get(); 
     }
-    
+
     template <typename T> inline typename OwnPtr<T>::PtrType getPtr(const OwnPtr<T>& p)
     {
         return p.get();
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrCommon.h b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrCommon.h
new file mode 100644
index 0000000..6cd8bdd
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/OwnPtrCommon.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WTF_OwnPtrCommon_h
+#define WTF_OwnPtrCommon_h
+
+#if PLATFORM(WIN)
+typedef struct HBITMAP__* HBITMAP;
+typedef struct HBRUSH__* HBRUSH;
+typedef struct HFONT__* HFONT;
+typedef struct HPALETTE__* HPALETTE;
+typedef struct HPEN__* HPEN;
+typedef struct HRGN__* HRGN;
+#endif
+
+namespace WTF {
+
+    template <typename T> inline void deleteOwnedPtr(T* ptr)
+    {
+        typedef char known[sizeof(T) ? 1 : -1];
+        if (sizeof(known))
+            delete ptr;
+    }
+
+#if PLATFORM(WIN)
+    void deleteOwnedPtr(HBITMAP);
+    void deleteOwnedPtr(HBRUSH);
+    void deleteOwnedPtr(HFONT);
+    void deleteOwnedPtr(HPALETTE);
+    void deleteOwnedPtr(HPEN);
+    void deleteOwnedPtr(HRGN);
+#endif
+
+} // namespace WTF
+
+#endif // WTF_OwnPtrCommon_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/PassOwnPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/PassOwnPtr.h
new file mode 100644
index 0000000..ae70457
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/PassOwnPtr.h
@@ -0,0 +1,177 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WTF_PassOwnPtr_h
+#define WTF_PassOwnPtr_h
+
+#include "Assertions.h"
+#include "OwnPtrCommon.h"
+#include "TypeTraits.h"
+
+namespace WTF {
+
+    // Unlike most of our smart pointers, PassOwnPtr can take either the pointer type or the pointed-to type.
+
+    template <typename T> class OwnPtr;
+
+    template <typename T> class PassOwnPtr {
+    public:
+        typedef typename RemovePointer<T>::Type ValueType;
+        typedef ValueType* PtrType;
+
+        PassOwnPtr(PtrType ptr = 0) : m_ptr(ptr) { }
+        // It somewhat breaks the type system to allow transfer of ownership out of
+        // a const PassOwnPtr. However, it makes it much easier to work with PassOwnPtr
+        // temporaries, and we don't really have a need to use real const PassOwnPtrs 
+        // anyway.
+        PassOwnPtr(const PassOwnPtr& o) : m_ptr(o.release()) { }
+        template <typename U> PassOwnPtr(const PassOwnPtr<U>& o) : m_ptr(o.release()) { }
+
+        ~PassOwnPtr() { deleteOwnedPtr(m_ptr); }
+
+        PtrType get() const { return m_ptr; }
+
+        void clear() { m_ptr = 0; }
+        PtrType release() const { PtrType ptr = m_ptr; m_ptr = 0; return ptr; }
+
+        ValueType& operator*() const { ASSERT(m_ptr); return *m_ptr; }
+        PtrType operator->() const { ASSERT(m_ptr); return m_ptr; }
+
+        bool operator!() const { return !m_ptr; }
+
+        // This conversion operator allows implicit conversion to bool but not to other integer types.
+        typedef PtrType PassOwnPtr::*UnspecifiedBoolType;
+        operator UnspecifiedBoolType() const { return m_ptr ? &PassOwnPtr::m_ptr : 0; }
+
+        PassOwnPtr& operator=(T*);
+        PassOwnPtr& operator=(const PassOwnPtr<T>&);
+        template <typename U> PassOwnPtr& operator=(const PassOwnPtr<U>&);
+
+    private:
+        mutable PtrType m_ptr;
+    };
+
+    template <typename T> inline PassOwnPtr<T>& PassOwnPtr<T>::operator=(T* optr)
+    {
+        T* ptr = m_ptr;
+        m_ptr = optr;
+        ASSERT(!ptr || m_ptr != ptr);
+        if (ptr)
+            deleteOwnedPtr(ptr);
+        return *this;
+    }
+
+    template <typename T> inline PassOwnPtr<T>& PassOwnPtr<T>::operator=(const PassOwnPtr<T>& optr)
+    {
+        T* ptr = m_ptr;
+        m_ptr = optr.release();
+        ASSERT(!ptr || m_ptr != ptr);
+        if (ptr)
+            deleteOwnedPtr(ptr);
+        return *this;
+    }
+
+    template <typename T> template <typename U> inline PassOwnPtr<T>& PassOwnPtr<T>::operator=(const PassOwnPtr<U>& optr)
+    {
+        T* ptr = m_ptr;
+        m_ptr = optr.release();
+        ASSERT(!ptr || m_ptr != ptr);
+        if (ptr)
+            deleteOwnedPtr(ptr);
+        return *this;
+    }
+
+    template <typename T, typename U> inline bool operator==(const PassOwnPtr<T>& a, const PassOwnPtr<U>& b) 
+    {
+        return a.get() == b.get(); 
+    }
+
+    template <typename T, typename U> inline bool operator==(const PassOwnPtr<T>& a, const OwnPtr<U>& b) 
+    {
+        return a.get() == b.get(); 
+    }
+    
+    template <typename T, typename U> inline bool operator==(const OwnPtr<T>& a, const PassOwnPtr<U>& b) 
+    {
+        return a.get() == b.get(); 
+    }
+    
+    template <typename T, typename U> inline bool operator==(const PassOwnPtr<T>& a, U* b) 
+    {
+        return a.get() == b; 
+    }
+    
+    template <typename T, typename U> inline bool operator==(T* a, const PassOwnPtr<U>& b) 
+    {
+        return a == b.get(); 
+    }
+    
+    template <typename T, typename U> inline bool operator!=(const PassOwnPtr<T>& a, const PassOwnPtr<U>& b) 
+    {
+        return a.get() != b.get(); 
+    }
+    
+    template <typename T, typename U> inline bool operator!=(const PassOwnPtr<T>& a, const OwnPtr<U>& b) 
+    {
+        return a.get() != b.get(); 
+    }
+    
+    template <typename T, typename U> inline bool operator!=(const OwnPtr<T>& a, const PassOwnPtr<U>& b) 
+    {
+        return a.get() != b.get(); 
+    }
+    
+    template <typename T, typename U> inline bool operator!=(const PassOwnPtr<T>& a, U* b)
+    {
+        return a.get() != b; 
+    }
+    
+    template <typename T, typename U> inline bool operator!=(T* a, const PassOwnPtr<U>& b) 
+    {
+        return a != b.get(); 
+    }
+
+    template <typename T, typename U> inline PassOwnPtr<T> static_pointer_cast(const PassOwnPtr<U>& p) 
+    {
+        return PassOwnPtr<T>(static_cast<T*>(p.release())); 
+    }
+
+    template <typename T, typename U> inline PassOwnPtr<T> const_pointer_cast(const PassOwnPtr<U>& p) 
+    {
+        return PassOwnPtr<T>(const_cast<T*>(p.release())); 
+    }
+
+    template <typename T> inline T* getPtr(const PassOwnPtr<T>& p)
+    {
+        return p.get();
+    }
+
+} // namespace WTF
+
+using WTF::PassOwnPtr;
+using WTF::const_pointer_cast;
+using WTF::static_pointer_cast;
+
+#endif // WTF_PassOwnPtr_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h
index c1dc309..d80ed62 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/PassRefPtr.h
@@ -40,7 +40,7 @@ namespace WTF {
         PassRefPtr(const PassRefPtr& o) : m_ptr(o.releaseRef()) {}
         template <typename U> PassRefPtr(const PassRefPtr<U>& o) : m_ptr(o.releaseRef()) { }
 
-        ALWAYS_INLINE ~PassRefPtr() { if (T* ptr = m_ptr) ptr->deref(); }
+        ALWAYS_INLINE ~PassRefPtr() { if (UNLIKELY(m_ptr != 0)) m_ptr->deref(); }
         
         template <class U> 
         PassRefPtr(const RefPtr<U>& o) : m_ptr(o.get()) { if (T* ptr = m_ptr) ptr->ref(); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
index 6c27123..c82d1f7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Platform.h
@@ -40,6 +40,13 @@
 /* be used regardless of operating environment */
 #ifdef __APPLE__
 #define WTF_PLATFORM_DARWIN 1
+#include <AvailabilityMacros.h>
+#if !defined(MAC_OS_X_VERSION_10_5) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_5
+#define BUILDING_ON_TIGER 1
+#elif !defined(MAC_OS_X_VERSION_10_6) || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_6
+#define BUILDING_ON_LEOPARD 1
+#endif
+#include <TargetConditionals.h>
 #endif
 
 /* PLATFORM(WIN_OS) */
@@ -49,15 +56,22 @@
 #define WTF_PLATFORM_WIN_OS 1
 #endif
 
-/* PLATFORM(WIN_CE) */
+/* PLATFORM(WINCE) */
 /* Operating system level dependencies for Windows CE that should be used */
 /* regardless of operating environment */
 /* Note that for this platform PLATFORM(WIN_OS) is also defined. */
 #if defined(_WIN32_WCE)
-#define WTF_PLATFORM_WIN_CE 1
+#define WTF_PLATFORM_WINCE 1
 #include <ce_time.h>
 #endif
 
+/* PLATFORM(LINUX) */
+/* Operating system level dependencies for Linux-like systems that */
+/* should be used regardless of operating environment */
+#ifdef __linux__
+#define WTF_PLATFORM_LINUX 1
+#endif
+
 /* PLATFORM(FREEBSD) */
 /* Operating system level dependencies for FreeBSD-like systems that */
 /* should be used regardless of operating environment */
@@ -137,11 +151,30 @@
 #define WTF_PLATFORM_WIN 1
 #endif
 
+/* PLATFORM(IPHONE) */
+#if (defined(TARGET_OS_EMBEDDED) && TARGET_OS_EMBEDDED) || (defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE)
+#define WTF_PLATFORM_IPHONE 1
+#endif
+
+/* PLATFORM(IPHONE_SIMULATOR) */
+#if defined(TARGET_IPHONE_SIMULATOR) && TARGET_IPHONE_SIMULATOR
+#define WTF_PLATFORM_IPHONE 1
+#define WTF_PLATFORM_IPHONE_SIMULATOR 1
+#else
+#define WTF_PLATFORM_IPHONE_SIMULATOR 0
+#endif
+
+#if !defined(WTF_PLATFORM_IPHONE)
+#define WTF_PLATFORM_IPHONE 0
+#endif
+
 /* Graphics engines */
 
 /* PLATFORM(CG) and PLATFORM(CI) */
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || PLATFORM(IPHONE)
 #define WTF_PLATFORM_CG 1
+#endif
+#if PLATFORM(MAC) && !PLATFORM(IPHONE)
 #define WTF_PLATFORM_CI 1
 #endif
 
@@ -195,7 +228,29 @@
 #if !defined(__ARM_EABI__)
 #define WTF_PLATFORM_FORCE_PACK 1
 #endif
+#define ARM_ARCH_VERSION 3
+#if defined(__ARM_ARCH_4__) || defined(__ARM_ARCH_4T__)
+#undef ARM_ARCH_VERSION
+#define ARM_ARCH_VERSION 4
+#endif
+#if defined(__ARM_ARCH_5__) || defined(__ARM_ARCH_5T__) \
+        || defined(__ARM_ARCH_5E__) || defined(__ARM_ARCH_5TE__) \
+        || defined(__ARM_ARCH_5TEJ__)
+#undef ARM_ARCH_VERSION
+#define ARM_ARCH_VERSION 5
+#endif
+#if defined(__ARM_ARCH_6__) || defined(__ARM_ARCH_6J__) \
+     || defined(__ARM_ARCH_6K__) || defined(__ARM_ARCH_6Z__) \
+     || defined(__ARM_ARCH_6ZK__)
+#undef ARM_ARCH_VERSION
+#define ARM_ARCH_VERSION 6
 #endif
+#if defined(__ARM_ARCH_7A__)
+#undef ARM_ARCH_VERSION
+#define ARM_ARCH_VERSION 7
+#endif
+#endif /* ARM */
+#define PLATFORM_ARM_ARCH(N) (PLATFORM(ARM) && ARM_ARCH_VERSION >= N)
 
 /* PLATFORM(X86) */
 #if   defined(__i386__) \
@@ -208,23 +263,27 @@
 
 /* PLATFORM(X86_64) */
 #if   defined(__x86_64__) \
-   || defined(__ia64__) \
    || defined(_M_X64)
 #define WTF_PLATFORM_X86_64 1
 #endif
 
+/* PLATFORM(SH4) */
+#if defined(__SH4__)
+#define WTF_PLATFORM_SH4 1
+#endif
+
 /* PLATFORM(SPARC64) */
 #if defined(__sparc64__)
 #define WTF_PLATFORM_SPARC64 1
 #define WTF_PLATFORM_BIG_ENDIAN 1
 #endif
 
-/* PLATFORM(WIN_CE) && PLATFORM(QT)
+/* PLATFORM(WINCE) && PLATFORM(QT)
    We can not determine the endianess at compile time. For
    Qt for Windows CE the endianess is specified in the
    device specific makespec
 */
-#if PLATFORM(WIN_CE) && PLATFORM(QT)
+#if PLATFORM(WINCE) && PLATFORM(QT)
 #   include <QtGlobal>
 #   undef WTF_PLATFORM_BIG_ENDIAN
 #   undef WTF_PLATFORM_MIDDLE_ENDIAN
@@ -276,7 +335,7 @@
 #define WTF_COMPILER_WINSCW 1
 #endif
 
-#if (PLATFORM(MAC) || PLATFORM(WIN)) && !defined(ENABLE_JSC_MULTIPLE_THREADS)
+#if (PLATFORM(IPHONE) || PLATFORM(MAC) || PLATFORM(WIN)) && !defined(ENABLE_JSC_MULTIPLE_THREADS)
 #define ENABLE_JSC_MULTIPLE_THREADS 1
 #endif
 
@@ -291,7 +350,7 @@
 #define WTF_USE_ICU_UNICODE 1
 #endif
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) && !PLATFORM(IPHONE)
 #define WTF_PLATFORM_CF 1
 #define WTF_USE_PTHREADS 1
 #if !defined(ENABLE_MAC_JAVA_BRIDGE)
@@ -301,9 +360,7 @@
 #define ENABLE_DASHBOARD_SUPPORT 1
 #endif
 #define HAVE_READLINE 1
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
-#define HAVE_DTRACE 1
-#endif
+#define HAVE_RUNLOOP_TIMER 1
 #endif
 
 #if PLATFORM(CHROMIUM) && PLATFORM(DARWIN)
@@ -311,11 +368,24 @@
 #define WTF_USE_PTHREADS 1
 #endif
 
+#if PLATFORM(IPHONE)
+#define WTF_PLATFORM_CF 1
+#define WTF_USE_PTHREADS 1
+#define ENABLE_FTPDIR 1
+#define ENABLE_MAC_JAVA_BRIDGE 0
+#define ENABLE_ICONDATABASE 0
+#define ENABLE_GEOLOCATION 1
+#define ENABLE_NETSCAPE_PLUGIN_API 0
+#define HAVE_READLINE 1
+#define ENABLE_REPAINT_THROTTLING 1
+#endif
+
 #if PLATFORM(WIN)
 #define WTF_USE_WININET 1
 #endif
 
 #if PLATFORM(WX)
+#define ENABLE_ASSEMBLER 1
 #define WTF_USE_CURL 1
 #define WTF_USE_PTHREADS 1
 #endif
@@ -327,18 +397,15 @@
 #endif
 
 #if !defined(HAVE_ACCESSIBILITY)
-#if PLATFORM(MAC) || PLATFORM(WIN) || PLATFORM(GTK) || PLATFORM(CHROMIUM)
+#if PLATFORM(IPHONE) || PLATFORM(MAC) || PLATFORM(WIN) || PLATFORM(GTK) || PLATFORM(CHROMIUM)
 #define HAVE_ACCESSIBILITY 1
 #endif
 #endif /* !defined(HAVE_ACCESSIBILITY) */
 
-#if COMPILER(GCC)
-#define HAVE_COMPUTED_GOTO 1
-#endif
-
 #if PLATFORM(DARWIN)
 
 #define HAVE_ERRNO_H 1
+#define HAVE_LANGINFO_H 1
 #define HAVE_MMAP 1
 #define HAVE_MERGESORT 1
 #define HAVE_SBRK 1
@@ -347,10 +414,19 @@
 #define HAVE_SYS_TIME_H 1
 #define HAVE_SYS_TIMEB_H 1
 
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !PLATFORM(IPHONE)
+#define HAVE_MADV_FREE_REUSE 1
+#define HAVE_MADV_FREE 1
+#endif
+
+#if PLATFORM(IPHONE)
+#define HAVE_MADV_FREE 1
+#endif
+
 #elif PLATFORM(WIN_OS)
 
 #define HAVE_FLOAT_H 1
-#if PLATFORM(WIN_CE)
+#if PLATFORM(WINCE)
 #define HAVE_ERRNO_H 0
 #else
 #define HAVE_SYS_TIMEB_H 1
@@ -375,6 +451,7 @@
 /* FIXME: is this actually used or do other platforms generate their own config.h? */
 
 #define HAVE_ERRNO_H 1
+#define HAVE_LANGINFO_H 1
 #define HAVE_MMAP 1
 #define HAVE_SBRK 1
 #define HAVE_STRINGS_H 1
@@ -385,6 +462,12 @@
 
 /* ENABLE macro defaults */
 
+/* fastMalloc match validation allows for runtime verification that
+   new is matched by delete, fastMalloc is matched by fastFree, etc. */
+#if !defined(ENABLE_FAST_MALLOC_MATCH_VALIDATION)
+#define ENABLE_FAST_MALLOC_MATCH_VALIDATION 0
+#endif
+
 #if !defined(ENABLE_ICONDATABASE)
 #define ENABLE_ICONDATABASE 1
 #endif
@@ -417,16 +500,15 @@
 #define ENABLE_OPCODE_STATS 0
 #endif
 
-#if !defined(ENABLE_CODEBLOCK_SAMPLING)
+#define ENABLE_SAMPLING_COUNTERS 0
+#define ENABLE_SAMPLING_FLAGS 0
+#define ENABLE_OPCODE_SAMPLING 0
 #define ENABLE_CODEBLOCK_SAMPLING 0
+#if ENABLE(CODEBLOCK_SAMPLING) && !ENABLE(OPCODE_SAMPLING)
+#error "CODEBLOCK_SAMPLING requires OPCODE_SAMPLING"
 #endif
-
-#if ENABLE(CODEBLOCK_SAMPLING) && !defined(ENABLE_OPCODE_SAMPLING)
-#define ENABLE_OPCODE_SAMPLING 1
-#endif
-
-#if !defined(ENABLE_OPCODE_SAMPLING)
-#define ENABLE_OPCODE_SAMPLING 0
+#if ENABLE(OPCODE_SAMPLING) || ENABLE(SAMPLING_FLAGS)
+#define ENABLE_SAMPLING_THREAD 1
 #endif
 
 #if !defined(ENABLE_GEOLOCATION)
@@ -437,51 +519,95 @@
 #define ENABLE_TEXT_CARET 1
 #endif
 
+#if !defined(ENABLE_ON_FIRST_TEXTAREA_FOCUS_SELECT_ALL)
+#define ENABLE_ON_FIRST_TEXTAREA_FOCUS_SELECT_ALL 0
+#endif
+
+#if !defined(WTF_USE_ALTERNATE_JSIMMEDIATE) && PLATFORM(X86_64) && PLATFORM(MAC)
+#define WTF_USE_ALTERNATE_JSIMMEDIATE 1
+#endif
+
+#if !defined(ENABLE_REPAINT_THROTTLING)
+#define ENABLE_REPAINT_THROTTLING 0
+#endif
+
 #if !defined(ENABLE_JIT)
-/* x86-64 support is under development. */
+/* The JIT is tested & working on x86_64 Mac */
 #if PLATFORM(X86_64) && PLATFORM(MAC)
-    #define ENABLE_JIT 0
-    #define WTF_USE_JIT_STUB_ARGUMENT_REGISTER 1
-    #define ENABLE_JIT_OPTIMIZE_CALL 1
-    #define ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS 1
-    #define WTF_USE_ALTERNATE_JSIMMEDIATE 1
+    #define ENABLE_JIT 1
 /* The JIT is tested & working on x86 Mac */
 #elif PLATFORM(X86) && PLATFORM(MAC)
     #define ENABLE_JIT 1
     #define WTF_USE_JIT_STUB_ARGUMENT_VA_LIST 1
-    #define ENABLE_JIT_OPTIMIZE_CALL 1
-    #define ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS 1
-    #define ENABLE_JIT_OPTIMIZE_ARITHMETIC 1
+#elif PLATFORM_ARM_ARCH(7) && PLATFORM(IPHONE)
+    /* Under development, temporarily disabled until 16Mb link range limit in assembler is fixed. */
+    #define ENABLE_JIT 0
+    #define ENABLE_JIT_OPTIMIZE_NATIVE_CALL 0
 /* The JIT is tested & working on x86 Windows */
 #elif PLATFORM(X86) && PLATFORM(WIN)
     #define ENABLE_JIT 1
-    #define WTF_USE_JIT_STUB_ARGUMENT_REGISTER 1
-    #define ENABLE_JIT_OPTIMIZE_CALL 1
-    #define ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS 1
-    #define ENABLE_JIT_OPTIMIZE_ARITHMETIC 1
 #endif
 #endif
 
-#if ENABLE(JIT)
-#if !(USE(JIT_STUB_ARGUMENT_VA_LIST) || USE(JIT_STUB_ARGUMENT_REGISTER) || USE(JIT_STUB_ARGUMENT_STACK))
-#error Please define one of the JIT_STUB_ARGUMENT settings.
-#elif (USE(JIT_STUB_ARGUMENT_VA_LIST) && USE(JIT_STUB_ARGUMENT_REGISTER)) \
-   || (USE(JIT_STUB_ARGUMENT_VA_LIST) && USE(JIT_STUB_ARGUMENT_STACK)) \
-   || (USE(JIT_STUB_ARGUMENT_REGISTER) && USE(JIT_STUB_ARGUMENT_STACK))
-#error Please do not define more than one of the JIT_STUB_ARGUMENT settings.
+#ifndef ENABLE_JIT_OPTIMIZE_CALL
+#define ENABLE_JIT_OPTIMIZE_CALL 1
 #endif
+#ifndef ENABLE_JIT_OPTIMIZE_NATIVE_CALL
+#define ENABLE_JIT_OPTIMIZE_NATIVE_CALL 1
+#endif
+#ifndef ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS
+#define ENABLE_JIT_OPTIMIZE_PROPERTY_ACCESS 1
+#endif
+#ifndef ENABLE_JIT_OPTIMIZE_ARITHMETIC
+#define ENABLE_JIT_OPTIMIZE_ARITHMETIC 1
+#endif
+#ifndef ENABLE_JIT_OPTIMIZE_METHOD_CALLS
+#define ENABLE_JIT_OPTIMIZE_METHOD_CALLS 1
 #endif
 
-/* WREC supports x86 & x86-64, and has been tested on Mac and Windows ('cept on 64-bit on Mac). */
-#if (!defined(ENABLE_WREC) && PLATFORM(X86) && PLATFORM(MAC)) \
- || (!defined(ENABLE_WREC) && PLATFORM(X86_64) && PLATFORM(MAC)) \
- || (!defined(ENABLE_WREC) && PLATFORM(X86) && PLATFORM(WIN))
-#define ENABLE_WREC 1
+#if PLATFORM(X86) && COMPILER(MSVC)
+#define JSC_HOST_CALL __fastcall
+#elif PLATFORM(X86) && COMPILER(GCC)
+#define JSC_HOST_CALL __attribute__ ((fastcall))
+#else
+#define JSC_HOST_CALL
 #endif
 
-#if ENABLE(JIT) || ENABLE(WREC)
+#if COMPILER(GCC) && !ENABLE(JIT)
+#define HAVE_COMPUTED_GOTO 1
+#endif
+
+#if ENABLE(JIT) && defined(COVERAGE)
+    #define WTF_USE_INTERPRETER 0
+#else
+    #define WTF_USE_INTERPRETER 1
+#endif
+
+/* Yet Another Regex Runtime. */
+/* YARR supports x86 & x86-64, and has been tested on Mac and Windows. */
+#if (!defined(ENABLE_YARR_JIT) && PLATFORM(X86) && PLATFORM(MAC)) \
+ || (!defined(ENABLE_YARR_JIT) && PLATFORM(X86_64) && PLATFORM(MAC)) \
+ /* Under development, temporarily disabled until 16Mb link range limit in assembler is fixed. */ \
+ || (!defined(ENABLE_YARR_JIT) && PLATFORM_ARM_ARCH(7) && PLATFORM(IPHONE) && 0) \
+ || (!defined(ENABLE_YARR_JIT) && PLATFORM(X86) && PLATFORM(WIN))
+#define ENABLE_YARR 1
+#define ENABLE_YARR_JIT 1
+#endif
+/* Sanity Check */
+#if ENABLE(YARR_JIT) && !ENABLE(YARR)
+#error "YARR_JIT requires YARR"
+#endif
+
+#if ENABLE(JIT) || ENABLE(YARR_JIT)
 #define ENABLE_ASSEMBLER 1
 #endif
+/* Setting this flag prevents the assembler from using RWX memory; this may improve
+   security but currectly comes at a significant performance cost. */
+#if PLATFORM_ARM_ARCH(7) && PLATFORM(IPHONE)
+#define ENABLE_ASSEMBLER_WX_EXCLUSIVE 1
+#else
+#define ENABLE_ASSEMBLER_WX_EXCLUSIVE 0
+#endif
 
 #if !defined(ENABLE_PAN_SCROLLING) && PLATFORM(WIN_OS)
 #define ENABLE_PAN_SCROLLING 1
@@ -502,4 +628,15 @@
 #define WTF_USE_FONT_FAST_PATH 1
 #endif
 
+/* Accelerated compositing */
+#if PLATFORM(MAC)
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#define WTF_USE_ACCELERATED_COMPOSITING 1
+#endif
+#endif
+
+#if PLATFORM(IPHONE)
+#define WTF_USE_ACCELERATED_COMPOSITING 1
+#endif
+
 #endif /* WTF_Platform_h */
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/PtrAndFlags.h b/src/3rdparty/webkit/JavaScriptCore/wtf/PtrAndFlags.h
new file mode 100644
index 0000000..477e893
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/PtrAndFlags.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PtrAndFlags_h
+#define PtrAndFlags_h
+
+#include <wtf/Assertions.h>
+
+namespace WTF {
+    template<class T, typename FlagEnum> class PtrAndFlags {
+    public:
+        PtrAndFlags() : m_ptrAndFlags(0) {}
+
+        bool isFlagSet(FlagEnum flagNumber) const { ASSERT(flagNumber < 2); return m_ptrAndFlags & (1 << flagNumber); }
+        void setFlag(FlagEnum flagNumber) { ASSERT(flagNumber < 2); m_ptrAndFlags |= (1 << flagNumber);}
+        void clearFlag(FlagEnum flagNumber) { ASSERT(flagNumber < 2); m_ptrAndFlags &= ~(1 << flagNumber);}
+        T* get() const { return reinterpret_cast<T*>(m_ptrAndFlags & ~3); }
+        void set(T* ptr) { ASSERT(!(reinterpret_cast<intptr_t>(ptr) & 3)); m_ptrAndFlags = reinterpret_cast<intptr_t>(ptr) | (m_ptrAndFlags & 3);}
+    private:
+        intptr_t m_ptrAndFlags;
+    };
+} // namespace WTF
+
+using WTF::PtrAndFlags;
+
+#endif // PtrAndFlags_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp
index e569227..c94d5a4 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.cpp
@@ -36,6 +36,16 @@
 
 namespace WTF {
 
+double weakRandomNumber()
+{
+#if COMPILER(MSVC) && defined(_CRT_RAND_S)
+    // rand_s is incredibly slow on windows so we fall back on rand for Math.random
+    return (rand() + (rand() / (RAND_MAX + 1.0))) / (RAND_MAX + 1.0);
+#else
+    return randomNumber();
+#endif
+}
+
 double randomNumber()
 {
 #if !ENABLE(JSC_MULTIPLE_THREADS)
@@ -46,42 +56,39 @@ double randomNumber()
     }
 #endif
     
-    uint32_t part1;
-    uint32_t part2;
-    uint64_t fullRandom;
 #if COMPILER(MSVC) && defined(_CRT_RAND_S)
-    rand_s(&part1);
-    rand_s(&part2);
-    fullRandom = part1;
-    fullRandom <<= 32;
-    fullRandom |= part2;
+    uint32_t bits;
+    rand_s(&bits);
+    return static_cast<double>(bits) / (static_cast<double>(std::numeric_limits<uint32_t>::max()) + 1.0);
 #elif PLATFORM(DARWIN)
-    part1 = arc4random();
-    part2 = arc4random();
-    fullRandom = part1;
-    fullRandom <<= 32;
-    fullRandom |= part2;
+    uint32_t bits = arc4random();
+    return static_cast<double>(bits) / (static_cast<double>(std::numeric_limits<uint32_t>::max()) + 1.0);
 #elif PLATFORM(UNIX)
-    part1 = random() & (RAND_MAX - 1);
-    part2 = random() & (RAND_MAX - 1);
+    uint32_t part1 = random() & (RAND_MAX - 1);
+    uint32_t part2 = random() & (RAND_MAX - 1);
     // random only provides 31 bits
-    fullRandom = part1;
+    uint64_t fullRandom = part1;
     fullRandom <<= 31;
     fullRandom |= part2;
+
+    // Mask off the low 53bits
+    fullRandom &= (1LL << 53) - 1;
+    return static_cast<double>(fullRandom)/static_cast<double>(1LL << 53);
 #else
-    part1 = rand() & (RAND_MAX - 1);
-    part2 = rand() & (RAND_MAX - 1);
+    uint32_t part1 = rand() & (RAND_MAX - 1);
+    uint32_t part2 = rand() & (RAND_MAX - 1);
     // rand only provides 31 bits, and the low order bits of that aren't very random
     // so we take the high 26 bits of part 1, and the high 27 bits of part2.
     part1 >>= 5; // drop the low 5 bits
     part2 >>= 4; // drop the low 4 bits
-    fullRandom = part1;
+    uint64_t fullRandom = part1;
     fullRandom <<= 27;
     fullRandom |= part2;
-#endif
+
     // Mask off the low 53bits
     fullRandom &= (1LL << 53) - 1;
     return static_cast<double>(fullRandom)/static_cast<double>(1LL << 53);
+#endif
 }
 
 }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.h b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.h
index 3540344..fe1687c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumber.h
@@ -28,9 +28,15 @@
 
 namespace WTF {
 
-    // Returns a pseudo-random number in the range [0, 1)
+    // Returns a pseudo-random number in the range [0, 1), attempts to be
+    // cryptographically secure if possible on the target platform
     double randomNumber();
 
+    // Returns a pseudo-random number in the range [0, 1), attempts to
+    // produce a reasonable "random" number fast.
+    // We only need this because rand_s is so slow on windows.
+    double weakRandomNumber();
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumberSeed.h b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumberSeed.h
index c7af3d6..32291dd 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumberSeed.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RandomNumberSeed.h
@@ -38,7 +38,7 @@
 #include <unistd.h>
 #endif
 
-#if PLATFORM(WIN_CE)
+#if PLATFORM(WINCE)
 #include <ce_time.h>
 #endif
 
@@ -61,6 +61,15 @@ inline void initializeRandomNumberGenerator()
 #endif
 }
 
+inline void initializeWeakRandomNumberGenerator()
+{
+#if COMPILER(MSVC) && defined(_CRT_RAND_S)
+    // We need to initialise windows rand() explicitly for Math.random
+    unsigned seed = 0;
+    rand_s(&seed);
+    srand(seed);
+#endif
+}
 }
 
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RefCounted.h b/src/3rdparty/webkit/JavaScriptCore/wtf/RefCounted.h
index ac8e167..c174145 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RefCounted.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RefCounted.h
@@ -49,15 +49,17 @@ public:
     }
 
 protected:
-    RefCountedBase(int initialRefCount)
-        : m_refCount(initialRefCount)
+    RefCountedBase()
+        : m_refCount(1)
 #ifndef NDEBUG
         , m_deletionHasBegun(false)
 #endif
     {
     }
 
-    ~RefCountedBase() {}
+    ~RefCountedBase()
+    {
+    }
 
     // Returns whether the pointer should be freed or not.
     bool derefBase()
@@ -75,7 +77,23 @@ protected:
         return false;
     }
 
-protected:
+    // Helper for generating JIT code. Please do not use for non-JIT purposes.
+    int* addressOfCount()
+    {
+        return &m_refCount;
+    }
+
+#ifndef NDEBUG
+    bool deletionHasBegun() const
+    {
+        return m_deletionHasBegun;
+    }
+#endif
+
+private:
+    template<class T>
+    friend class CrossThreadRefCounted;
+
     int m_refCount;
 #ifndef NDEBUG
     bool m_deletionHasBegun;
@@ -85,11 +103,6 @@ protected:
 
 template<class T> class RefCounted : public RefCountedBase {
 public:
-    RefCounted(int initialRefCount = 1)
-        : RefCountedBase(initialRefCount)
-    {
-    }
-
     void deref()
     {
         if (derefBase())
@@ -97,7 +110,9 @@ public:
     }
 
 protected:
-    ~RefCounted() {}
+    ~RefCounted()
+    {
+    }
 };
 
 } // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h
index 929e745..74cd0ea 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RefPtr.h
@@ -23,6 +23,7 @@
 
 #include <algorithm>
 #include "AlwaysInline.h"
+#include "FastAllocBase.h"
 
 namespace WTF {
 
@@ -32,7 +33,7 @@ namespace WTF {
 
     enum HashTableDeletedValueType { HashTableDeletedValue };
 
-    template <typename T> class RefPtr {
+    template <typename T> class RefPtr : public FastAllocBase {
     public:
         RefPtr() : m_ptr(0) { }
         RefPtr(T* ptr) : m_ptr(ptr) { if (ptr) ptr->ref(); }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/RetainPtr.h b/src/3rdparty/webkit/JavaScriptCore/wtf/RetainPtr.h
index a66a127..77f25e0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/RetainPtr.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/RetainPtr.h
@@ -21,6 +21,7 @@
 #ifndef RetainPtr_h
 #define RetainPtr_h
 
+#include "TypeTraits.h"
 #include <algorithm>
 #include <CoreFoundation/CoreFoundation.h>
 
@@ -30,14 +31,6 @@
 
 namespace WTF {
 
-    template <typename T> struct RemovePointer {
-        typedef T type;
-    };
-
-    template <typename T> struct RemovePointer<T*> {
-        typedef T type;
-    };
-
     // Unlike most most of our smart pointers, RetainPtr can take either the pointer type or the pointed-to type,
     // so both RetainPtr<NSDictionary> and RetainPtr<CFDictionaryRef> will work.
 
@@ -56,7 +49,7 @@ namespace WTF {
 
     template <typename T> class RetainPtr {
     public:
-        typedef typename RemovePointer<T>::type ValueType;
+        typedef typename RemovePointer<T>::Type ValueType;
         typedef ValueType* PtrType;
 
         RetainPtr() : m_ptr(0) {}
diff --git a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/SegmentedVector.h b/src/3rdparty/webkit/JavaScriptCore/wtf/SegmentedVector.h
index bbab04f..065c19c 100644
--- a/src/3rdparty/webkit/JavaScriptCore/bytecompiler/SegmentedVector.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/SegmentedVector.h
@@ -31,13 +31,79 @@
 
 #include <wtf/Vector.h>
 
-namespace JSC {
+namespace WTF {
+
+    // An iterator for SegmentedVector. It supports only the pre ++ operator
+    template <typename T, size_t SegmentSize> class SegmentedVector;
+    template <typename T, size_t SegmentSize> class SegmentedVectorIterator {
+    private:
+        friend class SegmentedVector<T, SegmentSize>;
+    public:
+        typedef SegmentedVectorIterator<T, SegmentSize> Iterator;
+
+        ~SegmentedVectorIterator() { }
+
+        T& operator*() const { return m_vector.m_segments.at(m_segment)->at(m_index); }
+        T* operator->() const { return &m_vector.m_segments.at(m_segment)->at(m_index); }
+
+        // Only prefix ++ operator supported
+        Iterator& operator++()
+        {
+            ASSERT(m_index != SegmentSize);
+            ++m_index;
+            if (m_index >= m_vector.m_segments.at(m_segment)->size())  {
+                if (m_segment + 1 < m_vector.m_segments.size()) {
+                    ASSERT(m_vector.m_segments.at(m_segment)->size() > 0);
+                    ++m_segment;
+                    m_index = 0;
+                } else {
+                    // Points to the "end" symbol
+                    m_segment = 0;
+                    m_index = SegmentSize;
+                }
+            }
+            return *this;
+        }
+
+        bool operator==(const Iterator& other) const
+        {
+            return (m_index == other.m_index && m_segment = other.m_segment && &m_vector == &other.m_vector);
+        }
+
+        bool operator!=(const Iterator& other) const
+        {
+            return (m_index != other.m_index || m_segment != other.m_segment || &m_vector != &other.m_vector);
+        }
+
+        SegmentedVectorIterator& operator=(const SegmentedVectorIterator<T, SegmentSize>& other)
+        {
+            m_vector = other.m_vector;
+            m_segment = other.m_segment;
+            m_index = other.m_index;
+            return *this;
+        }
+
+    private:
+        SegmentedVectorIterator(SegmentedVector<T, SegmentSize>& vector, size_t segment, size_t index)
+            : m_vector(vector)
+            , m_segment(segment)
+            , m_index(index)
+        {
+        }
+
+        SegmentedVector<T, SegmentSize>& m_vector;
+        size_t m_segment;
+        size_t m_index;
+    };
 
     // SegmentedVector is just like Vector, but it doesn't move the values
     // stored in its buffer when it grows. Therefore, it is safe to keep
     // pointers into a SegmentedVector.
     template <typename T, size_t SegmentSize> class SegmentedVector {
+        friend class SegmentedVectorIterator<T, SegmentSize>;
     public:
+        typedef SegmentedVectorIterator<T, SegmentSize> Iterator;
+
         SegmentedVector()
             : m_size(0)
         {
@@ -82,6 +148,12 @@ namespace JSC {
             segmentFor(m_size - 1)->uncheckedAppend(value);
         }
 
+        T& alloc()
+        {
+            append<T>(T());
+            return last();
+        }
+
         void removeLast()
         {
             if (m_size <= SegmentSize)
@@ -106,9 +178,19 @@ namespace JSC {
             m_size = 0;
         }
 
+        Iterator begin()
+        {
+            return Iterator(*this, 0, m_size ? 0 : SegmentSize);
+        }
+
+        Iterator end()
+        {
+            return Iterator(*this, 0, SegmentSize);
+        }
+
     private:
         typedef Vector<T, SegmentSize> Segment;
-        
+
         void deleteAllSegments()
         {
             // Skip the first segment, because it's our inline segment, which was
@@ -116,22 +198,22 @@ namespace JSC {
             for (size_t i = 1; i < m_segments.size(); i++)
                 delete m_segments[i];
         }
-        
+
         bool segmentExistsFor(size_t index)
         {
             return index / SegmentSize < m_segments.size();
         }
-        
+
         Segment* segmentFor(size_t index)
         {
             return m_segments[index / SegmentSize];
         }
-        
+
         size_t subscriptFor(size_t index)
         {
             return index % SegmentSize;
         }
-        
+
         void ensureSegmentsFor(size_t size)
         {
             size_t segmentCount = m_size / SegmentSize;
@@ -147,7 +229,7 @@ namespace JSC {
             size_t end = neededSegmentCount - 1;
             for (size_t i = segmentCount - 1; i < end; ++i)
                 ensureSegment(i, SegmentSize);
-            
+
             // Grow segment N to accomodate the remainder.
             ensureSegment(end, subscriptFor(size - 1) + 1);
         }
@@ -165,6 +247,6 @@ namespace JSC {
         Vector<Segment*, 32> m_segments;
     };
 
-} // namespace JSC
+} // namespace WTF
 
 #endif // SegmentedVector_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h b/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h
index ddc5a58..afc5e8a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/StdLibExtras.h
@@ -23,7 +23,11 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#ifndef WTF_StdLibExtras_h
+#define WTF_StdLibExtras_h
+
 #include <wtf/Platform.h>
+#include <wtf/Assertions.h>
 
 // Use these to declare and define a static local variable (static T;) so that
 //  it is leaked so that its destructors are not called at exit. Using this
@@ -36,3 +40,24 @@
 #define DEFINE_STATIC_LOCAL(type, name, arguments) \
     static type& name = *new type arguments
 #endif
+
+namespace WTF {
+
+    /*
+     * C++'s idea of a reinterpret_cast lacks sufficient cojones.
+     */
+    template<typename TO, typename FROM>
+    TO bitwise_cast(FROM from)
+    {
+        COMPILE_ASSERT(sizeof(TO) == sizeof(FROM), WTF_bitwise_cast_sizeof_casted_types_is_equal);
+        union {
+            FROM from;
+            TO to;
+        } u;
+        u.from = from;
+        return u.to;
+    }
+
+} // namespace WTF
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h b/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
index 881b066..1c23390 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/StringExtras.h
@@ -29,6 +29,10 @@
 #include <stdarg.h>
 #include <stdio.h>
 
+#if HAVE(STRINGS_H) 
+#include <strings.h> 
+#endif 
+
 #if COMPILER(MSVC)
 
 inline int snprintf(char* buffer, size_t count, const char* format, ...) 
@@ -41,7 +45,7 @@ inline int snprintf(char* buffer, size_t count, const char* format, ...)
     return result;
 }
 
-#if COMPILER(MSVC7) || PLATFORM(WIN_CE)
+#if COMPILER(MSVC7) || PLATFORM(WINCE)
 
 inline int vsnprintf(char* buffer, size_t count, const char* format, va_list args)
 {
@@ -50,7 +54,7 @@ inline int vsnprintf(char* buffer, size_t count, const char* format, va_list arg
 
 #endif
 
-#if PLATFORM(WIN_CE)
+#if PLATFORM(WINCE)
 
 inline int strnicmp(const char* string1, const char* string2, size_t count)
 {
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TCPageMap.h b/src/3rdparty/webkit/JavaScriptCore/wtf/TCPageMap.h
index 21a87e4..3f56c24 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/TCPageMap.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TCPageMap.h
@@ -54,7 +54,6 @@
 #endif
 
 #include <string.h>
-
 #include "Assertions.h"
 
 // Single-level array
@@ -164,7 +163,7 @@ class TCMalloc_PageMap2 {
 
 #ifdef WTF_CHANGES
   template<class Visitor, class MemoryReader>
-  void visit(const Visitor& visitor, const MemoryReader& reader)
+  void visitValues(Visitor& visitor, const MemoryReader& reader)
   {
     for (int i = 0; i < ROOT_LENGTH; i++) {
       if (!root_[i])
@@ -175,6 +174,14 @@ class TCMalloc_PageMap2 {
         ;
     }
   }
+
+  template<class Visitor, class MemoryReader>
+  void visitAllocations(Visitor& visitor, const MemoryReader&) {
+    for (int i = 0; i < ROOT_LENGTH; i++) {
+      if (root_[i])
+        visitor.visit(root_[i], sizeof(Leaf));
+    }
+  }
 #endif
 };
 
@@ -266,7 +273,7 @@ class TCMalloc_PageMap3 {
 
 #ifdef WTF_CHANGES
   template<class Visitor, class MemoryReader>
-  void visit(const Visitor& visitor, const MemoryReader& reader) {
+  void visitValues(Visitor& visitor, const MemoryReader& reader) {
     Node* root = reader(root_);
     for (int i = 0; i < INTERIOR_LENGTH; i++) {
       if (!root->ptrs[i])
@@ -283,6 +290,26 @@ class TCMalloc_PageMap3 {
       }
     }
   }
+
+  template<class Visitor, class MemoryReader>
+  void visitAllocations(Visitor& visitor, const MemoryReader& reader) {
+    visitor.visit(root_, sizeof(Node));
+
+    Node* root = reader(root_);
+    for (int i = 0; i < INTERIOR_LENGTH; i++) {
+      if (!root->ptrs[i])
+        continue;
+
+      visitor.visit(root->ptrs[i], sizeof(Node));
+      Node* n = reader(root->ptrs[i]);
+      for (int j = 0; j < INTERIOR_LENGTH; j++) {
+        if (!n->ptrs[j])
+          continue;
+
+        visitor.visit(n->ptrs[j], sizeof(Leaf));
+      }
+    }
+  }
 #endif
 };
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp
index 9c147b2..478ce63 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.cpp
@@ -381,11 +381,24 @@ void* TCMalloc_SystemAlloc(size_t size, size_t *actual_size, size_t alignment) {
   return NULL;
 }
 
+#if HAVE(MADV_FREE_REUSE)
+
+void TCMalloc_SystemRelease(void* start, size_t length)
+{
+    while (madvise(start, length, MADV_FREE_REUSABLE) == -1 && errno == EAGAIN) { }
+}
+
+#elif HAVE(MADV_FREE) || HAVE(MADV_DONTNEED)
+
 void TCMalloc_SystemRelease(void* start, size_t length)
 {
-  UNUSED_PARAM(start);
-  UNUSED_PARAM(length);
-#if HAVE(MADV_DONTNEED)
+    // MADV_FREE clears the modified bit on pages, which allows
+    // them to be discarded immediately.
+#if HAVE(MADV_FREE)
+    const int advice = MADV_FREE;
+#else
+    const int advice = MADV_DONTNEED;
+#endif
   if (FLAGS_malloc_devmem_start) {
     // It's not safe to use MADV_DONTNEED if we've been mapping
     // /dev/mem for heap memory
@@ -412,26 +425,45 @@ void TCMalloc_SystemRelease(void* start, size_t length)
     // Note -- ignoring most return codes, because if this fails it
     // doesn't matter...
     while (madvise(reinterpret_cast<char*>(new_start), new_end - new_start,
-                   MADV_DONTNEED) == -1 &&
+                   advice) == -1 &&
            errno == EAGAIN) {
       // NOP
     }
-    return;
   }
-#endif
+}
 
-#if HAVE(MMAP)
+#elif HAVE(MMAP)
+
+void TCMalloc_SystemRelease(void* start, size_t length)
+{
   void* newAddress = mmap(start, length, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS | MAP_FIXED, -1, 0);
   // If the mmap failed then that's ok, we just won't return the memory to the system.
   ASSERT_UNUSED(newAddress, newAddress == start || newAddress == reinterpret_cast<void*>(MAP_FAILED));
-  return;
-#endif
 }
 
-#if HAVE(VIRTUALALLOC)
+#else
+
+// Platforms that don't support returning memory use an empty inline version of TCMalloc_SystemRelease
+// declared in TCSystemAlloc.h
+
+#endif
+
+#if HAVE(MADV_FREE_REUSE)
+
 void TCMalloc_SystemCommit(void* start, size_t length)
 {
-    UNUSED_PARAM(start);
-    UNUSED_PARAM(length);
+    while (madvise(start, length, MADV_FREE_REUSE) == -1 && errno == EAGAIN) { }
 }
+
+#elif HAVE(VIRTUALALLOC)
+
+void TCMalloc_SystemCommit(void*, size_t)
+{
+}
+
+#else
+
+// Platforms that don't need to explicitly commit memory use an empty inline version of TCMalloc_SystemCommit
+// declared in TCSystemAlloc.h
+
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.h b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.h
index 0caf718..8e3a01a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TCSystemAlloc.h
@@ -62,9 +62,13 @@ extern void* TCMalloc_SystemAlloc(size_t bytes, size_t *actual_bytes,
 // be released, partial pages will not.)
 extern void TCMalloc_SystemRelease(void* start, size_t length);
 
-#if HAVE(VIRTUALALLOC)
 extern void TCMalloc_SystemCommit(void* start, size_t length);
-#else
+
+#if !HAVE(MADV_FREE_REUSE) && !HAVE(MADV_DONTNEED) && !HAVE(MMAP)
+inline void TCMalloc_SystemRelease(void*, size_t) { }
+#endif
+
+#if !HAVE(VIRTUALALLOC) && !HAVE(MADV_FREE_REUSE)
 inline void TCMalloc_SystemCommit(void*, size_t) { }
 #endif
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h
index 7603802..b07a9a2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecific.h
@@ -45,13 +45,15 @@
 
 #if USE(PTHREADS)
 #include <pthread.h>
+#elif PLATFORM(QT)
+#include <QThreadStorage>
 #elif PLATFORM(WIN_OS)
 #include <windows.h>
 #endif
 
 namespace WTF {
 
-#if !USE(PTHREADS) && PLATFORM(WIN_OS)
+#if !USE(PTHREADS) && !PLATFORM(QT) && PLATFORM(WIN_OS)
 // ThreadSpecificThreadExit should be called each time when a thread is detached.
 // This is done automatically for threads created with WTF::createThread.
 void ThreadSpecificThreadExit();
@@ -66,7 +68,7 @@ public:
     ~ThreadSpecific();
 
 private:
-#if !USE(PTHREADS) && PLATFORM(WIN_OS)
+#if !USE(PTHREADS) && !PLATFORM(QT) && PLATFORM(WIN_OS)
     friend void ThreadSpecificThreadExit();
 #endif
     
@@ -74,7 +76,7 @@ private:
     void set(T*);
     void static destroy(void* ptr);
 
-#if USE(PTHREADS) || PLATFORM(WIN_OS)
+#if USE(PTHREADS) || PLATFORM(QT) || PLATFORM(WIN_OS)
     struct Data : Noncopyable {
         Data(T* value, ThreadSpecific<T>* owner) : value(value), owner(owner) {}
 
@@ -88,6 +90,8 @@ private:
 
 #if USE(PTHREADS)
     pthread_key_t m_key;
+#elif PLATFORM(QT)
+    QThreadStorage<Data*> m_key;
 #elif PLATFORM(WIN_OS)
     int m_index;
 #endif
@@ -122,6 +126,37 @@ inline void ThreadSpecific<T>::set(T* ptr)
     pthread_setspecific(m_key, new Data(ptr, this));
 }
 
+#elif PLATFORM(QT)
+
+template<typename T>
+inline ThreadSpecific<T>::ThreadSpecific()
+{
+}
+
+template<typename T>
+inline ThreadSpecific<T>::~ThreadSpecific()
+{
+    Data* data = static_cast<Data*>(m_key.localData());
+    if (data)
+        data->destructor(data);
+}
+
+template<typename T>
+inline T* ThreadSpecific<T>::get()
+{
+    Data* data = static_cast<Data*>(m_key.localData());
+    return data ? data->value : 0;
+}
+
+template<typename T>
+inline void ThreadSpecific<T>::set(T* ptr)
+{
+    ASSERT(!get());
+    Data* data = new Data(ptr, this);
+    data->destructor = &ThreadSpecific<T>::destroy;
+    m_key.setLocalData(data);
+}
+
 #elif PLATFORM(WIN_OS)
 
 // The maximum number of TLS keys that can be created. For simplification, we assume that:
@@ -129,8 +164,8 @@ inline void ThreadSpecific<T>::set(T* ptr)
 // 2) We do not need to hold many instances of ThreadSpecific<> data. This fixed number should be far enough.
 const int kMaxTlsKeySize = 256;
 
-extern long g_tls_key_count;
-extern DWORD g_tls_keys[kMaxTlsKeySize];
+long& tlsKeyCount();
+DWORD* tlsKeys();
 
 template<typename T>
 inline ThreadSpecific<T>::ThreadSpecific()
@@ -140,23 +175,23 @@ inline ThreadSpecific<T>::ThreadSpecific()
     if (tls_key == TLS_OUT_OF_INDEXES)
         CRASH();
 
-    m_index = InterlockedIncrement(&g_tls_key_count) - 1;
+    m_index = InterlockedIncrement(&tlsKeyCount()) - 1;
     if (m_index >= kMaxTlsKeySize)
         CRASH();
-    g_tls_keys[m_index] = tls_key;
+    tlsKeys()[m_index] = tls_key;
 }
 
 template<typename T>
 inline ThreadSpecific<T>::~ThreadSpecific()
 {
     // Does not invoke destructor functions. They will be called from ThreadSpecificThreadExit when the thread is detached.
-    TlsFree(g_tls_keys[m_index]);
+    TlsFree(tlsKeys()[m_index]);
 }
 
 template<typename T>
 inline T* ThreadSpecific<T>::get()
 {
-    Data* data = static_cast<Data*>(TlsGetValue(g_tls_keys[m_index]));
+    Data* data = static_cast<Data*>(TlsGetValue(tlsKeys()[m_index]));
     return data ? data->value : 0;
 }
 
@@ -166,7 +201,7 @@ inline void ThreadSpecific<T>::set(T* ptr)
     ASSERT(!get());
     Data* data = new Data(ptr, this);
     data->destructor = &ThreadSpecific<T>::destroy;
-    TlsSetValue(g_tls_keys[m_index], data);
+    TlsSetValue(tlsKeys()[m_index], data);
 }
 
 #else
@@ -189,8 +224,10 @@ inline void ThreadSpecific<T>::destroy(void* ptr)
 
 #if USE(PTHREADS)
     pthread_setspecific(data->owner->m_key, 0);
+#elif PLATFORM(QT)
+    data->owner->m_key.setLocalData(0);
 #elif PLATFORM(WIN_OS)
-    TlsSetValue(g_tls_keys[data->owner->m_index], 0);
+    TlsSetValue(tlsKeys()[data->owner->m_index], 0);
 #else
 #error ThreadSpecific is not implemented for this platform.
 #endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecificWin.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecificWin.cpp
index 1a3febb..f2c0cad 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecificWin.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadSpecificWin.cpp
@@ -29,14 +29,23 @@
 
 namespace WTF {
 
-long g_tls_key_count = 0;
-DWORD g_tls_keys[kMaxTlsKeySize];
+long& tlsKeyCount()
+{
+    static long count;
+    return count;
+}
+
+DWORD* tlsKeys()
+{
+    static DWORD keys[kMaxTlsKeySize];
+    return keys;
+}
 
 void ThreadSpecificThreadExit()
 {
-    for (long i = 0; i < g_tls_key_count; i++) {
+    for (long i = 0; i < tlsKeyCount(); i++) {
         // The layout of ThreadSpecific<T>::Data does not depend on T. So we are safe to do the static cast to ThreadSpecific<int> in order to access its data member.
-        ThreadSpecific<int>::Data* data = static_cast<ThreadSpecific<int>::Data*>(TlsGetValue(g_tls_keys[i]));
+        ThreadSpecific<int>::Data* data = static_cast<ThreadSpecific<int>::Data*>(TlsGetValue(tlsKeys()[i]));
         if (data)
             data->destructor(data);
     }
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp
index 0179dcc..bd25ee7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,16 +26,21 @@
 #include "config.h"
 #include "Threading.h"
 
+#include <string.h>
+
 namespace WTF {
 
 struct NewThreadContext {
-    NewThreadContext(ThreadFunction entryPoint, void* data)
+    NewThreadContext(ThreadFunction entryPoint, void* data, const char* name)
         : entryPoint(entryPoint)
         , data(data)
-    { }
+        , name(name)
+    {
+    }
 
     ThreadFunction entryPoint;
     void* data;
+    const char* name;
 
     Mutex creationMutex;
 };
@@ -44,6 +49,8 @@ static void* threadEntryPoint(void* contextData)
 {
     NewThreadContext* context = reinterpret_cast<NewThreadContext*>(contextData);
 
+    setThreadNameInternal(context->name);
+
     // Block until our creating thread has completed any extra setup work
     {
         MutexLocker locker(context->creationMutex);
@@ -59,7 +66,14 @@ static void* threadEntryPoint(void* contextData)
 
 ThreadIdentifier createThread(ThreadFunction entryPoint, void* data, const char* name)
 {
-    NewThreadContext* context = new NewThreadContext(entryPoint, data);
+    // Visual Studio has a 31-character limit on thread names. Longer names will
+    // be truncated silently, but we'd like callers to know about the limit.
+#if !LOG_DISABLED
+    if (strlen(name) > 31)
+        LOG_ERROR("Thread name \"%s\" is longer than 31 characters and will be truncated by Visual Studio", name);
+#endif
+
+    NewThreadContext* context = new NewThreadContext(entryPoint, data, name);
 
     // Prevent the thread body from executing until we've established the thread identifier
     MutexLocker locker(context->creationMutex);
@@ -72,6 +86,8 @@ ThreadIdentifier createThread(ThreadFunction entryPoint, void* data, const char*
 // This function is deprecated but needs to be kept around for backward
 // compatibility. Use the 3-argument version of createThread above.
 
+ThreadIdentifier createThread(ThreadFunction entryPoint, void* data);
+
 ThreadIdentifier createThread(ThreadFunction entryPoint, void* data)
 {
     return createThread(entryPoint, data, 0);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h
index 156013d..b12f41f 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Threading.h
@@ -59,7 +59,7 @@
 #ifndef Threading_h
 #define Threading_h
 
-#if PLATFORM(WIN_CE)
+#if PLATFORM(WINCE)
 #include <windows.h>
 #endif
 
@@ -67,7 +67,7 @@
 #include <wtf/Locker.h>
 #include <wtf/Noncopyable.h>
 
-#if PLATFORM(WIN_OS) && !PLATFORM(WIN_CE)
+#if PLATFORM(WIN_OS) && !PLATFORM(WINCE)
 #include <windows.h>
 #elif PLATFORM(DARWIN)
 #include <libkern/OSAtomic.h>
@@ -108,10 +108,17 @@ namespace WTF {
 typedef uint32_t ThreadIdentifier;
 typedef void* (*ThreadFunction)(void* argument);
 
-// Returns 0 if thread creation failed
+// Returns 0 if thread creation failed.
+// The thread name must be a literal since on some platforms it's passed in to the thread.
 ThreadIdentifier createThread(ThreadFunction, void*, const char* threadName);
+
+// Internal platform-specific createThread implementation.
 ThreadIdentifier createThreadInternal(ThreadFunction, void*, const char* threadName);
 
+// Called in the thread during initialization.
+// Helpful for platforms where the thread name must be set from within the thread.
+void setThreadNameInternal(const char* threadName);
+
 ThreadIdentifier currentThread();
 bool isMainThread();
 int waitForThreadCompletion(ThreadIdentifier, void**);
@@ -119,28 +126,36 @@ void detachThread(ThreadIdentifier);
 
 #if USE(PTHREADS)
 typedef pthread_mutex_t PlatformMutex;
+typedef pthread_rwlock_t PlatformReadWriteLock;
 typedef pthread_cond_t PlatformCondition;
 #elif PLATFORM(GTK)
 typedef GOwnPtr<GMutex> PlatformMutex;
+typedef void* PlatformReadWriteLock; // FIXME: Implement.
 typedef GOwnPtr<GCond> PlatformCondition;
 #elif PLATFORM(QT)
 typedef QT_PREPEND_NAMESPACE(QMutex)* PlatformMutex;
+typedef void* PlatformReadWriteLock; // FIXME: Implement.
 typedef QT_PREPEND_NAMESPACE(QWaitCondition)* PlatformCondition;
 #elif PLATFORM(WIN_OS)
 struct PlatformMutex {
     CRITICAL_SECTION m_internalMutex;
     size_t m_recursionCount;
 };
+typedef void* PlatformReadWriteLock; // FIXME: Implement.
 struct PlatformCondition {
-    size_t m_timedOut;
-    size_t m_blocked;
-    size_t m_waitingForRemoval;
-    HANDLE m_gate;
-    HANDLE m_queue;
-    HANDLE m_mutex;
+    size_t m_waitersGone;
+    size_t m_waitersBlocked;
+    size_t m_waitersToUnblock; 
+    HANDLE m_blockLock;
+    HANDLE m_blockQueue;
+    HANDLE m_unblockLock;
+
+    bool timedWait(PlatformMutex&, DWORD durationMilliseconds);
+    void signal(bool unblockAll);
 };
 #else
 typedef void* PlatformMutex;
+typedef void* PlatformReadWriteLock;
 typedef void* PlatformCondition;
 #endif
     
@@ -161,14 +176,32 @@ private:
 
 typedef Locker<Mutex> MutexLocker;
 
+class ReadWriteLock : Noncopyable {
+public:
+    ReadWriteLock();
+    ~ReadWriteLock();
+
+    void readLock();
+    bool tryReadLock();
+
+    void writeLock();
+    bool tryWriteLock();
+    
+    void unlock();
+
+private:
+    PlatformReadWriteLock m_readWriteLock;
+};
+
 class ThreadCondition : Noncopyable {
 public:
     ThreadCondition();
     ~ThreadCondition();
     
     void wait(Mutex& mutex);
-    // Returns true if the condition was signaled before the timeout, false if the timeout was reached
-    bool timedWait(Mutex&, double interval);
+    // Returns true if the condition was signaled before absoluteTime, false if the absoluteTime was reached or is in the past.
+    // The absoluteTime is in seconds, starting on January 1, 1970. The time is assumed to use the same time zone as WTF::currentTime().
+    bool timedWait(Mutex&, double absoluteTime);
     void signal();
     void broadcast();
     
@@ -179,7 +212,7 @@ private:
 #if PLATFORM(WIN_OS)
 #define WTF_USE_LOCKFREE_THREADSAFESHARED 1
 
-#if COMPILER(MINGW) || COMPILER(MSVC7) || PLATFORM(WIN_CE)
+#if COMPILER(MINGW) || COMPILER(MSVC7) || PLATFORM(WINCE)
 inline void atomicIncrement(int* addend) { InterlockedIncrement(reinterpret_cast<long*>(addend)); }
 inline int atomicDecrement(int* addend) { return InterlockedDecrement(reinterpret_cast<long*>(addend)); }
 #else
@@ -201,9 +234,9 @@ inline int atomicDecrement(int volatile* addend) { return __gnu_cxx::__exchange_
 
 #endif
 
-template<class T> class ThreadSafeShared : Noncopyable {
+class ThreadSafeSharedBase : Noncopyable {
 public:
-    ThreadSafeShared(int initialRefCount = 1)
+    ThreadSafeSharedBase(int initialRefCount = 1)
         : m_refCount(initialRefCount)
     {
     }
@@ -218,20 +251,6 @@ public:
 #endif
     }
 
-    void deref()
-    {
-#if USE(LOCKFREE_THREADSAFESHARED)
-        if (atomicDecrement(&m_refCount) <= 0)
-#else
-        {
-            MutexLocker locker(m_mutex);
-            --m_refCount;
-        }
-        if (m_refCount <= 0)
-#endif
-            delete static_cast<T*>(this);
-    }
-
     bool hasOneRef()
     {
         return refCount() == 1;
@@ -245,13 +264,50 @@ public:
         return static_cast<int const volatile &>(m_refCount);
     }
 
+protected:
+    // Returns whether the pointer should be freed or not.
+    bool derefBase()
+    {
+#if USE(LOCKFREE_THREADSAFESHARED)
+        if (atomicDecrement(&m_refCount) <= 0)
+            return true;
+#else
+        int refCount;
+        {
+            MutexLocker locker(m_mutex);
+            --m_refCount;
+            refCount = m_refCount;
+        }
+        if (refCount <= 0)
+            return true;
+#endif
+        return false;
+    }
+
 private:
+    template<class T>
+    friend class CrossThreadRefCounted;
+
     int m_refCount;
 #if !USE(LOCKFREE_THREADSAFESHARED)
     mutable Mutex m_mutex;
 #endif
 };
 
+template<class T> class ThreadSafeShared : public ThreadSafeSharedBase {
+public:
+    ThreadSafeShared(int initialRefCount = 1)
+        : ThreadSafeSharedBase(initialRefCount)
+    {
+    }
+
+    void deref()
+    {
+        if (derefBase())
+            delete static_cast<T*>(this);
+    }
+};
+
 // This function must be called from the main thread. It is safe to call it repeatedly.
 // Darwin is an exception to this rule: it is OK to call it from any thread, the only requirement is that the calls are not reentrant.
 void initializeThreading();
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingGtk.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingGtk.cpp
deleted file mode 100644
index 777d55b..0000000
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingGtk.cpp
+++ /dev/null
@@ -1,244 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2007 Justin Haygood (jhaygood@reaktix.com)
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "Threading.h"
-
-#if !USE(PTHREADS)
-
-#include "HashMap.h"
-#include "MainThread.h"
-#include "RandomNumberSeed.h"
-
-#include <glib.h>
-
-namespace WTF {
-
-static Mutex* atomicallyInitializedStaticMutex;
-
-static ThreadIdentifier mainThreadIdentifier;
-
-static Mutex& threadMapMutex()
-{
-    static Mutex mutex;
-    return mutex;
-}
-
-void initializeThreading()
-{
-    if (!g_thread_supported())
-        g_thread_init(NULL);
-    ASSERT(g_thread_supported());
-
-    if (!atomicallyInitializedStaticMutex) {
-        atomicallyInitializedStaticMutex = new Mutex;
-        threadMapMutex();
-        initializeRandomNumberGenerator();
-        mainThreadIdentifier = currentThread();
-        initializeMainThread();
-    }
-}
-
-void lockAtomicallyInitializedStaticMutex()
-{
-    ASSERT(atomicallyInitializedStaticMutex);
-    atomicallyInitializedStaticMutex->lock();
-}
-
-void unlockAtomicallyInitializedStaticMutex()
-{
-    atomicallyInitializedStaticMutex->unlock();
-}
-
-static HashMap<ThreadIdentifier, GThread*>& threadMap()
-{
-    static HashMap<ThreadIdentifier, GThread*> map;
-    return map;
-}
-
-static ThreadIdentifier identifierByGthreadHandle(GThread*& thread)
-{
-    MutexLocker locker(threadMapMutex());
-
-    HashMap<ThreadIdentifier, GThread*>::iterator i = threadMap().begin();
-    for (; i != threadMap().end(); ++i) {
-        if (i->second == thread)
-            return i->first;
-    }
-
-    return 0;
-}
-
-static ThreadIdentifier establishIdentifierForThread(GThread*& thread)
-{
-    ASSERT(!identifierByGthreadHandle(thread));
-
-    MutexLocker locker(threadMapMutex());
-
-    static ThreadIdentifier identifierCount = 1;
-
-    threadMap().add(identifierCount, thread);
-
-    return identifierCount++;
-}
-
-static GThread* threadForIdentifier(ThreadIdentifier id)
-{
-    MutexLocker locker(threadMapMutex());
-
-    return threadMap().get(id);
-}
-
-static void clearThreadForIdentifier(ThreadIdentifier id)
-{
-    MutexLocker locker(threadMapMutex());
-
-    ASSERT(threadMap().contains(id));
-
-    threadMap().remove(id);
-}
-
-ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, const char*)
-{
-    GThread* thread;
-    if (!(thread = g_thread_create(entryPoint, data, TRUE, 0))) {
-        LOG_ERROR("Failed to create thread at entry point %p with data %p", entryPoint, data);
-        return 0;
-    }
-
-    ThreadIdentifier threadID = establishIdentifierForThread(thread);
-    return threadID;
-}
-
-int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
-{
-    ASSERT(threadID);
-
-    GThread* thread = threadForIdentifier(threadID);
-
-    void* joinResult = g_thread_join(thread);
-    if (result)
-        *result = joinResult;
-
-    clearThreadForIdentifier(threadID);
-    return 0;
-}
-
-void detachThread(ThreadIdentifier)
-{
-}
-
-ThreadIdentifier currentThread()
-{
-    GThread* currentThread = g_thread_self();
-    if (ThreadIdentifier id = identifierByGthreadHandle(currentThread))
-        return id;
-    return establishIdentifierForThread(currentThread);
-}
-
-bool isMainThread()
-{
-    return currentThread() == mainThreadIdentifier;
-}
-
-Mutex::Mutex()
-    : m_mutex(g_mutex_new())
-{
-}
-
-Mutex::~Mutex()
-{
-}
-
-void Mutex::lock()
-{
-    g_mutex_lock(m_mutex.get());
-}
-
-bool Mutex::tryLock()
-{
-    return g_mutex_trylock(m_mutex.get());
-}
-
-void Mutex::unlock()
-{
-    g_mutex_unlock(m_mutex.get());
-}
-
-ThreadCondition::ThreadCondition()
-    : m_condition(g_cond_new())
-{
-}
-
-ThreadCondition::~ThreadCondition()
-{
-}
-
-void ThreadCondition::wait(Mutex& mutex)
-{
-    g_cond_wait(m_condition.get(), mutex.impl().get());
-}
-
-bool ThreadCondition::timedWait(Mutex& mutex, double interval)
-{
-    if (interval < 0.0) {
-        wait(mutex);
-        return true;
-    }
-    
-    int intervalSeconds = static_cast<int>(interval);
-    int intervalMicroseconds = static_cast<int>((interval - intervalSeconds) * 1000000.0);
-    
-    GTimeVal targetTime;
-    g_get_current_time(&targetTime);
-        
-    targetTime.tv_sec += intervalSeconds;
-    targetTime.tv_usec += intervalMicroseconds;
-    if (targetTime.tv_usec > 1000000) {
-        targetTime.tv_usec -= 1000000;
-        targetTime.tv_sec++;
-    }
-
-    return g_cond_timed_wait(m_condition.get(), mutex.impl().get(), &targetTime);
-}
-
-void ThreadCondition::signal()
-{
-    g_cond_signal(m_condition.get());
-}
-
-void ThreadCondition::broadcast()
-{
-    g_cond_broadcast(m_condition.get());
-}
-
-
-}
-
-#endif // !USE(PTHREADS)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingNone.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingNone.cpp
index 832cd0c..46f23d2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingNone.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingNone.cpp
@@ -33,10 +33,11 @@
 namespace WTF {
 
 void initializeThreading() { }
-ThreadIdentifier createThreadInternal(ThreadFunction, void*, const char*) { return 0; }
+ThreadIdentifier createThreadInternal(ThreadFunction, void*, const char*) { return ThreadIdentifier(); }
+void setThreadNameInternal(const char*) { }
 int waitForThreadCompletion(ThreadIdentifier, void**) { return 0; }
 void detachThread(ThreadIdentifier) { }
-ThreadIdentifier currentThread() { return 0; }
+ThreadIdentifier currentThread() { return ThreadIdentifier(); }
 bool isMainThread() { return true; }
 
 Mutex::Mutex() { }
@@ -47,8 +48,8 @@ void Mutex::unlock() { }
 
 ThreadCondition::ThreadCondition() { }
 ThreadCondition::~ThreadCondition() { }
-void ThreadCondition::wait(Mutex& mutex) { }
-bool ThreadCondition::timedWait(Mutex& mutex, double interval) { return false; }
+void ThreadCondition::wait(Mutex&) { }
+bool ThreadCondition::timedWait(Mutex&, double) { return false; }
 void ThreadCondition::signal() { }
 void ThreadCondition::broadcast() { }
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
index f111fcf..d0e6df8 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingPthreads.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Justin Haygood (jhaygood@reaktix.com)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,27 +26,33 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
+
 #include "config.h"
 #include "Threading.h"
 
-#include "StdLibExtras.h"
-
 #if USE(PTHREADS)
 
+#include "CurrentTime.h"
 #include "HashMap.h"
 #include "MainThread.h"
 #include "RandomNumberSeed.h"
-
+#include "StdLibExtras.h"
+#include "UnusedParam.h"
 #include <errno.h>
+#include <limits.h>
 #include <sys/time.h>
 
+#if PLATFORM(ANDROID)
+#include "jni_utility.h"
+#endif
+
 namespace WTF {
 
 typedef HashMap<ThreadIdentifier, pthread_t> ThreadMap;
 
 static Mutex* atomicallyInitializedStaticMutex;
 
-#if !PLATFORM(DARWIN)
+#if !PLATFORM(DARWIN) || PLATFORM(CHROMIUM)
 static ThreadIdentifier mainThreadIdentifier; // The thread that was the first to call initializeThreading(), which must be the main thread.
 #endif
 
@@ -62,7 +68,7 @@ void initializeThreading()
         atomicallyInitializedStaticMutex = new Mutex;
         threadMapMutex();
         initializeRandomNumberGenerator();
-#if !PLATFORM(DARWIN)
+#if !PLATFORM(DARWIN) || PLATFORM(CHROMIUM)
         mainThreadIdentifier = currentThread();
 #endif
         initializeMainThread();
@@ -108,14 +114,14 @@ static ThreadIdentifier establishIdentifierForPthreadHandle(pthread_t& pthreadHa
     static ThreadIdentifier identifierCount = 1;
 
     threadMap().add(identifierCount, pthreadHandle);
-    
+
     return identifierCount++;
 }
 
 static pthread_t pthreadHandleForIdentifier(ThreadIdentifier id)
 {
     MutexLocker locker(threadMapMutex());
-    
+
     return threadMap().get(id);
 }
 
@@ -124,31 +130,76 @@ static void clearPthreadHandleForIdentifier(ThreadIdentifier id)
     MutexLocker locker(threadMapMutex());
 
     ASSERT(threadMap().contains(id));
-    
+
     threadMap().remove(id);
 }
 
+#if PLATFORM(ANDROID)
+// On the Android platform, threads must be registered with the VM before they run.
+struct ThreadData {
+    ThreadFunction entryPoint;
+    void* arg;
+};
+
+static void* runThreadWithRegistration(void* arg)
+{
+    ThreadData* data = static_cast<ThreadData*>(arg);
+    JavaVM* vm = JSC::Bindings::getJavaVM();
+    JNIEnv* env;
+    void* ret = 0;
+    if (vm->AttachCurrentThread(&env, 0) == JNI_OK) {
+        ret = data->entryPoint(data->arg);
+        vm->DetachCurrentThread();
+    }
+    delete data;
+    return ret;
+}
+
+ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, const char*)
+{
+    pthread_t threadHandle;
+    ThreadData* threadData = new ThreadData();
+    threadData->entryPoint = entryPoint;
+    threadData->arg = data;
+
+    if (pthread_create(&threadHandle, 0, runThreadWithRegistration, static_cast<void*>(threadData))) {
+        LOG_ERROR("Failed to create pthread at entry point %p with data %p", entryPoint, data);
+        return 0;
+    }
+    return establishIdentifierForPthreadHandle(threadHandle);
+}
+#else
 ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, const char*)
 {
     pthread_t threadHandle;
-    if (pthread_create(&threadHandle, NULL, entryPoint, data)) {
+    if (pthread_create(&threadHandle, 0, entryPoint, data)) {
         LOG_ERROR("Failed to create pthread at entry point %p with data %p", entryPoint, data);
         return 0;
     }
 
     return establishIdentifierForPthreadHandle(threadHandle);
 }
+#endif
+
+void setThreadNameInternal(const char* threadName)
+{
+#if PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !PLATFORM(IPHONE)
+    pthread_setname_np(threadName);
+#else
+    UNUSED_PARAM(threadName);
+#endif
+}
 
 int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
 {
     ASSERT(threadID);
-    
+
     pthread_t pthreadHandle = pthreadHandleForIdentifier(threadID);
- 
+
     int joinResult = pthread_join(pthreadHandle, result);
     if (joinResult == EDEADLK)
         LOG_ERROR("ThreadIdentifier %u was found to be deadlocked trying to quit", threadID);
-        
+
     clearPthreadHandleForIdentifier(threadID);
     return joinResult;
 }
@@ -156,11 +207,11 @@ int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
 void detachThread(ThreadIdentifier threadID)
 {
     ASSERT(threadID);
-    
+
     pthread_t pthreadHandle = pthreadHandleForIdentifier(threadID);
-    
+
     pthread_detach(pthreadHandle);
-    
+
     clearPthreadHandleForIdentifier(threadID);
 }
 
@@ -174,7 +225,7 @@ ThreadIdentifier currentThread()
 
 bool isMainThread()
 {
-#if PLATFORM(DARWIN)
+#if PLATFORM(DARWIN) && !PLATFORM(CHROMIUM)
     return pthread_main_np();
 #else
     return currentThread() == mainThreadIdentifier;
@@ -193,27 +244,82 @@ Mutex::~Mutex()
 
 void Mutex::lock()
 {
-    if (pthread_mutex_lock(&m_mutex) != 0)
-        ASSERT(false);
+    int result = pthread_mutex_lock(&m_mutex);
+    ASSERT_UNUSED(result, !result);
 }
-    
+
 bool Mutex::tryLock()
 {
     int result = pthread_mutex_trylock(&m_mutex);
-    
+
     if (result == 0)
         return true;
-    else if (result == EBUSY)
+    if (result == EBUSY)
         return false;
 
-    ASSERT(false);
+    ASSERT_NOT_REACHED();
     return false;
 }
 
 void Mutex::unlock()
 {
-    if (pthread_mutex_unlock(&m_mutex) != 0)
-        ASSERT(false);
+    int result = pthread_mutex_unlock(&m_mutex);
+    ASSERT_UNUSED(result, !result);
+}
+
+
+ReadWriteLock::ReadWriteLock()
+{
+    pthread_rwlock_init(&m_readWriteLock, NULL);
+}
+
+ReadWriteLock::~ReadWriteLock()
+{
+    pthread_rwlock_destroy(&m_readWriteLock);
+}
+
+void ReadWriteLock::readLock()
+{
+    int result = pthread_rwlock_rdlock(&m_readWriteLock);
+    ASSERT_UNUSED(result, !result);
+}
+
+bool ReadWriteLock::tryReadLock()
+{
+    int result = pthread_rwlock_tryrdlock(&m_readWriteLock);
+
+    if (result == 0)
+        return true;
+    if (result == EBUSY || result == EAGAIN)
+        return false;
+
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+void ReadWriteLock::writeLock()
+{
+    int result = pthread_rwlock_wrlock(&m_readWriteLock);
+    ASSERT_UNUSED(result, !result);
+}
+
+bool ReadWriteLock::tryWriteLock()
+{
+    int result = pthread_rwlock_trywrlock(&m_readWriteLock);
+
+    if (result == 0)
+        return true;
+    if (result == EBUSY || result == EAGAIN)
+        return false;
+
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+void ReadWriteLock::unlock()
+{
+    int result = pthread_rwlock_unlock(&m_readWriteLock);
+    ASSERT_UNUSED(result, !result);
 }
 
 ThreadCondition::ThreadCondition()
@@ -228,48 +334,42 @@ ThreadCondition::~ThreadCondition()
     
 void ThreadCondition::wait(Mutex& mutex)
 {
-    if (pthread_cond_wait(&m_condition, &mutex.impl()) != 0)
-        ASSERT(false);
+    int result = pthread_cond_wait(&m_condition, &mutex.impl());
+    ASSERT_UNUSED(result, !result);
 }
 
-bool ThreadCondition::timedWait(Mutex& mutex, double secondsToWait)
+bool ThreadCondition::timedWait(Mutex& mutex, double absoluteTime)
 {
-    if (secondsToWait < 0.0) {
+    if (absoluteTime < currentTime())
+        return false;
+
+    if (absoluteTime > INT_MAX) {
         wait(mutex);
         return true;
     }
 
-    int intervalSeconds = static_cast<int>(secondsToWait);
-    int intervalMicroseconds = static_cast<int>((secondsToWait - intervalSeconds) * 1000000.0);
-
-    // Current time comes in sec/microsec
-    timeval currentTime;
-    gettimeofday(&currentTime, NULL);
+    int timeSeconds = static_cast<int>(absoluteTime);
+    int timeNanoseconds = static_cast<int>((absoluteTime - timeSeconds) * 1E9);
 
-    // Target time comes in sec/nanosec
     timespec targetTime;
-    targetTime.tv_sec = currentTime.tv_sec + intervalSeconds;
-    targetTime.tv_nsec = (currentTime.tv_usec + intervalMicroseconds) * 1000;
-    if (targetTime.tv_nsec > 1000000000) {
-        targetTime.tv_nsec -= 1000000000;
-        targetTime.tv_sec++;
-    }
+    targetTime.tv_sec = timeSeconds;
+    targetTime.tv_nsec = timeNanoseconds;
 
     return pthread_cond_timedwait(&m_condition, &mutex.impl(), &targetTime) == 0;
 }
 
 void ThreadCondition::signal()
 {
-    if (pthread_cond_signal(&m_condition) != 0)
-        ASSERT(false);
+    int result = pthread_cond_signal(&m_condition);
+    ASSERT_UNUSED(result, !result);
 }
 
 void ThreadCondition::broadcast()
 {
-    if (pthread_cond_broadcast(&m_condition) != 0)
-        ASSERT(false);
+    int result = pthread_cond_broadcast(&m_condition);
+    ASSERT_UNUSED(result, !result);
 }
-    
+
 } // namespace WTF
 
 #endif // USE(PTHREADS)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingWin.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingWin.cpp
index 3626a37..ea18656 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingWin.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingWin.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -24,40 +25,61 @@
  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * There are numerous academic and practical works on how to implement pthread_cond_wait/pthread_cond_signal/pthread_cond_broadcast
+ * functions on Win32. Here is one example: http://www.cs.wustl.edu/~schmidt/win32-cv-1.html which is widely credited as a 'starting point'
+ * of modern attempts. There are several more or less proven implementations, one in Boost C++ library (http://www.boost.org) and another
+ * in pthreads-win32 (http://sourceware.org/pthreads-win32/).
+ *
+ * The number of articles and discussions is the evidence of significant difficulties in implementing these primitives correctly.
+ * The brief search of revisions, ChangeLog entries, discussions in comp.programming.threads and other places clearly documents
+ * numerous pitfalls and performance problems the authors had to overcome to arrive to the suitable implementations.
+ * Optimally, WebKit would use one of those supported/tested libraries directly. To roll out our own implementation is impractical,
+ * if even for the lack of sufficient testing. However, a faithful reproduction of the code from one of the popular supported
+ * libraries seems to be a good compromise.
+ *
+ * The early Boost implementation (http://www.boxbackup.org/trac/browser/box/nick/win/lib/win32/boost_1_32_0/libs/thread/src/condition.cpp?rev=30)
+ * is identical to pthreads-win32 (http://sourceware.org/cgi-bin/cvsweb.cgi/pthreads/pthread_cond_wait.c?rev=1.10&content-type=text/x-cvsweb-markup&cvsroot=pthreads-win32).
+ * Current Boost uses yet another (although seemingly equivalent) algorithm which came from their 'thread rewrite' effort.
  *
- * =============================================================================
- * Note:  The implementation of condition variables under the Windows
- * plaform was based on that of the excellent BOOST C++ library.  It
- * has been rewritten to fit in with the WebKit architecture and to
- * use its coding conventions.
- * =============================================================================
+ * This file includes timedWait/signal/broadcast implementations translated to WebKit coding style from the latest algorithm by
+ * Alexander Terekhov and Louis Thomas, as captured here: http://sourceware.org/cgi-bin/cvsweb.cgi/pthreads/pthread_cond_wait.c?rev=1.10&content-type=text/x-cvsweb-markup&cvsroot=pthreads-win32
+ * It replaces the implementation of their previous algorithm, also documented in the same source above.
+ * The naming and comments are left very close to original to enable easy cross-check.
  *
- * The Boost license is virtually identical to the Apple variation at the
- * top of this file, but is included here for completeness:
+ * The corresponding Pthreads-win32 License is included below, and CONTRIBUTORS file which it refers to is added to
+ * source directory (as CONTRIBUTORS.pthreads-win32).
+ */
+
+/*
+ *      Pthreads-win32 - POSIX Threads Library for Win32
+ *      Copyright(C) 1998 John E. Bossom
+ *      Copyright(C) 1999,2005 Pthreads-win32 contributors
  *
- * Boost Software License - Version 1.0 - August 17th, 2003
+ *      Contact Email: rpj@callisto.canberra.edu.au
  *
- * Permission is hereby granted, free of charge, to any person or organization
- * obtaining a copy of the software and accompanying documentation covered by
- * this license (the "Software") to use, reproduce, display, distribute,
- * execute, and transmit the Software, and to prepare derivative works of the
- * Software, and to permit third-parties to whom the Software is furnished to
- * do so, all subject to the following:
+ *      The current list of contributors is contained
+ *      in the file CONTRIBUTORS included with the source
+ *      code distribution. The list can also be seen at the
+ *      following World Wide Web location:
+ *      http://sources.redhat.com/pthreads-win32/contributors.html
  *
- * The copyright notices in the Software and this entire statement, including
- * the above license grant, this restriction and the following disclaimer,
- * must be included in all copies of the Software, in whole or in part, and
- * all derivative works of the Software, unless such copies or derivative
- * works are solely in the form of machine-executable object code generated by
- * a source language processor.
+ *      This library is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU Lesser General Public
+ *      License as published by the Free Software Foundation; either
+ *      version 2 of the License, or (at your option) any later version.
  *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT
- * SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE
- * FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE,
- * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
- * DEALINGS IN THE SOFTWARE.
+ *      This library is distributed in the hope that it will be useful,
+ *      but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *      MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *      Lesser General Public License for more details.
+ *
+ *      You should have received a copy of the GNU Lesser General Public
+ *      License along with this library in the file COPYING.LIB;
+ *      if not, write to the Free Software Foundation, Inc.,
+ *      59 Temple Place - Suite 330, Boston, MA 02111-1307, USA
  */
 
 #include "config.h"
@@ -69,13 +91,14 @@
 #endif
 #include <process.h>
 #include <windows.h>
+#include <wtf/CurrentTime.h>
 #include <wtf/HashMap.h>
 #include <wtf/MathExtras.h>
 #include <wtf/RandomNumberSeed.h>
 
 namespace WTF {
 
-// MS_VC_EXCEPTION, THREADNAME_INFO, and setThreadName all come from <http://msdn.microsoft.com/en-us/library/xcb2z8hs.aspx>.
+// MS_VC_EXCEPTION, THREADNAME_INFO, and setThreadNameInternal all come from <http://msdn.microsoft.com/en-us/library/xcb2z8hs.aspx>.
 static const DWORD MS_VC_EXCEPTION = 0x406D1388;
 
 #pragma pack(push, 8)
@@ -87,16 +110,12 @@ typedef struct tagTHREADNAME_INFO {
 } THREADNAME_INFO;
 #pragma pack(pop)
 
-static void setThreadName(DWORD dwThreadID, LPCSTR szThreadName)
+void setThreadNameInternal(const char* szThreadName)
 {
-    // Visual Studio has a 31-character limit on thread names. Longer names will
-    // be truncated silently, but we'd like callers to know about the limit.
-    ASSERT_ARG(szThreadName, strlen(szThreadName) <= 31);
-
     THREADNAME_INFO info;
     info.dwType = 0x1000;
     info.szName = szThreadName;
-    info.dwThreadID = dwThreadID;
+    info.dwThreadID = GetCurrentThreadId();
     info.dwFlags = 0;
 
     __try {
@@ -134,7 +153,7 @@ void initializeThreading()
         initializeRandomNumberGenerator();
         initializeMainThread();
         mainThreadIdentifier = currentThread();
-        setThreadName(mainThreadIdentifier, "Main Thread");
+        setThreadNameInternal("Main Thread");
     }
 }
 
@@ -197,9 +216,6 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
         return 0;
     }
 
-    if (threadName)
-        setThreadName(threadIdentifier, threadName);
-
     threadID = static_cast<ThreadIdentifier>(threadIdentifier);
     storeThreadHandleByIdentifier(threadIdentifier, threadHandle);
 
@@ -214,11 +230,11 @@ int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
     if (!threadHandle)
         LOG_ERROR("ThreadIdentifier %u did not correspond to an active thread when trying to quit", threadID);
  
-    DWORD joinResult = ::WaitForSingleObject(threadHandle, INFINITE);
+    DWORD joinResult = WaitForSingleObject(threadHandle, INFINITE);
     if (joinResult == WAIT_FAILED)
         LOG_ERROR("ThreadIdentifier %u was found to be deadlocked trying to quit", threadID);
 
-    ::CloseHandle(threadHandle);
+    CloseHandle(threadHandle);
     clearThreadHandleForIdentifier(threadID);
 
     return joinResult;
@@ -227,16 +243,16 @@ int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
 void detachThread(ThreadIdentifier threadID)
 {
     ASSERT(threadID);
-    
+
     HANDLE threadHandle = threadHandleForIdentifier(threadID);
     if (threadHandle)
-        ::CloseHandle(threadHandle);
+        CloseHandle(threadHandle);
     clearThreadHandleForIdentifier(threadID);
 }
 
 ThreadIdentifier currentThread()
 {
-    return static_cast<ThreadIdentifier>(::GetCurrentThreadId());
+    return static_cast<ThreadIdentifier>(GetCurrentThreadId());
 }
 
 bool isMainThread()
@@ -247,17 +263,17 @@ bool isMainThread()
 Mutex::Mutex()
 {
     m_mutex.m_recursionCount = 0;
-    ::InitializeCriticalSection(&m_mutex.m_internalMutex);
+    InitializeCriticalSection(&m_mutex.m_internalMutex);
 }
 
 Mutex::~Mutex()
 {
-    ::DeleteCriticalSection(&m_mutex.m_internalMutex);
+    DeleteCriticalSection(&m_mutex.m_internalMutex);
 }
 
 void Mutex::lock()
 {
-    ::EnterCriticalSection(&m_mutex.m_internalMutex);
+    EnterCriticalSection(&m_mutex.m_internalMutex);
     ++m_mutex.m_recursionCount;
 }
     
@@ -269,14 +285,14 @@ bool Mutex::tryLock()
     // treats this as a successful case, it changes the behavior of several
     // tests in WebKit that check to see if the current thread already
     // owned this mutex (see e.g., IconDatabase::getOrCreateIconRecord)
-    DWORD result = ::TryEnterCriticalSection(&m_mutex.m_internalMutex);
+    DWORD result = TryEnterCriticalSection(&m_mutex.m_internalMutex);
     
     if (result != 0) {       // We got the lock
         // If this thread already had the lock, we must unlock and
         // return false so that we mimic the behavior of POSIX's
         // pthread_mutex_trylock:
         if (m_mutex.m_recursionCount > 0) {
-            ::LeaveCriticalSection(&m_mutex.m_internalMutex);
+            LeaveCriticalSection(&m_mutex.m_internalMutex);
             return false;
         }
 
@@ -290,183 +306,168 @@ bool Mutex::tryLock()
 void Mutex::unlock()
 {
     --m_mutex.m_recursionCount;
-    ::LeaveCriticalSection(&m_mutex.m_internalMutex);
-}
-
-static const long MaxSemaphoreCount = static_cast<long>(~0UL >> 1);
-
-ThreadCondition::ThreadCondition()
-{
-    m_condition.m_timedOut = 0;
-    m_condition.m_blocked = 0;
-    m_condition.m_waitingForRemoval = 0;
-    m_condition.m_gate = ::CreateSemaphore(0, 1, 1, 0);
-    m_condition.m_queue = ::CreateSemaphore(0, 0, MaxSemaphoreCount, 0);
-    m_condition.m_mutex = ::CreateMutex(0, 0, 0);
-
-    if (!m_condition.m_gate || !m_condition.m_queue || !m_condition.m_mutex) {
-        if (m_condition.m_gate)
-            ::CloseHandle(m_condition.m_gate);
-        if (m_condition.m_queue)
-            ::CloseHandle(m_condition.m_queue);
-        if (m_condition.m_mutex)
-            ::CloseHandle(m_condition.m_mutex);
-    }
+    LeaveCriticalSection(&m_mutex.m_internalMutex);
 }
 
-ThreadCondition::~ThreadCondition()
-{
-    ::CloseHandle(m_condition.m_gate);
-    ::CloseHandle(m_condition.m_queue);
-    ::CloseHandle(m_condition.m_mutex);
-}
-    
-void ThreadCondition::wait(Mutex& mutex)
+bool PlatformCondition::timedWait(PlatformMutex& mutex, DWORD durationMilliseconds)
 {
-    PlatformMutex& cs = mutex.impl();
-
     // Enter the wait state.
-    DWORD res = ::WaitForSingleObject(m_condition.m_gate, INFINITE);
+    DWORD res = WaitForSingleObject(m_blockLock, INFINITE);
     ASSERT(res == WAIT_OBJECT_0);
-    ++m_condition.m_blocked;
-    res = ::ReleaseSemaphore(m_condition.m_gate, 1, 0);
+    ++m_waitersBlocked;
+    res = ReleaseSemaphore(m_blockLock, 1, 0);
     ASSERT(res);
 
-    ::LeaveCriticalSection(&cs.m_internalMutex);
+    LeaveCriticalSection(&mutex.m_internalMutex);
 
-    res = ::WaitForSingleObject(m_condition.m_queue, INFINITE);
-    ASSERT(res == WAIT_OBJECT_0);
+    // Main wait - use timeout.
+    bool timedOut = (WaitForSingleObject(m_blockQueue, durationMilliseconds) == WAIT_TIMEOUT);
 
-    res = ::WaitForSingleObject(m_condition.m_mutex, INFINITE);
+    res = WaitForSingleObject(m_unblockLock, INFINITE);
     ASSERT(res == WAIT_OBJECT_0);
-    size_t wasWaiting = m_condition.m_waitingForRemoval;
-    size_t wasTimedOut = m_condition.m_timedOut;
-    if (wasWaiting != 0) {
-        if (--m_condition.m_waitingForRemoval == 0) {
-            if (m_condition.m_blocked != 0) {
-                res = ::ReleaseSemaphore(m_condition.m_gate, 1, 0);  // open m_gate
-                ASSERT(res);
-                wasWaiting = 0;
-            }
-            else if (m_condition.m_timedOut != 0)
-                m_condition.m_timedOut = 0;
-        }
-    } else if (++m_condition.m_timedOut == ((std::numeric_limits<unsigned>::max)() / 2)) {
-        // timeout occured, normalize the m_condition.m_timedOut count
+
+    int signalsLeft = m_waitersToUnblock;
+
+    if (m_waitersToUnblock)
+        --m_waitersToUnblock;
+    else if (++m_waitersGone == (INT_MAX / 2)) { // timeout/canceled or spurious semaphore
+        // timeout or spurious wakeup occured, normalize the m_waitersGone count
         // this may occur if many calls to wait with a timeout are made and
         // no call to notify_* is made
-        res = ::WaitForSingleObject(m_condition.m_gate, INFINITE);
+        res = WaitForSingleObject(m_blockLock, INFINITE);
         ASSERT(res == WAIT_OBJECT_0);
-        m_condition.m_blocked -= m_condition.m_timedOut;
-        res = ::ReleaseSemaphore(m_condition.m_gate, 1, 0);
+        m_waitersBlocked -= m_waitersGone;
+        res = ReleaseSemaphore(m_blockLock, 1, 0);
         ASSERT(res);
-        m_condition.m_timedOut = 0;
+        m_waitersGone = 0;
     }
-    res = ::ReleaseMutex(m_condition.m_mutex);
+
+    res = ReleaseMutex(m_unblockLock);
     ASSERT(res);
 
-    if (wasWaiting == 1) {
-        for (/**/ ; wasTimedOut; --wasTimedOut) {
-            // better now than spurious later
-            res = ::WaitForSingleObject(m_condition.m_queue, INFINITE);
-            ASSERT(res == WAIT_OBJECT_0);
-        }
-        res = ::ReleaseSemaphore(m_condition.m_gate, 1, 0);
+    if (signalsLeft == 1) {
+        res = ReleaseSemaphore(m_blockLock, 1, 0); // Open the gate.
         ASSERT(res);
     }
 
-    ::EnterCriticalSection (&cs.m_internalMutex);
-}
+    EnterCriticalSection (&mutex.m_internalMutex);
 
-bool ThreadCondition::timedWait(Mutex& mutex, double interval)
-{
-    // Empty for now
-    ASSERT(false);
-    return false;
+    return !timedOut;
 }
 
-void ThreadCondition::signal()
+void PlatformCondition::signal(bool unblockAll)
 {
-    unsigned signals = 0;
+    unsigned signalsToIssue = 0;
 
-    DWORD res = ::WaitForSingleObject(m_condition.m_mutex, INFINITE);
+    DWORD res = WaitForSingleObject(m_unblockLock, INFINITE);
     ASSERT(res == WAIT_OBJECT_0);
 
-    if (m_condition.m_waitingForRemoval != 0) { // the m_gate is already closed
-        if (m_condition.m_blocked == 0) {
-            res = ::ReleaseMutex(m_condition.m_mutex);
+    if (m_waitersToUnblock) { // the gate is already closed
+        if (!m_waitersBlocked) { // no-op
+            res = ReleaseMutex(m_unblockLock);
             ASSERT(res);
             return;
         }
 
-        ++m_condition.m_waitingForRemoval;
-        --m_condition.m_blocked;
-
-        signals = 1;
-    } else {
-        res = ::WaitForSingleObject(m_condition.m_gate, INFINITE);
+        if (unblockAll) {
+            signalsToIssue = m_waitersBlocked;
+            m_waitersToUnblock += m_waitersBlocked;
+            m_waitersBlocked = 0;
+        } else {
+            signalsToIssue = 1;
+            ++m_waitersToUnblock;
+            --m_waitersBlocked;
+        }
+    } else if (m_waitersBlocked > m_waitersGone) {
+        res = WaitForSingleObject(m_blockLock, INFINITE); // Close the gate.
         ASSERT(res == WAIT_OBJECT_0);
-        if (m_condition.m_blocked > m_condition.m_timedOut) {
-            if (m_condition.m_timedOut != 0) {
-                m_condition.m_blocked -= m_condition.m_timedOut;
-                m_condition.m_timedOut = 0;
-            }
-            signals = m_condition.m_waitingForRemoval = 1;
-            --m_condition.m_blocked;
+        if (m_waitersGone != 0) {
+            m_waitersBlocked -= m_waitersGone;
+            m_waitersGone = 0;
+        }
+        if (unblockAll) {
+            signalsToIssue = m_waitersBlocked;
+            m_waitersToUnblock = m_waitersBlocked;
+            m_waitersBlocked = 0;
         } else {
-            res = ::ReleaseSemaphore(m_condition.m_gate, 1, 0);
-            ASSERT(res);
+            signalsToIssue = 1;
+            m_waitersToUnblock = 1;
+            --m_waitersBlocked;
         }
+    } else { // No-op.
+        res = ReleaseMutex(m_unblockLock);
+        ASSERT(res);
+        return;
     }
 
-    res =::ReleaseMutex(m_condition.m_mutex);
+    res = ReleaseMutex(m_unblockLock);
     ASSERT(res);
 
-    if (signals) {
-        res = ::ReleaseSemaphore(m_condition.m_queue, signals, 0);
+    if (signalsToIssue) {
+        res = ReleaseSemaphore(m_blockQueue, signalsToIssue, 0);
         ASSERT(res);
     }
 }
 
-void ThreadCondition::broadcast()
+static const long MaxSemaphoreCount = static_cast<long>(~0UL >> 1);
+
+ThreadCondition::ThreadCondition()
 {
-    unsigned signals = 0;
+    m_condition.m_waitersGone = 0;
+    m_condition.m_waitersBlocked = 0;
+    m_condition.m_waitersToUnblock = 0;
+    m_condition.m_blockLock = CreateSemaphore(0, 1, 1, 0);
+    m_condition.m_blockQueue = CreateSemaphore(0, 0, MaxSemaphoreCount, 0);
+    m_condition.m_unblockLock = CreateMutex(0, 0, 0);
+
+    if (!m_condition.m_blockLock || !m_condition.m_blockQueue || !m_condition.m_unblockLock) {
+        if (m_condition.m_blockLock)
+            CloseHandle(m_condition.m_blockLock);
+        if (m_condition.m_blockQueue)
+            CloseHandle(m_condition.m_blockQueue);
+        if (m_condition.m_unblockLock)
+            CloseHandle(m_condition.m_unblockLock);
+    }
+}
 
-    DWORD res = ::WaitForSingleObject(m_condition.m_mutex, INFINITE);
-    ASSERT(res == WAIT_OBJECT_0);
+ThreadCondition::~ThreadCondition()
+{
+    CloseHandle(m_condition.m_blockLock);
+    CloseHandle(m_condition.m_blockQueue);
+    CloseHandle(m_condition.m_unblockLock);
+}
 
-    if (m_condition.m_waitingForRemoval != 0) { // the m_gate is already closed
-        if (m_condition.m_blocked == 0) {
-            res = ::ReleaseMutex(m_condition.m_mutex);
-            ASSERT(res);
-            return;
-        }
+void ThreadCondition::wait(Mutex& mutex)
+{
+    m_condition.timedWait(mutex.impl(), INFINITE);
+}
 
-        m_condition.m_waitingForRemoval += (signals = m_condition.m_blocked);
-        m_condition.m_blocked = 0;
-    } else {
-        res = ::WaitForSingleObject(m_condition.m_gate, INFINITE);
-        ASSERT(res == WAIT_OBJECT_0);
-        if (m_condition.m_blocked > m_condition.m_timedOut) {
-            if (m_condition.m_timedOut != 0) {
-                m_condition.m_blocked -= m_condition.m_timedOut;
-                m_condition.m_timedOut = 0;
-            }
-            signals = m_condition.m_waitingForRemoval = m_condition.m_blocked;
-            m_condition.m_blocked = 0;
-        } else {
-            res = ::ReleaseSemaphore(m_condition.m_gate, 1, 0);
-            ASSERT(res);
-        }
-    }
+bool ThreadCondition::timedWait(Mutex& mutex, double absoluteTime)
+{
+    double currentTime = WTF::currentTime();
 
-    res = ::ReleaseMutex(m_condition.m_mutex);
-    ASSERT(res);
+    // Time is in the past - return immediately.
+    if (absoluteTime < currentTime)
+        return false;
 
-    if (signals) {
-        res = ::ReleaseSemaphore(m_condition.m_queue, signals, 0);
-        ASSERT(res);
+    // Time is too far in the future (and would overflow unsigned long) - wait forever.
+    if (absoluteTime - currentTime > static_cast<double>(INT_MAX) / 1000.0) {
+        wait(mutex);
+        return true;
     }
+
+    double intervalMilliseconds = (absoluteTime - currentTime) * 1000.0;
+    return m_condition.timedWait(mutex.impl(), static_cast<unsigned long>(intervalMilliseconds));
+}
+
+void ThreadCondition::signal()
+{
+    m_condition.signal(false); // Unblock only 1 thread.
+}
+
+void ThreadCondition::broadcast()
+{
+    m_condition.signal(true); // Unblock all threads.
 }
 
 } // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.cpp
new file mode 100644
index 0000000..36fc6c6
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.cpp
@@ -0,0 +1,120 @@
+ /*
+ * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "TypeTraits.h"
+
+#include "Assertions.h"
+
+namespace WTF {
+
+COMPILE_ASSERT(IsInteger<bool>::value, WTF_IsInteger_bool_true);
+COMPILE_ASSERT(IsInteger<char>::value, WTF_IsInteger_char_true);
+COMPILE_ASSERT(IsInteger<signed char>::value, WTF_IsInteger_signed_char_true);
+COMPILE_ASSERT(IsInteger<unsigned char>::value, WTF_IsInteger_unsigned_char_true);
+COMPILE_ASSERT(IsInteger<short>::value, WTF_IsInteger_short_true);
+COMPILE_ASSERT(IsInteger<unsigned short>::value, WTF_IsInteger_unsigned_short_true);
+COMPILE_ASSERT(IsInteger<int>::value, WTF_IsInteger_int_true);
+COMPILE_ASSERT(IsInteger<unsigned int>::value, WTF_IsInteger_unsigned_int_true);
+COMPILE_ASSERT(IsInteger<long>::value, WTF_IsInteger_long_true);
+COMPILE_ASSERT(IsInteger<unsigned long>::value, WTF_IsInteger_unsigned_long_true);
+COMPILE_ASSERT(IsInteger<long long>::value, WTF_IsInteger_long_long_true);
+COMPILE_ASSERT(IsInteger<unsigned long long>::value, WTF_IsInteger_unsigned_long_long_true);
+#if !COMPILER(MSVC) || defined(_NATIVE_WCHAR_T_DEFINED)
+COMPILE_ASSERT(IsInteger<wchar_t>::value, WTF_IsInteger_wchar_t_true);
+#endif
+COMPILE_ASSERT(!IsInteger<char*>::value, WTF_IsInteger_char_pointer_false);
+COMPILE_ASSERT(!IsInteger<const char*>::value, WTF_IsInteger_const_char_pointer_false);
+COMPILE_ASSERT(!IsInteger<volatile char*>::value, WTF_IsInteger_volatile_char_pointer_false);
+COMPILE_ASSERT(!IsInteger<double>::value, WTF_IsInteger_double_false);
+COMPILE_ASSERT(!IsInteger<float>::value, WTF_IsInteger_float_false);
+
+COMPILE_ASSERT(IsPod<bool>::value, WTF_IsPod_bool_true);
+COMPILE_ASSERT(IsPod<char>::value, WTF_IsPod_char_true);
+COMPILE_ASSERT(IsPod<signed char>::value, WTF_IsPod_signed_char_true);
+COMPILE_ASSERT(IsPod<unsigned char>::value, WTF_IsPod_unsigned_char_true);
+COMPILE_ASSERT(IsPod<short>::value, WTF_IsPod_short_true);
+COMPILE_ASSERT(IsPod<unsigned short>::value, WTF_IsPod_unsigned_short_true);
+COMPILE_ASSERT(IsPod<int>::value, WTF_IsPod_int_true);
+COMPILE_ASSERT(IsPod<unsigned int>::value, WTF_IsPod_unsigned_int_true);
+COMPILE_ASSERT(IsPod<long>::value, WTF_IsPod_long_true);
+COMPILE_ASSERT(IsPod<unsigned long>::value, WTF_IsPod_unsigned_long_true);
+COMPILE_ASSERT(IsPod<long long>::value, WTF_IsPod_long_long_true);
+COMPILE_ASSERT(IsPod<unsigned long long>::value, WTF_IsPod_unsigned_long_long_true);
+#if !COMPILER(MSVC) || defined(_NATIVE_WCHAR_T_DEFINED)
+COMPILE_ASSERT(IsPod<wchar_t>::value, WTF_IsPod_wchar_t_true);
+#endif
+COMPILE_ASSERT(IsPod<char*>::value, WTF_IsPod_char_pointer_true);
+COMPILE_ASSERT(IsPod<const char*>::value, WTF_IsPod_const_char_pointer_true);
+COMPILE_ASSERT(IsPod<volatile char*>::value, WTF_IsPod_volatile_char_pointer_true);
+COMPILE_ASSERT(IsPod<double>::value, WTF_IsPod_double_true);
+COMPILE_ASSERT(IsPod<long double>::value, WTF_IsPod_long_double_true);
+COMPILE_ASSERT(IsPod<float>::value, WTF_IsPod_float_true);
+COMPILE_ASSERT(!IsPod<IsPod<bool> >::value, WTF_IsPod_struct_false);
+
+enum IsConvertibleToIntegerCheck { };
+COMPILE_ASSERT(IsConvertibleToInteger<IsConvertibleToIntegerCheck>::value, WTF_IsConvertibleToInteger_enum_true);
+COMPILE_ASSERT(IsConvertibleToInteger<bool>::value, WTF_IsConvertibleToInteger_bool_true);
+COMPILE_ASSERT(IsConvertibleToInteger<char>::value, WTF_IsConvertibleToInteger_char_true);
+COMPILE_ASSERT(IsConvertibleToInteger<signed char>::value, WTF_IsConvertibleToInteger_signed_char_true);
+COMPILE_ASSERT(IsConvertibleToInteger<unsigned char>::value, WTF_IsConvertibleToInteger_unsigned_char_true);
+COMPILE_ASSERT(IsConvertibleToInteger<short>::value, WTF_IsConvertibleToInteger_short_true);
+COMPILE_ASSERT(IsConvertibleToInteger<unsigned short>::value, WTF_IsConvertibleToInteger_unsigned_short_true);
+COMPILE_ASSERT(IsConvertibleToInteger<int>::value, WTF_IsConvertibleToInteger_int_true);
+COMPILE_ASSERT(IsConvertibleToInteger<unsigned int>::value, WTF_IsConvertibleToInteger_unsigned_int_true);
+COMPILE_ASSERT(IsConvertibleToInteger<long>::value, WTF_IsConvertibleToInteger_long_true);
+COMPILE_ASSERT(IsConvertibleToInteger<unsigned long>::value, WTF_IsConvertibleToInteger_unsigned_long_true);
+COMPILE_ASSERT(IsConvertibleToInteger<long long>::value, WTF_IsConvertibleToInteger_long_long_true);
+COMPILE_ASSERT(IsConvertibleToInteger<unsigned long long>::value, WTF_IsConvertibleToInteger_unsigned_long_long_true);
+#if !COMPILER(MSVC) || defined(_NATIVE_WCHAR_T_DEFINED)
+COMPILE_ASSERT(IsConvertibleToInteger<wchar_t>::value, WTF_IsConvertibleToInteger_wchar_t_true);
+#endif
+COMPILE_ASSERT(IsConvertibleToInteger<double>::value, WTF_IsConvertibleToInteger_double_true);
+COMPILE_ASSERT(IsConvertibleToInteger<long double>::value, WTF_IsConvertibleToInteger_long_double_true);
+COMPILE_ASSERT(IsConvertibleToInteger<float>::value, WTF_IsConvertibleToInteger_float_true);
+COMPILE_ASSERT(!IsConvertibleToInteger<char*>::value, WTF_IsConvertibleToInteger_char_pointer_false);
+COMPILE_ASSERT(!IsConvertibleToInteger<const char*>::value, WTF_IsConvertibleToInteger_const_char_pointer_false);
+COMPILE_ASSERT(!IsConvertibleToInteger<volatile char*>::value, WTF_IsConvertibleToInteger_volatile_char_pointer_false);
+COMPILE_ASSERT(!IsConvertibleToInteger<IsConvertibleToInteger<bool> >::value, WTF_IsConvertibleToInteger_struct_false);
+
+COMPILE_ASSERT((IsSameType<bool, bool>::value), WTF_IsSameType_bool_true);
+COMPILE_ASSERT((IsSameType<int*, int*>::value), WTF_IsSameType_int_pointer_true);
+COMPILE_ASSERT((!IsSameType<int, int*>::value), WTF_IsSameType_int_int_pointer_false);
+COMPILE_ASSERT((!IsSameType<bool, const bool>::value), WTF_IsSameType_const_change_false);
+COMPILE_ASSERT((!IsSameType<bool, volatile bool>::value), WTF_IsSameType_volatile_change_false);
+
+COMPILE_ASSERT((IsSameType<bool, RemoveConst<const bool>::Type>::value), WTF_test_RemoveConst_const_bool);
+COMPILE_ASSERT((!IsSameType<bool, RemoveConst<volatile bool>::Type>::value), WTF_test_RemoveConst_volatile_bool);
+
+COMPILE_ASSERT((IsSameType<bool, RemoveVolatile<bool>::Type>::value), WTF_test_RemoveVolatile_bool);
+COMPILE_ASSERT((!IsSameType<bool, RemoveVolatile<const bool>::Type>::value), WTF_test_RemoveVolatile_const_bool);
+COMPILE_ASSERT((IsSameType<bool, RemoveVolatile<volatile bool>::Type>::value), WTF_test_RemoveVolatile_volatile_bool);
+
+COMPILE_ASSERT((IsSameType<bool, RemoveConstVolatile<bool>::Type>::value), WTF_test_RemoveConstVolatile_bool);
+COMPILE_ASSERT((IsSameType<bool, RemoveConstVolatile<const bool>::Type>::value), WTF_test_RemoveConstVolatile_const_bool);
+COMPILE_ASSERT((IsSameType<bool, RemoveConstVolatile<volatile bool>::Type>::value), WTF_test_RemoveConstVolatile_volatile_bool);
+COMPILE_ASSERT((IsSameType<bool, RemoveConstVolatile<const volatile bool>::Type>::value), WTF_test_RemoveConstVolatile_const_volatile_bool);
+
+COMPILE_ASSERT((IsSameType<int, RemovePointer<int>::Type>::value), WTF_Test_RemovePointer_int);
+COMPILE_ASSERT((IsSameType<int, RemovePointer<int*>::Type>::value), WTF_Test_RemovePointer_int_pointer);
+COMPILE_ASSERT((!IsSameType<int, RemovePointer<int**>::Type>::value), WTF_Test_RemovePointer_int_pointer_pointer);
+
+} // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.h b/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.h
new file mode 100644
index 0000000..6ce6a3e
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/TypeTraits.h
@@ -0,0 +1,339 @@
+ /*
+ * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef TypeTraits_h
+#define TypeTraits_h
+
+#include "Platform.h"
+
+#if (defined(__GLIBCXX__) && (__GLIBCXX__ >= 20070724) && defined(__GXX_EXPERIMENTAL_CXX0X__)) || (defined(_MSC_VER) && (_MSC_VER >= 1600))
+#include <type_traits>
+#endif
+
+namespace WTF {
+
+    // The following are provided in this file:
+    //
+    //   IsInteger<T>::value
+    //   IsPod<T>::value, see the definition for a note about its limitations
+    //   IsConvertibleToInteger<T>::value
+    //
+    //   IsSameType<T, U>::value
+    //
+    //   RemovePointer<T>::Type
+    //   RemoveConst<T>::Type
+    //   RemoveVolatile<T>::Type
+    //   RemoveConstVolatile<T>::Type
+    //
+    //   COMPILE_ASSERT's in TypeTraits.cpp illustrate their usage and what they do.
+
+    template<typename T> struct IsInteger           { static const bool value = false; };
+    template<> struct IsInteger<bool>               { static const bool value = true; };
+    template<> struct IsInteger<char>               { static const bool value = true; };
+    template<> struct IsInteger<signed char>        { static const bool value = true; };
+    template<> struct IsInteger<unsigned char>      { static const bool value = true; };
+    template<> struct IsInteger<short>              { static const bool value = true; };
+    template<> struct IsInteger<unsigned short>     { static const bool value = true; };
+    template<> struct IsInteger<int>                { static const bool value = true; };
+    template<> struct IsInteger<unsigned int>       { static const bool value = true; };
+    template<> struct IsInteger<long>               { static const bool value = true; };
+    template<> struct IsInteger<unsigned long>      { static const bool value = true; };
+    template<> struct IsInteger<long long>          { static const bool value = true; };
+    template<> struct IsInteger<unsigned long long> { static const bool value = true; };
+#if !COMPILER(MSVC) || defined(_NATIVE_WCHAR_T_DEFINED)
+    template<> struct IsInteger<wchar_t>            { static const bool value = true; };
+#endif
+
+    // IsPod is misnamed as it doesn't cover all plain old data (pod) types.
+    // Specifically, it doesn't allow for enums or for structs.
+    template <typename T> struct IsPod           { static const bool value = IsInteger<T>::value; };
+    template <> struct IsPod<float>              { static const bool value = true; };
+    template <> struct IsPod<double>             { static const bool value = true; };
+    template <> struct IsPod<long double>        { static const bool value = true; };
+    template <typename P> struct IsPod<P*>       { static const bool value = true; };
+
+    template<typename T> class IsConvertibleToInteger {
+        // Avoid "possible loss of data" warning when using Microsoft's C++ compiler
+        // by not converting int's to doubles.
+        template<bool performCheck, typename U> class IsConvertibleToDouble;
+        template<typename U> class IsConvertibleToDouble<false, U> {
+        public:
+            static const bool value = false;
+        };
+
+        template<typename U> class IsConvertibleToDouble<true, U> {
+            typedef char YesType;
+            struct NoType {
+                char padding[8];
+            };
+
+            static YesType floatCheck(long double);
+            static NoType floatCheck(...);
+            static T& t;
+        public:
+            static const bool value = sizeof(floatCheck(t)) == sizeof(YesType);
+        };
+
+    public:
+        static const bool value = IsInteger<T>::value || IsConvertibleToDouble<!IsInteger<T>::value, T>::value;
+    };
+
+    template <typename T, typename U> struct IsSameType {
+        static const bool value = false;
+    };
+
+    template <typename T> struct IsSameType<T, T> {
+        static const bool value = true;
+    };
+
+    template <typename T> struct RemoveConst {
+        typedef T Type;
+    };
+
+    template <typename T> struct RemoveConst<const T> {
+        typedef T Type;
+    };
+
+    template <typename T> struct RemoveVolatile {
+        typedef T Type;
+    };
+
+    template <typename T> struct RemoveVolatile<volatile T> {
+        typedef T Type;
+    };
+
+    template <typename T> struct RemoveConstVolatile {
+        typedef typename RemoveVolatile<typename RemoveConst<T>::Type>::Type Type;
+    };
+
+    template <typename T> struct RemovePointer {
+        typedef T Type;
+    };
+
+    template <typename T> struct RemovePointer<T*> {
+        typedef T Type;
+    };
+
+#if (defined(__GLIBCXX__) && (__GLIBCXX__ >= 20070724) && defined(__GXX_EXPERIMENTAL_CXX0X__)) || (defined(_MSC_VER) && (_MSC_VER >= 1600))
+
+    // GCC's libstdc++ 20070724 and later supports C++ TR1 type_traits in the std namespace.
+    // VC10 (VS2010) and later support C++ TR1 type_traits in the std::tr1 namespace.
+    template<typename T> struct HasTrivialConstructor : public std::tr1::has_trivial_constructor<T> { };
+    template<typename T> struct HasTrivialDestructor : public std::tr1::has_trivial_destructor<T> { };
+
+#else
+
+    // This compiler doesn't provide type traits, so we provide basic HasTrivialConstructor
+    // and HasTrivialDestructor definitions. The definitions here include most built-in
+    // scalar types but do not include POD structs and classes. For the intended purposes of
+    // type_traits this results correct but potentially less efficient code.
+    template <typename T, T v>
+    struct IntegralConstant {
+        static const T value = v;
+        typedef T value_type;
+        typedef IntegralConstant<T, v> type;
+    };
+
+    typedef IntegralConstant<bool, true>  true_type;
+    typedef IntegralConstant<bool, false> false_type;
+
+#if defined(_MSC_VER) && (_MSC_VER >= 1400)
+    // VC8 (VS2005) and later have built-in compiler support for HasTrivialConstructor / HasTrivialDestructor,
+    // but for some unexplained reason it doesn't work on built-in types.
+    template <typename T> struct HasTrivialConstructor : public IntegralConstant<bool, __has_trivial_constructor(T)>{ };
+    template <typename T> struct HasTrivialDestructor : public IntegralConstant<bool, __has_trivial_destructor(T)>{ };
+#else
+    template <typename T> struct HasTrivialConstructor : public false_type{ };
+    template <typename T> struct HasTrivialDestructor : public false_type{ };
+#endif
+
+    template <typename T> struct HasTrivialConstructor<T*> : public true_type{ };
+    template <typename T> struct HasTrivialDestructor<T*> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<float> : public true_type{ };
+    template <> struct HasTrivialConstructor<const float> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile float> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile float> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<double> : public true_type{ };
+    template <> struct HasTrivialConstructor<const double> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile double> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile double> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<long double> : public true_type{ };
+    template <> struct HasTrivialConstructor<const long double> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile long double> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile long double> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<unsigned char> : public true_type{ };
+    template <> struct HasTrivialConstructor<const unsigned char> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile unsigned char> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile unsigned char> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<unsigned short> : public true_type{ };
+    template <> struct HasTrivialConstructor<const unsigned short> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile unsigned short> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile unsigned short> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<unsigned int> : public true_type{ };
+    template <> struct HasTrivialConstructor<const unsigned int> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile unsigned int> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile unsigned int> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<unsigned long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const unsigned long> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile unsigned long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile unsigned long> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<unsigned long long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const unsigned long long> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile unsigned long long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile unsigned long long> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<signed char> : public true_type{ };
+    template <> struct HasTrivialConstructor<const signed char> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile signed char> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile signed char> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<signed short> : public true_type{ };
+    template <> struct HasTrivialConstructor<const signed short> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile signed short> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile signed short> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<signed int> : public true_type{ };
+    template <> struct HasTrivialConstructor<const signed int> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile signed int> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile signed int> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<signed long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const signed long> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile signed long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile signed long> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<signed long long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const signed long long> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile signed long long> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile signed long long> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<bool> : public true_type{ };
+    template <> struct HasTrivialConstructor<const bool> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile bool> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile bool> : public true_type{ };
+
+    template <> struct HasTrivialConstructor<char> : public true_type{ };
+    template <> struct HasTrivialConstructor<const char> : public true_type{ };
+    template <> struct HasTrivialConstructor<volatile char> : public true_type{ };
+    template <> struct HasTrivialConstructor<const volatile char> : public true_type{ };
+
+    #if !defined(_MSC_VER) || defined(_NATIVE_WCHAR_T_DEFINED)
+        template <> struct HasTrivialConstructor<wchar_t> : public true_type{ };
+        template <> struct HasTrivialConstructor<const wchar_t> : public true_type{ };
+        template <> struct HasTrivialConstructor<volatile wchar_t> : public true_type{ };
+        template <> struct HasTrivialConstructor<const volatile wchar_t> : public true_type{ };
+    #endif
+
+    template <> struct HasTrivialDestructor<float> : public true_type{ };
+    template <> struct HasTrivialDestructor<const float> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile float> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile float> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<double> : public true_type{ };
+    template <> struct HasTrivialDestructor<const double> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile double> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile double> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<long double> : public true_type{ };
+    template <> struct HasTrivialDestructor<const long double> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile long double> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile long double> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<unsigned char> : public true_type{ };
+    template <> struct HasTrivialDestructor<const unsigned char> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile unsigned char> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile unsigned char> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<unsigned short> : public true_type{ };
+    template <> struct HasTrivialDestructor<const unsigned short> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile unsigned short> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile unsigned short> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<unsigned int> : public true_type{ };
+    template <> struct HasTrivialDestructor<const unsigned int> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile unsigned int> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile unsigned int> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<unsigned long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const unsigned long> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile unsigned long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile unsigned long> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<unsigned long long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const unsigned long long> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile unsigned long long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile unsigned long long> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<signed char> : public true_type{ };
+    template <> struct HasTrivialDestructor<const signed char> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile signed char> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile signed char> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<signed short> : public true_type{ };
+    template <> struct HasTrivialDestructor<const signed short> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile signed short> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile signed short> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<signed int> : public true_type{ };
+    template <> struct HasTrivialDestructor<const signed int> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile signed int> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile signed int> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<signed long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const signed long> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile signed long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile signed long> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<signed long long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const signed long long> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile signed long long> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile signed long long> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<bool> : public true_type{ };
+    template <> struct HasTrivialDestructor<const bool> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile bool> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile bool> : public true_type{ };
+
+    template <> struct HasTrivialDestructor<char> : public true_type{ };
+    template <> struct HasTrivialDestructor<const char> : public true_type{ };
+    template <> struct HasTrivialDestructor<volatile char> : public true_type{ };
+    template <> struct HasTrivialDestructor<const volatile char> : public true_type{ };
+
+    #if !defined(_MSC_VER) || defined(_NATIVE_WCHAR_T_DEFINED)
+        template <> struct HasTrivialDestructor<wchar_t> : public true_type{ };
+        template <> struct HasTrivialDestructor<const wchar_t> : public true_type{ };
+        template <> struct HasTrivialDestructor<volatile wchar_t> : public true_type{ };
+        template <> struct HasTrivialDestructor<const volatile wchar_t> : public true_type{ };
+    #endif
+
+#endif  // __GLIBCXX__, etc.
+
+} // namespace WTF
+
+#endif // TypeTraits_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/VMTags.h b/src/3rdparty/webkit/JavaScriptCore/wtf/VMTags.h
new file mode 100644
index 0000000..519f518
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/VMTags.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef VMTags_h
+#define VMTags_h
+
+#include <wtf/Platform.h>
+
+// On Mac OS X, the VM subsystem allows tagging memory requested from mmap and vm_map
+// in order to aid tools that inspect system memory use. 
+#if PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER)
+
+#include <mach/vm_statistics.h>
+
+#if defined(VM_MEMORY_JAVASCRIPT_CORE) && defined(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR)
+#define VM_TAG_FOR_COLLECTOR_MEMORY VM_MAKE_TAG(VM_MEMORY_JAVASCRIPT_CORE)
+#define VM_TAG_FOR_REGISTERFILE_MEMORY VM_MAKE_TAG(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE)
+#define VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY VM_MAKE_TAG(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR)
+#else
+#define VM_TAG_FOR_COLLECTOR_MEMORY VM_MAKE_TAG(63)
+#define VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY VM_MAKE_TAG(64)
+#define VM_TAG_FOR_REGISTERFILE_MEMORY VM_MAKE_TAG(65)
+#endif // defined(VM_MEMORY_JAVASCRIPT_CORE) && defined(VM_MEMORY_JAVASCRIPT_JIT_REGISTER_FILE) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR) && defined(VM_MEMORY_JAVASCRIPT_JIT_EXECUTABLE_ALLOCATOR)
+
+#else // PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER)
+
+#define VM_TAG_FOR_COLLECTOR_MEMORY -1
+#define VM_TAG_FOR_EXECUTABLEALLOCATOR_MEMORY -1
+#define VM_TAG_FOR_REGISTERFILE_MEMORY -1
+
+#endif // PLATFORM(DARWIN) && !defined(BUILDING_ON_TIGER)
+
+#endif // VMTags_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
index 880b45d..c378fd0 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/Vector.h
@@ -21,16 +21,17 @@
 #ifndef WTF_Vector_h
 #define WTF_Vector_h
 
-#include "Assertions.h"
-#include "FastMalloc.h"
+#include "FastAllocBase.h"
 #include "Noncopyable.h"
 #include "NotFound.h"
 #include "VectorTraits.h"
 #include <limits>
-#include <stdlib.h>
-#include <string.h>
 #include <utility>
 
+#if PLATFORM(QT)
+#include <QDataStream>
+#endif
+
 namespace WTF {
 
     using std::min;
@@ -377,7 +378,8 @@ namespace WTF {
         VectorBuffer(size_t capacity)
             : Base(inlineBuffer(), inlineCapacity)
         {
-            allocateBuffer(capacity);
+            if (capacity > inlineCapacity)
+                Base::allocateBuffer(capacity);
         }
 
         ~VectorBuffer()
@@ -389,6 +391,10 @@ namespace WTF {
         {
             if (newCapacity > inlineCapacity)
                 Base::allocateBuffer(newCapacity);
+            else {
+                m_buffer = inlineBuffer();
+                m_capacity = inlineCapacity;
+            }
         }
 
         void deallocateBuffer(T* bufferToDeallocate)
@@ -428,7 +434,7 @@ namespace WTF {
     };
 
     template<typename T, size_t inlineCapacity = 0>
-    class Vector {
+    class Vector : public FastAllocBase {
     private:
         typedef VectorBuffer<T, inlineCapacity> Buffer;
         typedef VectorTypeOperations<T> TypeOperations;
@@ -503,6 +509,7 @@ namespace WTF {
         void grow(size_t size);
         void resize(size_t size);
         void reserveCapacity(size_t newCapacity);
+        void reserveInitialCapacity(size_t initialCapacity);
         void shrinkCapacity(size_t newCapacity);
         void shrinkToFit() { shrinkCapacity(size()); }
 
@@ -560,6 +567,32 @@ namespace WTF {
         Buffer m_buffer;
     };
 
+#if PLATFORM(QT)
+    template<typename T>
+    QDataStream& operator<<(QDataStream& stream, const Vector<T>& data)
+    {
+        stream << qint64(data.size());
+        foreach (const T& i, data)
+            stream << i;
+        return stream;
+    }
+
+    template<typename T>
+    QDataStream& operator>>(QDataStream& stream, Vector<T>& data)
+    {
+        data.clear();
+        qint64 count;
+        T item;
+        stream >> count;
+        data.reserveCapacity(count);
+        for (qint64 i = 0; i < count; ++i) {
+            stream >> item;
+            data.append(item);
+        }
+        return stream;
+    }
+#endif
+
     template<typename T, size_t inlineCapacity>
     Vector<T, inlineCapacity>::Vector(const Vector& other)
         : m_size(other.size())
@@ -686,7 +719,7 @@ namespace WTF {
     }
 
     template<typename T, size_t inlineCapacity>
-    void Vector<T, inlineCapacity>::resize(size_t size)
+    inline void Vector<T, inlineCapacity>::resize(size_t size)
     {
         if (size <= m_size)
             TypeOperations::destruct(begin() + size, end());
@@ -733,6 +766,15 @@ namespace WTF {
     }
     
     template<typename T, size_t inlineCapacity>
+    inline void Vector<T, inlineCapacity>::reserveInitialCapacity(size_t initialCapacity)
+    {
+        ASSERT(!m_size);
+        ASSERT(capacity() == inlineCapacity);
+        if (initialCapacity > inlineCapacity)
+            m_buffer.allocateBuffer(initialCapacity);
+    }
+    
+    template<typename T, size_t inlineCapacity>
     void Vector<T, inlineCapacity>::shrinkCapacity(size_t newCapacity)
     {
         if (newCapacity >= capacity())
@@ -766,6 +808,8 @@ namespace WTF {
             if (!begin())
                 return;
         }
+        if (newSize < m_size)
+            CRASH();
         T* dest = end();
         for (size_t i = 0; i < dataSize; ++i)
             new (&dest[i]) T(data[i]);
@@ -773,7 +817,7 @@ namespace WTF {
     }
 
     template<typename T, size_t inlineCapacity> template<typename U>
-    inline void Vector<T, inlineCapacity>::append(const U& val)
+    ALWAYS_INLINE void Vector<T, inlineCapacity>::append(const U& val)
     {
         const U* ptr = &val;
         if (size() == capacity()) {
@@ -827,6 +871,8 @@ namespace WTF {
             if (!begin())
                 return;
         }
+        if (newSize < m_size)
+            CRASH();
         T* spot = begin() + position;
         TypeOperations::moveOverlapping(spot, end(), spot + dataSize);
         for (size_t i = 0; i < dataSize; ++i)
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h b/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h
index 6efe36c..7974b9a 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/VectorTraits.h
@@ -22,6 +22,7 @@
 #define WTF_VectorTraits_h
 
 #include "RefPtr.h"
+#include "TypeTraits.h"
 #include <utility>
 #include <memory>
 
@@ -29,24 +30,6 @@ using std::pair;
 
 namespace WTF {
 
-    template <typename T> struct IsPod           { static const bool value = false; };
-    template <> struct IsPod<bool>               { static const bool value = true; };
-    template <> struct IsPod<char>               { static const bool value = true; };
-    template <> struct IsPod<signed char>        { static const bool value = true; };
-    template <> struct IsPod<unsigned char>      { static const bool value = true; };
-    template <> struct IsPod<short>              { static const bool value = true; };
-    template <> struct IsPod<unsigned short>     { static const bool value = true; };
-    template <> struct IsPod<int>                { static const bool value = true; };
-    template <> struct IsPod<unsigned int>       { static const bool value = true; };
-    template <> struct IsPod<long>               { static const bool value = true; };
-    template <> struct IsPod<unsigned long>      { static const bool value = true; };
-    template <> struct IsPod<long long>          { static const bool value = true; };
-    template <> struct IsPod<unsigned long long> { static const bool value = true; };
-    template <> struct IsPod<float>              { static const bool value = true; };
-    template <> struct IsPod<double>             { static const bool value = true; };
-    template <> struct IsPod<long double>        { static const bool value = true; };
-    template <typename P> struct IsPod<P *>      { static const bool value = true; };
-
     template<bool isPod, typename T>
     class VectorTraitsBase;
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.cpp
index adbb115..9509388 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.cpp
@@ -150,6 +150,8 @@
 #include <wtf/FastMalloc.h>
 #include <wtf/Threading.h>
 
+#include <stdio.h>
+
 #if COMPILER(MSVC)
 #pragma warning(disable: 4244)
 #pragma warning(disable: 4245)
@@ -189,13 +191,13 @@ typedef union { double d; uint32_t L[2]; } U;
 #endif
 #else
 #ifdef IEEE_8087
-#define word0(x) ((U*)&x)->L[1]
-#define word1(x) ((U*)&x)->L[0]
+#define word0(x) (x)->L[1]
+#define word1(x) (x)->L[0]
 #else
-#define word0(x) ((U*)&x)->L[0]
-#define word1(x) ((U*)&x)->L[1]
+#define word0(x) (x)->L[0]
+#define word1(x) (x)->L[1]
 #endif
-#define dval(x) ((U*)&x)->d
+#define dval(x) (x)->d
 #endif
 
 /* The following definition of Storeinc is appropriate for MIPS processors.
@@ -275,32 +277,29 @@ typedef union { double d; uint32_t L[2]; } U;
 
 #define Kmax 15
 
-struct Bigint {
-    struct Bigint* next;
-    int k, maxwds, sign, wds;
-    uint32_t x[1];
-};
-
-static Bigint* Balloc(int k)
-{
-    int x = 1 << k;
-    Bigint* rv = (Bigint*)fastMalloc(sizeof(Bigint) + (x - 1)*sizeof(uint32_t));
-    rv->k = k;
-    rv->maxwds = x;
-    rv->next = 0;
-    rv->sign = rv->wds = 0;
-
-    return rv;
-}
-
-static void Bfree(Bigint* v)
-{
-    fastFree(v);
-}
+struct BigInt {
+    BigInt() : sign(0), wds(0) { }
+    BigInt(const BigInt& other) : sign(other.sign), wds(other.wds) 
+    {
+        for (int i = 0; i < 64; ++i)
+            x[i] = other.x[i];
+    }
 
-#define Bcopy(x, y) memcpy((char*)&x->sign, (char*)&y->sign, y->wds * sizeof(int32_t) + 2 * sizeof(int))
+    BigInt& operator=(const BigInt& other) 
+    {
+        sign = other.sign;
+        wds = other.wds;
+        for (int i = 0; i < 64; ++i)
+            x[i] = other.x[i];        
+        return *this;
+    }
+    
+    int sign;
+    int wds;
+    uint32_t x[64];
+};
 
-static Bigint* multadd(Bigint* b, int m, int a)    /* multiply by m and add a */
+static void multadd(BigInt& b, int m, int a)    /* multiply by m and add a */
 {
 #ifdef USE_LONG_LONG
     unsigned long long carry;
@@ -308,8 +307,8 @@ static Bigint* multadd(Bigint* b, int m, int a)    /* multiply by m and add a */
     uint32_t carry;
 #endif
 
-    int wds = b->wds;
-    uint32_t* x = b->x;
+    int wds = b.wds;
+    uint32_t* x = b.x;
     int i = 0;
     carry = a;
     do {
@@ -333,19 +332,12 @@ static Bigint* multadd(Bigint* b, int m, int a)    /* multiply by m and add a */
     } while (++i < wds);
 
     if (carry) {
-        if (wds >= b->maxwds) {
-            Bigint* b1 = Balloc(b->k + 1);
-            Bcopy(b1, b);
-            Bfree(b);
-            b = b1;
-        }
-        b->x[wds++] = (uint32_t)carry;
-        b->wds = wds;
+        b.x[wds++] = (uint32_t)carry;
+        b.wds = wds;
     }
-    return b;
 }
 
-static Bigint* s2b(const char* s, int nd0, int nd, uint32_t y9)
+static void s2b(BigInt& b, const char* s, int nd0, int nd, uint32_t y9)
 {
     int k;
     int32_t y;
@@ -353,27 +345,26 @@ static Bigint* s2b(const char* s, int nd0, int nd, uint32_t y9)
 
     for (k = 0, y = 1; x > y; y <<= 1, k++) { }
 #ifdef Pack_32
-    Bigint* b = Balloc(k);
-    b->x[0] = y9;
-    b->wds = 1;
+    b.sign = 0;
+    b.x[0] = y9;
+    b.wds = 1;
 #else
-    Bigint* b = Balloc(k + 1);
-    b->x[0] = y9 & 0xffff;
-    b->wds = (b->x[1] = y9 >> 16) ? 2 : 1;
+    b.sign = 0;
+    b.x[0] = y9 & 0xffff;
+    b.wds = (b->x[1] = y9 >> 16) ? 2 : 1;
 #endif
 
     int i = 9;
     if (9 < nd0) {
         s += 9;
         do {
-            b = multadd(b, 10, *s++ - '0');
+            multadd(b, 10, *s++ - '0');
         } while (++i < nd0);
         s++;
     } else
         s += 10;
     for (; i < nd; i++)
-        b = multadd(b, 10, *s++ - '0');
-    return b;
+        multadd(b, 10, *s++ - '0');
 }
 
 static int hi0bits(uint32_t x)
@@ -446,21 +437,21 @@ static int lo0bits (uint32_t* y)
     return k;
 }
 
-static Bigint* i2b(int i)
+static void i2b(BigInt& b, int i)
 {
-    Bigint* b;
-
-    b = Balloc(1);
-    b->x[0] = i;
-    b->wds = 1;
-    return b;
+    b.sign = 0;
+    b.x[0] = i;
+    b.wds = 1;
 }
 
-static Bigint* mult(Bigint* a, Bigint* b)
+static void mult(BigInt& aRef, const BigInt& bRef)
 {
-    Bigint* c;
-    int k, wa, wb, wc;
-    uint32_t *x, *xa, *xae, *xb, *xbe, *xc, *xc0;
+    const BigInt* a = &aRef;
+    const BigInt* b = &bRef;
+    BigInt c;
+    int wa, wb, wc;
+    const uint32_t *x = 0, *xa, *xb, *xae, *xbe;
+    uint32_t *xc, *xc0;
     uint32_t y;
 #ifdef USE_LONG_LONG
     unsigned long long carry, z;
@@ -469,24 +460,22 @@ static Bigint* mult(Bigint* a, Bigint* b)
 #endif
 
     if (a->wds < b->wds) {
-        c = a;
+        const BigInt* tmp = a;
         a = b;
-        b = c;
+        b = tmp;
     }
-    k = a->k;
+    
     wa = a->wds;
     wb = b->wds;
     wc = wa + wb;
-    if (wc > a->maxwds)
-        k++;
-    c = Balloc(k);
-    for (x = c->x, xa = x + wc; x < xa; x++)
-        *x = 0;
+
+    for (xc = c.x, xa = xc + wc; xc < xa; xc++)
+        *xc = 0;
     xa = a->x;
     xae = xa + wa;
     xb = b->x;
     xbe = xb + wb;
-    xc0 = c->x;
+    xc0 = c.x;
 #ifdef USE_LONG_LONG
     for (; xb < xbe; xc0++) {
         if ((y = *xb++)) {
@@ -548,33 +537,43 @@ static Bigint* mult(Bigint* a, Bigint* b)
     }
 #endif
 #endif
-    for (xc0 = c->x, xc = xc0 + wc; wc > 0 && !*--xc; --wc) { }
-    c->wds = wc;
-    return c;
+    for (xc0 = c.x, xc = xc0 + wc; wc > 0 && !*--xc; --wc) { }
+    c.wds = wc;
+    aRef = c;
 }
 
-static Bigint* p5s;
+struct P5Node {
+    BigInt val;
+    P5Node* next;
+};
+    
+static P5Node* p5s;
 static int p5s_count;
 
-static Bigint* pow5mult(Bigint* b, int k)
+static ALWAYS_INLINE void pow5mult(BigInt& b, int k)
 {
     static int p05[3] = { 5, 25, 125 };
 
     if (int i = k & 3)
-        b = multadd(b, p05[i - 1], 0);
+        multadd(b, p05[i - 1], 0);
 
     if (!(k >>= 2))
-        return b;
+        return;
 
 #if ENABLE(JSC_MULTIPLE_THREADS)
     s_dtoaP5Mutex->lock();
 #endif
-    Bigint* p5 = p5s;
+    P5Node* p5 = p5s;
+
     if (!p5) {
         /* first time */
-        p5 = p5s = i2b(625);
+        p5 = new P5Node;
+        i2b(p5->val, 625);
+        p5->next = 0;
+        p5s = p5;
         p5s_count = 1;
     }
+
     int p5s_count_local = p5s_count;
 #if ENABLE(JSC_MULTIPLE_THREADS)
     s_dtoaP5Mutex->unlock();
@@ -582,11 +581,9 @@ static Bigint* pow5mult(Bigint* b, int k)
     int p5s_used = 0;
 
     for (;;) {
-        if (k & 1) {
-            Bigint* b1 = mult(b, p5);
-            Bfree(b);
-            b = b1;
-        }
+        if (k & 1)
+            mult(b, p5->val);
+
         if (!(k >>= 1))
             break;
 
@@ -596,7 +593,10 @@ static Bigint* pow5mult(Bigint* b, int k)
 #endif
             if (p5s_used == p5s_count) {
                 ASSERT(!p5->next);
-                p5->next = mult(p5, p5);
+                p5->next = new P5Node;
+                p5->next->next = 0;
+                p5->next->val = p5->val;
+                mult(p5->next->val, p5->next->val);
                 ++p5s_count;
             }
             
@@ -607,30 +607,21 @@ static Bigint* pow5mult(Bigint* b, int k)
         }
         p5 = p5->next;
     }
-
-    return b;
 }
 
-static Bigint* lshift(Bigint* b, int k)
+static ALWAYS_INLINE void lshift(BigInt& b, int k)
 {
-    Bigint* result = b;
-
 #ifdef Pack_32
     int n = k >> 5;
 #else
     int n = k >> 4;
 #endif
 
-    int k1 = b->k;
-    int n1 = n + b->wds + 1;
-    for (int i = b->maxwds; n1 > i; i <<= 1)
-        k1++;
-    if (b->k < k1)
-        result = Balloc(k1);
+    int n1 = n + b.wds + 1;
 
-    const uint32_t* srcStart = b->x;
-    uint32_t* dstStart = result->x;
-    const uint32_t* src = srcStart + b->wds - 1;
+    const uint32_t* srcStart = b.x;
+    uint32_t* dstStart = b.x;
+    const uint32_t* src = srcStart + b.wds - 1;
     uint32_t* dst = dstStart + n1 - 1;
 #ifdef Pack_32
     if (k &= 0x1f) {
@@ -642,7 +633,7 @@ static Bigint* lshift(Bigint* b, int k)
         }
         *dst = hiSubword;
         ASSERT(dst == dstStart + n);
-        result->wds = b->wds + n + (result->x[n1 - 1] != 0);
+        b.wds = b.wds + n + (b.x[n1 - 1] != 0);
     }
 #else
     if (k &= 0xf) {
@@ -661,30 +652,26 @@ static Bigint* lshift(Bigint* b, int k)
         do {
             *--dst = *src--;
         } while (src >= srcStart);
-        result->wds = b->wds + n;
+        b.wds = b.wds + n;
     }
     for (dst = dstStart + n; dst != dstStart; )
         *--dst = 0;
-
-    if (result != b)
-        Bfree(b);
-    return result;
 }
 
-static int cmp(Bigint* a, Bigint* b)
+static int cmp(const BigInt& a, const BigInt& b)
 {
-    uint32_t *xa, *xa0, *xb, *xb0;
+    const uint32_t *xa, *xa0, *xb, *xb0;
     int i, j;
 
-    i = a->wds;
-    j = b->wds;
-    ASSERT(i <= 1 || a->x[i - 1]);
-    ASSERT(j <= 1 || b->x[j - 1]);
+    i = a.wds;
+    j = b.wds;
+    ASSERT(i <= 1 || a.x[i - 1]);
+    ASSERT(j <= 1 || b.x[j - 1]);
     if (i -= j)
         return i;
-    xa0 = a->x;
+    xa0 = a.x;
     xa = xa0 + j;
-    xb0 = b->x;
+    xb0 = b.x;
     xb = xb0 + j;
     for (;;) {
         if (*--xa != *--xb)
@@ -695,35 +682,37 @@ static int cmp(Bigint* a, Bigint* b)
     return 0;
 }
 
-static Bigint* diff(Bigint* a, Bigint* b)
+static ALWAYS_INLINE void diff(BigInt& c, const BigInt& aRef, const BigInt& bRef)
 {
-    Bigint* c;
+    const BigInt* a = &aRef;
+    const BigInt* b = &bRef;
     int i, wa, wb;
-    uint32_t *xa, *xae, *xb, *xbe, *xc;
+    uint32_t *xc;
 
-    i = cmp(a,b);
+    i = cmp(*a, *b);
     if (!i) {
-        c = Balloc(0);
-        c->wds = 1;
-        c->x[0] = 0;
-        return c;
+        c.sign = 0;
+        c.wds = 1;
+        c.x[0] = 0;
+        return;
     }
     if (i < 0) {
-        c = a;
+        const BigInt* tmp = a;
         a = b;
-        b = c;
+        b = tmp;
         i = 1;
     } else
         i = 0;
-    c = Balloc(a->k);
-    c->sign = i;
+
+    c.wds = 0;
+    c.sign = i;
     wa = a->wds;
-    xa = a->x;
-    xae = xa + wa;
+    const uint32_t* xa = a->x;
+    const uint32_t* xae = xa + wa;
     wb = b->wds;
-    xb = b->x;
-    xbe = xb + wb;
-    xc = c->x;
+    const uint32_t* xb = b->x;
+    const uint32_t* xbe = xb + wb;
+    xc = c.x;
 #ifdef USE_LONG_LONG
     unsigned long long borrow = 0;
     do {
@@ -768,14 +757,13 @@ static Bigint* diff(Bigint* a, Bigint* b)
 #endif
     while (!*--xc)
         wa--;
-    c->wds = wa;
-    return c;
+    c.wds = wa;
 }
 
-static double ulp(double x)
+static double ulp(U *x)
 {
     register int32_t L;
-    double a;
+    U u;
 
     L = (word0(x) & Exp_mask) - (P - 1) * Exp_msk1;
 #ifndef Avoid_Underflow
@@ -783,57 +771,57 @@ static double ulp(double x)
     if (L > 0) {
 #endif
 #endif
-        word0(a) = L;
-        word1(a) = 0;
+        word0(&u) = L;
+        word1(&u) = 0;
 #ifndef Avoid_Underflow
 #ifndef Sudden_Underflow
     } else {
         L = -L >> Exp_shift;
         if (L < Exp_shift) {
-            word0(a) = 0x80000 >> L;
-            word1(a) = 0;
+            word0(&u) = 0x80000 >> L;
+            word1(&u) = 0;
         } else {
-            word0(a) = 0;
+            word0(&u) = 0;
             L -= Exp_shift;
-            word1(a) = L >= 31 ? 1 : 1 << 31 - L;
+            word1(&u) = L >= 31 ? 1 : 1 << 31 - L;
         }
     }
 #endif
 #endif
-    return dval(a);
+    return dval(&u);
 }
 
-static double b2d(Bigint* a, int* e)
+static double b2d(const BigInt& a, int* e)
 {
-    uint32_t* xa;
-    uint32_t* xa0;
+    const uint32_t* xa;
+    const uint32_t* xa0;
     uint32_t w;
     uint32_t y;
     uint32_t z;
     int k;
-    double d;
+    U d;
 
-#define d0 word0(d)
-#define d1 word1(d)
+#define d0 word0(&d)
+#define d1 word1(&d)
 
-    xa0 = a->x;
-    xa = xa0 + a->wds;
+    xa0 = a.x;
+    xa = xa0 + a.wds;
     y = *--xa;
     ASSERT(y);
     k = hi0bits(y);
     *e = 32 - k;
 #ifdef Pack_32
     if (k < Ebits) {
-        d0 = Exp_1 | y >> Ebits - k;
+        d0 = Exp_1 | (y >> (Ebits - k));
         w = xa > xa0 ? *--xa : 0;
-        d1 = y << (32 - Ebits) + k | w >> Ebits - k;
+        d1 = (y << (32 - Ebits + k)) | (w >> (Ebits - k));
         goto ret_d;
     }
     z = xa > xa0 ? *--xa : 0;
     if (k -= Ebits) {
-        d0 = Exp_1 | y << k | z >> 32 - k;
+        d0 = Exp_1 | (y << k) | (z >> (32 - k));
         y = xa > xa0 ? *--xa : 0;
-        d1 = z << k | y >> 32 - k;
+        d1 = (z << k) | (y >> (32 - k));
     } else {
         d0 = Exp_1 | y;
         d1 = z;
@@ -857,12 +845,11 @@ static double b2d(Bigint* a, int* e)
 ret_d:
 #undef d0
 #undef d1
-    return dval(d);
+    return dval(&d);
 }
 
-static Bigint* d2b(double d, int* e, int* bits)
+static ALWAYS_INLINE void d2b(BigInt& b, U* d, int* e, int* bits)
 {
-    Bigint* b;
     int de, k;
     uint32_t *x, y, z;
 #ifndef Sudden_Underflow
@@ -871,12 +858,13 @@ static Bigint* d2b(double d, int* e, int* bits)
 #define d0 word0(d)
 #define d1 word1(d)
 
+    b.sign = 0;
 #ifdef Pack_32
-    b = Balloc(1);
+    b.wds = 1;
 #else
-    b = Balloc(2);
+    b.wds = 2;
 #endif
-    x = b->x;
+    x = b.x;
 
     z = d0 & Frac_mask;
     d0 &= 0x7fffffff;    /* clear sign bit, which we ignore */
@@ -889,21 +877,21 @@ static Bigint* d2b(double d, int* e, int* bits)
 #ifdef Pack_32
     if ((y = d1)) {
         if ((k = lo0bits(&y))) {
-            x[0] = y | z << 32 - k;
+            x[0] = y | (z << (32 - k));
             z >>= k;
         } else
             x[0] = y;
 #ifndef Sudden_Underflow
         i =
 #endif
-            b->wds = (x[1] = z) ? 2 : 1;
+            b.wds = (x[1] = z) ? 2 : 1;
     } else {
         k = lo0bits(&z);
         x[0] = z;
 #ifndef Sudden_Underflow
         i =
 #endif
-            b->wds = 1;
+            b.wds = 1;
         k += 32;
     }
 #else
@@ -958,30 +946,29 @@ static Bigint* d2b(double d, int* e, int* bits)
 #endif
     }
 #endif
-    return b;
 }
 #undef d0
 #undef d1
 
-static double ratio(Bigint* a, Bigint* b)
+static double ratio(const BigInt& a, const BigInt& b)
 {
-    double da, db;
+    U da, db;
     int k, ka, kb;
 
-    dval(da) = b2d(a, &ka);
-    dval(db) = b2d(b, &kb);
+    dval(&da) = b2d(a, &ka);
+    dval(&db) = b2d(b, &kb);
 #ifdef Pack_32
-    k = ka - kb + 32 * (a->wds - b->wds);
+    k = ka - kb + 32 * (a.wds - b.wds);
 #else
-    k = ka - kb + 16 * (a->wds - b->wds);
+    k = ka - kb + 16 * (a.wds - b.wds);
 #endif
     if (k > 0)
-        word0(da) += k * Exp_msk1;
+        word0(&da) += k * Exp_msk1;
     else {
         k = -k;
-        word0(db) += k * Exp_msk1;
+        word0(&db) += k * Exp_msk1;
     }
-    return dval(da) / dval(db);
+    return dval(&da) / dval(&db);
 }
 
 static const double tens[] = {
@@ -1031,7 +1018,7 @@ static int match(const char** sp, const char* t)
 }
 
 #ifndef No_Hex_NaN
-static void hexnan(double* rvp, const char** sp)
+static void hexnan(U* rvp, const char** sp)
 {
     uint32_t c, x[2];
     const char* s;
@@ -1070,8 +1057,8 @@ static void hexnan(double* rvp, const char** sp)
         x[1] = (x[1] << 4) | c;
     }
     if ((x[0] &= 0xfffff) || x[1]) {
-        word0(*rvp) = Exp_mask | x[0];
-        word1(*rvp) = x[1];
+        word0(rvp) = Exp_mask | x[0];
+        word1(rvp) = x[1];
     }
 }
 #endif /*No_Hex_NaN*/
@@ -1085,16 +1072,17 @@ double strtod(const char* s00, char** se)
     int bb2, bb5, bbe, bd2, bd5, bbbits, bs2, c, dsign,
          e, e1, esign, i, j, k, nd, nd0, nf, nz, nz0, sign;
     const char *s, *s0, *s1;
-    double aadj, aadj1, adj, rv, rv0;
+    double aadj, aadj1;
+    U aadj2, adj, rv, rv0;
     int32_t L;
     uint32_t y, z;
-    Bigint *bb = NULL, *bb1 = NULL, *bd = NULL, *bd0 = NULL, *bs = NULL, *delta = NULL;
+    BigInt bb, bb1, bd, bd0, bs, delta;
 #ifdef SET_INEXACT
     int inexact, oldinexact;
 #endif
 
     sign = nz0 = nz = 0;
-    dval(rv) = 0.;
+    dval(&rv) = 0;
     for (s = s00; ; s++)
         switch (*s) {
             case '-':
@@ -1209,16 +1197,16 @@ dig_done:
                         --s;
                         if (!match(&s,"inity"))
                             ++s;
-                        word0(rv) = 0x7ff00000;
-                        word1(rv) = 0;
+                        word0(&rv) = 0x7ff00000;
+                        word1(&rv) = 0;
                         goto ret;
                     }
                     break;
                 case 'n':
                 case 'N':
                     if (match(&s, "an")) {
-                        word0(rv) = NAN_WORD0;
-                        word1(rv) = NAN_WORD1;
+                        word0(&rv) = NAN_WORD0;
+                        word1(&rv) = NAN_WORD1;
 #ifndef No_Hex_NaN
                         if (*s == '(') /*)*/
                             hexnan(&rv, &s);
@@ -1243,21 +1231,20 @@ ret0:
     if (!nd0)
         nd0 = nd;
     k = nd < DBL_DIG + 1 ? nd : DBL_DIG + 1;
-    dval(rv) = y;
+    dval(&rv) = y;
     if (k > 9) {
 #ifdef SET_INEXACT
         if (k > DBL_DIG)
             oldinexact = get_inexact();
 #endif
-        dval(rv) = tens[k - 9] * dval(rv) + z;
+        dval(&rv) = tens[k - 9] * dval(&rv) + z;
     }
-    bd0 = 0;
     if (nd <= DBL_DIG && Flt_Rounds == 1) {
         if (!e)
             goto ret;
         if (e > 0) {
             if (e <= Ten_pmax) {
-                /* rv = */ rounded_product(dval(rv), tens[e]);
+                /* rv = */ rounded_product(dval(&rv), tens[e]);
                 goto ret;
             }
             i = DBL_DIG - nd;
@@ -1266,14 +1253,14 @@ ret0:
                  * this for larger i values.
                  */
                 e -= i;
-                dval(rv) *= tens[i];
-                /* rv = */ rounded_product(dval(rv), tens[e]);
+                dval(&rv) *= tens[i];
+                /* rv = */ rounded_product(dval(&rv), tens[e]);
                 goto ret;
             }
         }
 #ifndef Inaccurate_Divide
         else if (e >= -Ten_pmax) {
-            /* rv = */ rounded_quotient(dval(rv), tens[-e]);
+            /* rv = */ rounded_quotient(dval(&rv), tens[-e]);
             goto ret;
         }
 #endif
@@ -1293,7 +1280,7 @@ ret0:
 
     if (e1 > 0) {
         if ((i = e1 & 15))
-            dval(rv) *= tens[i];
+            dval(&rv) *= tens[i];
         if (e1 &= ~15) {
             if (e1 > DBL_MAX_10_EXP) {
 ovfl:
@@ -1301,38 +1288,36 @@ ovfl:
                 errno = ERANGE;
 #endif
                 /* Can't trust HUGE_VAL */
-                word0(rv) = Exp_mask;
-                word1(rv) = 0;
+                word0(&rv) = Exp_mask;
+                word1(&rv) = 0;
 #ifdef SET_INEXACT
                 /* set overflow bit */
-                dval(rv0) = 1e300;
-                dval(rv0) *= dval(rv0);
+                dval(&rv0) = 1e300;
+                dval(&rv0) *= dval(&rv0);
 #endif
-                if (bd0)
-                    goto retfree;
                 goto ret;
             }
             e1 >>= 4;
             for (j = 0; e1 > 1; j++, e1 >>= 1)
                 if (e1 & 1)
-                    dval(rv) *= bigtens[j];
+                    dval(&rv) *= bigtens[j];
         /* The last multiplication could overflow. */
-            word0(rv) -= P * Exp_msk1;
-            dval(rv) *= bigtens[j];
-            if ((z = word0(rv) & Exp_mask) > Exp_msk1 * (DBL_MAX_EXP + Bias - P))
+            word0(&rv) -= P * Exp_msk1;
+            dval(&rv) *= bigtens[j];
+            if ((z = word0(&rv) & Exp_mask) > Exp_msk1 * (DBL_MAX_EXP + Bias - P))
                 goto ovfl;
             if (z > Exp_msk1 * (DBL_MAX_EXP + Bias - 1 - P)) {
                 /* set to largest number */
                 /* (Can't trust DBL_MAX) */
-                word0(rv) = Big0;
-                word1(rv) = Big1;
+                word0(&rv) = Big0;
+                word1(&rv) = Big1;
             } else
-                word0(rv) += P * Exp_msk1;
+                word0(&rv) += P * Exp_msk1;
         }
     } else if (e1 < 0) {
         e1 = -e1;
         if ((i = e1 & 15))
-            dval(rv) /= tens[i];
+            dval(&rv) /= tens[i];
         if (e1 >>= 4) {
             if (e1 >= 1 << n_bigtens)
                 goto undfl;
@@ -1341,42 +1326,40 @@ ovfl:
                 scale = 2 * P;
             for (j = 0; e1 > 0; j++, e1 >>= 1)
                 if (e1 & 1)
-                    dval(rv) *= tinytens[j];
-            if (scale && (j = (2 * P) + 1 - ((word0(rv) & Exp_mask) >> Exp_shift)) > 0) {
+                    dval(&rv) *= tinytens[j];
+            if (scale && (j = (2 * P) + 1 - ((word0(&rv) & Exp_mask) >> Exp_shift)) > 0) {
                 /* scaled rv is denormal; zap j low bits */
                 if (j >= 32) {
-                    word1(rv) = 0;
+                    word1(&rv) = 0;
                     if (j >= 53)
-                       word0(rv) = (P + 2) * Exp_msk1;
+                       word0(&rv) = (P + 2) * Exp_msk1;
                     else
-                       word0(rv) &= 0xffffffff << j - 32;
+                       word0(&rv) &= 0xffffffff << (j - 32);
                 } else
-                    word1(rv) &= 0xffffffff << j;
+                    word1(&rv) &= 0xffffffff << j;
             }
 #else
             for (j = 0; e1 > 1; j++, e1 >>= 1)
                 if (e1 & 1)
-                    dval(rv) *= tinytens[j];
+                    dval(&rv) *= tinytens[j];
             /* The last multiplication could underflow. */
-            dval(rv0) = dval(rv);
-            dval(rv) *= tinytens[j];
-            if (!dval(rv)) {
-                dval(rv) = 2. * dval(rv0);
-                dval(rv) *= tinytens[j];
+            dval(&rv0) = dval(&rv);
+            dval(&rv) *= tinytens[j];
+            if (!dval(&rv)) {
+                dval(&rv) = 2. * dval(&rv0);
+                dval(&rv) *= tinytens[j];
 #endif
-                if (!dval(rv)) {
+                if (!dval(&rv)) {
 undfl:
-                    dval(rv) = 0.;
+                    dval(&rv) = 0.;
 #ifndef NO_ERRNO
                     errno = ERANGE;
 #endif
-                    if (bd0)
-                        goto retfree;
                     goto ret;
                 }
 #ifndef Avoid_Underflow
-                word0(rv) = Tiny0;
-                word1(rv) = Tiny1;
+                word0(&rv) = Tiny0;
+                word1(&rv) = Tiny1;
                 /* The refinement below will clean
                  * this approximation up.
                  */
@@ -1389,13 +1372,12 @@ undfl:
 
     /* Put digits into bd: true value = bd * 10^e */
 
-    bd0 = s2b(s0, nd0, nd, y);
+    s2b(bd0, s0, nd0, nd, y);
 
     for (;;) {
-        bd = Balloc(bd0->k);
-        Bcopy(bd, bd0);
-        bb = d2b(dval(rv), &bbe, &bbbits);    /* rv = bb * 2^bbe */
-        bs = i2b(1);
+        bd = bd0;
+        d2b(bb, &rv, &bbe, &bbbits);    /* rv = bb * 2^bbe */
+        i2b(bs, 1);
 
         if (e >= 0) {
             bb2 = bb5 = 0;
@@ -1442,33 +1424,31 @@ undfl:
             bs2 -= i;
         }
         if (bb5 > 0) {
-            bs = pow5mult(bs, bb5);
-            bb1 = mult(bs, bb);
-            Bfree(bb);
-            bb = bb1;
+            pow5mult(bs, bb5);
+            mult(bb, bs);
         }
         if (bb2 > 0)
-            bb = lshift(bb, bb2);
+            lshift(bb, bb2);
         if (bd5 > 0)
-            bd = pow5mult(bd, bd5);
+            pow5mult(bd, bd5);
         if (bd2 > 0)
-            bd = lshift(bd, bd2);
+            lshift(bd, bd2);
         if (bs2 > 0)
-            bs = lshift(bs, bs2);
-        delta = diff(bb, bd);
-        dsign = delta->sign;
-        delta->sign = 0;
+            lshift(bs, bs2);
+        diff(delta, bb, bd);
+        dsign = delta.sign;
+        delta.sign = 0;
         i = cmp(delta, bs);
 
         if (i < 0) {
             /* Error is less than half an ulp -- check for
              * special case of mantissa a power of two.
              */
-            if (dsign || word1(rv) || word0(rv) & Bndry_mask
+            if (dsign || word1(&rv) || word0(&rv) & Bndry_mask
 #ifdef Avoid_Underflow
-             || (word0(rv) & Exp_mask) <= (2 * P + 1) * Exp_msk1
+             || (word0(&rv) & Exp_mask) <= (2 * P + 1) * Exp_msk1
 #else
-             || (word0(rv) & Exp_mask) <= Exp_msk1
+             || (word0(&rv) & Exp_mask) <= Exp_msk1
 #endif
                 ) {
 #ifdef SET_INEXACT
@@ -1477,14 +1457,14 @@ undfl:
 #endif
                 break;
             }
-            if (!delta->x[0] && delta->wds <= 1) {
+            if (!delta.x[0] && delta.wds <= 1) {
                 /* exact result */
 #ifdef SET_INEXACT
                 inexact = 0;
 #endif
                 break;
             }
-            delta = lshift(delta,Log2P);
+            lshift(delta, Log2P);
             if (cmp(delta, bs) > 0)
                 goto drop_down;
             break;
@@ -1492,26 +1472,26 @@ undfl:
         if (i == 0) {
             /* exactly half-way between */
             if (dsign) {
-                if ((word0(rv) & Bndry_mask1) == Bndry_mask1
-                 &&  word1(rv) == (
+                if ((word0(&rv) & Bndry_mask1) == Bndry_mask1
+                 &&  word1(&rv) == (
 #ifdef Avoid_Underflow
-            (scale && (y = word0(rv) & Exp_mask) <= 2 * P * Exp_msk1)
+            (scale && (y = word0(&rv) & Exp_mask) <= 2 * P * Exp_msk1)
         ? (0xffffffff & (0xffffffff << (2 * P + 1 - (y >> Exp_shift)))) :
 #endif
                            0xffffffff)) {
                     /*boundary case -- increment exponent*/
-                    word0(rv) = (word0(rv) & Exp_mask) + Exp_msk1;
-                    word1(rv) = 0;
+                    word0(&rv) = (word0(&rv) & Exp_mask) + Exp_msk1;
+                    word1(&rv) = 0;
 #ifdef Avoid_Underflow
                     dsign = 0;
 #endif
                     break;
                 }
-            } else if (!(word0(rv) & Bndry_mask) && !word1(rv)) {
+            } else if (!(word0(&rv) & Bndry_mask) && !word1(&rv)) {
 drop_down:
                 /* boundary case -- decrement exponent */
 #ifdef Sudden_Underflow /*{{*/
-                L = word0(rv) & Exp_mask;
+                L = word0(&rv) & Exp_mask;
 #ifdef Avoid_Underflow
                 if (L <= (scale ? (2 * P + 1) * Exp_msk1 : Exp_msk1))
 #else
@@ -1522,7 +1502,7 @@ drop_down:
 #else /*Sudden_Underflow}{*/
 #ifdef Avoid_Underflow
                 if (scale) {
-                    L = word0(rv) & Exp_mask;
+                    L = word0(&rv) & Exp_mask;
                     if (L <= (2 * P + 1) * Exp_msk1) {
                         if (L > (P + 2) * Exp_msk1)
                             /* round even ==> */
@@ -1533,20 +1513,20 @@ drop_down:
                     }
                 }
 #endif /*Avoid_Underflow*/
-                L = (word0(rv) & Exp_mask) - Exp_msk1;
+                L = (word0(&rv) & Exp_mask) - Exp_msk1;
 #endif /*Sudden_Underflow}}*/
-                word0(rv) = L | Bndry_mask1;
-                word1(rv) = 0xffffffff;
+                word0(&rv) = L | Bndry_mask1;
+                word1(&rv) = 0xffffffff;
                 break;
             }
-            if (!(word1(rv) & LSB))
+            if (!(word1(&rv) & LSB))
                 break;
             if (dsign)
-                dval(rv) += ulp(dval(rv));
+                dval(&rv) += ulp(&rv);
             else {
-                dval(rv) -= ulp(dval(rv));
+                dval(&rv) -= ulp(&rv);
 #ifndef Sudden_Underflow
-                if (!dval(rv))
+                if (!dval(&rv))
                     goto undfl;
 #endif
             }
@@ -1558,9 +1538,9 @@ drop_down:
         if ((aadj = ratio(delta, bs)) <= 2.) {
             if (dsign)
                 aadj = aadj1 = 1.;
-            else if (word1(rv) || word0(rv) & Bndry_mask) {
+            else if (word1(&rv) || word0(&rv) & Bndry_mask) {
 #ifndef Sudden_Underflow
-                if (word1(rv) == Tiny1 && !word0(rv))
+                if (word1(&rv) == Tiny1 && !word0(&rv))
                     goto undfl;
 #endif
                 aadj = 1.;
@@ -1592,23 +1572,23 @@ drop_down:
                 aadj1 += 0.5;
 #endif /*Check_FLT_ROUNDS*/
         }
-        y = word0(rv) & Exp_mask;
+        y = word0(&rv) & Exp_mask;
 
         /* Check for overflow */
 
         if (y == Exp_msk1 * (DBL_MAX_EXP + Bias - 1)) {
-            dval(rv0) = dval(rv);
-            word0(rv) -= P * Exp_msk1;
-            adj = aadj1 * ulp(dval(rv));
-            dval(rv) += adj;
-            if ((word0(rv) & Exp_mask) >= Exp_msk1 * (DBL_MAX_EXP + Bias - P)) {
-                if (word0(rv0) == Big0 && word1(rv0) == Big1)
+            dval(&rv0) = dval(&rv);
+            word0(&rv) -= P * Exp_msk1;
+            adj.d = aadj1 * ulp(&rv);
+            dval(&rv) += adj.d;
+            if ((word0(&rv) & Exp_mask) >= Exp_msk1 * (DBL_MAX_EXP + Bias - P)) {
+                if (word0(&rv0) == Big0 && word1(&rv0) == Big1)
                     goto ovfl;
-                word0(rv) = Big0;
-                word1(rv) = Big1;
+                word0(&rv) = Big0;
+                word1(&rv) = Big1;
                 goto cont;
             } else
-                word0(rv) += P * Exp_msk1;
+                word0(&rv) += P * Exp_msk1;
         } else {
 #ifdef Avoid_Underflow
             if (scale && y <= 2 * P * Exp_msk1) {
@@ -1618,30 +1598,32 @@ drop_down:
                     aadj = z;
                     aadj1 = dsign ? aadj : -aadj;
                 }
-                word0(aadj1) += (2 * P + 1) * Exp_msk1 - y;
+                dval(&aadj2) = aadj1;
+                word0(&aadj2) += (2 * P + 1) * Exp_msk1 - y;
+                aadj1 = dval(&aadj2);
             }
-            adj = aadj1 * ulp(dval(rv));
-            dval(rv) += adj;
+            adj.d = aadj1 * ulp(&rv);
+            dval(&rv) += adj.d;
 #else
 #ifdef Sudden_Underflow
-            if ((word0(rv) & Exp_mask) <= P * Exp_msk1) {
-                dval(rv0) = dval(rv);
-                word0(rv) += P * Exp_msk1;
-                adj = aadj1 * ulp(dval(rv));
-                dval(rv) += adj;
-                if ((word0(rv) & Exp_mask) <= P * Exp_msk1)
+            if ((word0(&rv) & Exp_mask) <= P * Exp_msk1) {
+                dval(&rv0) = dval(&rv);
+                word0(&rv) += P * Exp_msk1;
+                adj.d = aadj1 * ulp(&rv);
+                dval(&rv) += adj.d;
+                if ((word0(&rv) & Exp_mask) <= P * Exp_msk1)
                 {
-                    if (word0(rv0) == Tiny0 && word1(rv0) == Tiny1)
+                    if (word0(&rv0) == Tiny0 && word1(&rv0) == Tiny1)
                         goto undfl;
-                    word0(rv) = Tiny0;
-                    word1(rv) = Tiny1;
+                    word0(&rv) = Tiny0;
+                    word1(&rv) = Tiny1;
                     goto cont;
                 }
                 else
-                    word0(rv) -= P * Exp_msk1;
+                    word0(&rv) -= P * Exp_msk1;
             } else {
-                adj = aadj1 * ulp(dval(rv));
-                dval(rv) += adj;
+                adj.d = aadj1 * ulp(&rv);
+                dval(&rv) += adj.d;
             }
 #else /*Sudden_Underflow*/
             /* Compute adj so that the IEEE rounding rules will
@@ -1656,12 +1638,12 @@ drop_down:
                 if (!dsign)
                     aadj1 = -aadj1;
             }
-            adj = aadj1 * ulp(dval(rv));
-            dval(rv) += adj;
+            adj.d = aadj1 * ulp(&rv);
+            dval(&rv) += adj.d;
 #endif /*Sudden_Underflow*/
 #endif /*Avoid_Underflow*/
         }
-        z = word0(rv) & Exp_mask;
+        z = word0(&rv) & Exp_mask;
 #ifndef SET_INEXACT
 #ifdef Avoid_Underflow
         if (!scale)
@@ -1671,7 +1653,7 @@ drop_down:
             L = (int32_t)aadj;
             aadj -= L;
             /* The tolerances below are conservative. */
-            if (dsign || word1(rv) || word0(rv) & Bndry_mask) {
+            if (dsign || word1(&rv) || word0(&rv) & Bndry_mask) {
                 if (aadj < .4999999 || aadj > .5000001)
                     break;
             } else if (aadj < .4999999 / FLT_RADIX)
@@ -1679,53 +1661,44 @@ drop_down:
         }
 #endif
 cont:
-        Bfree(bb);
-        Bfree(bd);
-        Bfree(bs);
-        Bfree(delta);
+        ;
     }
 #ifdef SET_INEXACT
     if (inexact) {
         if (!oldinexact) {
-            word0(rv0) = Exp_1 + (70 << Exp_shift);
-            word1(rv0) = 0;
-            dval(rv0) += 1.;
+            word0(&rv0) = Exp_1 + (70 << Exp_shift);
+            word1(&rv0) = 0;
+            dval(&rv0) += 1.;
         }
     } else if (!oldinexact)
         clear_inexact();
 #endif
 #ifdef Avoid_Underflow
     if (scale) {
-        word0(rv0) = Exp_1 - 2 * P * Exp_msk1;
-        word1(rv0) = 0;
-        dval(rv) *= dval(rv0);
+        word0(&rv0) = Exp_1 - 2 * P * Exp_msk1;
+        word1(&rv0) = 0;
+        dval(&rv) *= dval(&rv0);
 #ifndef NO_ERRNO
         /* try to avoid the bug of testing an 8087 register value */
-        if (word0(rv) == 0 && word1(rv) == 0)
+        if (word0(&rv) == 0 && word1(&rv) == 0)
             errno = ERANGE;
 #endif
     }
 #endif /* Avoid_Underflow */
 #ifdef SET_INEXACT
-    if (inexact && !(word0(rv) & Exp_mask)) {
+    if (inexact && !(word0(&rv) & Exp_mask)) {
         /* set underflow bit */
-        dval(rv0) = 1e-300;
-        dval(rv0) *= dval(rv0);
+        dval(&rv0) = 1e-300;
+        dval(&rv0) *= dval(&rv0);
     }
 #endif
-retfree:
-    Bfree(bb);
-    Bfree(bd);
-    Bfree(bs);
-    Bfree(bd0);
-    Bfree(delta);
 ret:
     if (se)
-        *se = (char*)s;
-    return sign ? -dval(rv) : dval(rv);
+        *se = const_cast<char*>(s);
+    return sign ? -dval(&rv) : dval(&rv);
 }
 
-static int quorem(Bigint* b, Bigint* S)
+static ALWAYS_INLINE int quorem(BigInt& b, BigInt& S)
 {
     int n;
     uint32_t *bx, *bxe, q, *sx, *sxe;
@@ -1738,13 +1711,13 @@ static int quorem(Bigint* b, Bigint* S)
 #endif
 #endif
 
-    n = S->wds;
-    ASSERT_WITH_MESSAGE(b->wds <= n, "oversize b in quorem");
-    if (b->wds < n)
+    n = S.wds;
+    ASSERT_WITH_MESSAGE(b.wds <= n, "oversize b in quorem");
+    if (b.wds < n)
         return 0;
-    sx = S->x;
+    sx = S.x;
     sxe = sx + --n;
-    bx = b->x;
+    bx = b.x;
     bxe = bx + n;
     q = *bxe / (*sxe + 1);    /* ensure q <= true quotient */
     ASSERT_WITH_MESSAGE(q <= 9, "oversized quotient in quorem");
@@ -1779,18 +1752,18 @@ static int quorem(Bigint* b, Bigint* S)
 #endif
         } while (sx <= sxe);
         if (!*bxe) {
-            bx = b->x;
+            bx = b.x;
             while (--bxe > bx && !*bxe)
                 --n;
-            b->wds = n;
+            b.wds = n;
         }
     }
     if (cmp(b, S) >= 0) {
         q++;
         borrow = 0;
         carry = 0;
-        bx = b->x;
-        sx = S->x;
+        bx = b.x;
+        sx = S.x;
         do {
 #ifdef USE_LONG_LONG
             ys = *sx++ + carry;
@@ -1818,68 +1791,17 @@ static int quorem(Bigint* b, Bigint* S)
 #endif
 #endif
         } while (sx <= sxe);
-        bx = b->x;
+        bx = b.x;
         bxe = bx + n;
         if (!*bxe) {
             while (--bxe > bx && !*bxe)
                 --n;
-            b->wds = n;
+            b.wds = n;
         }
     }
     return q;
 }
 
-#if !ENABLE(JSC_MULTIPLE_THREADS)
-static char* dtoa_result;
-#endif
-
-static char* rv_alloc(int i)
-{
-    int k;
-
-    int j = sizeof(uint32_t);
-    for (k = 0;
-        sizeof(Bigint) - sizeof(uint32_t) - sizeof(int) + j <= (unsigned)i;
-        j <<= 1)
-            k++;
-    int* r = (int*)Balloc(k);
-    *r = k;
-    return
-#if !ENABLE(JSC_MULTIPLE_THREADS)
-    dtoa_result =
-#endif
-        (char*)(r + 1);
-}
-
-static char* nrv_alloc(const char* s, char** rve, int n)
-{
-    char* rv = rv_alloc(n);
-    char* t = rv;
-
-    while ((*t = *s++))
-        t++;
-    if (rve)
-        *rve = t;
-    return rv;
-}
-
-/* freedtoa(s) must be used to free values s returned by dtoa
- * when MULTIPLE_THREADS is #defined.  It should be used in all cases,
- * but for consistency with earlier versions of dtoa, it is optional
- * when MULTIPLE_THREADS is not defined.
- */
-
-void freedtoa(char* s)
-{
-    Bigint* b = (Bigint*)((int*)s - 1);
-    b->maxwds = 1 << (b->k = *(int*)b);
-    Bfree(b);
-#if !ENABLE(JSC_MULTIPLE_THREADS)
-    if (s == dtoa_result)
-        dtoa_result = 0;
-#endif
-}
-
 /* dtoa for IEEE arithmetic (dmg): convert double to ASCII string.
  *
  * Inspired by "How to Print Floating-Point Numbers Accurately" by
@@ -1914,7 +1836,7 @@ void freedtoa(char* s)
  *       calculation.
  */
 
-char* dtoa(double d, int ndigits, int* decpt, int* sign, char** rve)
+void dtoa(char* result, double dd, int ndigits, int* decpt, int* sign, char** rve)
 {
     /*
         Arguments ndigits, decpt, sign are similar to those
@@ -1933,38 +1855,37 @@ char* dtoa(double d, int ndigits, int* decpt, int* sign, char** rve)
     int denorm;
     uint32_t x;
 #endif
-    Bigint *b, *b1, *delta, *mlo = NULL, *mhi, *S;
-    double d2, ds, eps;
+    BigInt b, b1, delta, mlo, mhi, S;
+    U d2, eps, u;
+    double ds;
     char *s, *s0;
 #ifdef SET_INEXACT
     int inexact, oldinexact;
 #endif
 
-#if !ENABLE(JSC_MULTIPLE_THREADS)
-    if (dtoa_result) {
-        freedtoa(dtoa_result);
-        dtoa_result = 0;
-    }
-#endif
-
-    if (word0(d) & Sign_bit) {
+    u.d = dd;
+    if (word0(&u) & Sign_bit) {
         /* set sign for everything, including 0's and NaNs */
         *sign = 1;
-        word0(d) &= ~Sign_bit;    /* clear sign bit */
+        word0(&u) &= ~Sign_bit;    /* clear sign bit */
     } else
         *sign = 0;
 
-    if ((word0(d) & Exp_mask) == Exp_mask)
+    if ((word0(&u) & Exp_mask) == Exp_mask)
     {
         /* Infinity or NaN */
         *decpt = 9999;
-        if (!word1(d) && !(word0(d) & 0xfffff))
-            return nrv_alloc("Infinity", rve, 8);
-        return nrv_alloc("NaN", rve, 3);
+        if (!word1(&u) && !(word0(&u) & 0xfffff))
+            strcpy(result, "Infinity");
+        else 
+            strcpy(result, "NaN");
+        return;
     }
-    if (!dval(d)) {
+    if (!dval(&u)) {
         *decpt = 1;
-        return nrv_alloc("0", rve, 1);
+        result[0] = '0';
+        result[1] = '\0';
+        return;
     }
 
 #ifdef SET_INEXACT
@@ -1972,15 +1893,15 @@ char* dtoa(double d, int ndigits, int* decpt, int* sign, char** rve)
     inexact = 1;
 #endif
 
-    b = d2b(dval(d), &be, &bbits);
+    d2b(b, &u, &be, &bbits);
 #ifdef Sudden_Underflow
-    i = (int)(word0(d) >> Exp_shift1 & (Exp_mask >> Exp_shift1));
+    i = (int)(word0(&u) >> Exp_shift1 & (Exp_mask >> Exp_shift1));
 #else
-    if ((i = (int)(word0(d) >> Exp_shift1 & (Exp_mask >> Exp_shift1)))) {
+    if ((i = (int)(word0(&u) >> Exp_shift1 & (Exp_mask >> Exp_shift1)))) {
 #endif
-        dval(d2) = dval(d);
-        word0(d2) &= Frac_mask1;
-        word0(d2) |= Exp_11;
+        dval(&d2) = dval(&u);
+        word0(&d2) &= Frac_mask1;
+        word0(&d2) |= Exp_11;
 
         /* log(x)    ~=~ log(1.5) + (x-1.5)/1.5
          * log10(x)     =  log(x) / log(10)
@@ -2011,21 +1932,21 @@ char* dtoa(double d, int ndigits, int* decpt, int* sign, char** rve)
         /* d is denormalized */
 
         i = bbits + be + (Bias + (P - 1) - 1);
-        x = i > 32  ? word0(d) << 64 - i | word1(d) >> i - 32
-                : word1(d) << 32 - i;
-        dval(d2) = x;
-        word0(d2) -= 31 * Exp_msk1; /* adjust exponent */
+        x = (i > 32) ? (word0(&u) << (64 - i)) | (word1(&u) >> (i - 32))
+                : word1(&u) << (32 - i);
+        dval(&d2) = x;
+        word0(&d2) -= 31 * Exp_msk1; /* adjust exponent */
         i -= (Bias + (P - 1) - 1) + 1;
         denorm = 1;
     }
 #endif
-    ds = (dval(d2) - 1.5) * 0.289529654602168 + 0.1760912590558 + (i * 0.301029995663981);
+    ds = (dval(&d2) - 1.5) * 0.289529654602168 + 0.1760912590558 + (i * 0.301029995663981);
     k = (int)ds;
     if (ds < 0. && ds != k)
         k--;    /* want k = floor(ds) */
     k_check = 1;
     if (k >= 0 && k <= Ten_pmax) {
-        if (dval(d) < tens[k])
+        if (dval(&u) < tens[k])
             k--;
         k_check = 0;
     }
@@ -2059,14 +1980,14 @@ char* dtoa(double d, int ndigits, int* decpt, int* sign, char** rve)
     ilim = ilim1 = -1;
     i = 18;
     ndigits = 0;
-    s = s0 = rv_alloc(i);
+    s = s0 = result;
 
     if (ilim >= 0 && ilim <= Quick_max && try_quick) {
 
         /* Try to get by with floating-point arithmetic. */
 
         i = 0;
-        dval(d2) = dval(d);
+        dval(&d2) = dval(&u);
         k0 = k;
         ilim0 = ilim;
         ieps = 2; /* conservative */
@@ -2076,7 +1997,7 @@ char* dtoa(double d, int ndigits, int* decpt, int* sign, char** rve)
             if (j & Bletch) {
                 /* prevent overflows */
                 j &= Bletch - 1;
-                dval(d) /= bigtens[n_bigtens - 1];
+                dval(&u) /= bigtens[n_bigtens - 1];
                 ieps++;
             }
             for (; j; j >>= 1, i++) {
@@ -2085,32 +2006,32 @@ char* dtoa(double d, int ndigits, int* decpt, int* sign, char** rve)
                     ds *= bigtens[i];
                 }
             }
-            dval(d) /= ds;
+            dval(&u) /= ds;
         } else if ((j1 = -k)) {
-            dval(d) *= tens[j1 & 0xf];
+            dval(&u) *= tens[j1 & 0xf];
             for (j = j1 >> 4; j; j >>= 1, i++) {
                 if (j & 1) {
                     ieps++;
-                    dval(d) *= bigtens[i];
+                    dval(&u) *= bigtens[i];
                 }
             }
         }
-        if (k_check && dval(d) < 1. && ilim > 0) {
+        if (k_check && dval(&u) < 1. && ilim > 0) {
             if (ilim1 <= 0)
                 goto fast_failed;
             ilim = ilim1;
             k--;
-            dval(d) *= 10.;
+            dval(&u) *= 10.;
             ieps++;
         }
-        dval(eps) = (ieps * dval(d)) + 7.;
-        word0(eps) -= (P - 1) * Exp_msk1;
+        dval(&eps) = (ieps * dval(&u)) + 7.;
+        word0(&eps) -= (P - 1) * Exp_msk1;
         if (ilim == 0) {
-            S = mhi = 0;
-            dval(d) -= 5.;
-            if (dval(d) > dval(eps))
+            S = mhi = BigInt();
+            dval(&u) -= 5.;
+            if (dval(&u) > dval(&eps))
                 goto one_digit;
-            if (dval(d) < -dval(eps))
+            if (dval(&u) < -dval(&eps))
                 goto no_digits;
             goto fast_failed;
         }
@@ -2119,36 +2040,36 @@ char* dtoa(double d, int ndigits, int* decpt, int* sign, char** rve)
             /* Use Steele & White method of only
              * generating digits needed.
              */
-            dval(eps) = (0.5 / tens[ilim - 1]) - dval(eps);
+            dval(&eps) = (0.5 / tens[ilim - 1]) - dval(&eps);
             for (i = 0;;) {
-                L = (long int)dval(d);
-                dval(d) -= L;
+                L = (long int)dval(&u);
+                dval(&u) -= L;
                 *s++ = '0' + (int)L;
-                if (dval(d) < dval(eps))
-                    goto ret1;
-                if (1. - dval(d) < dval(eps))
+                if (dval(&u) < dval(&eps))
+                    goto ret;
+                if (1. - dval(&u) < dval(&eps))
                     goto bump_up;
                 if (++i >= ilim)
                     break;
-                dval(eps) *= 10.;
-                dval(d) *= 10.;
+                dval(&eps) *= 10.;
+                dval(&u) *= 10.;
             }
         } else {
 #endif
             /* Generate ilim digits, then fix them up. */
-            dval(eps) *= tens[ilim - 1];
-            for (i = 1;; i++, dval(d) *= 10.) {
-                L = (int32_t)(dval(d));
-                if (!(dval(d) -= L))
+            dval(&eps) *= tens[ilim - 1];
+            for (i = 1;; i++, dval(&u) *= 10.) {
+                L = (int32_t)(dval(&u));
+                if (!(dval(&u) -= L))
                     ilim = i;
                 *s++ = '0' + (int)L;
                 if (i == ilim) {
-                    if (dval(d) > 0.5 + dval(eps))
+                    if (dval(&u) > 0.5 + dval(&eps))
                         goto bump_up;
-                    else if (dval(d) < 0.5 - dval(eps)) {
+                    else if (dval(&u) < 0.5 - dval(&eps)) {
                         while (*--s == '0') { }
                         s++;
-                        goto ret1;
+                        goto ret;
                     }
                     break;
                 }
@@ -2158,7 +2079,7 @@ char* dtoa(double d, int ndigits, int* decpt, int* sign, char** rve)
 #endif
 fast_failed:
         s = s0;
-        dval(d) = dval(d2);
+        dval(&u) = dval(&d2);
         k = k0;
         ilim = ilim0;
     }
@@ -2169,31 +2090,31 @@ fast_failed:
         /* Yes. */
         ds = tens[k];
         if (ndigits < 0 && ilim <= 0) {
-            S = mhi = 0;
-            if (ilim < 0 || dval(d) <= 5 * ds)
+            S = mhi = BigInt();
+            if (ilim < 0 || dval(&u) <= 5 * ds)
                 goto no_digits;
             goto one_digit;
         }
-        for (i = 1;; i++, dval(d) *= 10.) {
-            L = (int32_t)(dval(d) / ds);
-            dval(d) -= L * ds;
+        for (i = 1;; i++, dval(&u) *= 10.) {
+            L = (int32_t)(dval(&u) / ds);
+            dval(&u) -= L * ds;
 #ifdef Check_FLT_ROUNDS
             /* If FLT_ROUNDS == 2, L will usually be high by 1 */
-            if (dval(d) < 0) {
+            if (dval(&u) < 0) {
                 L--;
-                dval(d) += ds;
+                dval(&u) += ds;
             }
 #endif
             *s++ = '0' + (int)L;
-            if (!dval(d)) {
+            if (!dval(&u)) {
 #ifdef SET_INEXACT
                 inexact = 0;
 #endif
                 break;
             }
             if (i == ilim) {
-                dval(d) += dval(d);
-                if (dval(d) > ds || dval(d) == ds && L & 1) {
+                dval(&u) += dval(&u);
+                if (dval(&u) > ds || (dval(&u) == ds && (L & 1))) {
 bump_up:
                     while (*--s == '9')
                         if (s == s0) {
@@ -2206,12 +2127,12 @@ bump_up:
                 break;
             }
         }
-        goto ret1;
+        goto ret;
     }
 
     m2 = b2;
     m5 = b5;
-    mhi = mlo = 0;
+    mhi = mlo = BigInt();
     if (leftright) {
         i =
 #ifndef Sudden_Underflow
@@ -2220,7 +2141,7 @@ bump_up:
             1 + P - bbits;
         b2 += i;
         s2 += i;
-        mhi = i2b(1);
+        i2b(mhi, 1);
     }
     if (m2 > 0 && s2 > 0) {
         i = m2 < s2 ? m2 : s2;
@@ -2231,26 +2152,24 @@ bump_up:
     if (b5 > 0) {
         if (leftright) {
             if (m5 > 0) {
-                mhi = pow5mult(mhi, m5);
-                b1 = mult(mhi, b);
-                Bfree(b);
-                b = b1;
+                pow5mult(mhi, m5);
+                mult(b, mhi);
             }
             if ((j = b5 - m5))
-                b = pow5mult(b, j);
+                pow5mult(b, j);
         } else
-            b = pow5mult(b, b5);
+            pow5mult(b, b5);
         }
-    S = i2b(1);
+    i2b(S, 1);
     if (s5 > 0)
-        S = pow5mult(S, s5);
+        pow5mult(S, s5);
 
     /* Check for special case that d is a normalized power of 2. */
 
     spec_case = 0;
-    if (!word1(d) && !(word0(d) & Bndry_mask)
+    if (!word1(&u) && !(word0(&u) & Bndry_mask)
 #ifndef Sudden_Underflow
-     && word0(d) & (Exp_mask & ~Exp_msk1)
+     && word0(&u) & (Exp_mask & ~Exp_msk1)
 #endif
             ) {
         /* The special case */
@@ -2267,10 +2186,10 @@ bump_up:
      * can do shifts and ors to compute the numerator for q.
      */
 #ifdef Pack_32
-    if ((i = ((s5 ? 32 - hi0bits(S->x[S->wds - 1]) : 1) + s2) & 0x1f))
+    if ((i = ((s5 ? 32 - hi0bits(S.x[S.wds - 1]) : 1) + s2) & 0x1f))
         i = 32 - i;
 #else
-    if ((i = ((s5 ? 32 - hi0bits(S->x[S->wds - 1]) : 1) + s2) & 0xf))
+    if ((i = ((s5 ? 32 - hi0bits(S.x[S.wds - 1]) : 1) + s2) & 0xf))
         i = 16 - i;
 #endif
     if (i > 4) {
@@ -2285,22 +2204,22 @@ bump_up:
         s2 += i;
     }
     if (b2 > 0)
-        b = lshift(b, b2);
+        lshift(b, b2);
     if (s2 > 0)
-        S = lshift(S, s2);
+        lshift(S, s2);
     if (k_check) {
         if (cmp(b,S) < 0) {
             k--;
-            b = multadd(b, 10, 0);    /* we botched the k estimate */
+            multadd(b, 10, 0);    /* we botched the k estimate */
             if (leftright)
-                mhi = multadd(mhi, 10, 0);
+                multadd(mhi, 10, 0);
             ilim = ilim1;
         }
     }
 
     if (leftright) {
         if (m2 > 0)
-            mhi = lshift(mhi, m2);
+            lshift(mhi, m2);
 
         /* Compute mlo -- check for special case
          * that d is a normalized power of 2.
@@ -2308,9 +2227,8 @@ bump_up:
 
         mlo = mhi;
         if (spec_case) {
-            mhi = Balloc(mhi->k);
-            Bcopy(mhi, mlo);
-            mhi = lshift(mhi, Log2P);
+            mhi = mlo;
+            lshift(mhi, Log2P);
         }
 
         for (i = 1;;i++) {
@@ -2319,10 +2237,9 @@ bump_up:
              * that will round to d?
              */
             j = cmp(b, mlo);
-            delta = diff(S, mhi);
-            j1 = delta->sign ? 1 : cmp(b, delta);
-            Bfree(delta);
-            if (j1 == 0 && !(word1(d) & 1)) {
+            diff(delta, S, mhi);
+            j1 = delta.sign ? 1 : cmp(b, delta);
+            if (j1 == 0 && !(word1(&u) & 1)) {
                 if (dig == '9')
                     goto round_9_up;
                 if (j > 0)
@@ -2334,17 +2251,17 @@ bump_up:
                 *s++ = dig;
                 goto ret;
             }
-            if (j < 0 || j == 0 && !(word1(d) & 1)) {
-                if (!b->x[0] && b->wds <= 1) {
+            if (j < 0 || (j == 0 && !(word1(&u) & 1))) {
+                if (!b.x[0] && b.wds <= 1) {
 #ifdef SET_INEXACT
                     inexact = 0;
 #endif
                     goto accept_dig;
                 }
                 if (j1 > 0) {
-                    b = lshift(b, 1);
+                    lshift(b, 1);
                     j1 = cmp(b, S);
-                    if ((j1 > 0 || j1 == 0 && dig & 1) && dig++ == '9')
+                    if ((j1 > 0 || (j1 == 0 && (dig & 1))) && dig++ == '9')
                         goto round_9_up;
                 }
 accept_dig:
@@ -2363,18 +2280,14 @@ round_9_up:
             *s++ = dig;
             if (i == ilim)
                 break;
-            b = multadd(b, 10, 0);
-            if (mlo == mhi)
-                mlo = mhi = multadd(mhi, 10, 0);
-            else {
-                mlo = multadd(mlo, 10, 0);
-                mhi = multadd(mhi, 10, 0);
-            }
+            multadd(b, 10, 0);
+            multadd(mlo, 10, 0);
+            multadd(mhi, 10, 0);
         }
     } else
         for (i = 1;; i++) {
             *s++ = dig = quorem(b,S) + '0';
-            if (!b->x[0] && b->wds <= 1) {
+            if (!b.x[0] && b.wds <= 1) {
 #ifdef SET_INEXACT
                 inexact = 0;
 #endif
@@ -2382,14 +2295,14 @@ round_9_up:
             }
             if (i >= ilim)
                 break;
-            b = multadd(b, 10, 0);
+            multadd(b, 10, 0);
         }
 
     /* Round off last digit */
 
-    b = lshift(b, 1);
+    lshift(b, 1);
     j = cmp(b, S);
-    if (j > 0 || j == 0 && dig & 1) {
+    if (j > 0 || (j == 0 && (dig & 1))) {
 roundoff:
         while (*--s == '9')
             if (s == s0) {
@@ -2411,29 +2324,20 @@ one_digit:
     k++;
     goto ret;
 ret:
-    Bfree(S);
-    if (mhi) {
-        if (mlo && mlo != mhi)
-            Bfree(mlo);
-        Bfree(mhi);
-    }
-ret1:
 #ifdef SET_INEXACT
     if (inexact) {
         if (!oldinexact) {
-            word0(d) = Exp_1 + (70 << Exp_shift);
-            word1(d) = 0;
-            dval(d) += 1.;
+            word0(&u) = Exp_1 + (70 << Exp_shift);
+            word1(&u) = 0;
+            dval(&u) += 1.;
         }
     } else if (!oldinexact)
         clear_inexact();
 #endif
-    Bfree(b);
     *s = 0;
     *decpt = k + 1;
     if (rve)
         *rve = s;
-    return s0;
 }
 
 } // namespace WTF
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.h b/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.h
index ed858c0..cbec7c7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/dtoa.h
@@ -30,8 +30,7 @@ namespace WTF {
     extern WTF::Mutex* s_dtoaP5Mutex;
 
     double strtod(const char* s00, char** se);
-    char* dtoa(double d, int ndigits, int* decpt, int* sign, char** rve);
-    void freedtoa(char* s);
+    void dtoa(char* result, double d, int ndigits, int* decpt, int* sign, char** rve);
 
 } // namespace WTF
 
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/qt/MainThreadQt.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/qt/MainThreadQt.cpp
index 1914600..7b2d0f2 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/qt/MainThreadQt.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/qt/MainThreadQt.cpp
@@ -58,12 +58,15 @@ void MainThreadInvoker::dispatch()
 
 Q_GLOBAL_STATIC(MainThreadInvoker, webkit_main_thread_invoker)
 
+void initializeMainThreadPlatform()
+{
+}
 
 void scheduleDispatchFunctionsOnMainThread()
 {
     QMetaObject::invokeMethod(webkit_main_thread_invoker(), "dispatch", Qt::QueuedConnection);
 }
 
-}
+} // namespace WTF
 
 #include "MainThreadQt.moc"
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingQt.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/qt/ThreadingQt.cpp
index 1a40d52..1fdd2bb 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/ThreadingQt.cpp
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/qt/ThreadingQt.cpp
@@ -29,6 +29,7 @@
 #include "config.h"
 #include "Threading.h"
 
+#include "CurrentTime.h"
 #include "HashMap.h"
 #include "MainThread.h"
 #include "RandomNumberSeed.h"
@@ -161,6 +162,10 @@ ThreadIdentifier createThreadInternal(ThreadFunction entryPoint, void* data, con
     return establishIdentifierForThread(threadRef);
 }
 
+void setThreadNameInternal(const char*)
+{
+}
+
 int waitForThreadCompletion(ThreadIdentifier threadID, void** result)
 {
     ASSERT(threadID);
@@ -233,15 +238,22 @@ void ThreadCondition::wait(Mutex& mutex)
     m_condition->wait(mutex.impl());
 }
 
-bool ThreadCondition::timedWait(Mutex& mutex, double secondsToWait)
+bool ThreadCondition::timedWait(Mutex& mutex, double absoluteTime)
 {
-    if (secondsToWait < 0.0) {
+    double currentTime = WTF::currentTime();
+
+    // Time is in the past - return immediately.
+    if (absoluteTime < currentTime)
+        return false;
+
+    // Time is too far in the future (and would overflow unsigned long) - wait forever.
+    if (absoluteTime - currentTime > static_cast<double>(INT_MAX) / 1000.0) {
         wait(mutex);
         return true;
     }
 
-    unsigned long millisecondsToWait = static_cast<unsigned long>(secondsToWait * 1000.0);
-    return m_condition->wait(mutex.impl(), millisecondsToWait);
+    double intervalMilliseconds = (absoluteTime - currentTime) * 1000.0;
+    return m_condition->wait(mutex.impl(), static_cast<unsigned long>(intervalMilliseconds));
 }
 
 void ThreadCondition::signal()
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h
index 5b849e4..f86a9b7 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/Unicode.h
@@ -28,10 +28,12 @@
 #include "qt4/UnicodeQt4.h"
 #elif USE(ICU_UNICODE)
 #include <wtf/unicode/icu/UnicodeIcu.h>
+#elif USE(GLIB_UNICODE)
+#include <wtf/unicode/glib/UnicodeGLib.h>
 #else
 #error "Unknown Unicode implementation"
 #endif
 
-COMPILE_ASSERT(sizeof(UChar) == 2, UCharIsTwoBytes)
+COMPILE_ASSERT(sizeof(UChar) == 2, UCharIsTwoBytes);
 
 #endif // WTF_UNICODE_H
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp
new file mode 100644
index 0000000..a779b36
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp
@@ -0,0 +1,214 @@
+/*
+ *  Copyright (C) 2008 Jürg Billeter <j@bitron.ch>
+ *  Copyright (C) 2008 Dominik Röttsches <dominik.roettsches@access-company.com>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "UnicodeGLib.h"
+
+namespace WTF {
+namespace Unicode {
+
+UChar32 foldCase(UChar32 ch)
+{
+    GOwnPtr<GError> gerror;
+
+    GOwnPtr<char> utf8char;
+    utf8char.set(g_ucs4_to_utf8(reinterpret_cast<gunichar*>(&ch), 1, 0, 0, &gerror.outPtr()));
+    if (gerror)
+        return ch;
+
+    GOwnPtr<char> utf8caseFolded;
+    utf8caseFolded.set(g_utf8_casefold(utf8char.get(), -1));
+
+    GOwnPtr<gunichar> ucs4Result;
+    ucs4Result.set(g_utf8_to_ucs4_fast(utf8caseFolded.get(), -1, 0));
+
+    return *ucs4Result;
+}
+
+int foldCase(UChar* result, int resultLength, const UChar* src, int srcLength, bool* error)
+{
+    *error = false;
+    GOwnPtr<GError> gerror;
+
+    GOwnPtr<char> utf8src;
+    utf8src.set(g_utf16_to_utf8(src, srcLength, 0, 0, &gerror.outPtr()));
+    if (gerror) {
+        *error = true;
+        return -1;
+    }
+
+    GOwnPtr<char> utf8result;
+    utf8result.set(g_utf8_casefold(utf8src.get(), -1));
+
+    long utf16resultLength = -1;
+    GOwnPtr<UChar> utf16result;
+    utf16result.set(g_utf8_to_utf16(utf8result.get(), -1, 0, &utf16resultLength, &gerror.outPtr()));
+    if (gerror) {
+        *error = true;
+        return -1;
+    }
+
+    if (utf16resultLength > resultLength) {
+        *error = true;
+        return utf16resultLength;
+    }
+    memcpy(result, utf16result.get(), utf16resultLength * sizeof(UChar));
+
+    return utf16resultLength;
+}
+
+int toLower(UChar* result, int resultLength, const UChar* src, int srcLength, bool* error)
+{
+    *error = false;
+    GOwnPtr<GError> gerror;
+
+    GOwnPtr<char> utf8src;
+    utf8src.set(g_utf16_to_utf8(src, srcLength, 0, 0, &gerror.outPtr()));
+    if (gerror) {
+        *error = true;
+        return -1;
+    }
+
+    GOwnPtr<char> utf8result;
+    utf8result.set(g_utf8_strdown(utf8src.get(), -1));
+
+    long utf16resultLength = -1;
+    GOwnPtr<UChar> utf16result;
+    utf16result.set(g_utf8_to_utf16(utf8result.get(), -1, 0, &utf16resultLength, &gerror.outPtr()));
+    if (gerror) {
+        *error = true;
+        return -1;
+    }
+
+    if (utf16resultLength > resultLength) {
+        *error = true;
+        return utf16resultLength;
+    }
+    memcpy(result, utf16result.get(), utf16resultLength * sizeof(UChar));
+
+    return utf16resultLength;
+}
+
+int toUpper(UChar* result, int resultLength, const UChar* src, int srcLength, bool* error)
+{
+    *error = false;
+    GOwnPtr<GError> gerror;
+
+    GOwnPtr<char> utf8src;
+    utf8src.set(g_utf16_to_utf8(src, srcLength, 0, 0, &gerror.outPtr()));
+    if (gerror) {
+        *error = true;
+        return -1;
+    }
+
+    GOwnPtr<char> utf8result;
+    utf8result.set(g_utf8_strup(utf8src.get(), -1));
+
+    long utf16resultLength = -1;
+    GOwnPtr<UChar> utf16result;
+    utf16result.set(g_utf8_to_utf16(utf8result.get(), -1, 0, &utf16resultLength, &gerror.outPtr()));
+    if (gerror) {
+        *error = true;
+        return -1;
+    }
+
+    if (utf16resultLength > resultLength) {
+        *error = true;
+        return utf16resultLength;
+    }
+    memcpy(result, utf16result.get(), utf16resultLength * sizeof(UChar));
+
+    return utf16resultLength;
+}
+
+Direction direction(UChar32 c)
+{
+    PangoBidiType type = pango_bidi_type_for_unichar(c);
+    switch (type) {
+    case PANGO_BIDI_TYPE_L:
+        return LeftToRight;
+    case PANGO_BIDI_TYPE_R:
+        return RightToLeft;
+    case PANGO_BIDI_TYPE_AL:
+        return RightToLeftArabic;
+    case PANGO_BIDI_TYPE_LRE:
+        return LeftToRightEmbedding;
+    case PANGO_BIDI_TYPE_RLE:
+        return RightToLeftEmbedding;
+    case PANGO_BIDI_TYPE_LRO:
+        return LeftToRightOverride;
+    case PANGO_BIDI_TYPE_RLO:
+        return RightToLeftOverride;
+    case PANGO_BIDI_TYPE_PDF:
+        return PopDirectionalFormat;
+    case PANGO_BIDI_TYPE_EN:
+        return EuropeanNumber;
+    case PANGO_BIDI_TYPE_AN:
+        return ArabicNumber;
+    case PANGO_BIDI_TYPE_ES:
+        return EuropeanNumberSeparator;
+    case PANGO_BIDI_TYPE_ET:
+        return EuropeanNumberTerminator;
+    case PANGO_BIDI_TYPE_CS:
+        return CommonNumberSeparator;
+    case PANGO_BIDI_TYPE_NSM:
+        return NonSpacingMark;
+    case PANGO_BIDI_TYPE_BN:
+        return BoundaryNeutral;
+    case PANGO_BIDI_TYPE_B:
+        return BlockSeparator;
+    case PANGO_BIDI_TYPE_S:
+        return SegmentSeparator;
+    case PANGO_BIDI_TYPE_WS:
+        return WhiteSpaceNeutral;
+    default:
+        return OtherNeutral;
+    }
+}
+
+int umemcasecmp(const UChar* a, const UChar* b, int len)
+{
+    GOwnPtr<char> utf8a;
+    GOwnPtr<char> utf8b;
+
+    utf8a.set(g_utf16_to_utf8(a, len, 0, 0, 0));
+    utf8b.set(g_utf16_to_utf8(b, len, 0, 0, 0));
+
+    GOwnPtr<char> foldedA;
+    GOwnPtr<char> foldedB;
+
+    foldedA.set(g_utf8_casefold(utf8a.get(), -1));
+    foldedB.set(g_utf8_casefold(utf8b.get(), -1));
+
+    // FIXME: umemcasecmp needs to mimic u_memcasecmp of icu
+    // from the ICU docs:
+    // "Compare two strings case-insensitively using full case folding.
+    // his is equivalent to u_strcmp(u_strFoldCase(s1, n, options), u_strFoldCase(s2, n, options))."
+    //
+    // So it looks like we don't need the full g_utf8_collate here,
+    // but really a bitwise comparison of casefolded unicode chars (not utf-8 bytes).
+    // As there is no direct equivalent to this icu function in GLib, for now
+    // we'll use g_utf8_collate():
+
+    return g_utf8_collate(foldedA.get(), foldedB.get());
+}
+
+}
+}
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h
new file mode 100644
index 0000000..c03d3ec
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h
@@ -0,0 +1,238 @@
+/*
+ *  Copyright (C) 2006 George Staikos <staikos@kde.org>
+ *  Copyright (C) 2006 Alexey Proskuryakov <ap@nypop.com>
+ *  Copyright (C) 2007 Apple Computer, Inc. All rights reserved.
+ *  Copyright (C) 2008 Jürg Billeter <j@bitron.ch>
+ *  Copyright (C) 2008 Dominik Röttsches <dominik.roettsches@access-company.com>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef UnicodeGLib_h
+#define UnicodeGLib_h
+
+#include "UnicodeMacrosFromICU.h"
+#include <wtf/GOwnPtr.h>
+
+#include <glib.h>
+#include <pango/pango.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <string.h>
+
+typedef uint16_t UChar;
+typedef int32_t UChar32;
+
+namespace WTF {
+namespace Unicode {
+
+enum Direction {
+    LeftToRight,
+    RightToLeft,
+    EuropeanNumber,
+    EuropeanNumberSeparator,
+    EuropeanNumberTerminator,
+    ArabicNumber,
+    CommonNumberSeparator,
+    BlockSeparator,
+    SegmentSeparator,
+    WhiteSpaceNeutral,
+    OtherNeutral,
+    LeftToRightEmbedding,
+    LeftToRightOverride,
+    RightToLeftArabic,
+    RightToLeftEmbedding,
+    RightToLeftOverride,
+    PopDirectionalFormat,
+    NonSpacingMark,
+    BoundaryNeutral
+};
+
+enum DecompositionType {
+    DecompositionNone,
+    DecompositionCanonical,
+    DecompositionCompat,
+    DecompositionCircle,
+    DecompositionFinal,
+    DecompositionFont,
+    DecompositionFraction,
+    DecompositionInitial,
+    DecompositionIsolated,
+    DecompositionMedial,
+    DecompositionNarrow,
+    DecompositionNoBreak,
+    DecompositionSmall,
+    DecompositionSquare,
+    DecompositionSub,
+    DecompositionSuper,
+    DecompositionVertical,
+    DecompositionWide,
+};
+
+enum CharCategory {
+    NoCategory =  0,
+    Other_NotAssigned = U_MASK(G_UNICODE_UNASSIGNED),
+    Letter_Uppercase = U_MASK(G_UNICODE_UPPERCASE_LETTER),
+    Letter_Lowercase = U_MASK(G_UNICODE_LOWERCASE_LETTER),
+    Letter_Titlecase = U_MASK(G_UNICODE_TITLECASE_LETTER),
+    Letter_Modifier = U_MASK(G_UNICODE_MODIFIER_LETTER),
+    Letter_Other = U_MASK(G_UNICODE_OTHER_LETTER),
+
+    Mark_NonSpacing = U_MASK(G_UNICODE_NON_SPACING_MARK),
+    Mark_Enclosing = U_MASK(G_UNICODE_ENCLOSING_MARK),
+    Mark_SpacingCombining = U_MASK(G_UNICODE_COMBINING_MARK),
+
+    Number_DecimalDigit = U_MASK(G_UNICODE_DECIMAL_NUMBER),
+    Number_Letter = U_MASK(G_UNICODE_LETTER_NUMBER),
+    Number_Other = U_MASK(G_UNICODE_OTHER_NUMBER),
+
+    Separator_Space = U_MASK(G_UNICODE_SPACE_SEPARATOR),
+    Separator_Line = U_MASK(G_UNICODE_LINE_SEPARATOR),
+    Separator_Paragraph = U_MASK(G_UNICODE_PARAGRAPH_SEPARATOR),
+
+    Other_Control = U_MASK(G_UNICODE_CONTROL),
+    Other_Format = U_MASK(G_UNICODE_FORMAT),
+    Other_PrivateUse = U_MASK(G_UNICODE_PRIVATE_USE),
+    Other_Surrogate = U_MASK(G_UNICODE_SURROGATE),
+
+    Punctuation_Dash = U_MASK(G_UNICODE_DASH_PUNCTUATION),
+    Punctuation_Open = U_MASK(G_UNICODE_OPEN_PUNCTUATION),
+    Punctuation_Close = U_MASK(G_UNICODE_CLOSE_PUNCTUATION),
+    Punctuation_Connector = U_MASK(G_UNICODE_CONNECT_PUNCTUATION),
+    Punctuation_Other = U_MASK(G_UNICODE_OTHER_PUNCTUATION),
+
+    Symbol_Math = U_MASK(G_UNICODE_MATH_SYMBOL),
+    Symbol_Currency = U_MASK(G_UNICODE_CURRENCY_SYMBOL),
+    Symbol_Modifier = U_MASK(G_UNICODE_MODIFIER_SYMBOL),
+    Symbol_Other = U_MASK(G_UNICODE_OTHER_SYMBOL),
+
+    Punctuation_InitialQuote = U_MASK(G_UNICODE_INITIAL_PUNCTUATION),
+    Punctuation_FinalQuote = U_MASK(G_UNICODE_FINAL_PUNCTUATION)
+};
+
+UChar32 foldCase(UChar32);
+
+int foldCase(UChar* result, int resultLength, const UChar* src, int srcLength, bool* error);
+
+int toLower(UChar* result, int resultLength, const UChar* src, int srcLength, bool* error);
+
+inline UChar32 toLower(UChar32 c)
+{
+    return g_unichar_tolower(c);
+}
+
+inline UChar32 toUpper(UChar32 c)
+{
+    return g_unichar_toupper(c);
+}
+
+int toUpper(UChar* result, int resultLength, const UChar* src, int srcLength, bool* error);
+
+inline UChar32 toTitleCase(UChar32 c)
+{
+    return g_unichar_totitle(c);
+}
+
+inline bool isArabicChar(UChar32 c)
+{
+    return c >= 0x0600 && c <= 0x06FF;
+}
+
+inline bool isFormatChar(UChar32 c)
+{
+    return g_unichar_type(c) == G_UNICODE_FORMAT;
+}
+
+inline bool isSeparatorSpace(UChar32 c)
+{
+    return g_unichar_type(c) == G_UNICODE_SPACE_SEPARATOR;
+}
+
+inline bool isPrintableChar(UChar32 c)
+{
+    return g_unichar_isprint(c);
+}
+
+inline bool isDigit(UChar32 c)
+{
+    return g_unichar_isdigit(c);
+}
+
+inline bool isPunct(UChar32 c)
+{
+    return g_unichar_ispunct(c);
+}
+
+inline bool hasLineBreakingPropertyComplexContext(UChar32 c)
+{
+    // FIXME
+    return false;
+}
+
+inline bool hasLineBreakingPropertyComplexContextOrIdeographic(UChar32 c)
+{
+    // FIXME
+    return false;
+}
+
+inline UChar32 mirroredChar(UChar32 c)
+{
+    gunichar mirror = 0;
+    g_unichar_get_mirror_char(c, &mirror);
+    return mirror;
+}
+
+inline CharCategory category(UChar32 c)
+{
+    if (c > 0xffff)
+        return NoCategory;
+
+    return (CharCategory) U_MASK(g_unichar_type(c));
+}
+
+Direction direction(UChar32);
+
+inline bool isLower(UChar32 c)
+{
+    return g_unichar_islower(c);
+}
+
+inline int digitValue(UChar32 c)
+{
+    return g_unichar_digit_value(c);
+}
+
+inline uint8_t combiningClass(UChar32 c)
+{
+    // FIXME
+    // return g_unichar_combining_class(c);
+    return 0;
+}
+
+inline DecompositionType decompositionType(UChar32 c)
+{
+    // FIXME
+    return DecompositionNone;
+}
+
+int umemcasecmp(const UChar*, const UChar*, int len);
+
+}
+}
+
+#endif
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeMacrosFromICU.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeMacrosFromICU.h
new file mode 100644
index 0000000..5d3eca6
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/glib/UnicodeMacrosFromICU.h
@@ -0,0 +1,69 @@
+/*
+ *  Copyright (C) 2006 George Staikos <staikos@kde.org>
+ *  Copyright (C) 2006 Alexey Proskuryakov <ap@nypop.com>
+ *  Copyright (C) 2007 Apple Computer, Inc. All rights reserved.
+ *  Copyright (C) 2008 Jürg Billeter <j@bitron.ch>
+ *  Copyright (C) 2008 Dominik Röttsches <dominik.roettsches@access-company.com>
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef UnicodeMacrosFromICU_h
+#define UnicodeMacrosFromICU_h
+
+// some defines from ICU
+
+#define U16_IS_LEAD(c) (((c)&0xfffffc00)==0xd800)
+#define U16_IS_TRAIL(c) (((c)&0xfffffc00)==0xdc00)
+#define U16_SURROGATE_OFFSET ((0xd800<<10UL)+0xdc00-0x10000)
+#define U16_GET_SUPPLEMENTARY(lead, trail) \
+    (((UChar32)(lead)<<10UL)+(UChar32)(trail)-U16_SURROGATE_OFFSET)
+
+#define U16_LEAD(supplementary) (UChar)(((supplementary)>>10)+0xd7c0)
+#define U16_TRAIL(supplementary) (UChar)(((supplementary)&0x3ff)|0xdc00)
+
+#define U_IS_SURROGATE(c) (((c)&0xfffff800)==0xd800)
+#define U16_IS_SINGLE(c) !U_IS_SURROGATE(c)
+#define U16_IS_SURROGATE(c) U_IS_SURROGATE(c)
+#define U16_IS_SURROGATE_LEAD(c) (((c)&0x400)==0)
+
+#define U16_PREV(s, start, i, c) { \
+    (c)=(s)[--(i)]; \
+    if(U16_IS_TRAIL(c)) { \
+        uint16_t __c2; \
+        if((i)>(start) && U16_IS_LEAD(__c2=(s)[(i)-1])) { \
+            --(i); \
+            (c)=U16_GET_SUPPLEMENTARY(__c2, (c)); \
+        } \
+    } \
+}
+
+#define U16_NEXT(s, i, length, c) { \
+    (c)=(s)[(i)++]; \
+    if(U16_IS_LEAD(c)) { \
+        uint16_t __c2; \
+        if((i)<(length) && U16_IS_TRAIL(__c2=(s)[(i)])) { \
+            ++(i); \
+            (c)=U16_GET_SUPPLEMENTARY((c), __c2); \
+        } \
+    } \
+}
+
+#define U_MASK(x) ((uint32_t)1<<(x))
+
+#endif
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
index 608aea6..35c6fbf 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
@@ -179,6 +179,17 @@ inline bool isPunct(UChar32 c)
     return !!u_ispunct(c);
 }
 
+inline bool hasLineBreakingPropertyComplexContext(UChar32 c)
+{
+    return u_getIntPropertyValue(c, UCHAR_LINE_BREAK) == U_LB_COMPLEX_CONTEXT;
+}
+
+inline bool hasLineBreakingPropertyComplexContextOrIdeographic(UChar32 c)
+{
+    int32_t prop = u_getIntPropertyValue(c, UCHAR_LINE_BREAK);
+    return prop == U_LB_COMPLEX_CONTEXT || prop == U_LB_IDEOGRAPHIC;
+}
+
 inline UChar32 mirroredChar(UChar32 c)
 {
     return u_charMirror(c);
diff --git a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
index d7d78ce..1531694 100644
--- a/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
+++ b/src/3rdparty/webkit/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
@@ -92,6 +92,17 @@ typedef uint32_t UChar32;
     } \
 }
 
+#define U16_PREV(s, start, i, c) { \
+    (c)=(s)[--(i)]; \
+    if(U16_IS_TRAIL(c)) { \
+        uint16_t __c2; \
+        if((i)>(start) && U16_IS_LEAD(__c2=(s)[(i)-1])) { \
+            --(i); \
+            (c)=U16_GET_SUPPLEMENTARY(__c2, (c)); \
+        } \
+    } \
+}
+
 #define U_MASK(x) ((uint32_t)1<<(x))
 
 namespace WTF {
@@ -352,6 +363,12 @@ inline bool isLower(UChar32 c)
     return QChar::category(c) == QChar::Letter_Lowercase;
 }
 
+inline bool hasLineBreakingPropertyComplexContext(UChar32)
+{
+    // FIXME: Implement this to return whether the character has line breaking property SA (Complex Context).
+    return false;
+}
+
 inline UChar32 mirroredChar(UChar32 c)
 {
     return QChar::mirroredChar(c);
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.cpp
new file mode 100644
index 0000000..c7b3c81
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.cpp
@@ -0,0 +1,728 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "RegexCompiler.h"
+
+#include "RegexInterpreter.h"
+#include "RegexPattern.h"
+#include <wtf/Vector.h>
+
+#if ENABLE(YARR)
+
+using namespace WTF;
+
+namespace JSC { namespace Yarr {
+
+class CharacterClassConstructor {
+public:
+    CharacterClassConstructor(bool isCaseInsensitive = false)
+        : m_isCaseInsensitive(isCaseInsensitive)
+    {
+    }
+    
+    void reset()
+    {
+        m_matches.clear();
+        m_ranges.clear();
+        m_matchesUnicode.clear();
+        m_rangesUnicode.clear();
+    }
+
+    void append(const CharacterClass* other)
+    {
+        for (size_t i = 0; i < other->m_matches.size(); ++i)
+            addSorted(m_matches, other->m_matches[i]);
+        for (size_t i = 0; i < other->m_ranges.size(); ++i)
+            addSortedRange(m_ranges, other->m_ranges[i].begin, other->m_ranges[i].end);
+        for (size_t i = 0; i < other->m_matchesUnicode.size(); ++i)
+            addSorted(m_matchesUnicode, other->m_matchesUnicode[i]);
+        for (size_t i = 0; i < other->m_rangesUnicode.size(); ++i)
+            addSortedRange(m_rangesUnicode, other->m_rangesUnicode[i].begin, other->m_rangesUnicode[i].end);
+    }
+
+    void putChar(UChar ch)
+    {
+        if (ch <= 0x7f) {
+            if (m_isCaseInsensitive && isASCIIAlpha(ch)) {
+                addSorted(m_matches, toASCIIUpper(ch));
+                addSorted(m_matches, toASCIILower(ch));
+            } else
+                addSorted(m_matches, ch);
+        } else {
+            UChar upper, lower;
+            if (m_isCaseInsensitive && ((upper = Unicode::toUpper(ch)) != (lower = Unicode::toLower(ch)))) {
+                addSorted(m_matchesUnicode, upper);
+                addSorted(m_matchesUnicode, lower);
+            } else
+                addSorted(m_matchesUnicode, ch);
+        }
+    }
+
+    // returns true if this character has another case, and 'ch' is the upper case form.
+    static inline bool isUnicodeUpper(UChar ch)
+    {
+        return ch != Unicode::toLower(ch);
+    }
+
+    // returns true if this character has another case, and 'ch' is the lower case form.
+    static inline bool isUnicodeLower(UChar ch)
+    {
+        return ch != Unicode::toUpper(ch);
+    }
+
+    void putRange(UChar lo, UChar hi)
+    {
+        if (lo <= 0x7f) {
+            char asciiLo = lo;
+            char asciiHi = std::min(hi, (UChar)0x7f);
+            addSortedRange(m_ranges, lo, asciiHi);
+            
+            if (m_isCaseInsensitive) {
+                if ((asciiLo <= 'Z') && (asciiHi >= 'A'))
+                    addSortedRange(m_ranges, std::max(asciiLo, 'A')+('a'-'A'), std::min(asciiHi, 'Z')+('a'-'A'));
+                if ((asciiLo <= 'z') && (asciiHi >= 'a'))
+                    addSortedRange(m_ranges, std::max(asciiLo, 'a')+('A'-'a'), std::min(asciiHi, 'z')+('A'-'a'));
+            }
+        }
+        if (hi >= 0x80) {
+            uint32_t unicodeCurr = std::max(lo, (UChar)0x80);
+            addSortedRange(m_rangesUnicode, unicodeCurr, hi);
+            
+            if (m_isCaseInsensitive) {
+                while (unicodeCurr <= hi) {
+                    // If the upper bound of the range (hi) is 0xffff, the increments to
+                    // unicodeCurr in this loop may take it to 0x10000.  This is fine
+                    // (if so we won't re-enter the loop, since the loop condition above
+                    // will definitely fail) - but this does mean we cannot use a UChar
+                    // to represent unicodeCurr, we must use a 32-bit value instead.
+                    ASSERT(unicodeCurr <= 0xffff);
+
+                    if (isUnicodeUpper(unicodeCurr)) {
+                        UChar lowerCaseRangeBegin = Unicode::toLower(unicodeCurr);
+                        UChar lowerCaseRangeEnd = lowerCaseRangeBegin;
+                        while ((++unicodeCurr <= hi) && isUnicodeUpper(unicodeCurr) && (Unicode::toLower(unicodeCurr) == (lowerCaseRangeEnd + 1)))
+                            lowerCaseRangeEnd++;
+                        addSortedRange(m_rangesUnicode, lowerCaseRangeBegin, lowerCaseRangeEnd);
+                    } else if (isUnicodeLower(unicodeCurr)) {
+                        UChar upperCaseRangeBegin = Unicode::toUpper(unicodeCurr);
+                        UChar upperCaseRangeEnd = upperCaseRangeBegin;
+                        while ((++unicodeCurr <= hi) && isUnicodeLower(unicodeCurr) && (Unicode::toUpper(unicodeCurr) == (upperCaseRangeEnd + 1)))
+                            upperCaseRangeEnd++;
+                        addSortedRange(m_rangesUnicode, upperCaseRangeBegin, upperCaseRangeEnd);
+                    } else
+                        ++unicodeCurr;
+                }
+            }
+        }
+    }
+
+    CharacterClass* charClass()
+    {
+        CharacterClass* characterClass = new CharacterClass();
+
+        characterClass->m_matches.append(m_matches);
+        characterClass->m_ranges.append(m_ranges);
+        characterClass->m_matchesUnicode.append(m_matchesUnicode);
+        characterClass->m_rangesUnicode.append(m_rangesUnicode);
+
+        reset();
+
+        return characterClass;
+    }
+
+private:
+    void addSorted(Vector<UChar>& matches, UChar ch)
+    {
+        unsigned pos = 0;
+        unsigned range = matches.size();
+
+        // binary chop, find position to insert char.
+        while (range) {
+            unsigned index = range >> 1;
+
+            int val = matches[pos+index] - ch;
+            if (!val)
+                return;
+            else if (val > 0)
+                range = index;
+            else {
+                pos += (index+1);
+                range -= (index+1);
+            }
+        }
+        
+        if (pos == matches.size())
+            matches.append(ch);
+        else
+            matches.insert(pos, ch);
+    }
+
+    void addSortedRange(Vector<CharacterRange>& ranges, UChar lo, UChar hi)
+    {
+        unsigned end = ranges.size();
+        
+        // Simple linear scan - I doubt there are that many ranges anyway...
+        // feel free to fix this with something faster (eg binary chop).
+        for (unsigned i = 0; i < end; ++i) {
+            // does the new range fall before the current position in the array
+            if (hi < ranges[i].begin) {
+                // optional optimization: concatenate appending ranges? - may not be worthwhile.
+                if (hi == (ranges[i].begin - 1)) {
+                    ranges[i].begin = lo;
+                    return;
+                }
+                ranges.insert(i, CharacterRange(lo, hi));
+                return;
+            }
+            // Okay, since we didn't hit the last case, the end of the new range is definitely at or after the begining
+            // If the new range start at or before the end of the last range, then the overlap (if it starts one after the
+            // end of the last range they concatenate, which is just as good.
+            if (lo <= (ranges[i].end + 1)) {
+                // found an intersect! we'll replace this entry in the array.
+                ranges[i].begin = std::min(ranges[i].begin, lo);
+                ranges[i].end = std::max(ranges[i].end, hi);
+
+                // now check if the new range can subsume any subsequent ranges.
+                unsigned next = i+1;
+                // each iteration of the loop we will either remove something from the list, or break the loop.
+                while (next < ranges.size()) {
+                    if (ranges[next].begin <= (ranges[i].end + 1)) {
+                        // the next entry now overlaps / concatenates this one.
+                        ranges[i].end = std::max(ranges[i].end, ranges[next].end);
+                        ranges.remove(next);
+                    } else
+                        break;
+                }
+                
+                return;
+            }
+        }
+
+        // CharacterRange comes after all existing ranges.
+        ranges.append(CharacterRange(lo, hi));
+    }
+
+    bool m_isCaseInsensitive;
+
+    Vector<UChar> m_matches;
+    Vector<CharacterRange> m_ranges;
+    Vector<UChar> m_matchesUnicode;
+    Vector<CharacterRange> m_rangesUnicode;
+};
+
+
+CharacterClass* newlineCreate()
+{
+    CharacterClass* characterClass = new CharacterClass();
+
+    characterClass->m_matches.append('\n');
+    characterClass->m_matches.append('\r');
+    characterClass->m_matchesUnicode.append(0x2028);
+    characterClass->m_matchesUnicode.append(0x2029);
+    
+    return characterClass;
+}
+
+CharacterClass* digitsCreate()
+{
+    CharacterClass* characterClass = new CharacterClass();
+
+    characterClass->m_ranges.append(CharacterRange('0', '9'));
+    
+    return characterClass;
+}
+
+CharacterClass* spacesCreate()
+{
+    CharacterClass* characterClass = new CharacterClass();
+
+    characterClass->m_matches.append(' ');
+    characterClass->m_ranges.append(CharacterRange('\t', '\r'));
+    characterClass->m_matchesUnicode.append(0x00a0);
+    characterClass->m_matchesUnicode.append(0x1680);
+    characterClass->m_matchesUnicode.append(0x180e);
+    characterClass->m_matchesUnicode.append(0x2028);
+    characterClass->m_matchesUnicode.append(0x2029);
+    characterClass->m_matchesUnicode.append(0x202f);
+    characterClass->m_matchesUnicode.append(0x205f);
+    characterClass->m_matchesUnicode.append(0x3000);
+    characterClass->m_rangesUnicode.append(CharacterRange(0x2000, 0x200a));
+    
+    return characterClass;
+}
+
+CharacterClass* wordcharCreate()
+{
+    CharacterClass* characterClass = new CharacterClass();
+
+    characterClass->m_matches.append('_');
+    characterClass->m_ranges.append(CharacterRange('0', '9'));
+    characterClass->m_ranges.append(CharacterRange('A', 'Z'));
+    characterClass->m_ranges.append(CharacterRange('a', 'z'));
+    
+    return characterClass;
+}
+
+CharacterClass* nondigitsCreate()
+{
+    CharacterClass* characterClass = new CharacterClass();
+
+    characterClass->m_ranges.append(CharacterRange(0, '0' - 1));
+    characterClass->m_ranges.append(CharacterRange('9' + 1, 0x7f));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x80, 0xffff));
+    
+    return characterClass;
+}
+
+CharacterClass* nonspacesCreate()
+{
+    CharacterClass* characterClass = new CharacterClass();
+
+    characterClass->m_ranges.append(CharacterRange(0, '\t' - 1));
+    characterClass->m_ranges.append(CharacterRange('\r' + 1, ' ' - 1));
+    characterClass->m_ranges.append(CharacterRange(' ' + 1, 0x7f));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x0080, 0x009f));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x00a1, 0x167f));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x1681, 0x180d));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x180f, 0x1fff));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x200b, 0x2027));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x202a, 0x202e));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x2030, 0x205e));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x2060, 0x2fff));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x3001, 0xffff));
+    
+    return characterClass;
+}
+
+CharacterClass* nonwordcharCreate()
+{
+    CharacterClass* characterClass = new CharacterClass();
+
+    characterClass->m_matches.append('`');
+    characterClass->m_ranges.append(CharacterRange(0, '0' - 1));
+    characterClass->m_ranges.append(CharacterRange('9' + 1, 'A' - 1));
+    characterClass->m_ranges.append(CharacterRange('Z' + 1, '_' - 1));
+    characterClass->m_ranges.append(CharacterRange('z' + 1, 0x7f));
+    characterClass->m_rangesUnicode.append(CharacterRange(0x80, 0xffff));
+
+    return characterClass;
+}
+
+
+class RegexPatternConstructor {
+public:
+    RegexPatternConstructor(RegexPattern& pattern)
+        : m_pattern(pattern)
+        , m_characterClassConstructor(pattern.m_ignoreCase)
+    {
+    }
+
+    ~RegexPatternConstructor()
+    {
+    }
+
+    void reset()
+    {
+        m_pattern.reset();
+        m_characterClassConstructor.reset();
+    }
+    
+    void assertionBOL()
+    {
+        m_alternative->m_terms.append(PatternTerm::BOL());
+    }
+    void assertionEOL()
+    {
+        m_alternative->m_terms.append(PatternTerm::EOL());
+    }
+    void assertionWordBoundary(bool invert)
+    {
+        m_alternative->m_terms.append(PatternTerm::WordBoundary(invert));
+    }
+
+    void atomPatternCharacter(UChar ch)
+    {
+        // We handle case-insensitive checking of unicode characters which do have both
+        // cases by handling them as if they were defined using a CharacterClass.
+        if (m_pattern.m_ignoreCase && !isASCII(ch) && (Unicode::toUpper(ch) != Unicode::toLower(ch))) {
+            atomCharacterClassBegin();
+            atomCharacterClassAtom(ch);
+            atomCharacterClassEnd();
+        } else
+            m_alternative->m_terms.append(PatternTerm(ch));
+    }
+
+    void atomBuiltInCharacterClass(BuiltInCharacterClassID classID, bool invert)
+    {
+        switch (classID) {
+        case DigitClassID:
+            m_alternative->m_terms.append(PatternTerm(m_pattern.digitsCharacterClass(), invert));
+            break;
+        case SpaceClassID:
+            m_alternative->m_terms.append(PatternTerm(m_pattern.spacesCharacterClass(), invert));
+            break;
+        case WordClassID:
+            m_alternative->m_terms.append(PatternTerm(m_pattern.wordcharCharacterClass(), invert));
+            break;
+        case NewlineClassID:
+            m_alternative->m_terms.append(PatternTerm(m_pattern.newlineCharacterClass(), invert));
+            break;
+        }
+    }
+
+    void atomCharacterClassBegin(bool invert = false)
+    {
+        m_invertCharacterClass = invert;
+    }
+
+    void atomCharacterClassAtom(UChar ch)
+    {
+        m_characterClassConstructor.putChar(ch);
+    }
+
+    void atomCharacterClassRange(UChar begin, UChar end)
+    {
+        m_characterClassConstructor.putRange(begin, end);
+    }
+
+    void atomCharacterClassBuiltIn(BuiltInCharacterClassID classID, bool invert)
+    {
+        ASSERT(classID != NewlineClassID);
+
+        switch (classID) {
+        case DigitClassID:
+            m_characterClassConstructor.append(invert ? m_pattern.nondigitsCharacterClass() : m_pattern.digitsCharacterClass());
+            break;
+        
+        case SpaceClassID:
+            m_characterClassConstructor.append(invert ? m_pattern.nonspacesCharacterClass() : m_pattern.spacesCharacterClass());
+            break;
+        
+        case WordClassID:
+            m_characterClassConstructor.append(invert ? m_pattern.nonwordcharCharacterClass() : m_pattern.wordcharCharacterClass());
+            break;
+        
+        default:
+            ASSERT_NOT_REACHED();
+        }
+    }
+
+    void atomCharacterClassEnd()
+    {
+        CharacterClass* newCharacterClass = m_characterClassConstructor.charClass();
+        m_pattern.m_userCharacterClasses.append(newCharacterClass);
+        m_alternative->m_terms.append(PatternTerm(newCharacterClass, m_invertCharacterClass));
+    }
+
+    void atomParenthesesSubpatternBegin(bool capture = true)
+    {
+        unsigned subpatternId = m_pattern.m_numSubpatterns + 1;
+        if (capture)
+            m_pattern.m_numSubpatterns++;
+
+        PatternDisjunction* parenthesesDisjunction = new PatternDisjunction(m_alternative);
+        m_pattern.m_disjunctions.append(parenthesesDisjunction);
+        m_alternative->m_terms.append(PatternTerm(PatternTerm::TypeParenthesesSubpattern, subpatternId, parenthesesDisjunction, capture));
+        m_alternative = parenthesesDisjunction->addNewAlternative();
+    }
+
+    void atomParentheticalAssertionBegin(bool invert = false)
+    {
+        PatternDisjunction* parenthesesDisjunction = new PatternDisjunction(m_alternative);
+        m_pattern.m_disjunctions.append(parenthesesDisjunction);
+        m_alternative->m_terms.append(PatternTerm(PatternTerm::TypeParentheticalAssertion, m_pattern.m_numSubpatterns + 1, parenthesesDisjunction, invert));
+        m_alternative = parenthesesDisjunction->addNewAlternative();
+    }
+
+    void atomParenthesesEnd()
+    {
+        ASSERT(m_alternative->m_parent);
+        ASSERT(m_alternative->m_parent->m_parent);
+        m_alternative = m_alternative->m_parent->m_parent;
+        
+        m_alternative->lastTerm().parentheses.lastSubpatternId = m_pattern.m_numSubpatterns;
+    }
+
+    void atomBackReference(unsigned subpatternId)
+    {
+        ASSERT(subpatternId);
+        m_pattern.m_maxBackReference = std::max(m_pattern.m_maxBackReference, subpatternId);
+
+        if (subpatternId > m_pattern.m_numSubpatterns) {
+            m_alternative->m_terms.append(PatternTerm::ForwardReference());
+            return;
+        }
+
+        PatternAlternative* currentAlternative = m_alternative;
+        ASSERT(currentAlternative);
+
+        // Note to self: if we waited until the AST was baked, we could also remove forwards refs 
+        while ((currentAlternative = currentAlternative->m_parent->m_parent)) {
+            PatternTerm& term = currentAlternative->lastTerm();
+            ASSERT((term.type == PatternTerm::TypeParenthesesSubpattern) || (term.type == PatternTerm::TypeParentheticalAssertion));
+
+            if ((term.type == PatternTerm::TypeParenthesesSubpattern) && term.invertOrCapture && (subpatternId == term.subpatternId)) {
+                m_alternative->m_terms.append(PatternTerm::ForwardReference());
+                return;
+            }
+        }
+
+        m_alternative->m_terms.append(PatternTerm(subpatternId));
+    }
+
+    PatternDisjunction* copyDisjunction(PatternDisjunction* disjunction)
+    {
+        PatternDisjunction* newDisjunction = new PatternDisjunction();
+
+        newDisjunction->m_parent = disjunction->m_parent;
+        for (unsigned alt = 0; alt < disjunction->m_alternatives.size(); ++alt) {
+            PatternAlternative* alternative = disjunction->m_alternatives[alt];
+            PatternAlternative* newAlternative = newDisjunction->addNewAlternative();
+            for (unsigned i = 0; i < alternative->m_terms.size(); ++i)
+                newAlternative->m_terms.append(copyTerm(alternative->m_terms[i]));
+        }
+
+        m_pattern.m_disjunctions.append(newDisjunction);
+        return newDisjunction;
+    }
+
+    PatternTerm copyTerm(PatternTerm& term)
+    {
+        if ((term.type != PatternTerm::TypeParenthesesSubpattern) && (term.type != PatternTerm::TypeParentheticalAssertion))
+            return PatternTerm(term);
+
+        PatternTerm termCopy = term;
+        termCopy.parentheses.disjunction = copyDisjunction(termCopy.parentheses.disjunction);
+        return termCopy;
+    }
+
+    void quantifyAtom(unsigned min, unsigned max, bool greedy)
+    {
+        ASSERT(min <= max);
+        ASSERT(m_alternative->m_terms.size());
+
+        if (!max) {
+            m_alternative->removeLastTerm();
+            return;
+        }
+
+        PatternTerm& term = m_alternative->lastTerm();
+        ASSERT(term.type > PatternTerm::TypeAssertionWordBoundary);
+        ASSERT((term.quantityCount == 1) && (term.quantityType == QuantifierFixedCount));
+
+        // For any assertion with a zero minimum, not matching is valid and has no effect,
+        // remove it.  Otherwise, we need to match as least once, but there is no point
+        // matching more than once, so remove the quantifier.  It is not entirely clear
+        // from the spec whether or not this behavior is correct, but I believe this
+        // matches Firefox. :-/
+        if (term.type == PatternTerm::TypeParentheticalAssertion) {
+            if (!min)
+                m_alternative->removeLastTerm();
+            return;
+        }
+
+        if (min == 0)
+            term.quantify(max, greedy   ? QuantifierGreedy : QuantifierNonGreedy);
+        else if (min == max)
+            term.quantify(min, QuantifierFixedCount);
+        else {
+            term.quantify(min, QuantifierFixedCount);
+            m_alternative->m_terms.append(copyTerm(term));
+            // NOTE: this term is interesting from an analysis perspective, in that it can be ignored.....
+            m_alternative->lastTerm().quantify((max == UINT_MAX) ? max : max - min, greedy ? QuantifierGreedy : QuantifierNonGreedy);
+            if (m_alternative->lastTerm().type == PatternTerm::TypeParenthesesSubpattern)
+                m_alternative->lastTerm().parentheses.isCopy = true;
+        }
+    }
+
+    void disjunction()
+    {
+        m_alternative = m_alternative->m_parent->addNewAlternative();
+    }
+
+    void regexBegin()
+    {
+        m_pattern.m_body = new PatternDisjunction();
+        m_alternative = m_pattern.m_body->addNewAlternative();
+        m_pattern.m_disjunctions.append(m_pattern.m_body);
+    }
+    void regexEnd()
+    {
+    }
+    void regexError()
+    {
+    }
+
+    unsigned setupAlternativeOffsets(PatternAlternative* alternative, unsigned currentCallFrameSize, unsigned initialInputPosition)
+    {
+        alternative->m_hasFixedSize = true;
+        unsigned currentInputPosition = initialInputPosition;
+
+        for (unsigned i = 0; i < alternative->m_terms.size(); ++i) {
+            PatternTerm& term = alternative->m_terms[i];
+
+            switch (term.type) {
+            case PatternTerm::TypeAssertionBOL:
+            case PatternTerm::TypeAssertionEOL:
+            case PatternTerm::TypeAssertionWordBoundary:
+                term.inputPosition = currentInputPosition;
+                break;
+
+            case PatternTerm::TypeBackReference:
+                term.inputPosition = currentInputPosition;
+                term.frameLocation = currentCallFrameSize;
+                currentCallFrameSize += RegexStackSpaceForBackTrackInfoBackReference;
+                alternative->m_hasFixedSize = false;
+                break;
+
+            case PatternTerm::TypeForwardReference:
+                break;
+
+            case PatternTerm::TypePatternCharacter:
+                term.inputPosition = currentInputPosition;
+                if (term.quantityType != QuantifierFixedCount) {
+                    term.frameLocation = currentCallFrameSize;
+                    currentCallFrameSize += RegexStackSpaceForBackTrackInfoPatternCharacter;
+                    alternative->m_hasFixedSize = false;
+                } else
+                    currentInputPosition += term.quantityCount;
+                break;
+
+            case PatternTerm::TypeCharacterClass:
+                term.inputPosition = currentInputPosition;
+                if (term.quantityType != QuantifierFixedCount) {
+                    term.frameLocation = currentCallFrameSize;
+                    currentCallFrameSize += RegexStackSpaceForBackTrackInfoCharacterClass;
+                    alternative->m_hasFixedSize = false;
+                } else
+                    currentInputPosition += term.quantityCount;
+                break;
+
+            case PatternTerm::TypeParenthesesSubpattern:
+                // Note: for fixed once parentheses we will ensure at least the minimum is available; others are on their own.
+                term.frameLocation = currentCallFrameSize;
+                if ((term.quantityCount == 1) && !term.parentheses.isCopy) {
+                    if (term.quantityType == QuantifierFixedCount) {
+                        currentCallFrameSize = setupDisjunctionOffsets(term.parentheses.disjunction, currentCallFrameSize, currentInputPosition);
+                        currentInputPosition += term.parentheses.disjunction->m_minimumSize;
+                    } else {
+                        currentCallFrameSize += RegexStackSpaceForBackTrackInfoParenthesesOnce;
+                        currentCallFrameSize = setupDisjunctionOffsets(term.parentheses.disjunction, currentCallFrameSize, currentInputPosition);
+                    }
+                    term.inputPosition = currentInputPosition;
+                } else {
+                    term.inputPosition = currentInputPosition;
+                    setupDisjunctionOffsets(term.parentheses.disjunction, 0, currentInputPosition);
+                    currentCallFrameSize += RegexStackSpaceForBackTrackInfoParentheses;
+                }
+                // Fixed count of 1 could be accepted, if they have a fixed size *AND* if all alternatives are of the same length.
+                alternative->m_hasFixedSize = false;
+                break;
+
+            case PatternTerm::TypeParentheticalAssertion:
+                term.inputPosition = currentInputPosition;
+                term.frameLocation = currentCallFrameSize;
+                currentCallFrameSize = setupDisjunctionOffsets(term.parentheses.disjunction, currentCallFrameSize + RegexStackSpaceForBackTrackInfoParentheticalAssertion, currentInputPosition);
+                break;
+            }
+        }
+
+        alternative->m_minimumSize = currentInputPosition - initialInputPosition;
+        return currentCallFrameSize;
+    }
+
+    unsigned setupDisjunctionOffsets(PatternDisjunction* disjunction, unsigned initialCallFrameSize, unsigned initialInputPosition)
+    {
+        if ((disjunction != m_pattern.m_body) && (disjunction->m_alternatives.size() > 1))
+            initialCallFrameSize += RegexStackSpaceForBackTrackInfoAlternative;
+
+        unsigned minimumInputSize = UINT_MAX;
+        unsigned maximumCallFrameSize = 0;
+        bool hasFixedSize = true;
+
+        for (unsigned alt = 0; alt < disjunction->m_alternatives.size(); ++alt) {
+            PatternAlternative* alternative = disjunction->m_alternatives[alt];
+            unsigned currentAlternativeCallFrameSize = setupAlternativeOffsets(alternative, initialCallFrameSize, initialInputPosition);
+            minimumInputSize = min(minimumInputSize, alternative->m_minimumSize);
+            maximumCallFrameSize = max(maximumCallFrameSize, currentAlternativeCallFrameSize);
+            hasFixedSize &= alternative->m_hasFixedSize;
+        }
+        
+        ASSERT(minimumInputSize != UINT_MAX);
+        ASSERT(maximumCallFrameSize >= initialCallFrameSize);
+
+        disjunction->m_hasFixedSize = hasFixedSize;
+        disjunction->m_minimumSize = minimumInputSize;
+        disjunction->m_callFrameSize = maximumCallFrameSize;
+        return maximumCallFrameSize;
+    }
+
+    void setupOffsets()
+    {
+        setupDisjunctionOffsets(m_pattern.m_body, 0, 0);
+    }
+
+private:
+    RegexPattern& m_pattern;
+    PatternAlternative* m_alternative;
+    CharacterClassConstructor m_characterClassConstructor;
+    bool m_invertCharacterClass;
+};
+
+
+const char* compileRegex(const UString& patternString, RegexPattern& pattern)
+{
+    RegexPatternConstructor constructor(pattern);
+
+    if (const char* error = parse(constructor, patternString))
+        return error;
+    
+    // If the pattern contains illegal backreferences reset & reparse.
+    // Quoting Netscape's "What's new in JavaScript 1.2",
+    //      "Note: if the number of left parentheses is less than the number specified
+    //       in \#, the \# is taken as an octal escape as described in the next row."
+    if (pattern.containsIllegalBackReference()) {
+        unsigned numSubpatterns = pattern.m_numSubpatterns;
+
+        constructor.reset();
+#ifndef NDEBUG
+        const char* error =
+#endif
+            parse(constructor, patternString, numSubpatterns);
+
+        ASSERT(!error);
+        ASSERT(numSubpatterns == pattern.m_numSubpatterns);
+    }
+
+    constructor.setupOffsets();
+
+    return false;
+};
+
+
+} }
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.h
new file mode 100644
index 0000000..3ed2be9
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexCompiler.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef RegexCompiler_h
+#define RegexCompiler_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(YARR)
+
+#include <wtf/unicode/Unicode.h>
+#include "RegexParser.h"
+#include "RegexPattern.h"
+
+namespace JSC { namespace Yarr {
+
+const char* compileRegex(const UString& patternString, RegexPattern& pattern);
+
+} } // namespace JSC::Yarr
+
+#endif
+
+#endif // RegexCompiler_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp
new file mode 100644
index 0000000..b0aae65
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.cpp
@@ -0,0 +1,1638 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "RegexInterpreter.h"
+
+#include "RegexCompiler.h"
+#include "RegexPattern.h"
+
+#ifndef NDEBUG
+#include <stdio.h>
+#endif
+
+#if ENABLE(YARR)
+
+using namespace WTF;
+
+namespace JSC { namespace Yarr {
+
+class Interpreter {
+public:
+    struct ParenthesesDisjunctionContext;
+
+    struct BackTrackInfoPatternCharacter {
+        uintptr_t matchAmount;
+    };
+    struct BackTrackInfoCharacterClass {
+        uintptr_t matchAmount;
+    };
+    struct BackTrackInfoBackReference {
+        uintptr_t begin; // Not really needed for greedy quantifiers.
+        uintptr_t matchAmount; // Not really needed for fixed quantifiers.
+    };
+    struct BackTrackInfoAlternative {
+        uintptr_t offset;
+    };
+    struct BackTrackInfoParentheticalAssertion {
+        uintptr_t begin;
+    };
+    struct BackTrackInfoParenthesesOnce {
+        uintptr_t inParentheses;
+    };
+    struct BackTrackInfoParentheses {
+        uintptr_t matchAmount;
+        ParenthesesDisjunctionContext* lastContext;
+        uintptr_t prevBegin;
+        uintptr_t prevEnd;
+    };
+
+    static inline void appendParenthesesDisjunctionContext(BackTrackInfoParentheses* backTrack, ParenthesesDisjunctionContext* context)
+    {
+        context->next = backTrack->lastContext;
+        backTrack->lastContext = context;
+        ++backTrack->matchAmount;
+    }
+
+    static inline void popParenthesesDisjunctionContext(BackTrackInfoParentheses* backTrack)
+    {
+        ASSERT(backTrack->matchAmount);
+        ASSERT(backTrack->lastContext);
+        backTrack->lastContext = backTrack->lastContext->next;
+        --backTrack->matchAmount;
+    }
+
+    struct DisjunctionContext
+    {
+        DisjunctionContext()
+            : term(0)
+        {
+        }
+        
+        void* operator new(size_t, void* where)
+        {
+            return where;
+        }
+
+        int term;
+        unsigned matchBegin;
+        unsigned matchEnd;
+        uintptr_t frame[1];
+    };
+
+    DisjunctionContext* allocDisjunctionContext(ByteDisjunction* disjunction)
+    {
+        return new(malloc(sizeof(DisjunctionContext) + (disjunction->m_frameSize - 1) * sizeof(uintptr_t))) DisjunctionContext();
+    }
+
+    void freeDisjunctionContext(DisjunctionContext* context)
+    {
+        free(context);
+    }
+
+    struct ParenthesesDisjunctionContext
+    {
+        ParenthesesDisjunctionContext(int* output, ByteTerm& term)
+            : next(0)
+        {
+            unsigned firstSubpatternId = term.atom.subpatternId;
+            unsigned numNestedSubpatterns = term.atom.parenthesesDisjunction->m_numSubpatterns;
+
+            for (unsigned i = 0; i < (numNestedSubpatterns << 1); ++i) {
+                subpatternBackup[i] = output[(firstSubpatternId << 1) + i];
+                output[(firstSubpatternId << 1) + i] = -1;
+            }
+            
+            new(getDisjunctionContext(term)) DisjunctionContext();
+        }
+
+        void* operator new(size_t, void* where)
+        {
+            return where;
+        }
+
+        void restoreOutput(int* output, unsigned firstSubpatternId, unsigned numNestedSubpatterns)
+        {
+            for (unsigned i = 0; i < (numNestedSubpatterns << 1); ++i)
+                output[(firstSubpatternId << 1) + i] = subpatternBackup[i];
+        }
+        
+        DisjunctionContext* getDisjunctionContext(ByteTerm& term)
+        {
+            return reinterpret_cast<DisjunctionContext*>(&(subpatternBackup[term.atom.parenthesesDisjunction->m_numSubpatterns << 1]));
+        }
+
+        ParenthesesDisjunctionContext* next;
+        int subpatternBackup[1];
+    };
+
+    ParenthesesDisjunctionContext* allocParenthesesDisjunctionContext(ByteDisjunction* disjunction, int* output, ByteTerm& term)
+    {
+        return new(malloc(sizeof(ParenthesesDisjunctionContext) + (((term.atom.parenthesesDisjunction->m_numSubpatterns << 1) - 1) * sizeof(int)) + sizeof(DisjunctionContext) + (disjunction->m_frameSize - 1) * sizeof(uintptr_t))) ParenthesesDisjunctionContext(output, term);
+    }
+
+    void freeParenthesesDisjunctionContext(ParenthesesDisjunctionContext* context)
+    {
+        free(context);
+    }
+
+    class InputStream {
+    public:
+        InputStream(const UChar* input, unsigned start, unsigned length)
+            : input(input)
+            , pos(start)
+            , length(length)
+        {
+        }
+
+        void next()
+        {
+            ++pos;
+        }
+
+        void rewind(unsigned amount)
+        {
+            ASSERT(pos >= amount);
+            pos -= amount;
+        }
+
+        int read()
+        {
+            ASSERT(pos < length);
+            if (pos < length)
+                return input[pos];
+            return -1;
+        }
+
+        int readChecked(int position)
+        {
+            ASSERT(position < 0);
+            ASSERT((unsigned)-position <= pos);
+            unsigned p = pos + position;
+            ASSERT(p < length);
+            return input[p];
+        }
+
+        int reread(unsigned from)
+        {
+            ASSERT(from < length);
+            return input[from];
+        }
+
+        int prev()
+        {
+            ASSERT(!(pos > length));
+            if (pos && length)
+                return input[pos - 1];
+            return -1;
+        }
+        
+        unsigned getPos()
+        {
+            return pos;
+        }
+
+        void setPos(unsigned p)
+        {
+            pos = p;
+        }
+        
+        bool atStart()
+        {
+            return pos == 0;
+        }
+
+        bool atEnd()
+        {
+            return pos == length;
+        }
+
+        bool checkInput(int count)
+        {
+            if ((pos + count) <= length) {
+                pos += count;
+                return true;
+            } else
+                return false;
+        }
+
+        void uncheckInput(int count)
+        {
+            pos -= count;
+        }
+
+        bool atStart(int position)
+        {
+            return (pos + position) == 0;
+        }
+
+        bool atEnd(int position)
+        {
+            return (pos + position) == length;
+        }
+
+    private:
+        const UChar* input;
+        unsigned pos;
+        unsigned length;
+    };
+
+    bool testCharacterClass(CharacterClass* characterClass, int ch)
+    {
+        if (ch & 0xFF80) {
+            for (unsigned i = 0; i < characterClass->m_matchesUnicode.size(); ++i)
+                if (ch == characterClass->m_matchesUnicode[i])
+                    return true;
+            for (unsigned i = 0; i < characterClass->m_rangesUnicode.size(); ++i)
+                if ((ch >= characterClass->m_rangesUnicode[i].begin) && (ch <= characterClass->m_rangesUnicode[i].end))
+                    return true;
+        } else {
+            for (unsigned i = 0; i < characterClass->m_matches.size(); ++i)
+                if (ch == characterClass->m_matches[i])
+                    return true;
+            for (unsigned i = 0; i < characterClass->m_ranges.size(); ++i)
+                if ((ch >= characterClass->m_ranges[i].begin) && (ch <= characterClass->m_ranges[i].end))
+                    return true;
+        }
+
+        return false;
+    }
+
+    bool tryConsumeCharacter(int testChar)
+    {
+        if (input.atEnd())
+            return false;
+        
+        int ch = input.read();
+
+        if (pattern->m_ignoreCase ? ((Unicode::toLower(testChar) == ch) || (Unicode::toUpper(testChar) == ch)) : (testChar == ch)) {
+            input.next();
+            return true;
+        }
+        return false;
+    }
+
+    bool checkCharacter(int testChar, int inputPosition)
+    {
+        return testChar == input.readChecked(inputPosition);
+    }
+
+    bool checkCasedCharacter(int loChar, int hiChar, int inputPosition)
+    {
+        int ch = input.readChecked(inputPosition);
+        return (loChar == ch) || (hiChar == ch);
+    }
+
+    bool tryConsumeCharacterClass(CharacterClass* characterClass, bool invert)
+    {
+        if (input.atEnd())
+            return false;
+
+        bool match = testCharacterClass(characterClass, input.read());
+
+        if (invert)
+            match = !match;
+
+        if (match) {
+            input.next();
+            return true;
+        }
+        return false;
+    }
+
+    bool checkCharacterClass(CharacterClass* characterClass, bool invert, int inputPosition)
+    {
+        bool match = testCharacterClass(characterClass, input.readChecked(inputPosition));
+        return invert ? !match : match;
+    }
+
+    bool tryConsumeBackReference(int matchBegin, int matchEnd, int inputOffset)
+    {
+        int matchSize = matchEnd - matchBegin;
+
+        if (!input.checkInput(matchSize))
+            return false;
+
+        for (int i = 0; i < matchSize; ++i) {
+            if (!checkCharacter(input.reread(matchBegin + i), inputOffset - matchSize + i)) {
+                input.uncheckInput(matchSize);
+                return false;
+            }
+        }
+        
+        return true;
+    }
+
+    bool matchAssertionBOL(ByteTerm& term)
+    {
+        return (input.atStart(term.inputPosition)) || (pattern->m_multiline && testCharacterClass(pattern->newlineCharacterClass, input.readChecked(term.inputPosition - 1)));
+    }
+
+    bool matchAssertionEOL(ByteTerm& term)
+    {
+        if (term.inputPosition)
+            return (input.atEnd(term.inputPosition)) || (pattern->m_multiline && testCharacterClass(pattern->newlineCharacterClass, input.readChecked(term.inputPosition)));
+        else
+            return (input.atEnd()) || (pattern->m_multiline && testCharacterClass(pattern->newlineCharacterClass, input.read()));
+    }
+
+    bool matchAssertionWordBoundary(ByteTerm& term)
+    {
+        bool prevIsWordchar = !input.atStart(term.inputPosition) && testCharacterClass(pattern->wordcharCharacterClass, input.readChecked(term.inputPosition - 1));
+        bool readIsWordchar;
+        if (term.inputPosition)
+            readIsWordchar = !input.atEnd(term.inputPosition) && testCharacterClass(pattern->wordcharCharacterClass, input.readChecked(term.inputPosition));
+        else
+            readIsWordchar = !input.atEnd() && testCharacterClass(pattern->wordcharCharacterClass, input.read());
+
+        bool wordBoundary = prevIsWordchar != readIsWordchar;
+        return term.invert() ? !wordBoundary : wordBoundary;
+    }
+
+    bool backtrackPatternCharacter(ByteTerm& term, DisjunctionContext* context)
+    {
+        BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount:
+            break;
+
+        case QuantifierGreedy:
+            if (backTrack->matchAmount) {
+                --backTrack->matchAmount;
+                input.uncheckInput(1);
+                return true;
+            }
+            break;
+
+        case QuantifierNonGreedy:
+            if ((backTrack->matchAmount < term.atom.quantityCount) && input.checkInput(1)) {
+                ++backTrack->matchAmount;
+                if (checkCharacter(term.atom.patternCharacter, term.inputPosition - 1))
+                    return true;
+            }
+            input.uncheckInput(backTrack->matchAmount);
+            break;
+        }
+
+        return false;
+    }
+
+    bool backtrackPatternCasedCharacter(ByteTerm& term, DisjunctionContext* context)
+    {
+        BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount:
+            break;
+
+        case QuantifierGreedy:
+            if (backTrack->matchAmount) {
+                --backTrack->matchAmount;
+                input.uncheckInput(1);
+                return true;
+            }
+            break;
+
+        case QuantifierNonGreedy:
+            if ((backTrack->matchAmount < term.atom.quantityCount) && input.checkInput(1)) {
+                ++backTrack->matchAmount;
+                if (checkCasedCharacter(term.atom.casedCharacter.lo, term.atom.casedCharacter.hi, term.inputPosition - 1))
+                    return true;
+            }
+            input.uncheckInput(backTrack->matchAmount);
+            break;
+        }
+
+        return false;
+    }
+
+    bool matchCharacterClass(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeCharacterClass);
+        BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount: {
+            for (unsigned matchAmount = 0; matchAmount < term.atom.quantityCount; ++matchAmount) {
+                if (!checkCharacterClass(term.atom.characterClass, term.invert(), term.inputPosition + matchAmount))
+                    return false;
+            }
+            return true;
+        }
+
+        case QuantifierGreedy: {
+            unsigned matchAmount = 0;
+            while ((matchAmount < term.atom.quantityCount) && input.checkInput(1)) {
+                if (!checkCharacterClass(term.atom.characterClass, term.invert(), term.inputPosition - 1)) {
+                    input.uncheckInput(1);
+                    break;
+                }
+                ++matchAmount;
+            }
+            backTrack->matchAmount = matchAmount;
+
+            return true;
+        }
+
+        case QuantifierNonGreedy:
+            backTrack->matchAmount = 0;
+            return true;
+        }
+
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    bool backtrackCharacterClass(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeCharacterClass);
+        BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount:
+            break;
+
+        case QuantifierGreedy:
+            if (backTrack->matchAmount) {
+                --backTrack->matchAmount;
+                input.uncheckInput(1);
+                return true;
+            }
+            break;
+
+        case QuantifierNonGreedy:
+            if ((backTrack->matchAmount < term.atom.quantityCount) && input.checkInput(1)) {
+                ++backTrack->matchAmount;
+                if (checkCharacterClass(term.atom.characterClass, term.invert(), term.inputPosition - 1))
+                    return true;
+            }
+            input.uncheckInput(backTrack->matchAmount);
+            break;
+        }
+
+        return false;
+    }
+
+    bool matchBackReference(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeBackReference);
+        BackTrackInfoBackReference* backTrack = reinterpret_cast<BackTrackInfoBackReference*>(context->frame + term.frameLocation);
+
+        int matchBegin = output[(term.atom.subpatternId << 1)];
+        int matchEnd = output[(term.atom.subpatternId << 1) + 1];
+        ASSERT((matchBegin == -1) == (matchEnd == -1));
+        ASSERT(matchBegin <= matchEnd);
+
+        if (matchBegin == matchEnd)
+            return true;
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount: {
+            backTrack->begin = input.getPos();
+            for (unsigned matchAmount = 0; matchAmount < term.atom.quantityCount; ++matchAmount) {
+                if (!tryConsumeBackReference(matchBegin, matchEnd, term.inputPosition)) {
+                    input.setPos(backTrack->begin);
+                    return false;
+                }
+            }
+            return true;
+        }
+
+        case QuantifierGreedy: {
+            unsigned matchAmount = 0;
+            while ((matchAmount < term.atom.quantityCount) && tryConsumeBackReference(matchBegin, matchEnd, term.inputPosition))
+                ++matchAmount;
+            backTrack->matchAmount = matchAmount;
+            return true;
+        }
+
+        case QuantifierNonGreedy:
+            backTrack->begin = input.getPos();
+            backTrack->matchAmount = 0;
+            return true;
+        }
+
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    bool backtrackBackReference(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeBackReference);
+        BackTrackInfoBackReference* backTrack = reinterpret_cast<BackTrackInfoBackReference*>(context->frame + term.frameLocation);
+
+        int matchBegin = output[(term.atom.subpatternId << 1)];
+        int matchEnd = output[(term.atom.subpatternId << 1) + 1];
+        ASSERT((matchBegin == -1) == (matchEnd == -1));
+        ASSERT(matchBegin <= matchEnd);
+
+        if (matchBegin == matchEnd)
+            return false;
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount:
+            // for quantityCount == 1, could rewind.
+            input.setPos(backTrack->begin);
+            break;
+
+        case QuantifierGreedy:
+            if (backTrack->matchAmount) {
+                --backTrack->matchAmount;
+                input.rewind(matchEnd - matchBegin);
+                return true;
+            }
+            break;
+
+        case QuantifierNonGreedy:
+            if ((backTrack->matchAmount < term.atom.quantityCount) && tryConsumeBackReference(matchBegin, matchEnd, term.inputPosition)) {
+                ++backTrack->matchAmount;
+                return true;
+            } else
+                input.setPos(backTrack->begin);
+            break;
+        }
+
+        return false;
+    }
+
+    void recordParenthesesMatch(ByteTerm& term, ParenthesesDisjunctionContext* context)
+    {
+        if (term.capture()) {
+            unsigned subpatternId = term.atom.subpatternId;
+            output[(subpatternId << 1)] = context->getDisjunctionContext(term)->matchBegin + term.inputPosition;
+            output[(subpatternId << 1) + 1] = context->getDisjunctionContext(term)->matchEnd + term.inputPosition;
+        }
+    }
+    void resetMatches(ByteTerm& term, ParenthesesDisjunctionContext* context)
+    {
+        unsigned firstSubpatternId = term.atom.subpatternId;
+        unsigned count = term.atom.parenthesesDisjunction->m_numSubpatterns;
+        context->restoreOutput(output, firstSubpatternId, count);
+    }
+    void resetAssertionMatches(ByteTerm& term)
+    {
+        unsigned firstSubpatternId = term.atom.subpatternId;
+        unsigned count = term.atom.parenthesesDisjunction->m_numSubpatterns;
+        for (unsigned i = 0; i < (count << 1); ++i)
+            output[(firstSubpatternId << 1) + i] = -1;
+    }
+    bool parenthesesDoBacktrack(ByteTerm& term, BackTrackInfoParentheses* backTrack)
+    {
+        while (backTrack->matchAmount) {
+            ParenthesesDisjunctionContext* context = backTrack->lastContext;
+
+            if (matchDisjunction(term.atom.parenthesesDisjunction, context->getDisjunctionContext(term), true))
+                return true;
+            
+            resetMatches(term, context);
+            freeParenthesesDisjunctionContext(context);
+            popParenthesesDisjunctionContext(backTrack);
+        }
+
+        return false;
+    }
+
+    bool matchParenthesesOnceBegin(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpatternOnceBegin);
+        ASSERT(term.atom.quantityCount == 1);
+
+        BackTrackInfoParenthesesOnce* backTrack = reinterpret_cast<BackTrackInfoParenthesesOnce*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierGreedy: {
+            // set this speculatively; if we get to the parens end this will be true.
+            backTrack->inParentheses = 1;
+            break;
+        }
+        case QuantifierNonGreedy: {
+            backTrack->inParentheses = 0;
+            context->term += term.atom.parenthesesWidth;
+            return true;
+        }
+        case QuantifierFixedCount:
+            break;
+        }
+
+        if (term.capture()) {
+            unsigned subpatternId = term.atom.subpatternId;
+            output[(subpatternId << 1)] = input.getPos() + term.inputPosition;
+        }
+
+        return true;
+    }
+
+    bool matchParenthesesOnceEnd(ByteTerm& term, DisjunctionContext*)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpatternOnceEnd);
+        ASSERT(term.atom.quantityCount == 1);
+
+        if (term.capture()) {
+            unsigned subpatternId = term.atom.subpatternId;
+            output[(subpatternId << 1) + 1] = input.getPos() + term.inputPosition;
+        }
+        return true;
+    }
+
+    bool backtrackParenthesesOnceBegin(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpatternOnceBegin);
+        ASSERT(term.atom.quantityCount == 1);
+
+        BackTrackInfoParenthesesOnce* backTrack = reinterpret_cast<BackTrackInfoParenthesesOnce*>(context->frame + term.frameLocation);
+
+        if (term.capture()) {
+            unsigned subpatternId = term.atom.subpatternId;
+            output[(subpatternId << 1)] = -1;
+            output[(subpatternId << 1) + 1] = -1;
+        }
+
+        switch (term.atom.quantityType) {
+        case QuantifierGreedy:
+            // if we backtrack to this point, there is another chance - try matching nothing.
+            ASSERT(backTrack->inParentheses);
+            backTrack->inParentheses = 0;
+            context->term += term.atom.parenthesesWidth;
+            return true;
+        case QuantifierNonGreedy:
+            ASSERT(backTrack->inParentheses);
+        case QuantifierFixedCount:
+            break;
+        }
+
+        return false;
+    }
+
+    bool backtrackParenthesesOnceEnd(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpatternOnceEnd);
+        ASSERT(term.atom.quantityCount == 1);
+
+        BackTrackInfoParenthesesOnce* backTrack = reinterpret_cast<BackTrackInfoParenthesesOnce*>(context->frame + term.frameLocation);
+
+        switch (term.atom.quantityType) {
+        case QuantifierGreedy:
+            if (!backTrack->inParentheses) {
+                context->term -= term.atom.parenthesesWidth;
+                return false;
+            }
+        case QuantifierNonGreedy:
+            if (!backTrack->inParentheses) {
+                // now try to match the parens; set this speculatively.
+                backTrack->inParentheses = 1;
+                if (term.capture()) {
+                    unsigned subpatternId = term.atom.subpatternId;
+                    output[(subpatternId << 1) + 1] = input.getPos() + term.inputPosition;
+                }
+                context->term -= term.atom.parenthesesWidth;
+                return true;
+            }
+        case QuantifierFixedCount:
+            break;
+        }
+
+        return false;
+    }
+
+    bool matchParentheticalAssertionBegin(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParentheticalAssertionBegin);
+        ASSERT(term.atom.quantityCount == 1);
+
+        BackTrackInfoParentheticalAssertion* backTrack = reinterpret_cast<BackTrackInfoParentheticalAssertion*>(context->frame + term.frameLocation);
+
+        backTrack->begin = input.getPos();
+        return true;
+    }
+
+    bool matchParentheticalAssertionEnd(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParentheticalAssertionEnd);
+        ASSERT(term.atom.quantityCount == 1);
+
+        BackTrackInfoParentheticalAssertion* backTrack = reinterpret_cast<BackTrackInfoParentheticalAssertion*>(context->frame + term.frameLocation);
+
+        input.setPos(backTrack->begin);
+
+        // We've reached the end of the parens; if they are inverted, this is failure.
+        if (term.invert()) {
+            context->term -= term.atom.parenthesesWidth;
+            return false;
+        }
+
+        return true;
+    }
+
+    bool backtrackParentheticalAssertionBegin(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParentheticalAssertionBegin);
+        ASSERT(term.atom.quantityCount == 1);
+
+        // We've failed to match parens; if they are inverted, this is win!
+        if (term.invert()) {
+            context->term += term.atom.parenthesesWidth;
+            return true;
+        }
+
+        return false;
+    }
+
+    bool backtrackParentheticalAssertionEnd(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParentheticalAssertionEnd);
+        ASSERT(term.atom.quantityCount == 1);
+
+        BackTrackInfoParentheticalAssertion* backTrack = reinterpret_cast<BackTrackInfoParentheticalAssertion*>(context->frame + term.frameLocation);
+
+        input.setPos(backTrack->begin);
+
+        context->term -= term.atom.parenthesesWidth;
+        return false;
+    }
+
+    bool matchParentheses(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpattern);
+
+        BackTrackInfoParentheses* backTrack = reinterpret_cast<BackTrackInfoParentheses*>(context->frame + term.frameLocation);
+
+        unsigned subpatternId = term.atom.subpatternId;
+        ByteDisjunction* disjunctionBody = term.atom.parenthesesDisjunction;
+
+        backTrack->prevBegin = output[(subpatternId << 1)];
+        backTrack->prevEnd = output[(subpatternId << 1) + 1];
+
+        backTrack->matchAmount = 0;
+        backTrack->lastContext = 0;
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount: {
+            // While we haven't yet reached our fixed limit,
+            while (backTrack->matchAmount < term.atom.quantityCount) {
+                // Try to do a match, and it it succeeds, add it to the list.
+                ParenthesesDisjunctionContext* context = allocParenthesesDisjunctionContext(disjunctionBody, output, term);
+                if (matchDisjunction(disjunctionBody, context->getDisjunctionContext(term)))
+                    appendParenthesesDisjunctionContext(backTrack, context);
+                else {
+                    // The match failed; try to find an alternate point to carry on from.
+                    resetMatches(term, context);
+                    freeParenthesesDisjunctionContext(context);
+                    if (!parenthesesDoBacktrack(term, backTrack))
+                        return false;
+                }
+            }
+
+            ASSERT(backTrack->matchAmount == term.atom.quantityCount);
+            ParenthesesDisjunctionContext* context = backTrack->lastContext;
+            recordParenthesesMatch(term, context);
+            return true;
+        }
+
+        case QuantifierGreedy: {
+            while (backTrack->matchAmount < term.atom.quantityCount) {
+                ParenthesesDisjunctionContext* context = allocParenthesesDisjunctionContext(disjunctionBody, output, term);
+                if (matchNonZeroDisjunction(disjunctionBody, context->getDisjunctionContext(term)))
+                    appendParenthesesDisjunctionContext(backTrack, context);
+                else {
+                    resetMatches(term, context);
+                    freeParenthesesDisjunctionContext(context);
+                    break;
+                }
+            }
+
+            if (backTrack->matchAmount) {
+                ParenthesesDisjunctionContext* context = backTrack->lastContext;
+                recordParenthesesMatch(term, context);
+            }
+            return true;
+        }
+
+        case QuantifierNonGreedy:
+            return true;
+        }
+
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    // Rules for backtracking differ depending on whether this is greedy or non-greedy.
+    //
+    // Greedy matches never should try just adding more - you should already have done
+    // the 'more' cases.  Always backtrack, at least a leetle bit.  However cases where
+    // you backtrack an item off the list needs checking, since we'll never have matched
+    // the one less case.  Tracking forwards, still add as much as possible.
+    //
+    // Non-greedy, we've already done the one less case, so don't match on popping.
+    // We haven't done the one more case, so always try to add that.
+    //
+    bool backtrackParentheses(ByteTerm& term, DisjunctionContext* context)
+    {
+        ASSERT(term.type == ByteTerm::TypeParenthesesSubpattern);
+
+        BackTrackInfoParentheses* backTrack = reinterpret_cast<BackTrackInfoParentheses*>(context->frame + term.frameLocation);
+
+        if (term.capture()) {
+            unsigned subpatternId = term.atom.subpatternId;
+            output[(subpatternId << 1)] = backTrack->prevBegin;
+            output[(subpatternId << 1) + 1] = backTrack->prevEnd;
+        }
+
+        ByteDisjunction* disjunctionBody = term.atom.parenthesesDisjunction;
+
+        switch (term.atom.quantityType) {
+        case QuantifierFixedCount: {
+            ASSERT(backTrack->matchAmount == term.atom.quantityCount);
+
+            ParenthesesDisjunctionContext* context = 0;
+
+            if (!parenthesesDoBacktrack(term, backTrack))
+                return false;
+
+            // While we haven't yet reached our fixed limit,
+            while (backTrack->matchAmount < term.atom.quantityCount) {
+                // Try to do a match, and it it succeeds, add it to the list.
+                context = allocParenthesesDisjunctionContext(disjunctionBody, output, term);
+                if (matchDisjunction(disjunctionBody, context->getDisjunctionContext(term)))
+                    appendParenthesesDisjunctionContext(backTrack, context);
+                else {
+                    // The match failed; try to find an alternate point to carry on from.
+                    resetMatches(term, context);
+                    freeParenthesesDisjunctionContext(context);
+                    if (!parenthesesDoBacktrack(term, backTrack))
+                        return false;
+                }
+            }
+
+            ASSERT(backTrack->matchAmount == term.atom.quantityCount);
+            context = backTrack->lastContext;
+            recordParenthesesMatch(term, context);
+            return true;
+        }
+
+        case QuantifierGreedy: {
+            if (!backTrack->matchAmount)
+                return false;
+
+            ParenthesesDisjunctionContext* context = backTrack->lastContext;
+            if (matchNonZeroDisjunction(disjunctionBody, context->getDisjunctionContext(term), true)) {
+                while (backTrack->matchAmount < term.atom.quantityCount) {
+                    ParenthesesDisjunctionContext* context = allocParenthesesDisjunctionContext(disjunctionBody, output, term);
+                    if (matchNonZeroDisjunction(disjunctionBody, context->getDisjunctionContext(term)))
+                        appendParenthesesDisjunctionContext(backTrack, context);
+                    else {
+                        resetMatches(term, context);
+                        freeParenthesesDisjunctionContext(context);
+                        break;
+                    }
+                }
+            } else {
+                resetMatches(term, context);
+                freeParenthesesDisjunctionContext(context);
+                popParenthesesDisjunctionContext(backTrack);
+            }
+
+            if (backTrack->matchAmount) {
+                ParenthesesDisjunctionContext* context = backTrack->lastContext;
+                recordParenthesesMatch(term, context);
+            }
+            return true;
+        }
+
+        case QuantifierNonGreedy: {
+            // If we've not reached the limit, try to add one more match.
+            if (backTrack->matchAmount < term.atom.quantityCount) {
+                ParenthesesDisjunctionContext* context = allocParenthesesDisjunctionContext(disjunctionBody, output, term);
+                if (matchNonZeroDisjunction(disjunctionBody, context->getDisjunctionContext(term))) {
+                    appendParenthesesDisjunctionContext(backTrack, context);
+                    recordParenthesesMatch(term, context);
+                    return true;
+                } else {
+                    resetMatches(term, context);
+                    freeParenthesesDisjunctionContext(context);
+                }
+            }
+
+            // Nope - okay backtrack looking for an alternative.
+            while (backTrack->matchAmount) {
+                ParenthesesDisjunctionContext* context = backTrack->lastContext;
+                if (matchNonZeroDisjunction(disjunctionBody, context->getDisjunctionContext(term), true)) {
+                    // successful backtrack! we're back in the game!
+                    if (backTrack->matchAmount) {
+                        context = backTrack->lastContext;
+                        recordParenthesesMatch(term, context);
+                    }
+                    return true;
+                }
+                
+                // pop a match off the stack
+                resetMatches(term, context);
+                freeParenthesesDisjunctionContext(context);
+                popParenthesesDisjunctionContext(backTrack);
+            }
+
+            return false;
+        }
+        }
+
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+#define MATCH_NEXT() { ++context->term; goto matchAgain; }
+#define BACKTRACK() { --context->term; goto backtrack; }
+#define currentTerm() (disjunction->terms[context->term])
+    bool matchDisjunction(ByteDisjunction* disjunction, DisjunctionContext* context, bool btrack = false)
+    {
+        if (btrack)
+            BACKTRACK();
+
+        context->matchBegin = input.getPos();
+        context->term = 0;
+
+    matchAgain:
+        ASSERT(context->term < static_cast<int>(disjunction->terms.size()));
+
+        switch (currentTerm().type) {
+        case ByteTerm::TypeSubpatternBegin:
+            MATCH_NEXT();
+        case ByteTerm::TypeSubpatternEnd:
+            context->matchEnd = input.getPos();
+            return true;
+
+        case ByteTerm::TypeBodyAlternativeBegin:
+            MATCH_NEXT();
+        case ByteTerm::TypeBodyAlternativeDisjunction:
+        case ByteTerm::TypeBodyAlternativeEnd:
+            context->matchEnd = input.getPos();
+            return true;
+
+        case ByteTerm::TypeAlternativeBegin:
+            MATCH_NEXT();
+        case ByteTerm::TypeAlternativeDisjunction:
+        case ByteTerm::TypeAlternativeEnd: {
+            int offset = currentTerm().alternative.end;
+            BackTrackInfoAlternative* backTrack = reinterpret_cast<BackTrackInfoAlternative*>(context->frame + currentTerm().frameLocation);
+            backTrack->offset = offset;
+            context->term += offset;
+            MATCH_NEXT();
+        }
+
+        case ByteTerm::TypeAssertionBOL:
+            if (matchAssertionBOL(currentTerm()))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeAssertionEOL:
+            if (matchAssertionEOL(currentTerm()))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeAssertionWordBoundary:
+            if (matchAssertionWordBoundary(currentTerm()))
+                MATCH_NEXT();
+            BACKTRACK();
+
+        case ByteTerm::TypePatternCharacterOnce:
+        case ByteTerm::TypePatternCharacterFixed: {
+            for (unsigned matchAmount = 0; matchAmount < currentTerm().atom.quantityCount; ++matchAmount) {
+                if (!checkCharacter(currentTerm().atom.patternCharacter, currentTerm().inputPosition + matchAmount))
+                    BACKTRACK();
+            }
+            MATCH_NEXT();
+        }
+        case ByteTerm::TypePatternCharacterGreedy: {
+            BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + currentTerm().frameLocation);
+            unsigned matchAmount = 0;
+            while ((matchAmount < currentTerm().atom.quantityCount) && input.checkInput(1)) {
+                if (!checkCharacter(currentTerm().atom.patternCharacter, currentTerm().inputPosition - 1)) {
+                    input.uncheckInput(1);
+                    break;
+                }
+                ++matchAmount;
+            }
+            backTrack->matchAmount = matchAmount;
+
+            MATCH_NEXT();
+        }
+        case ByteTerm::TypePatternCharacterNonGreedy: {
+            BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + currentTerm().frameLocation);
+            backTrack->matchAmount = 0;
+            MATCH_NEXT();
+        }
+
+        case ByteTerm::TypePatternCasedCharacterOnce:
+        case ByteTerm::TypePatternCasedCharacterFixed: {
+            for (unsigned matchAmount = 0; matchAmount < currentTerm().atom.quantityCount; ++matchAmount) {
+                if (!checkCasedCharacter(currentTerm().atom.casedCharacter.lo, currentTerm().atom.casedCharacter.hi, currentTerm().inputPosition + matchAmount))
+                    BACKTRACK();
+            }
+            MATCH_NEXT();
+        }
+        case ByteTerm::TypePatternCasedCharacterGreedy: {
+            BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + currentTerm().frameLocation);
+            unsigned matchAmount = 0;
+            while ((matchAmount < currentTerm().atom.quantityCount) && input.checkInput(1)) {
+                if (!checkCasedCharacter(currentTerm().atom.casedCharacter.lo, currentTerm().atom.casedCharacter.hi, currentTerm().inputPosition - 1)) {
+                    input.uncheckInput(1);
+                    break;
+                }
+                ++matchAmount;
+            }
+            backTrack->matchAmount = matchAmount;
+
+            MATCH_NEXT();
+        }
+        case ByteTerm::TypePatternCasedCharacterNonGreedy: {
+            BackTrackInfoPatternCharacter* backTrack = reinterpret_cast<BackTrackInfoPatternCharacter*>(context->frame + currentTerm().frameLocation);
+            backTrack->matchAmount = 0;
+            MATCH_NEXT();
+        }
+
+        case ByteTerm::TypeCharacterClass:
+            if (matchCharacterClass(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeBackReference:
+            if (matchBackReference(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParenthesesSubpattern:
+            if (matchParentheses(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParenthesesSubpatternOnceBegin:
+            if (matchParenthesesOnceBegin(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParenthesesSubpatternOnceEnd:
+            if (matchParenthesesOnceEnd(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParentheticalAssertionBegin:
+            if (matchParentheticalAssertionBegin(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+        case ByteTerm::TypeParentheticalAssertionEnd:
+            if (matchParentheticalAssertionEnd(currentTerm(), context))
+                MATCH_NEXT();
+            BACKTRACK();
+
+        case ByteTerm::TypeCheckInput:
+            if (input.checkInput(currentTerm().checkInputCount))
+                MATCH_NEXT();
+            BACKTRACK();
+        }
+
+        // We should never fall-through to here.
+        ASSERT_NOT_REACHED();
+
+    backtrack:
+        ASSERT(context->term < static_cast<int>(disjunction->terms.size()));
+
+        switch (currentTerm().type) {
+        case ByteTerm::TypeSubpatternBegin:
+            return false;
+        case ByteTerm::TypeSubpatternEnd:
+            ASSERT_NOT_REACHED();
+
+        case ByteTerm::TypeBodyAlternativeBegin:
+        case ByteTerm::TypeBodyAlternativeDisjunction: {
+            int offset = currentTerm().alternative.next;
+            context->term += offset;
+            if (offset > 0)
+                MATCH_NEXT();
+
+            if (input.atEnd())
+                return false;
+
+            input.next();
+            context->matchBegin = input.getPos();
+            MATCH_NEXT();
+        }
+        case ByteTerm::TypeBodyAlternativeEnd:
+            ASSERT_NOT_REACHED();
+
+            case ByteTerm::TypeAlternativeBegin:
+            case ByteTerm::TypeAlternativeDisjunction: {
+                int offset = currentTerm().alternative.next;
+                context->term += offset;
+                if (offset > 0)
+                    MATCH_NEXT();
+                BACKTRACK();
+            }
+            case ByteTerm::TypeAlternativeEnd: {
+                // We should never backtrack back into an alternative of the main body of the regex.
+                BackTrackInfoAlternative* backTrack = reinterpret_cast<BackTrackInfoAlternative*>(context->frame + currentTerm().frameLocation);
+                unsigned offset = backTrack->offset;
+                context->term -= offset;
+                BACKTRACK();
+            }
+
+            case ByteTerm::TypeAssertionBOL:
+            case ByteTerm::TypeAssertionEOL:
+            case ByteTerm::TypeAssertionWordBoundary:
+                BACKTRACK();
+
+            case ByteTerm::TypePatternCharacterOnce:
+            case ByteTerm::TypePatternCharacterFixed:
+            case ByteTerm::TypePatternCharacterGreedy:
+            case ByteTerm::TypePatternCharacterNonGreedy:
+                if (backtrackPatternCharacter(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypePatternCasedCharacterOnce:
+            case ByteTerm::TypePatternCasedCharacterFixed:
+            case ByteTerm::TypePatternCasedCharacterGreedy:
+            case ByteTerm::TypePatternCasedCharacterNonGreedy:
+                if (backtrackPatternCasedCharacter(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypeCharacterClass:
+                if (backtrackCharacterClass(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypeBackReference:
+                if (backtrackBackReference(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypeParenthesesSubpattern:
+                if (backtrackParentheses(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypeParenthesesSubpatternOnceBegin:
+                if (backtrackParenthesesOnceBegin(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypeParenthesesSubpatternOnceEnd:
+                if (backtrackParenthesesOnceEnd(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypeParentheticalAssertionBegin:
+                if (backtrackParentheticalAssertionBegin(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+            case ByteTerm::TypeParentheticalAssertionEnd:
+                if (backtrackParentheticalAssertionEnd(currentTerm(), context))
+                    MATCH_NEXT();
+                BACKTRACK();
+
+            case ByteTerm::TypeCheckInput:
+                input.uncheckInput(currentTerm().checkInputCount);
+                BACKTRACK();
+        }
+
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+
+    bool matchNonZeroDisjunction(ByteDisjunction* disjunction, DisjunctionContext* context, bool btrack = false)
+    {
+        if (matchDisjunction(disjunction, context, btrack)) {
+            while (context->matchBegin == context->matchEnd) {
+                if (!matchDisjunction(disjunction, context, true))
+                    return false;
+            }
+            return true;
+        }
+
+        return false;
+    }
+
+    int interpret()
+    {
+        for (unsigned i = 0; i < ((pattern->m_body->m_numSubpatterns + 1) << 1); ++i)
+            output[i] = -1;
+
+        DisjunctionContext* context = allocDisjunctionContext(pattern->m_body.get());
+
+        if (matchDisjunction(pattern->m_body.get(), context)) {
+            output[0] = context->matchBegin;
+            output[1] = context->matchEnd;
+        }
+
+        freeDisjunctionContext(context);
+
+        return output[0];
+    }
+
+    Interpreter(BytecodePattern* pattern, int* output, const UChar* inputChar, unsigned start, unsigned length)
+        : pattern(pattern)
+        , output(output)
+        , input(inputChar, start, length)
+    {
+    }
+
+private:
+    BytecodePattern *pattern;
+    int* output;
+    InputStream input;
+};
+
+
+
+class ByteCompiler {
+    struct ParenthesesStackEntry {
+        unsigned beginTerm;
+        unsigned savedAlternativeIndex;
+        ParenthesesStackEntry(unsigned beginTerm, unsigned savedAlternativeIndex/*, unsigned subpatternId, bool capture = false*/)
+            : beginTerm(beginTerm)
+            , savedAlternativeIndex(savedAlternativeIndex)
+        {
+        }
+    };
+
+public:
+    ByteCompiler(RegexPattern& pattern)
+        : m_pattern(pattern)
+    {
+        bodyDisjunction = 0;
+        currentAlternativeIndex = 0;
+    }
+    
+    BytecodePattern* compile()
+    {
+        regexBegin(m_pattern.m_numSubpatterns, m_pattern.m_body->m_callFrameSize);
+        emitDisjunction(m_pattern.m_body);
+        regexEnd();
+
+        return new BytecodePattern(bodyDisjunction, m_allParenthesesInfo, m_pattern);
+    }
+    
+    void checkInput(unsigned count)
+    {
+        bodyDisjunction->terms.append(ByteTerm::CheckInput(count));
+    }
+
+    void assertionBOL(int inputPosition)
+    {
+        bodyDisjunction->terms.append(ByteTerm::BOL(inputPosition));
+    }
+
+    void assertionEOL(int inputPosition)
+    {
+        bodyDisjunction->terms.append(ByteTerm::EOL(inputPosition));
+    }
+
+    void assertionWordBoundary(bool invert, int inputPosition)
+    {
+        bodyDisjunction->terms.append(ByteTerm::WordBoundary(invert, inputPosition));
+    }
+
+    void atomPatternCharacter(UChar ch, int inputPosition, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType)
+    {
+        if (m_pattern.m_ignoreCase) {
+            UChar lo = Unicode::toLower(ch);
+            UChar hi = Unicode::toUpper(ch);
+            
+            if (lo != hi) {
+                bodyDisjunction->terms.append(ByteTerm(lo, hi, inputPosition, frameLocation, quantityCount, quantityType));
+                return;
+            }
+        }
+
+        bodyDisjunction->terms.append(ByteTerm(ch, inputPosition, frameLocation, quantityCount, quantityType));
+    }
+    
+    void atomCharacterClass(CharacterClass* characterClass, bool invert, int inputPosition, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType)
+    {
+        bodyDisjunction->terms.append(ByteTerm(characterClass, invert, inputPosition));
+
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].atom.quantityCount = quantityCount;
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].atom.quantityType = quantityType;
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+    }
+
+    void atomBackReference(unsigned subpatternId, int inputPosition, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType)
+    {
+        ASSERT(subpatternId);
+
+        bodyDisjunction->terms.append(ByteTerm::BackReference(subpatternId, inputPosition));
+
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].atom.quantityCount = quantityCount;
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].atom.quantityType = quantityType;
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+    }
+
+    void atomParenthesesSubpatternBegin(unsigned subpatternId, bool capture, int inputPosition, unsigned frameLocation, unsigned alternativeFrameLocation)
+    {
+        int beginTerm = bodyDisjunction->terms.size();
+
+        bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParenthesesSubpatternOnceBegin, subpatternId, capture, inputPosition));
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+        bodyDisjunction->terms.append(ByteTerm::AlternativeBegin());
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = alternativeFrameLocation;
+
+        m_parenthesesStack.append(ParenthesesStackEntry(beginTerm, currentAlternativeIndex));
+        currentAlternativeIndex = beginTerm + 1;
+    }
+
+    void atomParentheticalAssertionBegin(unsigned subpatternId, bool invert, unsigned frameLocation, unsigned alternativeFrameLocation)
+    {
+        int beginTerm = bodyDisjunction->terms.size();
+
+        bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParentheticalAssertionBegin, subpatternId, invert, 0));
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = frameLocation;
+        bodyDisjunction->terms.append(ByteTerm::AlternativeBegin());
+        bodyDisjunction->terms[bodyDisjunction->terms.size() - 1].frameLocation = alternativeFrameLocation;
+
+        m_parenthesesStack.append(ParenthesesStackEntry(beginTerm, currentAlternativeIndex));
+        currentAlternativeIndex = beginTerm + 1;
+    }
+
+    unsigned popParenthesesStack()
+    {
+        ASSERT(m_parenthesesStack.size());
+        int stackEnd = m_parenthesesStack.size() - 1;
+        unsigned beginTerm = m_parenthesesStack[stackEnd].beginTerm;
+        currentAlternativeIndex = m_parenthesesStack[stackEnd].savedAlternativeIndex;
+        m_parenthesesStack.shrink(stackEnd);
+
+        ASSERT(beginTerm < bodyDisjunction->terms.size());
+        ASSERT(currentAlternativeIndex < bodyDisjunction->terms.size());
+        
+        return beginTerm;
+    }
+
+#ifndef NDEBUG
+    void dumpDisjunction(ByteDisjunction* disjunction)
+    {
+        printf("ByteDisjunction(%p):\n\t", disjunction);
+        for (unsigned i = 0; i < disjunction->terms.size(); ++i)
+            printf("{ %d } ", disjunction->terms[i].type);
+        printf("\n");
+    }
+#endif
+
+    void closeAlternative(int beginTerm)
+    {
+        int origBeginTerm = beginTerm;
+        ASSERT(bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeAlternativeBegin);
+        int endIndex = bodyDisjunction->terms.size();
+
+        unsigned frameLocation = bodyDisjunction->terms[beginTerm].frameLocation;
+
+        if (!bodyDisjunction->terms[beginTerm].alternative.next)
+            bodyDisjunction->terms.remove(beginTerm);
+        else {
+            while (bodyDisjunction->terms[beginTerm].alternative.next) {
+                beginTerm += bodyDisjunction->terms[beginTerm].alternative.next;
+                ASSERT(bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeAlternativeDisjunction);
+                bodyDisjunction->terms[beginTerm].alternative.end = endIndex - beginTerm;
+                bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
+            }
+            
+            bodyDisjunction->terms[beginTerm].alternative.next = origBeginTerm - beginTerm;
+
+            bodyDisjunction->terms.append(ByteTerm::AlternativeEnd());
+            bodyDisjunction->terms[endIndex].frameLocation = frameLocation;
+        }
+    }
+
+    void closeBodyAlternative()
+    {
+        int beginTerm = 0;
+        int origBeginTerm = 0;
+        ASSERT(bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeBodyAlternativeBegin);
+        int endIndex = bodyDisjunction->terms.size();
+
+        unsigned frameLocation = bodyDisjunction->terms[beginTerm].frameLocation;
+
+        while (bodyDisjunction->terms[beginTerm].alternative.next) {
+            beginTerm += bodyDisjunction->terms[beginTerm].alternative.next;
+            ASSERT(bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeBodyAlternativeDisjunction);
+            bodyDisjunction->terms[beginTerm].alternative.end = endIndex - beginTerm;
+            bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
+        }
+        
+        bodyDisjunction->terms[beginTerm].alternative.next = origBeginTerm - beginTerm;
+
+        bodyDisjunction->terms.append(ByteTerm::BodyAlternativeEnd());
+        bodyDisjunction->terms[endIndex].frameLocation = frameLocation;
+    }
+
+    void atomParenthesesEnd(bool doInline, unsigned lastSubpatternId, int inputPosition, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType, unsigned callFrameSize = 0)
+    {
+        unsigned beginTerm = popParenthesesStack();
+        closeAlternative(beginTerm + 1);
+        unsigned endTerm = bodyDisjunction->terms.size();
+
+        bool isAssertion = bodyDisjunction->terms[beginTerm].type == ByteTerm::TypeParentheticalAssertionBegin;
+        bool invertOrCapture = bodyDisjunction->terms[beginTerm].invertOrCapture;
+        unsigned subpatternId = bodyDisjunction->terms[beginTerm].atom.subpatternId;
+
+        bodyDisjunction->terms.append(ByteTerm(isAssertion ? ByteTerm::TypeParentheticalAssertionEnd : ByteTerm::TypeParenthesesSubpatternOnceEnd, subpatternId, invertOrCapture, inputPosition));
+        bodyDisjunction->terms[beginTerm].atom.parenthesesWidth = endTerm - beginTerm;
+        bodyDisjunction->terms[endTerm].atom.parenthesesWidth = endTerm - beginTerm;
+        bodyDisjunction->terms[endTerm].frameLocation = frameLocation;
+
+        if (doInline) {
+            bodyDisjunction->terms[beginTerm].atom.quantityCount = quantityCount;
+            bodyDisjunction->terms[beginTerm].atom.quantityType = quantityType;
+            bodyDisjunction->terms[endTerm].atom.quantityCount = quantityCount;
+            bodyDisjunction->terms[endTerm].atom.quantityType = quantityType;
+        } else {
+            ByteTerm& parenthesesBegin = bodyDisjunction->terms[beginTerm];
+            ASSERT(parenthesesBegin.type == ByteTerm::TypeParenthesesSubpatternOnceBegin);
+
+            bool invertOrCapture = parenthesesBegin.invertOrCapture;
+            unsigned subpatternId = parenthesesBegin.atom.subpatternId;
+
+            unsigned numSubpatterns = lastSubpatternId - subpatternId + 1;
+            ByteDisjunction* parenthesesDisjunction = new ByteDisjunction(numSubpatterns, callFrameSize);
+
+            parenthesesDisjunction->terms.append(ByteTerm::SubpatternBegin());
+            for (unsigned termInParentheses = beginTerm + 1; termInParentheses < endTerm; ++termInParentheses)
+                parenthesesDisjunction->terms.append(bodyDisjunction->terms[termInParentheses]);
+            parenthesesDisjunction->terms.append(ByteTerm::SubpatternEnd());
+
+            bodyDisjunction->terms.shrink(beginTerm);
+
+            m_allParenthesesInfo.append(parenthesesDisjunction);
+            bodyDisjunction->terms.append(ByteTerm(ByteTerm::TypeParenthesesSubpattern, subpatternId, parenthesesDisjunction, invertOrCapture, inputPosition));
+
+            bodyDisjunction->terms[beginTerm].atom.quantityCount = quantityCount;
+            bodyDisjunction->terms[beginTerm].atom.quantityType = quantityType;
+            bodyDisjunction->terms[beginTerm].frameLocation = frameLocation;
+        }
+    }
+
+    void regexBegin(unsigned numSubpatterns, unsigned callFrameSize)
+    {
+        bodyDisjunction = new ByteDisjunction(numSubpatterns, callFrameSize);
+        bodyDisjunction->terms.append(ByteTerm::BodyAlternativeBegin());
+        bodyDisjunction->terms[0].frameLocation = 0;
+        currentAlternativeIndex = 0;
+    }
+
+    void regexEnd()
+    {
+        closeBodyAlternative();
+    }
+
+    void alterantiveBodyDisjunction()
+    {
+        int newAlternativeIndex = bodyDisjunction->terms.size();
+        bodyDisjunction->terms[currentAlternativeIndex].alternative.next = newAlternativeIndex - currentAlternativeIndex;
+        bodyDisjunction->terms.append(ByteTerm::BodyAlternativeDisjunction());
+
+        currentAlternativeIndex = newAlternativeIndex;
+    }
+
+    void alterantiveDisjunction()
+    {
+        int newAlternativeIndex = bodyDisjunction->terms.size();
+        bodyDisjunction->terms[currentAlternativeIndex].alternative.next = newAlternativeIndex - currentAlternativeIndex;
+        bodyDisjunction->terms.append(ByteTerm::AlternativeDisjunction());
+
+        currentAlternativeIndex = newAlternativeIndex;
+    }
+
+    void emitDisjunction(PatternDisjunction* disjunction, unsigned inputCountAlreadyChecked = 0, unsigned parenthesesInputCountAlreadyChecked = 0)
+    {
+        for (unsigned alt = 0; alt < disjunction->m_alternatives.size(); ++alt) {
+            unsigned currentCountAlreadyChecked = inputCountAlreadyChecked;
+        
+            if (alt) {
+                if (disjunction == m_pattern.m_body)
+                    alterantiveBodyDisjunction();
+                else
+                    alterantiveDisjunction();
+            }
+
+            PatternAlternative* alternative = disjunction->m_alternatives[alt];
+            unsigned minimumSize = alternative->m_minimumSize;
+
+            ASSERT(minimumSize >= parenthesesInputCountAlreadyChecked);
+            unsigned countToCheck = minimumSize - parenthesesInputCountAlreadyChecked;
+            if (countToCheck)
+                checkInput(countToCheck);
+            currentCountAlreadyChecked += countToCheck;
+
+            for (unsigned i = 0; i < alternative->m_terms.size(); ++i) {
+                PatternTerm& term = alternative->m_terms[i];
+
+                switch (term.type) {
+                case PatternTerm::TypeAssertionBOL:
+                    assertionBOL(term.inputPosition - currentCountAlreadyChecked);
+                    break;
+
+                case PatternTerm::TypeAssertionEOL:
+                    assertionEOL(term.inputPosition - currentCountAlreadyChecked);
+                    break;
+
+                case PatternTerm::TypeAssertionWordBoundary:
+                    assertionWordBoundary(term.invertOrCapture, term.inputPosition - currentCountAlreadyChecked);
+                    break;
+
+                case PatternTerm::TypePatternCharacter:
+                    atomPatternCharacter(term.patternCharacter, term.inputPosition - currentCountAlreadyChecked, term.frameLocation, term.quantityCount, term.quantityType);
+                    break;
+
+                case PatternTerm::TypeCharacterClass:
+                    atomCharacterClass(term.characterClass, term.invertOrCapture, term.inputPosition - currentCountAlreadyChecked, term.frameLocation, term.quantityCount, term.quantityType);
+                    break;
+
+                case PatternTerm::TypeBackReference:
+                    atomBackReference(term.subpatternId, term.inputPosition - currentCountAlreadyChecked, term.frameLocation, term.quantityCount, term.quantityType);
+                        break;
+
+                case PatternTerm::TypeForwardReference:
+                    break;
+
+                case PatternTerm::TypeParenthesesSubpattern: {
+                    unsigned disjunctionAlreadyCheckedCount = 0;
+                    if ((term.quantityCount == 1) && !term.parentheses.isCopy) {
+                        if (term.quantityType == QuantifierFixedCount) {
+                            disjunctionAlreadyCheckedCount = term.parentheses.disjunction->m_minimumSize;
+                            unsigned delegateEndInputOffset = term.inputPosition - currentCountAlreadyChecked;
+                            atomParenthesesSubpatternBegin(term.parentheses.subpatternId, term.invertOrCapture, delegateEndInputOffset - disjunctionAlreadyCheckedCount, term.frameLocation, term.frameLocation);
+                            emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, term.parentheses.disjunction->m_minimumSize);
+                            atomParenthesesEnd(true, term.parentheses.lastSubpatternId, delegateEndInputOffset, term.frameLocation, term.quantityCount, term.quantityType, term.parentheses.disjunction->m_callFrameSize);
+                        } else {
+                            unsigned delegateEndInputOffset = term.inputPosition - currentCountAlreadyChecked;
+                            atomParenthesesSubpatternBegin(term.parentheses.subpatternId, term.invertOrCapture, delegateEndInputOffset - disjunctionAlreadyCheckedCount, term.frameLocation, term.frameLocation + RegexStackSpaceForBackTrackInfoParenthesesOnce);
+                            emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, 0);
+                            atomParenthesesEnd(true, term.parentheses.lastSubpatternId, delegateEndInputOffset, term.frameLocation, term.quantityCount, term.quantityType, term.parentheses.disjunction->m_callFrameSize);
+                        }
+                    } else {
+                        unsigned delegateEndInputOffset = term.inputPosition - currentCountAlreadyChecked;
+                        atomParenthesesSubpatternBegin(term.parentheses.subpatternId, term.invertOrCapture, delegateEndInputOffset - disjunctionAlreadyCheckedCount, term.frameLocation, 0);
+                        emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, 0);
+                        atomParenthesesEnd(false, term.parentheses.lastSubpatternId, delegateEndInputOffset, term.frameLocation, term.quantityCount, term.quantityType, term.parentheses.disjunction->m_callFrameSize);
+                    }
+                    break;
+                }
+
+                case PatternTerm::TypeParentheticalAssertion: {
+                    unsigned alternativeFrameLocation = term.inputPosition + RegexStackSpaceForBackTrackInfoParentheticalAssertion;
+                    
+                    atomParentheticalAssertionBegin(term.parentheses.subpatternId, term.invertOrCapture, term.frameLocation, alternativeFrameLocation);
+                    emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, 0);
+                    atomParenthesesEnd(true, term.parentheses.lastSubpatternId, 0, term.frameLocation, term.quantityCount, term.quantityType);
+                    break;
+                }
+                }
+            }
+        }
+    }
+
+private:
+    RegexPattern& m_pattern;
+    ByteDisjunction* bodyDisjunction;
+    unsigned currentAlternativeIndex;
+    Vector<ParenthesesStackEntry> m_parenthesesStack;
+    Vector<ByteDisjunction*> m_allParenthesesInfo;
+};
+
+
+BytecodePattern* byteCompileRegex(const UString& patternString, unsigned& numSubpatterns, const char*& error, bool ignoreCase, bool multiline)
+{
+    RegexPattern pattern(ignoreCase, multiline);
+
+    if ((error = compileRegex(patternString, pattern)))
+        return 0;
+
+    numSubpatterns = pattern.m_numSubpatterns;
+
+    return ByteCompiler(pattern).compile();
+}
+
+int interpretRegex(BytecodePattern* regex, const UChar* input, unsigned start, unsigned length, int* output)
+{
+    return Interpreter(regex, output, input, start, length).interpret();
+}
+
+
+COMPILE_ASSERT(sizeof(Interpreter::BackTrackInfoPatternCharacter) == (RegexStackSpaceForBackTrackInfoPatternCharacter * sizeof(uintptr_t)), CheckRegexStackSpaceForBackTrackInfoPatternCharacter);
+COMPILE_ASSERT(sizeof(Interpreter::BackTrackInfoCharacterClass) == (RegexStackSpaceForBackTrackInfoCharacterClass * sizeof(uintptr_t)), CheckRegexStackSpaceForBackTrackInfoCharacterClass);
+COMPILE_ASSERT(sizeof(Interpreter::BackTrackInfoBackReference) == (RegexStackSpaceForBackTrackInfoBackReference * sizeof(uintptr_t)), CheckRegexStackSpaceForBackTrackInfoBackReference);
+COMPILE_ASSERT(sizeof(Interpreter::BackTrackInfoAlternative) == (RegexStackSpaceForBackTrackInfoAlternative * sizeof(uintptr_t)), CheckRegexStackSpaceForBackTrackInfoAlternative);
+COMPILE_ASSERT(sizeof(Interpreter::BackTrackInfoParentheticalAssertion) == (RegexStackSpaceForBackTrackInfoParentheticalAssertion * sizeof(uintptr_t)), CheckRegexStackSpaceForBackTrackInfoParentheticalAssertion);
+COMPILE_ASSERT(sizeof(Interpreter::BackTrackInfoParenthesesOnce) == (RegexStackSpaceForBackTrackInfoParenthesesOnce * sizeof(uintptr_t)), CheckRegexStackSpaceForBackTrackInfoParenthesesOnce);
+COMPILE_ASSERT(sizeof(Interpreter::BackTrackInfoParentheses) == (RegexStackSpaceForBackTrackInfoParentheses * sizeof(uintptr_t)), CheckRegexStackSpaceForBackTrackInfoParentheses);
+
+
+} }
+
+#endif
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.h
new file mode 100644
index 0000000..a8c122a
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexInterpreter.h
@@ -0,0 +1,337 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef RegexInterpreter_h
+#define RegexInterpreter_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(YARR)
+
+#include <wtf/unicode/Unicode.h>
+#include "RegexParser.h"
+#include "RegexPattern.h"
+
+namespace JSC { namespace Yarr {
+
+class ByteDisjunction;
+
+struct ByteTerm {
+    enum Type {
+        TypeBodyAlternativeBegin,
+        TypeBodyAlternativeDisjunction,
+        TypeBodyAlternativeEnd,
+        TypeAlternativeBegin,
+        TypeAlternativeDisjunction,
+        TypeAlternativeEnd,
+        TypeSubpatternBegin,
+        TypeSubpatternEnd,
+        TypeAssertionBOL,
+        TypeAssertionEOL,
+        TypeAssertionWordBoundary,
+        TypePatternCharacterOnce,
+        TypePatternCharacterFixed,
+        TypePatternCharacterGreedy,
+        TypePatternCharacterNonGreedy,
+        TypePatternCasedCharacterOnce,
+        TypePatternCasedCharacterFixed,
+        TypePatternCasedCharacterGreedy,
+        TypePatternCasedCharacterNonGreedy,
+        TypeCharacterClass,
+        TypeBackReference,
+        TypeParenthesesSubpattern,
+        TypeParenthesesSubpatternOnceBegin,
+        TypeParenthesesSubpatternOnceEnd,
+        TypeParentheticalAssertionBegin,
+        TypeParentheticalAssertionEnd,
+        TypeCheckInput,
+    } type;
+    bool invertOrCapture;
+    union {
+        struct {
+            union {
+                UChar patternCharacter;
+                struct {
+                    UChar lo;
+                    UChar hi;
+                } casedCharacter;
+                CharacterClass* characterClass;
+                unsigned subpatternId;
+            };
+            union {
+                ByteDisjunction* parenthesesDisjunction;
+                unsigned parenthesesWidth;
+            };
+            QuantifierType quantityType;
+            unsigned quantityCount;
+        } atom;
+        struct {
+            int next;
+            int end;
+        } alternative;
+        unsigned checkInputCount;
+    };
+    unsigned frameLocation;
+    int inputPosition;
+
+    ByteTerm(UChar ch, int inputPos, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType)
+        : frameLocation(frameLocation)
+    {
+        switch (quantityType) {
+        case QuantifierFixedCount:
+            type = (quantityCount == 1) ? ByteTerm::TypePatternCharacterOnce : ByteTerm::TypePatternCharacterFixed;
+            break;
+        case QuantifierGreedy:
+            type = ByteTerm::TypePatternCharacterGreedy;
+            break;
+        case QuantifierNonGreedy:
+            type = ByteTerm::TypePatternCharacterNonGreedy;
+            break;
+        }
+
+        atom.patternCharacter = ch;
+        atom.quantityType = quantityType;
+        atom.quantityCount = quantityCount;
+        inputPosition = inputPos;
+    }
+
+    ByteTerm(UChar lo, UChar hi, int inputPos, unsigned frameLocation, unsigned quantityCount, QuantifierType quantityType)
+        : frameLocation(frameLocation)
+    {
+        switch (quantityType) {
+        case QuantifierFixedCount:
+            type = (quantityCount == 1) ? ByteTerm::TypePatternCasedCharacterOnce : ByteTerm::TypePatternCasedCharacterFixed;
+            break;
+        case QuantifierGreedy:
+            type = ByteTerm::TypePatternCasedCharacterGreedy;
+            break;
+        case QuantifierNonGreedy:
+            type = ByteTerm::TypePatternCasedCharacterNonGreedy;
+            break;
+        }
+
+        atom.casedCharacter.lo = lo;
+        atom.casedCharacter.hi = hi;
+        atom.quantityType = quantityType;
+        atom.quantityCount = quantityCount;
+        inputPosition = inputPos;
+    }
+
+    ByteTerm(CharacterClass* characterClass, bool invert, int inputPos)
+        : type(ByteTerm::TypeCharacterClass)
+        , invertOrCapture(invert)
+    {
+        atom.characterClass = characterClass;
+        atom.quantityType = QuantifierFixedCount;
+        atom.quantityCount = 1;
+        inputPosition = inputPos;
+    }
+
+    ByteTerm(Type type, unsigned subpatternId, ByteDisjunction* parenthesesInfo, bool invertOrCapture, int inputPos)
+        : type(type)
+        , invertOrCapture(invertOrCapture)
+    {
+        atom.subpatternId = subpatternId;
+        atom.parenthesesDisjunction = parenthesesInfo;
+        atom.quantityType = QuantifierFixedCount;
+        atom.quantityCount = 1;
+        inputPosition = inputPos;
+    }
+    
+    ByteTerm(Type type, bool invert = false)
+        : type(type)
+        , invertOrCapture(invert)
+    {
+        atom.quantityType = QuantifierFixedCount;
+        atom.quantityCount = 1;
+    }
+
+    ByteTerm(Type type, unsigned subpatternId, bool invertOrCapture, int inputPos)
+        : type(type)
+        , invertOrCapture(invertOrCapture)
+    {
+        atom.subpatternId = subpatternId;
+        atom.quantityType = QuantifierFixedCount;
+        atom.quantityCount = 1;
+        inputPosition = inputPos;
+    }
+
+    static ByteTerm BOL(int inputPos)
+    {
+        ByteTerm term(TypeAssertionBOL);
+        term.inputPosition = inputPos;
+        return term;
+    }
+
+    static ByteTerm CheckInput(unsigned count)
+    {
+        ByteTerm term(TypeCheckInput);
+        term.checkInputCount = count;
+        return term;
+    }
+
+    static ByteTerm EOL(int inputPos)
+    {
+        ByteTerm term(TypeAssertionEOL);
+        term.inputPosition = inputPos;
+        return term;
+    }
+
+    static ByteTerm WordBoundary(bool invert, int inputPos)
+    {
+        ByteTerm term(TypeAssertionWordBoundary, invert);
+        term.inputPosition = inputPos;
+        return term;
+    }
+    
+    static ByteTerm BackReference(unsigned subpatternId, int inputPos)
+    {
+        return ByteTerm(TypeBackReference, subpatternId, false, inputPos);
+    }
+
+    static ByteTerm BodyAlternativeBegin()
+    {
+        ByteTerm term(TypeBodyAlternativeBegin);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        return term;
+    }
+
+    static ByteTerm BodyAlternativeDisjunction()
+    {
+        ByteTerm term(TypeBodyAlternativeDisjunction);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        return term;
+    }
+
+    static ByteTerm BodyAlternativeEnd()
+    {
+        ByteTerm term(TypeBodyAlternativeEnd);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        return term;
+    }
+
+    static ByteTerm AlternativeBegin()
+    {
+        ByteTerm term(TypeAlternativeBegin);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        return term;
+    }
+
+    static ByteTerm AlternativeDisjunction()
+    {
+        ByteTerm term(TypeAlternativeDisjunction);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        return term;
+    }
+
+    static ByteTerm AlternativeEnd()
+    {
+        ByteTerm term(TypeAlternativeEnd);
+        term.alternative.next = 0;
+        term.alternative.end = 0;
+        return term;
+    }
+
+    static ByteTerm SubpatternBegin()
+    {
+        return ByteTerm(TypeSubpatternBegin);
+    }
+
+    static ByteTerm SubpatternEnd()
+    {
+        return ByteTerm(TypeSubpatternEnd);
+    }
+
+    bool invert()
+    {
+        return invertOrCapture;
+    }
+
+    bool capture()
+    {
+        return invertOrCapture;
+    }
+};
+
+class ByteDisjunction {
+public:
+    ByteDisjunction(unsigned numSubpatterns, unsigned frameSize)
+        : m_numSubpatterns(numSubpatterns)
+        , m_frameSize(frameSize)
+    {
+    }
+
+    Vector<ByteTerm> terms;
+    unsigned m_numSubpatterns;
+    unsigned m_frameSize;
+};
+
+struct BytecodePattern {
+    BytecodePattern(ByteDisjunction* body, Vector<ByteDisjunction*> allParenthesesInfo, RegexPattern& pattern)
+        : m_body(body)
+        , m_ignoreCase(pattern.m_ignoreCase)
+        , m_multiline(pattern.m_multiline)
+    {
+        newlineCharacterClass = pattern.newlineCharacterClass();
+        wordcharCharacterClass = pattern.wordcharCharacterClass();
+
+        m_allParenthesesInfo.append(allParenthesesInfo);
+        m_userCharacterClasses.append(pattern.m_userCharacterClasses);
+        // 'Steal' the RegexPattern's CharacterClasses!  We clear its
+        // array, so that it won't delete them on destruction.  We'll
+        // take responsibility for that.
+        pattern.m_userCharacterClasses.clear();
+    }
+
+    ~BytecodePattern()
+    {
+        deleteAllValues(m_allParenthesesInfo);
+        deleteAllValues(m_userCharacterClasses);
+    }
+
+    OwnPtr<ByteDisjunction> m_body;
+    bool m_ignoreCase;
+    bool m_multiline;
+    
+    CharacterClass* newlineCharacterClass;
+    CharacterClass* wordcharCharacterClass;
+private:
+    Vector<ByteDisjunction*> m_allParenthesesInfo;
+    Vector<CharacterClass*> m_userCharacterClasses;
+};
+
+BytecodePattern* byteCompileRegex(const UString& pattern, unsigned& numSubpatterns, const char*& error, bool ignoreCase = false, bool multiline = false);
+int interpretRegex(BytecodePattern* v_regex, const UChar* input, unsigned start, unsigned length, int* output);
+
+} } // namespace JSC::Yarr
+
+#endif
+
+#endif // RegexInterpreter_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
new file mode 100644
index 0000000..29a9d18
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.cpp
@@ -0,0 +1,1414 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "RegexJIT.h"
+
+#include "ASCIICType.h"
+#include "JSGlobalData.h"
+#include "MacroAssembler.h"
+#include "RegexCompiler.h"
+
+#include "pcre.h" // temporary, remove when fallback is removed.
+
+#if ENABLE(YARR_JIT)
+
+using namespace WTF;
+
+namespace JSC { namespace Yarr {
+
+
+class RegexGenerator : private MacroAssembler {
+    friend void jitCompileRegex(JSGlobalData* globalData, RegexCodeBlock& jitObject, const UString& pattern, unsigned& numSubpatterns, const char*& error, bool ignoreCase, bool multiline);
+
+#if PLATFORM_ARM_ARCH(7)
+    static const RegisterID input = ARM::r0;
+    static const RegisterID index = ARM::r1;
+    static const RegisterID length = ARM::r2;
+
+    static const RegisterID output = ARM::r4;
+    static const RegisterID regT0 = ARM::r5;
+    static const RegisterID regT1 = ARM::r6;
+
+    static const RegisterID returnRegister = ARM::r0;
+#endif
+#if PLATFORM(X86)
+    static const RegisterID input = X86::eax;
+    static const RegisterID index = X86::edx;
+    static const RegisterID length = X86::ecx;
+    static const RegisterID output = X86::edi;
+
+    static const RegisterID regT0 = X86::ebx;
+    static const RegisterID regT1 = X86::esi;
+
+    static const RegisterID returnRegister = X86::eax;
+#endif
+#if PLATFORM(X86_64)
+    static const RegisterID input = X86::edi;
+    static const RegisterID index = X86::esi;
+    static const RegisterID length = X86::edx;
+    static const RegisterID output = X86::ecx;
+
+    static const RegisterID regT0 = X86::eax;
+    static const RegisterID regT1 = X86::ebx;
+
+    static const RegisterID returnRegister = X86::eax;
+#endif
+
+    void optimizeAlternative(PatternAlternative* alternative)
+    {
+        if (!alternative->m_terms.size())
+            return;
+
+        for (unsigned i = 0; i < alternative->m_terms.size() - 1; ++i) {
+            PatternTerm& term = alternative->m_terms[i];
+            PatternTerm& nextTerm = alternative->m_terms[i + 1];
+
+            if ((term.type == PatternTerm::TypeCharacterClass)
+                && (term.quantityType == QuantifierFixedCount)
+                && (nextTerm.type == PatternTerm::TypePatternCharacter)
+                && (nextTerm.quantityType == QuantifierFixedCount)) {
+                PatternTerm termCopy = term;
+                alternative->m_terms[i] = nextTerm;
+                alternative->m_terms[i + 1] = termCopy;
+            }
+        }
+    }
+
+    void matchCharacterClassRange(RegisterID character, JumpList& failures, JumpList& matchDest, const CharacterRange* ranges, unsigned count, unsigned* matchIndex, const UChar* matches, unsigned matchCount)
+    {
+        do {
+            // pick which range we're going to generate
+            int which = count >> 1;
+            char lo = ranges[which].begin;
+            char hi = ranges[which].end;
+            
+            // check if there are any ranges or matches below lo.  If not, just jl to failure -
+            // if there is anything else to check, check that first, if it falls through jmp to failure.
+            if ((*matchIndex < matchCount) && (matches[*matchIndex] < lo)) {
+                Jump loOrAbove = branch32(GreaterThanOrEqual, character, Imm32((unsigned short)lo));
+                
+                // generate code for all ranges before this one
+                if (which)
+                    matchCharacterClassRange(character, failures, matchDest, ranges, which, matchIndex, matches, matchCount);
+                
+                while ((*matchIndex < matchCount) && (matches[*matchIndex] < lo)) {
+                    matchDest.append(branch32(Equal, character, Imm32((unsigned short)matches[*matchIndex])));
+                    ++*matchIndex;
+                }
+                failures.append(jump());
+
+                loOrAbove.link(this);
+            } else if (which) {
+                Jump loOrAbove = branch32(GreaterThanOrEqual, character, Imm32((unsigned short)lo));
+
+                matchCharacterClassRange(character, failures, matchDest, ranges, which, matchIndex, matches, matchCount);
+                failures.append(jump());
+
+                loOrAbove.link(this);
+            } else
+                failures.append(branch32(LessThan, character, Imm32((unsigned short)lo)));
+
+            while ((*matchIndex < matchCount) && (matches[*matchIndex] <= hi))
+                ++*matchIndex;
+
+            matchDest.append(branch32(LessThanOrEqual, character, Imm32((unsigned short)hi)));
+            // fall through to here, the value is above hi.
+
+            // shuffle along & loop around if there are any more matches to handle.
+            unsigned next = which + 1;
+            ranges += next;
+            count -= next;
+        } while (count);
+    }
+
+    void matchCharacterClass(RegisterID character, JumpList& matchDest, const CharacterClass* charClass)
+    {
+        Jump unicodeFail;
+        if (charClass->m_matchesUnicode.size() || charClass->m_rangesUnicode.size()) {
+            Jump isAscii = branch32(LessThanOrEqual, character, Imm32(0x7f));
+        
+            if (charClass->m_matchesUnicode.size()) {
+                for (unsigned i = 0; i < charClass->m_matchesUnicode.size(); ++i) {
+                    UChar ch = charClass->m_matchesUnicode[i];
+                    matchDest.append(branch32(Equal, character, Imm32(ch)));
+                }
+            }
+            
+            if (charClass->m_rangesUnicode.size()) {
+                for (unsigned i = 0; i < charClass->m_rangesUnicode.size(); ++i) {
+                    UChar lo = charClass->m_rangesUnicode[i].begin;
+                    UChar hi = charClass->m_rangesUnicode[i].end;
+                    
+                    Jump below = branch32(LessThan, character, Imm32(lo));
+                    matchDest.append(branch32(LessThanOrEqual, character, Imm32(hi)));
+                    below.link(this);
+                }
+            }
+
+            unicodeFail = jump();
+            isAscii.link(this);
+        }
+
+        if (charClass->m_ranges.size()) {
+            unsigned matchIndex = 0;
+            JumpList failures; 
+            matchCharacterClassRange(character, failures, matchDest, charClass->m_ranges.begin(), charClass->m_ranges.size(), &matchIndex, charClass->m_matches.begin(), charClass->m_matches.size());
+            while (matchIndex < charClass->m_matches.size())
+                matchDest.append(branch32(Equal, character, Imm32((unsigned short)charClass->m_matches[matchIndex++])));
+
+            failures.link(this);
+        } else if (charClass->m_matches.size()) {
+            // optimization: gather 'a','A' etc back together, can mask & test once.
+            Vector<char> matchesAZaz;
+
+            for (unsigned i = 0; i < charClass->m_matches.size(); ++i) {
+                char ch = charClass->m_matches[i];
+                if (m_pattern.m_ignoreCase) {
+                    if (isASCIILower(ch)) {
+                        matchesAZaz.append(ch);
+                        continue;
+                    }
+                    if (isASCIIUpper(ch))
+                        continue;
+                }
+                matchDest.append(branch32(Equal, character, Imm32((unsigned short)ch)));
+            }
+
+            if (unsigned countAZaz = matchesAZaz.size()) {
+                or32(Imm32(32), character);
+                for (unsigned i = 0; i < countAZaz; ++i)
+                    matchDest.append(branch32(Equal, character, Imm32(matchesAZaz[i])));
+            }
+        }
+
+        if (charClass->m_matchesUnicode.size() || charClass->m_rangesUnicode.size())
+            unicodeFail.link(this);
+    }
+
+    // Jumps if input not available; will have (incorrectly) incremented already!
+    Jump jumpIfNoAvailableInput(unsigned countToCheck)
+    {
+        add32(Imm32(countToCheck), index);
+        return branch32(Above, index, length);
+    }
+
+    Jump jumpIfAvailableInput(unsigned countToCheck)
+    {
+        add32(Imm32(countToCheck), index);
+        return branch32(BelowOrEqual, index, length);
+    }
+
+    Jump checkInput()
+    {
+        return branch32(BelowOrEqual, index, length);
+    }
+
+    Jump atEndOfInput()
+    {
+        return branch32(Equal, index, length);
+    }
+
+    Jump notAtEndOfInput()
+    {
+        return branch32(NotEqual, index, length);
+    }
+
+    Jump jumpIfCharEquals(UChar ch, int inputPosition)
+    {
+        return branch16(Equal, BaseIndex(input, index, TimesTwo, inputPosition * sizeof(UChar)), Imm32(ch));
+    }
+
+    Jump jumpIfCharNotEquals(UChar ch, int inputPosition)
+    {
+        return branch16(NotEqual, BaseIndex(input, index, TimesTwo, inputPosition * sizeof(UChar)), Imm32(ch));
+    }
+
+    void readCharacter(int inputPosition, RegisterID reg)
+    {
+        load16(BaseIndex(input, index, TimesTwo, inputPosition * sizeof(UChar)), reg);
+    }
+
+    void storeToFrame(RegisterID reg, unsigned frameLocation)
+    {
+        poke(reg, frameLocation);
+    }
+
+    void storeToFrame(Imm32 imm, unsigned frameLocation)
+    {
+        poke(imm, frameLocation);
+    }
+
+    DataLabelPtr storeToFrameWithPatch(unsigned frameLocation)
+    {
+        return storePtrWithPatch(ImmPtr(0), Address(stackPointerRegister, frameLocation * sizeof(void*)));
+    }
+
+    void loadFromFrame(unsigned frameLocation, RegisterID reg)
+    {
+        peek(reg, frameLocation);
+    }
+
+    void loadFromFrameAndJump(unsigned frameLocation)
+    {
+        jump(Address(stackPointerRegister, frameLocation * sizeof(void*)));
+    }
+
+    struct AlternativeBacktrackRecord {
+        DataLabelPtr dataLabel;
+        Label backtrackLocation;
+
+        AlternativeBacktrackRecord(DataLabelPtr dataLabel, Label backtrackLocation)
+            : dataLabel(dataLabel)
+            , backtrackLocation(backtrackLocation)
+        {
+        }
+    };
+
+    struct TermGenerationState {
+        TermGenerationState(PatternDisjunction* disjunction, unsigned checkedTotal)
+            : disjunction(disjunction)
+            , checkedTotal(checkedTotal)
+        {
+        }
+
+        void resetAlternative()
+        {
+            isBackTrackGenerated = false;
+            alt = 0;
+        }
+        bool alternativeValid()
+        {
+            return alt < disjunction->m_alternatives.size();
+        }
+        void nextAlternative()
+        {
+            ++alt;
+        }
+        PatternAlternative* alternative()
+        {
+            return disjunction->m_alternatives[alt];
+        }
+
+        void resetTerm()
+        {
+            ASSERT(alternativeValid());
+            t = 0;
+        }
+        bool termValid()
+        {
+            ASSERT(alternativeValid());
+            return t < alternative()->m_terms.size();
+        }
+        void nextTerm()
+        {
+            ASSERT(alternativeValid());
+            ++t;
+        }
+        PatternTerm& term()
+        {
+            ASSERT(alternativeValid());
+            return alternative()->m_terms[t];
+        }
+
+        PatternTerm& lookaheadTerm()
+        {
+            ASSERT(alternativeValid());
+            ASSERT((t + 1) < alternative()->m_terms.size());
+            return alternative()->m_terms[t + 1];
+        }
+        bool isSinglePatternCharacterLookaheadTerm()
+        {
+            ASSERT(alternativeValid());
+            return ((t + 1) < alternative()->m_terms.size())
+                && (lookaheadTerm().type == PatternTerm::TypePatternCharacter)
+                && (lookaheadTerm().quantityType == QuantifierFixedCount)
+                && (lookaheadTerm().quantityCount == 1);
+        }
+
+        int inputOffset()
+        {
+            return term().inputPosition - checkedTotal;
+        }
+
+        void jumpToBacktrack(Jump jump, MacroAssembler* masm)
+        {
+            if (isBackTrackGenerated)
+                jump.linkTo(backtrackLabel, masm);
+            else
+                backTrackJumps.append(jump);
+        }
+        void jumpToBacktrack(JumpList& jumps, MacroAssembler* masm)
+        {
+            if (isBackTrackGenerated)
+                jumps.linkTo(backtrackLabel, masm);
+            else
+                backTrackJumps.append(jumps);
+        }
+        bool plantJumpToBacktrackIfExists(MacroAssembler* masm)
+        {
+            if (isBackTrackGenerated) {
+                masm->jump(backtrackLabel);
+                return true;
+            }
+            return false;
+        }
+        void addBacktrackJump(Jump jump)
+        {
+            backTrackJumps.append(jump);
+        }
+        void setBacktrackGenerated(Label label)
+        {
+            isBackTrackGenerated = true;
+            backtrackLabel = label;
+        }
+        void linkAlternativeBacktracks(MacroAssembler* masm)
+        {
+            isBackTrackGenerated = false;
+            backTrackJumps.link(masm);
+        }
+        void linkAlternativeBacktracksTo(Label label, MacroAssembler* masm)
+        {
+            isBackTrackGenerated = false;
+            backTrackJumps.linkTo(label, masm);
+        }
+        void propagateBacktrackingFrom(TermGenerationState& nestedParenthesesState, MacroAssembler* masm)
+        {
+            jumpToBacktrack(nestedParenthesesState.backTrackJumps, masm);
+            if (nestedParenthesesState.isBackTrackGenerated)
+                setBacktrackGenerated(nestedParenthesesState.backtrackLabel);
+        }
+
+        PatternDisjunction* disjunction;
+        int checkedTotal;
+    private:
+        unsigned alt;
+        unsigned t;
+        JumpList backTrackJumps;
+        Label backtrackLabel;
+        bool isBackTrackGenerated;
+    };
+
+    void generateAssertionBOL(TermGenerationState& state)
+    {
+        PatternTerm& term = state.term();
+
+        if (m_pattern.m_multiline) {
+            const RegisterID character = regT0;
+
+            JumpList matchDest;
+            if (!term.inputPosition)
+                matchDest.append(branch32(Equal, index, Imm32(state.checkedTotal)));
+
+            readCharacter(state.inputOffset() - 1, character);
+            matchCharacterClass(character, matchDest, m_pattern.newlineCharacterClass());
+            state.jumpToBacktrack(jump(), this);
+
+            matchDest.link(this);
+        } else {
+            // Erk, really should poison out these alternatives early. :-/
+            if (term.inputPosition)
+                state.jumpToBacktrack(jump(), this);
+            else
+                state.jumpToBacktrack(branch32(NotEqual, index, Imm32(state.checkedTotal)), this);
+        }
+    }
+
+    void generateAssertionEOL(TermGenerationState& state)
+    {
+        PatternTerm& term = state.term();
+
+        if (m_pattern.m_multiline) {
+            const RegisterID character = regT0;
+
+            JumpList matchDest;
+            if (term.inputPosition == state.checkedTotal)
+                matchDest.append(atEndOfInput());
+
+            readCharacter(state.inputOffset(), character);
+            matchCharacterClass(character, matchDest, m_pattern.newlineCharacterClass());
+            state.jumpToBacktrack(jump(), this);
+
+            matchDest.link(this);
+        } else {
+            if (term.inputPosition == state.checkedTotal)
+                state.jumpToBacktrack(notAtEndOfInput(), this);
+            // Erk, really should poison out these alternatives early. :-/
+            else
+                state.jumpToBacktrack(jump(), this);
+        }
+    }
+
+    // Also falls though on nextIsNotWordChar.
+    void matchAssertionWordchar(TermGenerationState& state, JumpList& nextIsWordChar, JumpList& nextIsNotWordChar)
+    {
+        const RegisterID character = regT0;
+        PatternTerm& term = state.term();
+
+        if (term.inputPosition == state.checkedTotal)
+            nextIsNotWordChar.append(atEndOfInput());
+
+        readCharacter(state.inputOffset(), character);
+        matchCharacterClass(character, nextIsWordChar, m_pattern.wordcharCharacterClass());
+    }
+
+    void generateAssertionWordBoundary(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        PatternTerm& term = state.term();
+
+        Jump atBegin;
+        JumpList matchDest;
+        if (!term.inputPosition)
+            atBegin = branch32(Equal, index, Imm32(state.checkedTotal));
+        readCharacter(state.inputOffset() - 1, character);
+        matchCharacterClass(character, matchDest, m_pattern.wordcharCharacterClass());
+        if (!term.inputPosition)
+            atBegin.link(this);
+
+        // We fall through to here if the last character was not a wordchar.
+        JumpList nonWordCharThenWordChar;
+        JumpList nonWordCharThenNonWordChar;
+        if (term.invertOrCapture) {
+            matchAssertionWordchar(state, nonWordCharThenNonWordChar, nonWordCharThenWordChar);
+            nonWordCharThenWordChar.append(jump());
+        } else {
+            matchAssertionWordchar(state, nonWordCharThenWordChar, nonWordCharThenNonWordChar);
+            nonWordCharThenNonWordChar.append(jump());
+        }
+        state.jumpToBacktrack(nonWordCharThenNonWordChar, this);
+
+        // We jump here if the last character was a wordchar.
+        matchDest.link(this);
+        JumpList wordCharThenWordChar;
+        JumpList wordCharThenNonWordChar;
+        if (term.invertOrCapture) {
+            matchAssertionWordchar(state, wordCharThenNonWordChar, wordCharThenWordChar);
+            wordCharThenWordChar.append(jump());
+        } else {
+            matchAssertionWordchar(state, wordCharThenWordChar, wordCharThenNonWordChar);
+            // This can fall-though!
+        }
+
+        state.jumpToBacktrack(wordCharThenWordChar, this);
+        
+        nonWordCharThenWordChar.link(this);
+        wordCharThenNonWordChar.link(this);
+    }
+
+    void generatePatternCharacterSingle(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        UChar ch = state.term().patternCharacter;
+
+        if (m_pattern.m_ignoreCase && isASCIIAlpha(ch)) {
+            readCharacter(state.inputOffset(), character);
+            or32(Imm32(32), character);
+            state.jumpToBacktrack(branch32(NotEqual, character, Imm32(Unicode::toLower(ch))), this);
+        } else {
+            ASSERT(!m_pattern.m_ignoreCase || (Unicode::toLower(ch) == Unicode::toUpper(ch)));
+            state.jumpToBacktrack(jumpIfCharNotEquals(ch, state.inputOffset()), this);
+        }
+    }
+
+    void generatePatternCharacterPair(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        UChar ch1 = state.term().patternCharacter;
+        UChar ch2 = state.lookaheadTerm().patternCharacter;
+
+        int mask = 0;
+        int chPair = ch1 | (ch2 << 16);
+        
+        if (m_pattern.m_ignoreCase) {
+            if (isASCIIAlpha(ch1))
+                mask |= 32;
+            if (isASCIIAlpha(ch2))
+                mask |= 32 << 16;
+        }
+
+        if (mask) {
+            load32(BaseIndex(input, index, TimesTwo, state.inputOffset() * sizeof(UChar)), character);
+            or32(Imm32(mask), character);
+            state.jumpToBacktrack(branch32(NotEqual, character, Imm32(chPair | mask)), this);
+        } else
+            state.jumpToBacktrack(branch32(NotEqual, BaseIndex(input, index, TimesTwo, state.inputOffset() * sizeof(UChar)), Imm32(chPair)), this);
+    }
+
+    void generatePatternCharacterFixed(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+        PatternTerm& term = state.term();
+        UChar ch = term.patternCharacter;
+
+        move(index, countRegister);
+        sub32(Imm32(term.quantityCount), countRegister);
+
+        Label loop(this);
+        if (m_pattern.m_ignoreCase && isASCIIAlpha(ch)) {
+            load16(BaseIndex(input, countRegister, TimesTwo, (state.inputOffset() + term.quantityCount) * sizeof(UChar)), character);
+            or32(Imm32(32), character);
+            state.jumpToBacktrack(branch32(NotEqual, character, Imm32(Unicode::toLower(ch))), this);
+        } else {
+            ASSERT(!m_pattern.m_ignoreCase || (Unicode::toLower(ch) == Unicode::toUpper(ch)));
+            state.jumpToBacktrack(branch16(NotEqual, BaseIndex(input, countRegister, TimesTwo, (state.inputOffset() + term.quantityCount) * sizeof(UChar)), Imm32(ch)), this);
+        }
+        add32(Imm32(1), countRegister);
+        branch32(NotEqual, countRegister, index).linkTo(loop, this);
+    }
+
+    void generatePatternCharacterGreedy(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+        PatternTerm& term = state.term();
+        UChar ch = term.patternCharacter;
+    
+        move(Imm32(0), countRegister);
+
+        JumpList failures;
+        Label loop(this);
+        failures.append(atEndOfInput());
+        if (m_pattern.m_ignoreCase && isASCIIAlpha(ch)) {
+            readCharacter(state.inputOffset(), character);
+            or32(Imm32(32), character);
+            failures.append(branch32(NotEqual, character, Imm32(Unicode::toLower(ch))));
+        } else {
+            ASSERT(!m_pattern.m_ignoreCase || (Unicode::toLower(ch) == Unicode::toUpper(ch)));
+            failures.append(jumpIfCharNotEquals(ch, state.inputOffset()));
+        }
+        add32(Imm32(1), countRegister);
+        add32(Imm32(1), index);
+        branch32(NotEqual, countRegister, Imm32(term.quantityCount)).linkTo(loop, this);
+        failures.append(jump());
+
+        Label backtrackBegin(this);
+        loadFromFrame(term.frameLocation, countRegister);
+        state.jumpToBacktrack(branchTest32(Zero, countRegister), this);
+        sub32(Imm32(1), countRegister);
+        sub32(Imm32(1), index);
+
+        failures.link(this);
+
+        storeToFrame(countRegister, term.frameLocation);
+
+        state.setBacktrackGenerated(backtrackBegin);
+    }
+
+    void generatePatternCharacterNonGreedy(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+        PatternTerm& term = state.term();
+        UChar ch = term.patternCharacter;
+    
+        move(Imm32(0), countRegister);
+
+        Jump firstTimeDoNothing = jump();
+
+        Label hardFail(this);
+        sub32(countRegister, index);
+        state.jumpToBacktrack(jump(), this);
+
+        Label backtrackBegin(this);
+        loadFromFrame(term.frameLocation, countRegister);
+
+        atEndOfInput().linkTo(hardFail, this);
+        branch32(Equal, countRegister, Imm32(term.quantityCount), hardFail);
+        if (m_pattern.m_ignoreCase && isASCIIAlpha(ch)) {
+            readCharacter(state.inputOffset(), character);
+            or32(Imm32(32), character);
+            branch32(NotEqual, character, Imm32(Unicode::toLower(ch))).linkTo(hardFail, this);
+        } else {
+            ASSERT(!m_pattern.m_ignoreCase || (Unicode::toLower(ch) == Unicode::toUpper(ch)));
+            jumpIfCharNotEquals(ch, state.inputOffset()).linkTo(hardFail, this);
+        }
+
+        add32(Imm32(1), countRegister);
+        add32(Imm32(1), index);
+
+        firstTimeDoNothing.link(this);
+        storeToFrame(countRegister, term.frameLocation);
+
+        state.setBacktrackGenerated(backtrackBegin);
+    }
+
+    void generateCharacterClassSingle(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        PatternTerm& term = state.term();
+
+        JumpList matchDest;
+        readCharacter(state.inputOffset(), character);
+        matchCharacterClass(character, matchDest, term.characterClass);
+
+        if (term.invertOrCapture)
+            state.jumpToBacktrack(matchDest, this);
+        else {
+            state.jumpToBacktrack(jump(), this);
+            matchDest.link(this);
+        }
+    }
+
+    void generateCharacterClassFixed(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+        PatternTerm& term = state.term();
+
+        move(index, countRegister);
+        sub32(Imm32(term.quantityCount), countRegister);
+
+        Label loop(this);
+        JumpList matchDest;
+        load16(BaseIndex(input, countRegister, TimesTwo, (state.inputOffset() + term.quantityCount) * sizeof(UChar)), character);
+        matchCharacterClass(character, matchDest, term.characterClass);
+
+        if (term.invertOrCapture)
+            state.jumpToBacktrack(matchDest, this);
+        else {
+            state.jumpToBacktrack(jump(), this);
+            matchDest.link(this);
+        }
+
+        add32(Imm32(1), countRegister);
+        branch32(NotEqual, countRegister, index).linkTo(loop, this);
+    }
+
+    void generateCharacterClassGreedy(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+        PatternTerm& term = state.term();
+    
+        move(Imm32(0), countRegister);
+
+        JumpList failures;
+        Label loop(this);
+        failures.append(atEndOfInput());
+
+        if (term.invertOrCapture) {
+            readCharacter(state.inputOffset(), character);
+            matchCharacterClass(character, failures, term.characterClass);
+        } else {
+            JumpList matchDest;
+            readCharacter(state.inputOffset(), character);
+            matchCharacterClass(character, matchDest, term.characterClass);
+            failures.append(jump());
+            matchDest.link(this);
+        }
+
+        add32(Imm32(1), countRegister);
+        add32(Imm32(1), index);
+        branch32(NotEqual, countRegister, Imm32(term.quantityCount)).linkTo(loop, this);
+        failures.append(jump());
+
+        Label backtrackBegin(this);
+        loadFromFrame(term.frameLocation, countRegister);
+        state.jumpToBacktrack(branchTest32(Zero, countRegister), this);
+        sub32(Imm32(1), countRegister);
+        sub32(Imm32(1), index);
+
+        failures.link(this);
+
+        storeToFrame(countRegister, term.frameLocation);
+
+        state.setBacktrackGenerated(backtrackBegin);
+    }
+
+    void generateCharacterClassNonGreedy(TermGenerationState& state)
+    {
+        const RegisterID character = regT0;
+        const RegisterID countRegister = regT1;
+        PatternTerm& term = state.term();
+    
+        move(Imm32(0), countRegister);
+
+        Jump firstTimeDoNothing = jump();
+
+        Label hardFail(this);
+        sub32(countRegister, index);
+        state.jumpToBacktrack(jump(), this);
+
+        Label backtrackBegin(this);
+        loadFromFrame(term.frameLocation, countRegister);
+
+        atEndOfInput().linkTo(hardFail, this);
+        branch32(Equal, countRegister, Imm32(term.quantityCount), hardFail);
+
+        JumpList matchDest;
+        readCharacter(state.inputOffset(), character);
+        matchCharacterClass(character, matchDest, term.characterClass);
+
+        if (term.invertOrCapture)
+            matchDest.linkTo(hardFail, this);
+        else {
+            jump(hardFail);
+            matchDest.link(this);
+        }
+
+        add32(Imm32(1), countRegister);
+        add32(Imm32(1), index);
+
+        firstTimeDoNothing.link(this);
+        storeToFrame(countRegister, term.frameLocation);
+
+        state.setBacktrackGenerated(backtrackBegin);
+    }
+
+    void generateParenthesesDisjunction(PatternTerm& parenthesesTerm, TermGenerationState& state, unsigned alternativeFrameLocation)
+    {
+        ASSERT((parenthesesTerm.type == PatternTerm::TypeParenthesesSubpattern) || (parenthesesTerm.type == PatternTerm::TypeParentheticalAssertion));
+        ASSERT(parenthesesTerm.quantityCount == 1);
+    
+        PatternDisjunction* disjunction = parenthesesTerm.parentheses.disjunction;
+        unsigned preCheckedCount = ((parenthesesTerm.quantityType == QuantifierFixedCount) && (parenthesesTerm.type != PatternTerm::TypeParentheticalAssertion)) ? disjunction->m_minimumSize : 0;
+
+        if (disjunction->m_alternatives.size() == 1) {
+            state.resetAlternative();
+            ASSERT(state.alternativeValid());
+            PatternAlternative* alternative = state.alternative();
+            optimizeAlternative(alternative);
+
+            int countToCheck = alternative->m_minimumSize - preCheckedCount;
+            if (countToCheck) {
+                ASSERT((parenthesesTerm.type == PatternTerm::TypeParentheticalAssertion) || (parenthesesTerm.quantityType != QuantifierFixedCount));
+
+                // FIXME: This is quite horrible.  The call to 'plantJumpToBacktrackIfExists'
+                // will be forced to always trampoline into here, just to decrement the index.
+                // Ick. 
+                Jump skip = jump();
+
+                Label backtrackBegin(this);
+                sub32(Imm32(countToCheck), index);
+                state.addBacktrackJump(jump());
+                
+                skip.link(this);
+
+                state.setBacktrackGenerated(backtrackBegin);
+
+                state.jumpToBacktrack(jumpIfNoAvailableInput(countToCheck), this);
+                state.checkedTotal += countToCheck;
+            }
+
+            for (state.resetTerm(); state.termValid(); state.nextTerm())
+                generateTerm(state);
+
+            state.checkedTotal -= countToCheck;
+        } else {
+            JumpList successes;
+
+            for (state.resetAlternative(); state.alternativeValid(); state.nextAlternative()) {
+
+                PatternAlternative* alternative = state.alternative();
+                optimizeAlternative(alternative);
+
+                ASSERT(alternative->m_minimumSize >= preCheckedCount);
+                int countToCheck = alternative->m_minimumSize - preCheckedCount;
+                if (countToCheck) {
+                    state.addBacktrackJump(jumpIfNoAvailableInput(countToCheck));
+                    state.checkedTotal += countToCheck;
+                }
+
+                for (state.resetTerm(); state.termValid(); state.nextTerm())
+                    generateTerm(state);
+
+                // Matched an alternative.
+                DataLabelPtr dataLabel = storeToFrameWithPatch(alternativeFrameLocation);
+                successes.append(jump());
+
+                // Alternative did not match.
+                Label backtrackLocation(this);
+                
+                // Can we backtrack the alternative? - if so, do so.  If not, just fall through to the next one.
+                state.plantJumpToBacktrackIfExists(this);
+                
+                state.linkAlternativeBacktracks(this);
+
+                if (countToCheck) {
+                    sub32(Imm32(countToCheck), index);
+                    state.checkedTotal -= countToCheck;
+                }
+
+                m_backtrackRecords.append(AlternativeBacktrackRecord(dataLabel, backtrackLocation));
+            }
+            // We fall through to here when the last alternative fails.
+            // Add a backtrack out of here for the parenthese handling code to link up.
+            state.addBacktrackJump(jump());
+
+            // Generate a trampoline for the parens code to backtrack to, to retry the
+            // next alternative.
+            state.setBacktrackGenerated(label());
+            loadFromFrameAndJump(alternativeFrameLocation);
+
+            // FIXME: both of the above hooks are a little inefficient, in that you
+            // may end up trampolining here, just to trampoline back out to the
+            // parentheses code, or vice versa.  We can probably eliminate a jump
+            // by restructuring, but coding this way for now for simplicity during
+            // development.
+
+            successes.link(this);
+        }
+    }
+
+    void generateParenthesesSingle(TermGenerationState& state)
+    {
+        const RegisterID indexTemporary = regT0;
+        PatternTerm& term = state.term();
+        PatternDisjunction* disjunction = term.parentheses.disjunction;
+        ASSERT(term.quantityCount == 1);
+
+        unsigned preCheckedCount = ((term.quantityCount == 1) && (term.quantityType == QuantifierFixedCount)) ? disjunction->m_minimumSize : 0;
+
+        unsigned parenthesesFrameLocation = term.frameLocation;
+        unsigned alternativeFrameLocation = parenthesesFrameLocation;
+        if (term.quantityType != QuantifierFixedCount)
+            alternativeFrameLocation += RegexStackSpaceForBackTrackInfoParenthesesOnce;
+
+        // optimized case - no capture & no quantifier can be handled in a light-weight manner.
+        if (!term.invertOrCapture && (term.quantityType == QuantifierFixedCount)) {
+            TermGenerationState parenthesesState(disjunction, state.checkedTotal);
+            generateParenthesesDisjunction(state.term(), parenthesesState, alternativeFrameLocation);
+            // this expects that any backtracks back out of the parentheses will be in the
+            // parenthesesState's backTrackJumps vector, and that if they need backtracking
+            // they will have set an entry point on the parenthesesState's backtrackLabel.
+            state.propagateBacktrackingFrom(parenthesesState, this);
+        } else {
+            Jump nonGreedySkipParentheses;
+            Label nonGreedyTryParentheses;
+            if (term.quantityType == QuantifierGreedy)
+                storeToFrame(Imm32(1), parenthesesFrameLocation);
+            else if (term.quantityType == QuantifierNonGreedy) {
+                storeToFrame(Imm32(0), parenthesesFrameLocation);
+                nonGreedySkipParentheses = jump();
+                nonGreedyTryParentheses = label();
+                storeToFrame(Imm32(1), parenthesesFrameLocation);
+            }
+
+            // store the match start index
+            if (term.invertOrCapture) {
+                int inputOffset = state.inputOffset() - preCheckedCount;
+                if (inputOffset) {
+                    move(index, indexTemporary);
+                    add32(Imm32(inputOffset), indexTemporary);
+                    store32(indexTemporary, Address(output, (term.parentheses.subpatternId << 1) * sizeof(int)));
+                } else
+                    store32(index, Address(output, (term.parentheses.subpatternId << 1) * sizeof(int)));
+            }
+
+            // generate the body of the parentheses
+            TermGenerationState parenthesesState(disjunction, state.checkedTotal);
+            generateParenthesesDisjunction(state.term(), parenthesesState, alternativeFrameLocation);
+
+            // store the match end index
+            if (term.invertOrCapture) {
+                int inputOffset = state.inputOffset();
+                if (inputOffset) {
+                    move(index, indexTemporary);
+                    add32(Imm32(state.inputOffset()), indexTemporary);
+                    store32(indexTemporary, Address(output, ((term.parentheses.subpatternId << 1) + 1) * sizeof(int)));
+                } else
+                    store32(index, Address(output, ((term.parentheses.subpatternId << 1) + 1) * sizeof(int)));
+            }
+            Jump success = jump();
+
+            // A failure AFTER the parens jumps here
+            Label backtrackFromAfterParens(this);
+
+            if (term.quantityType == QuantifierGreedy) {
+                // If this is zero we have now tested with both with and without the parens.
+                loadFromFrame(parenthesesFrameLocation, indexTemporary);
+                state.jumpToBacktrack(branchTest32(Zero, indexTemporary), this);
+            } else if (term.quantityType == QuantifierNonGreedy) {
+                // If this is zero we have now tested with both with and without the parens.
+                loadFromFrame(parenthesesFrameLocation, indexTemporary);
+                branchTest32(Zero, indexTemporary).linkTo(nonGreedyTryParentheses, this);
+            }
+
+            parenthesesState.plantJumpToBacktrackIfExists(this);
+            // A failure WITHIN the parens jumps here
+            parenthesesState.linkAlternativeBacktracks(this);
+            if (term.invertOrCapture) {
+                store32(Imm32(-1), Address(output, (term.parentheses.subpatternId << 1) * sizeof(int)));
+                store32(Imm32(-1), Address(output, ((term.parentheses.subpatternId << 1) + 1) * sizeof(int)));
+            }
+
+            if (term.quantityType == QuantifierGreedy)
+                storeToFrame(Imm32(0), parenthesesFrameLocation);
+            else
+                state.jumpToBacktrack(jump(), this);
+
+            state.setBacktrackGenerated(backtrackFromAfterParens);
+            if (term.quantityType == QuantifierNonGreedy)
+                nonGreedySkipParentheses.link(this);
+            success.link(this);
+        }
+    }
+
+    void generateParentheticalAssertion(TermGenerationState& state)
+    {
+        PatternTerm& term = state.term();
+        PatternDisjunction* disjunction = term.parentheses.disjunction;
+        ASSERT(term.quantityCount == 1);
+        ASSERT(term.quantityType == QuantifierFixedCount);
+
+        unsigned parenthesesFrameLocation = term.frameLocation;
+        unsigned alternativeFrameLocation = parenthesesFrameLocation + RegexStackSpaceForBackTrackInfoParentheticalAssertion;
+
+        int countCheckedAfterAssertion = state.checkedTotal - term.inputPosition;
+
+        if (term.invertOrCapture) {
+            // Inverted case
+            storeToFrame(index, parenthesesFrameLocation);
+
+            state.checkedTotal -= countCheckedAfterAssertion;
+            if (countCheckedAfterAssertion)
+                sub32(Imm32(countCheckedAfterAssertion), index);
+
+            TermGenerationState parenthesesState(disjunction, state.checkedTotal);
+            generateParenthesesDisjunction(state.term(), parenthesesState, alternativeFrameLocation);
+            // Success! - which means - Fail!
+            loadFromFrame(parenthesesFrameLocation, index);
+            state.jumpToBacktrack(jump(), this);
+
+            // And fail means success.
+            parenthesesState.linkAlternativeBacktracks(this);
+            loadFromFrame(parenthesesFrameLocation, index);
+
+            state.checkedTotal += countCheckedAfterAssertion;
+        } else {
+            // Normal case
+            storeToFrame(index, parenthesesFrameLocation);
+
+            state.checkedTotal -= countCheckedAfterAssertion;
+            if (countCheckedAfterAssertion)
+                sub32(Imm32(countCheckedAfterAssertion), index);
+
+            TermGenerationState parenthesesState(disjunction, state.checkedTotal);
+            generateParenthesesDisjunction(state.term(), parenthesesState, alternativeFrameLocation);
+            // Success! - which means - Success!
+            loadFromFrame(parenthesesFrameLocation, index);
+            Jump success = jump();
+
+            parenthesesState.linkAlternativeBacktracks(this);
+            loadFromFrame(parenthesesFrameLocation, index);
+            state.jumpToBacktrack(jump(), this);
+
+            success.link(this);
+
+            state.checkedTotal += countCheckedAfterAssertion;
+        }
+    }
+
+    void generateTerm(TermGenerationState& state)
+    {
+        PatternTerm& term = state.term();
+
+        switch (term.type) {
+        case PatternTerm::TypeAssertionBOL:
+            generateAssertionBOL(state);
+            break;
+        
+        case PatternTerm::TypeAssertionEOL:
+            generateAssertionEOL(state);
+            break;
+        
+        case PatternTerm::TypeAssertionWordBoundary:
+            generateAssertionWordBoundary(state);
+            break;
+        
+        case PatternTerm::TypePatternCharacter:
+            switch (term.quantityType) {
+            case QuantifierFixedCount:
+                if (term.quantityCount == 1) {
+                    if (state.isSinglePatternCharacterLookaheadTerm() && (state.lookaheadTerm().inputPosition == (term.inputPosition + 1))) {
+                        generatePatternCharacterPair(state);
+                        state.nextTerm();
+                    } else
+                        generatePatternCharacterSingle(state);
+                } else
+                    generatePatternCharacterFixed(state);
+                break;
+            case QuantifierGreedy:
+                generatePatternCharacterGreedy(state);
+                break;
+            case QuantifierNonGreedy:
+                generatePatternCharacterNonGreedy(state);
+                break;
+            }
+            break;
+
+        case PatternTerm::TypeCharacterClass:
+            switch (term.quantityType) {
+            case QuantifierFixedCount:
+                if (term.quantityCount == 1)
+                    generateCharacterClassSingle(state);
+                else
+                    generateCharacterClassFixed(state);
+                break;
+            case QuantifierGreedy:
+                generateCharacterClassGreedy(state);
+                break;
+            case QuantifierNonGreedy:
+                generateCharacterClassNonGreedy(state);
+                break;
+            }
+            break;
+
+        case PatternTerm::TypeBackReference:
+            m_generationFailed = true;
+            break;
+
+        case PatternTerm::TypeForwardReference:
+            break;
+
+        case PatternTerm::TypeParenthesesSubpattern:
+            if ((term.quantityCount == 1) && !term.parentheses.isCopy)
+                generateParenthesesSingle(state);
+            else
+                m_generationFailed = true;
+            break;
+
+        case PatternTerm::TypeParentheticalAssertion:
+            generateParentheticalAssertion(state);
+            break;
+        }
+    }
+
+    void generateDisjunction(PatternDisjunction* disjunction)
+    {
+        TermGenerationState state(disjunction, 0);
+        state.resetAlternative();
+
+        // Plant a check to see if there is sufficient input available to run the first alternative.
+        // Jumping back to the label 'firstAlternative' will get to this check, jumping to
+        // 'firstAlternativeInputChecked' will jump directly to matching the alternative having
+        // skipped this check.
+
+        Label firstAlternative(this);
+
+        // check availability for the next alternative
+        int countCheckedForCurrentAlternative = 0;
+        int countToCheckForFirstAlternative = 0;
+        bool hasShorterAlternatives = false;
+        JumpList notEnoughInputForPreviousAlternative;
+
+        if (state.alternativeValid()) {
+            PatternAlternative* alternative = state.alternative();
+            countToCheckForFirstAlternative = alternative->m_minimumSize;
+            state.checkedTotal += countToCheckForFirstAlternative;
+            if (countToCheckForFirstAlternative)
+                notEnoughInputForPreviousAlternative.append(jumpIfNoAvailableInput(countToCheckForFirstAlternative));
+            countCheckedForCurrentAlternative = countToCheckForFirstAlternative;
+        }
+
+        Label firstAlternativeInputChecked(this);
+
+        while (state.alternativeValid()) {
+            // Track whether any alternatives are shorter than the first one.
+            hasShorterAlternatives = hasShorterAlternatives || (countCheckedForCurrentAlternative < countToCheckForFirstAlternative);
+
+            PatternAlternative* alternative = state.alternative();
+            optimizeAlternative(alternative);
+
+            for (state.resetTerm(); state.termValid(); state.nextTerm())
+                generateTerm(state);
+
+            // If we get here, the alternative matched.
+            if (m_pattern.m_body->m_callFrameSize)
+                addPtr(Imm32(m_pattern.m_body->m_callFrameSize * sizeof(void*)), stackPointerRegister);
+            
+            ASSERT(index != returnRegister);
+            if (m_pattern.m_body->m_hasFixedSize) {
+                move(index, returnRegister);
+                if (alternative->m_minimumSize)
+                    sub32(Imm32(alternative->m_minimumSize), returnRegister);
+            } else
+                pop(returnRegister);
+            store32(index, Address(output, 4));
+            store32(returnRegister, output);
+
+            generateReturn();
+
+            state.nextAlternative();
+
+            // if there are any more alternatives, plant the check for input before looping.
+            if (state.alternativeValid()) {
+                PatternAlternative* nextAlternative = state.alternative();
+                int countToCheckForNextAlternative = nextAlternative->m_minimumSize;
+
+                if (countCheckedForCurrentAlternative > countToCheckForNextAlternative) { // CASE 1: current alternative was longer than the next one.
+                    // If we get here, there the last input checked failed.
+                    notEnoughInputForPreviousAlternative.link(this);
+
+                    // Check if sufficent input available to run the next alternative 
+                    notEnoughInputForPreviousAlternative.append(jumpIfNoAvailableInput(countToCheckForNextAlternative - countCheckedForCurrentAlternative));
+                    // We are now in the correct state to enter the next alternative; this add is only required
+                    // to mirror and revert operation of the sub32, just below.
+                    add32(Imm32(countCheckedForCurrentAlternative - countToCheckForNextAlternative), index);
+
+                    // If we get here, there the last input checked passed.
+                    state.linkAlternativeBacktracks(this);
+                    // No need to check if we can run the next alternative, since it is shorter -
+                    // just update index.
+                    sub32(Imm32(countCheckedForCurrentAlternative - countToCheckForNextAlternative), index);
+                } else if (countCheckedForCurrentAlternative < countToCheckForNextAlternative) { // CASE 2: next alternative is longer than the current one.
+                    // If we get here, there the last input checked failed.
+                    // If there is insufficient input to run the current alternative, and the next alternative is longer,
+                    // then there is definitely not enough input to run it - don't even check. Just adjust index, as if
+                    // we had checked.
+                    notEnoughInputForPreviousAlternative.link(this);
+                    add32(Imm32(countToCheckForNextAlternative - countCheckedForCurrentAlternative), index);
+                    notEnoughInputForPreviousAlternative.append(jump());
+
+                    // The next alternative is longer than the current one; check the difference.
+                    state.linkAlternativeBacktracks(this);
+                    notEnoughInputForPreviousAlternative.append(jumpIfNoAvailableInput(countToCheckForNextAlternative - countCheckedForCurrentAlternative));
+                } else { // CASE 3: Both alternatives are the same length.
+                    ASSERT(countCheckedForCurrentAlternative == countToCheckForNextAlternative);
+
+                    // If the next alterative is the same length as this one, then no need to check the input -
+                    // if there was sufficent input to run the current alternative then there is sufficient
+                    // input to run the next one; if not, there isn't.
+                    state.linkAlternativeBacktracks(this);
+                }
+
+                state.checkedTotal -= countCheckedForCurrentAlternative;
+                countCheckedForCurrentAlternative = countToCheckForNextAlternative;
+                state.checkedTotal += countCheckedForCurrentAlternative;
+            }
+        }
+        
+        // If we get here, all Alternatives failed...
+
+        state.checkedTotal -= countCheckedForCurrentAlternative;
+
+        // How much more input need there be to be able to retry from the first alternative?
+        // examples:
+        //   /yarr_jit/ or /wrec|pcre/
+        //     In these examples we need check for one more input before looping.
+        //   /yarr_jit|pcre/
+        //     In this case we need check for 5 more input to loop (+4 to allow for the first alterative
+        //     being four longer than the last alternative checked, and another +1 to effectively move
+        //     the start position along by one).
+        //   /yarr|rules/ or /wrec|notsomuch/
+        //     In these examples, provided that there was sufficient input to have just been matching for
+        //     the second alternative we can loop without checking for available input (since the second
+        //     alternative is longer than the first).  In the latter example we need to decrement index
+        //     (by 4) so the start position is only progressed by 1 from the last iteration.
+        int incrementForNextIter = (countToCheckForFirstAlternative - countCheckedForCurrentAlternative) + 1;
+
+        // First, deal with the cases where there was sufficient input to try the last alternative.
+        if (incrementForNextIter > 0) // We need to check for more input anyway, fall through to the checking below.
+            state.linkAlternativeBacktracks(this);
+        else if (m_pattern.m_body->m_hasFixedSize && !incrementForNextIter) // No need to update anything, link these backtracks straight to the to pof the loop!
+            state.linkAlternativeBacktracksTo(firstAlternativeInputChecked, this);
+        else { // no need to check the input, but we do have some bookkeeping to do first.
+            state.linkAlternativeBacktracks(this);
+
+            // Where necessary update our preserved start position.
+            if (!m_pattern.m_body->m_hasFixedSize) {
+                move(index, regT0);
+                sub32(Imm32(countCheckedForCurrentAlternative - 1), regT0);
+                poke(regT0, m_pattern.m_body->m_callFrameSize);
+            }
+
+            // Update index if necessary, and loop (without checking).
+            if (incrementForNextIter)
+                add32(Imm32(incrementForNextIter), index);
+            jump().linkTo(firstAlternativeInputChecked, this);
+        }
+
+        notEnoughInputForPreviousAlternative.link(this);
+        // Update our idea of the start position, if we're tracking this.
+        if (!m_pattern.m_body->m_hasFixedSize) {
+            if (countCheckedForCurrentAlternative - 1) {
+                move(index, regT0);
+                sub32(Imm32(countCheckedForCurrentAlternative - 1), regT0);
+                poke(regT0, m_pattern.m_body->m_callFrameSize);
+            } else
+                poke(index, m_pattern.m_body->m_callFrameSize);
+        }
+        // Check if there is sufficent input to run the first alternative again.
+        jumpIfAvailableInput(incrementForNextIter).linkTo(firstAlternativeInputChecked, this);
+        // No - insufficent input to run the first alteranative, are there any other alternatives we
+        // might need to check?  If so, the last check will have left the index incremented by
+        // (countToCheckForFirstAlternative + 1), so we need test whether countToCheckForFirstAlternative
+        // LESS input is available, to have the effect of just progressing the start position by 1
+        // from the last iteration.  If this check passes we can just jump up to the check associated
+        // with the first alternative in the loop.  This is a bit sad, since we'll end up trying the
+        // first alternative again, and this check will fail (otherwise the check planted just above
+        // here would have passed).  This is a bit sad, however it saves trying to do something more
+        // complex here in compilation, and in the common case we should end up coallescing the checks.
+        //
+        // FIXME: a nice improvement here may be to stop trying to match sooner, based on the least
+        // of the minimum-alterantive-lengths.  E.g. if I have two alternatives of length 200 and 150,
+        // and a string of length 100, we'll end up looping index from 0 to 100, checking whether there
+        // is sufficient input to run either alternative (constantly failing).  If there had been only
+        // one alternative, or if the shorter alternative had come first, we would have terminated
+        // immediately. :-/
+        if (hasShorterAlternatives)
+            jumpIfAvailableInput(-countToCheckForFirstAlternative).linkTo(firstAlternative, this);
+        // index will now be a bit garbled (depending on whether 'hasShorterAlternatives' is true,
+        // it has either been incremented by 1 or by (countToCheckForFirstAlternative + 1) ... 
+        // but since we're about to return a failure this doesn't really matter!)
+
+        unsigned frameSize = m_pattern.m_body->m_callFrameSize;
+        if (!m_pattern.m_body->m_hasFixedSize)
+            ++frameSize;
+        if (frameSize)
+            addPtr(Imm32(frameSize * sizeof(void*)), stackPointerRegister);
+
+        move(Imm32(-1), returnRegister);
+
+        generateReturn();
+    }
+
+    void generateEnter()
+    {
+#if PLATFORM(X86_64)
+        push(X86::ebp);
+        move(stackPointerRegister, X86::ebp);
+#elif PLATFORM(X86)
+        push(X86::ebp);
+        move(stackPointerRegister, X86::ebp);
+        // TODO: do we need spill registers to fill the output pointer if there are no sub captures?
+        push(X86::ebx);
+        push(X86::edi);
+        push(X86::esi);
+        // load output into edi (2 = saved ebp + return address).
+    #if COMPILER(MSVC)
+        loadPtr(Address(X86::ebp, 2 * sizeof(void*)), input);
+        loadPtr(Address(X86::ebp, 3 * sizeof(void*)), index);
+        loadPtr(Address(X86::ebp, 4 * sizeof(void*)), length);
+        loadPtr(Address(X86::ebp, 5 * sizeof(void*)), output);
+    #else
+        loadPtr(Address(X86::ebp, 2 * sizeof(void*)), output);
+    #endif
+#elif PLATFORM_ARM_ARCH(7)
+        push(ARM::r4);
+        push(ARM::r5);
+        push(ARM::r6);
+        move(ARM::r3, output);
+#endif
+    }
+
+    void generateReturn()
+    {
+#if PLATFORM(X86_64)
+        pop(X86::ebp);
+#elif PLATFORM(X86)
+        pop(X86::esi);
+        pop(X86::edi);
+        pop(X86::ebx);
+        pop(X86::ebp);
+#elif PLATFORM_ARM_ARCH(7)
+        pop(ARM::r6);
+        pop(ARM::r5);
+        pop(ARM::r4);
+#endif
+        ret();
+    }
+
+public:
+    RegexGenerator(RegexPattern& pattern)
+        : m_pattern(pattern)
+        , m_generationFailed(false)
+    {
+    }
+
+    void generate()
+    {
+        generateEnter();
+
+        // TODO: do I really want this on the stack?
+        if (!m_pattern.m_body->m_hasFixedSize)
+            push(index);
+
+        if (m_pattern.m_body->m_callFrameSize)
+            subPtr(Imm32(m_pattern.m_body->m_callFrameSize * sizeof(void*)), stackPointerRegister);
+
+        generateDisjunction(m_pattern.m_body);
+    }
+
+    void compile(JSGlobalData* globalData, RegexCodeBlock& jitObject)
+    {
+        generate();
+
+        LinkBuffer patchBuffer(this, globalData->executableAllocator.poolForSize(size()));
+
+        for (unsigned i = 0; i < m_backtrackRecords.size(); ++i)
+            patchBuffer.patch(m_backtrackRecords[i].dataLabel, patchBuffer.locationOf(m_backtrackRecords[i].backtrackLocation));
+
+        jitObject.set(patchBuffer.finalizeCode());
+    }
+
+    bool generationFailed()
+    {
+        return m_generationFailed;
+    }
+
+private:
+    RegexPattern& m_pattern;
+    Vector<AlternativeBacktrackRecord> m_backtrackRecords;
+    bool m_generationFailed;
+};
+
+void jitCompileRegex(JSGlobalData* globalData, RegexCodeBlock& jitObject, const UString& patternString, unsigned& numSubpatterns, const char*& error, bool ignoreCase, bool multiline)
+{
+    RegexPattern pattern(ignoreCase, multiline);
+
+    if ((error = compileRegex(patternString, pattern)))
+        return;
+
+    numSubpatterns = pattern.m_numSubpatterns;
+
+    RegexGenerator generator(pattern);
+    generator.compile(globalData, jitObject);
+
+    if (generator.generationFailed()) {
+        JSRegExpIgnoreCaseOption ignoreCaseOption = ignoreCase ? JSRegExpIgnoreCase : JSRegExpDoNotIgnoreCase;
+        JSRegExpMultilineOption multilineOption = multiline ? JSRegExpMultiline : JSRegExpSingleLine;
+        jitObject.setFallback(jsRegExpCompile(reinterpret_cast<const UChar*>(patternString.data()), patternString.size(), ignoreCaseOption, multilineOption, &numSubpatterns, &error));
+    }
+}
+
+int executeRegex(RegexCodeBlock& jitObject, const UChar* input, unsigned start, unsigned length, int* output, int outputArraySize)
+{
+    if (JSRegExp* fallback = jitObject.getFallback())
+        return (jsRegExpExecute(fallback, input, length, start, output, outputArraySize) < 0) ? -1 : output[0];
+
+    return jitObject.execute(input, start, length, output);
+}
+
+}}
+
+#endif
+
+
+
+
+
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h
new file mode 100644
index 0000000..5b0df9d
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexJIT.h
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef RegexJIT_h
+#define RegexJIT_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(YARR_JIT)
+
+#include "MacroAssembler.h"
+#include "RegexPattern.h"
+#include <UString.h>
+
+#include <pcre.h>
+struct JSRegExp; // temporary, remove when fallback is removed.
+
+#if PLATFORM(X86) && !COMPILER(MSVC)
+#define YARR_CALL __attribute__ ((regparm (3)))
+#else
+#define YARR_CALL
+#endif
+
+namespace JSC {
+
+class JSGlobalData;
+class ExecutablePool;
+
+namespace Yarr {
+
+class RegexCodeBlock {
+    typedef int (*RegexJITCode)(const UChar* input, unsigned start, unsigned length, int* output) YARR_CALL;
+
+public:
+    RegexCodeBlock()
+        : m_fallback(0)
+    {
+    }
+
+    ~RegexCodeBlock()
+    {
+        if (m_fallback)
+            jsRegExpFree(m_fallback);
+    }
+
+    JSRegExp* getFallback() { return m_fallback; }
+    void setFallback(JSRegExp* fallback) { m_fallback = fallback; }
+
+    bool operator!() { return !m_ref.m_code.executableAddress(); }
+    void set(MacroAssembler::CodeRef ref) { m_ref = ref; }
+
+    int execute(const UChar* input, unsigned start, unsigned length, int* output)
+    {
+        return reinterpret_cast<RegexJITCode>(m_ref.m_code.executableAddress())(input, start, length, output);
+    }
+
+private:
+    MacroAssembler::CodeRef m_ref;
+    JSRegExp* m_fallback;
+};
+
+void jitCompileRegex(JSGlobalData* globalData, RegexCodeBlock& jitObject, const UString& pattern, unsigned& numSubpatterns, const char*& error, bool ignoreCase = false, bool multiline = false);
+int executeRegex(RegexCodeBlock& jitObject, const UChar* input, unsigned start, unsigned length, int* output, int outputArraySize);
+
+} } // namespace JSC::Yarr
+
+#endif
+
+#endif // RegexJIT_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexParser.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexParser.h
new file mode 100644
index 0000000..64e8463
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexParser.h
@@ -0,0 +1,854 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef RegexParser_h
+#define RegexParser_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(YARR)
+
+#include <UString.h>
+#include <wtf/ASCIICType.h>
+#include <wtf/unicode/Unicode.h>
+#include <limits.h>
+
+namespace JSC { namespace Yarr {
+
+enum BuiltInCharacterClassID {
+    DigitClassID,
+    SpaceClassID,
+    WordClassID,
+    NewlineClassID,
+};
+
+// The Parser class should not be used directly - only via the Yarr::parse() method.
+template<class Delegate>
+class Parser {
+private:
+    template<class FriendDelegate>
+    friend const char* parse(FriendDelegate& delegate, const UString& pattern, unsigned backReferenceLimit);
+
+    enum ErrorCode {
+        NoError,
+        PatternTooLarge,
+        QuantifierOutOfOrder,
+        QuantifierWithoutAtom,
+        MissingParentheses,
+        ParenthesesUnmatched,
+        ParenthesesTypeInvalid,
+        CharacterClassUnmatched,
+        CharacterClassOutOfOrder,
+        EscapeUnterminated,
+        NumberOfErrorCodes
+    };
+
+    /*
+     * CharacterClassParserDelegate:
+     *
+     * The class CharacterClassParserDelegate is used in the parsing of character
+     * classes.  This class handles detection of character ranges.  This class
+     * implements enough of the delegate interface such that it can be passed to
+     * parseEscape() as an EscapeDelegate.  This allows parseEscape() to be reused
+     * to perform the parsing of escape characters in character sets.
+     */
+    class CharacterClassParserDelegate {
+    public:
+        CharacterClassParserDelegate(Delegate& delegate, ErrorCode& err)
+            : m_delegate(delegate)
+            , m_err(err)
+            , m_state(empty)
+        {
+        }
+
+        /*
+         * begin():
+         *
+         * Called at beginning of construction.
+         */
+        void begin(bool invert)
+        {
+            m_delegate.atomCharacterClassBegin(invert);
+        }
+
+        /*
+         * atomPatternCharacterUnescaped():
+         *
+         * This method is called directly from parseCharacterClass(), to report a new
+         * pattern character token.  This method differs from atomPatternCharacter(),
+         * which will be called from parseEscape(), since a hypen provided via this
+         * method may be indicating a character range, but a hyphen parsed by
+         * parseEscape() cannot be interpreted as doing so.
+         */
+        void atomPatternCharacterUnescaped(UChar ch)
+        {
+            switch (m_state) {
+            case empty:
+                m_character = ch;
+                m_state = cachedCharacter;
+                break;
+
+            case cachedCharacter:
+                if (ch == '-')
+                    m_state = cachedCharacterHyphen;
+                else {
+                    m_delegate.atomCharacterClassAtom(m_character);
+                    m_character = ch;
+                }
+                break;
+
+            case cachedCharacterHyphen:
+                if (ch >= m_character)
+                    m_delegate.atomCharacterClassRange(m_character, ch);
+                else
+                    m_err = CharacterClassOutOfOrder;
+                m_state = empty;
+            }
+        }
+
+        /*
+         * atomPatternCharacter():
+         *
+         * Adds a pattern character, called by parseEscape(), as such will not
+         * interpret a hyphen as indicating a character range.
+         */
+        void atomPatternCharacter(UChar ch)
+        {
+            // Flush if a character is already pending to prevent the
+            // hyphen from begin interpreted as indicating a range.
+            if((ch == '-') && (m_state == cachedCharacter))
+                flush();
+
+            atomPatternCharacterUnescaped(ch);
+        }
+
+        /*
+         * atomBuiltInCharacterClass():
+         *
+         * Adds a built-in character class, called by parseEscape().
+         */
+        void atomBuiltInCharacterClass(BuiltInCharacterClassID classID, bool invert)
+        {
+            flush();
+            m_delegate.atomCharacterClassBuiltIn(classID, invert);
+        }
+
+        /*
+         * end():
+         *
+         * Called at end of construction.
+         */
+        void end()
+        {
+            flush();
+            m_delegate.atomCharacterClassEnd();
+        }
+
+        // parseEscape() should never call these delegate methods when
+        // invoked with inCharacterClass set.
+        void assertionWordBoundary(bool) { ASSERT_NOT_REACHED(); }
+        void atomBackReference(unsigned) { ASSERT_NOT_REACHED(); }
+
+    private:
+        void flush()
+        {
+            if (m_state != empty) // either cachedCharacter or cachedCharacterHyphen
+                m_delegate.atomCharacterClassAtom(m_character);
+            if (m_state == cachedCharacterHyphen)
+                m_delegate.atomCharacterClassAtom('-');
+            m_state = empty;
+        }
+    
+        Delegate& m_delegate;
+        ErrorCode& m_err;
+        enum CharacterClassConstructionState {
+            empty,
+            cachedCharacter,
+            cachedCharacterHyphen,
+        } m_state;
+        UChar m_character;
+    };
+
+    Parser(Delegate& delegate, const UString& pattern, unsigned backReferenceLimit)
+        : m_delegate(delegate)
+        , m_backReferenceLimit(backReferenceLimit)
+        , m_err(NoError)
+        , m_data(pattern.data())
+        , m_size(pattern.size())
+        , m_index(0)
+        , m_parenthesesNestingDepth(0)
+    {
+    }
+    
+    /*
+     * parseEscape():
+     *
+     * Helper for parseTokens() AND parseCharacterClass().
+     * Unlike the other parser methods, this function does not report tokens
+     * directly to the member delegate (m_delegate), instead tokens are
+     * emitted to the delegate provided as an argument.  In the case of atom
+     * escapes, parseTokens() will call parseEscape() passing m_delegate as
+     * an argument, and as such the escape will be reported to the delegate.
+     *
+     * However this method may also be used by parseCharacterClass(), in which
+     * case a CharacterClassParserDelegate will be passed as the delegate that
+     * tokens should be added to.  A boolean flag is also provided to indicate
+     * whether that an escape in a CharacterClass is being parsed (some parsing
+     * rules change in this context).
+     *
+     * The boolean value returned by this method indicates whether the token
+     * parsed was an atom (outside of a characted class \b and \B will be
+     * interpreted as assertions).
+     */
+    template<bool inCharacterClass, class EscapeDelegate>
+    bool parseEscape(EscapeDelegate& delegate)
+    {
+        ASSERT(!m_err);
+        ASSERT(peek() == '\\');
+        consume();
+
+        if (atEndOfPattern()) {
+            m_err = EscapeUnterminated;
+            return false;
+        }
+
+        switch (peek()) {
+        // Assertions
+        case 'b':
+            consume();
+            if (inCharacterClass)
+                delegate.atomPatternCharacter('\b');
+            else {
+                delegate.assertionWordBoundary(false);
+                return false;
+            }
+            break;
+        case 'B':
+            consume();
+            if (inCharacterClass)
+                delegate.atomPatternCharacter('B');
+            else {
+                delegate.assertionWordBoundary(true);
+                return false;
+            }
+            break;
+
+        // CharacterClassEscape
+        case 'd':
+            consume();
+            delegate.atomBuiltInCharacterClass(DigitClassID, false);
+            break;
+        case 's':
+            consume();
+            delegate.atomBuiltInCharacterClass(SpaceClassID, false);
+            break;
+        case 'w':
+            consume();
+            delegate.atomBuiltInCharacterClass(WordClassID, false);
+            break;
+        case 'D':
+            consume();
+            delegate.atomBuiltInCharacterClass(DigitClassID, true);
+            break;
+        case 'S':
+            consume();
+            delegate.atomBuiltInCharacterClass(SpaceClassID, true);
+            break;
+        case 'W':
+            consume();
+            delegate.atomBuiltInCharacterClass(WordClassID, true);
+            break;
+
+        // DecimalEscape
+        case '1':
+        case '2':
+        case '3':
+        case '4':
+        case '5':
+        case '6':
+        case '7':
+        case '8':
+        case '9': {
+            // To match Firefox, we parse an invalid backreference in the range [1-7] as an octal escape.
+            // First, try to parse this as backreference.
+            if (!inCharacterClass) {
+                ParseState state = saveState();
+
+                unsigned backReference = consumeNumber();
+                if (backReference <= m_backReferenceLimit) {
+                    delegate.atomBackReference(backReference);
+                    break;
+                }
+
+                restoreState(state);
+            }
+            
+            // Not a backreference, and not octal.
+            if (peek() >= '8') {
+                delegate.atomPatternCharacter('\\');
+                break;
+            }
+
+            // Fall-through to handle this as an octal escape.
+        }
+
+        // Octal escape
+        case '0':
+            delegate.atomPatternCharacter(consumeOctal());
+            break;
+
+        // ControlEscape
+        case 'f':
+            consume();
+            delegate.atomPatternCharacter('\f');
+            break;
+        case 'n':
+            consume();
+            delegate.atomPatternCharacter('\n');
+            break;
+        case 'r':
+            consume();
+            delegate.atomPatternCharacter('\r');
+            break;
+        case 't':
+            consume();
+            delegate.atomPatternCharacter('\t');
+            break;
+        case 'v':
+            consume();
+            delegate.atomPatternCharacter('\v');
+            break;
+
+        // ControlLetter
+        case 'c': {
+            ParseState state = saveState();
+            consume();
+            if (!atEndOfPattern()) {
+                int control = consume();
+
+                // To match Firefox, inside a character class, we also accept numbers and '_' as control characters.
+                if (inCharacterClass ? WTF::isASCIIAlphanumeric(control) || (control == '_') : WTF::isASCIIAlpha(control)) {
+                    delegate.atomPatternCharacter(control & 0x1f);
+                    break;
+                }
+            }
+            restoreState(state);
+            delegate.atomPatternCharacter('\\');
+            break;
+        }
+
+        // HexEscape
+        case 'x': {
+            consume();
+            int x = tryConsumeHex(2);
+            if (x == -1)
+                delegate.atomPatternCharacter('x');
+            else
+                delegate.atomPatternCharacter(x);
+            break;
+        }
+
+        // UnicodeEscape
+        case 'u': {
+            consume();
+            int u = tryConsumeHex(4);
+            if (u == -1)
+                delegate.atomPatternCharacter('u');
+            else
+                delegate.atomPatternCharacter(u);
+            break;
+        }
+
+        // IdentityEscape
+        default:
+            delegate.atomPatternCharacter(consume());
+        }
+        
+        return true;
+    }
+
+    /*
+     * parseAtomEscape(), parseCharacterClassEscape():
+     *
+     * These methods alias to parseEscape().
+     */
+    bool parseAtomEscape()
+    {
+        return parseEscape<false>(m_delegate);
+    }
+    void parseCharacterClassEscape(CharacterClassParserDelegate& delegate)
+    {
+        parseEscape<true>(delegate);
+    }
+
+    /*
+     * parseCharacterClass():
+     *
+     * Helper for parseTokens(); calls dirctly and indirectly (via parseCharacterClassEscape)
+     * to an instance of CharacterClassParserDelegate, to describe the character class to the
+     * delegate.
+     */
+    void parseCharacterClass()
+    {
+        ASSERT(!m_err);
+        ASSERT(peek() == '[');
+        consume();
+
+        CharacterClassParserDelegate characterClassConstructor(m_delegate, m_err);
+
+        characterClassConstructor.begin(tryConsume('^'));
+
+        while (!atEndOfPattern()) {
+            switch (peek()) {
+            case ']':
+                consume();
+                characterClassConstructor.end();
+                return;
+
+            case '\\':
+                parseCharacterClassEscape(characterClassConstructor);
+                break;
+
+            default:
+                characterClassConstructor.atomPatternCharacterUnescaped(consume());
+            }
+
+            if (m_err)
+                return;
+        }
+
+        m_err = CharacterClassUnmatched;
+    }
+
+    /*
+     * parseParenthesesBegin():
+     *
+     * Helper for parseTokens(); checks for parentheses types other than regular capturing subpatterns.
+     */
+    void parseParenthesesBegin()
+    {
+        ASSERT(!m_err);
+        ASSERT(peek() == '(');
+        consume();
+
+        if (tryConsume('?')) {
+            if (atEndOfPattern()) {
+                m_err = ParenthesesTypeInvalid;
+                return;
+            }
+
+            switch (consume()) {
+            case ':':
+                m_delegate.atomParenthesesSubpatternBegin(false);
+                break;
+            
+            case '=':
+                m_delegate.atomParentheticalAssertionBegin();
+                break;
+
+            case '!':
+                m_delegate.atomParentheticalAssertionBegin(true);
+                break;
+            
+            default:
+                m_err = ParenthesesTypeInvalid;
+            }
+        } else
+            m_delegate.atomParenthesesSubpatternBegin();
+
+        ++m_parenthesesNestingDepth;
+    }
+
+    /*
+     * parseParenthesesEnd():
+     *
+     * Helper for parseTokens(); checks for parse errors (due to unmatched parentheses).
+     */
+    void parseParenthesesEnd()
+    {
+        ASSERT(!m_err);
+        ASSERT(peek() == ')');
+        consume();
+
+        if (m_parenthesesNestingDepth > 0)
+            m_delegate.atomParenthesesEnd();
+        else
+            m_err = ParenthesesUnmatched;
+
+        --m_parenthesesNestingDepth;
+    }
+
+    /*
+     * parseQuantifier():
+     *
+     * Helper for parseTokens(); checks for parse errors and non-greedy quantifiers.
+     */
+    void parseQuantifier(bool lastTokenWasAnAtom, unsigned min, unsigned max)
+    {
+        ASSERT(!m_err);
+        ASSERT(min <= max);
+
+        if (lastTokenWasAnAtom)
+            m_delegate.quantifyAtom(min, max, !tryConsume('?'));
+        else
+            m_err = QuantifierWithoutAtom;
+    }
+
+    /*
+     * parseTokens():
+     *
+     * This method loops over the input pattern reporting tokens to the delegate.
+     * The method returns when a parse error is detected, or the end of the pattern
+     * is reached.  One piece of state is tracked around the loop, which is whether
+     * the last token passed to the delegate was an atom (this is necessary to detect
+     * a parse error when a quantifier provided without an atom to quantify).
+     */
+    void parseTokens()
+    {
+        bool lastTokenWasAnAtom = false;
+
+        while (!atEndOfPattern()) {
+            switch (peek()) {
+            case '|':
+                consume();
+                m_delegate.disjunction();
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '(':
+                parseParenthesesBegin();
+                lastTokenWasAnAtom = false;
+                break;
+
+            case ')':
+                parseParenthesesEnd();
+                lastTokenWasAnAtom = true;
+                break;
+
+            case '^':
+                consume();
+                m_delegate.assertionBOL();
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '$':
+                consume();
+                m_delegate.assertionEOL();
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '.':
+                consume();
+                m_delegate.atomBuiltInCharacterClass(NewlineClassID, true);
+                lastTokenWasAnAtom = true;
+                break;
+
+            case '[':
+                parseCharacterClass();
+                lastTokenWasAnAtom = true;
+                break;
+
+            case '\\':
+                lastTokenWasAnAtom = parseAtomEscape();
+                break;
+
+            case '*':
+                consume();
+                parseQuantifier(lastTokenWasAnAtom, 0, UINT_MAX);
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '+':
+                consume();
+                parseQuantifier(lastTokenWasAnAtom, 1, UINT_MAX);
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '?':
+                consume();
+                parseQuantifier(lastTokenWasAnAtom, 0, 1);
+                lastTokenWasAnAtom = false;
+                break;
+
+            case '{': {
+                ParseState state = saveState();
+
+                consume();
+                if (peekIsDigit()) {
+                    unsigned min = consumeNumber();
+                    unsigned max = min;
+                    
+                    if (tryConsume(','))
+                        max = peekIsDigit() ? consumeNumber() : UINT_MAX;
+
+                    if (tryConsume('}')) {
+                        if (min <= max)
+                            parseQuantifier(lastTokenWasAnAtom, min, max);
+                        else
+                            m_err = QuantifierOutOfOrder;
+                        lastTokenWasAnAtom = false;
+                        break;
+                    }
+                }
+
+                restoreState(state);
+            } // if we did not find a complete quantifer, fall through to the default case.
+
+            default:
+                m_delegate.atomPatternCharacter(consume());
+                lastTokenWasAnAtom = true;
+            }
+
+            if (m_err)
+                return;
+        }
+
+        if (m_parenthesesNestingDepth > 0)
+            m_err = MissingParentheses;
+    }
+
+    /*
+     * parse():
+     *
+     * This method calls regexBegin(), calls parseTokens() to parse over the input
+     * patterns, calls regexEnd() or regexError() as appropriate, and converts any
+     * error code to a const char* for a result.
+     */
+    const char* parse()
+    {
+        m_delegate.regexBegin();
+
+        if (m_size > MAX_PATTERN_SIZE)
+            m_err = PatternTooLarge;
+        else
+            parseTokens();
+        ASSERT(atEndOfPattern() || m_err);
+
+        if (m_err)
+            m_delegate.regexError();
+        else
+            m_delegate.regexEnd();
+
+        // The order of this array must match the ErrorCode enum.
+        static const char* errorMessages[NumberOfErrorCodes] = {
+            0, // NoError
+            "regular expression too large",
+            "numbers out of order in {} quantifier",
+            "nothing to repeat",
+            "missing )",
+            "unmatched parentheses",
+            "unrecognized character after (?",
+            "missing terminating ] for character class",
+            "range out of order in character class",
+            "\\ at end of pattern"
+        };
+
+        return errorMessages[m_err];
+    }
+
+
+    // Misc helper functions:
+
+    typedef unsigned ParseState;
+    
+    ParseState saveState()
+    {
+        return m_index;
+    }
+
+    void restoreState(ParseState state)
+    {
+        m_index = state;
+    }
+
+    bool atEndOfPattern()
+    {
+        ASSERT(m_index <= m_size);
+        return m_index == m_size;
+    }
+
+    int peek()
+    {
+        ASSERT(m_index < m_size);
+        return m_data[m_index];
+    }
+
+    bool peekIsDigit()
+    {
+        return !atEndOfPattern() && WTF::isASCIIDigit(peek());
+    }
+
+    unsigned peekDigit()
+    {
+        ASSERT(peekIsDigit());
+        return peek() - '0';
+    }
+
+    int consume()
+    {
+        ASSERT(m_index < m_size);
+        return m_data[m_index++];
+    }
+
+    unsigned consumeDigit()
+    {
+        ASSERT(peekIsDigit());
+        return consume() - '0';
+    }
+
+    unsigned consumeNumber()
+    {
+        unsigned n = consumeDigit();
+        // check for overflow.
+        for (unsigned newValue; peekIsDigit() && ((newValue = n * 10 + peekDigit()) >= n); ) {
+            n = newValue;
+            consume();
+        }
+        return n;
+    }
+
+    unsigned consumeOctal()
+    {
+        ASSERT(WTF::isASCIIOctalDigit(peek()));
+
+        unsigned n = consumeDigit();
+        while (n < 32 && !atEndOfPattern() && WTF::isASCIIOctalDigit(peek()))
+            n = n * 8 + consumeDigit();
+        return n;
+    }
+
+    bool tryConsume(UChar ch)
+    {
+        if (atEndOfPattern() || (m_data[m_index] != ch))
+            return false;
+        ++m_index;
+        return true;
+    }
+
+    int tryConsumeHex(int count)
+    {
+        ParseState state = saveState();
+
+        int n = 0;
+        while (count--) {
+            if (atEndOfPattern() || !WTF::isASCIIHexDigit(peek())) {
+                restoreState(state);
+                return -1;
+            }
+            n = (n << 4) | WTF::toASCIIHexValue(consume());
+        }
+        return n;
+    }
+
+    Delegate& m_delegate;
+    unsigned m_backReferenceLimit;
+    ErrorCode m_err;
+    const UChar* m_data;
+    unsigned m_size;
+    unsigned m_index;
+    unsigned m_parenthesesNestingDepth;
+
+    // Derived by empirical testing of compile time in PCRE and WREC.
+    static const unsigned MAX_PATTERN_SIZE = 1024 * 1024;
+};
+
+/*
+ * Yarr::parse():
+ *
+ * The parse method is passed a pattern to be parsed and a delegate upon which
+ * callbacks will be made to record the parsed tokens forming the regex.
+ * Yarr::parse() returns null on success, or a const C string providing an error
+ * message where a parse error occurs.
+ *
+ * The Delegate must implement the following interface:
+ *
+ *    void assertionBOL();
+ *    void assertionEOL();
+ *    void assertionWordBoundary(bool invert);
+ *
+ *    void atomPatternCharacter(UChar ch);
+ *    void atomBuiltInCharacterClass(BuiltInCharacterClassID classID, bool invert);
+ *    void atomCharacterClassBegin(bool invert)
+ *    void atomCharacterClassAtom(UChar ch)
+ *    void atomCharacterClassRange(UChar begin, UChar end)
+ *    void atomCharacterClassBuiltIn(BuiltInCharacterClassID classID, bool invert)
+ *    void atomCharacterClassEnd()
+ *    void atomParenthesesSubpatternBegin(bool capture = true);
+ *    void atomParentheticalAssertionBegin(bool invert = false);
+ *    void atomParenthesesEnd();
+ *    void atomBackReference(unsigned subpatternId);
+ *
+ *    void quantifyAtom(unsigned min, unsigned max, bool greedy);
+ *
+ *    void disjunction();
+ *
+ *    void regexBegin();
+ *    void regexEnd();
+ *    void regexError();
+ *
+ * Before any call recording tokens are made, regexBegin() will be called on the
+ * delegate once.  Once parsing is complete either regexEnd() or regexError() will
+ * be called, as appropriate.
+ *
+ * The regular expression is described by a sequence of assertion*() and atom*()
+ * callbacks to the delegate, describing the terms in the regular expression.
+ * Following an atom a quantifyAtom() call may occur to indicate that the previous
+ * atom should be quantified.  In the case of atoms described across multiple
+ * calls (parentheses and character classes) the call to quantifyAtom() will come
+ * after the call to the atom*End() method, never after atom*Begin().
+ *
+ * Character classes may either be described by a single call to
+ * atomBuiltInCharacterClass(), or by a sequence of atomCharacterClass*() calls.
+ * In the latter case, ...Begin() will be called, followed by a sequence of
+ * calls to ...Atom(), ...Range(), and ...BuiltIn(), followed by a call to ...End().
+ *
+ * Sequences of atoms and assertions are broken into alternatives via calls to
+ * disjunction().  Assertions, atoms, and disjunctions emitted between calls to
+ * atomParenthesesBegin() and atomParenthesesEnd() form the body of a subpattern.
+ * atomParenthesesBegin() is passed a subpatternId.  In the case of a regular
+ * capturing subpattern, this will be the subpatternId associated with these
+ * parentheses, and will also by definition be the lowest subpatternId of these
+ * parentheses and of any nested paretheses.  The atomParenthesesEnd() method
+ * is passed the subpatternId of the last capturing subexpression nested within
+ * these paretheses.  In the case of a capturing subpattern with no nested
+ * capturing subpatterns, the same subpatternId will be passed to the begin and
+ * end functions.  In the case of non-capturing subpatterns the subpatternId
+ * passed to the begin method is also the first possible subpatternId that might
+ * be nested within these paretheses.  If a set of non-capturing parentheses does
+ * not contain any capturing subpatterns, then the subpatternId passed to begin
+ * will be greater than the subpatternId passed to end.
+ */
+
+template<class Delegate>
+const char* parse(Delegate& delegate, const UString& pattern, unsigned backReferenceLimit = UINT_MAX)
+{
+    return Parser<Delegate>(delegate, pattern, backReferenceLimit).parse();
+}
+
+} } // namespace JSC::Yarr
+
+#endif
+
+#endif // RegexParser_h
diff --git a/src/3rdparty/webkit/JavaScriptCore/yarr/RegexPattern.h b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexPattern.h
new file mode 100644
index 0000000..fb1b0ab
--- /dev/null
+++ b/src/3rdparty/webkit/JavaScriptCore/yarr/RegexPattern.h
@@ -0,0 +1,356 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef RegexPattern_h
+#define RegexPattern_h
+
+#include <wtf/Platform.h>
+
+#if ENABLE(YARR)
+
+#include <wtf/Vector.h>
+#include <wtf/unicode/Unicode.h>
+
+
+namespace JSC { namespace Yarr {
+
+#define RegexStackSpaceForBackTrackInfoPatternCharacter 1 // Only for !fixed quantifiers.
+#define RegexStackSpaceForBackTrackInfoCharacterClass 1 // Only for !fixed quantifiers.
+#define RegexStackSpaceForBackTrackInfoBackReference 2
+#define RegexStackSpaceForBackTrackInfoAlternative 1 // One per alternative.
+#define RegexStackSpaceForBackTrackInfoParentheticalAssertion 1
+#define RegexStackSpaceForBackTrackInfoParenthesesOnce 1 // Only for !fixed quantifiers.
+#define RegexStackSpaceForBackTrackInfoParentheses 4
+
+struct PatternDisjunction;
+
+struct CharacterRange {
+    UChar begin;
+    UChar end;
+
+    CharacterRange(UChar begin, UChar end)
+        : begin(begin)
+        , end(end)
+    {
+    }
+};
+
+struct CharacterClass {
+    Vector<UChar> m_matches;
+    Vector<CharacterRange> m_ranges;
+    Vector<UChar> m_matchesUnicode;
+    Vector<CharacterRange> m_rangesUnicode;
+};
+
+enum QuantifierType {
+    QuantifierFixedCount,
+    QuantifierGreedy,
+    QuantifierNonGreedy,
+};
+
+struct PatternTerm {
+    enum Type {
+        TypeAssertionBOL,
+        TypeAssertionEOL,
+        TypeAssertionWordBoundary,
+        TypePatternCharacter,
+        TypeCharacterClass,
+        TypeBackReference,
+        TypeForwardReference,
+        TypeParenthesesSubpattern,
+        TypeParentheticalAssertion,
+    } type;
+    bool invertOrCapture;
+    union {
+        UChar patternCharacter;
+        CharacterClass* characterClass;
+        unsigned subpatternId;
+        struct {
+            PatternDisjunction* disjunction;
+            unsigned subpatternId;
+            unsigned lastSubpatternId;
+            bool isCopy;
+        } parentheses;
+    };
+    QuantifierType quantityType;
+    unsigned quantityCount;
+    int inputPosition;
+    unsigned frameLocation;
+
+    PatternTerm(UChar ch)
+        : type(PatternTerm::TypePatternCharacter)
+    {
+        patternCharacter = ch;
+        quantityType = QuantifierFixedCount;
+        quantityCount = 1;
+    }
+
+    PatternTerm(CharacterClass* charClass, bool invert)
+        : type(PatternTerm::TypeCharacterClass)
+        , invertOrCapture(invert)
+    {
+        characterClass = charClass;
+        quantityType = QuantifierFixedCount;
+        quantityCount = 1;
+    }
+
+    PatternTerm(Type type, unsigned subpatternId, PatternDisjunction* disjunction, bool invertOrCapture)
+        : type(type)
+        , invertOrCapture(invertOrCapture)
+    {
+        parentheses.disjunction = disjunction;
+        parentheses.subpatternId = subpatternId;
+        parentheses.isCopy = false;
+        quantityType = QuantifierFixedCount;
+        quantityCount = 1;
+    }
+    
+    PatternTerm(Type type, bool invert = false)
+        : type(type)
+        , invertOrCapture(invert)
+    {
+        quantityType = QuantifierFixedCount;
+        quantityCount = 1;
+    }
+
+    PatternTerm(unsigned spatternId)
+        : type(TypeBackReference)
+        , invertOrCapture(invertOrCapture)
+    {
+        subpatternId = spatternId;
+        quantityType = QuantifierFixedCount;
+        quantityCount = 1;
+    }
+
+    static PatternTerm ForwardReference()
+    {
+        return PatternTerm(TypeForwardReference);
+    }
+
+    static PatternTerm BOL()
+    {
+        return PatternTerm(TypeAssertionBOL);
+    }
+
+    static PatternTerm EOL()
+    {
+        return PatternTerm(TypeAssertionEOL);
+    }
+
+    static PatternTerm WordBoundary(bool invert)
+    {
+        return PatternTerm(TypeAssertionWordBoundary, invert);
+    }
+    
+    bool invert()
+    {
+        return invertOrCapture;
+    }
+
+    bool capture()
+    {
+        return invertOrCapture;
+    }
+    
+    void quantify(unsigned count, QuantifierType type)
+    {
+        quantityCount = count;
+        quantityType = type;
+    }
+};
+
+struct PatternAlternative {
+    PatternAlternative(PatternDisjunction* disjunction)
+        : m_parent(disjunction)
+    {
+    }
+
+    PatternTerm& lastTerm()
+    {
+        ASSERT(m_terms.size());
+        return m_terms[m_terms.size() - 1];
+    }
+    
+    void removeLastTerm()
+    {
+        ASSERT(m_terms.size());
+        m_terms.shrink(m_terms.size() - 1);
+    }
+
+    Vector<PatternTerm> m_terms;
+    PatternDisjunction* m_parent;
+    unsigned m_minimumSize;
+    bool m_hasFixedSize;
+};
+
+struct PatternDisjunction {
+    PatternDisjunction(PatternAlternative* parent = 0)
+        : m_parent(parent)
+    {
+    }
+    
+    ~PatternDisjunction()
+    {
+        deleteAllValues(m_alternatives);
+    }
+
+    PatternAlternative* addNewAlternative()
+    {
+        PatternAlternative* alternative = new PatternAlternative(this);
+        m_alternatives.append(alternative);
+        return alternative;
+    }
+
+    Vector<PatternAlternative*> m_alternatives;
+    PatternAlternative* m_parent;
+    unsigned m_minimumSize;
+    unsigned m_callFrameSize;
+    bool m_hasFixedSize;
+};
+
+// You probably don't want to be calling these functions directly
+// (please to be calling newlineCharacterClass() et al on your
+// friendly neighborhood RegexPattern instance to get nicely
+// cached copies).
+CharacterClass* newlineCreate();
+CharacterClass* digitsCreate();
+CharacterClass* spacesCreate();
+CharacterClass* wordcharCreate();
+CharacterClass* nondigitsCreate();
+CharacterClass* nonspacesCreate();
+CharacterClass* nonwordcharCreate();
+
+struct RegexPattern {
+    RegexPattern(bool ignoreCase, bool multiline)
+        : m_ignoreCase(ignoreCase)
+        , m_multiline(multiline)
+        , m_numSubpatterns(0)
+        , m_maxBackReference(0)
+        , newlineCached(0)
+        , digitsCached(0)
+        , spacesCached(0)
+        , wordcharCached(0)
+        , nondigitsCached(0)
+        , nonspacesCached(0)
+        , nonwordcharCached(0)
+    {
+    }
+
+    ~RegexPattern()
+    {
+        deleteAllValues(m_disjunctions);
+        deleteAllValues(m_userCharacterClasses);
+    }
+
+    void reset()
+    {
+        m_numSubpatterns = 0;
+        m_maxBackReference = 0;
+
+        newlineCached = 0;
+        digitsCached = 0;
+        spacesCached = 0;
+        wordcharCached = 0;
+        nondigitsCached = 0;
+        nonspacesCached = 0;
+        nonwordcharCached = 0;
+
+        deleteAllValues(m_disjunctions);
+        m_disjunctions.clear();
+        deleteAllValues(m_userCharacterClasses);
+        m_userCharacterClasses.clear();
+    }
+
+    bool containsIllegalBackReference()
+    {
+        return m_maxBackReference > m_numSubpatterns;
+    }
+
+    CharacterClass* newlineCharacterClass()
+    {
+        if (!newlineCached)
+            m_userCharacterClasses.append(newlineCached = newlineCreate());
+        return newlineCached;
+    }
+    CharacterClass* digitsCharacterClass()
+    {
+        if (!digitsCached)
+            m_userCharacterClasses.append(digitsCached = digitsCreate());
+        return digitsCached;
+    }
+    CharacterClass* spacesCharacterClass()
+    {
+        if (!spacesCached)
+            m_userCharacterClasses.append(spacesCached = spacesCreate());
+        return spacesCached;
+    }
+    CharacterClass* wordcharCharacterClass()
+    {
+        if (!wordcharCached)
+            m_userCharacterClasses.append(wordcharCached = wordcharCreate());
+        return wordcharCached;
+    }
+    CharacterClass* nondigitsCharacterClass()
+    {
+        if (!nondigitsCached)
+            m_userCharacterClasses.append(nondigitsCached = nondigitsCreate());
+        return nondigitsCached;
+    }
+    CharacterClass* nonspacesCharacterClass()
+    {
+        if (!nonspacesCached)
+            m_userCharacterClasses.append(nonspacesCached = nonspacesCreate());
+        return nonspacesCached;
+    }
+    CharacterClass* nonwordcharCharacterClass()
+    {
+        if (!nonwordcharCached)
+            m_userCharacterClasses.append(nonwordcharCached = nonwordcharCreate());
+        return nonwordcharCached;
+    }
+
+    bool m_ignoreCase;
+    bool m_multiline;
+    unsigned m_numSubpatterns;
+    unsigned m_maxBackReference;
+    PatternDisjunction* m_body;
+    Vector<PatternDisjunction*, 4> m_disjunctions;
+    Vector<CharacterClass*> m_userCharacterClasses;
+
+private:
+    CharacterClass* newlineCached;
+    CharacterClass* digitsCached;
+    CharacterClass* spacesCached;
+    CharacterClass* wordcharCached;
+    CharacterClass* nondigitsCached;
+    CharacterClass* nonspacesCached;
+    CharacterClass* nonwordcharCached;
+};
+
+} } // namespace JSC::Yarr
+
+#endif
+
+#endif // RegexPattern_h
diff --git a/src/3rdparty/webkit/VERSION b/src/3rdparty/webkit/VERSION
index 7d5d1c5..730c023 100644
--- a/src/3rdparty/webkit/VERSION
+++ b/src/3rdparty/webkit/VERSION
@@ -4,8 +4,8 @@ This is a snapshot of the Qt port of WebKit from
 
 The commit imported was from the
 
-        origin/qtwebkit-4.5 branch/tag
+        qtwebkit-4.6-snapshot-29062009 branch/tag
 
 and has the sha1 checksum
 
-        4ee8af9348b3f57d3c0f3575ae0a58336cf07a92
+        22aadba1b4356ad7d8e9446b95baccb6b2c037b0
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog b/src/3rdparty/webkit/WebCore/ChangeLog
index 072beee..8991528 100644
--- a/src/3rdparty/webkit/WebCore/ChangeLog
+++ b/src/3rdparty/webkit/WebCore/ChangeLog
@@ -1,41984 +1,5879 @@
-2009-05-19  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+2009-06-26  John Sullivan  <sullivan@apple.com>
 
-        Reviewed by Simon Hausmann.
-
-        Do not call the parent implementation (Widget::) in show() and hide()
-        of the PluginViewQt, as it always changes the visible state of the
-        platformWidget (equal to the platformPluginWidget in the Qt port),
-        thus ignoring the isParentVisible() test.
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::show):
-        (WebCore::PluginView::hide):
-
-2009-04-22  Tamas Szirbucz  <szirbucz.tamas@stud.u-szeged.hu>
-
-        Reviewed by Ariya Hidayat.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25023
-        Delete reply in QNetworkReplyHandler::abort() to avoid leak.
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::abort):
-
-2009-05-20  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Anders Carlsson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=24510
-
-        Fix a bug where the browserfuncs were not properly assigned,
-        make hasproperty use _NP_HasProperty and hasmethod _NP_HasMethod.
-
-        Test: plugins/netscape-invoke-browserfuncs.html
-
-        * plugins/gtk/PluginPackageGtk.cpp:
-        (WebCore::PluginPackage::load): Fix assignment
-        * plugins/qt/PluginPackageQt.cpp:
-        (WebCore::PluginPackage::load): Fix assignment
-
-2009-05-11  Yael Aharon  <yael.aharon@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        Change Qt port to match the mac and windows ports, and unregister plugins when plugins are stopped.
-        Not doing that can cause assersion failure.
-        https://bugs.webkit.org/show_bug.cgi?id=25702
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::stop):
-
-2009-05-18  Ariya Hidayat  <ariya.hidayat@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Done together with Balazs Kelemen  <kelemen.balazs@stud.u-szeged.hu>.
-
-        https://bugs.webkit.org/show_bug.cgi?id=24551
-
-        [Qt] Reuse FontPlatformData for the same FontDescription.
-        This effectively prevents growing heap usage for loading every web page.
-
-        * platform/graphics/qt/FontCacheQt.cpp:
-        (WebCore::qHash): Necessary for FontPlatformDataCache.
-        (WebCore::FontCache::getCachedFontPlatformData): Reuse the instance if
-        it exists, otherwise create a new one and insert it in the cache.
-
-2009-05-18  Balazs Kelemen  <kelemen.balazs@stud.u-szeged.hu>
-
-        Reviewed by Ariya Hidayat.
-
-        https://bugs.webkit.org/show_bug.cgi?id=24551
-
-        [Qt] Fix the leak in FontFallbackList::fontDataAt() function.
-        When creating a new instance of SimpleFontData, put it in the font list
-        so that it can deleted later on.
-
-        * platform/graphics/qt/FontFallbackListQt.cpp:
-        (WebCore::FontFallbackList::invalidate):
-        (WebCore::FontFallbackList::releaseFontData):
-        (WebCore::FontFallbackList::fontDataAt):
-
-2009-05-15  Ariya Hidayat  <ariya.hidayat@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        [Qt] In the image decoder, remove the raw image data represented as QImage
-        once the image is converted to QPixmap and inserted in the pixmap cache.
-        This effectively reduces the heap usage when running on graphics system
-        other than raster (i.e the case where QImage != QPixmap).
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::imageAtIndex): Nullified the image on purpose.
-        * platform/graphics/qt/ImageDecoderQt.h: Made m_imageList mutable.
-
-2009-05-15  Ariya Hidayat  <ariya.hidayat@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        [Qt] Refactor alpha channel detection the image decoder.
-        Sets the boolean flag as soon as the image is being read.
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::ImageDecoderQt): Initialized m_hasAlphaChannel.
-        (WebCore::ImageDecoderQt::setData): Set the flag when appropriate.
-        (WebCore::ImageDecoderQt::supportsAlpha): Simplified.
-        (WebCore::ImageDecoderQt::reset): Resetted the flag.
-        * platform/graphics/qt/ImageDecoderQt.h: Added m_hasAlphaChannel.
-
-2009-05-13  Ariya Hidayat  <ariya.hidayat@nokia.com>
-
-        Reviewed by Sam Weinig.
-
-        [Qt] Fix "lighther" composition mode.
-        QPainter::CompositionMode_Plus is the right match.
-
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::toQtCompositionMode):
-
-2009-04-29  Ariya Hidayat  <ariya.hidayat@nokia.com>
-
-        Reviewed by Simon Fraser.
-
-        [Qt] Initialize GraphicsContext's and ImageBuffer's QPainter to match
-        the default values of canvas attributes.
-
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::ImageBufferData::ImageBufferData):
-
-2009-04-27  Ariya Hidayat  <ariya.hidayat@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        https://bugs.webkit.org/show_bug.cgi?id=18475
-
-        [Qt] Widget painting should follow the layout direction (LTR, RTL)
-        of the element style, not the application layout direction.
-
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::applyTheme):
-
-2009-03-13  Adam Bergkvist <adam.bergkvist@ericsson.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=24349
-        [QT] HTTP status text is never set
-
-        Set HTTP status text to the reason phrase attribute of QNetworkReply.
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
-
-2009-03-02  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Holger Freyther.
-
-        Added putImageData to Qt. Discussed with Ariya Hidayat.
-
-        [Qt] lacks putImageData support in Canvas
-        https://bugs.webkit.org/show_bug.cgi?id=22186
-
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::ImageBuffer::putImageData):
-
-2009-03-01  Larry Ewing  <lewing@novell.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=24080
-        NPN_GetValue casting to the wrong type and writing outside bounds
-
-        Make sure to cast the value to the correct type so that only
-        memory owned by the value is written to.
-
-        * plugins/gtk/PluginViewGtk.cpp (PluginView::getValueStatic): 
-        * plugins/qt/PluginViewQt.cpp (PluginView::getValueStatic):
-        * plugins/mac/PluginViewMac.cpp (PluginView::getValueStatic): 
-        (PluginView::getValue):
-
-2009-02-27  Adam Treat  <adam.treat@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=24229
-        If an image has no alpha channel there is no reason to use SourceOver.
-
-        * platform/graphics/qt/ImageQt.cpp:
-        (WebCore::Image::drawPattern):
-        (WebCore::BitmapImage::draw):
-
-2009-02-27  Zack Rusin  <zack@kde.org>
-
-        Reviewed by Nikolas Zimmermann.
-
-        Qt: be more reasonable about scrolled lines
-
-        cMouseWheelPixelsPerLineStep is currently a constant set to 13.3. it doesn't
-        match our metrics meaning that Qt scrolls by ~2 lines by default which is quite
-        irritating. so lets scroll vertically by the Qt set number of lines * Qt default
-        single step scroll
-
-        * platform/qt/WheelEventQt.cpp:
-
-2009-02-25  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Ported arcTo to Qt. Qt has no native support for arcTo. This changes
-        calculate the behavior of arcTo and draws it with lineTo and arc.
-
-        [QT] implement Canvas arcTo
-        https://bugs.webkit.org/show_bug.cgi?id=23873
-
-        * platform/graphics/qt/PathQt.cpp:
-        (WebCore::Path::addArcTo):
-
-2009-03-12  Adam Treat  <adam.treat@torchmobile.com>
-
-        Reviewed by Oliver Hunt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=24498
-        Fix the Qt port to use the same algorithm for drawing dashed and dotted
-        borders as the other ports.  This makes the Qt port pixel-for-pixel perfect
-        compared to border drawing with Apple's canonical mac port and much closer
-        to konqueror and firefox behavior.
-
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::drawLine):
-
-2009-03-09  Adam Treat  <adam.treat@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        https://bugs.webkit.org/show_bug.cgi?id=24463
-        WebCore::qstring is detaching and copying twice for every single
-        WebCore::TextRun that is processed and drawn.  This elevates this method
-        to one of the top-ten most expensive methods in all of QtWebKit according
-        to profiling.  This changes the method so that QString only detaches
-        when absolutely necessary.
-
-        * platform/graphics/qt/FontQt.cpp:
-        (WebCore::qstring):
-        (WebCore::fixSpacing):
-        (WebCore::Font::drawComplexText):
-        (WebCore::Font::floatWidthForComplexText):
-        (WebCore::Font::offsetForPositionForComplexText):
-        (WebCore::Font::selectionRectForComplexText):
-
-2009-02-04  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Unreviewed Qt build fix.
-
-        Changed ASSERT(image) to ASSERT(!image.isNull()).
-
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::ImageBuffer::getImageData):
-
-2009-02-03  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Sam Weinig.
-
-        This is a follow up of r40546. Call toImage() once speeds up ImageBuffer::getImageData()
-
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::ImageBuffer::getImageData):
-
-2009-02-03  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Sam Weinig and Oliver Hunt.
-
-        Added getImageData() support for QtWebKit.
-
-        [QT] lacks getImageData / putImageData support in Canvas
-        https://bugs.webkit.org/show_bug.cgi?id=22186
-
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::ImageBuffer::getImageData):
-
-2009-04-14  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25099
-
-        When creating a QNetworkRequest make sure to populate the
-        CacheLoadControlAttribute with the value set by the ResourceRequest::cachePolicy() so that the cache will be used as WebKit expects.
-
-        * WebKit/qt/tests/qwebpage/tst_qwebpage.cpp:
-        (tst_QWebPage::requestCache):
-
-        * platform/network/qt/ResourceRequestQt.cpp:
-        (WebCore::ResourceRequest::toNetworkRequest):
-
-2009-04-07  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Darin Adler
-
-        While working on <rdar://problem/5968249>, noticed some glaring problems with LocalStorage.
-
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::localStorage): Return the cached m_localStorage object if it exists to 
-          avoid creating multiple representations for the same underlying StorageArea.
-        * page/DOMWindow.h:
-        (WebCore::DOMWindow::optionalLocalStorage): Return m_localStorage, not m_sessionStorage.
-
-2009-04-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Don't show and hide the platformPluginWidget, as it's our QWebView
-
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::show):
-        (WebCore::PluginView::hide):
-        (WebCore::PluginView::setParentVisible):
-
-2009-04-06  Mike Belshe <mike@belshe.com>
-
-        Reviewed by Eric Seidel.
-
-        HTMLCanvasElement crash when ImageBuffer creation fails.
-        https://bugs.webkit.org/show_bug.cgi?id=23212
-
-        Check for NULL before using the ImageBuffer as we might
-        be low on memory and creation may have failed.
-
-        Test case creation blocked by:
-        https://bugs.webkit.org/show_bug.cgi?id=25055
-
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::createImageBuffer):
-
-2009-04-05  Erik L. Bunce  <elbunce@xendom.com>
-
-        Reviewed by Simon Hausmann.
-
-        https://bugs.webkit.org/show_bug.cgi?id=25050
-
-        Fix an assert failure when dropping an 'empty' text/uri-list on a QWebView. 
-
-        * platform/qt/DragDataQt.cpp:
-        (WebCore::DragData::asURL):
-
-2009-03-27  Zack Rusin <zack@kde.org>
-
-        Reviewed by Simon Hausmann.
-
-        https://bugs.webkit.org/show_bug.cgi?id=24280
-
-        Fix propagation of fill rules when rendering paths in the Qt build.
-
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::toQtFillRule):
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::strokePath):
-
-2009-03-27  Zack Rusin <zack@kde.org>
-
-        Reviewed by Tor Arne Vestbø.
-
-        https://bugs.webkit.org/show_bug.cgi?id=24275
-
-        Fix text field theming in the Qt build with the KDE 4 Oxygen
-        style by adjusting the size vertically and horizontally to
-        set padding on the element equal to the width of the style painted border.
-
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::RenderThemeQt):
-        (WebCore::RenderThemeQt::computeSizeBasedOnStyle):
-        (WebCore::RenderThemeQt::adjustTextFieldStyle):
-        (WebCore::RenderThemeQt::paintTextField):
-        * platform/qt/RenderThemeQt.h:
-
-2009-02-06  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Simon Hausmann.
-
-        Fix bug in clearRect(). Use fillRect() instead of eraseRect() to get
-        the context transparent.
-
-        [QT] clearRect fill's a given rect with white
-        https://bugs.webkit.org/show_bug.cgi?id=23728
-
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::clearRect):
-
-2009-03-19  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Fixed support for doing calls from JavaScript into NPAPI Plugins for the Qt port on Windows.
-
-        Removed dead code for distinguishing between Widget and PluginView in the Qt port.
-
-        * bindings/js/ScriptControllerQt.cpp:
-        (WebCore::ScriptController::createScriptInstanceForWidget): Removed incorrect isNPAPI check.
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::PluginView): Removed m_isNPAPIPlugin variable.
-        * plugins/PluginView.h: Removed setter/getter.
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::init): Removed call to setIsNPAPIPlugin.
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::init): Ditto.
-
-2009-02-26  Benjamin Meyer  <benjamin.meyer@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        https://bugs.webkit.org/show_bug.cgi?id=24062
-        QNetworkCookieJar expects the url and not the policy url.  Sending the
-        policy url will cause QNetworkCookieJar to behave incorrectly.  One
-        example would be a cookie that does not have a path or domain.
-        QNetworkCookieJar will use the url it is given to fill in default values.
-        This allows setting cookies on the url of the main frame from an iFrame
-        when the cookie should be set on the url of the iFrame.
-
-        Originally noticed on http://writer.zoho.com/jsp/home.jsp?serviceurl=/index.do
-
-        * platform/qt/CookieJarQt.cpp:
-        (WebCore::setCookies):
-
-2009-02-23  Thiago Macieira  <thiago.macieira@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Fix the Copyright notices in a few files
-
-        * platform/qt/RenderThemeQt.h:
-
-2008-12-13  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by NOBODY (OOPS!).
-
-        The Qt API exposes a global history patch CSSStyleSelector to make API consumers work again
-
-        https://bugs.webkit.org/show_bug.cgi?id=20952
-
-        The QtWebKit port made the mistake of exposing a global history. This broke
-        with the addition of PageGroup and LinkHash. This needs to be repaired
-        for Qt4.5.
-
-        Add a function to LinkHash.cpp that is resolving a URL. Use this
-        function from within CSSStyleSelector to forward the url to the
-        QWebHistoryInterface API.
-
-        It is sad that there is a path within visitedLinkHash which is now
-        doing a memcpy, it is sad to add a PLATFORM(QT) define to CSSStyleSelector
-        and using QtWebKit types within WebCore is a layering violation as well.
-
-        PageGroup::setShouldTrackVisitedLinks is currently not enabled. For
-        Qt4.6 a second version of the QWebHistoryInterface is going to be
-        added which will fix things up.
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkPseudoState):
-        * platform/LinkHash.cpp:
-        (WebCore::visitedURL):
-        (WebCore::visitedLinkHash):
-        * platform/LinkHash.h:
-
-2009-02-13  Prasanth Ullattil  <pullatti@trolltech.com>
-
-        Reviewed by Simon Hausmann.
-
-        Fixes crash in the Qt port on Windows with comboboxes
-
-        The focusWidget in the input context is not reset properly.
-        The QApplication::setFocusWidget() wont reset the IC if the reason is
-        PopupFocusReason, this is not ideal. For the time being we are going
-        to do this from webkit itself.
-
-        * platform/qt/QWebPopup.cpp:
-        (WebCore::QWebPopup::hidePopup):
-
-2009-02-07  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        For the Qt port implement Image::drawPattern via
-        BitmapImage::drawPatterns' implementation and implement
-        Gradient::fill.
-
-        This partially fixes rendering of generated gradient content.
-
-        * platform/graphics/BitmapImage.h: Remove the drawPattern
-        implementation for the Qt port in BitmapImage, it's been moved to
-        Image::drawPattern.
-        * platform/graphics/qt/GradientQt.cpp:
-        (WebCore::Gradient::fill): Implement using a simple fillRect.
-        * platform/graphics/qt/ImageQt.cpp:
-        (WebCore::Image::drawPattern): Moved implementation from
-        BitmapImage::drawPattern.
-
-2009-02-06  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Added support for different ownership models for wrapped QObjects in
-        the JavaScript environment.
-
-        * bindings/js/ScriptControllerQt.cpp:
-        (WebCore::ScriptController::createScriptInstanceForWidget): Specify
-        QtOwnership for scriptable widgets.
-        * bridge/npruntime_internal.h: Add "NormalState" to the list of
-        undef'ed macros as an included Qt header uses "NormalState" as value
-        in an enum.
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtInstance::QtInstance): Save and initialize ownership
-        member.
-        (JSC::Bindings::QtInstance::~QtInstance): Respect
-        QScriptEngine::ValueOwnership policy with regards to wrapped m_object.
-        (JSC::Bindings::QtInstance::getQtInstance): Pass the ownership down to
-        the instance.
-        * bridge/qt/qt_instance.h:
-        (JSC::Bindings::QtInstance::create): Ditto.
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::convertQVariantToValue): Use QtOwnership for
-        automatically wrapped QObjects.
-        (JSC::Bindings::QtConnectionObject::execute): Ditto.
-
-2009-02-04  Trenton Schulz <trenton.schulz@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Fix implementation of PluginViewMac::invalidateRect to update only the
-        specified rect, not the entire browser window.
-
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::invalidateRect):
-
-2009-02-03  Adam Treat  <adam.treat@torchmobile.com>
-
-        Fix the Qt build after r40536.
-
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::convertQVariantToValue):
-
-2009-02-03  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Fix conversion of QByteArray to JavaScript and back. Instead of
-        converting it to a String (data loss!) we now map it to JSByteArray.
-
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::):
-        (JSC::Bindings::valueRealType): Added JSByteArray as converstion type.
-        (JSC::Bindings::convertValueToQVariant): Convert from JSByteArray to
-        QVariant(QByteArray).
-        (JSC::Bindings::convertQVariantToValue): Convert from
-        QVariant::ByteArray to jsByteArray.
-
-2009-01-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Bug 23580: GNU mode RVCT compilation support
-        <https://bugs.webkit.org/show_bug.cgi?id=23580>
-
-        * html/PreloadScanner.cpp: Use COMPILER(GCC) instead of __GNUC__.
-
-2009-01-28  Ariya Hidayat  <ariya.hidayat@trolltech.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Speed-up clipping: avoid calling expensive QPainter::clipRegion().
-        Beside, the check is not necessary since QPainter::setClipRect() will
-        work just fine if there is no clip region yet.
-
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::clip):
-
-2009-01-27  Ariya Hidayat  <ariya.hidayat@trolltech.com>
-
-        Rubber-stamped by Simon Hausmann.
-
-        http://www.qtsoftware.com/developer/task-tracker/index_html?id=238662&method=entry
-
-        [Qt] Map function keys F1 to F24.
-
-        * platform/qt/PlatformKeyboardEventQt.cpp:
-        (WebCore::windowsKeyCodeForKeyEvent):
-
-2009-01-23  Adam Treat  <adam.treat@torchmobile.com>
-
-        Reviewed by Holger Hans Peter Freyther.
-
-        Redo previous patch http://trac.webkit.org/changeset/34260 which fixes a
-        huge memory leak by ensuring that the timer is fired one last time on
-        application tear down thus triggering the GCController thereby freeing
-        JavaScript objects as well as triggering other timer based tear down methods.
-
-        * platform/qt/SharedTimerQt.cpp:
-        (WebCore::SharedTimerQt::~SharedTimerQt):
-
-2009-01-09  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon Hausmann.
-
-        [QT] Make SharedTimer use QBasicTimer
-
-        Kill the SharedTimerQt.h and the usage of signal and slots
-        by using QBasicTimer.
-
-        * WebCore.pro:
-        * platform/qt/SharedTimerQt.cpp:
-        (WebCore::SharedTimerQt::SharedTimerQt):
-        (WebCore::SharedTimerQt::inst):
-        (WebCore::SharedTimerQt::start):
-        (WebCore::SharedTimerQt::stop):
-        (WebCore::SharedTimerQt::timerEvent):
-        (WebCore::setSharedTimerFiredFunction):
-        (WebCore::setSharedTimerFireTime):
-        (WebCore::stopSharedTimer):
-        * platform/qt/SharedTimerQt.h: Removed.
-
-2009-01-25  Thiago Macieira  <thiago.macieira@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Fix gcc compiler warning (deprecated conversion from constant string to char*)
-
-        "" cannot be stored in a char*
-
-        * plugins/PluginStream.cpp:
-        (WebCore::PluginStream::destroyStream):
-
-2009-01-23  Ariya Hidayat  <ariya.hidayat@trolltech.com>
-
-        Reviewed by Simon Hausmann.
-
-        Bug 23475: fast/text/find-backwards.html fails with ICU disabled SearchBuffer
-        https://bugs.webkit.org/show_bug.cgi?id=23475
-
-        * editing/TextIterator.cpp:
-        (WebCore::SearchBuffer::search): Set the character start flag to false to
-        ensure we won't ever return the same result twice. There are other ways we
-        could accomplish this, mentioned in the comment, but this one was the smallest
-        and cleanest I could think of.
-
-2009-01-23  Darin Adler  <darin@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        [Qt] Simplify the assertion.
-
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::getWindowsContext):
-        (WebCore::GraphicsContext::releaseWindowsContext):
-
-2009-01-19  Ariya Hidayat  <ariya.hidayat@trolltech.com>
-
-        [Qt] Build fix after r39971.
-
-        * platform/qt/LoggingQt.cpp:
-        (WebCore::InitializeLoggingChannelsIfNecessary):
-
-2009-01-19  Ariya Hidayat  <ariya.hidayat@trolltech.com>
-
-        Reviewed by Simon Hausmann.
-
-        http://www.qtsoftware.com/developer/task-tracker/index_html?id=211228&method=entry
-
-        [Qt] Show focus rect when a button gets the focus for the first time.
-        This is important at least for Windows style.
-
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::applyTheme):
-
-2009-01-16  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Kevin Decker and Adam Roben.
-
-        - fix a regression that resulted in a crash when plug-ins were
-          disabled.
-
-        * rendering/RenderPartObject.cpp:
-        (WebCore::RenderPartObject::updateWidget): Added a null check.
-
-2009-01-16  Thiago Macieira  <thiago.macieira@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Fixes QString and 8-bit mix fixes.
-
-        Details:  Make sure we use QLatin1String where appropriate (and don't
-        use QString when not necessary)
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::create):
-        * platform/graphics/qt/SimpleFontDataQt.cpp:
-        (WebCore::SimpleFontData::platformInit):
-        * platform/qt/FileSystemQt.cpp:
-        (WebCore::openTemporaryFile):
-        * platform/qt/LoggingQt.cpp:
-        (WebCore::InitializeLoggingChannelsIfNecessary):
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::extraMediaControlsStyleSheet):
-        * plugins/qt/PluginDataQt.cpp:
-        (WebCore::PluginData::initPlugins):
-
-2009-01-16  Ariya Hidayat  <ariya.hidayat@trolltech.com>
-
-        Reviewed by Adam Roben.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22452
-
-        When plugins are disabled, plugin data should not be available for
-        the page. This ensures that navigator.plugins would not see the
-        additional MIME types supported by the plugins.
-
-        * page/Page.cpp:
-        (WebCore::Page::pluginData):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::shouldUsePlugin):
-        * rendering/RenderPartObject.cpp:
-        (WebCore::RenderPartObject::updateWidget):
-
-2009-01-09  Darin Adler  <darin@apple.com>
-
-        Reviewed by Jon Honeycutt.
-
-        Bug 22913: REGRESSION: Space bar doesn't scroll on windows
-        https://bugs.webkit.org/show_bug.cgi?id=22913
-        rdar://problem/6479834
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::defaultKeyboardEventHandler): Added code to call
-        defaultSpaceEventHandler.
-        (WebCore::EventHandler::defaultSpaceEventHandler): Added. Scrolls down or up based
-        on the shift key.
-        * page/EventHandler.h: Added defaultSpaceEventHandler.
-
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::platformScroll): Return false, because this function does
-        not scroll. In an earlier version of this patch, I used this to prevent the
-        patch from affecting the Mac, but I decided to use #if instead.
-
-2009-01-14  Alexey Proskuryakov  <ap@webkit.org>
-
-        Release build fix.
-
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::storeUpdatedType): Use ASSERT_UNUSED.
-
-2009-01-13  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Anders Carlsson.
-
-        Test: http/tests/appcache/xhr-foreign-resource.html
-
-        https://bugs.webkit.org/show_bug.cgi?id=23256
-        Implement application cache foreign entries
-
-        * loader/DocumentLoader.cpp: (WebCore::DocumentLoader::shouldLoadResourceFromApplicationCache):
-        Removed a misplaced check for foreign resources that prevented them from being loaded altogether.
-
-        * loader/appcache/ApplicationCacheGroup.cpp: (WebCore::ApplicationCacheGroup::selectCache):
-        If a document that was loaded from appcache should be associated with a different cache,
-        mark the resource as foreign in the original cache and start over.
-
-        * loader/appcache/ApplicationCacheResource.cpp: (WebCore::ApplicationCacheResource::addType):
-        This function can now be called after a cache is stored, so it no longer asserts the opposite.
-
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::cacheGroupForURL): Fix database pass to correctly ignore
-        in-memory caches that were already rejected.
-        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL): Ditto.
-        (WebCore::ApplicationCacheStorage::storeUpdatedType): Added a function that updates type of
-        an already stored cached resource.
-
-        * loader/appcache/ApplicationCacheStorage.h: Added storeUpdatedType().
-
-2009-01-13  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Speculative fix for an Uninitialized Memory Read (UMR)
-        seen by purify in chormium's equivalent V8 file.
-
-        * bindings/js/JSSVGPODTypeWrapper.h:
-        (WebCore::PODTypeWrapperCacheInfo::PODTypeWrapperCacheInfo):
-
-2009-01-13  Christian Dywan  <christian@twotoasts.de>
-
-        Build fix, StorageEvent is only defined if we have DOM_STORAGE
-
-        * dom/Document.cpp:
-        (WebCore::Document::createEvent): Conditionalize StorageEvent
+        Added Speech submenu to context menu on Mac when there's a non-editable selection
+        (it was already present when there's an editable selection). 
+        Also added support for disabling "Stop Speaking" when there is no speaking to stop.
 
-2009-01-13  Darin Adler  <darin@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        Bug 23277: space bar scrolls the page when typed in any text field
-        https://bugs.webkit.org/show_bug.cgi?id=23277
-        rdar://problem/6490249
-
-        There's already a regression test for this, since bug 16421 was the same problem, but on
-        Mac. The regression test is fast/events/space-scroll-event.html, so I won't write a new one.
-
-        This bug doesn't affect Mac because the canEdit check in -[WebHTMLView insertText:] prevents
-        a text input event from being generated at all. That difference may in itself be a bug, but
-        the only symptom is that you get text input events in more cases on platforms other than Mac.
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleTextInputEvent): Return whether the event's default was
-        handled, not the result of the dispatchEvent function, which indicates only whether the
-        default behavior was prevented, not if the default behavior did some insertion. This fix
-        makes it so the keyboard event handler can detect that no space was inserted and know that
-        the space bar keypress event can be treated as a scrolling command.
-        (WebCore::EventHandler::defaultKeyboardEventHandler): Handle the keypress event, not the
-        keydown event. Without the change above, making this change would have restored the old
-        behavior, reintroducing bug 22913 where the space bar doesn't scroll at all on Windows.
-
-2009-01-12  Robert Blaut  <webkit@blaut.biz>
-
-        Reviewed by Darin Adler
-
-        Fix for <https://bugs.webkit.org/show_bug.cgi?id=22096>
-        Bug 22096: REGRESSION (r35879) scrolldelay is counted in seconds 
-        instead of miliseconds
-
-        Test: fast/css/webkit-marquee-speed-unit-in-quirksmode.html
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::validUnit): treat unitless values in quirks mode 
-        as miliseconds instead of seconds.
-
-2009-01-13  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Fix crash in the Qt port when deleting a popup from within a
-        JavaScript onchange handler.
-
-        * platform/qt/QWebPopup.cpp:
-        (WebCore::QWebPopup::QWebPopup): Perform the activation of the
-        combobox item (i.e. the call to the JS handler) from a different
-        call stack by using a queued connection.
-
-2009-01-13  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Make sure media elements dispatch the 'loaded' event
-        
-        We assume that when Phonon goes into paused state that we have the
-        complete media file. Once we do media loading ourselves we can
-        distinguish between loading the first frame and the complete media.
-
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::updateStates):
-
-2009-01-13  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt] Add more verbose error output when loading NPAPI plugins
-
-        * plugins/qt/PluginPackageQt.cpp:
-        (WebCore::PluginPackage::load):
-
-2009-01-13  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon Hausmann.
-
-        Change how themes adjust mediaControls.css to match html4/quicks.css
-        
-        Instead of providing the full style sheet, the themes provide extra
-        overrides to the default style defined in UserAgentStyleSheetsData.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=23210
-        
-        Also, merge WebKitResources.qrc and WebCoreResources.qrc to speed up
-        build time for the Qt port.
-
-        * Resources/WebKitResources.qrc: Removed. Merged into WebCore.qrc
-        * WebCore.pro:
-        * WebCore.qrc: Added.
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::styleForElement):
-        * css/qt/mediaControls-extras.css: Rename from html4-adjustments-qt.css
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::extraMediaControlsStyleSheet):
-        * platform/qt/RenderThemeQt.h:
-        * platform/qt/WebCoreResources.qrc: Removed.
-        * platform/qt/html4-adjustments-qt.css: Rename to mediaControls-extras.css
-        * rendering/RenderTheme.cpp:
-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::extraMediaControlsStyleSheet):
-
-2009-01-10  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23210
-        Make it easier for ports to define custom UI for media controls
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::styleForElement): call theme()->styleSheetForMediaControls to
-        get the media controller style sheet 
-
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlInputElement::hitTest): Added
-        * rendering/MediaControlElements.h: Updated
-
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::forwardEvent): Call element hitTest() method instead of local function
-        so control elements don't necessarily have to be rectangular
-
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::styleSheetForMediaControls):  Added
-        (WebCore::RenderTheme::hitTestMediaControlPart):  Added
-        * rendering/RenderTheme.h: Updated
-
-2009-01-12  Kevin Ollivier  <kevino@theolliviers.com>
+        Reviewed by Tim Hatcher.
 
-        !ENABLE(SVG_FONTS) build fix. Move defaultUnitsPerEm into a non-SVG header
-        so it can be used by all builds.
+        * loader/EmptyClients.h:
+        (WebCore::EmptyContextMenuClient::isSpeaking):
+        implemented this new virtual function to return false
         
-        * platform/graphics/Font.h:
-        * platform/graphics/SimpleFontData.cpp:
-        * svg/SVGFontFaceElement.cpp:
-        * svg/SVGFontFaceElement.h:
-
-2008-01-12  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22936
-        Fix uninitialized memory read error, reported by Purify.
-
-        * platform/graphics/SimpleFontData.cpp:
-        (WebCore::SimpleFontData::SimpleFontData): Added initializer for
-            m_unitsPerEm using cDefaultUnitsPerEm constant.
-        * svg/SVGFontFaceElement.cpp:
-        (WebCore::SVGFontFaceElement::unitsPerEm): Replaced literal value with
-            the constant.
-        * svg/SVGFontFaceElement.h: Added cDefaultUnitsPerEm constant.
-
-2009-01-12  Adam Treat  <adam.treat@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Do not set fixedLayoutSize for anything other than the mainframe during
-        the transition as this is a page level state like the viewportSize.
-
-        * loader/FrameLoaderClient.cpp:
-        (WebCore::FrameLoaderClient::transitionToCommittedForNewPage):
-
-2009-01-09  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Rubber-stamped by Tor Arne Vestbø.
-
-        Swap the .h and the .cpp output in the Qt build for the
-        UserAgentStyleSheetData files, to put the definition in the .cpp file
-        and the declaration in the header file.
-
-        * WebCore.pro:
-
-2009-01-09  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon Hausmann.
-
-        Prevent qmake from generating duplicate rules for embedded stylesheets
+        * page/ContextMenuClient.h:
+        declared this new pure virtual function
         
-        The STYLESHEETS_EMBED variable used to contain only one file name, but
-        now that it is a list of files we need to change it to be a dependency
-        for the stylesheet generator instead of the input.
-
-        * WebCore.pro:
-
-2009-01-09  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Fix qmake warning about missing test function, a contains() call was
-        missing.
-
-        * WebCore.pro:
-
-2009-01-09  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Rubber-stamped by Tor Arne Vestbø.
-
-        Add the Qt API headers to HEADERS, too, for improved completion in IDEs.
-
-        * WebCore.pro:
-
-2009-01-09  David Levin  <levin@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23199
-
-        Fix deref's of string happening on two different threads.
-
-        No observable change in behavior, so no test.  However, there are asserts
-        being added for https://bugs.webkit.org/show_bug.cgi?id=23175 which
-        will detect this issue while running the normal worker tests.
-
-        * dom/WorkerThread.cpp:
-        (WebCore::WorkerThreadStartupData::create):
-        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
-        (WebCore::WorkerThread::WorkerThread):
-        (WebCore::WorkerThread::workerThread):
-        * dom/WorkerThread.h:
-
-2009-01-08  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Adam Roben.
-
-        - use native glyph support in Core Graphics when available
-
-        * platform/graphics/win/FontCGWin.cpp:
-        (WebCore::Font::drawGlyphs): Changed to use drawGDIGlyphs() only if
-        native glyph support is not available or stroking is required. Changed
-        to pass the font's useGDI() flag to wkSetCGContextFontRenderingStyle to
-        request the use of native glyphs.
-        * platform/graphics/win/FontCustomPlatformData.cpp:
-        (WebCore::FontCustomPlatformData::fontPlatformData): Added a call to
-        wkSetFontPlatformInfo to attach the LOGFONT to the CGFont.
-        * platform/graphics/win/FontPlatformDataCGWin.cpp:
-        (WebCore::FontPlatformData::platformDataInit): Ditto.
-
-2009-01-08  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22929
-        Fix memory regression when decoding large animated GIFs.
-
-        * platform/graphics/cg/ImageSourceCG.cpp:
-        (WebCore::ImageSource::clear):
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        insert Speech item (after a separator) on Mac when there's selected non-editable text
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        enable Stop Speaking item only if the context menu client returns true for isSpeaking()
 
-2009-01-08  Scott Violet  <sky@chromium.org>
+2009-06-28  Dan Bernstein  <mitz@apple.com>
 
-        Reviewed by Eric Seidel (and Adam Barth).
+        Reviewed by Simon Fraser.
 
-        Fix Images to return their file extension
-        http://code.google.com/p/chromium/issues/detail?id=5827
+        - fix https://bugs.webkit.org/show_bug.cgi?id=26783
+          <rdar://problem/7014543> REGRESSION (r45296): Subfolders not displayed
+          in MobileMe iDisk Web App
 
-        * platform/graphics/skia/ImageSourceSkia.cpp:
-        (WebCore::ImageSource::filenameExtension):
+        Test: added a case to fast/dom/Element/scrollWidth.html
 
-2009-01-08  Dimitri Glazkov  <dglazkov@chromium.org>
+        Ensure that scroll{Width, Height} is greater or equal to
+        client{Width, Height}.
 
-        Reviewed by Eric Seidel.
-
-        Add PathSkia and PatternSkia implementations to WebCore
-        https://bugs.webkit.org/show_bug.cgi?id=23200
-
-        * platform/graphics/skia/PathSkia.cpp: Added.
-        (WebCore::Path::Path):
-        (WebCore::Path::~Path):
-        (WebCore::Path::operator=):
-        (WebCore::Path::isEmpty):
-        (WebCore::Path::contains):
-        (WebCore::Path::translate):
-        (WebCore::Path::boundingRect):
-        (WebCore::Path::moveTo):
-        (WebCore::Path::addLineTo):
-        (WebCore::Path::addQuadCurveTo):
-        (WebCore::Path::addBezierCurveTo):
-        (WebCore::Path::addArcTo):
-        (WebCore::Path::closeSubpath):
-        (WebCore::Path::addArc):
-        (WebCore::Path::addRect):
-        (WebCore::Path::addEllipse):
-        (WebCore::Path::clear):
-        (WebCore::convertPathPoints):
-        (WebCore::Path::apply):
-        (WebCore::Path::transform):
-        (WebCore::Path::debugString):
-        (WebCore::boundingBoxForCurrentStroke):
-        (WebCore::Path::strokeBoundingRect):
-        * platform/graphics/skia/PatternSkia.cpp: Added.
-        (WebCore::shaderRule):
-        (WebCore::Pattern::createPlatformPattern):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
 
-2009-01-08  Dimitri Glazkov  <dglazkov@chromium.org>
+2009-06-27  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Eric Seidel.
 
-        Add ImageSourceSkia to platform/graphics/skia
-        https://bugs.webkit.org/show_bug.cgi?id=23200
+        https://bugs.webkit.org/show_bug.cgi?id=26780
         
-        ImageSourceSkia is mostly a hack to support our
-        ICO decoder model.  See ImageSourceSkia.h for more
-        explanation.  Eventually we'd like to make our ICO
-        decoder lazy.
-
-        * platform/graphics/ImageSource.h: mark m_decoder as protected
-        * platform/graphics/skia/ImageSourceSkia.cpp: Added.
-        (WebCore::createDecoder):
-        (WebCore::ImageSource::ImageSource):
-        (WebCore::ImageSource::~ImageSource):
-        (WebCore::ImageSource::clear):
-        (WebCore::ImageSource::initialized):
-        (WebCore::ImageSource::setData):
-        (WebCore::ImageSource::isSizeAvailable):
-        (WebCore::ImageSource::size):
-        (WebCore::ImageSource::frameSizeAtIndex):
-        (WebCore::ImageSource::repetitionCount):
-        (WebCore::ImageSource::frameCount):
-        (WebCore::ImageSource::createFrameAtIndex):
-        (WebCore::ImageSource::frameIsCompleteAtIndex):
-        (WebCore::ImageSource::frameDurationAtIndex):
-        (WebCore::ImageSource::frameHasAlphaAtIndex):
-        (WebCore::ImageSourceSkia::setData):
-        (WebCore::ImageSource::filenameExtension):
-        * platform/graphics/skia/ImageSourceSkia.h: Added.
-
-2009-01-08  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Add NativeImageSkia (PlatformImagePtr) to platform/graphics/skia
-        https://bugs.webkit.org/show_bug.cgi?id=23200
-
-        * platform/graphics/skia/NativeImageSkia.cpp: Added.
-        (NativeImageSkia::NativeImageSkia):
-        (NativeImageSkia::decodedSize):
-        (NativeImageSkia::hasResizedBitmap):
-        (NativeImageSkia::resizedBitmap):
-        (NativeImageSkia::shouldCacheResampling):
-        * platform/graphics/skia/NativeImageSkia.h: Added.
-        (NativeImageSkia::setDataComplete):
-        (NativeImageSkia::isDataComplete):
-
-2009-01-08  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Add ImageBufferSkia and ImageSkia files.
-        https://bugs.webkit.org/show_bug.cgi?id=23200
-        For now we've left BitmapImage and BitmapImageSingleFrameSkia
-        implementations in the ImageSkia file (like ImageCG has), but
-        we intend to break them out into their own files.
-
-        * platform/graphics/skia/ImageBufferSkia.cpp: Added.
-        (WebCore::ImageBufferData::ImageBufferData):
-        (WebCore::ImageBuffer::ImageBuffer):
-        (WebCore::ImageBuffer::~ImageBuffer):
-        (WebCore::ImageBuffer::context):
-        (WebCore::ImageBuffer::image):
-        (WebCore::ImageBuffer::getImageData):
-        (WebCore::ImageBuffer::putImageData):
-        (WebCore::ImageBuffer::toDataURL):
-        * platform/graphics/skia/ImageSkia.cpp: Added.
-        (WebCore::):
-        (WebCore::FrameData::clear):
-        (WebCore::Image::loadPlatformResource):
-        (WebCore::Image::drawPattern):
-        (WebCore::BitmapImage::initPlatformData):
-        (WebCore::BitmapImage::invalidatePlatformData):
-        (WebCore::BitmapImage::checkForSolidColor):
-        (WebCore::BitmapImage::draw):
-        (WebCore::BitmapImageSingleFrameSkia::draw):
-        (WebCore::BitmapImageSingleFrameSkia::create):
-
-2009-01-08  James Robinson  <jamesr@google.com>
-
-        Reviewed by Mark Rowe.
-        Landed by Pamela Greene.
-
-        WebCore::Event::timeStamp() is a simple accessor and should be const
-
-        https://bugs.webkit.org/show_bug.cgi?id=23176
-
-        * dom/Event.h:
-        (WebCore::Event::timeStamp):
-
-2009-01-08  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Fix <rdar://problem/6467206> 
-        Resources loaded from the memory cache do not get correctly inserted into the DocLoader resource map (22994)
+        Do not make compositing layers for non-self-painting RenderLayers,
+        since these exist only to push a clip onto the clipping stack. If such
+        a layer gets compositied for some other reason, it should not paint.
         
-        Use CachedResourceHandle in document resource map so resources get updated correctly when using
-        using cache validation conditionals.
-
-        * loader/Cache.cpp:
-        (WebCore::Cache::evict):
-        * loader/DocLoader.cpp:
-        (WebCore::DocLoader::~DocLoader):
-        (WebCore::DocLoader::requestResource):
-        (WebCore::DocLoader::setAutoLoadImages):
-        (WebCore::DocLoader::removeCachedResource):
-        * loader/DocLoader.h:
-        (WebCore::DocLoader::cachedResource):
-        (WebCore::DocLoader::allCachedResources):
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::getSubresources):
-        * loader/ImageLoader.cpp:
-        (WebCore::ImageLoader::updateFromElement):
-
-2009-01-08  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Add a cleaned-up GraphicsContextSkia implementation to WebKit.
-        https://bugs.webkit.org/show_bug.cgi?id=23191
-
-        * platform/graphics/skia/GraphicsContextSkia.cpp: Added.
-        (WebCore::):
-        (WebCore::GraphicsContext::GraphicsContext):
-        (WebCore::GraphicsContext::~GraphicsContext):
-        (WebCore::GraphicsContext::platformContext):
-        (WebCore::GraphicsContext::savePlatformState):
-        (WebCore::GraphicsContext::restorePlatformState):
-        (WebCore::GraphicsContext::beginTransparencyLayer):
-        (WebCore::GraphicsContext::endTransparencyLayer):
-        (WebCore::GraphicsContext::addInnerRoundedRectClip):
-        (WebCore::GraphicsContext::addPath):
-        (WebCore::GraphicsContext::beginPath):
-        (WebCore::GraphicsContext::clearPlatformShadow):
-        (WebCore::GraphicsContext::clearRect):
-        (WebCore::GraphicsContext::clip):
-        (WebCore::GraphicsContext::clipOut):
-        (WebCore::GraphicsContext::clipOutEllipseInRect):
-        (WebCore::GraphicsContext::clipPath):
-        (WebCore::GraphicsContext::clipToImageBuffer):
-        (WebCore::GraphicsContext::concatCTM):
-        (WebCore::GraphicsContext::drawConvexPolygon):
-        (WebCore::GraphicsContext::drawEllipse):
-        (WebCore::GraphicsContext::drawFocusRing):
-        (WebCore::GraphicsContext::drawLine):
-        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
-        (WebCore::GraphicsContext::drawLineForText):
-        (WebCore::GraphicsContext::drawRect):
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::fillRect):
-        (WebCore::GraphicsContext::fillRoundedRect):
-        (WebCore::GraphicsContext::getCTM):
-        (WebCore::GraphicsContext::roundToDevicePixels):
-        (WebCore::GraphicsContext::scale):
-        (WebCore::GraphicsContext::setAlpha):
-        (WebCore::GraphicsContext::setCompositeOperation):
-        (WebCore::GraphicsContext::setImageInterpolationQuality):
-        (WebCore::GraphicsContext::setLineCap):
-        (WebCore::GraphicsContext::setLineDash):
-        (WebCore::GraphicsContext::setLineJoin):
-        (WebCore::GraphicsContext::setMiterLimit):
-        (WebCore::GraphicsContext::setPlatformFillColor):
-        (WebCore::GraphicsContext::setPlatformShadow):
-        (WebCore::GraphicsContext::setPlatformStrokeColor):
-        (WebCore::GraphicsContext::setPlatformStrokeStyle):
-        (WebCore::GraphicsContext::setPlatformStrokeThickness):
-        (WebCore::GraphicsContext::setPlatformTextDrawingMode):
-        (WebCore::GraphicsContext::setURLForRect):
-        (WebCore::GraphicsContext::setUseAntialiasing):
-        (WebCore::GraphicsContext::strokeArc):
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::strokeRect):
-        (WebCore::GraphicsContext::rotate):
-        (WebCore::GraphicsContext::translate):
-
-2009-01-08  David Hyatt  <hyatt@apple.com>
-
-        Fix for <rdar://problem/6465682> REGRESSION: In Mail, can't force a message to auto scroll.
-
-        Make scrollRectIntoViewRecursively call out to the HostWindow to continue the recursive scroll for
-        any scrollable views that may contain a WebView.  Does nothing on platforms other than the Mac, but
-        might eventually be of interest to other platforms.
-
-        Reviewed by Oliver Hunt
-
-        * WebCore.base.exp:
-        * page/Chrome.cpp:
-        (WebCore::Chrome::scrollRectIntoView):
-        * page/Chrome.h:
-        * page/ChromeClient.h:
-        (WebCore::ChromeClient::scrollRectIntoView):
-        * platform/HostWindow.h:
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::scrollRectIntoViewRecursively):
-
-2009-01-08  Adam Treat  <adam.treat@torchmobile.com>
-
-        Reviewed by David Hyatt.
-
-        No need to make this part of HostWindow and moreover HostWindow should
-        not have any reference to non-platform parts of WebCore.
-
-        * page/Chrome.h:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::setContentsSize):
-        * platform/HostWindow.h:
-
-2009-01-08  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        Simplify Mac interfaces for drawing media controller elements
-
-        <rdar://problem/6293969>
-
-        * WebCore.base.exp: update for changed WebKitSystemInterface media controller functions
-
-        * platform/mac/WebCoreSystemInterface.h: Ditto
-        * platform/mac/WebCoreSystemInterface.mm: Ditto
-
-        * rendering/MediaControlElements.h:
-        (WebCore::): Add MediaControlElements enum
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::paintMediaFullscreenButton):  update for changed WebKitSystemInterface
-        media controller functions
-        (WebCore::RenderThemeMac::paintMediaMuteButton): Ditto
-        (WebCore::RenderThemeMac::paintMediaPlayButton): Ditto
-        (WebCore::RenderThemeMac::paintMediaSeekBackButton): Ditto
-        (WebCore::RenderThemeMac::paintMediaSeekForwardButton): Ditto
-        (WebCore::RenderThemeMac::paintMediaSliderTrack): Ditto
-        (WebCore::RenderThemeMac::paintMediaSliderThumb): Ditto
-
-2009-01-08  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Add two more files for platform/graphics/skia.
-        https://bugs.webkit.org/show_bug.cgi?id=23191
-
-        * platform/graphics/skia/GradientSkia.cpp: Added.
-        (WebCore::Gradient::platformDestroy):
-        (WebCore::F2B):
-        (WebCore::makeSkColor):
-        (WebCore::totalStopsNeeded):
-        (WebCore::fillStops):
-        (WebCore::compareStops):
-        (WebCore::Gradient::platformGradient):
-        (WebCore::Gradient::fill):
-        * platform/graphics/skia/GraphicsContextPlatformPrivate.h: Copied from WebCore/bindings/js/ScriptValue.h.
-        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
-        (WebCore::GraphicsContextPlatformPrivate::context):
-
-2009-01-08  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Eric Seidel.
+        Also ensure that we update composited layer positions correctly
+        inside overflow:scroll layers. We can't assume that the contents
+        are child layers, so we have to go up to the compositing ancestor,
+        and tell it to update all its child layer positions as we do 
+        after layout.
 
-        Commit the right files this time!  (Instead of the ugly unfixed ones.)
-        https://bugs.webkit.org/show_bug.cgi?id=23191
+        Tests: compositing/layers-inside-overflow-scroll.html
+               compositing/self-painting-layers.html
 
-        * platform/graphics/skia/BitmapImageSingleFrameSkia.h:
-        * platform/graphics/skia/FloatPointSkia.cpp:
-        * platform/graphics/skia/FloatRectSkia.cpp:
-        * platform/graphics/skia/IntPointSkia.cpp:
-        * platform/graphics/skia/IntRectSkia.cpp:
-        (WebCore::IntRect::operator SkRect):
-        * platform/graphics/skia/SkiaUtils.cpp:
-        (WebCore::):
-        (WebCore::WebCoreCompositeToSkiaComposite):
-        (WebCore::SkPMColorToWebCoreColor):
-        (WebCore::IntersectRectAndRegion):
-        (WebCore::ClipRectToCanvas):
-        (WebCore::SkPathContainsPoint):
-        (WebCore::scratchContext):
-        * platform/graphics/skia/SkiaUtils.h:
-        (WebCore::WebCoreFloatToSkScalar):
-        (WebCore::WebCoreDoubleToSkScalar):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollToOffset):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        (WebCore::RenderLayerCompositor::needsToBeComposited):
 
-2009-01-08  Dimitri Glazkov  <dglazkov@chromium.org>
+2009-06-28  Luke Kenneth Casson Leighton  <lkcl@lkcl.net>
 
         Reviewed by Eric Seidel.
 
-        Add the first few files from platform/graphics/skia
-        https://bugs.webkit.org/show_bug.cgi?id=23191
-
-        These are all pretty simple.
-        Eventually BitmapImageSingleFrameSkia might grow a .cpp file, for now it's just a header.
-        SkiaUtils needs to die, but that can come later, no need to block up-streaming now.
-
-        * platform/graphics/skia/BitmapImageSingleFrameSkia.h: Added.
-        (WebCore::BitmapImageSingleFrameSkia::isBitmapImage):
-        (WebCore::BitmapImageSingleFrameSkia::size):
-        (WebCore::BitmapImageSingleFrameSkia::destroyDecodedData):
-        (WebCore::BitmapImageSingleFrameSkia::decodedSize):
-        (WebCore::BitmapImageSingleFrameSkia::nativeImageForCurrentFrame):
-        (WebCore::BitmapImageSingleFrameSkia::BitmapImageSingleFrameSkia):
-        * platform/graphics/skia/FloatPointSkia.cpp: Copied from WebCore/platform/graphics/mac/FloatPointMac.mm.
-        (WebCore::FloatPoint::FloatPoint):
-        (WebCore::FloatPoint::operator SkPoint):
-        * platform/graphics/skia/FloatRectSkia.cpp: Copied from WebCore/platform/graphics/qt/IntRectQt.cpp.
-        (WebCore::FloatRect::FloatRect):
-        (WebCore::FloatRect::operator SkRect):
-        * platform/graphics/skia/IntPointSkia.cpp: Copied from WebCore/platform/graphics/win/IntPointWin.cpp.
-        (WebCore::IntPoint::IntPoint):
-        (WebCore::IntPoint::operator SkIPoint):
-        (WebCore::IntPoint::operator SkPoint):
-        * platform/graphics/skia/IntRectSkia.cpp: Copied from WebCore/platform/graphics/qt/IntRectQt.cpp.
-        (WebCore::IntRect::operator SkIRect):
-        (WebCore::IntRect::operator SkRect):
-        (WebCore::IntRect::IntRect):
-        * platform/graphics/skia/SkiaUtils.cpp: Added.
-        (WebCore::WebCorePointToSkiaPoint):
-        (WebCore::WebCoreRectToSkiaRect):
-        (WebCore::):
-        (WebCore::WebCoreCompositeToSkiaComposite):
-        (WebCore::InvScaleByte):
-        (WebCore::SkPMColorToColor):
-        (WebCore::SkPMColorToWebCoreColor):
-        (WebCore::IntersectRectAndRegion):
-        (WebCore::ClipRectToCanvas):
-        (WebCore::SkPathContainsPoint):
-        (WebCore::scratchContext):
-        * platform/graphics/skia/SkiaUtils.h: Added.
-        (WebCore::WebCoreFloatToSkScalar):
-        (WebCore::WebCoreDoubleToSkScalar):
-
-2009-01-08  Pierre-Olivier Latour  <pol@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Fixed CSS Transitions with zero-duration but non-zero-delay not starting or ending properly.
-
-        Also updated AnimationController::numberOfActiveAnimations() which now returns the number of "active" animations,
-        instead of simply the "running" ones.
+        PurgeableBuffer #defines leave out functions on gtk MacOSX 10.4 build
+        https://bugs.webkit.org/show_bug.cgi?id=23057
 
-        https://bugs.webkit.org/show_bug.cgi?id=23177
+        Define these functions for Gtk as well.
 
-        Tests: transitions/zero-duration-with-non-zero-delay-end.html
-               transitions/zero-duration-with-non-zero-delay-start.html
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::fireAnimationEventsIfNeeded):
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::animationTimerFired):
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimationPrivate::numberOfActiveAnimations):
-
-2009-01-08  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        <rdar://problem/6477501> Repro crash loading HTML5 AppCache manifest directly
-
-        The crash happened whenever a cached resource was downloaded, as opposed to used directly.
-
-        No test, as downloading cannot be tested automatically.
-
-        * loader/MainResourceLoader.cpp: (WebCore::MainResourceLoader::continueAfterContentPolicy):
-        Cancel downloads that do not have an associated ResourceHandle, such as downloads from the
-        application cache. Activity window shows "The URL can't be shown", and the frame remains empty.
-
-2009-01-08  Justin McPherson <justin.mcpherson@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Fix the Qt build on older X11 systems with special X paths.
-
-        * WebCore.pro: Use the x11 qmake config to pull in extra paths
-        needed for NPAPI.
-
-2009-01-08  Adam Roben  <aroben@apple.com>
-
-        Windows build fix after r39699
-
-        * DerivedSources.cpp: Added JSDOMStringList.cpp.
-
-2009-01-08  Kent Hansen  <khansen@trolltech.com>
-
-        Reviewed by Simon Hausmann.
-
-        Fix copy & paste of images in the Qt port.
-
-        Store the QPixmap itself in the mimedata, not a QPixmap* converted to bool.
-
-        * platform/qt/ClipboardQt.cpp:
-        (WebCore::ClipboardQt::declareAndWriteDragImage):
-
-2009-01-08  Hiroyuki Ikezoe  <poincare@ikezoe.net>
+        * platform/PurgeableBuffer.h:
 
-        Reviewed by Holger Freyther.
+2009-06-28  Nate Chapin  <japhet@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=23127
+        Reviewed by Dimitri Glazkov.
 
-        Invoke pango_coverage_get with each Unicode character.
+        Update CodeGeneratorV8.pm to match the new api for V8Proxy.
 
-        * platform/graphics/gtk/SimpleFontDataPango.cpp:
-        (WebCore::SimpleFontData::containsCharacters):
+        https://bugs.webkit.org/show_bug.cgi?id=26765
 
-2009-01-07  Alexey Proskuryakov  <ap@webkit.org>
+        * bindings/scripts/CodeGeneratorV8.pm: Match the current version of V8Proxy.
 
-        Reviewed by Darin Adler.
+2009-06-28  Nicolas Sylvain  <nsylvain@chromium.org>
 
-        Part one of 
-        https://bugs.webkit.org/show_bug.cgi?id=23165
-        Add support for application cache dynamic entries
+        Reviewed by Dimitri Glazkov.
 
-        Test: http/tests/appcache/dynamic-entries-no-cache.html
+        If loading a font fails because of the sandbox, we ask the browser process to 
+        try to load it by calling ensureFontLoaded. If it still fails after 
+        ensureFontLoaded, we hit a ASSERT_NOT_REACHED. 
 
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.scons:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        Added new files.
+        This case happens once in a while during browser shutdown. The browser will 
+        queue a message to the renderer to shutdown, and will then stop answering sync 
+        messages from the renderer. If the renderer is still loading a page during this 
+        time, it might try to call the browser process to ask to load a font. The 
+        browser process will ignore the request, and the font will fail to load, even 
+        after the second try. 
 
-        * bindings/js/JSDOMApplicationCacheCustom.cpp: (WebCore::JSDOMApplicationCache::hasItem):
-        Added binding for hasItem(). Like other DOMApplicationCache methods, it needs to be custom
-        to resolve relative URLs correctly.
+        This is unfortunate, but there is no real risk here, since the renderer will be 
+        going away as soon as it processes another message. 
 
-        * bindings/js/JSDOMStringListCustom.cpp: Added.
-        * dom/DOMStringList.cpp: Added.
-        * dom/DOMStringList.h: Added.
-        * dom/DOMStringList.idl: Added.
-        Added an implementation of DOM 3 Core DOMStringList interface, which is returned by
-        DOMApplicationCache items attribute.
+        This can't be layout tested as it depends on the sandbox. 
 
-        * dom/StaticStringList.cpp: Added.
-        * dom/StaticStringList.h: Added.
-        An implementation of DOMStringList that makes a snapshot (for DOMApplicationCache, this
-        matches Firefox, as the spec doesn't say whether the returned list should be live or not).
+        https://bugs.webkit.org/show_bug.cgi?id=26743 
 
-        * loader/appcache/ApplicationCache.h: Added a list of pending dynamic entry actions, to be
-        used in the near future.
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        * platform/graphics/chromium/FontPlatformDataChromiumWin.cpp:
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
 
-        * loader/appcache/DOMApplicationCache.idl: Updated for spec changes. Instead of length 
-        attribute and item(), we now have an items attribute that returns a DOMStringList, and a
-        hasItem convenience method.
-
-        * loader/appcache/DOMApplicationCache.cpp:
-        (WebCore::DOMApplicationCache::items):
-        (WebCore::DOMApplicationCache::hasItem):
-        * loader/appcache/DOMApplicationCache.h:
-        Added implementations of items attribute and hasItem() (note that underlying ApplicationCache
-        methods are still unimplemented though).
-
-        * page/DOMWindow.idl: Expose a DOMStringList global constructor.
-
-2009-01-07  Chris Marrin  <cmarrin@apple.com>
+2009-06-28  John Abd-El-Malek  <jam@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        https://bugs.webkit.org/show_bug.cgi?id=23122
-
-        This completes the removal of dependencies on WebKit from the platform code
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::getDelayValue):
-        (WebCore::getDurationValue):
-        (WebCore::getTimingFunctionValue):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSHelper.h:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::mapAnimationDelay):
-        (WebCore::CSSStyleSelector::mapAnimationDirection):
-        (WebCore::CSSStyleSelector::mapAnimationDuration):
-        (WebCore::CSSStyleSelector::mapAnimationIterationCount):
-        (WebCore::CSSStyleSelector::mapAnimationName):
-        (WebCore::CSSStyleSelector::mapAnimationPlayState):
-        (WebCore::CSSStyleSelector::mapAnimationProperty):
-        (WebCore::CSSStyleSelector::mapAnimationTimingFunction):
-        * platform/animation/Animation.cpp:
-        (WebCore::Animation::Animation):
-        * platform/animation/Animation.h:
-        (WebCore::Animation::initialAnimationDelay):
-        (WebCore::Animation::initialAnimationDirection):
-        (WebCore::Animation::initialAnimationDuration):
-        (WebCore::Animation::initialAnimationIterationCount):
-        (WebCore::Animation::initialAnimationName):
-        (WebCore::Animation::initialAnimationPlayState):
-        (WebCore::Animation::initialAnimationProperty):
-        (WebCore::Animation::initialAnimationTimingFunction):
-        * rendering/style/RenderStyle.h:
-
-2008-01-07  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22929
-
-        Fix errors while decoding GIFs by not calling setData() repeatedly
-        when it's not necessary.  Pushes the responsibility for calling
-        setData() after clear() into the ImageSource which presumably knows
-        better than BitmapImage what needs to be done.
-
-        NOTE: The above bug is mainly about a memory regression, which this
-        patch does not fix.
-
-        * platform/graphics/BitmapImage.cpp:
-        (WebCore::BitmapImage::destroyDecodedData):
-        * platform/graphics/ImageSource.h:
-        * platform/graphics/cairo/ImageSourceCairo.cpp:
-        (WebCore::ImageSource::clear):
-        * platform/graphics/cg/ImageSourceCG.cpp:
-        (WebCore::ImageSource::clear):
-        * platform/graphics/qt/ImageSourceQt.cpp:
-        (WebCore::ImageSource::~ImageSource):
-        (WebCore::ImageSource::clear):
-        * platform/graphics/wx/ImageSourceWx.cpp:
-        (WebCore::ImageSource::~ImageSource):
-        (WebCore::ImageSource::clear):
-
-2009-01-07  Justin Garcia  <justin.garcia@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/6355786> Find fails for queries that contain a line break
-
-        * editing/TextIterator.cpp:
-        (WebCore::findPlainText): Allow find with queries that contain newlines.
-
-2009-01-07  Dean Jackson  <dino@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Allow removal of inline shorthand properties for
-        animation, transition and transform origin. Also
-        add getter for shorthand animation property.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22605
-
-        Test: fast/css/transform-inline-style-remove.html
+        https://bugs.webkit.org/show_bug.cgi?id=15457
 
-        * css/CSSMutableStyleDeclaration.cpp:
-        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
-            Getter for animation property shorthand
-        (WebCore::initShorthandMap):
-            Adds initialisation for transform-origin, animation and transition
-
-2009-01-07  Benjamin Otte  <otte@gnome.org>
-
-        Reviewed by Holger Freyther.
+        Test: plugins/netscape-plugin-map-data-to-src.html
 
-        * platform/network/ResourceHandleInternal.h:
-        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::ResourceHandleInternal::~ResourceHandleInternal):
-        (WebCore::parseDataUrl):
-        (WebCore::ResourceHandle::startData): keep track of the idle handler
-        we add and remove it in the destructor
+        Fix problems with Real or WMP plugins not displaying because "data" was set
+        on the OBJECT tag instead of "src".  This is based on what Firefox does, see
+        http://mxr.mozilla.org/mozilla-central/source/layout/generic/nsObjectFrame.cpp#3045
 
-2009-01-07  Dean Jackson  <dino@apple.com>
+        * rendering/RenderPartObject.cpp:
+        (WebCore::mapDataParamToSrc):
+        (WebCore::RenderPartObject::updateWidget):
 
-        Reviewed by Darin Adler.
+2009-06-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        Finish renaming of AffineTransform to TransformationMatrix, this
-        time ensuring that the platform implementations get the correct
-        name. Also, clean up some whitespace cruft in old content.
+        Reviewed by Jan Alonzo.
 
-        https://bugs.webkit.org/show_bug.cgi?id=23151
+        [Qt] Build fix after r45290
+        https://bugs.webkit.org/show_bug.cgi?id=26769
 
-        * GNUmakefile.am:
         * WebCore.pro:
-        * WebCore.scons:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/graphics/cairo/AffineTransformCairo.cpp: Removed.
-        * platform/graphics/cairo/TransformationMatrixCairo.cpp: Copied from WebCore/platform/graphics/cairo/AffineTransformCairo.cpp.
-        * platform/graphics/cg/AffineTransformCG.cpp: Removed.
-        * platform/graphics/cg/TransformationMatrixCG.cpp: Copied from WebCore/platform/graphics/cg/AffineTransformCG.cpp.
-        * platform/graphics/qt/AffineTransformQt.cpp: Removed.
-        * platform/graphics/qt/TransformationMatrixQt.cpp: Copied from WebCore/platform/graphics/qt/AffineTransformQt.cpp.
-        * platform/graphics/transforms/TransformationMatrix.cpp:
-        * platform/graphics/transforms/TransformationMatrix.h:
-        * platform/graphics/wx/AffineTransformWx.cpp: Removed.
-        * platform/graphics/wx/TransformationMatrixWx.cpp: Copied from WebCore/platform/graphics/wx/AffineTransformWx.cpp.
-        * webcore-wx.bkl:
-
-2009-01-07  Anders Carlsson  <andersca@apple.com>
-
-        Another build fix.
-        
-        * WebCore.LP64.exp:
-
-2008-12-16  David Hyatt  <hyatt@apple.com>
-
-        Make Safari RSS behave nicely with full page zoom.  Need to add a new value to enable resetting of zoom
-        back to the document-level default.
-
-        Reviewed by Darin Adler
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * css/CSSValueKeywords.in:
 
-2009-01-07  Darin Adler  <darin@apple.com>
+2009-06-27  Emilio Pozuelo Monfort  <pochu27@gmail.com>
 
-        Reviewed by Oliver Hunt.
-
-        Bug 23160: add setMemoryCacheClientCallsEnabled SPI so Safari can be faster with activity window closed
-        https://bugs.webkit.org/show_bug.cgi?id=23160
-
-        * WebCore.base.exp: Added Page::setMemoryCacheClientCallsEnabled.
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::didLoadResourceFromMemoryCache): Updated to take a CachedResource
-        so that there's no extra work the caller has to do when the inspector is disabled.
-        * inspector/InspectorController.h: Ditto.
-
-        * loader/DocumentLoader.h: Added recordMemoryCacheLoadForFutureClientNotification,
-        takeMemoryCacheLoadsForClientNotification, and m_resourcesLoadedFromMemoryCacheForClientNotification.
+        Reviewed by Jan Alonzo.
 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadedResourceFromMemoryCache): Streamlined code so less work is done when
-        there's no inspector or client call needed. Added code to check areMemoryCacheClientCallsEnabled
-        and if it's false, use recordMemoryCacheLoadForFutureClientNotification.
-        (WebCore::FrameLoader::tellClientAboutPastMemoryCacheLoads): Added.
-        * loader/FrameLoader.h: Ditto.
-
-        * page/Page.cpp:
-        (WebCore::Page::Page): Initialize m_areMemoryCacheClientCallsEnabled to be compatible with old behavior.
-        (WebCore::Page::setMemoryCacheClientCallsEnabled): Added.
-        * page/Page.h: Added setMemoryCacheClientCallsEnabled, areMemoryCacheClientCallsEnabled,
-        and m_areMemoryCacheClientCallsEnabled.
-
-2009-01-07  Ariya Hidayat  <ariya.hidayat@trolltech.com>
-
-        Rubber-stamped by Simon Hausmann.
+        [GTK] Don't use deprecated GTK+ symbols.
+        https://bugs.webkit.org/show_bug.cgi?id=26583
 
-        Qt build fix after r39670.
-
-        * bridge/qt/qt_class.cpp:
-        (JSC::Bindings::QtClass::fallbackObject):
-        * bridge/qt/qt_class.h:
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtInstance::mark):
-        (JSC::Bindings::QtInstance::invokeMethod):
-        (JSC::Bindings::QtInstance::defaultValue):
-        (JSC::Bindings::QtInstance::stringValue):
-        (JSC::Bindings::QtInstance::numberValue):
-        (JSC::Bindings::QtInstance::booleanValue):
-        (JSC::Bindings::QtInstance::valueOf):
-        (JSC::Bindings::QtField::valueFromInstance):
-        (JSC::Bindings::QtField::setValueToInstance):
-        * bridge/qt/qt_instance.h:
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::valueRealType):
-        (JSC::Bindings::convertValueToQVariant):
-        (JSC::Bindings::convertQVariantToValue):
-        (JSC::Bindings::findMethodIndex):
-        (JSC::Bindings::QtRuntimeMetaMethod::call):
-        (JSC::Bindings::QtRuntimeMetaMethod::lengthGetter):
-        (JSC::Bindings::QtRuntimeMetaMethod::connectGetter):
-        (JSC::Bindings::QtRuntimeMetaMethod::disconnectGetter):
-        (JSC::Bindings::QtRuntimeConnectionMethod::call):
-        (JSC::Bindings::QtRuntimeConnectionMethod::lengthGetter):
-        (JSC::Bindings::::setValueAt):
-        (JSC::Bindings::::valueAt):
-        * bridge/qt/qt_runtime.h:
-        (JSC::Bindings::QtRuntimeMethod::createStructure):
-
-2009-01-06  Justin Garcia  <justin.garcia@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        <rdar://problem/6391734> SnowLeopard: Crash doing Copy Image from context menu
-        
-        Can't create an automated test case for specific contextual menu items yet and
-        a normal Copy doesn't cause a crash.
-
-        * platform/mac/PasteboardMac.mm:
-        (WebCore::fileWrapperForImage): The SharedBuffer may not have platform data.  It may,
-        for example, have a purgeable or regular buffer.
-
-2009-01-06  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Fix <https://bugs.webkit.org/show_bug.cgi?id=23157>.
-        Bug 23157: Crashes on Acid 3
-
-        * dom/Document.cpp:
-        (WebCore::Document::recalcStyle): Null-check the frame.
-
-2009-01-05  Gavin Barraclough  <baraclough@apple.com>
-
-        Rubber Stamped by Oliver Hunt.
-
-        Replace all uses of JSValue* with new wrapper class, JSValuePtr.
-        See JavaScriptCore/ChangeLog for more detailed description.
-
-        * bindings/js/JSAttrCustom.cpp:
-        (WebCore::JSAttr::setValue):
-        * bindings/js/JSCSSRuleCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
-        (WebCore::JSCSSStyleDeclaration::nameGetter):
-        (WebCore::JSCSSStyleDeclaration::customPut):
-        * bindings/js/JSCSSValueCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSCanvasPixelArrayCustom.h:
-        (WebCore::JSCanvasPixelArray::getByIndex):
-        (WebCore::JSCanvasPixelArray::indexSetter):
-        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
-        (WebCore::toJS):
-        (WebCore::toHTMLCanvasStyle):
-        (WebCore::JSCanvasRenderingContext2D::strokeStyle):
-        (WebCore::JSCanvasRenderingContext2D::setStrokeStyle):
-        (WebCore::JSCanvasRenderingContext2D::fillStyle):
-        (WebCore::JSCanvasRenderingContext2D::setFillStyle):
-        (WebCore::JSCanvasRenderingContext2D::setFillColor):
-        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
-        (WebCore::JSCanvasRenderingContext2D::strokeRect):
-        (WebCore::JSCanvasRenderingContext2D::drawImage):
-        (WebCore::JSCanvasRenderingContext2D::drawImageFromRect):
-        (WebCore::JSCanvasRenderingContext2D::setShadow):
-        (WebCore::JSCanvasRenderingContext2D::createPattern):
-        (WebCore::JSCanvasRenderingContext2D::putImageData):
-        (WebCore::JSCanvasRenderingContext2D::fillText):
-        (WebCore::JSCanvasRenderingContext2D::strokeText):
-        * bindings/js/JSClipboardCustom.cpp:
-        (WebCore::JSClipboard::types):
-        (WebCore::JSClipboard::clearData):
-        (WebCore::JSClipboard::getData):
-        (WebCore::JSClipboard::setData):
-        (WebCore::JSClipboard::setDragImage):
-        * bindings/js/JSConsoleCustom.cpp:
-        (WebCore::JSConsole::profiles):
-        * bindings/js/JSCustomPositionCallback.cpp:
-        (WebCore::JSCustomPositionCallback::handleEvent):
-        * bindings/js/JSCustomPositionErrorCallback.cpp:
-        (WebCore::JSCustomPositionErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementCallback.cpp:
-        (WebCore::JSCustomSQLStatementCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
-        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionCallback.cpp:
-        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
-        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
-        * bindings/js/JSCustomVoidCallback.cpp:
-        (WebCore::JSCustomVoidCallback::handleEvent):
-        (WebCore::toVoidCallback):
-        * bindings/js/JSCustomVoidCallback.h:
-        * bindings/js/JSCustomXPathNSResolver.cpp:
-        (WebCore::JSCustomXPathNSResolver::create):
-        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/js/JSCustomXPathNSResolver.h:
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::add):
-        (WebCore::JSDOMApplicationCache::remove):
-        (WebCore::JSDOMApplicationCache::addEventListener):
-        (WebCore::JSDOMApplicationCache::removeEventListener):
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::jsStringOrNull):
-        (WebCore::jsOwnedStringOrNull):
-        (WebCore::jsStringOrUndefined):
-        (WebCore::jsStringOrFalse):
-        (WebCore::valueToStringWithNullCheck):
-        (WebCore::valueToStringWithUndefinedOrNullCheck):
-        (WebCore::reportException):
-        (WebCore::reportCurrentException):
-        (WebCore::setDOMException):
-        (WebCore::objectToStringFunctionGetter):
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::getDOMObjectWrapper):
-        (WebCore::getDOMNodeWrapper):
-        (WebCore::toJS):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::findJSEventListener):
-        (WebCore::JSDOMGlobalObject::findOrCreateJSEventListener):
-        (WebCore::JSDOMGlobalObject::findJSUnprotectedEventListener):
-        (WebCore::JSDOMGlobalObject::findOrCreateJSUnprotectedEventListener):
-        * bindings/js/JSDOMGlobalObject.h:
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::createWindow):
-        (WebCore::showModalDialog):
-        (jsDOMWindowBaseCrypto):
-        (jsDOMWindowBaseEvent):
-        (jsDOMWindowBaseImage):
-        (jsDOMWindowBaseMessageChannel):
-        (jsDOMWindowBaseOption):
-        (jsDOMWindowBaseXMLHttpRequest):
-        (jsDOMWindowBaseAudio):
-        (jsDOMWindowBaseWorker):
-        (jsDOMWindowBaseXSLTProcessor):
-        (setJSDOMWindowBaseEvent):
-        (setJSDOMWindowBaseAudio):
-        (setJSDOMWindowBaseImage):
-        (setJSDOMWindowBaseMessageChannel):
-        (setJSDOMWindowBaseOption):
-        (setJSDOMWindowBaseWorker):
-        (setJSDOMWindowBaseXMLHttpRequest):
-        (setJSDOMWindowBaseXSLTProcessor):
-        (WebCore::JSDOMWindowBase::childFrameGetter):
-        (WebCore::JSDOMWindowBase::indexGetter):
-        (WebCore::JSDOMWindowBase::namedItemGetter):
-        (WebCore::JSDOMWindowBase::getOwnPropertySlot):
-        (WebCore::JSDOMWindowBase::put):
-        (WebCore::JSDOMWindowBase::clear):
-        (windowProtoFuncOpen):
-        (windowProtoFuncShowModalDialog):
-        (windowProtoFuncNotImplemented):
-        (WebCore::JSDOMWindowBase::setReturnValueSlot):
-        (WebCore::JSDOMWindowBase::installTimeout):
-        (WebCore::toJS):
-        (WebCore::toJSDOMWindow):
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::lookupGetter):
-        (WebCore::JSDOMWindow::lookupSetter):
-        (WebCore::JSDOMWindow::setLocation):
-        (WebCore::JSDOMWindow::postMessage):
-        (WebCore::setTimeoutOrInterval):
-        (WebCore::JSDOMWindow::setTimeout):
-        (WebCore::JSDOMWindow::clearTimeout):
-        (WebCore::JSDOMWindow::setInterval):
-        (WebCore::JSDOMWindow::clearInterval):
-        (WebCore::JSDOMWindow::atob):
-        (WebCore::JSDOMWindow::btoa):
-        (WebCore::JSDOMWindow::addEventListener):
-        (WebCore::JSDOMWindow::removeEventListener):
-        (WebCore::toDOMWindow):
-        (WebCore::nonCachingStaticCloseFunctionGetter):
-        (WebCore::nonCachingStaticBlurFunctionGetter):
-        (WebCore::nonCachingStaticFocusFunctionGetter):
-        (WebCore::nonCachingStaticPostMessageFunctionGetter):
-        * bindings/js/JSDOMWindowCustom.h:
-        (WebCore::JSDOMWindow::customPut):
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::JSDOMWindowShell::put):
-        (WebCore::JSDOMWindowShell::putWithAttributes):
-        (WebCore::JSDOMWindowShell::lookupGetter):
-        (WebCore::JSDOMWindowShell::lookupSetter):
-        (WebCore::toJS):
-        * bindings/js/JSDOMWindowShell.h:
-        (WebCore::JSDOMWindowShell::createStructure):
-        * bindings/js/JSDatabaseCustom.cpp:
-        (WebCore::JSDatabase::changeVersion):
-        (WebCore::JSDatabase::transaction):
-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::JSDocument::location):
-        (WebCore::JSDocument::setLocation):
-        (WebCore::toJS):
-        * bindings/js/JSElementCustom.cpp:
-        (WebCore::JSElement::setAttribute):
-        (WebCore::JSElement::setAttributeNode):
-        (WebCore::JSElement::setAttributeNS):
-        (WebCore::JSElement::setAttributeNodeNS):
-        (WebCore::toJSNewlyCreated):
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::JSEvent::clipboardData):
-        (WebCore::toJS):
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSAbstractEventListener::handleEvent):
-        (WebCore::eventParameterName):
-        (WebCore::JSLazyEventListener::parseCode):
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSEventTarget.h:
-        * bindings/js/JSEventTargetBase.h:
-        * bindings/js/JSEventTargetNodeCustom.cpp:
-        (WebCore::JSEventTargetNode::addEventListener):
-        (WebCore::JSEventTargetNode::removeEventListener):
-        * bindings/js/JSGeolocationCustom.cpp:
-        (WebCore::createPositionOptions):
-        (WebCore::JSGeolocation::getCurrentPosition):
-        (WebCore::JSGeolocation::watchPosition):
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::createStructure):
-        * bindings/js/JSHTMLAppletElementCustom.cpp:
-        (WebCore::JSHTMLAppletElement::customPut):
-        (WebCore::JSHTMLAppletElement::nameGetter):
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::getNamedItems):
-        (WebCore::callHTMLCollection):
-        (WebCore::JSHTMLCollection::nameGetter):
-        (WebCore::JSHTMLCollection::item):
-        (WebCore::JSHTMLCollection::namedItem):
-        (WebCore::toJS):
-        * bindings/js/JSHTMLDocumentCustom.cpp:
-        (WebCore::JSHTMLDocument::nameGetter):
-        (WebCore::JSHTMLDocument::all):
-        (WebCore::JSHTMLDocument::setAll):
-        (WebCore::JSHTMLDocument::open):
-        (WebCore::JSHTMLDocument::write):
-        (WebCore::JSHTMLDocument::writeln):
-        * bindings/js/JSHTMLEmbedElementCustom.cpp:
-        (WebCore::JSHTMLEmbedElement::customPut):
-        (WebCore::JSHTMLEmbedElement::nameGetter):
-        * bindings/js/JSHTMLFormElementCustom.cpp:
-        (WebCore::JSHTMLFormElement::nameGetter):
-        * bindings/js/JSHTMLFrameElementCustom.cpp:
-        (WebCore::JSHTMLFrameElement::setSrc):
-        (WebCore::JSHTMLFrameElement::setLocation):
-        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
-        (WebCore::JSHTMLFrameSetElement::nameGetter):
-        * bindings/js/JSHTMLIFrameElementCustom.cpp:
-        (WebCore::JSHTMLIFrameElement::setSrc):
-        * bindings/js/JSHTMLInputElementCustom.cpp:
-        (WebCore::JSHTMLInputElement::selectionStart):
-        (WebCore::JSHTMLInputElement::selectionEnd):
-        * bindings/js/JSHTMLObjectElementCustom.cpp:
-        (WebCore::JSHTMLObjectElement::customPut):
-        (WebCore::JSHTMLObjectElement::nameGetter):
-        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
-        (WebCore::JSHTMLOptionsCollection::length):
-        (WebCore::JSHTMLOptionsCollection::setLength):
-        (WebCore::JSHTMLOptionsCollection::indexSetter):
-        (WebCore::JSHTMLOptionsCollection::add):
-        (WebCore::JSHTMLOptionsCollection::remove):
-        * bindings/js/JSHTMLSelectElementCustom.cpp:
-        (WebCore::JSHTMLSelectElement::remove):
-        (WebCore::selectIndexSetter):
-        (WebCore::JSHTMLSelectElement::indexSetter):
-        * bindings/js/JSHTMLSelectElementCustom.h:
-        * bindings/js/JSHistoryCustom.cpp:
-        (WebCore::nonCachingStaticBackFunctionGetter):
-        (WebCore::nonCachingStaticForwardFunctionGetter):
-        (WebCore::nonCachingStaticGoFunctionGetter):
-        (WebCore::JSHistory::customPut):
-        * bindings/js/JSImageDataCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSInspectedObjectWrapper.cpp:
-        (WebCore::JSInspectedObjectWrapper::wrap):
-        (WebCore::JSInspectedObjectWrapper::prepareIncomingValue):
-        * bindings/js/JSInspectedObjectWrapper.h:
-        (WebCore::JSInspectedObjectWrapper::wrapOutgoingValue):
-        * bindings/js/JSInspectorCallbackWrapper.cpp:
-        (WebCore::JSInspectorCallbackWrapper::wrap):
-        (WebCore::JSInspectorCallbackWrapper::prepareIncomingValue):
-        * bindings/js/JSInspectorCallbackWrapper.h:
-        (WebCore::JSInspectorCallbackWrapper::wrapOutgoingValue):
-        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
-        (WebCore::JSJavaScriptCallFrame::evaluate):
-        (WebCore::JSJavaScriptCallFrame::thisObject):
-        (WebCore::JSJavaScriptCallFrame::type):
-        (WebCore::JSJavaScriptCallFrame::scopeChain):
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::nonCachingStaticReplaceFunctionGetter):
-        (WebCore::nonCachingStaticReloadFunctionGetter):
-        (WebCore::nonCachingStaticAssignFunctionGetter):
-        (WebCore::JSLocation::customPut):
-        (WebCore::JSLocation::setHref):
-        (WebCore::JSLocation::setProtocol):
-        (WebCore::JSLocation::setHost):
-        (WebCore::JSLocation::setHostname):
-        (WebCore::JSLocation::setPort):
-        (WebCore::JSLocation::setPathname):
-        (WebCore::JSLocation::setSearch):
-        (WebCore::JSLocation::setHash):
-        (WebCore::JSLocation::replace):
-        (WebCore::JSLocation::reload):
-        (WebCore::JSLocation::assign):
-        (WebCore::JSLocation::toString):
-        * bindings/js/JSMessageChannelConstructor.h:
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::startConversation):
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        * bindings/js/JSMimeTypeArrayCustom.cpp:
-        (WebCore::JSMimeTypeArray::nameGetter):
-        * bindings/js/JSNamedNodeMapCustom.cpp:
-        (WebCore::JSNamedNodeMap::nameGetter):
-        * bindings/js/JSNamedNodesCollection.cpp:
-        (WebCore::JSNamedNodesCollection::lengthGetter):
-        (WebCore::JSNamedNodesCollection::indexGetter):
-        * bindings/js/JSNamedNodesCollection.h:
-        (WebCore::JSNamedNodesCollection::createStructure):
-        * bindings/js/JSNavigatorCustom.cpp:
-        (WebCore::needsYouTubeQuirk):
-        (WebCore::JSNavigator::appVersion):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::insertBefore):
-        (WebCore::JSNode::replaceChild):
-        (WebCore::JSNode::removeChild):
-        (WebCore::JSNode::appendChild):
-        (WebCore::createWrapper):
-        (WebCore::toJSNewlyCreated):
-        (WebCore::toJS):
-        * bindings/js/JSNodeFilterCondition.cpp:
-        (WebCore::JSNodeFilterCondition::JSNodeFilterCondition):
-        (WebCore::JSNodeFilterCondition::acceptNode):
-        * bindings/js/JSNodeFilterCondition.h:
-        (WebCore::JSNodeFilterCondition::create):
-        * bindings/js/JSNodeFilterCustom.cpp:
-        (WebCore::JSNodeFilter::acceptNode):
-        (WebCore::toNodeFilter):
-        * bindings/js/JSNodeIteratorCustom.cpp:
-        (WebCore::JSNodeIterator::nextNode):
-        (WebCore::JSNodeIterator::previousNode):
-        * bindings/js/JSNodeListCustom.cpp:
-        (WebCore::callNodeList):
-        (WebCore::JSNodeList::nameGetter):
-        * bindings/js/JSPluginArrayCustom.cpp:
-        (WebCore::JSPluginArray::nameGetter):
-        * bindings/js/JSPluginCustom.cpp:
-        (WebCore::JSPlugin::nameGetter):
-        * bindings/js/JSPluginElementFunctions.cpp:
-        (WebCore::runtimeObjectGetter):
-        (WebCore::runtimeObjectPropertyGetter):
-        (WebCore::runtimeObjectCustomPut):
-        (WebCore::callPlugin):
-        * bindings/js/JSPluginElementFunctions.h:
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::asWrapper):
-        (WebCore::JSQuarantinedObjectWrapper::cachedValueGetter):
-        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertySlot):
-        (WebCore::JSQuarantinedObjectWrapper::put):
-        (WebCore::JSQuarantinedObjectWrapper::construct):
-        (WebCore::JSQuarantinedObjectWrapper::hasInstance):
-        (WebCore::JSQuarantinedObjectWrapper::call):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        (WebCore::JSQuarantinedObjectWrapper::createStructure):
-        * bindings/js/JSRGBColor.cpp:
-        (WebCore::getJSRGBColor):
-        (jsRGBColorRed):
-        (jsRGBColorGreen):
-        (jsRGBColorBlue):
-        * bindings/js/JSRGBColor.h:
-        (WebCore::JSRGBColor::createStructure):
-        * bindings/js/JSSQLResultSetRowListCustom.cpp:
-        (WebCore::JSSQLResultSetRowList::item):
-        * bindings/js/JSSQLTransactionCustom.cpp:
-        (WebCore::JSSQLTransaction::executeSql):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::addEventListener):
-        (WebCore::JSSVGElementInstance::removeEventListener):
-        * bindings/js/JSSVGLengthCustom.cpp:
-        (WebCore::JSSVGLength::value):
-        (WebCore::JSSVGLength::convertToSpecifiedUnits):
-        * bindings/js/JSSVGMatrixCustom.cpp:
-        (WebCore::JSSVGMatrix::multiply):
-        (WebCore::JSSVGMatrix::inverse):
-        (WebCore::JSSVGMatrix::translate):
-        (WebCore::JSSVGMatrix::scale):
-        (WebCore::JSSVGMatrix::scaleNonUniform):
-        (WebCore::JSSVGMatrix::rotate):
-        (WebCore::JSSVGMatrix::rotateFromVector):
-        (WebCore::JSSVGMatrix::flipX):
-        (WebCore::JSSVGMatrix::flipY):
-        (WebCore::JSSVGMatrix::skewX):
-        (WebCore::JSSVGMatrix::skewY):
-        * bindings/js/JSSVGPathSegCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSSVGPathSegListCustom.cpp:
-        (WebCore::JSSVGPathSegList::clear):
-        (WebCore::JSSVGPathSegList::initialize):
-        (WebCore::JSSVGPathSegList::getItem):
-        (WebCore::JSSVGPathSegList::insertItemBefore):
-        (WebCore::JSSVGPathSegList::replaceItem):
-        (WebCore::JSSVGPathSegList::removeItem):
-        (WebCore::JSSVGPathSegList::appendItem):
-        * bindings/js/JSSVGPointListCustom.cpp:
-        (WebCore::finishGetter):
-        (WebCore::finishSetter):
-        (WebCore::finishSetterReadOnlyResult):
-        (WebCore::JSSVGPointList::clear):
-        (WebCore::JSSVGPointList::initialize):
-        (WebCore::JSSVGPointList::getItem):
-        (WebCore::JSSVGPointList::insertItemBefore):
-        (WebCore::JSSVGPointList::replaceItem):
-        (WebCore::JSSVGPointList::removeItem):
-        (WebCore::JSSVGPointList::appendItem):
-        * bindings/js/JSSVGTransformListCustom.cpp:
-        (WebCore::finishGetter):
-        (WebCore::finishSetter):
-        (WebCore::finishSetterReadOnlyResult):
-        (WebCore::JSSVGTransformList::clear):
-        (WebCore::JSSVGTransformList::initialize):
-        (WebCore::JSSVGTransformList::getItem):
-        (WebCore::JSSVGTransformList::insertItemBefore):
-        (WebCore::JSSVGTransformList::replaceItem):
-        (WebCore::JSSVGTransformList::removeItem):
-        (WebCore::JSSVGTransformList::appendItem):
-        * bindings/js/JSStorageCustom.cpp:
-        (WebCore::JSStorage::nameGetter):
-        (WebCore::JSStorage::deleteProperty):
-        (WebCore::JSStorage::customPut):
-        * bindings/js/JSStyleSheetCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSStyleSheetListCustom.cpp:
-        (WebCore::JSStyleSheetList::nameGetter):
-        * bindings/js/JSTextCustom.cpp:
-        (WebCore::toJSNewlyCreated):
-        * bindings/js/JSTreeWalkerCustom.cpp:
-        (WebCore::JSTreeWalker::parentNode):
-        (WebCore::JSTreeWalker::firstChild):
-        (WebCore::JSTreeWalker::lastChild):
-        (WebCore::JSTreeWalker::nextSibling):
-        (WebCore::JSTreeWalker::previousSibling):
-        (WebCore::JSTreeWalker::previousNode):
-        (WebCore::JSTreeWalker::nextNode):
-        * bindings/js/JSWorkerContextBase.cpp:
-        (WebCore::JSWorkerContextBase::put):
-        * bindings/js/JSWorkerContextBase.h:
-        * bindings/js/JSWorkerContextCustom.cpp:
-        (WebCore::JSWorkerContext::self):
-        (WebCore::JSWorkerContext::setSelf):
-        (WebCore::JSWorkerContext::addEventListener):
-        (WebCore::JSWorkerContext::removeEventListener):
-        * bindings/js/JSWorkerCustom.cpp:
-        (WebCore::JSWorker::addEventListener):
-        (WebCore::JSWorker::removeEventListener):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::open):
-        (WebCore::JSXMLHttpRequest::setRequestHeader):
-        (WebCore::JSXMLHttpRequest::send):
-        (WebCore::JSXMLHttpRequest::getResponseHeader):
-        (WebCore::JSXMLHttpRequest::overrideMimeType):
-        (WebCore::JSXMLHttpRequest::addEventListener):
-        (WebCore::JSXMLHttpRequest::removeEventListener):
-        (WebCore::JSXMLHttpRequest::responseText):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::addEventListener):
-        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
-        * bindings/js/JSXSLTProcessorCustom.cpp:
-        (WebCore::JSXSLTProcessor::importStylesheet):
-        (WebCore::JSXSLTProcessor::transformToFragment):
-        (WebCore::JSXSLTProcessor::transformToDocument):
-        (WebCore::JSXSLTProcessor::setParameter):
-        (WebCore::JSXSLTProcessor::getParameter):
-        (WebCore::JSXSLTProcessor::removeParameter):
-        * bindings/js/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::ScheduledAction):
-        (WebCore::ScheduledAction::execute):
-        * bindings/js/ScheduledAction.h:
-        * bindings/js/ScriptCallStack.cpp:
-        (WebCore::ScriptCallStack::ScriptCallStack):
-        (WebCore::ScriptCallStack::initialize):
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::createScriptObjectForPluginElement):
-        * bindings/js/ScriptValue.cpp:
-        (WebCore::ScriptValue::getString):
-        (WebCore::ScriptValue::isNull):
-        (WebCore::ScriptValue::isUndefined):
-        * bindings/js/ScriptValue.h:
-        (WebCore::ScriptValue::ScriptValue):
-        (WebCore::ScriptValue::jsValue):
-        * bindings/objc/WebScriptObject.mm:
-        (-[WebScriptObject callWebScriptMethod:withArguments:]):
-        (-[WebScriptObject evaluateWebScript:]):
-        (-[WebScriptObject valueForKey:]):
-        (-[WebScriptObject webScriptValueAtIndex:]):
-        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
-        * bindings/objc/WebScriptObjectPrivate.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/NP_jsobject.cpp:
-        (_NPN_InvokeDefault):
-        (_NPN_Invoke):
-        (_NPN_Evaluate):
-        (_NPN_GetProperty):
-        (_NPN_HasMethod):
-        (_NPN_Construct):
-        * bridge/c/c_instance.cpp:
-        (JSC::Bindings::CInstance::invokeMethod):
-        (JSC::Bindings::CInstance::invokeDefaultMethod):
-        (JSC::Bindings::CInstance::invokeConstruct):
-        (JSC::Bindings::CInstance::defaultValue):
-        (JSC::Bindings::CInstance::stringValue):
-        (JSC::Bindings::CInstance::numberValue):
-        (JSC::Bindings::CInstance::booleanValue):
-        (JSC::Bindings::CInstance::valueOf):
-        * bridge/c/c_instance.h:
-        * bridge/c/c_runtime.cpp:
-        (JSC::Bindings::CField::valueFromInstance):
-        (JSC::Bindings::CField::setValueToInstance):
-        * bridge/c/c_runtime.h:
-        * bridge/c/c_utility.cpp:
-        (JSC::Bindings::convertValueToNPVariant):
-        (JSC::Bindings::convertNPVariantToValue):
-        * bridge/c/c_utility.h:
-        * bridge/jni/jni_instance.cpp:
-        (JavaInstance::stringValue):
-        (JavaInstance::numberValue):
-        (JavaInstance::booleanValue):
-        (JavaInstance::invokeMethod):
-        (JavaInstance::defaultValue):
-        (JavaInstance::valueOf):
-        * bridge/jni/jni_instance.h:
-        * bridge/jni/jni_jsobject.h:
-        * bridge/jni/jni_jsobject.mm:
-        (JavaJSObject::call):
-        (JavaJSObject::eval):
-        (JavaJSObject::getMember):
-        (JavaJSObject::getSlot):
-        (JavaJSObject::convertValueToJObject):
-        (JavaJSObject::convertJObjectToValue):
-        * bridge/jni/jni_objc.mm:
-        (JSC::Bindings::dispatchJNICall):
-        * bridge/jni/jni_runtime.cpp:
-        (JavaArray::convertJObjectToArray):
-        (JavaField::dispatchValueFromInstance):
-        (JavaField::valueFromInstance):
-        (JavaField::dispatchSetValueToInstance):
-        (JavaField::setValueToInstance):
-        (JavaArray::setValueAt):
-        (JavaArray::valueAt):
-        * bridge/jni/jni_runtime.h:
-        * bridge/jni/jni_utility.cpp:
-        (JSC::Bindings::convertArrayInstanceToJavaArray):
-        (JSC::Bindings::convertValueToJValue):
-        * bridge/jni/jni_utility.h:
-        * bridge/objc/WebScriptObject.h:
-        * bridge/objc/objc_class.h:
-        * bridge/objc/objc_class.mm:
-        (JSC::Bindings::ObjcClass::fallbackObject):
-        * bridge/objc/objc_instance.h:
-        * bridge/objc/objc_instance.mm:
-        (ObjcInstance::invokeMethod):
-        (ObjcInstance::invokeDefaultMethod):
-        (ObjcInstance::setValueOfUndefinedField):
-        (ObjcInstance::getValueOfUndefinedField):
-        (ObjcInstance::defaultValue):
-        (ObjcInstance::stringValue):
-        (ObjcInstance::numberValue):
-        (ObjcInstance::booleanValue):
-        (ObjcInstance::valueOf):
-        * bridge/objc/objc_runtime.h:
-        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
-        * bridge/objc/objc_runtime.mm:
-        (JSC::Bindings::ObjcField::valueFromInstance):
-        (JSC::Bindings::convertValueToObjcObject):
-        (JSC::Bindings::ObjcField::setValueToInstance):
-        (JSC::Bindings::ObjcArray::setValueAt):
-        (JSC::Bindings::ObjcArray::valueAt):
-        (JSC::Bindings::ObjcFallbackObjectImp::put):
-        (JSC::Bindings::callObjCFallbackObject):
-        (JSC::Bindings::ObjcFallbackObjectImp::defaultValue):
-        * bridge/objc/objc_utility.h:
-        * bridge/objc/objc_utility.mm:
-        (JSC::Bindings::convertValueToObjcValue):
-        (JSC::Bindings::convertNSStringToString):
-        (JSC::Bindings::convertObjcValueToValue):
-        * bridge/runtime.cpp:
-        (JSC::Bindings::Instance::getValueOfField):
-        (JSC::Bindings::Instance::setValueOfField):
-        * bridge/runtime.h:
-        (JSC::Bindings::Class::fallbackObject):
-        (JSC::Bindings::Instance::getValueOfUndefinedField):
-        (JSC::Bindings::Instance::setValueOfUndefinedField):
-        (JSC::Bindings::Instance::invokeDefaultMethod):
-        (JSC::Bindings::Instance::invokeConstruct):
-        (JSC::Bindings::Instance::valueOf):
-        * bridge/runtime_array.cpp:
-        (JSC::RuntimeArray::lengthGetter):
-        (JSC::RuntimeArray::indexGetter):
-        (JSC::RuntimeArray::put):
-        * bridge/runtime_array.h:
-        (JSC::RuntimeArray::createStructure):
-        * bridge/runtime_method.cpp:
-        (JSC::RuntimeMethod::lengthGetter):
-        (JSC::callRuntimeMethod):
-        * bridge/runtime_method.h:
-        (JSC::RuntimeMethod::createStructure):
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::fallbackObjectGetter):
-        (JSC::RuntimeObjectImp::fieldGetter):
-        (JSC::RuntimeObjectImp::methodGetter):
-        (JSC::RuntimeObjectImp::put):
-        (JSC::RuntimeObjectImp::defaultValue):
-        (JSC::callRuntimeObject):
-        (JSC::callRuntimeConstructor):
-        * bridge/runtime_object.h:
-        (JSC::RuntimeObjectImp::createStructure):
-        * inspector/InspectorController.cpp:
-        * inspector/JavaScriptCallFrame.cpp:
-        (WebCore::JavaScriptCallFrame::evaluate):
-        * inspector/JavaScriptCallFrame.h:
-        * inspector/JavaScriptProfile.cpp:
-        (WebCore::toJS):
-        * inspector/JavaScriptProfile.h:
-        * inspector/JavaScriptProfileNode.cpp:
-        (WebCore::toJS):
-        * inspector/JavaScriptProfileNode.h:
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::dropProtection):
-
-2009-01-06  Pierre-Olivier Latour  <pol@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Added new API on AnimationController::numberOfActiveAnimations() to be used by DRT.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23126
-
-        Test: animations/animation-controller-drt-api.html
-
-        * WebCore.base.exp:
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::numberOfActiveAnimations):
-        (WebCore::AnimationController::numberOfActiveAnimations):
-        * page/animation/AnimationController.h:
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimationPrivate::numberOfActiveAnimations):
-        (WebCore::CompositeAnimation::numberOfActiveAnimations):
-        * page/animation/CompositeAnimation.h:
-
-2009-01-06  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Gavin Barraclough.
-
-        Upstream 3 more files to get the WebCore-Chromium build a bit further.
-
-        * WebCore.scons:
-        * page/chromium/AccessibilityObjectChromium.cpp: Added.
-        (WebCore::AccessibilityObject::accessibilityIgnoreAttachment):
-        * page/chromium/AccessibilityObjectWrapper.h: Added.
-        (WebCore::AccessibilityObjectWrapper::~AccessibilityObjectWrapper):
-        (WebCore::AccessibilityObjectWrapper::attached):
-        (WebCore::AccessibilityObjectWrapper::accessibilityObject):
-        (WebCore::AccessibilityObjectWrapper::AccessibilityObjectWrapper):
-        * platform/chromium/PasteboardPrivate.h: Added.
-        (WebCore::PasteboardPrivate::):
-
-2009-01-06  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by David Hyatt.
-
-        Tests: animations/simultaneous-start-left.html
-               animations/simultaneous-start-transform.html
-
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=22870
- 
-        I added calls beginAnimationUpdate() and endAnimationUpdate() calls
-        to AnimationController. These are called by Document at the start
-        and end of the recalcStyle cycle. Right now, I'm just using the 
-        beginAnimationUpdate() method to reset an animation time value.
-        The first time the animation time is accessed after this reset I set
-        it to the currentTime. So all animations in that cycle get the same
-        start time. 
-
-        The test cases checked in test this, but in the case of the 'left'
-        test it actually doesn't make any difference in most cases. This is
-        because values are clamped to whole pixels, so the start times would 
-        have to be pretty far off for the test to fail using the old
-        currentTime() model. Still, under really heavy load, it's possible for
-        the test to fail without these changes.
-
-        The 'transform' test is another story. It animates to the full resolution
-        of a floating point number, so the test fails miserably without this
-        fix.
-
-        * dom/Document.cpp:
-        (WebCore::Document::recalcStyle):
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::updateStateMachine):
-        (WebCore::AnimationBase::fireAnimationEventsIfNeeded):
-        (WebCore::AnimationBase::willNeedService):
-        (WebCore::AnimationBase::progress):
-        (WebCore::AnimationBase::goIntoEndingOrLoopingState):
-        (WebCore::AnimationBase::beginAnimationUpdateTime):
-        * page/animation/AnimationBase.h:
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::beginAnimationUpdateTime):
-        (WebCore::AnimationControllerPrivate::setBeginAnimationUpdateTime):
-        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
-        (WebCore::AnimationController::updateAnimations):
-        (WebCore::AnimationController::beginAnimationUpdateTime):
-        (WebCore::AnimationController::beginAnimationUpdate):
-        (WebCore::AnimationController::endAnimationUpdate):
-        * page/animation/AnimationController.h:
-        * page/animation/KeyframeAnimation.cpp:
-        (WebCore::KeyframeAnimation::animate):
-
-2009-01-06  Julien Chaffraix  <jchaffraix@webkit.org>
-
-        Reviewed by Nikolas Zimmermann.
-
-        Bug 22858: Simplify make_names.pl code for avoiding multiple definitions or inclusions
-        https://bugs.webkit.org/show_bug.cgi?id=22858
-
-        I had introduced an awkward situation using hasCustomJSWrapper and
-        sometimes boolean parameter in order to ensure JS wrapper generated once
-        or header included once.
-
-        Simplified the code by using a %seenTag hash to detect multiple definitions
-        or inclusions and skipping it.
-
-        Also cleaned up a bit make_names.pl by using more explicit names and moving
-        code to where it belongs.
-
-        * dom/make_names.pl:
-        * html/HTMLTagNames.in: Necessary changes that were not detected by
-        the previous syntax but will be required for autogenerating HTMLElementFactory.
+        * plugins/gtk/gtk2xtbin.c:
+        (gtk_xtbin_class_init):
+        (gtk_xtbin_new):
+        (gtk_xtbin_destroy):
 
-2009-01-06  Anders Carlsson  <andersca@apple.com>
+2009-06-27  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Dan Bernstein.
 
-        Add a way for frame loader clients to always create a PluginDocument, regardless of 
-        the real document MIME type.
+        https://bugs.webkit.org/show_bug.cgi?id=26780
         
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::begin):
-        (WebCore::FrameLoader::shouldUsePlugin):
-        * loader/FrameLoaderClient.h:
-        (WebCore::FrameLoaderClient::shouldUsePluginDocument):
-
-2009-01-06  Dean Jackson  <dino@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Extend Media Queries to cover transitions,
-        animations, transform-2d and transform-3d
-        http://webkit.org/specs/MediaQueriesExtensions.html
-        Note that the implementation uses -webkit- prefixes
-        even though the spec doesn't have them.
-        https://bugs.webkit.org/show_bug.cgi?id=22494
-
-        Tests: fast/media/mq-animation.html
-               fast/media/mq-transform-01.html
-               fast/media/mq-transform-02.html
-               fast/media/mq-transform-03.html
-               fast/media/mq-transform-04.html
-               fast/media/mq-transition.html
-
-        * css/MediaFeatureNames.h:
-        * css/MediaQueryEvaluator.cpp:
-        (WebCore::animationMediaFeatureEval):
-        (WebCore::transitionMediaFeatureEval):
-        (WebCore::transform_2dMediaFeatureEval):
-        (WebCore::transform_3dMediaFeatureEval):
-
-2009-01-06  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Bring the Chromium-WebCore build closer to building
-        by upstreaming PlatformWidget.h add adding the JSC
-        plugin bridge files to the build.
-
-        * WebCore.scons:
-        * platform/chromium/PlatformWidget.h: Added.
-
-2009-01-06  Eric Seidel  <eric@webkit.org>
-
-        Build fix only, no review.
-
-        Bring the Chromium-WebCore build back closer to building
-        by adding files from recent commits.
-
-        * WebCore.scons:
-
-2009-01-06  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/6474973> REGRESSION: PLT ~2% slower due to 39465 (consolidate thread data)
-
-        I could not reproduce the slowdown on my PowerPC test machine, but the change should bring
-        performance back.
-
-        * platform/ThreadGlobalData.cpp: (WebCore::threadGlobalData): Don't use AtomicallyInitializedStatic.
-        Prior to r39465, it was only used for cached converters, which was necessary because the
-        first access to ICU or TEC one could happen on a secondary thread, but now they are all
-        initialized from ThreadGlobalData constructor.
-
-2009-01-06  David Smith  <catfish.man@gmail.com>
-
-        Reviewed by Darin Adler.
+        Fix up previous change. When computeCompositingRequirements() determines
+        that the current layer is composited, it needs to inform its parent
+        by setting compositingState.m_subtreeIsCompositing() to true. That didn't
+        always happen after the previous patch. Clarified the logic here.
         
-        https://bugs.webkit.org/show_bug.cgi?id=23129
-        Devirtualize Node::childNodes().
-
-2009-01-06  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Unreviewed build fix.
-
-        Fix the Qt build with Qt 4.4.x, the HTTP-only cookie support was
-        added in Qt 4.5.
-
-        * platform/qt/CookieJarQt.cpp:
-        (WebCore::setCookies):
-        (WebCore::cookies):
-
-2009-01-06  Zalan Bujtas  <zbujtas@gmail.com>
-
-        Reviewed by David Kilzer.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23133
-        Fix SVG disabled build. Move 'pointer-events' from SVGCSSPropertyNames.in to
-        CSSPropertyNames.in and move PointerEvents functions out of #if ENABLE(SVG)
-
-        NOTE: Property name fixes landed as part of r39648.
-
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator EPointerEvents):
-        * css/CSSPropertyNames.in:
-        * css/SVGCSSPropertyNames.in:
-
-2009-01-06  David Kilzer  <ddkilzer@apple.com>
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::CompositingState::CompositingState):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
 
-        BUILD FIX (r39634): Fix build for non-SVG builds (Wx)
+2009-06-27  Simon Fraser  <simon.fraser@apple.com>
 
-        * css/CSSPropertyNames.in: Added 'pointer-events'.
-        * css/SVGCSSPropertyNames.in: Commented out pointer-events
-        since it's now a plain CSS property.
-
-2009-01-06  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Reviewed by Lars Knoll.
-
-        Added support for HTTP-only cookies to the Qt build.
-
-        * platform/qt/CookieJarQt.cpp:
-        (WebCore::setCookies): Don't set HTTP-only cookies through the DOM.
-        (WebCore::cookies): Don't return HTTP-only cookies to the DOM.
-
-2009-01-05  David Smith  <catfish.man@gmail.com>
-
-        Reviewed by Oliver Hunt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23084
-        Avoid redundant AtomicString conversions
-
-        * dom/Node.cpp: Create an AtomicString early to avoid converting twice
-        (WebCore::Node::getElementsByTagNameNS):
-        * dom/QualifiedName.h: Use the appropriate AtomicString constructor instead of converting from a String
-
-2009-01-05  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt
+        Reviewed by Dan Bernstein.
 
-        https://bugs.webkit.org/show_bug.cgi?id=22985
-        
-        Add an assertion that clip rects are being used when painting with the same
-        rootLayer that they were computed with.
+        https://bugs.webkit.org/show_bug.cgi?id=26780
         
-        Fix two issues detected by the assertion:
+        First part: fix the RenderLayer::hasCompositingDescendant() flag to be set
+        correctly.
 
-        RenderLayer::updateClipRects() should not unconditionally update the clip rects
-        on its parent, but stop when reaching rootLayer (just like calculateClipRects()).
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        Do not unconditionally set compositingState.m_subtreeIsCompositing, because
+        that can clobber the value from an earlier sibling. Add some more comments.
         
-        We need to pass the temporaryClipRects flag down through reflection painting
-        to handle the case of nested reflections.
+        Remove a final use of Vector iterators.
         
-        Also use temporary clip rects in RenderTreeAsText, since that code does not
-        reset the painting root for transformed layers, so cached clip rects will not
-        match those used for painting.
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::RenderLayer):
-        (WebCore::RenderLayer::paintLayer):
-        (WebCore::RenderLayer::updateClipRects):
-        (WebCore::RenderLayer::clearClipRects):
-        * rendering/RenderLayer.h:
-        * rendering/RenderTreeAsText.cpp:
-        (WebCore::writeLayers):
-
-2009-01-05  Adam Treat  <adam.treat@torchmobile.com>
-
-        Fix the Qt build
-
-        * platform/graphics/qt/AffineTransformQt.cpp:
-        (WebCore::TransformationMatrix::TransformationMatrix):
-
-2009-01-05  Mark Rowe  <mrowe@apple.com>
+        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect):
+        Move the normalFlowList() processing outside the test for isStackingContext().
 
-        Fix the build some more.
+2009-06-27  Dan Bernstein  <mitz@apple.com>
 
-        * platform/graphics/cairo/AffineTransformCairo.cpp:
-        (WebCore::TransformationMatrix::TransformationMatrix):
+        Reviewed by Simon Fraser and Antti Koivisto.
 
-2009-01-05  Oliver Hunt  <oliver@apple.com>
+        - make paintFillLayerExtended() non-virtual and remove its clipY and
+          clipH parameters
 
-        Reviewed by NOBODY (Build fix).
+        These parameters were computed and passed along to
+        paintFillLayerExtended in order to vertically constrain the rect fill to
+        the damage rect, because Qt cannot paint tall rectangles (see
+        <http://websvn.kde.org/?view=rev&revision=42721>). Since the damage rect
+        is passed along in the PaintInfo, the extra parameters are redundant,
+        and the intersection can just take place in paintFillLayerExtended().
 
-        Fix Cairo/Gtk build
-
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        (WebCore::ImageBuffer::putImageData):
-
-2009-01-05  Dean Jackson  <dino@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Rename AffineTransform to TransformationMatrix in
-        preparation for future enhancements (non-affine matrices)
-
-        https://bugs.webkit.org/show_bug.cgi?id=22943
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.scons:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * platform/graphics/transforms/AffineTransform.cpp: Removed.
-        * platform/graphics/transforms/AffineTransform.h: Removed.
-        * platform/graphics/transforms/TransformationMatrix.cpp: Copied from WebCore/platform/graphics/transforms/AffineTransform.cpp.
-        * platform/graphics/transforms/TransformationMatrix.h: Copied from WebCore/platform/graphics/transforms/AffineTransform.h.
-        * lots of other files with s/AffineTransform/TransformationMatrix/g
-
-2008-01-05  Dean Jackson  <dino@apple.com>
-
-        Reviewed by David Hyatt.
-
-        Implement 'pointer-events' for HTML content. This involved
-        adding a new value 'auto' which behaves as 'visiblePainted'
-        in SVG content. 
-        
-        Moved the property out of the SVG CSS code and into
-        the general CSS (both parsing and RenderStyle). 
-        
-        Changes to the hit testing functionality of the Render tree,
-        specifically the nodeAtPoint methods. Where they used to 
-        test for visibility, they now use a helper function defined
-        on base classes (RenderObject and InlineBox) that checks both
-        visibility and pointer-events.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=11395
-
-        Tests: fast/events/pointer-events-2.html
-               fast/events/pointer-events.html
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator EPointerEvents):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * css/SVGCSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
-        * css/SVGCSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applySVGProperty):
-        * manual-tests/pointer-events.html: Added.
-        * rendering/EllipsisBox.cpp:
-        (WebCore::EllipsisBox::nodeAtPoint):
-        * rendering/InlineBox.h:
-        (WebCore::InlineBox::visibleToHitTesting):
         * rendering/InlineFlowBox.cpp:
-        (WebCore::InlineFlowBox::nodeAtPoint):
-        * rendering/InlineTextBox.cpp:
-        (WebCore::InlineTextBox::nodeAtPoint):
-        * rendering/PointerEventsHitRules.cpp:
-        (WebCore::PointerEventsHitRules::PointerEventsHitRules):
-        * rendering/PointerEventsHitRules.h:
-        (WebCore::PointerEventsHitRules::):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::InlineFlowBox::paintFillLayers):
+        (WebCore::InlineFlowBox::paintFillLayer):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/InlineFlowBox.h:
         * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::nodeAtPoint):
-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::visibleToHitTesting):
-        * rendering/RenderPath.cpp:
-        (WebCore::RenderPath::nodeAtPoint):
-        * rendering/RenderSVGImage.cpp:
-        (WebCore::RenderSVGImage::nodeAtPoint):
-        * rendering/RenderSVGText.cpp:
-        (WebCore::RenderSVGText::nodeAtPoint):
-        * rendering/RootInlineBox.cpp:
-        (WebCore::RootInlineBox::nodeAtPoint):
-        * rendering/TextControlInnerElements.cpp:
-        (WebCore::SearchFieldCancelButtonElement::defaultEventHandler):
-        * rendering/style/RenderStyle.h:
-        (WebCore::):
-        (WebCore::InheritedFlags::setBitDefaults):
-        (WebCore::InheritedFlags::pointerEvents):
-        (WebCore::InheritedFlags::setPointerEvents):
-        (WebCore::InheritedFlags::initialPointerEvents):
-        * rendering/style/RenderStyleConstants.h:
-        (WebCore::):
-        * rendering/style/SVGRenderStyle.h:
-        (WebCore::SVGRenderStyle::InheritedFlags::operator==):
-        (WebCore::SVGRenderStyle::setBitDefaults):
-        * rendering/style/SVGRenderStyleDefs.h:
-        * css/CSSValueKeywords.in:
-        * css/SVGCSSValueKeywords.in:
-
-2009-01-05  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by NOBODY (Build fix).
-
-        Fix Cairo/Gtk build
-
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        (WebCore::ImageBuffer::getImageData):
-
-2009-01-05  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Gavin Barraclough.
-
-        CanvasPixelArray performance is too slow 
-        <https://bugs.webkit.org/show_bug.cgi?id=23123>
-
-        Remove the WebCore CanvasPixelArray implementation and replace
-        CPA usage with JSC::ByteArray.  Replace the JSCanvasPixelArray
-        wrapper with an explicitly instantiated JSByteArray put on the
-        JSImageData object as an ordinary ReadOnly, DontDelete property.
-
-        * DerivedSources.make:
-        * ForwardingHeaders/runtime/ByteArray.h: Added.
-        * ForwardingHeaders/runtime/JSByteArray.h: Added.
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.scons:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSCanvasPixelArrayCustom.h: Removed.
-        * bindings/js/JSImageDataCustom.cpp:
-        (WebCore::toJS):
-        * html/CanvasPixelArray.cpp: Removed.
-        * html/CanvasPixelArray.h: Removed.
-        * html/CanvasPixelArray.idl: Removed.
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::createEmptyImageData):
-        * html/ImageData.cpp:
-        (WebCore::ImageData::ImageData):
-        * html/ImageData.h:
-        (WebCore::ImageData::data):
-        * html/ImageData.idl:
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::ImageBuffer::getImageData):
-        (WebCore::ImageBuffer::putImageData):
-
-2009-01-05  Adam Treat  <adam.treat@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Add notification for contentsSizeChanged which the Qt API will
-        introduce.
-
-        * loader/EmptyClients.h:
-        (WebCore::EmptyChromeClient::contentsSizeChanged):
-        * page/Chrome.cpp:
-        (WebCore::Chrome::contentsSizeChanged):
-        * page/Chrome.h:
-        * page/ChromeClient.h:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::setContentsSize):
-        * page/FrameView.h:
-        * platform/HostWindow.h:
-        * platform/ScrollView.h:
-
-2009-01-05  Anders Carlsson  <andersca@apple.com>
-
-        Build fix.
-        
-        * plugins/PluginView.h:
-        (WebCore::PluginManualLoader::~PluginManualLoader):
-
-2009-01-05  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Kevin Decker.
-        
-        Add an abstract PluginManualLoader class and make PluginView inherit from it. 
-        
-        Add some error checking that currently exists in WebKit (but not for long!)
-        
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::didReceiveResponse):
-        (WebCore::PluginView::didReceiveData):
-        (WebCore::PluginView::didFinishLoading):
-        (WebCore::PluginView::didFail):
-        * plugins/PluginView.h:
-
-2009-01-05  Adam Treat  <adam.treat@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Fixes FrameView to respect the state of scrollbarmode when it is explicitly
-        set programatically via a webkit API.
-
-        * loader/FrameLoaderClient.cpp:
-        (WebCore::FrameLoaderClient::transitionToCommittedForNewPage):
-        * loader/FrameLoaderClient.h:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::initScrollbars):
-        (WebCore::FrameView::updateDefaultScrollbarState):
-        * page/FrameView.h:
-
-2009-01-05  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Bug 23109: REGRESSION: Backwards search in a long document matches incorrectly
-        https://bugs.webkit.org/show_bug.cgi?id=23109
-
-        Test: fast/text/find-backwards.html
-
-        * editing/TextIterator.cpp:
-        (WebCore::SearchBuffer::append): Fix incorrect size passed to memcpy.
-        (WebCore::SearchBuffer::search): Handle case where we have an empty buffer but
-        we're at a break; must not try to search because ICU will give us an error.
-        Fix incorrect size passed to memcpy and memmove.
-        (WebCore::findPlainText): Fix case where we found a match and need to search
-        again because we want to find the last match. We need to try again without
-        adding any more text or handling the break before moving on.
-
-2009-01-05  Adam Treat  <adam.treat@torchmobile.com>
-
-        Fix the Qt build
-
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::put):
-
-2009-01-05  Alexey Proskuryakov  <ap@webkit.org>
+        (WebCore::RenderBox::paintRootBoxDecorations):
+        (WebCore::RenderBox::paintBoxDecorations):
+        (WebCore::RenderBox::paintMask):
+        (WebCore::RenderBox::paintMaskImages):
+        (WebCore::RenderBox::paintFillLayers):
+        (WebCore::RenderBox::paintFillLayer):
+        * rendering/RenderBox.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBoxDecorations):
+        (WebCore::RenderFieldset::paintMask):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paintBoxDecorations):
+        (WebCore::RenderTable::paintMask):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paintBackgroundsBehindCell):
+        (WebCore::RenderTableCell::paintMask):
 
-        Reviewed by Sam Weinig.
+2009-06-27  Ryosuke Niwa  <rniwa@google.com>
 
-        Fix platforms that don't have Workers enabled.
+        Reviewed by Eric Seidel.
 
-        * platform/ThreadGlobalData.cpp: (WebCore::threadGlobalData): Create ThreadGlobalData in
-        two stages, so that EventNames constructor can access the just-created atomic string table.
-        This matches what happens in ThreadSpecific case.
+        https://bugs.webkit.org/show_bug.cgi?id=26762
 
-2009-01-05  Alexey Proskuryakov  <ap@webkit.org>
+        Clean up for IndentOutdentCommand::indentRegion, and solved most of problems related to the bug 21712.
+        https://bugs.webkit.org/show_bug.cgi?id=21712
 
-        Suggested by Dave Levin.
+        Added few utility functions to htmlediting.h/cpp
 
-        Mac release build fix.
+        isVisibilyAdjacent checks whether the first position is visibly next to the second position.
+        i.e. there is no visible node between the first and second positions
 
-        * WebCore.base.exp: Remove ThreadGlobalData::eventNames(), which is now inline.
+        canMergeLists checks whether two lists can be merged.
+        It checks the type of list, the editing boundary, and adjacency of the lists.
 
-2009-01-05  Darin Adler  <darin@apple.com>
+        Tests: editing/execCommand/indent-nested-lists-1.html
+               editing/execCommand/indent-nested-lists-2.html
+               editing/execCommand/indent-nested-lists-3.html
+               editing/execCommand/indent-nested-lists-4.html
+               editing/execCommand/indent-nested-lists-5.html
+               editing/execCommand/indent-nested-lists-6.html
+               editing/execCommand/indent-nested-lists-7.html
+               editing/execCommand/outdent-nested-lists-1.html
+               editing/execCommand/outdent-nested-lists-2.html
+               editing/execCommand/outdent-nested-lists-3.html
+               editing/execCommand/outdent-nested-lists-4.html
 
-        * dom/Document.cpp: Fix build. Oops again.
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::prepareBlockquoteLevelForInsertion):
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem):
+        (WebCore::IndentOutdentCommand::indentIntoBlockquote):
+        (WebCore::IndentOutdentCommand::indentRegion):
+        * editing/IndentOutdentCommand.h:
+        * editing/htmlediting.cpp:
+        (WebCore::enclosingListChild):
+        (WebCore::canMergeLists):
+        (WebCore::isVisibilyAdjacent):
+        * editing/htmlediting.h:
 
-2009-01-05  Darin Adler  <darin@apple.com>
+2009-06-27  Pavel Feldman  <pfeldman@chromium.org>
 
-        Reviewed by Anders Carlsson.
+        Reviewed by Timothy Hatcher.
 
-        Fix hang whenever following an anchor.
+        WebInspector: Fix completion when iterating options using Tab.
 
-        * dom/Document.cpp:
-        (WebCore::Document::findAnchor): Oops!
+        https://bugs.webkit.org/show_bug.cgi?id=26722
 
-2009-01-05  Alexey Proskuryakov  <ap@webkit.org>
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype._completionsReady):
 
-        Reviewed by Darin Adler.
+2009-06-27  Gustavo Noronha Silva  <gns@gnome.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=23073
-        <rdar://problem/6471129> Workers crash on Windows Release builds
+        Reviewed by Holger Freyther.
 
-        * platform/ThreadGlobalData.cpp: (WebCore::ThreadGlobalData::ThreadGlobalData):
-        * platform/ThreadGlobalData.h: (WebCore::ThreadGlobalData::eventNames):
-        Now that ThreadSpecific sets up the pointer before invoking data constructor, we can
-        initialize EventNames right away.
+        https://bugs.webkit.org/show_bug.cgi?id=25889
+        [GTK] scrollbar policy for main frame is not implementable
 
-2009-01-05  Darin Adler  <darin@apple.com>
+        Override visibleContentRect to handle GTK+'s case, in which
+        scrollbars or equivalent decoration are painted by the parent
+        widget.
 
-        Reviewed by Anders Carlsson.
+        * platform/ScrollView.cpp:
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::visibleContentRect):
 
-        Bug 23106: HTMLFormCollection::namedItem ignores caseSensitive argument
-        https://bugs.webkit.org/show_bug.cgi?id=23106
+2009-06-27  Daniel Bates  <dbates@intudata.com>
 
-        This led me to a bunch of dead code. It turns out that HTML collections
-        were carrying the case-insensitive code just so they could be used to
-        find anchors, something we can do more simply and efficiently without
-        creating a DOM HTMLCollection object.
+        Reviewed by Adam Barth.
 
-        No behavior change. Just adding a new function findAnchor function and
-        removing some dead code.
+        https://bugs.webkit.org/show_bug.cgi?id=26708
+        
+        Fix addresses false negatives with respect to scheme relative paths, iFrame JavaScript URLs,
+        and UTF-7 encoded payloads.   
 
-        * dom/Document.cpp:
-        (WebCore::Document::findAnchor): Added.
-        * dom/Document.h: Ditto.
-
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::accessKey): Take and return AtomicString
-        references for better efficiency.
-        (WebCore::HTMLAnchorElement::setAccessKey): Ditto.
-        (WebCore::HTMLAnchorElement::charset): Ditto.
-        (WebCore::HTMLAnchorElement::setCharset): Ditto.
-        (WebCore::HTMLAnchorElement::coords): Ditto.
-        (WebCore::HTMLAnchorElement::setCoords): Ditto.
-        (WebCore::HTMLAnchorElement::setHref): Ditto.
-        (WebCore::HTMLAnchorElement::hreflang): Ditto.
-        (WebCore::HTMLAnchorElement::setHreflang): Ditto.
-        (WebCore::HTMLAnchorElement::name): Ditto.
-        (WebCore::HTMLAnchorElement::setName): Ditto.
-        (WebCore::HTMLAnchorElement::rel): Ditto.
-        (WebCore::HTMLAnchorElement::setRel): Ditto.
-        (WebCore::HTMLAnchorElement::rev): Ditto.
-        (WebCore::HTMLAnchorElement::setRev): Ditto.
-        (WebCore::HTMLAnchorElement::shape): Ditto.
-        (WebCore::HTMLAnchorElement::setShape): Ditto.
-        (WebCore::HTMLAnchorElement::setTarget): Ditto.
-        (WebCore::HTMLAnchorElement::type): Ditto.
-        (WebCore::HTMLAnchorElement::setType): Ditto.
-        * html/HTMLAnchorElement.h: Ditto.
-
-        * html/HTMLCollection.cpp:
-        (WebCore::HTMLCollection::checkForNameMatch): Changed argument to an
-        AtomicString and removed the caseSensitive boolean, since we're now always
-        case sensitive.
-        (WebCore::HTMLCollection::namedItem): Ditto.
-        (WebCore::HTMLCollection::nextNamedItem): Ditto.
-        * html/HTMLCollection.h: Ditto.
-        * html/HTMLFormCollection.cpp:
-        (WebCore::HTMLFormCollection::getNamedItem): Ditto.
-        (WebCore::HTMLFormCollection::getNamedFormItem): Ditto.
-        (WebCore::HTMLFormCollection::nextNamedItemInternal): Ditto.
-        (WebCore::HTMLFormCollection::namedItem): Ditto.
-        (WebCore::HTMLFormCollection::nextNamedItem): Ditto.
-        * html/HTMLFormCollection.h: Ditto.
-        * html/HTMLSelectElement.cpp:
-        (WebCore::HTMLSelectElement::namedItem): Ditto.
-        * html/HTMLSelectElement.h: Ditto.
+        Tests: http/tests/security/xssAuditor/http-equiv-utf-7-encoded.html
+               http/tests/security/xssAuditor/iframe-javascript-url.html
+               http/tests/security/xssAuditor/script-tag-utf-7-encoded.html
+               http/tests/security/xssAuditor/script-tag-with-source-relative-scheme.html
 
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler): Moved XSSAuditor check to HTMLTokenizer::parseTag.
+        (WebCore::HTMLTokenizer::parseTag):
         * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::gotoAnchor): Use the new findAnchor function.
-        * page/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::internalLinkElement): Ditto.
-
-2009-01-05  Darin Adler  <darin@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        Bug 23104: minor mistakes in init functions for animation and transition events
-        https://bugs.webkit.org/show_bug.cgi?id=23104
-
-        Test: fast/events/init-events.html
-
-        Also fixed two StorageEvent problems the test case uncovered:
-
-            Made document.createEvent("StorageEvent") work.
-            Allow null values for StorageEvent.oldValue and StorageEvent.newValue.
-
-        * dom/Document.cpp:
-        (WebCore::Document::createEvent): Sorted alphabetically by the name of the event
-        class. Added StorageEvent.
-
-        * dom/UIEvent.idl: Fixed typo in a comment.
-
-        * dom/WebKitAnimationEvent.cpp:
-        (WebCore::WebKitAnimationEvent::initWebKitAnimationEvent): Use all the arguments.
-        * dom/WebKitTransitionEvent.cpp:
-        (WebCore::WebKitTransitionEvent::initWebKitTransitionEvent): Ditto.
-
-        * storage/StorageEvent.idl: Use the ConvertNullToNullString keyword on the
-        arguments to initStorageEvent so it can create events with null values for the
-        oldValue and newValue, just like the real storage events. Note that the properties
-        already had ConvertNullStringTo=Null, so this is just the other half of that.
-
-2009-01-05  Darin Adler  <darin@apple.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Bug 23102: turn on unused parameter warnings in WebCore
-        https://bugs.webkit.org/show_bug.cgi?id=23102
-
-        First step: Fix the simple cases where we can just remove an argument name.
-        Also made a few more things protected and private.
-
-        * many files
-
-2009-01-05  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23115
-        Create a version of ASSERT for use with otherwise unused variables
-
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::verifySchemaVersion): Use the new ASSERT_UNUSED macro.
-
-2009-01-05  Alexey Proskuryakov  <ap@webkit.org>
-
-        Non-Mac build fix.
-
-        * loader/appcache/ApplicationCacheStorage.cpp: Include wtf/StringExtras.h for snprintf.
-
-2009-01-05  Adam Treat  <adam.treat@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Remove unnecessary methods from EmptyFrameLoaderClient
-
-        * loader/EmptyClients.h:
-
-2009-01-05  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23077
-        Make application cache use SQLite built-in user_version
-
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::verifySchemaVersion): Changed to track versions with
-        PRAGMA user_version.
-
-        * loader/appcache/ApplicationCacheResource.h: (WebCore::ApplicationCacheResource::):
-        Used the occasion to get rid of the hole in bitmask that was a leftover from opportunistic
-        cache entries.
-
-2009-01-04  David Smith  <catfish.man@gmail.com>
-
-        Reviewed by Oliver Hunt.
+        (WebCore::FrameLoader::loadSubframe): Modified to inform XSSAuditor of parent frame so
+        as to compare against iFrame javascript URL.
+        * page/XSSAuditor.cpp: Removed method XSSAuditor::isControlCharacter. Instead, exposed method
+        isControlCharacter in ResourceResponseBase.cpp.
+        (WebCore::XSSAuditor::XSSAuditor):
+        (WebCore::XSSAuditor::decodeURL): Modified to decode string using specified encoder.
+        (WebCore::XSSAuditor::findInRequest): Generalized to arbitrary frame so as to prevent execution
+        of iFrame javascript URL.
+        * page/XSSAuditor.h: Added field m_parentFrame.
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::isControlCharacter):
+        * platform/network/ResourceResponseBase.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=23084
-        Avoid redundant AtomicString conversions
+2009-06-27  Oliver Hunt  <oliver@apple.com>
 
-        * dom/Node.cpp:
-        (WebCore::Node::getElementsByTagName): Pass starAtom instead of "*"
-        (WebCore::Node::getElementsByTagNameNS): Take an AtomicString for the namespace URI
-        (WebCore::Node::isDefaultNamespace): Ditto
-        (WebCore::Node::lookupPrefix): Ditto
-        (WebCore::Node::lookupNamespacePrefix): Ditto
-        * dom/Node.h: Ditto
+        Reviewed by Maciej Stachowiak.
 
-2009-01-04  Darin Adler  <darin@apple.com>
+        Bug 26771: Canvas is incorrectly tainted when drawing from a video element that uses <source> elements
 
-        Reviewed by Oliver Hunt.
+        The drawImage(<video>) logic naively assumes that it just needs
+        to check the src attribute of the video element when in fact it
+        needs to look at the url that is being played instead.  Failure
+        to do this means that video provided through source elements 
+        taints the canvas.
 
-        Bug 23105: canvas setFillColor function ignores alpha argument
-        https://bugs.webkit.org/show_bug.cgi?id=23105
-
-        Test: fast/canvas/set-colors.html
+        Test: media/video-canvas-source.html
 
         * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::setFillColor): Pass alpha value through instead
-        of ignoring it and always passing 1.
-
-        * html/CanvasStyle.cpp:
-        (WebCore::CanvasStyle::applyStrokeColor): Fix spelling of transparent in comments.
-        (WebCore::CanvasStyle::applyFillColor): Ditto.
-
-2009-01-04  Darin Adler  <darin@apple.com>
-
-        Bug 23086: REGRESSION(r39540/r39541): Windows build fails due to ICU errors
-        https://bugs.webkit.org/show_bug.cgi?id=23086
-
-        * editing/TextIterator.cpp: Check UCONFIG_NO_COLLATION and don't compile
-        in the new search path if it's 0.
-
-2009-01-04  David Kilzer  <ddkilzer@apple.com>
-
-        Don't install *.idl and *.in files as resources
-
-        Reviewed by Oliver Hunt.
-
-        Don't install these files as resources in the WebCore framework:
-        - WMLAttributeNames.in
-        - WMLTagNames.in
-        - WorkerContext.idl
-        - WorkerLocation.idl
-        - WorkerNavigator.idl
-
-        * WebCore.xcodeproj/project.pbxproj: Removed resources.
+        (WebCore::CanvasRenderingContext2D::checkOrigin):
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        * html/CanvasRenderingContext2D.h:
 
-2009-01-04  Simon Fraser  <simon.fraser@apple.com>
+2009-06-26  Brian Weinstein  <bweinstein@apple.com>
 
-        Reviewed by Darin Adler
+        Reviewed by Simon Fraser.
 
-        https://bugs.webkit.org/show_bug.cgi?id=23090
+        https://bugs.webkit.org/show_bug.cgi?id=26695
         
-        If an object gets a Layout hint, and the style change will result in
-        the creation of a RenderLayer, then we need to repaint the old position
-        of the object. This was done for transform, but we have to test opacity too.
-
-        Test: fast/repaint/create-layer-repaint.html
-
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::styleWillChange):
-
-2009-01-04  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Bug 23103: Safari's auto-fill no longer works for <select> elements
-        https://bugs.webkit.org/show_bug.cgi?id=23103
-        rdar://problem/6472061
-
-        * bindings/objc/DOMHTML.mm:
-        (-[DOMHTMLSelectElement _activateItemAtIndex:]): Implemented this.
+        Added the ability to do scrollbar hit testing in EventHandler, changed the
+        signature of a PlatformWheelEvent constructor, and changed scrollbarUnderMouse
+        to scrollbarUnderPoint, and updated all calls to that function.        
 
-2009-01-04  Adam Treat  <adam.treat@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Add fixedLayoutSize feature to ScrollView to allow for controlling the
-        layout beyond the constraint of the current viewports dynamic size
-
-        * css/MediaQueryEvaluator.cpp:
-        (WebCore::heightMediaFeatureEval):
-        (WebCore::widthMediaFeatureEval):
-        * dom/Element.cpp:
-        (WebCore::Element::clientWidth):
-        (WebCore::Element::clientHeight):
-        * loader/FrameLoaderClient.cpp:
-        (WebCore::FrameLoaderClient::transitionToCommittedForNewPage):
-        * loader/FrameLoaderClient.h:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layout):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        * page/EventHandler.h:
+        (WebCore::):
+        * platform/PlatformWheelEvent.h:
         * platform/ScrollView.cpp:
-        (WebCore::ScrollView::ScrollView):
-        (WebCore::ScrollView::layoutWidth):
-        (WebCore::ScrollView::layoutHeight):
-        (WebCore::ScrollView::fixedLayoutSize):
-        (WebCore::ScrollView::setFixedLayoutSize):
-        (WebCore::ScrollView::useFixedLayout):
-        (WebCore::ScrollView::setUseFixedLayout):
+        (WebCore::ScrollView::scrollbarUnderPoint):
         * platform/ScrollView.h:
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::viewHeight):
-        (WebCore::RenderView::viewWidth):
-        * rendering/RenderView.h:
-
-2009-01-03  Rob Buis  <rwlbuis@gmail.com>
-
-        Reviewed by Darin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22660
-        SVG elements that are moved are nor fully invalidated/earsed
-
-        Mark the SVG root as needing a layout when its position changes.
-
-        Tests: svg/custom/circle-move-invalidation.svg
-
-        * rendering/RenderSVGRoot.cpp:
-        (WebCore::RenderSVGRoot::position):
-        * rendering/RenderSVGRoot.h:
-
-2009-01-03  Steve Falkenburg  <sfalken@apple.com>
-
-        Build fix.
-
-        * loader/FrameLoader.h:
-
-2009-01-02  Cary Clark  <caryclark@google.com>
-
-        Reviewed and landed by Darin Adler.
-
-        Bug 22963: write icons before reading them
-        https://bugs.webkit.org/show_bug.cgi?id=22963
-
-        Reverse the order in the icon database main thread loop to
-        write the pending icons to the database before trying
-        to read any requested icons. This ensures that a requested icon 
-        has the correct data when read.
-        
-        * loader/icon/IconDatabase.cpp:
-        (WebCore::IconDatabase::syncThreadMainLoop):
-
-2009-01-02  Darin Adler  <darin@apple.com>
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadItem): One small thing I forgot in my last check-in.
-        This cuts down on the number of hash table operations during loading.
-
-2009-01-02  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed and landed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23025
-        DOMTimer lifetime cleanup: timeoutMap methods on Document now do not delete the timer.
-        Instead, all 3 places that delete timers do it directly calling 'delete' and then timer's dtor removes the ID from the timeoutMap.
-        Note that in case the context is destroyed and timers are deleted at once, the check in ~DOMTimer() prevents 
-        unnecessary HashMap remove in case the Document is being destroyed.
-
-        * bindings/js/DOMTimer.cpp:
-        (WebCore::DOMTimer::~DOMTimer): removes the id from the timeoutMap.
-        (WebCore::DOMTimer::install):
-        (WebCore::DOMTimer::removeById): simply uses 'delete this'.
-        (WebCore::DOMTimer::fired): same.
-        (WebCore::DOMTimer::contextDestroyed): same.
-        * dom/Document.cpp:
-        (WebCore::Document::removeTimeout): now it only removes the id from the map, does not delete the timer.
-
-2009-01-02  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Bug 23072: REGRESSION (r37371): In the Dictionary application, scroll bar appears
-        inside its web view when resizing its window
-        https://bugs.webkit.org/show_bug.cgi?id=23072
-        rdar://problem/6368028
-
-        The first attempt at fixing this did not work.
-        This time I was able to reproduce the bug and test the fix.
-
-        Bug 11212: REGRESSION: Activity window doesn't always list all files until refresh
-        https://bugs.webkit.org/show_bug.cgi?id=11212
-        rdar://problem/4959702
-
-        I had to fix this second bug because otherwise the WebKit code to trigger the first
-        fix didn't run.
-
-        Also fixes memory use that kept growing as we maintained a set of all URLs loaded in
-        a particular frame. Bad idea! It's bad enough that we do it for each document, but
-        the old version kept the set around forever as you moved from one document to the next.
-
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::parseMappedAttribute): Change this so that we allow
-        turning off scrolling when the quirk is enabled. We just don't allow turning it on.
-        This fixes one of the two problems with the initial patch; the other fix is in WebKit.
-
-        * loader/DocumentLoader.h: Moved didTellClientAboutLoad and haveToldClientAboutLoad
-        here from FrameLoader. The old way meant that a given frame would forever remember
-        the URL of any resources loaded in that frame and never send any "loaded from cache"
-        client calls about those URLs.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadResourceSynchronously): Removed call to didTellCientAboutLoad.
-        This is now handled by dispatchWillSendRequest, which is safer since that's the actual
-        function that tells the client about the load.
-        (WebCore::FrameLoader::loadedResourceFromMemoryCache): Changed calls to
-        haveToldClientAboutLoad and didTellClientAboutLoad to call the document loader.
-        Also removed the call in the case where we don't load from the cache, since
-        dispatchWillSendRequest now takes care of it.
-        (WebCore::FrameLoader::dispatchWillSendRequest): Put calls to didTellClientAboutLoad
-        here. Call it both on the URL we pass in and the URL the client returns; we won't
-        tell the client about either if it's loaded from the memory cache.
-
-        * loader/FrameLoader.h: Removed didTellClientAboutLoad, haveToldClientAboutLoad, and
-        m_urlsClientKnowsAbout.
-
-        * loader/SubresourceLoader.cpp: Removed unneeded load function that called
-        didTellClientAboutLoad. That's now taken care of in dispatchWillSendRequest.
-
-        * loader/SubresourceLoader.h: Removed load function. Also made all members private
-        except for create and clearClient.
-
-2009-01-02  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler
-
-        https://bugs.webkit.org/show_bug.cgi?id=23082
-        
-        Fix GIF animation by ensuring that the signature of
-        startAnimation() in the base class matches the method in BitmapImage.
-        
-        Test: fast/backgrounds/animated-gif-as-background.html
-
-        * platform/graphics/Image.h:
-        (WebCore::Image::startAnimation):
-
-2009-01-02  David Smith  <catfish.man@gmail.com>
-
-        Reviewed by Darin Adler.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=22699
-        Enable NodeList caching for getElementsByTagName
-        
-        test: fast/dom/getelementsbytagnamens-mixed-namespaces.html
-
-        * dom/Document.cpp:
-        (WebCore::FormElementKeyHash::hash): Use WTF::stringHashingStartValue
-        * dom/Node.cpp:
-        (WebCore::Node::getElementsByTagNameNS): Ensure rare data and add a node list cache
-        (WebCore::NodeListsNodeData::invalidateCaches): Invalidate the tag name node list cache as well as the others
-        (WebCore::NodeListsNodeData::isEmpty): Check the tag name node list cache as well as the others
-        * dom/NodeRareData.h: Add m_tagNodeListCaches
-        * dom/QualifiedName.cpp:
-        * dom/QualifiedName.h: Move QNameHash to the header, make it work on QualifiedNames, and rename to QualifiedNameHash
-        * dom/StyledElement.cpp:
-        (WebCore::MappedAttributeHash::hash): Use WTF::stringHashingStartValue
-        * dom/TagNodeList.cpp:
-        (WebCore::TagNodeList::TagNodeList): Add a NodeList cache argument
-        * dom/TagNodeList.h: 
-        (WebCore::TagNodeList::create): Add a NodeList cache argument
-        * platform/text/StringHash.h:
-        (WebCore::CaseFoldingHash::hash): Use WTF::stringHashingStartValue
-        * platform/text/TextEncodingRegistry.cpp:
-        (WebCore::TextEncodingNameHash::hash): Use WTF::stringHashingStartValue
-
-2009-01-02  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Darin Adler
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=23066 & <rdar://problem/6028417> 
-        Full Page Zoom: a <video> element that doesn't include width/height attribute does not scale
-
-        * rendering/RenderVideo.cpp:
-        (WebCore::RenderVideo::calcReplacedWidth): Multiply aspect ratio width by style()->effectiveZoom()
-        (WebCore::RenderVideo::calcReplacedHeight): Multiply aspect ratio height by style()->effectiveZoom()
-
-2009-01-02  David Kilzer  <ddkilzer@apple.com>
-
-        BUILD FIX (r39552): Add mediaControls.css to other build files
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-
-2009-01-02  David Kilzer  <ddkilzer@apple.com>
-
-        Try to fix Wx build after r39427
-
-        * platform/graphics/wx/PathWx.cpp:
-        (WebCore::Path::strokeBoundingRect): Added stub.
-
-2009-01-02  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Adele Peterson.
-
-        <rdar://problem/6471356> Failed assertion on quit
-
-        * platform/ThreadGlobalData.cpp: (WebCore::ThreadGlobalData::~ThreadGlobalData):
-        Only assert that empty string are all removed on secondary threads.
-
-2009-01-02  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 23081: These files are no longer part of the KDE libraries
-
-        <https://bugs.webkit.org/show_bug.cgi?id=23081>
-
-        Reviewed by Darin Adler.
-
-        Removed "This file is part of the KDE libraries" comment from
-        source files.  Added or updated Apple copyrights as well.
-
-        No tests since there are only changes to comments.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::handleMouseDownEvent):
+        (WebCore::PopupListBox::handleMouseMoveEvent):
+        * platform/win/WheelEventWin.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
 
-        * bridge/testbindings.cpp:
-        * html/HTMLEntityNames.gperf:
-        * loader/Cache.h:
-        * loader/CachedCSSStyleSheet.h:
-        * loader/CachedResourceClient.h:
-        * loader/CachedResourceClientWalker.cpp:
-        * loader/CachedResourceClientWalker.h:
-        * loader/CachedScript.cpp:
-        * loader/CachedScript.h:
-        * loader/CachedXBLDocument.cpp:
-        * loader/CachedXBLDocument.h:
-        * loader/CachedXSLStyleSheet.cpp:
-        * loader/CachedXSLStyleSheet.h:
-        * rendering/GapRects.h:
-        * xml/XMLSerializer.cpp:
 
-2009-01-02  Simon Fraser  <simon.fraser@apple.com>
+2009-06-26  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Darin Adler
+        Reviewed by Dan Bernstein.
 
-        Use an OwnPtr for m_chromeClient.
+        <rdar://problem/7011924> Opacity transitions should not trigger hardware compositing mode
         
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::~SVGImage):
-        (WebCore::SVGImage::dataChanged):
-        * svg/graphics/SVGImage.h:
+        Don't go into compositing mode just for opacity transitions, but they will be
+        hardware acclerated if we're already compositing.
 
-2009-01-02  Simon Fraser  <simon.fraser@apple.com>
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::requiresCompositingForTransform):
+        (WebCore::RenderLayerCompositor::requiresCompositingForAnimation):
+        * rendering/RenderLayerCompositor.h:
 
-        Reviewed by Darin Adler
+2009-06-26  Simon Fraser  <simon.fraser@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=22981
+        Rubber-stamped by Dave Levin
 
-        Repaints inside of an SVGImage were thrown on the floor,
-        which broke incremental painting due to loading, or SVG animation.
-        Fix this by assigning the SVGImage a ChromeClient subclass that passes
-        along repaints via a new method on ImageObserver, which also takes
-        a rect parameter for the changed rect, allowing incremental repaints.
-        Fix RenderImage::imageChanged to take advantage of this changedRect to
-        only repaint the changed parts of the image.
+        Rename ioCompState to compositingState to better match WebCore coding style.
         
-        This also enables incremental painting for canvas-as-image, so
-        add tests for that too.
-
-        Tests: fast/backgrounds/animated-svg-as-background.html
-               fast/backgrounds/animated-svg-as-mask.html
-               fast/canvas/canvas-as-image-incremental-repaint.html
-               fast/canvas/canvas-as-image.html
-               fast/images/animated-svg-as-image.html
-
-        * css/CSSCanvasValue.cpp:
-        (WebCore::CSSCanvasValue::canvasChanged):
-        * loader/CachedImage.cpp:
-        (WebCore::CachedImage::notifyObservers):
-        (WebCore::CachedImage::data):
-        (WebCore::CachedImage::changedInRect):
-        * loader/CachedImage.h:
-        * loader/CachedResourceClient.h:
-        (WebCore::CachedResourceClient::imageChanged):
-        * platform/graphics/ImageObserver.h:
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::imageChanged):
-        * rendering/RenderBox.h:
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::imageChanged):
-        * rendering/RenderImage.h:
-        * rendering/RenderListMarker.cpp:
-        (WebCore::RenderListMarker::imageChanged):
-        * rendering/RenderListMarker.h:
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::imageChanged):
-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::imageChanged):
-        * rendering/RenderSVGImage.cpp:
-        (WebCore::RenderSVGImage::imageChanged):
-        * rendering/RenderSVGImage.h:
-        * rendering/RenderScrollbarPart.cpp:
-        (WebCore::RenderScrollbarPart::imageChanged):
-        * rendering/RenderScrollbarPart.h:
-        * rendering/RenderTableCol.cpp:
-        (WebCore::RenderTableCol::imageChanged):
-        * rendering/RenderTableCol.h:
-        * rendering/RenderTableRow.cpp:
-        (WebCore::RenderTableRow::imageChanged):
-        * rendering/RenderTableRow.h:
-        * rendering/RenderTableSection.cpp:
-        (WebCore::RenderTableSection::imageChanged):
-        * rendering/RenderTableSection.h:
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImageChromeClient::SVGImageChromeClient):
-        (WebCore::SVGImageChromeClient::image):
-        (WebCore::SVGImageChromeClient::chromeDestroyed):
-        (WebCore::SVGImageChromeClient::repaint):
-        (WebCore::SVGImage::SVGImage):
-        (WebCore::SVGImage::~SVGImage):
-        (WebCore::SVGImage::dataChanged):
-        * svg/graphics/SVGImage.h:
-
-2009-01-02  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Darin Adler
-
-        https://bugs.webkit.org/show_bug.cgi?id=23043
-
-        Pull media controls css out of html4.css into separate file. Don't generate
-        wml, svg, or media css globals unless the feature is enabled.
-
-        * DerivedSources.make:
-            Don't include css for unused features.
-
-        * WebCore.xcodeproj/project.pbxproj:
-            include mediaControls.css
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::styleForElement):
-            don't parse or add media css unless VIDEO feature is enabled and the target
-            element is video or audio
-
-        * css/html4.css:
-            moved media controls css to mediaControls.css
-
-        * css/mediaControls.css: Added.
-
-2009-01-02  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23022
-        Fix multiple issues with appcache online whitelist handling
-
-        Test: http/tests/appcache/online-whitelist.html
-
-        * loader/appcache/ApplicationCache.cpp:
-        (WebCore::ApplicationCache::isURLInOnlineWhitelist): Test whitelist entries as prefixes,
-        making it possible to use them for CGI invocation (as required by HTML5).
-
-        * loader/DocumentLoader.cpp: (WebCore::DocumentLoader::shouldLoadResourceFromApplicationCache):
-        Re-ordered checks, so that resources that are cached, but are also listed in online whitelist
-        are loaded from the cache. This is required by HTML5, although Firefox doesn't match.
-
-        * loader/appcache/ManifestParser.cpp:
-        (WebCore::parseManifest):
-        * loader/appcache/ManifestParser.h:
-        * loader/appcache/ApplicationCache.h:
-        (WebCore::ApplicationCache::onlineWhitelist):
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::store):
-        (WebCore::ApplicationCacheStorage::loadCache):
-        Changed online whitelist to be a vector of URLs, which is better suited for the new algorithm.
-
-2009-01-02  Darin Adler  <darin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 23072: REGRESSION (r37371): In the Dictionary application, scroll bar appears inside its web view when resizing its window
-        https://bugs.webkit.org/show_bug.cgi?id=23072
-        rdar://problem/6368028
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
 
-        * WebCore.base.exp: Updated.
-        * WebCore.xcodeproj/project.pbxproj: Mark HTMLHeadElement.h Private so it can be used in WebKit.
-
-        * dom/Document.cpp:
-        (WebCore::Document::Document): Initialize m_frameElementsShouldIgnoreScrolling to false.
-        * dom/Document.h: Added setFrameElementsShouldIgnoreScrolling, frameElementsShouldIgnoreScrolling,
-        and m_frameElementsShouldIgnoreScrolling.
-
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::parseMappedAttribute): Don't allow changes to the scrolling attribute
-        to affect the scrolling mode if frameElementsShouldIgnoreScrolling() returns true. This is only
-        triggered on Mac OS X when running the Dictionary application.
-
-2009-01-02  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23036
-        <rdar://problem/6451666> Implement AppCache fallback entries (23036)
-
-        Test: http/tests/appcache/fallback.html
-
-        * loader/FrameLoader.cpp: (WebCore::FrameLoader::loadResourceSynchronously): Use fallback
-        entries if normal loading fails.
-
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::shouldLoadResourceFromApplicationCache): Do not prevent normal
-        loading for resources that match fallback namespaces - they are only loaded from the cache
-        if that fails.
-        (WebCore::DocumentLoader::getApplicationCacheFallbackResource): Get a fallback entry for
-        resource from associated appcache, or from passed in one, if any.
-        (WebCore::DocumentLoader::scheduleLoadFallbackResourceFromApplicationCache): If a fallback
-        entry for resourse exists, add it to pending substitute loads.
-
-        * loader/DocumentLoader.h: Added new functions for loading fallback data for resources.
-
-        * loader/ResourceLoader.h:
-        * loader/ResourceLoader.cpp:
-        (WebCore::ResourceLoader::scheduleLoadFallbackResourceFromApplicationCache): This function
-        is called when normal loading fails (which includes network failures, 4xx and 5xx responses,
-        and cross-origin redirects) to load appcache fallback data instead. It can use either the
-        cache that is associated with the browsing context, or a custom one if association is yet
-        to take place.
-        (WebCore::ResourceLoader::willSendRequest): Try using fallback data.
-        (WebCore::ResourceLoader::didReceiveResponse): Ditto.
-        (WebCore::ResourceLoader::didFail): Ditto.
-
-        * loader/MainResourceLoader.cpp:
-        (WebCore::MainResourceLoader::didReceiveResponse): Locate an appropriate cache and load
-        fallback data from it if loading fails. The browsing context may still be associated with
-        its previous document here, so the cache to load from must be passed explicitly.
-        (WebCore::MainResourceLoader::didFail): Ditto.
-        (WebCore::MainResourceLoader::load): Remove unnecessary check and FIXME.
-
-        * loader/appcache/ApplicationCache.cpp:
-        (WebCore::ApplicationCache::setFallbackURLs):
-        (WebCore::ApplicationCache::urlMatchesFallbackNamespace):
-        * loader/appcache/ApplicationCache.h:
-        (WebCore::ApplicationCache::fallbackURLs):
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
-        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
-        (WebCore::ApplicationCacheStorage::store):
-        (WebCore::ApplicationCacheStorage::loadCache):
-        (WebCore::ApplicationCacheStorage::storeCopyOfCache):
-        * loader/appcache/ApplicationCacheStorage.h:
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::fallbackCacheForMainRequest):
-        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
-        * loader/appcache/ApplicationCacheGroup.h:
-        Implement fallback map saving and loading, pass it to the cache.
+2009-06-26  Dan Bernstein  <mitz@apple.com>
 
-        * loader/appcache/ManifestParser.h: Use a correct data structure for fallback map - keys
-        are matched by prefix, so HAshMap cannot be used.
-
-        * loader/appcache/ManifestParser.cpp: (WebCore::parseManifest): Fix bugs in fallback section
-        parsing.
-
-2009-01-01  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        <rdar://problem/6450530> WebCore::FontPlatformData should not leak
+        Reviewed by Mark Rowe.
 
-        Whoops, previous patch should also have fixed the font referencing in
-        the constructor.
+        - revert unintentional project changes from r45277
 
         * WebCore.xcodeproj/project.pbxproj:
-        * platform/graphics/mac/FontPlatformDataMac.mm:
-        (WebCore::FontPlatformData::FontPlatformData):
-
-2009-01-01  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by Dan Bernstein.
+2009-06-26  Mark Rowe  <mrowe@apple.com>
 
-        <rdar://problem/6450530> WebCore::FontPlatformData should not leak
+        Fix the Windows build.
 
-        Make sure we only adopt the new font, rather than re-referencing (and so leaking).
+        * WebCore.vcproj/WebCore.vcproj: Remove ColorSafari.cpp as
+        the file was deleted from SVN.
 
-        * platform/graphics/mac/FontPlatformDataMac.mm:
-        (WebCore::FontPlatformData::setFont):
-
-2009-01-01  Darin Adler  <darin@apple.com>
+2009-06-26  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Dan Bernstein.
 
-        Bug 23071: REGRESSION (r39536): New test failures after committing patch in bug 23051 (ICU search)
-        https://bugs.webkit.org/show_bug.cgi?id=23071
-
-        Also fix some things that Dan suggested during review of the ICU search patch that I forgot
-        the first time around.
-
-        * editing/TextIterator.cpp: Use ICU search on all platforms that use ICU, now that
-        we've double checked it works everywhere, removing HAVE_ICU_SEARCH entirely.
-        Removed unused m_atBreak data member from the non-ICU code path.
-        (WebCore::TextIterator::TextIterator): Move null check up.
-        (WebCore::TextIterator::handleTextBox): Fix mistake that made the iterator include
-        collapsed whitespace. This was left over from an earlier version of the patch.
-        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator):
-        Move null check up.
-
-2009-01-01  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler, Oliver Hunt
-
-        https://bugs.webkit.org/show_bug.cgi?id=23065
-        
-        Enable incremental painting of canvas. This turns incremental painting
-        back on, and fixes issues with stroke width and miters, calling willDraw()
-        for strokeText and fillText, and taking shadows into account.
-        
-        Test: fast/canvas/canvas-incremental-repaint.html
-
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasStrokeStyleApplier::CanvasStrokeStyleApplier):
-        (WebCore::CanvasStrokeStyleApplier::strokeStyle):
-        (WebCore::CanvasRenderingContext2D::stroke):
-        (WebCore::CanvasRenderingContext2D::willDraw):
-        (WebCore::CanvasRenderingContext2D::putImageData):
-        (WebCore::CanvasRenderingContext2D::drawTextInternal):
-        * html/CanvasRenderingContext2D.h:
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::willDraw):
-        * platform/graphics/FloatRect.h:
-        (WebCore::mapRect): new method to map a rect contained
-        in one rect to an equivalent rect inside another rect.
-
-2008-12-29  Konstantin Käfer  <kkaefer@gmail.com>
-
-        Reviewed by Tim Hatcher.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=17229
-        <rdar://problem/5732829> Inspector should show properties of all JS objects in Console
-
-        Prints objects not as plain text but makes them expandable so that
-        they can be inspected.
-
-        * inspector/front-end/Console.js:
-        (): added a parameter "inline" to the WebInspector.Console._format function which indicates
-            whether the object is printed in the context of another string (with console.log()) or
-            as sole element.
-        (.): objects and DOM nodes are now printed in an expandable form when they are printed alone
-            (i.e. not in the context of a console.log() string) so that they can be inspected.
-        * inspector/front-end/PropertiesSection.js:
-        (WebInspector.PropertiesSection.prototype.set title): Allow DOM Nodes as title instead of strings
-            in that case, the Node is inserted into the title instead of the string value of the passed
-            object. This is used for displaying linkified titles, for example when inspecting DOM nodes,
-            the syntax highlighted HTML representation is shown instead of the plain source code.
-        * inspector/front-end/inspector.css: correct the offsetParent for the expandable object inspector.
-
-2009-01-01  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Bug 23051: web page searching should use ICU's search so it can ignore diacritical differences
-        https://bugs.webkit.org/show_bug.cgi?id=23051
-        rdar://problem/3574497
-
-        Test: editing/execCommand/findString-diacriticals.html
-
-        * editing/TextIterator.cpp: Changed the CircularSearchBuffer class to have a new
-        name, since it doesn't always use a circular buffer any more. Changed the interface
-        so it can work well in the new chunky comparison mode for ICU search, and also
-        added private data members for both the ICU-search and non-ICU-search code paths.
-        (WebCore::TextIterator::TextIterator): Use the versions of the Range functions
-        that don't take an exception code.
-        (WebCore::TextIterator::handleTextBox): Added a special case to handle the position
-        of a collapsed-away space better. This is not needed for search mechanism, but was
-        helpful in an earlier version of this patch, and is still an improvement.
-        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator): Use the
-        versions of the Range functions that don't take an exception code.
-        (WebCore::CharacterIterator::range): Ditto.
-        (WebCore::characterSubrange): Added. Helper function used in both places below where
-        we want to convert a range and character offsets into a subrange.
-        (WebCore::WordAwareIterator::advance): Use the versions of the Range functions that
-        don't take an exception code.
-        (WebCore::createSearcher): Added.
-        (WebCore::searcher): Added.
-        (WebCore::lockSearcher): Added.
-        (WebCore::unlockSearcher): Added.
-        (WebCore::SearchBuffer::SearchBuffer): Added.
-        (WebCore::SearchBuffer::~SearchBuffer): Added.
-        (WebCore::SearchBuffer::append): Added.
-        (WebCore::SearchBuffer::atBreak): Added.
-        (WebCore::SearchBuffer::reachedBreak): Added.
-        (WebCore::SearchBuffer::search): Added.
-        (WebCore::SearchBuffer::length): Added.
-        (WebCore::TextIterator::subrange): Changed to call the characterSubrange
-        function above.
-        (WebCore::TextIterator::rangeFromLocationAndLength): Use the versions of the
-        Range functions that don't take an exception code. Also tweak some other details
-        of the code.
-        (WebCore::isAllCollapsibleWhitespace): Added.
-        (WebCore::collapsedToBoundary): Added.
-        (WebCore::findPlainText): Rewrote to use new interface and streamline the
-        logic a bit.
-
-        Add the relevant files in the icu directory. As icu/README says, the "icu"
-        directory is really just for Mac OS X, where we have the ICU library but not
-        the headers installed. It should be moved inside platform/mac at some point
-        to make this more clear (and the copy in JavaScriptCore should be moved
-        somewhere similar for the same reason).
-
-        * icu/unicode/ucoleitr.h: Added.
-        * icu/unicode/usearch.h: Added.
-
-2009-01-01  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        CrashTracer: [REGRESSION] 1090 crashes in Safari at com.apple.JavaScriptCore: KJS::JSGlobalObject::stopTimeoutCheck + 0
-        <rdar://problem/5821130>
-
-        This was caused by a plugin instance calling into JS code that removed the plugin
-        object.  This fix is to cache the global object locally in a ProtectedPtr so we don't
-        need to rely on the continued existence of the plugin instance.
-
-        * bridge/NP_jsobject.cpp:
-        (_NPN_InvokeDefault):
-        (_NPN_Invoke):
-        (_NPN_Evaluate):
-        (_NPN_Construct):
-
-2008-12-31  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Holger Freyther.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22964
-
-        MinGW build failure.
-
-        * platform/graphics/qt/SimpleFontDataQt.cpp:
-        (WebCore::SimpleFontData::containsCharacters):
-
-2008-12-31  Alexander V. Butenko  <alex@digiqube.com>
-
-        Reviewed by Holger Freyther.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22750
-        [gtk] webkit up to r39121 crash on image urls like
-        http:///sitename.com
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::ResourceHandle::start):
-
-2008-12-31  Hiroyuki Ikezoe  <poincare@ikezoe.net>
-
-        Reviewed by Holger Freyther.
-
-        https://bugs.webkit.org/show_bug.cgi?id=18310
-
-        * platform/graphics/gtk/SimpleFontDataPango.cpp:
-        (WebCore::SimpleFontData::determinePitch): Do not invoke
-        isFixedPitch() when the font is a custom font.
-
-2008-12-31  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        More work on Bug 3781: Animation via canvas could be faster
-        <https://bugs.webkit.org/show_bug.cgi?id=3781>
-
-        Make use of the fast path parsing of color strings that Color
-        uses.  This improves performance of '#rgb', '#rrggbb', etc and
-        named (eg. 'green') colors.
-
-        Improves frame rate of test by around 40%
-
-        * html/CanvasStyle.cpp:
-        (WebCore::CanvasStyle::applyStrokeColor):
-        (WebCore::CanvasStyle::applyFillColor):
-
-2008-12-30  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler
-
-        https://bugs.webkit.org/show_bug.cgi?id=23042
-        
-        Rather than doing a repaint() inside of computeAbsoluteRepaintRect()
-        when there is a reflection, compute the location of the rect inside
-        the reflection and take the union of the unreflected and reflected rects.
-        
-        Test: fast/repaint/reflection-redraw.html
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::computeAbsoluteRepaintRect):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::reflectedRect):
-        * rendering/RenderObject.h:
-
-2008-12-30  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        - fix <rdar://problem/6469944> REGRESSION(3.2.1-ToT): Repro crash in WebCore::HTMLInputElement::updatePlaceholderVisibility opening http://billshrink.com
-
-        Test: fast/forms/placeholder-non-textfield.html
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::parseMappedAttribute): Only call
-        updatePlaceholderVisibility() when the placeholder attribute changes if
-        the element is a text field.
-
-2008-12-30  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Antti Koivisto.
-
-        First step of Bug 3781: Animation via canvas could be faster
-
-        Amortise the cost of calling repaint by coalescing repaint rects
-        while the canvas is drawn to.  In a later step we'll stop calling
-        repaint() directly, and instead have all dirty canvases repaint
-        at the end of JS execution.
-
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::willDraw):
-        (WebCore::HTMLCanvasElement::paint):
-        * html/HTMLCanvasElement.h:
-
-2008-12-30  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Antti Koivisto.
-
-        Bug 22931: Using the inspector with purgeable resources leads to assertion failures
-        <https://bugs.webkit.org/show_bug.cgi?id=22931>
-
-        Change InspectorResource::sourceString() so that it doesn't attempt to
-        unsafely get the data of a purgeable CachedResource.
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorResource::sourceString): Attempt to make a purgeable
-        resource unpurgeable, and if this not possible, return an empty string.
-        * loader/CachedResource.h: Make InspectorResource a friend of CachedResource.
+        https://bugs.webkit.org/show_bug.cgi?id=26766
 
-2008-12-29  Alexey Proskuryakov  <ap@webkit.org>
+        Change to use array indexing rather than Vector enumerators; the former
+        are preferred style.
 
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23023
-        Remove incomplete support for opportunistic appcache entries
-
-        No change in behavior, thus no test.
-
-        * loader/appcache/ApplicationCacheResource.h:
-        (WebCore::ApplicationCacheResource::Type): Removed Opportunistic bit, will re-use when schema
-        version changes.
-
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::scheduleApplicationCacheLoad):
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
-        * loader/appcache/ApplicationCacheResource.cpp:
-        (WebCore::ApplicationCacheResource::dumpType):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::hasNonCompositingContent):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::updateCompositingChildrenGeometry):
+        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect):
+        (WebCore::RenderLayerCompositor::layerHas3DContent):
 
-2008-12-29  Dirk Schulze  <krit@webkit.org>
+2009-06-26  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        Add arcTo support for Cairo. This is needed by Canvas.
-        Cairo has no native support for arcTo. We have to make our
-        own implementation.
+        - fix <rdar://problem/6961476> REGRESSION (r42043): scrollWidth reported
+          as 1 px
 
-        [Canvas] Cairo needs arcTo
-        https://bugs.webkit.org/show_bug.cgi?id=23003
+        Test: fast/dom/Element/scrollWidth.html
 
-        * platform/graphics/cairo/PathCairo.cpp:
-        (WebCore::Path::addArcTo):
+        Changed scrollWidth and scrollHeight to use the same logic for
+        visible overflow boxes that is used for clipped overflow boxes. In
+        particular, borders are not included and
+        {leftmost,rightmost,lowest}Position() are used. This logic matches IE8.
 
-2008-12-29  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Bug 23030: Cannot setTransform with a non-invertible ctm
-
-        Removed a series of unnecessary and incorrect checks for an invertible
-        transform.
-
-        Test: fast/canvas/canvas-set-properties-with-non-invertible-ctm.html
-
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::setStrokeStyle):
-        (WebCore::CanvasRenderingContext2D::setFillStyle):
-            These properties are not effected by the current CTM, so there
-            is no need to prevent them from being assigned.
-
-        (WebCore::CanvasRenderingContext2D::setTransform):
-            The whole point of tracking whether the current CTM was expected to be
-            non-invertible was to allow setTransform to be used when the CTM had become
-            non-invertible.
-
-        (WebCore::CanvasRenderingContext2D::beginPath):
-        (WebCore::CanvasRenderingContext2D::closePath):
-            beginPath and closePath change the state of the path, but not any of
-            its coordinates so there is no need prevent them from being called.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
 
-2008-12-29  Josh Roesslein  <jroesslein@gmail.com>
+2009-06-26  Chris Fleizach  <cfleizach@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22968
+        Bug 26725: aria-hidden, aria-disabled, aria-readonly need to be implemented
+        https://bugs.webkit.org/show_bug.cgi?id=26725
 
-        Context menu rendering error when full page zoomed
+        Tests: accessibility/aria-disabled.html
+               accessibility/aria-hidden.html
+               accessibility/aria-readonly.html
 
-        * page/ContextMenuController.cpp:
-        (WebCore::ContextMenuController::handleContextMenuEvent):
-
-2008-12-29  Sam Weinig  <sam@webkit.org>
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaIsHidden):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::isEnabled):
+        (WebCore::AccessibilityRenderObject::canSetValueAttribute):
+        * accessibility/AccessibilityRenderObject.h:
+        * html/HTMLAttributeNames.in:
 
-        Reviewed by Mark Rowe.
+2009-06-26  Brett Wilson  <brettw@chromium.org>
 
-        Add some basic memory statistic logging for Node.
+        Reviewed by David Levin.
 
-        * dom/Node.cpp:
-        (WebCore::Node::dumpStatistics):
-        (WebCore::Node::Node):
-        (WebCore::Node::~Node):
-        (WebCore::Node::setDocument):
-        * dom/Node.h:
+        https://bugs.webkit.org/show_bug.cgi?id=26759
 
-2008-12-29  Sam Weinig  <sam@webkit.org>
+        GIFImageDecoder is broken.
 
-        Reviewed by Anders Carlsson.
+        Make the GIFImageDecoder.repetitionCount function const to match the
+        base class. The mismatched definitions were causing the function to not
+        get called.
 
-        Remove one use of DeprecatedPtrList.
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::repetitionCount):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
 
-        * css/CSSRuleList.cpp:
-        (WebCore::CSSRuleList::~CSSRuleList):
-        (WebCore::CSSRuleList::length):
-        (WebCore::CSSRuleList::item):
-        (WebCore::CSSRuleList::deleteRule):
-        (WebCore::CSSRuleList::append):
-        (WebCore::CSSRuleList::insertRule):
-        * css/CSSRuleList.h: Change m_lstCSSRules from using DeprecatedPtrList to a Vector.
-        I measured no performance change and was comforted by the fact that we use a Vector
-        for StyleList, which serves the exact same purpose.
+2009-06-26  Chris Marrin  <cmarrin@apple.com>
 
-2008-12-29  Adele Peterson  <adele@apple.com>
+        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
 
-        Reviewed by Brady Eidson.
+        Additional fix for https://bugs.webkit.org/show_bug.cgi?id=26651
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21797
-        <rdar://problem/6310682> REGRESSION: Crash in CFHTTPCookieStorageCopy beneath WebCore::cookies() when 
-        running fast/dom/document-attribute-js-null.html and http/tests/security/cookies/create-document.html
-        
-        Return early if the document is trying to get or set a cookie with an empty cookie url.
+        The flag should always default to true to avoid it getting set
+        to false in a build with accelerated compositing turned off
+        and then disabling accelerated compositing when subsequently
+        running a build with it turned on.
 
-        * dom/Document.cpp:
-        (WebCore::Document::cookie):
-        (WebCore::Document::setCookie):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
 
-2008-12-28  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+2009-06-26  Brady Eidson  <beidson@apple.com>
 
         Reviewed by Sam Weinig.
 
-        Bug 23016: JavaScriptDebugServer::recompileAllJSFunctions() should not execute JS while reparsing all functions
-        <https://bugs.webkit.org/show_bug.cgi?id=23016>
-        <rdar://problem/6425077>
-
-        JavaScriptDebugServer::recompileAllJSFunctions() calls sourceParsed() while
-        reparsing all JS functions, which will execute JS in the inspector. Depending
-        on the order in which functions are recompiled, a function could have a new
-        body but other functions that have not been recompiled could have an optimized
-        (in the sense of inline caching) call to it, bypassing the check of whether or
-        not there is generated bytecode. This leads to a crash caused by accessing
-        indices off of a null pointer.
-
-        To fix the problem, simply delay calling sourceParsed() until after all functions
-        have been reparsed. The crash isn't 100% reproducible, but on the one test case
-        I have, this makes it impossible to reproduce after a large number of attempts,
-        when it used to happen every few attempts.
-
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
-
-2008-12-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Rubber-stamped by Antti Koivisto.
-        Oops, remove some last minute ASSERTS that are obviously wrong.
-
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
-
-2008-12-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Antti Koivisto.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=23015
-
-        Don't rely on HTMLFormControlElement in RenderTextControl.
-
-        Introduce an abstract FormControlElement class, containing the
-        valueMatchesRenderer/setValueMatchesRenderer, the only HTMLFormControlElement
-        specific methods that RenderTextControl relies on.
-
-        This makes it possible for WML to reuse RenderTextControl.
-        RenderTextControlSingleLine still relies on HTMLInputElement,
-        this will change if WMLInputElement is introduced.
-
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * dom/FormControlElement.h: Added.
-        (WebCore::FormControlElement::~FormControlElement):
-        (WebCore::FormControlElement::FormControlElement):
-        * html/HTMLFormControlElement.h:
-        (WebCore::HTMLFormControlElement::valueMatchesRenderer):
-        (WebCore::HTMLFormControlElement::setValueMatchesRenderer):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::updateValue):
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::adjustInnerTextStyle):
-        (WebCore::RenderTextControl::updateFromElement):
-        (WebCore::RenderTextControl::setInnerTextValue):
-        (WebCore::RenderTextControl::selectionChanged):
-        (WebCore::RenderTextControl::formControlElement):
-        * rendering/RenderTextControl.h:
-        * rendering/RenderTextControlMultiLine.cpp:
-        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
-        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
-        * rendering/RenderTextControlSingleLine.cpp:
-        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
-        (WebCore::RenderTextControlSingleLine::updateFromElement):
-
-2008-12-28  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Darin Adler.
-
-        Bug 23006: Many Loader::Host member functions are not safe to use reentrantly
-        <https://bugs.webkit.org/show_bug.cgi?id=23006>
-        <rdar://problem/6216106>
-
-        Many Loader::Host member functions set m_processingResource to true when they
-        begin processing a resource and set it to false when they are done. Thanks to
-        JavaScript and the web inspector, almost anything can happen during the
-        processing of a resource, including these functions being called reentrantly,
-        which is unsafe due to this way of using m_processingResource.
-
-        This can theoretically cause a Loader::Host to be used after it is freed,
-        because when Loader::servedPendingRequests() is called, it will free Hosts
-        that have m_processingResource set to false.
-
-        To fix this, we replace m_processingResource with m_numResourcesProcessing,
-        which is incremented and decremented using a helper object, ProcessingResource.
-
-        There are no occurrences of crashes caused by this bug that are reproducible
-        by multiple people, but this fixes the problem of m_processingResource being
-        set to false while a Host is still alive.
-
-        * loader/loader.cpp:
-        (WebCore::Loader::Host::Host):
-        (WebCore::Loader::Host::didFinishLoading): Change to use ProcessingResource
-        instead of manually setting m_processingResource.
-        (WebCore::Loader::Host::didFail): Ditto.
-        (WebCore::Loader::Host::didReceiveData): Ditto.
-        * loader/loader.h:
-        (WebCore::Loader::Host::ProcessingResource::ProcessingResource): Added.
-        (WebCore::Loader::Host::ProcessingResource::~ProcessingResource): Added.
-        (WebCore::Loader::Host::processingResource): Change to use m_numResourcesProcessing
-        instead of just getting m_processingResource.
-
-2008-12-28  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23007
-        REGRESSION: Timer-related crash when closing Web Inspector
-
-        Test: fast/dom/Window/remove-timeout-crash.html
-
-        * bindings/js/DOMTimer.cpp: (WebCore::DOMTimer::fired): Besides deleting the timer, make
-        sure to remove it from a Document map.
-
-2008-12-28  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Anders Carlsson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23012
-        Bring application cache manifest parsing up to date
-
-        Test: http/tests/appcache/manifest-parsing.html
-
-        * loader/appcache/ManifestParser.cpp:
-        (WebCore::Mode): Added a constant for unknown sections, which are ignored when parsing. This
-        is necessary for future extensions.
-        (WebCore::parseManifest): Parse unknown sections correctly. Ignore trailing tokens in
-        supported sections.
-
-2008-12-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Darin Adler.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22996
-
-        RenderTextControl heavily depends on HTMLInputElement & HTMLTextAreaElement.
-        It handles multi & single line text control rendering in one class. Split up
-        in two new classes: RenderTextControlSingleLine & RenderTextControlMultiLine.
-
-        This has several benefits - code is more readable now, the memory usage
-        for RenderTextControlMultiLine is reduced, as all stuff related to search fields
-        lives in RenderTextControlSingleLine, and it's easier to introduce an
-        abstraction for input/textarea-like elements for other HTML flavours like WML.
+        Followup for the fix for <rdar://problem/6961578> REGRESSION (r43511): Opening .fdf files from Acrobat Professional fails
 
-        * GNUmakefile.am:
-        * WebCore.order:
-        * WebCore.pro:
-        * WebCore.scons:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::createRenderer):
-        (WebCore::HTMLInputElement::defaultEventHandler):
-        (WebCore::HTMLInputElement::updatePlaceholderVisibility):
-        (WebCore::HTMLInputElement::addSearchResult):
-        (WebCore::HTMLInputElement::onSearch):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::createRenderer):
-        (WebCore::HTMLTextAreaElement::defaultEventHandler):
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::RenderTextControl):
-        (WebCore::RenderTextControl::~RenderTextControl):
-        (WebCore::RenderTextControl::styleDidChange):
-        (WebCore::RenderTextControl::adjustInnerTextStyle):
-        (WebCore::RenderTextControl::createSubtreeIfNeeded):
-        (WebCore::RenderTextControl::textBlockHeight):
-        (WebCore::RenderTextControl::textBlockWidth):
-        (WebCore::RenderTextControl::updateFromElement):
-        (WebCore::RenderTextControl::setInnerTextValue):
-        (WebCore::RenderTextControl::setSelectionRange):
-        (WebCore::RenderTextControl::visiblePositionForIndex):
-        (WebCore::RenderTextControl::indexForVisiblePosition):
-        (WebCore::RenderTextControl::subtreeHasChanged):
-        (WebCore::RenderTextControl::scrollbarThickness):
-        (WebCore::RenderTextControl::calcHeight):
-        (WebCore::RenderTextControl::hitInnerTextBlock):
-        (WebCore::RenderTextControl::forwardEvent):
-        (WebCore::RenderTextControl::calcPrefWidths):
-        (WebCore::RenderTextControl::selectionChanged):
-        (WebCore::RenderTextControl::innerTextElement):
-        * rendering/RenderTextControl.h:
-        (WebCore::RenderTextControl::hasControlClip):
-        (WebCore::RenderTextControl::canHaveChildren):
-        (WebCore::RenderTextControl::avoidsFloats):
-        (WebCore::RenderTextControl::isEdited):
-        (WebCore::RenderTextControl::setEdited):
-        * rendering/RenderTextControlMultiLine.cpp: Added.
-        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
-        (WebCore::RenderTextControlMultiLine::~RenderTextControlMultiLine):
-        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
-        (WebCore::RenderTextControlMultiLine::layout):
-        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
-        (WebCore::RenderTextControlMultiLine::forwardEvent):
-        (WebCore::RenderTextControlMultiLine::preferredContentWidth):
-        (WebCore::RenderTextControlMultiLine::adjustControlHeightBasedOnLineHeight):
-        (WebCore::RenderTextControlMultiLine::baselinePosition):
-        (WebCore::RenderTextControlMultiLine::updateFromElement):
-        (WebCore::RenderTextControlMultiLine::cacheSelection):
-        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
-        * rendering/RenderTextControlMultiLine.h: Added.
-        (WebCore::RenderTextControlMultiLine::isTextArea):
-        * rendering/RenderTextControlSingleLine.cpp: Added.
-        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
-        (WebCore::RenderTextControlSingleLine::~RenderTextControlSingleLine):
-        (WebCore::RenderTextControlSingleLine::placeholderShouldBeVisible):
-        (WebCore::RenderTextControlSingleLine::updatePlaceholderVisibility):
-        (WebCore::RenderTextControlSingleLine::addSearchResult):
-        (WebCore::RenderTextControlSingleLine::stopSearchEventTimer):
-        (WebCore::RenderTextControlSingleLine::showPopup):
-        (WebCore::RenderTextControlSingleLine::hidePopup):
-        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
-        (WebCore::RenderTextControlSingleLine::paint):
-        (WebCore::RenderTextControlSingleLine::layout):
-        (WebCore::RenderTextControlSingleLine::nodeAtPoint):
-        (WebCore::RenderTextControlSingleLine::forwardEvent):
-        (WebCore::RenderTextControlSingleLine::styleDidChange):
-        (WebCore::RenderTextControlSingleLine::capsLockStateMayHaveChanged):
-        (WebCore::RenderTextControlSingleLine::textBlockWidth):
-        (WebCore::RenderTextControlSingleLine::preferredContentWidth):
-        (WebCore::RenderTextControlSingleLine::adjustControlHeightBasedOnLineHeight):
-        (WebCore::RenderTextControlSingleLine::createSubtreeIfNeeded):
-        (WebCore::RenderTextControlSingleLine::updateFromElement):
-        (WebCore::RenderTextControlSingleLine::cacheSelection):
-        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):
-        (WebCore::RenderTextControlSingleLine::createInnerBlockStyle):
-        (WebCore::RenderTextControlSingleLine::createResultsButtonStyle):
-        (WebCore::RenderTextControlSingleLine::createCancelButtonStyle):
-        (WebCore::RenderTextControlSingleLine::updateCancelButtonVisibility):
-        (WebCore::RenderTextControlSingleLine::autosaveName):
-        (WebCore::RenderTextControlSingleLine::startSearchEventTimer):
-        (WebCore::RenderTextControlSingleLine::searchEventTimerFired):
-        (WebCore::RenderTextControlSingleLine::valueChanged):
-        (WebCore::RenderTextControlSingleLine::itemText):
-        (WebCore::RenderTextControlSingleLine::itemIsEnabled):
-        (WebCore::RenderTextControlSingleLine::itemStyle):
-        (WebCore::RenderTextControlSingleLine::menuStyle):
-        (WebCore::RenderTextControlSingleLine::clientInsetLeft):
-        (WebCore::RenderTextControlSingleLine::clientInsetRight):
-        (WebCore::RenderTextControlSingleLine::clientPaddingLeft):
-        (WebCore::RenderTextControlSingleLine::clientPaddingRight):
-        (WebCore::RenderTextControlSingleLine::listSize):
-        (WebCore::RenderTextControlSingleLine::selectedIndex):
-        (WebCore::RenderTextControlSingleLine::itemIsSeparator):
-        (WebCore::RenderTextControlSingleLine::itemIsLabel):
-        (WebCore::RenderTextControlSingleLine::itemIsSelected):
-        (WebCore::RenderTextControlSingleLine::setTextFromItem):
-        (WebCore::RenderTextControlSingleLine::fontSelector):
-        (WebCore::RenderTextControlSingleLine::hostWindow):
-        (WebCore::RenderTextControlSingleLine::createScrollbar):
-        * rendering/RenderTextControlSingleLine.h: Added.
-        (WebCore::RenderTextControlSingleLine::hasControlClip):
-        (WebCore::RenderTextControlSingleLine::isTextField):
-        (WebCore::RenderTextControlSingleLine::placeholderIsVisible):
-        (WebCore::RenderTextControlSingleLine::popupIsVisible):
-        (WebCore::RenderTextControlSingleLine::shouldPopOver):
-        (WebCore::RenderTextControlSingleLine::valueShouldChangeOnHotTrack):
-        * rendering/TextControlInnerElements.cpp:
-        (WebCore::RenderTextControlInnerBlock::nodeAtPoint):
-        (WebCore::SearchFieldResultsButtonElement::defaultEventHandler):
-
-2008-12-28  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22755
-        Prepare to add create/remove timeout methods to JSWorkerContext by moving
-        timer-specific code from JSDOMWindowBase to DOMTimer.
-        Moved everything JS-related from DOMTimer to ScheduledAction.
-        Now ScheduledAction is what it wanted to be all the time: a JS engine-specific 
-        container for timer callback that knows how to invoke it.
-        DOMTimer is not anymore JS-specific.
-
-        This is mostly moving the code around. No intended functional changes.
-
-        * bindings/js/DOMTimer.cpp:
-        (WebCore::DOMTimer::DOMTimer):
-        (WebCore::DOMTimer::~DOMTimer):
-        (WebCore::DOMTimer::install):
-        (WebCore::DOMTimer::removeById):
-        (WebCore::DOMTimer::fired):
-        (WebCore::DOMTimer::stop):
-        * bindings/js/DOMTimer.h:
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::installTimeout):
-        (WebCore::JSDOMWindowBase::removeTimeout):
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::execute):
-        * bindings/js/ScheduledAction.h:
-        * dom/Document.cpp:
-        (WebCore::Document::addTimeout):
+        Now that other MIME type correction stuff is in our swizzled method, Tiger needs it too!
 
-2008-12-26  Zalan Bujtas  <zbujtas@gmail.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22999
-        Check if database thread exists.
-
-        * storage/Database.cpp:
-        (WebCore::Database::openAndVerifyVersion):
-        (WebCore::Database::markAsDeletedAndClose):
-        (WebCore::Database::tableNames):
-
-2008-12-26  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=23001
-        A call to applicationCache.update() from a cached event listener should be ignored
-
-        Test: http/tests/appcache/idempotent-update.html
-
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete): Only reset m_status after
-        dispatching events.
-
-2008-12-26  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22997
-        ASSERTION FAILED: !m_resources.contains(url) in ApplicationCache::addResource()
-
-        Tests: http/tests/appcache/top-frame-1.html
-               http/tests/appcache/top-frame-2.html
-               http/tests/appcache/top-frame-3.html
-               http/tests/appcache/top-frame-4.html
-
-        * loader/appcache/ApplicationCacheGroup.cpp: (WebCore::ApplicationCacheGroup::cacheForMainRequest):
-        Fixed one more instance of top level frame being used for caching purposes.
-
-2008-12-26  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22987
-        Fix for broken test editing/execCommand/5763082.html
-
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::mergeIdenticalElements): Used local RefPtr to hold onto
-        function parameter across multiple calls.
-
-2008-12-25  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22993
-        Application cache shouldn't be inherited by subframes
-
-        <rdar://problem/6284708> AppCache crashes in ApplicationCacheResource::addType()
-        This crash happened because main resource for subframe was looked up in top frame's
-        appcache. If not for the spec change, it could have been fixed by preventing the load
-        altogether.
-
-        Test: http/tests/appcache/foreign-iframe-main.html
-        I intend to write additional tests for the behavior change.
-
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::shouldLoadResourceFromApplicationCache):
-        * loader/DocumentLoader.h:
-        (WebCore::DocumentLoader::applicationCache):
-        * loader/MainResourceLoader.cpp:
-        (WebCore::MainResourceLoader::load):
-        * loader/appcache/DOMApplicationCache.cpp:
-        (WebCore::DOMApplicationCache::associatedCache):
-        Removed DocumentLoader::topLevelApplicationCache(), and changed callers accordingly.
-
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::selectCache):
-        (WebCore::ApplicationCacheGroup::selectCacheWithoutManifestURL):
-        Removed checks for the frame being top-level one, now that subframes are cached independently.
-
-2008-12-25  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        <rdar://problem/6465669> Frequent !isPurgeable() assertion in WebCore::CachedResource::addClient
-        
-        Disallow turning resources that are being revalidated to purgable state.
-        
-        No test, the condition is difficult to produce in DRT.
-
-        * loader/CachedCSSStyleSheet.cpp:
-        (WebCore::CachedCSSStyleSheet::allClientsRemoved):
-        * loader/CachedImage.cpp:
-        (WebCore::CachedImage::destroyDecodedData):
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::isSafeToMakePurgeable):
-        (WebCore::CachedResource::makePurgeable):
-        * loader/CachedResource.h:
-        * loader/CachedScript.cpp:
-        (WebCore::CachedScript::destroyDecodedData):
-
-2008-12-25  Alexey Proskuryakov  <ap@webkit.org>
-
-        Qt build fix.
-
-        * WebCore.pro: Added ThreadGlobalData.cpp.
-
-2008-12-24  Mark Rowe  <mrowe@apple.com>
-
-        Build fix.
-
-        * WebCore.base.exp:  Remove a symbol from the export file now that it is no longer generated.
-
-2008-12-24  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Unreviewed build fix to find addSubresourceURL
-
-        This is needed to compile on WebKit/Gtk+
-
-        * css/CSSFontFaceSrcValue.cpp:
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
+        * platform/network/mac/WebCoreURLResponse.h:
 
-2008-12-23  Alexey Proskuryakov  <ap@webkit.org>
+2009-06-26  Jeremy Orlow  <jorlow@chromium.org>
 
-        Reviewed by Darin Adler.
+        Reviewed by Darin Fisher.
 
-        https://bugs.webkit.org/show_bug.cgi?id=22980
-        WebCore uses more thread specific keys than it really needs
+        https://bugs.webkit.org/show_bug.cgi?id=26732
 
-        Consolidated ThreadSpecific data into a single ThreadGlobalData structure.
+        For the final step of https://bugs.webkit.org/show_bug.cgi?id=25376,
+        combine LocalStorage and SessionStorage into StorageNamespace. The
+        synching code (for LocalStorage) has already been removed, so these
+        classes are now very similar.  All they do is essentially contain a
+        logical grouping of origins that are attached to specific contexts
+        (be it PageGroups for LocalStorage and Page for SessionStorage).
 
         * GNUmakefile.am:
-        * WebCore.base.exp:
-        * WebCore.scons:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
         * WebCoreSources.bkl:
-        * dom/EventNames.cpp:
-        * dom/EventNames.h:
-        (WebCore::eventNames):
-        * page/Frame.cpp:
-        (WebCore::Frame::Frame):
-        * platform/ThreadGlobalData.cpp: Added.
-        (WebCore::threadGlobalData):
-        (WebCore::ThreadGlobalData::ThreadGlobalData):
-        (WebCore::ThreadGlobalData::~ThreadGlobalData):
-        * platform/ThreadGlobalData.h: Added.
-        (WebCore::ThreadGlobalData::eventNames):
-        (WebCore::ThreadGlobalData::emptyString):
-        (WebCore::ThreadGlobalData::atomicStringTable):
-        (WebCore::ThreadGlobalData::cachedConverterICU):
-        (WebCore::ThreadGlobalData::cachedConverterTEC):
-        * platform/text/AtomicString.cpp:
-        (WebCore::stringTable):
-        (WebCore::AtomicString::add):
-        (WebCore::AtomicString::remove):
-        (WebCore::AtomicString::find):
-        (WebCore::AtomicString::init):
-        * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::empty):
-        * platform/text/StringImpl.h:
-        * platform/text/TextCodecICU.cpp:
-        (WebCore::ICUConverterWrapper::~ICUConverterWrapper):
-        (WebCore::cachedConverterICU):
-        * platform/text/TextCodecICU.h:
-        (WebCore::ICUConverterWrapper::ICUConverterWrapper):
-        * platform/text/mac/TextCodecMac.cpp:
-        (WebCore::cachedConverterTEC):
-        * platform/text/mac/TextCodecMac.h:
-        (WebCore::TECConverterWrapper::TECConverterWrapper):
-        (WebCore::TECConverterWrapper::~TECConverterWrapper):
-
-2008-12-23  Mark Rowe  <mrowe@apple.com>
-
-        Build fix.
-
-        * WebCore.xcodeproj/project.pbxproj: CSSPropertyNames.h is a generated file so it needs to be explicitly copied
-        into the PrivateHeaders directory, rather than relying on the automatic copying of headers which runs before the
-        derived sources are generated.
-
-2008-12-23  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein
-
-        https://bugs.webkit.org/show_bug.cgi?id=22941
-        
-        If the document element has opacity, we need to erase the view background to
-        white before painting.
-        
-        Test: fast/backgrounds/opacity-on-document-element.html
-
-        * rendering/RenderView.cpp:
-        (WebCore::rendererObscuresBackground):
-
-2008-12-23  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein
-
-        https://bugs.webkit.org/show_bug.cgi?id=21910
-        
-        Fix SVGImage painting by ensuring that the SVGImage resizes its FrameView correctly.
-        Otherwise the FrameView is left at 0x0, and nothing paints.
-        
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::draw):
-
-2008-12-23  Darin Adler  <darin@apple.com>
-
-        Reviewed by John Sullivan.
-
-        - improve robustness of undo/redo in HTML editing to fix the following bugs
-          <https://bugs.webkit.org/show_bug.cgi?id=19703> Crash in WebCore::InsertNodeBeforeCommand::doUnapply()
-          <rdar://problem/4059423> DOM operations performed on editable HTML can cause a crash later during Undo
-
-        Major categories of improvements:
-
-            1) Added null checks.
-            2) Eliminated type casts without corresponding type checks.
-            3) Avoided possible infinite loops by building up lists of nodes to operate on
-               before starting to make DOM changes.
-            4) Use more RefPtr.
-
-        No test at this time, but test cases should follow in separate patches.
-
-        * WebCore.xcodeproj/project.pbxproj: Set the role of CSSPropertyNames.h to Private so it
-        can be used in other Private headers, specifically editing ones.
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::locateCousinList): Adopt parentElement.
-        (WebCore::CSSStyleSelector::locateSharedStyle): Ditto.
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): Ditto.
-
-        * dom/Element.cpp: (WebCore::Element::cloneElement): Added.
-        * dom/Element.h: Added cloneElement and an implementation of parentElement.
-        * dom/Node.h: Moved parentElement from here to Element.h and changed its
-        implementation so it will return 0 when the parent is not an element
-        (document, document fragment, etc.).
-
-        * editing/AppendNodeCommand.cpp:
-        (WebCore::AppendNodeCommand::AppendNodeCommand): Made parent be an Element.
-        Moved assertions from doApply in here.
-        (WebCore::AppendNodeCommand::doApply): Simplified to just a single unchecked
-        appendChild call.
-        (WebCore::AppendNodeCommand::doUnapply): Simplified to just a single remove call.
-        * editing/AppendNodeCommand.h: Updated.
-
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::createStyleSpanElement): Eliminate casting by creating an element in a more
-        direct way with new instead of createElementNS.
-        (WebCore::ApplyStyleCommand::ApplyStyleCommand): Use PassRefPtr.
-        (WebCore::ApplyStyleCommand::removeCSSStyle): Use CSSPropertyID.
-        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded): Use cloneElement.
-        * editing/ApplyStyleCommand.h:
-
-        * editing/BreakBlockquoteCommand.cpp:
-        (WebCore::BreakBlockquoteCommand::doApply): Use Element* and cloneElement.
-
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::applyStyledElement): Use PassRefPtr and unsigned.
-        (WebCore::CompositeEditCommand::removeStyledElement): Ditto.
-        (WebCore::CompositeEditCommand::insertNodeBefore): Ditto.
-        (WebCore::CompositeEditCommand::insertNodeAfter): Ditto.
-        (WebCore::CompositeEditCommand::insertNodeAt): Ditto.
-        (WebCore::CompositeEditCommand::appendNode): Ditto.
-        (WebCore::CompositeEditCommand::removeChildrenInRange): Ditto. Also use a vector to
-        make the list of children in case removing them has side effects.
-        (WebCore::CompositeEditCommand::removeNode): Ditto.
-        (WebCore::CompositeEditCommand::removeNodePreservingChildren): Ditto.
-        (WebCore::CompositeEditCommand::removeNodeAndPruneAncestors): Ditto.
-        (WebCore::CompositeEditCommand::splitTextNode): Ditto.
-        (WebCore::CompositeEditCommand::splitElement): Ditto.
-        (WebCore::CompositeEditCommand::mergeIdenticalElements): Ditto.
-        (WebCore::CompositeEditCommand::wrapContentsInDummySpan): Ditto.
-        (WebCore::CompositeEditCommand::splitTextNodeContainingElement): Ditto.
-        (WebCore::CompositeEditCommand::joinTextNodes): Ditto.
-        (WebCore::CompositeEditCommand::inputText): Ditto.
-        (WebCore::CompositeEditCommand::insertTextIntoNode): Ditto.
-        (WebCore::CompositeEditCommand::deleteTextFromNode): Ditto.
-        (WebCore::CompositeEditCommand::replaceTextInNode): Ditto.
-        (WebCore::CompositeEditCommand::insertNodeAtTabSpanPosition): Ditto.
-        (WebCore::CompositeEditCommand::removeCSSProperty): Ditto.
-        (WebCore::CompositeEditCommand::removeNodeAttribute): Ditto. Implement by calling
-        setNodeAttribute instead of with its own SimpleEditCommand.
-        (WebCore::CompositeEditCommand::setNodeAttribute): Ditto.
-        (WebCore::CompositeEditCommand::deleteInsignificantText): Ditto.
-        (WebCore::CompositeEditCommand::appendBlockPlaceholder): Ditto.
-        (WebCore::CompositeEditCommand::addBlockPlaceholderIfNeeded): Ditto.
-        (WebCore::CompositeEditCommand::insertNewDefaultParagraphElementAt): Ditto. Don't
-        bother using an undoable operation to put the break element into the paragraph
-        element because there's no need to split them and redo this when doing undo/redo.
-        (WebCore::CompositeEditCommand::moveParagraphs): Ditto.
-        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem): Ditto.
-        * editing/CompositeEditCommand.h: Ditto.
-
-        * editing/DeleteFromTextNodeCommand.cpp:
-        (WebCore::DeleteFromTextNodeCommand::DeleteFromTextNodeCommand): Use unsigned.
-        (WebCore::DeleteFromTextNodeCommand::doApply): Eliminated inappropriate assertions.
-        (WebCore::DeleteFromTextNodeCommand::doUnapply): Ditto.
-        * editing/DeleteFromTextNodeCommand.h:
-
-        * editing/DeleteSelectionCommand.cpp:
-        (WebCore::DeleteSelectionCommand::removeNode): Use PassRefPtr.
-        (WebCore::DeleteSelectionCommand::deleteTextFromNode): Ditto.
-        * editing/DeleteSelectionCommand.h:
-
-        * editing/FormatBlockCommand.cpp:
-        (WebCore::FormatBlockCommand::FormatBlockCommand): Use AtomicString.
-        (WebCore::FormatBlockCommand::doApply): Use Element.
-        * editing/FormatBlockCommand.h:
-
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::createIndentBlockquoteElement): Use new to create the element
-        instead of calling a function so we have a more specific type.
-        (WebCore::IndentOutdentCommand::prepareBlockquoteLevelForInsertion):
-        Use RefPtr and Element.
-        (WebCore::IndentOutdentCommand::indentRegion): Ditto.
-        (WebCore::IndentOutdentCommand::outdentParagraph): Ditto.
-        * editing/IndentOutdentCommand.h:
-
-        * editing/InsertIntoTextNodeCommand.cpp:
-        (WebCore::InsertIntoTextNodeCommand::InsertIntoTextNodeCommand):
-        Use unsigned. Added an assertion.
-        (WebCore::InsertIntoTextNodeCommand::doApply): Eliminated inappropriate assertions.
-        (WebCore::InsertIntoTextNodeCommand::doUnapply): Ditto.
-        * editing/InsertIntoTextNodeCommand.h:
-
-        * editing/InsertLineBreakCommand.cpp:
-        (WebCore::InsertLineBreakCommand::insertNodeAfterPosition): Use Element.
-        (WebCore::InsertLineBreakCommand::insertNodeBeforePosition): Ditto.
-
-        * editing/InsertListCommand.cpp:
-        (WebCore::InsertListCommand::doApply): Use Element.
-
-        * editing/InsertNodeBeforeCommand.cpp:
-        (WebCore::InsertNodeBeforeCommand::InsertNodeBeforeCommand): Moved assertions
-        here from doApply.
-        (WebCore::InsertNodeBeforeCommand::doApply): Eliminated inappropriate assertions.
-        Added a null check.
-        (WebCore::InsertNodeBeforeCommand::doUnapply): Simplified to just a single remove call.
-
-        * editing/InsertParagraphSeparatorCommand.cpp:
-        (WebCore::InsertParagraphSeparatorCommand::doApply): Use Element and cloneElement.
-
-        * editing/JoinTextNodesCommand.cpp:
-        (WebCore::JoinTextNodesCommand::doApply): Eliminated inappropriate assertions.
-        Added some runtime checks. Don't store anything in m_offset.
-        (WebCore::JoinTextNodesCommand::doUnapply): Ditto.
-        * editing/JoinTextNodesCommand.h:
-
-        * editing/MergeIdenticalElementsCommand.cpp:
-        (WebCore::MergeIdenticalElementsCommand::MergeIdenticalElementsCommand): Moved
-        an assertion here from doApply.
-        (WebCore::MergeIdenticalElementsCommand::doApply): Eliminated inappropriate assertions.
-        Added a null check. Changed implementation to use remove to avoid null parent issue.
-        Use a vector of nodes to avoid possible infinite loop if mutation happens while iterating.
-        (WebCore::MergeIdenticalElementsCommand::doUnapply): Ditto.
-
-        * editing/ModifySelectionListLevel.cpp:
-        (WebCore::ModifySelectionListLevelCommand::appendSiblingNodeRange): Use Element*.
-        (WebCore::IncreaseSelectionListLevelCommand::doApply): Ditto.
-        * editing/ModifySelectionListLevel.h:
-
-        * editing/RemoveCSSPropertyCommand.cpp:
-        (WebCore::RemoveCSSPropertyCommand::RemoveCSSPropertyCommand): Use PassRefPtr and
-        CSSPropertyID. Also renamed m_decl to m_style.
-        (WebCore::RemoveCSSPropertyCommand::doApply): Eliminated inappropriate assertions.
-        (WebCore::RemoveCSSPropertyCommand::doUnapply): Ditto.
-
-        * editing/RemoveNodeAttributeCommand.cpp: Removed contents of this file. To be deleted.
-        Use SetNodeAttributeCommand instead.
-        * editing/RemoveNodeAttributeCommand.h: Ditto.
-
-        * editing/RemoveNodeCommand.cpp:
-        (WebCore::RemoveNodeCommand::RemoveNodeCommand): Moved assertions here from doApply.
-        Don't initialize m_refChild here; rather do it in doApply.
-        (WebCore::RemoveNodeCommand::doApply): Eliminated inappropriate assertions. Added
-        checks and streamlined implementation.
-        (WebCore::RemoveNodeCommand::doUnapply): Ditto.
-        * editing/RemoveNodeCommand.h:
-
-        * editing/RemoveNodePreservingChildrenCommand.cpp:
-        (WebCore::RemoveNodePreservingChildrenCommand::doApply): Use a vector.
-
-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::ReplacementFragment::insertFragmentForTestRendering): Removed now-unneeded cast.
-
-        * editing/SetNodeAttributeCommand.cpp:
-        (WebCore::SetNodeAttributeCommand::SetNodeAttributeCommand): Use AtomicString.
-        Removed assertion that prevents us from using this to remove an attribute.
-        (WebCore::SetNodeAttributeCommand::doApply): Eliminated inappropriate assertions.
-        (WebCore::SetNodeAttributeCommand::doUnapply): Ditto.
-        * editing/SetNodeAttributeCommand.h:
-
-        * editing/SplitElementCommand.cpp:
-        (WebCore::SplitElementCommand::SplitElementCommand): Moved assertion here from doApply.
-        (WebCore::SplitElementCommand::doApply): Check some more invariants and use a vector
-        to avoid possible infinite loops.
-        (WebCore::SplitElementCommand::doUnapply): Ditto.
-
-        * editing/SplitTextNodeCommand.cpp:
-        (WebCore::SplitTextNodeCommand::SplitTextNodeCommand): Moved assertions and comment
-        here from doApply.
-        (WebCore::SplitTextNodeCommand::doApply): Check for null and failures when applying.
-        (WebCore::SplitTextNodeCommand::doUnapply): Ditto.
-
-        * editing/SplitTextNodeContainingElementCommand.cpp:
-        (WebCore::SplitTextNodeContainingElementCommand::doApply): Use Element.
-
-        * editing/WrapContentsInDummySpanCommand.cpp:
-        (WebCore::WrapContentsInDummySpanCommand::doApply): Check for null and ignore failures.
-        Don't reuse the dummy span. Simplified logic.
-        (WebCore::WrapContentsInDummySpanCommand::doUnapply): Ditto.
-
-        * editing/htmlediting.cpp:
-        (WebCore::isBlock): Make sure this returns true only for elements.
-        (WebCore::enclosingBlock): Return an Element*.
-        (WebCore::enclosingTableCell): Ditto.
-        (WebCore::enclosingList): Return an HTMLElement*.
-        (WebCore::outermostEnclosingList): Return an HTMLElement*.
-        (WebCore::createDefaultParagraphElement): Return an HTMLElement*.
-        (WebCore::createBreakElement): Return an HTMLElement*.
-        (WebCore::createOrderedListElement): Return an HTMLElement*.
-        (WebCore::createUnorderedListElement): Return an HTMLElement*.
-        (WebCore::createListItemElement): Return an HTMLElement*.
-        (WebCore::createHTMLElement): Return an HTMLElement*.
-        * editing/htmlediting.h:
-
-        * editing/markup.cpp:
-        (WebCore::createFragmentFromText): Use createBreakElement and use Element*.
-
-        * page/MouseEventWithHitTestResults.cpp:
-        (WebCore::MouseEventWithHitTestResults::targetNode): Use parentElement.
-
-2008-12-23  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        * dom/Node.h: Tweak comments and order of bits that Sam moved
-        here last night.
-        * dom/Node.cpp: Ditto.
-
-2008-12-22  Julien Chaffraix  <jchaffraix@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Bug 11106: Some XMLHttpRequest URI resolving tests fail
-        https://bugs.webkit.org/show_bug.cgi?id=11106
-
-        Use the ScriptExecutionContext to resolve the URI when calling open in JavaScript.
-        The previous code was using the containing DOMWindow to do so which would fail for
-        XMLHttpRequest object being passed between iframe.
-
-        Tests: http/tests/xmlhttprequest/uri-resolution-opera-open-004.html
-               http/tests/xmlhttprequest/uri-resolution-opera-open-005.html
-               http/tests/xmlhttprequest/uri-resolution-opera-open-006.html
-               http/tests/xmlhttprequest/uri-resolution-opera-open-007.html
-               http/tests/xmlhttprequest/uri-resolution-opera-open-008.html
-               http/tests/xmlhttprequest/uri-resolution-opera-open-009.html
-               http/tests/xmlhttprequest/uri-resolution-opera-open-010.html
-
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::open): Use the ScriptExecutionContext
-        to resolve the URL.
-
-        * dom/Document.cpp:
-        (WebCore::Document::virtualCompleteURL): Virtual method added to
-        avoid performance hit on completeURL call.
-
-        * dom/Document.h:
-        * dom/ScriptExecutionContext.h:
-        (WebCore::ScriptExecutionContext::completeURL): Non-virtual method
-        that wrap the call to the virtual call.
-        * dom/WorkerContext.cpp:
-        (WebCore::WorkerContext::virtualCompleteURL): Pure virtual method.
-        * dom/WorkerContext.h:
-
-2008-12-23  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=22978
-          a couple tweaks to the new strokeBoundingRect functions
-
-        * platform/graphics/cairo/PathCairo.cpp:
-        (WebCore::Path::strokeBoundingRect): Only create a GraphicsContext
-        if the applier is non-null.
-
-        * platform/graphics/cg/PathCG.cpp:
-        (WebCore::putBytesNowhere): Added.
-        (WebCore::createScratchContext): Changed to use a "/dev/null" type
-        function to discard bytes rather than using a data object. This
-        eliminates the possibility that memory will be used if someone draws
-        into the scratch context by accident. Also moved to the top of the
-        file; it was in a slightly strange place before.
-        (WebCore::Path::strokeBoundingRect): Only create a GraphicsContext
-        if the applier is non-null. Simplify the empty path special case.
-
-2008-12-22  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Save a word in all Elements by moving the 5 loose bits to Node,
-        where we had 16 spare.
-
-        * dom/Element.cpp:
-        (WebCore::Element::Element):
-        * dom/Element.h:
-        * dom/Node.cpp:
-        (WebCore::Node::Node):
-        * dom/Node.h:
-
-2008-12-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22972
-
-        Add WML <meta> element support. All needed functionality is present
-        in Document::processHttpEquiv, already covered by tests.
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * wml/WMLMetaElement.cpp: Added.
-        (WebCore::WMLMetaElement::WMLMetaElement):
-        (WebCore::WMLMetaElement::parseMappedAttribute):
-        (WebCore::WMLMetaElement::insertedIntoDocument):
-        * wml/WMLMetaElement.h: Added.
-        * wml/WMLTagNames.in:
-
-2008-12-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Rubber-stamped by Darin Adler.
-
-        Don't reference specific layout tests in comments.
-
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::createFormData):
-
-2008-12-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22965
-
-        Add WML <head> element support. Doesn't require a WMLHeadElement.
-        No functional behaviour, as we already created a WMLElement for headTag, by default.
-        It's just cleaner to list <head> in WMLTagNames, forwarding to a WMLElement constructor.
-
-        * wml/WMLTagNames.in:
-
-2008-12-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22971
-
-        Fix regression caused by the HTMLFormElement refactorization.
-        File form elements without a name have to be included in multipart/form-data
-        submission. Cover this behaviour with a new test case.
-
-        Test: http/tests/misc/empty-file-formdata.html
-
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::createFormData):
-        * wml/WMLTagNames.in:
-
-2008-12-22  David Kilzer  <ddkilzer@apple.com>
-
-        <rdar://problem/6438298> Bump schema version for app cache
-
-        Reviewed by Alexey Proskuryakov.
-
-        * loader/appcache/ApplicationCacheStorage.cpp: Increment
-        SchemaVersion from 2 to 3.
-
-2008-12-22  David Kilzer  <ddkilzer@apple.com>
-
-        Use Deque in CSSStyleSheet::addSubresourceStyleURLs()
-
-        Reviewed by Darin Adler.
-
-        * css/CSSStyleSheet.cpp:
-        (WebCore::CSSStyleSheet::addSubresourceStyleURLs): Replaced
-        use of ListHashSet with more efficient Deque.
-
-2008-12-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Sam Weinig.
-
-        Fix obvious crash fix for WML enabled builds.
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::adjustRenderStyle):
-
-2008-12-22  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 11850: Webarchive fails to save images referenced in CSS
-
-        <https://bugs.webkit.org/show_bug.cgi?id=11850>
-
-        Reviewed by Darin Adler.
-
-        This entry contains two parts since the tests for adding a
-        completeURL() method to StyleSheet and CSSStyleSheet (part 1) depend
-        on Bug 11850 being fixed (part 2).
-
-        --
-
-        Tests: http/tests/webarchive/test-css-url-encoding-shift-jis.html
-               http/tests/webarchive/test-css-url-encoding-utf-8.html
-               http/tests/webarchive/test-css-url-encoding.html
-
-        Added completeURL() methods to StyleSheet and CSSStyleSheet that
-        match the behavior of Document::completeURL().  Most notably,
-        CSSStyleSheet::completeURL() uses the charset of the stylesheet
-        (if it exists) to construct URLs, just like Document::completeURL().
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue): Use CSSStyleSheet::completeURL().
-        (WebCore::CSSParser::parseContent): Ditto.
-        (WebCore::CSSParser::parseFillImage): Ditto.
-        (WebCore::CSSParser::parseFontFaceSrc): Ditto.
-        (WebCore::CSSParser::parseBorderImage): Ditto.
-
-        * css/CSSStyleSheet.cpp:
-        (WebCore::CSSStyleSheet::completeURL): Added.
-        * css/CSSStyleSheet.h:
-        (WebCore::CSSStyleSheet::completeURL): Added declaration.
-
-        * css/StyleSheet.cpp:
-        (WebCore::StyleSheet::completeURL): Added.
-        * css/StyleSheet.h:
-        (WebCore::StyleSheet::completeURL): Added declaration.
-
-        * dom/Document.cpp:
-        (WebCore::Document::completeURL): Added comment referring to the new
-        completeURL() methods in StyleSheet and CSSStyleSheet.
-
-        --
-
-        Tests: webarchive/test-css-url-resources-in-stylesheets.html
-               webarchive/test-css-url-resources-inline-styles.html
-
-        Walk stylesheets and inline style attributes for url() references
-        when building a list of URLs to include in a webarchive.  Note that
-        not all URLs found this way will be included in the webarchive if
-        they were not used (and thus not downloaded) when laying out the
-        page.
-
-        The key method for CSS stylesheets is
-        CSSStyleSheet::addSubresourceStyleURLs() which iterates over all
-        CSSStyleSheet objects recursively referenced from its own stylesheet
-        through @import rules.  Starting with the CSSRule objects in each
-        sheet and continuing down through the CSSMutableStyleDeclaration and
-        CSSValue objects, addSubresourceStyleURLs() methods are called to
-        gather URLs.
-
-        For inline style attributes in HTML DOM elements,
-        StyledElement::addSubresourceAttributeURLs() calls
-        CSSMutableStyleDeclaration::addSubresourceStyleURLs() to gather URLs
-        from each element, hence the need to call
-        addSubresourceAttributeURLs() on superclasses when the method is
-        implemented on the element class itself.
-
-        * css/CSSBorderImageValue.cpp:
-        (WebCore::CSSBorderImageValue::addSubresourceStyleURLs): Added.
-        * css/CSSBorderImageValue.h:
-        (WebCore::CSSBorderImageValue::addSubresourceStyleURLs): Added
-        declaration.
-
-        * css/CSSFontFaceRule.cpp:
-        (WebCore::CSSFontFaceRule::addSubresourceStyleURLs): Added.
-        * css/CSSFontFaceRule.h:
-        (WebCore::CSSFontFaceRule::addSubresourceStyleURLs): Added
-        declaration.
-
-        * css/CSSFontFaceSrcValue.cpp:
-        (WebCore::CSSFontFaceSrcValue::addSubresourceStyleURLs): Added.
-        * css/CSSFontFaceSrcValue.h:
-        (WebCore::CSSFontFaceSrcValue::addSubresourceStyleURLs): Added
-        declaration.
-
-        * css/CSSImportRule.cpp:
-        (WebCore::CSSImportRule::addSubresourceStyleURLs): Added.
-        * css/CSSImportRule.h:
-        (WebCore::CSSImportRule::addSubresourceStyleURLs): Added
-        declaration.
-
-        * css/CSSMutableStyleDeclaration.cpp:
-        (WebCore::CSSMutableStyleDeclaration::addSubresourceStyleURLs): Added.
-        Iterates over m_properties vector of CSSProperty objects calling
-        addSubresourceStyleURLs() on each property's CSSValue object.
-        * css/CSSMutableStyleDeclaration.h:
-        (WebCore::CSSMutableStyleDeclaration::addSubresourceStyleURLs): Added
-        declaration.
-
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::addSubresourceStyleURLs): Added.
-        * css/CSSPrimitiveValue.h:
-        (WebCore::CSSPrimitiveValue::addSubresourceStyleURLs): Added
-        declaration.
-
-        * css/CSSReflectValue.cpp:
-        (WebCore::CSSReflectValue::addSubresourceStyleURLs): Added.
-        * css/CSSReflectValue.h:
-        (WebCore::CSSReflectValue::addSubresourceStyleURLs): Added
-        declaration.
-
-        * css/CSSRule.h:
-        (WebCore::CSSRule::addSubresourceStyleURLs): Added.  Virtual
-        method with empty implementation that's overridden by subclasses
-        as needed.
-
-        * css/CSSStyleRule.cpp:
-        (WebCore::CSSStyleRule::addSubresourceStyleURLs): Added.
-        * css/CSSStyleRule.h:
-        (WebCore::CSSStyleRule::addSubresourceStyleURLs): Added
-        declaration.
-
-        * css/CSSStyleSheet.cpp:
-        (WebCore::CSSStyleSheet::addSubresourceStyleURLs): Updated to
-        call CSSRule::addSubresourceStyleURLs on each rule to extract
-        URLs.  Removed unneeded baseURL parameter now that the
-        completeURL() method exists.
-        * css/CSSStyleSheet.h:
-        (WebCore::CSSStyleSheet::addSubresourceStyleURLs): Updated
-        declaration.
-
-        * css/CSSValue.h:
-        (WebCore::CSSValue::addSubresourceStyleURLs): Added.  Virtual
-        method with empty implementation that's overridden by subclasses
-        as needed.
-
-        * css/CSSValueList.cpp:
-        (WebCore::CSSValueList::addSubresourceStyleURLs): Added.
-        Iterates over m_values vector of CSSValue objects calling
-        addSubresourceStyleURLs() on each.
-        * css/CSSValueList.h:
-        (WebCore::CSSValueList::addSubresourceStyleURLs): Added
-        declaration.
-
-        * css/StyleSheet.h:
-        (WebCore::StyleSheet::addSubresourceStyleURLs): Updated
-        declaration to remove unneeded baseURL parameter.
-
-        * dom/ProcessingInstruction.cpp:
-        (WebCore::ProcessingInstruction::addSubresourceAttributeURLs):
-        Fixed to use the StyleBase::baseURL() method to get the
-        stylesheet's URL instead of calling Document::completeURL().
-
-        * dom/StyledElement.cpp:
-        (WebCore::StyledElement::addSubresourceAttributeURLs): Added method
-        to extract URLs from inline style declarations.
-        * dom/StyledElement.h:
-        (WebCore::StyledElement::addSubresourceAttributeURLs): Added
-        declaration.
-
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::addSubresourceAttributeURLs): Call
-        addSubresourceAttributeURLs() in superclass to extract URLs
-        from inline style declarations.
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::HTMLEmbedElement::addSubresourceAttributeURLs): Ditto.
-        * html/HTMLImageElement.cpp:
-        (WebCore::HTMLImageElement::addSubresourceAttributeURLs): Ditto.
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::addSubresourceAttributeURLs): Ditto.
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::addSubresourceAttributeURLs): Ditto.
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::addSubresourceAttributeURLs): Ditto.
-        * html/HTMLParamElement.cpp:
-        (WebCore::HTMLParamElement::addSubresourceAttributeURLs): Ditto.
-        * html/HTMLScriptElement.cpp:
-        (WebCore::HTMLScriptElement::addSubresourceAttributeURLs): Ditto.
-        * html/HTMLStyleElement.cpp:
-        (WebCore::HTMLStyleElement::addSubresourceAttributeURLs): Ditto.
-        * html/HTMLTableCellElement.cpp:
-        (WebCore::HTMLTableCellElement::addSubresourceAttributeURLs): Ditto.
-        * html/HTMLTableElement.cpp:
-        (WebCore::HTMLTableElement::addSubresourceAttributeURLs): Ditto.
-        * svg/SVGCursorElement.cpp:
-        (WebCore::SVGCursorElement::addSubresourceAttributeURLs): Ditto.
-        * svg/SVGFEImageElement.cpp:
-        (WebCore::SVGFEImageElement::addSubresourceAttributeURLs): Ditto.
-        * svg/SVGImageElement.cpp:
-        (WebCore::SVGImageElement::addSubresourceAttributeURLs): Ditto.
-        * svg/SVGScriptElement.cpp:
-        (WebCore::SVGScriptElement::addSubresourceAttributeURLs): Ditto.
-
-2008-12-22  Dhananjoy Chutia  <dhanrd@gmail.com>
-
-        Reviewed by David Kilzer.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22959
-        Memory leak fixes for WebKit+soup
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::finishedCallback):
-
-2008-12-22  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/6277060> ASSERTION FAILED: !m_cacheBeingUpdated if the manifest is not available
-
-        Tests: http/tests/appcache/404-manifest.html
-               http/tests/appcache/fail-on-update.html
-
-        * loader/appcache/ApplicationCacheGroup.cpp: (WebCore::ApplicationCacheGroup::stopLoading):
-        Removed the incorrect assertion.
-
-        * loader/appcache/ApplicationCacheGroup.h: Added an explanation of somewhat nonintuitive
-        m_currentHandle handling.
-
-2008-12-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Alexey Proskuryakov & George Staikos.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22961
-
-        Add WML <fieldset> element support.
-        Unlike HTML's <fieldset> element, WML doesn't provide a <legend> child element
-        to describe the <fieldset>. WML instead offers a 'title' attribute on the <fieldset>
-        element. To integrate within the existing RenderFieldset code, we just create an
-        internal <insertedLegend> element as first child for a WML <fieldset> element, containing
-        the title attribute value.
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::adjustRenderStyle):
-        * css/wml.css:
-        * rendering/RenderFieldset.cpp:
-        (WebCore::RenderFieldset::RenderFieldset):
-        (WebCore::RenderFieldset::findLegend):
-        * rendering/RenderFieldset.h:
-        * rendering/RenderLegend.cpp:
-        (WebCore::RenderLegend::RenderLegend):
-        * rendering/RenderLegend.h:
-        * wml/WMLFieldSetElement.cpp: Added.
-        (WebCore::WMLFieldSetElement::WMLFieldSetElement):
-        (WebCore::WMLFieldSetElement::~WMLFieldSetElement):
-        (WebCore::WMLFieldSetElement::parseMappedAttribute):
-        (WebCore::WMLFieldSetElement::insertedIntoDocument):
-        (WebCore::WMLFieldSetElement::removedFromDocument):
-        (WebCore::WMLFieldSetElement::createRenderer):
-        * wml/WMLFieldSetElement.h: Added.
-        * wml/WMLInsertedLegendElement.cpp: Added.
-        (WebCore::WMLInsertedLegendElement::WMLInsertedLegendElement):
-        (WebCore::WMLInsertedLegendElement::~WMLInsertedLegendElement):
-        (WebCore::WMLInsertedLegendElement::createRenderer):
-        * wml/WMLInsertedLegendElement.h: Added.
-        * wml/WMLTagNames.in:
-
-2008-12-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Not reviewed. Try to fix clean Mac builds, set role=private for FormDataBuilder.h
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2008-12-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Rubber-stamped by George Staikos.
-
-        Unify all TorchMobile copyright lines. Consolidate in a single line, as requested by Mark Rowe, some time ago.
-
-        * css/CSSStyleSelector.cpp:
-        * css/wml.css:
-        * dom/DOMImplementation.cpp:
-        * dom/Document.cpp:
-        * dom/Document.h:
-        * dom/XMLTokenizer.cpp:
-        * dom/XMLTokenizerLibxml2.cpp:
-        * dom/XMLTokenizerQt.cpp:
-        * history/BackForwardList.cpp:
-        * history/BackForwardList.h:
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * loader/MainResourceLoader.cpp:
+        * page/Chrome.cpp:
+        (WebCore::Chrome::createWindow):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::localStorage):
+        * page/DOMWindow.h:
         * page/Page.cpp:
+        (WebCore::Page::sessionStorage):
+        (WebCore::Page::setSessionStorage):
         * page/Page.h:
-        * platform/MIMETypeRegistry.cpp:
-        * platform/network/FormDataBuilder.cpp:
-        * platform/network/FormDataBuilder.h:
-        * platform/qt/MIMETypeRegistryQt.cpp:
-        * wml/WMLAElement.cpp:
-        * wml/WMLAElement.h:
-        * wml/WMLAccessElement.cpp:
-        * wml/WMLAccessElement.h:
-        * wml/WMLAnchorElement.cpp:
-        * wml/WMLAnchorElement.h:
-        * wml/WMLBRElement.cpp:
-        * wml/WMLBRElement.h:
-        * wml/WMLCardElement.cpp:
-        * wml/WMLCardElement.h:
-        * wml/WMLDoElement.cpp:
-        * wml/WMLDoElement.h:
-        * wml/WMLDocument.cpp:
-        * wml/WMLDocument.h:
-        * wml/WMLElement.cpp:
-        * wml/WMLElement.h:
-        * wml/WMLErrorHandling.cpp:
-        * wml/WMLErrorHandling.h:
-        * wml/WMLEventHandlingElement.cpp:
-        * wml/WMLEventHandlingElement.h:
-        * wml/WMLGoElement.cpp:
-        * wml/WMLGoElement.h:
-        * wml/WMLImageElement.cpp:
-        * wml/WMLImageElement.h:
-        * wml/WMLImageLoader.cpp:
-        * wml/WMLImageLoader.h:
-        * wml/WMLIntrinsicEvent.cpp:
-        * wml/WMLIntrinsicEvent.h:
-        * wml/WMLIntrinsicEventHandler.cpp:
-        * wml/WMLIntrinsicEventHandler.h:
-        * wml/WMLNoopElement.cpp:
-        * wml/WMLNoopElement.h:
-        * wml/WMLOnEventElement.cpp:
-        * wml/WMLOnEventElement.h:
-        * wml/WMLPElement.cpp:
-        * wml/WMLPElement.h:
-        * wml/WMLPageState.cpp:
-        * wml/WMLPageState.h:
-        * wml/WMLPostfieldElement.cpp:
-        * wml/WMLPostfieldElement.h:
-        * wml/WMLPrevElement.cpp:
-        * wml/WMLPrevElement.h:
-        * wml/WMLRefreshElement.cpp:
-        * wml/WMLRefreshElement.h:
-        * wml/WMLSetvarElement.cpp:
-        * wml/WMLSetvarElement.h:
-        * wml/WMLTableElement.cpp:
-        * wml/WMLTableElement.h:
-        * wml/WMLTaskElement.cpp:
-        * wml/WMLTaskElement.h:
-        * wml/WMLTemplateElement.cpp:
-        * wml/WMLTemplateElement.h:
-        * wml/WMLTimerElement.cpp:
-        * wml/WMLTimerElement.h:
-        * wml/WMLVariables.cpp:
-        * wml/WMLVariables.h:
-
-2008-12-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22638
-
-        Add POST method support to WMLGoElement. GET & POST over HTTP
-        covered by a new set of WML HTTP layout tests.
-
-        Tests: http/tests/wml/go-task-get-method-accept-charset.html
-               http/tests/wml/go-task-get-method.html
-               http/tests/wml/go-task-post-method-accept-charset.html
-               http/tests/wml/go-task-post-method.html
-
-        * wml/WMLGoElement.cpp:
-        (WebCore::WMLGoElement::WMLGoElement):
-        (WebCore::WMLGoElement::registerPostfieldElement):
-        (WebCore::WMLGoElement::parseMappedAttribute):
-        (WebCore::WMLGoElement::executeTask):
-        (WebCore::WMLGoElement::preparePOSTRequest):
-        (WebCore::WMLGoElement::prepareGETRequest):
-        (WebCore::WMLGoElement::createFormData):
-        * wml/WMLGoElement.h:
-        * wml/WMLPostfieldElement.cpp:
-        (WebCore::encodedString):
-        (WebCore::WMLPostfieldElement::encodeData):
-        * wml/WMLPostfieldElement.h:
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::localStorage):
+        * page/PageGroup.h:
+        * storage/LocalStorage.cpp: Removed.
+        * storage/LocalStorage.h: Removed.
+        * storage/LocalStorageTask.cpp:
+        * storage/LocalStorageThread.cpp:
+        * storage/SessionStorage.cpp: Removed.
+        * storage/SessionStorage.h: Removed.
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::create):
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::copy):
+        (WebCore::StorageArea::length):
+        (WebCore::StorageArea::key):
+        (WebCore::StorageArea::getItem):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        (WebCore::StorageArea::contains):
+        (WebCore::StorageArea::importItem):
+        (WebCore::StorageArea::close):
+        (WebCore::StorageArea::dispatchStorageEvent):
+        * storage/StorageArea.h:
+        (WebCore::):
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        * storage/StorageNamespace.cpp: Copied from WebCore/storage/LocalStorage.cpp.
+        (WebCore::localStorageNamespaceMap):
+        (WebCore::StorageNamespace::localStorageNamespace):
+        (WebCore::StorageNamespace::sessionStorageNamespace):
+        (WebCore::StorageNamespace::StorageNamespace):
+        (WebCore::StorageNamespace::~StorageNamespace):
+        (WebCore::StorageNamespace::copy):
+        (WebCore::StorageNamespace::storageArea):
+        (WebCore::StorageNamespace::close):
+        * storage/StorageNamespace.h: Copied from WebCore/storage/LocalStorage.h.
 
-2008-12-21  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+2009-06-26  Nate Chapin  <japhet@chromium.org>
 
-        Reviewed by Darin Adler and George Staikos.
+        Reviewed by David Levin.
 
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22949
+        Upstream V8Proxy.  This involved updating a lot of function and variable names to match WebKit style, hence the large size.
 
-        Refactor HTMLFormElement to share a maximum level of code between HTMLFormElement & WMLGoElement.
-        Create a new helper class 'FormDataBuilder', which is hold as member variable in those classes.
-        It encapsulates all functionality needed to generate a FormData object, usable for HTML/WML form
-        submission, including boundary string generation, multi-part form handling etc.
+        https://bugs.webkit.org/show_bug.cgi?id=26623
 
-        No functional changes, no test cases affected.
-        WMLGoElement will be converted in a follow-up patch.
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::~ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::isSafeScript):
+        (WebCore::ScriptController::gcProtectJSWrapper):
+        (WebCore::ScriptController::gcUnprotectJSWrapper):
+        (WebCore::ScriptController::processingUserGesture):
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::setEventHandlerLineNumber):
+        (WebCore::ScriptController::bindToWindowObject):
+        (WebCore::ScriptController::collectGarbage):
+        (WebCore::ScriptController::haveInterpreter):
+        (WebCore::createScriptObject):
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
+        * bindings/v8/ScriptInstance.cpp:
+        (WebCore::V8ScriptInstance::clear):
+        (WebCore::V8ScriptInstance::set):
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::set):
+        * bindings/v8/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/v8/ScriptScope.cpp:
+        (WebCore::ScriptScope::ScriptScope):
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::ScriptValue):
+        (WebCore::ScriptValue::operator=):
+        (WebCore::ScriptValue::clear):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        (WebCore::V8AbstractEventListener::disposeListenerObject):
+        (WebCore::V8AbstractEventListener::getReceiverObject):
+        * bindings/v8/V8Collection.cpp:
+        (WebCore::toOptionsCollectionSetter):
+        * bindings/v8/V8Collection.h:
+        (WebCore::getV8Object):
+        (WebCore::getNamedPropertyOfCollection):
+        (WebCore::nodeCollectionNamedPropertyGetter):
+        (WebCore::getIndexedPropertyOfCollection):
+        (WebCore::nodeCollectionIndexedPropertyGetter):
+        (WebCore::nodeCollectionIndexedPropertyEnumerator):
+        (WebCore::collectionIndexedPropertyEnumerator):
+        (WebCore::collectionStringOrNullIndexedPropertyGetter):
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::weakDOMObjectCallback):
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        * bindings/v8/V8Helpers.cpp:
+        (WebCore::wrapNPObject):
+        (WebCore::toV8Context):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::~V8LazyEventListener):
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        (WebCore::V8LazyEventListener::callListenerFunction):
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+        * bindings/v8/V8NodeFilterCondition.cpp:
+        (WebCore::V8NodeFilterCondition::V8NodeFilterCondition):
+        (WebCore::V8NodeFilterCondition::~V8NodeFilterCondition):
+        (WebCore::V8NodeFilterCondition::acceptNode):
+        * bindings/v8/V8ObjectEventListener.cpp:
+        (WebCore::weakObjectEventListenerCallback):
+        (WebCore::V8ObjectEventListener::~V8ObjectEventListener):
+        * bindings/v8/V8Proxy.cpp: Added.
+        * bindings/v8/V8Proxy.h:
+        (WebCore::):
+        (WebCore::GlobalHandleInfo::GlobalHandleInfo):
+        (WebCore::V8Proxy::):
+        (WebCore::V8Proxy::V8Proxy):
+        (WebCore::V8Proxy::frame):
+        (WebCore::V8Proxy::inlineCode):
+        (WebCore::V8Proxy::setInlineCode):
+        (WebCore::V8Proxy::timerCallback):
+        (WebCore::V8Proxy::setTimerCallback):
+        (WebCore::V8Proxy::setEventHandlerLineNumber):
+        (WebCore::V8Proxy::finishedWithEvent):
+        (WebCore::V8Proxy::wrapCPointer):
+        (WebCore::V8Proxy::extractCPointer):
+        (WebCore::V8Proxy::convertDOMWrapperToNative):
+        (WebCore::V8Proxy::convertDOMWrapperToNode):
+        (WebCore::V8Proxy::convertToV8Object):
+        (WebCore::V8Proxy::convertToNativeObject):
+        (WebCore::V8Proxy::convertToNativeEvent):
+        (WebCore::V8Proxy::context):
+        (WebCore::V8Proxy::extractCPointerImpl):
+        (WebCore::V8Proxy::utilityContext):
+        (WebCore::V8Proxy::constructDOMObject):
+        (WebCore::throwError):
+        (WebCore::toV8):
+        * bindings/v8/V8Utilities.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::retrieve):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::GetConstructor):
+        (WebCore::WorkerContextExecutionProxy::ToV8Object):
+        (WebCore::WorkerContextExecutionProxy::EventToV8Object):
+        (WebCore::WorkerContextExecutionProxy::toV8):
+        (WebCore::WorkerContextExecutionProxy::forgetV8EventObject):
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+        (WebCore::WorkerContextExecutionProxy::runScript):
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::toCanvasStyle):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8ClientRectListCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8CustomBinding.cpp:
+        (WebCore::allowSettingFrameSrcToJavascriptUrl):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::V8Custom::GetTargetFrame):
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        (WebCore::V8EventListener::~V8EventListener):
+        (WebCore::V8EventListener::callListenerFunction):
+        * bindings/v8/custom/V8CustomSQLStatementCallback.cpp:
+        (WebCore::V8CustomSQLStatementCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLTransactionCallback.cpp:
+        (WebCore::V8CustomSQLTransactionCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
+        (WebCore::V8CustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomVoidCallback.cpp:
+        (WebCore::V8CustomVoidCallback::handleEvent):
+        (WebCore::invokeCallback):
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp:
+        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/v8/custom/V8DOMParserConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl):
+        (WebCore::convertBase64):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::createWindow):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::V8Custom::ClearTimeoutImpl):
+        (WebCore::NAMED_ACCESS_CHECK):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8EventCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::removeElement):
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_ACCESS_CHECK):
+        (WebCore::NAMED_ACCESS_CHECK):
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8NavigatorCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8NodeCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGLengthCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        (WebCore::toV8):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::SetTimeoutOrInterval):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLSerializerConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XPathEvaluatorConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-06-26  Kevin McCullough  <kmccullough@apple.com>
 
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.scons:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::HTMLFormElement):
-        (WebCore::HTMLFormElement::dataEncoding):
-        (WebCore::HTMLFormElement::createFormData):
-        (WebCore::HTMLFormElement::submit):
-        (WebCore::HTMLFormElement::parseMappedAttribute):
-        * html/HTMLFormElement.h:
-        (WebCore::HTMLFormElement::enctype):
-        (WebCore::HTMLFormElement::encoding):
-        (WebCore::HTMLFormElement::setEncoding):
-        (WebCore::HTMLFormElement::acceptCharset):
-        * platform/network/FormDataBuilder.cpp: Added.
-        (WebCore::FormDataBuilder::FormDataBuilder):
-        (WebCore::FormDataBuilder::~FormDataBuilder):
-        (WebCore::FormDataBuilder::parseEncodingType):
-        (WebCore::FormDataBuilder::parseMethodType):
-        (WebCore::FormDataBuilder::dataEncoding):
-        (WebCore::appendString):
-        (WebCore::FormDataBuilder::beginMultiPartHeader):
-        (WebCore::FormDataBuilder::addBoundaryToMultiPartHeader):
-        (WebCore::FormDataBuilder::addFileNameToMultiPartHeader):
-        (WebCore::FormDataBuilder::addContentTypeToMultiPartHeader):
-        (WebCore::FormDataBuilder::finishMultiPartHeader):
-        (WebCore::FormDataBuilder::clear):
-        (WebCore::FormDataBuilder::addKeyValuePairAsFormData):
-        (WebCore::FormDataBuilder::encodeStringAsFormData):
-        (WebCore::FormDataBuilder::generateUniqueBoundaryString):
-        * platform/network/FormDataBuilder.h: Added.
-        (WebCore::FormDataBuilder::isPostMethod):
-        (WebCore::FormDataBuilder::setIsPostMethod):
-        (WebCore::FormDataBuilder::isMultiPartForm):
-        (WebCore::FormDataBuilder::setIsMultiPartForm):
-        (WebCore::FormDataBuilder::encodingType):
-        (WebCore::FormDataBuilder::setEncodingType):
-        (WebCore::FormDataBuilder::acceptCharset):
-        (WebCore::FormDataBuilder::setAcceptCharset):
-        (WebCore::FormDataBuilder::encodedData):
-        (WebCore::FormDataBuilder::multiPartData):
-
-2008-12-21  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Darin Adler, Nikolas Zimmermann.
-
-        Move the the platform dependent strokeBBox functionality out of RenderPath
-        into Path with strokeBoundingRect.
-
-        RenderPath clean-up for strokeBoundingBox
-        [https://bugs.webkit.org/show_bug.cgi?id=22902]
+        Reviewed by Tim Hatcher.
 
-        * GNUmakefile.am:
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/Path.h:
-        * platform/graphics/StrokeStyleApplier.h: Added.
-        (WebCore::StrokeStyleApplier::~StrokeStyleApplier):
-        * platform/graphics/cairo/PathCairo.cpp:
-        (WebCore::Path::strokeBoundingRect):
-        * platform/graphics/cg/PathCG.cpp:
-        (WebCore::createScratchContext):
-        (WebCore::scratchContext):
-        (WebCore::Path::strokeBoundingRect):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::pen):
-        * platform/graphics/qt/PathQt.cpp:
-        (WebCore::Path::strokeBoundingRect):
-        * rendering/RenderPath.cpp:
-        (WebCore::StrokeBoundingRectStyleApplier::StrokeBoundingRectStyleApplier):
-        (WebCore::StrokeBoundingRectStyleApplier::strokeStyle):
-        (WebCore::RenderPath::relativeBBox):
-        * rendering/RenderPath.h:
-        * svg/graphics/cairo/RenderPathCairo.cpp:
-        * svg/graphics/cg/RenderPathCg.cpp:
-        * svg/graphics/qt/RenderPathQt.cpp:
+        <rdar://problem/7011047> Profiler shows the record button 'on' even
+        though it's finished
 
-2008-12-20  David Kilzer  <ddkilzer@apple.com>
+        I consolidated the creation of the user initiated profile name into
+        its own function and then called it from console::profile instead of
+        calling startUserInitiatedProfiling().  This way we don't call
+        toggleRecordButton() which turns on the record button.
 
-        Fix typo "CSSAferRuleValue" to "CSSAfterRuleValue"
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::getCurrentUserInitiatedProfileName):
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        * inspector/InspectorController.h:
+        * page/Console.cpp:
+        (WebCore::Console::profile):
+        (WebCore::Console::profileEnd):
 
-        * html/PreloadScanner.cpp:
-        (WebCore::PreloadScanner::tokenizeCSS):
-        * html/PreloadScanner.h:
-        (WebCore::PreloadScanner::CSSState):
+2009-06-26  Jeremy Moskovich  <jeremy@chromium.org>
 
-2008-12-19  Alexey Proskuryakov  <ap@webkit.org>
+        Reviewed by Eric Seidel.
 
-        Reviewed by Geoff Garen.
+        https://bugs.webkit.org/show_bug.cgi?id=26691
 
-        <rdar://problem/6454076> Random crashes on JS raytracer
+        Cleanup: Move focusRingColor to RenderTheme.
 
-        No test, because the crash is not readily reproducible.
+        Most of this CL involves deleting files and removing dead code.
 
-        * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::empty):
-        * platform/text/StringImpl.h:
-        Made empty string per-thread.
+        focusRingColor() is now defined in RenderTheme rather than in
+        misc. places on each port.  The default color is specified as
+        black in renderTheme and ports can override it in their own
+        custom renderThemes.
 
-2008-12-19  Anders Carlsson  <andersca@apple.com>
+        Behavior should be identical except for the following cases,
+        this lists platform and what the focus ring color used to be
+        before this cl and the file where it used to be defined:
 
-        Reviewed by Sam Weinig.
+        Android - red
+        WebCore/platform/android/TemporaryLinkStubs.cpp
 
-        Replace some uses of HardRetain etc with RetainPtr.
+        Cairo - aqua focus ring color - 0xFF7DADD9
+        WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
 
-        * platform/mac/DragImageMac.mm:
-        * platform/mac/SharedBufferMac.mm:
-        (WebCore::SharedBuffer::createCFData):
-        * rendering/RenderThemeMac.mm:
-        * svg/graphics/cg/SVGResourceFilterCg.mm:
-        (WebCore::SVGResourceFilter::prepareFilter):
-        (WebCore::SVGResourceFilter::applyFilter):
-        * svg/graphics/mac/SVGResourceFilterPlatformDataMac.h:
-        * svg/graphics/mac/SVGResourceFilterPlatformDataMac.mm:
-        (WebCore::SVGResourceFilterPlatformDataMac::SVGResourceFilterPlatformDataMac):
+        wx - red
+        WebCore/platform/wx/TemporaryLinkStubs.cpp
 
-2008-12-19  miggilin  <mr.diggilin@gmail.com>
+        QT - black
+        WebCore/platform/graphics/qt/GraphicsContextQt.cpp
 
-        Reviewed by Kevin Ollivier.
+        Manual test: manual-tests/focusringcolor-change-on-theme-change.html
 
-        Add Context Menu support to wx bindings.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=22675
-
-        * platform/ContextMenu.h:
-        * platform/ContextMenuItem.h:
-        (WebCore::PlatformMenuItemDescription::PlatformMenuItemDescription):
-        * platform/wx/ContextMenuItemWx.cpp: Added.
-        * platform/wx/ContextMenuWx.cpp: Added.
-        * platform/wx/LocalizedStringsWx.cpp:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::getColorFromPrimitiveValue):
+        * manual-tests/focusringcolor-change-on-theme-change.html: Added.
+        * platform/android/TemporaryLinkStubs.cpp:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        * platform/graphics/chromium/ColorChromium.cpp: Removed.
+        * platform/graphics/chromium/ColorChromiumMac.mm: Removed.
+        * platform/graphics/mac/ColorMac.h:
+        * platform/graphics/mac/ColorMac.mm:
+        (WebCore::oldAquaFocusRingColor):
+        (WebCore::setUsesTestModeFocusRingColor):
+        (WebCore::usesTestModeFocusRingColor):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/win/ColorSafari.cpp: Removed.
         * platform/wx/TemporaryLinkStubs.cpp:
-        * webcore-wx.bkl:
-
-
-2008-12-19  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Darin Adler.
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::focusRingColor):
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::focusRingColor):
+        (WebCore::RenderThemeChromiumMac::systemColor):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::focusRingColor):
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::focusRingColor):
+        (WebCore::RenderThemeMac::systemColor):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::makeRGBAFromCGColor):
+        (WebCore::RenderThemeSafari::focusRingColor):
+        * rendering/RenderThemeSafari.h:
 
-        Temporary band-aide fix for <rdar://problem/6372481> In Gmail, a 
-        crash occurs at 
-        AccessibilityTable::isTableExposableThroughAccessibility() when 
-        attempting to create a link in a rich text message
+2009-06-26  Dmitry Titov  <dimich@chromium.org>
 
-        We need to disable Accessibility Tables until we get this fixed for 
-        real to prevent rampant crashing.
+        Reviewed by David Levin.
 
-        * page/AccessibilityTable.cpp:
-        (WebCore::AccessibilityTable::AccessibilityTable):
+        https://bugs.webkit.org/show_bug.cgi?id=26761
+        [Chromium] Enable Dedicated Workers in Chromium.
 
-2008-12-19  Simon Fraser  <simon.fraser@apple.com>
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        Remove the check that prevented workers from being created w/o a command-line switch.
+        The flag itself and methods will be removed in a subsequent patch, after
+        corresponding change in Chromium.
 
-        Reviewed by Darin Adler
+2009-06-26  Jessie Berlin  <jberlin@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=22938
-        
-        When the document element is transformed, we need to paint
-        the view background to avoid unpainted areas.
+        Reviewed by Mark Rowe.
         
-        Test: fast/transforms/transformed-document-element.html
-
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::paintBoxDecorations):
-
-2008-12-19  Steve Falkenburg  <sfalken@apple.com>
-
-        Fix build.
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2008-12-19  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fixes after recent changes.
-
-        * WebCoreSources.bkl:
-        * platform/graphics/wx/ImageSourceWx.cpp:
-        (WebCore::ImageSource::clear):
-        * webcore-base.bkl:
-
-2008-12-19  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Sam Weinig.
-
-        [GTK] Fix make distcheck again
-
-        These files were moved to WebCore/platform/animation
-        and WebCore/platform/graphics/transforms.
-
-        * GNUmakefile.am:
-
-2008-12-19  Gustavo Noronha Silva  <gns@gnome.org>
-
-        Reviewed by Holger Freyther.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22900
-
-        Fix AtomicString usage, so that building works.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-
-2008-12-19  Adam Roben  <aroben@apple.com>
-
-        Windows build fix on older versions of CFNetwork after r39393
-
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::highestSupportedCFURLConnectionClientVersion): Changed
-        preprocessor directives not to leave in unreachable code on old
-        versions of CFNetwork.
-
-2008-12-19  Antti Koivisto  <antti@apple.com>
-
-        Comment fix.
-
-        * platform/PurgeableBuffer.h:
-
-2008-12-19  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        [GTK] Build fix by adding the new files.
-
-        * GNUmakefile.am:
-
-2008-12-19  Jade Han <jade.han@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt] Allow conversion of JavaScript Number and Boolean types to Qt types
-
-        https://bugs.webkit.org/show_bug.cgi?id=22880
-
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::convertValueToQVariant):
-
-2008-12-19  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Holger Freyther.
-
-        Implement ImageDecoder::filenameExtension() for Qt
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::filenameExtension):
-        * platform/graphics/qt/ImageDecoderQt.h:
-        * platform/graphics/qt/ImageSourceQt.cpp:
-        (WebCore::ImageSource::filenameExtension):
-
-2008-12-19  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Darin Alder.
-
-        Implement ImageSource::filenameExtension for Cario
-          https://bugs.webkit.org/show_bug.cgi?id=22905
-
-        * platform/graphics/cairo/ImageSourceCairo.cpp:
-        (WebCore::ImageSource::filenameExtension):
-        * platform/image-decoders/ImageDecoder.h:
-        * platform/image-decoders/bmp/BMPImageDecoder.h:
-        (WebCore::BMPImageDecoder::filenameExtension):
-        * platform/image-decoders/gif/GIFImageDecoder.h:
-        (WebCore::GIFImageDecoder::filenameExtension):
-        * platform/image-decoders/ico/ICOImageDecoder.h:
-        (WebCore::ICOImageDecoder::filenameExtension):
-        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
-        (WebCore::JPEGImageDecoder::filenameExtension):
-        * platform/image-decoders/png/PNGImageDecoder.h:
-        (WebCore::PNGImageDecoder::filenameExtension):
-        * platform/image-decoders/xbm/XBMImageDecoder.h:
-        (WebCore::XBMImageDecoder::filenameExtension):
-
-2008-12-18  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - avoid using the ResourceHandle-level credential storage, if any,
-          unless the client opts to use it; when use of the credential
-          storage is disallowed, all authentication challenges are sent to
-          the client.
-        - let the FrameLoaderClient decide whether to use the credential
-          storage. 
-
-        * loader/EmptyClients.h:
-        (WebCore::EmptyFrameLoaderClient::shouldUseCredentialStorage): Added.
-        Returns false.
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::shouldUseCredentialStorage): Added. Calls through
-        to the FrameLoaderClient.
-        * loader/FrameLoader.h: Declared shouldUseCredentialStorage().
-        * loader/FrameLoaderClient.h: Declared shouldUseCredentialStorage().
-        * loader/ResourceLoader.cpp: 
-        (WebCore::ResourceLoader::shouldUseCredentialStorage): Added. Calls
-        through to the FrameLoader.
-        * loader/ResourceLoader.h:
-        (WebCore::ResourceLoader::shouldUseCredentialStorage): Implemented this
-        ResourceHandleClient method.
-        * loader/SubresourceLoader.cpp:
-        (WebCore::SubresourceLoader::shouldUseCredentialStorage): Added.
-        Overrides the ResourceLoader implementation by letting the client
-        supply the return value. If the client does not do this, continues
-        with the ResourceLoader behavior of asking the FrameLoader.
-        * loader/SubresourceLoader.h: Removed an unused #include and declared
-        shouldUseCredentialStorage().
-        * loader/SubresourceLoaderClient.h:
-        (WebCore::SubresourceLoaderClient::getShouldUseCredentialStorage):
-        Added a default implementation which returns false, meaning the client
-        does not wish to decide whether the credential storage should be used.
-        * platform/network/ResourceHandle.h: Removed unused forward declarations.
-        Declared a new member function, shouldUseCredentialStorage(), on Mac and
-        CFNetwork-using builds.
-        * platform/network/ResourceHandleClient.h:
-        (WebCore::ResourceHandleClient::shouldUseCredentialStorage): Added this
-        default implementation that returns false.
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::findCFNetworkModule): Added. Returns a handle to the CFNetwork
-        module.
-        (WebCore::cfNetworkVersion): Added. Returns the high word of the
-        CFNetwork library's product version.
-        (WebCore::highestSupportedCFURLConnectionClientVersion): Added. Returns
-        the highest version of the CFURLConnectionClient structure supported by
-        the CFNetwork library. The only reason to check this at runtime is
-        that WebKit may be linking at runtime against an older version of
-        CFNetwork than the one it was built with, as is the case with nightly
-        builds.
-        (WebCore::shouldUseCredentialStorageCallback): Added this
-        CFURLConnection callback which calls through to
-        ResourceHandle::shouldUseCredentialStorage().
-        (WebCore::ResourceHandle::start): Pass a version 3 CFURLConnectionClient
-        including the shouldUseCredentialStorage callback. At runtime, clamp the
-        client structure version down to the highest supported by CFNetwork.
-        (WebCore::ResourceHandle::shouldUseCredentialStorage): Added. Calls through
-        to the client if there is one. Otherwise returns false.
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::shouldUseCredentialStorage): Ditto.
-        (-[WebCoreResourceHandleAsDelegate connectionShouldUseCredentialStorage:]):
-        Added this delegate method which callls through to
-        ResourceHandle::shouldUseCredentialStorage().
-
-2008-12-18  David Kilzer  <ddkilzer@apple.com>
-
-        Reset role to "Private" on 6 header files to fix clean builds after r39378
-
-        Reviewed by BUILD FIX.
-
-        * WebCore.xcodeproj/project.pbxproj: Added back "Private" role
-        that was lost on 6 headers when they were "moved":
-        AffineTransform.h, Animation.h, AnimationList.h,
-        TimingFunction.h, TransformOperation.h and
-        TransformOperations.h.
-
-2008-12-18  Pamela Greene  <pam@chromium.org>
-
-        Reviewed by Dan Bernstein.
-
-        Add initializer for m_textDirectionSubmenuInclusionBehavior.
-        https://bugs.webkit.org/show_bug.cgi?id=22926
-
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings): Initialize m_textDirectionSubmenuInclusionBehavior
-
-2008-12-18  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by John Sullivan.
+        Fix: https://bugs.webkit.org/show_bug.cgi?id=26723
+        Where the m_mouseDown event was never being set on windows, so the
+        client X and Y coordinates were always being reported as zero in a
+        dragstart handler.
 
-        Add new FrameLoaderClient method to indicate the first visually 
-        non-empty layout based on an heuristic.  Right now that heuristic
-        is the first layout after an image, text or plugin has been added
-        to the render tree, but I can imagine it becoming much smarter.
+        Test: editing/selection/drag-start-event-client-x-y.html
 
-        * loader/EmptyClients.h:
-        (WebCore::EmptyFrameLoaderClient::dispatchDidFirstVisuallyNonEmptyLayout):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::didFirstVisuallyNonEmptyLayout):
-        * loader/FrameLoader.h:
-        * loader/FrameLoaderClient.h:
-        * page/FrameView.cpp:
-        (WebCore::FrameViewPrivate::reset):
-        (WebCore::FrameView::layout):
-        (WebCore::FrameView::performPostLayoutTasks):
-        (WebCore::FrameView::setIsVisuallyNonEmpty):
-        * page/FrameView.h:
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::RenderImage):
-        * rendering/RenderPartObject.cpp:
-        (WebCore::RenderPartObject::RenderPartObject):
-        * rendering/RenderText.cpp:
-        (WebCore::RenderText::RenderText):
-
-2008-12-18  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - fix <rdar://problem/6449841> reduce memory use of ResourceResponseBase by removing two maps
-
-        We were parsing the cache-control and pragma header field values into maps.
-        I changed that so instead we only cache two bits with the data we were actually
-        using. Later we might want to move this responsibility out of this class entirely;
-        we can cache it at the higher level instead.
-
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::mustRevalidate): Changed to call a specific API to get at
-        the bits in quest instead of a general "cache control directives" API.
-
-        * platform/network/ResourceResponseBase.cpp:
-        (WebCore::ResourceResponseBase::setHTTPHeaderField): Remove the logic for the
-        pragma header field since no one is using this for now.
-        (WebCore::ResourceResponseBase::parseCacheControlDirectives): Eliminated the return
-        value and made this function have side effects only. Changed it so it's the caller's
-        responsibility to check m_haveParsedCacheControl. Set m_cacheControlContainsNoCache
-        and m_cacheControlContainsMustRevalidate rather than keeping a map around.
-
-        * platform/network/ResourceResponseBase.h:
-        (WebCore::ResourceResponseBase::cacheControlContainsNoCache): Added.
-        (WebCore::ResourceResponseBase::cacheControlContainsMustRevalidate): Added.
-        (WebCore::ResourceResponseBase::ResourceResponseBase): Updated since I removed
-        m_haveParsedCacheControl and renamed m_haveParsedCacheControlHeader to remove
-        the imprecise use of the term "header".
-
-2008-12-18  Steve Falkenburg  <sfalken@apple.com>
-
-        Build fix.
-        Delete 2nd copy of code in these files.
-
-        * platform/animation/Animation.cpp:
-        * platform/animation/Animation.h:
-        * platform/animation/AnimationList.cpp:
-        * platform/animation/AnimationList.h:
-        * platform/animation/TimingFunction.h:
-        * platform/graphics/transforms/AffineTransform.cpp:
-        * platform/graphics/transforms/AffineTransform.h:
-        * platform/graphics/transforms/IdentityTransformOperation.h:
-        * platform/graphics/transforms/MatrixTransformOperation.cpp:
-        * platform/graphics/transforms/MatrixTransformOperation.h:
-        * platform/graphics/transforms/RotateTransformOperation.cpp:
-        * platform/graphics/transforms/RotateTransformOperation.h:
-        * platform/graphics/transforms/ScaleTransformOperation.cpp:
-        * platform/graphics/transforms/ScaleTransformOperation.h:
-        * platform/graphics/transforms/SkewTransformOperation.cpp:
-        * platform/graphics/transforms/SkewTransformOperation.h:
-        * platform/graphics/transforms/TransformOperation.h:
-        * platform/graphics/transforms/TransformOperations.cpp:
-        * platform/graphics/transforms/TransformOperations.h:
-        * platform/graphics/transforms/TranslateTransformOperation.cpp:
-        * platform/graphics/transforms/TranslateTransformOperation.h:
-
-2008-12-18  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Geoffrey Garen.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22859
-        Abstract away the use of JSDOMWindow in CachedPage and introduce
-        ScriptCachedPageData abstraction.
-
-        * GNUmakefile.am: Added ScriptCachedPageData to project.
-        * WebCore.pro: Added ScriptCachedPageData to project.
-        * WebCore.vcproj/WebCore.vcproj: Added ScriptCachedPageData to project.
-        * WebCore.xcodeproj/project.pbxproj: Added ScriptCachedPageData to
-            project.
-        * bindings/js/ScriptCachedPageData.cpp: Added.
-        (WebCore::ScriptCachedPageData::ScriptCachedPageData):
-        (WebCore::ScriptCachedPageData::~ScriptCachedPageData):
-        (WebCore::ScriptCachedPageData::restore):
-        (WebCore::ScriptCachedPageData::clear):
-        * bindings/js/ScriptCachedPageData.h: Added.
-        * history/CachedPage.cpp: Replaced JSDOMWindow and ProtectedPtr with
-            ScriptCachedPageData.
-        (WebCore::CachedPage::CachedPage):
-        (WebCore::CachedPage::domWindow):
-        (WebCore::CachedPage::restore):
-        (WebCore::CachedPage::clear):
-        * history/CachedPage.h: Replaced JSDOMWindow and ProtectedPtr with
-            ScriptCachedPageData.
-
-2008-12-18  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Dave Hyatt.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEvent):
+        Set the m_mouseDown event when the mouse press is handled.
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::mouseDown):
+        Removed now redundant setting of m_mouseDown.
 
-        https://bugs.webkit.org/show_bug.cgi?id=22888
+2009-06-26  Brady Eidson  <beidson@apple.com>
 
-        To avoid future dependency issues, all the TransformOperations and Animation related files need to be moved to platform
+        Tiger build fix
 
         * WebCore.xcodeproj/project.pbxproj:
-        * platform/animation: Added.
-        * platform/animation/Animation.cpp: Copied from WebCore/rendering/style/Animation.cpp.
-        * platform/animation/Animation.h: Copied from WebCore/rendering/style/Animation.h.
-        * platform/animation/AnimationList.cpp: Copied from WebCore/rendering/style/AnimationList.cpp.
-        * platform/animation/AnimationList.h: Copied from WebCore/rendering/style/AnimationList.h.
-        * platform/animation/TimingFunction.h: Copied from WebCore/rendering/style/TimingFunction.h.
-        * platform/graphics/AffineTransform.cpp: Removed.
-        * platform/graphics/AffineTransform.h: Removed.
-        * platform/graphics/transforms: Added.
-        * platform/graphics/transforms/AffineTransform.cpp: Copied from WebCore/platform/graphics/AffineTransform.cpp.
-        * platform/graphics/transforms/AffineTransform.h: Copied from WebCore/platform/graphics/AffineTransform.h.
-        * platform/graphics/transforms/IdentityTransformOperation.h: Copied from WebCore/rendering/style/IdentityTransformOperation.h.
-        * platform/graphics/transforms/MatrixTransformOperation.cpp: Copied from WebCore/rendering/style/MatrixTransformOperation.cpp.
-        * platform/graphics/transforms/MatrixTransformOperation.h: Copied from WebCore/rendering/style/MatrixTransformOperation.h.
-        * platform/graphics/transforms/RotateTransformOperation.cpp: Copied from WebCore/rendering/style/RotateTransformOperation.cpp.
-        * platform/graphics/transforms/RotateTransformOperation.h: Copied from WebCore/rendering/style/RotateTransformOperation.h.
-        * platform/graphics/transforms/ScaleTransformOperation.cpp: Copied from WebCore/rendering/style/ScaleTransformOperation.cpp.
-        * platform/graphics/transforms/ScaleTransformOperation.h: Copied from WebCore/rendering/style/ScaleTransformOperation.h.
-        * platform/graphics/transforms/SkewTransformOperation.cpp: Copied from WebCore/rendering/style/SkewTransformOperation.cpp.
-        * platform/graphics/transforms/SkewTransformOperation.h: Copied from WebCore/rendering/style/SkewTransformOperation.h.
-        * platform/graphics/transforms/TransformOperation.h: Copied from WebCore/rendering/style/TransformOperation.h.
-        * platform/graphics/transforms/TransformOperations.cpp: Copied from WebCore/rendering/style/TransformOperations.cpp.
-        * platform/graphics/transforms/TransformOperations.h: Copied from WebCore/rendering/style/TransformOperations.h.
-        * platform/graphics/transforms/TranslateTransformOperation.cpp: Copied from WebCore/rendering/style/TranslateTransformOperation.cpp.
-        * platform/graphics/transforms/TranslateTransformOperation.h: Copied from WebCore/rendering/style/TranslateTransformOperation.h.
-        * rendering/style/Animation.cpp: Removed.
-        * rendering/style/Animation.h: Removed.
-        * rendering/style/AnimationList.cpp: Removed.
-        * rendering/style/AnimationList.h: Removed.
-        * rendering/style/IdentityTransformOperation.h: Removed.
-        * rendering/style/MatrixTransformOperation.cpp: Removed.
-        * rendering/style/MatrixTransformOperation.h: Removed.
-        * rendering/style/RotateTransformOperation.cpp: Removed.
-        * rendering/style/RotateTransformOperation.h: Removed.
-        * rendering/style/ScaleTransformOperation.cpp: Removed.
-        * rendering/style/ScaleTransformOperation.h: Removed.
-        * rendering/style/SkewTransformOperation.cpp: Removed.
-        * rendering/style/SkewTransformOperation.h: Removed.
-        * rendering/style/TimingFunction.h: Removed.
-        * rendering/style/TransformOperation.h: Removed.
-        * rendering/style/TransformOperations.cpp: Removed.
-        * rendering/style/TransformOperations.h: Removed.
-        * rendering/style/TranslateTransformOperation.cpp: Removed.
-        * rendering/style/TranslateTransformOperation.h: Removed.
-
-2008-12-18  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Bug 21855: REGRESSION (r37323): Gmail complains about popup blocking when opening a link
-        <https://bugs.webkit.org/show_bug.cgi?id=21855>
-        <rdar://problem/6278244>
-
-        If JavaScript is not currently executing, the handleEvent member function
-        of JSAbstractEventListener should set the dynamic global object to the
-        global object of the context in which the event occurred.
-        
-        If this is not set, then JavaScriptCore will simply take the global object
-        of the context where the event handler function was created, which may be
-        a different frame. This will cause the popup blocker to incorrectly block
-        windows opened from onclick events inside of an iframe whose handler was
-        created in the outer frame, as it will check the outer frame and see that
-        it is not processing any events.
-
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSAbstractEventListener::handleEvent):
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (swizzleMIMETypeMethodIfNecessary):
 
-2008-12-17  Simon Fraser  <simon.fraser@apple.com>
+2009-06-26  Alexey Proskuryakov  <ap@webkit.org>
 
-        Reviewed by Dave Hyatt
+        Reviewed by Sam Weinig.
 
-        https://bugs.webkit.org/show_bug.cgi?id=22570
-        
-        Add the ability to compute clip rects independently from
-        caching them on the RenderLayer. When painting reflections, use 
-        such temporarily computed clipRects, otherwise the layer may cache
-        clipRects which are invalid, since they have been computed with
-        a rootLayer that is not the one usually used to paint.
+        https://bugs.webkit.org/show_bug.cgi?id=26681
+        Problem updating applicationCache when server returns 304
         
-        Test: fast/reflections/reflection-overflow-hidden.html
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintLayer):
-        (WebCore::RenderLayer::hitTestLayer):
-        (WebCore::RenderLayer::updateClipRects):
-        (WebCore::RenderLayer::calculateClipRects):
-        (WebCore::RenderLayer::calculateRects):
-        * rendering/RenderLayer.h:
-        (WebCore::ClipRects::ClipRects):
-        (WebCore::ClipRects::reset):
-        (WebCore::ClipRects::overflowClipRect):
-        (WebCore::ClipRects::setOverflowClipRect):
-        (WebCore::ClipRects::fixedClipRect):
-        (WebCore::ClipRects::setFixedClipRect):
-        (WebCore::ClipRects::posClipRect):
-        (WebCore::ClipRects::setPosClipRect):
-        (WebCore::ClipRects::setFixed):
-        (WebCore::ClipRects::operator==):
-        (WebCore::ClipRects::operator=):
-        * rendering/RenderReplica.cpp:
-        (WebCore::RenderReplica::paint):
-
-2008-12-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22618
-
-        Fix MinGW QtWebKit linking problems and also make the 
-        QtWebKit build system more robust.
-
-        * WebCore.pro:
+        Improve the fix, make the test pass on Tiger.
 
-2008-12-17  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didReceiveResponse): Fix another code path to remove the
+        current item from list.
 
-        Reviewed by Maciej Stachowiak.
+        * platform/network/mac/ResourceHandleMac.mm: (WebCore::ResourceHandle::start): On Tiger,
+        conditional requests that cannot be cached by network layer cause errors with default cache
+        policy.
 
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22866
+2009-06-26  Brady Eidson  <beidson@apple.com>
 
-        wml.css is based on an older copy of html4.css. Synchronize them.
-        Remove all entries, that are irrelevant for WML.
+        Reviewed by Sam Weinig
 
-        Fix <do> appearance: should behave like HTMLs <button>.
+        <rdar://problem/6961578> REGRESSION (r43511): Opening .fdf files from Acrobat Professional fails
 
-        * css/wml.css:
+        When we disabled content sniffing for file urls we lost knowledge of many file extensions that we
+        didn't intend to lose.  Turns out the CoreTypes UTI database doesn't know about every extension Gatekeeper
+        knew about.
 
-2008-12-17  Yury Semikhatsky <yurys@google.com>
+        By comparing CoreTypes' database to Gatekeepers, this patch adds a hardcoded list of file extension to MIME
+        type mappings that are missing in CoreType's database.
 
-        Reviewed by Timothy Hatcher.
-        Landed by Adam Barth.
-
-        Added more checks that WebInspector.panels.{resources,scripts} are
-        defined where they are accessed from other panels and WebInspector
-        (some panels are not yet supported in Chrome).
-
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype.addMessage):
-        (WebInspector.Console.prototype.clearMessages):
-        (WebInspector.Console.prototype.completions):
-        * inspector/front-end/ObjectPropertiesSection.js:
-        (WebInspector.ObjectPropertyTreeElement.prototype.evaluateExpression):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.get searchableViews):
-        (WebInspector.ScriptsPanel.prototype._sourceViewForScriptOrResource):
-        (WebInspector.ScriptsPanel.prototype._sourceFrameForScriptOrResource):
-        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
-        * inspector/front-end/SourceView.js:
-        (WebInspector.SourceView.prototype._addBreakpoint):
-        * inspector/front-end/inspector.js:
-        (WebInspector.addResource):
-        (WebInspector.removeResource):
-        (WebInspector.showResourceForURL):
-
-2008-12-17  Cary Clark  < caryclark@google.com>
+        Test: platform/mac/fast/loader/file-url-mimetypes.html
 
-        Reviewed by Darin Adler.
-        Landed by Adam Barth.
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): Move the MIME Type swizzling code to
+          WebCoreURLResponse.
 
-        Add ENABLE_TEXT_CARET to permit the ANDROID platform
-        to invalidate and draw the caret in a separate thread.
+        * platform/network/mac/ResourceResponseMac.mm:
+        (WebCore::ResourceResponse::platformLazyInit): _webcore_MIMEType -> MIMEType, as we now have only one place
+          where we do all MIMEType correction.
+
+        * platform/network/mac/WebCoreURLResponse.h: Remove _webcore_MIMEType, as it is now folded into the swizzled
+          implementation of MIMEType.
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (createBinaryExtensionsSet):
+        (createExtensionToMIMETypeMap):
+        (swizzleMIMETypeMethodIfNecessary):
+        (webNSURLResponseMIMEType): If it's a file URL and there's no MIME type, see if the extension exists in the 
+          extension -> MIME type map before turning to the default MIME type.  Also roll in what was previously
+          implemented in _webcore_MIMEType.
 
-        * page/Frame.cpp:
-        (WebCore::Frame::clearCaretRectIfNeeded): Body of
-        function does nothing if text caret is disabled.
-        (WebCore::Frame::selectionLayoutChanged): Do nothing
-        if text caret is disabled and the caret only blinked.
-        (WebCore::Frame::caretBlinkTimerFired):
-        (WebCore::Frame::paintCaret):
-        (WebCore::Frame::paintDragCaret): Body of
-        functions does nothing if text caret is disabled.
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::~SVGImage): Tweak this ASSERT - SVGImages might get destroyed without ever having a client.
 
-2008-12-16  Darin Adler  <darin@apple.com>
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
 
-        Reviewed and landed by Cameron Zwarich.
+        Reviewed by Simon Fraser.
 
-        Change the style of AtomicString::add() to match Identifier:add().
+        Show the fullscreen button only if the backend has support for it.
 
-        * platform/text/AtomicString.cpp:
-        (WebCore::AtomicString::add):
+        https://bugs.webkit.org/show_bug.cgi?id=26661
 
-2008-12-16  Adele Peterson  <adele@apple.com>
+        No test since this is not reachable via the DOM.
 
-        Reviewed by Darin Adler.
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::supportsFullscreen): new
+        * html/HTMLVideoElement.h:
+        (WebCore::HTMLVideoElement::supportsFullscreen): new
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::supportsFullscreen): new
+        (WebCore::MediaPlayer::supportsFullscreen): new
+        * platform/graphics/MediaPlayer.h: new
+        * platform/graphics/MediaPlayerPrivate.h: new
+        (WebCore::MediaPlayerPrivateInterface::supportsFullscreen): new
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlFullscreenButtonElement::rendererIsNeeded): new
+        * rendering/MediaControlElements.h:
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=22827
-        <rdar://problem/6247724> RenderThemeWin buttons have weird heavy text
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
 
-        * rendering/RenderThemeWin.cpp:
-        (WebCore::fillFontDescription): Add version that takes a font size.
-        (WebCore::RenderThemeWin::systemFont): Use the default GUI font for control fonts, but specify the size.
-        This will match Firefox.
+        Reviewed by Simon Fraser.
 
-2008-12-16  Stephanie Lewis  <slewis@apple.com>
+        <rdar://problem/7007776> Controller doesn't automatically update counters when file
+        is playing ( http://www.jazzguitar.be/mp3/Michael%20Lewis%20-%20SSSJ.mp3 )
 
-        Another build fix.
+        Update the time display when the movie time changes.
 
-        * platform/text/AtomicString.h:
-        (WebCore::AtomicString::AtomicString):
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls):
 
-2008-12-16  Stephanie Lewis  <slewis@apple.com>
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
 
-        Windows Build Fix.
+        Reviewed by Simon Fraser.
 
-        * platform/text/AtomicString.h:
-        (WebCore::AtomicString::AtomicString):
-        (WebCore::AtomicString::createCFString):
+        https://bugs.webkit.org/show_bug.cgi?id=26659
 
-2008-12-16  Peter Kasting  <pkasting@google.com>
+        Support hidding a control bar element from the Media element controller.
 
-        Reviewed by David Hyatt.
+        Update layout tests since the fullscreen button no longer has a renderer.
 
-        https://bugs.webkit.org/show_bug.cgi?id=22885
-        Fix memory corruption in GIFImageDecoder.cpp with certain GIFs.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaTextDisplayElement::update): call updateStyle() so everything
+        is updated properly.
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+        (WebCore::MediaControlInputElement::update): call updateStyle()
+        (WebCore::MediaControlInputElement::updateStyle): create the renderer properly
+        or not depending on what rendererIsNeeded() return.
+        * rendering/MediaControlElements.h:
 
-        * platform/image-decoders/gif/GIFImageDecoder.cpp:
-        (WebCore::GIFImageDecoder::frameComplete):
+2009-06-26  Kevin McCullough  <kmccullough@apple.com>
 
-2008-12-16  Stephanie Lewis  <slewis@apple.com>
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Geoff Garen.
+        <rdar://problem/6968137> Profiler title numbers increment even after a
+        reload.
 
-        Change HTTPHeaderMap to use an AtomicString as its key.  
-        Shaves ~1MB off of the Mozilla Memory Test
-        No functionality difference    
+        - Now the numbers are reset when the profiles are.
 
-        * WebCore.xcodeproj/project.pbxproj:
         * inspector/InspectorController.cpp:
-        (WebCore::addHeaders):
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::parseHeader):
-        * platform/network/HTTPHeaderMap.h:
-        * platform/network/ResourceRequestBase.cpp:
-        (WebCore::ResourceRequestBase::httpHeaderField):
-        (WebCore::ResourceRequestBase::setHTTPHeaderField):
-        (WebCore::ResourceRequestBase::addHTTPHeaderField):
-        * platform/network/ResourceRequestBase.h:
-        * platform/network/ResourceResponseBase.cpp:
-        (WebCore::ResourceResponseBase::httpHeaderField):
-        (WebCore::ResourceResponseBase::setHTTPHeaderField):
-        * platform/network/ResourceResponseBase.h:
-        * platform/text/StringHash.h:
-        (WebCore::CaseFoldingHash::hash):
-        (WebCore::CaseFoldingHash::equal):
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::isSetCookieHeader):
-        (WebCore::XMLHttpRequest::setRequestHeader):
-        (WebCore::XMLHttpRequest::setRequestHeaderInternal):
-        (WebCore::XMLHttpRequest::getRequestHeader):
-        (WebCore::XMLHttpRequest::getResponseHeader):
-        * xml/XMLHttpRequest.h:
+        (WebCore::InspectorController::didCommitLoad):
 
-2008-12-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+2009-06-26  Adele Peterson  <adele@apple.com>
 
         Reviewed by Darin Adler.
 
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22876
-
-        Remove legacy randomNumber() functionality from HTMLFormElement, and use the new wtf/RandomNumber.h.
-        Also remove an uneeded QFileInfo include while I'm at it - there is no Qt usage in this file.
-
-        * ForwardingHeaders/wtf/RandomNumber.h: Added.
-        * html/HTMLFormElement.cpp:
-        (WebCore::getUniqueBoundaryString):
-
-2008-12-16 Yael Aharon <yael.aharon@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
+        Fix for <rdar://problem/7000796>
+        REGRESSION(34681): Breaking up quoted text makes new, unquoted text blue after certain steps; repros with some messages
 
-        Qt/Win build fix
-
-        * platform/win/SystemTimeWin.cpp:
-
-2008-12-16  Kalle Vahlman  <kalle.vahlman@movial.com>
-
-        Reviewed by Holger Freyther.
+        Test: editing/inserting/break-blockquote-after-delete.html
 
-        [CURL] memory leak of ResouceHandles
-        http://bugs.webkit.org/show_bug.cgi?id=20777
+        Keep track of whether the typing style should be preserved after the TypingCommand is applied.  When adding onto an open
+        typing command, keep that flag up to date.
 
-        Fix ResourceHandle ref management to be consistent and correct.
-        Original patch from Marco Barisione.
+        In this case, an InsertParagraphSeparatorInQuotedContent command, which should not preserve typing style, 
+        was following an open Delete command, which does preserve the typing style.  So we were applying the original
+        typing style (from before the delete, so blue text) to the cursor in the unquoted area after breaking up the blockquote.
 
-        * platform/network/curl/ResourceHandleCurl.cpp:
-        (WebCore::ResourceHandle::start):
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::ResourceHandleManager::removeFromCurl):
-        (WebCore::ResourceHandleManager::add):
-        (WebCore::ResourceHandleManager::removeScheduledJob):
-
-2008-12-16  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Fix the Qt build.
-
-        * platform/graphics/qt/ImageSourceQt.cpp:
-        (WebCore::ImageSource::clear): Adjust to new signature.
-
-2008-12-15  Mark Rowe  <mrowe@apple.com>
-
-        Rubber-stamped by Cameron Zwarich.
-
-        <rdar://problem/6289933> Change WebKit-related projects to build with GCC 4.2 on Leopard.
-
-        * Configurations/Base.xcconfig:
-        * Configurations/DebugRelease.xcconfig:
-
-2008-12-15  Adele Peterson  <adele@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=22871
-        <rdar://problem/6417316> RenderThemeWin buttons are too short/thin
-
-        * rendering/RenderButton.cpp: (WebCore::RenderButton::setupInnerStyle): 
-        Check if the button's style (not the new inner style) has appearance set to determine whether we should set padding on the inner style.
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::TypingCommand):
+        (WebCore::TypingCommand::typingAddedToOpenCommand):
+        (WebCore::TypingCommand::insertTextRunWithoutNewlines):
+        (WebCore::TypingCommand::insertLineBreak):
+        (WebCore::TypingCommand::insertParagraphSeparator):
+        (WebCore::TypingCommand::insertParagraphSeparatorInQuotedContent):
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        (WebCore::TypingCommand::deleteSelection):
+        (WebCore::TypingCommand::updatePreservesTypingStyle):
+        * editing/TypingCommand.h: (WebCore::TypingCommand::preservesTypingStyle):
 
-2008-12-15  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Simon Hausmann.
 
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22865
+        Add support for saving and loading of QWebHistory to and from a QByteArray.
 
-        Add complete WML <table> / <tr> / <td> element support.
-        Proper handling of all table related attributes, including tests.
+        This includes streaming operators for QWebHistory. for convenience.
 
-        Tests: fast/wml/table-element-align-attribute-invalid.wml (variable reference in 'align' attribute, raises error)
-               fast/wml/table-element-columns-attribute-invalid-number.wml (columns='0', raises error)
-               fast/wml/table-element-columns-attribute-invalid.wml (non-numeric 'columns' attribute value, raises error)
-               fast/wml/table-element-columns-attribute-missing.wml (missing 'columns')
-               fast/wml/table-element-columns-attribute.wml (test 'columns' attribute and <td> count mismatches)
+        New autotests that test QWebHistory and QWebHistoryItem serialization.
 
-        * GNUmakefile.am:
         * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::offsetParent):
-        * rendering/RenderTableRow.cpp:
-        (WebCore::RenderTableRow::addChild):
-        * wml/WMLTableElement.cpp: Added.
-        (WebCore::WMLTableElement::WMLTableElement):
-        (WebCore::WMLTableElement::~WMLTableElement):
-        (WebCore::WMLTableElement::mapToEntry):
-        (WebCore::WMLTableElement::parseMappedAttribute):
-        (WebCore::WMLTableElement::finishParsingChildren):
-        * wml/WMLTableElement.h: Added.
-        * wml/WMLTagNames.in:
-
-2008-12-15  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - fix <rdar://problem/6427048> crash due to infinite recursion after setting window.__proto__ = window
-
-        Test: fast/dom/Window/window-custom-prototype.html
-
-        Replaced toGlobalObject with the more generally useful unwrappedObject.
-
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::JSDOMWindowShell::unwrappedObject): Added.
-        * bindings/js/JSDOMWindowShell.h: Declared unwrappedObject.
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        (WebCore::JSQuarantinedObjectWrapper::unwrappedObject): Ditto.
-
-2008-12-15  Gustavo Noronha Silva  <kov@kov.eti.br>
-
-        Reviewed by Mark Rowe.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22686
-
-        GTK+ build fix.
-
-        * GNUmakefile.am:
-
-2008-12-15  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=22847
-        Geolocation PositionOptions cannot be an arbitrary object.
-
-        Allow the PositionOptions to be a vanilla JS object and parse it
-        appropriately.
-
-        * DerivedSources.make: Remove PositionOptions.
-        * GNUmakefile.am: Ditto.
-        * WebCore.pro: Ditto.
-        * WebCore.vcproj/WebCore.vcproj: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * WebCoreSources.bkl: Ditto.
-
-        * bindings/js/JSGeolocationCustom.cpp:
-        (WebCore::createPositionOptions): Added. Extracts the enableHighAccuracy
-        and timeout fields from a vanilla JS object in order to create the 
-        PositionOptions object, checking for exceptions as necessary.
-        (WebCore::JSGeolocation::getCurrentPosition): Use createPositionOptions
-        instead of toPositionOptions.
-        (WebCore::JSGeolocation::watchPosition): Ditto.
-        * page/PositionOptions.idl: Removed
-
-2008-12-15  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by David Hyatt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22108
-        Large animated GIFs weren't always animating.  The code that deleted
-        the entire decoder after each frame of a large image was resulting in
-        us forgetting the loop count, breaking animations intermittently.
-
-        Instead of throwing the whole decoder away, we're more careful to just
-        delete frames we don't care about.  This additionally addresses
-        problems in the Cairo and Chromium ports with excessive peak memory
-        use and CPU use when decoding large animated GIFs because it leads to
-        much less redecoding (O(n) instead of O(n^2) CPU, and O(1) instead of
-        O(n) memory).
-
-        This change has less impact on the CG decoder, which seems to throw
-        away frames automatically when their external references are dropped;
-        this means the CG decoder didn't suffer from the peak memory usage
-        issue before (and still doesn't), but it also still burns excessive
-        CPU redecoding earlier frames, that in theory it wouldn't need to
-        redecode if it would judiciously save the most recent frames.  At
-        least this patch plumbs some useful info to the ImageSource so it can
-        help guide the CG decoder heuristics in the future.
-
-        * platform/graphics/BitmapImage.cpp:
-        (WebCore::frameBytes):
-        (WebCore::BitmapImage::destroyDecodedData):
-        (WebCore::BitmapImage::destroyDecodedDataIfNecessary):
-        (WebCore::BitmapImage::destroyMetadataAndNotify):
-        (WebCore::BitmapImage::clearFrame):
-        (WebCore::BitmapImage::cacheFrame):
-        (WebCore::BitmapImage::dataChanged):
-        (WebCore::BitmapImage::startAnimation):
-        (WebCore::BitmapImage::resetAnimation):
-        (WebCore::BitmapImage::internalAdvanceAnimation):
-        * platform/graphics/BitmapImage.h:
-        * platform/graphics/GeneratedImage.h:
-        (WebCore::GeneratedImage::destroyDecodedData):
-        * platform/graphics/Image.h:
-        * platform/graphics/ImageSource.h:
-        * platform/graphics/cairo/ImageSourceCairo.cpp:
-        (WebCore::ImageSource::~ImageSource):
-        (WebCore::ImageSource::clear):
-        * platform/graphics/cg/ImageSourceCG.cpp:
-        (WebCore::ImageSource::~ImageSource):
-        (WebCore::ImageSource::clear):
-        * platform/graphics/cg/PDFDocumentImage.h:
-        (WebCore::PDFDocumentImage::destroyDecodedData):
-        * platform/graphics/qt/StillImageQt.h:
-        (WebCore::StillImage::destroyDecodedData):
-        * platform/image-decoders/ImageDecoder.h:
-        (WebCore::RGBA32Buffer::clear):
-        (WebCore::ImageDecoder::clearFrameBufferCache):
-        * platform/image-decoders/gif/GIFImageDecoder.cpp:
-        (WebCore::GIFImageDecoder::repetitionCount):
-        (WebCore::GIFImageDecoder::clearFrameBufferCache):
-        (WebCore::GIFImageDecoder::initFrameBuffer):
-        * platform/image-decoders/gif/GIFImageDecoder.h:
-        * platform/image-decoders/gif/GIFImageReader.h:
-        (GIFImageReader::GIFImageReader):
-        * svg/graphics/SVGImage.h:
-        (WebCore::SVGImage::destroyDecodedData):
-
-2008-12-15  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 22562: REGRESSION (r37971): events not firing after going back in back/forward cache
-        <https://bugs.webkit.org/show_bug.cgi?id=22562>
-        <rdar://problem/6414593>
-
-        Restore the Frame's DOMWindow to its previous value when going back in
-        the back/forward cache. The fact that it was not getting set before may
-        have always caused some subtle bugs with the back/forward cache, but
-        after r37971, it causes no events to fire after restoring a page.
-
-        Previously, ScriptController::clearScriptObjects() was calling
-        clearPlatformScriptObjects(), which was not actually clearing any
-        objects, only updating them to reflect some change in state. Since the
-        window shell was not updated until after the call to clearScriptObjects(),
-        this didn't actually make that much sense.
-
-        We rename clearPlatformScriptObjects() to reflect its actual purpose and
-        call it after the window shell has been updated rather than before.
-
-        Unfortunately, there is no way to test this with a layout test because
-        it involves the back/forward cache.
-
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::updatePlatformScriptObjects): Renamed from
-        clearPlatformScriptObjects(), because the only nonempty implementation
-        doesn't actually clear any objects, it updates them. Also made public.
-        (WebCore::ScriptController::clearScriptObjects): Remove the call to
-        clearPlatformScriptObjects().
-        * bindings/js/ScriptController.h:
-        * bindings/js/ScriptControllerMac.mm:
-        (WebCore::ScriptController::updatePlatformScriptObjects):
-        * history/CachedPage.cpp:
-        (WebCore::CachedPage::domWindow): Added.
-        * history/CachedPage.h:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::cancelAndClear): Added call to updatePlatformScriptObjects().
-        (WebCore::FrameLoader::begin): Added call to updatePlatformScriptObjects().
-        (WebCore::FrameLoader::open): Added call to updatePlatformScriptObjects().
-        * page/Frame.cpp:
-        (WebCore::Frame::setDOMWindow): Added.
-        (WebCore::Frame::pageDestroyed): Added call to updatePlatformScriptObjects().
-        * page/Frame.h:
-
-2008-12-15  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Darin Adler.
-
-        When a resource is cached locally, WebKit should follow RFC 2616 "Specific end-to-end revalidation" instead of "Unspecified end-to-end revalidation"
-        https://bugs.webkit.org/show_bug.cgi?id=17998 
-        
-        - Enable conditional revalidation for reloads by default. 
-        - Add a parameter to FrameLoader::reload() for forcing end-to-end reload.
-        - To avoid duplicating state remove m_cachePolicy variables from FrameLoader and DocLoader. 
-          Instead synthezise the policy on demand.
-        
-        This speeds up reloads and makes them use way less bandwidth.
-
-        * WebCore.base.exp:
-        * loader/CachePolicy.h: Rename CachePolicyRefresh to CachePolicyRevalidate.
-        (WebCore::):
-        * loader/DocLoader.cpp:
-        (WebCore::DocLoader::DocLoader):
-        (WebCore::DocLoader::checkForReload): Support CachePolicyRevalidate.
-        (WebCore::DocLoader::requestResource):
-        (WebCore::DocLoader::cachePolicy):
-        * loader/DocLoader.h: Get rid of m_cachePolicy member. 
-        * loader/FrameLoader.cpp:
-        (WebCore::ScheduledRedirection::ScheduledRedirection): 
-            Add parameter to differentiate refresh from other types of redirects. 
-            m_cachePolicy was used for signaling this before.
-        (WebCore::isBackForwardLoadType):
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::FrameLoader::changeLocation):
-        (WebCore::FrameLoader::stopLoading):
-        (WebCore::FrameLoader::receivedFirstData):
-        (WebCore::FrameLoader::write):
-        (WebCore::FrameLoader::startIconLoader):
-        (WebCore::FrameLoader::restoreDocumentState):
-        (WebCore::FrameLoader::scheduleHTTPRedirection):
-        (WebCore::FrameLoader::scheduleLocationChange):
-        (WebCore::FrameLoader::scheduleRefresh):
-        (WebCore::FrameLoader::redirectionTimerFired):
-        (WebCore::FrameLoader::canCachePage):
-        (WebCore::FrameLoader::loadURL):
-        (WebCore::FrameLoader::reload): 
-            Differentiate between revalidation and reload.
-            No need to use setHTTPHeaderField here, addExtraFieldsToRequest will set the headers.
-        (WebCore::FrameLoader::transitionToCommitted):
-        (WebCore::FrameLoader::cachePolicy): Determine the cache policy based on current load type. 
-        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
-        (WebCore::FrameLoader::addExtraFieldsToRequest): Set Cache-control: no-cache for FrameLoadTypeReloadFromOrigin
-        (WebCore::FrameLoader::shouldScrollToAnchor):
-        (WebCore::FrameLoader::loadItem):
-        (WebCore::FrameLoader::updateHistoryForReload):
-        (WebCore::FrameLoader::updateHistoryForCommit):
-        (WebCore::FrameLoader::switchOutLowBandwidthDisplayIfReady):
-        * loader/FrameLoader.h:
-        * loader/FrameLoaderTypes.h: Add FrameLoadTypeReloadFromOrigin
-        (WebCore::):
-        * loader/NavigationAction.cpp: 
-        (WebCore::navigationType):  Support FrameLoadTypeReloadFromOrigin
-        * loader/loader.cpp:
-        (WebCore::Loader::Host::servePendingRequests):
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::dailyVisitCounts):
+        (WebCore::HistoryItem::weeklyVisitCounts):
+        * history/qt/HistoryItemQt.cpp: Added.
+        (WebCore::HistoryItem::restoreState):
+        (WebCore::HistoryItem::saveState):
 
-2008-12-15  Holger Hans Peter Freyther  <zecke@selfish.org>
+2009-06-26  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        Add null checks to PlatformScreenQt
+        Add support for QDataStream operators to String and IntPoint.
 
-        The other ports do the null checks and JSDOMWindowBase is
-        at least one caller that is passing 0.
-
-        * platform/qt/PlatformScreenQt.cpp:
-        (WebCore::screenDepth):
-        (WebCore::screenDepthPerComponent):
-        (WebCore::screenIsMonochrome):
-        (WebCore::screenRect):
-        (WebCore::screenAvailableRect):
+        * platform/graphics/IntPoint.h:
+        (WebCore::operator<<):
+        (WebCore::operator>>):
+        * platform/text/PlatformString.h:
+        * platform/text/qt/StringQt.cpp:
+        (WebCore::operator<<):
+        (WebCore::operator>>):
 
-2008-12-15  Alexey Proskuryakov  <ap@webkit.org>
+2009-06-26  Ben Murdoch  <benm@google.com>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Darin Fisher.
 
-        <rdar://problem/6444455> Worker Thread crash running multiple workers for a moderate amount of time
+        Add #if ENABLE(DOM_STORAGE) to the V8 custom bindings for local/session storage.
+        https://bugs.webkit.org/show_bug.cgi?id=26757
 
-        * dom/WorkerThread.cpp: (WebCore::WorkerThread::workerThread):
-        Detach the thread. Without this, one page of its stack was never unmmaped, and fragmentation
-        made RegisterFile allocaiton fail after a while.
+        * bindings/v8/custom/V8StorageCustom.cpp
 
-2008-12-13  Darin Adler  <darin@apple.com>
+2009-06-26  Yongjun Zhang  <yongjun.zhang@nokia.com>
 
-        Reviewed by Sam Weinig.
+        Reviewed by Eric Seidel.
 
-        - half of https://bugs.webkit.org/show_bug.cgi?id=17425
-          eliminate DeprecatedPtrList
+        Test: platform/qt/fast/events/event-sender-keydown-frame.html
 
-        * dom/Document.cpp:
-        (WebCore::Document::removeImage): Change to set slots in the vector
-        to 0 rather than removing items from a list.
-        (WebCore::Document::dispatchImageLoadEventsNow): Rewrite to process
-        the list. Since we now use a "set to zero" design, we don't need to
-        be careful about where the iterator points while iterating the list,
-        instead we just have to skip zeros.
+        Bug 20303: [Qt] Key events are not working in frames.
 
-        * dom/Document.h: Use Vector instead of DeprecatedPtrList.
+        Merge scrolling handling code in qt and win port, move it to
+        EventHandler.
 
-        * dom/EventTargetNode.cpp:
-        (WebCore::EventTargetNode::dispatchGenericEvent): Use a Vector instead
-        of a DeprecatedPtrList for the list of nodes to handle. Also streamlined
-        the logic a bit and used goto in a couple key places.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::scrollRecursively):
+        * page/EventHandler.h:
 
-        * dom/Node.cpp:
-        (WebCore::Node::eventParentNode): Moved this function into this file
-        because it's a virtual function so already can't be inlined. Also updated
-        to return a ContainerNode, so it needs to be in a place where the
-        definition of ContainerNode is visible, not the header file.
+2009-06-26  Rob Buis  <rwlbuis@gmail.com>
 
-        * dom/Node.h: Changed return type of eventParentNode to ContainerNode
-        and moved its definition into the cpp file.
+        Reviewed by Eric Seidel.
 
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::PendingCallbacks::~PendingCallbacks): Added a call to
-        deleteAllValues here instead of setAutoDelete in the constructor, since
-        we're using Deque instead of DeprecatedPtrList.
-        (WebCore::PendingCallbacks::callAndRemoveFirstCallback): Changed the
-        code to use an OwnPtr since the deque won't delete the callback object.
+        https://bugs.webkit.org/show_bug.cgi?id=26682
+        Bug 26682: It should be possible to add image to SVG DOM programmatically (using JavaScript)
 
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange): Use a
-        Vector instead of a DeprecatedPtrList.
+        Make sure the xlink:href animated property setting syncs the corresponding attribute with the right namespace.
 
-        * svg/SVGElement.cpp:
-        (WebCore::SVGElement::eventParentNode): Moved this function into this file
-        because it's a virtual function so already can't be inlined. Also updated
-        to return a ContainerNode.
+        Test: svg/custom/createImageElement.svg
 
-        * svg/SVGElement.h: Changed setShadowParentNode to take a ContainerNode*,
-        made eventParentNode return a ContainerNode*, and made m_shadowParent a
-        ContainerNode*.
+        * svg/SVGAnimatedProperty.h:
+        (WebCore::synchronizeProperty):
 
-2008-12-14  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+2009-06-26  Takeshi Yoshino  <tyoshino@google.com>
 
-        Reviewed by George Staikos.
+        Reviewed by Timothy Hatcher.
 
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22857
+        Bug 26156: In view-source mode, always render the contents using HTMLViewSourceDocument
+        https://bugs.webkit.org/show_bug.cgi?id=26156
 
-        Jumps within a WML deck using <go> task elements fail. Manual reloading
-        is necessary to display the page - fix cache-policy in WMLGoElement::executeTask
-        to prevent the problem.
+        When in view-source mode, render the contents using HTMLViewSourceDocument
+        regardless it's applicable for any plugin or not.
 
-        Refactor setActiveCardInDocument in two new functions: findNamedCardInDocument
-        and determineActiveCard, to fix a side-effect of executing a <go> task:
-        when switching cards within a deck the active card was changed before the load
-        was fired which resulted in a flash effect on the screen, and doing unnecessary work.
+        Chromium tells WebCore to render the contents of specified URL when
+        view-source: prefix is added to the URL. But currently, DOMImplementation
+        ignores inViewSourceMode() when the MIME type is indicating that the contents
+        are neither texts nor HTML family documents.
 
-        Test: wml/go-task-animation.html
+        For example, we can check the contents of asf file without launching media
+        player. Rendering contents for view-source:-specified input is not what user
+        expects.
 
-        * wml/WMLCardElement.cpp:
-        (WebCore::WMLCardElement::findNamedCardInDocument):
-        (WebCore::WMLCardElement::determineActiveCard):
-        * wml/WMLCardElement.h:
-        * wml/WMLDocument.cpp:
-        (WebCore::WMLDocument::finishedParsing):
-        * wml/WMLGoElement.cpp:
-        (WebCore::WMLGoElement::executeTask):
-        (WebCore::WMLGoElement::prepareGETRequest):
-        * wml/WMLGoElement.h:
-
-2008-12-14  Dirk Schulze  <krit@webkit.org>
+        http://code.google.com/p/chromium/issues/detail?id=10545
 
-        Reviewed by Oliver Hunt.
+        I want to fix this issue by this patch. IMHO, regardless of this Chromium
+        specific issue, I think we should force use of HTMLViewSourceDocument when
+        inViewSourceMode() is specified.
 
-        Fixes an issue in cairo. A fully transparent color can cause wrong
-        drawings on canvas' composite.
+        Test: fast/frames/viewsource-on-image-file.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=22846
-        [CAIRO] Canvas: transparent color and composite
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::createTokenizer):
+        * html/HTMLViewSourceDocument.h:
 
-        Test: fast/canvas/canvas-transparency-and-composite.html
+2009-06-26  Xan Lopez  <xlopez@igalia.com>
 
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::strokePath):
+        Reviewed by Jan Alonzo.
 
-2008-12-13  Julien Chaffraix  <jchaffraix@webkit.org>
+        https://bugs.webkit.org/show_bug.cgi?id=25529
+        [Gtk] Expected states not exposed to assistive technologies
 
-        Reviewed by Darin Adler.
+        Add support for VISIBLE, EDITABLE and SENSITIVE states.
 
-        Bug 22665: Remove setCreatedByParser(bool) from the few elements that use it
-        https://bugs.webkit.org/show_bug.cgi?id=22665
-
-        Remove setCreatedByParser from frame and iframe.
-
-        * html/HTMLElementFactory.cpp:
-        (WebCore::frameConstructor):
-        (WebCore::iframeConstructor):
-        (WebCore::objectConstructor):
-        * html/HTMLFrameElement.cpp:
-        (WebCore::HTMLFrameElement::HTMLFrameElement):
-        * html/HTMLFrameElement.h:
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::HTMLFrameElementBase):
-        * html/HTMLFrameElementBase.h:
-        * html/HTMLFrameOwnerElement.cpp:
-        (WebCore::HTMLFrameOwnerElement::HTMLFrameOwnerElement):
-        * html/HTMLFrameOwnerElement.h:
-        (WebCore::HTMLFrameOwnerElement::createdByParser):
-        * html/HTMLIFrameElement.cpp:
-        (WebCore::HTMLIFrameElement::HTMLIFrameElement):
-        * html/HTMLIFrameElement.h:
-        * html/HTMLPlugInElement.cpp:
-        (WebCore::HTMLPlugInElement::HTMLPlugInElement):
-        * html/HTMLTagNames.in:
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (setAtkStateSetFromCoreObject):
 
-2008-12-13  Alexey Proskuryakov  <ap@webkit.org>
+2009-06-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=22843
-        Auto-generate JSWorkerContext
-
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * dom/WorkerContext.idl: Added.
-        * page/DOMWindow.idl:
-        Added ExtendsDOMGlobalObject, a new attribute for behaviors common to DOMWindow and
-        WorkerContext.
-
-        * bindings/js/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::initScript):
-        Made JSWorkerContext creation look more like JSDOMWindow creation, to work with generated code.
-
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.scons:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSWorkerContext.cpp: Removed.
-        * bindings/js/JSWorkerContext.h: Removed.
-        * bindings/js/JSWorkerContextBase.cpp: Copied from WebCore/bindings/js/JSWorkerContext.cpp.
-        (WebCore::JSWorkerContextBase::JSWorkerContextBase):
-        (WebCore::JSWorkerContextBase::~JSWorkerContextBase):
-        (WebCore::JSWorkerContextBase::scriptExecutionContext):
-        (WebCore::getJSWorkerContextBaseTable):
-        (WebCore::):
-        (WebCore::JSWorkerContextBase::put):
-        * bindings/js/JSWorkerContextBase.h: Copied from WebCore/bindings/js/JSWorkerContext.h.
-        * bindings/js/JSWorkerContextCustom.cpp: Added.
-        (WebCore::JSWorkerContext::customGetOwnPropertySlot):
-        (WebCore::JSWorkerContext::mark):
-        (WebCore::JSWorkerContext::self):
-        (WebCore::JSWorkerContext::setSelf):
-        (WebCore::JSWorkerContext::addEventListener):
-        (WebCore::JSWorkerContext::removeEventListener):
-        Moved code around. Note that currently, JSWorkerContextBase lookup table is empty, but we'll
-        need to add some global objects to it in the future, as it is done in JSDOMWindowBase.
-
-        * page/WorkerNavigator.cpp:
-        * page/WorkerNavigator.h:
-        Added ENABLE(WORKERS) ifdefs.
-
-2008-12-13  Darin Adler  <darin@apple.com>
-
-        - fix Release build
-
-        * dom/Node.cpp:
-        (WebCore::Node::rareData): Remove inappropriate inline directive.
-
-2008-12-13  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=18734
-          REGRESSION (r31081): Focus problems in Gmail 2/Plain text message text
-          <rdar://problem/5892415>
-
-        Test: fast/forms/textarea-selection-preservation.html
-
-        The regression reported was caused by the fact that the renderer code had
-        a bug where it would constantly think the newline at the end of text was
-        missing, and so it would replace all the text even though it wasn't changing,
-        which would destroy the selection.
-
-        When writing the regression test I discovered another problem: The value
-        property in HTMLTextAreaElement was intentionally changing the selection
-        to the end of the textarea, but doing that even when the value wasn't changing.
-
-        This patch fixes both and the test checks both.
-
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::setValue): Exit early if the value is
-        not changing.
+        "Pointer to incomplete class type is not allowed" error with RVCT
+        https://bugs.webkit.org/show_bug.cgi?id=26721
 
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::text): Add a newline character for each <br>
-        element encountered in the control
-
-2008-12-13  Darin Adler  <darin@apple.com>
-
-        - file deletion part of https://bugs.webkit.org/show_bug.cgi?id=17497
-          eliminate DeprecatedValueList
-
-        * GNUmakefile.am: Removed references to deleted files.
-        * WebCore.pro: Ditto.
-        * WebCore.scons: Ditto.
-        * WebCore.vcproj/WebCore.vcproj: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * WebCoreSources.bkl: Ditto.
-
-        * platform/DeprecatedPtrQueue.h: Removed.
-        * platform/DeprecatedValueList.h: Removed.
-        * platform/DeprecatedValueListImpl.cpp: Removed.
-        * platform/DeprecatedValueListImpl.h: Removed.
-
-2008-12-13  Darin Adler  <darin@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=17497
-          eliminate DeprecatedValueList
-
-        * css/CSSStyleDeclaration.cpp: Removed unneeded include.
+        Based on Norbert Leser's work.
 
         * dom/Document.cpp:
-        (WebCore::Document::removeAllEventListenersFromAllNodes):
-        Set the removed flag on the window event listeners in case we
-        are in the middle of dispatching events on this window.
-        (WebCore::Document::clear): Ditto.
-        (WebCore::Document::handleWindowEvent): Changed to use a vector
-        instead of a DeprecatedPtrList.
-        (WebCore::Document::windowInlineEventListenerForType): Ditto.
-        (WebCore::Document::removeWindowInlineEventListenerForType): Ditto.
-        Also added a call to setRemoved, which is needed here just as in
-        other functions that remove.
-        (WebCore::Document::removeWindowEventListener): Ditto.
-        (WebCore::Document::hasWindowEventListener): Ditto.
-
-        * dom/Document.h: Changed RegisteredEventListenerList to
-        RegisteredEventListeners.
-
-        * dom/Element.cpp:
-        (WebCore::Element::attach): Use a function to access rare data instead
-        of getting directly at the data field.
-        (WebCore::Element::focus): Ditto.
-        (WebCore::Element::cancelFocusAppearanceUpdate): Ditto.
-
-        * dom/ElementRareData.h: Use "using" to make things that are protected
-        in NodeRareData be public here.
-
-        * dom/EventTarget.h: Removed include of DeprecatedValueList and
-        related declearations that weren't needed. Tweaked the definitions
-        of the forbidEventDispatch functions too.
-
-        * dom/EventTargetNode.cpp:
-        (WebCore::EventTargetNode::EventTargetNode): Eliminated code that
-        was used to initialized m_regdListeners.
-        (WebCore::EventTargetNode::~EventTargetNode): Elminated delete of
-        m_regdListeners. Changed code to use eventListeners() instead of
-        m_regdListeners.
-        (WebCore::EventTargetNode::eventListeners): Added.
-        (WebCore::EventTargetNode::insertedIntoDocument): Use eventListeners.
-        (WebCore::EventTargetNode::removedFromDocument): Ditto.
-        (WebCore::EventTargetNode::willMoveToNewOwnerDocument): Ditto.
-        (WebCore::EventTargetNode::didMoveToNewOwnerDocument): Ditto.
-        (WebCore::EventTargetNode::addEventListener): Ditto.
-        (WebCore::EventTargetNode::removeEventListener): Ditto.
-        (WebCore::EventTargetNode::removeAllEventListeners): Ditto.
-        Also added code to call setRemoved on all the listeners.
-        (WebCore::EventTargetNode::handleLocalEvents): Ditto.
-        (WebCore::EventTargetNode::dispatchGenericEvent): Fixed indentation.
-        (WebCore::EventTargetNode::removeInlineEventListenerForType): Use
-        the new event listeners vector. Also added missing call to setRemoved.
-        (WebCore::EventTargetNode::inlineEventListenerForType): Ditto.
-
-        * dom/EventTargetNode.h: Added a new RegisteredEventListenerVector
-        type and replaced the old localEventListeners function with a new
-        eventListeners function. Removed m_regdListeners.
-
+        (WebCore::Document::setFocusedNode):
         * dom/Node.cpp:
-        (WebCore::Node::childNodes): Removed unneeded std prefix.
-        (WebCore::Node::setFocus): Use function instead of going directly
-        at rare data.
-        (WebCore::Node::rareDataFocused): Ditto.
-        (WebCore::Node::registerDynamicNodeList): Removed unneeded std prefix.
-        (WebCore::Node::getElementsByName): Ditto.
-        (WebCore::Node::getElementsByClassName): Ditto.
-        (WebCore::Node::compareDocumentPosition): Ditto.
-
-        * dom/Node.h: Removed unneeded forward declaration of
-        RegisteredEventListener. This is now in EventTargetNode.
-
-        * dom/NodeRareData.h: Renamed m_focused to m_isFocused and made it
-        private. Made m_needsFocusAppearanceUpdateSoonAfterAttach private.
-        Added listeners and ensureListeners functions as well as isFocused,
-        setFocused, and focus-appearance functions. Made all data members private.
-
-        * dom/RegisteredEventListener.cpp: Removed operator ==.
-        * dom/RegisteredEventListener.h: Removed operator == and !=.
-
-        * svg/SVGElement.cpp:
-        (WebCore::hasLoadListener): Rewrote to work with the vector.
-        * svg/SVGUseElement.cpp:
-        (WebCore::SVGUseElement::transferEventListenersToShadowTree): Ditto.
+        (WebCore::Node::dispatchMouseEvent):
+        * dom/Node.h: Remove the default value for PassRefPtr<Event> args,
+        to eliminate dependency on the Event class definition
 
-2008-12-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+2009-06-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
 
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22824
+        Reviewed by Maciej Stachowiak.
 
-        Change ENABLE(FONT_FAST_PATH) to USE(FONT_FAST_PATH). With r39206
-        floatWidth always used the complex path causing a regression
-        in the pixel tests.
+        [Qt] Build fix after r45183
+        https://bugs.webkit.org/show_bug.cgi?id=26748
 
-        * platform/graphics/Font.cpp:
-        (WebCore::Font::floatWidth): Use the fast path again
+        * WebCore.pro:
 
-2008-12-13  Dirk Schulze  <krit@webkit.org>
+2009-06-25  Alexey Proskuryakov  <ap@webkit.org>
 
         Reviewed by Darin Adler.
 
-        Fixes behavior of gradients on empty path in canvas/Cg
-
-        https://bugs.webkit.org/show_bug.cgi?id=22844
-        [Cg] Canvas fill() draws gradients even without a path
+        https://bugs.webkit.org/show_bug.cgi?id=26681
+        <rdar://problem/7003461> Problem updating applicationCache when server returns 304
 
-        Test: fast/canvas/canvas-gradient-without-path.html
+        Test: http/tests/appcache/update-cache.html
 
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::fill):
-        (WebCore::CanvasRenderingContext2D::stroke):
+        * loader/appcache/ApplicationCacheGroup.cpp: (WebCore::ApplicationCacheGroup::didReceiveResponse):
+        We're already done with the resource, don't try to load it again.
 
-2008-12-13  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix.
-
-        * platform/graphics/wx/ImageSourceWx.cpp:
-        (WebCore::ImageSource::filenameExtension):
-
-2008-12-12  Brent Fulgham  <bfulgham@gmail.com>
+2009-06-25  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Oliver Hunt.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22805
-
-        Provides implementation of image dragging logic for Windows Cairo
-        back-end.
-
-        * platform/win/DragImageCGWin.cpp:
-        (WebCore::deallocContext): Add a generic CGContextRef destructor.
-        * platform/win/DragImageCairoWin.cpp:
-        (WebCore::deallocContext): Add a generic cairo_* destructor. 
-        (WebCore::allocImage):  New implementation to allocate a Cairo
-        surface of a specified size.
-        (WebCore::createCairoContextFromBitmap): New implementation to
-        create a Cairo surface from a Windows BITMAP.
-        (WebCore::scaleDragImage): Replace stub with implementation to
-        actually create a scaled image.
-        (WebCore::createDragImageFromImage): Replace stub with implementation
-        to actually create an image.
-
-2008-12-12  Dean Jackson  <dino@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Expose WebKitAnimationEvent, WebKitTransitionEvent,
-        WebKitCSSTransformValue, WebKitCSSKeyframeRule and
-        WebKitCSSKeyframesRule to Window object.
-        This required generating constructors for the event
-        interfaces.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=20560
-
-        * dom/WebKitAnimationEvent.idl:
-        * dom/WebKitTransitionEvent.idl:
-        * page/DOMWindow.idl:
-
-2008-12-12  Dave Moore  <davemoore@google.com>
-
-        Reviewed by Eric Seidel.
-
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=22798
-
-        In Font::drawTextUsingSVGFont() a variable of type SVGTextRunWalkerDrawTextData
-        is created on the stack (called data). One of its fields, charsConsumed, is
-        unitialized, leading to random values after calling walk() on the
-        SVGTextRunWalker created with it. I now initialize the variable
-
-        This bug was revealed in our Purify run. I don't know of any specific incorrect
-        behavior caused by it but it would lead to the charsConsumed field having a
-        a wrong value.
-
-        * svg/SVGFont.cpp:
-        (WebCore::Font::drawTextUsingSVGFont):
-
-2008-12-12  Beth Dakin  <bdakin@apple.com>
-
-        Rubber Stamped by Steve Falkenburg.
-
-        Build fix.
-
-        * platform/KURL.h:
-
-2008-12-12  Brett Wilson  <brettw@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Add the ability so that Google-URL can optionally be used in a build
-        of WebKit without changing the shared header. The guts of KURL are
-        optionally ifdefed out, and the replacement code goes in a different
-        header to avoid polluting KURL.h
-
-        * platform/KURL.cpp:
-        * platform/KURL.h:
-        (WebCore::KURL::string):
-        (WebCore::KURL::operator const String&):
-        (WebCore::KURL::operator JSC::UString):
-        (WebCore::KURL::operator NSString*):
-        (WebCore::KURL::parsed):
-        (WebCore::KURL::utf8String):
-        (WebCore::KURL::isNull):
-        (WebCore::KURL::isEmpty):
-        (WebCore::KURL::isValid):
-        (WebCore::KURL::hostStart):
-        (WebCore::KURL::hostEnd):
-        (WebCore::KURL::pathStart):
-        (WebCore::KURL::pathEnd):
-        (WebCore::KURL::pathAfterLastSlash):
-
-2008-12-11  Steve Falkenburg  <sfalken@apple.com>
-
-        Delete the previous timer-queue timer in the main thread, just prior to scheduling a new timer.
-        The code previously called DeleteTimerQueueTimer in the timer callback proc.
         
-        The new technique simplifies the code, since we now create and delete timers on the
-        same thread, and don't access the timer queue or timer handles in the callback.
-        This allows us to remove some mutex use, and more importantly, it solves a race
-        condition that was occuring between ChangeTimerQueueTimer and DeleteTimerQueueTimer.
+        <rdar://problem/6990481>
         
-        Since the timer callback isn't passed the timer handle, we were retrieving that handle
-        via a global. If the timer callback code was entered, but then a new timer was immediately
-        scheduled (prior to the callback acquiring the mutex and calling DeleteTimerQueueTimer),
-        there was a small window where the timer could be re-scheduled via ChangeTimerQueueTimer
-        and then immediately deleted once the already running callback acquired the mutex and
-        then called DeleteTimerQueueTimer. This resulted in the newly scheduled timer never firing.
-        
-        Reviewed by Oliver Hunt.
+        Handle perspective computation on non-layer objects.
 
-        * platform/win/SharedTimerWin.cpp:
-        (WebCore::queueTimerProc): Don't delete the timer in the callback.
-        (WebCore::setSharedTimerFireTime): Always delete and create the timer instead of using ChangeTimerQueueTimer.
-        (WebCore::stopSharedTimer): Call DeleteTimerQueueTimer directly.
+        Test: transforms/3d/general/perspective-non-layer.html
 
-2008-12-12  Kai Brüning  <kai@granus.net>
-
-        Reviewed and tweaked by Darin Adler.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=18205
-          DOMNode objects are garbage collected although there are strong references
-          <rdar://problem/6441200>
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::getTransformFromContainer):
 
-        Fixes resurrection bug for wrapper objects by using an NSMapTable with zeroing weak
-        memory for the wrapper reference for DOMWrapperCache (DOMInternal.mm),
-        JSWrapperCache (WebScriptObject.mm) and wrapperCache (DOMRGBColor.mm).
-        BUILDING_ON_TIGER is used to create a Leopard-only NSMapTable or an old-style
-        procedural map table for Tiger systems.
+2009-06-25  Pierre d'Herbemont  <pdherbemont@apple.com>
 
-        No regression tests yet since we don't currently run any tests in GC mode.
+        Reviewed by Eric Seidel.
 
-        * bindings/objc/DOMInternal.h: added WebCore::createWrapperCache for use by all three caches
-        * bindings/objc/DOMInternal.mm:
-        (WebCore::createWrapperCache): Contains the compile-time check for map table creation
-        (WebCore::getDOMWrapper): HashMap -> NSMapTable
-        (WebCore::addDOMWrapper): ditto
-        (WebCore::removeDOMWrapper): ditto
-        * bindings/objc/DOMObject.mm: removed [DOMObject finalize]
-        * bindings/objc/DOMRGBColor.mm: removed [DOMRGBColor finalize]
-        (WebCore::getWrapperForRGB): CFMutableDictionaryRef -> NSMapTable
-        (WebCore::setWrapperForRGB): ditto
-        (WebCore::removeWrapperForRGB): ditto
-        * bindings/objc/WebScriptObject.mm:
-        (WebCore::getJSWrapper): HashMap -> NSMapTable
-        (WebCore::addJSWrapper): ditto
-        (WebCore::removeJSWrapper): ditto
-        (-[WebScriptObject finalize]): removed call of removeJSWrapper()
+        https://bugs.webkit.org/show_bug.cgi?id=26653
 
-2008-12-12  Dimitri Glazkov  <dglazkov@chromium.org>
+        Use flex box in the mediaControls.css style, to nicely scale if a button gets
+        dynamically added or removed.
 
-        Reviewed by Alexey Proskuryakov.
+        Media tests results are affected by this changes.
 
-        https://bugs.webkit.org/show_bug.cgi?id=22813
-        Remove unused references to JSDOMBinding, CallFrame, and JSLock.
+        * css/mediaControls.css:
+        * css/mediaControlsQT.css:
 
-        * dom/Node.cpp: Removed CallFrame and JSLock header includes.
-        * loader/FrameLoader.cpp: Removed JSDOMBinding header include.
+2009-06-25  Albert J. Wong  <ajwong@chromium.org>
 
-2008-12-12  Holger Hans Peter Freyther  <zecke@selfish.org>
+        Reviewed by Darin Fisher.
 
-        Reviewed by Simon Hausmann.
+        https://bugs.webkit.org/show_bug.cgi?id=26724
 
-        Update the WebKit.qrc and add a script to automatically generate the file.
+        Move relavent part of setDefaultFontSize from RenderThemeChromiumWin
+        up into RenderThemeChromiumSkia.
 
-        With the way rcc and qmake work this can not be done at build time
-        as the WebKit.qrc must sit inside the directory that contains the files
-        and at build time we may not change the content of the source directory.
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::setDefaultFontSize):
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::setDefaultFontSize):
+        * rendering/RenderThemeChromiumWin.h:
 
-        * inspector/front-end/WebKit.qrc: Updated with new script
+2009-06-25  Matt Perry  <mpcomplete@chromium.org>
 
-2008-12-12  Oliver Hunt  <oliver@apple.com>
+        Reviewed by Darin Fisher.
 
-        Reviewed by Alexey Proskuryakov.
+        https://bugs.webkit.org/show_bug.cgi?id=26733
 
-        REGRESSION: Canvas is broken in high dpi mode
-        <rdar://problem/6432739> <https://bugs.webkit.org/show_bug.cgi?id=22823>
+        Add V8-only methods to FrameLoaderClient that V8 can use to send
+        out notifications when it creates/destroys a script context.
 
-        Simply made sure that we correctly scale the graphics context to
-        account for the difference between logical and buffer resolution.
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::didCreateScriptContext):
+        (WebCore::EmptyFrameLoaderClient::didDestroyScriptContext):
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::didCreateScriptContext):
+        (WebCore::FrameLoaderClient::didDestroyScriptContext):
 
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::createImageBuffer):
-        (WebCore::HTMLCanvasElement::baseTransform):
+2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
 
-2008-12-12  Tor Arne Vestbø  <tavestbo@trolltech.com>
+        Reviewed by David Levin.
 
-        Rubber-stamped by Oliver Hunt.
+        Correct a few typos that snuck in when I was reformatting CodeGeneratorV8.pm
+        to match WebKit style.
 
-        Share PluginView::paintMissingPluginIcon() between ports
+        * bindings/scripts/CodeGeneratorV8.pm: Corrected lots of typos.
 
-        Also, enable this feature for Qt/X11, Qt/Mac and GTK
+2009-06-25  Adam Langley  <agl@google.com>
 
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::paintMissingPluginIcon):
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::paint):
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::paint):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::paint):
-        * plugins/win/PluginViewWin.cpp:
+        TBRed: fix for Chromium tree.
 
-2008-12-12  Tor Arne Vestbø  <tavestbo@trolltech.com>
+        Add missing include for r45199.
 
-        Reviewed by Simon Hausmann.
+        https://bugs.webkit.org/show_bug.cgi?id=26736
 
-        [Qt/Mac] Implement PluginView::updatePluginWidget()
+        r45199 added a reference to throwError without including V8Proxy.h
 
-        We should update the window and clip rect regardless of whether or
-        not the plugin has been loaded, for example to ensure that the
-        missing plugin image is placed correctly.
+        * bindings/v8/WorkerScriptController.cpp:
 
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::setNPWindowIfNeeded):
-        (WebCore::PluginView::updatePluginWidget):
+2009-06-25  Adam Langley  <agl@google.com>
 
-2008-12-12  Tor Arne Vestbø  <tavestbo@trolltech.com>
+        TBRed: fix for Chromium tree.
 
-        Rubber-stamped by Oliver Hunt.
+        https://bugs.webkit.org/show_bug.cgi?id=26735
 
-        Make PluginView::updatePluginWidget() non-const
+        Fix V8IsolatedWorld to point to the correct include file.
 
-        We can do this now since frameRectsChanged() is no longer const. This
-        also allows us to get rid of the mutables in the PluginView.
+        The deprecated v8_index.h was removed from the Chromium tree in r19291
+        and upstreamed into WebKit with r45193. However V8IsolatedWorld
+        slipped in between the cracks and broke the build.
 
-        * platform/qt/TemporaryLinkStubs.cpp:
-        (PluginView::updatePluginWidget):
-        * plugins/PluginView.h:
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        * plugins/wx/PluginViewWx.cpp:
-        (WebCore::PluginView::updatePluginWidget):
+        * bindings/v8/V8IsolatedWorld.h: update with new header location.
 
-2008-12-12  Tor Arne Vestbø  <tavestbo@trolltech.com>
+2009-06-25  Chris Marrin  <cmarrin@apple.com>
 
-        Reviewed by Simon Hausmann.
+        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
 
-        Implement ImageSource::filenameExtension() for the Qt port
+        https://bugs.webkit.org/show_bug.cgi?id=26651
         
-        We're using QImageReader::imageFormat().toLower() to check
-        that the image format is supported, and if it is we store
-        the resulting extension when creating the ImageDecoderQt.
-
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        (WebCore::ImageDecoderQt::create):
-        (WebCore::ImageDecoderQt::ImageDecoderQt):
-        (WebCore::ImageDecoderQt::imageFormat):
-        * platform/graphics/qt/ImageDecoderQt.h:
-        * platform/graphics/qt/ImageSourceQt.cpp:
-        (WebCore::ImageSource::setData):
-        (WebCore::ImageSource::filenameExtension):
-
-2008-12-11  Stephanie Lewis  <slewis@apple.com>
-
-        Reviewed by Geoff Garen
-
-        Account for the size of the response and request headers as well as other overhead
-        when calculating the size a resource takes up in the cache.  Halts unbounded 
-        growth in the cache.  Reduced stress test memory high water marks by > 50%.
-
-        Uses estimates gathered from the stress test to set the overhead size.  
-        A version of the patch was created that calculated most of the sizes, but it was 
-        decided that the patch was still at a basic level an estimate.  What gains it made
-        in accuracy was offset by the complexity involved in creating and updating the
-        estimate.
-
-        * loader/Cache.cpp:
-        (WebCore::Cache::resourceAccessed):
-        (WebCore::Cache::TypeStatistic::addResource):
-        (WebCore::Cache::dumpLRULists):
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::overheadSize):
-        * loader/CachedResource.h:
-        (WebCore::CachedResource::size):
-
-2008-12-11  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Holger Freyther.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22814
-
-        Add <wml> image element support. Based on HTML/SVGImage{Element/Loader}, with
-        the only difference that WML defines a second source attribute 'localsrc', that
-        takes precedence over the 'src' attribute. If loading the 'localsrc' attribute
-        fails, the user agent should try loading the 'src' attribute. If both fail the
-        'alt' fallback content will be used - just like in HTML.
-
-        Fixes: fast/wml/img-localsrc.wml (<img> and 'localsrc' attribute)
-               fast/wml/img-src-localsrc-alt.wml ('localsrc'/'src' fallback handling)
-               fast/wml/img-src.wml (<img> and 'src' attribute)
-
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * rendering/HitTestResult.cpp:
-        (WebCore::HitTestResult::altDisplayString):
-        (WebCore::HitTestResult::absoluteImageURL):
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::updateAltText):
-        * wml/WMLImageElement.cpp: Added.
-        (WebCore::WMLImageElement::WMLImageElement):
-        (WebCore::WMLImageElement::~WMLImageElement):
-        (WebCore::WMLImageElement::mapToEntry):
-        (WebCore::WMLImageElement::parseMappedAttribute):
-        (WebCore::WMLImageElement::attach):
-        (WebCore::WMLImageElement::createRenderer):
-        (WebCore::WMLImageElement::insertedIntoDocument):
-        (WebCore::WMLImageElement::isURLAttribute):
-        (WebCore::WMLImageElement::imageSourceAttributeName):
-        (WebCore::WMLImageElement::altText):
-        * wml/WMLImageElement.h: Added.
-        (WebCore::WMLImageElement::useFallbackAttribute):
-        (WebCore::WMLImageElement::setUseFallbackAttribute):
-        * wml/WMLImageLoader.cpp: Added.
-        (WebCore::WMLImageLoader::WMLImageLoader):
-        (WebCore::WMLImageLoader::~WMLImageLoader):
-        (WebCore::WMLImageLoader::dispatchLoadEvent):
-        (WebCore::WMLImageLoader::sourceURI):
-        (WebCore::WMLImageLoader::notifyFinished):
-        * wml/WMLImageLoader.h: Added.
-        * wml/WMLTagNames.in:
-
-2008-12-11  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22043
-
-        Do not run into the WebCore::DocumentLoader::updateLoading
-        ASSERT on Gtk+/CURL when trying to load tests from our LayoutTests.
+        Preference is named "WebKitAcceleratedCompositingEnabled"
+        and is a boolean value. When false, prevents compositing layers from
+        being created, which prevents hardware animation from running.
+        Also forces video to do software rendering. Added a cache for
+        the flag in RenderLayerCompositing and made it all work
+        on-the-fly when the flag is changed while a page is loaded.
 
-        Do not call setPrimaryLoadComplete when the
-        activeDocumentLoader has already been replaced. This can happen
-        when a script executed from within FramerLoader::didFinishLoading will
-        navigate to another URL.
-
-        The assertion is caused by existing tests (e.g.
-        fast/history/clicked-link-is-visited.html) reproducing this with
-        network backends not equal to curl is tough or maybe not
-        even possible.
-
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::setPrimaryLoadComplete):
-
-2008-12-11  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Eric Seidel.
-
-        - Remove some dead, commented-out code from WMLAElement.
-        - Add missing virtual destructor for <noop>, as suggested by Alexey.
-        - Refactor addHTMLAlignment in a static helper function to share with WML.
-
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::addHTMLAlignment):
-        (WebCore::HTMLElement::addHTMLAlignmentToStyledElement):
-        * html/HTMLElement.h:
-        * wml/WMLAElement.cpp:
-        (WebCore::WMLAElement::defaultEventHandler):
-        * wml/WMLNoopElement.cpp:
-        (WebCore::WMLNoopElement::~WMLNoopElement):
-        * wml/WMLNoopElement.h:
-
-2008-12-10  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        <rdar://problem/6302405> Crash (null-deref) when using :before pseudoselector with content CSS rule in SVG
-        <https://bugs.webkit.org/show_bug.cgi?id=22804>
-
-        This issue was caused by css generated content resulting in non-svg flowboxes
-        being injected into SVG content.  As SVG spec does not describe behaviour in
-        this case, and neither Opera nor Firefox displays such generated content, so
-        now we make svg text layout and rendering just ignore any such content.
-
-        Test: svg/css/crash-css-generated-content.xhtml
-
-        * rendering/SVGRootInlineBox.cpp:
-        (WebCore::SVGRootInlineBox::buildLayoutInformation):
-        (WebCore::SVGRootInlineBox::layoutInlineBoxes):
-        (WebCore::SVGRootInlineBox::buildTextChunks):
-
-2008-12-11  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Bug 21256: REGRESSION (r36906): horizontally repeating image leaves ghosts when vertical scrolling
-        <https://bugs.webkit.org/show_bug.cgi?id=21256>
-        <rdar://problem/6362978>
-
-        The ScrollView refactoring in r36906 caused the ScrollView and the
-        platform widget to disagree about whether optimizing scrolling via
-        blitting is allowed. The easiest way to fix this is to make ScrollView
-        simply ask the platform widget whether this is safe on platforms that
-        are affected.
-
-        It is not possible to write a layout test for this bug because it
-        involves the back/forward cache.
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::ScrollView):
-        (WebCore::ScrollView::setCanBlitOnScroll):
-        (WebCore::ScrollView::canBlitOnScroll):
-        (WebCore::ScrollView::platformSetCanBlitOnScroll):
-        (WebCore::ScrollView::platformCanBlitOnScroll):
-        * platform/ScrollView.h:
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::platformSetCanBlitOnScroll):
-        (WebCore::ScrollView::platformCanBlitOnScroll):
-        * platform/wx/ScrollViewWx.cpp:
-        (WebCore::ScrollView::platformSetCanBlitOnScroll):
-        (WebCore::ScrollView::platformCanBlitOnScroll):
-
-2008-12-11  Brent Fulgham  <bfulgham@gmail.com>
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateCompositingLayers):
+        * page/Settings.cpp:
+        (WebCore::setNeedsReapplyStylesInAllFrames):
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setAcceleratedCompositingEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::acceleratedCompositingEnabled):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hasAcceleratedCompositing):
+        (WebCore::RenderLayer::updateTransform):
+        (WebCore::RenderLayer::currentTransform):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateLayerTransform):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::RenderLayerCompositor):
+        (WebCore::RenderLayerCompositor::enableCompositingMode):
+        (WebCore::RenderLayerCompositor::cacheAcceleratedCompositingEnabledFlag):
+        (WebCore::RenderLayerCompositor::updateCompositingLayers):
+        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::needsToBeComposited):
+        (WebCore::RenderLayerCompositor::destroyRootPlatformLayer):
+        * rendering/RenderLayerCompositor.h:
+        (WebCore::RenderLayerCompositor::hasAcceleratedCompositing):
+        * rendering/RenderObject.h:
+        (WebCore::makeMatrixRenderable):
 
-        Reviewed by Adam Roben.
+2009-06-25  Jian Li  <jianli@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=22808
+        Reviewed by Dimitri Glazkov.
 
-        Correct build break due to malformed XML in Visual Studio project
-        following @r39205 change.
+        Bug 26701: Implement the missing code for "FIXME: Need to return an
+        exception" in WorkerScriptController::evaluate for v8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=26701
 
-        * WebCore.vcproj/WebCore.vcproj: Correct file entry so project loads.
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
 
-2008-12-10  Chris Marrin  <cmarrin@apple.com>
+2009-06-25  Nate Chapin  <japhet@chromium.org>
 
-        Reviewed by Dave Hyatt.
+        Reviewed by Dimitri Glazkov.
 
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=22738
-
-        This gets rid of the per-animation timers which were used when an animation
-        started, ended and looped. Their job is now done by the main AnimationController's
-        timer. It is now set to fire as needed. For instance, if there is a delay, it will
-        fire after the delay time and then every 30ms to run the animation. The start, loop
-        and end events are generated as needed during the firing of this timer.
-
-        I had to add one more bit of code. When animation timers used to fire the animation events.
-        This would always happen from the RunLoop, so any style changes that happened in the
-        event handler would get picked up on the next updateRendering() call. But now the start
-        event is generated during the styleIsAvailable() call, which is in the middle of the 
-        updateRendering() cycle. And calling an event handler in the middle of updateRendering()
-        is not allowed and causes style changes to get missed. We already have a mechanism in
-        AnimationController to defer updateRendering() calls. So I added logic to defer all
-        event handling to there. Now, I put any request for event handling into a list and ask
-        for a deferred updateRendering() call. When that deferred timer fires, I go through that
-        list, send all the events and then call updateRendering().
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::AnimationBase):
-        (WebCore::AnimationBase::updateStateMachine):
-        (WebCore::AnimationBase::fireAnimationEventsIfNeeded):
-        (WebCore::AnimationBase::willNeedService):
-        (WebCore::AnimationBase::goIntoEndingOrLoopingState):
-        * page/animation/AnimationBase.h:
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
-        (WebCore::AnimationControllerPrivate::updateRenderingDispatcherFired):
-        (WebCore::AnimationControllerPrivate::addEventToDispatch):
-        (WebCore::AnimationControllerPrivate::animationTimerFired):
-        (WebCore::AnimationController::addEventToDispatch):
-        * page/animation/AnimationController.h:
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimationPrivate::updateTransitions):
-        (WebCore::CompositeAnimationPrivate::willNeedService):
-        (WebCore::CompositeAnimationPrivate::getAnimationForProperty):
-        (WebCore::CompositeAnimation::willNeedService):
-        (WebCore::CompositeAnimation::getAnimationForProperty):
-        * page/animation/CompositeAnimation.h:
-        * page/animation/ImplicitAnimation.cpp:
-        (WebCore::ImplicitAnimation::animate):
-        (WebCore::ImplicitAnimation::onAnimationEnd):
-        (WebCore::ImplicitAnimation::sendTransitionEvent):
-        * page/animation/ImplicitAnimation.h:
-        * page/animation/KeyframeAnimation.cpp:
-        (WebCore::KeyframeAnimation::animate):
-        (WebCore::KeyframeAnimation::sendAnimationEvent):
-        * page/animation/KeyframeAnimation.h:
-        (WebCore::KeyframeAnimation::setUnanimatedStyle):
-
-2008-12-11  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Fix the Qt build with an empty filenameExtension() implementation.
-
-        * platform/graphics/qt/ImageSourceQt.cpp:
-        (WebCore::ImageSource::filenameExtension):
-
-2008-12-11  Holger Hans Peter Freyther  <zecke@selfish.org>
+        Upstream V8Index.
 
-        Reviewed by Simon Hausmann.
+        https://bugs.webkit.org/show_bug.cgi?id=26495
 
-        Fix crash in the cairo implementation of the SVGPaintServer
+        * bindings/v8/V8Index.cpp: Added.
+        (WebCore::V8ClassIndex::GetFactory): Moved from src.chromium.org.
+        (WebCore::V8ClassIndex::GetCache): Moved from src.chromium.org.
+        * bindings/v8/V8Index.h:
+        (WebCore::V8ClassIndex::): Moved from src.chromium.org.
+        (WebCore::V8ClassIndex::ToInt): Moved from src.chromium.org.
+        (WebCore::V8ClassIndex::FromInt): Moved from src.chromium.org.
 
-        For SVGFonts the RenderObject can be zero. The existing SVGFont
-        test cases is exposing this bug. Qt and other ports have fixed
-        this issue by adding null checks as well.
+2009-06-25  Adam Langley  <agl@google.com>
 
-        * svg/graphics/cairo/SVGPaintServerCairo.cpp:
-        (WebCore::SVGPaintServer::renderPath):
+        Reviewed by Darin Fisher.
 
-2008-12-11  Holger Freyther  <zecke@selfish.org>
+        https://bugs.webkit.org/show_bug.cgi?id=26529
 
-        Reviewed by Simon Hausmann.
+        This is hopefully the last step before our renderers can run
+        cleanly in a chroot.
 
-        https://bugs.webkit.org/show_bug.cgi?id=20953
+        WebKit needs to be able to ask for the correct font to use in
+        the case that the current font doesn't include glyphs for
+        certain code points. Currently we make a fontconfig call in our
+        WebKit port to handle this.
 
-        Make the Qt port follow the Win, Mac, Gtk+ port in regard to Font
-        handling. FontQt.cpp from now on is only implementing the complex path. Create
-        FontFallbackListQt.cpp and FontPlatformDataQt.cpp to work within
-        the framework set by the Font code.
+        This patch changes this so that the call is sent our via
+        ChromiumBridge.
 
-        Sharing the Font.cpp implementation allows the Qt port to support
-        the CSS font faces and SVG fonts.
+        http://codereview.chromium.org/132007
 
-        Split out the Qt4.3 Font handling into FonQt43.cpp to allow to more
-        easily deprecate it.
+        This should not affect any layout tests.
 
-        This commit is removing a lot of #ifdefs from Font.h as the Qt Font
-        implementation is now in line with the rest of WebCore.
+        * platform/chromium/ChromiumBridge.h:
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::getFontDataForCharacters):
 
-        * WebCore.pro:
-        * platform/graphics/Font.h: Remove #ifdefs
-        (WebCore::Font::letterSpacing):
-        (WebCore::Font::setLetterSpacing):
-        (WebCore::Font::isPlatformFont):
-        * platform/graphics/FontFallbackList.h:
-        * platform/graphics/SimpleFontData.cpp:
-        (WebCore::SimpleFontData::SimpleFontData):
-        (WebCore::SimpleFontData::platformGlyphInit): There is no GlyphCache
-        on Qt, move the initialisation over.
-        (WebCore::SimpleFontData::~SimpleFontData):
-        * platform/graphics/SimpleFontData.h:
-        (WebCore::SimpleFontData::getQtFont):
-        * platform/graphics/qt/FontCacheQt.cpp:
-        (WebCore::FontCache::getCachedFontPlatformData): Remove unused parameter
-        (WebCore::FontCache::releaseFontData): Add to build
-        * platform/graphics/qt/FontCustomPlatformData.cpp:
-        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
-        (WebCore::FontCustomPlatformData::fontPlatformData):
-        (WebCore::createFontCustomPlatformData):
-        * platform/graphics/qt/FontCustomPlatformData.h:
-        * platform/graphics/qt/FontFallbackListQt.cpp: Added.
-        (WebCore::FontFallbackList::FontFallbackList):
-        (WebCore::FontFallbackList::invalidate):
-        (WebCore::FontFallbackList::releaseFontData):
-        (WebCore::FontFallbackList::determinePitch):
-        (WebCore::FontFallbackList::fontDataAt):
-        (WebCore::FontFallbackList::fontDataForCharacters):
-        (WebCore::FontFallbackList::setPlatformFont):
-        * platform/graphics/qt/FontPlatformData.h:
-        (WebCore::FontPlatformData::font):
-        (WebCore::FontPlatformData::size):
-        * platform/graphics/qt/FontPlatformDataQt.cpp: Added.
-        (WebCore::FontPlatformData::FontPlatformData):
-        * platform/graphics/qt/FontQt.cpp:
-        (WebCore::Font::drawComplexText):
-        (WebCore::Font::floatWidthForComplexText):
-        (WebCore::Font::offsetForPositionForComplexText):
-        (WebCore::Font::selectionRectForComplexText):
-        (WebCore::Font::font):
-        * platform/graphics/qt/FontQt43.cpp: Added. Moved Qt4.3 code from FontQt.cpp
-        (WebCore::Font::drawComplexText):
-        (WebCore::Font::floatWidthForComplexText):
-        (WebCore::Font::offsetForPositionForComplexText):
-        (WebCore::Font::selectionRectForComplexText):
-        * platform/graphics/qt/GlyphPageTreeNodeQt.cpp:
-        (WebCore::GlyphPageTreeNode::pruneTreeCustomFontData):
-        (WebCore::GlyphPageTreeNode::pruneTreeFontData):
-        * platform/graphics/qt/SimpleFontDataQt.cpp:
-        (WebCore::SimpleFontData::determinePitch):
-        (WebCore::SimpleFontData::containsCharacters):
-        (WebCore::SimpleFontData::platformInit):
-        (WebCore::SimpleFontData::platformGlyphInit):
-        (WebCore::SimpleFontData::platformDestroy):
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::adjustButtonStyle): Avoid crashes.
+2009-06-25  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26566
+        Upstream these files from the chromium v8 code.  No tests were
+        affected because this is essentially a code move.
+
+        * bindings/v8/NPV8Object.cpp: Added.
+        (allocV8NPObject):
+        (freeV8NPObject):
+        (listFromVariantArgs):
+        (npIdentifierToV8Identifier):
+        (npCreateV8ScriptObject):
+        (NPN_Invoke):
+        (NPN_InvokeDefault):
+        (NPN_Evaluate):
+        (NPN_EvaluateHelper):
+        (NPN_GetProperty):
+        (NPN_SetProperty):
+        (NPN_RemoveProperty):
+        (NPN_HasProperty):
+        (NPN_HasMethod):
+        (NPN_SetException):
+        (NPN_Enumerate):
+        (NPN_Construct):
+        * bindings/v8/NPV8Object.h: Added.
+        (PrivateIdentifier::):
+        * bindings/v8/V8NPUtils.cpp: Added.
+        (convertV8ObjectToNPVariant):
+        (convertNPVariantToV8Object):
+        (getStringIdentifier):
+        * bindings/v8/V8NPUtils.h: Added.
+
+2009-06-25  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26436
+
+        Windows Chromium bug fix: save context of destination canvas in
+        TransparencyWin::compositeTextComposite() before the function
+        modifies the context.
+
+        Test: fast/canvas/translate-text.html
+
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::compositeTextComposite):
+
+2009-06-25  Patrick Mueller  <Patrick_Mueller@us.ibm.com>
 
-2008-12-11  Holger Freyther  <zecke@selfish.org>
+        Reviewed by Timothy Hatcher.
 
-        Reviewed by Simon Hausmann.
+        Show the filename and first line for "(program)" in the Profiler/Debugger
+        https://bugs.webkit.org/show_bug.cgi?id=25475
 
-        https://bugs.webkit.org/show_bug.cgi?id=20953
+        Add support to associate a sourceURL with an eval()'d string
+        via a @sourceURL comment.  Currently the sourceURL is only available
+        in the script debugger, not in the console or profiler, but it's
+        most needed in the script debugger.
 
-        For Qt it is not pratical to have a FontCache and GlyphPageTreeNode
-        implementation. This is one of the reasons why the Qt port is currently not
-        using WebCore/platform/graphics/Font.cpp. By allowing to not use
-        the simple/fast-path the Qt port will be able to use it.
+        * English.lproj/localizedStrings.js: added new "(program): %s" string
+        * inspector/front-end/Script.js:
+        (WebInspector.Script): if no sourceURL is available for the Script,
+        search for a comment of the form //@ sourceURL=(url) to use
+        as the sourceURL instead.
+        * manual-tests/inspector/named-evals.html: Added.
 
-        Introduce USE(FONT_FAST_PATH) and define it for every port but the
-        Qt one.
+2009-06-25  John Gregg  <johnnyg@google.com>
 
-        * platform/graphics/Font.cpp:
-        (WebCore::Font::drawText):
-        (WebCore::Font::floatWidth):
-        (WebCore::Font::selectionRectForText):
-        (WebCore::Font::offsetForPosition):
-        * platform/graphics/Font.h:
+        Reviewed by Sam Weinig.
 
-2008-12-11  Holger Hans Peter Freyther  <zecke@selfish.org>
+        Bug 23721: Changing dropdown's selectedIndex within onchange handler fires another onchange
+        https://bugs.webkit.org/show_bug.cgi?id=23721
+
+        onchange events fire when a SELECT element has
+        focus and the selectedIndex is updated by script in some way--either
+        during another onchange, onkeypress, onfocus, or timer--and then
+        focus is lost. 
+
+        Fixed by making a separate method for user-driven selectedIndex 
+        changes, leaving scripts to use one which doesn't cause onchange to
+        be queued.
+        
+        Test: fast/forms/select-script-onchange.html
+
+        * dom/SelectElement.cpp: check if the pending change is user driven
+        before calling onchange
+        (WebCore::SelectElement::menuListOnChange):
+        (WebCore::SelectElement::setSelectedIndex):
+        * dom/SelectElement.h: store whether the pending change is user driven
+        (WebCore::SelectElementData::userDrivenChange):
+        (WebCore::SelectElementData::setUserDrivenChange):
+        * html/HTMLSelectElement.cpp: split into two methods -- script version
+        [non-user-driven] corresponds to IDL defined property name
+        (WebCore::HTMLSelectElement::setSelectedIndex):
+        (WebCore::HTMLSelectElement::setSelectedIndexByUser):
+        * html/HTMLSelectElement.h: 
+        * rendering/RenderMenuList.cpp: use ByUser method when coming through
+        the renderer
+        (WebCore::RenderMenuList::valueChanged):
 
-        Reviewed by Darin Adler.
+2009-06-25  Jeremy Orlow  <jorlow@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=20953
+        Reviewed by Darin Fisher.
 
-        Split out the font fast path from Fast.cpp into FontFastPath.cpp. This
-        will allow the Qt port to share most of WebCore::Font
-        implementation but the fast path. Qt does not provide the API to get
-        individual Glyphs making the fast path hard to support.
+        https://bugs.webkit.org/show_bug.cgi?id=26698
 
+        Combined LocalStorageArea and SessionStorageArea into StorageArea since
+        (after my other refactorings) there are no longer substantial
+        differences between the two.
 
         * GNUmakefile.am:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
         * WebCoreSources.bkl:
-        * platform/graphics/Font.cpp:
-        * platform/graphics/FontFastPath.cpp: Added.
-        (WebCore::Font::glyphDataForCharacter):
-
-2008-12-11  Robert Carr  <racarr@svn.gnome.org>
-
-        Reviewed by Holger Freyther.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22560
-
-        Code in PlatformScreenGtk for screenDepth and screenRect can not
-        assume that the platformWindow for the widget has a valid "window"
-        member. For example in the case of, a new browser view opening as a
-        child of a GtkNotebook, but never being switched to, or manually
-        realized. Solve by using the toplevel window of the widget, rather
-        than the widget itself.
-
-        * platform/gtk/PlatformScreenGtk.cpp:
-        (WebCore::screenDepth):
-        (WebCore::screenRect):
-
-2008-12-08  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Darin Adler and Holger Freyther.
-
-        Make Widget::frameRectsChanged() and overrides non-const
-
-        This will hopefully allow us to get rid of some of the mutables in
-        the classes that react to the callback by changing their own state.
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::frameRectsChanged):
-        * platform/ScrollView.h:
-        * platform/Widget.h:
-        (WebCore::Widget::frameRectsChanged):
-        * platform/gtk/ScrollbarGtk.cpp: Remove non-const version since
-        this was more complex and did the same thing, changed const of
-        the leftover frameRectsChanged() method.
-        (ScrollbarGtk::frameRectsChanged):
-        * platform/gtk/ScrollbarGtk.h:
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::frameRectsChanged):
-        * plugins/PluginView.h:
-
-2008-12-11  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed and implemented with Tor Arne Vestbø.
-
-        Reimplement RenderTheme::caretBlinkInterval for Qt.
-
-        The QApplication::cursorFlashTime is in milliseconds and describes
-        the whole cycle while WebCore expects half a cycle.
-
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::caretBlinkInterval):
-        * platform/qt/RenderThemeQt.h:
-
-2008-12-09  Trenton Schulz <trenton.schulz@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        [Qt/Mac] Don't call HIGetScaleFactor() if we're not on Tiger or better
-
-        * plugins/mac/PluginViewMac.cpp:
-        (WebCore::tigerOrBetter):
-        (WebCore::PluginView::globalMousePosForPlugin):
-
-2008-12-10  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Eric Seidel and George Staikos.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22799
-
-        Add WML <template> support. The <template> element is specified at deck-level
-        and declares a template for all <card> elements in the document.
-
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * editing/htmlediting.cpp:
-        (WebCore::canHaveChildrenForEditing): Treat <do> just like a <button>.
-        * wml/WMLCardElement.cpp:
-        (WebCore::WMLCardElement::WMLCardElement):
-        (WebCore::WMLCardElement::setTemplateElement):
-        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded):
-        (WebCore::WMLCardElement::handleDeckLevelTaskOverridesIfNeeded):
-        * wml/WMLCardElement.h:
-        (WebCore::WMLCardElement::templateElement):
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::insertedIntoDocument):
-        * wml/WMLDocument.cpp:
-        (WebCore::WMLDocument::finishedParsing):
-        * wml/WMLErrorHandling.cpp:
-        (WebCore::errorMessageForErrorCode):
-        * wml/WMLErrorHandling.h:
-        (WebCore::):
-        * wml/WMLEventHandlingElement.cpp:
-        (WebCore::WMLEventHandlingElement::~WMLEventHandlingElement):
-        * wml/WMLEventHandlingElement.h:
-        (WebCore::WMLEventHandlingElement::doElements):
-        * wml/WMLTagNames.in:
-        * wml/WMLTemplateElement.cpp: Added.
-        (WebCore::WMLTemplateElement::WMLTemplateElement):
-        (WebCore::WMLTemplateElement::~WMLTemplateElement):
-        (WebCore::WMLTemplateElement::parseMappedAttribute):
-        (WebCore::WMLTemplateElement::registerTemplatesInDocument):
-        * wml/WMLTemplateElement.h: Added.
-        * wml/WMLTimerElement.cpp:
-        (WebCore::WMLTimerElement::timerFired):
-
-2008-12-09  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Fix memory leak - need to call stopActiveDOMObjects
-        when cached pages get destroyed.
-        https://bugs.webkit.org/show_bug.cgi?id=22753
-
-        * dom/Document.cpp:
-        (WebCore::Document::detach):
-
-2008-12-10  Alice Liu  <alice.liu@apple.com>
-
-        Manual test for https://bugs.webkit.org/show_bug.cgi?id=20685
-
-        Reviewed by Darin Adler.
-
-        * manual-tests/drag-image-to-desktop.html: Added.
-
-2008-12-10  Alice Liu  <alice.liu@apple.com>
-
-        fixed https://bugs.webkit.org/show_bug.cgi?id=20685
-
-        Reviewed by Darin Adler.
-
-        Manual test case is manual-tests/drag-image-to-desktop.html
-
-        Added new files to projects
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-
-        * page/DragController.cpp:
-        (WebCore::DragController::startDrag):
-        * platform/MIMETypeRegistry.cpp:
-        (WebCore::initializeSupportedImageMIMETypes):
-        (WebCore::initializeSupportedImageMIMETypesForEncoding):
-
-        These changes add a method to obtain the extension for an image
-        * platform/graphics/BitmapImage.cpp:
-        (WebCore::BitmapImage::filenameExtension):
-        * platform/graphics/BitmapImage.h:
-        * platform/graphics/Image.h:
-        (WebCore::Image::filenameExtension):
-        * platform/graphics/ImageSource.h:
-        * platform/graphics/cairo/ImageSourceCairo.cpp:
-        (WebCore::ImageSource::filenameExtension):
-        * platform/graphics/cg/ImageSourceCG.cpp:
-        (WebCore::ImageSource::filenameExtension):
-
-        These changes added a utility that returns the preferred extension for a UTI
-        * platform/graphics/cg/ImageSourceCG.h: Added.
-        * platform/graphics/cg/ImageSourceCGMac.mm: Added.
-        (WebCore::MIMETypeForImageSourceType):
-        (WebCore::preferredExtensionForImageSourceType):
-        * platform/graphics/cg/ImageSourceCGWin.cpp: Added.
-        (WebCore::MIMETypeForImageSourceType):
-        (WebCore::preferredExtensionForImageSourceType):
-
-        * platform/mac/MIMETypeRegistryMac.mm:
-        moved getMIMETypeForUTI to ImageSourceCGMac.mm
-
-        Ask image for its file extension instead of relying on MIME type and file path
-        * platform/win/ClipboardWin.cpp:
-        (WebCore::createGlobalImageFileDescriptor):
-
-        Remove extraneous code from getPreferredExtensionForMIMEType.
-        Also moved getMIMETypeForUTI to ImageSourceCGWin.cpp
-        * platform/win/MIMETypeRegistryWin.cpp:
-        (WebCore::MIMETypeRegistry::getPreferredExtensionForMIMEType):
-
-2008-12-10  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Antti Koivisto
-
-        <rdar://problem/6431224>
-        
-        When updating the value of a slider, don't mark the parents
-        as needing layout, because the size of the slider can never
-        change. This fixes full-page repaints in some cases.
-
-        * rendering/RenderSlider.cpp:
-        (WebCore::RenderSlider::updateFromElement):
-
-2008-12-10  Simon Fraser  <simon.fraser@apple.com>
-
-        Potential build fix. The forward declaration of FloatPoint should
-        be inside the WebCore namespace.
-        
-        * platform/graphics/FloatPoint3D.h:
-
-2008-12-10  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22793
-
-        Cleanup FloatPoint3D: inline the getters and setters,
-        fix a potential divide-by-zero in normalize(), and add
-        a FloatPoint constructor.
-        
-        * platform/graphics/FloatPoint3D.cpp:
-        (WebCore::FloatPoint3D::FloatPoint3D):
-        (WebCore::FloatPoint3D::normalize):
-        * platform/graphics/FloatPoint3D.h:
-        (WebCore::FloatPoint3D::x):
-        (WebCore::FloatPoint3D::setX):
-        (WebCore::FloatPoint3D::y):
-        (WebCore::FloatPoint3D::setY):
-        (WebCore::FloatPoint3D::z):
-        (WebCore::FloatPoint3D::setZ):
-
-2008-12-09  Julien Chaffraix  <jchaffraix@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Bug 22665: Remove setCreatedByParser(bool) from the few elements that use it
-        https://bugs.webkit.org/show_bug.cgi?id=22665
-
-        - Removed setCreatedByParser from style and link elements.
-
-        - Removed XMLTokenizer::eventuallyMarkAsCreatedByParser.
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::storageArea):
+        * storage/LocalStorage.h:
+        * storage/LocalStorageArea.cpp: Removed.
+        * storage/LocalStorageArea.h: Removed.
+        * storage/SessionStorage.cpp:
+        (WebCore::SessionStorage::copy):
+        (WebCore::SessionStorage::storageArea):
+        * storage/SessionStorage.h:
+        * storage/SessionStorageArea.cpp: Removed.
+        * storage/SessionStorageArea.h: Removed.
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::createLocalStorage):
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::createSessionStorage):
+        (WebCore::StorageArea::copy):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        (WebCore::StorageArea::scheduleFinalSync):
+        (WebCore::StorageArea::blockUntilImportComplete):
+        (WebCore::StorageArea::dispatchStorageEvent):
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::syncTimerFired):
+        (WebCore::StorageAreaSync::performImport):
+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.h:
+
+2009-06-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=26671
+          <rdar://problem/7001880> Safari 4.0 crashes in
+          WebCore::DOMTimer::fired()
+
+        Test: fast/dom/style-sheet-candidate-remove-unrendered-document.html
+
+        When a "style sheet candidate" element is removed from a document,
+        call Document::removeStyleSheetCandidateNode() regardless of whether
+        the document is rendered. Otherwise, the document's style sheet
+        candidate set can end up containing stale references.
 
-        * dom/XMLTokenizer.cpp:
-        * dom/XMLTokenizer.h:
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::startElementNs):
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::parseStartElement):
-        * html/HTMLElementFactory.cpp:
-        (WebCore::linkConstructor):
-        (WebCore::styleConstructor):
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::removedFromDocument):
         * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::HTMLLinkElement):
-        * html/HTMLLinkElement.h:
+        (WebCore::HTMLLinkElement::removedFromDocument):
         * html/HTMLStyleElement.cpp:
-        (WebCore::HTMLStyleElement::HTMLStyleElement):
-        * html/HTMLStyleElement.h:
-        * html/HTMLTagNames.in:
-        * svg/SVGStyleElement.cpp:
-        (WebCore::SVGStyleElement::SVGStyleElement):
-        * svg/SVGStyleElement.h:
-        * svg/svgtags.in:
-
-2008-12-10  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Darin
-
-        https://bugs.webkit.org/show_bug.cgi?id=22194 and <rdar://problem/6388378> -
-        Dialog when going back to a page from whence you submitted a form
-
-        http://trac.webkit.org/changeset/37317 changed the manner in which headers are added to
-        http requests, which caused the networking layer to have an incomplete set of headers
-        just before consulting the Policy Delegate.  This caused a cache miss and incorrectly made
-        us believe we'd be resubmitting the form.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadItem):  Being careful to maintain the new behavior required by
-          the Origin header mechanism as discussed in bug 22194, restore the previous behavior of
-          setting all the headers before the networking layer is asked about the cache lookup.
-
-2008-12-10  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Add back ability to end all profiling via console by invoking profileEnd
-        with no arguments.
-
-        * page/Console.cpp:
-        (WebCore::Console::profileEnd): Removed title null-checking and
-            subsequent early exit.
-
-2008-12-10  Pierre-Olivier Latour  <pol@apple.com>
-
-        Reviewed by Darin Adler.
-
-        KeyframeAnimation::animate() needs to compute the elapsed animation time
-        properly taking into account its paused state.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22773
-
-        Test: animations/animation-drt-api-multiple-keyframes.html
-
-        * page/animation/KeyframeAnimation.cpp:
-        (WebCore::KeyframeAnimation::animate):
-
-2008-12-10  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein
+        (WebCore::HTMLStyleElement::removedFromDocument):
 
-        Part of
-        https://bugs.webkit.org/show_bug.cgi?id=22570
-        
-        Rename methods on RenderLayer for clarity:
-            clearClipRects -> clearClipRectsIncludingDescendants
-            clearClipRect  -> clearClipRects
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::destroy):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateLayerPosition):
-        (WebCore::RenderLayer::removeOnlyThisLayer):
-        (WebCore::RenderLayer::insertOnlyThisLayer):
-        (WebCore::RenderLayer::clearClipRectsIncludingDescendants):
-        (WebCore::RenderLayer::clearClipRects):
-        * rendering/RenderLayer.h:
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::styleWillChange):
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::destroy):
-
-2008-12-10  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix after the script call stack/frame additions.
-        
-        * WebCoreSources.bkl:
-
-2008-12-10   Srinivasa Rao M. Hamse  <msrinirao@gmail.com>
+2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
 
-        Reviewed by Holger Freyther.
-
-        F1-F12 key mappings for WebKit Gtk Port
-
-        * platform/gtk/KeyEventGtk.cpp:
-        (WebCore::windowsKeyCodeForKeyEvent):
+        Reviewed by Darin Fisher.
 
-2008-12-10  Enrico Ros  <enrico.ros@m31.com>
+        Update CodeGeneratorV8.pm to sync up with the changes downstream.
 
-        Reviewed by Simon Hausmann.
-
-        Fix the Qt build when SVG is disabled. A broken dependancy caused
-        unnecessary rebuilds even with no changes.
+        * bindings/scripts/CodeGeneratorV8.pm: Added HTMLFrameSetElement check,
+          FileList as a ref-counted type, and DataGridColumn as typeCanFailConversion.
 
-        * WebCore.pro: fix a broken build dependancy
+2009-06-25  Dimitri Glazkov  <dglazkov@chromium.org>
 
-2008-12-10  Hironori Bono  <hbono@chromium.org>
+        Unreviewed, build fix.
 
-        Reviewed by Alexey Proskuryakov.
+        Add FileList.h include to fix Chromium build.
 
-        Bug 21820: Unable to enter the Tamil UNICODE Characters via Thamizha Phonetic IME
-        https://bugs.webkit.org/show_bug.cgi?id=21820
+        * platform/chromium/ClipboardChromium.cpp: Added FileList.h include.
 
-        <rdar://problem/5683248> Typing backspace to delete a diacritical mark also deletes the character before (Arabic)
-        <rdar://problem/5702038> Backspace removes Thai Character in wrong sequence
+2009-06-25  Joseph Pecoraro  <joepeck02@gmail.com>
 
-        Tests: editing/deleting/delete-ligature-001.html
-               editing/deleting/delete-ligature-002.html
-               editing/deleting/delete-ligature-003.html
+        Reviewed by Jan Alonzo.
 
-        * editing/TypingCommand.cpp:
-        (WebCore::TypingCommand::deleteKeyPressed): Delete only the last character
-        of a ligature which consists of multiple Unicode characters when deleting it with
-        a backspace key.
-
-2008-12-10  David Levin  <levin@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22177
-        Fix the windows build by removing calls to notifyFormStateChanged
-        where they didn't appear in the original reviewed patch.
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::type):
-        (WebCore::HTMLInputElement::attach):
+        Bug 26489: Web Inspector: Typo in DatabaseQuery Error Message
+        https://bugs.webkit.org/show_bug.cgi?id=26489
 
-2008-12-09  Adam Barth  <abarth@webkit.org>
+        Fixed a Typo in a Web Inspector error message.
 
-        Reviewed by Sam Weinig.
-
-        Add ScriptController::updateSecurityOrigin to notify the bindings
-        that a document's securityOrigin has been updated.  This is used by
-        V8 to update its security context.
-
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::updateSecurityOrigin):
-        * bindings/js/ScriptController.h:
-        * dom/Document.cpp:
-        (WebCore::Document::setDomain):
-
-2008-12-09  Eric Seidel  <eric@webkit.org>
-
-        No review, build fix only.
-
-        Fix a few config issues to let the Chromium Windows WebCore build get further.
-
-        * WebCore.scons:
-
-2008-12-09  Brett Wilson  <brettw@chromium.org>
-
-        Reviewed by Dave Hyatt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22177
-
-        Add a callback on ChromeClient that the state of form elements on
-        the page has changed. This is to allow clients implementing session
-        saving to know when the current state is dirty.
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::notifyFormStateChanged):
-        (WebCore::HTMLInputElement::setInputType):
-        (WebCore::HTMLInputElement::type):
-        (WebCore::HTMLInputElement::attach):
-        (WebCore::HTMLInputElement::setValue):
-        (WebCore::HTMLInputElement::setValueFromRenderer):
-        (WebCore::HTMLInputElement::setFileListFromRenderer):
-        * html/HTMLSelectElement.cpp:
-        (WebCore::HTMLSelectElement::setSelectedIndex):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::notifyFormStateChanged):
-        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
-        (WebCore::HTMLTextAreaElement::updateValue):
-        (WebCore::HTMLTextAreaElement::setValue):
-        * loader/EmptyClients.h:
-        (WebCore::EmptyChromeClient::formStateDidChange):
-        * page/ChromeClient.h:
-
-2008-12-09  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=19762
-
-        Fix intermittent crash in buildbot. The CSSCursorImageValues and
-        SVGCursorElements held onto raw SVGElement pointers without any
-        guarantee that the element is still around.
-
-        We did not fix the design that resulted in this issue, we just fixed
-        the pointer lifetimes.
-
-        * css/CSSCursorImageValue.cpp:
-        (WebCore::CSSCursorImageValue::~CSSCursorImageValue): Zero out the back pointers.
-        (WebCore::CSSCursorImageValue::updateIfSVGCursorIsUsed): Set up a back pointer.
-        (WebCore::CSSCursorImageValue::removeReferencedElement): Added. Used when the element
-        is destroyed.
-        * css/CSSCursorImageValue.h: Added removeReferencedElement.
-
-        * svg/SVGCursorElement.cpp:
-        (WebCore::SVGCursorElement::~SVGCursorElement): Zero out the back pointers.
-        (WebCore::SVGCursorElement::addClient): Set up a back pointer.
-        (WebCore::SVGCursorElement::removeClient): Zero out the back pointer.
-
-        * svg/SVGElement.cpp:
-        (WebCore::SVGElement::SVGElement): Initialize back pointers to zero.
-        (WebCore::SVGElement::~SVGElement): Call both the element and cursor image value
-        to remove the element from their sets.
-        * svg/SVGElement.h:
-        (WebCore::SVGElement::setCursorElement): Added.
-        (WebCore::SVGElement::setCursorImageValue): Added.
-
-2008-12-09  David Hyatt  <hyatt@apple.com>
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView.prototype._queryError):
 
-        Add code that will create custom CSS scrollbars from the <body>, the document element (<html>) and the owning
-        frame/iframe.  If any of them set a custom style, it will be used.  The scrollbars do not update dynamically
-        yet as you switch from page to page (until they are destroyed and recreated).
+2009-06-25  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        Reviewed by Adele
+        Fix the Qt build, add missing StorageAreaSync files to the build.
 
-        * page/FrameView.cpp:
-        (WebCore::FrameView::createScrollbar):
+        * WebCore.pro:
 
-2008-12-09  Ojan Vafai  <ojan@chromium.org>
+2009-06-25  Simon Hausmann  <simon.hausmann@nokia.com>
 
-        Reviewed by Dave Hyatt.
+        Reviewed by and done with Tor Arne Vestbø.
 
-        https://bugs.webkit.org/show_bug.cgi?id=22689
-        Match Firefox button metrics on Windows.
+        Fix shortcut keyboard handling with plugins on the Qt/Mac build.
 
-        * rendering/RenderButton.cpp:
-        (WebCore::RenderButton::addChild):
-        (WebCore::RenderButton::styleDidChange):
-        (WebCore::RenderButton::setupInnerStyle):
-        * rendering/RenderButton.h:
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::adjustButtonInnerStyle):
-        * rendering/RenderTheme.h:
-        * rendering/RenderThemeWin.cpp:
-        (WebCore::RenderThemeWin::adjustSliderThumbSize):
-        (WebCore::RenderThemeWin::adjustButtonInnerStyle):
-        * rendering/RenderThemeWin.h:
+        When we receive shortcut events like Ctrl+V then the text in the QKeyEvent is
+        empty. If we're asked to disambiguate the event into a Char keyboard event,
+        we try to detect this situation and still set the text, to ensure that the
+        general event handling sends a key press event after this disambiguation.
 
-2008-12-09  Darin Fisher  <darin@chromium.org>
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
 
-        Fixes bustages.
+2009-06-25  Eric Seidel  <eric@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=22631
-        Adding missing files from previous commit.
+        Build fix only, no review.
 
-        * bindings/js/ScriptCallFrame.cpp: Added.
-        (WebCore::ScriptCallFrame::ScriptCallFrame):
-        (WebCore::ScriptCallFrame::~ScriptCallFrame):
-        (WebCore::ScriptCallFrame::argumentAt):
-        * bindings/js/ScriptCallFrame.h: Added.
-        (WebCore::ScriptCallFrame::functionName):
-        (WebCore::ScriptCallFrame::sourceURL):
-        (WebCore::ScriptCallFrame::lineNumber):
-        (WebCore::ScriptCallFrame::argumentCount):
-        * bindings/js/ScriptCallStack.cpp: Added.
-        (WebCore::ScriptCallStack::ScriptCallStack):
-        (WebCore::ScriptCallStack::~ScriptCallStack):
-        (WebCore::ScriptCallStack::at):
-        (WebCore::ScriptCallStack::size):
-        (WebCore::ScriptCallStack::initialize):
-        * bindings/js/ScriptCallStack.h: Added.
-        (WebCore::ScriptCallStack::state):
+        Add FileList.h and NotImplemented.h includes in an attempt to fix bots.
 
-2008-12-09  Dimitri Glazkov  <dglazkov@chromium.org>
+        * platform/gtk/ClipboardGtk.cpp:
+        * platform/qt/ClipboardQt.cpp:
+        * platform/win/ClipboardWin.cpp:
+        * platform/wx/ClipboardWx.cpp:
 
-        Reviewed by Timothy Hatcher.
+2009-05-21  Eric Seidel  <eric@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=22631
-        Streamline Console.cpp, abstract out the use of JSC::ExecState and
-        JSC::ArgList by introducing ScriptCallFrame and ScriptCallStack
-        abstractions.
-
-        * GNUmakefile.am: Added ScriptCallFrame and ScriptCallStack to build
-        * WebCore.pro:  Added ScriptCallFrame and ScriptCallStack to build
-        * WebCore.vcproj/WebCore.vcproj: Added ScriptCallFrame and
-        ScriptCallStack to project
-        * WebCore.xcodeproj/project.pbxproj: Added ScriptCallFrame and
-        ScriptCallStack to project
-        * bindings/js/JSConsoleCustom.cpp: Remove custom bindings.
-        * bindings/js/ScriptCallFrame.cpp: Added.
-        (WebCore::ScriptCallFrame::ScriptCallFrame):
-        (WebCore::ScriptCallFrame::~ScriptCallFrame):
-        (WebCore::ScriptCallFrame::argumentAt):
-        * bindings/js/ScriptCallFrame.h: Added.
-        (WebCore::ScriptCallFrame::functionName):
-        (WebCore::ScriptCallFrame::sourceURL):
-        (WebCore::ScriptCallFrame::lineNumber):
-        (WebCore::ScriptCallFrame::argumentCount):
-        * bindings/js/ScriptCallStack.cpp: Added.
-        (WebCore::ScriptCallStack::ScriptCallStack):
-        (WebCore::ScriptCallStack::~ScriptCallStack):
-        (WebCore::ScriptCallStack::at):
-        (WebCore::ScriptCallStack::size):
-        (WebCore::ScriptCallStack::initialize):
-        * bindings/js/ScriptCallStack.h: Added.
-        (WebCore::ScriptCallStack::ScriptCallStack):
-        (WebCore::ScriptCallStack::~ScriptCallStack):
-        (WebCore::ScriptCallStack::state):
-        (WebCore::ScriptCallStack::at):
-        (WebCore::ScriptCallStack::size):
-        (WebCore::ScriptCallStack::initialize):
-        * bindings/js/ScriptString.h: Added missing PlatformString include.
-        (WebCore::ScriptString::ScriptString): Added default constructor.
-        (WebCore::ScriptString::operator==): Added equality operator.
-        (WebCore::ScriptString::operator!=):
-        * bindings/js/ScriptValue.cpp: Added isNull and isUndefined.
-        (WebCore::ScriptValue::isNull):
-        (WebCore::ScriptValue::isUndefined):
-        * bindings/js/ScriptValue.h: Added isNull and isUndefined
-        * bindings/scripts/CodeGeneratorJS.pm: Add handling for
-        CustomArgumentHandling attribute.
-        * inspector/InspectorController.cpp: Refactored to use 
-        ScriptCallFrame and ScriptCallStack.
-        (WebCore::ConsoleMessage::ConsoleMessage):
-        (WebCore::InspectorController::addMessageToConsole):
-        (WebCore::InspectorController::startGroup):
-        (WebCore::InspectorController::addScriptConsoleMessage):
-        (WebCore::InspectorController::count):
-        (WebCore::InspectorController::startTiming):
-        (WebCore::InspectorController::stopTiming):
-        * inspector/InspectorController.h: Refactored to use ScriptCallFrame and
-        ScriptCallStack.
-        * inspector/front-end/Console.js: Modified to use argument value itself
-        rather than f.name for stack trace.
-        * page/Console.cpp: Refactored to use ScriptCallFrame and
-        ScriptCallStack.
-        (WebCore::getFirstArgumentAsString):
-        (WebCore::Console::addMessage):
-        (WebCore::Console::debug):
-        (WebCore::Console::error):
-        (WebCore::Console::info):
-        (WebCore::Console::log):
-        (WebCore::Console::dir):
-        (WebCore::Console::dirxml):
-        (WebCore::Console::trace):
-        (WebCore::Console::assertCondition):
-        (WebCore::Console::count):
-        (WebCore::Console::profile):
-        (WebCore::Console::profileEnd):
-        (WebCore::Console::time):
-        (WebCore::Console::timeEnd):
-        (WebCore::Console::group):
-        (WebCore::Console::warn):
-        * page/Console.h:
-        * page/Console.idl: Removed Custom attributes, added
-        CustomArgumentHandling attributes, and tweaked argument defs.
+        Reviewed by Maciej Stachowiak.
 
-2008-12-09  Darin Adler  <darin@apple.com>
+        Expose files in the clipboard in ondrop events
+        https://bugs.webkit.org/show_bug.cgi?id=25916
 
-        Try to fix non-Mac builds.
+        Make it possible for applications like gmail to implement
+        drag and drop of attachments onto email messages.
 
-        * GNUmakefile.am: Added NavigatorBase.
-        * WebCore.pro: Ditto.
-        * WebCore.scons: Ditto.
-        * WebCore.vcproj/WebCore.vcproj: Ditto.
-        * WebCoreSources.bkl: Ditto.
+        This patch exposes an event.dataTransfer.files accessor
+        on the drop event.  No information is exposed during dragover.
+        This follows the HTML 5 drag and drop security model:
+        http://www.w3.org/TR/html5/editing.html#security-risks-in-the-drag-and-drop-model
+        The test http/tests/security/clipboard/clipboard-file-access.html
+        verifies this behavior.
 
-        Unrelated tweak sitting in my tree.
+        Internet Explorer shows historical documentation of supporting
+        getData('File') as a way of exposing files on the pasteboard.  The current version of their docs:
+        http://msdn.microsoft.com/en-us/library/ms537658(VS.85).aspx
+        has removed this reference (as far as I can tell IE never implemented it)
+        I have a printed copy of that URL from 2008 on my desk describing getData('File') in IE.
+        IE does not follow the HTML5 clipboard security model and always allows access to the full clipboard, even on dragover.
 
-        * bindings/objc/DOMAbstractView.mm: Remove pointless override of finalize method.
+        I choose not to use IE's getData('File') and instead added .files
+        so that the accessor could have a type, matching WebKit's existing
+        .files accessor on HTMLInputElement.
 
-2008-12-09  Darin Adler  <darin@apple.com>
+        Mozilla has equivalent file access:
+        event.dataTransfer.mozGetDataAt("application/x-moz-file", 0);
+        which also does not return a typed value.
+        https://developer.mozilla.org/En/DragDrop/Recommended_Drag_Types#Dragging_Files
 
-        Try to fix Tiger build.
+        This is only implemented for Mac WebKit.  All other platforms (including Apple's Win WebKit)
+        have incomplete Clipboard implementations and will require experts from those platforms
+        to add this functionality.  Right now they all have Clipboard*::files() methods which call notImplemented();
 
-        * platform/network/mac/NetworkStateNotifierMac.cpp: Declare CFRunLoopGetMain.
+        Test: http/tests/security/clipboard/clipboard-file-access.html
 
-2008-12-09  Alexey Proskuryakov  <ap@webkit.org>
+        * dom/Clipboard.h:
+        * dom/Clipboard.idl:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::files):
+        * platform/chromium/ClipboardChromium.h:
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::files):
+        * platform/gtk/ClipboardGtk.h:
+        * platform/mac/ClipboardMac.h:
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::absoluteURLsFromPasteboardFilenames):
+        (WebCore::absoluteURLsFromPasteboard):
+        (WebCore::ClipboardMac::files):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::files):
+        * platform/qt/ClipboardQt.h:
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::files):
+        * platform/win/ClipboardWin.h:
+        * platform/wx/ClipboardWx.cpp:
+        (WebCore::ClipboardWx::files):
+        * platform/wx/ClipboardWx.h:
+
+2009-06-25  Eric Seidel  <eric@webkit.org>
+
+        No review, only completing revert of r45144.
+
+        Add back files deleted by r45144.
+
+        * storage/LocalStorageArea.cpp: Added.
+        (WebCore::LocalStorageArea::create):
+        (WebCore::LocalStorageArea::LocalStorageArea):
+        (WebCore::LocalStorageArea::scheduleFinalSync):
+        (WebCore::LocalStorageArea::itemChanged):
+        (WebCore::LocalStorageArea::itemRemoved):
+        (WebCore::LocalStorageArea::areaCleared):
+        (WebCore::LocalStorageArea::blockUntilImportComplete):
+        (WebCore::LocalStorageArea::dispatchStorageEvent):
+        * storage/LocalStorageArea.h: Added.
+        * storage/SessionStorageArea.cpp: Added.
+        (WebCore::SessionStorageArea::copy):
+        (WebCore::SessionStorageArea::SessionStorageArea):
+        (WebCore::SessionStorageArea::itemChanged):
+        (WebCore::SessionStorageArea::itemRemoved):
+        (WebCore::SessionStorageArea::areaCleared):
+        (WebCore::SessionStorageArea::blockUntilImportComplete):
+        (WebCore::SessionStorageArea::dispatchStorageEvent):
+        * storage/SessionStorageArea.h: Added.
+        (WebCore::SessionStorageArea::create):
 
-        Reviewed by Darin Adler.
+2009-06-25  Eric Seidel  <eric@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=22719
-        Implement Navigator object in Workers
+        No review, reverting r45144 only.
 
-        Test: fast/workers/worker-navigator.html
+        Roll out r45144 after 18 test failures appeared on the bots.
+        https://bugs.webkit.org/show_bug.cgi?id=26698
 
-        * DerivedSources.make:
         * GNUmakefile.am:
-        * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        Added WorkerNavigator sources.
-
-        * bindings/js/JSWorkerContext.cpp: (WebCore::jsWorkerContextNavigator):
-        Worker.navigator returns a WoerkerNavigator object (it is named just Navigator in the spec,
-        but it is not the same interface that is available on Windows).
-
-        * dom/Worker.cpp:
-        (WebCore::Worker::notifyFinished):
-        * dom/WorkerContext.cpp:
-        (WebCore::WorkerContext::WorkerContext):
-        (WebCore::WorkerContext::navigator):
-        * dom/WorkerContext.h:
-        (WebCore::WorkerContext::create):
-        * dom/WorkerThread.cpp:
-        (WebCore::WorkerThread::create):
-        (WebCore::WorkerThread::WorkerThread):
-        (WebCore::WorkerThread::workerThread):
-        * dom/WorkerThread.h:
-        Pass a pre-computed user agent string into worker, because it cannot call a client method
-        directly, and pre-computing is easier than sending a synchronous message to the main thread.
-
-        * page/Navigator.cpp:
-        * page/Navigator.h:
-        * page/NavigatorBase.cpp: Added.
-        * page/NavigatorBase.h: Added.
-        Factor out common (and uncommon, but very similar) functionality into a base class.
-
-        * page/WorkerNavigator.cpp: Added.
-        * page/WorkerNavigator.h: Added.
-        * page/WorkerNavigator.idl: Added.
-        Per Web Workers and HTML5, implement a small subset of what we currently have in Window.Navigator.
-
-        * platform/network/NetworkStateNotifier.cpp: (WebCore::networkStateNotifier):
-        Make networkStateNotifier() static constructor thread safe. The object is created on the
-        thread it is first called from, while callbacks are registered on the main thread. Calls to
-        onLine() from other threads are safe, because it is just loading a boolean.
-
-        * platform/network/mac/NetworkStateNotifierMac.cpp: (WebCore::NetworkStateNotifier::NetworkStateNotifier):
-        Schedule notifications on main event loop, not the current one.
-
-2008-12-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Rubber-stamped by Alexey Proskuryakov.
-
-        Forgot to update Qt/WML build - add some new files to the build.
-
-        * WebCore.pro:
-
-2008-12-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22637
-
-        Implement the GET method for WMLGoElement, and some test covering it's behaviour.
-        Update all build systems supporting WML that haven't been updated since a while.
-
-        Add WMLPostField stub implementation, needed for implementing POST method.
-
-        Tests: wml/go-task-get-method-external-deck-with-href.html
-               wml/go-task-get-method-external-deck.html
-               wml/go-task-get-method-same-deck.html
+        * WebCoreSources.bkl:
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::storageArea):
+        * storage/LocalStorage.h:
+        * storage/SessionStorage.cpp:
+        (WebCore::SessionStorage::copy):
+        (WebCore::SessionStorage::storageArea):
+        * storage/SessionStorage.h:
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::~StorageArea):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::syncTimerFired):
+        (WebCore::StorageAreaSync::performImport):
+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.h:
+
+2009-06-24  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26698
+
+        Combined LocalStorageArea and SessionStorageArea into StorageArea since
+        (after my other refactorings) there are no longer substantial
+        differences between the two.
 
         * GNUmakefile.am:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * dom/Document.cpp:
-        (WebCore::Document::resetWMLPageState):
-        * wml/WMLCardElement.cpp:
-        * wml/WMLCardElement.h:
-        * wml/WMLEventHandlingElement.cpp:
-        (WebCore::WMLCardElement::registerDoElement):
-        * wml/WMLEventHandlingElement.h:
-        * wml/WMLGoElement.cpp:
-        (WebCore::WMLGoElement::WMLGoElement):
-        (WebCore::WMLGoElement::registerPostfieldElement):
-        (WebCore::WMLGoElement::parseMappedAttribute):
-        (WebCore::WMLGoElement::executeTask):
-        (WebCore::WMLGoElement::parseContentType):
-        (WebCore::WMLGoElement::preparePOSTRequest):
-        (WebCore::WMLGoElement::prepareGETRequest):
-        * wml/WMLGoElement.h:
-        * wml/WMLPostfieldElement.cpp: Added.
-        (WebCore::WMLPostfieldElement::WMLPostfieldElement):
-        (WebCore::WMLPostfieldElement::parseMappedAttribute):
-        (WebCore::WMLPostfieldElement::insertedIntoDocument):
-        * wml/WMLPostfieldElement.h: Added.
-        (WebCore::WMLPostfieldElement::name):
-        (WebCore::WMLPostfieldElement::value):
-        * wml/WMLTagNames.in:
-
-2008-12-08  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Anders Carlsson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=16814
-        Allow ports to disable ActiveX->NPAPI conversion for Media Player.
-        Improve handling of miscellaneous ActiveX objects.
-
-        * rendering/RenderPartObject.cpp:
-        (WebCore::mapClassIdToServiceType):
-        (WebCore::shouldUseChildEmbedOfObject):
-        (WebCore::RenderPartObject::updateWidget):
-
-2008-12-08  Darin Adler  <darin@apple.com>
-
-        Reviewed by John Sullivan.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=22409
-          REGRESSION: cmd-shift-left/right don't switch tabs, instead select text
-
-        Tests: editing/execCommand/enabling-and-selection-2.html
-               editing/execCommand/enabling-and-selection.html
-
-        * editing/EditorCommand.cpp: Updated table to use these functions by their new names.
-        (WebCore::enabledVisibleSelection): Renamed this to reflect its new algorithm.
-        An invisible selection with a position that selects no characters doesn't count
-        as a visible selection.
-        (WebCore::enabledVisibleSelectionAndMark): Ditto.
-
-2008-12-08  David Kilzer  <ddkilzer@apple.com>
-
-        Remove duplicate entries from WebCore project.
-
-        Reviewed by Eric Seidel.
-
-        Bug 22555: Sort "children" sections in Xcode project files.
-        <https://bugs.webkit.org/show_bug.cgi?id=22555>
-
-        Recipe for removing duplicates:
-        $ ./WebKitTools/Scripts/sort-Xcode-project-file project.pbxproj
-        $ uniq < project.pbxproj | diff -u project.pbxproj - | patch -p0 project.pbxproj
-
-        * WebCore.xcodeproj/project.pbxproj: Removed duplicates.
-
-2008-12-08  Julien Chaffraix  <jchaffraix@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Bug 22665: Remove setCreatedByParser(bool) from the few elements that use it
-        https://bugs.webkit.org/show_bug.cgi?id=22665
-
-        Remove setCreatedByParser from the script elements (HTML and SVG).
-
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::eventuallyMarkAsParserCreated): Removed
-        call to setCreatedByParser for the 2 elements.
-
-        * dom/make_names.pl: Modified to call the constructor with
-        the createByParser parameter if 'constructorNeedsCreatedByParser'
-        is set.
-
-        * html/HTMLElementFactory.cpp:
-        (WebCore::scriptConstructor):
-        * html/HTMLScriptElement.cpp:
-        (WebCore::HTMLScriptElement::HTMLScriptElement):
-        * html/HTMLScriptElement.h:
-        * html/HTMLTagNames.in: Added constructorNeedsCreatedByParser
-        to script.
-        * svg/SVGScriptElement.cpp:
-        (WebCore::SVGScriptElement::SVGScriptElement):
-        * svg/SVGScriptElement.h:
-        * svg/svgtags.in: Added constructorNeedsCreatedByParser
-        to script.
-
-2008-12-08  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 22555: Sort "children" sections in Xcode project files
-
-        <https://bugs.webkit.org/show_bug.cgi?id=22555>
-
-        Reviewed by Eric Seidel.
-
-        * WebCore.xcodeproj/project.pbxproj: Sorted.
-        * manual-tests/NPN_Invoke/NPN_Invoke.xcodeproj/project.pbxproj: Sorted.
-
-2008-12-08  Tony Chang  <tony@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Add a bool to GraphicsContext so that shadows can ignore
-        transformations.  This is needed by HTML canvas element
-        where the spec says shadows are applied w/o transformations.
-        https://bugs.webkit.org/show_bug.cgi?id=22580
-
-        No functional changes, thus no tests.
-
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::setShadow):
-        (WebCore::CanvasRenderingContext2D::applyShadow):
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::createImageBuffer):
-        * platform/graphics/GraphicsContext.cpp:
-        (WebCore::GraphicsContext::setShadowsIgnoreTransforms):
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/GraphicsContextPrivate.h:
-        (WebCore::GraphicsContextState::GraphicsContextState):
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::GraphicsContext::setPlatformShadow):
-
-2008-12-08  Julien Chaffraix  <jchaffraix@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Bug 17897: Not Rendering Images Imported from XHTML Document
-        <rdar://problem/5827614>
-
-        When we were loading document with XMLHttpRequest that contained images, the images
-        would not be fetched as they would not be displayed. However if we inserted such
-        an image element into a rendered document, we would not fetch the image and thus never
-        display it.
-
-        Now we check if the image has been loaded when we insert an HTMLImageElement into a
-        document.
-        To enable this, the image loader has an error flag. To avoid doing several attempts
-        when we know that the image is in error, we store the failed URL.
-        However Firefox and Opera ignore errors when the 'src' attribute changes and thus
-        we also have an updateFromElementIgnoringPreviousError to match the other browser.
-
-        Tests: http/tests/misc/image-blocked-src-change.html
-               http/tests/misc/image-blocked-src-no-change.html
-               http/tests/xmlhttprequest/xmlhttprequest-image-not-loaded-svg.svg
-               http/tests/xmlhttprequest/xmlhttprequest-image-not-loaded.html
-
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::HTMLEmbedElement::parseMappedAttribute): Changed to call updateFromElementIgnoringPreviousError.
-        * html/HTMLImageElement.cpp:
-        (WebCore::HTMLImageElement::parseMappedAttribute): Ditto.
-        (WebCore::HTMLImageElement::insertedIntoDocument): Call updateFromElement if we do not have
-        an image.
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::parseMappedAttribute): Changed to call updateFromElementIgnoringPreviousError.
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::parseMappedAttribute): Ditto.
-        * html/HTMLVideoElement.cpp:
-        (WebCore::HTMLVideoElement::parseMappedAttribute): Ditto.
-        * loader/ImageLoader.cpp:
-        (WebCore::ImageLoader::setImage): Added an assertion.
-        (WebCore::ImageLoader::updateFromElement): Added a check for load error (to avoid displaying
-        multiple errors in the console for a single image load).
+        * WebCoreSources.bkl:
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::storageArea):
+        * storage/LocalStorage.h:
+        * storage/LocalStorageArea.cpp: Removed.
+        * storage/LocalStorageArea.h: Removed.
+        * storage/SessionStorage.cpp:
+        (WebCore::SessionStorage::copy):
+        (WebCore::SessionStorage::storageArea):
+        * storage/SessionStorage.h:
+        * storage/SessionStorageArea.cpp: Removed.
+        * storage/SessionStorageArea.h: Removed.
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::createLocalStorage):
+        (WebCore::StorageArea::StorageArea):
+        (WebCore::StorageArea::createSessionStorage):
+        (WebCore::StorageArea::copy):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        (WebCore::StorageArea::scheduleFinalSync):
+        (WebCore::StorageArea::blockUntilImportComplete):
+        (WebCore::StorageArea::dispatchStorageEvent):
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp:
+        (WebCore::StorageAreaSync::StorageAreaSync):
+        (WebCore::StorageAreaSync::scheduleFinalSync):
+        (WebCore::StorageAreaSync::syncTimerFired):
+        (WebCore::StorageAreaSync::performImport):
+        * storage/StorageAreaSync.h:
+        * storage/StorageSyncManager.h:
+
+2009-06-24  Dan Bernstein  <mitz@apple.com>
 
-        (WebCore::ImageLoader::updateFromElementIgnoringPreviousError): This method clears previous error
-        before calling updateFromElement.
+        Reviewed by Simon Fraser.
 
-        (WebCore::ImageLoader::notifyFinished): Added an assertion.
-        * loader/ImageLoader.h:
-        * svg/SVGImageElement.cpp:
-        (WebCore::SVGImageElement::svgAttributeChanged): Changed to call updateFromElementIgnoringPreviousError.
+        - fix <rdar://problem/7001817> REGRESSION (r41902): Base position track
+          at UCSC Genome Browser doesn't work because image map prevents img
+          from hit-testing
 
-2008-12-08  David Hyatt  <hyatt@apple.com>
+        Test: fast/replaced/image-map-2.html
 
-        Make scrollbar creation virtual on ScrollView so that FrameView can have the capability to create
-        custom CSS scrollbars.
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::nodeAtPoint): Do not reset 'inside' to false if
+        the image map failed the hit test.
 
-        Reviewed by Eric Seidel
+2009-06-22  Adam Barth  <abarth@webkit.org>
 
-        * page/FrameView.cpp:
-        (WebCore::FrameView::createScrollbar):
-        * page/FrameView.h:
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::setHasHorizontalScrollbar):
-        (WebCore::ScrollView::setHasVerticalScrollbar):
-        (WebCore::ScrollView::createScrollbar):
-        * platform/ScrollView.h:
+        Reviewed by Dimitri Glazkov.
 
-2008-12-08  Dan Bernstein  <mitz@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=26366
 
-        Reviewed by John Sullivan.
+        Refactor V8DOMMap to support isolated worlds.
 
-        - WebCore part of tracking the global history item for a WebView
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::checkLoadCompleteForThisFrame): Set the page's
-        global history item to the current back/forward list item, respecting
-        private browsing mode.
-        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy): Ditto in this
-        case.
-        (WebCore::FrameLoader::goToItem): Ditto in this case.
-        (WebCore::FrameLoader::updateHistoryForStandardLoad): If this load
-        creates a new global history item, set the page's global history item
-        to it.
-        (WebCore::FrameLoader::updateHistoryForRedirectWithLockedHistory):
-        Ditto.
-        * page/Page.cpp:
-        (WebCore::Page::setGlobalHistoryItem): Added this setter.
-        * page/Page.h: Added a m_globalHistoryItem data member.
-        (WebCore::Page::globalHistoryItem): Added this getter.
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInNewWorld):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::DOMDataStore::InternalDOMWrapperMap::InternalDOMWrapperMap):
+        (WebCore::DOMDataStore::allStores):
+        (WebCore::DOMDataStore::allStoresMutex):
+        (WebCore::DOMDataStore::domData):
+        (WebCore::ScopedDOMDataStore::ScopedDOMDataStore):
+        (WebCore::ScopedDOMDataStore::~ScopedDOMDataStore):
+        (WebCore::StaticDOMDataStore::StaticDOMDataStore):
+        (WebCore::):
+        (WebCore::MainThreadDOMData::MainThreadDOMData):
+        (WebCore::MainThreadDOMData::getStore):
+        (WebCore::ChildThreadDOMData::ChildThreadDOMData):
+        (WebCore::ChildThreadDOMData::getStore):
+        (WebCore::DOMDataStore::DOMDataStore):
+        (WebCore::DOMDataStore::~DOMDataStore):
+        (WebCore::DOMDataStoreHandle::DOMDataStoreHandle):
+        (WebCore::DOMDataStoreHandle::~DOMDataStoreHandle):
+        (WebCore::::forget):
+        (WebCore::getDOMNodeMap):
+        (WebCore::getDOMObjectMap):
+        (WebCore::getActiveDOMObjectMap):
+        (WebCore::getDOMSVGElementInstanceMap):
+        (WebCore::getDOMSVGObjectWithContextMap):
+        (WebCore::DOMData::getCurrent):
+        (WebCore::DOMData::handleWeakObject):
+        (WebCore::DOMData::ensureDeref):
+        (WebCore::weakDOMObjectCallback):
+        (WebCore::weakActiveDOMObjectCallback):
+        (WebCore::weakNodeCallback):
+        (WebCore::weakSVGElementInstanceCallback):
+        (WebCore::weakSVGObjectWithContextCallback):
+        (WebCore::DOMData::derefObject):
+        (WebCore::DOMData::derefDelayedObjects):
+        (WebCore::DOMData::derefDelayedObjectsInCurrentThread):
+        (WebCore::DOMData::removeObjectsFromWrapperMap):
+        (WebCore::removeAllDOMObjectsInCurrentThreadHelper):
+        (WebCore::visitDOMNodesInCurrentThread):
+        (WebCore::visitDOMObjectsInCurrentThread):
+        (WebCore::visitActiveDOMObjectsInCurrentThread):
+        (WebCore::visitDOMSVGElementInstancesInCurrentThread):
+        (WebCore::visitSVGObjectsInCurrentThread):
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::DOMDataStoreHandle::getStore):
+        * bindings/v8/V8IsolatedWorld.cpp: Added.
+        (WebCore::getIsolatedWorldKey):
+        (WebCore::contextWeakReferenceCallback):
+        (WebCore::V8IsolatedWorld::evaluate):
+        (WebCore::V8IsolatedWorld::V8IsolatedWorld):
+        (WebCore::V8IsolatedWorld::~V8IsolatedWorld):
+        (WebCore::V8IsolatedWorld::getEntered):
+        * bindings/v8/V8IsolatedWorld.h: Added.
+        (WebCore::V8IsolatedWorld::getDOMDataStore):
+
+2009-06-24  Mikhail Naganov  <mnaganov@chromium.org>
 
-2008-12-08  Antti Koivisto  <antti@apple.com>
+        Reviewed by Timothy Hatcher.
 
-        Reviewed by Dave Kilzer.
+        Bug 26604: Search doesn't work in Web Inspector Profiler
+        https://bugs.webkit.org/show_bug.cgi?id=26604
 
-        A few stylistic fixes suggested by Dave Kilzer.
+        Seems like search was damaged in revision 42808.
 
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::createIdentifier):
-        (WebCore::CSSPrimitiveValue::create):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView.prototype.refresh):
+        Here and in other functions: nodes we're searching in are profile data grid
+        nodes, so there is no more need for '_dataGridNode' references.
+        (WebInspector.ProfileView.prototype.searchCanceled):
+        (WebInspector.ProfileView.prototype.performSearch.matchesQuery):
+        Fixed accidental semicolon that caused 'matchesQuery' always return true.
+        (WebInspector.ProfileView.prototype.performSearch):
+        To perform search correctly in the case of bottom up tree, we need to populate
+        the tree, because there's no 1-to-1 correspondence between profile nodes and
+        data grid nodes in this case.
+        (WebInspector.ProfileView.prototype._jumpToSearchResult):
 
-2008-12-08  Alexey Proskuryakov  <ap@webkit.org>
+2009-06-24  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Darin Adler.
+        
+        <rdar://problem/6450239&6574516>
+    
+        Fix flashing issues caused by compositing layers rendering content before
+        a deferred layout has happened. Because the -viewWillDraw machinery doesn't
+        work for composited layers, we need to use scheduleViewUpdate() to queue
+        up a layout via the run loop observer in WebKit, whenever we know we
+        are going to be painting soon.
 
-        https://bugs.webkit.org/show_bug.cgi?id=22737
-        Try debug version when locating CFNetwork
-
-        * platform/network/cf/ResourceRequestCFNet.cpp:
-        (WebCore::findCFNetworkModule):
-        (WebCore::findCFURLRequestSetContentDispositionEncodingFallbackArrayFunction):
-        (WebCore::findCFURLRequestCopyContentDispositionEncodingFallbackArrayFunction):
-        * platform/network/win/CookieJarCFNetWin.cpp:
-        (WebCore::findCFNetworkModule):
-        (WebCore::findIsHTTPOnlyFunction):
-
-2008-12-08  Aaron Boodman  <aa@chromium.org>
-
-        Reviewed by Stephanie Lewis.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22301
-        Make dispatchDidFinishLoading() always fire before didFinishLoadForFrame().
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::finishedParsing):
-
-2008-12-08  Trenton Schulz <trenton.schulz@nokia.com>
-
-        Rubber-stamped by Tor Arne Vestbø.
-
-        Fix build warning on Mac
-
-        * platform/text/mac/StringImplMac.mm:
-
-2008-12-08  Simon Hausmann  <simon.hausmann@nokia.com>
-
-        Fix the Qt build.
-
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::convertQVariantToValue): Pass JSGlobalData to RegExp
-          constructor.
-
-2008-12-08  Oliver Hunt  <oliver@apple.com>
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::setContentsNeedDisplay):
+        (WebCore::RenderLayerBacking::setContentsNeedDisplayInRect):
 
-        Reviewed by Alexey Proskuryakov.
+2009-06-24  David Levin  <levin@chromium.org>
 
-        Bug 22398: r39059: Crash when clearing webkitTransitionDuration in webkitTransitionEnd event handler
-        <rdar://problem/6426245> REGRESSION(r39059): Reproducible crash when clearing webkitTransitionDuration in webkitTransitionEnd event handler (22398)
+        Fix all builds.
 
-        This regression was caused by r39059 replacing the protector on the active
-        animation with a protector on just the composition.  It turns out that both
-        protectors are necessary.
+        * ForwardingHeaders/wtf/FastAllocBase.h: Added.
 
-        Test: transitions/transition-duration-cleared-in-transitionend-crash.html
+2009-06-24  Jeremy Orlow  <jorlow@chromium.org>
 
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::animationTimerCallbackFired):
+        Reviewed by Darin Fisher.
 
-2008-12-08  Dmitry Titov  <dimich@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=26658
 
-        Reviewed by Alexey Proskuryakov.
+        Split the syncing portions of LocalStorageArea into StorageAreaSync.
+        This name will make more sense in the next patch (in this set) when
+        LocalStorageArea and SessionStorageArea are merged to become simply
+        StorageArea.  (Thus the synching portion of StorageArea is in
+        StorageAreaSync.)
 
-        https://bugs.webkit.org/show_bug.cgi?id=22732
-        Remove unused files PausedTimeouts.h,.cpp
-        The change that deprecated this code was https://bugs.webkit.org/show_bug.cgi?id=22620
+        This looks like a big patch, but really all it's doing is splitting
+        code and patching split-related things up.
 
         * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.scons:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
         * WebCoreSources.bkl:
-          These are build files which had PausedTimeouts referenced.
-
-        * bindings/js/PausedTimeouts.cpp: Removed.
-        * bindings/js/PausedTimeouts.h: Removed.
-        * bindings/js/ScriptController.cpp: Removed '#include'
-        * page/Chrome.cpp: Removed '#include' and unused variable.
-
-2008-12-07  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein
-
-        https://bugs.webkit.org/show_bug.cgi?id=22594
-
-        Fix issues which break reading inline style for -webkit-transition
-        and -webkit-transform-origin.
-        
-        Test: fast/css/transform-inline-style.html
-
-        * css/CSSMutableStyleDeclaration.cpp:
-        (WebCore::CSSMutableStyleDeclaration::getPropertyValue): Add cases 
-        for CSSPropertyWebkitTransformOrigin and CSSPropertyWebkitTransition
-        so that these shorthand properties are returned correctly.
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseAnimationProperty): Create CSSPrimitiveValues
-        with the correct CSSValueAll and CSSValueNone identifiers, not the
-        RenderStyle-level cAnimateAll, cAnimateNone.
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::mapAnimationProperty): Special-case CSSValueAll
-        and CSSValueNone values to set cAnimateAll and cAnimateNone transition properties.
-
-2008-12-07  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22717
-        Make CSS values use less memory
-        
-        Share CSSPrimitiveValue objects for commonly used values including
-        - idents
-        - colors
-        - small integers
-        
-        This reduces the amount CSSPrimitiveValue instances by > 80%.
-
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::createIdentifier):
-        (WebCore::CSSPrimitiveValue::createColor):
-        (WebCore::CSSPrimitiveValue::create):
-        * css/CSSPrimitiveValue.h:
-        (WebCore::CSSPrimitiveValue::create):
-
-2008-12-07  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22717
-        Make CSS values use less memory
-
-        Get CSSValues off from the common StyleBase base class. They don't
-        need a parent pointer or anything else there and there is no real
-        reason to have them in same data structures with other CSSOM objects.
-        
-        Disabled (instead of refactoring around the lack of common base) the ability 
-        to have style declaration blocks as CSS variable values. They don't exist in 
-        the spec so I wasn't sure if they have future or not. It would not be hard to 
-        get them back. CSS variables are in any case an experimental feature and 
-        not enabled by default.
-
-        * css/CSSInitialValue.h:
-        (WebCore::CSSInitialValue::createExplicit):
-        (WebCore::CSSInitialValue::createImplicit):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::addVariableDeclarationBlock):
-        * css/CSSParser.h:
-        * css/CSSValue.h:
-        (WebCore::CSSValue::~CSSValue):
-        (WebCore::CSSValue::parserValue):
-        * css/CSSVariablesDeclaration.cpp:
-        (WebCore::CSSVariablesDeclaration::CSSVariablesDeclaration):
-        (WebCore::CSSVariablesDeclaration::getVariableValue):
-        (WebCore::CSSVariablesDeclaration::removeVariable):
-        (WebCore::CSSVariablesDeclaration::addParsedVariable):
-        (WebCore::CSSVariablesDeclaration::getParsedVariable):
-        (WebCore::CSSVariablesDeclaration::getParsedVariableDeclarationBlock):
-        * css/CSSVariablesDeclaration.h:
-        (WebCore::CSSVariablesDeclaration::create):
-        * css/StyleBase.h:
-
-2008-12-07  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Oliver Hunt.
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::create):
+        (WebCore::LocalStorageArea::LocalStorageArea):
+        (WebCore::LocalStorageArea::scheduleFinalSync):
+        (WebCore::LocalStorageArea::itemChanged):
+        (WebCore::LocalStorageArea::itemRemoved):
+        (WebCore::LocalStorageArea::areaCleared):
+        (WebCore::LocalStorageArea::blockUntilImportComplete):
+        * storage/LocalStorageArea.h:
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::LocalStorageTask):
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::createImport):
+        (WebCore::LocalStorageTask::createSync):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        * storage/LocalStorageThread.h:
+        * storage/SessionStorageArea.cpp:
+        (WebCore::SessionStorageArea::blockUntilImportComplete):
+        * storage/SessionStorageArea.h:
+        * storage/StorageArea.h:
+        * storage/StorageAreaSync.cpp: Copied from WebCore/storage/LocalStorageArea.cpp.
+        * storage/StorageAreaSync.h: Copied from WebCore/storage/LocalStorageArea.h.
+        * storage/StorageSyncManager.cpp:
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h:
+
+2009-06-24  Adam Treat  <adam.treat@torchmobile.com>
 
-        Add gradient and pattern support for strokeRect on canvas/Cg.
+        Fix Qt build.
 
-        Canvas strokeRect() doesn't support gradients
-        https://bugs.webkit.org/show_bug.cgi?id=19790
+        * WebCore.pro:
 
-        Test: fast/canvas/canvas-strokeRect.html
+2009-06-24  David Levin  <levin@chromium.org>
 
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::GraphicsContext::strokeRect):
+        Reviewed by David Hyatt.
 
-2008-12-06  Dirk Schulze  <krit@webkit.org>
+        Bug 26696: Member functions in DataGridColumnList should return pointers instead of PassRefPtr.
+        https://bugs.webkit.org/show_bug.cgi?id=26696
+
+        * html/DataGridColumnList.cpp:
+        (WebCore::DataGridColumnList::itemWithName):
+        (WebCore::DataGridColumnList::add):
+        * html/DataGridColumnList.h:
+        (WebCore::DataGridColumnList::item):
+        (WebCore::DataGridColumnList::primaryColumn):
+        (WebCore::DataGridColumnList::sortColumn):
+
+2009-06-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dave "Messy" Hyatt.
+
+        Little bit of style cleanup.
+
+        * html/DataGridColumn.cpp:
+        * html/DataGridColumn.h:
+        * html/DataGridColumn.idl:
+        * html/DataGridColumnList.cpp:
+        * html/DataGridColumnList.h:
+        * html/DataGridColumnList.idl:
+        * html/HTMLDataGridCellElement.cpp:
+        * html/HTMLDataGridCellElement.h:
+        * html/HTMLDataGridCellElement.idl:
+        * html/HTMLDataGridColElement.cpp:
+        * html/HTMLDataGridColElement.h:
+        * html/HTMLDataGridColElement.idl:
+        * html/HTMLDataGridElement.h:
+        * html/HTMLDataGridElement.idl:
+        * html/HTMLDataGridRowElement.cpp:
+        * html/HTMLDataGridRowElement.h:
+        * html/HTMLDataGridRowElement.idl:
+
+2009-06-24  Chris Fleizach  <cfleizach@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        Add support for setTransform() in canvas.
-
-        <canvas> lacks transform() and setTransform()
-        https://bugs.webkit.org/show_bug.cgi?id=16604
-
-        Test: fast/canvas/canvas-setTransform.html
-
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::State::State):
-        (WebCore::CanvasRenderingContext2D::setStrokeStyle):
-        (WebCore::CanvasRenderingContext2D::setFillStyle):
-        (WebCore::CanvasRenderingContext2D::scale):
-        (WebCore::CanvasRenderingContext2D::rotate):
-        (WebCore::CanvasRenderingContext2D::translate):
-        (WebCore::CanvasRenderingContext2D::transform):
-        (WebCore::CanvasRenderingContext2D::setTransform):
-        (WebCore::CanvasRenderingContext2D::beginPath):
-        (WebCore::CanvasRenderingContext2D::closePath):
-        (WebCore::CanvasRenderingContext2D::moveTo):
-        (WebCore::CanvasRenderingContext2D::lineTo):
-        (WebCore::CanvasRenderingContext2D::quadraticCurveTo):
-        (WebCore::CanvasRenderingContext2D::bezierCurveTo):
-        (WebCore::CanvasRenderingContext2D::arcTo):
-        (WebCore::CanvasRenderingContext2D::arc):
-        (WebCore::CanvasRenderingContext2D::rect):
-        (WebCore::CanvasRenderingContext2D::fill):
-        (WebCore::CanvasRenderingContext2D::stroke):
-        (WebCore::CanvasRenderingContext2D::clip):
-        (WebCore::CanvasRenderingContext2D::isPointInPath):
-        (WebCore::CanvasRenderingContext2D::clearRect):
-        (WebCore::CanvasRenderingContext2D::fillRect):
-        (WebCore::CanvasRenderingContext2D::strokeRect):
-        (WebCore::CanvasRenderingContext2D::drawImage):
-        (WebCore::CanvasRenderingContext2D::drawImageFromRect):
-        (WebCore::CanvasRenderingContext2D::willDraw):
-        (WebCore::CanvasRenderingContext2D::drawTextInternal):
-        * html/CanvasRenderingContext2D.h:
-        * html/CanvasRenderingContext2D.idl:
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::baseTransform):
-        * html/HTMLCanvasElement.h:
-        * platform/graphics/ImageBuffer.h:
-        (WebCore::ImageBuffer::baseTransform):
-
-2008-12-06  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Also copy m_implicit field. Darin wanted this change commited separately.
-
-        * css/CSSProperty.h:
-        (WebCore::CSSProperty::operator=):
-
-2008-12-06  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22379
-        Make CSSOM use less memory
-        
-        Use vector instead of a double linked list for properties in CSSMutableStyleDeclaration.
-        
-        Taught setter functions to use existing slots to avoid memory moves, plus some
-        other optimizations.
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * css/CSSMutableStyleDeclaration.cpp:
-        (WebCore::CSSMutableStyleDeclaration::CSSMutableStyleDeclaration):
-        (WebCore::CSSMutableStyleDeclaration::operator=):
-        (WebCore::CSSMutableStyleDeclaration::getPropertyCSSValue):
-        (WebCore::CSSMutableStyleDeclaration::removeShorthandProperty):
-        (WebCore::CSSMutableStyleDeclaration::removeProperty):
-        (WebCore::CSSMutableStyleDeclaration::getPropertyPriority):
-        (WebCore::CSSMutableStyleDeclaration::getPropertyShorthand):
-        (WebCore::CSSMutableStyleDeclaration::isPropertyImplicit):
-        (WebCore::CSSMutableStyleDeclaration::setProperty):
-        (WebCore::CSSMutableStyleDeclaration::setPropertyInternal):
-        (WebCore::CSSMutableStyleDeclaration::setStringProperty):
-        (WebCore::CSSMutableStyleDeclaration::setImageProperty):
-        (WebCore::CSSMutableStyleDeclaration::parseDeclaration):
-        (WebCore::CSSMutableStyleDeclaration::addParsedProperties):
-        (WebCore::CSSMutableStyleDeclaration::addParsedProperty):
-        (WebCore::CSSMutableStyleDeclaration::setLengthProperty):
-        (WebCore::CSSMutableStyleDeclaration::length):
-        (WebCore::CSSMutableStyleDeclaration::item):
-        (WebCore::CSSMutableStyleDeclaration::cssText):
-        (WebCore::CSSMutableStyleDeclaration::setCssText):
-        (WebCore::CSSMutableStyleDeclaration::merge):
-        (WebCore::CSSMutableStyleDeclaration::removePropertiesInSet):
-        (WebCore::CSSMutableStyleDeclaration::copy):
-        (WebCore::CSSMutableStyleDeclaration::findPropertyWithId):
-        * css/CSSMutableStyleDeclaration.h:
-        (WebCore::CSSMutableStyleDeclarationConstIterator::operator*):
-        (WebCore::CSSMutableStyleDeclarationConstIterator::operator->):
-        (WebCore::CSSMutableStyleDeclarationConstIterator::operator!=):
-        (WebCore::CSSMutableStyleDeclarationConstIterator::operator==):
-        (WebCore::CSSMutableStyleDeclaration::create):
-        (WebCore::CSSMutableStyleDeclaration::begin):
-        (WebCore::CSSMutableStyleDeclaration::end):
-        (WebCore::CSSMutableStyleDeclarationConstIterator::CSSMutableStyleDeclarationConstIterator):
-        (WebCore::CSSMutableStyleDeclarationConstIterator::~CSSMutableStyleDeclarationConstIterator):
-        (WebCore::CSSMutableStyleDeclarationConstIterator::operator=):
-        (WebCore::CSSMutableStyleDeclarationConstIterator::operator++):
-        (WebCore::CSSMutableStyleDeclarationConstIterator::operator--):
-        * css/CSSProperty.h:
-        (WTF::):
-        * css/CSSStyleDeclaration.cpp:
-        (WebCore::CSSStyleDeclaration::diff):
-        (WebCore::CSSStyleDeclaration::copyPropertiesInSet):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::resolveVariablesForDeclaration):
-        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
-        (WebCore::CSSStyleSelector::applyDeclarations):
-        * dom/EventTarget.h:
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::StyleChange::init):
-        (WebCore::ApplyStyleCommand::isHTMLStyleNode):
-        (WebCore::ApplyStyleCommand::removeHTMLFontStyle):
-        (WebCore::ApplyStyleCommand::removeCSSStyle):
-        * editing/Editor.cpp:
-        (WebCore::Editor::selectionStartHasStyle):
-        (WebCore::updateState):
-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::ReplaceSelectionCommand::handleStyleSpans):
-        * editing/markup.cpp:
-        (WebCore::appendStartMarkup):
-
-2008-12-06  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Antti Koivisto, Dan Bernstein
-
-        https://bugs.webkit.org/show_bug.cgi?id=22088
-
-        Fix logic related to repainting when transform changes:
-        If an object has a layer, and the transform changes, then we need
-        to do a repaintIncludingDescendants(), not just a repaint.
+        Bug 26668: AX: need a way to retrieve the language for an element
         
-        Test: fast/repaint/transform-repaint-descendants.html
-
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::styleWillChange):
-
-2008-12-06  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein
-
-        https://bugs.webkit.org/show_bug.cgi?id=15739
-
-        When painting the selection on a replaced element, paint
-        using local coordinates so that the selection is correctly
-        painted for transformed elements.
-
-        Test: fast/replaced/selection-rect-transform.html
+        Provides a way to retrieve the language associated with a specific accessibility element.
 
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::paint):
+        Test: accessibility/language-attribute.html
 
-2008-12-06  Simon Fraser  <simon.fraser@apple.com>
+        * accessibility/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::language):
+        * accessibility/AccessibilityObject.h:
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::language):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
 
-        Reviewed by Dave Hyatt
+2009-06-24  Brady Eidson  <beidson@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=15671
+        Reviewed by Dan Bernstein.
         
-        Fix caret rendering to behave correctly with transforms:
-        * Rename caretRect() methods to localCaretRect() and
-          absoluteCaretBounds() as appropriate
-        * Fix localCaretRect() methods to return a rect in the
-          appropriate coordinates.
-        * Pass tx, ty down through the paintCaret() methods, after fixing them
-          up to account for differences between contents coords, and renderer-local
-          coords (via RenderBlock::offsetForContents()).
-        * Remove m_caretPositionOnLayout from SelectionController, and instead
-          call invalidateSelection() from RenderLayer::scrollToOffset(), because
-          we can no longer assume simple x/y offsets from scrolling with transforms.
-        * Move the logic to compute which RenderObject actually paints the caret into
-          SelectionController::caretRenderer(), rather than having it in RenderBlock.
-        * SelectionController now computes and caches a local caret rect. For invalidation,
-          it computes the absolute bounds of that (possibly transformed) local rect.
-          The local rect is computed in the coordinate system of the RenderObject that
-          will paint the caret (this may require offsetting from the actual renderer
-          at the start of the selection).
-        * Fix LayoutState(RenderObject* root) to take transforms into account
-        * Make offsetFromContainer() a virtual method on RenderObject, and implement
-          the RenderObject version. It's used to map from selection start renderer
-          to caret renderer.
-
-        Test: fast/transforms/transformed-caret.html
-
-        * WebCore.base.exp:
-        * editing/DeleteSelectionCommand.cpp:
-        (WebCore::DeleteSelectionCommand::mergeParagraphs):
-        * editing/SelectionController.cpp:
-        (WebCore::SelectionController::SelectionController):
-        (WebCore::absoluteCaretY):
-        (WebCore::SelectionController::modify):
-        (WebCore::SelectionController::xPosForVerticalArrowNavigation):
-        (WebCore::SelectionController::layout):
-        (WebCore::SelectionController::caretRenderer):
-        (WebCore::SelectionController::localCaretRect):
-        (WebCore::SelectionController::absoluteCaretBounds):
-        (WebCore::SelectionController::caretRepaintRect):
-        (WebCore::SelectionController::recomputeCaretRect):
-        (WebCore::SelectionController::invalidateCaretRect):
-        (WebCore::SelectionController::paintCaret):
-        (WebCore::SelectionController::caretRendersInsideNode):
-        * editing/SelectionController.h:
-        * editing/VisiblePosition.cpp:
-        (WebCore::VisiblePosition::localCaretRect):
-        (WebCore::VisiblePosition::absoluteCaretBounds):
-        (WebCore::VisiblePosition::xOffsetForVerticalNavigation):
-        * editing/VisiblePosition.h:
-        * editing/mac/SelectionControllerMac.mm:
-        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::isContentEditable):
-        * page/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::boundsForVisiblePositionRange):
-        * page/Frame.cpp:
-        (WebCore::Frame::firstRectForRange):
-        (WebCore::Frame::selectionLayoutChanged):
-        (WebCore::Frame::paintCaret):
-        (WebCore::Frame::paintDragCaret):
-        (WebCore::Frame::revealSelection):
-        (WebCore::Frame::revealCaret):
-        * page/Frame.h:
-        * rendering/LayoutState.cpp:
-        (WebCore::LayoutState::LayoutState):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::paintCaret):
-        (WebCore::RenderBlock::paintObject):
-        (WebCore::RenderBlock::positionForCoordinates):
-        (WebCore::RenderBlock::offsetForContents):
-        * rendering/RenderBlock.h:
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::localCaretRect):
-        * rendering/RenderBox.h:
-        * rendering/RenderFlow.cpp:
-        (WebCore::RenderFlow::localCaretRect):
-        * rendering/RenderFlow.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::scrollToOffset):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::localCaretRect):
-        * rendering/RenderObject.h:
-        * rendering/RenderSVGInlineText.cpp:
-        (WebCore::RenderSVGInlineText::localCaretRect):
-        * rendering/RenderSVGInlineText.h:
-        * rendering/RenderText.cpp:
-        (WebCore::RenderText::RenderText):
-        (WebCore::RenderText::localCaretRect):
-        * rendering/RenderText.h:
-
-2008-12-06  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 22711: Current svn (build 39065) fails to compile
-
-        <https://bugs.webkit.org/show_bug.cgi?id=22711>
-
-        BUILD FIX for r39065: Forgot parentheses after "document".
-
-        Bug 22666: Clean up data structures used when collecting URLs of subresources for webarchives
-        <https://bugs.webkit.org/show_bug.cgi?id=22666>
-
-        * svg/SVGFEImageElement.cpp:
-        (WebCore::SVGFEImageElement::addSubresourceAttributeURLs): Changed
-        document to document().
-
-2008-12-06  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22710
-        Memory leak due to circular reference Document->DOMTimer->ScheduledAction->[JS objects]->Document
-
-        * bindings/js/DOMTimer.cpp:
-        (WebCore::DOMTimer::stop): Delete ScheduledAction, which contains a protected object.
-
-2008-12-06  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 22666: Clean up data structures used when collecting URLs of subresources for webarchives
-
-        <https://bugs.webkit.org/show_bug.cgi?id=22666>
-
-        Reviewed by Darin Adler.
-
-        When creating a webarchive from WebCore::LegacyWebArchive::create(),
-        HashSet<String>, Vector<KURL> and Vector<String> were all used to
-        store a list of URLs for resources found in the document.  Instead
-        use a single ListHashSet<KURL> to store the list and resolve the
-        relative URLs as they're added.  We use a new inline method called
-        WebCore::addSubresourceURL() to add KURL objects to the ListHashSet
-        to prevent "null" KURL objects from crashing in the KURL hashing
-        function.
-
-        * WebCore.base.exp: Changed export of
-        WebCore::Node::getSubresourceURLs() to take a ListHashSet<KURL>
-        argument instead of a Vector<KURL>.
-
-        * WebCore.xcodeproj/project.pbxproj: Marked KURLHash.h as a private
-        header for use in WebKit.
-
-        * css/CSSStyleSheet.cpp:
-        (WebCore::CSSStyleSheet::addSubresourceStyleURLs): Renamed from
-        addSubresourceURLStrings().  Changed to use ListHashSet<KURL>
-        instead of HashSet<String>.  Cleaned up code.
-        * css/CSSStyleSheet.h:
-        (WebCore::CSSStyleSheet::addSubresourceStyleURLs): Ditto.
-        * css/StyleSheet.h:
-        (WebCore::StyleSheet::addSubresourceStyleURLs): Ditto.
-
-        * dom/Node.cpp:
-        (WebCore::Node::getSubresourceURLs): Changed to use
-        ListHashSet<KURL> instead of Vector<KURL>.  Cleaned up code.
-        * dom/Node.h:
-        (WebCore::Node::getSubresourceURLs): Ditto.
-        (WebCore::Node::addSubresourceAttributeURLs): Renamed from
-        getSubresourceAttributeStrings().  Changed to use ListHashSet<KURL>
-        instead of Vector<String>.
-        (WebCore::addSubresourceURL): Added.  Safely adds new KURL objects
-        to a ListHashSet<KURL> object.  A "null" KURL object will cause the
-        hash function to crash since it contains a null StringImpl.  Used in
-        Node::addSubresourceAttributeURLs() and addSubresourceStyleURLs() in
-        the style subsystem.
-
-        * dom/ProcessingInstruction.cpp:
-        (WebCore::ProcessingInstruction::addSubresourceAttributeURLs):
-        Renamed from getSubresourceAttributeStrings().  Changed to use
-        ListHashSet<KURL> instead of Vector<String>.  Use
-        WebCore::addSubresourceURL() to add new KURL objects.
-        * dom/ProcessingInstruction.h: Ditto.
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::addSubresourceAttributeURLs): Ditto.
-        * html/HTMLBodyElement.h: Ditto.
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::HTMLEmbedElement::addSubresourceAttributeURLs): Ditto.
-        * html/HTMLEmbedElement.h: Ditto.
-        * html/HTMLImageElement.cpp:
-        (WebCore::HTMLImageElement::addSubresourceAttributeURLs): Ditto.
-        * html/HTMLImageElement.h: Ditto.
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::addSubresourceAttributeURLs): Ditto.
-        * html/HTMLInputElement.h: Ditto.
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::addSubresourceAttributeURLs): Ditto.
-        * html/HTMLLinkElement.h: Ditto.
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::addSubresourceAttributeURLs): Ditto.
-        * html/HTMLObjectElement.h: Ditto.
-        * html/HTMLParamElement.cpp:
-        (WebCore::HTMLParamElement::addSubresourceAttributeURLs): Ditto.
-        * html/HTMLParamElement.h: Ditto.
-        * html/HTMLScriptElement.cpp:
-        (WebCore::HTMLScriptElement::addSubresourceAttributeURLs): Ditto.
-        * html/HTMLScriptElement.h: Ditto.
-        * html/HTMLStyleElement.cpp:
-        (WebCore::HTMLStyleElement::addSubresourceAttributeURLs): Ditto.
-        * html/HTMLStyleElement.h: Ditto.
-        * html/HTMLTableCellElement.cpp:
-        (WebCore::HTMLTableCellElement::addSubresourceAttributeURLs): Ditto.
-        * html/HTMLTableCellElement.h: Ditto.
-        * html/HTMLTableElement.cpp:
-        (WebCore::HTMLTableElement::addSubresourceAttributeURLs): Ditto.
-        * html/HTMLTableElement.h: Ditto.
-
-        * loader/archive/cf/LegacyWebArchive.cpp:
-        (WebCore::LegacyWebArchive::create): Changed from using
-        HashSet<String> to ListHashSet<KURL> for tracking unique
-        subresources.  Changed from using Vector<KURL> to ListHashSet<KURL>
-        when calling WebCore::Node::getSubresourceURLs().  Cleaned up code.
-
-        * svg/SVGCursorElement.cpp:
-        (WebCore::SVGCursorElement::addSubresourceAttributeURLs): Renamed
-        from getSubresourceAttributeStrings().  Changed to use
-        ListHashSet<KURL> instead of Vector<String>.  Use
-        WebCore::addSubresourceURL() to add new KURL objects.
-        * svg/SVGCursorElement.h: Ditto.
-        * svg/SVGFEImageElement.cpp:
-        (WebCore::SVGFEImageElement::addSubresourceAttributeURLs): Ditto.
-        * svg/SVGFEImageElement.h: Ditto.
-        * svg/SVGImageElement.cpp:
-        (WebCore::SVGImageElement::addSubresourceAttributeURLs): Ditto.
-        * svg/SVGImageElement.h: Ditto.
-        * svg/SVGScriptElement.cpp:
-        (WebCore::SVGScriptElement::addSubresourceAttributeURLs): Ditto.
-        * svg/SVGScriptElement.h: Ditto.
-
-2008-12-05  Brett Wilson  <brettw@chromium.org>
-
-        Reviewed by Darin Adler.
+        <rdar://problem/6893811> Instead of downloading files linked from Google Earth, file contents displayed in browser window as text.
 
-        Make the page group use the proper link hashing functions rather than
-        calling the string hash functions directly. Add Chromium-specfic ifdefs
-        in the visited link computation functions to allow integration.
+        * platform/network/mac/WebCoreURLResponse.mm:
+        (createBinaryExtensionsSet): Add '.kmz' to the list of known-to-be-binary extensions.
 
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::isLinkVisited):
-        (WebCore::PageGroup::addVisitedLink):
-        * platform/LinkHash.cpp:
-        (WebCore::visitedLinkHash):
-        * platform/LinkHash.h:
-
-2008-12-05  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=22635
-        For iteration and end events, previous fixes to prevent the deletion of
-        Animation objects (ref counting and hanging onto a ref during event callbacks)
-        was sufficient to prevent dangling pointers. But start events are sent in
-        the styleAvailable() call, which iterates over CompositeAnimation objects,
-        which are not ref counted. So that object can get destroyed in the event
-        handler while still active. So I added refcounting for CompositeAnimations.
-
-        Additionally, when am iterating over the CompositingAnimation list, it can
-        be deleted, which mutates the list. So I now make one pass over the list
-        building a vector of CompositeAnimation objects that need to be called and
-        then iterate over that vector to make the actual calls.
-
-        Finally, to make sure the lifetime of the CompositeAnimation exceeds that of
-        the Animation objects it owns, I now keep a ref to the CompositeAnimation
-        in the timer callback for the iteration and end events. That means I no
-        longer need to keep a ref to the Animation objects themselves in that timer
-        callback, since the CompositeAnimation already has one.
-
-        Tests: animations/animation-iteration-event-destroy-renderer.html
-               animations/animation-start-event-destroy-renderer.html
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::updateStateMachine):
-        (WebCore::AnimationBase::animationTimerCallbackFired):
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::~AnimationControllerPrivate):
-        (WebCore::AnimationControllerPrivate::accessCompositeAnimation):
-        (WebCore::AnimationControllerPrivate::clear):
-        (WebCore::AnimationControllerPrivate::styleAvailable):
-        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
-        (WebCore::AnimationControllerPrivate::animationTimerFired):
-        (WebCore::AnimationControllerPrivate::isAnimatingPropertyOnRenderer):
-        (WebCore::AnimationControllerPrivate::suspendAnimations):
-        (WebCore::AnimationControllerPrivate::resumeAnimations):
-        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
-        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
-        (WebCore::AnimationController::updateAnimations):
-        (WebCore::AnimationController::setAnimationStartTime):
-        (WebCore::AnimationController::setTransitionStartTime):
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimationPrivate::animationController):
-        (WebCore::CompositeAnimationPrivate::isWaitingForStyleAvailable):
-        (WebCore::CompositeAnimationPrivate::~CompositeAnimationPrivate):
-        (WebCore::CompositeAnimationPrivate::clearRenderer):
-        (WebCore::CompositeAnimation::clearRenderer):
-        (WebCore::CompositeAnimation::animationController):
-        (WebCore::CompositeAnimation::isWaitingForStyleAvailable):
-        * page/animation/CompositeAnimation.h:
-        (WebCore::CompositeAnimation::create):
-
-2008-12-05  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 22609: Provide a build-time choice when generating hash tables for properties of built-in DOM objects
-
-        <https://bugs.webkit.org/show_bug.cgi?id=22609>
-        <rdar://problem/6331749>
-
-        Reviewed by Darin Adler.
-
-        Initial patch by Yosen Lin.  Adapted for ToT WebKit by David Kilzer.
-
-        Added back the code that generates a "compact" hash (instead of a
-        perfect hash) as a build-time option using the
-        ENABLE(PERFECT_HASH_SIZE) macro as defined in Lookup.h.
-
-        * bindings/scripts/CodeGeneratorJS.pm:
-        (GenerateImplementation): Compute the number of elements that will
-        be stored in each hash table and pass it to GenerateHashTable().
-        (GenerateHashTable): Added new second parameter representing the
-        number of elements to store in the compact hash table.  Added back
-        code to compute compact hash tables.  Generate both hash table sizes
-        and emit conditionalized code based on ENABLE(PERFECT_HASH_SIZE).
-
-2008-12-05  Brett Wilson  <brettw@chromium.org>
-
-        Fix build bustage from previous patch.
-
-        * css/CSSSelector.h:
-
-2008-12-05  Brett Wilson  <brettw@chromium.org>
+2009-06-24  Nicolas Weber  <thakis@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        Add a missing include for OwnPtr to make CSSSelector compile without
-        precompiled headers.
-
-        * css/CSSSelector.h:
-
-2008-12-05  Finnur Thorarinsson  <finnur.webkit@gmail.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 22579: Providing a function to ScrollbarClient.h which allows us to get at the tickmarks
-        without relying on high-level WebCore types, as requested by Dave Hyatt.
-        
-        No functional changes, thus no test cases.
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::getTickmarks):
-        * page/FrameView.h:
-        * platform/ScrollbarClient.h:
-
-2008-12-05  Dean Jackson  <dino@apple.com>
-
-        Reviewed by David Hyatt.
-
-        Make sure Window event listeners also tell the
-        Document about the event type, so noisy events
-        will be dispatched even if nothing in the document
-        is listening.
-        https://bugs.webkit.org/show_bug.cgi?id=20572
-
-        * dom/Document.cpp:
-        (WebCore::Document::addWindowEventListener):
-
-2008-12-05  Adam Roben  <aroben@apple.com>
-
-        Windows build fix after r39026
-
-        * platform/network/cf/ResourceRequestCFNet.cpp:
-        (WebCore::ResourceRequest::doUpdatePlatformRequest):
-        (WebCore::ResourceRequest::doUpdateResourceRequest):
-        Add some missing .get()s.
-
-2008-12-05  Alexey Proskuryakov  <ap@webkit.org>
-
-        Tiger build fix.
-
-        * platform/network/mac/ResourceRequestMac.mm: Define NSUInteger.
-
-2008-12-05  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/6405599> Tiger Mail crashes when using "Mail Contents of This Page"
-        in Safari before opening a mail message in Mail
-
-        * platform/mac/WebCoreObjCExtras.mm:
-        (WebCoreObjCFinalizeOnMainThread):
-        Don't call initializeThreading: we now expect the caller to do it, to simplify keeping
-        Tiger and post-Tiger behavior in line.
-
-        * bindings/objc/DOMRGBColor.mm:
-        (+[DOMRGBColor initialize]):
-        * bindings/objc/WebScriptObject.mm:
-        (+[WebScriptObject initialize]):
-        * page/mac/AccessibilityObjectWrapper.mm:
-        (+[AccessibilityObjectWrapper initialize]):
-        * platform/mac/SharedBufferMac.mm:
-        (+[WebCoreSharedBufferData initialize]):
-        Call JSC::initializeThreading();
-
-2008-12-05  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/4072827> Downloaded non-ASCII file name becomes garbled
-
-        * platform/network/ResourceRequestBase.cpp:
-        (WebCore::ResourceRequestBase::setResponseContentDispositionEncodingFallbackArray):
-        * platform/network/ResourceRequestBase.h:
-        * platform/network/cf/ResourceRequestCFNet.cpp:
-        (WebCore::findCFURLRequestSetContentDispositionEncodingFallbackArrayFunction):
-        (WebCore::findCFURLRequestCopyContentDispositionEncodingFallbackArrayFunction):
-        (WebCore::setContentDispositionEncodingFallbackArray):
-        (WebCore::copyContentDispositionEncodingFallbackArray):
-        (WebCore::ResourceRequest::doUpdatePlatformRequest):
-        (WebCore::ResourceRequest::doUpdateResourceRequest):
-        * platform/network/mac/ResourceRequestMac.mm:
-        (WebCore::ResourceRequest::doUpdateResourceRequest):
-        (WebCore::ResourceRequest::doUpdatePlatformRequest):
-        Added a way to specify encoding fallback list for Content-Disposition header.
-
-        * loader/FrameLoader.cpp: (WebCore::FrameLoader::addExtraFieldsToRequest): Generate and
-        pass a list of encodings to try when decoding Content-Disposition header, as described
-        in comments.
-
-2008-12-05  Alexey Proskuryakov  <ap@webkit.org>
+        https://bugs.webkit.org/show_bug.cgi?id=26685
+        Accomodate for backwards-incompatible skia api changes.
 
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22672
-        ASSERT(m_table) when xhr.onabort creates another xhr or calls setTimeout
-
-        Test: http/tests/xmlhttprequest/send-on-abort.html
-
-        * dom/ScriptExecutionContext.cpp:
-        (WebCore::ScriptExecutionContext::canSuspendActiveDOMObjects):
-        (WebCore::ScriptExecutionContext::suspendActiveDOMObjects):
-        (WebCore::ScriptExecutionContext::resumeActiveDOMObjects):
-        (WebCore::ScriptExecutionContext::stopActiveDOMObjects):
-        Add a comment explaining that ActiveDOMObject methods shouldn't execute arbitrary JS.
-
-        * xml/XMLHttpRequest.cpp: (WebCore::XMLHttpRequest::stop): Don't dispatch events. This
-        reverts a recent change that made the behavior slightly closer to Firefox - but the
-        compatibility effect should be very minor if any, and Firefox itself behaves inconsistently.
-
-2008-12-05  Tobias König <tobias.koenig@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Record required package dependencies for the Qt build for a correct
-        pkg-config file.
-
-        * WebCore.pro:
-
-2008-12-05  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Rubber-stamped by Simon Hausmann.
-
-        [Qt/Mac] Blacklist QuickTime plugin until we support the QuickDraw drawing model
-
-        * plugins/mac/PluginPackageMac.cpp:
-        (WebCore::PluginPackage::fetchInfo):
-        (WebCore::PluginPackage::isPluginBlacklisted):
-
-2008-12-05  Jungshik Shin  <jshin@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22472
-
-        Revises charset alias map for TextCodecICU.
-        - Uses windows-949 and windows-874 instead of windows-949-2000 and windows-874-2000
-        - Replaces 'windows874' in a couple of place with 'windows-874' (for the canonical name)
-        - Maps 'dos-874' to 'windows-874'. Currently, it's aliases to 'cp874', which is in turn
-          mapped to 'TIS-620'. 'TIS-620' is manually aliased to 'windows-874'. We'd better directly
-          alias 'dos-874' to 'windows-874'.
-        - Replaces 'EUC-CN' with 'GBK' when it's used as the canonical name.
-          Similar to the above case, we're getting rid of indirection that eventually leads to 'GBK' by
-          directly going to 'GBK'.
-        - Adds 'x-uhc' as an alias for 'windows-949'. It's used in some web pages.
-
-        Tests: fast/encoding/char-decoding-mac.html
-               fast/encoding/char-decoding.html
-
-        * platform/text/TextCodecICU.cpp:
-        (WebCore::TextCodecICU::registerExtendedEncodingNames):
-
-2008-12-04  Kevin Watters  <kevinwatters@gmail.com>
-
-        Reviewed by Kevin Ollivier.
-
-        Add a MIME mapping for the .htm extension to wx and GTK ports.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=22668
-        
-        * platform/gtk/MIMETypeRegistryGtk.cpp:
-        (WebCore::):
-        * platform/wx/MimeTypeRegistryWx.cpp:
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::setCompositeOperation):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::paintSkBitmap):
+        (WebCore::Image::drawPattern):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::State::State):
+        (PlatformContextSkia::setupPaintCommon):
+        (PlatformContextSkia::setXfermodeMode):
+        (PlatformContextSkia::applyClipFromImage):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * platform/graphics/skia/SkiaUtils.cpp:
         (WebCore::):
+        (WebCore::WebCoreCompositeToSkiaComposite):
+        * platform/graphics/skia/SkiaUtils.h:
 
-2008-12-04  Kevin Watters  <kevinwatters@gmail.com>
-
-        Reviewed by Kevin Ollivier.
-
-        Implement basic text paste support in wx and add notImplemented stubs
-        to catch other methods.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=22667
-
-        * platform/wx/PasteboardWx.cpp:
-        (WebCore::Pasteboard::canSmartReplace):
-        (WebCore::Pasteboard::plainText):
-        (WebCore::Pasteboard::documentFragment):
-        (WebCore::Pasteboard::writeImage):
-
-2008-12-04  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix for !USE(WXGC) build config.
-
-        * platform/graphics/wx/PathWx.cpp:
-        (WebCore::Path::contains):
-        (WebCore::Path::addLineTo):
-        (WebCore::Path::addQuadCurveTo):
-        (WebCore::Path::addBezierCurveTo):
-        (WebCore::Path::addArcTo):
-        (WebCore::Path::closeSubpath):
-        (WebCore::Path::addArc):
-        (WebCore::Path::addRect):
-        (WebCore::Path::addEllipse):
-        (WebCore::Path::transform):
-        (WebCore::Path::apply):
-        (WebCore::Path::isEmpty):
-
-2008-12-04  Kevin Watters  <kevinwatters@gmail.com>
-
-        Reviewed by Kevin Ollivier.
-
-        Turn off styled controls until we can implement them properly.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=22662
-
-        * platform/wx/RenderThemeWx.cpp:
-        (WebCore::RenderThemeWx::isControlStyled):
+2009-06-24  Jan Michael Alonzo  <jmalonzo@webkit.org>
 
-2008-12-04  Kevin Watters  <kevinwatters@gmail.com>
+        Gtk build fix. Add files that were added in r45093 and r45096
 
-        Reviewed by Kevin Ollivier.
+        * GNUmakefile.am:
 
-        wx implementations for Path API.
+2009-06-24  Brady Eidson  <beidson@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=22661
+        Fix 64-bit SnowLeopard build.
 
-        * platform/graphics/wx/PathWx.cpp:
-        (WebCore::Path::~Path):
-        (WebCore::Path::contains):
-        (WebCore::Path::addLineTo):
-        (WebCore::Path::addQuadCurveTo):
-        (WebCore::Path::addBezierCurveTo):
-        (WebCore::Path::addArcTo):
-        (WebCore::Path::closeSubpath):
-        (WebCore::Path::addArc):
-        (WebCore::Path::addRect):
-        (WebCore::Path::addEllipse):
-        (WebCore::Path::transform):
-        (WebCore::Path::isEmpty):
+        * html/DataGridColumnList.cpp:
+        (WebCore::DataGridColumnList::remove):
+        (WebCore::DataGridColumnList::move):
 
-2008-12-04  Julien Chaffraix  <jchaffraix@webkit.org>
+2009-06-24  Rob Buis  <rwlbuis@gmail.com>
 
         Reviewed by Eric Seidel.
 
-        Bug 22564: Make HTML elements' constructors take a QualifiedName
-        https://bugs.webkit.org/show_bug.cgi?id=22564
-
-        Updated the remaining constructors.
-
-        * bindings/js/JSImageConstructor.cpp:
-        (WebCore::constructImage):
-        * dom/Document.cpp:
-        (WebCore::Document::getCSSCanvasElement):
-        * editing/DeleteButton.cpp:
-        (WebCore::DeleteButton::DeleteButton):
-        * html/HTMLAppletElement.cpp:
-        (WebCore::HTMLAppletElement::HTMLAppletElement):
-        * html/HTMLAppletElement.h:
-        * html/HTMLAreaElement.cpp:
-        (WebCore::HTMLAreaElement::HTMLAreaElement):
-        * html/HTMLAreaElement.h:
-        * html/HTMLBaseFontElement.cpp:
-        (WebCore::HTMLBaseFontElement::HTMLBaseFontElement):
-        * html/HTMLBaseFontElement.h:
-        * html/HTMLCanvasElement.cpp:
-        (WebCore::HTMLCanvasElement::HTMLCanvasElement):
-        * html/HTMLCanvasElement.h:
-        * html/HTMLElementFactory.cpp:
-        (WebCore::hrConstructor):
-        (WebCore::paragraphConstructor):
-        (WebCore::basefontConstructor):
-        (WebCore::fontConstructor):
-        (WebCore::anchorConstructor):
-        (WebCore::imageConstructor):
-        (WebCore::mapConstructor):
-        (WebCore::areaConstructor):
-        (WebCore::canvasConstructor):
-        (WebCore::appletConstructor):
-        (WebCore::embedConstructor):
-        (WebCore::objectConstructor):
-        (WebCore::paramConstructor):
-        (WebCore::scriptConstructor):
-        (WebCore::tableConstructor):
-        (WebCore::tableCaptionConstructor):
-        (WebCore::tableRowConstructor):
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::HTMLEmbedElement::HTMLEmbedElement):
-        * html/HTMLEmbedElement.h:
-        * html/HTMLFontElement.cpp:
-        (WebCore::HTMLFontElement::HTMLFontElement):
-        * html/HTMLFontElement.h:
-        * html/HTMLHRElement.cpp:
-        (WebCore::HTMLHRElement::HTMLHRElement):
-        * html/HTMLHRElement.h:
-        * html/HTMLImageElement.cpp:
-        (WebCore::HTMLImageElement::HTMLImageElement):
-        * html/HTMLImageElement.h:
-        * html/HTMLMapElement.cpp:
-        (WebCore::HTMLMapElement::HTMLMapElement):
-        * html/HTMLMapElement.h:
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::HTMLObjectElement):
-        * html/HTMLObjectElement.h:
-        * html/HTMLParagraphElement.cpp:
-        (WebCore::HTMLParagraphElement::HTMLParagraphElement):
-        * html/HTMLParagraphElement.h:
-        * html/HTMLParamElement.cpp:
-        (WebCore::HTMLParamElement::HTMLParamElement):
-        * html/HTMLParamElement.h:
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::handleError):
-        (WebCore::HTMLParser::mapCreateErrorCheck):
-        (WebCore::HTMLParser::handleIsindex):
-        * html/HTMLScriptElement.cpp:
-        (WebCore::HTMLScriptElement::HTMLScriptElement):
-        * html/HTMLScriptElement.h:
-        * html/HTMLTableCaptionElement.cpp:
-        (WebCore::HTMLTableCaptionElement::HTMLTableCaptionElement):
-        * html/HTMLTableCaptionElement.h:
-        * html/HTMLTableElement.cpp:
-        (WebCore::HTMLTableElement::HTMLTableElement):
-        (WebCore::HTMLTableElement::createCaption):
-        (WebCore::HTMLTableElement::insertRow):
-        * html/HTMLTableElement.h:
-        * html/HTMLTableRowElement.cpp:
-        (WebCore::HTMLTableRowElement::HTMLTableRowElement):
-        * html/HTMLTableRowElement.h:
-        * html/HTMLTableSectionElement.cpp:
-        (WebCore::HTMLTableSectionElement::insertRow):
-        * html/HTMLViewSourceDocument.cpp:
-        (WebCore::HTMLViewSourceDocument::createContainingTable):
-        (WebCore::HTMLViewSourceDocument::addLine):
-        * loader/ImageDocument.cpp:
-        (WebCore::ImageDocumentElement::ImageDocumentElement):
-
-2008-12-04  Eric Seidel  <eric@webkit.org>
-
-        No review, build fix only.
-
-        Add file missing from last commit.
-
-        * bindings/js/ScriptState.h: Added.
-
-2008-12-04  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Geoff Garen.
-
-        Implement ScriptState abstraction (initially, a simple typedef)
-        as means of carrying exception information across bindings boundaries
-        and in a script engine-independent way.
-
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::scriptStateFromNode):
-        * bindings/js/JSDOMBinding.h:
-        * bindings/js/JSNodeFilterCondition.h:
-        * bindings/js/ScriptState.h: Added.
-        * dom/NodeFilter.cpp:
-        (WebCore::NodeFilter::acceptNode):
-        * dom/NodeFilter.h:
-        (WebCore::NodeFilter::acceptNode):
-        * dom/NodeFilterCondition.cpp:
-        (WebCore::NodeFilterCondition::acceptNode):
-        * dom/NodeFilterCondition.h:
-        * dom/NodeIterator.cpp:
-        (WebCore::NodeIterator::nextNode):
-        (WebCore::NodeIterator::previousNode):
-        * dom/NodeIterator.h:
-        (WebCore::NodeIterator::nextNode):
-        (WebCore::NodeIterator::previousNode):
-        * dom/Traversal.cpp:
-        (WebCore::Traversal::acceptNode):
-        * dom/Traversal.h:
-        * dom/TreeWalker.cpp:
-        (WebCore::TreeWalker::parentNode):
-        (WebCore::TreeWalker::firstChild):
-        (WebCore::TreeWalker::lastChild):
-        (WebCore::TreeWalker::previousSibling):
-        (WebCore::TreeWalker::nextSibling):
-        (WebCore::TreeWalker::previousNode):
-        (WebCore::TreeWalker::nextNode):
-        * dom/TreeWalker.h:
-        (WebCore::TreeWalker::parentNode):
-        (WebCore::TreeWalker::firstChild):
-        (WebCore::TreeWalker::lastChild):
-        (WebCore::TreeWalker::previousSibling):
-        (WebCore::TreeWalker::nextSibling):
-        (WebCore::TreeWalker::previousNode):
-        (WebCore::TreeWalker::nextNode):
-
-2008-12-04  Pierre-Olivier Latour  <pol@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Fixed pauseTransitionAtTimeOnElementWithId() in DRT asserting when passed invalid property name
-        and potential similar issue with pauseAnimationAtTimeOnElementWithId().
-
-        https://bugs.webkit.org/show_bug.cgi?id=22641
-
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimationPrivate::pauseAnimationAtTime):
-        (WebCore::CompositeAnimationPrivate::pauseTransitionAtTime):
-
-2008-12-04  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Remove unused Completion.h include.
-
-        * html/CanvasRenderingContext2D.cpp: Removed Completion.h include.
-
-2008-11-13  David Hyatt  <hyatt@apple.com>
-
-        Fix a bug in ScrollView's refactoring.  An isVisible check should have been isSelfVisible.
-
-        Reviewed by Darin Adler
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::setParentVisible):
-
-2008-12-04  Friedemann Kleint  <friedemann.kleint@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Fix small translation glitch in the Qt file chooser.
-
-        * platform/qt/FileChooserQt.cpp:
-        (WebCore::FileChooser::basenameForWidth):
-
-2008-12-04  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Rubber-stamped by Simon Hausmann.
-
-        Blacklist Silverlight plugin on Qt/Mac until supported
-
-        Currently the plugin crashes with a corrupted stack trace, possibly
-        related to https://bugs.webkit.org/show_bug.cgi?id=20635
-
-        * plugins/mac/PluginPackageMac.cpp:
-        (WebCore::PluginPackage::fetchInfo):
-        (WebCore::PluginPackage::isPluginBlacklisted):
-
-2008-12-03  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Fix non-Mac build.
-
-        * page/Chrome.cpp: (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
-
-2008-12-03  David Levin  <levin@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Remove uses of document() in XMLHttpRequest where simple.
-        https://bugs.webkit.org/show_bug.cgi?id=22619
-
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::responseXML):
-        Return NULL in the worker case which is according to spec (and avoids using document()).
-
-        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
-        (WebCore::XMLHttpRequest::initSend):
-        Use scriptExecutionContext() instead of document().
-
-2008-12-03  David Levin  <levin@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Make ScriptExecutionContextTaskWorkerTask::performTask a pure virtual function.
-        https://bugs.webkit.org/show_bug.cgi?id=22642
-
-        * dom/Document.cpp:
-        (WebCore::ScriptExecutionContextTaskTimer::ScriptExecutionContextTaskTimer):
-        (WebCore::ScriptExecutionContextTaskTimer::fired):
-        (WebCore::PerformTaskContext::PerformTaskContext):
-        (WebCore::performTask):
-        (WebCore::Document::postTask):
-        * dom/Document.h:
-        * dom/ScriptExecutionContext.cpp:
-        * dom/ScriptExecutionContext.h:
-        * dom/WorkerContext.cpp:
-        (WebCore::ScriptExecutionContextTaskWorkerTask::create):
-        (WebCore::ScriptExecutionContextTaskWorkerTask::ScriptExecutionContextTaskWorkerTask):
-        (WebCore::ScriptExecutionContextTaskWorkerTask::performTask):
-        (WebCore::WorkerContext::postTask):
-        * dom/WorkerContext.h:
-
-2008-12-03  Dmitry Titov  <dimich@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Using ActiveDOMObject as base class for DOMTimer.
-        https://bugs.webkit.org/show_bug.cgi?id=22620
-
-        Using ActiveDOMObject simplifies the code because ActiveDOMObject
-        is wired for stop/pause/resume on loading/unloading/caching the page etc
-        so the timer-specific code that does the same can be removed.
-        In addition, timers can be now paused/resumed 'in place' which
-        makes it unnecessary to 'serialize' them into special PausedTimeouts
-        instance, so pause/resumeTimeouts implementation in JSDOMWindowBase can also be removed.
-        Also, moving TimeoutMap from JSDOMWindowBase to Document matches lifetime
-        of timeouts and makes it possible to not roundtrip them via PausedTimeouts 
-        every time when JSDOMWindow wrapper is destroyed while the page is in the b/f cache.
-
-        Timeouts are now paused with other ActiveDOMObjects:
-        - before creating CachedPage in FrameLoader::commitProvisionalLoad()
-        - in JavaScriptDebugServer::setJavaScriptPaused
-        - during modal UI operations in Chrome::*
-        this is equivalent to previous usage of JSDOMWindowBase::pauseTimeouts()
-
-        Timeouts are stopped to prevent future firing from:
-        - FrameLoader::clear()
-        - FrameLoader::frameDetached()
-        this is equivalent to previous usage of JSDOMWindowBase::clearAllTimeouts()
-
-        This is also one of the steps to having timers in Workers. See the plan of
-        the next steps in the bug above.
-
-        * bindings/js/DOMTimer.cpp:
-        (WebCore::DOMTimer::DOMTimer):
-        (WebCore::DOMTimer::fired):
-        (WebCore::DOMTimer::hasPendingActivity):
-        (WebCore::DOMTimer::contextDestroyed):
-        (WebCore::DOMTimer::stop):
-        (WebCore::DOMTimer::suspend):
-        (WebCore::DOMTimer::resume):
-        (WebCore::DOMTimer::canSuspend): Implemented ActiveDOMObject methods.
-
-        * bindings/js/DOMTimer.h:
-        * bindings/js/JSDOMBinding.cpp: ActiveDOMObject can have no JS wrapper
-        (WebCore::markActiveObjectsForContext): 
-
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::~JSDOMWindowBase):
-        (WebCore::JSDOMWindowBase::clear):
-        (WebCore::JSDOMWindowBase::installTimeout):
-        (WebCore::JSDOMWindowBase::removeTimeout):
-        (WebCore::JSDOMWindowBase::timerFired):
-        (WebCore::JSDOMWindowBase::disconnectFrame):
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/ScriptController.cpp:
-        * bindings/js/ScriptController.h:
-
-        * dom/Document.cpp: Document now holds a hash map id->timeout
-        (WebCore::Document::addTimeout):
-        (WebCore::Document::removeTimeout):
-        (WebCore::Document::findTimeout):
-        * dom/Document.h:
-        * history/CachedPage.cpp:
-        (WebCore::CachedPage::CachedPage):
-        (WebCore::CachedPage::restore):
-        (WebCore::CachedPage::clear):
-        * history/CachedPage.h:
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::~JavaScriptDebugServer):
-        (WebCore::JavaScriptDebugServer::setJavaScriptPaused):
-        * inspector/JavaScriptDebugServer.h:
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::commitProvisionalLoad): 
-        removed clearAllTimeouts since all ActiveDOMObjects will be stopped in FrameLoader::clear();
-        I don't see how the old comment can be correct - the code in the same method proceeds to invoke 'onunload'
-        and then calls into client which can be external code and can cause any active object created in onunload
-        to fire. We can stop them all before firing onunload but it does not make a lot of sense.
-        I have a test to go with the next patch which verifies that timers set in onunload do not fire.
-
-        (WebCore::FrameLoader::open):
-        * page/Chrome.cpp:
-        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
-        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
-
-2008-12-03  Justin Garcia  <justin.garcia@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        <rdar://problem/6018653> Extra blank line when pasting paragraph in plain text
-        
-        In SnowLeopard, Mail occasionally adds an empty, unstyled paragraph at the
-        end of pasted content so that users don't get stuck with non-standard pargraph
-        spacing.  This content threw off our handling of interchange newlines.  Any interchange
-        newline, regardless of it's position in the incoming fragment was considered to be
-        "at the start" of the fragment, and would result in us inserting in a newline before 
-        inserted content.  This patch makes the checks for interchange newlines more strict, 
-        and treats interchange newlines found elsewhere as normal <br>s.
-
-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::ReplacementFragment::ReplacementFragment):
-        (WebCore::ReplacementFragment::removeInterchangeNodes):
-        * editing/VisiblePosition.cpp:
-        (WebCore::VisiblePosition::init):
-        (WebCore::VisiblePosition::canonicalPosition):
-        * editing/VisiblePosition.h:
-
-2008-12-03  Eric Seidel  <eric@webkit.org>
-
-        Rubber-stamped by David Hyatt.
-
-        Bring the WebCore chromium build a couple steps closer to building.
+        https://bugs.webkit.org/show_bug.cgi?id=26392
+        Bug 26392: In html, modification of xlink:href of an newly inserted svg image does not work.
+        https://bugs.webkit.org/show_bug.cgi?id=26328
+        Bug 26328: changing href attribute of svg images does not work when changing display attribute as well
 
-        * WebCore.scons:
+        React to href updates even when there is no renderer, i.e. display=none.
 
-2008-12-03  Kevin Ollivier  <kevino@theolliviers.com>
+        Tests: svg/custom/js-update-image-and-display.svg
+               svg/custom/js-update-image-and-display2.svg
+               svg/custom/js-update-image-and-display3.svg
 
-        wx build fix.
-
-        * WebCoreSources.bkl:
-
-2008-12-03  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22636
-
-        Implement WML variable substitution & validation.
-        Created a framework for scriptable WML layout tests, that are able to test variable substiution & validation.
-
-        Tests: wml/variable-reference-invalid-character.html
-               wml/variable-reference-valid.html
-
-        * wml/WMLVariables.cpp:
-        (WebCore::isValidFirstVariableNameCharacter):
-        (WebCore::isValidVariableNameCharacter):
-        (WebCore::isValidVariableEscapingModeString):
-        (WebCore::isValidVariableName):
-        (WebCore::containsVariableReference):
-        (WebCore::substituteVariableReferences):
-        * wml/WMLVariables.h:
-
-2008-12-03  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Further preparations for WML layout tests.
-        - Enable variable substitution in Text.cpp - if the parent is a WMLElement derived class.
-        - Dump WMLMessageSource messages to the console, just like it's done for JSMessageSource
-        - Add helper method in Document.idl, to reset the WML page state to a well-known default state.
-          (will be used in the upcoming LayoutTests/wml testcases)
-
-         * dom/Document.cpp:
-        (WebCore::Document::resetWMLPageState):
-        * dom/Document.h:
-        * dom/Document.idl:
-        * dom/Text.cpp:
-        (WebCore::Text::insertedIntoDocument):
-        * dom/Text.h:
-        * page/Console.cpp:
-        (WebCore::Console::addMessage):
-        * wml/WMLPageState.h: Readd heper function
-        (WebCore::WMLPageState::hasVariables):
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::svgAttributeChanged):
 
-2008-12-03  Antti Koivisto  <antti@apple.com>
+2009-06-24  David Hyatt  <hyatt@apple.com>
 
         Reviewed by Sam Weinig.
 
-        Don't leak selectors in case selector list parsing failed.
-
-        * css/CSSGrammar.y:
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::~CSSParser):
-
-2008-12-03  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Fix https://bugs.webkit.org/show_bug.cgi?id=22520
+        https://bugs.webkit.org/show_bug.cgi?id=26687
 
-        This is a regression (causes a crash of LayoutTests/animations/transform-animation-event-destroy-element.html).
-        This patch fixes the testcase.
+        Add basic back-end column support to datagrid.
 
-        This is another case of animations getting destroyed in the end animation callback and causing dangling
-        pointers on return. This one involves iterating over the CompositeAnimation, which has been destroyed.
-        So I now check for a null m_object pointer (which is nullified when the CompositeAnimation is destroyed)
-        and skip that call.
+        Added fast/dom/HTMLDataGridElement/ column tests.
 
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::updateStateMachine):
-
-2008-12-03  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22379
-        Make CSSOM use less memory
-
-        Reduce size of the CSSSelector by one more pointer by using an array
-        instead of a linked list to store them.
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * css/CSSGrammar.y:
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::CSSParser):
-        (WebCore::CSSParser::parseSelector):
-        (WebCore::CSSParser::createStyleRule):
-        * css/CSSParser.h:
-        (WebCore::CSSParser::reusableSelectorVector):
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::CSSSelector):
-        (WebCore::CSSSelector::~CSSSelector):
-        (WebCore::CSSSelector::isLastInSelectorList):
-        (WebCore::CSSSelector::setLastInSelectorList):
-        * css/CSSStyleRule.cpp:
-        (WebCore::CSSStyleRule::CSSStyleRule):
-        (WebCore::CSSStyleRule::~CSSStyleRule):
-        (WebCore::CSSStyleRule::selectorText):
-        * css/CSSStyleRule.h:
-        (WebCore::CSSStyleRule::adoptSelectorVector):
-        (WebCore::CSSStyleRule::selectorList):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSRuleSet::addRulesFromSheet):
-        * dom/Node.cpp:
-        (WebCore::forEachSelector):
-        (WebCore::selectorNeedsNamespaceResolution):
-        (WebCore::Node::querySelector):
-        (WebCore::Node::querySelectorAll):
-        * dom/SelectorNodeList.cpp:
-        (WebCore::createSelectorNodeList):
-        * dom/SelectorNodeList.h:
-
-2008-12-03  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22630
-        Assertion failure in XMLHttpRequest::contextDestroyed
-
-        Test: http/tests/xmlhttprequest/close-window.html
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::clear):
-        (WebCore::FrameLoader::commitProvisionalLoad):
-        Move stopping active objects to clear(), so that closing a window is also covered.
-
-        * xml/XMLHttpRequest.cpp: (WebCore::XMLHttpRequest::abort): Protect the object in abort(),
-        because internalAbort() deref()'s.
-
-2008-12-03  Dean Jackson  <dino@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Implement CSS 3 <angle> turn unit and support it
-        in rotations.
-        https://bugs.webkit.org/show_bug.cgi?id=22497
-
-        * css/CSSGrammar.y:
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::validUnit):
-        (WebCore::unitFromString):
-        (WebCore::CSSParser::lex):
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::cssText):
-        (WebCore::CSSPrimitiveValue::parserValue):
-        * css/CSSPrimitiveValue.h:
-        (WebCore::CSSPrimitiveValue::):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::createTransformOperations):
-        * css/tokenizer.flex:
-
-2008-12-03  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Nikolas Zimmermann.
-
-        Make use of the gradient code in GraphicsContext and get rid of most of the
-        platform dependent code.
-
-        SVG should use the new Gradient support on GraphicsContext
-        https://bugs.webkit.org/show_bug.cgi?id=20543
-
-        * GNUmakefile.am:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * platform/graphics/FloatSize.h:
-        (WebCore::FloatSize::shrunkTo):
-        * svg/SVGLinearGradientElement.cpp:
-        (WebCore::SVGLinearGradientElement::buildGradient):
-        * svg/SVGRadialGradientElement.cpp:
-        (WebCore::SVGRadialGradientElement::buildGradient):
-        * svg/graphics/SVGPaintServer.h:
-        * svg/graphics/SVGPaintServerGradient.cpp:
-        (WebCore::SVGPaintServerGradient::SVGPaintServerGradient):
-        (WebCore::SVGPaintServerGradient::~SVGPaintServerGradient):
-        (WebCore::SVGPaintServerGradient::gradient):
-        (WebCore::SVGPaintServerGradient::setGradient):
-        (WebCore::findTextRootObject):
-        (WebCore::createMaskAndSwapContextForTextGradient):
-        (WebCore::clipToTextMask):
-        (WebCore::SVGPaintServerGradient::setup):
-        (WebCore::SVGPaintServerGradient::renderPath):
-        (WebCore::SVGPaintServerGradient::teardown):
-        * svg/graphics/SVGPaintServerGradient.h:
-        (WebCore::SVGPaintServerGradient::setGradientStops):
-        (WebCore::SVGPaintServerGradient::gradientStops):
-        * svg/graphics/SVGPaintServerLinearGradient.h:
-        * svg/graphics/SVGPaintServerRadialGradient.h:
-        * svg/graphics/cairo/SVGPaintServerGradientCairo.cpp: Removed.
-        * svg/graphics/cg/SVGPaintServerCg.cpp:
-        * svg/graphics/cg/SVGPaintServerGradientCg.cpp: Removed.
-        * svg/graphics/qt/SVGPaintServerGradientQt.cpp: Removed.
-        * svg/graphics/qt/SVGPaintServerLinearGradientQt.cpp: Removed.
-        * svg/graphics/qt/SVGPaintServerRadialGradientQt.cpp: Removed.
-
-2008-12-03  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Fix formatting.
-
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::createRareData):
-
-2008-12-03  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Adam Roben.
-
-        As Adam Roben noticed, synchronize MessageSource enum with Console.js, and add a comment.
-
-        * inspector/front-end/Console.js:
-        * page/Console.h:
-
-2008-12-03  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Next steps to make LayoutTests work:
-        Never access the main frame from WMLRefreshElement/WMLCardElement, but
-        the current documents frame (WML layout tests will run in an <iframe>)
-
-        Prepare WMLErrorHandling for the case that no tokenizer is available anymore
-        -> report errors through Console::addMessage(), so they get logged in the
-           expected layout test results.
-
-        * wml/WMLCardElement.cpp:
-        (WebCore::WMLCardElement::setActiveCardInDocument):
-        * wml/WMLErrorHandling.cpp:
-        (WebCore::reportWMLError):
-        (WebCore::errorMessageForErrorCode):
-        * wml/WMLErrorHandling.h:
-        * wml/WMLRefreshElement.cpp:
-        (WebCore::WMLRefreshElement::executeTask):
-        * page/Console.cpp: Handle WMLMessageSource.
-        (WebCore::printMessageSourceAndLevelPrefix):
-        * page/Console.h: Add WMLMessageSource.
-        (WebCore::):
-
-2008-12-03  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon Hausmann.
-
-        Allow passing jsNull and jsUndefined to Qt plugins
-
-        Currently limited to functions with QString and QVariant arguments,
-        and properties of these types. Both jsNull and jsUndefined ends up
-        as default-constructed QStrings and QVariants, which means you can
-        check for isEmpty() and isValid() in the native plugin code.
-
-        Based on patches by Jade Han <jade.han@nokia.com>
-
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::convertValueToQVariant):
-        (JSC::Bindings::findMethodIndex):
-
-2008-12-03  Trenton Schulz  <trenton.schulz@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Fix the build with Qt for Mac OS X.
-
-        * platform/PurgeableBuffer.h: Use the dummy wrappers for now.
-
-2008-12-03  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Fix error handling in WMLSetvarElement. If an invalid variable reference is contained
-        in the 'name' attribute of <setvar>, a 'WMLErrorInvalidVariableName' error should be
-        reported, instead of 'WMLErrorInvalidVariableReference'.
-
-        * wml/WMLElement.cpp:
-        (WebCore::WMLElement::parseValueSubstitutingVariableReferences):
-        (WebCore::WMLElement::parseValueForbiddingVariableReferences):
-        * wml/WMLElement.h:
-        * wml/WMLSetvarElement.cpp:
-        (WebCore::WMLSetvarElement::parseMappedAttribute):
-        * wml/WMLSetvarElement.h:
-        (WebCore::WMLSetvarElement::name):
-        (WebCore::WMLSetvarElement::value):
-
-2008-12-03  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Preparations to get WML layout tests going.
-        Make WMLPageState an OwnPtr to Page, and let Page create it on demand.
-
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        (WebCore::Page::wmlPageState):
-        * page/Page.h:
-        * wml/WMLDocument.cpp:
-        (WebCore::WMLDocument::WMLDocument):
-        (WebCore::WMLDocument::finishedParsing):
-        (WebCore::wmlPageStateForDocument):
-        * wml/WMLPageState.h: Don't inherit from RefCounted anymore.
-        (WebCore::WMLPageState::hasVariables): Remove helper function.
-
-2008-12-03  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22627
-        fast/workers/worker-terminate.html fails randomly
-
-        The problem is that worker termination uses script timeouts, so an InterruptedExecutionError
-        is raised, and it sometimes reaches the main thread.
-
-        * dom/WorkerMessagingProxy.cpp:
-        (WebCore::WorkerExceptionTask::create):
-        (WebCore::WorkerExceptionTask::WorkerExceptionTask):
-        (WebCore::WorkerExceptionTask::performTask):
-        (WebCore::WorkerMessagingProxy::postWorkerException):
-        * dom/WorkerMessagingProxy.h:
-        Ignore exceptions that happen in terminated workers.
-
-2008-12-03  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Remove some unncessary includes.
-
-        * wml/WMLAccessElement.cpp:
-        * wml/WMLDocument.h:
-        * wml/WMLRefreshElement.cpp:
-
-2008-12-03  Alexey Proskuryakov  <ap@webkit.org>
-
-        Rubber-stamped by Cameron Zwarich and Adam Roben.
-
-        Fix a typo: m_executionForbidded.
-
-        * bindings/js/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::WorkerScriptController):
-        (WebCore::WorkerScriptController::evaluate):
-        (WebCore::WorkerScriptController::forbidExecution):
-        * bindings/js/WorkerScriptController.h:
-
-2008-12-03  Dean McNamee  <deanm@chromium.org>
-
-        Bug 22623: Uninitialized memory access in cache parsing code
-        <https://bugs.webkit.org/show_bug.cgi?id=22623>
-
-        Reviewed by David Kilzer.
-
-        Initialize m_haveParsedCacheControlHeader and m_haveParsedPragmaHeader.
-
-        * platform/network/ResourceResponseBase.h:
-        (WebCore::ResourceResponseBase::ResourceResponseBase):
-
-2008-12-03  Antti Koivisto  <antti@apple.com>
-
-        Probable build fix.
-
         * WebCoreSources.bkl:
-
-2008-12-03  Antti Koivisto  <antti@apple.com>
-
-        Forgot to commit these.
-
-        * dom/Node.cpp:
-        (WebCore::forEachTagSelector):
-        (WebCore::SelectorNeedsNamespaceResolutionFunctor::operator()):
-        (WebCore::Node::querySelector):
-        * dom/SelectorNodeList.cpp:
-        (WebCore::createSelectorNodeList):
-
-2008-12-03  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Dan Bernstein and Mark Rowe.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22379
-        Make CSSOM use less memory
-
-        Reduce size of the CSSSelector by 3/8 by moving rarely used fields to a rare data
-        struct. Browsing around with some instrumentation showed that ~0.1% of all selectors
-        encountered had rare data.
-        
-        This also eliminates the CSSNthSelector subclass which will make possible to store
-        CSSSelectors in an array instead of a linked list for futher memory savings.
-
-        * css/CSSGrammar.y:
-        * css/CSSNthSelector.cpp: Removed.
-        * css/CSSNthSelector.h: Removed.
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::createFloatingSelector):
-        * css/CSSParser.h:
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::specificity):
-        (WebCore::CSSSelector::operator==):
-        (WebCore::CSSSelector::selectorText):
-        (WebCore::CSSSelector::setTagHistory):
-        (WebCore::CSSSelector::attribute):
-        (WebCore::CSSSelector::setAttribute):
-        (WebCore::CSSSelector::setArgument):
-        (WebCore::CSSSelector::setSimpleSelector):
-        (WebCore::CSSSelector::parseNth):
-        (WebCore::CSSSelector::matchNth):
-        (WebCore::CSSSelector::RareData::parseNth):
-        (WebCore::CSSSelector::RareData::matchNth):
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::CSSSelector):
-        (WebCore::CSSSelector::~CSSSelector):
-        (WebCore::CSSSelector::tagHistory):
-        (WebCore::CSSSelector::hasAttribute):
-        (WebCore::CSSSelector::argument):
-        (WebCore::CSSSelector::simpleSelector):
-        (WebCore::CSSSelector::RareData::RareData):
-        (WebCore::CSSSelector::createRareData):
-        (WebCore::CSSSelector::):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkSelector):
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
-
-2008-12-03  Jian Li  <jianli@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Remove unneeded included file in WorkerThread.cpp.
-        https://bugs.webkit.org/show_bug.cgi?id=22613
-
-        * dom/WorkerThread.cpp: No need to include JSWorkerContext.h.
-
-2008-12-02  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22543
-        Consolidate ActiveDOMObject page cache interaction
-
-        Test: http/tests/xmlhttprequest/abort-on-leaving-page.html
-
-        * dom/ActiveDOMObject.cpp:
-        (WebCore::ActiveDOMObject::canSuspend):
-        (WebCore::ActiveDOMObject::suspend):
-        (WebCore::ActiveDOMObject::resume):
-        * dom/ActiveDOMObject.h:
-        * dom/ScriptExecutionContext.cpp:
-        (WebCore::ScriptExecutionContext::canSuspendActiveDOMObjects):
-        (WebCore::ScriptExecutionContext::suspendActiveDOMObjects):
-        (WebCore::ScriptExecutionContext::resumeActiveDOMObjects):
-        * dom/ScriptExecutionContext.h:
-        Added methods for suspending and resuming active objects.
-
-        * dom/Worker.cpp:
-        (WebCore::Worker::canSuspend):
-        (WebCore::Worker::stop):
-        * dom/Worker.h:
-        Workers cannot be suspended yet. This is a change in behavior, as workers used to keep
-        running until their owner was destroyed.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::stopLoading): No longer call stopActiveDOMObjects() here, because
-        their activity is not necessarily loading.
-        (WebCore::FrameLoader::canCachePage): Can only cache if all active objects can be suspended.
-        Previously, stopLoading() cancelled outstanding XMLHttpRequests, which made the page
-        uncacheable due to no-null main document error.
-        (WebCore::FrameLoader::commitProvisionalLoad): Suspend or stop active objects, depending on
-        whether the document will be cached.
-        (WebCore::FrameLoader::frameDetached): Stop active objects to let them clean up before their
-        context is destroyed.
-
-        * xml/XMLHttpRequest.h: added canSuspend().
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::canSuspend): Only XHRs that are not loading can be suspended.
-        (WebCore::XMLHttpRequest::stop): Call abort() instead of internalAbort() to dispatch events
-        for Firefox compatibility. This is a change in behavior that helps test that requests do
-        get aborted.
-        (WebCore::XMLHttpRequest::contextDestroyed): The request must have been stopped by now, so
-        assert that.
-
-2008-12-02  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        Bug 22606: Can <th> serves as the AXTitleUIElement for <td>?
-
-        Test: accessibility/th-as-title-ui.html
-
-        * page/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::isGroup):
-        * page/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::isGroup):
-        * page/AccessibilityRenderObject.h:
-        * page/AccessibilityTableCell.cpp:
-        (WebCore::AccessibilityTableCell::rowIndexRange):
-        (WebCore::AccessibilityTableCell::columnIndexRange):
-        (WebCore::AccessibilityTableCell::titleUIElement):
-        * page/AccessibilityTableCell.h:
-        * page/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
-
-2008-12-02  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        https://bugs.webkit.org/show_bug.cgi?id=22472
-        
-        Override absoluteClippedOverflowRect() in RenderReplaced to return a rect
-        that is large enough to encompass the selection, so that the repainting of
-        selected replaced elements works correctly.
-        
-        Test: fast/repaint/selected-replaced.html
-
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::selectionRect):
-        (WebCore::RenderReplaced::localSelectionRect):
-        (WebCore::RenderReplaced::absoluteClippedOverflowRect):
-        * rendering/RenderReplaced.h:
-
-2008-12-02  Gregory Hughes  <ghughes@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        Bug 22513: ZOOM: text selection does not send correct zoom bounds
-
-        When zoomed, text selection must send the zoom bounds in flipped
-        screen coordinates.
-
-        * editing/mac/SelectionControllerMac.mm:
-        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
-        * page/mac/WebCoreViewFactory.h:
-
-2008-12-02  Dean Jackson  <dino@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Remove support for 'now' from CSS (was
-        erroneously added to transition and animation delay)
-        https://bugs.webkit.org/show_bug.cgi?id=22571
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseAnimationDelay):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::mapAnimationDelay):
-        * css/CSSValueKeywords.in:
-
-2008-12-02  Eric Seidel  <eric@webkit.org>
-
-        Build fix, no review.
-
-        Fix the Mac and gtk builds:
-        Don't use a float to hold a double.
-        Remove a now duplicate symbol.
-
-        * page/Frame.cpp:
-        (WebCore::Frame::selectionLayoutChanged):
-        * platform/gtk/TemporaryLinkStubs.cpp:
-
-2008-12-02  Chris Fleizach  <cfleizach@apple.com>
-
-        Bug 22596: Some elements don't report AXBlockQuoteLevel
-        https://bugs.webkit.org/show_bug.cgi?id=22596
- 
-        Reviewed by John Sullivan.
-
-        * page/mac/AccessibilityObjectWrapper.mm:
-        (blockquoteLevel):
-        (AXAttributeStringSetBlockquoteLevel):
-        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
-
-2008-12-02  Dean McNamee  <deanm@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        Correctly handle a theme returning a non-blinking interval.  We should
-        not set any timers when the interval is 0 (non-blinking), otherwise we
-        repeatedly set and destroy a blinking timer, causing a paint and timer
-        storm.  This is applicable to GTK and Windows, where a user can set a
-        non-blinking caret in their system preferences.
-
-        Renamed caretBlinkFrequency to the more accurate caretBlinkInterval.
-
-        * page/Frame.cpp:
-        (WebCore::Frame::selectionLayoutChanged):
-        * platform/Theme.h:
-        (WebCore::Theme::caretBlinkInterval):
-        * platform/gtk/RenderThemeGtk.cpp:
-        (WebCore::RenderThemeGtk::caretBlinkInterval):
-        * platform/gtk/RenderThemeGtk.h:
-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::caretBlinkInterval):
-
-2008-12-02  David Levin  <levin@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22538
-        
-        startsWith uses find which searches through the whole string if no match is found.
-        Using reverseFind with an index of 0 has the benefit of only searching for the match
-        at the beginning of the string.  This may only be a small benefit in the overall program,
-        but it may help in some cases when the string is big.
-
-        No observable change in behavior, so no test.
- 
-        * platform/text/StringImpl.h:
-        (WebCore::StringImpl::startsWith):
-
-2008-10-29  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Wrap a JSC-only hack in a USE(JSC) block to fix the v8 build.
-        https://bugs.webkit.org/show_bug.cgi?id=21951
-
-        * svg/SVGElementInstance.cpp:
-        (WebCore::SVGElementInstance::forgetWrapper):
-
-2008-12-02  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Add an ASSERT to try and catch the root cause of:
-        https://bugs.webkit.org/show_bug.cgi?id=22168
-        http://code.google.com/p/chromium/issues/detail?id=4122
-
-        * editing/TextIterator.cpp:
-        (WebCore::TextIterator::emitText):
-
-2008-12-02  Brent Fulgham  <bfulgham@gmail.com>
+        * html/DataGridColumn.cpp: Added.
+        (WebCore::DataGridColumn::setPrimary):
+        * html/DataGridColumn.h: Added.
+        (WebCore::DataGridColumn::create):
+        (WebCore::DataGridColumn::id):
+        (WebCore::DataGridColumn::setId):
+        (WebCore::DataGridColumn::label):
+        (WebCore::DataGridColumn::setLabel):
+        (WebCore::DataGridColumn::type):
+        (WebCore::DataGridColumn::setType):
+        (WebCore::DataGridColumn::sortable):
+        (WebCore::DataGridColumn::setSortable):
+        (WebCore::DataGridColumn::sortDirection):
+        (WebCore::DataGridColumn::setSortDirection):
+        (WebCore::DataGridColumn::primary):
+        (WebCore::DataGridColumn::detachFromColumnList):
+        (WebCore::DataGridColumn::DataGridColumn):
+        * html/DataGridColumn.idl: Added.
+        * html/DataGridColumnList.cpp: Added.
+        (WebCore::DataGridColumnList::~DataGridColumnList):
+        (WebCore::DataGridColumnList::itemWithName):
+        (WebCore::DataGridColumnList::add):
+        (WebCore::DataGridColumnList::remove):
+        (WebCore::DataGridColumnList::move):
+        (WebCore::DataGridColumnList::clear):
+        (WebCore::DataGridColumnList::primaryColumnChanged):
+        * html/DataGridColumnList.h: Added.
+        (WebCore::DataGridColumnList::create):
+        (WebCore::DataGridColumnList::length):
+        (WebCore::DataGridColumnList::item):
+        (WebCore::DataGridColumnList::primaryColumn):
+        (WebCore::DataGridColumnList::sortColumn):
+        * html/DataGridColumnList.idl: Added.
+        * html/HTMLDataGridColElement.cpp:
+        (WebCore::HTMLDataGridColElement::sortable):
+        (WebCore::HTMLDataGridColElement::setSortable):
+        (WebCore::HTMLDataGridColElement::sortDirection):
+        (WebCore::HTMLDataGridColElement::setSortDirection):
+        * html/HTMLDataGridColElement.h:
+        * html/HTMLDataGridColElement.idl:
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
+        * html/HTMLDataGridElement.h:
+        (WebCore::HTMLDataGridElement::columns):
+        * html/HTMLDataGridElement.idl:
+        * rendering/RenderDataGrid.cpp:
+        (WebCore::RenderDataGrid::paintObject):
+        (WebCore::RenderDataGrid::paintColumnHeaders):
+        (WebCore::RenderDataGrid::rebuildColumns):
+        * rendering/RenderDataGrid.h:
+        (WebCore::RenderDataGrid::gridElement):
+
+2009-06-24  Jessie Berlin  <jberlin@apple.com>
 
         Reviewed by Adam Roben.
 
-        Remove some CG-specific code from the Windows Cairo build.
-        https://bugs.webkit.org/show_bug.cgi?id=22586
-
-        No new test cases since this update should create no user-visible
-        changes, and should be fully covered by the existing regression
-        tests.
-
-        * WebCore.vcproj/WebCore.vcproj: Remove FontDatabase from
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        (WebCore::focusRingColor): Add stub method
-        * platform/win/TemporaryLinkStubs.cpp:
-        (WebCore::populateFontDatabase): Add stub method.
-
-2008-12-01 Laszlo Gombos <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        MinGW compilation fix for PluginPackageWin.cpp
-
-        https://bugs.webkit.org/show_bug.cgi?id=22585
-
-        * plugins/win/PluginPackageWin.cpp:
-        (WebCore::PluginPackage::fetchInfo):
-
-2008-12-02  Adam Roben  <aroben@apple.com>
-
-        Build fix for Windows projects with NOMINMAX defined globally
-
-        * platform/win/COMPtr.h: Don't redefine NOMINMAX if it's already
-        defined.
-
-2008-12-02  Simon Hausmann  <hausmann@webkit.org>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Build JavaScriptCore into libQtWebKit.so through a direct build
-        instead of a static library. When linking a static library into
-        a shared library qmake generates an incorrect .prl file, which
-        causes all sorts of different build problems when linking against
-        QtWebKit. Fixing this in qmake requires bigger changes that are
-        currently not possible, so we need to work around this limitation
-        for now. The advantages of the separate build did not outweight the
-        build problems it caused.
-
-        * WebCore.pro: include JavaScriptCore.pri, re-enable prl support
-        and rename the lut generator to domlut to avoid a conflict with
-        JavaScriptCore.pri's lut generator.
-
-2008-12-02  David Levin  <levin@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22588
-        Move securityOrigin() from Document and WorkerContext into ScriptExecutionContext.
-
-        No observable change in behavior, so no test.
+        Partially fixes: https://bugs.webkit.org/show_bug.cgi?id=24735
+        (<rdar://problem/5015942>)
+        Where on windows it was not possible to set an element as the drag
+        image using setDragImage on the dataTransfer object.
         
-        * dom/Document.cpp:
-        (WebCore::Document::open):
-        (WebCore::Document::domain):
-        (WebCore::Document::setDomain):
-        (WebCore::Document::initSecurityContext):
-        (WebCore::Document::setSecurityOrigin):
-        * dom/Document.h:
-        * dom/ScriptExecutionContext.cpp:
-        (WebCore::ScriptExecutionContext::setSecurityOrigin):
-        * dom/ScriptExecutionContext.h:
-        (WebCore::ScriptExecutionContext::securityOrigin):
-        * dom/WorkerContext.cpp:
-        (WebCore::WorkerContext::WorkerContext):
-        * dom/WorkerContext.h:
-        These changes are for the move of securityOrigin().
+        Does not "fix" the case of dragging a link where the default link image
+        is still used, even when the -webkit-user-drag is set to "element". This
+        is the same behavior as is found on OS X.
         
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::createRequest):
-        (WebCore::XMLHttpRequest::makeSimpleCrossSiteAccessRequest):
-        (WebCore::XMLHttpRequest::makeCrossSiteAccessRequestWithPreflight):
-        (WebCore::XMLHttpRequest::handleAsynchronousPreflightResult):
-        (WebCore::XMLHttpRequest::setRequestHeader):
-        (WebCore::XMLHttpRequest::getAllResponseHeaders):
-        (WebCore::XMLHttpRequest::getResponseHeader):
-        (WebCore::XMLHttpRequest::processSyncLoadResults):
-        (WebCore::XMLHttpRequest::willSendRequest):
-        (WebCore::XMLHttpRequest::accessControlCheck):
-        (WebCore::XMLHttpRequest::didReceiveResponsePreflight):
-        Change XMLHttpRequest to use ScriptExecutionContext instead of Document to access securityOrigin().
-
-2008-12-02  André Pönitz  <apoenitz@trolltech.com>
-
-        Reviewed by Simon Hausmann.
-
-        Disable the creation of debug information for the Qt build when done
-        inside Qt. With 670 mb it was slowing down gdb start significantly
-        for third-party applications that usually don't need it.
-
-        * WebCore.pro:
-
-2008-12-01  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=13736 REGRESSION 
-        (r19811): Using the down arrow in a textarea gets "stuck" at the 
-        end of a wrapped line
-        And corresponding: <rdar://problem/5347931>
-
-        The basic problem here is that Position::getInlineBoxAndOffset() 
-        failed to look beyond a single renderer. This patch looks for a 
-        better match beyond the first renderer when the affinity is 
-        downstream and we failed to find a "perfect" match. 
-        * dom/Position.cpp:
-        (WebCore::isNonTextLeafChild):
-        (WebCore::searchAheadForBetterMatch):
-        (WebCore::Position::getInlineBoxAndOffset):
-
-        This is a fix I made based on code inspection. It looks like the 
-        old code here and skipped over the parent as a possible match. 
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::nextInPreOrderAfterChildren):
-
-2008-12-01  Brent Fulgham  <bfulgham@gmail.com>
+        Added a manual test because it is not possible to check that what is
+        contained in the image snapshot is indeed the requested element.
 
-        Reviewed by Adam Roben.
+        * dom/Clipboard.h:
+        (WebCore::Clipboard::dragImageElement):
+        Made getting the raw pointer from the RefPtr a const operation.
+        * manual-tests/drag-with-div-or-image-as-data-image.html: Added.
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::createDragImage):
+        Get an image of the rendered element and its subtree.
 
-        Add WML related files to Visual Studio projects.
-        https://bugs.webkit.org/show_bug.cgi?id=22561
+2009-06-24  Darin Fisher  <darin@chromium.org>
 
-        * WebCore.vcproj/WebCore.vcproj:
-          1. Add files from the wml directory to the set of windows files.
-          2. Extend include paths with new wml directory. 
-          3. Add new autogenerated WML files to DerivedSources.
-          4. Alphabetize preprocesor includes (holdover from earlier debugging).
+        Reviewed by David Levin.
 
-2008-12-01  Steve Falkenburg  <sfalken@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=26683
+        Fix Chromium build bustage: Add custom binding for HTMLDataGridElement.dataSource
 
-        Revise node/selection image fix.
-        Moved updateLayout call so selection rect is fetched after the layout.
-        
-        Reviewed by Adam Roben.
+        This change just adds a stub implementation for now to help fix the build.
 
-        * page/win/FrameCGWin.cpp:
-        (WebCore::imageFromRect):
-        (WebCore::imageFromSelection):
-        (WebCore::Frame::nodeImage):
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8HTMLDataGridElementCustom.cpp: Added.
 
-2008-12-01  Steve Falkenburg  <sfalken@apple.com>
+2009-06-24  David Kilzer  <ddkilzer@apple.com>
 
-        Support needed to implement renderedImage for Windows.
-        https://bugs.webkit.org/show_bug.cgi?25648
+        Build fixes for ENABLE(PLUGIN_PROXY_FOR_VIDEO)
 
         Reviewed by Adam Roben.
 
-        * page/Frame.h:
-        * page/win/FrameCGWin.cpp:
-        (WebCore::imageFromRect):
-        (WebCore::imageFromSelection):
-        (WebCore::Frame::nodeImage):
-        * page/win/FrameCairoWin.cpp:
-        (WebCore::imageFromNode):
-
-2008-12-01  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein
-
-        https://bugs.webkit.org/show_bug.cgi?id=22581
-        
-        Fix the painting of the caps lock indicator for transformed text inputs,
-        by replacing a call to absoluteContentBox() with code that computes the
-        painting rect for the input contents.
-
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::paint):
-
-2008-12-01  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::deliverNotification): Removed
+        ExceptionCode parameter from togglePlayState().
+        (WebCore::HTMLMediaElement::initialURL): Don't convert a KURL
+        object to a String when assigning to a KURL variable.
 
-        Add two new helper functions to WMLElement, parseValueSubstitutingVariableReferences/parseValueForbiddingVariableReferences.
+2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
 
-        Convert all elements to parse their attribute values using these new helper functions. This simplifies the
-        actual attribute parsing code in all WMLElement derived classes, as most WML attribute values either report
-        an error if there's a variable reference used in the attribute value, or if it's invalid.
+        Reviewed by Adam Treat.
 
-        Split the WMLErrorInvalidVariableReference error which covered both 'invalid syntax' / 'wrong location'
-        in two seperated error codes: WMLErrorInvalidVariableReference / WMLErrorInvalidVariableReferenceLocation.
+        Save memory by not storing attribute values in member variables, if not absolutely needed.
+        Also fixes bugs where we're substituting variables too early (noticeable with the upcoming <select> element).
 
-        * wml/WMLAccessElement.cpp:
-        (WebCore::WMLAccessElement::parseMappedAttribute):
         * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::defaultEventHandler):
         (WebCore::WMLDoElement::parseMappedAttribute):
-        * wml/WMLElement.cpp:
-        (WebCore::WMLElement::parseValueSubstitutingVariableReferences):
-        (WebCore::WMLElement::parseValueForbiddingVariableReferences):
-        * wml/WMLElement.h:
-        * wml/WMLErrorHandling.cpp:
-        (WebCore::reportWMLError):
-        * wml/WMLErrorHandling.h:
-        (WebCore::):
-        * wml/WMLOnEventElement.cpp:
-        (WebCore::WMLOnEventElement::parseMappedAttribute):
-        * wml/WMLPrevElement.cpp:
-        (WebCore::WMLPrevElement::executeTask):
+        (WebCore::WMLDoElement::label):
+        * wml/WMLDoElement.h:
+        * wml/WMLFieldSetElement.cpp:
+        (WebCore::WMLFieldSetElement::insertedIntoDocument):
+        * wml/WMLFieldSetElement.h:
+        * wml/WMLOptGroupElement.cpp:
+        (WebCore::WMLOptGroupElement::title):
+        (WebCore::WMLOptGroupElement::parseMappedAttribute):
+        (WebCore::WMLOptGroupElement::groupLabelText):
+        * wml/WMLOptGroupElement.h:
+        * wml/WMLPostfieldElement.cpp:
+        (WebCore::WMLPostfieldElement::name):
+        (WebCore::WMLPostfieldElement::value):
+        (WebCore::WMLPostfieldElement::encodeData):
+        * wml/WMLPostfieldElement.h:
         * wml/WMLSetvarElement.cpp:
         (WebCore::WMLSetvarElement::parseMappedAttribute):
+        (WebCore::WMLSetvarElement::name):
+        (WebCore::WMLSetvarElement::value):
+        * wml/WMLSetvarElement.h:
         * wml/WMLTimerElement.cpp:
         (WebCore::WMLTimerElement::parseMappedAttribute):
-
-2008-12-01  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Fix switching active cards within a document. No way to test, until <go> support is implemented.
-
-        * wml/WMLCardElement.cpp:
-        (WebCore::WMLCardElement::showCard):
-        (WebCore::WMLCardElement::hideCard):
-        (WebCore::WMLCardElement::setActiveCardInDocument):
-        * wml/WMLCardElement.h:
-
-2008-12-01  David Kilzer  <ddkilzer@apple.com>
-
-        Fix logic error in LegacyWebArchive::create() from r38884.
-
-        * loader/archive/cf/LegacyWebArchive.cpp:
-        (WebCore::LegacyWebArchive::create): Only continue if the
-        subresource is actually added.
-
-2008-12-01  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 22466: REGRESSION (35867): Many resources missing when saving webarchive of webkit.org
-
-        <https://bugs.webkit.org/show_bug.cgi?id=22466>
-        <rdar://problem/6403593>
-
-        Reviewed by Brady Eidson.
-
-        Test: http/tests/webarchive/test-preload-resources.html
-
-        * loader/archive/cf/LegacyWebArchive.cpp:
-        (WebCore::LegacyWebArchive::create): Check the WebCore cache for
-        resources if DocumentLoader::subresource() doesn't return them.
-        Note that the DocumentLoader::subresource() method returned
-        preloaded resources before r35867, but this caused a regression in
-        Mail.
-
-2008-12-01  Julien Chaffraix  <jchaffraix@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Bug 22564: Make HTML elements' constructors take a QualifiedName
-        https://bugs.webkit.org/show_bug.cgi?id=22564
-
-        - Modified the remaining HTML elements' constructors to take a QualifiedName.
-
-        - Added an assertion that the QualifiedName given corresponds to the element constructed.
-
-        * bindings/js/JSAudioConstructor.cpp:
-        (WebCore::constructAudio):
-        * html/HTMLAudioElement.cpp:
-        (WebCore::HTMLAudioElement::HTMLAudioElement):
-        * html/HTMLAudioElement.h:
-        * html/HTMLBRElement.cpp:
-        (WebCore::HTMLBRElement::HTMLBRElement):
-        * html/HTMLBRElement.h:
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::setInnerText):
-        * html/HTMLElementFactory.cpp:
-        (WebCore::brConstructor):
-        (WebCore::quoteConstructor):
-        (WebCore::marqueeConstructor):
-        (WebCore::audioConstructor):
-        (WebCore::videoConstructor):
-        (WebCore::sourceConstructor):
-        * html/HTMLMarqueeElement.cpp:
-        (WebCore::HTMLMarqueeElement::HTMLMarqueeElement):
-        * html/HTMLMarqueeElement.h:
-        * html/HTMLQuoteElement.cpp:
-        (WebCore::HTMLQuoteElement::HTMLQuoteElement):
-        * html/HTMLQuoteElement.h:
-        * html/HTMLSourceElement.cpp:
-        (WebCore::HTMLSourceElement::HTMLSourceElement):
-        * html/HTMLSourceElement.h:
-        * html/HTMLVideoElement.cpp:
-        (WebCore::HTMLVideoElement::HTMLVideoElement):
-        * html/HTMLVideoElement.h:
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::updateFromElement):
-
-2008-12-01  Julien Chaffraix  <jchaffraix@webkit.org>
-
-        Reviewed by Antti Koivisto.
-
-        Bug 22441: Bridge the gap between the generated ElementFactory and HTMLElementFactory
-        https://bugs.webkit.org/show_bug.cgi?id=22441
-
-        Add an assertion to the modified HTML elements' constructor
-        to check that the QualifiedName parameter is the one that
-        matches the Element's.
-
-        * html/HTMLBaseElement.cpp:
-        (WebCore::HTMLBaseElement::HTMLBaseElement):
-        * html/HTMLBlockquoteElement.cpp:
-        (WebCore::HTMLBlockquoteElement::HTMLBlockquoteElement):
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::HTMLBodyElement):
-        * html/HTMLButtonElement.cpp:
-        (WebCore::HTMLButtonElement::HTMLButtonElement):
-        * html/HTMLDListElement.cpp:
-        (WebCore::HTMLDListElement::HTMLDListElement):
-        * html/HTMLDirectoryElement.cpp:
-        (WebCore::HTMLDirectoryElement::HTMLDirectoryElement):
-        * html/HTMLDivElement.cpp:
-        (WebCore::HTMLDivElement::HTMLDivElement):
-        * html/HTMLFieldSetElement.cpp:
-        (WebCore::HTMLFieldSetElement::HTMLFieldSetElement):
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::HTMLFormElement):
-        * html/HTMLFrameElement.cpp:
-        (WebCore::HTMLFrameElement::HTMLFrameElement):
-        * html/HTMLFrameSetElement.cpp:
-        (WebCore::HTMLFrameSetElement::HTMLFrameSetElement):
-        * html/HTMLHeadElement.cpp:
-        (WebCore::HTMLHeadElement::HTMLHeadElement):
-        * html/HTMLHtmlElement.cpp:
-        (WebCore::HTMLHtmlElement::HTMLHtmlElement):
-        * html/HTMLIFrameElement.cpp:
-        (WebCore::HTMLIFrameElement::HTMLIFrameElement):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::HTMLInputElement):
-        * html/HTMLIsIndexElement.cpp:
-        (WebCore::HTMLIsIndexElement::HTMLIsIndexElement):
-        * html/HTMLKeygenElement.cpp:
-        (WebCore::HTMLKeygenElement::HTMLKeygenElement):
-        * html/HTMLLIElement.cpp:
-        (WebCore::HTMLLIElement::HTMLLIElement):
-        * html/HTMLLabelElement.cpp:
-        (WebCore::HTMLLabelElement::HTMLLabelElement):
-        * html/HTMLLegendElement.cpp:
-        (WebCore::HTMLLegendElement::HTMLLegendElement):
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::HTMLLinkElement):
-        * html/HTMLMenuElement.cpp:
-        (WebCore::HTMLMenuElement::HTMLMenuElement):
-        * html/HTMLMetaElement.cpp:
-        (WebCore::HTMLMetaElement::HTMLMetaElement):
-        * html/HTMLOListElement.cpp:
-        (WebCore::HTMLOListElement::HTMLOListElement):
-        * html/HTMLOptGroupElement.cpp:
-        (WebCore::HTMLOptGroupElement::HTMLOptGroupElement):
-        * html/HTMLOptionElement.cpp:
-        (WebCore::HTMLOptionElement::HTMLOptionElement):
-        * html/HTMLSelectElement.cpp:
-        (WebCore::HTMLSelectElement::HTMLSelectElement):
-        * html/HTMLStyleElement.cpp:
-        (WebCore::HTMLStyleElement::HTMLStyleElement):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
-        * html/HTMLTitleElement.cpp:
-        (WebCore::HTMLTitleElement::HTMLTitleElement):
-        * html/HTMLUListElement.cpp:
-        (WebCore::HTMLUListElement::HTMLUListElement):
-
-2008-12-01  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22046
-
-        Fixed another case of crashing because the animation object is getting deleted when
-        it's in the middle of a callback. I actually moved where I am retaining the pointer
-        up out of the lower level AnimationBase code and into the timer callback that calls
-        them. So now the pointer is valid throughout the entire sequence of callback code.
-
-        The testcase for https://bugs.webkit.org/show_bug.cgi?id=22052 also exhibits a
-        crash which this patch fixes. 
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::updateStateMachine):
-        (WebCore::AnimationBase::animationTimerCallbackFired):
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimationPrivate::setAnimationStartTime):
-        (WebCore::CompositeAnimationPrivate::setTransitionStartTime):
-        (WebCore::CompositeAnimationPrivate::styleAvailable):
-        * page/animation/ImplicitAnimation.cpp:
-        (WebCore::ImplicitAnimation::sendTransitionEvent):
-        * page/animation/KeyframeAnimation.cpp:
-        (WebCore::KeyframeAnimation::sendAnimationEvent):
-        (WebCore::KeyframeAnimation::resumeOverriddenAnimations):
-
-2008-12-01  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon Hausmann.
-
-        [Qt/Mac] Initialize NPAPI plugins before getting their entry points
-
-        The old behavior (calling NP_GetEntryPoints before NP_Initialize) was
-        copied from Windows, but caused Silverlight on Mac to crash when loaded.
-
-        Apparently the call order of NP_Initialize and NP_GetEntryPoints is
-        reversed on Mac. See https://bugzilla.mozilla.org/show_bug.cgi?id=344425
-
-        Reported-by: Peter Johnson <peter@zattoo.com>
-
-        * plugins/mac/PluginPackageMac.cpp:
-        (WebCore::PluginPackage::load):
-
-2008-11-30  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by John Sullivan.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22510
-        Crash at WebCore::AccessibilityRenderObject::activeDescendant() on Google Reader with ARIA (22510)
-
-        A nil pointer needed to be checked
-
-        * page/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::activeDescendant):
-
-2008-11-30  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22530
-        Assertion failures seen on buildbot due to uninitialized WorkerThread::m_threadID
-
-        * dom/WorkerThread.cpp:
-        (WebCore::WorkerThread::start): Protect worker startup with a mutex to ensure that this
-        function runs to completion before the thread begins execution.
-        (WebCore::WorkerThread::workerThread): Updated comments.
-        (WebCore::WorkerThread::stop): Ditto.
-        * dom/WorkerThread.h: Renamed m_workerContextMutex to m_threadCreationMutex, because it now
-        protects startup as a whole.
-
-        * storage/DatabaseThread.cpp:
-        * storage/DatabaseThread.h:
-        * storage/LocalStorageThread.cpp:
-        * storage/LocalStorageThread.h:
-        Fixed the same m_threadID problem.
-
-2008-11-29  Brent Fulgham  <bfulgham@gmail.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Remove Visual Studio project dependencies on non-redistributable
-        components in the Debug_Cairo and Release_Cairo build targets.
-        See https://bugs.webkit.org/show_bug.cgi?id=22527
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2008-11-29  Sam Weinig  <sam@webkit.org>
-
-        Rubber-stamped by Alexey Proskuryakov.
-
-        Fix some sorting
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2008-11-28  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21063
-        NULL pointer crash in dispatchEvent(null);
-
-        Test: fast/events/dispatchEvent-crash.html
-
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::dispatchEvent):
-        * dom/Worker.cpp:
-        (WebCore::Worker::dispatchEvent):
-        * dom/WorkerContext.cpp:
-        (WebCore::WorkerContext::dispatchEvent):
-        * loader/appcache/DOMApplicationCache.cpp:
-        (WebCore::DOMApplicationCache::dispatchEvent):
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::dispatchEvent):
-        * xml/XMLHttpRequestUpload.cpp:
-        (WebCore::XMLHttpRequestUpload::dispatchEvent):
-
-2008-11-29  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=22454
-          <rdar://problem/6405550> REGRESSION (3.2-TOT): Crash below FontFallbackList::fontDataAt on jacobian.org
-
-        Test: http/tests/misc/font-face-in-multiple-segmented-faces.html
-
-        The crash happened because style recalculation was invoked by
-        CSSFontSelector after one CSSSegmentedFontFace had pruned its tables but
-        before another CSSSegmentedFontFace using the same CSSFontFace had done
-        so. The fix is to let all CSSSegmentedFontFaces using the CSSFontFace
-        prune their tables before telling the CSSFontSelector to recalc style.
-
-        * css/CSSFontFace.cpp:
-        (WebCore::CSSFontFace::fontLoaded):
-        * css/CSSFontSelector.cpp:
-        (WebCore::CSSFontSelector::fontLoaded):
-        * css/CSSFontSelector.h:
-        * css/CSSSegmentedFontFace.cpp:
-        (WebCore::CSSSegmentedFontFace::fontLoaded):
-
-2008-11-29  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=14968
-        document.open() erroneously returns void instead of the new Document
-
-        Test: fast/dom/HTMLDocument/document-open-return-value.html
-
-        * bindings/js/JSHTMLDocumentCustom.cpp: (WebCore::JSHTMLDocument::open):
-        Return the document on which this method was invoked, per HTML5.
-
-2008-11-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22550
-
-        Add <timer> element support. It provides a way to execute a task with a delay.
-        The user is notified by firing the task associated with the <card>'s ontimer attribute.
-        Only one timer element is allowed per <card> (fix wrong error message in reportWMLError)
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * wml/WMLCardElement.cpp:
-        (WebCore::WMLCardElement::WMLCardElement):
-        (WebCore::WMLCardElement::setIntrinsicEventTimer):
-        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded):
-        * wml/WMLCardElement.h:
-        * wml/WMLDoElement.cpp:
-        (WebCore::WMLDoElement::defaultEventHandler):
-        * wml/WMLErrorHandling.cpp:
-        (WebCore::reportWMLError):
-        * wml/WMLPageState.h:
-        (WebCore::WMLPageState::getVariable):
-        * wml/WMLPrevElement.cpp:
-        (WebCore::WMLPrevElement::executeTask):
-        * wml/WMLRefreshElement.cpp:
-        (WebCore::WMLRefreshElement::executeTask):
-        * wml/WMLTagNames.in:
-        * wml/WMLTimerElement.cpp: Added.
-        (WebCore::WMLTimerElement::WMLTimerElement):
-        (WebCore::WMLTimerElement::parseMappedAttribute):
         (WebCore::WMLTimerElement::insertedIntoDocument):
         (WebCore::WMLTimerElement::timerFired):
         (WebCore::WMLTimerElement::start):
-        (WebCore::WMLTimerElement::stop):
-        (WebCore::WMLTimerElement::storeIntervalToPageState):
-        * wml/WMLTimerElement.h: Added.
-
-2008-11-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        (WebCore::WMLTimerElement::value):
+        * wml/WMLTimerElement.h:
 
-        Reviewed by Holger Freyther.
+2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
 
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22549
+        Reviewed by Adam Roben.
 
-        Add <do> element support. It provides a way to bind a task element to a <template>/<card> element. 
-        Changes numerous of layout tests which contain <do> elements, as they render as buttons now.
+        Forgot to initialize m_task member variable. Results in crashes sometimes.
 
-        * WebCore.xcodeproj/project.pbxproj:
-        * rendering/RenderButton.cpp:
-        (WebCore::RenderButton::updateFromElement):
-        * wml/WMLCardElement.cpp:
-        (WebCore::WMLCardElement::registerDoElement):
-        * wml/WMLCardElement.h:
-        * wml/WMLDoElement.cpp: Added.
-        (WebCore::WMLDoElement::WMLDoElement):
-        (WebCore::WMLDoElement::defaultEventHandler):
-        (WebCore::WMLDoElement::parseMappedAttribute):
-        (WebCore::WMLDoElement::insertedIntoDocument):
-        (WebCore::WMLDoElement::createRenderer):
-        (WebCore::WMLDoElement::recalcStyle):
-        * wml/WMLDoElement.h: Added.
-        (WebCore::WMLDoElement::registerTask):
-        (WebCore::WMLDoElement::isActive):
-        (WebCore::WMLDoElement::label):
-        (WebCore::WMLDoElement::name):
-        (WebCore::WMLDoElement::setActive):
-        (WebCore::WMLDoElement::setNoop):
-        * wml/WMLNoopElement.cpp:
-        (WebCore::WMLNoopElement::insertedIntoDocument):
-        * wml/WMLTagNames.in:
-        * wml/WMLTaskElement.cpp:
-        (WebCore::WMLTaskElement::insertedIntoDocument):
+        * wml/WMLAnchorElement.cpp:
+        (WebCore::WMLAnchorElement::WMLAnchorElement):
 
-2008-11-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+2009-06-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
 
-        Reviewed by Sam Weinig.
+        Not reviewed. Forgot to include within last patch.
 
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22545
+        * manual-tests/wml/card-title-attr.wml: Added.
 
-        Add onenterforward/onenterbackward/ontimer support for <card> elements.
+2009-06-24  Wajahat Siddiqui <wajahatmeister@gmail.com>
+ 
+        Reviewed by Nikolas Zimmermann.
 
-        No testing possible at the moment because WMLGoElement is not yet implemented.
-        After that we can add tests covering the <card> event handling.
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26474
+        Adding WML <card> title attribute handling.
 
+        * wml/WMLElement.h: marking parseValueSubstitutingVariableReferences and parseValueForbiddingVariableReferences as const
+        * wml/WMLElement.cpp:
+        * wml/WMLCardElement.h: 
+        (WebCore::WMLCardElement::title):
         * wml/WMLCardElement.cpp:
-        (WebCore::WMLCardElement::WMLCardElement):
-        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded):
-        (WebCore::WMLCardElement::parseMappedAttribute):
-        (WebCore::WMLCardElement::setActiveCardInDocument):
-        * wml/WMLCardElement.h:
-        (WebCore::WMLCardElement::isNewContext):
-        (WebCore::WMLCardElement::isOrdered):
-        * wml/WMLDocument.cpp:
-        (WebCore::WMLDocument::finishedParsing):
-        * wml/WMLIntrinsicEvent.cpp:
-        (WebCore::WMLIntrinsicEvent::WMLIntrinsicEvent):
-        * wml/WMLIntrinsicEvent.h:
-        (WebCore::WMLIntrinsicEvent::create):
-
-2008-11-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Regression seen on QtWebKit - causes a build failure on Win using MinGW
-
-        https://bugs.webkit.org/show_bug.cgi?id=22536
-
-        * WebCore.pro:
-
-2008-11-28  Simon Hausmann  <hausmann@webkit.org>
+        * wml/manual-test/card-title-attr.wml: Manual test  
+ 
+2009-06-24  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Reviewed by Tor Arne Vestbø.
 
-        Fix compilation and linking on Windows CE.
-
-        Use WIN_OS instead of WIN and therefore exclude determineModuleVersionFromDescription()
-        from the Windows'ish build.
-
-        Link against the newly required mmtimer.
-
-        * WebCore.pro:
-        * plugins/PluginPackage.cpp:
-
-2008-11-28  David Levin  <levin@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        http://bugs.webkit.org/show_bug.cgi?id=22524
-
-        Made static initializations in XMLHttpRequest.cpp thread-safe in preparation for usage
-        of XMLHttpRequest by Workers (on threads).
+        Fix the build without ENABLE_VIDEO.
 
-        No observable change in behavior, so no test.
+        * html/CanvasRenderingContext2D.cpp: Add #if ENABLE guards.
+        * html/CanvasRenderingContext2D.h: Ditto.
 
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequestStaticData::XMLHttpRequestStaticData):
-        (WebCore::PreflightResultCacheItem::allowsCrossSiteMethod):
-        (WebCore::PreflightResultCacheItem::allowsCrossSiteHeaders):
-        (WebCore::PreflightResultCacheItem::allowsRequest):
-        (WebCore::createXMLHttpRequestStaticData):
-        (WebCore::initializeXMLHttpRequestStaticData):
-        (WebCore::XMLHttpRequest::XMLHttpRequest):
-        (WebCore::XMLHttpRequest::isSafeRequestHeader):
-        (WebCore::XMLHttpRequest::isOnAccessControlResponseHeaderWhitelist):
-        * xml/XMLHttpRequest.h:
-
-2008-11-27  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        r38825, was committed without checking whether anything in WebCore
-        uses JSFunction::m_body. Use the appropriate getters and setters
-        instead.
-
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
-
-2008-11-27  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22529
-        Crashes seen on buildbots due to trying to stop a worker thread twice
-
-        * dom/WorkerMessagingProxy.cpp: (WebCore::WorkerMessagingProxy::workerObjectDestroyed):
-        Don't try to stop the thread if it's already stopping.
-
-2008-11-27  Kent Hansen  <khansen@trolltech.com>
+2009-06-24  Siddhartha Chattopadhyay  <sidchat@google.com>
 
-        Reviewed by Simon Hausmann.
-
-        Make JavaScript bindings for Qt plugin widgets work again
-        this was a regression; need to handle non-NPAPI plugins as in 4.4.
-
-        * bindings/js/ScriptControllerQt.cpp:
-        (WebCore::ScriptController::createScriptInstanceForWidget):
-
-2008-11-26  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        Reviewed by Eric Seidel.
 
-        Reviewed by George Staikos.
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26200 which I introduced earlier. I had
+        the smartReplace set TRUE initially, which was wrong since the purpose of this call is
+        to just replace the selection, and place the caret at the end of the selection it replaced.
 
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22522
+        * editing/Editor.cpp:
+        (WebCore::Editor::markMisspellingsAfterTypingToPosition):
+        * manual-tests/textarea-caret-position-after-auto-spell-correct.html: Added.
 
-        Catch WML errors (invalid variable name/reference, multiple access elements, etc)
-        while parsing the document, and stop parsing immediately and wrap the document
-        fragment in a XHTML error document, just like it's done from XML parsing errors.
+2009-06-24  Kevin Watters  <kevinwatters@gmail.com>
 
-        Until now all card elements were hidden by default (no renderer created), and
-        WMLDocument::finishedParsing() took care of showing the right card (either the first,
-        or any named card in the document, specified by document URL reference). Change this
-        behaviour to support displaying partially parsed WML document fragments: Mark the first
-        WMLCardElement inserted into the document as visible. If the document parsing finishes
-        without problems, WMLDocument::finishedParsing() will be called, which takes care of
-        showing the desired card (common case: first card in the document, which is already
-        visible, so nothing actually has to be done). If an error occours, the document is
-        correctly rendered until the error happened - wrapped in a XHTML document.
+        Reviewed by Kevin Ollivier.
 
-        Fixes: fast/wml/err-event-binding-conflict.wml
-               fast/wml/err-invalid-variable-name.wml
-               fast/wml/err-multi-access.wml
-               fast/wml/err-unallowed-task-in-anchor.wml
+        Don't use an unsigned int for intervalInMS because we sometimes initialize
+        it with a negative value.
 
-        * WebCore.xcodeproj/project.pbxproj:
-        * wml/WMLAccessElement.cpp:
-        (WebCore::WMLAccessElement::parseMappedAttribute):
-        (WebCore::WMLAccessElement::insertedIntoDocument):
-        * wml/WMLAccessElement.h:
-        * wml/WMLCardElement.cpp:
-        (WebCore::WMLCardElement::insertedIntoDocument):
-        (WebCore::WMLCardElement::setActiveCardInDocument):
-        * wml/WMLCardElement.h:
-        * wml/WMLDocument.cpp:
-        (WebCore::WMLDocument::finishedParsing):
-        * wml/WMLErrorHandling.cpp: Added.
-        (WebCore::reportWMLError):
-        * wml/WMLErrorHandling.h: Added.
-        (WebCore::):
-        * wml/WMLIntrinsicEventHandler.cpp:
-        (WebCore::WMLIntrinsicEventHandler::registerIntrinsicEvent):
-        * wml/WMLIntrinsicEventHandler.h:
-        * wml/WMLNoopElement.cpp:
-        (WebCore::WMLNoopElement::insertedIntoDocument):
-        * wml/WMLOnEventElement.cpp:
-        (WebCore::WMLOnEventElement::parseMappedAttribute):
-        (WebCore::WMLOnEventElement::registerTask):
-        * wml/WMLPageState.cpp:
-        (WebCore::WMLPageState::setNeedCheckDeckAccess):
-        * wml/WMLPageState.h:
-        * wml/WMLSetvarElement.cpp:
-        (WebCore::WMLSetvarElement::parseMappedAttribute):
+        * platform/wx/SharedTimerWx.cpp:
+        (WebCore::setSharedTimerFireTime):
 
-2008-11-26  Glenn Wilson  <gwilson@chromium.org>
+2009-06-24  Eric Seidel  <eric@webkit.org>
 
-        Reviewed by Dan Bernstein.
+        No review, build fix only.
 
-        Fixed bug http://bugs.webkit.org/show_bug.cgi?id=21953
+        The previous checkin had an improper merge.  This fixes the build.
 
-        This fixes the crash when the small-caps font variant is used
-        on a lower-case glyph that does not have a corresponding
-        upper-case glyph defined in the set of available fonts.
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDocumentDrag):
 
-        This changes Font.cpp to check if the font being used exists before trying to apply the small-caps variant.
-        
-        Test: fast/css/small-caps-crash.html
+2009-06-05  Eric Seidel  <eric@webkit.org>
 
-        * platform/graphics/Font.cpp:
-        (WebCore::Font::glyphDataForCharacter):
+        Reviewed by Oliver Hunt.
 
-2008-11-26  Tony Chang  <tony@chromium.org>
+        https://bugs.webkit.org/show_bug.cgi?id=25922
+        JS setting dropEffect = "none" causes tryDHTMLDrag
+        to return DragOperationNone.  Which is also the value
+        tryDHTMLDrag previously used to indicate JS did not
+        want to handle the drag.
 
-        Reviewed by Oliver Hunt.
+        Make it possible for the DragController::try* methods
+        to return a bool to indicate if javascript accepted
+        or rejected the drag event, separate from the DragOperation.
 
-        Add a new platform specific method cleanupAfterSystemDrag
-        that platforms can ue to clean up drag state after a
-        system drag.  Use this method on PLAFORM(MAC).
-        https://bugs.webkit.org/show_bug.cgi?id=21956
+        Tests:
+        - fast/events/drag-to-navigate.html
+        - fast/events/prevent-drag-to-navigate.html
 
-        * ChangeLog:
         * page/DragController.cpp:
-        (WebCore::DragController::doSystemDrag):
+        (WebCore::DragController::dragEnteredOrUpdated):
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::defaultOperationForDrag):
+        (WebCore::DragController::tryDHTMLDrag):
         * page/DragController.h:
-        * page/gtk/DragControllerGtk.cpp:
-        (WebCore::DragController::cleanupAfterSystemDrag):
-        * page/mac/DragControllerMac.mm:
-        (WebCore::DragController::cleanupAfterSystemDrag):
-        * page/qt/DragControllerQt.cpp:
-        (WebCore::DragController::cleanupAfterSystemDrag):
-        * page/win/DragControllerWin.cpp:
-        (WebCore::DragController::cleanupAfterSystemDrag):
-        * page/wx/DragControllerWx.cpp:
-      (WebCore::DragController::cleanupAfterSystemDrag):
-
-2008-11-26  Nikolas Zimmermann  <zimmermann@kde.org>
 
-        Reviewed by Oliver Hunt.
-
-        Fix path to string logic, correctly taking closed (sub-)paths into account.
-        Code was just broken on cg, observed by Dirk Schulze.
+2009-06-23  Oliver Hunt  <oliver@apple.com> and Eric Carlson  <eric.carlson@apple.com>
 
-        QPainterPath doesn't seem to expose any functionality to detect closed sub paths,
-        using the elementAt() function. There might be a workaround - Dirk will investigate.
+        Reviewed by Sam Weinig and Dave Hyatt.
 
-        * platform/graphics/cg/PathCG.cpp:
-        (WebCore::CGPathToCFStringApplierFunction):
-        * platform/graphics/cairo/PathCairo.cpp:
-        (WebCore::Path::debugString):
+        <rdar://problem/6164797> Add Canvas API to allow drawing of <video> frames
+        <https://bugs.webkit.org/show_bug.cgi?id=25920>
 
-2008-11-26  Darin Fisher  <darin@chromium.org>
+        Add support for drawing the contents of the video element to the canvas
+        in accordance with the current HTML5 draft.
 
-        Reviewed by Eric Seidel.
+        Test: media/video-canvas.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=22519
-        Remove unnecessary include.
-
-        * dom/XMLTokenizer.cpp:
-
-2008-11-26  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Oliver Hunt.
-
-        Add <noop> element support, completing the task element support.
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * wml/WMLNoopElement.cpp: Added.
-        (WebCore::WMLNoopElement::WMLNoopElement):
-        (WebCore::WMLNoopElement::insertedIntoDocument):
-        * wml/WMLNoopElement.h: Added.
-        * wml/WMLTagNames.in: Reorganize file a bit.
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext2D::drawImage):
+          Standard custom bindings stuff we need to do for all canvas methods.
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::size): Helper function for finding the size of a video element
+        (WebCore::CanvasRenderingContext2D::checkOrigin): moved up in the file.
+        (WebCore::CanvasRenderingContext2D::drawImage): The various overloads of HTML5's drawImage(<video>)
+        * html/CanvasRenderingContext2D.h:
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::hasSingleSecurityOrigin):
+          hasSingleSecurityOrigin is needed for security, currently all implementations are trivial
+          as we force QT to maintain a single origin.
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::paint): 
+            Paint routine on video so we don't have to look at MediaPlayer directly
+        * html/HTMLVideoElement.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::hasSingleSecurityOrigin):
+        (WebCore::MediaPlayer::hasSingleSecurityOrigin):
+            Default implementations of hasSingleSecurityOrigin
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
+            A video may need a player now even if it is not visible.
+        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
+            Always return true due to restrictions we've placed on QT.
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::paint):
+            Jump through some hoops to allow windows QT to draw to an intermediate buffer.
+            In the long term we'd like to cache the HDC, but this will do for now.
+        (WebCore::MediaPlayerPrivate::hasSingleSecurityOrigin):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+            As for Mac we force QT to only allow same origin loads.
 
-2008-11-26  Julien Chaffraix  <jchaffraix@webkit.org>
+2009-06-23  Adam Langley  <agl@google.com>
 
         Reviewed by Eric Seidel.
 
-        Bug 22441: Bridge the gap between the generated ElementFactory and HTMLElementFactory
-        https://bugs.webkit.org/show_bug.cgi?id=22441
-
-        Make more HTML elements' constructors take a QualifiedName.
-
-        * editing/DeleteButtonController.cpp:
-        (WebCore::DeleteButtonController::createDeletionUI):
-        * html/HTMLBlockquoteElement.cpp:
-        (WebCore::HTMLBlockquoteElement::HTMLBlockquoteElement):
-        * html/HTMLBlockquoteElement.h:
-        * html/HTMLButtonElement.cpp:
-        (WebCore::HTMLButtonElement::HTMLButtonElement):
-        * html/HTMLButtonElement.h:
-        * html/HTMLDListElement.cpp:
-        (WebCore::HTMLDListElement::HTMLDListElement):
-        * html/HTMLDListElement.h:
-        * html/HTMLDirectoryElement.cpp:
-        (WebCore::HTMLDirectoryElement::HTMLDirectoryElement):
-        * html/HTMLDirectoryElement.h:
-        * html/HTMLDivElement.cpp:
-        (WebCore::HTMLDivElement::HTMLDivElement):
-        * html/HTMLDivElement.h:
-        * html/HTMLElementFactory.cpp:
-        (WebCore::styleConstructor):
-        (WebCore::titleConstructor):
-        (WebCore::frameConstructor):
-        (WebCore::framesetConstructor):
-        (WebCore::iframeConstructor):
-        (WebCore::formConstructor):
-        (WebCore::buttonConstructor):
-        (WebCore::inputConstructor):
-        (WebCore::isindexConstructor):
-        (WebCore::fieldsetConstructor):
-        (WebCore::keygenConstructor):
-        (WebCore::labelConstructor):
-        (WebCore::legendConstructor):
-        (WebCore::optgroupConstructor):
-        (WebCore::optionConstructor):
-        (WebCore::selectConstructor):
-        (WebCore::textareaConstructor):
-        (WebCore::dlConstructor):
-        (WebCore::ulConstructor):
-        (WebCore::olConstructor):
-        (WebCore::dirConstructor):
-        (WebCore::menuConstructor):
-        (WebCore::liConstructor):
-        (WebCore::blockquoteConstructor):
-        (WebCore::divConstructor):
-        (WebCore::headingConstructor):
-        * html/HTMLFieldSetElement.cpp:
-        (WebCore::HTMLFieldSetElement::HTMLFieldSetElement):
-        * html/HTMLFieldSetElement.h:
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::HTMLFormElement):
-        * html/HTMLFormElement.h:
-        * html/HTMLFrameElement.cpp:
-        (WebCore::HTMLFrameElement::HTMLFrameElement):
-        * html/HTMLFrameElement.h:
-        * html/HTMLFrameSetElement.cpp:
-        (WebCore::HTMLFrameSetElement::HTMLFrameSetElement):
-        * html/HTMLFrameSetElement.h:
-        * html/HTMLIFrameElement.cpp:
-        (WebCore::HTMLIFrameElement::HTMLIFrameElement):
-        * html/HTMLIFrameElement.h:
-        * html/HTMLInputElement.cpp:
-        * html/HTMLInputElement.h:
-        * html/HTMLIsIndexElement.cpp:
-        (WebCore::HTMLIsIndexElement::HTMLIsIndexElement):
-        * html/HTMLIsIndexElement.h:
-        * html/HTMLKeygenElement.cpp:
-        (WebCore::HTMLKeygenElement::HTMLKeygenElement):
-        * html/HTMLKeygenElement.h:
-        * html/HTMLLIElement.cpp:
-        (WebCore::HTMLLIElement::HTMLLIElement):
-        * html/HTMLLIElement.h:
-        * html/HTMLLabelElement.cpp:
-        (WebCore::HTMLLabelElement::HTMLLabelElement):
-        * html/HTMLLabelElement.h:
-        * html/HTMLLegendElement.cpp:
-        (WebCore::HTMLLegendElement::HTMLLegendElement):
-        * html/HTMLLegendElement.h:
-        * html/HTMLMenuElement.cpp:
-        (WebCore::HTMLMenuElement::HTMLMenuElement):
-        * html/HTMLMenuElement.h:
-        * html/HTMLOListElement.cpp:
-        (WebCore::HTMLOListElement::HTMLOListElement):
-        * html/HTMLOListElement.h:
-        * html/HTMLOptGroupElement.cpp:
-        (WebCore::HTMLOptGroupElement::HTMLOptGroupElement):
-        * html/HTMLOptGroupElement.h:
-        * html/HTMLOptionElement.cpp:
-        (WebCore::HTMLOptionElement::HTMLOptionElement):
-        * html/HTMLOptionElement.h:
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::formCreateErrorCheck):
-        (WebCore::HTMLParser::handleIsindex):
-        * html/HTMLSelectElement.cpp:
-        * html/HTMLSelectElement.h:
-        * html/HTMLStyleElement.cpp:
-        (WebCore::HTMLStyleElement::HTMLStyleElement):
-        * html/HTMLStyleElement.h:
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
-        * html/HTMLTextAreaElement.h:
-        * html/HTMLTitleElement.cpp:
-        (WebCore::HTMLTitleElement::HTMLTitleElement):
-        * html/HTMLTitleElement.h:
-        * html/HTMLUListElement.cpp:
-        (WebCore::HTMLUListElement::HTMLUListElement):
-        * html/HTMLUListElement.h:
-        * html/HTMLViewSourceDocument.cpp:
-        (WebCore::HTMLViewSourceDocument::createContainingTable):
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlShadowRootElement::MediaControlShadowRootElement):
-        (WebCore::MediaControlInputElement::MediaControlInputElement):
-        * rendering/RenderFileUploadControl.cpp:
-        (WebCore::HTMLFileUploadInnerButtonElement::HTMLFileUploadInnerButtonElement):
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::createPanel):
-        (WebCore::RenderMedia::createTimeDisplay):
-        * rendering/RenderSlider.cpp:
-        (WebCore::HTMLSliderThumbElement::HTMLSliderThumbElement):
-        * rendering/TextControlInnerElements.cpp:
-        (WebCore::TextControlInnerElement::TextControlInnerElement):
-
-2008-11-26  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Sam Weinig.
+        Chromium: Fix crash with inherited font-size in <option>
 
-        Fix obvious problem in WMLPageState constructor, m_page was not set to the passed Page pointer.
+        https://bugs.webkit.org/show_bug.cgi?id=26656
+        http://code.google.com/p/chromium/issues/detail?id=14853
 
-        * wml/WMLPageState.cpp:
-        (WebCore::WMLPageState::WMLPageState):
+        In r42597 (https://bugs.webkit.org/show_bug.cgi?id=25244), I changed
+        the <select> handing for Chromium to fix a rendering bug. However,
+        although the font-size is correctly ignored, getRowHeight wasn't
+        updated and so was calculating the height of the rows in an
+        inconsistent manner. This can lead to a crash.
 
-2008-11-26  Matt Perry  <mpcomplete@gmail.com>
+        * manual-tests/optgroup-empty-and-nested.html: adding test case for crash
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::getRowHeight):
 
-        Fix Qt bustage.
-
-        See https://bugs.webkit.org/show_bug.cgi?id=22051
-
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::extraDefaultStyleSheet):
-
-2008-11-26  Matt Perry  <mpcomplete@gmail.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Fix https://bugs.webkit.org/show_bug.cgi?id=22051
-        Renderthemes should be able to supply additional CSS rules to the core
-        ones.
-
-        * DerivedSources.make:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::parseUASheet):
-        (WebCore::loadFullDefaultStyle):
-        (WebCore::loadSimpleDefaultStyle):
-        * css/themeWin.css: Added.
-        * css/themeWinQuirks.css: Added.
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::extraDefaultStyleSheet):
-        * platform/qt/RenderThemeQt.h:
-        * rendering/RenderTheme.cpp:
-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::extraDefaultStyleSheet):
-        (WebCore::RenderTheme::extraQuirksStyleSheet):
-        * rendering/RenderThemeWin.cpp:
-        (WebCore::RenderThemeWin::extraDefaultStyleSheet):
-        (WebCore::RenderThemeWin::extraQuirksStyleSheet):
-        * rendering/RenderThemeWin.h:
-
-2008-11-26  David Kilzer  <ddkilzer@apple.com>
-
-        Make CSSStyleSheet::addSubresourceURLStrings() iterative
-
-        Part of the fix for Bug 11850: Webarchive fails to save images referenced in CSS
-        <https://bugs.webkit.org/show_bug.cgi?id=11850>
+2009-06-23  Brady Eidson  <beidson@apple.com>
 
+        Patch by Antti Koivisto.
         Reviewed by Brady Eidson.
 
-        * css/CSSStyleSheet.cpp:
-        (WebCore::CSSStyleSheet::addSubresourceURLStrings): Switch algorithm
-        from recursive to iterative for gathering the list of all CSS
-        stylesheets referenced in @import statements.
-
-2008-11-26  Dirk Schulze  <krit@webkit.org>
+        <rdar://problem/6988010> Failed resources not reloaded when built against Tiger SDK
 
-        Reviewed by Simon Hausmann.
+        A latent bug that cache revalidation uncovered.  When a CachedResource failed to load,
+        it should always be revalidated upon reload.
 
-        Transformations to the context shouldn't transform the currentPath.
-        Fixed this on Qt.
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::canUseCacheValidator):
+        (WebCore::CachedResource::mustRevalidate):
 
-        [QT] GraphicsContext's currenPath can be transformed
-        https://bugs.webkit.org/show_bug.cgi?id=22163
+2009-06-23  Dan Bernstein  <mitz@apple.com>
 
-        * platform/graphics/GraphicsContextPrivate.h:
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::restorePlatformState):
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::fillRect):
-        (WebCore::GraphicsContext::translate):
-        (WebCore::GraphicsContext::rotate):
-        (WebCore::GraphicsContext::scale):
-        (WebCore::GraphicsContext::concatCTM):
+        Reviewed by Darin Adler.
 
-2008-11-26  Jan Michael Alonzo  <jmalonzo@webkit.org>
+        - fix <rdar://problem/6634228> Crash in [NSScroller mouseDown:] beneath
+          EventHandler::passMouseDownEventToWidget()
 
-        Gtk build script minor fixes. Not reviewed.
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passMouseDownEventToWidget): Surround the
+        -mouseDown: call with calls to Widget::beforeMouseDown() and
+        Widget::afterMouseDown(), which prevent the widget's view hierarchy from
+        being removed from its parent view while the scroller is tracking the
+        mouse.
 
-        * GNUmakefile.am:
-          - Add ScriptInstance.h (introduced in r38774) to
-        the build.
-          - Move WML and GEOLOCATION conditionals before the SVG
-        conditional to be consistent with the style of the script.
-          - Move GeolocationGtk sources to webcoregtk_sources.
+2009-06-23  Sam Weinig  <sam@webkit.org>
 
-2008-11-26  Dmitry Titov  <dimich@chromium.org>
+        Reviewed by Dave Hyatt.
 
-        Reviewed by Darin Adler and Eric Seidel.
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26516
+        Add initial implementation of DataGridDataSource
 
-        https://bugs.webkit.org/show_bug.cgi?id=22469
+        - Initial implementation only supports the initialize callback function.
 
-        Move the class DOMWindowTimer from JSDOMWindowBase into its own file in
-        preparation to making it work for Workers. For now, just move the code and couple
-        of global variables.
+        Test: fast/dom/HTMLDataGridElement/DataGridDataSource-basic.html
 
+        * WebCore.xcodeproj/project.pbxproj:
         * GNUmakefile.am:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
         * WebCoreSources.bkl:
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::installTimeout):
-        (WebCore::JSDOMWindowBase::pauseTimeouts):
-        (WebCore::JSDOMWindowBase::resumeTimeouts):
-        (WebCore::JSDOMWindowBase::timerFired):
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/DOMTimer.cpp: Added.
-        (WebCore::DOMTimer::DOMTimer):
-        (WebCore::DOMTimer::~DOMTimer):
-        (WebCore::DOMTimer::fired):
-        * bindings/js/DOMTimer.h: Added.
-        (WebCore::DOMTimer::timeoutId):
-        (WebCore::DOMTimer::nestingLevel):
-        (WebCore::DOMTimer::setNestingLevel):
-        (WebCore::DOMTimer::action):
-        (WebCore::DOMTimer::takeAction):
-
-2008-11-25  Darin Fisher  <darin@chromium.org>
-
-        Fix bustage.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22493
-        Need to expose bridge/*.h to the WebKit build.
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2008-11-25  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Not reviewed. Fix build, by removing some wrong last-minute changes.
-
-        * wml/WMLIntrinsicEvent.cpp:
-        (WebCore::createTaskElement):
-        * wml/WMLOnEventElement.cpp:
-        (WebCore::WMLOnEventElement::registerTask):
-
-2008-11-25  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Geoffrey Garen.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22493
-        Abstract away JSC:: usage in WebCore/html
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSPluginElementFunctions.cpp:
-        (WebCore::pluginInstance):
-        * bindings/js/ScriptController.h:
-        * bindings/js/ScriptControllerMac.mm:
-        (WebCore::ScriptController::createScriptInstanceForWidget):
-        * bindings/js/ScriptInstance.h: Added.
-        * html/HTMLPlugInElement.cpp:
-        (WebCore::HTMLPlugInElement::~HTMLPlugInElement):
-        (WebCore::HTMLPlugInElement::getInstance):
-        * html/HTMLPlugInElement.h:
-
-2008-11-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Sam Weinig.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22477
+        * bindings/js/JSDataGridDataSource.cpp: Added.
+        (WebCore::JSDataGridDataSource::JSDataGridDataSource):
+        (WebCore::JSDataGridDataSource::~JSDataGridDataSource):
+        (WebCore::JSDataGridDataSource::initialize):
+        * bindings/js/JSDataGridDataSource.h: Added.
+        (WebCore::JSDataGridDataSource::create):
+        (WebCore::JSDataGridDataSource::isJSDataGridDataSource):
+        (WebCore::JSDataGridDataSource::jsDataSource):
+        (WebCore::asJSDataGridDataSource):
+        * bindings/js/JSHTMLDataGridElementCustom.cpp: Added.
+        (WebCore::JSHTMLDataGridElement::listener):
+        (WebCore::JSHTMLDataGridElement::setListener):
+        * html/DataGridDataSource.h: Added.
+        (WebCore::DataGridDataSource::~DataGridDataSource):
+        (WebCore::DataGridDataSource::isJSDataGridDataSource):
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
+        (WebCore::HTMLDataGridElement::setDataSource):
+        (WebCore::HTMLDataGridElement::initializationTimerFired):
+        * html/HTMLDataGridElement.h:
+        (WebCore::HTMLDataGridElement::dataSource):
+        * html/HTMLDataGridElement.idl:
+
+2009-06-23  Ryosuke Niwa  <rniwa@google.com>
 
-        A WMLTaskElement checks wheter it's parent is an <anchor>/<do>/<onevent> element, and calls registerTask(this) on the parent.
-        Add a isWMLTaskElement() function to WMLElement, making it possible to cast to WMLTaskElement directly.
-
-        Add WMLEventHandlingElement class, inheriting from WMLElement, to serve as common base WMLTemplate/Option/CardElement,
-        centralizing the eventHandler() / createEventHandlerIfNeeded() implementation. Add a isWMLEventHandlingElement()
-        function to WMLElement, so WMLOnEventElement can create event handlers, without knowing wheter it's a
-        <template>/<option> or <card> element.
-
-        Add complete <onevent> support.
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * wml/WMLCardElement.cpp:
-        (WebCore::WMLCardElement::WMLCardElement):
-        (WebCore::WMLCardElement::setActiveCardInDocument):
-        * wml/WMLCardElement.h:
-        (WebCore::WMLCardElement::isVisible):
-        (WebCore::WMLCardElement::setVisible):
-        * wml/WMLElement.h:
-        (WebCore::WMLElement::isWMLTaskElement):
-        * wml/WMLEventHandlingElement.cpp: Added.
-        (WebCore::WMLEventHandlingElement::WMLEventHandlingElement):
-        (WebCore::WMLEventHandlingElement::createEventHandlerIfNeeded):
-        * wml/WMLEventHandlingElement.h: Added.
-        (WebCore::WMLEventHandlingElement::isWMLEventHandlingElement):
-        (WebCore::WMLEventHandlingElement::eventHandler):
-        * wml/WMLOnEventElement.cpp: Added.
-        (WebCore::WMLOnEventElement::WMLOnEventElement):
-        (WebCore::WMLOnEventElement::parseMappedAttribute):
-        (WebCore::WMLOnEventElement::registerTask):
-        * wml/WMLOnEventElement.h: Added.
-        * wml/WMLSetvarElement.cpp:
-        (WebCore::WMLSetvarElement::parseMappedAttribute):
-        (WebCore::WMLSetvarElement::insertedIntoDocument):
-        * wml/WMLTagNames.in:
-        * wml/WMLTaskElement.cpp:
-        (WebCore::WMLTaskElement::insertedIntoDocument):
-        * wml/WMLTaskElement.h:
-        (WebCore::WMLTaskElement::isWMLTaskElement):
-
-2008-11-25  Pierre-Olivier Latour  <pol@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        createFontCustomPlatformData() crashes if CGFontCreateWithPlatformFont() returns NULL
-
-        https://bugs.webkit.org/show_bug.cgi?id=22503
-
-        * platform/graphics/mac/FontCustomPlatformData.cpp:
-        (WebCore::createFontCustomPlatformData):
-
-2008-11-25  Julien Chaffraix  <jchaffraix@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Bug 22441: Bridge the gap between the generated ElementFactory and HTMLElementFactory
-        https://bugs.webkit.org/show_bug.cgi?id=22441
-
-        Element's other than HTML ones take a QualifiedName in their constructors.
-        To make HTMLElementFactory closer to the other ElementFactory, we need
-        to make them take the same arguments.
-        This patch only makes the 5 first one in HTMLElementFactory abide by that. The others
-        will go into the next patch.
-
-        * dom/Document.cpp:
-        (WebCore::Document::implicitClose):
-        * html/HTMLBaseElement.cpp:
-        (WebCore::HTMLBaseElement::HTMLBaseElement):
-        * html/HTMLBaseElement.h:
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::HTMLBodyElement):
-        * html/HTMLBodyElement.h:
-        * html/HTMLElementFactory.cpp:
-        (WebCore::htmlConstructor):
-        (WebCore::headConstructor):
-        (WebCore::bodyConstructor):
-        (WebCore::baseConstructor):
-        (WebCore::linkConstructor):
-        (WebCore::metaConstructor):
-        * html/HTMLHeadElement.cpp:
-        (WebCore::HTMLHeadElement::HTMLHeadElement):
-        * html/HTMLHeadElement.h:
-        * html/HTMLHtmlElement.cpp:
-        (WebCore::HTMLHtmlElement::HTMLHtmlElement):
-        * html/HTMLHtmlElement.h:
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::HTMLLinkElement):
-        * html/HTMLLinkElement.h:
-        * html/HTMLMetaElement.cpp:
-        (WebCore::HTMLMetaElement::HTMLMetaElement):
-        * html/HTMLMetaElement.h:
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::handleError):
-        (WebCore::HTMLParser::headCreateErrorCheck):
-        (WebCore::HTMLParser::createHead):
-        (WebCore::HTMLParser::finished):
-        * html/HTMLViewSourceDocument.cpp:
-        (WebCore::HTMLViewSourceDocument::createContainingTable):
-
-2008-11-25  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=22487
-        I was not checking for the case of 0 length keyframe lists and dereffing a null pointer.
-
-        Tests: animations/empty-keyframes.html
-               animations/fill-unset-properties.html
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
-
-2008-11-25  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Darin Adler
-
-        https://bugs.webkit.org/show_bug.cgi?id=22046
-
-        Fix a crash when an animation or transition end event handler
-        removes the element upon which the transition/animation is running,
-        by keeping a reference to the AnimationBase object on the stack.
-
-        Tests: animations/transform-animation-event-destroy-element.html
-               transitions/transform-transition-event-destroy-element.html
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::setChanged):
-        (WebCore::AnimationBase::updateStateMachine):
-        * page/animation/AnimationBase.h:
-        (WebCore::AnimationBase::clearRenderer):
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::clear):
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimationPrivate::~CompositeAnimationPrivate):
-        * page/animation/CompositeAnimation.h:
-
-2008-11-25  Kevin Ollivier  <kevino@theolliviers.com>
-
-        Better wx build fix - support PurgeableBuffer on Mac.
-
-        * platform/PurgeableBuffer.h:
-        * webcore-wx.bkl:
-
-2008-11-25  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by David Kilzer.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22022
-
-        Add GeoleocationServiceGtk stubs and integrate it into the buildsystem
-
-        Add stubs for a Gtk Implementation.
-
-        * GNUmakefile.am:
-        * platform/gtk/GeolocationServiceGtk.cpp: Added.
-        (WebCore::GeolocationService::create):
-        (WebCore::GeolocationServiceGtk::GeolocationServiceGtk):
-        (WebCore::GeolocationServiceGtk::startUpdating):
-        (WebCore::GeolocationServiceGtk::stopUpdating):
-        (WebCore::GeolocationServiceGtk::suspend):
-        (WebCore::GeolocationServiceGtk::resume):
-        (WebCore::GeolocationServiceGtk::lastPosition):
-        (WebCore::GeolocationServiceGtk::lastError):
-        * platform/gtk/GeolocationServiceGtk.h: Added.
-
-2008-11-25  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix - we don't support PurgeableBuffer on Leopard for now.
-        
-        * platform/PurgeableBuffer.h:
-
-2008-11-25  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        Fix https://bugs.webkit.org/show_bug.cgi?id=22483
-        Assertion failure in CachedResource::makePurgeable during layout tests
-        
-        Deleting SVG image can re-enter destroyDecodedData.
-
-        * loader/CachedImage.cpp:
-        (WebCore::CachedImage::destroyDecodedData):
-
-2008-11-25  David Levin  <levin@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22443
-        Made the PreflightResultCache thread-safe in preparation for usage of XMLHttpRequest by
-        Workers on threads.
-
-        No observable change in behavior, so no test.
-
-        * platform/text/PlatformString.h:
-        * platform/text/String.cpp:
-        (WebCore::String::substringCopy):
-        * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::substringCopy):
-        * platform/text/StringImpl.h:
-        Added the ability to copy a substring.
-
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::PreflightResultCacheItem::PreflightResultCacheItem):
-        (WebCore::PreflightResultCache::PreflightResultCache):
-        (WebCore::PreflightResultCacheItem::addToAccessControlAllowList):
-        (WebCore::PreflightResultCacheItem::parseAccessControlAllowList):
-        (WebCore::PreflightResultCacheItem::parseAccessControlMaxAge):
-        (WebCore::PreflightResultCacheItem::parse):
-        (WebCore::PreflightResultCacheItem::allowsRequest):
-        (WebCore::PreflightResultCache::shared):
-        (WebCore::PreflightResultCache::appendEntry):
-        (WebCore::PreflightResultCache::canSkipPreflight):
-        (WebCore::XMLHttpRequest::makeCrossSiteAccessRequestWithPreflight):
-        (WebCore::XMLHttpRequest::didReceiveResponsePreflight):
-        Made the PreflightResultCache threadsafe.
-
-        (WebCore::PreflightResultCacheItem::allowsCrossSiteMethod):
-        (WebCore::PreflightResultCacheItem::allowsCrossSiteHeaders):
-        Consolidation of duplicate logic.
-
-2008-11-24  Jungshik Shin  <jshin@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        For Unicode encodings other than UTF-8, use UTF-8 for
-        form submission and URL query part encoding.
-
-        See https://bugs.webkit.org/show_bug.cgi?id=21635
-
-        Tests: http/tests/misc/submit-get-in-utf16be.html
-               http/tests/misc/submit-get-in-utf16le.html
-               http/tests/misc/submit-get-in-utf32be.html
-               http/tests/misc/submit-get-in-utf32le.html
-               http/tests/misc/submit-get-in-utf7.html
-               http/tests/misc/submit-post-in-utf16be.html
-               http/tests/misc/submit-post-in-utf16le.html
-               http/tests/misc/submit-post-in-utf32be.html
-               http/tests/misc/submit-post-in-utf32le.html
-               http/tests/misc/submit-post-in-utf7.html
-               http/tests/misc/url-in-utf16be.html
-               http/tests/misc/url-in-utf16le.html
-               http/tests/misc/url-in-utf32be.html
-               http/tests/misc/url-in-utf32le.html
-               http/tests/misc/url-in-utf7.html
- 
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::formData):
-        * loader/TextResourceDecoder.cpp:
-        (WebCore::TextResourceDecoder::setEncoding):
-        * platform/KURL.cpp:
-        (WebCore::KURL::KURL):
-        * platform/text/TextEncoding.cpp:
-        (WebCore::UTF7Encoding):
-        (WebCore::TextEncoding::isNonByteBasedEncoding):
-        (WebCore::TextEncoding::closestByteBasedEquivalent):
-        (WebCore::TextEncoding::encodingForFormSubmission):
-        * platform/text/TextEncoding.h:
-
-2008-11-24  Julien Chaffraix  <jchaffraix@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Bug 22441: Bridge the gap between the generated ElementFactory and HTMLElementFactory
-        https://bugs.webkit.org/show_bug.cgi?id=22441
-
-        - Make the generated ElementFactory constructors return PassRefPtr instead of raw pointers.
-
-        - Tweaked the generated files to better match our coding style.
-
-        * dom/make_names.pl:
-
-2008-11-24  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=22073
-        REGRESSION(r33544): Palace in the Sky crashes WebKit
-        
-        HTMLTokenizer::m_hasScriptsWaitingForStylesheets would still be set while
-        there were no scripts left to execute. 
-        
-        If m_hasScriptsWaitingForStylesheets becomes true during script execution
-        bail out from executing more scripts synchronously.
-
-        Test: fast/tokenizer/nested-cached-scripts-and-stylesheet.html
-
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::reset):
-        (WebCore::HTMLTokenizer::notifyFinished):
-
-2008-11-24  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Geoffrey Garen.
+        Reviewed by Justin Garcia.
 
-        https://bugs.webkit.org/show_bug.cgi?id=22465
-        Define KURL::copy() and use it in WorkerThread.cpp
+        Undo the changeset 21212 to fix the regression bug 14062.
+        The changeset 21212 attempted to fix rdar://problem/5002441.
+        The changeset 21212 modified InsertTextCommand::input so as to convert
+        all spaces in text to non-breaking spaces for rdar://problem/5002441.
+        However, the bug was originally caused by rebalanceWhitespaceAt
+        and this workaround introduced a regression bug 14062.
+        Because rebalanceWhitespaceAt appears to behave correctly now,
+        the workaround introduced in 21212 is no longer needed.
 
-        * dom/WorkerThread.cpp:
-        (WebCore::WorkerThread::WorkerThread):
-        * platform/KURL.cpp:
-        (WebCore::KURL::copy):
-        * platform/KURL.h:
+        Test: editing/inserting/space-after-removeformat.html
 
-2008-11-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::input):
 
-        Reviewed by Sam Weinig.
+2009-06-23  Beth Dakin  <bdakin@apple.com>
 
-        Name enum values in a style guide compatible way.
-        Allow WMLIntrinsicEvent inclusion, without needing other includes.
+        Reviewed by Dave Hyatt.
 
-        * wml/WMLIntrinsicEvent.cpp:
-        (WebCore::createTaskElement):
-        * wml/WMLIntrinsicEvent.h:
-        * wml/WMLIntrinsicEventHandler.cpp:
-        * wml/WMLIntrinsicEventHandler.h:
-        (WebCore::):
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26523 <col> 
+        elements width can't be changed with javascript
 
-2008-11-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+        This patch both fixes setting the width attribute directly in 
+        JavaScript, and setting the width on the style attribute. 
 
-        Reviewed by Sam Weinig.
+        * html/HTMLTableColElement.cpp:
+        (WebCore::HTMLTableColElement::parseMappedAttribute): If we have a 
+        new width, call setNeedsLayoutAndPrefWidthsRecalc()
 
-        Add wmlPageStateForDocument() helper function and use it in some places.
-
-        * wml/WMLAccessElement.cpp:
-        (WebCore::WMLAccessElement::parseMappedAttribute):
-        * wml/WMLDocument.cpp:
-        (WebCore::WMLDocument::WMLDocument):
-        (WebCore::WMLDocument::finishedParsing):
-        (WebCore::wmlPageStateForDocument):
-        * wml/WMLDocument.h:
-        * wml/WMLGoElement.cpp:
-        (WebCore::WMLGoElement::executeTask):
-        * wml/WMLPrevElement.cpp:
-        (WebCore::WMLPrevElement::executeTask):
-        * wml/WMLRefreshElement.cpp:
-        (WebCore::WMLRefreshElement::executeTask):
-        * wml/WMLTaskElement.cpp:
-        (WebCore::WMLTaskElement::storeVariableState):
-        * wml/WMLTaskElement.h:
-
-2008-11-24  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Geoff Garen and Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22214
-        Keep dead resources in memory cache in purgeable memory.
-        <rdar://problem/6333088>
+        Call calcPrefWidths() on the table cols.
+        * rendering/AutoTableLayout.cpp:
+        (WebCore::AutoTableLayout::recalcColumn):
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray):
         
-        OS X 10.5 has purgeable memory kernel facility that allows marking reserved memory
-        areas as less important. Under memory pressure system can steal pages that have
-        been marked purgeable for (hopefully) better uses. This is ideal for caches.
-        
-        Only resources larger than 16KB will be moved to the purgeable memory.
-
-        * WebCore.base.exp:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * loader/Cache.cpp:
-        (WebCore::Cache::requestResource):
-        (WebCore::Cache::requestUserCSSStyleSheet):
-        (WebCore::Cache::resourceForURL):
-        (WebCore::Cache::pruneDeadResources):
-        (WebCore::Cache::TypeStatistic::addResource):
-        (WebCore::Cache::getStatistics):
-        (WebCore::Cache::dumpStats):
-        * loader/Cache.h:
-        (WebCore::Cache::TypeStatistic::TypeStatistic):
-        * loader/CachedCSSStyleSheet.cpp:
-        (WebCore::CachedCSSStyleSheet::allClientsRemoved):
-        (WebCore::CachedCSSStyleSheet::sheetText):
-        * loader/CachedCSSStyleSheet.h:
-        * loader/CachedImage.cpp:
-        (WebCore::CachedImage::addClient):
-        (WebCore::CachedImage::image):
-        (WebCore::CachedImage::imageSize):
-        (WebCore::CachedImage::imageRect):
-        (WebCore::CachedImage::destroyDecodedData):
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::addClient):
-        (WebCore::CachedResource::makePurgeable):
-        (WebCore::CachedResource::isPurgeable):
-        (WebCore::CachedResource::wasPurged):
-        * loader/CachedResource.h:
-        (WebCore::CachedResource::data):
-        * loader/CachedScript.cpp:
-        (WebCore::CachedScript::allClientsRemoved):
-        (WebCore::CachedScript::script):
-        (WebCore::CachedScript::destroyDecodedData):
-        * platform/PurgeableBuffer.h: Added.
-        (WebCore::PurgeableBuffer::create):
-        (WebCore::PurgeableBuffer::size):
-        (WebCore::PurgeableBuffer::):
-        (WebCore::PurgeableBuffer::purgePriority):
-        (WebCore::PurgeableBuffer::isPurgeable):
-        (WebCore::PurgeableBuffer::~PurgeableBuffer):
-        (WebCore::PurgeableBuffer::data):
-        (WebCore::PurgeableBuffer::setPurgePriority):
-        (WebCore::PurgeableBuffer::wasPurged):
-        (WebCore::PurgeableBuffer::makePurgeable):
-        * platform/SharedBuffer.cpp:
-        (WebCore::SharedBuffer::~SharedBuffer):
-        (WebCore::SharedBuffer::adoptPurgeableBuffer):
-        (WebCore::SharedBuffer::size):
-        (WebCore::SharedBuffer::data):
-        (WebCore::SharedBuffer::append):
-        (WebCore::SharedBuffer::clear):
-        (WebCore::SharedBuffer::releasePurgeableBuffer):
-        * platform/SharedBuffer.h:
-        (WebCore::SharedBuffer::hasPurgeableBuffer):
-        * platform/cf/SharedBufferCF.cpp:
-        * platform/mac/PurgeableBufferMac.cpp: Added.
-        (WebCore::PurgeableBuffer::PurgeableBuffer):
-        (WebCore::PurgeableBuffer::~PurgeableBuffer):
-        (WebCore::PurgeableBuffer::create):
-        (WebCore::PurgeableBuffer::makePurgeable):
-        (WebCore::PurgeableBuffer::wasPurged):
-        (WebCore::PurgeableBuffer::setPurgePriority):
-        (WebCore::PurgeableBuffer::data):
-
-2008-11-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos & Eric Seidel.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22430
-
-        Regenerate WML layout test results after implementing WML specific <card> handling:
-        Only the first <card> element should be visible after loading the document, others
-        can be shown by using the <go> task element.
-
-        * dom/Document.h: Make 'finishedParsing()' a virtual function.
-        * wml/WMLCardElement.cpp:
-        (WebCore::WMLCardElement::WMLCardElement):
-        (WebCore::WMLCardElement::~WMLCardElement):
-        (WebCore::WMLCardElement::createRenderer):
-        (WebCore::WMLCardElement::setActiveCardInDocument):
-        (WebCore::WMLCardElement::setVisibility):
-        * wml/WMLCardElement.h:
-        * wml/WMLDocument.cpp:
-        (WebCore::WMLDocument::finishedParsing): Execute WML specific logic after tokenzing.
-        * wml/WMLDocument.h:
-
-2008-11-24  Glenn Wilson  <gwilson@chromium.org>
-
-        Reviewed by Alexey Proskuryakov.
-
-        http://bugs.webkit.org/show_bug.cgi?id=15643
-
-        Added support for clients that wish to disable smart insert/delete
-        and enable the "trailing whitespace selection" work-around.
-
-        Tests: editing/selection/doubleclick-whitespace.html
-
-        * editing/Editor.cpp:
-        (WebCore::Editor::selectTrailingWhitespaceEnabled):
-        * editing/Editor.h:
-        * editing/Selection.cpp:
-        (WebCore::Selection::includeTrailingWhitespace):
-        * editing/Selection.h:
-        * loader/EmptyClients.h:
-        (WebCore::EmptyEditorClient::selectTrailingWhitespaceEnabled):
-        * page/EditorClient.h:
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::selectClosestWordFromMouseEvent):
-
-2008-11-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Not reviewed. Forgot to include WMLPageState.h in last commit.
-
-        * wml/WMLPageState.h:
-        (WebCore::WMLPageState::restrictDeckAccessToDomain):
-        (WebCore::WMLPageState::restrictDeckAccessToPath):
-
-2008-11-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Oliver Hunt & Eric Seidel.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22431
-
-        Implement WMLAccessElement. It just propogates two attributes values to WMLPageState.
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * wml/WMLAccessElement.cpp: Added.
-        (WebCore::WMLAccessElement::WMLAccessElement):
-        (WebCore::WMLAccessElement::parseMappedAttribute):
-        * wml/WMLAccessElement.h: Added.
-        * wml/WMLTagNames.in:
-        * wml/WMLPageState.h: Rename functions.
-        (WebCore::WMLPageState::restrictDeckAccessToDomain):
-        (WebCore::WMLPageState::restrictDeckAccessToPath):
-        * wml/WMLVariables.cpp: Add new helper function.
-        (WebCore::valueContainsVariableReference):
-        * wml/WMLVariables.h:
-        (WebCore::):
-
-2008-11-24  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=22470
-          remove unneeded URL argument from FrameLoaderClient::updateGlobalHistory
-
-        * loader/EmptyClients.h:
-        (WebCore::EmptyFrameLoaderClient::updateGlobalHistory): Remove argument.
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::updateHistoryForStandardLoad): Don't pass the URL.
-        (WebCore::FrameLoader::updateHistoryForRedirectWithLockedHistory): Ditto.
-        * loader/FrameLoaderClient.h: Remove argument.
-
-2008-11-24  Finnur Thorarinsson  <finnur.webkit@gmail.com>
-
-        Reviewed by Darin Adler.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22432
-
-        Add plumbing for tickmark support for the scrollbars. The painting code
-        for the scrollbar just needed to call paintTickmarks at the right time
-        and a default no-op implementation is provided, which the ports will
-        need to override.
-
-        * platform/ScrollbarThemeComposite.cpp:
-        (WebCore::ScrollbarThemeComposite::paint):
-        * platform/ScrollbarThemeComposite.h:
-        (WebCore::ScrollbarThemeComposite::paintTickmarks):
-
-2008-11-24  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22448
-        Create an abstraction for JSC::SourceCode
+        Call layoutIfNeeded on the table cols.
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
 
-        * WebCore.vcproj/WebCore.vcproj:
-        * bindings/js/CachedScriptSourceProvider.h:
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
-        * bindings/js/ScriptController.h:
-        * bindings/js/ScriptSourceCode.h: Added.
-        (WebCore::ScriptSourceCode::ScriptSourceCode):
-        (WebCore::ScriptSourceCode::length):
-        (WebCore::ScriptSourceCode::jsSourceCode):
-        * bindings/js/WorkerScriptController.cpp:
-        (WebCore::Workevn ScriptController::evaluate):
-        * bindings/js/WorkerScriptController.h:
-        * dom/ScriptElement.cpp:
-        (WebCore::ScriptElement::insertedIntoDocument):
-        (WebCore::ScriptElement::childrenChanged):
-        (WebCore::ScriptElementData::evaluateScript):
-        (WebCore::ScriptElementData::notifyFinished):
-        * dom/ScriptElement.h:
-        * dom/WorkerThread.cpp:
-        (WebCore::WorkerThread::workerThread):
-        * dom/WorkerThread.h:
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::notifyFinished):
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::endElementNs):
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::parseEndElement):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::scriptHandler):
-        (WebCore::HTMLTokenizer::scriptExecution):
-        (WebCore::HTMLTokenizer::notifyFinished):
-        * html/HTMLTokenizer.h:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::executeScript):
-        * loader/FrameLoader.h:
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::clippedOverflowRectForRepaint): Use new 
+        table() convenience function.
+        (WebCore::RenderTableCol::calcPrefWidths): Just call 
+        setPrefWidthsDirty(false) on ourself and our children.
+        (WebCore::RenderTableCol::table):
+        * rendering/RenderTableCol.h:
 
-2008-11-24  Darin Adler  <darin@apple.com>
+2009-06-23  Ojan Vafai  <ojan@chromium.org>
 
         Reviewed by Dan Bernstein.
 
-        - finish https://bugs.webkit.org/show_bug.cgi?id=22295
-          track which history items are from page load failures
-
-        * WebCore.base.exp: Exported new function.
-
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::urlForHistoryReflectsFailure): Added.
-        * loader/DocumentLoader.h: Ditto.
-
-2008-11-24  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        Bug 22461: AccessibilityListBox::doAccessibilityHitTest() signature does not match the base class
-        https://bugs.webkit.org/show_bug.cgi?id=22461
- 
-        Changing AccessibilityListBox to use its parent's signature for hit testing
-
-        * page/AccessibilityListBox.cpp:
-        (WebCore::AccessibilityListBox::doAccessibilityHitTest):
-        * page/AccessibilityListBox.h:
-
-2008-11-24  Simon Fraser  <simon.fraser@apple.com>
-
-        Fix Windows build: selectionRect() -> selectionBounds().
-
-        * page/win/FrameCGWin.cpp:
-        (WebCore::imageFromSelection):
-
-2008-11-24  Glenn Wilson  <gwilson@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        http://bugs.webkit.org/show_bug.cgi?id=18703
-        "Changing the 'size' property on a text input does not affect its length"
-
-        Text fields would not repaint themselves after having their "size" 
-        attributes modified.  This fix tells the object to recalculate its 
-        width and repaint itself when its "size" attribute is parsed.
-
-        Test: fast/js/text-field-resize.html
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::parseMappedAttribute):
-
-2008-11-24  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler
-
-        Followup from changes for https://bugs.webkit.org/show_bug.cgi?id=22433
+        Add logic to CSSStyleDeclaration::diff to deal with font-sizes that are 
+        keyword values. When diff is called on a CSSStyleDeclaration, we check
+        the keywordSize to see if font-size matches a keyword value.
         
-        Make RenderView::selectionRect() private to cause compile-time
-        errors if someone tries to call it.
-
-        * rendering/RenderView.h:
-
-2008-11-24  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein
-
-        Via: https://bugs.webkit.org/show_bug.cgi?id=22433
+        This ensures that when we diff a CSSMutableStyleDeclaration returned from
+        copyInheritableProperties on a CSSComputedStyleDeclaration that we 
+        correctly identify matching font-sizes.
         
-        Rename RenderView::selectionRect() to selectionBounds(), to remove
-        longstanding ambiguity with the base class selectionRect() method.
-        Do the same on Frame for consistency with RenderView. Assert
-        that RenderView::selectionRect() is never called.
-
-        * WebCore.base.exp:
-        * editing/SelectionController.cpp:
-        (WebCore::SelectionController::focusedOrActiveStateChanged):
-        * page/DragController.cpp:
-        (WebCore::dragLocForSelectionDrag):
-        * page/Frame.cpp:
-        (WebCore::Frame::selectionBounds):
-        (WebCore::Frame::revealSelection):
-        * page/Frame.h:
-        * page/mac/FrameMac.mm:
-        (WebCore::Frame::selectionImage):
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::selectionRect):
-        (WebCore::RenderView::selectionBounds):
-        * rendering/RenderView.h:
-
-2008-11-19  Julien Chaffraix  <jchaffraix@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Bug 22441: Bridge the gap between the generated ElementFactory and HTMLElementFactory
-        https://bugs.webkit.org/show_bug.cgi?id=22441
-
-        - Make HTMLElementFactory::createHTMLElement take a QualifiedName instead of
-        an AtomicString.
-
-        - Updated the elements' constructors and the callers to reflect the previous change.
-
-        * dom/Document.cpp:
-        (WebCore::Document::createElement):
-        * html/HTMLDocument.cpp:
-        (WebCore::HTMLDocument::createElement):
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::cloneNode):
-        * html/HTMLElementFactory.cpp:
-        (WebCore::htmlConstructor):
-        (WebCore::headConstructor):
-        (WebCore::bodyConstructor):
-        (WebCore::baseConstructor):
-        (WebCore::linkConstructor):
-        (WebCore::metaConstructor):
-        (WebCore::styleConstructor):
-        (WebCore::titleConstructor):
-        (WebCore::frameConstructor):
-        (WebCore::framesetConstructor):
-        (WebCore::iframeConstructor):
-        (WebCore::formConstructor):
-        (WebCore::buttonConstructor):
-        (WebCore::inputConstructor):
-        (WebCore::isindexConstructor):
-        (WebCore::fieldsetConstructor):
-        (WebCore::keygenConstructor):
-        (WebCore::labelConstructor):
-        (WebCore::legendConstructor):
-        (WebCore::optgroupConstructor):
-        (WebCore::optionConstructor):
-        (WebCore::selectConstructor):
-        (WebCore::textareaConstructor):
-        (WebCore::dlConstructor):
-        (WebCore::ulConstructor):
-        (WebCore::olConstructor):
-        (WebCore::dirConstructor):
-        (WebCore::menuConstructor):
-        (WebCore::liConstructor):
-        (WebCore::blockquoteConstructor):
-        (WebCore::divConstructor):
-        (WebCore::headingConstructor):
-        (WebCore::hrConstructor):
-        (WebCore::paragraphConstructor):
-        (WebCore::preConstructor):
-        (WebCore::basefontConstructor):
-        (WebCore::fontConstructor):
-        (WebCore::modConstructor):
-        (WebCore::anchorConstructor):
-        (WebCore::imageConstructor):
-        (WebCore::mapConstructor):
-        (WebCore::areaConstructor):
-        (WebCore::canvasConstructor):
-        (WebCore::appletConstructor):
-        (WebCore::embedConstructor):
-        (WebCore::objectConstructor):
-        (WebCore::paramConstructor):
-        (WebCore::scriptConstructor):
-        (WebCore::tableConstructor):
-        (WebCore::tableCaptionConstructor):
-        (WebCore::tableColConstructor):
-        (WebCore::tableRowConstructor):
-        (WebCore::tableCellConstructor):
-        (WebCore::tableSectionConstructor):
-        (WebCore::brConstructor):
-        (WebCore::quoteConstructor):
-        (WebCore::marqueeConstructor):
-        (WebCore::audioConstructor):
-        (WebCore::videoConstructor):
-        (WebCore::sourceConstructor):
-        (WebCore::HTMLElementFactory::createHTMLElement):
-        * html/HTMLElementFactory.h:
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::getNode):
-
-2008-11-24  Brent Fulgham  <bfulgham@gmail.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22444
-
-        Correct bad default constructor for Cairo FontPlatformData so that
-        the m_scaledFont member is initialized.  Previously this would be
-        set to 0xbaadf00d, which would result in infinite loops while
-        attempting to deal with the font cache.
-
-        * platform/graphics/win/FontPlatformData.h:
-        (WebCore::FontPlatformData::FontPlatformData): Initialize m_scaledFont to 0
-
-2008-11-24  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22455
-        Add support for Worker.terminate()
-
-        Test: fast/workers/worker-terminate.html
-
-        * dom/Worker.idl:
-        * dom/Worker.cpp:
-        * dom/Worker.h:
-        Added terminate().
-
-        * dom/WorkerMessagingProxy.h: (WebCore::WorkerMessagingProxy::askedToTerminate):
-        * dom/WorkerMessagingProxy.cpp:
-        (WebCore::MessageWorkerTask::performTask): Don't dispatch messages if the worker was asked
-        to terminate (this is not mentioned in draft spec, but makes sense anyway).
-        (WebCore::WorkerMessagingProxy::WorkerMessagingProxy): The proxy now remembers if it was
-        asked to terminate in m_askedToTerminate member variable. Also, changed m_unconfirmedMessageCount
-        to only track messages that were posted to worker thread, avoiding a leak if the script
-        could not be loaded.
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext): Return early if terminating.
-        (WebCore::WorkerMessagingProxy::workerThreadCreated): Stop the thread if already asked for.
-        (WebCore::WorkerMessagingProxy::workerContextDestroyedInternal): Even if worker context
-        was destroyed, the worker object may still be alive now, so don't delete self in this case.
-        (WebCore::WorkerMessagingProxy::terminate): Stop the thread if it was already created, or
-        remember to stop it when it is created.
-        (WebCore::WorkerMessagingProxy::reportWorkerThreadActivityInternal): Don't track activity
-        if the thread asked to stop anyway.
-        (WebCore::WorkerMessagingProxy::workerThreadHasPendingActivity): Ditto.
-
-        * dom/WorkerThread.cpp:
-        * dom/WorkerThread.h:
-        Fixed a race condition in stop().
-
-2008-11-24  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22439
-        Won't load stylesheets with filenames less than 2 characters long in xhtml.
-
-        Test: http/tests/misc/single-character-pi-stylesheet.xhtml
-
-        * dom/ProcessingInstruction.cpp: (WebCore::ProcessingInstruction::checkStyleSheet):
-        Fix up the logic.
-
-2008-11-24  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Mark Rowe.
-
-        [Gtk+] Add configure option to enable Web Workers and enable it by default
-
-        Add --enable-workers to the buildsystem (used by build-webkit) add
-        the to be build files to the GNUmakefile.am and change build-webkit
-        to enable Web Workers by default.
-
-        * GNUmakefile.am:
-
-2008-11-24  Alexey Proskuryakov  <ap@webkit.org>
-
-        Build fix (for Windows Cairo port?)
+        https://bugs.webkit.org/show_bug.cgi?id=26279
 
-        * page/DOMWindow.idl: Use ENABLE_CHANNEL_MESSAGING instead of ENABLE(CHANNEL_MESSAGING), as
-        the ENABLE macro is not available in idls.
+        Test: editing/inserting/font-size-clears-from-typing-style.html
 
-2008-11-22  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22421
-        Added ScriptValue to Visual Studio and XCode projects.
-
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-
-2008-11-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Holger Freyther.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22426
-
-        Add WMLInstrinsicEvent/EventHandler implementation. Code not yet used.
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * wml/WMLIntrinsicEvent.cpp: Added.
-        (WebCore::createTaskElement):
-        (WebCore::WMLIntrinsicEvent::WMLIntrinsicEvent):
-        * wml/WMLIntrinsicEvent.h: Added.
-        (WebCore::WMLIntrinsicEvent::create):
-        (WebCore::WMLIntrinsicEvent::createWithTask):
-        (WebCore::WMLIntrinsicEvent::taskElement):
-        * wml/WMLIntrinsicEventHandler.cpp: Added.
-        (WebCore::WMLIntrinsicEventHandler::WMLIntrinsicEventHandler):
-        (WebCore::WMLIntrinsicEventHandler::registerIntrinsicEvent):
-        (WebCore::WMLIntrinsicEventHandler::triggerIntrinsicEvent):
-        (WebCore::WMLIntrinsicEventHandler::hasIntrinsicEvent):
-        * wml/WMLIntrinsicEventHandler.h: Added.
-        (WebCore::):
-
-2008-11-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Holger Freyther.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22423
-
-        Add <go> stub implementation. Add complete <prev>/<refresh> and <setvar> implementation.
-        Activate code handling <setvar> registration in WMLTaskElement.
-
-        * wml/WMLGoElement.cpp: Added.
-        (WebCore::WMLGoElement::WMLGoElement):
-        (WebCore::WMLGoElement::~WMLGoElement):
-        (WebCore::WMLGoElement::parseMappedAttribute):
-        (WebCore::WMLGoElement::executeTask):
-        * wml/WMLGoElement.h: Added.
-        * wml/WMLPrevElement.cpp: Added.
-        (WebCore::WMLPrevElement::WMLPrevElement):
-        (WebCore::WMLPrevElement::~WMLPrevElement):
-        (WebCore::WMLPrevElement::executeTask):
-        * wml/WMLPrevElement.h: Added.
-        * wml/WMLRefreshElement.cpp: Added.
-        (WebCore::WMLRefreshElement::WMLRefreshElement):
-        (WebCore::WMLRefreshElement::~WMLRefreshElement):
-        (WebCore::WMLRefreshElement::executeTask):
-        * wml/WMLRefreshElement.h: Added.
-        * wml/WMLSetvarElement.cpp: Added.
-        (WebCore::WMLSetvarElement::WMLSetvarElement):
-        (WebCore::WMLSetvarElement::~WMLSetvarElement):
-        (WebCore::WMLSetvarElement::parseMappedAttribute):
-        (WebCore::WMLSetvarElement::insertedIntoDocument):
-        (WebCore::WMLSetvarElement::name):
-        (WebCore::WMLSetvarElement::value):
-        * wml/WMLSetvarElement.h: Added.
-        * wml/WMLTagNames.in:
-        * wml/WMLTaskElement.cpp:
-        (WebCore::WMLTaskElement::registerVariableSetter):
-        (WebCore::WMLTaskElement::storeVariableState):
-        * wml/WMLTaskElement.h:
-        * WebCore.xcodeproj/project.pbxproj:
-
-2008-11-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Not reviewed. Forgot to include WMLPageState.* in the last commit.
-
-        * wml/WMLPageState.cpp:
-        (WebCore::WMLPageState::setNeedCheckDeckAccess):
-        * wml/WMLPageState.h:
-        (WebCore::WMLPageState::storeVariables):
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::cssPropertyMatches):
+        * css/CSSComputedStyleDeclaration.h:
+        * css/CSSStyleDeclaration.cpp:
+        (WebCore::CSSStyleDeclaration::cssPropertyMatches):
+        (WebCore::CSSStyleDeclaration::diff):
+        * css/CSSStyleDeclaration.h:
 
-2008-11-21  Alexey Proskuryakov  <ap@webkit.org>
+2009-06-23  Kevin McCullough  <kmccullough@apple.com>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=22397
-        Worker threads are not destroyed if running a JS loop
-
-        Since the event loop is not ever entered again in this case, the fix necessarily involves
-        some shared data hackery.
-
-        * dom/WorkerThread.cpp: (WebCore::WorkerThread::stop):
-        * dom/WorkerThread.h:
-        Added a stop() method, which asks the thread to exit as soon as possible. In the future, it
-        may need to abort other kinds of synchronous processing, such as importScripts or XHR.
-
-        * bindings/js/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::WorkerScriptController):
-        (WebCore::WorkerScriptController::evaluate):
-        (WebCore::WorkerScriptController::forbidExecution):
-        * bindings/js/WorkerScriptController.h:
-        Added a forbidExecution() method, which interrupts currently running JS, and makes any
-        future calls to evaluate() return immediately.
-
-        * dom/WorkerMessagingProxy.cpp: (WebCore::WorkerMessagingProxy::workerObjectDestroyed):
-        Call WorkerThread::stop().
-
-2008-11-21  Kevin Watters  <kevinwatters@gmail.com>
-
-        Reviewed by Kevin Ollivier.
-
-        Improve wx image drawing performance considerably when using wxGraphicsContext
-        by avoiding unnecessary copies and drawing.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=22404
-
-        * platform/graphics/wx/ImageWx.cpp:
-        (WebCore::BitmapImage::draw):
-        (WebCore::BitmapImage::drawPattern):
-
-
-2008-11-21  Kevin Watters  <kevinwatters@gmail.com>
-
-        Reviewed by Kevin Ollivier.
-
-        Implementation of AffineTransform::mapRect for wx.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=22401
-
-        * platform/graphics/wx/AffineTransformWx.cpp:
-        (WebCore::AffineTransform::mapRect):
-
-2008-11-21  Justin Garcia  <justin.garcia@apple.com>
+        <rdar://problem/6994790> CrashTracer: [USER] 8 crashes in Mail trying to
+        add a blank line to pasted Facebook content (under
+        CompositeEditCommand::positionAvoidingSpecialElementBoundary)
 
-        Reviewed by Darin Adler.
-
-        <rdar://problem/5381788> Match NSTextView editing behavior at the end of hyperlink text
-        
-        Change link editing behavior to match TextEdit and MS Word when editing before and after 
-        a link (Pages has two caret positions at link boundaries, Thunderbird and FF behave like we 
-        used to, so it's difficult to get out of link editing mode):
-        When inserting before or after a link, always insert content outside of the link.  This
-        makes it impossible to get stuck in link editing mode, while making it slightly more 
-        difficult to edit link labels.  WebKit editors that care about this can add UI for editing 
-        link labels, like GMail and GoogleDocs have done.  We never actually had any bugs complaining
-        about how it was difficult to edit link labels at the start/end, the code was just introduced 
-        with another bug fix without much thought.
-        
-        Don't remember removed links anymore, no other editor does this and it made it 
-        difficult/impossible to get out of link editing mode.  This code was added to fix
-        <rdar://problem/4069359>, which is fixed instead by removing the styles from an 
-        enclosing anchor element from those styles that we remember when we delete content.
+        - Just added null checks and I will create a new bug to prevent the
+        bad behavior.
 
         * editing/CompositeEditCommand.cpp:
         (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
-        * editing/CompositeEditCommand.h:
-        * editing/DeleteSelectionCommand.cpp:
-        (WebCore::removeEnclosingAnchorStyle):
-        (WebCore::DeleteSelectionCommand::saveTypingStyleState):
-        (WebCore::DeleteSelectionCommand::doApply):
-        * editing/DeleteSelectionCommand.h:
-        * editing/EditCommand.cpp:
-        (WebCore::EditCommand::apply):
-        * editing/Editor.cpp:
-        (WebCore::Editor::appliedEditing):
-        * editing/InsertTextCommand.cpp:
-        (WebCore::InsertTextCommand::prepareForTextInsertion):
-        (WebCore::InsertTextCommand::input):
-        * editing/RemoveFormatCommand.cpp:
-        (WebCore::RemoveFormatCommand::doApply):
-        * editing/SelectionController.cpp:
-        (WebCore::SelectionController::setSelection):
-        * editing/SelectionController.h:
-
-2008-11-21  Alice Liu  <alice.liu@apple.com>
-
-        Rubber-stamped by Dan Bernstein.
-
-        fixed <rdar://6340771> crashing on print preview
-
-        * platform/graphics/win/GraphicsContextCGWin.cpp:
-        (WebCore::GraphicsContext::drawWindowsBitmap):
-
-2008-11-21  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Geoffrey Garen.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22390
-        Abstract away JSC:: usage in WebCore/xml
-
-        * bindings/js/ScriptString.h: Added.
-        (WebCore::ScriptString::ScriptString):
-        (WebCore::ScriptString::operator JSC::UString):
-        (WebCore::ScriptString::isNull):
-        (WebCore::ScriptString::size):
-        (WebCore::ScriptString::operator=):
-        (WebCore::ScriptString::operator+=):
-        * inspector/InspectorController.cpp:
-        (WebCore::XMLHttpRequestResource::XMLHttpRequestResource):
-        (WebCore::InspectorResource::setXMLHttpRequestProperties):
-        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
-        * inspector/InspectorController.h:
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::responseText):
-        (WebCore::XMLHttpRequest::clearResponse):
-        (WebCore::XMLHttpRequest::dropProtection):
-        (WebCore::XMLHttpRequest::didFinishLoading):
-        (WebCore::XMLHttpRequest::didReceiveData):
-        * xml/XMLHttpRequest.h:
-        (WebCore::XMLHttpRequest::setLastSendURL):
-
-2008-11-21  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        Destroy script decoded data on a zero-delay timer after
-        decoding.  This means we now have no decoded script data
-        at the end of Membuster.
-
-        * loader/CachedScript.cpp:
-        (WebCore::CachedScript::CachedScript):
-        (WebCore::CachedScript::allClientsRemoved):
-        (WebCore::CachedScript::script):
-        (WebCore::CachedScript::decodedDataDeletionTimerFired):
-        * loader/CachedScript.h:
-
-2008-11-21  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler
-
-        https://bugs.webkit.org/show_bug.cgi?id=22159
-
-        RenderBox::absoluteClippedOverflowRect() needs to inflate the rect by
-        maximalOutlineSize(), since a child might have an outline which projects
-        outside the parent overflowRect().
-        
-        We also need to ensure that maximalOutlineSize() is updated early in styleDidChange,
-        so that it is valid for these repaints.
-
-        Test: fast/repaint/outline-child-repaint.html
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::styleDidChange):
-        (WebCore::RenderBox::absoluteClippedOverflowRect):
-
-2008-11-21  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Gtk, Qt, and Wx build fix.
-
-        Add LinkHash.cpp in the build scripts.
-        Add LinkHash.h to Gtk's build script.
-
-        LinkHash.cpp/h was introduced in r38661.
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCoreSources.bkl:
-
-2008-11-21  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Third step in https://bugs.webkit.org/show_bug.cgi?id=22394
-        Be more eager in destroying script decoded data
-
-        Destroy the decoded data when all clients are removed from a CachedScript.
-
-        * loader/CachedScript.cpp:
-        (WebCore::CachedScript::allClientsRemoved):
-        * loader/CachedScript.h:
-        (WebCore::CachedScript::allClientsRemoved):
-
-2008-11-21  Pierre-Olivier Latour  <pol@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        WebKit should be using Device RGB colorspace everywhere for
-        consistency.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22300
-
-        * page/mac/AccessibilityObjectWrapper.mm:
-        (CreateCGColorIfDifferent):
-        * platform/graphics/mac/ColorMac.h:
-        * platform/graphics/mac/ColorMac.mm:
-        (WebCore::nsColor):
-        (+[WebCoreControlTintObserver controlTintDidChange]):
-        * rendering/RenderThemeMac.mm:
-        (WebCore::convertNSColorToColor):
-        (WebCore::menuBackgroundColor):
-
-2008-11-20  Julien Chaffraix  <jchaffraix@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Bug 22388: Add JSInterfaceName to the .in files
-        https://bugs.webkit.org/show_bug.cgi?id=22388        
-
-        Add JSInterfaceName that is similar to interfaceName but
-        for the JS wrappers. JSInterfaceName is always equal to interfaceName
-        unless explicitly set.
-        
-        * dom/make_names.pl:
-        * html/HTMLTagNames.in:
-        * svg/svgtags.in:
-
-2008-11-21  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        Second step in https://bugs.webkit.org/show_bug.cgi?id=22394
-        Be more eager in destroying script decoded data
-
-        Use a new CachedScriptSourceProvider to keep CachedScripts as
-        CachedScripts, even down into JSC.  This has the added benefit
-        of showing the CachedScripts as live in the Caches window.
-
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/CachedScriptSourceProvider.h: Added.
-        (WebCore::CachedScriptSourceProvider::create):
-        (WebCore::CachedScriptSourceProvider::~CachedScriptSourceProvider):
-        (WebCore::CachedScriptSourceProvider::getRange):
-        (WebCore::CachedScriptSourceProvider::data):
-        (WebCore::CachedScriptSourceProvider::length):
-        (WebCore::CachedScriptSourceProvider::CachedScriptSourceProvider):
-        (WebCore::makeSource):
-        * dom/ScriptElement.cpp:
-        (WebCore::ScriptElementData::notifyFinished):
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::notifyFinished):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::notifyFinished):
-
-2008-11-21  Brett Wilson  <brettw@chromium.org>
-
-        Fix debug-only build bustage due to a typo in an assert, and add new
-        files to the Windows build.
-
-        * Info.plist:
-        * WebCore.vcproj/WebCore.vcproj:
-        * platform/LinkHash.h:
-        (WebCore::LinkHashHash::avoidDeletedValue):
-
-2008-11-20  Brett Wilson  <brettw@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22131
-
-        Factor out visited link hashing and types into a new file, LinkHash.
-        This also changes the hash type to 64 bits, but does not actually use
-        the extra bits yet.
-
-        * WebCore.xcodeproj/project.pbxproj:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkPseudoState):
-        (WebCore::CSSStyleSelector::SelectorChecker::visitedStateChanged):
-        * css/CSSStyleSelector.h:
-        (WebCore::CSSStyleSelector::visitedStateChanged):
-        * dom/Document.cpp:
-        * dom/Document.h:
-        * page/Page.cpp:
-        (WebCore::Page::visitedStateChanged):
-        * page/Page.h:
-        * page/PageGroup.cpp:
-        (WebCore::PageGroup::isLinkVisited):
-        (WebCore::PageGroup::addVisitedLink):
-        * page/PageGroup.h:
-        * platform/LinkHash.cpp: Added.
-        (WebCore::findSlashDotDotSlash):
-        (WebCore::findSlashSlash):
-        (WebCore::findSlashDotSlash):
-        (WebCore::containsColonSlashSlash):
-        (WebCore::cleanPath):
-        (WebCore::matchLetter):
-        (WebCore::needsTrailingSlash):
-        (WebCore::visitedLinkHash):
-        * platform/LinkHash.h: Added
-        (WebCore::LinkHashHash::hash):
-        (WebCore::LinkHashHash::equal):
-        (WebCore::LinkHashHash::avoidDeletedValue):
-
-2008-11-21  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        No need to use getElementsByTagNameNS() in WML documents. Revert to using getElementByTagName() again.
-
-        * wml/WMLPElement.cpp:
-        (WebCore::WMLPElement::insertedIntoDocument):
-
-2008-11-21  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Fix some coding style/formatting issues in WMLAElement.
-
-        * wml/WMLAElement.cpp:
-        (WebCore::WMLAElement::parseMappedAttribute):
-        (WebCore::WMLAElement::defaultEventHandler):
-        * wml/WMLAElement.h:
-
-2008-11-21  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22399
-
-        Implement <anchor> support for WML, add WMLVariables file containing helper functions
-        for variable support, and a WMLTaskElement base class for WMLPrev/Go/RefreshElement.
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::linkAttribute):
-        * rendering/HitTestResult.cpp:
-        (WebCore::HitTestResult::absoluteImageURL):
-        (WebCore::HitTestResult::absoluteLinkURL):
-        (WebCore::HitTestResult::isLiveLink):
-        * wml/WMLAnchorElement.cpp: Added.
-        (WebCore::WMLAnchorElement::WMLAnchorElement):
-        (WebCore::WMLAnchorElement::~WMLAnchorElement):
-        (WebCore::WMLAnchorElement::defaultEventHandler):
-        * wml/WMLAnchorElement.h: Added.
-        (WebCore::WMLAnchorElement::registerTask):
-        * wml/WMLTagNames.in:
-        * wml/WMLTaskElement.cpp: Added.
-        (WebCore::WMLTaskElement::WMLTaskElement):
-        (WebCore::WMLTaskElement::~WMLTaskElement):
-        (WebCore::WMLTaskElement::insertedIntoDocument):
-        (WebCore::WMLTaskElement::addVariableSetter):
-        (WebCore::WMLTaskElement::removeVariableSetter):
-        (WebCore::WMLTaskElement::storeVariableState):
-        * wml/WMLTaskElement.h: Added.
-        * wml/WMLVariables.cpp: Added.
-        (WebCore::isValidVariableCharacter):
-        (WebCore::isValidVariableReferenceCharacter):
-        (WebCore::isValidVariableName):
-        (WebCore::substituteVariableReferences):
-        * wml/WMLVariables.h: Added.
-        (WebCore::):
 
-2008-11-21  Julien Chaffraix  <jchaffraix@pleyo.com>
+2009-06-23  Simon Fraser  <simon.fraser@apple.com>
 
-        Rubber-stamped by Alexey Proskuryakov.
-
-        Build fix when building without WORKERS on non-POSIX, non-WINDOWS
-        machine.
-
-        Spotted by Mario Bensi.
-
-        * platform/text/TextCodecICU.cpp:
-
-2008-11-20  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        First step in https://bugs.webkit.org/show_bug.cgi?id=22394
-        Be more eager in destroying script decoded data
-
-        Pass data to be used in script execution around as JSC::SourceCode instead
-        of a source, url, and starting line.
-
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
-        * bindings/js/ScriptController.h:
-        * bindings/js/StringSourceProvider.h:
-        (WebCore::makeSource):
-        * bindings/js/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::evaluate):
-        * bindings/js/WorkerScriptController.h:
-        * dom/ScriptElement.cpp:
-        (WebCore::ScriptElement::insertedIntoDocument):
-        (WebCore::ScriptElement::childrenChanged):
-        (WebCore::ScriptElementData::evaluateScript):
-        (WebCore::ScriptElementData::notifyFinished):
-        * dom/ScriptElement.h:
-        * dom/WorkerThread.cpp:
-        (WebCore::WorkerThread::workerThread):
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::notifyFinished):
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::endElementNs):
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::parseEndElement):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::scriptHandler):
-        (WebCore::HTMLTokenizer::scriptExecution):
-        (WebCore::HTMLTokenizer::notifyFinished):
-        * html/HTMLTokenizer.h:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::executeScript):
-        * loader/FrameLoader.h:
-
-2008-11-20  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=22392
-        REGRESION: XMLHttpRequest.responseText does unnecessary trip though WebCore::String
-
-        - Use jsOwnedStringOrNull to avoid conversion to WebCore::String.
+        Build fix.
 
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::responseText):
-        * xml/XMLHttpRequest.idl:
+        Wrap shouldDoSoftwarePaint() in #if USE(ACCELERATED_COMPOSITING) to avoid warning when 
+        ACCELERATED_COMPOSITING is not defined.
 
-2008-11-20  Simon Fraser  <simon.fraser@apple.com>
+        * rendering/RenderLayer.cpp:
 
-        Reviewed by Dan Bernstein
+2009-06-23  Simon Fraser  <simon.fraser@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=19623
-        
-        When an non-layer object gained a transform, it would only repaint
-        the bounds of the new layer, which could result in redraw artifacts
-        if the new layer was smaller. So if we're gaining a transform, we
-        repaint.
+        Reviewed by Dave Hyatt.
         
-        Test: fast/repaint/change-transform.html
-
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::styleWillChange):
-
-2008-11-20  Adele Peterson  <adele@apple.com>
-
-        Reviewed by Darin Adler. 
-
-        Fix for <rdar://problem/6111436> Support upload progress events on Windows
-
-        * platform/network/cf/ResourceHandleCFNet.cpp:
-        (WebCore::didSendBodyData): Added.
-        (WebCore::ResourceHandle::start): Hook up didSendBodyData callback.
-
-2008-11-20  Justin Garcia  <justin.garcia@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/2610675> Blank line that is quoted can't be deleted
+        https://bugs.webkit.org/show_bug.cgi?id=24863
         
-        If the caret is in an empty quoted paragraph, and either there is nothing before that
-        paragraph, or what is before is unquoted, and the user presses delete, unquote that
-        paragraph.
-
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph): Added.
-        Removes the line break that holds open an empty paragraph and then attempts to
-        prune the blockquote(s) that held that line break in case they have been emptied
-        out.  Places a line break to create in empty unquoted paragraph in place of the
-        quoted one that was removed.
-        * editing/CompositeEditCommand.h:
-        * editing/TypingCommand.cpp:
-        (WebCore::TypingCommand::deleteKeyPressed): Call breakOutOfEmptyBlockquotedParagraph.
-        * editing/htmlediting.cpp:
-        (WebCore::highestEnclosingNodeOfType): Added.
-        * editing/htmlediting.h:
-
-2008-11-20  Dean Jackson  <dino@apple.com>
-
-        Reviewed by Antti Koivisto
-
-        https://bugs.webkit.org/show_bug.cgi?id=21247
-
-        Make transition shorthand property accept transition-delay.
-
-        Test: transitions/transition-shorthand-delay.html
+        Fix reflection painting on elements with compositing layers.
 
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseTransitionShorthand):
+        Test: compositing/reflections/reflection-on-composited.html
 
-2008-11-20  Dean Jackson  <dino@apple.com>
-
-        Reviewed by Antti Koivisto
-
-        https://bugs.webkit.org/show_bug.cgi?id=22368
-
-        Make sure pauseTransition API takes transition delay into account.
-
-        Test: transitions/transition-drt-api-delay.html
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::pauseAtTime):
-
-2008-11-20  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler
-
-        https://bugs.webkit.org/show_bug.cgi?id=20368
+        * rendering/RenderLayer.h:
+        Add a new PaintLayerPaintingReflection flag which is set while painting inside
+        reflections.
+        (WebCore::RenderLayer::setPaintingInsideReflection):
+        Add a setter so that RenderLayerBacking can call it.
 
-        Implement getComputedStyle for animation properties. Remove individual
-        computed values for transform-origin-x, transform-origin-y, and just
-        return transform-origin instead. Return "none" for default animation-name,
-        and fix the initial value.
+        * rendering/RenderLayer.cpp:
+        (WebCore::shouldDoSoftwarePaint):
+        Utility to clarify the logic of when a composited layer should do a software paint.
         
-        Tests: animations/computed-style.html
-               transforms/computed-style-origin.html
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::):
-        (WebCore::getDelayValue):
-        (WebCore::getDurationValue):
-        (WebCore::getTimingFunctionValue):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::initialAnimationName):
-
-2008-11-20  Justin Garcia  <justin.garcia@apple.com>
+        (WebCore::RenderLayer::paintLayer):
+        Use shouldDoSoftwarePaint() to determine when to software-paint a reflected layer.
+        Remove transform-related tests from the reflection-painting if test because they appear
+        to be unnecessary.
 
-        Reviewed by Beth Dakin.
-        
-        Preparation for:
-        <rdar://problem/2610675> Blank line that is quoted can't be deleted
-        
-        To fix this we need to make changes to the code that creates selections to delete
-        when the user does a backward or forward delete with a caret selection.  For certain
-        caret positions, we now want to remove something other than the standard "caret extended
-        backward/forward by one unit".  The problem is that there were two pieces of code 
-        responsible for doing this, one in Editor::deleteWithDirection, and another inside 
-        TypingCommand::deleteKeyPressed.  The code in deleteWithDirection is a recent 
-        addition (r19172), and adding it there caused regressions because it prevented the 
-        code in deleteKeyPressed from ever running.  The regressions were never caught because 
-        JS deletion uses deleteKeyPressed while manual deletion uses deleteWithDirection.
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        Add the code to paint reflections to the composited layer painting method.
         
-        This patch removes selection creation code from deleteWithDirection so that deleteKeyPressed
-        can handle it.  That required moving code to handle the kill ring down into deleteKeyPressed.
-        
-        Follow up patches will fix <rdar://problem/2610675>, and attempt to eliminate the rest of the 
-        discrepancies between the behavior of JS deletions and manual deletions, so that we 
-        have better test coverage.
-
-        * editing/Editor.cpp:
-        (WebCore::Editor::deleteWithDirection): Early return if m_frame->document() is null, instead
-        of checking for that periodically throughout the function.  There's really nothing to be done
-        if it's null anyway.
-        Move kill ring code down into deleteKeyPressed.
-        * editing/Editor.h:
-        * editing/TypingCommand.cpp:
-        (WebCore::TypingCommand::TypingCommand):
-        (WebCore::TypingCommand::deleteKeyPressed):
-        (WebCore::TypingCommand::forwardDeleteKeyPressed):
-        (WebCore::TypingCommand::doApply):
-        * editing/TypingCommand.h:
-        (WebCore::TypingCommand::create):
-
-2008-11-20  Darin Adler  <darin@apple.com>
-
-        Earlier version reviewed by Justin Garcia.
-
-        - fix <rdar://problem/4108572> REGRESSION: Can't extend selection with shift-arrow in read only mode
-
-        * editing/Editor.cpp:
-        (WebCore::Editor::handleKeyboardEvent): Remove isContentEditable check -- keyboard events can be
-        handled even when the selection is not in an editable area.
-        (WebCore::Editor::handleInputMethodKeydown): Ditto.
-
-        * editing/EditorCommand.cpp: Changed the enabled rule for operations that change the selection to
-        allow use when there's a selection even if it's not in an editable area. This includes commands
-        like shift-arrow keys to extend the slection, but not commands like arrow keys to move the
-        insertion point.
-
-2008-11-20  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22380
-        Fix WorkerContext refcounting
-
-        * dom/WorkerContext.cpp:
-        (WebCore::WorkerContext::WorkerContext):
-        * dom/WorkerContext.h:
-        (WebCore::WorkerContext::script):
-        (WebCore::WorkerContext::clearScript):
-        Added a method to manually destroy WorkerScriptController.
-
-        * dom/WorkerThread.cpp: (WebCore::WorkerThread::workerThread):
-        Destroy WorkerScriptController to release any references to WorkerContext.
-
-2008-11-19  Julien Chaffraix  <jchaffraix@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Last part of bug 21106: .in format discussed changes
-        https://bugs.webkit.org/show_bug.cgi?id=21106
-
-        - Renamed isAudioHack to wrapperOnlyIfMediaIsAvailable as requested.
-
-        - Cleaned up additionnal function parameters that were unneeded.
-
-        * dom/make_names.pl:
-        * html/HTMLTagNames.in:
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::paint):
+        Set the PaintLayerPaintingReflection flag.
 
-2008-11-20  Alexey Proskuryakov  <ap@webkit.org>
+2009-06-23  Antti Koivisto  <antti@apple.com>
 
         Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22383
-        Worker tests spill error messages over to consequent tests
-
-        * dom/Worker.cpp: (WebCore::Worker::Worker):
-        Raise an exception immediately if URL is empty. Dcoument::completeURL() returns document URL
-        in this case, and there is no sense in starting a thread and trying to parse document source
-        as JavaScript.
-
-        * bindings/js/JSWorkerConstructor.cpp: (WebCore::constructWorker):
-        Return quickly if toString() raised an exception.
-
-2008-11-19  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22190
-
-        Fix the painting and event handling in transformed search fields.
-        When painting the cancel and results button parts,  get the rect from AppKit
-        relative to the input bounds (rather than in absolute coords), then convert
-        it into the coords of the part's renderer (which is the one that is painting).
-        To do this we need to compute an offset relative to some container, so expose
-        a method on RenderObject for that.
         
-        Also fix the location at which the search popup shows up to take transforms
-        into account, and fix the math that is used to figure out if the search
-        results button, or the cancel button should get the mouse events.
-        
-        Test: fast/forms/search-transformed.html
-
-        * rendering/RenderBox.h:
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::offsetFromContainer):
-        * rendering/RenderObject.h:
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::forwardEvent):
-        (WebCore::RenderTextControl::showPopup):
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::convertToPaintingRect):
-        (WebCore::RenderThemeMac::paintSearchFieldCancelButton):
-        (WebCore::RenderThemeMac::paintSearchFieldResultsDecoration):
-        (WebCore::RenderThemeMac::paintSearchFieldResultsButton):
-
-2008-11-20  Joerg Bornemann  <joerg.bornemann@trolltech.com>
-
-        Reviewed by Simon Hausmann.
-
-        Steps towards making the the Qt port of WebKit compile on Windows CE
-
-        https://bugs.webkit.org/show_bug.cgi?id=20746
-
-        * WebCore.pro: Various fixes to include windows specific build options
-        also in the Windows CE build.
-        * loader/icon/IconDatabase.cpp: Removed unnecessary errno.h inclusion.
-        * platform/FileSystem.h: Changed Q_OS_WIN32 to Q_OS_WIN to include CE.
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::getWindowsContext): SetWorldTransform is
-        not available on CE.
-        * platform/graphics/qt/PathQt.cpp: Added local definition of M_PI.
-        * platform/qt/FileSystemQt.cpp: Changed Q_OS_WIN32 to Q_OS_WIN to include CE.
-        * platform/qt/KeyboardCodes.h: Extend #idefs to define the missing OEM
-        constants on CE.
-        * platform/qt/TemporaryLinkStubs.cpp: Added stubs for plugins.
-        * platform/text/RegularExpression.cpp: Removed unused sys/types.h and
-        pcre.h inclusions.
-        * platform/win/SystemTimeWin.cpp:
-        (WebCore::userIdleTime): Don't use GetLastInputInfo on CE, it does not
-        exist.
-
-2008-11-20  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22379
-        Make CSSOM use less memory
-        
-        - Shrink CSSProperty by half by using bitfields.
-        - Get rid of m_strictParsing field in StyleBase by moving it up to CSSStyleSheet
-          and CSSMutableStyleDeclaration. This reduces size of many highly popular objects.
-
-        * css/CSSMutableStyleDeclaration.cpp:
-        (WebCore::CSSMutableStyleDeclaration::CSSMutableStyleDeclaration):
-        (WebCore::CSSMutableStyleDeclaration::operator=):
-        * css/CSSMutableStyleDeclaration.h:
-        (WebCore::CSSMutableStyleDeclaration::setStrictParsing):
-        (WebCore::CSSMutableStyleDeclaration::useStrictParsing):
-        * css/CSSProperty.h:
-        * css/CSSStyleSheet.cpp:
-        (WebCore::CSSStyleSheet::CSSStyleSheet):
-        * css/CSSStyleSheet.h:
-        (WebCore::CSSStyleSheet::setStrictParsing):
-        (WebCore::CSSStyleSheet::useStrictParsing):
-        * css/StyleBase.h:
-        (WebCore::StyleBase::useStrictParsing):
-        (WebCore::StyleBase::StyleBase):
-
-2008-11-19  Darin Fisher  <darin@chromium.org>
-
-        Fix bustage.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22373
-        Ports busted by addition of ScriptValue.{h,cpp}
-        
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::performRequest):
-
-2008-11-19  Darin Fisher  <darin@chromium.org>
-
-        Bustage fix.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22373
-        Ports busted by addition of ScriptValue.{h,cpp}
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCoreSources.bkl:
-        * dom/XMLTokenizerQt.cpp:
-        * plugins/PluginView.cpp:
-
-2008-11-19  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Geoff Garen.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22345
-        Define ScriptValue as a thin container for a JSC::Value*.
-
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/ScheduledAction.cpp:
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
-        * bindings/js/ScriptController.h:
-        * bindings/js/ScriptValue.cpp: Added.
-        (WebCore::ScriptValue::getString):
-        * bindings/js/ScriptValue.h: Added.
-        (WebCore::ScriptValue::ScriptValue):
-        (WebCore::ScriptValue::jsValue):
-        * dom/ScriptElement.cpp:
-        * dom/XMLTokenizer.cpp:
-        * dom/XMLTokenizerLibxml2.cpp:
-        * html/HTMLTokenizer.cpp:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::executeIfJavaScriptURL):
-        (WebCore::FrameLoader::executeScript):
-        * loader/FrameLoader.h:
-
-2008-11-19  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Justin Garcia.
-
-        Fix for <rdar://problem/5472507> Remove color property when a user 
-        sets color to black
-
-        This patch prevents us from inserting font nodes during the 
-        ApplyStyleCommand if they will not change the computed style of an 
-        element.
-
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::fontColorChangesComputedStyle):
-        (WebCore::fontSizeChangesComputedStyle):
-        (WebCore::fontFaceChangesComputedStyle):
-        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded):
-
-2008-11-19  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Antti Koivisto
-        
-        https://bugs.webkit.org/show_bug.cgi?id=22111
-        
-        Fix hit testing in controls on transformed video elements
-        by replacing absoluteBoundingBoxRect().contains() with
-        code that maps the point into local coords, taking
-        transforms into account.
-
-        Test: media/video-controls-transformed.html
-
-        * platform/graphics/MediaPlayer.h:
-        * rendering/RenderMedia.cpp:
-        (WebCore::rendererContainsPoint):
-        (WebCore::RenderMedia::forwardEvent):
-
-2008-11-19  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler
-
-        https://bugs.webkit.org/show_bug.cgi?id=22348
+        https://bugs.webkit.org/show_bug.cgi?id=26643
+        Memory cache should respect Cache-Control: no-store
         
-        Need to educate style sharing about autofill, so that style does not
-        get shared between input elements that are autofilled, and those
-        that are not. Setting autofill should also do a setChanged on the node.
+        Make resources with Cache-Control: no-store uncacheable in the memory cache.
+        They get evicted immediately when all clients are gone and are always
+        reloaded from the server.
 
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::canShareStyleWithElement):
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
-        * dom/Node.h:
-        (WebCore::Node::isAutofilled):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::setAutofilled):
-        * html/HTMLInputElement.h:
-        (WebCore::HTMLInputElement::isAutofilled):
-
-2008-11-19  Brett Wilson  <brettw@chromium.org>
-
-        Reviewed by Antti Koivisto.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22349
-
-        Clear the subresource loader client when the client is removed in
-        response to a 304 (not modified). This prevents an inconsistent state
-        where the loader thinks it's active and the loader::Host doesn't.
-
-        * loader/loader.cpp:
-        (WebCore::Loader::Host::didReceiveResponse):
-
-2008-11-19  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22355
-        Systematize code for replacing global constructors
-
-        Test: fast/workers/worker-replace-global-constructor.html
-
-        * bindings/js/JSDOMWindowBase.cpp:
-        (setJSDOMWindowBaseEvent): Changed to put the value as property, matching what generated
-        code for global constructor setters does.
-        (setJSDOMWindowBaseAudio): Ditto.
-        (setJSDOMWindowBaseImage): Ditto.
-        (setJSDOMWindowBaseMessageChannel): Ditto.
-        (setJSDOMWindowBaseOption): Ditto.
-        (setJSDOMWindowBaseWorker): Ditto.
-        (setJSDOMWindowBaseXMLHttpRequest): Ditto.
-        (setJSDOMWindowBaseXSLTProcessor): Ditto.
-        (WebCore::JSDOMWindowBase::put): Removed special cases for global constructors.
-
-        * bindings/js/JSWorkerContext.cpp:
-        (WebCore::JSWorkerContext::getOwnPropertySlot): Look up overrides before own properties,
-        as it is done for Window.
-        (WebCore::setJSWorkerContextMessageEvent): Implemented in the same way as Window global
-        constructors are.
-        (WebCore::setJSWorkerContextWorkerLocation): Ditto.
-
-2008-11-19  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22341
-        Text codecs should not use static data without locking
-
-        * platform/text/TextCodecICU.cpp:
-        * platform/text/mac/TextCodecMac.cpp:
-        Made cached converters per-thread.
-
-        * platform/text/TextEncodingRegistry.cpp:
-        (WebCore::encodingRegistryMutex): Added a mutex for codec maps access.
-        (WebCore::addToTextCodecMap): Don't use TextEncoding just to canonicalize the name, as it
-        causes a deadlock due to a recursive call into registry.
-        (WebCore::buildBaseTextCodecMaps): Added assertions.
-        (WebCore::newTextCodec): Take a lock to avoid concurrent access to codec maps.
-        (WebCore::atomicCanonicalTextEncodingName): Ditto.
-        (WebCore::noExtendedTextEncodingNameUsed): Added a comment, explaining why locking is not
-        necessary here.
-
-2008-11-19  Alexey Proskuryakov  <ap@webkit.org>
-
-        Touch WebCorePrefix.h to force a rebuild, needed because of changed feature defines.
-
-        * WebCorePrefix.h:
-
-2008-11-19  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22310
-        Worker exceptions should be printed to console
-
-        * dom/Document.cpp: (WebCore::Document::reportException):
-        * dom/Document.h:
-        * dom/ScriptExecutionContext.h:
-        * dom/WorkerContext.cpp: (WebCore::WorkerContext::reportException):
-        * dom/WorkerContext.h:
-        Added a reportException() method on ScriptExecutionContext. It forwards the exception info
-        up until it finds a Document context, and then it prints it to console.
-
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSAbstractEventListener::handleEvent): Don't talk to Console directly, use
-        ScriptExecutionContext::reportException. Also, fixed a bug where Document::updateDocumentsRendering()
-        could be called from workers.
-        (WebCore::JSLazyEventListener::parseCode): Moved variable declaration inside if block for clarity.
-
-        * bindings/js/WorkerScriptController.cpp: (WebCore::WorkerScriptController::evaluate):
-        Report exceptions to ScriptExecutionContext.
-
-        * dom/WorkerMessagingProxy.cpp:
-        (WebCore::MessageWorkerTask::performTask):
-        (WebCore::WorkerExceptionTask::create):
-        (WebCore::WorkerExceptionTask::WorkerExceptionTask):
-        (WebCore::WorkerExceptionTask::performTask):
-        (WebCore::WorkerMessagingProxy::postWorkerException):
-        * dom/WorkerMessagingProxy.h:
-        Added a task for posting exception information.
-
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::reportException):
-        (WebCore::reportCurrentException):
-        * bindings/js/JSDOMBinding.h:
-        Added helper methods for reporting exceptions via ScriptExecutionContext.
-
-        * page/Console.cpp:
-        * page/Console.h:
-        Removed methods for directly reporting exceptions to console.
-
-        * bindings/js/JSCustomPositionCallback.cpp:
-        (WebCore::JSCustomPositionCallback::handleEvent):
-        * bindings/js/JSCustomPositionErrorCallback.cpp:
-        (WebCore::JSCustomPositionErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementCallback.cpp:
-        (WebCore::JSCustomSQLStatementCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
-        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionCallback.cpp:
-        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
-        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
-        * bindings/js/JSCustomVoidCallback.cpp:
-        (WebCore::JSCustomVoidCallback::handleEvent):
-        * bindings/js/JSCustomXPathNSResolver.cpp:
-        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/js/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::execute):
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
-        * bindings/objc/WebScriptObject.mm:
-        (WebCore::addExceptionToConsole):
-        Switch to JSDOMBinding methods for reporting exceptions.
-
-2008-11-18  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        - WebCore part of https://bugs.webkit.org/show_bug.cgi?id=22331
-          <rdar://problem/6381657> REGRESSION: Contextual menu no longer has an "Inspect Element" item
-
-        * platform/ContextMenuItem.h:
-        (WebCore::ContextMenuAction): Reorder this enum to keep it in sync with
-        the one in WebUIDelegate.h.
-
-2008-11-18  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Adler.
+        Conforms to RFC2616 14.9.2 and seems also match Firefox behavior.
 
-        https://bugs.webkit.org/show_bug.cgi?id=22346
-        PlatformString should also include HashSet.h for non-JSC builds
-
-        * platform/text/PlatformString.h:
-
-2008-11-18  Adele Peterson  <adele@apple.com>
-
-        Reviewed by Holger Hans Peter Freyther.
-
-        Flip check added in recent refactoring so the background gets updated when the background color is valid, not invalid.
-
-        * loader/FrameLoaderClient.cpp: (WebCore::FrameLoaderClient::transitionToCommittedForNewPage):
-
-2008-11-18  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22343
-        Remove unused runtime/Collector, JSLock includes in Page.cpp
-
-        * page/Page.cpp:
-
-2008-11-18  Ada Chan  <adachan@apple.com>
-
-        Bug 22344: Make select popup window opaque
-        https://bugs.webkit.org/show_bug.cgi?id=22344
-
-        Reviewed by Steve Falkenburg.
-
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::show):
-
-2008-11-18  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22342
-        Remove unused JSLock.h include
-
-        * dom/Document.cpp:
-
-2008-11-18  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Sam Weinig.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22334
-
-        Add WMLBRElement, correcting <br/> behaviour in WML.
-        Enable entity replacment for WML documents.
-        Handle WML specific <p> 'mode' attribute.
-
-        Generate layout tests results for fast/wml.
-
-        Tests cases that pass now:
-        fast/wml/br-element-in-table.wml
-        fast/wml/br-element-in-text.wml
-        fast/wml/case-sensitivity.wml
-        fast/wml/cdata-section.wml
-        fast/wml/comment.wml
-        fast/wml/entity.wml
-        fast/wml/p-align.wml
-        fast/wml/p-mode.wml
-        fast/wml/text-emphasis.wml
-        fast/wml/validate-dtd.wml
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::removeClient):
+        (WebCore::CachedResource::canUseCacheValidator):
+        (WebCore::CachedResource::mustRevalidate):
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::ResourceResponseBase):
+        (WebCore::ResourceResponseBase::parseCacheControlDirectives):
+        (WebCore::ResourceResponseBase::cacheControlContainsNoStore):
+        * platform/network/ResourceResponseBase.h:
 
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.xcodeproj/project.pbxproj:
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::isWMLDocument):
-        (WebCore::XMLTokenizer::insertErrorMessageBlock):
-        * dom/XMLTokenizer.h:
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::internalSubset):
-        (WebCore::getEntityHandler):
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::parse):
-        * wml/WMLBRElement.cpp: Added.
-        (WebCore::WMLBRElement::WMLBRElement):
-        (WebCore::WMLBRElement::mapToEntry):
-        (WebCore::WMLBRElement::parseMappedAttribute):
-        (WebCore::WMLBRElement::createRenderer):
-        * wml/WMLBRElement.h: Added.
-        * wml/WMLPElement.cpp:
-        (WebCore::WMLPElement::parseMappedAttribute):
-        (WebCore::WMLPElement::insertedIntoDocument):
-        * wml/WMLPElement.h:
-        * wml/WMLTagNames.in:
-
-2008-11-18  Alexey Proskuryakov  <ap@webkit.org>
+2009-06-23  Brady Eidson  <beidson@apple.com>
 
         Windows build fix.
 
-        * WebCore.vcproj/WebCore.vcproj: Fix relative paths to use $(WebKitOutputDir).
-
-2008-11-18  Darin Adler  <darin@apple.com>
-
-        - try to fix Wx build
-
-        * WebCoreSources.bkl: Added FrameLoaderClient.cpp.
-
-2008-11-18  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22337
-        Enable workers by default
-
-        Tests: fast/workers/worker-constructor.html
-               fast/workers/worker-event-listener.html
-               fast/workers/worker-gc.html
-               fast/workers/worker-location.html
-
-        * Configurations/WebCore.xcconfig:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.vcproj/build-generated-files.sh:
-        Define ENABLE_WORKERS.
-
-2008-11-18  Darin Adler  <darin@apple.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        - first cut at https://bugs.webkit.org/show_bug.cgi?id=10957
-          <rdar://problem/5516594> please add support for HTTP-only cookies
-
-        Test: http/tests/xmlhttprequest/get-dangerous-headers.html
-
-        No test for HTTP-only support in JavaScript yet, since the Mac and Win changes
-        require an updated CFNetwork.
-
-        * platform/mac/CookieJar.mm:
-        (WebCore::isHTTPOnly): Added.
-        (WebCore::filterCookies): Added.
-        (WebCore::cookies): Use filterCookies to prevent getting HTTP-only cookies.
-        (WebCore::setCookies): Use filterCookies to prevent setting HTTP-only cookies.
-
-        * platform/network/win/CookieJarCFNetWin.cpp:
-        (WebCore::isHTTPOnly): Added.
-        (WebCore::filterCookies): Added.
-        (WebCore::setCookies): Use filterCookies to prevent getting HTTP-only cookies.
-        (WebCore::cookies): Use filterCookies to prevent getting HTTP-only cookies.
-
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::isSetCookieHeader): Added.
-        (WebCore::XMLHttpRequest::getAllResponseHeaders): Hide Set-Cookie headers from
-        clients that don't have local-resource privileges.
-        (WebCore::XMLHttpRequest::getResponseHeader): Ditto.
-
-        - clean soup-specific details out of shared cookie jar header
-
-        * platform/CookieJar.h: Removed the soup-specific parts of this.
-        * platform/network/soup/CookieJarSoup.cpp: Changed to include
-        CookieJarSoup.h. Tweaked implementation a bit to handle UTF-8 better.
-        * platform/network/soup/CookieJarSoup.h: Added. Has the Soup-specified
-        part of CookieJar.h.
-        * platform/network/soup/ResourceHandleSoup.cpp: Changed to include
-        CookieJarSoup.h.
-
-2008-11-18  Steve Falkenburg  <sfalken@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=22329
-        Improper bitwise and tests against 0 in Windows context menu code
-
-        Reviewed by John Sullivan.
-
-        * platform/win/ContextMenuItemWin.cpp:
-        (WebCore::ContextMenuItem::type):
-        (WebCore::ContextMenuItem::enabled):
-
-2008-11-18  John Sullivan  <sullivan@apple.com>
-
-        Yet more Mac build fixing
-
-        * WebCore.base.exp: Export __ZTVN7WebCore17FrameLoaderClientE
-
-2008-11-18  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon Hausmann.
-
-        React properly to frame rect changes for QWidget based plugins
-
-        We now set the geometry of the QWidget in frameRectsChanged,
-        intead of setFrameRect, which means we pick up the changes to
-        the frame rect when scrolling. We also set a mask on the
-        widget to keep it from painting over scrollbars and the like
-
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::Widget::setFrameRect):
-
-2008-11-18  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Rubber-stamped by Simon Hausmann.
-
-        Don't mark scrollbars as focused in QtWebKit
-
-        When initing from the widget we also got the focus state,
-        but this does not make sense for scrollbars.
-
-        * platform/qt/ScrollbarThemeQt.cpp:
-        (WebCore::styleOptionSlider):
-
-2008-11-18  Alexey Proskuryakov  <ap@webkit.org>
-
-        More Mac build fixing.
-
-        * WebCore.base.exp: Export FrameLoaderClient destructor.
-
-2008-11-18  Alexey Proskuryakov  <ap@webkit.org>
-
-        Mac build fix.
-
-        * WebCore.xcodeproj/project.pbxproj: Add FrameLoaderClient.cpp for now.
-
-2008-11-18  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon Hausmann.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22056
-
-        Attempt to share transitionToCommittedForNewPage of FrameLoaderClient with the different ports
-
-        After Hyatt's work on Widget and ScrollView there is little difference
-        between the implementation of Qt, Gtk+ and Win. In fact any kind of
-        difference is mostly a bug. Alp has fixed two of such errors for the Gtk+
-        port and the Qt port has at least one of them left.
-
-        The only difference between the implementations is in getting the the
-        IntSize for the new FrameView, the background color to be applied and
-        eventually some post processing.
-
-        Unify the implementations by providing a static helper function that
-        takes a Frame, IntSize, color and transparency bit and calling it from
-        the Gtk+, the Qt and the Windows port.
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * loader/FrameLoaderClient.cpp: Added.
-        (WebCore::FrameLoaderClient::~FrameLoaderClient):
-        (WebCore::FrameLoaderClient::transitionToCommittedForNewPage):
-        * loader/FrameLoaderClient.h:
-
-2008-11-18  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon Hausmann.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22056
-
-        Move setting the background color and transparency from WebKit/win
-        to WebCore. This allows WebKit/win, WebKit/Qt and WebKit/Gtk+
-        to share this code.
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::updateBackgroundRecursively):
-        * page/FrameView.h:
-
-2008-11-18  Ariya Hidayat  <ariya.hidayat@trolltech.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Fix the bug where select elements are painted without border.
-        http://trolltech.com/developer/task-tracker/index_html?id=218957&method=entry
-
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::paintMenuList):
-
-2008-11-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Gtk build fix. Not reviewed.
-
-        * GNUmakefile.am: Fix USER_AGENT_STYLESHEETS, wml.css is in css/,
-        not in wml/.
-
-2008-11-18  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22308
-        Improve Worker GC behavior
-
-        * dom/ActiveDOMObject.cpp: (WebCore::ActiveDOMObject::hasPendingActivity):
-        * dom/ActiveDOMObject.h:
-        Made hasPendingActivity() virtual, letting Worker add behavior to it.
-
-        * bindings/js/WorkerScriptController.cpp: (WebCore::WorkerScriptController::evaluate):
-        * dom/WorkerThread.cpp: (WebCore::WorkerThread::workerThread):
-        Tell message proxy whether there are active objects in the worker whenever JS execution
-        finishes.
-
-        * dom/ScriptExecutionContext.h: (WebCore::ScriptExecutionContext::activeDOMObjects):
-        Added a typedef for activeDOMObjects() return type, necessary to declare iterators.
-
-        * dom/Worker.h:
-        * dom/Worker.cpp: (WebCore::Worker::hasPendingActivity): A Worker is active if it is still
-        loading, or if it has unconfirmed messages, or it the worker thread has pending activity.
-
-        * dom/WorkerContext.h:
-        * dom/WorkerContext.cpp: (WebCore::WorkerContext::hasPendingActivity): Check all registered
-        active objects for pending activity.
-
-        * dom/WorkerMessagingProxy.cpp:
-        (WebCore::MessageWorkerContextTask::performTask):
-        (WebCore::WorkerThreadActivityReportTask::create):
-        (WebCore::WorkerThreadActivityReportTask::WorkerThreadActivityReportTask):
-        (WebCore::WorkerThreadActivityReportTask::performTask):
-        (WebCore::WorkerMessagingProxy::WorkerMessagingProxy):
-        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
-        (WebCore::WorkerMessagingProxy::workerObjectDestroyed):
-        (WebCore::WorkerMessagingProxy::workerContextDestroyedInternal):
-        (WebCore::WorkerMessagingProxy::confirmWorkerThreadMessage):
-        (WebCore::WorkerMessagingProxy::reportWorkerThreadActivity):
-        (WebCore::WorkerMessagingProxy::reportWorkerThreadActivityInternal):
-        (WebCore::WorkerMessagingProxy::workerThreadHasPendingActivity):
-        * dom/WorkerMessagingProxy.h:
-        Track outstanding messages, and activity reported by worker thread.
-
-2008-11-18  Alexey Proskuryakov  <ap@webkit.org>
-
-        Rubber-stamped by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22306
-        Disable channel messaging support
-
-        * bindings/js/JSDOMWindowBase.cpp:
-        (jsDOMWindowBaseMessageChannel):
-        * page/DOMWindow.idl:
-        Hide MesssagePort and MessageChannel global constructors. Due to the way MessageChannel
-        constructor is added, it remains enumerable, but undefined.
-
-2008-11-17  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by Mark Rowe.
-
-        Remove WBXML code. MainResourceLoader is not an appropriate location.
-        Revert until we find a better place.
-
-        The mime type which belongs to wmlc should be enabled anyway so WML documents get build.
-        Remove the ENABLE(WBXML) blocks around these types in MIMETypeRegistry / DOMImplementation.
-
-        * WebCore.pro:
-        * dom/DOMImplementation.cpp:
-        (WebCore::DOMImplementation::createDocument):
-        * loader/MainResourceLoader.cpp:
-        (WebCore::MainResourceLoader::addData):
-        * platform/MIMETypeRegistry.cpp:
-        (WebCore::initializeSupportedNonImageMimeTypes):
-
-2008-11-17  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Not reviewed. Build fix.
-
-        Oops, disable WML by default on Qt.
-
-        * WebCore.pro:
-
-2008-11-17  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
-
-        Reviewed by George Staikos.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22324 (Add basic subset of WML elements)
-
-        Add first bits of WML support. Only <card> & <p> and <a> elements are supported in this first patch.
-        Support for most other elements will be added step-by-step (merging in small chunks from a big patch).
-
-        WML is not build by default.
-
-        * DerivedSources.make: Handle WMLNames/WMLElementFactory generation.
-        * GNUmakefile.am: Add new files and generator hooks.
-        * WebCore.pro: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * css/CSSStyleSelector.cpp: Load wml.css on demand, just like it's done for SVG.
-        (WebCore::linkAttribute):
-        (WebCore::CSSStyleSelector::styleForElement):c
-        * css/wml.css: Added.
-        * dom/DOMImplementation.cpp: Handle WMLDocument creation
-        (WebCore::DOMImplementation::createDocument):
-        * dom/Document.cpp: Handle WMLElement creation.
-        (WebCore::Document::createElement):
-        * dom/Document.h: Add helper function identifying WML documents.
-        (WebCore::Document::isWMLDocument):
-        * dom/Node.h: Add heper function identifying WML elements.
-        (WebCore::Node::isWMLElement):
-        * dom/XMLTokenizer.cpp: Handle errors in WML documents
-        (WebCore::XMLTokenizer::insertErrorMessageBlock):
-        * dom/XMLTokenizerLibxml2.cpp: Add WML DTD checks.
-        (WebCore::XMLTokenizer::internalSubset):
-        * dom/XMLTokenizerQt.cpp: Ditto.
-        (WebCore::):
-        * dom/make_names.pl: Force internal linkage for the "tagConstructor" functions, avoiding SVG<->WML clashes.
-        * history/BackForwardList.cpp: Add WML specific function for clearing the history.
-        (WebCore::BackForwardList::clearWmlPageHistory):
-        * history/BackForwardList.h:
-        * loader/FrameLoader.cpp: Add WML specific 'shouldReload' logic.
-        (WebCore::FrameLoader::FrameLoader):
-        (WebCore::FrameLoader::setForceReloadWmlDeck):
-        (WebCore::FrameLoader::shouldReload):
-        (WebCore::FrameLoader::loadItem):
-        * loader/FrameLoader.h:
-        * loader/MainResourceLoader.cpp: Add WBXML support (only enabled on Linux/Qt at the moment)
-        (WebCore::MainResourceLoader::addData):
-        * page/Frame.cpp: Initialize WMLNames.
-        (WebCore::Frame::Frame):
-        * page/Page.cpp: Maintain WMLPageState object per Page.
-        (WebCore::Page::Page):
-        (WebCore::Page::setWMLPageState):
-        (WebCore::Page::wmlPageState):
-        * page/Page.h:
-        * platform/MIMETypeRegistry.cpp: Recognize WML extensions.
-        (WebCore::initializeSupportedNonImageMimeTypes):
-        * platform/gtk/MIMETypeRegistryGtk.cpp: Ditto.
-        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
-        * platform/qt/MIMETypeRegistryQt.cpp: Ditto.
-        (WebCore::):
-        * platform/win/MIMETypeRegistryWin.cpp: Ditto.
-        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
-        * manual-tests/wml: Added.
-        * manual-tests/wml/a-br-element.wml: Added.
-        * manual-tests/wml/a-element.wml: Added.
-        * manual-tests/wml/a-img-element.wml: Added.
-        * manual-tests/wml/access-target.wml: Added.
-        * manual-tests/wml/anchor-br-element.wml: Added.
-        * manual-tests/wml/anchor-element.wml: Added.
-        * manual-tests/wml/anchor-img-element.wml: Added.
-        * manual-tests/wml/card-newcontext-attr.wml: Added.
-        * manual-tests/wml/card-onenterbackward.wml: Added.
-        * manual-tests/wml/card-onenterforward.wml: Added.
-        * manual-tests/wml/card-ontimer.wml: Added.
-        * manual-tests/wml/deck-access-control.wml: Added.
-        * manual-tests/wml/go-element.wml: Added.
-        * manual-tests/wml/input-emptyok.wml: Added.
-        * manual-tests/wml/input-format.wml: Added.
-        * manual-tests/wml/onevent-go.wml: Added.
-        * manual-tests/wml/onevent-noop.wml: Added.
-        * manual-tests/wml/onevent-prev.wml: Added.
-        * manual-tests/wml/onevent-refresh.wml: Added.
-        * manual-tests/wml/onevent-shadow.wml: Added.
-        * manual-tests/wml/postfield-get.wml: Added.
-        * manual-tests/wml/postfield-post.wml: Added.
-        * manual-tests/wml/select-element.wml: Added.
-        * manual-tests/wml/select-onpick-event.wml: Added.
-        * manual-tests/wml/setvar-element.wml: Added.
-        * manual-tests/wml/targetdeck.wml: Added.
-        * manual-tests/wml/task-go-in-anchor.wml: Added.
-        * manual-tests/wml/task-noop-in-do.wml: Added.
-        * manual-tests/wml/task-noop-in-onevent.wml: Added.
-        * manual-tests/wml/task-prev-in-anchor.wml: Added.
-        * manual-tests/wml/task-refresh-in-anchor.wml: Added.
-        * manual-tests/wml/template-go.wml: Added.
-        * manual-tests/wml/template-onevent.wml: Added.
-        * manual-tests/wml/template-ontimer.wml: Added.
-        * manual-tests/wml/timer.wml: Added.
-        * manual-tests/wml/variable-substitution.wml: Added.
-        * wml: Added.
-        * wml/WMLAElement.cpp: Added.
-        (WebCore::WMLAElement::WMLAElement):
-        (WebCore::WMLAElement::parseMappedAttribute):
-        (WebCore::WMLAElement::supportsFocus):
-        (WebCore::WMLAElement::isFocusable):
-        (WebCore::WMLAElement::isMouseFocusable):
-        (WebCore::WMLAElement::isKeyboardFocusable):
-        (WebCore::WMLAElement::defaultEventHandler):
-        (WebCore::WMLAElement::accessKeyAction):
-        (WebCore::WMLAElement::isURLAttribute):
-        (WebCore::WMLAElement::target):
-        * wml/WMLAElement.h: Added.
-        * wml/WMLAttributeNames.in: Added.
-        * wml/WMLCardElement.cpp: Added.
-        (WebCore::WMLCardElement::WMLCardElement):
-        * wml/WMLCardElement.h: Added.
-        * wml/WMLDocument.cpp: Added.
-        (WebCore::WMLDocument::WMLDocument):
-        (WebCore::WMLDocument::~WMLDocument):
-        * wml/WMLDocument.h: Added.
-        (WebCore::WMLDocument::create):
-        (WebCore::WMLDocument::isWMLDocument):
-        * wml/WMLElement.cpp: Added.
-        (WebCore::WMLElement::WMLElement):
-        (WebCore::WMLElement::mapToEntry):
-        (WebCore::WMLElement::parseMappedAttribute):
-        (WebCore::WMLElement::rendererIsNeeded):
-        (WebCore::WMLElement::createRenderer):
-        * wml/WMLElement.h: Added.
-        (WebCore::WMLElement::isWMLElement):
-        * wml/WMLPElement.cpp: Added.
-        (WebCore::WMLPElement::WMLPElement):
-        (WebCore::WMLPElement::mapToEntry):
-        (WebCore::WMLPElement::parseMappedAttribute):
-        * wml/WMLPElement.h: Added.
-        * wml/WMLPageState.cpp: Added.
-        (WebCore::WMLPageState::WMLPageState):
-        (WebCore::WMLPageState::~WMLPageState):
-        (WebCore::WMLPageState::reset):
-        (WebCore::WMLPageState::setNeedCheckDeckAccess):
-        (WebCore::WMLPageState::isDeckAccessible):
-        * wml/WMLPageState.h: Added.
-        (WebCore::WMLPageState::storeVariable):
-        (WebCore::WMLPageState::storeVariables):
-        (WebCore::WMLPageState::getVaribale):
-        (WebCore::WMLPageState::hasVariables):
-        (WebCore::WMLPageState::historyLength):
-        (WebCore::WMLPageState::setHistoryLength):
-        (WebCore::WMLPageState::page):
-        (WebCore::WMLPageState::activeCard):
-        (WebCore::WMLPageState::setActiveCard):
-        (WebCore::WMLPageState::setDeckAccessDomain):
-        (WebCore::WMLPageState::setDeckAccessPath):
-        (WebCore::WMLPageState::hasDeckAccess):
-        * wml/WMLTagNames.in: Added.
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Updated for JavaScriptCore renames.
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::play):
+        (QTMovieWin::pause):
+        (QTMovieWin::setRate):
+        (QTMovieWin::setCurrentTime):
 
-        * WebCore.pro:
-        * webcore-base.bkl:
+2009-06-23  Kevin McCullough  <kmccullough@apple.com>
 
-2008-11-17  Justin Garcia  <justin.garcia@apple.com>
+        Reviewed by Adele Peterson.
 
-        Reviewed by Beth Dakin.
+        <rdar://problem/6902203> REGRESSION: 'Return' insertion point incorrect
+        after manually quoting blank line then hitting return
 
-        <rdar://problem/4922709> Copying less than a paragraph of quoted text and pasting it doesn't retain quote level
-        
-        There was code to intentionally avoid quoting pasted content if less than a paragraph of 
-        it was copied.  That was added for <rdar://problem/5006779>, but was unnecessary because
-        that bug was about Paste and Match style for single paragraphs.  And quote stripping for
-        Paste and Match style is handled elsewhere.
+        If the insertion point is both the begining and ending visible position
+        then we need to insert at the end instead of the begining, which is what
+        would normally happen if the insertion point was as the begining.
 
-        * editing/markup.cpp:
-        (WebCore::createMarkup):
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
 
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+2009-06-23  Brady Eidson  <beidson@apple.com>
 
-        Reviewed by Sam Weinig.
-        
-        Updated for JavaScriptCore rename.
+        Reviewed by Sam Weinig, and looked over by Eric Carlson.
 
-        * ForwardingHeaders/interpreter/CallFrame.h: Copied from WebCore/ForwardingHeaders/runtime/ExecState.h.
-        * ForwardingHeaders/runtime/ExecState.h: Removed.
-        * bindings/objc/WebScriptObject.mm:
-        * bridge/c/c_instance.cpp:
-        * bridge/jni/jni_jsobject.mm:
-        * dom/Node.cpp:
-        * dom/NodeFilter.cpp:
-        * dom/NodeIterator.cpp:
-        * dom/TreeWalker.cpp:
-        * inspector/JavaScriptCallFrame.h:
-
-2008-11-17  Pierre-Olivier Latour  <pol@apple.com>
+        <rdar://problem/6980466> Media elements should provide option for changing pitch correction
 
-        Reviewed by Sam Weinig.
+        Introduce a new boolean property to HTMLMediaElement called webkitPreservesPitch for script to control this.
 
-        Added functionality to AnimationController to allow pausing a running
-        animation or transition at a given time for testing purposes.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Currently the platforms that have a flexible pitch preservation 
+          property (Quicktime on Mac and Win) have had it on by default, so continue that default for now.
+        (WebCore::HTMLMediaElement::loadResource):
+        (WebCore::HTMLMediaElement::webkitPreservesPitch):
+        (WebCore::HTMLMediaElement::setWebkitPreservesPitch):
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
 
-        https://bugs.webkit.org/show_bug.cgi?id=21261
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::setPreservesPitch):
+        (WebCore::MediaPlayer::MediaPlayer):
+        (WebCore::MediaPlayer::preservesPitch):
+        (WebCore::MediaPlayer::setPreservesPitch):
+        * platform/graphics/MediaPlayer.h:
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::setPreservesPitch):
 
-        Tests: animations/animation-drt-api.html
-               transitions/transition-drt-api.html
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::createQTMovie): Rework to allow recreation of the movie with almost the
+          exact same attributes as before, with pitch preservation being the difference.
+        (WebCore::MediaPlayerPrivate::setPreservesPitch): Recreate the QTMovie if the flag actually changes.
+        (WebCore::MediaPlayerPrivate::updateStates): Restore current time and rate if this is a recreated movie.
+        (WebCore::MediaPlayerPrivate::timeChanged): Clear the time-to-be-restored, as this callback means it
+          has been effectively overwritten.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::load):
+        (WebCore::MediaPlayerPrivate::setPreservesPitch):
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWinPrivate::QTMovieWinPrivate):
+        (QTMovieWinPrivate::~QTMovieWinPrivate):
+        (QTMovieWinPrivate::task): Restore current time and rate if this is a re-created movie.
+        (QTMovieWin::play): Clear the time-to-be-restored, as this effectively overwrites it.
+        (QTMovieWin::pause): Ditto.
+        (QTMovieWin::setRate): Ditto.
+        (QTMovieWin::setCurrentTime): Ditto.
+        (QTMovieWin::setPreservesPitch): Recreate the Movie if the flag actually changes.
+        (QTMovieWin::load): Rework to allow recreation of the Movie with similar state as the movie before it, 
+          but changing the pitch preservation flag.
+        * platform/graphics/win/QTMovieWin.h:
+
+2009-06-23  Eric Carlson  <eric.carlson@apple.com>
 
-        * WebCore.base.exp:
-        * WebCore.xcodeproj/project.pbxproj:
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::updateStateMachine):
-        (WebCore::AnimationBase::progress):
-        (WebCore::AnimationBase::pauseAtTime):
-        * page/animation/AnimationBase.h:
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
-        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
-        (WebCore::AnimationController::pauseAnimationAtTime):
-        (WebCore::AnimationController::pauseTransitionAtTime):
-        * page/animation/AnimationController.h:
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimationPrivate::isAnimating):
-        (WebCore::CompositeAnimationPrivate::pauseAnimationAtTime):
-        (WebCore::CompositeAnimationPrivate::pauseTransitionAtTime):
-        (WebCore::CompositeAnimation::pauseAnimationAtTime):
-        (WebCore::CompositeAnimation::pauseTransitionAtTime):
-        * page/animation/CompositeAnimation.h:
-        * page/animation/ImplicitAnimation.cpp:
-        (WebCore::ImplicitAnimation::animate):
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+        Reviewed by Simon Fraser.
 
-        Reviewed by Sam Weinig.
+        <rdar://problem/6998286> Crash after leaving page with <video>
         
-        Updated for JavaScriptCore renames.
+        Don't try to post events after going into the page cache.
 
-        * ForwardingHeaders/VM: Removed.
-        * ForwardingHeaders/VM/Machine.h: Removed.
-        * ForwardingHeaders/interpreter: Added.
-        * ForwardingHeaders/interpreter/Interpreter.h: Copied from ForwardingHeaders/VM/Machine.h.
-        * WebCore.pro:
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        * page/Console.cpp:
-        * webcore-base.bkl:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Updated for JavaScriptCore renames.
-
-        * ForwardingHeaders/runtime/Interpreter.h: Removed.
-        * WebCore.vcproj/WebCore.vcproj:
-        * bindings/js/JSDOMBinding.h:
-        * bindings/js/WorkerScriptController.cpp:
-        * bindings/objc/WebScriptObject.mm:
-        * bridge/NP_jsobject.cpp:
-        * bridge/jni/jni_jsobject.mm:
-        * html/CanvasRenderingContext2D.cpp:
-        * inspector/JavaScriptCallFrame.cpp:
-        * page/Console.cpp:
-
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-
-        Try to fix wx build.
-
-        * webcore-base.bkl:
-
-2008-11-17  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21810
-        Remove use of static C++ objects that are destroyed at exit time (destructors)
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::documentWillBecomeInactive): Cancel pending events and stop
+        event timers so we won't try to post events after going into the cache.
 
-        Find some missing DEFINE_STATIC_LOCAL use cases.
-        
-        * bindings/js/JSSVGPODTypeWrapper.h:
-        (WebCore::PODTypeWrapperCacheInfoTraits::emptyValue):
-        (WebCore::JSSVGDynamicPODTypeWrapperCache::dynamicWrapperHashMap):
-        * dom/make_names.pl: Generate code to use DEFINE_STATIC_LOCAL.
-        * page/AccessibilityRenderObject.cpp:
-        (WebCore::RoleEntry::): This method is only called once, so the array does not have to be static.
-        * platform/graphics/FontCache.cpp:
-        (WebCore::FontPlatformDataCacheKeyTraits::emptyValue):
-        (WebCore::FontDataCacheKeyTraits::emptyValue):
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::initialTransform):
+2009-06-23  Jeremy Orlow  <jorlow@chromium.org>
 
-2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+        Reviewed by Brady Eidson.
 
-        Not reviewed.
+        Simplify the interaction between LocalStorageArea/SessionStorageArea
+        and StorageArea by creating a "blockUntilImportComplete()" function
+        rather than bouncing back and forth between the child and parent
+        classes in a somewhat unintuitive manner.
 
-        Try to fix Qt build.
+        This patch also paves the way for LocalStorageArea and
+        SessionStorageArea being merged into one.  It's part of several in a
+        set which are separating syncing (to disk) code from the rest of the
+        implementation so that local storage and session storage's code can be
+        unified.
 
-        * WebCore.pro:
+        https://bugs.webkit.org/show_bug.cgi?id=25376
 
-2008-11-16  Simon Fraser  <simon.fraser@apple.com>
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::blockUntilImportComplete):
+        * storage/LocalStorageArea.h:
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::length):
+        (WebCore::StorageArea::key):
+        (WebCore::StorageArea::getItem):
+        (WebCore::StorageArea::setItem):
+        (WebCore::StorageArea::removeItem):
+        (WebCore::StorageArea::clear):
+        (WebCore::StorageArea::contains):
+        * storage/StorageArea.h:
+        (WebCore::StorageArea::blockUntilImportComplete):
+
+2009-06-23  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Dan Bernstein
+        Reviewed by Dave Hyatt
 
-        https://bugs.webkit.org/show_bug.cgi?id=22118
-        
-        Fix resize corner tracking in transformed elements by using 
-        mapping the point into local coords using absoluteToLocal,
-        rather than convertToLayerCoords.
+        First part of https://bugs.webkit.org/show_bug.cgi?id=26652
         
-        Test: fast/css/resize-corner-tracking-transformed.html
-
-        * page/EventHandler.h:
         * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::absoluteToContents):
-        (WebCore::RenderLayer::offsetFromResizeCorner):
-        (WebCore::RenderLayer::isPointInResizeControl):
+        (WebCore::RenderLayer::paint):
+        (WebCore::RenderLayer::paintLayer):
         * rendering/RenderLayer.h:
-
-2008-11-16  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-
-        Try to fix Qt build.
-
-        * WebCore.pro:
-
-2008-11-16  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        Use RefPtr and PassRefPtr where appropriate.
-
-        * loader/FTPDirectoryDocument.cpp:
-        (WebCore::createTemplateDocumentData):
-
-2008-11-16  Greg Bolsinga  <bolsinga@apple.com>
-
-        Fix build break for real.
-
-        * loader/FTPDirectoryDocument.cpp:
-        (WebCore::createTemplateDocumentData):
-
-2008-11-16  Greg Bolsinga  <bolsinga@apple.com>
-
-        Fix build break and bug.
-
-        * loader/FTPDirectoryDocument.cpp:
-        (WebCore::createTemplateDocumentData):
-
-2008-11-16  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21810
-        Remove use of static C++ objects that are destroyed at exit time (destructors)
-
-        Use DEFINE_STATIC_LOCAL for static RetainPtr<T>, RefPtr<T>. Add additional
-        uses of DEFINE_STATIC_LOCAL where appropriate.
-
-        * html/HTMLTableElement.cpp:
-        (WebCore::HTMLTableElement::addSharedCellBordersDecl): new the AtomicStrings
-        * loader/CachedImage.cpp:
-        (WebCore::brokenImage):
-        (WebCore::nullImage):
-        * loader/FTPDirectoryDocument.cpp:
-        (WebCore::_createTemplateDocumentData): Created so accessor has one line initialization
-        (WebCore::FTPDirectoryTokenizer::loadDocumentTemplate):
-        * loader/icon/IconDatabase.cpp:
-        (WebCore::loadDefaultIconRecord):
-        * page/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::actionVerb):
-        * page/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::actionVerb):
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::currentEvent):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::paint):
-        * platform/graphics/Image.cpp:
-        (WebCore::Image::nullImage):
-        * platform/graphics/mac/ColorMac.mm:
-        (WebCore::nsColor):
-        * platform/graphics/mac/FontCacheMac.mm: new the Strings
-        (WebCore::FontCache::getSimilarFontPlatformData):
-        * platform/graphics/mac/GraphicsContextMac.mm:
-        (WebCore::_createPatternColor): Created so accessor has one line initialization
-        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
-        * platform/graphics/mac/SimpleFontDataMac.mm:
-        (WebCore::webFallbackFontFamily):
-        * platform/mac/PasteboardMac.mm:
-        (WebCore::writableTypesForURL):
-        (WebCore::createWritableTypesForImage): Created so accessor has one line initialization
-        (WebCore::writableTypesForImage):
-        (WebCore::stripAttachmentCharacters):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintResizer):
-
-2008-11-16  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Darin Adler.
-
-        Do not spit Curl errors into the stdout as this is used by DRT
-
-        We have failing tests results due the curl errors printed to stdout,
-        move them to stderr to be able to pass those tests.
-
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::ResourceHandleManager::startJob):
-
-2008-11-16  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        - fix the Gtk+ build
-
-        * GNUmakefile.am:
-
-2008-11-16  Darin Adler  <darin@apple.com>
-
-        - try to fix Qt build
-
-        * WebCore.pro: Add the worker-related source files.
-
-2008-11-16  Darin Adler  <darin@apple.com>
-
-        Suggested by Alexey Proskuryakov.
-
-        - fix the GTK build another way
-
-        * GNUmakefile.am: Add the worker-related source files.
-        * bindings/js/JSEventTarget.cpp: Take the #if back out.
-
-2008-11-16  Darin Adler  <darin@apple.com>
-
-        - try to fix GTK build
-
-        * bindings/js/JSEventTarget.cpp: Put worker includes inside an #if.
-
-2008-11-16  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=22295
-          track which history items are from page load failures
-
-        * history/HistoryItem.cpp: Sort includes, add newly needed ones, and remove
-        no-longer-needed ones.
-        (WebCore::HistoryItem::HistoryItem): Initialize m_lastVisitWasFailure to false.
-        (WebCore::HistoryItem::showTreeWithIndent): Rewrote to avoid appending to a
-        String, since that's not efficient.
-
-        * history/HistoryItem.h: Removed unneeded includes. Added lastVisitWasFailure,
-        setLastVisitWasFailure, and m_lastVisitWasFailure.
-
-        * history/mac/HistoryItemMac.mm: Add newly-needed include
-        (WebCore::HistoryItem::setTransientProperty): Rewrote to avoid keeping a
-        m_transientProperties map around when it is empty.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::createHistoryItem): Call setLastVisitWasFailure when
-        the page was unreachable or an HTTP page with a status code that indicates
-        failure.
-
-2008-11-16  Yong Li  <yong.li@torchmobile.com>
-
-        Reviewed by Timothy Hatcher.
-        Landed by George Staikos.
-
-        Optimization: don't relayout, repaint, or emit a DOM event if the
-        scroll event didn't scroll anywhere.
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::scrollToOffset): add early exit
-
-2008-11-16  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22290
-        Remove cross-heap GC and MessagePort multi-threading support
-
-        It is broken (and may not be implementable at all), and no longer needed, as we
-        don't use MessagePorts for communication with workers any more.
-
-        * bindings/js/JSDOMBinding.cpp:
-        * bindings/js/JSDOMBinding.h:
-        * bindings/js/JSDOMWindowBase.cpp:
-        * bindings/js/JSDOMWindowBase.h:
-        Removed cross-heap GC implementation.
-
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::hasPendingActivity):
-        * dom/MessagePort.h:
-        Made objects RefCounted instead of ThreadSafeShared, added FIXME comments for code that is
-        unnecessarily complicated for single threaded case.
-
-2008-11-14  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22266
-        Stop using MessagePort for communication with workers
-
-        The current MessagePort specification is not well suited for being implemented in a
-        multi-threaded or multi-process environment, and this doesn't appear to be easily fixable.
-        This patch implements a simpler Mozilla API for workers instead.
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * DerivedSources.make:
-        * bindings/js/JSDOMWindowBase.cpp: (jsDOMWindowBaseWorker):
-        * bindings/js/JSDedicatedWorkerConstructor.cpp: Removed.
-        * bindings/js/JSDedicatedWorkerConstructor.h: Removed.
-        * bindings/js/JSDedicatedWorkerCustom.cpp: Removed.
-        * bindings/js/JSWorkerConstructor.cpp: Copied from WebCore/bindings/js/JSDedicatedWorkerConstructor.cpp.
-        * bindings/js/JSWorkerConstructor.h: Copied from WebCore/bindings/js/JSDedicatedWorkerConstructor.h.
-        * bindings/js/JSWorkerCustom.cpp: Copied from WebCore/bindings/js/JSDedicatedWorkerCustom.cpp.
-        * dom/DedicatedWorker.cpp: Removed.
-        * dom/DedicatedWorker.h: Removed.
-        * dom/DedicatedWorker.idl: Removed.
-        Renamed DedicatedWorker to Worker to match Mozilla and current WHATWG cpec.
-
-        * bindings/js/JSEventListener.cpp: (WebCore::JSAbstractEventListener::handleEvent):
-        Clear worker exceptions to avoid hitting an assertion.
-
-        * dom/EventTarget.cpp: (WebCore::EventTarget::toWorker):
-        * dom/EventTarget.h:
-        * bindings/js/JSEventTarget.cpp: (WebCore::toJS):
-        WorkerContext is now an EventTarget, too.
-
-        * bindings/js/JSWorkerContext.cpp: Removed onconnect, constructors for MessageChannel and
-        MessagePort. Added postMessage() and onmessage.
-
-        * dom/ScriptExecutionContext.cpp: (WebCore::performTask): Do not reference ScriptExecutionContext
-        when posting a task - this operation is not thread safe. It is also not necessary any more,
-        as the context is kept alive by WorkerMessagingProxy.
-
-        * dom/Worker.cpp: Copied from WebCore/dom/DedicatedWorker.cpp.
-        (WebCore::Worker::Worker): Start loading the script right away - there is no reason to do
-        that on a timer.
-        (WebCore::Worker::~Worker): Notify messaging proxy.
-        (WebCore::Worker::postMessage): Just ask the proxy to post the message.
-        (WebCore::Worker::notifyFinished): Notify messaging proxy when a thread object becomes
-        available. Also, it is now safe to unsetPendingActivity(), making the object collectable.
-        I'm not sure if this is the right lifetime for workers, as unreachable workers with event
-        listeners should probably be kept alive, but it at least lets the object be collected.
-        (WebCore::Worker::addEventListener): Added an EventTarget implementation.
-        (WebCore::Worker::removeEventListener): Added an EventTarget implementation.
-        (WebCore::Worker::dispatchEvent): Added an EventTarget implementation.
-
-        * dom/Worker.h: Copied from WebCore/dom/DedicatedWorker.h.
-        * dom/Worker.idl: Copied from WebCore/dom/DedicatedWorker.idl.
-        Removed onclose, made an EventListener. Actual messaging is now handled by WorkerMessagingProxy.
-
-        * dom/WorkerContext.cpp:
-        (WebCore::WorkerContext::~WorkerContext): Notify messaging proxy that the context was shut
-        down successfully.
-        (WebCore::WorkerContext::postMessage): Added. Post the message via messaging proxy.
-
-        * dom/WorkerContext.h: Added postMessage and onmessage, removed onconnect.
-
-        * dom/WorkerMessagingProxy.cpp: Added.
-        * dom/WorkerMessagingProxy.h: Added.
-        This new class implements actual messaging. It is notified when a Worker is garbage collected,
-        and asks the thread to shut down. It also owns the thread object, and references script
-        execution context, making it safe to post messages to it remotely.
-
-        * dom/WorkerThread.cpp:
-        * dom/WorkerThread.h:
-        Keep a reference to messaging proxy, not to Worker itself. Also, the thread object no longer
-        keeps itself alive - it is now the job of messaging proxy.
-
-2008-11-15  Darin Adler  <darin@apple.com>
-
-        Rubber stamped by Geoff Garen.
-
-        - do the long-planned StructureID -> Structure rename
-
-        * ForwardingHeaders/runtime/Structure.h: Copied from WebCore/ForwardingHeaders/runtime/StructureID.h.
-        * ForwardingHeaders/runtime/StructureID.h: Removed.
-        * bindings/js/JSAudioConstructor.cpp:
-        (WebCore::JSAudioConstructor::JSAudioConstructor):
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::getCachedDOMStructure):
-        (WebCore::cacheDOMStructure):
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObject::DOMObject):
-        (WebCore::getDOMStructure):
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::JSDOMGlobalObject):
-        * bindings/js/JSDOMGlobalObject.h:
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::JSDOMWindowShell::JSDOMWindowShell):
-        (WebCore::JSDOMWindowShell::setWindow):
-        * bindings/js/JSDOMWindowShell.h:
-        (WebCore::JSDOMWindowShell::createStructure):
-        * bindings/js/JSDedicatedWorkerConstructor.cpp:
-        (WebCore::JSDedicatedWorkerConstructor::JSDedicatedWorkerConstructor):
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::JSHTMLAllCollection):
-        (WebCore::JSHTMLAllCollection::createStructure):
-        * bindings/js/JSImageConstructor.cpp:
-        (WebCore::JSImageConstructor::JSImageConstructor):
-        * bindings/js/JSInspectedObjectWrapper.cpp:
-        (WebCore::JSInspectedObjectWrapper::wrap):
-        (WebCore::JSInspectedObjectWrapper::JSInspectedObjectWrapper):
-        * bindings/js/JSInspectedObjectWrapper.h:
-        * bindings/js/JSInspectorCallbackWrapper.cpp:
-        (WebCore::leakInspectorCallbackWrapperStructure):
-        (WebCore::JSInspectorCallbackWrapper::wrap):
-        (WebCore::JSInspectorCallbackWrapper::JSInspectorCallbackWrapper):
-        * bindings/js/JSInspectorCallbackWrapper.h:
-        * bindings/js/JSMessageChannelConstructor.cpp:
-        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
-        * bindings/js/JSNamedNodesCollection.h:
-        (WebCore::JSNamedNodesCollection::createStructure):
-        * bindings/js/JSOptionConstructor.cpp:
-        (WebCore::JSOptionConstructor::JSOptionConstructor):
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        (WebCore::JSQuarantinedObjectWrapper::createStructure):
-        * bindings/js/JSRGBColor.h:
-        (WebCore::JSRGBColor::createStructure):
-        * bindings/js/JSWorkerContext.cpp:
-        (WebCore::createJSWorkerContextStructure):
-        (WebCore::JSWorkerContext::JSWorkerContext):
-        (WebCore::JSWorkerContext::createPrototype):
-        * bindings/js/JSWorkerContext.h:
-        (WebCore::JSWorkerContext::createStructure):
-        (WebCore::JSWorkerContextPrototype::JSWorkerContextPrototype):
-        (WebCore::JSWorkerContextPrototype::createStructure):
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
-        * bindings/js/JSXSLTProcessorConstructor.cpp:
-        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/objc/objc_runtime.h:
-        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::QtConnectionObject::execute):
-        * bridge/qt/qt_runtime.h:
-        (JSC::Bindings::QtRuntimeMethod::createStructure):
-        * bridge/runtime_array.h:
-        (JSC::RuntimeArray::createStructure):
-        * bridge/runtime_method.h:
-        (JSC::RuntimeMethod::createStructure):
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::RuntimeObjectImp):
-        * bridge/runtime_object.h:
-        (JSC::RuntimeObjectImp::createStructure):
-
-2008-11-15  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        - fix just-introduced crash in the svg/custom/svg-fonts-in-html.html test
-
-        This gets rid of the crash. It restores the behavior of the CG case from before Dirk
-        Shulze removed the platorm-dependent code, but perhaps it should be changed further
-        in the future so that the default for no style is "no stroke". I think the patch is
-        fine for fill.
-
-        * svg/graphics/SVGPaintServerSolid.cpp:
-        (WebCore::SVGPaintServerSolid::setup): Added null checks for svgStyle.
-        (WebCore::SVGPaintServerSolid::renderPath): Added null checks for style and svgStyle.
-
-2008-11-15  Kevin Ollivier  <kevino@theolliviers.com>
-
-        Reviewed by Timothy Hatcher.
-
-        Initialize m_networkStateChangedFunction to 0 as otherwise the check for null will fail.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=22284
-
-        * platform/network/NetworkStateNotifier.h:
-        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
-
-2008-11-15  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Geoffrey Garen.
-
-        r38426 caused a wrong drawing of a LayoutTest. Use another
-        way to set the color to pass this test again.
-
-        * svg/graphics/SVGPaintServerSolid.cpp:
-        (WebCore::SVGPaintServerSolid::setup):
-
-2008-11-15  Dirk Schulze  <krit@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Removed platform dependent code on SVGPaintServerSolid.
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * svg/graphics/SVGPaintServerSolid.cpp:
-        (WebCore::SVGPaintServerSolid::setup):
-        (WebCore::SVGPaintServerSolid::renderPath):
-        * svg/graphics/SVGPaintServerSolid.h:
-        * svg/graphics/cairo/SVGPaintServerSolidCairo.cpp: Removed.
-        * svg/graphics/cg/SVGPaintServerSolidCg.cpp: Removed.
-        * svg/graphics/qt/SVGPaintServerSolidQt.cpp: Removed.
-
-2008-11-15  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Updated for JavaScriptCore renames.
-
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::mark):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::send):
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
-        * bindings/js/WorkerScriptController.cpp:
-        (WebCore::WorkerScriptController::evaluate):
-        * bindings/objc/WebScriptObject.mm:
-        (-[WebScriptObject evaluateWebScript:]):
-        * bridge/NP_jsobject.cpp:
-        (_NPN_Evaluate):
-        * bridge/jni/jni_jsobject.mm:
-        (JavaJSObject::eval):
-        * page/Console.cpp:
-        (WebCore::retrieveLastCaller):
-        (WebCore::Console::trace):
-
-2008-11-14  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21810
-        Remove use of static C++ objects that are destroyed at exit time (destructors)
-
-        Create DEFINE_STATIC_LOCAL macro. Change static local objects to leak to avoid 
-        exit-time destructor. Update code that was changed to fix this issue that ran 
-        into a gcc bug (<rdar://problem/6354696> Codegen issue with C++ static reference 
-        in gcc build 5465). Also typdefs for template types needed to be added in some 
-        cases so the type could make it through the macro successfully.
-
-        Basically code of the form:
-        static T m;
-        becomes:
-        DEFINE_STATIC_LOCAL(T, m, ());
-
-        Also any code of the form:
-        static T& m = *new T;
-        also becomes:
-        DEFINE_STATIC_LOCAL(T, m, ());
-
-        * ForwardingHeaders/wtf/StdLibExtras.h: Added.
-        * bindings/js/GCController.cpp:
-        (WebCore::gcController):
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::wrapperSet):
-        * bindings/js/JSInspectedObjectWrapper.cpp:
-        (WebCore::wrappers):
-        * bindings/js/JSInspectorCallbackWrapper.cpp:
-        (WebCore::wrappers):
-        * bindings/js/JSNavigatorCustom.cpp:
-        (WebCore::needsYouTubeQuirk):
-        * bridge/runtime_root.cpp:
-        (JSC::Bindings::rootObjectSet):
-        * css/CSSMutableStyleDeclaration.cpp:
-        (WebCore::initShorthandMap):
-        (WebCore::CSSMutableStyleDeclaration::removeProperty):
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::cssText):
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::screenEval):
-        (WebCore::printEval):
-        * dom/DOMImplementation.cpp:
-        (WebCore::addString):
-        (WebCore::isSVG10Feature):
-        (WebCore::isSVG11Feature):
-        (WebCore::DOMImplementation::isXMLMIMEType):
-        * dom/Document.cpp:
-        (WebCore::Document::hasPrefixNamespaceMismatch):
-        * dom/ScriptElement.cpp:
-        (WebCore::isSupportedJavaScriptLanguage):
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::styleSpanClassString):
-        * editing/HTMLInterchange.cpp:
-        (WebCore::):
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::indentBlockquoteString):
-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::isInterchangeNewlineNode):
-        (WebCore::isInterchangeConvertedSpaceSpan):
-        * editing/htmlediting.cpp:
-        (WebCore::stringWithRebalancedWhitespace):
-        (WebCore::nonBreakingSpaceString):
-        * editing/markup.cpp:
-        (WebCore::appendAttributeValue):
-        (WebCore::appendEscapedContent):
-        (WebCore::shouldAddNamespaceAttr):
-        (WebCore::appendNamespace):
-        (WebCore::appendStartMarkup):
-        (WebCore::createMarkup):
-        * html/HTMLButtonElement.cpp:
-        (WebCore::HTMLButtonElement::type):
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::isRecognizedTagName):
-        (WebCore::inlineTagList):
-        (WebCore::blockTagList):
-        * html/HTMLFieldSetElement.cpp:
-        (WebCore::HTMLFieldSetElement::type):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::type):
-        * html/HTMLKeygenElement.cpp:
-        (WebCore::HTMLKeygenElement::type):
-        * html/HTMLLegendElement.cpp:
-        (WebCore::HTMLLegendElement::type):
-        * html/HTMLOptGroupElement.cpp:
-        (WebCore::HTMLOptGroupElement::type):
-        * html/HTMLOptionElement.cpp:
-        (WebCore::HTMLOptionElement::type):
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::getNode):
-        (WebCore::HTMLParser::isHeaderTag):
-        (WebCore::HTMLParser::isResidualStyleTag):
-        (WebCore::HTMLParser::isAffectedByResidualStyle):
-        * html/HTMLSelectElement.cpp:
-        (WebCore::HTMLSelectElement::type):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::type):
-        * inspector/InspectorController.cpp:
-        (WebCore::platform):
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::shared):
-        * inspector/JavaScriptProfile.cpp:
-        (WebCore::profileCache):
-        * inspector/JavaScriptProfileNode.cpp:
-        (WebCore::profileNodeCache):
-        * loader/FrameLoader.cpp:
-        (WebCore::localSchemes):
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::cacheStorage):
-        * loader/archive/ArchiveFactory.cpp:
-        (WebCore::archiveMIMETypes):
-        (WebCore::ArchiveFactory::registerKnownArchiveMIMETypes):
-        * loader/icon/IconDatabase.cpp:
-        (WebCore::IconDatabase::defaultDatabaseFilename):
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::dragState):
-        * page/Frame.cpp:
-        (WebCore::createRegExpForLabels):
-        (WebCore::keepAliveSet):
-        * page/Page.cpp:
-        (WebCore::Page::groupName):
-        * page/SecurityOrigin.cpp:
-        (WebCore::isDefaultPortForProtocol):
-        (WebCore::SecurityOrigin::databaseIdentifier):
-        * page/mac/FrameMac.mm:
-        (WebCore::regExpForLabels):
-        * platform/KURL.cpp:
-        (WebCore::blankURL):
-        * platform/graphics/FontCache.cpp:
-        (WebCore::alternateFamilyName):
-        * platform/graphics/mac/FontCacheMac.mm:
-        (WebCore::FontCache::getSimilarFontPlatformData):
-        (WebCore::FontCache::getLastResortFallbackFont):
-        * platform/mac/CursorMac.mm:
-        (WebCore::leakNamedCursor):
-        (WebCore::pointerCursor):
-        (WebCore::crossCursor):
-        (WebCore::handCursor):
-        (WebCore::moveCursor):
-        (WebCore::verticalTextCursor):
-        (WebCore::cellCursor):
-        (WebCore::contextMenuCursor):
-        (WebCore::aliasCursor):
-        (WebCore::zoomInCursor):
-        (WebCore::zoomOutCursor):
-        (WebCore::copyCursor):
-        (WebCore::noneCursor):
-        (WebCore::progressCursor):
-        (WebCore::noDropCursor):
-        (WebCore::notAllowedCursor):
-        (WebCore::iBeamCursor):
-        (WebCore::waitCursor):
-        (WebCore::helpCursor):
-        (WebCore::eastResizeCursor):
-        (WebCore::northResizeCursor):
-        (WebCore::northEastResizeCursor):
-        (WebCore::northWestResizeCursor):
-        (WebCore::southResizeCursor):
-        (WebCore::southEastResizeCursor):
-        (WebCore::southWestResizeCursor):
-        (WebCore::westResizeCursor):
-        (WebCore::northSouthResizeCursor):
-        (WebCore::eastWestResizeCursor):
-        (WebCore::northEastSouthWestResizeCursor):
-        (WebCore::northWestSouthEastResizeCursor):
-        (WebCore::columnResizeCursor):
-        (WebCore::rowResizeCursor):
-        (WebCore::grabCursor):
-        (WebCore::grabbingCursor):
-        * platform/mac/ScrollbarThemeMac.mm:
-        (WebCore::ScrollbarTheme::nativeTheme):
-        * platform/mac/ThemeMac.mm:
-        (WebCore::platformTheme):
-        * platform/mac/ThreadCheck.mm:
-        (WebCoreReportThreadViolation):
-        * platform/network/NetworkStateNotifier.cpp:
-        (WebCore::networkStateNotifier):
-        * platform/network/mac/FormDataStreamMac.mm:
-        (WebCore::getStreamFormDataMap):
-        (WebCore::getStreamResourceHandleMap):
-        * platform/network/mac/ResourceResponseMac.mm:
-        (WebCore::ResourceResponse::platformLazyInit):
-        * platform/text/TextEncoding.cpp:
-        (WebCore::TextEncoding::isJapanese):
-        * plugins/PluginMainThreadScheduler.cpp:
-        (WebCore::PluginMainThreadScheduler::scheduler):
-        * rendering/RenderBlock.cpp:
-        (WebCore::continuationOutlineTable):
-        (WebCore::RenderBlock::addContinuationWithOutline):
-        (WebCore::RenderBlock::paintContinuationOutlines):
-        * rendering/RenderCounter.cpp:
-        (WebCore::counterMaps):
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::layoutVerticalBox):
-        * rendering/RenderListItem.cpp:
-        (WebCore::RenderListItem::markerText):
-        * rendering/RenderScrollbarTheme.cpp:
-        (WebCore::RenderScrollbarTheme::renderScrollbarTheme):
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::systemFont):
-        * rendering/bidi.cpp:
-        (WebCore::RenderBlock::checkLinesForTextOverflow):
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::initialDashboardRegions):
-        (WebCore::RenderStyle::noneDashboardRegions):
-        * storage/Database.cpp:
-        (WebCore::guidMutex):
-        (WebCore::guidToVersionMap):
-        (WebCore::guidToDatabaseMap):
-        (WebCore::Database::databaseInfoTableName):
-        (WebCore::databaseVersionKey):
-        (WebCore::Database::getVersionFromDatabase):
-        (WebCore::Database::setVersionInDatabase):
-        (WebCore::guidForOriginAndName):
-        * storage/DatabaseTracker.cpp:
-        (WebCore::DatabaseTracker::tracker):
-        (WebCore::notificationMutex):
-        (WebCore::notificationQueue):
-        * storage/LocalStorage.cpp:
-        (WebCore::localStorageMap):
-        * svg/SVGAnimateMotionElement.cpp:
-        (WebCore::SVGAnimateMotionElement::rotateMode):
-        * svg/SVGAnimationElement.cpp:
-        (WebCore::SVGAnimationElement::calcMode):
-        (WebCore::SVGAnimationElement::attributeType):
-        (WebCore::SVGAnimationElement::isAdditive):
-        (WebCore::SVGAnimationElement::isAccumulated):
-        * svg/SVGLangSpace.cpp:
-        (WebCore::SVGLangSpace::xmlspace):
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::contentScriptType):
-        (WebCore::SVGSVGElement::contentStyleType):
-        * svg/SVGStyleElement.cpp:
-        (WebCore::SVGStyleElement::type):
-        (WebCore::SVGStyleElement::media):
-        * svg/SVGTextContentElement.cpp:
-        (WebCore::SVGTextContentElement::parseMappedAttribute):
-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::SVGSMILElement::parseClockValue):
-        (WebCore::SVGSMILElement::restart):
-        (WebCore::SVGSMILElement::fill):
-        (WebCore::SVGSMILElement::repeatCount):
-        (WebCore::SVGSMILElement::notifyDependentsIntervalChanged):
-        * svg/graphics/SVGResource.cpp:
-        (WebCore::clientMap):
-        (WebCore::SVGResource::removeClient):
-        * svg/graphics/SVGResourceMarker.cpp:
-        (WebCore::SVGResourceMarker::draw):
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::PreflightResultCacheItem::PreflightResultCacheItem):
-        (WebCore::preflightResultCache):
-        (WebCore::appendPreflightResultCacheEntry):
-        (WebCore::isSafeRequestHeader):
-        (WebCore::isOnAccessControlResponseHeaderWhitelist):
-        (WebCore::XMLHttpRequest::didReceiveResponsePreflight):
-        * xml/XPathExpressionNode.cpp:
-        (WebCore::XPath::Expression::evaluationContext):
-        * xml/XPathParser.cpp:
-        (WebCore::XPath::setUpAxisNamesMap):
-        (WebCore::XPath::isAxisName):
-        (WebCore::XPath::isNodeTypeName):
-        * xml/XPathValue.cpp:
-        (WebCore::XPath::Value::toNodeSet):
-
-2008-11-14  Dan Bernstein  <mitz@apple.com>
-
-        - attempt to fix the Qt build
-
-        * platform/qt/Localizations.cpp:
-        (WebCore::contextMenuItemTagTextDirectionMenu): Added. Maybe this string
-        needs to go somewhere else in addition to here.
-
-2008-11-14  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix.
-
-        * platform/wx/LocalizedStringsWx.cpp:
-        (WebCore::contextMenuItemTagTextDirectionMenu):
-
-2008-11-14  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Darin Adler.
-
-        - <rdar://problem/6234307> Support action methods for setting and clearing character-level directionality
-        - WebCore part of <rdar://problem/6234337> Add a Text Direction menu to the default context menu when appropriate
-
-        * WebCore.base.exp: Exported
-        WebCore::Settings::setTextDirectionSubmenuInclusionBehavior().
-
-        * editing/ApplyStyleCommand.cpp:
-        (StyleChange::init): Changed to always include the direction property
-        in the result if the unicode-bidi property is included.
-        (ApplyStyleCommand::splitAncestorsWithUnicodeBidi): Added. Finds the
-        highest ancestor of the given node that establishes bidi embedding. If
-        that embedding agrees with the given allowed direction, finds the
-        second-highest embedding ancestor. Splits all nodes through that
-        ancestor. If the highest embedding ancestor did not need to be split,
-        it is returned.
-        (ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock): Added. Removes
-        bidi embedding attributes and styles from all ancestors of the given
-        node up to its enclosing block or the given node.
-        (ApplyStyleCommand::applyInlineStyle): Added code to handle the
-        unicode-bidi property. Applying style the includes this property
-        involves removing all bidi embedding in effect, except  for one-level
-        embedding that agrees with the desired embedding, then applying the
-        desired embedding where it is not already in effect.
-        (ApplyStyleCommand::applyInlineStyleToRange): Factored out from
-        applyInlineStyle().
-        (ApplyStyleCommand::removeHTMLBidiEmbeddingStyle): Added. Removed the
-        "dir" attribute if necessary and the element if it becomes an unstyled
-        style span.
-        (ApplyStyleCommand::removeCSSStyle): Changed to remove the direction
-        property when removing the unicode-bidi property.
-        (ApplyStyleCommand::removeInlineStyle): Added a call to
-        removeHTMLBidiEmbeddingStyle().
-
-        * editing/ApplyStyleCommand.h:
-        * editing/Editor.cpp:
-        (Editor::textDirectionForSelection): Added. Returns the character-level
-        writing direction of the selection if it is uniform and simple (at most
-        one level of embedding).
-        (Editor::hasBidiSelection): Added. Returns true if the selection lies
-        entirely within a single block, and that block has direction:rtl or
-        contains any inline boxes with non-zero bidi embedding level.
-
-        * editing/Editor.h:
-        * editing/EditorCommand.cpp:
-        (stateTextWritingDirection): Added this helper function for deciding
-        the state of Text Direction submenu items.
-        (executeMakeTextWritingDirectionLeftToRight): Added. Applies
-        "unicode-bidi: embed; direction: ltr;".
-        (executeMakeTextWritingDirectionNatural): Added. Applies
-        "unicode-bidi: normal;"
-        (executeMakeTextWritingDirectionRightToLeft): Added. Applies
-        "unicode-bidi: embed; direction: rtl;".
-        (stateTextWritingDirectionLeftToRight): Added.
-        (stateTextWritingDirectionNatural): Added.
-        (stateTextWritingDirectionRightToLeft): Added.
-        (createCommandMap): Added "MakeTextWritingDirectionLeftToRight",
-        "MakeTextWritingDirectionNatural",
-        and "MakeTextWritingDirectionRightToLeft".
-
-        * editing/InsertTextCommand.cpp:
-        (InsertTextCommand::input): Added code to maintain the unicode-bidi
-        and direction properties in the typing style. Even if they have the
-        same values as the computed style at the caret, they need to be included
-        in the typing style so that inserted text will not inherit any nested
-        embedding.
-
-        * page/ContextMenuController.cpp:
-        (ContextMenuController::contextMenuItemSelected): Added calls to
-        the editor for the text direction menu items.
-
-        * page/Frame.cpp
-        (Frame::computeAndSetTypingStyle): Added code to maintain the
-        unicode-bidi and direction properties in the typing style.
-
-        * page/Settings.cpp:
-        (Settings::setTextDirectionSubmenuInclusionBehavior): Added this setter.
-
-        * page/Settings.h: Added a TextDirectionSubmenuInclusionBehavior enum,
-        an m_textDirectionSubmenuInclusionBehavior member, and accessors.
-
-        * page/mac/WebCoreViewFactory.h:
-        * platform/ContextMenu.cpp:
-        (WebCore::createAndAppendTextDirectionSubMenu): Added.
-        (ContextMenu::populate): Added the Text Direction submenu item based on
-        the inclusion behavior and the existence of a bidi selection.
-        (ContextMenu::checkOrEnableIfNeeded): Added code for the text direction
-        menu items.
-
-        * platform/ContextMenuItem.h:
-        * platform/LocalizedStrings.h: Declared
-        contextMenuItemTagTextDirectionMenu().
-
-        * platform/mac/LocalizedStringsMac.mm: Defined
-        contextMenuItemTagTextDirectionMenu().
-
-        * rendering/RenderBlock.cpp:
-        (RenderBlock::containsNonZeroBidiLevel): Added.
-        * rendering/RenderBlock.h:
-
-2008-11-14  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22264
-        Need to update to latest Geolocation spec (13 November 2008)
-        
-        Update to new error code constants and values.
-
-        * page/Geolocation.cpp: Use new named ErrorCode enums
-        (WebCore::Geolocation::GeoNotifier::timerFired):
-        (WebCore::Geolocation::getCurrentPosition):
-        (WebCore::Geolocation::watchPosition):
-        * page/PositionError.h: Have ErrorCode enum names match new error constant names and values
-        (WebCore::PositionError::):
-        * page/PositionError.idl: Add new named error constants
-
-2008-11-14  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Justin Garcia.
-
-        Fix (again) for <rdar://problem/5089327> Too much indentation when 
-        pasting quoted paragraphs
-
-        This patch goes back to Justin's original approach to fix this bug, 
-        written in revision 38273. That fix was mostly rolled out by 
-        revision 38310 because of styling issues created by the addition of 
-        extra blockquote nodes. This patch again goes back to Justin's 
-        original fix because of cases we discovered the newer fix could not 
-        possibly cover. This version of the patch minimizes the styling 
-        issues of extra blockquotes by opting into the merge start code. 
-
-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::hasMatchingQuoteLevel): We want shouldMergeStart to 
-        return true when the quoting level of the end of the inserted 
-        content matches the quoting level of the end of the existing 
-        content.
-        (WebCore::ReplaceSelectionCommand::shouldMergeStart): Now calls 
-        hasMatchingQuoteLevel
-        (WebCore::ReplaceSelectionCommand::doApply):
-
-2008-11-14  Dirk Schulze  <vbs85@gmx.de>
-
-        Reviewed by Eric Seidel.
-
-        Made SVGResourceClipper platform independent.
-        https://bugs.webkit.org/show_bug.cgi?id=21444
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        (WebCore::GraphicsContext::clipPath):
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::GraphicsContext::clipPath):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::addPath):
-        (WebCore::GraphicsContext::clipPath):
-        * svg/graphics/SVGResourceClipper.cpp:
-        (WebCore::SVGResourceClipper::applyClip):
-        * svg/graphics/cairo/SVGResourceClipperCairo.cpp: Removed.
-        * svg/graphics/cg/SVGResourceClipperCg.cpp: Removed.
-        * svg/graphics/qt/SVGResourceClipperQt.cpp: Removed.
-
-2008-11-14  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        Combine loadFrameRequestWithFormState to loadFrameRequestWithFormAndValues.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadFrameRequestWithFormAndValues):
-        * loader/FrameLoader.h:
-
-2008-11-14  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        Remove unneeded forward declaration.
-
-        * plugins/Plugin.h:
-
-2008-11-14  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22251
-        HTMLCanvasElement.cpp unnecessarily includes runtime/Interpreter.h
-
-        * html/HTMLCanvasElement.cpp:
-
-2008-11-14  Yael Aharon  <yael.aharon@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Add new files from the Qt port to the build.
-
-        * WebCore.pro:
-
-2008-11-14  Yael Aharon  <yael.aharon@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Made DatabaseTracker::hasEntryForOrigin() public. This allows the Qt
-        port to apply a default quota only if there is no entry in the
-        database for a given origin yet.
-
-        * storage/DatabaseTracker.h:
-
-2008-11-14  Yael Aharon  <yael.aharon@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Make it possible to get the cache directory set in the application
-        cache storage.
-
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::ApplicationCacheStorage::cacheDirectory): Added.
-        * loader/appcache/ApplicationCacheStorage.h:
-
-2008-11-14  Justin Garcia  <justin.garcia@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        <rdar://problem/4230923> "Make Plain Text" doesn't reset text alignment in single paragraph messages
-        
-        When applying block styles, we would add block properties to the body element, and Mail's
-        Make Plain Text feature isn't equipped to remove those.  This could have been fixed on our side,
-        but this change has the advantage that it fixes the bug on Tiger, where Mail does not plan future updates.
-        
-        We have code that puts the paragraphs that we're operating on into blocks of their own before
-        adding or removing block properties from the blocks that enclose them.  We need to run this code 
-        when the enclosing block is the body element.
+        (WebCore::RenderLayer::):
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::paint):
+        Replace the 3 boolean params to RenderLayer::paintLayer() with a bit mask for readability.
         
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::CompositeEditCommand::insertNewDefaultParagraphElementAt): Added, moved code from moveParagraphContents
-        to here.
-        (WebCore::CompositeEditCommand::moveParagraphContentsToNewBlockIfNecessary): Renamed some variables for clarity.
-        Added a few comments.  Fixed bug by not bailing out when the block about to be used is the body element.
-        * editing/CompositeEditCommand.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        (WebCore::RenderLayerBacking::paintContents):
+        * rendering/RenderLayerBacking.h:
+        Remove the unused 'haveTransparency' param to paintIntoLayer().
 
-2008-11-14  Cameron Zwarich  <zwarich@apple.com>
+2009-06-23  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Darin Adler.
 
-        Bug 22245: Move wtf/dtoa.h into the WTF namespace
-        <https://bugs.webkit.org/show_bug.cgi?id=22245>
-
-        Move wtf/dtoa.h into the WTF namespace from the JSC namespace.
-
-        * platform/text/String.cpp:
-        (WebCore::charactersToDouble):
-
-2008-11-14  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Rubber-stamped by Simon Hausmann.
-
-        Make sure Qt scrollbars follow the style with regard to context menus
-
-        * platform/qt/ScrollbarQt.cpp:
-        (WebCore::Scrollbar::contextMenu):
+        <rdar://problem/6997929> Assertion at WebCore::RenderLayer::updateClipRects with hardware acceleration
 
-2008-11-14  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Rubber-stamped by Simon Hausmann.
-
-        Make scrollbar look active when the window is active on Qt/Mac
-
-        * platform/qt/ScrollbarThemeQt.cpp:
-        (WebCore::styleOptionSlider):
-        (WebCore::ScrollbarThemeQt::paint):
-
-2008-11-13  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Roben.
-
-        Add a basic Scons-based build system for building
-        Chromium-Mac WebCore.
-        https://bugs.webkit.org/show_bug.cgi?id=21991
-
-        The build currently fails due to missing files from our
-        platform directory (platform skia and platform chromium)
-        I will be sending those up shortly in separate patches.
-        I expect it will be a while before our WebCore build links.
-
-        * SConstruct: Added.
-        * WebCore.scons: Added.
-
-2008-11-13  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22248
-        AtomicString.cpp uses JSC types outside of #if USE(JSC)
-
-        * platform/text/AtomicString.cpp:
-        (WebCore::AtomicString::add):
+        The updatingControlTints() painting pass goes through compositing layer boundaries,
+        so we need to ensure we don't cache clip rects computed with the wrong root by
+        setting temporaryClipRects to true.
         
-2008-11-13  Justin Garcia  <justin.garcia@apple.com>
-
-        Reviewed by Darin Adler.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=18620
-        Long hang under TextIterator::advance() when loading http://www.lsvd.de/
-
-        A huge section at the beginning of this document is invisible.  As we iterate through it,
-        we create VisiblePositions unnecessarily.
-
-        * editing/TextIterator.cpp:
-        (WebCore::TextIterator::shouldRepresentNodeOffsetZero): Don't proceed to VisiblePosition 
-        creation if m_node is unrendered or invisible.  The answers wouldn't have much meaning 
-        and would be wasteful.  Also fixed some comments to reflect the fact that this function
-        isn't specifically about emitting a newline.
-
-2008-11-13  Pierre-Olivier Latour  <pol@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Remove unused or unnecessary code from AnimationBase class.
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::AnimationBase):
-        (WebCore::AnimationBase::playStatePlaying):
-        * page/animation/AnimationBase.h:
-
-2008-11-12  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon Hausmann.
-
-        Inital implementation of PluginPackage and PluginView for Mac NPAPI support in WebCore
-
-        Currently only used by QtWebKit. See also:
-
-        https://bugs.webkit.org/show_bug.cgi?id=21427
-
-        * WebCore.pro:
-        * platform/qt/TemporaryLinkStubs.cpp:
-        (PluginView::userAgentStatic):
-        (PluginView::getValueStatic):
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::handleEvent):
-        (WebCore::PluginView::setValue):
-        (WebCore::PluginView::PluginView):
-        * plugins/PluginView.h:
-        (WebCore::PluginView::setPlatformPluginWidget):
-        * plugins/mac/PluginPackageMac.cpp: Added.
-        (WebCore::PluginPackage::determineQuirks):
-        (WebCore::readPListFile):
-        (WebCore::stringListFromResourceId):
-        (WebCore::PluginPackage::fetchInfo):
-        (WebCore::PluginPackage::load):
-        (WebCore::PluginPackage::hash):
-        (WebCore::PluginPackage::equal):
-        (WebCore::PluginPackage::compareFileVersion):
-        * plugins/mac/PluginViewMac.cpp: Added.
-        (WebCore::nativeWindowFor):
-        (WebCore::cgHandleFor):
-        (WebCore::topLevelOffsetFor):
-        (WebCore::PluginView::init):
-        (WebCore::PluginView::~PluginView):
-        (WebCore::PluginView::stop):
-        (WebCore::PluginView::getValueStatic):
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::setParent):
-        (WebCore::PluginView::show):
-        (WebCore::PluginView::hide):
-        (WebCore::PluginView::setFocus):
-        (WebCore::PluginView::setParentVisible):
-        (WebCore::PluginView::setNPWindowRect):
-        (WebCore::PluginView::setNPWindowIfNeeded):
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::paint):
-        (WebCore::PluginView::invalidateRect):
-        (WebCore::PluginView::invalidateRegion):
-        (WebCore::PluginView::forceRedraw):
-        (WebCore::PluginView::handleMouseEvent):
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::nullEventTimerFired):
-        (WebCore::modifiersForEvent):
-        (WebCore::PluginView::globalMousePosForPlugin):
-        (WebCore::PluginView::dispatchNPEvent):
-        (WebCore::PluginView::userAgent):
-        (WebCore::PluginView::userAgentStatic):
-        (WebCore::PluginView::handlePostReadFile):
-
-2008-11-12  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22200
-        Crash when close event is dispatched to MessagePort due to document destruction
-
-        Test: fast/events/message-port-onclose.html
-
-        * dom/MessagePort.cpp: (WebCore::MessagePort::contextDestroyed):
-        Don't dispatch close event, even though HTML5 currently says that we should. It is not
-        right for GC to have observable effects.
-
-2008-11-12  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22203
-        Implement Worker messaging
-
-        No test cases included, because this functionality is disabled by default.
-
-        The implementation is known to still have many race condition, but works quite well for
-        testing.
-
-        * WebCore.xcodeproj/project.pbxproj: Added WorkerTask.{h,cpp}.
-
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::markActiveObjectsForContext): Re-worded comments a little.
-        (WebCore::markCrossHeapDependentObjectsForContext): Existing cross-heap GC protocol was
-        incorrect, changed it to a much simpler (but still incorrect) version.
-
-        * dom/WorkerTask.cpp: Added.
-        (WebCore::WorkerTask::~WorkerTask):
-        * dom/WorkerTask.h: Added.
-        Tasks posted to workers implement this new interface.
-
-        * bindings/js/JSDedicatedWorkerCustom.cpp:
-        (WebCore::JSDedicatedWorker::mark):
-        (WebCore::JSDedicatedWorker::connect):
-        * dom/DedicatedWorker.h:
-        * dom/DedicatedWorker.idl:
-        Auto-generate event listener attributes. Renamed startConversation() to connect(), tracking
-        WHATWG discussions.
-
-        * dom/DedicatedWorker.cpp:
-        (WebCore::WorkerConnectTask::WorkerConnectTask): A task that performs worker-side connect()
-        operations.
-        (WebCore::DedicatedWorker::DedicatedWorker): Initialize WorkerThread pointer.
-        (WebCore::DedicatedWorker::connect): Connect() creates a pair of entangled ports, and posts
-        one to worker. Since message port registration in ScriptExecutionContext is not thread safe,
-        this port starts with a null context pointer.
-        (WebCore::DedicatedWorker::notifyFinished): Since Worker methods should work immediately
-        after creation, we have to queue tasks until after a WorkerThread object is created. Then we
-        forward all queued tasks to its queue.
-
-        * dom/EventTarget.cpp: (WebCore::EventTarget::toWorkerContext):
-        * dom/EventTarget.h:
-        * bindings/js/JSEventTarget.cpp: (WebCore::toJS):
-        Added cases for WorkerContext, which is now an EventTarget, too.
-
-        * bindings/js/JSWorkerContext.h: Added JSWorkerContext::put() to make onconnect settable.
-        * bindings/js/JSWorkerContext.cpp:
-        (WebCore::JSWorkerContext::mark): Mark event listeners.
-        (WebCore::JSWorkerContext::createPrototype): Fixed a typo, use the right StructureID.
-        (WebCore::JSWorkerContext::put): Implemented.
-        (WebCore::jsWorkerContextPrototypeFunctionAddEventListener): Added an EventTarget implementation.
-        (WebCore::jsWorkerContextPrototypeFunctionRemoveEventListener): Ditto.
-        (WebCore::jsWorkerContextPrototypeFunctionDispatchEvent): Ditto.
-        (WebCore::jsWorkerContextOnconnect): Added.
-        (WebCore::setJSWorkerContextOnconnect): Added.
-
-        * bindings/js/WorkerScriptController.cpp: (WebCore::WorkerScriptController::evaluate):
-        Made it actually work by adding necessary setup.
-
-        * bindings/js/WorkerScriptController.h: (WebCore::WorkerScriptController::initScriptIfNeeded):
-        Check the right variable - it is the wrapper that may not be initialized yet.
-
-        * dom/ActiveDOMObject.cpp:
-        (WebCore::ActiveDOMObject::ActiveDOMObject):
-        (WebCore::ActiveDOMObject::~ActiveDOMObject):
-        Assert being called from the correct thread, as active DOM object tracking is not thread safe.
-
-        * dom/ScriptExecutionContext.h: Added a Task interface and a postTask() method, to be used
-        for asynchronously executing tasks in context's thread.
-
-        * dom/ScriptExecutionContext.cpp:
-        (WebCore::ProcessMessagesSoonTask): Changed from a Timer to a Task
-        (WebCore::ScriptExecutionContext::ScriptExecutionContext): Removed m_firedMessagePortTimer.
-        It was an optimization that couldn't be easily preserved without introducing race conditions
-        in multithreading case.
-        (WebCore::ScriptExecutionContext::processMessagePortMessagesSoon): Use postTask().
-        (WebCore::ScriptExecutionContext::dispatchMessagePortEvents): Added a comment explaining
-        why it's OK to not ref() ports in a frozen copy.
-        (WebCore::ScriptExecutionContext::createdMessagePort): Assert that we're not being called
-        from a wrong thread.
-        (WebCore::ScriptExecutionContext::destroyedMessagePort): Ditto.
-        (WebCore::ScriptExecutionContextTaskTimer): Part of
-        ScriptExecutionContext::Task implementation - use Timer if posting from main thread to main
-        thread.
-        (WebCore::ScriptExecutionContextTaskWorkerTask): Another part - use WorkerTask if posting
-        to a worker.
-        (WebCore::PerformTaskContext::PerformTaskContext): Finally, use callOnMainThread() if posting
-        to main thread from a secondary one.
-        (WebCore::performTask): A helper function for callOnMainThread().
-        (WebCore::ScriptExecutionContext::postTask): Use one of the above implementations.
-
-        * dom/MessagePort.h: Fixed message queue to keep EventData pointers - otherwise, we would
-        ref/deref EventData::message from different threads, which is not allowed.
-
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePortCloseEventTask): Use a task instead of a timer to work across threads.
-        (WebCore::MessagePort::EventData::create): Updated for EventData being refcountable now.
-        (WebCore::MessagePort::EventData::EventData): Ditto.
-        (WebCore::MessagePort::MessagePort): ScriptExecutionContext is now allowed to be null at
-        first, because we need to create ports for posting to other threads, and it is not possible
-        to register in a context from another thread.
-        (WebCore::MessagePort::clone): Always create ports with null contexts - it is now message
-        receiver's job to set the context.
-        (WebCore::MessagePort::postMessage): Enable posting to ports that are not attached to any
-        context yet.
-        (WebCore::MessagePort::startConversation): Ditto. Data port is always posted unattached.
-        (WebCore::MessagePort::contextDestroyed): Assert that we had a context.
-        (WebCore::MessagePort::attachToContext): Called when receiving a data port to register in
-        context.
-        (WebCore::MessagePort::scriptExecutionContext): Moved from header, as the function is virtual.
-        (WebCore::MessagePort::dispatchMessages): Attach data port to receiving context. Use postTask().
-        (WebCore::MessagePort::queueCloseEvent): Use postTask().
-        (WebCore::MessagePort::hasPendingActivity): Reworded comment a little. As mentioned above,
-        MessagePort cross-heap GC is still quite wrong.
-
-        * dom/WorkerContext.h: Made WorkerContext an event target, added onconnect attribute.
-        * dom/WorkerContext.cpp: Keep a pointer to WorkerThread. It is only used for debug assertions
-        now, but there is no harm in tracking it in release builds, too.
-
-        * dom/WorkerThread.cpp:
-        (WebCore::WorkerThread::create): WorkerThread is refcountable, construct with create().
-        (WebCore::WorkerThread::workerThread): Implemented a message loop.
-        * dom/WorkerThread.h:
-        (WebCore::WorkerThread::threadID): Also only used for assertions.
-        (WebCore::WorkerThread::messageQueue): Return a reference to queue, so clients can post to it.
-
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::postMessage): MessagePort::clone() no longer takes a context, as it
-        always sets it to null.
-        (WebCore::DOMWindow::postMessageTimerFired): Attach data port to receiving context.
-
-2008-11-12  Dirk Schulze  <vbs85@gmx.de>
-
-        Reviewed Darin Adler.
-
-        use strokeColor.alpha() instead of fillColor.alpha()
-        on GraphicsContext::strokePath()
-
-        [Canvas] Transparent fillStyle stops line rendering
-        https://bugs.webkit.org/show_bug.cgi?id=21888
-
-        Test: fast/canvas/canvas-stroke-empty-fill.html
-
-        * ChangeLog:
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::GraphicsContext::strokePath):
-
-2008-11-12  Stephanie  <slewis@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        Fix context leak in XSLStyleSheets.
-        See bug https://bugs.webkit.org/show_bug.cgi?id=15715
-
-        * xml/XSLStyleSheet.cpp:
-        (WebCore::XSLStyleSheet::parseString):
-
-2008-11-12  Alp Toker  <alp@nuanti.com>
-
-        autotools: List web worker-related headers needed for a successful
-        build. distcheck is passing again with this change.
-
-        * GNUmakefile.am:
-
-2008-11-12  Alp Toker  <alp@nuanti.com>
-
-        autotools build system fix-up only. Add FloatQuad.h to the source
-        lists and sort them.
-
-        * GNUmakefile.am:
-
-2008-11-12  Alp Toker  <alp@nuanti.com>
-
-        Build fixes for r38346. FloatQuad.cpp is missing:
-
-        1) #include "config.h"
-        2) #include <algorithm> for various mathematical definitions it uses.
-
-        * platform/graphics/FloatQuad.cpp:
-
-2008-11-12  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein
-
-        https://bugs.webkit.org/show_bug.cgi?id=22212
-
-        Rename absoluteOutlineBox() to absoluteOutlineBounds(), to indicate that
-        it may be the bounding outline box of a transformed element, and fix it
-        to respect transforms by mapping the outline box to an absolute quad and
-        taking the enclosing rect.
-        
-        RenderBox::localToAbsoluteQuad() can no longer assert that there is no
-        LayoutState, but LayoutState cannot be used during quad mapping (it knows
-        nothing about transforms).
-        
-        Finally, fix a bug in RenderBox::localToAbsoluteQuad() which was getting
-        borderTopExtra() from the object, rather than its container (as localToAbsolute()
-        does).
-        
-        Test: fast/repaint/transform-absolute-child.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::layoutBlock):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::localToAbsoluteQuad):
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::layoutBlock):
-        * rendering/RenderForeignObject.cpp:
-        (WebCore::RenderForeignObject::layout):
         * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateLayerPositions):
-        (WebCore::RenderLayer::setHasVisibleContent):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):
-        (WebCore::RenderObject::absoluteOutlineBounds):
-        * rendering/RenderObject.h:
-        * rendering/RenderPath.cpp:
-        (WebCore::RenderPath::layout):
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::layout):
-        * rendering/RenderSVGContainer.cpp:
-        (WebCore::RenderSVGContainer::layout):
-        * rendering/RenderSVGImage.cpp:
-        (WebCore::RenderSVGImage::layout):
-        * rendering/RenderSVGRoot.cpp:
-        (WebCore::RenderSVGRoot::layout):
-        * rendering/RenderSVGText.cpp:
-        (WebCore::RenderSVGText::layout):
-        * rendering/RenderSVGViewportContainer.cpp:
-        (WebCore::RenderSVGViewportContainer::layout):
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::layout):
-
-2008-11-12  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        https://bugs.webkit.org/show_bug.cgi?id=21942
-        https://bugs.webkit.org/show_bug.cgi?id=18557
-        
-        Add methods which can be used to map renderer-local rectangles
-        to quads in absolute coordinates, taking transforms into account:
-            localToAbsoluteQuad() converts a local rect into an absolute quad.
-            collectAbsoluteLineBoxQuads() is an analogue of addLineBoxRects()
-                that works with quads.
-            absoluteQuads() is an analogue of absoluteRects(), for quads.
-        
-        Use the quad methods to fix the inspector highlight for transformed
-        elements.
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * inspector/InspectorController.cpp:
-        (WebCore::drawOutlinedQuad):
-        (WebCore::drawHighlightForBoxes):
-        (WebCore::frameToMainFrameOffset):
-        (WebCore::InspectorController::drawNodeHighlight):
-        * platform/graphics/AffineTransform.cpp:
-        (WebCore::AffineTransform::mapQuad):
-        * platform/graphics/AffineTransform.h:
-        * platform/graphics/FloatQuad.cpp: Added.
-        (WebCore::min4):
-        (WebCore::max4):
-        (WebCore::FloatQuad::boundingBox):
-        * platform/graphics/FloatQuad.h: Added.
-        (WebCore::FloatQuad::FloatQuad):
-        (WebCore::FloatQuad::p1):
-        (WebCore::FloatQuad::p2):
-        (WebCore::FloatQuad::p3):
-        (WebCore::FloatQuad::p4):
-        (WebCore::FloatQuad::setP1):
-        (WebCore::FloatQuad::setP2):
-        (WebCore::FloatQuad::setP3):
-        (WebCore::FloatQuad::setP4):
-        (WebCore::FloatQuad::isEmpty):
-        (WebCore::FloatQuad::enclosingBoundingBox):
-        (WebCore::FloatQuad::move):
-        (WebCore::operator+=):
-        (WebCore::operator-=):
-        (WebCore::operator==):
-        (WebCore::operator!=):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::localToAbsoluteQuad):
-        * rendering/RenderBox.h:
-        * rendering/RenderContainer.cpp:
-        (WebCore::RenderContainer::collectAbsoluteLineBoxQuads):
-        * rendering/RenderContainer.h:
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::absoluteQuads):
-        * rendering/RenderInline.h:
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::absoluteBoundingBoxRect):
-        (WebCore::RenderObject::collectAbsoluteLineBoxQuads):
-        (WebCore::RenderObject::absoluteQuads):
-        (WebCore::RenderObject::localToAbsoluteQuad):
-        (WebCore::RenderObject::absoluteContentQuad):
-        * rendering/RenderObject.h:
-        * rendering/RenderPath.cpp:
-        (WebCore::RenderPath::absoluteQuads):
-        * rendering/RenderPath.h:
-        * rendering/RenderSVGContainer.cpp:
-        (WebCore::RenderSVGContainer::absoluteQuads):
-        * rendering/RenderSVGContainer.h:
-        * rendering/RenderSVGHiddenContainer.cpp:
-        (WebCore::RenderSVGHiddenContainer::absoluteQuads):
-        * rendering/RenderSVGHiddenContainer.h:
-        * rendering/RenderSVGImage.cpp:
-        (WebCore::RenderSVGImage::calculateAbsoluteBounds):
-        (WebCore::RenderSVGImage::absoluteQuads):
-        * rendering/RenderSVGImage.h:
-        * rendering/RenderSVGInlineText.cpp:
-        (WebCore::RenderSVGInlineText::absoluteQuads):
-        (WebCore::RenderSVGInlineText::computeAbsoluteRectForRange):
-        * rendering/RenderSVGInlineText.h:
-        * rendering/RenderSVGRoot.cpp:
-        (WebCore::RenderSVGRoot::absoluteQuads):
-        * rendering/RenderSVGRoot.h:
-        * rendering/RenderSVGTSpan.cpp:
-        (WebCore::RenderSVGTSpan::absoluteRects):
-        (WebCore::RenderSVGTSpan::absoluteQuads):
-        * rendering/RenderSVGTSpan.h:
-        * rendering/RenderSVGText.cpp:
-        (WebCore::RenderSVGText::absoluteRects):
-        (WebCore::RenderSVGText::absoluteQuads):
-        * rendering/RenderSVGText.h:
-        * rendering/RenderSVGTextPath.cpp:
-        (WebCore::RenderSVGTextPath::absoluteRects):
-        (WebCore::RenderSVGTextPath::absoluteQuads):
-        * rendering/RenderSVGTextPath.h:
-        * rendering/RenderTableCell.cpp:
-        (WebCore::RenderTableCell::localToAbsolute):
-        (WebCore::RenderTableCell::localToAbsoluteQuad):
-        * rendering/RenderTableCell.h:
-        * rendering/RenderText.cpp:
-        (WebCore::RenderText::absoluteQuads):
-        (WebCore::RenderText::collectAbsoluteLineBoxQuads):
-        * rendering/RenderText.h:
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::localToAbsoluteQuad):
-        (WebCore::RenderView::absoluteQuads):
-        * rendering/RenderView.h:
-
-2008-11-12  Brent Fulgham <bfulgham@gmail.com>
-
-        Fix Bug 22178: Build errors in WebKit Cairo port
-
-        <https://bugs.webkit.org/show_bug.cgi?id=22178>
-
-        Reviewed by Mark Rowe.
-
-        * platform/graphics/cairo/PatternCairo.cpp: Correct build error under
-        Visual Studio.
-        (WebCore::Pattern::createPlatformPattern):
-
-2008-11-12  Adam Roben  <aroben@apple.com>
-
-        Fix a typo in the include path for the Release_Cairo configuration
-
-        * WebCore.vcproj/WebCore.vcproj: Fixed "caro" -> "cairo" typo.
-
-2008-11-12  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        https://bugs.webkit.org/show_bug.cgi?id=17840
-        Patch 2
-        
-        Code cleanup in RenderBox::computeAbsoluteRepaintRect().
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::computeAbsoluteRepaintRect):
-
-2008-11-12  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        https://bugs.webkit.org/show_bug.cgi?id=17840
-
-        Fix repainting when the transform on a positioned element changes.
-        In computeAbsoluteRepaintRect(), add the offsets due to relative positioning,
-        and being in a positioned container after applying the transform to the local
-        rect.
-
-        Tests: fast/repaint/transform-absolute-in-positioned-container.html
-               fast/repaint/transform-relative-position.html
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::computeAbsoluteRepaintRect):
-
-2008-11-12  Justin Garcia  <justin.garcia@apple.com>
- 
-        Reviewed by Beth Dakin.
- 
-        <rdar://problem/5495723> Selecting and deleting quoted text quotes other text
-        <rdar://problem/4775313> Deleting lines from the bottom of a messages leaves the last blank line quoted
+        (WebCore::RenderLayer::paintLayer):
         
-        We don't want to merge into a block if it will mean changing the quote level of content after deleting 
-        selections that contain a whole number paragraphs plus a line break, since it is unclear to most users 
-        that such a selection actually ends at the start of the next paragraph.  Instead we want to completely
-        remove the selected paragraph(s) and all evidence of the first one's quote level.  This matches TextEdit behavior 
-        for indented paragraphs.
- 
-        * editing/DeleteSelectionCommand.cpp:
-        (WebCore::DeleteSelectionCommand::initializePositionData): For the selections described above, do not
-        try to merge after the deletion.  Instead try and prune the start block or blocks if they've been emptied
-        so that we remove evidence of the deleted paragraphs' quote level.
-        (WebCore::DeleteSelectionCommand::mergeParagraphs): Try and prune the start block(s) if necessary.  Also 
-        make sure that the caret is placed correctly so that it ends up on the same line that the deleted selection 
-        started on, instead of one higher.
-        * editing/DeleteSelectionCommand.h:
-        * editing/htmlediting.cpp:
-        (WebCore::numEnclosingMailBlockquotes): Added.
-        * editing/htmlediting.h:
-
-2008-11-10  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon Hausmann.
-
-        Move _web_encodingForResource from WebKit into WebCore and change return type
-
-        This change is needed to implement NSAPI in WebCore for Mac, see:
-
-        https://bugs.webkit.org/show_bug.cgi?id=21427
-
-        * WebCore.base.exp:
-        * platform/mac/WebCoreNSStringExtras.h:
-        * platform/mac/WebCoreNSStringExtras.mm:
-        (stringEncodingForResource):
-
-2008-11-10  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon Hausmann.
-
-        Moved the implementation of _webkit_isCaseInsensitiveEqualToString to
-        WebCore's WebCoreNSStringExtras as _stringIsCaseInsensitiveEqualToString.
-
-        This change is needed to implement NSAPI in WebCore for Mac, see:
-
-        https://bugs.webkit.org/show_bug.cgi?id=21427
-
-        * WebCore.base.exp:
-        * platform/mac/WebCoreNSStringExtras.h:
-        * platform/mac/WebCoreNSStringExtras.mm:
-        (stringIsCaseInsensitiveEqualToString):
-
-2008-11-11  Stephanie  <slewis@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Null check image data before setting it as image source.
-
-        Test: fast/images/image-empty-data.html
-
-        * platform/graphics/BitmapImage.cpp:
-        (WebCore::BitmapImage::destroyDecodedData):
-
-2008-11-11  Adele Peterson  <adele@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        Remove ifdef so future OS versions can use the new delegate method.
-
-        * platform/network/mac/ResourceHandleMac.mm: (WebCore::ResourceHandle::didSendBodyDataDelegateExists):
-
-2008-11-11  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Antti Koivisto and Sam Weinig.
-
-        Clean up HTMLTokenizer a litle
-        https://bugs.webkit.org/show_bug.cgi?id=22188
-
-        Rename pendingScripts to m_pendingScripts
-        Rename scriptNode to m_scriptNode make the type specific
-        Rename pendingSrc to m_pendingSrc
-        Rename currentPrependingSrc to m_currentPrependingSrc
-        Rename noMoreData to m_noMoreData and cBuffer to m_cBuffer
-        Remove long-since-dead kdDebug and qDebug calls
-        Rename brokenComments to m_brokenComments
-        Remove HTMLTokenizer includes and document the rest
-        Rename src to m_src
-        Rename parser to m_parser and make it an OwnPtr
-        Rename inWrite to m_inWrite and jsProxy to scriptController
-        Rename brokenServer to m_brokenServer
-        Rename buffer to m_buffer and dest to m_dest
-        Rename size to m_bufferSize
-        Rename attrName to m_attrName
-        Rename searchStopper to m_searchStopper and searchStopperLen to m_searchStopperLen
-        Rename scriptCode* to m_scriptCode* and change scriptCodeMax to m_scriptCodeCapacity
-        Rename scriptStartLineno to m_currentScriptTagStartLineNumber and tagStartLineno to m_currentTagStartLineNumber
-        Rename scriptSrc to m_scriptTagSrcAttrValue and scriptSrcCharset to m_scriptTagCharsetAttrValue -- a bit unwieldy, but more precise
-        Rename flat to selfClosingTag
-        Rename currToken to m_currentToken
-
-        * css/CSSParser.cpp:
-        * dom/XMLTokenizer.cpp:
-        * dom/XMLTokenizerLibxml2.cpp:
-        * html/HTMLDocument.cpp:
-        * html/HTMLElement.cpp:
-        * html/HTMLFormControlElement.cpp:
-        * html/HTMLParser.h:
-        * html/HTMLTokenizer.cpp:
-        (WebCore::Token::addAttribute):
-        (WebCore::HTMLTokenizer::HTMLTokenizer):
-        (WebCore::HTMLTokenizer::reset):
-        (WebCore::HTMLTokenizer::begin):
-        (WebCore::HTMLTokenizer::processListing):
-        (WebCore::HTMLTokenizer::parseSpecial):
-        (WebCore::HTMLTokenizer::scriptHandler):
-        (WebCore::HTMLTokenizer::scriptExecution):
-        (WebCore::HTMLTokenizer::parseComment):
-        (WebCore::HTMLTokenizer::parseServer):
-        (WebCore::HTMLTokenizer::parseProcessingInstruction):
-        (WebCore::HTMLTokenizer::parseText):
-        (WebCore::HTMLTokenizer::parseEntity):
-        (WebCore::HTMLTokenizer::parseTag):
-        (WebCore::HTMLTokenizer::write):
-        (WebCore::HTMLTokenizer::processingData):
-        (WebCore::HTMLTokenizer::end):
-        (WebCore::HTMLTokenizer::finish):
-        (WebCore::HTMLTokenizer::processToken):
-        (WebCore::HTMLTokenizer::processDoctypeToken):
-        (WebCore::HTMLTokenizer::~HTMLTokenizer):
-        (WebCore::HTMLTokenizer::enlargeBuffer):
-        (WebCore::HTMLTokenizer::enlargeScriptBuffer):
-        (WebCore::HTMLTokenizer::notifyFinished):
-        (WebCore::HTMLTokenizer::setSrc):
-        * html/HTMLTokenizer.h:
-        (WebCore::Token::Token):
-        (WebCore::Token::reset):
-        (WebCore::HTMLTokenizer::processingContentWrittenByScript):
-        (WebCore::HTMLTokenizer::htmlParser):
-        (WebCore::HTMLTokenizer::checkBuffer):
-        (WebCore::HTMLTokenizer::checkScriptBuffer):
-        * html/HTMLViewSourceDocument.h:
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::leftRelOffset):
-        (WebCore::RenderBlock::rightRelOffset):
-        (WebCore::RenderBlock::lineWidth):
-        * xml/XSLTProcessor.cpp:
-
-2008-11-11  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=22189
-        Track CachedScript decoded data
-
-        We now track the decoded size of CachedScripts in the Cache allowing
-        them to accounted for when deciding when to evict data.  The decoded
-        data itself can be evicted when Cache pressure gets high enough through
-        CachedScript::destroyDecodedData.
-
-        * loader/CachedResource.h:
-        (WebCore::CachedResource::allClientsRemoved):
-        (WebCore::CachedResource::destroyDecodedData):
-        * loader/CachedScript.cpp:
-        (WebCore::CachedScript::script):
-        (WebCore::CachedScript::data):
-        (WebCore::CachedScript::destroyDecodedData):
-        * loader/CachedScript.h:
-
-2008-11-11  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Remove pointless dependencies on the now-deleted kjs directory and
-        mentions of it in comments that are no longer relevant.
-
-        * WebCore.pro:
-        * webcore-base.bkl:
-
-2008-11-11  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Adam Roben.
-
-        WebCore part of adding a master volume control for media elements in a WebView
-
-        * WebCore.base.exp: Exported WebCore::Page::setMediaVolume().
-        * dom/Document.cpp:
-        (WebCore::Document::mediaVolumeDidChange): Added. Called by the Page
-        when the media volume is changed.
-        (WebCore::Document::registerForMediaVolumeCallbacks): Added. Allows
-        elements to register for a callback when the media volume is changed.
-        (WebCore::Document::unregisterForMediaVolumeCallbacks): Added. Allows
-        elements to unregister for the callback.
-        * dom/Document.h:
-        * dom/Element.h:
-        (WebCore::Element::mediaVolumeDidChange): Added an empty implementation.
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::HTMLMediaElement): Added a call to
-        registerForMediaVolumeCallbacks().
-        (WebCore::HTMLMediaElement::~HTMLMediaElement): Added a call to
-        unregisterForMediaVolumeCallbacks().
-        (WebCore::HTMLMediaElement::updateVolume): Changed to multiply the
-        element's intrinsic volume by the master volume from the page.
-        (WebCore::HTMLMediaElement::mediaVolumeDidChange): Added. Calls
-        updateVolume().
-        * html/HTMLMediaElement.h:
-        * page/Page.cpp:
-        (WebCore::Page::Page): Initialize m_mediaVolume to 1.
-        (WebCore::Page::setMediaVolume): Added. Calls mediaVolumeDidChange() on
-        every document in the page when the master volume changes.
-        * page/Page.h:
-        (WebCore::Page::mediaVolume): Added this getter.
-
-2008-11-11  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=22182
-
-        Fix problems with scrollbars when the OS setting for clicks in the track jumping the thumb to that location
-        is turned on.  Make sure to only jump the thumb if the click happens in the track.  Also fix some math
-        errors when jumping the thumb that cause dragging after the jump to incorrectly jump the thumb again.
-
-        Reviewed by Adele
-
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::mouseDown):
-
-2008-11-11  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Fix for <rdar://problem/5089327> Too much indentation when pasting 
-        quoted paragraphs
-
-        This patch re-addresses pasting blockquotes into blockquotes. It 
-        backs out most of revision 38273. 38273 fixed the bug by inserting 
-        the pasted content as a sibling blockquote node to the pre-existing 
-        blockquote node. The problem with that is that by default, 
-        blockquotes have a giant margin, so visually, this can be weird. 
-        This patch instead inserts the pasted content as siblings of the 
-        the content already inside the outer blockquote, and then removes 
-        the blockquote node from the pasted content itself, so that it 
-        doesn't nest itself into the outer blockquote.
-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::ReplaceSelectionCommand::doApply):
-
-        Move contains() from Element to Node since there is nothing 
-        Element-specific about it.
-        * dom/Element.cpp:
-        * dom/Element.h:
-        * dom/Node.cpp:
-        (WebCore::Node::contains):
-        * dom/Node.h:
-
-2008-11-11  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=17997
-
-        Stop using the new Leopard API tiling call for scaled tiles when drawing background images.  The method
-        is buggy.  Fall back to using the slower (and more correct) pattern tiling that Tiger still uses.  This
-        is a Leopard-only workaround, since the API has been fixed on Snow Leopard.
-
-        Reviewed by John Sullivan
-
-        * platform/graphics/cg/ImageCG.cpp:
-        (WebCore::Image::drawPattern):
-
-2008-11-10  David Hyatt  <hyatt@apple.com>
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::contentOffsetInCompostingLayer):
+        Remove a printf that I left in by mistake.
 
-        Disable the Aqua look for menu lists when full page zoom is turned on.  Because the control is buggy
-        when scaling and because it's impossible to paint into an offscreen bitmap without completely rewriting
-        how we draw the control on Mac, our only real option for now is to just switch to our styled look when zoomed.
-
-        Reviewed by Adam Roben
-
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::isControlStyled):
-
-2008-11-11  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=22160
-        speculative fix for <rdar://problem/5995450> Nil deref because nextLinePosition
-        (previousLinePosition, too) uses a nil node
-
-        * editing/visible_units.cpp:
-        (WebCore::nextLinePosition): Use RenderObject::node instead of RenderObject::element
-        to check editingIgnoresContent. It makes sense to use the associated DOM node for
-        this, even in cases of anonymous content, and it avoids the case where element() can
-        be 0.
-        (WebCore::previousLinePosition): Ditto.
-
-2008-11-11  Dirk Schulze  <vbs85@gmx.de>
+2009-06-23  Anders Carlsson  <andersca@apple.com>
 
         Reviewed by Darin Adler.
 
-        Removed default: in applySpreadMethod. This causes the problems
-        in radial gradients. We don't need CAIRO_EXTEND_NONE in SVG, Canvas
-        or CSS.
-
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        (WebCore::applySpreadMethod):
-
-2008-11-11  Ariya Hidayat  <ariya.hidayat@trolltech.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Fix crash when rendering the file chooser.
-        Also proper implementation for multi-selected files.
-
-        * platform/qt/FileChooserQt.cpp:
-        (WebCore::FileChooser::basenameForWidth):
-
-2008-11-11  Dirk Schulze  <vbs85@gmx.de>
-
-        Reviewed by Oliver Hunt.
-
-        PatternCairo needs to invert the pattern matrix because
-        of transformation from user space to pattern space.
-        Give a identity matrix to pattern for Qt and Cairo. Because the 
-        context is transformed already.
-
-        [CAIRO][QT] Canvas transformations applied twice to Patterns
-        https://bugs.webkit.org/show_bug.cgi?id=21555
-
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::strokePath):
-        * platform/graphics/cairo/PatternCairo.cpp:
-        (WebCore::Pattern::createPlatformPattern):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::fillRect):
-
-2008-11-10  Stephanie Lewis  <slewis@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Clear the image source cache even if we haven't decoded any of the image data.
-        We use the image source cache when calculating layout.
-
-        * loader/Cache.cpp:
-        (WebCore::Cache::pruneDeadResources):
-        * platform/graphics/BitmapImage.cpp:
-        (WebCore::BitmapImage::destroyDecodedData):
-
-2008-11-10  Adam Roben  <aroben@apple.com>
-
-        Fix Bug 22161: Assertion failure in RenderThemeWin::systemColor when
-        loading microsoftpdc.com
-
-        <https://bugs.webkit.org/show_bug.cgi?id=22161>
-
-        Reviewed by Dan Bernstein.
-
-        Test: fast/css/outline-invert-assertion.html
-
-        * rendering/RenderThemeWin.cpp:
-        (WebCore::RenderThemeWin::systemColor): If we can't determine a good
-        Win32 system color to use, defer to RenderTheme instead of asserting.
-        This matches what RenderThemeMac does.
-
-2008-11-10  Justin Garcia  <justin.garcia@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        <rdar://problem/4037481> REGRESSION (Mail): pasting quoted text 
-        into quoted text yields double-quoting
+        WebCore side of <rdar://problem/6946094>.
         
-        Don't nest inserted content in Mail blockquotes.  Perform a 
-        BreakBlockquoteCommand if we're in
-        one and insert the incoming fragment between the split blockquotes.
-
-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::ReplaceSelectionCommand::shouldMerge): Renamed from -> 
-        source and to -> destination.
-        (WebCore::ReplaceSelectionCommand::doApply):
-
-2008-11-10  Adam Roben  <aroben@apple.com>
-
-        Fix Bug 22158: Would like to turn on WebCore logging channels via an
-        environment variable
-
-        <https://bugs.webkit.org/show_bug.cgi?id=22158>
-
-        Logging channels can now be enabled by setting the WebCoreLogLevel
-        environment variable to a hexadecimal number.
-
-        Reviewed by Anders Carlsson.
-
-        * WebCore.vcproj/WebCore.vcproj: Added LoggingWin.cpp.
-        * platform/win/LoggingWin.cpp: Copied from WebCore/platform/mac/LoggingMac.mm.
-        (WebCore::initializeWithUserDefault): Read in the WebCoreLogLevel
-        environment variable, parse its value as a hexadecimal number, and
-        turn the channel on/off based on whether the mask bit is set.
-        (WebCore::InitializeLoggingChannelsIfNecessary): Initialize each
-        logging channel in turn.
-
-2008-11-10  Darin Adler  <darin@apple.com>
-
-        Reviewed by Adam Roben.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=22103
-          Changing fonts in preferences does not immediately update WebViews
-
-        This broke when the meaning of FrameView::invalidate changed.
-        I changed setNeedsReapplyStyles to no longer depend on invalidate.
-
-        * dom/Document.cpp: (WebCore::Document::shouldScheduleLayout):
-        Removed the part of this function that duplicated what's already in
-        FrameView::needsLayout, since the copy here left out a few key things.
-        For example, it didn't handle the fact that "needs reapply styles"
-        counts as needing layout.
-
-        * page/Frame.cpp: (WebCore::Frame::setNeedsReapplyStyles): This called
-        FrameView::invalidate before. There were two things wrong with that.
-        1) It requested that the entire view repaint even if the style change
-        didn't necessitate that. 2) FrameView::invalidate no longer causes any
-        repainting at all in certain cases, because of Hyatt's changes to how
-        widgets and the host window are involved in the repainting process.
-        So call FrameView::scheduleRelayout instead, which is more precisely
-        what we want and need here.
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::scheduleRelayout): Add a call to needsLayout here
-        so that Document::shouldScheduleLayout doesn't have to replicate the
-        logic that's in needsLayout and can instead rely on the fact that it
-        was already called.
-        (WebCore::FrameView::needsLayout): Tweaked the comments and formatting
-        in this function.
-
-2008-11-10  Darin Adler  <darin@apple.com>
-
-        Reviewed by Adam Roben.
-
-        - speculative fix for <rdar://problem/5557243> crashes in Safari at
-          WebCore::HTMLSelectElement::updateListBoxSelection + 280
-
-        * html/HTMLSelectElement.cpp:
-        (WebCore::HTMLSelectElement::updateListBoxSelection):
-        Check index against size of vector before indexing into the vector.
-
-2008-11-10  Tom Cooksey  <thomas.cooksey@trolltech.com>
-
-        Reviewed by Tor Arne Vestbø.
-
-        Fix QtWebkit build failure on arm.
-
-        pen.widthF() is a qreal, which means it's a float on arm.
-
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::setLineDash):
-
-2008-11-10  Morten Sørvig  <msorvig@trolltech.com>
-
-        Reviewed by Simon Hausmann.
-
-        Improve mouse wheel scolling on Qt/Cocoa.
-        Cocoa differs from Carbon (and other platforms I think) in that the
-        mouse wheel events we get have a much higher acceleration factor.
-
-        This submit switches over to scroll-per-pixel from scroll-per-line
-        for most of our scrolling views. This matches the native views
-        and works well with the increased acceleration.
-
-        * platform/qt/WheelEventQt.cpp:
-
-2008-11-09  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 19541: Null pointer in showModalDialog()
-        <https://bugs.webkit.org/show_bug.cgi?id=19541>
-
-        Add null frame->page() checks to JSDOMWindowBase::canShowModalDialog()
-        and JSDOMWindowBase::canShowModalDialogNow()C
-
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::canShowModalDialog):
-        (WebCore::canShowModalDialogNow):
-
-2008-11-09  Darin Adler  <darin@apple.com>
-
-        - try to fix Windows build
-
-        * platform/graphics/Color.cpp: For some reason MSVC doesn't follow the rules
-        about needed a separate definition for static const integer data members.
-        Until I get to the bottom of this, put the definitions inside an ifdef.
-
-2008-11-09  David Kilzer  <ddkilzer@apple.com>
-
-        BUILD FIX: Qt build broke after r38235.
-
-        Added HAVE(ACCESSIBILITY) header guards to platform implementation
-        source files.
-
-        * page/gtk/AccessibilityObjectAtk.cpp: Added HAVE(ACCESSIBILITY)
-        guards.
-        * page/gtk/AccessibilityObjectWrapperAtk.cpp: Ditto.
-        * page/qt/AccessibilityObjectQt.cpp: Ditto.
-        * page/win/AccessibilityObjectWin.cpp: Ditto.
-        * page/wx/AccessibilityObjectWx.cpp: Ditto.
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::setExternalDataObject):
+        * platform/win/ClipboardWin.h:
 
-2008-11-09  Alexey Proskuryakov  <ap@webkit.org>
+2009-06-23  Darin Fisher  <darin@chromium.org>
 
         Reviewed by Darin Adler.
 
-        https://bugs.webkit.org/show_bug.cgi?id=22104
-        Javascript URL percent encoding/decoding broken by some characters
-
-        Test: fast/loader/javascript-url-encoding-2.html
-
-        * platform/KURL.cpp: (WebCore::encodeRelativeString): Don't try to break down javascript URLs.
-
-2008-11-09  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed and tweaked by Darin Adler.
-
-        * platform/graphics/Color.cpp: Added definitions for the static data members
-        in this class. Static data members need a definition, even when they are the
-        simple integer constant kind that can be initialized in the header.
-
-2008-11-08  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Sam Weinig.
-        
-        Fix https://bugs.webkit.org/show_bug.cgi?id=22141
-        REGRESSION: Safari error page is not fully styled when loaded from cache
-        
-        Reset text decoder on flush so it does not pass through the BOM when it is reused.
-
-        Test: fast/encoding/css-cached-bom.html
-
-        * loader/TextResourceDecoder.cpp:
-        (WebCore::TextResourceDecoder::flush):
-
-2008-11-08  Kevin Ollivier  <kevino@theolliviers.com>
- 
-        Reviewed by Mark Rowe.
-
-        Send URL errors to stderr rather than stdout. While debugging wx DumpRenderTree,
-        it was causing these errors to end up in the page's text representation.
-
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::ResourceHandleManager::downloadTimerCallback):
-
-2008-11-08  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fixes after addition of JSCore parser and bycompiler dirs. 
-
-        * webcore-base.bkl:
-        * webcore-wx.bkl:
-
-2008-11-08  Simon Fraser  <simon.fraser@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=26650
 
-        Reviewed by Dan Bernstein
+        Add setFormContentType and setFormData since it is awkward for Chromium
+        to use setFormInfoFromRequest to set the underlying members.  Also, add
+        a clearChildren method that Chromium needs.  These methods are used as
+        part of the Chromium code that serializes a HistoryItem for storing in
+        the browser's session history.
 
-        https://bugs.webkit.org/show_bug.cgi?id=21906
-        
-        Override addFocusRingRects() in RenderTextControl to avoid
-        the RenderFlow behavior of recursing on descendent renderers.
-        RenderTextControl should only ever need a simple focus rect.
-        
-        This fixes focus ring issues with transforms on text controls.
-        
-        Test: fast/transforms/transformed-focused-text-input.html
-
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::addFocusRingRects):
-        * rendering/RenderTextControl.h:
-
-2008-11-08  Dimitri Dupuis-Latour  <dupuislatour@apple.com>
-
-        Make sure the icon thumbnail width/height is at least 1px in
-        the Web Inspector's resource panel.
-
-        <rdar://problem/5988888>
-
-        Reviewed by Tim Hatcher.
-
-        * inspector/front-end/inspector.css:
-
-2008-11-08  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 22137: PLATFORM(MAC) build broken with HAVE(ACCESSIBILITY) disabled
-
-        <https://bugs.webkit.org/show_bug.cgi?id=22137>
-
-        Reviewed by Darin Adler.
-
-        * page/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::accessibilityIgnoreAttachment):
-        Provide a default implementation when HAVE(ACCESSIBILITY) is false.
-        * page/mac/AXObjectCacheMac.mm: Added HAVE(ACCESSIBILITY) guard.
-        * page/mac/AccessibilityObjectMac.mm: Ditto.
-        * page/mac/AccessibilityObjectWrapper.mm: Ditto.
+        * history/HistoryItem.cpp:
+        * history/HistoryItem.h:
 
-2008-11-08  Dan Bernstein  <mitz@apple.com>
+2009-06-23  Eric Carlson  <eric.carlson@apple.com>
 
         Reviewed by Darin Adler.
 
-        - WebCore part of adding WebPreferences for controlling databases and local storage
+        <rdar://problem/6978938> Need HTML 5 event attributes for media elements
 
-        * WebCore.base.exp: Exported Settings::setDatabasesEnabled() and
-        Settings::setLocalStorageEnabled().
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::localStorage): Changed to return 0 if local storage
-        is disabled in settings.
-        (WebCore::DOMWindow::openDatabase): Changed to return 0 if databases
-        are disabled in settings.
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings): Initialize m_databasesEnabled and
-        m_localStorageEnabled.
-        (WebCore::Settings::setDatabasesEnabled): Added.
-        (WebCore::Settings::setLocalStorageEnabled): Added.
-        * page/Settings.h:
-        (WebCore::Settings::databasesEnabled): Added.
-        (WebCore::Settings::localStorageEnabled): Added.
+        Test: media/event-attributes.html
 
-2008-11-07  Alp Toker  <alp@nuanti.com>
-
-        Fix build with bleeding edge GTK+ versions. GTK+ and other libraries
-        now require that only their top-level header file is included.
-
-        Patch tested and still builds fine with older GTK+ versions (back to
-        2.8).
-
-        Future WebKit GTK+ contributions are required to adhere to this
-        policy.
-
-        * platform/gtk/FileSystemGtk.cpp:
-        * platform/gtk/KeyEventGtk.cpp:
-        * platform/gtk/MouseEventGtk.cpp:
-        * platform/gtk/WheelEventGtk.cpp:
-        * platform/gtk/gtkdrawing.h:
-        * plugins/gtk/gtk2xtbin.c:
-        * plugins/gtk/gtk2xtbin.h:
-
-2008-11-07  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Kevin Decker
-
-        Explicitly initialize the NPDrawingModelCoreAnimation.
-
-        * bridge/npapi.h:
-
-2008-11-07  Alp Toker  <alp@nuanti.com>
-
-        autotools fix. Always use the configured perl binary (which may be
-        different to the one in $PATH) when generating sources.
-
-        * GNUmakefile.am:
-
-2008-11-07  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein
-
-        https://bugs.webkit.org/show_bug.cgi?id=22122
-        
-        Use a stack-based object to simplify the pushLayoutState/popLayoutState
-        code. LayoutStateMaintainer either pushes in the constructor, or allows
-        an explicit push() later. Both cases require an explicit pop().
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::layoutBlock):
-        (WebCore::RenderBlock::layoutOnlyPositionedObjects):
-        * rendering/RenderContainer.cpp:
-        (WebCore::RenderContainer::layout):
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::layoutBlock):
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::layout):
-        * rendering/RenderTableRow.cpp:
-        (WebCore::RenderTableRow::layout):
-        * rendering/RenderTableSection.cpp:
-        (WebCore::RenderTableSection::setCellWidths):
-        (WebCore::RenderTableSection::calcRowHeight):
-        (WebCore::RenderTableSection::layoutRows):
-        * rendering/RenderView.h:
-        (WebCore::LayoutStateMaintainer::LayoutStateMaintainer):
-        (WebCore::LayoutStateMaintainer::~LayoutStateMaintainer):
-        (WebCore::LayoutStateMaintainer::pop):
-        (WebCore::LayoutStateMaintainer::push):
-        (WebCore::LayoutStateMaintainer::didPush):
-
-2008-11-07  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Fix the QtWebKit build on Mac
-
-        * platform/qt/TemporaryLinkStubs.cpp:
-        (PluginView::invalidateRect):
-
-2008-11-07  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Rubber-stamped by Simon Hausmann.
-
-        Don't allow Phonon's invisible video widget to keep the app running
-
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        * html/HTMLAttributeNames.in: Add media event attribute names.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute): Handle media event attributes.
 
-2008-11-07  Henrik Hartz  <henrik.hartz@nokia.com>
+2009-06-23  Thiago Macieira  <thiago.macieira@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        Fix valgrind warning about uninitialized lastStop variable.
-
-        * platform/graphics/qt/GradientQt.cpp:
-        (WebCore::Gradient::platformGradient):
-
-2008-11-07  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Fix layout test brokenness following r38211.
-
-        * page/EventHandler.cpp: (WebCore::EventHandler::handleAccessKey):
-        Restore old Shift key behavior. We ignore Shift key state when matching access keys (which
-        matches neither IE nor Firefox), and this patch made WebKit behave like Firefox
-        inadvertently. This may or may not be a good thing, but it's certainly not something that
-        should change by accident.
-
-2008-11-06  Antti Koivisto  <antti@apple.com>
-
-        Eh, this trivial last minute change was wrong.
-
-        * loader/CachedCSSStyleSheet.cpp:
-        (WebCore::CachedCSSStyleSheet::sheetText):
-
-2008-11-06  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22093
-        
-        Delaying the text decoding caused regression since the decoding
-        also determines the encoding in case of @charset rule. 
-        
-        Decode immediately in data() and keep the decoded string around
-        during the checkNotify().
-
-        * loader/CachedCSSStyleSheet.cpp:
-        (WebCore::CachedCSSStyleSheet::sheetText):
-        (WebCore::CachedCSSStyleSheet::data):
-        * loader/CachedCSSStyleSheet.h:
-
-2008-11-06  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22097
-        Expose MessageEvent constructor on WorkerContext
-
-        * bindings/js/JSWorkerContext.cpp:
-        (WebCore::jsWorkerContextMessageEvent):
-        (WebCore::setJSWorkerContextMessageEvent):
-
-2008-11-06  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21107
-        <rdar://problem/6264219> New access key combination conflicts with VoiceOver
-
-        * page/EventHandler.h:
-        * page/gtk/EventHandlerGtk.cpp:
-        (WebCore::EventHandler::accessKeyModifiers):
-        * page/qt/EventHandlerQt.cpp:
-        (WebCore::EventHandler::accessKeyModifiers):
-        * page/win/EventHandlerWin.cpp:
-        (WebCore::EventHandler::accessKeyModifiers):
-        * page/wx/EventHandlerWx.cpp:
-        (WebCore::EventHandler::accessKeyModifiers):
-        Access access key modifiers via a function, not a static variable.
-
-        * page/mac/EventHandlerMac.mm: (WebCore::EventHandler::accessKeyModifiers):
-        Use Ctrl when VoiceOver is enabled, because a conflict with Emacs-style key bindings is
-        less troublesome than one with VO keys.
-
-        * page/EventHandler.cpp: (WebCore::EventHandler::handleAccessKey):
-        Also fix an access key matching bug introduced in r32424 - Any superset of specified
-        modifier set invoked access keys. We can use simple equality comparison instead because
-        CapsLock is not part of modifiers(), so it doesn't need to be ignored explicitly.
-
-2008-11-06  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Kevin Decker.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22115
-        NPN_HasPropertyUPP and NPN_HasMethodUPP entries in NPNetscapeFuncs are NULL
-
-        Export _NPN_HasMethod and _NPN_HasProperty.
-        
-        * WebCore.NPAPI.exp:
-
-2008-11-06  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Antti Koivisto
-
-        https://bugs.webkit.org/show_bug.cgi?id=15678
-        
-        Fix transformed menu selects to show the popup in the correct
-        location.
-
-        * rendering/RenderMenuList.cpp:
-        (WebCore::RenderMenuList::showPopup):
-
-2008-11-06  David Kilzer  <ddkilzer@apple.com>
-
-        BUILD FIX: Backed out r38189 (and r38203) for Xcode 3.0.
-
-        Apparently older versions of gcc have issues with this patch.
-        Backing out a second time until the issues are resolved.
-
-2008-11-06  Julien Chaffraix  <jchaffraix@pleyo.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 21106: .in format discussed changes
-        https://bugs.webkit.org/show_bug.cgi?id=21106
-
-        Include the namespace into the interfaceName.
-
-        * dom/make_names.pl: Do not append the namespace when
-        using the interfaceName.
-        * html/HTMLTagNames.in: Added namespace prefix for custom
-        interfaceName.
-        * svg/svgtags.in: Ditto.
-
-2008-11-06  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Move the remaining files in the kjs subdirectory of JavaScriptCore to
-        a new parser subdirectory, and remove the kjs subdirectory entirely.
-
-        * ForwardingHeaders/kjs: Removed.
-        * ForwardingHeaders/kjs/Parser.h: Removed.
-        * ForwardingHeaders/kjs/SavedBuiltins.h: Removed.
-        * ForwardingHeaders/kjs/SourceCode.h: Removed.
-        * ForwardingHeaders/kjs/SourceProvider.h: Removed.
-        * ForwardingHeaders/parser: Added.
-        * ForwardingHeaders/parser/Parser.h: Copied from ForwardingHeaders/kjs/Parser.h.
-        * ForwardingHeaders/parser/SourceCode.h: Copied from ForwardingHeaders/kjs/SourceCode.h.
-        * ForwardingHeaders/parser/SourceProvider.h: Copied from ForwardingHeaders/kjs/SourceProvider.h.
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * bindings/js/StringSourceProvider.h:
-        * bindings/js/WorkerScriptController.cpp:
-        * bridge/NP_jsobject.cpp:
-        * bridge/jni/jni_jsobject.mm:
-        * bridge/testbindings.pro:
-        * inspector/JavaScriptDebugServer.cpp:
-
-2008-11-06  David Kilzer  <ddkilzer@apple.com>
-
-        BUILD WAS NOT BROKEN: Rolling r38189 back in.
-
-        Please perform a clean build if you see crashes.
-
-2008-11-06  David Kilzer  <ddkilzer@apple.com>
-
-        BUILD FIX: Backed out r38189 since it apparently broke the world.
-
-2008-11-06  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        Bug 22112: if a <body> has contenteditable=true, it should report a writable AXValue
-        https://bugs.webkit.org/show_bug.cgi?id=22112
-
-        Test: accessibility/content-editable.html
-
-        * page/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::isReadOnly):
-
-2008-11-06  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Alice Liu.
-
-        Fix failed assert at launch caused by unintialized data member on the mac.
-
-        * platform/network/mac/NetworkStateNotifierMac.cpp:
-        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
-
-2008-11-06  Steve Falkenburg  <sfalken@apple.com>
-
-        Fix failed assert at launch caused by unintialized data member.
-        
-        Reviewed by Maciej Stachowiak.
-
-        * platform/network/win/NetworkStateNotifierWin.cpp:
-        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
-
-2008-11-06  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Antti Koivisto
-
-        https://bugs.webkit.org/show_bug.cgi?id=22109
-        Make <input type="range"> work correctly with transforms
-
-        Test: fast/forms/slider-transformed.html
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::defaultEventHandler):
-            Compute a correct local point when the event is retargeted
-        * rendering/RenderSlider.cpp:
-        (WebCore::HTMLSliderThumbElement::defaultEventHandler):
-            Compute m_initialClickPoint in slider-local coords, so that
-            deltas are computed correctly with transforms
-        (WebCore::RenderSlider::mouseEventIsInThumb):
-            Rather than computing an absolute bounds for the thumb,
-            convert the point to local coords and compare it with the border box.
-
-2008-11-06  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 21810: Remove use of static C++ objects that are destroyed at exit time (destructors)
-        https://bugs.webkit.org/show_bug.cgi?id=21810
-
-        * bindings/js/GCController.cpp:
-        (WebCore::gcController): Changed to leak an object to avoid an exit-time destructor.
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::wrapperSet): Ditto
-        * bindings/js/JSInspectedObjectWrapper.cpp:
-        (WebCore::wrappers): Ditto
-        * bindings/js/JSInspectorCallbackWrapper.cpp:
-        (WebCore::wrappers): Ditto
-        * bridge/runtime_root.cpp:
-        (JSC::Bindings::rootObjectSet): Ditto
-        * css/CSSMutableStyleDeclaration.cpp:
-        (WebCore::CSSMutableStyleDeclaration::removeProperty): Ditto
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::cssText): Ditto
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType): Ditto
-        * css/CSSStyleSelector.cpp:
-        (WebCore::screenEval): Ditto
-        (WebCore::printEval): Ditto
-        * dom/DOMImplementation.cpp:
-        (WebCore::isSVG10Feature): Ditto
-        (WebCore::isSVG11Feature): Ditto
-        (WebCore::DOMImplementation::isXMLMIMEType): Ditto
-        * dom/Document.cpp:
-        (WebCore::Document::hasPrefixNamespaceMismatch): Ditto
-        * dom/ScriptElement.cpp:
-        (WebCore::isSupportedJavaScriptLanguage): Ditto
-        * editing/ApplyStyleCommand.cpp:
-        (WebCore::styleSpanClassString): Ditto
-        * editing/HTMLInterchange.cpp:
-        (WebCore::): Ditto
-        * editing/IndentOutdentCommand.cpp:
-        (WebCore::indentBlockquoteString): Ditto
-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::isInterchangeNewlineNode): Ditto
-        (WebCore::isInterchangeConvertedSpaceSpan): Ditto
-        * editing/htmlediting.cpp:
-        (WebCore::stringWithRebalancedWhitespace): Ditto
-        (WebCore::nonBreakingSpaceString): Ditto
-        * editing/markup.cpp:
-        (WebCore::appendAttributeValue): Ditto
-        (WebCore::appendEscapedContent): Ditto
-        (WebCore::shouldAddNamespaceAttr): Ditto
-        (WebCore::appendNamespace): Ditto
-        (WebCore::appendStartMarkup): Ditto
-        (WebCore::createMarkup): Ditto
-        * html/HTMLButtonElement.cpp:
-        (WebCore::HTMLButtonElement::type): Ditto
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::isRecognizedTagName): Ditto
-        (WebCore::inlineTagList): Ditto
-        (WebCore::blockTagList): Ditto
-        * html/HTMLFieldSetElement.cpp:
-        (WebCore::HTMLFieldSetElement::type): Ditto
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::type): Ditto
-        * html/HTMLKeygenElement.cpp:
-        (WebCore::HTMLKeygenElement::type): Ditto
-        * html/HTMLLegendElement.cpp:
-        (WebCore::HTMLLegendElement::type): Ditto
-        * html/HTMLOptGroupElement.cpp:
-        (WebCore::HTMLOptGroupElement::type): Ditto
-        * html/HTMLOptionElement.cpp:
-        (WebCore::HTMLOptionElement::type): Ditto
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::getNode): Ditto
-        (WebCore::HTMLParser::isHeaderTag): Ditto
-        (WebCore::HTMLParser::isResidualStyleTag): Ditto
-        (WebCore::HTMLParser::isAffectedByResidualStyle): Ditto
-        * html/HTMLSelectElement.cpp:
-        (WebCore::HTMLSelectElement::type): Ditto
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::type): Ditto
-        * inspector/InspectorController.cpp:
-        (WebCore::platform): Ditto
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::shared): Ditto
-        * inspector/JavaScriptProfile.cpp:
-        (WebCore::profileCache): Ditto
-        * inspector/JavaScriptProfileNode.cpp:
-        (WebCore::profileNodeCache): Ditto
-        * loader/FrameLoader.cpp:
-        (WebCore::localSchemes): Ditto
-        * loader/appcache/ApplicationCacheStorage.cpp:
-        (WebCore::cacheStorage): Ditto
-        * loader/archive/ArchiveFactory.cpp:
-        (WebCore::archiveMIMETypes): Ditto
-        * loader/icon/IconDatabase.cpp:
-        (WebCore::IconDatabase::defaultDatabaseFilename): Ditto
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::dragState): Ditto
-        * page/Frame.cpp:
-        (WebCore::createRegExpForLabels): Ditto
-        (WebCore::keepAliveSet): Ditto
-        * page/Page.cpp:
-        (WebCore::Page::groupName): Ditto
-        * page/SecurityOrigin.cpp:
-        (WebCore::isDefaultPortForProtocol): Ditto
-        (WebCore::SecurityOrigin::databaseIdentifier): Ditto
-        * page/mac/FrameMac.mm:
-        (WebCore::regExpForLabels): Ditto
-        * platform/KURL.cpp:
-        (WebCore::blankURL): Ditto
-        * platform/graphics/FontCache.cpp:
-        (WebCore::alternateFamilyName): Ditto
-        * platform/graphics/mac/FontCacheMac.mm:
-        (WebCore::FontCache::getSimilarFontPlatformData): Ditto
-        (WebCore::FontCache::getLastResortFallbackFont): Ditto
-        * platform/mac/ScrollbarThemeMac.mm:
-        (WebCore::ScrollbarTheme::nativeTheme): Ditto
-        * platform/mac/ThemeMac.mm:
-        (WebCore::platformTheme): Ditto
-        * platform/mac/ThreadCheck.mm:
-        (WebCoreReportThreadViolation): Ditto
-        * platform/network/NetworkStateNotifier.cpp:
-        (WebCore::networkStateNotifier): Ditto
-        * platform/network/mac/FormDataStreamMac.mm:
-        (WebCore::getStreamFormDataMap): Ditto
-        (WebCore::getStreamResourceHandleMap): Ditto
-        * platform/network/mac/ResourceResponseMac.mm:
-        (WebCore::ResourceResponse::platformLazyInit): Ditto
-        * platform/text/TextEncoding.cpp:
-        (WebCore::TextEncoding::isJapanese): Ditto
-        * rendering/RenderBlock.cpp:
-        (WebCore::continuationOutlineTable): Ditto
-        * rendering/RenderCounter.cpp:
-        (WebCore::counterMaps): Ditto
-        * rendering/RenderFlexibleBox.cpp:
-        (WebCore::RenderFlexibleBox::layoutVerticalBox): Ditto
-        * rendering/RenderListItem.cpp:
-        (WebCore::RenderListItem::markerText): Ditto
-        * rendering/RenderScrollbarTheme.cpp:
-        (WebCore::RenderScrollbarTheme::renderScrollbarTheme): Ditto
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::systemFont): Ditto
-        * rendering/bidi.cpp:
-        (WebCore::RenderBlock::checkLinesForTextOverflow): Ditto
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::initialDashboardRegions): Ditto
-        (WebCore::RenderStyle::noneDashboardRegions): Ditto
-        * storage/LocalStorage.cpp:
-        (WebCore::localStorageMap): Ditto
-        * svg/SVGAnimateMotionElement.cpp:
-        (WebCore::SVGAnimateMotionElement::rotateMode): Ditto
-        * svg/SVGAnimationElement.cpp:
-        (WebCore::SVGAnimationElement::calcMode): Ditto
-        (WebCore::SVGAnimationElement::attributeType): Ditto
-        (WebCore::SVGAnimationElement::isAdditive): Ditto
-        (WebCore::SVGAnimationElement::isAccumulated): Ditto
-        * svg/SVGLangSpace.cpp:
-        (WebCore::SVGLangSpace::xmlspace): Ditto
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::contentScriptType): Ditto
-        (WebCore::SVGSVGElement::contentStyleType): Ditto
-        * svg/SVGStyleElement.cpp:
-        (WebCore::SVGStyleElement::type): Ditto
-        (WebCore::SVGStyleElement::media): Ditto
-        * svg/SVGTextContentElement.cpp:
-        (WebCore::SVGTextContentElement::parseMappedAttribute): Ditto
-        * svg/animation/SVGSMILElement.cpp:
-        (WebCore::SVGSMILElement::parseClockValue): Ditto
-        (WebCore::SVGSMILElement::restart): Ditto
-        (WebCore::SVGSMILElement::fill): Ditto
-        (WebCore::SVGSMILElement::repeatCount): Ditto
-        (WebCore::SVGSMILElement::notifyDependentsIntervalChanged): Ditto
-        * svg/graphics/SVGResource.cpp:
-        (WebCore::clientMap): Ditto
-        * svg/graphics/SVGResourceMarker.cpp:
-        (WebCore::SVGResourceMarker::draw): Ditto
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::preflightResultCache): Ditto
-        (WebCore::isSafeRequestHeader): Ditto
-        (WebCore::isOnAccessControlResponseHeaderWhitelist): Ditto
-        * xml/XPathExpressionNode.cpp:
-        (WebCore::XPath::Expression::evaluationContext): Ditto
-        * xml/XPathParser.cpp:
-        (WebCore::XPath::isAxisName): Ditto
-        (WebCore::XPath::isNodeTypeName): Ditto
-        * xml/XPathValue.cpp:
-        (WebCore::XPath::Value::toNodeSet): Ditto
-
-2008-11-06  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Rubber-stamped by Simon Hausmann.
+        Fix Qt build with Phonon.
 
-        Remove a bunch of unused methods in the Qt media element implementation
+        The #include <phonon> header no longer exists. And the <Phonon> or
+        <Phonon/Phonon> headers have never existed (neither for us nor for the
+        Phonon sources). You have to select each and every header that you do
+        want now.
 
         * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
-
-2008-11-05  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        https://bugs.webkit.org/show_bug.cgi?id=21870
-        
-        Implement absoluteToLocal() to convert a point from absolute
-        to local coordinates, optionally taking transforms into account.
-        
-        Use this to set offsetX/offsetY in mouse events, thus fixing
-        offsetX/offsetY in events on elements with transforms.
-
-        Test: fast/events/offsetX-offsetY.html
-
-        * dom/MouseRelatedEvent.cpp:
-        (WebCore::MouseRelatedEvent::receivedTarget):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::localToAbsolute):
-        (WebCore::RenderBox::absoluteToLocal):
-        (WebCore::RenderBox::offsetFromContainer):
-        * rendering/RenderBox.h:
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::absoluteToLocal):
-        * rendering/RenderObject.h:
-        * rendering/RenderTableCell.cpp:
-        (WebCore::RenderTableCell::localToAbsolute):
-        (WebCore::RenderTableCell::absoluteToLocal):
-        * rendering/RenderTableCell.h:
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::absoluteToLocal):
-        * rendering/RenderView.h:
-
-2008-11-06  Alp Toker  <alp@nuanti.com>
-
-        Reviewed by Cameron Zwarich.
 
-        https://bugs.webkit.org/show_bug.cgi?id=22067
-        [GTK] Sun Java plugin segfaults at PluginPackage::createPackage()
-
-        null-check symbols loaded from plugin modules, initialize the function
-        table (like Win already does) and update it with the latest
-        additions. Adjust whitespace for easy diff'ing with the Win port code
-        from which it was forked.
-
-        This fixes crashes with libnspr4.so and any other plugins that don't
-        provide the symbols we expect.
-
-        * plugins/gtk/PluginPackageGtk.cpp:
-        (WebCore::PluginPackage::fetchInfo):
-        (WebCore::PluginPackage::load):
-
-2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Removed dead (and broken) code from an ancient Symbian port.
-
-        * config.h:
-        * platform/text/AtomicString.h:
-        * platform/text/PlatformString.h:
-
-2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
+2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        Use QLibrary as PlatformModule when compiling with Qt for S60.
-
-        * platform/FileSystem.h:
-
-2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Compile fix for Symbian.
-        The snprintf function is defined in stdio.h, the inclusion
-        of snprintf.h inside this PLATFORM(SYMBIAN) block does not
-        compile.
-
-        * config.h:
-
-2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
-
-        Reviewed by Simon Hausmann.
-
-        Disable webkit plugins for Symbian.
-
-        * WebCore.pro:
-
-2008-11-06  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Fix build break in debug mode when XSLT is not enabled
-
-        * loader/Cache.cpp:
-        (WebCore::Cache::dumpStats):
-
-2008-11-06  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon Hausmann.
-
-        Repaint video on UpdateRequest to prevent recursive painting
-
-        Calling QWidget::render() to update the video generates a paint
-        event that's then picked up by the event filter once more :(
-
-        We're really only interested in updates from Phonon, which we
-        get through the UpdateRequest for each new frame.
-
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::eventFilter):
-
-2008-11-06  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Fix the WebCore build for some platforms by changing build scripts to
-        account for the recent move of the create_hash_table script from the kjs
-        subdirectory of JavaScriptCore to the root directory.
-
-        * WebCore.pro:
-        * make-generated-sources.sh:
-
-2008-11-06  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Fix a case-sensitivity issue in Mac forwarding headers. Strangely
-        enough, this does not always cause the build to break, even with a
-        case-sensitive filesystem.
-
-        * ForwardingHeaders/runtime/Interpreter.h:
-
-2008-11-05  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22083
-        MessageEvents cannot be used across threads
-
-        * dom/Event.idl:
-        * dom/MessageEvent.idl:
-        Add a NoStaticTables attribute - MessageEvent is used in worker threads, so static tables
-        won't work.
-
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::EventData::EventData):
-        (WebCore::MessagePort::EventData::~EventData):
-        (WebCore::MessagePort::clone):
-        (WebCore::MessagePort::postMessage):
-        (WebCore::MessagePort::startConversation):
-        (WebCore::MessagePort::dispatchMessages):
-        * dom/MessagePort.h:
-        Don't create a MessageEvent until dispatch time - messages can be posted across threads,
-        but MessageEvents are tied to the thread that they were created in.
-
-2008-11-05  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22066
-        Implement Worker global object
-
-        * DerivedSources.make: Added WorkerLocation IDL and JSWorkerContext lookup table.
-
-        * WebCore.xcodeproj/project.pbxproj: Only adding files to Mac project for now, as Worker
-        support is still disabled by default.
-
-        * bindings/js/JSDOMGlobalObject.cpp: (WebCore::toJSDOMGlobalObject): Implemented Worker case.
-
-        * bindings/js/JSMessageChannelConstructor.cpp:
-        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor): Ditto.
-
-        * bindings/js/JSWorkerContext.cpp: Added.
-        * bindings/js/JSWorkerContext.h: Added.
-        * bindings/js/WorkerScriptController.cpp: Added.
-        * bindings/js/WorkerScriptController.h: Added.
-        * dom/WorkerContext.cpp: Added.
-        * dom/WorkerContext.h: Added.
-        Added an implementation of worker contexts.
-
-        * dom/DedicatedWorker.cpp:
-        (WebCore::DedicatedWorker::startLoad): Fixed a lifetime bug I saw on my tests.
-        (WebCore::DedicatedWorker::notifyFinished): Create a thread. Currently, object ownership
-        and lifetime is not clear at all.
-
-        * dom/WorkerLocation.cpp: Added.
-        * dom/WorkerLocation.h: Added.
-        * dom/WorkerLocation.idl: Added.
-        Added WorkerLocation, which is one of the objects available to workers.
-
-        * dom/WorkerThread.cpp: Added.
-        (WebCore::WorkerThread::WorkerThread):
-        (WebCore::WorkerThread::start):
-        (WebCore::WorkerThread::workerThreadStart):
-        (WebCore::WorkerThread::workerThread):
-        * dom/WorkerThread.h: Added.
-        (WebCore::WorkerThread::create):
-        Run some code in a worker thread (no message loop yet).
-
-2008-11-05  Antti Koivisto  <antti@apple.com>
+        Remove duplicated code in Qt & GTK logging initialization
 
-        Reviewed by Dan Bernstein.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=22093
-        Don't keep decoded stylesheet data in cache
-        
-        <rdar://problem/6343588>
-
-        Don't keep decoded stylesheet string around in the cache. There are no sharing benefits and
-        performance benefits are negligible (no measured PLT impact). Reduces memory consumption of
-        style sheet data in cache by 2/3 in common case.  
-
-        * loader/CachedCSSStyleSheet.cpp:
-        (WebCore::CachedCSSStyleSheet::sheetText):
-        (WebCore::CachedCSSStyleSheet::data):
-        * loader/CachedCSSStyleSheet.h:
-
-2008-11-05  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 21596: WebCore::Cache should use parsed Pragma and Cache-Control headers
-
-        <https://bugs.webkit.org/show_bug.cgi?id=21596>
-
-        Reviewed by Antti.
-
-        This patch adds real parsing for Pragma and Cache-Control headers
-        based on RFC 2616, Sections 2, 14.9 and 14.32.  It also adds some
-        new String and StringImpl methods to assist with the parsing.
-
-        * loader/Cache.cpp:
-        (WebCore::Cache::dumpStats): Added.  Convenience method for dumping
-        stats outside of Safari.
-        * loader/Cache.h: Declared dumpStats().
-
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::mustRevalidate): Updated to use
-        ResourceResponseBase::cacheControlDirectives() instead of substring
-        matching of the entire Cache-Control header.
-
-        * loader/loader.cpp:
-        (WebCore::Loader::Host::didReceiveResponse): Used the local
-        'resource' variable instead of 'request->cachedResource()'.
-
-        * platform/network/ResourceResponseBase.cpp:
-        (WebCore::ResourceResponseBase::setHTTPHeaderField): Set
-        m_haveParsedCacheControlHeader to false when a "Cache-Control"
-        header is set.  Ditto for m_haveParsedPragmaHeader and "Pragma".
-        (WebCore::ResourceResponseBase::parsePragmaDirectives): Added.
-        Provides parsed Pragma header directives.
-        (WebCore::ResourceResponseBase::parseCacheControlDirectives): Added.
-        Provides parsed Cache-Control header directives.
-        (WebCore::isCacheHeaderSeparator): Added.  Returns true if a
-        character is a separator character per RFC 2616, Section 2.2, else
-        returns false.
-        (WebCore::isControlCharacter): Added.  Returns true if a character
-        is a control character per RFC 2616 Section 2.2, else returns false.
-        (WebCore::trimToNextSeparator): Added.  Returns a string truncated
-        at the first separator character per isCacheHeaderSeparator().
-        (WebCore::parseCacheHeader): Added.  This is the main parsing
-        routine for both Cache-Control and Pragma headers.
-        (WebCore::parseCacheControlDirectiveValues): Added.  This splits
-        certain Cache-Control directive values into a vector of strings.
-        * platform/network/ResourceResponseBase.h:
-        (WebCore::CacheControlDirectiveMap): Added.  Typedef for a parsed
-        Cache-Control header.
-        (WebCore::PragmaDirectiveMap): Added.  Typedef for a parsed Pragma
-        header.
-        (WebCore::ResourceResponseBase::parsePragmaDirectives): Added
-        declaration.
-        (WebCore::ResourceResponseBase::parseCacheControlDirectives): Ditto.
-        (WebCore::ResourceResponseBase::m_haveParsedCacheControlHeader):
-        Added.  Boolean to describe when the "Cache-Control" header needs to
-        be reparsed.
-        (WebCore::ResourceResponseBase::m_haveParsedPragmaHeader):  Added.
-        Boolean to describe when the "Pragma" header needs to be reparsed.
-        (WebCore::ResourceResponseBase::m_cacheControlDirectiveMap): Added.
-        Cached map to hold parsed "Cache-Control" headers.
-        (WebCore::ResourceResponseBase::m_pragmaDirectiveMap): Added.
-        Cached map to hold parsed "Pragma" headers.
-
-        * platform/text/PlatformString.h:
-        (WebCore::String::find): Added.  Returns the first match based on
-        the character-matching function pointer passed in.
-        (WebCore::String::removeCharacters): Added declaration.
-        (WebCore::find): Added.  Inline method that takes a character-
-        matching function pointer.  Called by StringImpl::find().
-        * platform/text/String.cpp:
-        (WebCore::String::removeCharacters): Added.  Calls
-        StringImpl::removeCharacters().
-        * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::removeCharacters): Added.  Returns a string
-        with all characters removed that match the character-matching
-        function pointer passed in.  If there is no change to the string, it
-        returns itself.  Based heavily on StringImpl::simplifyWhitespace().
-        (WebCore::StringImpl::find): Added.  Calls WebCore::find().
-        * platform/text/StringImpl.h:
-        (WebCore::FindMatchFunctionPtr): Added.  Typedef for a character-
-        matching function pointer.
-        (WebCore::StringImpl::removeCharacters): Added declaration.
-        (WebCore::StringImpl::find): Ditto.
-
-2008-11-05  Justin Garcia  <justin.garcia@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        <rdar://problem/5480736> In Mail and Gmail, copied indented text pastes with line break
-        
-        As a rule, we don't allow merges out of blockquotes.  In the bug, we are inserting a text node 
-        between two blockquotes.  Because the start merge moves the text node into a blockquote, when we
-        determine whether or not we should do the end merge, it incorrectly appears as though the end merge 
-        is merging out of a blockquote.  The fix is to determine whether or not we should do the end merge
-        before we do the start merge, so that the start merge doesn't effect our decision.
-
-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::ReplaceSelectionCommand::ReplaceSelectionCommand): Initialize the new boolean.
-        (WebCore::ReplaceSelectionCommand::mergeEndIfNeeded): Moved code from doApply() here for clarity.
-        (WebCore::ReplaceSelectionCommand::doApply): Set m_shouldMergeEnd before we do the start merge.
-        * editing/ReplaceSelectionCommand.h: Added m_shouldMergeEnd.
-
-2008-11-05  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Speculatively fix the Windows build, even though these changes may not
-        actually matter for anything in the build, because the Windows bots are
-        behind.
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2008-11-05  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Fix the Qt build.
-
-        * bridge/qt/qt_class.cpp:
-        * bridge/qt/qt_runtime.h:
-
-2008-11-05  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        Move more files to the runtime subdirectory of JavaScriptCore.
-
-        * ForwardingHeaders/kjs/collector.h: Removed.
-        * ForwardingHeaders/kjs/completion.h: Removed.
-        * ForwardingHeaders/kjs/identifier.h: Removed.
-        * ForwardingHeaders/kjs/interpreter.h: Removed.
-        * ForwardingHeaders/kjs/lookup.h: Removed.
-        * ForwardingHeaders/kjs/operations.h: Removed.
-        * ForwardingHeaders/kjs/protect.h: Removed.
-        * ForwardingHeaders/kjs/ustring.h: Removed.
-        * ForwardingHeaders/runtime/Collector.h: Copied from ForwardingHeaders/kjs/collector.h.
-        * ForwardingHeaders/runtime/Completion.h: Copied from ForwardingHeaders/kjs/completion.h.
-        * ForwardingHeaders/runtime/Identifier.h: Copied from ForwardingHeaders/kjs/identifier.h.
-        * ForwardingHeaders/runtime/Interpreter.h: Copied from ForwardingHeaders/kjs/interpreter.h.
-        * ForwardingHeaders/runtime/Lookup.h: Copied from ForwardingHeaders/kjs/lookup.h.
-        * ForwardingHeaders/runtime/Operations.h: Copied from ForwardingHeaders/kjs/operations.h.
-        * ForwardingHeaders/runtime/Protect.h: Copied from ForwardingHeaders/kjs/protect.h.
-        * ForwardingHeaders/runtime/UString.h: Copied from ForwardingHeaders/kjs/ustring.h.
-        * bindings/js/GCController.cpp:
-        * bindings/js/JSCustomPositionCallback.h:
-        * bindings/js/JSCustomPositionErrorCallback.h:
-        * bindings/js/JSCustomSQLStatementCallback.h:
-        * bindings/js/JSCustomSQLStatementErrorCallback.h:
-        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
-        * bindings/js/JSCustomVoidCallback.h:
-        * bindings/js/JSDOMBinding.h:
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSEventListener.h:
-        * bindings/js/ScheduledAction.h:
-        * bindings/js/ScriptController.cpp:
-        * bindings/js/ScriptController.h:
-        * bindings/objc/WebScriptObject.mm:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/NP_jsobject.cpp:
-        * bridge/c/c_class.cpp:
-        * bridge/jni/jni_class.cpp:
-        * bridge/jni/jni_jsobject.mm:
-        * bridge/npruntime.cpp:
-        * bridge/runtime_root.h:
-        * history/CachedPage.h:
-        * html/CanvasRenderingContext2D.cpp:
-        * html/HTMLCanvasElement.cpp:
-        * inspector/InspectorController.cpp:
-        * inspector/JavaScriptCallFrame.cpp:
-        * page/Console.cpp:
-        * page/Page.cpp:
-        * platform/text/AtomicString.cpp:
-        * platform/text/PlatformString.h:
-
-2008-11-05  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Anders Carlsson.
-
-        Fix https://bugs.webkit.org/show_bug.cgi?id=22085
-        The Plugin JS object should expose item() and namedItem() methods to match Firefox
+        We now share the getChannelFromName() function in Logging.cpp
 
-        * bindings/js/JSPluginCustom.cpp:
-        (WebCore::JSPlugin::nameGetter):
-        * plugins/Plugin.cpp:
-        (WebCore::Plugin::namedItem):
-        * plugins/Plugin.h:
-        * plugins/Plugin.idl:
-
-2008-11-05  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21060
-        Range#surroundContents incorrectly throws BAD_BOUNDARYPOINTS_ERR
-
-        Test: fast/dom/Range/surroundContents-check-boundary-points.html
-
-        * dom/Range.cpp: (WebCore::Range::surroundContents): Fix BAD_BOUNDARYPOINTS_ERR checks.
-
-2008-11-05  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Remove two global destructors from CoreTextController.
-        
-        * platform/graphics/mac/CoreTextController.cpp:
-        (WebCore::CoreTextController::collectCoreTextRunsForCharacters):
-
-2008-11-05  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        CRASH at Scrollbar::invalidateRect due to null m_client
-        https://bugs.webkit.org/show_bug.cgi?id=22080
-
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::isWindowActive):
-        (WebCore::Scrollbar::invalidateRect):
+        * platform/gtk/LoggingGtk.cpp:
+        * platform/qt/LoggingQt.cpp:
 
-2008-11-04  Sam Weinig  <sam@webkit.org>
+2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        Fix https://bugs.webkit.org/show_bug.cgi?id=21648
-        navigator.mimeTypes and navigator.plugins don't expose item and namedItem to JS
-
-        - Also adds constructors for Plugin, PluginArray, MimeType and MimeTypeArray.
-
-        * bindings/js/JSMimeTypeArrayCustom.cpp:
-        (WebCore::JSMimeTypeArray::nameGetter):
-        * bindings/js/JSPluginArrayCustom.cpp:
-        (WebCore::JSPluginArray::nameGetter):
-        * page/DOMWindow.idl:
-        * plugins/MimeType.idl:
-        * plugins/MimeTypeArray.cpp:
-        (WebCore::MimeTypeArray::namedItem):
-        * plugins/MimeTypeArray.h:
-        * plugins/MimeTypeArray.idl:
-        * plugins/Plugin.idl:
-        * plugins/PluginArray.cpp:
-        (WebCore::PluginArray::namedItem):
-        * plugins/PluginArray.h:
-        * plugins/PluginArray.idl:
-
-2008-11-05  Steve Falkenburg  <sfalken@apple.com>
-
-        Build fix.
-
-        * plugins/PluginPackage.cpp:
-
-2008-11-05  Jeff Cook  <cookiecaper@gmail.com>
-
-        Reviewed by Simon Hausmann and Tor Arne.
-
-        Fix crash in the Qt port when unloading swfdec and Flash 10
-        by reordering window destruction and plugin stop.
-
-        See https://bugs.webkit.org/show_bug.cgi?id=20779
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::stop):
-
-2008-11-05  Simon Hausmann  <hausmann@webkit.org>
-
-        Reviewed by Tor Arne Vestbø
-
-        Fix loading of Flash 10 in the Qt port by faking the toolkit to be Gtk.
-
-        Otherwise Flash refuses to load and function :(
-
-        * plugins/PluginPackage.cpp:
-        (WebCore::PluginPackage::determineQuirks):
-        * plugins/PluginQuirkSet.h:
-        (WebCore::):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::getValue):
-
-2008-11-05  Simon Hausmann  <hausmann@webkit.org>
-
-        Reviewed by Tor Arne Vestbø
+        Rename the plugin logging channel to plural form 'Plugins'
 
-        Unify determineQuirks between the Qt and the Gtk PluginPackage.
-        Share the code for parsing the module version from the description.
-        This is currently used to determine Flash based quirks.
+        This matches both the other logging channel names, as well as the
+        WebKit logging channel used by Safari/Mac for plugins.
 
-        * plugins/PluginPackage.cpp:
-        (WebCore::PluginPackage::createPackage):
-        (WebCore::PluginPackage::determineQuirks):
-        (WebCore::PluginPackage::determineModuleVersionFromDescription):
-        * plugins/PluginPackage.h:
+        * platform/Logging.cpp:
+        * platform/Logging.h:
+        * platform/gtk/LoggingGtk.cpp:
+        * platform/mac/LoggingMac.mm:
+        * platform/qt/LoggingQt.cpp:
+        * platform/win/LoggingWin.cpp:
+        * plugins/PluginDebug.h:
         * plugins/gtk/PluginPackageGtk.cpp:
-        (WebCore::PluginPackage::fetchInfo):
+        * plugins/mac/PluginPackageMac.cpp:
+        * plugins/mac/PluginViewMac.cpp:
         * plugins/qt/PluginPackageQt.cpp:
-        (WebCore::PluginPackage::fetchInfo):
-
-2008-11-04  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        Move kjs/dtoa.h to the wtf subdirectory of JavaScriptCore.
-
-        * ForwardingHeaders/kjs/dtoa.h: Removed.
-        * ForwardingHeaders/wtf/dtoa.h: Copied from ForwardingHeaders/kjs/dtoa.h.
-        * css/CSSParser.cpp:
-        * platform/text/String.cpp:
-        * platform/text/StringImpl.cpp:
 
-2008-11-04  Jonathan Haas  <myrdred@gmail.com>
-
-        Addiitonal tweaks and patch prep by Pamela Greene <pam@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Fixed an issue which could cause memory corruption using ToT libxml.
-        See https://bugs.webkit.org/show_bug.cgi?id=15715
-
-        Test: fast/xsl/xslt-nested-stylesheets.xml
-
-        * xml/XSLImportRule.cpp:
-        (WebCore::XSLImportRule::setXSLStyleSheet): Set parent rather than owner document
-        * xml/XSLStyleSheet.cpp:
-        (WebCore::XSLStyleSheet::XSLStyleSheet): Initialize m_parentStyleSheet
-        (WebCore::XSLStyleSheet::parseString): Make all child stylesheets use parent's dictionary
-        (WebCore::XSLStyleSheet::setParentStyleSheet): Added
-        * xml/XSLStyleSheet.h: Added m_parentStyleSheet member
-
-2008-11-04  Simon Fraser  <simon.fraser@apple.com>
-
-        No review.
-
-        Improved buid fix: include MathExtras.h to get roundf on all platforms.
-
-        * platform/graphics/FloatPoint.h:
-
-2008-11-04  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by John Sullivan
-
-        Add a simple "visited" method to HistoryItem for use by global history
-
-        * WebCore.base.exp:
-
-        * history/HistoryItem.cpp:
-        (WebCore::HistoryItem::visited):  Update the title on the item, set last visited time,
-          and bump the visit count.  All things that should happen when a url is visited again!
-        * history/HistoryItem.h:
-
-2008-11-04  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Build fix. Not reviewed.
-
-        * platform/graphics/FloatPoint.h: include math.h.
-        reported by zdobersek in #webkit.
-
-2008-11-04  Darin Fisher  <darin@chromium.org>
- 
-        Reviewed by Anders Carlsson.
- 
-        No need to clobber all ResourceRequest fields in FrameLoader::reload()
-        https://bugs.webkit.org/show_bug.cgi?id=21949
- 
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::reload):
-
-2008-11-04  Darin Adler  <darin@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        * storage/Database.cpp:
-        (WebCore::databaseVersionKey): Tweaked formatting.
-
-2008-11-03  Darin Adler  <darin@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=22061
-          create script to check for exit-time destructors
-
-        * WebCore.xcodeproj/project.pbxproj: Added a script
-        phase that runs the check-for-exit-time-destructors script.
-
-        * html/HTMLAttributeNames.in: Removed some unused attribute names.
-
-        * html/HTMLEmbedElement.cpp:
-        (WebCore::HTMLEmbedElement::parseMappedAttribute): Removed code that
-        sets the write-only m_pluginPage.
-        * html/HTMLEmbedElement.h: Ditto.
-
-        * platform/mac/CursorMac.mm:
-        (WebCore::leakNamedCursor): Changed to return a Cursor&.
-        (WebCore::pointerCursor): Changed to leak an object to avoid an
-        exit-time destructor.
-        (WebCore::crossCursor): Ditto.
-        (WebCore::handCursor): Ditto.
-        (WebCore::moveCursor): Ditto.
-        (WebCore::verticalTextCursor): Ditto.
-        (WebCore::cellCursor): Ditto.
-        (WebCore::contextMenuCursor): Ditto.
-        (WebCore::aliasCursor): Ditto.
-        (WebCore::zoomInCursor): Ditto.
-        (WebCore::zoomOutCursor): Ditto.
-        (WebCore::copyCursor): Ditto.
-        (WebCore::noneCursor): Ditto.
-        (WebCore::progressCursor): Ditto.
-        (WebCore::noDropCursor): Ditto.
-        (WebCore::notAllowedCursor): Ditto.
-        (WebCore::iBeamCursor): Ditto.
-        (WebCore::waitCursor): Ditto.
-        (WebCore::helpCursor): Ditto.
-        (WebCore::eastResizeCursor): Ditto.
-        (WebCore::northResizeCursor): Ditto.
-        (WebCore::northEastResizeCursor): Ditto.
-        (WebCore::northWestResizeCursor): Ditto.
-        (WebCore::southResizeCursor): Ditto.
-        (WebCore::southEastResizeCursor): Ditto.
-        (WebCore::southWestResizeCursor): Ditto.
-        (WebCore::westResizeCursor): Ditto.
-        (WebCore::northSouthResizeCursor): Ditto.
-        (WebCore::eastWestResizeCursor): Ditto.
-        (WebCore::northEastSouthWestResizeCursor): Ditto.
-        (WebCore::northWestSouthEastResizeCursor): Ditto.
-        (WebCore::columnResizeCursor): Ditto.
-        (WebCore::rowResizeCursor): Ditto.
-        (WebCore::grabCursor): Ditto.
-        (WebCore::grabbingCursor): Ditto.
-
-        * storage/Database.cpp:
-        (WebCore::guidMutex): Changed to leak an object to avoid an
-        exit-time destructor. Also added a comment explaining why it's
-        thread safe.
-        (WebCore::guidToVersionMap): Ditto.
-        (WebCore::guidToDatabaseMap): Ditto.
-        (WebCore::Database::databaseInfoTableName): Ditto.
-        (WebCore::databaseVersionKey): Ditto.
-        (WebCore::Database::getVersionFromDatabase): Ditto.
-        (WebCore::Database::setVersionInDatabase): Ditto.
-        (WebCore::guidForOriginAndName): Ditto.
-        * storage/DatabaseTracker.cpp:
-        (WebCore::DatabaseTracker::tracker): Ditto.
-        (WebCore::notificationMutex): Ditto.
-        (WebCore::notificationQueue): Ditto.
-        (WebCore::DatabaseTracker::notifyDatabasesChanged): Ditto.
-
-2008-11-04  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        https://bugs.webkit.org/show_bug.cgi?id=21941
-
-        Rename absolutePosition() to localToAbsolute(), and add the ability
-        to optionally take transforms into account (which will eventually be the
-        default behavior).
-
-        * WebCore.base.exp:
-        * WebCore.xcodeproj/project.pbxproj:
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::getUpperLeftCorner):
-        (WebCore::ContainerNode::getLowerRightCorner):
-        (WebCore::ContainerNode::getRect):
-        * dom/ContainerNode.h:
-        * dom/MouseRelatedEvent.cpp:
-        (WebCore::MouseRelatedEvent::receivedTarget):
-        * dom/Node.cpp:
-        (WebCore::Node::getRect):
-        * editing/SelectionController.cpp:
-        (WebCore::SelectionController::layout):
-        (WebCore::SelectionController::caretRect):
-        * editing/visible_units.cpp:
-        (WebCore::previousLinePosition):
-        (WebCore::nextLinePosition):
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
-        (WebCore::HTMLAnchorElement::defaultEventHandler):
-        * html/HTMLAreaElement.cpp:
-        (WebCore::HTMLAreaElement::getRect):
-        * html/HTMLImageElement.cpp:
-        (WebCore::HTMLImageElement::x):
-        (WebCore::HTMLImageElement::y):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::defaultEventHandler):
-        * html/HTMLInputElement.h:
-        * page/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::boundingBoxRect):
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleDrag):
-        * platform/graphics/FloatPoint.h:
-        (WebCore::roundedIntPoint):
-        * platform/graphics/IntSize.h:
-        (WebCore::IntSize::expand):
-        * rendering/LayoutState.cpp:
-        (WebCore::LayoutState::LayoutState):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::layoutBlock):
-        (WebCore::RenderBlock::paintObject):
-        (WebCore::RenderBlock::selectionGapRects):
-        (WebCore::RenderBlock::fillBlockSelectionGaps):
-        (WebCore::RenderBlock::nodeAtPoint):
-        (WebCore::RenderBlock::positionForCoordinates):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::localToAbsolute):
-        (WebCore::RenderBox::computeAbsoluteRepaintRect):
-        (WebCore::RenderBox::caretRect):
-        * rendering/RenderBox.h:
-        (WebCore::RenderBox::relativePositionOffset):
-        * rendering/RenderContainer.cpp:
-        (WebCore::RenderContainer::addLineBoxRects):
-        * rendering/RenderFlow.cpp:
-        (WebCore::RenderFlow::absoluteClippedOverflowRect):
-        (WebCore::RenderFlow::caretRect):
-        (WebCore::RenderFlow::addFocusRingRects):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateLayerPosition):
-        (WebCore::RenderLayer::convertToLayerCoords):
-        (WebCore::RenderLayer::addScrolledContentOffset):
-        (WebCore::RenderLayer::subtractScrolledContentOffset):
-        (WebCore::RenderLayer::scrollRectToVisible):
-        * rendering/RenderLayer.h:
-        (WebCore::RenderLayer::scrolledContentOffset):
-        (WebCore::RenderLayer::relativePositionOffset):
-        * rendering/RenderListBox.cpp:
-        (WebCore::RenderListBox::panScroll):
-        (WebCore::RenderListBox::scrollToward):
-        * rendering/RenderListMarker.cpp:
-        (WebCore::RenderListMarker::selectionRect):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::absoluteBoundingBoxRect):
-        (WebCore::RenderObject::computeAbsoluteRepaintRect):
-        (WebCore::RenderObject::localToAbsolute):
-        (WebCore::RenderObject::addDashboardRegions):
-        (WebCore::RenderObject::absoluteContentBox):
-        (WebCore::RenderObject::absoluteOutlineBox):
-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::localToAbsoluteForContent):
-        * rendering/RenderPart.cpp:
-        (WebCore::RenderPart::updateWidgetPosition):
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::selectionRect):
-        * rendering/RenderSVGInlineText.cpp:
-        (WebCore::RenderSVGInlineText::computeAbsoluteRectForRange):
-        * rendering/RenderSVGText.cpp:
-        (WebCore::RenderSVGText::absoluteRects):
-        * rendering/RenderTableCell.cpp:
-        (WebCore::RenderTableCell::localToAbsolute):
-        * rendering/RenderTableCell.h:
-        * rendering/RenderText.cpp:
-        (WebCore::RenderText::addLineBoxRects):
-        (WebCore::RenderText::caretRect):
-        (WebCore::RenderText::selectionRect):
-        * rendering/RenderVideo.cpp:
-        (WebCore::RenderVideo::updatePlayer):
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::localToAbsolute):
-        * rendering/RenderView.h:
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::updateWidgetPosition):
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::getScreenCTM):
-
-2008-11-03  Yael Aharon  <yael.aharon@nokia.com>
+2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
         Reviewed by Simon Hausmann.
 
-        Add methods for getting and setting user data on History Item.
-        This change is limited to QT port only. Tests were added in
-        the patch for https://bugs.webkit.org/show_bug.cgi?id=21864.
-
-        Minor change by Simon: made the functions inline and added a missing
-        const.
-
-        * history/HistoryItem.h:
-
-2008-11-01  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22030
-        Make EventNames usable from multiple threads
-
-        * platform/text/AtomicString.cpp:
-        (WebCore::stringTable):
-        (WebCore::AtomicString::add):
-        (WebCore::AtomicString::remove):
-        (WebCore::AtomicString::find):
-        (WebCore::AtomicString::init):
-        * platform/text/AtomicString.h:
-        Atomic string table is now per-thread. Individual strings cannot be shared between threads,
-        so global AtomicString constants cannot be used from threads other than the main one.
-
-        * dom/EventNames.cpp:
-        (WebCore::EventNames::EventNames):
-        (WebCore::eventNames):
-        (WebCore::EventNames::init):
-        * dom/EventNames.h:
-        Made EventNames a ThreadSpecific struct. Individual event names are now accessed as
-        eventNames().fooEvent, not EventNames::fooEvent. This makes EventNames usable from all
-        threads.
-
-        * WebCore.base.exp:
-        * bindings/js/JSDOMWindowBase.cpp:
-        * bindings/js/JSEventListener.cpp:
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::processingUserGesture):
-        * dom/BeforeTextInsertedEvent.cpp:
-        (WebCore::BeforeTextInsertedEvent::BeforeTextInsertedEvent):
-        * dom/BeforeUnloadEvent.cpp:
-        (WebCore::BeforeUnloadEvent::BeforeUnloadEvent):
-        * dom/CharacterData.cpp:
-        (WebCore::CharacterData::dispatchModifiedEvent):
-        * dom/ContainerNode.cpp:
-        (WebCore::dispatchChildInsertionEvents):
-        (WebCore::dispatchChildRemovalEvents):
-        * dom/DedicatedWorker.cpp:
-        (WebCore::DedicatedWorker::dispatchErrorEvent):
-        * dom/Document.cpp:
-        (WebCore::Document::implicitClose):
-        (WebCore::Document::setFocusedNode):
-        (WebCore::Document::addListenerTypeIfNeeded):
-        (WebCore::Document::removeWindowInlineEventListenerForType):
-        (WebCore::Document::addWindowEventListener):
-        (WebCore::Document::removeWindowEventListener):
-        (WebCore::Document::finishedParsing):
-        * dom/EventTargetNode.cpp:
-        (WebCore::EventTargetNode::dispatchGenericEvent):
-        (WebCore::EventTargetNode::dispatchSubtreeModifiedEvent):
-        (WebCore::EventTargetNode::dispatchWindowEvent):
-        (WebCore::EventTargetNode::dispatchUIEvent):
-        (WebCore::EventTargetNode::dispatchSimulatedClick):
-        (WebCore::EventTargetNode::dispatchMouseEvent):
-        (WebCore::EventTargetNode::dispatchFocusEvent):
-        (WebCore::EventTargetNode::dispatchBlurEvent):
-        (WebCore::EventTargetNode::defaultEventHandler):
-        (WebCore::EventTargetNode::on*): (multiple methods)
-        (WebCore::EventTargetNode::setOn*): (multiple methods)
-        * dom/KeyboardEvent.cpp:
-        (WebCore::eventTypeForKeyboardEventType):
-        (WebCore::KeyboardEvent::keyCode):
-        (WebCore::KeyboardEvent::charCode):
-        * dom/MessageEvent.cpp:
-        (WebCore::MessageEvent::MessageEvent):
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::dispatchMessages):
-        (WebCore::MessagePort::dispatchCloseEvent):
-        * dom/MouseEvent.cpp:
-        (WebCore::MouseEvent::isDragEvent):
-        (WebCore::MouseEvent::toElement):
-        (WebCore::MouseEvent::fromElement):
-        * dom/OverflowEvent.cpp:
-        (WebCore::OverflowEvent::OverflowEvent):
-        * dom/TextEvent.cpp:
-        (WebCore::TextEvent::TextEvent):
-        * dom/WebKitAnimationEvent.cpp:
-        (WebCore::WebKitAnimationEvent::WebKitAnimationEvent):
-        (WebCore::WebKitAnimationEvent::~WebKitAnimationEvent):
-        (WebCore::WebKitAnimationEvent::initWebKitAnimationEvent):
-        (WebCore::WebKitAnimationEvent::animationName):
-        (WebCore::WebKitAnimationEvent::elapsedTime):
-        * dom/WebKitTransitionEvent.cpp:
-        (WebCore::WebKitTransitionEvent::WebKitTransitionEvent):
-        (WebCore::WebKitTransitionEvent::~WebKitTransitionEvent):
-        (WebCore::WebKitTransitionEvent::initWebKitTransitionEvent):
-        (WebCore::WebKitTransitionEvent::propertyName):
-        (WebCore::WebKitTransitionEvent::elapsedTime):
-        * dom/WheelEvent.cpp:
-        (WebCore::WheelEvent::WheelEvent):
-        (WebCore::WheelEvent::initWheelEvent):
-        * dom/XMLTokenizerLibxml2.cpp:
-        * dom/XMLTokenizerQt.cpp:
-        * editing/DeleteButton.cpp:
-        (WebCore::DeleteButton::defaultEventHandler):
-        * editing/EditCommand.cpp:
-        * editing/Editor.cpp:
-        (WebCore::Editor::canDHTMLCut):
-        (WebCore::Editor::canDHTMLCopy):
-        (WebCore::Editor::canDHTMLPaste):
-        (WebCore::Editor::tryDHTMLCopy):
-        (WebCore::Editor::tryDHTMLCut):
-        (WebCore::Editor::tryDHTMLPaste):
-        (WebCore::dispatchEditableContentChangedEvents):
-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::ReplacementFragment::ReplacementFragment):
-        * editing/SelectionController.cpp:
-        (WebCore::SelectionController::setFocused):
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::defaultEventHandler):
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::parseMappedAttribute):
-        * html/HTMLButtonElement.cpp:
-        (WebCore::HTMLButtonElement::parseMappedAttribute):
-        (WebCore::HTMLButtonElement::defaultEventHandler):
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::parseMappedAttribute):
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::onChange):
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::handleLocalEvents):
-        (WebCore::HTMLFormElement::prepareSubmit):
-        (WebCore::HTMLFormElement::reset):
-        (WebCore::HTMLFormElement::parseMappedAttribute):
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
-        * html/HTMLFrameSetElement.cpp:
-        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
-        * html/HTMLImageElement.cpp:
-        (WebCore::HTMLImageElement::parseMappedAttribute):
-        * html/HTMLImageLoader.cpp:
-        (WebCore::HTMLImageLoader::dispatchLoadEvent):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::parseMappedAttribute):
-        (WebCore::HTMLInputElement::setValueFromRenderer):
-        (WebCore::HTMLInputElement::preDispatchEventHandler):
-        (WebCore::HTMLInputElement::postDispatchEventHandler):
-        (WebCore::HTMLInputElement::defaultEventHandler):
-        (WebCore::HTMLInputElement::onSearch):
-        * html/HTMLLabelElement.cpp:
-        (WebCore::HTMLLabelElement::defaultEventHandler):
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::load):
-        (WebCore::HTMLMediaElement::mediaPlayerNetworkStateChanged):
-        (WebCore::HTMLMediaElement::setReadyState):
-        (WebCore::HTMLMediaElement::progressEventTimerFired):
-        (WebCore::HTMLMediaElement::seek):
-        (WebCore::HTMLMediaElement::setDefaultPlaybackRate):
-        (WebCore::HTMLMediaElement::setPlaybackRate):
-        (WebCore::HTMLMediaElement::play):
-        (WebCore::HTMLMediaElement::pause):
-        (WebCore::HTMLMediaElement::setVolume):
-        (WebCore::HTMLMediaElement::setMuted):
-        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged):
-        (WebCore::HTMLMediaElement::documentWillBecomeInactive):
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::parseMappedAttribute):
-        * html/HTMLOptionElement.cpp:
-        * html/HTMLScriptElement.cpp:
-        (WebCore::HTMLScriptElement::parseMappedAttribute):
-        (WebCore::HTMLScriptElement::dispatchLoadEvent):
-        (WebCore::HTMLScriptElement::dispatchErrorEvent):
-        * html/HTMLSelectElement.cpp:
-        (WebCore::HTMLSelectElement::parseMappedAttribute):
-        (WebCore::HTMLSelectElement::defaultEventHandler):
-        (WebCore::HTMLSelectElement::menuListDefaultEventHandler):
-        (WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
-        (WebCore::HTMLTextAreaElement::defaultEventHandler):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::notifyFinished):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::stopLoading):
-        (WebCore::FrameLoader::canCachePage):
-        * loader/ImageDocument.cpp:
-        (WebCore::ImageEventListener::handleEvent):
-        * loader/ImageLoader.cpp:
-        * loader/MediaDocument.cpp:
-        (WebCore::MediaDocument::defaultEventHandler):
-        * loader/appcache/DOMApplicationCache.cpp:
-        (WebCore::DOMApplicationCache::callCheckingListener):
-        (WebCore::DOMApplicationCache::callErrorListener):
-        (WebCore::DOMApplicationCache::callNoUpdateListener):
-        (WebCore::DOMApplicationCache::callDownloadingListener):
-        (WebCore::DOMApplicationCache::callProgressListener):
-        (WebCore::DOMApplicationCache::callUpdateReadyListener):
-        (WebCore::DOMApplicationCache::callCachedListener):
-        * page/AccessibilityObject.cpp:
-        * page/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::mouseButtonListener):
-        * page/ContextMenuController.cpp:
-        (WebCore::ContextMenuController::handleContextMenuEvent):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::on*): (multiple methods)
-        (WebCore::DOMWindow::setOn*): (multiple methods)
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMousePressEvent):
-        (WebCore::EventHandler::handleMouseDoubleClickEvent):
-        (WebCore::EventHandler::handleMouseMoveEvent):
-        (WebCore::EventHandler::handleMouseReleaseEvent):
-        (WebCore::EventHandler::updateDragAndDrop):
-        (WebCore::EventHandler::cancelDragAndDrop):
-        (WebCore::EventHandler::performDragAndDrop):
-        (WebCore::EventHandler::updateMouseEventTargetNode):
-        (WebCore::EventHandler::dispatchMouseEvent):
-        (WebCore::EventHandler::sendContextMenuEvent):
-        (WebCore::EventHandler::canMouseDownStartSelect):
-        (WebCore::EventHandler::canMouseDragExtendSelect):
-        (WebCore::EventHandler::defaultKeyboardEventHandler):
-        (WebCore::EventHandler::dragSourceMovedTo):
-        (WebCore::EventHandler::dragSourceEndedAt):
-        (WebCore::EventHandler::handleDrag):
-        (WebCore::EventHandler::handleTextInputEvent):
-        * page/FocusController.cpp:
-        * page/Frame.cpp:
-        (WebCore::Frame::sendResizeEvent):
-        (WebCore::Frame::sendScrollEvent):
-        * page/Page.cpp:
-        (WebCore::networkStateChanged):
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::updateStateMachine):
-        (WebCore::AnimationBase::animationTimerCallbackFired):
-        (WebCore::AnimationBase::primeEventTimers):
-        * page/animation/ImplicitAnimation.cpp:
-        (WebCore::ImplicitAnimation::onAnimationEnd):
-        (WebCore::ImplicitAnimation::sendTransitionEvent):
-        * page/animation/KeyframeAnimation.cpp:
-        (WebCore::KeyframeAnimation::onAnimationStart):
-        (WebCore::KeyframeAnimation::onAnimationIteration):
-        (WebCore::KeyframeAnimation::onAnimationEnd):
-        (WebCore::KeyframeAnimation::sendAnimationEvent):
-        * page/gtk/EventHandlerGtk.cpp:
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::isKeyboardOptionTab):
-        * page/mac/FrameMac.mm:
-        * page/qt/EventHandlerQt.cpp:
-        (WebCore::isKeyboardOptionTab):
-        * plugins/PluginView.cpp:
-        * plugins/gtk/PluginViewGtk.cpp:
-        * plugins/qt/PluginViewQt.cpp:
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::handleMouseEvent):
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlMuteButtonElement::defaultEventHandler):
-        (WebCore::MediaControlPlayButtonElement::defaultEventHandler):
-        (WebCore::MediaControlSeekButtonElement::defaultEventHandler):
-        (WebCore::MediaControlTimelineElement::defaultEventHandler):
-        (WebCore::MediaControlFullscreenButtonElement::defaultEventHandler):
-        * rendering/RenderFrameSet.cpp:
-        (WebCore::RenderFrameSet::userResize):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::scrollToOffset):
-        * rendering/RenderListBox.cpp:
-        (WebCore::RenderListBox::valueChanged):
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::forwardEvent):
-        * rendering/RenderObject.cpp:
-        * rendering/RenderSlider.cpp:
-        (WebCore::HTMLSliderThumbElement::defaultEventHandler):
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::forwardEvent):
-        (WebCore::RenderTextControl::selectionChanged):
-        * rendering/RenderWidget.cpp:
-        * rendering/TextControlInnerElements.cpp:
-        (WebCore::TextControlInnerTextElement::defaultEventHandler):
-        (WebCore::SearchFieldResultsButtonElement::defaultEventHandler):
-        (WebCore::SearchFieldCancelButtonElement::defaultEventHandler):
-        * storage/LocalStorageArea.cpp:
-        (WebCore::LocalStorageArea::dispatchStorageEvent):
-        * storage/SessionStorageArea.cpp:
-        (WebCore::SessionStorageArea::dispatchStorageEvent):
-        * svg/SVGAElement.cpp:
-        (WebCore::SVGAElement::defaultEventHandler):
-        * svg/SVGDocument.cpp:
-        (WebCore::SVGDocument::dispatchZoomEvent):
-        (WebCore::SVGDocument::dispatchScrollEvent):
-        * svg/SVGElement.cpp:
-        (WebCore::SVGElement::parseMappedAttribute):
-        (WebCore::hasLoadListener):
-        (WebCore::SVGElement::sendSVGLoadEventIfPossible):
-        * svg/SVGElementInstance.cpp:
-        (WebCore::SVGElementInstance::on*): (multiple methods)
-        (WebCore::SVGElementInstance::setOn*): (multiple methods)
-        * svg/SVGImageLoader.cpp:
-        (WebCore::SVGImageLoader::dispatchLoadEvent):
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::parseMappedAttribute):
-        * svg/SVGScriptElement.cpp:
-        (WebCore::SVGScriptElement::dispatchErrorEvent):
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::dispatchReadyStateChangeEvent):
-        (WebCore::XMLHttpRequest::dispatchAbortEvent):
-        (WebCore::XMLHttpRequest::dispatchErrorEvent):
-        (WebCore::XMLHttpRequest::dispatchLoadEvent):
-        (WebCore::XMLHttpRequest::dispatchLoadStartEvent):
-        (WebCore::XMLHttpRequest::dispatchProgressEvent):
-        * xml/XMLHttpRequestUpload.cpp:
-        (WebCore::XMLHttpRequestUpload::dispatchAbortEvent):
-        (WebCore::XMLHttpRequestUpload::dispatchErrorEvent):
-        (WebCore::XMLHttpRequestUpload::dispatchLoadEvent):
-        (WebCore::XMLHttpRequestUpload::dispatchLoadStartEvent):
-        (WebCore::XMLHttpRequestUpload::dispatchProgressEvent):
-        * xml/XPathResult.cpp:
-        (WebCore::XPathResult::XPathResult):
-        (WebCore::XPathResult::~XPathResult):
-        (WebCore::XPathResult::invalidateIteratorState):
-        Access event names via eventNames() function.
-
-2008-11-04  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        Delete unused forwarding headers.
-
-        * ForwardingHeaders/kjs/Activation.h: Removed.
-        * ForwardingHeaders/kjs/Register.h: Removed.
-        * ForwardingHeaders/kjs/RegisterID.h: Removed.
+        Fix NPAPI mouse translation issues on Mac
 
-2008-11-04  Cameron Zwarich  <zwarich@apple.com>
+        The WindowRef we pass to the plugin refers to the the top level window,
+        so the x and y positions have to be relative to this position, but we
+        have to manually compensate for title bar decorations and other parents
+        of the QWebView since contentsToWindow() only traverses to the QWebView.
 
-        Not reviewed.
+        Previously we did this compensation when passing on mouse coordinates to
+        the plugin, which caused various issues with translations such as not
+        being able to close the Flash settings dialog, or the hand cursor not
+        appearing over links.
 
-        Fix stupid typo in previous build fix.
+        We now do the compensation as part of the call to NPP_SetWindow, and
+        then pass mouse coordinates in global context without any compensation,
+        similar to how both Safari and Mozilla does it.
 
-        * bindings/js/JSStorageCustom.cpp:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/NP_jsobject.cpp:
-
-2008-11-03  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Fix the build for all non-Mac platforms.
-
-        * ForwardingHeaders/kjs/PropertyNameArray.h: Removed.
-        * ForwardingHeaders/runtime/PropertyNameArray.h: Copied from ForwardingHeaders/kjs/PropertyNameArray.h.
-        * bindings/js/JSStorageCustom.cpp:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/NP_jsobject.cpp:
-
-2008-11-03  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Fix the wxWindows build.
-
-        * bridge/c/c_instance.cpp:
-
-2008-11-03  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Maciej Stachowiak.
-
-        Move more files into the runtime subdirectory of JavaScriptCore.
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::globalMousePosForPlugin):
 
-        * ForwardingHeaders/kjs/ArgList.h: Removed.
-        * ForwardingHeaders/kjs/CollectorHeapIterator.h: Removed.
-        * ForwardingHeaders/kjs/ExecState.h: Removed.
-        * ForwardingHeaders/kjs/InitializeThreading.h: Removed.
-        * ForwardingHeaders/kjs/JSGlobalData.h: Removed.
-        * ForwardingHeaders/kjs/JSLock.h: Removed.
-        * ForwardingHeaders/kjs/SymbolTable.h: Removed.
-        * ForwardingHeaders/runtime/ArgList.h: Copied from ForwardingHeaders/kjs/ArgList.h.
-        * ForwardingHeaders/runtime/CollectorHeapIterator.h: Copied from ForwardingHeaders/kjs/CollectorHeapIterator.h.
-        * ForwardingHeaders/runtime/ExecState.h: Copied from ForwardingHeaders/kjs/ExecState.h.
-        * ForwardingHeaders/runtime/InitializeThreading.h: Copied from ForwardingHeaders/kjs/InitializeThreading.h.
-        * ForwardingHeaders/runtime/JSGlobalData.h: Copied from ForwardingHeaders/kjs/JSGlobalData.h.
-        * ForwardingHeaders/runtime/JSLock.h: Copied from ForwardingHeaders/kjs/JSLock.h.
-        * ForwardingHeaders/runtime/SymbolTable.h: Copied from ForwardingHeaders/kjs/SymbolTable.h.
-        * bindings/js/GCController.cpp:
-        * bindings/js/JSCustomPositionCallback.cpp:
-        * bindings/js/JSCustomPositionErrorCallback.cpp:
-        * bindings/js/JSCustomSQLStatementCallback.cpp:
-        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
-        * bindings/js/JSCustomSQLTransactionCallback.cpp:
-        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
-        * bindings/js/JSCustomVoidCallback.cpp:
-        * bindings/js/JSCustomXPathNSResolver.cpp:
-        * bindings/js/JSDOMWindowBase.cpp:
-        * bindings/js/JSEventCustom.cpp:
-        * bindings/js/JSEventListener.cpp:
-        * bindings/js/JSNodeFilterCondition.cpp:
-        * bindings/js/ScheduledAction.cpp:
-        * bindings/js/ScriptController.cpp:
-        * bindings/js/ScriptControllerMac.mm:
-        * bindings/objc/WebScriptObject.mm:
-        * bridge/NP_jsobject.cpp:
-        * bridge/c/c_class.cpp:
-        * bridge/c/c_instance.cpp:
-        * bridge/c/c_runtime.cpp:
-        * bridge/c/c_utility.cpp:
-        * bridge/jni/jni_class.cpp:
-        * bridge/jni/jni_instance.cpp:
-        * bridge/jni/jni_jsobject.mm:
-        * bridge/jni/jni_objc.mm:
-        * bridge/jni/jni_runtime.cpp:
-        * bridge/jni/jni_runtime.h:
-        * bridge/jni/jni_utility.cpp:
-        * bridge/npruntime.cpp:
-        * bridge/objc/objc_instance.mm:
-        * bridge/objc/objc_runtime.mm:
-        * bridge/objc/objc_utility.mm:
-        * bridge/runtime.cpp:
-        * dom/Document.cpp:
-        * dom/Node.cpp:
-        * dom/NodeFilter.cpp:
-        * dom/NodeIterator.cpp:
-        * dom/TreeWalker.cpp:
-        * history/CachedPage.cpp:
-        * inspector/InspectorController.cpp:
-        * inspector/JavaScriptCallFrame.cpp:
-        * inspector/JavaScriptCallFrame.h:
-        * inspector/JavaScriptDebugServer.cpp:
-        * inspector/JavaScriptProfileNode.cpp:
-        * loader/FrameLoader.cpp:
-        * loader/icon/IconDatabase.cpp:
-        * page/Console.cpp:
-        * page/Page.cpp:
-        * page/mac/FrameMac.mm:
-        * plugins/PluginView.cpp:
-        * plugins/gtk/PluginViewGtk.cpp:
-        * plugins/qt/PluginViewQt.cpp:
-        * plugins/win/PluginViewWin.cpp:
-        * storage/Database.cpp:
-        * xml/XMLHttpRequest.cpp:
+2009-06-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-2008-11-03  Cameron Zwarich  <zwarich@apple.com>
+        Rubber-stamped by Simon Hausmann.
 
-        Reviewed by Sam Weinig.
+        [Qt] Resolve absolute path to library install_name manually
 
-        Remove the forwarding header for FunctionCallProfile, because it was
-        renamed to ProfileNode in r33466.
+        Since our target.path is set to the Qt directory (to be able
+        to do 'make install') the 'absolute_library_soname' option
+        to QMake did not do the right thing.
 
-        * ForwardingHeaders/kjs/FunctionCallProfile.h: Removed.
+        We now compute the absolute path manually using DESTDIR.
 
-2008-11-03  Simon Fraser  <simon.fraser@apple.com>
+        * WebCore.pro:
 
-        Reviewed by Dave Hyatt
+2009-06-22  Simon Fraser  <simon.fraser@apple.com>
 
-        https://bugs.webkit.org/show_bug.cgi?id=22026
+        Reviewed by Oliver Hunt.
 
-        When computing the bounds of the transparency layer, we need to
-        map the clipRect through the enclosing transform.
-        
-        Test: fast/layers/opacity-transforms.html
+        <rdar://problem/6991146> Scrollbars in hardware layers don't change to the
+        inactive look in background windows
 
         * rendering/RenderLayer.cpp:
-        (WebCore::transparencyClipBox):
-
-2008-11-03  Kevin Decker  <kdecker@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22053
-
-        Added additional support needed for the NPDrawingModelCoreAnimation drawing model. 
-
-        * bridge/npapi.h:
-
-2008-11-03  Xan Lopez  <xan@gnome.org>
-
-        Reviewed by Alp Toker.
-
-        Update parseDataUrl() function in the libsoup http backend with
-        the one from the curl backend which has recent correctness and crash
-        fixes.
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::parseDataUrl):
-
-2008-11-03  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Alp Toker.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22041
-        Fix CURL crashes on the test suite
-
-        Fix segfault with setDefersLoading(). Do not call into curl when we
-        don't have a CURL handle.
-
-        It is attempted to defer the loading before the load has been
-        started (no curl handle was allocated yet). If that happens then
-        just remember that. ResourceHandleManager::startJob is already taking
-        care of this and in initResourceHandle the the downloading will
-        be paused if needed.
-
-        Fixes fast/loader/simultaneous-reloads-assert.html
-
-        * platform/network/curl/ResourceHandleCurl.cpp:
-        (WebCore::ResourceHandle::setDefersLoading):
-
-2008-11-03  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Alp Toker.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22041
-        Fix CURL crashes on the test suite
-
-        Do not send "no data" to WebCore in parseDataUrl().
-
-        Fixes assert on fast/tokenizer/image-empty-crash.html
-
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::parseDataUrl):
-
-2008-11-02  Xan Lopez  <xan@gnome.org>
-
-        Reviewed by Holger Freyther.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22009
-        HTML5 Video with GStreamer pulls gnome-vfs without using it
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        Remove gnome-vfs include.
+        (WebCore::RenderLayer::paintLayer):
+        Don't short-circuit the "painting" pass that is used to udpate control tints.
 
-2008-11-01  Adam Barth  <abarth@webkit.org>
+2009-06-22  Dimitri Glazkov  <dglazkov@chromium.org>
 
         Reviewed by Sam Weinig.
 
-        Be sure to check the final URLs of requested resources to make sure we
-        don't get fooled by HTTP redirects.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21963
+        https://bugs.webkit.org/show_bug.cgi?id=26567
+        Upstream V8 bindings code generator. With this change, also added interface ancestor
+        traversal to IDL parser, which is necessary for V8 bindings. The traversal is used
+        to determine whether an interface is a Node to facilitate proper casting and storage
+        in V8DOMMap.
 
-        Tests: http/tests/security/xss-DENIED-xsl-document-redirect.xml
-               http/tests/security/xss-DENIED-xsl-external-entity-redirect.xml
+        * bindings/scripts/CodeGenerator.pm: Added parent traversal sub, needed
+            by V8 bindings.
+        * bindings/scripts/CodeGeneratorV8.pm: Added.
+        * bindings/scripts/IDLParser.pm: Modified to allow limited parsing for
+            parent traversal cases.
 
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::openFunc):
-        * loader/DocLoader.cpp:
-        (WebCore::DocLoader::canRequest):
-        (WebCore::DocLoader::requestResource):
-        * loader/DocLoader.h:
-        * xml/XSLTProcessor.cpp:
-        (WebCore::docLoaderFunc):
-
-2008-11-01  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
+2009-06-22  Sam Weinig  <sam@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=22001
-        AtomicStringImpl* keys of event listener maps can outlive their strings
-
-        Test: fast/events/destroyed-atomic-string.html
-
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::addEventListener):
-        (WebCore::MessagePort::removeEventListener):
-        (WebCore::MessagePort::dispatchEvent):
-        * dom/MessagePort.h:
-        * loader/appcache/DOMApplicationCache.cpp:
-        (WebCore::DOMApplicationCache::addEventListener):
-        (WebCore::DOMApplicationCache::removeEventListener):
-        (WebCore::DOMApplicationCache::dispatchEvent):
-        * loader/appcache/DOMApplicationCache.h:
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::addEventListener):
-        (WebCore::XMLHttpRequest::removeEventListener):
-        (WebCore::XMLHttpRequest::dispatchEvent):
-        * xml/XMLHttpRequest.h:
-        * xml/XMLHttpRequestUpload.cpp:
-        (WebCore::XMLHttpRequestUpload::addEventListener):
-        (WebCore::XMLHttpRequestUpload::removeEventListener):
-        (WebCore::XMLHttpRequestUpload::dispatchEvent):
-        * xml/XMLHttpRequestUpload.h:
-        Changed EventListenersMap to use AtomicString as key (instead of AtomicStringImpl*).
-
-2008-10-31  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21998
-        Use JSDOMGlobalObject in EventListener-related bindings
-
-        * dom/MessagePort.idl: Auto-generate bindings for onclose and onmessage.
-
-        * bindings/scripts/CodeGeneratorJS.pm: Use JSDOMGlobalObject instead of JSDOMWindow in JS
-        bindings for inline event handlers.
-
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::addEventListener):
-        (WebCore::JSDOMApplicationCache::removeEventListener):
-        * bindings/js/JSEventTargetNodeCustom.cpp:
-        (WebCore::JSEventTargetNode::addEventListener):
-        (WebCore::JSEventTargetNode::removeEventListener):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::removeEventListener):
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::addEventListener):
-        (WebCore::JSSVGElementInstance::removeEventListener):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::addEventListener):
-        (WebCore::JSXMLHttpRequest::removeEventListener):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::addEventListener):
-        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
-        Use ScriptExecutionContext and JSDOMGlobalObject in bindings.
-
-        * dom/EventTarget.h:
-        * dom/EventTargetNode.cpp:
-        (WebCore::EventTargetNode::scriptExecutionContext):
-        * dom/EventTargetNode.h:
-        * dom/MessagePort.cpp:
-        * dom/MessagePort.h:
-        (WebCore::MessagePort::scriptExecutionContext):
-        * loader/appcache/DOMApplicationCache.cpp:
-        (WebCore::DOMApplicationCache::scriptExecutionContext):
-        * loader/appcache/DOMApplicationCache.h:
-        * svg/SVGElementInstance.cpp:
-        (WebCore::SVGElementInstance::scriptExecutionContext):
-        * svg/SVGElementInstance.h:
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::scriptExecutionContext):
-        * xml/XMLHttpRequest.h:
-        * xml/XMLHttpRequestUpload.cpp:
-        (WebCore::XMLHttpRequestUpload::scriptExecutionContext):
-        * xml/XMLHttpRequestUpload.h:
-        Remove associatedFrame() method, and provide scriptExecutionContext() where it wasn't
-        available yet.
-
-2008-10-31  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Geoff Garen.
-
-        Rename SourceRange.h to SourceCode.h.
-
-        * ForwardingHeaders/kjs/SourceCode.h: Copied from ForwardingHeaders/kjs/SourceRange.h.
-        * ForwardingHeaders/kjs/SourceRange.h: Removed.
-        * bindings/js/StringSourceProvider.h:
-        * bridge/NP_jsobject.cpp:
-
-2008-10-31  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Bug 22019: Move JSC::Interpreter::shouldPrintExceptions() to WebCore::Console
-        <https://bugs.webkit.org/show_bug.cgi?id=22019>
-
-        * WebCore.base.exp:
-        * page/Console.cpp:
-        (WebCore::printToStandardOut):
-        (WebCore::Console::shouldPrintExceptions):
-        (WebCore::Console::setShouldPrintExceptions):
-        * page/Console.h:
-
-2008-10-31  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by John Sullivan.
-
-        - WebCore part of <rdar://problem/6334641> Add WebView SPI for disabling document.cookie
-
-        * dom/Document.cpp:
-        (WebCore::Document::cookie): Added checking if cookies are disabled.
-        (WebCore::Document::setCookie): Ditto.
-        * page/Navigator.cpp:
-        (WebCore::Navigator::cookieEnabled): Ditto.
-        * page/Page.cpp:
-        (WebCore::Page::Page): Initialize m_cookieEnabled to true.
-        * page/Page.h:
-        (WebCore::Page::cookieEnabled): Added.
-        (WebCore::Page::setCookieEnabled): Added.
-
-2008-10-31  Adele Peterson  <adele@apple.com>
-
-        Reviewed by Darin Adler.
-
-        WebCore Windows part of fix for <rdar://problem/5839256> FILE CONTROL: multi-file upload.
-        https://bugs.webkit.org/show_bug.cgi?id=22008
-
-        * platform/FileChooser.cpp: (WebCore::FileChooser::chooseIcon): 
-        Rename newIconForFile and newIconForFiles to createIconForFile and createIconForFiles.
-        * platform/graphics/Icon.h: ditto.
-        * platform/graphics/gtk/IconGtk.cpp:
-        (WebCore::Icon::createIconForFile): ditto.
-        (WebCore::Icon::createIconForFiles): ditto.
-        * platform/graphics/mac/IconMac.mm:
-        (WebCore::Icon::createIconForFile): ditto.
-        (WebCore::Icon::createIconForFiles): ditto.
-        * platform/graphics/qt/IconQt.cpp:
-        (WebCore::Icon::createIconForFile): ditto.
-        (WebCore::Icon::createIconForFiles): ditto.
-        * platform/wx/TemporaryLinkStubs.cpp:
-        (Icon::createIconForFile): ditto.
-        (Icon::createIconForFiles): ditto.
-        * platform/graphics/win/IconWin.cpp:
-        (WebCore::Icon::createIconForFile): ditto.
-        (WebCore::Icon::createIconForFiles): Add creation of an icon for multiple files.
-
-        * rendering/RenderThemeWin.cpp: (WebCore::RenderThemeWin::paintSearchFieldResultsDecoration):        
-        Improve icon creation code to match new code in Icon::createIconForFiles
-        
-2008-10-31  Timothy Hatcher  <timothy@apple.com>
-
-        Add manual tests that check breakpoints on a blockless body of "for" loops.
-
-        https://bugs.webkit.org/show_bug.cgi?id=22004
-
-        Reviewed by Darin Adler.
-
-        * manual-tests/inspector/debugger-pause-on-for-in-statements.html: Added.
-        * manual-tests/inspector/debugger-pause-on-for-statements.html: Added.
-
-2008-10-31  Darin Adler  <darin@apple.com>
-
-        - fix build
-
-        * platform/win/WCDataObject.cpp: Added missing include of "config.h".
-
-2008-10-30  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21970
-        Make MessagePort event dispatch work in workers
-
-        * bindings/js/JSDOMGlobalObject.cpp:
-        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
-        (WebCore::JSDOMGlobalObject::~JSDOMGlobalObject):
-        (WebCore::JSDOMGlobalObject::findJSEventListener):
-        (WebCore::JSDOMGlobalObject::findOrCreateJSEventListener):
-        (WebCore::JSDOMGlobalObject::findJSUnprotectedEventListener):
-        (WebCore::JSDOMGlobalObject::findOrCreateJSUnprotectedEventListener):
-        (WebCore::JSDOMGlobalObject::jsEventListeners):
-        (WebCore::JSDOMGlobalObject::jsInlineEventListeners):
-        (WebCore::JSDOMGlobalObject::jsUnprotectedEventListeners):
-        (WebCore::JSDOMGlobalObject::jsUnprotectedInlineEventListeners):
-        (WebCore::JSDOMGlobalObject::setCurrentEvent):
-        (WebCore::JSDOMGlobalObject::currentEvent):
-        (WebCore::toJSDOMGlobalObject):
-        * bindings/js/JSDOMGlobalObject.h:
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData):
-        (WebCore::JSDOMWindowBase::~JSDOMWindowBase):
-        (WebCore::JSDOMWindowBase::clearHelperObjectProperties):
-        * bindings/js/JSDOMWindowBase.h:
-        Moved event listener tracking from JSDOMWindow to JSDOMGlobalObject.
-
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSAbstractEventListener::handleEvent):
-        (WebCore::JSUnprotectedEventListener::JSUnprotectedEventListener):
-        (WebCore::JSUnprotectedEventListener::~JSUnprotectedEventListener):
-        (WebCore::JSUnprotectedEventListener::globalObject):
-        (WebCore::JSUnprotectedEventListener::clearGlobalObject):
-        (WebCore::JSEventListener::JSEventListener):
-        (WebCore::JSEventListener::~JSEventListener):
-        (WebCore::JSEventListener::globalObject):
-        (WebCore::JSEventListener::clearGlobalObject):
-        (WebCore::JSLazyEventListener::JSLazyEventListener):
-        (WebCore::JSLazyEventListener::parseCode):
-        * bindings/js/JSEventListener.h:
-        (WebCore::JSUnprotectedEventListener::create):
-        (WebCore::JSEventListener::create):
-        (WebCore::JSLazyEventListener::create):
-        Changed to use JSDOMGlobalObject and ScriptExecutionContext.
-
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::startConversation):
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        (WebCore::JSMessagePort::setOnmessage):
-        (WebCore::JSMessagePort::setOnclose):
-        Updated bindings to work with JSDOMGlobalObject. Next step is to make code generator emit
-        such code, and stop using a custom implementation for JSMessagePort inline event handler
-        getters and setters.
-
-        * dom/Document.cpp:
-        (WebCore::Document::virtualURL):
-        * dom/Document.h:
-        * dom/ScriptExecutionContext.h:
-        Expose url() method on ScriptExecutionContext (necessary for compiling scripts in
-        JSLazyEventListener).
-
-2008-10-31  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Speculative wxWindows build fix.
-
-        * webcore-base.bkl:
-
-2008-10-30  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Jon Homeycutt.
-
-        Explicitly default to building for only the native architecture in debug and release builds.
-
-        * Configurations/DebugRelease.xcconfig:
-
-2008-10-30  Cameron Zwarich  <zwarich@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        Create a debugger directory in JavaScriptCore and move the relevant
-        files to it.
-
-        * ForwardingHeaders/debugger: Added.
-        * ForwardingHeaders/debugger/Debugger.h: Copied from ForwardingHeaders/kjs/debugger.h.
-        * ForwardingHeaders/debugger/DebuggerCallFrame.h: Copied from ForwardingHeaders/kjs/DebuggerCallFrame.h.
-        * ForwardingHeaders/kjs/DebuggerCallFrame.h: Removed.
-        * ForwardingHeaders/kjs/debugger.h: Removed.
-        * WebCore.pro:
-        * bindings/js/ScriptController.cpp:
-        * inspector/JavaScriptCallFrame.cpp:
-        * inspector/JavaScriptCallFrame.h:
-        * inspector/JavaScriptDebugServer.cpp:
-        * inspector/JavaScriptDebugServer.h:
-
-2008-10-30  Tony Chang <tony@chromium.org>
-
-        Fix 2 Windows theme bugs:
-        1) Checkboxes marked readonly were rendered incorrectly
-        2) If a button has focus and is pressed, it was rendered
-           as focused rather than pressed.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21859
-
-        Reviewed by Dave Hyatt.
-
-        * rendering/RenderThemeWin.cpp:
-        (WebCore::RenderThemeWin::determineState):
-        (WebCore::RenderThemeWin::determineButtonState):
-
-2008-10-30  Benjamin K. Stuhl  <bks24@cornell.edu>
-
-        gcc 4.3.3/linux-x86 generates "suggest parentheses around && within ||"
-        warnings; add some parentheses to disambiguate things. No functional
-        changes, so no tests.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21973
-        Add parentheses to clean up some gcc warnings
-
-        Reviewed by Dan Bernstein.
-
-        * platform/graphics/Font.h:
-        (WebCore::Font::treatAsZeroWidthSpace):
-
-2008-10-30  Aaron Boodman  <aa@chromium.org>
-
-        Added an explicit dependency on HashMap.h. It was getting pulled in via
-        <kjs/identifier.h> in the case of JSC, causing errors for the Chromium port.
-
-        Reviewed by Darin Adler.
-
-        * platform/text/PlatformString.h:
-
-2008-10-30  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Sam Weinig
-
-        https://bugs.webkit.org/show_bug.cgi?id=21967
-        
-        For some platforms the GeolocationService must be suspended and resumed.
-
-        * page/Geolocation.cpp:
-        (WebCore::Geolocation::clearWatch): now uses Geolocation::hasListeners()
-        (WebCore::Geolocation::suspend): calls GeolocationService::suspend() if there are listeners
-        (WebCore::Geolocation::resume): calls GeolocationService::resume() if there are listeners
-        (WebCore::Geolocation::geolocationServicePositionChanged): now uses Geolocation::hasListeners()
-        * page/Geolocation.h:
-        (WebCore::Geolocation::hasListeners): Indicates of the Geolocation has interested GeolocationService listeners
-        * platform/GeolocationService.h:
-        (WebCore::GeolocationService::suspend): empty implementation
-        (WebCore::GeolocationService::resume): empty implementation
-
-2008-10-30  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Sam Weinig
-
-        https://bugs.webkit.org/show_bug.cgi?id=21966
-        
-        The Geolocation spec was updated on 10/27/2008. This brings WebCore up to date.
-        http://dev.w3.org/geo/api/spec-source.html
-
-        * page/Geolocation.cpp:
-        (WebCore::Geolocation::GeoNotifier::GeoNotifier): PositionOptions' timeout now unsigned
-        * page/Geoposition.cpp: velocity is now called speed
-        (WebCore::Geoposition::toString):
-        * page/Geoposition.h: velocity is now called speed
-        (WebCore::Geoposition::create):
-        (WebCore::Geoposition::speed):
-        (WebCore::Geoposition::Geoposition):
-        * page/Geoposition.idl: velocity is now called speed
-        * page/PositionOptions.h: timeout is now unsigned
-        (WebCore::PositionOptions::create):
-        (WebCore::PositionOptions::timeout):
-        (WebCore::PositionOptions::setTimeout):
-        (WebCore::PositionOptions::PositionOptions):
-        * page/PositionOptions.idl: timeout is now unsigned long
-
-2008-10-30  Justin Garcia  <justin.garcia@apple.com>
-
-        Also handle preserved newlines.
-
-        * editing/BreakBlockquoteCommand.cpp:
-        (WebCore::BreakBlockquoteCommand::doApply):
-
-2008-10-30  Justin Garcia  <justin.garcia@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        <rdar://problem/6104369> Hitting return at the end of a quoted line creates an extraneous quoted line
-
-        * editing/BreakBlockquoteCommand.cpp:
-        (WebCore::BreakBlockquoteCommand::doApply): 
-        Don't store the endingSelection() in selection, just call endingSelection() in the few places it's 
-        needed.  This function is cheap since it just returns a reference to a Selection instead of creating one.
-        Don't store an affinity.  In the one place that it was used, isLastVisiblePositionInNode(VisiblePosition(pos, affinity), topBlockquote),
-        we now use visiblePos (in order to avoid VisiblePosition creation).
-        Set pos after we delete the current selection (if there is one), and be consistent about what we set 
-        pos to.  Before, we upstream()ed it if there was a selection to delete and left it alone otherwise.  In fact...
-        ...we need to use downstream() for pos so that when a caret is at the boundary between two nodes, pos is 
-        in the first node that we want to move.  This fixes the bug, since it lets code that checks for the case 
-        where the caret is between text and a br work correctly.
-
-2008-10-30  Yael Aharon  <yael.aharon@nokia.com>
-
-        Reviewed by Darin Adler.
-
-        Fix the Qt build.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21969
-
-        * inspector/front-end/WebKit.qrc:
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::ImageBufferData::ImageBufferData):
-        (WebCore::ImageBuffer::ImageBuffer):
-        (WebCore::ImageBuffer::context):
-        (WebCore::ImageBuffer::image):
-        (WebCore::ImageBuffer::toDataURL):
-
-2008-10-30  Justin Garcia  <justin.garcia@apple.com>
-
-        Reviewed by Darin Adler.
-
-        More preparation for:
-        <rdar://problem/6104369> Hitting return at the end of a quoted line creates an extraneous quoted line
-
-        * editing/BreakBlockquoteCommand.cpp:
-        (WebCore::BreakBlockquoteCommand::doApply): Added comments.  Don't need to use newStartNode.  If the 
-        startNode needs to change, change it.  Afterwords, check to make sure that it hasn't left topBlockquote.  
-        This is slightly stricter than before, where we just made sure that it still had a topBlockquote.  This 
-        doesn't really fix a bug, since we can't really get into a situation where we move to a different 
-        topBlockquote, but it simplifies the code.
-
-2008-10-30  Dirk Schulze  <vbs85@gmx.de>
-
-        Reviewed by Alp Toker.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21883
-        [CAIRO] globalAlpha has to be stored and restored
-
-        Cairo's globalAlpha has to be stored and reloaded on calling
-        save() and restore(). We use the power of GraphicsContextState for this.
-
-        * platform/graphics/GraphicsContextPrivate.h:
-        (WebCore::GraphicsContextState::GraphicsContextState):
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::setAlpha):
-        (WebCore::GraphicsContext::getAlpha):
-        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
-        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
-
-2008-10-29  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Rename "attachedToEventTargetNode" to "isInline".
-
-        Inline (onXXX) attributes are used not just with event target nodes, but also with Window,
-        XMLHttpRequest, MessagePort et al.
+        Reviewed by Gavin Barraclough.
 
-        Also renamed createHTMLEventHandler() (which was a leftover from earlier isHTMLEvent ->
-        attachedToEventTargetNode rename made for SVG) to createInlineEventListener().
-        And also renamed EventTargetNode, Document and Window "eventListenerForType" methods to
-        "inlineEventListenerForType", as they work with inline listeners.
+        Add event handler attribute getter/setters to HTMLFrameSetElement
+        as specified in HTML 5.  These match the ones on HTMLBodyElement.
 
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::addEventListener):
-        (WebCore::JSDOMApplicationCache::removeEventListener):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::setOnmessage):
-        (WebCore::JSMessagePort::setOnclose):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::addEventListener):
-        (WebCore::JSXMLHttpRequest::removeEventListener):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::addEventListener):
-        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
-        Pass a correct value for this argument - callers used to be confused, because they didn't
-        consider themselves event target nodes. This doesn't affect behavior however, as the only
-        difference between inline and non-inline event handlers is that the former treat
-        "return false" as "event.preventDefault()", which is not important to any of these objects.
-
-        * bindings/js/JSEventListener.cpp: (WebCore::JSLazyEventListener::parseCode):
-        Assert that isInline is true instead of checking its value, as the constructor of this class
-        always sets it to true.
-
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::~JSDOMWindowBase):
-        (WebCore::JSDOMWindowBase::findJSEventListener):
-        (WebCore::JSDOMWindowBase::findOrCreateJSEventListener):
-        (WebCore::JSDOMWindowBase::findJSUnprotectedEventListener):
-        (WebCore::JSDOMWindowBase::findOrCreateJSUnprotectedEventListener):
-        (WebCore::JSDOMWindowBase::jsInlineEventListeners):
-        (WebCore::JSDOMWindowBase::jsUnprotectedInlineEventListeners):
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSAbstractEventListener::handleEvent):
-        (WebCore::JSAbstractEventListener::isInline):
-        (WebCore::JSUnprotectedEventListener::JSUnprotectedEventListener):
-        (WebCore::JSUnprotectedEventListener::~JSUnprotectedEventListener):
-        (WebCore::JSEventListener::JSEventListener):
-        (WebCore::JSEventListener::~JSEventListener):
-        (WebCore::JSLazyEventListener::parseCode):
-        * bindings/js/JSEventListener.h:
-        (WebCore::JSAbstractEventListener::JSAbstractEventListener):
-        (WebCore::JSUnprotectedEventListener::create):
-        (WebCore::JSEventListener::create):
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::createInlineEventHandler):
-        * bindings/js/ScriptController.h:
-        * dom/Document.cpp:
-        (WebCore::Document::setWindowInlineEventListenerForType):
-        (WebCore::Document::windowInlineEventListenerForType):
-        (WebCore::Document::removeWindowInlineEventListenerForType):
-        (WebCore::Document::createEventListener):
-        (WebCore::Document::setWindowInlineEventListenerForTypeAndAttribute):
-        * dom/Document.h:
-        * dom/EventListener.h:
-        (WebCore::EventListener::isInline):
-        * dom/EventTargetNode.cpp:
-        (WebCore::EventTargetNode::removeInlineEventListenerForType):
-        (WebCore::EventTargetNode::setInlineEventListenerForType):
-        (WebCore::EventTargetNode::setInlineEventListenerForTypeAndAttribute):
-        (WebCore::EventTargetNode::inlineEventListenerForType):
-        (WebCore::EventTargetNode::on*): (many methods)
-        (WebCore::EventTargetNode::setOn*): (many methods)
-        * dom/EventTargetNode.h:
-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::ReplacementFragment::ReplacementFragment):
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::parseMappedAttribute):
-        * html/HTMLButtonElement.cpp:
-        (WebCore::HTMLButtonElement::parseMappedAttribute):
-        * html/HTMLElement.cpp:
-        (WebCore::HTMLElement::parseMappedAttribute):
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::parseMappedAttribute):
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
+        * dom/Node.h:
         * html/HTMLFrameSetElement.cpp:
         (WebCore::HTMLFrameSetElement::parseMappedAttribute):
-        * html/HTMLImageElement.cpp:
-        (WebCore::HTMLImageElement::parseMappedAttribute):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::parseMappedAttribute):
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::parseMappedAttribute):
-        * html/HTMLScriptElement.cpp:
-        (WebCore::HTMLScriptElement::parseMappedAttribute):
-        * html/HTMLSelectElement.cpp:
-        (WebCore::HTMLSelectElement::parseMappedAttribute):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
-        * page/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::mouseButtonListener):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::setInlineEventListenerForType):
-        (WebCore::DOMWindow::inlineEventListenerForType):
-        (WebCore::DOMWindow::on*): (many methods)
-        (WebCore::DOMWindow::setOn*): (many methods)
-        * page/DOMWindow.h:
-        * svg/SVGElement.cpp:
-        (WebCore::SVGElement::parseMappedAttribute):
-        * svg/SVGElementInstance.cpp:
-        (WebCore::SVGElementInstance::on*): (many methods)
-        (WebCore::SVGElementInstance::setOn*): (many methods)
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::parseMappedAttribute):
-        Rename things, as described above.
-
-2008-10-29  Gustavo Noronha Silva  <gns@gnome.org>
-
-        Reviewed and slightly changed by Holger Freyther.
-
-        Added all the files that need to be installed for the Inspector to
-        work.
-
-        * GNUmakefile.am: Invoke the shell to get the files.
-
-2008-10-29  Andrew Scherkus  <scherkus@chromium.org>
-
-        Reviewed by Darin Adler
-
-        Add MediaPlayerPrivateChromium to MediaPlayer
-        https://bugs.webkit.org/show_bug.cgi?id=21930
-
-        * platform/graphics/MediaPlayer.cpp:
-
-2008-10-29  Justin Garcia  <justin.garcia@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Some preparation for:
-        <rdar://problem/6104369> Hitting return at the end of a quoted line creates an extraneous quoted line
-        
-        Added an early return to avoid a level of if-nesting.  No other changes.  We probably don't
-        need to rebalance whitespace before the early return but for now don't risk any change in behavior
-        I'll revisit that later.
-
-        * editing/BreakBlockquoteCommand.cpp:
-        (WebCore::BreakBlockquoteCommand::doApply):
-
-2008-10-29  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fixes after addition of runtime and ImageBuffer changes.
-        
-        * platform/graphics/wx/ImageBufferData.h: Added.
-        * platform/graphics/wx/ImageBufferWx.cpp:
-        (WebCore::ImageBufferData::ImageBufferData):
-        (WebCore::ImageBuffer::ImageBuffer):
-        (WebCore::ImageBuffer::context):
-        * webcore-base.bkl:
-
-2008-10-29  Brett Wilson  <brettw@chromium.org>
-
-        Reviewed by Darin Adler
-        https://bugs.webkit.org/attachment.cgi?id=24745
-
-        Allow Skia implementations to get text style changed notifications.
-
-        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::HTMLFrameSetElement::onblur):
+        (WebCore::HTMLFrameSetElement::setOnblur):
+        (WebCore::HTMLFrameSetElement::onerror):
+        (WebCore::HTMLFrameSetElement::setOnerror):
+        (WebCore::HTMLFrameSetElement::onfocus):
+        (WebCore::HTMLFrameSetElement::setOnfocus):
+        (WebCore::HTMLFrameSetElement::onload):
+        (WebCore::HTMLFrameSetElement::setOnload):
+        (WebCore::HTMLFrameSetElement::onbeforeunload):
+        (WebCore::HTMLFrameSetElement::setOnbeforeunload):
+        (WebCore::HTMLFrameSetElement::onmessage):
+        (WebCore::HTMLFrameSetElement::setOnmessage):
+        (WebCore::HTMLFrameSetElement::onoffline):
+        (WebCore::HTMLFrameSetElement::setOnoffline):
+        (WebCore::HTMLFrameSetElement::ononline):
+        (WebCore::HTMLFrameSetElement::setOnonline):
+        (WebCore::HTMLFrameSetElement::onresize):
+        (WebCore::HTMLFrameSetElement::setOnresize):
+        (WebCore::HTMLFrameSetElement::onstorage):
+        (WebCore::HTMLFrameSetElement::setOnstorage):
+        (WebCore::HTMLFrameSetElement::onunload):
+        (WebCore::HTMLFrameSetElement::setOnunload):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLFrameSetElement.idl:
 
-2008-10-29  Timothy Hatcher  <timothy@apple.com>
+2009-06-22  Darin Adler  <darin@apple.com>
 
-        Add a manual test that checks breakpoints on a blockless body of
-        an "else" statement.
+        Reviewed by Sam Weinig.
 
-        https://bugs.webkit.org/show_bug.cgi?id=21944
+        Bug 25425: DOM attribute getter/setter functions should use const AtomicString& type
+        https://bugs.webkit.org/show_bug.cgi?id=25425
 
-        Reviewed by Maciej Stachowiak.
+        * bindings/scripts/CodeGeneratorJS.pm: Added handling for ReflectURL.
+        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
 
-        * manual-tests/inspector/debugger-pause-on-else-statements.html: Added.
+        * dom/Element.cpp:
+        (WebCore::Element::getURLAttribute): Added. For use implementing getters
+        for ReflectURL.
+        * dom/Element.h: Added getURLAttribute.
 
-2008-10-29  Alexey Proskuryakov  <ap@webkit.org>
+        * html/HTMLImageElement.idl: Use Reflect and ReflectURL.
 
-        Reviewed by Darin Adler.
+2009-06-22  Jian Li  <jianli@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=21921
-        MessagePort messages are dispatched to documents that are not fully active
+        Reviewed by Dimitri Glazkov.
 
-        Covered by corrected fast/events/message-port-inactive-document.html
+        Bug 26626: Make WorkerContextExecutionProxy::toV8Object handle exception
+        objects.
+        https://bugs.webkit.org/show_bug.cgi?id=26626
 
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSAbstractEventListener::handleEvent): Don't dispatch messages to contexts
-        that are not fully active.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::ToV8Object):
 
-2008-10-29  Alexey Proskuryakov  <ap@webkit.org>
+2009-06-22  David Hyatt  <hyatt@apple.com>
 
         Reviewed by Sam Weinig.
 
-        https://bugs.webkit.org/show_bug.cgi?id=21922
-        Expose MessagePort global constructor
-
-        Covered by existing dumper tests.
-
-        * dom/MessagePort.idl:
-        * page/DOMWindow.idl:
-
-2008-10-29  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21924
-        HashTable internal index is not always deleted
-
-        * bindings/js/JSDOMBinding.cpp: (WebCore::DOMObjectHashTableMap::~DOMObjectHashTableMap):
-        Call deleteTable for HashTables that are being deleted.
-
-2008-10-28  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21923
-        Create an abstraction for script execution context
+        Add RenderDataGrid to the build.  Give it some basic default styling (that more or less matches a listbox).  It has a default size
+        of 300x150.
 
         * GNUmakefile.am:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
         * WebCoreSources.bkl:
-        Added ScriptExecutionContext.{h,cpp}.
-
-        * bindings/js/JSAudioConstructor.cpp:
-        (WebCore::JSAudioConstructor::JSAudioConstructor):
-        * bindings/js/JSAudioConstructor.h:
-        * bindings/js/JSImageConstructor.cpp:
-        (WebCore::JSImageConstructor::JSImageConstructor):
-        * bindings/js/JSImageConstructor.h:
-        * bindings/js/JSOptionConstructor.cpp:
-        (WebCore::JSOptionConstructor::JSOptionConstructor):
-        * bindings/js/JSOptionConstructor.h:
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
-        * bindings/js/JSXMLHttpRequestConstructor.h:
-        Pass ScriptExecutionContext instead of Document to make getDOMConstructor() happy.
-        Since these objects can only work within documents now, it is immediately converted back
-        to Document.
-
-        * bindings/js/JSMessageChannelConstructor.cpp:
-        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
-        (WebCore::JSMessageChannelConstructor::construct):
-        * bindings/js/JSMessageChannelConstructor.h:
-        (WebCore::JSMessageChannelConstructor::scriptExecutionContext):
-        MessageChannel needs to be supported in workers right away, so the constructor operates with
-        it directly.
-
-        * dom/ActiveDOMObject.cpp:
-        (WebCore::ActiveDOMObject::ActiveDOMObject):
-        (WebCore::ActiveDOMObject::~ActiveDOMObject):
-        (WebCore::ActiveDOMObject::contextDestroyed):
-        * dom/ActiveDOMObject.h:
-        (WebCore::ActiveDOMObject::scriptExecutionContext):
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::markActiveObjectsForContext):
-        (WebCore::markCrossHeapDependentObjectsForContext):
-        Use ScriptExecutionContext instead of Document, now that ActiveDOMObject and MessagePort
-        tracking is handled by ScriptExecutionContext.
-
-        * bindings/js/JSDOMBinding.h: (WebCore::getDOMPrototype): Moved to JSDOMGlobalObject.
-
-        * bindings/js/JSDOMGlobalObject.h:
-        (WebCore::getDOMConstructor): Moved to this file, as constructors live in JSDOMGlobalObject.
-        Also, the two-argument version that used to be in JSDOMWindowBase.cpp need to be accessible
-        to worker context implementation.
-        (WebCore::scriptExecutionContext): Added a pure virtual method to access
-        ScriptExecutionContext, implemented by subclasses.
-
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSDOMWindowBase.cpp: (WebCore::JSDOMWindowBase::scriptExecutionContext):
-        Implement by returning the associated document. Note that this method currently gives bogus
-        results after navigation - DOMWindow Frame reference is not zeroed out, so we get a document
-        that is currently in the frame, not the one associated with this window.
-
-        * bindings/js/JSDedicatedWorkerConstructor.cpp: Removed unnecessary include of DOMWindow.h.
-
-        * bindings/js/JSDocumentCustom.cpp: (WebCore::JSDocument::mark):
-        Call markActiveObjectsForContext() by its new name.
-
-        * dom/DedicatedWorker.cpp:
-        (WebCore::DedicatedWorker::DedicatedWorker):
-        (WebCore::DedicatedWorker::document):
-        * dom/DedicatedWorker.h:
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::document):
-        * xml/XMLHttpRequest.h:
-        Added a document() function that upcasts ScriptExecutionContext, as these objects only work
-        within documents currently (at least for XMLHttpRequest, this will change soon though).
-
-        * dom/Document.cpp:
-        (WebCore::Document::Document):
-        (WebCore::Document::~Document):
-        Moved active object and MessagePort tracking up to ScriptExecutionContext, to share code
-        with workers.
-        
-        * dom/Document.h:
-        (WebCore::Document::isDocument):
-        (WebCore::Document::refScriptExecutionContext):
-        (WebCore::Document::derefScriptExecutionContext):
-        Inherit from ScriptExecutionContext.
-
-        * dom/MessageChannel.cpp:
-        (WebCore::MessageChannel::MessageChannel):
-        * dom/MessageChannel.h:
-        (WebCore::MessageChannel::create):
-        Use ScriptExecutionContext instead of Document.
-
-        * dom/MessagePort.cpp:
-        (WebCore::CloseMessagePortTimer::CloseMessagePortTimer): Make m_port a RefPtr, because
-        MessagePort doesn't ref() itself when posting this event any more (this is a fix for an
-        unrelated issue that was causing random crashes in layout tests).
-        (WebCore::MessagePort::MessagePort):
-        (WebCore::MessagePort::~MessagePort):
-        (WebCore::MessagePort::associatedFrame):
-        (WebCore::MessagePort::clone):
-        (WebCore::MessagePort::postMessage):
-        (WebCore::MessagePort::startConversation):
-        (WebCore::MessagePort::start):
-        (WebCore::MessagePort::contextDestroyed):
-        (WebCore::MessagePort::dispatchMessages):
-        * dom/MessagePort.h:
-        (WebCore::MessagePort::create):
-        (WebCore::MessagePort::scriptExecutionContext):
-        Use ScriptExecutionContext instead of Document. This is a step toward making MessagePort
-        work in worker contexts - we need to also make some its method thread safe for cross-thread
-        messaging, and make event dispatching thread safe.
-
-        * dom/ScriptExecutionContext.cpp: Added.
-        * dom/ScriptExecutionContext.h: Added.
-        ActiveDOMObject and MessagePort tracking is moved from Document.
-        It is debatable whether ScriptExecutionContext should be a parent of Document or DOMWindow,
-        but as I'm just moving Document code, and it is Document that is the main context object
-        in our implementation currently.
-        Changing ScriptExecutionContext to be a parent of DOMWindow causes a number of bugs that
-        seem non-trivial to fix, and isn't really a part of this task.
-
-2008-10-28  Alp Toker  <alp@nuanti.com>
-
-        List newly-added ImageBufferData.h in build system.
-
-        * GNUmakefile.am:
-
-2008-10-28  Alp Toker  <alp@nuanti.com>
-
-        Reviewed by Cameron Zwarich.
-
-        De-list unused WebCore ForwardingHeaders to fix the dist target.
-
-        * GNUmakefile.am:
-
-2008-10-28  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Attempt to fix the Windows build by generating Forwardingheaders for the
-        runtime directory in JavaScriptCore.
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2008-10-28  Justin Garcia  <justin.garcia@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/5188560> REGRESSION: Spell checker doesn't clear spelling/grammar marker after error is marked as Ignored
-
-        * editing/Editor.cpp:
-        (WebCore::Editor::ignoreSpelling): Remove misspelling markers from the word.
-        (WebCore::Editor::learnSpelling): Added a FIXME about <rdar://problem/5396072>, which 
-        will probably require a change more complicated than just marking the learned word as 
-        misspelled.  I'll address it with a separate patch.
-        * editing/EditorCommand.cpp:
-        (WebCore::executeIgnoreSpelling): Added.
-        (WebCore::CommandEntry::): Added an entry for IgnoreSpelling.
-
-2008-10-28  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        Move ForwardingHeaders to their correct location after the creation of
-        the runtime directory in JavaScriptCore.
-
-        * ForwardingHeaders/kjs/ArrayPrototype.h: Removed.
-        * ForwardingHeaders/kjs/BooleanObject.h: Removed.
-        * ForwardingHeaders/kjs/CallData.h: Removed.
-        * ForwardingHeaders/kjs/ConstructData.h: Removed.
-        * ForwardingHeaders/kjs/DateInstance.h: Removed.
-        * ForwardingHeaders/kjs/Error.h: Removed.
-        * ForwardingHeaders/kjs/FunctionConstructor.h: Removed.
-        * ForwardingHeaders/kjs/FunctionPrototype.h: Removed.
-        * ForwardingHeaders/kjs/InternalFunction.h: Removed.
-        * ForwardingHeaders/kjs/JSArray.h: Removed.
-        * ForwardingHeaders/kjs/JSFunction.h: Removed.
-        * ForwardingHeaders/kjs/JSGlobalObject.h: Removed.
-        * ForwardingHeaders/kjs/JSNumberCell.h: Removed.
-        * ForwardingHeaders/kjs/JSObject.h: Removed.
-        * ForwardingHeaders/kjs/JSString.h: Removed.
-        * ForwardingHeaders/kjs/JSValue.h: Removed.
-        * ForwardingHeaders/kjs/ObjectPrototype.h: Removed.
-        * ForwardingHeaders/kjs/PropertyMap.h: Removed.
-        * ForwardingHeaders/kjs/PrototypeFunction.h: Removed.
-        * ForwardingHeaders/kjs/StringObject.h: Removed.
-        * ForwardingHeaders/kjs/StringObjectThatMasqueradesAsUndefined.h: Removed.
-        * ForwardingHeaders/kjs/StringPrototype.h: Removed.
-        * ForwardingHeaders/kjs/StructureID.h: Removed.
-        * ForwardingHeaders/runtime: Added.
-        * ForwardingHeaders/runtime/ArrayPrototype.h: Copied from ForwardingHeaders/kjs/ArrayPrototype.h.
-        * ForwardingHeaders/runtime/BooleanObject.h: Copied from ForwardingHeaders/kjs/BooleanObject.h.
-        * ForwardingHeaders/runtime/CallData.h: Copied from ForwardingHeaders/kjs/CallData.h.
-        * ForwardingHeaders/runtime/ConstructData.h: Copied from ForwardingHeaders/kjs/ConstructData.h.
-        * ForwardingHeaders/runtime/DateInstance.h: Copied from ForwardingHeaders/kjs/DateInstance.h.
-        * ForwardingHeaders/runtime/Error.h: Copied from ForwardingHeaders/kjs/Error.h.
-        * ForwardingHeaders/runtime/FunctionConstructor.h: Copied from ForwardingHeaders/kjs/FunctionConstructor.h.
-        * ForwardingHeaders/runtime/FunctionPrototype.h: Copied from ForwardingHeaders/kjs/FunctionPrototype.h.
-        * ForwardingHeaders/runtime/InternalFunction.h: Copied from ForwardingHeaders/kjs/InternalFunction.h.
-        * ForwardingHeaders/runtime/JSArray.h: Copied from ForwardingHeaders/kjs/JSArray.h.
-        * ForwardingHeaders/runtime/JSFunction.h: Copied from ForwardingHeaders/kjs/JSFunction.h.
-        * ForwardingHeaders/runtime/JSGlobalObject.h: Copied from ForwardingHeaders/kjs/JSGlobalObject.h.
-        * ForwardingHeaders/runtime/JSNumberCell.h: Copied from ForwardingHeaders/kjs/JSNumberCell.h.
-        * ForwardingHeaders/runtime/JSObject.h: Copied from ForwardingHeaders/kjs/JSObject.h.
-        * ForwardingHeaders/runtime/JSString.h: Copied from ForwardingHeaders/kjs/JSString.h.
-        * ForwardingHeaders/runtime/JSValue.h: Copied from ForwardingHeaders/kjs/JSValue.h.
-        * ForwardingHeaders/runtime/ObjectPrototype.h: Copied from ForwardingHeaders/kjs/ObjectPrototype.h.
-        * ForwardingHeaders/runtime/PropertyMap.h: Copied from ForwardingHeaders/kjs/PropertyMap.h.
-        * ForwardingHeaders/runtime/PrototypeFunction.h: Copied from ForwardingHeaders/kjs/PrototypeFunction.h.
-        * ForwardingHeaders/runtime/StringObject.h: Copied from ForwardingHeaders/kjs/StringObject.h.
-        * ForwardingHeaders/runtime/StringObjectThatMasqueradesAsUndefined.h: Copied from ForwardingHeaders/kjs/StringObjectThatMasqueradesAsUndefined.h.
-        * ForwardingHeaders/runtime/StringPrototype.h: Copied from ForwardingHeaders/kjs/StringPrototype.h.
-        * ForwardingHeaders/runtime/StructureID.h: Copied from ForwardingHeaders/kjs/StructureID.h.
-        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
-        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
-        * bindings/js/JSClipboardCustom.cpp:
-        * bindings/js/JSConsoleCustom.cpp:
-        * bindings/js/JSCustomPositionCallback.h:
-        * bindings/js/JSCustomPositionErrorCallback.h:
-        * bindings/js/JSCustomSQLStatementCallback.h:
-        * bindings/js/JSCustomSQLStatementErrorCallback.h:
-        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
-        * bindings/js/JSCustomVoidCallback.h:
-        * bindings/js/JSCustomXPathNSResolver.h:
-        * bindings/js/JSDOMBinding.cpp:
-        * bindings/js/JSDOMBinding.h:
-        * bindings/js/JSDOMGlobalObject.h:
-        * bindings/js/JSDOMWindowBase.cpp:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        * bindings/js/JSDOMWindowShell.cpp:
-        * bindings/js/JSDatabaseCustom.cpp:
-        * bindings/js/JSEventListener.cpp:
-        * bindings/js/JSEventTarget.h:
-        * bindings/js/JSHTMLDocumentCustom.cpp:
-        * bindings/js/JSHistoryCustom.cpp:
-        * bindings/js/JSInspectedObjectWrapper.cpp:
-        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
-        * bindings/js/JSLocationCustom.cpp:
-        * bindings/js/JSNodeFilterCondition.h:
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        * bindings/objc/WebScriptObject.mm:
-        * bindings/objc/WebScriptObjectPrivate.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/NP_jsobject.cpp:
-        * bridge/c/c_instance.cpp:
-        * bridge/c/c_utility.cpp:
-        * bridge/c/c_utility.h:
-        * bridge/jni/jni_instance.cpp:
-        * bridge/jni/jni_jsobject.h:
-        * bridge/jni/jni_jsobject.mm:
-        * bridge/jni/jni_runtime.cpp:
-        * bridge/jni/jni_utility.cpp:
-        * bridge/jni/jni_utility.h:
-        * bridge/objc/objc_instance.mm:
-        * bridge/objc/objc_runtime.h:
-        * bridge/objc/objc_runtime.mm:
-        * bridge/objc/objc_utility.h:
-        * bridge/objc/objc_utility.mm:
-        * bridge/runtime.h:
-        * bridge/runtime_array.cpp:
-        * bridge/runtime_array.h:
-        * bridge/runtime_method.cpp:
-        * bridge/runtime_method.h:
-        * bridge/runtime_object.cpp:
-        * bridge/runtime_object.h:
-        * bridge/runtime_root.cpp:
-        * inspector/JavaScriptCallFrame.cpp:
-        * inspector/JavaScriptProfile.cpp:
-        * inspector/JavaScriptProfile.h:
-        * inspector/JavaScriptProfileNode.cpp:
-        * inspector/JavaScriptProfileNode.h:
-        * loader/FrameLoader.cpp:
-        * page/Console.cpp:
-        * plugins/PluginView.cpp:
-        * plugins/gtk/PluginViewGtk.cpp:
-        * plugins/qt/PluginViewQt.cpp:
-        * plugins/win/PluginViewWin.cpp:
-
-2008-10-28  Adele Peterson  <adele@apple.com>
-
-        Windows build fix.  This removes Cairo include directories from non-Cairbo build configurations.
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2008-10-28  Adele Peterson  <adele@apple.com>
-
-        Windows build fix.
-
-        * platform/graphics/ImageBuffer.h:
-        (WebCore::ImageBuffer::create):
-
-2008-10-28  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Roll out a mistaken attempt at fixing the GTK build in r37947.
-
-        * GNUmakefile.am:
-
-2008-10-28  Adele Peterson  <adele@apple.com>
-
-        Reviewed by John Sullivan.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21880
-        "files" string for multifile uploads needs to be localized
-
-        * page/mac/WebCoreViewFactory.h:
-        * platform/LocalizedStrings.h:
-        * platform/gtk/FileChooserGtk.cpp: (WebCore::FileChooser::basenameForWidth):
-        * platform/gtk/LocalizedStringsGtk.cpp: (WebCore::multipleFileUploadText):
-        * platform/mac/FileChooserMac.mm: (WebCore::FileChooser::basenameForWidth):
-        * platform/mac/LocalizedStringsMac.mm: (WebCore::multipleFileUploadText):
-        * platform/qt/Localizations.cpp: (WebCore::multipleFileUploadText):
-        * platform/wx/LocalizedStringsWx.cpp: (WebCore::multipleFileUploadText):
-
-2008-10-28  Brett Wilson  <brettw@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21816
-
-        Remove platform ifdefs in ImageBuffer.h by moving platform specific code
-        into a new PlatformImageBuffer class. Move the static create function
-        into the header because it can be cross-platform. Initialization now
-        happens in the cunstructor which sets a flag that create uses to know
-        whether it should return null or not. I also made passing of IntSize
-        more consistent (always by reference).
-
-        This change also changes the ifdefs in GraphicsContext to allow Skia
-        ports to implement text drawing modes.
-
-        * platform/graphics/ImageBuffer.h:
-        (WebCore::ImageBuffer::create):
-        (WebCore::ImageBuffer::size):
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        (WebCore::ImageBufferData::ImageBufferData):
-        (WebCore::ImageBuffer::ImageBuffer):
-        (WebCore::ImageBuffer::~ImageBuffer):
-        (WebCore::ImageBuffer::image):
-        (WebCore::ImageBuffer::getImageData):
-        (WebCore::ImageBuffer::putImageData):
-        * platform/graphics/cairo/ImageBufferData.h:
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::ImageBufferData::ImageBufferData):
-        (WebCore::ImageBuffer::ImageBuffer):
-        (WebCore::ImageBuffer::~ImageBuffer):
-        (WebCore::ImageBuffer::getImageData):
-        (WebCore::ImageBuffer::putImageData):
-        * platform/graphics/cg/ImageBufferData.h:
-        * platform/graphics/qt/ImageBufferData.h:
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::ImageBufferData::ImageBufferData):
-        (WebCore::ImageBuffer::ImageBuffer):
-        (WebCore::ImageBuffer::~ImageBuffer):
-
-2008-10-28  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Fix the GTK build.
-
-        * GNUmakefile.am:
-
-2008-10-28  Cameron Zwarich  <zwarich@apple.com>
-
-        Not reviewed.
-
-        Another Qt build fix.
-
-        * WebCore.pro:
-
-2008-10-28  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by David Kilzer.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21932
-        Add non-pointer constant lookups to SoftLinking.h
-
-        * platform/mac/SoftLinking.h:
-
-2008-10-28  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by David Kilzer.
-
-        https://bugs.webkit.org/show_bug.cgi?id=2192
-        Missing semi-colons in Geoposition.idl
-
-        * page/Geoposition.idl: Add missing semi-colons
-
-2008-10-28  Timothy Hatcher  <timothy@apple.com>
-
-        Make the Profiles panel in the Web Inspector have an enable screen.
-        Profiling now needs to be enabled before console.profile() works.
-
-        <rdar://problem/6211578> Make the JavaScript profiler opt-in, so it does
-        not slow down JavaScript all the time
-
-        Reviewed by Darin Adler and Kevin McCullough.
-
-        * English.lproj/localizedStrings.js: New strings.
-        * WebCore.base.exp: New and changed exports.
-        * WebCore.vcproj/WebCore.vcproj: Add the PanelEnablerView.js file.
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::supportsProfiling): Call InspectorController:profilerEnabled.
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::InspectorController): Initialize the m_startProfiling
-        Timer to call InspectorController::startUserInitiatedProfiling.
-        (WebCore::InspectorController::startUserInitiatedProfilingSoon): Start a one-shot timer
-        that calls InspectorController::startUserInitiatedProfiling.
-        (WebCore::InspectorController::startUserInitiatedProfiling): Recompile all JavaScript
-        and enable the profiler if the profiler was not enabled.
-        (WebCore::InspectorController::stopUserInitiatedProfiling): Rearrange code for readability.
-        (WebCore::InspectorController::enableProfiler): Recompile all the JavaScript functions
-        if the skipRecompile argument is false. Call the profilerWasEnabled script function.
-        (WebCore::InspectorController::disableProfiler): Recompile all the JavaScript functions.
-        Call the profilerWasEnabled script function.
-        (WebCore::InspectorController::disableDebugger): Set m_attachDebuggerWhenShown to false,
-        so it won't be started later.
-        * inspector/InspectorController.h:
-        (WebCore::InspectorController::profilerEnabled): Return enabled() && m_profilerEnabled.
-        * inspector/front-end/Images/debuggingButtons.png: Remove.
-        * inspector/front-end/Images/enableButtons.png: Added.
-        * inspector/front-end/Images/profilesSilhouette.png: Added.
-        * inspector/front-end/Images/scriptsSilhouette.png: Added.
-        * inspector/front-end/PanelEnablerView.js: Added.
-        (WebInspector.PanelEnablerView):
-        (WebInspector.PanelEnablerView.prototype._enableButtonCicked): Fire the "enable clicked"
-        event so listeners can do their thing.
-        (WebInspector.PanelEnablerView.prototype._windowResized): Test if the icon should be hidden.
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel): Create the PanelEnablerView and the strings needed for it.
-        (WebInspector.ProfilesPanel.prototype.get statusBarItems): Include the enableToggleButton.
-        (WebInspector.ProfilesPanel.prototype.profilerWasEnabled): Call reset and populateInterface.
-        (WebInspector.ProfilesPanel.prototype.profilerWasDisabled): Call reset.
-        (WebInspector.ProfilesPanel.prototype.reset): Call _updateInterface.
-        (WebInspector.ProfilesPanel.prototype.setRecordingProfile): Moved in the code, no changes.
-        (WebInspector.ProfilesPanel.prototype._updateInterface): Update the toggle button and
-        show/hide other buttons. Also show/hide the PanelEnablerView.
-        (WebInspector.ProfilesPanel.prototype._enableProfiling): Call _toggleProfiling if not enabled.
-        (WebInspector.ProfilesPanel.prototype._toggleProfiling): Call InspectorController's
-        disableProfiler or enableProfiler.
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel): Replace the overlay element with a PanelEnablerView. Replace the
-        debuggingButton with the enableToggleButton.
-        (WebInspector.ScriptsPanel.prototype.get statusBarItems): Replace the debuggingButton with
-        the enableToggleButton.
-        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons): Hide/show the pauseOnExceptionButton
-        when needed. Replace the overlay element with a PanelEnablerView. Replace the debuggingButton
-        with the enableToggleButton.
-        (WebInspector.ScriptsPanel.prototype._enableDebugging): Call _toggleDebugging when not enabled.
-        (WebInspector.ScriptsPanel.prototype._toggleDebugging): Remove the call to _clearInterface,
-        since reset is called from debuggerWasEnabled and debuggerWasDisabled.
-        * inspector/front-end/View.js: Inherit from WebInspector.Object.
-        * inspector/front-end/WebKit.qrc: Add the PanelEnablerView.js file.
-        * inspector/front-end/inspector.css: New styles for the PanelEnablerView.
-        * inspector/front-end/inspector.html: Add the PanelEnablerView.js file.
-        * inspector/front-end/inspector.js:
-        (WebInspector.profilerWasEnabled): Added. Calls the ProfilesPanel.
-        (WebInspector.profilerWasDisabled): Ditto.
-        * page/Console.cpp:
-        (WebCore::Console::error): Remove null check for m_frame, since m_frame isn't used.
-        (WebCore::Console::info): Ditto.
-        (WebCore::Console::log): Ditto.
-        (WebCore::Console::assertCondition): Ditto.
-        (WebCore::Console::dirxml): Remove null check for m_frame and use this->page().
-        (WebCore::Console::count): Ditto.
-        (WebCore::Console::profile): Return early if InspectorController::profilerEnabled is false.
-        (WebCore::Console::profileEnd): Ditto.
-        (WebCore::Console::warn): Remove null check for m_frame, since m_frame isn't used.
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings): Remove initialization of m_didInitializeDeveloperExtrasEnabled.
-        (WebCore::Settings::setDeveloperExtrasEnabled): Remove code that recompiled functions.
-        Now just sets the member boolean.
-        * page/Settings.h: Remove m_didInitializeDeveloperExtrasEnabled.
-
-2008-10-28  Timothy Hatcher  <timothy@apple.com>
-
-        Rename a few methods related to attaching and detaching the debugger. Also
-        adds stub methods for enabling and disabling the profiler.
-
-        * Rename attachDebugger to enableDebugger.
-        * Rename detachDebugger to disableDebugger.
-        * Rename the debuggerAttached getter to debuggerEnabled.
-        * Rename the debuggerAttached callback to debuggerWasEnabled.
-        * Rename the debuggerDetached callback to debuggerWasDisabled.
-
-        Reviewed by Darin Adler.
-
-        * WebCore.base.exp:
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::InspectorController):
-        (WebCore::InspectorController::setWindowVisible):
-        (WebCore::InspectorController::windowScriptObjectAvailable):
-        (WebCore::InspectorController::close):
-        (WebCore::InspectorController::enableProfiler):
-        (WebCore::InspectorController::disableProfiler):
-        (WebCore::InspectorController::enableDebugger):
-        (WebCore::InspectorController::disableDebugger):
-        (WebCore::InspectorController::pauseInDebugger):
-        (WebCore::InspectorController::resumeDebugger):
-        (WebCore::InspectorController::stepOverStatementInDebugger):
-        (WebCore::InspectorController::stepIntoStatementInDebugger):
-        (WebCore::InspectorController::stepOutOfFunctionInDebugger):
-        * inspector/InspectorController.h:
-        (WebCore::InspectorController::profilerEnabled):
-        (WebCore::InspectorController::debuggerEnabled):
-        * inspector/front-end/BreakpointsSidebarPane.js:
-        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
-        (WebInspector.BreakpointsSidebarPane.prototype.removeBreakpoint):
-        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
-        * inspector/front-end/Object.js:
-        * inspector/front-end/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel):
-        * inspector/front-end/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel):
-        (WebInspector.ScriptsPanel.prototype.get statusBarItems):
-        (WebInspector.ScriptsPanel.prototype.debuggerWasEnabled):
-        (WebInspector.ScriptsPanel.prototype.debuggerWasDetached):
-        (WebInspector.ScriptsPanel.prototype.reset):
-        (WebInspector.ScriptsPanel.prototype.canShowResource):
-        (WebInspector.ScriptsPanel.prototype._updatePauseOnExceptionsButton):
-        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
-        (WebInspector.ScriptsPanel.prototype._toggleDebugging):
-        * inspector/front-end/View.js:
-        * inspector/front-end/inspector.css:
-        * inspector/front-end/inspector.html:
-        * inspector/front-end/inspector.js:
-        (WebInspector.addResource):
-        (WebInspector.debuggerWasEnabled):
-        (WebInspector.debuggerWasDisabled):
-
-2008-10-28  Timothy Hatcher  <timothy@apple.com>
-
-        Fix an exception when searching the Resources panel while there
-        and resources queued to be added to the list.
-
-        Reviewed by Kevin McCullough.
-
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype.searchCanceled): Null check
-        the _resourcesTreeElement property.
-        (WebInspector.ResourcesPanel.prototype.performSearch): Ditto.
-
-2008-10-28  Alp Toker  <alp@nuanti.com>
-
-        GTK+ build fix for older versions of Pango where PANGO_VERSION_CHECK
-        isn't defined.
-
-        * platform/graphics/gtk/FontGtk.cpp:
-        (WebCore::getDefaultPangoLayout):
-        * platform/graphics/gtk/FontPlatformDataPango.cpp:
-
-2008-10-28  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21893
-        Character set is incorrect for external scripts in XHTML pages
-
-        <rdar://problem/6317451> Incorrect encoding for text in a popup at http://xpoint.ru/
-
-        Test: fast/encoding/external-script-charset.xhtml
-
-        Expose scriptCharset() function on all ScriptElements, and call it from XML tokenizer.
-
-        * dom/ScriptElement.h:
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::XMLTokenizer::endElementNs):
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::parseEndElement):
-        * html/HTMLScriptElement.h:
-        * svg/SVGScriptElement.cpp:
-        (WebCore::SVGScriptElement::scriptCharset):
-        * svg/SVGScriptElement.h:
-
-2008-10-28  Alp Toker  <alp@nuanti.com>
-
-        Include copyright license files in the autotools dist target and
-        exclude unused zlib headers.
-
-        Change suggested by Mike Hommey.
-
-        * GNUmakefile.am:
-
-2008-10-27  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Clear the window shell when destroying a page to allow documents
-        which have no way of being reached anymore, to be torn down.
-
-        * page/Frame.cpp:
-        (WebCore::Frame::pageDestroyed):
-
-2008-10-27  Kevin Watters  <kevinwatters@gmail.com>
-
-        Reviewed by Kevin Ollivier.
-        
-        Update the active state as well as the focused state as both need to be true
-        for the caret to be drawn.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=21900
-
-        * WebView.cpp:
-        (wxWebView::OnSetFocus):
-        (wxWebView::OnKillFocus):
-
-2008-10-27  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix on Linux/GTK. Enable support for #include <JavaScriptCore/XYZ.h> style includes.
-
-        * webcore-wx.bkl:
-
-2008-10-27  Michael Knaup  <michael.knaup@mac.com>
-
-        Reviewed and tweaked by Darin Adler.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=8988
-
-        Bug 8988: Add support for Mozilla CSS custom cursors.
-        Added -webkit-grab and -webkit-grabbing cursor suppport
-        for the Mac, dummy implementations for other platforms.
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue): Updated since the
-        -webkit-grabbing cursor is now the last one.
-
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Added
-        CURSOR_WEBKIT_GRAB and CURSOR_WEBKIT_GRABBING.
-
-        * css/CSSValueKeywords.in: Added -webkit-grab and
-        -webkit-grabbing.
-
-        * manual-tests/cursor.html: Added -webkit-zoom-in,
-        webkit-zoom-out, -webkit-grab, and -webkit-grabbing.
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::selectCursor): Added
-        CURSOR_WEBKIT_GRAB and CURSOR_WEBKIT_GRABBING.
-
-        * platform/Cursor.h: Added grabCursor and grabbingCursor.
-
-        * platform/gtk/CursorGtk.cpp:
-        (WebCore::grabCursor): Added.
-        (WebCore::grabbingCursor): Added.
-        * platform/mac/CursorMac.mm:
-        (WebCore::grabCursor): Added.
-        (WebCore::grabbingCursor): Added.
-        * platform/qt/CursorQt.cpp:
-        (WebCore::grabCursor): Added.
-        (WebCore::grabbingCursor): Added.
-        * platform/win/CursorWin.cpp:
-        (WebCore::grabCursor): Added.
-        (WebCore::grabbingCursor): Added.
-        * platform/wx/CursorWx.cpp:
-        (WebCore::grabCursor): Added.
-        (WebCore::grabbingCursor): Added.
-
-        * rendering/style/RenderStyleConstants.h:
-        Added CURSOR_WEBKIT_GRAB and CURSOR_WEBKIT_GRABBING.
-        Also broke ECursor out into a single constant per line.
-        Also added a couple of comments.
-
-2008-10-27  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        * svg/SVGAnimatedTemplate.h: needed a HashMap define
-
-2008-10-21  Eric Seidel  <eric@webkit.org>
+        * css/html4.css:
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::createRenderer):
+        * html/HTMLDataGridElement.h:
+        * html/HTMLDataGridElement.idl:
+        * rendering/RenderDataGrid.cpp: Added.
+        (WebCore::RenderDataGrid::RenderDataGrid):
+        (WebCore::RenderDataGrid::~RenderDataGrid):
+        (WebCore::RenderDataGrid::calcPrefWidths):
+        (WebCore::RenderDataGrid::paintObject):
+        (WebCore::RenderDataGrid::valueChanged):
+        (WebCore::RenderDataGrid::invalidateScrollbarRect):
+        (WebCore::RenderDataGrid::isActive):
+        * rendering/RenderDataGrid.h: Added.
+        (WebCore::RenderDataGrid::renderName):
+        (WebCore::RenderDataGrid::canHaveChildren):
+        (WebCore::RenderDataGrid::scrollbarCornerPresent):
+
+2009-06-22  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Dave Hyatt.
 
-        Infinite recursion crash in WebCore::RenderSVGRoot::absoluteClippedOverflowRect on a <stop> element outside of a gradient block
-        https://bugs.webkit.org/show_bug.cgi?id=20400
-
-        Test: svg/custom/stop-crash.svg
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * rendering/RenderSVGGradientStop.h:
-        (WebCore::RenderSVGGradientStop::absoluteClippedOverflowRect):
-
-2008-10-27  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        No need to call release if the connection is null.
-        
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::start):
-
-2008-10-27  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Kevin Decker.
-
-        <rdar://problem/6322650> Crash in fast/loader/simultaneous-reloads-assert.html
-        
-        Make sure to null check the NSURLConnection object.
-        
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::start):
-        (WebCore::ResourceHandle::setDefersLoading):
-
-2008-10-27  Alexey Proskuryakov  <ap@webkit.org>
-
-        Fix non-Mac builds.
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCoreSources.bkl:
-        Renamed JSHTMLOptionElementConstructor to JSOptionConstructor.
-
-2008-10-26  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21886
-        window.HTMLOptionElement == "[object HTMLElementConstructor]" instead of HTMLOptionElementConstructor
-
-        Test: fast/dom/HTMLOptionElement/option-prototype.html
-
-        We now have separate objects for window.Option and window.HTMLOptionElement - the latter
-        "constructor" cannot be used to construct anything. This matches Firefox behavior.
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWindowBase.cpp:
-        (jsDOMWindowBaseOption):
-        * bindings/js/JSHTMLOptionElementConstructor.cpp: Removed.
-        * bindings/js/JSHTMLOptionElementConstructor.h: Removed.
-        * bindings/js/JSOptionConstructor.cpp: Copied from WebCore/bindings/js/JSHTMLOptionElementConstructor.cpp.
-        * bindings/js/JSOptionConstructor.h: Copied from WebCore/bindings/js/JSHTMLOptionElementConstructor.h.
-        * html/HTMLOptionElement.idl:
-        Renamed JSHTMLOptionElementConstructor to JSOptionConstructor.
-
-        * html/HTMLOptionElement.idl: Generate a constructor.
-
-2008-10-25  Geoffrey Garen  <ggaren@apple.com>
-
-        Not reviewed.
-        
-        Try to fix Mac debug build on the buildbot.
-
-        * platform/FileChooser.cpp:
-        (WebCore::FileChooserClient::~FileChooserClient):
-        * platform/FileChooser.h: Moved destructor to .cpp file, to avoid a
-        weak exported symbol.
-
-2008-10-25  Jade Han  <jade.han@nokia.com>
-
-        Reviewed by Anders.
-
-        Enable custom properties for Qt runtime objects in QtWebKit
-
-        https://bugs.webkit.org/show_bug.cgi?id=21813
-
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::getOwnPropertySlot):
-        (JSC::RuntimeObjectImp::put):
-
-2008-10-24  Sam Weinig  <sam@webkit.org>
-
-        Fix windows build.
-
-        * page/Chrome.cpp:
-        * page/Chrome.h:
-
-2008-10-24  Sam Weinig  <sam@webkit.org>
-
-        Fix Qt build.
-
-        * platform/qt/FileChooserQt.cpp:
-
-2008-10-24  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Fix https://bugs.webkit.org/show_bug.cgi?id=21759
-        Layering violation: FileChooser should not depend on Document/Frame/Page
-
-        Move file choosing into WebKit ChromeClient.
-
-        * loader/EmptyClients.h:
-        (WebCore::EmptyChromeClient::runOpenPanel):
-        * page/Chrome.cpp:
-        (WebCore::Chrome::runOpenPanel):
-        * page/Chrome.h:
-        * page/ChromeClient.h:
-        * page/mac/ChromeMac.mm:
-        * platform/FileChooser.h:
-        * platform/mac/FileChooserMac.mm:
-        * platform/qt/FileChooserQt.cpp:
-        * platform/win/FileChooserWin.cpp:
-        * platform/wx/TemporaryLinkStubs.cpp:
-        * rendering/RenderFileUploadControl.cpp:
-        (WebCore::RenderFileUploadControl::click):
-
-2008-10-24  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix - add newIconForFiles stub.
-
-        * platform/wx/TemporaryLinkStubs.cpp:
-        (Icon::newIconForFiles):
-
-2008-10-24  Kevin Watters  <kevinwatters@gmail.com>
-
-        Reviewed by Kevin Ollivier.
-
-        Use the CGFont metrics APIs for more accurate measurements, and tweak the y
-        value the text is drawn at (it was a couple pixels off before because wx
-        internally adds to the y value.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21853
-
-        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
-        (wxFontProperties::wxFontProperties):
-        * platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp:
-        (WebCore::drawTextWithSpacing):
-
-2008-10-24  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Sam Weinig.
-
-        Generate missing constructors and add test to prevent missing ones in the future
-        https://bugs.webkit.org/show_bug.cgi?id=21846
-
-        Test: fast/js/global-constructors.html
-
-        * css/CSSStyleSheet.idl:
-        * css/RGBColor.idl:
-        * dom/NodeIterator.idl:
-        * dom/TreeWalker.idl:
-        * xml/XPathExpression.idl:
-
-2008-10-24  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21836
-        REGRESSION: Sign-in on Fancast.com causes crash in Webkit nightly
-
-        Test: http/tests/xmlhttprequest/detaching-frame.html
-
-        * xml/XMLHttpRequest.cpp: (WebCore::XMLHttpRequest::dropProtection): Null check the window -
-        even though XHR needs a context (AKA frame) to be serviced, the frame may be disconnected
-        when dispatching the same callback that results in this function being called.
-
-2008-10-24  David Kilzer  <ddkilzer@apple.com>
-
-        Gtk build fix.
-
-        * platform/gtk/TemporaryLinkStubs.cpp:
-        (WebCore::setFocusRingColorChangeFunction): Removed in r37858.
-
-2008-10-24  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        <rdar://problem/6164952> Use constant kCGInterpolationMedium in GraphicsContextCG.cpp rather than hard-coded values.
-
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::GraphicsContext::setImageInterpolationQuality):
-        (WebCore::GraphicsContext::imageInterpolationQuality):
-
-2008-10-24  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        <rdar://problem/5440917> Support NPN_Construct
-                
-        * WebCore.NPAPI.exp:
-        Export _NPN_Construct.
+        https://bugs.webkit.org/show_bug.cgi?id=26430
+        <rdar://problem/6944442> Elements jump around when they become composited (WWDC checkers demo)
+        <rdar://problem/6989006> Lots of time spent in RenderLayerCompositor::calculateCompositedBounds()
+            during window resize when using hardware layers
         
-        * bridge/NP_jsobject.cpp:
-        (_NPN_Construct):
-        Implement this.
-        
-        * bridge/c/c_instance.cpp:
-        (JSC::Bindings::CInstance::supportsConstruct):
-        (JSC::Bindings::CInstance::invokeConstruct):
-        Have this call the appropriate NPClass method.
-        
-        * bridge/npruntime.h:
-        Add NPN_Construct.
-
-        * bridge/npruntime_impl.h:
-        Add _NPN_Construct.
+        Fix an ordering dependency which caused the compositing position of a layer
+        to be affected by some later sibling, which affected the compositing ancestor's
+        composited bounds.
         
-        * bridge/runtime.h:
-        (JSC::Bindings::Instance::supportsConstruct):
-        (JSC::Bindings::Instance::invokeConstruct):
-        New methods.
+        The fix is to only update the compositing positions of layers in some subtree
+        when updateAfterLayout() has been called on all the layers in that subtree,
+        from the ancestor down.
         
-        * bridge/runtime_object.cpp:
-        (JSC::callRuntimeConstructor):
-        Call the native instance.
+        Also cache the composited bounds of a RenderLayerBacking, now that we can
+        guarantee that those bounds are accurate.
         
-        (JSC::RuntimeObjectImp::getConstructData):
-        Implement this.
-        
-        * bridge/runtime_object.h:
-        Add new method declarations.
-        
-        * plugins/gtk/PluginPackageGtk.cpp:
-        (WebCore::PluginPackage::load):
-        * plugins/qt/PluginPackageQt.cpp:
-        (WebCore::PluginPackage::load):
-        * plugins/win/PluginPackageWin.cpp:
-        (WebCore::PluginPackage::load):
-        Initialize m_pluginFuncs.construct.
-
-2008-10-24  Adele Peterson  <adele@apple.com>
-
-        Build fix.
-
-        * platform/FileChooser.h: (WebCore::FileChooserClient::~FileChooserClient):
-        * platform/graphics/mac/IconMac.mm: (WebCore::Icon::newIconForFiles):
-
-2008-10-24  Greg Bolsinga  <bolsinga@apple.com>
-
-        Fix GTK build break.
-
-        Reviewed by David Kilzer.
-
-        * GNUmakefile.am: Do not include .idl files whose generated files should not be
-        compiled.
-
-2008-10-24  David Kilzer  <ddkilzer@apple.com>
-
-        Wx build fix.
-
-        * platform/wx/TemporaryLinkStubs.cpp:
-        (WebCore::setFocusRingColorChangeFunction): Removed in r37858.
-
-2008-10-24  Adele Peterson  <adele@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        WebCore part of fix for <rdar://problem/5839256> FILE CONTROL: multi-file upload.
-
-        This change adds support for multiple file selection in an <input type="file"> control when the "multiple" attribute is used.
-        This is consistent with the direction HTML5 will be going in the future.
-
-        The initial implementation here will show "n files" as the text next to the control when multiple files are selected.  You can view
-        the individual files in a tooltip for now.  Improvements to this control will come later.  
-
-        Web developers will be able to access the FileList from the HTMLInputElement element, where they can get a base name and a size for each file.  
-        These FileList Files can also be sent in an XMLHTTPRequest.
-
-        * manual-tests/post-multi-file-upload.html: Added.
-        * manual-tests/resources/multiFileResources: Added.
-        * manual-tests/resources/multiFileResources/post-echo-and-notify-done.cgi: Added.
-        * manual-tests/resources/multiFileResources/testFile1.html: Added.
-        * manual-tests/resources/multiFileResources/testFile2.html: Added.
-        * manual-tests/resources/multiFileResources/testFile3.html: Added.
-
-        * WebCore.base.exp: Added support to export the new "chooseFilenames" method to be used in WebKit.
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::parseMappedAttribute): Add support for the multiple attribute.
-        (WebCore::HTMLInputElement::value): Added comments.  The HTML5 spec says that value shouldn't apply for the file upload control,
-        but we don't want to break the behavior for existing websites that may rely on this.
-        (WebCore::HTMLInputElement::setValue): ditto.
-        (WebCore::HTMLInputElement::setValueFromRenderer): This is no longer used for file upload controls. setFileListFromRenderer is used instead.
-        (WebCore::HTMLInputElement::setFileListFromRenderer): Added. 
-        * html/HTMLInputElement.h:
-
-        * page/Chrome.cpp: (WebCore::Chrome::setToolTip): Show a tooltip with the file name list for the multi-file upload control.
-
-        * page/DragController.cpp: (WebCore::DragController::concludeDrag): Updated to support multiple files.
-
-        * platform/FileChooser.cpp: Add support for maintaining a list of file paths that can be retrieved by the renderer.
-        (WebCore::FileChooser::FileChooser):
-        (WebCore::FileChooser::create):
-        (WebCore::FileChooser::clear):
-        (WebCore::FileChooser::chooseFile):
-        (WebCore::FileChooser::chooseFiles):
-        (WebCore::FileChooser::chooseIcon):
-        * platform/FileChooser.h:
-        (WebCore::FileChooser::filePaths):
-        (WebCore::FileChooser::allowsMultipleFiles):
-
-        * platform/graphics/Icon.h:
-        * platform/graphics/mac/IconMac.mm: (WebCore::Icon::newIconForFiles): Returns a generic icon for multiple files.
-        * platform/graphics/gtk/IconGtk.cpp: (WebCore::Icon::newIconForFiles): stubbed out.
-        * platform/graphics/qt/IconQt.cpp: (WebCore::Icon::newIconForFiles): ditto.
-        * platform/graphics/win/IconWin.cpp: (WebCore::Icon::newIconForFiles): ditto.
-
-        * platform/gtk/FileChooserGtk.cpp: (WebCore::FileChooser::basenameForWidth):  Updated to deal with new filenames vector.
-        * platform/mac/FileChooserMac.mm: (WebCore::FileChooser::basenameForWidth): ditto.
-        * platform/qt/FileChooserQt.cpp:
-        (WebCore::FileChooser::openFileChooser):
-        (WebCore::FileChooser::basenameForWidth):
-        * platform/win/FileChooserWin.cpp: (WebCore::FileChooser::basenameForWidth):
-
-        * platform/network/mac/FormDataStreamMac.mm: (WebCore::disassociateStreamWithResourceHandle):
-        Removed unnecessary assertion.  This can get hit when connectionDidFinishLoading and cancel
-        both get called for the same ResourceHandle.  This getting called twice has no negative effect.
-
-        * rendering/RenderFileUploadControl.cpp:
-        (WebCore::RenderFileUploadControl::valueChanged):  Calls setFileListFromRenderer.
-        (WebCore::RenderFileUploadControl::allowsMultipleFiles):  Added.
-        (WebCore::RenderFileUploadControl::updateFromElement):  Uses the new filenames call from FileChooser.
-        (WebCore::RenderFileUploadControl::receiveDroppedFiles):  Updated to support multiple files.
-        * rendering/RenderFileUploadControl.h:
-
-2008-10-23  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by David Hyatt.
+        Test: compositing/sibling-positioning.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=21844
-        Remove setFocusRingColorChangeFunction.
-
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        * platform/graphics/Color.h:
-        * platform/graphics/mac/ColorMac.mm:
-        (WebCore::focusRingColor):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        * platform/graphics/win/ColorSafari.cpp:
-
-2008-10-24  David Kilzer  <ddkilzer@apple.com>
-
-        Build fix for Qt.
-
-        Reviewed by Greg.
-
-        * WebCore.pro: Added missing *.idl files.
-
-2008-10-24  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21475
-        
-        Provide support for the Geolocation API
-        
-        http://dev.w3.org/geo/api/spec-source.html
-
-        Test: geolocation/geolocation-not-implemented.html
-
-        * DerivedSources.make:
-        * GNUmakefile.am: Added Geolocation support
-        * WebCore.pro: Added Geolocation support
-        * WebCore.vcproj/WebCore.vcproj: Added Geolocation support
-        * WebCore.xcodeproj/project.pbxproj: Added Geolocation support
-        * WebCoreSources.bkl: Added Geolocation support
-        * bindings/js/JSCustomPositionCallback.cpp: Added.
-        (WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
-        (WebCore::JSCustomPositionCallback::handleEvent):
-        * bindings/js/JSCustomPositionCallback.h: Added.
-        (WebCore::JSCustomPositionCallback::create):
-        * bindings/js/JSCustomPositionErrorCallback.cpp: Added.
-        (WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
-        (WebCore::JSCustomPositionErrorCallback::handleEvent):
-        * bindings/js/JSCustomPositionErrorCallback.h: Added.
-        (WebCore::JSCustomPositionErrorCallback::create):
-        * bindings/js/JSDOMBinding.cpp: move markDOMObjectWrapper here from JSDOMWindowCustom
-        (WebCore::markDOMObjectWrapper):
-        * bindings/js/JSDOMBinding.h: move markDOMObjectWrapper here from JSDOMWindowCustom
-        * bindings/js/JSDOMWindowCustom.cpp: move markDOMObjectWrapper to JSDOMBinding
-        * bindings/js/JSGeolocationCustom.cpp: Added.
-        (WebCore::JSGeolocation::getCurrentPosition):
-        (WebCore::JSGeolocation::watchPosition):
-        * bindings/js/JSNavigatorCustom.cpp: handle marking Geolocation
-        (WebCore::JSNavigator::mark):
-        * dom/Document.cpp:
-        (WebCore::Document::Document):
-        * dom/Document.h:
-        (WebCore::Document::setUsingGeolocation):
-        (WebCore::Document::usingGeolocation):
-        * loader/FrameLoader.cpp: don't add to back forward cache if using Geolocation
-        (WebCore::FrameLoader::canCachePage):
-        * page/Geolocation.cpp: Added.
-        (WebCore::Geolocation::GeoNotifier::GeoNotifier):
-        (WebCore::Geolocation::GeoNotifier::timerFired):
-        (WebCore::Geolocation::Geolocation):
-        (WebCore::Geolocation::disconnectFrame):
-        (WebCore::Geolocation::getCurrentPosition):
-        (WebCore::Geolocation::watchPosition):
-        (WebCore::Geolocation::clearWatch):
-        (WebCore::Geolocation::stopUpdatingIfEmpty):
-        (WebCore::Geolocation::sendErrorToOneShots):
-        (WebCore::Geolocation::sendErrorToWatchers):
-        (WebCore::Geolocation::sendPositionToOneShots):
-        (WebCore::Geolocation::sendPositionToWatchers):
-        (WebCore::Geolocation::handleError):
-        (WebCore::Geolocation::geolocationServicePositionChanged):
-        (WebCore::Geolocation::geolocationServiceErrorOccurred):
-        * page/Geolocation.h: Added.
-        (WebCore::Geolocation::create):
-        (WebCore::Geolocation::~Geolocation):
-        (WebCore::Geolocation::lastPosition):
-        (WebCore::Geolocation::GeoNotifier::create):
-        * page/Geolocation.idl: Added.
-        * page/Geoposition.cpp: Added.
-        (WebCore::Geoposition::toString):
-        * page/Geoposition.h: Added.
-        (WebCore::Geoposition::create):
-        (WebCore::Geoposition::latitude):
-        (WebCore::Geoposition::longitude):
-        (WebCore::Geoposition::altitude):
-        (WebCore::Geoposition::accuracy):
-        (WebCore::Geoposition::altitudeAccuracy):
-        (WebCore::Geoposition::heading):
-        (WebCore::Geoposition::velocity):
-        (WebCore::Geoposition::timestamp):
-        (WebCore::Geoposition::Geoposition):
-        * page/Geoposition.idl: Added.
-        * page/Navigator.cpp:
-        (WebCore::Navigator::disconnectFrame): disconnect Geolocation
-        (WebCore::Navigator::geolocation): accessor for Geolocation
-        * page/Navigator.h:
-        (WebCore::Navigator::optionalGeolocation): accessor for Geolocation
-        * page/Navigator.idl: accessor for Geolocation
-        * page/PositionCallback.h: Added.
-        (WebCore::PositionCallback::~PositionCallback):
-        * page/PositionCallback.idl: Added.
-        * page/PositionError.h: Added.
-        (WebCore::PositionError::):
-        (WebCore::PositionError::create):
-        (WebCore::PositionError::code):
-        (WebCore::PositionError::message):
-        (WebCore::PositionError::PositionError):
-        * page/PositionError.idl: Added.
-        * page/PositionErrorCallback.h: Added.
-        (WebCore::PositionErrorCallback::~PositionErrorCallback):
-        * page/PositionErrorCallback.idl: Added.
-        * page/PositionOptions.h: Added.
-        (WebCore::PositionOptions::create):
-        (WebCore::PositionOptions::enableHighAccuracy):
-        (WebCore::PositionOptions::setEnableHighAccuracy):
-        (WebCore::PositionOptions::timeout):
-        (WebCore::PositionOptions::setTimeout):
-        (WebCore::PositionOptions::PositionOptions):
-        * page/PositionOptions.idl: Added.
-        * platform/GeolocationService.cpp: Added.
-        (WebCore::GeolocationService::GeolocationService):
-        (WebCore::GeolocationService::positionChanged):
-        (WebCore::GeolocationService::errorOccurred):
-        * platform/GeolocationService.h: Added.
-        (WebCore::GeolocationServiceClient::~GeolocationServiceClient):
-        (WebCore::GeolocationServiceClient::geolocationServicePositionChanged):
-        (WebCore::GeolocationServiceClient::geolocationServiceErrorOccurred):
-        (WebCore::GeolocationService::~GeolocationService):
-
-2008-10-24  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler
-
-        https://bugs.webkit.org/show_bug.cgi?id=21818
-        
-        Add HashTraits for AtomicString so that AtomicString can be used as
-        the key for a HashMap or HashSet.
-
-        * GNUmakefile.am: add AtomicStringHash.h
-        * WebCore.vcproj/WebCore.vcproj: add AtomicStringHash.h
-        * WebCore.xcodeproj/project.pbxproj: add AtomicStringHash.h
-        * platform/text/AtomicString.h:
-        (WebCore::AtomicString::AtomicString):
-        (WebCore::AtomicString::isHashTableDeletedValue):
-            specialize DefaultHash for AtomicString to use AtomicStringHash
-        * platform/text/AtomicStringHash.h: Added.
-        * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::StringImpl):
-            compute the hash up-front for the empty string
-        * platform/text/StringImpl.h:
-        (WebCore::StringImpl::existingHash):
-            method to get the hash without a test and branch, for callers like
-            AtomicStringHash who can guarantee that the hash has already been computed.
-
-2008-10-24  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Sam Weinig
-
-        https://bugs.webkit.org/show_bug.cgi?id=21857
-
-        Add WebKitCSSKeyframeRule and WebKitCSSKeyframesRule to the
-        switch in _wrapCSSRule.
-        
-        * bindings/objc/DOMCSS.mm:
-        (+[DOMCSSRule _wrapCSSRule:WebCore::]):
-
-2008-10-24  Adam Roben  <aroben@apple.com>
-
-        Windows build fix
-
-        * plugins/PluginView.cpp:
-
-2008-10-24  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=21851
-          <rdar://problem/6304151> REGRESSION (r36513): Crash when removing a widget with percent height
-
-        Test: fast/replaced/percent-height-in-anonymous-block-widget.html
-
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::destroy): Copied code added to
-        RenderBox::destroy() in r36513 into this function.
-
-2008-10-24  Timothy Hatcher  <timothy@apple.com>
-
-        Add a mechanism to ask the InspectorClient for key/value setting pairs.
-        These settings can be strings, numbers, booleans or string vectors. The
-        settings are also bridged to and from JavaScript.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21856
-
-        Reviewed by Darin Adler.
-
-        * WebCore.base.exp: Expose the String CFStringRef constructor.
-        * inspector/InspectorClient.h:
-        (WebCore::InspectorClient::populateSetting): Added, pure virtual.
-        (WebCore::InspectorClient::storeSetting): Ditto.
-        (WebCore::InspectorClient::removeSetting): Ditto.
-        * inspector/InspectorController.cpp:
-        (WebCore::setting): Calls InspectorController::setting and wraps the result in script types.
-        (WebCore::setSetting): Calls InspectorController::setSetting after converting from script types.
-        (WebCore::InspectorController::InspectorController): Increment a global static
-        to track the number of live InspectorControllers.
-        (WebCore::InspectorController::~InspectorController): Decrement the global static
-        that tracks the number of live InspectorControllers. Delete the setting cache if there
-        are no more live controllers.
-        (WebCore::InspectorController::setting): Check the cache and return the setting from there,
-        otherwise make a new Setting and ask the client to populate it.
-        (WebCore::InspectorController::setSetting): Change the cache and ask the client to store it.
-        (WebCore::InspectorController::windowScriptObjectAvailable): Add setting and setSetting
-        to the InspectorController script class.
-        * inspector/InspectorController.h:
-        (WebCore::InspectorController::Setting::Setting):
-        (WebCore::InspectorController::Setting::operator=):
-        (WebCore::InspectorController::Setting::type): Return m_type.
-        (WebCore::InspectorController::Setting::string): Return m_string. Assert the type is correct.
-        (WebCore::InspectorController::Setting::stringVector): Return m_stringVector.
-        Assert the type is correct.
-        (WebCore::InspectorController::Setting::doubleValue): Return m_simpleContent.m_double.
-        Assert the type is correct.
-        (WebCore::InspectorController::Setting::integerValue): Return m_simpleContent.m_integer.
-        Assert the type is correct.
-        (WebCore::InspectorController::Setting::booleanValue): Return m_simpleContent.m_boolean.
-        Assert the type is correct.
-        (WebCore::InspectorController::Setting::set): Overloaded for each data type, sets the right
-        field and the type.
-        * loader/EmptyClients.h:
-        (WebCore::EmptyInspectorClient::populateSetting): Added, empty method.
-        (WebCore::EmptyInspectorClient::storeSetting): Ditto.
-        (WebCore::EmptyInspectorClient::removeSetting): Ditto.
-
-2008-10-24  Cameron Zwarich  <zwarich@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Remove some C-style casts.
-
-        * html/HTMLViewSourceDocument.cpp:
-        (WebCore::HTMLViewSourceDocument::addViewSourceToken):
-
-2008-10-24  Darin Adler  <darin@apple.com>
-
-        - finish rolling out https://bugs.webkit.org/show_bug.cgi?id=21732
-
-        * bindings/js/JSAttrCustom.cpp:
-        * bindings/js/JSCSSRuleCustom.cpp:
-        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
-        * bindings/js/JSCSSValueCustom.cpp:
-        * bindings/js/JSCanvasPixelArrayCustom.h:
-        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
-        * bindings/js/JSClipboardCustom.cpp:
-        * bindings/js/JSConsoleCustom.cpp:
-        * bindings/js/JSCustomSQLStatementCallback.cpp:
-        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
-        * bindings/js/JSCustomSQLTransactionCallback.cpp:
-        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
-        * bindings/js/JSCustomVoidCallback.cpp:
-        * bindings/js/JSCustomVoidCallback.h:
-        * bindings/js/JSCustomXPathNSResolver.cpp:
-        * bindings/js/JSCustomXPathNSResolver.h:
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        * bindings/js/JSDOMBinding.cpp:
-        * bindings/js/JSDOMBinding.h:
-        * bindings/js/JSDOMWindowBase.cpp:
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        * bindings/js/JSDOMWindowCustom.h:
-        * bindings/js/JSDOMWindowShell.cpp:
-        * bindings/js/JSDOMWindowShell.h:
-        * bindings/js/JSDatabaseCustom.cpp:
-        * bindings/js/JSDedicatedWorkerCustom.cpp:
-        * bindings/js/JSDocumentCustom.cpp:
-        * bindings/js/JSElementCustom.cpp:
-        * bindings/js/JSEventCustom.cpp:
-        * bindings/js/JSEventListener.cpp:
-        * bindings/js/JSEventTarget.cpp:
-        * bindings/js/JSEventTarget.h:
-        * bindings/js/JSEventTargetBase.h:
-        * bindings/js/JSEventTargetNodeCustom.cpp:
-        * bindings/js/JSHTMLAllCollection.h:
-        * bindings/js/JSHTMLAppletElementCustom.cpp:
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        * bindings/js/JSHTMLDocumentCustom.cpp:
-        * bindings/js/JSHTMLEmbedElementCustom.cpp:
-        * bindings/js/JSHTMLFormElementCustom.cpp:
-        * bindings/js/JSHTMLFrameElementCustom.cpp:
-        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
-        * bindings/js/JSHTMLIFrameElementCustom.cpp:
-        * bindings/js/JSHTMLInputElementCustom.cpp:
-        * bindings/js/JSHTMLObjectElementCustom.cpp:
-        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
-        * bindings/js/JSHTMLSelectElementCustom.cpp:
-        * bindings/js/JSHTMLSelectElementCustom.h:
-        * bindings/js/JSHistoryCustom.cpp:
-        * bindings/js/JSImageDataCustom.cpp:
-        * bindings/js/JSInspectedObjectWrapper.cpp:
-        * bindings/js/JSInspectedObjectWrapper.h:
-        * bindings/js/JSInspectorCallbackWrapper.cpp:
-        * bindings/js/JSInspectorCallbackWrapper.h:
-        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
-        * bindings/js/JSLocationCustom.cpp:
-        * bindings/js/JSMessagePortCustom.cpp:
-        * bindings/js/JSMimeTypeArrayCustom.cpp:
-        * bindings/js/JSNamedNodeMapCustom.cpp:
-        * bindings/js/JSNamedNodesCollection.cpp:
-        * bindings/js/JSNamedNodesCollection.h:
-        * bindings/js/JSNavigatorCustom.cpp:
-        * bindings/js/JSNodeCustom.cpp:
-        * bindings/js/JSNodeFilterCondition.cpp:
-        * bindings/js/JSNodeFilterCondition.h:
-        * bindings/js/JSNodeFilterCustom.cpp:
-        * bindings/js/JSNodeIteratorCustom.cpp:
-        * bindings/js/JSNodeListCustom.cpp:
-        * bindings/js/JSPluginArrayCustom.cpp:
-        * bindings/js/JSPluginCustom.cpp:
-        * bindings/js/JSPluginElementFunctions.cpp:
-        * bindings/js/JSPluginElementFunctions.h:
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        * bindings/js/JSRGBColor.cpp:
-        * bindings/js/JSRGBColor.h:
-        * bindings/js/JSSQLResultSetRowListCustom.cpp:
-        * bindings/js/JSSQLTransactionCustom.cpp:
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        * bindings/js/JSSVGLengthCustom.cpp:
-        * bindings/js/JSSVGMatrixCustom.cpp:
-        * bindings/js/JSSVGPathSegCustom.cpp:
-        * bindings/js/JSSVGPathSegListCustom.cpp:
-        * bindings/js/JSSVGPointListCustom.cpp:
-        * bindings/js/JSSVGTransformListCustom.cpp:
-        * bindings/js/JSStorageCustom.cpp:
-        * bindings/js/JSStyleSheetCustom.cpp:
-        * bindings/js/JSStyleSheetListCustom.cpp:
-        * bindings/js/JSTextCustom.cpp:
-        * bindings/js/JSTreeWalkerCustom.cpp:
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        * bindings/js/JSXSLTProcessorCustom.cpp:
-        * bindings/js/ScheduledAction.cpp:
-        * bindings/js/ScheduledAction.h:
-        * bindings/js/ScriptController.cpp:
-        * bindings/js/ScriptController.h:
-        * bindings/objc/WebScriptObject.mm:
-        * bindings/objc/WebScriptObjectPrivate.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/NP_jsobject.cpp:
-        * bridge/c/c_instance.cpp:
-        * bridge/c/c_instance.h:
-        * bridge/c/c_runtime.cpp:
-        * bridge/c/c_runtime.h:
-        * bridge/c/c_utility.cpp:
-        * bridge/c/c_utility.h:
-        * bridge/jni/jni_instance.cpp:
-        * bridge/jni/jni_instance.h:
-        * bridge/jni/jni_jsobject.h:
-        * bridge/jni/jni_jsobject.mm:
-        * bridge/jni/jni_objc.mm:
-        * bridge/jni/jni_runtime.cpp:
-        * bridge/jni/jni_runtime.h:
-        * bridge/jni/jni_utility.cpp:
-        * bridge/jni/jni_utility.h:
-        * bridge/objc/WebScriptObject.h:
-        * bridge/objc/objc_class.h:
-        * bridge/objc/objc_class.mm:
-        * bridge/objc/objc_instance.h:
-        * bridge/objc/objc_instance.mm:
-        * bridge/objc/objc_runtime.h:
-        * bridge/objc/objc_runtime.mm:
-        * bridge/objc/objc_utility.h:
-        * bridge/objc/objc_utility.mm:
-        * bridge/qt/qt_class.cpp:
-        * bridge/qt/qt_class.h:
-        * bridge/qt/qt_instance.cpp:
-        * bridge/qt/qt_instance.h:
-        * bridge/qt/qt_runtime.cpp:
-        * bridge/qt/qt_runtime.h:
-        * bridge/runtime.cpp:
-        * bridge/runtime.h:
-        * bridge/runtime_array.cpp:
-        * bridge/runtime_array.h:
-        * bridge/runtime_method.cpp:
-        * bridge/runtime_method.h:
-        * bridge/runtime_object.cpp:
-        * bridge/runtime_object.h:
-        * bridge/testqtbindings.cpp:
-        * inspector/JavaScriptCallFrame.cpp:
-        * inspector/JavaScriptCallFrame.h:
-        * inspector/JavaScriptProfile.cpp:
-        * inspector/JavaScriptProfile.h:
-        * inspector/JavaScriptProfileNode.cpp:
-        * inspector/JavaScriptProfileNode.h:
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * page/Console.cpp:
-        * page/Console.h:
-        * plugins/MimeTypeArray.h:
-        * plugins/Plugin.h:
-        * plugins/PluginArray.h:
-        * plugins/PluginView.cpp:
-        * xml/XMLHttpRequest.cpp:
-        Use JSValue* instead of JSValuePtr.
-
-2008-10-24  Simon Hausmann  <hausmann@webkit.org>
-
-        Fix the Qt build.
-
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtField::valueFromInstance):
-
-2008-10-24  David Kilzer  <ddkilzer@apple.com>
-
-        Rolled out r37840 and r37841.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::hitTestLayer):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::contentOffsetInCompostingLayer):
+        (WebCore::RenderLayerBacking::paintContents):
+        (WebCore::RenderLayerBacking::compositedBounds):
+        (WebCore::RenderLayerBacking::setCompositedBounds):
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateBacking):
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        (WebCore::RenderLayerCompositor::layerWillBeRemoved):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::updateCompositingChildrenGeometry):
+        * rendering/RenderLayerCompositor.h:
+
+2009-06-22  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        First step in https://bugs.webkit.org/show_bug.cgi?id=25376
+
+        Add StorageSyncManager.cpp/h
 
-        * DerivedSources.make:
         * GNUmakefile.am:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
         * WebCoreSources.bkl:
-        * bindings/js/JSCustomPositionCallback.cpp: Removed.
-        * bindings/js/JSCustomPositionCallback.h: Removed.
-        * bindings/js/JSCustomPositionErrorCallback.cpp: Removed.
-        * bindings/js/JSCustomPositionErrorCallback.h: Removed.
-        * bindings/js/JSDOMBinding.cpp:
-        * bindings/js/JSDOMBinding.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::markDOMObjectWrapper):
-        * bindings/js/JSGeolocationCustom.cpp: Removed.
-        * bindings/js/JSNavigatorCustom.cpp:
-        * dom/Document.cpp:
-        (WebCore::Document::Document):
-        * dom/Document.h:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::canCachePage):
-        * page/Geolocation.cpp: Removed.
-        * page/Geolocation.h: Removed.
-        * page/Geolocation.idl: Removed.
-        * page/Geoposition.cpp: Removed.
-        * page/Geoposition.h: Removed.
-        * page/Geoposition.idl: Removed.
-        * page/Navigator.cpp:
-        (WebCore::Navigator::disconnectFrame):
-        * page/Navigator.h:
-        * page/Navigator.idl:
-        * page/PositionCallback.h: Removed.
-        * page/PositionCallback.idl: Removed.
-        * page/PositionError.h: Removed.
-        * page/PositionError.idl: Removed.
-        * page/PositionErrorCallback.h: Removed.
-        * page/PositionErrorCallback.idl: Removed.
-        * page/PositionOptions.h: Removed.
-        * page/PositionOptions.idl: Removed.
-        * platform/GeolocationService.cpp: Removed.
-        * platform/GeolocationService.h: Removed.
-
-2008-10-23  David Kilzer  <ddkilzer@apple.com>
-
-        Attempt to fix GTK build.
-
-        * GNUmakefile.am: Added new *.idl files that were missing.
-
-2008-10-23  Greg Bolsinga  <bolsinga@apple.com>
 
-        Reviewed by Sam Weinig.
+        In preparation for combining SessionStorage and LocalStorage into a
+        single StorageManager, move the syncing bits out of LocalStorage and
+        into its own class.
 
-        https://bugs.webkit.org/show_bug.cgi?id=21475
-        
-        Provide support for the Geolocation API
-        
-        http://dev.w3.org/geo/api/spec-source.html
+        The next step is to combine LocalStorageArea and SessionStorageArea
+        into one.  Then SessionStorage and LocalStorage can be combined.
 
-        Test: geolocation/geolocation-not-implemented.html
+        Note that combining them will cut down on code paths that must be
+        proxied, eliminate virtual dispatch, and allow Chromium to (eventually)
+        write historical sessionStorage to disk when memory is getting tight.
 
-        * DerivedSources.make:
-        * GNUmakefile.am: Added Geolocation support
-        * WebCore.pro: Added Geolocation support
-        * WebCore.vcproj/WebCore.vcproj: Added Geolocation support
-        * WebCore.xcodeproj/project.pbxproj: Added Geolocation support
-        * WebCoreSources.bkl: Added Geolocation support
-        * bindings/js/JSCustomPositionCallback.cpp: Added.
-        (WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
-        (WebCore::JSCustomPositionCallback::handleEvent):
-        * bindings/js/JSCustomPositionCallback.h: Added.
-        (WebCore::JSCustomPositionCallback::create):
-        * bindings/js/JSCustomPositionErrorCallback.cpp: Added.
-        (WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
-        (WebCore::JSCustomPositionErrorCallback::handleEvent):
-        * bindings/js/JSCustomPositionErrorCallback.h: Added.
-        (WebCore::JSCustomPositionErrorCallback::create):
-        * bindings/js/JSDOMBinding.cpp: move markDOMObjectWrapper here from JSDOMWindowCustom
-        (WebCore::markDOMObjectWrapper):
-        * bindings/js/JSDOMBinding.h: move markDOMObjectWrapper here from JSDOMWindowCustom
-        * bindings/js/JSDOMWindowCustom.cpp: move markDOMObjectWrapper to JSDOMBinding
-        * bindings/js/JSGeolocationCustom.cpp: Added.
-        (WebCore::JSGeolocation::getCurrentPosition):
-        (WebCore::JSGeolocation::watchPosition):
-        * bindings/js/JSNavigatorCustom.cpp: handle marking Geolocation
-        (WebCore::JSNavigator::mark):
-        * dom/Document.cpp:
-        (WebCore::Document::Document):
-        * dom/Document.h:
-        (WebCore::Document::setUsingGeolocation):
-        (WebCore::Document::usingGeolocation):
-        * loader/FrameLoader.cpp: don't add to back forward cache if using Geolocation
-        (WebCore::FrameLoader::canCachePage):
-        * page/Geolocation.cpp: Added.
-        (WebCore::Geolocation::GeoNotifier::GeoNotifier):
-        (WebCore::Geolocation::GeoNotifier::timerFired):
-        (WebCore::Geolocation::Geolocation):
-        (WebCore::Geolocation::disconnectFrame):
-        (WebCore::Geolocation::getCurrentPosition):
-        (WebCore::Geolocation::watchPosition):
-        (WebCore::Geolocation::clearWatch):
-        (WebCore::Geolocation::stopUpdatingIfEmpty):
-        (WebCore::Geolocation::sendErrorToOneShots):
-        (WebCore::Geolocation::sendErrorToWatchers):
-        (WebCore::Geolocation::sendPositionToOneShots):
-        (WebCore::Geolocation::sendPositionToWatchers):
-        (WebCore::Geolocation::handleError):
-        (WebCore::Geolocation::geolocationServicePositionChanged):
-        (WebCore::Geolocation::geolocationServiceErrorOccurred):
-        * page/Geolocation.h: Added.
-        (WebCore::Geolocation::create):
-        (WebCore::Geolocation::~Geolocation):
-        (WebCore::Geolocation::lastPosition):
-        (WebCore::Geolocation::GeoNotifier::create):
-        * page/Geolocation.idl: Added.
-        * page/Geoposition.cpp: Added.
-        (WebCore::Geoposition::toString):
-        * page/Geoposition.h: Added.
-        (WebCore::Geoposition::create):
-        (WebCore::Geoposition::latitude):
-        (WebCore::Geoposition::longitude):
-        (WebCore::Geoposition::altitude):
-        (WebCore::Geoposition::accuracy):
-        (WebCore::Geoposition::altitudeAccuracy):
-        (WebCore::Geoposition::heading):
-        (WebCore::Geoposition::velocity):
-        (WebCore::Geoposition::timestamp):
-        (WebCore::Geoposition::Geoposition):
-        * page/Geoposition.idl: Added.
-        * page/Navigator.cpp:
-        (WebCore::Navigator::disconnectFrame): disconnect Geolocation
-        (WebCore::Navigator::geolocation): accessor for Geolocation
-        * page/Navigator.h:
-        (WebCore::Navigator::optionalGeolocation): accessor for Geolocation
-        * page/Navigator.idl: accessor for Geolocation
-        * page/PositionCallback.h: Added.
-        (WebCore::PositionCallback::~PositionCallback):
-        * page/PositionCallback.idl: Added.
-        * page/PositionError.h: Added.
-        (WebCore::PositionError::):
-        (WebCore::PositionError::create):
-        (WebCore::PositionError::code):
-        (WebCore::PositionError::message):
-        (WebCore::PositionError::PositionError):
-        * page/PositionError.idl: Added.
-        * page/PositionErrorCallback.h: Added.
-        (WebCore::PositionErrorCallback::~PositionErrorCallback):
-        * page/PositionErrorCallback.idl: Added.
-        * page/PositionOptions.h: Added.
-        (WebCore::PositionOptions::create):
-        (WebCore::PositionOptions::enableHighAccuracy):
-        (WebCore::PositionOptions::setEnableHighAccuracy):
-        (WebCore::PositionOptions::timeout):
-        (WebCore::PositionOptions::setTimeout):
-        (WebCore::PositionOptions::PositionOptions):
-        * page/PositionOptions.idl: Added.
-        * platform/GeolocationService.cpp: Added.
-        (WebCore::GeolocationService::GeolocationService):
-        (WebCore::GeolocationService::positionChanged):
-        (WebCore::GeolocationService::errorOccurred):
-        * platform/GeolocationService.h: Added.
-        (WebCore::GeolocationServiceClient::~GeolocationServiceClient):
-        (WebCore::GeolocationServiceClient::geolocationServicePositionChanged):
-        (WebCore::GeolocationServiceClient::geolocationServiceErrorOccurred):
-        (WebCore::GeolocationService::~GeolocationService):
-
-2008-10-23  Alp Toker  <alp@nuanti.com>
-
-        Fix typo in comment in previous commit. GTK -> GLIB
-
-        * platform/gtk/guriescape.c:
-
-2008-10-23  Kalle Vahlman  <kalle.vahlman@movial.com>
-
-        Reviewed by Alp Toker.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21824
-        [GTK] FileSystem abstraction uses features from Glib 2.16
-
-        Wrap g_uri_unescape_string() to fix building with pre-2.16 Glib
-
-        * platform/gtk/guriescape.c:
-        (unescape_character):
-        (_webcore_g_uri_unescape_segment):
-        (_webcore_g_uri_unescape_string):
-        * platform/gtk/guriescape.h:
-
-2008-10-23  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Fix Gtk build typo introduced in http://trac.webkit.org/changeset/37826.
+        Also remove a couple bits of cruft including code for quotas which is
+        unnecessary (since a meta-data db is unnecessary since you can just
+        count bytes as you read the local storage databases into memory).
 
-        * GNUmakefile.am:
-
-2008-10-23  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        m_frame null checked but then dereferenced
-        https://bugs.webkit.org/show_bug.cgi?id=21845
-
-        This error was found using a static analysis tool, and so I do not know
-        how to produce a null m_frame on entry to this method.  Hence, I have
-        not included a regression test.
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::allowDHTMLDrag): Add an early return.
-
-2008-10-23  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig with no hesitation.
-
-        - fix the HTML/CSS case of https://bugs.webkit.org/show_bug.cgi?id=19839
-          <rdar://problem/6304805> A PDF,RLE sequence that should be a no-op affects bidi reordering
-
-        Test: fast/text/bidi-embedding-pop-and-push-same.html
-
-        * platform/text/BidiResolver.h:
-        (WebCore::BidiResolver::embed): Changed to only add the embedding
-        operation to a vector of pending operations.
-
-        (WebCore::BidiResolver::lowerExplicitEmbeddingLevel): Added. Moved the
-        code that used to be in the PDF case of embed() here, except the part
-        that sets the context.
-
-        (WebCore::BidiResolver::raiseExplicitEmbeddingLevel): Added. Moved the
-        code that used to be in the non-PDF case of embed() here, except the
-        part the sets the context.
-
-        (WebCore::BidiResolver::commitExplicitEmbedding): Added. Processes the
-        explicit embedding operations in the vector by creating an updated
-        context and determining the old and new embedding levels. If the levels
-        are not the same, calls {lower,raise}ExplicitEmbeddingLevel(). Always
-        sets the context to the new one.
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::LocalStorage):
+        (WebCore::LocalStorage::storageArea):
+        (WebCore::LocalStorage::close):
+        * storage/LocalStorage.h:
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::LocalStorageArea):
+        (WebCore::LocalStorageArea::scheduleFinalSync):
+        (WebCore::LocalStorageArea::syncTimerFired):
+        (WebCore::LocalStorageArea::performImport):
+        * storage/LocalStorageArea.h:
+        (WebCore::LocalStorageArea::create):
+        * storage/LocalStorageTask.cpp:
+        (WebCore::LocalStorageTask::performTask):
+        * storage/LocalStorageTask.h:
+        (WebCore::LocalStorageTask::):
+        (WebCore::LocalStorageTask::createImport):
+        * storage/LocalStorageThread.cpp:
+        * storage/LocalStorageThread.h:
+        * storage/SessionStorage.h:
+        * storage/StorageSyncManager.cpp: Copied from WebCore/storage/LocalStorage.cpp.
+        (WebCore::StorageSyncManager::create):
+        (WebCore::StorageSyncManager::StorageSyncManager):
+        (WebCore::StorageSyncManager::fullDatabaseFilename):
+        (WebCore::StorageSyncManager::close):
+        (WebCore::StorageSyncManager::scheduleImport):
+        (WebCore::StorageSyncManager::scheduleSync):
+        * storage/StorageSyncManager.h: Copied from WebCore/storage/LocalStorage.h.
+        (WebCore::):
 
-        (WebCore::BidiResolver::createBidiRunsForLine): Added calls to
-        commitExplicitEmbedding() after calling embed() and after calling
-        increment().
+2009-06-22  Darin Fisher  <darin@chromium.org>
 
-        * rendering/bidi.cpp:
-        (WebCore::bidiFirst): Added calls to commitExplicitEmbedding() because
-        this function increments the resolver.
+        Reviewed by Dimitri Glazkov.
 
-        (WebCore::RenderBlock::skipLeadingWhitespace): Ditto.
+        https://bugs.webkit.org/show_bug.cgi?id=26622
+        Add ChromiumDataObject::copy()
 
-2008-10-23  Jan Michael Alonzo  <jmalonzo@webkit.org>
+        * platform/chromium/ChromiumDataObject.cpp:
+        * platform/chromium/ChromiumDataObject.h:
 
-        Gtk build fix. Not reviewed.
+2009-06-22  Timothy Hatcher  <timothy@apple.com>
 
-        Add DNSCurl and DNSSoup to the Gtk build
+        Add a silhouette image for the enable view of the Resource panel.
 
-        * GNUmakefile.am:
-        * platform/gtk/TemporaryLinkStubs.cpp:
-        * platform/network/soup/DNSSoup.cpp: Copied from WebCore/platform/network/curl/DNSCurl.cpp.
-        (WebCore::prefetchDNS):
+        Reviewed by Kevin McCullough.
 
-2008-10-23  Eric Seidel  <eric@webkit.org>
+        * inspector/front-end/Images/resourcesSilhouette.png: Added.
+        * inspector/front-end/inspector.css:
 
-        Reviewed by Sam Weinig.
+2009-06-22  Kyle Prete  <kylep@chromium.org>
 
-        Un-break the Darwin build.
+        Reviewed by Dimitri Glazkov.
 
-        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
-        * platform/graphics/cg/ImageCG.cpp:
+        https://bugs.webkit.org/show_bug.cgi?id=26552
+        Add V8 JS bindings for Audio Constructor.
 
-2008-10-23  Darin Fisher  <darin@chromium.org>
+        * bindings/v8/custom/V8CustomBinding.h:
+        Added a callback declaration for audio ctor to macro.
+        * bindings/v8/custom/V8HTMLAudioElementConstructor.cpp:
+        Added the whole file.
 
-        Reviewed by Eric Seidel.
+2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
 
-        Fix forward decls to be struct instead of class.
-        https://bugs.webkit.org/show_bug.cgi?id=21838
+        Reviewed by David Levin.
 
-        * rendering/style/StyleRareInheritedData.h:
-        * rendering/style/StyleRareNonInheritedData.h:
+        https://bugs.webkit.org/show_bug.cgi?id=26600
+        StringImpl::copy() no longer copies empty string correctly
 
-2008-10-23  Brent Fulgham  <bfulgham@gmail.com>
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::ustring): Changed method calling syntax to look less like calling a
+        static method.
+        (WebCore::StringImpl::copy): Reverted part of r41917 that caused the problem.
 
-        Reviewed by Oliver Hunt.
+2009-06-22  Xiaomei Ji  <xji@chromium.org>
 
-        * platform/network/curl/ResourceRequest.h:  A better implementation
-          of CFURLRequest, rather than void*.  This gives better compatibility 
-          with the WebKit.idl interface.
-        (WebCore::ResourceRequest::cfURLRequest):
+        Reviewed by Eric Seidel
 
-2008-10-23  Mike Pinkerton  <pinkerton@chromium.org>
+        Not auto-testable since it involves sending a keyboard event to
+        the popup, which is not possible (eventSender sends the key
+        events through webview, we want to go through the webwidget).
 
-        Reviewed by Eric Seidel.
+        This patch is one part of the fix for issue "keyboard selection in
+        Hebrew select element does not work in Windows". The other part of the
+        fix is in chromium's webkit/glue layer.
+        https://bugs.webkit.org/show_bug.cgi?id=25899
 
-        PLATFORM(CHROMIUM) uses CG the same way PLATFORM(MAC) does so fix
-        ifdefs to reflect that.
+        * manual-tests/keyboard_select_non_english.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::isCharacterTypeEvent): Added. Check whether the event is a 
+        character type event. "Char" in Windows or "KeyDown" in Mac is character
+        type event.
+        (WebCore::PopupListBox::typeAheadFind): Since m_lastCharTime is used to
+        indicate whether user types multiple characters continuely as a search
+        prefix or not, it should be only assigned when the event is character 
+        type event. 
 
-        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
-        * platform/graphics/cg/ImageCG.cpp:
+2009-06-22  Kevin McCullough  <kmccullough@apple.com>
 
-2008-10-23  Peter Kasting  <pkasting@google.com>
+        Reviewed by Darin Adler.
 
-        Reviewed by Adam Roben.
+        <rdar://problem/6115819> Notify of profile start in console
 
-        https://bugs.webkit.org/show_bug.cgi?id=21833
-        Place JavaScript Debugger hooks under #if ENABLE(JAVASCRIPT_DEBUGGER).
+        Put a message in the console that announces that a profile has started,
+        similar to how a console message announces that a profile has finished.
 
         * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::InspectorController):
-        (WebCore::InspectorController::setWindowVisible):
-        (WebCore::InspectorController::windowScriptObjectAvailable):
-        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::addProfile): Use renamed function.
+        (WebCore::InspectorController::addProfileFinishedMessageToConsole):
+        Renamed.
+        (WebCore::InspectorController::addStartProfilingMessageToConsole):
+        New function that logs the message about the profile starting.
+        (WebCore::InspectorController::startUserInitiatedProfiling): Ditto
         * inspector/InspectorController.h:
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-
-2008-10-23  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21817
-        Bug 21817: Manual profiler tests should be made into layout tests
-
-        -Moving the tests before diffing so that it's clear what changed.
-
-        * manual-tests/inspector/profiler-test-anonymous-event-handler.html: Removed.
-        * manual-tests/inspector/profiler-test-anonymous-function-called-from-different-contexts.html: Removed.
-        * manual-tests/inspector/profiler-test-anonymous-function-calls-built-in-functions.html: Removed.
-        * manual-tests/inspector/profiler-test-anonymous-function-calls-eval.html: Removed.
-        * manual-tests/inspector/profiler-test-apply.html: Removed.
-        * manual-tests/inspector/profiler-test-built-in-function-calls-anonymous.html: Removed.
-        * manual-tests/inspector/profiler-test-built-in-function-calls-user-defined-function.html: Removed.
-        * manual-tests/inspector/profiler-test-call-nodelist-as-function.html: Removed.
-        * manual-tests/inspector/profiler-test-calling-the-function-that-started-the-profiler-from-another-scope.html: Removed.
-        * manual-tests/inspector/profiler-test-compare-multiple-profiles.html: Removed.
-        * manual-tests/inspector/profiler-test-constructor.html: Removed.
-        * manual-tests/inspector/profiler-test-dead-time.html: Removed.
-        * manual-tests/inspector/profiler-test-deep-recursion.html: Removed.
-        * manual-tests/inspector/profiler-test-document-dot-write.html: Removed.
-        * manual-tests/inspector/profiler-test-event-handler.html: Removed.
-        * manual-tests/inspector/profiler-test-execution-context-and-eval-on-same-line.html: Removed.
-        * manual-tests/inspector/profiler-test-heavy-view.html: Removed.
-        * manual-tests/inspector/profiler-test-inline-event-handler.html: Removed.
-        * manual-tests/inspector/profiler-test-multiple-and-different-scoped-anonymous-function-calls.html: Removed.
-        * manual-tests/inspector/profiler-test-multiple-and-different-scoped-function-calls.html: Removed.
-        * manual-tests/inspector/profiler-test-multiple-frames.html: Removed.
-        * manual-tests/inspector/profiler-test-multiple-windows.html: Removed.
-        * manual-tests/inspector/profiler-test-nested-anonymous-functon.html: Removed.
-        * manual-tests/inspector/profiler-test-nested-start-and-stop-profiler.html: Removed.
-        * manual-tests/inspector/profiler-test-no-execution-context.html: Removed.
-        * manual-tests/inspector/profiler-test-one-execution-context.html: Removed.
-        * manual-tests/inspector/profiler-test-profile-calls-in-included-file.html: Removed.
-        * manual-tests/inspector/profiler-test-profiling-from-a-nested-location-but-stop-profiling-outside-the-nesting.html: Removed.
-        * manual-tests/inspector/profiler-test-profiling-from-a-nested-location.html: Removed.
-        * manual-tests/inspector/profiler-test-simple-event-call.html: Removed.
-        * manual-tests/inspector/profiler-test-simple-no-level-change.html: Removed.
-        * manual-tests/inspector/profiler-test-start-and-stop-profiler-multiple-times.html: Removed.
-        * manual-tests/inspector/profiler-test-start-and-stop-profiling-in-the-same-function.html: Removed.
-        * manual-tests/inspector/profiler-test-start-but-dont-stop-profiling.html: Removed.
-        * manual-tests/inspector/profiler-test-stop-profiling-after-setTimeout.html: Removed.
-        * manual-tests/inspector/profiler-test-stop-then-function-call.html: Removed.
-        * manual-tests/inspector/profiler-test-throw-exception-from-eval.html: Removed.
-        * manual-tests/inspector/profiler-test-two-execution-contexts.html: Removed.
-        * manual-tests/inspector/profiler-test-user-defined-function-calls-built-in-functions.html: Removed.
-        * manual-tests/inspector/profiler-test-window-dot-eval.html: Removed.
-        * manual-tests/inspector/resources/other-frame.html: Removed.
-        * manual-tests/inspector/resources/other-window.html: Removed.
-        * manual-tests/inspector/resources/profiler-test-JS-resources.js: Removed.
-
-2008-10-23  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21826
-
-        Add accessor for SecurityOrigin::m_domainWasSetInDOM.
-
-        * page/SecurityOrigin.h:
-        (WebCore::SecurityOrigin::domainWasSetInDOM):
-
-2008-10-23  Darin Adler  <darin@apple.com>
-
-        - roll out https://bugs.webkit.org/show_bug.cgi?id=21732
-
-        * bindings/js/ScheduledAction.h:
-        * inspector/InspectorController.cpp:
-        ProtectedPtr<JSValue> instead of ProtectedPtr<JSValuePtr>.
-
-2008-10-23  Simon Hausmann  <hausmann@webkit.org>
-
-        Fix the Qt build.
-
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::QtConnectionObject::execute):
-        * bridge/qt/qt_runtime.h:
-        (JSC::Bindings::QtRuntimeMethod::createStructureID):
-
-2008-10-23  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21825
-        JSDOMBinding should not blindly cast the global object to JSDOMWindow
-
-        * bindings/js/JSDOMGlobalObject.cpp:
-        * bindings/js/JSDOMGlobalObject.h:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        Added JSDOMGlobalObject, a base class to be used by both Window and worker contexts.
-
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::getCachedDOMStructure):
-        (WebCore::cacheDOMStructure):
-        (WebCore::getCachedDOMConstructor):
-        (WebCore::cacheDOMConstructor):
-        Cast to JSDOMGlobalObject, as DOM objects live in DOM global objects.
-
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::mark):
-        Moved constructor and structure tracking to JSDOMGlobalObject.
-
-2008-10-23  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21787
-
-        Update postMessage to send origin = "null" for non-serializable
-        origins to match latest spec.  Merge SecurityOrigin::toString and
-        SecurityOrigin::toHTTPOrigin because they are now the same.
-
-        Test: http/tests/security/postMessage/data-url-sends-null-origin.html
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::outgoingOrigin):
-        (WebCore::FrameLoader::loadURL):
-        (WebCore::FrameLoader::addHTTPOriginIfNeeded):
-        (WebCore::FrameLoader::loadItem):
-        * loader/loader.cpp:
-        (WebCore::Loader::Host::servePendingRequests):
-        * page/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::toString):
-        * page/SecurityOrigin.h:
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::makeSimpleCrossSiteAccessRequest):
-        (WebCore::XMLHttpRequest::makeCrossSiteAccessRequestWithPreflight):
-        (WebCore::XMLHttpRequest::handleAsynchronousPreflightResult):
-        (WebCore::XMLHttpRequest::didReceiveResponsePreflight):
-
-2008-10-22  David Kilzer  <ddkilzer@apple.com>
-
-        Bug 21781: WebCore::Settings should have a maximum decoded image size setting
-
-        <https://bugs.webkit.org/show_bug.cgi?id=21781>
-
-        Reviewed by Antti.
-
-        No tests since there is no change in behavior.
-
-        * loader/CachedImage.cpp:
-        (WebCore::CachedImage::maximumDecodedImageSize): Added.  Returns
-        WebCore::Settings::maximumDecodedImageSize() or 0 on error.
-        (WebCore::CachedImage::data): Flag an error if the image being
-        loaded is too big.
-        * loader/CachedImage.h:
-        (WebCore::CachedImage::maximumDecodedImageSize): Added declaration.
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings): Initialize m_maximumDecodedImageSize
-        to the maximum value of size_t.
-        * page/Settings.h:
-        (WebCore::Settings::setMaximumDecodedImageSize): Added method.
-        (WebCore::Settings::maximumDecodedImageSize): Ditto.
-
-2008-10-22  Mike Pinkerton  <pinkerton@chromium.org>
-
-        Reviewed by Dan Bernstein.
-        Landed and tweaked a bit by Darin Adler.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=21809
-
-        Remove PLATFORM(MAC) wrapping USE(ATSUI). It's redundant and inhibits 
-        its use for PLATFORM(CHROMIUM) in the future.
-
-        * platform/graphics/SimpleFontData.h:
-
-2008-10-22  David Smith  <catfish.man@gmail.com>
-
-        Reviewed by Anders Carlsson.
-               
-        https://bugs.webkit.org/show_bug.cgi?id=19974
-        getElementsByClassName not live enough
-
-        Test: fast/dom/getElementsByClassName/015.html
-
-        * dom/StyledElement.cpp:
-        (WebCore::StyledElement::classAttributeChanged): call dispatchSubtreeModifiedEvent()
-
-2008-10-22  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=21294
-          Bug 21294: Devirtualize getOwnPropertySlot()
-
-        * bindings/js/JSDOMWindowShell.h:
-        (WebCore::JSDOMWindowShell::createStructureID): Added. Returns a structure without
-        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
-
-        * bindings/js/JSInspectorCallbackWrapper.cpp:
-        (WebCore::JSInspectorCallbackWrapper::wrap): Change to use a unique structure
-        for this class rather than sharing nullProtoStructureID, which no longer exists.
-
-        * bindings/js/JSNamedNodesCollection.h:
-        (WebCore::JSNamedNodesCollection::createStructureID): Added. Returns a structure without
-        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
-        * bindings/js/JSRGBColor.h:
-        (WebCore::JSRGBColor::createStructureID): Ditto.
-
-        * bindings/scripts/CodeGeneratorJS.pm: Added createStructureID functions for the wrappers,
-        constructors, and prototypes in any case where they override getOwnPropertySlot, without
-        HasStandardGetOwnPropertySlot.
-
-        * bridge/objc/objc_runtime.h:
-        (JSC::Bindings::ObjcFallbackObjectImp::createStructureID): Added. Returns a structure
-        without HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
-        * bridge/qt/qt_runtime.h:
-        (JSC::Bindings::QtRuntimeMethod::createStructureID): Ditto.
-        * bridge/runtime_array.h:
-        (JSC::RuntimeArray::createStructureID): Ditto.
-        * bridge/runtime_method.h:
-        (JSC::RuntimeMethod::createStructureID): Ditto.
-        * bridge/runtime_object.h:
-        (JSC::RuntimeObjectImp::createStructureID): Ditto.
-
-2008-10-22  Brent Fulgham  <bfulgham@gmail.com>
-
-        Bring Windows Cairo Port's font handling in line with CG.
-        http://bugs.webkit.org/show_bug.cgi?id=21812.
-
-        Reviewed by Adam Roben.
-
-        * platform/graphics/win/FontCacheWin.cpp:
-        (WebCore::createGDIFont): Remove unnecessary special-case for Cairo
-        TrueType font search. It should match CG in all font selections.
-
-2008-10-22  Brent Fulgham  <bfulgham@gmail.com>
-
-        http://bugs.webkit.org/show_bug.cgi?id=21812.
-        Bring Windows Cairo Port's font handling in line with CG.
-
-        Reviewed by David Hyatt.
-
-        * platform/graphics/win/FontCacheWin.cpp:
-        (WebCore::createGDIFont):  Remove unnecessary special-case for Cairo TrueType font search.  It should match CG in all font selections.
-
-2008-10-22  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Adam Roben
-
-        <rdar://6261773> - autocomplete="off" doesn't work on Windows
-
-        Visual Studio makes a poor decision regarding the combination of enums and bitfields, such that a 
-        statement like "m_autocomplete = Off" followed by "return m_autocomplete == Off" would return "false" 
-        instead of the much more correct "true."
-        
-        In the past we have worked around this by declaring the bitfield member as an unsigned instead 
-        of the enum type.
-
-        For more discussion, see http://trac.webkit.org/changeset/25329
-
-        * html/HTMLInputElement.h:  Work around insane Visual Studio enum issue  *sigh*
-
-2008-10-22  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Oliver Hunt and Tim Hatcher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=19225
-        Bug 19225: JSProfiler: Create automated profiler tests
-        - This change exports profiles on the console object so that they can be
-        iterated over via JavaScript, and thus can be used in automated tests.
-
-        * bindings/js/JSConsoleCustom.cpp: Get the profiles and return an array
-        that JS can use.
-        (WebCore::JSConsole::profiles):
-        * inspector/InspectorController.h: Use the new typedef.
-        (WebCore::InspectorController::profiles):
-        * page/Console.cpp: Keep our own array of profile objects.
-        (WebCore::Console::profileEnd):
-        * page/Console.h: Ditto.
-        (WebCore::Console::profiles):
-        * page/Console.idl: Expose the profiles to JS.
-
-2008-10-22  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21775
-
-        Convert buttons over to use the new Theme API on OS X.
-
-        Reviewed by Adam Roben
-
-        * platform/LengthBox.h:
-        (WebCore::LengthBox::LengthBox):
-        * platform/Theme.cpp:
-        (WebCore::Theme::controlBorder):
-        (WebCore::Theme::controlPadding):
-        * platform/Theme.h:
-        (WebCore::Theme::controlFont):
-        (WebCore::Theme::controlSize):
-        (WebCore::Theme::minControlSize):
-        (WebCore::Theme::controlRequiresPreWhiteSpace):
-        * platform/mac/ThemeMac.h:
-        (WebCore::ThemeMac::controlRequiresPreWhiteSpace):
-        * platform/mac/ThemeMac.mm:
-        (WebCore::checkboxSize):
-        (WebCore::radioSize):
-        (WebCore::buttonSizes):
-        (WebCore::buttonMargins):
-        (WebCore::button):
-        (WebCore::paintButton):
-        (WebCore::ThemeMac::controlFont):
-        (WebCore::ThemeMac::controlSize):
-        (WebCore::ThemeMac::minControlSize):
-        (WebCore::ThemeMac::controlBorder):
-        (WebCore::ThemeMac::controlPadding):
-        (WebCore::ThemeMac::inflateControlPaintRect):
-        (WebCore::ThemeMac::paint):
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::adjustStyle):
-        (WebCore::RenderTheme::paint):
-        (WebCore::RenderTheme::controlStatesForRenderer):
-        (WebCore::RenderTheme::isDefault):
-        (WebCore::RenderTheme::adjustRadioStyle):
-        * rendering/RenderTheme.h:
-        (WebCore::RenderTheme::setRadioSize):
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::adjustRepaintRect):
-        (WebCore::menuListButtonSizes):
-        (WebCore::RenderThemeMac::adjustMenuListStyle):
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::paddingBox):
-        (WebCore::InheritedFlags::setPaddingBox):
-
-2008-10-22  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        Make sure that the AtomicString that identifies a set of animation keyframes
-        stays live by keeping a copy in the WebKitCSSKeyframesRule.
-        
-        Also call styleSheetChanged() when the keyframes name changes, but
-        add an internal method that doesn't call styleSheetChanged() for use
-        during normal stylesheet parsing.
-        
-        Test: animations/change-keyframes-name.html
-
-        * css/CSSGrammar.y:
-        * css/WebKitCSSKeyframesRule.cpp:
-        (WebCore::WebKitCSSKeyframesRule::setName):
-        * css/WebKitCSSKeyframesRule.h:
-        (WebCore::WebKitCSSKeyframesRule::setNameInternal):
-
-2008-10-22  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21791
-        WebCore JS bindings should be able to use non-static hash tables for properties
-
-        Add a map for HashTables to WebCore JS client data.
-
-        This makes property access noticeably slower, so it is an opt-in. For classes that need to be
-        supported in workers in forseeable future this is not critical.
-
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::DOMObjectHashTableMap::get):
-        (WebCore::DOMObjectHashTableMap::mapFor):
-        (WebCore::getHashTableForGlobalData):
-        (WebCore::DOMObjectWrapperMap::mapFor):
-        WebCore client data is now a class that contains both a DOM wrapper map and a property hash
-        table one.
-
-        * bindings/js/JSDOMBinding.h: Added getHashTableForGlobalData() to query the hash table map.
-
-        * bindings/scripts/CodeGeneratorJS.pm: If the class has a NoStaticTables attribute, use
-        JSDOMBinding map to access its property hash tables.
-
-        * dom/MessageChannel.idl:
-        * dom/MessagePort.idl:
-        Added NoStaticTables attribute.
-
-2008-10-22  Gustavo Noronha Silva  <gns@gnome.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Build failure because of missing include
-        https://bugs.webkit.org/show_bug.cgi?id=21765
-
-        Build failure fix for WebKit/GTK+; added missing
-        include (GOwnPtr.h)
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-
-2008-10-22  Alp Toker  <alp@nuanti.com>
-
-        Reviewed by Adam Roben.
-
-        Fix crashes on older GTK+ versions (2.8). gtk_widget_style_get()
-        doesn't initialize values if the requested property doesn't exist, so
-        initialize the values to the documented defaults before calling it
-        where necessary. Additionally, avoid critical warnings by not calling
-        gtk_widget_style_get() when we know the property isn't available.
-
-        Note that this is an imported source file which doesn't follow the
-        WebKit coding style.
-
-        * platform/gtk/gtk2drawing.c:
-        (moz_gtk_init):
-        (moz_gtk_button_get_inner_border):
-        (moz_gtk_combo_box_paint):
-        (moz_gtk_toolbar_separator_paint):
-        (moz_gtk_menu_separator_paint):
-        (moz_gtk_get_widget_border):
-        (moz_gtk_get_tab_scroll_arrow_size):
-        (moz_gtk_get_toolbar_separator_width):
-        (moz_gtk_get_menu_separator_height):
-
-2008-10-22  Alp Toker  <alp@nuanti.com>
-
-        Fix build for Cairo 1.2.
-
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        (WebCore::GraphicsContext::clipOut):
-        * platform/gtk/RenderThemeGtk.cpp:
-        (WebCore::paintMozWidget):
-
-2008-10-22  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        A little more PLATFORM(CHROMIUM) in WebCore
-        https://bugs.webkit.org/show_bug.cgi?id=21758
-
-        * page/AccessibilityObject.h:
-        * platform/graphics/Icon.h:
-
-2008-10-21  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Test: fast/events/message-channel-gc-3.html
-
-        https://bugs.webkit.org/show_bug.cgi?id=21769
-        MessagePort should be GC protected if there are messages to be delivered
-
-        * dom/MessagePort.h: Removed pending activity count. Now we track if a close event is
-        pending, and check if the queue is non-empty.
-        (WebCore::MessagePort::workerContext): Added a stub implementation for a cross-heap GC bug
-        fix (below).
-
-        * dom/MessagePort.cpp:
-        (WebCore::CloseMessagePortTimer::fired):
-        (WebCore::MessagePort::MessagePort):
-        (WebCore::MessagePort::queueCloseEvent):
-        (WebCore::MessagePort::dispatchCloseEvent):
-        (WebCore::MessagePort::hasPendingActivity):
-        Track message and close event activity separately.
-
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::markCrossHeapDependentObjectsForDocument): Fixed a bug in cross-heap GC that was
-        causing same-heap ports to never be deleted.
+        * inspector/front-end/ProfilesPanel.js: Print the "run" of the profile's
+        title if there are multiple profiles, and take into account the fact
+        that titles are displayed twice as much now.
+        (WebInspector.ProfilesPanel.prototype.displayTitleForProfileLink):
+        * page/Console.cpp:
+        (WebCore::Console::profile): Call new function.
 
-2008-10-21  Dan Bernstein  <mitz@apple.com>
+2009-06-22  David Hyatt  <hyatt@apple.com>
 
         Reviewed by Sam Weinig.
 
-        - remove unreachable code
-
-        * platform/text/BidiResolver.h:
-        (WebCore::::embed):
-
-2008-10-21  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=20352 
-        REGRESSION(r31030-31055): Choosing "Print window" from frame set 
-        prints blank page
-        and corresponding: <rdar://problem/6142398>
-
-        viewHeight() and viewWidth() only return valuable information if we 
-        are not printing. Everywhere else in the code, we make sure we are 
-        not printing before we call these functions. Adding a check for 
-        printing here fixes this bug, and framesets print again.
-
-        * rendering/RenderFrameSet.cpp:
-        (WebCore::RenderFrameSet::layout):
-
-2008-10-21  Yael Aharon <yael.aharon@nokia.com>
-
-        Reviewed by Simon.
-
-        Pixmap in canvas tag was not getting initialized.
-
-        See https://bugs.webkit.org/show_bug.cgi?id=21771
-
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::ImageBuffer::create):
-
-2008-10-20  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein
-
-        Add a comment explaining layoutDelta(), and an assertion
-        that checks that delta changes were correctly paired during layout.
-        
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::layout):
-        * rendering/RenderView.h:
-
-2008-10-20  Timothy Hatcher  <timothy@apple.com>
-
-        Make auto-complete only suggest properties that are valid syntax
-        when using dot-notation. Also when completing numeric properties,
-        the quotes are omitted inside the brackets.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21760
-        https://bugs.webkit.org/show_bug.cgi?id=21761
-
-        Reviewed by Oliver Hunt.
-
-        * inspector/front-end/Console.js:
-        (WebInspector.Console.prototype.completions): Skip properties that
-        are not valid identifies when using dot-notation. And omit the quotes
-        when completing numbers in bracket-notation.
-
-2008-10-20  Timothy Hatcher  <timothy@apple.com>
-
-        Fixes the Profiles panel in the Web Inspector, which was broken by
-        the JSValue base-class changes. Also renames some functions and
-        variables in JavaScriptProfileNode.cpp that where title case.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21764
-
-        Reviewed by Oliver Hunt.
-
-        * inspector/JavaScriptProfile.cpp:
-        (WebCore::toJS): Use a JSObject pointer instead of JSValuePtr so the
-        returned JSValuePtr will be treated as an object and not a value.
-        * inspector/JavaScriptProfileNode.cpp:
-        (WebCore::toJS): Ditto.
-
-2008-10-20  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Anders Carlsson.
-
-        Remove FrameLoaderClient::detachedFromParent4.  It is no longer used by any port.
-
-        * loader/EmptyClients.h:
-        (WebCore::EmptyFrameLoaderClient::detachedFromParent4):.
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::detachFromParent):
-        * loader/FrameLoaderClient.h:
-
-2008-10-20  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        Fix https://bugs.webkit.org/show_bug.cgi?id=21763
-        REGRESSION (r36108-r36113): Can't load picture content on wired.com galleries
-        <rdar://problem/6285025
-        
-        If we get 304 response we need to explicitly check if that completes the frame load.
-        
-        No test case, simulating the condition is pretty difficult.
-
-        * loader/loader.cpp:
-        (WebCore::Loader::Host::didReceiveResponse):
-
-2008-10-20  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        Work around <rdar://problem/6301728>.
-        
-        Don't assert that loads are deferred when we're using CFNetwork on Mac or Windows.
-        
-        * loader/MainResourceLoader.cpp:
-        (WebCore::MainResourceLoader::didReceiveResponse):
-        (WebCore::MainResourceLoader::didReceiveData):
-        (WebCore::MainResourceLoader::didFinishLoading):
-        (WebCore::MainResourceLoader::didFail):
-
-2008-10-20  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        Speculative fix for <rdar://problem/6242585> CrashTracer: [USER] 19 
-        crashes in Safari at com.apple.WebCore
-        WebCore::ScrollView::visibleContentRect const + 153
-
-        d->m_view can be null and is null-checked at other points in the 
-        code. The logs indicate that this crash occurs when closing a 
-        window containing a PDF, so in case where we crash, the PDF's view 
-        is probably already null. So the fix is to simply add a null-check.
-
-        * page/Frame.cpp:
-        (WebCore::Frame::selectionRect):
-
-2008-10-20  Adele Peterson  <adele@apple.com>
-
-        Reviewed by Darin Adler.
-
-        * html/HTMLFormElement.cpp: (WebCore::HTMLFormElement::formData):
-        Removed stray increment that would screw up any form with multiple files in it.
-
-2008-10-20  Sam Weinig  <sam@webkit.org>
-
-        Rubber-stamped by David Hyatt.
-
-        Split LengthBox and LengthSize into their own files.
-
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/Length.h:
-        (WebCore::Length::blend):
-        * platform/LengthBox.h: Copied from platform/Length.h.
-        (WebCore::LengthBox::LengthBox):
-        (WebCore::LengthBox::nonZero):
-        * platform/LengthSize.h: Copied from platform/Length.h.
-        (WebCore::LengthSize::LengthSize):
-        (WebCore::LengthSize::setWidth):
-        (WebCore::LengthSize::setHeight):
-        (WebCore::LengthSize::height):
-        * platform/Theme.h:
-        * rendering/style/FillLayer.h:
-        * rendering/style/NinePieceImage.h:
-        (WebCore::NinePieceImage::NinePieceImage):
-        * rendering/style/RenderStyle.h:
-        * rendering/style/StyleDashboardRegion.h:
-        * rendering/style/StyleSurroundData.h:
-        * rendering/style/StyleVisualData.h:
-
-2008-10-20  Dan Bernstein  <mitz@apple.com>
-
-        - Mac build fix
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2008-10-20  Alp Toker  <alp@nuanti.com>
-
-        Fix autotools dist build target by listing recently added header
-        files only. Not reviewed.
-
-        * GNUmakefile.am:
-
-2008-10-20  David Hyatt  <hyatt@apple.com>
-
-        Clean up some USE(NEW_THEME) ifdefs (I botched one of them and have broken non-Mac platforms).  Also
-        refactor some of the code that I put in ThemeMac to be cross-platform, since it was in RenderTheme.cpp
-        originally.
-
-        ifdef some methods in RenderTheme.cpp also that are no longer needed with the new Theme.
-
-        Reviewed by Adam Roben
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/Theme.cpp: Added.
-        (WebCore::Theme::controlSupportsBorder):
-        (WebCore::Theme::controlSupportsPadding):
-        * platform/Theme.h:
-        * platform/mac/ThemeMac.h:
-        * platform/mac/ThemeMac.mm:
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::adjustStyle):
-        * rendering/RenderTheme.h:
-
-2008-10-20  David Hyatt  <hyatt@apple.com>
-
-        Rename LengthBox's members to have m_ in front of them.
-
-        Reviewed by Sam Weinig
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::valueForNinePieceImage):
-        (WebCore::getPositionOffsetValue):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::mapNinePieceImage):
-        * platform/Length.h:
-        (WebCore::LengthBox::LengthBox):
-        (WebCore::LengthBox::left):
-        (WebCore::LengthBox::right):
-        (WebCore::LengthBox::top):
-        (WebCore::LengthBox::bottom):
-        (WebCore::LengthBox::operator==):
-        (WebCore::LengthBox::nonZero):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::paintNinePieceImage):
-        (WebCore::RenderObject::addDashboardRegions):
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::positionedObjectMoved):
-        (WebCore::RenderStyle::setClip):
-        (WebCore::RenderStyle::noneDashboardRegions):
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::left):
-        (WebCore::InheritedFlags::right):
-        (WebCore::InheritedFlags::top):
-        (WebCore::InheritedFlags::bottom):
-        (WebCore::InheritedFlags::clipLeft):
-        (WebCore::InheritedFlags::clipRight):
-        (WebCore::InheritedFlags::clipTop):
-        (WebCore::InheritedFlags::clipBottom):
-        (WebCore::InheritedFlags::marginTop):
-        (WebCore::InheritedFlags::marginBottom):
-        (WebCore::InheritedFlags::marginLeft):
-        (WebCore::InheritedFlags::marginRight):
-        (WebCore::InheritedFlags::paddingTop):
-        (WebCore::InheritedFlags::paddingBottom):
-        (WebCore::InheritedFlags::paddingLeft):
-        (WebCore::InheritedFlags::paddingRight):
-        (WebCore::InheritedFlags::setLeft):
-        (WebCore::InheritedFlags::setRight):
-        (WebCore::InheritedFlags::setTop):
-        (WebCore::InheritedFlags::setBottom):
-        (WebCore::InheritedFlags::setDashboardRegion):
-        (WebCore::InheritedFlags::setClipLeft):
-        (WebCore::InheritedFlags::setClipRight):
-        (WebCore::InheritedFlags::setClipTop):
-        (WebCore::InheritedFlags::setClipBottom):
-        (WebCore::InheritedFlags::setMarginTop):
-        (WebCore::InheritedFlags::setMarginBottom):
-        (WebCore::InheritedFlags::setMarginLeft):
-        (WebCore::InheritedFlags::setMarginRight):
-        (WebCore::InheritedFlags::setPaddingTop):
-        (WebCore::InheritedFlags::setPaddingBottom):
-        (WebCore::InheritedFlags::setPaddingLeft):
-        (WebCore::InheritedFlags::setPaddingRight):
-
-2008-10-20  Timothy Hatcher  <timothy@apple.com>
-
-        Make the Resource panel perform graph updates atomically, so when resources
-        are added the graph and summary graph update at the same time.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21755
-
-        Reviewed by Kevin McCullough.
-
-        * inspector/front-end/Resource.js:
-        (WebInspector.Resource.prototype.get startTime): Return -1 if the _startTime
-        property is undefined, null or 0. This allows callers to check for -1 and not
-        the other values when there is no startTime yet.
-        (WebInspector.Resource.prototype.get responseReceivedTime): Ditto.
-        (WebInspector.Resource.prototype.get endTime): Ditto.
-        (WebInspector.Resource.prototype.get duration): Remove an extra empty line.
-        (WebInspector.Resource.prototype.get latency): Ditto.
-        (WebInspector.Resource.prototype.get contentLength): Return 0 if the _duration
-        property is undefined or null. This allows callers to always assume a number.
-        (WebInspector.Resource.prototype.get expectedContentLength): Ditto.
-        (WebInspector.Resource.prototype.get errors): Simplify the case where there is
-        no _errors property yet.
-        (WebInspector.Resource.prototype.set errors): Remove the check if the new value
-        if the same as the previous value, since there is no work to guard.
-        (WebInspector.Resource.prototype.get warnings): Simplify the case where there is
-        no _warnings property yet.
-        (WebInspector.Resource.prototype.set warnings): Remove the check if the new value
-        if the same as the previous value, since there is no work to guard.
-        (WebInspector.Resource.CompareByResponseReceivedTime): Add cases for when the
-        responseReceivedTime is -1.
-        (WebInspector.Resource.CompareByEndTime): Add cases for when the endTime is -1.
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype.get searchableViews): If a resource does not
-        have a _resourcesTreeElement yet, exclude it from the searchable views.
-        (WebInspector.ResourcesPanel.prototype.set calculator): Set _staleResource to _resources
-        and call refresh to refresh the entire graph.
-        (WebInspector.ResourcesPanel.prototype.set needsRefresh): Set a timeout if the panel
-        is visible that calls refresh.
-        (WebInspector.ResourcesPanel.prototype.refresh): Create the resource tree element and
-        graph for a resource if it hasn't been created yet. If the boundaries changed during
-        the first stale resource pass, do a full pass of all resources when updating the graphs.
-        (WebInspector.ResourcesPanel.prototype.reset): Remove the legend items.
-        (WebInspector.ResourcesPanel.prototype.addResource): Don't create the tree element and
-        graph, these are now created during the first refresh.
-        (WebInspector.ResourcesPanel.prototype.removeResource): Null check _resourcesTreeElement.
-        (WebInspector.ResourcesPanel.prototype.addMessageToResource): Ditto.
-        (WebInspector.ResourcesPanel.prototype.clearMessages): Ditto.
-        (WebInspector.ResourcesPanel.prototype.refreshResource): Remove most of the work, just
-        add the resource to the _staleResources and set needsRefresh.
-        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded): Null check
-        _resourcesTreeElement.
-        (WebInspector.ResourcesPanel.prototype._sortResourcesIfNeeded): Remove code to clear
-        the timeout used by the deleted _sortResourcesSoonIfNeeded. Remove call to removeChild
-        since the insertBefore call will do it if needed.
-        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded): Remove code to
-        clear the timeout used by the deleted _updateGraphDividersSoonIfNeeded.
-        (WebInspector.ResourcesPanel.prototype._updateSummaryGraph): Remove code to clear the
-        timeout used by the deleted _updateSummaryGraphSoon. No need to remove the totalLegendLabel,
-        since all the legend items are removed in one pass right before.
-        (WebInspector.ResourcesPanel.prototype._changeSortingFunction): Set the sortingFunction
-        before the calculator so the correct sortingFunction is there when a refresh happens.
-        (WebInspector.ResourceTimeCalculator.prototype.computeBarGraphPercentages): Set start to 0
-        when the startTime is -1, since that looks best visually. Also set middle and end
-        to the start and middle (respectfully) when startAtZero. This looks best visually.
-        (WebInspector.ResourceGraph): Start the graph as hidden until the first refresh.
-        (WebInspector.ResourceGraph.prototype.refresh): Remove the hidden class.
-
-2008-10-20  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21733
-
-        Make sure that the haveMetadata flag is set to true for generated images from image buffers, so that
-        no attempt is made to re-cache the frame from a non-existent image source.
-
-        Reviewed by Sam Weinig
-
-        * platform/graphics/cairo/ImageCairo.cpp:
-        (WebCore::BitmapImage::BitmapImage):
-        * platform/graphics/cg/ImageCG.cpp:
-        (WebCore::BitmapImage::BitmapImage):
-
-2008-10-20  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by John Sullivan.
-
-        - make hasARenderedDescendant() have internal linkage
-
-        * editing/CompositeEditCommand.cpp:
-        (WebCore::hasARenderedDescendant):
-
-2008-10-20  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Jon Honeycutt
-
-        Fix a crash in Accessibility where a table section was being 
-        referenced without first checking if it was null
-
-        https://bugs.webkit.org/show_bug.cgi?id=21721
-
-        Test: accessibility/table-nofirstbody.html
-
-        * page/AccessibilityTable.cpp:
-        (WebCore::AccessibilityTable::addChildren):
-
-2008-10-20  David Hyatt  <hyatt@apple.com>
-
-        Avoid some stderr spew from CG by checking if we have a decoder yet in ImageSourceCG.
-
-        Reviewed by Darin Adler
-
-        * platform/graphics/cg/ImageSourceCG.cpp:
-        (WebCore::ImageSource::repetitionCount):
-        (WebCore::ImageSource::frameDurationAtIndex):
-
-2008-10-20  Alp Toker  <alp@nuanti.com>
-
-        Reviewed by Mark Rowe.
-
-        Fix the pthread conditionals in the FTP code to correctly define
-        threadsafe *_r functions on Windows. Partly fixes the GTK+/Win32
-        build.
-
-        * loader/FTPDirectoryDocument.cpp:
-        * loader/FTPDirectoryParser.cpp:
-
-2008-10-20  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21751
-
-        Convert checkboxes and radio buttons on OS X over to the new Theme API.
-
-        Reviewed by Adam Roben
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::mapFillSize):
-        * platform/Length.h:
-        (WebCore::LengthSize::LengthSize):
-        (WebCore::LengthSize::operator==):
-        (WebCore::LengthSize::width):
-        (WebCore::LengthSize::height):
-        (WebCore::LengthSize::setWidth):
-        (WebCore::LengthSize::setHeight):
-        * platform/Theme.h:
-        (WebCore::Theme::controlSize):
-        (WebCore::Theme::controlSupportsBorder):
-        (WebCore::Theme::controlSupportsPadding):
-        (WebCore::Theme::paint):
-        (WebCore::Theme::inflateControlPaintRect):
-        * platform/ThemeTypes.h:
-        (WebCore::):
-        * platform/mac/ThemeMac.h:
-        * platform/mac/ThemeMac.mm:
-        (WebCore::):
-        (WebCore::controlSizeForFont):
-        (WebCore::sizeFromFont):
-        (WebCore::setControlSize):
-        (WebCore::updateStates):
-        (WebCore::inflateRect):
-        (WebCore::checkboxSizes):
-        (WebCore::checkboxMargins):
-        (WebCore::checkboxSize):
-        (WebCore::checkbox):
-        (WebCore::paintCheckbox):
-        (WebCore::radioSizes):
-        (WebCore::radioMargins):
-        (WebCore::radioSize):
-        (WebCore::radio):
-        (WebCore::paintRadio):
-        (WebCore::ThemeMac::baselinePositionAdjustment):
-        (WebCore::ThemeMac::controlSize):
-        (WebCore::ThemeMac::controlSupportsBorder):
-        (WebCore::ThemeMac::controlSupportsPadding):
-        (WebCore::ThemeMac::inflateControlPaintRect):
-        (WebCore::ThemeMac::paint):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::calculateBackgroundSize):
-        * rendering/RenderObject.cpp:
-        (WebCore::mustRepaintFillLayers):
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::adjustStyle):
-        (WebCore::RenderTheme::paint):
-        (WebCore::RenderTheme::baselinePosition):
-        (WebCore::RenderTheme::adjustRepaintRect):
-        (WebCore::RenderTheme::controlStatesForRenderer):
-        (WebCore::RenderTheme::isFocused):
-        * rendering/RenderTheme.h:
-        * rendering/RenderThemeMac.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::adjustRepaintRect):
-        * rendering/style/FillLayer.cpp:
-        (WebCore::FillLayer::operator==):
-
-2008-10-18  Geoffrey Garen  <ggaren@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=26615
 
-        Reviewed by Darin Adler.
+        Add IDL interface for datagrid cell elements.  Add a few more properties to the datagrid itself that
+        correspond to ones you find on <select> elements.
 
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=21735
-        Emit profiling instrumentation only if the Web Inspector's profiling
-        feature is enabled
-
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::supportsProfiling):
-        * bindings/js/JSDOMWindowBase.h: Implemented the interface for specifying
-        whether a target global object has the Web Inspector's profiling feature
-        enabled.
-
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::recompileAllJSFunctionsSoon):
-        (WebCore::JavaScriptDebugServer::didAddListener):
-        (WebCore::JavaScriptDebugServer::didRemoveListener):
-        * inspector/JavaScriptDebugServer.h: Exported an API for recompiling, 
-        used by the Settings object.
-
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-        (WebCore::Settings::setDeveloperExtrasEnabled):
-        * page/Settings.h: Recompile when the developer menu is enabled/disabled
-        for the first time, to add/remove profiling hooks. In the future, with
-        better Web Inspector UI, we can do this on a page-by-page basis,
-        instead of a global basis.
-
-2008-10-20  David Hyatt  <hyatt@apple.com>
-
-        Move Length to platform/.
-
-        Reviewed by Adam Roben
+        Add an expanded property to row elements.
 
+        * DerivedSources.cpp:
+        * DerivedSources.make:
         * GNUmakefile.am:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
         * WebCoreSources.bkl:
-        * platform/Length.cpp: Copied from rendering/Length.cpp.
-        * platform/Length.h: Copied from rendering/Length.h.
-
-2008-10-20  Darin Adler  <darin@apple.com>
-
-        - try to fix Qt build
-
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::QtRuntimeMetaMethod::connectGetter): Add asObject calls.
-        (JSC::Bindings::QtRuntimeMetaMethod::disconnectGetter): Ditto.
-
-2008-10-20  Darin Adler  <darin@apple.com>
-
-        - try to fix Qt build
-
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtInstance::mark): Use JSValue* instead of JSValuePtr.
-        (JSC::Bindings::QtField::valueFromInstance): Ditto.
-        * bridge/qt/qt_instance.h: Ditto.
-
-2008-10-20  Darin Adler  <darin@apple.com>
-
-        - try to fix Tiger build
-
-        * bridge/objc/objc_instance.mm:
-        (ObjcInstance::invokeMethod): Add a const_cast to remove the unwanted
-        volatile qualifier.
-        (ObjcInstance::invokeDefaultMethod): Ditto.
-        (ObjcInstance::getValueOfUndefinedField): Ditto.
-        * bridge/objc/objc_runtime.mm:
-        (JSC::Bindings::ObjcField::valueFromInstance): Ditto.
-
-2008-10-20  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21750
-        Eliminate the notion of "temporary events"
-
-        We mark some events as temporary when dispatching, for the sole reason of
-        manually calling forgetDOMObject when done dispatching.
-
-        There doesn't seem to be any reason to call it manually, as JSEvent destructor
-        will do this automatically right away.
-
-        * bindings/js/ScriptController.cpp:
-        * bindings/js/ScriptController.h:
-        Removed ScriptController::finishedWithEvent(), which was called after dispatching
-        a temporary event.
-
-        * dom/ContainerNode.cpp:
-        (WebCore::dispatchChildInsertionEvents):
-        (WebCore::dispatchChildRemovalEvents):
-        * dom/EventTarget.h:
-        * dom/EventTargetNode.cpp:
-        (WebCore::EventTargetNode::dispatchEvent):
-        (WebCore::EventTargetNode::dispatchGenericEvent):
-        (WebCore::EventTargetNode::dispatchSubtreeModifiedEvent):
-        (WebCore::EventTargetNode::dispatchWindowEvent):
-        (WebCore::EventTargetNode::dispatchUIEvent):
-        (WebCore::EventTargetNode::dispatchKeyEvent):
-        (WebCore::EventTargetNode::dispatchMouseEvent):
-        (WebCore::EventTargetNode::dispatchWheelEvent):
-        (WebCore::EventTargetNode::dispatchWebKitAnimationEvent):
-        (WebCore::EventTargetNode::dispatchWebKitTransitionEvent):
-        (WebCore::EventTargetNode::dispatchEventForType):
-        (WebCore::EventTargetNode::dispatchProgressEvent):
-        (WebCore::EventTargetNode::dispatchStorageEvent):
-        * dom/EventTargetNode.h:
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::dispatchMessages):
-        (WebCore::MessagePort::dispatchCloseEvent):
-        (WebCore::MessagePort::dispatchEvent):
-        * dom/MessagePort.h:
-        * editing/Editor.cpp:
-        (WebCore::Editor::dispatchCPPEvent):
-        (WebCore::dispatchEditableContentChangedEvents):
-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::ReplacementFragment::ReplacementFragment):
-        * editing/TypingCommand.cpp:
-        (WebCore::TypingCommand::insertText):
-        * loader/appcache/DOMApplicationCache.cpp:
-        (WebCore::DOMApplicationCache::dispatchEvent):
-        (WebCore::DOMApplicationCache::callListener):
-        * loader/appcache/DOMApplicationCache.h:
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::dispatchDragEvent):
-        (WebCore::EventHandler::keyEvent):
-        (WebCore::EventHandler::handleTextInputEvent):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::scheduleEvent):
-        (WebCore::FrameView::updateOverflowStatus):
-        (WebCore::FrameView::dispatchScheduledEvents):
-        * page/FrameView.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::scrollToOffset):
-        (WebCore::RenderLayer::updateOverflowStatus):
-        * svg/SVGElement.cpp:
-        (WebCore::SVGElement::sendSVGLoadEventIfPossible):
-        * svg/SVGElementInstance.cpp:
-        (WebCore::SVGElementInstance::dispatchEvent):
-        * svg/SVGElementInstance.h:
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::dispatchEvent):
-        (WebCore::XMLHttpRequest::dispatchReadyStateChangeEvent):
-        (WebCore::XMLHttpRequest::dispatchXMLHttpRequestProgressEvent):
-        * xml/XMLHttpRequest.h:
-        * xml/XMLHttpRequestUpload.cpp:
-        (WebCore::XMLHttpRequestUpload::dispatchEvent):
-        (WebCore::XMLHttpRequestUpload::dispatchXMLHttpRequestProgressEvent):
-        * xml/XMLHttpRequestUpload.h:
-        Don't pass the tempEvent boolean around.
-
-2008-10-20  Alp Toker  <alp@nuanti.com>
-
-        Remove unused includes only. Partial GTK+/Win build fix.
-
-        * platform/graphics/gtk/SimpleFontDataPango.cpp:
-
-2008-10-20  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21705
-        Implement Web Workers client-side API
-
-        The implementation is experimental, and disabled by default. It doesn't quite match the
-        published draft, being influenced by further WHATWG discussions.
-
-        This only implements the client-side API, and does not actually create any threads or
-        global contexts yet.
-
-        * DerivedSources.make: Added DedicatedWorker. SharedWorker is not implemented yet, as I'm
-        still not sure if having separate classes for these helps at all.
-
-        * WebCore.xcodeproj/project.pbxproj: Added new files.
-
-        * bindings/js/JSDOMWindowBase.cpp:
-        (jsDOMWindowBaseWorker):
-        (WebCore::JSDOMWindowBase::put):
-        (setJSDOMWindowBaseWorker):
-        Added window.Worker constructor. Moved JSXSLTProcessorConstructor.h include out of ifdef
-        to match prevailing style.
-
-        * bindings/js/JSDedicatedWorkerConstructor.cpp: Added.
-        * bindings/js/JSDedicatedWorkerConstructor.h: Added.
-        * bindings/js/JSDedicatedWorkerCustom.cpp: Added.
-        The implementation of event listeners are left custom intentionally, for easier implementation
-        of listeners that are not tied to any Document in the future.
-
-        * dom/DedicatedWorker.cpp: Added.
-        * dom/DedicatedWorker.h: Added.
-        * dom/DedicatedWorker.idl: Added.
-        Added an implementation that can only load requested scripts for now.
-
-2008-10-19  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        - fix assertion seen when opening inspector
-
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertySlot):
-        Removed unneeded asObject cast.
-
-2008-10-19  Dan Bernstein  <mitz@apple.com>
-
-        Rubber-stamped by Timothy Hatcher.
-
-        - remove empty directories and correct the MIME type of inspector images
-
-        * page/inspector: Removed.
-        * page/inspector/Images: Removed.
-
-2008-10-19  Timothy Hatcher  <timothy@apple.com>
-
-        Make the Web Inspector Resources panel open quicker and change graphs
-        faster. There was some accidental n^2 logic at fault when updating the
-        graph boundaries.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21742
-
-        Reviewed by Darin Adler.
-
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype.set calculator): Return early for
-        a null calculator. Remove the second argument passed to _refreshAllResources.
-        (WebInspector.ResourcesPanel.prototype.refresh): Call updateBoundaries on
-        the calculator for all the stale resources before calling refreshResource.
-        Pass true for the first argument of refreshResource to skip the boundary update.
-        (WebInspector.ResourcesPanel.prototype._updateGraphBoundariesIfNeeded): Remove
-        the second argument passed to _refreshAllResources.
-        (WebInspector.ResourcesPanel.prototype._refreshAllResourcesSoon): Remove the
-        skipSort argument since every passed true, and it would be bad to pass false.
-        (WebInspector.ResourcesPanel.prototype._refreshAllResources): Ditto. And if
-        skipBoundaryUpdate is false, call updateBoundaries on the calculator for all
-        the resources before calling refreshResource. Pass true for the first argument
-        of refreshResource to skip the boundary update.
-
-2008-10-19  Timothy Hatcher  <timothy@apple.com>
-
-        Visually distinguish resources that loaded from the memory cache.
-
-        https://bugs.webkit.org/show_bug.cgi?id=14279
-
-        Reviewed by Dan Bernstein.
-
-        * English.lproj/localizedStrings.js: New string.
-        * inspector/front-end/Images/timelineHollowPillBlue.png: Added.
-        * inspector/front-end/Images/timelineHollowPillGray.png: Added.
-        * inspector/front-end/Images/timelineHollowPillGreen.png: Added.
-        * inspector/front-end/Images/timelineHollowPillOrange.png: Added.
-        * inspector/front-end/Images/timelineHollowPillPurple.png: Added.
-        * inspector/front-end/Images/timelineHollowPillRed.png: Added.
-        * inspector/front-end/Images/timelineHollowPillYellow.png: Added.
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourceCalculator.prototype.computeBarGraphLabels):
-        Add the "(from cache)" suffix to the tooltip.
-        (WebInspector.ResourceTimeCalculator.prototype.computeBarGraphLabels):
-        Add the "(from cache)" suffix to the tooltip.
-        (WebInspector.ResourceGraph): Add the "resource-cached" class.
-        * inspector/front-end/inspector.css: New styles to make the timeline
-        bars use the hollow pill images.
-
-2008-10-19  Timothy Hatcher  <timothy@apple.com>
-
-        Update the scroll position in the Resources panel when loading
-        a new page or toggling on small resource rows.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20114
-
-        Reviewed by Darin Adler.
-
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype.reset): Scroll to the top,
-        since all the resource are being removed.
-        (WebInspector.ResourcesPanel.prototype.removeResource): Call
-        _adjustScrollPosition in case the view is shorter and needs scrolled.
-        (WebInspector.ResourcesPanel.prototype._toggleLargerResources): Ditto.
-        (WebInspector.ResourcesPanel.prototype._adjustScrollPosition): Check
-        the height of the sidebar against the scrollTop and height of the
-        resourcesContainerElement. If the sidebar is shorter, scroll up
-        so the last resource is at the bottom again.
-
-2008-10-19  Timothy Hatcher  <timothy@apple.com>
-
-        Show per resource times and sizes when hovering over the bar graph for a resource.
-
-        https://bugs.webkit.org/show_bug.cgi?id=14300
-        rdar://problem/5712802
-
-        Reviewed by Cameron Zwarich.
-
-        * English.lproj/localizedStrings.js: Add new strings.
-        * inspector/front-end/Images/graphLabelCalloutLeft.png: Added.
-        * inspector/front-end/Images/graphLabelCalloutRight.png: Added.
-        * inspector/front-end/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype.refreshResource): Pass the calculator to the
-        ResourceGraph.refresh function.
-        (WebInspector.ResourceCalculator.prototype.computeBarGraphLabels): Default implementation
-        returns the formatted value.
-        (WebInspector.ResourceTimeCalculator.prototype.computeBarGraphLabels): Return discrete values
-        for the latency and download times. Also generate a custom tooltip.
-        (WebInspector.ResourceGraph): Add a mouseover event listener that calls refreshLabelPositions.
-        (WebInspector.ResourceGraph.prototype.refreshLabelPositions): Added. Updates the label positions
-        in case the bar has changed size.
-        (WebInspector.ResourceGraph.prototype.refresh): Set the label text and tooltips.
-        * inspector/front-end/inspector.css: New styles for the labels.
-
-2008-10-19  Darin Adler  <darin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        - next step of https://bugs.webkit.org/show_bug.cgi?id=21732
-          improve performance by eliminating JSValue as a base class for JSCell
-
-        Remove most uses of JSValue, which will be removed in a future patch.
-
-        * bindings/js/JSCustomXPathNSResolver.h: Removed declaration of JSValue
-        and used JSValuePtr instead.
-        * bindings/js/JSEventTarget.h: Ditto.
-        * bindings/js/JSNodeFilterCondition.h: Ditto.
-        * bindings/js/ScheduledAction.h: Ditto.
-        * bindings/js/ScriptController.h: Ditto.
-        * bindings/objc/WebScriptObjectPrivate.h: Ditto.
-        * bridge/c/c_utility.h: Ditto.
-        * bridge/jni/jni_jsobject.h: Ditto.
-        * bridge/jni/jni_utility.h: Ditto.
-        * bridge/objc/WebScriptObject.h: Ditto.
-        * dom/Traversal.h: Ditto.
-        * inspector/InspectorController.cpp: Ditto.
-        * inspector/JavaScriptProfile.h: Ditto.
-        * inspector/JavaScriptProfileNode.h: Ditto.
-        * loader/FrameLoader.h: Ditto.
-        * page/Console.h: Ditto.
-        * plugins/MimeTypeArray.h: Ditto.
-        * plugins/Plugin.h: Ditto.
-        * plugins/PluginArray.h: Ditto.
-        * plugins/PluginView.cpp:
-        (WebCore::getString): Ditto.
-        (WebCore::PluginView::performRequest): Ditto.
-        * plugins/gtk/PluginViewGtk.cpp: Ditto.
-        * plugins/qt/PluginViewQt.cpp: Ditto.
-        * plugins/win/PluginViewWin.cpp: Ditto.
-
-        * bridge/qt/qt_class.cpp:
-        (JSC::Bindings::QtClass::fallbackObject): Use JSValuePtr and JSObject*
-        instead of JSValue*.
-        * bridge/qt/qt_class.h: Ditto.
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtInstance::mark): Ditto.
-        (JSC::Bindings::QtInstance::invokeMethod): Ditto.
-        (JSC::Bindings::QtInstance::defaultValue): Ditto.
-        (JSC::Bindings::QtInstance::stringValue): Ditto.
-        (JSC::Bindings::QtInstance::numberValue): Ditto.
-        (JSC::Bindings::QtInstance::booleanValue): Ditto.
-        (JSC::Bindings::QtInstance::valueOf): Ditto.
-        (JSC::Bindings::QtField::valueFromInstance): Ditto.
-        (JSC::Bindings::QtField::setValueToInstance): Ditto.
-        * bridge/qt/qt_instance.h: Ditto.
-        * bridge/qt/qt_runtime.cpp: Ditto.
-        (JSC::Bindings::valueRealType): Ditto.
-        (JSC::Bindings::convertValueToQVariant): Ditto.
-        (JSC::Bindings::convertQVariantToValue): Ditto.
-        (JSC::Bindings::findMethodIndex): Ditto.
-        (JSC::Bindings::QtRuntimeMetaMethod::call): Ditto.
-        (JSC::Bindings::QtRuntimeMetaMethod::lengthGetter): Ditto.
-        (JSC::Bindings::QtRuntimeMetaMethod::connectGetter): Ditto.
-        (JSC::Bindings::QtRuntimeMetaMethod::disconnectGetter): Ditto.
-        (JSC::Bindings::QtRuntimeConnectionMethod::call): Ditto.
-        (JSC::Bindings::QtRuntimeConnectionMethod::lengthGetter): Ditto.
-        (JSC::Bindings::QtArray::setValueAt): Ditto.
-        (JSC::Bindings::QtArray::valueAt): Ditto.
-        * bridge/qt/qt_runtime.h: Ditto.
-
-        * bridge/testqtbindings.cpp:
-        (main): Use JSValuePtr.
-
-2008-10-18  Darin Adler  <darin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        - next step of https://bugs.webkit.org/show_bug.cgi?id=21732
-          improve performance by eliminating JSValue as a base class for JSCell
-
-        Tweak a little more to get closer to where we can make JSValuePtr a class.
-
-        * bindings/js/JSAudioConstructor.cpp:
-        (WebCore::JSAudioConstructor::JSAudioConstructor): Use asObject.
-        (WebCore::constructAudio): Ditto.
-        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
-        (WebCore::JSCSSStyleDeclaration::nameGetter): Ditto.
-
-        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
-        (WebCore::toHTMLCanvasStyle): Use asString and asObject.
-        (WebCore::JSCanvasRenderingContext2D::setFillColor): Ditto.
-        (WebCore::JSCanvasRenderingContext2D::setStrokeColor): Ditto.
-        (WebCore::JSCanvasRenderingContext2D::drawImage): Ditto.
-        (WebCore::JSCanvasRenderingContext2D::drawImageFromRect): Ditto.
-        (WebCore::JSCanvasRenderingContext2D::setShadow): Ditto.
-        (WebCore::JSCanvasRenderingContext2D::createPattern): Ditto.
-
-        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
-        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent): Use JSValuePtr.
-
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::setDOMException): Use noValue.
-
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::getDOMPrototype): Use asObject.
-
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::showModalDialog): Use noValue.
-        (jsDOMWindowBaseEvent): Use asObject.
-        (jsDOMWindowBaseImage): Ditto.
-        (jsDOMWindowBaseMessageChannel): Ditto.
-        (jsDOMWindowBaseOption): Ditto.
-        (jsDOMWindowBaseXMLHttpRequest): Ditto.
-        (jsDOMWindowBaseAudio): Ditto.
-        (jsDOMWindowBaseXSLTProcessor): Ditto.
-        (WebCore::JSDOMWindowBase::childFrameGetter): Ditto.
-        (WebCore::JSDOMWindowBase::indexGetter): Ditto.
-        (WebCore::JSDOMWindowBase::namedItemGetter): Ditto.
-        (WebCore::JSDOMWindowBase::getOwnPropertySlot): Ditto.
-        (WebCore::JSDOMWindowBase::findJSEventListener): Ditto.
-        (WebCore::JSDOMWindowBase::findOrCreateJSEventListener): Ditto.
-        (WebCore::JSDOMWindowBase::findJSUnprotectedEventListener): Ditto.
-        (WebCore::JSDOMWindowBase::findOrCreateJSUnprotectedEventListener): Ditto.
-        (windowProtoFuncOpen): Use noValue.
-        (WebCore::toJSDOMWindow): Use asObject.
-
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::setTimeoutOrInterval): Use asString.
-        (WebCore::toDOMWindow): Use asObject.
-
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSAbstractEventListener::handleEvent): Use noValue.
-        (WebCore::JSLazyEventListener::parseCode): Use asObject.
-
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::JSHTMLCollection::nameGetter): Use asObject.
-        * bindings/js/JSHTMLDocumentCustom.cpp:
-        (WebCore::JSHTMLDocument::nameGetter): Ditto.
-        * bindings/js/JSHTMLElementCustom.cpp:
-        (WebCore::JSHTMLElement::pushEventHandlerScope): Ditto.
-        * bindings/js/JSHTMLFormElementCustom.cpp:
-        (WebCore::JSHTMLFormElement::nameGetter): Ditto.
-        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
-        (WebCore::JSHTMLFrameSetElement::nameGetter): Ditto.
-        * bindings/js/JSHTMLOptionElementConstructor.cpp:
-        (WebCore::JSHTMLOptionElementConstructor::JSHTMLOptionElementConstructor): Ditto.
-        (WebCore::constructHTMLOptionElement): Ditto.
-        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
-        (WebCore::JSHTMLOptionsCollection::remove): Ditto.
-        * bindings/js/JSImageConstructor.cpp:
-        (WebCore::JSImageConstructor::JSImageConstructor): Ditto.
-        (WebCore::constructImage): Ditto.
-        * bindings/js/JSInspectedObjectWrapper.cpp:
-        (WebCore::JSInspectedObjectWrapper::wrap): Ditto.
-        * bindings/js/JSInspectorCallbackWrapper.cpp:
-        (WebCore::JSInspectorCallbackWrapper::wrap): Ditto.
-
-        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
-        (WebCore::JSJavaScriptCallFrame::evaluate): Use noValue.
-
-        * bindings/js/JSMessageChannelConstructor.cpp:
-        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor): Use asObject.
-        (WebCore::JSMessageChannelConstructor::construct): Ditto.
-        * bindings/js/JSMimeTypeArrayCustom.cpp:
-        (WebCore::JSMimeTypeArray::nameGetter): Ditto.
-        * bindings/js/JSNamedNodeMapCustom.cpp:
-        (WebCore::JSNamedNodeMap::nameGetter): Ditto.
-        * bindings/js/JSNamedNodesCollection.cpp:
-        (WebCore::JSNamedNodesCollection::lengthGetter): Ditto.
-        (WebCore::JSNamedNodesCollection::indexGetter): Ditto.
-        * bindings/js/JSNodeFilterCustom.cpp:
-        (WebCore::toNodeFilter): Ditto.
-        * bindings/js/JSNodeListCustom.cpp:
-        (WebCore::JSNodeList::nameGetter): Ditto.
-        * bindings/js/JSPluginArrayCustom.cpp:
-        (WebCore::JSPluginArray::nameGetter): Ditto.
-        * bindings/js/JSPluginCustom.cpp:
-        (WebCore::JSPlugin::nameGetter): Ditto.
-        * bindings/js/JSPluginElementFunctions.cpp:
-        (WebCore::runtimeObjectGetter): Ditto.
-        (WebCore::runtimeObjectPropertyGetter): Ditto.
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::asWrapper): Ditto.
-        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertySlot): Ditto.
-        (WebCore::JSQuarantinedObjectWrapper::construct): Ditto.
-        * bindings/js/JSRGBColor.cpp:
-        (jsRGBColorRed): Ditto.
-        (jsRGBColorGreen): Ditto.
-        (jsRGBColorBlue): Ditto.
-
-        * bindings/js/JSSQLResultSetRowListCustom.cpp:
-        (WebCore::JSSQLResultSetRowList::item): Use noValue.
-
-        * bindings/js/JSStorageCustom.cpp:
-        (WebCore::JSStorage::nameGetter): Use asObject.
-        (WebCore::JSStorage::deleteProperty): Ditto.
-        (WebCore::JSStorage::customPut): Ditto.
-        * bindings/js/JSStyleSheetListCustom.cpp:
-        (WebCore::JSStyleSheetList::nameGetter): Ditto.
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor): Ditto.
-        * bindings/js/JSXSLTProcessorCustom.cpp:
-        (WebCore::JSXSLTProcessor::importStylesheet): Ditto.
-        (WebCore::JSXSLTProcessor::transformToFragment): Ditto.
-        (WebCore::JSXSLTProcessor::transformToDocument): Ditto.
-
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate): Use noValue.
-        * bindings/objc/DOMInternal.mm:
-        (-[WebScriptObject _initializeScriptDOMNodeImp]): Ditto.
-
-        * bindings/objc/WebScriptObject.mm:
-        (-[WebScriptObject evaluateWebScript:]): Use JSValuePtr.
-        (-[WebScriptObject valueForKey:]): Ditto.
-        (-[WebScriptObject webScriptValueAtIndex:]): Ditto.
-        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
-        Use asObject and asString.
-
-        * bindings/scripts/CodeGeneratorJS.pm: Use asObject.
-
-        * bridge/c/c_instance.h: Use JSValuePtr.
-        * bridge/c/c_runtime.cpp:
-        (JSC::Bindings::CField::setValueToInstance): Ditto.
-
-        * bridge/c/c_utility.cpp:
-        (JSC::Bindings::convertValueToNPVariant): Use asObject.
-
-        * bridge/jni/jni_instance.cpp:
-        (JavaInstance::booleanValue): Use JSValuePtr.
-        (JavaInstance::invokeMethod): Ditto. And noValue.
-        * bridge/jni/jni_jsobject.mm:
-        (JavaJSObject::getSlot): Ditto.
-        (JavaJSObject::convertValueToJObject): Ditto.
-        * bridge/jni/jni_runtime.cpp:
-        (JavaField::dispatchValueFromInstance): Ditto.
-        (JavaField::valueFromInstance): Ditto.
-        (JavaField::dispatchSetValueToInstance): Ditto.
-        (JavaField::setValueToInstance): Ditto.
-        (JavaArray::setValueAt): Ditto.
-        (JavaArray::valueAt): Ditto.
-        * bridge/jni/jni_runtime.h: Ditto.
-
-        * bridge/jni/jni_utility.cpp:
-        (JSC::Bindings::convertArrayInstanceToJavaArray): Take a JSArray*
-        instead of a JSValue*.
-        (JSC::Bindings::convertValueToJValue): Use asObject and asArray.
-
-        * bridge/objc/objc_class.h: Use JSValuePtr.
-        * bridge/objc/objc_instance.h: Ditto.
-        * bridge/objc/objc_runtime.h: Ditto.
-
-        * bridge/objc/objc_runtime.mm:
-        (JSC::Bindings::callObjCFallbackObject): Use asObject.
-
-        * bridge/objc/objc_utility.h: Use JSValuePtr.
-        * bridge/objc/objc_utility.mm:
-        (JSC::Bindings::convertValueToObjcValue): Use JSValuePtr and asObject.
-        (JSC::Bindings::convertObjcValueToValue): Use jsUndefined() instead of 0.
-
-        * bridge/runtime.cpp:
-        (JSC::Bindings::Instance::getValueOfField): Use JSValuePtr.
-        (JSC::Bindings::Instance::setValueOfField): Ditto.
-
-        * bridge/runtime_array.cpp:
-        (JSC::RuntimeArray::lengthGetter): Use JSValuePtr and asObject.
-        (JSC::RuntimeArray::indexGetter): Ditto.
-        * bridge/runtime_array.h: Ditto.
-        * bridge/runtime_method.cpp:
-        (JSC::RuntimeMethod::lengthGetter): Ditto.
-        (JSC::callRuntimeMethod): Ditto.
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::fallbackObjectGetter): Ditto.
-        (JSC::RuntimeObjectImp::fieldGetter): Ditto.
-        (JSC::RuntimeObjectImp::methodGetter): Ditto.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::executeScript): Use noValue.
-
-        * page/Console.cpp:
-        (WebCore::Console::trace): Use asInternalFunction.
-
-2008-10-19  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        - lower the default button repaint frequency
-
-        * rendering/RenderButton.cpp:
-        (WebCore::RenderButton::styleDidChange): Changed the timer interval from
-        0.01 to 0.03.
+        * html/HTMLAttributeNames.in:
+        * html/HTMLDataGridCellElement.cpp: Added.
+        (WebCore::HTMLDataGridCellElement::HTMLDataGridCellElement):
+        (WebCore::HTMLDataGridCellElement::label):
+        (WebCore::HTMLDataGridCellElement::setLabel):
+        (WebCore::HTMLDataGridCellElement::focused):
+        (WebCore::HTMLDataGridCellElement::setFocused):
+        (WebCore::HTMLDataGridCellElement::checked):
+        (WebCore::HTMLDataGridCellElement::setChecked):
+        (WebCore::HTMLDataGridCellElement::indeterminate):
+        (WebCore::HTMLDataGridCellElement::setIndeterminate):
+        (WebCore::HTMLDataGridCellElement::progress):
+        (WebCore::HTMLDataGridCellElement::setProgress):
+        * html/HTMLDataGridCellElement.h: Added.
+        (WebCore::HTMLDataGridCellElement::endTagRequirement):
+        (WebCore::HTMLDataGridCellElement::tagPriority):
+        * html/HTMLDataGridCellElement.idl: Added.
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::autofocus):
+        (WebCore::HTMLDataGridElement::setAutofocus):
+        (WebCore::HTMLDataGridElement::disabled):
+        (WebCore::HTMLDataGridElement::setDisabled):
+        (WebCore::HTMLDataGridElement::size):
+        (WebCore::HTMLDataGridElement::setSize):
+        * html/HTMLDataGridElement.h:
+        * html/HTMLDataGridElement.idl:
+        * html/HTMLDataGridRowElement.cpp:
+        (WebCore::HTMLDataGridRowElement::checkDTD):
+        (WebCore::HTMLDataGridRowElement::expanded):
+        (WebCore::HTMLDataGridRowElement::setExpanded):
+        * html/HTMLDataGridRowElement.h:
+        * html/HTMLDataGridRowElement.idl:
+        * html/HTMLElementsAllInOne.cpp:
+        * html/HTMLTagNames.in:
 
-2008-10-18  Dan Bernstein  <mitz@apple.com>
+2009-06-22  Sam Weinig  <sam@webkit.org>
 
         Reviewed by Mark Rowe.
 
-        - Windows build fix
-
-        * rendering/RenderThemeSafari.cpp:
-        (WebCore::RenderThemeSafari::paintMediaFullscreenButton):
-        (WebCore::RenderThemeSafari::paintMediaMuteButton):
-        (WebCore::RenderThemeSafari::paintMediaPlayButton):
-        (WebCore::RenderThemeSafari::paintMediaSeekBackButton):
-        (WebCore::RenderThemeSafari::paintMediaSeekForwardButton):
-        (WebCore::RenderThemeSafari::paintMediaSliderThumb):
-
-2008-10-18  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - WebCore part of https://bugs.webkit.org/show_bug.cgi?id=21736
-          Long-dead decoded image data make up for most of the object cache's memory use over time
-
-        Add a cache setting for how long decoded image data should be allowed to
-        persist in memory after the image has died. By default, this is set to
-        0, which means "forever".
-
-        * loader/Cache.cpp:
-        (WebCore::Cache::Cache): Initialize m_deadDecodedDataDeletionInterval.
-        * loader/Cache.h:
-        (WebCore::Cache::setDeadDecodedDataDeletionInterval): Added a setter.
-        (WebCore::Cache::deadDecodedDataDeletionInterval): Added a getter.
-        * loader/CachedImage.cpp:
-        (WebCore::CachedImage::CachedImage): Initialize the decoded data
-        deletion timer.
-        (WebCore::CachedImage::decodedDataDeletionTimerFired): Added. Destroys
-        the decoded image data.
-        (WebCore::CachedImage::addClient): Stop the timer if it is active.
-        (WebCore::CachedImage::allClientsRemoved): Start the decoded data
-        deletion timer.
-        * loader/CachedImage.h:
-
-2008-10-18  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=21645
-          REGRESSION (r37469-r37605): File Input not Uploaded in Multipart/Form-data Form
-
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::formData):
-        Fix loop that goes through the FormDataList to go two at a time in a clearer
-        way. My last patch screwed up the way it got form content from the items.
-        This "two at a time" approach is a confusing way to do things, which explains
-        why I got it wrong last time through, but I decided to just fix it locally for
-        now rather than changing the design of FormDataList.
-
-2008-10-18  Darin Adler  <darin@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        - next step on https://bugs.webkit.org/show_bug.cgi?id=21732
-          improve performance by eliminating JSValue as a base class for JSCell
-
-        Use JSValuePtr everywhere instead of JSValue*. In the future, we'll be
-        changing JSValuePtr to be a class, and then eventually renaming it
-        to JSValue once that's done.
-
-        * bindings/js/JSAttrCustom.cpp:
-        * bindings/js/JSCSSRuleCustom.cpp:
-        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
-        * bindings/js/JSCSSValueCustom.cpp:
-        * bindings/js/JSCanvasPixelArrayCustom.h:
-        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
-        * bindings/js/JSClipboardCustom.cpp:
-        * bindings/js/JSConsoleCustom.cpp:
-        * bindings/js/JSCustomSQLStatementCallback.cpp:
-        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
-        * bindings/js/JSCustomSQLTransactionCallback.cpp:
-        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
-        * bindings/js/JSCustomVoidCallback.cpp:
-        * bindings/js/JSCustomVoidCallback.h:
-        * bindings/js/JSCustomXPathNSResolver.cpp:
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        * bindings/js/JSDOMBinding.cpp:
-        * bindings/js/JSDOMBinding.h:
-        * bindings/js/JSDOMWindowBase.cpp:
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        * bindings/js/JSDOMWindowCustom.h:
-        * bindings/js/JSDOMWindowShell.cpp:
-        * bindings/js/JSDOMWindowShell.h:
-        * bindings/js/JSDatabaseCustom.cpp:
-        * bindings/js/JSDocumentCustom.cpp:
-        * bindings/js/JSElementCustom.cpp:
-        * bindings/js/JSEventCustom.cpp:
-        * bindings/js/JSEventListener.cpp:
-        * bindings/js/JSEventTarget.cpp:
-        * bindings/js/JSEventTargetBase.h:
-        * bindings/js/JSEventTargetNodeCustom.cpp:
-        * bindings/js/JSHTMLAllCollection.h:
-        * bindings/js/JSHTMLAppletElementCustom.cpp:
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        * bindings/js/JSHTMLDocumentCustom.cpp:
-        * bindings/js/JSHTMLEmbedElementCustom.cpp:
-        * bindings/js/JSHTMLFormElementCustom.cpp:
-        * bindings/js/JSHTMLFrameElementCustom.cpp:
-        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
-        * bindings/js/JSHTMLIFrameElementCustom.cpp:
-        * bindings/js/JSHTMLInputElementCustom.cpp:
-        * bindings/js/JSHTMLObjectElementCustom.cpp:
-        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
-        * bindings/js/JSHTMLSelectElementCustom.cpp:
-        * bindings/js/JSHTMLSelectElementCustom.h:
-        * bindings/js/JSHistoryCustom.cpp:
-        * bindings/js/JSImageDataCustom.cpp:
-        * bindings/js/JSInspectedObjectWrapper.cpp:
-        * bindings/js/JSInspectedObjectWrapper.h:
-        * bindings/js/JSInspectorCallbackWrapper.cpp:
-        * bindings/js/JSInspectorCallbackWrapper.h:
-        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
-        * bindings/js/JSLocationCustom.cpp:
-        * bindings/js/JSMessagePortCustom.cpp:
-        * bindings/js/JSMimeTypeArrayCustom.cpp:
-        * bindings/js/JSNamedNodeMapCustom.cpp:
-        * bindings/js/JSNamedNodesCollection.cpp:
-        * bindings/js/JSNamedNodesCollection.h:
-        * bindings/js/JSNavigatorCustom.cpp:
-        * bindings/js/JSNodeCustom.cpp:
-        * bindings/js/JSNodeFilterCondition.cpp:
-        * bindings/js/JSNodeFilterCustom.cpp:
-        * bindings/js/JSNodeIteratorCustom.cpp:
-        * bindings/js/JSNodeListCustom.cpp:
-        * bindings/js/JSPluginArrayCustom.cpp:
-        * bindings/js/JSPluginCustom.cpp:
-        * bindings/js/JSPluginElementFunctions.cpp:
-        * bindings/js/JSPluginElementFunctions.h:
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        * bindings/js/JSRGBColor.cpp:
-        * bindings/js/JSRGBColor.h:
-        * bindings/js/JSSQLResultSetRowListCustom.cpp:
-        * bindings/js/JSSQLTransactionCustom.cpp:
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        * bindings/js/JSSVGLengthCustom.cpp:
-        * bindings/js/JSSVGMatrixCustom.cpp:
-        * bindings/js/JSSVGPathSegCustom.cpp:
-        * bindings/js/JSSVGPathSegListCustom.cpp:
-        * bindings/js/JSSVGPointListCustom.cpp:
-        * bindings/js/JSSVGTransformListCustom.cpp:
-        * bindings/js/JSStorageCustom.cpp:
-        * bindings/js/JSStyleSheetCustom.cpp:
-        * bindings/js/JSStyleSheetListCustom.cpp:
-        * bindings/js/JSTextCustom.cpp:
-        * bindings/js/JSTreeWalkerCustom.cpp:
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        * bindings/js/JSXSLTProcessorCustom.cpp:
-        * bindings/js/ScheduledAction.cpp:
-        * bindings/js/ScheduledAction.h:
-        * bindings/js/ScriptController.cpp:
-        * bindings/js/ScriptController.h:
-        * bindings/objc/WebScriptObject.mm:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/NP_jsobject.cpp:
-        * bridge/c/c_instance.cpp:
-        * bridge/c/c_instance.h:
-        * bridge/c/c_runtime.cpp:
-        * bridge/c/c_runtime.h:
-        * bridge/c/c_utility.cpp:
-        * bridge/jni/jni_instance.cpp:
-        * bridge/jni/jni_instance.h:
-        * bridge/jni/jni_jsobject.mm:
-        * bridge/jni/jni_objc.mm:
-        * bridge/jni/jni_runtime.cpp:
-        * bridge/jni/jni_runtime.h:
-        * bridge/jni/jni_utility.cpp:
-        * bridge/objc/objc_class.mm:
-        * bridge/objc/objc_instance.h:
-        * bridge/objc/objc_instance.mm:
-        * bridge/objc/objc_runtime.h:
-        * bridge/objc/objc_runtime.mm:
-        * bridge/objc/objc_utility.h:
-        * bridge/objc/objc_utility.mm:
-        * bridge/runtime.h:
-        * bridge/runtime_array.cpp:
-        * bridge/runtime_array.h:
-        * bridge/runtime_method.cpp:
-        * bridge/runtime_method.h:
-        * bridge/runtime_object.cpp:
-        * bridge/runtime_object.h:
-        * inspector/JavaScriptCallFrame.cpp:
-        * inspector/JavaScriptCallFrame.h:
-        * inspector/JavaScriptProfile.cpp:
-        * inspector/JavaScriptProfileNode.cpp:
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * page/Console.cpp:
-        * page/Console.h:
-        * plugins/MimeTypeArray.h:
-        * plugins/Plugin.h:
-        * plugins/PluginArray.h:
-        * xml/XMLHttpRequest.cpp:
-        Replace JSValue* with JSValuePtr.
-
-2008-10-18  Darin Adler  <darin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        - first step of https://bugs.webkit.org/show_bug.cgi?id=21732
-          improve performance by eliminating JSValue as a base class for JSCell
-
-        Update for change to make PreferredPrimitiveType no longer
-        a member of JSValue.
-
-        * bridge/c/c_instance.cpp:
-        (JSC::Bindings::CInstance::defaultValue): Removed JSValue:: prefix.
-        * bridge/jni/jni_instance.cpp:
-        (JavaInstance::defaultValue): Ditto.
-        * bridge/objc/objc_instance.mm:
-        (ObjcInstance::defaultValue): Ditto.
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtInstance::defaultValue): Ditto.
-        * bridge/runtime.h: Ditto. Also removed typedef.
-
-2008-10-18  Darin Adler  <darin@apple.com>
-
-        - try to fix Windows build
-
-        * rendering/RenderThemeSafari.cpp:
-        (WebCore::RenderThemeSafari::paintCheckbox): Explicitly qualify part name with
-        SafariTheme namespace, since there is now an identically named constant in
-        the ControlPart enum.
-        (WebCore::RenderThemeSafari::paintButton): Ditto.
-        (WebCore::RenderThemeSafari::paintTextField): Ditto.
-        (WebCore::RenderThemeSafari::paintTextArea): Ditto.
-        (WebCore::RenderThemeSafari::paintSearchField): Ditto.
-        (WebCore::RenderThemeSafari::paintSearchFieldCancelButton): Ditto.
-        (WebCore::RenderThemeSafari::paintSearchFieldResultsDecoration): Ditto.
-        (WebCore::RenderThemeSafari::paintSearchFieldResultsButton): Ditto.
-
-2008-10-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Alp Toker.
-
-        [GTK] crash after selecting a file on an <input type=file>
-        https://bugs.webkit.org/show_bug.cgi?id=21385
-
-        Follow Mac and Win's behaviors for Icon::paint
-
-        * platform/graphics/gtk/IconGtk.cpp:
-        (WebCore::Icon::paint): check if painting is enabled before
-        painting the icon
-
-2008-10-18  Zan Dobersek  <zandobersek@gmail.com>
-
-        Reviewed by Oliver Hunt.
-
-        Qt port build fix.
-
-        * platform/qt/RenderThemeQt.h:
-
-2008-10-17  Kevin Watters  <kevinwatters@gmail.com>
-
-        Reviewed by Kevin Ollivier
-        
-        Fix wx port's scrollbar and drawing handling after recent changes.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=21720
-
-        * platform/ScrollView.h:
-        * platform/wx/ScrollViewWx.cpp:
-        (WebCore::ScrollView::platformVisibleContentRect):
-        (WebCore::ScrollView::platformContentsSize):
-        (WebCore::ScrollView::platformSetContentsSize):
-        * platform/wx/WidgetWx.cpp:
-        (WebCore::Widget::paint):
-
-2008-10-17  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix. EAppearance -> ControlPart.
-
-        * platform/wx/RenderThemeWx.cpp:
-        (WebCore::RenderThemeWx::isControlStyled):
-        (WebCore::RenderThemeWx::adjustRepaintRect):
-        (WebCore::RenderThemeWx::controlSupportsTints):
-        (WebCore::RenderThemeWx::supportsFocus):
-        (WebCore::RenderThemeWx::paintButton):
-
-2008-10-17  David Hyatt  <hyatt@apple.com>
-
-        Eliminate the EAppearance enum in favor of the new ControlPart enum.  Cut out the scrollbar
-        values from the enum since they are handled by ScrollbarTheme instead.
+        Add event handler attribute getter/setters to HTMLBodyElement
+        as specified in HTML 5.
 
-        Reviewed by Tim Hatcher
-
-        * css/CSSPrimitiveValueMappings.h:
-        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
-        (WebCore::CSSPrimitiveValue::operator ControlPart):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::adjustRenderStyle):
-        * css/CSSValueKeywords.in:
-        * platform/gtk/RenderThemeGtk.cpp:
-        (WebCore::supportsFocus):
-        (WebCore::RenderThemeGtk::baselinePosition):
-        (WebCore::setToggleSize):
-        (WebCore::RenderThemeGtk::setCheckboxSize):
-        (WebCore::RenderThemeGtk::setRadioSize):
-        (WebCore::RenderThemeGtk::adjustButtonStyle):
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::baselinePosition):
-        (WebCore::RenderThemeQt::controlSupportsTints):
-        (WebCore::RenderThemeQt::adjustRepaintRect):
-        (WebCore::RenderThemeQt::isControlStyled):
-        (WebCore::computeSizeBasedOnStyle):
-        (WebCore::RenderThemeQt::paintButton):
-        (WebCore::RenderThemeQt::paintTextField):
-        (WebCore::RenderThemeQt::paintMenuList):
-        (WebCore::RenderThemeQt::supportsFocus):
-        (WebCore::RenderThemeQt::applyTheme):
-        (WebCore::RenderThemeQt::adjustSliderThumbSize):
-        * platform/qt/RenderThemeQt.h:
-        * rendering/RenderSlider.cpp:
-        (WebCore::RenderSlider::createThumbStyle):
-        (WebCore::RenderSlider::layout):
-        (WebCore::RenderSlider::setValueForPosition):
-        (WebCore::RenderSlider::setPositionFromValue):
-        (WebCore::RenderSlider::positionForOffset):
-        (WebCore::RenderSlider::currentPosition):
-        (WebCore::RenderSlider::setCurrentPosition):
-        (WebCore::RenderSlider::trackSize):
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::adjustStyle):
-        (WebCore::RenderTheme::paint):
-        (WebCore::RenderTheme::paintBorderOnly):
-        (WebCore::RenderTheme::paintDecorations):
-        (WebCore::RenderTheme::isControlContainer):
-        (WebCore::RenderTheme::isControlStyled):
-        (WebCore::RenderTheme::supportsFocusRing):
-        (WebCore::RenderTheme::isDefault):
-        * rendering/RenderTheme.h:
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::isControlStyled):
-        (WebCore::RenderThemeMac::adjustRepaintRect):
-        (WebCore::RenderThemeMac::baselinePosition):
-        (WebCore::RenderThemeMac::controlSupportsTints):
-        (WebCore::RenderThemeMac::adjustButtonStyle):
-        (WebCore::RenderThemeMac::setButtonCellState):
-        (WebCore::RenderThemeMac::popupInternalPaddingLeft):
-        (WebCore::RenderThemeMac::popupInternalPaddingRight):
-        (WebCore::RenderThemeMac::popupInternalPaddingTop):
-        (WebCore::RenderThemeMac::popupInternalPaddingBottom):
-        (WebCore::RenderThemeMac::paintSliderTrack):
-        (WebCore::RenderThemeMac::paintSliderThumb):
-        (WebCore::RenderThemeMac::adjustSliderThumbSize):
-        * rendering/RenderThemeSafari.cpp:
-        (WebCore::RenderThemeSafari::isControlStyled):
-        (WebCore::RenderThemeSafari::adjustRepaintRect):
-        (WebCore::RenderThemeSafari::baselinePosition):
-        (WebCore::RenderThemeSafari::controlSupportsTints):
-        (WebCore::RenderThemeSafari::adjustButtonStyle):
-        (WebCore::RenderThemeSafari::popupInternalPaddingLeft):
-        (WebCore::RenderThemeSafari::popupInternalPaddingRight):
-        (WebCore::RenderThemeSafari::popupInternalPaddingTop):
-        (WebCore::RenderThemeSafari::popupInternalPaddingBottom):
-        (WebCore::RenderThemeSafari::paintSliderTrack):
-        (WebCore::RenderThemeSafari::adjustSliderThumbSize):
-        * rendering/RenderThemeWin.cpp:
-        (WebCore::RenderThemeWin::supportsFocus):
-        (WebCore::RenderThemeWin::determineClassicState):
-        (WebCore::RenderThemeWin::getClassicThemeData):
-        (WebCore::RenderThemeWin::getThemeData):
-        (WebCore::drawControl):
-        (WebCore::RenderThemeWin::paintSliderTrack):
-        (WebCore::RenderThemeWin::adjustSliderThumbSize):
-        * rendering/RenderThemeWin.h:
-        * rendering/style/RenderStyle.h:
-        (WebCore::InheritedFlags::hasAppearance):
-        (WebCore::InheritedFlags::appearance):
-        (WebCore::InheritedFlags::setAppearance):
-        (WebCore::InheritedFlags::initialAppearance):
-        * rendering/style/RenderStyleConstants.h:
+        - Removes erroneous inclusion of the onresize and onunload event
+        handler attributes in Element and Document.
 
-2008-10-17  David Hyatt  <hyatt@apple.com>
-
-        Beginning of the RenderTheme re-architecture (to share more code).  Add the new Theme API header
-        file.  Add new USE(NEW_THEME) switch that is enabled on Mac.  The Mac theme will be converted first.
-
-        Reviewed by Tim Hatcher
-
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * config.h:
-        * platform/Theme.h: Added.
-        (WebCore::Theme::Theme):
-        (WebCore::Theme::~Theme):
-        (WebCore::Theme::baselinePositionAdjustment):
-        (WebCore::Theme::controlHasInactiveAppearance):
-        (WebCore::Theme::controlsCanHaveInactiveAppearance):
-        (WebCore::Theme::controlsCanHaveHoveredAppearance):
-        (WebCore::Theme::controlDrawsBorder):
-        (WebCore::Theme::controlDrawsBackground):
-        (WebCore::Theme::controlDrawsFocusOutline):
-        (WebCore::Theme::selectionColor):
-        (WebCore::Theme::textSearchHighlightColor):
-        (WebCore::Theme::systemColor):
-        (WebCore::Theme::systemFont):
-        (WebCore::Theme::caretBlinkFrequency):
-        (WebCore::Theme::themeChanged):
-        (WebCore::Theme::controlSize):
-        (WebCore::Theme::controlFont):
-        (WebCore::Theme::controlPadding):
-        (WebCore::Theme::controlInternalPadding):
-        (WebCore::Theme::controlBorder):
-        (WebCore::Theme::controlBorderRadius):
-        (WebCore::Theme::paint):
-        (WebCore::Theme::inflateControlPaintRect):
-        * platform/ThemeTypes.h: Added.
-        (WebCore::):
-        (WebCore::ControlBox::ControlBox):
-        (WebCore::ControlBox::top):
-        (WebCore::ControlBox::right):
-        (WebCore::ControlBox::bottom):
-        (WebCore::ControlBox::left):
-        * platform/mac/ThemeMac.h: Added.
-        (WebCore::ThemeMac::ThemeMac):
-        (WebCore::ThemeMac::~ThemeMac):
-        * platform/mac/ThemeMac.mm: Added.
-        (WebCore::platformTheme):
-        * rendering/RenderTheme.cpp:
-        (WebCore::RenderTheme::RenderTheme):
-        * rendering/RenderTheme.h:
-
-2008-10-17  Marco Barisione  <marco.barisione@collabora.co.uk>
-
-        Reviewed by Sam Weinig. Landed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21603
-        [GTK] Minor fixes to GOwnPtr
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::mediaPlayerPrivateErrorCallback):
-
-2008-10-17  Timothy Hatcher  <timothy@apple.com>
-
-        Recompile the JavaScript functions when removing any listener, so functions that are
-        not being debugged can resume normal speed again.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21715
-
-        Reviewed by Geoffrey Garen.
-
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::globalExec): Changed an assert into an if check. This assert
-        was firing when closing the window and having the recompile fire after. This was an
-        overzelious assert now.
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::didRemoveListener): Start the recompile timer.
-        (WebCore::JavaScriptDebugServer::didRemoveLastListener): Removed the recompile timer start.
-
-2008-10-17  Timothy Hatcher  <timothy@apple.com>
-
-        Fixes a regression where starting a debugging session in
-        another Web Inspector window would not show any scripts.
-        Also only attach the debugger to only the required Pages.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21708
-
-        Reviewed by Darin Adler.
-
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::addListener): Add an assert and
-        remove the call to willAddFirstListener(). Add a call to
-        didAddListener().
-        (WebCore::JavaScriptDebugServer::removeListener): Add an assert
-        and call to didRemoveListener().
-        (WebCore::JavaScriptDebugServer::pageCreated): Attach the debugger
-        if there is a listener interested in the new Page.
-        (WebCore::JavaScriptDebugServer::hasListenersInterestedInPage):
-        Use hasGlobalListeners() instead of isEmpty().
-        (WebCore::JavaScriptDebugServer::sourceParsed): Ditto.
-        (WebCore::JavaScriptDebugServer::didAddListener): Added. Attach the
-        debugger to the page if non-null, or all pages if page is null.
-        (WebCore::JavaScriptDebugServer::didRemoveListener): Added. Detach
-        the debugger only if there are no interested listeners.
-        (WebCore::JavaScriptDebugServer::didRemoveLastListener): Remove the
-        call to Page::setDebuggerForAllPages().
-        * inspector/JavaScriptDebugServer.h:
-        (WebCore::JavaScriptDebugServer::hasGlobalListeners): Added.
-
-2008-10-15  Brett Wilson  <brettw@chromium.org>
-
-        Reviewed by Timothy Hatcher.
-
-        Have ImageDocument generate its own filename for the title of images
-        without relying on the suggested filename from the network layer, which
-        may be nonexistant or not relevant.
-        https://bugs.webkit.org/show_bug.cgi?id=21565
-
-        * loader/ImageDocument.cpp:
-        (WebCore::ImageTokenizer::finish):
-
-2008-10-17  Alexey Proskuryakov  <ap@webkit.org>
-
-        Non-Mac build fix.
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCoreSources.bkl:
-        Added ActiveDOMObject to the build.
-
-2008-10-17  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21642
-        Abstract out active object tracking
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::markActiveObjectsForDocument):
-        * dom/ActiveDOMObject.cpp: Added.
-        (WebCore::ActiveDOMObject::ActiveDOMObject):
-        (WebCore::ActiveDOMObject::~ActiveDOMObject):
-        (WebCore::ActiveDOMObject::contextDestroyed):
-        (WebCore::ActiveDOMObject::stop):
-        * dom/ActiveDOMObject.h: Added.
-        (WebCore::ActiveDOMObject::document):
-        (WebCore::ActiveDOMObject::hasPendingActivity):
-        (WebCore::ActiveDOMObject::setPendingActivity):
-        (WebCore::ActiveDOMObject::unsetPendingActivity):
         * dom/Document.cpp:
-        (WebCore::Document::~Document):
-        (WebCore::Document::stopActiveDOMObjects):
-        (WebCore::Document::createdActiveDOMObject):
-        (WebCore::Document::destroyedActiveDOMObject):
+        (WebCore::Document::getWindowAttributeEventListener):
         * dom/Document.h:
-        (WebCore::Document::activeDOMObjects):
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::contextDestroyed):
-        * dom/MessagePort.h:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::stopLoading):
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::XMLHttpRequest):
-        (WebCore::XMLHttpRequest::~XMLHttpRequest):
-        (WebCore::XMLHttpRequest::associatedFrame):
-        (WebCore::XMLHttpRequest::responseXML):
-        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
-        (WebCore::XMLHttpRequest::initSend):
-        (WebCore::XMLHttpRequest::send):
-        (WebCore::XMLHttpRequest::createRequest):
-        (WebCore::XMLHttpRequest::makeSimpleCrossSiteAccessRequest):
-        (WebCore::XMLHttpRequest::makeCrossSiteAccessRequestWithPreflight):
-        (WebCore::XMLHttpRequest::handleAsynchronousPreflightResult):
-        (WebCore::XMLHttpRequest::loadRequestSynchronously):
-        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
-        (WebCore::XMLHttpRequest::dropProtection):
-        (WebCore::XMLHttpRequest::setRequestHeader):
-        (WebCore::XMLHttpRequest::processSyncLoadResults):
-        (WebCore::XMLHttpRequest::didFinishLoading):
-        (WebCore::XMLHttpRequest::didFinishLoadingPreflight):
-        (WebCore::XMLHttpRequest::willSendRequest):
-        (WebCore::XMLHttpRequest::accessControlCheck):
-        (WebCore::XMLHttpRequest::didReceiveResponsePreflight):
-        (WebCore::XMLHttpRequest::stop):
-        (WebCore::XMLHttpRequest::contextDestroyed):
-        * xml/XMLHttpRequest.h:
-        Move activity tracking to a new ActiveDOMObject class.
-
-2008-10-16  David Hyatt  <hyatt@apple.com>
-
-        Simplify styleForRenderer to avoid confusion.  Callers in the SVG filter code thought "forRenderer" meant
-        they would be given a style that corresponded to the RenderObject* passed in.  This is not what the code
-        did though.  This patch removes the renderer argument and the Element subclass shadow implementation
-        so that confusion like this can't occur again.
-
-        Reviewed by Oliver Hunt
-
-        * dom/Element.cpp:
-        * dom/Element.h:
-        * dom/Node.cpp:
-        (WebCore::Node::createRendererIfNeeded):
-        (WebCore::Node::styleForRenderer):
-        * dom/Node.h:
-        * html/HTMLOptGroupElement.cpp:
-        (WebCore::HTMLOptGroupElement::attach):
-        * html/HTMLOptionElement.cpp:
-        (WebCore::HTMLOptionElement::attach):
-        * svg/SVGClipPathElement.cpp:
-        (WebCore::SVGClipPathElement::canvasResource):
-        * svg/SVGFEDiffuseLightingElement.cpp:
-        (WebCore::SVGFEDiffuseLightingElement::build):
-        * svg/SVGFEFloodElement.cpp:
-        (WebCore::SVGFEFloodElement::build):
-        * svg/SVGFESpecularLightingElement.cpp:
-        (WebCore::SVGFESpecularLightingElement::build):
-        * svg/SVGGradientElement.cpp:
-        (WebCore::SVGGradientElement::buildStops):
-        * svg/SVGUseElement.cpp:
-        (WebCore::SVGUseElement::attachShadowTree):
-
-2008-10-16  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/attachment.cgi?bugid=21647
-
-        Make RenderStyle inherit from RefCounted so that it works with RefPtr.  RenderStyle was being malloced
-        out of the RenderArena.  Years and years ago (before TCMalloc), the plan was to make RenderStyles and
-        all their associated sub-structs use the arena.  However only the RenderStyle itself was ever changed
-        to use the arena.
-
-        At a later point style sharing was implemented, which made using the arena for styles pretty pointless,
-        as the bulk of the styles on a given page are actually shared.  Not ever making the sub-structs use the
-        arena also limited the usefulness.
-
-        Now that we have RefPtr/PassRefPtr to eliminate manual ref/deref and now that we use TCMalloc for fast
-        mallocs, there is no reason to keep RenderStyles in the arena.  The benefits of being able to eliminate
-        manual ref/deref far outweigh keeping them in the arena.
-
-        Reviewed by Adam Roben
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::CSSStyleSelector):
-        (WebCore::CSSStyleSelector::~CSSStyleSelector):
-        (WebCore::CSSStyleSelector::styleForElement):
-        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
-        (WebCore::CSSStyleSelector::pseudoStyleForElement):
-        These methods now return a PassRefPtr.  They will null out the m_style variable as they hand it back
-        so that it isn't left pointing to the previous style resolve RenderStyle (which is what the old code did).
-
-        (WebCore::CSSStyleSelector::updateFont):
-        (WebCore::CSSStyleSelector::checkSelector):
-        (WebCore::CSSStyleSelector::applyProperty):
-        (WebCore::CSSStyleSelector::mapFillSize):
-        (WebCore::CSSStyleSelector::mapFillXPosition):
-        (WebCore::CSSStyleSelector::mapFillYPosition):
-        * css/CSSStyleSelector.h:
-        (WebCore::CSSStyleSelector::style):
-        * dom/Document.cpp:
-        (WebCore::Document::recalcStyle):
-        * dom/Element.cpp:
-        (WebCore::Element::styleForRenderer):
-        (WebCore::Element::recalcStyle):
-        (WebCore::Element::computedStyle):
-        * dom/Element.h:
-        * dom/ElementRareData.h:
-        (WebCore::ElementRareData::ElementRareData):
-        (WebCore::ElementRareData::resetComputedStyle):
-        * dom/Node.cpp:
-        (WebCore::Node::diff):
-        (WebCore::Node::createRendererIfNeeded):
-        (WebCore::Node::styleForRenderer):
-        (WebCore::Node::setRenderStyle):
-        * dom/Node.h:
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::setFont):
-        * html/HTMLOptGroupElement.cpp:
-        (WebCore::HTMLOptGroupElement::attach):
-        (WebCore::HTMLOptGroupElement::detach):
-        (WebCore::HTMLOptGroupElement::setRenderStyle):
-        (WebCore::HTMLOptGroupElement::nonRendererRenderStyle):
-        * html/HTMLOptGroupElement.h:
-        * html/HTMLOptionElement.cpp:
-        (WebCore::HTMLOptionElement::attach):
-        (WebCore::HTMLOptionElement::detach):
-        (WebCore::HTMLOptionElement::setRenderStyle):
-        (WebCore::HTMLOptionElement::nonRendererRenderStyle):
-        * html/HTMLOptionElement.h:
-        * page/animation/AnimationBase.h:
-        (WebCore::AnimationBase::animate):
-        * page/animation/AnimationController.cpp:
-        (WebCore::AnimationController::updateAnimations):
-        * page/animation/AnimationController.h:
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimationPrivate::updateTransitions):
-        (WebCore::CompositeAnimationPrivate::updateKeyframeAnimations):
-        (WebCore::CompositeAnimationPrivate::animate):
-        (WebCore::CompositeAnimation::animate):
-        * page/animation/CompositeAnimation.h:
-        * page/animation/ImplicitAnimation.cpp:
-        (WebCore::ImplicitAnimation::ImplicitAnimation):
-        (WebCore::ImplicitAnimation::~ImplicitAnimation):
-        (WebCore::ImplicitAnimation::animate):
-        (WebCore::ImplicitAnimation::reset):
-        (WebCore::ImplicitAnimation::isTargetPropertyEqual):
-        (WebCore::ImplicitAnimation::blendPropertyValueInStyle):
-        * page/animation/ImplicitAnimation.h:
-        (WebCore::ImplicitAnimation::create):
-        * page/animation/KeyframeAnimation.cpp:
-        (WebCore::KeyframeAnimation::KeyframeAnimation):
-        (WebCore::KeyframeAnimation::~KeyframeAnimation):
-        (WebCore::KeyframeAnimation::animate):
-        (WebCore::KeyframeAnimation::validateTransformFunctionList):
-        * page/animation/KeyframeAnimation.h:
-        (WebCore::KeyframeAnimation::create):
-        (WebCore::KeyframeAnimation::unanimatedStyle):
-        * rendering/InlineTextBox.cpp:
-        (WebCore::InlineTextBox::paint):
-        * rendering/MediaControlElements.cpp:
-        (WebCore::MediaControlShadowRootElement::MediaControlShadowRootElement):
-        (WebCore::MediaControlInputElement::MediaControlInputElement):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::styleDidChange):
-        (WebCore::RenderBlock::updateFirstLetter):
-        * rendering/RenderContainer.cpp:
-        (WebCore::RenderContainer::addChild):
-        (WebCore::RenderContainer::updateBeforeAfterContentForContainer):
-        * rendering/RenderFileUploadControl.cpp:
-        (WebCore::RenderFileUploadControl::updateFromElement):
-        (WebCore::RenderFileUploadControl::createButtonStyle):
-        * rendering/RenderFileUploadControl.h:
-        * rendering/RenderFlow.cpp:
-        (WebCore::RenderFlow::createAnonymousFlow):
-        * rendering/RenderFlow.h:
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::addChildToFlow):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateScrollCornerStyle):
-        (WebCore::RenderLayer::updateResizerStyle):
-        (WebCore::RenderLayer::updateReflectionStyle):
-        * rendering/RenderListItem.cpp:
-        (WebCore::RenderListItem::styleDidChange):
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::createPanel):
-        (WebCore::RenderMedia::createTimeDisplay):
-        (WebCore::RenderMedia::changeOpacity):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::selectionBackgroundColor):
-        (WebCore::RenderObject::selectionForegroundColor):
-        (WebCore::RenderObject::createAnonymousBlock):
-        (WebCore::RenderObject::setAnimatableStyle):
-        (WebCore::RenderObject::setStyle):
-        (WebCore::RenderObject::setStyleInternal):
-        (WebCore::RenderObject::arenaDelete):
-        (WebCore::RenderObject::firstLineStyle):
-        (WebCore::RenderObject::getPseudoStyle):
-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::style):
-        * rendering/RenderSVGBlock.cpp:
-        (WebCore::RenderSVGBlock::setStyle):
-        * rendering/RenderSVGBlock.h:
-        * rendering/RenderScrollbar.cpp:
-        (WebCore::RenderScrollbar::getScrollbarPseudoStyle):
-        (WebCore::RenderScrollbar::updateScrollbarPart):
-        * rendering/RenderScrollbar.h:
-        * rendering/RenderSlider.cpp:
-        (WebCore::RenderSlider::styleDidChange):
-        (WebCore::RenderSlider::createThumbStyle):
-        (WebCore::RenderSlider::updateFromElement):
-        * rendering/RenderSlider.h:
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::addChild):
-        * rendering/RenderTableRow.cpp:
-        (WebCore::RenderTableRow::addChild):
-        * rendering/RenderTableSection.cpp:
-        (WebCore::RenderTableSection::addChild):
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::styleDidChange):
-        (WebCore::RenderTextControl::createInnerBlockStyle):
-        (WebCore::RenderTextControl::createInnerTextStyle):
-        (WebCore::RenderTextControl::createResultsButtonStyle):
-        (WebCore::RenderTextControl::createCancelButtonStyle):
-        (WebCore::RenderTextControl::createSubtreeIfNeeded):
-        (WebCore::RenderTextControl::updatePlaceholderVisibility):
-        * rendering/RenderTextControl.h:
-        * rendering/TextControlInnerElements.cpp:
-        (WebCore::TextControlInnerElement::attachInnerElement):
-        * rendering/TextControlInnerElements.h:
-        * rendering/style/KeyframeList.cpp:
-        (WebCore::KeyframeList::clear):
-        (WebCore::KeyframeList::operator==):
-        (WebCore::KeyframeList::insert):
-        * rendering/style/KeyframeList.h:
-        (WebCore::KeyframeValue::KeyframeValue):
-        (WebCore::KeyframeValue::~KeyframeValue):
-        (WebCore::KeyframeValue::key):
-        (WebCore::KeyframeValue::style):
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::defaultStyle):
-        (WebCore::RenderStyle::create):
-        (WebCore::RenderStyle::createDefaultStyle):
-        (WebCore::RenderStyle::clone):
-        (WebCore::RenderStyle::RenderStyle):
-        (WebCore::RenderStyle::getCachedPseudoStyle):
-        (WebCore::RenderStyle::addCachedPseudoStyle):
-        * rendering/style/RenderStyle.h:
-        (WebCore::):
-        (WebCore::InheritedFlags::operator!=):
-        * svg/SVGClipPathElement.cpp:
-        (WebCore::SVGClipPathElement::canvasResource):
-        * svg/SVGGradientElement.cpp:
-        (WebCore::SVGGradientElement::buildStops):
-        * svg/SVGStyledElement.cpp:
-        (WebCore::SVGStyledElement::resolveStyle):
-        * svg/SVGStyledElement.h:
-        * svg/SVGUseElement.cpp:
-        (WebCore::SVGUseElement::recalcStyle):
-        (WebCore::SVGUseElement::attachShadowTree):
-
-2008-10-16  Kenneth Russell  <kenneth.russell@sun.com>
-
-        Reviewed and landed by Anders Carlsson.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21587
-        NPN_PluginThreadAsyncCall does not work properly
-        
-        * plugins/PluginMainThreadScheduler.cpp:
-        (WebCore::PluginMainThreadScheduler::dispatchCalls):
-        Make sure to set m_callPending to false once the queue has been cleared.
-
-2008-10-15  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21609
-        Make MessagePorts protect their peers across heaps
-
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::MessagePort):
-        * dom/MessagePort.h:
-        (WebCore::MessagePort::setJSWrapperIsKnownToBeInaccessible):
-        (WebCore::MessagePort::jsWrapperIsKnownToBeInaccessible):
-        Track objects whose JS wrappers are no longer reachable in MessagePort. Unfortunately, this
-        means that the implementation object knows about JS bindings - but it is not possible to
-        access JS wrappers from another heap/thread.
-
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::markCrossHeapDependentObjectsForDocument):
-        * bindings/js/JSDOMBinding.h:
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::markCrossHeapDependentObjects):
-        * bindings/js/JSDOMWindowBase.h:
-        Implement cross-heap dependency tracking for entangled MessagePorts. If a wrapper object
-        hasn't been marked normally, it is marked as inaccessible. It is then marked manually,
-        as long as its entangled port is accessible itself.
-
-2008-10-15  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Remove unneeded check of whether a Page defers loading before running it
-        in a modal dialog.
-
-        No test possible.
-
-        Reviewed by Tim Hatcher.
-
-        * page/Chrome.cpp:
-
-2008-10-15  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=21345
-        Start the debugger without reloading the inspected page
-
-        * WebCore.base.exp: New symbols.
-
-        * ForwardingHeaders/kjs/CollectorHeapIterator.h: Copied from ForwardingHeaders/kjs/ustring.h.
-        * ForwardingHeaders/kjs/Parser.h: Copied from ForwardingHeaders/kjs/ustring.h.
-        * WebCore.xcodeproj/project.pbxproj: New forwarding headers.
-
-        * inspector/InspectorController.cpp:
-        (WebCore::InspectorController::setWindowVisible):
-        (WebCore::InspectorController::windowScriptObjectAvailable):
-        (WebCore::InspectorController::startDebugging):
-        * inspector/InspectorController.h: Renamed startDebuggingAndReloadInspectedPage
-        to startDebugging, and changed its behavior to match.
-
-        * inspector/JavaScriptDebugListener.h:
-        * inspector/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::JavaScriptDebugServer):
-        (WebCore::JavaScriptDebugServer::addListener):
-        (WebCore::JavaScriptDebugServer::removeListener):
-        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
-        (WebCore::JavaScriptDebugServer::willAddFirstListener):
-        (WebCore::JavaScriptDebugServer::didRemoveLastListener):
-        * inspector/JavaScriptDebugServer.h: Refactored the
-        JavaScriptDebugServer to centralize handling of adding the first listener
-        and removing the last. Then, added a feature to recompile all JS functions
-        in these cases. This allows us to dynamically add and remove hooks like
-        the debugger hooks without reloading the page.
-
-        * inspector/front-end/ScriptsPanel.js:
-        * English.lproj/localizedStrings.js: Updated for startDebuggingAndReloadInspectedPage =>
-        startDebugging rename. Removed all UI that claimed that starting the
-        debugger would reload the page.
-
-2008-10-15  Adele Peterson  <adele@apple.com>
-
-        Attempt to fix the Tiger build.
-
-        * platform/network/mac/ResourceHandleMac.mm:
-
-2008-10-15  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Build fix attempt.
-
-        Try to fix static/non-static declaration of g_string_append_uri_escape
-        by renaming that string. Another look needs to be taken.
-
-        * platform/gtk/guriescape.c:
-        (_webcore_g_string_append_uri_escaped):
-        (_webcore_g_uri_escape_string):
-
-2008-10-15  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Build fix.
-
-        m_animatingImageType is gone.
-
-        * platform/graphics/cairo/ImageCairo.cpp:
-        (WebCore::BitmapImage::BitmapImage):
-
-2008-10-15  Jeff Cook <cookiecaper@gmail.com>
-
-        Reviewed by Holger Freyther.
-
-        Stop SIGSEGV when leaving a page with a Flash object by reordering
-        window destruction and plugin stop.
-
-        See https://bugs.webkit.org/show_bug.cgi?id=20779
-
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::stop):
-
-2008-10-15  Adele Peterson  <adele@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Implement didSendBodyData delegate method, and use older code path when that delegate doesn't exist. 
-
-        * platform/network/ResourceHandle.h:
-        * platform/network/mac/FormDataStreamMac.mm: (WebCore::formRead):
-        * platform/network/mac/ResourceHandleMac.mm:
-        (WebCore::ResourceHandle::didSendBodyDataDelegateExists):
-        (WebCore::ResourceHandle::start):
-        (WebCore::ResourceHandle::cancel):
-        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
-        (-[WebCoreResourceHandleAsDelegate connection:didSendBodyData:totalBytesWritten:totalBytesExpectedToWrite:]):
-        (-[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:]):
-        (-[WebCoreResourceHandleAsDelegate connection:didFailWithError:]):
-
-2008-10-15  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by David Hyatt.
-
-        Qt build bustage fix.
-
-        * platform/graphics/qt/StillImageQt.h:
-        (WebCore::StillImage::destroyDecodedData):
-
-2008-10-15  David Hyatt  <hyatt@apple.com>
-
-        Make sure scrollbar styles get deleted if they aren't assigned to a renderer.
-
-        Reviewed by Mark Rowe
-
-        * rendering/RenderScrollbar.cpp:
-        (WebCore::RenderScrollbar::getScrollbarPseudoStyle):
-        (WebCore::RenderScrollbar::updateScrollbarPart):
-
-2008-10-15  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by David Hyatt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=19663 (Second attempt)
-        Account for paint and timer lag when animating images.  Also pretend
-        that images whose animations were paused (by becoming invisible)
-        continued to animate, by "catching up" to the correct frame when they're
-        shown again.
-
-        * platform/graphics/BitmapImage.cpp:
-        (WebCore::BitmapImage::BitmapImage):
-        (WebCore::BitmapImage::destroyDecodedData):
-        (WebCore::BitmapImage::cacheFrame):
-        (WebCore::BitmapImage::frameIsCompleteAtIndex):
-        (WebCore::BitmapImage::frameDurationAtIndex):
-        (WebCore::BitmapImage::frameHasAlphaAtIndex):
-        (WebCore::BitmapImage::repetitionCount):
-        (WebCore::BitmapImage::shouldAnimate):
-        (WebCore::BitmapImage::startAnimation):
-        (WebCore::BitmapImage::resetAnimation):
-        (WebCore::BitmapImage::advanceAnimation):
-        (WebCore::BitmapImage::internalAdvanceAnimation):
-        (WebCore::BitmapImage::notifyObserverAndTrimDecodedData):
-        * platform/graphics/BitmapImage.h:
-        (WebCore::FrameData::FrameData):
-        (WebCore::BitmapImage::):
-        * platform/graphics/GeneratedImage.h:
-        (WebCore::GeneratedImage::destroyDecodedData):
-        * platform/graphics/Image.h:
-        * platform/graphics/cairo/ImageCairo.cpp:
-        (WebCore::FrameData::clear):
-        (WebCore::BitmapImage::BitmapImage):
-        (WebCore::BitmapImage::draw):
-        * platform/graphics/cg/ImageCG.cpp:
-        (WebCore::FrameData::clear):
-        (WebCore::BitmapImage::BitmapImage):
-        (WebCore::BitmapImage::draw):
-        * platform/graphics/cg/PDFDocumentImage.h:
-        (WebCore::PDFDocumentImage::destroyDecodedData):
-        * platform/graphics/qt/ImageQt.cpp:
-        (WebCore::FrameData::clear):
-        (WebCore::BitmapImage::draw):
-        * platform/graphics/wx/ImageWx.cpp:
-        (WebCore::FrameData::clear):
-        (WebCore::BitmapImage::draw):
-        * svg/graphics/SVGImage.h:
-        (WebCore::SVGImage::destroyDecodedData):
-
-2008-10-14  Maxime Britto  <britto@apple.com>
-
-        Reviewed by Darin Adler, tweaked and landed by Beth.
-
-        * WebCore.base.exp: Exposes two functions to be able to create a 
-        selection from a point on the screen. Also exposes the new 
-        TextIterator::currentNode function.
-        * WebCore/editing/TextIterator.cpp:
-        (TextIterator::currentNode) : New function that returns the current 
-        text node or NULL if there is no text node.
-
-2008-10-15  Marco Barisione  <marco.barisione@collabora.co.uk>
-
-        Reviewed by Holger Freyther.
-
-        http://bugs.webkit.org/show_bug.cgi?id=21211
-        [CURL] Upload doesn't work because cancel is called
-
-        FormDataStream::read returns 0 when retrieving data from the form
-        fails, but also when there is no more data to send. This means that
-        ResourceHandleManager::cancel is always called even when the data was
-        successfully sent.
-
-        Check if there are more elements in the form before calling
-        FormDataStream::read.
-
-        * platform/network/curl/FormDataStreamCurl.cpp:
-        (WebCore::FormDataStream::hasMoreElements):
-        * platform/network/curl/FormDataStreamCurl.h:
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::readCallback):
-
-2008-10-15  Marco Barisione  <marco.barisione@collabora.co.uk>
-
-        Reviewed by Holger Freyther.
-
-        http://bugs.webkit.org/show_bug.cgi?id=20664
-        [GTK] File names are not always encodable in UTF-8
-
-        On Linux file names are just raw data and cannot always be directly
-        encoded in UTF-8 or in any other encodings, so we escape them before
-        storing the file name in a String and unescape them before passing
-        them to native functions handling files.
-
-        * GNUmakefile.am:
-        * platform/FileSystem.h:
-        * platform/gtk/FileChooserGtk.cpp:
-        (WebCore::stringByAdoptingFileSystemRepresentation):
-        (WebCore::FileChooser::basenameForWidth):
-        * platform/gtk/FileSystemGtk.cpp:
-        (WebCore::filenameToString):
-        (WebCore::filenameFromString):
-        (WebCore::filenameForDisplay):
-        (WebCore::fileExists):
-        (WebCore::deleteFile):
-        (WebCore::deleteEmptyDirectory):
-        (WebCore::getFileSize):
-        (WebCore::getFileModificationTime):
-        (WebCore::makeAllDirectories):
-        (WebCore::homeDirectoryPath):
-        (WebCore::pathGetFileName):
-        (WebCore::listDirectory):
-        * platform/gtk/KURLGtk.cpp:
-        (WebCore::KURL::fileSystemPath):
-        * platform/gtk/SharedBufferGtk.cpp:
-        (WebCore::SharedBuffer::createWithContentsOfFile):
-        * platform/gtk/guriescape.c: Added.
-        (is_valid):
-        (gunichar_ok):
-        (g_string_append_uri_escaped):
-        (_webcore_g_uri_escape_string):
-        * platform/gtk/guriescape.h: Added.
-
-2008-10-15  Dirk Schulze  <vbs85@gmx.de>
-
-        Reviewed by Eric Seidel.
-
-        - part of https://bugs.webkit.org/show_bug.cgi?id=20543
-          Moved gradient spread method out of SVG into the GraphicsContext.
-
-        * platform/graphics/GraphicsContext.cpp:
-        (WebCore::GraphicsContext::spreadMethod):
-        (WebCore::GraphicsContext::setSpreadMethod):
-        * platform/graphics/GraphicsContext.h:
-        (WebCore::):
-        * platform/graphics/GraphicsContextPrivate.h:
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        (WebCore::applySpreadMethod):
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::strokePath):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::applySpreadMethod):
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::strokePath):
-        * svg/GradientAttributes.h:
-        (WebCore::GradientAttributes::GradientAttributes):
-        (WebCore::GradientAttributes::spreadMethod):
-        (WebCore::GradientAttributes::setSpreadMethod):
-        * svg/SVGGradientElement.cpp:
-        (WebCore::SVGGradientElement::parseMappedAttribute):
-        * svg/SVGGradientElement.h:
-        * svg/SVGLinearGradientElement.cpp:
-        (WebCore::SVGLinearGradientElement::collectGradientProperties):
-        * svg/SVGRadialGradientElement.cpp:
-        (WebCore::SVGRadialGradientElement::collectGradientProperties):
-        * svg/graphics/SVGPaintServerGradient.cpp:
-        (WebCore::operator<<):
-        (WebCore::SVGPaintServerGradient::SVGPaintServerGradient):
-        (WebCore::SVGPaintServerGradient::spreadMethod):
-        (WebCore::SVGPaintServerGradient::setGradientSpreadMethod):
-        (WebCore::SVGPaintServerGradient::externalRepresentation):
-        * svg/graphics/SVGPaintServerGradient.h:
-        * svg/graphics/cairo/SVGPaintServerGradientCairo.cpp:
-        (WebCore::SVGPaintServerGradient::setup):
-        * svg/graphics/qt/SVGPaintServerGradientQt.cpp:
-        (WebCore::SVGPaintServerGradient::setup):
-
-2008-10-09  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Sam Weinig.
-
-        Make pan scrolling a platform configurable option
-        https://bugs.webkit.org/show_bug.cgi?id=21515
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleAutoscroll):
-        (WebCore::EventHandler::autoscrollTimerFired):
-        (WebCore::EventHandler::stopAutoscrollTimer):
-        (WebCore::EventHandler::handleMousePressEvent):
-        (WebCore::EventHandler::keyEvent):
-
-2008-10-10  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Add some PLATFORM(CHROMIUM) ifdefs to WebCore
-        https://bugs.webkit.org/show_bug.cgi?id=21511
-
-        * loader/FTPDirectoryDocument.cpp:
-        * loader/FTPDirectoryParser.cpp:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::finishedLoadingDocument):
-        * platform/ContextMenuItem.h:
-        * platform/Cursor.h:
-        * platform/DragData.h:
-        * platform/DragImage.h:
-        * platform/Pasteboard.h:
-        * platform/PlatformKeyboardEvent.h:
-        (WebCore::PlatformKeyboardEvent::isSystemKey):
-        * platform/PlatformMenuDescription.h:
-        * platform/PlatformMouseEvent.h:
-        * platform/PlatformWheelEvent.h:
-        * platform/PopupMenu.h:
-        * platform/ScrollView.h:
-        * platform/Widget.h:
-        * platform/network/NetworkStateNotifier.h:
-
-2008-10-14  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=21490
-        Optimize keyframe style sheet changes by avoiding styleSheetChanged()
-
-        Test: css3/change-keyframes.html
-
-        * css/WebKitCSSKeyframesRule.cpp:
-        (WebCore::WebKitCSSKeyframesRule::append):
-        (WebCore::WebKitCSSKeyframesRule::deleteRule):
-
-2008-10-14  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21595
-
-        Clean up background and overflow propagation from the body to the viewport.  Make it match the
-        latest CSS2.1 spec thinking.
-
-        Reviewed by Adam Roben
-
-        Added many tests at fast/body-propagation/.  These are Simon Pieters' tests of propagation handling
-        (available at http://simon.html5.org/test/css/magic-body/).
-
-        * dom/Document.cpp:
-        (WebCore::Document::body):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::layout):
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::styleDidChange):
-        (WebCore::RenderBox::paintRootBoxDecorations):
-        (WebCore::RenderBox::paintBoxDecorations):
-        (WebCore::RenderBox::repaintLayerRectsForImage):
-
-2008-10-14  Dimitri Glazkov  <dglazkov@chromium.org>
-
-        Reviewed and landed by Sam Weinig.
-
-        Due to change in spec (http://dev.w3.org/2006/webapi/selectors-api/#namespace),
-        remove NSResolver code, leaving only checking for selectors that need
-        NS resolution and throwing a coresponding error.
-
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSDocumentCustom.cpp:
-        * bindings/js/JSDocumentFragmentCustom.cpp:
-        * bindings/js/JSElementCustom.cpp:
-        * bindings/js/JSNSResolver.cpp: Removed.
-        * bindings/js/JSNSResolver.h: Removed.
         * dom/Document.idl:
-        * dom/DocumentFragment.idl:
         * dom/Element.idl:
-        * dom/NSResolver.h: Removed.
-        * dom/NSResolver.idl: Removed.
-        * dom/Node.h:
         * dom/Node.cpp:
-        (WebCore::forEachTagSelector):
-        (WebCore::SelectorNeedsNamespaceResolutionFunctor::operator()):
-        (WebCore::selectorNeedsNamespaceResolution):
-        (WebCore::Node::querySelector):
-        (WebCore::Node::querySelectorAll):
-
-2008-10-14  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig (all but the FormDataListItem rename).
-
-        - https://bugs.webkit.org/show_bug.cgi?id=21593
-          Bug 21593: add multiple-file support to HTMLFormElement
-
-        * html/FormDataList.cpp: Removed appendFile since it's now inline.
-        Also took incorrect old copyrights off of this file that are left
-        over from when it was split.
-        * html/FormDataList.h: Ditto. Renamed FormDataListItem to Item and
-        made it a member of FormDataList. Changed it to hold a File object
-        instead of a path. And made its data members private. Changed
-        FormDataList::appendFile accordingly.
-
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::formData): Updated for above changes.
-        Removed the code that special-cases HTMLInputElement, because now
-        the FormDataListItem has everything we need. And if there are
-        multiple files, we'll get multiple list items for them.
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::appendFormData): Changed the code for
-        <input type=file> to use File objects instead of path strings and
-        also to append multiple files if the file list has them.
-
-2008-10-14  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon.
-        
-        Fix QtWebKit scrollbar painting errors
-
-        * platform/qt/ScrollbarThemeQt.cpp:
-        (WebCore::ScrollbarThemeQt::paint):
-        (WebCore::ScrollbarThemeQt::paintScrollCorner):
-
-2008-10-14  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon.
-
-        Fix scrollbar arrows for horizontal scrollbars
-
-        * platform/qt/ScrollbarThemeQt.cpp:
-        (WebCore::styleOptionSlider):
-
-2008-10-14  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon.
-
-        Use style-painter to draw scrollbars in ScrollbarThemeQt
-        
-        This has the benefit of setting up the painter properly without
-        antialiasing and saving and restoring the brush. It also ensures
-        that we use the style of the QWebView over the QApplication style
-        if possible.
-
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::StylePainter::StylePainter):
-        (WebCore::StylePainter::init):
-        * platform/qt/RenderThemeQt.h:
-        * platform/qt/ScrollbarThemeQt.cpp:
-        (WebCore::ScrollbarThemeQt::paint):
-
-2008-10-13  David Hyatt  <hyatt@apple.com>
-
-        Add support for CSS transitions on some SVG properties.  This patch is intended to be a guideline
-        for how to add support for the rest.
-
-        Reviewed by Oliver Hunt
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::ensurePropertyMap):
-        * rendering/style/RenderStyle.h:
-        (WebCore::RenderStyle::fillOpacity):
-        (WebCore::RenderStyle::setFillOpacity):
-        (WebCore::RenderStyle::strokeOpacity):
-        (WebCore::RenderStyle::setStrokeOpacity):
-        (WebCore::RenderStyle::floodOpacity):
-        (WebCore::RenderStyle::setFloodOpacity):
-
-2008-10-13  David Hyatt  <hyatt@apple.com>
-
-        <rdar://problem/6289712> REGRESSION(r37432-37490): Scroll bar is not drawn in Bookmark View, Preferences sheets.
-
-        Fix for disabled scrollbars not painting in Windows Safari.  Make sure that the Windows theme
-        implements paintTrackBackground so that when the thumb is not present the track still paints.
-
-        Reviewed by Oliver Hunt
-
-        * platform/ScrollbarThemeComposite.cpp:
-        (WebCore::ScrollbarThemeComposite::paint):
-        * platform/win/ScrollbarThemeWin.cpp:
-        (WebCore::ScrollbarThemeWin::paintTrackBackground):
-        * platform/win/ScrollbarThemeWin.h:
-
-2008-10-13  David Hyatt  <hyatt@apple.com>
-
-        Fix over-invalidation of native scrollbars.
-
-        Reviewed by Oliver Hunt
-
-        * platform/Scrollbar.h:
-        (WebCore::Scrollbar::styleChanged):
-        * platform/mac/ScrollbarThemeMac.mm:
-        (+[ScrollbarPrefsObserver appearancePrefsChanged:]):
-        * rendering/RenderScrollbar.cpp:
-        (WebCore::RenderScrollbar::styleChanged):
-
-2008-10-13  Alp Toker  <alp@nuanti.com>
-
-        Fix autotools dist build target by listing recently added header
-        files only. Not reviewed.
-
-        * GNUmakefile.am:
-
-2008-10-13  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Brady Eidson.
-
-        Don't run a SQLite query on every iteration of the sync thread when the query
-        will touch a large portion of the icon database while performing no useful work.
-
-        * loader/icon/IconDatabase.cpp:
-        (WebCore::IconDatabase::writeToDatabase): Don't call checkForDanglingPageURLs unless
-        we modified the database.
-        (WebCore::IconDatabase::checkForDanglingPageURLs): Don't do any work in a release build
-        unless we've been asked to prune any dangling pageURLs that we find.
-
-2008-10-13  Maciej Stachowiak  <mjs@apple.com>
-
-        Rubber stamped by Mark Rowe.
-        
-        - use gcc 4.2 when building with Xcode 3.1 or newer on Leopard, even though this is not the default
-
-        * Configurations/DebugRelease.xcconfig:
-
-2008-10-13  David Hyatt  <hyatt@apple.com>
-
-        Make dropdown lists on Windows work with CSS custom scrollbars.
-
-        Reviewed by Adele
-
-        * platform/PopupMenu.h:
-        (WebCore::PopupMenu::scrollbarCornerPresent):
-        * platform/PopupMenuClient.h:
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::show):
-        * rendering/RenderMenuList.cpp:
-        (WebCore::RenderMenuList::createScrollbar):
-        * rendering/RenderMenuList.h:
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::createScrollbar):
-        * rendering/RenderTextControl.h:
-
-2008-10-13  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        <rdar://problem/6271864> Links from image maps not being included in AXLinkUIElements
-
-        Links from image maps were not being included in the web area's AXLinkUIElements attribute.
-        The position of image map links was being reported incorrectly and the parent-chain
-        hierarchy for image map links was incorrect because image map links did not have a reference
-        to their parent image. 
-
-        Test: accessibility/document-links.html
-
-        * page/AccessibilityImageMapLink.cpp:
-        (WebCore::AccessibilityImageMapLink::parentObject):
-        (WebCore::AccessibilityImageMapLink::actionElement):
-        (WebCore::AccessibilityImageMapLink::elementRect):
-        * page/AccessibilityImageMapLink.h:
-        (WebCore::AccessibilityImageMapLink::setHTMLMapElement):
-        (WebCore::AccessibilityImageMapLink::setParent):
-        * page/AccessibilityObject.cpp:
-        * page/AccessibilityObject.h:
-        * page/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
-        (WebCore::AccessibilityRenderObject::getDocumentLinks):
-        (WebCore::AccessibilityRenderObject::addChildren):
-        * page/AccessibilityRenderObject.h:
-        * page/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
-
-2008-10-13  David Hyatt  <hyatt@apple.com>
-
-        Make RenderListBox work with CSS scrollbars.  Refactoring this code to support creation/destruction in
-        the same way RenderLayer does also fixes a bug where the PLT would assert on the next-to-last page (no
-        idea how to make a test case for that, though, since I couldn't repro without running the whole PLT).
-
-        Reviewed by Tim Hatcher
-
-        Added scrollbars/listbox-scrollbar-combinations.html
-
-        * rendering/RenderListBox.cpp:
-        (WebCore::RenderListBox::~RenderListBox):
-        (WebCore::RenderListBox::updateFromElement):
-        (WebCore::RenderListBox::createScrollbar):
-        (WebCore::RenderListBox::destroyScrollbar):
-        (WebCore::RenderListBox::setHasVerticalScrollbar):
-        * rendering/RenderListBox.h:
-
-2008-10-13  David Hyatt  <hyatt@apple.com>
-
-        In order to always match the :corner-present pseudo-class properly, delay initial updating of
-        scrollbar styles until the layer has the scrollbars in its member variables.
-
-        Reviewed by Tim Hatcher
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::setHasHorizontalScrollbar):
-        (WebCore::RenderLayer::setHasVerticalScrollbar):
-        * rendering/RenderScrollbar.cpp:
-        (WebCore::RenderScrollbar::RenderScrollbar):
-
-2008-10-13  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21577
-        5 false positive StructureID leaks
-
-        In WebCore, we intentionally leak the common JSGlobalData which in turn
-        leaks 5 StructureIDs.  Use the new JSGlobalData::createLeaked in order to
-        ignore the StructureIDs leaked within.
-
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::commonJSGlobalData):
-
-2008-10-13  David Hyatt  <hyatt@apple.com>
-
-        Add support for the :corner-present pseudoclass, which enables scrollbar pieces to change their
-        artwork based on whether there is a scrollbar corner present.
-
-        Reviewed by Tim Hatcher
-
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType):
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::scrollbarCornerPresent):
-        * platform/ScrollView.h:
-        * platform/ScrollbarClient.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::cornerRect):
-        (WebCore::scrollCornerRect):
-        (WebCore::resizerCornerRect):
-        (WebCore::RenderLayer::scrollbarCornerPresent):
-        (WebCore::RenderLayer::setHasHorizontalScrollbar):
-        (WebCore::RenderLayer::setHasVerticalScrollbar):
-        * rendering/RenderLayer.h:
-        (WebCore::RenderLayer::horizontalScrollbar):
-        (WebCore::RenderLayer::verticalScrollbar):
-        * rendering/RenderListBox.h:
-        (WebCore::RenderListBox::scrollbarCornerPresent):
-
-2008-10-13  David Hyatt  <hyatt@apple.com>
-
-        Make resizers and scrollbar corners respect :window-inactive (one more bug fix and then Tim's master
-        test case for all this can land).
-
-        Reviewed by Tim Hatcher
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkSelector):
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
-        (WebCore::CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintOverflowControls):
-        (WebCore::RenderLayer::paintScrollCorner):
-        (WebCore::RenderLayer::paintResizer):
-        (WebCore::RenderLayer::styleChanged):
-        (WebCore::RenderLayer::updateScrollCornerStyle):
-        (WebCore::RenderLayer::updateResizerStyle):
-        * rendering/RenderLayer.h:
-        * rendering/RenderScrollbar.cpp:
-        (WebCore::RenderScrollbar::paint):
-        * rendering/RenderScrollbarPart.cpp:
-        (WebCore::RenderScrollbarPart::paintIntoRect):
-
-2008-10-13  David Hyatt  <hyatt@apple.com>
-
-        Rework resizer and scroll corner painting so that custom resizers and scroll corners will paint
-        and invalidate properly as images load, etc.
-
-        Reviewed by Tim Hatcher
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::cornerRect):
-        (WebCore::scrollCornerRect):
-        (WebCore::resizerCornerRect):
-        (WebCore::RenderLayer::positionOverflowControls):
-        (WebCore::RenderLayer::paintOverflowControls):
-        (WebCore::RenderLayer::paintScrollCorner):
-        (WebCore::RenderLayer::paintResizer):
-        (WebCore::RenderLayer::isPointInResizeControl):
-        (WebCore::RenderLayer::hitTestOverflowControls):
-        (WebCore::RenderLayer::styleChanged):
-        * rendering/RenderLayer.h:
-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::setRect):
-        * rendering/RenderScrollbarPart.cpp:
-        (WebCore::RenderScrollbarPart::styleDidChange):
-        (WebCore::RenderScrollbarPart::imageChanged):
-
-2008-10-13  Marco Barisione  <marco.barisione@collabora.co.uk>
-
-        Reviewed by Darin Adler. Landed by Jan Alonzo.
-
-        WebKit GTK Port needs a smartpointer to handle g_free (GFreePtr?)
-        http://bugs.webkit.org/show_bug.cgi?id=20483
-
-        Start the conversion to use GOwnPtr and fix a memory leak.
-
-        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
-        (WebCore::mediaPlayerPrivateErrorCallback):
-
-2008-10-12  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Windows build fix.
-
-        * loader/TextResourceDecoder.cpp:
-
-2008-10-12  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=21229
-          Bug 21229: NetworkStateNotifier.h lacks a #include <windows.h> for PLATFORM(WIN)
-
-        * platform/network/NetworkStateNotifier.h: Add the #include.
-
-2008-10-12  Darin Adler  <darin@apple.com>
-
-        Based on work by Holger Freyther.
-
-        - part of https://bugs.webkit.org/show_bug.cgi?id=20953
-          Split WidthIterator into its own source file.
-
-        * GNUmakefile.am: Added new source files.
-        * WebCore.vcproj/WebCore.vcproj: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * WebCoreSources.bkl: Ditto.
-
-        * platform/graphics/Font.cpp: Use WidthIterator from its new place.
-        * platform/graphics/WidthIterator.cpp: Added.
-        * platform/graphics/WidthIterator.h: Added.
-
-2008-10-12  Tony Chang  <tony@chromium.org>
-
-        Reviewed by Sam Weinig.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=21480
-          Remove duplicate definitions of MimeClassInfo and PluginInfo.
-
-        * plugins/PluginInfoStore.cpp: Added an include.
-        * plugins/PluginInfoStore.h: Removed struct declarations.
-
-2008-10-12  Darin Adler  <darin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=21563
-          Bug 21563: platform Gradient class should not use the CSS parser
-
-        * platform/graphics/Gradient.cpp: Removed the overload of addColorStop
-        that accepts a CSS color string. That's handled in the DOM now, not here.
-        (WebCore::Gradient::addColorStop): Use getRGBA instead of having our own
-        copy of it here.
-        * platform/graphics/Gradient.h: More of the same. Tweak formatting a bit.
-
-2008-10-12  Glenn Wilson  <gwilson@google.com>
-
-        Reviewed by Darin Adler.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=20461
-
-        Added feature to allow multi-line inputs into text fields.
-        HTMLInputElement would cut the set text at the first 'system' character,
-        so it would truncate at the first carriage return or newline.
-        This fix modifies that behavior to truncate at any non-space system character
-        but changes \r, \n, and \r\n to a single space.
-
-        Tests: editing/pasteboard/paste-multiline-text-input.html
-               
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::constrainValue):
-
-2008-10-12  Dirk Schulze  <vbs85@gmx.de>
-
-        Reviewed by Eric Seidel.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=20435
-
-        Added exception codes to canvas gradients to match current specification.
-
-        Tests: fast/canvas/gradient-addColorStop-with-invalid-color.html
-               fast/canvas/linearGradient-infinite-values.html
-               fast/canvas/radialGradient-infinite-values.html
-
-        * html/CanvasGradient.cpp:
-        (WebCore::CanvasGradient::addColorStop):
-        * html/CanvasGradient.h:
-        * html/CanvasGradient.idl:
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::createLinearGradient):
-        (WebCore::CanvasRenderingContext2D::createRadialGradient):
-        * html/CanvasRenderingContext2D.h:
-        * html/CanvasRenderingContext2D.idl:
-
-2008-10-12  Eric Roman  <eroman@chromium.org>
-
-        - https://bugs.webkit.org/show_bug.cgi?id=20246
-          Implement RenderThemeWin::systemColor() to match Windows colors.
-
-        Reviewed by David Hyatt.
-
-        * rendering/RenderThemeWin.cpp:
-        (WebCore::cssValueIdToSysColorIndex):
-        (WebCore::RenderThemeWin::systemColor):
-        * rendering/RenderThemeWin.h:
-
-2008-10-12  Aaron Bockover  <abockover@novell.com>
-
-        Reviewed by Alp Toker.
-
-        Add version parsing for Flash, and the PluginQuirkDontSetNullWindowHandleOnDestroy 
-        plugin quirk if Flash 10 or newer since at least in b218, setting a NULL window 
-        handler on destroy crashes WebKit <https://bugs.webkit.org/show_bug.cgi?id=19859>
-
-        * plugins/gtk/PluginPackageGtk.cpp:
-
-2008-10-12  Jonathon Jongsma  <jonathon.jongsma@collabora.co.uk>
-
-        Reviewed by Oliver Hunt.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=19331
-          <rdar://problem/5984433>: Drag and drop of links in edit mode violates assert in MoveSelectionCommand::doApply()
-
-        * page/DragController.cpp:
-        (WebCore::DragController::startDrag): When a link is dragged without any
-        text selected (note: for this to work, the EditableLinkBehavior setting must be
-        set to 'live' or 'default') and then dropped into an editable html document it
-        will eventually violate an ASSERT in MoveSelectionCommand that requires that there
-        is a selection.  To prevent this, expand the selection to the enclosing anchor tag
-        when the drag begins.
-
-2008-10-12  Darin Adler  <darin@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=21557
-          Bug 21557: REGRESSION: generated-layer-scrollbar-crash.html is crashing
-
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::getPseudoStyle): Keep walking up the parent chain
-        until we hit an Element. Nowadays, Node::isElementNode() is just as efficient
-        as RenderObject::isText(), and this guarantees that the node can be cast to
-        Element*, which is done just below. The reason this is hit is that RenderLayer
-        can call getPseudoStyle on a RenderView, which has the document as its
-        element() -- and a document is neither a Text node nor an Element. A loose
-        end is that this seems to mean you can't style the scrollbar corner or the
-        resizer on a RenderView. Hyatt may want to look into that later.
-
-2008-10-12  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=21556
-          Bug 21556: non-ASCII digits are allowed in places where only ASCII should be
-
-        Tests: fast/dom/HTMLFontElement/size-attribute.html
-               fast/dom/HTMLInputElement/size-attribute.html
-               fast/dom/HTMLTableElement/cellpadding-attribute.html
-
-        * html/HTMLFontElement.cpp:
-        (WebCore::parseFontSizeNumber): Use isASCIIDigit instead of
-        Unicode::isDigit, since non-ASCII digits are not valid here.
-        * html/HTMLFontElement.h: Tweaked formatting a bit and removed
-        the unneeded destructor declaration.
-        * platform/text/String.cpp:
-        (WebCore::lengthOfCharactersAsInteger): Use isASCIIDigit instead
-        of Unicode::isDigit, since non-ASCII digits are not valid.
-
-2008-10-12  Jungshik Shin  <jshin@chromium.org>
-
-        Reviewed by Darin Adler.
-
-        Treat x-user-defined as windows-1252 for html files with meta charset
-        declaration to be compatible with Indian web sites.
-        ( https://bugs.webkit.org/show_bug.cgi?id=18270 )
-
-        Test: fast/encoding/charset-xuser-defined.html
-
-        * loader/TextResourceDecoder.cpp:
-        (WebCore::TextResourceDecoder::setEncoding):
-
-2008-10-12  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Remove unneeded forward declaration.
-
-        * platform/graphics/ImageBuffer.h:
+        * dom/Node.h: onblur, onerror, onfocus, and onload all need to be declared
+        virtual, since their behavior for HTMLBodyElement differs from the base
+        implementation.
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::onblur):
+        (WebCore::HTMLBodyElement::setOnblur):
+        (WebCore::HTMLBodyElement::onerror):
+        (WebCore::HTMLBodyElement::setOnerror):
+        (WebCore::HTMLBodyElement::onfocus):
+        (WebCore::HTMLBodyElement::setOnfocus):
+        (WebCore::HTMLBodyElement::onload):
+        (WebCore::HTMLBodyElement::setOnload):
+        (WebCore::HTMLBodyElement::onbeforeunload):
+        (WebCore::HTMLBodyElement::setOnbeforeunload):
+        (WebCore::HTMLBodyElement::onmessage):
+        (WebCore::HTMLBodyElement::setOnmessage):
+        (WebCore::HTMLBodyElement::onoffline):
+        (WebCore::HTMLBodyElement::setOnoffline):
+        (WebCore::HTMLBodyElement::ononline):
+        (WebCore::HTMLBodyElement::setOnonline):
+        (WebCore::HTMLBodyElement::onresize):
+        (WebCore::HTMLBodyElement::setOnresize):
+        (WebCore::HTMLBodyElement::onstorage):
+        (WebCore::HTMLBodyElement::setOnstorage):
+        (WebCore::HTMLBodyElement::onunload):
+        (WebCore::HTMLBodyElement::setOnunload):
+        * html/HTMLBodyElement.h:
+        * html/HTMLBodyElement.idl:
 
-2008-10-12  Sam Weinig  <sam@webkit.org>
+2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
 
         Reviewed by Darin Adler.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21560
-        Layering violation: String should not be responsible for creating Lengths
+        https://bugs.webkit.org/show_bug.cgi?id=26601
+        Remove disabled code for appcache dynamic entries
 
-        It was a layering violation for String to know haw to parse
-        into Lengths, LengthArrays, and CoordsArrays.
+        This also removes code for DOM 3 Core DOMStringList, which we don't use for anything else yet.
 
+        * DerivedSources.cpp:
+        * DerivedSources.make:
         * GNUmakefile.am:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
         * WebCoreSources.bkl:
-        * html/HTMLAreaElement.cpp:
-        (WebCore::HTMLAreaElement::parseMappedAttribute):
-        * html/HTMLFrameSetElement.cpp:
-        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
-        * platform/text/AtomicString.h:
-        (WebCore::AtomicString::percentage):
-        * platform/text/PlatformString.h:
-        * platform/text/String.cpp:
-        * platform/text/StringImpl.cpp:
-        * platform/text/StringImpl.h:
-        * rendering/Length.cpp: Added.
-        (WebCore::parseLength):
-        (WebCore::countCharacter):
-        (WebCore::newCoordsArray):
-        (WebCore::newLengthArray):
-        * rendering/Length.h:
-        (WebCore::LengthSize::LengthSize):
-
-2008-10-12  Brad Garcia  <bgarcia@google.com>
-
-        Reviewed by Darin Adler.
-
-        Interpret fractional percentage values for %MultiLength values.
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=3591
-        Test: fast/frames/frame-length-fractional-percentage.html
-
-        * platform/text/StringImpl.cpp:
-        (WebCore::parseLength):
-
-2008-10-12  Timothy Hatcher  <timothy@apple.com>
-
-        Remember the expanded state of the rules in the Styles pane. So
-        collapsing a rule will persist across all the elements that have
-        that same rule. The same applies to Computed Style, so the Computed
-        Style rule is now collapsed by default. This should help lessen the
-        confusion on why Computed Style can't be edited (a common confusion.)
-
-        https://bugs.webkit.org/show_bug.cgi?id=21553
-
-        Reviewed by Darin Adler.
-
-        * inspector/front-end/PropertiesSection.js:
-        (WebInspector.PropertiesSection): Set the _expanded property directly,
-        instead of using the setter. Expanded is the default, so no work is needed.
-        This prevents calling StylesSidebarPane.collapse before object initialization
-        is complete.
-        * inspector/front-end/StylesSidebarPane.js:
-        (WebInspector.StylesSidebarPane.prototype.update): Check the Preferences object
-        for the expanded state of the StylePropertiesSection. Collapse computed style
-        by default and expand everything else.
-        (WebInspector.StylePropertiesSection): Make a semi unique identifier to be used
-        when remembering expanded state.
-        (WebInspector.StylePropertiesSection.prototype.expand): Set the expanded state
-        to true for this identifier in Preferences.styleRulesExpandedState. Don't remember
-        the state if the dontRememberState property is true.
-        (WebInspector.StylePropertiesSection.prototype.collapse): Set the expanded state
-        to false for this identifier in Preferences.styleRulesExpandedState.
-        * inspector/front-end/inspector.js:
-        (Preferences.styleRulesExpandedState): Initialize to an empty object.
-
-2008-10-12  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Alp Toker.
-
-        [Gtk] Remove libWebCoreJS.la when doing make clean
-        https://bugs.webkit.org/show_bug.cgi?id=21544
-
-        Remove libWebCoreJS.la when doing a clean target
-
-        * GNUmakefile.am: add libWebCoreJS.la to CLEANFILES
-
-2008-10-11  Alp Toker  <alp@nuanti.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20592
-        The focus ring is not shown while navigating on some pages
-
-        Fix drawFocusRing() so it doesn't depend on the current graphics
-        state, thus matching other platforms which already work this way.
-
-        This patch provides two code paths: one using straight Cairo and
-        one specialised for the GTK+ port with a more conventional appearance.
-
-        Also change focusRingColor() to return a null color, allowing the
-        focus ring to pick up the style's current color if it isn't overridden
-        with CSS.
-
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        (WebCore::GraphicsContext::drawFocusRing):
-        * platform/gtk/TemporaryLinkStubs.cpp:
-        (WebCore::focusRingColor):
-
-2008-10-11  Dan Bernstein  <mitz@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        - change all internal callers to use Cache::evict() instead of remove()
-
-        * loader/Cache.cpp:
-        (WebCore::Cache::revalidateResource):
-        (WebCore::Cache::revalidationSucceeded):
-        (WebCore::Cache::pruneDeadResources):
-        (WebCore::Cache::setDisabled):
-
-2008-10-11  David Hyatt  <hyatt@apple.com>
-
-        Make sure invalidatePart knows how to invalidate the track and scrollbar backgrounds.
-
-        Reviewed by Tim Hatcher
-
-        * platform/ScrollbarThemeComposite.cpp:
-        (WebCore::ScrollbarThemeComposite::invalidatePart):
-
-2008-10-11  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21549 (regression in before/after track pieces).
-
-        Also fixed resizer positioning problems.
-
-        Reviewed by Tim Hatcher
-
-        * platform/ScrollbarThemeComposite.cpp:
-        (WebCore::ScrollbarThemeComposite::splitTrack):
-        (WebCore::ScrollbarThemeComposite::trackPosition):
-        (WebCore::ScrollbarThemeComposite::trackLength):
-        * platform/ScrollbarThemeComposite.h:
-        (WebCore::ScrollbarThemeComposite::constrainTrackRectToTrackPieces):
-        * rendering/RenderLayer.cpp:
-        (WebCore::scrollCornerRect):
-        (WebCore::RenderLayer::positionOverflowControls):
-        (WebCore::RenderLayer::paintOverflowControls):
-        (WebCore::RenderLayer::isPointInResizeControl):
-        (WebCore::RenderLayer::hitTestOverflowControls):
-        * rendering/RenderScrollbarTheme.cpp:
-        (WebCore::RenderScrollbarTheme::constrainTrackRectToTrackPieces):
-        * rendering/RenderScrollbarTheme.h:
-
-2008-10-11  Alp Toker  <alp@nuanti.com>
-
-        Reviewed by David Hyatt.
-
-        Implement release/retain for Widget GTK+.
-
-        * platform/Widget.cpp:
-        * platform/gtk/WidgetGtk.cpp:
-        (WebCore::Widget::~Widget):
-        (WebCore::Widget::releasePlatformWidget):
-        (WebCore::Widget::retainPlatformWidget):
-
-2008-10-11  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - rename WebCoreSetAlwaysUseATSU to WebCoreSetAlwaysUsesComplexTextCodePath
-          and add a corresponding getter; add the same functions on Windows
-
-        * WebCore.base.exp:
-        * platform/graphics/Font.cpp:
-        (WebCore::Font::setCodePath):
-        (WebCore::codePath):
-        (WebCore::Font::canUseGlyphCache):
-        * platform/graphics/Font.h:
-        * platform/mac/WebCoreTextRenderer.h:
-        * platform/mac/WebCoreTextRenderer.mm:
-        (WebCoreSetAlwaysUsesComplexTextCodePath):
-        (WebCoreAlwaysUsesComplexTextCodePath):
-        * platform/win/WebCoreTextRenderer.cpp:
-        (WebCore::WebCoreSetAlwaysUsesComplexTextCodePath):
-        (WebCore::WebCoreAlwaysUsesComplexTextCodePath):
-        * platform/win/WebCoreTextRenderer.h:
-
-2008-10-11  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Cameron Zwarich.
-
-        Stop leaking the event parameter names.  The protected strings were showing up
-        in the caches window after one use.  No measurable performance loss.
-
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::eventParameterName):
-
-2008-10-11  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Cameron Zwarich.
-
-        Remove unused function getNodeEventListener.
-
-        * bindings/js/JSEventListener.cpp:
-        * bindings/js/JSEventListener.h:
-
-2008-10-11  David Hyatt  <hyatt@apple.com>
-
-        Add support for both positive and negative margins to tracks and track pieces.
-
-        Reviewed by Tim Hatcher
-
-        * platform/ScrollbarThemeComposite.cpp:
-        (WebCore::ScrollbarThemeComposite::paint):
-        (WebCore::ScrollbarThemeComposite::hitTest):
-        (WebCore::ScrollbarThemeComposite::splitTrack):
-        (WebCore::ScrollbarThemeComposite::trackPieceRects):
-        (WebCore::ScrollbarThemeComposite::trackPosition):
-        (WebCore::ScrollbarThemeComposite::trackLength):
-        * platform/ScrollbarThemeComposite.h:
-        (WebCore::ScrollbarThemeComposite::adjustTrackPieceRect):
-        * rendering/RenderScrollbar.cpp:
-        (WebCore::RenderScrollbar::trackRect):
-        (WebCore::RenderScrollbar::trackPieceRectWithMargins):
-        * rendering/RenderScrollbar.h:
-        * rendering/RenderScrollbarPart.cpp:
-        (WebCore::RenderScrollbarPart::computeScrollbarWidth):
-        (WebCore::RenderScrollbarPart::computeScrollbarHeight):
-        * rendering/RenderScrollbarTheme.cpp:
-        (WebCore::RenderScrollbarTheme::adjustTrackPieceRect):
-        * rendering/RenderScrollbarTheme.h:
-
-2008-10-10  David Hyatt  <hyatt@apple.com>
-
-        Drop -webkit-scrollbar- from all the scrollbar pseudo-classes, since they are scoped to
-        the scrollbar pseudo-elements anyway.
-
-        Reviewed by Tim Hatcher
-
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType):
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass):
-
-2008-10-10  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - separate Cache::remove() into a private method and a public interface,
-          then make Cache::pruneDeadResources() use the private method.
-
-        * loader/Cache.cpp:
-        (WebCore::Cache::pruneDeadResources):
-        (WebCore::Cache::evict):
-        * loader/Cache.h:
-        (WebCore::Cache::remove):
-
-2008-10-10  David Hyatt  <hyatt@apple.com>
-
-        Fix a math error when splitting a vertical track.  Clean up more of ScrollbarThemeComposite
-        now that the track pieces meet under the thumb.
-
-        Reviewed by Tim Hatcher
-
-        * platform/ScrollbarThemeComposite.cpp:
-        (WebCore::ScrollbarThemeComposite::paint):
-        (WebCore::ScrollbarThemeComposite::splitTrack):
-
-2008-10-10  David Hyatt  <hyatt@apple.com>
-
-        Make the track pieces of a scrollbar extend under the thumb (each gets half the thumb).
-
-        Reviewed by Tim Hatcher
-
-        * platform/ScrollbarThemeComposite.cpp:
-        (WebCore::ScrollbarThemeComposite::hitTest):
-        (WebCore::ScrollbarThemeComposite::splitTrack):
-
-2008-10-10  David Hyatt  <hyatt@apple.com>
-
-        Make sure specialized ::scrollbar rules are still triggering custom scrollbar creation.
-
-        Reviewed by Tim Hatcher
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::createScrollbar):
-        * rendering/RenderScrollbar.cpp:
-        (WebCore::RenderScrollbar::createCustomScrollbar):
-        (WebCore::RenderScrollbar::RenderScrollbar):
-        (WebCore::RenderScrollbar::setParent):
-        (WebCore::RenderScrollbar::updateScrollbarParts):
-        (WebCore::RenderScrollbar::updateScrollbarPart):
-        * rendering/RenderScrollbar.h:
-        * rendering/style/RenderStyle.h:
-        (WebCore::RenderStyle::):
-
-2008-10-10  David Hyatt  <hyatt@apple.com>
-
-        Make sure scrollbar background images cause proper part invalidation to occur.
-
-        Reviewed by Tim Hatcher
-
-        * rendering/RenderScrollbar.cpp:
-        (WebCore::RenderScrollbar::setHoveredPart):
-        (WebCore::RenderScrollbar::setPressedPart):
-        * rendering/RenderScrollbarPart.cpp:
-        (WebCore::RenderScrollbarPart::styleDidChange):
-        (WebCore::RenderScrollbarPart::imageChanged):
-        * rendering/RenderScrollbarPart.h:
-
-2008-10-10  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler
-
-        https://bugs.webkit.org/show_bug.cgi?id=21538
-        
-        The blendFunc() for TransformOperations should never mess with the
-        operation lists by replacing some ops with identity, otherwise the lists
-        no longer match and transitions break.
-
-        Test: transitions/matched-transform-functions.html
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::blendFunc):
-
-2008-10-10  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Darin Adler
-
-        https://bugs.webkit.org/show_bug.cgi?id=21537
-
-        Fix re-targetting a running transition; if the target property
-        changes, we do need to make a new ImplicitAnimation.
-        
-        Test: transitions/retargetted-transition.html
-
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimationPrivate::updateTransitions):
-
-2008-10-10  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Part of <rdar://problem/6278147> Cannot stop a slow script -- Fix assertion.
-
-        When JS is terminated by the user choosing to stop a slow script
-        the exception toString method throws, yet the console logger does
-        not perform exception checks after logging.  This leaves an
-        exception on the Machine, which in turn results in an assertion
-        failure next time we attempt to enter JS.  The solution is just to
-        clear the exception state after attempting to record the exception.
-
-        * page/Console.cpp:
-        (WebCore::Console::reportException):
-
-2008-10-10  David Hyatt  <hyatt@apple.com>
-
-        Make textareas work with custom CSS scrollbars and resizers.  Need to access the correct renderer
-        when looking for pseudo styles.
-
-        Reviewed by Tim Hatcher
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::createScrollbar):
-        (WebCore::RenderLayer::styleChanged):
-
-2008-10-10  David Hyatt  <hyatt@apple.com>
-
-        Add the ability to style the scroll corner and the resizer from CSS.
-
-        Reviewed by Tim Hatcher
-
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType):
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::RenderLayer):
-        (WebCore::RenderLayer::~RenderLayer):
-        (WebCore::RenderLayer::paintOverflowControls):
-        (WebCore::RenderLayer::paintScrollCorner):
-        (WebCore::RenderLayer::paintResizer):
-        (WebCore::RenderLayer::styleChanged):
-        * rendering/RenderLayer.h:
-        * rendering/RenderScrollbar.cpp:
-        (WebCore::RenderScrollbar::updateScrollbarPart):
-        (WebCore::RenderScrollbar::paintPart):
-        * rendering/RenderScrollbarPart.cpp:
-        (WebCore::RenderScrollbarPart::RenderScrollbarPart):
-        (WebCore::RenderScrollbarPart::paintIntoRect):
-        * rendering/RenderScrollbarPart.h:
-        * rendering/style/RenderStyle.h:
-        (WebCore::RenderStyle::):
-
-2008-10-10  David Hyatt  <hyatt@apple.com>
-
-        Make CSS scrollbars respect the OS setting regarding where buttons should be placed.
-
-        Reviewed by Sam Weinig
-
-        No test case possible, since the OS setting can vary.
-
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType):
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass):
-        * platform/Scrollbar.h:
-        (WebCore::Scrollbar::styleChanged):
-        * platform/mac/ScrollbarThemeMac.mm:
-        (+[ScrollbarPrefsObserver appearancePrefsChanged:]):
-        (WebCore::ScrollbarThemeMac::preferencesChanged):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::invalidateScrollbarRect):
-        * rendering/RenderScrollbar.cpp:
-        (WebCore::RenderScrollbar::styleChanged):
-        (WebCore::RenderScrollbar::updateScrollbarPart):
-        * rendering/RenderScrollbar.h:
-        * rendering/RenderScrollbarTheme.h:
-        (WebCore::RenderScrollbarTheme::buttonsPlacement):
-
-2008-10-10  Timothy Hatcher  <timothy@apple.com>
-
-        Fixes a regression with input search fields, where the placeholder text
-        would not be updated when the value of the placeholder attribute changed.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21521
-
-        Reviewed by Adele Peterson.
-
-        Test: fast/forms/search-placeholder-value-changed.html
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::parseMappedAttribute): Pass true for the
-        placeholderValueChanged parameter of updatePlaceholderVisibility.
-        (WebCore::HTMLInputElement::updatePlaceholderVisibility): Add parameter
-        for placeholderValueChanged that informs the method that the value changed.
-        * html/HTMLInputElement.h: Add the placeholderValueChanged to the
-        updatePlaceholderVisibility method. Made it default to false.
-
-2008-10-10  David Hyatt  <hyatt@apple.com>
-
-        Allow the track part to have negative margins so that it can slightly overlap buttons.  This
-        is necessary to emulate the Aqua look in CSS.
-
-        Reviewed by Sam Weinig
-
-        * platform/ScrollbarThemeComposite.cpp:
-        (WebCore::ScrollbarThemeComposite::paint):
-        (WebCore::ScrollbarThemeComposite::hitTest):
-        * rendering/RenderScrollbar.cpp:
-        (WebCore::RenderScrollbar::setHoveredPart):
-        (WebCore::RenderScrollbar::trackRect):
-        * rendering/RenderScrollbar.h:
-        * rendering/RenderScrollbarPart.cpp:
-        (WebCore::RenderScrollbarPart::computeScrollbarWidth):
-        (WebCore::RenderScrollbarPart::computeScrollbarHeight):
-        * rendering/RenderScrollbarTheme.cpp:
-        (WebCore::RenderScrollbarTheme::backButtonRect):
-        (WebCore::RenderScrollbarTheme::forwardButtonRect):
-        (WebCore::RenderScrollbarTheme::trackRect):
-
-2008-10-10  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21527
-
-        Make CSS scrollbars support :not, :hover and :active.
-
-        Reviewed by Adam Roben
-
-        Added WebCore/manual-tests/scrollbar-hover-active.html
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
-        (WebCore::CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass):
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::autoscrollPressedPart):
-        (WebCore::Scrollbar::startTimerIfNeeded):
-        (WebCore::Scrollbar::setHoveredPart):
-        (WebCore::Scrollbar::setPressedPart):
-        (WebCore::Scrollbar::mouseMoved):
-        (WebCore::Scrollbar::mouseExited):
-        (WebCore::Scrollbar::mouseUp):
-        (WebCore::Scrollbar::mouseDown):
-        * platform/Scrollbar.h:
-        * rendering/RenderScrollbar.cpp:
-        (WebCore::RenderScrollbar::setHoveredPart):
-        (WebCore::RenderScrollbar::setPressedPart):
-        (WebCore::RenderScrollbar::updateScrollbarParts):
-        (WebCore::pseudoForScrollbarPart):
-        (WebCore::RenderScrollbar::updateScrollbarPart):
-        * rendering/RenderScrollbar.h:
-
-2008-10-10  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21025
-        CSS transition with duration=0 and delay=0 doesn't override ongoing transition
-
-        Test: transitions/interrupt-zero-duration.html
-
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimation::updateTransitions):
-
-2008-10-10  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix. Add new scrollbar-related sources.
-
-        * WebCoreSources.bkl:
-
-2008-10-10  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21522
-
-        Support increment/decrement/start/end on scrollbars.  Allows a fully functional scrollbar to be
-        created.  (Just :hover/:active left to finish it up.)
+        * bindings/js/JSDOMStringListCustom.cpp: Removed.
+        * bindings/v8/custom/V8CustomBinding.h:
+        * bindings/v8/custom/V8DOMStringListCustom.cpp: Removed.
+        * dom/DOMStringList.cpp: Removed.
+        * dom/DOMStringList.h: Removed.
+        * dom/DOMStringList.idl: Removed.
+        * dom/StaticStringList.cpp: Removed.
+        * dom/StaticStringList.h: Removed.
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::shouldLoadResourceFromApplicationCache):
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::addResource):
+        * loader/appcache/ApplicationCache.h:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
+        * loader/appcache/ApplicationCacheResource.cpp:
+        (WebCore::ApplicationCacheResource::dumpType):
+        * loader/appcache/ApplicationCacheResource.h:
+        (WebCore::ApplicationCacheResource::):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::storeUpdatedType):
+        * loader/appcache/DOMApplicationCache.cpp:
+        * loader/appcache/DOMApplicationCache.h:
+        * loader/appcache/DOMApplicationCache.idl:
+        * page/DOMWindow.idl:
 
-        Reviewed by Adam Roben
+2009-06-22  Steve Falkenburg  <sfalken@apple.com>
 
-        Added scrollbars/scrollbar-buttons.html
+        Windows build fix.
 
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass):
+        * DerivedSources.cpp:
+        * html/HTMLElementsAllInOne.cpp:
 
-2008-10-10  David Hyatt  <hyatt@apple.com>
+2009-06-22  Alexey Proskuryakov  <ap@webkit.org>
 
-        Rename some pseudoclasses.  Removing "-scrollbar-" from a bunch of the pseudoclasses.  Renaming
-        back/forward to decrement/increment.  Adding start/end pseudoclasses.
+        Reviewed by John Sullivan.
 
-        Reviewed by Eric Seidel
+        <rdar://problem/6956606> REGRESSION (S4Beta -> Final): After the password is input,
+        Japanese can't be input.
 
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType):
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass):
+        WebKit uses a per-frame input context for most editable fields, and application's global
+        context for password fields, manually controlling secure input state and the list of available
+        input sources.
 
-2008-10-10  David Hyatt  <hyatt@apple.com>
+        We were setting TSMDocument property to disable non-Roman input methods after focus changed
+        to a password field, but before selection was updated. This resulted in the property being
+        applied to a wrong TSMDocument in some cases, because TSMGetActiveDocument() uses input
+        context cached by +[NSApplication updateWindows], we change context based on selection,
+        not on focus.
 
-        Switch window-active to window-inactive, since that will work better as far as degrading in other
-        browsers.
+        * page/mac/FrameMac.mm: (WebCore::Frame::setUseSecureKeyboardEntry): Since there is only one
+        context that we use for password fields - the global one - there is no need to get the active
+        one.
 
-        Reviewed by Tim Hatcher
+2009-06-22  David Levin  <levin@chromium.org>
 
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType):
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass):
+        Reviewed by David Hyatt and Eric Seidel.
 
-2008-10-09  Chris Marrin  <cmarrin@apple.com>
+        REGRESSION: When the main page (ScrollView) has a custom scrollbar, it crashes on destruction.
+        https://bugs.webkit.org/show_bug.cgi?id=26326
 
-        Reviewed by Dan Bernstein.
+        Test: scrollbars/scrollbar-crash-on-refresh.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=21310
-
-        Redesigned how animation events are sent in order to get rid of
-        AnimationEventDispatcher. ImplicitAnimation and KeyframeAnimation
-        are now ref counted. While calling the event handler, I keep a 
-        reference to this class to avoid it getting destroyed out from under me.
-
-        I also moved most of the functionality of CompositeAnimation to
-        and internal class (CompositeAnimationPrivate) to reduce the exposure
-        of the internals of the various animation classes.
-
-        We have several transition and animation LayoutTests which verify that
-        this fix works as expected and continues to avoid crashes.
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::AnimationBase):
-        * page/animation/AnimationBase.h:
-        (WebCore::AnimationBase::cancelTimers):
-        (WebCore::AnimationBase::waitingForStyleAvailable):
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimationPrivate::CompositeAnimationPrivate):
-        (WebCore::CompositeAnimationPrivate::suspended):
-        (WebCore::CompositeAnimationPrivate::~CompositeAnimationPrivate):
-        (WebCore::CompositeAnimationPrivate::updateTransitions):
-        (WebCore::CompositeAnimationPrivate::updateKeyframeAnimations):
-        (WebCore::CompositeAnimationPrivate::animate):
-        (WebCore::CompositeAnimationPrivate::setAnimating):
-        (WebCore::CompositeAnimationPrivate::animating):
-        (WebCore::CompositeAnimationPrivate::getAnimationForProperty):
-        (WebCore::CompositeAnimationPrivate::resetTransitions):
-        (WebCore::CompositeAnimationPrivate::resetAnimations):
-        (WebCore::CompositeAnimationPrivate::cleanupFinishedAnimations):
-        (WebCore::CompositeAnimationPrivate::setAnimationStartTime):
-        (WebCore::CompositeAnimationPrivate::setTransitionStartTime):
-        (WebCore::CompositeAnimationPrivate::suspendAnimations):
-        (WebCore::CompositeAnimationPrivate::resumeAnimations):
-        (WebCore::CompositeAnimationPrivate::overrideImplicitAnimations):
-        (WebCore::CompositeAnimationPrivate::resumeOverriddenImplicitAnimations):
-        (WebCore::compareAnimationIndices):
-        (WebCore::CompositeAnimationPrivate::styleAvailable):
-        (WebCore::CompositeAnimationPrivate::isAnimatingProperty):
-        (WebCore::CompositeAnimationPrivate::setWaitingForStyleAvailable):
-        (WebCore::CompositeAnimation::CompositeAnimation):
-        (WebCore::CompositeAnimation::~CompositeAnimation):
-        (WebCore::CompositeAnimation::animate):
-        (WebCore::CompositeAnimation::animating):
-        (WebCore::CompositeAnimation::setWaitingForStyleAvailable):
-        (WebCore::CompositeAnimation::resetTransitions):
-        (WebCore::CompositeAnimation::suspendAnimations):
-        (WebCore::CompositeAnimation::resumeAnimations):
-        (WebCore::CompositeAnimation::suspended):
-        (WebCore::CompositeAnimation::styleAvailable):
-        (WebCore::CompositeAnimation::setAnimating):
-        (WebCore::CompositeAnimation::isAnimatingProperty):
-        (WebCore::CompositeAnimation::setAnimationStartTime):
-        (WebCore::CompositeAnimation::setTransitionStartTime):
-        (WebCore::CompositeAnimation::overrideImplicitAnimations):
-        (WebCore::CompositeAnimation::resumeOverriddenImplicitAnimations):
-        * page/animation/CompositeAnimation.h:
-        * page/animation/ImplicitAnimation.cpp:
-        (WebCore::ImplicitAnimation::sendTransitionEvent):
-        * page/animation/ImplicitAnimation.h:
-        (WebCore::ImplicitAnimation::create):
-        * page/animation/KeyframeAnimation.cpp:
-        (WebCore::KeyframeAnimation::sendAnimationEvent):
-        * page/animation/KeyframeAnimation.h:
-        (WebCore::KeyframeAnimation::create):
-
-2008-10-09  David Hyatt  <hyatt@apple.com>
-
-        Add support for scrollbar orientation as a pseudoclass.  Add support for whether or not the scrollbar
-        is active as well.
-
-        Reviewed by Tim Hatcher
-
-        Added scrollbars/scrollbar-orientation.html
-
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType):
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass):
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::isWindowActive):
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        Gives the FrameView a change to do any necessary cleanup on
+        Document::detach() which is where the renderArena gets detroyed.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::detachCustomScrollbars):
+        Gets rid of any custom scrollbars (if the docment supplied them).
+        * page/FrameView.h:
         * platform/Scrollbar.h:
-        * rendering/RenderScrollbar.cpp:
-        (WebCore::RenderScrollbar::paint):
-        (WebCore::RenderScrollbar::partForStyleResolve):
-        * rendering/RenderScrollbar.h:
-
-2008-10-09  David Hyatt  <hyatt@apple.com>
-
-        Add support for pseudo classes on scrollbar pseudo elements.  As an initial proof of concept only
-        :enabled/:disabled are supported.  More pseudo classes will follow quickly now that this works.
-
-        Reviewed by Tim Hatcher
-
-        Added scrollbars/disabled-scrollbar.html
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkSelector):
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
-        (WebCore::CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass):
-        * css/CSSStyleSelector.h:
+        (WebCore::Scrollbar::isCustomScrollbar):
         * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::getPseudoStyle):
-        * rendering/RenderObject.h:
-        * rendering/RenderScrollbar.cpp:
-        (WebCore::RenderScrollbar::setEnabled):
-        (WebCore::RenderScrollbar::scrollbarForStyleResolve):
-        (WebCore::RenderScrollbar::getScrollbarPseudoStyle):
-        (WebCore::RenderScrollbar::paintPart):
+        (WebCore::RenderObject::destroy):
+        Removed the check for document()->frame().  If frame() is 0 in this code,
+        then the call to animation() is also incorrect (since it does document()->frame()->animation()).
         * rendering/RenderScrollbar.h:
+        (WebCore::RenderScrollbar::isCustomScrollbar):
 
-2008-10-09  Eric Carlson  <eric.carlson@apple.com>
-
-        Media controls should not show when element is not visible
-
-        https://bugs.webkit.org/show_bug.cgi?id=21155
-        
-        Reviewed by Adele Peterson.
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::recalcStyle): New, call renderer()->updateFromElement to stay
-        in sync with visibility changes
-        * html/HTMLMediaElement.h:
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::RenderMedia): initialize m_previousVisible
-        (WebCore::RenderMedia::updateControlVisibility): consider style()->visibility() when determining
-        if element is visible or not. Don't animate controller visibility when change triggered by
-        showing or hiding media element.
-        * rendering/RenderMedia.h: declare m_previousVisible
-
-2008-10-09  Timothy Hatcher  <timothy@apple.com>
-
-        Annotate the Objective-C DOM APIs with the JavaScriptCore/WebKitAvailability.h
-        availability macros and version macros.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21496
-        rdar://problem/6259225
-
-        Reviewed by Sam Weinig.
-
-        * bindings/objc/DOMCSS.h: Add a version #if around catgory interface.
-        * bindings/objc/DOMEventException.h: Include JavaScriptCore/WebKitAvailability.h
-        and add an #if around the enum.
-        * bindings/objc/DOMException.h: Ditto. Give the enum a name and remove the
-        comment to match the other headers.
-        * bindings/objc/DOMExtensions.h: Annotate the methods with version 3.0 or later.
-        * bindings/objc/DOMObject.h: Add a version #if around class interface.
-        * bindings/objc/DOMRangeException.h: Include JavaScriptCore/WebKitAvailability.h
-        and add a version #if around the enum.
-        * bindings/objc/DOMSVGException.h: Ditto. Use the latest version since SVG is new.
-        * bindings/objc/DOMXPathException.h: Ditto. Use the 3.0 version.
-        * bindings/objc/PublicDOMInterfaces.h: Annotate classes and protocols for
-        when they where added to WebKit. Also annotate individual methods that are
-        deprecated or where added after the class was added to WebKit.
-        * bindings/objc/WebScriptObject.h: Include JavaScriptCore/WebKitAvailability.h
-        since this header is included by most DOM headers. Annotate the JSObject method.
-
-        * bindings/scripts/CodeGeneratorObjC.pm:
-        (ReadPublicInterfaces): Parse out the availability macro for each function/property.
-        And parse out the availability version for the class/protocol. Default to
-        WEBKIT_VERSION_LATEST if the class is new.
-        (GenerateHeader): Include JavaScriptCore/WebKitAvailability.h if needed. Add the
-        interface availability version check if the class has a required version. Create
-        a public interface key (used to lookup in $publicInterfaces) and make a declaration
-        suffix that includes the availability macro (if needed). Use the "available in 1.3
-        and later but deprecated in 3.0" macro instead of "deprecated in 10.5 and later" as
-        the default availability macro for old style methods. Tweak line breaks in the generated
-        headers to look good and not have too many extra lines.
-
-2008-10-09  Simon Fraser  <simon.fraser@apple.com>
+2009-06-22  Dan Bernstein  <mitz@apple.com>
 
-        Reviewed by Dave Hyatt
+        Reviewed by Simon Fraser.
 
-        https://bugs.webkit.org/show_bug.cgi?id=20947
+        - fix https://bugs.webkit.org/show_bug.cgi?id=23606
+          <rdar://problem/6537777> CSS gradient not repainted when image load
+          completes
 
-        Refactor setStyle() methods into styleWillChange()
-        and styleDidChange(), so most of the setStyle() overrides can
-        be removed.
+        Test: fast/repaint/background-generated.html
 
-        * rendering/RenderBR.cpp:
-        (WebCore::RenderBR::styleDidChange):
-        * rendering/RenderBR.h:
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::styleWillChange):
-        (WebCore::RenderBlock::styleDidChange):
-        * rendering/RenderBlock.h:
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::~RenderBox):
-        (WebCore::RenderBox::destroy):
-        (WebCore::RenderBox::styleWillChange):
-        (WebCore::RenderBox::styleDidChange):
-        * rendering/RenderBox.h:
-        * rendering/RenderButton.cpp:
-        (WebCore::RenderButton::styleWillChange):
-        (WebCore::RenderButton::styleDidChange):
-        * rendering/RenderButton.h:
-        * rendering/RenderFieldset.cpp:
-        (WebCore::RenderFieldset::styleDidChange):
-        * rendering/RenderFieldset.h:
-        * rendering/RenderFileUploadControl.cpp:
-        (WebCore::RenderFileUploadControl::styleDidChange):
-        * rendering/RenderFileUploadControl.h:
-        * rendering/RenderInline.cpp:
-        (WebCore::RenderInline::styleDidChange):
-        * rendering/RenderInline.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::styleChanged):
-        * rendering/RenderLayer.h:
-        * rendering/RenderListBox.cpp:
-        (WebCore::RenderListBox::styleDidChange):
-        * rendering/RenderListBox.h:
-        * rendering/RenderListItem.cpp:
-        (WebCore::RenderListItem::styleDidChange):
-        * rendering/RenderListItem.h:
-        * rendering/RenderListMarker.cpp:
-        (WebCore::RenderListMarker::styleWillChange):
-        (WebCore::RenderListMarker::styleDidChange):
-        * rendering/RenderListMarker.h:
-        * rendering/RenderMenuList.cpp:
-        (WebCore::RenderMenuList::styleDidChange):
-        * rendering/RenderMenuList.h:
         * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::setStyle):
-        (WebCore::RenderObject::setStyleInternal):
-        (WebCore::RenderObject::styleWillChange):
-        (WebCore::RenderObject::styleDidChange):
-        * rendering/RenderObject.h:
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::styleDidChange):
-        * rendering/RenderReplaced.h:
-        * rendering/RenderSVGGradientStop.cpp:
-        (WebCore::RenderSVGGradientStop::styleDidChange):
-        * rendering/RenderSVGGradientStop.h:
-        * rendering/RenderScrollbarPart.cpp:
-        (WebCore::RenderScrollbarPart::styleDidChange):
-        * rendering/RenderScrollbarPart.h:
-        * rendering/RenderSlider.cpp:
-        (WebCore::RenderSlider::styleDidChange):
-        * rendering/RenderSlider.h:
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::styleDidChange):
-        * rendering/RenderTable.h:
-        * rendering/RenderTableCell.cpp:
-        (WebCore::RenderTableCell::styleWillChange):
-        (WebCore::RenderTableCell::styleDidChange):
-        * rendering/RenderTableCell.h:
-        * rendering/RenderTableRow.cpp:
-        (WebCore::RenderTableRow::styleWillChange):
-        * rendering/RenderTableRow.h:
-        * rendering/RenderText.cpp:
-        (WebCore::RenderText::styleDidChange):
-        * rendering/RenderText.h:
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::styleDidChange):
-        * rendering/RenderTextControl.h:
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::styleDidChange):
-        * rendering/RenderWidget.h:
-
-2008-10-09  David Hyatt  <hyatt@apple.com>
-
-        Make sure to destroy a custom scrollbar's RenderObjects before the arena goes away.  When our widget
-        parent is nulled out is a good time.
-
-        Reviewed by Oliver Hunt
-
-        * rendering/RenderScrollbar.cpp:
-        (WebCore::RenderScrollbar::~RenderScrollbar):
-        (WebCore::RenderScrollbar::setParent):
-        (WebCore::RenderScrollbar::updateScrollbarPart):
-        * rendering/RenderScrollbar.h:
-
-2008-10-09  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21446
-
-        This patch gets CSS scrollbars up and limping.  There's no way to distinguish between states or between
-        orientation and back vs. forward on the buttons, but it's a start.
-
-        Reviewed by Oliver Hunt
-
-        Added scrollbars/basic-scrollbar.html
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType):
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
-        * platform/ScrollTypes.h:
-        (WebCore::):
-        * platform/Scrollbar.h:
-        (WebCore::Scrollbar::styleChanged):
-        * platform/ScrollbarThemeComposite.cpp:
-        (WebCore::ScrollbarThemeComposite::paint):
-        (WebCore::ScrollbarThemeComposite::splitTrack):
-        * platform/ScrollbarThemeComposite.h:
-        (WebCore::ScrollbarThemeComposite::paintScrollbarBackground):
-        (WebCore::ScrollbarThemeComposite::paintTrackBackground):
-        (WebCore::ScrollbarThemeComposite::paintTrackPiece):
-        * platform/win/ScrollbarThemeSafari.cpp:
-        (WebCore::ScrollbarThemeSafari::paintTrackBackground):
-        * platform/win/ScrollbarThemeSafari.h:
-        * platform/win/ScrollbarThemeWin.cpp:
-        (WebCore::ScrollbarThemeWin::paintTrack):
-        * platform/win/ScrollbarThemeWin.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::createScrollbar):
-        (WebCore::RenderLayer::styleChanged):
-        * rendering/RenderScrollbar.cpp: Added.
-        (WebCore::RenderScrollbar::createCustomScrollbar):
-        (WebCore::RenderScrollbar::RenderScrollbar):
-        (WebCore::RenderScrollbar::~RenderScrollbar):
-        (WebCore::RenderScrollbar::getScrollbarPseudoStyle):
-        (WebCore::RenderScrollbar::updateScrollbarParts):
-        (WebCore::RenderScrollbar::updateScrollbarPart):
-        (WebCore::RenderScrollbar::paintPart):
-        (WebCore::RenderScrollbar::buttonRect):
-        (WebCore::RenderScrollbar::minimumThumbLength):
-        * rendering/RenderScrollbar.h: Added.
-        (WebCore::RenderScrollbar::styleChanged):
-        (WebCore::RenderScrollbar::owningRenderer):
-        * rendering/RenderScrollbarPart.cpp: Added.
-        (WebCore::RenderScrollbarPart::RenderScrollbarPart):
-        (WebCore::RenderScrollbarPart::~RenderScrollbarPart):
-        (WebCore::RenderScrollbarPart::layout):
-        (WebCore::RenderScrollbarPart::layoutHorizontalPart):
-        (WebCore::RenderScrollbarPart::layoutVerticalPart):
-        (WebCore::calcScrollbarThicknessUsing):
-        (WebCore::RenderScrollbarPart::computeScrollbarWidth):
-        (WebCore::RenderScrollbarPart::computeScrollbarHeight):
-        (WebCore::RenderScrollbarPart::calcPrefWidths):
-        (WebCore::RenderScrollbarPart::setStyle):
-        * rendering/RenderScrollbarPart.h: Added.
-        (WebCore::RenderScrollbarPart::renderName):
-        (WebCore::RenderScrollbarPart::requiresLayer):
-        * rendering/RenderScrollbarTheme.cpp: Added.
-        (WebCore::RenderScrollbarTheme::renderScrollbarTheme):
-        (WebCore::RenderScrollbarTheme::buttonSizesAlongTrackAxis):
-        (WebCore::RenderScrollbarTheme::hasButtons):
-        (WebCore::RenderScrollbarTheme::hasThumb):
-        (WebCore::RenderScrollbarTheme::minimumThumbLength):
-        (WebCore::RenderScrollbarTheme::backButtonRect):
-        (WebCore::RenderScrollbarTheme::forwardButtonRect):
-        (WebCore::RenderScrollbarTheme::trackRect):
-        (WebCore::RenderScrollbarTheme::paintScrollCorner):
-        (WebCore::RenderScrollbarTheme::paintScrollbarBackground):
-        (WebCore::RenderScrollbarTheme::paintTrackBackground):
-        (WebCore::RenderScrollbarTheme::paintTrackPiece):
-        (WebCore::RenderScrollbarTheme::paintButton):
-        (WebCore::RenderScrollbarTheme::paintThumb):
-        * rendering/RenderScrollbarTheme.h: Added.
-        (WebCore::RenderScrollbarTheme::~RenderScrollbarTheme):
-        (WebCore::RenderScrollbarTheme::scrollbarThickness):
-        (WebCore::RenderScrollbarTheme::buttonsPlacement):
-        (WebCore::RenderScrollbarTheme::supportsControlTints):
-        (WebCore::RenderScrollbarTheme::shouldCenterOnThumb):
-        (WebCore::RenderScrollbarTheme::initialAutoscrollTimerDelay):
-        (WebCore::RenderScrollbarTheme::autoscrollTimerDelay):
-        (WebCore::RenderScrollbarTheme::registerScrollbar):
-        (WebCore::RenderScrollbarTheme::unregisterScrollbar):
-        * rendering/style/RenderStyle.h:
-        (WebCore::RenderStyle::):
-
-2008-10-09  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Fix Canvex DOOM Game
-        Gradient clips were not getting cleared after filling the
-        gradient, this was causing nothing to draw in Canvex
-        https://bugs.webkit.org/show_bug.cgi?id=21498
-        
-        Tests forthcoming.
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::fillRect):
-
-2008-10-09  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Oliver Hunt.
-        
-        Fix transformed patterns
-        https://bugs.webkit.org/show_bug.cgi?id=21498
-        
-        Test: fast/canvas/patternfill-repeat.html
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/graphics/GraphicsContext.cpp:
-        (WebCore::GraphicsContext::setStrokePattern):
-        (WebCore::GraphicsContext::setFillPattern):
-        (WebCore::GraphicsContext::setStrokeGradient):
-        (WebCore::GraphicsContext::setFillGradient):
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::applyStrokePattern):
-        (WebCore::applyFillPattern):
-        (WebCore::GraphicsContext::drawPath):
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::fillRect):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        * platform/graphics/wx/GraphicsContextWx.cpp:
-
-2008-10-09  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fixes.
-
-        * platform/wx/WidgetWx.cpp:
-        * plugins/wx/PluginViewWx.cpp:
-        (WebCore::PluginView::invalidateRect):
-        * webcore-base.bkl:
-
-2008-10-09  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Darin Adler.
+        (WebCore::mustRepaintFillLayers): Return true if the layer does not
+        specify a size and the image uses the container size.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21217
-        Animations assert when navigating from page
+2009-06-22  David Hyatt  <hyatt@apple.com>
 
-        Changed assertions to test the right flag for the paused state
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::updateStateMachine):
-
-2008-10-09  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Fixed > 180 degree rotation bug
-        Ensure that validateTransformFunctionList() is called after updating keyframe styles
-
-        https://bugs.webkit.org/show_bug.cgi?id=21420
-
-        Test: animations/big-rotation.html
-
-        * page/animation/KeyframeAnimation.cpp:
-        (WebCore::KeyframeAnimation::KeyframeAnimation):
-
-2008-10-09  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Anders
-
-        <rdar://problem/6250856> - Calling [WebView close] from within a redirection callback can cause bad things
-
-        The API usage to reveal this crash was so particular that a layout test is not possible with our current infrastructure.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::changeLocation): Protect the Frame from deletion
-        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy): stopAllLoaders() might clear the Frame's page,
-          so perform a second null check on the page.  Bail if it has been cleared.
-
-2008-10-09  Alp Toker  <alp@nuanti.com>
-
-        Build fix for recent DOM generation Makefile changes when custom
-        CFLAGS/CXXFLAGS are passed in.
-
-        * GNUmakefile.am:
-
-2008-10-09  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Alp Toker.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21390
-        [Gtk] Linux/Gtk: GtkLauncher crashes on Acid3 (but after test 80 this time)
-
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::platformRemoveChild):
-
-2008-10-09  Darin Adler  <darin@apple.com>
-
-       - try to fix Qt build
-
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::convertQVariantToValue): Pass JSGlobalData instead of ExecState to RegExp constructor.
-
-2008-10-08  Nikolas Zimmermann  <zimmermann@kde.org>
-
-        Reviewed by Oliver Hunt & Sam Weinig.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=15413 (SVGElementInstance does not implement EventTarget)
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=15430 (SVGElementInstances should rebuild themselves lazily)
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=20550 (SVGUseElement.setAttribute crashes Safari)
-
-        Rebuild SVG use element shadow tree lazily. Mark SVGElementInstance with the "needsUpdate" flag.
-        Next time SVGUseElement::recalcStyle is invoked (ie. via Document::updateDocumentsRendering()) the
-        use tree is rebuild.
-
-        Make SVGElementInstance a real EventTarget, as the SVG specification demands.
-        When dispatching events to a shadow tree element of a use element, the associated SVGElementInstance
-        is used as event target. The SVGElementInstance, the shadow tree element and the corresponding element
-        share an event listener list. Every event listener change on the SVGElementInstance object is forwared
-        to the corresponding element. Each change marks the SVGElementInstance tree dirty, and causes a reclone.
-        Each event listener defined via attributes (onclick/onkeydown/...) is copied from the correspondingElement
-        to the shadow tree element - through the cloneNode calls - if the use element's shadow tree gets rebuild.
-        Each listener, dynamically created using addEventListener, gets copied to the corersponding element as well.
+        Reviewed by Sam Weinig.
 
-        Now that the target/currentTarget properties of the Events are correct, event bubbling works as expected,
-        see resources/use-instanceRoot-event-bubbling.js for details.
+        https://bugs.webkit.org/show_bug.cgi?id=26607
 
-        Tests: svg/custom/use-elementInstance-event-target.svg (reenabled)
-               svg/custom/use-elementInstance-methods.svg (reenabled)
-               svg/custom/use-setAttribute-crash.svg (covers bug 20550)
-               svg/custom/use-instanceRoot-as-event-target.xhtml (covers bug 15413)
-               svg/custom/use-instanceRoot-event-bubbling.xhtml (covers bug 15413)
-               svg/custom/use-instanceRoot-event-listeners.xhtml (covers bug 15413 & 15430)
+        Add IDL for HTMLDataGridRowElement.
 
         * DerivedSources.make:
         * GNUmakefile.am:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSEventListener.h:
-        (WebCore::JSLazyEventListener::wasCreatedFromMarkup):
-        * bindings/js/JSEventTarget.cpp:
-        * bindings/js/JSEventTargetSVGElementInstance.cpp: Removed.
-        * bindings/js/JSEventTargetSVGElementInstance.h: Removed.
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::JSSVGElementInstance::addEventListener):
-        (WebCore::JSSVGElementInstance::removeEventListener):
-        (WebCore::JSSVGElementInstance::pushEventHandlerScope):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bindings/scripts/CodeGeneratorObjC.pm:
-        * dom/EventListener.h:
-        (WebCore::EventListener::wasCreatedFromMarkup):
-        * dom/EventTargetNode.cpp:
-        (WebCore::updateSVGElementInstancesAfterEventListenerChange):
-        (WebCore::EventTargetNode::addEventListener):
-        (WebCore::EventTargetNode::removeEventListener):
-        (WebCore::eventTargetAsSVGElementInstance):
-        (WebCore::eventTargetRespectingSVGTargetRules):
-        (WebCore::EventTargetNode::dispatchEvent):
-        (WebCore::EventTargetNode::dispatchGenericEvent):
-        (WebCore::EventTargetNode::removeEventListenerForType):
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::clear):
-        (WebCore::instanceAssociatedWithShadowTreeElement):
-        (WebCore::EventHandler::updateMouseEventTargetNode):
-        * page/EventHandler.h:
-        * svg/EventTargetSVGElementInstance.cpp: Removed.
-        * svg/EventTargetSVGElementInstance.h: Removed.
-        * svg/SVGElementInstance.cpp:
-        (WebCore::SVGElementInstance::SVGElementInstance):
-        (WebCore::SVGElementInstance::~SVGElementInstance):
-        (WebCore::SVGElementInstance::childNodes):
-        (WebCore::SVGElementInstance::setShadowTreeElement):
-        (WebCore::SVGElementInstance::forgetWrapper):
-        (WebCore::SVGElementInstance::appendChild):
-        (WebCore::SVGElementInstance::invalidateAllInstancesOfElement):
-        (WebCore::SVGElementInstance::setNeedsUpdate):
-        (WebCore::SVGElementInstance::associatedFrame):
-        (WebCore::SVGElementInstance::addEventListener):
-        (WebCore::SVGElementInstance::removeEventListener):
-        (WebCore::SVGElementInstance::dispatchEvent):
-        (WebCore::SVGElementInstance::onabort):
-        (WebCore::SVGElementInstance::setOnabort):
-        (WebCore::SVGElementInstance::onblur):
-        (WebCore::SVGElementInstance::setOnblur):
-        (WebCore::SVGElementInstance::onchange):
-        (WebCore::SVGElementInstance::setOnchange):
-        (WebCore::SVGElementInstance::onclick):
-        (WebCore::SVGElementInstance::setOnclick):
-        (WebCore::SVGElementInstance::oncontextmenu):
-        (WebCore::SVGElementInstance::setOncontextmenu):
-        (WebCore::SVGElementInstance::ondblclick):
-        (WebCore::SVGElementInstance::setOndblclick):
-        (WebCore::SVGElementInstance::onerror):
-        (WebCore::SVGElementInstance::setOnerror):
-        (WebCore::SVGElementInstance::onfocus):
-        (WebCore::SVGElementInstance::setOnfocus):
-        (WebCore::SVGElementInstance::oninput):
-        (WebCore::SVGElementInstance::setOninput):
-        (WebCore::SVGElementInstance::onkeydown):
-        (WebCore::SVGElementInstance::setOnkeydown):
-        (WebCore::SVGElementInstance::onkeypress):
-        (WebCore::SVGElementInstance::setOnkeypress):
-        (WebCore::SVGElementInstance::onkeyup):
-        (WebCore::SVGElementInstance::setOnkeyup):
-        (WebCore::SVGElementInstance::onload):
-        (WebCore::SVGElementInstance::setOnload):
-        (WebCore::SVGElementInstance::onmousedown):
-        (WebCore::SVGElementInstance::setOnmousedown):
-        (WebCore::SVGElementInstance::onmousemove):
-        (WebCore::SVGElementInstance::setOnmousemove):
-        (WebCore::SVGElementInstance::onmouseout):
-        (WebCore::SVGElementInstance::setOnmouseout):
-        (WebCore::SVGElementInstance::onmouseover):
-        (WebCore::SVGElementInstance::setOnmouseover):
-        (WebCore::SVGElementInstance::onmouseup):
-        (WebCore::SVGElementInstance::setOnmouseup):
-        (WebCore::SVGElementInstance::onmousewheel):
-        (WebCore::SVGElementInstance::setOnmousewheel):
-        (WebCore::SVGElementInstance::onbeforecut):
-        (WebCore::SVGElementInstance::setOnbeforecut):
-        (WebCore::SVGElementInstance::oncut):
-        (WebCore::SVGElementInstance::setOncut):
-        (WebCore::SVGElementInstance::onbeforecopy):
-        (WebCore::SVGElementInstance::setOnbeforecopy):
-        (WebCore::SVGElementInstance::oncopy):
-        (WebCore::SVGElementInstance::setOncopy):
-        (WebCore::SVGElementInstance::onbeforepaste):
-        (WebCore::SVGElementInstance::setOnbeforepaste):
-        (WebCore::SVGElementInstance::onpaste):
-        (WebCore::SVGElementInstance::setOnpaste):
-        (WebCore::SVGElementInstance::ondragenter):
-        (WebCore::SVGElementInstance::setOndragenter):
-        (WebCore::SVGElementInstance::ondragover):
-        (WebCore::SVGElementInstance::setOndragover):
-        (WebCore::SVGElementInstance::ondragleave):
-        (WebCore::SVGElementInstance::setOndragleave):
-        (WebCore::SVGElementInstance::ondrop):
-        (WebCore::SVGElementInstance::setOndrop):
-        (WebCore::SVGElementInstance::ondragstart):
-        (WebCore::SVGElementInstance::setOndragstart):
-        (WebCore::SVGElementInstance::ondrag):
-        (WebCore::SVGElementInstance::setOndrag):
-        (WebCore::SVGElementInstance::ondragend):
-        (WebCore::SVGElementInstance::setOndragend):
-        (WebCore::SVGElementInstance::onreset):
-        (WebCore::SVGElementInstance::setOnreset):
-        (WebCore::SVGElementInstance::onresize):
-        (WebCore::SVGElementInstance::setOnresize):
-        (WebCore::SVGElementInstance::onscroll):
-        (WebCore::SVGElementInstance::setOnscroll):
-        (WebCore::SVGElementInstance::onsearch):
-        (WebCore::SVGElementInstance::setOnsearch):
-        (WebCore::SVGElementInstance::onselect):
-        (WebCore::SVGElementInstance::setOnselect):
-        (WebCore::SVGElementInstance::onselectstart):
-        (WebCore::SVGElementInstance::setOnselectstart):
-        (WebCore::SVGElementInstance::onsubmit):
-        (WebCore::SVGElementInstance::setOnsubmit):
-        (WebCore::SVGElementInstance::onunload):
-        (WebCore::SVGElementInstance::setOnunload):
-        * svg/SVGElementInstance.h:
-        (WebCore::SVGElementInstance::needsUpdate):
-        (WebCore::SVGElementInstance::toNode):
-        (WebCore::SVGElementInstance::toSVGElementInstance):
-        (WebCore::SVGElementInstance::correspondingElement):
-        (WebCore::SVGElementInstance::correspondingUseElement):
-        (WebCore::SVGElementInstance::shadowTreeElement):
-        (WebCore::SVGElementInstance::parentNode):
-        (WebCore::SVGElementInstance::previousSibling):
-        (WebCore::SVGElementInstance::nextSibling):
-        (WebCore::SVGElementInstance::firstChild):
-        (WebCore::SVGElementInstance::lastChild):
-        (WebCore::SVGElementInstance::ownerDocument):
-        (WebCore::SVGElementInstance::hasChildNodes):
-        (WebCore::SVGElementInstance::setFirstChild):
-        (WebCore::SVGElementInstance::setLastChild):
-        (WebCore::SVGElementInstance::setNextSibling):
-        (WebCore::SVGElementInstance::setPreviousSibling):
-        (WebCore::SVGElementInstance::refEventTarget):
-        (WebCore::SVGElementInstance::derefEventTarget):
-        * svg/SVGElementInstance.idl:
-        * svg/SVGStyledElement.cpp:
-        (WebCore::SVGStyledElement::svgAttributeChanged):
-        (WebCore::SVGStyledElement::childrenChanged):
-        * svg/SVGUseElement.cpp:
-        (WebCore::SVGUseElement::svgAttributeChanged):
-        (WebCore::shadowTreeContainsChangedNodes):
-        (WebCore::SVGUseElement::recalcStyle):
-        (WebCore::dumpInstanceTree):
-        (WebCore::SVGUseElement::buildPendingResource):
-        (WebCore::SVGUseElement::buildInstanceTree):
-        (WebCore::SVGUseElement::transferEventListenersToShadowTree):
-        * svg/SVGUseElement.h:
-
-2008-10-08  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Cameron Zwarich.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21241
-        REGRESSION (r36977): getRGBColorValue().red returning incorrect value
-
-        Update JSRGBColor to use the new static function per getter approach.
-
-        Test: fast/dom/css-RGBValue.html
-
-        * bindings/js/JSRGBColor.cpp:
-        (WebCore::):
-        (jsRGBColorRed):
-        (jsRGBColorGreen):
-        (jsRGBColorBlue):
-        * bindings/js/JSRGBColor.h:
-
-2008-10-08  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Darin Adler, Nikolas Zimmermann and Dave Hyatt.
-
-        svgElement.className.baseValue = "foo" does not work
-        https://bugs.webkit.org/show_bug.cgi?id=20651
-
-        * dom/StyledElement.cpp:
-        (WebCore::StyledElement::classAttributeChanged):
-        (WebCore::StyledElement::parseMappedAttribute):
-        * dom/StyledElement.h:
-        * svg/SVGStyledElement.cpp:
-        (WebCore::SVGStyledElement::svgAttributeChanged):
-
-2008-10-08  Anthony Ricaud  <rik24d@gmail.com>
-
-        Make the toolbar label text-shadow not disappear when clicking on the
-        search result count or around the search field.
-
-        Reviewed by Timothy Hatcher.
-
-        * inspector/front-end/inspector.css:
-        (.toolbar-item:active .toolbar-label): Make this rule also require the
-        toggleable class with the toolbar-item class.
-
-2008-10-08  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon.
-
-        Updated the qrc file for the Web Inspector to contain the current set
-        of images.
-
-        * inspector/front-end/WebKit.qrc:
-
-2008-10-08  Prasanth Ullattil  <pullatti@trolltech.com>
-
-        Reviewed by Simon.
-
-        Fix the linking of applications against WebKit on Qt/Windows.
-
-        The prl files that qmake creates are buggy on Unix, but we they're
-        fine on Windows and we have to have them there in order to get the
-        dependencies correct.
-
-        * WebCore.pro:
-
-2008-10-08  Ariya Hidayat  <ariya.hidayat@trolltech.com>
-
-        Reviewed by Simon.
-
-        Speed up rectangle filling by not re-creating a QBrush all the time.
-
-        This triggers faster path in QPainter where the brush is reused.
-
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
-        (WebCore::GraphicsContext::fillRect):
-
-2008-10-08  Thiago Macieira  <thiago.macieira@nokia.com>
-
-        Reviewed by Simon.
+        * WebCoreSources.bkl:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLDataGridColElement.cpp:
+        (WebCore::HTMLDataGridColElement::primary):
+        (WebCore::HTMLDataGridColElement::setPrimary):
+        * html/HTMLDataGridColElement.h:
+        * html/HTMLDataGridColElement.idl:
+        * html/HTMLDataGridElement.cpp:
+        (WebCore::HTMLDataGridElement::checkDTD):
+        (WebCore::HTMLDataGridElement::multiple):
+        (WebCore::HTMLDataGridElement::setMultiple):
+        * html/HTMLDataGridElement.h:
+        * html/HTMLDataGridElement.idl:
+        * html/HTMLDataGridRowElement.cpp: Added.
+        (WebCore::HTMLDataGridRowElement::HTMLDataGridRowElement):
+        (WebCore::HTMLDataGridRowElement::selected):
+        (WebCore::HTMLDataGridRowElement::setSelected):
+        (WebCore::HTMLDataGridRowElement::focused):
+        (WebCore::HTMLDataGridRowElement::setFocused):
+        * html/HTMLDataGridRowElement.h: Added.
+        (WebCore::HTMLDataGridRowElement::tagPriority):
+        * html/HTMLDataGridRowElement.idl: Added.
+        * html/HTMLTagNames.in:
 
-        Fixes: Encoding of Qt URLs
+2009-06-19  Yael Aharon <yael.aharon@nokia.com>
 
-        This encoding was added by Simon and I because QUrl's
-        tolerant parser wasn't tolerant enough. Now it is, so we don't need
-        this anymore.
+        Reviewed by Holger Freyther.
 
-        * platform/qt/KURLQt.cpp:
-        (WebCore::KURL::operator QUrl):
+        https://bugs.webkit.org/show_bug.cgi?id=26556
 
-2008-10-08  Marius Storm-Olsen  <marius@trolltech.com>
+        Fix a crash in case that the QNetworkReply::readReady signal is
+        "stuck" in deferred mode due to JavaScript alert, and in the meantime,
+        QNetworkreply::finished signal is received and processed before
+        QNetworkReply::readReady is processed.
 
-        Reviewed by Simon.
+        * manual-tests/qt/unload-alert.html: Added.
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::setLoadMode):
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::start):
+        (WebCore::QNetworkReplyHandler::sendQueuedItems):
+        * platform/network/qt/QNetworkReplyHandler.h:
+        (WebCore::QNetworkReplyHandler::):
 
-        Fixes dependencies in qmake generated visual studio projects.
+2009-06-22  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
-        Only add debug lib name if we're in the debug build_pass, else the release version.
-        The MSVC solution generator would pick up the debug javascriptcore lib as a dependency.
+        Fix the Qt build.
 
         * WebCore.pro:
 
-2008-10-08  Prasanth Ullattil  <pullatti@trolltech.com>
-
-        Reviewed by Simon.
-
-        Fix compilation errors on VS2008 64Bit
-
-        * platform/text/TextStream.cpp:
-        (WebCore::TextStream::operator<<):
-        * platform/text/TextStream.h:
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::init):
-
-2008-10-07  Alp Toker  <alp@nuanti.com>
-
-        GTK+ build fix for older automake versions (1.7). Discussed in bug
-        #21392.
-
-        * GNUmakefile.am:
-
-2008-10-07  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Antti Koivisto.
-
-        <rdar://problem/6273887> Crash in ApplicationCacheGroup
-        
-        Make sure to stop loading even before a cache update is in progress so that the
-        manifest load will be stopped.
-
-        * loader/appcache/ApplicationCacheGroup.cpp:
-        (WebCore::ApplicationCacheGroup::~ApplicationCacheGroup):
-        (WebCore::ApplicationCacheGroup::stopLoading):
-        (WebCore::ApplicationCacheGroup::cacheUpdateFailed):
-
-2008-10-07  Timothy Hatcher  <timothy@apple.com>
-
-        Auto-generate DOMDocument's createNodeIterator: and createTreeWalker: methods.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21433
+2009-06-21  Darin Adler  <darin@apple.com>
 
         Reviewed by Sam Weinig.
 
-        * WebCore.xcodeproj/project.pbxproj: Add ObjCNodeFilterCondition.{mm,h}.
-        * bindings/objc/DOM.mm: Remove previous category implementations
-        on DOMDocument for createNodeIterator: and createTreeWalker:. Also
-        moves ObjCNodeFilterCondition to its own file.
-        * bindings/objc/DOMTraversal.h: Remove the category methods that added
-        createNodeIterator: and createTreeWalker: to DOMDocument. This is fine
-        to do since DOmDocument.h is included still, and has these methods.
-        * bindings/objc/DOMUtility.mm:
-        (JSC::createDOMWrapper): Remove special case for JSNodeIterator and
-        JSTreeWalker now that the ObjC binding conforms to the standard wrap.
-        * bindings/objc/ObjCNodeFilterCondition.h: Split out from DOM.mm.
-        (WebCore::ObjCNodeFilterCondition::create): Moved from DOM.mm.
-        (WebCore::ObjCNodeFilterCondition::ObjCNodeFilterCondition): Ditto.
-        * bindings/objc/ObjCNodeFilterCondition.mm: Split out from DOM.mm.
-        (WebCore::ObjCNodeFilterCondition::acceptNode): Moved from DOM.mm.
-        * bindings/objc/PublicDOMInterfaces.h: Add the createNodeIterator: and
-        createTreeWalker: methods to DOMDocument.
-        * bindings/scripts/CodeGeneratorObjC.pm:
-        (GetObjCTypeGetter): Add a case for NodeFilter.
-        (AddIncludesForType): Include ObjCNodeFilterCondition.h for NodeFilter.
-        (GenerateImplementation): Remove existing NodeFilter special case that
-        used the m_filter member variable. Add a new special getter for protocol
-        types that aren't EventTarget, so the right class is used for NodeFilter.
-        Add a special case for NodeFilter where it creates an ObjCNodeFilterCondition.
-        * dom/Document.idl: Remove the #ifdef LANGUAGE_OBJECTIVE_C. Add the
-        OldStyleObjC extended attribute to createNodeIterator and createTreeWalker.
-        Rename the entityReferenceExpansion parameter to expandEntityReferences to
-        match the previous ObjC API.
-        * dom/NodeIterator.idl: Remove ObjCIvar from the filter attribute. The
-        m_filter member variable was never used in practice, it was always nil!
-        We can remove it and not pad the object because this can't be subclassed.
-        * dom/TreeWalker.idl: Ditto.
-
-2008-10-07  Timothy Hatcher  <timothy@apple.com>
-
-        Auto-generate the DOMEventTarget protocol implementation for
-        DOMNode and DOMSVGElementInstance.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21432
-
-        Reviewed by Darin Adler.
-
-        * WebCore.xcodeproj/project.pbxproj: Add ObjCEventListener.{mm,h}.
-        * bindings/objc/DOM.mm: Remove many unneeded header includes. Move
-        ObjCEventListener to it's own file. Remove the manual impelmentations
-        of the DOMEventTarget protocol for DOMNode and DOMSVGElementInstance.
-        * bindings/objc/DOMEvents.h: Remove the categories that defined
-        DOMEventTarget for DOMNode and DOMSVGElementInstance.
-        * bindings/objc/ObjCEventListener.h: Split out from DOM.mm.
-        * bindings/objc/ObjCEventListener.mm: Split out from DOM.mm.
-        (WebCore::ObjCEventListener::find): Moved from DOM.mm.
-        (WebCore::ObjCEventListener::wrap): Use PassRefPtr to prevent the
-        callers from doing a manual deref.
-        (WebCore::ObjCEventListener::ObjCEventListener): Moved from DOM.mm.
-        (WebCore::ObjCEventListener::~ObjCEventListener): Ditto.
-        * bindings/scripts/CodeGeneratorObjC.pm:
-        (GetObjCTypeGetter): Add a case for EventListener and use WTF::getPtr.
-        (AddIncludesForType): Include ObjCEventListener.h for EventListener.
-        And include EventTargetSVGElementInstance.h for SVGElementInstance.
-        (GenerateHeader): Remove the check for multiple parents.
-        (GenerateImplementation): Remove the check for multiple parents. Remove
-        the @deprecatedFunctions array since deprecated methods get generated
-        into the main @interface now to work with protocols. Add support
-        for the EventTargetNodeCast extended attribute. Add support for
-        EventListener parameters.
-        * dom/Node.idl: Define superclasses for ObjC so the implementation
-        and interface implement the DOMEventTarget protocol. Explicitly
-        specify Object as a superclass to use DOMEventTarget. Object will turn
-        into DOMObject. This is needed to take the code generator down the right
-        path of multiple super-classes as protocols. It is ObjC only for legacy
-        reasons. The event target methods are normally on NodeEventTarget, a
-        subclass of Node. But the ObjC API has never has this subclass and
-        they are on DOMNode.
-        * svg/SVGElementInstance.idl: Ditto.
-
-2008-10-07  David Hyatt  <hyatt@apple.com>
-
-        Add new pseudo-elements and pseudo-classes that will enable scrollbars to be styled by CSS.
-
-        The new pseudo-elements are:
-            scrollbar
-            scrollbar-button
-            scrollbar-corner
-            scrollbar-thumb
-            scrollbar-track
-        
-        These elements will work with all the usual pseudo-classes (:hover, :active, :enabled, :disabled, etc.) and with
-        the following new pseudo-classes:
-            scrollbar-active
-            scrollbar-back
-            scrollbar-forward
-            scrollbar-horizontal
-            scrollbar-vertical
-        
-        Reviewed by Adele
-
-        * css/CSSSelector.cpp:
-        (WebCore::CSSSelector::extractPseudoType):
-        * css/CSSSelector.h:
-        (WebCore::CSSSelector::):
-
-2008-10-06  Timothy Hatcher  <timothy@apple.com>
-
-        Add support to the Resources panel for queries like "#123", "foo #123",
-        "line: 123" and "foo line: 123". These will match the query limiting
-        the search only to the line specified. If only a line is specified,
-        the whole line is matched.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21422
-
-        Reviewed by Darin Adler.
-
-        * inspector/front-end/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype.sourceRow): Don't return the last
-        row if the index is greater than the rows collection. Let it return
-        undefined by indexing out-of-bounds.
-        * inspector/front-end/SourceView.js:
-        (WebInspector.SourceView.prototype.performSearch): Add support for
-        queries like "#123", "foo #123", "line: 123" and "foo line: 123".
-        Also match the whole query to the whole document in case there are
-        colors like "#333".
-
-2008-10-07  Alp Toker  <alp@nuanti.com>
-
-        Reviewed by Mark Rowe.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21392
-        [GTK] Auto-generate JS DOM binding sources list
-
-        Remove the huge lists of generated DOM binding sources and headers in
-        the build system. These are difficult to maintain and can be derived
-        automatically.
-
-        The new strategy is to re-use the existing lists of IDL sources (which
-        are needed for dist support anyway). This will also ease the addition
-        of new language bindings.
-
-        * GNUmakefile.am:
-
-2008-10-07  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon.
-
-        Don't attempt to paint when updating control tints
-
-        We don't have a valid PlatformGraphicsContext so schedule
-        the dirty scrollbar/scrollview area for repaint instead.
-
-        * platform/qt/ScrollbarThemeQt.cpp:
-        (WebCore::ScrollbarThemeQt::paint):
-        (WebCore::ScrollbarThemeQt::paintScrollCorner):
-
-2008-10-07  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        [qt] Build fix after Scrollbar.h and Widget.h changes.
-
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::init):
-
-2008-10-06  David Hyatt  <hyatt@apple.com>
-
-        Enable viewless Mac WebKit to (kinda sorta) paint basic pages (with no frames on them).
-
-        Reviewed by Sam Weinig
-
-        * WebCore.base.exp:
-        * WebCore.xcodeproj/project.pbxproj:
-        * loader/EmptyClients.h:
-        (WebCore::EmptyFrameLoaderClient::hasWebView):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::loadWithDocumentLoader):
-        (WebCore::FrameLoader::transitionToCommitted):
-        * loader/FrameLoaderClient.h:
-        * page/FocusController.cpp:
-        (WebCore::FocusController::setActive):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::FrameView):
-        (WebCore::FrameView::init):
-        (WebCore::FrameView::layoutIfNeededRecursive):
-        * page/FrameView.h:
+        Bug 25425: DOM attribute getter/setter functions should use const AtomicString& type
+        https://bugs.webkit.org/show_bug.cgi?id=25425
 
-2008-10-06  Dan Bernstein  <mitz@apple.com>
+        * bindings/scripts/CodeGeneratorJS.pm: Tweaked mechanism for includes to be a bit
+        more consistent and to make SVGElement.h be included in the header rather than in
+        every implementation file that includes the header. Added code to use getAttribute
+        and setAttribute directly when the [Reflect] extended attribute is used.
 
-        - build fix
+        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
 
-        * bindings/objc/DOMEvents.h:
+        * html/HTMLElement.idl: Used [Reflect] for all the attributes in this class that
+        reflect content attributes. Restricting this to one class for now to keep the
+        patch small and start out slowly.
 
-2008-10-06  Mark Mentovai  <mark@moxienet.com>
+2009-06-21  Sam Weinig  <sam@webkit.org>
 
-        Reviewed by Tim Hatcher.
+        Reviewed by Oliver Hunt.
 
-        Use #if ENABLE(feature) where possible, and #if ENABLE_feature where
-        Platform.h is not available, in preference to #ifdef ENABLE_feature.
-        #ifdef is wrong now that features are disabled by #defining
-        ENABLE_feature to 0.
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26596
+        Only expose event handler attributes to elements and documents.
 
-        https://bugs.webkit.org/show_bug.cgi?id=21338
+        Test: fast/dom/event-attribute-availability.html
 
-        * bindings/objc/DOMEvents.h:
-        * bindings/objc/PublicDOMInterfaces.h:
         * dom/Document.idl:
-        * page/DOMWindow.idl:
-        * svg/svgtags.in:
-
-2008-10-06  Mark Mentovai  <mark@moxienet.com>
-
-        Reviewed by Sam Weinig.
-
-        * platform/network/mac/FormDataStreamMac.mm: #import <wtf/Threading.h>
-        to get the declaration for isMainThread().
-
-2008-10-06  Jeremy Moskovich  <jeremy@chromium.org>
-
-        Reviewed by Tim Hatcher.
-
-        WebCoreObjCExtras.c is actually an obj-c++ file, so change its name
-        to reflect that.
+        * dom/Element.idl:
+        * dom/Node.cpp:
+        * dom/Node.h:
+        * dom/Node.idl:
 
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/mac/WebCoreObjCExtras.c: Removed.
-        * platform/mac/WebCoreObjCExtras.mm: Copied from WebCore/platform/mac/WebCoreObjCExtras.c.
+2009-06-21  Daniel Bates  <dbates@intudata.com>
 
-2008-10-06  Jeremy Moskovich  <jeremy@chromium.org>
+        Reviewed by Adam Barth.
 
-        Reviewed by Dan Bernstein.
+        https://bugs.webkit.org/show_bug.cgi?id=26580
         
-        Added C++ forward declaration for the NSURLAuthenticationChallenge class
-        so that the m_currentMacChallenge variable doesn't cause a
-        compilation error when ResourceHandleInternal.h is included from a C++ file.
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=21411
-
-        * platform/network/ResourceHandleInternal.h:
-
-2008-10-06  Steve Falkenburg  <sfalken@apple.com>
-
-        Windows build fix.
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2008-10-06  Steve Falkenburg  <sfalken@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21416
-        Add missing null checks identified by Application Verifier.
+        Fix to enable XSSAuditor on child windows.
         
-        Reviewed by Darin Adler.
-
-        * platform/win/SharedTimerWin.cpp:
-        (WebCore::clearTimer):
-
-2008-10-06  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        Removed accidentally left in debugging statement.
-
-        * inspector/front-end/inspector.js:
-
-2008-10-06  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Tim Hatcher and Oliver Hunt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21412
-        Bug 21412: Refactor user initiated profile count to be more stable
-
-        * inspector/InspectorController.cpp: Keep track of the user-initiated
-        profiles here now.
-        (WebCore::InspectorController::InspectorController):
-        (WebCore::InspectorController::startUserInitiatedProfiling):
-        (WebCore::InspectorController::stopUserInitiatedProfiling):
-        * inspector/InspectorController.h:
-        The front end will now need to check for the existence of the user-
-        initiated profile title and use its count instead of keeping its own.
-        * inspector/front-end/ProfilesPanel.js:
-
-2008-10-06  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - separate GDI text drawing into its own function
-
-        * platform/graphics/win/FontCGWin.cpp:
-        (WebCore::drawGDIGlyphs):
-        (WebCore::Font::drawGlyphs):
-
-2008-10-03  Steve Falkenburg  <sfalken@apple.com>
-
-        <rdar://problem/6249833> Fix default button appearance
+        Test: http/tests/security/xssAuditor/link-opens-new-window.html
         
-        Reviewed by Adele Peterson.
-
-        * rendering/RenderThemeWin.cpp:
-        (WebCore::RenderThemeWin::supportsFocus):
-        (WebCore::RenderThemeWin::determineClassicState):
-        (WebCore::RenderThemeWin::determineButtonState):
-        (WebCore::RenderThemeWin::getClassicThemeData):
-        (WebCore::RenderThemeWin::getThemeData):
-        (WebCore::drawControl):
-        * rendering/RenderThemeWin.h:
-
-2008-10-06  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon.
-
-        Add native virtual keycode to PlatformKeyboardEvent
-
-        * platform/PlatformKeyboardEvent.h:
-        * platform/gtk/KeyEventGtk.cpp:
-        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
-        * platform/mac/KeyEventMac.mm:
-        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
-        * platform/qt/PlatformKeyboardEventQt.cpp:
-        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
-        * platform/win/KeyEventWin.cpp:
-        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
-        * platform/wx/KeyboardEventWx.cpp:
-        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
-
-2008-10-06  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon.
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::XSSAuditor):
+        (WebCore::XSSAuditor::isEnabled):
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        * page/XSSAuditor.h: Removed method setXSSAuditorEnabled, and field m_isEnabled.
+        Moved implementation of isEnabled to XSSAuditor.cpp and changed implementation
+        to query Settings.
 
-        Enable WebCore::String <> CFStringRef conversion functions for QtWebKit/Mac
-
-        * platform/text/PlatformString.h:
-        * platform/text/StringImpl.h:
-        * platform/text/cf/StringCF.cpp:
-        * platform/text/cf/StringImplCF.cpp:
-
-2008-10-06  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon.
-
-        Use bundles on QtWebKit/Mac for platform modules
-
-        * platform/FileSystem.h:
-        * platform/qt/FileSystemQt.cpp:
-        (WebCore::unloadModule):
-
-2008-10-06  Ariya Hidayat  <ariya.hidayat@trolltech.com>
-
-        Reviewed by Simon.
-
-        Build fix for MinGW.
-
-        * platform/win/SystemTimeWin.cpp:
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::invalidateRect):
+2009-06-21  David Levin  <levin@chromium.org>
 
-2008-10-06  Adam Roben  <aroben@apple.com>
+        Reviewed by NOBODY.
 
-        Mimic the inspector/ directory structure in WebCore.vcproj
+        Speculative windows build fix (idea by Mark Rowe).
 
         * WebCore.vcproj/WebCore.vcproj:
 
-2008-10-06  Adam Roben  <aroben@apple.com>
-
-        Windows build fix
-
-        * WebCore.vcproj/WebCore.vcproj: Update the Include path for all
-        configurations to include WebCore/inspector.
-
-2008-10-04  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        SVG should support ascent and descent properties <font-face> instead of <font>!
-        https://bugs.webkit.org/show_bug.cgi?id=21365
-        
-        Tested by many many existing SVG tests.
-
-        * svg/SVGFontFaceElement.cpp:
-        (WebCore::SVGFontFaceElement::ascent):
-        (WebCore::SVGFontFaceElement::descent):
-
-2008-10-05  Darin Fisher  <darin@chromium.org>
-
-        Reviewed by Eric Seidel.
-
-        REGRESSION: crash in ScriptElement::notifyFinished
-        Fixes https://bugs.webkit.org/show_bug.cgi?id=21329
-
-        * dom/ScriptElement.cpp:
-        (WebCore::ScriptElementData::notifyFinished): Revert part of r35744 to
-        ensure that the ScriptElementData object is not destroyed prematurely.
-
-2008-10-05  Chris Lord  <chris@openedhand.com>
-
-        Reviewed by Alp Toker. Landed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20624
-        WebKit-gtk uses deprecated GtkType/GtkObject
-
-        * plugins/gtk/gtk2xtbin.c:
-        (gtk_xtbin_get_type):
-        * plugins/gtk/gtk2xtbin.h:
-
-2008-10-05  Luke Kenneth Casson Leighton  <lkcl@lkcl.net>
-
-        Reviewed by David Hyatt.
-
-        GTK_WINDOW_HWND not GTK_WINDOWING_HWND
-        https://bugs.webkit.org/show_bug.cgi?id=20725
+2009-06-21  David Levin  <levin@chromium.org>
 
-        Updated to ToT by Jan Alonzo.
-
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::getValue):
-
-2008-10-05  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Invalid cast from GdkWindow to GtkWidget
-        https://bugs.webkit.org/show_bug.cgi?id=21391
-
-        Fix a misplaced closing parenthesis to actually cast the widget, not the window
-
-        * platform/gtk/PlatformScreenGtk.cpp:
-        (WebCore::screenDepth):
-
-2008-10-05  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Darin Alder.
-
-        Attach the Origin header to POST requests to help defend against
-        cross-site request forgery.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20792
-
-        Collin Jackson <collinj@webkit.org> also contributed to this patch.
-
-        Tests: http/tests/security/originHeader/origin-header-for-data.html
-               http/tests/security/originHeader/origin-header-for-empty.html
-               http/tests/security/originHeader/origin-header-for-get.html
-               http/tests/security/originHeader/origin-header-for-https.html
-               http/tests/security/originHeader/origin-header-for-post.html
-
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::createWindow):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::createWindow):
-        (WebCore::FrameLoader::urlSelected):
-        (WebCore::FrameLoader::submitForm):
-        (WebCore::FrameLoader::outgoingOrigin):
-        (WebCore::FrameLoader::loadURL):
-        (WebCore::FrameLoader::addExtraFieldsToRequest):
-        (WebCore::FrameLoader::loadPostRequest):
-        (WebCore::FrameLoader::loadResourceSynchronously):
-        (WebCore::FrameLoader::loadItem):
-        * loader/FrameLoader.h:
-        * loader/SubresourceLoader.cpp:
-        (WebCore::SubresourceLoader::create):
-        * loader/loader.cpp:
-        (WebCore::Loader::Host::servePendingRequests):
-        * platform/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::toHTTPOrigin):
-        * platform/SecurityOrigin.h:
-        * platform/network/ResourceRequestBase.h:
-        (WebCore::ResourceRequestBase::httpOrigin):
-        (WebCore::ResourceRequestBase::setHTTPOrigin):
-        (WebCore::ResourceRequestBase::clearHTTPOrigin):
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::makeSimpleCrossSiteAccessRequest):
-        (WebCore::XMLHttpRequest::makeCrossSiteAccessRequestWithPreflight):
-        (WebCore::XMLHttpRequest::handleAsynchronousPreflightResult):
-        (WebCore::XMLHttpRequest::didReceiveResponsePreflight):
-
-2008-10-04  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        Bug 21381: Incremental parsing of html causes bogus line numbers in some cases
-        <https://bugs.webkit.org/show_bug.cgi?id=21381>
-
-        If we hit a parsing boundary (end of a packet, etc) in the middle of a
-        <script> element when we are doing an incremental parse, we exit the
-        parser, and reenter later when more data is available.  During this
-        reentry we incorrectly reset the scriptStartLineno to the current line
-        in the parser, which is now part way through the script element.
-
-        The solution is to track whether we are entering or reentering the parsing
-        of a script element.  We do this simply by 0 checking scriptStartLineno,
-        and resetting it after we complete parsing of each script element. 
-
-        Test: http/tests/incremental/pause-in-script-element.pl
-
-        * ChangeLog:
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::parseSpecial):
-        (WebCore::HTMLTokenizer::scriptHandler):
-
-2008-10-04  Alp Toker  <alp@nuanti.com>
-
-        Reviewed by David Hyatt. Landed by Jan Alonzo.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20924
-        [Gtk] Linux/Gtk: Recent tree revisions fail Acid2 and Acid3
-
-        https://bugs.webkit.org/show_bug.cgi?id=19578
-        [CURL] problem in parseDataUrl
-
-        De-obfuscate parseDataUrl() and fix regressions introduced in r35954.
-        This patch also fixes encoding support in escaped (non-Base64) data
-        URLs. All manual data URL tests now pass in both GLib and non-GLib
-        code paths.
-
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::parseDataUrl):
-
-2008-10-04  Timothy Hatcher  <timothy@apple.com>
-
-        Makes breakpoints and debugging code during page load work in the
-        Web Inspector's debugger. Specifically, this makes the source
-        code for loading resources show up in the Scripts panel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=19053
-        rdar://problem/5933408
-
-        Reviewed by Mark Rowe.
-
-        * WebCore.xcodeproj/project.pbxproj: Mark the inspector group as
-        not using tabs and a tab width of 8.
-        * inspector/InspectorController.cpp:
-        (WebCore::addResourceSourceToFrame): Return a bool to report if the
-        source was added successfully or not.
-        (WebCore::addSourceToFrame): Ditto.
-        * inspector/front-end/ScriptView.js:
-        (WebInspector.ScriptView.prototype.setupSourceFrameIfNeeded):
-        Return early if the InspectorController.addSourceToFrame fails.
-        Moved the delete of the _frameNeedsSetup property after that call so
-        if the source wasn't added it will be attempted again.
-        * inspector/front-end/SourceView.js:
-        (WebInspector.SourceView.prototype.detach): Move a comment.
-        (WebInspector.SourceView.prototype.setupSourceFrameIfNeeded):
-        Don't check if the resource is finished or failed, just attempt
-        to add the source to the frame. WebCore has the source, but the
-        finished property hasn't been set yet. Return early if the
-        InspectorController.addSourceToFrame fails. Moved the delete
-        of the _frameNeedsSetup property after that call so if the source
-        wasn't added it will be attempted again.
-        (WebInspector.SourceView.prototype._resourceLoadingFinished):
-        Clear the _frameNeedsSetup and _sourceFrameSetup properties so
-        the source frame will we populated again now that the resource
-        load has finished.
-        * manual-tests/inspector/debugger-pause-during-load.html: Added.
-
-2008-10-04  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        Add a 'Check For Weak VTables' build phase to catch weak vtables as early as possible.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2008-10-04  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21373
-
-        Tear down scrollbars in FrameView rather than ScrollView so that the connection to the hostWindow()
-        is still present.
-
-        Reviewed by Mark Rowe
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::~FrameView):
-
-2008-10-04  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Avoid copying a Vector when using getSupportedKeySizes.
-
-        * html/HTMLKeygenElement.cpp:
-        (WebCore::HTMLKeygenElement::HTMLKeygenElement):
-        * platform/SSLKeyGenerator.h:
-        * platform/gtk/TemporaryLinkStubs.cpp:
-        (WebCore::getSupportedKeySizes):
-        * platform/mac/SSLKeyGeneratorMac.mm:
-        (WebCore::getSupportedKeySizes):
-        * platform/qt/TemporaryLinkStubs.cpp:
-        (WebCore::getSupportedKeySizes):
-        * platform/win/TemporaryLinkStubs.cpp:
-        (WebCore::getSupportedKeySizes):
-        * platform/wx/TemporaryLinkStubs.cpp:
-        (WebCore::getSupportedKeySizes):
-
-2008-10-04  Darin Adler  <darin@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        - prepare for https://bugs.webkit.org/show_bug.cgi?id=21295
-          Bug 21295: Replace ExecState with a call frame Register pointer
-
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::allowsUnwrappedAccessFrom):
-        Remove bogus "const".
-        * bindings/js/JSQuarantinedObjectWrapper.h: Ditto.
-
-2008-10-04  David Hyatt  <hyatt@apple.com>
-
-        Make PopupMenuClient obey the platform abstraction.  Remove any connection to Document and RenderStyle.
-
-        Reviewed by Darin Adler
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/PopupMenuClient.h:
-        * platform/gtk/PopupMenuGtk.cpp:
-        (WebCore::PopupMenu::show):
-        * platform/mac/PopupMenuMac.mm:
-        (WebCore::PopupMenu::populate):
-        (WebCore::PopupMenu::show):
-        * platform/qt/PopupMenuQt.cpp:
-        (WebCore::PopupMenu::populate):
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::calculatePositionAndSize):
-        (WebCore::PopupMenu::paint):
-        (WebCore::PopupWndProc):
-        * rendering/RenderMenuList.cpp:
-        (WebCore::RenderMenuList::itemStyle):
-        (WebCore::RenderMenuList::menuStyle):
-        (WebCore::RenderMenuList::hostWindow):
-        * rendering/RenderMenuList.h:
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::itemStyle):
-        (WebCore::RenderTextControl::menuStyle):
-        (WebCore::RenderTextControl::hostWindow):
-        * rendering/RenderTextControl.h:
-
-2008-10-04  Matt Lilek  <webkit@mattlilek.com>
-
-        Build fix - restore Private role to headers that had it before the move.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2008-10-04  Darin Adler  <darin@apple.com>
-
-        - try to fix build
-
-        * DerivedSources.make: Add new inspector directory to VPATH.
-        * GNUmakefile.am: Add new inspector directory to includes.
-        Re-sort the IDL_BINDINGS list. Add new inspector directory
-        to VPATH.
-
-2008-10-04  Matt Lilek  <webkit@mattlilek.com>
-
-        Not reviewed, attempt to fix Gtk build.
-
-        * GNUmakefile.am:
-
-2008-10-03  Timothy Hatcher  <timothy@apple.com>
-
-        Move the Web Inspector files into a top-level "inspector" folder.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21359
-
-        Reviewed by Dave Hyatt.
+        Reviewed by NOBODY (Speculative gtk build fix).
 
         * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * inspector/InspectorClient.h: Renamed from WebCore/page/InspectorClient.h.
-        * inspector/InspectorController.cpp: Renamed from WebCore/page/InspectorController.cpp.
-        * inspector/InspectorController.h: Renamed from WebCore/page/InspectorController.h.
-        * inspector/JavaScriptCallFrame.cpp: Renamed from WebCore/page/JavaScriptCallFrame.cpp.
-        * inspector/JavaScriptCallFrame.h: Renamed from WebCore/page/JavaScriptCallFrame.h.
-        * inspector/JavaScriptCallFrame.idl: Renamed from WebCore/page/JavaScriptCallFrame.idl.
-        * inspector/JavaScriptDebugListener.h: Renamed from WebCore/page/JavaScriptDebugListener.h.
-        * inspector/JavaScriptDebugServer.cpp: Renamed from WebCore/page/JavaScriptDebugServer.cpp.
-        * inspector/JavaScriptDebugServer.h: Renamed from WebCore/page/JavaScriptDebugServer.h.
-        * inspector/JavaScriptProfile.cpp: Renamed from WebCore/page/JavaScriptProfile.cpp.
-        * inspector/JavaScriptProfile.h: Renamed from WebCore/page/JavaScriptProfile.h.
-        * inspector/JavaScriptProfileNode.cpp: Renamed from WebCore/page/JavaScriptProfileNode.cpp.
-        * inspector/JavaScriptProfileNode.h: Renamed from WebCore/page/JavaScriptProfileNode.h.
-        * inspector/front-end/Breakpoint.js: Renamed from WebCore/page/inspector/Breakpoint.js.
-        * inspector/front-end/BreakpointsSidebarPane.js: Renamed from WebCore/page/inspector/BreakpointsSidebarPane.js.
-        * inspector/front-end/CallStackSidebarPane.js: Renamed from WebCore/page/inspector/CallStackSidebarPane.js.
-        * inspector/front-end/Console.js: Renamed from WebCore/page/inspector/Console.js.
-        * inspector/front-end/DataGrid.js: Renamed from WebCore/page/inspector/DataGrid.js.
-        * inspector/front-end/Database.js: Renamed from WebCore/page/inspector/Database.js.
-        * inspector/front-end/DatabaseQueryView.js: Renamed from WebCore/page/inspector/DatabaseQueryView.js.
-        * inspector/front-end/DatabaseTableView.js: Renamed from WebCore/page/inspector/DatabaseTableView.js.
-        * inspector/front-end/DatabasesPanel.js: Renamed from WebCore/page/inspector/DatabasesPanel.js.
-        * inspector/front-end/ElementsPanel.js: Renamed from WebCore/page/inspector/ElementsPanel.js.
-        * inspector/front-end/ElementsTreeOutline.js: Renamed from WebCore/page/inspector/ElementsTreeOutline.js.
-        * inspector/front-end/FontView.js: Renamed from WebCore/page/inspector/FontView.js.
-        * inspector/front-end/ImageView.js: Renamed from WebCore/page/inspector/ImageView.js.
-        * inspector/front-end/Images/back.png: Renamed from WebCore/page/inspector/Images/back.png.
-        * inspector/front-end/Images/checker.png: Renamed from WebCore/page/inspector/Images/checker.png.
-        * inspector/front-end/Images/clearConsoleButtons.png: Renamed from WebCore/page/inspector/Images/clearConsoleButtons.png.
-        * inspector/front-end/Images/closeButtons.png: Renamed from WebCore/page/inspector/Images/closeButtons.png.
-        * inspector/front-end/Images/consoleButtons.png: Renamed from WebCore/page/inspector/Images/consoleButtons.png.
-        * inspector/front-end/Images/database.png: Renamed from WebCore/page/inspector/Images/database.png.
-        * inspector/front-end/Images/databaseTable.png: Renamed from WebCore/page/inspector/Images/databaseTable.png.
-        * inspector/front-end/Images/databasesIcon.png: Renamed from WebCore/page/inspector/Images/databasesIcon.png.
-        * inspector/front-end/Images/debuggerContinue.png: Renamed from WebCore/page/inspector/Images/debuggerContinue.png.
-        * inspector/front-end/Images/debuggerPause.png: Renamed from WebCore/page/inspector/Images/debuggerPause.png.
-        * inspector/front-end/Images/debuggerStepInto.png: Renamed from WebCore/page/inspector/Images/debuggerStepInto.png.
-        * inspector/front-end/Images/debuggerStepOut.png: Renamed from WebCore/page/inspector/Images/debuggerStepOut.png.
-        * inspector/front-end/Images/debuggerStepOver.png: Renamed from WebCore/page/inspector/Images/debuggerStepOver.png.
-        * inspector/front-end/Images/debuggingButtons.png: Renamed from WebCore/page/inspector/Images/debuggingButtons.png.
-        * inspector/front-end/Images/disclosureTriangleSmallDown.png: Renamed from WebCore/page/inspector/Images/disclosureTriangleSmallDown.png.
-        * inspector/front-end/Images/disclosureTriangleSmallDownBlack.png: Renamed from WebCore/page/inspector/Images/disclosureTriangleSmallDownBlack.png.
-        * inspector/front-end/Images/disclosureTriangleSmallDownWhite.png: Renamed from WebCore/page/inspector/Images/disclosureTriangleSmallDownWhite.png.
-        * inspector/front-end/Images/disclosureTriangleSmallRight.png: Renamed from WebCore/page/inspector/Images/disclosureTriangleSmallRight.png.
-        * inspector/front-end/Images/disclosureTriangleSmallRightBlack.png: Renamed from WebCore/page/inspector/Images/disclosureTriangleSmallRightBlack.png.
-        * inspector/front-end/Images/disclosureTriangleSmallRightDown.png: Renamed from WebCore/page/inspector/Images/disclosureTriangleSmallRightDown.png.
-        * inspector/front-end/Images/disclosureTriangleSmallRightDownBlack.png: Renamed from WebCore/page/inspector/Images/disclosureTriangleSmallRightDownBlack.png.
-        * inspector/front-end/Images/disclosureTriangleSmallRightDownWhite.png: Renamed from WebCore/page/inspector/Images/disclosureTriangleSmallRightDownWhite.png.
-        * inspector/front-end/Images/disclosureTriangleSmallRightWhite.png: Renamed from WebCore/page/inspector/Images/disclosureTriangleSmallRightWhite.png.
-        * inspector/front-end/Images/dockButtons.png: Renamed from WebCore/page/inspector/Images/dockButtons.png.
-        * inspector/front-end/Images/elementsIcon.png: Renamed from WebCore/page/inspector/Images/elementsIcon.png.
-        * inspector/front-end/Images/errorIcon.png: Renamed from WebCore/page/inspector/Images/errorIcon.png.
-        * inspector/front-end/Images/errorMediumIcon.png: Renamed from WebCore/page/inspector/Images/errorMediumIcon.png.
-        * inspector/front-end/Images/excludeButtons.png: Renamed from WebCore/page/inspector/Images/excludeButtons.png.
-        * inspector/front-end/Images/focusButtons.png: Renamed from WebCore/page/inspector/Images/focusButtons.png.
-        * inspector/front-end/Images/forward.png: Renamed from WebCore/page/inspector/Images/forward.png.
-        * inspector/front-end/Images/glossyHeader.png: Renamed from WebCore/page/inspector/Images/glossyHeader.png.
-        * inspector/front-end/Images/glossyHeaderPressed.png: Renamed from WebCore/page/inspector/Images/glossyHeaderPressed.png.
-        * inspector/front-end/Images/glossyHeaderSelected.png: Renamed from WebCore/page/inspector/Images/glossyHeaderSelected.png.
-        * inspector/front-end/Images/glossyHeaderSelectedPressed.png: Renamed from WebCore/page/inspector/Images/glossyHeaderSelectedPressed.png.
-        * inspector/front-end/Images/goArrow.png: Renamed from WebCore/page/inspector/Images/goArrow.png.
-        * inspector/front-end/Images/largerResourcesButtons.png: Renamed from WebCore/page/inspector/Images/largerResourcesButtons.png.
-        * inspector/front-end/Images/nodeSearchButtons.png: Renamed from WebCore/page/inspector/Images/nodeSearchButtons.png.
-        * inspector/front-end/Images/paneBottomGrow.png: Renamed from WebCore/page/inspector/Images/paneBottomGrow.png.
-        * inspector/front-end/Images/paneBottomGrowActive.png: Renamed from WebCore/page/inspector/Images/paneBottomGrowActive.png.
-        * inspector/front-end/Images/paneGrowHandleLine.png: Renamed from WebCore/page/inspector/Images/paneGrowHandleLine.png.
-        * inspector/front-end/Images/pauseOnExceptionButtons.png: Renamed from WebCore/page/inspector/Images/pauseOnExceptionButtons.png.
-        * inspector/front-end/Images/percentButtons.png: Renamed from WebCore/page/inspector/Images/percentButtons.png.
-        * inspector/front-end/Images/profileGroupIcon.png: Renamed from WebCore/page/inspector/Images/profileGroupIcon.png.
-        * inspector/front-end/Images/profileIcon.png: Renamed from WebCore/page/inspector/Images/profileIcon.png.
-        * inspector/front-end/Images/profileSmallIcon.png: Renamed from WebCore/page/inspector/Images/profileSmallIcon.png.
-        * inspector/front-end/Images/profilesIcon.png: Renamed from WebCore/page/inspector/Images/profilesIcon.png.
-        * inspector/front-end/Images/recordButtons.png: Renamed from WebCore/page/inspector/Images/recordButtons.png.
-        * inspector/front-end/Images/reloadButtons.png: Renamed from WebCore/page/inspector/Images/reloadButtons.png.
-        * inspector/front-end/Images/resourceCSSIcon.png: Renamed from WebCore/page/inspector/Images/resourceCSSIcon.png.
-        * inspector/front-end/Images/resourceDocumentIcon.png: Renamed from WebCore/page/inspector/Images/resourceDocumentIcon.png.
-        * inspector/front-end/Images/resourceDocumentIconSmall.png: Renamed from WebCore/page/inspector/Images/resourceDocumentIconSmall.png.
-        * inspector/front-end/Images/resourceJSIcon.png: Renamed from WebCore/page/inspector/Images/resourceJSIcon.png.
-        * inspector/front-end/Images/resourcePlainIcon.png: Renamed from WebCore/page/inspector/Images/resourcePlainIcon.png.
-        * inspector/front-end/Images/resourcePlainIconSmall.png: Renamed from WebCore/page/inspector/Images/resourcePlainIconSmall.png.
-        * inspector/front-end/Images/resourcesIcon.png: Renamed from WebCore/page/inspector/Images/resourcesIcon.png.
-        * inspector/front-end/Images/resourcesSizeGraphIcon.png: Renamed from WebCore/page/inspector/Images/resourcesSizeGraphIcon.png.
-        * inspector/front-end/Images/resourcesTimeGraphIcon.png: Renamed from WebCore/page/inspector/Images/resourcesTimeGraphIcon.png.
-        * inspector/front-end/Images/scriptsIcon.png: Renamed from WebCore/page/inspector/Images/scriptsIcon.png.
-        * inspector/front-end/Images/searchSmallBlue.png: Renamed from WebCore/page/inspector/Images/searchSmallBlue.png.
-        * inspector/front-end/Images/searchSmallBrightBlue.png: Renamed from WebCore/page/inspector/Images/searchSmallBrightBlue.png.
-        * inspector/front-end/Images/searchSmallGray.png: Renamed from WebCore/page/inspector/Images/searchSmallGray.png.
-        * inspector/front-end/Images/searchSmallWhite.png: Renamed from WebCore/page/inspector/Images/searchSmallWhite.png.
-        * inspector/front-end/Images/segment.png: Renamed from WebCore/page/inspector/Images/segment.png.
-        * inspector/front-end/Images/segmentEnd.png: Renamed from WebCore/page/inspector/Images/segmentEnd.png.
-        * inspector/front-end/Images/segmentHover.png: Renamed from WebCore/page/inspector/Images/segmentHover.png.
-        * inspector/front-end/Images/segmentHoverEnd.png: Renamed from WebCore/page/inspector/Images/segmentHoverEnd.png.
-        * inspector/front-end/Images/segmentSelected.png: Renamed from WebCore/page/inspector/Images/segmentSelected.png.
-        * inspector/front-end/Images/segmentSelectedEnd.png: Renamed from WebCore/page/inspector/Images/segmentSelectedEnd.png.
-        * inspector/front-end/Images/splitviewDimple.png: Renamed from WebCore/page/inspector/Images/splitviewDimple.png.
-        * inspector/front-end/Images/splitviewDividerBackground.png: Renamed from WebCore/page/inspector/Images/splitviewDividerBackground.png.
-        * inspector/front-end/Images/statusbarBackground.png: Renamed from WebCore/page/inspector/Images/statusbarBackground.png.
-        * inspector/front-end/Images/statusbarBottomBackground.png: Renamed from WebCore/page/inspector/Images/statusbarBottomBackground.png.
-        * inspector/front-end/Images/statusbarButtons.png: Renamed from WebCore/page/inspector/Images/statusbarButtons.png.
-        * inspector/front-end/Images/statusbarMenuButton.png: Renamed from WebCore/page/inspector/Images/statusbarMenuButton.png.
-        * inspector/front-end/Images/statusbarMenuButtonSelected.png: Renamed from WebCore/page/inspector/Images/statusbarMenuButtonSelected.png.
-        * inspector/front-end/Images/statusbarResizerHorizontal.png: Renamed from WebCore/page/inspector/Images/statusbarResizerHorizontal.png.
-        * inspector/front-end/Images/statusbarResizerVertical.png: Renamed from WebCore/page/inspector/Images/statusbarResizerVertical.png.
-        * inspector/front-end/Images/timelinePillBlue.png: Renamed from WebCore/page/inspector/Images/timelinePillBlue.png.
-        * inspector/front-end/Images/timelinePillGray.png: Renamed from WebCore/page/inspector/Images/timelinePillGray.png.
-        * inspector/front-end/Images/timelinePillGreen.png: Renamed from WebCore/page/inspector/Images/timelinePillGreen.png.
-        * inspector/front-end/Images/timelinePillOrange.png: Renamed from WebCore/page/inspector/Images/timelinePillOrange.png.
-        * inspector/front-end/Images/timelinePillPurple.png: Renamed from WebCore/page/inspector/Images/timelinePillPurple.png.
-        * inspector/front-end/Images/timelinePillRed.png: Renamed from WebCore/page/inspector/Images/timelinePillRed.png.
-        * inspector/front-end/Images/timelinePillYellow.png: Renamed from WebCore/page/inspector/Images/timelinePillYellow.png.
-        * inspector/front-end/Images/tipBalloon.png: Renamed from WebCore/page/inspector/Images/tipBalloon.png.
-        * inspector/front-end/Images/tipBalloonBottom.png: Renamed from WebCore/page/inspector/Images/tipBalloonBottom.png.
-        * inspector/front-end/Images/tipIcon.png: Renamed from WebCore/page/inspector/Images/tipIcon.png.
-        * inspector/front-end/Images/tipIconPressed.png: Renamed from WebCore/page/inspector/Images/tipIconPressed.png.
-        * inspector/front-end/Images/toolbarItemSelected.png: Renamed from WebCore/page/inspector/Images/toolbarItemSelected.png.
-        * inspector/front-end/Images/treeDownTriangleBlack.png: Renamed from WebCore/page/inspector/Images/treeDownTriangleBlack.png.
-        * inspector/front-end/Images/treeDownTriangleWhite.png: Renamed from WebCore/page/inspector/Images/treeDownTriangleWhite.png.
-        * inspector/front-end/Images/treeRightTriangleBlack.png: Renamed from WebCore/page/inspector/Images/treeRightTriangleBlack.png.
-        * inspector/front-end/Images/treeRightTriangleWhite.png: Renamed from WebCore/page/inspector/Images/treeRightTriangleWhite.png.
-        * inspector/front-end/Images/treeUpTriangleBlack.png: Renamed from WebCore/page/inspector/Images/treeUpTriangleBlack.png.
-        * inspector/front-end/Images/treeUpTriangleWhite.png: Renamed from WebCore/page/inspector/Images/treeUpTriangleWhite.png.
-        * inspector/front-end/Images/userInputIcon.png: Renamed from WebCore/page/inspector/Images/userInputIcon.png.
-        * inspector/front-end/Images/userInputPreviousIcon.png: Renamed from WebCore/page/inspector/Images/userInputPreviousIcon.png.
-        * inspector/front-end/Images/warningIcon.png: Renamed from WebCore/page/inspector/Images/warningIcon.png.
-        * inspector/front-end/Images/warningMediumIcon.png: Renamed from WebCore/page/inspector/Images/warningMediumIcon.png.
-        * inspector/front-end/Images/warningsErrors.png: Renamed from WebCore/page/inspector/Images/warningsErrors.png.
-        * inspector/front-end/MetricsSidebarPane.js: Renamed from WebCore/page/inspector/MetricsSidebarPane.js.
-        * inspector/front-end/Object.js: Renamed from WebCore/page/inspector/Object.js.
-        * inspector/front-end/ObjectPropertiesSection.js: Renamed from WebCore/page/inspector/ObjectPropertiesSection.js.
-        * inspector/front-end/Panel.js: Renamed from WebCore/page/inspector/Panel.js.
-        * inspector/front-end/Placard.js: Renamed from WebCore/page/inspector/Placard.js.
-        * inspector/front-end/ProfileView.js: Renamed from WebCore/page/inspector/ProfileView.js.
-        * inspector/front-end/ProfilesPanel.js: Renamed from WebCore/page/inspector/ProfilesPanel.js.
-        * inspector/front-end/PropertiesSection.js: Renamed from WebCore/page/inspector/PropertiesSection.js.
-        * inspector/front-end/PropertiesSidebarPane.js: Renamed from WebCore/page/inspector/PropertiesSidebarPane.js.
-        * inspector/front-end/Resource.js: Renamed from WebCore/page/inspector/Resource.js.
-        * inspector/front-end/ResourceCategory.js: Renamed from WebCore/page/inspector/ResourceCategory.js.
-        * inspector/front-end/ResourceView.js: Renamed from WebCore/page/inspector/ResourceView.js.
-        * inspector/front-end/ResourcesPanel.js: Renamed from WebCore/page/inspector/ResourcesPanel.js.
-        * inspector/front-end/ScopeChainSidebarPane.js: Renamed from WebCore/page/inspector/ScopeChainSidebarPane.js.
-        * inspector/front-end/Script.js: Renamed from WebCore/page/inspector/Script.js.
-        * inspector/front-end/ScriptView.js: Renamed from WebCore/page/inspector/ScriptView.js.
-        * inspector/front-end/ScriptsPanel.js: Renamed from WebCore/page/inspector/ScriptsPanel.js.
-        * inspector/front-end/SidebarPane.js: Renamed from WebCore/page/inspector/SidebarPane.js.
-        * inspector/front-end/SidebarTreeElement.js: Renamed from WebCore/page/inspector/SidebarTreeElement.js.
-        * inspector/front-end/SourceFrame.js: Renamed from WebCore/page/inspector/SourceFrame.js.
-        * inspector/front-end/SourceView.js: Renamed from WebCore/page/inspector/SourceView.js.
-        * inspector/front-end/StylesSidebarPane.js: Renamed from WebCore/page/inspector/StylesSidebarPane.js.
-        * inspector/front-end/TextPrompt.js: Renamed from WebCore/page/inspector/TextPrompt.js.
-        * inspector/front-end/View.js: Renamed from WebCore/page/inspector/View.js.
-        * inspector/front-end/WebKit.qrc: Renamed from WebCore/page/inspector/WebKit.qrc.
-        * inspector/front-end/inspector.css: Renamed from WebCore/page/inspector/inspector.css.
-        * inspector/front-end/inspector.html: Renamed from WebCore/page/inspector/inspector.html.
-        * inspector/front-end/inspector.js: Renamed from WebCore/page/inspector/inspector.js.
-        * inspector/front-end/treeoutline.js: Renamed from WebCore/page/inspector/treeoutline.js.
-        * inspector/front-end/utilities.js: Renamed from WebCore/page/inspector/utilities.js.
-
-2008-10-03  Timothy Hatcher  <timothy@apple.com>
-
-        Adds support to the Web Inspector's Elements panel for fast tag name,
-        class name, id and attribute name searching. The panel first tries
-        using getElementById, getElementsByClassName and getElementsByTagName
-        with the search query. Then does a slower search using XPath for partial
-        matches, text and comment matches.
-
-        Adds support for search queries like "<div>", "<h" and "frame>".
-        These forms limit the search to tag names, text and comment matches.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21353
-
-        Reviewed by Maciej Stachowiak.
-
-        * page/inspector/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype.performSearch): Add tag syntax
-        support. Add new search functions that try exact matches first.
-
-2008-10-03  Timothy Hatcher  <timothy@apple.com>
-
-        Changes how searching works in the Web Inspector's Elements
-        panel. The search tasks are divided into chunks that are small
-        units of work that are performed at a time interval. This
-        change also prevents queries that will select all elements,
-        since that isn't useful.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21285
-
-        Reviewed by Oliver Hunt.
-
-        * page/inspector/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype.searchCancled):
-        Remove the searchResultsProperty form results since there might
-        be an unfinished search.
-        (WebInspector.ElementsPanel.prototype.performSearch): Divide the
-        documents and search functions into chunks that are performed on
-        a interval of 25ms. Prevent searches for "//*" and "*".
-
-2008-10-03  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        - "this" object in methods called on primitives should be wrapper object
-        https://bugs.webkit.org/show_bug.cgi?id=21362
-
-        Updated so toThis conversion for the split window is handled properly.
-
-        * bindings/scripts/CodeGeneratorJS.pm:
-
-2008-10-03  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by David "The Motivator" Hyatt.
-
-        Patch for https://bugs.webkit.org/show_bug.cgi?id=21355
-        Move SecurityOrigin out of platform/ to page/.
-
-        It was a layering violation for SecurityOrigin to be in platform
-        as it depended on FrameLoader.
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * page/SecurityOrigin.cpp: Copied from platform/SecurityOrigin.cpp.
-        * page/SecurityOrigin.h: Copied from platform/SecurityOrigin.h.
-        * page/SecurityOriginHash.h: Copied from platform/SecurityOriginHash.h.
-        * platform/SecurityOrigin.cpp: Removed.
-        * platform/SecurityOrigin.h: Removed.
-        * platform/SecurityOriginHash.h: Removed.
-
-2008-10-03  Marco Barisione  <marco.barisione@collabora.co.uk>
-
-        Reviewed by Alp Toker.
-
-        http://bugs.webkit.org/show_bug.cgi?id=18832
-        [curl] file upload does not work
-
-        The curl_off_t integer type has a different size depending if large
-        file support is enabled or not. There is no different public API for
-        the two cases, so the same function accepts a different type based on
-        a compilation option the could be different in WebKit and libcurl.
-        To fix the bug we query libcurl at runtime for large file support and
-        pass the right type based on that.
-
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::ResourceHandleManager::setupPOST):
-
-2008-10-03  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by David Hyatt.
-
-        Gtk build fixes.
-
-        * platform/gtk/FileChooserGtk.cpp:
-        (WebCore::FileChooser::openFileChooser):
-        * platform/gtk/PlatformScreenGtk.cpp:
-        (WebCore::screenDepth):
-        (WebCore::screenDepthPerComponent):
-        (WebCore::screenAvailableRect):
-        * platform/gtk/PopupMenuGtk.cpp:
-        (WebCore::PopupMenu::show):
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::platformAddChild):
-        (WebCore::ScrollView::platformRemoveChild):
-        * platform/gtk/WidgetGtk.cpp:
-        (WebCore::Widget::setCursor):
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::forceRedraw):
-        (WebCore::PluginView::init):
-
-2008-10-03  David Hyatt  <hyatt@apple.com>
-
-        Fix Qt bustage from missing include.
-
-        * platform/qt/PlatformScreenQt.cpp:
-
-2008-10-03  David Hyatt  <hyatt@apple.com>
-
-        Fix Windows scrollbar bustage in popup menus.
-
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupWndProc):
-
-2008-10-03  David Hyatt  <hyatt@apple.com>
-
-        Fix Windows bustage.
-
-        * platform/win/FileChooserWin.cpp:
-        (WebCore::FileChooser::openFileChooser):
-        * platform/win/PlatformScreenWin.cpp:
-        (WebCore::monitorInfoForWidget):
-        * platform/win/WidgetWin.cpp:
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::forceRedraw):
-        (WebCore::PluginView::init):
-
-2008-10-03  Darin Adler  <darin@apple.com>
-
-        * bindings/js/JSInspectedObjectWrapper.cpp: Try to fix a build failure
-        seen on some machines but not others by adding an include.
-
-2008-10-03  Darin Adler  <darin@apple.com>
-
-        - Qt build fix
-
-        * bridge/qt/qt_runtime.cpp: Remove long-obsolete codeType and
-        execute functions. Declarations for these relied on the CodeType
-        enumeration, which used to be in ExecState.h; but the functions
-        aren't needed at all.
-        * bridge/qt/qt_runtime.h: Ditto.
-
-2008-10-03  Darin Adler  <darin@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        - next step of https://bugs.webkit.org/show_bug.cgi?id=21295
-          Turn ExecState into a call frame pointer.
-
-        Remove m_globalObject and m_globalData from ExecState.
-
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData):
-        Removed an argument now that JSGlobalObject doesn't need it any more.
-        (WebCore::JSDOMWindowBase::JSDOMWindowBase): Removed the argument from
-        the JSDOMWindowBaseData constructor, and added the this argument to the
-        JSGlobalObject constructor. This is because a couple key bits of
-        initialization moved from the data constructor to the JSGlobalObject
-        constructor.
-        * bindings/js/JSDOMWindowBase.h: Ditto.
-
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::QtRuntimeMethod::QtRuntimeMethod):
-        * bridge/runtime_method.cpp:
-        (JSC::RuntimeMethod::RuntimeMethod):
-        Pass JSGlobalData* instead of ExecState* to the InternalFunction
-        constructor.
-
-2008-10-03  David Hyatt  <hyatt@apple.com>
-
-        Fix Windows/Qt build bustage.
-
-        Reviewed by ggaren
-
-        * loader/EmptyClients.h:
-        (WebCore::EmptyChromeClient::platformWindow):
-        * page/Chrome.cpp:
-        (WebCore::Chrome::platformWindow):
-        * page/Chrome.h:
-        * page/ChromeClient.h:
-        * platform/HostWindow.h:
-        * platform/qt/PlatformScreenQt.cpp:
-        (WebCore::screenDepth):
-        (WebCore::screenDepthPerComponent):
-        (WebCore::screenIsMonochrome):
-        (WebCore::screenRect):
-        (WebCore::screenAvailableRect):
-        * platform/qt/PopupMenuQt.cpp:
-        (WebCore::PopupMenu::show):
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::show):
-        (WebCore::PopupMenu::calculatePositionAndSize):
-        (WebCore::PopupWndProc):
-
-2008-10-03  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        Make setStyle() take a const RenderStyle, to ensure that an
-        earlier RenderStyle::diff() remains valid.
-
-        * rendering/RenderBR.cpp:
-        * rendering/RenderBR.h:
-        * rendering/RenderBlock.cpp:
-        * rendering/RenderBlock.h:
-        * rendering/RenderBox.cpp:
-        * rendering/RenderBox.h:
-        * rendering/RenderButton.cpp:
-        * rendering/RenderButton.h:
-        * rendering/RenderFieldset.cpp:
-        * rendering/RenderFieldset.h:
-        * rendering/RenderFileUploadControl.cpp:
-        * rendering/RenderFileUploadControl.h:
-        * rendering/RenderInline.cpp:
-        * rendering/RenderInline.h:
-        * rendering/RenderListBox.cpp:
-        * rendering/RenderListBox.h:
-        * rendering/RenderListItem.cpp:
-        * rendering/RenderListItem.h:
-        * rendering/RenderListMarker.cpp:
-        * rendering/RenderListMarker.h:
-        * rendering/RenderMenuList.cpp:
-        * rendering/RenderMenuList.h:
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::setStyle):
-        * rendering/RenderObject.h:
-        * rendering/RenderReplaced.cpp:
-        * rendering/RenderReplaced.h:
-        * rendering/RenderSVGBlock.cpp:
-        (WebCore::RenderSVGBlock::setStyle):
-        * rendering/RenderSVGBlock.h:
-        * rendering/RenderSVGGradientStop.cpp:
-        * rendering/RenderSVGGradientStop.h:
-        * rendering/RenderSlider.cpp:
-        * rendering/RenderSlider.h:
-        * rendering/RenderTable.cpp:
-        * rendering/RenderTable.h:
-        * rendering/RenderTableCell.cpp:
-        * rendering/RenderTableCell.h:
-        * rendering/RenderTableRow.cpp:
-        * rendering/RenderTableRow.h:
-        * rendering/RenderText.cpp:
-        * rendering/RenderText.h:
-        * rendering/RenderTextControl.cpp:
-        * rendering/RenderTextControl.h:
-        * rendering/RenderWidget.cpp:
-        * rendering/RenderWidget.h:
-        * rendering/style/RenderStyle.h:
-        (WebCore::RenderStyle::isDisplayReplacedType):
-        (WebCore::RenderStyle::isDisplayInlineType):
-
-2008-10-03  David Hyatt  <hyatt@apple.com>
-
-        Preparation for enabling scrollbars to hit test properly inside transforms.  Clean up the scrollbar
-        event handlers to no longer be virtual.  Don't pass a mouse event where none is needed.  Add a new
-        method on Scrollbars called transformEvent that will apply all of the transforms to make a new event
-        that will work properly for hit testing.  This patch just stubs out that method to return the same
-        event untransformed.
-
-        Reviewed by Darin Adler
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMouseDoubleClickEvent):
-        (WebCore::EventHandler::handleMouseMoveEvent):
-        (WebCore::EventHandler::handleMouseReleaseEvent):
-        (WebCore::EventHandler::passMousePressEventToScrollbar):
-        * page/gtk/EventHandlerGtk.cpp:
-        * page/mac/EventHandlerMac.mm:
-        * page/qt/EventHandlerQt.cpp:
-        * page/win/EventHandlerWin.cpp:
-        * page/wx/EventHandlerWx.cpp:
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::mouseMoved):
-        (WebCore::Scrollbar::mouseExited):
-        (WebCore::Scrollbar::mouseUp):
-        (WebCore::Scrollbar::mouseDown):
-        (WebCore::Scrollbar::transformEvent):
-        * platform/Scrollbar.h:
-
-2008-10-03  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21340
-        
-        Remove "containingWindow()/setContainingWindow()" from Widget.  HostWindow covers this now.
-    
-        Reviewed by Dan Bernstein & Darin Adler
-        
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::addChild):
-        * platform/Widget.cpp:
-        (WebCore::Widget::init):
-        * platform/Widget.h:
-        * platform/mac/WidgetMac.mm:
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::show):
-
-2008-10-03  Adele Peterson  <adele@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        * css/CSSFontSelector.cpp: (WebCore::fontDataForGenericFamily):
-        Return early if settings is nil.
-
-2008-10-03  Rob Buis  <buis@kde.org>
 
-        Reviewed by Darin.
+2009-06-21  David Levin  <levin@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=20134
-        REGRESSION (2.0.4-3.0.4): No default value set for <input type=range> with an even difference of (max - min)
+        Reviewed by NOBODY.
 
-        Make sure the input element gets the right default value when no value is set.
+        Speculative tiger build fix and a windows build fix.
+        More fixes may still be in order.
 
-        Test: fast/forms/range-default-value.html
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+        * dom/default/PlatformMessagePortChannel.h:
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::tryGetMessage):
 
-        * rendering/RenderSlider.cpp:
-        (WebCore::RenderSlider::setPositionFromValue):
+2009-06-21  David Levin  <levin@chromium.org>
 
-2008-10-03  David Hyatt  <hyatt@apple.com>
+        Reviewed by NOBODY (Speculative tiger build fix).
 
-        Instead of a cross-platform init/destroy that forces every ScrollView platform to have a constructor/
-        destructor that calls them, switch to having a cross-platform constructor/destructor that calls
-        platform-specific init/destroy methods.
+        * dom/default/PlatformMessagePortChannel.h:
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::~MessagePortQueue):
 
-        With this change, ScrollViewWin.cpp can be removed from the build (yay!).
+2009-06-21  Drew Wilson  <atwilson@google.com>
 
-        Reviewed by Darin Adler
+        Reviewed by David Levin.
 
-        * WebCore.vcproj/WebCore.vcproj:
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::ScrollView):
-        (WebCore::ScrollView::~ScrollView):
-        (WebCore::ScrollView::platformInit):
-        (WebCore::ScrollView::platformDestroy):
-        (WebCore::ScrollView::platformAddChild):
-        (WebCore::ScrollView::platformRemoveChild):
-        * platform/ScrollView.h:
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::platformInit):
-        (WebCore::ScrollView::platformDestroy):
-        * platform/mac/ScrollViewMac.mm:
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::platformInit):
-        (WebCore::ScrollView::platformDestroy):
-        * platform/win/ScrollViewWin.cpp: Removed.
-        * platform/wx/ScrollViewWx.cpp:
-        (WebCore::ScrollView::platformInit):
-        (WebCore::ScrollView::platformDestroy):
-        (WebCore::ScrollView::setPlatformWidget):
-
-2008-10-03  Adele Peterson  <adele@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Fix for <rdar://problem/6012018> 
-        https://bugs.webkit.org/show_bug.cgi?id=21335
-        CrashTracer: [USER] 4959 crashes in Safari at com.apple.WebCore: WebCore::Frame::settings const + 8
-
-        * css/CSSFontSelector.cpp: (WebCore::fontDataForGenericFamily): Return early if the frame is nil.
-
-2008-10-03  Ariya Hidayat  <ariya.hidayat@trolltech.com>
-
-        Build fix.
-
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::Widget::invalidateRect):
-
-2008-10-03  Alp Toker  <alp@nuanti.com>
-
-        Remove some left-over GTK+ includes. No change in functionality.
-
-        * platform/Cursor.h:
-        * platform/graphics/Icon.h:
-        * platform/gtk/RenderThemeGtk.h:
-
-2008-10-03  Alp Toker  <alp@nuanti.com>
-
-        Build fix for trailing comment after #endif
-
-        * dom/ElementRareData.h:
-
-2008-10-03  David Hyatt  <hyatt@apple.com>
-
-        Remove addToDirtyRegion.
-        
-        Reviewed by Oliver Hunt
-
-        * page/Chrome.cpp:
-        * page/Chrome.h:
-        * page/ChromeClient.h:
-        * platform/ScrollView.h:
-        * platform/gtk/ScrollViewGtk.cpp:
-        * platform/qt/ScrollViewQt.cpp:
-        * platform/win/ScrollViewWin.cpp:
-
-2008-10-03  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        - fix a CachedResource leak introduced in r37176 
-
-        Undo r37176 and instead allow pruneDeadResources() to be re-entered, but
-        afterwards bail out of the outer pruneDeadResources().
-
-        * loader/Cache.cpp:
-        (WebCore::Cache::Cache):
-        (WebCore::Cache::pruneDeadResources):
-        (WebCore::Cache::remove):
-        * loader/Cache.h:
-
-2008-10-03  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21330
-
-        Fix Gtk adjustments so that they are properly checked again before creating horizontal/vertical
-        scrollbars.
-        
-        Reviewed by Oliver Hunt
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::setHasHorizontalScrollbar):
-        (WebCore::ScrollView::setHasVerticalScrollbar):
-        (WebCore::ScrollView::platformHasHorizontalAdjustment):
-        (WebCore::ScrollView::platformHasVerticalAdjustment):
-        * platform/ScrollView.h:
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::adjustmentChanged):
-        (WebCore::ScrollView::ScrollView):
-        (WebCore::ScrollView::~ScrollView):
-        (WebCore::ScrollView::setGtkAdjustments):
-        (WebCore::ScrollView::platformHandleHorizontalAdjustment):
-        (WebCore::ScrollView::platformHandleVerticalAdjustment):
-
-2008-10-03  Julien Chaffraix  <jchaffraix@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 21106: .in format discussed changes
-        https://bugs.webkit.org/show_bug.cgi?id=21106
-
-        Change "upperCase" to "interfaceName" per-tag parameter as
-        discussed on the mailing list. Removed the per-attribute version
-        as it was not used.
-
-        Also add the "Element" suffix to all interfaceName parameter to match
-        the class name (and thus remove it from make_names.pl).
-
-        * dom/make_names.pl:
-        * html/HTMLTagNames.in:
-        * svg/svgtags.in:
-
-2008-10-03  David Hyatt  <hyatt@apple.com>
-
-        Preserve Qt's disabling of blitting when any native widgets are present anywhere on the page (ick).
-        Hopefully this is a temporary hack that could eventually be removed.
-
-        Reviewed by Sam Weinig
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::scrollContents):
-        * platform/ScrollView.h:
-        (WebCore::ScrollView::rootPreventsBlitting):
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::ScrollView):
-        (WebCore::ScrollView::~ScrollView):
-        (WebCore::ScrollView::platformAddChild):
-        (WebCore::ScrollView::platformRemoveChild):
-
-2008-10-02  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21328
-        
-        Make widget invalidation more cross-platform.
-        
-        (1) Make invalidateRect a pure virtual function on Widget.  All leaf widgets must now implement this function.
-        
-        (2) Scrollbars now send invalidations through the ScrollbarClient.  windowClipRect on ScrollbarClient has been removed and replaced with this invalidation call.
-        This allows all scrollbar invalidations to go through the render tree so that transforms and reflections will be respected.
-        
-        (3) Plugins now have the native window invalidation code for windowed plugins.  Windowless plugins do a repaintRectangle on the plugin's renderer.
-        
-        (4) FrameViews now do a repaintRectangle on their owner element's renderer.
-
-        Reviewed by Sam Weinig
-
-        * WebCore.base.exp:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::invalidateRect):
-        (WebCore::FrameView::invalidateScrollbarRect):
-        * page/FrameView.h:
-        * platform/PopupMenu.h:
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::scrollContents):
-        * platform/ScrollView.h:
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::setEnabled):
-        (WebCore::Scrollbar::invalidateRect):
-        * platform/Scrollbar.h:
-        * platform/ScrollbarClient.h:
-        * platform/Widget.h:
-        * platform/gtk/WidgetGtk.cpp:
-        * platform/mac/WidgetMac.mm:
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::invalidateScrollbarRect):
-        * platform/win/WidgetWin.cpp:
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::invalidateTimerFired):
-        (WebCore::PluginView::invalidateWindowlessPluginRect):
-        * plugins/PluginView.h:
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::invalidateRect):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::invalidateRect):
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::invalidateRect):
-        (WebCore::PluginView::invalidateRegion):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::invalidateScrollbarRect):
-        * rendering/RenderLayer.h:
-        * rendering/RenderListBox.cpp:
-        (WebCore::RenderListBox::paintObject):
-        (WebCore::RenderListBox::paintScrollbar):
-        (WebCore::RenderListBox::invalidateScrollbarRect):
-        * rendering/RenderListBox.h:
-
-2008-10-02  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Geoffrey Garen and Sam Weinig.
-
-        - fix SVGFontFaceElement leaks seen in Acid3
-        - make font-face elements take effect only when they are in the document tree
-
-        Test: svg/custom/font-face-not-in-document.svg
-
-        * svg/SVGFontData.h: Changed the m_svgFontFaceElement member from a
-        RefPtr to a plain pointer to break a ref cycle.
-        (WebCore::SVGFontData::svgFontFaceElement):
-
-        * svg/SVGFontFaceElement.cpp: Changed to insert and remove the
-        @font-face rule from the document's mapped element sheet when the
-        element is inserted and removed from the document, and to update it
-        only when the element is in the document.
-        (WebCore::SVGFontFaceElement::SVGFontFaceElement):
-        (WebCore::SVGFontFaceElement::parseMappedAttribute):
-        (WebCore::SVGFontFaceElement::rebuildFontFace):
-        (WebCore::SVGFontFaceElement::insertedIntoDocument):
-        (WebCore::SVGFontFaceElement::removedFromDocument):
-        (WebCore::SVGFontFaceElement::childrenChanged):
-        (WebCore::SVGFontFaceElement::removeFromMappedElementSheet):
-        * svg/SVGFontFaceElement.h:
-
-2008-10-01  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        Fix RenderFileUploadControl::setStyle() and 
-        RenderMenuList::setStyle() to not touch the style; replace
-        with html4.css and CSSStyleSelector changes.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21287
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::adjustRenderStyle):
-        * css/html4.css:
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::setStyle):
-        * rendering/RenderFileUploadControl.cpp:
-        * rendering/RenderMenuList.cpp:
-        (WebCore::RenderMenuList::setStyle):
-
-2008-10-01  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        Clean up code that changes the RenderStyle passed in to
-        table renderer setStyle() methods.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=21287
+        <https://bugs.webkit.org/show_bug.cgi?id=26448>
         
-        Tests: fast/table/floating-th.html
-               fast/table/table-display-types-strict.html
-               fast/table/table-display-types.html
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::adjustRenderStyle):
-        * rendering/RenderTableCell.cpp:
-        (WebCore::RenderTableCell::setStyle):
-        * rendering/RenderTableRow.cpp:
-        (WebCore::RenderTableRow::setStyle):
-        * rendering/RenderTableSection.cpp:
-        (WebCore::RenderTableSection::setStyle):
-
-2008-10-02  Darin Adler  <darin@apple.com>
-
-        - fix build
-
-        * bindings/scripts/CodeGeneratorJS.pm: Need to replace the -> with a . here too.
-        Not just locally in my generated file!
-
-2008-10-02  Adele Peterson  <adele@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21299
-        REGRESSION: <input> color specified in inline style applies to placeholder
-
-        I recently added a pseudo-class for the placeholder, but that can be overridden by inline style changes.  A pseudo-element
-        is more appropriate.  This change adds "-webkit-input-placeholder".
-
-        * css/CSSSelector.cpp: (WebCore::CSSSelector::extractPseudoType):
-        Added definition for "-webkit-input-placeholder" pseudo element.
-        * css/CSSSelector.h: (WebCore::CSSSelector::): Added PseudoInputPlaceholder.
-        * css/CSSStyleSelector.cpp: (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
-        Added case for PseudoInputPlaceholder.
-        * css/html4.css: Added rule for -webkit-input-placeholder pseudo-element.
-        * rendering/style/RenderStyle.h: (WebCore::RenderStyle::): Added INPUT_PLACEHOLDER.
-
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::setValue): Check that its a text field before calling updatePlaceholderVisibility.
-        (WebCore::HTMLInputElement::setValueFromRenderer): ditto.
-        (WebCore::HTMLInputElement::updatePlaceholderVisibility): Instead of calling setChanged(), call updatePlaceholderVisibility on the renderer.
-        setChanged wouldn't actually trigger setStyle since the style for the input element won't actually change.
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::createInnerTextStyle): Get the pseudoStyle when the placeholder is visible.
-        (WebCore::RenderTextControl::updatePlaceholderVisibility): Sets the style on the inner text block, and calls updateFromElement so
-        the text will be updated correctly.
-        * rendering/RenderTextControl.h:
-
-2008-10-02  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21280
-        <rdar://problem/6227690> There are a bunch of tables on this page that don't seem to be real tables
-
-        Updated AXTable detection to be more robust to false-positives. Specifically, added checks
-        to ensure that there is more than one valid table cell, and that at least half of the cells
-        have borders or have specific background colors. Modified the table detection layout test
-        to test for the tables mentioned in the bug
-
-        * page/AccessibilityTable.cpp:
-        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
-
-2008-10-02  Darin Adler  <darin@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=21321
-          Bug 21321: speed up JavaScriptCore by inlining Heap in JSGlobalData
-
-        * bindings/js/GCController.cpp:
-        (WebCore::collect): Use heap. instead of heap-> to work with the heap.
-        (WebCore::GCController::gcTimerFired): Ditto.
-        (WebCore::GCController::garbageCollectNow): Ditto.
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::JSDOMWindowShell::operator new): Ditto.
-        * storage/Database.cpp:
-        (WebCore::Database::Database): Ditto.
-
-2008-10-02  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        - fix a Database leak that resulted in Document leaks
-
-        * storage/Database.cpp:
-        (WebCore::Database::openDatabase): Account for the fact that RefCounted 
-        objects start out with a ref count of 1.
-
-2008-10-02  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Mr. Geoffrey Garen.
-
-        Always mark your parent before marking members.
-
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::mark):
-
-2008-10-02  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21314
-        
-        Make scrollBackingStore cross-platform.
-
-        Reviewed by Sam Weinig
-
-        * loader/EmptyClients.h:
-        (WebCore::EmptyChromeClient::repaint):
-        (WebCore::EmptyChromeClient::scroll):
-        * page/Chrome.cpp:
-        (WebCore::Chrome::repaint):
-        (WebCore::Chrome::scroll):
-        * page/Chrome.h:
-        * page/ChromeClient.h:
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleAutoscroll):
-        * platform/HostWindow.h:
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::scrollContents):
-        (WebCore::ScrollView::addPanScrollIcon):
-        (WebCore::ScrollView::removePanScrollIcon):
-        * platform/ScrollView.h:
-        * platform/gtk/ScrollViewGtk.cpp:
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
-        (WebCore::ScrollView::~ScrollView):
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::ScrollView):
-        (WebCore::ScrollView::~ScrollView):
-
-2008-10-02  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fixes after Frame/ScrollView changes.
-
-        * WebCoreSources.bkl:
-        * platform/wx/ScrollViewWx.cpp:
-        (WebCore::ScrollView::platformContentsToScreen):
-        (WebCore::ScrollView::platformScreenToContents):
-        (WebCore::ScrollView::platformIsOffscreen):
-
-2008-10-02  Brett Wilson  <brettw@chromium.org>
-
-        Reviewed by Sam Weinig
-
-        https://bugs.webkit.org/show_bug.cgi?id=21292
-
-        Revert the changes to enclosingIntRect made in r12530 since the new code
-        doesn't round correctly.
-
-        * ChangeLog:
-        * platform/graphics/FloatRect.cpp:
-        (WebCore::enclosingIntRect):
-
-2008-10-02  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Anders Carlsson and Eric Seidel.
-
-        - fix HTMLCanvaseElement leak from -webkit-canvas() values
-
-        Changed the m_element member of CSSCanvasValue from a RefPtr to a plain
-        pointer, as the document owns the canvas elements. Added code to release
-        those elements in Document::removedLastRef() because they reference
-        the document.
-
-        * css/CSSCanvasValue.cpp:
-        (WebCore::CSSCanvasValue::element):
-        * css/CSSCanvasValue.h:
-        (WebCore::CSSCanvasValue::CSSCanvasValue):
-        * dom/Document.cpp:
-        (WebCore::Document::removedLastRef):
-
-2008-10-02  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Build fix for platforms that don't implement WTF::ThreadSpecific.
-
-        * bindings/js/JSDOMBinding.cpp: (WebCore::wrapperSet):
-        Guard ThreadSpecific use with #if ENABLE(WORKERS). No platform defines this yet, but this
-        code is only needed for JS bindings in worker threads.
-
-2008-10-01  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21298
-        
-        Make updateScrollbars cross-platform.  For now a stubbed out scrollContents function is invoked to do the scrolling of the backing store.  Next patch
-        will make that cross-platform.  
-        
-        The ScrollView now implements ScrollbarClient, which means that there was a clash of windowClipRect methods from the
-        multiple inheritance.  For now I solved this by adding a Scrollbar* to the ScrollbarClient version of the method, but longer term
-        windowClipRect is going to be removed from ScrollbarClient (when Widget invalidation gets rewritten).
-        
-        Reviewed by Sam Weinig
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::windowClipRect):
-        (WebCore::FrameView::isActive):
-        * page/FrameView.h:
-        (WebCore::FrameView::visibleContentsResized):
-        * platform/PopupMenu.h:
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::init):
-        (WebCore::ScrollView::destroy):
-        (WebCore::ScrollView::setHasHorizontalScrollbar):
-        (WebCore::ScrollView::setHasVerticalScrollbar):
-        (WebCore::ScrollView::valueChanged):
-        (WebCore::ScrollView::updateScrollbars):
-        (WebCore::ScrollView::scrollContents):
-        (WebCore::ScrollView::platformHandleHorizontalAdjustment):
-        (WebCore::ScrollView::platformHandleVerticalAdjustment):
-        * platform/ScrollView.h:
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::windowClipRect):
-        * platform/ScrollbarClient.h:
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::platformHandleHorizontalAdjustment):
-        (WebCore::ScrollView::platformHandleVerticalAdjustment):
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::scrollContents):
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::windowClipRect):
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::scrollContents):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::windowClipRect):
-        * rendering/RenderLayer.h:
-        * rendering/RenderListBox.cpp:
-        (WebCore::RenderListBox::panScroll):
-        (WebCore::RenderListBox::windowClipRect):
-        * rendering/RenderListBox.h:
-
-2008-10-02  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21304
-        Stop using a static wrapper map for WebCore JS bindings
-
-        The static domObjects map was not thread safe.
-
-        * dom/Document.h:
-        (WebCore::Document::messagePorts): Added an accessor for JSDocument to iterate over message
-        ports.
-        (WebCore::Document::xmlHttpRequests): Ditto for XMLHttpRequests.
-
-        * dom/Document.cpp:
-        (WebCore::Document::createdXMLHttpRequest):
-        (WebCore::Document::destroyedXMLHttpRequest):
-        Moved XMLHttpRequest tracking from a global map to Document.
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * webcore-base.bkl:
-        * bindings/DOMProtect.cpp: Removed.
-        * bindings/DOMProtect.h: Removed.
-        Removed gcProtect(Unprotect)DOMObject - its callers do not have a JSGlobalData reference,
-        so they can no longer protect bindings objects.
-
-        * dom/MessagePort.cpp:
-        (WebCore::CloseMessagePortTimer::CloseMessagePortTimer):
-        (WebCore::CloseMessagePortTimer::fired):
-        (WebCore::MessagePort::MessagePort):
-        (WebCore::MessagePort::queueCloseEvent):
-        (WebCore::MessagePort::setPendingActivity):
-        (WebCore::MessagePort::unsetPendingActivity):
-        * dom/MessagePort.h:
-        (WebCore::MessagePort::hasPendingActivity):
-        MessagePort now counts outstanding async events, so JSDocument::mark can decide whether
-        to protect it.
-
-        * xml/XMLHttpRequest.h:
-        (WebCore::XMLHttpRequest::hasPendingActivity):
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::XMLHttpRequest):
-        (WebCore::XMLHttpRequest::~XMLHttpRequest):
-        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
-        (WebCore::XMLHttpRequest::dropProtection):
-        (WebCore::XMLHttpRequest::didFinishLoadingPreflight):
-        (WebCore::XMLHttpRequest::cancelRequests):
-        (WebCore::XMLHttpRequest::detachRequests):
-        (WebCore::XMLHttpRequest::setPendingActivity):
-        (WebCore::XMLHttpRequest::unsetPendingActivity):
-        Moved XMLHttpRequest tracking from a global map to Document. 
+        Added optimized GC for MessagePorts when the entangled port is run by the same thread.
+        Fixed bug in isProxyFor() that was not properly throwing an exception when trying to clone the entangled port.
 
         * bindings/js/JSDOMBinding.cpp:
-        (WebCore::wrapperSet):
-        (WebCore::DOMObjectWrapperMap::mapFor):
-        (WebCore::DOMObjectWrapperMap::get):
-        (WebCore::DOMObjectWrapperMap::set):
-        (WebCore::DOMObjectWrapperMap::remove):
-        (WebCore::getCachedDOMObjectWrapper):
-        (WebCore::cacheDOMObjectWrapper):
-        (WebCore::forgetDOMObject):
-        (WebCore::getCachedDOMNodeWrapper):
-        (WebCore::forgetDOMNode):
-        (WebCore::cacheDOMNodeWrapper):
-        (WebCore::markActiveObjectsForDocument):
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::createDOMObjectWrapper):
-        (WebCore::getDOMObjectWrapper):
-        Wrapper map is now kept as JSGlobalData::clientData. Also changed debug-only wrapperSet
-        to be per-thread (this is slower than going to JSGlobalData, but fast enough for debug).
-        WebCore objects can never migrate between threads.
-
-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::JSDocument::mark):
-        Call markActiveObjectsForDocument() from JSDOMBinding.
-
-        * bindings/js/JSCSSRuleCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSCSSValueCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::markDOMObjectWrapper):
-        (WebCore::JSDOMWindow::mark):
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSEventTarget.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSImageDataCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSMessageChannelCustom.cpp:
-        (WebCore::JSMessageChannel::mark):
+        (WebCore::markActiveObjectsForContext):
+        Now marks remotely entangled ports as in-use, in addition to those with pending activity.
         * bindings/js/JSMessagePortCustom.cpp:
         (WebCore::JSMessagePort::mark):
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::mark):
-        * bindings/js/JSSVGPathSegCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSStyleSheetCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::mark):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::mark):
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::finishedWithEvent):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        Pass a JSGlobalData reference to functions that track JS wrapper objects.
-
-2008-10-02  Dan Bernstein  <mitz@apple.com>
-
-        - build fix
-
-        * page/JavaScriptCallFrame.idl:
-
-2008-10-02  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by NOBODY (Build fix).
-
-        Add new file to project files
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
+        Now checks if the entangled port is local (run by same thread) and if so mark()s it.
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::postMessage):
+        (WebCore::MessagePort::disentangle):
+        Removes cloned ports from the ScriptExecutionContext - this allows cloned ports to be GC'd as otherwise they look like remotely entangled ports.
+        (WebCore::MessagePort::start):
+        (WebCore::MessagePort::locallyEntangledPort):
+        Added API for fetching the entangled port if it is run by the same thread
+        * dom/MessagePort.h:
+        * dom/MessagePortProxyWrapper.h:
+        * dom/default/MessagePortProxy.cpp:
+        (WebCore::MessagePortProxyWrapper::locallyEntangledPort):
+        Added API for fetching the entangled port if it is run by the same thread        
+        (WebCore::MessagePortProxy::hasPendingActivity):
+        Changed definition of hasPendingActivity() to be stricter - only returns true if there are pending messages.
+        (WebCore::MessagePortProxy::locallyEntangledPort):
+        * dom/default/MessagePortProxy.h:
 
-2008-10-02  Geoffrey Garen  <ggaren@apple.com>
+2009-06-21  Drew Wilson  <atwilson@google.com>
 
-        Not reviewed.
+        Reviewed by David Levin.
 
-        Try to fix some more builds.
+        <https://bugs.webkit.org/show_bug.cgi?id=25043>
+        Removed obsolete MessagePort.startConversation(), active and onclose APIs.
 
-        * GNUmakefile.am:
-        * WebCore.pro:
+        Refactored MessagePortProxy into MessagePortChannel and a platform-dependent PlatformMessagePortChannel
+        implementation. Modified APIs to simplify cross-process implementations by moving the messaging code
+        entirely into the platform-dependent proxy.
 
-2008-10-02  Geoffrey Garen  <ggaren@apple.com>
+        Created a thread-safe default PlatformMessagePortChannel implementation.
 
-        Not reviewed.
+        Changed DOMWindow messaging to create the MessageEvent in the target ScriptExecutionContext to match how
+        cross-thread MessagePorts work.
         
-        Try to fix Windows build.
-
+        * GNUMakefile.am:
         * WebCore.vcproj/WebCore.vcproj:
-
-2008-10-01  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Darin Adler and Cameron Zwarich.
-
-        Updated for JavaScriptCore API changes: use a SourceCode instead of
-        broken out parameters; treat sourceId as intptr_t.
-
-        * ForwardingHeaders/kjs/SourceRange.h: Copied from ForwardingHeaders/kjs/SourceProvider.h.
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::send):
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
-        * bindings/js/StringSourceProvider.h:
-        (WebCore::StringSourceProvider::create):
-        (WebCore::StringSourceProvider::StringSourceProvider):
-
-        (WebCore::makeSource): Added a makeSource function for convenience.
-
-        * bindings/objc/WebScriptObject.mm:
-        (-[WebScriptObject evaluateWebScript:]):
-        * bridge/NP_jsobject.cpp:
-        (_NPN_Evaluate):
-        * bridge/jni/jni_jsobject.mm:
-        (JavaJSObject::call):
-        (JavaJSObject::eval):
-        (JavaJSObject::getMember):
-        (JavaJSObject::setMember):
-        (JavaJSObject::removeMember):
-
-        * bridge/jni/jni_runtime.h:
-        (JSC::Bindings::JavaString::operator UString): Replaced the explicit
-        ustring() function with an implicit operator because this class already
-        holds a UString::rep.
-
-        * page/Console.cpp:
-        (WebCore::retrieveLastCaller):
-        (WebCore::Console::trace):
-        * page/InspectorController.cpp:
-        (WebCore::jsStringRef):
-        (WebCore::InspectorController::addBreakpoint):
-        (WebCore::InspectorController::removeBreakpoint):
-        (WebCore::InspectorController::didParseSource):
-        (WebCore::InspectorController::failedToParseSource):
-        * page/InspectorController.h:
-        * page/JavaScriptCallFrame.cpp:
-        (WebCore::JavaScriptCallFrame::JavaScriptCallFrame):
-        * page/JavaScriptCallFrame.h:
-        (WebCore::JavaScriptCallFrame::create):
-        (WebCore::JavaScriptCallFrame::sourceIdentifier):
-        (WebCore::JavaScriptCallFrame::update):
-        * page/JavaScriptDebugListener.h:
-        * page/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::addBreakpoint):
-        (WebCore::JavaScriptDebugServer::removeBreakpoint):
-        (WebCore::JavaScriptDebugServer::hasBreakpoint):
-        (WebCore::dispatchDidParseSource):
-        (WebCore::dispatchFailedToParseSource):
-        (WebCore::JavaScriptDebugServer::sourceParsed):
-        (WebCore::JavaScriptDebugServer::callEvent):
-        (WebCore::JavaScriptDebugServer::atStatement):
-        (WebCore::JavaScriptDebugServer::returnEvent):
-        (WebCore::JavaScriptDebugServer::exception):
-        (WebCore::JavaScriptDebugServer::willExecuteProgram):
-        (WebCore::JavaScriptDebugServer::didExecuteProgram):
-        (WebCore::JavaScriptDebugServer::didReachBreakpoint):
-        * page/JavaScriptDebugServer.h:
-        * page/inspector/ScriptsPanel.js: Renamed internal uses of sourceId and 
-        sourceIdentifier to sourceID.
-
-2008-10-01  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Geoffrey Garen.
-
-        - fix SVGFontFaceElement leak seen on svg/custom/acid3-test-77.html
-
-        Broke a ref cycle by changing the m_svgFontFaceElement members of
-        CSSFontFaceSource and CSSFontFaceSrcValue from RefPtrs to plain
-        pointers. Also made sure that the @font-face rule added by
-        SVGFontFaceElement to the document's mapped element sheet is removed
-        when the font-face element is deleted or moved to another document.
-
-        * css/CSSFontFaceSource.cpp:
-        (WebCore::CSSFontFaceSource::CSSFontFaceSource):
-        (WebCore::CSSFontFaceSource::getFontData):
-        * css/CSSFontFaceSource.h:
-        (WebCore::CSSFontFaceSource::svgFontFaceElement):
-        * css/CSSFontFaceSrcValue.h:
-        (WebCore::CSSFontFaceSrcValue::svgFontFaceElement):
-        (WebCore::CSSFontFaceSrcValue::CSSFontFaceSrcValue):
-        * svg/SVGFontFaceElement.cpp:
-        (WebCore::SVGFontFaceElement::~SVGFontFaceElement):
-        (WebCore::SVGFontFaceElement::willMoveToNewOwnerDocument):
-        (WebCore::SVGFontFaceElement::didMoveToNewOwnerDocument):
-        (WebCore::SVGFontFaceElement::removeFromMappedElementSheet):
-        * svg/SVGFontFaceElement.h:
-
-2008-10-01  Oliver Hunt  <oliver@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 20315: Memory leak with Canvas getImageData
-        <https://bugs.webkit.org/show_bug.cgi?id=20315>
-
-        This wasn't a leak, the issue was that we were reporting the cost
-        of the CanvasPixelArray when creating the JSCanvasPixelArray wrapper
-        and we should have been reporting the cost when we create the
-        JSImageData wrapper.
-
         * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSCanvasPixelArrayCustom.cpp: Removed.
-          This was only needed to report the extra memory cost
-          of the CPA.
-        * bindings/js/JSImageDataCustom.cpp:
-        (WebCore::toJS):
-          We need a custom toJS function now so that we can report
-          the extra memory cost.
-        * bindings/scripts/CodeGeneratorJS.pm:
-          Need to replace the reference to CanvasPixelArray with ImageData
-          to be able to create the custom toJS implementation.
-        * html/CanvasPixelArray.idl:
-        * html/ImageData.idl:
-
-2008-10-01  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Mark Rowe.
+            Added MessagePortChannel/PlatformMessagePortChannel files.
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::mark):
+            Changed ports to not mark their entangled pair as reachable, per the spec.
+        * bindings/v8/custom/V8MessagePortCustom.cpp:
+        * dom/MessageChannel.cpp:
+        (WebCore::MessageChannel::MessageChannel):
+            Updated to use PlatformMessagePortChannel::createChannel() to entangle the ports.
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::MessagePort):
+        (WebCore::MessagePort::~MessagePort):
+        (WebCore::MessagePort::postMessage):
+        (WebCore::MessagePort::disentangle):
+        (WebCore::MessagePort::messageAvailable):
+        (WebCore::MessagePort::start):
+        (WebCore::MessagePort::close):
+        (WebCore::MessagePort::entangle):
+        (WebCore::MessagePort::contextDestroyed):
+        (WebCore::MessagePort::dispatchMessages):
+        (WebCore::MessagePort::setOnmessage):
+        (WebCore::MessagePort::hasPendingActivity):
+            Changed these APIs to delegate to new PlatformMessagePortChannel APIs.
+        * dom/MessagePort.h:
+            Renamed isQueueOpen() to started().
+        * dom/MessagePort.idl:
+            Removed startConversation and onclose.
+        * dom/MessagePortProxy.h: Removed.
+        * dom/MessagePortChannel.cpp: Added.
+        (WebCore::MessagePortChannel::EventData::create):
+        (WebCore::MessagePortChannel::EventData::EventData):
+        (WebCore::MessagePortChannel::~MessagePortChannel):
+        * dom/MessagePortChannel.h: Added.
+        (WebCore::MessagePortChannel::EventData::message):
+        (WebCore::MessagePortChannel::EventData::channel):
+            Changed EventData to hold a reference to a MessagePortChannel object instead of a MessagePort to enable cross-thread messaging.
+        (WebCore::MessagePortChannel::MessagePortChannel):
+        (WebCore::MessagePortChannel::create):        
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore:ScriptExecutionContext::dispatchMessagePortEvents):
+            Renamed isQueueOpen() to started().
+        * dom/default/PlatformMessagePortChannel.cpp: Added.
+        (WebCore::MessagePortChannel::entangleIfOpen):
+        (WebCore::MessagePortChannel::disentangle):
+        (WebCore::MessagePortChannel::postMessageToRemote):
+        (WebCore::MessagePortChannel::tryGetMessageFromRemote):
+        (WebCore::MessagePortChannel::close):
+        (WebCore::MessagePortChannel::isConnectedTo):
+        (WebCore::MessagePortChannel::hasPendingActivity):
+        (WebCore::PlatformMessagePortChannel::PlatformMessagePortChannel):
+        (WebCore::PlatformMessagePortChannel::~PlatformMessagePortChannel):
+        (WebCore::PlatformMessagePortChannel::createChannel):
+        (WebCore::PlatformMessagePortChannel::entangleIfOpen):
+        (WebCore::PlatformMessagePortChannel::disentangle):
+        (WebCore::PlatformMessagePortChannel::setRemotePort):
+        (WebCore::PlatformMessagePortChannel::remotePort):
+        (WebCore::PlatformMessagePortChannel::entangledChannel):
+        (WebCore::PlatformMessagePortChannel::setEntangledChannel):
+        (WebCore::PlatformMessagePortChannel::postMessageToRemote):
+        (WebCore::PlatformMessagePortChannel::tryGetMessageFromRemote):
+        (WebCore::PlatformMessagePortChannel::isConnectedTo):
+        (WebCore::PlatformMessagePortChannel::close):
+        (WebCore::PlatformMessagePortChannel::closeInternal):
+        (WebCore::PlatformMessagePortChannel::hasPendingActivity):
+        * dom/default/PlatformMessagePortChannel.h: Added.
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::create):
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::tryGetMessage):
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::appendAndCheckEmpty):
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::isEmpty):
+        (WebCore::PlatformMessagePortChannel::MessagePortQueue::MessagePortQueue):
+        * page/DOMWindow.cpp:
+        (WebCore::PostMessageTimer::PostMessageTimer):
+            Changed DOMWindow messaging to create the MessageEvent in the target ScriptExecutionContext to match how cross-thread MessagePorts work.
+        (WebCore::PostMessageTimer::event):
+        (WebCore::DOMWindow::postMessage):
+        (WebCore::DOMWindow::postMessageTimerFired):
 
-        - https://bugs.webkit.org/show_bug.cgi?id=21293
-          REGRESSION: Crash beneath RenderSVGViewportContainer::viewportTransform() during SVGSVGElement destruction
+2009-06-21  Dan Bernstein  <mitz@apple.com>
 
-        * svg/SVGMarkerElement.cpp:
-        (WebCore::SVGMarkerElement::~SVGMarkerElement): Call detach() here so
-        that renderer destruction happens before the SVGMarkerElement is
-        destroyed.
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::~SVGSVGElement): Ditto for SVGSVGElement.
+        Reviewed by Sam Weinig.
 
-2008-10-01  Evan Martin  <evan@chromium.org>
+        - fix https://bugs.webkit.org/show_bug.cgi?id=15383
+          <rdar://problem/5682745> resize: vertical does not restrict to vertical
+          resize
 
-        Reviewed by Eric Seidel.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=20669
+        Test: fast/css/resize-single-axis.html
 
-        * css/makeprop.pl:
-        Die if gperf fails.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::resize): Ignore movement along the non-resizing
+        axis.
 
-2008-10-01  Evan Martin  <evan@chromium.org>
+2009-06-21  Sam Weinig  <sam@webkit.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Eric Seidel
 
-        * loader/icon/IconDatabase.h:
-        IconDatabase uses HashMap, so it needs to #include the header.
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26578
+        event.currentTarget for listener registered on window should point to the window object like in Firefox
 
-2008-10-01  Dan Bernstein  <mitz@apple.com>
+        Test: fast/events/event-trace.html
 
-        Reviewed by Mark Rowe.
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchGenericEvent): Make the DOMWindow the currentTarget when events are dispatched
+        to it. We previously used the document because DOMWindow was not yet an EventTarget.
 
-        - fix an assertion failure in http/tests/security/canvas-remote-read-svg-image.html due to re-entry into Cache::pruneDeadResources()
+2009-06-21  Dan Bernstein  <mitz@apple.com>
 
-        * loader/Cache.cpp:
-        (WebCore::Cache::remove): Disable pruning temporarily during 
-        CachedResource deletion.
+        Reviewed by Sam Weinig.
 
-2008-10-01  Dan Bernstein  <mitz@apple.com>
+        - fix https://bugs.webkit.org/show_bug.cgi?id=9694
+          resize value not compared
 
-        Reviewed by Mark Rowe.
+        Test: fast/css/resize-value-compared.html
 
-        - fix SVGFontElement leaks seen on buildbot by breaking a ref cycle
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::operator==): Compare the resize
+        member.
 
-        * svg/SVGFontFaceElement.cpp:
-        (WebCore::SVGFontFaceElement::rebuildFontFace):
-        * svg/SVGFontFaceElement.h:
-        (WebCore::SVGFontFaceElement::associatedFontElement):
+2009-06-19  Alice Liu  <alice.liu@apple.com>
 
-2008-10-01  Brett Wilson  <brettw@chromium.org>
+        Fix https://bugs.webkit.org/show_bug.cgi?id=26568 
+        Repro crash animating GIF if previously used in a closed window's back/forward list
+        Also filed as <rdar://problem/6978362>
 
         Reviewed by Maciej Stachowiak.
 
-        Document the rounding behavior of the mapRect(IntRect) function in
-        AffineTransform.h.
-
-        * platform/graphics/AffineTransform.h:
-
-2008-10-01  David Hyatt  <hyatt@apple.com>
+        Can't test this bug with an automated layout test since it requires b/f caching 
+        * manual-tests/animated-gif-bfcache-crash.html: Added.
+        * manual-tests/resources/containsAnimatedGif.html: Added.
 
-        Move prohibitsScrolling from the Frame to the ScrollView.
-
-        Reviewed by Sam Weinig
-
-        * WebCore.base.exp:
-        * page/Frame.cpp:
-        (WebCore::FramePrivate::FramePrivate):
-        * page/Frame.h:
-        * page/FramePrivate.h:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::scrollRectIntoViewRecursively):
-        (WebCore::FrameView::setScrollPosition):
+        Adding checks for hostWindow() since there is no guarantee that the Page is alive
         * platform/ScrollView.cpp:
-        (WebCore::ScrollView::init):
         (WebCore::ScrollView::scrollRectIntoViewRecursively):
-        (WebCore::ScrollView::setScrollPosition):
-        * platform/ScrollView.h:
-        (WebCore::ScrollView::setProhibitsScrolling):
-        (WebCore::ScrollView::prohibitsScrolling):
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::updateScrollbars):
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::updateScrollbars):
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::updateScrollbars):
-
-2008-10-01  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Geoff Garen.
-
-        Fix leaks seen during http/tests/xmlhttprequest/access-control-basic-non-simple-allow.html.
-
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::didFinishLoadingPreflight): Balance the ref and GC protect
-        that we do during the loadRequestAsynchronously of the preflight request with a deref and
-        GC unprotect.
-
-2008-10-01  David Hyatt  <hyatt@apple.com>
-
-        Rename allowsScrolling/setAllowsScrolling to canHaveScrollbars/setCanHaveScrollbars to make it more
-        clear that the boolean doesn't actually stop all scrolling.  It just gets rid of scrollbars.
-
-        Reviewed by Tim Hatcher
-
-        * WebCore.base.exp:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::setCanHaveScrollbars):
-        * page/FrameView.h:
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::setCanHaveScrollbars):
-        (WebCore::ScrollView::wheelEvent):
-        * platform/ScrollView.h:
-        (WebCore::ScrollView::canHaveScrollbars):
-
-2008-10-01  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        - fix some CachedResource leaks seen on buildbot
-
-        The issue here was that emptying the cache was a no-op when it only
-        contained resources with no data. Changed to go after those
-        resources when the desired cache capacity is zero.
-
-        * loader/Cache.cpp:
-        (WebCore::Cache::pruneLiveResources):
-        (WebCore::Cache::pruneDeadResources):
-        * loader/Cache.h:
-        (WebCore::Cache::prune):
-
-2008-10-01  David Hyatt  <hyatt@apple.com>
-
-        Make isOffscreen cross-platform.  Only Mac implements this method, so hold off on adding API to the
-        HostWindow object until other platforms decide they want this method.  (We need it for Win though at some point.)
-
-        Reviewed by Adam Roben
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::isOffscreen):
-        (WebCore::ScrollView::platformIsOffscreen):
-        * platform/ScrollView.h:
-        * platform/gtk/ScrollViewGtk.cpp:
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::platformIsOffscreen):
-        * platform/qt/ScrollViewQt.cpp:
-        * platform/wx/ScrollViewWx.cpp:
-
-2008-10-01  David Hyatt  <hyatt@apple.com>
-
-        Make show/hide/setParentVisible cross-platform on ScrollView.
-
-        Reviewed by Adam Roben
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::setParentVisible):
-        (WebCore::ScrollView::show):
-        (WebCore::ScrollView::hide):
-        * platform/ScrollView.h:
-        * platform/win/ScrollViewWin.cpp:
-
-2008-10-01  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21284
-        Bug 21284: Max height affects max width
-        - Looks like a cut and paste bug
-        - Added layout test fast/css/max-height-and-max-width.html
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-
-2008-10-01  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21282
-        
-        Make contentsToScreen/screenToContents cross-platform.  Only implemented by Mac/Win right now.
-        
-        Reviewed by Adam Roben
-
-        * loader/EmptyClients.h:
-        (WebCore::EmptyChromeClient::screenToWindow):
-        (WebCore::EmptyChromeClient::windowToScreen):
-        * page/Chrome.cpp:
-        (WebCore::Chrome::screenToWindow):
-        (WebCore::Chrome::windowToScreen):
-        * page/Chrome.h:
-        * page/ChromeClient.h:
-        * platform/HostWindow.h:
-        * platform/ScrollView.cpp:
         (WebCore::ScrollView::contentsToScreen):
         (WebCore::ScrollView::screenToContents):
-        (WebCore::ScrollView::platformContentsToScreen):
-        (WebCore::ScrollView::platformScreenToContents):
-        * platform/ScrollView.h:
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::platformContentsToScreen):
-        (WebCore::ScrollView::platformScreenToContents):
-        * platform/win/ScrollViewWin.cpp:
-
-2008-10-01  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Darin Adler.
-
-        - fix <rdar://problem/6255862> domfuzz: null deref in WebCore::HTMLParser::handleResidualStyleCloseTagAcrossBlocks(WebCore::HTMLStackElem*)
-
-        Test: fast/parser/residual-style-close-across-removed-block.html
-
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::handleResidualStyleCloseTagAcrossBlocks): Removed
-        an assertion that turned out to be wrong in this case, and changed to
-        terminate the algorithm at the first empty block.
-
-2008-10-01  David Hyatt  <hyatt@apple.com>
-
-        Make setFrameRect on ScrollView cross-platform.
-
-        Reviewed by Sam Weinig
-
-        * page/FrameView.h:
-        (WebCore::FrameView::contentsResized):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::setFrameRect):
-        * platform/ScrollView.h:
-        * platform/gtk/ScrollViewGtk.cpp:
-        * platform/qt/ScrollViewQt.cpp:
-        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::wheelEvent):
 
-2008-10-01  Sam Weinig  <sam@webkit.org>
+2009-06-20  Sam Weinig  <sam@webkit.org>
 
-        Reviewed by Adele Peterson.
+        Reviewed by Adam Barth.
 
-        Move setTimeout, clearTimeout, setInterval, clearInterval, atob and btoa
-        to JSDOMWindow from JSDOMWindowBase.
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26554
+        Shadowing of top and parent
 
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::removeTimeout):
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::setTimeoutOrInterval):
-        (WebCore::JSDOMWindow::setTimeout):
-        (WebCore::JSDOMWindow::clearTimeout):
-        (WebCore::JSDOMWindow::setInterval):
-        (WebCore::JSDOMWindow::clearInterval):
-        (WebCore::JSDOMWindow::atob):
-        (WebCore::JSDOMWindow::btoa):
         * page/DOMWindow.idl:
 
-2008-10-01  Dan Bernstein  <mitz@apple.com>
-
-        - Mac build fix
-
-        * WebCore.base.exp:
-
-2008-10-01  Timothy Hatcher  <timothy@apple.com>
-
-        Prevent stealing focus from the search field when focusing a DOM node.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21275
-
-        Reviewed by Kevin McCullough.
-
-        * page/inspector/ElementsPanel.js:
-        (WebInspector.ElementsPanel.treeOutline.focusedNodeChanged):
-        Don't steal focus if the current focus element is the search field.
-
-2008-09-30  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Nikolas Zimmermann and Alexey Proskuryakov.
-
-        Final patch for https://bugs.webkit.org/show_bug.cgi?id=21122
-        Autogenerate JS event listeners
-
-        - Generate getting/setting of EventListeners.
-
-        - Adding a new named EventListener now has the same process as adding any other DOM
-          attribute. (Add a method with the same name in the c++ file).
-
-        (The EventListeners for MessagePort have been intentionally left custom so that we
-        can continue to experiment with making those EventListeners work in a frame-less world.)
-
-        * bindings/js/JSDOMApplicationCacheCustom.cpp: Remove custom methods.
-        * bindings/js/JSDOMWindowCustom.cpp: ditto.
-        * bindings/js/JSEventTargetNodeCustom.cpp: ditto.
-        * bindings/js/JSXMLHttpRequestCustom.cpp: ditto.
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp: ditto.
-        * bindings/scripts/CodeGeneratorJS.pm: Add code to generate EventListener
-        getter/setters
-        * dom/EventTargetNode.cpp: Add getter/setters for named EventListener.
-        * dom/EventTargetNode.h: ditto.
-        * dom/EventTargetNode.idl: Mark EventListeners as Protected so that the codegenerator
-        will use JSEventListerner instead of JSUnprotectedEventListener.
-        * loader/appcache/DOMApplicationCache.idl: Remove custom attributes..
-        * page/DOMWindow.cpp: Add getter/setters for named EventListener
-        * page/DOMWindow.h: ditto.
-        * page/DOMWindow.idl: Mark EventListeners as Protected so that the codegenerator
-        will use JSEventListerner instead of JSUnprotectedEventListener.
-        * xml/XMLHttpRequest.idl: Remove custom attributes.
-        * xml/XMLHttpRequestUpload.idl: ditto.
-
-2008-09-30  Mark Rowe  <mrowe@apple.com>
+2009-06-20  Mark Rowe  <mrowe@apple.com>
 
         Reviewed by Dan Bernstein.
 
-        Add a leak counter for CachedResources since we've had two recent leaks involving them.
-
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::CachedResource):
-        (WebCore::CachedResource::~CachedResource):
-
-2008-09-30  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=21127
-          <rdar://problem/6259134> REGRESSION: CFF format fonts fail to load
-
-        If TTLoadEmbeddedFont fails, use AddFontMemResourceEx after changing
-        the font name in memory.
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=15106>.
+        Bug 15106: REGRESSION: Can't drag text as element when user-select is set to none
 
-        * WebCore.vcproj/WebCore.vcproj: Renamed GetEOTHeader.* to
-        OpenTypeUtilities.*.
+        We allow selections to begin within an element that has -webkit-user-select: none set,
+        unless the element is draggable as dragging should take priority over starting a selection.
 
-        * platform/graphics/win/FontCustomPlatformData.cpp:
-        (WebCore::FontCustomPlatformData::~FontCustomPlatformData): Added a call
-        to RemoveFontMemResourceEx to match AddFontMemResourceEx when it is
-        used.
-        (WebCore::FontCustomPlatformData::fontPlatformData): Added a code path
-        for fonts loaded using AddFontMemResourceEx.
-        (WebCore::createFontCustomPlatformData): Added a call to
-        renameAndActivateFont() if TTLoadEmbeddedFont fails. If
-        TTLoadEmbeddedFont succeeds, set the font name to the null string, as
-        fontPlatformData() will retrieve the name from the font reference.
+        Test: editing/selection/user-drag-element-and-user-select-none.html
 
-        * platform/graphics/win/FontCustomPlatformData.h:
-        (WebCore::FontCustomPlatformData::FontCustomPlatformData): Added a
-        font name member.
-
-        * platform/graphics/win/GetEOTHeader.cpp: Renamed.
-        * platform/graphics/win/GetEOTHeader.h: Renamed.
-
-        * platform/graphics/win/OpenTypeUtilities.cpp: Copied from platform/graphics/win/GetEOTHeader.cpp.
-        (WebCore::BigEndianUShort::BigEndianUShort): Added a constructor.
-        (WebCore::BigEndianULong::BigEndianULong): Ditto.
-        (WebCore::renameAndActivateFont): Added. Creates an in-memory copy of
-        the font data and modifies it to have the given name, then activates
-        it using AddFontMemResourceEx.
-
-        * platform/graphics/win/OpenTypeUtilities.h: Copied from platform/graphics/win/GetEOTHeader.h.
+        * dom/Node.cpp:
+        (WebCore::Node::canStartSelection):
 
-2008-09-30  Mark Rowe  <mrowe@apple.com>
+2009-06-20  Darin Adler  <darin@apple.com>
 
         Reviewed by Dan Bernstein.
 
-        Fix many leaks seen on fast/backgrounds/svg-as-mask.html.
-
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::arenaDelete): Balance the calls to addClient on maskLayer's images
-        with calls to removeClient when we're being destroyed.
-
-2008-09-30  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Antti Koivisto.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21243
-
-        Fix loopstart and loopend default values.
-
-        Tests: media/loopend-limits.html
-               media/loopstart-limits.html
+        Bug 26528: REGRESSION (r44674): Assertion in TextIterator::pushFullyClippedState while counting matches for "a" on apple.com
+        https://bugs.webkit.org/show_bug.cgi?id=26528
+        rdar://problem/6985329
 
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::loopStart): the spec says start() is the default value
-        (WebCore::HTMLMediaElement::loopEnd): the spec says end() is the default value
-
-2008-09-30  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fixes. Add file to build and remove call to (now gone) ScrollView::update.
-
-        * WebCoreSources.bkl:
-        * platform/wx/ScrollViewWx.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::OnScrollWinEvents):
-
-2008-09-30  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - fix HTMLViewSourceDocument leaks by breaking a ref cycle which
-          was fixed in r17249 and re-introduced in r31435. 
-
-        * html/HTMLViewSourceDocument.cpp:
-        (WebCore::HTMLViewSourceDocument::HTMLViewSourceDocument):
-        (WebCore::HTMLViewSourceDocument::addSpanWithClassName):
-        (WebCore::HTMLViewSourceDocument::addLine):
-        (WebCore::HTMLViewSourceDocument::addLink):
-        * html/HTMLViewSourceDocument.h:
-
-2008-09-30  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        More for https://bugs.webkit.org/show_bug.cgi?id=21122
-        Autogenerate JS event listeners
-
-        - Make EventListener getter/setters names in c++ files match those in 
-          JS (ie. onLoadListener -> onload).
-        - Add standard way to access the frame associated with the EventTarget
-          for EventListener lookup.
-        - Autogenerate dispatchEvent, it wasn't doing anything custom.
-
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::mark):
-        (WebCore::JSDOMApplicationCache::addEventListener):
-        (WebCore::JSDOMApplicationCache::removeEventListener):
-        (WebCore::JSDOMApplicationCache::setOnchecking):
-        (WebCore::JSDOMApplicationCache::onchecking):
-        (WebCore::JSDOMApplicationCache::setOnerror):
-        (WebCore::JSDOMApplicationCache::onerror):
-        (WebCore::JSDOMApplicationCache::setOnnoupdate):
-        (WebCore::JSDOMApplicationCache::onnoupdate):
-        (WebCore::JSDOMApplicationCache::setOndownloading):
-        (WebCore::JSDOMApplicationCache::ondownloading):
-        (WebCore::JSDOMApplicationCache::setOnprogress):
-        (WebCore::JSDOMApplicationCache::onprogress):
-        (WebCore::JSDOMApplicationCache::setOnupdateready):
-        (WebCore::JSDOMApplicationCache::onupdateready):
-        (WebCore::JSDOMApplicationCache::setOncached):
-        (WebCore::JSDOMApplicationCache::oncached):
-        * bindings/js/JSEventTargetNodeCustom.cpp:
-        (WebCore::JSEventTargetNode::addEventListener):
-        (WebCore::JSEventTargetNode::removeEventListener):
-        (WebCore::JSEventTargetNode::getListener):
-        (WebCore::JSEventTargetNode::setListener):
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::mark):
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        (WebCore::JSMessagePort::setOnmessage):
-        (WebCore::JSMessagePort::onmessage):
-        (WebCore::JSMessagePort::setOnclose):
-        (WebCore::JSMessagePort::onclose):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::mark):
-        (WebCore::JSXMLHttpRequest::onreadystatechange):
-        (WebCore::JSXMLHttpRequest::setOnreadystatechange):
-        (WebCore::JSXMLHttpRequest::onabort):
-        (WebCore::JSXMLHttpRequest::setOnabort):
-        (WebCore::JSXMLHttpRequest::onerror):
-        (WebCore::JSXMLHttpRequest::setOnerror):
-        (WebCore::JSXMLHttpRequest::onload):
-        (WebCore::JSXMLHttpRequest::setOnload):
-        (WebCore::JSXMLHttpRequest::onloadstart):
-        (WebCore::JSXMLHttpRequest::setOnloadstart):
-        (WebCore::JSXMLHttpRequest::onprogress):
-        (WebCore::JSXMLHttpRequest::setOnprogress):
-        (WebCore::JSXMLHttpRequest::addEventListener):
-        (WebCore::JSXMLHttpRequest::removeEventListener):
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::mark):
-        (WebCore::JSXMLHttpRequestUpload::onabort):
-        (WebCore::JSXMLHttpRequestUpload::setOnabort):
-        (WebCore::JSXMLHttpRequestUpload::onerror):
-        (WebCore::JSXMLHttpRequestUpload::setOnerror):
-        (WebCore::JSXMLHttpRequestUpload::onload):
-        (WebCore::JSXMLHttpRequestUpload::setOnload):
-        (WebCore::JSXMLHttpRequestUpload::onloadstart):
-        (WebCore::JSXMLHttpRequestUpload::setOnloadstart):
-        (WebCore::JSXMLHttpRequestUpload::onprogress):
-        (WebCore::JSXMLHttpRequestUpload::setOnprogress):
-        (WebCore::JSXMLHttpRequestUpload::addEventListener):
-        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * dom/EventTarget.h:
-        * dom/EventTargetNode.cpp:
-        (WebCore::EventTargetNode::associatedFrame):
-        * dom/EventTargetNode.h:
-        * dom/EventTargetNode.idl:
-        * dom/MessagePort.cpp:
-        (WebCore::MessagePort::associatedFrame):
-        * dom/MessagePort.h:
-        (WebCore::MessagePort::setOnmessage):
-        (WebCore::MessagePort::onmessage):
-        (WebCore::MessagePort::setOnclose):
-        (WebCore::MessagePort::onclose):
-        * dom/MessagePort.idl:
-        * loader/appcache/DOMApplicationCache.h:
-        (WebCore::DOMApplicationCache::setOnchecking):
-        (WebCore::DOMApplicationCache::onchecking):
-        (WebCore::DOMApplicationCache::setOnerror):
-        (WebCore::DOMApplicationCache::onerror):
-        (WebCore::DOMApplicationCache::setOnnoupdate):
-        (WebCore::DOMApplicationCache::onnoupdate):
-        (WebCore::DOMApplicationCache::setOndownloading):
-        (WebCore::DOMApplicationCache::ondownloading):
-        (WebCore::DOMApplicationCache::setOnprogress):
-        (WebCore::DOMApplicationCache::onprogress):
-        (WebCore::DOMApplicationCache::setOnupdateready):
-        (WebCore::DOMApplicationCache::onupdateready):
-        (WebCore::DOMApplicationCache::setOncached):
-        (WebCore::DOMApplicationCache::oncached):
-        (WebCore::DOMApplicationCache::associatedFrame):
-        * loader/appcache/DOMApplicationCache.idl:
-        * svg/EventTargetSVGElementInstance.cpp:
-        (WebCore::EventTargetSVGElementInstance::associatedFrame):
-        (WebCore::EventTargetSVGElementInstance::addEventListener):
-        (WebCore::EventTargetSVGElementInstance::removeEventListener):
-        (WebCore::EventTargetSVGElementInstance::dispatchEvent):
-        * svg/EventTargetSVGElementInstance.h:
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::associatedFrame):
-        * xml/XMLHttpRequest.h:
-        (WebCore::XMLHttpRequest::setOnreadystatechange):
-        (WebCore::XMLHttpRequest::onreadystatechange):
-        (WebCore::XMLHttpRequest::setOnabort):
-        (WebCore::XMLHttpRequest::onabort):
-        (WebCore::XMLHttpRequest::setOnerror):
-        (WebCore::XMLHttpRequest::onerror):
-        (WebCore::XMLHttpRequest::setOnload):
-        (WebCore::XMLHttpRequest::onload):
-        (WebCore::XMLHttpRequest::setOnloadstart):
-        (WebCore::XMLHttpRequest::onloadstart):
-        (WebCore::XMLHttpRequest::setOnprogress):
-        (WebCore::XMLHttpRequest::onprogress):
-        * xml/XMLHttpRequest.idl:
-        * xml/XMLHttpRequestUpload.cpp:
-        (WebCore::XMLHttpRequestUpload::associatedFrame):
-        * xml/XMLHttpRequestUpload.h:
-        (WebCore::XMLHttpRequestUpload::setOnabort):
-        (WebCore::XMLHttpRequestUpload::onabort):
-        (WebCore::XMLHttpRequestUpload::setOnerror):
-        (WebCore::XMLHttpRequestUpload::onerror):
-        (WebCore::XMLHttpRequestUpload::setOnload):
-        (WebCore::XMLHttpRequestUpload::onload):
-        (WebCore::XMLHttpRequestUpload::setOnloadstart):
-        (WebCore::XMLHttpRequestUpload::onloadstart):
-        (WebCore::XMLHttpRequestUpload::setOnprogress):
-        (WebCore::XMLHttpRequestUpload::onprogress):
-        * xml/XMLHttpRequestUpload.idl:
-
-2008-09-30  Darin Adler  <darin@apple.com>
-
-        - roll out assertion breaking regression tests
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::repaintContentRectangle): Temporarily remove assertion
-        that fires in regression tests. Hyatt can add it back later. The assertion
-        fires in the regression test because of layout that triggers repaint occuring
-        during the process of removing a frame.
-
-2008-09-30  Adele Peterson  <adele@apple.com>
-
-        Reviewed by Darin Adler.
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::handleReplacedElement): When entering a text control,
+        start at the top of the shadow tree (by calling shadowTreeRootNode). Also
+        remove assumption that innerTextElement will never be 0 since RenderTextControl
+        doesn't really guarantee this.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21227
-        <rdar://problem/6222134> add a way to set color for input placeholder text
+2009-06-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
 
-        Test: fast/forms/placeholder-pseudo-style.html
+        Reviewed by NOBODY.
 
-        This change adds "-webkit-input-placeholder-mode" as a pseudo class that can be used to style
-        input elements when they are displaying the placeholder text.
+        Speculative Qt build fix - add HTMLDataGridColElement to the build script.
 
-        * css/CSSSelector.cpp: (WebCore::CSSSelector::extractPseudoType): Add case for inputPlaceholderMode.
-        * css/CSSSelector.h: (WebCore::CSSSelector::): Add PseudoInputPlaceholderMode.
-        * css/CSSStyleSelector.cpp: (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
-        Add check for PseudoInputPlaceholderMode that asks the node if placeholderShouldBeVisible is true.
-        * css/html4.css: Add rule to make placeholder text default to darkGray.
+        * WebCore.pro:
 
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::init): Initialize m_placeholderShouldBeVisible.
-        (WebCore::HTMLInputElement::dispatchFocusEvent): Call updatePlaceholderVisibility.
-        (WebCore::HTMLInputElement::dispatchBlurEvent): ditto.
-        (WebCore::HTMLInputElement::parseMappedAttribute): ditto.
-        (WebCore::HTMLInputElement::setValue): ditto.
-        (WebCore::HTMLInputElement::setValueFromRenderer): ditto.
-        (WebCore::HTMLInputElement::updatePlaceholderVisibility): Sets m_placeholderShouldBeVisible based on the current value and the focus state.
-         This calculation used to be done in the renderer, but since the node knows everything about the state, it can make that decision, and the
-         renderer will just ask the node if it should draw the placeholder.
-        * html/HTMLInputElement.h: (WebCore::HTMLInputElement::placeholderShouldBeVisible):
-
-        * rendering/RenderTextControl.cpp:
-        (WebCore::disabledTextColor): Moved to the top of the file.  If there's not very much contrast between the disabled color and the background color,
-        just leave the text color alone.  We don't want to change a good contrast color scheme so that it has really bad contrast.
-        If the the contrast was already poor, then it doesn't do any good to change it to a different poor contrast color scheme.
-        (WebCore::RenderTextControl::createInnerTextStyle): If the node says the placeholder should be visible, prepare by overriding the text security to be "none".
-        This can only happen as a result of either a setStyle call (which will be followed by a call to updateFromElement) or from createSubtreeIfNeeded, which
-        is called directly from updateFromElement.  updateFromElement will immediately update the text displayed.
-        (WebCore::RenderTextControl::updateFromElement): If the placeholder visibility has changed, update the text that is displayed.
-        (WebCore::RenderTextControl::forwardEvent): Remove calls to update the placeholder state.  This is now done in HTMLInputElement.
-        * rendering/RenderTextControl.h:
-
-2008-09-30  Beth Dakin  <bdakin@apple.com>
+2009-06-19  Adam Barth  <abarth@webkit.org>
 
         Reviewed by Darin Adler.
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=20396 Abort caused 
-        by failed allocation due to invalid counter/attr
-        and corresponding: <rdar://problem/6152371>
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseCounterContent): The spec indicates that 
-        only identifiers should be accepted here.
-
-2008-09-30  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 21255: console.profileEnd() without a console.profile() crashes the
-        web inspector
-
-        * page/Console.cpp:
-        (WebCore::Console::profileEnd):
-
-2008-09-30  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        Bug 21252: calling console.profile() with a title that is 2 chars or
-        shorter does not linkify it
+        https://bugs.webkit.org/show_bug.cgi?id=26561
 
-        - Previously we tried to not linkify very short URLs but since profile
-        titles can be any length this is not always true.
+        Remove a memcpy by retrieving the already existing copy of a string
+        instead of making a new one.
 
-        * page/inspector/inspector.js:
+        * bindings/js/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        (WebCore::ScriptSourceCode::source):
+        * bindings/js/StringSourceProvider.h:
+        (WebCore::StringSourceProvider::source):
 
-2008-09-30  Dave Hyatt  <hyatt@apple.com>
+2009-06-19  Brian Weinstein  <bweinstein@apple.com>
 
-        Remove the update() method on ScrollView.  This method was only called in one place, and its purpose
-        was to cause a display/flush to happen.  Here is a breakdown of the method use on each platform:
-        (1) Not used on Mac
-        (2) Used on Windows
-        (3) Used on Qt, but implemented incorrectly to cause a full repaint for no reason.
-        (4) Used on Gtk, but implemented incorrectly to cause a full repaint for no reason.
-        (5) Used on wx, but probably not needed (since wx has platform widgets like Mac).
+        Reviewed by Steve Falkenburg.
         
-        There is now a paint method on HostWindow that does an immediate mode repaint of an empty rect to
-        cause the display/flush to happen if needed (thus saving an extra method on ChromeClient).
-        With the changes to this method, the new behavior is as follows:
-        (1) Not used on Mac
-        (2) Used on Windows
-        (3) Nothing happens on Qt, but only because they have not implemented immediate mode updating.
-        (4) Gtk now behaves like Windows and will process updates but not do any incorrect additional invalidation.
-        (5) Not used on wx
+        https://bugs.webkit.org/show_bug.cgi?id=26488
+        No Support for Single Finger or Two Finger Panning in Windows 7
         
-        This method was originally added for Windows. It's not clear the display/flush is really even necessary on the other
-        platforms.  At the very least stopping unnecessary full invalidations on Qt/Gtk is a good thing. :)
+        The code in WebCore allows us to interpret a Pan gesture as
+        a mousewheel event, and we are able to reuse the scrolling code.
+        Another constructor was created in WheelEventWin which takes data
+        better suited to the pan guesture than what was currently there. 
         
-        Reviewed by Sam Weinig
-
-        * ChangeLog:
-        * dom/Document.cpp:
-        (WebCore::Document::implicitClose):
-        * platform/HostWindow.h:
-        (WebCore::HostWindow::paint):
-        * platform/ScrollView.h:
-        * platform/gtk/ScrollViewGtk.cpp:
-        * platform/mac/ScrollViewMac.mm:
-        * platform/qt/ScrollViewQt.cpp:
-        * platform/win/ScrollViewWin.cpp:
-        * platform/wx/ScrollViewWx.cpp:
-
-2008-09-30  Timothy Hatcher  <timothy@apple.com>
-
-        Focus the DOM tree in the Web Inspector when a node is inspected.
-        So when the search field has focus, the focus moves to the tree,
-        allowing the arrow keys work. This can happen when using the new
-        find in page feature.
+        Unable to add tests to simulate touch behavior/gestures.
 
-        https://bugs.webkit.org/show_bug.cgi?id=21251
-
-        Reviewed by Geoff Garen.
-
-        * page/inspector/ElementsPanel.js:
-        (WebInspector.ElementsPanel): Set currentFocusElement to
-        the main-panels element if the panel is visible.
-        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
-        Remove a set of currentFocusElement since this moved.
-        * page/inspector/inspector.js:
-        (WebInspector.set currentFocusElement): Always focus the element.
-        This ensures that when focus changes in the page and we don't
-        catch it, we will still focus the elements even if we think it
-        was already focused.
-
-2008-09-30  Timothy Hatcher  <timothy@apple.com>
-
-        Make the Web Inspector's toolbar icons darker when the mouse is
-        pressed on them. This matches the standard NSToolbar look.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21249
-        rdar://problem/6033752
-
-        Reviewed by Adam Roben.
-
-        * page/inspector/Images/databasesIcon.png:
-        * page/inspector/Images/elementsIcon.png:
-        * page/inspector/Images/profilesIcon.png:
-        * page/inspector/Images/resourcesIcon.png:
-        * page/inspector/Images/scriptsIcon.png:
-        * page/inspector/Panel.js:
-        * page/inspector/inspector.css:
+        * platform/PlatformWheelEvent.h:
+        * platform/win/WheelEventWin.cpp:
 
-2008-09-30  Kevin McCullough  <kmccullough@apple.com>
+2009-06-19  Chris Marrin  <cmarrin@apple.com>
 
-        Reviewed by Tim Hatcher.
+        Fixed a build error, which only shows up in the i386 compile
 
-        Bug 21139: Profiler log message is wrong
-        - Correctly fix =(
-        Don't call _format twice.
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::animateTransform):
 
-        * page/Page.h:
-        * page/inspector/Console.js:
-        * page/inspector/ProfilesPanel.js:
-        * page/inspector/inspector.js:
+2009-06-19  Simon Fraser  <simon.fraser@apple.com>
 
-2008-09-30  Dave Hyatt  <hyatt@apple.com>
+        Reviewed by Oliver Hunt.
 
-        http://bugs.webkit.org/show_bug.cgi?id=21250
+        <rdar://problem/6988385> REGRESSION: In full page video player, movie's
+        video track becomes detached from its controller.
         
-        Rename updateContents to repaintContentRectangle and make it cross-platform by always sending
-        repaints up through the ChromeClient.
-
-        Reviewed by Darin Adler
-
-        * loader/EmptyClients.h:
-        (WebCore::EmptyChromeClient::repaint):
-        * page/Chrome.cpp:
-        (WebCore::Chrome::repaint):
-        * page/Chrome.h:
-        * page/ChromeClient.h:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::hostWindow):
-        (WebCore::FrameView::repaintContentRectangle):
-        * page/FrameView.h:
-        * platform/HostWindow.h:
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::repaintContentRectangle):
-        (WebCore::ScrollView::platformRepaintContentRectangle):
-        * platform/ScrollView.h:
-        * platform/gtk/ScrollViewGtk.cpp:
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::platformRepaintContentRectangle):
-        * platform/qt/ScrollViewQt.cpp:
-        * platform/win/ScrollViewWin.cpp:
-        * platform/wx/ScrollViewWx.cpp:
-        (WebCore::ScrollView::platformRepaintContentRectangle):
-
-2008-09-30  Alexey Proskuryakov  <ap@webkit.org>
-
-        Non-Mac build fixes.
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCoreSources.bkl:
-        * webcore-base.bkl:
-        Added DOMProtect.{cpp,h}.
-
-2008-09-39  Kevin Decker  <kdecker@apple.com>
-
-        Reviewed by John Sullivan.
-
-        * bridge/npapi.h: Added skeleton for a new plug-in drawing model, the NPCoreAnimationDrawingModel. This model will eventually pave the way
-        for hardware accelerated drawing in plug-ins and out of process plug-in rendering.
-
-2008-09-29  Julien Chaffraix  <jchaffraix@webkit.org>
+        When in the media document, the MediaPlayer should not report that it
+        is capable of hardware acceleration, because it renders via a QTMovieView
+        which is already accelerated.
 
-        Reviewed by Maciej Stachowiak.
-
-        Bug 21106: .in format discussed changes
-        https://bugs.webkit.org/show_bug.cgi?id=21106
-
-        - Removed "cppNamespace" global parameter and hard-coded "WebCore" as it
-        is the only namespace used.
-
-        - Removed "generateFactory" and "generateWrapperFactory" parameters and
-        re-introduced the command line options.
-
-        - Cleaned up the output of make_names.pl (removed unneeded new line).
-
-        * DerivedSources.make: Added factories command line options.
-        * GNUmakefile.am: Ditto.
-        * WebCore.pro: Ditto and removed some arguments that were migrated to
-        the .in files.
-
-        * dom/make_names.pl: Clean up (see above).
-
-        * html/HTMLAttributeNames.in: Removed "cppNamespace", "generateFactory"
-        and "generateWrapperFactory" occurences.
-        * html/HTMLTagNames.in: Ditto.
-        * svg/svgattrs.in: Ditto.
-        * svg/svgtags.in: Ditto.
-        * svg/xlinkattrs.in: Ditto.
-        * xml/xmlattrs.in: Ditto.
-
-2008-09-29  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by John Sullivan.
-
-        <rdar://problem/6255456> AX: <file> input button shouldn't have children exposed
-        Make sure that certain types of elements do not return children and, moreover, do not waste their
-        energy trying to return children
-
-        Test: accessibility/nochildren-elements.html
-
-        * page/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::canHaveChildren):
-        * page/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::canHaveChildren):
-        (WebCore::AccessibilityRenderObject::addChildren):
-        * page/AccessibilityRenderObject.h:
-
-2008-09-30  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21213
-        MessagePort crash when GC collects an object with a pending close event
-
-        Test: fast/events/message-channel-gc-2.html
-              fast/events/message-channel-listener-circular-ownership.html
-
-        * bindings/DOMProtect.cpp: Added.
-        (WebCore::gcProtectDOMObject):
-        (WebCore::gcUnprotectDOMObject):
-        * bindings/DOMProtect.h: Added.
-        Added an abstraction for GC protection to avoid the need to call JS bindings code from
-        DOM objects directly.
-
-        * dom/MessagePort.cpp:
-        (WebCore::CloseMessagePortTimer::fired):
-        (WebCore::MessagePort::queueCloseEvent):
-        GC protect MessagePort wrapper while there is a pending close event.
-        This may be necessary for message events, too, but that case is not a crasher, and actually
-        behaves to the letter of the current HTML5 text, so I'll consider it later.
-
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
-        (WebCore::XMLHttpRequest::dropProtection):
-        Use gcProtectDOMObject here, too. Unfortunately, XMLHttpRequest has more dependencies on JSC.
-
-        * bindings/js/JSMessagePortCustom.cpp:
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        (WebCore::JSMessagePort::setOnmessage):
-        (WebCore::JSMessagePort::setOnclose):
-        Don't tell DOMWindowBase that MessagePort is a NodeEventTarget, this is not true. I do not
-        know if this was causing any real issues, but we shouldn't lie to DOMWindowBase.
-
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::mark):
-        While at it, changed to use a typedef for event listeners from XMLHttpRequestUpload, not
-        from XMLHttpRequest.
-
-2008-09-30  Adam Roben  <aroben@apple.com>
-
-        Windows build fix
-
-        * DerivedSources.cpp: Add JSEventTargetNode.cpp.
-
-2008-09-29  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Tim Hatcher.
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
 
-        Patch for https://bugs.webkit.org/show_bug.cgi?id=21122
-        Autogenerate JS event listeners
+2009-06-19  Kevin Ollivier  <kevino@theolliviers.com>
 
-        - Generate EventTargetNode.
+        Adding XSSAuditor.cpp to the wx build.
 
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
         * WebCoreSources.bkl:
-        * bindings/js/JSEventListener.cpp:
-        * bindings/js/JSEventTarget.cpp: Added.
-        (WebCore::toJS):
-        * bindings/js/JSEventTarget.h: Added.
-        * bindings/js/JSEventTargetBase.cpp: Removed.
-        * bindings/js/JSEventTargetBase.h:
-        * bindings/js/JSEventTargetNode.cpp: Removed.
-        * bindings/js/JSEventTargetNode.h: Removed.
-        * bindings/js/JSEventTargetNodeCustom.cpp: Added.
-        (WebCore::JSEventTargetNode::addEventListener):
-        (WebCore::JSEventTargetNode::removeEventListener):
-        (WebCore::JSEventTargetNode::dispatchEvent):
-        (WebCore::JSEventTargetNode::getListener):
-        (WebCore::JSEventTargetNode::setListener):
-        (WebCore::JSEventTargetNode::pushEventHandlerScope):
-        * bindings/js/JSEventTargetSVGElementInstance.cpp:
-        (WebCore::):
-        (WebCore::JSEventTargetSVGElementInstancePrototype::self):
-        (WebCore::JSEventTargetSVGElementInstancePrototype::getOwnPropertySlot):
-        (jsEventTargetAddEventListener):
-        (jsEventTargetRemoveEventListener):
-        (jsEventTargetDispatchEvent):
-        * bindings/js/JSEventTargetSVGElementInstance.h:
-        (WebCore::JSEventTargetSVGElementInstancePrototype::JSEventTargetSVGElementInstancePrototype):
-        (WebCore::JSEventTargetSVGElementInstancePrototype::classInfo):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * dom/EventTargetNode.idl: Added.
-
-2008-09-29  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=21214
-          work on getting rid of ExecState
-
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::JSDOMWindowBase): Removed globalThisValue argument
-        for base class constructor.
-
-2008-09-29  David Hyatt  <hyatt@apple.com>
-
-        Add the new HostWindow base class.  A HostWindow hosts a hierarchy of Widgets.  The Chrome object on Page
-        now subclasses from HostWindow.  The new class will allow objects in platform/ like Widgets, Scrollbars
-        and ScrollViews to talk to the HostWindow object in order to do backing store operations and invalidations.
-        (Right now the platform layering is simply being violated by ScrollViews going directly to the ChromeClient.)
-
-        Reviewed by Sam Weinig
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * page/Chrome.h:
-        * platform/HostWindow.h: Added.
-        (WebCore::HostWindow::HostWindow):
-        (WebCore::HostWindow::~HostWindow):
-
-2008-09-29  Kevin Decker  <kdecker@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        * bridge/npapi.h: Tweaked NPNVariable enum. NPNVsupportsCocoaBool,  NPNVsupportsCarbonBool are now in the 3000 range instead of 
-        2000. 
-
-2008-09-29  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Adam Roben.
-
-        - WebCore part of fixing <rdar://problem/6247906> REGRESSION (r19500): Crash on quit beneath CloseThemeData
-
-        * rendering/RenderThemeWin.cpp:
-        (WebCore::RenderThemeWin::setWebKitIsBeingUnloaded): Added.
-        (WebCore::RenderThemeWin::~RenderThemeWin): Check if WebKit is being
-        unloaded, to avoid calling uxtheme.dll functions after that library has
-        been unloaded.
-        * rendering/RenderThemeWin.h:
-
-2008-09-29  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by John Sullivan
-
-        <rdar://problem/6240743> AXLoadComplete is sent for non-top level web areas and bogus web areas
 
-        Sends AXLoadComplete only when the top level web area is finished loading
+2009-06-19  Chris Marrin  <cmarrin@apple.com>
 
-        * dom/Document.cpp:
-        (WebCore::Document::implicitClose):
-
-2008-09-29  Timothy Hatcher  <timothy@apple.com>
-
-        Makes the node highlight always show up when hovering a node in
-        the Web Inspector now that the highlight does not scroll to reveal
-        the node. Also adds a hover effect in the inspector when hovering
-        causes a highlight in the page. This ties the user hovering action
-        to the highlight so it is clear what causes the highlight to appear.
-
-        Also the highlight now temporarily shows up for 2 seconds after
-        selecting a node in the DOM tree. So arrowing around in the tree
-        will show the node on the page, providing feedback to the user.
-
-        Plus fixes an issue where quickly moving away from hovering
-        a node would keep showing the page highlight. This was happening
-        in breadcrumbs and the DOM tree.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21220
-
-        Reviewed by Kevin McCullough.
-
-        * page/inspector/Console.js:
-        (WebInspector.Console.prototype._mouseOverNode): Added. Used for
-        hovering DOM nodes in the console.
-        (WebInspector.Console.prototype._mouseOutOfNode): Ditto.
-        (WebInspector.Console.prototype._formatnode): Use the new event
-        listeners and add a class name to the anchor element.
-        * page/inspector/ElementsPanel.js:
-        (WebInspector.ElementsPanel): Add new event listeners to the
-        crumbs element to do the node hovering highlight.
-        (WebInspector.ElementsPanel.prototype.hide):
-        (WebInspector.ElementsPanel.prototype.reset):
-        (WebInspector.ElementsPanel.prototype._mouseMovedInCrumbs):
-        (WebInspector.ElementsPanel.prototype._mouseMovedOutOfCrumbs):
-        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
-        * page/inspector/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode):
-        Show the node hishlight for 2 seconds then restore the highlight
-        to the current hovered node.
-        (WebInspector.ElementsTreeOutline.prototype._onmousemove): Set the
-        hovered node and set the hovered state on the tree element.
-        (WebInspector.ElementsTreeOutline.prototype._onmouseout): Set the
-        hovered node to null and removed the hovered state from the previous
-        hovered tree element.
-        (WebInspector.ElementsTreeElement.prototype.set/get hovered): Adds
-        the hovered class to the list item.
-        (WebInspector.ElementsTreeElement.prototype.onattach): Ditto.
-        * page/inspector/inspector.css:
-        * page/inspector/inspector.js:
-        (WebInspector.set hoveredDOMNode): Pass a delay to _updateHoverHighlightSoon
-        based on the showingDOMNodeHighlight property of 50ms or 500ms. This
-        causes the highlight to change sooner if there is one already showing
-        and appear later if there isn't one showing. This is like tooltips,
-        hovering a node for 500ms will cause highlight then mousing between nodes
-        will keep the highlight and change to the new node.
-        (WebInspector._updateHoverHighlightSoon): Take a delay being passed in and
-        always reset the timeout so continuous mousing does not keep flasshing
-        the highlight on the screen.
-        (WebInspector._updateHoverHighlight): Removed the alt key check and added
-        the showingDOMNodeHighlight property.
-        (WebInspector.documentKeyDown): Removed the alt key check.
-        (WebInspector.documentKeyUp): Ditto.
-        (WebInspector.reset): Clear the hoveredDOMNode.
-
-2008-09-29  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Anders Carlsson
-
-        Fix RenderStyle leak in animation code, and assert that 
-        keyframe resolution in CSSStyleSelector is not going to clobber
-        m_style.
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
-        * page/animation/KeyframeAnimation.cpp:
-        (WebCore::KeyframeAnimation::~KeyframeAnimation):
-
-2008-09-29  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=20995
-        Rewrite keyframe resolution to be like styleForElement()
-        
-        Test: animations/lineheight-animation.html
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::addKeyframeStyle):
-        (WebCore::CSSStyleSelector::~CSSStyleSelector):
-        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
-        (WebCore::CSSRuleSet::addRulesFromSheet):
-        (WebCore::CSSStyleSelector::mapAnimationName):
-        * css/CSSStyleSelector.h:
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimation::updateKeyframeAnimations):
-        * page/animation/KeyframeAnimation.cpp:
-        (WebCore::KeyframeAnimation::KeyframeAnimation):
-        (WebCore::KeyframeAnimation::animate):
-        (WebCore::KeyframeAnimation::hasAnimationForProperty):
-        (WebCore::KeyframeAnimation::sendAnimationEvent):
-        (WebCore::KeyframeAnimation::overrideAnimations):
-        (WebCore::KeyframeAnimation::resumeOverriddenAnimations):
-        (WebCore::KeyframeAnimation::affectsProperty):
-        (WebCore::KeyframeAnimation::validateTransformFunctionList):
-        * page/animation/KeyframeAnimation.h:
-        * rendering/style/Animation.cpp:
-        (WebCore::Animation::animationsMatch):
-        * rendering/style/Animation.h:
-        * rendering/style/KeyframeList.cpp:
-        (WebCore::KeyframeList::~KeyframeList):
-        (WebCore::KeyframeList::clear):
-        (WebCore::KeyframeList::insert):
-        * rendering/style/KeyframeList.h:
-        (WebCore::KeyframeValue::KeyframeValue):
-        (WebCore::KeyframeList::KeyframeList):
-        (WebCore::KeyframeList::operator!=):
-        (WebCore::KeyframeList::animationName):
-        (WebCore::KeyframeList::addProperty):
-        (WebCore::KeyframeList::containsProperty):
-        (WebCore::KeyframeList::beginProperties):
-        (WebCore::KeyframeList::endProperties):
-        (WebCore::KeyframeList::isEmpty):
-        (WebCore::KeyframeList::size):
-        (WebCore::KeyframeList::beginKeyframes):
-        (WebCore::KeyframeList::endKeyframes):
-        * rendering/style/RenderStyle.h:
-        * rendering/style/StyleRareNonInheritedData.cpp:
-        * rendering/style/StyleRareNonInheritedData.h:
-
-2008-09-29  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Eric Seidel
-
-        Clean up fix in PropertyWrapperGetter::equals
-        https://bugs.webkit.org/show_bug.cgi?id=21011
-        
-        Test: transitions/override-transition-crash.html
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::PropertyWrapperGetter::equals):
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimation::updateTransitions):
-
-2008-09-29  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Eric Seidel
-
-        https://bugs.webkit.org/show_bug.cgi?id=21001
-        Starting transition after animation, when animation
-        is finished, transition is wrong.
-
-        Test: animations/transition-and-animation-2.html
-
-        * page/animation/AnimationBase.h:
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimation::updateTransitions):
-        (WebCore::CompositeAnimation::updateKeyframeAnimations):
-        (WebCore::CompositeAnimation::resetTransitions):
-        (WebCore::CompositeAnimation::cleanupFinishedAnimations):
-        * page/animation/ImplicitAnimation.cpp:
-        (WebCore::ImplicitAnimation::ImplicitAnimation):
-        (WebCore::ImplicitAnimation::~ImplicitAnimation):
-        (WebCore::ImplicitAnimation::animate):
-        (WebCore::ImplicitAnimation::reset):
-        * page/animation/ImplicitAnimation.h:
-
-2008-09-29  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Sam Weinig
-
-        https://bugs.webkit.org/show_bug.cgi?id=20921
-        -webkit-animation-timing-function: inside of keyframes is ignored
-
-        Test: animations/keyframe-timing-functions.html
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::progress):
-        * page/animation/AnimationBase.h:
-        * page/animation/ImplicitAnimation.cpp:
-        (WebCore::ImplicitAnimation::animate):
-        * page/animation/KeyframeAnimation.cpp:
-        (WebCore::KeyframeAnimation::animate):
-
-2008-09-29  Dan Bernstein  <mitz@apple.com>
-
-        - Windows build fix
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::platformScroll):
-
-2008-09-29  Dan Bernstein  <mitz@apple.com>
-
-        - another attempt at a Windows build fix
-
-        * platform/ScrollView.cpp:
-        (WebCore::platformScroll):
-
-2008-09-29  Dan Bernstein  <mitz@apple.com>
-
-        - Windows build fix
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::platformSetScrollPosition):
-
-2008-09-29  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21218
-
-        Accidentally removed a check to see if the scrollbar modes were equal.  This caused a crash on Windows.
-        It's silly that the code was this fragile, but for now just put the check back in.
-
-        Reviewed by Dan Bernstein
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::setScrollbarModes):
-
-2008-09-29  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21216
-
-        Make setScrollPosition and scroll() cross-platform.
-
-        Reviewed by Anders
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::setScrollPosition):
-        (WebCore::ScrollView::scroll):
-        * platform/ScrollView.h:
-        * platform/gtk/ScrollViewGtk.cpp:
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::platformSetScrollPosition):
-        (WebCore::ScrollView::platformScroll):
-        * platform/qt/ScrollViewQt.cpp:
-        * platform/win/ScrollViewWin.cpp:
-        * platform/wx/ScrollViewWx.cpp:
-        (WebCore::ScrollView::platformSetScrollPosition):
-        (WebCore::ScrollView::platformScroll):
-
-2008-09-29  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Oliver.
-
-        Bug 21139: Profiler log message is wrong
-        - Because _format was called twice the number in the log was incremented
-        too many times, but we were passing it around in the link the whole time
-
-        * page/inspector/ProfilesPanel.js:
-        * page/inspector/inspector.js:
-
-2008-09-29  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Cameron Zwarich.
-
-        Autogenerate EventListeners, addEventListener and removeEventListener
-        for JSDOMWindow.
-
-        * bindings/js/JSDOMWindowBase.cpp:
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::onwebkitanimationstart):
-        (WebCore::JSDOMWindow::setOnwebkitanimationstart):
-        (WebCore::JSDOMWindow::onwebkitanimationiteration):
-        (WebCore::JSDOMWindow::setOnwebkitanimationiteration):
-        (WebCore::JSDOMWindow::onwebkitanimationend):
-        (WebCore::JSDOMWindow::setOnwebkitanimationend):
-        (WebCore::JSDOMWindow::onwebkittransitionend):
-        (WebCore::JSDOMWindow::setOnwebkittransitionend):
-        (WebCore::JSDOMWindow::addEventListener):
-        (WebCore::JSDOMWindow::removeEventListener):
-        (WebCore::JSDOMWindow::setListener):
-        (WebCore::JSDOMWindow::getListener):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * page/DOMWindow.idl:
-
-2008-09-29  Thiago Macieira  <thiago.macieira@nokia.com>
-
-        Reviewed by Simon.
-
-        Changed copyright from Trolltech ASA to Nokia.
-
-        Nokia acquired Trolltech ASA, assets were transferred on September 26th 2008.
-
-        * bindings/js/JSMimeTypeArrayCustom.cpp:
-        * bindings/js/JSNavigatorCustom.cpp:
-        * bindings/js/JSPluginArrayCustom.cpp:
-        * bindings/js/JSPluginCustom.cpp:
-        * bindings/js/ScriptControllerMac.mm:
-        * bindings/js/ScriptControllerQt.cpp:
-        * bridge/qt/qt_class.cpp:
-        * bridge/qt/qt_class.h:
-        * bridge/qt/qt_instance.cpp:
-        * bridge/qt/qt_instance.h:
-        * bridge/qt/qt_runtime.cpp:
-        * bridge/qt/qt_runtime.h:
-        * bridge/testqtbindings.cpp:
-        * css/makegrammar.pl:
-        * css/makeprop.pl:
-        * css/makevalues.pl:
-        * dom/Node.cpp:
-        * dom/TagNodeList.cpp:
-        * dom/TagNodeList.h:
-        * dom/XMLTokenizer.cpp:
-        * dom/XMLTokenizer.h:
-        * dom/XMLTokenizerLibxml2.cpp:
-        * dom/XMLTokenizerQt.cpp:
-        * editing/Editor.cpp:
-        * editing/EditorCommand.cpp:
-        * html/CanvasRenderingContext2D.cpp:
-        * html/CanvasStyle.cpp:
-        * html/HTMLAppletElement.cpp:
-        * html/HTMLEmbedElement.cpp:
-        * html/HTMLObjectElement.cpp:
-        * loader/FrameLoader.cpp:
-        * page/Chrome.cpp:
-        * page/EditorClient.h:
-        * page/Frame.cpp:
-        * page/Frame.h:
-        * page/FramePrivate.h:
-        * page/Navigator.cpp:
-        * page/Navigator.h:
-        * page/Navigator.idl:
-        * page/mac/FrameMac.mm:
-        * page/qt/EventHandlerQt.cpp:
-        * platform/graphics/qt/FontCacheQt.cpp:
-        * platform/graphics/qt/FontCustomPlatformData.cpp:
-        * platform/graphics/qt/FontCustomPlatformData.h:
-        * platform/graphics/qt/FontPlatformData.h:
-        * platform/graphics/qt/FontQt.cpp:
-        * platform/graphics/qt/GlyphPageTreeNodeQt.cpp:
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        * platform/graphics/qt/ImageDecoderQt.cpp:
-        * platform/graphics/qt/ImageDecoderQt.h:
-        * platform/graphics/qt/ImageSourceQt.cpp:
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
-        * platform/graphics/qt/SimpleFontDataQt.cpp:
-        * platform/gtk/MIMETypeRegistryGtk.cpp:
-        * platform/mac/MIMETypeRegistryMac.mm:
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        * platform/network/qt/QNetworkReplyHandler.h:
-        * platform/network/qt/ResourceHandleQt.cpp:
-        * platform/network/qt/ResourceRequestQt.cpp:
-        * platform/qt/ClipboardQt.cpp:
-        * platform/qt/EventLoopQt.cpp:
-        * platform/qt/KURLQt.cpp:
-        * platform/qt/LoggingQt.cpp:
-        * platform/qt/MIMETypeRegistryQt.cpp:
-        * platform/qt/PasteboardQt.cpp:
-        * platform/qt/PlatformScreenQt.cpp:
-        * platform/qt/PopupMenuQt.cpp:
-        * platform/qt/QWebPopup.cpp:
-        * platform/qt/QWebPopup.h:
-        * platform/qt/RenderThemeQt.cpp:
-        * platform/qt/ScrollbarQt.cpp:
-        * platform/qt/ScrollbarThemeQt.cpp:
-        * platform/qt/WheelEventQt.cpp:
-        * platform/qt/html4-adjustments-qt.css:
-        * platform/wx/MimeTypeRegistryWx.cpp:
-        * plugins/MimeType.cpp:
-        * plugins/MimeType.h:
-        * plugins/MimeType.idl:
-        * plugins/MimeTypeArray.cpp:
-        * plugins/MimeTypeArray.h:
-        * plugins/MimeTypeArray.idl:
-        * plugins/Plugin.cpp:
-        * plugins/Plugin.h:
-        * plugins/Plugin.idl:
-        * plugins/PluginArray.cpp:
-        * plugins/PluginArray.h:
-        * plugins/PluginArray.idl:
-        * plugins/PluginData.cpp:
-        * plugins/PluginData.h:
-        * plugins/gtk/PluginDataGtk.cpp:
-        * plugins/mac/PluginDataMac.mm:
-        * plugins/qt/PluginDataQt.cpp:
-        * plugins/win/PluginDataWin.cpp:
-        * rendering/RenderTableCol.cpp:
-        * rendering/RenderTableCol.h:
+        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
 
-2008-09-29  Thiago Macieira  <thiago.macieira@trolltech.com>
+        https://bugs.webkit.org/show_bug.cgi?id=26544
 
-        Reviewed by Simon
+        If I am doing a Matrix hardware animation and any matrix is singular, I revert to software.
+        This is not really testable, since we can't see what the hardware animation is doing.
 
-        Fix compilation with gcc 4.3
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::animateTransform):
 
-         gcc 4.3 is stricter and ctype.h isn't getting included
-        automatically here by dependencies. So do it directly.
-
-        * platform/qt/PlatformKeyboardEventQt.cpp:
-
-2008-09-29  Morten Sørvig  <msorvig@trolltech.com>
-
-        Reviewed by Simon.
-
-        Fix compilation with Qt/Mac without plugins.
-
-        * platform/qt/TemporaryLinkStubs.cpp:
-
-2008-09-29  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Apply the ASCII fast path optimization from StringImpl::lower to StringImpl::upper.
-        In the few places that we call .upper() in WebCore the strings represent things like
-        tag and attribute names, which are nearly always going to be ASCII.
-
-        * platform/text/StringImpl.cpp:
-        (WebCore::StringImpl::lower): If we have to resize the buffer, be sure to pass the new length
-        in to Unicode::toLower the second time.
-        (WebCore::StringImpl::upper):
-
-2008-09-28  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Speed up getPropertyValue('clip') by 25% by using a Vector<UChar> for building a string,
-        rather than String::operator+=.
-
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::cssText):
-
-2008-09-28  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Speed up computedStyle.getPropertyValue('color') by 4.5x.
-
-        Using a Vector<UChar> while building up the property's cssText is substantially cheaper than using String::operator+=
-        as it avoids many memory reallocations.
-
-        This also speeds up the jQuery .offset() benchmark at <http://dev.jquery.com/~john/speed/1.2.6/offset-1.2.6.html>
-        by 20% due to jQuery's strange need to call getPropertyValue('color') when retrieving the computed styles for
-        unrelated properties on an element.
-
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::cssText): Build the result for the color types into a Vector<UChar>
-        and use appendNumber rather than the String::number in order to cut down on memory allocations.
-        * platform/text/PlatformString.h:
-        (WebCore::appendNumber): A helper function for formatting an unsigned character as a number
-        into a Vector<UChar>.
-
-2008-09-28  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Anders Carlsson.
-
-        Remove spurious call to lower().
-
-        * css/MediaQueryEvaluator.cpp:
-        (WebCore::MediaQueryEvaluator):
-
-2008-09-28  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Use a CaseFoldingHash instead of calling lower on family strings.
-
-        * css/CSSFontSelector.cpp:
-        (WebCore::CSSFontSelector::addFontFaceRule):
-        (WebCore::CSSFontSelector::getFontData):
-        * css/CSSFontSelector.h:
-
-2008-09-28  Timothy Hatcher  <timothy@apple.com>
-
-        Remove the scrollIntoViewIfNeeded() call when drawing the
-        Inspector node highlight.
-
-        <rdar://problem/6115804> Don't scroll when highlighting (21000)
-        https://bugs.webkit.org/show_bug.cgi?id=21000
-
-        Reviewed by Dan Bernstein.
-
-        * page/InspectorController.cpp:
-        (WebCore::InspectorController::drawNodeHighlight):
-
-2008-09-28  David Hyatt  <hyatt@apple.com>
-
-        Fix crash when WebKit has no instantiated Scrollbars and the appearance prefs for scrollbars are
-        changed.
-
-        Reviewed by Dan Bernstein
-
-        * platform/mac/ScrollbarThemeMac.mm:
-        (+[ScrollbarPrefsObserver appearancePrefsChanged:]):
-
-2008-09-28  Timothy Hatcher  <timothy@apple.com>
-
-        Clear the current search results in the Inspector when
-        the search query is less than 3 characters long. Incremental
-        searches only occur for 3 characters or longer, but deleting
-        under this limit would not clear the results unless the whole
-        query was deleted.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21196
-
-        Reviewed by Dan Bernstein.
-
-        * page/inspector/inspector.js:
-        (WebInspector.performSearch): Check for short queries in the
-        if statement that triggers the clear.
-
-2008-09-28  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        - fix <rdar://problem/6202962> "Tibetan Machine Uni" font does not work as a web font on Windows because TTLoadEmbeddedFont fails with E_NAMECHANGEFAILED
-
-        * platform/graphics/win/FontCustomPlatformData.cpp:
-        (WebCore::EOTStream::EOTStream): Added overlayDst, overlaySrc and
-        overlayLength parameters.
-        (WebCore::EOTStream::read): Added code to overlay the
-        m_overlayLength bytes starting at m_overlayDst with the same number of
-        bytes from m_overlaySrc.
-        (WebCore::createFontCustomPlatformData): Changed to get overlay
-        parameters from getEOTHeader.
-        * platform/graphics/win/GetEOTHeader.cpp:
-        (WebCore::getEOTHeader): Added code to specify overlaying of the
-        family name with the prefix of the full name if they differ, because
-        that such a difference causes TTLoadEmbeddedFont to fail.
-        * platform/graphics/win/GetEOTHeader.h:
-
-2008-09-28  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Eric Seidel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20366
-        Reproducible test failure for editing/undo/undo-iframe-location-change.html
-
-        * ChangeLog-2006-05-10: Added bug URLs for a fix that included this test.
-
-2008-09-28  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig (except for a few comment and header tweaks).
-
-        - https://bugs.webkit.org/show_bug.cgi?id=21158
-          reduce use of virtual functions in Node for speed
-
-        Speeds up Dromaeo a bit less than 1%.
-
-        * bindings/js/JSNamedNodesCollection.cpp: Include Element.h instead of
-        Node.h now that some inlines are in there.
-
-        * dom/Attr.h: Override both the virtual and non-virtual name functions.
-
-        * dom/ChildNodeList.cpp:
-        (WebCore::ChildNodeList::nodeMatches): Updated to take an Element.
-        * dom/ChildNodeList.h: Ditto.
-        * dom/ClassNodeList.cpp:
-        (WebCore::ClassNodeList::nodeMatches): Ditto.
-        * dom/ClassNodeList.h: Ditto.
-
-        * dom/Document.h: Put the Node::isDocumentNode() function's inline
-        definition here where it can see the Document class definition.
-
-        * dom/DynamicNodeList.cpp:
-        (WebCore::DynamicNodeList::length): Changed to pass an Element.
-        (WebCore::DynamicNodeList::itemForwardsFromCurrent): Ditto.
-        (WebCore::DynamicNodeList::itemBackwardsFromCurrent): Ditto.
-        (WebCore::DynamicNodeList::itemWithName): Ditto.
-        * dom/DynamicNodeList.h: Ditto.
-
-        * dom/Element.cpp: Removed virtualHasTagName.
-        * dom/Element.h: Made localName, prefix, namespaceURI, and
-        styleForRenderer non-virtual. Added virtualPrefix, virtualLocalName,
-        virtualNamespaceURI, and removed virtualHasTagName. Put the
-        Node::hasTagName, Node::hasAttributes, and Node::attributes
-        functions' inline definitions here where they can see the Element
-        class definition.
-
-        * dom/NameNodeList.cpp:
-        (WebCore::NameNodeList::nodeMatches): Updated to take an Element.
-        * dom/NameNodeList.h: Ditto.
-
-        * dom/Node.cpp:
-        (WebCore::Node::virtualPrefix): Renamed from prefix.
-        (WebCore::Node::virtualLocalName): Renamed from localName.
-        (WebCore::Node::virtualNamespaceURI): Renamed from namespaceURI.
-        (WebCore::Node::styleForRenderer): Handle the Element case here.
-
-        * dom/Node.h: Removed definition of hasTagName that calls virtual,
-        since we now have a non-virtual version. Made hasAttributes,
-        attributes, remove, localName, namespaceURI, prefix, isDocumentNode,
-        and styleForRenderer non-virtual. Added virtualPrefix,
-        virtualLocalName, and virtualNamespaceURI. Removed isMalformed
-        and setMalformed, which are used only on HTMLFormElement objects.
-
-        * dom/TagNodeList.cpp:
-        (WebCore::TagNodeList::nodeMatches): Updated to take an Element.
-        * dom/TagNodeList.h: Ditto.
-
-        * html/HTMLAnchorElement.cpp: Added a comment.
-        * html/HTMLFormControlElement.cpp: Ditto.
-
-        * html/HTMLAnchorElement.h: Removed unused, unimplemented setTabIndex
-        function. Marked tabIndex function virtual explicitly for clarity.
-
-        * html/HTMLAreaElement.h: Removed unused, unimplemented setTabIndex
-        function. Marked isFocusable function virtual explicitly for clarity.
-
-        * html/HTMLElement.h: Marked tabIndex function virtual explicitly for
-        clarity.
-        * html/HTMLFormControlElement.h: Ditto.
-
-        * html/HTMLFormElement.h: Made isMalformed non-virtual.
-
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::handleError): Use the already-cast-to-HTMLElement
-        pointer to call localName since that one does not need to call a virtual
-        function.
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::layoutBlock): Cast to HTMLFormElement before
-        calling isMalformed. We already did a tag name check so we know it's
-        an HTMLFormELement.
-
-        * xml/XPathUtil.cpp:
-        (WebCore::XPath::isValidContextNode): Rewrote to not make so many calls
-        to nodeType(), since it's a virtual function.
-
-2008-09-28  David Hyatt  <hyatt@apple.com>
-
-        Make frameRectsChanged() cross-platform on ScrollView.
-
-        Reviewed by Oliver Hunt
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::frameRectsChanged):
-        * platform/ScrollView.h:
-        * platform/gtk/ScrollViewGtk.cpp:
-        * platform/qt/ScrollViewQt.cpp:
-        * platform/win/ScrollViewWin.cpp:
-        * platform/wx/ScrollViewWx.cpp:
-
-2008-09-28  Oliver Hunt  <oliver@apple.com>
+2009-06-19  Geoffrey Garen  <ggaren@apple.com>
 
         Reviewed by Maciej Stachowiak.
+        
+        An additional fix for Bug 26532: Native functions do not correctly unlink
+        from optimised callsites when they're collected
+        <https://bugs.webkit.org/show_bug.cgi?id=26532> | <rdar://problem/6625385>
 
-        Bug 21141: REGRESSION: Exception messages for user entered commands are poor
-        <https://bugs.webkit.org/show_bug.cgi?id=21141>
-
-        The bug repsonsible for this was the the JSInspectedObjectWrapper instances
-        were not initialising their StructureID's to indicate that the wrapper
-        overrides hasInstance, etc.  The solution is simply to use the createStructureID
-        helper on JSQuarantinedObjectWrapper to create a correct StructureID.
-
-        * bindings/js/JSInspectedObjectWrapper.cpp:
-        (WebCore::JSInspectedObjectWrapper::wrap):
-
-2008-09-28  David Hyatt  <hyatt@apple.com>
-
-        Make sure pixel wheel scrolls (formerly "continuous" wheel events) send deltas to DOM wheel events in
-        terms of lines.
-
-        Reviewed by Oliver Hunt
-
-        * dom/EventTargetNode.cpp:
-        (WebCore::EventTargetNode::dispatchWheelEvent):
-
-2008-09-28  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21191
-
-        Rework mouse wheeling significantly to make the platform event less messy and to enable wheelEvent
-        on ScrollView to be cross-platform.
-
-        Give the wheel event a concept of granularity (pixel, line or page).  What used to be called continuous
-        events are now pixel wheel events.
-
-        Page scrolling as implemented in bug 17589 was completely broken.  It had the following problems:
-        (1) Page scrolling has been corrected to be properly detected (on Windows
-        page wheeling is only done in the vertical direction and it is keyed off a special return value of -1).  The
-        old code had some bizarre incorrect heuristic for "guessing" that you should page scroll and also thought
-        you could page scroll horizontally.
-        (2) Page scrolling a layer used the enclosing ScrollView's width/height instead of the layer's width/height.
-        This caused the scroll amount for page scrolling to be way too large on layers.
-
-        Bug 17589 got the default horizontal scrolling value wrong.  It assumed 1, when the Vista default is 3.
-
-        Incorporate WebCore's line multiplier right into the deltas of the event.  This eliminates the need
-        for separate multiplier fields (or for the need to ask if you're looking for line sensitivity).
-
-        Reviewed by Oliver Hunt
-
-        * editing/EditorCommand.cpp:
-        (WebCore::verticalScrollDistance):
-        * page/EventHandler.cpp:
-        (WebCore::scrollAndAcceptEvent):
-        (WebCore::EventHandler::handleWheelEvent):
-        * platform/PlatformWheelEvent.h:
-        (WebCore::):
-        (WebCore::PlatformWheelEvent::pos):
-        (WebCore::PlatformWheelEvent::globalPos):
-        (WebCore::PlatformWheelEvent::deltaX):
-        (WebCore::PlatformWheelEvent::deltaY):
-        (WebCore::PlatformWheelEvent::granularity):
-        (WebCore::PlatformWheelEvent::x):
-        (WebCore::PlatformWheelEvent::globalX):
-        (WebCore::PlatformWheelEvent::ignore):
-        (WebCore::PlatformWheelEvent::horizontalLineMultiplier):
-        (WebCore::PlatformWheelEvent::verticalLineMultiplier):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::wheelEvent):
-        * platform/Scrollbar.h:
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::updateScrollbars):
-        * platform/gtk/WheelEventGtk.cpp:
-        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
-        * platform/mac/ScrollViewMac.mm:
-        * platform/mac/WheelEventMac.mm:
-        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::updateScrollbars):
-        * platform/qt/WheelEventQt.cpp:
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::updateScrollbars):
-        * platform/win/WheelEventWin.cpp:
-        (WebCore::PlatformWheelEvent::horizontalLineMultiplier):
-        (WebCore::PlatformWheelEvent::verticalLineMultiplier):
-        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
-        * platform/wx/ScrollViewWx.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::OnScrollWinEvents):
-        (WebCore::ScrollView::wheelEvent):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
-
-2008-09-27  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        fix https://bugs.webkit.org/show_bug.cgi?id=20994
-        <rdar://problem/6171023> HTMLVideoElement width and height attributes are now unsigned
+        Use "NativeFunctionWrapper" instead of "PrototypeFunction" in cross-frame
+        accessors, so the type of object you get to wrap a function is the same,
+        regardless of whether the access to the function is cross-frame.
         
-        HTML5 spec says HTMLVideoElement width and height attributes should be unsigned. Convert
-        all unsigned media attributes from string with toUInt() instead of toInt().
+        This is faster and more idiomatic than what we had before. It also would
+        have avoided Bug 26532 because it would have prevented a conflicting
+        PrototypeFunction from being allocated to wrap postMessage, where a
+        NativeFunctionWrapper had been allocated previously.
         
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::playCount): convert from attribute with toUInt().
-
-        * html/HTMLVideoElement.cpp:
-        (WebCore::HTMLVideoElement::videoWidth):
-        (WebCore::HTMLVideoElement::videoHeight): return unsigned to match idl.
-        (WebCore::HTMLVideoElement::width): convert from attribute with toUInt() and return
-          unsigned value.
-        (WebCore::HTMLVideoElement::height): Ditto.
-        (WebCore::HTMLVideoElement::setWidth): take unsigned value.
-        (WebCore::HTMLVideoElement::setHeight): Ditto.
-
-        * html/HTMLVideoElement.h: width, height, videoWidth, and videoHeight are unsigned.
-
-        * html/HTMLVideoElement.idl: make width and height unsigned to match HTML5 spec.
-
-2008-09-27  Timothy Hatcher  <timothy@apple.com>
-
-        Fixes an exception when typing a command in the Console.
-
-        Reviewed by Oliver Hunt.
-
-        * page/inspector/Console.js:
-        (WebInspector.Console.prototype.addMessage): Null check
-        this.previosMessage.
-
-2008-09-27  Timothy Hatcher  <timothy@apple.com>
-
-        Fixes a bug where the Profiles panel sidebar would be empty
-        after closing and reopening the Web Inspector.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21179
-
-        Reviewed by Sam Weinig.
-
-        * page/inspector/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel.prototype.reset): Don't call
-        populateInterface, it is called automatically.
-        (WebInspector.ProfilesPanel.prototype._populateProfiles):
-        Return early if the sidebar is already populated.
-
-2008-09-27  Dave Hyatt  <hyatt@apple.com>
-
-        Bug 21190.  The line scroll amount on Windows is way too small.  A patch for bug 17589 for wheel sensitivity
-        incorrectly applied the tinier wheel step delta (unmultiplied) to line scrolling.  Line scrolling with the
-        scrollbar has nothing to do with mouse wheeling.  This patch reverts the scrollbars to use the same line
-        step as other platforms while leaving the wheel delta alone for use with wheel scrolling.
-
-        There was a lot wrong with 17589, so more patches will be coming to deal with the fallout of this patch
-        (which should never have landed in the first place).
-       
-        Reviewed by Tim Hatcher, Sam Weinig
-
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::adjustDeltaForPageScrollMode):
-        (WebCore::ScrollView::updateScrollbars):
-        (WebCore::ScrollView::wheelEvent):
-
-2008-09-27  David Hyatt  <hyatt@apple.com>
-
-        Make the scrollbarUnderMouse method cross-platform.
-
-        Reviewed by Sam Weinig
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::scrollbarUnderMouse):
-        * platform/gtk/ScrollViewGtk.cpp:
-        * platform/mac/ScrollViewMac.mm:
-        * platform/qt/ScrollViewQt.cpp:
-        * platform/win/ScrollViewWin.cpp:
-        * platform/wx/ScrollViewWx.cpp:
-
-2008-09-27  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Gtk+ build fix.
-
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::valueChanged):
-
-2008-09-27  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Holger Freyther.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20287
-        [Gtk] disable plugins for gtk/directfb target
-
-        Introduce WTF_PLATFORM_X11 for X11 builds.
-        Also use target-specific packages when building the port
-
-        * platform/gtk/PlatformScreenGtk.cpp:
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::getValueStatic):
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::init):
-
-2008-09-27  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21188
-
-        Make scrollbar suppression and resizer avoidance cross-platform.
-
-        Reviewed by Anders
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::transitionToCommitted):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::resetScrollbars):
-        (WebCore::FrameView::clear):
-        (WebCore::FrameView::layout):
-        (WebCore::FrameView::restoreScrollbar):
-        (WebCore::FrameView::windowResizerRect):
-        * page/FrameView.h:
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::init):
-        (WebCore::ScrollView::resizerOverlapsContent):
-        (WebCore::ScrollView::adjustScrollbarsAvoidingResizerCount):
-        (WebCore::ScrollView::setParent):
-        (WebCore::ScrollView::setScrollbarsSuppressed):
-        (WebCore::ScrollView::platformSetScrollbarsSuppressed):
-        * platform/ScrollView.h:
-        (WebCore::ScrollView::scrollbarsSuppressed):
-        (WebCore::ScrollView::windowResizerRect):
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::setFrameRect):
-        (WebCore::Scrollbar::setParent):
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
-        (WebCore::ScrollView::ScrollViewPrivate::adjustmentChanged):
-        (WebCore::ScrollView::updateScrollbars):
-        (WebCore::ScrollView::paint):
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::ScrollView):
-        (WebCore::ScrollView::~ScrollView):
-        (WebCore::ScrollView::platformSetScrollbarsSuppressed):
-        (WebCore::ScrollView::setScrollPosition):
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
-        (WebCore::ScrollView::ScrollViewPrivate::valueChanged):
-        (WebCore::ScrollView::frameRectsChanged):
-        (WebCore::ScrollView::updateScrollbars):
-        (WebCore::ScrollView::paint):
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
-        (WebCore::ScrollView::ScrollViewPrivate::valueChanged):
-        (WebCore::ScrollView::updateScrollbars):
-        (WebCore::ScrollView::paint):
-        * platform/wx/ScrollViewWx.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
-
-2008-09-27  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Rubber-stamped by Anders Carlsson.
-
-        Compile fix.
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::load):
-
-2008-09-27  Mark Rowe  <mrowe@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        Fix <https://bugs.webkit.org/show_bug.cgi?id=21184>.
-        Bug 21184: REGRESSION: Reproducible crash below StringImpl::hash while running editing/deleting/5408255.html
-
-        Remove an assertion that was incorrect and that if made correct would have duplicated a check that occurred earlier in the function.
-
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::~CachedResource):
-
-2008-09-27  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon Hausmann.
-
-        [qt] Use QImageReader to figure out which image formats are supported
-        - Qt can have many different plugins for different image formats. Instead
-        of checking only for a few in WebCore use Qt to determine if this data
-        can be treated as an image.
-
-        * platform/graphics/qt/ImageSourceQt.cpp:
-        (WebCore::canHandleImage):
-        (WebCore::createDecoder):
-
-2008-09-27  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-
-        [qt] Clean the pattern code
-        - Use save/restore on the painter after manipulating the
-        pen/brush
-        - Make the context and object null checking consistent. CG is using
-        the object unconditionally so the Qt webkit platform can do the
-        same.
-        - Move code below the early exit. Only use the m_ownerElement before
-        the early exit as the CG code is doing it.
-
-        * svg/graphics/SVGPaintServerPattern.h:
-        * svg/graphics/qt/SVGPaintServerPatternQt.cpp:
-        (WebCore::SVGPaintServerPattern::setup):
-        (WebCore::SVGPaintServerPattern::teardown):
-
-2008-09-27  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Added support for console.trace.
-
-        https://bugs.webkit.org/show_bug.cgi?id=19157
-
-        Reviewed by Kevin McCullough and Tim Hatcher.
-
-        * bindings/js/JSConsoleCustom.cpp:
-        (WebCore::JSConsole::trace):
-        * page/Console.cpp:
-        (WebCore::Console::trace): Calls Machine::retrieveCaller to
-        get a stack trace.
-        * page/Console.h:
-        (WebCore::): Added TraceMessageLevel.
-        * page/Console.idl: Added console.trace.
-        * page/inspector/Console.js:
-        (ConsoleMessage): Added case for TraceMessageLevel.
-
-2008-09-27  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21178
-        <rdar://problem/6248651>
-
-        Check if the plug-in is allowed to load the resource. This matches Firefox.
-
-        Test: http/tests/plugins/local-geturl-from-remote.html
-
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::load):
-
-2008-09-22  Dirk Schulze  <vbs85@gmx.de>
-
-        Reviewed by Eric Seidel.
-
-        Added SVG pattern support to Qt.
-
-        [Qt] SVG patterns are missing
-        https://bugs.webkit.org/show_bug.cgi?id=20973
-
-        * svg/graphics/qt/SVGPaintServerPatternQt.cpp:
-        (WebCore::SVGPaintServerPattern::setup):
-
-2008-09-27  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Fixed a bug in the JS syntax highlighter with multiple line tokens.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21171
-
-        Reviewed by Tim Hatcher.
-
-        * page/inspector/SourceFrame.js:
-        (syntaxHighlightJavascriptLine): Initialize previousMatchLength.
-
-2008-09-27  Timothy Hatcher  <timothy@apple.com>
-
-        Change searching in the Profiles panel to not match the
-        Self and Total columns when there are no units. The only
-        column that is matched for unitless number searches is
-        now the Calls column.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21169
-
-        Reviewed by Sam Weinig.
-
-        * page/inspector/ProfileView.js:
-        (WebInspector.ProfileView.prototype.performSearch):
-
-2008-09-27  David Hyatt  <hyatt@apple.com>
-
-        Rename boundsGeometry -> boundsRect.  Rename geometryChanged -> frameRectsChanged.
-
-        Reviewed by Sam Weinig
-
-        * platform/ScrollView.h:
-        * platform/Widget.h:
-        (WebCore::Widget::boundsRect):
-        (WebCore::Widget::invalidate):
-        (WebCore::Widget::frameRectsChanged):
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollViewScrollbar::frameRectsChanged):
-        (WebCore::ScrollView::ScrollViewPrivate::scrollBackingStore):
-        (WebCore::ScrollView::setFrameRect):
-        (WebCore::ScrollView::updateScrollbars):
-        (WebCore::ScrollView::frameRectsChanged):
-        * platform/gtk/ScrollbarGtk.cpp:
-        (ScrollbarGtk::setFrameRect):
-        (ScrollbarGtk::frameRectsChanged):
-        * platform/gtk/ScrollbarGtk.h:
-        * platform/gtk/WidgetGtk.cpp:
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::scrollBackingStore):
-        (WebCore::ScrollView::setFrameRect):
-        (WebCore::ScrollView::frameRectsChanged):
-        (WebCore::ScrollView::updateScrollbars):
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::scrollBackingStore):
-        (WebCore::ScrollView::setFrameRect):
-        (WebCore::ScrollView::updateScrollbars):
-        (WebCore::ScrollView::frameRectsChanged):
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::frameRectsChanged):
-        * plugins/PluginView.h:
-
-2008-09-27  Simon Hausmann  <hausmann@webkit.org>
-
-        Refix the previous build fix to compile on non-Qt platforms, too.
-
-        * WebCore.pro: Don't pass -i to create_hashtable, added missing -n
-        WebCore to generate the PrototypeTable in the WebCore namespace
-        * bindings/js/JSEventTargetBase.h: Revert previous fix, the Prototype
-        table remains in the Webcore namespace
-        (WebCore::JSEventTargetBasePrototype::getOwnPropertySlot):
-
-2008-09-27  Simon Hausmann  <hausmann@webkit.org>
-
-        Fix compilation with gcc 4.3 (probably > 4.0)
-
-        * bindings/js/JSDOMWindowBase.cpp: Don't define static property
-        get/put functions inside the WebCore namespace.
-        * bindings/js/JSEventTargetBase.cpp: Ditto.
-        * bindings/js/JSEventTargetNode.cpp: Ditto.
-        * bindings/js/JSEventTargetSVGElementInstance.cpp: Ditto.
-        * bindings/js/JSEventTargetBase.h: Forward declare
-        JSEventTargetPrototypeTable in the JSC namespace as the lut.h file
-        defines it in the JSC namespace.
-        (WebCore::JSEventTargetBasePrototype::getOwnPropertySlot): Add JSC::
-        prefix for PrototypeTable symbol.
-
-2008-09-27  David Hyatt  <hyatt@apple.com>
-
-        Rename frameGeometry to frameRect.  Rename setFrameGeometry to setFrameRect.
-
-        Reviewed by Dan Bernstein
-
-        * WebCore.base.exp:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::FrameView):
-        (WebCore::FrameView::updateControlTints):
-        * platform/ScrollView.h:
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::Scrollbar):
-        (WebCore::Scrollbar::paint):
-        (WebCore::Scrollbar::setFrameRect):
-        * platform/Scrollbar.h:
-        * platform/ScrollbarThemeComposite.cpp:
-        (WebCore::ScrollbarThemeComposite::paint):
-        * platform/Widget.h:
-        (WebCore::Widget::x):
-        (WebCore::Widget::y):
-        (WebCore::Widget::width):
-        (WebCore::Widget::height):
-        (WebCore::Widget::size):
-        (WebCore::Widget::pos):
-        (WebCore::Widget::resize):
-        (WebCore::Widget::move):
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollViewScrollbar::geometryChanged):
-        (WebCore::ScrollView::update):
-        (WebCore::ScrollView::setFrameRect):
-        (WebCore::ScrollView::updateScrollbars):
-        (WebCore::ScrollView::scrollbarUnderMouse):
-        (WebCore::ScrollView::paint):
-        * platform/gtk/ScrollbarGtk.cpp:
-        (ScrollbarGtk::setFrameRect):
-        (ScrollbarGtk::geometryChanged):
-        * platform/gtk/ScrollbarGtk.h:
-        * platform/gtk/WidgetGtk.cpp:
-        (WebCore::Widget::frameRect):
-        (WebCore::Widget::setFrameRect):
-        * platform/mac/ScrollbarThemeMac.mm:
-        (WebCore::ScrollbarThemeMac::trackRect):
-        (WebCore::ScrollbarThemeMac::paint):
-        * platform/mac/WidgetMac.mm:
-        (WebCore::Widget::frameRect):
-        (WebCore::Widget::setFrameRect):
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::setFrameRect):
-        (WebCore::ScrollView::updateScrollbars):
-        (WebCore::ScrollView::scrollbarUnderMouse):
-        (WebCore::ScrollView::paint):
-        * platform/qt/ScrollbarThemeQt.cpp:
-        (WebCore::styleOptionSlider):
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::Widget::frameRect):
-        (WebCore::Widget::setFrameRect):
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::invalidateItem):
-        (WebCore::PopupMenu::valueChanged):
-        (WebCore::PopupWndProc):
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::setFrameRect):
-        (WebCore::ScrollView::updateScrollbars):
-        (WebCore::ScrollView::scrollbarUnderMouse):
-        (WebCore::ScrollView::paint):
-        * platform/win/ScrollbarThemeSafari.cpp:
-        (WebCore::ScrollbarThemeSafari::trackRect):
-        * platform/win/WidgetWin.cpp:
-        (WebCore::Widget::frameRect):
-        (WebCore::Widget::setFrameRect):
-        * platform/wx/WidgetWx.cpp:
-        (WebCore::Widget::frameRect):
-        (WebCore::Widget::setFrameRect):
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::setFrameRect):
-        * plugins/PluginView.h:
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::paint):
-        (WebCore::PluginView::init):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::init):
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        (WebCore::PluginView::paintMissingPluginIcon):
-        (WebCore::PluginView::paint):
-        (WebCore::PluginView::init):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::positionOverflowControls):
-        * rendering/RenderListBox.cpp:
-        (WebCore::RenderListBox::paintScrollbar):
-        * rendering/RenderPart.cpp:
-        (WebCore::RenderPart::updateWidgetPosition):
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::setWidgetGeometry):
-        (WebCore::RenderWidget::updateWidgetPosition):
-
-2008-09-27  David Hyatt  <hyatt@apple.com>
-
-        <rdar://problem/6252041> REGRESSION (4dp-TOT): Crash in Widget::platformWidget() when closing a PDF
-
-        This crash was lurking for a while and basically got exposed by my changes to visibleContentRect() to
-        access an actual member variable.
-
-        Reviewed by Dan Bernstein
-
-        * page/FocusController.cpp:
-        (WebCore::FocusController::setFocusedFrame):
-
-2008-09-27  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Attempt to fix QT Build. Not reviewed.
-
-        * WebCore.pro: add -n WebCore parameter to create_hash_table
-
-2008-09-26  Gwenole Beauchesne  <gbeauchesne@splitted-desktop.org>
-
-        Reviewed by Eric Seidel.
-
-        http://bugs.webkit.org/show_bug.cgi?id=18905
-        [GTK] Fix build with older pango (1.14.8)
-
-        * platform/graphics/gtk/FontGtk.cpp:
-        * platform/gtk/Language.cpp:
-        (_pango_get_lc_ctype):
-        (pango_language_get_default):
-
-2008-09-26  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21168
-
-        Make contentsToWindow/windowToContents cross-platform.
-
-        Reviewed by Oliver Hunt
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::windowToContents):
-        (WebCore::ScrollView::contentsToWindow):
-        * platform/ScrollView.h:
-        * platform/gtk/ScrollViewGtk.cpp:
-        * platform/mac/ScrollViewMac.mm:
-        * platform/qt/ScrollViewQt.cpp:
-        * platform/win/ScrollViewWin.cpp:
-        * platform/wx/ScrollViewWx.cpp:
-
-2008-09-26  Sam Weinig  <sam@webkit.org>
-
-        GTK build fix.
-
-        * GNUmakefile.am:
-
-2008-09-26  David Hyatt  <hyatt@apple.com>
-
-        Eliminate shouldUpdateWhileOffscreen from ScrollView.  Make the concept of not invalidating while
-        offscreen cross-platform.  Rename the inWindow method to isOffscreen (which flips the boolean), since that
-        more clearly conveys the intent of the method.  Make isOffscreen also check NSWindow visibility on Mac.
-
-        Reviewed by Oliver Hunt
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::repaintContentRectangle):
-        * page/FrameView.h:
-        * platform/ScrollView.h:
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::isOffscreen):
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::updateContents):
-        (WebCore::ScrollView::isOffscreen):
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::isOffscreen):
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::isOffscreen):
-        * platform/wx/ScrollViewWx.cpp:
-        (WebCore::ScrollView::isOffscreen):
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::willRenderImage):
-
-2008-09-26  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21164
-
-        Rework concept of allowsScrolling/setAllowsScrolling to be cross-platform.
-
-        Reviewed by Sam Weinig
-
-        * WebCore.base.exp:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::setAllowsScrolling):
-        * page/FrameView.h:
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::setAllowsScrolling):
-        * platform/ScrollView.h:
-        (WebCore::ScrollView::allowsScrolling):
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::wheelEvent):
-
-2008-09-26  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fixes after Widget/ScrollView changes.
-
-        * platform/wx/PopupMenuWx.cpp:
-        (WebCore::PopupMenu::show):
-        * platform/wx/ScrollViewWx.cpp:
-        (WebCore::ScrollView::platformSetContentsSize):
-        (WebCore::ScrollView::platformSetScrollbarModes):
-        (WebCore::ScrollView::wheelEvent):
-        * platform/wx/TemporaryLinkStubs.cpp:
-        * platform/wx/WidgetWx.cpp:
-        (WebCore::Widget::containingWindow):
-
-2008-09-26  Timothy Hatcher  <timothy@apple.com>
-
-        Allow searching for paths by always performing the
-        three search methods in the Elements panel and not
-        assume a search with a "/" is a XPath query.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21159
-
-        Reviewed by Geoff Garen.
-
-        * page/inspector/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype.performSearch):
-
-2008-09-26  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Patch for https://bugs.webkit.org/show_bug.cgi?id=21152
-        Speedup static property get/put
-
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
         * bindings/js/JSDOMBinding.cpp:
-        * bindings/js/JSDOMBinding.h:
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::getDOMConstructor):
-        (WebCore::jsDOMWindowBaseCrypto):
-        (WebCore::jsDOMWindowBaseEvent):
-        (WebCore::jsDOMWindowBaseImage):
-        (WebCore::jsDOMWindowBaseMessageChannel):
-        (WebCore::jsDOMWindowBaseOption):
-        (WebCore::jsDOMWindowBaseXMLHttpRequest):
-        (WebCore::jsDOMWindowBaseAudio):
-        (WebCore::jsDOMWindowBaseXSLTProcessor):
-        (WebCore::jsDOMWindowBaseOnabort):
-        (WebCore::jsDOMWindowBaseOnblur):
-        (WebCore::jsDOMWindowBaseOnchange):
-        (WebCore::jsDOMWindowBaseOnclick):
-        (WebCore::jsDOMWindowBaseOndblclick):
-        (WebCore::jsDOMWindowBaseOnerror):
-        (WebCore::jsDOMWindowBaseOnfocus):
-        (WebCore::jsDOMWindowBaseOnkeydown):
-        (WebCore::jsDOMWindowBaseOnkeypress):
-        (WebCore::jsDOMWindowBaseOnkeyup):
-        (WebCore::jsDOMWindowBaseOnload):
-        (WebCore::jsDOMWindowBaseOnmousedown):
-        (WebCore::jsDOMWindowBaseOnmousemove):
-        (WebCore::jsDOMWindowBaseOnmouseout):
-        (WebCore::jsDOMWindowBaseOnmouseover):
-        (WebCore::jsDOMWindowBaseOnmouseup):
-        (WebCore::jsDOMWindowBaseOnMouseWheel):
-        (WebCore::jsDOMWindowBaseOnreset):
-        (WebCore::jsDOMWindowBaseOnresize):
-        (WebCore::jsDOMWindowBaseOnscroll):
-        (WebCore::jsDOMWindowBaseOnsearch):
-        (WebCore::jsDOMWindowBaseOnselect):
-        (WebCore::jsDOMWindowBaseOnsubmit):
-        (WebCore::jsDOMWindowBaseOnbeforeunload):
-        (WebCore::jsDOMWindowBaseOnunload):
-        (WebCore::jsDOMWindowBaseOnWebKitAnimationStart):
-        (WebCore::jsDOMWindowBaseOnWebKitAnimationIteration):
-        (WebCore::jsDOMWindowBaseOnWebKitAnimationEnd):
-        (WebCore::jsDOMWindowBaseOnWebKitTransitionEnd):
-        (WebCore::JSDOMWindowBase::getOwnPropertySlot):
-        (WebCore::JSDOMWindowBase::put):
-        (WebCore::setJSDOMWindowBaseOnabort):
-        (WebCore::setJSDOMWindowBaseOnblur):
-        (WebCore::setJSDOMWindowBaseOnchange):
-        (WebCore::setJSDOMWindowBaseOnclick):
-        (WebCore::setJSDOMWindowBaseOndblclick):
-        (WebCore::setJSDOMWindowBaseOnerror):
-        (WebCore::setJSDOMWindowBaseOnfocus):
-        (WebCore::setJSDOMWindowBaseOnkeydown):
-        (WebCore::setJSDOMWindowBaseOnkeypress):
-        (WebCore::setJSDOMWindowBaseOnkeyup):
-        (WebCore::setJSDOMWindowBaseOnload):
-        (WebCore::setJSDOMWindowBaseOnmousedown):
-        (WebCore::setJSDOMWindowBaseOnmousemove):
-        (WebCore::setJSDOMWindowBaseOnmouseout):
-        (WebCore::setJSDOMWindowBaseOnmouseover):
-        (WebCore::setJSDOMWindowBaseOnmouseup):
-        (WebCore::setJSDOMWindowBaseOnMouseWheel):
-        (WebCore::setJSDOMWindowBaseOnreset):
-        (WebCore::setJSDOMWindowBaseOnresize):
-        (WebCore::setJSDOMWindowBaseOnscroll):
-        (WebCore::setJSDOMWindowBaseOnsearch):
-        (WebCore::setJSDOMWindowBaseOnselect):
-        (WebCore::setJSDOMWindowBaseOnsubmit):
-        (WebCore::setJSDOMWindowBaseOnbeforeunload):
-        (WebCore::setJSDOMWindowBaseOnunload):
-        (WebCore::setJSDOMWindowBaseOnWebKitAnimationStart):
-        (WebCore::setJSDOMWindowBaseOnWebKitAnimationIteration):
-        (WebCore::setJSDOMWindowBaseOnWebKitAnimationEnd):
-        (WebCore::setJSDOMWindowBaseOnWebKitTransitionEnd):
-        (WebCore::setJSDOMWindowBaseEvent):
-        (WebCore::setJSDOMWindowBaseAudio):
-        (WebCore::setJSDOMWindowBaseImage):
-        (WebCore::setJSDOMWindowBaseMessageChannel):
-        (WebCore::setJSDOMWindowBaseOption):
-        (WebCore::setJSDOMWindowBaseXMLHttpRequest):
-        (WebCore::setJSDOMWindowBaseXSLTProcessor):
-        * bindings/js/JSDOMWindowBase.h:
+        (WebCore::objectToStringFunctionGetter):
         * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::nonCachingStaticCloseFunctionGetter):
-        (WebCore::nonCachingStaticBlurFunctionGetter):
-        (WebCore::nonCachingStaticFocusFunctionGetter):
-        (WebCore::nonCachingStaticPostMessageFunctionGetter):
-        * bindings/js/JSDOMWindowCustom.h:
-        (WebCore::JSDOMWindow::customGetOwnPropertySlot):
-        * bindings/js/JSEventTargetBase.cpp:
-        * bindings/js/JSEventTargetBase.h:
-        (WebCore::JSEventTargetBasePrototype::getOwnPropertySlot):
-        (WebCore::JSEventTargetBasePrototype::classInfo):
-        * bindings/js/JSEventTargetNode.cpp:
-        (WebCore::):
-        (WebCore::JSEventTargetNode::getOwnPropertySlot):
-        (WebCore::JSEventTargetNode::put):
-        * bindings/js/JSEventTargetNode.h:
-        (WebCore::JSEventTargetNode::classInfo):
-        (WebCore::JSEventTargetNode::prototypeClassName):
-        * bindings/js/JSEventTargetSVGElementInstance.cpp:
-        (WebCore::):
-        (WebCore::JSEventTargetSVGElementInstance::getOwnPropertySlot):
-        (WebCore::JSEventTargetSVGElementInstance::put):
-        * bindings/js/JSEventTargetSVGElementInstance.h:
-        (WebCore::JSEventTargetSVGElementInstance::classInfo):
-        (WebCore::JSEventTargetSVGElementInstance::prototypeClassName):
-        * bindings/js/JSHTMLInputElementCustom.cpp:
-        (WebCore::JSHTMLInputElement::customGetOwnPropertySlot):
+        (WebCore::nonCachingStaticFunctionGetter):
         * bindings/js/JSHistoryCustom.cpp:
         (WebCore::nonCachingStaticBackFunctionGetter):
         (WebCore::nonCachingStaticForwardFunctionGetter):
         (WebCore::nonCachingStaticGoFunctionGetter):
-        (WebCore::JSHistory::customGetOwnPropertySlot):
         * bindings/js/JSLocationCustom.cpp:
         (WebCore::nonCachingStaticReplaceFunctionGetter):
         (WebCore::nonCachingStaticReloadFunctionGetter):
         (WebCore::nonCachingStaticAssignFunctionGetter):
-        (WebCore::JSLocation::customGetOwnPropertySlot):
-        (WebCore::JSLocation::customPut):
-        * bindings/scripts/CodeGeneratorJS.pm:
-
-2008-09-26  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21149
-
-        Make the concept of scroll modes cross-platform.  Move the scrollbars up into ScrollView as well.
-        Eliminate the unused isScrollable() method.
-
-        Reviewed by Sam Weinig
-
-        * WebCore.base.exp:
-        * page/FrameView.cpp:
-        (WebCore::FrameView::resetScrollbars):
-        (WebCore::FrameView::initScrollbars):
-        (WebCore::FrameView::layout):
-        * page/FrameView.h:
-        * page/mac/WebCoreFrameView.h:
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::init):
-        (WebCore::ScrollView::setScrollbarModes):
-        (WebCore::ScrollView::scrollbarModes):
-        (WebCore::ScrollView::platformSetScrollbarModes):
-        (WebCore::ScrollView::platformScrollbarModes):
-        * platform/ScrollView.h:
-        (WebCore::ScrollView::horizontalScrollbar):
-        (WebCore::ScrollView::verticalScrollbar):
-        (WebCore::ScrollView::isScrollViewScrollbar):
-        (WebCore::ScrollView::setHorizontalScrollbarMode):
-        (WebCore::ScrollView::setVerticalScrollbarMode):
-        (WebCore::ScrollView::horizontalScrollbarMode):
-        (WebCore::ScrollView::verticalScrollbarMode):
-        (WebCore::ScrollView::convertSelfToChild):
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
-        (WebCore::ScrollView::ScrollViewPrivate::setHasHorizontalScrollbar):
-        (WebCore::ScrollView::ScrollViewPrivate::setHasVerticalScrollbar):
-        (WebCore::ScrollView::ScrollViewPrivate::valueChanged):
-        (WebCore::ScrollView::updateScrollbars):
-        (WebCore::ScrollView::scrollbarUnderMouse):
-        (WebCore::ScrollView::isScrollViewScrollbar):
-        (WebCore::ScrollView::paint):
-        (WebCore::ScrollView::scroll):
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::platformSetScrollbarModes):
-        (WebCore::ScrollView::platformScrollbarModes):
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::setHasHorizontalScrollbar):
-        (WebCore::ScrollView::ScrollViewPrivate::setHasVerticalScrollbar):
-        (WebCore::ScrollView::ScrollViewPrivate::valueChanged):
-        (WebCore::ScrollView::horizontalScrollbar):
-        (WebCore::ScrollView::verticalScrollbar):
-        (WebCore::ScrollView::invalidateScrollbars):
-        (WebCore::ScrollView::updateScrollbars):
-        (WebCore::ScrollView::scrollbarUnderMouse):
-        (WebCore::ScrollView::paint):
-        (WebCore::ScrollView::scroll):
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
-        (WebCore::ScrollView::ScrollViewPrivate::setHasHorizontalScrollbar):
-        (WebCore::ScrollView::ScrollViewPrivate::setHasVerticalScrollbar):
-        (WebCore::ScrollView::ScrollViewPrivate::valueChanged):
-        (WebCore::ScrollView::ScrollViewPrivate::setAllowsScrolling):
-        (WebCore::ScrollView::ScrollViewPrivate::allowsScrolling):
-        (WebCore::ScrollView::suppressScrollbars):
-        (WebCore::ScrollView::updateScrollbars):
-        (WebCore::ScrollView::scrollbarUnderMouse):
-        (WebCore::ScrollView::paint):
-        (WebCore::ScrollView::scroll):
-        * platform/wx/ScrollViewWx.cpp:
-        (WebCore::ScrollView::platformSetScrollbarModes):
-        (WebCore::ScrollView::platformScrollbarModes):
-
-2008-09-26  David Kilzer  <ddkilzer@apple.com>
-
-        Fix Mac build with XPATH and XSLT disabled
-
-        Reviewed by Alexey.
-
-        * bindings/objc/DOMUtility.mm:
-        (JSC::createDOMWrapper): Conditionalize code with ENABLE(XPATH).
-        * dom/XMLTokenizerLibxml2.cpp:
-        (WebCore::errorFunc): Conditionalize method with ENABLE(XSLT) to
-        prevent an unused code warning.
-
-2008-09-26  Kevin McCullough  <kmccullough@apple.com>
-
-        Rubber stamped by Tim Hatcher.
-
-        Bug 21098: Crashing under Console::log
-        - Speculative ASSERT to help find the problem.
-
-        * page/InspectorController.cpp:
-        (WebCore::ConsoleMessage::isEqual):
-
-2008-09-26  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        [gtk+] Build fix for the latest ScrollView changes
-
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::adjustmentChanged):
-        (WebCore::ScrollView::ScrollViewPrivate::valueChanged):
-
-2008-09-26  Timothy Hatcher  <timothy@apple.com>
-
-        Fixes a bug where the console message repeat count would be wrong
-        when typing commands in between repeated messages.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21145
-
-        Reviewed by Kevin McCullough.
-
-        * page/InspectorController.cpp:
-        (WebCore::InspectorController::clearConsoleMessages): Reset m_groupLevel.
-        (WebCore::InspectorController::didCommitLoad): Call clearConsoleMessages.
-        * page/inspector/Console.js:
-        (WebInspector.Console.prototype.addMessage): Remember the original repeat count
-        for each message as totalRepeatCount, since we now modify repeatCount to mean
-        repeats since previous console command. If repeatCountBeforeCommand is a number,
-        subtract that value from the repeatCount.
-        (WebInspector.Console.prototype.clearMessages): Delete the repeatCountBeforeCommand
-        and commandSincePreviousMessage properties.
-
-2008-09-26  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Antti
-
-        https://bugs.webkit.org/show_bug.cgi?id=21116
-        <rdar://problem/5726325> Audio from <video> can still be heard after navigating 
-        back to page with <video>, then closing tab
-
-        Rename willSaveToCache/didRestoreFromCache callbacks to documentWillBecomeInactive/
-        documentDidBecomeActive, and post documentWillBecomeInactive when a page is marked for
-        deletion.
-
-        * dom/Document.cpp:
-        (WebCore::Document::documentWillBecomeInactive):
-        (WebCore::Document::documentDidBecomeActive):
-        (WebCore::Document::registerForDocumentActivationCallbacks):
-        (WebCore::Document::unregisterForDocumentActivationCallbacks):
-        * dom/Document.h:
-        * dom/Element.h:
-        (WebCore::Element::documentWillBecomeInactive):
-        (WebCore::Element::documentDidBecomeActive):
-        * history/CachedPage.cpp:
-        (WebCore::CachedPage::CachedPage):
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::~HTMLFormElement):
-        (WebCore::HTMLFormElement::parseMappedAttribute):
-        (WebCore::HTMLFormElement::documentDidBecomeActive):
-        (WebCore::HTMLFormElement::willMoveToNewOwnerDocument):
-        (WebCore::HTMLFormElement::didMoveToNewOwnerDocument):
-        * html/HTMLFormElement.h:
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::~HTMLInputElement):
-        (WebCore::HTMLInputElement::setInputType):
-        (WebCore::HTMLInputElement::parseMappedAttribute):
-        (WebCore::HTMLInputElement::needsActivationCallback):
-        (WebCore::HTMLInputElement::registerForActivationCallbackIfNeeded):
-        (WebCore::HTMLInputElement::unregisterForActivationCallbackIfNeeded):
-        (WebCore::HTMLInputElement::documentDidBecomeActive):
-        (WebCore::HTMLInputElement::willMoveToNewOwnerDocument):
-        (WebCore::HTMLInputElement::didMoveToNewOwnerDocument):
-        * html/HTMLInputElement.h:
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::HTMLMediaElement):
-        (WebCore::HTMLMediaElement::~HTMLMediaElement):
-        (WebCore::HTMLMediaElement::documentWillBecomeInactive):
-        (WebCore::HTMLMediaElement::documentDidBecomeActive):
-        * html/HTMLMediaElement.h:
-        (WebCore::HTMLMediaElement::inActiveDocument):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::opened):
-        * page/Page.cpp:
-        (WebCore::Page::~Page):
-        * rendering/RenderMedia.cpp:
-        (WebCore::RenderMedia::updateControls):
-        * rendering/RenderVideo.cpp:
-        (WebCore::RenderVideo::updatePlayer):
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::SVGSVGElement):
-        (WebCore::SVGSVGElement::~SVGSVGElement):
-        (WebCore::SVGSVGElement::documentWillBecomeInactive):
-        (WebCore::SVGSVGElement::documentDidBecomeActive):
-        * svg/SVGSVGElement.h:
-
-2008-09-26  Ariya Hidayat  <ariya.hidayat@trolltech.com>
-
-        Reviewed by Simon
-
-        Fix the build inside Qt, don't create faulty prl files for now.
-
-        * WebCore.pro:
-
-2008-09-26  Simon Hausmann  <hausmann@webkit.org>
-
-        Fix compilation on Qt/Windows
-
-        * Add WebCore/ to the include path so that config.h is found that enables JSC
-        * Link against winmm for the multimedia timer functions
-        * Include DateMath.h instead of JavaScriptCore/DateMath.h as file is in the kjs/
-        subdirectory
-        * In PluginViewWin.cpp don't use setPlatformWidget with the HWND for the Qt/Windows port
-        but set m_window directly as setPlatformWidget takes a QWidget*.
-
-        * WebCore.pro:
-        * platform/win/SystemTimeWin.cpp:
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::init):
-
-2008-09-26  Oliver Hunt  <oliver@apple.com>
 
-        Reviewed by Maciej Stachowiak.
-
-        Bug 21054: Construction of certain DOM objects is heavily regressed by r36675
-        <https://bugs.webkit.org/show_bug.cgi?id=21054>
-
-        This performance regression is actually just a symptom of a correctness
-        bug.  The constructor objects for a number of properties that have security
-        checks on access were returning new objects each time.  The most obvious
-        symptom of this bug is that window.Image != window.Image, etc.
-
-        The solution to this is to make sure we cache these constructors
-        in the same way as all the other DOM constructors.  To achieve this
-        without causing any refcount cycles it is necessary to replace the
-        refcounted document pointer in the Image, MessageChannel, Option, 
-        XMLHttpRequest, and Audio constructor objects with a reference to 
-        the document's JS wrapper.
-
-        Tests: fast/dom/constructors-cached-navigate.html
-               fast/dom/constructors-cached.html
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSAudioConstructor.cpp:
-        (WebCore::JSAudioConstructor::mark):
-        * bindings/js/JSAudioConstructor.h:
-        (WebCore::JSAudioConstructor::document):
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::getDOMConstructor):
-        (WebCore::JSDOMWindowBase::getValueProperty):
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSHTMLOptionElementConstructor.cpp:
-        (WebCore::JSHTMLOptionElementConstructor::mark):
-        * bindings/js/JSHTMLOptionElementConstructor.h:
-        (WebCore::JSHTMLOptionElementConstructor::document):
-        * bindings/js/JSImageConstructor.cpp:
-        (WebCore::JSImageConstructor::mark):
-        * bindings/js/JSImageConstructor.h:
-        (WebCore::JSImageConstructor::document):
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        (WebCore::JSXMLHttpRequestConstructor::mark):
-        * bindings/js/JSXMLHttpRequestConstructor.h:
-        (WebCore::JSXMLHttpRequestConstructor::document):
-
-2008-09-26  Simon Hausmann  <hausmann@webkit.org>
-
-        Unreviewed one-liner build fix for the Qt/Windows build.
-
-        The build requires NPAPI support to be enabled, fix the condition in
-        the .pro file for that.
-
-        * WebCore.pro:
-
-2008-09-26  Trenton Schulz <twschulz@trolltech.com>
-
-        Reviewed by Simon.
-
-        Fix compilation with the Qt/Cocoa port.
-
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::updateScrollbars):
-
-2008-09-26  Simon Hausmann  <hausmann@webkit.org>
-
-        Reviewed by Holger.
-
-        Fix compilation with VC9SP1, work around bug in TR1 library by
-        disabling it.
-
-        * WebCore.pro:
-
-2008-09-26  Simon Hausmann  <hausmann@webkit.org>
-
-        Reviewed by Holger.
-
-        Fix an lupdate() warning.
-
-        Don't use tr() in a class that is not a QObject, use
-        QCoreApplication::translate() directly.
-
-        * platform/qt/ScrollbarQt.cpp:
-        (WebCore::Scrollbar::handleContextMenuEvent):
-
-2008-09-25  David Hyatt  <hyatt@apple.com>
-
-        Remove the scrollTo() method from FrameView, since it is not used by anyone.
-
-        Reviewed by Oliver Hunt
-
-        * page/FrameView.cpp:
-        * page/FrameView.h:
-
-2008-09-25  David Hyatt  <hyatt@apple.com>
-
-        Make scrollRectIntoViewRecursively cross-platform.
-
-        Reviewed by Oliver Hunt
-
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::scrollRectIntoViewRecursively):
-        * platform/gtk/ScrollViewGtk.cpp:
-        * platform/mac/ScrollViewMac.mm:
-        * platform/qt/ScrollViewQt.cpp:
-        * platform/win/ScrollViewWin.cpp:
-        * platform/wx/ScrollViewWx.cpp:
-
-2008-09-25  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21133
-        
-        Rename resizeContents method on ScrollView to setContentsSize (to match contentsSize()).  Make it
-        cross-platform.
-
-        Reviewed by Oliver Hunt
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::begin):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::adjustViewSize):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::setContentsSize):
-        * platform/ScrollView.h:
-        (WebCore::ScrollView::updateScrollbars):
-        * platform/gtk/ScrollViewGtk.cpp:
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::platformSetContentsSize):
-        * platform/qt/ScrollViewQt.cpp:
-        * platform/win/ScrollViewWin.cpp:
-        * platform/wx/ScrollViewWx.cpp:
-        (WebCore::ScrollView::platformSetContentsSize):
-
-2008-09-25  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21132
-
-        Clean up the methods that actually do the scrolling in ScrollView.
-
-        Reviewed by Oliver Hunt
-
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::setScrollLeft):
-        (WebCore::HTMLBodyElement::setScrollTop):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::restoreScrollPositionAndViewState):
-        * loader/ImageDocument.cpp:
-        (WebCore::ImageDocument::imageClicked):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::scrollBy):
-        (WebCore::DOMWindow::scrollTo):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::scrollTo):
-        (WebCore::FrameView::setScrollPosition):
-        * page/FrameView.h:
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::maximumScrollPosition):
-        * platform/ScrollView.h:
-        (WebCore::ScrollView::contentsWidth):
-        (WebCore::ScrollView::contentsHeight):
-        (WebCore::ScrollView::scrollBy):
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::setScrollPosition):
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::setScrollPosition):
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::setScrollPosition):
-        (WebCore::ScrollView::scrollRectIntoViewRecursively):
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::setScrollPosition):
-        (WebCore::ScrollView::scrollRectIntoViewRecursively):
-        * platform/wx/ScrollViewWx.cpp:
-        (WebCore::ScrollView::setScrollPosition):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::scrollByRecursively):
-        (WebCore::RenderLayer::scrollRectToVisible):
-
-2008-09-25  Dan Bernstein  <mitz@apple.com>
-
-        - attempted Windows build fix
-
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::valueChanged):
-        (WebCore::ScrollView::setContentsPos):
-        (WebCore::ScrollView::paint):
-
-2008-09-25  Timothy Hatcher  <timothy@apple.com>
-
-        Revert the padding changes done in r36905 to prevent the
-        scrollbar from overlapping the URLs in the Console.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21126
-
-        * page/inspector/inspector.css:
-
-2008-09-25  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21129
-
-        Refactor contents size and scroll offset to be cross-platform.  Reduce further the number
-        of platform-specific methods required of ScrollView implementations.
-
-        Reviewed by Tim Hatcher
-
-        * dom/MouseRelatedEvent.cpp:
-        (WebCore::contentsX):
-        (WebCore::contentsY):
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::scrollLeft):
-        (WebCore::HTMLBodyElement::setScrollLeft):
-        (WebCore::HTMLBodyElement::scrollTop):
-        (WebCore::HTMLBodyElement::setScrollTop):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::saveScrollPositionAndViewStateToItem):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::scrollX):
-        (WebCore::DOMWindow::scrollY):
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::hitTestResultAtPoint):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::scrollTo):
-        (WebCore::FrameView::windowClipRect):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::visibleContentRect):
-        (WebCore::ScrollView::contentsSize):
-        (WebCore::ScrollView::platformContentsSize):
-        * platform/ScrollView.h:
-        (WebCore::ScrollView::scrollPosition):
-        (WebCore::ScrollView::scrollOffset):
-        (WebCore::ScrollView::scrollX):
-        (WebCore::ScrollView::scrollY):
-        (WebCore::ScrollView::contentsWidth):
-        (WebCore::ScrollView::contentsHeight):
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::adjustmentChanged):
-        (WebCore::ScrollView::setGtkAdjustments):
-        (WebCore::ScrollView::resizeContents):
-        (WebCore::ScrollView::contentsWidth):
-        (WebCore::ScrollView::contentsHeight):
-        (WebCore::ScrollView::scrollOffset):
-        (WebCore::ScrollView::maximumScroll):
-        (WebCore::ScrollView::scrollBy):
-        (WebCore::ScrollView::suppressScrollbars):
-        (WebCore::ScrollView::setHScrollbarMode):
-        (WebCore::ScrollView::setVScrollbarMode):
-        (WebCore::ScrollView::setScrollbarsMode):
-        (WebCore::ScrollView::setFrameGeometry):
-        (WebCore::ScrollView::updateScrollbars):
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::platformContentsSize):
-        (WebCore::ScrollView::scrollBy):
-        * platform/mac/WidgetMac.mm:
-        (WebCore::Widget::convertFromContainingWindow):
-        (WebCore::Widget::convertToContainingWindow):
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::valueChanged):
-        (WebCore::ScrollView::resizeContents):
-        (WebCore::ScrollView::setFrameGeometry):
-        (WebCore::ScrollView::scrollOffset):
-        (WebCore::ScrollView::maximumScroll):
-        (WebCore::ScrollView::scrollBy):
-        (WebCore::ScrollView::setHScrollbarMode):
-        (WebCore::ScrollView::setVScrollbarMode):
-        (WebCore::ScrollView::setScrollbarsMode):
-        (WebCore::ScrollView::updateScrollbars):
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::valueChanged):
-        (WebCore::ScrollView::ScrollViewPrivate::setAllowsScrolling):
-        (WebCore::ScrollView::resizeContents):
-        (WebCore::ScrollView::setFrameGeometry):
-        (WebCore::ScrollView::scrollOffset):
-        (WebCore::ScrollView::maximumScroll):
-        (WebCore::ScrollView::scrollBy):
-        (WebCore::ScrollView::setHScrollbarMode):
-        (WebCore::ScrollView::setVScrollbarMode):
-        (WebCore::ScrollView::setScrollbarsMode):
-        (WebCore::ScrollView::updateScrollbars):
-        * platform/wx/ScrollViewWx.cpp:
-        (WebCore::ScrollView::platformVisibleContentRect):
-        (WebCore::ScrollView::platformContentsSize):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::nodeAtPoint):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::scrollRectToVisible):
-        (WebCore::RenderLayer::calculateClipRects):
-        (WebCore::RenderLayer::calculateRects):
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::absolutePosition):
-        (WebCore::RenderView::computeAbsoluteRepaintRect):
-
-2008-09-25  David Smith  <catfish.man@gmail.com>
-
-        Reviewed by Dave Hyatt.
+2009-06-19  Simon Fraser  <simon.fraser@apple.com>
 
-        Fix a nasty regression I introduced in the previous commit, which caused infinite recursion on facebook.
-
-        * dom/Element.cpp:
-        (WebCore::Element::rareData):
-        * dom/Element.h:
-        * dom/Node.cpp:
-        (WebCore::Node::rareData):
-        * dom/Node.h:
-
-2008-09-25  David Smith  <catfish.man@gmail.com>
-
-        Reviewed by Darin Adler.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=20980
-        Split off uncommonly used data from Node similar to ElementRareData
-        
-        Saves an OwnPtr and a short on Node, as well as providing room for an isContainer bit,
-        which in turn allows inlining firstChild(), lastChild(), childNodeCount(), and childNode()
-        for a 5-10+% performance win on SlickSpeed and assorted speedups on other tests.
-
-        * WebCore.base.exp: 
-        * WebCore.xcodeproj/project.pbxproj:
-        * dom/ChildNodeList.cpp: Include ContainerNode to pick up its definitions for childNodeCount(), etc...
-        * dom/ContainerNode.cpp: Set isContainer to true
-        (WebCore::ContainerNode::ContainerNode):
-        * dom/ContainerNode.h: These Node inlines are here to avoid including ContainerNode.h in Node.h
-        (WebCore::Node::containerChildNodeCount): Use ContainerNode's definition, having proved that the Node is a container
-        (WebCore::Node::containerChildNode): ditto
-        (WebCore::Node::containerFirstChild): ditto
-        (WebCore::Node::containerLastChild): ditto
-        * dom/Element.cpp: Most of the changes here are moving ElementRareData to ElementRareData.h and NodeRareData.h
-        (WebCore::Element::Element): 
-        (WebCore::Element::~Element):
-        (WebCore::Element::rareData):
-        (WebCore::Element::ensureRareData): Renamed from createRareData
-        (WebCore::Element::createRareData): Used by ensureRareData to get the correct rareData type
-        (WebCore::Element::attach): Check hasRareData rather than null-checking rareData()
-        (WebCore::Element::detach): ditto
-        (WebCore::Element::recalcStyle): ditto
-        (WebCore::Element::focus):
-        (WebCore::Element::minimumSizeForResizing): ditto
-        (WebCore::Element::setMinimumSizeForResizing): ditto
-        (WebCore::Element::computedStyle):
-        (WebCore::Element::cancelFocusAppearanceUpdate): ditto
-        * dom/Element.h:
-        * dom/ElementRareData.h: Added; everything copied from Element.cpp
-        (WebCore::defaultMinimumSizeForResizing):
-        (WebCore::ElementRareData::ElementRareData):
-        (WebCore::ElementRareData::resetComputedStyle):
-        * dom/EventTargetNode.cpp:
-        (WebCore::EventTargetNode::EventTargetNode): Pass the isContainer flag up the chain
-        * dom/EventTargetNode.h:
-        * dom/Node.cpp:
-        (WebCore::Node::Node):
-        (WebCore::Node::~Node): rareData cleanup code moved from Element and changed to use hasRareData
-        (WebCore::Node::rareData):
-        (WebCore::Node::ensureRareData):
-        (WebCore::Node::createRareData):
-        (WebCore::Node::tabIndex): nonzero tab indexes are now in rareData
-        (WebCore::Node::setTabIndexExplicitly):
-        (WebCore::Node::childNodes): NodeLists are now in rareData
-        (WebCore::Node::setFocus):
-        (WebCore::Node::rareDataFocused):
-        (WebCore::Node::isFocusable):
-        (WebCore::Node::isKeyboardFocusable):
-        (WebCore::Node::registerDynamicNodeList): NodeLists are now in rareData
-        (WebCore::Node::unregisterDynamicNodeList): ditto
-        (WebCore::Node::notifyLocalNodeListsAttributeChanged): ditto
-        (WebCore::Node::notifyLocalNodeListsChildrenChanged): ditto
-        (WebCore::Node::getElementsByName): ditto
-        (WebCore::Node::getElementsByClassName): ditto
-        * dom/Node.h:
-        (WebCore::Node::firstChild): Use isContainerNode() to devirtualize
-        (WebCore::Node::lastChild): ditto
-        (WebCore::Node::isContainerNode): Take advantage of a newly freed bit to store whether we're a container
-        (WebCore::Node::focused): focus is in rareData if set
-        (WebCore::Node::childTypeAllowed):
-        (WebCore::Node::childNodeCount): Use isContainerNode() to devirtualize
-        (WebCore::Node::childNode): ditto
-        (WebCore::Node::hasRareData): Use another newly freed bit to store whether we have rare data; avoids doing hash lookups in the common case
-        * dom/NodeRareData.h: Added. Most of this is just properties moved from Node
-        (WebCore::NodeListsNodeData::~NodeListsNodeData): Moved from Node.cpp since we NodeRareData needs to put them in a HashTable :(
-        (WebCore::NodeRareData::NodeRareData):
-        (WebCore::NodeRareData::rareDataMap):
-        (WebCore::NodeRareData::rareDataFromMap):
-        (WebCore::NodeRareData::clearNodeLists):
-        (WebCore::NodeRareData::setNodeLists):
-        (WebCore::NodeRareData::nodeLists):
-        (WebCore::NodeRareData::tabIndex):
-        (WebCore::NodeRareData::setTabIndex):
-        (WebCore::NodeRareData::tabIndexSetExplicitly):
-        * dom/TreeWalker.cpp: Include ContainerNode to pick up its definitions for childNodeCount(), etc...
-        * xml/XPathUtil.cpp: Include ContainerNode to pick up its definitions for childNodeCount(), etc...
-
-2008-09-25  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon Hausmann.
-
-        [qt] ImageBuffer::toDataURL implementation
-
-        There needs to be a Qt specific test result for the above mentioned
-        implementation.
-
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::ImageBuffer::toDataURL):
-
-2008-09-25  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon Hausmann.
-
-        [qt] Implement SharedBuffer for Qt.
-
-        * WebCore.pro:
-        * platform/qt/SharedBufferQt.cpp: Added.
-        (WebCore::SharedBuffer::createWithContentsOfFile):
-        * platform/qt/TemporaryLinkStubs.cpp:
-
-2008-09-25  Feng Qian <feng@chromium.org>
-
-        Fix bug: https://bugs.webkit.org/show_bug.cgi?id=21032
-        <rdar://problem/6243032>
-
-        Reviewed by Dave Hyatt.
-
-        Test: fast/dom/attribute-downcast-right.html
-
-        Add isMappedAttribute function to Attribute for checking if an object
-        is an instance of MappedAttribute. Removed attributeItem,
-        getAttributeItem functions from NamedMappedAttrMap, and callers
-        expecting MappedAttribute have to check isMappedAttribute before
-        downcasting the return value to MappedAttribute.
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::styleForElement):
-        * dom/Attribute.h:
-        (WebCore::Attribute::isMappedAttribute):
-        * dom/MappedAttribute.h:
-        (WebCore::MappedAttribute::isMappedAttribute):
-        * dom/NamedMappedAttrMap.cpp:
-        (WebCore::NamedMappedAttrMap::declCount):
-        (WebCore::NamedMappedAttrMap::mapsEquivalent):
-        * dom/NamedMappedAttrMap.h:
-        * dom/StyledElement.cpp:
-        (WebCore::StyledElement::attributeChanged):
-        * html/HTMLInputElement.cpp:
-        (WebCore::HTMLInputElement::setInputType):
-        * svg/SVGForeignObjectElement.cpp:
-        (WebCore::addCSSPropertyAndNotifyAttributeMap):
-        * svg/SVGStyledElement.cpp:
-        (WebCore::SVGStyledElement::getPresentationAttribute):
-
-2008-09-25  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21120
-
-        Make visibleContentRect cross-platform.  Note this does add new horizontal/verticalScrollbar accessors
-        to a bunch of platforms.  This is a temporary evil until the scrollbars get made cross-platform (and I
-        didn't want to mix that change in with this patch).
-
-        Reviewed by Sam Weinig
-
-        * page/Frame.cpp:
-        (WebCore::Frame::markAllMatchesForText):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::repaintContentRectangle):
-        (WebCore::FrameView::windowClipRect):
-        (WebCore::FrameView::updateControlTints):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::visibleContentRect):
-        (WebCore::ScrollView::platformVisibleContentRect):
-        * platform/ScrollView.h:
-        (WebCore::ScrollView::visibleWidth):
-        (WebCore::ScrollView::visibleHeight):
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::horizontalScrollbar):
-        (WebCore::ScrollView::verticalScrollbar):
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::horizontalScrollbar):
-        (WebCore::ScrollView::verticalScrollbar):
-        (WebCore::ScrollView::platformVisibleContentRect):
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::horizontalScrollbar):
-        (WebCore::ScrollView::verticalScrollbar):
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::horizontalScrollbar):
-        (WebCore::ScrollView::verticalScrollbar):
-        * platform/wx/ScrollViewWx.cpp:
-        (WebCore::ScrollView::platformVisibleContentRect):
-        (WebCore::ScrollView::horizontalScrollbar):
-        (WebCore::ScrollView::verticalScrollbar):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::scrollRectToVisible):
-        (WebCore::frameVisibleRect):
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::viewRect):
-
-2008-09-25  David Smith  <catfish.man@gmail.com>
-
-        Reviewed by Timothy Hatcher
+        Reviewed by John Sullivan
 
-        https://bugs.webkit.org/show_bug.cgi?id=21052
-        Generalize id selector special case for querySelectorAll
-        
-        By checking the element we get with getElementById against the selector, we can use the special case in many more circumstances.
-        Changes results on http://native.khan.mozilla.org 
-        from
-            #title: 2ms
-            h1#title: 55ms
-            div #title: 55ms
-
-        to:
-            #title: 1ms
-            h1#title: 2ms
-            div #title: 5ms
+        <rdar://problem/6953673> Crash in RenderLayerCompositor::setCompositingParent
         
-        * dom/Node.cpp:
-        (WebCore::Node::querySelector):
-        * dom/SelectorNodeList.cpp:
-        (WebCore::createSelectorNodeList):
-
-2008-09-25  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21118
-
-        Make the concept of whether you can blit on scroll cross-platform on ScrollView.
-
-        Reviewed by Sam Weinig
-
-        * page/FrameView.cpp:
-        (WebCore::FrameView::clear):
-        (WebCore::FrameView::layout):
-        (WebCore::FrameView::setUseSlowRepaints):
-        (WebCore::FrameView::addSlowRepaintObject):
-        (WebCore::FrameView::removeSlowRepaintObject):
-        * platform/ScrollView.cpp:
-        (WebCore::ScrollView::init):
-        (WebCore::ScrollView::addChild):
-        (WebCore::ScrollView::removeChild):
-        (WebCore::ScrollView::setCanBlitOnScroll):
-        * platform/ScrollView.h:
-        (WebCore::ScrollView::canBlitOnScroll):
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
-        (WebCore::ScrollView::ScrollViewPrivate::scrollBackingStore):
-        (WebCore::ScrollView::ScrollView):
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::ScrollView):
-        (WebCore::ScrollView::platformAddChild):
-        (WebCore::ScrollView::platformRemoveChild):
-        (WebCore::ScrollView::platformSetCanBlitOnScroll):
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
-        (WebCore::ScrollView::ScrollViewPrivate::scrollBackingStore):
-        (WebCore::ScrollView::ScrollView):
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
-        (WebCore::ScrollView::ScrollViewPrivate::scrollBackingStore):
-        (WebCore::ScrollView::ScrollView):
-        * platform/wx/ScrollViewWx.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
-        (WebCore::ScrollView::ScrollView):
-        (WebCore::ScrollView::scrollBy):
-
-2008-09-25  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        Bug 21109: Console should right-align urls
-
-        * page/inspector/Console.js: Re-order the message elements so that when
-        it overflows it doesn't get mixed in with the next message.
-        * page/inspector/inspector.css:
-
-2008-09-25  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21113
-
-        Putting r36771 back in with a fix to the addPendingSheet check in CSSImportRule::insertedIntoParent.
-
-        Reviewed by Darin Adler
-
-        * css/CSSImportRule.cpp:
-        (WebCore::CSSImportRule::insertedIntoParent):
-        * css/CSSRule.cpp:
-        (WebCore::CSSRule::parentStyleSheet):
-        (WebCore::CSSRule::parentRule):
-        * css/CSSStyleSheet.cpp:
-        (WebCore::CSSStyleSheet::CSSStyleSheet):
-        * css/CSSStyleSheet.h:
-
-2008-09-25  Darin Adler  <darin@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=21115
-          <rdar://problem/6245773> REGRESSION (r34702): Safari no longer zips
-          bundled documents
-
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::formData): Use files() instead of value()
-        to get the path, since value() now returns just the basename.
-
-2008-09-25  Brady Eidson  <beidson@apple.com>
-
-        Rubberstamped by Mark Rowe
-
-        Roll out 36771 as it caused <rdar://problem/6246554>
-        "nytimes.com doesn't display after returning to it with back/forward"
-
-        * css/CSSImportRule.cpp:
-        (WebCore::CSSImportRule::insertedIntoParent):
-        * css/CSSRule.cpp:
-        (WebCore::CSSRule::parentStyleSheet):
-        (WebCore::CSSRule::parentRule):
-        * css/CSSStyleSheet.cpp:
-        (WebCore::CSSStyleSheet::CSSStyleSheet):
-        (WebCore::CSSStyleSheet::docLoader):
-        * css/CSSStyleSheet.h:
-        (WebCore::CSSStyleSheet::doc):
-
-2008-09-25  Adam Roben  <aroben@apple.com>
-
-        Windows build fix
-
-        * WebCore.vcproj/WebCore.vcproj: Add ScrollView.cpp to the project.
-
-2008-09-25  Dan Bernstein  <mitz@apple.com>
-
-        - Windows build fix
-
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::addChildPlatformWidget):
-        (WebCore::ScrollView::removeChildPlatformWidget):
-
-2008-09-25  Timothy Hatcher  <timothy@apple.com>
+        Fix a crash that could occur in complex content due to timing issues
+        when doing a partial layer tree rebuild which is required when painting;
+        setCompositingParent() could be called with a parent which has not been made
+        compositing yet.
 
-        Fixes a leak of ConsoleMessage seen when repeated console
-        messages occur.
+2009-06-19  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
 
-        Reviewed by Mark Rowe.
-
-        * page/InspectorController.cpp:
-        (WebCore::InspectorController::addConsoleMessage): Delete the repeat
-        since we don't add it to m_consoleMessages.
-
-2008-09-25  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Bug 21105: XHRs logged in the console may show the wrong URL for the
-        source
-        - Get the url at the time of the send() and pass it on to the XHR.
+        Build fix. Adding missing HTMLDataGrid* files to the build.
 
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::send):
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::didFinishLoading):
-        * xml/XMLHttpRequest.h:
-        (WebCore::XMLHttpRequest::setLastSendURL):
-
-2008-09-25  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Geoff and Tim.
-
-        Bug 20322: XHRs logged in the console do not have line numbers
-        - Get the line number at the time of the send and pass it on to the XHR.
-
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::send):
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::XMLHttpRequest):
-        (WebCore::XMLHttpRequest::didFinishLoading):
-        * xml/XMLHttpRequest.h:
-        (WebCore::XMLHttpRequest::setLastSendLineNumber):
+        * GNUmakefile.am:
 
-2008-09-25  Eric Carlson  <eric.carlson@apple.com>
+2009-06-19  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Eric Seidel.
-        
-        <rdar://problem/6171047> HTMLMediaElement "begin" event is now "loadstart"
-        https://bugs.webkit.org/show_bug.cgi?id=21003
-
-        * dom/EventNames.h: remove "begin" event
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::load): Post "loadstart" event instead of "begin"
-
-2008-09-25  Alexey Proskuryakov  <ap@webkit.org>
 
-        Reviewed by Eric Seidel.
+        https://bugs.webkit.org/show_bug.cgi?id=26460 part three
+        Make BMPImageReader a standalone class that is used by ICOImageDecoder
+        and BMPImageDecoder to decode individual BMPs within a file.  These
+        decoders now inherit directly from ImageDecoder.
+        
+        This also makes these decoders decode on-demand in isSizeAvailable() and
+        frameBufferAtIndex(), like the other decoders, instead of when setData()
+        is called, like before.  This should provide a speedup on pages
+        containing BMPs that aren't immediately onscreen.
+
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::BMPImageDecoder):
+        (WebCore::BMPImageDecoder::setData):
+        (WebCore::BMPImageDecoder::isSizeAvailable):
+        (WebCore::BMPImageDecoder::frameBufferAtIndex):
+        (WebCore::BMPImageDecoder::decodeWithCheckForDataEnded):
+        (WebCore::BMPImageDecoder::decode):
+        (WebCore::BMPImageDecoder::processFileHeader):
+        * platform/image-decoders/bmp/BMPImageDecoder.h:
+        (WebCore::BMPImageDecoder::readUint32):
+        * platform/image-decoders/bmp/BMPImageReader.cpp:
+        (WebCore::BMPImageReader::BMPImageReader):
+        (WebCore::BMPImageReader::decodeBMP):
+        (WebCore::BMPImageReader::readInfoHeaderSize):
+        (WebCore::BMPImageReader::processInfoHeader):
+        (WebCore::BMPImageReader::readInfoHeader):
+        (WebCore::BMPImageReader::processBitmasks):
+        (WebCore::BMPImageReader::processColorTable):
+        (WebCore::BMPImageReader::processRLEData):
+        (WebCore::BMPImageReader::processNonRLEData):
+        (WebCore::BMPImageReader::setFailed):
+        * platform/image-decoders/bmp/BMPImageReader.h:
+        (WebCore::BMPImageReader::readUint16):
+        (WebCore::BMPImageReader::readUint32):
+        (WebCore::BMPImageReader::setBuffer):
+        (WebCore::BMPImageReader::setData):
+        (WebCore::BMPImageReader::):
+        (WebCore::BMPImageReader::pastEndOfImage):
+        (WebCore::BMPImageReader::readCurrentPixel):
+        (WebCore::BMPImageReader::setRGBA):
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::ICOImageDecoder):
+        (WebCore::ICOImageDecoder::setData):
+        (WebCore::ICOImageDecoder::isSizeAvailable):
+        (WebCore::ICOImageDecoder::size):
+        (WebCore::ICOImageDecoder::frameBufferAtIndex):
+        (WebCore::ICOImageDecoder::decodeWithCheckForDataEnded):
+        (WebCore::ICOImageDecoder::decode):
+        (WebCore::ICOImageDecoder::processDirectory):
+        (WebCore::ICOImageDecoder::processDirectoryEntries):
+        (WebCore::ICOImageDecoder::readDirectoryEntry):
+        (WebCore::ICOImageDecoder::processImageType):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+        (WebCore::ICOImageDecoder::readUint16):
+        (WebCore::ICOImageDecoder::readUint32):
 
-        https://bugs.webkit.org/show_bug.cgi?id=21097
-        Calling a MessageChannel constructor from a destroyed document results in a crash
+2009-06-19  Adam Barth  <abarth@webkit.org>
 
-        Test: fast/events/message-port-constructor-for-deleted-document.html
+        Reviewed by Dimitri Glazkov.
 
-        * bindings/js/JSMessageChannelConstructor.cpp:
-        (WebCore::JSMessageChannelConstructor::construct):
-        * bindings/js/JSMessageChannelConstructor.h:
-        Made m_document a RefPtr.
+        https://bugs.webkit.org/show_bug.cgi?id=26555
 
-2008-09-24  Alexey Proskuryakov  <ap@webkit.org>
+        Fix the Chromium canary bot.  Turns out ScriptSourceCode doesn't have
+        the same API in V8 and JSC.
 
-        Reviewed by Sam Weinig, Anders Carlsson, and (unofficially) Adam Barth.
+        * WebCore/bindings/js/ScriptController.cpp:
+        * WebCore/bindings/js/ScriptSourceCode.h:
+        * WebCore/bindings/v8/ScriptController.cpp:
+        * WebCore/page/XSSAuditor.cpp:
+        * WebCore/page/XSSAuditor.h:
 
-        https://bugs.webkit.org/show_bug.cgi?id=20879
-        Implement HTML5 channel messaging
+2009-06-19  David Hyatt  <hyatt@apple.com>
 
-        Tests: fast/events/message-channel-gc.html
-               fast/events/message-port-deleted-document.html
-               fast/events/message-port-deleted-frame.html
-               fast/events/message-port-inactive-document.html
-               fast/events/message-port.html
-               http/tests/security/MessagePort/event-listener-context.html
+        Reviewed by Anders Carlsson.
 
-        * Configurations/WebCore.xcconfig:
-        Removed unused  ENABLE_CROSS_DOCUMENT_MESSAGING macro.
+        https://bugs.webkit.org/show_bug.cgi?id=26547
+        
+        Implement the IDL interface for HTMLDataGridColElement.
 
+        * DerivedSources.cpp:
         * DerivedSources.make:
-        Added MessageChannel and MessagePort.
-
-        * WebCore.pro: Made MessageEvent compilation unconditional, as it could not possibly be
-        turmed off anyway. Added new files.
-
         * GNUmakefile.am:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
         * WebCoreSources.bkl:
-        Added new files.
-
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSDOMWindowBase.cpp: (WebCore::JSDOMWindowBase::getValueProperty):
-        Added suport for window.MessageChannel constructor.
-
-        * bindings/js/JSDOMWindowCustom.cpp: (WebCore::JSDOMWindow::postMessage):
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::postMessage):
-        * page/DOMWindow.h:
+        * html/HTMLAttributeNames.in:
+        * html/HTMLDataGridColElement.cpp: Added.
+        (WebCore::HTMLDataGridColElement::HTMLDataGridColElement):
+        (WebCore::HTMLDataGridColElement::label):
+        (WebCore::HTMLDataGridColElement::setLabel):
+        (WebCore::HTMLDataGridColElement::type):
+        (WebCore::HTMLDataGridColElement::setType):
+        (WebCore::HTMLDataGridColElement::sortable):
+        (WebCore::HTMLDataGridColElement::setSortable):
+        (WebCore::HTMLDataGridColElement::sortDirection):
+        (WebCore::HTMLDataGridColElement::setSortDirection):
+        (WebCore::HTMLDataGridColElement::selected):
+        (WebCore::HTMLDataGridColElement::setSelected):
+        * html/HTMLDataGridColElement.h: Added.
+        (WebCore::HTMLDataGridColElement::endTagRequirement):
+        (WebCore::HTMLDataGridColElement::tagPriority):
+        * html/HTMLDataGridColElement.idl: Added.
+        * html/HTMLDataGridElement.h:
+        * html/HTMLElementsAllInOne.cpp:
+        * html/HTMLTagNames.in:
         * page/DOMWindow.idl:
-        Added support for three-argument postMessage (that posts a MessagePort).
-
-        * dom/EventTarget.cpp:
-        (WebCore::EventTarget::toMessagePort):
-        * dom/EventTarget.h:
-        * bindings/js/JSEventTargetBase.cpp: (WebCore::toJS): Added MessagePort as yet another
-        EventTarget variant.
-
-        * bindings/js/JSMessageChannelConstructor.h:
-        * bindings/js/JSMessageChannelConstructor.cpp: Added a custom constructor, so that it could
-        take a browsing context (document) parameter.
-
-        * bindings/js/JSMessageChannelCustom.cpp: Added.
-        (WebCore::JSMessageChannel::mark): JSMessageChannel uses a custom mark function to mark
-        port1 and port2 that it owns.
-
-        * bindings/js/JSMessagePortCustom.cpp: Added.
-        (WebCore::JSMessagePort::startConversation):
-        (WebCore::JSMessagePort::addEventListener):
-        (WebCore::JSMessagePort::removeEventListener):
-        (WebCore::JSMessagePort::dispatchEvent):
-        (WebCore::JSMessagePort::setOnmessage):
-        (WebCore::JSMessagePort::onmessage):
-        (WebCore::JSMessagePort::setOnclose):
-        (WebCore::JSMessagePort::onclose):
-        (WebCore::JSMessagePort::mark):
-        * dom/MessagePort.cpp: Added.
-        * dom/MessagePort.h: Added.
-        * dom/MessagePort.idl: Added.
-        Added a MessagePort implementation. Currently, it is not thread-safe at all, and only works
-        with Documents as contexts, but in the future, it will be used for communication with worker
-        threads.
-
-        * bindings/objc/DOMInternal.h: Include "DOMMessagePortInternal.h". The new APIs do not
-        really have Obj-C bindings, as they are far from being final, but a MessagePort stub is
-        needed for MessageEvent.
-
-        * bindings/scripts/CodeGeneratorJS.pm: Include PlatformString.h for MessagePort happiness.
-
-        * dom/Document.cpp:
-        (WebCore::MessagePortTimer::MessagePortTimer):
-        (WebCore::MessagePortTimer::fired):
-        (WebCore::Document::processMessagePortMessagesSoon):
-        (WebCore::Document::~Document):
-        (WebCore::Document::dispatchMessagePortEvents):
-        (WebCore::Document::createdMessagePort):
-        (WebCore::Document::destroyedMessagePort):
-        * dom/Document.h:
-        Document keeps track of all MessagePort objects that were created when it was fully active
-        in its context.
-
-        * dom/EventNames.h: Added closeEvent.
-
-        * dom/MessageChannel.cpp: Added.
-        (WebCore::MessageChannel::MessageChannel):
-        (WebCore::MessageChannel::~MessageChannel):
-        * dom/MessageChannel.h: Added.
-        (WebCore::MessageChannel::create):
-        (WebCore::MessageChannel::port1):
-        (WebCore::MessageChannel::port2):
-        * dom/MessageChannel.idl: Added.
-        Addded JSMessageChannel implementation.
-
-        * dom/MessageEvent.cpp:
-        (WebCore::MessageEvent::MessageEvent):
-        (WebCore::MessageEvent::initMessageEvent):
-        * dom/MessageEvent.h:
-        (WebCore::MessageEvent::create):
-        (WebCore::MessageEvent::messagePort):
-        * dom/MessageEvent.idl:
-        MessageEvent has a MessagePort member now, making it possible to pass ports across
-        documents.
-
-2008-09-25  David Smith  <catfish.man@gmail.com>
-
-        Reviewed by Eric Seidel
-        
-        fix https://bugs.webkit.org/show_bug.cgi?id=21091
-        Regression: querySelector matches tag names case sensitively
-        
-        Tests: fast/dom/SelectorAPI/caseTag.html
-               fast/dom/SelectorAPI/caseTagX.xhtml
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseSelector): Add a Document argument, since tag case sensitivity is different for HTML documents
-        * css/CSSParser.h:
-        * dom/Node.cpp:
-        (WebCore::Node::querySelector):
-        (WebCore::Node::querySelectorAll):
-
-2008-09-24  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21084
-
-        Make the m_children member of ScrollView cross-platform.  Consolidate children add/remove
-        functionality.  Add platform stubs for connecting/disconnecting the platform widgets.
-
-        Reviewed by Sam Weinig
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * platform/ScrollView.h:
-        (WebCore::ScrollView::children):
-        * platform/Widget.h:
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::addChildPlatformWidget):
-        (WebCore::ScrollView::removeChildPlatformWidget):
-        (WebCore::ScrollView::geometryChanged):
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::addChildPlatformWidget):
-        (WebCore::ScrollView::removeChildPlatformWidget):
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::geometryChanged):
-        (WebCore::ScrollView::addChildPlatformWidget):
-        (WebCore::ScrollView::removeChildPlatformWidget):
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::geometryChanged):
-        (WebCore::ScrollView::setParentVisible):
-        (WebCore::ScrollView::show):
-        (WebCore::ScrollView::hide):
-        * platform/wx/ScrollViewWx.cpp:
-        (WebCore::ScrollView::addChildPlatformWidget):
-        (WebCore::ScrollView::removeChildPlatformWidget):
-
-2008-09-25  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=21024
-          <rdar://problem/6240821> Scrollbar not painted until hovered
-
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::setWidgetGeometry): Replaced resizeWidget with
-        this method, which sets both the location and the size.
-        (WebCore::RenderWidget::setWidget): Replaced the call to resizeWidget
-        with a call to the new method setWidgetGeometry. Positioning the
-        widget correctly ensures that the scroll bars invalidate correctly when
-        they are created and resized.
-        * rendering/RenderWidget.h:
-
-2008-09-24  Dan Bernstein  <mitz@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        - create a "style" subfolder under "rendering" and move style files to that folder
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2008-09-24  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        Remove staticFunctionGetter.  There is only one remaining user of
-        staticFunctionGetter and it can be converted to use setUpStaticFunctionSlot.
-
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::getOwnPropertySlot):
-
-2008-09-24  Jeremy Moskovich  <jeremy@chromium.org>
-
-        Reviewed by Dan Bernstein.
-
-        Test: editing/spelling/inline_spelling_markers.html
-        
-        - https://bugs.webkit.org/show_bug.cgi?id=20092
-        Spelling markers positioned incorrectly in RTL text
-
-        Measure spelling markers with selectionRectForText() to fix RTL.
-
-        This patch also fixes hit-testing for spelling marker tool tips,
-        which used to work only on the first line.
-
-        * rendering/InlineTextBox.cpp:
-        (WebCore::InlineTextBox::paintSpellingOrGrammarMarker):
-
-2008-09-24  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21074
-
-        Make sure the viewless scrollbar knows how to paint properly when transformed.
-
-        Reviewed by Sam Weinig
-
-        * platform/mac/ScrollbarThemeMac.mm:
-        (WebCore::ScrollbarThemeMac::ScrollbarThemeMac):
-        (WebCore::ScrollbarThemeMac::paint):
-
-2008-09-24  Nikolas Zimmermann  <zimmermann@kde.org>
 
-        Not reviewed. Try to fix win build.
+2009-06-19  Chris Evans  <scarybeasts@gmail.com>
 
-        * bindings/js/JSSVGElementInstanceCustom.cpp:
-        (WebCore::toJS):
-        * dom/ContainerNodeAlgorithms.h:
-        (WebCore::removeAllChildrenInContainer):
-        (WebCore::appendChildToContainer):
-        (WebCore::Private::addChildNodesToDeletionQueue):
-
-2008-09-24  Nikolas Zimmermann  <zimmermann@kde.org>
-
-        Reviewed by Oliver.
-
-        Add ContainerNodeAlgorithms.h, as central place to share algorithms
-        operating on TreeShared-derived classes with a Node-style interface.
-
-        This allows SVGElementInstance & ContainerNode to share code.
-
-        * dom/ContainerNode.cpp:
-        (WebCore::ContainerNode::removeAllChildren):
-        (WebCore::ContainerNode::addChild):
-        * dom/ContainerNode.h:
-        * dom/ContainerNodeAlgorithms.h: Added.
-        (WebCore::removeAllChildrenInContainer):
-        (WebCore::appendChildToContainer):
-        (WebCore::Private::NodeRemovalDispatcher::dispatch):
-        (WebCore::Private::addChildNodesToDeletionQueue):
-
-2008-09-24  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        Wrap up dirtying the z-order list of the stacking context
-        RenderLayer into a method.
-        https://bugs.webkit.org/show_bug.cgi?id=21072
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::setHasVisibleContent):
-        (WebCore::RenderLayer::addChild):
-        (WebCore::RenderLayer::removeChild):
-        (WebCore::RenderLayer::dirtyStackingContextZOrderLists):
-        (WebCore::RenderLayer::styleChanged):
-        * rendering/RenderLayer.h:
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::setStyle):
-
-2008-09-24  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Tim.
-
-        Bug 21070: REGRESSION Repeated messages with arguments are not repeated
-        or displayed multiple times
-        - The Insepctor Controller was comparing JSValue pointers so thought the
-        message was not a repeat, but the JS of the inspector compared the
-        strings and so knew it was the same message and so overwrote the old
-        message.
-
-        * page/InspectorController.cpp:
-        (WebCore::ConsoleMessage::isEqual):
-        (WebCore::InspectorController::addMessageToConsole):
-        (WebCore::InspectorController::addConsoleMessage):
-        (WebCore::InspectorController::startGroup):
-        (WebCore::InspectorController::endGroup):
-        * page/InspectorController.h:
-
-2008-09-24  David Hyatt  <hyatt@apple.com>
-
-        Make sure the viewless Mac scrollbar responds properly to system preference changes (including the
-        arrow placement preference and the thumb jump preference).
-
-        Reviewed by Adam Roben
-
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::Scrollbar):
-        (WebCore::Scrollbar::~Scrollbar):
-        * platform/ScrollbarTheme.h:
-        (WebCore::ScrollbarTheme::registerScrollbar):
-        (WebCore::ScrollbarTheme::unregisterScrollbar):
-        * platform/mac/ScrollbarThemeMac.h:
-        * platform/mac/ScrollbarThemeMac.mm:
-        (+[ScrollbarPrefsObserver appearancePrefsChanged:]):
-        (+[ScrollbarPrefsObserver behaviorPrefsChanged:]):
-        (+[ScrollbarPrefsObserver registerAsObserver]):
-        (WebCore::ScrollbarThemeMac::registerScrollbar):
-        (WebCore::ScrollbarThemeMac::unregisterScrollbar):
-        (WebCore::ScrollbarThemeMac::ScrollbarThemeMac):
-        (WebCore::ScrollbarThemeMac::preferencesChanged):
-
-2008-09-24  Rob Buis  <buis@kde.org>
-
-        Reviewed by Darin.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20557
-        getScreenCTM() returns wrong values
-
-        Use the absolute position of the svg root when
-        determining the screen ctm.
-
-        Test: svg/custom/getscreenctm-in-mixed-content2.xhtml
-
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::getScreenCTM):
-
-2008-09-24  David Hyatt  <hyatt@apple.com>
-
-        Turn off support for CSS variables.
-
-        * ChangeLog:
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::createVariablesRule):
-        (WebCore::CSSParser::addVariable):
-        (WebCore::CSSParser::addVariableDeclarationBlock):
-
-2008-09-24  David Hyatt  <hyatt@apple.com>
-
-        Back out the alternate forms of CSS variable call syntax (leaving only the -webkit-var version).
-
-        * css/CSSGrammar.y:
-        * css/CSSParserValues.cpp:
-        (WebCore::CSSParserValue::isVariable):
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::cleanup):
-        (WebCore::CSSPrimitiveValue::getStringValue):
-        (WebCore::CSSPrimitiveValue::cssText):
-        (WebCore::CSSPrimitiveValue::parserValue):
-        * css/CSSPrimitiveValue.h:
-        (WebCore::CSSPrimitiveValue::):
-        (WebCore::CSSPrimitiveValue::isVariable):
-
-2008-09-24  Timothy Hatcher  <timothy@apple.com>
-
-        Fixes a regression where the "incorrect MIME-type" warning would not
-        show up correctly in the Console or the resources sidebar.
-
-        Reviewed by Kevin McCullough.
-
-        * page/inspector/Resource.js:
-        (WebInspector.Resource.prototype._addTip): Add the repeat count argument
-        to the WebInspector.ConsoleMessage constructor call.
-        (WebInspector.Resource.prototype._checkWarning): Ditto.
-
-2008-09-23  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon.
-
-        Remove deprecated JS Qt bindings object call/construct code and fix autotests
-
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtInstance::QtInstance):
-        * bridge/qt/qt_instance.h:
-
-2008-09-23  Julien Chaffraix  <jchaffraix@pleyo.com>
-
-        Reviewed by Alp Toker. Landed by Jan Alonzo.
-
-        Bug 20883: [CURL] Add deferred loading
-        https://bugs.webkit.org/show_bug.cgi?id=20883
-
-        Implement deferred loading for the libcURL backend using curl_easy_pause.
-        As the method was introduced in version 7.18.0, all the code checks for libcURL
-        version.
-
-        * platform/network/curl/ResourceHandleCurl.cpp:
-        (WebCore::ResourceHandle::setDefersLoading):
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::writeCallback): Add an assertion that deferred loading is not
-        activated.
-        (WebCore::headerCallback): Ditto.
-        (WebCore::readCallback): Ditto.
-        (WebCore::ResourceHandleManager::dispatchSynchronousJob): Force
-        defersLoading to be false in order to avoid triggering an assertion.
-        (WebCore::ResourceHandleManager::initializeHandle): If deferred loading is
-        activated, pause the easy handle.
-
-2008-09-23  Matt Lilek  <webkit@mattlilek.com>
-
-        Reviewed by Tim Hatcher.
-
-        Inspector search field style tweaks.
-
-        * page/inspector/inspector.css:
-
-2008-09-23  Nikolas Zimmermann  <zimmermann@kde.org>
-
-        Reviewed by Eric.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=21046 (Several LayoutTests crash)
-
-        Fix missing negation in EventTargetNode::insertedIntoDocument.
-        Made handleLocalEvents() virtual again, HTMLFormElement overrides it.
-        Remove code, that wasn't supposed to go in in dispatchGenericEvent().
-
-        * dom/EventTargetNode.cpp:
-        (WebCore::EventTargetNode::insertedIntoDocument):
-        (WebCore::EventTargetNode::dispatchGenericEvent):
-        * dom/EventTargetNode.h:
-
-2008-09-23  Timothy Hatcher  <timothy@apple.com>
-
-        Adds search support to the Profiles panel.
-
-        The Profiles panel supports a few types of queries:
-         * Standard string matching for function names and file URLs.
-         * Greater than and less than search for numeric columns.
-           So a query of ">24" will match all rows that have calls
-           greater than 24. Or "<=42" will match all 42 or less.
-         * Percent and time units. Adding a unit of "s", "ms" or "%"
-           is supported and will match only the Self and Total columns.
-           So a query of ">1.25s" will match all rows that took longer
-           than 1.25 seconds.
-
-        Reviewed by Oliver Hunt.
-
-        * page/inspector/ProfileView.js:
-        (WebInspector.ProfileView.prototype.hide): Reset _currentSearchResultIndex to -1. So the next time
-        it will start at the first result.
-        (WebInspector.ProfileView.prototype.refreshShowAsPercents): Moved from the bottom of the file.
-        (WebInspector.ProfileView.prototype.searchCanceled): Clear the search properties and refresh highlighted
-        data grid nodes.
-        (WebInspector.ProfileView.prototype.performSearch): Search the profile nodes.
-        (WebInspector.ProfileView.prototype.jumpToFirstSearchResult): Does what the function says. Calls _jumpToSearchResult.
-        (WebInspector.ProfileView.prototype.jumpToLastSearchResult): Ditto.
-        (WebInspector.ProfileView.prototype.jumpToNextSearchResult): Ditto.
-        (WebInspector.ProfileView.prototype.jumpToPreviousSearchResult): Ditto.
-        (WebInspector.ProfileView.prototype.showingFirstSearchResult): Does what the function says.
-        (WebInspector.ProfileView.prototype.showingLastSearchResult): Ditto.
-        (WebInspector.ProfileView.prototype._jumpToSearchResult): Select and reveal the profile node.
-        Expand all the ancestors first so the profile node will have a DataGridNode.
-        (WebInspector.ProfileView.prototype._changeView): Perform the search again on the new tree.
-        (WebInspector.ProfileDataGridNode.prototype.createCell): Add the highlight class to cells that
-        have search matches.
-        * page/inspector/ProfilesPanel.js:
-        (WebInspector.ProfilesPanel.prototype.reset): Call searchCanceled and delete the currentQuery.
-        (WebInspector.ProfilesPanel.prototype.showProfile): Use profileViewForProfile.
-        (WebInspector.ProfilesPanel.prototype.showView): Call showProfile. Used by Panel to show a view.
-        (WebInspector.ProfilesPanel.prototype.profileViewForProfile): Create the ProfileView if needed.
-        (WebInspector.ProfilesPanel.prototype.closeVisibleView): Renamed visibleProfileView  to visibleView.
-        (WebInspector.ProfilesPanel.prototype.get searchableViews): Return all the views.
-        (WebInspector.ProfilesPanel.prototype.searchMatchFound): Update the sidebar search matches.
-        (WebInspector.ProfilesPanel.prototype.searchCanceled): Clear all the sidebar search matches.
-        (WebInspector.ProfileSidebarTreeElement.prototype.set searchMatches): Set the class and bubbleText.
-        * page/inspector/inspector.css: New style rules for the cell highlight color.
-
-2008-09-23  Timothy Hatcher  <timothy@apple.com>
-
-        Adds search support to the Resources and Scripts panels.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21005
-
-        Reviewed by Oliver Hunt.
-
-        * page/inspector/Images/searchSmallBlue.png: Added.
-        * page/inspector/Images/searchSmallBrightBlue.png: Added.
-        * page/inspector/Images/searchSmallGray.png: Added.
-        * page/inspector/Images/searchSmallWhite.png: Added.
-        * page/inspector/ResourceView.js:
-        (WebInspector.ResourceView.prototype.attach): Attempt to attach to "resource-views"
-        or "script-resource-views" since one might not be created yet.
-        * page/inspector/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype.show): Hide any views that are visible that
-        are not this panel's current visible view. This can happen when a ResourceView is
-        visible in the Scripts panel then switched to the this panel.
-        (WebInspector.ResourcesPanel.prototype.get searchableViews): Return all views, with the
-        visibleView first.
-        (WebInspector.ResourcesPanel.prototype.searchResultsSortFunction): Return a sort function
-        that uses the current graph search function. So cycling through results will be in the order
-        things appear in the sidebar.
-        (WebInspector.ResourcesPanel.prototype.searchMatchFound): Update the search matches on the
-        resource's sidebar tree element.
-        (WebInspector.ResourcesPanel.prototype.searchCanceled): Restore the error and warning bubbles
-        in the sidebar. Calls the Panel prototype's searchCanceled.
-        (WebInspector.ResourcesPanel.prototype.performSearch): Hide all the error and warning bubbles
-        in the sidebar. Calls the Panel prototype's performSearch.
-        (WebInspector.ResourcesPanel.prototype.reset): Call searchCanceled and delete the currentQuery.
-        (WebInspector.ResourcesPanel.prototype.addMessageToResource): Don't call updateErrorsAndWarnings
-        if there is a current search query.
-        (WebInspector.ResourcesPanel.prototype.clearMessages): Ditto.
-        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded): Ditto.
-        (WebInspector.ResourcesPanel.prototype.showView): Call showResource. Used by Panel to show a view.
-        (WebInspector.ResourceSidebarTreeElement.prototype.resetBubble): Clear all the classes and content.
-        (WebInspector.ResourceSidebarTreeElement.prototype.set searchMatches): Set the bubbleText and class.
-        (WebInspector.ResourceSidebarTreeElement.prototype.updateErrorsAndWarnings): Call resetBubble.
-        * page/inspector/ScriptView.js:
-        (WebInspector.ScriptView): Set _sourceFrameSetup to flase.
-        (WebInspector.ScriptView.prototype.hide): Reset _currentSearchResultIndex to -1. So the next time
-        it will start at the first result.
-        (WebInspector.ScriptView.prototype.setupSourceFrameIfNeeded): Add an event listener for "syntax
-        highlighting complete".
-        (WebInspector.ScriptView.prototype): Share many methods with SourceView.
-        * page/inspector/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.show): Hide any views that are visible that are not this
-        This can happen when a ResourceView is visible in the Resources panel then switched to the this panel.
-        (WebInspector.ScriptsPanel.prototype.get searchableViews): Return all views, with the visibleView first.
-        (WebInspector.ScriptsPanel.prototype.reset): Call searchCanceled and delete the currentQuery.
-        (WebInspector.ScriptsPanel.prototype.showView): Call _showScriptOrResource. Used by Panel to show a view.
-        (WebInspector.ScriptsPanel.prototype._sourceViewForScriptOrResource): Added helper.
-        * page/inspector/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype.syntaxHighlightJavascript): Dispatch a "syntax highlighting complete" event.
-        * page/inspector/SourceView.js:
-        (WebInspector.SourceView.prototype.hide):
-        (WebInspector.SourceView.prototype.detach):
-        (WebInspector.SourceView.prototype._resourceLoadingFinished): Moved from the bottom of the file.
-        (WebInspector.SourceView.prototype._addBreakpoint): Ditto.
-        (WebInspector.SourceView.prototype.searchCanceled): Delete search properties.
-        (WebInspector.SourceView.prototype.performSearch): Search the frame if it is loaded, otherwise
-        store the worker function as _delayedFindSearchMatches and call it later in _sourceFrameSetupFinished.
-        (WebInspector.SourceView.prototype.jumpToFirstSearchResult):
-        (WebInspector.SourceView.prototype.jumpToLastSearchResult):
-        (WebInspector.SourceView.prototype.jumpToNextSearchResult):
-        (WebInspector.SourceView.prototype.jumpToPreviousSearchResult):
-        (WebInspector.SourceView.prototype.showingFirstSearchResult):
-        (WebInspector.SourceView.prototype.showingLastSearchResult):
-        (WebInspector.SourceView.prototype._jumpToSearchResult): Selects the found Range.
-        (WebInspector.SourceView.prototype._sourceFrameSetupFinished): Calls _delayedFindSearchMatches.
-        (WebInspector.SourceView.prototype._syntaxHighlightingComplete): Call _sourceFrameSetupFinished.
-        * page/inspector/inspector.css:
-
-2008-09-23  Timothy Hatcher  <timothy@apple.com>
-
-        Rename some properties of ResourcesPanel and ScriptsPanel to be the same,
-        so future code can be shared.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21005
-
-        Reviewed by Oliver Hunt.
-
-        * page/inspector/ResourcesPanel.js: Renamed resourceViews to viewsContainerElement.
-        And visibleResourceView to visibleView.
-        * page/inspector/ScriptsPanel.js: Renamed scriptResourceViews to viewsContainerElement.
-
-2008-09-23  Timothy Hatcher  <timothy@apple.com>
-
-        Highlight all matched search results in the Elements panel DOM tree.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21005
-
-        Reviewed by Oliver Hunt.
-
-        * page/inspector/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype.searchCanceled): Clear the highlight
-        on all previous search results.
-        (WebInspector.ElementsPanel.prototype.performSearch): Set the hihglight
-        on all new search results.
-        * page/inspector/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeElement): Delay setting the title until onattach.
-        (WebInspector.ElementsTreeElement.prototype.get/set highlighted): Sets or removes
-        the highlighted class on the listItemElement.
-        (WebInspector.ElementsTreeElement.prototype.onattach): Set the highlighted class
-        if needed. Calls _updateTitle.
-        (WebInspector.ElementsTreeElement.prototype._updateTitle): Adds a span with the highlight
-        class so it can be styled when the highlighted class is present.
-        * page/inspector/inspector.css: New style rules for the hihglight.
-
-2008-09-23  Timothy Hatcher  <timothy@apple.com>
-
-        Add search support to the Elements panel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21005
-
-        Reviewed by Oliver Hunt.
-
-        * page/inspector/ElementsPanel.js:
-        (WebInspector.ElementsPanel.prototype.searchCanceled): Call updateSearchMatchesCount
-        with a 0 match count to rest. Reset the other search properties.
-        (WebInspector.ElementsPanel.prototype.performSearch): Evaluates the search as an XPath
-        query and a CSS selector on all the Documents in the page. Remembers the found nodes
-        and avoids duplicates. Focuses the first result.
-        (WebInspector.ElementsPanel.prototype.jumpToNextSearchResult): Focuses the next result.
-        (WebInspector.ElementsPanel.prototype.jumpToPreviousSearchResult): Focuses the previous result.
-
-2008-09-23  Timothy Hatcher  <timothy@apple.com>
-
-        Add support to Panel that allows easy searching of sub-views.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21005
-
-        Reviewed by Oliver Hunt.
-
-        * page/inspector/Panel.js:
-        (WebInspector.Panel.prototype.searchCanceled): Call searchCanceled on all the
-        views in the search results and delete the currentQuery property. Call
-        WebInspector.updateSearchMatchesCount wit ha 0 match count to rest. Reset the
-        other search properties.
-        (WebInspector.Panel.prototype.performSearch): Call searchCanceled since it will
-        reset everything we need before doing a new search. Get an array of searchableViews
-        from the panel, implemented by sub-classes. Iterate over the views one-by-one
-        with an interval to prevent blocking the UI for large lists of searchableViews.
-        This keeps the interface really responsive. Pass a finishedCallback function to
-        the performSearch on each view so it can notify the panel of results.
-        (WebInspector.Panel.prototype.jumpToNextSearchResult): Finds the index in the
-        searchResults of the visibleView, so we know where in the results we are.
-        This is done every time incase the user manually navigates to a new view.
-        If the view is showing the last result, jump to the next view and show it's
-        first result. Otherwise jump to the next result in the current view.
-        (WebInspector.Panel.prototype.jumpToPreviousSearchResult): Ditto, but in reverse.
-
-2008-09-23  Timothy Hatcher  <timothy@apple.com>
-
-        Add support for asking the current panel to perform a search, find next/previous and clear.
-        A search is performed on the new new current panel when switching between panels. The search
-        label/placeholder in the toolbar now includes the panel name to make it clear that panel will
-        be searched. The search field contents are selected when Command/Control-F or Enter/Return
-        is pressed, so the user can easily type an entirely new query. The search match count shows
-        up in the toolbar next to the search field.
-
-        Also changed:
-         * Rename lastQuery to currentQuery since it better matches the truth.
-         * Set the search field "results" attribute to zero since results arn't saved for
-           how we use the search field.
-         * Make repeated presses of the Return key jump to the next search result instead
-           of doing nothing.
-         * Increased the search field width.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21005
-
-        Reviewed by Oliver Hunt.
-
-        * English.lproj/localizedStrings.js: New strings.
-        * page/inspector/inspector.css: New styles.
-        * page/inspector/inspector.html: Add the search-results-matches element. Add the
-        incremental attribute to the search field and set the results attribute to zero.
-        * page/inspector/inspector.js:
-        (WebInspector.set currentPanel): perform the search on the new panel.
-        (WebInspector.loaded): Change the event listeners and remove code that changes
-        the search label text.
-        (WebInspector.documentKeyDown): Add support for Command/Control-G and
-        Command/Control-Shift-G. To jump to the next and previous search results.
-        (WebInspector.updateSearchLabel): Added. Update the search placeholder/label.
-        This does different things depending on the attached state.
-        (WebInspector.searchKeyDown): Call preventDefault since this was the Enter key.
-        This prevents a "search" event from firing for key down. We handle the Enter key
-        on key up in searchKeyUp. This stops performSearch from being called twice in a row.
-        (WebInspector.searchKeyUp): Calls performSearch when it is the Enter key.
-        (WebInspector.performSearch): Delete the currentQuery property and call searchCanceled
-        on all the panels. Call jumpToNextSearchResult when this is the same query or a forced search.
-        Call updateSearchMatchesCount to reset the matches count in the toolbar.
-        (WebInspector.updateSearchMatchesCount): Added. Updates the matches count in the toolbar.
-
-2008-09-23  Timothy Hatcher  <timothy@apple.com>
-
-        Remove the previous Inspector search code to make room for the new stuff.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21005
-
-        Reviewed by Oliver Hunt.
-
-        * page/inspector/inspector.css:
-        * page/inspector/inspector.html:
-        * page/inspector/inspector.js:
-        (WebInspector.get/set showingSearchResults): Removed.
-        (WebInspector.searchResultsKeyDown): Removed.
-        (WebInspector.searchResultsResizerDragStart): Removed.
-        (WebInspector.searchResultsResizerDragEnd): Removed.
-        (WebInspector.searchResultsResizerDrag): Removed.
-        (WebInspector.performSearch): Removed searching parts.
-
-2008-09-23  Timothy Hatcher  <timothy@apple.com>
-
-        Use the Array.remove helper function in more places.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21037
-
-        Reviewed by Kevin McCullough.
-
-        * page/inspector/ResourceCategory.js:
-        (WebInspector.ResourceCategory.prototype.removeResource): Use Array.remove.
-        * page/inspector/ResourcesPanel.js:
-        (WebInspector.ResourcesPanel.prototype.removeResource): Ditto.
-        * page/inspector/inspector.js:
-        (WebInspector.removeResource): Ditto.
-
-2008-09-23  Timothy Hatcher  <timothy@apple.com>
-
-        Fixes a bug where inspecting a node after reloading the page
-        would not reveal the node in the DOM tree. The TreeOutline
-        was not being told to forget decendants of a removed child.
-        So old TreeElements would be found that are not in the tree.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21036
-
-        Reviewed by Kevin McCullough.
-
-        * page/inspector/treeoutline.js:
-        (TreeOutline._removeChildAtIndex): Call _forgetChildrenRecursive
-        in addition to _forgetTreeElement.
-        (TreeOutline._removeChildren): Call _forgetChildrenRecursive
-        in addition to _forgetTreeElement.
-        (TreeOutline._rememberTreeElement): Use Array.indexOf to quickly
-        search for known elements.
-        (TreeOutline._forgetTreeElement): Use Array.remove to remove elements.
-        (TreeOutline._forgetChildrenRecursive): Recursively traverse the
-        descendants and call _forgetTreeElement.
-        * page/inspector/utilities.js:
-        (Array.prototype.remove): Speed up this function by using Array.indexOf
-        when onlyFirst is true.
-
-2008-09-23  Timothy Hatcher  <timothy@apple.com>
-
-        Fixes a bug where inspecting some short text nodes does
-        not reveal them in the Elements panel DOM tree.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21035
-
-        Reviewed by Oliver Hunt.
-
-        * page/inspector/ElementsTreeOutline.js:
-        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode):
-        The revealAndSelectNode() method might find a different element
-        if there is inlined text, and the select() call would change the
-        focusedDOMNode and reenter this setter. So to avoid calling
-        focusedNodeChanged() twice, first check if _focusedDOMNode is
-        the same node as the one passed in.
-        (WebInspector.ElementsTreeOutline.prototype.update): Remove use of
-        this.treeOutline, since this is the TreeOutline.
-        (WebInspector.ElementsTreeOutline.prototype.findTreeElement): Added.
-        Provides default functions for isAncestor, getParet and equal.
-        Calls the base protoype's findTreeElement. If that returns null
-        and the node is a text node, try finding it's parent.
-        (WebInspector.ElementsTreeOutline.prototype.revealNode): Removed.
-        Renamed to revealAndSelectNode.
-        (WebInspector.ElementsTreeOutline.prototype.revealAndSelectNode):
-        Selects and reveals the node passed in. Use the simple findTreeElement.
-        (WebInspector.ElementsTreeOutline.prototype._treeElementFromEvent):
-        Remove use of this.treeOutline, since this is the TreeOutline.
-
-2008-09-23  Timothy Hatcher  <timothy@apple.com>
-
-        Fixes an exception that happened when removing a Resource
-        from the ResourcesPanel.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21034
+        Reviewed by Eric Seidel.
 
-        Reviewed by Kevin McCullough.
+        There is no new test because this cannot be tested deterministically.
+        I've not been able to cause a crash at all in the test framework, but
+        I have verified that this is happening in the wild and that the patch
+        fixes the likely cause in the debugger.
 
-        * page/inspector/ResourcesPanel.js:
-        (WebInspctor.ResourcesPanel.prototype.removeResource):
-        Remove the graphElement.
-
-2008-09-23  Kevin McCullough  <kmccullough@apple.com>
-
-        Fixed "Time" to "Tim"
-
-        * ChangeLog:
-
-2008-09-23  Nikolas Zimmermann  <zimmermann@kde.org>
-
-        Reviewed by Oliver.
-
-        Move mapInstanceToElement/removeInstanceMapping/instancesForElement
-        from SVGDocumentExtensions to SVGElement. It's more useful to store
-        the list of SVGElementInstances per SVGElement, instead of using
-        a document-wide hash for this purpose.
-
-        * svg/SVGAnimateMotionElement.cpp:
-        (WebCore::SVGAnimateMotionElement::applyResultsToTarget):
-        * svg/SVGAnimateTransformElement.cpp:
-        (WebCore::SVGAnimateTransformElement::applyResultsToTarget):
-        * svg/SVGAnimationElement.cpp:
-        (WebCore::SVGAnimationElement::setTargetAttributeAnimatedValue):
-        * svg/SVGDocumentExtensions.cpp:
-        (WebCore::SVGDocumentExtensions::~SVGDocumentExtensions):
-        * svg/SVGDocumentExtensions.h:
-        * svg/SVGElement.cpp:
-        (WebCore::SVGElement::mapInstanceToElement):
-        (WebCore::SVGElement::removeInstanceMapping):
-        (WebCore::SVGElement::instancesForElement):
-        * svg/SVGElement.h:
-        * svg/SVGElementInstance.cpp:
-        (WebCore::SVGElementInstance::SVGElementInstance):
-        (WebCore::SVGElementInstance::~SVGElementInstance):
-        (WebCore::SVGElementInstance::updateAllInstancesOfElement):
-        * svg/SVGElementInstance.h:
-        * svg/SVGStyledElement.cpp:
-        (WebCore::SVGStyledElement::svgAttributeChanged):
-        (WebCore::SVGStyledElement::childrenChanged):
-        * svg/SVGStyledElement.h:
-
-2008-09-23  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix.
+        * loader/TextResourceDecoder.cpp: careful not to iterate off the end
+          of our input buffer looking for the end of the comment.
 
-        * WebCoreSources.bkl:
+2009-06-19  Adam Barth  <abarth@webkit.org>
 
-2008-09-23  Nikolas Zimmermann  <zimmermann@kde.org>
+        Reviewed by Dimitri Glazkov.
 
-        Rubber stamped by Sam.
+        https://bugs.webkit.org/show_bug.cgi?id=26536
 
-        Move code from EventTarget to EventTargetNode.
+        Fix external-script-URL-location.html and
+        write-external-script-open.html LayoutTests.
 
-        I refactored most parts to live in EventTarget, a year ago,
-        though the implementation of EventTargetSVGElementInstance is
-        done in another way, that obsoletes this.
+        implicitOpen is called from several places.  We need to setXSSAuditor
+        each time, so I moved the call inside implicitOpen.
 
         * dom/Document.cpp:
-        (WebCore::Document::addListenerTypeIfNeeded):
-        * dom/Document.h:
-        * dom/EventTarget.cpp:
-        * dom/EventTarget.h:
-        (WebCore::allowEventDispatch):
-        * dom/EventTargetNode.cpp:
-        (WebCore::EventTargetNode::insertedIntoDocument):
-        (WebCore::EventTargetNode::removedFromDocument):
-        (WebCore::EventTargetNode::willMoveToNewOwnerDocument):
-        (WebCore::EventTargetNode::didMoveToNewOwnerDocument):
-        (WebCore::EventTargetNode::addEventListener):
-        (WebCore::EventTargetNode::removeEventListener):
-        (WebCore::EventTargetNode::removeAllEventListeners):
-        (WebCore::EventTargetNode::handleLocalEvents):
-        (WebCore::setCurrentEventTargetRespectingSVGTargetRules):
-        (WebCore::EventTargetNode::dispatchEvent):
-        (WebCore::EventTargetNode::dispatchGenericEvent):
-        (WebCore::EventTargetNode::dispatchWindowEvent):
-        (WebCore::EventTargetNode::removeEventListenerForType):
-        * dom/EventTargetNode.h:
-        * svg/EventTargetSVGElementInstance.cpp:
-        (WebCore::EventTargetSVGElementInstance::dispatchEvent):
-        * svg/SVGElement.cpp:
-        (WebCore::SVGElement::sendSVGLoadEventIfPossible):
-        * svg/SVGElement.h:
-        (WebCore::SVGElement::supplementalTransform):
-
-2008-09-23  Dave Hyatt  <hyatt@apple.com>
-
-        Fix for bug 21012.  The Aqua scrollbar was returning the wrong track rect on Windows Aqua theme.  Make
-        sure to not accidentally fall into the vertical scrollbar case for horizontal scrollbars. :)
-        
-        Reviewed by Sam Weinig
+        (WebCore::Document::open):
+        (WebCore::Document::implicitOpen):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
 
-        * platform/mac/ScrollbarThemeMac.mm:
-        (WebCore::ScrollbarThemeMac::trackRect):
-        * platform/win/ScrollbarThemeSafari.cpp:
-        (WebCore::ScrollbarTheme::nativeTheme):
-        (WebCore::ScrollbarThemeSafari::trackRect):
+2009-06-19  Kent Tamura  <tkent@chromium.org>
 
-2008-09-23  Beth Dakin  <bdakin@apple.com>
+        Reviewed by David Levin.
 
-        Reviewed by Sam Weinig.
+        Use WebCore::multipleFileUploadText() in Chromium to fix a problem
+        that Chromium shows only the first filename even if a user selects
+        multiple files for <input type=file multiple>.
+        <https://bugs.webkit.org/show_bug.cgi?id=26502>
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=21041 "Add Contact" 
-        link at gmail does not support AXPress action
-        and corresponding: <rdar://problem/6216178>
-
-        I fixed this bug by making AccessibilityObject::anchorElement 
-        support ARIA links.
-
-        * page/AccessibilityImageMapLink.cpp:
-        (WebCore::AccessibilityImageMapLink::anchorElement):
-        * page/AccessibilityImageMapLink.h:
-        * page/AccessibilityObject.cpp:
-        (WebCore::AccessibilityObject::anchorElement):
-        * page/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::isNativeAnchor):
-        * page/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::isNativeAnchor):
-        (WebCore::AccessibilityRenderObject::anchorElement):
-        (WebCore::AccessibilityRenderObject::internalLinkElement):
-        (WebCore::AccessibilityRenderObject::url):
-        * page/AccessibilityRenderObject.h:
-        * page/mac/AccessibilityObjectWrapper.mm:
-        (AXLinkElementForNode):
-
-2008-09-23  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Tim and Oliver.
-
-        Bug 20949: Catch repeated messages in Inspector Controller to limit
-        memory usage
-        - Store the repeat count in the Console Message object, in the 
-        Inspector Controller and JS ConsoleMessage object.
-
-        * page/InspectorController.cpp:
-        (WebCore::ConsoleMessage::ConsoleMessage):
-        (WebCore::ConsoleMessage::operator==):
-        (WebCore::InspectorController::InspectorController):
-        (WebCore::InspectorController::addConsoleMessage):
-        (WebCore::InspectorController::addScriptConsoleMessage):
-        * page/InspectorController.h:
-        * page/inspector/Console.js:
-        * page/inspector/Resource.js:
-        * page/inspector/ResourcesPanel.js:
-        * page/inspector/SourceFrame.js:
-
-2008-09-23  Nikolas Zimmermann  <zimmermann@kde.org>
-
-        Reviewed by Eric.
-
-        Working on proper EventTarget support for SVGElementInstance.
-
-        Add new EventTargetSVGElementInstance class, and it's corresponding JS wrapper.
-        Finally JSEventTargetBase, is actually used for another class than JSEventTargetnode.
-
-        Remove EventTarget inheritance from SVGElementInstance, and the manual "TreeShared"
-        implementation. Let it use TreeShared directly.
-
-        It's not activated so far (SVGUseElement still creating SVGElementInstance objects).
-        The transition to EventTargetSVGElementInstance will be done in a few individual patches.
+        * platform/chromium/FileChooserChromium.cpp:
+        (WebCore::FileChooser::basenameForWidth):
 
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSEventTargetBase.cpp:
-        (WebCore::retrieveEventTargetAndCorrespondingNode):
-        (WebCore::toJS):
-        * bindings/js/JSEventTargetBase.h:
-        * bindings/js/JSEventTargetSVGElementInstance.cpp: Added.
-        (WebCore::):
-        (WebCore::JSEventTargetSVGElementInstance::JSEventTargetSVGElementInstance):
-        (WebCore::JSEventTargetSVGElementInstance::createPrototype):
-        (WebCore::JSEventTargetSVGElementInstance::setListener):
-        (WebCore::JSEventTargetSVGElementInstance::getListener):
-        (WebCore::toEventTargetSVGElementInstance):
-        * bindings/js/JSEventTargetSVGElementInstance.h: Added.
-        (WebCore::JSEventTargetSVGElementInstance::prototypeClassName):
-        (WebCore::JSEventTargetSVGElementInstance::getOwnPropertySlot):
-        (WebCore::JSEventTargetSVGElementInstance::getValueProperty):
-        (WebCore::JSEventTargetSVGElementInstance::put):
-        (WebCore::JSEventTargetSVGElementInstance::putValueProperty):
-        * bindings/js/JSSVGElementInstanceCustom.cpp: Added.
-        (WebCore::toJS):
-        * bindings/objc/DOM.mm:
-        (+[DOMNode _wrapEventTarget:WebCore::]):
-        (-[DOMSVGElementInstance _initWithSVGElementInstance:WebCore::]):
-        (+[DOMSVGElementInstance _wrapSVGElementInstance:WebCore::]):
-        (+[DOMSVGElementInstance _wrapEventTarget:WebCore::]):
-        (-[DOMSVGElementInstance WebCore::]):
-        (-[DOMSVGElementInstance addEventListener:listener:useCapture:]):
-        (-[DOMSVGElementInstance addEventListener:::]):
-        (-[DOMSVGElementInstance removeEventListener:listener:useCapture:]):
-        (-[DOMSVGElementInstance removeEventListener:::]):
-        (-[DOMSVGElementInstance dispatchEvent:]):
-        * bindings/objc/DOMEvents.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bindings/scripts/CodeGeneratorObjC.pm:
-        * svg/EventTargetSVGElementInstance.cpp: Added.
-        (WebCore::EventTargetSVGElementInstance::EventTargetSVGElementInstance):
-        (WebCore::EventTargetSVGElementInstance::~EventTargetSVGElementInstance):
-        (WebCore::EventTargetSVGElementInstance::addEventListener):
-        (WebCore::EventTargetSVGElementInstance::removeEventListener):
-        (WebCore::EventTargetSVGElementInstance::dispatchEvent):
-        * svg/EventTargetSVGElementInstance.h: Added.
-        (WebCore::EventTargetSVGElementInstance::isEventTargetSVGElementInstance):
-        (WebCore::EventTargetSVGElementInstance::toNode):
-        (WebCore::EventTargetSVGElementInstance::toSVGElementInstance):
-        (WebCore::EventTargetSVGElementInstance::refEventTarget):
-        (WebCore::EventTargetSVGElementInstance::derefEventTarget):
-        (WebCore::EventTargetSVGElementInstanceCast):
-        * svg/SVGElement.cpp:
-        (WebCore::SVGElement::dispatchEvent):
-        * svg/SVGElementInstance.cpp:
-        (WebCore::SVGElementInstance::SVGElementInstance):
-        (WebCore::SVGElementInstance::~SVGElementInstance):
-        * svg/SVGElementInstance.h:
-        (WebCore::SVGElementInstance::isEventTargetSVGElementInstance):
-        * svg/SVGElementInstance.idl:
-
-2008-09-23  Dan Bernstein  <mitz@apple.com>
+2009-06-19  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Dave Hyatt.
 
-        - https://bugs.webkit.org/show_bug.cgi?id=21040
-          Pass NULL instead of the identity matrix to CTFontCreateWithGraphicsFont()
-
-        * platform/graphics/mac/SimpleFontDataMac.mm:
-        (WebCore::SimpleFontData::getCTFont):
-
-2008-09-23  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=21039
-
-        Teach the viewless Mac scrollbar how to avoid NSWindow's resizer.
-
-        Reviewed by Sam Weinig
-
-        * platform/ScrollView.h:
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::setFrameGeometry):
-        * platform/Scrollbar.h:
-        * platform/Widget.cpp:
-        (WebCore::Widget::convertFromContainingWindow):
-        * platform/Widget.h:
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
-        (WebCore::ScrollView::ScrollView):
-        (WebCore::ScrollView::~ScrollView):
-        (WebCore::ScrollView::windowResizerRect):
-        (WebCore::ScrollView::resizerOverlapsContent):
-        (WebCore::ScrollView::adjustOverlappingScrollbarCount):
-        (WebCore::ScrollView::setParent):
-        * platform/mac/WidgetMac.mm:
-        (WebCore::Widget::convertFromContainingWindow):
-
-2008-09-23  Dirk Schulze  <vbs85@gmx.de>
-
-        Reviewed by Darin Adler. Landed by Jan Alonzo.
-
-        Added support for getImageData() and putImageData()
-        to Cairo.
-
-        [CAIRO] needs getImageData and putImageData support
-        https://bugs.webkit.org/show_bug.cgi?id=20838
-
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        (WebCore::ImageBuffer::getImageData):
-        (WebCore::ImageBuffer::putImageData):
-
-2008-09-23  Marco Barisione  <marco.barisione@collabora.co.uk>
-
-        Reviewed by Holger Freyther.
-
-        http://bugs.webkit.org/show_bug.cgi?id=18987
-        [GTK] Implement SharedBuffer::createWithContentsOfFile and
-        KURL::fileSystemPath
-
-        * GNUmakefile.am: Add KURLGtk.cpp and SharedBufferGtk.cpp.
-        * platform/gtk/KURLGtk.cpp: Added.
-        (WebCore::KURL::fileSystemPath): Implemented.
-        * platform/gtk/SharedBufferGtk.cpp: Added.
-        (WebCore::SharedBuffer::createWithContentsOfFile): Implemented.
-        * platform/gtk/TemporaryLinkStubs.cpp: Remove the old stubs.
-
-2008-09-23  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Oliver Hunt, okayed by Darin Adler.
-
-        <rdar://problem/5575547> REGRESSION: ATOK has no phrase boundary on Safari/Mail.app
-
-        * rendering/InlineTextBox.cpp:
-        (WebCore::InlineTextBox::paintCompositionUnderline): Add 2 pixel spacing between clauses.
-
-2008-09-23  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=21023
-        Don't use TEC for encodings supported by ICU
-
-        * platform/text/mac/mac-encodings.txt: Removed x-mac-centraleurroman, x-mac-cyrillic,
-        x-mac-greek, and x-mac-turkish.
-
-        * platform/text/TextCodecICU.cpp: (WebCore::TextCodecICU::registerExtendedEncodingNames):
-        Register aliases for these encodings that are not registered automatically; updated comments.
-
-2008-09-23  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Darin.
-
-        - speed up instanceof some more
-        https://bugs.webkit.org/show_bug.cgi?id=20818
-
-        ~2% speedup on EarleyBoyer
-
-        (WebCore updates.)
-        
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        (WebCore::JSQuarantinedObjectWrapper::createStructureID):
-
-2008-09-22  Darin Adler  <darin@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=21008
-          getting pixels by index from CanvasPixelArray is unnecessarily slow
-
-        * GNUmakefile.am: Added JSCanvasPixelArrayCustom.h.
-        * WebCore.vcproj/WebCore.vcproj: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-
-        * bindings/js/JSCanvasPixelArrayCustom.cpp: Removed indexGetter and
-          indexSetter. These are now both inlined, so in the header.
-        * bindings/js/JSCanvasPixelArrayCustom.h: Added. The getByIndex
-          function is what's used for HasCustomIndexGetter. Also moved the
-          indexSetter function here.
-
-        * bindings/scripts/CodeGeneratorJS.pm: Changed HasCustomIndexGetter
-          to use a getByIndex member function rather than an indexGetter static
-          member function in a property slot. This lets us avoid the property
-          slot mechanism's rule where it turns numeric property names into
-          strings in the identifier table, which is good because that's slow.
-          Also added a new property CustomHeader that allows IDL files to
-          introduce headers to be included -- useful when we have functions
-          that we want to inline into the binding.
-
-        * html/CanvasPixelArray.idl: Added CustomHeader attribute.
-
-2008-09-23  Eric Seidel  <eric@webkit.org>
-
-        No review, build fix only.
-
-        Another blind stab in the dark.
-
-        * svg/graphics/cg/SVGResourceClipperCg.cpp: Add missing header.
-
-2008-09-23  Eric Seidel  <eric@webkit.org>
-
-        No review, build fix only.
-        
-        Third time's the charm, eh?  My local build is sadly still not done...
-
-        * platform/graphics/AffineTransform.cpp: remove extra &
-        * platform/graphics/AffineTransform.h: remove extra &
-
-2008-09-22  Eric Seidel  <eric@webkit.org>
-
-        No review, build fix only.
-
-        * platform/graphics/AffineTransform.cpp: remove extra ;
-
-2008-09-22  Eric Seidel  <eric@webkit.org>
-
-        No review, build fix only.
-
-        Speculative fix for the build while I wait for my compile to finish.
-
-        * platform/graphics/AffineTransform.cpp:
-
-2008-09-22  Dirk Schulze  <vbs85@gmx.de>
-
-        Reviewed by eseidel.  Landed by eseidel.
-
-        Moved makeMapBetweenRects from SVG/CG to AffineTransform
-        Make SVGResourceClipper::applyClip more cross-platform
-
-        * platform/graphics/AffineTransform.cpp:
-        * platform/graphics/AffineTransform.h:
-        * svg/graphics/cg/CgSupport.cpp:
-        * svg/graphics/cg/CgSupport.h:
-        * svg/graphics/cg/SVGPaintServerGradientCg.cpp:
-        (WebCore::SVGPaintServerGradient::handleBoundingBoxModeAndGradientTransformation):
-        * svg/graphics/cg/SVGResourceClipperCg.cpp:
-        (WebCore::SVGResourceClipper::applyClip):
-
-2008-09-22  Alp Toker  <alp@nuanti.com>
-
-        Reviewed by David Hyatt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=16331
-        [Gtk] no focus when button/checkbox/radiobutton clicked, only when tabbed
-
-        Obey GTK+ focusing conventions for controls and anchor elements.
-
-        It could be interesting to push these decisions up to Settings or
-        ChromeClient some day but this gets things working.
-
-        Right and middle click events still need some work to match GTK+
-        conventions.
-
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::isMouseFocusable):
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::isMouseFocusable):
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::sendContextMenuEvent):
-
-2008-09-22  Darin Adler  <darin@apple.com>
-
-        * page/mac/FrameMac.mm:
-        (WebCore::Frame::baseWritingDirectionForSelectionStart): Fix indentation.
-
-2008-09-22  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Dan Bernstein.
-
-        Patch for https://bugs.webkit.org/show_bug.cgi?id=21013
-        Match Firefox in how we hide HTMLInputElement.selectionStart, selectionEnd
-        and setSelectionRange.  This also allows us to remove the legacy JSHTMLInputElementBase
-        class!
-
-        - selectionStart, selectionEnd and setSelectionRange now are visible in iteration of
-          non-selectable input types, but return undefined when accessed.
-
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * bindings/js/JSHTMLInputElementBase.cpp: Removed.
-        * bindings/js/JSHTMLInputElementBase.h: Removed.
-        * bindings/js/JSHTMLInputElementCustom.cpp: Added.
-        (WebCore::JSHTMLInputElement::customGetOwnPropertySlot):
-        (WebCore::JSHTMLInputElement::selectionStart):
-        (WebCore::JSHTMLInputElement::selectionEnd):
-        * bindings/js/JSHTMLInputElementCustom.h: Added.
-        * html/HTMLInputElement.idl:
-
-2008-09-22  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - fix <rdar://problem/5699571> Mail: Unable to change writing direction to LTR in an empty message
-
-        Not testable in DumpRenderTree or in Safari
-
-        * page/mac/FrameMac.mm:
-        (WebCore::Frame::baseWritingDirectionForSelectionStart): Account for the
-        case that the selection start node is a block.
+        - fix <rdar://problem/6967596> Safari hung using 100% CPU when I tried
+          to look up a word in Dictionary using command-control-d
 
-2008-09-22  David Hyatt  <hyatt@apple.com>
+        Test: editing/selection/move-by-line-005.html
 
-        https://bugs.webkit.org/show_bug.cgi?id=21007
+        The root cause of this bug was searchAheadForBetterMatch() continuing
+        past the first rendered text object after the given object. While we
+        want to skip non-rendered text and empty containers, when we encounter
+        rendered text object, we must return a text box for that object.
 
-        Make sure that the scrollbar gets sent a release event on platforms that call handleMouseDoubleClickEvent.
-
-        Reviewed by Sam Weinig
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMouseDoubleClickEvent):
-
-2008-09-22  Eric Seidel  <eric@webkit.org>
-
-        No review, rollback only.
+        * dom/Position.cpp:
+        (WebCore::searchAheadForBetterMatch):
 
-        Roll out Peter's change (per his request)
-        http://trac.webkit.org/changeset/36069
-        https://bugs.webkit.org/show_bug.cgi?id=19663
-        This change has been the source of numerous regressions
-        (several of which were latent bugs revealed by this change,
-        others were bugs in this change)
+2009-06-19  Jungshik Shin  <jshin@chromium.org>
 
-        * platform/graphics/BitmapImage.cpp:
-        (WebCore::BitmapImage::BitmapImage):
-        (WebCore::BitmapImage::startAnimation):
-        (WebCore::BitmapImage::advanceAnimation):
-        * platform/graphics/BitmapImage.h:
-        * platform/graphics/cairo/ImageCairo.cpp:
-        (WebCore::BitmapImage::draw):
-        * platform/graphics/cg/ImageCG.cpp:
-        (WebCore::BitmapImage::draw):
-        * platform/graphics/qt/ImageQt.cpp:
-        (WebCore::BitmapImage::draw):
-        * platform/graphics/wx/ImageWx.cpp:
-        (WebCore::BitmapImage::draw):
+        Reviewed by David Levin
 
-2008-09-22  Dan Bernstein  <mitz@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=25657
 
-        Reviewed by Sam Weinig.
+        Chromium Linux port does not handle non-BMP characters properly.
+        It's fixed with a 'UTF-16 iterator macro' to extract Unicode
+        codepoints out of a UTF-16 input string.
 
-        - fix <rdar://problem/5158514> Switch the complex text code path to Core Text
+        A manual test is added for non-BMP character rendering,
+        which we can use until a small freely-distributable font
+        covering non-BMP is added to the Webkit source tree.
 
-        Tests: platform/mac-snowleopard/fast/text/myanmar-shaping.html
-               platform/mac-snowleopard/fast/text/thai-combining-mark-positioning.html
 
-        * config.h: Use Core Text if not building for Leopard or Tiger.
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::getFontDataForCharacters):
+        * manual-tests/non-bmp.html: Added.
 
-2008-09-22  David Hyatt  <hyatt@apple.com>
+2009-06-19  Pavel Feldman  <pfeldman@chromium.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=21006
+        Reviewed by Dimitri Glazkov.
 
-        Add code that paints an NSView-less scroller using HIThemeDrawTrack.  This scrollbar is still not
-        switched on.  There are still a few more refinements to make to the rendering and behavior.
+        V8 Bindings: return proper state from the script stack.
 
-        Reviewed by Darin Adler
+        https://bugs.webkit.org/show_bug.cgi?id=26512
 
-        * platform/ScrollbarThemeComposite.cpp:
-        (WebCore::ScrollbarThemeComposite::paint):
-        * platform/ScrollbarThemeComposite.h:
-        (WebCore::ScrollbarThemeComposite::paintTrack):
-        (WebCore::ScrollbarThemeComposite::paintButton):
-        (WebCore::ScrollbarThemeComposite::paintThumb):
-        * platform/mac/ScrollbarThemeMac.h:
-        * platform/mac/ScrollbarThemeMac.mm:
-        (WebCore::ScrollbarThemeMac::backButtonRect):
-        (WebCore::ScrollbarThemeMac::forwardButtonRect):
-        (WebCore::scrollbarPartToHIPressedState):
-        (WebCore::ScrollbarThemeMac::paint):
-        * platform/mac/WidgetMac.mm:
-        (WebCore::Widget::invalidateRect):
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        * bindings/v8/ScriptCallStack.h:
+        (WebCore::ScriptCallStack::state):
 
-2008-09-22  Chris Marrin  <cmarrin@apple.com>
+2009-06-19  Jessie Berlin  <jberlin@apple.com>
 
-        Reviewed by Sam Weinig
+        Reviewed by Simon Fraser.
 
-        transition end event when -webkit-transition-property: all puts wrong
-        propertyName in event
-        https://bugs.webkit.org/show_bug.cgi?id=20903
+        Windows build fix.
         
-        * page/animation/ImplicitAnimation.cpp:
-        (WebCore::ImplicitAnimation::sendTransitionEvent):
-
-2008-09-22  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/6230234> AXTable should probably not be exposed in there's only one cell
+        * platform/graphics/cg/PatternCG.cpp:
+        (WebCore::Pattern::createPlatformPattern):
 
-        Test: accessibility/table-one-cell.html
+2009-06-19  Yael Aharon  <yael.aharon@nokia.com>
 
-        * page/AccessibilityTable.cpp:
-        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
+        Reviewed by Simon Hausmann.
+        Build fix after 44825.
 
-2008-09-22  Chris Fleizach  <cfleizach@apple.com>
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::isSizeAvailable):
+        * platform/graphics/qt/ImageDecoderQt.h:
 
-        Reviewed by Darin Adler.
+2009-06-18  Shinichiro Hamaji  <hamaji@chromium.org>
 
-        <rdar://problem/6167779> Setting AXSelectedTextRange for TextAreas in a WebView behaves incorrectly
+        Reviewed by Oliver Hunt.
 
-        Test: accessibility/textarea-selected-text-range.html
+        Bug 26426: Canvas: rotation of 'no-repeat' pattern is weird
+        <https://bugs.webkit.org/show_bug.cgi?id=26426>
 
-        * page/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::setSelectedTextRange):
+        Use 1<<23-1 as steps of no-repeat patterns instead of 100000000.0f.
+        The original number cannot be represented by mantissa of float
+        (23bit) so that it caused some error.
 
-2008-09-22  David Hyatt  <hyatt@apple.com>
+        Test: fast/canvas/image-object-in-canvas.html:
 
-        Clean up some parent relationships in the back end stylesheet code.  Make sure parentStyleSheet
-        properly walks up nested rule blocks to reach the parent sheet instead of giving up at the immediate
-        parent.  Also fix the doc() method so that it is properly set when the parent of the sheet is an import
-        rule.
+        * platform/graphics/cg/PatternCG.cpp:
+        (WebCore::Pattern::createPlatformPattern):
 
-        Reviewed by Sam Weinig
+2009-06-19  Adam Barth  <abarth@webkit.org>
 
-        Added fast/css/nested-rule-parent-sheet.html
+        Unreviewed attempt to fix the Chromium build.
 
-         * css/CSSImportRule.cpp:
-        (WebCore::CSSImportRule::insertedIntoParent):
-        * css/CSSRule.cpp:
-        (WebCore::CSSRule::parentStyleSheet):
-        (WebCore::CSSRule::parentRule):
-        * css/CSSStyleSheet.cpp:
-        (WebCore::CSSStyleSheet::CSSStyleSheet):
-        * css/CSSStyleSheet.h:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::evaluate):
+        * bindings/v8/ScriptController.h:
+        (WebCore::ScriptController::xssAuditor):
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
 
-2008-09-22  Dan Bernstein  <mitz@apple.com>
+2009-06-18  Adam Barth  <abarth@webkit.org>
 
         Reviewed by Sam Weinig.
 
-        - fix https://bugs.webkit.org/show_bug.cgi?id=21002
-          Make the ATSUI code path respect spacingDisabled()
-
-        Fixes svg/text/text-spacing-01-b.svg in run-webkit-tests --complex-text
-
-        * platform/graphics/mac/FontMacATSUI.mm:
-        (WebCore::overrideLayoutOperation):
-
-2008-09-22  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        - speed up instanceof operator by replacing implementsHasInstance method with a TypeInfo flag
-
-        Partial work towards <https://bugs.webkit.org/show_bug.cgi?id=20818>
-        
-        2.2% speedup on EarleyBoyer benchmark.
-
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        (WebCore::JSQuarantinedObjectWrapper::createStructureID):
-        * bindings/scripts/CodeGeneratorJS.pm:
-
-2008-09-22  Adam Roben  <aroben@apple.com>
-
-        Windows build fix
-
-        * WebCore.vcproj/WebCore.vcproj: Add a missing </File> tag.
-
-2008-09-22  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Based on initial work by Darin Adler.
-        
-        - replace masqueradesAsUndefined virtual method with a flag in TypeInfo
-        - use this to JIT inline code for eq_null and neq_null
-        https://bugs.webkit.org/show_bug.cgi?id=20823
-        
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCore.vcproj/WebCore.vcproj:
-        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
-        (WebCore::JSCSSStyleDeclaration::nameGetter):
-        * bindings/js/JSHTMLAllCollection.cpp: Added.
-        (WebCore::):
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::createStructureID):
-        (WebCore::JSHTMLAllCollection::toBoolean):
-
-2008-09-22  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon.
-
-        Fix the QtWebKit build
-
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtRuntimeObjectImp::construct):
-        * bridge/qt/qt_runtime.cpp:
-
-2008-09-22  Alp Toker  <alp@nuanti.com>
-
-        Suggested by David Hyatt.
-
-        Build fix: ScrollView::update() is still used by Document.cpp on !MAC
-        so make it public.
-
-        * platform/ScrollView.h:
-
-2008-09-22  David Hyatt  <hyatt@apple.com>
-
-        Fix a regression in Windows scrollbar painting.  (Also fix the same
-        bug in my new viewless Mac scrollbar painting code).  The track rect
-        was being improperly inflated when painting resulting in the scrollbar
-        being too tall and painting in the border of overflow sections.
-
-        Reviewed by Oliver Hunt
-
-        * platform/mac/ScrollbarThemeMac.mm:
-        (WebCore::ScrollbarThemeMac::trackRect):
-        * platform/win/ScrollbarThemeSafari.cpp:
-        (WebCore::ScrollbarThemeSafari::trackRect):
-
-2008-09-22  David Hyatt  <hyatt@apple.com>
-
-        Fix a hit testing bug where events are mistakenly passed to subframes
-        if the mouse is over the border or padding area of the frame.  Add
-        a boolean flag, isOverWidget(), to hit test results so that EventHandler
-        can check it to tell if the mouse is really over the content box of a
-        RenderWidget and not just in the border/padding area.
-
-        This is not testable, since the old code properly recovered when it detected
-        that the mouse was outside the bounds of the view, but this prevents
-        the extra passdown from even occurring (and is basically a nice cleanup).
-
-        Reviewed by Oliver Hunt
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMousePressEvent):
-        (WebCore::EventHandler::hitTestResultAtPoint):
-        (WebCore::subframeForHitTestResult):
-        (WebCore::EventHandler::handleMouseDoubleClickEvent):
-        (WebCore::EventHandler::handleMouseMoveEvent):
-        (WebCore::EventHandler::handleMouseReleaseEvent):
-        (WebCore::EventHandler::handleWheelEvent):
-        * page/MouseEventWithHitTestResults.h:
-        (WebCore::MouseEventWithHitTestResults::isOverWidget):
-        * rendering/HitTestResult.cpp:
-        (WebCore::HitTestResult::HitTestResult):
-        (WebCore::HitTestResult::operator=):
-        * rendering/HitTestResult.h:
-        (WebCore::HitTestResult::isOverWidget):
-        (WebCore::HitTestResult::setIsOverWidget):
-        * rendering/RenderWidget.cpp:
-        (WebCore::RenderWidget::nodeAtPoint):
-        * rendering/RenderWidget.h:
-
-2008-09-21  David Hyatt  <hyatt@apple.com>
-
-        Rename FrameView's repaintRectangle method to repaintContentRectangle.  Make
-        both it and ScrollView's updateContents method be off-limits to everyone in
-        WebCore except for RenderView.
-
-        Make repaintViewRectangle the only possible method for WebCore code to do
-        an invalidation.  This ensures that all invalidates triggered by WebCore
-        cross-platform code that cross ownerElement() boundaries are transform-aware.
-
-        Make sure that iframes/frames contained inside objects that have transforms
-        or reflections are not allowed to blit (this was already true for transparency).
-
-        It is not possible to make a test for any of this, since iframe scrolling
-        still doesn't work on Mac (since the invalidates are not being done
-        through WebCore's cross-platform invalidation code but are instead going
-        through NSScrollView's setNeedsDisplay still).
-
-        Reviewed by Oliver Hunt
-
-        * editing/SelectionController.cpp:
-        (WebCore::SelectionController::recomputeCaretRect):
-        (WebCore::SelectionController::invalidateCaretRect):
-        (WebCore::SelectionController::focusedOrActiveStateChanged):
-        * page/FrameView.cpp:
-        (WebCore::FrameView::repaintContentRectangle):
-        (WebCore::FrameView::endDeferredRepaints):
-        * page/FrameView.h:
-        * platform/ScrollView.h:
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::paintFillLayerExtended):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::enclosingPositionedAncestor):
-        (WebCore::RenderLayer::requiresSlowRepaints):
-        * rendering/RenderLayer.h:
-        (WebCore::RenderLayer::hasTransform):
-        * rendering/RenderView.cpp:
-        (WebCore::RenderView::paintBoxDecorations):
-        (WebCore::RenderView::repaintViewRectangle):
-        (WebCore::RenderView::setSelection):
-
-2008-09-21  Maciej Stachowiak  <mjs@apple.com>
-
-        Reviewed by Darin.
-
-        - introduce a TypeInfo class, for holding per-type (in the C++ class sense) date in StructureID
-        https://bugs.webkit.org/show_bug.cgi?id=20981
-        
-        * bindings/js/JSAudioConstructor.cpp:
-        (WebCore::JSAudioConstructor::JSAudioConstructor):
-        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
-        (WebCore::JSCSSStyleDeclaration::nameGetter):
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::createDOMStructure):
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::getDOMStructure):
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::JSDOMWindowShell::JSDOMWindowShell):
-        (WebCore::JSDOMWindowShell::setWindow):
-        * bindings/js/JSEventTargetNode.cpp:
-        (WebCore::JSEventTargetNode::createPrototype):
-        * bindings/js/JSHTMLOptionElementConstructor.cpp:
-        (WebCore::JSHTMLOptionElementConstructor::JSHTMLOptionElementConstructor):
-        * bindings/js/JSImageConstructor.cpp:
-        (WebCore::JSImageConstructor::JSImageConstructor):
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
-        * bindings/js/JSXSLTProcessorConstructor.cpp:
-        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
-        * bindings/scripts/CodeGeneratorJS.pm:
-
-2008-09-21  Darin Adler  <darin@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        - fix problem Maciej noticed where every JSNamedNodesCollection
-          gets its own StructureID
-
-        * bindings/js/JSNamedNodesCollection.cpp:
-        (WebCore::JSNamedNodesCollection::JSNamedNodesCollection): Use
-        getDOMStructure to get the structure.
-        * bindings/js/JSNamedNodesCollection.h:
-        (WebCore::JSNamedNodesCollection::createPrototype): Return the
-        object prototype.
+        https://bugs.webkit.org/show_bug.cgi?id=26199
 
-2008-09-20  David Hyatt  <hyatt@apple.com>
+        Added an experimental reflective XSS filter.  The filter is disabled by
+        default.
 
-        Make sure transformed scrollbars in overflow sections position
-        properly.  This patch mimics the same behavior that works for
-        iframes, namely making sure that the same code that dynamically
-        adjusts iframe widget positions at paint time for fixed positioning
-        and transforms also applies to scrollbars.  (This is as simple as passing
-        in the current translation factor at paint time rather than crawling
-        up the layer tree to compute a "false" absolute position.)
-
-        An existing transform test covers this (although only a pixel result
-        reveals the correct rendering).
-
-        Reviewed by Darin Adler
-
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateLayerPositions):
-        (WebCore::RenderLayer::positionOverflowControls):
-        (WebCore::RenderLayer::paintOverflowControls):
-        (WebCore::RenderLayer::paintLayer):
-        * rendering/RenderLayer.h:
-
-2008-09-21  Steve Falkenburg  <sfalken@apple.com>
-
-        Removed unnecessary nested timer check.
-        
-        Rubber-stamped by Dan Bernstein.
-
-        * platform/win/SharedTimerWin.cpp:
-        (WebCore::TimerWindowWndProc):
-
-2008-09-21  Steve Falkenburg  <sfalken@apple.com>
-
-        Improve timer resolution on WinXP.
-        https://bugs.webkit.org/show_bug.cgi?id=20979
-        
-        Removed last-chance timer. It should not be necessary.
-        Change timeEndPeriod timer to fire in 300ms instead of 20ms. Calling timeBeginPeriod/timeEndPeriod too often throws off accuracy.
-        Remove Vista checks. We now run the same code on both XP and Vista.
-        
-        Call through to JSC::getCurrentUTCTimeWithMicroseconds from WebCore::currentTime.
-        The code previously called GetSystemTimeAsFileTime, which is always low-resolution on XP, even within timeBeginPeriod(1).
-        
-        Reviewed by Maciej Stachowiak.
-
-        * platform/win/SharedTimerWin.cpp:
-        (WebCore::):
-        (WebCore::TimerWindowWndProc):
-        (WebCore::setSharedTimerFireTime):
-        * platform/win/SystemTimeWin.cpp:
-        (WebCore::currentTime):
-
-2008-09-21  Dirk Schulze  <vbs85@gmx.de>
-
-        Reviewed by eseidel.  Landed by eseidel.
-
-        All platforms use the DashArray in the GraphicsContext.
-
-        * svg/graphics/SVGPaintServer.h:
-        * svg/graphics/cairo/SVGPaintServerGradientCairo.cpp:
-        (WebCore::SVGPaintServerGradient::setup):
-        * svg/graphics/cairo/SVGPaintServerPatternCairo.cpp:
-        (WebCore::SVGPaintServerPattern::setup):
-        * svg/graphics/cairo/SVGPaintServerSolidCairo.cpp:
-        (WebCore::SVGPaintServerSolid::setup):
-        * svg/graphics/qt/SVGPaintServerGradientQt.cpp:
-        (WebCore::SVGPaintServerGradient::setup):
-        * svg/graphics/qt/SVGPaintServerQt.cpp:
-        * svg/graphics/qt/SVGPaintServerSolidQt.cpp:
-        (WebCore::SVGPaintServerSolid::setup):
-
-2008-09-21  Dirk Schulze  <vbs85@gmx.de>
-
-        Reviewed by eseidel.  Landed by eseidel.
-
-        Moved DashArray to GraphicsContext.
+        Test: http/tests/security/xssAuditor/script-tag.html
 
         * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/graphics/DashArray.h: Added.
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        (WebCore::GraphicsContext::setLineDash):
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::GraphicsContext::setLineDash):
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::setLineDash):
-        * svg/graphics/SVGPaintServer.cpp:
-        (WebCore::applyStrokeStyleToContext):
-        * svg/graphics/SVGPaintServer.h:
-        * svg/graphics/cg/CgSupport.cpp:
-        * svg/graphics/cg/CgSupport.h:
-
-2008-09-21  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        - fix linker warnings
-
         * WebCore.base.exp:
-
-2008-09-20  Darin Adler  <darin@apple.com>
-
-        - another try at fixing Qt
-
-        * bridge/qt/qt_runtime.cpp: "using namespce WebCore"
-
-2008-09-20  Darin Adler  <darin@apple.com>
-
-        - blind attempt to fix Qt build
-
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::convertQVariantToValue): Use regExpStructure instead
-        of regExpPrototype to make a RegExpObject. There should really be
-        some sort of public helper function for this. Same thing for
-        DateInstance and dateStructure. For JSObject, use constructEmptyObject.
-        (JSC::Bindings::):
-        (JSC::Bindings::QtRuntimeMethod::QtRuntimeMethod): Use getDOMStructure.
-        It is not correct to do this inside the constructor because it could
-        cause a garbage collect while the QtRuntimeMethod object is half-
-        allocated, which could lead to a crash; note that RuntimeMethod,
-        QtRuntimeObjectImp, and RuntimeObjectImp have the same bug.
-        * bridge/qt/qt_runtime.h: Add s_info and createPrototype.
-
-2008-09-20  Collin Jackson  <collinj@webkit.org>
-
-        Prefetch DNS for hyperlinks that the user mouses over.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20931
-
-        Reviewed by Sam Weinig.
-
-        * page/Chrome.cpp:
-        (WebCore::Chrome::mouseDidMoveOverElement):
-
-2008-09-20  Darin Adler  <darin@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        - finish https://bugs.webkit.org/show_bug.cgi?id=20858
-          make each distinct C++ class get a distinct JSC::Structure
-
-        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
-        (WebCore::JSCSSStyleDeclaration::nameGetter): Pass in a structure
-        ID. Note that this makes a new structure every time -- we could
-        optimize this slightly be caching and reusing a single one.
-
-        * bridge/runtime_method.cpp:
-        (JSC::RuntimeMethod::RuntimeMethod): Create a unique structure using
-        getDOMStructure.
-        * bridge/runtime_method.h:
-        (JSC::RuntimeMethod::createPrototype): Added createPrototype so
-        getDOMStructure will work.
-
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::JSDOMWindowShell::JSDOMWindowShell): Initialize m_window to
-        0; needed in case garbage collection happens while creating the
-        JSDOMWindow.
-
-2008-09-20  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=20950
-          <rdar://problem/6234059> Reproducible assertion failure running svg/custom/acid3-test-77.html multiple times under guard malloc
-
-        * svg/SVGTextContentElement.cpp:
-        (WebCore::SVGInlineTextBoxQueryWalker::chunkPortionCallback): Changed to
-        not include the first character in the extraCharsAvailable count.
-
-2008-09-20  Kevin Ollivier  <kevino@theolliviers.com>
-
-        Reviewed by Dan Bernstein.
-
-        Fix memory leak.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=20505
-
-        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
-        (GetTextExtent):
-
-2008-09-20  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fixes. Added/removed build sources, and nativeWindow->platformWidget updates.
-
-        * WebCoreSources.bkl:
-        * platform/ScrollView.h:
-        * platform/wx/PopupMenuWx.cpp:
-        (WebCore::PopupMenu::show):
-        * platform/wx/RenderThemeWx.cpp:
-        (WebCore::RenderThemeWx::paintButton):
-        (WebCore::RenderThemeWx::paintTextField):
-        (WebCore::RenderThemeWx::paintMenuList):
-        (WebCore::RenderThemeWx::paintMenuListButton):
-        * platform/wx/ScrollViewWx.cpp:
-        (WebCore::ScrollView::setPlatformWidget):
-        (WebCore::ScrollView::updateContents):
-        (WebCore::ScrollView::update):
-        (WebCore::ScrollView::visibleWidth):
-        (WebCore::ScrollView::visibleHeight):
-        (WebCore::ScrollView::scrollBy):
-        (WebCore::ScrollView::resizeContents):
-        (WebCore::ScrollView::contentsWidth):
-        (WebCore::ScrollView::contentsHeight):
-        (WebCore::ScrollView::isScrollViewScrollbar):
-        (WebCore::ScrollView::adjustScrollbars):
-        (WebCore::ScrollView::inWindow):
-        (WebCore::ScrollView::removeChild):
-        * platform/wx/WidgetWx.cpp:
-        * plugins/wx/PluginViewWx.cpp:
-        (WebCore::PluginView::setParentVisible):
-        (WebCore::PluginView::updatePluginWidget):
-
-2008-09-20  Timothy Hatcher  <timothy@apple.com>
-
-        Fix the new Node Search button image to not be blurry.
-
-        * page/inspector/Images/nodeSearchButtons.png:
-
-2008-09-20  Matt Lilek  <webkit@mattlilek.com>
-
-        Reviewed by Tim Hatcher.
-
-        Cut down some of the inspector javascript -> InspectorController glue code
-        with two new macros. Also rearrange the exposed function list to be grouped
-        by implementation and to all explicitly use the WebCore namespace.
-
-        * page/InspectorController.cpp:
-        (WebCore::InspectorController::windowScriptObjectAvailable):
-
-2008-09-20  Matt Lilek  <webkit@mattlilek.com>
-
-        Reviewed by Tim Hatcher.
-
-        Fix regression from my previous patch where the breadcrumbs bar was not displayed.
-
-        * page/inspector/inspector.css:
-
-2008-09-20  Nikolas Zimmermann  <zimmermann@kde.org>
-
-        Reviewed by Eric.
-
-        Refactor HTMLImageLoader/SVGImageLoader code.
-        Move html/HTMLImageLoader.* to loader/ImageLoader.*
-
-        Let HTMLImageLoader & SVGImageLoader inherit from the new base class.
-        SVGImageLoader used to inherit from HTMLImageLoader which is awkward.
-
-        * GNUmakefile.am:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * dom/Document.cpp:
-        (WebCore::Document::dispatchImageLoadEventSoon):
-        (WebCore::Document::removeImage):
-        (WebCore::Document::dispatchImageLoadEventsNow):
-        * dom/Document.h:
-        * html/HTMLImageLoader.cpp:
-        (WebCore::HTMLImageLoader::HTMLImageLoader):
-        (WebCore::HTMLImageLoader::~HTMLImageLoader):
-        (WebCore::HTMLImageLoader::sourceURI):
-        (WebCore::HTMLImageLoader::notifyFinished):
-        * html/HTMLImageLoader.h:
-        * loader/DocLoader.h:
-        * loader/ImageLoader.cpp: Copied from html/HTMLImageLoader.cpp.
-        (WebCore::ImageLoader::ImageLoader):
-        (WebCore::ImageLoader::~ImageLoader):
-        (WebCore::ImageLoader::setImage):
-        (WebCore::ImageLoader::setLoadingImage):
-        (WebCore::ImageLoader::updateFromElement):
-        (WebCore::ImageLoader::notifyFinished):
-        * loader/ImageLoader.h: Copied from html/HTMLImageLoader.h.
-        * svg/SVGImageElement.cpp:
-        (WebCore::SVGImageElement::attach):
-        (WebCore::SVGImageElement::insertedIntoDocument):
-        (WebCore::SVGImageElement::imageSourceAttributeName):
-        * svg/SVGImageElement.h:
-        * svg/SVGImageLoader.cpp:
-        (WebCore::SVGImageLoader::SVGImageLoader):
-        (WebCore::SVGImageLoader::dispatchLoadEvent):
-        (WebCore::SVGImageLoader::sourceURI):
-        * svg/SVGImageLoader.h:
-
-2008-09-20  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Build fix.
-
-        [qtwebkit] ScrollBar build fix after r36684.
-        BackButtonPart was split into Start and End Part
-        ForwardButtonPart was split into Start and End Part
-
-        * platform/qt/ScrollbarThemeQt.cpp:
-        (WebCore::scPart):
-        (WebCore::scrollbarPart):
-        (WebCore::styleOptionSlider):
-
-2008-09-20  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Build fix.
-
-        [qtwebkit] Make qt_instance.cpp compile.
-        Revision of 36675 introduced getDOMStructure to give unique
-        structure id's to C++ classes. Catch up. RuntimeObjectImp assigns
-        the the StructureID inside the c'tor, do the same in QtRuntimeObjectImp
-
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtInstance::getRuntimeObject):
-
-2008-09-20  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Nikolas Zimmermann.
-
-        [svg] Change SVGLocatable to deal with a plain SVGElement
-        There is no requirement in the code that we have to have a
-        SVGStyledElement. Remove that artificial limitation and compile
-        with SVGElement.
-
-        * svg/SVGLocatable.cpp:
-        * svg/SVGLocatable.h:
-
-2008-09-20  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Nikolas Zimmermann.
-
-        [svg] Use OwnPtr for the SVGExtensions to avoid custom lifetime
-        management.
-
-        * dom/Document.cpp:
-        (WebCore::Document::~Document):
-        (WebCore::Document::svgExtensions):
-        (WebCore::Document::accessSVGExtensions):
-        * dom/Document.h:
-
-2008-09-19  David Hyatt  <hyatt@apple.com>
-
-        Fix for crash in updateTransitions.  Make sure to test for a style
-        being null when comparing two RenderStyles.
-
-        Reviewed by Oliver Hunt
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::PropertyWrapperGetter::equals):
-
-2008-09-19  David Hyatt  <hyatt@apple.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=20954
-
-        Roll out r36628 since it has caused horrible regressions with
-        animated GIF CPU usage.
-
-        * platform/graphics/BitmapImage.cpp:
-        (WebCore::BitmapImage::cacheFrame):
-        (WebCore::BitmapImage::startAnimation):
-        * platform/graphics/BitmapImage.h:
-        (WebCore::FrameData::FrameData):
-        * platform/graphics/cairo/ImageCairo.cpp:
-        (WebCore::FrameData::clear):
-        * platform/graphics/cg/ImageCG.cpp:
-        (WebCore::FrameData::clear):
-        * platform/graphics/qt/ImageQt.cpp:
-        (WebCore::FrameData::clear):
-        * platform/graphics/wx/ImageWx.cpp:
-        (WebCore::FrameData::clear):
-
-2008-09-20  Alp Toker  <alp@nuanti.com>
-
-        Reviewed by Timothy Hatcher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20913
-        Avoid redudant includes
-
-        Document.h is included excessively such that a modification to Document.h (or
-        any of the header it includes itself) triggers a rebuild of many files
-        including the whole of SVG and a lot of the JS bindings.
-
-        Some of these includes can be avoided by only including Document.h where
-        necessary.
-
-        * bindings/js/JSAttrCustom.cpp:
-        * bindings/js/JSElementCustom.cpp:
-        * bindings/js/JSEventTargetBase.cpp:
-        * bindings/js/JSEventTargetBase.h:
-        * bindings/js/JSEventTargetNode.cpp:
-        * bindings/js/JSHTMLFrameElementCustom.cpp:
-        * bindings/js/JSHTMLIFrameElementCustom.cpp:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * css/CSSCursorImageValue.cpp:
-        * css/SVGCSSStyleSelector.cpp:
-        * dom/make_names.pl:
-        * svg/SVGAnimateElement.h:
-        * svg/SVGAnimatedProperty.h:
-        (WebCore::::baseValue):
-        (WebCore::::setBaseValue):
-        (WebCore::::startAnimation):
-        (WebCore::::stopAnimation):
-        * svg/SVGElement.cpp:
-        (WebCore::SVGElement::accessDocumentSVGExtensions):
-        * svg/SVGElement.h:
-        * svg/SVGElementInstance.cpp:
-        * svg/SVGFitToViewBox.cpp:
-        * svg/SVGFontElement.cpp:
-        * svg/SVGFontFaceElement.cpp:
-        * svg/SVGLinearGradientElement.cpp:
-        * svg/SVGMPathElement.cpp:
-        * svg/SVGViewSpec.cpp:
-
-2008-09-19  Nikolas Zimmermann  <zimmermann@kde.org>
-
-        Reviewed by Antti & Eric.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=20372
-
-        Finish HTMLScriptElement / SVGScriptElement unification.
-        SVG <script> support is complete now, full SVGLoad event
-        respecting the influence of the externalResourcesRequired attribute
-        as well as SVGError event support. All other features shared with HTML.
-
-        Tests: fast/dom/HTMLScriptElement/script-reexecution.html
-               svg/dom/SVGScriptElement/script-change-externalResourcesRequired-while-loading.svg
-               svg/dom/SVGScriptElement/script-load-and-error-events.svg
-               svg/dom/SVGScriptElement/script-reexecution.svg
-               svg/dom/SVGScriptElement/script-set-href.svg
-
-        * dom/ScriptElement.cpp:
-        (WebCore::ScriptElementData::ScriptElementData):
-        (WebCore::ScriptElementData::requestScript):
-        * dom/ScriptElement.h:
-        (WebCore::ScriptElementData::haveFiredLoadEvent):
-        (WebCore::ScriptElementData::setHaveFiredLoadEvent):
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::notifyFinished):
-        * html/HTMLScriptElement.cpp:
-        (WebCore::HTMLScriptElement::dispatchLoadEvent):
-        * svg/SVGScriptElement.cpp:
-        (WebCore::SVGScriptElement::setCreatedByParser):
-        (WebCore::SVGScriptElement::parseMappedAttribute):
-        (WebCore::SVGScriptElement::svgAttributeChanged):
-        (WebCore::SVGScriptElement::insertedIntoDocument):
-        (WebCore::SVGScriptElement::removedFromDocument):
-        (WebCore::SVGScriptElement::childrenChanged):
-        (WebCore::SVGScriptElement::isURLAttribute):
-        (WebCore::SVGScriptElement::finishParsingChildren):
-        (WebCore::SVGScriptElement::type):
-        (WebCore::SVGScriptElement::setType):
-        (WebCore::SVGScriptElement::haveLoadedRequiredResources):
-        (WebCore::SVGScriptElement::dispatchLoadEvent):
-        (WebCore::SVGScriptElement::dispatchErrorEvent):
-        * svg/SVGScriptElement.h:
-
-2008-09-19  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by John Sullivan.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=20951
-          Typo in Position::getInlineBoxAndOffset()
-          and add an assertion
-
-        Without the fix, the newly-added assertion fails in platform/mac/editing/input/caret-primary-bidi.html
-
-        * dom/Position.cpp:
-        (WebCore::Position::getInlineBoxAndOffset):
-        * rendering/InlineTextBox.cpp:
-        (WebCore::InlineTextBox::positionForOffset):
-
-2008-09-19  David Hyatt  <hyatt@apple.com>
-
-        Add support for hit testing of all five possible scrollbar button placements. 
-
-        Reviewed by Sam Weinig
-
-        * platform/ScrollbarThemeComposite.cpp:
-        (WebCore::ScrollbarThemeComposite::paint):
-        * platform/mac/ScrollbarThemeMac.mm:
-        (WebCore::):
-        (WebCore::ScrollbarThemeMac::backButtonRect):
-        (WebCore::ScrollbarThemeMac::forwardButtonRect):
-        (WebCore::ScrollbarThemeMac::trackRect):
-        (WebCore::ScrollbarThemeMac::paintButton):
-
-2008-09-19  Darin Adler  <darin@apple.com>
-
-        - try to fix Qt build
-
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtRuntimeObjectImp::QtRuntimeObjectImp): Add structure argument.
-        (JSC::Bindings::QtInstance::getRuntimeObject): Ditto.
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::RuntimeObjectImp): Add an overload just for Qt.
-        * bridge/runtime_object.h: Ditto.
-
-2008-09-19  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Transition starts running when it shouldn't
-        https://bugs.webkit.org/show_bug.cgi?id=20892
-
-        When there is a transition and an animation on the
-        same element, make sure the animation wins.
-
-        The fix is to save the unanimated style when an animation is started.
-        Then, when starting a transition, check to see if there is a current
-        animation on the same prop. If so, use the unanimated style as the
-        fromStyle rather than the current style.
-
-        Test: animations/transition-and-animation-1.html
-
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimation::updateTransitions):
-        (WebCore::CompositeAnimation::updateKeyframeAnimations):
-        (WebCore::CompositeAnimation::animate):
-        (WebCore::CompositeAnimation::getAnimationForProperty):
-        * page/animation/CompositeAnimation.h:
-        * page/animation/ImplicitAnimation.cpp:
-        (WebCore::ImplicitAnimation::reset):
-        * page/animation/ImplicitAnimation.h:
-        * page/animation/KeyframeAnimation.cpp:
-        (WebCore::KeyframeAnimation::hasAnimationForProperty):
-        * page/animation/KeyframeAnimation.h:
-        (WebCore::KeyframeAnimation::KeyframeAnimation):
-        (WebCore::KeyframeAnimation::unanimatedStyle):
-
-2008-09-19  David Hyatt  <hyatt@apple.com>
-
-        Add support for painting/hit testing of four possible scrollbar buttons.
-        The Windows themes simply ignore the two parts that they will never
-        show.  The Mac theme also ignores the other two buttons for now.
-
-        The cross-platform base for all three themes, ScrollbarThemeComposite,
-        has all the proper support though.
-
-        Reviewed by Sam Weinig
-
-        * platform/ScrollbarThemeComposite.cpp:
-        (WebCore::ScrollbarThemeComposite::hitTest):
-        (WebCore::ScrollbarThemeComposite::invalidatePart):
-        * platform/ScrollbarThemeComposite.h:
-        * platform/mac/ScrollbarThemeMac.h:
-        * platform/mac/ScrollbarThemeMac.mm:
-        (WebCore::ScrollbarThemeMac::backButtonRect):
-        (WebCore::ScrollbarThemeMac::forwardButtonRect):
-        (WebCore::ScrollbarThemeMac::paintButton):
-        * platform/win/ScrollbarThemeSafari.cpp:
-        (WebCore::ScrollbarThemeSafari::backButtonRect):
-        (WebCore::ScrollbarThemeSafari::forwardButtonRect):
-        (WebCore::ScrollbarThemeSafari::paintButton):
-        * platform/win/ScrollbarThemeSafari.h:
-        * platform/win/ScrollbarThemeWin.cpp:
-        (WebCore::ScrollbarThemeWin::backButtonRect):
-        (WebCore::ScrollbarThemeWin::forwardButtonRect):
-        (WebCore::ScrollbarThemeWin::paintButton):
-        * platform/win/ScrollbarThemeWin.h:
-
-2008-09-19  Matt Lilek  <webkit@mattlilek.com>
-
-        Reviewed by Tim Hatcher.
-
-        Bug 17772: Inspector should support point-and-click to select a node to inspect
-        https://bugs.webkit.org/show_bug.cgi?id=17772
-        <rdar://problem/5792395>
-
-        * English.lproj/localizedStrings.js:
-        * page/Chrome.cpp:
-        (WebCore::Chrome::mouseDidMoveOverElement):
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMousePressEvent):
-        * page/InspectorController.cpp:
-        (WebCore::toggleNodeSearch):
-        (WebCore::searchingForNode):
-        (WebCore::InspectorController::InspectorController):
-        (WebCore::InspectorController::toggleSearchForNodeInPage):
-        (WebCore::InspectorController::mouseDidMoveOverElement):
-        (WebCore::InspectorController::handleMousePressOnNode):
-        (WebCore::InspectorController::windowScriptObjectAvailable):
-        * page/InspectorController.h:
-        (WebCore::InspectorController::searchingForNodeInPage):
-        * page/inspector/ElementsPanel.js:
-        * page/inspector/Images/nodeSearchButtons.png: Added.
-        * page/inspector/inspector.css:
-
-2008-09-19  David Hyatt  <hyatt@apple.com>
-
-        Add new scrollbar parts to be able to represent back and forward buttons
-        at either end of the scrollbar.  The current scrollbar still just draws
-        a single button at either end, but the parts now exist.
-
-        Reviewed by Sam Weinig
-
-        * platform/ScrollTypes.h:
-        (WebCore::):
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::autoscrollTimerFired):
-        (WebCore::Scrollbar::pressedPartScrollDirection):
-        (WebCore::Scrollbar::pressedPartScrollGranularity):
-        (WebCore::Scrollbar::handleMouseMoveEvent):
-        * platform/ScrollbarTheme.h:
-        (WebCore::ScrollbarTheme::buttonsPlacement):
-        (WebCore::ScrollbarTheme::invalidateParts):
-        * platform/ScrollbarThemeComposite.cpp:
-        (WebCore::ScrollbarThemeComposite::paint):
-        (WebCore::ScrollbarThemeComposite::hitTest):
-        (WebCore::ScrollbarThemeComposite::invalidatePart):
-        * platform/ScrollbarThemeComposite.h:
-
-2008-09-19  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Fix for <rdar://problem/6231308> crash in AutoTableLayout
-
-        The code assumes later on that a TableSection's grid's row vector 
-        will never be empty. So make 1 the minimum number of columns.
-
-        * rendering/RenderTableSection.cpp:
-        (WebCore::RenderTableSection::ensureRows):
-
-2008-09-19  David Hyatt  <hyatt@apple.com>
-
-        Add a new ScrollbarButtonsPlacement type for specifying where
-        the button arrows are in a scrollbar.
-
-        Read in the placement settings for Mac.  Nothing is done with the
-        setting yet.
-
-        Add a new buttonsPlacement() method to ScrollbarTheme composite
-        so that the arrow settings can be obtained.
-
-        Reviewed by Sam Weinig
-
-        * platform/ScrollTypes.h:
-        (WebCore::):
-        * platform/ScrollbarThemeComposite.h:
-        (WebCore::ScrollbarThemeComposite::buttonsPlacement):
-        * platform/mac/ScrollbarThemeMac.mm:
-        (WebCore::updateArrowPlacement):
-        (WebCore::ScrollbarThemeMac::ScrollbarThemeMac):
-
-2008-09-19  Steve Falkenburg  <sfalken@apple.com>
-
-        Roll out r36626. It is causing variance in SunSpider numbers on XP.
-        
-        Rubber stamped by Mark Rowe.
-
-        * platform/win/SharedTimerWin.cpp:
-        (WebCore::isRunningOnVistaOrLater):
-        (WebCore::setSharedTimerFireTime):
-
-2008-09-19  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Tim.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20942
-        Bug 20942: Repeated messages in resources don't collapse
-        - Now repeated messages in a resource's view are collapsed and a message
-        says how many were repeated.
-
-        * English.lproj/localizedStrings.js:
-        * manual-tests/inspector/multiple-console-messages.html:
-        * page/inspector/Console.js: Send all the messages to the resource's
-        view before possibly returning early if the message is a repeat.
-        * page/inspector/SourceFrame.js: Add the text about the message being
-        repeated, if it is, and increment it when necessary.
-
-2008-09-19  Chris Fleizach  <cfleizach@apple.com>
-
-        Removed unnecessary #if
-
-        * page/mac/AccessibilityObjectWrapper.mm:
-
-2008-09-19  David Hyatt  <hyatt@apple.com>
-
-        Read in prefs for the scroll delay repeat values for buttons.  Also
-        honor the option-click pref for jumping to the thumb when clicking in
-        the track.
-
-        Reviewed by Sam Weinig
-
-        * platform/mac/ScrollbarThemeMac.h:
-        * platform/mac/ScrollbarThemeMac.mm:
-        (WebCore::ScrollbarThemeMac::ScrollbarThemeMac):
-        (WebCore::ScrollbarThemeMac::initialAutoscrollTimerDelay):
-        (WebCore::ScrollbarThemeMac::autoscrollTimerDelay):
-        (WebCore::ScrollbarThemeMac::shouldCenterOnThumb):
-
-2008-09-19  David Hyatt  <hyatt@apple.com>
-
-        Move ScrollbarThemeMac.cpp to ScrollbarThemeMac.mm so it can use Obj-C.
-        Set the initial button repeat delay to 0.5 for Mac.
-
-        Reviewed by Sam Weinig
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/mac/ScrollbarThemeMac.cpp: Removed.
-        * platform/mac/ScrollbarThemeMac.h:
-        (WebCore::ScrollbarThemeMac::initialAutoscrollTimerDelay):
-        * platform/mac/ScrollbarThemeMac.mm: Copied from platform/mac/ScrollbarThemeMac.cpp.
-
-2008-09-19  Darin Adler  <darin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - part 2 of https://bugs.webkit.org/show_bug.cgi?id=20858
-          make each distinct C++ class get a distinct JSC::Structure
-
-          + Fixed all cases where we were using a shared structure for multiple
-            C++ classes in WebCore. This still has to be done in JavaScriptCore.
-
-          + Got rid of cacheGlobalObject.
-
-          + Improved use of PassRefPtr in bindings code.
-
-          + Removed a couple cases where we were potentially allocating prototypes
-            inside a JSObject's construction process -- this can lead to trouble if
-            we do a garbage collection while an object is only partly constructed.
-
-        * bindings/js/JSAudioConstructor.cpp:
-        (WebCore::JSAudioConstructor::JSAudioConstructor): Create a structure explicitly
-        so we don't implicitly share the structure with other objects that use the object
-        prototype.
-
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::getCachedDOMConstructor): Added. To be used for constructors so we
-        don't need cacheGlobalObject any more.
-        (WebCore::cacheDOMConstructor): Ditto.
-
-        * bindings/js/JSDOMBinding.h: Removed DOMObject constructor that takes a prototype.
-        Added functions and a function template for getting cached DOM constructors.
-        Removed cacheGlobalObject function template.
-
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::JSDOMWindowBase): Take a PassRefPtr<DOMWindow> since
-        we're taking ownership.
-        * bindings/js/JSDOMWindowBase.h: Changed constructor to take PassRefPtr, since
-        we're taking ownership. Added constructor map.
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::mark): Mark the constructors in the map.
-
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::JSDOMWindowShell::JSDOMWindowShell): Take a PassRefPtr<DOMWindow> since
-        we're taking ownership. Use the new setWindow function to create the JSDOMWindow;
-        this is now done in only that one place.
-        (WebCore::JSDOMWindowShell::setWindow): Added. Creates the JSDOMWindow based on
-        the passed-in DOMWindow. Code was moved here and changed to allocate unique
-        structures for both the window prototype and the window.
-        * bindings/js/JSDOMWindowShell.h: Ditto.
-
-        * bindings/js/JSEventTargetBase.h: Changed class template argument so it doesn't
-        have the same name (JSEventTarget) as an actual class. Removed unhelpful use of
-        private/friend in JSEventTargetBase. Removed comments referring to defunct
-        macros. Changed JSEventTargetBasePrototype to get the prototype with the new
-        rather than its own copy of cacheGlobalObject (I missed this during pass 1).
-        Changed JSEventTargetBasePrototype so it doesn't have so many template arguments.
-
-        * bindings/js/JSEventTargetNode.cpp: Added s_info; needed for the new scheme
-        for caching structures and prototypes.
-        (WebCore::JSEventTargetNode::JSEventTargetNode): Use PassRefPtr.
-        (WebCore::JSEventTargetNode::createPrototype): Added.
-        * bindings/js/JSEventTargetNode.h: Updated for above changes.
-
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::JSHTMLAllCollection): Use PassRefPtr.
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::getNamedItems): Pass ExecState instead of prototype.
-        * bindings/js/JSHTMLFormElementCustom.cpp:
-        (WebCore::JSHTMLFormElement::nameGetter): Ditto.
-        * bindings/js/JSHTMLInputElementBase.cpp:
-        (WebCore::JSHTMLInputElementBase::JSHTMLInputElementBase): Use PassRefPtr.
-        * bindings/js/JSHTMLInputElementBase.h: Ditto.
-        * bindings/js/JSHTMLOptionElementConstructor.cpp:
-        (WebCore::JSHTMLOptionElementConstructor::JSHTMLOptionElementConstructor):
-        Create a unique structure instead of sharing.
-        * bindings/js/JSImageConstructor.cpp:
-        (WebCore::JSImageConstructor::JSImageConstructor): Ditto.
-
-        * bindings/js/JSInspectedObjectWrapper.cpp:
-        (WebCore::JSInspectedObjectWrapper::wrap): Removed overload that takes
-        a prototype rather than a structure. Made the use of inheritorID() here
-        explicit.
-        * bindings/js/JSInspectedObjectWrapper.h: Ditto.
-        * bindings/js/JSInspectorCallbackWrapper.cpp:
-        (WebCore::JSInspectorCallbackWrapper::wrap): Ditto.
-        * bindings/js/JSInspectorCallbackWrapper.h: Ditto.
-
-        * bindings/js/JSNamedNodesCollection.cpp:
-        (WebCore::JSNamedNodesCollection::JSNamedNodesCollection): Changed to
-        take an ExecState argument instead of a prototype. Create a unique
-        StructureID instead of sharing.
-        * bindings/js/JSNamedNodesCollection.h: Ditto.
-
-        * bindings/js/JSQuarantinedObjectWrapper.cpp: Removed overloaded
-        constructor that takes a prototype instead of a structure.
-        * bindings/js/JSQuarantinedObjectWrapper.h: Ditto.
-
-        * bindings/js/JSRGBColor.cpp:
-        (WebCore::JSRGBColor::JSRGBColor): Take ExecState instead of a
-        prototype; create a unique structure.
-        (WebCore::getJSRGBColor): Ditto.
-        * bindings/js/JSRGBColor.h: Ditto.
-
-        * bindings/js/JSSQLResultSetRowListCustom.cpp:
-        (WebCore::JSSQLResultSetRowList::item): Use constructEmptyObject instead
-        of explicit coding the idiom for making a new object.
-
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
-        Create a unique structure instead of the shared one.
-        * bindings/js/JSXSLTProcessorConstructor.cpp:
-        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
-        Ditto.
-
         * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::clearWindowShell): Let the window shell's
-        setWindow function create the JSDOMWindow instead of doing it here.
-
-        * bindings/scripts/CodeGeneratorJS.pm: Changed to use PassRefPtr for
-        the structure and the wrapped object when creating wrappers.
-        Simplified some of the special cases for DOMWindow so they are
-        different only in ways the need to be. Eliminated the
-        JSDOMWindow::createPrototype and JSDOMWindowPrototype::self
-        functions. Moved responsibility for creating the structure and
-        parent prototype out of the prototype constructor into the
-        createPrototype function. Removed the unused "DoNotCache" flag for
-        objects other than DOMWindow. Use getDOMConstructor instead of
-        cacheGlobalObject for constructors. Make each constructor have
-        a unique structure ID.
-
-        * bridge/objc/objc_runtime.h: Added createPrototype and changed the
-        name of the info member to s_info so we can use the standard DOM
-        binding macros to handl the prototype.
-        * bridge/objc/objc_runtime.mm: Fixed namespacing a bit.
-        (JSC::Bindings::ObjcFallbackObjectImp::ObjcFallbackObjectImp):
-        Create a unique structure using getDOMStructure.
-
-        * bridge/runtime_array.cpp: Fixed namespacing a bit.
-        (JSC::RuntimeArray::RuntimeArray): Create a unique structure using
-        getDOMStructure.
-        * bridge/runtime_array.h: Added createPrototype so getDOMStructure
-        will work.
-
-        * bridge/runtime_object.cpp:
-        (JSC::RuntimeObjectImp::RuntimeObjectImp): Create a unique structure using
-        getDOMStructure.
-        * bridge/runtime_object.h: Added createPrototype so getDOMStructure
-        will work.
-
-        * history/CachedPage.cpp:
-        (WebCore::CachedPage::restore): Let the window shell's
-        setWindow function create the JSDOMWindow instead of doing it here.
-
-        * page/DOMWindow.idl: Removed DoNotCache, which is no longer used.
-
-2008-09-19  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        This optimization was suggested by Daniel Fenwick
-
-        - speed up measuring text on the Core Text code path by not specifying a paragraph writing direction
-
-        Specifying LTR paragraph directionality when measuring runs of RTL text
-        resulted in typically two CTRuns being generated for every run instead
-        of one, due to the leading space being reordered to the left.
-
-        * platform/graphics/SimpleFontData.h: Removed the ltr parameter to
-        getCFStringAttributes() and changed m_CFStringAttributes from an array
-        to a single value.
-        * platform/graphics/mac/CoreTextController.cpp:
-        (WebCore::CoreTextController::CoreTextController): Added a
-        mayUseNaturalWritingDirection parameter.
-        (WebCore::CoreTextController::collectCoreTextRunsForCharacters): Changed
-        to force the bidi embedding level whenever 
-        m_mayUseNaturalWritingDirectrion is false. Since this is now a common
-        case, made the typesetter options dictionaries static.
-        * platform/graphics/mac/CoreTextController.h:
-        * platform/graphics/mac/FontMacCoreText.cpp:
-        (WebCore::Font::selectionRectForComplexText): Renamed a local variable.
-        (WebCore::Font::floatWidthForComplexText): Changed to allow the
-        CoreTextController to not set the writing direction.
-        * platform/graphics/mac/SimpleFontDataMac.mm:
-        (WebCore::SimpleFontData::getCFStringAttributes): Removed the ltr
-        parameter and the paragraph style attribute.
-
-2008-09-19  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Sam Weinig
-
-        https://bugs.webkit.org/show_bug.cgi?id=20941
-
-        Incorrect height calculation for replaced element inside nested
-        positioned elements (where the inner has a percentage height and
-        the outer implicitly has a fixed height because of explicit top/bottom
-        values).
-
-        Added fast/block/positioning/replaced-inside-top-bottom.html
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::availableHeightUsing):
-
-2008-09-19  Chris Fleizach  <cfleizach@apple.com>
-
-        Fix Tiger bustage
-
-        * page/mac/AccessibilityObjectWrapper.mm:
-
-2008-09-18  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/6211041> Expose legend tag in accessibility
-
-        Exposes the legend tag as the titleUIElement of a fieldset
-
-        Test: accessibility/legend.html
-
-        * page/AccessibilityObject.h:
-        (WebCore::AccessibilityObject::isFieldset):
-        * page/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::isFieldset):
-        (WebCore::AccessibilityRenderObject::titleUIElement):
-        * page/AccessibilityRenderObject.h:
-        * rendering/RenderFieldset.h:
-
-2008-09-19  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/6213171> WebKit should use new array-centric methods for AX performance
-
-        Implement a few AX API methods that will be called by AppKit, which will 
-        speed up access to accessibility objects
-
-        * page/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityIndexOfChild:]):
-        (-[AccessibilityObjectWrapper accessibilityArrayAttributeCount:]):
-        (-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):
-
-2008-09-19  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon Hausmann.
-
-        [qtwebkit] Set the m_should* flags to their proper value on entry
-        With plugins it was possible that we finished a job twice. This was
-        some kind of reentrancy in QNetworkReplyHandler::sendQueuedItems. By
-        setting the flag to (m_loadMode == LoadDeferred) they will always have
-        the right value and we will not send responses twice.
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-
-2008-09-19  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon Hausmann.
-
-        [qtwebkit] Pass test 70 of acid3. Handle text decoding errors
-        Handle text decoding errors before instructing the parser to parse. We
-        have converted the text to QString and all encoding errors are gone and
-        the parser will not be able to detect them. So handle them before parsing.
-
-        * dom/XMLTokenizerQt.cpp:
-        (WebCore::XMLTokenizer::doWrite):
-
-2008-09-18  Darin Adler  <darin@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        - part 1 of https://bugs.webkit.org/show_bug.cgi?id=20858
-          make each distinct C++ class get a distinct JSC::Structure
-
-        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
-        (WebCore::JSCSSStyleDeclaration::customPut): Use setDOMException
-        instead of DOMExceptionTranslator.
-
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::getCachedDOMObjectWrapper): Updated function name.
-        (WebCore::cacheDOMObjectWrapper): Ditto.
-        (WebCore::forgetDOMObject): Ditto.
-        (WebCore::getCachedDOMNodeWrapper): Ditto.
-        (WebCore::forgetDOMNode): Ditto.
-        (WebCore::cacheDOMNodeWrapper): Ditto.
-        (WebCore::forgetAllDOMNodesForDocument): Ditto.
-        (WebCore::markDOMNodesForDocument): Ditto.
-        (WebCore::updateDOMNodeDocument): Ditto.
-        (WebCore::getCachedDOMStructure): Added.
-        (WebCore::createDOMStructure): Ditto.
-
-        * bindings/js/JSDOMBinding.h: Get rid of the ScriptInterpreter
-        class and replace the static member functions with non-member
-        functions. Added many other functions for getting at structures,
-        prototypes, wrappers, and creating them. Also moved the
-        cacheGlobalObject function here from JavaScriptCore; eventually
-        I'll remove that once I get rid of the remaining callers. Also
-        removed the DOMExceptionTranslator class.
-
-        * bindings/js/JSDOMWindowBase.h: Added JSDOMStructureMap type,
-        and put one of those maps in each window.
-
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::markDOMObjectWrapper): Updated for function name change.
-        (WebCore::JSDOMWindow::mark): Added code to mark all the structures
-        in the structure map.
-
-        * bindings/js/JSEventTargetNode.cpp:
-        (WebCore::JSEventTargetNode::JSEventTargetNode): Changed to take
-        a structure instead of a prototype.
-        * bindings/js/JSEventTargetNode.h: Ditto.
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::JSHTMLAllCollection): Ditto.
-
-        * bindings/js/JSHTMLInputElementBase.cpp:
-        (WebCore::JSHTMLInputElementBase::JSHTMLInputElementBase): Removed
-        use of the JSC_IMPLEMENT_PROTOTYPE macro, and changed to take a
-        structure instead of a prototype.
-        * bindings/js/JSHTMLInputElementBase.h: Removed use of the
-        JSC_DEFINE_PROTOTYPE_WITH_PROTOTYPE macro, and changed constructor
-        to take a structure instead of a prototype. Created a dummy prototype
-        class that causes the HTMLInputElement prototype to have the
-        HTMLElement prototype.
-
-        * bindings/scripts/CodeGeneratorJS.pm: Change constructors to take
-        structures instead of prototypes. Changed the prototype self function
-        to use the getDOMPrototype function -- later we can eliminate it and
-        have callers invoke getDOMPrototype directly instead. Updated other
-        functions that have name changes. Added code to generate the
-        createPrototype member function. Changed use of cacheGlobalObject to
-        get it from the WebCore namespace instead of the JSC namespace.
-        Changed cacheDOMObject calls to use getDOMObjectWrapper instead.
-
-        * dom/Document.cpp:
-        (WebCore::Document::~Document): Updated for name change and also
-        removed unnecessary JSLock use -- there's no need to lock around this.
-        * dom/Node.cpp:
-        (WebCore::Node::setDocument): Ditto.
-
-        * dom/make_names.pl: Changed to use CREATE_DOM_NODE_WRAPPER macro
-        instead of calling new directly.
-
-        * bindings/js/JSCSSRuleCustom.cpp:
-        (WebCore::toJS): Updated for function name changes and used the
-        CREATE_DOM_OBJECT_WRAPPER macro.
-        * bindings/js/JSCSSValueCustom.cpp:
-        (WebCore::toJS): Ditto.
-        * bindings/js/JSCanvasPixelArrayCustom.cpp:
-        (WebCore::toJS): Ditto.
-        * bindings/js/JSDocumentCustom.cpp:
-        (WebCore::JSDocument::mark): Ditto.
-        (WebCore::toJS): Ditto.
-        * bindings/js/JSElementCustom.cpp:
-        (WebCore::toJSNewlyCreated): Ditto.
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::toJS): Ditto.
-        * bindings/js/JSEventTargetBase.cpp:
-        (WebCore::jsEventTargetDispatchEvent): Use setDOMException instead
-        of DOMExceptionTranslator.
-        (WebCore::toJS): Updated for function name changes and used the
-        CREATE_DOM_OBJECT_WRAPPER macro.
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        (WebCore::toJS): Ditto.
-        * bindings/js/JSNodeCustom.cpp:
-        (WebCore::JSNode::mark): Ditto.
-        (WebCore::createWrapper): Ditto.
-        (WebCore::toJS): Ditto.
-        * bindings/js/JSSVGPathSegCustom.cpp:
-        (WebCore::toJS): Ditto.
-        * bindings/js/JSStyleSheetCustom.cpp:
-        (WebCore::toJS): Ditto.
-        (WebCore::JSStyleSheet::mark): Ditto.
-        * bindings/js/JSTextCustom.cpp:
-        (WebCore::toJSNewlyCreated): Ditto.
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        (WebCore::constructXMLHttpRequest): Ditto.
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        (WebCore::JSXMLHttpRequest::mark): Ditto.
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        (WebCore::JSXMLHttpRequestUpload::mark): Ditto.
-        * bindings/js/JSXSLTProcessorConstructor.cpp:
-        (WebCore::constructXSLTProcessor): Ditto.
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::finishedWithEvent): Ditto.
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::loadRequestAsynchronously): Ditto.
-        (WebCore::XMLHttpRequest::dropProtection): Ditto.
-
-2008-09-18  David Hyatt  <hyatt@apple.com>
-
-        This patch gets a viewless scrollbar working on Mac. It is turned off
-        by default.  Hit testing works.  For now the scrollbar just paints ugly
-        debug rects in the place of the buttons, track and thumb.  It does match
-        Aqua metrics though.
-
-        Reviewed by Sam Weinig
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::passMousePressEventToScrollbar):
-        * platform/ScrollbarThemeComposite.cpp:
-        (WebCore::ScrollbarThemeComposite::paint):
-        (WebCore::ScrollbarThemeComposite::trackPosition):
-        * platform/ScrollbarThemeComposite.h:
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::addChild):
-        * platform/mac/ScrollbarThemeMac.cpp:
-        (WebCore::):
-        (WebCore::ScrollbarThemeMac::hasButtons):
-        (WebCore::ScrollbarThemeMac::hasThumb):
-        (WebCore::buttonRepaintRect):
-        (WebCore::ScrollbarThemeMac::backButtonRect):
-        (WebCore::ScrollbarThemeMac::forwardButtonRect):
-        (WebCore::trackRepaintRect):
-        (WebCore::ScrollbarThemeMac::trackRect):
-        (WebCore::ScrollbarThemeMac::minimumThumbLength):
-        (WebCore::ScrollbarThemeMac::shouldCenterOnThumb):
-        (WebCore::ScrollbarThemeMac::paintTrack):
-        (WebCore::ScrollbarThemeMac::paintButton):
-        (WebCore::ScrollbarThemeMac::paintThumb):
-        * platform/mac/ScrollbarThemeMac.h:
-        (WebCore::ScrollbarThemeMac::supportsControlTints):
-        * platform/qt/ScrollbarThemeQt.cpp:
-        (WebCore::ScrollbarThemeQt::trackPosition):
-
-2008-09-18  Collin Jackson  <collinj@webkit.org>
-
-        Build fix; added missing header file to GNUmakefile.am
-
-        * GNUmakefile.am:
-
-2008-09-18  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by David "the Hair" Hyatt.
-
-        Move DataRef, SVGRenderStyle and SVGRenderStyleDefs in render/style.
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * rendering/DataRef.h: Removed.
-        * rendering/SVGRenderStyle.cpp: Removed.
-        * rendering/SVGRenderStyle.h: Removed.
-        * rendering/SVGRenderStyleDefs.cpp: Removed.
-        * rendering/SVGRenderStyleDefs.h: Removed.
-        * rendering/style/DataRef.h: Copied from rendering/DataRef.h.
-        * rendering/style/SVGRenderStyle.cpp: Copied from rendering/SVGRenderStyle.cpp.
-        * rendering/style/SVGRenderStyle.h: Copied from rendering/SVGRenderStyle.h.
-        * rendering/style/SVGRenderStyleDefs.cpp: Copied from rendering/SVGRenderStyleDefs.cpp.
-        * rendering/style/SVGRenderStyleDefs.h: Copied from rendering/SVGRenderStyleDefs.h.
-
-2008-09-18  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Add a means of clearing a FrameTree's name.
-
-        * WebCore.base.exp:
-        * page/FrameTree.cpp:
-        (WebCore::FrameTree::clearName):
-        * page/FrameTree.h:
-
-2008-09-18  David Hyatt  <hyatt@apple.com>
-
-        Eliminate addToSuperview from Widget, since it was only called
-        by ScrollViewMac's addChild method.  Just shift the original body
-        of addToSuperView into addChild.
-
-        Reviewed by Sam Weinig
-
-        * platform/Widget.h:
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::addChild):
-        * platform/mac/WidgetMac.mm:
-
-2008-09-18  Collin Jackson  <collinj@webkit.org>
-
-        Reviewed by Antti Koivisto and Mark Rowe.
-
-        Test: http/tests/misc/dns-prefetch-control.html
-
-        https://bugs.webkit.org/show_bug.cgi?id=20690
-
-        Invoke WebCore::prefetchDNS() on host names that appear in
-        in the href of hyperlinks and <link rel="dns-prefetch">. This 
-        can be used to implement DNS prefetching.
-
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * dom/Document.cpp:
-        (WebCore::Document::Document):
-        (WebCore::Document::processHttpEquiv):
-        (WebCore::Document::setSecurityOrigin):
-        (WebCore::Document::initDNSPrefetch):
-        (WebCore::Document::parseDNSPrefetchControlHeader):
-        * dom/Document.h:
-        (WebCore::Document::isDNSPrefetchEnabled):
-        * html/HTMLAnchorElement.cpp:
-        (WebCore::HTMLAnchorElement::parseMappedAttribute):
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::HTMLLinkElement):
-        (WebCore::HTMLLinkElement::parseMappedAttribute):
-        (WebCore::HTMLLinkElement::tokenizeRelAttribute):
-        (WebCore::HTMLLinkElement::process):
-        * html/HTMLLinkElement.h:
-        * html/PreloadScanner.cpp:
-        (WebCore::PreloadScanner::processAttribute):
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::evaluate):
+        * bindings/js/ScriptController.h:
+        (WebCore::ScriptController::xssAuditor):
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * dom/Tokenizer.h:
+        (WebCore::Tokenizer::xssAuditor):
+        (WebCore::Tokenizer::setXSSAuditor):
+        (WebCore::Tokenizer::Tokenizer):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler):
         * loader/FrameLoader.cpp:
         (WebCore::FrameLoader::begin):
-        * platform/gtk/TemporaryLinkStubs.cpp:
-        (WebCore::prefetchDNS):
-        * platform/network/DNS.h: Added.
-        * platform/network/cf/DNSCFNet.cpp: Added.
-        (WebCore::prefetchDNS):
-        * platform/qt/TemporaryLinkStubs.cpp:
-        (WebCore::prefetchDNS):
-        * platform/wx/TemporaryLinkStubs.cpp:
-        (WebCore::prefetchDNS):
-
-2008-09-18  David Hyatt  <hyatt@apple.com>
-
-        Eliminate the convertToScreenCoordinate method on Widget, since
-        ScrollView has redundant methods that already do the same thing.
-
-        Reviewed by Sam Weinig
-
-        * editing/mac/SelectionControllerMac.mm:
-        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
-        * platform/Widget.h:
-        * platform/mac/WidgetMac.mm:
-        (WebCore::Widget::containingWindow):
-
-2008-09-18  David Hyatt  <hyatt@apple.com>
-
-        Move to only one constructor for Widgets.  Rename data to m_data and make
-        it have an #ifdef only for platforms that have platform-specific data (Mac
-        and Gtk).
-
-        Reviewed by Sam Weinig
-
-        * WebCore.base.exp:
-        * platform/Widget.cpp:
-        (WebCore::Widget::init):
-        * platform/Widget.h:
-        * platform/gtk/WidgetGtk.cpp:
-        (WebCore::Widget::Widget):
-        (WebCore::Widget::~Widget):
-        (WebCore::Widget::cursor):
-        (WebCore::Widget::setCursor):
-        * platform/mac/WidgetMac.mm:
-        (WebCore::Widget::Widget):
-        (WebCore::Widget::~Widget):
-        (WebCore::Widget::addToSuperview):
-        (WebCore::Widget::removeFromSuperview):
-        (WebCore::Widget::beforeMouseDown):
-        (WebCore::Widget::afterMouseDown):
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::Widget::Widget):
-        * platform/win/WidgetWin.cpp:
-        (WebCore::Widget::Widget):
-        * platform/wx/WidgetWx.cpp:
-        (WebCore::Widget::Widget):
-
-2008-09-18  David Hyatt  <hyatt@apple.com>
-
-        Move Qt's isNPAPIPlugin boolean from Widget down to PluginView, since there
-        was no reason for it to be on Widget.  This change eliminates Qt ifdefs
-        from Widget.
-
-        Reviewed by Sam Weinig
-
-        * bindings/js/ScriptControllerQt.cpp:
-        (WebCore::ScriptController::createScriptInstanceForWidget):
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::WidgetPrivate::WidgetPrivate):
-        (WebCore::WidgetPrivate::~WidgetPrivate):
-        (WebCore::Widget::Widget):
-        (WebCore::Widget::~Widget):
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::PluginView):
-        * plugins/PluginView.h:
-        (WebCore::PluginView::isNPAPIPlugin):
-        (WebCore::PluginView::setIsNPAPIPlugin):
-
-2008-09-18  David Hyatt  <hyatt@apple.com>
-
-        Make geometryChanged() cross-platform on Widget.  GTK and WIN platform
-        ifdefs are now gone from Widget!
-
-        Reviewed by Sam Weinig
-
-        * platform/Widget.h:
-        (WebCore::Widget::geometryChanged):
-        * platform/gtk/WidgetGtk.cpp:
-        * platform/qt/WidgetQt.cpp:
-
-2008-09-18  David Hyatt  <hyatt@apple.com>
-
-        Consolidate convertTo/FromContainingWindow methods so that all platforms
-        but Mac share the same code.
-
-        Move convertSelfToChild and convertChildToSelf to ScrollView, since
-        Widget should know nothing about children.  Make the methods cross-platform
-        on ScrollView.
-
-        Reviewed by Sam Weinig
-
-        * platform/ScrollView.h:
-        (WebCore::ScrollView::convertChildToSelf):
-        (WebCore::ScrollView::convertSelfToChild):
-        * platform/Widget.cpp:
-        (WebCore::Widget::convertToContainingWindow):
-        (WebCore::Widget::convertFromContainingWindow):
-        * platform/Widget.h:
-        (WebCore::Widget::geometryChanged):
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::isScrollViewScrollbar):
-        * platform/gtk/WidgetGtk.cpp:
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::isScrollViewScrollbar):
-        * platform/mac/WidgetMac.mm:
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::isScrollViewScrollbar):
-        * platform/qt/WidgetQt.cpp:
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::isScrollViewScrollbar):
-        * platform/win/WidgetWin.cpp:
-
-2008-09-18  David Hyatt  <hyatt@apple.com>
-
-        Make the conversion methods that go to and from some containingWindow
-        cross-platform.  Implement them on Mac.
-
-        Reviewed by Sam Weinig
-
-        * platform/Widget.h:
-        (WebCore::Widget::setContainingWindow):
-        * platform/mac/WidgetMac.mm:
-        (WebCore::Widget::convertFromContainingWindow):
-        (WebCore::Widget::convertToContainingWindow):
-
-2008-09-18  Sam Weinig  <sam@webkit.org>
-
-        Rubber-stamped by David "Yeah-yeah" Hyatt.
-
-        Cleanup RenderStyle.
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * rendering/style/CounterContent.h:
-        * rendering/style/RenderStyle.cpp:
-        * rendering/style/RenderStyle.h:
-
-2008-09-18  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Sam Weinig
-
-        Fixed https://bugs.webkit.org/show_bug.cgi?id=20908
-        Now TransformOperations and AnimationList no longer
-        inherit from Vector<> but rather have API to access.
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::computedTransform):
-        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::createTransformOperations):
-        * page/animation/AnimationBase.cpp:
-        (WebCore::blendFunc):
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimation::updateTransitions):
-        (WebCore::CompositeAnimation::updateKeyframeAnimations):
-        (WebCore::CompositeAnimation::animate):
-        * page/animation/ImplicitAnimation.cpp:
-        (WebCore::ImplicitAnimation::validateTransformFunctionList):
-        * page/animation/KeyframeAnimation.cpp:
-        (WebCore::KeyframeAnimation::validateTransformFunctionList):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::updateReflectionStyle):
-        * rendering/style/AnimationList.cpp:
-        (WebCore::AnimationList::operator==):
-        * rendering/style/AnimationList.h:
-        (WebCore::AnimationList::operator!=):
-        (WebCore::AnimationList::size):
-        (WebCore::AnimationList::isEmpty):
-        (WebCore::AnimationList::resize):
-        (WebCore::AnimationList::remove):
-        (WebCore::AnimationList::append):
-        (WebCore::AnimationList::animation):
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::StyleRareNonInheritedData::updateKeyframes):
-        (WebCore::RenderStyle::applyTransform):
-        (WebCore::RenderStyle::adjustAnimations):
-        (WebCore::RenderStyle::adjustTransitions):
-        (WebCore::RenderStyle::transitionForProperty):
-        * rendering/style/RenderStyle.h:
-        (WebCore::RenderStyle::hasTransform):
-        * rendering/style/TransformOperations.cpp:
-        (WebCore::TransformOperations::TransformOperations):
-        (WebCore::TransformOperations::operator==):
-        * rendering/style/TransformOperations.h:
-        (WebCore::TransformOperations::apply):
-        (WebCore::TransformOperations::operations):
-
-2008-09-18  Holger Hans Peter Freyther  <zecke@selfish.org>
+        (WebCore::FrameLoader::requestObject):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setXSSAuditorEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::xssAuditorEnabled):
+        * page/XSSAuditor.cpp: Added.
+        (WebCore::isControlCharacter):
+        (WebCore::XSSAuditor::XSSAuditor):
+        (WebCore::XSSAuditor::~XSSAuditor):
+        (WebCore::XSSAuditor::canEvaluate):
+        (WebCore::XSSAuditor::canCreateInlineEventListener):
+        (WebCore::XSSAuditor::canLoadExternalScriptFromSrc):
+        (WebCore::XSSAuditor::canLoadObject):
+        (WebCore::XSSAuditor::decodeURL):
+        (WebCore::XSSAuditor::findInRequest):
+        * page/XSSAuditor.h: Added.
+        (WebCore::XSSAuditor::isEnabled):
+        (WebCore::XSSAuditor::setXSSAuditorEnabled):
+
+2009-06-18  Dirk Schulze  <krit@webkit.org>
 
-        Build fix.
+        Reviewed by Oliver Hunt.
 
-        [qt] Build fixes after the Widget/ScrollView cleanup
-        topLevel() is now root()
+        feOffset and objectBoundingBox
+        [https://bugs.webkit.org/show_bug.cgi?id=26441]
 
+        If we use objectBoundingBox for primitiveUnits, the fractions given
+        to dx or dy of feOffset must be multiplied with the referenced objects
+        objectBoundingBox size.
 
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::scrollBackingStore):
-        (WebCore::ScrollView::addChild):
-        (WebCore::ScrollView::removeChild):
+        Test: svg/filters/feOffset.svg
 
-2008-09-18  Holger Hans Peter Freyther  <zecke@selfish.org>
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
 
-        Reviewed by Mark Rowe.
+2009-06-18  Dirk Schulze  <krit@webkit.org>
 
-        https://bugs.webkit.org/show_bug.cgi?id=20437
+        Reviewed by Oliver Hunt.
 
-        XMLTokenizer.cpp used to contain two different implementations. One was using
-        libxml2 and the other was using the Qt XML StreamReader. Clean up the code by
-        separating the two implementations from each other.
-        Common code and some small bits are kept inside the XMLTokenizer.cpp, the Qt code
-        was moved to XMLTokenizerQt.cpp and the Libxml2 based code was moved to
-        XMLTokenizerLibxml2.cpp. There should be no functional changes.
+        feTile implementation missing
+        [https://bugs.webkit.org/show_bug.cgi?id=26419]
 
-        Attempt to add XMLTokenizerLibxml2.cpp to every buildsystem so the build continues
-        to work.
+        Implementation of feTile, a pattern effect for SVG filters. It was
+        necessary to modify FilterEffect since source inputs need a secial
+        logic and we have to identify if an effect is a source input.
 
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * dom/XMLTokenizer.cpp:
-        (WebCore::isScriptElement):
-        (WebCore::castToScriptElement):
-        (WebCore::XMLTokenizer::setCurrentNode):
-        (WebCore::XMLTokenizer::write):
-        (WebCore::XMLTokenizer::eventuallyMarkAsParserCreated):
-        (WebCore::XMLTokenizer::enterText):
-        (WebCore::toString):
-        (WebCore::XMLTokenizer::exitText):
-        (WebCore::XMLTokenizer::end):
-        (WebCore::XMLTokenizer::insertErrorMessageBlock):
-        * dom/XMLTokenizer.h:
-        (WebCore::XMLTokenizer::wellFormed):
-        * dom/XMLTokenizerLibxml2.cpp: Copied from WebCore/dom/XMLTokenizer.cpp.
-        (WebCore::createMemoryParser):
-        (WebCore::XMLTokenizer::XMLTokenizer):
-        (WebCore::XMLTokenizer::~XMLTokenizer):
-        (WebCore::XMLTokenizer::doWrite):
-        (WebCore::ignorableWhitespaceHandler):
-        (WebCore::XMLTokenizer::initializeParserContext):
-        (WebCore::XMLTokenizer::doEnd):
-        (WebCore::XMLTokenizer::lineNumber):
-        (WebCore::XMLTokenizer::columnNumber):
-        (WebCore::XMLTokenizer::stopParsing):
-        (WebCore::XMLTokenizer::resumeParsing):
-        (WebCore::parseXMLDocumentFragment):
-        (WebCore::attributesStartElementNsHandler):
-        (WebCore::parseAttributes):
-        * dom/XMLTokenizerQt.cpp: Copied from WebCore/dom/XMLTokenizer.cpp.
-        (WebCore::EntityResolver::resolveUndeclaredEntity):
-        (WebCore::XMLTokenizer::XMLTokenizer):
-        (WebCore::XMLTokenizer::~XMLTokenizer):
-        (WebCore::XMLTokenizer::doWrite):
-        (WebCore::XMLTokenizer::initializeParserContext):
-        (WebCore::XMLTokenizer::doEnd):
-        (WebCore::XMLTokenizer::lineNumber):
-        (WebCore::XMLTokenizer::columnNumber):
-        (WebCore::XMLTokenizer::stopParsing):
-        (WebCore::XMLTokenizer::resumeParsing):
-        (WebCore::parseXMLDocumentFragment):
-        (WebCore::attributesStartElementNsHandler):
-        (WebCore::parseAttributes):
-        (WebCore::):
+        Tests: svg/batik/filters/feTile.svg
+               svg/filters/feTile.svg
 
-2008-09-18  Beth Dakin  <bdakin@apple.com>
+        * platform/graphics/filters/FilterEffect.h:
+        (WebCore::FilterEffect::isSourceInput):
+        * platform/graphics/filters/SourceAlpha.h:
+        (WebCore::SourceAlpha::isSourceInput):
+        * platform/graphics/filters/SourceGraphic.h:
+        (WebCore::SourceGraphic::isSourceInput):
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
 
-        Reviewed by Geoff Garen.
+2009-06-18  Dirk Schulze  <krit@webkit.org>
 
-        Build fix for non-Mac builds.
+        Reviewed by Oliver Hunt.
 
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::cssText):
+        feMerge implementation
+        [https://bugs.webkit.org/show_bug.cgi?id=26480]
 
-2008-09-18  Peter Kasting  <pkasting@google.com>
+        Added feMerge to the SVG Filter system.
 
-        Reviewed by hyatt.  Landed by eseidel.
+        Test: svg/filters/feMerge.svg
 
-        https://bugs.webkit.org/show_bug.cgi?id=20745
-        Animated GIFs do not animate properly with (at least) CG.
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::uniteChildEffectSubregions):
+        (WebCore::FEMerge::apply):
+        * svg/graphics/filters/SVGFEMerge.h:
 
-        * WebCore\platform\graphics\BitmapImage.cpp:
-        * WebCore\platform\graphics\BitmapImage.h:
-        * WebCore\platform\graphics\cairo\ImageCairo.cpp:
-        * WebCore\platform\graphics\cg\ImageCG.cpp:
-        * WebCore\platform\graphics\qt\ImageQt.cpp:
-        * WebCore\platform\graphics\wx\ImageWx.cpp:
+2009-06-18  Mark Rowe  <mrowe@apple.com>
 
-2008-09-18  Chris Fleizach  <cfleizach@apple.com>
+        Speculative Windows build fix.
 
-        Reviewed by Beth Dakin
+        * page/win/FrameCGWin.cpp: Add missing #include.
 
-        <rdar://problem/6224222> AX: should not expose a <table> as an AXTable if ARIA 
-        role specifies otherwise
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
 
-        If a <table> isn't an AXTable, the rows and cells should default to AccessibilityRenderObject
+        Reviewed by Dave Levin.
 
-        Test: accessibility/table-with-aria-role.html
+        https://bugs.webkit.org/show_bug.cgi?id=26425
+        Final refactorings, picking up a few places where BitmapInfo
+        could be used.
 
-        * page/AccessibilityTable.cpp:
-        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
-        (WebCore::AccessibilityTable::addChildren):
-        (WebCore::AccessibilityTable::roleValue):
-        (WebCore::AccessibilityTable::accessibilityIsIgnored):
-        (WebCore::AccessibilityTable::title):
-        * page/AccessibilityTableCell.cpp:
-        (WebCore::AccessibilityTableCell::accessibilityIsIgnored):
-        (WebCore::AccessibilityTableCell::isTableCell):
-        (WebCore::AccessibilityTableCell::roleValue):
-        * page/AccessibilityTableCell.h:
-        * page/AccessibilityTableRow.cpp:
-        (WebCore::AccessibilityTableRow::roleValue):
-        (WebCore::AccessibilityTableRow::isTableRow):
-        (WebCore::AccessibilityTableRow::accessibilityIsIgnored):
-        * page/AccessibilityTableRow.h:
+        * page/win/FrameCGWin.cpp:
+        (WebCore::imageFromRect):
+        * platform/win/CursorWin.cpp:
+        (WebCore::Cursor::Cursor):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::paint):
 
-2008-09-18  Steve Falkenburg  <sfalken@apple.com>
+2009-06-18  Chris Fleizach  <cfleizach@apple.com>
 
-        Use higher-resolution timers on all variants of Windows.
-        
         Reviewed by Darin Adler.
 
-        * platform/win/SharedTimerWin.cpp:
-        (WebCore::setSharedTimerFireTime):
-
-
-2008-09-18  David Hyatt  <hyatt@apple.com>
-
-        Make containingWindow() and setContainingWindow() cross-platform.
-        Add a root() function cross-platform so Qt doesn't have to
-        define its own.
-
-        Reviewed by Darin Adler
-
-        * platform/Widget.cpp:
-        (WebCore::Widget::root):
-        * platform/Widget.h:
-        (WebCore::Widget::setContainingWindow):
-        * platform/gtk/WidgetGtk.cpp:
-        (WebCore::Widget::Widget):
-        (WebCore::Widget::containingWindow):
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::addChild):
-        (WebCore::ScrollView::removeChild):
-        * platform/mac/WidgetMac.mm:
-        (WebCore::Widget::containingWindow):
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::Widget::invalidateRect):
-        (WebCore::Widget::containingWindow):
-        * platform/win/WidgetWin.cpp:
-        (WebCore::Widget::Widget):
-        (WebCore::Widget::~Widget):
-        (WebCore::Widget::containingWindow):
-
-2008-09-18  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=20515 Crash upon 
-        parsing CSS: unicode-range: searchfield-cancel-buttonpt=-webkit-
-        dashboard-region=
-        and corresponding: <rdar://problem/6174100>
-
-        This patch makes CSSParserValue::createCSSValue handle unknown 
-        identifiers.
-
-        * css/CSSParserValues.cpp:
-        (WebCore::CSSParserValue::createCSSValue): If we have an identifier 
-        with no id (an unknown identifier) create a CSSPrimitiveValue of 
-        type CSS_PARSER_IDENTIFIER
-        * css/CSSPrimitiveValue.cpp:
-        (WebCore::CSSPrimitiveValue::cssText):
-        (WebCore::CSSPrimitiveValue::parserValue):
-        * css/CSSPrimitiveValue.h:
-        (WebCore::CSSPrimitiveValue::):
-
-2008-09-18  Sam Weinig  <sam@webkit.org>
-
-        Rubber-stamped by David "I'd prefer not" Hyatt.
-
-        More the remaining class out of RenderStyle.h/cpp
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * rendering/style/CursorData.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::CursorData::CursorData):
-        (WebCore::CursorData::operator==):
-        (WebCore::CursorData::operator!=):
-        * rendering/style/CursorList.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::CursorList::operator[]):
-        (WebCore::CursorList::CursorList):
-        * rendering/style/RenderStyle.cpp:
-        * rendering/style/RenderStyle.h:
-        (WebCore::RenderStyle::deref):
-        (WebCore::RenderStyle::hasOneRef):
-        (WebCore::RenderStyle::InheritedFlags::operator!=):
-        (WebCore::RenderStyle::NonInheritedFlags::operator!=):
-        (WebCore::RenderStyle::hasBackground):
-        (WebCore::RenderStyle::outlineWidth):
-        (WebCore::RenderStyle::autoWrap):
-        (WebCore::RenderStyle::preserveNewline):
-        (WebCore::RenderStyle::collapseWhiteSpace):
-        (WebCore::RenderStyle::isCollapsibleWhiteSpace):
-        (WebCore::RenderStyle::breakOnlyAfterWhiteSpace):
-        (WebCore::RenderStyle::breakWords):
-        (WebCore::RenderStyle::outlineOffset):
-        (WebCore::RenderStyle::setLeft):
-        (WebCore::RenderStyle::setRight):
-        (WebCore::RenderStyle::setTop):
-        (WebCore::RenderStyle::setBottom):
-        (WebCore::RenderStyle::setDashboardRegion):
-        (WebCore::RenderStyle::setBackgroundColor):
-        (WebCore::RenderStyle::setBorderImage):
-        (WebCore::RenderStyle::setBorderRadius):
-        (WebCore::RenderStyle::setFontDescription):
-        (WebCore::RenderStyle::adjustBackgroundLayers):
-        (WebCore::RenderStyle::adjustMaskLayers):
-        (WebCore::RenderStyle::deleteBindingURIs):
-        (WebCore::RenderStyle::inheritBindingURIs):
-        (WebCore::RenderStyle::isDisplayReplacedType):
-        (WebCore::RenderStyle::isDisplayInlineType):
-        (WebCore::RenderStyle::isOriginalDisplayInlineType):
-        * rendering/style/StyleInheritedData.cpp: Copied from rendering/style/RenderStyle.cpp.
-        * rendering/style/StyleInheritedData.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::StyleInheritedData::operator!=):
-        * rendering/style/StyleRareInheritedData.cpp: Copied from rendering/style/RenderStyle.cpp.
-        * rendering/style/StyleRareInheritedData.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::StyleRareInheritedData::operator!=):
-        * rendering/style/StyleRareNonInheritedData.cpp: Copied from rendering/style/RenderStyle.cpp.
-        * rendering/style/StyleRareNonInheritedData.h: Copied from rendering/style/RenderStyle.h.
-        * rendering/style/StyleReflection.h: Copied from rendering/style/RenderStyle.h.
-
-2008-09-18  David Hyatt  <hyatt@apple.com>
-
-        Move the concept of suppression invalidation on Widgets to Scrollbar
-        instead.  Since this is only used by Scrollbars, there is no need for
-        it to be on Widget.
-
-        Reviewed by Sam Weinig
-
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::Scrollbar):
-        (WebCore::Scrollbar::invalidateRect):
-        * platform/Scrollbar.h:
-        (WebCore::Scrollbar::suppressInvalidation):
-        (WebCore::Scrollbar::setSuppressInvalidation):
-        * platform/Widget.h:
-        * platform/gtk/WidgetGtk.cpp:
-        (WebCore::Widget::Widget):
-        (WebCore::Widget::invalidateRect):
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::WidgetPrivate::WidgetPrivate):
-        (WebCore::Widget::invalidateRect):
-        * platform/win/WidgetWin.cpp:
-        (WebCore::Widget::Widget):
-        (WebCore::Widget::invalidateRect):
-
-2008-09-18  David Hyatt  <hyatt@apple.com>
-
-        Make invalidate() on Widget non-virtual and make it just call
-        invalidateRect() on the boundsGeometry() of the Widget.
-
-        Reviewed by Dan Bernstein
-
-        * platform/Widget.h:
-        (WebCore::Widget::boundsGeometry):
-        (WebCore::Widget::invalidate):
-        * platform/gtk/WidgetGtk.cpp:
-        * platform/mac/WidgetMac.mm:
-        * platform/qt/WidgetQt.cpp:
-        * platform/win/WidgetWin.cpp:
-        * platform/wx/WidgetWx.cpp:
-
-2008-09-18  Sam Weinig  <sam@webkit.org>
-
-        Rubber-stamped in exile by David Hyatt.
-
-        Split Animation, AnimationList, BindingURI, ContentData, CounterContent,
-        KeyframeList, ShadowData, StyleFlexibleBoxData and TimingFunction out of
-        RenderStyle.h/cpp
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * css/CSSStyleSelector.cpp:
-        * css/CSSStyleSelector.h:
-        * page/animation/CompositeAnimation.cpp:
-        * page/animation/KeyframeAnimation.cpp:
-        * page/animation/KeyframeAnimation.h:
-        * rendering/RenderCounter.h:
-        * rendering/style/Animation.cpp: Copied from rendering/style/RenderStyle.cpp.
-        (WebCore::Animation::~Animation):
-        (WebCore::Animation::animationsMatch):
-        (WebCore::Animation::keyframeList):
-        (WebCore::Animation::setAnimationKeyframe):
-        * rendering/style/Animation.h: Copied from rendering/style/RenderStyle.h.
-        * rendering/style/AnimationList.cpp: Copied from rendering/style/RenderStyle.cpp.
-        * rendering/style/AnimationList.h: Copied from rendering/style/RenderStyle.h.
-        * rendering/style/BindingURI.cpp: Copied from rendering/style/RenderStyle.cpp.
-        * rendering/style/BindingURI.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::BindingURI::operator!=):
-        * rendering/style/ContentData.cpp: Copied from rendering/style/RenderStyle.cpp.
-        * rendering/style/ContentData.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::ContentData::ContentData):
-        (WebCore::ContentData::~ContentData):
-        * rendering/style/CounterContent.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::CounterContent::CounterContent):
-        * rendering/style/CounterDirectives.cpp: Copied from rendering/style/RenderStyle.cpp.
-        * rendering/style/CounterDirectives.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::CounterDirectives::CounterDirectives):
-        * rendering/style/KeyframeList.cpp: Copied from rendering/style/RenderStyle.cpp.
-        (WebCore::KeyframeList::insert):
-        * rendering/style/KeyframeList.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::KeyframeValue::KeyframeValue):
-        (WebCore::KeyframeList::create):
-        (WebCore::KeyframeList::KeyframeList):
-        * rendering/style/RenderStyle.cpp:
-        * rendering/style/RenderStyle.h:
-        * rendering/style/ShadowData.cpp: Copied from rendering/style/RenderStyle.cpp.
-        * rendering/style/ShadowData.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::ShadowData::ShadowData):
-        (WebCore::ShadowData::~ShadowData):
-        (WebCore::ShadowData::operator!=):
-        * rendering/style/StyleFlexibleBoxData.cpp: Copied from rendering/style/RenderStyle.cpp.
-        * rendering/style/StyleFlexibleBoxData.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::StyleFlexibleBoxData::operator!=):
-        * rendering/style/TimingFunction.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::TimingFunction::TimingFunction):
-        (WebCore::TimingFunction::operator==):
-
-2008-09-18  Adele Peterson  <adele@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Fix RenderStyle leaks.
-
-        * rendering/RenderTextControl.cpp: (WebCore::RenderTextControl::createSubtreeIfNeeded):
-
-2008-09-18  Kevin McCullough  <kmccullough@apple.com>
-
-        Accidentally checked in code.
-
-        * html/HTMLElementFactory.cpp:
-        (WebCore::frameConstructor):
-        (WebCore::iframeConstructor):
-
-2008-09-18  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Tim.
-
-        <rdar://problem/5722310> gracefully handle too many console messages
-        (20904)
-        - Keep track of the most previous message and then compare it to the 
-        subsequent messages as they come in.  If there are multiple of the same
-        message create a count that indicates the current number.
-
-        * manual-tests/inspector/multiple-console-messages.html: Added.
-        * page/inspector/Console.js:
-        * page/inspector/inspector.css:
-
-2008-09-18  Jonathon Jongsma  <jonathon@quotidian.org>
-
-        Reviewed by Alp Toker
+        Bug 26522: In DOM mode, VoiceOver reads some mouseover text on web sites strangely
+        https://bugs.webkit.org/show_bug.cgi?id=26522
 
-        https://bugs.webkit.org/show_bug.cgi?id=20830
-        [GTK] Don't use deprecated pango API
+        Test: accessibility/non-data-table-cell-title-ui-element.html
 
-        Replace deprecated pango functions with non-deprecated ones for newer
-        versions of pango
-
-        * platform/graphics/gtk/FontGtk.cpp:
-        (WebCore::getDefaultPangoLayout):
-        * platform/graphics/gtk/FontPlatformDataPango.cpp:
-        (WebCore::FontPlatformData::FontPlatformData):
-
-2008-09-18  Alp Toker  <alp@nuanti.com>
-
-        Build fix for r36587. Add new sources (and sort the lists).
-
-        * GNUmakefile.am:
-
-2008-09-17  Sam Weinig  <sam@webkit.org>
+        * accessibility/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::titleUIElement):
 
-        Fix Windows build.
+2009-06-18  Kevin Ollivier  <kevino@theolliviers.com>
 
-        * WebCore.vcproj/WebCore.vcproj:
+        wx build fix after recent RenderTheme changes.
 
-2008-09-17  David Hyatt  <hyatt@apple.com>
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderThemeWx::~RenderThemeWx):
+        (WebCore::RenderTheme::themeForPage):
 
-        Switch back to having frameGeometry be virtual in order to keep Mac
-        the way it used to be.
+2009-06-18  Peter Kasting  <pkasting@google.com>
 
-        Reviewed by Sam Weinig
+        Reviewed by Eric Seidel.
 
-        * WebCore.base.exp:
-        * platform/Widget.cpp:
-        (WebCore::Widget::setParent):
-        * platform/Widget.h:
-        * platform/gtk/WidgetGtk.cpp:
-        (WebCore::Widget::frameGeometry):
-        (WebCore::Widget::setFrameGeometry):
-        * platform/mac/WidgetMac.mm:
-        (WebCore::Widget::frameGeometry):
-        (WebCore::Widget::setFrameGeometry):
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::Widget::frameGeometry):
-        (WebCore::Widget::setFrameGeometry):
-        * platform/win/WidgetWin.cpp:
-        (WebCore::Widget::frameGeometry):
-        (WebCore::Widget::setFrameGeometry):
-        * platform/wx/WidgetWx.cpp:
-        (WebCore::Widget::frameGeometry):
-        (WebCore::Widget::setFrameGeometry):
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::setFrameGeometry):
-        (WebCore::PluginView::geometryChanged):
-        * plugins/PluginView.h:
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::updatePluginWidget):
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::updatePluginWidget):
+        https://bugs.webkit.org/show_bug.cgi?id=26460 part two
+        Attempt to minimize diff of following functional change by first landing
+        non-functional change to:
+        * Make readUintX() public and static (since they will need to be once
+          BMPImageReader is included in *ImageDecoder via composition rather
+          than inheritance).  Add wrappers in each class so callers can be
+          simpler.  In the next patch, these wrappers will be beefed up slightly
+          and the callers will get even simpler.
+        * Change direct setting of m_failed to use setFailed(), since in the
+          next patch much of this code won't even have direct access to m_failed
+        * Add a helper function in ICOImageDecoder to determine the image type
+          instead of simply doing it inline
+        * Rewrap lines that used to be <=80 cols and slipped over it during the
+          original landing of these decoders
+        * Other misc. changes, e.g. adding constructor definitions, reordering
+          functions, changing RGBA32Buffer& to RGBA32Buffer*, etc. that have no
+          functional effect but minimize the subsequent diff for readability
+
+
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp:
+        (WebCore::BMPImageDecoder::BMPImageDecoder):
+        (WebCore::BMPImageDecoder::processFileHeader):
+        * platform/image-decoders/bmp/BMPImageDecoder.h:
+        (WebCore::BMPImageDecoder::readUint32):
+        * platform/image-decoders/bmp/BMPImageReader.cpp:
+        (WebCore::BMPImageReader::decodeBMP):
+        (WebCore::BMPImageReader::getInfoHeaderSize):
+        (WebCore::BMPImageReader::processInfoHeader):
+        (WebCore::BMPImageReader::readInfoHeader):
+        (WebCore::BMPImageReader::processBitmasks):
+        (WebCore::BMPImageReader::processColorTable):
+        (WebCore::BMPImageReader::processRLEData):
+        (WebCore::BMPImageReader::processNonRLEData):
+        * platform/image-decoders/bmp/BMPImageReader.h:
+        (WebCore::BMPImageReader::readUint16Helper):
+        (WebCore::BMPImageReader::readUint32Helper):
+        (WebCore::BMPImageReader::):
+        (WebCore::BMPImageReader::readUint16):
+        (WebCore::BMPImageReader::readUint32):
+        (WebCore::BMPImageReader::readCurrentPixel):
+        (WebCore::BMPImageReader::getComponent):
+        (WebCore::BMPImageReader::setI):
+        (WebCore::BMPImageReader::setRGBA):
+        (WebCore::BMPImageReader::fillRGBA):
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::ICOImageDecoder):
+        (WebCore::ICOImageDecoder::isSizeAvailable):
+        (WebCore::ICOImageDecoder::size):
+        (WebCore::ICOImageDecoder::decodeImage):
+        (WebCore::ICOImageDecoder::processDirectory):
+        (WebCore::ICOImageDecoder::processDirectoryEntries):
+        (WebCore::ICOImageDecoder::isBetterEntry):
+        (WebCore::ICOImageDecoder::processImageType):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+        (WebCore::ICOImageDecoder::readUint16):
+        (WebCore::ICOImageDecoder::readUint32):
 
-2008-09-17  Sam Weinig  <sam@webkit.org>
+2009-06-18  Peter Kasting  <pkasting@google.com>
 
-        Reviewed by Mark Rowe.
+        Fix build bustage.
 
-        Fix assertion in DOMWindow::adjustWindowRect where we were passing
-        in garbage values and were getting lucky that they were a not Nan.
+        * platform/image-decoders/gif/GIFImageDecoder.h:
 
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::windowProtoFuncOpen):
+2009-06-18  Kevin McCullough  <kmccullough@apple.com>
 
-2008-09-17  Sam Weinig  <sam@webkit.org>
+        Reviewed by Oliver Hunt.
 
-        Fix gtk build.
+        <rdar://problem/6940880> REGRESSION: Breakpoints don't break in 64-bit
 
-        * rendering/style/MatrixTransformOperation.cpp:
+        Convert intptr_t to Strings so that we don't loose bits in the
+        conversion to JS.  Previously they were being put into 32bit ints.
 
-2008-09-17  Sam Weinig  <sam@webkit.org>
+        * inspector/InspectorController.cpp: Convert the String back to an
+        intptr_t.
+        (WebCore::InspectorController::addBreakpoint):
+        (WebCore::InspectorController::removeBreakpoint):
+        * inspector/InspectorController.h:
+        * inspector/InspectorController.idl: Use strings in JS to avoid 32bit
+        truncation.
+        * inspector/InspectorFrontend.cpp: Make the intptr_t into a String.
+        (WebCore::InspectorFrontend::parsedScriptSource):
+        * platform/text/PlatformString.h: Implemented the necessary conversion
+        functions to be able to convert to and from an intptr_t.
+        * platform/text/String.cpp: Ditto.
+        (WebCore::String::toIntPtrStrict):
+        (WebCore::String::toIntPtr):
+        (WebCore::charactersToIntPtrStrict):
+        (WebCore::charactersToIntPtr):
+        * platform/text/StringImpl.cpp: Ditto.
+        (WebCore::StringImpl::toIntPtrStrict):
+        (WebCore::StringImpl::toIntPtr):
+        * platform/text/StringImpl.h: Ditto.
+
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
 
-        Rubber-stamped with love by David Hyatt.
+        Reviewed by Eric Seidel.
 
-        Split IdentityTransformOperation, MatrixTransformOperation, RotateTransformOperation, 
-        ScaleTransformOperation, SkewTransformOperation, StyleTransformData, TransformOperation,
-        TransformOperations and TranslateTransformOperation out of RenderStyle.h/cpp
+        Final cleanups in this refactoring:
+        (1) Move WindowsBitmap implementation from CG-specific file to
+            the platform-common GraphicsContextWin.cpp, since it is
+            equally useful on both platforms.
+        (2) Revise the TransformationMatrix logic as suggested by
+            Adam Roben in his review comments to Part #2 of this
+            refactoring.
 
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * css/CSSStyleSelector.cpp:
-        * page/animation/AnimationBase.cpp:
-        (WebCore::solveEpsilon):
-        * rendering/RenderLayer.cpp:
-        * rendering/style/IdentityTransformOperation.h: Copied from rendering/style/RenderStyle.h.
-        * rendering/style/MatrixTransformOperation.cpp: Copied from rendering/style/RenderStyle.cpp.
-        * rendering/style/MatrixTransformOperation.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::MatrixTransformOperation::MatrixTransformOperation):
-        * rendering/style/RenderStyle.cpp:
-        * rendering/style/RenderStyle.h:
-        * rendering/style/RotateTransformOperation.cpp: Copied from rendering/style/RenderStyle.cpp.
-        * rendering/style/RotateTransformOperation.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::RotateTransformOperation::RotateTransformOperation):
-        * rendering/style/ScaleTransformOperation.cpp: Copied from rendering/style/RenderStyle.cpp.
-        * rendering/style/ScaleTransformOperation.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::ScaleTransformOperation::ScaleTransformOperation):
-        * rendering/style/SkewTransformOperation.cpp: Copied from rendering/style/RenderStyle.cpp.
-        * rendering/style/SkewTransformOperation.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::SkewTransformOperation::SkewTransformOperation):
-        * rendering/style/StyleTransformData.cpp: Copied from rendering/style/RenderStyle.cpp.
-        * rendering/style/StyleTransformData.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::StyleTransformData::operator!=):
-        * rendering/style/TransformOperation.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::TransformOperation::):
-        * rendering/style/TransformOperations.cpp: Copied from rendering/style/RenderStyle.cpp.
-        (WebCore::TransformOperations::TransformOperations):
-        * rendering/style/TransformOperations.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::TransformOperations::operator!=):
-        * rendering/style/TranslateTransformOperation.cpp: Copied from rendering/style/RenderStyle.cpp.
-        * rendering/style/TranslateTransformOperation.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::TranslateTransformOperation::TranslateTransformOperation):
-
-2008-09-17  Mark Rowe  <mrowe@apple.com>
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::GraphicsContext::WindowsBitmap::WindowsBitmap):
+        (WebCore::GraphicsContext::WindowsBitmap::~WindowsBitmap):
+        (WebCore::GraphicsContext::createWindowsBitmap):
+        (WebCore::GraphicsContext::getWindowsContext):
+        (WebCore::GraphicsContextPlatformPrivate::scale):
+        (WebCore::GraphicsContextPlatformPrivate::rotate):
+        (WebCore::GraphicsContextPlatformPrivate::translate):
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
 
-        Build fix.
+2009-06-18  Peter Kasting  <pkasting@google.com>
 
-        * rendering/style/StyleDashboardRegion.h:  PlatformString.h rather than String.h.
+        Reviewed by Eric Seidel.
 
-2008-09-17  David Hyatt  <hyatt@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=26460 part one
+        Make isSizeAvailable non-const, since it's not logically const (it
+        triggers lazy decoding), and simplify all the implementations (without
+        changing behavior; just make less verbose).  Remove some other
+        inappropriate consts, which enables the removal of all the mutable
+        declarations in the decoders.
 
-        (1) Inline a bunch of methods for accessing frame geometry.
-        (2) Make sure frameGeometry() works even when you have no underlying
-        native widget.
-        (3) Cache a frame geometry rect cross-platform (even for widgets that
-        have underlying native widgets.
-        (4) PluginView's updateWindow call is now a virtual function on Widget.
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::isSizeAvailable):
+        (WebCore::ImageDecoder::setSize): Make public to avoid needing a friend declaration in the JPEG decoder, and because the ICO/BMP decoders will soon need this.
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::isSizeAvailable):
+        (WebCore::GIFImageDecoder::repetitionCount):
+        (WebCore::GIFImageDecoder::decode):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+        * platform/image-decoders/ico/ICOImageDecoder.cpp:
+        (WebCore::ICOImageDecoder::isSizeAvailable):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageDecoder::isSizeAvailable):
+        (WebCore::JPEGImageDecoder::decode):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::isSizeAvailable):
+        (WebCore::PNGImageDecoder::decode):
+        * platform/image-decoders/png/PNGImageDecoder.h:
+        * platform/image-decoders/xbm/XBMImageDecoder.cpp:
+        (WebCore::XBMImageDecoder::isSizeAvailable):
+        (WebCore::XBMImageDecoder::frameBufferAtIndex):
+        (WebCore::XBMImageDecoder::decode):
+        * platform/image-decoders/xbm/XBMImageDecoder.h: Rename decodeXBM() to decode() for consistency with the JPEG/PNG decoders, and in the future the ICO/BMP decoders.
 
-        Reviewed by Sam Weinig
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
 
-        * ChangeLog:
-        * WebCore.base.exp:
-        * platform/Widget.cpp:
-        (WebCore::Widget::setFrameGeometry):
-        * platform/Widget.h:
-        (WebCore::Widget::x):
-        (WebCore::Widget::y):
-        (WebCore::Widget::width):
-        (WebCore::Widget::height):
-        (WebCore::Widget::size):
-        (WebCore::Widget::pos):
-        (WebCore::Widget::frameGeometry):
-        (WebCore::Widget::resize):
-        (WebCore::Widget::move):
-        (WebCore::Widget::isFrameView):
-        (WebCore::Widget::windowClipRect):
-        * platform/mac/WidgetMac.mm:
-        (WebCore::Widget::~Widget):
-        (WebCore::Widget::updatePlatformWidgetFrameGeometry):
-        * platform/win/WidgetWin.cpp:
-        (WebCore::Widget::updatePlatformWidgetFrameGeometry):
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::setFrameGeometry):
-        (WebCore::PluginView::geometryChanged):
-        * plugins/PluginView.h:
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::updatePlatformWidgetFrameGeometry):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::updatePlatformWidgetFrameGeometry):
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::updatePlatformWidgetFrameGeometry):
-        * plugins/wx/PluginViewWx.cpp:
-
-2008-09-17  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by David "Waterman" Hyatt.
-
-        Fix a leak of NSViews in WidgetMac.mm.
-
-        * platform/mac/WidgetMac.mm:
-        (WebCore::Widget::~Widget):
-
-2008-09-17  Sam Weinig  <sam@webkit.org>
-
-        Rubber-stamped by David Waterman Hyatt.
-
-        Split FillLayer, StyleBackgroundData, StyleBoxData, StyleDashboardRegion, StyleMarqueeData
-        StyleMultiColData and StyleVisualData out of RenderStyle.h/cpp
+        Reviewed by Eric Seidel.
 
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * rendering/style/FillLayer.cpp: Copied from rendering/style/RenderStyle.cpp.
-        * rendering/style/FillLayer.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::FillLayer::operator!=):
-        (WebCore::FillLayer::hasImage):
-        (WebCore::FillLayer::hasFixedImage):
-        * rendering/style/RenderStyle.cpp:
-        * rendering/style/RenderStyle.h:
-        * rendering/style/StyleBackgroundData.cpp: Copied from rendering/style/RenderStyle.cpp.
-        (WebCore::StyleBackgroundData::StyleBackgroundData):
-        * rendering/style/StyleBackgroundData.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::StyleBackgroundData::~StyleBackgroundData):
-        (WebCore::StyleBackgroundData::operator!=):
-        * rendering/style/StyleBoxData.cpp: Copied from rendering/style/RenderStyle.cpp.
-        * rendering/style/StyleBoxData.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::StyleBoxData::operator!=):
-        * rendering/style/StyleDashboardRegion.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::StyleDashboardRegion::operator!=):
-        * rendering/style/StyleMarqueeData.cpp: Copied from rendering/style/RenderStyle.cpp.
-        * rendering/style/StyleMarqueeData.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::StyleMarqueeData::operator!=):
-        * rendering/style/StyleMultiColData.cpp: Copied from rendering/style/RenderStyle.cpp.
-        * rendering/style/StyleMultiColData.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::StyleMultiColData::operator!=):
-        (WebCore::StyleMultiColData::ruleWidth):
-        * rendering/style/StyleVisualData.cpp: Copied from rendering/style/RenderStyle.cpp.
-        * rendering/style/StyleVisualData.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::StyleVisualData::operator==):
-
-2008-09-17  David Hyatt  <hyatt@apple.com>
-
-        Remove WidgetClient from Widget.
+        Move some common functions out of platform files and into
+        the common implementation.
 
-        Reviewed by Sam Weinig
+        https://bugs.webkit.org/show_bug.cgi?id=26425.
+        Add a new platform context method (flush) so that the
+        getWindowsContext method can be consolidated into the common
+        GraphicsContextWin.cpp file.
+         
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+        (WebCore::GraphicsContextPlatformPrivate::flush):
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        (WebCore::GraphicsContextPlatformPrivate::flush):
+        * platform/graphics/win/GraphicsContextCGWin.cpp: Remove
+          getWindowContext method.
+        * platform/graphics/win/GraphicsContextCairoWin.cpp: Remove
+          getWindowContext method and fillWithClearColor methods.
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::fillWithClearColor): Moved from *CairoWin.cpp
+        (WebCore::GraphicsContext::getWindowsContext): Moved
+          from *CairoWin.cpp
+
+2009-06-18  Ojan Vafai  <ojan@chromium.org>
 
-        * WebCore.xcodeproj/project.pbxproj:
-        * platform/Widget.h:
-        (WebCore::Widget::setClient):
-        (WebCore::Widget::client):
-        * platform/WidgetClient.h: Removed.
-        * platform/gtk/WidgetGtk.cpp:
-        * platform/mac/WidgetMac.mm:
-        (WebCore::Widget::Widget):
-        (WebCore::Widget::show):
-        (WebCore::Widget::hide):
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::WidgetPrivate::WidgetPrivate):
-        * platform/win/WidgetWin.cpp:
-        (WebCore::Widget::Widget):
-        * platform/wx/WidgetWx.cpp:
-        (WebCore::Widget::Widget):
-
-2008-09-17  David Hyatt  <hyatt@apple.com>
-
-        Remove isEnabled/setEnabled from Widget.  The concept of being enabled now
-        only applies to Scrollbars so the method has been moved there and made
-        cross-platform.  Scrollbar subclasses that have a corresponding native
-        widget can subclass setEnabled to change the enabled state of the native
-        widget.
+        Reviewed by Oliver Hunt.
 
-        Reviewed by Sam Weinig & Darin Adler
+        Remove code that I accidentally committed in r44811.
 
-        * WebCore.base.exp:
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::Scrollbar):
-        * platform/Scrollbar.h:
-        (WebCore::Scrollbar::enabled):
-        (WebCore::Scrollbar::setEnabled):
-        * platform/Widget.h:
-        * platform/gtk/ScrollbarGtk.cpp:
-        (ScrollbarGtk::setEnabled):
-        * platform/gtk/ScrollbarGtk.h:
-        * platform/gtk/WidgetGtk.cpp:
-        * platform/mac/ScrollbarMac.h:
-        * platform/mac/ScrollbarMac.mm:
-        (WebCore::ScrollbarMac::scrollbarHit):
-        (WebCore::ScrollbarMac::setEnabled):
-        * platform/mac/WidgetMac.mm:
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::WidgetPrivate::WidgetPrivate):
-        * platform/win/WidgetWin.cpp:
-        (WebCore::Widget::Widget):
-        * platform/wx/WidgetWx.cpp:
-
-2008-09-17  Sam Weinig  <sam@webkit.org>
-
-        Rubber-stamped by David Hyatt.
-
-        Split all RenderStyle enums into their own file.
+        * editing/markup.cpp:
+        (WebCore::createMarkup):
 
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * rendering/style/BorderValue.h:
-        * rendering/style/CollapsedBorderValue.h:
-        * rendering/style/RenderStyle.h:
-        * rendering/style/RenderStyleConstants.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::):
-        * rendering/style/StyleCachedImage.h:
-        * rendering/style/StyleGeneratedImage.h:
-        * rendering/style/StyleImage.h:
+2009-06-18  Simon Fraser  <simon.fraser@apple.com>
 
-2008-09-17  Steve Falkenburg  <sfalken@apple.com>
+        Reviewed by Dan Bernstein.
 
-        Add back isFrameView check to fix failed assertion during scroll bar teardown.
+        <rdar://problem/6983207> Non-layer content is not re-rendered when transition
+        starts sometimes (with hardware acceleration).
         
-        Reviewed by Dave Hyatt.
-
-        * platform/Scrollbar.cpp:
-        (WebCore::Scrollbar::setParent):
-
-2008-09-17  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Mac build fix
-
-        * WebCore.xcodeproj/project.pbxproj: Send appropriate headers to WebKit
-
-2008-09-17  Steve Falkenburg  <sfalken@apple.com>
-
-        Fix build.
-
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::setParentVisible):
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::init):
-
-2008-09-17  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon.
-
-        [QtWebKit] Implement error handling in TextCodecQt::decode
-        Use the QTextCodec parsing state to set the sawError out variable. This
-        is needed to pass Test 70 of acid3. The test case for this bug is
-        fast/encoding/invalid-xml.html that is now partially passed. To pass
-        it completely the Qt text codecs need to be adjusted to have proper
-        error handling.
-
-        * platform/text/qt/TextCodecQt.cpp:
-        (WebCore::TextCodecQt::decode):
+        When deciding which RenderLayers should be composited, when a layer goes into
+        compositing mode we repaint the old location. However, we did that before
+        we'd looked at all the factors that may force a layer to composite, so missed
+        some cases. Fix by doing the repaint once we really know whether it's going
+        to composite.
 
-2008-09-17  Sam Weinig  <sam@webkit.org>
+        Test: compositing/repaint/become-overlay-composited-layer.html
 
-        Rubber-stamped by Dave Hyatt.
-
-        Split BorderData, BorderValue, CollapsedBorderValue, OutlineValue and StyleSurroundData
-        out of RenderStyle.h/cpp
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * rendering/style/BorderData.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::BorderData::hasBorderRadius):
-        (WebCore::BorderData::borderLeftWidth):
-        (WebCore::BorderData::borderRightWidth):
-        (WebCore::BorderData::borderTopWidth):
-        (WebCore::BorderData::borderBottomWidth):
-        (WebCore::BorderData::operator!=):
-        * rendering/style/BorderValue.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::):
-        (WebCore::BorderValue::BorderValue):
-        (WebCore::BorderValue::nonZero):
-        (WebCore::BorderValue::isTransparent):
-        (WebCore::BorderValue::isVisible):
-        * rendering/style/CollapsedBorderValue.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::):
-        (WebCore::CollapsedBorderValue::CollapsedBorderValue):
-        (WebCore::CollapsedBorderValue::operator==):
-        * rendering/style/OutlineValue.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::OutlineValue::OutlineValue):
-        * rendering/style/RenderStyle.cpp:
-        * rendering/style/RenderStyle.h:
-        * rendering/style/StyleSurroundData.cpp: Copied from rendering/style/RenderStyle.cpp.
-        * rendering/style/StyleSurroundData.h: Copied from rendering/style/RenderStyle.h.
-        (WebCore::StyleSurroundData::operator!=):
-
-2008-09-17  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Darin Adler.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
 
-        This is a better fix for: Invalid CSS code crashes Safari
-        https://bugs.webkit.org/show_bug.cgi?id=20512
+2009-06-18  Simon Fraser  <simon.fraser@apple.com>
 
-        The spec indicates that the only valid input for a counter is a 
-        number or an identifier. So that is exactly what we allow.
+        Fix the Leopard build where USE(ACCELERATED_COMPOSITING) is not defined, and
+        the Tiger build where QTMovieLayer does not exist.
 
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseCounterContent):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovieLayer):
+        (WebCore::MediaPlayerPrivate::destroyQTMovieLayer):
+        (WebCore::MediaPlayerPrivate::currentRenderingMode):
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
+        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
+        (WebCore::MediaPlayerPrivate::hasSetUpVideoRendering):
 
-2008-09-17  Alp Toker  <alp@nuanti.com>
+2009-06-18  Simon Fraser  <simon.fraser@apple.com>
 
-        GTK+ build fix. Adapt to use PlatformWidget functions.
+        Fix the Leopard build where USE(ACCELERATED_COMPOSITING) is not defined.
 
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollViewScrollbar::geometryChanged):
-        (WebCore::ScrollView::addChild):
-        (WebCore::ScrollView::removeChild):
-        * platform/gtk/ScrollbarGtk.cpp:
-        (ScrollbarGtk::ScrollbarGtk):
-        (ScrollbarGtk::~ScrollbarGtk):
-        (ScrollbarGtk::geometryChanged):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::currentRenderingMode):
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
+        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
 
-2008-09-17  Sam Weinig  <sam@webkit.org>
+2009-06-17  Erik Arvidsson  <arv@chromium.org>
 
         Reviewed by Adele Peterson.
 
-        Patch for <rdar://problem/6133884> 
-        Calling window.resizeTo() on a subframe shouldn't change the window size
-
-        Test: fast/dom/Window/window-resize-and-move-sub-frame.html
-
-        * page/DOMWindow.cpp:
-        (WebCore::DOMWindow::moveBy):
-        (WebCore::DOMWindow::moveTo):
-        (WebCore::DOMWindow::resizeBy):
-        (WebCore::DOMWindow::resizeTo):
-
-2008-09-17  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Adam Roben.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=20512 Invalid CSS 
-        code crashes Safari 
-        and corresponding: <rdar://problem/6173832>
-
-        Reading through the spec, it seems like a function is not valid 
-        input for a counter. So this patch checks for that and bails in the 
-        case of invalid input. 
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseCounterContent):
-
-2008-09-17  Greg Bolsinga  <bolsinga@apple.com>
-
-        Reviewed by Antti Koivisto.
-
-        Fix <rdar://problem/6227089> 
-        Crash in WebCore::Frame::setNeedsReapplyStyles()
+        https://bugs.webkit.org/show_bug.cgi?id=15189
+        Adds the HTML5 input event support for textarea.
         
-        View is null checked elsewhere too.
-
-        * page/Frame.cpp:
-        (WebCore::Frame::setNeedsReapplyStyles):
-
-2008-09-17  David Hyatt  <hyatt@apple.com>
-
-        Make the notion of having a native widget backing a Widget cross-platform.
-        The PlatformWidget abstraction (which already existed) is used for this.
-             Windows = HWND
-             Qt = QWidget
-             Mac = NSView
-             wx = wxWindow
-             Gtk = GtkWidget
-
-        There are new cross-platform methods that replace all of the unique
-        platform-specific methods.
-             platformWidget()
-             setPlatformWidget()
-
-        For plugins, on every platform except Qt on Windows, the plugin's native
-        widget is now stored in the Widget base class.  Since Qt on Windows uses
-        HWNDs for plugins instead of QWidget, it is the only platform to keep the
-        m_window variable in PluginView.
-
-        Reviewed by Sam Weinig
-
-        * WebCore.base.exp:
-        * bindings/js/ScriptControllerMac.mm:
-        (WebCore::ScriptController::createScriptInstanceForWidget):
-        * page/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper attachmentView]):
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::passMouseDownEventToWidget):
-        (WebCore::EventHandler::mouseDownViewIfStillGood):
-        (WebCore::EventHandler::passWheelEventToWidget):
-        (WebCore::EventHandler::sendFakeEventsAfterWidgetTracking):
-        * platform/Widget.cpp:
-        (WebCore::Widget::init):
-        (WebCore::Widget::setParent):
-        (WebCore::Widget::releasePlatformWidget):
-        (WebCore::Widget::retainPlatformWidget):
-        * platform/Widget.h:
-        (WebCore::Widget::platformWidget):
-        (WebCore::Widget::setPlatformWidget):
-        * platform/gtk/WidgetGtk.cpp:
-        (WebCore::Widget::Widget):
-        (WebCore::Widget::setFocus):
-        (WebCore::gdkDrawable):
-        (WebCore::Widget::setCursor):
-        (WebCore::Widget::show):
-        (WebCore::Widget::hide):
-        (WebCore::Widget::setEnabled):
-        (WebCore::Widget::isEnabled):
-        (WebCore::Widget::paint):
-        * platform/mac/PlatformScreenMac.mm:
-        (WebCore::screenRect):
-        (WebCore::screenAvailableRect):
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::scrollView):
-        (WebCore::ScrollView::update):
-        (WebCore::ScrollView::inWindow):
-        * platform/mac/ScrollbarMac.mm:
-        (WebCore::ScrollbarMac::ScrollbarMac):
-        (WebCore::ScrollbarMac::~ScrollbarMac):
-        (WebCore::ScrollbarMac::updateThumbPosition):
-        (WebCore::ScrollbarMac::updateThumbProportion):
-        (WebCore::ScrollbarMac::scrollbarHit):
-        * platform/mac/WidgetMac.mm:
-        (WebCore::Widget::Widget):
-        (WebCore::Widget::setEnabled):
-        (WebCore::Widget::isEnabled):
-        (WebCore::Widget::setFocus):
-        (WebCore::Widget::getOuterView):
-        (WebCore::Widget::paint):
-        (WebCore::Widget::invalidate):
-        (WebCore::Widget::invalidateRect):
-        (WebCore::Widget::setIsSelected):
-        (WebCore::Widget::releasePlatformWidget):
-        (WebCore::Widget::retainPlatformWidget):
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::WidgetPrivate::WidgetPrivate):
-        (WebCore::Widget::Widget):
-        (WebCore::Widget::setFrameGeometry):
-        (WebCore::Widget::show):
-        (WebCore::Widget::hide):
-        (WebCore::Widget::isEnabled):
-        (WebCore::Widget::setEnabled):
-        (WebCore::Widget::invalidateRect):
-        (WebCore::Widget::containingWindow):
-        * platform/win/WidgetWin.cpp:
-        (WebCore::Widget::Widget):
-        * platform/wx/WidgetWx.cpp:
-        (WebCore::Widget::Widget):
-        (WebCore::Widget::frameGeometry):
-        (WebCore::Widget::setFocus):
-        (WebCore::Widget::setCursor):
-        (WebCore::Widget::show):
-        (WebCore::Widget::hide):
-        (WebCore::Widget::setFrameGeometry):
-        (WebCore::Widget::setEnabled):
-        (WebCore::Widget::isEnabled):
-        (WebCore::Widget::invalidate):
-        (WebCore::Widget::invalidateRect):
-        (WebCore::Widget::paint):
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::PluginView):
-        * plugins/PluginView.h:
-        (WebCore::PluginView::platformPluginWidget):
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::updateWindow):
-        (WebCore::PluginView::setFocus):
-        (WebCore::PluginView::show):
-        (WebCore::PluginView::hide):
-        (WebCore::PluginView::setParent):
-        (WebCore::PluginView::setNPWindowRect):
-        (WebCore::PluginView::setParentVisible):
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::forceRedraw):
-        (WebCore::PluginView::init):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::updateWindow):
-        (WebCore::PluginView::setFocus):
-        (WebCore::PluginView::show):
-        (WebCore::PluginView::hide):
-        (WebCore::PluginView::setParent):
-        (WebCore::PluginView::setNPWindowRect):
-        (WebCore::PluginView::setParentVisible):
-        (WebCore::PluginView::getValue):
-        (WebCore::PluginView::~PluginView):
-        (WebCore::PluginView::init):
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::updateWindow):
-        (WebCore::PluginView::setFocus):
-        (WebCore::PluginView::show):
-        (WebCore::PluginView::hide):
-        (WebCore::PluginView::paint):
-        (WebCore::PluginView::setParent):
-        (WebCore::PluginView::setParentVisible):
-        (WebCore::PluginView::setNPWindowRect):
-        (WebCore::PluginView::stop):
-        (WebCore::PluginView::invalidateRect):
-        (WebCore::PluginView::forceRedraw):
-        (WebCore::PluginView::~PluginView):
-        (WebCore::PluginView::init):
-
-2008-09-17  Sam Weinig  <sam@webkit.org>
-
-        Fix assert.
-
-        * platform/Widget.cpp:
-        (WebCore::Widget::setParent):
-
-2008-09-17  David Hyatt  <hyatt@apple.com>
-
-        Beginnings of Widget refactoring (in order to make the mixing of
-        widgets with and without corresponding native widgets more cross-platform).
-
-        This first patch makes the concept of a parent ScrollView cross-platform.
-
-        Note the similarity of the show/hide methods on the three PluginViews.  This
-        will be refactored better in a later patch so that they can all share
-        a base class Widget show/hide method.  For now the changes were made
-        simply to be able to bring WidgetWin's setParent method up into Widget.
-
-        Reviewed by Sam Weinig
-
-        * WebCore.base.exp:
-        * platform/ScrollView.h:
-        * platform/Widget.cpp:
-        (WebCore::Widget::init):
-        (WebCore::Widget::setParent):
-        * platform/Widget.h:
-        (WebCore::Widget::isSelfVisible):
-        (WebCore::Widget::isParentVisible):
-        (WebCore::Widget::isVisible):
-        (WebCore::Widget::setParentVisible):
-        (WebCore::Widget::isPluginView):
-        (WebCore::Widget::parent):
-        (WebCore::Widget::handleEvent):
-        (WebCore::Widget::geometryChanged):
-        * platform/gtk/WidgetGtk.cpp:
-        (WebCore::Widget::Widget):
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::addChild):
-        (WebCore::ScrollView::removeChild):
-        * platform/mac/ScrollbarMac.mm:
-        (WebCore::ScrollbarMac::~ScrollbarMac):
-        * platform/mac/WidgetMac.mm:
-        (WebCore::Widget::Widget):
-        (WebCore::Widget::~Widget):
-        * platform/qt/WidgetQt.cpp:
-        (WebCore::WidgetPrivate::WidgetPrivate):
-        (WebCore::Widget::Widget):
-        (WebCore::Widget::topLevel):
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
-        (WebCore::ScrollView::setAncestorVisible):
-        (WebCore::ScrollView::show):
-        (WebCore::ScrollView::hide):
-        * platform/win/WidgetWin.cpp:
-        (WebCore::Widget::Widget):
-        (WebCore::Widget::setParent):
-        * platform/wx/WidgetWx.cpp:
-        (WebCore::Widget::Widget):
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::PluginView):
-        * plugins/PluginView.h:
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::show):
-        (WebCore::PluginView::hide):
-        (WebCore::PluginView::setParentVisible):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::show):
-        (WebCore::PluginView::hide):
-        (WebCore::PluginView::setParentVisible):
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::show):
-        (WebCore::PluginView::hide):
-        (WebCore::PluginView::setParentVisible):
-
-2008-09-17  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Adam Roben.
-
-        <rdar://problem/6219577> Spew in console at launch about encoding mappings when running with ICU 4.0
-
-        * platform/text/TextCodecICU.cpp:
-        (WebCore::TextCodecICU::registerExtendedEncodingNames): Updated for new encoding names.
-
-2008-09-17  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Fix the QtWebKit/Mac build
-
-        * platform/qt/ScrollViewQt.cpp: add include
-
-2008-09-17  David Hyatt  <hyatt@apple.com>
-
-        Add a #define to control whether or not to use an NSScroller on Mac.
-        This ifdef will allow the new NSView-less NSScroller on Mac to be
-        developed side by side with the current one.
-
-        The new scroller paints a debug red if turned on (although due to
-        Widget issues you won't see anything paint yet).
-
-        Reviewed by olliej
-
-        * platform/Scrollbar.cpp:
-        * platform/Scrollbar.h:
-        * platform/mac/ScrollbarMac.h:
-        * platform/mac/ScrollbarMac.mm:
-        * platform/mac/ScrollbarThemeMac.cpp:
-        (WebCore::ScrollbarThemeMac::paint):
-        * platform/mac/ScrollbarThemeMac.h:
-
-2008-09-16  Marco Barisione  <marco.barisione@collabora.co.uk>
-
-        Reviewed by Alp Toker.
-
-        http://bugs.webkit.org/show_bug.cgi?id=20854
-        [GTK] Windows can be not realized in ScrollView::update
-
-        Do not call gdk_window_invalidate_rect on a non-realized GtkWidget.
-
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::update):
-
-2008-09-16  Alp Toker  <alp@nuanti.com>
-
-        Suggested by Dave Hyatt.
-
-        Build fix and cleanup. Rename ScrollBar to Scrollbar.
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * editing/EditorCommand.cpp:
-        * page/EventHandler.cpp:
-        * page/gtk/EventHandlerGtk.cpp:
-        * page/mac/EventHandlerMac.mm:
-        * page/mac/FrameMac.mm:
-        * page/qt/EventHandlerQt.cpp:
-        * page/wx/EventHandlerWx.cpp:
-        * platform/PopupMenu.h:
-        * platform/ScrollBar.cpp: Removed.
-        * platform/ScrollBar.h: Removed.
-        * platform/Scrollbar.cpp: Copied from WebCore/platform/ScrollBar.cpp.
-        * platform/Scrollbar.h: Copied from WebCore/platform/ScrollBar.h.
-        * platform/gtk/ScrollbarGtk.cpp:
-        (ScrollbarGtk::ScrollbarGtk):
-        * platform/gtk/ScrollbarGtk.h:
-        * platform/mac/ScrollbarMac.h:
-        * platform/qt/ScrollViewQt.cpp:
-        * platform/qt/ScrollbarQt.cpp:
-        * platform/qt/ScrollbarThemeQt.cpp:
-        * platform/win/PlatformScrollBar.h:
-        * platform/win/PopupMenuWin.cpp:
-        * platform/win/ScrollViewWin.cpp:
-        * platform/win/ScrollbarThemeWin.cpp:
-        * platform/wx/ScrollViewWx.cpp:
-        * platform/wx/TemporaryLinkStubs.cpp:
-        * rendering/HitTestResult.cpp:
-        * rendering/RenderLayer.cpp:
-        * rendering/RenderTextControl.cpp:
+        Also, moves the oninput attribute parse handling to HTMLElement so that
+        it can be set on any HTML element so that bubbling events can be handled
+        using HTML attribute handlers.
 
-2008-09-16  David Hyatt  <hyatt@apple.com>
+        Test: fast/forms/textarea-input-event.html
 
-        Fix Qt build bustage by making moveThumb a member of Scrollbar so that
-        it can be called from ScrollbarQt.
-
-        * platform/ScrollBar.cpp:
-        (WebCore::Scrollbar::moveThumb):
-        (WebCore::Scrollbar::handleMouseMoveEvent):
-        (WebCore::Scrollbar::handleMousePressEvent):
-        * platform/ScrollBar.h:
-        * platform/qt/ScrollViewQt.cpp:
-        * platform/qt/ScrollbarQt.cpp:
-        (WebCore::Scrollbar::handleContextMenuEvent):
-
-2008-09-16  David Hyatt  <hyatt@apple.com>
-
-        Eliminate PlatformScrollbar.  Mac and Gtk now have subclasses for their
-        native-widget scrollbars (ScrollbarMac and ScrollbarGtk).  Other platforms
-        now just use Scrollbar.
-
-        Reviewed by Sam Weinig
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * page/mac/FrameMac.mm:
-        * platform/PopupMenu.h:
-        (WebCore::PopupMenu::scrollbar):
-        * platform/ScrollBar.cpp:
-        (WebCore::createNativeScrollbar):
-        * platform/ScrollBar.h:
-        * platform/gtk/PlatformScrollBar.h: Removed.
-        * platform/gtk/PlatformScrollBarGtk.cpp: Removed.
-        * platform/gtk/ScrollbarGtk.cpp: Copied from platform/gtk/PlatformScrollBarGtk.cpp.
-        (gtkScrollEventCallback):
-        (ScrollbarGtk::ScrollbarGtk):
-        (ScrollbarGtk::~ScrollbarGtk):
-        (ScrollbarGtk::updateThumbPosition):
-        (ScrollbarGtk::updateThumbProportion):
-        (ScrollbarGtk::setFrameGeometry):
-        (ScrollbarGtk::geometryChanged):
-        (ScrollbarGtk::gtkValueChanged):
-        * platform/gtk/ScrollbarGtk.h: Copied from platform/gtk/PlatformScrollBar.h.
-        * platform/mac/PlatformScrollBar.h: Removed.
-        * platform/mac/PlatformScrollBarMac.mm: Removed.
-        * platform/mac/ScrollbarMac.h: Copied from platform/mac/PlatformScrollBar.h.
-        * platform/mac/ScrollbarMac.mm: Copied from platform/mac/PlatformScrollBarMac.mm.
-        (-[WebCoreScrollBar initWithScrollbarMac:]):
-        (-[WebCoreScrollBar detachScrollbarMac]):
-        (WebCore::Scrollbar::createNativeScrollbar):
-        (WebCore::ScrollbarMac::ScrollbarMac):
-        (WebCore::ScrollbarMac::~ScrollbarMac):
-        (WebCore::ScrollbarMac::updateThumbPosition):
-        (WebCore::ScrollbarMac::updateThumbProportion):
-        (WebCore::ScrollbarMac::scrollbarHit):
-        * platform/qt/PlatformScrollBar.h: Removed.
-        * platform/qt/PlatformScrollBarQt.cpp: Removed.
-        * platform/qt/ScrollbarQt.cpp: Copied from platform/qt/PlatformScrollBarQt.cpp.
-        (WebCore::Scrollbar::handleContextMenuEvent):
-        * rendering/HitTestResult.cpp:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::createScrollbar):
-        (WebCore::RenderLayer::destroyScrollbar):
-        * rendering/RenderLayer.h:
-        * rendering/RenderListBox.cpp:
-        (WebCore::RenderListBox::~RenderListBox):
-        (WebCore::RenderListBox::updateFromElement):
-        (WebCore::RenderListBox::isPointInOverflowControl):
-        * rendering/RenderObject.h:
-        * rendering/RenderTextControl.cpp:
-
-2008-09-16  David Hyatt  <hyatt@apple.com>
-
-        Make the scrollbar resizer-dodging logic cross-platform in the
-        Scrollbar class.
-
-        Reviewed by Sam Weinig
-
-        * platform/ScrollBar.cpp:
-        (WebCore::Scrollbar::setFrameGeometry):
-        (WebCore::Scrollbar::setParent):
-        (WebCore::Scrollbar::windowClipRect):
-        * platform/ScrollBar.h:
-        * platform/ScrollView.h:
-        (WebCore::ScrollView::windowResizerRect):
-        (WebCore::ScrollView::resizerOverlapsContent):
-        (WebCore::ScrollView::adjustOverlappingScrollbarCount):
-        * platform/Widget.h:
-        (WebCore::Widget::setParent):
-        * platform/mac/WidgetMac.mm:
-        (WebCore::Widget::convertToContainingWindow):
-        * platform/win/PlatformScrollBar.h:
-        * platform/win/PlatformScrollBarWin.cpp:
-
-2008-09-16  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Darin Adler.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=15129
-          <rdar://problem/4644824> adding a new line with DOM does unnecessary additional repaint
-
-        Covered by fast/repaint/4776765.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::layoutBlock): Avoid repainting this object if it
-        did not have layout in the beginning.
-        (WebCore::RenderBlock::layoutBlockChildren): If a child did not have
-        layout in the beginning, repaint it in its new position, to compensate
-        for the above (regardless of whether it "moved").
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::checkForRepaintDuringLayout): Added a comment
-        about generalizing this fix in the future.
-
-2008-09-16  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=15384
-          Div does not notice when grandparent changes height
-
-        Test: fast/block/basic/quirk-percent-height-grandchild.html
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=20714
-          Resizing Gmail inbox vertically results in whitespace at the bottom of the window
-
-        Test: fast/replaced/percent-height-in-anonymous-block.html
-
-        Added a two-way mapping between boxes with percentage heights and
-        their non-parent ancestors up to the one the height is computed relative
-        to. In quirks mode (the first bug), this can be any number of containing
-        block with auto height. In strict mode (the second bug) this can be
-        the containing block of an anonymous block containing a replaced
-        element.
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::~RenderBlock): Added code to remove the all the
-        mapping to/from this block to percentage-height descendants.
-        (WebCore::RenderBlock::layoutBlockChildren): Added code to mark
-        percentage-height descendants (and their containing block ancestry chain
-        up to this block) for layout. This ensures that those descendants whose
-        height depends on the height of this block (or an ancestor) are updated.
-        (WebCore::RenderBlock::addPercentHeightDescendant): Added. Establishes
-        a two-way mapping between this block and the given box.
-        (WebCore::RenderBlock::removePercentHeightDescendant): Added. Removes
-        all the mapping to/from this box.
-        * rendering/RenderBlock.h:
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::setStyle): Added calls to
-        removePercentHeightDescendant() when style changes and the box
-        previously had a percentage height. An exception is when the style
-        change does not require layout, in which case the box still has
-        a percentage height and the mappings are valid. In all other cases,
-        any required mappings will be (re-)established during layout.
-        (WebCore::RenderBox::destroy): Added a call to
-        removePercentHeightDescendant.
-        (WebCore::RenderBox::calcPercentageHeight): Added code that, in quirks
-        mode, if a higher-than-parent containing block is affecting the box's
-        height, creates a mapping between the box and that block.
-        (WebCore::RenderBox::calcReplacedHeightUsing): Changed to skip over
-        anonymous containing blocks, if any, and when that happens, use
-        addPercentHeightDescendant() to ensure that the non-anonymous block
-        is aware of the dependent percent-height box.
-
-2008-09-16  Dirk Schulze  <vbs85@gmx.de>
-
-        Reviewed by Oliver Hunt and Alp Toker.
-
-        Implemented toDataURL in Cairo. Only PNG support
-        at the moment.
-
-        Qt, Cairo and wx require toDataURL implementations
-        https://bugs.webkit.org/show_bug.cgi?id=17719
-
-        * platform/MIMETypeRegistry.cpp:
-        (WebCore::initializeSupportedImageMIMETypesForEncoding):
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        (WebCore::ImageBuffer::ImageBuffer):
-        (WebCore::writeFunction):
-        (WebCore::ImageBuffer::toDataURL):
-
-2008-09-16  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon.
-
-        Hide unused media element controls in the QtWebKit port
-
-        * platform/qt/html4-adjustments-qt.css
-
-2008-09-16  Ariya Hidayat  <ariya.hidayat@trolltech.com>
-
-        Reviewed by Simon.
-
-        Fix compilation of the Qt scrollbar code.
-
-        * platform/qt/PlatformScrollBarQt.cpp:
-        (WebCore::scPart):
-        (WebCore::styleOptionSlider):
-        (WebCore::thumbLength):
-        (WebCore::pixelPosToRangeValue):
-        (WebCore::PlatformScrollbar::handleContextMenuEvent):
-
-2008-09-16  Adam Treat  <treat@kde.org>
-
-        Reviewed by Anders Carlsson.
-
-        Prevent accesses off of the end of the buffer introduced in r36450
-        and when checking for descriptions of mime. Also, coding style fix.
-
-        * plugins/qt/PluginPackageQt.cpp:
-        (WebCore::PluginPackage::fetchInfo):
-
-2008-09-15  Rob Buis  <buis@kde.org>
-
-        Reviewed by Eric.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20634
-        SVG transform attribute is ignored by <use> in <clipPath>
-
-        Transform the paths with the local transform when part
-        of a clip path.
-
-        Test: svg/custom/use-clipped-transform.svg
-
-        * svg/SVGClipPathElement.cpp:
-        (WebCore::SVGClipPathElement::canvasResource):
-        * svg/SVGStyledTransformableElement.cpp:
-        (WebCore::SVGStyledTransformableElement::toClipPath):
-        * svg/SVGStyledTransformableElement.h:
-
-2008-09-15  Dave Hyatt  <hyatt@apple.com>
-
-        Convert Qt over to its ScrollbarTheme.  Add cross-platform support for jumping the thumb location directly
-        to a pressed location on the track (this is done with the middle mouse on Qt and with Shift-Click on Windows).
-      
-        Reviewed by Sam Weinig
-
-        * platform/ScrollBar.cpp:
-        (WebCore::thumbUnderMouse):
-        (WebCore::Scrollbar::autoscrollPressedPart):
-        (WebCore::Scrollbar::startTimerIfNeeded):
-        (WebCore::moveThumb):
-        (WebCore::Scrollbar::handleMouseMoveEvent):
-        (WebCore::Scrollbar::handleMousePressEvent):
-        * platform/ScrollBar.h:
-        (WebCore::Scrollbar::pressedPos):
-        (WebCore::Scrollbar::pixelStep):
-        (WebCore::Scrollbar::setPressedPos):
-        * platform/ScrollbarTheme.h:
-        (WebCore::ScrollbarTheme::thumbPosition):
-        (WebCore::ScrollbarTheme::thumbLength):
-        (WebCore::ScrollbarTheme::trackPosition):
-        (WebCore::ScrollbarTheme::trackLength):
-        * platform/ScrollbarThemeComposite.cpp:
-        (WebCore::ScrollbarThemeComposite::trackPosition):
-        * platform/ScrollbarThemeComposite.h:
-        * platform/qt/PlatformScrollBarQt.cpp:
-        (WebCore::PlatformScrollbar::PlatformScrollbar):
-        (WebCore::):
-        * platform/qt/ScrollbarThemeQt.cpp:
-        (WebCore::styleOptionSlider):
-        (WebCore::ScrollbarThemeQt::hitTest):
-        (WebCore::ScrollbarThemeQt::shouldCenterOnThumb):
-        (WebCore::ScrollbarThemeQt::invalidatePart):
-        (WebCore::ScrollbarThemeQt::thumbPosition):
-        (WebCore::):
-        * platform/qt/ScrollbarThemeQt.h:
-        * platform/win/ScrollbarThemeSafari.cpp:
-        (WebCore::ScrollbarThemeSafari::shouldCenterOnThumb):
-        * platform/win/ScrollbarThemeSafari.h:
-        * platform/win/ScrollbarThemeWin.cpp:
-        (WebCore::ScrollbarThemeWin::shouldCenterOnThumb):
-        * platform/win/ScrollbarThemeWin.h:
-
-2008-09-15  David Smith  <catfish.man@gmail.com>
-
-        Reviewed by Sam Weinig.
-        
-        https://bugs.webkit.org/show_bug.cgi?id=20180
-        
-        Cache the result of parsing the an+b expression in :nth-child(an+b). Roughly a 2x speedup for :nth-child on SlickSpeed.
-
-        * GNUmakefile.am: Add CSSNthSelector
-        * WebCore.pro: Add CSSNthSelector
-        * WebCore.vcproj/WebCore.vcproj: Add CSSNthSelector
-        * WebCore.xcodeproj/project.pbxproj: Add CSSNthSelector
-        * css/CSSGrammar.y: Create CSSNthSelectors instead of CSSSelectors for :nth-*
-        * css/CSSNthSelector.cpp: Added.
-        (WebCore::CSSNthSelector::parseNth): Moved from CSSStyleSelector and modified to cache
-        (WebCore::CSSNthSelector::matchNth): Moved from CSSStyleSelector and modified to use the cache
-        * css/CSSNthSelector.h: Added.
-        (WebCore::CSSNthSelector::CSSNthSelector):
-        (WebCore::CSSNthSelector::~CSSNthSelector):
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::createFloatingNthSelector):
-        * css/CSSParser.h:
-        * css/CSSSelector.h: Use the free bit here to store a flag for CSSNthSelector
-        (WebCore::CSSSelector::CSSSelector):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): Take advantage of knowing that all :nth-* selectors are CSSNthSelectors
-
-2008-09-15  Matt Lilek  <webkit@mattlilek.com>
-
-        Reviewed by Tim Hatcher.
-
-        Clean up some inspector JS callbacks to remove an extra return.
-
-        * page/InspectorController.cpp:
-        (WebCore::hideDOMNodeHighlight):
-        (WebCore::loaded):
-        (WebCore::unloading):
-        (WebCore::attach):
-        (WebCore::detach):
-        (WebCore::startDebuggingAndReloadInspectedPage):
-        (WebCore::stopDebugging):
-        (WebCore::debuggerAttached):
-        (WebCore::pauseOnExceptions):
-        (WebCore::pauseInDebugger):
-        (WebCore::resumeDebugger):
-        (WebCore::stepOverStatementInDebugger):
-        (WebCore::stepIntoStatementInDebugger):
-        (WebCore::stepOutOfFunctionInDebugger):
-        (WebCore::isWindowVisible):
-        (WebCore::closeWindow):
-
-2008-09-15  Dave Hyatt  <hyatt@apple.com>
-
-        Completely switch Windows scrollbars over to ScrollbarTheme.  The Aqua windows scrollbar and native scrollbar
-        now share most of their code.
-       
-        Also removing mini size scrollbar support, since it would have crashed Windows had it ever been used, and it
-        also is never used in our code anyway.
-       
-        Reviewed by Sam Weinig
-
-        * WebCore.vcproj/WebCore.vcproj:
-        * platform/ScrollTypes.h:
-        (WebCore::):
-        * platform/ScrollbarThemeComposite.cpp:
-        (WebCore::ScrollbarThemeComposite::splitTrack):
-        (WebCore::ScrollbarThemeComposite::thumbLength):
-        (WebCore::ScrollbarThemeComposite::minimumThumbLength):
-        * platform/ScrollbarThemeComposite.h:
-        * platform/mac/PlatformScrollBarMac.mm:
-        (NSControlSizeForScrollBarControlSize):
-        * platform/win/PlatformScrollBar.h:
-        * platform/win/PlatformScrollBarSafari.cpp: Removed.
-        * platform/win/PlatformScrollBarWin.cpp:
-        (WebCore::PlatformScrollbar::PlatformScrollbar):
-        * platform/win/ScrollbarThemeSafari.cpp:
-        (WebCore::ScrollbarTheme::nativeTheme):
-        (WebCore::):
-        (WebCore::scrollbarControlStateFromThemeState):
-        (WebCore::ScrollbarThemeSafari::hasButtons):
-        (WebCore::ScrollbarThemeSafari::hasThumb):
-        (WebCore::buttonRepaintRect):
-        (WebCore::ScrollbarThemeSafari::backButtonRect):
-        (WebCore::ScrollbarThemeSafari::forwardButtonRect):
-        (WebCore::trackRepaintRect):
-        (WebCore::ScrollbarThemeSafari::trackRect):
-        (WebCore::ScrollbarThemeSafari::minimumThumbLength):
-        (WebCore::ScrollbarThemeSafari::paintTrack):
-        (WebCore::ScrollbarThemeSafari::paintButton):
-        (WebCore::ScrollbarThemeSafari::paintThumb):
-        * platform/win/ScrollbarThemeSafari.h:
-        * platform/win/ScrollbarThemeWin.cpp:
-        * platform/win/ScrollbarThemeWin.h:
-
-2008-09-15  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler, Beth Dakin
-
-        <rdar://problem/4003789> Expose lists as AXList
-        <rdar://problem/5707399> VO: Definition lists not announced in Safari
-
-        Lists are now exposed through AX. On the mac (in SnowLeopard) they use two new subroles
-        AXContentList for <ul>, <ol> and AXDefinitionList for <dl>
-        Inside the definition list, each <dt> "term" has an accessibility description ("term"), 
-        as does each <dd> tag ("definition")
-
-        Test: accessibility/lists.html
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * page/AXObjectCache.cpp:
-        * page/AccessibilityList.cpp: Added.
-        * page/AccessibilityList.h: Added.
-        * page/AccessibilityObject.h:
-        * page/AccessibilityRenderObject.cpp:
-        * page/AccessibilityTable.cpp:
-        * page/mac/AccessibilityObjectWrapper.mm:
-        * page/mac/WebCoreViewFactory.h:
-        * platform/LocalizedStrings.h:
-        * platform/mac/LocalizedStringsMac.mm:
-        * platform/qt/Localizations.cpp:
-
-2008-09-15  Nikolas Zimmermann  <zimmermann@kde.org>
-
-        Reviewed by Eric.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=20865
-        Prepare HTMLScriptElement & SVGScriptElement unification, and unification of event handling.
-
-        Several renames:
-        dispatchHTMLEvent -> dispatchEventForType
-        setHTMLEventListener -> setEventListenerForType
-        getHTMLEventListener -> eventListenerForType
-        removeHTMLEventListener -> removeEventListenerForType
-        isHTMLEventListener -> isAttachedToEventTargetNode
-        ...
-
-        Similar renames for the dispatch/get/set/*Window*Event functions.
-        Kill JSSVGLazyEventListener and merge with JSLazyEventListener.
-
-        Most important change: Rename setHTMLEventListener to setEventListenerForTypeAndAttribute,
-        as there exists a generic createEventListener() method now, taking care of JSLazyEventListener creation.
-
-        setHTMLEventListener() used createHTMLEventListener() before and was HTML specific.
-        SVG is able to use the code as well now. This affects most files in html/.
-
-        No functional changes.
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::~JSDOMWindowBase):
-        (WebCore::JSDOMWindowBase::setListener):
-        (WebCore::JSDOMWindowBase::getListener):
-        (WebCore::JSDOMWindowBase::findJSEventListener):
-        (WebCore::JSDOMWindowBase::findOrCreateJSEventListener):
-        (WebCore::JSDOMWindowBase::findJSUnprotectedEventListener):
-        (WebCore::JSDOMWindowBase::findOrCreateJSUnprotectedEventListener):
-        (WebCore::JSDOMWindowBase::jsEventListenersAttachedToEventTargetNodes):
-        (WebCore::JSDOMWindowBase::jsUnprotectedEventListenersAttachedToEventTargetNodes):
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSAbstractEventListener::handleEvent):
-        (WebCore::JSAbstractEventListener::isAttachedToEventTargetNode):
-        (WebCore::JSUnprotectedEventListener::JSUnprotectedEventListener):
-        (WebCore::JSUnprotectedEventListener::~JSUnprotectedEventListener):
-        (WebCore::JSEventListener::JSEventListener):
-        (WebCore::JSEventListener::~JSEventListener):
-        (WebCore::JSLazyEventListener::JSLazyEventListener):
-        (WebCore::eventParameterName):
-        (WebCore::JSLazyEventListener::parseCode):
-        (WebCore::getNodeEventListener):
-        * bindings/js/JSEventListener.h:
-        (WebCore::JSAbstractEventListener::JSAbstractEventListener):
-        (WebCore::JSUnprotectedEventListener::create):
-        (WebCore::JSEventListener::create):
-        (WebCore::JSLazyEventListener::):
-        (WebCore::JSLazyEventListener::create):
-        * bindings/js/JSEventTargetNode.cpp:
-        (WebCore::JSEventTargetNode::setListener):
-        (WebCore::JSEventTargetNode::getListener):
-        * bindings/js/JSSVGLazyEventListener.cpp: Removed.
-        * bindings/js/JSSVGLazyEventListener.h: Removed.
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::createHTMLEventHandler):
-        (WebCore::ScriptController::createSVGEventHandler):
-        * dom/Document.cpp:
-        (WebCore::Document::setFocusedNode):
-        (WebCore::Document::handleWindowEvent):
-        (WebCore::Document::setWindowEventListenerForType):
-        (WebCore::Document::windowEventListenerForType):
-        (WebCore::Document::removeWindowEventListenerForType):
-        (WebCore::Document::addWindowEventListener):
-        (WebCore::Document::hasWindowEventListener):
-        (WebCore::Document::removePendingFrameBeforeUnloadEventCount):
-        (WebCore::Document::createEventListener):
-        (WebCore::Document::setWindowEventListenerForTypeAndAttribute):
-        * dom/Document.h:
-        * dom/EventListener.h:
-        (WebCore::EventListener::isAttachedToEventTargetNode):
-        * dom/EventTargetNode.cpp:
-        (WebCore::EventTargetNode::dispatchFocusEvent):
-        (WebCore::EventTargetNode::dispatchBlurEvent):
-        (WebCore::EventTargetNode::dispatchEventForType):
-        (WebCore::EventTargetNode::removeEventListenerForType):
-        (WebCore::EventTargetNode::setEventListenerForType):
-        (WebCore::EventTargetNode::setEventListenerForTypeAndAttribute):
-        (WebCore::EventTargetNode::eventListenerForType):
-        * dom/EventTargetNode.h:
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::notifyFinished):
-        * editing/ReplaceSelectionCommand.cpp:
-        (WebCore::ReplacementFragment::ReplacementFragment):
-        * html/HTMLBodyElement.cpp:
-        (WebCore::HTMLBodyElement::parseMappedAttribute):
-        * html/HTMLButtonElement.cpp:
-        (WebCore::HTMLButtonElement::parseMappedAttribute):
         * html/HTMLElement.cpp:
         (WebCore::HTMLElement::parseMappedAttribute):
-        (WebCore::HTMLElement::checkDTD):
-        * html/HTMLElement.h:
-        * html/HTMLFormControlElement.cpp:
-        (WebCore::HTMLFormControlElement::onChange):
-        * html/HTMLFormElement.cpp:
-        (WebCore::HTMLFormElement::prepareSubmit):
-        (WebCore::HTMLFormElement::reset):
-        (WebCore::HTMLFormElement::parseMappedAttribute):
-        * html/HTMLFrameElementBase.cpp:
-        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
-        * html/HTMLFrameSetElement.cpp:
-        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
-        * html/HTMLImageElement.cpp:
-        (WebCore::HTMLImageElement::parseMappedAttribute):
-        * html/HTMLImageLoader.cpp:
-        (WebCore::HTMLImageLoader::dispatchLoadEvent):
         * html/HTMLInputElement.cpp:
         (WebCore::HTMLInputElement::parseMappedAttribute):
-        (WebCore::HTMLInputElement::setValueFromRenderer):
-        (WebCore::HTMLInputElement::onSearch):
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::asyncEventTimerFired):
-        (WebCore::HTMLMediaElement::load):
-        (WebCore::HTMLMediaElement::mediaPlayerNetworkStateChanged):
-        (WebCore::HTMLMediaElement::setReadyState):
-        (WebCore::HTMLMediaElement::seek):
-        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged):
-        (WebCore::HTMLMediaElement::willSaveToCache):
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::parseMappedAttribute):
-        * html/HTMLScriptElement.cpp:
-        (WebCore::HTMLScriptElement::parseMappedAttribute):
-        (WebCore::HTMLScriptElement::dispatchLoadEvent):
-        (WebCore::HTMLScriptElement::dispatchErrorEvent):
-        * html/HTMLSelectElement.cpp:
-        (WebCore::HTMLSelectElement::parseMappedAttribute):
-        * html/HTMLTextAreaElement.cpp:
-        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::notifyFinished):
-        * page/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::mouseButtonListener):
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::canMouseDownStartSelect):
-        (WebCore::EventHandler::canMouseDragExtendSelect):
-        * page/Frame.cpp:
-        (WebCore::Frame::sendScrollEvent):
-        * page/Page.cpp:
-        (WebCore::networkStateChanged):
-        * rendering/RenderListBox.cpp:
-        (WebCore::RenderListBox::valueChanged):
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::selectionChanged):
-        * svg/SVGDocumentExtensions.cpp:
-        * svg/SVGDocumentExtensions.h:
-        * svg/SVGElement.cpp:
-        (WebCore::SVGElement::parseMappedAttribute):
-        (WebCore::SVGElement::finishParsingChildren):
-        * svg/SVGElement.h:
-        * svg/SVGSVGElement.cpp:
-        (WebCore::SVGSVGElement::parseMappedAttribute):
-        * svg/SVGSVGElement.h:
-
-2008-09-15  Dave Hyatt  <hyatt@apple.com>
-
-        Convert PlatformScrollbarWin to use ScrollbarTheme for hit testing.  PlatformScrollbarQt/Gtk still
-        need to be converted.
-        
-        Reviewed by Sam Weinig
-
-        * platform/ScrollBar.cpp:
-        (WebCore::Scrollbar::Scrollbar):
-        (WebCore::Scrollbar::updateThumbPosition):
-        (WebCore::Scrollbar::updateThumbProportion):
-        (WebCore::Scrollbar::autoscrollPressedPart):
-        (WebCore::Scrollbar::startTimerIfNeeded):
-        * platform/ScrollBar.h:
-        * platform/ScrollbarTheme.h:
-        (WebCore::ScrollbarTheme::invalidateParts):
-        * platform/ScrollbarThemeComposite.cpp:
-        (WebCore::ScrollbarThemeComposite::hitTest):
-        (WebCore::ScrollbarThemeComposite::invalidatePart):
-        (WebCore::ScrollbarThemeComposite::thumbPosition):
-        (WebCore::ScrollbarThemeComposite::thumbLength):
-        (WebCore::ScrollbarThemeComposite::trackLength):
-        * platform/ScrollbarThemeComposite.h:
-        * platform/win/PlatformScrollBarSafari.cpp:
-        (WebCore::PlatformScrollbar::PlatformScrollbar):
-        * platform/win/PlatformScrollBarWin.cpp:
-        (WebCore::PlatformScrollbar::PlatformScrollbar):
-
-2008-09-15  David Smith  <catfish.man@gmail.com>
-
-        "Just do it"'d by Mark Rowe
-
-        https://bugs.webkit.org/show_bug.cgi?id=20856
-        Add missing license header
-
-        * dom/NodeRenderStyle.h:
-
-2008-09-15  Dean Jackson  <dino@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        Add default constructor for ShadowData
-        https://bugs.webkit.org/show_bug.cgi?id=20757
-
-        Test: transitions/shadow.html
-
-        * rendering/style/RenderStyle.h:
-
-2008-09-15  Dean Jackson  <dino@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        RenderStyle should update keyframes.
-        http://bugs.webkit.org/show_bug.cgi?id=20756
-
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::StyleRareNonInheritedData::updateKeyframes):
-
-2008-09-15  Dean Jackson  <dino@apple.com>
-
-        Reviewed by Tim Hatcher.
-
-        Unnecessary ASSERT in ImplicitAnimation destructor.
-        https://bugs.webkit.org/show_bug.cgi?id=20817
-
-        * page/animation/ImplicitAnimation.cpp:
-        (WebCore::ImplicitAnimation::~ImplicitAnimation):
-
-2008-09-15  Adam Treat  <treat@kde.org>
-
-        Reviewed by Simon.
-
-        Fix plugin extension info. It was returning the mimetype where the
-        extension was given.
-
-        * plugins/qt/PluginPackageQt.cpp:
-        (WebCore::PluginPackage::fetchInfo):
-
-2008-09-15  Dean Jackson  <dino@apple.com>
-
-        Reviewed by Tim Hatcher
-
-        Coding style violation!!!! Cleanup AnimationBase.cpp
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::blendFunc):
-
-2008-09-15  David Hyatt  <hyatt@apple.com>
-
-        Move all hit testing code for scrollbars into the base class.  Refactor
-        it to accommodate all platform-specific behaviors using virtual ScrollbarTheme
-        functions.
-
-        No platform is using this code yet.  Although it has been moved and compiles
-        (even on Mac), it is not being used on any platform.
-
-        Reviewed by Sam Weinig
-
-        * platform/ScrollBar.cpp:
-        (WebCore::Scrollbar::autoscrollPressedPart):
-        (WebCore::Scrollbar::startTimerIfNeeded):
-        (WebCore::Scrollbar::handleMouseMoveEvent):
-        (WebCore::Scrollbar::handleMouseOutEvent):
-        (WebCore::Scrollbar::handleMouseReleaseEvent):
-        (WebCore::Scrollbar::handleMousePressEvent):
-        * platform/ScrollBar.h:
-        (WebCore::Scrollbar::handleContextMenuEvent):
-        * platform/ScrollbarTheme.h:
-        (WebCore::ScrollbarTheme::hitTest):
-        (WebCore::ScrollbarTheme::invalidateOnMouseEnterExit):
-        (WebCore::ScrollbarTheme::invalidatePart):
-        (WebCore::ScrollbarTheme::shouldCenterOnThumb):
-        (WebCore::ScrollbarTheme::centerOnThumb):
-        (WebCore::ScrollbarTheme::thumbPosition):
-        (WebCore::ScrollbarTheme::thumbLength):
-        (WebCore::ScrollbarTheme::trackLength):
-        (WebCore::ScrollbarTheme::initialAutoscrollTimerDelay):
-        (WebCore::ScrollbarTheme::autoscrollTimerDelay):
-        * platform/Widget.h:
-        (WebCore::Widget::parent):
-        * platform/mac/PlatformScrollBar.h:
-        (WebCore::PlatformScrollbar::handleMouseMoveEvent):
-        (WebCore::PlatformScrollbar::handleMouseOutEvent):
-        (WebCore::PlatformScrollbar::handleMousePressEvent):
-        (WebCore::PlatformScrollbar::handleMouseReleaseEvent):
-        * platform/mac/WidgetMac.mm:
-        (WebCore::Widget::convertFromContainingWindow):
-        * platform/win/ScrollbarThemeWin.cpp:
-        (WebCore::ScrollbarThemeWin::invalidateOnMouseEnterExit):
-        * platform/win/ScrollbarThemeWin.h:
-
-2008-09-15  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - fix <rdar://problem/5842247> Single long breakable word takes O(n^2) to lay out
-
-        Cache the next breakable position for text nodes in InlineIterator.
-
-        * rendering/bidi.cpp:
-        (WebCore::InlineIterator::InlineIterator):
-        (WebCore::InlineIterator::increment):
-        (WebCore::RenderBlock::findNextLineBreak):
-
-2008-09-15  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dan Bernstein
-
-        Fix assertion and integral pixel issue when creating subimages.
-        https://bugs.webkit.org/show_bug.cgi?id=20786
-
-        * platform/graphics/cg/ImageCG.cpp:
-        (WebCore::BitmapImage::draw):
-
-2008-09-15  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon.
-
-        Implment seek() and clean up and improve debugging output
-
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (debugMediaObject):
-        (WebCore::MediaPlayerPrivate::seek):
-        (WebCore::MediaPlayerPrivate::setVolume):
-        (WebCore::MediaPlayerPrivate::setMuted):
-        (WebCore::MediaPlayerPrivate::updateStates):
-        (WebCore::MediaPlayerPrivate::naturalSize):
-        (WebCore::MediaPlayerPrivate::paint):
-        (WebCore::MediaPlayerPrivate::stateChanged):
-        (WebCore::MediaPlayerPrivate::tick):
-
-2008-09-15  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon.
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
 
-        Remove bogus Q_ASSERTs from the MediaPlayer Phonon implementation
+2009-06-18  Dirk Schulze  <krit@webkit.org>
 
-        m_mediaObject, m_audioOutput, m_videoWidget get created in the
-        c'tor and will only be deleted in the c'tor. The Q_ASSERTs would
-        only check if we use the MediaPlayerPrivate after it has been deleted.
+        Reviewed by Oliver Hunt.
 
-        Acked-by: Tor Arne Vestbø  <tavestbo@trolltech.com>
+        Share code between filterEffects
+        [https://bugs.webkit.org/show_bug.cgi?id=26479]
 
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::play):
-        (WebCore::MediaPlayerPrivate::setVolume):
-        (WebCore::MediaPlayerPrivate::updateStates):
+        Share more code of filter effects. The imageBuffer creation can move to
+        FilterEffect ant every effect asks for the GraphicsContext. Move the
+        drawingRect calculation to FilterEffect.
 
-2008-09-15  Anders Carlsson  <andersca@apple.com>
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::calculateDrawingRect):
+        (WebCore::FilterEffect::getEffectContext):
+        * platform/graphics/filters/FilterEffect.h:
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::apply):
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::apply):
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
 
-        Reviewed by Maciej.
+2009-06-18  Simon Fraser  <simon.fraser@apple.com>
 
-        <rdar://problem/6163988> 
-        https://bugs.webkit.org/show_bug.cgi?id=20457
-        Canvas: createPattern crashes WebKit in WTF::RefPtr<WebCore::Image>::operator!() const + 9 with a 1D pattern
+        Reviewed by Dave Hyatt.
         
-        Check the width and height and throw an exception if any of them are 0.
+        https://bugs.webkit.org/show_bug.cgi?id=26499
         
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::createPattern):
-
-2008-09-15  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon.
-
-        Render media element controls with antialiasing enabled
-
-        * platform/qt/RenderThemeQt.cpp:
-        (WebCore::RenderThemeQt::paintMediaMuteButton):
-        (WebCore::RenderThemeQt::paintMediaPlayButton):
-        (WebCore::RenderThemeQt::paintMediaSliderTrack):
-        (WebCore::RenderThemeQt::paintMediaSliderThumb):
-
-2008-09-15  Ariya Hidayat  <ariya.hidayat@trolltech.com>
-
-        Reviewed by Simon.
-
-        Upon non fatal error, switch to the pause state (so that playback can continue)
-
-        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
-        (WebCore::MediaPlayerPrivate::updateStates):
-
-2008-09-15  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon.
-
-        Don't set WTF_USE_JSC in WebCore.pro now that it's set in config.h
-
-        * WebCore.pro:
-
-2008-09-15  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon.
-
-        Make QtInstance::create() private and fix caching
-
-        * bindings/js/ScriptControllerQt.cpp:
-        (WebCore::ScriptController::createScriptInstanceForWidget):
-        * bridge/qt/qt_instance.cpp:
-        (JSC::Bindings::QtInstance::getQtInstance):
-        (JSC::Bindings::QtInstance::getRuntimeObject):
-        * bridge/qt/qt_instance.h:
-        (JSC::Bindings::QtInstance::create):
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::convertQVariantToValue):
-        (JSC::Bindings::QtConnectionObject::execute):
-
-2008-09-15  David Smith  <catfish.man@gmail.com>
+        Support hardware-accelerationed rendering of video elements.
 
-        Reviewed by Dave Hyatt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20180
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerSawUnsupportedTracks):
+        (WebCore::HTMLMediaElement::mediaPlayerRepaint):
+        Just move these methods to group the render-related methods together.
         
-        >2x speedup on querySelector[All] with :nth-child by removing the collectRulesOnly argument on SelectorChecker.
-        With collectRulesOnly set to true (the default) an optimization is turned off, and no callers were intentionally leaving it true.
-        querySelector[All] assumed that the default was probably the right way to go, and so ended up being slow.
+        (WebCore::HTMLMediaElement::mediaPlayerRenderingCanBeAccelerated):
+        Call out method to ask the RenderLayerCompositor if presentation of this video
+        can be acclerated. It might say no, if, for example, the video has a reflection.
         
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::CSSStyleSelector):
-        (WebCore::CSSStyleSelector::SelectorChecker::SelectorChecker):
-        * css/CSSStyleSelector.h:
-
-2008-09-14  Dave Hyatt  <hyatt@apple.com>
-
-        Refactor PlatformScrollbarWin's painting so that it is now done by ScrollbarThemeWin.  PlatformScrollbarSafari
-        is still painting itself (a subsequent patch will move its painting into ScrollbarThemeSafari).
-       
-        Reviewed by Sam Weinig
-
-        * platform/ScrollBar.h:
-        (WebCore::Scrollbar::client):
-        (WebCore::Scrollbar::currentPos):
-        (WebCore::Scrollbar::totalSize):
-        * platform/ScrollbarTheme.h:
-        * platform/ScrollbarThemeComposite.cpp:
-        (WebCore::pageForScrollView):
-        (WebCore::ScrollbarThemeComposite::paint):
-        * platform/ScrollbarThemeComposite.h:
-        (WebCore::ScrollbarThemeComposite::trackIsSinglePiece):
-        * platform/win/PlatformScrollBar.h:
-        * platform/win/PlatformScrollBarSafari.cpp:
-        * platform/win/PlatformScrollBarWin.cpp:
-        * platform/win/ScrollbarThemeSafari.h:
-        (WebCore::ScrollbarThemeSafari::hasButtons):
-        (WebCore::ScrollbarThemeSafari::hasThumb):
-        (WebCore::ScrollbarThemeSafari::backButtonRect):
-        (WebCore::ScrollbarThemeSafari::forwardButtonRect):
-        (WebCore::ScrollbarThemeSafari::trackRect):
-        (WebCore::ScrollbarThemeSafari::splitTrack):
-        (WebCore::ScrollbarThemeSafari::paintTrack):
-        (WebCore::ScrollbarThemeSafari::paintButton):
-        (WebCore::ScrollbarThemeSafari::paintThumb):
-        * platform/win/ScrollbarThemeWin.cpp:
-        (WebCore::isRunningOnVistaOrLater):
-        (WebCore::checkAndInitScrollbarTheme):
-        (WebCore::ScrollbarThemeWin::ScrollbarThemeWin):
-        (WebCore::ScrollbarThemeWin::themeChanged):
-        (WebCore::ScrollbarThemeWin::hasThumb):
-        (WebCore::ScrollbarThemeWin::backButtonRect):
-        (WebCore::ScrollbarThemeWin::forwardButtonRect):
-        (WebCore::ScrollbarThemeWin::trackRect):
-        (WebCore::ScrollbarThemeWin::splitTrack):
-        (WebCore::ScrollbarThemeWin::paintTrack):
-        (WebCore::ScrollbarThemeWin::paintButton):
-        (WebCore::gripperRect):
-        (WebCore::paintGripper):
-        (WebCore::ScrollbarThemeWin::paintThumb):
-        (WebCore::ScrollbarThemeWin::thumbPosition):
-        (WebCore::ScrollbarThemeWin::thumbLength):
-        (WebCore::ScrollbarThemeWin::trackLength):
-        * platform/win/ScrollbarThemeWin.h:
-        (WebCore::ScrollbarThemeWin::hasButtons):
-        (WebCore::ScrollbarThemeWin::trackIsSinglePiece):
-
-2008-09-14  Anthony Ricaud  <rik24d@gmail.com>
-
-        Moving all resource graphs under the same container for future scalable feature.
-        This is a speedup on resize but maybe a loss on changing the sorting function.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20555
-
-        Reviewed by Timothy Hatcher.
-
-        * page/inspector/ResourcesPanel.js: Added a container for all resource graphs.
-        Added WebInspector.ResourceGraph. No more _updateGraphBars on resize.
-        * page/inspector/inspector.css: Edited corresponding rules and removed unnecessaries.
-
-2008-09-14  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Maciej Stachowiak.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20738
-        compareBoundaryPoints gives incorrect results
-
-        Test: fast/dom/Range/compareBoundaryPoints-2.html
-
-        * dom/Range.cpp: (WebCore::Range::compareBoundaryPoints): Correct meanings of START_TO_END
-        and END_TO_START.
-        * page/DOMSelection.cpp: (WebCore::DOMSelection::addRange): Updated for this change.
-
-2008-09-14  Maciej Stachowiak  <mjs@apple.com>
-
-        Unreviewed build fix.
-
-        Trying again.
-
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::hasInstance):
-
-2008-09-14  Maciej Stachowiak  <mjs@apple.com>
-
-        Unreviewed build fix.
-
-        Blind attempt to fix build. Correct parameters for hasInstance.
-
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::hasInstance):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-
-2008-09-14  Dan Bernstein  <mitz@apple.com>
-
-        Rubber-stamped by Sam Weinig.
-
-        - revert <http://trac.webkit.org/changeset/36382> because it exposed
-          <https://bugs.webkit.org/show_bug.cgi?id=20846> and resulted in crashes
-          on Tiger.
-
-        * platform/graphics/mac/FontCacheMac.mm:
-        (WebCore::FontCache::getFontDataForCharacters):
-        (WebCore::FontCache::getLastResortFallbackFont):
-
-2008-09-14  Dave Hyatt  <hyatt@apple.com>
-
-        Add a new ScrollbarThemeComposite base class that is shared by ScrollbarThemeSafari and
-        ScrollbarThemeWin.  Any scrollbar that wants to render by ScrollbarPart can subclass from this
-        theme.
+        (WebCore::HTMLMediaElement::mediaPlayerGraphicsLayer):
+        Fetch the GraphicsLayer from the RenderVideo that will host the movie layer.
         
-        Reviewed by Sam Weinig
-
-        * WebCore.vcproj/WebCore.vcproj:
-        * platform/win/ScrollbarThemeSafari.h:
-        * platform/win/ScrollbarThemeWin.h:
-
-2008-09-14  Alp Toker  <alp@nuanti.com>
-
-        https://bugs.webkit.org/show_bug.cgi?id=20320
-        [GTK] A white rectangle is visible behind widgets with rounded corners
-
-        Sync bundled gtk2drawing.c to the latest version from Mozilla (coding
-        style exempt).
-
-        Requested by Michael Monreal.
-
-        * platform/gtk/RenderThemeGtk.cpp:
-        (WebCore::RenderThemeGtk::RenderThemeGtk):
-        * platform/gtk/gtk2drawing.c:
-        (moz_gtk_set_widget_name):
-        (ensure_window_widget):
-        (setup_widget_prototype):
-        (ensure_button_arrow_widget):
-        (moz_gtk_get_combo_box_inner_button):
-        (moz_gtk_get_combo_box_button_inner_widgets):
-        (ensure_combo_box_widgets):
-        (moz_gtk_get_combo_box_entry_inner_widgets):
-        (moz_gtk_get_combo_box_entry_arrow):
-        (ensure_combo_box_entry_widgets):
-        (ensure_toolbar_widget):
-        (ensure_tooltip_widget):
-        (ensure_menu_bar_widget):
-        (ensure_menu_bar_item_widget):
-        (ensure_menu_popup_widget):
-        (ensure_menu_item_widget):
-        (ensure_image_menu_item_widget):
-        (ensure_menu_separator_widget):
-        (ensure_check_menu_item_widget):
-        (ensure_tree_header_cell_widget):
-        (ensure_scrolled_window_widget):
-        (moz_gtk_button_paint):
-        (moz_gtk_init):
-        (moz_gtk_button_get_inner_border):
-        (moz_gtk_toggle_paint):
-        (calculate_button_inner_rect):
-        (calculate_arrow_rect):
-        (moz_gtk_scrollbar_button_paint):
-        (moz_gtk_scrollbar_thumb_paint):
-        (moz_gtk_caret_paint):
-        (moz_gtk_entry_paint):
-        (moz_gtk_treeview_paint):
-        (moz_gtk_tree_header_cell_paint):
-        (moz_gtk_combo_box_paint):
-        (moz_gtk_downarrow_paint):
-        (moz_gtk_combo_box_entry_button_paint):
-        (moz_gtk_toolbar_paint):
-        (moz_gtk_tab_scroll_arrow_paint):
-        (moz_gtk_menu_bar_paint):
-        (moz_gtk_menu_item_paint):
-        (moz_gtk_get_widget_border):
-        (moz_gtk_get_combo_box_entry_button_size):
-        (moz_gtk_get_tab_scroll_arrow_size):
-        (moz_gtk_get_downarrow_size):
-        (moz_gtk_images_in_menus):
-        (moz_gtk_widget_paint):
-        (moz_gtk_shutdown):
-        * platform/gtk/gtkdrawing.h:
-
-2008-09-14  David Hyatt  <hyatt@apple.com>
-
-        Convert Mac, Gtk, wx and Qt over to the new ScrollbarTheme for
-        painting.  Mac and Gtk themes don't do anything and just let the
-        underlying widget paint.  Qt now uses the theme to paint.  wx doesn't
-        do anything yet.
-
-        Reviewed by Sam Weinig
-
-        * platform/ScrollBar.cpp:
-        (WebCore::Scrollbar::paint):
-        * platform/ScrollBar.h:
-        (WebCore::Scrollbar::value):
-        (WebCore::Scrollbar::visibleSize):
-        (WebCore::Scrollbar::maximum):
-        (WebCore::Scrollbar::lineStep):
-        (WebCore::Scrollbar::pageStep):
-        (WebCore::Scrollbar::pixelStep):
-        (WebCore::Scrollbar::pressedPart):
-        (WebCore::Scrollbar::hoveredPart):
-        (WebCore::Scrollbar::theme):
-        * platform/ScrollbarTheme.h:
-        (WebCore::ScrollbarTheme::paint):
-        (WebCore::ScrollbarTheme::scrollbarThickness):
-        (WebCore::ScrollbarTheme::supportsControlTints):
-        (WebCore::ScrollbarTheme::themeChanged):
-        * platform/gtk/PlatformScrollBar.h:
-        * platform/gtk/PlatformScrollBarGtk.cpp:
-        * platform/mac/PlatformScrollBar.h:
-        * platform/mac/PlatformScrollBarMac.mm:
-        * platform/qt/PlatformScrollBar.h:
-        * platform/qt/PlatformScrollBarQt.cpp:
-        * platform/qt/ScrollbarThemeQt.cpp:
-        (WebCore::styleOptionSlider):
-        * platform/qt/ScrollbarThemeQt.h:
-        (WebCore::ScrollbarThemeQt::paint):
-        * platform/win/PlatformScrollBarSafari.cpp:
-        (WebCore::PlatformScrollbar::paint):
-        * platform/win/ScrollbarThemeSafari.h:
-        (WebCore::ScrollbarThemeSafari::supportsControlTints):
-        * platform/wx/PlatformScrollBar.h:
-        * platform/wx/TemporaryLinkStubs.cpp:
-        (PlatformScrollbar::~PlatformScrollbar):
-
-2008-09-14  Sam Weinig  <sam@webkit.org>
-
-        Qt build fix.
-
-        * platform/qt/PlatformScrollBarQt.cpp:
-
-2008-09-14  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Remove extraneous semicolons.
-
-        * bindings/scripts/CodeGeneratorObjC.pm:
-        * html/HTMLLinkElement.cpp:
-        (WebCore::HTMLLinkElement::tokenizeRelAttribute):
-        * html/HTMLScriptElement.cpp:
-        (WebCore::HTMLScriptElement::charsetAttributeValue):
-        (WebCore::HTMLScriptElement::typeAttributeValue):
-        * platform/graphics/qt/GradientQt.cpp:
-        (WebCore::Gradient::platformGradient):
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::setHasHorizontalScrollbar):
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::updateScrollbars):
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::paintEllipsisBoxes):
-        * svg/SVGPathSegList.cpp:
-        (WebCore::SVGPathSegList::toPathData):
-
-2008-09-14  Sam Weinig  <sam@webkit.org>
-
-        Qt build fix.
-
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::updateScrollbars):
-
-2008-09-14  Sam Weinig  <sam@webkit.org>
-
-        Qt build fix.
-
-        * platform/qt/PlatformScrollBarQt.cpp:
-        (WebCore::PlatformScrollbar::PlatformScrollbar):
-        (WebCore::PlatformScrollbar::paint):
-
-2008-09-13  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Gtk build fix, not reviewed.
-
-        * platform/gtk/PlatformScrollBarGtk.cpp:
-        (PlatformScrollbar::PlatformScrollbar):
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::updateScrollbars):
-
-2008-09-13  Dave Hyatt  <hyatt@apple.com>
-
-        Remove scrollbar's setRect method.  Clients can now just call setFrameGeometry (the corresponding Widget) method
-        to set the dimensions of a scrollbar.
+        * html/HTMLMediaElement.h:
+        Reordered the rendering-related methods, and added two methods related to video
+        acceleration.
         
-        Reviewed by Sam Weinig
-
-        * platform/ScrollBar.h:
-        * platform/gtk/PlatformScrollBar.h:
-        * platform/gtk/PlatformScrollBarGtk.cpp:
-        (PlatformScrollbar::setFrameGeometry):
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::updateScrollbars):
-        * platform/mac/PlatformScrollBarMac.mm:
-        * platform/qt/PlatformScrollBarQt.cpp:
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::updateScrollbars):
-        * platform/win/PlatformScrollBar.h:
-        * platform/win/PlatformScrollBarSafari.cpp:
-        (WebCore::PlatformScrollbar::PlatformScrollbar):
-        (WebCore::PlatformScrollbar::setFrameGeometry):
-        * platform/win/PlatformScrollBarWin.cpp:
-        (WebCore::PlatformScrollbar::PlatformScrollbar):
-        (WebCore::PlatformScrollbar::setFrameGeometry):
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupWndProc):
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::updateScrollbars):
-        * platform/wx/PlatformScrollBar.h:
-        * platform/wx/TemporaryLinkStubs.cpp:
-        (PlatformScrollbar::updateThumbProportion):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::positionOverflowControls):
-        * rendering/RenderListBox.cpp:
-        (WebCore::RenderListBox::paintScrollbar):
-
-2008-09-13  Dave Hyatt  <hyatt@apple.com>
-
-        Remove setEnabled() from all Scrollbar classes that were just using their Widget base class methods.
-       
-        Reviewed by Sam Weinig
-
-        * platform/ScrollBar.h:
-        * platform/gtk/PlatformScrollBar.h:
-        * platform/gtk/PlatformScrollBarGtk.cpp:
-        * platform/mac/PlatformScrollBar.h:
-        * platform/mac/PlatformScrollBarMac.mm:
-        * platform/win/PlatformScrollBar.h:
-        * platform/win/PlatformScrollBarSafari.cpp:
-        * platform/win/PlatformScrollBarWin.cpp:
-        * platform/wx/PlatformScrollBar.h:
-        * platform/wx/TemporaryLinkStubs.cpp:
-        (PlatformScrollbar::~PlatformScrollbar):
-
-2008-09-13  Dave Hyatt  <hyatt@apple.com>
-
-        Remove width()/height() from Scrollbar now that it derives from Widget.  Remove width()/height() from
-        all PlatformScrollbar subclasses that just called the Widget base class versions of those methods.
-
-        Reviewed by Sam Weinig
-
-        * platform/ScrollBar.h:
-        * platform/gtk/PlatformScrollBar.h:
-        * platform/gtk/PlatformScrollBarGtk.cpp:
-        * platform/mac/PlatformScrollBar.h:
-        * platform/mac/PlatformScrollBarMac.mm:
-        * platform/win/PlatformScrollBarSafari.cpp:
-        * platform/win/PlatformScrollBarWin.cpp:
-        * platform/wx/PlatformScrollBar.h:
-        * platform/wx/TemporaryLinkStubs.cpp:
-        (PlatformScrollbar::~PlatformScrollbar):
-
-2008-09-13  Dave Hyatt  <hyatt@apple.com>
-
-        Move stopTimerIfNeeded out of PlatformScrollbar destructors and into Scrollbar.
-
-        Reviewed by Sam Weinig
-
-        * platform/ScrollBar.cpp:
-        (WebCore::Scrollbar::~Scrollbar):
-        * platform/ScrollBar.h:
-        * platform/qt/PlatformScrollBarQt.cpp:
-        (WebCore::PlatformScrollbar::~PlatformScrollbar):
-        * platform/win/PlatformScrollBarSafari.cpp:
-        (WebCore::PlatformScrollbar::~PlatformScrollbar):
-        * platform/win/PlatformScrollBarWin.cpp:
-        (WebCore::PlatformScrollbar::~PlatformScrollbar):
-
-2008-09-13  David Hyatt  <hyatt@apple.com>
-
-        Move maximum() from Qt's PlatformScrollbar to be a cross-platform
-        function on Scrollbar.  Fixes Qt build bustage.
-
-        Reviewed by Sam Weinig
-
-        * platform/ScrollBar.h:
-        (WebCore::Scrollbar::orientation):
-        (WebCore::Scrollbar::value):
-        (WebCore::Scrollbar::maximum):
-        * platform/qt/PlatformScrollBar.h:
-
-2008-09-13  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - use the LastResort font for missing glyphs instead of showing the
-          primary font's missing glyph
-
-        Test: platform/mac/fast/text/last-resort-font.html
-
-        * platform/graphics/mac/FontCacheMac.mm:
-        (WebCore::FontCache::getFontDataForCharacters): Changed to return the
-        last resort font if a substitute font cannot be found.
-        (WebCore::FontCache::getLastResortFallbackFont): Removed an outdated
-        comment (the user's preferred standard font is included in the search
-        thanks to code in FontCache::getFontData()) and changed to return the
-        LastResort font.  
-
-2008-09-13  Dave Hyatt  <hyatt@apple.com>
-
-        This patch adds ScrollbarTheme to the build.  ScrollbarTheme is similar to RenderTheme (but for
-        scrollbars only).  For now ScrollbarTheme just handles returning the size of scrollbars.  Subsequent
-        patches will move rendering and hit testing functionality into this class.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::acceleratedRenderingStateChanged):
+        Called by the rendering system when it determines that the video must go into, or
+        fall off of the hardware-accelerated path.
         
-        Implemented ScrollbarTheme subclasses for four ports (Mac, Win, Gtk, Qt).  The wxWidgets port does not
-        implement scrollbars yet, so I added a temporary link stub to keep things compiling on wx.
-       
-        Reviewed by Sam Weinig
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * platform/ScrollBar.cpp:
-        (WebCore::Scrollbar::Scrollbar):
-        * platform/ScrollBar.h:
-        * platform/ScrollbarTheme.h: Added.
-        (WebCore::ScrollbarTheme::~ScrollbarTheme):
-        (WebCore::ScrollbarTheme::scrollbarThickness):
-        (WebCore::ScrollbarTheme::themeChanged):
-        * platform/gtk/ScrollbarThemeGtk.cpp: Added.
-        (WebCore::ScrollbarTheme::nativeTheme):
-        (WebCore::ScrollbarThemeGtk::~ScrollbarThemeGtk):
-        (WebCore::ScrollbarThemeGtk::scrollbarThickness):
-        * platform/gtk/ScrollbarThemeGtk.h: Added.
-        * platform/mac/PlatformScrollBar.h:
-        * platform/mac/ScrollbarThemeMac.cpp: Added.
-        (WebCore::ScrollbarTheme::nativeTheme):
-        (WebCore::):
-        (WebCore::ScrollbarThemeMac::~ScrollbarThemeMac):
-        (WebCore::ScrollbarThemeMac::scrollbarThickness):
-        * platform/mac/ScrollbarThemeMac.h: Added.
-        * platform/qt/PlatformScrollBarQt.cpp:
-        * platform/qt/ScrollbarThemeQt.cpp: Added.
-        (WebCore::ScrollbarTheme::nativeTheme):
-        (WebCore::ScrollbarThemeQt::~ScrollbarThemeQt):
-        (WebCore::ScrollbarThemeQt::scrollbarThickness):
-        * platform/qt/ScrollbarThemeQt.h: Added.
-        * platform/win/PlatformScrollBar.h:
-        * platform/win/PlatformScrollBarSafari.cpp:
-        * platform/win/PlatformScrollBarWin.cpp:
-        * platform/win/PopupMenuWin.cpp:
-        (WebCore::PopupMenu::calculatePositionAndSize):
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::updateScrollbars):
-        (WebCore::ScrollView::themeChanged):
-        * platform/win/ScrollbarThemeSafari.cpp: Added.
-        (WebCore::ScrollbarTheme::nativeTheme):
-        (WebCore::):
-        (WebCore::ScrollbarThemeSafari::~ScrollbarThemeSafari):
-        (WebCore::ScrollbarThemeSafari::scrollbarThickness):
-        * platform/win/ScrollbarThemeSafari.h: Added.
-        * platform/win/ScrollbarThemeWin.cpp: Added.
-        (WebCore::ScrollbarTheme::nativeTheme):
-        (WebCore::ScrollbarThemeWin::~ScrollbarThemeWin):
-        (WebCore::ScrollbarThemeWin::scrollbarThickness):
-        (WebCore::ScrollbarThemeWin::themeChanged):
-        * platform/win/ScrollbarThemeWin.h: Added.
-        * platform/wx/TemporaryLinkStubs.cpp:
-        (ScrollbarTheme::nativeTheme):
-        * rendering/RenderLayer.cpp:
-        (WebCore::scrollCornerRect):
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::calcHeight):
-        (WebCore::RenderTextControl::calcPrefWidths):
-
-2008-09-13  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        <rdar://problem/5060439> Web elements should have an AXTopLevelUIElement
-
-        * page/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
-
-2008-09-13  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Timothy Hatcher.
-
-        - fix <rdar://problem/6171280> REGRESSION (r35667): Assertion failure in WebCore::FrameView::scheduleRelayout() when releasing a page with counters from the b/f cache
-
-        No regression test because the back/forward cache is disabled in DumpRenderTree
-
-        * rendering/RenderContainer.cpp:
-        (WebCore::RenderContainer::invalidateCounters): Bail out if the document
-        is being destroyed.
-
-2008-09-13  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fixes for new methods recently introduced.
-
-        * platform/graphics/wx/AffineTransformWx.cpp:
-        (WebCore::AffineTransform::AffineTransform):
-        (WebCore::AffineTransform::setMatrix):
-        (WebCore::AffineTransform::setA):
-        (WebCore::AffineTransform::setB):
-        (WebCore::AffineTransform::setC):
-        (WebCore::AffineTransform::setD):
-        (WebCore::AffineTransform::setE):
-        (WebCore::AffineTransform::setF):
-        * platform/wx/LocalizedStringsWx.cpp:
-        (WebCore::AXDefinitionListTermText):
-        (WebCore::AXDefinitionListDefinitionText):
-
-2008-09-12  Dave Hyatt  <hyatt@apple.com>
-
-        Move the member variables of PlatformScrollbar up into Scrollbar.  Move autoscroll timer handling
-        up into scrollbar.  Make sure a bunch of cross-platform code now just uses "Scrollbar" instead of
-        "PlatformScrollbar."
+        (WebCore::MediaPlayer::supportsAcceleratedRendering):
+        Method to say whether the media engine supports accelerated rendering.
         
-        Reviewed by Sam Weinig
-
-        * WebCore.vcproj/WebCore.vcproj:
-        * editing/EditorCommand.cpp:
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::selectCursor):
-        (WebCore::EventHandler::handleMousePressEvent):
-        (WebCore::EventHandler::handleMouseMoveEvent):
-        * page/EventHandler.h:
-        * page/MouseEventWithHitTestResults.cpp:
-        (WebCore::MouseEventWithHitTestResults::scrollbar):
-        * page/MouseEventWithHitTestResults.h:
-        * page/gtk/EventHandlerGtk.cpp:
-        (WebCore::EventHandler::passMousePressEventToScrollbar):
-        * page/mac/EventHandlerMac.mm:
-        (WebCore::EventHandler::passMousePressEventToScrollbar):
-        * page/qt/EventHandlerQt.cpp:
-        (WebCore::EventHandler::passMousePressEventToScrollbar):
-        * page/win/EventHandlerWin.cpp:
-        (WebCore::EventHandler::passMousePressEventToScrollbar):
-        * page/wx/EventHandlerWx.cpp:
-        (WebCore::EventHandler::passMousePressEventToScrollbar):
-        * platform/PopupMenu.h:
-        * platform/ScrollBar.cpp:
-        (WebCore::Scrollbar::Scrollbar):
-        (WebCore::Scrollbar::autoscrollTimerFired):
-        (WebCore::Scrollbar::autoscrollPressedPart):
-        (WebCore::Scrollbar::startTimerIfNeeded):
-        (WebCore::Scrollbar::stopTimerIfNeeded):
-        (WebCore::Scrollbar::pressedPartScrollDirection):
-        (WebCore::Scrollbar::pressedPartScrollGranularity):
-        * platform/ScrollBar.h:
-        (WebCore::Scrollbar::handleMousePressEvent):
-        (WebCore::Scrollbar::invalidatePart):
-        (WebCore::Scrollbar::thumbUnderMouse):
-        * platform/ScrollView.h:
-        * platform/ScrollbarClient.h: Added.
-        (WebCore::ScrollbarClient::~ScrollbarClient):
-        * platform/gtk/ScrollViewGtk.cpp:
-        (WebCore::ScrollView::scrollbarUnderMouse):
-        * platform/qt/PlatformScrollBar.h:
-        * platform/qt/PlatformScrollBarQt.cpp:
-        (WebCore::PlatformScrollbar::PlatformScrollbar):
-        (WebCore::scrollbarPart):
-        (WebCore::PlatformScrollbar::handleMouseMoveEvent):
-        (WebCore::PlatformScrollbar::handleMouseOutEvent):
-        (WebCore::PlatformScrollbar::handleMousePressEvent):
-        (WebCore::PlatformScrollbar::handleMouseReleaseEvent):
-        * platform/qt/ScrollViewQt.cpp:
-        (WebCore::ScrollView::scrollbarUnderMouse):
-        (WebCore::ScrollView::wheelEvent):
-        * platform/win/PlatformScrollBar.h:
-        * platform/win/PlatformScrollBarSafari.cpp:
-        (WebCore::PlatformScrollbar::PlatformScrollbar):
-        * platform/win/PlatformScrollBarWin.cpp:
-        (WebCore::PlatformScrollbar::PlatformScrollbar):
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::scrollbarUnderMouse):
-        * rendering/HitTestResult.cpp:
-        (WebCore::HitTestResult::setScrollbar):
-        * rendering/HitTestResult.h:
-        (WebCore::HitTestResult::scrollbar):
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::hitTestOverflowControls):
-        * rendering/RenderLayer.h:
-        * rendering/RenderListBox.h:
-
-2008-09-12  Steve Falkenburg  <sfalken@apple.com>
-
-        Fix Mac build.
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::getTransformOperationType):
-
-2008-09-12  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Make transform animation behavior match spec
-        https://bugs.webkit.org/show_bug.cgi?id=20770
-
-        Tests: transitions/transform-op-list-match.html
-               transitions/transform-op-list-no-match.html
-
-        * css/CSSStyleSelector.cpp:
-        * css/CSSStyleSelector.h:
-        * page/animation/AnimationBase.cpp:
-        * page/animation/AnimationBase.h:
-        * page/animation/ImplicitAnimation.cpp:
-        * page/animation/ImplicitAnimation.h:
-        * page/animation/KeyframeAnimation.cpp:
-        * page/animation/KeyframeAnimation.h:
-        * rendering/RenderLayer.cpp:
-        * rendering/style/RenderStyle.cpp:
-        * rendering/style/RenderStyle.h:
-
-2008-09-12  Ojan Vafai  <ojan@chromium.org>
-
-        Properly escape contents of links added to the inspector.
-        For now, just build the link with the DOM and get the
-        outerHTML. Eventually, we probably just want to do
-        this entirely with the DOM.
-
-        Reviewed by Timothy Hatcher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20684
-
-        * manual-tests/inspector/escape-links.html: Added.
-        * page/inspector/StylesSidebarPane.js:
-        * page/inspector/inspector.js:
-        * page/inspector/utilities.js:
-
-2008-09-12  Adele Peterson  <adele@apple.com>
-
-        Reviewed by John Sullivan and Kevin McCullough.
-
-        Fix for <rdar://problem/6216951> REGRESSION (r36000?): Crash due to infinite recursion into EventHandler::hitTestResultAtPoint() with disconnected frames
-
-        * page/EventHandler.cpp: (WebCore::EventHandler::hitTestResultAtPoint):
-        Hit testing again on the main frame will only work if we aren't already on the main frame.  If we are already on the main frame, that will
-        cause infinite recursion.  This change checks that we're not already on the main frame before hit testing again. 
-
-2008-09-12  Kevin McCullough  <kmccullough@apple.com>
-
-        RS by Tim .
-
-        Re-introducing the code since it was not the cause of the crash.
-        See r36343.
-
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::canBeProgramaticallyScrolled):
-        * rendering/RenderObject.h:
-
-2008-09-12  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        When changing one animation in a list, don't reset other animations
-        https://bugs.webkit.org/show_bug.cgi?id=20675
-
-        Test: animations/change-one-anim.html
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::getNumProperties):
-        * page/animation/AnimationBase.h:
-        * page/animation/AnimationController.cpp:
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimation::updateKeyframeAnimations):
-        * page/animation/CompositeAnimation.h:
-        * page/animation/ImplicitAnimation.cpp:
-        * page/animation/KeyframeAnimation.cpp:
-        * page/animation/KeyframeAnimation.h:
-        (WebCore::KeyframeAnimation::setIndex):
-
-2008-09-12  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Mitz Pettel
-
-        Fix the ASSERT and failure in webarchive/archive-empty-frame-source.html
-
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::mainResource): Further restoration of original WebArchive behavior.
-          Subresources can never be created from nil data, but there is always a MainResource, whether
-          or not there's any data.  So in the case where the main resource has no data, fake it for the
-          sake of creating the ArchiveResource.
-
-2008-09-12  Dave Hyatt  <hyatt@apple.com>
-
-        Preparation for major scrollbar rearchitecture.  Eliminate the concept of non-widget based
-        scrollbars (which we never supported anyway).  Make Scrollbar derive from Widget directly.
-        Remove all the isWidget and hasPlatformScrollbars guards.
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayerClient::mediaPlayerRepaint):
+        (WebCore::MediaPlayerClient::mediaPlayerSizeChanged):
+        Moved.
         
-        Reviewed by Tim Hatcher
-
-        * platform/ScrollBar.h:
-        * platform/gtk/PlatformScrollBar.h:
-        * platform/mac/PlatformScrollBar.h:
-        * platform/qt/PlatformScrollBar.h:
-        * platform/win/PlatformScrollBar.h:
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::ScrollViewPrivate::setHasHorizontalScrollbar):
-        (WebCore::ScrollView::ScrollViewPrivate::setHasVerticalScrollbar):
-        * platform/wx/PlatformScrollBar.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::horizontalScrollbarWidget):
-        (WebCore::RenderLayer::verticalScrollbarWidget):
-        (WebCore::RenderLayer::createScrollbar):
-        (WebCore::RenderLayer::destroyScrollbar):
-        * rendering/RenderListBox.cpp:
-        (WebCore::RenderListBox::~RenderListBox):
-        (WebCore::RenderListBox::updateFromElement):
-        (WebCore::RenderListBox::isPointInOverflowControl):
-
-2008-09-12  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - https://bugs.webkit.org/show_bug.cgi?id=20793 clean up page/animation
-
-        * page/animation/AnimationController.cpp:
-        * page/animation/AnimationController.h:
-        * page/animation/CompositeAnimation.cpp:
-        * page/animation/CompositeAnimation.h:
-        * page/animation/ImplicitAnimation.cpp:
-        * page/animation/ImplicitAnimation.h:
-        * page/animation/KeyframeAnimation.cpp:
-        * page/animation/KeyframeAnimation.h:
-
-2008-09-11  Timothy Hatcher  <timothy@apple.com>
-
-        Add a renderedImage method to DOMNode to get an image
-        of the rendering for the node and it's descendants.
-
-        <rdar://problem/5849349> Would like API to create
-        an image for a DOM node
-
-        Reviewed by Oliver Hunt.
-
-        * bindings/objc/DOM.mm:
-        (-[DOMNode renderedImage]): Call Frame::nodeImage.
-        * bindings/objc/DOMPrivate.h:
-        * page/Frame.h:
-        * page/mac/FrameMac.mm:
-        (WebCore::Frame::nodeImage):
-
-2008-09-08  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        Need to support comma separated list of key times in keyframes selectors
-        https://bugs.webkit.org/show_bug.cgi?id=20680
-
-        Test: animations/keyframes-comma-separated.html
-
-        * css/CSSGrammar.y:
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::createKeyframeRule):
-        * css/CSSParser.h:
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::addKeyframeStyle):
-        * css/WebKitCSSKeyframeRule.cpp:
-        (WebCore::WebKitCSSKeyframeRule::WebKitCSSKeyframeRule):
-        (WebCore::WebKitCSSKeyframeRule::cssText):
-        (WebCore::WebKitCSSKeyframeRule::parseKeyString):
-        * css/WebKitCSSKeyframeRule.h:
-        (WebCore::WebKitCSSKeyframeRule::keyText):
-        (WebCore::WebKitCSSKeyframeRule::setKeyText):
-        (WebCore::WebKitCSSKeyframeRule::getKeys):
-        * css/WebKitCSSKeyframesRule.cpp:
-        (WebCore::WebKitCSSKeyframesRule::append):
-        (WebCore::WebKitCSSKeyframesRule::insertRule):
-        (WebCore::WebKitCSSKeyframesRule::deleteRule):
-        (WebCore::WebKitCSSKeyframesRule::findRule):
-        (WebCore::WebKitCSSKeyframesRule::findRuleIndex):
-        * css/WebKitCSSKeyframesRule.h:
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::blendProperties):
-
-2008-09-11  Kevin McCullough  <kmccullough@apple.com>
-
-        RS by Tim.
-
-        Reverting because this caused a crash.
-
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::canBeProgramaticallyScrolled):
-        (WebCore::RenderObject::hasScrollableView):
-        * rendering/RenderObject.h:
-
-2008-09-11  Dean Jackson  <dino@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Fix assertion on transition property "none"
-        https://bugs.webkit.org/show_bug.cgi?id=20751
-
-        Test: transitions/transition-end-event-set-none.html
-
-        * page/animation/CompositeAnimation.cpp:
-        (WebCore::CompositeAnimation::updateTransitions):
-
-2008-09-11  David Smith  <catfish.man@gmail.com>
-
-        Rubber-stamped by mitzpettel.
-
-        Remove an accidentally added extra file.
-
-        * WebCore: Removed.
-
-2008-09-11  David Smith  <catfish.man@gmail.com>
-
-        Reviewed by Darin
-
-        https://bugs.webkit.org/show_bug.cgi?id=20180
+        (WebCore::MediaPlayerClient::mediaPlayerRenderingCanBeAccelerated):
+        (WebCore::MediaPlayerClient::mediaPlayerGraphicsLayer):
+        New methods to ask the client if the rendering system can support accelerated
+        rendering, and to get a GraphicsLayer to plug the movie layer into.
         
-        This speeds up :nth-child matching as tested by querySelectorAll by around 10% by inlining the common case of Node::renderStyle(). Many thanks to mitzpettel and othermaciej for suggestions and help.
-
-        * WebCore.xcodeproj/project.pbxproj: Add NodeRenderStyle.h
-        * css/CSSStyleSelector.cpp: include NodeRenderStyle.h
-        * dom/Element.cpp: include NodeRenderStyle.h
-        * dom/Node.cpp: Remove the definition of renderStyle()
-        (WebCore::Node::nonRendererRenderStyle):
-        * dom/Node.h: Make renderStyle() nonvirtual and add nonRendererRenderStyle()
-        * dom/NodeRenderStyle.h: Added.
-        (WebCore::Node::renderStyle): Inline the common case of this, call nonRendererRenderStyle for the part that needed to be virtual
-        * html/HTMLOptGroupElement.cpp: include NodeRenderStyle.h
-        * html/HTMLOptGroupElement.h:
-        (WebCore::HTMLOptGroupElement::nonRendererRenderStyle): override to return m_style
-        * html/HTMLOptionElement.cpp: include NodeRenderStyle.h
-        * html/HTMLOptionElement.h:
-        (WebCore::HTMLOptionElement::nonRendererRenderStyle): override to return m_style
-        * rendering/RenderListBox.cpp: include NodeRenderStyle.h
-        * rendering/RenderMenuList.cpp: include NodeRenderStyle.h
-        * svg/SVGUseElement.cpp: include NodeRenderStyle.h
-
-2008-09-11  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Adele and Tim.
-
-        <rdar://problem/6100597> REGRESSION: clicking on search results in Web
-        Inspector does not scroll to the line of the results (20167)
-        - This was put in by Max to fix auto scrolling but is not correct for
-        the whole web: rdar://problem/6213098
-
-        * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::canBeProgramaticallyScrolled):
-        * rendering/RenderObject.h:
-
-2008-09-11  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Beth Dakin
-
-        <rdar://problem/6210511> AX: if a frame has a title, that should be reported as the AXWebArea's title
-
-        Test: accessibility/frame-with-title.html
-
-        * page/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::accessibilityDescription):
-
-2008-09-11  Dirk Schulze  <vbs85@gmx.de>
-
-        Reviewed by Simon.
-
-        Fixed stroke() and strokeRect() to support gradients
-        and patterns on Qt.
-
-        [Qt] Canvas stroke don't work for gradients and patterns
-        [https://bugs.webkit.org/show_bug.cgi?id=20749]
-
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::strokeRect):
-
-2008-09-11  Dirk Schulze  <vbs85@gmx.de>
-
-        Reviewed by Simon.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20729
-
-        Fixed canvas gradients for Qt
-
-        [Qt] Canvas gradients don't work as expected
-        [https://bugs.webkit.org/show_bug.cgi?id=20729]
-
-        * platform/graphics/qt/GradientQt.cpp:
-        (WebCore::Gradient::platformGradient):
-
-2008-09-11  Dirk Schulze  <vbs85@gmx.de>
-
-        Reviewed by Simon.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20568
-
-        Add support for patterns to Qt.
-
-        * platform/graphics/qt/PatternQt.cpp:
-        (WebCore::Pattern::createPlatformPattern):
-
-2008-09-10  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - clean up AnimationBase
-
-        * page/animation/AnimationBase.cpp:
-        * page/animation/AnimationBase.h:
-        * page/animation/CompositeAnimation.cpp:
-        * page/animation/ImplicitAnimation.cpp:
-        * page/animation/ImplicitAnimation.h:
-        * page/animation/KeyframeAnimation.cpp:
-        * page/animation/KeyframeAnimation.h:
-
-2008-09-10  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20741
-        REGRESSION: ISO-8859-8-I encoding is registered incorrectly
-
-        Turns out that there were no real behavior changes for 8859-8, as it was only a debug-only
-        check to ignore this specific registration that was failing. Yet, I decided to add a bunch of
-        tests for ISO-8859-8 encoding aliases, as we handle them in a quite complicated manner.
-
-        I also found and fixed a potential crasher for non-Mac ports.
-
-        Tests: fast/encoding/hebrew/8859-8-e.html
-               fast/encoding/hebrew/8859-8-i.html
-               fast/encoding/hebrew/8859-8.html
-               fast/encoding/hebrew/csISO88598I.html
-               fast/encoding/hebrew/hebrew.html
-               fast/encoding/hebrew/iso-ir-138.html
-               fast/encoding/hebrew/logical.html
-
-        * platform/text/TextEncodingRegistry.cpp: (WebCore::checkExistingName): Check for iso-8859-8
-        (case-insensitively, because different versions of ICU report this MIME name in different
-        case).
-
-        * platform/text/TextCodecICU.cpp:
-        (WebCore::TextCodecICU::registerExtendedEncodingNames): Updated some comments.
-        (WebCore::TextCodecICU::registerExtendedCodecs): Try both MIME and IANA names here, too.
-        There are four names in ICU that only have MIME names (x-mac-* ones), so we could end up
-        with an encoding map entry, but no codec for these. This was not an issue on the Mac, as
-        we also support these via TEC (which we should stop doing), but on Windows, this would
-        likely crash.
-
-2008-09-09  Dave Hyatt  <hyatt@apple.com
-
-        Resurrect PlatformScrollbarWin.
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::supportsAcceleratedRendering):
+        (WebCore::MediaPlayerPrivateInterface::acceleratedRenderingStateChanged):
+        Forwarding methods from MediaPlayer.
         
-        Reviewed by Adam Roben
-
-        * WebCore.vcproj/WebCore.vcproj:
-        * platform/win/PlatformScrollBarWin.cpp:
-        (WebCore::isRunningOnVistaOrLater):
-        (WebCore::checkAndInitScrollbarTheme):
-        (WebCore::PlatformScrollbar::PlatformScrollbar):
-        (WebCore::PlatformScrollbar::invalidateTrack):
-        (WebCore::PlatformScrollbar::invalidatePart):
-        (WebCore::PlatformScrollbar::paint):
-        (WebCore::PlatformScrollbar::hasButtons):
-        (WebCore::PlatformScrollbar::hasThumb):
-        (WebCore::PlatformScrollbar::backButtonRect):
-        (WebCore::PlatformScrollbar::forwardButtonRect):
-        (WebCore::PlatformScrollbar::trackRect):
-        (WebCore::PlatformScrollbar::gripperRect):
-        (WebCore::PlatformScrollbar::thumbLength):
-        (WebCore::PlatformScrollbar::paintButton):
-        (WebCore::PlatformScrollbar::paintTrack):
-        (WebCore::PlatformScrollbar::paintThumb):
-        (WebCore::PlatformScrollbar::paintGripper):
-        (WebCore::PlatformScrollbar::hitTest):
-        (WebCore::PlatformScrollbar::handleMouseMoveEvent):
-        (WebCore::PlatformScrollbar::handleMouseOutEvent):
-        (WebCore::PlatformScrollbar::themeChanged):
-
-2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 20759: Remove MacroAssembler
-        <https://bugs.webkit.org/show_bug.cgi?id=20759>
-
-        Make the necessary changes to ForwardingHeaders to remove
-        MacroAssembler.
-
-        * ForwardingHeaders/masm/IA32MacroAsm.h: Removed.
-        * ForwardingHeaders/masm/MacroAssembler.h: Removed.
-        * ForwardingHeaders/masm/X86Assembler.h: Added.
-
-2008-09-09  Alp Toker  <alp@nuanti.com>
-
-        Reviewed by Dave Hyatt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=16792
-        [GTK] Fails to render Japanese/Chinese text with simple path
-
-        https://bugs.webkit.org/show_bug.cgi?id=16942
-        [GTK] Oddities in font selection and fall back
-
-        https://bugs.webkit.org/show_bug.cgi?id=16862
-        [GTK] Custom fonts hard-coded to use grayscale antialiasing and no hinting
-
-        GTK+ font fixes and enhancements.
-
-        Implement font fallback for the simple FontConfig-based text path and
-        improve the Pango-based complex text path to make use of requested
-        font properties and available font selection.
-
-        Add text shadow support to the complex path.
-
-        * platform/graphics/gtk/FontCacheGtk.cpp:
-        (WebCore::FontCache::getFontDataForCharacters):
-        (WebCore::FontCache::getSimilarFontPlatformData):
-        * platform/graphics/gtk/FontGtk.cpp:
-        (WebCore::setPangoAttributes):
-        (WebCore::Font::drawComplexText):
-        (WebCore::getDefaultPangoLayout):
-        (WebCore::Font::floatWidthForComplexText):
-        (WebCore::Font::offsetForPositionForComplexText):
-        (WebCore::Font::selectionRectForComplexText):
-        * platform/graphics/gtk/FontPlatformData.h:
-        (WebCore::FontPlatformData::FontPlatformData):
-        (WebCore::FontPlatformData::hash):
-        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
-        (WebCore::FontPlatformData::FontPlatformData):
-        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
-        (WebCore::SimpleFontData::platformDestroy):
-
-2008-09-09  Dave Hyatt  <hyatt@apple.com>
-
-        Make the Windows classic case work again.  Overlap in slider constants and other constants broke
-        the push state for buttons and checkboxes.  Make sure to check the RenderObject's appearance
-        value to make sure it's really a slider thumb to resolve this conflict.
-       
-        Reviewed by Adam Roben
-
-        * rendering/RenderThemeWin.cpp:
-        (WebCore::drawControl):
-
-2008-09-05  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Need to handle the case when 0% or 100% keyframe is omitted
-        https://bugs.webkit.org/show_bug.cgi?id=20679
-
-        Tests: animations/keyframes-from-missing.html
-               animations/keyframes-to-missing.html
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::addKeyframeStyle):
-
-2008-09-09  Dave Hyatt  <hyatt@apple.com>
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        Some new methods related to using a QTMovieLayer, and to simplify the rendering mode logic.
 
-        Resurrect Safari's original RenderThemeWin and bring it up to date with ToT.  Having a current
-        RenderThemeWin that does not have any Skia dependencies should provide a good basis for a potential
-        merge of Google Chrome's RenderThemeWin (to help us see where the Skia stuff can be cut and to see
-        what changes have been made as compared with the old RenderThemeWin).
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovieLayer):
+        (WebCore::MediaPlayerPrivate::destroyQTMovieLayer):
+        Methods to create and destroy the QTMovieLayer.
         
-        Fix CSS2 system fonts to properly set both the rendering mode (so that they properly pick up GDI vs. CG
-        text rendering modes) and the printer font setting (so that OS X system fonts properly pick up screen
-        vs. printer advancement rounding).
-    
-        Reviewed by Adam/Sam
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::applyProperty):
-        * platform/graphics/Icon.h:
-        (WebCore::Icon::create):
-        * rendering/RenderThemeWin.cpp:
-        (WebCore::RenderThemeWin::RenderThemeWin):
-        (WebCore::RenderThemeWin::~RenderThemeWin):
-        (WebCore::RenderThemeWin::buttonTheme):
-        (WebCore::RenderThemeWin::textFieldTheme):
-        (WebCore::RenderThemeWin::menuListTheme):
-        (WebCore::RenderThemeWin::sliderTheme):
-        (WebCore::RenderThemeWin::close):
-        (WebCore::RenderThemeWin::themeChanged):
-        (WebCore::RenderThemeWin::supportsHover):
-        (WebCore::fillFontDescription):
-        (WebCore::RenderThemeWin::systemFont):
-        (WebCore::RenderThemeWin::supportsFocus):
-        (WebCore::RenderThemeWin::determineClassicState):
-        (WebCore::RenderThemeWin::determineState):
-        (WebCore::RenderThemeWin::determineSliderThumbState):
-        (WebCore::RenderThemeWin::getClassicThemeData):
-        (WebCore::RenderThemeWin::getThemeData):
-        (WebCore::drawControl):
-        (WebCore::RenderThemeWin::paintButton):
-        (WebCore::RenderThemeWin::paintTextField):
-        (WebCore::RenderThemeWin::paintMenuList):
-        (WebCore::RenderThemeWin::adjustMenuListStyle):
-        (WebCore::RenderThemeWin::adjustMenuListButtonStyle):
-        (WebCore::RenderThemeWin::paintMenuListButton):
-        (WebCore::RenderThemeWin::paintSliderTrack):
-        (WebCore::RenderThemeWin::paintSliderThumb):
-        (WebCore::RenderThemeWin::adjustSliderThumbSize):
-        (WebCore::RenderThemeWin::paintSearchField):
-        (WebCore::RenderThemeWin::adjustSearchFieldStyle):
-        (WebCore::RenderThemeWin::paintSearchFieldCancelButton):
-        (WebCore::RenderThemeWin::adjustSearchFieldCancelButtonStyle):
-        (WebCore::RenderThemeWin::adjustSearchFieldDecorationStyle):
-        (WebCore::RenderThemeWin::adjustSearchFieldResultsDecorationStyle):
-        (WebCore::RenderThemeWin::paintSearchFieldResultsDecoration):
-        (WebCore::RenderThemeWin::adjustSearchFieldResultsButtonStyle):
-        (WebCore::RenderThemeWin::paintSearchFieldResultsButton):
-        * rendering/RenderThemeWin.h:
-        (WebCore::ThemeData::ThemeData):
-        (WebCore::RenderThemeWin::paintSearchFieldDecoration):
-        (WebCore::RenderThemeWin::adjustButtonStyle):
-        (WebCore::RenderThemeWin::adjustTextFieldStyle):
-        (WebCore::RenderThemeWin::adjustTextAreaStyle):
-
-2008-09-09  Dean Jackson  <dino@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Document::createEvent missing cases for animation and
-        transition events.
-        https://bugs.webkit.org/show_bug.cgi?id=20734
-
-        Test: transitions/transition-end-event-create.html
-        Test: animations/animation-events-create.html
-
-        * dom/Document.cpp:
-        (WebCore::Document::createEvent):
-            - add the two cases
-
-2008-09-09  Dan Bernstein  <mitz@apple.com>
-
-        - Tiger build fix
-
-        * WebCore.Tiger.exp:
-        * WebCore.base.exp:
-        * platform/mac/WebCoreSystemInterface.h:
-        * platform/mac/WebCoreSystemInterface.mm:
-
-2008-09-09  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Darin Adler.
-
-        - WebCore part of <rdar://problem/6206244> Use alternate character-to-glyph interface on Leopard
-
-        * WebCore.Tiger.exp:
-        * WebCore.base.exp:
-        * platform/graphics/SimpleFontData.h:
-        * platform/graphics/mac/GlyphPageTreeNodeMac.cpp:
-        (WebCore::GlyphPage::fill):
-        * platform/graphics/mac/SimpleFontDataMac.mm:
-        (WebCore::initFontData):
-        (WebCore::SimpleFontData::platformInit):
-        (WebCore::SimpleFontData::platformDestroy):
-        * platform/mac/WebCoreSystemInterface.h:
-        * platform/mac/WebCoreSystemInterface.mm:
-
-2008-09-09  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Tim.
-
-        <rdar://problem/6198545> REGRESSION: Inspector debugger barfs on
-        breakpoints inside eval.
-
-        * page/inspector/inspector.js:
-
-2008-09-09  Joerg Bornemann  <joerg.bornemann@trolltech.com>
-
-        Reviewed by Simon.
-
-        Fix compilation of the Qt port with disabled plugins on Windows
-
-        * WebCore.pro:
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::PluginView):
-        * plugins/PluginView.h:
-
-2008-09-09  Jungshik Shin  <jungshik.shin@gmail.com>
-
-        Reviewed by Alexey Proskuryakov.
-
-        Try MIME charset names before trying IANA names 
-        ( https://bugs.webkit.org/show_bug.cgi?id=17537 )
-
-        With this change, shorter and more widely used names (preferred MIME
-        names) are returned by document.charset, document.characterSet,
-        document.inputEncoding rather than IANA names. This  helps
-        fixing bug 18085 in addition to web developers who are more familiar
-        with MIME names. For instance, EUC-JP, ISO-8859-X and US-ASCII will be
-        returned instead of Extended_UNIX_Code_Packed_Format_for_Japanese, 
-        ISO-8859-X:19xx, and ANSI_X3.4-1968. It also replaces IBM8xx with cp8xx. 
-        Note that cp/IBM 8xx are extremly rare in today's web. Even if they're
-        used, the former is still recognized as aliases to the latter so that
-        there's very little, if any, to worry about.
-
-        * platform/text/TextCodecICU.cpp:
-        (WebCore::TextCodecICU::registerExtendedEncodingNames):
-
-2008-09-08  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Maciej Stachowiak and Oliver Hunt.
-
-        Add forwarding headers.
-
-        * ForwardingHeaders/wtf/HashFunctions.h: Added.
-
-2008-09-05  Dean Jackson  <dino@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Update grammar so that we can add a keyframe rule via the DOM.
-        https://bugs.webkit.org/show_bug.cgi?id=20613
-
-        * css/CSSGrammar.y:
-        * css/tokenizer.flex:
-
-2008-09-08  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Allow <br> for simple UA stylesheet. Editing code generates them. It does not
-        actually show up in any of the default stylesheets.
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::elementCanUseSimpleDefaultStyle):
-
-2008-09-08  Dimitri Glazkov  <dglazkov@google.com>
-
-        Reviewed by Dan Bernstein.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=20237
-          Zero width and space characters are displayed incorrectly if not contained in a fallback font
-
-        Adds an extra check for Object Replacement Character (U+FFFC) to address
-        the issue with fast/text/zero-width-characters.html test when run
-        with Windows system default fonts.
-
-        * platform/graphics/Font.h:
-        (WebCore::Font::treatAsZeroWidthSpace):
-
-2008-09-08  Dean Jackson  <dino@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Code style issue I forgot to fix from previous commit.
-
-        * platform/graphics/AffineTransform.cpp:
-        (WebCore::AffineTransform::blend):
-
-2008-09-08  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Sam Weinig
-
-        - Animation of -webkit-transform matrix() function should not do linear interpolation
-          https://bugs.webkit.org/show_bug.cgi?id=20667
-
-        Test: animations/matrix-anim.html
-
-        * ChangeLog:
-        * platform/graphics/AffineTransform.cpp:
-        (WebCore::affineTransformDecompose):
-        (WebCore::affineTransformCompose):
-        (WebCore::AffineTransform::blend):
-        * platform/graphics/AffineTransform.h:
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::MatrixTransformOperation::blend):
-
-2008-09-08  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20668
-        multipart/form-data does not always include Content-type for submitted files
-
-        Cannot be tested with DRT or manual tests.
-
-        * platform/MIMETypeRegistry.cpp:
-        (WebCore::initializeSupportedNonImageMimeTypes): Fix spacing.
-        (WebCore::MIMETypeRegistry::getMIMETypeForPath): Default to application/octet-stream for
-        unknown extensions, not just missing ones.
-
-2008-09-08  Simon Hausmann  <hausmann@webkit.org>
-
-        Build fix for the Qt/Windows build, define USE_JSC to
-        enable the WebCore::String -> JSC::UString operator that
-        MSVC insists on seeing
-
-        * WebCore.pro:
-
-2008-09-08  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Maciej.
-
-        <rdar://problem/5850387> Showing bookmarks reloads Google Reader instead.
+        (WebCore::MediaPlayerPrivate::currentRenderingMode):
+        (WebCore::MediaPlayerPrivate::preferredRenderingMode):
+        Methods to clarify the code that decides which of the 3 rendering modes to use.
         
-        In some cases, timeouts scheduled by a page in the onunload handler could fire even when the
-        page had been unloaded and replaced by a non-HTML representation based view (such as the bookmarks view).
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering):
+        Changed to use the new rendering mode methods.
         
-        Fix this by clearing timeouts for pages that aren't cached when the provisional load is committed.
+        (WebCore::MediaPlayerPrivate::tearDownVideoRendering):
+        Destroy the layer if we have one.
         
-        * bindings/js/JSDOMWindowBase.h:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::commitProvisionalLoad):
-
-2008-09-07  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        Don't leak the simple stylesheet.
-        Also call RenderTheme::adjustDefaultStyleSheet() in right place.
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::loadFullDefaultStyle):
-        (WebCore::loadSimpleDefaultStyle):
-        (WebCore::CSSStyleSelector::styleForElement):
-
-2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Oliver Hunt.
-
-        Bug 20711: Change KJS prefix on preprocessor macros to JSC
-        <https://bugs.webkit.org/show_bug.cgi?id=20711>
-
-        * bindings/js/JSEventTargetBase.h:
-        * bindings/js/JSHTMLInputElementBase.cpp:
-        * bindings/js/JSHTMLInputElementBase.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
-
-2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Reviewed by Maciej Stachowiak.
-
-        Bug 20704: Replace the KJS namespace
-        <https://bugs.webkit.org/show_bug.cgi?id=20704>
-
-        Rename the KJS namespace to JSC. There are still some uses of KJS in the
-        names of JNI functions, and I will check if these are safe to change
-        as well.
-
-        * WebCore.base.exp:
-        * bindings/js/GCController.cpp:
-        * bindings/js/JSAttrCustom.cpp:
-        * bindings/js/JSAudioConstructor.cpp:
-        * bindings/js/JSAudioConstructor.h:
-        (WebCore::JSAudioConstructor::classInfo):
-        * bindings/js/JSCSSRuleCustom.cpp:
-        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
-        * bindings/js/JSCSSValueCustom.cpp:
-        * bindings/js/JSCanvasPixelArrayCustom.cpp:
-        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
-        * bindings/js/JSClipboardCustom.cpp:
-        * bindings/js/JSConsoleCustom.cpp:
-        * bindings/js/JSCustomSQLStatementCallback.cpp:
-        (WebCore::JSCustomSQLStatementCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementCallback.h:
-        (WebCore::JSCustomSQLStatementCallback::create):
-        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
-        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementErrorCallback.h:
-        (WebCore::JSCustomSQLStatementErrorCallback::create):
-        * bindings/js/JSCustomSQLTransactionCallback.cpp:
-        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionCallback.h:
-        (WebCore::JSCustomSQLTransactionCallback::create):
-        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
-        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
-        (WebCore::JSCustomSQLTransactionErrorCallback::create):
-        * bindings/js/JSCustomVoidCallback.cpp:
-        (WebCore::JSCustomVoidCallback::handleEvent):
-        * bindings/js/JSCustomVoidCallback.h:
-        (WebCore::JSCustomVoidCallback::create):
-        * bindings/js/JSCustomXPathNSResolver.cpp:
-        (WebCore::JSCustomXPathNSResolver::create):
-        * bindings/js/JSCustomXPathNSResolver.h:
-        * bindings/js/JSDOMApplicationCacheCustom.cpp:
-        (WebCore::JSDOMApplicationCache::dispatchEvent):
-        * bindings/js/JSDOMBinding.cpp:
-        (WebCore::jsOwnedStringOrNull):
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObject::DOMObject):
-        (WebCore::cacheDOMObject):
-        (WebCore::cacheSVGDOMObject):
-        (WebCore::DOMExceptionTranslator::DOMExceptionTranslator):
-        (WebCore::toJS):
-        * bindings/js/JSDOMWindowBase.cpp:
-        * bindings/js/JSDOMWindowBase.h:
-        (WebCore::JSDOMWindowBase::classInfo):
-        (WebCore::JSDOMWindowBase::d):
-        * bindings/js/JSDOMWindowCustom.cpp:
-        (WebCore::JSDOMWindow::getPropertyAttributes):
-        * bindings/js/JSDOMWindowCustom.h:
-        (WebCore::asJSDOMWindow):
-        (WebCore::JSDOMWindow::customGetOwnPropertySlot):
-        (WebCore::JSDOMWindow::customPut):
-        (WebCore::JSDOMWindowBase::allowsAccessFrom):
-        (WebCore::JSDOMWindowBase::allowsAccessFromNoErrorMessage):
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::JSDOMWindowShell::getPropertyAttributes):
-        * bindings/js/JSDOMWindowShell.h:
-        (WebCore::JSDOMWindowShell::classInfo):
-        * bindings/js/JSDatabaseCustom.cpp:
-        * bindings/js/JSDocumentCustom.cpp:
-        * bindings/js/JSDocumentFragmentCustom.cpp:
-        * bindings/js/JSElementCustom.cpp:
-        * bindings/js/JSEventCustom.cpp:
-        * bindings/js/JSEventListener.cpp:
-        * bindings/js/JSEventListener.h:
-        (WebCore::JSUnprotectedEventListener::create):
-        (WebCore::JSEventListener::create):
-        * bindings/js/JSEventTargetBase.cpp:
-        * bindings/js/JSEventTargetBase.h:
-        (WebCore::JSEventTargetBase::getValueProperty):
-        (WebCore::JSEventTargetBase::putValueProperty):
-        (WebCore::JSEventTargetBase::getOwnPropertySlot):
-        (WebCore::JSEventTargetBase::put):
-        (WebCore::JSEventTargetPrototype::JSEventTargetPrototype):
-        (WebCore::JSEventTargetPrototype::self):
-        (WebCore::JSEventTargetPrototype::getOwnPropertySlot):
-        (WebCore::JSEventTargetPrototype::classInfo):
-        * bindings/js/JSEventTargetNode.cpp:
-        * bindings/js/JSEventTargetNode.h:
-        (WebCore::JSEventTargetNode::getOwnPropertySlot):
-        (WebCore::JSEventTargetNode::getValueProperty):
-        (WebCore::JSEventTargetNode::put):
-        (WebCore::JSEventTargetNode::putValueProperty):
-        * bindings/js/JSHTMLAllCollection.h:
-        (WebCore::JSHTMLAllCollection::JSHTMLAllCollection):
-        (WebCore::JSHTMLAllCollection::toBoolean):
-        * bindings/js/JSHTMLAppletElementCustom.cpp:
-        * bindings/js/JSHTMLCollectionCustom.cpp:
-        * bindings/js/JSHTMLDocumentCustom.cpp:
-        * bindings/js/JSHTMLElementCustom.cpp:
-        * bindings/js/JSHTMLEmbedElementCustom.cpp:
-        * bindings/js/JSHTMLFormElementCustom.cpp:
-        * bindings/js/JSHTMLFrameElementCustom.cpp:
-        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
-        * bindings/js/JSHTMLIFrameElementCustom.cpp:
-        * bindings/js/JSHTMLInputElementBase.cpp:
-        (WebCore::JSHTMLInputElementBase::JSHTMLInputElementBase):
-        (WebCore::JSHTMLInputElementBase::getOwnPropertySlot):
-        * bindings/js/JSHTMLInputElementBase.h:
-        (WebCore::JSHTMLInputElementBase::classInfo):
-        * bindings/js/JSHTMLObjectElementCustom.cpp:
-        * bindings/js/JSHTMLOptionElementConstructor.cpp:
-        * bindings/js/JSHTMLOptionElementConstructor.h:
-        (WebCore::JSHTMLOptionElementConstructor::classInfo):
-        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
-        * bindings/js/JSHTMLSelectElementCustom.cpp:
-        (WebCore::selectIndexSetter):
-        (WebCore::JSHTMLSelectElement::indexSetter):
-        * bindings/js/JSHTMLSelectElementCustom.h:
-        * bindings/js/JSHistoryCustom.cpp:
-        * bindings/js/JSImageConstructor.cpp:
-        * bindings/js/JSImageConstructor.h:
-        (WebCore::JSImageConstructor::classInfo):
-        * bindings/js/JSInspectedObjectWrapper.cpp:
-        * bindings/js/JSInspectedObjectWrapper.h:
-        (WebCore::JSInspectedObjectWrapper::wrapOutgoingValue):
-        (WebCore::JSInspectedObjectWrapper::classInfo):
-        * bindings/js/JSInspectorCallbackWrapper.cpp:
-        * bindings/js/JSInspectorCallbackWrapper.h:
-        (WebCore::JSInspectorCallbackWrapper::classInfo):
-        (WebCore::JSInspectorCallbackWrapper::wrapOutgoingValue):
-        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
-        * bindings/js/JSLocationCustom.cpp:
-        * bindings/js/JSMimeTypeArrayCustom.cpp:
-        * bindings/js/JSNSResolver.cpp:
-        * bindings/js/JSNSResolver.h:
-        (WebCore::JSNSResolver::create):
-        * bindings/js/JSNamedNodeMapCustom.cpp:
-        * bindings/js/JSNamedNodesCollection.cpp:
-        (WebCore::JSNamedNodesCollection::JSNamedNodesCollection):
-        * bindings/js/JSNamedNodesCollection.h:
-        (WebCore::JSNamedNodesCollection::classInfo):
-        * bindings/js/JSNavigatorCustom.cpp:
-        * bindings/js/JSNodeCustom.cpp:
-        * bindings/js/JSNodeFilterCondition.cpp:
-        (WebCore::JSNodeFilterCondition::acceptNode):
-        * bindings/js/JSNodeFilterCondition.h:
-        (WebCore::JSNodeFilterCondition::create):
-        * bindings/js/JSNodeFilterCustom.cpp:
-        * bindings/js/JSNodeIteratorCustom.cpp:
-        * bindings/js/JSNodeListCustom.cpp:
-        * bindings/js/JSPluginArrayCustom.cpp:
-        * bindings/js/JSPluginCustom.cpp:
-        * bindings/js/JSPluginElementFunctions.cpp:
-        (WebCore::getRuntimeObject):
-        * bindings/js/JSPluginElementFunctions.h:
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::construct):
-        (WebCore::JSQuarantinedObjectWrapper::call):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        (WebCore::JSQuarantinedObjectWrapper::unwrappedObject):
-        (WebCore::JSQuarantinedObjectWrapper::unwrappedGlobalObject):
-        (WebCore::JSQuarantinedObjectWrapper::className):
-        * bindings/js/JSRGBColor.cpp:
-        * bindings/js/JSRGBColor.h:
-        (WebCore::JSRGBColor::classInfo):
-        * bindings/js/JSSQLResultSetRowListCustom.cpp:
-        * bindings/js/JSSQLTransactionCustom.cpp:
-        * bindings/js/JSSVGLazyEventListener.cpp:
-        * bindings/js/JSSVGLazyEventListener.h:
-        * bindings/js/JSSVGLengthCustom.cpp:
-        * bindings/js/JSSVGMatrixCustom.cpp:
-        (WebCore::JSSVGMatrix::inverse):
-        (WebCore::JSSVGMatrix::rotateFromVector):
-        * bindings/js/JSSVGPathSegCustom.cpp:
-        * bindings/js/JSSVGPathSegListCustom.cpp:
-        (WebCore::JSSVGPathSegList::initialize):
-        (WebCore::JSSVGPathSegList::getItem):
-        (WebCore::JSSVGPathSegList::insertItemBefore):
-        (WebCore::JSSVGPathSegList::replaceItem):
-        (WebCore::JSSVGPathSegList::removeItem):
-        (WebCore::JSSVGPathSegList::appendItem):
-        * bindings/js/JSSVGPointListCustom.cpp:
-        * bindings/js/JSSVGTransformListCustom.cpp:
-        * bindings/js/JSStorageCustom.cpp:
-        * bindings/js/JSStyleSheetCustom.cpp:
-        * bindings/js/JSStyleSheetListCustom.cpp:
-        * bindings/js/JSTextCustom.cpp:
-        * bindings/js/JSTreeWalkerCustom.cpp:
-        * bindings/js/JSXMLHttpRequestConstructor.cpp:
-        * bindings/js/JSXMLHttpRequestConstructor.h:
-        (WebCore::JSXMLHttpRequestConstructor::classInfo):
-        * bindings/js/JSXMLHttpRequestCustom.cpp:
-        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
-        * bindings/js/JSXSLTProcessorConstructor.cpp:
-        * bindings/js/JSXSLTProcessorConstructor.h:
-        (WebCore::JSXSLTProcessorConstructor::classInfo):
-        * bindings/js/JSXSLTProcessorCustom.cpp:
-        * bindings/js/ScheduledAction.cpp:
-        * bindings/js/ScheduledAction.h:
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::attachDebugger):
-        (WebCore::ScriptController::windowScriptNPObject):
-        * bindings/js/ScriptController.h:
-        * bindings/js/ScriptControllerGtk.cpp:
-        (WebCore::ScriptController::createScriptInstanceForWidget):
-        * bindings/js/ScriptControllerMac.mm:
-        (WebCore::ScriptController::createScriptInstanceForWidget):
-        (WebCore::ScriptController::windowScriptObject):
-        (WebCore::ScriptController::clearPlatformScriptObjects):
-        (WebCore::updateRenderingForBindings):
-        (WebCore::ScriptController::initJavaJSBindings):
-        * bindings/js/ScriptControllerQt.cpp:
-        (WebCore::ScriptController::createScriptInstanceForWidget):
-        * bindings/js/ScriptControllerWin.cpp:
-        (WebCore::ScriptController::createScriptInstanceForWidget):
-        * bindings/js/ScriptControllerWx.cpp:
-        (WebCore::ScriptController::createScriptInstanceForWidget):
-        * bindings/js/StringSourceProvider.h:
-        (WebCore::StringSourceProvider::getRange):
-        * bindings/objc/DOM.mm:
-        (-[DOMNode JSC::Bindings::]):
-        * bindings/objc/DOMInternal.h:
-        * bindings/objc/DOMInternal.mm:
-        (-[WebScriptObject _initializeScriptDOMNodeImp]):
-        * bindings/objc/DOMUtility.mm:
-        (JSC::createDOMWrapper):
-        (WebCore::createDOMWrapper):
-        * bindings/objc/WebScriptObject.mm:
-        (WebCore::createJSWrapper):
-        (-[WebScriptObject _initWithJSObject:JSC::originRootObject:JSC::Bindings::rootObject:JSC::Bindings::]):
-        * bindings/objc/WebScriptObjectPrivate.h:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/NP_jsobject.cpp:
-        * bridge/NP_jsobject.h:
-        * bridge/c/c_class.cpp:
-        * bridge/c/c_class.h:
-        * bridge/c/c_instance.cpp:
-        * bridge/c/c_instance.h:
-        * bridge/c/c_runtime.cpp:
-        * bridge/c/c_runtime.h:
-        * bridge/c/c_utility.cpp:
-        * bridge/c/c_utility.h:
-        * bridge/jni/jni_class.cpp:
-        * bridge/jni/jni_class.h:
-        * bridge/jni/jni_instance.cpp:
-        * bridge/jni/jni_instance.h:
-        * bridge/jni/jni_jsobject.h:
-        * bridge/jni/jni_jsobject.mm:
-        (JavaJSObject::call):
-        (JavaJSObject::convertJObjectToValue):
-        * bridge/jni/jni_objc.mm:
-        (JSC::Bindings::dispatchJNICall):
-        * bridge/jni/jni_runtime.cpp:
-        * bridge/jni/jni_runtime.h:
-        * bridge/jni/jni_utility.cpp:
-        * bridge/jni/jni_utility.h:
-        * bridge/npruntime.cpp:
-        (_NPN_GetStringIdentifier):
-        * bridge/objc/WebScriptObject.h:
-        * bridge/objc/objc_class.h:
-        * bridge/objc/objc_class.mm:
-        * bridge/objc/objc_instance.h:
-        * bridge/objc/objc_instance.mm:
-        * bridge/objc/objc_runtime.h:
-        * bridge/objc/objc_runtime.mm:
-        * bridge/objc/objc_utility.h:
-        * bridge/objc/objc_utility.mm:
-        * bridge/qt/qt_class.cpp:
-        * bridge/qt/qt_class.h:
-        * bridge/qt/qt_instance.cpp:
-        * bridge/qt/qt_instance.h:
-        * bridge/qt/qt_runtime.cpp:
-        (JSC::Bindings::convertQVariantToValue):
-        (JSC::Bindings::):
-        * bridge/qt/qt_runtime.h:
-        * bridge/runtime.cpp:
-        * bridge/runtime.h:
-        * bridge/runtime_array.cpp:
-        * bridge/runtime_array.h:
-        * bridge/runtime_method.cpp:
-        * bridge/runtime_method.h:
-        * bridge/runtime_object.cpp:
-        * bridge/runtime_object.h:
-        * bridge/runtime_root.cpp:
-        (JSC::Bindings::RootObject::invalidate):
-        (JSC::Bindings::RootObject::gcProtect):
-        (JSC::Bindings::RootObject::gcUnprotect):
-        * bridge/runtime_root.h:
-        * bridge/testbindings.cpp:
-        * bridge/testbindings.mm:
-        * bridge/testqtbindings.cpp:
-        * dom/Document.cpp:
-        (WebCore::Document::~Document):
-        * dom/NSResolver.h:
-        * dom/Node.cpp:
-        (WebCore::Node::setDocument):
-        (WebCore::ResolveNamespaceFunctor::ResolveNamespaceFunctor):
-        (WebCore::resolveNamespacesForSelector):
-        (WebCore::Node::querySelector):
-        (WebCore::Node::querySelectorAll):
-        * dom/Node.h:
-        * dom/NodeFilter.cpp:
-        * dom/NodeFilter.h:
-        * dom/NodeFilterCondition.cpp:
-        * dom/NodeFilterCondition.h:
-        * dom/NodeIterator.cpp:
-        * dom/NodeIterator.h:
-        * dom/Traversal.cpp:
-        * dom/Traversal.h:
-        * dom/TreeWalker.cpp:
-        * dom/TreeWalker.h:
-        * dom/make_names.pl:
-        * history/CachedPage.cpp:
-        * history/CachedPage.h:
-        * html/HTMLPlugInElement.cpp:
-        (WebCore::HTMLPlugInElement::getInstance):
-        * html/HTMLPlugInElement.h:
-        * loader/FrameLoader.cpp:
-        * loader/FrameLoader.h:
-        * loader/icon/IconDatabase.cpp:
-        (WebCore::iconDatabase):
-        * page/Console.cpp:
-        * page/Console.h:
-        * page/InspectorController.cpp:
-        (WebCore::XMLHttpRequestResource::XMLHttpRequestResource):
-        (WebCore::XMLHttpRequestResource::~XMLHttpRequestResource):
-        (WebCore::InspectorResource::setXMLHttpRequestProperties):
-        (WebCore::InspectorResource::sourceString):
-        (WebCore::getResourceDocumentNode):
-        (WebCore::search):
-        (WebCore::InspectorController::focusNode):
-        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
-        (WebCore::InspectorController::addDatabaseScriptResource):
-        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
-        * page/InspectorController.h:
-        (WebCore::InspectorController::profiles):
-        * page/JavaScriptCallFrame.cpp:
-        (WebCore::JavaScriptCallFrame::scopeChain):
-        * page/JavaScriptCallFrame.h:
-        (WebCore::JavaScriptCallFrame::create):
-        (WebCore::JavaScriptCallFrame::update):
-        * page/JavaScriptDebugListener.h:
-        * page/JavaScriptDebugServer.cpp:
-        (WebCore::dispatchDidParseSource):
-        * page/JavaScriptDebugServer.h:
-        * page/JavaScriptProfile.cpp:
-        * page/JavaScriptProfile.h:
-        * page/JavaScriptProfileNode.cpp:
-        (WebCore::getTotalTime):
-        (WebCore::getSelfTime):
-        (WebCore::getTotalPercent):
-        (WebCore::getSelfPercent):
-        (WebCore::getNumberOfCalls):
-        (WebCore::getChildren):
-        (WebCore::getVisible):
-        * page/JavaScriptProfileNode.h:
-        * page/Page.cpp:
-        (WebCore::Page::setDebuggerForAllPages):
-        (WebCore::Page::setDebugger):
-        * page/Page.h:
-        (WebCore::Page::debugger):
-        * page/mac/FrameMac.mm:
-        * platform/KURL.h:
-        (WebCore::KURL::operator JSC::UString):
-        * platform/text/AtomicString.cpp:
-        (WebCore::AtomicString::add):
-        (WebCore::AtomicString::find):
-        * platform/text/AtomicString.h:
-        (WebCore::AtomicString::AtomicString):
-        * platform/text/PlatformString.h:
-        * platform/text/String.cpp:
-        (WebCore::charactersToDouble):
-        * platform/win/BString.cpp:
-        * platform/win/BString.h:
-        * plugins/MimeTypeArray.h:
-        * plugins/Plugin.h:
-        * plugins/PluginArray.h:
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::start):
-        (WebCore::PluginView::performRequest):
-        (WebCore::PluginView::bindingInstance):
-        * plugins/PluginView.h:
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::paint):
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::handleMouseEvent):
-        (WebCore::PluginView::setNPWindowRect):
-        (WebCore::PluginView::stop):
-        (WebCore::PluginView::init):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::setNPWindowRect):
-        (WebCore::PluginView::stop):
-        (WebCore::PluginView::init):
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::dispatchNPEvent):
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::handleMouseEvent):
-        (WebCore::PluginView::setNPWindowRect):
-        (WebCore::PluginView::stop):
-        * storage/Database.cpp:
-        (WebCore::Database::Database):
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::responseText):
-        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
-        (WebCore::XMLHttpRequest::clearResponse):
-        (WebCore::XMLHttpRequest::dropProtection):
-        (WebCore::XMLHttpRequest::didFinishLoading):
-        (WebCore::XMLHttpRequest::didReceiveData):
-        * xml/XMLHttpRequest.h:
-
-2008-09-07  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Sam Weinig.
-
-        Adopt opener restriction on frame navigation.
-          https://bugs.webkit.org/show_bug.cgi?id=20642
-
-        This restriction helps prevent an attacker from navigating top-level
-        windows that were created by another web site.
-
-        Tests: http/tests/security/frameNavigation/not-opener.html
-               http/tests/security/frameNavigation/opener.html
-
-        * loader/FrameLoader.cpp:
-        (WebCore::canAccessAncestor):
-        (WebCore::FrameLoader::shouldAllowNavigation):
-
-2008-09-07  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Maciej Stachowiak.
-
-        - use the correct sign for vertical offsets of combining marks
-
-        * platform/graphics/win/UniscribeController.cpp:
-        (WebCore::UniscribeController::shapeAndPlaceItem):
-
-2008-09-07  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        - add the combining mark offsets in two places where I forgot them
-
-        * platform/graphics/win/FontCGWin.cpp:
-        (WebCore::Font::drawGlyphs):
-
-2008-09-07  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        - correct glyph advances in complex text using web fonts rendered with
-          Core Graphics
-
-        * platform/graphics/win/FontCustomPlatformData.cpp:
-        (WebCore::FontCustomPlatformData::fontPlatformData):
-
-2008-09-07  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Adds console.dirxml support to the Web Inspector.
-
-        https://bugs.webkit.org/show_bug.cgi?id=19156
-
-        Reviewed by Timothy Hatcher.
-
-        * WebCore.vcproj/WebCore.vcproj: Added ElementsTreeOutline.js.
-        * bindings/js/JSConsoleCustom.cpp:
-        (WebCore::JSConsole::dirxml):
-        * page/Console.cpp:
-        (WebCore::Console::dirxml): Adds a ConsoleMessage with NodeMessageLevel.
-        * page/Console.h:
-        (WebCore::): Added NodeMessageLevel.
-        * page/Console.idl: Added console.dirxml.
-        * page/inspector/Console.js: A NodeMessage creates a ElementsTreeOutline.
-        * page/inspector/ElementsPanel.js: Modified to use ElementsTreeOutline. The ElementsTreeOutline 
-        in the ElementsPanel has includeRootDOMNode and selectEnabled set to true.
-        * page/inspector/ElementsTreeOutline.js: Added.
-        (WebInspector.ElementsTreeOutline): A subclass of TreeOutline for displaying a DOM node tree.
-        (WebInspector.ElementsTreeElement): A subclass of TreeElement for ElementsTreeOutline.
-        * page/inspector/WebKit.qrc: Added ElementsTreeOutline.js.
-        * page/inspector/inspector.css:
-        * page/inspector/inspector.html: Added ElementsTreeOutline.js.
-        * page/inspector/inspector.js: Moved hover related methods to WebInspector.
-        (WebInspector.altKeyDown):
-        (WebInspector.forceHoverHighlight):
-        (WebInspector.hoveredDOMNode):
-        (WebInspector._updateHoverHighlightSoon):
-        (WebInspector._updateHoverHighlight):
-        (WebInspector.documentKeyDown): Updates WebInspector.altKeyDown
-        (WebInspector.documentKeyUp): Updates WebInspector.altKeyDown
-        * page/inspector/utilities.js: Added getDocumentForNode, parentNodeOrFrameElement,
-        isAncestorIncludingParentFrames.
-
-2008-09-06  Mark Rowe  <mrowe@apple.com>
-
-        Qt build fix.
-
-        * bridge/qt/qt_runtime.cpp:
-        (KJS::Bindings::convertQVariantToValue):
-
-=== End merge of squirrelfish-extreme ===
-
-2008-09-05  Oliver Hunt  <oliver@apple.com>
-
-        Start bringing up SFX on windows.
-
-        Reviewed by Mark Rowe and Sam Weinig
-
-        Start doing the work to bring up SFX on windows.  Initially
-        just working on WREC, as it does not make any calls so reduces
-        the amount of code that needs to be corrected.
-
-        Add forwarding headers
-
-        * ChangeLog:
-        * ForwardingHeaders/masm/MacroAssembler.h: Added.
-        * WebCore.vcproj/WebCore.vcproj:
-
-2008-08-27  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Oliver Hunt.
-
-        Fix the build of the full WebKit stack.
-
-        Add forwarding headers.
-
-        * ForwardingHeaders/masm/IA32MacroAsm.h: Added.
-        * ForwardingHeaders/wrec/WREC.h: Added.
-
-=== Start merge of squirrelfish-extreme ===
-
-2008-09-06  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        <rdar://problem/6187043> 
-        Don't parse full HTML user agent style sheet unless it is actually needed
-        <rdar://problem/6131889> 
-        WebView is significantly more expensive to create recently
+        (WebCore::MediaPlayerPrivate::hasSetUpVideoRendering):
+        Small utility method.
         
-        Parsing the html4.css takes significant amount of time and memory (~50kb) on application
-        startup. Some clients may never use most of the rules.
+        (WebCore::MediaPlayerPrivate::updateStates):
+        Move the call to setUpVideoRendering() to before we send out the state notifications,
+        so that we will have created the rendering objects already.
         
-        With this patch we use simplified UA stylesheet until we hit something it can't handle. 
-        This avoids full stylesheet parsing on application startup (due to empty document construction)
-        and also makes it possible for clients with very simple demands (divs and spans only) never to load 
-        the full style.
+        (WebCore::MediaPlayerPrivate::supportsAcceleratedRendering):
+        Return true if we have QTMovieLayer.
         
-        It also delays view source style parsing until it is used.
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::elementCanUseSimpleDefaultStyle):
-        (WebCore::CSSStyleSelector::CSSStyleSelector):
-        (WebCore::loadFullDefaultStyle):
-        (WebCore::loadSimpleDefaultStyle):
-        (WebCore::loadViewSourceStyle):
-        (WebCore::CSSStyleSelector::matchUARules):
-        (WebCore::CSSStyleSelector::styleForElement):
-
-2008-09-06  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix.
-
-        * WebCoreSources.bkl:
-
-2008-09-06  Antti Koivisto  <antti@apple.com>
-
-        Reverting r35953 which was causing problems on Windows which relies on
-        WebCore timers in nested event loops. r36132 did alternative fix.
-
-        * page/Chrome.cpp:
-        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
-        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
-
-2008-09-06  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Fix <rdar://problem/6201644>
-        https://bugs.webkit.org/show_bug.cgi?id=20493
-        Crash after OK in dialog box and reloading page in secure mode
+        (WebCore::MediaPlayerPrivate::acceleratedRenderingStateChanged):
+        We've been told that we went into or out of accelerated mode; maybe reset
+        the renderer, and set the layer if we have to.
         
-        Limited loader only fix since the general timer fix is causing problems on Windows.
-
-        * loader/loader.cpp:
-        (WebCore::Loader::servePendingRequests):
-        (WebCore::Loader::Host::Host):
-        (WebCore::Loader::Host::didFinishLoading):
-        (WebCore::Loader::Host::didFail):
-        (WebCore::Loader::Host::didReceiveData):
-        * loader/loader.h:
-        (WebCore::Loader::Host::processingResource):
-
-2008-09-06  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        The initial Core Text adoption prototype was made by Daniel Fenwick.
-
-        - <rdar://problem/5158514> Add a Core Text-based complex text code path
-
-        Currently the Core Text code path is not used in any configuration.
-
-        * WebCore.xcodeproj/project.pbxproj: Added files.
-        * config.h: Defined WTF_USE_ATSUI and WTF_USE_CORE_TEXT.
-        * platform/graphics/Font.cpp:
-        (WebCore::WidthIterator::advance): Moved the spacingDisabled() test out
-        of the loop.
-        * platform/graphics/GlyphBuffer.h:
-        (WebCore::GlyphBuffer::add): Added this version that takes an advance.
-        * platform/graphics/SimpleFontData.h: Added ATSUI and CORE_TEXT #ifdefs.
-        Added getCTFont() and getCFStringAttributes() and corresponding data
-        members for Core Text.
-        * platform/graphics/mac/CoreTextController.cpp: Added.
-        (WebCore::roundCGFloat): Helper function.
-        (WebCore::ceilCGFloat): Helper function.
-        (WebCore::CoreTextController::CoreTextRun::CoreTextRun):
-        (WebCore::CoreTextController::CoreTextController):
-        (WebCore::CoreTextController::offsetForPosition):
-        (WebCore::CoreTextController::collectCoreTextRuns): Added. Segments the
-        run into subruns as necessary such that each subrun can be rendered with
-        a single font. Also separates out soft hyphens and replaces them with
-        real hyphens, because Core Text does not emit a glyph for soft hyphens.
-        Then calls collectCoreTextRunsForCharacters() on each subrun.
-        (WebCore::CoreTextController::advance):
-        (WebCore::CoreTextController::collectCoreTextRunsForCharacters): Creates
-        a CTLine from the given subrun and collects its CoreTextRuns.
-        (WebCore::CoreTextController::adjustGlyphsAndAdvances): Applies the
-        rounding hacks, letter- and word-spacing and glyph substitutions and
-        stores the resulting adjusted glyphs and advances.
-        * platform/graphics/mac/CoreTextController.h: Copied from WebCore/platform/graphics/win/UniscribeController.h.
-        (WebCore::CoreTextController::totalWidth):
-        (WebCore::CoreTextController::finalRoundingWidth):
-        (WebCore::CoreTextController::CoreTextRun::ctRun):
-        (WebCore::CoreTextController::CoreTextRun::glyphCount):
-        (WebCore::CoreTextController::CoreTextRun::fontData):
-        (WebCore::CoreTextController::CoreTextRun::characters):
-        (WebCore::CoreTextController::CoreTextRun::stringLocation):
-        (WebCore::CoreTextController::CoreTextRun::stringLength):
-        (WebCore::CoreTextController::CoreTextRun::indexAt):
-        * platform/graphics/mac/FontMac.mm: Moved the ATSUI-specific parts to
-        FontMacATSUI.mm.
-        * platform/graphics/mac/FontMacATSUI.mm: Copied from WebCore/platform/graphics/mac/FontMac.mm.
-        (WebCore::disableLigatures): Changed to call
-        FontPlatformData::allowsLigatures().
-        (WebCore::overrideLayoutOperation): Changed to call
-        FontPlatformData::roundsGlyphAdvances().
-        * platform/graphics/mac/FontMacCoreText.cpp: Copied from WebCore/platform/graphics/win/FontWin.cpp.
-        (WebCore::Font::selectionRectForComplexText): Changed to use
-        totalWidth() instead of advancing to the end and using runWidthSoFar().
-        (WebCore::Font::drawComplexText):
-        (WebCore::Font::floatWidthForComplexText): Ditto.
-        (WebCore::Font::offsetForPositionForComplexText):
-        * platform/graphics/mac/FontPlatformData.h:
-        * platform/graphics/mac/FontPlatformDataMac.mm:
-        (WebCore::FontPlatformData::setFont):
-        (WebCore::FontPlatformData::roundsGlyphAdvances): Added. Checks the
-        AppKit rendering mode.
-        (WebCore::FontPlatformData::allowsLigatures): Added. Implements the
-        heuristic that allows ligatures in fonts that do not have a glyph for
-        'a', based on the assumption that such fonts are only used in complex
-        text.
-        * platform/graphics/mac/SimpleFontDataMac.mm:
-        (WebCore::SimpleFontData::platformInit):
-        (WebCore::SimpleFontData::platformDestroy):
-        (WebCore::SimpleFontData::getCTFont): Added.
-        (WebCore::SimpleFontData::getCFStringAttributes): Added. Caches and
-        returns an attributes dictionary.
-        * platform/text/mac/ShapeArabic.c: Added ATSUI #ifdefs.
-        * platform/text/mac/ShapeArabic.h: Ditto.
-
-2008-09-06  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        - make combining mark offsets work in CG text on Windows
-
-        * platform/graphics/win/FontCGWin.cpp:
-        (WebCore::Font::drawGlyphs): The old code tried to translate the text
-        matrix, but failed for two reasons: it did not actually change the
-        matrix, and even if it did, CGContextSetTextPosition overwrites the
-        translation values in the text matrix. Instead, just added the
-        translation to the anchor point.
-
-2008-09-05  Gustavo Noronha Silva  <gns@gnome.org>
-
-        Reviewed by Alp Toker.
-
-        https://bugs.webkit.org/show_bug.cgi?id=18346
-        [GTK] Remove build warnings
-
-        Applied some casts, and removed an unused typedef to make the
-        compiler happy, printing less warnings when building.
-
-        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
-        * platform/graphics/gtk/SimpleFontDataPango.cpp:
-        (WebCore::SimpleFontData::containsCharacters):
-        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
-        (webkit_video_sink_set_caps):
-        * platform/network/soup/ResourceHandleSoup.cpp:
-
-2008-09-05  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Adam Roben.
-
-        Build fix for WebKitWin and Chromium
-
-        * platform/FileSystem.h:
-
-2008-09-05  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Try to make Chromium compile with ToT:
-        - Wrap a few places which depend on KJS:: in #if USE(JSC)
-        - Include some windows forward declarations
-
-        * dom/Node.h:
-        * page/Console.h:
-        * page/animation/CompositeAnimation.h:
-        * platform/FileSystem.h:
-        * platform/graphics/Image.h:
-        * platform/text/AtomicString.h:
-        * platform/text/String.cpp:
-        * rendering/style/RenderStyle.h:
-
-2008-09-05  Dave Hyatt  <hyatt@apple.com>
-
-        Add support for runtime switchability of the Aqua look and the native look on Windows.
-        Make RenderThemeWin compile by default even when USE(SAFARI_THEME) is set.
-
-        Reviewed by Adam Roben
-
-        * WebCore.vcproj/WebCore.vcproj:
-        * page/Settings.cpp:
-        (WebCore::Settings::setShouldPaintNativeControls):
-        * page/Settings.h:
-        (WebCore::Settings::shouldPaintNativeControls):
-        * rendering/RenderThemeSafari.cpp:
-        (WebCore::theme):
-        * rendering/RenderThemeWin.cpp:
-
-2008-09-05  Antti Koivisto  <antti@apple.com>
-
-        Qt build fix.
-
-        * svg/SVGFEImageElement.cpp:
-        (WebCore::SVGFEImageElement::build):
-
-2008-09-05  Dirk Schulze  <vbs85@gmx.de>
-
-        Gtk build fix
-
-        * GNUmakefile.am:
-
-2008-09-05  Antti Koivisto  <antti@apple.com>
-
-        Another build fix.
-
-        * svg/SVGFEImageElement.cpp:
-        (WebCore::SVGFEImageElement::notifyFinished):
-
-2008-09-05  Antti Koivisto  <antti@apple.com>
-
-        Build fixes.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::rendererContentChanged):
+        We may need to udpate compositing layers if the video went into accelerated mode.
         
-        * WebCore.xcodeproj/project.pbxproj:
-        * svg/graphics/filters/SVGFEImage.cpp:
-        (WebCore::FEImage::cachedImage):
-
-2008-09-05  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Most of the implementation for https://bugs.webkit.org/show_bug.cgi?id=17998
-        When a resource is cached locally, WebKit should follow RFC 2616 "Specific end-to-end revalidation" instead of "Unspecified end-to-end revalidation"
-
-        Implement HTTP 1.1 "Specific end-to-end revalidation" for WebCore memory cache. This patch does
-        not yet enable it for the biggest use case, reloading. However it is good for general browsing as
-        well. Doing this in WebCore level as opposed to relying on disk cache has big benefit that
-        we avoid re-decoding resources, especially images. 
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::canUseDirectCompositing):
+        Add smarts to deal with video, which allows us to avoid extra backing store.
         
-        To be exact the enabled case is not actually the "Specific end-to-end revalidation" since it does not include
-        CacheControl: max-age=0 header. That would be added in reload case.
+        (WebCore::RenderLayerBacking::contentsBox):
+        Use the videoBox to use the content layer for video layers.
         
-        The approach for revalidation is to kick the original resource out from the memory cache
-        and create a new CachedResource that represents the revalidation request. In case
-        we get 304 back for the request we put the original resource back to the cache, update 
-        its expiration date and switch the clients registered to revalidation resource to be
-        clients of the original resource.
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        Poke the RenderVideo if the state changed.
         
-        All heap allocated CachedImage pointers now use CachedResourceHandle<CachedImage> (and so on) instead.
-        This allows updating the handles to point to the original resource when the revalidation succeeds. It
-        also acts as refcounting smart pointer.
-
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * css/CSSFontFaceSource.h:
-        * css/CSSImportRule.h:
-        * dom/Clipboard.h:
-        (WebCore::Clipboard::dragImage):
-        * dom/ProcessingInstruction.h:
-        * dom/ScriptElement.h:
-        * dom/XMLTokenizer.cpp:
-        (WebCore::XMLTokenizer::isWaitingForScripts):
-        * dom/XMLTokenizer.h:
-        * html/HTMLImageLoader.cpp:
-        (WebCore::HTMLImageLoader::setImage):
-        (WebCore::HTMLImageLoader::updateFromElement):
-        (WebCore::HTMLImageLoader::notifyFinished):
-        * html/HTMLImageLoader.h:
-        (WebCore::HTMLImageLoader::image):
-        * html/HTMLLinkElement.h:
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::reset):
-        (WebCore::HTMLTokenizer::scriptHandler):
-        (WebCore::HTMLTokenizer::notifyFinished):
-        * html/HTMLTokenizer.h:
-        * loader/Cache.cpp:
-        (WebCore::Cache::revalidateResource):
-        (WebCore::Cache::revalidationSucceeded):
-        (WebCore::Cache::revalidationFailed):
-        * loader/Cache.h:
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::CachedResource):
-        (WebCore::CachedResource::~CachedResource):
-        (WebCore::CachedResource::isExpired):
-        (WebCore::CachedResource::setResponse):
-        (WebCore::CachedResource::deleteIfPossible):
-        (WebCore::CachedResource::setResourceToRevalidate):
-        (WebCore::CachedResource::clearResourceToRevalidate):
-        (WebCore::CachedResource::switchClientsToRevalidatedResource):
-        (WebCore::CachedResource::canUseCacheValidator):
-        (WebCore::CachedResource::mustRevalidate):
-        * loader/CachedResource.h:
-        (WebCore::CachedResource::canDelete):
-        (WebCore::CachedResource::registerHandle):
-        (WebCore::CachedResource::unregisterHandle):
-        (WebCore::CachedResource::isCacheValidator):
-        (WebCore::CachedResource::resourceToRevalidate):
-        (WebCore::CachedResource::setExpirationDate):
-        * loader/CachedResourceHandle.cpp: Added.
-        (WebCore::CachedResourceHandleBase::setResource):
-        * loader/CachedResourceHandle.h: Added.
-        (WebCore::CachedResourceHandleBase::~CachedResourceHandleBase):
-        (WebCore::CachedResourceHandleBase::get):
-        (WebCore::CachedResourceHandleBase::operator!):
-        (WebCore::CachedResourceHandleBase::operator UnspecifiedBoolType):
-        (WebCore::CachedResourceHandleBase::CachedResourceHandleBase):
-        (WebCore::CachedResourceHandleBase::operator=):
-        (WebCore::CachedResourceHandle::CachedResourceHandle):
-        (WebCore::CachedResourceHandle::get):
-        (WebCore::CachedResourceHandle::operator->):
-        (WebCore::CachedResourceHandle::operator=):
-        (WebCore::CachedResourceHandle::operator==):
-        (WebCore::CachedResourceHandle::operator!=):
-        (WebCore::operator==):
-        (WebCore::operator!=):
-        * loader/DocLoader.cpp:
-        (WebCore::DocLoader::checkForReload):
-        * loader/UserStyleSheetLoader.h:
-        * loader/loader.cpp:
-        (WebCore::Loader::Host::servePendingRequests):
-        (WebCore::Loader::Host::didFinishLoading):
-        (WebCore::Loader::Host::didFail):
-        (WebCore::Loader::Host::didReceiveResponse):
-        (WebCore::Loader::Host::didReceiveData):
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::selectCursor):
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::setCachedImage):
-        (WebCore::RenderImage::imageChanged):
-        * rendering/RenderImage.h:
-        (WebCore::RenderImage::cachedImage):
-        (WebCore::RenderImage::imagePtr):
-        * rendering/style/RenderStyle.h:
-        * rendering/style/StyleCachedImage.h:
-        (WebCore::StyleCachedImage::data):
-        (WebCore::StyleCachedImage::cachedImage):
-        * svg/SVGFEImageElement.h:
-        * svg/graphics/filters/SVGFEImage.h:
-        * xml/XSLImportRule.h:
-
-2008-09-04  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Mitz
-
-        <rdar://problem/6180236> - Safari times out connections after 1 or 2 minutes
-
-        A 60-second default timeout was added in http://trac.webkit.org/changeset/17144 in an attempt 
-        to model default NSURLRequest behavior in a cross-platform manner.  
-
-        Sadly by always enforcing this 60 second timeout, WebCore was stomping over the wishes of any Webkit 
-        client that wished to enforce a much larger default timeout using NSURLRequest API.
-
-        Additionally, upon reviewing what all other browsers do, it seems apparent that "no limit" is desirable
-        behavior on the web and this restores previous Safari/WebKit behavior.
-
-        It would be easy to write a layout test for this, but to be effective it would have
-        to run for at least 61 seconds, which seems insane until will can parallelize run-webkit-tests
-
-        * manual-tests/timeout-test.html: Added.
-        * manual-tests/timeout-test.php: Added.
-
-        * platform/network/ResourceRequestBase.h:
-        (WebCore::ResourceRequestBase::ResourceRequestBase):  Rename the constant to "unspecifiedTimeoutInterval"
-          and make it UINT_MAX so platforms that do set it have an effective "no timeout."  (Windows, for example)
-        * platform/network/mac/ResourceRequestMac.mm:
-        (WebCore::ResourceRequest::doUpdatePlatformRequest):  If the timeout for this request is 
-          "unspecifiedTimeoutInterval", then don't bother setting the timeout using NSURLRequest API, allowing
-          WebKit applications to enforce their own default timeout.
-
-2008-09-04  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        - fix <rdar://problem/6198514> Changing a button's opacity triggers relayout
-
-        Test: fast/repaint/button-spurious-layout-hint.html
-
-        * rendering/RenderButton.cpp:
-        (WebCore::RenderButton::setStyle): Reset the inner block's style box
-        flex to 0 to avoid getting a spurious layout hint. 
-
-2008-09-04  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fixes.
-
-        * WebCoreSources.bkl:
-        * bindings/js/ScriptControllerWx.cpp: Added.
-        (WebCore::ScriptController::createScriptInstanceForWidget):
-        * page/wx/AccessibilityObjectWx.cpp: Added.
-        (WebCore::AccessibilityObject::accessibilityIgnoreAttachment):
-        * platform/graphics/wx/GraphicsContextWx.cpp:
-        * webcore-base.bkl:
-        * webcore-wx.bkl:
-
-2008-09-04  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Mark Rowe.
-
-        - roll out r36050 because it made svg/custom/invalid-fill-hex.svg fail,
-          and fixing https://bugs.webkit.org/show_bug.cgi?id=15360 appears to
-          require a different approach
-
-        * css/CSSGrammar.y:
-
-2008-09-04  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Eric Seidel.
-
-        Fix https://bugs.webkit.org/show_bug.cgi?id=20639.
-        Bug 20639: ENABLE_DASHBOARD_SUPPORT does not need to be a FEATURE_DEFINE
-
-        * Configurations/WebCore.xcconfig: Remove ENABLE_DASHBOARD_SUPPORT from FEATURE_DEFINES.
-        * DerivedSources.make: Revert to checking for ENABLE_DASHBOARD_SUPPORT rather than looking
-        for ENABLE_DASHBOARD_SUPPORT in FEATURE_DEFINES.
-
-2008-09-04  Mark Rowe  <mrowe@apple.com>
-
-        Mac build fix.
-
-        * config.h: Only check the value of HAVE_CONFIG_H if it is defined.
-
-2008-09-04  Eric Seidel  <eric@webkit.org>
-
-        Build fix only, no review.
-
-        * dom/XMLTokenizer.cpp: Fix the Chromium merge build by adding a missing header (the Mac files must include it somewhere).
-
-2008-09-04  Marco Barisione  <marco.barisione@collabora.co.uk>
-
-        Reviewed by Eric Seidel.
-
-        http://bugs.webkit.org/show_bug.cgi?id=20380
-        [GTK][AUTOTOOLS] Include autotoolsconfig.h from config.h
-
-        * config.h: Include the configuration header generated by autotools if
-        available.
-
-2008-09-04  Dan Bernstein  <mitz@apple.com>
-
-        Rubber-stamped by Dave Hyatt.
-
-        - rename CachedResource::allReferencesRemoved() to allClientsRemoved()
-
-        * loader/CachedFont.cpp:
-        (WebCore::CachedFont::allClientsRemoved):
-        * loader/CachedFont.h:
-        * loader/CachedImage.cpp:
-        (WebCore::CachedImage::allClientsRemoved):
-        * loader/CachedImage.h:
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::removeClient):
-        * loader/CachedResource.h:
-        (WebCore::CachedResource::allClientsRemoved):
-
-2008-09-04  Adam Roben  <aroben@apple.com>
-
-        Windows build fix after r36071
-
-        We were getting these errors:
-
-        error C2356: initialization segment must not change during translation
-        unit
-
-        This was happening because multiple files #included by
-        DerivedSources.cpp were themselves #including StaticConstructors.h. I
-        fixed the error by adding header guards to StaticConstructors.h so its
-        contents will only be included once.
-
-        But it's also not a good idea for StaticConstructors.h to end up in
-        DerivedSources.cpp, since it ends up "polluting" all the source files
-        we have in there. So I removed all the files that include
-        StaticConstructors.h and added some preprocessor directives to
-        DerivedSources.cpp to catch this error in the future.
-
-        * DerivedSources.cpp: Removed the *Names.cpp files, which include
-        StaticConstructors.h, and added some preprocessor directives to make
-        sure we don't end up accidentally including StaticConstructors.h in
-        the future.
-        * WebCore.vcproj/WebCore.vcproj: Added the *Names.cpp files.
-        * platform/StaticConstructors.h: Added header guards.
-
-2008-09-04  Adam Roben  <aroben@apple.com>
-
-        Windows build fix
-
-        * platform/graphics/win/FontPlatformData.h: Added a missing #include
-        of PassRefPtr.h, and corrected the capitalization of RefCounted.h.
-        * platform/text/PlatformString.h: Added a missing #include of
-        PassRefPtr.h.
-
-2008-09-04  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon.
-
-        Fix the QtWebKit build to match changes in r36016
-
-        * WebCore.pro:
-        * bridge/qt/qt_instance.cpp:
-        (KJS::Bindings::QtInstance::getRuntimeObject):
-        * bridge/qt/qt_runtime.cpp:
-        (KJS::Bindings::convertQVariantToValue):
-        (KJS::Bindings::QtConnectionObject::execute):
-
-2008-09-04  Tor Arne Vestbø  <tavestbo@trolltech.com>
-
-        Reviewed by Simon.
-
-        Re-enable support for user stylesheets in QtWebKit
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        Handle an edge case when the video element itself is a stacking context
+        because of opacity or transform.
         
-        QtWebKit now follows the FRAME_LOADS_USER_STYLESHEET
-        code path, which allows us to keep API support for
-        loading user style sheets from remote URLs.
+        (WebCore::RenderLayerCompositor::canAccelerateVideoRendering):
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::requiresCompositingForVideo):
+        Allow video to throw us into compositing mode if the media engine supports it.
         
-        As part of the change UserStyleSheetLoader.cpp/h was
-        moved from WebCore/loader/mac to WebCore/loader.
-
-        * WebCore.pro:
-        * WebCore.xcodeproj/project.pbxproj:
-        * dom/Document.h:
-        * loader/UserStyleSheetLoader.cpp: Renamed from WebCore/loader/mac/UserStyleSheetLoader.cpp.
-        (UserStyleSheetLoader::UserStyleSheetLoader):
-        (UserStyleSheetLoader::~UserStyleSheetLoader):
-        * loader/UserStyleSheetLoader.h: Renamed from WebCore/loader/mac/UserStyleSheetLoader.h.
-        * page/qt/FrameQt.cpp:
-        (WebCore::Frame::setUserStyleSheetLocation):
-        (WebCore::Frame::setUserStyleSheet):
-
-2008-09-04  Alp Toker  <alp@nuanti.com>
-
-        Reviewed by Eric.
-
-        Remove left-over QT and CAIRO platform checks.
-
-        * html/CanvasRenderingContext2D.cpp:
-
-2008-09-04  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Fix leak of TextMetrics due to over-ref as see on buildbot.
-
-        * html/TextMetrics.h: use adoptRef since RefCounted starts @ refcount 1 instead of 0 now.
-
-2008-09-04  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=19717
-          <rdar://problem/6026832> REGRESSION (r31876): menu items render horizontally at the Economist
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::layoutOnlyPositionedObjects): In the
-        positioned movement only case, call
-        tryLayoutDoingPositionedMovementOnly() and fall back on doing a full
-        layout if that fails.
-        (WebCore::RenderBlock::layoutPositionedObjects): Ditto.
-        * rendering/RenderBox.h:
-        (WebCore::RenderBox::tryLayoutDoingPositionedMovementOnly): Renamed
-        layoutDoingPositionedMovementOnly to this, and made this function
-        check if the width changed. If it did, return, leaving the object
-        dirty. The caller can then call layout(). The width can change even
-        in the "positioned movement only" case if the object is shrink-to-fit
-        and the available width constraint is met. (This was the case in the
-        bug).
-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::tryLayoutDoingPositionedMovementOnly):
-        Renamed layoutDoingPositionedMovementOnly() to this.
-
-2008-09-03  Eric Seidel  <eric@webkit.org>
-
-        No review, build fix only.
-
-        Attempt to fix the Qt build.
-
-        * WebCore.pro: add page/animation to include path
-
-2008-09-03  Mark Rowe  <mrowe@apple.com>
-
-        Mac build fix.  Correctly detect whether dashboard support is enabled.
-
-        * DerivedSources.make:
-
-2008-09-03  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Sam.
-
-        Clean up Platform.h and add PLATFORM(CHROMIUM), PLATFORM(SKIA) and USE(V8_BINDINGS)
+        * rendering/RenderLayerCompositor.h:
+        New methods related to video.
+        
+        * rendering/RenderVideo.h:
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::updatePlayer):
+        Call rendererContentChanged() to give the compositor a change to throw the video into
+        compositing mode.
+        
+        (WebCore::RenderVideo::supportsAcceleratedRendering):
+        (WebCore::RenderVideo::acceleratedRenderingStateChanged):
+        (WebCore::RenderVideo::videoGraphicsLayer):
+        Methods to allow the MediaPlayer to do rendering-related stuff via the media element.
 
-        * Configurations/WebCore.xcconfig: add missing ENABLE_*
-        * config.h: add rules for V8_BINDINGS
+2009-06-18  Rob Buis  <rwlbuis@gmail.com>
 
-2008-09-03  Eric Seidel  <eric@webkit.org>
+        Reviewed by Niko.
 
-        Reviewed by Sam.
+        https://bugs.webkit.org/show_bug.cgi?id=26385
+        Root SVG element is not checked on requiredFeatures, requiredExtension like other elements
 
-        https://bugs.webkit.org/show_bug.cgi?id=20620
+        Also do the isValid check for outer <svg>.
 
-        Add #if USE(JSC) around KJS dependencies
-        Remove !USE(JAVASCRIPTCORE_BINDINGS) support for 3 reasons:
-        1. Most platforms have it on anyway
-        2. V8 is going to want to share some of that code
-        3. Those platforms which want it off, should have a separate file instead of an #ifdef in our .cpp
+        Test: svg/custom/outer-svg-unknown-feature.svg
 
-        * bindings/js/JSPluginElementFunctions.cpp: remove !USE(JAVASCRIPTCORE_BINDINGS) support
-        * config.h: change JAVASCRIPTCORE_BINDINGS to JSC and add USE(V8)
-        * html/HTMLAppletElement.cpp: remove USE(JAVASCRIPTCORE_BINDINGS) wrappers
-        * html/HTMLAppletElement.h: remove USE(JAVASCRIPTCORE_BINDINGS) wrappers
-        * html/HTMLEmbedElement.cpp: remove USE(JAVASCRIPTCORE_BINDINGS) wrappers
-        * html/HTMLEmbedElement.h: remove USE(JAVASCRIPTCORE_BINDINGS) wrappers
-        * html/HTMLObjectElement.cpp: remove USE(JAVASCRIPTCORE_BINDINGS) wrappers
-        * html/HTMLObjectElement.h: remove USE(JAVASCRIPTCORE_BINDINGS) wrappers
-        * html/HTMLPlugInElement.cpp: replace USE(JAVASCRIPTCORE_BINDINGS) with USE(JSC) where needed
-        * html/HTMLPlugInElement.h: replace USE(JAVASCRIPTCORE_BINDINGS) with USE(JSC) where needed
-        * platform/text/AtomicString.cpp: add USE(JSC)
-        * platform/text/AtomicString.h: add USE(JSC)
-        * platform/text/PlatformString.h: add USE(JSC)
-        * platform/text/String.cpp: add USE(JSC)
-        * platform/text/StringImpl.cpp: add USE(JSC)
-        * platform/text/StringImpl.h: add USE(JSC)
+        * svg/SVGDocument.cpp:
+        (WebCore::SVGDocument::childShouldCreateRenderer):
+        * svg/SVGDocument.h:
 
-2008-09-03  Dean McNamee  <deanm@chromium.org>
+2009-06-18  Dan Bernstein  <mitz@apple.com>
 
         Reviewed by Darin Adler.
 
-        Fix https://bugs.webkit.org/show_bug.cgi?id=20511
-        Bug 20511: Remove static initializers on Windows
-
-        Avoid static initializers on Windows by forcing Visual C++ to put
-        all static initializers in a code segment that is never executed.
+        - fix <rdar://problem/6913221> REGRESSION (Safari 3-4): Search field on
+          apple.com cuts entered text
 
-        * config.h:
-        * css/MediaFeatureNames.cpp:
-        * dom/EventNames.cpp:
-        * dom/QualifiedName.cpp:
-        * dom/make_names.pl:
-        * platform/StaticConstructors.h:
-        * platform/text/AtomicString.cpp:
-
-2008-09-03  Dirk Schulze  <vbs85@gmx.de>
-
-        Reviewed by Dave Hyatt.
+        Test: fast/forms/search-vertical-alignment.html
 
-        Make FontCairo draw TextStroke and TextFill separately.
-
-        [CAIRO] draw TextFill and TextStroke separately.
-        [https://bugs.webkit.org/show_bug.cgi?id=20631]
-
-        * platform/graphics/cairo/FontCairo.cpp:
-        (WebCore::Font::drawGlyphs):
-
-2008-09-03  Peter Kasting  <pkasting@google.com>
-
-        Reviewed by Dave Hyatt.
-
-        https://bugs.webkit.org/show_bug.cgi?id=19663
-        Account for paint and timer lag when animating images.  Also pretend
-        that images whose animations were paused (by becoming invisible)
-        continued to animate, by "catching up" to the correct frame when they're
-        shown again.
-
-        * platform/graphics/BitmapImage.cpp:
-        (WebCore::BitmapImage::BitmapImage):
-        (WebCore::BitmapImage::startAnimation):
-        (WebCore::BitmapImage::advanceAnimation):
-        (WebCore::BitmapImage::internalAdvanceAnimation):
-        (WebCore::BitmapImage::notifyObserverAndTrimDecodedData):
-        * platform/graphics/BitmapImage.h:
-        * platform/graphics/cairo/ImageCairo.cpp:
-        (WebCore::BitmapImage::draw):
-        * platform/graphics/cg/ImageCG.cpp:
-        (WebCore::BitmapImage::draw):
-        * platform/graphics/qt/ImageQt.cpp:
-        (WebCore::BitmapImage::draw):
-        * platform/graphics/wx/ImageWx.cpp:
-        (WebCore::BitmapImage::draw):
-
-2008-09-03  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Tim.
-
-        Remove the rest of the "zombie" code from the profiler.
-        - There is no longer a need for the ProfilerClient callback mechanism.
-
-        * page/Console.cpp: 
-        (WebCore::Console::Console):
-        (WebCore::Console::profile):
-        (WebCore::Console::profileEnd): Move the variables from the header to
-        here since we don't have to wait for a callback to use them.
-        * page/Console.h:
-        * page/InspectorController.cpp:
-        (WebCore::InspectorController::startUserInitiatedProfiling):
-        (WebCore::InspectorController::stopUserInitiatedProfiling):
-        * page/InspectorController.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::layout): Vertically center the
+            the search field's inner block.
 
-2008-09-03  Ada Chan  <adachan@apple.com>
+2009-06-18  Janne Koskinen  <janne.p.koskinen@digia.com>
 
-        Windows build fix.
+        Reviewed by Simon Hausmann.
 
-        * WebCore.vcproj/WebCore.vcproj: Added JSWebKitCSSKeyframeRule.cpp and JSWebKitCSSKeyframesRule.cpp to the project.
+        Fix compilation with Symbian WINSCW compiler, which produced
+        multiple definitions of the CSSPrimitiveValue conversion operators.
 
-2008-09-01  Dean Jackson  <dino@apple.com>
+        It turns out that they are defined inline but not declared inline.
 
-        Reviewed by Dave Hyatt.
+        Adding the inline keyword to the declaration fixes the build.
 
-        https://bugs.webkit.org/show_bug.cgi?id=20594
-        Add DOM interfaces for WebKitCSSKeyframeRule
-        and WebKitCSSKeyframesRule.
+        * css/CSSPrimitiveValue.h:
 
-        TEST: LayoutTests/css3/keyframes-rule.html
+2009-06-18  Markus Goetz <Markus.Goetz@nokia.com>
 
-        * css/WebKitCSSKeyframeRule.idl: Added
-        * css/WebKitCSSKeyframesRule.idl: Added
+        Reviewed by Simon Hausman.
 
-        * bindings/js/JSCSSRuleCustom.cpp:
-        (WebCore::toJS):
-            Add return of new JS Keyframe rules
-        * bindings/objc/DOMInternal.h:
-            Include new internal header
+        Clarify in docs how to compile with debug information.
 
-        * DerivedSources.make:
-        * GNUmakefile.am:
         * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-            Build configs for new files
-
-2008-09-03  Adam Roben  <aroben@apple.com>
-
-        Windows build fix
-
-        * DerivedSources.cpp: Add JSTextMetrics.cpp to fix the build.
-        * WebCore.vcproj/WebCore.vcproj: Add JSTextMetrics.h for
-        convenience/consistency.
-
-2008-09-03  Adele Peterson  <adele@apple.com>
-
-        Build fix.
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2008-09-03  David Hyatt  <hyatt@apple.com>
-
-        Fix for bug 18203, right floats should be allowed to overflow past the left border edge.
-
-        Reviewed by Darin (ages ago)
-
-        Added fast/block/float/clamped-right-float.html
-
-        * rendering/RenderBlock.cpp:
-        (WebCore::RenderBlock::positionNewFloats):
-
-2008-09-02  David Hyatt  <hyatt@apple.com>
-
-        Add support for canvas text drawing APIs.
-
-        Reviewed by olliej
-
-        Tests added as fast/canvas/canvas-text-*.html
-
-        * DerivedSources.make:
-        * WebCore.xcodeproj/project.pbxproj:
-        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
-        (WebCore::JSCanvasRenderingContext2D::fillText):
-        (WebCore::JSCanvasRenderingContext2D::strokeText):
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::initForStyleResolve):
-        (WebCore::CSSStyleSelector::applyPropertyToStyle):
-        * css/CSSStyleSelector.h:
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::State::State):
-        (WebCore::CanvasRenderingContext2D::font):
-        (WebCore::CanvasRenderingContext2D::setFont):
-        (WebCore::CanvasRenderingContext2D::textAlign):
-        (WebCore::CanvasRenderingContext2D::setTextAlign):
-        (WebCore::CanvasRenderingContext2D::textBaseline):
-        (WebCore::CanvasRenderingContext2D::setTextBaseline):
-        (WebCore::CanvasRenderingContext2D::fillText):
-        (WebCore::CanvasRenderingContext2D::strokeText):
-        (WebCore::CanvasRenderingContext2D::measureText):
-        (WebCore::CanvasRenderingContext2D::drawTextInternal):
-        (WebCore::CanvasRenderingContext2D::accessFont):
-        * html/CanvasRenderingContext2D.h:
-        * html/CanvasRenderingContext2D.idl:
-        * html/TextMetrics.h: Added.
-        (WebCore::TextMetrics::create):
-        (WebCore::TextMetrics::width):
-        (WebCore::TextMetrics::setWidth):
-        (WebCore::TextMetrics::TextMetrics):
-        * html/TextMetrics.idl: Added.
-        * platform/graphics/Font.cpp:
-        (WebCore::Font::lineGap):
-        * platform/graphics/Font.h:
-        * platform/graphics/GraphicsContext.cpp:
-        (WebCore::GraphicsContext::drawBidiText):
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/GraphicsTypes.cpp:
-        (WebCore::textAlignName):
-        (WebCore::parseTextAlign):
-        (WebCore::textBaselineName):
-        (WebCore::parseTextBaseline):
-        * platform/graphics/GraphicsTypes.h:
-        (WebCore::):
 
-2008-09-03  John Sullivan  <sullivan@apple.com>
+2009-06-18  Jakub Wieczorek  <faw217@gmail.com>
 
-        Fixed <rdar://problem/6193022> <rdar://problem/6193022> Crash occurs at WebCore::AnimationBase::propertiesEqual () after certain steps
-
-        Fixed by Darin, reviewed by me
-
-        * page/animation/AnimationBase.cpp:
-        (WebCore::AnimationBase::propertiesEqual):
-        added ensurePropertyMap() to this static function
-        (WebCore::AnimationBase::getPropertyAtIndex):
-        ditto
-        (WebCore::AnimationBase::getNumProperties):
-        ditto
-
-2008-09-03  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Darin and Tim.
-
-        Remove most of the "zombie" mode from the profiler.  Next we will need
-        to remove the client callback mechanism in profiles.
-        - These changes are a result of changes to JSCore.
-
-        * manual-tests/inspector/profiler-test-nested-start-and-stop-profiler.html:
-        * page/Console.cpp:
-        (WebCore::retrieveLastCaller):
-        (WebCore::Console::profileEnd):
-        * page/InspectorController.cpp:
-        (WebCore::InspectorController::stopUserInitiatedProfiling):
-
-2008-09-03  Adele Peterson  <adele@apple.com>
-
-        Reviewed by Darin Adler.
-
-        Test: fast/forms/search-display-none-cancel-button.html
-
-        Allow display:none to work on a search field's cancel button.  Prepare for adding more style-ability for the results button too.
+        Reviewed by Simon Hausmann.
 
-        * css/html4.css: Set display:inline-block for these buttons.  Now they can be overridden by a web author.
+        [Qt] When writing an URL to the clipboard, save the corresponding title
+        in the mime data as well.
 
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::setStyle): Add nil checks for the button renderers.
-        (WebCore::RenderTextControl::createResultsButtonStyle): Don't set the display explicitly.  This is now done in html4.css.
-        (WebCore::RenderTextControl::createCancelButtonStyle): ditto.
-        (WebCore::RenderTextControl::createSubtreeIfNeeded):
-        Reorganize this code so our complicated way of adding shadow nodes is abstracted out into the TextControlInnerElement class.
-        (WebCore::RenderTextControl::updateFromElement): Added nil checks for the button renderers.
-        (WebCore::RenderTextControl::subtreeHasChanged): ditto.
-        (WebCore::RenderTextControl::calcHeight): ditto.
-        (WebCore::RenderTextControl::nodeAtPoint): ditto.
-        (WebCore::RenderTextControl::layout): ditto.
-        (WebCore::RenderTextControl::calcPrefWidths): ditto.
-        (WebCore::RenderTextControl::clientPaddingLeft): ditto.
-        (WebCore::RenderTextControl::clientPaddingRight): ditto.
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::writeURL):
 
-        * rendering/TextControlInnerElements.cpp:
-        (WebCore::RenderTextControlInnerBlock::RenderTextControlInnerBlock): Moved from RenderTextControl.cpp.
-        (WebCore::RenderTextControlInnerBlock::nodeAtPoint): ditto.
-        (WebCore::TextControlInnerElement::attachInnerElement): Added.
-         This does all the separate steps of attaching a shadow node that used to be repeated in RenderTextControl::createSubtreeIfNeeded for each element.
-        (WebCore::TextControlInnerTextElement::createRenderer): Added.  Creates a RenderTextControlInnerBlock.
-        * rendering/TextControlInnerElements.h:
+2009-06-18  Jakub Wieczorek  <faw217@gmail.com>
 
-2008-08-28  Alexey Proskuryakov  <ap@webkit.org>
+        [Qt] Fix build. Add HTMLDataGridElement.
 
-        Reviewed by Maciej.
+        * WebCore.pro:
 
-        Elminate SQLiteAuthorizer class.
+2009-06-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
 
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCore.vcproj/WebCore.vcproj:
-        * GNUmakefile.am
-        Removed SQLiteAuthorizer.h.
-
-        * platform/sql/SQLiteAuthorizer.cpp:
-        * platform/sql/SQLiteAuthorizer.h: Removed.
-        * platform/sql/SQLiteDatabase.cpp:
-        (WebCore::SQLiteDatabase::authorizerFunction):
-        (WebCore::SQLiteDatabase::setAuthorizer):
-        * platform/sql/SQLiteDatabase.h:
-        * storage/DatabaseAuthorizer.h:
-        (WebCore::DatabaseAuthorizer::create):
-        (WebCore::DatabaseAuthorizer::createView):
-        (WebCore::DatabaseAuthorizer::createTempView):
-        (WebCore::DatabaseAuthorizer::dropView):
-        (WebCore::DatabaseAuthorizer::dropTempView):
-        (WebCore::DatabaseAuthorizer::allowSelect):
-        (WebCore::DatabaseAuthorizer::allowReindex):
-        Merge SQLiteAuthorizer and DatabaseAuthorizer, as keeping them separate serves no purpose.
-
-2008-09-03  Dirk Schulze  <vbs85@gmx.de>
-
-        Reviewed by Mark Rowe.
+        Gtk build fix.
 
-        WebKitGtk build fix.
+        Add HTMLDataGridElement header and IDL to the build script.
 
         * GNUmakefile.am:
-        * page/animation/AnimationController.h:
 
-2008-09-02  Robert Blaut  <webkit@blaut.biz>
+2009-06-18  Chris Evans  <scarybeasts@gmail.com>
 
-        Reviewed by Geoff Garen.
+        Reviewed by Adam Barth.
 
-        Fix for <https://bugs.webkit.org/show_bug.cgi?id=16913>
-        Misplaced elements should not close DL lists.
+        Fix 8-digit long hex entities. Fixes bug 26454
+        https://bugs.webkit.org/show_bug.cgi?id=26454
 
-        Test: fast/invalid/test-case-tr-th-td-should-not-close-dl-list.html
+        Test: fast/parser/eightdigithexentity.html
 
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::handleError):
+        * html/HTMLTokenizer.cpp: fix off-by-ones.
 
-2008-09-02  Glenn Wilson  <wilsong@gmail.com>
+2009-06-18  David Levin  <levin@chromium.org>
 
-        Reviewed by Darin Adler.
-
-        Fix for <https://bugs.webkit.org/show_bug.cgi?id=15360>
-        Bug 15360: color:#{predefined colorName} is treated as colorName in Safari
-
-        We would inappropriately interpret and apply an invalid CSS "color" property
-        when the value is a predefined color preceded by a '#' symbol.  For example,
-        style="color:#gray;" would apply the color gray when it should not.
-
-        In the bison template, "hexcolor" was defined as both "HEX maybe_space" OR "IDENT maybe_space".
-        This caused identifiers not fitting the appropriate hex format but preceded by a '#' to be 
-        interpreted as a valid color (CSSPrimitiveValue::CSS_PARSER_HEXCOLOR), when it was really just
-        an ignorable token.
-
-        To correct this, "IDENT maybe_space" was removed from "hexcolor" and added under "term" as
-        '#' IDENT maybe_space, which is then processed as a CSSPrimitiveValue::CSS_STRING instead of
-        CSSPrimitiveValue::CSS_PARSER_HEXCOLOR.
-
-        Test: css1/color_and_background/invalid_color.html
-
-        * css/CSSGrammar.y:
-
-2008-09-02  Mihnea Ovidenie  <mihnea@adobe.com>
-
-        Reviewed by Darin Adler.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=19964
-        Bug 19964: Divide by zero crash in RenderBox::calculateBackgroundSize with 0,0 bmp background image
+        Fix chromium linux build.
 
-        Add a check to RenderBox::repaintLayerRectsForImage to make sure the current layer image can be rendered.
+        Fixes a mistake that happened during the complicated merge for
+        landing r44775, r44776, r44777.
 
-        Test: css3/khtml-background-size-0x0-bmp.html
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::create):
 
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::repaintLayerRectsForImage):
-
-2008-09-02  Glenn Wilson  <wilsong@gmail.com>
-
-        Reviewed by Eric Seidel.
-
-        Fix https://bugs.webkit.org/show_bug.cgi?id=20397
-        Bug 20397: Invalid webkit-border-bottom-left-radius property causes crash
-
-        The function checkForOrphanedUnits() would change the length of a list whose size was
-        was already determined before the call to checkForOrphanedUnits was made.  Later in
-        the caller, the old size was being used for boundary management.
-
-        This has been fixed by moving the call to checkForOrphanedUnits() earlier in the
-        calling function, before the size of the list is determined.
-
-        Test: fast/css/orphaned_units_crash.html
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue):  Moved call to checkForOrphanedUnits() earlier in the function.
-
-2008-09-02  Dirk Schulze  <vbs85@gmx.de>
+2009-06-17  Simon Fraser  <simon.fraser@apple.com>
 
         Reviewed by Darin Adler.
-
-        Fallback on invalid fill or stroke styles in Canvas was
-        transparent black. Changed it to last valid style.
-
-        Canvas fillStyle() and strokeStyle() needs fallback
-        https://bugs.webkit.org/show_bug.cgi?id=20474
-
-        Tests: fast/canvas/canvas-invalid-fillstyle.html
-               fast/canvas/canvas-invalid-strokestyle.html
-
-        * html/CanvasStyle.cpp:
-        (WebCore::CanvasStyle::applyStrokeColor):
-        (WebCore::CanvasStyle::applyFillColor):
-
-2008-09-02  Dirk Schulze  <vbs85@gmx.de>
-
-        Reviewed by Darin Adler.
-
-        Fix https://bugs.webkit.org/show_bug.cgi?id=20468
-        Updated drawImage() in canvas to match the current specification.
-
-        Test: fast/canvas/drawImage-with-negative-source-destination.html
-
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::normalizeRect):
-        (WebCore::CanvasRenderingContext2D::drawImage):
-
-2008-08-26  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/5768210> Switch back to the system version of SQLite
-
-        Use the system version of SQLite when it is new enough to provide the functionality
-        that WebCore requires.
-
-        * Configurations/Base.xcconfig:
-        * Configurations/DebugRelease.xcconfig:
-        * Configurations/WebCore.xcconfig:
-
-2008-09-02  Dan Bernstein  <mitz@apple.com>
-
-        - build fix
-
-        * page/animation/AnimationBase.h:
-
-2008-09-02  Chris Marrin  <cmarrin@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        AnimationController.cpp should be split into separate files
-        https://bugs.webkit.org/show_bug.cgi?id=20604
         
-        Note: All makefiles, except WebCore.xcodeproj have been changed without testing, upon
-        recommendation of Dave Hyatt.
-
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-            Build files.
+        https://bugs.webkit.org/show_bug.cgi?id=26499
         
-        * page/AnimationController.cpp: Removed.
-        * page/AnimationController.h: Removed.
-        * page/animation: Added.
-        * page/animation/AnimationBase.cpp: Added.
-        * page/animation/AnimationBase.h: Added.
-        * page/animation/AnimationController.cpp: Copied from WebCore/page/AnimationController.cpp.
-        * page/animation/AnimationController.h: Copied from WebCore/page/AnimationController.h.
-        * page/animation/CompositeAnimation.cpp: Added.
-        * page/animation/CompositeAnimation.h: Added.
-        * page/animation/ImplicitAnimation.cpp: Added.
-        * page/animation/ImplicitAnimation.h: Added.
-        * page/animation/KeyframeAnimation.cpp: Added.
-        * page/animation/KeyframeAnimation.h: Added.
-
-2008-09-02  Dan Bernstein  <mitz@apple.com>
-
-        - release build fix
-
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::calculateDrawingMode):
-
-2008-09-02  Timothy Hatcher  <timothy@apple.com>
-
-        Make console functions log the correct resource URL and
-        line number for where the call originated.
-
-        https://bugs.webkit.org/show_bug.cgi?id=17234
-        <rdar://problem/5732837>
-
-        Reviewed by Kevin McCullough.
-
-        Test: manual-tests/inspector/console-call-line-numbers.html
-
-        * bindings/js/JSConsoleCustom.cpp:
-        (WebCore::JSConsole::count): Call the impl.
-        (WebCore::JSConsole::timeEnd): Ditto.
-        * manual-tests/inspector/console-call-line-numbers.html: Added.
-        * manual-tests/inspector/resources/script-console-calls.js: Added.
-        * page/Console.cpp:
-        (WebCore::retrieveLastCaller): Helper to get the URL and line.
-        (WebCore::Console::error): Call retrieveLastCaller to get the URL and
-        line number to pass to addMessageToConsole.
-        (WebCore::Console::info): Ditto.
-        (WebCore::Console::log): Ditto.
-        (WebCore::Console::assertCondition): Ditto.
-        (WebCore::Console::count): Ditto.
-        (WebCore::Console::timeEnd): Ditto.
-        (WebCore::Console::warn): Ditto.
-        * page/Console.h:
-        * page/Console.idl: Make count and timeEnd custom.
-
-2008-09-02  Timothy Hatcher  <timothy@apple.com>
-
-        Removed IDL files from WebCore's framework resources.
-
-        * WebCore.xcodeproj/project.pbxproj:
-
-2008-09-02  Dan Bernstein  <mitz@apple.com>
+        First step to making video rendering be hardware-accelerated:
+        make <video> elements get self-painting RenderLayers, and add
+        an isVideo() virtual method to RenderObject.
 
-        Reviewed by Dave Hyatt.
-
-        - <rdar://problem/5681647> pages at http://www.stendmarsofa.com/ are so slow to calculate style it seems like a hang
-
-        * html/HTMLParser.cpp:
-        (WebCore::HTMLParser::handleResidualStyleCloseTagAcrossBlocks): Added a
-        cap on the number of consecutive identical residual style tags to
-        reopen.
-        (WebCore::HTMLParser::popBlock): Ditto.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setReadyState):
+        (WebCore::HTMLMediaElement::mediaPlayerDurationChanged):
+        (WebCore::HTMLMediaElement::mediaPlayerSizeChanged):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::shouldBeNormalFlowOnly):
+        (WebCore::RenderLayer::isSelfPaintingLayer):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isVideo):
+        * rendering/RenderVideo.h:
+        (WebCore::RenderVideo::requiresLayer):
+        (WebCore::RenderVideo::isVideo):
 
-2008-09-02  Alexey Proskuryakov  <ap@webkit.org>
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
 
         Reviewed by Adam Roben.
 
-        A little database quota management cleanup.
-
-        * storage/OriginQuotaManager.cpp:
-        (WebCore::OriginQuotaManager::OriginQuotaManager):
-        (WebCore::OriginQuotaManager::lock):
-        (WebCore::OriginQuotaManager::unlock):
-        (WebCore::OriginQuotaManager::trackOrigin):
-        (WebCore::OriginQuotaManager::tracksOrigin):
-        (WebCore::OriginQuotaManager::addDatabase):
-        (WebCore::OriginQuotaManager::removeDatabase):
-        (WebCore::OriginQuotaManager::removeOrigin):
-        (WebCore::OriginQuotaManager::markDatabase):
-        (WebCore::OriginQuotaManager::diskUsage):
-        * storage/OriginQuotaManager.h:
-        Changed to assert that a lock is taken more directly and reliably. Removed comments about
-        main/background threads, as this is likely to stop being true with synchronous Database calls
-        being made on worker threads.
-
-        * storage/OriginUsageRecord.cpp:
-        (WebCore::OriginUsageRecord::OriginUsageRecord):
-        (WebCore::OriginUsageRecord::addDatabase):
-        (WebCore::OriginUsageRecord::removeDatabase):
-        (WebCore::OriginUsageRecord::markDatabase):
-        (WebCore::OriginUsageRecord::diskUsage):
-        * storage/OriginUsageRecord.h:
-        (WebCore::OriginUsageRecord::DatabaseEntry::DatabaseEntry):
-        Don't use a magic value for unknown. It is totally unnecessary for DatabaseEntry, and
-        can be replaced with a single boolean for OriginUsageRecord.
-        Added assertions for string parameters being unshared.
-
-
-2008-09-01  Adam Barth  <abarth@webkit.org>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=19760
-
-        Make granting LoadLocalResources conditional on a policy.
-
-        * WebCore.base.exp:
-        * dom/Document.cpp:
-        (WebCore::Document::initSecurityContext):
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::setLocalLoadPolicy):
-        (WebCore::FrameLoader::restrictAccessToLocal):
-        * loader/FrameLoader.h:
-        (WebCore::FrameLoader::):
-        * platform/SecurityOrigin.cpp:
-        (WebCore::SecurityOrigin::grantLoadLocalResources):
-        * platform/SecurityOrigin.h:
-
-2008-09-01  Dean Jackson  <dino@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20571
-        Make sure Window object can assign Animation/Transition event
-        listeners via attributes.
-
-        Also added a bunch of transition event tests, although
-        only transition-end-event-window is directly relevant to this patch.
-
-        (WebCore::JSDOMWindowBase::put):
+        Refactor a few common routines in the various Windows ports
+        and reduce some duplicated code.
 
-        Tests: transitions/transition-end-event-all-properties.html
-               transitions/transition-end-event-attributes.html
-               transitions/transition-end-event-container.html
-               transitions/transition-end-event-left.html
-               transitions/transition-end-event-multiple-01.html
-               transitions/transition-end-event-multiple-02.html
-               transitions/transition-end-event-multiple-03.html
-               transitions/transition-end-event-multiple-04.html
-               transitions/transition-end-event-nested.html
-               transitions/transition-end-event-transform.html
-               transitions/transition-end-event-window.html
+        (1) Create TransformationMatrix XFORM casting operator, and
+            switch various XFORM structure uses to utilize it.
+        (2) Push concatCTM call to GraphicsContextWin now that the
+            TransformationMatrix can directly create XFORM (rather
+            than converting to CGAffineTransform/cairo_matrix_t first.)
 
-2008-09-01  Dean Jackson  <dino@apple.com>
-
-        Reviewed by Sam Weinig
-
-        Code styling cleanup.
+        * WebCore.vcproj/WebCore.vcproj: Add new BitmapInfo structure.
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        * platform/graphics/win/GraphicsContextWin.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::scale):
+        (WebCore::GraphicsContextPlatformPrivate::rotate):
+        (WebCore::GraphicsContextPlatformPrivate::translate):
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM):
+        * platform/graphics/win/TransformationMatrixWin.cpp: Added.
+        (WebCore::TransformationMatrix::operator XFORM): New operator
 
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::getValueProperty):
-        (WebCore::JSDOMWindowBase::put):
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
 
-2008-09-01  Geoffrey Garen  <ggaren@apple.com>
+        Non-CG Windows build fix after @r44758.
 
-        Reviewed by Darin Adler.
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderTheme::themeForPage):
 
-        First cut at inline caching for access to vanilla JavaScript properties.
-
-        Updated for JavaScriptCore changes. Mostly mechanical addition of StructureIDs
-        to WebCore classes, and PutPropertySlot& arguments to put functions.
-
-        (WebCore::JSCSSStyleDeclaration::customPut): Be sure to play nice with
-        inline caching for global properties, so global assignment can be optimized.
-
-        * ForwardingHeaders/kjs/StructureID.h: Added.
-        * bindings/js/JSDOMBinding.h:
-        (WebCore::DOMObject::DOMObject):
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::put):
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSDOMWindowCustom.h:
-        (WebCore::JSDOMWindow::customPut):
-        * bindings/js/JSDOMWindowShell.cpp:
-        (WebCore::JSDOMWindowShell::JSDOMWindowShell):
-        (WebCore::JSDOMWindowShell::put):
-        * bindings/js/JSDOMWindowShell.h:
-        * bindings/js/JSEventTargetBase.h:
-        (WebCore::JSEventTargetBase::put):
-        * bindings/js/JSEventTargetNode.h:
-        (WebCore::JSEventTargetNode::put):
-        * bindings/js/JSHTMLAppletElementCustom.cpp:
-        (WebCore::JSHTMLAppletElement::customPut):
-        * bindings/js/JSHTMLEmbedElementCustom.cpp:
-        (WebCore::JSHTMLEmbedElement::customPut):
-        * bindings/js/JSHTMLInputElementBase.cpp:
-        (WebCore::JSHTMLInputElementBase::put):
-        * bindings/js/JSHTMLInputElementBase.h:
-        * bindings/js/JSHTMLObjectElementCustom.cpp:
-        (WebCore::JSHTMLObjectElement::customPut):
-        * bindings/js/JSHistoryCustom.cpp:
-        (WebCore::JSHistory::customPut):
-        * bindings/js/JSInspectedObjectWrapper.cpp:
-        (WebCore::JSInspectedObjectWrapper::wrap):
-        (WebCore::JSInspectedObjectWrapper::JSInspectedObjectWrapper):
-        * bindings/js/JSInspectedObjectWrapper.h:
-        * bindings/js/JSInspectorCallbackWrapper.cpp:
-        (WebCore::JSInspectorCallbackWrapper::wrap):
-        (WebCore::JSInspectorCallbackWrapper::JSInspectorCallbackWrapper):
-        * bindings/js/JSInspectorCallbackWrapper.h:
-        * bindings/js/JSLocationCustom.cpp:
-        (WebCore::JSLocation::customPut):
-        * bindings/js/JSPluginElementFunctions.cpp:
-        (WebCore::runtimeObjectCustomPut):
-        * bindings/js/JSPluginElementFunctions.h:
-        * bindings/js/JSQuarantinedObjectWrapper.cpp:
-        (WebCore::JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper):
-        (WebCore::JSQuarantinedObjectWrapper::put):
-        * bindings/js/JSQuarantinedObjectWrapper.h:
-        * bindings/js/JSStorageCustom.cpp:
-        (WebCore::JSStorage::customPut):
-        * bindings/objc/WebScriptObject.mm:
-        (-[WebScriptObject setValue:forKey:]):
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * bridge/NP_jsobject.cpp:
-        (_NPN_SetProperty):
-        * bridge/jni/jni_jsobject.mm:
-        (JavaJSObject::setMember):
-        * bridge/objc/objc_class.mm:
-        (KJS::Bindings::ObjcClass::fallbackObject):
-        * bridge/objc/objc_runtime.h:
-        * bridge/objc/objc_runtime.mm:
-        (ObjcFallbackObjectImp::ObjcFallbackObjectImp):
-        (ObjcFallbackObjectImp::put):
-        * bridge/runtime.cpp:
-        (KJS::Bindings::Instance::createRuntimeObject):
-        * bridge/runtime_array.cpp:
-        (RuntimeArray::put):
-        * bridge/runtime_array.h:
-        * bridge/runtime_object.cpp:
-        (RuntimeObjectImp::RuntimeObjectImp):
-        (RuntimeObjectImp::put):
-        * bridge/runtime_object.h:
-
-2008-09-01  Dirk Schulze  <vbs85@gmx.de>
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
 
-        Reviewed by Eric Seidel.
+        Reviewed by Adam Roben.
 
-        Fixed border-radius for Cairo.
+        Refactor a few common routines in the various Windows ports
+        and reduce some duplicated code.
+        https://bugs.webkit.org/show_bug.cgi?id=26425.
 
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        (WebCore::GraphicsContext::strokeArc):
+        Refactor use of BITMAPINFO for the new BitmapInfo structure.
 
-2008-09-01  Dirk Schulze  <vbs85@gmx.de>
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/win/BitmapInfo.cpp: Added.
+        (WebCore::bitmapInfoForSize):
+        (WebCore::BitmapInfo::create):
+        (WebCore::BitmapInfo::createBottomUp):
+        * platform/win/BitmapInfo.h: Added.
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        * platform/graphics/win/TransformationMatrixWin.cpp: Added.
+        (WebCore::TransformationMatrix::operator XFORM): New operator
+        * platform/win/DragImageCGWin.cpp:
+        (WebCore::allocImage):
+        * platform/win/DragImageCairoWin.cpp:
+        (WebCore::allocImage):
+        * platform/win/PasteboardWin.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::paint):
 
-        Reviewed by Eric Seidel.
+2009-06-17  Adam Roben  <aroben@apple.com>
 
-        Added canvas's globalAlpha to cairo.
+        Remove unnecessary 6th parameter from SOFT_LINK_OPTIONAL
 
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::setAlpha):
-        (WebCore::GraphicsContext::getAlpha):
-        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
-        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
-        * platform/graphics/cairo/ImageCairo.cpp:
-        (WebCore::BitmapImage::draw):
-
-2008-08-31  Simon Hausmann  <hausmann@webkit.org>
+        Reviewed by Mark Rowe.
 
-        Unreviewed Qt build fix.
+        * platform/graphics/win/ColorSafari.cpp: Removed the 6th parameter and
+        an unnecessary parameter name.
+        * platform/win/SoftLinking.h: Removed the unused 6th parameter.
 
-        * WebCore.pro: Add TextControlInnerElements.cpp to SOURCES instead of
-        the .h file
+2009-06-17  Adam Roben  <aroben@apple.com>
 
-2008-08-30  Darin Adler  <darin@apple.com>
+        Make Settings::shouldPaintNativeControls default to true
 
-        Reviewed by Maciej.
+        This matches the default up in WebKit (that was changed in r43318).
 
-        - adopt some new JavaScriptCore functions where appropriate
+        Fixes Bug 26493: REGRESSION (r44758): First tab always uses Mac-style
+        form controls
+        <https://bugs.webkit.org/show_bug.cgi?id=26493>
 
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::windowProtoFuncAToB): Adopted jsEmptyString.
-        (WebCore::windowProtoFuncBToA): Ditto.
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSLazyEventListener::eventParameterName): Adopted
-        jsNontrivialString.
-        * bindings/js/JSSVGLazyEventListener.cpp:
-        (WebCore::JSSVGLazyEventListener::eventParameterName): Ditto.
+        Reviewed by Darin Adler and Dave Hyatt.
 
-2008-08-29  Brady Eidson  <beidson@apple.com>
+        No test possible since DRT always uses Mac-style form controls.
 
-        Reviewed by Anders' rubberstamp
+        * page/Settings.cpp: Changed the initial value of
+        gShouldPaintNativeControls to true.
 
-        Style cleanup to match MediaTokenizer::writeRawData()
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderTheme::themeForPage): Added a FIXME about the design
+        flaw here involving querying Settings before it's been initialized.
 
-        * loader/PluginDocument.cpp:
-        (WebCore::PluginTokenizer::writeRawData):
+2009-06-17  David Levin  <levin@chromium.org>
 
-2008-08-29  Brady Eidson  <beidson@apple.com>
+        Fix chromium windows build.
 
-        Reviewed by Anders
+        A mistake that happened during the complicated merge for
+        landing r44775, r44776, r44777.
 
-        https://bugs.webkit.org/show_bug.cgi?id=20556
-        <rdar://problem/6181817> REGRESSION (r35946): media/video-click-dlbclick-standalone.html [sic] fails because load never fires
+        * rendering/RenderThemeChromiumWin.h:
+        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
+        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
 
-        Fix regression I introducted in 35946
-        Already covered by media/video-click-dlbclick-standalone.html
+2009-06-17  Eric Carlson  <eric.carlson@apple.com>
 
-        * loader/MediaDocument.cpp:
-        (WebCore::MediaTokenizer::createDocumentStructure): Don't cancel the load here - too early!
-        (WebCore::MediaTokenizer::writeRawData): Call finish() here so onload() can be called.  Also add
-          an ASSERT signifying that this method should only be called once, to more closely follow the
-          PluginDocument case.
+        Reviewed by Simon Fraser.
 
-2008-08-29  Beth Dakin  <bdakin@apple.com>
+        <rdar://problem/6981193> Crash in MediaControlInputElement::attachToParent
 
-        Reviewed by Sam Weinig.
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaTextDisplayElement::attachToParent): NULL check element renderer or parent renderer.
+        (WebCore::MediaControlInputElement::attachToParent): Ditto.
 
-        Fix for <rdar://problem/6181588>
+2009-06-17  David Hyatt  <hyatt@apple.com>
 
-        This patch makes hit testing take into account the new concept of a 
-        disconnected frame, in which some of the content may not be 
-        visible. The current hit testing mechanism starts at a target frame 
-        and drills down for a HitTestResult. In some cases, drilling down 
-        will find a non-visible result. When this happens, we need to try 
-        again, starting at a higher level -- namely, starting at the main 
-        frame.
+        Fix Windows build.  There's no HTMLDataGridElement.cpp file yet.
 
-        * editing/Editor.cpp:
-        (WebCore::Editor::insideVisibleArea): New function that tests if a 
-        point is inside the visible area for a disconnected frame.
-        * editing/Editor.h:
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::hitTestResultAtPoint):
+        * html/HTMLElementsAllInOne.cpp:
 
-2008-08-29  Adele Peterson  <adele@apple.com>
+2009-06-17  David Hyatt  <hyatt@apple.com>
 
-        Reviewed by Adam Roben. 
+        Reviewed by Adam Roben and Anders Carlsson.
 
-        Rename HTMLTextFieldInnerElement.h/.cpp to TextControlInnerElements.h/.cpp
+        Stub out the HTMLDataGridElement.
 
-        * GNUmakefile.am:
-        * WebCore.pro:
+        * DerivedSources.make:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
         * WebCoreSources.bkl:
-        * html/HTMLTextFieldInnerElement.cpp: Removed.
-        * html/HTMLTextFieldInnerElement.h: Removed.
-        * rendering/RenderTextControl.cpp:
-        (WebCore::RenderTextControl::createSubtreeIfNeeded):
-        * rendering/RenderTextControl.h:
-        * rendering/TextControlInnerElements.cpp: Copied from html/HTMLTextFieldInnerElement.cpp.
-        (WebCore::TextControlInnerElement::TextControlInnerElement):
-        (WebCore::TextControlInnerTextElement::TextControlInnerTextElement):
-        (WebCore::TextControlInnerTextElement::defaultEventHandler):
-        (WebCore::SearchFieldResultsButtonElement::SearchFieldResultsButtonElement):
-        (WebCore::SearchFieldResultsButtonElement::defaultEventHandler):
-        (WebCore::SearchFieldCancelButtonElement::SearchFieldCancelButtonElement):
-        (WebCore::SearchFieldCancelButtonElement::defaultEventHandler):
-        * rendering/TextControlInnerElements.h: Copied from html/HTMLTextFieldInnerElement.h.
-
-2008-08-29  Eric Seidel  <eric@webkit.org>
-
-        Rubber-stamped by aroben.
-
-        Add GraphicsContext.h include to GraphcisContextPrivate.h
-
-        GraphicsContextPrivate uses StrokeStyle which is defined
-        in GraphicsContext.h but it doesn't include that header.
-        CoreGraphics build doesn't fail here due to the order
-        it happens to include files.
-
-        * platform/graphics/GraphicsContextPrivate.h:
-
-2008-08-29  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by hyatt.
-
-        Fix GeneratedImage to respect Image's refcounting
-        Fixing potential crashers (future if not current)
-        https://bugs.webkit.org/show_bug.cgi?id=20567
-        
-        I don't know if it's possible to make the current code
-        crash, thus I've not made a test.
-
-        * css/CSSGradientValue.cpp:
-        (WebCore::CSSGradientValue::image):
-        * css/CSSImageGeneratorValue.cpp:
-        (WebCore::CSSImageGeneratorValue::removeClient):
-        (WebCore::CSSImageGeneratorValue::getImage):
-        * css/CSSImageGeneratorValue.h:
-        * platform/graphics/GeneratedImage.h:
-        (WebCore::GeneratedImage::GeneratedImage):
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::setContent):
-        * rendering/style/RenderStyle.h:
-
-2008-08-29  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Adele.
-
-        Fix for <rdar://problem/6093767>
-        https://bugs.webkit.org/show_bug.cgi?id=20526
-
-        Don't allow video to render until unsupported track types have been disabled.
-
-        * platform/graphics/win/QTMovieWin.cpp:
-        (QTMovieWinPrivate::task):
-        (QTMovieWinPrivate::drawingComplete):
-        (QTMovieWinPrivate::clearGWorld):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        * editing/htmlediting.cpp:
+        (WebCore::canHaveChildrenForEditing):
+        * html/HTMLDataGridElement.h: Added.
+        (WebCore::HTMLDataGridElement::HTMLDataGridElement):
+        (WebCore::HTMLDataGridElement::tagPriority):
+        * html/HTMLDataGridElement.idl: Added.
+        * html/HTMLElement.cpp:
+        (WebCore::inlineTagList):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::isAffectedByResidualStyle):
+        * html/HTMLTagNames.in:
 
-2008-08-29  Eric Carlson  <eric.carlson@apple.com>
+2009-06-17  David Levin  <levin@chromium.org>
 
-        Reviewed by Adele.
+        Reviewed by NOBODY (chromium build fix).
 
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=20525
-        <rdar://problem/6169301>
-        
-        Return the size of the movie data instead of 1000.
-        
-        Test: media/progress-event-total.html
+        Fix typo in previous changes.
 
-        * platform/graphics/win/QTMovieWin.cpp:
-        (QTMovieWin::dataSize):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
 
-2008-08-29  Holger Hans Peter Freyther  <zecke@selfish.org>
+2009-06-17  Albert J. Wong  <ajwong@chromium.org>
 
         Reviewed by Eric Seidel.
 
-        [janitor/qt] Start replacing port specific getters with the generic native getter
-        To get the native presentation of an image we currently have platform
-        specific #ifdef's and a generic getter using NativeImagePtr. This patch
-        extends this to the ImageBuffer and updates the Qt platform to get rid
-        of the special #ifdefs.
-
-        https://bugs.webkit.org/attachment.cgi?id=22861
-
-        * platform/graphics/BitmapImage.h:
-        * platform/graphics/Image.h:
-        * platform/graphics/qt/ImageQt.cpp:
-        * platform/graphics/qt/StillImageQt.cpp:
-        * platform/graphics/qt/StillImageQt.h:
-        * platform/qt/ClipboardQt.cpp:
-        (WebCore::ClipboardQt::createDragImage):
-        (WebCore::ClipboardQt::declareAndWriteDragImage):
-        * platform/qt/CursorQt.cpp:
-        * platform/qt/PasteboardQt.cpp:
-        (WebCore::Pasteboard::writeImage):
-
-2008-08-29  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon.
-
-        [svg/qt] Stop crashing... when no RenderPath/RenderObject is given...
-
-        * svg/graphics/qt/SVGPaintServerQt.cpp:
-        (WebCore::SVGPaintServer::renderPath):
-        * svg/graphics/qt/SVGPaintServerSolidQt.cpp:
-        (WebCore::SVGPaintServerSolid::setup):
-
-2008-08-29  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon.
+        https://bugs.webkit.org/show_bug.cgi?id=26148
+        Remove common code from RenderThemeChromiumWin that is shared with
+        RenderThemeChromiumSkia.
 
-        [network/qt] Implement defering of loading ResourceHandle's
-        This is needed otherwise we end in an ASSERT in the MainResourceLoader. The
-        implementation is simply not forwarding anything to the
-        ResourceHandleClient until we are allowed to. This might lead to a deadlock
-        in Qt as we do not empty the QNetworkReply input buffer and wait until we
-        are allowed to read. If that happens we are forced to buffer the data
-        within QNetworkReplyHandler, for now this is not done.
-
-        Manual test:
-        - Open http://acid3.acidtests.org
-        - Wait for the test to complete
-        - Click on the Reference Rendering link
-        - Be fast and see the results of acid3
-        => assert
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
-        (WebCore::QNetworkReplyHandler::setLoadMode):
-        (WebCore::QNetworkReplyHandler::finish):
-        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
-        (WebCore::QNetworkReplyHandler::forwardData):
-        (WebCore::QNetworkReplyHandler::start):
-        (WebCore::QNetworkReplyHandler::resetState):
-        (WebCore::QNetworkReplyHandler::sendQueuedItems):
-        * platform/network/qt/QNetworkReplyHandler.h:
-        (WebCore::QNetworkReplyHandler::):
-        * platform/network/qt/ResourceHandleQt.cpp:
-        (WebCore::ResourceHandle::start):
-        (WebCore::ResourceHandle::loadResourceSynchronously):
-        (WebCore::ResourceHandle::setDefersLoading):
-
-2008-08-29  Simon Hausmann  <hausmann@webkit.org>
-
-        Reviewed by Holger.
-
-        Don't crash when drawing patterns with the HTML canvas. Patterns
-        remain unimplemented but at least they don't crash anymore. This is
-        done by changing the PlatformPatternPtr to be a brush for the Qt
-        platform.
-
-        * platform/graphics/Pattern.h:
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::fillRect):
-        * platform/graphics/qt/PatternQt.cpp:
-        (WebCore::Pattern::createPlatformPattern):
+        Also move supportsControlTints to RenderThemeChromiumLinux since it
+        is linux specific.
 
-2008-08-29  Simon Hausmann  <hausmann@webkit.org>
+        There are no tests changed because this just removes functions with
+        duplicate implementations between the base and derived classes.
 
-        Fix the Qt build, fontSelector() is not used by the Qt port yet
-        and we just return 0 in Font::fontSelector().
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::supportsControlTints):
+        * rendering/RenderThemeChromiumLinux.h:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::):
+        (WebCore::getNonClientMetrics):
+        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
+        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
+        (WebCore::RenderThemeChromiumWin::systemFont):
+        (WebCore::RenderThemeChromiumWin::paintCheckbox):
+        (WebCore::RenderThemeChromiumWin::paintRadio):
+        (WebCore::RenderThemeChromiumWin::paintSliderThumb):
+        (WebCore::RenderThemeChromiumWin::caretBlinkIntervalInternal):
+        * rendering/RenderThemeChromiumWin.h:
+
+2009-06-17  Albert J. Wong  <ajwong@chromium.org>
 
-        * platform/graphics/Font.h:
+        Reviewed by Eric Seidel.
 
-2008-08-28  Alp Toker  <alp@nuanti.com>
+        https://bugs.webkit.org/show_bug.cgi?id=26148
+        Move RenderThemeChromiumSkia into its own file.  This is purely a code move.
 
-        GTK+ dist/build fix. List newly added header files.
+        * rendering/RenderThemeChromiumLinux.cpp:
+        * rendering/RenderThemeChromiumLinux.h:
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::):
+        (WebCore::setSizeIfAuto):
+        (WebCore::mediaElementParent):
+        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
+        (WebCore::RenderThemeChromiumSkia::RenderThemeChromiumSkia):
+        (WebCore::RenderThemeChromiumSkia::~RenderThemeChromiumSkia):
+        (WebCore::RenderThemeChromiumSkia::extraDefaultStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::extraQuirksStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::extraMediaControlsStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::supportsHover):
+        (WebCore::RenderThemeChromiumSkia::supportsFocusRing):
+        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformTextSearchHighlightColor):
+        (WebCore::RenderThemeChromiumSkia::caretBlinkInterval):
+        (WebCore::RenderThemeChromiumSkia::systemFont):
+        (WebCore::RenderThemeChromiumSkia::minimumMenuListSize):
+        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
+        (WebCore::RenderThemeChromiumSkia::setCheckboxSize):
+        (WebCore::RenderThemeChromiumSkia::paintRadio):
+        (WebCore::RenderThemeChromiumSkia::setRadioSize):
+        (WebCore::brightenColor):
+        (WebCore::paintButtonLike):
+        (WebCore::RenderThemeChromiumSkia::paintButton):
+        (WebCore::RenderThemeChromiumSkia::paintTextField):
+        (WebCore::RenderThemeChromiumSkia::paintTextArea):
+        (WebCore::RenderThemeChromiumSkia::paintSearchField):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldCancelButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldDecorationStyle):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeChromiumSkia::paintMediaButtonInternal):
+        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumSkia::adjustMenuListStyle):
+        (WebCore::RenderThemeChromiumSkia::paintMenuList):
+        (WebCore::RenderThemeChromiumSkia::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintMenuListButton):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingRight):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingTop):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingBottom):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingRight):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingTop):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingBottom):
+        (WebCore::RenderThemeChromiumSkia::caretBlinkIntervalInternal):
+        (WebCore::RenderThemeChromiumSkia::menuListInternalPadding):
+        * rendering/RenderThemeChromiumSkia.h:
+        (WebCore::RenderThemeChromiumSkia::supportsControlTints):
+
+2009-06-17  Albert J. Wong  <ajwong@chromium.org>
 
-        * GNUmakefile.am:
+        Reviewed by Eric Seidel.
 
-2008-08-28  Simon Fraser  <simon.fraser@apple.com>
+        https://bugs.webkit.org/show_bug.cgi?id=26148
+        Extract RenderThemeChromiumSkia out of RenderThemeChromiumLinux.  This
+        is mostly a code shuffle.  The non-suffle changes are:
+           1) Creation of a caretBlinkIntervalInternal.
+           2) Moving of some inline functions into the implementation files.
+           3) Changing of defaultGUIFont into a static class constant from a
+              static function.  Also the type is changed to String.
+           4) Changing of defaultFontSize into a static class constant from a
+              static variable in the file scope.
+           5) The static supportsFocus function was collapsed into
+              supportsFocusRing.
+           6) Split the extraDefaultStyleSheet into Skia and Linux versions.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumSkia::defaultGUIFont):
+        (WebCore::RenderThemeChromiumSkia::RenderThemeChromiumSkia):
+        (WebCore::RenderThemeChromiumSkia::~RenderThemeChromiumSkia):
+        (WebCore::RenderThemeChromiumSkia::extraDefaultStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::extraQuirksStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::extraMediaControlsStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::supportsHover):
+        (WebCore::RenderThemeChromiumSkia::supportsFocusRing):
+        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformActiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderThemeChromiumSkia::platformTextSearchHighlightColor):
+        (WebCore::RenderThemeChromiumSkia::caretBlinkInterval):
+        (WebCore::RenderThemeChromiumSkia::systemFont):
+        (WebCore::RenderThemeChromiumSkia::minimumMenuListSize):
+        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
+        (WebCore::RenderThemeChromiumSkia::setCheckboxSize):
+        (WebCore::RenderThemeChromiumSkia::paintRadio):
+        (WebCore::RenderThemeChromiumSkia::setRadioSize):
+        (WebCore::RenderThemeChromiumSkia::paintButton):
+        (WebCore::RenderThemeChromiumSkia::paintTextField):
+        (WebCore::RenderThemeChromiumSkia::paintTextArea):
+        (WebCore::RenderThemeChromiumSkia::paintSearchField):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldCancelButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldDecorationStyle):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumSkia::adjustSearchFieldResultsButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeChromiumSkia::paintMediaButtonInternal):
+        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumSkia::adjustMenuListStyle):
+        (WebCore::RenderThemeChromiumSkia::paintMenuList):
+        (WebCore::RenderThemeChromiumSkia::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeChromiumSkia::paintMenuListButton):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingRight):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingTop):
+        (WebCore::RenderThemeChromiumSkia::popupInternalPaddingBottom):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingRight):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingTop):
+        (WebCore::RenderThemeChromiumSkia::buttonInternalPaddingBottom):
+        (WebCore::RenderThemeChromiumSkia::caretBlinkIntervalInternal):
+        (WebCore::RenderThemeChromiumLinux::RenderThemeChromiumLinux):
+        (WebCore::RenderThemeChromiumLinux::~RenderThemeChromiumLinux):
+        (WebCore::RenderThemeChromiumLinux::systemColor):
+        (WebCore::RenderThemeChromiumLinux::extraDefaultStyleSheet):
+        (WebCore::RenderThemeChromiumSkia::menuListInternalPadding):
+        * rendering/RenderThemeChromiumLinux.h:
+
+2009-06-17  Adam Roben  <aroben@apple.com>
+
+        Add a SOFT_LINK_OPTIONAL macro
+
+        This macro is useful when soft-linking functions that are present in
+        only some versions of a particular library (e.g., APIs added in
+        Windows Vista that aren't available on Windows XP).
 
-        Reviewed by Dave Hyatt
-
-        Various WebKitCSSTransformValue-related fixes
-        https://bugs.webkit.org/show_bug.cgi?id=20562
+        Reviewed by Ada Chan.
 
-        Test: css3/transform-value-types.html
+        * platform/graphics/win/ColorSafari.cpp:
+        (WebCore::focusRingColor):
+        Use the SoftLinking.h macros instead of doing the soft-link ourselves.
+        Also removed an unused call to focusRingColor.isValid().
 
-        * bindings/js/JSCSSValueCustom.cpp:
-        (WebCore::toJS):
-        * css/CSSValue.h:
-        * css/WebKitCSSTransformValue.cpp:
-        (WebCore::WebKitCSSTransformValue::cssText):
-        * css/WebKitCSSTransformValue.h:
-        (WebCore::WebKitCSSTransformValue::):
-        * css/WebKitCSSTransformValue.idl:
+        * platform/win/SoftLinking.h: Added SOFT_LINK_OPTIONAL.
 
-2008-08-28  Dan Bernstein  <mitz@apple.com>
+2009-06-17  Brent Fulgham  <bfulgham@webkit.org>
 
-        Reviewed by Steve Falkenburg.
+        Reviewed by Gustavo Noronha.
 
-        - do not let the "last chance" WM_TIMER trigger WebCore timers when they should be deferred
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26470.
+        The use of zero-width or zero-height rectangles in generating
+        gradients caused Windows Cairo to crash, and webkitgtk to
+        produce invalid images.
 
-        * platform/win/SharedTimerWin.cpp:
-        (WebCore::TimerWindowWndProc):
+        We now test for NaN in the phase argument, which is calculated
+        using fmodf and can blow up when the width/height values passed
+        are zero.
 
-2008-08-28  David Hyatt  <hyatt@apple.com>
+        Test: fast/gradients/border-image-gradient-sides-and-corners.html
 
-        RenderStyle cleanup.
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
 
-        Break out StyleImage, StyleGeneratedImage, StyleCachedImage and NinePieceImage into separate files.
+2009-06-17  Ojan Vafai  <ojan@chromium.org>
 
-        Reviewed by Adam
+        Reviewed by Dimitri Glazkov.
 
-        * css/CSSImageGeneratorValue.cpp:
-        * css/CSSImageValue.cpp:
-        * css/CSSStyleSelector.cpp:
-        * rendering/RenderImageGeneratedContent.cpp:
-        * rendering/style/NinePieceImage.cpp: Added.
-        * rendering/style/NinePieceImage.h: Added.
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::FillLayer::operator==):
-        (WebCore::FillLayer::containsImage):
-        (WebCore::StyleInheritedData::operator==):
-        (WebCore::RenderStyle::contentDataEquivalent):
-        * rendering/style/RenderStyle.h:
-        * rendering/style/StyleCachedImage.cpp: Added.
-        * rendering/style/StyleCachedImage.h: Added.
-        * rendering/style/StyleGeneratedImage.cpp: Added.
-        * rendering/style/StyleGeneratedImage.h: Added.
-        * rendering/style/StyleImage.h: Added.
-
-2008-08-28  Simon Fraser  <simon.fraser@apple.com>
+        If loading a font fails because of the sandbox, we ask the browser process to
+        try to load it by calling ensureFontLoaded. If it still fails after
+        ensureFontLoaded, we hit a ASSERT_NOT_REACHED.
 
-        Reviewed by Dave Hyatt
+        This case happens once in a while during browser shutdown. The browser will
+        queue a message to the renderer to shutdown, and will then stop answering sync
+        messages from the renderer. If the renderer is still loading a page during this
+        time, it might try to call the browser process to ask to load a font. The
+        browser process will ignore the request, and the font will fail to load, even
+        after the second try.
 
-        Make all the 'isFoo()' methods on CSSValue const,
-        and fix the subclasses.
+        This is unfortunate, but there is no real risk here, since the renderer will be
+        going away as soon as it processes another message.
         
-        https://bugs.webkit.org/show_bug.cgi?id=20561
+        This can't be layout tested as it depends on the sandbox.
         
-        * css/CSSTimingFunctionValue.h:
-        * css/CSSValue.h:
-        (WebCore::CSSValue::isFontValue):
-        (WebCore::CSSValue::isImageGeneratorValue):
-        (WebCore::CSSValue::isImageValue):
-        (WebCore::CSSValue::isImplicitInitialValue):
-        * css/CSSValueList.h:
-        * css/FontValue.h:
-
-2008-08-28  David Hyatt  <hyatt@apple.com>
-
-        The great RenderStyle cleanup begins!
+        https://bugs.webkit.org/show_bug.cgi?id=26484
 
-        Move LengthBox and LengthSize out of RenderStyle and into Length.
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        (WebCore::fontContainsCharacter):
 
-        Reviewed by Adam
-
-        * rendering/Length.h:
-        (WebCore::):
-        (WebCore::Length::Length):
-        (WebCore::Length::operator==):
-        (WebCore::Length::operator!=):
-        (WebCore::Length::value):
-        (WebCore::Length::rawValue):
-        (WebCore::Length::percent):
-        (WebCore::Length::type):
-        (WebCore::Length::quirk):
-        (WebCore::Length::setValue):
-        (WebCore::Length::setRawValue):
-        (WebCore::Length::calcValue):
-        (WebCore::Length::calcMinValue):
-        (WebCore::Length::calcFloatValue):
-        (WebCore::Length::isUndefined):
-        (WebCore::Length::isZero):
-        (WebCore::Length::isPositive):
-        (WebCore::Length::isNegative):
-        (WebCore::Length::isAuto):
-        (WebCore::Length::isRelative):
-        (WebCore::Length::isPercent):
-        (WebCore::Length::isFixed):
-        (WebCore::Length::isStatic):
-        (WebCore::Length::isIntrinsicOrAuto):
-        (WebCore::Length::blend):
-        (WebCore::LengthBox::LengthBox):
-        (WebCore::LengthBox::operator=):
-        (WebCore::LengthBox::operator==):
-        (WebCore::LengthBox::operator!=):
-        (WebCore::LengthBox::nonZero):
-        (WebCore::LengthSize::LengthSize):
-        * rendering/style/RenderStyle.h:
-
-2008-08-28  David Hyatt  <hyatt@apple.com>
-
-        Reviewed by Darin
-
-        https://bugs.webkit.org/show_bug.cgi?id=18091
-
-        font-size should be animatable using -webkit-transition.
-
-        * page/AnimationController.cpp:
-        (WebCore::AnimationControllerPrivate::ensurePropertyMap):
-        * rendering/style/RenderStyle.h:
-        (WebCore::RenderStyle::setFontSize):
-
-2008-08-28  Brad Garcia  <bgarcia@google.com>
+2009-06-17  Eric Carlson  <eric.carlson@apple.com>
 
         Reviewed by Dan Bernstein.
 
-        https://bugs.webkit.org/show_bug.cgi?id=20549
-        Correctly determine when cursor is over a resizable border within
-        a nested frameset.
-
-        * rendering/RenderFrameSet.cpp:
-        (WebCore::RenderFrameSet::canResizeRow):
-        (WebCore::RenderFrameSet::canResizeColumn):
+        https://bugs.webkit.org/show_bug.cgi?id=26482
+        <rdar://problem/6978590> When setting playback rate to 0, the audio element stops 
+        playing (doesn't resume later)
 
-2008-08-28  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Eric Seidel
-
-        Add RuleTypes to CSSRule.idl for keyframes and keyframe rules.
-        https://bugs.webkit.org/show_bug.cgi?id=20552
-
-        Test: animations/animation-css-rule-types.html
-
-        * css/CSSRule.idl:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::setRate): Always set the rate, even when "paused".
 
-2008-08-28  Anders Carlsson  <andersca@apple.com>
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::setRate): Ditto.
 
-        Reviewed by Kevin and Darin.
+2009-06-17  Adam Roben  <aroben@apple.com>
 
-        <rdar://problem/6182541>
-        https://bugs.webkit.org/show_bug.cgi?id=20202
-        Missing http status line from the http headers.
-        
-        Add a status line to the header string.
-        
-        * plugins/PluginStream.cpp:
-        (WebCore::PluginStream::startStream):
+        Add all the generated JS*.cpp files back to WebCore.vcproj
 
-2008-08-28  Holger Hans Peter Freyther  <zecke@selfish.org>
+        They are not compiled by the vcproj directly. Instead they are
+        compiled as part of DerivedSources.cpp. Having them listed in the
+        vcproj makes them be included in Project Find, etc.
 
-        Rubber-stamped by Darin Adler.
+        Rubber-stamped in advance by Steve Falkenburg.
 
-        https://bugs.webkit.org/show_bug.cgi?id=17261
+        * WebCore.vcproj/WebCore.vcproj:
 
-        Make it possible to theme the default Url icon and enable this for
-        the Qt port. To have a minimal usage of #ifdef in the code the setting
-        of the icon was moved to a new method which comes in two flavors.
+2009-06-17  Kent Tamura  <tkent@chromium.org>
 
-        * loader/icon/IconDatabase.cpp:
-        (WebCore::loadDefaultIconRecord): Load or set the default icon
-        (WebCore::IconDatabase::defaultIcon):
+        Reviewed by Darin Fisher.
 
-2008-08-28  Holger Hans Peter Freyther <zecke@selfish.org>
+        Don't fire redundant 'change' events for a file upload form.
+        https://bugs.webkit.org/show_bug.cgi?id=26471
 
-        Unreviewed compile fix
+        * platform/FileChooser.cpp:
+        (WebCore::FileChooser::chooseFiles): Suppress change event if the
+        existing selected files and the incoming selected files are equal.
+        (WebCore::FileChooser::chooseIcon): Returns 0 if there is no selected
+        files.
 
-        * platform/graphics/qt/GraphicsContextQt.cpp: Remove redefinitions
+2009-06-17  Adam Treat  <adam.treat@torchmobile.com>
 
-2008-08-28  Adam Roben  <aroben@apple.com>
+        Reviewed by George Staikos.
 
-        Windows (and others?) build fix
+        https://bugs.webkit.org/show_bug.cgi?id=23155
+        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
 
-        * page/Chrome.cpp: Added a missing #include.
-        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer): Fixed typo.
+        * platform/KeyboardCodes.h:
 
-2008-08-27  Eric Seidel  <eric@webkit.org>
+2009-06-17  George Staikos  <george.staikos@torchmobile.com>
 
-        Reviewed by Oliver Hunt.
+        Reviewed by Adam Treat.
 
-        Qt and Cairo support from krit (and blind stab @ wx compile support)
-        https://bugs.webkit.org/show_bug.cgi?id=20373
+        https://bugs.webkit.org/show_bug.cgi?id=23155
+        Move WIN_CE -> WINCE as previously discussed with Qt WINCE folks.
 
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::drawPath):
-        (WebCore::GraphicsContext::fillRect):
-        (WebCore::GraphicsContext::setPlatformFillColor):
-        (WebCore::GraphicsContext::setPlatformStrokeColor):
-        (WebCore::GraphicsContext::setPlatformStrokeStyle):
-        (WebCore::GraphicsContext::strokeRect):
-        (WebCore::GraphicsContext::setImageInterpolationQuality):
-        (WebCore::GraphicsContext::imageInterpolationQuality):
-        (WebCore::GraphicsContext::setPlatformFillPattern):
-        (WebCore::GraphicsContext::setPlatformStrokePattern):
-        (WebCore::GraphicsContext::setPlatformFillGradient):
-        (WebCore::GraphicsContext::setPlatformStrokeGradient):
         * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::fillRect):
-        (WebCore::GraphicsContext::strokeRect):
-        (WebCore::GraphicsContext::clipToImageBuffer):
-        (WebCore::GraphicsContext::setPlatformFillPattern):
-        (WebCore::GraphicsContext::setPlatformStrokePattern):
-        (WebCore::GraphicsContext::setPlatformFillGradient):
-        (WebCore::GraphicsContext::setPlatformStrokeGradient):
-        (WebCore::GraphicsContext::setImageInterpolationQuality):
-        (WebCore::GraphicsContext::imageInterpolationQuality):
-        * platform/graphics/wx/GraphicsContextWx.cpp:
-        (WebCore::GraphicsContext::clipToImageBuffer):
-        (WebCore::GraphicsContext::setImageInterpolationQuality):
-        (WebCore::GraphicsContext::imageInterpolationQuality):
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::drawPath):
-        (WebCore::GraphicsContext::fillRect):
-        (WebCore::GraphicsContext::setPlatformFillPattern):
-        (WebCore::GraphicsContext::setPlatformStrokePattern):
-        (WebCore::GraphicsContext::setPlatformFillGradient):
-
-2008-08-27  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Add stroke/fill Gradient and Pattern support to GraphicsContext and update <canvas> to use it.
-        https://bugs.webkit.org/show_bug.cgi?id=20373
-
-        Changed pattern() to canvasPattern() on CanvasStyle to match canvasGradient()
-        
-        Made Generator (aka Gradient) RefCounted so that GraphicsContext didn't
-        have to store large Gradient objects in the GraphicsContextState
-        
-        Made Pattern RefCounted for the same reason.
-        
-        Many updates to GraphicsContext to support easier drawing with
-        Patterns and Gradients.
-
-        * WebCore.xcodeproj/project.pbxproj: Add pre-existing GraphicsContextPrivate.h
-        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
-        (WebCore::toJS):
-        * css/CSSGradientValue.cpp:
-        (WebCore::CSSGradientValue::createGradient):
-        * css/CSSGradientValue.h:
-        * html/CanvasGradient.cpp:
-        (WebCore::CanvasGradient::CanvasGradient):
-        * html/CanvasGradient.h:
-        (WebCore::CanvasGradient::gradient):
-        (WebCore::CanvasGradient::addColorStop):
-        (WebCore::CanvasGradient::getColor):
-        * html/CanvasPattern.cpp:
-        * html/CanvasPattern.h:
-        (WebCore::CanvasPattern::pattern):
-        (WebCore::CanvasPattern::originClean):
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::State::State):
-        (WebCore::CanvasRenderingContext2D::setStrokeStyle):
-        (WebCore::CanvasRenderingContext2D::setFillStyle):
-        (WebCore::CanvasRenderingContext2D::fill):
-        (WebCore::CanvasRenderingContext2D::stroke):
-        (WebCore::CanvasRenderingContext2D::fillRect):
-        (WebCore::CanvasRenderingContext2D::strokeRect):
-        * html/CanvasRenderingContext2D.h:
-        * html/CanvasStyle.cpp:
-        (WebCore::CanvasStyle::applyStrokeColor):
-        (WebCore::CanvasStyle::applyFillColor):
-        * html/CanvasStyle.h:
-        * platform/graphics/GeneratedImage.h:
-        (WebCore::GeneratedImage::GeneratedImage):
-        * platform/graphics/Generator.h:
-        * platform/graphics/Gradient.h:
-        (WebCore::Gradient::create):
-        * platform/graphics/GraphicsContext.cpp:
-        (WebCore::GraphicsContext::fillRule):
-        (WebCore::GraphicsContext::setFillRule):
-        (WebCore::GraphicsContext::setStrokePattern):
-        (WebCore::GraphicsContext::setFillPattern):
-        (WebCore::GraphicsContext::setStrokeGradient):
-        (WebCore::GraphicsContext::setFillGradient):
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/GraphicsContextPrivate.h:
-        (WebCore::):
-        (WebCore::GraphicsContextState::GraphicsContextState):
-        * platform/graphics/GraphicsTypes.h:
-        * platform/graphics/Path.h:
-        * platform/graphics/Pattern.h:
-        (WebCore::Pattern::create):
-        (WebCore::Pattern::tileImage):
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::GraphicsContext::drawRect):
-        (WebCore::GraphicsContext::drawEllipse):
-        (WebCore::GraphicsContext::drawConvexPolygon):
-        (WebCore::calculateDrawingMode):
-        (WebCore::GraphicsContext::drawPath):
-        (WebCore::fillPathWithFillRule):
-        (WebCore::GraphicsContext::fillPath):
-        (WebCore::GraphicsContext::strokePath):
-        (WebCore::GraphicsContext::fillRect):
-        (WebCore::GraphicsContext::fillRoundedRect):
-        (WebCore::GraphicsContext::setPlatformStrokePattern):
-        (WebCore::GraphicsContext::setPlatformFillPattern):
-        (WebCore::GraphicsContext::setPlatformStrokeGradient):
-        (WebCore::GraphicsContext::setPlatformFillGradient):
-
-2008-08-20  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Darin and Alexey.
-
-        Close a leak of PausedTimeouts if the JavaScriptDebugServer was destroyed
-        with timeouts paused.
-        https://bugs.webkit.org/show_bug.cgi?id=20469
-        
-        I attempted to clean up the memory management of PausedTimeouts, I'm not
-        sure the solution I came up with is "cleaner", but it's in some ways
-        "safer", since it no longer uses raw pointers and manual new/delete.
-        
-        This also now prevents CachedPage from needlessly creating Window
-        objects when caching pages which didn't already have one. :)
-        
-        I also made Chrome.cpp no longer depend on the JavaScript bindings
-        (aka JSDOMWindowBase.h), since there was no real reason for it to.
-
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::JSDOMWindowBase::pauseTimeouts):
-        (WebCore::JSDOMWindowBase::resumeTimeouts):
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::pauseTimeouts):
-        (WebCore::ScriptController::resumeTimeouts):
-        * bindings/js/ScriptController.h:
-        * history/CachedPage.cpp:
-        (WebCore::CachedPage::CachedPage):
-        (WebCore::CachedPage::restore):
-        * page/Chrome.cpp:
-        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
-        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
-        * page/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::~JavaScriptDebugServer):
-        (WebCore::JavaScriptDebugServer::setJavaScriptPaused):
-
-2008-08-27  Holger Hans Peter Freyther <zecke@selfish.org>
-
-        Unreviewed compile fix
-
-        Add the stub for the Qt port.
-
-        * WebCore.pro:
-        * page/qt/AccessibilityObjectQt.cpp: Added.
-        (WebCore::AccessibilityObject::accessibilityIgnoreAttachment):
-
-2008-08-27  Alp Toker  <alp@nuanti.com>
-
-        Reviewed by Eric.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20551
-        [GTK] search popup crash
-
-        * platform/gtk/SearchPopupMenuGtk.cpp:
-        (WebCore::SearchPopupMenu::enabled):
-        Fix a search popup crasher by disabling the history popup since we
-        don't support this feature yet in the GTK+ port.
-
-2008-08-27  Alp Toker  <alp@nuanti.com>
-
-        Reviewed by Eric.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20551
-        [GTK] curl crashers
+        (WebCore::GraphicsContext::getWindowsContext):
+        * platform/win/SystemTimeWin.cpp:
+        (WebCore::userIdleTime):
 
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::ResourceHandleManager::startScheduledJobs):
-        Remove the resource handle from the pending list before starting the
-        job, not afterwards. Fixes crashers in the test suite.
+2009-06-17  Adam Roben  <aroben@apple.com>
 
-        Test: fast/dom/clientWidthAfterDocumentIsRemoved.html
-        Test: fast/encoding/char-encoding.html
+        Speculative Mac build fix
 
-2008-08-27  Dirk Schulze  <vbs85@gmx.de>
+        * page/Page.h: Forward-declare RenderTheme instead of including
+        RenderTheme.h so that we don't need to make RenderTheme.h a private
+        header for WebKit's benefit.
 
-        Reviewed by eseidel.
+        * editing/SelectionController.cpp:
+        * rendering/InlineTextBox.cpp:
+        * rendering/RenderObject.cpp:
+        Added #includes of RenderTheme.h.
 
-        Fix canvas drawImage to support composite operations.
-        Composite had no effect on canvas elements like these:
-        http://philip.html5.org/tests/canvas/suite/tests/index.2d.composite.canvas.html
+2009-06-17  Adam Roben  <aroben@apple.com>
 
-        [CAIRO] Canvas composite don't work on canvas-elements.
-        https://bugs.webkit.org/show_bug.cgi?id=20548
+        Speculative Mac build fix
 
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::drawImage): pass the current composite operator to the drawImage call
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderTheme::create): Added.
 
-2008-08-27  Mario Bensi  <mbensi@pleyo.com>
+2009-06-17  Adam Roben  <aroben@apple.com>
 
-        Reviewed by Eric Seidel.
-        
-        Fix the data content of an image with a base64.
+        Speculative Mac build fix
 
-        * platform/network/curl/ResourceHandleManager.cpp:
-        (WebCore::parseDataUrl): Remove the String and use only the data
-        Vector because the data.latin1().data() convert the data content and
-        the image test ( https://bugs.webkit.org/attachment.cgi?id=21726 ) is
-        not drawn correctly.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderTheme::themeForPage): Remove the name of an unused
+        parameter.
 
-2008-08-27  Antti Koivisto  <antti@apple.com>
+2009-06-17  Adam Roben  <aroben@apple.com>
 
-        Reviewed by Eric Seidel.
+        Speculative Mac build fix
 
-        Crash after OK in dialog box and reloading page in secure mode
-        https://bugs.webkit.org/show_bug.cgi?id=20493
-        
-        The new run loop spawned by a modal dialog causes a timer in the loader to run 
-        synchronously inside didFinishLoading() deleting "this" object.
-        
-        Defer all WebCore timers when a modal dialog is up. They are not
-        safe to execute.
+        * page/Page.cpp:
+        (WebCore::Page::Page): Change the initializer order to match the
+        declaration order.
 
-        * page/Chrome.cpp:
-        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
-        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
+2009-06-16  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
 
-2008-08-27  Chris Marrin  <cmarrin@apple.com>
+        Reviewed by Simon Hausmann.
 
-        Reviewed by Dave Hyatt
+        Follow up to bug https://bugs.webkit.org/show_bug.cgi?id=26278
+        Patch that make WebCore have a RenderTheme per page
 
-        Memory leaks when animating transforms
-        https://bugs.webkit.org/show_bug.cgi?id=20532
+        Make the Qt implementation of RenderTheme create a theme per page,
+        and use the QStyle associated with the view of each page, in order
+        to make the QWidget setStyle() method work as advertised.
 
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::ScaleTransformOperation::blend):
-        (WebCore::RotateTransformOperation::blend):
-        (WebCore::SkewTransformOperation::blend):
-        (WebCore::TranslateTransformOperation::blend):
-        (WebCore::MatrixTransformOperation::blend):
-        * rendering/style/RenderStyle.h:
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::RenderThemeQt):
+        (WebCore::RenderThemeQt::qStyle):
+        (WebCore::findFrameLineWidth):
+        (WebCore::inflateButtonRect):
+        (WebCore::RenderThemeQt::adjustRepaintRect):
+        (WebCore::RenderThemeQt::isControlStyled):
+        (WebCore::RenderThemeQt::computeSizeBasedOnStyle):
+        (WebCore::RenderThemeQt::setButtonPadding):
+        (WebCore::RenderThemeQt::paintButton):
+        (WebCore::RenderThemeQt::paintTextField):
+        (WebCore::RenderThemeQt::setPopupPadding):
+        * platform/qt/RenderThemeQt.h:
 
-2008-08-27  Timothy Hatcher  <timothy@apple.com>
+2009-06-16  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
 
-        Add support for support for -webkit-appearance: default-button on the Mac platform.
+        Reviewed by Dave Hyatt and Adam Roben.
 
-        <rdar://problem/6173530>
+        https://bugs.webkit.org/show_bug.cgi?id=26278
+        Patch that make WebCore have a RenderTheme per page
 
-        Reviewed by Dave Hyatt.
 
-        * WebCore.base.exp: Export new symbols.
-        * platform/mac/WebCoreSystemInterface.h: Add wkAdvanceDefaultButtonPulseAnimation.
-        * platform/mac/WebCoreSystemInterface.mm: Ditto.
-        * rendering/RenderButton.cpp:
-        (WebCore::RenderButton::RenderButton): Remove #if PLATFORM(WIN).
-        (WebCore::RenderButton::setStyle): Ditto.
-        * rendering/RenderButton.h: Ditto.
-        * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::adjustRepaintRect): Add a case for DefaultButtonAppearance.
-        (WebCore::RenderThemeMac::setButtonCellState): Set the key equivalent to the return
-        key if the button is default, otherwise reset the key equivalent.
-        (WebCore::RenderThemeMac::paintButton): If the button is default call setDefaultButtonCell:
-        on the window, then wkAdvanceDefaultButtonPulseAnimation before painting. Restore
-        the window's previous default button cell when finished.
+        Create a different RenderTheme per page, so that RenderTheme has
+        access to page specific theming. This is needed for the Qt port, as Qt
+        supports setting the theme (style) per widget.
 
-2008-08-26  David Hyatt  <hyatt@apple.com>
+        This change was suggested and discussed with Dave Hyatt.
 
-        First cut at making form controls on OS X respect full page zoom.  There are lots of bugs.
+        More detailed:
 
-        Reviewed by weinig
+        1) Create a theme per page or one global one, depending on the needs
+           of the platform.
+        2) Add an accesser to the theme from RenderObject.
+        3) Change all uses of the theming to access the theme through
+           RenderObject, using the global default theme as fallback, when the
+           document of RenderObject has no page.
+           When we don't have access to a RenderObject, use the default theme.
+        4) Modify all RenderTheme platform implementations to work with the
+           above changes, still creating only one global theme.
 
-        Added fast/forms/zoomed-controls.html
 
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::boundingBoxRect):
         * css/CSSStyleSelector.cpp:
-        (WebCore::addIntrinsicMargins):
-        * rendering/RenderSlider.cpp:
-        (WebCore::RenderSlider::calcPrefWidths):
+        (WebCore::loadFullDefaultStyle):
+        (WebCore::CSSStyleSelector::styleForElement):
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        (WebCore::CSSStyleSelector::applyProperty):
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::setActive):
+        (WebCore::ContainerNode::setHovered):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::focusedOrActiveStateChanged):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::parseMappedAttribute):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setChecked):
+        (WebCore::HTMLInputElement::setIndeterminate):
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionLayoutChanged):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateControlTints):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        * page/Page.h:
+        (WebCore::Page::theme):
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::paintRow):
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::create):
+        (WebCore::RenderTheme::themeForPage):
+        (WebCore::RenderThemeGtk::RenderThemeGtk):
+        (WebCore::RenderThemeGtk::~RenderThemeGtk):
+        (WebCore::RenderThemeGtk::gtkEntry):
+        (WebCore::RenderThemeGtk::gtkTreeView):
+        * platform/gtk/RenderThemeGtk.h:
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::create):
+        (WebCore::RenderTheme::themeForPage):
+        * platform/qt/RenderThemeQt.h:
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::paint):
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::determineState):
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderThemeWx::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlInputElement::hitTest):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::theme):
+        * rendering/RenderObject.h:
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::defaultTheme):
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeChromiumLinux.h:
+        (WebCore::RenderThemeChromiumLinux::~RenderThemeChromiumLinux):
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeChromiumWin.h:
+        (WebCore::RenderThemeChromiumWin::RenderThemeChromiumWin):
+        (WebCore::RenderThemeChromiumWin::~RenderThemeChromiumWin):
         * rendering/RenderThemeMac.h:
         * rendering/RenderThemeMac.mm:
-        (WebCore::RenderThemeMac::adjustRepaintRect):
-        (WebCore::RenderThemeMac::inflateRect):
-        (WebCore::RenderThemeMac::baselinePosition):
-        (WebCore::RenderThemeMac::setControlSize):
-        (WebCore::RenderThemeMac::sizeForFont):
-        (WebCore::RenderThemeMac::sizeForSystemFont):
-        (WebCore::RenderThemeMac::setFontFromControlSize):
-        (WebCore::RenderThemeMac::paintCheckbox):
-        (WebCore::RenderThemeMac::setCheckboxCellState):
-        (WebCore::RenderThemeMac::paintRadio):
-        (WebCore::RenderThemeMac::setRadioCellState):
-        (WebCore::RenderThemeMac::setButtonPaddingFromControlSize):
-        (WebCore::RenderThemeMac::adjustButtonStyle):
-        (WebCore::RenderThemeMac::setButtonCellState):
-        (WebCore::RenderThemeMac::paintButton):
-        (WebCore::RenderThemeMac::paintMenuList):
-        (WebCore::RenderThemeMac::paintMenuListButton):
-        (WebCore::RenderThemeMac::popupInternalPaddingLeft):
-        (WebCore::RenderThemeMac::popupInternalPaddingRight):
-        (WebCore::RenderThemeMac::popupInternalPaddingTop):
-        (WebCore::RenderThemeMac::popupInternalPaddingBottom):
-        (WebCore::RenderThemeMac::setPopupButtonCellState):
-        (WebCore::RenderThemeMac::paintSliderTrack):
-        (WebCore::RenderThemeMac::paintSliderThumb):
-        (WebCore::RenderThemeMac::adjustSliderThumbSize):
-        (WebCore::RenderThemeMac::paintSearchField):
-        (WebCore::RenderThemeMac::adjustSearchFieldStyle):
-        (WebCore::RenderThemeMac::paintSearchFieldCancelButton):
-        (WebCore::RenderThemeMac::paintSearchFieldResultsButton):
-
-2008-08-27  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Anders
-
-        <rdar://problem/6134133> - Crash when loading large movie as a standalone document
-
-        We hand off these loads to Quicktime which manages and spools the data itself, but we also continued
-        to load and buffer the data for the movie in WebCore.  With large media files, this results in blowing
-        away the virtual address space and a crash.
-
-        * loader/EmptyClients.h:
-        (WebCore::EmptyFrameLoaderClient::pluginWillHandleLoadError):
-        * loader/FrameLoaderClient.h:  Added client method to get platform specific error for
-          "plugin will handle load"
-
-        * loader/MediaDocument.cpp:
-        (WebCore::MediaTokenizer::createDocumentStructure): Tell the MainResourceLoader to not buffer data,
-          and cancel the WebCore-managed load
-        (WebCore::MediaTokenizer::writeRawData):
-        (WebCore::MediaTokenizer::finish):
-
-2008-08-26  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Eric Seidel
-
-        Linear timing functions should have control points 0, 0, 1, 1.
-        https://bugs.webkit.org/show_bug.cgi?id=20535
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSStyleSelector::mapAnimationTimingFunction):
-        * rendering/style/RenderStyle.h:
-
-2008-08-27  Adam Roben  <aroben@apple.com>
-
-        Windows build fix
-
-        * WebCore.vcproj/WebCore.vcproj: Fix file extension.
-
-2008-08-26  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        <rdar://problem/6069462> REGRESSION: webkit is returning flash objects as AXUnknown
-
-        Added platform-specific accessibilityIgnoreAttachment, which allows the platform
-        to determine if an attachment is ignored through accessibility. Added equivalent
-        methods in Gtk, Win and Mac
-
-        Test: accessibility/plugin.html
-
-        * GNUmakefile.am:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * page/AccessibilityObject.h:
-        * page/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
-        * page/gtk/AccessibilityObjectAtk.cpp: Added.
-        (WebCore::AccessibilityObject::accessibilityIgnoreAttachment):
-        * page/mac/AccessibilityObjectMac.mm: Added.
-        (WebCore::AccessibilityObject::accessibilityIgnoreAttachment):
-        * page/mac/AccessibilityObjectWrapper.h:
-        * page/win/AccessibilityObjectWin.cpp: Added.
-        (WebCore::AccessibilityObject::accessibilityIgnoreAttachment):
-
-2008-08-26  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Beth Dakin.
-
-        <rdar://problem/5817770> can't bring up contextual menu for embedded objects in WebText
-
-        * page/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityPerformShowMenuAction]):
-        (-[AccessibilityObjectWrapper accessibilityShowContextMenu]):
-
-2008-08-26  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Darin Adler.
-
-        <rdar://problem/6176924> CrashTracer: [USER] 4 crashes in Safari at com.apple.WebCore: WebCore::RenderTableSection::numColumns
-
-        Tests: accessibility/table-notbody.html
-
-        * page/AccessibilityTable.cpp:
-        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
-
-2008-08-26  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Beth Dakin.
-
-        Fix typo.
-
-        * dom/DOMCoreException.h:
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeSafari.h:
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::create):
+        (WebCore::RenderTheme::themeForPage):
+        * rendering/RenderThemeWin.h:
 
-2008-08-26  Sam Weinig  <sam@webkit.org>
+2009-06-17  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Oliver Hunt.
 
-        Fix https://bugs.webkit.org/show_bug.cgi?id=20479
-        <rdar://problem/6167660>
-        Take image redirects into account when tainting the canvas.
+        <rdar://problem/6974175> ASSERT in JITStubs.cpp at appsaccess.apple.com
 
-        Test: http/tests/security/canvas-remote-read-redirect-to-remote-image.html
+        JSDOMWindowCustom was using PropertySlot::putValue, however this interface
+        appears to be fundaementally incorrect - PropertySlots are only used to get
+        values, all puts use PutPropertySlot.  However PutPropertySlot cannot be
+        used in the fashion desired here - it only reports the caching type of a
+        write that has been performed.
 
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::drawImage):
-        (WebCore::CanvasRenderingContext2D::drawImageFromRect):
+        (This caused a bug where the put should have triggered a transition, and
+        failed to do so.)
 
-2008-08-26  Sam Weinig  <sam@webkit.org>
+        Removing the faulty case from the optimization leads to a ~0.5% progression
+        on in-browser SunSpider (presumably the very first case was not being hit
+        often, and the simplification here is beneficial).
 
-        Reviewed by Darin Adler.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::put):
 
-        Change canvas tainting logic to ask the image if it contains
-        any resources outside of its own origin. Since there is no 
-        way to determine if SVG images contain any resources outside its
-        origin, we always assume it does.
+2009-06-17  David Levin  <levin@chromium.org>
 
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::drawImage):
-        (WebCore::CanvasRenderingContext2D::drawImageFromRect):
-        * platform/graphics/BitmapImage.h:
-        (WebCore::BitmapImage::hasSingleSecurityOrigin):
-        * platform/graphics/GeneratedImage.h:
-        (WebCore::GeneratedImage::hasSingleSecurityOrigin):
-        * platform/graphics/Image.h:
-        (WebCore::Image::hasSingleSecurityOrigin):
-        * platform/graphics/cg/PDFDocumentImage.h:
-        (WebCore::PDFDocumentImage::hasSingleSecurityOrigin):
-        * svg/graphics/SVGImage.h:
-
-2008-08-26  Maxime Britto  <britto@apple.com>
+        Reviewed by NOBODY, layout tests fix.
 
-        Reviewed by Adele.
+        https://bugs.webkit.org/show_bug.cgi?id=26326
+        This reverts commit r44751.
 
-        <rdar://6159244> Pan-scrolling does not work on particular sites (starmagazine.com, nytimes.com)
-        This patch fixes the issues and modify the behavior of the panscroll by allowing it to jump to a parent layer when it reaches the end of its scrollable area.
-        This is matching the behavior of the mouse wheel when trying to scroll in a smaller layer of the page (div, textarea, ...) and when we reach the edge and keep scrolling then the whole page scrolls.
+        Once that change was checked scrollbars/scrollbar-orientation.html started
+        crashing on Windows.
 
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::updateAutoscrollRenderer): if we switch to the parent layer to do the scroll we want to change the renderer for the panning
-        * page/EventHandler.h:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::panScrollFromPoint): now calls the scrollByRecursively method when it has computed the xDelta and yDelta
-        (WebCore::RenderLayer::scrollByRecursively): try to scroll the current layer by the xDelta and yDelta provided, if it can't it ask its parent layer to do so.
-        * rendering/RenderLayer.h:
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        * page/FrameView.cpp:
+        * page/FrameView.h:
+        * platform/Scrollbar.h:
         * rendering/RenderObject.cpp:
-        (WebCore::RenderObject::canBeProgramaticallyScrolled): a RenderObject must have a RenderLayer to be programatically scrolled
-        (WebCore::RenderObject::autoscroll): No need to check for the layer anymore since we verify it's present in the upmentionned method
-        (WebCore::RenderObject::panScroll): No need to check for the layer anymore too.
-
-2008-08-25  Julien Chaffraix  <jchaffraix@webkit.org>
-
-        Reviewed by Darin Adler.
-
-        Bug 20247: setAttributeNode() does not work when attribute name has a capital letter in it
-        https://bugs.webkit.org/show_bug.cgi?id=20247
-
-        <rdar://problem/6118218>
-
-        Add a boolean parameter to getAttributeItem to choose between case sensitive and case insensitive
-        check. This keeps the behaviour for setAttribute / hasAttribute (case sensitive) and getAttribute
-        (case insensitive for HTML elements).
-
-        Test: fast/dom/Element/getAttribute-check-case-sensitivity.html
-
-        * dom/Element.cpp:
-        (WebCore::Element::getAttribute):
-        * dom/NamedAttrMap.cpp:
-        (WebCore::NamedAttrMap::getNamedItem):
-        (WebCore::NamedAttrMap::getAttributeItem):
-        * dom/NamedAttrMap.h:
-
-2008-08-25  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=20514
-        <rdar://problem/6174096>
-        Treat SVG images as dirty when drawing to a canvas.
-
-        Test: http/tests/security/canvas-remote-read-svg-image.html
-
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::drawImage):
-        (WebCore::CanvasRenderingContext2D::drawImageFromRect):
-        * platform/graphics/Image.h:
-        (WebCore::Image::isSVGImage):
-        * svg/graphics/SVGImage.h:
-        (WebCore::SVGImage::isSVGImage):
-
-2008-08-25  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Mark Rowe.
-
-        Fix https://bugs.webkit.org/show_bug.cgi?id=20377
-        Leak in XMLHttpRequest.
-
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::makeCrossSiteAccessRequestWithPreflight):
-
-2008-08-25  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Anders
-
-        Speculative fix for <rdar://problem/6173217>
-
-        Moves the "clearArchivedResources()" call to exactly where it used to be in the old version of WebArchive code.
-        Also, adds a null check for m_documentLoader since DocumentLoader::stopLoading() can end up clearing it, rendering
-        the first null check invalid.
-
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::stopAllLoaders):
-
-
-2008-08-25  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Tim.
-
-        <rdar://problem/6157711> Heavy/Tree view selector is not grayed out if
-        there is no profile, can cause crash
-
-        * page/inspector/ProfilesPanel.js:
-
-2008-08-25  Dean Jackson  <dino@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        Make sure 'inherit' is handled by transition property.
-        https://bugs.webkit.org/show_bug.cgi?id=20513
-
-        Test: transitions/inherit.html
-        Test: transitions/inherit-other-props.html
-
-        * css/CSSStyleSelector.cpp:
-          fix macro to check existence of list before getting size
-
-2008-08-25  Anders Carlsson  <andersca@apple.com>
-
-        Reviewed by Mark.
-
-        <rdar://problem/6149787> crash @ com.apple.JavaScriptCore: WTF::callOnMainThread + 37.
-        
-        Initialize threading in the call to WebCoreObjCFinalizeOnMainThread. We currently assume 
-        (safely) that any class that needs finalization on the main thread will also need to be deallocated
-        on the main thread, and calling initializeThreading from WebCoreObjCFinalizeOnMainThread instead of
-        calling it from WebCoreObjCScheduleDeallocateOnMainThread seems safer.
-
-        * platform/mac/WebCoreObjCExtras.c:
-        (WebCoreObjCFinalizeOnMainThread):
-
-2008-08-25  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Rename CachedResource::referenced() to CachedResource::hasClients() to
-        match previous ref() -> addClient() rename.
-
-        * loader/Cache.cpp:
-        (WebCore::Cache::pruneLiveResources):
-        (WebCore::Cache::pruneDeadResources):
-        (WebCore::Cache::remove):
-        (WebCore::Cache::getStatistics):
-        (WebCore::Cache::dumpLRULists):
-        * loader/CachedResource.cpp:
-        (WebCore::CachedResource::addClient):
-        (WebCore::CachedResource::removeClient):
-        (WebCore::CachedResource::setDecodedSize):
-        (WebCore::CachedResource::setEncodedSize):
-        * loader/CachedResource.h:
-        (WebCore::CachedResource::hasClients):
-        (WebCore::CachedResource::canDelete):
-
-2008-08-25  Anthony Ricaud  <rik24d@gmail.com>
-
-        Add a missing Inspector localized string for "other".
-
-        https://bugs.webkit.org/show_bug.cgi?id=20509
-
-        Reviewed by Tim Hatcher.
-
-        * English.lproj/localizedStrings.js:
-
-2008-08-22  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Geoff, Mark and Tim.
-
-        <rdar://problem/6150623> JSProfiler: It would be nice if the profiles
-        in the console said what file and line number they came from
-        - Lay the foundation for getting line numbers and other data from the
-        JavaScript engine.
-
-        * ForwardingHeaders/VM: Added.
-        * ForwardingHeaders/VM/Machine.h: Added.
-        * page/Console.cpp: Gather the line number and file information when 
-        profileEnd has been called, but don't use it until didFinishProfiling is
-        called.  We won't need to wait once we remove the profiler "zombie" mode
-        which this patch helps pave the foundation for.
-        (WebCore::Console::Console):
-        (WebCore::Console::profileEnd):
-        (WebCore::Console::finishedProfiling):
-        * page/Console.h:
-        * page/InspectorController.cpp: Modify calls to
-        addProfileMessageToConsole to satisfy the new arguments it takes.
-        (WebCore::InspectorController::finishedProfiling):
-        (WebCore::InspectorController::addProfile):
-        (WebCore::InspectorController::addProfileMessageToConsole):
-        (WebCore::InspectorController::finishedProfiling):
-        * page/InspectorController.h:
-
-2008-08-25  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Reviewed by Simon.
-
-        [inspector] Update the WebKit.qrc Qt resources file
-        Catchup with the changes in the directory.
-
-        * page/inspector/WebKit.qrc:
-
-2008-08-25  Dirk Schulze  <vbs85@gmx.de>
-
-        Reviewed by Simon.
-
-        Transformed the radian to degree, to get rotate()
-        in canvas work as expected.
-
-        [Qt] Canvas.rotate() doesn't work
-        https://bugs.webkit.org/show_bug.cgi?id=20496
+        (WebCore::RenderObject::destroy):
+        * rendering/RenderScrollbar.h:
 
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::rotate):
+2009-06-16  Kevin Watters  <kevinwatters@gmail.com>
 
-2008-08-24  Steve Falkenburg  <sfalken@apple.com>
+        Reviewed by Kevin Ollivier.
 
-        Add a "last chance" WM_TIMER to the Windows shared timer.
+        In ImageSource::setData, delete the old m_encoder before replacing it with a new one.
         
-        The last chance timer fires every 5 seconds to run any lost WM_TIMER based timers.
-        Failure to fire a timer is fatal to the cross-platform Timer code, since it won't re-schedule
-        timers if a timer with an earlier expiration is already pending. This results in no timers
-        firing from that point on.
-        
-        We lose WM_TIMER messages occasionally (in the neighborhood of 1 per hour) probably due to a
-        buggy window message hook.
-        
-        This timer will start when the first WM_TIMER is scheduled, and will
-        fire every 5 seconds thereafter, causing any lost timers to be fired.
-        
-        Found this via one of its symptoms: leaking WebFrames. The fix prevents timers from stalling
-        and prevents the WebFrame leak.
-        
-        Reviewed by Darin Adler, Geoff Garen.
-
-        * platform/win/SharedTimerWin.cpp:
-        (WebCore::):
-        (WebCore::TimerWindowWndProc):
-        (WebCore::setSharedTimerFireTime):
-
-2008-08-24  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Darin Adler.
-
-        - fix <rdar://problem/6065547> REGRESSION (r34879): "Subject" in unread emails in Yahoo mail is not shown in bold
-
-        Test: fast/css/font-property-priority.html
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::parseValue): Changed to pass the 'important' flag
-        to the font-property-parsing functions.
-        (WebCore::CSSParser::parseFontStyle): Added an 'important' argument and
-        changed to use it rather than the m_important member.
-        (WebCore::CSSParser::parseFontVariant): Ditto.
-        (WebCore::CSSParser::parseFontWeight): Ditto.
-        * css/CSSParser.h:
-
-2008-08-24  Timothy Hatcher  <timothy@apple.com>
-
-        Fixes a bug where the Inspector's UI would not animate or
-        fully function because JavaScript timeouts, intervals and
-        CSS animation timers where not firing while paused at a
-        a breakpoint in the inspected page.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20042
-
-        Reviewed by Darin Adler.
-
-        Test: manual-tests/inspector/forzen-ui-while-paused.html
-
-        * page/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::pauseIfNeeded):
-        Add a call to TimerBase::fireTimersInNestedEventLoop before
-        spinning the EventLoop.
-
-2008-08-24  Rob Buis  <buis@kde.org>
-
-        Reviewed by Sam Weinig.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20324
-        A change in SVG Glyph wont show up
-
-        Invalidate the glyph cache when the d attribute is set.
-
-        Test: svg/custom/glyph-setting-d-attribute.svg
-
-        * svg/SVGGlyphElement.cpp:
-        (WebCore::SVGGlyphElement::invalidateGlyphCache):
-        (WebCore::SVGGlyphElement::parseMappedAttribute):
-        (WebCore::SVGGlyphElement::insertedIntoDocument):
-        (WebCore::SVGGlyphElement::removedFromDocument):
-        * svg/SVGGlyphElement.h:
-
-2008-08-24  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=13864
-          <rdar://problem/5451470> REGRESSION: Uninitialized value in RenderBlock::calcInlinePrefWidths()
-
-        * rendering/RenderText.cpp:
-        (WebCore::RenderText::trimmedPrefWidths): Moved the assignment to
-        beginWS and endWS before the early return to ensure that they are
-        initialized in that case.
-
-2008-08-23  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Rubber-stamped by Mark Rowe.
-
-        Remove modelines.
-
-        * WebCore.pro:
-        * bridge/testbindings.cpp:
-        * dom/DocPtr.h:
-        * loader/SubstituteData.h:
-        * page/Chrome.cpp:
-        * page/Chrome.h:
-        * page/ChromeClient.h:
-        * page/Frame.h:
-        * page/FrameLoadRequest.h:
-        * page/FrameTree.cpp:
-        * page/FrameTree.h:
-        * page/Page.h:
-        * page/mac/ChromeMac.mm:
-        * platform/network/HTTPHeaderMap.h:
-        * platform/network/ResourceErrorBase.cpp:
-        * platform/network/ResourceErrorBase.h:
-        * platform/network/ResourceHandleInternal.h:
-        * platform/network/ResourceRequestBase.cpp:
-        * platform/network/ResourceRequestBase.h:
-        * platform/network/ResourceResponseBase.cpp:
-        * platform/network/ResourceResponseBase.h:
-        * platform/network/cf/ResourceError.h:
-        * platform/network/cf/ResourceRequest.h:
-        * platform/network/cf/ResourceRequestCFNet.h:
-        * platform/network/cf/ResourceResponse.h:
-        * platform/network/cf/ResourceResponseCFNet.h:
-        * platform/network/curl/ResourceError.h:
-        * platform/network/curl/ResourceRequest.h:
-        * platform/network/curl/ResourceResponse.h:
-        * platform/network/mac/ResourceError.h:
-        * platform/network/mac/ResourceErrorMac.mm:
-        * platform/network/mac/ResourceRequest.h:
-        * platform/network/mac/ResourceRequestMac.mm:
-        * platform/network/mac/ResourceResponse.h:
-        * platform/network/mac/ResourceResponseMac.mm:
-        * platform/network/qt/ResourceError.h:
-        * platform/network/qt/ResourceRequest.h:
-        * platform/network/qt/ResourceResponse.h:
-        * platform/network/soup/CookieJarSoup.cpp:
-        * platform/network/soup/ResourceError.h:
-        * platform/network/soup/ResourceRequest.h:
-        * platform/network/soup/ResourceResponse.h:
-
-2008-08-23  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        - fix <rdar://problem/6065143> Reflowed image in first line of table doesn't affect baseline
-
-        Test: fast/table/vertical-align-baseline.html
-
-        * rendering/RenderTable.cpp:
-        (WebCore::RenderTable::getBaselineOfFirstLineBox): Added. Returns the
-        baseline of the first table row, if there is one, -1 otherwise.
-        * rendering/RenderTable.h:
-        * rendering/RenderTableCell.cpp:
-        (WebCore::RenderTableCell::baselinePosition): Changed to follow the
-        CSS2.1 definition of the baseline of a table cell.
-        * rendering/RenderTableSection.cpp:
-        (WebCore::RenderTableSection::getBaselineOfFirstLineBox): Added. Returns
-        the baseline of the first row in the section.
-        * rendering/RenderTableSection.h:
-
-2008-08-18  Jon Honeycutt  <jhoneycutt@apple.com>
-
-        Add SPI to make a Windows WebView transparent.
-
-        Reviewed by Dan Bernstein.
-
-        * platform/graphics/GraphicsContext.h: Add a parameter, hasAlpha, that
-        determines whether the created context has an alpha channel.
-        * platform/graphics/win/GraphicsContextCGWin.cpp:
-        (WebCore::CGContextWithHDC):
-
-2008-08-22  Timothy Hatcher  <timothy@apple.com>
-
-        Rolls out r35834 because it caused a regression in the Inspector's
-        Console where some expressions always threw a syntax error.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20487
-
-        * page/inspector/Console.js:
-        (Console.prototype._evalInInspectedWindow): Removes parenthesis
-        around the expression.
-
-2008-08-22  Timothy Hatcher  <timothy@apple.com>
-
-        Makes getStyleProperty return a value for the overflow property
-        when overflow-x and overflow-y are equal.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20485
-
-        Reviewed by Dan Bernstein.
-
-        Test: fast/css/overflow-property.html
-
-        * css/CSSMutableStyleDeclaration.cpp:
-        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
-
-2008-08-22  Timothy Hatcher  <timothy@apple.com>
-
-        Fixes a bug where while editing in the Inspector the
-        sidebar scroll position would jump to the top.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20484
-
-        Reviewed by Darin Adler.
-
-        * page/inspector/treeoutline.js:
-        (TreeOutline._removeChildren): Remove the offsetTop call that
-        was forcing a layout, since layout causes scroll positions
-        to be clamped to the new scrollHeight/Width. Layout will happen
-        normally when needed.
-
-2008-08-22  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix. Add AccessibilityTable sources.
-
-        * WebCoreSources.bkl:
-
-2008-08-21  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Jon Honeycutt and Alexey Proskuryakov.
-
-        - fix <rdar://problem/6162701> WebKit should correct Geeza Pro's font metrics
-
-        Test: platform/mac/fast/text/international/Geeza-Pro-vertical-metrics-adjustment.html
-
-        * platform/graphics/mac/SimpleFontDataMac.mm:
-        (WebCore::SimpleFontData::platformInit): Add 8% to Geeza Pro's reported
-        ascent and 100% to its reported descent.
-
-2008-08-21  Kalle Vahlman  <kalle.vahlman@movial.com>
-
-        Reviewed by Darin Adler.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20267
-        [GTK] Crash on some pages due to a plugin
-
-        Fix handling of badly formatted and empty plugin mime descriptions
-
-        * plugins/gtk/PluginPackageGtk.cpp:
-        (WebCore::PluginPackage::fetchInfo):
-
-2008-08-21  Kevin Watters  <kevinwatters@gmail.com>
-
-        Reviewed by Darin Adler.
-
-        Follow other ports (and IE) in ImageSourceWx.cpp never to return an
-        animated GIF frame duration of less than 50ms.
+        https://bugs.webkit.org/show_bug.cgi?id=26458
 
         * platform/graphics/wx/ImageSourceWx.cpp:
-        (WebCore::ImageSource::frameDurationAtIndex):
-
-2008-08-21  Maxime Britto  <britto@apple.com>
-
-        Reviewed by Kevin McCullough.
-
-        Test: fast/events/autoscroll-nonscrollable-iframe-in-scrollable-div.html
-        https://bugs.webkit.org/show_bug.cgi?id=20451
-   
-        rdar://problem/6166435 Inspector doesn't auto scroll when selecting text (20451)
-        When we climb up the rendering tree looking for a scrollable renderer, we need to be able to jump outside of an iframe.
-        This way we can see if what is embedding the iframe can be scrolled even if the iframe content can't.
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::handleMouseDraggedEvent): when we reach the document node and it can't be scrolled we set the next parent as the document's owner element if it exists.
-
-        (WebCore::EventHandler::handleMousePressEvent): ditto
-
-2008-08-21  Anthony Ricaud  <rik24d@gmail.com>
-
-        Small optimization for when the dividers in the Inspector's
-        Resources panel are updated.
-
-        Reviewed by Tim Hatcher.
-
-        * page/inspector/ResourcesPanel.js:
-        (WebInsector.ResourcesPanel.prototype._updateGraphDividersIfNeeded):
-        Combind a for loop and clone the divider element.
-
-2008-08-21  Chris Marrin  <cmarrin@apple.com>
-
-        Allow 0 (without units) for Time eg. duration
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=20467
-
-        Reviewed by Dave Hyatt.
-
-        Test: css1/units/zero-duration-without-units.html
-
-        * css/CSSParser.cpp:
-        (WebCore::CSSParser::validUnit):
-
-2008-08-21  Timothy Hatcher  <timothy@apple.com>
-
-        Make deleting all text while editing a DOM attribute in
-        the Inspector delete the attribute. This also fixes
-        an exception that would happen before.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20472
-
-        Reviewed by Kevin McCullough.
-
-        * page/inspector/ElementsPanel.js:
-        (WebInspector.DOMNodeTreeElement.prototype._attributeEditingCommitted):
-        Don't check for hasAttributes on the parseElement, continuing
-        through the function will correctly remove the attribute.
-        If the parseElement is null, call _editingCancelled not
-        editingCancelled, this fixes an exception.
-
-2008-08-21  Timothy Hatcher  <timothy@apple.com>
-
-        Update the Inspector's Metrics pane when editing in
-        the Styles pane. This makes sure the metrics shown
-        always match what the Styles pane shows.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20470
-
-        Reviewed by Kevin McCullough.
-
-        * page/inspector/ElementsPanel.js:
-        (WebInspector.ElementsPanel): Add event listeners for
-        the "style edited" and "style property toggled" events,
-        so the Metrics pane is updated.
-        (WebInspector.ElementsPanel.prototype._stylesPaneEdited):
-        Update the Metrics pane.
-        * page/inspector/StylesSidebarPane.js:
-        (WebInspector.StylePropertyTreeElement.prototype.toggleEnabled):
-        Dispatch the "style property toggled" event.
-        (WebInspector.StylePropertyTreeElement.prototype.editingCancelled):
-        Dispatch the "style edited" event when the CSS text is restored.
-        (WebInspector.StylePropertyTreeElement.prototype.applyStyleText):
-        Dispatch the "style edited" event.
-
-2008-08-21  Timothy Hatcher  <timothy@apple.com>
-
-        Make the Inspector's Metrics sidebar pane editable.
-
-        https://bugs.webkit.org/show_bug.cgi?id=17218
-        rdar://problem/5732818
-
-        Reviewed by Kevin McCullough.
-
-        * page/inspector/ElementsPanel.js:
-        (WebInspector.ElementsPanel): Add an event listener for
-        the "metrics edited" event, so the Styles pane is updated.
-        * page/inspector/MetricsSidebarPane.js:
-        (WebInspector.MetricsSidebarPane.prototype.update): Remember the node
-        so future updates work. Add a double click event listener for the
-        metric values to start editing.
-        (WebInspector.MetricsSidebarPane.prototype.startEditing):
-        Call WebInspector.startEditing with some context.
-        (WebInspector.MetricsSidebarPane.prototype.editingCancelled):
-        (WebInspector.MetricsSidebarPane.prototype.editingCommitted):
-        Set the user input on the elements inline style. Fire the
-        "metrics edited" event.
-
-2008-08-21  Steve Falkenburg  <sfalken@apple.com>
-
-        Fix a race condition in Windows timer code.
-        Timer function could end up being called with a 0 timer, leading to a Windows exception.
-        
-        Don't post a timer message if one is already pending.
-        
-        Reviewed by Ada Chan.
-
-        * platform/win/SharedTimerWin.cpp:
-        (WebCore::TimerWindowWndProc):
-        (WebCore::clearTimer):
-        (WebCore::queueTimerProc):
-        (WebCore::setSharedTimerFireTime):
-
-2008-08-21  Anthony Ricaud  <rik24d@gmail.com>
-
-        After trying to add the expression, try again with quotes for
-        easier edition.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20466
-
-        Reviewed by Tim Hatcher.
-
-        * page/inspector/ObjectPropertiesSection.js: Added an
-        evaluateExpression function.
-
-2008-08-21  Anthony Ricaud  <rik24d@gmail.com>
-
-        Perform Inspector searches on search event to clear results when
-        clicking the cross to empty it. Delete the lastQuery when the field
-        is emptied in order to perform the search if exactly the same query
-        is entered next.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20462
-
-        Reviewed by Tim Hatcher.
-
-        * page/inspector/inspector.js:
-
-2008-08-21  Marco Barisione  <marco.barisione@collabora.co.uk>
-
-        Reviewed by Mark Rowe.
-
-        http://bugs.webkit.org/show_bug.cgi?id=19656
-        [SOUP] The gio code should call didFail() instead of
-        didFinishLoading() in case of error
-
-        In case of error call didFail() instead of didReceiveResponse() and
-        didFinishLoading().
-
-        * platform/network/soup/ResourceHandleSoup.cpp:
-        (WebCore::networkErrorForFile):
-        (WebCore::readCallback):
-        (WebCore::openCallback):
-        (WebCore::queryInfoCallback):
-
-2008-08-20  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Jon Honeycutt.
-
-        Fix build failure.
-
-        * bridge/c/c_instance.cpp:
-        (KJS::Bindings::CInstance::getPropertyNames): Declare count as uint32_t rather than unsigned
-        as that is what NPEnumerationFunctionPtr is declared as accepting.
-
-2008-08-20  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Dan Bernstein.
+        (WebCore::ImageSource::setData):
 
-        Build fix.  Handle kCGInterpolationMedium in switch statements if it is available.
+2009-06-16  David Levin  <levin@chromium.org>
 
-        * platform/graphics/GraphicsContext.h:
-        (WebCore::):
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::GraphicsContext::setImageInterpolationQuality):
-        (WebCore::GraphicsContext::imageInterpolationQuality):
-
-2008-08-20  Dan Bernstein  <mitz@apple.com>
+        Reviewed by David Hyatt.
 
-        Rubber-stamped by John Sullivan.
+        REGRESSION: When the main page (ScrollView) has a custom scrollbar, it crashes on destruction.
+        https://bugs.webkit.org/show_bug.cgi?id=26326
 
-        - rename shouldUpdateWhileHidden to shouldUpdateWhileOffscreen and
-          rename related methods and variables accordingly.
+        Test: scrollbars/scrollbar-crash-on-refresh.html
 
-        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        Gives the FrameView a change to do any necessary cleanup on
+        Document::detach() which is where the renderArena gets detroyed.
         * page/FrameView.cpp:
-        (WebCore::FrameViewPrivate::FrameViewPrivate):
-        (WebCore::FrameView::shouldUpdateWhileOffscreen):
-        (WebCore::FrameView::setShouldUpdateWhileOffscreen):
+        (WebCore::FrameView::detachCustomScrollbars):
+        Gets rid of any custom scrollbars (if the docment supplied them).
         * page/FrameView.h:
-        * platform/ScrollView.h:
-        * platform/mac/ScrollViewMac.mm:
-        (WebCore::ScrollView::updateContents):
-
-2008-08-20  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by Mitzpettel
-
-        <rdar://problem/6153432> - Many images broken in Mail
-
-        This can be traced back to the preload scanner.  With that change, CachedResources are created a lot 
-        sooner than before and confuse the WebArchive machinery.  
-
-        When referencing WebArchive subresources directly through the WebKit API it is appropriate to ignore 
-        such CachedResources since they are placeholders and have not been submitted to the ResourceLoadDelegate 
-        machinery and nothing is known about where the data will eventually come from.
-
-        * loader/DocumentLoader.cpp:
-        (WebCore::DocumentLoader::subresource):  Ignore a CachedResource if its preloadResult is 
-          CachedResource::PreloadReferenced.
-
-2008-08-20  Holger Hans Peter Freyther  <zecke@selfish.org>
-
-        Unreviewed compile fix
-
-        Catch up with the JSValue::type elimination.
-
-        * bridge/qt/qt_instance.cpp:
-        (KJS::Bindings::QtRuntimeObjectImp::construct):
-        (KJS::Bindings::QtInstance::defaultValue):
-        * bridge/qt/qt_runtime.cpp:
-        (KJS::Bindings::QtRuntimeConnectionMethod::call):
-
-2008-08-20  Chris Teague  <chris.teague@gmail.com>
-
-        Reviewed by Mark Rowe.
-
-        Fix https://bugs.webkit.org/show_bug.cgi?id=20449
-        Bug 20449: Build fails if LOW_BANDWIDTH_DISPLAY is defined
-
-        * ChangeLog:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::switchOutLowBandwidthDisplayIfReady):
-
-2008-08-20  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        getComputedStyle() for webkitTransform should return a transform
-        that does not have the transform origin baked into it.
-        https://bugs.webkit.org/show_bug.cgi?id=20464
-        
-        Test: fast/css/getComputedStyle-transform.html
-
-        * css/CSSComputedStyleDeclaration.cpp:
-        (WebCore::computedTransform):
-        * rendering/style/RenderStyle.cpp:
-        (WebCore::RenderStyle::applyTransform):
-        * rendering/style/RenderStyle.h:
-
-2008-08-20  Josh Aas  <joshmoz@gmail.com>
-
-        Reviewed and landed by Anders.
-
-        <rdar://problem/6163636> 
-        rename NPCocoaEvent's "event" struct to "data" (20446)
-        
-        * bridge/npapi.h:
-        (_NPCocoaEvent::):
-
-2008-08-20  Beth Dakin  <bdakin@apple.com>
+        * platform/Scrollbar.h:
+        (WebCore::Scrollbar::isCustomScrollbar):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        Removed the check for document()->frame().  If frame() is 0 in this code,
+        then the call to animation() is also incorrect (since it does document()->frame()->animation()).
+        * rendering/RenderScrollbar.h:
+        (WebCore::RenderScrollbar::isCustomScrollbar):
 
-        Reviewed by Darin Adler.
+2009-06-16  Brian Weinstein  <bweinstein@apple.com>
 
-        Fix for <rdar://problem/6145626> 
-        This patch fixes a number of remaining problems getting 
-        disconnected frames to work correctly with markAllMatchesForText() 
-        and findString(). Details inline. 
+        Reviewed by Adele Peterson.
 
-        This was a static helper function in Frame, but this patch requires 
-        the same functionality in Editor, so I just added it as a function 
-        on Node.
-        * dom/Node.cpp:
-        (WebCore::Node::isInShadowTree):
-        * dom/Node.h:
+        Fix of <rdar://6967547> Ctrl-C copies null value erasing text in clipboard in Safari.
+        This patch kept the way events were firing as they were before, and Windows events are
+        consistent with Mac.       
 
         * editing/Editor.cpp:
-        (WebCore::Editor::insideVisibleArea): Returns false if 
-        excludeFromTextSearch() is true.
-
-        In a normal (non-disconnected) frame, findString returns a range of 
-        the document node if the text is not found in the frame. I changed 
-        firstVisibleRange and lastVisibleRange to match that behavior when 
-        the text is not found
-        (WebCore::Editor::firstVisibleRange):
-        (WebCore::Editor::lastVisibleRange):
-
-        Here are the bulk of the changes in the patch. A lot of text was 
-        not being found in disconnected frames because I failed to account 
-        for all of the possible problems associated with shadow trees. That 
-        is fixed here.
-        (WebCore::Editor::nextVisibleRange):
-        * editing/Editor.h:
-
-        excludeFromTextSearch() is new. It allows a WebKit client to mark a 
-        frame as not-text-searchable through SPI. 
-        * WebCore.base.exp:
-        * page/Frame.cpp:
-        (WebCore::Frame::excludeFromTextSearch):
-        (WebCore::Frame::setExcludeFromTextSearch):
-        (WebCore::FramePrivate::FramePrivate):
-        * page/Frame.h:
-        * page/FramePrivate.h:
-
-        (WebCore::Frame::findString):
-        (WebCore::Frame::markAllMatchesForText):  I kept running into an 
-        assertion failure in paining code because of the forced paint on 
-        empty visible rects.
-
-2008-08-20  Timothy Hatcher  <timothy@apple.com>
-
-        Adds a positon box to the Inspector's Metrics sidebar
-        pane. When an element is not statically positioned, there
-        is now a position box that show top, right, bottom and
-        left computed values.
-
-        Reviewed by Kevin McCullough.
-
-        * English.lproj/localizedStrings.js: Updated the strings.
-        * page/inspector/MetricsSidebarPane.js:
-        (WebInspector.MetricsSidebarPane.prototype.update):
-        Renamed the boxPartValue function to createBoxPartElement
-        and made it create the entire element. Made it understand
-        how to get position style properties. Don't use the figure dash
-        when 0px is used for positions, since the 0 is meaningful there.
-        Instead use the figure dash when a position is auto.
-        * page/inspector/inspector.css: Added a new rule for position.
-
-2008-08-20  Chris Fleizach  <cfleizach@apple.com>
-
-        Reviewed by Beth Dakin
-
-        Qt build fix
-
-        * WebCore.pro:
-
-2008-08-20  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Anders Carlsson.
-
-        - avoid using a deprecated NSScroller method on Leopard
-
-        * platform/mac/PlatformScrollBarMac.mm:
-        (WebCore::PlatformScrollbar::updateThumbPosition):
-        (WebCore::PlatformScrollbar::updateThumbProportion):
-
-2008-08-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Oliver Hunt.
-
-        Gtk build fix
-
-        * GNUmakefile.am:
-        * page/AccessibilityTable.cpp: Change nil to 0
-        (WebCore::AccessibilityTable::cellForColumnAndRow):
-
-2008-08-19  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Geoff Garen.
-
-        Bring back shared JSGlobalData and implicit locking, because too many clients rely on it.
-
-        * ForwardingHeaders/kjs/JSLock.h: Added.
-        * WebCore.vcproj/WebCore.vcproj:
-        * bindings/js/GCController.cpp:
-        (WebCore::collect):
-        (WebCore::GCController::gcTimerFired):
-        (WebCore::GCController::garbageCollectNow):
-        * bindings/js/JSCustomSQLStatementCallback.cpp:
-        (WebCore::JSCustomSQLStatementCallback::handleEvent):
-        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
-        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionCallback.cpp:
-        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
-        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
-        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
-        * bindings/js/JSCustomVoidCallback.cpp:
-        (WebCore::JSCustomVoidCallback::handleEvent):
-        * bindings/js/JSCustomXPathNSResolver.cpp:
-        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
-        * bindings/js/JSDOMWindowBase.cpp:
-        (WebCore::DOMWindowTimer::~DOMWindowTimer):
-        (WebCore::JSDOMWindowBase::clear):
-        (WebCore::JSDOMWindowBase::timerFired):
-        * bindings/js/JSEventCustom.cpp:
-        (WebCore::toJS):
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSAbstractEventListener::handleEvent):
-        * bindings/js/JSNSResolver.cpp:
-        (WebCore::JSNSResolver::lookupNamespaceURI):
-        * bindings/js/JSNodeFilterCondition.cpp:
-        (WebCore::JSNodeFilterCondition::acceptNode):
-        * bindings/js/ScheduledAction.cpp:
-        (WebCore::ScheduledAction::execute):
-        * bindings/js/ScriptController.cpp:
-        (WebCore::ScriptController::evaluate):
-        (WebCore::ScriptController::clearWindowShell):
-        (WebCore::ScriptController::createHTMLEventHandler):
-        (WebCore::ScriptController::createSVGEventHandler):
-        (WebCore::ScriptController::initScript):
-        (WebCore::ScriptController::updateDocument):
-        (WebCore::ScriptController::bindingRootObject):
-        (WebCore::ScriptController::windowScriptNPObject):
-        (WebCore::ScriptController::createScriptObjectForPluginElement):
-        (WebCore::ScriptController::clearScriptObjects):
-        * bindings/js/ScriptControllerMac.mm:
-        (WebCore::ScriptController::windowScriptObject):
-        * bindings/objc/WebScriptObject.mm:
-        (_didExecute):
-        (-[WebScriptObject callWebScriptMethod:withArguments:]):
-        (-[WebScriptObject evaluateWebScript:]):
-        (-[WebScriptObject setValue:forKey:]):
-        (-[WebScriptObject valueForKey:]):
-        (-[WebScriptObject removeWebScriptKey:]):
-        (-[WebScriptObject stringRepresentation]):
-        (-[WebScriptObject webScriptValueAtIndex:]):
-        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
-        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
-        * bridge/NP_jsobject.cpp:
-        (_NPN_InvokeDefault):
-        (_NPN_Invoke):
-        (_NPN_Evaluate):
-        (_NPN_GetProperty):
-        (_NPN_SetProperty):
-        (_NPN_RemoveProperty):
-        (_NPN_HasProperty):
-        (_NPN_HasMethod):
-        (_NPN_Enumerate):
-        * bridge/c/c_class.cpp:
-        (KJS::Bindings::CClass::~CClass):
-        (KJS::Bindings::CClass::methodsNamed):
-        (KJS::Bindings::CClass::fieldNamed):
-        * bridge/c/c_instance.cpp:
-        (KJS::Bindings::CInstance::invokeMethod):
-        (KJS::Bindings::CInstance::invokeDefaultMethod):
-        (KJS::Bindings::CInstance::getPropertyNames):
-        * bridge/c/c_runtime.cpp:
-        (KJS::Bindings::CField::valueFromInstance):
-        (KJS::Bindings::CField::setValueToInstance):
-        * bridge/c/c_utility.cpp:
-        (KJS::Bindings::convertValueToNPVariant):
-        (KJS::Bindings::convertNPVariantToValue):
-        * bridge/jni/jni_class.cpp:
-        (JavaClass::JavaClass):
-        (JavaClass::~JavaClass):
-        * bridge/jni/jni_instance.cpp:
-        (JavaInstance::stringValue):
-        * bridge/jni/jni_jsobject.mm:
-        (JavaJSObject::call):
-        (JavaJSObject::eval):
-        (JavaJSObject::getMember):
-        (JavaJSObject::setMember):
-        (JavaJSObject::removeMember):
-        (JavaJSObject::getSlot):
-        (JavaJSObject::setSlot):
-        (JavaJSObject::toString):
-        (JavaJSObject::convertValueToJObject):
-        (JavaJSObject::convertJObjectToValue):
-        * bridge/jni/jni_objc.mm:
-        (KJS::Bindings::dispatchJNICall):
-        * bridge/jni/jni_runtime.cpp:
-        (appendClassName):
-        (JavaMethod::signature):
-        * bridge/jni/jni_runtime.h:
-        (KJS::Bindings::JavaString::JavaString):
-        (KJS::Bindings::JavaString::_commonInit):
-        (KJS::Bindings::JavaString::~JavaString):
-        (KJS::Bindings::JavaString::UTF8String):
-        * bridge/jni/jni_utility.cpp:
-        (KJS::Bindings::convertValueToJValue):
-        * bridge/npruntime.cpp:
-        (_NPN_GetStringIdentifier):
-        * bridge/objc/objc_instance.mm:
-        (ObjcInstance::moveGlobalExceptionToExecState):
-        (ObjcInstance::invokeMethod):
-        (ObjcInstance::invokeDefaultMethod):
-        (ObjcInstance::setValueOfUndefinedField):
-        (ObjcInstance::getValueOfUndefinedField):
-        * bridge/objc/objc_runtime.mm:
-        (ObjcField::valueFromInstance):
-        (ObjcField::setValueToInstance):
-        * bridge/objc/objc_utility.mm:
-        (KJS::Bindings::convertValueToObjcValue):
-        (KJS::Bindings::convertNSStringToString):
-        (KJS::Bindings::convertObjcValueToValue):
-        * bridge/qt/qt_instance.cpp:
-        (KJS::Bindings::QtRuntimeObjectImp::removeFromCache):
-        (KJS::Bindings::QtInstance::~QtInstance):
-        (KJS::Bindings::QtInstance::getQtInstance):
-        (KJS::Bindings::QtInstance::getRuntimeObject):
-        * bridge/qt/qt_runtime.cpp:
-        (KJS::Bindings::convertValueToQVariant):
-        (KJS::Bindings::convertQVariantToValue):
-        (KJS::Bindings::QtRuntimeMetaMethod::call):
-        (KJS::Bindings::QtRuntimeConnectionMethod::call):
-        (KJS::Bindings::QtConnectionObject::QtConnectionObject):
-        (KJS::Bindings::QtConnectionObject::execute):
-        * bridge/runtime.cpp:
-        (KJS::Bindings::Instance::createRuntimeObject):
-        * bridge/testbindings.cpp:
-        (main):
-        * bridge/testbindings.mm:
-        (main):
-        * bridge/testqtbindings.cpp:
-        (main):
-        * dom/Document.cpp:
-        (WebCore::Document::~Document):
-        * dom/Node.cpp:
-        (WebCore::Node::setDocument):
-        * history/CachedPage.cpp:
-        (WebCore::CachedPage::CachedPage):
-        (WebCore::CachedPage::restore):
-        (WebCore::CachedPage::clear):
-        * loader/FrameLoader.cpp:
-        (WebCore::getString):
-        * page/InspectorController.cpp:
-        (WebCore::ConsoleMessage::ConsoleMessage):
-        (WebCore::XMLHttpRequestResource::XMLHttpRequestResource):
-        (WebCore::XMLHttpRequestResource::~XMLHttpRequestResource):
-        (WebCore::getResourceDocumentNode):
-        (WebCore::search):
-        (WebCore::inspectedWindow):
-        (WebCore::wrapCallback):
-        (WebCore::currentCallFrame):
-        (WebCore::profiles):
-        (WebCore::InspectorController::focusNode):
-        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
-        (WebCore::InspectorController::addDatabaseScriptResource):
-        (WebCore::InspectorController::addScriptProfile):
-        * page/JavaScriptCallFrame.cpp:
-        (WebCore::JavaScriptCallFrame::evaluate):
-        * page/JavaScriptProfileNode.cpp:
-        (WebCore::getTotalTime):
-        (WebCore::getSelfTime):
-        (WebCore::getTotalPercent):
-        (WebCore::getSelfPercent):
-        (WebCore::getNumberOfCalls):
-        (WebCore::getChildren):
-        (WebCore::getVisible):
-        * page/Page.cpp:
-        * page/mac/FrameMac.mm:
-        * plugins/PluginView.cpp:
-        (WebCore::PluginView::start):
-        (WebCore::getString):
-        (WebCore::PluginView::performRequest):
-        (WebCore::PluginView::bindingInstance):
-        * plugins/gtk/PluginViewGtk.cpp:
-        (WebCore::PluginView::paint):
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::handleMouseEvent):
-        (WebCore::PluginView::setNPWindowRect):
-        (WebCore::PluginView::stop):
-        (WebCore::PluginView::init):
-        * plugins/qt/PluginViewQt.cpp:
-        (WebCore::PluginView::setNPWindowRect):
-        (WebCore::PluginView::stop):
-        (WebCore::PluginView::init):
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::dispatchNPEvent):
-        (WebCore::PluginView::handleKeyboardEvent):
-        (WebCore::PluginView::handleMouseEvent):
-        (WebCore::PluginView::setNPWindowRect):
-        (WebCore::PluginView::stop):
-        * xml/XMLHttpRequest.cpp:
-        (WebCore::XMLHttpRequest::clearResponse):
-        (WebCore::XMLHttpRequest::didFinishLoading):
-        (WebCore::XMLHttpRequest::didReceiveData):
-
-2008-08-19  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Geoff Garen.
-
-        Add the beginnings of Skia graphics support to WebCore
-        as I try to begin the long process of un-forking the changes
-        needed to WebCore to make Andriod's WebCore build.
-
-        I'll follow this up with actual *Skia.cpp files in a separate patch.
-
-        * platform/graphics/AffineTransform.h:
-        * platform/graphics/FloatPoint.h:
-        * platform/graphics/FloatRect.h:
-        * platform/graphics/Gradient.h:
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/Image.h:
-        * platform/graphics/ImageBuffer.h:
-        * platform/graphics/ImageSource.h:
-        * platform/graphics/IntPoint.h:
-        * platform/graphics/IntRect.h:
-        * platform/graphics/Path.h:
-        * platform/graphics/Pattern.h:
-        * svg/graphics/SVGPaintServerPattern.h:
-        * svg/graphics/SVGPaintServerSolid.h:
-
-2008-08-19  Steve Falkenburg  <sfalken@apple.com>
-
-        Fix Windows build more.
-
-        * WebCore.vcproj/WebCore.vcproj:
-
-2008-08-19  Steve Falkenburg  <sfalken@apple.com>
-
-        Fix Windows build.
-
-        * page/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
-
-2008-08-19  Chris Fleizach  <cfleizach@apple.com>
+        (WebCore::Editor::tryDHTMLCopy): Added check for canCopy() before clearing PasteBoard
+        (WebCore::Editor::tryDHTMLCut): Added check for canCut() before clearing PasteBoard
 
-        Reviewed by Beth Dakin.
+2009-06-16  Antti Koivisto  <antti@apple.com>
 
-        <rdar://problem/4003764> Expose tables as AXTables
- 
-        Tests: accessibility/table-attributes.html
-               accessibility/table-cell-spans.html
-               accessibility/table-cells.html
-               accessibility/table-detection.html
-               accessibility/table-sections.html
-               accessibility/table-with-rules.html
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * page/AXObjectCache.cpp:
-        (WebCore::AXObjectCache::get):
-        * page/AccessibilityObject.h:
-        (WebCore::):
-        (WebCore::AccessibilityObject::isDataTable):
-        (WebCore::AccessibilityObject::isTableRow):
-        (WebCore::AccessibilityObject::isTableColumn):
-        (WebCore::AccessibilityObject::isTableCell):
-        * page/AccessibilityRenderObject.cpp:
-        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
-        * page/AccessibilityTable.cpp: Added.
-        (WebCore::AccessibilityTable::AccessibilityTable):
-        (WebCore::AccessibilityTable::~AccessibilityTable):
-        (WebCore::AccessibilityTable::create):
-        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
-        (WebCore::AccessibilityTable::clearChildren):
-        (WebCore::AccessibilityTable::addChildren):
-        (WebCore::AccessibilityTable::headerContainer):
-        (WebCore::AccessibilityTable::columns):
-        (WebCore::AccessibilityTable::rows):
-        (WebCore::AccessibilityTable::rowHeaders):
-        (WebCore::AccessibilityTable::columnHeaders):
-        (WebCore::AccessibilityTable::cells):
-        (WebCore::AccessibilityTable::columnCount):
-        (WebCore::AccessibilityTable::rowCount):
-        (WebCore::AccessibilityTable::cellForColumnAndRow):
-        (WebCore::AccessibilityTable::roleValue):
-        (WebCore::AccessibilityTable::accessibilityIsIgnored):
-        (WebCore::AccessibilityTable::title):
-        (WebCore::AccessibilityTable::isDataTable):
-        * page/AccessibilityTable.h: Added.
-        * page/AccessibilityTableCell.cpp: Added.
-        (WebCore::AccessibilityTableCell::AccessibilityTableCell):
-        (WebCore::AccessibilityTableCell::~AccessibilityTableCell):
-        (WebCore::AccessibilityTableCell::create):
-        (WebCore::AccessibilityTableCell::accessibilityIsIgnored):
-        (WebCore::AccessibilityTableCell::rowIndexRange):
-        (WebCore::AccessibilityTableCell::columnIndexRange):
-        * page/AccessibilityTableCell.h: Added.
-        (WebCore::AccessibilityTableCell::isTableCell):
-        (WebCore::AccessibilityTableCell::roleValue):
-        * page/AccessibilityTableColumn.cpp: Added.
-        (WebCore::AccessibilityTableColumn::AccessibilityTableColumn):
-        (WebCore::AccessibilityTableColumn::~AccessibilityTableColumn):
-        (WebCore::AccessibilityTableColumn::create):
-        (WebCore::AccessibilityTableColumn::setParentTable):
-        (WebCore::AccessibilityTableColumn::elementRect):
-        (WebCore::AccessibilityTableColumn::size):
-        (WebCore::AccessibilityTableColumn::children):
-        (WebCore::AccessibilityTableColumn::headerObject):
-        (WebCore::AccessibilityTableColumn::headerObjectForSection):
-        (WebCore::AccessibilityTableColumn::addChildren):
-        * page/AccessibilityTableColumn.h: Added.
-        (WebCore::AccessibilityTableColumn::parentObject):
-        (WebCore::AccessibilityTableColumn::roleValue):
-        (WebCore::AccessibilityTableColumn::accessibilityIsIgnored):
-        (WebCore::AccessibilityTableColumn::isTableColumn):
-        (WebCore::AccessibilityTableColumn::setColumnIndex):
-        (WebCore::AccessibilityTableColumn::columnIndex):
-        * page/AccessibilityTableHeaderContainer.cpp: Added.
-        (WebCore::AccessibilityTableHeaderContainer::AccessibilityTableHeaderContainer):
-        (WebCore::AccessibilityTableHeaderContainer::~AccessibilityTableHeaderContainer):
-        (WebCore::AccessibilityTableHeaderContainer::create):
-        (WebCore::AccessibilityTableHeaderContainer::children):
-        (WebCore::AccessibilityTableHeaderContainer::elementRect):
-        (WebCore::AccessibilityTableHeaderContainer::size):
-        (WebCore::AccessibilityTableHeaderContainer::addChildren):
-        * page/AccessibilityTableHeaderContainer.h: Added.
-        (WebCore::AccessibilityTableHeaderContainer::roleValue):
-        (WebCore::AccessibilityTableHeaderContainer::setParentTable):
-        (WebCore::AccessibilityTableHeaderContainer::parentObject):
-        (WebCore::AccessibilityTableHeaderContainer::accessibilityIsIgnored):
-        * page/AccessibilityTableRow.cpp: Added.
-        (WebCore::AccessibilityTableRow::AccessibilityTableRow):
-        (WebCore::AccessibilityTableRow::~AccessibilityTableRow):
-        (WebCore::AccessibilityTableRow::create):
-        (WebCore::AccessibilityTableRow::accessibilityIsIgnored):
-        (WebCore::AccessibilityTableRow::headerObject):
-        * page/AccessibilityTableRow.h: Added.
-        (WebCore::AccessibilityTableRow::isTableRow):
-        (WebCore::AccessibilityTableRow::roleValue):
-        (WebCore::AccessibilityTableRow::setRowIndex):
-        (WebCore::AccessibilityTableRow::rowIndex):
-        * page/mac/AccessibilityObjectWrapper.mm:
-        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
-        (RoleEntry::):
-        (-[AccessibilityObjectWrapper roleDescription]):
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
-        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
-        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
-
-2008-08-19  Steve Falkenburg  <sfalken@apple.com>
-
-        Build fix.
-        Add buildfailed support to stop builds early (preventing inaccurate error messages).
-        Add missing post-build rule to Release.
-
-        * WebCore.vcproj/QTMovieWin.vcproj:
-
-2008-08-19  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Added support for console.count in the inspector.
-
-        Reviewed by Geoff Garen.
-
-        * page/Console.cpp:
-        (WebCore::Console::count):
-        * page/Console.h:
-        * page/Console.idl: Added console.count.
-        * page/InspectorController.cpp:
-        (WebCore::InspectorController::didCommitLoad): Clears m_counts.
-        (WebCore::InspectorController::count): Updates the count number
-        sing "title@source:line" as the identifier, and adds a
-        message to the console.
-        * page/InspectorController.h: Added m_counts.
-
-2008-08-19  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Clear console.time timers when changing page.
-
-        Reviewed by Geoff Garen.
-
-        * page/InspectorController.cpp:
-        (WebCore::InspectorController::didCommitLoad):
-
-2008-08-19  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Adele.
-
-        Fix for <rdar://problem/6154695> Full-page movies flicker while playing
-        https://bugs.webkit.org/show_bug.cgi?id=20404
-
-        Ignore setVisible() when visibility doesn't change.
-
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
-        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
-        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
-        (WebCore::MediaPlayerPrivate::setVisible):
-
-2008-08-19  Timothy Hatcher  <timothy@apple.com>
-
-        Fixes a bug in the Profile view where switching sort order, then
-        switching from heavy to tree mode would show the tree in the
-        previous sort order.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20441
-
-        Reviewed by Kevin McCullough.
-
-        * page/inspector/ProfileView.js:
-        (WebInspector.ProfileView.prototype._changeView): Call _sortProfile
-        on the next profile before assigning it to this.profile.
-        (WebInspector.ProfileView.prototype._sortData): Call _sortProfile.
-        (WebInspector.ProfileView.prototype._sortProfile): Moves from
-        _sortData and takes a profile argument. If the profile passed in
-        matches the this.profile, then call refresh.
-
-2008-08-18  Timothy Hatcher  <timothy@apple.com>
-
-        Changed the default sort order now that heavy view is the default.
-        Also fixes a bug where the heavy profile was not sorted at first.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20440
-
-        Reviewed by Kevin McCullough.
-
-        * page/inspector/ProfileView.js:
-        (WebInspector.ProfileView): Changed the default sort column. Also assign
-        heavyProfile to profile, so the sortSelfTimeDescending call happens
-        on the heavy profile before assigning to this.profile.
-
-2008-08-18  Timothy Hatcher  <timothy@apple.com>
-
-        Add support for editing DOM properties and scope variables by double
-        clicking a property to enter edit mode.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20415
-
-        Reviewed by Kevin McCullough.
-
-        * page/inspector/ObjectPropertiesSection.js:
-        (WebInspector.ObjectPropertiesSection): Set editable to true by default.
-        (WebInspector.ObjectPropertiesSection.prototype.onpopulate):
-        Factored out code into update, and calls update.
-        (WebInspector.ObjectPropertiesSection.prototype.update): Moved from onpopulate.
-        Call removeChildren since this method can be called multiple times now.
-        (WebInspector.ObjectPropertyTreeElement): Pass an empty title, the title
-        gets made later in onattach.
-        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate): Don't return early
-        if shouldRefreshChildren is true. Call removeChildren since this method can be
-        called multiple times now.
-        (WebInspector.ObjectPropertyTreeElement.prototype.ondblclick): Call startEditing.
-        (WebInspector.ObjectPropertyTreeElement.prototype.onattach): Call update.
-        (WebInspector.ObjectPropertyTreeElement.prototype.update): Update the title for
-        this element (code moved from the constructor.)
-        (WebInspector.ObjectPropertyTreeElement.prototype.updateSiblings): Recreate all
-        sibling property elements.
-        (WebInspector.ObjectPropertyTreeElement.prototype.startEditing): Call
-        WebInspector.startEditing after rememebring some context.
-        (WebInspector.ObjectPropertyTreeElement.prototype.editingEnded): Reset the scrollLeft
-        for the list element, since it might have scrolled during editing.
-        (WebInspector.ObjectPropertyTreeElement.prototype.editingCancelled): Call editingEnded
-        then restore the state from the context. Then call update to restore the title.
-        (WebInspector.ObjectPropertyTreeElement.prototype.editingCommitted): Call editingCancelled
-        if the user input and the previous input are the same. Call editingEnded, then call applyExpression
-        to commit the user input.
-        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression): Evaluates the input expression
-        and stores the result on the object for the property name of this element. If the expression is
-        empty, delete the property and remove the tree element.
-        * page/inspector/ScopeChainSidebarPane.js:
-        (WebInspector.ScopeChainSidebarPane.prototype.update): Set the editInSelectedCallFrameWhenPaused
-        property on each ObjectPropertiesSection.
-        (WebInspector.ScopeVariableTreeElement.prototype.onattach): Call ObjectPropertyTreeElement's onattach
-        since it is now implemented.
-        * page/inspector/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame): Added an updateInterface argument
-        that defaults to true if omitted. It specifies whether to call update on the scope chain.
-        * page/inspector/inspector.css: New styles.
-        * page/inspector/treeoutline.js:
-        (TreeElement.prototype._attach): Fixed an exception that fired when handling the shouldRefreshChildren
-        change. The nextSibling would exist but have a _listItemNode that didn't match the new parent.
-
-2008-08-18  Timothy Hatcher  <timothy@apple.com>
-
-        Surround the expression to be evaluated in parenthesis so the
-        result of the eval is the result of the whole expression not
-        the last potential sub-expression. So evaluating {x: 123}
-        will show the Object not 123.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20428
-
-        Reviewed by Kevin McCullough.
-
-        * page/inspector/Console.js:
-        (Console.prototype._evalInInspectedWindow): Add parenthesis
-        around the expression. And add couple comments.
-
-2008-08-19 Kevin McCullough <kmccullough@apple.com>
-
-        Reviewed by Geoff.
-
-        -Implement a page() function to extract a common code pattern.
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * page/Console.cpp:
-        (WebCore::Console::addMessage):
-        (WebCore::Console::error):
-        (WebCore::Console::info):
-        (WebCore::Console::log):
-        (WebCore::Console::dir):
-        (WebCore::Console::assertCondition):
-        (WebCore::Console::time):
-        (WebCore::Console::timeEnd):
-        (WebCore::Console::group):
-        (WebCore::Console::groupEnd):
-        (WebCore::Console::finishedProfiling):
-        (WebCore::Console::warn):
-        (WebCore::Console::framePage):
-        * page/Console.h:
-
-2008-08-12  Darin Adler  <darin@apple.com>
-
-        Reviewed by Geoff.
-
-        - eliminate JSValue::type()
-
-        * bridge/c/c_instance.cpp:
-        (KJS::Bindings::CInstance::defaultValue): Take PreferredPrimitiveType
-        argument instead of JSType argument. Removed unneeded code to handle
-        boolean, since that's never passed.
-        * bridge/c/c_instance.h: Ditto.
-
-        * bridge/c/c_utility.cpp:
-        (KJS::Bindings::convertValueToNPVariant): Use JSValue::is functions
-        instead of JSValue::type(). Removed unneeded code to handle
-        "unspecified".
-
-        * bridge/jni/jni_instance.cpp:
-        (JavaInstance::defaultValue): Take PreferredPrimitiveType argument
-        instead of JSType argument. Removed unneeded code to handle boolean.
-        * bridge/jni/jni_instance.h: Ditto.
-
-        * bridge/jni/jni_jsobject.mm:
-        (JavaJSObject::convertValueToJObject): Use JSValue::is functions
-        instead of JSValue::type().
-
-        * bridge/objc/objc_instance.h: Take PreferredPrimitiveType argument
-        instead of JSType argument. Removed unused argument.
-        * bridge/objc/objc_instance.mm:
-        (ObjcInstance::getValueOfUndefinedField): Removed unused argument.
-        (ObjcInstance::defaultValue): Take PreferredPrimitiveType argument
-        instead of JSType argument. Removed unneeded code to handle boolean
-        and another dead code path for unknown types.
-
-        * bridge/objc/objc_runtime.h: Take PreferredPrimitiveType argument
-        instead of JSType argument. Removed override of type() that caused
-        the fallback object to return "UndefinedType" when there is no
-        invokeUndefinedMethodFromWebScript:withArguments: method defined.
-        That didn't accomplish much, since most checks for undefined don't
-        ever call type().
-        * bridge/objc/objc_runtime.mm:
-        (ObjcFallbackObjectImp::defaultValue): Ditto.
-
-        * bridge/qt/qt_instance.cpp:
-        (KJS::Bindings::QtInstance::defaultValue): Take PreferredPrimitiveType
-        argument instead of JSType argument. Removed unneeded code to handle
-        boolean.
-        * bridge/qt/qt_instance.h: Ditto.
-
-        * bridge/runtime.h:
-        (KJS::Bindings::Instance::getValueOfUndefinedField): Removed
-        unsed argument.
-        * bridge/runtime_object.cpp:
-        (RuntimeObjectImp::defaultValue): Take PreferredPrimitiveType
-        argument instead of JSType argument.
-        * bridge/runtime_object.h: Ditto.
-
-2008-08-18  Maxime Britto  <britto@apple.com>
-
-        Reviewed by Adele.
-
-        <rdar://6157207> Mouse pointer does not change when new window is opened after pan-scrolling original window
-        Related to the discussion from rdar://6102511 , we should disable every key event (except for the esc key which stops the panning).
-        We shouldn't be able to create another window while we are in pan scrolling.
-        Other browsers behaviors :
-          FF3 : Most of the keys are disabled, there is no way to create another window while in panscroll mode
-          IE7 : Keys are not disabled but stops immediately the panning.
-        This patch matches FF3 behavior by disabling every key but the esc key.
-
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::stopAutoscrollTimer): Change the cursor back to the regular arrow cursor when the pannning is stopped.
-        (WebCore::EventHandler::keyEvent): When a key event is received while in panning or autoscroll we swallow the event early.
-
-2008-08-18  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Dave Hyatt.
-
-        - fix <rdar://problem/5862634> REGRESSION (3.1.1): In iChat, inline image not resizable past current size after another IM is received
-
-        Test: fast/replaced/max-width-percent.html
-
-        Added an includeMaxWidth boolean to RenderBox::calcReplaedWidth().
-        When false, max-width is not factored into the
-        calculation.
-        Changed RenderReplaced and subclasses' calcPrefWidths() to call
-        calcReplacedWidth(false) and then apply max-width only if it has a
-        fixed, positive value.
-
-        * rendering/RenderBox.cpp:
-        (WebCore::RenderBox::calcReplacedWidth):
-        * rendering/RenderBox.h:
-        * rendering/RenderImage.cpp:
-        (WebCore::RenderImage::calcReplacedWidth):
-        (WebCore::RenderImage::calcPrefWidths): 
-        * rendering/RenderImage.h:
-        * rendering/RenderReplaced.cpp:
-        (WebCore::RenderReplaced::calcPrefWidths):
-        * rendering/RenderSVGRoot.cpp:
-        (WebCore::RenderSVGRoot::calcPrefWidths):
-        * rendering/RenderVideo.cpp:
-        (WebCore::RenderVideo::calcReplacedWidth):
-        (WebCore::RenderVideo::calcPrefWidths):
-        * rendering/RenderVideo.h:
-
-2008-08-18  Daniel Macks  <dmacks@netspace.org>
-
-        Reviewed by Mark Rowe.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20410
-        More portable/self-documenting replacement for SIZE_MAX.
-
-        * platform/network/curl/FormDataStreamCurl.cpp:
-        (WebCore::FormDataStream::read):
-
-2008-08-18  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        Need to make sure we have an Animation in the AnimationList
-        before setting the initial value.
-        https://bugs.webkit.org/show_bug.cgi?id=20408
-
-        Test: fast/css/transition_shorthand_parsing.html
-
-        * css/CSSStyleSelector.cpp:
-
-2008-08-18  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Tim.
-
-        <rdar://problem/6150593> JSProfiler: Empty profiles disappear when there
-        is another profile.
-
-        * page/inspector/ProfilesPanel.js:
-
-2008-08-18  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Geoff.
-
-        <rdar://problem/6150642> REGRESSION: Closing the Web Inspector clears
-        all console messages
-
-        * page/inspector/Console.js:
-
-2008-08-18  Dirk Schulze  <vbs85@gmx.de>
-
-        Reviewed by Eric Seidel.
-
-        Fixed Canvas for Cairo. Stroke and fill colors didn't work after
-        the canvas clean up.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20405
-
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::fill):
-        (WebCore::CanvasRenderingContext2D::stroke):
-        (WebCore::CanvasRenderingContext2D::fillRect):
-
-2008-08-17  Timothy Hatcher  <timothy@apple.com>
-
-        Complete in scope variables in the Console when paused.
-
-        https://bugs.webkit.org/show_bug.cgi?id=19115
-
-        Reviewed by Geoffrey Garen.
-
-        * page/inspector/Console.js:
-        (WebInspector.Console.prototype.completions): If the expressionString
-        is null or empty and the debugger is paused, call variablesInScopeForSelectedCallFrame
-        to get an object that declares all the in scope variables. That way
-        "top level" expressions are completed.
-        * page/inspector/ScriptsPanel.js:
-        (WebInspector.ScriptsPanel.prototype.variablesInScopeForSelectedCallFrame):
-        Return an object that has all the variables that are in scope for the
-        selected call frame. The value of each property is just true.
-        The return object is useful for quick lookups or auto completion.
-
-2008-08-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
-
-        Not reviewed.
-
-        Speculative Qt build fix.
-
-        * bridge/qt/qt_runtime.cpp:
-        (KJS::Bindings::convertValueToQVariant):
-        (KJS::Bindings::QtRuntimeMethod::QtRuntimeMethod):
-
-2008-08-17  Geoffrey Garen  <ggaren@apple.com>
+        Reviewed by Brady Eidson.
 
-        Reviewed by Cameron Zwarich.
+        <rdar://problem/6660037> CrashTracer: [USER] 46 crashes in Safari at com.apple.WebCore • WebCore::CachedCSSStyleSheet::addClient + 53
         
-        Updated project files to XCode 3.1.
-
-        * manual-tests/NPN_Invoke/NPN_Invoke.xcodeproj/project.pbxproj:
-
-2008-08-17  Geoffrey Garen  <ggaren@apple.com>
-
-        Reviewed by Cameron Zwarich.
-
-        Made room for a free word in JSCell.
+        When revalidating a resource, calling addClient() on one client might cause another to get removed.
         
-        Changed JSDOMWindowBase to store its auxiliary data in a subclass of
-        JSGlobalData, so the two could share a pointer.
+        - made CachedResource::addClient() non-virtual and added virtual didAddClient()
+        - in CachedResource::switchClientsToRevalidatedResource() add all clients to the client set of the revalidated resource first
+        - check if the client is still in the set before invoking didAddClient() for it
         
-        Added a bunch of ASSERTs, to help catch over-sized objects.
-
-2008-08-15  Mark Rowe  <mrowe@apple.com>
-
-        Reviewed by Dan Bernstein.
-
-        Disable dead code stripping in debug builds.
-
-        * Configurations/Base.xcconfig:
-        * WebCore.xcodeproj/project.pbxproj:
-
-2008-08-15  Mark Rowe  <mrowe@apple.com>
-
-        Rubber-stamped by Geoff Garen.
-
-        <rdar://problem/6139914> Please include a _debug version of JavaScriptCore framework
-
-        * Configurations/Base.xcconfig: Factor out the debug-only settings so that they can shared
-        between the Debug configuration and debug Production variant.
-        * WebCore.xcodeproj/project.pbxproj: Enable the debug variant.
-
-2008-08-15  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Anders.
-
-        Don't start preloading body resources before the head is complete. This prevents
-        body preloads from slowing down initial display when there is limited amount
-        of bandwidth available.
-        
-        Works by queuing up found body preloads to DocLoader and only issuing them
-        after document has rendering.
-        
-        With bandwidth capped to 300kbit/s this speeds up cnn.com initial display by ~25% or 5s
-        without affecting complete load time.
-
-        * html/PreloadScanner.cpp:
-        (WebCore::PreloadScanner::PreloadScanner):
-        (WebCore::PreloadScanner::scanningBody):
-        (WebCore::PreloadScanner::emitTag):
-        (WebCore::PreloadScanner::emitCSSRule):
-        * html/PreloadScanner.h:
-        * loader/DocLoader.cpp:
-        (WebCore::DocLoader::preload):
-        (WebCore::DocLoader::checkForPendingPreloads):
-        (WebCore::DocLoader::requestPreload):
-        * loader/DocLoader.h:
-        * loader/loader.cpp:
-        (WebCore::Loader::Host::didFinishLoading):
-        (WebCore::Loader::Host::didFail):
-
-2008-08-15  Ada Chan  <adachan@apple.com>
-
-        Use item's computed style if the render style is 0 before falling back to the <select>'s style.
-        This way style set on an <hr> within a <select> will be honored.
-
-        Reviewed by Dave Hyatt and Dan Bernstein.
-
-        * rendering/RenderMenuList.cpp:
-        (WebCore::RenderMenuList::itemStyle):
-
-2008-08-15  Antti Koivisto  <antti@apple.com>
-
-        Reviewed by Oliver.
-
-        Some loader performance tweaks:
-        - Make stylesheets highest priority instead of scripts. We block script execution on stylesheets.
-          Especially if a stylesheet @imports other stylesheets it is important to get them to the front of the queue 
-          to not delay rendering.
-        - Issue the first resource load for a host immediately even if the resource is low priority. TCP connection setup
-          can take long time when latency is high so it is good to get started early.
-        - When the document is fully parsed and stylesheets have been loaded there is no need to keep managing the
-          load queues. Issue remaining loads to the network layer.
-
-        * loader/loader.cpp:
-        (WebCore::Loader::determinePriority):
-        (WebCore::Loader::load):
-        (WebCore::Loader::Host::servePendingRequests):
-        * loader/loader.h:
-
-2008-08-15  Timothy Hatcher  <timothy@apple.com>
-
-        Detach the script debugger when the Web Inspector's window closes.
-        This has always been the intended design, but never fully implemented.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20402
-
-        Reviewed by Adam Roben.
-
-        * page/InspectorController.cpp:
-        (WebCore::InspectorController::setWindowVisible): Call stopDebugging()
-        if the window is no longer visible.
-
-2008-08-15  Håvard Wall  <hwall@trolltech.com>
-
-        Reviewed by Simon.
-
-        Fixes:    compile with QT_NO_CONTEXTMENU
-
-        * platform/qt/PlatformMouseEventQt.cpp:
-        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
-        * platform/qt/PlatformScrollBarQt.cpp:
-        (WebCore::PlatformScrollbar::handleMouseMoveEvent):
-        (WebCore::PlatformScrollbar::handleContextMenuEvent):
-
-2008-08-15  Håvard Wall  <hwall@trolltech.com>
-
-        Reviewed by Simon.
-
-        Fixes: compile with QT_NO_WHEELEVENT
-
-        * platform/qt/WheelEventQt.cpp:
-        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
-
-2008-08-15  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Fixed Bug 20210: Console groups are incorrect when closing and reopening the Inspector
-
-        https://bugs.webkit.org/show_bug.cgi?id=20210
-
-        Reviewed by Tim Hatcher.
-
-        * page/Console.cpp:
-        (WebCore::Console::group):
-        (WebCore::Console::groupEnd):
-        * page/Console.h:
-        (WebCore::): Removed GroupTitleMessageLevel. Added StartGroupMessaageLevel and EndGroupMessageLevel.
-        * page/InspectorController.cpp:
-        (WebCore::InspectorController::startGroup): Increments group level by
-        one and adds console message with StartGroupMessaageLevel.
-        (WebCore::InspectorController::endGroup): Decrements group level by one
-        and adds console message with EndGroupMessaageLevel.
-        * page/InspectorController.h:
-        * page/inspector/Console.js:
-        (WebInspector.Console.prototype.addMessage): Creates new ConsoleGroup
-        if the message is StartGroupMessaageLevel.
-        (WebInspector.ConsoleMessage.prototype.toMessageElement):
-        (WebInspector.ConsoleGroup.prototype.addMessage):
-        * page/inspector/inspector.js:
-
-2008-08-15  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Adds support for console.dir to the Inspector
-
-        https://bugs.webkit.org/show_bug.cgi?id=19155
-
-        Reviewed by Tim Hatcher.
-
-        * bindings/js/JSConsoleCustom.cpp:
-        (WebCore::JSConsole::dir):
-        * page/Console.cpp:
-        (WebCore::Console::dir):
-        * page/Console.h: Added ObjectMessageLevel.
-        * page/Console.idl: Added console.dir.
-        * page/inspector/Console.js:
-        (WebInspector.ConsoleMessage.prototypet.toMessageElement): Creates an
-        ObjectPropertiesSection if the MessageLevel is Object.
-        * page/inspector/ObjectPropertiesSection.js: "in" operator can't be
-        used on primitive data types.
-        * page/inspector/inspector.css:
-
-2008-08-15  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Adds support for clear() in the Inspector console.
-
-        https://bugs.webkit.org/show_bug.cgi?id=19873
-
-        Reviewed by Tim Hatcher.
-
-        * page/inspector/Console.js:
-
-2008-08-15  Anthony Ricaud  <rik24d@gmail.com>
-
-        Cmd-F on Mac or Ctrl-F on other platforms now focus the search field.
-
-        Platform distinction and modifier key matching adjusted
-        by Daniel Jalkut <jalkut@red-sweater.com>
-
-        Bug 16313: text search (find) keybindings should work in the Web Inspector
-        https://bugs.webkit.org/show_bug.cgi?id=16313
-
-        Reviewed by Tim Hatcher.
-
-        * page/inspector/inspector.js: Added a case for the F key
-
-2008-08-15  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Fix for error when the string doesn't contain a webkit-profile link.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20399
-
-        Reviewed by Tim Hatcher.
-
-        * page/inspector/inspector.js:
-
-2008-08-15  Timothy Hatcher  <timothy@apple.com>
-
-        Fixes two bugs where JavaScript could be executed from the page
-        while the debugger is paused.
-
-        The first issue was JSLazyEventListener not checking the paused
-        state before parsing the code.
-
-        The second issue was with the PageGroup version of
-        JavaScriptDebugServer::setJavaScriptPaused always passing false
-        to the Page version of JavaScriptDebugServer::setJavaScriptPaused,
-        and not the paused argument.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20284
-
-        Reviewed by Adam Roben.
-
-        * bindings/js/JSEventListener.cpp:
-        (WebCore::JSLazyEventListener::parseCode): Check the paused
-        state of the ScriptController. Return early if paused.
-        * manual-tests/inspector/debugger-execution-while-paused.html: Added.
-        * page/JavaScriptDebugServer.cpp:
-        (WebCore::JavaScriptDebugServer::setJavaScriptPaused):
-        Pass the paused argument to the Page version of setJavaScriptPaused.
-
-2008-08-15  Alexey Proskuryakov  <ap@webkit.org>
-
-        Reviewed by Geoff Garen.
-
-        JSStringRef is created context-free, but can get linked to one via an identifier table,
-        breaking an implicit API contract.
-
-        * page/InspectorController.cpp:
-        (WebCore::jsStringRef):
-        (WebCore::InspectorController::didParseSource):
-        (WebCore::InspectorController::failedToParseSource):
-        * page/JavaScriptProfile.cpp:
-        (WebCore::getTitleCallback):
-        Updated for JavaScriptCore changes.
-
-2008-08-14  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx !USE(WXGC) build fix. This is necessary until we find a way to replace GDI with
-        an alternative that performs reasonably well. (GDI+ is too slow in many cases.)
-
-        * platform/graphics/AffineTransform.h:
-
-2008-08-14  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Adele.
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=20388
-        <video> elements on Windows never becomes visible when a page is restored from the cache
-
-        Always pass "set" calls down to MediaPlayerPrivate instead of only when the
-        value is different from the cached value. Let the implementation decide when
-        to avoid work because nothing has changed.
-
-        * platform/graphics/MediaPlayer.cpp:
-        (WebCore::MediaPlayer::setVolume):
-        (WebCore::MediaPlayer::setRate):
-        (WebCore::MediaPlayer::setRect):
-        (WebCore::MediaPlayer::setVisible):
-
-2008-08-14  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Make Firebug command line API respect predefined variables.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20385
-
-        Reviewed by Tim Hatcher.
-
-        * page/inspector/Console.js:
-
-2008-08-14  Sam Weinig  <sam@webkit.org>
-
-        Reviewed by Geoffrey Garen and Timothy Hatcher.
-
-        Allow programatically setting the HTMLTokenizers time delay and chunk size
-        which are used for determining how aggressively we yield.
+        No test case, I didn't manage to construct one. You need some combination of 304 revalidation, stylesheets that
+        reference each other via @imports and reloading.
 
         * WebCore.base.exp:
-        * html/HTMLTokenizer.cpp:
-        (WebCore::HTMLTokenizer::begin):
-        (WebCore::HTMLTokenizer::continueProcessing):
-        * html/HTMLTokenizer.h:
-        * page/Page.cpp:
-        (WebCore::Page::Page):
-        (WebCore::Page::setCustomHTMLTokenizerTimeDelay):
-        (WebCore::Page::setCustomHTMLTokenizerChunkSize):
-        * page/Page.h:
-        (WebCore::Page::hasCustomHTMLTokenizerTimeDelay):
-        (WebCore::Page::customHTMLTokenizerTimeDelay):
-        (WebCore::Page::hasCustomHTMLTokenizerChunkSize):
-        (WebCore::Page::customHTMLTokenizerChunkSize):
-
-2008-08-14  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Beth.
-
-        Move us one step closer to cross-platform svg/graphics code
-
-        * WebCore.xcodeproj/project.pbxproj:
-        * html/CanvasStyle.cpp:
-        * platform/graphics/Color.cpp:
-        (WebCore::colorWithOverrideAlpha):
-        * platform/graphics/Color.h:
-        * svg/graphics/cg/CgSupport.cpp:
-        (WebCore::applyStrokeStyleToContext):
-        (WebCore::strokeBoundingBox):
-        * svg/graphics/cg/SVGPaintServerSolidCg.cpp:
-        (WebCore::SVGPaintServerSolid::setup):
-
-2008-08-14  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Alexey.
-
-        Remove un-need includes from HTMLCanvas and use the
-        Gradient platform abstraction in one place in CanvasStyle
-
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::fillRect):
-        * html/CanvasStyle.cpp:
-        * html/HTMLCanvasElement.cpp:
-
-2008-08-14  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Alexey.
-
-        Clean up GlyphBuffer.h, removing more #ifdefs
-
-        * platform/graphics/GlyphBuffer.h:
-        (WebCore::GlyphBuffer::glyphAt):
-        (WebCore::GlyphBuffer::advanceAt):
-        (WebCore::GlyphBuffer::add):
-
-2008-08-14  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Sam.
-
-        Clean up AffineTransform.h, removing #ifdefs
-
-        * platform/graphics/AffineTransform.h:
-        * platform/graphics/cairo/AffineTransformCairo.cpp:
-        * platform/graphics/cg/AffineTransformCG.cpp:
-        * platform/graphics/qt/AffineTransformQt.cpp:
-        * platform/graphics/wx/AffineTransformWx.cpp:
-
-2008-08-14  Dan Bernstein  <mitz@apple.com>
-
-        - fix non-CG builds by adding an ImageSource::frameSizeAtIndex() that returns size().
-
-        * platform/graphics/cairo/ImageSourceCairo.cpp:
-        (WebCore::ImageSource::frameSizeAtIndex):
-        * platform/graphics/qt/ImageSourceQt.cpp:
-        (WebCore::ImageSource::frameSizeAtIndex):
-        * platform/graphics/wx/ImageSourceWx.cpp:
-        (WebCore::ImageSource::frameSizeAtIndex):
-
-2008-08-14  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Brady Eidson.
-
-        - fix <rdar://problem/5993323> REGRESSION (r34210): Apple.com favicon appears stretched/clipped
-
-        * platform/graphics/BitmapImage.cpp: 
-        (WebCore::BitmapImage::BitmapImage): Added initialization of
-        m_hasUniformFrameSize.
-        (WebCore::BitmapImage::cacheFrame): Added code to get the size of the
-        cached frame for use in decoded size computation and for setting
-        m_hasUniformFrameSize.
-        (WebCore::BitmapImage::currentFrameSize): Added.
-        (WebCore::BitmapImage::dataChanged): Added code to reset
-        m_hasUniformFrameSize.
-        * platform/graphics/BitmapImage.h: Added currentFrameSize() and
-        m_hasUniformFrameSize.
-        * platform/graphics/ImageSource.h: Added frameSizeAtIndex().
-        * platform/graphics/cg/ImageCG.cpp:
-        (WebCore::BitmapImage::draw): Changed to use currentFrameSize(). This
-        fixes the bug, which resulted from assuming that the frame being drawn 
-        was the same size as the first frame.
-        * platform/graphics/cg/ImageSourceCG.cpp:
-        (WebCore::ImageSource::frameSizeAtIndex): Renamed size() to this and
-        changed to get the size of the frame at the given index.
-        (WebCore::ImageSource::size): Added. Returns frameSizeAtIndex(0).
-
-2008-08-13  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Eric Seidel
-
-        Fix @font-face inside @media rule crash.
-        https://bugs.webkit.org/show_bug.cgi?id=20367
-
-        Test: fast/css/font-face-in-media-rule.html
-
-        * css/CSSStyleSelector.cpp:
-        (WebCore::CSSRuleSet::addRulesFromSheet):
-
-2008-08-14  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fixes after recent changes to Canvas and Image classes.
-
-        * platform/graphics/Pattern.h:
-        * platform/graphics/wx/GradientWx.cpp:
-        (WebCore::Gradient::fill):
-        * platform/graphics/wx/GraphicsContextWx.cpp:
-        (WebCore::GraphicsContext::applyFillPattern):
-        (WebCore::GraphicsContext::applyStrokePattern):
-        * platform/graphics/wx/ImageBufferWx.cpp:
-        (WebCore::ImageBuffer::image):
-        * platform/graphics/wx/ImageWx.cpp:
-        (WebCore::Image::loadPlatformResource):
+        * loader/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::didAddClient):
+        * loader/CachedCSSStyleSheet.h:
+        * loader/CachedFont.cpp:
+        (WebCore::CachedFont::didAddClient):
+        * loader/CachedFont.h:
+        * loader/CachedImage.cpp:
+        (WebCore::CachedImage::didAddClient):
+        * loader/CachedImage.h:
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::addClient):
+        (WebCore::CachedResource::addClientToSet):
+        (WebCore::CachedResource::switchClientsToRevalidatedResource):
+        * loader/CachedResource.h:
+        * loader/CachedScript.cpp:
+        (WebCore::CachedScript::didAddClient):
+        * loader/CachedScript.h:
+        * loader/CachedXSLStyleSheet.cpp:
+        (WebCore::CachedXSLStyleSheet::didAddClient):
+        * loader/CachedXSLStyleSheet.h:
 
-2008-08-14  Maxime Britto  <britto@apple.com>
+2009-06-16  Simon Fraser  <simon.fraser@apple.com>
 
-        Reviewed by Sam Weinig.
+        No Review
 
-        rdar://6102511
-        When pan-scrolling, typing on the keyboard should either stop the pan scroll or be ignored
-        IE and FF are both preventing the keyboard event to interact with the page while scrolling.
-        Some differences exist between them concerning the kind of key which is pressed :
-        IE7 : every key leads to a stop of the panning
-        FF3 : the ESC and TAB keys leads to a stop, the other keys are inactive.
-        For WebKit this patch is adopting the FF3 behavior except for the TAB key which is inactive too.
+        Fix code inside an #ifdef that draws the video framerate.
 
-        * page/EventHandler.cpp:
-        (WebCore::EventHandler::keyEvent): Verifies which key has been hit and decide either to stop the pan scroll or to swallow the key event.
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::paint):
 
-2008-08-14  Christian Dywan  <christian@twotoasts.de>
+2009-06-16  Jian Li  <jianli@chromium.org>
 
-        Gtk+/ Cairo build fix, patch by Dirk Schulze.
+        Reviewed by Dimitri Glazkov.
 
-        * html/CanvasStyle.cpp:
-        * platform/graphics/cairo/PatternCairo.cpp:
-        (WebCore::Pattern::createPlatformPattern):
-        * svg/graphics/cairo/SVGResourceMaskerCairo.cpp:
-
-2008-08-14  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Tim.
-
-        <rdar://problem/6115819> Notify of profile in console
-
-        * page/InspectorController.cpp:
-        (WebCore::InspectorController::addProfile):
-        (WebCore::InspectorController::addProfileMessageToConsole): Called by
-        addProfile this is the function that adds a message to the console that
-        a profile finished.
-        * page/InspectorController.h:
-        * page/JavaScriptProfile.cpp: Expose the profiler's unique ID to match
-        the console log to the profile in the web inspector.
-        (WebCore::getUniqueIdCallback):
-        (WebCore::ProfileClass):
-        * page/inspector/ProfilesPanel.js: Created a map of all the profiles by
-        Id to bring up the requested profile.  Also select and reveal the
-        profile in the profile panel.  And created displayTitleForProfileLink()
-        which formats a title taking into account if it's user initiated or if
-        there are multiples. Lasty, I put the user initiated profile in a
-        variable.
-        * page/inspector/inspector.js: Make the profile title be a clickable
-        link that will take the user to the identified profile.  Also expose
-        the count of user initiated profiles so they can be displayed in the
-        console with the correct count.
-
-2008-08-14  Timothy Hatcher  <timothy@apple.com>
-
-        Avoid formating ConsoleMessages twice unless the message will be
-        displayed in bubbles of a SourceFrame.
+        Bug 26456: Hook up V8 bindings for Worker's importScripts functionality.
+        https://bugs.webkit.org/show_bug.cgi?id=26456
 
-        Reviewed by Kevin McCullough.
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WorkerCustom.cpp: Fixed missing exception code
+          handling in Worker constructor for V8 bindings.
+        (WebCore::CALLBACK_FUNC_DECL):
 
-        * page/inspector/Console.js:
-        (WebInspector.ConsoleMessage): Only format the plain text message
-        if the URL and line are valid and the level is error or warning.
-        (WebInspector.ConsoleMessage.prototype.isErrorOrWarning): Added.
-        Helper to test for error or warning level.
-        * page/inspector/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype.addMessage): Don't add the
-        message if there is no message or valid line or if the msg
-        isn't an error or warning.
+2009-06-16  Brent Fulgham  <bfulgham@webkit.org>
 
-2008-08-14  Jan Michael Alonzo  <jmalonzo@webkit.org>
+        Reviewed by Maciej Stachowiak.
 
-        partial Gtk build fix, not reviewed
+        Update of https://bugs.webkit.org/show_bug.cgi?id=26353.
+        Provide an assignment operator to avoid improper reference
+        counts on the Cairo font objects.  This brings the Windows
+        Cairo port in line with the GTK+ port.
 
-        * platform/graphics/cairo/PatternCairo.cpp:
+        * platform/graphics/win/FontPlatformData.h:
+        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
 
-2008-08-13  Sam Weinig  <sam@webkit.org>
+2009-06-16  Eric Carlson  <eric.carlson@apple.com>
 
-        Reviewed by Anders Carlsson.
+        Reviewed by Simon Fraser.
 
-        Fix style issue.
+        Fix for <rdar://problem/6890126> Theme code should fetch the MediaControlElementType from 
+        the MediaControlInputElement, rather than computing it again
 
         * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::pickMedia):
-
-2008-08-13  Nikolas Zimmermann  <zimmermann@kde.org>
-
-        Build fix for Cairo, not reviewed. (exposed by gtk build slave)
-        Continue Erics build fixes, after the Image cleanup.
-
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        (WebCore::ImageBuffer::image):
-
-2008-08-13  Nikolas Zimmermann  <zimmermann@kde.org>
-
-        Build fix for Qt, not reviewed.
-        Don't declare eventuallyMarkAsParserCreated in a block wrapped by !USE_QXMLSTREAM.
-
-        * dom/XMLTokenizer.cpp:
-        (WebCore::eventuallyMarkAsParserCreated): Was erre
-
-2008-08-13  Nikolas Zimmermann  <zimmermann@kde.org>
-
-        Build fix, not reviewed.
-        Add ScriptElement.cpp to Gtk build.
-
-        * GNUmakefile.am:
-
-2008-08-13  Nikolas Zimmermann  <zimmermann@kde.org>
-
-        Reviewed by Eric.
-
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=20372
-
-        Refactor HTMLScriptElement's code into a common base class: ScriptElement.
-        SVGScriptElement will be converted to use ScriptElement in a follow-up patch.
-
-        This resolves code duplications and allows us to completly replace the old
-        SVGScriptElement (which doesn't use CachedScript, no dynamic injected scripts etc..)
-
-        As ScriptElement, doesn't actually inherit from Element, we may want to rename
-        it, though StyleElement uses the same naming convention, so I left it as is for now.
-        Eventually we'll rename both files in future.
-
-        No functional changes yet, as SVGScriptElement doesn't yet use the new base class.
-
-        * WebCore.pro: Add new ScriptElement.cpp to build.
-        * WebCore.vcproj/WebCore.vcproj: Ditto.
-        * WebCore.xcodeproj/project.pbxproj: Ditto.
-        * WebCoreSources.bkl: Dutto.
-        * dom/ScriptElement.cpp: Added. 1:1 based on HTMLScriptElement
-        (WebCore::ScriptElement::insertedIntoDocument):
-        (WebCore::ScriptElement::removedFromDocument):
-        (WebCore::ScriptElement::childrenChanged):
-        (WebCore::ScriptElement::finishParsingChildren):
-        (WebCore::ScriptElement::handleSourceAttribute):
-        (WebCore::isSupportedJavaScriptLanguage):
-        (WebCore::ScriptElementData::ScriptElementData):
-        (WebCore::ScriptElementData::~ScriptElementData):
-        (WebCore::ScriptElementData::requestScript):
-        (WebCore::ScriptElementData::evaluateScript):
-        (WebCore::ScriptElementData::stopLoadRequest):
-        (WebCore::ScriptElementData::notifyFinished):
-        (WebCore::ScriptElementData::ignoresLoadRequest):
-        (WebCore::ScriptElementData::shouldExecuteAsJavaScript):
-        (WebCore::ScriptElementData::scriptCharset):
-        (WebCore::ScriptElementData::scriptContent):
-        * dom/ScriptElement.h: Added.
-        (WebCore::ScriptElement::ScriptElement):
-        (WebCore::ScriptElement::~ScriptElement):
-        (WebCore::ScriptElementData::element):
-        (WebCore::ScriptElementData::createdByParser):
-        (WebCore::ScriptElementData::setCreatedByParser):
-        * dom/XMLTokenizer.cpp:
-        (WebCore::isScriptElement):
-        (WebCore::castToScriptElement):
-        (WebCore::eventuallyMarkAsParserCreated):
-        (WebCore::XMLTokenizer::startElementNs):
-        (WebCore::XMLTokenizer::endElementNs):
-        (WebCore::createXHTMLParserErrorHeader):
-        (WebCore::XMLTokenizer::insertErrorMessageBlock):
-        * html/HTMLScriptElement.cpp: Refactored code, pushed most code down to ScriptElement.
-        (WebCore::HTMLScriptElement::HTMLScriptElement):
-        (WebCore::HTMLScriptElement::~HTMLScriptElement):
-        (WebCore::HTMLScriptElement::isURLAttribute):
-        (WebCore::HTMLScriptElement::setCreatedByParser):
-        (WebCore::HTMLScriptElement::shouldExecuteAsJavaScript):
-        (WebCore::HTMLScriptElement::childrenChanged):
-        (WebCore::HTMLScriptElement::parseMappedAttribute):
-        (WebCore::HTMLScriptElement::finishParsingChildren):
-        (WebCore::HTMLScriptElement::insertedIntoDocument):
-        (WebCore::HTMLScriptElement::removedFromDocument):
-        (WebCore::HTMLScriptElement::text):
-        (WebCore::HTMLScriptElement::setText):
-        (WebCore::HTMLScriptElement::setHtmlFor):
-        (WebCore::HTMLScriptElement::setEvent):
-        (WebCore::HTMLScriptElement::charset):
-        (WebCore::HTMLScriptElement::src):
-        (WebCore::HTMLScriptElement::type):
-        (WebCore::HTMLScriptElement::scriptCharset):
-        (WebCore::HTMLScriptElement::scriptContent):
-        (WebCore::HTMLScriptElement::sourceAttributeValue):
-        (WebCore::HTMLScriptElement::charsetAttributeValue):
-        (WebCore::HTMLScriptElement::typeAttributeValue):
-        (WebCore::HTMLScriptElement::languageAttributeValue):
-        (WebCore::HTMLScriptElement::dispatchLoadEvent):
-        (WebCore::HTMLScriptElement::dispatchErrorEvent):
-        * html/HTMLScriptElement.h:
-        * svg/SVGScriptElement.cpp: Inherit from ScriptElement, don't actually use it yet.
-        * svg/SVGScriptElement.cpp:
-        (WebCore::SVGScriptElement::SVGScriptElement):
-        (WebCore::SVGScriptElement::scriptContent):
-        (WebCore::SVGScriptElement::sourceAttributeValue):
-        (WebCore::SVGScriptElement::charsetAttributeValue):
-        (WebCore::SVGScriptElement::typeAttributeValue):
-        (WebCore::SVGScriptElement::languageAttributeValue):
-        (WebCore::SVGScriptElement::dispatchLoadEvent):
-        (WebCore::SVGScriptElement::dispatchErrorEvent):
-        * svg/SVGScriptElement.h:
-        (WebCore::SVGScriptElement::setCreatedByParser):
-
-2008-08-13  Eric Seidel  <eric@webkit.org>
-
-        Attempt to fix the Gtk build, no review.
-
-        I removed the bogus GraphicsContext::translatePoint() hack for Gtk in the process.
-
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        * platform/graphics/qt/GradientQt.cpp:
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        * platform/gtk/RenderThemeGtk.cpp:
-        (WebCore::paintMozWidget):
-
-2008-08-13  Eric Seidel  <eric@webkit.org>
-
-        Yet another attempt to fix the Qt build, no review.
-
-        * platform/graphics/qt/GradientQt.cpp:
-        * platform/graphics/qt/GraphicsContextQt.cpp:
-        (WebCore::GraphicsContext::applyStrokePattern):
-        (WebCore::GraphicsContext::applyFillPattern):
-
-2008-08-13  Eric Seidel  <eric@webkit.org>
-
-        Attempt to fix the Windows build, no review.
-
-        * platform/win/CursorWin.cpp:
-        (WebCore::loadCursorByName):
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::paint):
-
-2008-08-13  Eric Seidel  <eric@webkit.org>
-
-        Attempt to fix the Windows build, no review.
-
-        * platform/win/CursorWin.cpp:
-        (WebCore::loadCursorByName):
-        * platform/win/ScrollViewWin.cpp:
-        (WebCore::ScrollView::paint):
-
-2008-08-13  Eric Seidel  <eric@webkit.org>
-
-        Attempt to fix the Qt build, no review.
-
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        (WebCore::ImageBuffer::image):
-
-2008-08-13  Eric Seidel  <eric@webkit.org>
+        (WebCore::HTMLMediaElement::percentLoaded): New, utility function for controller implementation.
+        * html/HTMLMediaElement.h:
 
-        Attempt to fix the Windows build, no review.
+        * rendering/MediaControlElements.h:
+        (WebCore::MediaControlInputElement::displayType): New, return m_displayType.
 
-        * platform/graphics/win/ImageWin.cpp:
-        (WebCore::Image::loadPlatformResource):
-        * plugins/win/PluginViewWin.cpp:
-        (WebCore::PluginView::paintMissingPluginIcon):
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart): Stop using MediaPlayer object, get button
+        state from the button itself and get movie state from HTMLMediaElement.
 
-2008-08-13  Eric Seidel  <eric@webkit.org>
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaMuteButton): Get state from button instead of MediaPlayer.
+        (WebCore::RenderThemeMac::paintMediaPlayButton): Ditto.
+
+2009-06-16  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Bug 26450: Rename values of enum RedirectOriginCheck to make them
+        clearer.
+        https://bugs.webkit.org/show_bug.cgi?id=26450
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::create):
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
+        (WebCore::DocumentThreadableLoader::willSendRequest):
+        * loader/DocumentThreadableLoader.h:
+        * loader/ThreadableLoader.cpp:
+        (WebCore::ThreadableLoader::create):
+        (WebCore::ThreadableLoader::loadResourceSynchronously):
+        * loader/ThreadableLoader.h:
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
+        (WebCore::WorkerThreadableLoader::loadResourceSynchronously):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):
+        * loader/WorkerThreadableLoader.h:
+        (WebCore::WorkerThreadableLoader::create):
+        * workers/WorkerScriptLoader.cpp:
+        (WebCore::WorkerScriptLoader::loadSynchronously):
+        (WebCore::WorkerScriptLoader::loadAsynchronously):
+        * workers/WorkerScriptLoader.h:
+        (WebCore::WorkerContext::importScripts):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
 
-        Another attempt to fix the Qt build, no review.
+2009-06-16  Tony Chang  <tony@chromium.org>
 
-        * platform/graphics/qt/ImageQt.cpp:
-        * platform/graphics/qt/StillImageQt.h:
+        Reviewed by Darin Fisher.
 
-2008-08-13  Eric Seidel  <eric@webkit.org>
+        Fix a UMR in WebCore::BitStack by initializing new memory to 0.
+        https://bugs.webkit.org/show_bug.cgi?id=26449
+        No new tests, covered by purify.
 
-        No review, build fix only.
+        * editing/TextIterator.cpp:
+        (WebCore::BitStack::push):
 
-        Fix mac build, due to change in new code since my patch was written.
+2009-06-16  Brent Fulgham  <bfulgham@webkit.org>
 
-        * svg/graphics/cg/SVGResourceMaskerCg.mm:
-        (WebCore::SVGResourceMasker::applyMask):
+        Reviewed by Xan Lopez.
 
-2008-08-13  Eric Seidel  <eric@webkit.org>
+        Test: fast/multicol/columns-shorthand-parsing.html 
 
-        Build fix only, no review.
+        Fixes https://bugs.webkit.org/show_bug.cgi?id=26453.
+        Null Cairo contextwill crash Windows Cairo build.
 
-        Attempt to fix the Qt build.
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::syncContext):
+          Add a check for null context before attempting to
+          retrieve the Cairo surface.
 
-        * platform/graphics/qt/ImageBufferQt.cpp:
-        * platform/graphics/qt/StillImageQt.h:
-        (WebCore::StillImage::create):
-        (WebCore::StillImage::destroyDecodedData):
-        (WebCore::StillImage::decodedSize):
+2009-06-16  Peter Kasting  <pkasting@google.com>
 
-2008-08-13  Eric Seidel  <eric@webkit.org>
+        Reviewed by Xan Lopez.
 
-        Build fix only, no review.
+        https://bugs.webkit.org/show_bug.cgi?id=26447
+        Fix animated GIF breakage in Cairo/wx ports.
 
-        Attempt to fix the Qt build.
+        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::operator=):
+        * platform/image-decoders/wx/ImageDecoderWx.cpp:
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::operator=):
 
-        * html/CanvasStyle.cpp:
-        (WebCore::CanvasStyle::applyStrokeColor):
-        (WebCore::CanvasStyle::applyFillColor):
+2009-06-16  Pierre d'Herbemont  <pdherbemont@apple.com>
 
-2008-08-13  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Sam.
+        Reviewed by John Sullivan
+        
+        <rdar://problem/6937882>
+        
+        Tweak "time remaining" and "time elapsed" fields in the overlay video controller.
 
-        Match HTML5 spec by throwing INVALID_STATE_ERR when
-        createPattern is called and the HTMLImageElement is not
-        yet done loading the image (!isComplete)
-        https://bugs.webkit.org/show_bug.cgi?id=20351
+        * css/mediaControlsQT.css:
 
-        Test: http/misc/canvas-pattern-from-incremental-image.html
+2009-06-16  Jian Li  <jianli@chromium.org>
 
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::createPattern):
+        Reviewed by Adam Barth and David Levin.
 
-2008-08-13  Eric Seidel  <eric@webkit.org>
+        Bug 26146: Change to use ThreadableLoader to load the worker script
+        in order to check URL origin for redirection.
+        https://bugs.webkit.org/show_bug.cgi?id=26146
 
-        Reviewed by Niko.
-
-        Split out a Pattern class from CanvasPattern
-        and remove all the Pattern-related #ifdefs
-        (This will break non-mac platforms!  I will fix them.)
-        https://bugs.webkit.org/show_bug.cgi?id=20351
+        Test: http/tests/workers/worker-redirect.html
 
         * GNUmakefile.am:
         * WebCore.pro:
         * WebCore.vcproj/WebCore.vcproj:
         * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-        * html/CanvasPattern.cpp:
-        (WebCore::CanvasPattern::parseRepetitionType):
-        (WebCore::CanvasPattern::CanvasPattern):
-        * html/CanvasPattern.h:
-        (WebCore::CanvasPattern::create):
-        (WebCore::CanvasPattern::pattern):
-        (WebCore::CanvasPattern::originClean):
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::createPattern):
-        (WebCore::CanvasRenderingContext2D::applyStrokePattern):
-        (WebCore::CanvasRenderingContext2D::applyFillPattern):
-        * html/CanvasRenderingContext2D.h:
-        * html/HTMLCanvasElement.cpp:
-        * html/HTMLCanvasElement.h:
-        * loader/FrameLoader.cpp:
-        (WebCore::FrameLoader::createHistoryItem):
-        * platform/graphics/GraphicsContext.h:
-        * platform/graphics/cairo/GraphicsContextCairo.cpp:
-        (WebCore::GraphicsContext::applyStrokePattern):
-        (WebCore::GraphicsContext::applyFillPattern):
-        * platform/graphics/cg/GraphicsContextCG.cpp:
-        (WebCore::GraphicsContext::clipToImageBuffer):
-        (WebCore::GraphicsContext::applyStrokePattern):
-        (WebCore::GraphicsContext::applyFillPattern):
-
-2008-08-13  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Niko.
-
-        Make Images RefCounted (and clean up callers)
-        https://bugs.webkit.org/show_bug.cgi?id=20351
-
-        * editing/DeleteButtonController.cpp:
-        (WebCore::DeleteButtonController::createDeletionUI):
-        * loader/CachedImage.cpp:
-        (WebCore::CachedImage::CachedImage):
-        (WebCore::brokenImage):
-        (WebCore::nullImage):
-        (WebCore::CachedImage::image):
-        (WebCore::CachedImage::notifyObservers):
-        (WebCore::CachedImage::createImage):
-        * loader/CachedImage.h:
-        * loader/icon/IconRecord.cpp:
-        (WebCore::IconRecord::setImageData):
-        (WebCore::IconRecord::loadImageFromResource):
-        * loader/icon/IconRecord.h:
-        * platform/graphics/BitmapImage.h:
-        (WebCore::BitmapImage::create):
-        * platform/graphics/GeneratedImage.h:
-        * platform/graphics/Gradient.cpp:
-        * platform/graphics/Gradient.h:
-        * platform/graphics/Image.cpp:
-        (WebCore::Image::nullImage):
-        * platform/graphics/Image.h:
-        * platform/graphics/ImageBuffer.h:
-        * platform/graphics/cairo/ImageBufferCairo.cpp:
-        (WebCore::ImageBuffer::image):
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::ImageBuffer::image):
-        (WebCore::ImageBuffer::getImageData):
-        (WebCore::ImageBuffer::putImageData):
-        * platform/graphics/cg/PDFDocumentImage.h:
-        (WebCore::PDFDocumentImage::create):
-        (WebCore::PDFDocumentImage::destroyDecodedData):
-        (WebCore::PDFDocumentImage::decodedSize):
-        * platform/graphics/gtk/ImageGtk.cpp:
-        (WebCore::Image::loadPlatformResource):
-        * platform/graphics/mac/ImageMac.mm:
-        (WebCore::Image::loadPlatformResource):
-        * rendering/RenderImage.cpp:
-        * rendering/RenderLayer.cpp:
-        (WebCore::RenderLayer::paintOverflowControls):
-        * svg/graphics/SVGImage.cpp:
-        (WebCore::SVGImage::nativeImageForCurrentFrame):
-        * svg/graphics/SVGImage.h:
-        (WebCore::SVGImage::create):
-        (WebCore::SVGImage::destroyDecodedData):
-        (WebCore::SVGImage::decodedSize):
-        (WebCore::SVGImage::frameAtIndex):
-        * svg/graphics/cairo/SVGPaintServerPatternCairo.cpp:
-        (WebCore::SVGPaintServerPattern::setup):
-        * svg/graphics/cairo/SVGResourceMaskerCairo.cpp:
-        (WebCore::SVGResourceMasker::applyMask):
-        * svg/graphics/cg/SVGPaintServerPatternCg.cpp:
-        (WebCore::patternCallback):
-        * svg/graphics/cg/SVGResourceMaskerCg.mm:
-        (WebCore::SVGResourceMasker::applyMask):
-
-2008-08-13  Eric Seidel  <eric@webkit.org>
-
-        Reviewed by Niko.
-
-        Remove #ifdefs from CanvasStyle by using platform/Color.h
-        https://bugs.webkit.org/show_bug.cgi?id=20351
-
-        There are some down-sides to this commit.
-        This commit limits us to 255 levels of grey for calls like:
-        context.setStrokeStyle(.37, 1.0)
-        previously CG might have used up to 32bits to store the grey level
-        Since setStrokeStyle is not part of HTML5, I don't suspect the web will notice.
-
-        Likewise, setStrokeStyle/setFillStyle calls which used float colors are now limited
-        to RGBA32 (like all the rest of colors in WebCore), thus:
-        context.setStrokStyle(.37, .24, .456, .99) will now have the same precision as:
-        context.strokeStyle = "rgba(.37, .24, .456, .99)", which is to say RGBA32
-
-        If this is a problem for Dashboard, we can either roll out this commit
-        or add a beefier Color abstraction, which can be used internally by GraphicsContext
-        when keeping state, and then GraphicsContext can grow some additional set* routines
-        for setting the a grey/float/whatever fill and stroke.
-
-        * html/CanvasRenderingContext2D.cpp:
-        (WebCore::CanvasRenderingContext2D::setFillStyle):
-        * html/CanvasStyle.cpp:
-        (WebCore::CanvasStyle::CanvasStyle):
-        (WebCore::colorWithOverrideAlpha):
-        (WebCore::CanvasStyle::applyStrokeColor):
-        (WebCore::CanvasStyle::applyFillColor):
-        * html/CanvasStyle.h:
-        * platform/graphics/Color.cpp:
-        (WebCore::colorFloatToRGBAByte):
-        (WebCore::makeRGBA32FromFloats):
-        * platform/graphics/Color.h:
-
-2008-08-13  Eric Carlson  <eric.carlson@apple.com>
-
-        Reviewed by Adele Peterson.
-
-        Fix for <rdar://problem/6137931>
-        https://bugs.webkit.org/show_bug.cgi?id=20360
-        Remove all parameters from the MIME type before checking with the MIME type registry
-
-        Tests: media/video-source-type-params.html
-
-        * html/HTMLMediaElement.cpp:
-        (WebCore::HTMLMediaElement::pickMedia): only pass the portion before the first ';' 
-        to isSupportedMediaMIMEType()
-
-2008-08-13  Beth Dakin  <bdakin@apple.com>
-
-        Reviewed by Sam Weinig.
-
-        Fix for <rdar://problem/6141345>
-
-        This patch refines findString and markAllMatchesForText functions' 
-        interactions with disconnected frames. They no longer rely on 
-        knowing where a range is relative to the visible region and work 
-        with disconnected frames that contain frames.
-
-        * editing/Editor.cpp:
-        (WebCore::Editor::insideVisibleArea): Now returns a bool instead of 
-        the visiblity enum.
-        (WebCore::Editor::firstVisibleRange): This now returns the very 
-        first visible range in the document. It's no longer dependent on 
-        searching forward.
-        (WebCore::Editor::lastVisibleRange): This now returns the very last 
-        visible range in the document. It's no longer dependent on 
-        searching backwards.
-        (WebCore::Editor::nextVisibleRange): This returns the next visible 
-        range in the appropriate direction from the current range.
-        * editing/Editor.h:
-        * page/Frame.cpp:
-        (WebCore::Frame::findString):
-        (WebCore::Frame::markAllMatchesForText):
-
-2008-08-13  Kevin Ollivier  <kevino@theolliviers.com>
-
-        wx build fix for case-sensitive platforms, like Linux.
-
-        * WebCoreSources.bkl:
-
-2008-08-13  Marco Barisione  <marco.barisione@collabora.co.uk>
-
-        Reviewed by Holger Freyther.
-
-        http://bugs.webkit.org/show_bug.cgi?id=16881
-        [GTK] PlatformScreenGtk is unimplemented
-
-        Original patch by Christian Dywan.
-
-        * platform/gtk/PlatformScreenGtk.cpp:
-        (WebCore::screenDepth):
-        (WebCore::screenDepthPerComponent):
-        (WebCore::screenIsMonochrome):
-        (WebCore::screenRect):
-        (WebCore::screenAvailableRect):
-
-2008-08-13  Jan Michael Alonzo  <jmalonzo@webkit.org>
-
-        Reviewed by Holger Freyther.
-
-        http://bugs.webkit.org/show_bug.cgi?id=20318
-        SharedTimerGtk should use G_PRIORITY_DEFAULT_IDLE for g_idle_add
-
-        g_idle_add is the same as g_idle_add_full with a priority of
-        G_PRIORITY_DEFAULT_IDLE, so we can safely use that.
-
-        * platform/gtk/SharedTimerGtk.cpp:
-        (WebCore::setSharedTimerFireTime):
-
-2008-08-13  Timothy Hatcher  <timothy@apple.com>
-
-        Changed the InspectorController so it can be notified when the
-        attached state of the Inspector changes in WebKit.
-
-        Reviewed by Kevin McCullough.
-
-        * WebCore.base.exp: Updated the symbol for setWindowVisible.
-        * page/InspectorController.cpp:
-        (WebCore::InspectorController::setWindowVisible): Added an attached argument,
-        that defaults to false.Call setAttachedWindow with the attached argument.
-        (WebCore::InspectorController::setAttachedWindow): Call the script version
-        of setAttachedWindow.
-        * page/InspectorController.h:
-        * page/inspector/inspector.js:
-        (WebInspector.setAttachedWindow): Set the attached property.
-
-2008-08-12  Timothy Hatcher  <timothy@apple.com>
-
-        Added a close button to the Inspector's toolbar when docked.
-
-        https://bugs.webkit.org/show_bug.cgi?id=14270
-
-        Reviewed by Kevin McCullough.
-
-        * page/InspectorController.cpp:
-        (WebCore::closeWindow): Call InspectorController::closeWindow.
-        (WebCore::InspectorController::windowScriptObjectAvailable):
-        Added closeWindow to the script class.
-        * page/InspectorController.h:
-        * page/inspector/Images/closeButtons.png: Added.
-        * page/inspector/inspector.css: Added and changed styles.
-        * page/inspector/inspector.html: Added the close button.
-        * page/inspector/inspector.js:
-        (WebInspector.loaded): Added click event listener to the close button.
-        (WebInspector.close): Call InspectorController.closeWindow.
-
-2008-08-12  Timothy Hatcher  <timothy@apple.com>
-
-        Make the docked Web Inspector resizable. This is the cross platform
-        portion of the code. Each InspectorClient needs to implement the
-        real resize code.
-
-        https://bugs.webkit.org/show_bug.cgi?id=14282
-
-        Reviewed by Kevin McCullough.
-
-        * loader/EmptyClients.h: Added an empty setAttachedWindowHeight.
-        * page/InspectorClient.h: Added setAttachedWindowHeight.
-        * page/InspectorController.cpp:
-        (WebCore::setAttachedWindowHeight): Call setAttachedWindowHeight
-        on the InspectorController.
-        (WebCore::InspectorController::setAttachedWindowHeight): Call
-        setAttachedWindowHeight on the client.
-        (WebCore::InspectorController::windowScriptObjectAvailable):
-        Added setAttachedWindowHeight to the script class.
-        * page/InspectorController.h:
-        * page/inspector/inspector.css: Make the cursor on the toolbar be
-        row-resize when docked.
-        * page/inspector/inspector.js:
-        (WebInspector.loaded): Always add the toolbarDragStart event listener.
-        (WebInspector.toolbarDragStart): Return early if we are not attached
-        and not on Leopard. Call WebInspector.elementDragStart.
-        (WebInspector.toolbarDragEnd): Call WebInspector.elementDragEnd.
-        (WebInspector.toolbarDrag): When attached call setAttachedWindowHeight,
-        otherwise call moveByUnrestricted.
-
-2008-08-13  Simon Hausmann  <hausmann@webkit.org>
-
-        Reviewed by Holger.
-
-        Initialize m_zoomsTextOnly in the Settings constructor.
-
-        * page/Settings.cpp:
-        (WebCore::Settings::Settings):
-
-2008-08-13  Brad Hughes <bhughes@trolltech.com>
-
-        Reviewed by Simon.
-
-        Fix compiling of QtWebKit in release mode with the Intel C++ Compiler for Linux
-
-        The latest upgrade of the intel compiler allows us to compile all of
-        Qt with optimizations enabled (yay!).
-
-        * WebCore.pro:
-
-2008-08-13  Prasanth Ullattil  <prasanth.ullattil@trolltech.com>
-
-        Reviewed by Simon.
-
-        Fix QtWebKit not displaying content on 403 HTTP responses
-
-        Just like with 404 responses also display content with 403, as
-        used by http://audiio.ejamming.proteus-tech.com/audiio/profile/original_signup/
-
-        * platform/network/qt/QNetworkReplyHandler.cpp:
-        (WebCore::QNetworkReplyHandler::finish):
-
-2008-08-13  Simon Hausmann  <hausmann@webkit.org>
-
-        Reviewed by Holger.
-
-        Qt part of https://bugs.webkit.org/show_bug.cgi?id=18994
-
-        Make the formatting of String::format() locale independent through the use of QString::vsprintf.
-
-        * platform/text/String.cpp:
-        (WebCore::String::format):
-
-2008-08-13  Simon Hausmann  <hausmann@webkit.org>
-
-        Reviewed by Lars.
-
-        Fix QWebFrame::setHtml() not setting the new contents immediately.
-
-        Added a setter to the DocumentLoader to toggle the deferred loading of the main
-        resource when it comes from substitute data.
-
-        Disable deferred loading of the main resource when we have valid substitute data,
-        as used by QWebFrame::setHtml.
-
-        * loader/DocumentLoader.h:
-
-2008-08-13  Mark Rowe  <mrowe@apple.com>
-
-        Speculative GTK build fix.
-
-        * GNUmakefile.am:  Add dependency info for JSSVGElementWrapperFactory.cpp.
-
-2008-08-13  Thiago Macieira  <tjmaciei@trolltech.com>
-
-        Reviewed by Simon.
-
-        Fix encoding of [ and ] in the host part of the URL
-
-        Until QUrl is fixed (making QUrl's tolerant parser more tolerant), we have to
-        add this workaround to the QUrl <> WebCore::KURL conversion operator so that it
-        doesn't encode [ and ] when they are found in the host part. That is, the
-        following URL:
-        http://[::1]/
-        is valid and should not be reencoded to:
-        http://%5b::1%5d/
-
-        * platform/qt/KURLQt.cpp:
-        (WebCore::KURL::operator QUrl):
-
-2008-08-12  Mihnea Ovidenie  <mihnea@adobe.com>
-
-        Fix for https://bugs.webkit.org/show_bug.cgi?id=19891
-        Broken HTML object elements cause de-reference of pointer to freed memory.
-        If we fail to load an image for an object tag and we no longer believe the object tag points at
-        an image, then clear m_imageLoader in the HTMLObjectElement so that we attempt to render the
-        fall back content.
-
-        Reviewed by Dave Hyatt and Alexey Proskuryakov.
-
-        Test: http/tests/misc/object-image-error-with-onload.html
-
-        * html/HTMLObjectElement.cpp:
-        (WebCore::HTMLObjectElement::renderFallbackContent):
-        * page/Frame.cpp:
-        (WebCore::Frame::Frame):
-
-2008-08-12  Nikolas Zimmermann  <zimmermann@kde.org>
-
-        Reviewed by Dave.
-    
-        Fixes: https://bugs.webkit.org/show_bug.cgi?id=19798
-        Masks are translated, and the mask images are swapped on the y-axis.
-
-        Turned out that http://trac.webkit.org/changeset/31830/trunk/WebCore/svg/graphics/cg/SVGResourceMaskerCg.mm
-        is guilty. GraphicsContext::clipToImageBuffer() does some extra transformations that SVGResourcesMaskerCg does not want.
-
-        Long term goal is to remove the SVGResource*/SVGPaintServer* classes anyway, so it's okay to duplicate
-        the "clip to image buffer" functionality, in the CG specific SVGResourceMaskerCg class - as it was before.
-
-        * svg/graphics/cg/SVGResourceMaskerCg.mm:
-        (WebCore::SVGResourceMasker::applyMask): Changed back to use CG clipping again.
-
-2008-08-12  Dan Bernstein  <mitz@apple.com>
-
-        - WebCore part of <rdar://problem/6121636>
-          Make fast*alloc() abort() on failure and add "try" variants that
-          return NULL on failure.
-
-        Reviewed by Darin Adler.
-
-        * platform/Arena.cpp:
-        (WebCore::ArenaAllocate): Removed null checking of fastMalloc()'s
-        result.
-        * platform/graphics/cg/ImageBufferCG.cpp:
-        (WebCore::ImageBuffer::create): Changed to use tryFastCalloc().
-
-2008-08-12  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by Darin Adler.
-
-        - fix https://bugs.webkit.org/show_bug.cgi?id=19348
-          <rdar://problem/5978447> REGRESSION (r34193): Setting the size of a frame with javascript document.body.row no longer works
-
-        Test: fast/frames/frameset-style-recalc.html
-
-        * html/HTMLFrameSetElement.cpp:
-        (WebCore::HTMLFrameSetElement::recalcStyle): Changed to call the base
-        class implementation after marking for layout.
-
-2008-08-12  Dan Bernstein  <mitz@apple.com>
-
-        Reviewed by John Sullivan.
-
-        - move shouldUpdateWhenOffscreen from Settings to FrameView and rename it shouldUpdateWhileHidden
-
-        * WebCore.base.exp:
-        * page/FrameView.cpp:
-        (WebCore::FrameViewPrivate::FrameViewPrivate):
-        (WebCore::FrameView::shouldUpdateWhileHidden):
-        (WebCore::FrameView::setShouldUpdateWhileHidden):
-        * page/FrameView.h:
-        * page/Settings.cpp:
-        * page/Settings.h:
-
-2008-08-12  Adam Roben  <aroben@apple.com>
-
-        Windows build fix
-
-        * bindings/js/JSSVGPODTypeWrapper.h: Align
-        JSSVGDynamicPODTypeWrapper's and JSSVGStaticPODTypeWrapperWithParent's
-        members on 16-byte boundaries to avoid an alignment warning.
-
-2008-08-12  Nikolas Zimmermann  <zimmermann@kde.org>
-
-        Reviewed by Oliver.
-
-        Add new dynamice-update layout tests covering SVGMarkerElement.
-        Fix bug: SVGMarkerElement's SVG DOM function calls don't update rendering.
-        Fix orientAngle/orientType confusion: "auto" orient should always return "0" as angle.
-
-        Tests: svg/dynamic-updates/SVGMarkerElement-dom-markerHeight-attr.html
-               svg/dynamic-updates/SVGMarkerElement-dom-markerUnits-attr.html
-               svg/dynamic-updates/SVGMarkerElement-dom-markerWidth-attr.html
-               svg/dynamic-updates/SVGMarkerElement-dom-orient-attr.html
-               svg/dynamic-updates/SVGMarkerElement-dom-refX-attr.html
-               svg/dynamic-updates/SVGMarkerElement-dom-refY-attr.html
-               svg/dynamic-updates/SVGMarkerElement-svgdom-markerHeight-prop.html
-               svg/dynamic-updates/SVGMarkerElement-svgdom-markerUnits-prop.html
-               svg/dynamic-updates/SVGMarkerElement-svgdom-markerWidth-prop.html
-               svg/dynamic-updates/SVGMarkerElement-svgdom-orientAngle-prop.html
-               svg/dynamic-updates/SVGMarkerElement-svgdom-orientType-prop.html
-               svg/dynamic-updates/SVGMarkerElement-svgdom-refX-prop.html
-               svg/dynamic-updates/SVGMarkerElement-svgdom-refY-prop.html
-               svg/dynamic-updates/SVGMarkerElement-svgdom-setOrientToAngle-call.html
-               svg/dynamic-updates/SVGMarkerElement-svgdom-setOrientToAuto-call.html
-
-        * svg/SVGMarkerElement.cpp:
-        (WebCore::SVGMarkerElement::SVGMarkerElement):
-        (WebCore::SVGMarkerElement::parseMappedAttribute):
-        (WebCore::SVGMarkerElement::svgAttributeChanged):
-        (WebCore::SVGMarkerElement::childrenChanged):
-        (WebCore::SVGMarkerElement::setOrientToAuto):
-        (WebCore::SVGMarkerElement::setOrientToAngle):
-        (WebCore::SVGMarkerElement::canvasResource):
-
-2008-08-12  Nikolas Zimmermann  <zimmermann@kde.org>
-
-        Reviewed by Oliver.
-
-        Add new dynamic-update layout tests covering SVGImageElement.
-        Fix bug: SVGImageElement doesn't react on 'preserveAspectRatio' changes.
-
-        Tests: svg/dynamic-updates/SVGImageElement-dom-height-attr.html
-               svg/dynamic-updates/SVGImageElement-dom-preserveAspectRatio-attr.html
-               svg/dynamic-updates/SVGImageElement-dom-width-attr.html
-               svg/dynamic-updates/SVGImageElement-dom-x-attr.html
-               svg/dynamic-updates/SVGImageElement-dom-y-attr.html
-               svg/dynamic-updates/SVGImageElement-svgdom-height-prop.html
-               svg/dynamic-updates/SVGImageElement-svgdom-preserveAspectRatio-prop.html
-               svg/dynamic-updates/SVGImageElement-svgdom-width-prop.html
-               svg/dynamic-updates/SVGImageElement-svgdom-x-prop.html
-               svg/dynamic-updates/SVGImageElement-svgdom-y-prop.html
-
-        * svg/SVGImageElement.cpp:
-        (WebCore::SVGImageElement::svgAttributeChanged):
-
-2008-08-11  Anthony Ricaud  <rik24d@gmail.com>
-
-        Changed Option/Alt-Up or Down in CSS editing when the value is
-        near zero to jump to the next integer.
-
-        Reviewed by Tim Hatcher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20326
-
-        * page/inspector/StylesSidebarPane.js:
-
-2008-08-11  Anthony Ricaud  <rik24d@gmail.com>
-
-        Changed the line highlight transition for an easier animation.
-
-        Reviewed by Tim Hatcher.
-
-        * page/inspector/SourceFrame.js:
-
-2008-08-11  Keishi Hattori  <casey.hattori@gmail.com>
-
-        Added support for some Firebug Command Line APIs.
-
-        Reviewed by Tim Hatcher.
-
-        https://bugs.webkit.org/show_bug.cgi?id=19867
-        https://bugs.webkit.org/show_bug.cgi?id=19868
-        https://bugs.webkit.org/show_bug.cgi?id=19869
-        https://bugs.webkit.org/show_bug.cgi?id=19875
-        https://bugs.webkit.org/show_bug.cgi?id=19876
-        https://bugs.webkit.org/show_bug.cgi?id=19880
-
-        * page/inspector/Console.js:
-        (WebInspector.Console.prototype._evalInInspectedWindow):
-        Create an object on the inspected window that holds the console
-        command line API functions. This object is used in a with statement
-        around the typed expression.
-
-2008-08-11  Nikolas Zimmermann  <zimmermann@kde.org>
-
-        Reviewed by Antti.
-
-        Fixes: http://bugs.webkit.org/show_bug.cgi?id=17736
-
-        JS wrapper objects around SVG POD types, that contain other SVG POD types with writable properties
-        failed to update. Modification of the values were completly ignored (ie. transform.matrix.a = 50, didn't take any effect)
-
-        Added tests: svg/custom/svg-modify-currentTranslate.html
-                     svg/custom/tearoffs-with-tearoffs.html
-                     svg/custom/immutable-properties.html
-
-        Fixed tests: svg/dynamic-updates/SVGLinearGradientElement-svgdom-gradientTransform-prop.html
-
-        * bindings/js/JSSVGPODTypeWrapper.h:
-        (WebCore::JSSVGDynamicPODTypeWrapper::commitChange):
-        (WebCore::JSSVGStaticPODTypeWrapperWithPODTypeParent::create):
-        (WebCore::JSSVGStaticPODTypeWrapperWithPODTypeParent::commitChange):
-        (WebCore::JSSVGStaticPODTypeWrapperWithPODTypeParent::JSSVGStaticPODTypeWrapperWithPODTypeParent):
-        (WebCore::JSSVGStaticPODTypeWrapperWithParent::create):
-        (WebCore::JSSVGStaticPODTypeWrapperWithParent::operator PODType):
-        (WebCore::JSSVGStaticPODTypeWrapperWithParent::commitChange):
-        (WebCore::JSSVGStaticPODTypeWrapperWithParent::JSSVGStaticPODTypeWrapperWithParent):
-        * bindings/scripts/CodeGenerator.pm:
-        * bindings/scripts/CodeGeneratorJS.pm:
-        * svg/SVGSVGElement.idl: Add [Immutable] markers to SVG POD attributes, that contain POD types with writable attributes.
-        * svg/SVGZoomEvent.idl:  SVG specification explicitely demands these attributes to be readonly, even its content.
-
-2008-08-11  Brady Eidson  <beidson@apple.com>
-
-        Reviewed by John and Anders
-
-        Fix for <rdar://problem/6141797>
-
-        When WebArchives were entirely a WebKit concept, there was a guarantee that a WebResource
-        would never have nil data.
-
-        When they were pushed down into WebCore, that guarantee was lost, subtly changing a few
-        semantics with some WebKit applications.
-
-        The guarantee was a good one and should be restored.
-
-        Note that ApplicationCacheResource doesn't need any updates to follow this rule as it already
-        creates an empty data object in the case of null data for its own purposes.
-
-        * loader/SubstituteResource.h:
-        (WebCore::SubstituteResource::SubstituteResource): ASSERT that the data is not null.  This
-          well help any future subclassers not make this mistake.
-
-        * loader/archive/ArchiveResource.cpp:
-        (WebCore::ArchiveResource::create): Return 0 if the data is null.
-
-2008-08-11  Simon Fraser  <simon.fraser@apple.com>
-
-        Reviewed by Dave Hyatt
-
-        https://bugs.webkit.org/show_bug.cgi?id=20328
-        Fix a problem when an 'all' transition transition with more than
-        one property changing is interrupted, and did some AnimationController
-        cleanup.
-
-        Test: transitions/interrupted-all-transition.html
-
-        * page/AnimationController.cpp:
-        (WebCore::ImplicitAnimation::ImplicitAnimation):
-        (WebCore::AnimationControllerPrivate::blendProperties):
-        (WebCore::CompositeAnimation::updateTransitions):
-        (WebCore::CompositeAnimation::cleanupFinishedAnimations):
-        (WebCore::CompositeAnimation::setTransitionStartTime):
-        (WebCore::CompositeAnimation::overrideImplicitAnimations):
-        (WebCore::CompositeAnimation::resumeOverriddenImplicitAnimations):
-        (WebCore::ImplicitAnimation::animate):
-        (WebCore::ImplicitAnimation::onAnimationEnd):
-        (WebCore::ImplicitAnimation::sendTransitionEvent):
-        (WebCore::ImplicitAnimation::affectsProperty):
-        (WebCore::KeyframeAnimation::endAnimation):
-        (WebCore::KeyframeAnimation::onAnimationEnd):
-
-2008-08-11  Kevin McCullough  <kmccullough@apple.com>
-
-        Reviewed by Tim.
-
-        - Because console messages have group levels now, newly created messages
-        that do not specify the level lose their message since the number of
-        arguments is wrong.
- 
-        * page/inspector/Console.js:
-        * page/inspector/Resource.js:
-
-2008-08-11  Alp Toker  <alp@nuanti.com>
-
-        Build fix. Add new files from r35666 (WebKitAnimationEvent). Also take
-        the opportunity to sort the sources lists.
-
-        * GNUmakefile.am:
-
-2008-08-11  Timothy Hatcher  <timothy@apple.com>
-
-        Speed up the the JavaScript syntax highlighter by generating
-        the finders only once per script instead of per line.
-
-        https://bugs.webkit.org/show_bug.cgi?id=20346
-
-        Reviewed by Adam Roben.
-
-        * page/inspector/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype._syntaxHighlightJavascriptLine):
-        Removed, factored into syntaxHighlightJavascript as an inline function.
-        (WebInspector.SourceFrame.prototype.syntaxHighlightJavascript):
-        Pulled in the _syntaxHighlightJavascriptLine so it will create a closure.
-        Generate the finders before iterating the lines.
-
-2008-08-11  Adam Roben  <aroben@apple.com>
-
-        Windows build fix
-
-        * WebCore.vcproj/WebCore.vcproj: Added JSWebKitAnimationEvent.cpp and
-        JSWebKitTransitionEvent.cpp to the project. Let VS reformat the file,
-        too.
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
+        (WebCore::Worker::notifyFinished):
+        * workers/Worker.h:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+        * workers/WorkerImportScriptsClient.cpp: Removed.
+        * workers/WorkerImportScriptsClient.h: Removed.
+        * workers/WorkerScriptLoader.cpp: Renamed from workers/WorkerImportScriptsClient.cpp.
+          This to make it more generic so worker script loading could use it.
+        (WebCore::WorkerScriptLoader::loadSynchronously):
+        (WebCore::WorkerScriptLoader::loadAsynchronously):
+        (WebCore::WorkerScriptLoader::didFinishLoading):
+        (WebCore::WorkerScriptLoader::didFail):
+        (WebCore::WorkerScriptLoader::didFailRedirectCheck):
+        (WebCore::WorkerScriptLoader::didReceiveAuthenticationCancellation):
+        (WebCore::WorkerScriptLoader::notifyFinished):
+        * workers/WorkerScriptLoader.h: Renamed from workers/WorkerImportScriptsClient.h.
+          This to make it more generic so worker script loading could use it.
+        * workers/WorkerScriptLoaderClient.h: Added.
 
-2008-08-11  Dan Bernstein  <mitz@apple.com>
+2009-06-16  Brent Fulgham  <bfulgham@gmail.com>
 
         Reviewed by Darin Adler.
 
-        - fix <rdar://problem/6131096> Reproducible crash in CounterNode::isReset under guard malloc
-
-        Test: fast/css/counters/invalidate-cached-counter-node.html
-
-        * rendering/RenderContainer.cpp:
-        (WebCore::RenderContainer::invalidateCounters): Added. Invalidates all
-        RenderCounters in :before and :after content.
-        * rendering/RenderContainer.h:
-        * rendering/RenderCounter.cpp:
-        (WebCore::RenderCounter::isCounter): Renamed isRenderCounter() to this
-        to match the RenderObject method.
-        (WebCore::RenderCounter::invalidate): Added. Resets the cached
-        CounterNode and invalidates the object's layout and preferred widths.
-        (WebCore::destroyCounterNodeChildren): Added a call to
-        invalidateCounters().
-        * rendering/RenderCounter.h:
-        * rendering/RenderObject.h:
-        (WebCore::RenderObject::invalidateCounters):
-
-2008-08-11  Dean Jackson  <dino@apple.com>
-
-        Implement CSS Animation and Transition Events
-        https://bugs.webkit.org/show_bug.cgi?id=20337
-
-        Implement the events defined in the CSS Animations
-        and Transitions specifications so code can react
-        to animations and transitions.
-
-        Reviewed by Tim Hatcher and Dave Hyatt.
-
-        * DerivedSources.make:
-        * GNUmakefile.am:
-        * WebCore.pro:
-        * WebCore.vcproj/WebCore.vcproj:
-        * WebCore.xcodeproj/project.pbxproj:
-        * WebCoreSources.bkl:
-            Build configs for new files
-
-        * bindings/js/JSDOMWindowBase.cpp:
-        * bindings/js/JSDOMWindowBase.h:
-        * bindings/js/JSEventCustom.cpp:
-        * dom/Document.h:
-        * dom/Event.cpp:
-        * dom/Event.h:
-        * dom/EventTarget.cpp:
-        * dom/EventTargetNode.cpp:
-        * dom/EventTargetNode.h:
-        * html/HTMLElement.cpp:
-        * page/AnimationController.cpp:
-            do all the new event stuff
-            
-        * html/HTMLAttributeNames.in:
-            the onwebkitanimation* and onwebkittransitionend attrs
+        Use consistent GUID comparison functions.
+        https://bugs.webkit.org/show_bug.cgi?id=26427
 
-        * dom/WebKitAnimationEvent.cpp: Added.
-        * dom/WebKitAnimationEvent.h: Added.
-        * dom/WebKitAnimationEvent.idl: Added.
-        * dom/WebKitTransitionEvent.cpp: Added.
-        * dom/WebKitTransitionEvent.h: Added.
-        * dom/WebKitTransitionEvent.idl: Added.
-            New files for the events
+        * platform/win/WCDataObject.cpp:
+        (WebCore::WCDataObject::QueryInterface):
 
-        * manual-tests/transition-events.html: Added.
-            New testfile
+2009-06-16  Xan Lopez  <xlopez@igalia.com>
 
-2008-08-11  Adam Roben  <aroben@apple.com>
+        Reviewed by Gustavo Noronha.
 
-        Add a ForwardingHeader for wtf/NotFound.h
+        Fix compiler warning.
 
-        Rubberstamped by Darin Adler.
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_class_init):
 
-        * ForwardingHeaders/wtf/NotFound.h: Added.
+2009-06-16  Xan Lopez  <xlopez@igalia.com>
 
-2008-08-11  Timothy Hatcher  <timothy@apple.com>
+        Reviewed by Gustavo Noronha.
 
-        Fixes a bug where error bubbles in JavaScript resources would
-        be clobbered by the syntax highlighter.
+        Remove dummy AtkStreamableContent implementation.
 
-        https://bugs.webkit.org/show_bug.cgi?id=20345
-
-        Reviewed by Adam Roben.
+        It's completely empty, we'll add it back (and conditionally
+        instead of unconditionally) when it does something.
 
-        * manual-tests/inspector/resources/script-error.js: Added.
-        * manual-tests/inspector/styled-error-bubbles-in-scripts.html: Added.
-        * page/inspector/SourceFrame.js:
-        (WebInspector.SourceFrame.prototype._addMessageToSource):
-        Check the nodeType and not the nodeName, this is less fragile.
-        (WebInspector.SourceFrame.prototype._syntaxHighlightJavascriptLine):
-        Check if the lastChild is an error bubble, if so remove it before
-        getting the line's textContent. Add the error bubble back at the end.
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (GetAtkInterfaceTypeFromWAIType):
+        (getInterfaceMaskFromObject):
 
-== Rolled over to ChangeLog-2008-08-10 ==
+== Rolled over to ChangeLog-2009-06-16 ==
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog-2006-12-31 b/src/3rdparty/webkit/WebCore/ChangeLog-2006-12-31
index b2a350e..804ca3f 100644
--- a/src/3rdparty/webkit/WebCore/ChangeLog-2006-12-31
+++ b/src/3rdparty/webkit/WebCore/ChangeLog-2006-12-31
@@ -6304,7 +6304,7 @@
 
         * config.h:
 
-2006-12-08  Peter Kasting  <pkasting@chromium.org>
+2006-12-08  Peter Kasting  <pkasting@google.com>
 
         Reviewed and landed by Alexey.
 
@@ -6577,7 +6577,7 @@
         * platform/PlatformKeyboardEvent.h:
         (WebCore::PlatformKeyboardEvent::setIsAutoRepeat):
 
-2006-12-07  Peter Kasting  <pkasting@chromium.org>
+2006-12-07  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Darin.
 
@@ -7421,7 +7421,7 @@
         Fix obvious-in-retrospect copy and paste error -- call
         passMouseDownEventToWidget instead of passWheelEventToWidget.
 
-2006-12-04  Peter Kasting  <pkasting@chromium.org>
+2006-12-04  Peter Kasting  <pkasting@google.com>
 
         Reviewed and landed by Alexey.
 
@@ -7468,7 +7468,7 @@
         (WebCore::FrameLoader::createFrame):
         (WebCore::FrameLoaderClientWin::setTitle):
 
-2006-12-04  Peter Kasting  <pkasting@chromium.org>
+2006-12-04  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Mitz.
 
@@ -7970,7 +7970,7 @@
         now calls out to both findFirstMisspellingInRange and findFirstBadGrammarInRange separately
         instead of trying to interweave the spelling and grammar logic
 
-2006-12-01  Peter Kasting  <pkasting@chromium.org>
+2006-12-01  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Mitz.
 
@@ -9946,7 +9946,7 @@
         * loader/FrameLoader.cpp:
         (WebCore::FrameLoader::gotoAnchor):
 
-2006-11-18  Peter Kasting  <pkasting@chromium.org>
+2006-11-18  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Sam Weinig.
 
@@ -10415,7 +10415,7 @@
         (WebCore::createMarkup):
         Add null-checks for the frame, it might not exist for all documents.
         
-2006-11-16  Peter Kasting  <pkasting@chromium.org>
+2006-11-16  Peter Kasting  <pkasting@google.com>
 
         Reviewed and landed by ap.
 
@@ -24148,7 +24148,7 @@ t2006-10-29  Darin Adler  <darin@apple.com>
         * ksvg2/svg/SVGPathSegMovetoAbs.idl:
         * ksvg2/svg/SVGPathSegMovetoRel.idl:
 
-2006-10-09  Peter Kasting  <pkasting@chromium.org>
+2006-10-09  Peter Kasting  <pkasting@google.com>
 
         Unreviewed build fix.
 
@@ -25062,7 +25062,7 @@ t2006-10-29  Darin Adler  <darin@apple.com>
         (WebCore::Frame::stopAutoscrollTimer):
         * page/Frame.h:
 
-2006-10-05  Peter Kasting  <pkasting@chromium.org>
+2006-10-05  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Eric.
 
@@ -25284,7 +25284,7 @@ t2006-10-29  Darin Adler  <darin@apple.com>
         * rendering/RenderLayer.cpp:
         (WebCore::RenderLayer::RenderLayer):
 
-2006-10-05  Peter Kasting  <pkasting@chromium.org>
+2006-10-05  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Darin, landed by Adam.
 
@@ -25416,7 +25416,7 @@ t2006-10-29  Darin Adler  <darin@apple.com>
         (WebCore::RenderObject::NodeInfo::scrollbar):
         (WebCore::RenderObject::NodeInfo::setScrollbar):
 
-2006-10-05  Peter Kasting  <pkasting@chromium.org>
+2006-10-05  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Adam.
 
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog-2007-10-14 b/src/3rdparty/webkit/WebCore/ChangeLog-2007-10-14
index 9275e32..018c5b4 100644
--- a/src/3rdparty/webkit/WebCore/ChangeLog-2007-10-14
+++ b/src/3rdparty/webkit/WebCore/ChangeLog-2007-10-14
@@ -9453,7 +9453,7 @@ a2007-08-31  Darin Adler  <darin@apple.com>
         (WebCore::ArrayImpl::operator==):
         Fixed typo so that correct variable is used in equality comparison.
 
-2007-08-29  Peter Kasting  <zerodpx@gmail.com>
+2007-08-29  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Maciej.
 
@@ -9469,7 +9469,7 @@ a2007-08-31  Darin Adler  <darin@apple.com>
         * platform/image-decoders/gif/GIFImageReader.cpp:
         (GIFImageReader::read):
 
-2007-08-29  Peter Kasting  <zerodpx@gmail.com>
+2007-08-29  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Maciej.
 
@@ -9485,7 +9485,7 @@ a2007-08-31  Darin Adler  <darin@apple.com>
         (WebCore::PNGImageDecoder::rowAvailable):
         (WebCore::PNGImageDecoder::pngComplete):
 
-2007-08-29  Peter Kasting  <zerodpx@gmail.com>
+2007-08-29  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Maciej.
 
@@ -9793,7 +9793,7 @@ a2007-08-31  Darin Adler  <darin@apple.com>
           Only restricts hit testing if the placeholder text is visible.
         * rendering/RenderTextControl.h: (WebCore::RenderTextControl::placeholderIsVisible): Added. 
 
-2007-08-25  Peter Kasting <zerodpx@gmail.org>
+2007-08-25  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Sam Weinig.
 
@@ -10975,7 +10975,7 @@ a2007-08-31  Darin Adler  <darin@apple.com>
         (WebCore::StyleRareInheritedData::operator==):
         (WebCore::RenderStyle::diff):
 
-2007-08-15  Peter Kasting  <zerodpx@gmail.org>
+2007-08-15  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Darin.
         
@@ -15750,7 +15750,7 @@ a2007-08-31  Darin Adler  <darin@apple.com>
         <script> quirk in cases where the / appears in a mangled attribtue
         value.
 
-2007-07-17  Peter Kasting  <zerodpx@gmail.com>
+2007-07-17  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Hyatt.
 
@@ -43567,7 +43567,7 @@ a2007-08-31  Darin Adler  <darin@apple.com>
         (WebCore::RenderObject::verticalPositionHint):
         (WebCore::RenderObject::firstLineStyle):
 
-2007-04-20  Peter Kasting  <pkasting@chromium.org>
+2007-04-20  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Oliver.
 
@@ -60245,7 +60245,7 @@ a2007-08-31  Darin Adler  <darin@apple.com>
         non-obvious side-effect of setting the focused frame.
         * WebCore.xcodeproj/project.pbxproj: Version wars.
 
-2007-01-27  Peter Kasting  <pkasting@chromium.org>
+2007-01-27  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Maciej.
 
@@ -69463,7 +69463,7 @@ a2007-08-31  Darin Adler  <darin@apple.com>
         (WebCore::contextMenuItemTagRightToLeft):
             Added missing stubs.
 
-2007-01-04  Peter Kasting  <pkasting@chromium.org>
+2007-01-04  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Alexey.
 
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog-2008-08-10 b/src/3rdparty/webkit/WebCore/ChangeLog-2008-08-10
index a47ebab..92cbc3f 100644
--- a/src/3rdparty/webkit/WebCore/ChangeLog-2008-08-10
+++ b/src/3rdparty/webkit/WebCore/ChangeLog-2008-08-10
@@ -16230,7 +16230,7 @@
         (WebCore::TextResourceDecoder::checkForHeadCharset): Correct the length passed to
         findIgnoringCase().
 
-2008-05-29  Peter Kasting  <zerodpx@gmail.com>
+2008-05-29  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Dave Hyatt.
 
@@ -63513,7 +63513,7 @@ element is when the element reports itself to the screen reader. So all of these
         directories to the plugin paths.
         (WebCore::PluginDatabaseWin::defaultPluginPaths):
 
-2007-12-20  Peter Kasting  <zerodpx@gmail.com>
+2007-12-20  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Alp Toker.
 
@@ -71115,7 +71115,7 @@ element is when the element reports itself to the screen reader. So all of these
         width among columns, skip those whose effective (rather than
         specified) width is auto and contain only empty cells.
 
-2007-11-28  Peter Kasting  <zerodpx@gmail.com>
+2007-11-28  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Alp Toker.
 
@@ -71349,7 +71349,7 @@ element is when the element reports itself to the screen reader. So all of these
         (WebCore::DatabaseTracker::defaultOriginQuota):
         * storage/DatabaseTracker.h:
 
-2007-11-26  Peter Kasting  <zerodpx@gmail.com>
+2007-11-26  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Alp Toker.
 
@@ -72529,7 +72529,7 @@ element is when the element reports itself to the screen reader. So all of these
         (WebCore::XMLHttpRequest::getResponseXML):
         * xml/XMLHttpRequest.h:
 
-2007-11-19  Peter Kasting  <zerodpx@gmail.com>
+2007-11-19  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Darin Adler.
 
@@ -74725,7 +74725,7 @@ element is when the element reports itself to the screen reader. So all of these
         (WebCore::ContextMenu::appendItem):
         (WebCore::ContextMenu::itemCount):
 
-2007-11-09  Peter Kasting  <zerodpx@gmail.com>
+2007-11-09  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Mark Rowe.
 
@@ -76617,7 +76617,7 @@ element is when the element reports itself to the screen reader. So all of these
         * platform/network/ResourceResponse.cpp:
         (WebCore::ResourceResponse::isAttachment):
 
-2007-11-01  Peter Kasting  <zerodpx@gmail.com>
+2007-11-01  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Dave Hyatt.
 
@@ -82084,7 +82084,7 @@ element is when the element reports itself to the screen reader. So all of these
         (WebCore::renderSubtreeToImage):
         * rendering/SVGRenderSupport.h:
 
-2007-10-14  Peter Kasting  <zerodpx@gmail.com>
+2007-10-14  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Maciej.
 
@@ -82180,7 +82180,7 @@ element is when the element reports itself to the screen reader. So all of these
         not added into generated after content. Also made adding a child before
         a table caption work correctly instead of adding the child after the caption.
 
-2007-10-14  Peter Kasting  <zerodpx@gmail.com>
+2007-10-14  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Maciej.
 
@@ -82191,7 +82191,7 @@ element is when the element reports itself to the screen reader. So all of these
         * platform/image-decoders/gif/GIFImageReader.cpp:
         (GIFImageReader::read):
 
-2007-10-14  Peter Kasting  <zerodpx@gmail.com>
+2007-10-14  Peter Kasting  <pkasting@google.com>
 
         Reviewed by Maciej.
 
diff --git a/src/3rdparty/webkit/WebCore/ChangeLog-2009-06-16 b/src/3rdparty/webkit/WebCore/ChangeLog-2009-06-16
new file mode 100644
index 0000000..1041c90
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ChangeLog-2009-06-16
@@ -0,0 +1,97559 @@
+2009-06-15  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/6907228> Pasting a paragraph as quotation leaves you typing in blue instead of black; repros
+
+        * editing/InsertParagraphSeparatorCommand.cpp: (WebCore::InsertParagraphSeparatorCommand::doApply):
+        When inserting a newline after the blockquote, we don't want to apply the original style after the insertion.
+
+2009-06-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Remove outdated comment.
+
+        * bindings/js/JSDOMWindowBase.h:
+
+2009-06-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Bring CustomGetPropertyNames more inline with the other
+        extended attributes prefixed with Custom, by making it 
+        require a complete implementation.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getPropertyNames):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::getPropertyNames):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getPropertyNames):
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::getPropertyNames):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-06-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Remove commented out ondataunavailable attribute event listener which
+        has now been removed from HTML 5.
+
+        * page/DOMWindow.idl:
+
+2009-06-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Move entire custom implementation of getOwnPropertySlot and put
+        for JSDOMWindow into JSDOMWindowCustom, eliminating the bit in
+        JSDOMWindowBase.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::nonCachingStaticFunctionGetter):
+        (WebCore::childFrameGetter):
+        (WebCore::indexGetter):
+        (WebCore::namedItemGetter):
+        (WebCore::JSDOMWindow::getOwnPropertySlot):
+        (WebCore::JSDOMWindow::put):
+        (WebCore::JSDOMWindow::getPropertyAttributes):
+        * bindings/js/JSDOMWindowCustom.h:
+        * page/DOMWindow.idl:
+
+2009-06-15  Jeremy Orlow (jorlow@chromium.org)
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26356
+        Define the functions in V8CustomBindings.h.  "Forgot" this in my
+        earlier patch since it wasn't fully upstreamed when I wrote the
+        patch.
+
+        * bindings/v8/custom/V8CustomBinding.h:
+
+2009-06-15  Andre Boule  <aboule@apple.com>
+
+        Reviewed by Cameron Zwarich and Dan Bernstein.
+
+        - fix <rdar://problem/6967975> crash with NSString drawAtPoint
+
+        No test possible because this crash can only occur if the client uses
+        WebKit text drawing without ever using WebCore text, and DumpRenderTree
+        cannot do either.
+
+        * platform/graphics/FontCache.cpp:
+        (WebCore::FontCache::purgeInactiveFontData): Null-check
+            gFontPlatformDataCache.
+
+2009-06-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6974857>
+        
+        Define ENABLE_3D_RENDERING when building on 10.6, and move ENABLE_3D_RENDERING
+        switch from config.h to wtf/Platform.h.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * config.h:
+
+2009-06-15  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Make WebInspector's console evaluation/completion asynchronous.
+        This way of evaluation allows serializing calls between 
+        InspectorController and its frontend.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26350
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype.completions):
+        (WebInspector.Console.prototype._reportCompletions):
+        (WebInspector.Console.prototype._evalInInspectedWindow):
+        (WebInspector.Console.prototype._enterKeyPressed.printResult):
+        (WebInspector.Console.prototype._enterKeyPressed):
+        * inspector/front-end/DatabaseQueryView.js:
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.evaluateExpression):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame):
+        * inspector/front-end/TextPrompt.js:
+        (WebInspector.TextPrompt.prototype.complete):
+        (WebInspector.TextPrompt.prototype._completionsReady):
+
+2009-06-15  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Reverted previous change as the old behavior was correct for heavy view.
+
+        * inspector/front-end/BottomUpProfileDataGridTree.js:
+        (WebInspector.BottomUpProfileDataGridNode.prototype._populate):
+
+2009-06-15  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        <rdar://problem/6968125> Profiler 'Call' count is incorrect in Heavy
+        view (26418)
+
+        - Removed code that copied call and time data from it's ancestor.
+
+        * inspector/front-end/BottomUpProfileDataGridTree.js:
+        (WebInspector.BottomUpProfileDataGridNode.prototype._populate):
+
+2009-06-15  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser  <simon.fraser@apple.com>.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26163
+
+        Added logic to updateTransitions similar to that in updateKeyframeAnimations
+        which detects and removes stale transitions.
+
+        Test: transitions/cancel-transition.html
+
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateTransitions):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::ImplicitAnimation):
+        * page/animation/ImplicitAnimation.h:
+        (WebCore::ImplicitAnimation::active):
+        (WebCore::ImplicitAnimation::setActive):
+
+2009-06-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        - allow the source code font in the Web Inspector to be customized
+
+        * css/view-source.css: Use the default monospace font family and size
+            for source code.
+        * inspector/front-end/inspector.css: Use the default monospace font
+            family and size for console I/O.
+
+2009-06-15  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by and done with Tor Arne Vestbø.
+
+        Fix initialization of uninitialized members in FontFallbackListQt, leading
+        to random crashes when rendering text.
+
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        (WebCore::FontFallbackList::FontFallbackList):
+        (WebCore::FontFallbackList::invalidate):
+
+2009-06-15  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25895
+        [Gtk] Segfault when deleting the last/only character in an entry if a11y is enabled
+
+        Use computeOffsetInContainerNode instead of the inline
+        offsetInContainerNode to return the caret offset, since the former
+        can handle all types of anchoring. Otherwise we'll hit an ASSERT
+        in some situations in debug builds, and crash.
+
+        * editing/gtk/SelectionControllerGtk.cpp:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+
+2009-06-15  Joe Ligman  <joseph.ligman@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix build break
+        Rename JSONObject to InspectorJSONObject
+
+        https://bugs.webkit.org/show_bug.cgi?id=26340
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToConsole):
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::bind):
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::newInspectorJSONObject):
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        (WebCore::InspectorFrontend::addResource):
+        (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        * inspector/InspectorFrontend.h:
+        * inspector/InspectorJSONObject.cpp: Copied from WebCore/inspector/JSONObject.cpp.
+        (WebCore::InspectorJSONObject::InspectorJSONObject):
+        (WebCore::InspectorJSONObject::set):
+        (WebCore::InspectorJSONObject::scriptObject):
+        (WebCore::InspectorJSONObject::createNew):
+        * inspector/InspectorJSONObject.h: Copied from WebCore/inspector/JSONObject.h.
+        * inspector/InspectorResource.cpp:
+        (WebCore::populateHeadersObject):
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+        * inspector/JSONObject.cpp: Removed.
+        * inspector/JSONObject.h: Removed.
+
+2009-06-12  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Refactor handling of options in the build-webkit script
+        
+        Options are now defined in one place, and then reused when creating
+        the usage help text, the arguments to GetOptions(), and when passing
+        the options on to the underlying port-dependent build systems.
+        
+        This allows the Qt port to read the defaults for the options from the
+        pro file (dynamically), and to pass the options on to qmake at build.
+
+        * WebCore.pro:
+
+2009-06-14  chris fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 26399: REGRESSION: java applet accessibility broken
+        https://bugs.webkit.org/show_bug.cgi?id=26399
+ 
+        Accessibility could not access the elements in a java applet 
+        when going down the AX hierarchy.
+
+        Test: DRT does not allow java applets so add a manual test:
+              manual-tests/accessibility/java-applet.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
+        * accessibility/mac/AccessibilityObjectMac.mm:
+        (WebCore::AccessibilityObject::accessibilityIgnoreAttachment):
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper attachmentView]):
+        * manual-tests/accessibility: Added.
+        * manual-tests/accessibility/java-applet.html: Added.
+        * manual-tests/accessibility/resources: Added.
+        * manual-tests/accessibility/resources/AppletTest.class: Added.
+        * manual-tests/accessibility/resources/AppletTest.java: Added.
+        (AppletTest):
+        (AppletTest.init):
+
+2009-06-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Rename the CustomGetOwnPropertySlot and CustomPutFunction extended attributes
+        to DelegatingGetOwnPropertySlot and DelegatingPutFunction to more clearly describe
+        their functionality (customGetOwnPropertySlot and customPut member functions have
+        been renamed getOwnPropertySlotDelegate and putDelegate).  CustomGetOwnPropertySlot 
+        and CustomPutFunction have been repurposed to mean a complete custom implementation
+        of the function which is inline with other extended attributes prefixed with Custom.
+
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::JSCSSStyleDeclaration::putDelegate):
+        * bindings/js/JSDOMWindowCustom.h:
+        (WebCore::JSDOMWindow::getOwnPropertySlotDelegate):
+        (WebCore::JSDOMWindow::putDelegate):
+        * bindings/js/JSHTMLAppletElementCustom.cpp:
+        (WebCore::JSHTMLAppletElement::getOwnPropertySlotDelegate):
+        (WebCore::JSHTMLAppletElement::putDelegate):
+        * bindings/js/JSHTMLEmbedElementCustom.cpp:
+        (WebCore::JSHTMLEmbedElement::getOwnPropertySlotDelegate):
+        (WebCore::JSHTMLEmbedElement::putDelegate):
+        * bindings/js/JSHTMLObjectElementCustom.cpp:
+        (WebCore::JSHTMLObjectElement::getOwnPropertySlotDelegate):
+        (WebCore::JSHTMLObjectElement::putDelegate):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::getOwnPropertySlotDelegate):
+        (WebCore::JSHistory::putDelegate):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::getOwnPropertySlotDelegate):
+        (WebCore::JSLocation::putDelegate):
+        (WebCore::JSLocationPrototype::putDelegate):
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::putDelegate):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::getOwnPropertySlotDelegate):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * css/CSSStyleDeclaration.idl:
+        * html/HTMLAppletElement.idl:
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLObjectElement.idl:
+        * page/DOMWindow.idl:
+        * page/History.idl:
+        * page/Location.idl:
+        * storage/Storage.idl:
+        * workers/WorkerContext.idl:
+
+2009-06-14  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=26395
+          <rdar://problem/6971333> REGRESSION (r40813-r40884): No caret after
+          going back/forward to page with focused text field
+
+        No test, since the back/forward cache is disabled in DumpRenderTree
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::open): Added a call to CachedPage::restore(),
+        which was removed in r40870.
+
+2009-06-14  Darin Adler  <darin@apple.com>
+
+        * editing/TextIterator.cpp:
+        (WebCore::BitStack::push): Use named constant instead of hardcoded numbers.
+        (WebCore::BitStack::top): Ditto.
+
+2009-06-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 26364: Search can find text that's hidden by overflow:hidden
+        https://bugs.webkit.org/show_bug.cgi?id=26364
+        <rdar://problem/6952081>
+
+        Test: fast/text/find-hidden-text.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::BitStack::BitStack): Added.
+        (WebCore::BitStack::push): Added.
+        (WebCore::BitStack::pop): Added.
+        (WebCore::BitStack::top): Added.
+        (WebCore::BitStack::size): Added.
+        (WebCore::parentOrShadowParent): Added. Helper function for walking up
+        the parent node chain, crossing shadow tree boundaries.
+        (WebCore::depthCrossingShadowBoundaries): Added for use in assertions.
+        Counts the depth of a node using the parentOrShadowParent function.
+        (WebCore::fullyClipsContents): Added. Returns true for an element that
+        fully clips its contents, currently defined as a box that has zero width
+        or height and hides overflow. We can add other cases here later.
+        (WebCore::ignoresContainerClip): Added. Returns true for an element that
+        ignores its container clip, currently defined as an element with absolute
+        or fixed positioning.
+        (WebCore::pushFullyClippedState): Added. Pushes a bit on the stack indicating
+        if the node in question fully clips its contents.
+        (WebCore::setUpFullyClippedStack): Added. Pushes a bit for each ancestor of
+        a node. Used when creating an iterator.
+        (WebCore::TextIterator::TextIterator): Removed code to initialize
+        m_inShadowContent. Call setUpFullyClippedStack.
+        (WebCore::TextIterator::advance): Use parentOrShadowParent. Call pop when moving
+        up to a parent node, and also one extra time when moving to a sibling node.
+        Call pushFullyClippedState when moving to a child node, or when moving to a
+        sibling node after the aforementioned call to pop.
+        (WebCore::TextIterator::handleTextNode): Return early if the node is fully clipped.
+        (WebCore::TextIterator::handleReplacedElement): Ditto.
+        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator):
+        Call setUpFullyClippedStack.
+        (WebCore::SimplifiedBackwardsTextIterator::advance): Same changes as
+        TextIterator::advance above.
+
+        * editing/TextIterator.h: Added BitStack class and added m_fullyClippedStack to both
+        TextIterator and SimplifiedBackwardsTextIterator. Removed unneeded m_inShadowContent.
+
+2009-06-14  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26362
+
+        Back out Simon's fix and replace it with a better one that doesn't needlessly destroy RenderObjects.
+        Use NoInherit rather than Detach for child index changes, and don't worry about other pseudo-class state
+        changes, since they were handled already with setNeedsStyleRecalcs on the affected objects themselves.
+
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle):
+        * dom/Node.cpp:
+        (WebCore::Node::diff):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::setChildIndex):
+
+2009-06-14  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Move all of the mutable member variables from Font into the refcounted FontFallbackList.  This makes
+        copying of Fonts more efficient and also effectively makes all of the mutations of a Font object happen
+        inside the FontFallbackList.
+
+        * WebCore.base.exp:
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::Font):
+        (WebCore::Font::operator=):
+        (WebCore::Font::primaryFont):
+        (WebCore::Font::update):
+        * platform/graphics/Font.h:
+        (WebCore::Font::setWordSpacing):
+        (WebCore::Font::setLetterSpacing):
+        * platform/graphics/FontFallbackList.cpp:
+        (WebCore::FontFallbackList::FontFallbackList):
+        (WebCore::FontFallbackList::invalidate):
+        (WebCore::FontFallbackList::determinePitch):
+        * platform/graphics/FontFallbackList.h:
+        (WebCore::FontFallbackList::primarySimpleFontData):
+        (WebCore::FontFallbackList::primaryFontData):
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter):
+
+2009-06-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26362
+        
+        Fix an issue noted on quirksmode.com where dynamically adding siblings does not
+        update :nth-child style correctly.
+
+        Test: fast/css/nth-child-dynamic.html
+
+        * dom/Node.h:
+        Change diff() to take const RenderStyle*
+        * dom/Node.cpp:
+        (WebCore::Node::diff):
+        When comparing styles to decide whether to detach and reattach, we
+        need to look at whether the pseudoclass-related data in the style
+        changed (since RenderStyle::diff doesn't check this).
+        
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::getCachedPseudoStyle):
+        (WebCore::RenderStyle::inheritedNotEqual):
+        Make these methods const.
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::styleType):
+        (WebCore::InheritedFlags::pseudoClassStateEquivalent):
+        Make methods const.
+        Add new method that compares the pseudoclass-related members.
+
+2009-06-13  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Kevin Ollivier.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25709 part eleven
+        Write a wx implementation so the wx port can compile.  For now this is
+        mostly a copy of the Cairo port, but in the future it can be changed to
+        use a wxBitmap as the storage type everywhere (just as Cairo can
+        probably be changed).
+        
+        Also ASSERT for any other ports who call getAddr() (I don't think there
+        are any, and besides, they probably won't link, but this doesn't hurt).
+        
+        Also fixes a dumb Cairo build bustage typo introduced in part ten.
+
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::ImageSource::createFrameAtIndex):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::getAddr):
+        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
+        (WebCore::RGBA32Buffer::setStatus):
+        * platform/image-decoders/wx: Added.
+        * platform/image-decoders/wx/ImageDecoderWx.cpp: Added.
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::zeroFill):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+        * webcore-wx.bkl:
+
+2009-06-13  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.  Landed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26320
+
+        Some minor code cleanup for chromium/skia port.  Removed #ifdef's
+        around skia API changes, since the new version seems solid and we
+        don't need to go back.  Added some comments to
+        TransparencyWin.h, as requested by Brett in
+        https://bugs.webkit.org/show_bug.cgi?id=24584.
+
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/chromium/TransparencyWin.h:
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::boundingRect):
+        (WebCore::boundingBoxForCurrentStroke):
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::SkPathContainsPoint):
+
+2009-06-13  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24492
+
+        Moved registerURLSchemeAsLocal and registerURLSchemeAsNoAccess from
+        FrameLoader to SecurityOrigin.
+
+        * WebCore.base.exp:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadFrameRequest):
+        (WebCore::FrameLoader::canLoad):
+        * loader/FrameLoader.h:
+        * page/SecurityOrigin.cpp:
+        (WebCore::localSchemes):
+        (WebCore::noAccessSchemes):
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::isLocal):
+        (WebCore::SecurityOrigin::registerURLSchemeAsLocal):
+        (WebCore::SecurityOrigin::shouldTreatURLAsLocal):
+        (WebCore::SecurityOrigin::shouldTreatURLSchemeAsLocal):
+        (WebCore::SecurityOrigin::registerURLSchemeAsNoAccess):
+        (WebCore::SecurityOrigin::shouldTreatURLSchemeAsNoAccess):
+        * page/SecurityOrigin.h:
+
+2009-06-13  Ben Murdoch  <benm@google.com>
+
+        Reviewed by David Kilzer.  Landed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26189
+
+        This patch changes the way PageGroups create their localStorage
+        objects. Rather than creating a local storage object for the page group
+        when a page is added to the group, the local storage object is now
+        created lazily when the local storage object is requested by the
+        DOMWindow.
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::closeLocalStorage): Before attempting to close a local storage object for a page group, ensure one has been created.
+        (WebCore::PageGroup::addPage): Do not automatically try to create a local storage object when a page is added to the group.
+        (WebCore::PageGroup::localStorage): Create a local storage object if one does not exist and return it.
+        * page/PageGroup.h: Add private hasLocalStorage method to PageGroup.
+
+
+2009-06-13  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Eric Seidel.  Landed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26189
+
+        Add ENABLE(DOM_STORAGE) guards to the dom storage source files.
+
+        * storage/LocalStorage.cpp: Add ENABLE(DOM_STORAGE) guards to the file.
+        * storage/LocalStorage.h: Ditto
+        * storage/LocalStorageArea.cpp: Ditto
+        * storage/LocalStorageArea.h: Ditto
+        * storage/LocalStorageTask.cpp: Ditto
+        * storage/LocalStorageTask.h: Ditto
+        * storage/LocalStorageThread.cpp: Ditto
+        * storage/LocalStorageThread.h: Ditto
+        * storage/SessionStorage.cpp: Ditto
+        * storage/SessionStorage.h: Ditto
+        * storage/SessionStorageArea.cpp: Ditto
+        * storage/SessionStorageArea.h: Ditto
+        * storage/Storage.cpp: Ditto
+        * storage/Storage.h: Ditto
+        * storage/StorageArea.cpp: Ditto
+        * storage/StorageArea.h: Ditto
+        * storage/StorageEvent.cpp: Ditto
+        * storage/StorageEvent.h: Ditto
+        * storage/StorageMap.cpp: Ditto
+        * storage/StorageMap.h: Ditto
+        * storage/StorageEvent.idl: Add Conditional=DOM_STORAGE attribute.
+        * storage/Storage.idl: Ditto
+
+2009-06-13  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25709 part ten
+        Make Skia use the root directory ImageDecoder.h and factor out most
+        Skia-specific bits into skia/ImageDecoderSkia.cpp.  Also fix a pair of
+        style violations in ImageDecoderCairo.cpp.  This is the last patch for
+        this bug, everything beyond this is an enhancement rather than
+        unforking.
+
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::getAddr):
+        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::setStatus):
+        * platform/image-decoders/skia/ImageDecoder.h: Removed.
+        * platform/image-decoders/skia/ImageDecoderSkia.cpp: Added.
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::zeroFill):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+
+2009-06-13  Victor Wang <victorw@chromium.org>
+
+        Reviewed by Eric Seidel.  Landed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26333
+        Alert during a dragenter event handler will crash the renderer
+        
+        This crash is casued by calling NULL pointer m_documentUnderMouse in
+        DragController::tryDocumentDrag()
+
+        tryDHTMLDrag fires dragenter event. The event listener that listens
+        to this event may create a nested message loop (open a modal dialog),
+        which could process dragleave event and reset m_documentUnderMouse in
+        dragExited.
+
+        Fix the crash by checking m_documentUnderMouse after tryDHTMLDrag and
+        do not continue if the pointer has been set to NULL.
+
+        Test: DRT does not show alerts so add a manual test:
+              manual-tests/drag-enter-alert.html
+
+        * manual-tests/drag-enter-alert.html: Added.
+        * manual-tests/resources/drag-image.png: Added.
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDocumentDrag):
+
+2009-06-13  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.  Landed by Adam Barth.
+
+        Moved V8 Bindings for V8CustomXPathNSResolver to svn.webkit.org.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26227
+
+        * bindings/v8/custom/V8CustomXPathNSResolver.cpp: Added.
+        (WebCore::V8CustomXPathNSResolver::V8CustomXPathNSResolver): Moved from src.chromium.org.
+        (WebCore::V8CustomXPathNSResolver::~V8CustomXPathNSResolver): Moved from src.chromium.org.
+        (WebCore::V8CustomXPathNSResolver::lookupNamespaceURI): Moved from src.chromium.org.
+        * bindings/v8/custom/V8CustomXPathNSResolver.h: Added.
+        * bindings/v8/custom/V8DocumentCustom.cpp: Updated includes.
+        (WebCore::CALLBACK_FUNC_DECL): Updated class name.
+
+2009-06-13  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Mark Rowe.  Landed by Adam Barth.
+
+        Remove obsolete declarations for old Symbian port
+        https://bugs.webkit.org/show_bug.cgi?id=26339
+
+        * platform/graphics/FloatPoint.h: Remove declarations for native SYMBIAN adaptation.
+        * platform/graphics/FloatRect.h: Ditto.
+        * platform/graphics/IntPoint.h: Ditto.
+        * platform/graphics/IntRect.h: Ditto.
+        * platform/graphics/IntSize.h: Ditto.
+
+2009-06-13  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Added subRegion calculation to SVG filter. Every filter effect is
+        clipped to the filter region (according to the spec). This makes
+        ImageBuffers for filter effects smaller and we just need to take
+        care about big filter regions.
+        SVGFEImage needed a correction, to avoid an ASSERT. The two filter
+        effects feOffset and feFlood help to test the new subRegion code.
+
+        Tests: svg/filters/subRegion-one-effect.svg
+               svg/filters/subRegion-two-effects.svg
+
+        * platform/graphics/filters/FEBlend.h:
+        (WebCore::FEBlend::uniteChildEffectSubregions):
+        * platform/graphics/filters/FEColorMatrix.h:
+        (WebCore::FEColorMatrix::uniteChildEffectSubregions):
+        * platform/graphics/filters/FEComponentTransfer.h:
+        (WebCore::FEComponentTransfer::uniteChildEffectSubregions):
+        * platform/graphics/filters/FEComposite.h:
+        (WebCore::FEComposite::uniteChildEffectSubregions):
+        * platform/graphics/filters/Filter.h:
+        (WebCore::Filter::setSourceImage):
+        (WebCore::Filter::sourceImage):
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::FilterEffect):
+        (WebCore::FilterEffect::calculateUnionOfChildEffectSubregions):
+        (WebCore::FilterEffect::calculateEffectRect):
+        * platform/graphics/filters/FilterEffect.h:
+        (WebCore::FilterEffect::setUnionOfChildEffectSubregions):
+        (WebCore::FilterEffect::unionOfChildEffectSubregions):
+        (WebCore::FilterEffect::hasX):
+        (WebCore::FilterEffect::setHasX):
+        (WebCore::FilterEffect::hasY):
+        (WebCore::FilterEffect::setHasY):
+        (WebCore::FilterEffect::hasWidth):
+        (WebCore::FilterEffect::setHasWidth):
+        (WebCore::FilterEffect::hasHeight):
+        (WebCore::FilterEffect::setHasHeight):
+        (WebCore::FilterEffect::setEffectBuffer):
+        (WebCore::FilterEffect::uniteChildEffectSubregions):
+        * platform/graphics/filters/SourceAlpha.h:
+        (WebCore::SourceAlpha::calculateEffectRect):
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::calculateEffectRect):
+        (WebCore::SourceGraphic::apply):
+        * platform/graphics/filters/SourceGraphic.h:
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::finishRenderSVGContent):
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::setStandardAttributes):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::prepareFilter):
+        (WebCore::SVGResourceFilter::applyFilter):
+        * svg/graphics/SVGResourceFilter.h:
+        * svg/graphics/filters/SVGFEConvolveMatrix.h:
+        (WebCore::FEConvolveMatrix::uniteChildEffectSubregions):
+        * svg/graphics/filters/SVGFEDiffuseLighting.h:
+        (WebCore::FEDiffuseLighting::uniteChildEffectSubregions):
+        * svg/graphics/filters/SVGFEDisplacementMap.h:
+        (WebCore::FEDisplacementMap::uniteChildEffectSubregions):
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::apply):
+        * svg/graphics/filters/SVGFEGaussianBlur.h:
+        (WebCore::FEGaussianBlur::uniteChildEffectSubregions):
+        * svg/graphics/filters/SVGFEImage.cpp:
+        (WebCore::FEImage::FEImage):
+        * svg/graphics/filters/SVGFEImage.h:
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::uniteEffectRect):
+        * svg/graphics/filters/SVGFEMerge.h:
+        * svg/graphics/filters/SVGFEMorphology.h:
+        (WebCore::FEMorphology::uniteChildEffectSubregions):
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+        * svg/graphics/filters/SVGFEOffset.h:
+        (WebCore::FEOffset::uniteChildEffectSubregions):
+        * svg/graphics/filters/SVGFESpecularLighting.h:
+        (WebCore::FESpecularLighting::uniteEffectRect):
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::uniteChildEffectSubregions):
+        * svg/graphics/filters/SVGFETile.h:
+        * svg/graphics/filters/SVGFilter.cpp:
+        (WebCore::SVGFilter::calculateEffectSubRegion):
+        * svg/graphics/filters/SVGFilter.h:
+        (WebCore::SVGFilter::effectBoundingBoxMode):
+        (WebCore::SVGFilter::filterRegion):
+        (WebCore::SVGFilter::sourceImageRect):
+
+2009-06-13  Peter Kasting  <pkasting@google.com>
+
+        Bustage: Fix broken GIFs on Cairo due to subtle typo.  Fix a warning.
+
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::copyRowNTimes):
+        * platform/image-decoders/bmp/BMPImageReader.cpp:
+        (WebCore::BMPImageReader::processBitmasks):
+
+2009-06-13  Peter Kasting  <pkasting@google.com>
+
+        GTK bustage fix.  "inline" is handled differently by different compilers.
+
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::getAddr):
+        * platform/image-decoders/cairo/ImageDecoderCairo.cpp:
+
+2009-06-13  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25709 part nine
+        Factor Cairo-specific implementation out of ImageDecoder.h into
+        ImageDecoderCairo.cpp.  Add some comments to functions declared
+        in ImageDecoder.h.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/image-decoders/ImageDecoder.h:
+        * platform/image-decoders/cairo: Added.
+        * platform/image-decoders/cairo/ImageDecoderCairo.cpp: Added.
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::zeroFill):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+        (WebCore::RGBA32Buffer::getAddr):
+
+2009-06-13  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Cleanup of the new MidpointState class.  Turn it into a struct instead.  Fix a mistaken
+        assertion removal and some unintentional whitespace changes.
+
+        * platform/text/BidiResolver.h:
+        (WebCore::MidpointState::reset):
+        * rendering/RenderBlock.h:
+        * rendering/bidi.cpp:
+        (WebCore::BidiRun::operator delete):
+        (WebCore::chopMidpointsAt):
+        (WebCore::checkMidpoints):
+        (WebCore::addMidpoint):
+        (WebCore::appendRunsForObject):
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2009-06-12  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26367
+
+        Remove the global variables in bidi.cpp.  Make a new struct, MidpointState, that holds all of the
+        midpoint information.  Add the remaining global variables as arguments passed down through functions
+        as needed.
+
+        * platform/text/BidiResolver.h:
+        (WebCore::MidpointState::MidpointState):
+        (WebCore::MidpointState::reset):
+        (WebCore::BidiResolver::midpointState):
+        * rendering/RenderBlock.h:
+        * rendering/bidi.cpp:
+        (WebCore::BidiRun::operator delete):
+        (WebCore::chopMidpointsAt):
+        (WebCore::checkMidpoints):
+        (WebCore::addMidpoint):
+        (WebCore::appendRunsForObject):
+        (WebCore::RenderBlock::bidiReorderLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::determineStartPosition):
+        (WebCore::skipNonBreakingSpace):
+        (WebCore::shouldCollapseWhiteSpace):
+        (WebCore::requiresLineBox):
+        (WebCore::RenderBlock::generatesLineBoxesForInlineChild):
+        (WebCore::RenderBlock::skipTrailingWhitespace):
+        (WebCore::RenderBlock::skipLeadingWhitespace):
+        (WebCore::shouldSkipWhitespaceAfterStartObject):
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2009-06-12  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Build fix for Qt. After recent ImageDeocder.h changes. I want
+        the original change to be backed out as the whole Skia merging
+        is going in the wrong direction. The discussion will happen in
+        the bugtracker.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25709.
+
+        * platform/image-decoders/ImageDecoder.h:
+
+2009-06-12  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix: include cstdio so we can use sscanf
+
+        Gtk/Win Cairo build fix: use isASCIISpace instead of isspace
+        Suggested by Brent Fulgham
+
+        * platform/image-decoders/xbm/XBMImageDecoder.cpp:
+        (WebCore::XBMImageDecoder::decodeDatum):
+
+2009-06-12  Peter Kasting  <pkasting@google.com>
+
+        Yet another Skia bustage fix.
+
+        * platform/image-decoders/skia/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::setSize): Avoid symbol name clash.  The better fix is to take an IntSize(); I'll do that later.
+
+2009-06-12  Peter Kasting  <pkasting@google.com>
+
+        Fix remaining Cairo build bustage from
+        https://bugs.webkit.org/show_bug.cgi?id=25709 changes.  Use
+        Vector<char> in place of std::string.
+
+        * platform/image-decoders/xbm/XBMImageDecoder.cpp:
+        (WebCore::XBMImageDecoder::setData):
+        (WebCore::XBMImageDecoder::decodeHeader):
+        (WebCore::XBMImageDecoder::decodeDatum):
+        * platform/image-decoders/xbm/XBMImageDecoder.h:
+
+2009-06-12  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        UString shouldn't create sharedBuffer for SmallStrings.
+        https://bugs.webkit.org/show_bug.cgi?id=26347
+
+        Change the call to use the method UString::Rep::sharedBuffer due
+        to changes in UString.
+
+        No noticable change in behavior, so no test.
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::create):
+
+2009-06-12  Peter Kasting  <pkasting@google.com>
+
+        Fix Chromium and some of Cairo build bustage, fallout from
+        https://bugs.webkit.org/show_bug.cgi?id=25709 changes.
+
+        * WebCore.vcproj/WebCore.vcproj: Add missing XBM decoder files.
+        * platform/image-decoders/skia/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::copyRowNTimes): Fix typo that broke Skia GIF decoding.
+
+2009-06-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=26095
+        
+        Fix crash when a renderer for an anonymous node is composited
+        by null-checking renderer()->node().
+        
+        Test: compositing/generated-content.html
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::createGraphicsLayer):
+        (WebCore::RenderLayerBacking::rendererHasBackground):
+        (WebCore::RenderLayerBacking::rendererBackgroundColor):
+        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer):
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+
+2009-06-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix build when ACCELERATED_COMPOSITING is defined.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::attachRootGraphicsLayer):
+        (WebCore::EmptyChromeClient::setNeedsOneShotDrawingSynchronization):
+        (WebCore::EmptyChromeClient::scheduleViewUpdate):
+        Add stubs for the compositing-related ChromeClient methods.
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateRootLayerPosition):
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+        docWidth()/docHeight() became private. Use overflowWidth()/overflowHeight() instead, which
+        matches what is used to size the WebHTMLView.
+
+2009-06-12  jorlow  <jorlow@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26356
+        http://crbug.com/14006
+        Create custom bindings for v8.  The rest of these files are still
+        forked (so the review is happening on the chromium review site).
+        These bindings have been tested on a hacked up Chromium instance
+        (also running --single-process) and Android.
+
+        * bindings/v8/custom/V8StorageCustom.cpp: Added.
+
+2009-06-12  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26359
+        [v8] Add XMLHttpRequest to WorkerContextExecutionProxy.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::ToV8Object): Add type == V8ClassIndex::XMLHTTPREQUEST to the convertable types.
+        (WebCore::WorkerContextExecutionProxy::EventTargetToV8Object): same.
+        * bindings/v8/WorkerContextExecutionProxy.h: fix typo in the comment.
+
+2009-06-12  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25709 part eight
+        Replace placeholder Cairo BMP, ICO, XBM decoders with real ones.  Remove
+        all the decoders from skia/ since they are now just mirrors of the Cairo
+        ones.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+        * platform/graphics/cairo/ImageSourceCairo.cpp:
+        (WebCore::createDecoder): Pass IntSize() to ICOImageDecoder() so it will always decode the largest icon.  Enable XBM decoding on Windows.
+        * platform/graphics/skia/ImageSourceSkia.cpp:
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::createDecoder): Pass IntSize() to ICOImageDecoder() so it will always decode the largest icon.
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp: Replaced with WebCore/platform/image-decoders/skia/BMPImageDecoder.cpp.
+        * platform/image-decoders/bmp/BMPImageDecoder.h: Replaced with WebCore/platform/image-decoders/skia/BMPImageDecoder.h.
+        * platform/image-decoders/bmp/BMPImageReader.cpp: Copied from WebCore/platform/image-decoders/skia/BMPImageReader.cpp.
+        * platform/image-decoders/bmp/BMPImageReader.h: Copied from WebCore/platform/image-decoders/skia/BMPImageReader.h.
+        * platform/image-decoders/ico/ICOImageDecoder.cpp: Replaced with WebCore/platform/image-decoders/skia/ICOImageDecoder.cpp.
+        * platform/image-decoders/ico/ICOImageDecoder.h: Replaced with WebCore/platform/image-decoders/skia/ICOImageDecoder.h.
+        * platform/image-decoders/skia/BMPImageDecoder.cpp: Removed.
+        * platform/image-decoders/skia/BMPImageDecoder.h: Removed.
+        * platform/image-decoders/skia/BMPImageReader.cpp: Removed.
+        * platform/image-decoders/skia/BMPImageReader.h: Removed.
+        * platform/image-decoders/skia/GIFImageDecoder.cpp: Removed.
+        * platform/image-decoders/skia/GIFImageDecoder.h: Removed.
+        * platform/image-decoders/skia/GIFImageReader.cpp: Removed.
+        * platform/image-decoders/skia/GIFImageReader.h: Removed.
+        * platform/image-decoders/skia/ICOImageDecoder.cpp: Removed.
+        * platform/image-decoders/skia/ICOImageDecoder.h: Removed.
+        * platform/image-decoders/skia/JPEGImageDecoder.cpp: Removed.
+        * platform/image-decoders/skia/JPEGImageDecoder.h: Removed.
+        * platform/image-decoders/skia/PNGImageDecoder.cpp: Removed.
+        * platform/image-decoders/skia/PNGImageDecoder.h: Removed.
+        * platform/image-decoders/skia/XBMImageDecoder.cpp: Removed.
+        * platform/image-decoders/skia/XBMImageDecoder.h: Removed.
+        * platform/image-decoders/xbm/XBMImageDecoder.cpp: Replaced with WebCore/platform/image-decoders/skia/XBMImageDecoder.cpp.
+        * platform/image-decoders/xbm/XBMImageDecoder.h: Replaced with WebCore/platform/image-decoders/skia/XBMImageDecoder.h.
+
+2009-06-11  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25709 part seven
+        Update Skia's ImageDecoder.h with a few changes designed to reduce the
+        delta between specific implementations of ImageDecoder.h.  Update
+        Cairo's ImageDecoder.h to sync up with the API changes in the Skia
+        version in the last two chage sets.  Update Cairo's PNG/JPEG/GIF
+        decoders to use the APIs as well.  All the Cairo image decoder changes
+        are direct copies of the Skia versions except ImageDecoder.h, which is
+        modified in the necessary ways for the differences between Cairo and
+        Skia.
+
+        * platform/graphics/cairo/ImageSourceCairo.cpp:
+        (WebCore::ImageSource::createFrameAtIndex): Use new RGBA32Buffer::asNewNativeImage() API.
+        * platform/image-decoders/ImageDecoder.h: Sync up with Skia version.
+        (WebCore::RGBA32Buffer::):
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::zeroFill):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::copyRowNTimes):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::disposalMethod):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setDisposalMethod):
+        (WebCore::RGBA32Buffer::setRGBA):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+        (WebCore::RGBA32Buffer::getAddr):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp: Sync up with Skia version.
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        (WebCore::GIFImageDecoder::haveDecodedRow):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp: Sync up with Skia version.
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        * platform/image-decoders/png/PNGImageDecoder.cpp: Sync up with Skia version.
+        (WebCore::PNGImageDecoder::rowAvailable):
+        * platform/image-decoders/skia/ImageDecoder.h: Add various typedefs or helper functions to minimize differences with Cairo version.  Reorder functions slightly to match reordering of Cairo's m_hasAlpha variable, which I moved to increase readability.
+        (WebCore::RGBA32Buffer::):
+        (WebCore::RGBA32Buffer::copyRowNTimes):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::asNewNativeImage):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::disposalMethod):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::setDisposalMethod):
+        (WebCore::RGBA32Buffer::setRGBA):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+        (WebCore::RGBA32Buffer::getAddr):
+        * platform/image-decoders/skia/JPEGImageDecoder.cpp: Add #include needed by JPEG headers on some platforms, plus comment.
+
+2009-06-12  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build correction.
+
+        Revert accidental configuration checkin.  Was not meant to
+        be part of the last changeset.
+
+        * config.h:
+
+2009-06-12  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26353
+        Corrects handling of Cairo fonts that were getting out of
+        sync due to default copy construction.  Also refactors
+        some incorrect platform font destruction code that belongs
+        in the font object's destructor.
+
+        * platform/graphics/win/FontPlatformData.h:
+        * platform/graphics/win/FontPlatformDataCGWin.cpp:
+        (WebCore::FontPlatformData::~FontPlatformData):
+        * platform/graphics/win/FontPlatformDataCairoWin.cpp:
+        (WebCore::FontPlatformData::platformDataInit):
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::setFont):
+        (WebCore::FontPlatformData::~FontPlatformData):
+        * platform/graphics/win/FontPlatformDataWin.cpp:
+        * platform/graphics/win/SimpleFontDataCGWin.cpp:
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+
+2009-06-12  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        * ChangeLog-2007-10-14: Update my email address.
+        * ChangeLog-2008-08-10: Update my email address.
+
+2009-06-12  Nate Chapin  <japhet@google.com>
+
+        Reviewed by David Levin.
+
+        Upstream V8Helpers.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26332
+
+        * bindings/v8/V8Helpers.cpp: Added.
+        (wrapNPObject): Moved from v8_helpers.cpp.
+        (toV8Context): Moved from v8_helpers.cpp.
+        (toV8Proxy): Moved from v8_helpers.cpp.
+        * bindings/v8/V8Helpers.h: Added.
+
+2009-06-12  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24792
+        rdar://problem/6933055
+
+        Changes the radius in which cursor movement around the 4 arrow icon
+        while pan-scrolling does not cause scrolling from around 10 pixels to
+        15 pixels, similar to what is found in IE and Firefox.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::setPanScrollCursor):
+        Factor out the no-pan-scroll radius.
+        * platform/ScrollView.h:
+        Create a constant for the no-pan-scroll radius.
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::panScrollFromPoint):
+        Factor out the no-pan-scroll radius.
+
+2009-06-12  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25609
+        [GTK] Implement support for get_selection and get_n_selections
+
+        Only use the VisibleSelection object if it actually belongs to the
+        object we are using.
+
+        This is pretty hacky-ish, but I can't seem to find a direct API to
+        get the VisibleSelection for a given object, only the global one.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (selectionBelongsToObject):
+        (webkit_accessible_text_get_n_selections):
+        (webkit_accessible_text_get_selection):
+
+2009-06-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Crash at Node::nodeIndex()
+        https://bugs.webkit.org/show_bug.cgi?id=26044
+
+        This crash seems to be caused by calling nodeIndex() on
+        and invalid Node pointer.  As far as I can tell, the most likely
+        explanation is that the Range holding the node is actually
+        deleted already (thus the memory is junk).  Looking at the code
+        Range changes m_start.container() in its destructor to tell if
+        the range is detached or not.  If somehow m_start.container() was
+        cleared, the range will never be detached and the Document will end
+        up with pointers to deleted ranges.  I don't know how to reproduce this
+        any reproduction I could think of would hit ASSERTS in Debug mode.
+        One reproduction I tried, did not crash in Release mode, even though it
+        did in Debug mode.
+
+        I'm making a speculative fix by always detaching the Range from the document
+        during ~Range.  This is safer, and all we lose is an ASSERT to prevent double-detach.
+        
+        Another solution would be to instead store an m_attached bool on the Range object, or
+        expose a Document::isRangeAttached(range) call.  Either of those solutions
+        could affect performance, so I went with this solution for now.
+
+        I also removed the RangeBoundaryPoint default constructor
+        as it is not used anywhere (and is more likely to cause confusion).
+
+        Since I can't reproduce the crash, no test.
+
+        * dom/Document.cpp:
+        (WebCore::Document::detachRange):
+        * dom/Range.cpp:
+        (WebCore::Range::~Range):
+        (WebCore::Range::detach):
+        * dom/RangeBoundaryPoint.h:
+        (WebCore::RangeBoundaryPoint::RangeBoundaryPoint):
+          RangeBoundaryPoints always have an m_containerNode, ASSERT that.
+        (WebCore::RangeBoundaryPoint::set):
+          ASSERT(container) to match all the other functions.
+          All callers already ASSERT(container).  Since we only
+          have reports if this crash from Release mode, I can only
+          assume that those ASSERTs would have been hit in a Debug reproduction.
+
+2009-06-11  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25512
+        Handle texts after unfinished special tags (i.e., script, style, textarea,
+        title, xmp, and iframe) as the text node under the tags in view-source mode.
+        Before this change, all texts in unfinished special tags cannot be seen even in view-source mode.
+
+        This was already done only for title. This change allows other special tags to be handled as well.
+
+        Test: fast/frames/viewsource-unfinished-tags.html
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::parseNonHTMLText):
+        (WebCore::HTMLTokenizer::parseTag):
+        (WebCore::HTMLTokenizer::write):
+        * html/HTMLTokenizer.h:
+        (WebCore::HTMLTokenizer::State::inAnyNonHTMLText):
+
+2009-06-11  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26291
+
+        [Qt] build break in ImageDecoderQt.cpp.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::reset):
+        (WebCore::ImageDecoderQt::setData):
+        (WebCore::ImageDecoderQt::isSizeAvailable):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::ImageDecoder::setSize):
+
+2009-06-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Ariya Hidayat.
+
+        Removed obsolete and unmaintained files from the old Symbian port.
+
+        * platform/symbian/FloatPointSymbian.cpp: Removed.
+        * platform/symbian/FloatRectSymbian.cpp: Removed.
+        * platform/symbian/IntPointSymbian.cpp: Removed.
+        * platform/symbian/IntRectSymbian.cpp: Removed.
+        * platform/symbian/IntSizeSymbian.cpp: Removed.
+        * platform/text/symbian/StringImplSymbian.cpp: Removed.
+        * platform/text/symbian/StringSymbian.cpp: Removed.
+
+2009-06-10  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25709 part six
+        Miscellaneous tiny changes.  The important bits here are the ANSI C++
+        compliance fix in skia/ImageDecoders.h (needed to compile this file on
+        non-MSVC) and some behavioral fixes for the XBM decoder that Chromium
+        unit tests partly exposed.  Other changes are mostly cosmetic.
+
+        * platform/image-decoders/ImageDecoder.h: Make some variables private again.  This will break QTWebKit but those guys have agreed to wait on my finishing the ImageDecoder changes.
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::initFrameBuffer): Use IntPoint() instead of the redundant IntPoint(0, 0).
+        (WebCore::GIFImageDecoder::frameComplete): Use IntPoint() instead of the redundant IntPoint(0, 0).
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageDecoder::outputScanlines): Remove obvious comments.
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::rowAvailable): Remove obvious comments.
+        * platform/image-decoders/skia/BMPImageReader.cpp:
+        (WebCore::BMPImageReader::decodeBMP): Make more in line with other decoders' comments and structure, use a ref to decrease verbosity.
+        (WebCore::BMPImageReader::processRLEData): Use a ref to decrease verbosity.
+        (WebCore::BMPImageReader::processNonRLEData): Use a ref to decrease verbosity.
+        * platform/image-decoders/skia/GIFImageDecoder.cpp: Use IntPoint() instead of the redundant IntPoint(0, 0).
+        (WebCore::GIFImageDecoder::initFrameBuffer): Use IntPoint() instead of the redundant IntPoint(0, 0).
+        (WebCore::GIFImageDecoder::frameComplete): Use IntPoint() instead of the redundant IntPoint(0, 0).
+        * platform/image-decoders/skia/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::copyRowNTimes): Fix ANSI violation that MSVC let me compile (!).
+        * platform/image-decoders/skia/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageDecoder::outputScanlines): Remove obvious comments.
+        * platform/image-decoders/skia/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::rowAvailable): Remove obvious comments.
+        * platform/image-decoders/skia/XBMImageDecoder.cpp:
+        (WebCore::XBMImageDecoder::frameBufferAtIndex): Return 0 for non-zero indexes, don't try to decode unnecessarily after failure or when the size couldn't be computed, make more in line with other decoders' comments and structure, call RGBA32Buffer::setRect() appropriately.
+
+2009-06-10  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        The shadow node inside empty textareas gets collapsed in disabled
+        textareas. This is a regression from moving the overflow from
+        the shadow node to it's parent. The fix is to return true in
+        RenderBlock::hasLineIfEmpty for textarea shadow nodes as we 
+        currently do for input shadow nodes.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26296
+        
+        Test: fast/forms/empty-textarea-toggle-disabled.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::hasLineIfEmpty):
+
+2009-06-10  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25609
+        [GTK] Implement support for get_selection and get_n_selections
+
+        Implement atk_text_get_n_selections.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_text_get_n_selections):
+
+2009-06-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        - fix <rdar://problem/6958664> REGRESSION (r42665): When I drag to pan a
+          Google map in iPhoto Places, it drags a map tile instead
+
+        Calling stopLoadRequest() from notifyFinished() removed the
+        ScriptElementData from the CachedScript's client set, which could make
+        it eligible for purging. The fix is to call removeClient() only after
+        executing the script, which protects it from being purged while it is
+        in the document's queue of scripts to execute soon.
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::execute): Call removeClient() here.
+        (WebCore::ScriptElementData::notifyFinished): Instead of calling
+        stopLoadRequest(), which calls removeClient(), just reset
+        m_cachedScript.
+
+2009-06-10  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Mark Rowe and Eric Seidel.
+
+        Update WebInspector localizedStrings.js with new resource tracking strings
+        https://bugs.webkit.org/show_bug.cgi?id=26247
+
+        * English.lproj/localizedStrings.js:
+
+2009-06-10  Feng Qian  <feng@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add Android specific files.
+        https://bugs.webkit.org/show_bug.cgi?id=26280
+
+        * platform/text/android: Added.
+        * platform/text/android/TextBreakIteratorInternalICU.cpp: Added.
+
+2009-06-10  Feng Qian  <feng@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add Android specific file to WebCore/platform/android (part 9).
+        https://bugs.webkit.org/show_bug.cgi?id=26266
+
+        * platform/android/TemporaryLinkStubs.cpp: Added.
+
+2009-06-10  Feng Qian  <feng@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add Android platform specific files.
+        https://bugs.webkit/org/show_bug.cgi?id=26265 (part 8).
+
+        * platform/android/SystemTimeAndroid.cpp: Added.
+        * platform/android/WidgetAndroid.cpp: Added.
+
+2009-06-10  Feng Qian  <feng@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add Android port files to WebCore/platform. (part 6).
+        https://bugs.webkit.org/show_bug.cgi?id=26264
+
+        * platform/android/RenderThemeAndroid.cpp: Added.
+        * platform/android/RenderThemeAndroid.h: Added.
+
+2009-06-10  Feng Qian  <feng@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add Android port files to WebCore/platform (part 7).
+        https://bugs.webkit.org/show_bug.cgi?id=23296
+
+        * platform/android/ScreenAndroid.cpp: Added.
+        * platform/android/ScrollViewAndroid.cpp: Added.
+        * platform/android/SearchPopupMenuAndroid.cpp: Added.
+
+2009-06-10  Feng Qian  <feng@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add Android port files to WebCore/platform (part 5).
+        https://bugs.webkit.org/show_bug.cgi?id=23296
+
+        * platform/android/LocalizedStringsAndroid.cpp: Added.
+        * platform/android/PopupMenuAndroid.cpp: Added.
+
+2009-06-10  Feng Qian  <feng@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add Android port files to WebCore/platform (part 4).
+        https://bugs.webkit.org/show_bug.cgi?id=23296
+
+        * platform/android/KeyEventAndroid.cpp: Added.
+        * platform/android/KeyboardCodes.h: Added.
+
+2009-06-10  Feng Qian  <feng@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add Android port files to WebCore/platform (part 3).
+        https://bugs.webkit.org/show_bug.cgi?id=23296
+
+        * platform/android/FileChooserAndroid.cpp: Added.
+        * platform/android/FileSystemAndroid.cpp: Added.
+
+2009-06-10  Feng Qian  <feng@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add Android port files to WebCore/platform (part 2).
+        https://bugs.webkit.org/show_bug.cgi?id=23296
+
+        * platform/android/CursorAndroid.cpp: Added.
+        * platform/android/DragDataAndroid.cpp: Added.
+        * platform/android/EventLoopAndroid.cpp: Added.
+
+2009-06-10  Nate Chapin  <japhet@google.com>
+
+        Reviewed by David Levin.
+
+        Finish moving V8Custom from src.chromium.org to svn.webkit.org.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26258
+
+        * bindings/v8/custom/V8CustomBinding.cpp: Finished upstreaming.
+        (WebCore::ACCESSOR_GETTER): Moved from v8_custom.cpp.
+        (WebCore::INDEXED_ACCESS_CHECK): Moved from v8_custom.cpp.
+        (WebCore::NAMED_ACCESS_CHECK): Moved from v8_custom.cpp.
+        (WebCore::V8Custom::GetTargetFrame): Moved from v8_custom.cpp.
+        (WebCore::V8Custom::DowncastSVGPathSeg): Moved from v8_custom.cpp.
+        * bindings/v8/custom/V8CustomBinding.h: Finished upstreaming.
+        * bindings/v8/custom/V8DatabaseCustom.cpp: Updated includes.
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp: Updated includes.
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp: Updated includes.
+        * bindings/v8/custom/V8WebKitPointConstructor.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL): Moved from v8_custom.cpp.
+
+2009-06-10  Takeshi Yoshino  <tyoshino@google.com>
+
+        Reviewed by Justin Garcia.
+
+        Bug 26214: RenderTextControl: Remove ASSERT for checking that visiblePositionForIndex()'s return is not null.
+        https://bugs.webkit.org/show_bug.cgi?id=26214
+
+        visiblePositionForIndex can return an instance that returns true for
+        isNotNull(). One of common case is when the corresponding input element has
+        "-webkit-user-select: none" style attribute. We should allow the case instead
+        of putting ASSERT.
+
+        Test: fast/forms/input-select-webkit-user-select-none.html
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setSelectionRange):
+
+2009-06-10  Roland Steiner <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 26197: Incorrect variable initialization in PlatformContextSkia.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=26197
+
+        The PlatformContextSkia constructor does a (very likely) wrong size
+        initialization for its m_stateStack member:
+
+            m_stateStack(sizeof(State))
+
+        The intended initialization is probably rather
+
+            m_stateStack(1)
+
+        However, since this doesn't buy much (see also comment #4),
+        I removed the initialization completely.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::PlatformContextSkia): remove member initialization
+
+2009-06-10  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        When there is no backing bitmap, return a transparent pattern.
+        https://bugs.webkit.org/show_bug.cgi?id=26061
+
+        Test: fast/canvas/canvas-empty-image-pattern.html
+
+        * platform/graphics/skia/PatternSkia.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+
+2009-06-10  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix a crash for radial gradients with a zero radius.
+        https://bugs.webkit.org/show_bug.cgi?id=26059
+
+        Test: fast/gradients/crash-on-zero-radius.html
+
+        * platform/graphics/skia/GradientSkia.cpp:
+        (WebCore::Gradient::platformGradient):
+
+2009-06-10  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25709 part five
+        Rewrite users of ImageDecoder.h to use "safe" API calls, Skia side.
+        This tweaks the RGBA32Buffer interfaces to be implementable by Cairo as
+        well and modifies Skia's usage of those interfaces accordingly.  Once a
+        similar change lands on the Cairo side, the Skia and Cairo decoders
+        should be identical except for the implementation of RGBA32Buffer.
+
+        * platform/graphics/skia/ImageSourceSkia.cpp:
+        (WebCore::ImageSource::createFrameAtIndex): Use new RGBA32Buffer::asNewNativeImage() function.
+        * platform/image-decoders/skia/BMPImageReader.cpp:
+        (WebCore::BMPImageReader::processNonRLEData): Use new RGBA32Buffer::zeroFill() function.
+        * platform/image-decoders/skia/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::haveDecodedRow): Rewrite to use RGBA32Buffer::setRGBA(x, y, ...) calls as well as other RGBA32Buffer interface calls instead of knowing the underlying types inside the buffer; also try and add clarity.
+        * platform/image-decoders/skia/ImageDecoder.h: Removed bitmap(), width(), and height().
+        (WebCore::RGBA32Buffer::zeroFill): Added.
+        (WebCore::RGBA32Buffer::copyBitmapData): Avoid using bitmap(), which is going away.
+        (WebCore::RGBA32Buffer::copyRowNTimes): Added.
+        (WebCore::RGBA32Buffer::setSize): Use new zeroFill() function.
+        (WebCore::RGBA32Buffer::asNewNativeImage): Added.
+        (WebCore::RGBA32Buffer::setRGBA): Condensed two versions into one that takes coordinates instead of a raw pointer.
+
+2009-06-10  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25671
+        [GTK] Implement support for set_caret_offset
+
+        Make an implementation that actually works.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_text_set_caret_offset):
+
+2009-06-10  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26294
+
+        Make sure all member variables are initialized so that the default
+        assignment operator and copy constructors do not read uninitialized
+        memory.
+
+        * platform/network/ResourceResponseBase.cpp:
+
+2009-06-10  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Update main resource meta-data when resource tracking is disabled.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26253
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::getTrackedResource):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorController.h:
+
+2009-06-10  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25609
+        [GTK] Implement support for get_selection and get_n_selections
+
+        Implement atk_text_get_selection.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_text_get_selection):
+
+2009-06-10  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Do not check if our parent class has the finalize method, it's
+        guaranteed to be there.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_finalize):
+
+2009-06-10  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build correct for Windows Cairo targets.
+
+        * WebCore.vcproj/WebCore.vcproj: Disable warning 4611 (interaction
+          between '_setjmp' and C++ object destruction is non-portable) for
+          the two Cairo targets.  This used to be disabled in a #pragma,
+          but recent refactoring removed these lines.
+
+2009-06-10  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the build of PluginView on Qt with 64-bit where we disable plugins
+        at compile time.
+
+        Use the FooNone.cpp files at compile-time.
+
+        * plugins/PluginPackageNone.cpp:
+        * plugins/mac/PluginPackageMac.cpp:
+        * plugins/mac/PluginViewMac.cpp:
+
+2009-06-10  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build.
+
+        ImageDecoderQt needs m_size and m_sizeAvailable to be protected.
+
+        * platform/image-decoders/ImageDecoder.h:
+
+2009-06-10  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Use absolute path for install_name on Mac
+
+        * WebCore.pro:
+
+2009-06-10  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Reduce duplicated code to access the text of a AtkText
+        object. doAXStringForRange calls text() internally, so we are
+        doing exactly the same after the change.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getGailTextUtilForAtk):
+        (getPangoLayoutForAtk):
+
+2009-06-10  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Pass a PangoLayout to the GailTextUtil function calls.
+
+        It's needed for LINE boundary calls to work correctly.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (updateLayout):
+        (getPangoLayoutForAtk):
+        (webkit_accessible_text_get_text_after_offset):
+        (webkit_accessible_text_get_text_at_offset):
+
+2009-06-10  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Use GailUtilText instead of my crappy partial reimplementation of
+        it. This should add support for LINE boundaries too, although it's
+        mostly untested for now.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getGailTextUtilForAtk):
+        (webkit_accessible_text_get_text_after_offset):
+        (webkit_accessible_text_get_text_at_offset):
+
+2009-06-10  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix: include <stdio.h> as it is required in jpeglib.h
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+
+2009-06-09  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25709 part four
+        Most of the remaining Cairo changes needed before merging Skia/Cairo
+        image decoders.  Most of these involve plumbing more error detection and
+        handling (or, in some cases, merely the capability to detect errors, as
+        e.g. Skia detects and handles image allocation failure while Cairo
+        currently doesn't).  There is also some general cleanup and
+        simplification; RGBA32Buffer::m_height and all associated functions have
+        been removed (set but never used) and some places now rely on superclass
+        implementations.
+
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::RGBA32Buffer): Remove m_height, ensureHeight() and associated stuff
+        (WebCore::RGBA32Buffer::copyBitmapData): Add API function so refcounted backing stores (like Skia uses) can be used with GIFs
+        (WebCore::RGBA32Buffer::setSize): Zero-fill image to avoid garbage
+        (WebCore::RGBA32Buffer::height): Remove
+        (WebCore::RGBA32Buffer::ensureHeight): Remove
+        (WebCore::ImageDecoder::ImageDecoder): Keep member initialization in order, force subclasses to go through size() instead of accessing m_size directly
+        (WebCore::ImageDecoder::isSizeAvailable): Check that decoding hasn't failed
+        (WebCore::ImageDecoder::size): Check that decoding hasn't failed
+        (WebCore::ImageDecoder::setSize): Protect against integer overflow
+        (WebCore::ImageDecoder::isOverSize): Protect against integer overflow
+        * platform/image-decoders/gif/GIFImageDecoder.cpp: Remove prepEmptyFrameBuffer()
+        (WebCore::GIFImageDecoder::isSizeAvailable): Rely on superclass isSizeAvailable() for better failure handling
+        (WebCore::GIFImageDecoder::sizeNowAvailable): Add return values for better failure handling, rely on superclass setSize() for overflow protection
+        (WebCore::GIFImageDecoder::initFrameBuffer): Add return values for better failure handling, remove prepEmptyFrameBuffer(), use RGBA32Buffer::setSize() to handle potential allocation failures (won't happen with Cairo port, can in Skia), use RGBA32Buffer::copyBitmapData() so backing store can be refcounted internally (Cairo won't be, Skia is), rely on superclass size() for better failure handling
+        (WebCore::GIFImageDecoder::haveDecodedRow): Fix style violation, remove RGBA32Buffer::ensureHeight()
+        (WebCore::GIFImageDecoder::frameComplete): Remove RGBA32Buffer::ensureHeight()
+        * platform/image-decoders/gif/GIFImageDecoder.h: Remove prepEmptyFrameBuffer(), add return values for better failure handling
+        * platform/image-decoders/gif/GIFImageReader.cpp:
+        (GIFImageReader::do_lzw): Protect against array overflow, add comments
+        (GIFImageReader::read): Protect against array overflow, be more tolerant of bad data, better failure handling
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp: Remove MSVC-specific warning disable (bfulgham will move into build files)
+        (WebCore::JPEGImageReader::decode): Better failure handling
+        (WebCore::JPEGImageDecoder::isSizeAvailable): Rely on superclass isSizeAvailable() for better failure handling
+        (WebCore::JPEGImageDecoder::outputScanlines): Use RGBA32Buffer::setSize() to handle potential allocation failures (won't happen with Cairo port, can in Skia), rely on superclass size() for better failure handling, remove RGBA32Buffer::ensureHeight()
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h: Rely on superclass setSize() for overflow protection
+        * platform/image-decoders/png/PNGImageDecoder.cpp: Remove MSVC-specific warning disable (bfulgham will move into build files)
+        (WebCore::PNGImageDecoder::PNGImageDecoder): Don't allocate a slot in the framebuffer cache until it's needed
+        (WebCore::PNGImageDecoder::isSizeAvailable): Rely on superclass isSizeAvailable() for better failure handling
+        (WebCore::PNGImageDecoder::frameBufferAtIndex): Don't allocate a slot in the framebuffer cache until it's needed
+        (WebCore::PNGImageDecoder::decode): Don't allocate a slot in the framebuffer cache until it's needed
+        (WebCore::PNGImageDecoder::decodingFailed): Fix style violation
+        (WebCore::PNGImageDecoder::headerAvailable): Rely on superclass isSizeAvailable() and setSize() for overflow protection and better failure handling
+        (WebCore::PNGImageDecoder::rowAvailable): Don't allocate a slot in the framebuffer cache until it's needed, use RGBA32Buffer::setSize() to handle potential allocation failures (won't happen with Cairo port, can in Skia), remove RGBA32Buffer::ensureHeight()
+        (WebCore::PNGImageDecoder::pngComplete): Don't allocate a slot in the framebuffer cache until it's needed
+
+2009-06-09  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, adding JSCore/assembler to the list of include dirs, and
+        adding editing/ReplaceNodeSpanCommand.cpp to the build.
+        
+        * WebCoreSources.bkl:
+        * webcore-base.bkl:
+
+2009-06-09  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        When checking if the loader is the main resource loader make sure that the loader's frame is the main frame. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=26218
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::isMainResourceLoader):
+        * inspector/InspectorController.h:
+
+2009-06-09  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26190
+
+        Test: media/controls-css-overload.html
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls): Prevent NULL dereference in case containers gets hidden.
+
+2009-06-08  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25709 part three
+        Various minor cleanups to the Skia files.  Mostly non-functional, except
+        for two specific changes:
+        * JPEGs and PNGs were always marked as transparent; now they are only
+          marked as transparent when they actually are.  I doubt this has much
+          of an effect but in theory it could be used to optimize their display.
+        * Instead of arbitrarily disallowing images over 32 * 1024 * 1024 px^2,
+          only disallow images which are so large they will cause overflow in
+          other parts of the code.  This should fix the testcase on
+          http://code.google.com/p/chromium/issues/detail?id=3643.
+
+        * platform/image-decoders/skia/BMPImageReader.h:
+        (WebCore::BMPImageReader::setRGBA): Use simpler non-static setRGBA() form
+        * platform/image-decoders/skia/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::initFrameBuffer): Remove unneeded code, use more readable setRGBA() form
+        (WebCore::GIFImageDecoder::haveDecodedRow): Fix style violation
+        * platform/image-decoders/skia/GIFImageDecoder.h: Remove unneeded code
+        * platform/image-decoders/skia/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::setSize): setSize() should just setStatus() when it fails since all callers were doing it
+        (WebCore::ImageDecoder::isOverSize): Ease "oversized" image constraints to allow any image that won't overflow
+        * platform/image-decoders/skia/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageDecoder::outputScanlines): Remove unneeded code, mark JPEGs as non-transparent
+        * platform/image-decoders/skia/PNGImageDecoder.cpp:
+        (WebCore::PNGImageDecoder::decodingFailed): Fix style violation
+        (WebCore::PNGImageDecoder::rowAvailable): Mark un-decoded PNGs as non-transparent (this will get reset later as needed)
+        * platform/image-decoders/skia/XBMImageDecoder.cpp:
+        (WebCore::XBMImageDecoder::frameBufferAtIndex): Remove unneeded code
+
+2009-06-09  Darin Fisher  <darin@chromium.org>
+
+        Fix Chromium build bustage.
+        
+        CachedResource.cpp no longer compiles if USE(JSC) is not defined.  The
+        problem is that this file is using a macro from StdLibExtras.h without
+        including that file.  It just happenes to get that file via a JSC
+        specific include.
+
+        * loader/CachedResource.cpp:
+
+2009-06-09  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Make sure the graphics backends are in sync with the canvas lineWidth state.
+        https://bugs.webkit.org/show_bug.cgi?id=26187
+
+        Test: fast/canvas/canvas-line-width.html
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::CanvasRenderingContext2D):
+
+2009-06-09  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Proactively cancel pending requests at DocLoader dtor time,
+        otherwise crashes can occur. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=26230
+        http://code.google.com/p/chromium/issues/detail?id=12161
+
+        Test: fast/frames/javascript-url-as-framesrc-crash.html
+
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::~DocLoader):
+
+2009-06-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix ASSERT seen in shadow tree testing
+        https://bugs.webkit.org/show_bug.cgi?id=25092
+
+        Test: svg/custom/use-mutation-event-crash.svg
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::instanceForShadowTreeElement):
+
+2009-06-09  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Fixes https://bugs.webkit.org/show_bug.cgi?id=22891
+        Scrolling in Windows Cairo Broken if no background color set.
+
+        * platform/graphics/cairo/GradientCairo.cpp:
+        (WebCore::Gradient::fill):  Use the GraphicsContext save and restore
+          methods (rather than the Cairo-only functions) so that the Windows
+          device context is kept in sync.
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::GraphicsContext): Add new constructor call
+          to sync Windows HDC with Cairo surface.
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+        (WebCore::GraphicsContextPlatformPrivate::syncContext): Provide
+          declaration for Windows HDC sync method (and stub for non-Windows
+          Cairo implementations).
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::draw): Use GraphicsContext save and restore
+          methods (rather than the Cairo-only functions) so that the Windows
+          device context is kept in sync.
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        (WebCore::CairoContextWithHDC): New method to create a valid Cairo
+          context for a given HDC.
+        (WebCore::GraphicsContext::GraphicsContext): Modify constructor to
+          use new CairoContextWithHDC call.
+        (WebCore::GraphicsContext::getWindowsContext): Revise to match
+          behavior of CG implementation.
+        (WebCore::GraphicsContext::releaseWindowsContext): Revise to match
+          behavior of CG implementation.
+        (WebCore::GraphicsContextPlatformPrivate::concatCTM): Get rid of
+          incorrect new HDC, and use object's HDC member for dealing with
+          concatCTM operations.
+        (WebCore::GraphicsContextPlatformPrivate::syncContext): New method
+          to sync Windows HDC with Cairo context.
+        * platform/graphics/win/ImageCairoWin.cpp:
+        (WebCore::BitmapImage::getHBITMAPOfSize): Revise implementation to
+          match CG behavior.
+
+2009-06-09  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Bug 26196: Fix the problem that worker's importScripts fails if the
+        script URL is redirected from different origin.
+        https://bugs.webkit.org/show_bug.cgi?id=26196
+
+        Test: http/tests/workers/worker-importScripts.html
+
+        The fix is to pass an additional enum parameter to the loader in
+        order to tell it to perform the redirect origin check or not.
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::create):
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
+        (WebCore::DocumentThreadableLoader::willSendRequest):
+        * loader/DocumentThreadableLoader.h:
+        * loader/ThreadableLoader.cpp:
+        (WebCore::ThreadableLoader::create):
+        (WebCore::ThreadableLoader::loadResourceSynchronously):
+        * loader/ThreadableLoader.h:
+        (WebCore::):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
+        (WebCore::WorkerThreadableLoader::loadResourceSynchronously):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):
+        * loader/WorkerThreadableLoader.h:
+        (WebCore::WorkerThreadableLoader::create):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::importScripts):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
+
+2009-06-09  Anand K. Mistry  <amistry@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Paint bitmaps with the alpha channel in Skia.
+        https://bugs.webkit.org/show_bug.cgi?id=26037
+
+        Test: fast/canvas/drawImage-with-globalAlpha.html
+
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::paintSkBitmap):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::getAlpha):
+        * platform/graphics/skia/PlatformContextSkia.h:
+
+2009-06-09  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26104
+        [GTK] Make NetworkRequest a proper GObject and expose SoupMessage
+
+        Refactor how SoupMessage is handled, so that our ResourceRequest
+        object doesn't have to store it as a member, which complicates
+        managing ResourceRequest's lifetime.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startHttp):
+        * platform/network/soup/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::toSoupMessage):
+        (WebCore::ResourceRequest::updateFromSoupMessage):
+
+2009-06-09  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build, the time functions moved into the WTF namespace.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+
+2009-06-08  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Antti Koivisto
+
+        <rdar://problem/6727495> Repro crash in WebCore::Loader::Host::servePendingRequests() and dupes.
+
+        Test: http/tests/loading/deleted-host-in-resource-load-delegate-callback.html
+
+        Loader::Host objects were manually managed via new/delete.
+        There's a variety of circumstances where a Host might've been deleted while it was still in the middle
+        of a resource load delegate callback.
+        Changing them to be RefCounted then adding protectors in the callbacks makes this possibility disappear.
+
+        At the same time, remove ProcessingResource which was an earlier fix for this same problem that wasn't
+        fully implemented.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Loader):
+        (WebCore::Loader::load):
+        (WebCore::Loader::servePendingRequests):
+        (WebCore::Loader::resumePendingRequests):
+        (WebCore::Loader::cancelRequests):
+        (WebCore::Loader::Host::didFinishLoading):
+        (WebCore::Loader::Host::didFail):
+        (WebCore::Loader::Host::didReceiveResponse):
+        (WebCore::Loader::Host::didReceiveData):
+        * loader/loader.h:
+        (WebCore::Loader::Host::create):
+
+2009-06-08  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26126
+        Refactor methods of WorkerMessagingProxy used to talk to main-thread loader into new interface.
+
+        Split a couple of methods used to schedule cross-thread tasks between worker thread and loader thread
+        implemented on WorkerMessagingProxy into a separate interface so the loading can be implemented in
+        Chromium's workers.
+
+        No changes in functionality so no tests added.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Added WorkerLoaderProxy.h to the bulid.
+
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate): WorkerThread::workerObjectProxy() now returns & instead of *
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate): same.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::~WorkerContext): same.
+        (WebCore::WorkerContext::reportException): same.
+        (WebCore::WorkerContext::addMessage): same.
+        (WebCore::WorkerContext::postMessage): same.
+
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::destroy):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::cancel):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didSendData):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveResponse):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveData):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFinishLoading):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFail):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFailRedirectCheck):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveAuthenticationCancellation):
+        Use WorkerLoaderProxy instead of WorkerMessagingProxy for the MainThreadBridge.
+        Mostly rename.
+
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):
+        In addition to using WorkerLoaderProxy instead of WorkerMessagingProxy, the check for
+        AskedToTerminate is removed. It seems to be an optimization for a very small number of cases
+        when worker termination is requested a very short time before the request to load something
+        (XHR or importScript) was dispatched on the main thread.
+
+        * loader/WorkerThreadableLoader.h:
+        Now keeps a pointer to WorkerLoaderProxy rather then to a WorkerMessagingProxy. This allows
+        to implement WorkerThreadableLoader for Chromium.
+
+        * workers/WorkerLoaderProxy.h: Added.
+        (WebCore::WorkerLoaderProxy::~WorkerLoaderProxy):
+
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::startWorkerContext):
+        (WebCore::WorkerMessagingProxy::postTaskToLoader): Added ASSERT since this needs to be implemented for nested workers.
+        * workers/WorkerMessagingProxy.h:
+        Derived from WorkerLoaderProxy, the methods for posting tasks cross-thread are now virtual.
+        Removed unused postTaskToWorkerContext() method.
+
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::create):
+        (WebCore::WorkerThread::WorkerThread):
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::workerLoaderProxy):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::create):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::workerThread):
+        * workers/WorkerThread.h:
+        (WebCore::WorkerThread::workerLoaderProxy):
+        (WebCore::WorkerThread::workerObjectProxy):
+        WorkerThread gets a new member of type WorkerLoaderProxy&, and accessor.
+        Also, existing WorkerObjectProxy* member is now WorkerObjectProxy& because it can't be null.
+
+2009-06-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26238
+        Add parseDate helper to HTTPParsers, which uses WTF::parseDateFromNullTerminatedCharacters.
+
+        * ForwardingHeaders/runtime/DateMath.h: Removed.
+        * ForwardingHeaders/wtf/DateMath.h: Copied from WebCore/ForwardingHeaders/runtime/DateMath.h.
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::parseDate): Added.
+        * platform/network/HTTPParsers.h:
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::parseDateValueInHeader): Changed to use the new helper.
+
+2009-06-08  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Siedel.
+
+        Chromium Linux ignored the background color on <select>s. Rather
+        than encode magic colours, we start with a base color (specified
+        via CSS) and derive the other colors from it. Thus, setting the
+        CSS background-color now correctly changes the colour of the
+        control.
+
+        This should not change the appearence controls without
+        background-colors. However, <select>s with a background-color
+        will now renderer correctly, which may require rebaselining
+        pixel tests in the Chromium tree.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26030
+        http://code.google.com/p/chromium/issues/detail?id=12596
+
+        * platform/graphics/Color.cpp:
+        (WebCore::Color::getHSL): new member
+        * platform/graphics/Color.h:
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::systemColor):
+        (WebCore::brightenColor):
+        (WebCore::paintButtonLike):
+
+2009-06-08  Victor Wang <victorw@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26087
+        Bug 26087: Removing element in JS crashes Chrome tab if it fired the change event
+
+        Fix tab crash caused by destroying the popup list that fired the change event on abandon.
+
+        If a popup list is abandoned (press a key to jump to an item
+        and then use tab or mouse to get away from the select box),
+        the current code fires a change event in PopupListBox::updateFromElemt().
+        The JS that listens to this event may destroy the object and cause the
+        rest of popup list code crashes.
+
+        The updateFromElement() is called before abandon() and this causes
+        the selected index to be discarded after updateFromElement(). From
+        the code comments, this appears to be the reason why valueChanged is
+        called in updateFromElement.
+
+        Fix the issue by removing the valueChanged call in updateFromElement,
+        saving the selected index that we should accept on abandon and pass
+        it to the valueChange in abandon().
+
+        A manual test has been added.
+
+        * manual-tests/chromium: Added.
+        * manual-tests/chromium/onchange-reload-popup.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::PopupListBox):
+        (WebCore::PopupListBox::handleKeyEvent):
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::updateFromElement):
+
+2009-06-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Disable a few warnings on Windows
+
+        * WebCore.pro:
+
+2009-06-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Don't enable ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH on Windows
+        
+        This define was brought in after refactoring some code from
+        PluginPackage(Qt|Gtk).cpp into the shared PluginPackage.cpp.
+
+        * WebCore.pro:
+
+2009-06-08  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Use $QMAKE_PATH_SEP instead of hardcoded / to fix Windows build
+
+        * WebCore.pro:
+
+2009-06-08  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Build fix when NETSCAPE_PLUGIN_API support is turned off
+        https://bugs.webkit.org/show_bug.cgi?id=26244
+
+        * WebCore.pro: Define PLUGIN_PACKAGE_SIMPLE_HASH only if
+        NETSCAPE_PLUGIN_API is turned on
+        * plugins/PluginPackage.cpp: Guard initializeBrowserFuncs()
+        * plugins/PluginViewNone.cpp: Match guards with PluginView.h
+
+2009-06-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix <rdar://problem/6931661> -[WebView _selectionIsAll] returns YES
+          when the selection is inside a text field.
+
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::isAll): Return false if the selection is in
+        a shadow tree.
+
+2009-06-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26106
+        [GTK] Crashes when you keep a combo open during a page transition, then close it
+
+        Hide the combo popup and disconnect from its signals during
+        PopupMenu destruction to handle this exceptional case with no
+        crash.
+
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::~PopupMenu):
+        (WebCore::PopupMenu::menuUnmapped):
+
+2009-06-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6930540>
+        REGRESSION (r43797): Serif and fantasy font-family names are wrong in result of getComputedStyle
+
+        Test: fast/css/font-family-builtins.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::identifierForFamily): Fix typo. Fantasy family should be
+        -webkit-fantasy not, -webkit-serif.
+
+2009-06-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Fix for <rdar://problem/6936235>
+        Need to support StorageEvent.storageArea to meet the Web Storage spec
+
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::dispatchStorageEvent): Pass the localStorage for
+        the frame being dispatched to.
+        * storage/SessionStorageArea.cpp:
+        (WebCore::SessionStorageArea::dispatchStorageEvent): Ditto, only for sessionStorage.
+
+        * storage/StorageEvent.cpp:
+        (WebCore::StorageEvent::StorageEvent):
+        (WebCore::StorageEvent::initStorageEvent):
+        * storage/StorageEvent.h:
+        (WebCore::StorageEvent::create):
+        (WebCore::StorageEvent::storageArea):
+        * storage/StorageEvent.idl:
+        Add storageArea member.
+
+2009-06-05  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Anders Carlsson.
+
+        Fix WMLInputElement initialization code. Don't call initialize() on attach(), let
+        WMLCardElement handle initialization once, after the document has been parsed.
+
+        To keep layout tests working introduce a new function in Document.idl: initializeWMLPageState().
+        WMLTestCase.js (the wml/ layout test framework) will use it to simulate a regular WML document,
+        whose variable state gets initialized on WMLDocument::finishedParsing(). Force initialization
+        of the WML variable state, right after the dynamically created elements have been inserted into the tree.
+
+        * dom/Document.cpp:
+        (WebCore::Document::initializeWMLPageState):
+        * dom/Document.h:
+        * dom/Document.idl:
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded):
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::finishedParsing):
+        (WebCore::WMLDocument::initialize):
+        * wml/WMLDocument.h:
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::initialize):
+        * wml/WMLInputElement.h:
+
+2009-06-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add ononline and onoffline attributes for the <body> element. 
+
+        * html/HTMLAttributeNames.in: Added ononlineAttr and onofflineAttr.
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute): Map ononlineAttr
+        and onofflineAttr to window event listeners.
+
+2009-06-05  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add missing includes of config.h
+
+        * platform/qt/QWebPopup.cpp:
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+
+2009-06-05  Fumitoshi Ukai  <ukai@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26215
+        Try to fix the Chromium build.
+
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
+        (WebCore::fillBMPGlyphs):
+        (WebCore::fillNonBMPGlyphs):
+
+2009-06-05  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Bug 26160: Compile fails in MacOSX when GNU fileutils are installed
+
+        <https://bugs.webkit.org/show_bug.cgi?id=26160>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Use /bin/ln instead of ln for cases where this command is used with -h option.
+        As this option is not supported by GNU fileutils, this change helps users 
+        who have GNU fileutils in their PATH.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-06-03  Ben Murdoch  <benm@google.com>
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25710> HTML5 Database stops executing transactions if the URL hash changes while a transaction is open and an XHR is in progress.
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix a bug that causes database transactions to fail if a history navigation to a hash fragment of the same document is made while resources (e.g. an XHR) are loading
+
+        Test: storage/hash-change-with-xhr.html
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::stopLoading):
+        * loader/DocumentLoader.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::stopAllLoaders):
+        * loader/FrameLoader.h:
+        * loader/FrameLoaderTypes.h:
+        (WebCore::):
+        * page/Page.cpp:
+        (WebCore::Page::goToItem):
+        * WebCore.base.exp:
+
+2009-06-03  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make sure the correct config.h is included when shadowbuilding
+
+        * WebCore.pro:
+
+2009-06-05  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix Qt build after r44452
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-06-05  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Remove some dead code (MenuEventProxy)
+
+        * WebCore.pro:
+        * platform/ContextMenu.h:
+        * platform/qt/ContextMenuQt.cpp:
+        * platform/qt/MenuEventProxy.h: Removed.
+
+2009-06-05  Xan Lopez  <xlopez@igalia.com>
+
+        More build fixes.
+
+        * platform/graphics/gtk/GlyphPageTreeNodePango.cpp:
+        (WebCore::GlyphPage::fill):
+
+2009-06-05  Xan Lopez  <xlopez@igalia.com>
+
+        Fix the GTK+ build.
+
+        * GNUmakefile.am:
+        * platform/graphics/gtk/FontCacheGtk.cpp:
+        (WebCore::FontCache::getFontDataForCharacters):
+        * platform/graphics/gtk/GlyphPageTreeNodeGtk.cpp:
+        (WebCore::GlyphPage::fill):
+
+2009-06-05  Antti Koivisto  <antti@apple.com>
+
+        Try to fix Windows (and possibly other platforms) build.
+
+        Restore ResourceResponseBase::lastModifiedDate() and setLastModifiedDate() removed in previous commit.
+        for now since PluginStream used on some platforms expects them and calculations differ from plain 
+        Last-modified header value.
+        
+        Also include <wtf/MathExtras.h> to get isfinite().
+
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::adopt):
+        (WebCore::ResourceResponseBase::copyData):
+        (WebCore::ResourceResponseBase::setLastModifiedDate):
+        (WebCore::ResourceResponseBase::lastModifiedDate):
+        * platform/network/ResourceResponseBase.h:
+        * platform/network/cf/ResourceResponseCFNet.cpp:
+        (WebCore::ResourceResponse::platformLazyInit):
+
+2009-06-03  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=13128
+        Safari not obeying cache header
+        
+        Implement RFC 2616 cache expiration calculations in WebKit instead of
+        relying on the networking layer.
+
+        * ForwardingHeaders/runtime/DateMath.h: Added.
+        * WebCore.base.exp:
+        * loader/Cache.cpp:
+        (WebCore::Cache::revalidationSucceeded):
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::CachedResource):
+        (WebCore::CachedResource::isExpired):
+        (WebCore::CachedResource::currentAge):
+        (WebCore::CachedResource::freshnessLifetime):
+        (WebCore::CachedResource::setResponse):
+        (WebCore::CachedResource::updateResponseAfterRevalidation):
+        (WebCore::CachedResource::mustRevalidate):
+        * loader/CachedResource.h:
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::ResourceResponseBase):
+        (WebCore::ResourceResponseBase::adopt):
+        (WebCore::ResourceResponseBase::copyData):
+        (WebCore::ResourceResponseBase::setHTTPHeaderField):
+        (WebCore::ResourceResponseBase::parseCacheControlDirectives):
+        (WebCore::ResourceResponseBase::cacheControlContainsNoCache):
+        (WebCore::ResourceResponseBase::cacheControlContainsMustRevalidate):
+        (WebCore::ResourceResponseBase::cacheControlMaxAge):
+        (WebCore::parseDateValueInHeader):
+        (WebCore::ResourceResponseBase::date):
+        (WebCore::ResourceResponseBase::age):
+        (WebCore::ResourceResponseBase::expires):
+        (WebCore::ResourceResponseBase::lastModified):
+        (WebCore::ResourceResponseBase::isAttachment):
+        (WebCore::ResourceResponseBase::compare):
+        * platform/network/ResourceResponseBase.h:
+        * platform/network/cf/ResourceResponseCFNet.cpp:
+        (WebCore::ResourceResponse::platformLazyInit):
+        * platform/network/mac/ResourceResponseMac.mm:
+        (WebCore::ResourceResponse::platformLazyInit):
+
+2009-06-04  Roland Steiner <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 26201: Remove superfluous 'if' statements in RenderTable::addChild
+        https://bugs.webkit.org/show_bug.cgi?id=26201
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::addChild): remove superfluous 'if' statements
+       
+
+2009-06-04  Roland Steiner <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 26202: add macros for primitive values to simplify CSSStyleSelector::applyProperty
+        https://bugs.webkit.org/show_bug.cgi?id=26202
+
+        * css/CSSStyleSelector.cpp: add HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE[_WITH_VALUE] macros
+        (WebCore::CSSStyleSelector::applyProperty): use new macros
+
+2009-06-04  Roland Steiner <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel
+
+        Bug 26203: Move parsing of 'attr(X)' values to own method
+        https://bugs.webkit.org/show_bug.cgi?id=26203
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseAttr): new method
+        (WebCore::CSSParser::parseContent): use new parseAttr method
+        * css/CSSParser.h:
+        (WebCore::CSSParser::parseAttr): new method
+
+2009-06-04  Roland Steiner <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 26205: RenderTableSection::addChild : correct comment
+        https://bugs.webkit.org/show_bug.cgi?id=26205
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addChild): correct comment
+
+2009-06-04  Roland Steiner <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 26204: RenderBlock : simplify handleSpecialChild, comment correction
+        https://bugs.webkit.org/show_bug.cgi?id=26204
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleSpecialChild): simplify usage
+        (WebCore::RenderBlock::handlePositionedChild): simplify usage
+        (WebCore::RenderBlock::handleFloatingChild): simplify usage
+        (WebCore::RenderBlock::handleRunInChild): simplify usage
+        (WebCore::RenderBlock::layoutBlock): correct comment
+        (WebCore::RenderBlock::layoutBlockChildren): simplify loop, change call to handleSpecialChild
+        * rendering/RenderBlock.h: 
+        (WebCore::RenderBlock::handleSpecialChild): change signature
+        (WebCore::RenderBlock::handlePositionedChild): change signature
+        (WebCore::RenderBlock::handleFloatingChild): change signature
+        (WebCore::RenderBlock::handleRunInChild): change signature
+
+2009-06-04  Dan Bernstein  <mitz@apple.com>
+
+        - retry to fix the Tiger build
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::initFontData):
+
+2009-06-04  Dan Bernstein  <mitz@apple.com>
+
+        - try to fix the Tiger build
+
+        * platform/graphics/SimpleFontData.h:
+
+2009-06-04  Dan Bernstein  <mitz@apple.com>
+
+        - try to fix the Leopard and Tiger builds
+
+        * platform/graphics/SimpleFontData.h:
+
+2009-06-04  Dan Bernstein  <mitz@apple.com>
+
+        - try to fix the Windows build
+
+        * platform/graphics/win/UniscribeController.cpp:
+        (WebCore::UniscribeController::shapeAndPlaceItem):
+
+2009-06-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - make SimpleFontData's data members private
+        - rename SimpleFontData's m_font member to m_platformData
+
+        * platform/graphics/Font.h:
+        (WebCore::Font::spaceWidth):
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData):
+        * platform/graphics/SimpleFontData.h:
+        (WebCore::SimpleFontData::platformData):
+        (WebCore::SimpleFontData::spaceWidth):
+        (WebCore::SimpleFontData::adjustedSpaceWidth):
+        (WebCore::SimpleFontData::syntheticBoldOffset):
+        (WebCore::SimpleFontData::spaceGlyph):
+        (WebCore::SimpleFontData::getNSFont):
+        (WebCore::SimpleFontData::getQtFont):
+        (WebCore::SimpleFontData::getWxFont):
+        * platform/graphics/WidthIterator.cpp:
+        (WebCore::WidthIterator::advance):
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::smallCapsFontData):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::smallCapsFontData):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        * platform/graphics/gtk/FontGtk.cpp:
+        (WebCore::setPangoAttributes):
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        (WebCore::SimpleFontData::setFont):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        (WebCore::SimpleFontData::setFont):
+        * platform/graphics/mac/CoreTextController.cpp:
+        (WebCore::CoreTextController::adjustGlyphsAndAdvances):
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/mac/FontMacATSUI.mm:
+        (WebCore::initializeATSUStyle):
+        (WebCore::overrideLayoutOperation):
+        (WebCore::ATSULayoutParameters::initialize):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::initFontData):
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        (WebCore::SimpleFontData::smallCapsFontData):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        (WebCore::SimpleFontData::checkShapesArabic):
+        (WebCore::SimpleFontData::getCTFont):
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::drawGDIGlyphs):
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/win/SimpleFontDataCGWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformDestroy):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        (WebCore::SimpleFontData::setFont):
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+        (WebCore::SimpleFontData::initGDIFont):
+        (WebCore::SimpleFontData::smallCapsFontData):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::widthForGDIGlyph):
+        (WebCore::SimpleFontData::scriptFontProperties):
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+
+2009-06-04  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Initialize the width of PopupMenuListBox properly for Mac Chromium.
+
+        Added a test that works only with this patch applied. The test is
+        a manual one, since the hit testing infrastructure in the layout
+        tests sends keyboard and mouse events to the main window and not
+        the cocoa control that implements the popup up, which means we can't
+        select items from the popup up.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25904
+
+
+        * manual-tests/select-narrow-width.html: Added.
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::PopupListBox):
+        (WebCore::PopupContainer::showExternal):
+
+2009-06-04  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed Windows build correction.
+
+        * WebCore.vcproj/WebCore.vcproj: Add missing 'ReplaceNodeWithSpanCommand.cpp'
+          and 'ReplaceNodeWithSpanCommand.h'
+
+2009-02-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        Make sure execCommand("bold") on <b style="text-decoration: underline">test</b>
+        only removes the bold and not the underline.
+        https://bugs.webkit.org/show_bug.cgi?id=23496
+
+        Test: editing/execCommand/convert-style-elements-to-spans.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSStyleDeclaration.h:
+        (WebCore::CSSStyleDeclaration::isEmpty):
+        * dom/NamedAttrMap.h:
+        (WebCore::NamedAttrMap::isEmpty):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::isUnstyledStyleSpan):
+        (WebCore::isSpanWithoutAttributesOrUnstyleStyleSpan):
+        (WebCore::ApplyStyleCommand::applyBlockStyle):
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
+        (WebCore::ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle):
+        (WebCore::ApplyStyleCommand::replaceWithSpanOrRemoveIfWithoutAttributes):
+        (WebCore::ApplyStyleCommand::removeCSSStyle):
+        (WebCore::ApplyStyleCommand::applyTextDecorationStyle):
+        (WebCore::ApplyStyleCommand::removeInlineStyle):
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded):
+        * editing/ApplyStyleCommand.h:
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::replaceNodeWithSpanPreservingChildrenAndAttributes):
+        * editing/CompositeEditCommand.h:
+        * editing/RemoveNodePreservingChildrenCommand.cpp:
+        (WebCore::RemoveNodePreservingChildrenCommand::RemoveNodePreservingChildrenCommand):
+        * editing/ReplaceNodeWithSpanCommand.cpp: Added.
+        (WebCore::ReplaceNodeWithSpanCommand::ReplaceNodeWithSpanCommand):
+        (WebCore::swapInNodePreservingAttributesAndChildren):
+        (WebCore::ReplaceNodeWithSpanCommand::doApply):
+        (WebCore::ReplaceNodeWithSpanCommand::doUnapply):
+        * editing/ReplaceNodeWithSpanCommand.h: Added.
+        (WebCore::ReplaceNodeWithSpanCommand::create):
+
+2009-06-04  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix for Windows Cairo target.
+
+        Add missing post-build command to copy history/cf contents
+        to output directory.
+
+        * WebCore.vcproj/WebCore.vcproj: Update Debug_Cairo and Release_Cairo
+          target post-build steps with copy commands.
+
+2009-06-04  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6854695> Movie controller thumb fails to scale with full page zoom
+        
+        Account for zoom level when drawing media controller thumb on Windows.
+
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::adjustMediaSliderThumbSize):
+
+2009-06-04  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Move DOM window focus/blur out of SelectionController and into FocusController.  Make sure it
+        fires on the focused frame when the page activation state changes also.  This is covered by an existing
+        layout test (albeit badly).  I have modified the test to be correct.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setFocused):
+        * page/FocusController.cpp:
+        (WebCore::FocusController::setFocusedFrame):
+        (WebCore::FocusController::setActive):
+
+2009-06-04  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26148
+        Adding in empty files to stage the extract of RenderThemeChromiumSkia
+        from RenderThemeChromiumLinux and RenderThemeChromiumWindows.
+
+        * rendering/RenderThemeChromiumSkia.cpp: Added.
+        * rendering/RenderThemeChromiumSkia.h: Added.
+
+2009-06-04  Andrei Popescu <andreip@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25562
+        Potential crash after ApplicationCacheStorage::storeNewestCache() fails
+
+              Fix the crash by checking the return value of cacheStorage().storeNewestCache(this)
+              in WebCore::ApplicationCacheGroup::checkIfLoadIsComplete. If storeNewestCache failed,
+              we run the cache failure steps:
+
+        1. Fire the error events to all pending master entries, as well any other cache hosts
+           currently associated with a cache in this group.
+        2. Disassociate the pending master entries from the failed new cache.
+        3. Reinstate the old "newest cache", if there was one.
+
+        We also introduce two other changes:
+
+        1. a mechanism to rollback storageID changes to the in-memory resource
+           objects when the storing of an ApplicationCache object fails.
+
+        2. defer removing the pending master entries from the list of pending master entries
+           until the entire load is complete. This matches the HTML 5 spec better. To track
+           if the load is complete we now introduce a counter for those pending master entries
+           that haven't yet finshed downloading.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::ApplicationCacheGroup): initializes the new counter to 0
+        (WebCore::ApplicationCacheGroup::selectCache): increments the counter when a new pending
+        master entry is added.
+        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource): decrements the counter
+        instead of removing the pending master entry.
+        (WebCore::ApplicationCacheGroup::failedLoadingMainResource): decrements the counter
+        instead of removing the pending master entry.
+        (WebCore::ApplicationCacheGroup::setNewestCache): removes an assertion that no longer
+        holds true. In particular, the newest cache is not necessarily new anymore. We can
+        set an old cache as the new cache. This can happen if we failed to store a newly
+        downloaded cache to the database and we are now reinstating the former newest cache.
+        (WebCore::ApplicationCacheGroup::manifestNotFound): resets the counter to 0.
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete): check if the loading is complete
+        based on the counter instead of the list of pending master entries. Empty the list of
+        master entries if the load is complete.
+        * loader/appcache/ApplicationCacheGroup.h: add the new counter.
+        * loader/appcache/ApplicationCacheStorage.cpp: introduce the journaling mechanism for
+        in-memory resource objects.
+        (WebCore::ResourceStorageIDJournal::~ResourceStorageIDJournal):
+        (WebCore::ResourceStorageIDJournal::add):
+        (WebCore::ResourceStorageIDJournal::commit):
+        (WebCore::ResourceStorageIDJournal::Record::Record):
+        (WebCore::ResourceStorageIDJournal::Record::restore):
+        (WebCore::ApplicationCacheStorage::store): log the changes to the in-memory resource
+        objects.
+        (WebCore::ApplicationCacheStorage::storeNewestCache): create the journal object.
+        * loader/appcache/ApplicationCacheStorage.h:  modify the signature of
+        bool store(ApplicationCache*) to add a pointer to the logger object used to
+        trace the changes to the storageID of the resource objects.
+
+2009-06-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26154
+        Allow underscores in the hostnames we parse out of databaseIdentifiers.
+        This code is used for HTML 5 database support.
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::createFromDatabaseIdentifier):
+
+2009-06-04  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 26084: Multiple missing images in webkit-mask-image prevent rendering
+        https://bugs.webkit.org/show_bug.cgi?id=26084
+
+        When painting multiple images, make sure that at least one image is valid before pushing a transparency layer.
+
+        Added a manual test.
+
+        * manual-tests/mask-composite-missing-images.html: Added.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintMaskImages):
+
+2009-06-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26180
+        Add a fast path for SecurityOrigin::equal. If "other == this" (where
+        other is the other security origin), then we really don't need to do
+        all the other (expensive) comparisons. We know it's equal.
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::equal):
+
+2009-06-03  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Improvements in how selection behaves with focus/activation and a reversion back to using isActive
+        in the scrollbar theme code to remove a Chromium ifdef.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::SelectionController):
+        Make the controller set its focused state correctly upon initial creation.
+
+        (WebCore::SelectionController::setSelection):
+        Make selection willing to shift the focus node if the selection is focused even if the
+        selection is not active.  Whether or not the Page is active is irrelevant to focus changes.
+
+        (WebCore::SelectionController::setFocused):
+        * editing/SelectionController.h:
+        (WebCore::SelectionController::isFocused):
+        Add a new isFocused() method so that code can check if the Selection is focused without caring
+        about the active state.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setFocusedNodeIfNeeded):
+        Allow focus shifts even when the selection is not active.
+
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint):
+        Revert Dan's change to directly talk to AppKit for checking active state.  Now that the WebCore isActive
+        method works, ditch the Chromium-specific #ifdef and go back to the original code.
+
+2009-06-04  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Test: media/before-load-member-access.html
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26081
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::played): Ensure that if m_playedTimeRanges,
+        is not initialized we return a valid range, and don't attempt to use it.
+
+2009-06-03  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Implement a way to invalidate the FontCache used by the Qt port.
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::invalidate):
+
+2009-06-04  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26015
+
+        [Qt] Single-threaded QtWebKit configuration
+
+        Turn off Database, DOM storage, icon database and Web Workers support
+        when ENABLE_SINGLE_THREADED is turned on.
+
+        Set SQLITE_THREADSAFE to false to turn off SQLite mutexes
+        when ENABLE_SINGLE_THREADED is turned on.
+
+        * WebCore.pro:
+
+2009-06-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - add some assertions that Font methods are used on the main thread
+
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::setShouldUseSmoothing):
+        * platform/graphics/Font.h:
+        (WebCore::Font::primaryFont):
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter):
+
+2009-06-03  Dan Bernstein  <mitz@apple.com>
+
+        - Windows build fix
+
+        Rolled out apparently-accidental changes to config.h from r44398. These
+        were not part of the patch as reviewed.
+
+        * config.h:
+
+2009-06-03  Dmitry Titov  <dimich@chromium.org>
+
+        Not reviewed, Chromium build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26177
+        Reverting 'private' to 'protected' on 2 classes.
+        Chromium glue layer (not yet in Webkit tree) relies on ability to derive
+        Chromium-specific platform classes and access the data members.
+        See bug for more details.
+
+        * platform/PlatformMouseEvent.h:
+        * platform/PlatformWheelEvent.h:
+
+2009-06-03  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser <simonfr@apple.com>.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=26162
+
+        This corrects an error when destroying an animation
+        or transition where endAnimation was never getting
+        called and therefore the hardware animation was never
+        getting removed.
+
+        This includes a manual-test since it's really impossible
+        to make a meaningful automatic test for an animation
+        bug like this.
+
+        This has no effect unless accelerated compositing is 
+        enabled.
+
+        * manual-tests/interrupted-compound-transform.html: Added.
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::~ImplicitAnimation):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::~KeyframeAnimation):
+
+2009-06-03  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Make the scrollbar thumb size twice the width for Chromium Linux. This
+        matches Firefox on Linux.
+
+        This will need layout test pixel results to be rebaselined in the
+        Chromium tree.
+
+        http://code.google.com/p/chromium/issues/detail?id=12602
+        https://bugs.webkit.org/show_bug.cgi?id=26176
+
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromiumLinux::minimumThumbLength):
+        * platform/chromium/ScrollbarThemeChromiumLinux.h:
+
+2009-06-03  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Change Chromium scrollbar theme code to use different classes on
+        Windows and Linux rather than suppling symbols. The ScrollbarTheme
+        class is already using virtual dispatch, so there's no reason not to.
+
+        This should not affect any layout tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26174
+
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        * platform/chromium/ScrollbarThemeChromium.h:
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeChromiumLinux::scrollbarThickness):
+        (WebCore::ScrollbarThemeChromiumLinux::paintTrackPiece):
+        (WebCore::ScrollbarThemeChromiumLinux::paintButton):
+        (WebCore::ScrollbarThemeChromiumLinux::paintThumb):
+        (WebCore::ScrollbarThemeChromiumLinux::buttonSize):
+        * platform/chromium/ScrollbarThemeChromiumLinux.h: Added.
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeChromiumWin::scrollbarThickness):
+        (WebCore::ScrollbarThemeChromiumWin::invalidateOnMouseEnterExit):
+        (WebCore::ScrollbarThemeChromiumWin::shouldSnapBackToDragOrigin):
+        (WebCore::ScrollbarThemeChromiumWin::paintTrackPiece):
+        (WebCore::ScrollbarThemeChromiumWin::paintButton):
+        (WebCore::ScrollbarThemeChromiumWin::paintThumb):
+        (WebCore::ScrollbarThemeChromiumWin::getThemeState):
+        (WebCore::ScrollbarThemeChromiumWin::getThemeArrowState):
+        (WebCore::ScrollbarThemeChromiumWin::getClassicThemeState):
+        (WebCore::ScrollbarThemeChromiumWin::buttonSize):
+        * platform/chromium/ScrollbarThemeChromiumWin.h: Added.
+
+2009-06-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Enabling debugger requires that Scripts panel is already attached to the
+        render tree. The reason is that recompile events result in script sources
+        being added into the source frames. Prior to the global options introduced,
+        debugger was enabled from the Scripts panel, so that it was guaranteed to
+        exist. The InspectorController::enableDebugger API calls with no inspector
+        frontend showing were failing though.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26145
+
+        * WebCore.base.exp:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::enableDebuggerFromFrontend):
+        (WebCore::InspectorController::enableDebugger):
+        * inspector/InspectorController.h:
+        * inspector/InspectorController.idl:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::attachDebuggerWhenShown):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.show):
+        (WebInspector.ScriptsPanel.prototype.attachDebuggerWhenShown):
+        * inspector/front-end/inspector.js:
+        (WebInspector.attachDebuggerWhenShown):
+
+2009-06-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        - fix a regression from the previous patch
+
+        * platform/graphics/Font.cpp: Initialize shouldUseFontSmoothing to true.
+
+2009-06-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        - eliminate WebCoreTextRenderer
+
+        * WebCore.base.exp: Updated.
+        * WebCore.xcodeproj/project.pbxproj: Removed WebCoreTextRenderer.{h,mm}
+            and promoted WebFontCache.h to private.
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::setShouldUseSmoothing): Added this static setter for
+            a new file-static boolean.
+        (WebCore::Font::shouldUseSmoothing): Added this static getter.
+        * platform/graphics/Font.h: Decleared setShouldUseSmoothing() and
+            shouldUseSmoothing().
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::drawGlyphs): Use Font::shouldUseSmoothing() instead of
+        WebCoreShouldUseFontSmoothing().
+        * platform/graphics/mac/WebLayer.mm: Removed unneeded #import.
+        * platform/mac/WebCoreTextRenderer.h: Removed.
+        * platform/mac/WebCoreTextRenderer.mm: Removed.
+
+2009-06-03  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        v8's ScriptController::evaluate should protect the Frame like the jsc version.
+        https://bugs.webkit.org/show_bug.cgi?id=26172
+
+        This change is simply copying protections done for Frame in the method
+        WebCore::ScriptController::evaluate in the file js/ScriptController.cpp.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+
+2009-06-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - fix <rdar://problem/6841120> Use CTFontManager notifications instead
+          of ATS notifications
+
+        * platform/graphics/FontCache.h: Made it an error to destroy a
+        FontCache instance.
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore::fontCacheRegisteredFontsChangedNotificationCallback): Added
+        this notification callback for the
+        kCTFontManagerRegisteredFontsChangedNotification, which calls
+        invalidate().
+        (WebCore::FontCache::platformInit): Register for
+        kCTFontManagerRegisteredFontsChangedNotification.
+
+2009-06-03  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Use CGContextShowGlyphsWithAdvances to get more accurate text rendering on Mac.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26161
+
+        * platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+
+2009-06-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Reorder ResourcesPanel components initialization to unfreeze resource list scroller.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26159
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+
+2009-06-03  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        - Fix for crash (preceded by assertion) in InspectorController::didCommitLoad
+          when reloading or navigating with the Inspector open.
+        - Fix for Inspector's Elements panel being empty when Inspector first appears.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26134
+        https://bugs.webkit.org/show_bug.cgi?id=26135
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::ensureResourceTrackingSettingsLoaded):
+        * inspector/InspectorController.h:
+
+2009-06-03  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r44379
+
+        * svg/graphics/SVGImage.cpp: Move EmptyClients.h back down below the
+        other #includes to fix a compiler warning on Windows.
+
+2009-06-02  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add workaround for crash in Linux Flash Player when hosted by
+        another toolkit than GTK+. Bug fixed at the Flash Player bugzilla,
+        issue (FP-2140).
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2009-06-01  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Refactor the Qt plugin code to use NPP_SetWindow correctly,
+        to make resizing of plugins work.
+
+        Attention was paid to make sure that the windowed plugins scroll
+        synchronized with the page view. A manual test has been added.
+
+        * manual-tests/qt/plugin-iframe.html: Added.
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect):
+        (WebCore::PluginView::frameRectsChanged):
+        * plugins/PluginView.h:
+        * plugins/qt/PluginContainerQt.cpp:
+        (PluginContainerQt::PluginContainerQt):
+        * plugins/qt/PluginContainerQt.h:
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::load):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::setParent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::handlePostReadFile):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::init):
+
+2009-06-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Bug 26112: viewless WebKit -- make events work
+        https://bugs.webkit.org/show_bug.cgi?id=26112
+
+        The main fix here is to make mouse and wheel event coordinates in the coordinate
+        system of the top level NSView rather than the NSWindow when in the viewless mode.
+        This is the design Hyatt chose, but the event part of it wasn't done yet.
+
+        Also fix FrameView to do normal reference counting instead of a strange model with
+        an explicit deref near creation time.
+
+        * WebCore.base.exp: Updated.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::eventLoopHandleMouseUp): Moved this function into the file
+        to reduce conditionals in the header.
+        (WebCore::EventHandler::eventLoopHandleMouseDragged): Ditto.
+
+        * page/EventHandler.h: Reduced includes. Fixed formatting of Objective-C types.
+        Made currentNSEvent a static member function. Added sendContextMenuEvent and
+        eventMayStartDrag functions that takes NSEvent * so the conversion to PlatformMouseEvent
+        can be done here rather than in WebKit. Reduced #if by making eventLoopHandleMouseUp and
+        eventLoopHandleMouseDragged unconditional.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setView): Made this take a PassRefPtr since it takes ownership.
+        (WebCore::Frame::createView): Changed to use RefPtr and FrameView::create and remove
+        the explicit deref.
+
+        * page/Frame.h: Changed setView to take a PassRefPtr.
+
+        * page/FrameTree.cpp: Added newly-needed include.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView): Got rid of one of the two constructors, and removed
+        the initialization of m_refCount and call to show from the reamining one.
+        (WebCore::FrameView::create): Added two create functions that do what the two
+        constructors did before, except that they return a PassRefPtr to make sure the
+        reference counting is handled correctly.
+        (WebCore::FrameView::~FrameView): Removed assertion from when FrameView implemented
+        its own reference counting.
+
+        * page/FrameView.h: Inherit from RefCounted for reference counting. Made the
+        constructor private and added create functions. Got rid of the hand-implemented
+        reference counting in this class.
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::currentNSEventSlot): Renamed currentEvent to currentNSEventSlot to
+        make it more clear how it relates to currentNSEvent.
+        (WebCore::EventHandler::currentNSEvent): Updated.
+        (WebCore::CurrentEventScope::CurrentEventScope): Added. Use to set/reset the
+        current event in a foolproof way.
+        (WebCore::CurrentEventScope::~CurrentEventScope): Ditto.
+        (WebCore::EventHandler::wheelEvent): Use CurrentEventScope. Pass the platform
+        window in when constructing the PlatformWheelEvent.
+        (WebCore::EventHandler::keyEvent): Use CurrentEventScope.
+        (WebCore::lastEventIsMouseUp): Use currentNSEvent.
+        (WebCore::EventHandler::passMouseDownEventToWidget): Ditto.
+        (WebCore::EventHandler::eventLoopHandleMouseDragged): Ditto.
+        (WebCore::EventHandler::eventLoopHandleMouseUp): Ditto.
+        (WebCore::EventHandler::passSubframeEventToSubframe): Use
+        currentPlatformMouseEvent to get a mouse event that has the appropriate
+        platform window passed to create it.
+        (WebCore::EventHandler::passWheelEventToWidget): Ditto.
+        (WebCore::EventHandler::mouseDown): Ditto.
+        (WebCore::EventHandler::mouseDragged): Ditto.
+        (WebCore::EventHandler::mouseUp): Ditto.
+        (WebCore::EventHandler::mouseMoved): Ditto.
+        (WebCore::EventHandler::currentPlatformMouseEvent): Added. Passes the
+        platform window that's now needed to create a PlatformMouseEvent.
+        (WebCore::EventHandler::sendContextMenuEvent): Added.
+        (WebCore::EventHandler::eventMayStartDrag): Added.
+
+        * platform/HostWindow.h: Removed unneeded includes and constructor definition.
+
+        * platform/PlatformMouseEvent.h: Sorted things in alphabetical order.
+        Changed Mac constructor to take a windowView as well as the event. This is
+        needed in viewless mode, since the "window" is actually an NSView, so the
+        event has to know which view to compute the coordinates with. Made the
+        same change to pointForEvent.
+        * platform/PlatformWheelEvent.h: Ditto.
+
+        * platform/mac/PlatformMouseEventMac.mm:
+        (WebCore::pointForEvent): Convert point from window coordinates to view
+        coordinates if a windowView is passed in. This is used in viewless mode.
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent): Ditto.
+        * platform/mac/WheelEventMac.mm:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent): Ditto.
+
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::convertFromContainingWindow): Fixed case where there
+        is no platform widget and no parent. Before it would yield unpredictable
+        results because of dispatching to a nil object and returning a structure.
+        Now it returns the point without changing coordinates at all, which is what
+        we need for this case in viewless mode.
+
+        * rendering/RenderApplet.cpp: Removed unneeded includes.
+        (WebCore::RenderApplet::intrinsicSize): Use widget function.
+        (WebCore::RenderApplet::createWidgetIfNecessary): Ditto.
+
+        * rendering/RenderApplet.h: Make more things private. Get rid of unneeded
+        explicit destructor.
+
+        * rendering/RenderFrame.cpp: Removed unneeded includes.
+        (WebCore::RenderFrame::edgeInfo): Updated to use node function so header
+        doesn't have to define element function.
+        (WebCore::RenderFrame::viewCleared): Ditto. Also changed to use widget
+        function.
+
+        * rendering/RenderFrame.h: Removed unneeded includes. Made some things
+        private. Got rid of element function.
+
+        * rendering/RenderPart.cpp: Removed unneeded includes.
+        (WebCore::RenderPart::~RenderPart): Changed to use clearWidget function.
+        (WebCore::RenderPart::setWidget): Changed to use widget function.
+        (WebCore::RenderPart::deleteWidget): Changed to use passed-in widget.
+        This is now only called by the clearWidget function.
+
+        * rendering/RenderPart.h: Removed unneeded forward declarations.
+        Made more functions private. Updated deleteWidget to take widget argument.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::~RenderPartObject): use frameView function
+        instead of getting at m_view directly.
+        (WebCore::RenderPartObject::updateWidget): Ditto.
+        (WebCore::RenderPartObject::layout): Ditto. Same for widget and m_widget.
+        (WebCore::RenderPartObject::viewCleared): Ditto.
+
+        * rendering/RenderPartObject.h: Made some functions private.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::RenderWidget): Initialize m_frameView with
+        construction syntax instead of assignment.
+        (WebCore::RenderWidget::destroy): Updated for name change of m_view
+        to m_frameView.
+        (WebCore::RenderWidget::~RenderWidget): Use clearWidget to delete
+        the widget.
+        (WebCore::RenderWidget::setWidget): Use clearWidget.
+        (WebCore::RenderWidget::paint): Updated for name change of m_view
+        to m_frameView.
+        (WebCore::RenderWidget::deleteWidget): Changed to use passed-in widget.
+
+        * rendering/RenderWidget.h: Made many functions protected, others
+        private and made all data members private.
+
+        * svg/animation/SMILTime.h: Removed unhelpful max and min functions. These
+        just do what std::max and std::min will already do automatically for this
+        type, so they are not helpful.
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::SVGImage): Removed unneeded initial values for types
+        that initialize to zero without anything explicit.
+        (WebCore::SVGImage::~SVGImage): Update since m_frame and m_frameView are
+        no longer stored.
+        (WebCore::SVGImage::setContainerSize): Ditto.
+        (WebCore::SVGImage::usesContainerSize): Ditto.
+        (WebCore::SVGImage::size): Ditto.
+        (WebCore::SVGImage::hasRelativeWidth): Ditto.
+        (WebCore::SVGImage::hasRelativeHeight): Ditto.
+        (WebCore::SVGImage::draw): Ditto.
+        (WebCore::SVGImage::nativeImageForCurrentFrame): Ditto.
+        (WebCore::SVGImage::dataChanged): Ditto.
+
+        * svg/graphics/SVGImage.h: Removed unneeded includes and unneeded data
+        members m_document, m_frame, m_frameView, and m_minSize.
+
+2009-06-02  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        The previous code was assuming that we'll be painting buttons on the scrollbar
+        which isn't true on Linux. To reproduce, resize a page with scrollbars until
+        they are less than two widths high.
+
+        This will need pixel test baselines to be updated in the Chromium tree.
+
+        * platform/chromium/ScrollbarThemeChromium.cpp: move this function...
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        (WebCore::ScrollbarThemeChromium::trackRect): ... to here
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromium::trackRect): add an alternative which
+        doesn't remove the track when the scrollbar is less than two widths
+        high.
+
+2009-06-02  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Remove workaround that was added to address <rdar://problem/5488678> as it no longer affects our Tiger builds.
+
+        * Configurations/Base.xcconfig:
+
+2009-06-02  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Insert*List on an stand-alone image in a content editable region ASSERTS
+        ASSERTION FAILED: isStartOfParagraph(startOfParagraphToMove)
+        https://bugs.webkit.org/show_bug.cgi?id=19066
+
+        Attempt to fix this by noticing that we inserted the list inside
+        the selection which includes the image, and re-adjust the selection
+        to not include the list before trying to move the image into
+        the list item.
+        
+        Test: editing/execCommand/list-wrapping-image-crash.html
+
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::doApply):
+
+2009-06-02  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Rename PositionIterator members in hope of further clarity
+        https://bugs.webkit.org/show_bug.cgi?id=24854
+
+        Rename m_parent to m_anchorNode (since although it's always the parent
+        of the previous m_child member, it is not always the parent of the effective position)
+        Rename m_child to m_nodeAfterPositionInAnchor to make clear that it's the node
+        directly following the position.  This member is often NULL, but is always
+        a child of m_parent, now m_anchorNode if set.
+        Rename m_offset to m_offsetInAnchor (since it's interpreted relative to m_anchorNode)
+
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::operator Position):
+        (WebCore::PositionIterator::increment):
+        (WebCore::PositionIterator::decrement):
+        (WebCore::PositionIterator::atStart):
+        (WebCore::PositionIterator::atEnd):
+        (WebCore::PositionIterator::atStartOfNode):
+        (WebCore::PositionIterator::atEndOfNode):
+        (WebCore::PositionIterator::isCandidate):
+        * dom/PositionIterator.h:
+        (WebCore::PositionIterator::PositionIterator):
+        (WebCore::PositionIterator::node):
+        (WebCore::PositionIterator::offsetInLeafNode):
+
+2009-06-02  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 17167: Failures in fast/dom/Node/initial-values.html
+
+        This partly solve a compatibility issue with other browsers. It will also
+        make us more consistent while handling XHTML element.
+
+        The issue is that when we create an XHTML element inside an HTML document
+        (as it is the case when calling createElementNS), we default to the HTML
+        behaviour in nodeName. As we cannot test if an HTMLElement is an XHTML
+        element, our fix is to check whether it has a prefix and then default
+        to XML behaviour for nodeName.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::nodeName): Add a prefix check before
+        returning the uppercase tagName (HTML behaviour).
+
+2009-06-02  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add a compareBoundaryPoints which takes RangeBoundaryPoints
+        https://bugs.webkit.org/show_bug.cgi?id=25500
+
+        I noticed the need for this function when removing compareBoundaryPoints(Position, Position)
+        This patch is almost entirely minus lines.
+
+        No functional changes, thus no tests.
+
+        * dom/Range.cpp:
+        (WebCore::Range::setStart):
+        (WebCore::Range::setEnd):
+        (WebCore::Range::compareBoundaryPoints):
+        (WebCore::Range::boundaryPointsValid):
+        * dom/Range.h:
+
+2009-06-02  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove Range::compareBoundaryPoints(Position, Position) per Darin's suggestion in bug 25056
+        https://bugs.webkit.org/show_bug.cgi?id=25500
+
+        Darin indicated the Range should deal only with primitive DOM node/offset
+        pairs, and that Position (which is a more robust editing construct) should have
+        its own comparison functions and that Range.h should not mention Position at all.
+
+        Turns out that Position already has a comparePositions() function (which knows
+        how to additionally handled positions in shadow trees).  So I've just changed
+        all callers of compareBoundaryPoints(Position, Position) to use the existing
+        comparePositions() function.  I've also added a comparePositions which takes
+        VisiblePositions for convenience.
+
+        * dom/Range.cpp:
+        * dom/Range.h:
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::updateStartEnd):
+        (WebCore::ApplyStyleCommand::applyBlockStyle):
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
+        (WebCore::ApplyStyleCommand::applyInlineStyle):
+        (WebCore::ApplyStyleCommand::applyInlineStyleToRange):
+        (WebCore::ApplyStyleCommand::removeInlineStyle):
+        (WebCore::ApplyStyleCommand::nodeFullySelected):
+        (WebCore::ApplyStyleCommand::nodeFullyUnselected):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::deleteInsignificantText):
+        (WebCore::CompositeEditCommand::moveParagraphContentsToNewBlockIfNecessary):
+        (WebCore::CompositeEditCommand::moveParagraphs):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::initializeStartEnd):
+        (WebCore::DeleteSelectionCommand::handleGeneralDelete):
+        (WebCore::DeleteSelectionCommand::mergeParagraphs):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::nodeWillBeRemoved):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::toNormalizedRange):
+        * editing/htmlediting.cpp:
+        (WebCore::comparePositions):
+        * editing/htmlediting.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+
+2009-06-02  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26122
+        Upstream v8_utility.h functions into V8Utilities.h.  This patch has
+        some transitional code to make upstreaming easier.  This code will
+        be deleted in a few days.
+
+        * bindings/v8/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::construct): NewInstance -> newInstance.
+        * bindings/v8/V8Utilities.h:
+        (WebCore::AllowAllocation::AllowAllocation): Function added.
+        (WebCore::AllowAllocation::~AllowAllocation): Function added.
+        (WebCore::SafeAllocation::NewInstance): Function added.
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        NewInstance -> newInstance.
+        (WebCore::WorkerContextExecutionProxy::toV8): NewInstance ->
+        newInstance.
+
+2009-06-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - fix <rdar://problem/6940747> Search field’s focus ring is outset
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::adjustSearchFieldStyle): Set the focused
+        search field outline offset to -2.
+
+2009-06-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add list of unimplemented event handlers to DOMWindow.
+
+        * page/DOMWindow.idl:
+
+2009-06-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26133
+        Adapt and import py-dom-xpath tests
+
+        Tests: fast/xpath/py-dom-xpath/abbreviations.html
+               fast/xpath/py-dom-xpath/axes.html
+               fast/xpath/py-dom-xpath/data.html
+               fast/xpath/py-dom-xpath/expressions.html
+               fast/xpath/py-dom-xpath/functions.html
+               fast/xpath/py-dom-xpath/nodetests.html
+               fast/xpath/py-dom-xpath/paths.html
+               fast/xpath/py-dom-xpath/predicates.html
+
+        Fix bugs found with this test suite:
+        - name and local-name were incorrect for processing instructions (XPath expanded-name
+        doesn't match DOM exactly);
+        - name, local-name and namespace functions should crash on attribute nodes;
+        - attemps to make node sets from other types were not detected as errors.
+
+        No performance impact.
+
+        * xml/XPathExpressionNode.h: Track type conversion errors that happen during evaluation.
+        An error won't stop evaluation, but an exception will be raised afterwards. We could also
+        detect conversion errors at compile time, but not if we're going to support XPath variables
+        (which is unnecessary for XPathEvaluator, but will be necessary if we decide to make our own
+        XSLT one day).
+
+        * xml/XPathExpression.cpp: (WebCore::XPathExpression::evaluate): Check whether a type
+        conversion exception occurred during evaluation, and raise an excpetion if it did.
+
+        * xml/XPathFunctions.cpp:
+        (WebCore::XPath::expandedNameLocalPart):
+        (WebCore::XPath::expandedName):
+        XPath name(), local-name() and namespace-uri() functions are defined in terms of expanded-name,
+        which doesn't match anything available via DOM exactly. Calculate the expanded name properly.
+        (WebCore::XPath::FunNamespaceURI::evaluate): This function could crash if used with an
+        attribute node, because it released what was possibly the only reference to attribute node
+        before using it. Changed the function to avoid such situation.
+        (WebCore::XPath::FunLocalName::evaluate): Ditto. Also, used the new expandedNameLocalPart()
+        to work properly with processing instruction nodes.
+        (WebCore::XPath::FunName::evaluate): Ditto (using expandedName()).
+        (WebCore::XPath::FunCount::evaluate): Signal an error if the argument is not a node-set
+        (by using toNodeSet unconditionally, which will raise an error, and return an empty set).
+
+        * xml/XPathPath.cpp: (WebCore::XPath::Filter::evaluate): Signal an error if the expression
+        evaluation result is not a node-set.
+
+        * xml/XPathPath.h: (WebCore::XPath::Filter::resultType): A Filter's result is actually
+        always a node-set (this is not so for FilterExpr production in the spec, but is for us,
+        because we don't naively map BNF productions to classes).
+
+        * xml/XPathPredicate.cpp: (WebCore::XPath::Union::evaluate): Signal an error if either side
+        is not a node-set.
+
+        * xml/XPathStep.cpp: Removed an unnecesary include.
+
+        * xml/XPathValue.cpp:
+        (WebCore::XPath::Value::toNodeSet): Signal an error if conversion fails.
+        (WebCore::XPath::Value::modifiableNodeSet): Ditto.
+        (WebCore::XPath::Value::toNumber): Don't allow inputs that don't match XPath Number production
+        (in particular, those using exponential notation).
+
+2009-06-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Part of https://bugs.webkit.org/show_bug.cgi?id=26100
+        Add missing event handler properties to the DOMWindow
+
+        Added oncontextmenu, oninput, and onmessage event handlers to
+        the DOMWindow. Aditionally, the onloadstart, onprogress, onstalled,
+        and onsuspend event handlers were implemented but not added to
+        DOMWindow.idl.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::oninput):
+        (WebCore::DOMWindow::setOninput):
+        (WebCore::DOMWindow::onmessage):
+        (WebCore::DOMWindow::setOnmessage):
+        (WebCore::DOMWindow::oncontextmenu):
+        (WebCore::DOMWindow::setOncontextmenu):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-06-01  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.  Landed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26123
+
+        Remove a redundant checkEncodedString call when constructing a
+        KURL object from a string.
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::KURL):
+
+2009-06-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Reposition platform guard, improperly placed by http://trac.webkit.org/changeset/44340
+        Bad Dimitri.
+
+        * platform/KeyboardCodes.h: Repositioned the guard to avoid nested
+            WebCore namespace declarations.
+
+2009-06-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        * platform/KeyboardCodes.h: Integrated contents of platform/chromium/KeyboardCodes.h
+            with a stern FIXME.
+        * platform/chromium/KeyboardCodes.h: Removed.
+
+2009-06-01  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix assertion error in --filters enabled debug builds.
+        Instead of using RefPtr<AtomicStringImpl> as keys for the hash maps in SVGFilterBuilder, just use AtomicString objects.
+
+        * svg/graphics/filters/SVGFilterBuilder.cpp:
+        (WebCore::SVGFilterBuilder::SVGFilterBuilder):
+        (WebCore::SVGFilterBuilder::add):
+        (WebCore::SVGFilterBuilder::getEffectById):
+        * svg/graphics/filters/SVGFilterBuilder.h:
+
+2009-06-01  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix --filters enabled build on Mac.
+        Remove unnecessary 'boundingBox' parameter from finishRenderSVGContent() method.
+        Kill several warnings, to make build pass.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paint):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::finishRenderSVGContent):
+        * rendering/SVGRenderSupport.h:
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkEndCallback):
+        * svg/SVGFEGaussianBlurElement.cpp:
+        (WebCore::SVGFEGaussianBlurElement::setStdDeviation):
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::FEFlood):
+
+2009-06-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Fix Chromium build by adding an #ifdef, restoring the code path to that
+        before http://trac.webkit.org/changeset/44287.
+
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint): Added an #ifdef.
+
+2009-06-01  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Remove last pieces of the old SVG filter system. They are not
+        usable with our current filter system. The new filter effects
+        will replace the functionality step by step.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * svg/graphics/cairo: Removed.
+        * svg/graphics/cairo/SVGResourceFilterCairo.cpp: Removed.
+        * svg/graphics/cg: Removed.
+        * svg/graphics/cg/SVGResourceFilterCg.cpp: Removed.
+        * svg/graphics/cg/SVGResourceFilterCg.mm: Removed.
+        * svg/graphics/filters/SVGFilterEffect.cpp: Removed.
+        * svg/graphics/filters/SVGFilterEffect.h: Removed.
+        * svg/graphics/filters/cg: Removed.
+        * svg/graphics/filters/cg/SVGFEHelpersCg.h: Removed.
+        * svg/graphics/filters/cg/SVGFEHelpersCg.mm: Removed.
+        * svg/graphics/filters/cg/SVGFilterEffectCg.mm: Removed.
+        * svg/graphics/filters/cg/WKArithmeticFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKArithmeticFilter.h: Removed.
+        * svg/graphics/filters/cg/WKArithmeticFilter.m: Removed.
+        * svg/graphics/filters/cg/WKComponentMergeFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKComponentMergeFilter.h: Removed.
+        * svg/graphics/filters/cg/WKComponentMergeFilter.m: Removed.
+        * svg/graphics/filters/cg/WKDiffuseLightingFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKDiffuseLightingFilter.h: Removed.
+        * svg/graphics/filters/cg/WKDiffuseLightingFilter.m: Removed.
+        * svg/graphics/filters/cg/WKDiscreteTransferFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKDiscreteTransferFilter.h: Removed.
+        * svg/graphics/filters/cg/WKDiscreteTransferFilter.m: Removed.
+        * svg/graphics/filters/cg/WKDisplacementMapFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKDisplacementMapFilter.h: Removed.
+        * svg/graphics/filters/cg/WKDisplacementMapFilter.m: Removed.
+        * svg/graphics/filters/cg/WKDistantLightFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKDistantLightFilter.h: Removed.
+        * svg/graphics/filters/cg/WKDistantLightFilter.m: Removed.
+        * svg/graphics/filters/cg/WKGammaTransferFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKGammaTransferFilter.h: Removed.
+        * svg/graphics/filters/cg/WKGammaTransferFilter.m: Removed.
+        * svg/graphics/filters/cg/WKIdentityTransferFilter.h: Removed.
+        * svg/graphics/filters/cg/WKIdentityTransferFilter.m: Removed.
+        * svg/graphics/filters/cg/WKLinearTransferFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKLinearTransferFilter.h: Removed.
+        * svg/graphics/filters/cg/WKLinearTransferFilter.m: Removed.
+        * svg/graphics/filters/cg/WKNormalMapFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKNormalMapFilter.h: Removed.
+        * svg/graphics/filters/cg/WKNormalMapFilter.m: Removed.
+        * svg/graphics/filters/cg/WKPointLightFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKPointLightFilter.h: Removed.
+        * svg/graphics/filters/cg/WKPointLightFilter.m: Removed.
+        * svg/graphics/filters/cg/WKSpecularLightingFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKSpecularLightingFilter.h: Removed.
+        * svg/graphics/filters/cg/WKSpecularLightingFilter.m: Removed.
+        * svg/graphics/filters/cg/WKSpotLightFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKSpotLightFilter.h: Removed.
+        * svg/graphics/filters/cg/WKSpotLightFilter.m: Removed.
+        * svg/graphics/filters/cg/WKTableTransferFilter.cikernel: Removed.
+        * svg/graphics/filters/cg/WKTableTransferFilter.h: Removed.
+        * svg/graphics/filters/cg/WKTableTransferFilter.m: Removed.
+        * svg/graphics/mac: Removed.
+        * svg/graphics/mac/SVGResourceFilterPlatformDataMac.h: Removed.
+        * svg/graphics/mac/SVGResourceFilterPlatformDataMac.mm: Removed.
+        * svg/graphics/qt: Removed.
+        * svg/graphics/qt/SVGResourceFilterQt.cpp: Removed.
+        * svg/graphics/skia: Removed.
+        * svg/graphics/skia/SVGResourceFilterSkia.cpp: Removed.
+
+2009-06-01  Dmitry Titov  <dimich@chromium.org>
+
+        Fix the previous checkin (ttp://trac.webkit.org/changeset/44327).
+        This adds a comment suggested during review.
+
+        * platform/ThreadGlobalData.cpp:
+        (WebCore::ThreadGlobalData::~ThreadGlobalData): Add comment clarifying the change.
+
+2009-06-01  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25973
+        Avoid calling CurrentThread() in thread-specific destructors in OSX Chromium.
+        Pthreads invoke thread-specific destructors after WTF::detachThread() is called and ThreadIdentifier
+        for the thread removed from the WTF thread map. Calling CurrentThread() in such destructor causes
+        the ThreadIdentifier to be re-created and inserted into the map again. Since Pthreads on OSX reuse
+        the pthread_t between threads, the next created thread will have the same pthread_t and cause an assert
+        in establishIdentifierForPthreadHandle() since the id is already in the map.
+
+        The behavior is covered by existing test LayoutTests/fast/workers/worker-terminate.html, which currently fails
+        on OSX Chromium and will stop failing after this change.
+
+        * platform/ThreadGlobalData.h:
+        * platform/ThreadGlobalData.cpp:
+        (WebCore::ThreadGlobalData::~ThreadGlobalData):
+        Store the result of "isMainThread()" in a member variable during construction of thread-specific data
+        to avoid calling IsMainThread() in destructor, since the latter calls CurrentThread() in OSX Chromium.
+
+2009-06-01  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Alder and Maciej Stachowiak.
+
+        Bug 26057: StringImpl should share buffers with UString.
+        https://bugs.webkit.org/show_bug.cgi?id=26057
+
+        This change results in the following performance improvements:
+        On http://www.hixie.ch/tests/adhoc/perf/dom/artificial/core/001.html
+        the time went from 78ms to 40ms for append (other times remained constant).
+
+        On http://www.hixie.ch/tests/adhoc/perf/dom/artificial/core/002.html,
+        the time went from 3900ms to 2600ms.
+
+        For http://dromaeo.com/?dom, the time for DomModification improved by ~6%.
+        Other tests in dom seemed to be faster across several runs but within the
+        margin of error (except DOM Attributes which was slightly ~1.5% worse).
+
+        Existing tests cover this code and there is no new functionality
+        that is exposed to test.
+
+        * platform/text/AtomicString.cpp:
+        (WebCore::AtomicString::add):
+        * platform/text/String.cpp:
+        (WebCore::String::String):
+        (WebCore::String::operator UString):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+        (WebCore::StringImpl::~StringImpl):
+        (WebCore::StringImpl::create): Consumes a shared buffer.
+        (WebCore::StringImpl::ustring): Shares the StringImpl's buffer with the UString.
+        (WebCore::StringImpl::sharedBuffer): Exposes the buffer that may be shared.
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::hasTerminatingNullCharacter):
+        (WebCore::StringImpl::inTable):
+        (WebCore::StringImpl::setInTable): Converted the bools to be inside of PtrAndFlags
+        to avoid growing StringImpl in size.
+
+2009-06-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        V8 bindings follow-up to to DOMWindow-related cleanup:
+        http://trac.webkit.org/changeset/44215
+
+        * bindings/v8/ScriptController.cpp: Removed disconnectFrame(), relocated
+            its body to destructor.
+        * bindings/v8/ScriptController.h: Removed disconnectFrame() decl.
+
+2009-05-28  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        - Add panel enabler to the resources panel.
+        - Add session / always options into the panel enabler.
+        - Make enabled status for three panels sticky (globally).
+        - Persist enabled status using InspectorController::Settings
+        - Make InspectorController produce no network-related overhead when
+          resources panel is not enabled.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26046
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        (WebCore::InspectorController::enableResourceTracking):
+        (WebCore::InspectorController::disableResourceTracking):
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
+        (WebCore::InspectorController::enableDebugger):
+        (WebCore::InspectorController::disableDebugger):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::Setting::Setting):
+        (WebCore::InspectorController::resourceTrackingEnabled):
+        * inspector/InspectorController.idl:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::resourceTrackingWasEnabled):
+        (WebCore::InspectorFrontend::resourceTrackingWasDisabled):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/PanelEnablerView.js:
+        (WebInspector.PanelEnablerView.enableOption):
+        (WebInspector.PanelEnablerView):
+        (WebInspector.PanelEnablerView.prototype._windowResized):
+        (WebInspector.PanelEnablerView.prototype.alwaysWasChosen):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype._enableProfiling):
+        (WebInspector.ProfilesPanel.prototype._toggleProfiling):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel):
+        (WebInspector.ResourcesPanel.prototype.get statusBarItems):
+        (WebInspector.ResourcesPanel.prototype.resourceTrackingWasEnabled):
+        (WebInspector.ResourcesPanel.prototype.resourceTrackingWasDisabled):
+        (WebInspector.ResourcesPanel.prototype.reset):
+        (WebInspector.ResourcesPanel.prototype._updateSidebarWidth):
+        (WebInspector.ResourcesPanel.prototype._enableResourceTracking):
+        (WebInspector.ResourcesPanel.prototype._toggleResourceTracking):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._enableDebugging):
+        (WebInspector.ScriptsPanel.prototype._toggleDebugging):
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.js:
+        (WebInspector.resourceTrackingWasEnabled):
+        (WebInspector.resourceTrackingWasDisabled):
+
+2009-06-01  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Darin Adler.  Landed (and tweaked) by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25902
+
+        Added WorkerContext.close()
+
+        Test: fast/workers/worker-close.html
+
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::close):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::workerContextDestroyedInternal):
+
+2009-06-01  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=12471
+        XPathResult not invalidated for documents retrieved via XMLHttpRequest
+
+        Test: fast/xpath/detached-subtree-invalidate-iterator.html and existing tests in dom/svg/level3/xpath.
+
+        Use DOM tree version instead of DOMSubtreeModified events to invalidate, which is more
+        reliable and much faster.
+
+        * xml/XPathExpression.cpp:
+        (WebCore::XPathExpression::evaluate):
+        * xml/XPathResult.cpp:
+        (WebCore::XPathResult::XPathResult):
+        (WebCore::XPathResult::~XPathResult):
+        (WebCore::XPathResult::invalidIteratorState):
+        (WebCore::XPathResult::iterateNext):
+        * xml/XPathResult.h:
+        (WebCore::XPathResult::create):
+
+2009-06-01  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by Darin Adler.  Landed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25750
+
+        Test: fast/transforms/bounding-rect-zoom.html
+
+        Make getClientRects and getBoundingClientRect account for ther zoom
+        factor.
+
+        * dom/Element.cpp:
+        (WebCore::adjustFloatPointForAbsoluteZoom):
+        (WebCore::adjustFloatQuadForAbsoluteZoom):
+        (WebCore::adjustIntRectForAbsoluteZoom):
+        (WebCore::Element::getClientRects):
+        (WebCore::Element::getBoundingClientRect):
+
+2009-06-01  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Dimitri Glazkov.  Landed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26026
+
+        Fix an infinite loop when using the keyboard in Chromium select
+        popups.
+
+        Not testable since it involves sending a keyboard event to
+        the popup, which is not possible (eventSender sends the key
+        events through webview, we want to go through the webwidget).
+
+        * platform/chromium/PopupMenuChromium.cpp:
+
+2009-06-01  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.  Landed by Adam Barth.
+
+        If a url with an anchor is being loaded, ensure that the anchor remains locked in view until the page
+        has finished loading compeltely or the user has manually scrolled.  Refreshing an anchor url after
+        scrolling to a new location on the page will still result in jumping to the new location.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=26034
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::gotoAnchor): Set anchor lock after navigating to anchor.
+        (WebCore::FrameLoader::completed): Release anchor lock.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView): Ensure anchor lock starts unset.
+        (WebCore::FrameView::reset): Ensure anchor lock starts unset.
+        (WebCore::FrameView::layout): If anchor lock is set, force a gotoAnchor() after layout.
+        (WebCore::FrameView::scrollRectIntoViewRecursively): Release anchor lock if a programmatic scroll begins.
+        (WebCore::FrameView::setWasScrolledByUser): Release anchor lock if user manually scrolls.
+        (WebCore::FrameView::setScrollPosition): Release anchor lock if a programmatic scroll begins.
+        * page/FrameView.h:
+        (WebCore::FrameView::lockedToAnchor): Added.
+        (WebCore::FrameView::setLockedToAnchor): Added.
+
+2009-05-31  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        WebKit needs cross-platform filter system
+        [https://bugs.webkit.org/show_bug.cgi?id=19991]
+
+        A short clean-up. FilterBuilder is SVG specific. Move it
+        to svg/graphics/filters and rename it to SVGFilterBuilder. 
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * svg/FilterBuilder.cpp: Removed.
+        * svg/FilterBuilder.h: Removed.
+        * svg/SVGFilterElement.cpp:
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::SVGResourceFilter):
+        * svg/graphics/SVGResourceFilter.h:
+        (WebCore::SVGResourceFilter::builder):
+        * svg/graphics/filters/SVGFilterBuilder.cpp: Added.
+        (WebCore::SVGFilterBuilder::SVGFilterBuilder):
+        (WebCore::SVGFilterBuilder::add):
+        (WebCore::SVGFilterBuilder::getEffectById):
+        (WebCore::SVGFilterBuilder::clearEffects):
+        * svg/graphics/filters/SVGFilterBuilder.h: Added.
+        (WebCore::SVGFilterBuilder::lastEffect):
+
+2009-05-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=13233
+        Need to implement an optimizing XPath evaluator
+
+        Avoid sorting results of hierarchical paths that are naturally sorted. On a flat data structure
+        with 128K nodes and a simple XPath expression, this changes evaluation time from 1.5 minutes
+        to 33 ms.
+
+        * xml/XPathNodeSet.h: Keep track of whether subtrees rooted at nodes in set are disjoint,
+        which is useful for optimization.
+        (WebCore::XPath::NodeSet::NodeSet): Removed, it was identical to compiler generated one.
+        (WebCore::XPath::NodeSet::operator=): Ditto.
+        (WebCore::XPath::NodeSet::swap): Ditto.
+        (WebCore::XPath::NodeSet::isSorted): Single element sets are always sorted, even if sort()
+        was never called.
+        (WebCore::XPath::NodeSet::markSubtreesDisjoint): Just like being sorted, the new flag is
+        maintained by callers.
+        (WebCore::XPath::NodeSet::subtreesAreDisjoint): A single element set only has one subtree.
+        Currently, the only way for a set to gain this flag is to be produced from a single element
+        set with a hierarchical location path.
+
+        * xml/XPathPath.cpp: (WebCore::XPath::LocationPath::evaluate): Use the new flag to avoid
+        maintaining a set of unique nodes, and to avoid sorting the result.
+
+2009-05-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=13233
+        Need to implement an optimizing XPath evaluator
+
+        This patch adds some infrastructure and simple optimizations. Namely,
+        - we now avoid building a full NodeSet just to evaluate a predicate in some cases;
+        - "/descendant-or-self::node()/child::" is optimized to iterate the tree once when possible;
+
+        * xml/XPathExpressionNode.cpp:
+        (WebCore::XPath::Expression::Expression):
+        * xml/XPathExpressionNode.h:
+        (WebCore::XPath::Expression::addSubExpression):
+        (WebCore::XPath::Expression::isContextNodeSensitive):
+        (WebCore::XPath::Expression::isContextPositionSensitive):
+        (WebCore::XPath::Expression::isContextSizeSensitive):
+        (WebCore::XPath::Expression::setIsContextNodeSensitive):
+        (WebCore::XPath::Expression::setIsContextPositionSensitive):
+        (WebCore::XPath::Expression::setIsContextSizeSensitive):
+        XPath expression now knows its result type, and whether evaluation depends on context.
+
+        * xml/XPathFunctions.cpp:
+        (WebCore::XPath::FunLast::resultType):
+        (WebCore::XPath::FunLast::FunLast):
+        (WebCore::XPath::FunPosition::resultType):
+        (WebCore::XPath::FunPosition::FunPosition):
+        (WebCore::XPath::FunCount::resultType):
+        (WebCore::XPath::FunId::resultType):
+        (WebCore::XPath::FunLocalName::resultType):
+        (WebCore::XPath::FunLocalName::FunLocalName):
+        (WebCore::XPath::FunNamespaceURI::resultType):
+        (WebCore::XPath::FunNamespaceURI::FunNamespaceURI):
+        (WebCore::XPath::FunName::resultType):
+        (WebCore::XPath::FunName::FunName):
+        (WebCore::XPath::FunString::resultType):
+        (WebCore::XPath::FunString::FunString):
+        (WebCore::XPath::FunConcat::resultType):
+        (WebCore::XPath::FunStartsWith::resultType):
+        (WebCore::XPath::FunContains::resultType):
+        (WebCore::XPath::FunSubstringBefore::resultType):
+        (WebCore::XPath::FunSubstringAfter::resultType):
+        (WebCore::XPath::FunSubstring::resultType):
+        (WebCore::XPath::FunStringLength::resultType):
+        (WebCore::XPath::FunStringLength::FunStringLength):
+        (WebCore::XPath::FunNormalizeSpace::resultType):
+        (WebCore::XPath::FunNormalizeSpace::FunNormalizeSpace):
+        (WebCore::XPath::FunTranslate::resultType):
+        (WebCore::XPath::FunBoolean::resultType):
+        (WebCore::XPath::FunNot::resultType):
+        (WebCore::XPath::FunTrue::resultType):
+        (WebCore::XPath::FunFalse::resultType):
+        (WebCore::XPath::FunLang::resultType):
+        (WebCore::XPath::FunLang::FunLang):
+        (WebCore::XPath::FunNumber::resultType):
+        (WebCore::XPath::FunNumber::FunNumber):
+        (WebCore::XPath::FunSum::resultType):
+        (WebCore::XPath::FunFloor::resultType):
+        (WebCore::XPath::FunCeiling::resultType):
+        (WebCore::XPath::FunRound::resultType):
+        (WebCore::XPath::Function::setArguments):
+        Set optimization details for the expression. Normally, a function does not introduce context
+        node set dependency, but some use context node as default argument, or otherwise use the context.
+
+        * xml/XPathFunctions.h: Tweaked style.
+
+        * xml/XPathPath.cpp:
+        (WebCore::XPath::Filter::Filter): A filter is as context node set sensitive as its expression is.
+        (WebCore::XPath::LocationPath::LocationPath): A location path can only be context node sensitive,
+        and only if the path relative.
+        (WebCore::XPath::LocationPath::appendStep): Invoke compile-time Step optimizations.
+        (WebCore::XPath::LocationPath::insertFirstStep): Ditto.
+        (WebCore::XPath::Path::Path): A path is as context node set sensitive as its filter is.
+
+        * xml/XPathPath.h:
+        (WebCore::XPath::Filter::resultType): Result type of a filter is the same as of its expression
+        (useful filters return NodeSets, of course).
+        (WebCore::XPath::LocationPath::setAbsolute): An absolute location path if context node set
+        insensitive.
+        (WebCore::XPath::LocationPath::resultType): A path's result is always a node set.
+        (WebCore::XPath::Path::resultType): Ditto.
+
+        * xml/XPathPredicate.h:
+        (WebCore::XPath::Number::resultType): Return a proper result type.
+        (WebCore::XPath::StringExpression::resultType): Ditto.
+        (WebCore::XPath::Negative::resultType): Ditto.
+        (WebCore::XPath::NumericOp::resultType): Ditto.
+        (WebCore::XPath::EqTestOp::resultType): Ditto.
+        (WebCore::XPath::LogicalOp::resultType): Ditto.
+        (WebCore::XPath::Union::resultType): Ditto.
+        (WebCore::XPath::Predicate::isContextPositionSensitive): A predicate can be context position
+        sensitive even if its expression is not, because e.g. [5] is a shortcut for [position()=5].
+        (WebCore::XPath::Predicate::isContextSizeSensitive): This matches expression result.
+
+        * xml/XPathStep.h:
+        (WebCore::XPath::Step::NodeTest::Kind): Removed unused ElementNodeTest, which was previously
+        borrowed from XPath 2.0 to express some optimizations.
+        (WebCore::XPath::Step::NodeTest::mergedPredicates): To avoid building a huge node set and
+        filtering it with predicates, we now try to apply predicates while enumerating an axis.
+        (WebCore::XPath::Step::nodeTest): Expose m_nodeTest.
+
+        * xml/XPathStep.cpp:
+        (WebCore::XPath::Step::~Step): The step owns NodeTest merged predicates, so it is still
+        possible to copy NodeTests.
+        (WebCore::XPath::Step::optimize): Merge predicates into NodeTest if possible.
+        (WebCore::XPath::optimizeStepPair): Optimize some expressions containing "//".
+        (WebCore::XPath::Step::predicatesAreContextListInsensitive): The above optimization is only
+        possible if there are no context sensitive predicates for "//".
+        (WebCore::XPath::Step::evaluate): Track context position for the first merged predicate.
+        (WebCore::XPath::nodeMatchesBasicTest): Check whether the node matches node test, ignoring
+        merged predicates.
+        (WebCore::XPath::nodeMatches): Additionally check merged predicates, and update position.
+        (WebCore::XPath::Step::nodesInAxis): Check merged predicates in optimized attribute code
+        path.
+
+        * xml/XPathVariableReference.h: (WebCore::XPath::VariableReference::resultType): Variable
+        references are not used with XPathEvaluator, so we'll only need them if we decide to
+        reimplement XSLT. The type of variable reference is not known at compile time.
+
+2009-05-31  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Remove unused JSEventTargetBase.h
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSEventTargetBase.h: Removed.
+
+2009-05-31  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Part of https://bugs.webkit.org/show_bug.cgi?id=26100
+        Add missing event handler properties to the DOMWindow
+
+        Add missing oncanplay, oncanplaythrough, ondurationchange, onemptied,
+        onended, onloadeddata, onloadedmetadata, onpause, onplay, onplaying,
+        onratechange, onseeked, onseeking, ontimeupdate, onvolumechange,
+        onwaiting, onloadstart, onprogress, onstalled, onsuspend, ondrag,
+        ondragend, ondragenter, ondragleave, ondragover, ondragstart and 
+        ondrop event handlers to the DOMWindow.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::ondrag):
+        (WebCore::DOMWindow::setOndrag):
+        (WebCore::DOMWindow::ondragend):
+        (WebCore::DOMWindow::setOndragend):
+        (WebCore::DOMWindow::ondragenter):
+        (WebCore::DOMWindow::setOndragenter):
+        (WebCore::DOMWindow::ondragleave):
+        (WebCore::DOMWindow::setOndragleave):
+        (WebCore::DOMWindow::ondragover):
+        (WebCore::DOMWindow::setOndragover):
+        (WebCore::DOMWindow::ondragstart):
+        (WebCore::DOMWindow::setOndragstart):
+        (WebCore::DOMWindow::ondrop):
+        (WebCore::DOMWindow::setOndrop):
+        (WebCore::DOMWindow::oncanplay):
+        (WebCore::DOMWindow::setOncanplay):
+        (WebCore::DOMWindow::oncanplaythrough):
+        (WebCore::DOMWindow::setOncanplaythrough):
+        (WebCore::DOMWindow::ondurationchange):
+        (WebCore::DOMWindow::setOndurationchange):
+        (WebCore::DOMWindow::onemptied):
+        (WebCore::DOMWindow::setOnemptied):
+        (WebCore::DOMWindow::onended):
+        (WebCore::DOMWindow::setOnended):
+        (WebCore::DOMWindow::onloadeddata):
+        (WebCore::DOMWindow::setOnloadeddata):
+        (WebCore::DOMWindow::onloadedmetadata):
+        (WebCore::DOMWindow::setOnloadedmetadata):
+        (WebCore::DOMWindow::onpause):
+        (WebCore::DOMWindow::setOnpause):
+        (WebCore::DOMWindow::onplay):
+        (WebCore::DOMWindow::setOnplay):
+        (WebCore::DOMWindow::onplaying):
+        (WebCore::DOMWindow::setOnplaying):
+        (WebCore::DOMWindow::onratechange):
+        (WebCore::DOMWindow::setOnratechange):
+        (WebCore::DOMWindow::onseeked):
+        (WebCore::DOMWindow::setOnseeked):
+        (WebCore::DOMWindow::onseeking):
+        (WebCore::DOMWindow::setOnseeking):
+        (WebCore::DOMWindow::ontimeupdate):
+        (WebCore::DOMWindow::setOntimeupdate):
+        (WebCore::DOMWindow::onvolumechange):
+        (WebCore::DOMWindow::setOnvolumechange):
+        (WebCore::DOMWindow::onwaiting):
+        (WebCore::DOMWindow::setOnwaiting):
+        (WebCore::DOMWindow::onloadstart):
+        (WebCore::DOMWindow::setOnloadstart):
+        (WebCore::DOMWindow::onprogress):
+        (WebCore::DOMWindow::setOnprogress):
+        (WebCore::DOMWindow::onstalled):
+        (WebCore::DOMWindow::setOnstalled):
+        (WebCore::DOMWindow::onsuspend):
+        (WebCore::DOMWindow::setOnsuspend):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-05-31  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Part of https://bugs.webkit.org/show_bug.cgi?id=26100
+        Add missing event handler properties to the DOMWindow
+
+        Add missing onstorage event handler to the DOMWindow.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::onstorage):
+        (WebCore::DOMWindow::setOnstorage):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-05-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26110
+        Update online/offline events to match the current spec.
+        - Also adds window.ononline and window.onoffline event handler
+          properties.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::onoffline):
+        (WebCore::DOMWindow::setOnoffline):
+        (WebCore::DOMWindow::ononline):
+        (WebCore::DOMWindow::setOnonline):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * page/Page.cpp:
+        (WebCore::networkStateChanged):
+
+2009-05-31  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        WebKit needs cross-platform filter system
+        [https://bugs.webkit.org/show_bug.cgi?id=19991]
+
+        Make use of the new filter system in WebCore for SVG. Deleted Mac bindings
+        and replace it by a platform independent code. Calculation of subRegions
+        is missing but needed for a first filter effect.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/Filter.h:
+        (WebCore::Filter::~Filter):
+        (WebCore::Filter::setSourceImage):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::finishRenderSVGContent):
+        * svg/FilterBuilder.h:
+        (WebCore::FilterBuilder::lastEffect):
+        * svg/SVGFEBlendElement.cpp:
+        (WebCore::SVGFEBlendElement::SVGFEBlendElement):
+        (WebCore::SVGFEBlendElement::build):
+        * svg/SVGFEBlendElement.h:
+        * svg/SVGFEColorMatrixElement.cpp:
+        (WebCore::SVGFEColorMatrixElement::SVGFEColorMatrixElement):
+        (WebCore::SVGFEColorMatrixElement::build):
+        * svg/SVGFEColorMatrixElement.h:
+        * svg/SVGFEComponentTransferElement.cpp:
+        (WebCore::SVGFEComponentTransferElement::SVGFEComponentTransferElement):
+        (WebCore::SVGFEComponentTransferElement::build):
+        * svg/SVGFEComponentTransferElement.h:
+        * svg/SVGFECompositeElement.cpp:
+        (WebCore::SVGFECompositeElement::SVGFECompositeElement):
+        (WebCore::SVGFECompositeElement::build):
+        * svg/SVGFECompositeElement.h:
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::SVGFEDiffuseLightingElement):
+        (WebCore::SVGFEDiffuseLightingElement::build):
+        * svg/SVGFEDiffuseLightingElement.h:
+        * svg/SVGFEDisplacementMapElement.cpp:
+        (WebCore::SVGFEDisplacementMapElement::SVGFEDisplacementMapElement):
+        (WebCore::SVGFEDisplacementMapElement::build):
+        * svg/SVGFEDisplacementMapElement.h:
+        * svg/SVGFEFloodElement.cpp:
+        (WebCore::SVGFEFloodElement::SVGFEFloodElement):
+        (WebCore::SVGFEFloodElement::build):
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEGaussianBlurElement.cpp:
+        (WebCore::SVGFEGaussianBlurElement::SVGFEGaussianBlurElement):
+        (WebCore::SVGFEGaussianBlurElement::build):
+        * svg/SVGFEGaussianBlurElement.h:
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::SVGFEImageElement):
+        (WebCore::SVGFEImageElement::notifyFinished):
+        (WebCore::SVGFEImageElement::build):
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFEMergeElement.cpp:
+        (WebCore::SVGFEMergeElement::SVGFEMergeElement):
+        (WebCore::SVGFEMergeElement::build):
+        * svg/SVGFEMergeElement.h:
+        * svg/SVGFEOffsetElement.cpp:
+        (WebCore::SVGFEOffsetElement::SVGFEOffsetElement):
+        (WebCore::SVGFEOffsetElement::build):
+        * svg/SVGFEOffsetElement.h:
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::SVGFESpecularLightingElement):
+        (WebCore::SVGFESpecularLightingElement::build):
+        * svg/SVGFESpecularLightingElement.h:
+        * svg/SVGFETileElement.cpp:
+        (WebCore::SVGFETileElement::SVGFETileElement):
+        (WebCore::SVGFETileElement::build):
+        * svg/SVGFETileElement.h:
+        * svg/SVGFETurbulenceElement.cpp:
+        (WebCore::SVGFETurbulenceElement::SVGFETurbulenceElement):
+        (WebCore::SVGFETurbulenceElement::build):
+        * svg/SVGFETurbulenceElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::canvasResource):
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::setStandardAttributes):
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+        (WebCore::SVGFilterPrimitiveStandardAttributes::contextElement):
+        * svg/graphics/SVGResourceFilter.cpp:
+        (WebCore::SVGResourceFilter::SVGResourceFilter):
+        (WebCore::SVGResourceFilter::addFilterEffect):
+        (WebCore::SVGResourceFilter::filterBBoxForItemBBox):
+        (WebCore::SVGResourceFilter::prepareFilter):
+        (WebCore::SVGResourceFilter::applyFilter):
+        (WebCore::SVGResourceFilter::externalRepresentation):
+        * svg/graphics/SVGResourceFilter.h:
+        (WebCore::SVGResourceFilter::filterBoundingBox):
+        (WebCore::SVGResourceFilter::setFilterBoundingBox):
+        (WebCore::SVGResourceFilter::itemBoundingBox):
+        (WebCore::SVGResourceFilter::setItemBoundingBox):
+        (WebCore::SVGResourceFilter::builder):
+
+2009-05-31  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        WebKit needs cross-platform filter system
+        [https://bugs.webkit.org/show_bug.cgi?id=19991]
+
+        Adding 'in1' attribute support for <feFlood>, as specified in SVG 1.1.
+        This change helps creating test cases, once filters are activated.
+
+        * svg/SVGFEFloodElement.cpp:
+        (WebCore::SVGFEFloodElement::SVGFEFloodElement):
+        (WebCore::SVGFEFloodElement::parseMappedAttribute):
+        (WebCore::SVGFEFloodElement::build):
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEFloodElement.idl:
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::FEFlood):
+        (WebCore::FEFlood::create):
+        * svg/graphics/filters/SVGFEFlood.h:
+
+2009-05-31  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        WebKit needs cross-platform filter system
+        [https://bugs.webkit.org/show_bug.cgi?id=19991]
+
+        Replace all occurrences of SVGResourceFilter by Filter. This is the last 
+        step for a SVG independent filter system. Every other part of WebCore can
+        use the filter system by creating a new Filter object.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/FEBlend.cpp:
+        (WebCore::FEBlend::apply):
+        * platform/graphics/filters/FEBlend.h:
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+        * platform/graphics/filters/FEColorMatrix.h:
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::FEComponentTransfer::apply):
+        * platform/graphics/filters/FEComponentTransfer.h:
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+        * platform/graphics/filters/FEComposite.h:
+        * platform/graphics/filters/Filter.h: Added.
+        (WebCore::Filter::setSourceImage):
+        (WebCore::Filter::sourceImage):
+        * platform/graphics/filters/FilterEffect.h:
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::apply):
+        * platform/graphics/filters/SourceAlpha.h:
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::apply):
+        * platform/graphics/filters/SourceGraphic.h:
+        * svg/Filter.cpp: Removed.
+        * svg/Filter.h: Removed.
+        * svg/graphics/filters/SVGFEConvolveMatrix.cpp:
+        (WebCore::FEConvolveMatrix::apply):
+        * svg/graphics/filters/SVGFEConvolveMatrix.h:
+        * svg/graphics/filters/SVGFEDiffuseLighting.cpp:
+        (WebCore::FEDiffuseLighting::apply):
+        * svg/graphics/filters/SVGFEDiffuseLighting.h:
+        * svg/graphics/filters/SVGFEDisplacementMap.cpp:
+        (WebCore::FEDisplacementMap::apply):
+        * svg/graphics/filters/SVGFEDisplacementMap.h:
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::apply):
+        * svg/graphics/filters/SVGFEFlood.h:
+        * svg/graphics/filters/SVGFEGaussianBlur.cpp:
+        (WebCore::FEGaussianBlur::apply):
+        * svg/graphics/filters/SVGFEGaussianBlur.h:
+        * svg/graphics/filters/SVGFEImage.cpp:
+        (WebCore::FEImage::apply):
+        * svg/graphics/filters/SVGFEImage.h:
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::apply):
+        * svg/graphics/filters/SVGFEMerge.h:
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::FEMorphology::apply):
+        * svg/graphics/filters/SVGFEMorphology.h:
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+        * svg/graphics/filters/SVGFEOffset.h:
+        * svg/graphics/filters/SVGFESpecularLighting.cpp:
+        (WebCore::FESpecularLighting::apply):
+        * svg/graphics/filters/SVGFESpecularLighting.h:
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+        * svg/graphics/filters/SVGFETile.h:
+        * svg/graphics/filters/SVGFETurbulence.cpp:
+        (WebCore::FETurbulence::apply):
+        * svg/graphics/filters/SVGFETurbulence.h:
+        * svg/graphics/filters/SVGFilter.cpp: Added.
+        (WebCore::SVGFilter::SVGFilter):
+        (WebCore::SVGFilter::calculateEffectSubRegion):
+        (WebCore::SVGFilter::create):
+        * svg/graphics/filters/SVGFilter.h: Added.
+
+2009-05-30  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fix for platforms without plugins support.
+
+        * plugins/PluginViewNone.cpp:
+        (WebCore::PluginView::userAgentStatic):
+        (WebCore::PluginView::getValueStatic):
+
+2009-05-30  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=25979
+
+        Fix regression, local WML files won't load anymore, as the mimetype isn't correctly detected.    
+        Bug filed at <rdar://problem/6917571> to cover this CFNetwork limitation.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
+
+2009-05-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=26091
+        Make storage events match the current spec.
+        - Storage event listeners are added to the window.
+        - Storage events are dispatched to the window.
+
+        Updated existing tests.
+
+        * dom/Document.cpp:
+        (WebCore::Document::dispatchWindowEvent):
+        * dom/Document.h:
+        * dom/Node.cpp:
+        * dom/Node.h:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::dispatchStorageEvent):
+        * storage/SessionStorageArea.cpp:
+        (WebCore::SessionStorageArea::dispatchStorageEvent):
+
+2009-05-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Bug 26097: REGRESSION (r44283): Tab key doesn't work when focus is on a <select> element
+
+        Test: fast/forms/focus-control-to-page.html
+
+        * dom/SelectElement.h: Made destructor protected. Tweaked a bit.
+
+        * html/HTMLSelectElement.cpp: Removed unneeded includes.
+        (WebCore::HTMLSelectElement::remove): Removed unneeded range check of the
+        result of optionToListIndex.
+        (WebCore::HTMLSelectElement::parseMappedAttribute): Removed code to set the
+        unused attribute, m_minwidth.
+        (WebCore::HTMLSelectElement::defaultEventHandler): The actual bug fix.
+        Call through to the base class defaultEventHandler if the event hasn't
+        been handled yet.
+
+        * html/HTMLSelectElement.h: Removed unneeded includes. Made a lot more functions
+        private. Removed unused minWidth function and m_minwidth data member.
+
+2009-05-30  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Holger Freyther.
+
+        The two KeyboardCodes.h files are basically identical and the
+        qt one is properly #ifdef-ed for different win32 systems. Share
+        them between Qt and Gtk implementations.
+
+        * GNUmakefile.am:
+        * platform/KeyboardCodes.h: Copied from WebCore/platform/qt/KeyboardCodes.h.
+        * platform/gtk/KeyboardCodes.h: Removed.
+        * platform/qt/KeyboardCodes.h: Removed.
+
+2009-05-30  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        LocalStorage and SessionStorage's implicit setters do not correctly 
+        handle null.  The custom JS bindings should convert to strings
+        unconditionally and not try to handle null specially.
+        https://bugs.webkit.org/show_bug.cgi?id=25970
+
+        Tests: storage/domstorage/localstorage/string-conversion.html
+               storage/domstorage/sessionstorage/string-conversion.html
+
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::customPut):
+
+2009-05-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6935192> REGRESSION (Safari 3-TOT): Scroll
+          bars in key window draw as inactive if the WebView is not active
+
+        Test: platform/mac/scrollbars/key-window-not-first-responder.html
+
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint): Use the window's key state instead
+        of the WebView's first responder state to switch between active and
+        inactive state.
+
+2009-05-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=18445
+          <rdar://problem/5931174> Assertion failure in CSSGradientValue::image
+          with -webkit-gradient as body's background
+
+        Test: fast/backgrounds/body-generated-image-propagated-to-root.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended): Check if this
+        is the root element painting a background layer propagated from the
+        body, and if it is, use the body's renderer as the client to
+        StyleImage::image().
+
+2009-05-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix for AXObjectCache.
+
+        For !HAVE(ACCESSIBILITY) postNotification was defined twice. Move
+        that into the #ifdef.
+
+        * accessibility/AXObjectCache.cpp:
+
+2009-05-29  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26072
+
+        Add support for the last missing WML element: <select>. This patch adds WMLSelectElement, providing
+        the same functionality HTMLSelectElement has. The WML specific features will follow soon.
+    
+        Add simple testcase covering <select> element rendering: fast/wml/select.wml
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/OptionElement.cpp:
+        (WebCore::OptionElement::optionIndex):
+        (WebCore::isOptionElement):
+        * dom/OptionElement.h:
+        * dom/OptionGroupElement.cpp:
+        (WebCore::isOptionGroupElement):
+        * dom/OptionGroupElement.h:
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::accessKeySetSelectedIndex):
+        (WebCore::toSelectElement):
+        * dom/SelectElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::index):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::accessKeySetSelectedIndex):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::paintItemForeground):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::itemIsEnabled):
+        (WebCore::RenderMenuList::itemIsLabel):
+        * wml/WMLFormControlElement.cpp:
+        (WebCore::WMLFormControlElement::attach):
+        (WebCore::WMLFormControlElement::recalcStyle):
+        * wml/WMLFormControlElement.h:
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::attach):
+        * wml/WMLOptGroupElement.cpp:
+        (WebCore::WMLOptGroupElement::insertBefore):
+        (WebCore::WMLOptGroupElement::replaceChild):
+        (WebCore::WMLOptGroupElement::removeChild):
+        (WebCore::WMLOptGroupElement::appendChild):
+        (WebCore::WMLOptGroupElement::removeChildren):
+        (WebCore::ownerSelectElement):
+        (WebCore::WMLOptGroupElement::accessKeyAction):
+        (WebCore::WMLOptGroupElement::childrenChanged):
+        (WebCore::WMLOptGroupElement::parseMappedAttribute):
+        (WebCore::WMLOptGroupElement::attach):
+        (WebCore::WMLOptGroupElement::detach):
+        (WebCore::WMLOptGroupElement::recalcSelectOptions):
+        * wml/WMLOptionElement.cpp:
+        (WebCore::ownerSelectElement):
+        (WebCore::WMLOptionElement::accessKeyAction):
+        (WebCore::WMLOptionElement::childrenChanged):
+        (WebCore::WMLOptionElement::parseMappedAttribute):
+        (WebCore::WMLOptionElement::attach):
+        (WebCore::WMLOptionElement::detach):
+        (WebCore::WMLOptionElement::insertedIntoDocument):
+        * wml/WMLSelectElement.cpp: Added.
+        (WebCore::WMLSelectElement::WMLSelectElement):
+        (WebCore::WMLSelectElement::~WMLSelectElement):
+        (WebCore::WMLSelectElement::formControlType):
+        (WebCore::WMLSelectElement::isKeyboardFocusable):
+        (WebCore::WMLSelectElement::isMouseFocusable):
+        (WebCore::WMLSelectElement::selectAll):
+        (WebCore::WMLSelectElement::recalcStyle):
+        (WebCore::WMLSelectElement::dispatchFocusEvent):
+        (WebCore::WMLSelectElement::dispatchBlurEvent):
+        (WebCore::WMLSelectElement::selectedIndex):
+        (WebCore::WMLSelectElement::setSelectedIndex):
+        (WebCore::WMLSelectElement::saveFormControlState):
+        (WebCore::WMLSelectElement::restoreFormControlState):
+        (WebCore::WMLSelectElement::childrenChanged):
+        (WebCore::WMLSelectElement::parseMappedAttribute):
+        (WebCore::WMLSelectElement::createRenderer):
+        (WebCore::WMLSelectElement::appendFormData):
+        (WebCore::WMLSelectElement::optionToListIndex):
+        (WebCore::WMLSelectElement::listToOptionIndex):
+        (WebCore::WMLSelectElement::reset):
+        (WebCore::WMLSelectElement::defaultEventHandler):
+        (WebCore::WMLSelectElement::accessKeyAction):
+        (WebCore::WMLSelectElement::setActiveSelectionAnchorIndex):
+        (WebCore::WMLSelectElement::setActiveSelectionEndIndex):
+        (WebCore::WMLSelectElement::updateListBoxSelection):
+        (WebCore::WMLSelectElement::listBoxOnChange):
+        (WebCore::WMLSelectElement::menuListOnChange):
+        (WebCore::WMLSelectElement::activeSelectionStartListIndex):
+        (WebCore::WMLSelectElement::activeSelectionEndListIndex):
+        (WebCore::WMLSelectElement::accessKeySetSelectedIndex):
+        (WebCore::WMLSelectElement::setRecalcListItems):
+        (WebCore::WMLSelectElement::scrollToSelection):
+        (WebCore::WMLSelectElement::insertedIntoTree):
+        * wml/WMLSelectElement.h: Added.
+        (WebCore::WMLSelectElement::canSelectAll):
+        (WebCore::WMLSelectElement::canStartSelection):
+        (WebCore::WMLSelectElement::size):
+        (WebCore::WMLSelectElement::multiple):
+        (WebCore::WMLSelectElement::listItems):
+        * wml/WMLTagNames.in:
+
+2009-05-29  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (build fix for windows).
+
+        http://trac.webkit.org/changeset/44279 left in a "Vector<WCHAR> localeNameBuf"
+        that it was trying to replace.  Resulting in this variable being defined twice (and
+        the second time incorrectly).
+
+        * platform/win/Language.cpp:
+        (WebCore::localeInfo):
+
+2009-05-29  Takeshi Yoshino  <tyoshino@google.com>
+
+        Reviewed by Darin Alder.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26018
+
+        Fix behavior of the Element View of the Web Inspector for double
+        clicking the element outline tree.
+
+        Double clicking the element outline tree should
+        1) on attribute: enter attribute editing mode
+        2) on text: enter text editing mode
+        3) otherwise: change root node to the parent element of double clicked
+           element.
+
+        Now, 3) is broken. For example, clicking <html> clears the element
+        outline view.
+
+        rootDOMNode should be updated to this.representedObject.parentNode, not
+        this.parent.representedObject which is parent inside the element
+        outline tree itself.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype.ondblclick):
+
+2009-05-29  David Moore  <davemoore@google.com>
+
+        Reviewed by Darin Alder.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26001
+        Change many of the uses of String::adopt() to String::createUninitialized().
+        This allows those strings to use an inlined buffer for their characters.
+
+        * dom/StyleElement.cpp:
+        Loop over nodes to precompute length of string and then
+        write the characters into the allocated inline buffer
+        (WebCore::StyleElement::process):
+        * dom/Text.cpp:
+        Loop over nodes to precompute length of string and then
+        write the characters into the allocated inline buffer
+        (WebCore::Text::wholeText):
+        (WebCore::Text::rendererIsNeeded):
+        (WebCore::Text::createRenderer):
+        (WebCore::Text::createWithLengthLimit):
+        (WebCore::Text::formatForDebugger):
+        * platform/text/String.cpp:
+        (WebCore::String::append):
+        (WebCore::String::insert):
+        (WebCore::String::truncate):
+        (WebCore::String::remove):
+        * platform/text/StringBuilder.cpp:
+        (WebCore::StringBuilder::toString):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::lower):
+        (WebCore::StringImpl::upper):
+        (WebCore::StringImpl::secure):
+        (WebCore::StringImpl::foldCase):
+        (WebCore::StringImpl::replace):
+        * platform/text/TextCodecLatin1.cpp:
+        (WebCore::TextCodecLatin1::decode):
+        * platform/text/TextCodecUserDefined.cpp:
+        (WebCore::TextCodecUserDefined::decode):
+        * platform/win/Language.cpp:
+        (WebCore::localeInfo):
+
+2009-05-29  Takeshi Yoshino  <tyoshino@google.com>
+
+        Reviewed by Darin Alder.
+
+        Bug 25911: Apply href in base elements to anchors shown on the source viewer
+        https://bugs.webkit.org/show_bug.cgi?id=25911
+
+        In rendering HTML sources, parse base elements to apply the base URI to
+        anchors shown on the source viewer.
+
+        This issue was originally reported to the Chromium issue tracker.
+        http://code.google.com/p/chromium/issues/detail?id=2418
+
+        Test: fast/frames/viewsource-link-on-href-value.html
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::addViewSourceToken):
+
+2009-05-29  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22429
+        document.styleSheets collection ignores media=presentation
+
+        Ensure that stylesheets though <link> show up in document.styleSheets regardless of media attribute.
+
+        Test: fast/css/sheet-collection-link.html
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::process):
+
+2009-05-29  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26069
+        Fix a crash in custom V8 bindings code for XMLHttpRequest.
+
+        Test: fast/xmlhttprequest/xmlhttprequest-open-after-iframe-onload-remove-self.html
+
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-05-29  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 26074: SQLTransaction::executeSQL does an unnecessary call to String::copy.
+        https://bugs.webkit.org/show_bug.cgi?id=26074
+
+        The constructor for SQLStatement already does a copy for this string.
+
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::executeSQL):
+
+2009-05-29  Darin Adler  <darin@apple.com>
+
+        Fix build; the new Cairo code compiled on Windows only.
+
+        * platform/graphics/gtk/FontPlatformData.h: Added syntheticBold
+        and syntheticOblique functions as in the Windows version to make it
+        easier to use this cross-platform. Later we can make data members
+        private as in the Windows version.
+        * platform/graphics/mac/FontPlatformData.h: Ditto.
+
+2009-05-29  Alexander Macdonald  <alexmac@adobe.com>
+
+        Reviewed by Darin Adler.
+
+        Added support for synthetic bold/oblique font rendering
+        on platforms that use cairo.
+
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-05-29  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 26024: AX: possible to fail assertion because AXPostNotification calls accessibilityIsIgnored
+        https://bugs.webkit.org/show_bug.cgi?id=26024
+
+        AX notifications are posted after a one shot timer so that notifications are not performed mid-layout.
+        Consolidated postNotification and postNotificationToElement into one method.
+
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::AXObjectCache):
+        (WebCore::AXObjectCache::notificationPostTimerFired):
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::selectedChildrenChanged):
+        * accessibility/AXObjectCache.h:
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::handleActiveDescendantChanged):
+        * accessibility/chromium/AXObjectCacheChromium.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * accessibility/win/AXObjectCacheWin.cpp:
+        (WebCore::AXObjectCache::postPlatformNotification):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        * editing/Editor.cpp:
+        (WebCore::Editor::respondToChangedContents):
+        * editing/mac/SelectionControllerMac.mm:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+
+2009-05-29  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Build fix for Windows Cairo target.
+        https://bugs.webkit.org/show_bug.cgi?id=25972
+
+        Compiler mistakenly selects SMILTime min/max instead of STL version,
+        resulting in a build error.  This change makes the meaning of the
+        min/max explicit and avoids the problem.
+
+        * html/TimeRanges.h:
+        (WebCore::TimeRanges::Range::unionWithOverlappingOrContiguousRange):
+
+2009-05-29  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Jan Alonzo.
+
+        Make SoupMessage a member of ResourceRequest, instead of creating
+        it in startHttp. Implement updating of ResourceRequest from
+        SoupMessage, and vice versa.
+
+        * GNUmakefile.am:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::~ResourceHandle):
+        (WebCore::gotHeadersCallback):
+        (WebCore::ResourceHandle::startHttp):
+        * platform/network/soup/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::~ResourceRequest):
+        * platform/network/soup/ResourceRequestSoup.cpp: Added.
+        (WTF::SoupURI):
+        (WebCore::ResourceRequest::soupMessage):
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+
+2009-05-28  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26068
+        V8: Remove the remaining b8::Locker usage in worker code.
+        This completes the fix for https://bugs.webkit.org/show_bug.cgi?id=25944,
+        since the patches for enabling timers and that bug have "crossed in the queue".
+        Existing LayoutTests/fast/workers/worker-timeout.html covers this fix (will start work in Chromium).
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+
+2009-05-28  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        Simplify the Accept-Encoding header we are sending out, for it
+        seems some servers do not enjoy parsing the full, explicit
+        version.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startHttp):
+
+2009-05-28  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Added a new build flag --filters. This replaces the old --svg-filters and enables
+        other parts of WebKit to use some basic filters of platform/graphics/filters if needed.
+        This patch also fixes a bug in dom/DOMImplementation.cpp where we used SVG_FILTER. This flag
+        doesn't exist and was replaced by FILTERS as well as all SVG_FILTERS occurrences.
+        Filters are not working yet. This patch is just a preperation. Filters are deactivated by
+        default. 
+
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap):
+        * dom/DOMImplementation.cpp:
+        (WebCore::isSVG10Feature):
+        (WebCore::isSVG11Feature):
+        * page/DOMWindow.idl:
+        * platform/graphics/filters/FEBlend.cpp:
+        * platform/graphics/filters/FEBlend.h:
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        * platform/graphics/filters/FEColorMatrix.h:
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        * platform/graphics/filters/FEComponentTransfer.h:
+        * platform/graphics/filters/FEComposite.cpp:
+        * platform/graphics/filters/FEComposite.h:
+        * platform/graphics/filters/FilterEffect.cpp:
+        * platform/graphics/filters/FilterEffect.h:
+        * platform/graphics/filters/SourceAlpha.cpp:
+        * platform/graphics/filters/SourceAlpha.h:
+        * platform/graphics/filters/SourceGraphic.cpp:
+        * platform/graphics/filters/SourceGraphic.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::selfWillPaint):
+        * rendering/RenderSVGModelObject.cpp:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::selfWillPaint):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::finishRenderSVGContent):
+        (WebCore::SVGRenderBase::filterBoundingBoxForRenderer):
+        * svg/Filter.cpp:
+        * svg/Filter.h:
+        * svg/FilterBuilder.cpp:
+        * svg/FilterBuilder.h:
+        * svg/SVGComponentTransferFunctionElement.cpp:
+        * svg/SVGComponentTransferFunctionElement.h:
+        * svg/SVGComponentTransferFunctionElement.idl:
+        * svg/SVGFEBlendElement.cpp:
+        * svg/SVGFEBlendElement.h:
+        * svg/SVGFEBlendElement.idl:
+        * svg/SVGFEColorMatrixElement.cpp:
+        * svg/SVGFEColorMatrixElement.h:
+        * svg/SVGFEColorMatrixElement.idl:
+        * svg/SVGFEComponentTransferElement.cpp:
+        * svg/SVGFEComponentTransferElement.h:
+        * svg/SVGFEComponentTransferElement.idl:
+        * svg/SVGFECompositeElement.cpp:
+        * svg/SVGFECompositeElement.h:
+        * svg/SVGFECompositeElement.idl:
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        * svg/SVGFEDiffuseLightingElement.h:
+        * svg/SVGFEDiffuseLightingElement.idl:
+        * svg/SVGFEDisplacementMapElement.cpp:
+        * svg/SVGFEDisplacementMapElement.h:
+        * svg/SVGFEDisplacementMapElement.idl:
+        * svg/SVGFEDistantLightElement.cpp:
+        * svg/SVGFEDistantLightElement.h:
+        * svg/SVGFEDistantLightElement.idl:
+        * svg/SVGFEFloodElement.cpp:
+        * svg/SVGFEFloodElement.h:
+        * svg/SVGFEFloodElement.idl:
+        * svg/SVGFEFuncAElement.cpp:
+        * svg/SVGFEFuncAElement.h:
+        * svg/SVGFEFuncAElement.idl:
+        * svg/SVGFEFuncBElement.cpp:
+        * svg/SVGFEFuncBElement.h:
+        * svg/SVGFEFuncBElement.idl:
+        * svg/SVGFEFuncGElement.cpp:
+        * svg/SVGFEFuncGElement.h:
+        * svg/SVGFEFuncGElement.idl:
+        * svg/SVGFEFuncRElement.cpp:
+        * svg/SVGFEFuncRElement.h:
+        * svg/SVGFEFuncRElement.idl:
+        * svg/SVGFEGaussianBlurElement.cpp:
+        * svg/SVGFEGaussianBlurElement.h:
+        * svg/SVGFEGaussianBlurElement.idl:
+        * svg/SVGFEImageElement.cpp:
+        * svg/SVGFEImageElement.h:
+        * svg/SVGFEImageElement.idl:
+        * svg/SVGFELightElement.cpp:
+        * svg/SVGFELightElement.h:
+        * svg/SVGFEMergeElement.cpp:
+        * svg/SVGFEMergeElement.h:
+        * svg/SVGFEMergeElement.idl:
+        * svg/SVGFEMergeNodeElement.cpp:
+        * svg/SVGFEMergeNodeElement.h:
+        * svg/SVGFEMergeNodeElement.idl:
+        * svg/SVGFEOffsetElement.cpp:
+        * svg/SVGFEOffsetElement.h:
+        * svg/SVGFEOffsetElement.idl:
+        * svg/SVGFEPointLightElement.cpp:
+        * svg/SVGFEPointLightElement.h:
+        * svg/SVGFEPointLightElement.idl:
+        * svg/SVGFESpecularLightingElement.cpp:
+        * svg/SVGFESpecularLightingElement.h:
+        * svg/SVGFESpecularLightingElement.idl:
+        * svg/SVGFESpotLightElement.cpp:
+        * svg/SVGFESpotLightElement.h:
+        * svg/SVGFESpotLightElement.idl:
+        * svg/SVGFETileElement.cpp:
+        * svg/SVGFETileElement.h:
+        * svg/SVGFETileElement.idl:
+        * svg/SVGFETurbulenceElement.cpp:
+        * svg/SVGFETurbulenceElement.h:
+        * svg/SVGFETurbulenceElement.idl:
+        * svg/SVGFilterElement.cpp:
+        * svg/SVGFilterElement.h:
+        * svg/SVGFilterElement.idl:
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+        * svg/SVGFilterPrimitiveStandardAttributes.h:
+        * svg/graphics/SVGResourceFilter.cpp:
+        * svg/graphics/SVGResourceFilter.h:
+        * svg/graphics/cairo/SVGResourceFilterCairo.cpp:
+        * svg/graphics/cg/SVGResourceFilterCg.cpp:
+        * svg/graphics/cg/SVGResourceFilterCg.mm:
+        * svg/graphics/filters/SVGDistantLightSource.h:
+        * svg/graphics/filters/SVGFEConvolveMatrix.cpp:
+        * svg/graphics/filters/SVGFEConvolveMatrix.h:
+        * svg/graphics/filters/SVGFEDiffuseLighting.cpp:
+        * svg/graphics/filters/SVGFEDiffuseLighting.h:
+        * svg/graphics/filters/SVGFEDisplacementMap.cpp:
+        * svg/graphics/filters/SVGFEDisplacementMap.h:
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        * svg/graphics/filters/SVGFEFlood.h:
+        * svg/graphics/filters/SVGFEGaussianBlur.cpp:
+        * svg/graphics/filters/SVGFEGaussianBlur.h:
+        * svg/graphics/filters/SVGFEImage.cpp:
+        * svg/graphics/filters/SVGFEImage.h:
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        * svg/graphics/filters/SVGFEMerge.h:
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        * svg/graphics/filters/SVGFEMorphology.h:
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        * svg/graphics/filters/SVGFEOffset.h:
+        * svg/graphics/filters/SVGFESpecularLighting.cpp:
+        * svg/graphics/filters/SVGFESpecularLighting.h:
+        * svg/graphics/filters/SVGFETile.cpp:
+        * svg/graphics/filters/SVGFETile.h:
+        * svg/graphics/filters/SVGFETurbulence.cpp:
+        * svg/graphics/filters/SVGFETurbulence.h:
+        * svg/graphics/filters/SVGFilterEffect.cpp:
+        * svg/graphics/filters/SVGFilterEffect.h:
+        * svg/graphics/filters/SVGLightSource.cpp:
+        * svg/graphics/filters/SVGLightSource.h:
+        * svg/graphics/filters/SVGPointLightSource.h:
+        * svg/graphics/filters/SVGSpotLightSource.h:
+        * svg/graphics/filters/cg/SVGFEHelpersCg.h:
+        * svg/graphics/filters/cg/SVGFEHelpersCg.mm:
+        * svg/graphics/filters/cg/SVGFilterEffectCg.mm:
+        * svg/graphics/filters/cg/WKArithmeticFilter.h:
+        * svg/graphics/filters/cg/WKArithmeticFilter.m:
+        * svg/graphics/filters/cg/WKComponentMergeFilter.h:
+        * svg/graphics/filters/cg/WKComponentMergeFilter.m:
+        * svg/graphics/filters/cg/WKDiffuseLightingFilter.h:
+        * svg/graphics/filters/cg/WKDiffuseLightingFilter.m:
+        * svg/graphics/filters/cg/WKDiscreteTransferFilter.h:
+        * svg/graphics/filters/cg/WKDiscreteTransferFilter.m:
+        * svg/graphics/filters/cg/WKDisplacementMapFilter.h:
+        * svg/graphics/filters/cg/WKDisplacementMapFilter.m:
+        * svg/graphics/filters/cg/WKDistantLightFilter.h:
+        * svg/graphics/filters/cg/WKDistantLightFilter.m:
+        * svg/graphics/filters/cg/WKGammaTransferFilter.h:
+        * svg/graphics/filters/cg/WKGammaTransferFilter.m:
+        * svg/graphics/filters/cg/WKIdentityTransferFilter.h:
+        * svg/graphics/filters/cg/WKIdentityTransferFilter.m:
+        * svg/graphics/filters/cg/WKLinearTransferFilter.h:
+        * svg/graphics/filters/cg/WKLinearTransferFilter.m:
+        * svg/graphics/filters/cg/WKNormalMapFilter.h:
+        * svg/graphics/filters/cg/WKNormalMapFilter.m:
+        * svg/graphics/filters/cg/WKPointLightFilter.h:
+        * svg/graphics/filters/cg/WKPointLightFilter.m:
+        * svg/graphics/filters/cg/WKSpecularLightingFilter.h:
+        * svg/graphics/filters/cg/WKSpecularLightingFilter.m:
+        * svg/graphics/filters/cg/WKSpotLightFilter.h:
+        * svg/graphics/filters/cg/WKSpotLightFilter.m:
+        * svg/graphics/filters/cg/WKTableTransferFilter.h:
+        * svg/graphics/filters/cg/WKTableTransferFilter.m:
+        * svg/graphics/mac/SVGResourceFilterPlatformDataMac.h:
+        * svg/graphics/mac/SVGResourceFilterPlatformDataMac.mm:
+        * svg/graphics/qt/SVGResourceFilterQt.cpp:
+        * svg/graphics/skia/SVGResourceFilterSkia.cpp:
+        * svg/svgtags.in:
+
+2009-05-28  Brett Wilson  <brettw@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26067
+
+        Add casts for scale function to make more explicit what is happening
+        and fix a compiler warning.
+
+        * platform/graphics/IntSize.h:
+        (WebCore::IntSize::scale):
+
+2009-05-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove the returnValueSlot concept from JSDOMWindowBase. Now that windows
+        are not cleared on navigation it is no longer necessary.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData):
+        (WebCore::JSDOMWindowBase::willRemoveFromWindowShell):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::showModalDialog):
+
+2009-05-19  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo and Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25415
+        [GTK][ATK] Please implement support for get_text_at_offset
+
+        Implement atk_text_get_text_{at,after,before}_offset.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-05-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Rubber-stamped by Darin Adler.
+
+        Remove unnecessary destructor from InputElementData/OptionElementData.
+
+        * dom/InputElement.cpp:
+        * dom/InputElement.h:
+        * dom/OptionElement.cpp:
+        * dom/OptionElement.h:
+
+2009-05-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26062
+
+        Refactor code from all virtual methods in HTMLSelectElement (that are also needed for WMLSelectElement)
+        in the recently introduced SelectElement abstract base class. Follow the same design sheme that InputElement uses.
+
+        A follow-up patch can now easily add WMLSelectElement.
+
+        * dom/OptionElement.h:
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::selectAll):
+        (WebCore::SelectElement::saveLastSelection):
+        (WebCore::isOptionElement):
+        (WebCore::isOptionGroupElement):
+        (WebCore::SelectElement::nextSelectableListIndex):
+        (WebCore::SelectElement::previousSelectableListIndex):
+        (WebCore::SelectElement::setActiveSelectionAnchorIndex):
+        (WebCore::SelectElement::setActiveSelectionEndIndex):
+        (WebCore::SelectElement::updateListBoxSelection):
+        (WebCore::SelectElement::listBoxOnChange):
+        (WebCore::SelectElement::menuListOnChange):
+        (WebCore::SelectElement::scrollToSelection):
+        (WebCore::SelectElement::recalcStyle):
+        (WebCore::SelectElement::setRecalcListItems):
+        (WebCore::SelectElement::recalcListItems):
+        (WebCore::SelectElement::selectedIndex):
+        (WebCore::SelectElement::setSelectedIndex):
+        (WebCore::SelectElement::optionToListIndex):
+        (WebCore::SelectElement::listToOptionIndex):
+        (WebCore::SelectElement::dispatchFocusEvent):
+        (WebCore::SelectElement::dispatchBlurEvent):
+        (WebCore::SelectElement::deselectItems):
+        (WebCore::SelectElement::saveFormControlState):
+        (WebCore::SelectElement::restoreFormControlState):
+        (WebCore::SelectElement::parseMultipleAttribute):
+        (WebCore::SelectElement::appendFormData):
+        (WebCore::SelectElement::reset):
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+        (WebCore::SelectElement::defaultEventHandler):
+        (WebCore::SelectElement::lastSelectedListIndex):
+        (WebCore::stripLeadingWhiteSpace):
+        (WebCore::SelectElement::typeAheadFind):
+        (WebCore::SelectElement::insertedIntoTree):
+        (WebCore::SelectElementData::SelectElementData):
+        (WebCore::SelectElementData::checkListItems):
+        (WebCore::SelectElementData::listItems):
+        * dom/SelectElement.h:
+        (WebCore::SelectElementData::multiple):
+        (WebCore::SelectElementData::setMultiple):
+        (WebCore::SelectElementData::size):
+        (WebCore::SelectElementData::setSize):
+        (WebCore::SelectElementData::usesMenuList):
+        (WebCore::SelectElementData::lastOnChangeIndex):
+        (WebCore::SelectElementData::setLastOnChangeIndex):
+        (WebCore::SelectElementData::lastOnChangeSelection):
+        (WebCore::SelectElementData::activeSelectionState):
+        (WebCore::SelectElementData::setActiveSelectionState):
+        (WebCore::SelectElementData::activeSelectionAnchorIndex):
+        (WebCore::SelectElementData::setActiveSelectionAnchorIndex):
+        (WebCore::SelectElementData::activeSelectionEndIndex):
+        (WebCore::SelectElementData::setActiveSelectionEndIndex):
+        (WebCore::SelectElementData::cachedStateForActiveSelection):
+        (WebCore::SelectElementData::shouldRecalcListItems):
+        (WebCore::SelectElementData::setShouldRecalcListItems):
+        (WebCore::SelectElementData::rawListItems):
+        (WebCore::SelectElementData::repeatingChar):
+        (WebCore::SelectElementData::setRepeatingChar):
+        (WebCore::SelectElementData::lastCharTime):
+        (WebCore::SelectElementData::setLastCharTime):
+        (WebCore::SelectElementData::typedString):
+        (WebCore::SelectElementData::setTypedString):
+        * html/HTMLOptionElement.h:
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::HTMLSelectElement):
+        (WebCore::HTMLSelectElement::recalcStyle):
+        (WebCore::HTMLSelectElement::formControlType):
+        (WebCore::HTMLSelectElement::selectedIndex):
+        (WebCore::HTMLSelectElement::deselectItems):
+        (WebCore::HTMLSelectElement::setSelectedIndex):
+        (WebCore::HTMLSelectElement::activeSelectionStartListIndex):
+        (WebCore::HTMLSelectElement::activeSelectionEndListIndex):
+        (WebCore::HTMLSelectElement::saveFormControlState):
+        (WebCore::HTMLSelectElement::restoreFormControlState):
+        (WebCore::HTMLSelectElement::parseMappedAttribute):
+        (WebCore::HTMLSelectElement::canSelectAll):
+        (WebCore::HTMLSelectElement::selectAll):
+        (WebCore::HTMLSelectElement::createRenderer):
+        (WebCore::HTMLSelectElement::appendFormData):
+        (WebCore::HTMLSelectElement::optionToListIndex):
+        (WebCore::HTMLSelectElement::listToOptionIndex):
+        (WebCore::HTMLSelectElement::recalcListItems):
+        (WebCore::HTMLSelectElement::setRecalcListItems):
+        (WebCore::HTMLSelectElement::reset):
+        (WebCore::HTMLSelectElement::dispatchFocusEvent):
+        (WebCore::HTMLSelectElement::dispatchBlurEvent):
+        (WebCore::HTMLSelectElement::defaultEventHandler):
+        (WebCore::HTMLSelectElement::setActiveSelectionAnchorIndex):
+        (WebCore::HTMLSelectElement::setActiveSelectionEndIndex):
+        (WebCore::HTMLSelectElement::updateListBoxSelection):
+        (WebCore::HTMLSelectElement::menuListOnChange):
+        (WebCore::HTMLSelectElement::listBoxOnChange):
+        (WebCore::HTMLSelectElement::saveLastSelection):
+        (WebCore::HTMLSelectElement::setOption):
+        (WebCore::HTMLSelectElement::scrollToSelection):
+        (WebCore::HTMLSelectElement::insertedIntoTree):
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::size):
+        (WebCore::HTMLSelectElement::multiple):
+        (WebCore::HTMLSelectElement::listItems):
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::text):
+        * wml/WMLOptionElement.h:
+
+
+        * dom/OptionElement.h:
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::selectAll):
+        (WebCore::SelectElement::saveLastSelection):
+        (WebCore::isOptionElement):
+        (WebCore::isOptionGroupElement):
+        (WebCore::SelectElement::nextSelectableListIndex):
+        (WebCore::SelectElement::previousSelectableListIndex):
+        (WebCore::SelectElement::setActiveSelectionAnchorIndex):
+        (WebCore::SelectElement::setActiveSelectionEndIndex):
+        (WebCore::SelectElement::updateListBoxSelection):
+        (WebCore::SelectElement::listBoxOnChange):
+        (WebCore::SelectElement::menuListOnChange):
+        (WebCore::SelectElement::scrollToSelection):
+        (WebCore::SelectElement::recalcStyle):
+        (WebCore::SelectElement::setRecalcListItems):
+        (WebCore::SelectElement::recalcListItems):
+        (WebCore::SelectElement::selectedIndex):
+        (WebCore::SelectElement::setSelectedIndex):
+        (WebCore::SelectElement::optionToListIndex):
+        (WebCore::SelectElement::listToOptionIndex):
+        (WebCore::SelectElement::dispatchFocusEvent):
+        (WebCore::SelectElement::dispatchBlurEvent):
+        (WebCore::SelectElement::deselectItems):
+        (WebCore::SelectElement::saveFormControlState):
+        (WebCore::SelectElement::restoreFormControlState):
+        (WebCore::SelectElement::parseMultipleAttribute):
+        (WebCore::SelectElement::appendFormData):
+        (WebCore::SelectElement::reset):
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+        (WebCore::SelectElement::defaultEventHandler):
+        (WebCore::SelectElement::lastSelectedListIndex):
+        (WebCore::stripLeadingWhiteSpace):
+        (WebCore::SelectElement::typeAheadFind):
+        (WebCore::SelectElement::insertedIntoTree):
+        (WebCore::SelectElementData::SelectElementData):
+        (WebCore::SelectElementData::~SelectElementData):
+        (WebCore::SelectElementData::checkListItems):
+        (WebCore::SelectElementData::listItems):
+        * dom/SelectElement.h:
+        (WebCore::SelectElementData::multiple):
+        (WebCore::SelectElementData::setMultiple):
+        (WebCore::SelectElementData::size):
+        (WebCore::SelectElementData::setSize):
+        (WebCore::SelectElementData::usesMenuList):
+        (WebCore::SelectElementData::lastOnChangeIndex):
+        (WebCore::SelectElementData::setLastOnChangeIndex):
+        (WebCore::SelectElementData::lastOnChangeSelection):
+        (WebCore::SelectElementData::activeSelectionState):
+        (WebCore::SelectElementData::setActiveSelectionState):
+        (WebCore::SelectElementData::activeSelectionAnchorIndex):
+        (WebCore::SelectElementData::setActiveSelectionAnchorIndex):
+        (WebCore::SelectElementData::activeSelectionEndIndex):
+        (WebCore::SelectElementData::setActiveSelectionEndIndex):
+        (WebCore::SelectElementData::cachedStateForActiveSelection):
+        (WebCore::SelectElementData::shouldRecalcListItems):
+        (WebCore::SelectElementData::setShouldRecalcListItems):
+        (WebCore::SelectElementData::rawListItems):
+        (WebCore::SelectElementData::repeatingChar):
+        (WebCore::SelectElementData::setRepeatingChar):
+        (WebCore::SelectElementData::lastCharTime):
+        (WebCore::SelectElementData::setLastCharTime):
+        (WebCore::SelectElementData::typedString):
+        (WebCore::SelectElementData::setTypedString):
+        * html/HTMLOptionElement.h:
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::HTMLSelectElement):
+        (WebCore::HTMLSelectElement::recalcStyle):
+        (WebCore::HTMLSelectElement::formControlType):
+        (WebCore::HTMLSelectElement::selectedIndex):
+        (WebCore::HTMLSelectElement::deselectItems):
+        (WebCore::HTMLSelectElement::setSelectedIndex):
+        (WebCore::HTMLSelectElement::activeSelectionStartListIndex):
+        (WebCore::HTMLSelectElement::activeSelectionEndListIndex):
+        (WebCore::HTMLSelectElement::saveFormControlState):
+        (WebCore::HTMLSelectElement::restoreFormControlState):
+        (WebCore::HTMLSelectElement::parseMappedAttribute):
+        (WebCore::HTMLSelectElement::canSelectAll):
+        (WebCore::HTMLSelectElement::selectAll):
+        (WebCore::HTMLSelectElement::createRenderer):
+        (WebCore::HTMLSelectElement::appendFormData):
+        (WebCore::HTMLSelectElement::optionToListIndex):
+        (WebCore::HTMLSelectElement::listToOptionIndex):
+        (WebCore::HTMLSelectElement::recalcListItems):
+        (WebCore::HTMLSelectElement::setRecalcListItems):
+        (WebCore::HTMLSelectElement::reset):
+        (WebCore::HTMLSelectElement::dispatchFocusEvent):
+        (WebCore::HTMLSelectElement::dispatchBlurEvent):
+        (WebCore::HTMLSelectElement::defaultEventHandler):
+        (WebCore::HTMLSelectElement::setActiveSelectionAnchorIndex):
+        (WebCore::HTMLSelectElement::setActiveSelectionEndIndex):
+        (WebCore::HTMLSelectElement::updateListBoxSelection):
+        (WebCore::HTMLSelectElement::menuListOnChange):
+        (WebCore::HTMLSelectElement::listBoxOnChange):
+        (WebCore::HTMLSelectElement::saveLastSelection):
+        (WebCore::HTMLSelectElement::setOption):
+        (WebCore::HTMLSelectElement::scrollToSelection):
+        (WebCore::HTMLSelectElement::insertedIntoTree):
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::size):
+        (WebCore::HTMLSelectElement::multiple):
+        (WebCore::HTMLSelectElement::listItems):
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::text):
+        * wml/WMLOptionElement.h:
+
+2009-05-28  Adam Roben  <aroben@apple.com>
+
+        Don't try to use the new combobox parts on Vista in Classic mode
+
+        Fixes:
+        <rdar://problem/6929277> REGRESSION (r42289+r42350): Windows Classic
+        theme: drop down lists in Preferences get a line/square
+        <rdar://problem/6929298> REGRESSION (r42289): Windows Classic: drop
+        down lists are black with a circle on many sites
+
+        Reviewed by Steve Falkenburg.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::paintMenuList): Only use the new combobox
+        parts when we have a theme (i.e., when we're not in Classic mode).
+        When we don't have a theme, fall back to the pre-r42289 code.
+
+2009-05-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25659
+        Avoid calling frameCount() unnecessarily (which could lead to extra
+        GIF decoding).
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::destroyDecodedDataIfNecessary):
+
+2009-05-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=8736
+
+        Tests: fast/borders/border-radius-constraints.html
+               fast/borders/border-radius-split-inline.html
+               
+        When the sum of the corner radii on a side exceed the length of the side,
+        reduce the radii according to CSS 3 rules.
+        
+        Add RenderStyle::getBorderRadiiForRect() to fetch corner radii, applying
+        the constraints. Use that for painting borders, box-shadow, clipping replaced
+        elements
+
+        * platform/graphics/IntSize.h:
+        (WebCore::IntSize::scale):
+        Add a scale method that scales by a float (using C rounding rules, like IntRect::scale()).
+
+        * platform/graphics/Path.cpp:
+        Make the QUARTER const static.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::pushContentsClip):
+        Use getBorderRadiiForRect to fetch border radii.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        Use getBorderRadiiForRect to fetch border radii.
+
+        (WebCore::RenderBoxModelObject::paintBorder):
+        Use getBorderRadiiForRect to fetch border radii, and fix a bug when drawing
+        borders for split inlines, which used to apply the radii for each segment,
+        and no longer does.
+
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        Use getBorderRadiiForRect to fetch border radii.
+
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        Use getBorderRadiiForRect to fetch border radii for clipping.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        Use getBorderRadiiForRect to fetch border radii for clipping.
+
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::getBorderRadiiForRect):
+        New bottleneck method to fetch corner radiil given a rect, applying the constraint
+        rules.
+
+2009-05-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26005
+        Optimization for XPath //* does not preserve context size
+
+        Test: fast/xpath/position.html
+
+        Fixed the bug by removing the incorrect optimization, and made enough micro-optimizations to
+        get a performance progression on my tests.
+
+        * xml/XPathPath.h: Removed broken optimizeStepPair().
+
+        * xml/XPathPath.cpp:
+        (WebCore::XPath::LocationPath::evaluate): Style fix.
+        (WebCore::XPath::LocationPath::appendStep): Don't call optimizeStepPair().
+        (WebCore::XPath::LocationPath::insertFirstStep): Ditto.
+        (WebCore::XPath::Path::Path): Style fix.
+
+        * xml/XPathStep.cpp:
+        (WebCore::XPath::primaryNodeType): Turned this member function into a static inline helper.
+        (WebCore::XPath::nodeMatches): Ditto. Don't check for namespace axis, which is unsupported
+        (and might never be).
+        (WebCore::XPath::Step::nodesInAxis): Updated for the new nodeMatches() signature.
+
+        * xml/XPathStep.h:
+        (WebCore::XPath::Step::NodeTest::data):
+        (WebCore::XPath::Step::NodeTest::namespaceURI):
+        Made these data members AtomicString to avoid repeated conversions. This is the biggest
+        performance win here.
+
+        * xml/XPathUtil.cpp: (WebCore::XPath::stringValue): Reserve some capacity upfront.
+
+2009-05-28  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        When creating a linear or radial gradient with a single stop
+        at offset 1.0, the Skia layer was allocating 3 stops, but only
+        filling 2, leaving one uninitialized.  Only 2 stops are necessary
+        in this case, at offsets (0.0, 1.0).
+
+        http://bugs.webkit.org/show_bug.cgi?id=26063
+
+        Covered by: LayoutTests/svg/W3C-SVG-1.1/pservers-grad-16-b.svg
+                    LayoutTests/svg/custom/gradient-stop-corner-cases.svg
+                    LayoutTests/svg/custom/js-late-gradient-and-object-creation.svg
+
+        * platform/graphics/skia/GradientSkia.cpp:
+        (WebCore::totalStopsNeeded):
+
+2009-05-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26041
+        Allow adding resource source to WebInspector.SourceFrame asynchronously.
+
+        Provide common implementation for InspectorController::addResourceSourceToFrame and
+        InspectorController::addSourceToFrame methods.
+
+        * bindings/js/JSInspectorControllerCustom.cpp:
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addResourceSourceToFrame):
+        * inspector/InspectorController.h:
+        * inspector/InspectorController.idl:
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.revealLine):
+        (WebInspector.SourceFrame.prototype.highlightLine):
+        (WebInspector.SourceFrame.prototype._loaded):
+        (WebInspector.SourceFrame.prototype._isContentLoaded):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype.setupSourceFrameIfNeeded):
+        (WebInspector.SourceView.prototype._contentLoaded):
+
+2009-05-28  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Xan Lopez.
+
+        After r44177 we had a problem when increasing the size
+        of the window the scrollbars stayed and were not hidden.
+        This was due WebCore giving up on the Scrollbar as it became
+        unnecessary but the GtkAdjustment remained unchanged.
+        So from the point of view of the GtkScrolledWindow scrolling
+        was still necessary and the GtkScrollbar kept being displayed.
+
+        Solve the issue by resetting the GtkAdjustment in the
+        destructor of ScrollbarGtk.
+
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::~ScrollbarGtk):
+
+2009-05-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Clean up window.open()'s use of lexical and dynamic scope.
+
+        (Added one unreviewed tweak: use dynamicFrame instead of lexicalFrame
+        for DOMWindow::allowPopUp.)
+
+        Test: http/tests/security/frameNavigation/context-for-window-open.html
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::toDynamicFrame):
+        (WebCore::processingUserGesture):
+        (WebCore::completeURL):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::createWindow):
+
+2009-05-27  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26056
+        XPath string() function can be very slow
+
+        * xml/XPathUtil.cpp: (WebCore::XPath::stringValue): Use an intermediate Vector when appending.
+
+2009-05-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix <rdar://problem/6927761> <isindex> placeholder text is unstylable
+          and initially not visible
+
+        Test: fast/forms/isindex-placeholder.html
+
+        * css/html4.css: Added a default style for <isindex> placeholder text.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute): Changed to call
+        the new protected function updatePlaceholderVisibility().
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::updatePlaceholderVisibility): Added this
+        protected function to allow HTMLIsIndexElement::parseMappedAttribute()
+        to invoke InputElement::updatePlaceholderVisibility().
+        * html/HTMLIsIndexElement.cpp:
+        (WebCore::HTMLIsIndexElement::parseMappedAttribute): Call
+        updatePlaceholderVisibility() when parsing the placeholder attribute.
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::createInnerTextStyle): If there
+        is no placeholder pseudo-element style, use the normal style.
+
+2009-05-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        More cleanup of DOMWindow related functions.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::willRemoveFromWindowShell): Renamed from JSDOMWindowBase::clear()
+        * bindings/js/JSDOMWindowBase.h:
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::showModalDialog): Update Comment.
+
+        * bindings/js/JSDOMWindowShell.cpp:
+        * bindings/js/JSDOMWindowShell.h:
+        Remove JSDOMWindowShell::clear().  It was unused.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::clearWindowShell):
+
+2009-05-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Miscellaneous cleanup of DOMWindow related functions.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::~JSDOMGlobalObject): Fix poorly named variables.
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::supportsProfiling): Don't jump through hoops
+        checking for null frames if the build does not support profiling.
+        (WebCore::JSDOMWindowBase::clear): Use setCurrentEvent(0) instead of calling
+        clearHelperObjectProperties().  It is clearer.
+        * bindings/js/JSDOMWindowBase.h:
+        Removed now unused clearHelperObjectProperties() function, empty disconnectFrame()
+        function, and the empty destructor.
+        * bindings/js/JSDOMWindowShell.cpp:
+        * bindings/js/JSDOMWindowShell.h:
+        Remove disconnectFrame() which only called JSDOMWindowBase::disconnectFrame(), which
+        is a no-op.
+        * page/Frame.cpp:
+        (WebCore::Frame::~Frame):
+        (WebCore::Frame::pageDestroyed):
+        Remove calls to JSDOMWindowShell::disconnectFrame() which only called
+        JSDOMWindowBase::disconnectFrame(), which is a no-op.
+
+2009-05-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25974
+        Remove extra qualifiers from the ScheduledAction decl.
+
+        * bindings/v8/ScheduledAction.h: Removed extraneous class qualifiers.
+
+2009-05-27  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed make distcheck fix. One more missing file.
+
+        * GNUmakefile.am:
+
+2009-05-27  Antonio Gomes   <antonio.gomes@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fixed trunk build on Linux after r44126.
+
+        * WebCore.pro:
+
+2009-05-27  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6926046> REGRESSION (r43972): http://www.youtube.com/html5 crashes on open
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::load): Don't look for a media engine based on an empty MIME type.
+
+2009-05-27  David Levin  <levin@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 26029: FrameLoader::canLoad should allow calls with just a security origin
+        https://bugs.webkit.org/show_bug.cgi?id=26029
+
+        No functional changes, so no tests.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canLoad):
+        * loader/FrameLoader.h:
+
+2009-05-27  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix.
+
+        Remove file that does not exist from the build.
+
+        * GNUmakefile.am:
+
+2009-05-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Remove two unneeded protected constructors, these classes have pure-virtual functions, and can't be constructed anyway.
+
+        * dom/InputElement.h:
+        * dom/OptionGroupElement.h:
+
+2009-05-27  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=17725
+        XPath should be case insensitive for HTML
+
+        Test: fast/xpath/node-name-case-sensitivity.html
+
+        * xml/XPathStep.cpp: (WebCore::XPath::Step::nodeMatches): Made node name check case insensitive
+        for HTML elements in HTML documents.
+
+2009-05-27  John Sullivan  <sullivan@apple.com>
+
+        fixed <rdar://problem/6925482> repro crash in WebCore::DragController::dragExited dropping 
+        bookmarks (at least) over Top Sites (at least)
+
+        Reviewed by Kevin Decker
+
+        * page/DragController.cpp:
+        (WebCore::DragController::dragExited):
+        nil check m_documentUnderMouse and take the "local file" case if it's nil
+
+2009-05-27  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Gustavo Noronha.
+
+        When building on window, consider Windows specific files.
+
+        * GNUmakefile.am:
+
+2009-05-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26031
+
+        InputElementData is too heavy, save storing two pointers by passing them
+        directly to the static helper functions (the only place which needs them). 
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::dispatchFocusEvent):
+        (WebCore::InputElement::dispatchBlurEvent):
+        (WebCore::InputElement::updatePlaceholderVisibility):
+        (WebCore::InputElement::updateFocusAppearance):
+        (WebCore::InputElement::updateSelectionRange):
+        (WebCore::InputElement::aboutToUnload):
+        (WebCore::InputElement::setValueFromRenderer):
+        (WebCore::InputElement::constrainValue):
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        (WebCore::InputElement::parseSizeAttribute):
+        (WebCore::InputElement::parseMaxLengthAttribute):
+        (WebCore::InputElement::updateValueIfNeeded):
+        (WebCore::InputElement::notifyFormStateChanged):
+        (WebCore::InputElementData::InputElementData):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::HTMLInputElement):
+        (WebCore::HTMLInputElement::updateFocusAppearance):
+        (WebCore::HTMLInputElement::aboutToUnload):
+        (WebCore::HTMLInputElement::dispatchFocusEvent):
+        (WebCore::HTMLInputElement::dispatchBlurEvent):
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::setSelectionRange):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        (WebCore::HTMLInputElement::setFileListFromRenderer):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::constrainValue):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::WMLInputElement):
+        (WebCore::WMLInputElement::dispatchFocusEvent):
+        (WebCore::WMLInputElement::dispatchBlurEvent):
+        (WebCore::WMLInputElement::updateFocusAppearance):
+        (WebCore::WMLInputElement::aboutToUnload):
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::setValueFromRenderer):
+        (WebCore::WMLInputElement::parseMappedAttribute):
+        (WebCore::WMLInputElement::defaultEventHandler):
+        (WebCore::WMLInputElement::constrainValue):
+
+2009-05-27  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=26033
+
+        OptionElementData saves an Element pointer, which is unnessary.
+        Just pass it to the static function calls directly.
+
+        * dom/OptionElement.cpp:
+        (WebCore::OptionElement::setSelectedState):
+        (WebCore::OptionElement::collectOptionText):
+        (WebCore::OptionElement::collectOptionTextRespectingGroupLabel):
+        (WebCore::OptionElement::collectOptionValue):
+        (WebCore::OptionElementData::OptionElementData):
+        * dom/OptionElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::HTMLOptionElement):
+        (WebCore::HTMLOptionElement::text):
+        (WebCore::HTMLOptionElement::value):
+        (WebCore::HTMLOptionElement::setSelected):
+        (WebCore::HTMLOptionElement::setSelectedState):
+        (WebCore::HTMLOptionElement::textIndentedToRespectGroupLabel):
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::WMLOptionElement):
+        (WebCore::WMLOptionElement::setSelectedState):
+        (WebCore::WMLOptionElement::value):
+        (WebCore::WMLOptionElement::textIndentedToRespectGroupLabel):
+
+2009-05-27  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Maciej Stachowiak.
+
+        When building with MinGW, don't use the __declspec(dl{import,export})
+        decorations and rely on the linker to use its nifty auto-import feature.
+        It is extremely hard to get the decorations right with MinGW in general
+        and impossible in WebKit, where the resulting shared library is linking 
+        together some static libraries.
+
+        * config.h:
+
+2009-05-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25613
+
+        Add a WebCore::Widget that can embed GtkWidget with and
+        without a GdkWindow. This can be used to embed any GtkWidget.
+
+        Some bits are directly copied from the Scrollbar implementation
+        but can not be easily shared here.
+
+        * GNUmakefile.am:
+        * platform/gtk/GtkPluginWidget.cpp: Added.
+        (WebCore::GtkPluginWidget::GtkPluginWidget):
+        (WebCore::GtkPluginWidget::invalidateRect):
+        (WebCore::GtkPluginWidget::frameRectsChanged):
+        (WebCore::GtkPluginWidget::paint):
+        * platform/gtk/GtkPluginWidget.h: Added.
+
+2009-05-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25613.
+
+        Implement Widget::setIsSelected for Gtk+ by searching
+        for a property of the name "webkit-widget-is-selected" and if
+        such property exists we are going to set it. We expect
+        the property to take a boolean.
+
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::setIsSelected):
+
+2009-05-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        Fix for <rdar://problem/6916371>
+        iWeb 'Announce' button does nothing after publishing to MobileMe
+
+        Add ability to force content sniffing for all urls (including file: urls)
+
+        * WebCore.base.exp:
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::shouldContentSniffURL):
+        (WebCore::ResourceHandle::forceContentSniffing):
+        * platform/network/ResourceHandle.h:
+
+2009-05-26  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25996
+
+        [Qt] Dead-code stripping for unix
+
+        * WebCore.pro: Turn on GCC dead-code stripping flags for Unix
+
+2009-05-10  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25646
+
+        [GTK] Send onscroll events for the main FrameView
+
+        WebKit/GTK+ is currently not sending any onscroll
+        events for a frame with external adjustments. This is
+        due the fact that the value-changed signal of the GtkAdjustment
+        is handled by WebCore::ScrollView directly and is not going through
+        the WebCore::Scrollbar -> WebCore::ScrollbarClient ->
+        WebCore::FrameView::valueChanged -> WebCore::ScrollView::valueChanged
+        path.
+
+        Fix the above problem by wrapping the GtkAdjustment we get
+        assigned from GTK+ in a ScrollbarGtk that will not have any
+        visual appearance. Remove code from ScrollView that knows
+        about adjustments and create a special case for
+        WebCore::ScrollView::createScrollbar that will create such
+        a special WebCore::ScrollbarGtk.
+
+        * platform/ScrollView.cpp: Remove adjustment code
+        (WebCore::ScrollView::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::setHasVerticalScrollbar):
+        (WebCore::ScrollView::updateScrollbars):
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h: Remove adjustment code
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::platformDestroy):
+        (WebCore::ScrollView::createScrollbar):
+        (WebCore::ScrollView::setGtkAdjustments):
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::createScrollbar): Special case.
+        (ScrollbarGtk::ScrollbarGtk):  New ctor and work on the adjustment
+        (ScrollbarGtk::~ScrollbarGtk): Disconnect signal
+        (ScrollbarGtk::frameRectsChanged): Do nothing when we lack a platformWidget
+        * platform/gtk/ScrollbarGtk.h:
+
+2009-05-26  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 26035: Make ImageSource::frameHasAlphaAtIndex() return false for JPEGs with CG
+        <https://bugs.webkit.org/show_bug.cgi?id=26035>
+        <rdar://problem/6924087>
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::frameHasAlphaAtIndex): return false if the image
+        is JPEG, there is no image type, or m_decoder is null.
+
+2009-05-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix for the JPEGImageDecoder.
+
+        Revision 44167 removed stdio.h from the included headers and
+        this will lead to an error that FILE is not known inside the
+        jpeglib.h Put back the stdio.h include.
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+
+2009-05-26  Yichao Yin  <yichao.yin@torchmobile.com.cn>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix the crash issue while running layout tests after enalbed XHTMLMP
+        https://bugs.webkit.org/show_bug.cgi?id=26017
+
+        * dom/Document.cpp:
+        (WebCore::Document::isXHTMLMPDocument):
+
+2009-05-26  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6901751> 
+        REGRESSION (r35515): Tiger crash painting the selection on registration page of car2go.com
+        
+        Don't use the WKCGContextIsSafeToClip function; it wasn't working correctly. Instead, just disable
+        the improved selection drawing on Tiger.
+        
+        * WebCore.Tiger.exp:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::clipPath):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::strokeRect):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::fillSelectionGaps):
+
+2009-05-26  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25709 part two
+        Mostly cosmetic changes, mainly to get image decoders for Cairo build to
+        comply with WebKit style guidelines:
+        * Fix header guard names
+        * Fix initializer list wrapping
+        * Fix class/function "{" wrapping
+        * Fix wrapping of long boolean expressions
+        * Fix whitespace around operators
+        * Eliminate whitespace on otherwise-blank lines
+        * No {} on single-line conditional arms
+        * Use 0 instead of NULL
+        * Don't #include "config.h" in headers
+
+        Also a few non-cosmetic changes:
+        * Remove unneeded #ifdef protecting the contents of these files.  The
+          platforms listed don't match who uses these files anymore (even
+          without considering Skia), and platforms which don't use them at all
+          (like CG) aren't harmed by the files, since they don't have
+          equivalently-named classes.  It's simpler to just ditch these.
+        * Convert a use of Vector<>& into SharedBuffer*, since that's how the
+          data is really stored anyway.
+        * Use size() instead of m_size, for consistency with Skia code, and
+          future-proofing (if a particular decoder wants to specialize this).
+        * Move an ASSERT that was slightly more aggressive than necessary.
+        * Change variable names/types for clarity/accuracy and to match Skia.
+        * Remove unnecessary macro magic to work around a problem which no
+          longer exists in the third-party JPEG headers.
+        * Stop silencing a portability warning about setjmp (the vcproj/vsprops
+          are the right place for this)
+        * In Skia code, don't explicitly check |m_failed| before calling
+          isSizeAvailable(), which itself checks |m_failed|.
+
+        * platform/image-decoders/ImageDecoder.h: Fix header guards, "{" wrapping.
+        (WebCore::RGBA32Buffer::):
+        (WebCore::RGBA32Buffer::RGBA32Buffer): Fix initializer list wrapping.
+        (WebCore::ImageDecoder::ImageDecoder): Fix initializer list wrapping.
+        * platform/image-decoders/bmp/BMPImageDecoder.cpp: Remove unneeded #ifdef.
+        * platform/image-decoders/bmp/BMPImageDecoder.h: Fix header guards, "{" wrapping.
+        * platform/image-decoders/gif/GIFImageDecoder.cpp: Remove unneeded #ifdef, fix "{" wrapping.
+        (WebCore::GIFImageDecoderPrivate::GIFImageDecoderPrivate): Use an initializer instead of a block-level statement.
+        (WebCore::GIFImageDecoderPrivate::decode): Expect a SharedBuffer.
+        (WebCore::GIFImageDecoderPrivate::getColorMap):
+        (WebCore::GIFImageDecoder::GIFImageDecoder): Fix initializer list wrapping.
+        (WebCore::GIFImageDecoder::frameCount): Add comment.
+        (WebCore::GIFImageDecoder::frameBufferAtIndex): Explicitly cast, fix whitespace around operators.
+        (WebCore::GIFImageDecoder::decode): Pass a SharedBuffer.
+        (WebCore::GIFImageDecoder::initFrameBuffer): Use size() instead of m_size, move ASSERT, fix boolean wrapping, fix indenting.
+        (WebCore::GIFImageDecoder::prepEmptyFrameBuffer): Use size() instead of m_size.
+        (WebCore::GIFImageDecoder::haveDecodedRow): Use size() instead of m_size, eliminate unneeded whitespace, change variable name.
+        (WebCore::GIFImageDecoder::frameComplete): Use size() instead of m_size, no {} on single-line conditional arms, fix boolean wrapping.
+        * platform/image-decoders/gif/GIFImageDecoder.h: Fix header guards, "{" wrapping.
+        * platform/image-decoders/gif/GIFImageReader.cpp: Remove unneeded #ifdef.
+        (GIFImageReader::read):
+        * platform/image-decoders/gif/GIFImageReader.h: Fix header guards, change variable type.
+        * platform/image-decoders/ico/ICOImageDecoder.cpp: Remove unneeded #ifdef.
+        * platform/image-decoders/ico/ICOImageDecoder.h: Fix header guards, "{" wrapping.
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp: Remove unneeded #ifdef, macro magic, silencing of warning.
+        (WebCore::JPEGImageDecoder::outputScanlines): Use size() instead of m_size, change variable name.
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h: Fix header guards, "{" wrapping.
+        * platform/image-decoders/png/PNGImageDecoder.cpp: Remove unneeded #ifdef, silencing of warning, change variable type.
+        (WebCore::PNGImageReader::PNGImageReader): Fix initializer list wrapping.
+        (WebCore::PNGImageReader::close): Add comment, zero another member for consistency.
+        (WebCore::PNGImageDecoder::PNGImageDecoder): Fix indenting.
+        (WebCore::PNGImageDecoder::decodingFailed): Define in .cpp, not .h.
+        (WebCore::PNGImageDecoder::rowAvailable):
+        * platform/image-decoders/png/PNGImageDecoder.h: Fix header guards, "{" wrapping.
+        * platform/image-decoders/skia/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::isSizeAvailable): Don't check m_failed unnecessarily.
+        (WebCore::GIFImageDecoder::frameBufferAtIndex): Fix whitespace around operators.
+        * platform/image-decoders/skia/GIFImageReader.h: "unsigned" is sufficient to convey "unsigned int".
+        * platform/image-decoders/skia/ImageDecoder.h: Remove unnecessary #includes.
+        (WebCore::ImageDecoder::ImageDecoder): Fix initializer list wrapping.
+        * platform/image-decoders/skia/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageReader::JPEGImageReader): Use 0 instead of NULL.
+        (WebCore::JPEGImageDecoder::isSizeAvailable): Don't check m_failed unnecessarily.
+        * platform/image-decoders/skia/PNGImageDecoder.cpp:
+        (WebCore::PNGImageReader::PNGImageReader): Fix initializer list wrapping.
+        (WebCore::PNGImageDecoder::PNGImageDecoder): Fix indenting.
+        (WebCore::PNGImageDecoder::isSizeAvailable): Don't check m_failed unnecessarily.
+        (WebCore::rowAvailable):
+        * platform/image-decoders/skia/XBMImageDecoder.h: Don't #include config.h.
+        * platform/image-decoders/xbm/XBMImageDecoder.cpp: Remove unneeded #ifdef.
+        * platform/image-decoders/xbm/XBMImageDecoder.h: Fix header guards, "{" wrapping.
+
+2009-05-26  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25944
+        Remove the uses of V8 Locker in worker execution code. No additional test is needed.
+        The normal WebKit layout tests should cover it. However, layout tests that start
+        multiple workers will fail to pass due to test shell limitation in Chromium. To cover
+        this, UI tests will be added (http://code.google.com/p/chromium/issues/detail?id=12554).
+
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::initV8IfNeeded):
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListenerHelper):
+        (WebCore::WorkerContextExecutionProxy::RemoveEventListener):
+
+2009-05-26  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25974
+        Enable timers in Chromuim workers.
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute): Added function which can execute a callback using WorkerContext.
+        * bindings/v8/ScheduledAction.h:
+        (WebCore::ScheduledAction::ScheduledAction): added url parameter to capture the worker's location.
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::SetTimeoutOrInterval): replaced NotImplemented with code to create ScheduledAction and DOMTimer.
+        Also, removed declarations for clearTimeout/clearInterval callbacks since they are now directly generated from IDL.
+
+2009-05-26  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23649
+        Update V8 bindings to match SQLTransactionErrorCallback change.
+
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
+        (WebCore::V8CustomSQLTransactionErrorCallback::handleEvent): Changed to return void.
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.h: Ditto.
+
+2009-05-26  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Move FilterEffect to platform/graphics/filters. First step to get an
+        SVG independent filter system.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/FilterEffect.cpp: Added.
+        (WebCore::FilterEffect::FilterEffect):
+        (WebCore::FilterEffect::~FilterEffect):
+        (WebCore::FilterEffect::externalRepresentation):
+        * platform/graphics/filters/FilterEffect.h: Added.
+        (WebCore::FilterEffect::xBoundingBoxMode):
+        (WebCore::FilterEffect::setXBoundingBoxMode):
+        (WebCore::FilterEffect::yBoundingBoxMode):
+        (WebCore::FilterEffect::setYBoundingBoxMode):
+        (WebCore::FilterEffect::widthBoundingBoxMode):
+        (WebCore::FilterEffect::setWidthBoundingBoxMode):
+        (WebCore::FilterEffect::heightBoundingBoxMode):
+        (WebCore::FilterEffect::setHeightBoundingBoxMode):
+        (WebCore::FilterEffect::subRegion):
+        (WebCore::FilterEffect::setSubRegion):
+        (WebCore::FilterEffect::resultImage):
+        (WebCore::FilterEffect::setEffectBuffer):
+        * svg/FilterEffect.cpp: Removed.
+        * svg/FilterEffect.h: Removed.
+
+2009-05-26  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23649
+        Update SQLTransactionErrorCallback to not return a value per changes in
+        HTML5 spec.
+
+        Test: storage/transaction-error-callback.html
+
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::SQLTransaction):
+        (WebCore::SQLTransaction::postflightAndCommit):
+        (WebCore::SQLTransaction::handleTransactionError):
+        (WebCore::SQLTransaction::deliverTransactionErrorCallback):
+        (WebCore::SQLTransaction::cleanupAfterTransactionErrorCallback):
+        * storage/SQLTransaction.h:
+        * storage/SQLTransactionErrorCallback.h:
+
+2009-05-26  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=25969
+
+        Detect the case where we can fit without scrollbars when the view shrinks, so that we don't mistakenly
+        continue to show scrollbars.
+
+        Added two tests in fast/dynamic.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+2009-05-26  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 25801: change AccessibilityAria -> AccessibilityARIA
+        https://bugs.webkit.org/show_bug.cgi?id=25801
+
+        * GNUmakefile.am:
+        * WebCore.order:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * accessibility/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::getOrCreate):
+        * accessibility/AccessibilityARIAGrid.cpp: Copied from WebCore/accessibility/AccessibilityAriaGrid.cpp.
+        (WebCore::AccessibilityARIAGrid::AccessibilityARIAGrid):
+        (WebCore::AccessibilityARIAGrid::~AccessibilityARIAGrid):
+        (WebCore::AccessibilityARIAGrid::create):
+        (WebCore::AccessibilityARIAGrid::addChild):
+        (WebCore::AccessibilityARIAGrid::addChildren):
+        (WebCore::AccessibilityARIAGrid::cellForColumnAndRow):
+        * accessibility/AccessibilityARIAGrid.h: Copied from WebCore/accessibility/AccessibilityAriaGrid.h.
+        * accessibility/AccessibilityARIAGridCell.cpp: Copied from WebCore/accessibility/AccessibilityAriaGridCell.cpp.
+        (WebCore::AccessibilityARIAGridCell::AccessibilityARIAGridCell):
+        (WebCore::AccessibilityARIAGridCell::~AccessibilityARIAGridCell):
+        (WebCore::AccessibilityARIAGridCell::create):
+        (WebCore::AccessibilityARIAGridCell::parentTable):
+        (WebCore::AccessibilityARIAGridCell::rowIndexRange):
+        (WebCore::AccessibilityARIAGridCell::columnIndexRange):
+        * accessibility/AccessibilityARIAGridCell.h: Copied from WebCore/accessibility/AccessibilityAriaGridCell.h.
+        * accessibility/AccessibilityARIAGridRow.cpp: Copied from WebCore/accessibility/AccessibilityAriaGridRow.cpp.
+        (WebCore::AccessibilityARIAGridRow::AccessibilityARIAGridRow):
+        (WebCore::AccessibilityARIAGridRow::~AccessibilityARIAGridRow):
+        (WebCore::AccessibilityARIAGridRow::create):
+        (WebCore::AccessibilityARIAGridRow::parentTable):
+        (WebCore::AccessibilityARIAGridRow::headerObject):
+        * accessibility/AccessibilityARIAGridRow.h: Copied from WebCore/accessibility/AccessibilityAriaGridRow.h.
+        * accessibility/AccessibilityAriaGrid.cpp: Removed.
+        * accessibility/AccessibilityAriaGrid.h: Removed.
+        * accessibility/AccessibilityAriaGridCell.cpp: Removed.
+        * accessibility/AccessibilityAriaGridCell.h: Removed.
+        * accessibility/AccessibilityAriaGridRow.cpp: Removed.
+        * accessibility/AccessibilityAriaGridRow.h: Removed.
+
+2009-05-26  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26012
+
+        Fix the Skia path to normalize the given source rect when
+        drawing patterns, so it accepts negative width/height (as CG does).
+        Fixes Chromium bug http://www.crbug.com/6167.
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::Image::drawPattern):
+
+2009-05-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Serialize calls to WebInspector. This is the first step where method 
+        calls are being serialized to arrays (not yet JSON stringified ones) and 
+        are being dispatched on the client. This change also allows client to override 
+        InspectorFrontend, so that the serialized calls can be made on a given object
+        instead of in-process WebInspector global. This will be the main control flow
+        when InspectorController is decoupled from the in-process frontend.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26010
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::overrideFrontendObject):
+        (WebCore::InspectorController::show):
+        (WebCore::InspectorController::populateScriptObjects):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        (WebCore::InspectorFrontend::addResource):
+        (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::removeResource):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        (WebCore::InspectorFrontend::setAttachedWindow):
+        (WebCore::InspectorFrontend::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorFrontend::showPanel):
+        (WebCore::InspectorFrontend::populateInterface):
+        (WebCore::InspectorFrontend::reset):
+        (WebCore::InspectorFrontend::debuggerWasEnabled):
+        (WebCore::InspectorFrontend::debuggerWasDisabled):
+        (WebCore::InspectorFrontend::profilerWasEnabled):
+        (WebCore::InspectorFrontend::profilerWasDisabled):
+        (WebCore::InspectorFrontend::parsedScriptSource):
+        (WebCore::InspectorFrontend::failedToParseScriptSource):
+        (WebCore::InspectorFrontend::addProfile):
+        (WebCore::InspectorFrontend::setRecordingProfile):
+        (WebCore::InspectorFrontend::pausedScript):
+        (WebCore::InspectorFrontend::resumedScript):
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        (WebCore::InspectorFrontend::newFunctionCall):
+        (WebCore::InspectorFrontend::callSimpleFunction):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/inspector.js:
+        (WebInspector.dispatch):
+
+2009-05-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6918671> REGRESSION (r41700): Crashes in debug DumpRenderTree at RefCountedBase::ref().
+
+        * dom/QualifiedName.cpp: (WebCore::QualifiedName::QualifiedName):
+        * dom/QualifiedName.h: (WebCore::QualifiedName::QualifiedNameImpl::QualifiedNameImpl):
+        Adjust empty namespace before QNameComponentsTranslator black magic, not after.
+
+2009-05-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Maciej Stachowiak and Oliver Hunt.
+
+        Added forwarding headers.
+
+        * ForwardingHeaders/wtf/CrossThreadRefCounted.h: Added.
+        * ForwardingHeaders/wtf/OwnFastMallocPtr.h: Added.
+
+2009-05-25  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - WebCore side of <rdar://problem/6914001>.
+
+        Add a new m_allowPopupsFromPlugin flag.
+        
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        (WebCore::ScriptController::processingUserGesture):
+        * bindings/js/ScriptController.h:
+        (WebCore::ScriptController::setAllowPopupsFromPlugin):
+        (WebCore::ScriptController::allowPopupsFromPlugin):
+
+2009-05-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26006
+
+        Sort out our use of dynamicGlobalObject and lexicalGlobalObject for
+        window.location.  The correct use appears to be as follows:
+
+        1) Use dynamicGlobalObject to find the user gesture.
+        2) Use dynamicGlobalObject to complete URLs.
+        3) Use lexicalGlobalObject to find the referrer.
+        4) Use lexicalGlobalObject for the frame navigation checks.
+        5) Use lexicalGlobalObject for the XSS checks.
+
+        Tests: http/tests/security/frameNavigation/context-for-location-assign.html
+               http/tests/security/frameNavigation/context-for-location-href.html
+               http/tests/security/frameNavigation/context-for-location.html
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::shouldAllowNavigation):
+        (WebCore::toLexicalFrame):
+        (WebCore::processingUserGesture):
+        (WebCore::completeURL):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::navigateIfAllowed):
+        (WebCore::JSLocation::setHref):
+        (WebCore::JSLocation::replace):
+        (WebCore::JSLocation::reload):
+        (WebCore::JSLocation::assign):
+        (WebCore::JSLocation::toString):
+        (WebCore::JSLocationPrototype::customPut):
+        * bindings/v8/V8Utilities.cpp:
+        (WebCore::processingUserGesture):
+        (WebCore::shouldAllowNavigation):
+        (WebCore::completeURL):
+        (WebCore::navigateIfAllowed):
+        * bindings/v8/V8Utilities.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetLocation):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-05-25  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Maciej Stachowiak.
+
+        With Windows compilers older then MSVC 2005, the functions
+        gmtime_s and localtime_s don't exist. The gmtime and localtime are
+        on Windows always thread safe. So use them in the cases where
+        gmtime_s and localtime_s are not present.
+
+        * loader/FTPDirectoryDocument.cpp:
+        * loader/FTPDirectoryParser.cpp:
+
+2009-05-25  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        Follow up on r44120. PluginPackageMac.cpp is used
+        by Qt on Mac and contained a copy of the m_browserFunc
+        assignments and ::equal, ::hash and ::compareFileVersion.
+        Change it to use the ones from PluginPackage.cpp as well.
+
+        * plugins/mac/PluginPackageMac.cpp:
+        (WebCore::PluginPackage::load):
+
+2009-05-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25612
+
+        Support conditionals in the tag factories, by placing
+        feature #ifdefs around the individual factory functions
+        and the registration.
+
+        Made the Audio and Video elements conditional in the tag factories
+
+        * html/HTMLTagNames.in:
+        * dom/make_names.pl:
+
+2009-05-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Gtk build when video is disabled.
+
+        * GNUmakefile.am: Always generate and compile the IDL files for the media
+        elements. They contain proper feature #ifdefs.
+
+2009-05-25  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build when video is disabled.
+
+        * WebCore.pro: Always generate the IDL files for the media elements. They
+        contain proper ENABLE(VIDEO) #ifdefs.
+
+2009-05-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=26004
+
+        The origin for postMessage should follow lexical scope, not dynamic
+        scope.  Yes, this is a super-obscure corner case.
+
+        Test: http/tests/security/postMessage/origin-follows-lexical-scope.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::postMessage):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-05-24  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix build bustage related to PassOwnPtr changes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25999
+
+        * platform/graphics/chromium/TransparencyWin.cpp:
+
+2009-05-24  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25988
+
+        Minor cleanup in PluginPackage::hash. Let the compiler
+        figure out the size of the array. Do not have it in the
+        definition and specially not the in the call to
+        StringImpl::hash.
+
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::hash):
+
+2009-05-24  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25988
+
+        Move ::hash, ::equal and ::compareFileVersion from
+        the duplicated copies in PluginPackageQt.cpp and
+        PluginPackageGtk to PluginPackage.cpp. We need to #ifdef
+        this for the PluginPackageWin version. Use the new style
+        ENABLE() for this feature/policy and enable it in the Gtk+
+        and Qt buildsystem.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::hash):
+        (WebCore::PluginPackage::equal):
+        (WebCore::PluginPackage::compareFileVersion):
+        * plugins/gtk/PluginPackageGtk.cpp:
+        * plugins/qt/PluginPackageQt.cpp:
+
+2009-05-24  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25988
+
+        So far the initialization of the browserfuncs struct
+        is done in PluginPackageQt, PluginPackageGtk and
+        PluginPackageWin there is no need for this duplication.
+
+        The PluginPackageWin version got copied to PluginPackage
+
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::initializeBrowserFuncs):
+        * plugins/PluginPackage.h:
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::PluginPackage::load):
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::load):
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::load):
+
+2009-05-24  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        WebKit needs cross-platform filter system
+        [https://bugs.webkit.org/show_bug.cgi?id=19991]
+
+        Added standard input for filter system.
+
+        No testcases were added. Filter system is still off.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/filters/SourceAlpha.cpp: Added.
+        (WebCore::SourceAlpha::create):
+        (WebCore::SourceAlpha::effectName):
+        (WebCore::SourceAlpha::apply):
+        (WebCore::SourceAlpha::dump):
+        * platform/graphics/filters/SourceAlpha.h: Added.
+        (WebCore::SourceAlpha::SourceAlpha):
+        * platform/graphics/filters/SourceGraphic.cpp: Added.
+        (WebCore::SourceGraphic::create):
+        (WebCore::SourceGraphic::effectName):
+        (WebCore::SourceGraphic::apply):
+        (WebCore::SourceGraphic::dump):
+        * platform/graphics/filters/SourceGraphic.h: Added.
+        (WebCore::SourceGraphic::SourceGraphic):
+        * svg/FilterBuilder.cpp: Added.
+        (WebCore::FilterBuilder::FilterBuilder):
+        (WebCore::FilterBuilder::add):
+        (WebCore::FilterBuilder::getEffectById):
+        (WebCore::FilterBuilder::clearEffects):
+        * svg/FilterBuilder.h:
+
+2009-05-24  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25612
+
+        Add support conditionals in the JSC bindings generator code for attributes,
+        by placing feature #ifdefs around the setters/getters.
+
+        Made the audio and video element specific DOM attributes conditional
+        in the generated code, by moving the #ifdefs from the IDL files into
+        the generated code. This allows for re-using the same generated code
+        with or without ENABLE(VIDEO).
+
+        * page/DOMWindow.idl:
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-05-23  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix for Qt. Change signature to have PassOwnPtr.
+
+        * platform/text/qt/TextCodecQt.cpp:
+        (WebCore::newTextCodecQt):
+
+2009-05-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - clean up ColorMac a little
+
+        * platform/graphics/mac/ColorMac.h: Whitespace change.
+        * platform/graphics/mac/ColorMac.mm: Removed redundant #import
+        statements and sorted the remaining ones.
+        (WebCore::makeRGBAFromNSColor): Replaced four Objective-C method calls
+        with a single call and removed redundant casts to int.
+        (WebCore::nsColor): Removed ".0f" from number literals used as CGFloats.
+        In one case, this avoids an intermediate conversion to float before
+        conversion to double on 64-bit.
+        (WebCore::CGColorFromNSColor): Replaced four Objective-C method calls
+        with a single call.
+        (WebCore::focusRingColor):
+        (+[WebCoreControlTintObserver controlTintDidChange]): Whitespace change.
+
+2009-05-23  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] ROLE_ROW_HEADER should not be used for list item bullets/numbers
+        https://bugs.webkit.org/show_bug.cgi?id=25900
+
+        Use ATK_ROLE_TEXT for ListMarkerRole.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (atkRole):
+
+2009-05-23  David Kilzer  <ddkilzer@apple.com>
+
+        Reformat WebCore::requiresContextForWordBoundary()
+
+        * platform/text/TextBoundaries.h:
+        (WebCore::requiresContextForWordBoundary):
+
+2009-05-23  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Roll out ResourceHandle patch, that I accidently included in my last commit.
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::shouldContentSniffURL):
+
+2009-05-23  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=23808
+
+        After a long journey, add the last missing ABC to share form control element support with HTMLSelectElement.
+        RenderListBox/RenderMenuList operates on SelectElement instead of HTMLSelectElement now, querying selected index etc.
+        This makes it possible to use these render objects for ie. WML, as it's done before for input & option elements.
+
+        WMLSelectElement will be created soon, in a follow-up patch, adding more methods to SelectElement, sharing code between
+        HTMLSelectElement/WMLSelectElement.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * accessibility/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::addChildren):
+        (WebCore::AccessibilityListBox::doAccessibilityHitTest):
+        * accessibility/AccessibilityListBoxOption.cpp:
+        (WebCore::AccessibilityListBoxOption::listBoxOptionIndex):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::actionElement):
+        * dom/Element.h:
+        (WebCore::Element::isFormControlElement):
+        (WebCore::Element::dispatchFormControlChangeEvent):
+        * dom/SelectElement.cpp: Added.
+        (WebCore::toSelectElement):
+        * dom/SelectElement.h: Added.
+        (WebCore::SelectElement::~SelectElement):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::dispatchFormControlChangeEvent):
+        * html/HTMLFormControlElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setChecked):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::index):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::selectedIndex):
+        (WebCore::HTMLSelectElement::lastSelectedListIndex):
+        (WebCore::HTMLSelectElement::deselectItems):
+        (WebCore::HTMLSelectElement::setSelectedIndex):
+        (WebCore::HTMLSelectElement::length):
+        (WebCore::HTMLSelectElement::remove):
+        (WebCore::HTMLSelectElement::value):
+        (WebCore::HTMLSelectElement::setValue):
+        (WebCore::HTMLSelectElement::saveFormControlState):
+        (WebCore::HTMLSelectElement::restoreFormControlState):
+        (WebCore::HTMLSelectElement::selectAll):
+        (WebCore::HTMLSelectElement::appendFormData):
+        (WebCore::HTMLSelectElement::optionToListIndex):
+        (WebCore::HTMLSelectElement::listToOptionIndex):
+        (WebCore::HTMLSelectElement::recalcListItems):
+        (WebCore::HTMLSelectElement::reset):
+        (WebCore::HTMLSelectElement::dispatchFocusEvent):
+        (WebCore::HTMLSelectElement::dispatchBlurEvent):
+        (WebCore::HTMLSelectElement::menuListDefaultEventHandler):
+        (WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
+        (WebCore::HTMLSelectElement::setActiveSelectionAnchorIndex):
+        (WebCore::HTMLSelectElement::updateListBoxSelection):
+        (WebCore::HTMLSelectElement::menuListOnChange):
+        (WebCore::HTMLSelectElement::listBoxOnChange):
+        (WebCore::HTMLSelectElement::saveLastSelection):
+        (WebCore::HTMLSelectElement::typeAheadFind):
+        (WebCore::HTMLSelectElement::nextSelectableListIndex):
+        (WebCore::HTMLSelectElement::previousSelectableListIndex):
+        (WebCore::HTMLSelectElement::setLength):
+        (WebCore::HTMLSelectElement::checkListItems):
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::size):
+        (WebCore::HTMLSelectElement::multiple):
+        (WebCore::HTMLSelectElement::listItems):
+        (WebCore::HTMLSelectElement::setActiveSelectionEndIndex):
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::shouldContentSniffURL):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::valueChanged):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::RenderListBox):
+        (WebCore::RenderListBox::updateFromElement):
+        (WebCore::RenderListBox::scrollToRevealSelection):
+        (WebCore::RenderListBox::size):
+        (WebCore::RenderListBox::numItems):
+        (WebCore::RenderListBox::paintItemForeground):
+        (WebCore::RenderListBox::paintItemBackground):
+        (WebCore::RenderListBox::panScroll):
+        (WebCore::RenderListBox::autoscroll):
+        (WebCore::RenderListBox::stopAutoscroll):
+        (WebCore::RenderListBox::valueChanged):
+        (WebCore::RenderListBox::nodeAtPoint):
+        * rendering/RenderListBox.h:
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::RenderMenuList):
+        (WebCore::RenderMenuList::updateOptionsWidth):
+        (WebCore::RenderMenuList::updateFromElement):
+        (WebCore::RenderMenuList::setTextFromOption):
+        (WebCore::RenderMenuList::showPopup):
+        (WebCore::RenderMenuList::valueChanged):
+        (WebCore::RenderMenuList::itemText):
+        (WebCore::RenderMenuList::itemIsEnabled):
+        (WebCore::RenderMenuList::itemStyle):
+        (WebCore::RenderMenuList::itemBackgroundColor):
+        (WebCore::RenderMenuList::listSize):
+        (WebCore::RenderMenuList::selectedIndex):
+        (WebCore::RenderMenuList::itemIsSeparator):
+        (WebCore::RenderMenuList::itemIsLabel):
+        (WebCore::RenderMenuList::itemIsSelected):
+        (WebCore::RenderMenuList::setTextFromItem):
+        * rendering/RenderMenuList.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::setValueForPosition):
+
+2009-05-23  David Kilzer  <ddkilzer@apple.com>
+
+        Fix Gtk/Qt builds for PassOwnPtr
+
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern): Use an OwnPtr<ImageBuffer>
+        instead of an std::auto_ptr<ImageBuffer> to store the result of
+        ImageBuffer::create() now that it returns a
+        PassOwnPtr<ImageBuffer>.
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::strokeContains): Ditto.
+        (WebCore::Path::strokeBoundingRect): Ditto.
+
+2009-05-23  David Kilzer  <ddkilzer@apple.com>
+
+        Part 2 of 2: Bug 25495: Implement PassOwnPtr and replace uses of std::auto_ptr
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25495>
+
+        Reviewed by Oliver Hunt.
+
+        No test cases added since there is no change in behavior.
+
+        * WebCore.base.exp: Updated export for
+        HistoryItem::setRedirectURLs() which now takes a PassOwnPtr.
+        * dom/Node.cpp:
+        (WebCore::Node::childNodes): Use NodeListsNodeData::create()
+        instead of new NodeListsNodeData.
+        (WebCore::Node::registerDynamicNodeList): Ditto.
+        (WebCore::Node::getElementsByTagNameNS): Ditto.
+        (WebCore::Node::getElementsByName): Ditto.
+        (WebCore::Node::getElementsByClassName): Ditto.
+        * dom/NodeRareData.h:
+        (WebCore::NodeListsNodeData::create): Added.  Implements
+        create() pattern popularized by RefCounted classes.
+        (WebCore::NodeListsNodeData::NodeListsNodeData): Declared
+        private constructor.
+        (WebCore::NodeRareData::setNodeLists): Now takes a PassOwnPtr<>
+        instead of an auto_ptr<>.
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::setRedirectURLs): Ditto.
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::setRedirectURLs): Ditto.
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawTextInternal): Use
+        OwnPtr<> instead of auto_ptr<> for stack variable.
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createImageBuffer): Updated to use
+        assignment operator now that ImageBuffer::create() returns a
+        PassOwnPtr<>.
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::createHTMLParserQuirks): Return a
+        PassOwnPtr<> instead of a raw HTMLParserQuirks pointer.
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::createHTMLParserQuirks): Ditto.
+        * platform/graphics/GeneratedImage.cpp:
+        (WebCore::GeneratedImage::drawPattern): Use OwnPtr<> instead of
+        auto_ptr<> for stack variable.
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::ImageBuffer::create): Return PassOwnPtr<> instead of
+        auto_ptr<>.  Use OwnPtr<> instead of auto_ptr<> for stack
+        variable.
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint): Use OwnPtr<> instead of
+        auto_ptr<> for stack variable.
+        * platform/text/TextCodec.h:
+        (WebCore::NewTextCodecFunction): Return PassOwnPtr<> instead of
+        auto_ptr<>.
+        * platform/text/TextCodecICU.cpp:
+        (WebCore::newTextCodecICU): Ditto.
+        * platform/text/TextCodecLatin1.cpp:
+        (WebCore::newStreamingTextDecoderWindowsLatin1): Ditto.
+        * platform/text/TextCodecUTF16.cpp:
+        (WebCore::newStreamingTextDecoderUTF16LE): Ditto.
+        (WebCore::newStreamingTextDecoderUTF16BE): Ditto.
+        * platform/text/TextCodecUserDefined.cpp:
+        (WebCore::newStreamingTextDecoderUserDefined): Ditto.
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::newTextCodec): Ditto.
+        * platform/text/TextEncodingRegistry.h:
+        (WebCore::newTextCodec): Ditto.
+        * platform/text/mac/TextCodecMac.cpp:
+        (WebCore::newTextCodecMac): Ditto.
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended): Use
+        OwnPtr<> instead of auto_ptr<> for stack variable.
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent): Ditto.  Return
+        OwnPtr<> instead of auto_ptr<>.
+        * svg/SVGMaskElement.h:
+        (WebCore::SVGMaskElement::drawMaskerContent): Return OwnPtr<>
+        instead of auto_ptr<>.
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::buildPattern): Use OwnPtr<> instead
+        of auto_ptr<> for stack variable.
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::nativeImageForCurrentFrame): Updated to use
+        assignment operator now that ImageBuffer::create() returns a
+        PassOwnPtr<>.
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::createMaskAndSwapContextForTextGradient): Use OwnPtr<>
+        instead of auto_ptr<> for stack variable.
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setTile): Updated to take a
+        PassOwnPtr<> instead of an auto_ptr<>.
+        (WebCore::SVGPaintServerPattern::setup): Use OwnPtr<> instead of
+        auto_ptr<> for stack variable.
+        * svg/graphics/SVGPaintServerPattern.h:
+        (WebCore::SVGPaintServerPattern::setTile): Updated to take a
+        PassOwnPtr<> instead of an auto_ptr<>.
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask): Updated to use
+        assignment operator now that SVGMaskElement::drawMaskerContent()
+        returns a PassOwnPtr<>.  Use OwnPtr<> instead of auto_ptr<> for
+        stack variable.
+
+2009-05-23  David Kilzer  <ddkilzer@apple.com>
+
+        Part 1 of 2: Bug 25495: Implement PassOwnPtr and replace uses of std::auto_ptr
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25495>
+
+        Reviewed by Oliver Hunt.
+
+        * ForwardingHeaders/wtf/OwnPtrCommon.h: Added.
+        * ForwardingHeaders/wtf/PassOwnPtr.h: Added.
+        * WebCore.vcproj/WebCore.vcproj: Added OwnPtrCommon.h and
+        PassOwnPtr.h.
+
+2009-05-23  David Kilzer  <ddkilzer@apple.com>
+
+        Fix Mac builds by backing out r44093
+
+        * bindings/js/JSCustomPositionCallback.cpp:
+        * bindings/js/JSCustomPositionCallback.h:
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        * bindings/js/JSCustomPositionErrorCallback.h:
+        * bindings/js/JSGeolocationCustom.cpp:
+        * page/Geolocation.cpp:
+        * page/Geolocation.idl:
+        * page/Geoposition.cpp:
+        * page/Geoposition.h:
+        * page/Geoposition.idl:
+        * page/Navigator.cpp:
+        (WebCore::Navigator::disconnectFrame):
+        (WebCore::Navigator::geolocation):
+        * page/PositionError.idl:
+        * platform/GeolocationService.cpp:
+        (WebCore::GeolocationService::create):
+
+2009-05-23  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Add GEOLOCATION guards around Geolocation API code
+        https://bugs.webkit.org/show_bug.cgi?id=25756
+
+        * bindings/js/JSCustomPositionCallback.cpp:
+        * bindings/js/JSCustomPositionCallback.h:
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        * bindings/js/JSCustomPositionErrorCallback.h:
+        * bindings/js/JSGeolocationCustom.cpp:
+        * page/Geolocation.cpp:
+        * page/Geolocation.idl:
+        * page/Geoposition.cpp:
+        * page/Geoposition.h:
+        * page/Geoposition.idl:
+        * page/Navigator.cpp:
+        (WebCore::Navigator::disconnectFrame):
+        (WebCore::Navigator::geolocation):
+        * page/PositionError.idl:
+        * platform/GeolocationService.cpp:
+
+2009-05-23  David Kilzer  <ddkilzer@apple.com>
+
+        Rename startupdateStyleIfNeededDispatcher to startUpdateStyleIfNeededDispatcher
+
+        In r42377, startUpdateRenderingDispatcher() was renamed to
+        startupdateStyleIfNeededDispatcher(), but the camelCase "U" was
+        dropped.  This change restores it.
+
+        * WebCore.order:
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::startUpdateStyleIfNeededDispatcher):
+        (WebCore::AnimationControllerPrivate::addEventToDispatch):
+        (WebCore::AnimationControllerPrivate::addNodeChangeToDispatch):
+        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
+        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
+        * page/animation/AnimationControllerPrivate.h:
+
+2009-05-23  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build-fix for Qt. Disable SVG Filters.
+
+        SVG Filters can not be built right now and Qt should not have
+        them enabled anyway as they do not carry out any filtering.
+
+        * WebCore.pro:
+
+2009-05-23  Dirk Schulze  <krit@webkit.org>
+
+        Unreviewed build-fix for gtk. Remove source input files
+        for SVG filter system from the build for the moment and
+        add them later again.
+
+        * GNUmakefile.am:
+
+2009-05-23  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebKit needs cross-platform filter system
+        [https://bugs.webkit.org/show_bug.cgi?id=19991]
+
+        Preparing Filter primitves for the new filter system.
+
+        No testcases were added. SVG filters are off by default.
+
+        * GNUmakefile.am:
+        * platform/graphics/filters/FEBlend.cpp:
+        (WebCore::FEBlend::apply):
+        * platform/graphics/filters/FEBlend.h:
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+        * platform/graphics/filters/FEColorMatrix.h:
+        * platform/graphics/filters/FEComponentTransfer.cpp:
+        (WebCore::FEComponentTransfer::apply):
+        * platform/graphics/filters/FEComponentTransfer.h:
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+        * platform/graphics/filters/FEComposite.h:
+        * svg/Filter.h:
+        * svg/FilterBuilder.h:
+        (WebCore::FilterBuilder::lastFilter):
+        * svg/FilterEffect.cpp:
+        (WebCore::FilterEffect::FilterEffect):
+        * svg/FilterEffect.h:
+        (WebCore::FilterEffect::xBoundingBoxMode):
+        (WebCore::FilterEffect::setXBoundingBoxMode):
+        (WebCore::FilterEffect::yBoundingBoxMode):
+        (WebCore::FilterEffect::setYBoundingBoxMode):
+        (WebCore::FilterEffect::widthBoundingBoxMode):
+        (WebCore::FilterEffect::setWidthBoundingBoxMode):
+        (WebCore::FilterEffect::heightBoundingBoxMode):
+        (WebCore::FilterEffect::setHeightBoundingBoxMode):
+        (WebCore::FilterEffect::subRegion):
+        (WebCore::FilterEffect::setSubRegion):
+        (WebCore::FilterEffect::resultImage):
+        (WebCore::FilterEffect::setEffectBuffer):
+        * svg/graphics/filters/SVGFEConvolveMatrix.cpp:
+        (WebCore::FEConvolveMatrix::apply):
+        * svg/graphics/filters/SVGFEConvolveMatrix.h:
+        * svg/graphics/filters/SVGFEDiffuseLighting.cpp:
+        (WebCore::FEDiffuseLighting::apply):
+        * svg/graphics/filters/SVGFEDiffuseLighting.h:
+        * svg/graphics/filters/SVGFEDisplacementMap.cpp:
+        (WebCore::FEDisplacementMap::apply):
+        * svg/graphics/filters/SVGFEDisplacementMap.h:
+        * svg/graphics/filters/SVGFEFlood.cpp:
+        (WebCore::FEFlood::apply):
+        * svg/graphics/filters/SVGFEFlood.h:
+        * svg/graphics/filters/SVGFEGaussianBlur.cpp:
+        (WebCore::FEGaussianBlur::apply):
+        * svg/graphics/filters/SVGFEGaussianBlur.h:
+        * svg/graphics/filters/SVGFEImage.cpp:
+        (WebCore::FEImage::apply):
+        * svg/graphics/filters/SVGFEImage.h:
+        * svg/graphics/filters/SVGFEMerge.cpp:
+        (WebCore::FEMerge::apply):
+        * svg/graphics/filters/SVGFEMerge.h:
+        * svg/graphics/filters/SVGFEMorphology.cpp:
+        (WebCore::FEMorphology::apply):
+        * svg/graphics/filters/SVGFEMorphology.h:
+        * svg/graphics/filters/SVGFEOffset.cpp:
+        (WebCore::FEOffset::apply):
+        * svg/graphics/filters/SVGFEOffset.h:
+        * svg/graphics/filters/SVGFESpecularLighting.cpp:
+        (WebCore::FESpecularLighting::apply):
+        * svg/graphics/filters/SVGFESpecularLighting.h:
+        * svg/graphics/filters/SVGFETile.cpp:
+        (WebCore::FETile::apply):
+        * svg/graphics/filters/SVGFETile.h:
+        * svg/graphics/filters/SVGFETurbulence.cpp:
+        (WebCore::FETurbulence::apply):
+        * svg/graphics/filters/SVGFETurbulence.h:
+
+2009-05-22  Dirk Schulze  <krit@webkit.org>
+
+        Unreviewed build-fix for gtk. Breakage caused by a wrong call of ImageBuffer.
+
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+
+2009-05-22  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by Eric Seidel.
+
+        Added the use of tileRect() for a correct drawing of
+        border-images.
+
+        Testcases for border-image are in fast/borders like
+        border-image-01.html and will be activated for cairo, once
+        gtk supports pixel tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19652
+        [CAIRO] wrong drawing of border-image
+
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+
+2009-05-22  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25684
+
+        Ask the Scrollbar for the orientation.
+
+        Use Scrollbar::orientation to figure out the
+        direction of scrolling.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::valueChanged):
+
+2009-05-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6916082> Incorrect handling of % as CSS value.
+
+        Test: fast/css/percent-character-as-value.html
+
+        * css/CSSGrammar.y: Make a stray % character reliably cause
+        CSS parsing to succeed, but the CSS value to be ignored because
+        of incorrect type. A type of 0 has this effect.
+
+2009-05-22  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25971
+        Correct a handful of build errors in the Windows Cairo variant
+        due to missing VIDEO support.
+
+        * WebCore.vcproj/WebCore.vcproj: Exclude RenderMediaControls for
+          the Cairo-based Windows target.
+        * rendering/RenderThemeWin.cpp: Avoid #include of RenderMediaControls
+          for non-VIDEO builds.
+
+2009-05-22  David Kilzer  <ddkilzer@apple.com>
+
+        One <limits> is enough
+
+        * html/HTMLMediaElement.cpp: Removed duplicate #include <limits>.
+
+2009-05-22  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://problem/6915957> REGRESSION: Hang when leaving page with VLC
+        plug-in
+
+        Reviewed by Steve Falkenburg.
+
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::determineQuirks):
+        Look for the VLC plug-in's new name.
+
+2009-05-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25966
+
+        Remove redudant member from Chromium's ResourceRequest.  We already
+        have this data in the cross-platform ResourceRequestBase.  Also, rename
+        ChromiumBridge parameter to be consistant with the new name for this
+        piece of data.
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/network/chromium/ResourceRequest.h:
+
+2009-05-22  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Only account for overhang for multi-character strings.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25961
+
+        * platform/wx/wxcode/win/fontprops.cpp:
+        (GetTextExtent):
+
+2009-05-22  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Switch to CURL cookies so we can benefit from API updates.
+
+        * platform/wx/TemporaryLinkStubs.cpp:
+        * webcore-wx.bkl:
+
+2009-05-22  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25709 part one
+        Indent contents of namespaces in header files, to comply with the
+        style guide.  No functional change.
+
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::):
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::bytes):
+        (WebCore::RGBA32Buffer::rect):
+        (WebCore::RGBA32Buffer::height):
+        (WebCore::RGBA32Buffer::status):
+        (WebCore::RGBA32Buffer::duration):
+        (WebCore::RGBA32Buffer::disposalMethod):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setRect):
+        (WebCore::RGBA32Buffer::ensureHeight):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::setDuration):
+        (WebCore::RGBA32Buffer::setDisposalMethod):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setRGBA):
+        (WebCore::ImageDecoder::m_failed):
+        (WebCore::ImageDecoder::~ImageDecoder):
+        (WebCore::ImageDecoder::setData):
+        (WebCore::ImageDecoder::size):
+        (WebCore::ImageDecoder::frameCount):
+        (WebCore::ImageDecoder::repetitionCount):
+        (WebCore::ImageDecoder::supportsAlpha):
+        (WebCore::ImageDecoder::failed):
+        (WebCore::ImageDecoder::setFailed):
+        (WebCore::ImageDecoder::clearFrameBufferCache):
+        * platform/image-decoders/bmp/BMPImageDecoder.h:
+        (WebCore::BMPImageDecoder::filenameExtension):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+        (WebCore::GIFImageDecoder::filenameExtension):
+        (WebCore::GIFImageDecoder::frameDurationAtIndex):
+        (WebCore::GIFImageDecoder::):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+        (WebCore::ICOImageDecoder::filenameExtension):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        (WebCore::JPEGImageDecoder::filenameExtension):
+        (WebCore::JPEGImageDecoder::supportsAlpha):
+        (WebCore::JPEGImageDecoder::reader):
+        (WebCore::JPEGImageDecoder::setSize):
+        * platform/image-decoders/png/PNGImageDecoder.h:
+        (WebCore::PNGImageDecoder::filenameExtension):
+        (WebCore::PNGImageDecoder::reader):
+        (WebCore::PNGImageDecoder::decodingFailed):
+        * platform/image-decoders/xbm/XBMImageDecoder.h:
+        (WebCore::XBMImageDecoder::filenameExtension):
+
+2009-05-22  Dominik Röttsches  <dominik.roettsches@access-company.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15914
+        [GTK] Implement Unicode functionality using GLib
+
+        Minor changes that allow building a hybrid version of WebKit
+        that has WTF Unicode backend based on GLib functions while
+        text codecs and TextBreakIterator remain based on ICU.
+
+        Fixed some includes that were assuming a WTF ICU backend and
+        introduced temporary usage of WTF_USE_GLIB_ICU_UNICODE_HYBRID
+        macro.
+
+        * platform/ThreadGlobalData.cpp:
+        (WebCore::ThreadGlobalData::ThreadGlobalData):
+        (WebCore::ThreadGlobalData::~ThreadGlobalData):
+        * platform/ThreadGlobalData.h:
+        * platform/text/TextBoundariesICU.cpp:
+        * platform/text/TextCodecICU.h:
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::encode):
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+        (WebCore::extendTextCodecMaps):
+
+2009-05-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25955
+
+        Remove the policyBaseURL parameter from setCookie.  This parameter is
+        redundant with the document parameter.
+
+        * WebCore.base.exp:
+        * WebCore.order:
+        * dom/Document.cpp:
+        (WebCore::Document::setCookie):
+        * platform/CookieJar.h:
+        * platform/mac/CookieJar.mm:
+        (WebCore::setCookies):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::setCookies):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::setCookies):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::setCookies):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::setCookies):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::setCookies):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::setCookies):
+
+2009-05-22  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25955
+
+        Rename policyBaseURL and mainDocumentURL to firstPartyForCookies.  The
+        previous names were confusing and inaccurate.
+
+        * WebCore.order:
+        * dom/Document.cpp:
+        (WebCore::Document::setCookie):
+        * dom/Document.h:
+        (WebCore::Document::firstPartyForCookies):
+        (WebCore::Document::setFirstPartyForCookies):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        (WebCore::FrameLoader::updateFirstPartyForCookies):
+        (WebCore::FrameLoader::setFirstPartyForCookies):
+        (WebCore::FrameLoader::open):
+        (WebCore::FrameLoader::addExtraFieldsToRequest):
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        * loader/FrameLoader.h:
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::willSendRequest):
+        (WebCore::ResourceRequestBase::adopt):
+        (WebCore::ResourceRequestBase::copyData):
+        (WebCore::ResourceRequestBase::firstPartyForCookies):
+        (WebCore::ResourceRequestBase::setFirstPartyForCookies):
+        (WebCore::equalIgnoringHeaderFields):
+        * platform/network/ResourceRequestBase.h:
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::setCookies):
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::firstPartyForCookies):
+        (WebCore::ResourceRequestBase::setFirstPartyForCookies):
+        * platform/network/chromium/CookieJarChromium.cpp:
+        (WebCore::setCookies):
+        * platform/network/curl/CookieJarCurl.cpp:
+        (WebCore::setCookies):
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::setCookies):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::setCookies):
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::setCookies):
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::setCookies):
+
+2009-05-22  Pavel Feldman  <pfeldman@chromium.org>
+
+        Fix the call to editingCancelled to be this._editingCancelled, since
+        editingCancelled doesn't exist and throws an exception.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=24881>
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._attributeEditingCommitted):
+
+2009-05-22  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25928
+        Several errors detected by cppcheck
+
+        Fix all (the only one) problem in cross-platform code found by the tool. Port maintainers
+        should take a look at other reports.
+
+        * css/CSSParser.cpp: (WebCore::CSSParser::addProperty): Don't leak the property even if there
+        are billions of those.
+
+2009-05-22  Shinichiro Hamaji  <hamaji@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        Remove optimization path alpha=0 case from GraphicContext(CG|Skia).
+        This optimization doesn't make sense for some composite mode (e.g., 'copy' operation).
+
+        https://bugs.webkit.org/show_bug.cgi?id=25956
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::strokeRect):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::strokeRect):
+
+2009-05-22  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        Revert the whole thing, since we can't figure out a way to make it
+        work in all platforms.
+
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::pathForDecoration):
+        * svg/SVGLength.cpp:
+        (WebCore::SVGLength::PercentageOfViewport):
+
+2009-05-22  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix Windows build.
+
+        Apparently it can't tell if '1.0f' is float or double, so cast to
+        float.
+
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::pathForDecoration):
+
+2009-05-22  Xan Lopez  <xlopez@igalia.com>
+
+        Try to fix breakage from the previous patch.
+
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::pathForDecoration):
+        * svg/SVGLength.cpp:
+        (WebCore::SVGLength::PercentageOfViewport):
+
+2009-05-15  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25805
+        In debug build, mingw win32 build has problems with powf
+
+        Change C-style calls to powf and sqrtf to C++-style calls to
+        overloaded pow and sqrt. This solves also a problem with mingw
+        compiler during the debug build.
+
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::pathForDecoration):
+        * svg/SVGLength.cpp:
+        (WebCore::SVGLength::PercentageOfViewport):
+
+2009-05-21  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6913680> Update image caching options.
+        Disable extra ImageIO cache because we already handle caching decoded image data.
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::imageSourceOptions):
+
+2009-05-21  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 25903: Create a default UI theme for media controls in Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=25903
+
+        Implement a default UI for chromium.  Add a style sheet for Chromium
+        media controls with good defaults and implemented basic draw functions
+        for play/pause & mute buttons.
+
+        * css/mediaControlsChromium.css: Added.
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumWin::extraMediaControlsStyleSheet): Export
+        our custom media controls style sheet.
+        (WebCore::RenderThemeChromiumLinux::paintMediaButtonInternal): Paint
+        buttons respecting chromium media controls color scheme.
+        (WebCore::RenderThemeChromiumLinux::paintMediaPlayButton): Paint logic
+        specific to play/pause button.
+        (WebCore::RenderThemeChromiumLinux::paintMediaMuteButton): Paint
+        specific to mute button.
+        * rendering/RenderThemeChromiumLinux.h: Appropriate header changes.
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::extraMediaControlsStyleSheet): Export
+        our custom media controls style sheet.
+        (WebCore::RenderThemeChromiumWin::paintMediaButtonInternal): Paint
+        buttons respecting chromium media controls color scheme.
+        (WebCore::RenderThemeChromiumWin::paintMediaPlayButton): Paint logic
+        specific to play/pause button.
+        (WebCore::RenderThemeChromiumWin::paintMediaMuteButton): Paint specific
+        to mute button.
+        (WebCore::RenderThemeChromiumWin::setDefaultFontSize): Appropriate
+        header changes.
+        * rendering/RenderThemeChromiumWin.h:
+
+2009-05-21  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        When stripping the query from a file:// URL, do not leave a trailing question mark.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25940
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::initializeHandle):
+
+2009-05-21  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Notify ImageObserver::didDraw to help the cache purge alive resources.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25942
+
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImage::drawPattern):
+
+2009-05-21  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Flesh out font fallback for Chromium's Skia port.
+        getLastResortFallbackFont should fall back on well-known fonts.
+        https://bugs.webkit.org/show_bug.cgi?id=25860
+
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::getLastResortFallbackFont): try known font names.
+
+2009-05-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - speculative fix for <rdar://problem/6890716> crash at
+          FontCache::purgeInactiveFontData + 199
+
+        * platform/graphics/FontCache.cpp:
+        (WebCore::FontCache::purgeInactiveFontData): Deleting a SimpleFontData
+        can cause releaseFontData() to be called, which modifies
+        gInactiveFontData. Therefore, avoid deleting SimpleFontData instances
+        while iterating over gInactiveFontData and delete them afterwards.
+
+2009-05-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        Test for <rdar://problem/6910832> | https://bugs.webkit.org/show_bug.cgi?id=25907
+        Incorrect URL returned to the DOM while the user drags a file
+
+        * page/DragController.cpp:
+        (WebCore::DragController::dragExited):
+        (WebCore::DragController::tryDHTMLDrag): Don't base our decision on KURL,
+        since that only looks at the text of the document's URL. Do base our
+        decision on the securityOrigin(), which knows more about the document's
+        actual origin.
+
+2009-05-21  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Mark Rowe.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=25947
+          Assertion failure in FrameLoader::transitionToCommitted on launch in
+          Safari with r43985
+
+        Rolled out r43979.
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedNonImageMimeTypes):
+        (WebCore::MIMETypeRegistry::isSupportedNonImageMIMEType):
+
+2009-05-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Brady Eidson and Mark Rowe.
+
+        Fix for <rdar://problem/6901522>
+        REGRESSION: Office 2008: Preview with browser is not shown, and Finder window is in the front of Safari
+
+        If the NSURLRequest is annotated with a "ForceHTMLMIMEType" property, force
+        the MIME type to be text/html.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
+
+2009-05-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Blind windows fix after last commit.
+
+        * platform/Logging.cpp:
+        (WebCore::getChannelFromName):
+
+2009-05-21  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Use an environment variable to control which logs are on and off.
+        Also, make a generic function for translating channel name to its log.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25936
+
+        * platform/Logging.cpp:
+        (WebCore::getChannelFromName):
+        * platform/Logging.h:
+        * platform/wx/LoggingWx.cpp:
+        (WebCore::InitializeLoggingChannelsIfNecessary):
+
+2009-05-21  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Bug 25946: Chromium needs MIMETypeRegistry::getMediaMIMETypeForExtension implementation.
+        https://bugs.webkit.org/show_bug.cgi?id=25946
+
+        A very simple implementation to keep it working.  A bug has been filed in the chromium db
+        (http://code.google.com/p/chromium/issues/detail?id=12441) to investigate doing something more
+        complete.
+
+        * platform/chromium/MimeTypeRegistryChromium.cpp:
+        (WebCore::MIMETypeRegistry::getMediaMIMETypeForExtension):
+
+2009-05-20  Siddhartha Chattopadhyaya  <sidchat@google.com>
+
+        Reviewed by Justin Garcia.
+        
+        Add automatic spell correction support in WebKit
+
+        https://bugs.webkit.org/show_bug.cgi?id=24953
+
+        * editing/Editor.cpp:
+        (WebCore::findFirstMisspellingInRange):
+        (WebCore::Editor::advanceToNextMisspelling):
+        (WebCore::Editor::markMisspellingsAfterTypingToPosition):
+        (WebCore::markAllMisspellingsInRange):
+        (WebCore::markMisspellingsOrBadGrammar):
+        (WebCore::Editor::markMisspellings):
+        (WebCore::Editor::markBadGrammar):
+        (WebCore::Editor::markMisspellingsAndBadGrammar):
+        * editing/Editor.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyEditorClient::getAutoCorrectSuggestionForMisspelledWord):
+        * page/EditorClient.h:
+
+2009-05-21  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Darin Adler.
+
+        Text files which have sub MIME types are treated as not displayable
+        http://bugs.webkit.org/show_bug.cgi?id=24903
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedNonImageMimeTypes):
+        (WebCore::MIMETypeRegistry::isSupportedNonImageMIMEType): Regard any
+        MIME type beginning with "text/" as supported and remove all "text/"
+        types from the list.
+
+2009-05-21  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25890
+        Implement Network logging channel on Mac
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::~ResourceHandle):
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::cancel):
+        (WebCore::ResourceHandle::setDefersLoading):
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
+        (-[WebCoreResourceHandleAsDelegate connectionShouldUseCredentialStorage:]):
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveAuthenticationChallenge:]):
+        (-[WebCoreResourceHandleAsDelegate connection:didCancelAuthenticationChallenge:]):
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]):
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveData:lengthReceived:]):
+        (-[WebCoreResourceHandleAsDelegate connection:willStopBufferingData:]):
+        (-[WebCoreResourceHandleAsDelegate connection:didSendBodyData:totalBytesWritten:totalBytesExpectedToWrite:]):
+        (-[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:]):
+        (-[WebCoreResourceHandleAsDelegate connection:didFailWithError:]):
+        (-[WebCoreResourceHandleAsDelegate connection:willCacheResponse:]):
+        Added logging for async requests (as these are most interesting).
+
+2009-05-21  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by David Kilzer.
+
+        <rdar://problem/6902197> WebCore doesn't know about all of the MIME types supported by QTKit
+        
+        Add a static table to map from some common file extensions to their MIME types so it
+        is possible to detect support even when the platform mapping is incomplete. Use the
+        table to lookup types not found by UTI on the OSX, and when looking for a media engine
+        with a generic or missing type.
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeMediaTypeMaps): New, initialize the mediaMIMETypeForExtensionMap.
+        (WebCore::MIMETypeRegistry::getMediaMIMETypeForExtension): New. Look for the specified
+        MIME type in the static mapping table if the platform specific getMIMETypeForExtension
+        doesn't find a match.
+        * platform/MIMETypeRegistry.h: Declare getMediaMIMETypeForExtension.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::load): When the type passed is empty, "application/octet-stream", or
+        "text/plain", try to look it up based on the file extension with getMediaMIMETypeForExtension.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::addFileTypesToCache): See if getMediaMIMETypeForExtension can map from file extension
+        to MIME type if UTI fails.
+
+2009-05-21  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Clean up DragController
+        https://bugs.webkit.org/show_bug.cgi?id=25926
+
+        I renamed m_document to m_documentUnderMouse to better document what it does
+        I could call it m_lastDocumentUnderMouse to be most-accurate, but this seemed
+        long enough.
+
+        I also saw copy/paste code involving clearing the selection when moving out of
+        one document and into another.  I moved that code into a function called
+        mouseMovedIntoDocument.
+
+        I also got rid of a couple needless null-checks after confirming via source
+        inspection they were not ever possible.
+        In Mac WebKit it's not possible to have a Page that doesn't have a mainFrame()
+        I left an ASSERT(m_page->mainFrame()) in case some other port ever violates this.
+        It's also not possible to return a document from documentAtPoint that is not
+        in a frame (as such a document would not be rendered).
+
+        No functional changes, thus no tests.
+
+        * page/DragController.cpp:
+        (WebCore::DragController::DragController):
+        (WebCore::DragController::dragIsMove):
+        (WebCore::DragController::dragExited):
+        (WebCore::DragController::performDrag):
+        (WebCore::DragController::mouseMovedIntoDocument):
+        (WebCore::DragController::dragEnteredOrUpdated):
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::DragController::operationForLoad):
+        (WebCore::DragController::concludeEditDrag):
+        (WebCore::DragController::canProcessDrag):
+        (WebCore::DragController::tryDHTMLDrag):
+        (WebCore::DragController::placeDragCaret):
+        * page/DragController.h:
+        (WebCore::DragController::documentUnderMouse):
+
+2009-05-21  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Rename DragController::dragOperation() to sourceDragOperation() for clarity
+        Remove unused setDragOperation()
+
+        There are two times DragOperation is used.  The source specifies
+        what drag operations it supports (in a mask) and the destination
+        picks a subset of those as DragOperations it supports if a drop were
+        to occur.  I was confused when I first saw this accessor as to which
+        it meant.  It turns out that this is only used when WebKit starts a
+        drag, and we keep it around so that we can provide this information
+        to other Mac OS X applications when they ask.  I've renamed the method
+        for clarity so the next person in this code will be less confused.
+
+        No functional changes, thus no tests.
+
+        * page/DragController.h:
+        (WebCore::DragController::sourceDragOperation):
+
+2009-05-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        - WebCore part of <rdar://problem/6901751> REGRESSION (r35515): Tiger
+          crash painting the selection on registration page of car2go.com
+
+        A bug in old versions of Core Graphics causes memory corruption to occur
+        when clipping under certain conditions. Make the clipping functions
+        fail silently under those conditions.
+
+        Test: fast/block/float/selection-gap-clip-out-tiger-crash.html
+
+        * WebCore.Tiger.exp: Added wkCGContextIsSafeToClip
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::safeCGContextClip): Added a wrapper around CGContextClip that,
+        on Tiger, bails out if wkCGContextIsSafeToClip() returns false.
+        (WebCore::safeCGContextEOClip): Ditto for CGContextEOClip.
+        (WebCore::safeCGContextClipToRect): Ditto for CGContextClipToRect.
+        (WebCore::GraphicsContext::fillPath): Changed to call the safe variants
+        of CGContextClip, CGContextEOClip and CGContextClipToRect.
+        (WebCore::GraphicsContext::strokePath): Ditto.
+        (WebCore::GraphicsContext::fillRect): Ditto.
+        (WebCore::GraphicsContext::clip): Ditto.
+        (WebCore::GraphicsContext::clipOut): Ditto.
+        (WebCore::GraphicsContext::clipOutEllipseInRect): Ditto.
+        (WebCore::GraphicsContext::clipPath): Ditto.
+        (WebCore::GraphicsContext::addInnerRoundedRectClip): Ditto.
+        (WebCore::GraphicsContext::strokeRect): Ditto.
+        * platform/mac/WebCoreSystemInterface.h: Added wkCGContextIsSafeToClip.
+        * platform/mac/WebCoreSystemInterface.mm: Added wkCGContextIsSafeToClip.
+
+2009-05-21  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25910
+        WebkitGTK r43960 cannot compile
+
+        Do not include local copy of guriescape header, which was
+        removed. We now use the copy in glib.
+
+        * platform/gtk/FileSystemGtk.cpp:
+
+2009-05-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25706
+
+        It turns out the CurrentContext wasn't currect either because it gave
+        us the frame for the write() function itself.  We actually want the
+        *calling* context.
+
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-05-20  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Implement Image::loadPlatformResource.
+
+        Install the four resources we are using. For the icons
+        where an icon name is specified by freedeskop.org try to
+        map the WebCore name to that name and fallback to the
+        internal icon. For everything else use the internal icon
+        name. Remove the temporary link stub as this is not
+        required any more.
+
+        * GNUmakefile.am: Install the png files, set DATA_DIR again
+        * Resources/panIcon.png: Copied from WebKit/win/WebKit.vcproj/panIcon.png.
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WTF::GtkIconInfo): Add template specialization for GtkIconInfo
+        (WebCore::getIconFileNameOrFallback): Use GtkIconTheme to get the icon
+        (WebCore::loadResourceIntoSharedBuffer):
+        (WebCore::Image::loadPlatformResource): Implement
+        * platform/gtk/TemporaryLinkStubs.cpp: Remove link stub
+
+2009-05-20  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19357
+
+        [GTK] The Gtk+ port wants to have a themable
+        urlIcon too.
+
+        * loader/icon/IconDatabase.cpp:
+
+2009-05-20  Stephanie Lewis  <slewis@apple.com>
+
+        Update the order files.  <rdar://problem/6881750> Generate new order files.
+
+        * WebCore.order:
+
+2009-05-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Fix some assertion failures in plug-in tests on the Windows debug build bot.
+
+        * plugins/PluginStream.cpp:
+        (WebCore::PluginStream::startStream): Switch to using protocolIsJavaScript.
+        * plugins/PluginView.cpp:
+        (WebCore::scriptStringIfJavaScriptURL): Ditto.
+
+2009-05-20  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        More protocolInHTTPFamily() cleanup.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::send):
+
+2009-05-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for <rdar://problem/6905475>
+        Office 2008: Entourage: Crash when you switch to "My Day" view
+
+        The host function callback callObjCFallbackObject was not annotated
+        with JSC_HOST_CALL which meant that when it was called by the JIT, which
+        expects the JSC_HOST_CALL calling convention, the arguments are not in the
+        expected places.
+
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::callObjCFallbackObject): Added missing JSC_HOST_CALL
+        annotation on callObjCFallbackObject.
+
+2009-05-20  David Levin  <levin@chromium.org>
+
+        Not Reviewed, build fix.
+
+        Need to disable this assert while the chormium code is fixed for it.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::protocolIs):
+
+2009-05-20  David Levin  <levin@chromium.org>
+
+        Not Reviewed, build fix.
+
+        Change KURLGoogle.cpp to mirror the KURL.cpp changes done in
+        http://trac.webkit.org/changeset/43929.  Fix assert placement.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::protocolIs):
+        (WebCore::protocolIs):
+
+2009-05-20  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream V8 bindings for V8DomWindow.
+        https://bugs.webkit.org/show_bug.cgi?id=25869
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetTimeoutImpl): Moved from v8_custom.cpp.
+        (WebCore::isAscii): Moved from v8_custom.cpp.
+        (WebCore::convertBase64): Moved from v8_custom.cpp.
+        (WebCore::CALLBACK_FUNC_DECL): Moved from v8_custom.cpp.
+        (WebCore::eventNameFromAttributeName): Moved from v8_custom.cpp.
+        (WebCore::ACCESSOR_SETTER): Moved from v8_custom.cpp.
+        (WebCore::ACCESSOR_GETTER): Moved from v8_custom.cpp.
+        (WebCore::NAMED_ACCESS_CHECK): Moved from v8_custom.cpp.
+        (WebCore::INDEXED_ACCESS_CHECK): Moved from v8_custom.cpp.
+
+2009-05-21  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Jan Alonzo.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::parseDataUrl): Always use Glib Base64 decoding.
+
+2009-05-21  Christian Dywan  <christian@twotoasts.de>
+
+        Rubberstamped by Gustavo Noronha.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::parseDataUrl): Remove Gtk/ Glib Base64 decoding.
+
+2009-05-20  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Gustavo Noronha.
+
+        * GNUmakefile.am:
+        * platform/gtk/guriescape.c:
+        * platform/gtk/guriescape.h: Remove copies of g_uri_escape_string and
+        g_uri_unescape_string now that we require Glib 2.16.
+
+2009-05-20  David Levin  <levin@chromium.org>
+
+        Not Reviewed, build fix.
+
+        Change KURLGoogle.cpp to mirror the KURL.cpp changes done in
+        http://trac.webkit.org/changeset/43929.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::protocolIsJavaScript):
+        (WebCore::protocolIs):
+
+2009-05-20  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Sam Weinig
+
+        At all call sites that check if a KURL has either the http or https protocol,
+        use the KURL::protocolInHTTPFamily() accessor, instead.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::iconURL):
+        (WebCore::FrameLoader::didOpenURL):
+        (WebCore::FrameLoader::open):
+
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::requestIsHTTPOrHTTPSGet):
+
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::send):
+
+2009-05-20  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix <rdar://problem/6904941> and https://bugs.webkit.org/show_bug.cgi?id=25300
+
+        KURL parsing changes back in r30243 and r30815 made javascript urls that use the form
+        "javascript://" be detected as invalid hierarchical URLs.  When a KURL is marked as
+        invalid, you can no longer ask it a question such as "is your protocol javascript?"
+        Therefore FrameLoader wouldn't recognize them as javascript URLs and instead try to
+        navigate to them.
+
+        URL parsing rules aside, such URLs are in use in the wild (Microsoft's Virtual Earth 
+        being a high profile example) and actually represent valid javascript.
+
+        Whenever checking for javascript urls, the new protocolIsJavaScript() should be used
+        as it functions on a String which doesn't have to pass KURLs parsing rules. 
+
+        Test: fast/loader/javascript-url-hierarchical-execution.html
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::setValue): Use protocolIsJavaScript().
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation): Ditto.
+        (WebCore::createWindow): Ditto.
+        (WebCore::JSDOMWindow::open): Ditto.
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::allowSettingSrcToJavascriptURL): Ditto.
+        * bindings/js/JSHTMLFrameElementCustom.cpp:
+        (WebCore::allowSettingJavascriptURL): Ditto.
+        * bindings/js/JSHTMLIFrameElementCustom.cpp:
+        (WebCore::JSHTMLIFrameElement::setSrc): Ditto.
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::navigateIfAllowed): Ditto.
+        (WebCore::JSLocation::reload): Ditto.
+        * editing/markup.cpp:
+        (WebCore::appendQuotedURLAttributeValue): Ditto.
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::parseMappedAttribute): Ditto.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestFrame): Ditto.
+        (WebCore::FrameLoader::submitForm): Ditto.
+        (WebCore::FrameLoader::executeIfJavaScriptURL): Ditto.
+        
+        * platform/KURL.cpp:
+        (WebCore::KURL::init): Use protocolIsJavaScript().
+        (WebCore::KURL::protocolIs): ASSERT that the protocol being asked about is not javascript.
+           Such checks should go through protocolIsJavaScript() instead.
+        (WebCore::encodeRelativeString): Use protocolIsJavaScript().
+        (WebCore::protocolIsJavaScript):
+        * platform/KURL.h:
+
+2009-05-20  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24510
+
+        Fix a bug where the browserfuncs were not properly assigned,
+        make hasproperty use _NP_HasProperty and hasmethod _NP_HasMethod.
+
+        Test: plugins/netscape-invoke-browserfuncs.html
+
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::PluginPackage::load): Fix assignment
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::load): Fix assignment
+
+2009-05-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Make absoluteRectsForRange and absoluteQuadsForRange non-virtual
+        and only exist on RenderText.
+
+        * dom/Range.cpp:
+        (WebCore::Range::textRects):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::drawNodeHighlight): Use absoluteQuads instead
+        of absoluteQuadsForRange since no range is being specifiec.
+        * rendering/RenderObject.cpp:
+        * rendering/RenderObject.h:
+        * rendering/RenderText.h:
+
+2009-05-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Implement AtkObject::focus-event and
+        AtkObject::state-changed:focused signal emission.
+
+        Adds a new handleFocusedUIElementChangedWithRenderers, only in the
+        GTK port, called at the same point than
+        handleFocusedUIElementChanged but with two parameters, the old and
+        the newly focused RenderObjects. We need this, since the ATK
+        signals require us to pass the objects involved in the focus
+        change as arguments.
+
+        * accessibility/AXObjectCache.h:
+        * accessibility/gtk/AXObjectCacheAtk.cpp:
+        (WebCore::AXObjectCache::handleFocusedUIElementChangedWithRenderers):
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+
+2009-05-20  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25834
+
+        Make ChromeClient a interface again
+
+        With recent additions to ChromeClient.h empty defaults were
+        added. This is bad for porters as these changes go unnoticed
+        and at runtime no notImplemented warning is logged and grepping
+        for notImplemented will not show anything. Change this Client
+        to be like the other Clients again and always have pure virtuals
+        (but for stuff inside #ifdef PLATFORM(MAC)).
+
+        Update the various WebKit/* implementations to compile again.
+
+        * loader/EmptyClients.h: Add empty defaults
+        (WebCore::EmptyChromeClient::setCursor):
+        (WebCore::EmptyChromeClient::scrollRectIntoView):
+        (WebCore::EmptyChromeClient::requestGeolocationPermissionForFrame):
+        * page/ChromeClient.h: Make methods pure virtual
+
+2009-05-19  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Fix a bug where a non visible plugin would show it self in a
+        sibling frame. The problem was due to our clipping. In Qt,
+        if setMask is set with an empty QRegion, no clipping will
+        be performed, so in that case we hide the PluginContainer
+
+        Added manual test.
+
+        * plugins/qt/PluginContainerQt.cpp:
+        (PluginContainerQt::adjustGeometry):
+        * manual-tests/qt/plugin-sibling-frame-include.html
+        * manual-tests/qt/plugin-sibling-frame.html
+
+2009-05-19  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Do not call the parent implementation (Widget::) in show() and hide()
+        of the PluginViewQt, as it always changes the visible state of the
+        platformWidget (equal to the platformPluginWidget in the Qt port),
+        thus ignoring the isParentVisible() test.
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
+
+2009-05-20  Yichao Yin  <yichao.yin@torchmobile.com.cn>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23452
+        Change the implementation of HTMLNoScriptElement to avoid the pain of 
+        adding virtual function for XHTMLMP support
+
+        Includes changes suggested by Simon Fraser.
+
+        * dom/Node.cpp:
+        (WebCore::Node::styleForRenderer):
+        * dom/Node.h:
+        * html/HTMLNoScriptElement.cpp:
+        * html/HTMLNoScriptElement.h:
+
+2009-05-20  Kevin Ollivier  <kevino@theolliviers.com>
+
+        CURL backend build fix. Make sure URL is always set.
+        
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::downloadTimerCallback):
+
+2009-05-20  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by George Staikos.
+
+        Fix Qt WebKit build break in Mac OS.
+
+        * platform/FileSystem.h:
+
+2009-05-20  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Eric Seidel.
+
+        Enable code that was commented out waiting for a way to get a
+        GdkPixbuf from an image, effectively enabling copying images to
+        the clipboard.
+
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writeImage):
+
+2009-05-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25414
+        [GTK] ROLE_PANEL should not be used for paragraphs and list items.
+
+        Implement Atk list item role for list items.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_role):
+
+2009-05-20  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25414
+        [GTK] ROLE_PANEL should not be used for paragraphs and list items.
+
+        Implement Atk paragraph role for paragraph elements.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_get_role):
+
+2009-05-20  Eric Seidel  <eric@webkit.org>
+
+        Fix bug URL in ChangeLogs in r43903.
+        https://bugs.webkit.org/show_bug.cgi?id=25742
+
+2009-05-20  Takeshi Yoshino <tyoshino@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 24539: Fix RenderThemeChromiumWin::paintTextFieldInternal() not to hide background image.
+        https://bugs.webkit.org/show_bug.cgi?id=25742
+
+        Fix RenderThemeChromiumWin::paintTextFieldInternal().
+
+        We shouldn't paint the content area of text fields when o->style() has
+        background image or transparent background color. paintTextFieldInternal() is
+        used for painting inner area of HTML option elements by Chromium.
+
+        When we pass fillContentArea = true to ChromiumBridge::paintTextField, it hides
+        the background image rendered by RenderBoxModelObject. So, we should set
+        fillContentArea = false in such case.
+
+        Besides, when background-color:transparent is specified for CSS property,
+        o->style().backgroundColor returns black color with alpha channel == 0. But
+        since ThemeEngine for Windows behind ChromiumBridge::paintTextField cannot
+        recognize alpha channel, it fills the rect with black. I made workaround to set
+        fillContentArea = false when alpha channel == 0 to avoid this.
+
+        And more, I'd like to fallback the color passed to ChromiumBridge to white when
+        o->style()->backgroundColor() is invalid.
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::paintTextFieldInternal):
+
+2009-05-20  Shinichiro Hamaji  <hamaji@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25417
+        Map CompositeCopy to Skia's kSrc_Mode composite operation.
+
+        Test: fast/canvas/canvas-composite-alpha.html
+
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::):
+
+2009-05-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Rubber-stamped by Xan Lopez.
+
+        Remove misplaced extern "C"
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-05-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Expose password field with role of PASSWORD_TEXT
+        https://bugs.webkit.org/show_bug.cgi?id=25682
+
+        Check if input type is a password field and return
+        ATK_ROLE_PASSWORD_TEXT if it is.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-05-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by George Staikos.
+
+        BUG 25845: [Qt] Fix QtWebKit pkgconfig dependencies
+        <https://bugs.webkit.org/show_bug.cgi?id=25845>
+
+        * WebCore.pro: Remove QtDBus; remove QtXml if Qt >= 4.4
+
+2009-05-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by George Staikos.
+
+        BUG 25843: [Qt] Remove qt-port build flag
+        <https://bugs.webkit.org/show_bug.cgi?id=25843>
+
+        * bridge/testbindings.pro:
+
+2009-05-20  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25824
+
+        [Qt] Cleanup - move files exclusive to JAVASCRIPT_DEBUGGER
+        and WORKERS under the appropriate build section
+
+        * WebCore.pro:
+
+2009-05-20  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Unreviewed Qt build fix, after r43892.
+
+        * platform/graphics/qt/ImageQt.cpp: included ImageObservser.h
+
+2009-05-20  Yongjun Zhang  <yongjun.zhang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25856
+        [Qt] notify an image has been drawn, to help Cache purge alive decoded data.
+
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::draw):
+
+2009-05-20  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY, layout tests fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23727
+        This reverts commit r43888.
+
+        Once that change was checked in many of the fast/flexbox0*.html        
+        tests (and others) started failing.
+
+        * WebCore.pro:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::updateMarqueePosition):
+        (WebCore::RenderMarquee::timerFired):
+
+2009-05-19  Yichao Yin <yichao.yin@torchmobile.com.cn>
+
+        Reviewed by George Staikos.
+
+        Add XHTMLMP support to Webkit
+        Update the configure files for building XHTMLMP-enabled WebKit on different platform
+        https://bugs.webkit.org/show_bug.cgi?id=23452
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+
+2009-05-19  Antti Koivisto  <antti@apple.com>
+
+        I can't figure out how to make this not timing dependent, making it manual test instead.
+
+        * manual-tests/preload-scanner-entities.html: Added.
+
+2009-05-19  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Antti Koivisto. 
+
+        <rdar://problem/6886382> REGRESSION (Safari 4PB -> ToT): HTTP cache revalidation broken.
+
+        This was caused in http://trac.webkit.org/changeset/41425, which fixed an image caching bug
+        in QuickLooks (rdar://problem/6619630).
+
+        We need to respect the DocumentLoader's request cache policy when deciding the cache policy
+        for subresources, but the check (originally removed in r39304 and added back in in the same
+        place in r41424) needs to be tweaked and relocated a bit.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::subresourceCachePolicy): Renamed from cachePolicy().  Move checking
+          the DocumentLoader's request to a more appropriate place. Add code to handle the recently 
+          added FIXME regarding POSTs. Add a new FIXME describing a great way to make this code 
+          cleaner in the future.
+        * loader/FrameLoader.h:
+
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::cachePolicy): Calls the newly renamed subresourceCachePolicy().
+
+2009-05-19  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 25872: aria-labeledby appends all siblings instead of all children to aria name
+        https://bugs.webkit.org/show_bug.cgi?id=25872
+
+        When setting the aria-labeledby text it should stay within the element identified by the id
+        when searching through the sibling list.
+  
+        This also removes an outdated assert in getDocumentLinks. Its possible for the document to
+        think an element is a link, but accessibility can treat it differently (eg. its ARIA role is different).
+
+        Test: accessibility/aria-labelledby-stay-within.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaAccessiblityName):
+        (WebCore::AccessibilityRenderObject::getDocumentLinks):
+
+2009-05-19  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin Adler).
+        
+        <rdar://problem/6902674> REGRESSION: Query parameters are sometimes incorrect in URL (23135)
+        
+        Push characters back in correct order when entity parsing fails after 3 characters.
+
+        Test: fast/tokenizer/preload-scanner-entities.html
+
+        * html/PreloadScanner.cpp:
+        (WebCore::PreloadScanner::consumeEntity):
+
+2009-05-19  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix a crash in Mac Chromium when displaying an HTML select element
+        with no items.
+        https://bugs.webkit.org/show_bug.cgi?id=25874
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::showExternal):
+
+2009-05-19  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Upstream V8 bindings for CanvasRenderingContext2D.
+        https://bugs.webkit.org/show_bug.cgi?id=25858
+
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp: Moved bindings from v8_custom.cpp.
+
+2009-05-19  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Windows Build Fix.
+
+        * WebCore.vcproj/WebCore.vcproj: Copy accessibility headers from WebCore.
+
+2009-05-19  Timothy Hatcher  <timothy@apple.com>
+
+        <rdar://problem/6889218> REGRESSION: Some iChat transcript resources are not
+        loaded because willSendRequest doesn't happen immediately
+
+        Reviewed by Antti Koivisto.
+
+        * WebCore.base.exp: Export Loader::servePendingRequests().
+
+2009-05-19  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 25859: Need to upstream ScriptController.* for v8.
+        https://bugs.webkit.org/show_bug.cgi?id=25859
+
+        Fixing the header file (which I accidentally made identical to the cpp file).
+
+        * bindings/v8/ScriptController.h:
+
+2009-05-19  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler and Brady Eidson.
+
+        <rdar://problem/6900582> REGRESSION (r42446?): UA Profiler in http://stevesouders.com/ua/ stalls
+
+        The problem was that Document::removeAllEventListeners() was called for a wrong document
+        when a CachedFrame was destroyed.
+
+        Cannot be tested automatically, because DRT doesn't have a b/f cache.
+
+        * dom/Document.cpp: (WebCore::Document::domWindow): Make sure that this doesn't return an
+        unrelated window even if document's m_frame pointer is stale.
+
+        * history/CachedFrame.cpp: (WebCore::CachedFrame::clear): Added a FIXME about strange behavior.
+
+2009-05-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Split InspectorController into InspectorController and InspectorFrontend. Latter encapsulates all frontend interaction and is the only entity allowed to make ScriptFunctionCalls. The further plan is to serialize these script function calls.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25419
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToConsole):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::inspect):
+        (WebCore::InspectorController::focusNode):
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::setAttachedWindow):
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::scriptObjectReady):
+        (WebCore::InspectorController::showPanel):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::pruneResources):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        (WebCore::InspectorController::didOpenDatabase):
+        (WebCore::InspectorController::didUseDOMStorage):
+        (WebCore::InspectorController::addScriptProfile):
+        (WebCore::InspectorController::toggleRecordButton):
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
+        (WebCore::InspectorController::enableDebugger):
+        (WebCore::InspectorController::disableDebugger):
+        (WebCore::InspectorController::didParseSource):
+        (WebCore::InspectorController::failedToParseSource):
+        (WebCore::InspectorController::didPause):
+        (WebCore::InspectorController::didContinue):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::bind):
+        * inspector/InspectorDOMStorageResource.h:
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorDatabaseResource.h:
+        * inspector/InspectorFrontend.cpp: Added.
+        (WebCore::callSimpleFunction):
+        (WebCore::InspectorFrontend::InspectorFrontend):
+        (WebCore::InspectorFrontend::~InspectorFrontend):
+        (WebCore::InspectorFrontend::newJSONObject):
+        (WebCore::InspectorFrontend::addMessageToConsole):
+        (WebCore::InspectorFrontend::addResource):
+        (WebCore::InspectorFrontend::updateResource):
+        (WebCore::InspectorFrontend::removeResource):
+        (WebCore::InspectorFrontend::updateFocusedNode):
+        (WebCore::InspectorFrontend::setAttachedWindow):
+        (WebCore::InspectorFrontend::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorFrontend::showPanel):
+        (WebCore::InspectorFrontend::populateInterface):
+        (WebCore::InspectorFrontend::reset):
+        (WebCore::InspectorFrontend::debuggerWasEnabled):
+        (WebCore::InspectorFrontend::debuggerWasDisabled):
+        (WebCore::InspectorFrontend::profilerWasEnabled):
+        (WebCore::InspectorFrontend::profilerWasDisabled):
+        (WebCore::InspectorFrontend::parsedScriptSource):
+        (WebCore::InspectorFrontend::failedToParseScriptSource):
+        (WebCore::InspectorFrontend::addProfile):
+        (WebCore::InspectorFrontend::setRecordingProfile):
+        (WebCore::InspectorFrontend::pausedScript):
+        (WebCore::InspectorFrontend::resumedScript):
+        (WebCore::InspectorFrontend::addDatabase):
+        (WebCore::InspectorFrontend::addDOMStorage):
+        * inspector/InspectorFrontend.h: Added.
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+        (WebCore::InspectorResource::releaseScriptObject):
+        * inspector/InspectorResource.h:
+
+2009-05-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Introduce JSONObject that wraps ScriptObject and ScriptState* for further serialization
+
+        https://bugs.webkit.org/show_bug.cgi?id=25419
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToConsole):
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::bind):
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::bind):
+        * inspector/InspectorResource.cpp:
+        (WebCore::populateHeadersObject):
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+        * inspector/JSONObject.cpp: Added.
+        (WebCore::JSONObject::JSONObject):
+        (WebCore::JSONObject::set):
+        (WebCore::JSONObject::scriptObject):
+        (WebCore::JSONObject::createNew):
+        * inspector/JSONObject.h: Added.
+
+2009-05-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Refactor InpectorController so that it does not instantiate resource/console/database/domresource javascript objects. Move instantiation into the javascript.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25419
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToConsole):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::InspectorDOMStorageResource):
+        (WebCore::InspectorDOMStorageResource::bind):
+        (WebCore::InspectorDOMStorageResource::unbind):
+        * inspector/InspectorDOMStorageResource.h:
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::InspectorDatabaseResource):
+        (WebCore::InspectorDatabaseResource::bind):
+        (WebCore::InspectorDatabaseResource::unbind):
+        * inspector/InspectorDatabaseResource.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::InspectorResource):
+        (WebCore::populateHeadersObject):
+        (WebCore::InspectorResource::createScriptObject):
+        (WebCore::InspectorResource::updateScriptObject):
+        (WebCore::InspectorResource::releaseScriptObject):
+        * inspector/InspectorResource.h:
+        * inspector/front-end/Console.js:
+        (WebInspector.ConsoleMessage):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+        (WebInspector.updateResource):
+        (WebInspector.removeResource):
+        (WebInspector.addDatabase):
+        (WebInspector.addDOMStorage):
+        (WebInspector.reset):
+        (WebInspector.addMessageToConsole):
+
+2009-05-19  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Ariya Hidayat.
+
+        The Qt port has code that disables scrolling optimizations
+        when the root contains native windows, such as windowed plugins.
+
+        This code broke when detaching iframes containing windowed
+        plugins.
+
+        Each ScrollView now knows how many native windows it and its
+        children contain, and when it is detached, that number is
+        substracted from its old parents.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::setParent):
+        * platform/ScrollView.h:
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::adjustWidgetsPreventingBlittingCount):
+        (WebCore::ScrollView::platformAddChild):
+        (WebCore::ScrollView::platformRemoveChild):
+
+2009-05-18  David Kilzer  <ddkilzer@apple.com>
+
+        Tiger build fix for r43850
+
+        * platform/mac/ClipboardMac.mm: Added typedef for NSUinteger
+        when building on Tiger.
+
+2009-05-18  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        ClipboardMac cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=25847
+
+        I'm mostly just moving code, however there are 3 changes I made while moving, detailed below.
+
+        No functional changes, so no tests.
+
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::clearData):
+        (WebCore::absoluteURLsFromPasteboardFilenames):
+          Broke out logic for filenames into its own function to make the caller more readable.
+        (WebCore::absoluteURLsFromPasteboard):
+          Broke out logic from getData into absoluteURLsFromPasteboard. This returns an NSArray
+          so that we can use -[NSArray componentsJoinedByString] in the caller (which is
+          cleaner than the manual "\n" addition before).
+          This also access to the full list of file urls for future callers.
+        (WebCore::ClipboardMac::getData):
+          unsigned count = (type == "URL") ? 1 : [fileList count]; is now an
+          explicit check for "URL", before it was a check for != "text/uri-list" which
+          was much more confusing in my opinion.  text/uri-list and URL are the only
+          two types which map to NSURLPboardType in cocoaTypeFromMIMEType().
+        (WebCore::ClipboardMac::types):
+          I removed an extra if (!types) check, right before [types count].  In Obj-C
+          messaging nil will return 0 (size of a pointer), so it's safe to message nil
+          here and expect it to return 0.
+
+2009-05-18  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Bug 25859: Need to upstream ScriptController.* for v8.
+        https://bugs.webkit.org/show_bug.cgi?id=25859
+
+        * bindings/v8/ScriptController.cpp: Added.
+        * bindings/v8/ScriptController.h: Added.
+
+2009-05-18  Yichao Yin  <yichao.yin@torchmobile.com.cn>
+
+        Reviewed by George Staikos.
+
+        Change ScriptElement to support XHTMLMP in a better way
+        https://bugs.webkit.org/show_bug.cgi?id=23452
+
+        * dom/ScriptElement.h:
+        * html/HTMLScriptElement.h:
+        * svg/SVGScriptElement.h:
+        (WebCore::SVGScriptElement::shouldExecuteAsJavaScript):
+
+2009-05-18  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, finish up changes after the accessibility dir split.
+
+        * webcore-base.bkl:
+
+2009-05-18  Yichao Yin  <yichao.yin@torchmobile.com.cn>
+
+        Reviewed by George Staikos (and others).
+
+        Add XHTMLMP support to Webkit
+        https://bugs.webkit.org/show_bug.cgi?id=23452
+        XHTMLMP is a strict subset of XHTML 1.1. It extends XHTML Basic and add enhanced
+        functionality. Most of the functionalities have already been implemented by Webkit.
+        
+        The changes include:
+        1) Adding <noscript> support
+        2) Document conformance validation
+        3) User Agent conformance validation
+ 
+        refer to the specification: OMA-WAP-XHTMLMP-V1_1-20061020-A.pdf
+
+        Tests: fast/xhtmlmp/check-doctype-declaration.xhtml
+               fast/xhtmlmp/check-rootelement.xhtml
+               fast/xhtmlmp/noscript-in-multiscripts.xhtml
+               fast/xhtmlmp/noscript-nested.xhtml
+               fast/xhtmlmp/noscript.xhtml
+
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::isXHTMLMPDocument):
+        * dom/Document.h:
+        (WebCore::Document::shouldProcessNoscriptElement):
+        (WebCore::Document::setShouldProcessNoscriptElement):
+        * dom/Node.cpp:
+        (WebCore::Node::createRendererIfNeeded):
+        * dom/Node.h:
+        * dom/XMLTokenizer.h:
+        (WebCore::XMLTokenizer::setIsXHTMLMPDocument):
+        (WebCore::XMLTokenizer::isXHTMLMPDocument):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        (WebCore::XMLTokenizer::startElementNs):
+        (WebCore::XMLTokenizer::endElementNs):
+        (WebCore::XMLTokenizer::endDocument):
+        (WebCore::XMLTokenizer::internalSubset):
+        (WebCore::getEntityHandler):
+        (WebCore::externalSubsetHandler):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        (WebCore::XMLTokenizer::parse):
+        (WebCore::XMLTokenizer::parseStartElement):
+        (WebCore::XMLTokenizer::parseEndElement):
+        (WebCore::):
+        * dom/make_names.pl:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::rendererIsNeeded):
+        * html/HTMLNoScriptElement.cpp: Added.
+        (WebCore::HTMLNoScriptElement::HTMLNoScriptElement):
+        (WebCore::HTMLNoScriptElement::~HTMLNoScriptElement):
+        (WebCore::HTMLNoScriptElement::checkDTD):
+        (WebCore::HTMLNoScriptElement::attach):
+        (WebCore::HTMLNoScriptElement::recalcStyle):
+        (WebCore::HTMLNoScriptElement::childShouldCreateRenderer):
+        (WebCore::HTMLNoScriptElement::styleForRenderer):
+        * html/HTMLNoScriptElement.h: Added.
+        (WebCore::HTMLNoScriptElement::rendererIsNeeded):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode):
+        (WebCore::HTMLParser::isInline):
+        * html/HTMLTagNames.in:
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler):
+        (WebCore::HTMLTokenizer::notifyFinished):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::addExtraFieldsToRequest):
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedNonImageMimeTypes):
+
+2009-05-18  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-05-18  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Rubber-stamped by Gustavo Noronha.
+
+        Fixed build for the Qt port by adding the WebCore/accessibility
+        directory to the includepath.
+
+        * WebCore.pro:
+
+2009-05-18  Chris Fleizach  <cfleizach@apple.com>
+
+        Bug 25776: accessibility should have its own folder in WebCore project
+        https://bugs.webkit.org/show_bug.cgi?id=25776
+   
+        Speculative fix for windows build failure.
+
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+
+2009-05-18  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 20652: WebKit doesn't display favicons with MIME type image/vnd.microsoft.icon
+
+        <https://bugs.webkit.org/show_bug.cgi?id=20652>
+
+        Reviewed by Darin Adler.
+
+        Test: http/tests/misc/favicon-as-image.html
+
+        * inspector/front-end/inspector.js: Added
+        image/vnd.microsoft.icon to WebInspector.MIMETypes.
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes): Added
+        image/vnd.microsoft.icon to list of supported image and image
+        resource MIME types.
+
+2009-05-18  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25776: accessibility should have its own folder in WebCore project
+        https://bugs.webkit.org/show_bug.cgi?id=25776
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * accessibility: Added.
+        * accessibility/AXObjectCache.cpp: Copied from WebCore/page/AXObjectCache.cpp.
+        * accessibility/AXObjectCache.h: Copied from WebCore/page/AXObjectCache.h.
+        * accessibility/AccessibilityAriaGrid.cpp: Copied from WebCore/page/AccessibilityAriaGrid.cpp.
+        * accessibility/AccessibilityAriaGrid.h: Copied from WebCore/page/AccessibilityAriaGrid.h.
+        * accessibility/AccessibilityAriaGridCell.cpp: Copied from WebCore/page/AccessibilityAriaGridCell.cpp.
+        * accessibility/AccessibilityAriaGridCell.h: Copied from WebCore/page/AccessibilityAriaGridCell.h.
+        * accessibility/AccessibilityAriaGridRow.cpp: Copied from WebCore/page/AccessibilityAriaGridRow.cpp.
+        * accessibility/AccessibilityAriaGridRow.h: Copied from WebCore/page/AccessibilityAriaGridRow.h.
+        * accessibility/AccessibilityImageMapLink.cpp: Copied from WebCore/page/AccessibilityImageMapLink.cpp.
+        * accessibility/AccessibilityImageMapLink.h: Copied from WebCore/page/AccessibilityImageMapLink.h.
+        * accessibility/AccessibilityList.cpp: Copied from WebCore/page/AccessibilityList.cpp.
+        * accessibility/AccessibilityList.h: Copied from WebCore/page/AccessibilityList.h.
+        * accessibility/AccessibilityListBox.cpp: Copied from WebCore/page/AccessibilityListBox.cpp.
+        * accessibility/AccessibilityListBox.h: Copied from WebCore/page/AccessibilityListBox.h.
+        * accessibility/AccessibilityListBoxOption.cpp: Copied from WebCore/page/AccessibilityListBoxOption.cpp.
+        * accessibility/AccessibilityListBoxOption.h: Copied from WebCore/page/AccessibilityListBoxOption.h.
+        * accessibility/AccessibilityObject.cpp: Copied from WebCore/page/AccessibilityObject.cpp.
+        * accessibility/AccessibilityObject.h: Copied from WebCore/page/AccessibilityObject.h.
+        * accessibility/AccessibilityRenderObject.cpp: Copied from WebCore/page/AccessibilityRenderObject.cpp.
+        * accessibility/AccessibilityRenderObject.h: Copied from WebCore/page/AccessibilityRenderObject.h.
+        * accessibility/AccessibilityTable.cpp: Copied from WebCore/page/AccessibilityTable.cpp.
+        * accessibility/AccessibilityTable.h: Copied from WebCore/page/AccessibilityTable.h.
+        * accessibility/AccessibilityTableCell.cpp: Copied from WebCore/page/AccessibilityTableCell.cpp.
+        * accessibility/AccessibilityTableCell.h: Copied from WebCore/page/AccessibilityTableCell.h.
+        * accessibility/AccessibilityTableColumn.cpp: Copied from WebCore/page/AccessibilityTableColumn.cpp.
+        * accessibility/AccessibilityTableColumn.h: Copied from WebCore/page/AccessibilityTableColumn.h.
+        * accessibility/AccessibilityTableHeaderContainer.cpp: Copied from WebCore/page/AccessibilityTableHeaderContainer.cpp.
+        * accessibility/AccessibilityTableHeaderContainer.h: Copied from WebCore/page/AccessibilityTableHeaderContainer.h.
+        * accessibility/AccessibilityTableRow.cpp: Copied from WebCore/page/AccessibilityTableRow.cpp.
+        * accessibility/AccessibilityTableRow.h: Copied from WebCore/page/AccessibilityTableRow.h.
+        * accessibility/chromium: Added.
+        * accessibility/chromium/AXObjectCacheChromium.cpp: Copied from WebCore/page/chromium/AXObjectCacheChromium.cpp.
+        * accessibility/chromium/AccessibilityObjectChromium.cpp: Copied from WebCore/page/chromium/AccessibilityObjectChromium.cpp.
+        * accessibility/chromium/AccessibilityObjectWrapper.h: Copied from WebCore/page/chromium/AccessibilityObjectWrapper.h.
+        * accessibility/gtk: Added.
+        * accessibility/gtk/AXObjectCacheAtk.cpp: Copied from WebCore/page/gtk/AXObjectCacheAtk.cpp.
+        * accessibility/gtk/AccessibilityObjectAtk.cpp: Copied from WebCore/page/gtk/AccessibilityObjectAtk.cpp.
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp: Copied from WebCore/page/gtk/AccessibilityObjectWrapperAtk.cpp.
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.h: Copied from WebCore/page/gtk/AccessibilityObjectWrapperAtk.h.
+        * accessibility/mac: Added.
+        * accessibility/mac/AXObjectCacheMac.mm: Copied from WebCore/page/mac/AXObjectCacheMac.mm.
+        * accessibility/mac/AccessibilityObjectMac.mm: Copied from WebCore/page/mac/AccessibilityObjectMac.mm.
+        * accessibility/mac/AccessibilityObjectWrapper.h: Copied from WebCore/page/mac/AccessibilityObjectWrapper.h.
+        * accessibility/mac/AccessibilityObjectWrapper.mm: Copied from WebCore/page/mac/AccessibilityObjectWrapper.mm.
+        * accessibility/qt: Added.
+        * accessibility/qt/AccessibilityObjectQt.cpp: Copied from WebCore/page/qt/AccessibilityObjectQt.cpp.
+        * accessibility/win: Added.
+        * accessibility/win/AXObjectCacheWin.cpp: Copied from WebCore/page/win/AXObjectCacheWin.cpp.
+        * accessibility/win/AccessibilityObjectWin.cpp: Copied from WebCore/page/win/AccessibilityObjectWin.cpp.
+        * accessibility/win/AccessibilityObjectWrapperWin.h: Copied from WebCore/page/win/AccessibilityObjectWrapperWin.h.
+        * accessibility/wx: Added.
+        * accessibility/wx/AccessibilityObjectWx.cpp: Copied from WebCore/page/wx/AccessibilityObjectWx.cpp.
+        * page/AXObjectCache.cpp: Removed.
+        * page/AXObjectCache.h: Removed.
+        * page/AccessibilityAriaGrid.cpp: Removed.
+        * page/AccessibilityAriaGrid.h: Removed.
+        * page/AccessibilityAriaGridCell.cpp: Removed.
+        * page/AccessibilityAriaGridCell.h: Removed.
+        * page/AccessibilityAriaGridRow.cpp: Removed.
+        * page/AccessibilityAriaGridRow.h: Removed.
+        * page/AccessibilityImageMapLink.cpp: Removed.
+        * page/AccessibilityImageMapLink.h: Removed.
+        * page/AccessibilityList.cpp: Removed.
+        * page/AccessibilityList.h: Removed.
+        * page/AccessibilityListBox.cpp: Removed.
+        * page/AccessibilityListBox.h: Removed.
+        * page/AccessibilityListBoxOption.cpp: Removed.
+        * page/AccessibilityListBoxOption.h: Removed.
+        * page/AccessibilityObject.cpp: Removed.
+        * page/AccessibilityObject.h: Removed.
+        * page/AccessibilityRenderObject.cpp: Removed.
+        * page/AccessibilityRenderObject.h: Removed.
+        * page/AccessibilityTable.cpp: Removed.
+        * page/AccessibilityTable.h: Removed.
+        * page/AccessibilityTableCell.cpp: Removed.
+        * page/AccessibilityTableCell.h: Removed.
+        * page/AccessibilityTableColumn.cpp: Removed.
+        * page/AccessibilityTableColumn.h: Removed.
+        * page/AccessibilityTableHeaderContainer.cpp: Removed.
+        * page/AccessibilityTableHeaderContainer.h: Removed.
+        * page/AccessibilityTableRow.cpp: Removed.
+        * page/AccessibilityTableRow.h: Removed.
+        * page/chromium/AXObjectCacheChromium.cpp: Removed.
+        * page/chromium/AccessibilityObjectChromium.cpp: Removed.
+        * page/chromium/AccessibilityObjectWrapper.h: Removed.
+        * page/gtk/AXObjectCacheAtk.cpp: Removed.
+        * page/gtk/AccessibilityObjectAtk.cpp: Removed.
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp: Removed.
+        * page/gtk/AccessibilityObjectWrapperAtk.h: Removed.
+        * page/mac/AXObjectCacheMac.mm: Removed.
+        * page/mac/AccessibilityObjectMac.mm: Removed.
+        * page/mac/AccessibilityObjectWrapper.h: Removed.
+        * page/mac/AccessibilityObjectWrapper.mm: Removed.
+        * page/qt/AccessibilityObjectQt.cpp: Removed.
+        * page/win/AXObjectCacheWin.cpp: Removed.
+        * page/win/AccessibilityObjectWin.cpp: Removed.
+        * page/win/AccessibilityObjectWrapperWin.h: Removed.
+        * page/wx/AccessibilityObjectWx.cpp: Removed.
+
+2009-05-18  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25854
+        [GTK] Should tell servers we only support identity as content encoding
+
+        Let servers know we only support identity as content
+        encoding. We will implement this in libsoup.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startHttp):
+
+2009-05-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6881160> REGRESSION (r41425): Unable to create battle.net account due to
+        CAPTCHA failure.
+
+        The problem was that after loading and displaying a CAPTCHA image, it was loaded from
+        the server again due to preloading. So, the server expected the last loaded (invisible)
+        CAPTCHA text to be typed and posted back.
+
+        I don't know how to make tests for preloading.
+
+        * loader/DocLoader.cpp: (WebCore::DocLoader::checkForPendingPreloads): There is never a reason
+        to preload after loading for real - and if cache policy is CachePolicyReload, that actually
+        results in another load from network layer.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::cachePolicy): It's not good for cachePolicy()
+        to lie, but I don't know how to re-do r41425 properly. Added a FIXME.
+
+2009-05-18  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Done together with Balazs Kelemen  <kelemen.balazs@stud.u-szeged.hu>.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24551
+
+        [Qt] Reuse FontPlatformData for the same FontDescription.
+        This effectively prevents growing heap usage for loading every web page.
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::qHash): Necessary for FontPlatformDataCache.
+        (WebCore::FontCache::getCachedFontPlatformData): Reuse the instance if
+        it exists, otherwise create a new one and insert it in the cache.
+
+2009-05-18  Balazs Kelemen  <kelemen.balazs@stud.u-szeged.hu>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24551
+
+        [Qt] Fix the leak in FontFallbackList::fontDataAt() function.
+        When creating a new instance of SimpleFontData, put it in the font list
+        so that it can deleted later on.
+
+        * platform/graphics/qt/FontFallbackListQt.cpp:
+        (WebCore::FontFallbackList::invalidate):
+        (WebCore::FontFallbackList::releaseFontData):
+        (WebCore::FontFallbackList::fontDataAt):
+
+2009-05-15  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+         Reviewed by Xan Lopez.
+
+         [Gtk] Various autotools build refactoring and fixes
+         https://bugs.webkit.org/show_bug.cgi?id=25286
+
+         Style fixes
+
+         * GNUmakefile.am:
+
+2009-05-17  George Staikos  <george.staikos@torchmobile.com>
+
+        Not reviewed - build fix.
+
+        Fix typo: constr -> const.
+
+        * wml/WMLInputElement.h:
+        (WebCore::WMLInputElement::setPlaceholder):
+
+2009-05-17  Darin Adler  <darin@apple.com>
+
+        Fix done by Simon Fraser (reviewed by me).
+
+        <rdar://problem/6893775> Page with screen-only stylesheet with overflow and height
+        transitions has bad layout and overlapping garbled text when printing
+
+        * manual-tests/print-with-height-transition-in-screen-stylesheet.html: Added.
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationController::updateAnimations): Don't run transitions when printing.
+
+2009-05-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6870241> REGRESSION: Programmatically selected popup menu item not shown
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setSelectedIndex): Added a call to updateFromElement and
+        also a type check on the selected index to avoid a bad cast to HTMLOptionElement.
+
+        * manual-tests/select-option-in-onload.html: Added.
+
+2009-05-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson
+
+        Rename local variables for readability.
+        
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBorder):
+
+2009-05-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 25840: fix some warnings seen on the GTK bot
+        https://bugs.webkit.org/show_bug.cgi?id=25840
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::platformScrollbarModes): Initialize results here.
+        This is really just to quiet warnings. I think this code is unreachable.
+        Someone could put ASSERT_NOT_REACHED() in here too at some point.
+
+        * plugins/PluginStream.cpp:
+        (WebCore::PluginStream::startStream): Use proper printf format for int
+        here, %d, not %lu. This could cause a real problem when compiled 64-bit,
+        so it's good to fix.
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::getNextSoftBreak): Initialize breakOffset to 0 here. This is
+        really just to quiet the warning, but still seems like a good idea.
+
+2009-05-17  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25769: Fix accessibility warnings on GTK
+        https://bugs.webkit.org/show_bug.cgi?id=25769
+
+        * page/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::columnCount): Get rid of excess const.
+        (WebCore::AccessibilityTable::rowCount): Ditto.
+        * page/AccessibilityTable.h: Ditto.
+
+2009-05-17  Kai Brüning  <kai@granus.net>
+
+        Reviewed by Darin Adler.
+
+        bug 25822: DOM normalize does not remove empty text node between element nodes
+        https://bugs.webkit.org/show_bug.cgi?id=25822
+
+        Test: fast/dom/Node/normalize.html
+
+        * dom/Node.cpp:
+        (WebCore::Node::normalize): Changed to remove any empty text nodes.
+
+2009-05-16  Dave Moore  <davemoore@google.com>
+
+        Reviewed by Darin Adler.
+
+        Allow Strings to be created with one malloc node with no copying
+        https://bugs.webkit.org/show_bug.cgi?id=25779
+
+        Add new methods to String and StringImpl, refactoring existing
+        methods in StringImpl to use new createUninitialized() method.
+
+        * platform/text/PlatformString.h:
+        (WebCore::String::createUninitialized):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::createUninitialized):
+        (WebCore::StringImpl::create):
+        * platform/text/StringImpl.h:
+
+2009-05-16  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6827041> WebCore should stop throwing away the CGImageSourceRef to
+        dramatically improve animated GIF decoding performance
+
+        Recent versions of ImageIO discard previously decoded image frames if the client
+        application no longer holds references to them, so there's no need to throw away
+        the decoder unless we're explicitly asked to destroy all of the frames.
+
+        This drops peak CPU usage when displaying <http://www.aintitcool.com/files/HoD2.gif>
+        from over 90% to below 3%.
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::clear):
+
+2009-05-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        - fix <rdar://problem/6873305> Two distinct characters are not displayed
+          correctly with 2 of the font selections from the stickies widget
+
+        Test: platform/mac/editing/pasteboard/text-precomposed.html
+
+        Ensure that "text/plain" data retrieved from the clipboard is always
+        precomposed. This makes Clipboard::getData() and
+        Pasteboard::documentFragment() consistent with Pasteboard::plainText()
+        and -[WebHTMLView _documentFragmentFromPasteboard:forType:inContext:subresources:].
+
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::getData):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::documentFragment):
+
+2009-05-16  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::valueForFamily): Declare valueForFamily as static.
+
+2009-05-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6883872> REGRESSION (r43243): computed style for font-family is returning
+        only the generic font, if any generic font is in the family list
+
+        Test: fast/css/getComputedStyle/computed-style-font-family.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        Sorted computedProperties alphabetically. Added CSSPropertyClip and CSSPropertyWordBreak.
+        (WebCore::identifierForFamily): Added. Maps internal font family names to identifiers.
+        (WebCore::valueForFamily): Added. Creates either an identifier or a string as appropriate.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Implemented the font-family
+        property as specified in the CSS standard. Fixed clip to return "auto" when there is no
+        clip set instead of nothing at all. Gave inheritableProperties and numInheritableProperties
+        internal linkage since there was no reason for them to have external linkage.
+
+2009-05-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25741
+
+        Append instead of throwing when insertItemBefore gets an out-of-bound
+        index.
+
+        Test: svg/dom/svglist-insertItemBefore-appends.html
+
+        * svg/SVGList.h:
+        (WebCore::SVGList::insertItemBefore):
+
+2009-05-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25829
+        
+        Fix -webkit-background-clip:text when the renderer had a non (0,0) x, y offset.
+
+        Test: fast/backgrounds/background-clip-text.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+
+2009-05-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix <rdar://problem/6888244> REGRESSION: Using the Up or Down keyboard
+          arrows, I can't navigate caret between To Do items in a Note message
+
+        Test: editing/selection/move-by-line-004.html
+
+        * editing/visible_units.cpp:
+        (WebCore::enclosingNodeWithNonInlineRenderer): Added this helper
+        function.
+        (WebCore::previousLinePosition): When advancing to the next candidate
+        node, stop when leaving the closest ancestor of the original node that
+        is not an inline. The code, incorrectly, was trying to exit the closest
+        ancestor of that type which was editable, and therefore missing other
+        blocks in the same editable root.
+        (WebCore::nextLinePosition): Ditto.
+
+2009-05-15  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Jan Alonzo.
+
+        Converting filename to uri by concatenating strings is broken
+        on Windows. So, don't do it for that platform.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startGio):
+
+2009-05-15  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Upstream V8 bindings for HTMLOptionsCollection and HTMLSelectElementCollection.
+        https://bugs.webkit.org/show_bug.cgi?id=25739
+
+        * bindings/v8/V8Collection.cpp: Added.
+        (WebCore::toOptionsCollectionSetter): Moved from v8_custom.cpp.
+        * bindings/v8/V8Collection.h: Added prototype for toOptionsCollectionSetter().
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_SETTER): Moved from v8_custom.cpp.
+        * bindings/v8/custom/V8HTMLSelectElementCollectionCustom.cpp: Added.
+        (WebCore::NAMED_PROPERTY_GETTER):  Moved from v8_custom.cpp.
+        (WebCore::INDEXED_PROPERTY_SETTER):  Moved from v8_custom.cpp.
+
+2009-05-15  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6649936> Add *.exp export files to WebCore Xcode project
+
+        Reviewed by Darin Adler and Timothy Hatcher.
+
+        * WebCore.xcodeproj/project.pbxproj: Added Exports group, moved
+        WebCore.base.exp into the group, and added 10 other *.exp files
+        in WebCore.
+
+2009-05-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25826
+        Change type to only have custom getter in JCS.
+
+        * html/HTMLInputElement.idl: Changed CustomGetter attribute to JSCCustomGetter.
+
+2009-05-15  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+
+        Add a settings entry to en/disable web font support
+        https://bugs.webkit.org/show_bug.cgi?id=25239
+
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::addFontFaceRule):
+
+2009-05-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Steve Falkenburg.
+
+        Remove dead youtube site specific hack that was commented out.
+
+        * bindings/js/JSNavigatorCustom.cpp:
+        * page/Navigator.idl:
+
+2009-05-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=25826
+        <rdar://problem/6884742> 
+        REGRESSION: In Gmail's Edit Link dialog, I can't type in the Link To: field (due to <input type=url> support)
+
+        Added a site specific quirk for mail.google.com which returns "text" when getting the type of an <input type=url>
+
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        (WebCore::needsGmailQuirk):
+        (WebCore::JSHTMLInputElement::type):
+        * html/HTMLInputElement.idl:
+
+2009-05-14  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25810
+        Upstream V8 DOM Wrapper map declarations.
+
+        No behavior change, so no tests.
+
+        * bindings/v8/V8DOMMap.h:
+        (WebCore::WeakReferenceMap::WeakReferenceMap): Added.
+        (WebCore::WeakReferenceMap::~WeakReferenceMap): Added.
+        (WebCore::WeakReferenceMap::get): Added.
+        (WebCore::WeakReferenceMap::set): Added.
+        (WebCore::WeakReferenceMap::forget): Added.
+        (WebCore::WeakReferenceMap::contains): Added.
+        (WebCore::WeakReferenceMap::impl): Added.
+        (WebCore::DOMWrapperMap::DOMWrapperMap): Added.
+
+2009-05-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25773
+        
+        Rename GraphicsLayer::graphicsContextsFlipped() to 
+        GraphicsLayer::compositingCoordinatesOrientation() in order to clarify the usage.
+
+        Clean up code around the GraphicsLayer "contents" layer that makes use of this
+        flag, by removing the setHasContentsLayer() method, and just using setContentsLayer(),
+        which can then always do the flipping if necessary.
+
+        Only affects ACCELERATED_COMPOSITING builds.
+        
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        (WebCore::GraphicsLayerCA::contentsLayer):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayer::compositingCoordinatesOrientation):
+        (WebCore::GraphicsLayerCA::setBackgroundColor):
+        (WebCore::GraphicsLayerCA::clearBackgroundColor):
+        (WebCore::GraphicsLayerCA::setContentsToImage):
+        (WebCore::GraphicsLayerCA::clearContents):
+        (WebCore::GraphicsLayerCA::swapFromOrToTiledLayer):
+        (WebCore::GraphicsLayerCA::setContentsLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+
+2009-05-15  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25765
+
+        Avoid calling setNeedsStyleRecalc() when we are
+        putting an animated page in the cache. This avoids
+        the assert and subsequent problems with a dirty 
+        page going into the cache.
+
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::endAnimation):
+
+2009-05-15  Francisco Tolmasky  <francisco@280north.com>
+
+        BUG 25467: JavaScript debugger should use function.displayName as the function's name in the call stack
+        <https://bugs.webkit.org/show_bug.cgi?id=25467>
+        
+        Reviewed by Adam Roben.
+
+        * inspector/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::functionName): Use calculatedFunctionName which takes into account displayName
+        * inspector/front-end/CallStackSidebarPane.js: Remove "|| anonymous function" since it is handled internally just like in profiles
+        (WebInspector.CallStackSidebarPane.prototype.update):
+
+2009-05-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Windows build fix (and a matching Mac change, to avoid unnecessarily diverging the implementations).
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::start):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        Check strings with isEmpty(), not relying on any implicit conversions.
+
+2009-05-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler, Brady Eidson and Eric Carlson.
+
+        <rdar://problem/6875643> REGRESSION: Unable to download file with FTP URL that includes
+        username and password (Lightwave 9.6 for Mac from Newtek site)
+
+        CFNetwork only invokes didReceiveAuthenticationChallenge for HTTP requests. Credentials
+        for other protocols (including FTP) should be included as part of the URL.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::WebCoreSynchronousLoader::load):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
+        Put credentials in URL for non-HTTP requests.
+
+        * xml/XMLHttpRequest.cpp: (WebCore::XMLHttpRequest::makeSimpleCrossOriginAccessRequest):
+        Bail out quickly if the URL is non-HTTP. Cross-origin requests require specific HTTP
+        headers to be received, so they cannot work with other protocols.
+
+2009-05-15  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] In the image decoder, remove the raw image data represented as QImage
+        once the image is converted to QPixmap and inserted in the pixmap cache.
+        This effectively reduces the heap usage when running on graphics system
+        other than raster (i.e the case where QImage != QPixmap).
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::imageAtIndex): Nullified the image on purpose.
+        * platform/graphics/qt/ImageDecoderQt.h: Made m_imageList mutable.
+
+2009-05-15  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Refactor alpha channel detection the image decoder.
+        Sets the boolean flag as soon as the image is being read.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::ImageDecoderQt): Initialized m_hasAlphaChannel.
+        (WebCore::ImageDecoderQt::setData): Set the flag when appropriate.
+        (WebCore::ImageDecoderQt::supportsAlpha): Simplified.
+        (WebCore::ImageDecoderQt::reset): Resetted the flag.
+        * platform/graphics/qt/ImageDecoderQt.h: Added m_hasAlphaChannel.
+
+2009-05-15  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Finish support for disabling the JavaScript Debugger and Profiler 
+        at compile time in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=24917
+
+        * bindings/js/JSInspectorControllerCustom.cpp: ENABLE_JAVASCRIPT_DEBUGGER guard
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp: Ditto.
+        * inspector/JavaScriptCallFrame.cpp: Ditto.
+        * inspector/JavaScriptCallFrame.h: Ditto.
+        * inspector/JavaScriptCallFrame.idl: Ditto.
+        * inspector/JavaScriptDebugListener.h: Ditto.
+        * inspector/JavaScriptDebugServer.cpp: Ditto.
+        * inspector/JavaScriptDebugServer.h: Ditto.
+        * inspector/JavaScriptProfile.cpp: Ditto.
+        * inspector/JavaScriptProfile.h: Ditto.
+        * inspector/JavaScriptProfileNode.cpp: Ditto.
+        * inspector/JavaScriptProfileNode.h: Ditto.
+        * page/Console.cpp: Use guard ENABLE(JAVASCRIPT_DEBUGGER) instead of USE(JSC)
+        * page/Console.h: Ditto.
+        * page/Console.idl: Use guard ENABLE(JAVASCRIPT_DEBUGGER) instead of !defined(V8_BINDING)
+
+2009-05-15  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Dimitri Glazkov
+
+        http://bugs.webkit.org/show_bug.cgi?id=25464
+
+        Improve the font fallback for characters belonging to 'common' scripts
+        in ChromiumWin port. Make characters like Danda, Double Danda (punctuation
+        marks in North Indian scripts) and currency signs (e.g. Thai Baht)
+        rendered correctly in Chromium on Win. 
+
+        Tests: fast/text/international/danda-space.html
+               fast/text/international/thai-baht-space.html
+
+        * platform/graphics/chromium/FontUtilsChromiumWin.cpp:
+        (WebCore::FontMap::getScriptBasedOnUnicodeBlock):
+        (WebCore::FontMap::getScript):
+        (WebCore::getFallbackFamily):
+
+2009-05-15  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25731
+        [Qt] Cleanup - move files exclusive to XPATH and XSLT under the
+        appropriate build section
+
+        * WebCore.pro:
+
+2009-05-14  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel and Darin Fisher.
+
+        Fix a font-related leak in Chromium's Skia backend found by Valgrind.
+        https://bugs.webkit.org/show_bug.cgi?id=25760
+
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::getFontDataForCharacters):
+        Use caches instead of "new" on every call.
+
+2009-05-14  Rahul Kuchhal  <kuchhal@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Initialize m_spreadMethod in the second constructor too. Not sure if
+        a test case can be written, so no test case.
+        https://bugs.webkit.org/show_bug.cgi?id=25814
+
+        No test possible: spreadMethod() is only used by SVG, doesn't seem possible to hit
+        this case, since several other SVG tests already should be calling
+        spreadMethod().
+
+        * platform/graphics/Gradient.cpp:
+        (WebCore::Gradient::Gradient):
+
+2009-05-14  Simon Fraser  <simon.fraser@apple.com>
+
+        No review.
+
+        Fix Windows build after renaming MediaControlElements to MediaControlElementType.
+
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart):
+        * rendering/RenderMediaControls.h:
+
+2009-05-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+        
+        <rdar://problem/6739671> Movie controller’s play button does not change into a pause
+        button
+
+        Fix a controls repaint issue when the playing state of a video changes by
+        educating the MediaControlInputElements about the state they are currently
+        displaying, and making them repaint when that state changes. This applies
+        to the play/pause and mute/unmute buttons, which both have two states.
+        
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+        (WebCore::MediaControlSeekButtonElement::MediaControlSeekButtonElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement):
+        Pass in and initialize the MediaControlElementType.
+        
+        (WebCore::MediaControlInputElement::update):
+        Update the display type too
+        
+        (WebCore::MediaControlInputElement::setDisplayType):
+        (WebCore::MediaControlMuteButtonElement::MediaControlMuteButtonElement):
+        (WebCore::MediaControlMuteButtonElement::updateDisplayType):
+        Choose muted vs. unmuted display.
+        
+        (WebCore::MediaControlPlayButtonElement::MediaControlPlayButtonElement):
+        (WebCore::MediaControlPlayButtonElement::updateDisplayType):
+        Choose play vs. paused display.
+
+        * rendering/MediaControlElements.h:
+        Renamed the MediaControlElements enum to MediaControlElementType.
+        (WebCore::MediaControlInputElement::updateDisplayType):
+        Add a MediaControlElementType member variable with a setter to allow
+        the element to know what type it is displaying.
+
+2009-05-14  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25197
+
+        Add support for aspect-ratio and orientation
+        media queries.
+
+        Tests: fast/media/mq-aspect-ratio.html
+               fast/media/mq-orientation.html
+
+        * css/MediaFeatureNames.h:
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::orientationMediaFeatureEval):
+        (WebCore::aspect_ratioMediaFeatureEval):
+        (WebCore::min_aspect_ratioMediaFeatureEval):
+        (WebCore::max_aspect_ratioMediaFeatureEval):
+        * css/MediaQueryExp.h:
+        (WebCore::MediaQueryExp::isViewportDependent):
+
+2009-05-14  Kevin McCullough  <kmccullough@apple.com>
+
+        - Resubmitting previous patch, correctly this time.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::splitTreeToNode):
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::outdentParagraph):
+
+2009-05-14  Kevin McCullough  <kmccullough@apple.com>
+
+        - Rolling out to fix a bug and the build
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::splitTreeToNode):
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::outdentParagraph):
+
+2009-05-14  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6510362> In some situations message content is messed up
+        when indentation is decreased
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::splitTreeToNode): Calling recursively
+        here served to do nothing because this function will return if the
+        second argument is the parent of the first.  Not only does this now work
+        as intended, but is necessary for the rest of this fix.
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::outdentParagraph): To determine if we 
+        are the last node in a <blockquote>, and can therefore remove the
+        <blockquote> we need the endOfEnclosingBlock to extend to the end of
+        the <blockquote> not just the next block, which could be a <div>, for
+        example. 
+        - Also If a <blockquote> is removed, but it's the child of another
+        <blockquote> then its children are now children of the top <blockquote>.
+        In this case we want to split the parent <blockquote> because the next
+        paragraph assumes that it is the first node in its <blockquote> and if
+        that is not true, various bugs arise.
+
+2009-05-14  Brady Eidson  <beidson@apple.com>
+
+        Build fix.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::setDefaultMIMEType):
+
+2009-05-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix http/tests/xmlhttprequest/cache-override.html on Windows
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::setDefaultMIMEType): Modify the previous response so it maintains all of its data.
+        (WebCore::didReceiveResponse): Call setDefaultMIMEType() when needed.
+        (WebCore::WebCoreSynchronousLoader::load): Ditto.
+
+2009-05-14  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug: Mac Chromium popup menus are not positioned correctly
+        on scrolled pages:
+        https://bugs.webkit.org/show_bug.cgi?id=25772
+
+        Fix Mac Chromium popup menu placement by taking into
+        account any scrolling in the current window. This mirrors
+        the positioning done in PopupContainer::show(), which is
+        used on Chromium Windows and linux.
+
+        Also fixed indenting for this method.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::showExternal):
+
+2009-05-14  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25774
+        Upstream V8MessagePortCustom.cpp from the chromium repository.
+
+        * bindings/v8/custom/V8MessagePortCustom.cpp: Added.
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-05-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=25777
+        
+        StyleGeneratedImage::imageSize() needs to take zooming into account for
+        fixed-size images (i.e. canvas) so that canvas-as-image-background
+        renders correctly with zooming.
+
+        Test: fast/canvas/canvas-bg-zoom.html
+
+        * rendering/style/StyleGeneratedImage.cpp:
+        (WebCore::StyleGeneratedImage::imageSize):
+
+2009-05-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Patch originally by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25796
+        <rdar://problem/6886654> Shouldn't set referer and origin in Loader::Host::servePendingRequests().
+
+        Test: http/tests/security/credentials-in-referer.html
+
+        * loader/loader.cpp: (WebCore::Loader::Host::servePendingRequests): This will be done in
+        SubresourceLoader::create() anyway.
+
+2009-05-14  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25797: Pages with image maps are not properly read with Voiceover
+        https://bugs.webkit.org/show_bug.cgi?id=25797
+
+        * page/AccessibilityImageMapLink.h:
+        (WebCore::AccessibilityImageMapLink::isEnabled):
+
+2009-05-14  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6887762> and https://bugs.webkit.org/show_bug.cgi?id=25790 
+
+        Nuke the bogus ASSERT and add a legitimate ASSERT with a little help from a new accessor.
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::shouldContentSniff):
+        * platform/network/ResourceHandle.h:
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::createCFURLResponseWithDefaultMIMEType):
+        (WebCore::didReceiveResponse):
+
+2009-05-14  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25791
+        Bug 25791: HTMLMediaElement: implement 'startTime' attribute
+        
+        Support the recently added HTMLMediaElement 'startTime' attribute. This is a read-only 
+        value that only the media engine can know, so we just need to add the attribute 
+        to HTMLMediaElement and add methods to MediaPlayer and MediaPlayerPrivateInterface so 
+        the engine can make it available.
+
+        Test: media/media-startTime.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::startTime): New.
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::startTime): New.
+        * platform/graphics/MediaPlayer.h:
+
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::startTime): New.
+
+2009-05-14  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Only create a QWidget wrapper for the plugin in the case it is not
+        in the Qt window mapper, and thus receiving events from the Qt
+        event system. Native Qt based plugins running in process, will
+        already be in the window mapper, and thus creating a wrapper,
+        stops them from getting events from Qt, as they are redirected
+        to the wrapper.
+
+        * plugins/qt/PluginContainerQt.cpp:
+        (PluginContainerQt::on_clientIsEmbedded):
+
+2009-05-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25784
+        Leaks seen on HTTP tests
+
+        We should change ResourceHandleMac.mm to use smart pointers some day, but this is a minimal fix.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::loadResourceSynchronously): Release mutable request copy made for
+        disabling content sniffing, matching the normal code path.
+        (-[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]): Release m_user
+        and m_pass before overwriting.
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Ditto.
+
+2009-05-14  Yury Semikhatsky <yurys@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25418
+        Remove new lines from event handler wrapper to make line numbers
+        in the wrapped script conside with the lines in the original script.
+
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+
+2009-05-14  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove a JSC-specific include that is already added by including
+        ScriptController.
+
+        No change in behavior, so no tests.
+
+        * dom/Document.cpp: Removed JSDOMBinding include.
+
+2009-05-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/4072827> Downloaded non-ASCII file name becomes garbled
+
+        Hopefully, a final stroke. When updating ResourceRequest from a platform request, a wrong
+        CFString function was used, so a user-friendly name was stored in encoding fallback array.
+
+        * platform/network/cf/ResourceRequestCFNet.cpp: (WebCore::ResourceRequest::doUpdateResourceRequest):
+        * platform/network/mac/ResourceRequestMac.mm: (WebCore::ResourceRequest::doUpdateResourceRequest):
+
+2009-05-14  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Darin Adler.
+
+        Add more ENABLE_DATABASE guards.
+        https://bugs.webkit.org/show_bug.cgi?id=25616
+
+        See also https://bugs.webkit.org/show_bug.cgi?id=24776 (original set of guards)
+
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        * bindings/v8/custom/V8CustomSQLStatementCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLStatementCallback.h:
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.h:
+        * bindings/v8/custom/V8CustomSQLTransactionCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLTransactionCallback.h:
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp:
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.h:
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp:
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        * storage/Database.cpp:
+        * storage/DatabaseDetails.h:
+        * storage/OriginUsageRecord.cpp:
+        * storage/OriginUsageRecord.h:
+        * storage/SQLError.h:
+        * storage/SQLError.idl:
+        * storage/SQLResultSet.cpp:
+        * storage/SQLResultSet.h:
+        * storage/SQLResultSet.idl:
+        * storage/SQLResultSetRowList.cpp:
+        * storage/SQLResultSetRowList.h:
+        * storage/SQLResultSetRowList.idl:
+        * storage/SQLStatementCallback.h:
+        * storage/SQLStatementErrorCallback.h:
+        * storage/SQLTransactionCallback.h:
+        * storage/SQLTransactionErrorCallback.h:
+
+2009-05-11  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25787
+
+        Gtk was the last platform to not unregister plugins when
+        the plugin is stopped. Catch up with r43550.
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::stop):
+
+2009-05-14  Adam Roben  <aroben@apple.com>
+
+        Make WebCore.vcproj's pre-build event work again
+
+        * WebCore.vcproj/WebCore.vcproj: Removed empty override of the
+        pre-build event that was accidentally left in when the pre-build event
+        was moved to WebCoreCommon.vsprops.
+
+2009-05-14  Darin Adler  <darin@apple.com>
+
+        * manual-tests/right-click-crash.html: Added.
+
+2009-05-14  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Darin Adler.
+
+        <rdar://problem/6681868> When building with Xcode 3.1.3 should be using gcc 4.2
+
+        The meaning of XCODE_VERSION_ACTUAL is more sensible in newer versions of Xcode.
+        Update our logic to select the compiler version to use the more appropriate XCODE_VERSION_MINOR
+        if the version of Xcode supports it, and fall back to XCODE_VERSION_ACTUAL if not.
+
+        * Configurations/Base.xcconfig:
+
+2009-05-13  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+
+        * WebCore.NPAPI.exp:
+
+2009-05-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix invalid memory write seen in HTMLCanvasElement by Valgrind
+        https://bugs.webkit.org/show_bug.cgi?id=25759
+
+        I can't think of any way to catch this with a layout test, so no test.
+
+        * css/CSSCanvasValue.cpp:
+        (WebCore::CSSCanvasValue::canvasDestroyed):
+        * css/CSSCanvasValue.h:
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::~HTMLCanvasElement):
+        * html/HTMLCanvasElement.h:
+
+2009-05-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        - fix <rdar://problem/5483015> Replies in Mail are drawn first without
+          the user style sheet and then redrawn with the style sheet
+
+        Test: platform/mac/fast/loader/user-stylesheet-fast-path.html
+
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::setUserStyleSheetLocation): For data URLs with
+        base64-encoded UTF-8 data, just decode the style sheet here an apply
+        it synchronously instead of invoking an asynchronous loader.
+
+2009-05-13  Chris Fleizach  <cfleizach@apple.com>
+
+        Bug 25755: Implement ARIA grid role
+        https://bugs.webkit.org/show_bug.cgi?id=25755
+
+        Fix build bustage from last checkin.
+
+        * page/AccessibilityAriaGrid.cpp:
+        (WebCore::AccessibilityAriaGrid::addChild):
+
+2009-05-13  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 25755: Implement ARIA grid role
+        https://bugs.webkit.org/show_bug.cgi?id=25755
+
+        Test: accessibility/aria-tables.html
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * page/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::nodeIsAriaType):
+        (WebCore::AXObjectCache::getOrCreate):
+        * page/AXObjectCache.h:
+        * page/AccessibilityAriaGrid.cpp: Added.
+        (WebCore::AccessibilityAriaGrid::AccessibilityAriaGrid):
+        (WebCore::AccessibilityAriaGrid::~AccessibilityAriaGrid):
+        (WebCore::AccessibilityAriaGrid::create):
+        (WebCore::AccessibilityAriaGrid::addChild):
+        (WebCore::AccessibilityAriaGrid::addChildren):
+        (WebCore::AccessibilityAriaGrid::cellForColumnAndRow):
+        * page/AccessibilityAriaGrid.h: Added.
+        (WebCore::AccessibilityAriaGrid::isAriaTable):
+        * page/AccessibilityAriaGridCell.cpp: Added.
+        (WebCore::AccessibilityAriaGridCell::AccessibilityAriaGridCell):
+        (WebCore::AccessibilityAriaGridCell::~AccessibilityAriaGridCell):
+        (WebCore::AccessibilityAriaGridCell::create):
+        (WebCore::AccessibilityAriaGridCell::parentTable):
+        (WebCore::AccessibilityAriaGridCell::rowIndexRange):
+        (WebCore::AccessibilityAriaGridCell::columnIndexRange):
+        * page/AccessibilityAriaGridCell.h: Added.
+        * page/AccessibilityAriaGridRow.cpp: Added.
+        (WebCore::AccessibilityAriaGridRow::AccessibilityAriaGridRow):
+        (WebCore::AccessibilityAriaGridRow::~AccessibilityAriaGridRow):
+        (WebCore::AccessibilityAriaGridRow::create):
+        (WebCore::AccessibilityAriaGridRow::parentTable):
+        (WebCore::AccessibilityAriaGridRow::headerObject):
+        * page/AccessibilityAriaGridRow.h: Added.
+        * page/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::accessibilityIsIgnored):
+        * page/AccessibilityList.h:
+        * page/AccessibilityObject.h:
+        (WebCore::):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::):
+        * page/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::AccessibilityTable):
+        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
+        * page/AccessibilityTable.h:
+        (WebCore::AccessibilityTable::isAriaTable):
+        * page/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::parentTable):
+        (WebCore::AccessibilityTableCell::isTableCell):
+        (WebCore::AccessibilityTableCell::titleUIElement):
+        * page/AccessibilityTableCell.h:
+        * page/AccessibilityTableColumn.cpp:
+        (WebCore::AccessibilityTableColumn::setParentTable):
+        (WebCore::AccessibilityTableColumn::headerObject):
+        * page/AccessibilityTableRow.cpp:
+        (WebCore::AccessibilityTableRow::isTableRow):
+        (WebCore::AccessibilityTableRow::parentTable):
+        * page/AccessibilityTableRow.h:
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (RoleEntry::):
+
+2009-05-13  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 25763: Need to move v8 custom binding to the custom directory.
+        https://bugs.webkit.org/show_bug.cgi?id=25763
+
+        No test due to no change in behavior.
+
+        * bindings/v8/custom/V8CanvasPixelArrayCustom.cpp: Renamed from WebCore/bindings/v8/V8CanvasPixelArrayCustom.cpp.
+
+2009-05-13  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix LayoutTests/fast/dom/Element/attr-param-typechecking.html crashing with V8.
+        https://bugs.webkit.org/show_bug.cgi?id=25758
+
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): return the result of throwError() if it is called.
+
+2009-05-13  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Fix a number of bugs relating to RTL and text-overflow:ellipsis.
+        Also refactor the relevant code to make it a little clearer.
+
+        This CL fixes 3 fundamental issues:
+        - Corrects behavior if the truncated InlineTextBox's directionality is
+          different from the overall flow direction - bug 25135.
+        - Make decoration drawing in InlineFlowbox RTL-aware - bug 24206.
+        - Full truncation on InlineBoxes in RTL flow - bug 24186
+        - Add tests for the above + reorder/cleanup tests for easier
+          interpretation of outcome.
+
+        The code for placing ellipsis has been refactored to use
+        left/right notation rather than a single variable whose meaning
+        could differ based on flow directionality.
+
+        To support differing inline directionality vs flow directionality,
+        different variables are now used in InlineTextBox::placeEllipsisBox to
+        track the two.
+
+        The drawing mode for underlines in standards mode now correctly handles
+        RTL truncation and relevant test where added.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24186
+        https://bugs.webkit.org/show_bug.cgi?id=25135
+        https://bugs.webkit.org/show_bug.cgi?id=24206
+
+        Tests: fast/css/text-overflow-ellipsis-bidi.html
+               fast/css/text-overflow-ellipsis-strict.html
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::placeEllipsisBox):
+        * rendering/InlineBox.h:
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintTextDecorations):
+        (WebCore::InlineFlowBox::placeEllipsisBox):
+        * rendering/InlineFlowBox.h:
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::placeEllipsisBox):
+        (WebCore::InlineTextBox::paint):
+        * rendering/InlineTextBox.h:
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::placeEllipsis):
+        (WebCore::RootInlineBox::placeEllipsisBox):
+        * rendering/RootInlineBox.h:
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::checkLinesForTextOverflow):
+
+2009-05-13  Dmitry Titov  <dimich@chromium.org>
+
+        Rubber-stamped by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25746
+        Revert http://trac.webkit.org/changeset/43507 which caused crash in PPC nightlies with Safari 4.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::matchFunc):
+        (WebCore::openFunc):
+        (WebCore::createStringParser):
+        (WebCore::createMemoryParser):
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open):
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::SQLiteDatabase):
+        (WebCore::SQLiteDatabase::close):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        (WebCore::DatabaseThread::start):
+        (WebCore::DatabaseThread::databaseThread):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::localStorageThread):
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        (WebCore::LocalStorageThread::terminate):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::start):
+
+2009-05-13  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Fix for <rdar://problem/6872894> REGRESSION (r41896-42143): First letter cut off in styled select menus
+        
+        Make sure to do rounded clipping for overflow and controls relative to the border box and not to the overflow/control clip rect
+        (which is typically clipped to the padding or content box).  Doing so was causing rounded clips to be incorrectly applied to padding and
+        content.
+    
+        Added fast/overflow/border-radius-clipping.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::pushContentsClip):
+
+2009-05-13  Darin Adler  <darin@apple.com>
+
+        Revert the parser arena change. It was a slowdown, not a speedup.
+        Better luck next time (I'll break it up into pieces).
+
+2009-05-13  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin and Darin Adler.
+
+        Fix for <rdar://problem/6869687> REGRESSION (r41203): Facebook friend suggestions disappear on update.
+        
+        Make sure that renderers are marked for layout if a style change causes them to switch from having a self-painting layer
+        to a non-self-painting layer (and vice versa).
+        
+        Move misplaced layer repainting code that was in RenderBox up into RenderBoxModelObject so that inlines with layers
+        repaint properly on opacity changes, etc.
+
+        Added fast/repaint/opacity-change-on-overflow-float.html.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleWillChange):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::styleWillChange):
+        (WebCore::RenderBoxModelObject::styleDidChange):
+        * rendering/RenderBoxModelObject.h:
+
+2009-05-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Not reviewed, build fix.
+
+        Move an include, needed by Debugger under the corresponding guard.
+
+        * inspector/InspectorController.cpp: Moved parser/SourceCode under JAVASCRIPT_DEBUGGER
+            guard.
+
+2009-05-13  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 25394: REGRESSION: crash in DocumentLoader::addResponse due to bad |this| pointer
+        https://bugs.webkit.org/show_bug.cgi?id=25394
+
+        Test: http/tests/xmlhttprequest/frame-unload-abort-crash.html
+
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        Add another check to subresource loader to avoid doing any loads in frames
+        when the loaders are being stopped.
+
+2009-05-13  Stephan Haller  <nomad@froevel.de>
+
+        Reviewed by Gustavo Noronha.
+
+        Wrong handling of file upload if no file selected
+        https://bugs.webkit.org/show_bug.cgi?id=25649
+
+        Fixed returned path if path is empty
+
+        * WebCore/platform/gtk/FileSystemGtk.cpp:
+
+2009-05-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6805567> REGRESSION (r42348): Notes flicker white
+          when loading
+
+        Tests: fast/frames/content-opacity-1.html
+               fast/frames/content-opacity-2.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::reset): Reset m_contentIsOpaque to false.
+        (WebCore::FrameView::useSlowRepaints): Use slow repaints if the content
+        is not known to be opaque.
+        (WebCore::FrameView::setContentIsOpaque): Added. Sets m_contentIsOpaque
+        and enables or disables fast repaints accordingly.
+        * page/FrameView.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended): Removed the
+        document()->haveStylesheetsLoaded() condition in determining whether the
+        root is opaque. This is what was causing the bug, as iframes were
+        considered to be opaque, and thus painted an opaque white background,
+        whenever they were pending a style sheet load.
+        Changed to call FrameView::setContentIsOpaqe() instead of
+        setUseSlowRepaints(), which allows the frame to go back to fast repaints
+        if the content becomes opaque.
+        Corrected the check for background color opacity: any alpha value other
+        than 255--not just zero--is not opaque.
+
+2009-05-13  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Sam Weinig.
+
+        [Qt] Fix "lighther" composition mode.
+        QPainter::CompositionMode_Plus is the right match.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::toQtCompositionMode):
+
+2009-05-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 25674: syntax tree nodes should use arena allocation
+        https://bugs.webkit.org/show_bug.cgi?id=25674
+
+        * bindings/js/JSDOMBinding.h: Removed include of JSFunction.h.
+        We don't want the entire DOM binding to depend on that file.
+
+        * bindings/js/JSAudioConstructor.cpp: Added include of Error.h.
+        Before we inherited this automatically because JDDOMBinding.h
+        included JSFunction.h, but that was excessive.
+        * bindings/js/JSDOMWindowCustom.cpp: Ditto.
+        * bindings/js/JSHTMLInputElementCustom.cpp: Ditto.
+        * bindings/js/JSImageConstructor.cpp: Ditto.
+        * bindings/js/JSLazyEventListener.cpp: Ditto, but for JSFunction.h.
+        * bindings/js/JSMessageChannelConstructor.cpp: Ditto.
+        * bindings/js/JSOptionConstructor.cpp: Ditto.
+        * bindings/js/JSWorkerConstructor.cpp: Ditto.
+        * bindings/js/JSXMLHttpRequestConstructor.cpp: Ditto.
+        * bridge/jni/jni_jsobject.mm: Ditto, but for SourceCode.h.
+        * inspector/InspectorController.cpp: Ditto.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+        Moved mose of this function into the base class in JavaScriptCore,
+        so the details of compilation don't have to be exposed.
+
+2009-05-13  Douglas R. Davidson  <ddavidso@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6879145>
+        Generate a contextual menu item allowing autocorrections to
+        easily be changed back.  Refrain from re-correcting items
+        that have already been autocorrected once.
+
+        * dom/DocumentMarker.h:
+        * editing/Editor.cpp:
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
+        (WebCore::Editor::changeBackToReplacedString):
+        * editing/Editor.h:
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/mac/WebCoreViewFactory.h:
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        (WebCore::ContextMenu::checkOrEnableIfNeeded):
+        * platform/ContextMenuItem.h:
+        * platform/LocalizedStrings.h:
+        * platform/mac/LocalizedStringsMac.mm:
+        (WebCore::contextMenuItemTagChangeBack):
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::replacedString):
+        * rendering/HitTestResult.h:
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::computeRectForReplacementMarker):
+        (WebCore::InlineTextBox::paintDocumentMarkers):
+        * rendering/InlineTextBox.h:
+
+2009-05-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber Stamped by Oliver Hunt.
+
+        [GTK] Fix Gtk+/X11 build on OSX
+
+        Including the CoreFoundation header here and X11 headers
+        later will result in different definitions of Boolean. The
+        CoreFoundation include does not seem to be necessary here
+        and my mac build was successfull without it. I will remove
+        it for now. If the build bots disagree this will be replaced
+        by a #if PLATFORM(CF).
+
+        * platform/FileSystem.h:
+
+2009-05-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber Stamped by Gustavo Noronha.
+
+        [GTK] Move the #ifdef around for a buildfix for Gtk+ on OSX
+
+        When building Gtk+ on OSX we ended up declaring
+        setNPWindowIfNeeded twice. Fix that by moving
+        the #if PLATFORM(GTK) up and using elif instead of
+        else.
+
+        * plugins/PluginView.h:
+
+2009-05-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25685
+        [GTK] Middle click paste form the pasteboard
+
+        The kit wants to paste from at least two different
+        clipboards. By introducing getCurrentTarget to the
+        PasteboardHelper interface we can make this decision
+        in the kit.
+        Use the new method in PasteboardGtk to get the right
+        GdkClipboard for the paste operation.
+
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::documentFragment):
+        (WebCore::Pasteboard::plainText):
+        * platform/gtk/PasteboardHelper.h:
+
+2009-05-13  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6438177> QTMoviePreferredTransformAttribute only supported on SnowLeopard
+        <rdar://problem/6872468> QTMovieOpenForPlaybackAttribute only supported on SnowLeopard
+
+        QTMoviePreferredTransformAttribute and QTMovieOpenForPlaybackAttribute are not supported
+        on Tiger or Leopard.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setNetworkState): Remove invalid ASSERT.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovie): Only request QTMoviePreferredTransformAttribute
+        when !BUILDING_ON_TIGER and !BUILDING_ON_LEOPARD.
+        (WebCore::MediaPlayerPrivate::cacheMovieScale): Only ask for QTMovieOpenForPlaybackAttribute 
+        when !BUILDING_ON_TIGER and !BUILDING_ON_LEOPARD,
+
+2009-05-12  Roland Steiner <rolandsteiner@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 25738: Skia: CSS border style not cleared for SVG object
+        https://bugs.webkit.org/show_bug.cgi?id=25738
+
+        If no dashing is set, this change reverts to solid stroke
+        (previously the code bailed and left the old setting, whatever it was)
+
+        Test case listed in above bug entry.
+        (Additional complications due to each platform rendering dotted lines differently -
+        c.f. https://bugs.webkit.org/show_bug.cgi?id=25737)
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setLineDash):
+
+2009-05-11  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 21903: Adds DOM bindings for the placeholder property of the
+        HTMLInputElement.
+        https://bugs.webkit.org/show_bug.cgi?id=21903
+
+        Test: fast/forms/placeholder-dom-property.html
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::updatePlaceholderVisibility):
+        * dom/InputElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::placeholder):
+        (WebCore::HTMLInputElement::setPlaceholder):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        * wml/WMLInputElement.h:
+        (WebCore::WMLInputElement::placeholder):
+        (WebCore::WMLInputElement::setPlaceholder):
+
+2009-05-12  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25706
+
+        Change V8 bindings to match JSC bindings with respect to using
+        the lexical or dynamic global object.
+
+        Tests: http/tests/security/aboutBlank/security-context-grandchildren-lexical.html
+               http/tests/security/aboutBlank/security-context-grandchildren-write-lexical.html
+               http/tests/security/aboutBlank/security-context-grandchildren-writeln-lexical.html
+
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-03-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6702386> Incorrect bound check in SVGList::insertItemBefore
+
+        SVGList::insertItemBefore would not perform a bounds check on the
+        index it was provided, potentially leading to a buffer overflow. 
+
+        Test: svg/dom/svglist-exception-on-out-bounds-error.html
+
+        * svg/SVGList.h:
+        (WebCore::SVGList::insertItemBefore):
+
+2009-05-12  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 25708: Cannot choose menu items in popups with many entries in Chromium
+        https://bugs.webkit.org/show_bug.cgi?id=25708
+
+        This change sets the window size for popups on Mac to include all items
+        in the menu. This is required for hit testing on Mac, where we use native
+        controls to manage the popups and don't want to artificially limit the
+        valid hit testing region to a limited scroll window.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::layout):
+
+2009-05-12  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fixes to build with latest skia:  SkTypeface::Create() is now
+        SkTypeface::CreateFromName(); computeBounds() has been reworked
+        as getBounds().  The changes are placed behind an #ifdef for now,
+        so that we can roll back the skia version in Chromium if necessary
+        without having to roll back this change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25705
+
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::boundingRect):
+        (WebCore::boundingBoxForCurrentStroke):
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::SkPathContainsPoint):
+
+2009-05-12  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25732
+        Update V8ElementCustom.cpp to match the current API of V8Proxy.
+
+        (WebCore::ACCESSOR_SETTER): Change retrieveActiveFrame() to retrieveFrameForEnteredContext().
+
+2009-05-12  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25694
+        HTMLParser::createHead() ASSERT: Creating an element, calling  document.open() and writing
+        to the document NULL ptr
+
+        Test: fast/parser/implicit-head-in-fragment-crash.html
+
+        * html/HTMLParser.cpp: (WebCore::HTMLParser::bodyCreateErrorCheck): Do not try to implicitly
+        create <head> when parsing a fragment.
+
+2009-05-12  Soren Gjesse  <sgjesse@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25687
+        Missing check for valid function in V8 bindings for toString function for event listeners.
+
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction): Added empty handle checks.
+
+2009-05-11  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Change Qt port to match the mac and windows ports, and unregister plugins when plugins are stopped.
+        Not doing that can cause assersion failure.
+        https://bugs.webkit.org/show_bug.cgi?id=25702
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::stop):
+
+2009-05-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Bug 25714: [Qt] Decouple HTML5 Database support from the
+        SQLite/generic database support in the Qt port
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25714>
+
+        * WebCore.pro:
+
+2009-05-11  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 25713: AX: Control Elements not identified in HTML content
+        https://bugs.webkit.org/show_bug.cgi?id=25713
+
+        Test: accessibility/onclick-handlers.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::mouseButtonListener):
+
+2009-05-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6276843> REGRESSION: TextIterator generates
+        an extra newline for ranges that start outside of body
+
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::shouldRepresentNodeOffsetZero):
+        Check startPos for null, not just currPos.
+
+2009-05-11  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25700: Regression:WebKit:cmd-left and cmd-right use to go to the beginning and end of a line in Mail
+        https://bugs.webkit.org/show_bug.cgi?id=25700
+
+        Keyboard selection movement handlers need to also watch for the Cmd key when Accessibility is enabled.
+        Note: This code is only used when accessibility is enabled.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleKeyboardSelectionMovement):
+
+2009-05-11  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 25087: Test for ENABLE_FOO macros consistently in IDL files
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25087>
+
+        Reviewed by Timothy Hatcher.
+
+        Change tests for ENABLE macros to check for both existence and
+        value:
+
+        - Negative:  #if !defined(ENABLE_FOO) || !ENABLE_FOO
+        - Positive:  #if defined(ENABLE_FOO) && ENABLE_FOO
+
+        * css/CSSCharsetRule.idl:
+        * css/CSSPrimitiveValue.idl:
+        * css/RGBColor.idl:
+        * dom/Attr.idl:
+        * dom/DOMCoreException.idl:
+        * dom/DOMImplementation.idl:
+        * dom/Document.idl:
+        * dom/Element.idl:
+        * dom/Event.idl:
+        * dom/EventException.idl:
+        * dom/KeyboardEvent.idl:
+        * dom/MessagePort.idl:
+        * dom/MouseEvent.idl:
+        * dom/Node.idl:
+        * dom/ProcessingInstruction.idl:
+        * dom/Range.idl:
+        * dom/RangeException.idl:
+        * dom/WheelEvent.idl:
+        * html/CanvasPixelArray.idl:
+        * html/HTMLAnchorElement.idl:
+        * html/HTMLAppletElement.idl:
+        * html/HTMLAreaElement.idl:
+        * html/HTMLBaseFontElement.idl:
+        * html/HTMLCanvasElement.idl:
+        * html/HTMLDocument.idl:
+        * html/HTMLElement.idl:
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLFrameElement.idl:
+        * html/HTMLIFrameElement.idl:
+        * html/HTMLImageElement.idl:
+        * html/HTMLInputElement.idl:
+        * html/HTMLLinkElement.idl:
+        * html/HTMLObjectElement.idl:
+        * html/HTMLOptionElement.idl:
+        * html/HTMLOptionsCollection.idl:
+        * html/HTMLSelectElement.idl:
+        * html/HTMLStyleElement.idl:
+        * html/ImageData.idl:
+        * inspector/InspectorController.idl:
+        * loader/appcache/DOMApplicationCache.idl:
+        * page/Console.idl:
+        * page/Coordinates.idl:
+        * page/DOMSelection.idl:
+        * page/DOMWindow.idl:
+        * page/Geoposition.idl:
+        * page/History.idl:
+        * page/Location.idl:
+        * page/Navigator.idl:
+        * svg/SVGElementInstance.idl:
+        * svg/SVGException.idl:
+        * workers/WorkerContext.idl:
+        * xml/XMLHttpRequestException.idl:
+        * xml/XPathException.idl:
+
+2009-05-11  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 24538: class/struct mixup in forward declarations
+        https://bugs.webkit.org/show_bug.cgi?id=24538
+
+        * inspector/InspectorResource.h:
+        * loader/CachedFont.h:
+        * loader/appcache/ApplicationCache.h:
+        * rendering/RenderBlock.h:
+        * rendering/RootInlineBox.h:
+        * rendering/SVGInlineTextBox.h:
+        * svg/SVGGlyphElement.h:
+        * svg/SVGHKernElement.h:
+
+2009-05-11  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 24539: Unresolved CSSMutableStyleDeclaration
+        https://bugs.webkit.org/show_bug.cgi?id=24539
+
+        The Symbian tools can't compile and link this without this include.
+        It's not clear why this is different from other toolsets or why it affects
+        only this header file, but adding the include for now.
+
+        * editing/RemoveCSSPropertyCommand.h: Added include of CSSMutableStyleDeclaration.h.
+
+2009-05-11  Alice Liu  <alice.liu@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25701
+        REGRESSION(r38788 & r42020): styled searchfields look wrong on Windows, affects Facebook
+
+        Test: fast/forms/search-styled.html
+
+        * css/themeWin.css:
+        Remove the overriding of -webkit-appearance for searchfields. This will cause background
+        images to not be honored when styling searchfields
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::adjustSearchFieldStyle):
+        * rendering/RenderThemeWin.h:
+        Re-instate final adjustments to searchfield styling that were removed in r42020
+
+2009-05-11  Brady Eidson  <beidson@apple.com>
+
+        Fix Windows build
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::createCFURLResponseWithDefaultMIMEType):
+
+2009-05-11  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25626
+        Update V8ElementCustom.cpp to match the current API of Node.
+
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        (WebCore::ACCESSOR_SETTER): Changed a couple of method names to match current names.
+        (WebCore::ACCESSOR_GETTER): Changed a method name to match current name.
+
+2009-05-11  Brady Eidson  <beidson@apple.com>
+
+        Fix Windows build
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::createCFURLResponseWithDefaultMIMEType):
+        (WebCore::WebCoreSynchronousLoader::load):
+
+2009-05-11  Brady Eidson  <beidson@apple.com>
+
+        Fix Windows build
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::createCFURLResponseWithDefaultMIMEType):
+
+2009-05-11  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        V8CustomBinding.cpp is missing a header file
+
+        https://bugs.webkit.org/show_bug.cgi?id=25644
+
+        * bindings/v8/custom/V8CustomBinding.cpp: Added #include "V8Proxy.h".
+
+2009-05-11  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25634
+        Change V8Proxy::retrieveActiveFrame() call sites to V8Proxy::retrieveFrameForEnteredContext().
+
+        Also, change instances of ScriptController::retrieveActiveFrame() to
+        V8::retrieveFrameForEnteredContext() for consistency.
+
+
+        See http://codereview.chromium.org/113085 for the corresponding Chromium change.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8Custom::WindowSetLocation):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::navigateIfAllowed):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-05-11  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/5972751> Local image files (BMP, ico) can be misidentified as HTML.
+
+        First part of the fix - Disable content sniffing for file resources which never should've been happening anyways.
+        Second part of the fix - If the networking layer doesn't give us back a MIME type default to "application/octet-stream".
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::defaultMIMEType): "application/octet-stream"
+        * platform/MIMETypeRegistry.h:
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::create): If content sniffing is true, double check with "shouldContentSniffRequest()" which
+          might override it to false.
+        (WebCore::ResourceHandle::shouldContentSniffURL): Return false for file:// urls, true for everything else.
+        * platform/network/ResourceHandle.h:
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::createCFURLResponseWithDefaultMIMEType): Create a copy of the CFURLRequest with the default MIME type instead
+          of null.
+        (WebCore::didReceiveResponse): If the MIME type for the response is null, create a copy with the default MIME type.
+        (WebCore::WebCoreSynchronousLoader::load): Use shouldContentSniffRequest() to make synchronous loads have the same 
+          sniffing policy as asynchronous loads.  Also, correct a null MIME type by creating a copy with the default type.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::loadResourceSynchronously): Use shouldContentSniffRequest() to make synchronous loads have the
+          same sniffing policy as asynchronous loads.
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): Set up the [NSURLResponse MIMEType] swizzling if
+          it hasn't been set up yet.
+        (_web_NSURLResponse_MIMEType): Either return the actual MIME type of the response, or the default MIME type if it's nil.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously): Remove the workaround added in r29370 as it will now be covered by
+          the new mechanism.
+
+2009-05-11  David Kilzer  <ddkilzer@apple.com>
+
+        Fix typo "APPLICATION_CAHE_DYNAMIC_ENTRIES" to "APPLICATION_CACHE_DYNAMIC_ENTRIES"
+
+        This was added in r39816 to disable dynamic entries.  They are
+        still disabled after fixing the typo since this feature define
+        is never set anywhere.
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        * loader/appcache/DOMApplicationCache.idl:
+
+2009-05-11  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov and Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25348
+        Change WTF::ThreadIdentifier to be an actual (but wrapped) thread id, remove ThreadMap.
+
+        Most of the change is in WTF.
+        Unless noted, all the following files changed to use the new ThreadIdentifier::isValid()
+        method instead of just doing 'if(m_threadID)' kind of checks, since ThreadIdentifier
+        is now a class rather then an integer.
+        Also, there is no need to initialize threadID in constructors to 0 now.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::libxmlLoaderThread): use DEFINE_STATIC_LOCAL and accessor function for static thread id,
+        since now ThreadIdentifier needs construction and we avoid having global initializers.
+        (WebCore::matchFunc): use the new accessor function.
+        (WebCore::openFunc): ditto.
+        (WebCore::createStringParser): ditto.
+        (WebCore::createMemoryParser): ditto.
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open):
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::SQLiteDatabase):
+        (WebCore::SQLiteDatabase::close):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::start):
+        (WebCore::DatabaseThread::databaseThread): remove m_threadID from debug output.
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        (WebCore::LocalStorageThread::terminate):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::start):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::start):
+
+2009-05-11  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Remove unused header that declared one function which was never defined anywhere.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/network/cf/ResourceResponseCFNet.cpp: Change to include ResourceResponse.h (which really means
+          platform/network/cf/ResourceResponse.h)
+        * platform/network/cf/ResourceResponseCFNet.h: Removed.
+
+2009-05-11  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25213
+        Fix assert during Inspector destruction.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspectedPageDestroyed): Moved closing
+            inspector above removing InspectorController object to fix JS errors,
+            added clearing inspector page ptr.
+
+2009-05-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Make sure that public APIs are properly exported on all Qt platforms
+        https://bugs.webkit.org/show_bug.cgi?id=25601
+
+        * WebCore.pro: Define QT_MAKEDLL for all non-static builds, not just for win
+
+2009-05-11  Csaba Osztrogonac  <oszi@inf.u-szeged.hu>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24284
+
+        * WebCore.pro: duplicated values removed from INCLUDEPATH
+
+2009-05-11  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Build fix Symbian; clean Up WebKit/Qt if ENABLE_NETSCAPE_PLUGIN_API=0
+        https://bugs.webkit.org/show_bug.cgi?id=24688
+
+        * WebCore.pro: Use platform independent plugin stubs if ENABLE_NETSCAPE_PLUGIN_API=0
+        * platform/qt/TemporaryLinkStubs.cpp: Remove stub functions for plugins
+
+2009-05-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix a crash when deactivating a document that had adopted a <form>
+          element
+
+        Test: fast/dom/HTMLFormElement/document-deactivation-callback-crash.html
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::didMoveToNewOwnerDocument): Corrected the
+        logic here: <form> elements should be registered for document activation
+        callbacks if and only if autocomplete is off.
+
+2009-05-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6867598> REGRESSION (r42483): Have to enter credentials twice when trying
+        to view protected MobileMe video
+
+        Add a temporary workaround.
+
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        Added an m_useSiteSpecificQuirks boolean (Mac-only). A Frame pointer is only available when
+        starting a request, so we need to store this data for later use.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start): Initialize m_useSiteSpecificQuirks.
+        (WebCore::ResourceHandle::receivedCredential): Use per-session credentials with gallery.me.com.
+
+2009-05-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6870383> Have to enter credentials twice when downloading from a protected page
+
+        * platform/network/cf/AuthenticationCF.cpp:
+        * platform/network/cf/AuthenticationCF.h:
+        (WebCore::WebCoreCredentialStorage::set):
+        (WebCore::WebCoreCredentialStorage::get):
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        Move WebCore credential storage to AuthenticationCF, so that WebKit could use it (macthing
+        an earlier Mac change).
+
+2009-05-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Match newer XMLHttpRequest draft and make withCredential setter raise an exception when
+        called at a wrong time.
+
+        No test, because we are waiting for a newer version of system frameworks to test the attribute.
+
+        * xml/XMLHttpRequest.cpp: (WebCore::XMLHttpRequest::setWithCredentials):
+        * xml/XMLHttpRequest.h:
+        * xml/XMLHttpRequest.idl:
+        Raise INVALID_STATE_ERR if the state is not OPENED, or if the send() flag is true.
+
+2009-05-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Kilzer.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=25602
+          REGRESSION: fast/overflow/overflow-focus-ring.html seems double-drawn
+          on ToT
+
+        Test: fast/layers/self-painting-outline.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer): Paint the layer's own outline only
+        if it is a self-painting layer.
+
+2009-05-09  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Geoffrey Garen and Mark Rowe.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=25666
+          Assertion failure in Node::setDocument()
+          (willMoveToNewOwnerDocumentWasCalled) when adopting a <form> element
+
+        Test: fast/dom/HTMLFormElement/adopt-assertion.html
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::willMoveToNewOwnerDocument): Overrides of
+        this method are required to call the base class implementation. Do it.
+        (WebCore::HTMLFormElement::didMoveToNewOwnerDocument): Ditto.
+
+2009-03-29  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        WebCore::DocumentLoader::mainReceivedError now asserts if error.isNull(), so
+        make sure CURL does not create empty ResourceError() objects.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24927
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::downloadTimerCallback):
+
+2009-05-09  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Build fix, adding missing files to make dist.
+
+        * GNUmakefile.am:
+
+2009-05-08  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25656
+        
+        Reduce the inline capacity of CSSParserValueList's m_values
+        vector to reduce the size of CSSParserValueList from 544 to 160 bytes in 64-bit.
+
+        * css/CSSParserValues.h:
+
+2009-05-08  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Used sort-Xcode-project-file to sort the XCode project file - it hasn't been done for a while.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-05-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6864786> REGRESSION: Crash below
+          ApplyStyleCommand::applyInlineStyleToRange when reviewing a patch in
+          Bugzilla
+
+        Test: editing/style/apply-through-end-of-document.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyInlineStyleToRange): Added a null
+        check for the case of a range extending through the end of the document,
+        in which pastEndNode is 0.
+
+2009-05-08  Douglas R. Davidson  <ddavidso@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        <rdar://problem/6857446> REGRESSION (Safari 3-4): Contraction base 
+        marked as misspelled even though contraction is a word
+        Make sure spelling underline does not persist on words like 
+        <doesn't>.  
+
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::typingAddedToOpenCommand):
+
+2009-05-08  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Make sure the path's refdata isn't deleted before we're done with the object.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25652
+
+        * platform/graphics/wx/PathWx.cpp:
+        (WebCore::Path::~Path):
+        (WebCore::Path::Path):
+        (WebCore::Path::translate):
+
+2009-05-08  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for memory leak on Mac.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25650
+
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
+        (wxFontProperties::wxFontProperties):
+
+2009-05-08  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6857446> REGRESSION (r37591): Cannot print or 
+        preview from maps.yandex.ru
+
+        We need to fall into the stretchesToViewHeight() quirk when we are 
+        printing and we are the root and the root has percentage height OR 
+        when we are the body and the root has percentage height. Otherwise 
+        we have a height of 0 and can run into painting troubles.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcHeight):
+
+2009-05-08  Douglas Davidson  <ddavidso@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes for <rdar://problem/6852771>.
+        Prevent text checking replacement immediately after an apostrophe
+        and automatic link addition except immediately after typing.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
+
+2009-05-08  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25627
+        Bug 25627: HTMLMediaElement: some errors should fire on <source> elements
+
+        Update for HTML5 spec change to fire 'error' events on <source> element
+        when there is a failure while processing/loading a <source>.
+
+        Test: media/video-source-error.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::enqueueEvent): Remove white-space.
+        (WebCore::HTMLMediaElement::loadInternal): Call cancelPendingEventsAndCallbacks instead
+        of just calling m_pendingEvents.clear() as we now also need to cancel pending errors on
+        all <source> element. 
+        (WebCore::HTMLMediaElement::selectMediaResource): Call isSafeToLoadURL() here instead of in
+        loadResource() as we need to report errors differently depending on the type of failure. Use
+        KURL instead of String.
+        (WebCore::HTMLMediaElement::loadNextSourceChild): nextSourceChild -> selectNextSourceChild.
+        Fail silently when there are no more <source> canditates because that is what spec mandates.
+        Keep url as KURL instead of converting to String.
+        (WebCore::HTMLMediaElement::loadResource): ASSERT that the URL is safe to load as we now 
+        assume the safety check now done before this function. Takes KURL instead of String.
+        (WebCore::HTMLMediaElement::isSafeToLoadURL): New, checks to see if a url is safe to load, logs
+        failure if not.
+        (WebCore::HTMLMediaElement::noneSupported): MEDIA_ERR_NONE_SUPPORTED -> MEDIA_ERR_SRC_NOT_SUPPORTED
+        (WebCore::HTMLMediaElement::cancelPendingEventsAndCallbacks): New, clear all events pending on
+        the media and all source elements.
+        (WebCore::HTMLMediaElement::setNetworkState): Fire an error on the source element when the 
+        the failure happened while processing one. Only call nonSupported() when the failure happened
+        while processing media element 'src' attribute.
+        (WebCore::HTMLMediaElement::havePotentialSourceChild): nextSourceChild -> selectNextSourceChild.
+        Deal with selectNextSourceChild returning a KURL instead of a String.
+        (WebCore::HTMLMediaElement::selectNextSourceChild): Renamed from nextSourceChild, add optional
+        param to control whether or not errors are fired on a source element when it will not be used.
+        Check safety of url here instead of waiting until loadResource(). Return a KURL instead of a
+        String.
+        (WebCore::HTMLMediaElement::initialURL): nextSourceChild -> selectNextSourceChild. Keep url as
+        a KURL instead of a String.
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::):
+
+        * html/HTMLSourceElement.cpp:
+        (WebCore::HTMLSourceElement::HTMLSourceElement): Initialize timer related variables.
+        (WebCore::HTMLSourceElement::scheduleErrorEvent): New, start one-shot timer to fire an error
+        event ASAP.
+        (WebCore::HTMLSourceElement::cancelPendingErrorEvent): New, cancel pending error event.
+        (WebCore::HTMLSourceElement::errorEventTimerFired): New, fire error event if it has not been
+        cancelled.
+        * html/HTMLSourceElement.h:
+
+        * html/MediaError.h: 
+        (WebCore::MediaError::): MEDIA_ERR_NONE_SUPPORTED -> MEDIA_ERR_SRC_NOT_SUPPORTED
+        * html/MediaError.idl: Ditto
+
+2009-05-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        - fix <rdar://problem/6859955> Undoing typed text after selecting all
+          leaves non-text areas highlighted
+
+        Test: fast/repaint/selection-clear.html
+
+        When RenderView::clearSelection() is called from
+        SelectionController::nodeWillBeRemoved(), selected renderers may already
+        be marked for layout, which means that they can no longer compute
+        their selection repaint info. Instead, an empty IntRect (or GapRects) is
+        returned, leading to incomplete repaint.
+
+        The fix is not to rely on individual renderers when clearing the
+        selection, but instead, cache the bounding rectangle of the selected
+        blocks' GapRects when setting the selection, and invalidate that
+        entire rectangle when clearing it.
+
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setSelection): Added a parameter saying whether
+        the repainting of selected blocks should include both
+        previously-selected areas and newly-selected areas or only
+        newly-selected areas. The default is both. Also compute
+        m_cachedSelectionBounds to be the bounding rectangle of the
+        new selection's BlockSelectionInfos' GapRects.
+        (WebCore::RenderView::clearSelection): Repaint m_cachedSelectionBounds,
+        and tell setSelection() that it should not paint areas that were in
+        the old selection's BlockSelectionInfos' GapRects.
+        * rendering/RenderView.h:
+        (WebCore::RenderView::):
+
+2009-05-08  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        <rdar://problem/6868773> NPN_GetAuthenticationInfo does not work with non-permanent credentials
+
+        * WebCore.base.exp:
+        * platform/network/mac/AuthenticationMac.h:
+        (WebCore::WebCoreCredentialStorage::set):
+        (WebCore::WebCoreCredentialStorage::get):
+        * platform/network/mac/AuthenticationMac.mm:
+        * platform/network/mac/ResourceHandleMac.mm:
+        Moved WebCoreCredentialStorage to AuthenticationMac, so that it could be used from WebKit.
+
+2009-05-08  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the Qt build, add missing JSC_HOST_CALL macros to the runtime
+        call methods.
+
+        * bridge/qt/qt_runtime.h:
+
+2009-05-08  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Add missing strings to localizedStrings.js
+        https://bugs.webkit.org/show_bug.cgi?id=25635
+
+        Add the strings "Delete", "Key", "Refresh" and "Value".
+
+        * English.lproj/localizedStrings.js:
+
+2009-05-08  Robert Hogan  <robert@roberthogan.net>
+
+        Reviewed, tweaked and landed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24992
+        [Qt] crash at http://browserspy.dk/browser.php
+
+        This cannot be easily tested in DRT, because it relies on interaction with QApplication,
+        but the added assertions guard against re-introducing this issue.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::didOpenURL): Don't make client calls
+        while the frame is being constructed, because the intermediate state without a document
+        is something we don't want to expose.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setJSStatusBarText): Assert that the frame has a document, which is an
+        approximation of it being in a consistent state for client calls.
+        (WebCore::Frame::setJSDefaultStatusBarText): Ditto.
+
+2009-05-07  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=25640>.
+        Bug 25640: Crash on quit in r43384 nightly build on Leopard w/ Safari 4 beta installed
+        
+        Roll out r43366 as it removed symbols that Safari 4 Beta uses.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::matchFunc):
+        (WebCore::openFunc):
+        (WebCore::createStringParser):
+        (WebCore::createMemoryParser):
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open):
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::SQLiteDatabase):
+        (WebCore::SQLiteDatabase::close):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread):
+        (WebCore::DatabaseThread::start):
+        (WebCore::DatabaseThread::databaseThread):
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::LocalStorageThread):
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::localStorageThread):
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        (WebCore::LocalStorageThread::terminate):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::start):
+
+2009-05-08  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Unify scrolling code via adjustments and keys. Use the WebCore
+        defined constants, since that's what people are most used to at
+        this point.
+
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::platformHandleHorizontalAdjustment):
+        (WebCore::ScrollView::platformHandleVerticalAdjustment):
+
+2009-05-07  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY.
+        Suggested by Oliver Hunt.
+
+        Rolling back http://trac.webkit.org/changeset/43385
+        because we have to use mac artwork for the underline on OSX.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::createPatternColor):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::setCGStrokeColor):
+        (WebCore::spellingPatternColor):
+        (WebCore::grammarPatternColor):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+
+2009-05-07  John Grabowski  <jrg@chromium.org>
+
+        Reviewed by Simon Fraser.
+  
+        https://bugs.webkit.org/show_bug.cgi?id=25573
+        Unify use of CG-common routine for drawLineForMisspellingOrBadGrammar.
+        Cleanup for WebKit, but required for Chromium happiness.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::spellingPatternColor):
+        (WebCore::grammarPatternColor):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+
+2009-05-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Bug 25575: Registered mutation event listener crashes HTMLMediaElement
+        https://bugs.webkit.org/show_bug.cgi?id=25575
+
+        Test: fast/media/video-controls-with-mutation-event-handler.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement): Don't call setAttribute.
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createTimeline): Call setAttribute here.
+
+2009-05-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Rubber Stamped by Dave Hyatt
+        
+        Shuffle the data members to minimize padding.
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::RenderTableSection):
+        * rendering/RenderTableSection.h:
+
+2009-05-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Rubber Stamped by Dave Hyatt
+        
+        Shuffle the data members to make Events 8 bytes smaller in 64-bit.
+
+        * dom/Event.cpp:
+        (WebCore::Event::Event):
+        * dom/Event.h:
+
+2009-05-07  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Fix regression caused by r41469, add test case to prevent it from 
+        happening again.
+        https://bugs.webkit.org/show_bug.cgi?id=25252
+  
+        hasLayer() was true during removeOnlyThisLayer()/
+        updateLayerPositions()
+        which caused updateLayerPosition()'s walk up the render tree to 
+        include offsets from the layer we were about to remove.
+  
+        I'm not 100% convinced that this wasn't a bug in 
+        updateLayerPosition() or in RenderBoxModelObject::styleDidChange, 
+        because the layer in question is not the containing block for the 
+        block which gets laid out wrong. But this restores the previous 
+        behavior and adds a test.  So the next time someone is in here re-
+        factoring, they will at least know if they break something.
+  
+        Test: fast/layers/remove-only-this-layer-update.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::destroyLayer):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::removeOnlyThisLayer):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy):
+
+2009-05-07  Dmitry Titov  <dimich@chromium.org>
+
+        Attempt to fix GTK build.
+
+        * platform/graphics/GlyphPageTreeNode.h: add #include <string.h> to ensure memcpy and memset are defined.
+
+2009-05-07  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Improve native call performance
+
+        Add calling convention declarations where necessary, and update bindings
+        script to generate them as well.
+
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::callHTMLCollection):
+        * bindings/js/JSNodeListCustom.cpp:
+        (WebCore::callNodeList):
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::callPlugin):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/runtime_method.cpp:
+        (JSC::callRuntimeMethod):
+        * bridge/runtime_object.cpp:
+        (JSC::callRuntimeObject):
+
+2009-05-07  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=25617
+
+        Fix memory/performance regression because of too much form control related abstraction just for WMLs sake.
+
+        Remove FormControlElement and FormControlElementWithState base classes, as the overhead is too high for the
+        gain. HTML has no benefit of that kind of abstraction, so we're going to move the functionality to Element directly.
+
+        The functions now living in FormControlElement(WithState) lived in Node/Element/HTMLFormControlElement before.
+        This patches moves all of them in a central place in Element.h, as virtual functions with an inline default implementation.
+        To avoid confusion like isEnabled() living on Node, before the creation of the FormControlElement abstraction layer, all
+        methods are renamed to clarify where they belong to. All renames are listed here:
+
+        From FormControlElement:
+        - isEnabled() -> isEnabledFormControl()
+        - isReadOnly() -> isReadOnlyFormControl()
+        - isTextControl() -> isTextFormControl()
+        - valueMatchesRenderer() -> formControlValueMatchesRenderer()
+        - setValueMatchesRenderer() -> setFormControlValueMatchesRenderer()
+        - name() -> formControlName()
+        - type() -> formControlType()
+
+        From FormControlElementWithState:
+        - saveState() -> saveFormControlState()
+        - restoreState() -> restoreFormControlState()
+
+        A lot of Element -> FormControlElement(WithState) casting is gone again, so it's not only a memory, but also a performance progression.
+
+        No testcases affected, no new tests needed.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * dom/Document.cpp:
+        (WebCore::Document::formElementsState):
+        * dom/Document.h:
+        (WebCore::Document::registerFormElementWithState):
+        (WebCore::Document::unregisterFormElementWithState):
+        * dom/Element.h:
+        (WebCore::Element::isFormControlElement):
+        (WebCore::Element::isEnabledFormControl):
+        (WebCore::Element::isReadOnlyFormControl):
+        (WebCore::Element::isTextFormControl):
+        (WebCore::Element::formControlValueMatchesRenderer):
+        (WebCore::Element::setFormControlValueMatchesRenderer):
+        (WebCore::Element::formControlName):
+        (WebCore::Element::formControlType):
+        (WebCore::Element::saveFormControlState):
+        (WebCore::Element::restoreFormControlState):
+        * dom/FormControlElement.cpp: Removed.
+        * dom/FormControlElement.h: Removed.
+        * dom/FormControlElementWithState.cpp: Removed.
+        * dom/FormControlElementWithState.h: Removed.
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::setValueFromRenderer):
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::formControlType):
+        * html/HTMLButtonElement.h:
+        * html/HTMLFieldSetElement.cpp:
+        (WebCore::HTMLFieldSetElement::formControlType):
+        * html/HTMLFieldSetElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::attach):
+        (WebCore::HTMLFormControlElement::formControlName):
+        (WebCore::HTMLFormControlElement::willValidate):
+        (WebCore::HTMLFormControlElementWithState::HTMLFormControlElementWithState):
+        (WebCore::HTMLFormControlElementWithState::~HTMLFormControlElementWithState):
+        (WebCore::HTMLFormControlElementWithState::willMoveToNewOwnerDocument):
+        (WebCore::HTMLFormControlElementWithState::didMoveToNewOwnerDocument):
+        (WebCore::HTMLFormControlElementWithState::finishParsingChildren):
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::isTextFormControl):
+        (WebCore::HTMLFormControlElement::isEnabledFormControl):
+        (WebCore::HTMLFormControlElement::formControlValueMatchesRenderer):
+        (WebCore::HTMLFormControlElement::setFormControlValueMatchesRenderer):
+        (WebCore::HTMLFormControlElement::isReadOnlyFormControl):
+        (WebCore::HTMLFormControlElement::type):
+        (WebCore::HTMLFormControlElement::name):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::formControlName):
+        (WebCore::HTMLInputElement::formControlType):
+        (WebCore::HTMLInputElement::saveFormControlState):
+        (WebCore::HTMLInputElement::restoreFormControlState):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::detach):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setFileListFromRenderer):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::readOnly):
+        (WebCore::HTMLInputElement::isTextFormControl):
+        * html/HTMLKeygenElement.cpp:
+        (WebCore::HTMLKeygenElement::formControlType):
+        * html/HTMLKeygenElement.h:
+        * html/HTMLLegendElement.cpp:
+        (WebCore::HTMLLegendElement::formControlType):
+        * html/HTMLLegendElement.h:
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::formControlType):
+        * html/HTMLOptGroupElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::formControlType):
+        * html/HTMLOptionElement.h:
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::formControlType):
+        (WebCore::HTMLSelectElement::saveFormControlState):
+        (WebCore::HTMLSelectElement::restoreFormControlState):
+        * html/HTMLSelectElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
+        (WebCore::HTMLTextAreaElement::formControlType):
+        (WebCore::HTMLTextAreaElement::saveFormControlState):
+        (WebCore::HTMLTextAreaElement::restoreFormControlState):
+        (WebCore::HTMLTextAreaElement::updateValue):
+        (WebCore::HTMLTextAreaElement::setValue):
+        * html/HTMLTextAreaElement.h:
+        (WebCore::HTMLTextAreaElement::readOnly):
+        (WebCore::HTMLTextAreaElement::isTextFormControl):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isEnabled):
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        * page/DragController.cpp:
+        (WebCore::DragController::concludeEditDrag):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::itemIsEnabled):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::updateUserModifyProperty):
+        (WebCore::RenderTextControl::setInnerTextValue):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::isEnabled):
+        (WebCore::RenderTheme::isReadOnlyControl):
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::adjustMenuListStyle):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::adjustMenuListStyle):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::adjustMenuListStyle):
+        * wml/WMLFormControlElement.cpp:
+        * wml/WMLFormControlElement.h:
+        (WebCore::WMLFormControlElement::isReadOnlyFormControl):
+        (WebCore::WMLFormControlElement::isTextFormControl):
+        (WebCore::WMLFormControlElement::formControlValueMatchesRenderer):
+        (WebCore::WMLFormControlElement::setFormControlValueMatchesRenderer):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::WMLInputElement):
+        (WebCore::WMLInputElement::isKeyboardFocusable):
+        (WebCore::WMLInputElement::isMouseFocusable):
+        (WebCore::WMLInputElement::dispatchBlurEvent):
+        (WebCore::WMLInputElement::formControlType):
+        (WebCore::WMLInputElement::formControlName):
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::saveFormControlState):
+        (WebCore::WMLInputElement::restoreFormControlState):
+        (WebCore::WMLInputElement::parseMappedAttribute):
+        (WebCore::WMLInputElement::detach):
+        (WebCore::WMLInputElement::appendFormData):
+        (WebCore::WMLInputElement::init):
+        * wml/WMLInputElement.h:
+        (WebCore::WMLInputElement::isTextFormControl):
+        * wml/WMLOptGroupElement.cpp:
+        (WebCore::WMLOptGroupElement::formControlType):
+        * wml/WMLOptGroupElement.h:
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::formControlType):
+        * wml/WMLOptionElement.h:
+
+2009-05-07  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov and Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25348
+        Change WTF::ThreadIdentifier to be an actual (but wrapped) thread id, remove ThreadMap.
+
+        Most of the change is in WTF.
+        Unless noted, all the following files changed to use the new ThreadIdentifier::isValid()
+        method instead of just doing 'if(m_threadID)' kind of checks, since ThreadIdentifier
+        is now a class rather then an integer.
+        Also, there is no need to initialize threadID in constructors to 0 now.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::libxmlLoaderThread): use DEFINE_STATIC_LOCAL and accessor function for static thread id,
+        since now ThreadIdentifier needs construction and we avoid having global initializers.
+        (WebCore::matchFunc): use the new accessor function.
+        (WebCore::openFunc): ditto.
+        (WebCore::createStringParser): ditto.
+        (WebCore::createMemoryParser): ditto.
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open):
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::SQLiteDatabase):
+        (WebCore::SQLiteDatabase::close):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::start):
+        (WebCore::DatabaseThread::databaseThread): remove m_threadID from debug output.
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::start):
+        (WebCore::LocalStorageThread::scheduleImport):
+        (WebCore::LocalStorageThread::scheduleSync):
+        (WebCore::LocalStorageThread::terminate):
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::start):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::start):
+
+2009-05-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Rubber Stamped by Dave Hyatt
+        
+        Shuffle the data members to minimize padding.
+
+        * dom/ClassNames.h:
+
+2009-05-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/6864062> Shrink GlyphPage from 4112 to 2576 bytes in 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=25605
+
+        Shrink GlyphPage by splitting the array of GlyphData, which has lots
+        of padding, into separate Glyph and SimpleFontData* arrays.
+
+        * platform/graphics/Font.h:
+        glyphDataForCharacter has to return a GlyphData by value now.
+        
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter):
+        Return GlyphData by value.
+        
+        * platform/graphics/GlyphPageTreeNode.cpp:
+        (WebCore::GlyphPageTreeNode::initializePage):
+        Better encapsulation of GlyphPage, using the new methods.
+
+        * platform/graphics/Font.h:
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter):
+        * platform/graphics/GlyphPageTreeNode.cpp:
+        (WebCore::GlyphPageTreeNode::initializePage):
+        * platform/graphics/GlyphPageTreeNode.h:
+        (WebCore::GlyphData::GlyphData):
+        (WebCore::GlyphPage::indexForCharacter):
+        (WebCore::GlyphPage::glyphDataForCharacter):
+        (WebCore::GlyphPage::glyphDataForIndex):
+        (WebCore::GlyphPage::glyphAt):
+        (WebCore::GlyphPage::fontDataForCharacter):
+        (WebCore::GlyphPage::setGlyphDataForCharacter):
+        (WebCore::GlyphPage::setGlyphDataForIndex):
+        (WebCore::GlyphPage::copyFrom):
+        (WebCore::GlyphPage::clear):
+
+2009-05-07  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25625
+        Implement Image/Option constructors in V8 bindings.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER): Removed old JS-based code.
+        * bindings/v8/custom/V8HTMLImageElementConstructor.cpp: Added.
+        * bindings/v8/custom/V8HTMLOptionElementConstructor.cpp: Added.
+
+2009-05-07  Brady Eidson  <beidson@apple.com>
+
+        I hate myself for doing this, but need to fix that ChangeLog entry.
+
+        * ChangeLog:
+
+2009-05-07  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Darin Adler
+
+        * html/HTMLParser.cpp: Use the correct style of BUILDING_ON_* for WebCore.
+        * html/HTMLParser.h: Ditto
+
+2009-05-07  David Hyatt  <hyatt@apple.com>
+
+        Restore intrinsic margins to all form controls on Mac and Windows.  Some of this regressed in 43007
+        when textareas were given explicit margins.  Some of it had already regressed earlier whenever intrinsic
+        margins were turned off in themeWin.css.
+
+        Reviewed by Beth Dakin.
+
+        * css/html4.css:
+        * css/themeWin.css:
+
+2009-05-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler and Alexey Proskuryakov.
+
+        <rdar://problem/6863795> Exception occurs in Mail when attempting to create signatures due to <head> element creation
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose): Check shouldCreateImplicitHead() before creating it.
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleError): Check shouldCreateImplicitHead() before creating it.
+        (WebCore::HTMLParser::bodyCreateErrorCheck): Ditto.
+        (WebCore::shouldCreateImplicitHead): For Tiger/Leopard when running under Mail, the implicit <head> shouldn't be created.
+        * html/HTMLParser.h:
+        (WebCore::shouldCreateImplicitHead): Inline implementation for non-Tiger/Leopard platforms
+
+2009-05-07  Antony Sargent  <asargent@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix a memory leak in V8EventListenerList::remove.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25618
+
+        No new functionality so no new tests. 
+
+        * bindings/v8/V8EventListenerList.cpp:
+        (WebCore::V8EventListenerList::remove):
+
+2009-05-07  Darin Fisher  <darin@chromium.org>
+
+        Fix Chromium build bustage.
+
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp: Add missing
+        HTMLCollection.h include.
+
+2009-05-07  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 25598: AX: if a radio button has a label and a title, the label is not exposed
+        https://bugs.webkit.org/show_bug.cgi?id=25598
+
+        Test: accessibility/radio-button-title-label.html
+
+        * page/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::exposesTitleUIElement):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::exposesTitleUIElement):
+        (WebCore::AccessibilityRenderObject::titleUIElement):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * page/AccessibilityRenderObject.h:
+
+2009-05-07  Darin Fisher  <darin@chromium.org>
+
+        Fix Chromium build bustage.
+
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER): ":" should be "::"
+
+2009-05-07  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25610
+        [GTK] text.caretOffset is reportedly always 0
+
+        Use the right function to get the caret offset in an
+        element. selectionStart() would only work for text
+        controls (there's even an ASSERT when calculating the selected
+        text range). Instead just get the selection and get the offset of
+        the start position.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-05-07  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix support for antialiased CSS border-radius
+        
+        WebKit implements border-radius by drawing a double-size border,
+        and then letting the clip constrain the border to the right width
+        and position. This requires support for antialiased clipping, as
+        well as painting, to get a nice smooth border.
+        
+        Qt only does antialiased clipping if the anti-alias flag is set
+        at the time of clipping, so we have to enable this in the method
+        addInnerRoundedRectClip(), as well as when we draw the border.
+        
+        Currently the raster-engine is the only Qt paint engine to support
+        anti-aliased clipping, but the OpenGL and Mac paint engines could
+        potentially support this in the future.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+
+2009-05-07  Adam Langley  <agl@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Render empty optgroup elements.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24900
+
+        Currently, optgroup elements which are empty are not rendered. The
+        HTML specification gives no guidance on this situation.
+
+        However, the test for being empty is that they have no children, thus
+        this will not render:
+          <optgroup label="test"></optgroup>
+        while this /will/ render (because of the text node child):
+          <optgroup label="test"> </optgroup>
+
+        This patch will cause both cases to render which matches IE's and
+        Firefox's behaviour.
+
+        The difference only appears when opening the select element and does
+        not appear in the render tree. Thus, a manual layout-test is required.
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::recalcListItems):
+        * manual-tests/optgroup-empty-and-nested.html: Added.
+
+2009-05-06  Julie Parent  <jparent@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 25608: Unused m_frame in ChromiumClipboard.
+        https://bugs.webkit.org/show_bug.cgi?id=25608
+
+        * platform/chromium/ClipboardChromium.h:
+        
+        No tests added as this is only removing dead code, no functional changes.
+
+2009-05-06  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser and Justin Garcia.
+
+        - fix another part of <rdar://problem/6703873> Triple-click quoted line
+          and type Return creates an extra quoted blank line
+
+        Test: editing/inserting/6703873-2.html
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply): Corrected the logic for
+        determining the first node that should go into the new blockquote
+        given the split position: if it is at the end of a container, use the
+        next node after the container. Otherwise, use the child at the
+        position's offset.
+
+2009-05-06  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, fixes for wx trunk builds.
+
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::draw):
+        * platform/wx/RenderThemeWx.cpp:
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
+        (wxFontProperties::wxFontProperties):
+
+2009-05-06  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25597
+        Fix API drift compile errors that occurred while this was ifdef-ed out.
+        The two big issues were that RenderObject::element() became
+        RenderObject::node() and some of the wk* drawing functions had
+        an extra theme parameter added to the argument list.
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMediaFullscreenButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekBackButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderThumb):
+
+2009-05-06  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25385
+        Upstream changes to V8 bindings for supporting nested workers.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::ToV8Object):
+        (WebCore::WorkerContextExecutionProxy::EventTargetToV8Object):
+        * bindings/v8/custom/V8WorkerCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_SETTER WorkerOnmessage):
+        (WebCore::CALLBACK_FUNC_DECL WorkerAddEventListener):
+
+2009-05-06  Dave Moore  <davemoore@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25513
+        The V8 bindings convert every javascript property to its associated css style
+        name. It then calls functions that convert that name to an id. This makes
+        getting or setting css styles on elements slow.
+        
+        The patch fixes this by caching the results of the transformation, mapping a
+        javascript property name to its css property id. It then calls the already
+        public webkit methods that take the id in place of the string property names.
+
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+
+2009-05-06  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25591
+        Upstream V8HTMLFormElement from the Chromium repository.
+
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        (WebCore::INDEXED_PROPERTY_GETTER HTMLFormElement): Upstreamed from Chromium repository
+        (WebCore::NAMED_PROPERTY_GETTER HTMLFormElement): Changed empty element return case to return notHandledByInterceptor();
+        (WebCore::CALLBACK_FUNC_DECL HTMLFormElementSubmit): Upstreamed from Chromium repository
+
+2009-05-06  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25595
+        Upstream V8CanvasPixelArrayCustom from chromium port tree.
+
+        * bindings/v8/V8CanvasPixelArrayCustom.cpp: Added.
+
+2009-05-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Rubber-stampted by Eric Seidel
+
+        Add braces to clarify logic flow in RenderObject::adjustStyleDifference.
+        Only affects ACCELERATED_COMPOSITING builds.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::adjustStyleDifference):
+
+2009-05-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        <rdar://problem/6862550> Reduce size of RenderText in 64-bit
+        
+        Rearrange data members of RenderText so that an int comes
+        first, to minimize padding.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::RenderText):
+        * rendering/RenderText.h:
+
+2009-05-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        <rdar://problem/6862823> Reduce size of RenderStyle in 64-bit
+        
+        Rearrange data members of RenderStyle to minimize padding
+        when building for 64-bit.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::RenderStyle):
+        * rendering/style/RenderStyle.h:
+        (WebCore::):
+
+2009-05-06  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25596
+
+        Fixes Chromium build bustage caused by r43317 (making
+        RefCountedBase::m_refCount private)
+
+        * page/chromium/AccessibilityObjectWrapper.h:
+        (WebCore::AccessibilityObjectWrapper::AccessibilityObjectWrapper):
+
+2009-05-06  Hin-Chung Lam  <hclam@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25593
+
+        Refactor for MediaPlayerPrivate for Chromium port. Remove
+        the implementation of MediaPlayerPrivateInferface from it.
+
+        * platform\graphics\chromium\MediaPlayerPrivateChromium.h:
+
+2009-05-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt, Dan Bernstein
+        
+        <rdar://problem/6860197> Reduce the size of FontFallbackList in 64-bit
+
+        Re-order the data members of FontFallbackList to save 8 bytes when building 64-bit.
+
+        * platform/graphics/FontFallbackList.cpp:
+        (WebCore::FontFallbackList::FontFallbackList):
+        * platform/graphics/FontFallbackList.h:
+
+2009-05-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler, Dan Bernstein
+
+        <rdar://problem/6860068> Reduce size of InlineBox in 64-bit
+
+        Re-order the data members of InlineBox to save 8 bytes when building 64-bit.
+
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
+
+2009-05-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25588
+        Adding the custom v8 bindings Document.location.
+
+        * bindings/v8/custom/V8DocumentLocationCustom.cpp: Added.
+
+2009-05-06  Kevin McCullough  <kmccullough@apple.com>
+
+        -Clarified a comment
+
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+
+2009-05-06  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Fix WML enabled builds by including "MappedAttribute.h" in several places.
+
+        * wml/WMLAElement.cpp:
+        * wml/WMLAccessElement.cpp:
+        * wml/WMLBRElement.cpp:
+        * wml/WMLCardElement.cpp:
+        * wml/WMLDoElement.cpp:
+        * wml/WMLElement.cpp:
+        * wml/WMLFieldSetElement.cpp:
+        * wml/WMLGoElement.cpp:
+        * wml/WMLImageElement.cpp:
+        * wml/WMLInputElement.cpp:
+        * wml/WMLMetaElement.cpp:
+        * wml/WMLOnEventElement.cpp:
+        * wml/WMLOptGroupElement.cpp:
+        * wml/WMLOptionElement.cpp:
+        * wml/WMLPElement.cpp:
+        * wml/WMLPostfieldElement.cpp:
+        * wml/WMLSetvarElement.cpp:
+        * wml/WMLTableElement.cpp:
+        * wml/WMLTemplateElement.cpp:
+        * wml/WMLTimerElement.cpp:
+
+2009-05-06  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25526
+        [Gtk] Additional support is needed for caret browsing
+
+        Emit AtkText::text-selection-changed when the selection changes
+        and the current selection is of Range (ie, the start and end
+        positions are different) type. This seems to match what Gecko
+        does.
+
+        * editing/gtk/SelectionControllerGtk.cpp:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+
+2009-05-05  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25526
+        [Gtk] Additional support is needed for caret browsing
+
+        Emit AtkText::text-caret-moved when selection changes.
+
+        * GNUmakefile.am:
+        * editing/SelectionController.h:
+        * editing/gtk/SelectionController.cpp: Added.
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+
+2009-05-06  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Use mozilla cursors for the previously not implemented
+        cursors. The manual-tests/cursor.html is looking complete
+        now.
+
+        * platform/gtk/CursorGtk.cpp:
+        (WebCore::cellCursor):
+        (WebCore::noDropCursor):
+        (WebCore::progressCursor):
+        (WebCore::noneCursor):
+        (WebCore::notAllowedCursor):
+        (WebCore::grabCursor):
+        (WebCore::grabbingCursor):
+        * platform/gtk/CursorGtk.h:
+
+2009-05-06  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Xan Lopez.
+
+        Properly indent the header file.
+
+        * platform/gtk/CursorGtk.h:
+
+2009-05-06  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Use the mozilla copyright header. Use MPL1.1/GPL2.0
+        and LGPL2.1 as the license compared to LGPL2.0.
+
+        * platform/gtk/CursorGtk.h:
+
+2009-05-06  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Gustavo Noronha.
+
+        Move PluginView::invalidateRegion from the
+        TemporaryLinkStubs to PluginViewGtk.cpp and implement
+        it with a call to Widget::invalidate() just like
+        mac is doing. Optimisations would have to be window
+        system specific.
+
+        * platform/gtk/TemporaryLinkStubs.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::invalidateRegion):
+
+2009-05-06  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        Misc fixes to InspectorClientGtk.
+
+        * GNUmakefile.am: Add localizedStrings.js to webinspector_DATA.
+        This prevents copious amounts "Localized string not found" errors
+        in the console
+
+2009-05-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix the Qt build on Windows.
+
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::GraphicsContext::shouldIncludeChildWindows): Implemented dummy accessor.
+
+2009-05-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Tweak WebCore.pro for being able to override the generated sources dir for the
+        generated_files target.
+
+        * WebCore.pro:
+
+2009-05-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Fix the Qt/Windows build, use iface instead of interface to avoid conflict
+        with VS2005 headers.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkPseudoState):
+
+2009-05-06  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        We need to include StringExtras.h on Windows CE to access the strdup function.
+
+        * plugins/PluginStream.cpp:
+
+2009-05-06  Soren Gjesse  <sgjesse@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Changed the toString behaviour for non document dom node event handlers in the V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=25544
+
+        In the V8 bindings non document dom node event handlers are wrapped in a number of with blocks and uses an inner
+        function. This causes the default toString on such a handler to return all this wrapper code. As some web sites
+        use the source of an event handler to create new functions this wrapper code causes compatibility problems.
+
+        Create a specific toString function for these handlers which will return a function source compatible with the
+        source returned by the JSC bindings and other browsers.
+
+        Test: fast/events/event-function-toString.html
+
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        (WebCore::V8LazyEventListenerToString):
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::create):
+
+2009-05-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Build QtWebKit as a framework on Mac
+
+        This implies both debug and release build by default, unless
+        one of the --debug or --release config options are passed to
+        the build-webkit script.
+
+        Frameworks can be disabled by passing CONFIG+=webkit_no_framework
+        to the build-webkit script.
+
+        To be able to build both debug and release targets in parallel
+        we have to use separate output directories for the generated
+        sources, which is not optimal, but required to avoid race conditions.
+
+        An optimization would be to only require this spit-up on Mac.
+
+        * WebCore.pro:
+
+2009-05-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Use $$GENERATED_SOURCES_DIR as output when running bison
+
+        A couple of the generators left the bison output file in the source
+        tree, and then moved it into $$GENERATED_SOURCES_DIR, which did not
+        work well when building release and debug configurations in parallel.
+
+        * WebCore.pro:
+
+2009-05-06  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Justin Garcia.
+
+        - fix an assertion failure in RemoveNodeCommand() when deleting a <br>
+          between a block and a mail blockquote
+
+        Test: editing/deleting/removeNodeCommand-assert.html
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::mergeParagraphs): Pass the start block
+        to prune() instead of passing m_upstreamStart.node(), because the latter
+        may have been removed already.
+
+2009-05-05  Eric Seidel  <eric@webkit.org>
+
+        No review, roll out only.
+
+        Roll out r23072 since it broke layout tests
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+
+2009-05-05  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Eric Seidel.
+        
+        Add #if ENABLE(DATABASE) guards around database code so toggling ENABLE_DATABASE off does not break builds.
+        https://bugs.webkit.org/show_bug.cgi?id=24776
+
+        No functional changes, thus no tests.
+
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        * bindings/js/JSCustomSQLStatementCallback.h:
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        * bindings/js/JSCustomSQLStatementErrorCallback.h:
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        * bindings/js/JSCustomSQLTransactionCallback.h:
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
+        * bindings/js/JSDatabaseCustom.cpp:
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        * loader/EmptyClients.h:
+        * page/ChromeClient.h:
+        * storage/ChangeVersionWrapper.cpp:
+        * storage/ChangeVersionWrapper.h:
+        * storage/Database.cpp:
+        (WebCore::Database::databaseInfoTableName):
+        * storage/Database.h:
+        * storage/Database.idl:
+        * storage/DatabaseTask.cpp:
+        * storage/DatabaseTask.h:
+        * storage/DatabaseThread.cpp:
+        * storage/DatabaseThread.h:
+        * storage/DatabaseTracker.cpp:
+        * storage/DatabaseTracker.h:
+        * storage/DatabaseTrackerClient.h:
+        * storage/OriginQuotaManager.cpp:
+        * storage/OriginQuotaManager.h:
+        * storage/SQLStatement.cpp:
+        * storage/SQLStatement.h:
+        * storage/SQLTransaction.cpp:
+        * storage/SQLTransaction.h:
+        * storage/SQLTransaction.idl:
+
+2009-05-05  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add some documentation to InlineBox::x(),y().
+        https://bugs.webkit.org/show_bug.cgi?id=25378
+
+        * rendering/InlineBox.h:
+
+2009-05-05  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Eric Seidel.
+
+        Disable all the SVG features for WebKit/Qt if ENABLE_SVG=0 
+        https://bugs.webkit.org/show_bug.cgi?id=24693
+
+        * WebCore.pro:
+
+2009-05-05  Sankar Aditya Tanguturi  <sankaraditya@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Anonymous blocks should not be exposed in accessibility tree.
+        Part of https://bugs.webkit.org/show_bug.cgi?id=23072
+
+        Tests: accessibility/ignore-anonymous-block.html
+               platform/win/accessibility/document-role.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):Return
+        true for Anonymous blocks. Matching Firefox 2.0.0.14
+
+2009-05-05  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        http://bugs.webkit.org/show_bug.cgi?id=25487
+
+        For euc-kr and other 8bit Korean encodings
+        (similar to euc-kr/windows-949), make document.charset return
+        EUC-KR instead of windows-949. The latter is not recognized by
+        Korean web servers.
+
+        Add domName method to TextEncoding to deal with cases where
+        our internal encoding name does not match what's widely recognized
+        by web servers. Currently, the only case is 'windows-949' (internal
+        name) vs 'EUC-KR'.
+
+        Test: fast/encoding/euckr-name.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::encoding): Call TextEncoding.domName() instead
+        of TextEncoding.name().
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::domName): For the canonical name 'windows-949',
+        return 'EUC-KR'. Otherwise, just return the canonical name.
+        * platform/text/TextEncoding.h:
+
+2009-05-05  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Adler.
+
+        Rendering fix for <select> elements.
+        https://bugs.webkit.org/show_bug.cgi?id=25558
+
+        When switching a <select> element from display:none to default
+        display, we would fail to invalidate the parent's pref widths in some
+        situations:
+
+        When attaching the element, RenderMenuList::updateOptionsWidth would
+        call setNeedsLayoutAndPrefWidthsRecalc before the parent pointer was
+        set. This would mark the pref widths as dirty, but not for any parent
+        objects.
+
+        When RenderObjectChildList::appendChildNode later calls
+        setNeedsLayoutAndPrefWidthsRecalc again, with a valid parent pointer,
+        nothing would be done because the pref widths were already dirty for.
+        the RenderMenuList.
+
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::updateOptionsWidth):
+
+2009-05-05  Antony Sargent  <asargent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Switch V8EventListenerList to use HashTable<T>.
+        https://bugs.webkit.org/show_bug.cgi?id=25496
+        
+        This avoids some tricky issues with event listener removal in the 
+        current implementation and has slightly better performance.
+
+        No new functionality so no new tests.
+
+        * bindings/v8/V8EventListenerList.cpp: Added V8EventListenerListIterator.
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::size):
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+
+2009-05-05  Darin Fisher  <darin@chromium.org>
+
+        Fixing build bustage.
+
+        Add some missing includes to fix the Chromium build.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp:
+
+2009-05-05  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25570
+
+        history.{back,forward,go} should always be dispatched asynchronously,
+        even when the history navigation would just result in scrolling the
+        page.  This matches the behavior of other browsers like IE and FF.
+
+        Test: fast/history/back-forward-is-asynchronous.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::scheduleHistoryNavigation):
+
+2009-05-05  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Add an ASSERT(useTransforms) to mapLocalToContainer implementations in SVG.
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+        https://bugs.webkit.org/show_bug.cgi?id=25568
+
+        Adding this ASSERT exposed a bug in SVGPaintServerPattern::setup
+        which was causing transformed SVG text when filled/stroked with a
+        pattern using patternUnits=objectBoundingBox to draw incorrectly.
+
+        I fixed the incorrect drawing (by removing the broken code) and added
+        two test cases to test the fix:
+        * svg/transforms/text-with-pattern-inside-transformed-html.xhtml
+        * svg/transforms/text-with-pattern-with-svg-transform.svg
+
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::mapLocalToContainer):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::mapLocalToContainer):
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2009-05-05  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25554
+        
+        Support HTML5 text control input types: email, number, tel, url
+
+        Test: fast/html/text-field-input-types.html
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLInputElement _isTextField]): Call HTMLInputElement::isTextField directly.
+        * html/HTMLInputElement.cpp: Use the new types where appropriate.
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::type):
+        (WebCore::HTMLInputElement::saveState):
+        (WebCore::HTMLInputElement::restoreState):
+        (WebCore::HTMLInputElement::accessKeyAction):
+        (WebCore::HTMLInputElement::rendererIsNeeded):
+        (WebCore::HTMLInputElement::createRenderer):
+        (WebCore::HTMLInputElement::appendFormData):
+        (WebCore::HTMLInputElement::valueWithDefault):
+        (WebCore::HTMLInputElement::storesValueSeparateFromAttribute):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * html/HTMLInputElement.h: Ditto.
+        (WebCore::HTMLInputElement::):
+        (WebCore::HTMLInputElement::isTextField):
+
+2009-04-01  miggilin  <mr.diggilin@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Mouse wheel scrolling and keyboard shortcut support for wx.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24797
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/wx/KeyboardEventWx.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::platformSetScrollPosition):
+
+2009-05-05  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for Windows, add missing include.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24798
+
+        * platform/wx/wxcode/win/non-kerned-drawing.cpp:
+
+2009-05-05  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 25574: AXImageMap children links don't respond properly to accessibilityHitTest:
+        https://bugs.webkit.org/show_bug.cgi?id=25574
+
+        Enable accessibility hit-testing for image map links. 
+        Allow image map links to return AXURLs and AXAccessKey information.
+
+        Test: platform/mac/accessibility/imagemap-hittest.html
+
+        * page/AccessibilityImageMapLink.cpp:
+        (WebCore::AccessibilityImageMapLink::url):
+        * page/AccessibilityImageMapLink.h:
+        * page/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::minValueForRange):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
+        (WebCore::AccessibilityRenderObject::accessibilityImageMapHitTest):
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
+        * page/AccessibilityRenderObject.h:
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+
+2009-05-05  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6552129> Select a quote line and paste elsewhere, you
+        get that line and an extra quoted blank line
+        <rdar://problem/6609308> Triple-click a quoted header line, copy, paste
+        onto an empty line makes an extra quoted line
+
+        - When pasting a blockquote with a newline, make sure we put the newline
+        outside of the blockquote so that it is not quoted.
+
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+
+2009-05-05  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        Call moz_gtk_shutdown on RenderThemeGtk destruction.
+
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::~RenderThemeGtk):
+        * platform/gtk/RenderThemeGtk.h:
+
+2009-05-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        <rdar://problem/6858340> REGRESSION: can't drag local HTML files into Safari because CFURLCreateWithFileSystemPath inserts "localhost"
+
+        * platform/win/ClipboardUtilitiesWin.cpp: (WebCore::urlFromPath): Remove localhost.
+
+2009-05-05  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Brady Eidson.
+
+        Safety-check m_documentLoader before dereferencing.  While it seems
+        unlikely this could fail (as Safari 3 shipped without this),
+        technically almost any call can change or reset m_documentLoader.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::receivedFirstData):
+
+2009-05-05  Dan Bernstein  <mitz@apple.com>
+
+        - Tiger build fix
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::toCSSIdentifier):
+
+2009-05-05  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25303
+        No need to ref the internal buffer inside the Skia ImageDecoder.
+
+        * platform/image-decoders/skia/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::bitmap):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setRGBA):
+
+2009-05-05  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=24192
+          <rdar://problem/5760774> Replying to a Mail message that contains
+          fixed width text can change the size of the text
+
+        Covered by existing tests: editing/pasteboard/5027857.html
+                                   editing/pasteboard/paste-pre-002.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getFontSizeCSSValuePreferringKeyword):
+        Added. If the font-size is keyword-based, returns the keyword value
+        instead of the pixel size.
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): If
+        font-family is a generic family, return the generic family instead of
+        the the internal string -webkit-[serif|sans-serif|cursive|fantasy
+        |monospace].
+        (WebCore::CSSComputedStyleDeclaration::copyInheritableProperties):
+        For the font-size property, prefer a keyword value over a pixel size.
+        * css/CSSComputedStyleDeclaration.h:
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::currentlyHasStyle): For the font-size property,
+        call getFontSizeCSSValuePreferringKeyword().
+        * platform/graphics/FontDescription.h:
+        (WebCore::FontDescription::keywordSize): Changed the return type to
+        unsigned.
+        (WebCore::FontDescription::setKeywordSize): Changed the parameter type
+        to unsigned.
+        (WebCore::FontDescription::m_keywordSize): Changed the type of this
+        4-bit field to unsigned, because it takes values as high as 8.
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix http/tests/misc/DOMContentLoaded-event.html
+
+        The native call performance improvement removed a few places where we
+        unintentionally performed a toThisObject conversion.  This patch updates
+        the bindings codegen to not rely on this bug.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-05-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Xan Lopez and Gustavo Noronha.
+
+        Implement WebCore::directoryName for Gtk+.
+
+        * platform/gtk/FileSystemGtk.cpp:
+        (WebCore::directoryName):
+
+2009-05-05  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Fix mappedAttributes() access without NULL check
+        https://bugs.webkit.org/show_bug.cgi?id=25553
+
+        SVGStyledElement::getPresentationAttribute was using mappedAttributes()
+        without checking for NULL.
+
+        HTMLInputElement::setInputType also doesn't NULL check, but I was not
+        able to get it to crash with a test case so I just added an ASSERT.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::getPresentationAttribute):
+
+2009-05-05  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Xan Lopez.
+
+        Implement WebCore::imageTitle for Gtk+.
+
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::imageTitle):
+
+2009-05-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Bug 25559: Improve native function call performance
+        <https://bugs.webkit.org/show_bug.cgi?id=25559>
+
+        Add forwarding header necessary for compilation, and fix debugger
+        to correctly account for change in JSFunction behaviour.
+
+        * ForwardingHeaders/jit/JITCode.h: Added.
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+
+2009-05-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Make convertValueToQVariant more robust against null JSValues.
+
+        Don't require the caller to do the null check.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+
+2009-05-05  Eric Seidel  <eric@webkit.org>
+
+        No review, just a revert.
+
+        Roll out http://trac.webkit.org/changeset/43213 as it caused 4 tests to crash.
+
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::mapLocalToContainer):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::mapLocalToContainer):
+
+2009-05-04  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        <rdar://problem/6576889> REGRESSION (r35185): Cannot watch Flash movies on omg.yahoo.com
+
+        The problem was caused by missing <head> element - we used to create it when moving a
+        misplaced <style> element, but we now handle those in place. Other browsers always create
+        a <head> element.
+
+        There is no guarantee that a <head> element always exists - first, it can be removed with
+        removeChild or innerHTML, and also, we don't currently create it for frameset documents, or
+        for manually created ones (e.g. ImageDocument).
+
+        Test: fast/parser/head-element-for-yahoo-player.html
+
+        * dom/Document.cpp: (WebCore::Document::implicitClose): Create a <head> element for about:blank.
+        A removed comment talked about rdar://3758785, but that problem doesn't re-occur even if this
+        code is removed completely.
+
+        * html/HTMLHtmlElement.cpp: (WebCore::HTMLHtmlElement::checkDTD): No longer allow <script>
+        elements as children of <html>. This isn't directly related to this bug, but it was easier
+        to fix both at once (IE and Firefox both don't allow such mispositioned <script> elements).
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleError): Move <script> to <head> if <body> hasn't been created yet.
+        Create a <head> it a <body> is created implicitly to contain some other element.
+        (WebCore::HTMLParser::bodyCreateErrorCheck): Ensure that a <head> exists when <body> is
+        explicitly present in source.
+        (WebCore::HTMLParser::createHead): Do the work even if <html> element hasn't been created yet.
+
+2009-05-04  Jakub Wieczorek  <faw217@gmail.com>
+
+        Reviewed by Simon Hausmann.
+
+        As Qtish implementation of MIMETypeRegistry::getMIMETypeForExtension()
+        returns the application/octet-stream mimetype when it can't associate
+        extension with any mimetype, it can happen that the application/octet-stream
+        mimetype will hit the list of supported image formats. For instance,
+        it is possible when QImageReader or QImageWriter support an extension
+        that is not in the extensions map.
+
+        Make sure that this mimetype is not treated as displayable image type.
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes):
+        (WebCore::initializeSupportedImageMIMETypesForEncoding):
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        ASSERT(useTransforms) in SVG mapLocalToContainer implementations
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::mapLocalToContainer):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::mapLocalToContainer):
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Remove m_absoluteBounds hack from RenderSVGText
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        No functional changes (SVGs inside CSS transformed HTML should theoretically repaint better)
+
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::layout):
+        * rendering/RenderSVGText.h:
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Remove the vestigial calculateLocalTransform()
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        RenderSVGContainer is now the only render which needs this
+        function, but it no longer returns the unused bool.
+
+        calculateLocalTransform() previously was called by the DOM before
+        transform updates were part of layout().
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::layout):
+        * rendering/RenderForeignObject.h:
+        (WebCore::RenderForeignObject::localTransform):
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::layout):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        * rendering/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::calculateLocalTransform):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::layout):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::layout):
+        * rendering/RenderSVGText.h:
+        * rendering/RenderSVGTransformableContainer.cpp:
+        (WebCore::RenderSVGTransformableContainer::calculateLocalTransform):
+        * rendering/RenderSVGTransformableContainer.h:
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Move more code into SVGRenderBase
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        clippedOverflowRectForRepaint, computeRectForRepaint and mapLocalToContainer
+        are now all shared via SVGRenderBase.
+
+        RenderForeignObject should also be sharing this code, but I've left it
+        alone for now, as changing that would likely cause test changes.
+
+        No test changes.  It's possible that transformed <svg:image> elements will
+        now show up with better metrics in the inspector.
+
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGImage::computeRectForRepaint):
+        (WebCore::RenderSVGImage::mapLocalToContainer):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGModelObject::computeRectForRepaint):
+        (WebCore::RenderSVGModelObject::mapLocalToContainer):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGText::computeRectForRepaint):
+        (WebCore::RenderSVGText::mapLocalToContainer):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::clippedOverflowRectForRepaint):
+        (WebCore::SVGRenderBase::computeRectForRepaint):
+        (WebCore::SVGRenderBase::mapLocalToContainer):
+        * rendering/SVGRenderSupport.h:
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Add SVGRenderBase to share logic between SVG renderers
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        I've added an SVGRenderBase base class which is shared by
+        all of the SVG renders now.  This patch is just moving code
+        there are no functional changes in this patch.
+
+        Currently I've left these functions in SVGRenderSupport.h
+        In a later patch I will rename SVGRenderSupport.* to SVGRenderBase.*
+
+        clampImageBufferSizeToViewport now takes a FrameView* which makes some code easier to read.
+
+        * rendering/RenderSVGBlock.h:
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGRoot.h:
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::finishRenderSVGContent):
+        (WebCore::clampImageBufferSizeToViewport):
+        (WebCore::SVGRenderBase::computeContainerBoundingBox):
+        (WebCore::SVGRenderBase::filterBoundingBoxForRenderer):
+        * rendering/SVGRenderSupport.h:
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkStartCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkEndCallback):
+        (WebCore::SVGRootInlineBox::paint):
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::drawMaskerContent):
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::buildPattern):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::createMaskAndSwapContextForTextGradient):
+        (WebCore::clipToTextMask):
+
+2009-05-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed SVG build fix.
+
+        Include MappedAttribute.h after r43187.
+
+        * svg/SVGComponentTransferFunctionElement.cpp:
+        * svg/SVGFEBlendElement.cpp:
+        * svg/SVGFEColorMatrixElement.cpp:
+        * svg/SVGFEComponentTransferElement.cpp:
+        * svg/SVGFECompositeElement.cpp:
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        * svg/SVGFEDisplacementMapElement.cpp:
+        * svg/SVGFEGaussianBlurElement.cpp:
+        * svg/SVGFEImageElement.cpp:
+        * svg/SVGFELightElement.cpp:
+        * svg/SVGFEMergeNodeElement.cpp:
+        * svg/SVGFEOffsetElement.cpp:
+        * svg/SVGFESpecularLightingElement.cpp:
+        * svg/SVGFETileElement.cpp:
+        * svg/SVGFETurbulenceElement.cpp:
+        * svg/SVGFilterElement.cpp:
+        * svg/SVGFilterPrimitiveStandardAttributes.cpp:
+
+2009-05-04  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam 'The Belly' Weinig
+
+        <rdar://problem/6828894> - Facebook photo uploader applet broken on Leopard only
+
+        In r41568 we started adding a default codebase attribute to <applet> tags if they didn't specify one
+        themselves.  Leopard's Java plug-in mishandles this case and fails to load code for the applet.
+
+        The spirit of r41568 can be maintained by removing the "default codebase" piece and only performing
+        the canLoad() check if a codebase was actually set on the applet tag.
+
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::createRenderer): Don't create a default codebase attribute.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::createJavaAppletWidget): Only perform the canLoad() check if the codebase was set.
+
+2009-05-04  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * html/HTMLCollection.h:
+        * html/HTMLFormElement.h:
+        Declare CollectionCache as a struct, not a class, to match its
+        definition.
+
+2009-05-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin, Oliver Hunt.
+
+        Bug 25557: REGRESSION: Canvas elements are ignored instead of being exposed as AXImage
+        https://bugs.webkit.org/show_bug.cgi?id=25557
+
+        Test: accessibility/canvas.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::roleValue):
+
+2009-05-04  Brady Eidson  <beidson@apple.com>
+
+        Fix an ancient Changelog entry where Sam Weinig flat out lied and confused my exploration of a bug.
+
+        * ChangeLog
+
+2009-05-04  Kai Brüning  <kai@granus.net>
+
+        Reviewed by Eric Seidel.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24883
+        24883: Bad success test in parseXMLDocumentFragment in XMLTokenizerLibxml2.cpp
+        
+        Fixed test whether all the chunk has been processed to correctly count utf8 bytes.
+
+        Test: fast/innerHTML/innerHTML-nbsp.xhtml
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::parseXMLDocumentFragment):
+
+2009-05-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 24924: remove Document.h include of Attr.h and HTMLCollection.h,
+        and NamedMappedAttrMap.h include of MappedAttribute.h
+        https://bugs.webkit.org/show_bug.cgi?id=24924
+
+        Make compiles faster, and debugging info smaller.
+
+        * GNUmakefile.am: Added new source files.
+        * WebCore.pro: Ditto.
+        * WebCore.scons: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::toJS): Updated for new collection type names.
+
+        * dom/Document.cpp:
+        (WebCore::Document::createAttribute): Added. No longer inline.
+        (WebCore::Document::images): Updated for new collection type names.
+        (WebCore::Document::applets): Ditto.
+        (WebCore::Document::embeds): Ditto.
+        (WebCore::Document::plugins): Ditto.
+        (WebCore::Document::objects): Ditto.
+        (WebCore::Document::scripts): Ditto.
+        (WebCore::Document::links): Ditto.
+        (WebCore::Document::forms): Ditto.
+        (WebCore::Document::anchors): Ditto.
+        (WebCore::Document::all): Ditto.
+        (WebCore::Document::windowNamedItems): Ditto.
+        (WebCore::Document::documentNamedItems): Ditto.
+        (WebCore::Document::nameCollectionInfo): Ditto.
+
+        * dom/Document.h: Changed around includes and forward declarations.
+        Updated for changes to collection types.
+
+        * dom/NamedMappedAttrMap.h: Removed include of MappedAttribute.h.
+
+        * html/CollectionCache.cpp: Copied from WebCore/html/HTMLCollection.cpp.
+        Contains the class that used to be HTMLCollection::CollectionInfo.
+        * html/CollectionCache.h: Copied from WebCore/html/HTMLCollection.h.
+        Ditto.
+
+        * html/CollectionType.h: Copied from WebCore/html/HTMLCollection.h.
+        Has the enum that used to be HTMLCollection::Type.
+
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::HTMLCollection): Update for collection type change.
+        (WebCore::HTMLCollection::create): Ditto.
+        (WebCore::HTMLCollection::resetCollectionInfo): Ditto.
+        (WebCore::HTMLCollection::itemAfter): Ditto.
+        * html/HTMLCollection.h: Ditto.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::children): Updated for new collection type names.
+        * html/HTMLFormCollection.cpp:
+        (WebCore::HTMLFormCollection::formCollectionInfo): Ditto.
+        (WebCore::HTMLFormCollection::HTMLFormCollection): Ditto.
+        * html/HTMLFormCollection.h: Ditto.
+        * html/HTMLFormElement.h: Ditto.
+        * html/HTMLMapElement.cpp:
+        (WebCore::HTMLMapElement::areas): Ditto.
+        * html/HTMLNameCollection.cpp:
+        (WebCore::HTMLNameCollection::HTMLNameCollection): Ditto.
+        * html/HTMLNameCollection.h:
+        (WebCore::HTMLNameCollection::create): Ditto.
+        * html/HTMLSelectElement.h:
+        (WebCore::HTMLSelectElement::collectionInfo): Ditto.
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::tBodies):Ditto.
+        * html/HTMLTableRowElement.cpp:
+        (WebCore::HTMLTableRowElement::cells):Ditto.
+        * html/HTMLTableRowsCollection.cpp:
+        (WebCore::HTMLTableRowsCollection::HTMLTableRowsCollection): Ditto.
+        * html/HTMLTableSectionElement.cpp:
+        (WebCore::HTMLTableSectionElement::rows): Ditto.
+
+        * bindings/js/JSDOMWindowBase.cpp: Added newly-needed includes.
+        * bindings/js/JSHTMLFrameSetElementCustom.cpp: Ditto.
+        * css/CSSStyleSelector.cpp: Ditto.
+        * dom/Element.cpp: Ditto.
+        * dom/InputElement.cpp: Ditto.
+        * dom/NamedAttrMap.cpp: Ditto.
+        * dom/NamedMappedAttrMap.cpp: Ditto.
+        * dom/Node.cpp: Ditto.
+        * dom/StyledElement.cpp: Ditto.
+        * dom/StyledElement.h: Ditto.
+        * editing/ApplyStyleCommand.cpp: Ditto.
+        * editing/DeleteSelectionCommand.cpp: Ditto.
+        * editing/Editor.cpp: Ditto.
+        * editing/EditorCommand.cpp: Ditto.
+        * editing/InsertParagraphSeparatorCommand.cpp: Ditto.
+        * editing/ReplaceSelectionCommand.cpp: Ditto.
+        * editing/markup.cpp: Ditto.
+        * html/CanvasRenderingContext2D.cpp: Ditto.
+        * html/HTMLAnchorElement.cpp: Ditto.
+        * html/HTMLAppletElement.cpp: Ditto.
+        * html/HTMLAreaElement.cpp: Ditto.
+        * html/HTMLBRElement.cpp: Ditto.
+        * html/HTMLBaseElement.cpp: Ditto.
+        * html/HTMLBodyElement.cpp: Ditto.
+        * html/HTMLButtonElement.cpp: Ditto.
+        * html/HTMLCanvasElement.cpp: Ditto.
+        * html/HTMLDivElement.cpp: Ditto.
+        * html/HTMLEmbedElement.cpp: Ditto.
+        * html/HTMLFontElement.cpp: Ditto.
+        * html/HTMLFormControlElement.cpp: Ditto.
+        * html/HTMLFormElement.cpp: Ditto.
+        * html/HTMLFrameElement.cpp: Ditto.
+        * html/HTMLFrameElementBase.cpp: Ditto.
+        * html/HTMLFrameSetElement.cpp: Ditto.
+        * html/HTMLHRElement.cpp: Ditto.
+        * html/HTMLIFrameElement.cpp: Ditto.
+        * html/HTMLImageElement.cpp: Ditto.
+        * html/HTMLInputElement.cpp: Ditto.
+        * html/HTMLIsIndexElement.cpp: Ditto.
+        * html/HTMLKeygenElement.cpp: Ditto.
+        * html/HTMLLIElement.cpp: Ditto.
+        * html/HTMLLinkElement.cpp: Ditto.
+        * html/HTMLMarqueeElement.cpp: Ditto.
+        * html/HTMLMetaElement.cpp: Ditto.
+        * html/HTMLOListElement.cpp: Ditto.
+        * html/HTMLObjectElement.cpp: Ditto.
+        * html/HTMLOptionElement.cpp: Ditto.
+        * html/HTMLParagraphElement.cpp: Ditto.
+        * html/HTMLParamElement.cpp: Ditto.
+        * html/HTMLPlugInElement.cpp: Ditto.
+        * html/HTMLPreElement.cpp: Ditto.
+        * html/HTMLScriptElement.cpp: Ditto.
+        * html/HTMLSelectElement.cpp: Ditto.
+        * html/HTMLStyleElement.cpp: Ditto.
+        * html/HTMLTableCaptionElement.cpp: Ditto.
+        * html/HTMLTableCellElement.cpp: Ditto.
+        * html/HTMLTableColElement.cpp: Ditto.
+        * html/HTMLTablePartElement.cpp: Ditto.
+        * html/HTMLTextAreaElement.cpp: Ditto.
+        * html/HTMLTokenizer.cpp: Ditto.
+        * html/HTMLUListElement.cpp: Ditto.
+        * html/HTMLVideoElement.cpp: Ditto.
+        * html/HTMLViewSourceDocument.cpp: Ditto.
+        * loader/ImageDocument.cpp: Ditto.
+        * page/Frame.cpp: Ditto.
+        * rendering/RenderTreeAsText.cpp: Ditto.
+        * svg/SVGAElement.cpp: Ditto.
+        * svg/SVGAnimateMotionElement.cpp: Ditto.
+        * svg/SVGAnimateTransformElement.cpp: Ditto.
+        * svg/SVGAnimationElement.cpp: Ditto.
+        * svg/SVGCircleElement.cpp: Ditto.
+        * svg/SVGClipPathElement.cpp: Ditto.
+        * svg/SVGCursorElement.cpp: Ditto.
+        * svg/SVGElement.cpp: Ditto.
+        * svg/SVGEllipseElement.cpp: Ditto.
+        * svg/SVGExternalResourcesRequired.cpp: Ditto.
+        * svg/SVGFitToViewBox.cpp: Ditto.
+        * svg/SVGFontFaceElement.cpp: Ditto.
+        * svg/SVGFontFaceUriElement.cpp: Ditto.
+        * svg/SVGForeignObjectElement.cpp: Ditto.
+        * svg/SVGGlyphElement.cpp: Ditto.
+        * svg/SVGGradientElement.cpp: Ditto.
+        * svg/SVGImageElement.cpp: Ditto.
+        * svg/SVGLangSpace.cpp: Ditto.
+        * svg/SVGLineElement.cpp: Ditto.
+        * svg/SVGLinearGradientElement.cpp: Ditto.
+        * svg/SVGMarkerElement.cpp: Ditto.
+        * svg/SVGMaskElement.cpp: Ditto.
+        * svg/SVGPathElement.cpp: Ditto.
+        * svg/SVGPatternElement.cpp: Ditto.
+        * svg/SVGPolyElement.cpp: Ditto.
+        * svg/SVGRadialGradientElement.cpp: Ditto.
+        * svg/SVGRectElement.cpp: Ditto.
+        * svg/SVGSVGElement.cpp: Ditto.
+        * svg/SVGScriptElement.cpp: Ditto.
+        * svg/SVGStopElement.cpp: Ditto.
+        * svg/SVGStyleElement.cpp: Ditto.
+        * svg/SVGStyledElement.cpp: Ditto.
+        * svg/SVGStyledTransformableElement.cpp: Ditto.
+        * svg/SVGTests.cpp: Ditto.
+        * svg/SVGTextContentElement.cpp: Ditto.
+        * svg/SVGTextElement.cpp: Ditto.
+        * svg/SVGTextPathElement.cpp: Ditto.
+        * svg/SVGTextPositioningElement.cpp: Ditto.
+        * svg/SVGURIReference.cpp: Ditto.
+        * svg/SVGUseElement.cpp: Ditto.
+        * svg/SVGViewElement.cpp: Ditto.
+        * svg/animation/SVGSMILElement.cpp: Ditto.
+        * xml/XPathStep.cpp: Ditto.
+
+2009-05-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Do not instantiate hidden WebInspector panels. Otherwise they are hitting unimplemented InspectorController methods.
+        https://bugs.webkit.org/show_bug.cgi?id=25520
+
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+
+2009-05-04  Brady Eidson <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6839881> With "Mail Contents of This Page" in Safari images don't appear in the Tiger Mail compose window
+
+        DocumentLoader::subresource() is the implementation for the WebKit API [WebDataSource subresourceForURL:] and has 
+        particularly sticky behavior.  
+
+        If the DocumentLoader represents a WebArchive, this method should return ArchiveResources from that archive.  However, we 
+        prefer CachedResources over ArchiveResources because they might represent fresher data than what was originally loaded 
+        from the WebArchive.
+
+        In some instances, CachedResources are created and associated with the DocumentLoader but not immediately run through the 
+        loading delegate machinery.  This was always a possibility, but the Preload Scanner made this significantly more likely.
+
+        When this happens and someone asks the WebDataSource for a subresource, it would prefer the CachedResource over an 
+        ArchiveResource it has even if the CachedResource hasn't been loaded yet.  The CachedResource has nil data, so no
+        WebResource is returned, and the client thinks the subresource doesn't exist even though it does.
+
+        This broke Tiger Mail and probably various other WebKit applications but has a fairly straightforward fix.
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::subresource): If there is a CachedResource but it hasn't been loaded yet, fallback to the
+          ArchiveResource.
+
+2009-05-04  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adam Roben.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25545
+        Bug 25545: HTMLMediaElement: display anamorphic video correctly
+        
+        Tell QuickTime to use clean aperture mode so movies with non-square pixels are sized
+        and displayed correctly.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovie): Ask QuickTime to use clean aperture mode.
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::load): Ditto. Add ASSERT to ensure that static movie property array isn't 
+        filled beyond capacity.
+
+2009-05-03  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=25332>.
+        Bug 25332: Plug-in inserted in to DOM of PluginDocument fails to load
+
+        Only the first plug-in in a PluginDocument can use the main resource data.  For all
+        subsequent plug-ins, such as the plug-in that ClickToFlash inserts when swapping itself
+        out for the real Flash plug-in, we need to load the resource data in the same manner
+        as for other embedded plug-ins.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadPlugin):
+
+2009-05-04  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Ariya Hidayat.
+
+        Update the qrc file for the Web Inspector in the Qt build
+        with missing files.
+
+        * inspector/front-end/WebKit.qrc:
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Move absoluteRects and absoluteQuads into RenderSVGInline and remove absoluteTransform() usage
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::absoluteRects):
+        (WebCore::RenderSVGInline::absoluteQuads):
+        * rendering/RenderSVGInline.h:
+        * rendering/RenderSVGTSpan.cpp:
+        * rendering/RenderSVGTSpan.h:
+        * rendering/RenderSVGTextPath.cpp:
+        * rendering/RenderSVGTextPath.h:
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Move RenderSVGText off of localToAbsolute()
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::absoluteRects):
+        (WebCore::RenderSVGText::absoluteQuads):
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Remove broken absoluteTransform() code from RenderSVGInlineText
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        This improved SVG text focus rings.
+        This also improved SVG.getScreenCTM() results.
+
+        SVGSVGElement::getScreenCTM was passing "true" for the second argument in
+        localToAbsolute, which is "fixed" it meant to pass "true" for the
+        third argument (useTransforms).  That change alone caused no layout test changes, however
+        before I fixed this, it was hitting ASSERT(!fixed) in RenderSVGRoot::mapLocalToContainer
+
+        mapLocalToContainer implementations really should be shared,
+        but I'll do that in a later patch.
+
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::styleDidChange):
+        (WebCore::RenderSVGInlineText::absoluteQuads):
+        (WebCore::RenderSVGInlineText::computeRepaintRectForRange):
+        (WebCore::RenderSVGInlineText::computeRepaintQuadForRange):
+        * rendering/RenderSVGInlineText.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::mapLocalToContainer):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::mapLocalToContainer):
+        * rendering/RenderSVGText.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::getScreenCTM):
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Remove dead code from RenderPath
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        * rendering/RenderPath.cpp:
+        * rendering/RenderPath.h:
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Share layout code between RenderSVGViewportContainer and RenderSVGContainer
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::layout):
+        * rendering/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::calcViewport):
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::applyViewportClip):
+        * rendering/RenderSVGViewportContainer.h:
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Remove redundant disableLayoutState() calls
+        https://bugs.webkit.org/show_bug.cgi?id=25532
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::layout):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::layout):
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::layout):
+
+2009-05-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Simplify RenderForeignObject::paint and fix a repaint bug.
+        Paint now calls applyTransformToPaintInfo which correctly transforms the damage rect.
+        https://bugs.webkit.org/show_bug.cgi?id=16939
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::paint):
+
+2009-05-03  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Test: editing/spelling/spellcheck-attribute.html
+
+        Bug 14552: Add a way to disable spell checking for specific element
+        https://bugs.webkit.org/show_bug.cgi?id=14552
+
+        For compatibility with Firefox, this code ascends the DOM tree when an element does
+        not have its "spellcheck" attribute.
+
+        * editing/Editor.cpp:
+        (WebCore::markMisspellingsOrBadGrammar): Retrieve the value of the "spellcheck"
+        attribute of an element before calling a spell checker or a grammar checker.
+        * html/HTMLAttributeNames.in: Add a "spellcheck" attribute.
+
+2009-05-03  Sam Weinig  <sam@webkit.org>
+
+        Roll JSC API number marshaling back in one last time (I hope).
+
+2009-05-03  Sam Weinig  <sam@webkit.org>
+
+        Roll JSC API number marshaling back out. It still breaks windows.
+
+2009-05-03  Sam Weinig  <sam@webkit.org>
+
+        Roll JSC API number marshaling back in.
+
+2009-05-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - another fix for <rdar://problem/6617298> Typing delete on an unquoted
+          blank line unquotes the preceding, quoted blank line
+
+        Test: editing/deleting/type-delete-after-quote-2.html
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::DeleteSelectionCommand): Initialize
+        m_startsAtEmptyLine.
+        (WebCore::DeleteSelectionCommand::handleSpecialCaseBRDelete): When the
+        selection starts at an empty line, do not prevent the merging of blocks.
+        This is what allows the text after the line break to be merged into the
+        block containing the line break. Also set m_startsAtEmptyLine to true.
+        (WebCore::DeleteSelectionCommand::mergeParagraphs): If
+        m_startsAtEmptyLine is true, create a placeholder BR to serve as the
+        merge destination.
+        * editing/DeleteSelectionCommand.h:
+
+2009-05-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Simplified null-ish JSValues.
+        
+        Replaced calls to noValue() with calls to JSValue() (which is what
+        noValue() returned). Removed noValue().
+        
+        Removed "JSValue()" initialiazers, since default construction happens...
+        by default.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::setDOMException):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::evaluate):
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        (WebCore::JSSQLResultSetRowList::item):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/js/ScriptValue.h:
+        (WebCore::ScriptValue::ScriptValue):
+        (WebCore::ScriptValue::hasNoValue):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        * bridge/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bridge/jni/jni_runtime.cpp:
+        (JavaField::dispatchValueFromInstance):
+        (JavaField::dispatchSetValueToInstance):
+        * bridge/runtime.h:
+        (JSC::Bindings::Instance::invokeConstruct):
+
+2009-05-02  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6631735> Crash in WebCore::CSSStyleSelector::applyProperty(int, WebCore::CSSValue*) (RenderStyle.h:454)
+        
+        Avoid re-entering style selector from load delegates by not issuing resource loads synchronously during attach().
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::suspendPostAttachCallbacks):
+        (WebCore::ContainerNode::resumePostAttachCallbacks):
+        (WebCore::ContainerNode::attach):
+        * dom/Element.cpp:
+        (WebCore::Element::attach):
+        * loader/loader.cpp:
+        (WebCore::Loader::Loader):
+        (WebCore::Loader::servePendingRequests):
+        (WebCore::Loader::suspendPendingRequests):
+        (WebCore::Loader::resumePendingRequests):
+        (WebCore::Loader::Host::servePendingRequests):
+        * loader/loader.h:
+        (WebCore::Loader::isSuspendingPendingRequests):
+
+2009-05-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 25352: REGRESSION(r42322): style isn't applied at bmwusa.com
+        https://bugs.webkit.org/show_bug.cgi?id=25352
+        rdar://problem/6823239
+
+        Test: http/tests/mime/standard-mode-loads-stylesheet-with-text-css-and-invalid-type.html
+
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::extractMIMETypeFromMediaType): Allow comma as a separator.
+
+2009-05-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Bug 25491: WebFrame leak when a subframe removes itself
+        https://bugs.webkit.org/show_bug.cgi?id=25491
+        rdar://problem/6833859
+
+        Test: fast/loading/subframe-removes-itself.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame): When isStopping is true,
+        treat load as complete, even if isLoadingInAPISense is still returning true.
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Roll out JavaScriptCore API number marshaling.
+
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::isEqual):
+        * inspector/JavaScriptProfile.cpp:
+        (WebCore::getHeadCallback):
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::getChildren):
+        (WebCore::getParent):
+        (WebCore::getHead):
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Fix build.
+
+        * workers/WorkerContext.idl:
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Cleanup workers code a bit.
+
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSWorkerContextBase.h:
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::customGetOwnPropertySlot):
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::toWorkerContext):
+        (WebCore::WorkerContext::self):
+        (WebCore::WorkerContext::setOnmessage):
+        (WebCore::WorkerContext::onmessage):
+        * workers/WorkerContext.idl:
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        A little clean up.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::createJavaAppletWidget):
+
+2009-05-01  Sam Weinig  <sam@webkit.org>
+
+        Fix the build.
+
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::isEqual):
+        * inspector/JavaScriptProfile.cpp:
+        (WebCore::getHeadCallback):
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::getChildren):
+        (WebCore::getParent):
+        (WebCore::getHead):
+
+2009-05-01  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Oliver Hunt and Sam "Jon 'The Belly' Honeycutt" Weinig
+
+        Fix <rdar://problem/6848867> Addition of DOCTYPE node breaks Tiger Mail
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLDocument firstChild]): Add a Tiger Mail version of this method that skips DOCTYPE nodes.
+
+2009-05-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber Stamped by Sam Weinig.
+        
+        Renamed JSValuePtr => JSValue.
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::setValue):
+        * bindings/js/JSCDATASectionCustom.cpp:
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSCSSRuleCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::JSCSSStyleDeclaration::nameGetter):
+        (WebCore::JSCSSStyleDeclaration::customPut):
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::toJS):
+        (WebCore::toHTMLCanvasStyle):
+        (WebCore::JSCanvasRenderingContext2D::strokeStyle):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeStyle):
+        (WebCore::JSCanvasRenderingContext2D::fillStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillColor):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
+        (WebCore::JSCanvasRenderingContext2D::strokeRect):
+        (WebCore::JSCanvasRenderingContext2D::drawImage):
+        (WebCore::JSCanvasRenderingContext2D::drawImageFromRect):
+        (WebCore::JSCanvasRenderingContext2D::setShadow):
+        (WebCore::JSCanvasRenderingContext2D::createPattern):
+        (WebCore::JSCanvasRenderingContext2D::putImageData):
+        (WebCore::JSCanvasRenderingContext2D::fillText):
+        (WebCore::JSCanvasRenderingContext2D::strokeText):
+        * bindings/js/JSClipboardCustom.cpp:
+        (WebCore::JSClipboard::types):
+        (WebCore::JSClipboard::clearData):
+        (WebCore::JSClipboard::getData):
+        (WebCore::JSClipboard::setData):
+        (WebCore::JSClipboard::setDragImage):
+        * bindings/js/JSConsoleCustom.cpp:
+        (WebCore::JSConsole::profiles):
+        * bindings/js/JSCoordinatesCustom.cpp:
+        (WebCore::JSCoordinates::altitude):
+        (WebCore::JSCoordinates::altitudeAccuracy):
+        (WebCore::JSCoordinates::heading):
+        (WebCore::JSCoordinates::speed):
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        (WebCore::toVoidCallback):
+        * bindings/js/JSCustomVoidCallback.h:
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::create):
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSCustomXPathNSResolver.h:
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::hasItem):
+        (WebCore::JSDOMApplicationCache::add):
+        (WebCore::JSDOMApplicationCache::remove):
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::jsStringOrNull):
+        (WebCore::jsOwnedStringOrNull):
+        (WebCore::jsStringOrUndefined):
+        (WebCore::jsStringOrFalse):
+        (WebCore::valueToStringWithNullCheck):
+        (WebCore::valueToStringWithUndefinedOrNullCheck):
+        (WebCore::reportException):
+        (WebCore::reportCurrentException):
+        (WebCore::setDOMException):
+        (WebCore::objectToStringFunctionGetter):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::getDOMObjectWrapper):
+        (WebCore::getDOMNodeWrapper):
+        (WebCore::toJS):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::findJSEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSEventListener):
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMStringListCustom.cpp:
+        (WebCore::JSDOMStringList::getByIndex):
+        (WebCore::JSDOMStringList::item):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::childFrameGetter):
+        (WebCore::JSDOMWindowBase::indexGetter):
+        (WebCore::JSDOMWindowBase::namedItemGetter):
+        (WebCore::JSDOMWindowBase::getOwnPropertySlot):
+        (WebCore::JSDOMWindowBase::put):
+        (WebCore::JSDOMWindowBase::setReturnValueSlot):
+        (WebCore::toJS):
+        (WebCore::toJSDOMWindow):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::lookupGetter):
+        (WebCore::JSDOMWindow::lookupSetter):
+        (WebCore::JSDOMWindow::history):
+        (WebCore::JSDOMWindow::location):
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::JSDOMWindow::crypto):
+        (WebCore::JSDOMWindow::event):
+        (WebCore::JSDOMWindow::image):
+        (WebCore::JSDOMWindow::option):
+        (WebCore::JSDOMWindow::audio):
+        (WebCore::JSDOMWindow::webKitPoint):
+        (WebCore::JSDOMWindow::webKitCSSMatrix):
+        (WebCore::JSDOMWindow::xmlHttpRequest):
+        (WebCore::JSDOMWindow::xsltProcessor):
+        (WebCore::JSDOMWindow::messageChannel):
+        (WebCore::JSDOMWindow::worker):
+        (WebCore::createWindow):
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        (WebCore::JSDOMWindow::postMessage):
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        (WebCore::JSDOMWindow::atob):
+        (WebCore::JSDOMWindow::btoa):
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        (WebCore::toDOMWindow):
+        * bindings/js/JSDOMWindowCustom.h:
+        (WebCore::nonCachingStaticFunctionGetter):
+        (WebCore::JSDOMWindow::customPut):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::put):
+        (WebCore::JSDOMWindowShell::putWithAttributes):
+        (WebCore::JSDOMWindowShell::lookupGetter):
+        (WebCore::JSDOMWindowShell::lookupSetter):
+        (WebCore::toJS):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSDatabaseCustom.cpp:
+        (WebCore::JSDatabase::changeVersion):
+        (WebCore::JSDatabase::transaction):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::location):
+        (WebCore::JSDocument::setLocation):
+        (WebCore::toJS):
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::JSElement::setAttribute):
+        (WebCore::JSElement::setAttributeNode):
+        (WebCore::JSElement::setAttributeNS):
+        (WebCore::JSElement::setAttributeNodeNS):
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::JSEvent::clipboardData):
+        (WebCore::toJS):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        (WebCore::toEventTarget):
+        * bindings/js/JSEventTarget.h:
+        * bindings/js/JSEventTargetBase.h:
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionOptions):
+        (WebCore::JSGeolocation::getCurrentPosition):
+        (WebCore::JSGeolocation::watchPosition):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSHTMLAppletElementCustom.cpp:
+        (WebCore::JSHTMLAppletElement::customPut):
+        (WebCore::JSHTMLAppletElement::nameGetter):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLCollection::nameGetter):
+        (WebCore::JSHTMLCollection::item):
+        (WebCore::JSHTMLCollection::namedItem):
+        (WebCore::toJS):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::nameGetter):
+        (WebCore::JSHTMLDocument::all):
+        (WebCore::JSHTMLDocument::setAll):
+        (WebCore::JSHTMLDocument::open):
+        (WebCore::JSHTMLDocument::write):
+        (WebCore::JSHTMLDocument::writeln):
+        * bindings/js/JSHTMLEmbedElementCustom.cpp:
+        (WebCore::JSHTMLEmbedElement::customPut):
+        (WebCore::JSHTMLEmbedElement::nameGetter):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter):
+        (WebCore::JSHTMLFormElement::submit):
+        * bindings/js/JSHTMLFrameElementCustom.cpp:
+        (WebCore::JSHTMLFrameElement::setSrc):
+        (WebCore::JSHTMLFrameElement::setLocation):
+        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
+        (WebCore::JSHTMLFrameSetElement::nameGetter):
+        * bindings/js/JSHTMLIFrameElementCustom.cpp:
+        (WebCore::JSHTMLIFrameElement::setSrc):
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        (WebCore::JSHTMLInputElement::selectionStart):
+        (WebCore::JSHTMLInputElement::setSelectionStart):
+        (WebCore::JSHTMLInputElement::selectionEnd):
+        (WebCore::JSHTMLInputElement::setSelectionEnd):
+        (WebCore::JSHTMLInputElement::setSelectionRange):
+        * bindings/js/JSHTMLObjectElementCustom.cpp:
+        (WebCore::JSHTMLObjectElement::customPut):
+        (WebCore::JSHTMLObjectElement::nameGetter):
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::JSHTMLOptionsCollection::length):
+        (WebCore::JSHTMLOptionsCollection::setLength):
+        (WebCore::JSHTMLOptionsCollection::indexSetter):
+        (WebCore::JSHTMLOptionsCollection::add):
+        (WebCore::JSHTMLOptionsCollection::remove):
+        * bindings/js/JSHTMLSelectElementCustom.cpp:
+        (WebCore::JSHTMLSelectElement::remove):
+        (WebCore::selectIndexSetter):
+        (WebCore::JSHTMLSelectElement::indexSetter):
+        * bindings/js/JSHTMLSelectElementCustom.h:
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::nonCachingStaticBackFunctionGetter):
+        (WebCore::nonCachingStaticForwardFunctionGetter):
+        (WebCore::nonCachingStaticGoFunctionGetter):
+        (WebCore::JSHistory::customPut):
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::wrap):
+        (WebCore::JSInspectedObjectWrapper::prepareIncomingValue):
+        * bindings/js/JSInspectedObjectWrapper.h:
+        (WebCore::JSInspectedObjectWrapper::wrapOutgoingValue):
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::wrap):
+        (WebCore::JSInspectorCallbackWrapper::prepareIncomingValue):
+        * bindings/js/JSInspectorCallbackWrapper.h:
+        (WebCore::JSInspectorCallbackWrapper::wrapOutgoingValue):
+        * bindings/js/JSInspectorControllerCustom.cpp:
+        (WebCore::JSInspectorController::highlightDOMNode):
+        (WebCore::JSInspectorController::addResourceSourceToFrame):
+        (WebCore::JSInspectorController::addSourceToFrame):
+        (WebCore::JSInspectorController::getResourceDocumentNode):
+        (WebCore::JSInspectorController::search):
+        (WebCore::JSInspectorController::databaseTableNames):
+        (WebCore::JSInspectorController::inspectedWindow):
+        (WebCore::JSInspectorController::setting):
+        (WebCore::JSInspectorController::setSetting):
+        (WebCore::JSInspectorController::wrapCallback):
+        (WebCore::JSInspectorController::currentCallFrame):
+        (WebCore::JSInspectorController::profiles):
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::evaluate):
+        (WebCore::JSJavaScriptCallFrame::thisObject):
+        (WebCore::JSJavaScriptCallFrame::type):
+        (WebCore::JSJavaScriptCallFrame::scopeChain):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::nonCachingStaticReplaceFunctionGetter):
+        (WebCore::nonCachingStaticReloadFunctionGetter):
+        (WebCore::nonCachingStaticAssignFunctionGetter):
+        (WebCore::JSLocation::customPut):
+        (WebCore::JSLocation::setHref):
+        (WebCore::JSLocation::setProtocol):
+        (WebCore::JSLocation::setHost):
+        (WebCore::JSLocation::setHostname):
+        (WebCore::JSLocation::setPort):
+        (WebCore::JSLocation::setPathname):
+        (WebCore::JSLocation::setSearch):
+        (WebCore::JSLocation::setHash):
+        (WebCore::JSLocation::replace):
+        (WebCore::JSLocation::reload):
+        (WebCore::JSLocation::assign):
+        (WebCore::JSLocation::toString):
+        (WebCore::JSLocationPrototype::customPut):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::startConversation):
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSMimeTypeArrayCustom.cpp:
+        (WebCore::JSMimeTypeArray::nameGetter):
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::nameGetter):
+        * bindings/js/JSNamedNodesCollection.cpp:
+        (WebCore::JSNamedNodesCollection::lengthGetter):
+        (WebCore::JSNamedNodesCollection::indexGetter):
+        * bindings/js/JSNamedNodesCollection.h:
+        (WebCore::JSNamedNodesCollection::createStructure):
+        * bindings/js/JSNavigatorCustom.cpp:
+        (WebCore::needsYouTubeQuirk):
+        (WebCore::JSNavigator::appVersion):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::insertBefore):
+        (WebCore::JSNode::replaceChild):
+        (WebCore::JSNode::removeChild):
+        (WebCore::JSNode::appendChild):
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        (WebCore::createWrapper):
+        (WebCore::toJSNewlyCreated):
+        (WebCore::toJS):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::JSNodeFilterCondition):
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSNodeFilterCondition.h:
+        (WebCore::JSNodeFilterCondition::create):
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::JSNodeFilter::acceptNode):
+        (WebCore::toNodeFilter):
+        * bindings/js/JSNodeIteratorCustom.cpp:
+        (WebCore::JSNodeIterator::nextNode):
+        (WebCore::JSNodeIterator::previousNode):
+        * bindings/js/JSNodeListCustom.cpp:
+        (WebCore::callNodeList):
+        (WebCore::JSNodeList::nameGetter):
+        * bindings/js/JSPluginArrayCustom.cpp:
+        (WebCore::JSPluginArray::nameGetter):
+        * bindings/js/JSPluginCustom.cpp:
+        (WebCore::JSPlugin::nameGetter):
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::runtimeObjectGetter):
+        (WebCore::runtimeObjectPropertyGetter):
+        (WebCore::runtimeObjectCustomPut):
+        (WebCore::callPlugin):
+        * bindings/js/JSPluginElementFunctions.h:
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::asWrapper):
+        (WebCore::JSQuarantinedObjectWrapper::cachedValueGetter):
+        (WebCore::JSQuarantinedObjectWrapper::transferExceptionToExecState):
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertySlot):
+        (WebCore::JSQuarantinedObjectWrapper::put):
+        (WebCore::JSQuarantinedObjectWrapper::construct):
+        (WebCore::JSQuarantinedObjectWrapper::hasInstance):
+        (WebCore::JSQuarantinedObjectWrapper::call):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/js/JSRGBColor.cpp:
+        (WebCore::getJSRGBColor):
+        (jsRGBColorRed):
+        (jsRGBColorGreen):
+        (jsRGBColorBlue):
+        * bindings/js/JSRGBColor.h:
+        (WebCore::JSRGBColor::createStructure):
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        (WebCore::JSSQLResultSetRowList::item):
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        (WebCore::JSSQLTransaction::executeSql):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        (WebCore::toJS):
+        * bindings/js/JSSVGLengthCustom.cpp:
+        (WebCore::JSSVGLength::value):
+        (WebCore::JSSVGLength::convertToSpecifiedUnits):
+        * bindings/js/JSSVGMatrixCustom.cpp:
+        (WebCore::JSSVGMatrix::inverse):
+        (WebCore::JSSVGMatrix::rotateFromVector):
+        * bindings/js/JSSVGPathSegCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSSVGPathSegListCustom.cpp:
+        (WebCore::JSSVGPathSegList::clear):
+        (WebCore::JSSVGPathSegList::initialize):
+        (WebCore::JSSVGPathSegList::getItem):
+        (WebCore::JSSVGPathSegList::insertItemBefore):
+        (WebCore::JSSVGPathSegList::replaceItem):
+        (WebCore::JSSVGPathSegList::removeItem):
+        (WebCore::JSSVGPathSegList::appendItem):
+        * bindings/js/JSSVGPointListCustom.cpp:
+        (WebCore::finishGetter):
+        (WebCore::finishSetter):
+        (WebCore::finishSetterReadOnlyResult):
+        (WebCore::JSSVGPointList::clear):
+        (WebCore::JSSVGPointList::initialize):
+        (WebCore::JSSVGPointList::getItem):
+        (WebCore::JSSVGPointList::insertItemBefore):
+        (WebCore::JSSVGPointList::replaceItem):
+        (WebCore::JSSVGPointList::removeItem):
+        (WebCore::JSSVGPointList::appendItem):
+        * bindings/js/JSSVGTransformListCustom.cpp:
+        (WebCore::finishGetter):
+        (WebCore::finishSetter):
+        (WebCore::finishSetterReadOnlyResult):
+        (WebCore::JSSVGTransformList::clear):
+        (WebCore::JSSVGTransformList::initialize):
+        (WebCore::JSSVGTransformList::getItem):
+        (WebCore::JSSVGTransformList::insertItemBefore):
+        (WebCore::JSSVGTransformList::replaceItem):
+        (WebCore::JSSVGTransformList::removeItem):
+        (WebCore::JSSVGTransformList::appendItem):
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::nameGetter):
+        (WebCore::JSStorage::deleteProperty):
+        (WebCore::JSStorage::customPut):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSStyleSheetListCustom.cpp:
+        (WebCore::JSStyleSheetList::nameGetter):
+        * bindings/js/JSTextCustom.cpp:
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSTreeWalkerCustom.cpp:
+        (WebCore::JSTreeWalker::parentNode):
+        (WebCore::JSTreeWalker::firstChild):
+        (WebCore::JSTreeWalker::lastChild):
+        (WebCore::JSTreeWalker::nextSibling):
+        (WebCore::JSTreeWalker::previousSibling):
+        (WebCore::JSTreeWalker::previousNode):
+        (WebCore::JSTreeWalker::nextNode):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::self):
+        (WebCore::JSWorkerContext::setSelf):
+        (WebCore::JSWorkerContext::xmlHttpRequest):
+        (WebCore::JSWorkerContext::importScripts):
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        (WebCore::JSWorkerContext::setTimeout):
+        (WebCore::JSWorkerContext::setInterval):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::addEventListener):
+        (WebCore::JSWorker::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::open):
+        (WebCore::JSXMLHttpRequest::setRequestHeader):
+        (WebCore::JSXMLHttpRequest::send):
+        (WebCore::JSXMLHttpRequest::getResponseHeader):
+        (WebCore::JSXMLHttpRequest::overrideMimeType):
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        (WebCore::JSXMLHttpRequest::responseText):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/JSXSLTProcessorCustom.cpp:
+        (WebCore::JSXSLTProcessor::importStylesheet):
+        (WebCore::JSXSLTProcessor::transformToFragment):
+        (WebCore::JSXSLTProcessor::transformToDocument):
+        (WebCore::JSXSLTProcessor::setParameter):
+        (WebCore::JSXSLTProcessor::getParameter):
+        (WebCore::JSXSLTProcessor::removeParameter):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create):
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScheduledAction.h:
+        * bindings/js/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        (WebCore::ScriptCallStack::initialize):
+        * bindings/js/ScriptCallStack.h:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument):
+        (WebCore::ScriptFunctionCall::call):
+        (WebCore::ScriptFunctionCall::construct):
+        * bindings/js/ScriptFunctionCall.h:
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::get):
+        * bindings/js/ScriptValue.h:
+        (WebCore::ScriptValue::ScriptValue):
+        (WebCore::ScriptValue::jsValue):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject webScriptValueAtIndex:]):
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bindings/objc/WebScriptObjectPrivate.h:
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_GetProperty):
+        (_NPN_HasMethod):
+        (_NPN_Construct):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::invokeMethod):
+        (JSC::Bindings::CInstance::invokeDefaultMethod):
+        (JSC::Bindings::CInstance::invokeConstruct):
+        (JSC::Bindings::CInstance::defaultValue):
+        (JSC::Bindings::CInstance::stringValue):
+        (JSC::Bindings::CInstance::numberValue):
+        (JSC::Bindings::CInstance::booleanValue):
+        (JSC::Bindings::CInstance::valueOf):
+        * bridge/c/c_instance.h:
+        * bridge/c/c_runtime.cpp:
+        (JSC::Bindings::CField::valueFromInstance):
+        (JSC::Bindings::CField::setValueToInstance):
+        * bridge/c/c_runtime.h:
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertValueToNPVariant):
+        (JSC::Bindings::convertNPVariantToValue):
+        * bridge/c/c_utility.h:
+        * bridge/jni/jni_instance.cpp:
+        (JavaInstance::stringValue):
+        (JavaInstance::numberValue):
+        (JavaInstance::booleanValue):
+        (JavaInstance::invokeMethod):
+        (JavaInstance::defaultValue):
+        (JavaInstance::valueOf):
+        * bridge/jni/jni_instance.h:
+        * bridge/jni/jni_jsobject.h:
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        (JavaJSObject::getMember):
+        (JavaJSObject::getSlot):
+        (JavaJSObject::convertValueToJObject):
+        (JavaJSObject::convertJObjectToValue):
+        * bridge/jni/jni_objc.mm:
+        (JSC::Bindings::dispatchJNICall):
+        * bridge/jni/jni_runtime.cpp:
+        (JavaArray::convertJObjectToArray):
+        (JavaField::dispatchValueFromInstance):
+        (JavaField::valueFromInstance):
+        (JavaField::dispatchSetValueToInstance):
+        (JavaField::setValueToInstance):
+        (JavaArray::setValueAt):
+        (JavaArray::valueAt):
+        * bridge/jni/jni_runtime.h:
+        * bridge/jni/jni_utility.cpp:
+        (JSC::Bindings::convertArrayInstanceToJavaArray):
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jni/jni_utility.h:
+        * bridge/objc/WebScriptObject.h:
+        * bridge/objc/objc_class.h:
+        * bridge/objc/objc_class.mm:
+        (JSC::Bindings::ObjcClass::fallbackObject):
+        * bridge/objc/objc_instance.h:
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::invokeMethod):
+        (ObjcInstance::invokeDefaultMethod):
+        (ObjcInstance::setValueOfUndefinedField):
+        (ObjcInstance::getValueOfUndefinedField):
+        (ObjcInstance::defaultValue):
+        (ObjcInstance::stringValue):
+        (ObjcInstance::numberValue):
+        (ObjcInstance::booleanValue):
+        (ObjcInstance::valueOf):
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcField::valueFromInstance):
+        (JSC::Bindings::convertValueToObjcObject):
+        (JSC::Bindings::ObjcField::setValueToInstance):
+        (JSC::Bindings::ObjcArray::setValueAt):
+        (JSC::Bindings::ObjcArray::valueAt):
+        (JSC::Bindings::ObjcFallbackObjectImp::put):
+        (JSC::Bindings::callObjCFallbackObject):
+        (JSC::Bindings::ObjcFallbackObjectImp::defaultValue):
+        * bridge/objc/objc_utility.h:
+        * bridge/objc/objc_utility.mm:
+        (JSC::Bindings::convertValueToObjcValue):
+        (JSC::Bindings::convertNSStringToString):
+        (JSC::Bindings::convertObjcValueToValue):
+        * bridge/runtime.h:
+        (JSC::Bindings::Class::fallbackObject):
+        (JSC::Bindings::Instance::setValueOfUndefinedField):
+        (JSC::Bindings::Instance::invokeDefaultMethod):
+        (JSC::Bindings::Instance::invokeConstruct):
+        (JSC::Bindings::Instance::put):
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::lengthGetter):
+        (JSC::RuntimeArray::indexGetter):
+        (JSC::RuntimeArray::put):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::lengthGetter):
+        (JSC::callRuntimeMethod):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::fallbackObjectGetter):
+        (JSC::RuntimeObjectImp::fieldGetter):
+        (JSC::RuntimeObjectImp::methodGetter):
+        (JSC::RuntimeObjectImp::put):
+        (JSC::RuntimeObjectImp::defaultValue):
+        (JSC::callRuntimeObject):
+        (JSC::callRuntimeConstructor):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+        * inspector/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+        * inspector/JavaScriptCallFrame.h:
+        * inspector/JavaScriptProfile.cpp:
+        (WebCore::toJS):
+        * inspector/JavaScriptProfile.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::toJS):
+        * inspector/JavaScriptProfileNode.h:
+
+2009-05-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25485
+        Only use visitedURL in Qt. This is a follow-up change to http://trac.webkit.org/changeset/43052,
+        which broke Chromium build.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkPseudoState): Moved guards around to
+            provide separate code paths for Qt and non-Qt ports. Also restored original
+            order of execution.
+
+2009-05-01  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/6839222>
+        CrashTracer: Lots of crashes in Safari in hash table remove function inside DocumentLoader::removeSubresourceLoader
+        
+        After calling m_client->didFail(), check if the subresource loader has reached its terminal state. If that's the case,
+        return early to avoid calling removeSubresourceLoader on a null document loader. I don't think this is allowed to happen
+        which is why I've added the ASSERT.
+        
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::didCancel):
+
+2009-05-01  Timothy Hatcher  <timothy@apple.com>
+
+        Disallow the deletion UI for elements that have any overflow clipping.
+        Also disallow the UI for the body element it isn't practical to delete,
+        and the deletion UI would be clipped.
+
+        <rdar://problem/6840161> Deletion UI can be clipped by some
+        elements (with overflow: hidden)
+
+        Reviewed by Darin Adler.
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+
+2009-05-01  Timothy Hatcher  <timothy@apple.com>
+
+        Decrease the minimum height for deleteable elements to 16px, and increase the
+        minimum width to 48px. This allows deleting shorter items like navigation bars.
+
+        <rdar://problem/6840735> Deletion UI does not show up for short
+        elements (22px or less)
+
+        Reviewed by Adele Peterson.
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+
+2009-05-01  Timothy Hatcher  <timothy@apple.com>
+
+        Clean up the comments and logic in the code for picking a
+        deleteable element for the deletion UI.
+
+        Reviewed by Adele Peterson.
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+
+2009-05-01  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Adele Peterson and Darin Adler.
+
+        <rdar://problem/4815598> Stuck in double spacing mode after pasting a
+        paragraph with padding/margin (or table mode !)
+
+        A lot of the issues in this bug were resolved on Mail's side by using
+        WebKit to convert to plain text.  This is the final issue, that floating
+        style stays on copied nodes causing them to float when they are pasted
+        which is not what the user intended.
+
+        * editing/markup.cpp:
+        (WebCore::removeExteriorStyles):
+        (WebCore::):
+        (WebCore::appendStartMarkup):
+        (WebCore::getStartMarkup):
+        (WebCore::createMarkup):
+
+2009-05-01  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Add a FrameLoaderClient callback for the ResourceRetrievedByXMLHttpRequest.
+        This is the only resource-related information that is available in InspectorController
+        and is missing in the FrameLoaderClient.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25347
+
+        * WebCore.xcodeproj/project.pbxproj: Made ScriptSource private.
+        * dom/Document.cpp: Made a call to a client along with the call to the InspectorController.
+        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        * loader/EmptyClients.h: Added stub implementation.
+        (WebCore::EmptyFrameLoaderClient::dispatchDidLoadResourceByXMLHttpRequest):
+        * loader/FrameLoader.cpp: Call initiating dispatches.
+        (WebCore::FrameLoader::resourceRetrievedByXMLHttpRequest):
+        * loader/FrameLoader.h:
+        * loader/FrameLoaderClient.h:
+
+2009-04-30  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for <rdar://problem/6841106> REGRESSION: Crash drag selecting 
+        To Do's in a Mail note (excessive recursion in mouse drag tracking)
+
+        Oliver's recent change to dragging seems to have revealed a long-
+        time bug in passSubframeEventToSubframe where we did not set 
+        m_sendingEventToSubview to true before calling 
+        handleMouseMoveEvent() in the NSMouseMoved case. This patch fixes 
+        that and adds ASSERTions around all of the places where 
+        m_sendingEventToSubview is set to true and then false to make sure 
+        we are not trampling its state.
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::eventLoopHandleMouseDragged):
+        (WebCore::EventHandler::eventLoopHandleMouseUp):
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+        (WebCore::EventHandler::passWheelEventToWidget):
+
+2009-04-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+        
+        MediaDocument falls back to plug-in unnecessarily
+        https://bugs.webkit.org/show_bug.cgi?id=25504
+        <rdar://problem/6844702>
+        
+        Don't allow harmless media types to cause a MediaDocument to fall
+        back to PluginDocument.
+
+        Test: media/video-document-types.html
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks): add timecode, timecode 64,
+        odsm, and sdsm to allowed track types.
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::disableUnsupportedTracks): Ditto.
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add CHROMIUM guard to unfork Document.cpp
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode): Added guard.
+
+2009-04-30  David Kilzer  <ddkilzer@apple.com>
+
+        Use OwnPtr<HTMLParserQuirks> for m_parserQuirks
+
+        Reviewed by Geoff Garen.
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::~HTMLParser): Removed unneeded code.
+        * html/HTMLParser.h: Made m_parserQuirks an OwnPtr.
+
+2009-04-30  David Kilzer  <ddkilzer@apple.com>
+
+        Provide a mechanism to create a quirks delegate for HTMLParser
+
+        Reviewed by David Hyatt.
+
+        No tests since there is no change in behavior.
+
+        HTMLParserQuirks.h defines an abstract base class that may be
+        extended as needed.  The ChromeClient::createHTMLParserQuirks()
+        factory method should be used to return an HTMLParserQuirks
+        subclassed object when needed.
+
+        * WebCore.xcodeproj/project.pbxproj: Added HTMLParserQuirks.h.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::HTMLParser): Initialize m_parserQuirks
+        using ChromeClient::createHTMLParserQuirks().
+        (WebCore::HTMLParser::~HTMLParser): Delete m_parserQuirks if
+        set.
+        (WebCore::HTMLParser::reset): Call HTMLParserQuirks::reset() if
+        m_parserQuirks is set.
+        (WebCore::HTMLParser::insertNode): Call
+        HTMLParserQuirks::shouldInsertNode() if m_parserQuirks is set,
+        and return early if it returns false.
+        (WebCore::HTMLParser::popBlock): Call
+        HTMLParserQuirks::shouldPopBlock() if m_parserQuirks is set, and
+        return early if it returns false.
+        * html/HTMLParser.h: Added m_parserQuirks.
+        * html/HTMLParserQuirks.h: Added.
+        (WebCore::HTMLParserQuirks::HTMLParserQuirks):
+        (WebCore::HTMLParserQuirks::~HTMLParserQuirks):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::createHTMLParserQuirks): Added.
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::createHTMLParserQuirks): Added.
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25492
+        Add JSC guards around node wrapper cache calls. These are not used by V8.
+
+        Also, remove JSDOMBinding include, which is brought in by ScriptController.
+
+        * dom/Document.cpp:
+        (WebCore::Document::~Document): Added JSC guard.
+        * dom/Node.cpp:
+        (WebCore::Node::setDocument): Ditto and removed JSDOMBinding include.
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25493
+        Remove debugger/profiler custom method stubs, catching V8 bindings up to
+        http://trac.webkit.org/changeset/43072.
+
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp: Removed method stubs.
+
+2009-04-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/6839338> VoiceOver does not take into account transforms when drawing outlines
+        
+        Use transform-aware quad methods when computing the boundingBoxRect for
+        an AccessibilityRenderObject. The code follows RenderObject::absoluteBoundingBoxRect().
+
+        Test: accessibility/transformed-element.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::boundingBoxRect):
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, Chromium build fix.
+
+        Catch up to ScriptObject changes from http://trac.webkit.org/changeset/42512.
+
+        * bindings/v8/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::get): Renamed from getObject.
+        (WebCore::ScriptGlobalObject::remove): Added.
+        * bindings/v8/ScriptObject.h: Ditto.
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25470
+        Extend the cover of ENABLE_JAVASCRIPT_DEBUGGER to profiler.
+
+        * WebCore.pro: Fix copy-paste error.
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25470
+        Extend the cover of ENABLE_JAVASCRIPT_DEBUGGER to profiler.
+
+        * GNUmakefile.am: Add ENABLE_JAVASCRIPT_DEBUGGER definitions.
+        * WebCore.pro: Ditto.
+
+2009-04-02  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Change Position to pre-compute the AnchorType and store it.
+        Also store a "legacy editing mode" bit on the Position.
+        https://bugs.webkit.org/show_bug.cgi?id=24763
+
+        The old Postion(node, offset) constructor creates legacy positions
+        but there are new constructors to create explicitly anchored positions
+        which the next patch will use.
+
+        Once we fix all the "position-fixup" functions (like rangeCompliantEquivalent) to
+        only affect legacy positions, we will be able to distinguish
+        between [table, 1] and [table, after] in the code correctly!
+
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Position.cpp:
+        (WebCore::Position::Position):
+        (WebCore::Position::moveToPosition):
+        (WebCore::Position::moveToOffset):
+        (WebCore::Position::anchorTypeForLegacyEditingPosition):
+        (WebCore::Position::element):
+        * dom/Position.h:
+        (WebCore::Position::):
+        (WebCore::Position::Position):
+        (WebCore::Position::anchorType):
+        (WebCore::Position::deprecatedEditingOffset):
+
+2009-04-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix bug where the WorkerLocation and WorkerNavigator wrappers would be
+        collected even if the WorkerContext is still alive.
+
+        Test: fast/workers/worker-context-gc.html
+
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::mark):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::WorkerContext):
+        (WebCore::WorkerContext::completeURL):
+        (WebCore::WorkerContext::location):
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::optionalNavigator):
+        (WebCore::WorkerContext::optionalLocation):
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25470
+        Extend the cover of ENABLE_JAVASCRIPT_DEBUGGER to profiler.
+
+        * Configurations/FeatureDefines.xcconfig: Added ENABLE_JAVASCRIPT_DEBUGGER.
+        * WebCore.vcproj/build-generated-files.sh: Ditto.
+        * bindings/js/JSConsoleCustom.cpp: Added ENABLE(JAVASCRIPT_DEBUGGER) guard.
+        * bindings/js/JSDOMWindowBase.cpp: Ditto.
+        * bindings/js/JSInspectorControllerCustom.cpp: Ditto.
+        * inspector/InspectorController.cpp: Moved profiler/debugger methods under
+            ENABLE(JAVASCRIPT_DEBUGGER) flag.
+        * inspector/InspectorController.h: Ditto.
+        * inspector/InspectorController.idl: Added ENABLE(JAVASCRIPT_DEBUGGER) guard.
+        * page/Console.cpp: Replaced USE(JSC) with ENABLE(JAVASCRIPT_DEBUGGER) guard.
+
+2009-04-30  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25275
+        This patch snuck in a re-definition of a local.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER): Removed re-definition.
+
+2009-04-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix a leak introduced yesterday.  Don't allocate a ScheduledAction
+        if the toString()ing throws an exception.
+
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create):
+
+2009-04-30  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25379
+        <rdar://problem/6809460> REGRESSION (r41772): Selecting a bank in American Express Pay Bill fails
+
+        Test: fast/forms/multiple-selected-options-innerHTML.html
+
+        This problem was caused by an inconsistency at when Node::instertedIntoTree() is called.
+        For normal HTML parsing, it is called immediately after an element is inserted, but for
+        innerHTML, it is only called after the whole subtree is inserted into a document.
+
+        It may make sense to harmonize these cases one day, but for now, I only made the minimal
+        changes necessary to fix the bug.
+
+        * html/HTMLSelectElement.cpp: (WebCore::HTMLSelectElement::insertedIntoTree):
+        * html/HTMLSelectElement.h:
+        Recalculate list items when a SELECT element is inserted. OPTION elements cannot decide
+        which one to keep selected themselves, because their logic assumes normal parsing, with
+        insertedIntoTree() called after each element is inserted.
+
+2009-04-30  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25342
+        Add MessageSource and MessageLevel parameters to the ChromeClient::addMessageToConsole.
+
+        Chromium async/out-of-process version of WebInspector is currently not based on
+        InspectorController. The reason was that we did not want to interfere with
+        the unforking effort, yet wanted to experiment. So we came up with these
+        agents concept that basically mimic InspectorController, but separating 'agent'
+        nature from the 'transport'. Now that InspectorController is unforked, I am
+        planning to bring these concepts into the WebKit land and use what we have in
+        Chromium as a proof of concept / experimental playground.
+
+        * loader/EmptyClients.h: added MessageSource and MessageLevel parameters.
+        (WebCore::EmptyChromeClient::addMessageToConsole): ditto
+        * page/ChromeClient.h: ditto
+        * page/Console.cpp: Used new method signature.
+        (WebCore::Console::addMessage): ditto
+
+2009-04-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=25476
+          <rdar://problem/6841919> REGRESSION (r42987): Welcome to Safari 4
+          animation is jittery
+
+        Reverted r42987.
+
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::draw):
+
+2009-04-30  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Maciej Stachowiak
+
+        <rdar://problem/3785248> http://www.greekembassy.org/ gets in an infinite reload loop
+        https://bugs.webkit.org/show_bug.cgi?id=21193
+
+        Some websites use for attributes in script elements to specify events that the script 
+        should be run for.  One example is greekembassy.org which has the following in their <head>:
+
+        <script for=window event=onresize>
+            location.reload(false);
+        </script>
+
+        Since we don't support the full for attribute syntax, we would just blissfully ignore the
+        condition and execute the code unconditionally.  This caused breakage on multiple real-world 
+        sites besides greekembassy.org.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16915 and <rdar://problem/4471751> track adding full 
+        support for the for attribute in scripts.  In the meantime it's best to not execute them
+        unconditionally.
+
+        Test: fast/dom/HTMLScriptElement/script-for-attribute-unexpected-execution.html
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::shouldExecuteAsJavaScript): After all other checks have
+          passed, only return true if there is no for attribute in the script element.
+        * dom/ScriptElement.h:
+
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::forAttributeValue): Return the attribute value, if any.
+        * html/HTMLScriptElement.h:
+
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::forAttributeValue): Return an empty string (like the other
+          attribute getters do for SVGScriptElement)
+        * svg/SVGScriptElement.h:
+
+2009-04-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        The Qt API exposes a global history patch CSSStyleSelector to make API consumers work again
+
+        https://bugs.webkit.org/show_bug.cgi?id=20952
+
+        The QtWebKit port made the mistake of exposing a global history. This broke
+        with the addition of PageGroup and LinkHash. This needs to be repaired
+        for Qt4.5.
+
+        Add a function to LinkHash.cpp that is resolving a URL. Use this
+        function from within CSSStyleSelector to forward the url to the
+        QWebHistoryInterface API.
+
+        It is sad that there is a path within visitedLinkHash which is now
+        doing a memcpy, it is sad to add a PLATFORM(QT) define to CSSStyleSelector
+        and using QtWebKit types within WebCore is a layering violation as well.
+
+        PageGroup::setShouldTrackVisitedLinks is currently not enabled. For
+        Qt4.6 a second version of the QWebHistoryInterface is going to be
+        added which will fix things up.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkPseudoState):
+        * platform/LinkHash.cpp:
+        (WebCore::visitedURL):
+        (WebCore::visitedLinkHash):
+        * platform/LinkHash.h:
+
+2009-04-30  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build.
+
+        * platform/graphics/SimpleFontData.cpp: Don't use initCharWidths() for the Qt build.
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit): Instead initialize the average and
+        max char widths from QFontMetrics.
+
+2009-04-30  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Unreview build fix after r43037.
+
+        Use MarkedArgumentBuffer instead of ArgList.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtConnectionObject::execute):
+
+2009-04-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=25440
+        setTimeout should stringify non-string/non-function first arguments
+
+        Test: fast/dom/Window/setTimeout-string-argument.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::setTimeout):
+        (WebCore::JSWorkerContext::setInterval):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create):
+        * bindings/js/ScheduledAction.h:
+
+2009-04-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - WebCore part of <rdar://problem/6609509> Select All and then Delete
+          should put Mail editing back into the same state as a new message
+
+        Test: editing/deleting/in-visibly-empty-root.html
+
+        * WebCore.base.exp: Exported VisibleSelection::isAll(bool).
+        * editing/SelectionController.h:
+        (WebCore::SelectionController::isAll): Added. Calls through to
+        VisibleSelection.
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::makeEditableRootEmpty): Added. Removes all children
+        of the root editable element the selection is in, other than a
+        placeholder. Returns true iff it did anything.
+        (WebCore::TypingCommand::deleteKeyPressed): When there is only a single
+        visible position in the root editable element, but it has children other
+        than a placeholder, remove those children.
+        * editing/TypingCommand.h:
+        * editing/VisiblePosition.h:
+        Added a StayInEditableContent enum and a FIXME.
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::isAll): Added. Returns whether the
+        selection encompasses all visible positions, either in the document or
+        in the editable root.
+        * editing/VisibleSelection.h:
+
+2009-04-29  Sam Weinig  <sam@webkit.org>
+
+        Fix style nit.
+
+        * editing/visible_units.cpp:
+        (WebCore::getLeafBoxesInLogicalOrder):
+
+2009-04-29  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        For now just drop the deferred layout on the floor, since it causes an infinite hang in mail.  Even
+        trying to schedule a relayout for later leaves you in a state where you hit the needsLayout painting
+        assertions.
+
+        Basically what Mail is doing is crazy, and we can't support it other than to just drop the last layout
+        and not do it (which is basically what was happening before).
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setContentsSize):
+        (WebCore::FrameView::needsLayout):
+
+2009-04-29  Douglas Davidson  <ddavidso@apple.com>
+
+        Reviewed by Justin Garcia.
+
+        <rdar://problem/6836921> Mail exhibits issues with text checking, e.g. menu items not always validated correctly
+        
+        Updates to the text checking code to enable text checking even if spellchecking is turned off 
+        and fix an off-by-one error in selection handling.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markMisspellingsAfterTypingToPosition):
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges):
+        (WebCore::Editor::markMisspellingsAndBadGrammar):
+        * editing/Editor.h:
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::markMisspellingsAfterTyping):
+
+2009-04-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Clean up ArgList to be a trivial type
+
+        Start using MarkedArgumentBuffer to create argument lists for function calls
+
+        * bindings/js/JSClipboardCustom.cpp:
+        (WebCore::JSClipboard::types):
+        * bindings/js/JSConsoleCustom.cpp:
+        (WebCore::JSConsole::profiles):
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::handleEvent):
+        * bindings/js/JSInspectorControllerCustom.cpp:
+        (WebCore::JSInspectorController::profiles):
+        (WebCore::JSInspectorController::search):
+        (WebCore::JSInspectorController::databaseTableNames):
+        (WebCore::JSInspectorController::setting):
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::scopeChain):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::construct):
+        (WebCore::JSQuarantinedObjectWrapper::call):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScriptFunctionCall.h:
+        * bindings/objc/WebScriptObject.mm:
+        (getListFromNSArray):
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        * bridge/NP_jsobject.cpp:
+        (getListFromVariantArgs):
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Construct):
+        * bridge/jni/jni_jsobject.h:
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::getListFromJArray):
+
+2009-04-29  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        Fix m_offset uses added while I wasn't looking.
+
+        * editing/visible_units.cpp:
+        (WebCore::logicalStartPositionForLine):
+        (WebCore::logicalEndPositionForLine):
+
+2009-04-29  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=24168
+        RTL: Home/End key does not behave correctly in mixed bidi text in RTL document
+
+        Test: editing/selection/home-end.html
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modifyExtendingForward): Change calling endOfLine()
+        to logicalEndOfLine() when granularity is LineBoundary.
+        (WebCore::SelectionController::modifyMovingForward): Change calling endOfLine()
+        to logicalEndOfLine() when granularity is LineBoundary
+        (WebCore::SelectionController::modifyExtendingBackward): Change calling 
+        startOfLine() to logicalStartOfLine() when granularity is LineBoundary.
+        (WebCore::SelectionController::modifyMovingBackward): Change calling startOfLine() 
+        to logicalStartOfLine() when granularity is LineBoundary.
+        * editing/visible_units.cpp:
+        (WebCore::getLeafBoxesInLogicalOrder): Added. Reconstruct leaf boxes in logical order.
+        (WebCore::getLogicalStartBoxAndNode): Added.
+        (WebCore::getLogicalEndBoxAndNode): Added.
+        (WebCore::logicalStartPositionForLine): Added. Similar to startPositionForLine.
+        (WebCore::logicalStartOfLine): Added. Similar to startOfLine.
+        (WebCore::logicalEndPositionForLine): Added. Similar to endPositionForLine.
+        (WebCore::inSameLogicalLine): Added.
+        (WebCore::logicalEndOfLine): Added. Similar to endOfLine.
+        * editing/visible_units.h:
+
+2009-04-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Make m_offset private and change all callers to use deprecatedEditingOffset().
+        https://bugs.webkit.org/show_bug.cgi?id=25472
+
+        Per Darin's suggestion, this was just a simple search replace
+        of .m_offset with .deprecatedEditingOffset().
+
+        There was one change in InsertParagraphSeparatorCommand::doApply to use
+        Position::moveToOffset(0) instead of .m_offset = 0;
+
+        * dom/Position.cpp:
+        (WebCore::Position::rendersInDifferentPosition):
+        (WebCore::Position::leadingWhitespacePosition):
+        * dom/Position.h:
+        (WebCore::Position::deprecatedEditingOffset):
+        (WebCore::Position::moveToOffset):
+        (WebCore::operator==):
+        * dom/PositionIterator.h:
+        (WebCore::PositionIterator::PositionIterator):
+        * dom/Range.cpp:
+        (WebCore::Range::create):
+        (WebCore::Range::compareBoundaryPoints):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
+        (WebCore::ApplyStyleCommand::applyInlineStyleToRange):
+        (WebCore::ApplyStyleCommand::removeInlineStyle):
+        (WebCore::ApplyStyleCommand::nodeFullySelected):
+        (WebCore::ApplyStyleCommand::nodeFullyUnselected):
+        (WebCore::ApplyStyleCommand::splitTextAtStartIfNeeded):
+        (WebCore::ApplyStyleCommand::splitTextAtEndIfNeeded):
+        (WebCore::ApplyStyleCommand::splitTextElementAtStartIfNeeded):
+        (WebCore::ApplyStyleCommand::splitTextElementAtEndIfNeeded):
+        (WebCore::ApplyStyleCommand::mergeStartWithPreviousIfIdentical):
+        (WebCore::ApplyStyleCommand::mergeEndWithNextIfIdentical):
+        (WebCore::ApplyStyleCommand::joinChildTextNodes):
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::insertNodeAt):
+        (WebCore::CompositeEditCommand::positionOutsideTabSpan):
+        (WebCore::CompositeEditCommand::rebalanceWhitespaceAt):
+        (WebCore::CompositeEditCommand::prepareWhitespaceAtPositionForSplit):
+        (WebCore::CompositeEditCommand::deleteInsignificantText):
+        (WebCore::CompositeEditCommand::moveParagraphs):
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::updatePositionForNodeRemoval):
+        (WebCore::updatePositionForTextRemoval):
+        (WebCore::DeleteSelectionCommand::handleGeneralDelete):
+        (WebCore::DeleteSelectionCommand::fixupWhitespace):
+        * editing/Editor.cpp:
+        (WebCore::Editor::setComposition):
+        (WebCore::Editor::advanceToNextMisspelling):
+        (WebCore::Editor::getCompositionSelection):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::performTrivialReplace):
+        (WebCore::InsertTextCommand::input):
+        (WebCore::InsertTextCommand::insertTab):
+        * editing/MoveSelectionCommand.cpp:
+        (WebCore::MoveSelectionCommand::doApply):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::debugRenderer):
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::rangeFromLocationAndLength):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::characterAfter):
+        (WebCore::VisiblePosition::debugPosition):
+        (WebCore::makeRange):
+        (WebCore::setStart):
+        (WebCore::setEnd):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::toNormalizedRange):
+        (WebCore::makeSearchRange):
+        (WebCore::VisibleSelection::debugPosition):
+        (WebCore::VisibleSelection::showTreeForThis):
+        * editing/htmlediting.cpp:
+        (WebCore::comparePositions):
+        (WebCore::rangeCompliantEquivalent):
+        * editing/visible_units.cpp:
+        (WebCore::previousBoundary):
+        (WebCore::nextBoundary):
+        (WebCore::startPositionForLine):
+        (WebCore::startOfLine):
+        (WebCore::endPositionForLine):
+        (WebCore::nextLinePosition):
+        (WebCore::startOfParagraph):
+        (WebCore::endOfParagraph):
+        (WebCore::logicalStartPositionForLine):
+        (WebCore::logicalEndPositionForLine):
+        * page/AccessibilityObject.cpp:
+        (WebCore::updateAXLineStartForVisiblePosition):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::indexForVisiblePosition):
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::anchorOffset):
+        (WebCore::DOMSelection::focusOffset):
+        (WebCore::DOMSelection::baseOffset):
+        (WebCore::DOMSelection::extentOffset):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionLayoutChanged):
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (textMarkerForVisiblePosition):
+        (visiblePositionForTextMarker):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::indexForVisiblePosition):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeSelection):
+
+2009-04-29  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out a patch.
+
+        Revert http://trac.webkit.org/changeset/43019
+
+        New tests failed because I removed the tabs from them
+        when landing (since we avoid tabs in WebKit files).
+        I couldn't tell if the new results were correct with
+        spaces or not.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modifyExtendingForward):
+        (WebCore::SelectionController::modifyMovingForward):
+        (WebCore::SelectionController::modifyExtendingBackward):
+        (WebCore::SelectionController::modifyMovingBackward):
+        * editing/visible_units.cpp:
+        * editing/visible_units.h:
+
+2009-04-29  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6828164>, Mail hits the !root->needsLayout() assert because it re-marks the FrameView for layout
+        when the FrameView is resized.  This bug was exposed by the elimination of the separate WebKit layout
+        flag on Mac.  
+        
+        FrameView now defers setNeedsLayouts during size changes.  Once all of the size changes are finished (including re-entrant ones
+        from WebDynamicScrollbarsView and ScrollView::updateScrollbars) we then do a layout if necessary.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::setContentsSize):
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::needsLayout):
+        (WebCore::FrameView::setNeedsLayout):
+        * page/FrameView.h:
+
+2009-04-29  Eric Seidel  <eric@webkit.org>
+
+        No review, rolling out a patch.
+
+        Revert 43020 as it caused accessibility/lists.html to fail
+        and no one is around to tell me if it's a progression or not.
+
+        * page/AccessibilityObject.h:
+        (WebCore::):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::roleValue):
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (RoleEntry::):
+
+2009-04-29  Sankar Aditya Tanguturi  <sankaraditya@gmail.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Add a new accessibility role for list items. Part of
+        http://bugs.webkit.org/show_id.cgi?id=20013
+
+        Tests: platform/win/accessibility/listitem-role.html
+
+        * page/AccessibilityObject.h:
+        (WebCore::):  Add ListItemRole to accessibilityRole enum.
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::roleValue):Return
+        listItemRole when rendered object is a list item.
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute): Return
+        true for ListItemRole, matching firefox.
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (RoleEntry::): Map ListItemRole with NSAccessibilityGroupRole in
+        MAC.
+
+2009-04-29  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=24168
+        RTL: Home/End key does not behave correctly in mixed bidi text in RTL document
+
+        Test: editing/selection/home-end.html
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::modifyExtendingForward): Change calling endOfLine()
+        to logicalEndOfLine() when granularity is LineBoundary.
+        (WebCore::SelectionController::modifyMovingForward): Change calling endOfLine()
+        to logicalEndOfLine() when granularity is LineBoundary
+        (WebCore::SelectionController::modifyExtendingBackward): Change calling 
+        startOfLine() to logicalStartOfLine() when granularity is LineBoundary.
+        (WebCore::SelectionController::modifyMovingBackward): Change calling startOfLine() 
+        to logicalStartOfLine() when granularity is LineBoundary.
+        * editing/visible_units.cpp:
+        (WebCore::getLeafBoxesInLogicalOrder): Added. Reconstruct leaf boxes in logical order.
+        (WebCore::getLogicalStartBoxAndNode): Added.
+        (WebCore::getLogicalEndBoxAndNode): Added.
+        (WebCore::logicalStartPositionForLine): Added. Similar to startPositionForLine.
+        (WebCore::logicalStartOfLine): Added. Similar to startOfLine.
+        (WebCore::logicalEndPositionForLine): Added. Similar to endPositionForLine.
+        (WebCore::inSameLogicalLine): Added.
+        (WebCore::logicalEndOfLine): Added. Similar to endOfLine.
+        * editing/visible_units.h:
+
+2009-04-29  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Eric Seidel.
+
+        Update location while page is loading.
+        https://bugs.webkit.org/show_bug.cgi?id=21597
+
+        Tested by:
+        - fast/dom/location-new-window-no-crash
+        - fast/dom/Window/window-open-pending-url
+
+        * page/Location.cpp:
+
+2009-04-29  Feng Qian  <feng@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add Android port files to WebCore/platform.
+        https://bugs.webkit.org/show_bug.cgi?id=23296
+
+        * platform/android: Added.
+        * platform/android/ClipboardAndroid.cpp: Added.
+        * platform/android/ClipboardAndroid.h: Added.
+
+2009-04-29  Feng Qian  <feng@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add Android-specific files to the WebCore/page directory.
+        https://bugs.webkit.org/show_bug.cgi?id=23295
+
+        * page/android: Added.
+        * page/android/DragControllerAndroid.cpp: Added.
+        * page/android/EventHandlerAndroid.cpp: Added.
+        * page/android/InspectorControllerAndroid.cpp: Added.
+
+2009-04-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Extract PageGroupLoadDeferrer from Chrome.cpp
+
+        * GNUmakefile.am: added PageGroupLoadDeferrer
+        * WebCore.pro: ditto
+        * WebCore.scons: ditto
+        * WebCore.vcproj/WebCore.vcproj: ditto
+        * WebCore.xcodeproj/project.pbxproj: ditto
+        * WebCoreSources.bkl: ditto
+        * page/Chrome.cpp: PageGroupLoadDeferrer impl moved to a separate class.
+        * page/PageGroupLoadDeferrer.cpp: Added.
+        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
+        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
+        * page/PageGroupLoadDeferrer.h: Added.
+
+2009-04-24  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Make textarea and text input metrics more closely match IEs.
+
+        This involves:
+        -set text input width to size*avgCharWidth + maxCharWidth - avgCharWidth
+        -set textarea width to cols*avgCharWidth
+        -Make default CSS match IEs
+        -Correctly initializing m_avgCharWidth and m_maxCharWidth for each platform and SVG.
+
+        Those values for textarea and inputs were derived by doing a ton of manual
+        testing of IE's width values for various textareas and fonts. On Windows we match
+        IE exactly except for a couple fonts of the ~12 tested.
+
+        To get the average and max character width of a font, we do the following
+        for each platform:
+        -Win: TextMetrics expose avgCharWidth and maxCharWidth
+        -SVG: avgCharWidth = width of an '0', fallback on width of a space glyph, then m_xHeight
+            maxCharWidth = width of a 'W' for roman fonts, fallback on m_ascent
+        -Linux: avgCharWidth = width of an '0', fallback on m_xHeight
+            maxCharWidth = max of avgCharWidth and m_ascent
+        -Mac: Calculate the avgCharWidth and grab the maxCharWidth off the font.
+            If either one is non-positive, then calculate the value using the Linux approach.
+
+        Tests: fast/forms/text-control-intrinsic-widths.html
+               fast/forms/textarea-metrics.html
+               svg/custom/svg-fonts-in-text-controls.html
+
+        * css/html4.css:
+        * css/themeWin.css:
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData):
+        (WebCore::SimpleFontData::initCharWidths):
+        * platform/graphics/SimpleFontData.h:
+        (WebCore::SimpleFontData::maxCharWidth):
+        (WebCore::SimpleFontData::avgCharWidth):
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/win/SimpleFontDataCGWin.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+        (WebCore::SimpleFontData::initGDIFont):
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::calcPrefWidths):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::preferredContentWidth):
+
+2009-04-29  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        * bindings/objc/DOMCSS.mm:
+        (kitClass):  Added CSS_INITIAL to the switch statement, and changed to use the WebCore
+          type and not the binding type.
+
+2009-04-29  John Abd-El-Malek  <jam@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Reverted my previous change to add resetChromiumPluginCache().
+        https://bugs.webkit.org/show_bug.cgi?id=25318
+
+        * plugins/chromium/PluginDataChromium.cpp:
+
+2009-04-29  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6573742> - Problem dragging standalone images from Safari to Mail
+
+        Roll out trac.webkit.org/changeset/35867 which fixed <rdar://problem/6153432>
+
+        Cloned <rdar://problem/6153432> to <rdar://problem/6839881> to find a better fix for that Tiger Mail bug.
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::subresource): Remove the preload referenced check.
+
+2009-04-29  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25430
+
+        Provide style sheet for UI controls of media elements for Chromium port.
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::extraMediaControlsStyleSheet):
+
+2009-04-29  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Expose sudden termination to Chromium port.
+        https://bugs.webkit.org/show_bug.cgi?id=25457
+
+        * platform/SuddenTermination.h:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/SuddenTerminationChromium.cpp: Added.
+        (WebCore::disableSuddenTermination):
+        (WebCore::enableSuddenTermination):
+
+2009-04-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Remove unused EventListeners.
+
+        * page/DOMWindow.idl:
+
+2009-04-29  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reveal current execution line once SourceFrame content is loaded. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=25448
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+
+2009-04-29  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Simon Fraser.
+
+        [Qt] Initialize GraphicsContext's and ImageBuffer's QPainter to match
+        the default values of canvas attributes.
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBufferData::ImageBufferData):
+
+2009-04-28  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::findMethodIndex): Removed exec param from at() call.
+        (JSC::Bindings::QtRuntimeConnectionMethod::call): Ditto.
+
+2009-04-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber stamped by Beth Dakin.
+        
+        Missed one.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-04-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber stamped by Beth Dakin.
+        
+        Removed scaffolding supporting dynamically converting between 32bit and
+        64bit value representations. 
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::constructAudio):
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext2D::setFillColor):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
+        (WebCore::JSCanvasRenderingContext2D::strokeRect):
+        (WebCore::JSCanvasRenderingContext2D::drawImage):
+        (WebCore::JSCanvasRenderingContext2D::drawImageFromRect):
+        (WebCore::JSCanvasRenderingContext2D::setShadow):
+        (WebCore::JSCanvasRenderingContext2D::createPattern):
+        (WebCore::JSCanvasRenderingContext2D::putImageData):
+        (WebCore::JSCanvasRenderingContext2D::fillText):
+        (WebCore::JSCanvasRenderingContext2D::strokeText):
+        * bindings/js/JSClipboardCustom.cpp:
+        (WebCore::JSClipboard::clearData):
+        (WebCore::JSClipboard::getData):
+        (WebCore::JSClipboard::setData):
+        (WebCore::JSClipboard::setDragImage):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::hasItem):
+        (WebCore::JSDOMApplicationCache::add):
+        (WebCore::JSDOMApplicationCache::remove):
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMStringListCustom.cpp:
+        (WebCore::JSDOMStringList::item):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        (WebCore::JSDOMWindow::postMessage):
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        (WebCore::JSDOMWindow::atob):
+        (WebCore::JSDOMWindow::btoa):
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSDatabaseCustom.cpp:
+        (WebCore::JSDatabase::changeVersion):
+        (WebCore::JSDatabase::transaction):
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::JSElement::setAttribute):
+        (WebCore::JSElement::setAttributeNode):
+        (WebCore::JSElement::setAttributeNS):
+        (WebCore::JSElement::setAttributeNodeNS):
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::JSGeolocation::getCurrentPosition):
+        (WebCore::JSGeolocation::watchPosition):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLCollection::item):
+        (WebCore::JSHTMLCollection::namedItem):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::documentWrite):
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        (WebCore::JSHTMLInputElement::setSelectionRange):
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::JSHTMLOptionsCollection::add):
+        * bindings/js/JSHTMLSelectElementCustom.cpp:
+        (WebCore::JSHTMLSelectElement::remove):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::constructImage):
+        * bindings/js/JSInspectorControllerCustom.cpp:
+        (WebCore::JSInspectorController::highlightDOMNode):
+        (WebCore::JSInspectorController::addResourceSourceToFrame):
+        (WebCore::JSInspectorController::addSourceToFrame):
+        (WebCore::JSInspectorController::getResourceDocumentNode):
+        (WebCore::JSInspectorController::search):
+        (WebCore::JSInspectorController::databaseTableNames):
+        (WebCore::JSInspectorController::setting):
+        (WebCore::JSInspectorController::setSetting):
+        (WebCore::JSInspectorController::wrapCallback):
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::evaluate):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::replace):
+        (WebCore::JSLocation::assign):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::startConversation):
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::insertBefore):
+        (WebCore::JSNode::replaceChild):
+        (WebCore::JSNode::removeChild):
+        (WebCore::JSNode::appendChild):
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::JSNodeFilter::acceptNode):
+        * bindings/js/JSNodeListCustom.cpp:
+        (WebCore::callNodeList):
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::constructHTMLOptionElement):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::construct):
+        (WebCore::JSQuarantinedObjectWrapper::call):
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        (WebCore::JSSQLResultSetRowList::item):
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        (WebCore::JSSQLTransaction::executeSql):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSSVGLengthCustom.cpp:
+        (WebCore::JSSVGLength::convertToSpecifiedUnits):
+        * bindings/js/JSSVGMatrixCustom.cpp:
+        (WebCore::JSSVGMatrix::rotateFromVector):
+        * bindings/js/JSSVGPathSegListCustom.cpp:
+        (WebCore::JSSVGPathSegList::initialize):
+        (WebCore::JSSVGPathSegList::getItem):
+        (WebCore::JSSVGPathSegList::insertItemBefore):
+        (WebCore::JSSVGPathSegList::replaceItem):
+        (WebCore::JSSVGPathSegList::removeItem):
+        (WebCore::JSSVGPathSegList::appendItem):
+        * bindings/js/JSSVGPointListCustom.cpp:
+        (WebCore::JSSVGPointList::initialize):
+        (WebCore::JSSVGPointList::getItem):
+        (WebCore::JSSVGPointList::insertItemBefore):
+        (WebCore::JSSVGPointList::replaceItem):
+        (WebCore::JSSVGPointList::removeItem):
+        (WebCore::JSSVGPointList::appendItem):
+        * bindings/js/JSSVGTransformListCustom.cpp:
+        (WebCore::JSSVGTransformList::initialize):
+        (WebCore::JSSVGTransformList::getItem):
+        (WebCore::JSSVGTransformList::insertItemBefore):
+        (WebCore::JSSVGTransformList::replaceItem):
+        (WebCore::JSSVGTransformList::removeItem):
+        (WebCore::JSSVGTransformList::appendItem):
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::constructWebKitCSSMatrix):
+        * bindings/js/JSWebKitPointConstructor.cpp:
+        (WebCore::constructWebKitPoint):
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::constructWorker):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::importScripts):
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        (WebCore::JSWorkerContext::setTimeout):
+        (WebCore::JSWorkerContext::setInterval):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::addEventListener):
+        (WebCore::JSWorker::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::open):
+        (WebCore::JSXMLHttpRequest::setRequestHeader):
+        (WebCore::JSXMLHttpRequest::send):
+        (WebCore::JSXMLHttpRequest::getResponseHeader):
+        (WebCore::JSXMLHttpRequest::overrideMimeType):
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/JSXSLTProcessorCustom.cpp:
+        (WebCore::JSXSLTProcessor::importStylesheet):
+        (WebCore::JSXSLTProcessor::transformToFragment):
+        (WebCore::JSXSLTProcessor::transformToDocument):
+        (WebCore::JSXSLTProcessor::setParameter):
+        (WebCore::JSXSLTProcessor::getParameter):
+        (WebCore::JSXSLTProcessor::removeParameter):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create):
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/js/ScheduledAction.h:
+        * bindings/js/ScriptCallFrame.cpp:
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        * bindings/js/ScriptCallFrame.h:
+        * bindings/js/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        (WebCore::ScriptCallStack::initialize):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::invokeMethod):
+        (JSC::Bindings::CInstance::invokeDefaultMethod):
+        (JSC::Bindings::CInstance::invokeConstruct):
+        * bridge/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::invokeMethod):
+        (ObjcInstance::invokeDefaultMethod):
+
+2009-04-28  David Carson  <dacarson@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Restore alignment to device pixel boundaries.
+        https://bugs.webkit.org/show_bug.cgi?id=25458
+
+        Adjust the adjusted destination rect to be device pixel aligned.
+
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::draw):
+
+2009-04-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Move unimplemented captureEvents and releaseEvents from JSDOMWindow
+        to DOMWindow.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::captureEvents):
+        (WebCore::DOMWindow::releaseEvents):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-04-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25420
+        <rdar://problem/6829570> REGRESSION: XMLHttpRequest allows loading from another origin
+
+        Test: http/tests/xmlhttprequest/detaching-frame-2.html
+
+        This was caused by faulty DOMWindow::document(), which could return a new document from
+        the window's frame after navigation.
+
+        * bindings/js/JSDOMWindowCustom.h: (WebCore::JSDOMWindowBase::allowsAccessFromPrivate):
+        Removed an obsolete check that allowed access when document was null. Contrary to what a
+        comment said, that can happen for a window that is no longer in frame, not to one whose
+        document is not constructed yet.
+
+        * bindings/js/JSXMLHttpRequestConstructor.cpp: (WebCore::constructXMLHttpRequest): Bail
+        out if context was not found. This currently happens due to a shortcoming in
+        DOMWindow::document() - when it is fixed, the XMLHttpRequest object in included regression
+        test will be constructed successfully, but won't be sent, because its context will be
+        frameless.
+
+        * page/DOMWindow.cpp: (WebCore::DOMWindow::document): Check that the window in frame hasn't
+        been replaced yet. Added FIXME comments about how this may be better fixed in the future.
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::document):
+        (WebCore::constructAudio):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::document):
+        (WebCore::constructImage):
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::construct):
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::document):
+        (WebCore::constructHTMLOptionElement):
+        Make matching changes to other constructors that hold a reference to global object.
+
+2009-04-28  Kevin Ollivier <kevino@theolliviers.com>
+
+        wxMSW build fix. Switch JSCore build back to static.
+
+        * config.h:
+
+2009-04-28  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6834830>
+
+        Make sure we cover the two possible values reported by event.total that are playback engine
+        specific.
+
+        * media/progress-event-total-expected.txt: Match the new test.
+        * media/progress-event-total.html: Test the two values.
+
+2009-04-28  Timothy Hatcher  <timothy@apple.com>
+
+        Rename -[DOMRange lineBoxRects] to -[DOMRange textRects] and change how it
+        collects the individual rects, making sure to only include RenderText.
+
+        <rdar://problem/6810061>
+
+        Reviewed by Sam Weinig.
+
+        * bindings/objc/DOM.mm:
+        (-[DOMNode textRects]): Added. Make a Range and call textRects.
+        (-[DOMNode lineBoxRects]): Call textRects method.
+        (-[DOMRange textRects]): Call Range::textRects.
+        (-[DOMRange lineBoxRects]): Call textRects method.
+        * bindings/objc/DOMPrivate.h: Add the new methods and a comment
+        about lineBoxRects being deprecated.
+        * dom/Range.cpp:
+        (WebCore::Range::boundingBox): Call textRects (renamed from addLineBoxRects).
+        (WebCore::Range::textRects): Renamed from addLineBoxRects. Iterate over the
+        nodes instead of the RenderObjects to correctly account for offsets. Also
+        only call absoluteRectsForRange on RenderText.
+        * dom/Range.h: Renamed addLineBoxRects to textRects.
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionTextRects): Call textRects (renamed from addLineBoxRects).
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::absoluteRectsForRange): Remove if conditions that made this
+        function very specific for the lineBoxRects API. These functions are still used
+        by the InspectorController, and this change improves what the Inspector shows.
+        (WebCore::RenderObject::absoluteQuadsForRange): Ditto.
+
+2009-04-28  Timothy Hatcher  <timothy@apple.com>
+
+        Remove the topLevel boolean argument from absolute{Rects,Quads}.
+        This argument was default to true and no one ever passed false.
+
+        Reviewed by Sam Weinig.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::absoluteRects):
+        (WebCore::RenderBlock::absoluteQuads):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::absoluteRects):
+        (WebCore::RenderBox::absoluteQuads):
+        * rendering/RenderBox.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::absoluteRects):
+        (WebCore::RenderInline::absoluteQuads):
+        * rendering/RenderInline.h:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::absoluteRects):
+        (WebCore::RenderObject::absoluteQuads):
+        * rendering/RenderSVGHiddenContainer.cpp:
+        (WebCore::RenderSVGHiddenContainer::absoluteRects):
+        (WebCore::RenderSVGHiddenContainer::absoluteQuads):
+        * rendering/RenderSVGHiddenContainer.h:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::absoluteRects):
+        (WebCore::RenderSVGImage::absoluteQuads):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::absoluteRects):
+        (WebCore::RenderSVGInlineText::absoluteQuads):
+        * rendering/RenderSVGInlineText.h:
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::absoluteRects):
+        (WebCore::RenderSVGModelObject::absoluteQuads):
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGTSpan.cpp:
+        (WebCore::RenderSVGTSpan::absoluteRects):
+        (WebCore::RenderSVGTSpan::absoluteQuads):
+        * rendering/RenderSVGTSpan.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::absoluteRects):
+        (WebCore::RenderSVGText::absoluteQuads):
+        * rendering/RenderSVGText.h:
+        * rendering/RenderSVGTextPath.cpp:
+        (WebCore::RenderSVGTextPath::absoluteQuads):
+        * rendering/RenderSVGTextPath.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::absoluteRects):
+        * rendering/RenderText.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::absoluteRects):
+        (WebCore::RenderView::absoluteQuads):
+        * rendering/RenderView.h:
+
+2009-04-28  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6794691> Media documents and <video controls> never show controls on Windows
+
+        RenderThemeWin doesn't implement the media element controller rendering methods, so media
+        controls stopped rendering when we switched from RenderThemeSafari. Rather than having copies
+        of the code in both places, the logic is in a new class that is called from both.
+
+        * WebCore.vcproj/WebCore.vcproj: Add RenderMediaControls.cpp.
+
+        * rendering/RenderMediaControls.cpp: Added.
+        (WebCore::determineState): Translate renderer state to ThemeControlState.
+        (WebCore::RenderMediaControls::adjustMediaSliderThumbSize): Adjust slider thumb.
+        (WebCore::parentMediaElement): Return the HTMLMediaElement parent of a controller element.
+        (WebCore::RenderMediaControls::paintMediaControlsPart): Paint a media controller part.
+        * rendering/RenderMediaControls.h: Added.
+
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::paintSliderTrack): Remove the MediaSliderPart case, it is never
+        called for the media slider.
+        (WebCore::RenderThemeSafari::adjustSliderThumbSize): Call RenderMediaControls function.
+        (WebCore::RenderThemeSafari::paintMediaFullscreenButton): Ditto.
+        (WebCore::RenderThemeSafari::paintMediaMuteButton): Ditto.
+        (WebCore::RenderThemeSafari::paintMediaPlayButton): Ditto.
+        (WebCore::RenderThemeSafari::paintMediaSeekBackButton): Ditto.
+        (WebCore::RenderThemeSafari::paintMediaSeekForwardButton): Ditto.
+        (WebCore::RenderThemeSafari::paintMediaSliderTrack): Ditto.
+        (WebCore::RenderThemeSafari::paintMediaSliderThumb): Ditto.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::adjustSliderThumbSize): Ditto.
+        (WebCore::RenderThemeWin::paintMediaFullscreenButton): Ditto.
+        (WebCore::RenderThemeWin::paintMediaMuteButton): Ditto.
+        (WebCore::RenderThemeWin::paintMediaPlayButton): Ditto.
+        (WebCore::RenderThemeWin::paintMediaSeekBackButton): Ditto.
+        (WebCore::RenderThemeWin::paintMediaSeekForwardButton): Ditto.
+        (WebCore::RenderThemeWin::paintMediaSliderTrack): Ditto.
+        (WebCore::RenderThemeWin::paintMediaSliderThumb): Ditto.
+        * rendering/RenderThemeWin.h:
+
+2009-04-28  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for <rdar://problem/6419515> REGRESSION (r31037): Positioned 
+        images with % height are collapsed when printing
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcHeight): Make sure we don't ignore 
+        printing here!
+
+2009-04-28  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/6617298> Typing delete on an unquoted blank line unquotes the preceding, quoted blank line
+
+        Test: editing/deleting/type-delete-after-quote.html
+
+        When a selection is deleted that contains a whole number paragraphs plus a line break, we refrain from merging paragraphs after the delete,
+        since it is unclear to most users that such a selection actually ends at the start of the next paragraph.  However, when a user hits delete 
+        with a caret selection, they actually do expect the start of that paragraph to be merged into the paragraph before it.  We can tell that 
+        we're in this state because the TypingCommand creates the selection to delete but it doesn't change the endingSelection.  So we can tell
+        that if we started with a caret selection, then we're not in this special case where we have to protect the user from unexpected behavior 
+        from deleting a range they selected.
+
+        * editing/DeleteSelectionCommand.cpp: (WebCore::DeleteSelectionCommand::initializePositionData):
+
+2009-04-28  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed: fix distcheck build, add missing header to file list.
+
+        * GNUmakefile.am:
+
+2009-04-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Fix foreignObject transform order
+        https://bugs.webkit.org/show_bug.cgi?id=25433
+
+        Transforms were being applied in the wrong order.
+        When mapping from local to parent, first apply the viewport transform
+        then map from the viewport box to the parent box.
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::localToParentTransform):
+
+2009-04-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Simplify nodeAtPoint for SVG
+        https://bugs.webkit.org/show_bug.cgi?id=25432
+
+        Added a new nodeAtFloatPoint method which takes a FloatPoint
+        instead of the *super confusing* x/y tx/ty pairs that HTML uses.
+        Mostly this is just lots of minus-lines as the new code is *much* simpler.
+
+        I made all the SVG renderers use the new nodeAtFloatPoint and ASSERT_NOT_REACHED
+        for the nodeAtPoint HTML/CSS int x/y version.
+
+        Eventually the rest of CSS/HTML render objects will follow suit
+        and move to nodeAtFloatPoint (possibly renamed back to nodeAtPoint), but changing them
+        over was well outside the scope of this change.
+
+        SVG hit testing is not actually floating point precise yet, since its still
+        passed in an integer x/y.  Certain transform hit-test edge cases are likely fixed
+        by moving to FloatPoint here, but I didn't try to find one.
+
+        This should not cause functional changes for common-case hit testing, thus
+        no tests changed, nor should new tests be needed.
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::translationForAttributes):
+        (WebCore::RenderForeignObject::paint):
+        (WebCore::RenderForeignObject::computeRectForRepaint):
+        (WebCore::RenderForeignObject::localToParentTransform):
+        (WebCore::RenderForeignObject::layout):
+        (WebCore::RenderForeignObject::nodeAtFloatPoint):
+        * rendering/RenderForeignObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::nodeAtFloatPoint):
+        * rendering/RenderObject.h:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::nodeAtFloatPoint):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::nodeAtFloatPoint):
+        * rendering/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::pointIsInsideViewportClip):
+        * rendering/RenderSVGHiddenContainer.cpp:
+        (WebCore::RenderSVGHiddenContainer::nodeAtFloatPoint):
+        * rendering/RenderSVGHiddenContainer.h:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint):
+        (WebCore::RenderSVGImage::nodeAtFloatPoint):
+        * rendering/RenderSVGImage.h:
+        (WebCore::RenderSVGImage::localToParentTransform):
+        (WebCore::RenderSVGImage::localTransform):
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::nodeAtFloatPoint):
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::nodeAtFloatPoint):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::nodeAtFloatPoint):
+        * rendering/RenderSVGText.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::pointIsInsideViewportClip):
+        * rendering/RenderSVGViewportContainer.h:
+
+2009-04-28  Eric Carlson  <eric.carlson@apple.com>
+
+        - fix the Tiger build
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::cacheMovieScale):
+
+2009-04-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Consolidate ScheduleAction creation into ScheduledAction::create.
+        Autogenerate JSWorkerContext.clearTimeout and clearInterval.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::setTimeout):
+        (WebCore::JSWorkerContext::setInterval):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::create):
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScheduledAction.h:
+        * workers/WorkerContext.cpp:
+        (WebCore::DOMWindow::setTimeout):
+        (WebCore::DOMWindow::clearTimeout):
+        (WebCore::DOMWindow::setInterval):
+        (WebCore::DOMWindow::clearInterval):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+
+2009-04-28  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/6643219> Crashes after moving nodes between documents with Safari 4 Beta installed
+
+        When moving Nodes between documents we weren't properly updating style declarations.  Certain operations, such
+        as creating webarchives, would tickle this bug.
+
+        Tests: webarchive/adopt-attribute-styled-body-webarchive.html
+               webarchive/adopt-attribute-styled-node-webarchive.html
+               webarchive/adopt-inline-styled-node-webarchive.html
+
+        * dom/Node.cpp:  Add a debug-only mechanism to insure that anyone who overrides (did/will)MoveToNewOwnerDocument
+          calls their parent-class implementation after they've done their own work.
+        (WebCore::setWillMoveToNewOwnerDocumentWasCalled): 
+        (WebCore::setDidMoveToNewOwnerDocumentWasCalled):
+        (WebCore::Node::setDocument):
+        (WebCore::Node::willMoveToNewOwnerDocument):
+        (WebCore::Node::didMoveToNewOwnerDocument):
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::attributeChanged): Add a comment explaining why we don't need to walk the nameAttrMap
+          to update style declarations.
+        (WebCore::StyledElement::didMoveToNewOwnerDocument): Update the parent pointer for the inline style declaration.
+        * dom/StyledElement.h:
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::didMoveToNewOwnerDocument): Update the parent pointer for the link declaration.
+        * html/HTMLBodyElement.h:
+
+2009-04-28  Eric Carlson  <eric.carlson@apple.com>
+
+         Reviewed by Darin Adler.
+        
+        <rdar://problem/6834876> Don't use BlockExceptions macros until QTKit supports 
+        QTMoviePreferredTransformAttribute
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::cacheMovieScale): use @try and @catch instead of 
+        BEGIN_BLOCK_OBJC_EXCEPTIONS and END_BLOCK_OBJC_EXCEPTIONS for builds of QTKit 
+        that throw an exception on QTMovieCurrentSizeAttribute but don't support 
+        QTMoviePreferredTransformAttribute
+
+2009-04-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::RenderText): Streamline code path to avoid a bit of reference count
+        churn and remove a strange unneeeded PassRefPtr typecast. Also added a comment.
+        (WebCore::RenderText::setTextInternal): Ditto.
+
+2009-04-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Simplify how SVG containers paint
+        https://bugs.webkit.org/show_bug.cgi?id=25431
+
+        Moved filterBoundingBox() from RenderSVGModelObject to SVGRenderSupport to share with other classes.
+        Gave RenderSVGText a modern clippedOverflowRectForRepaint and computeRectForRepaint.
+        RenderSVGText now applies transforms at paint() time instead of during chunk draw time
+        this should be much more efficient.
+
+        Fixed the order in which RenderSVGViewportContainer applied
+        transforms and clips.  We now clip to the viewport first and apply
+        all transforms at once.  Also since the viewport logic is now only
+        inside RenderSVGViewportContainer (instead of inside RenderSVGContainer)
+        we always know we have a viewport.  We now use only viewportSize instead of
+        viewport() since RenderSVGViewportContainers can't have x/y offsets.
+
+        We now correctly transform the PaintInfo::rect (damage rect) when applying transforms.
+        This allowed us to apply the transform during text paint() instead of at chunk paint
+        time. Previously we had to apply the transform during chunk paint time because
+        RenderBlock (superclass of RenderSVGBlock) would check intersection with the damageRect
+        before telling any of the inlines to draw.  Now that we adjust the damage rect correctly
+        we pass the intersection check correctly!  (This probably fixed some <text> redraw bugs
+        but since I still have a bunch of those to fix, I've not tried to write additional tests
+        to cover these potential fixes yet.)
+
+        SVGRootInlineBox no longer needs to deal with transforms at chunk paint time, yay!
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        (WebCore::RenderPath::paint):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+        (WebCore::RenderSVGContainer::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::applyViewportClip):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::layout):
+        (WebCore::RenderSVGImage::repaintRectInLocalCoordinates):
+        (WebCore::RenderSVGImage::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGImage::computeRectForRepaint):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGModelObject.cpp:
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::layout):
+        (WebCore::RenderSVGRoot::selfWillPaint):
+        (WebCore::RenderSVGRoot::paint):
+        (WebCore::RenderSVGRoot::viewportSize):
+        (WebCore::RenderSVGRoot::calcViewport):
+        (WebCore::RenderSVGRoot::localToBorderBoxTransform):
+        (WebCore::RenderSVGRoot::parentOriginToBorderBox):
+        (WebCore::RenderSVGRoot::borderOriginToContentBox):
+        (WebCore::RenderSVGRoot::localToRepaintContainerTransform):
+        (WebCore::RenderSVGRoot::localToParentTransform):
+        (WebCore::RenderSVGRoot::computeRectForRepaint):
+        (WebCore::RenderSVGRoot::nodeAtPoint):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGText::computeRectForRepaint):
+        (WebCore::RenderSVGText::paint):
+        (WebCore::RenderSVGText::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGText.h:
+        (WebCore::RenderSVGText::localToParentTransform):
+        (WebCore::RenderSVGText::localTransform):
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::applyViewportClip):
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::filterBoundingBoxForRenderer):
+        (WebCore::applyTransformToPaintInfo):
+        * rendering/SVGRenderSupport.h:
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkStartCallback):
+        (WebCore::SVGRootInlineBox::paint):
+
+2009-04-28  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25453: AX: fall back to PLACEHOLDER attr if form element is not labeled
+        https://bugs.webkit.org/show_bug.cgi?id=25453
+
+        Test: accessibility/placeholder.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::title):
+
+2009-04-28  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25452: AX: Don't create addition space AXStaticText element for every bold or link tag
+        https://bugs.webkit.org/show_bug.cgi?id=25452
+
+        Test: accessibility/ignore-spacer-elements.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+
+2009-04-28  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Work around <rdar://problem/6833240> by relying on static initialization to zero the entire struct.
+        This removes the need for us to explicitly initialize all of the members, which have a tendency
+        to change in meaning and number between versions of libxml2.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::):
+        (WebCore::sharedXHTMLEntity):
+        (WebCore::getXHTMLEntity):
+
+2009-04-28  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix linker warning by specifying /NODEFAULTLIB:LIBCMT for QTMovieWin.
+        
+        Reviewed by Mark Rowe.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+
+2009-04-28  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25449: AX: Respect the alt tag of ARIA button as AXDescription
+        https://bugs.webkit.org/show_bug.cgi?id=25449
+
+        Test: accessibility/img-aria-button-alt-tag.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+
+2009-04-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - formatting cleanup
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcHeight): Corrected indentation and added braces
+        around a multi-line "else" clause.
+
+2009-04-28  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adam Roben
+        
+        <rdar://problem/6769968> media/video-size-intrinsic-scale.html fails on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=25094
+        
+        Display movies saved with a non-identity matrix at the correct size.
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWinPrivate::QTMovieWinPrivate): Initialize m_widthScaleFactor and m_heightScaleFactor.
+        (QTMovieWinPrivate::cacheMovieScale): New, calculate difference between initial
+        size and natural size so naturalSize() accounts for non-identity movie matrix.
+        (QTMovieWinPrivate::task):Call cacheMovieScale when load state reaches
+        kMovieLoadStateLoaded for the first time. kMovieLoadState -> QTMovieLoadState.
+        (QTMovieWinPrivate::drawingComplete): kMovieLoadState -> QTMovieLoadState.
+        (QTMovieWinPrivate::createGWorld): Don't bother creating gworld until load state reaches
+        kMovieLoadStateLoaded because we do not try to draw it before that point.
+        (QTMovieWinPrivate::setSize): Do not change movie box before reaching kMovieLoadStateLoaded
+        because we need to get the movie's initial size in cacheMovieScale.
+        (QTMovieWin::getNaturalSize): Multiply width and height by initial scale.
+
+2009-04-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Move timer code from JSDOMWindow to DOMWindow. clearTimeout and
+        clearInterval can now be autogenerated.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createScheduledAction):
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::setTimeout):
+        (WebCore::DOMWindow::clearTimeout):
+        (WebCore::DOMWindow::setInterval):
+        (WebCore::DOMWindow::clearInterval):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-04-28  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Small optimization, don't get the widget's handle twice in one method.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25446
+
+        * platform/wx/WidgetWx.cpp:
+        (WebCore::Widget::setFocus):
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        (WebCore::Widget::frameRect):
+        (WebCore::Widget::setFrameRect):
+        (WebCore::Widget::invalidateRect):
+        (WebCore::Widget::paint):
+
+2009-04-28  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        ScrollView copy and paste typo fix.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25445
+
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::platformSetScrollbarModes):
+
+2009-04-28  John Sullivan  <sullivan@apple.com>
+
+        <rdar://problem/6820221> REGRESSION: 2-byte character names of images are displayed as %-encoded ASCII
+
+        Reviewed by Adam Roben
+
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageTokenizer::finish):
+        decode the filename before processing it as part of the image name that's passed to the client
+
+2009-04-28  Maciej Stachowiak  <mjs@apple.com>
+
+        Not reviewed, build fix.
+
+        - fix initialization order to match declaration order to fix release build
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2009-04-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Justin Garcia.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16135
+        [GTK] Support caret browsing
+
+        Based on a patch by Alp Toker.
+
+        Implement basic support for caret browsing, active only when the
+        corresponding setting is enabled.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+        * page/FocusController.cpp:
+        (WebCore::FocusController::advanceFocus):
+        (WebCore::clearSelectionIfNeeded):
+        (WebCore::FocusController::setFocusedNode):
+        * page/Frame.cpp:
+        (WebCore::Frame::setFocusedNodeIfNeeded):
+        (WebCore::Frame::setSelectionFromNone):
+        (WebCore::Frame::respondToChangedSelection):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintCaret):
+
+2009-04-27  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix a compile breakage.
+        <https://bugs.webkit.org/show_bug.cgi?id=25384>
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-04-27  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6822344> Use of QTMovieCurrentSizeAttribute generates exception and will crash
+
+        QTMovieCurrentSizeAttribute generates an exception with some versions of QTKit, so calculate a 
+        multiplier to scale from natural size to current size when a movie is opened and use that to 
+        return the correct value from the naturalSize() method.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Initialize m_scaleFactor.
+        (WebCore::MediaPlayerPrivate::naturalSize): Return naturalSize transformed by initial scale.
+        (WebCore::MediaPlayerPrivate::cacheMovieScale): New, calculate difference between initial
+        size and natural size so naturalSize() accounts for non-identity movie matrix.
+        (WebCore::MediaPlayerPrivate::updateStates): Call cacheMovieScale when load state reaches
+        QTMovieLoadStateLoaded for the first time.
+
+2009-04-27  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/6709057> REGRESSION (4PB-TOT): http://www.winway.com/main3/support/faq.aspx selector doesn't look right or work
+
+        The problem here is that we had a self-painting layer nested inside 
+        a non-self-painting layer. We ended up ignoring the self-painting 
+        layer both during painting and hit-testing. This patch corrects 
+        that. 
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+
+2009-04-27  Ada Chan  <adachan@apple.com>
+
+        If it has been set to allow any HTTPS certificates for this host, set 
+        kCFStreamSSLAllowsExpiredCertificates to true to allow expired 
+        certificate, and set kCFStreamSSLValidatesCertificateChain false to skip
+        certificate chain validation. (<rdar://problem/6382059>)
+
+        Reviewed by John Sullivan.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::makeFinalRequest):
+
+2009-04-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Adele Peterson
+        
+        <rdar://problem/6822225> Full page zooming of <video> element in the browser window doesn't work well
+        
+        Fix a 'size changed' notification thrash that caused standalone video elements
+        to continually resize after full page zooming, by using the movie's natual size (which is independent
+        of zooming), rather than its current size (which is not).
+        
+        Note that this regresses <https://bugs.webkit.org/show_bug.cgi?id=25029>, so we have to
+        disable the media/video-size-intrinsic-scale.html test. However, we have to stop using
+        QTMovieCurrentSizeAttribute anyway; this will be addressed, and the test re-enabled via
+        <rdar://problem/6822344>.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::naturalSize):
+
+2009-04-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/6642221> REGRESSION: With the Movie widget, movie trailer fails to
+        load if movie had been previously viewed
+        
+        Fix the Dashboard quirk for display:none plug-ins by moving the code from HTMLObjectElement
+        to HTMLEmebedElement. It has to be in HTMLEmbedElement because the content we care about uses <embed>.
+
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::rendererIsNeeded):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::rendererIsNeeded):
+
+2009-04-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Move more window event related code into DOMWindow.
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::setWindowAttributeEventListener):
+        (WebCore::Document::dispatchWindowEvent):
+        (WebCore::Document::dispatchLoadEvent):
+        * dom/Document.h:
+        * dom/Element.cpp:
+        * dom/Element.h:
+        * dom/Node.cpp:
+        * dom/Node.h:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents):
+        (WebCore::DOMWindow::postMessageTimerFired):
+        (WebCore::DOMWindow::dispatchEvent):
+        (WebCore::DOMWindow::dispatchEventWithDocumentAsTarget):
+        (WebCore::DOMWindow::dispatchLoadEvent):
+        (WebCore::DOMWindow::dispatchUnloadEvent):
+        (WebCore::DOMWindow::dispatchBeforeUnloadEvent):
+        * page/DOMWindow.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::shouldClose):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::parseMappedAttribute):
+
+2009-04-27  Douglas R. Davidson  <ddavidso@apple.com>
+
+        Implement the editing mechanisms and add context menu items for
+        <rdar://problem/6724106> WebViews need to implement text checking
+
+        Reviewed by Justin Garcia.
+
+        * editing/Editor.cpp:
+        * editing/Editor.h:
+        * editing/TypingCommand.cpp:
+        * loader/EmptyClients.h:
+        * page/ContextMenuController.cpp:
+        * page/EditorClient.h:
+        * page/mac/WebCoreViewFactory.h:
+        * platform/ContextMenu.cpp:
+        * platform/ContextMenuItem.h:
+        * platform/LocalizedStrings.h:
+        * platform/mac/LocalizedStringsMac.mm:
+
+2009-04-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix for <rdar://problem/6772944> REGRESSION (r42223): PLT 2% slower, i-Bench 3% slower
+
+        Be slightly less eager in collecting after page close/navigation by increasing
+        the time before collection from 0 seconds to .5 seconds.
+
+        3% speedup on the PLT.
+
+        * bindings/js/GCController.cpp:
+        (WebCore::GCController::garbageCollectSoon):
+
+2009-04-27  David Kilzer  <ddkilzer@apple.com>
+
+        Consolidate runtime application checks for Apple Mail and Safari
+
+        Reviewed by Mark Rowe and Darin Adler.
+
+        * WebCore.base.exp: Added exports.
+        * WebCore.xcodeproj/project.pbxproj: Added
+        RuntimeApplicationChecks.{h|mm} source files to the project.
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::needsKeyboardEventDisambiguationQuirks):
+        Removed local checkedSafari and isSafari variables and switched
+        to use applicationIsSafari().
+        * platform/mac/RuntimeApplicationChecks.h: Added.
+        * platform/mac/RuntimeApplicationChecks.mm: Added.
+        (WebCore::applicationIsAppleMail): Runtime application check for
+        Apple Mail.
+        (WebCore::applicationIsSafari): Runtime application check for
+        Safari.
+
+2009-04-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25374: AX: No AXValue change sent when text is auto-inserted
+        https://bugs.webkit.org/show_bug.cgi?id=25374
+
+        First patch caused some regression tests to fail. 
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+
+2009-04-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Based on a patch by Alp Toker.
+
+        Cover more WebCore role -> ATK role conversions.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-18  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Do not call ATK setters in the getters, just return the
+        value. Among other things calling the setter will emit the notify
+        signal, which is wrong.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Based on a patch by Alp Toker.
+
+        Implement AtkImage interface.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-27  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed debug build fix.
+
+        * platform/gtk/gtk2drawing.c:
+        (moz_gtk_toggle_paint):
+
+2009-04-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Build fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25382
+        Remove direct reference to CallFrame.h include to pacify Win build.
+
+        * bindings/js/JSDOMBinding.h: Removed ScriptState.h include.
+        * bindings/js/ScriptState.h: Replaced CallFrame.h with JSDOMBinding.h
+
+2009-04-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 25374: AX: No AXValue change sent when text is auto-inserted
+        https://bugs.webkit.org/show_bug.cgi?id=25374
+
+        When an input's text value is changed through the DOM, no AXValueChange notification is being sent.
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+
+2009-04-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25382
+        Move scriptStateFromNode to ScriptState.
+
+        * bindings/js/JSDOMBinding.cpp: Moved scriptStateFromNode to ScriptState.
+        * bindings/js/JSDOMBinding.h: Ditto.
+        * bindings/js/ScriptState.cpp:
+        (WebCore::scriptStateFromNode): Added.
+        * bindings/js/ScriptState.h: Ditto.
+        * bindings/v8/ScriptState.cpp:
+        (WebCore::scriptStateFromNode): Added.
+        * bindings/v8/ScriptState.h: Ditto.
+        * dom/NodeFilter.h: Removed JSDOMBinding header include.
+        * dom/NodeIterator.h: Ditto.
+        * dom/TreeWalker.h: Ditto.
+
+2009-04-27  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 25428: 5 crashes in DumpRenderTree at com.apple.WebCore • -[AccessibilityObjectWrapper accessibilityAttributeValue:] + 830
+        https://bugs.webkit.org/show_bug.cgi?id=25428
+
+        When marking children as changed in accessibility, we cannot rely on the accessibility parent chain existing.
+        Instead, the render chain needs to be consulted.
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::childrenChanged):
+
+2009-04-27  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25399
+        <rdar://problem/6633943> REGRESSION: Many crashes reported accessing Lexis/Nexis database,
+        beneath WebCore::Cache::evict
+
+        The crash happened because a cached resource handle was removed from a document's cached
+        resources map twice recursively, so a destructor was called for a value in a deleted bucket.
+        The first call was from Cache::evict, and when destroying CachedResourceHandle destroyed
+        CachedResource, DocLoader::removeCachedResource() was called again, with HashMap being in
+        an inconsistent state.
+
+        I couldn't fully reconstruct the loading sequence to make a test.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::revalidateResource): Assert that the resource being revalidated is in cache
+        (it makes no sense to revalidate one that isn't).
+        (WebCore::Cache::evict): Don't remove the resource from document's map. Removing a resource
+        from the cache in no way implies that documents no longer use the old version. This fixes the
+        crash, and also fixes many cases of resource content being unavailable in Web Inspector.
+
+        * loader/CachedResource.h:
+        (WebCore::CachedResource::setInCache): When bringing a revalidated resource back to cache,
+        reset m_isBeingRevalidated to maintain the invariant of resources being revalidated never
+        being in cache. This fixes another assertion I saw on LexisNexis search: in rare cases,
+        switchClientsToRevalidatedResource() results in the same resource being requested again,
+        but we were only enforcing CachedResource invariants after calling this function.
+        (WebCore::CachedResource::unregisterHandle): Assert that the counter doesn't underflow.
+
+        * loader/DocLoader.cpp: (WebCore::DocLoader::removeCachedResource): Assert that the passed
+        resource is removed, not some other resource that happens to have the same URL (this used to
+        fail on LexisNexis search before this patch).
+
+        * loader/ImageDocument.cpp: (WebCore::ImageTokenizer::write): Replaced ASSERT_NOT_REACHED
+        with notImplemented(). This method can be legally called via document.write(), and should
+        work. LexisNexis takes this code path, but apparently has a fallback for Safari, so it
+        doesn't affect site functionality.
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::clearResourceToRevalidate): Don't assert that m_resourceToRevalidate
+        is being revalidated - this may no longer be true, because we now reset this member in
+        CachedResource::setInCache().
+
+2009-04-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - make BidiContext a RefCounted class, starting with a refcount of 1,
+          and share the root BidiContexts.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawBidiText): Use BidiContext::create().
+        * platform/text/BidiContext.cpp:
+        (WebCore::BidiContext::create): Added. For the four "root" contexts,
+        returns a reference to a shared static BidiContext.
+        * platform/text/BidiContext.h:
+        (WebCore::BidiContext::BidiContext):
+        * platform/text/BidiResolver.h:
+        (WebCore::::commitExplicitEmbedding): Use BidiContext::create().
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::determineStartPosition): Ditto.
+
+2009-04-27  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Rubber-stamped by Gustavo Noronha.
+
+        Build fix for r42893: change GDK_exclaim to GDK_exclam
+
+        * platform/chromium/KeyCodeConversionGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2009-04-27  Fumitoshi Ukai  <ukai@google.com>
+
+        Reviewed by Xan Lopez.
+
+        Fix wrong key code conversion.
+
+        Missing conversion for GDK_exlaim ('!').
+        Parens are opposite: GDK_parenleft is open paren '('
+        and GDK_parenright is close paren ')'.
+        https://bugs.webkit.org/show_bug.cgi?id=25367
+
+        * platform/chromium/KeyCodeConversionGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2009-04-27  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Gustavo Noronha.
+
+        [Gtk] gtkdrawing update
+        https://bugs.webkit.org/show_bug.cgi?id=25408
+
+        Update to the 25 Apr 2009 version of gtk2drawing.c and
+        gtkdrawing.h from Mozilla (http://hg.mozilla.org/mozilla-central)
+
+        * platform/gtk/gtk2drawing.c:
+        (setup_widget_prototype):
+        (moz_gtk_get_combo_box_entry_arrow):
+        (ensure_toolbar_widget):
+        (ensure_tree_header_cell_widget):
+        (moz_gtk_init):
+        (moz_gtk_button_get_inner_border):
+        (moz_gtk_toggle_paint):
+        (moz_gtk_caret_paint):
+        (moz_gtk_entry_paint):
+        (moz_gtk_tree_header_cell_paint):
+        (moz_gtk_combo_box_paint):
+        (moz_gtk_toolbar_separator_paint):
+        (moz_gtk_menu_separator_paint):
+        (moz_gtk_get_widget_border):
+        (moz_gtk_get_tab_scroll_arrow_size):
+        (moz_gtk_get_toolbar_separator_width):
+        (moz_gtk_get_menu_separator_height):
+        (moz_gtk_widget_paint):
+        (moz_gtk_shutdown):
+        * platform/gtk/gtkdrawing.h:
+
+2009-04-27  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18475
+
+        [Qt] Widget painting should follow the layout direction (LTR, RTL)
+        of the element style, not the application layout direction.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::applyTheme):
+
+2009-04-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=25412
+        The Window object should be an EventTarget
+
+        Test: fast/dom/Window/dispatchEvent.html
+
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS): Add DOMWindow case.
+        (WebCore::toEventTarget): Ditto.
+
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toDOMWindow): Added.
+        * dom/EventTarget.h:
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::scriptExecutionContext): Added. Returns the document.
+        (WebCore::DOMWindow::dispatchEvent): Added.
+        * page/DOMWindow.h:
+        (WebCore::DOMWindow::toDOMWindow):
+        (WebCore::DOMWindow::refEventTarget):
+        (WebCore::DOMWindow::derefEventTarget):
+        * page/DOMWindow.idl:
+
+2009-04-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove scons-based build system.
+
+        * WebCore.scons: Removed.
+
+2009-04-26  Darin Adler  <darin@apple.com>
+
+        Suggested by Darin Fisher.
+
+        Improve the fix for bug 25355: Crash when Creating New Tab or New Window when set to open Same Page
+        https://bugs.webkit.org/show_bug.cgi?id=25355
+        rdar://problem/6823543
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem): Allow shouldScroll to be true even if m_currentHistoryItem is 0.
+        Not sure if when this case can really arise in practice, but it's good to match the original
+        logic more closely.
+
+2009-04-25  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        A width or height of zero for the destination or source rect of an
+        image causes a not invertible pattern matrix.
+        This crahes newer versions of Cairo and give some graphic gliches in
+        Canvas.
+        With this patch we check if there is something to draw and return if not.
+
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::draw):
+
+2009-04-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25390
+        
+        Fix point mapping and hit testing through transforms and perspective
+        with ENABLE_3D_RENDERING. Previously the code did the more efficient
+        move(), rather than getTransformFromContainer(), when the object had
+        no transform. However, this skipped the application of perspective
+        when the immediate child of the perspective element had no transform
+        itself.
+
+        Test: transforms/3d/point-mapping/3d-point-mapping-3.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        (WebCore::RenderBox::mapAbsoluteToLocalPoint):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::createLocalTransformState):
+        Call shouldUseTransformFromContainer() to determine if we need to
+        go through the more expensive getTransformFromContainer() code
+        path.
+
+        * rendering/RenderObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::shouldUseTransformFromContainer):
+        New method that indicates whether we need use getTransformFromContainer()
+        when mapping points through renderers, and hit testing.
+
+2009-04-25  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for <rdar://problem/6712771> REGRESSION(34681): Text is no longer underlined after delete
+        https://bugs.webkit.org/show_bug.cgi?id=25396
+
+        Test: editing/deleting/delete-br-013.html
+
+        * editing/CompositeEditCommand.cpp: (WebCore::CompositeEditCommand::moveParagraphs):
+         Only preserve an empty paragraph's style when moving paragraphs around if the selection is still 
+         in an empty paragraph after the move occurs.  This was causing the empty paragraph's style to overwrite
+         the previous paragraph's style during a delete of an empty paragraph.
+
+2009-04-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6808171> REGRESSION (3-4): Standalone media documents don't 
+        properly display non-linear media
+
+        If a media engine claims it can support the MIME type, WebCore now creates a <video>
+        element for document mode media files instead of an <embed> element. Because WebCore's 
+        QuickTime backed media players do not support every kind of media the QuickTime plug-in
+        supports, and because it is not always possible to tell what type of media is in a file 
+        without opening and parsing it, some types of media that used to be displayed properly
+        by a plug-in are no longer supported properly. To fix this, if the media engine
+        sees that it can not completely support a media file it now informs the media 
+        document, which replaces the <video> element with an <embed>.
+        
+        r42301 landed support for OSX. This patch modifies those changes slighly and adds support
+        for Windows.
+
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::MediaDocument): Initialize m_replaceMediaElementTimer.
+        (WebCore::MediaDocument::mediaElementSawUnsupportedTracks): Don't replace the <video> 
+        element immediately.
+        (WebCore::MediaDocument::replaceMediaElementTimerFired): Renamed from replaceVideoWithEmbed.
+        Set body margin-width and margin-height to 0 as that is what a PluginDocument uses.
+        * loader/MediaDocument.h:
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::loadStateChanged): Don't do anything if m_hasUnsupportedTracks.
+        (WebCore::MediaPlayerPrivate::rateChanged): Ditto.
+        (WebCore::MediaPlayerPrivate::timeChanged): Ditto.
+        (WebCore::MediaPlayerPrivate::didEnd): Ditto.
+        (WebCore::MediaPlayerPrivate::repaint): Ditto.
+        (WebCore::MediaPlayerPrivate::paint): Ditto.
+        (WebCore::MediaPlayerPrivate::sawUnsupportedTracks): Set m_hasUnsupportedTracks before callback.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Initialize m_totalTrackCount and m_hasUnsupportedTracks.
+        (WebCore::MediaPlayerPrivate::updateStates): Call sawUnsupportedTracks if the movie has unsupported
+        media type(s) or if it fails completely.
+        (WebCore::MediaPlayerPrivate::sawUnsupportedTracks): New, disable the movie object and tell the
+        media player client we won't play this movie correctly.
+        (WebCore::MediaPlayerPrivate::didEnd): Don't do anything if m_hasUnsupportedTracks.
+        (WebCore::MediaPlayerPrivate::setSize): Ditto.
+        (WebCore::MediaPlayerPrivate::setVisible): Ditto.
+        (WebCore::MediaPlayerPrivate::paint): Ditto.
+        (WebCore::MediaPlayerPrivate::movieEnded): Ditto.
+        (WebCore::MediaPlayerPrivate::movieLoadStateChanged): Ditto.
+        (WebCore::MediaPlayerPrivate::movieTimeChanged): Ditto.
+        (WebCore::MediaPlayerPrivate::movieNewImageAvailable): Ditto.
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWinPrivate::task): Stop the task timer if we were disabled during the load state
+        change callback.
+        (QTMovieWinPrivate::drawingComplete): Don't do anything if disabled.
+        (QTMovieWin::QTMovieWin): Initialize m_disabled.
+        (QTMovieWin::disableUnsupportedTracks): Return total number of tracks.
+        (QTMovieWin::setDisabled): New, set m_disabled flag.
+        * platform/graphics/win/QTMovieWin.h:
+
+2009-04-25  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Error reporting
+        https://bugs.webkit.org/show_bug.cgi?id=18344
+
+        Fix the SOUP resource handle to report SOUP_HTTP_ERROR for Soup
+        errors and G_IO_ERROR for gio errors.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::finishedCallback):
+        (WebCore::ResourceHandle::startHttp):
+        (WebCore::ResourceHandle::start):
+        (WebCore::readCallback):
+        (WebCore::openCallback):
+        (WebCore::queryInfoCallback):
+        (WebCore::ResourceHandle::startGio):
+
+2009-04-25  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Mark Rowe.
+
+        Only set the new URL once for the request. Doing it a second time
+        after the call to willSendRequest was causing crashes when
+        redirected requests got cancelled.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-04-24  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Adding ScriptEventListener.cpp.
+
+        * WebCoreSources.bkl:
+
+2009-04-24  Sergio García-Cuevas  <sergio_gcg@telefonica.net>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=17267
+        [GTK] Primary selection/clipboard support
+
+        Copy the link location to the primary selection as well as the
+        clipboard selection when using the "copy link selection" context
+        menu entry.
+
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writeURL):
+        * platform/gtk/PasteboardHelper.h:
+
+2009-04-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25383
+        Changing SVG size via JS does not update CSS width/height
+
+        Add an ugly hack to fix CSS width/height updates from JS.
+
+        We can't easily call setAttribute when width/height changes
+        as that would cause infinite recursion (as we'd try to set
+        the animation storage from the attributes)
+
+        For now, when we get notification that JS changed width/height
+        we copy what parseMappedAttribute does and update the CSS values as well.
+
+        A better fix for this would be:
+        https://bugs.webkit.org/show_bug.cgi?id=25383
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::updateCSSForAttribute):
+        (WebCore::SVGSVGElement::svgAttributeChanged):
+
+2009-04-24  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        We should not show the deletion UI for blockquotes in mail but they do 
+        show now that we only check for one visible border.
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+
+2009-04-24  Dan Bernstein  <mitz@apple.com>
+
+        - address Hyatt's review comments on the last patch
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::performOverlapTests):
+        (WebCore::RenderLayer::paintLayer):
+
+2009-04-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=5909
+          <rdar://problem/5863349> overlapping element leaves trail when
+          scrolling iframe
+
+        * WebCore.xcodeproj/project.pbxproj: Added OverlapTestRequestClient.h.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::reset): Initialize m_isOverlapped.
+        (WebCore::FrameView::useSlowRepaints): Also check m_isOverlapped.
+        (WebCore::FrameView::removeSlowRepaintObject): Use useSlowRepaints()
+        so overlapping is taken into account.
+        (WebCore::FrameView::setIsOverlapped): Added. Sets m_isOverlapped and
+        enables or disables copy-on-scroll accordingly.
+
+        * page/FrameView.h:
+        Added setIsOverlapped() and m_isOverlapped.
+
+        * rendering/OverlapTestRequestClient.h: Added. During foreground painting,
+        an OverlapTestRequestClient can make a request to test if any subsequently-
+        painted layers overlap a rect. The test result is delivered to the
+        requestClient via setOverlapTestResult().
+        (WebCore::OverlapTestRequestClient::~OverlapTestRequestClient):
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paint): Pass an OverlapTestRequestMap to
+        paintLayer(). When done painting, inform any remaining requestClients that
+        they are not overlapped.
+
+        (WebCore::RenderLayer::paintLayer): Take an OverlapTestRequestMap and
+        pass it down to child and reflection layers. Inform requestClients if this
+        layer overlaps their requested rects.
+
+        * rendering/RenderLayer.h:
+
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::PaintInfo::PaintInfo): Added an
+        OverlapTestRequestMap member.
+
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::paint): For now, pass a 0 OverlapTestRequestMap
+        to paintLayer().
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint): For FrameViews, request an overlap test
+        with the frame.
+        (WebCore::RenderWidget::setOverlapTestResult): Call
+        FrameView::setIsOverlapped() with the result of the overlap test.
+
+        * rendering/RenderWidget.h: Made RenderWidget an OverlapTestRequestClient.
+
+2009-04-24  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser, Dan Bernstein.
+
+        Speed up the PLT by devirtualizing the height() function on InlineBox.  virtualizing it in order to make the height() computation dynamic caused
+        a ~0.5% slowdown.  This patch does the following to get the speed back:
+        
+        (a) Devirtualizes isText and forces inline box creators to set the bit as needed.  This actually resulted in simplified code, since ListMarkerBox could
+        then be removed.
+        (b) Reduces the height() call count.  In some cases the code was repeatedly calling height(), which used to be fine when the function was just an inline
+        member variable access.  The call sites have been patched to cut down on extra height() calls now that it is more expensive.
+        (c) Devirtualize height() except on SVG boxes.  For all non-SVG, the height() function on InlineBox handles the computation.  For SVG boxes, a new bit has
+        been set on InlineBoxes (isSVG()) that indicates that the virtual svgBoxHeight() function should be called to retrieve the height instead.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::height):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
+        (WebCore::InlineBox::isSVG):
+        (WebCore::InlineBox::setIsSVG):
+        (WebCore::InlineBox::isText):
+        (WebCore::InlineBox::setIsText):
+        (WebCore::InlineBox::svgBoxHeight):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/InlineFlowBox.h:
+        * rendering/InlineTextBox.cpp:
+        * rendering/InlineTextBox.h:
+        * rendering/ListMarkerBox.cpp: Removed.
+        * rendering/ListMarkerBox.h: Removed.
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::createInlineBox):
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::createFlowBox):
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::createTextBox):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::createRootBox):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::createInlineTextBox):
+        * rendering/RootInlineBox.cpp:
+        * rendering/RootInlineBox.h:
+        * rendering/SVGInlineFlowBox.h:
+        (WebCore::SVGInlineFlowBox::svgBoxHeight):
+        * rendering/SVGInlineTextBox.h:
+        (WebCore::SVGInlineTextBox::svgBoxHeight):
+        * rendering/SVGRootInlineBox.h:
+        (WebCore::SVGRootInlineBox::svgBoxHeight):
+
+2009-04-24  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25370
+        Introduce ScriptEventListener to refactor away direct references to
+        JSLazyEventListener in WebCore code.
+
+        * GNUmakefile.am: Added ScriptEventListener to project.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSDOMGlobalObject.cpp: Removed unused JSLazyEventListener include.
+        * bindings/js/JSLazyEventListener.cpp: Moved createAttributeEventListener helpers
+            to ScriptEventListener.
+        * bindings/js/JSLazyEventListener.h: Ditto.
+        * bindings/js/ScriptController.cpp: Removed unused JSLazyEventListener include.
+        * bindings/js/ScriptEventListener.cpp: Added.
+        * bindings/js/ScriptEventListener.h: Added.
+        * bindings/v8/ScriptEventListener.cpp: Added.
+        * bindings/v8/ScriptEventListener.h: Added.
+        * dom/Document.cpp: Renamed JSLazyEventListener include to ScriptEventListener.
+        * html/HTMLBodyElement.cpp: Ditto.
+        * html/HTMLButtonElement.cpp: Ditto.
+        * html/HTMLElement.cpp: Ditto.
+        * html/HTMLFormElement.cpp: Ditto.
+        * html/HTMLFrameElementBase.cpp: Ditto.
+        * html/HTMLFrameSetElement.cpp: Ditto.
+        * html/HTMLImageElement.cpp: Ditto.
+        * html/HTMLInputElement.cpp: Ditto.
+        * html/HTMLObjectElement.cpp: Ditto.
+        * html/HTMLScriptElement.cpp: Ditto.
+        * html/HTMLSelectElement.cpp: Ditto.
+        * html/HTMLTextAreaElement.cpp: Ditto.
+        * svg/SVGElement.cpp: Ditto.
+        * svg/SVGSVGElement.cpp: Ditto.
+
+2009-04-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 25355: Crash when Creating New Tab or New Window when set to open Same Page
+        https://bugs.webkit.org/show_bug.cgi?id=25355
+        rdar://problem/6823543
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem): Added a null check.
+
+2009-04-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Fix RenderSVGImage to dump with full bounds and style information.
+        https://bugs.webkit.org/show_bug.cgi?id=25377
+        
+        No functional changes, we're just now including more info in render tree dumps.
+
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isSVGImage):
+        * rendering/RenderSVGImage.h:
+        (WebCore::RenderSVGImage::isSVGImage):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write):
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        (WebCore::write):
+        * rendering/SVGRenderTreeAsText.h:
+
+2009-04-24  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+
+        Rename "isInline" => "isAttribute" in v8 bindings (jsc was done in r42699).
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::V8AbstractEventListener):
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8EventListenerList.cpp:
+        (WebCore::V8EventListenerList::add):
+        (WebCore::V8EventListenerList::remove):
+        (WebCore::V8EventListenerList::clear):
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::virtualisAttribute):
+        * bindings/v8/custom/V8CustomEventListener.cpp:
+        (WebCore::V8EventListener::V8EventListener):
+        * bindings/v8/custom/V8CustomEventListener.h:
+        (WebCore::V8EventListener::create):
+        (WebCore::V8EventListener::virtualisAttribute):
+
+2009-04-24  Nate Chapin  <japhet@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25343
+        Fix Chromium/Skia bug where -webkit-box-shadow with 0,0 offset 
+        ignores blur.
+
+        * WebCore\platform\graphics\skia\GraphicsContextSkia.cpp
+         (WebCore::GraphicsContext::setPlatformShadow): Add check against
+         blur before clearing looper.
+
+2009-04-24  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Initialize TextIterator::m_textLength to 0.
+
+        This assures that TextIterator::length() will return 0 for cases when TextIterator's constructor returns early (because there is nothing to iterate over in the range).
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25335>
+
+        Test: editing/selection/doubleclick-whitespace-img-crash.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::TextIterator):
+
+2009-04-24  Fumitoshi Ukai  <ukai@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25329
+        Add indexed access method in v8 binding of ClientRectList.
+
+        * bindings/v8/custom/V8ClientRectListCustom.cpp: Added.
+
+2009-04-24  Fumitoshi Ukai  <ukai@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25257
+        Use null for unspecified event listener attributes of XMLHttpRequest
+        and XMLHttpRequestUpload in v8 binding.
+
+        cf. http://www.whatwg.org/specs/web-apps/current-work/#event-handler-attributes
+        An event handler attribute, unless otherwise specified, can either
+        have the value null or be set to a Function object.
+        Initially, an event handler attribute must be set to null.
+
+        Test: fast/xmlhttprequest/xmlhttprequest-default-attributes.html
+
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::ACCESSOR_GETTER): Changed to use v8::Null().
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        (WebCore::ACCESSOR_GETTER): Ditto.
+
+2009-04-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        <rdar://problem/6663836> CrashTracer: crashes in Safari at com.apple.WebCore • WebCore::reportException + 1513
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::reportException): Added a null check.
+
+2009-04-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+        
+        https://bugs.webkit.org/show_bug.cgi?id=23219
+
+        Add support for transtions and animations of background-position, -webkit-background-size,
+        -webkit-mask-position and -webkit-mask-size.
+
+        Tests: transitions/background-transitions.html
+               transitions/mask-transitions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc):
+        Add a blend func for LengthSize.
+        
+        (WebCore::ensurePropertyMap):
+        Add wrappers for the new properties.
+        
+        (WebCore::addShorthandProperties):
+        Add a shorthand property for CSSPropertyBackgroundPosition to map to
+        CSSPropertyBackgroundPositionX and CSSPropertyBackgroundPositionY, 
+        add CSSPropertyWebkitMask for CSSPropertyWebkitMaskPosition, and add
+        CSSPropertyWebkitMaskPosition for CSSPropertyWebkitMaskPositionX and
+        CSSPropertyWebkitMaskPositionY.
+        
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::setBackgroundXPosition):
+        (WebCore::InheritedFlags::setBackgroundYPosition):
+        (WebCore::InheritedFlags::setBackgroundSize):
+        (WebCore::InheritedFlags::setMaskXPosition):
+        (WebCore::InheritedFlags::setMaskYPosition):
+        (WebCore::InheritedFlags::setMaskSize):
+        Add setters for the properties that can be animated now.
+
+2009-04-24  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/5089327> Newline gets stripped when pasting whole lines in certain markup
+
+        Test: editing/pasteboard/paste-blockquote-after-blockquote.html
+
+        When we have matching quote levels, its ok to merge the starts of the inserted and existing blocks more frequently.
+        But we should only merge here if the selection start was inside a mail blockquote.  This prevents against removing a 
+        blockquote from newly pasted quoted content that was pasted into an unquoted position.  If that unquoted position happens 
+        to be right after another blockquote, we don't want to merge and risk stripping a valid block (and newline) from the pasted content.
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::shouldMergeStart): Also added an early return to always return false when we're already moving paragraphs.
+        (WebCore::ReplaceSelectionCommand::doApply): Removed redundant check for when we're moving paragraphs.
+        * editing/ReplaceSelectionCommand.h:
+
+2009-04-23  Francisco Tolmasky  <francisco@280north.com>
+
+        BUG 24604: WebKit profiler reports incorrect total times
+        <https://bugs.webkit.org/show_bug.cgi?id=24604>
+
+        Reviewed by Timothy Hatcher and Kevin McCullough.
+
+        Made it so that most of the profiler functions now match the behavior of Shark. Most notably, in the
+        heavy view, child nodes now represent the statistics of the root node. Each root node of heavy view
+        displays flattened statistics for a particular function that ran during the profile, and each child
+        of these root nodes represents a callpath that lead to it. Thus, the statistics for each of these child
+        nodes should show how much of the root nodes values came from it. For example, if you had the following to
+        stacks take place during the profile:
+
+        A ->calls 1 times-> B ->calls 2 times-> C
+        D ->calls 4 times-> C
+
+        The tree for the C root node would look like this:
+
+        C -> B -> A
+          -> D
+
+        The number of calls values would look like this:
+
+        C (6) -> B (2) -> A(2)
+              -> D (4)
+
+        What this means is that "2 of the total 6 C calls came from B", "2 of the total C calls came from A", and
+        "4 of the total C calls came from D".  Notice that the "A ->calls 2 time->" is completely ignored. This becomes
+        particularly tricky during recursive calls, because each child note can represent multiple possible paths. This
+        is the reason that we would get things like 40000% previously with recursion.
+
+        This is also the way gprof works, and as close as we can get to Shark's behavior (Shark is not instrumented so it
+        can't know exactly how many calls came from where, etc).
+
+        * English.lproj/localizedStrings.js: Added "Average" for average times in the profile.
+        * inspector/JavaScriptProfile.cpp:
+        (WebCore::ProfileClass):
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::getParent):
+        (WebCore::getHead):
+        (WebCore::getCallUID):
+        (WebCore::ProfileNodeClass):
+        * inspector/front-end/BottomUpProfileDataGridTree.js: Added.
+        (WebInspector.BottomUpProfileDataGridTree):
+        (WebInspector.BottomUpProfileDataGridTree.prototype.focus):
+        (WebInspector.BottomUpProfileDataGridNode):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._takePropertiesFromProfileDataGridNode):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._keepOnlyChild):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._exclude):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._merge):
+        (WebInspector.BottomUpProfileDataGridNode.prototype._populate):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype.insertChild):
+        (WebInspector.DataGrid.prototype.removeChild):
+        (WebInspector.DataGrid.prototype.removeChildren):
+        (WebInspector.DataGridNode.prototype.set hasChildren):
+        (WebInspector.DataGridNode.prototype.get hasChildren):
+        * inspector/front-end/ProfileDataGridTree.js: Added.
+        (WebInspector.ProfileDataGridNode):
+        (WebInspector.ProfileDataGridNode.prototype.get data.formatMilliseconds):
+        (WebInspector.ProfileDataGridNode.prototype.get data):
+        (WebInspector.ProfileDataGridNode.prototype.createCell):
+        (WebInspector.ProfileDataGridNode.prototype.select):
+        (WebInspector.ProfileDataGridNode.prototype.deselect):
+        (WebInspector.ProfileDataGridNode.prototype.expand):
+        (WebInspector.ProfileDataGridNode.prototype.insertChild):
+        (WebInspector.ProfileDataGridNode.prototype.removeChild):
+        (WebInspector.ProfileDataGridNode.prototype.removeChildren):
+        (WebInspector.ProfileDataGridNode.prototype.findChild):
+        (WebInspector.ProfileDataGridNode.prototype.get averageTime):
+        (WebInspector.ProfileDataGridNode.prototype.get averagePercent):
+        (WebInspector.ProfileDataGridNode.prototype.get selfPercent):
+        (WebInspector.ProfileDataGridNode.prototype.get totalPercent):
+        (WebInspector.ProfileDataGridNode.prototype._save):
+        (WebInspector.ProfileDataGridNode.prototype._restore):
+        (WebInspector.ProfileDataGridNode.prototype._merge):
+        (WebInspector.ProfileDataGridTree):
+        (WebInspector.ProfileDataGridTree.prototype.get expanded):
+        (WebInspector.ProfileDataGridTree.prototype.appendChild):
+        (WebInspector.ProfileDataGridTree.prototype.insertChild):
+        (WebInspector.ProfileDataGridTree.prototype.removeChildren):
+        (WebInspector.ProfileDataGridTree.prototype.findChild.WebInspector.ProfileDataGridNode.prototype.findChild.sort.WebInspector.ProfileDataGridNode.prototype.sort._save):
+        (WebInspector.ProfileDataGridTree.propertyComparator.comparator):
+        (WebInspector.ProfileDataGridTree.propertyComparator.else.comparator):
+        (WebInspector.ProfileDataGridTree.propertyComparator):
+        * inspector/front-end/ProfileView.js:
+        (WebInspector.ProfileView):
+        (WebInspector.ProfileView.prototype.set profile):
+        (WebInspector.ProfileView.prototype.get bottomUpProfileDataGridTree):
+        (WebInspector.ProfileView.prototype.get topDownProfileDataGridTree):
+        (WebInspector.ProfileView.prototype.get currentTree):
+        (WebInspector.ProfileView.prototype.set currentTree):
+        (WebInspector.ProfileView.prototype.get topDownTree):
+        (WebInspector.ProfileView.prototype.get bottomUpTree):
+        (WebInspector.ProfileView.prototype.refresh):
+        (WebInspector.ProfileView.prototype.refreshVisibleData):
+        (WebInspector.ProfileView.prototype.refreshShowAsPercents):
+        (WebInspector.ProfileView.prototype.performSearch.matchesQuery):
+        (WebInspector.ProfileView.prototype.performSearch):
+        (WebInspector.ProfileView.prototype._changeView):
+        (WebInspector.ProfileView.prototype._focusClicked):
+        (WebInspector.ProfileView.prototype._excludeClicked):
+        (WebInspector.ProfileView.prototype._resetClicked):
+        (WebInspector.ProfileView.prototype._sortProfile):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.showProfile):
+        (WebInspector.ProfilesPanel.prototype.showView):
+        (WebInspector.ProfilesPanel.prototype.searchMatchFound):
+        * inspector/front-end/TopDownProfileDataGridTree.js: Added.
+        (WebInspector.TopDownProfileDataGridNode):
+        (WebInspector.TopDownProfileDataGridNode.prototype._populate):
+        (WebInspector.TopDownProfileDataGridNode.prototype._exclude):
+        (WebInspector.TopDownProfileDataGridTree):
+        (WebInspector.TopDownProfileDataGridTree.prototype.focus):
+        (WebInspector.TopDownProfileDataGridTree.prototype.exclude):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-04-23  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Use static functions (and a couple templates)
+        to further reduce the amount of copy/paste code in SVGRenderTreeAsText
+
+        No test changes, only code cleanup.
+
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::writeNameValuePair):
+        (WebCore::writeNameAndQuotedValue):
+        (WebCore::writeIfNotEmpty):
+        (WebCore::writeIfNotDefault):
+        (WebCore::writeStyle):
+        (WebCore::writePositionAndStyle):
+        (WebCore::operator<<):
+
+2009-04-23  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        SVGRenderTreeAsText cleanup/code sharing.
+
+        No test changes, only code cleanup.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::firstRunOrigin):
+        * rendering/RenderText.h:
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::writeStandardPrefix):
+        (WebCore::writeChildren):
+        (WebCore::write):
+        (WebCore::writeRenderResources):
+
+2009-04-23  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WebCore part of fix for <rdar://problem/6333461> REGRESSION 
+        (r36864-r36869): Dragging stocks widget scrollbar drags the whole 
+        widget
+
+        * platform/Scrollbar.h:
+        (WebCore::Scrollbar::isScrollbar):
+        * platform/Widget.h:
+        (WebCore::Widget::isScrollbar):
+
+2009-04-23  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Adam Roben.
+
+        <rdar://problem/6808109> "Deletion UI" is not available for many
+        portions of HTML content
+
+        This patch makes the deletion UI show up in some new situations:
+        1) If a block's background color is different from its parent's
+        2) If a block has a background image.
+        3) If a block has a single visible border.
+        However the block must now not only be at least a minimum width and
+        height, but also exceed a minimum area.  In practice this has led to
+        much better element selection. 
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+
+2009-04-23  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Adding XMLTokenizerScope.cpp to the build.
+
+        * WebCoreSources.bkl:
+
+2009-04-23  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/6788905> REGRESSION (41928?): hang in Position::upstream
+        https://bugs.webkit.org/show_bug.cgi?id=25312
+
+        I was unable to reproduce the problem, but I'm pretty sure this will fix it.
+
+        * rendering/RenderObject.cpp: (WebCore::RenderObject::createVisiblePosition):
+        Since VisiblePosition doesn't ensure the offset is good, we shouldn't pass max int as an offset.
+
+2009-04-23  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25313
+        Missing scroll bars in GMail.
+
+        Test: fast/overflow/overflow-y-scroll.html
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars): Added check for the ScrollbarAlwaysOn
+        scroll mode.
+
+2009-04-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Justin Garcia.
+
+        - fix <rdar://problem/6081309> Mail crash when pressing down arrow in
+          some messages in WebCore::canHaveChildrenForEditing
+
+        Test: editing/selection/extend-by-line-anonymous-content-crash.html
+
+        * editing/visible_units.cpp:
+        (WebCore::previousLinePosition): Null-check node. If p is not an
+        editable position, then closestLeafChildForXPos() may have returned a
+        non-editable box, and in particular one belonging to anonymous content.
+        If node is 0, fall back on RenderObject::positionForPoint, which
+        finds the closest position in non-anonymous content.
+        (WebCore::nextLinePosition): Ditto.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createVisiblePosition): Fixed a typo.
+
+2009-04-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/6791439> REGRESSION: Get an error page instead of login page navigating back in gmail
+
+        Test: http/tests/history/back-to-post.php
+
+        * platform/network/cf/ResourceRequestCFNet.cpp: (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        Apply a new cache policy if it changed after the platform request was first created.
+        While at it, also made sure to update timeout.
+
+2009-04-23  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        When creating a new drawable object, collect system's
+        information about the best depth it can provide and use it
+        in a new colormap that the new drawable requires.
+
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::BitmapImage::getGdkPixbuf):
+
+2009-04-23  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15654
+        GdkPixbuf support for ImageCairo
+
+        Add support for converting a Cairo surface to a GdkPixbuf.
+
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/Image.h:
+        (WebCore::Image::getGdkPixbuf):
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::BitmapImage::getGdkPixbuf):
+
+2009-04-23  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Simon Hausmann.
+
+        Make windowed plugins (on X11, Qt) behave nicer with wheel scrolling.
+
+        Basically, what we want is to send wheel events to the plugin *only*
+        when it has focus, or else send it to the parent frame.
+
+        This is a work around, and basically what we do, is to steal the
+        wheel events from the plugin, modify the window ID, and put the
+        event back into the Qt event loop.
+
+        * plugins/qt/PluginContainerQt.cpp:
+        (PluginClientWrapper::PluginClientWrapper):
+        (PluginClientWrapper::~PluginClientWrapper):
+        (PluginClientWrapper::x11Event):
+        (PluginContainerQt::PluginContainerQt):
+        (PluginContainerQt::~PluginContainerQt):
+        (PluginContainerQt::on_clientClosed):
+        (PluginContainerQt::on_clientIsEmbedded):
+        (PluginContainerQt::redirectWheelEventsToParent):
+        (PluginContainerQt::x11Event):
+        (PluginContainerQt::focusInEvent):
+        * plugins/qt/PluginContainerQt.h:
+
+2009-04-22  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Maciej Stachowiak
+
+        <rdar://problem/6786961> - "Are you sure you want to resubmit this form?" nag displays twice.
+
+        For most loads, we were consulting the navigation policy delegate twice.  Once from FrameLoader before
+        the load started and once from MainResourceLoader in its willSendRequest callback.
+
+        In the past we tried removing MainResourceLoader's call altogether.  This caused a regression where urls 
+        that redirect to a url handled by an external application would no longer work in Safari.  It probably 
+        also broke other WebKit apps in subtle ways.
+
+        Changing MainResourceLoader to make the check only on redirects fixes both bugs.  We now only call the 
+        policy delegate once for most standard loads, but we do correctly call it a second time for redirects.
+
+        Tests: http/tests/misc/policy-delegate-called-twice.html
+               http/tests/misc/redirect-to-external-url.html
+
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::willSendRequest): Call the navigation policy delegate only for redirects.
+
+2009-04-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix for <rdar://problem/6800695>
+
+        Add a hack to only allow navigating (via a link from a http page)
+        to feed: urls (same for feeds: and feedsearch:) that map to http:
+        or https: via their nested protocol. This includes both feed://example.com
+        and feed:http://example.com.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::isFeedWithNestedProtocolInHTTPFamily):
+        (WebCore::FrameLoader::loadFrameRequest):
+
+2009-04-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Autogenerate the XMLHttpRequest constructor getter/setter for the
+        WorkerContext and remove the now no longer needed JSWorkerContextBase.lut.h
+        file.
+
+        * DerivedSources.make: Remove JSWorkerContextBase.lut.h
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+
+        * bindings/js/JSWorkerContextBase.cpp:
+        * bindings/js/JSWorkerContextBase.h: Remove code to support hand written
+        code for XMLHttpRequest constructor lookup and shadowing.
+
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::customGetOwnPropertySlot): Remove JSC prefixes.
+        (WebCore::JSWorkerContext::xmlHttpRequest): Added. Custom implementation of
+        cached constructor lookup.
+        * workers/WorkerContext.idl: Make the XMLHttpRequestConstructor accessor not
+        V8 specific.
+
+2009-04-22  Darin Adler  <darin@apple.com>
+
+        * page/Navigator.idl: Touch this file to fix build since Geolocation
+        configuration was recently turned off.
+
+2009-04-22  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25322
+        Can't delete empty paragraph after a block image
+        
+        Empty paragraph removal would have been handled by mergeParagraphs, but we stopped short
+        because of some code that avoided problems that would arise from Positions that would go
+        bad during deletion.  
+        
+        We have several checks that prevent us from using bad Positions, this one in particular
+        was added to avoid bad Positions that result from text removal.  So, I removed the check
+        and started correctly updating m_downstreamEnd during text removal so that it doesn't go
+        bad.  m_upstreamStart doesn't need to be updated during text removal, since only text
+        after it will ever be removed.
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::deleteTextFromNode):
+        (WebCore::DeleteSelectionCommand::handleGeneralDelete):
+        (WebCore::DeleteSelectionCommand::mergeParagraphs):
+
+2009-04-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6757346> SAP: Prevent default on mouseDown does not stop iframe from capturing subsequent mouse moves
+
+        Make mouseUp target the correct frame when the original
+        mousedown made the drag non-capturing.
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+
+2009-04-22  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6757346> SAP: Prevent default on mouseDown does not stop iframe from capturing subsequent mouse moves
+
+        This is the first step of allowing drag events to match the behaviour
+        of mouse move events when the default action of the initial mouse down
+        is prevented.  Remaining issue is that the final mouse up event still
+        targets the original root frame.
+
+        Test: fast/events/mouse-drag-from-frame-to-other-frame.html
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passSubframeEventToSubframe):
+
+2009-04-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Adele Peterson
+        
+        <rdar://problem/6702882> QT movie's video fails to be displayed after switching between tabs
+        <rdar://problem/6754957> Resizing Web browser window and hitting play will cause video blocks and artifacting
+
+        When in a media document, MediaPlayerPrivateQTKit uses a QTMovieView which may get
+        layer backing under some circumstances. However, drawing the view via
+        displayRectIgnoringOpacity:inContext: bypasses any layer setup that AppKit normally performs.
+        So when in the media document, we draw via displayRectIgnoringOpacity:.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::paint):
+
+2009-04-22  Timothy Hatcher  <timothy@apple.com>
+
+        Fix a crash in Mail when forwarding a specific HTML email.
+        Caused by the fix for <rdar://problem/6512520> (r42096).
+        Unable to create a test case that works outside of Mail.
+
+        <rdar://problem/6796069>
+
+        Reviewed by Ada Chan.
+
+        * editing/markup.cpp:
+        (WebCore::createMarkup): Null check pastEnd before trying to
+        call Range::compareBoundaryPoints.
+
+2009-04-22  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Fix for <rdar://problem/6816957>
+        Turn off Geolocation by default
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2009-04-22  Eric Seidel  <eric@webkit.org>
+
+        Rubber-stamped by David Hyatt.
+
+        Change RenderSVGImage to dump as RenderSVGImage instead of RenderImage
+
+        * rendering/RenderSVGImage.h:
+        (WebCore::RenderSVGImage::renderName):
+
+2009-04-21  Timothy Hatcher  <timothy@apple.com>
+
+        Fix a crash on Gmail when they remove a "before unload" event listener when
+        it was never added to the pending map in the first place.
+
+        <rdar://problem/6814144>
+
+        Reviewed by Darin Adler.
+
+        * page/DOMWindow.cpp:
+        (WebCore::allowsPendingBeforeUnloadListeners): Renamed from shouldAddPendingBeforeUnloadListener.
+        (WebCore::DOMWindow::addEventListener): Call allowsPendingBeforeUnloadListeners now.
+        (WebCore::DOMWindow::removeEventListener): Call allowsPendingBeforeUnloadListeners before
+        removing the before unload listener.
+        (WebCore::DOMWindow::clearAttributeEventListener): Ditto.
+
+2009-04-22  Kenneth Rohde Christiansen  <kenneth.christiansen@openbossa.org>
+
+        Reviewed by Ariya Hidayat.
+
+        Made windowed plugins move/resize synchronized with the painting, so
+        that windowed plugins are not moved before the rest of the parent
+        frame during scrolling.
+
+        * plugins/qt/PluginContainerQt.cpp:
+        (PluginContainerQt::PluginContainerQt):
+        (PluginContainerQt::requestGeometry):
+        (PluginContainerQt::adjustGeometry):
+        * plugins/qt/PluginContainerQt.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+
+2009-04-22  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        Fix various bugs in the X11 Qt plugin focus handling.
+
+        Notify the focus controller on activation/deactivation of the plugin and
+        set focus on the plugin's element when it receives the window system
+        focus.
+
+        * WebCore.pro: Added PluginContainerQt to the Qt build.
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::focusPluginElement): New helper function, moved from PluginViewWin.
+        * plugins/PluginView.h:
+        (WebCore::PluginView::parentFrame): Added parent frame accessor.
+        * plugins/qt/PluginContainerQt.cpp: Added.
+        (PluginContainerQt::PluginContainerQt):
+        (PluginContainerQt::focusInEvent): Set the focus controller active on focus in events.
+        (PluginContainerQt::focusOutEvent): Deactivate the focus controller when loosing the focus.
+        * plugins/qt/PluginContainerQt.h: Added.
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::init): Allocate a PluginContainerQt instead of QX11EmbedContainer.
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::handleMouseEvent): Moved the code to set focus on the plugin element
+        to PluginView::focusPluginElement.
+
+2009-04-22  Tamas Szirbucz  <szirbucz.tamas@stud.u-szeged.hu>
+
+        Reviewed by Ariya Hidayat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25023
+        Delete reply in QNetworkReplyHandler::abort() to avoid leak.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::abort):
+
+2009-04-21  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Allow the UI delegate to control cursor-setting.
+
+        Reviewed by Ada Chan.
+
+        * page/Chrome.cpp:
+        (WebCore::Chrome::setCursor):
+        Pass the call to the client.
+
+        * page/Chrome.h:
+
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::setCursor):
+        Stubbed; returns false.
+
+        * platform/Cursor.h:
+        Define PlatformCursorHandle for each platform.
+
+        * platform/win/WidgetWin.cpp:
+        Reordered some includes. Added an include of Page.h.
+        (WebCore::Widget::setCursor):
+        Fixed a typo in the comment about ignoreNextSetCursor. Get the Page, and
+        call its Chrome's setCursor() method with the passed cursor. Fall back
+        to SetCursor() if the Page is not available.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::handleMouseEvent):
+        Remove an unused variable. Cleaned up some whitespace.
+
+2009-04-21  John Abd-El-Malek  <jam@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add a method to purge the Chromium plugin list cache.
+        https://bugs.webkit.org/show_bug.cgi?id=25318
+
+        * plugins/chromium/PluginDataChromium.cpp:
+        (WebCore::resetChromiumPluginCache):
+
+2009-04-21  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=25164> / <rdar://problem/6786319>.
+
+        We need to ensure that XMLTokenizer sets the current DocLoader before calling in to
+        any libxml2 methods that may trigger a load.  The presence of a DocLoader indicates
+        that the load was originated by WebCore's use of libxml2 and that we should enforce
+        the same-origin policy on it.  XMLTokenizer::initializeParserContext,
+        XMLTokenizer::doWrite and XMLTokenizer::doEnd were three methods that were not setting
+        the current DocLoader when they should have.
+
+        The XMLTokenizerScope class is introduced to simplify the pattern of saving, setting and
+        restoring the current DocLoader and libxml2 error handlers.  The DocLoader and error handlers
+        are saved and set when the scope is allocated, and restored to their previous values when
+        the scope is exited.
+
+        Test: http/tests/security/xss-DENIED-xml-external-entity.xhtml
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/XMLTokenizer.cpp:
+        * dom/XMLTokenizer.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::matchFunc):
+        (WebCore::shouldAllowExternalLoad):
+        (WebCore::openFunc):
+        (WebCore::XMLTokenizer::doWrite):
+        (WebCore::XMLTokenizer::initializeParserContext):
+        (WebCore::XMLTokenizer::doEnd):
+        (WebCore::xmlDocPtrForString):
+        * dom/XMLTokenizerScope.cpp:
+        (WebCore::XMLTokenizerScope::XMLTokenizerScope):
+        (WebCore::XMLTokenizerScope::~XMLTokenizerScope):
+        * dom/XMLTokenizerScope.h:
+        * xml/XSLStyleSheet.cpp:
+        (WebCore::XSLStyleSheet::parseString):
+        * xml/XSLTProcessor.cpp:
+
+2009-04-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/5874009>
+        Add port 3659 (apple-sasl / PasswordServer) to the list of blocked ports.
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::portAllowed):
+
+2009-04-21  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25320
+        Crash when changing block styles in a root that contains no visible content (but contains nodes with renderers)
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::moveParagraphContentsToNewBlockIfNecessary): If the enclosing block is the 
+        root editable element and it contains no visible content, create a new block but don't try and move 
+        content into it, since there's nothing for moveParagraphs to move.
+        
+
+2009-04-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 25162: REGRESSION (r41176-r41242): Drag-selection above/below the line does not select to beginning/end
+        https://bugs.webkit.org/show_bug.cgi?id=25162
+        rdar://problem/6764354
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Initialize editing behavior to Mac-style for PLATFORM(MAC).
+        Later we may want to change this default to encompass other versions running on Mac.
+
+        * page/Settings.h: Added EditingBehavior, setEditingBehavior, editingBehavior, and
+        m_editingBehavior. Also moved m_maximumDecodedImageSize out of the middle of all
+        the bit fields.
+
+        * platform/graphics/IntPoint.h: Added a constructor to turn an IntSize into an IntPoint.
+        I'm not sure the distinction here is serving us well at the moment. When converting from
+        global to local coordinates you want to do IntPoint - IntPoint and have the result be
+        another IntPoint, not an IntSize. And so on.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::positionForPointRespectingEditingBoundaries): Changed to use pointers more and
+        separate coordinates less.
+        (WebCore::RenderBlock::positionForPointWithInlineChildren): Turned into a member function.
+        Added separate cases to support the Mac and Windows behavior.
+        (WebCore::RenderBlock::positionForPoint): Updated for the change above. Also moved the
+        computation of pointInContents closer to the place it's used.
+
+        * rendering/RenderBlock.h: Updated for the new private member function.
+
+2009-04-17  Timothy Hatcher  <timothy@apple.com>
+
+        Change pending unload and beforeunload counts to store the listeners
+        in a single data structure that can be quickly iterated for dispatch.
+
+        <rdar://problem/6383352&6383379&6383940>
+
+        Reviewed by Darin Adler.
+
+        * WebCore.base.exp: Change what symbols are exported.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): Remove count updating code
+        and move an if inside a block already checking m_frame->document().
+        * page/Chrome.cpp: Remove disableSuddenTermination/enableSuddenTermination.
+        * page/Chrome.h: Ditto.
+        * page/ChromeClient.h: Ditto.
+        * page/DOMWindow.cpp:
+        (WebCore::pendingUnloadEventListenerMap): Create a static map.
+        (WebCore::pendingBeforeUnloadEventListenerMap): Ditto.
+        (WebCore::addPendingEventListener): Add the event listener to the map.
+        (WebCore::removePendingEventListener): Remove the event listener from the map.
+        (WebCore::removePendingEventListeners): Remove all listeners for the window.
+        (WebCore::dispatchWindowEventToListeners): Dispatch the event to the given listeners.
+        (WebCore::DOMWindow::dispatchAllPendingBeforeUnloadEvents): Send the beforeunload event.
+        (WebCore::DOMWindow::pendingUnloadEventListeners): Return a count of pending listeners.
+        (WebCore::DOMWindow::dispatchAllPendingUnloadEvents): Send the unload event.
+        (WebCore::DOMWindow::~DOMWindow): Remove the window from both event listener maps.
+        (WebCore::DOMWindow::addEventListener): Call addPendingEventListener when needed.
+        (WebCore::DOMWindow::removeEventListener): Call removePendingEventListener when needed.
+        (WebCore::DOMWindow::removeAllEventListeners): Call removePendingEventListeners.
+        (WebCore::DOMWindow::removeInlineEventListenerForType): Call removePendingEventListener when needed.
+        * page/DOMWindow.h:
+        (WebCore::DOMWindow::frame): Changed to be const.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::EventHandler): Remove count tracking code.
+        * page/EventHandler.h: Ditto.
+        * page/Page.cpp:
+        (WebCore::Page::Page): Ditto.
+        * page/Page.h: Ditto.
+
+2009-04-21  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19644
+        Text copied with Select All pastes with a indent but shouldn't
+        <rdar://problem/6102483> 
+        Pasting the content of an HTML message in Mail causes addition nested <div> elements to be added
+        
+        To improve selectall/copy/paste fidelity of certain pages, we began wrapping copied content with
+        a div that held properties and attributes from the fully selected body.  To fix the above issues, 
+        only do this if if the body has certain properties or attributes.  We'll begin adding to this list as 
+        necessary.  For now it's just background colors and images.  Tested copy/paste of nytimes, wired,
+        arstechnica, and several others.
+        
+        Massive nesting can still happen, it will just be much less common.
+
+        * editing/markup.cpp:
+        (WebCore::createMarkup): 
+
+2009-04-21  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25250
+        Allow platforms to snap the scroll thumb back to the drag origin
+        during a drag.  Implement functions for Safari/Win and Chromium/Win
+        to do this snapping at distances approximating the native ones.
+
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::Scrollbar):
+        (WebCore::Scrollbar::setValue):
+        (WebCore::Scrollbar::scroll):
+        (WebCore::Scrollbar::moveThumb):
+        (WebCore::Scrollbar::setCurrentPos):
+        (WebCore::Scrollbar::mouseMoved):
+        (WebCore::Scrollbar::mouseDown):
+        * platform/Scrollbar.h:
+        * platform/ScrollbarTheme.h:
+        (WebCore::ScrollbarTheme::shouldSnapBackToDragOrigin):
+        * platform/chromium/ScrollbarThemeChromium.h:
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromium::shouldSnapBackToDragOrigin):
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        (WebCore::ScrollbarThemeChromium::shouldSnapBackToDragOrigin):
+        * platform/win/ScrollbarThemeWin.cpp:
+        (WebCore::ScrollbarThemeWin::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeWin::shouldSnapBackToDragOrigin):
+        * platform/win/ScrollbarThemeWin.h:
+
+2009-04-21  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::eventParameterName): Remove unreachable code when SVG is
+        enabled.
+
+2009-04-21  Kevin Ollivier  <kevino@theolliviers.com>
+
+        !ENABLE(SVG) build fix.
+        
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::eventParameterName):
+
+2009-04-21  Dave Moore  <davemoore@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25309
+        Better use AtomicStrings when calling from the V8
+        bindings into WebCore code.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp:
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp:
+
+2009-04-21  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+ 
+        Bug 25304: AX: Safari not identifying a secure text field
+        https://bugs.webkit.org/show_bug.cgi?id=25304
+
+        Secure text fields need to be able to return AXTitleUIElements.
+
+        Test: accessibility/secure-textfield-title-ui.html
+
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+
+2009-04-21  Dan Bernstein  <mitz@apple.com>
+
+        - fix the Tiger build
+
+        * page/mac/EventHandlerMac.mm:
+        (method_setImplementation):
+
+2009-04-21   Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25271
+
+        Fix the build with disabled DOM storage or disabled database support.
+
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        * bindings/js/ScriptObjectQuarantine.h:
+
+2009-04-21  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix.
+
+        Compile fix for r42633. const qualifier does not work
+        on a static method.
+
+        * dom/Document.h:
+        (WebCore::Document::isSVGDocument):
+
+2009-04-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler and John Sullivan.
+
+        - fix <rdar://problem/5914146> Crash at -[NSScrollView scrollWheel:]
+
+        -[NSScrollView scrollWheel:] runs a nested event-tracking run loop
+        in a mode that allows WebCore timers to fire and NSURLConnection
+        callbacks to be dispatched, which can release the NSScrollView and
+        cause it to be deallocated (one example is a DOM timer callback that
+        removes a subframe from the document). This leads to a crash in
+        -scrollView:.
+
+        The fix is to replace the implementation of -[NSScrollView scrollWheel:]
+        with one that optionally retains the receiver for the duration of the
+        call.
+
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::nsScrollViewScrollWheelShouldRetainSelf): Added.
+        (WebCore::setNSScrollViewScrollWheelShouldRetainSelf): Added. Replaces
+        the implementation of -[NSScrollView scrollWheel:] with the
+        self-retaining one, and sets a static boolean that tells it whether to
+        retain the receiver around the call to the original implementation.
+        (WebCore::selfRetainingNSScrollViewScrollWheel): Added. If
+        setNSScrollViewScrollWheelShouldRetainSelf(true) was called and this
+        function is executing on the main thread, it retains the NSScrollView,
+        invokes the original -[NSScrollView scrollWheel:], then releases the
+        view. Otherwise it just calls through to the original implementation.
+        (WebCore::EventHandler::passWheelEventToWidget): Added calls to
+        setNSScrollViewScrollWheelShouldRetainSelf() around the call to
+        -scrollWheel:.
+
+2009-04-21  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Tiger crash fix: Put VM tags in their own header file, and fixed up the
+        #ifdefs so they're not used on Tiger.
+
+        * ForwardingHeaders/wtf/VMTags.h: Copied from WebCore/ForwardingHeaders/wtf/HashTraits.h.
+
+2009-04-21  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Based on a patch by Alp Toker.
+
+        Implement AtkComponent interface.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (core):
+
+2009-04-21  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Only implement AtkAction interface if we actually have an action.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-20  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25290
+        REGRESSION(r41732): Crash when constructing XMLHttpRequest in a detached document
+
+        Test: fast/dom/xmlhttprequest-constructor-in-detached-document.html
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSAudioConstructor.h:
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::getDOMConstructor):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSImageConstructor.h:
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
+        * bindings/js/JSMessageChannelConstructor.h:
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSOptionConstructor.h:
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
+        * bindings/js/JSXMLHttpRequestConstructor.h:
+        Avoid accessing JSDOMGlobalObject via ScriptExecutionContext, since it may not
+        work during frame teardown.
+
+2009-04-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber stamped by Darin Adler and Sam Weinig.
+
+        Renamed "*InlineEventListener*" => "*AttributeEventListener*", and
+        "isInline" => "isAttribute".
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::createJSAttributeEventListener):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::virtualisAttribute):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::create):
+        (WebCore::JSEventListener::isAttribute):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/js/JSLazyEventListener.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/Element.cpp:
+        (WebCore::Element::setWindowAttributeEventListener):
+        * dom/Element.h:
+        * dom/EventListener.h:
+        (WebCore::EventListener::isAttribute):
+        (WebCore::EventListener::virtualisAttribute):
+        * dom/Node.cpp:
+        (WebCore::Node::clearAttributeEventListener):
+        (WebCore::Node::setAttributeEventListener):
+        (WebCore::Node::getAttributeEventListener):
+        (WebCore::Node::onabort):
+        (WebCore::Node::setOnabort):
+        (WebCore::Node::onblur):
+        (WebCore::Node::setOnblur):
+        (WebCore::Node::onchange):
+        (WebCore::Node::setOnchange):
+        (WebCore::Node::onclick):
+        (WebCore::Node::setOnclick):
+        (WebCore::Node::oncontextmenu):
+        (WebCore::Node::setOncontextmenu):
+        (WebCore::Node::ondblclick):
+        (WebCore::Node::setOndblclick):
+        (WebCore::Node::onerror):
+        (WebCore::Node::setOnerror):
+        (WebCore::Node::onfocus):
+        (WebCore::Node::setOnfocus):
+        (WebCore::Node::oninput):
+        (WebCore::Node::setOninput):
+        (WebCore::Node::onkeydown):
+        (WebCore::Node::setOnkeydown):
+        (WebCore::Node::onkeypress):
+        (WebCore::Node::setOnkeypress):
+        (WebCore::Node::onkeyup):
+        (WebCore::Node::setOnkeyup):
+        (WebCore::Node::onload):
+        (WebCore::Node::setOnload):
+        (WebCore::Node::onmousedown):
+        (WebCore::Node::setOnmousedown):
+        (WebCore::Node::onmousemove):
+        (WebCore::Node::setOnmousemove):
+        (WebCore::Node::onmouseout):
+        (WebCore::Node::setOnmouseout):
+        (WebCore::Node::onmouseover):
+        (WebCore::Node::setOnmouseover):
+        (WebCore::Node::onmouseup):
+        (WebCore::Node::setOnmouseup):
+        (WebCore::Node::onmousewheel):
+        (WebCore::Node::setOnmousewheel):
+        (WebCore::Node::onbeforecut):
+        (WebCore::Node::setOnbeforecut):
+        (WebCore::Node::oncut):
+        (WebCore::Node::setOncut):
+        (WebCore::Node::onbeforecopy):
+        (WebCore::Node::setOnbeforecopy):
+        (WebCore::Node::oncopy):
+        (WebCore::Node::setOncopy):
+        (WebCore::Node::onbeforepaste):
+        (WebCore::Node::setOnbeforepaste):
+        (WebCore::Node::onpaste):
+        (WebCore::Node::setOnpaste):
+        (WebCore::Node::ondragenter):
+        (WebCore::Node::setOndragenter):
+        (WebCore::Node::ondragover):
+        (WebCore::Node::setOndragover):
+        (WebCore::Node::ondragleave):
+        (WebCore::Node::setOndragleave):
+        (WebCore::Node::ondrop):
+        (WebCore::Node::setOndrop):
+        (WebCore::Node::ondragstart):
+        (WebCore::Node::setOndragstart):
+        (WebCore::Node::ondrag):
+        (WebCore::Node::setOndrag):
+        (WebCore::Node::ondragend):
+        (WebCore::Node::setOndragend):
+        (WebCore::Node::onreset):
+        (WebCore::Node::setOnreset):
+        (WebCore::Node::onresize):
+        (WebCore::Node::setOnresize):
+        (WebCore::Node::onscroll):
+        (WebCore::Node::setOnscroll):
+        (WebCore::Node::onsearch):
+        (WebCore::Node::setOnsearch):
+        (WebCore::Node::onselect):
+        (WebCore::Node::setOnselect):
+        (WebCore::Node::onselectstart):
+        (WebCore::Node::setOnselectstart):
+        (WebCore::Node::onsubmit):
+        (WebCore::Node::setOnsubmit):
+        (WebCore::Node::onunload):
+        (WebCore::Node::setOnunload):
+        * dom/Node.h:
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment):
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::parseMappedAttribute):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::parseMappedAttribute):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::parseMappedAttribute):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parseMappedAttribute):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::parseMappedAttribute):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::mouseButtonListener):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::setAttributeEventListener):
+        (WebCore::DOMWindow::clearAttributeEventListener):
+        (WebCore::DOMWindow::getAttributeEventListener):
+        (WebCore::DOMWindow::onabort):
+        (WebCore::DOMWindow::setOnabort):
+        (WebCore::DOMWindow::onblur):
+        (WebCore::DOMWindow::setOnblur):
+        (WebCore::DOMWindow::onchange):
+        (WebCore::DOMWindow::setOnchange):
+        (WebCore::DOMWindow::onclick):
+        (WebCore::DOMWindow::setOnclick):
+        (WebCore::DOMWindow::ondblclick):
+        (WebCore::DOMWindow::setOndblclick):
+        (WebCore::DOMWindow::onerror):
+        (WebCore::DOMWindow::setOnerror):
+        (WebCore::DOMWindow::onfocus):
+        (WebCore::DOMWindow::setOnfocus):
+        (WebCore::DOMWindow::onkeydown):
+        (WebCore::DOMWindow::setOnkeydown):
+        (WebCore::DOMWindow::onkeypress):
+        (WebCore::DOMWindow::setOnkeypress):
+        (WebCore::DOMWindow::onkeyup):
+        (WebCore::DOMWindow::setOnkeyup):
+        (WebCore::DOMWindow::onload):
+        (WebCore::DOMWindow::setOnload):
+        (WebCore::DOMWindow::onmousedown):
+        (WebCore::DOMWindow::setOnmousedown):
+        (WebCore::DOMWindow::onmousemove):
+        (WebCore::DOMWindow::setOnmousemove):
+        (WebCore::DOMWindow::onmouseout):
+        (WebCore::DOMWindow::setOnmouseout):
+        (WebCore::DOMWindow::onmouseover):
+        (WebCore::DOMWindow::setOnmouseover):
+        (WebCore::DOMWindow::onmouseup):
+        (WebCore::DOMWindow::setOnmouseup):
+        (WebCore::DOMWindow::onmousewheel):
+        (WebCore::DOMWindow::setOnmousewheel):
+        (WebCore::DOMWindow::onreset):
+        (WebCore::DOMWindow::setOnreset):
+        (WebCore::DOMWindow::onresize):
+        (WebCore::DOMWindow::setOnresize):
+        (WebCore::DOMWindow::onscroll):
+        (WebCore::DOMWindow::setOnscroll):
+        (WebCore::DOMWindow::onsearch):
+        (WebCore::DOMWindow::setOnsearch):
+        (WebCore::DOMWindow::onselect):
+        (WebCore::DOMWindow::setOnselect):
+        (WebCore::DOMWindow::onsubmit):
+        (WebCore::DOMWindow::setOnsubmit):
+        (WebCore::DOMWindow::onunload):
+        (WebCore::DOMWindow::setOnunload):
+        (WebCore::DOMWindow::onbeforeunload):
+        (WebCore::DOMWindow::setOnbeforeunload):
+        (WebCore::DOMWindow::onwebkitanimationstart):
+        (WebCore::DOMWindow::setOnwebkitanimationstart):
+        (WebCore::DOMWindow::onwebkitanimationiteration):
+        (WebCore::DOMWindow::setOnwebkitanimationiteration):
+        (WebCore::DOMWindow::onwebkitanimationend):
+        (WebCore::DOMWindow::setOnwebkitanimationend):
+        (WebCore::DOMWindow::onwebkittransitionend):
+        (WebCore::DOMWindow::setOnwebkittransitionend):
+        * page/DOMWindow.h:
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::parseMappedAttribute):
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::onabort):
+        (WebCore::SVGElementInstance::setOnabort):
+        (WebCore::SVGElementInstance::onblur):
+        (WebCore::SVGElementInstance::setOnblur):
+        (WebCore::SVGElementInstance::onchange):
+        (WebCore::SVGElementInstance::setOnchange):
+        (WebCore::SVGElementInstance::onclick):
+        (WebCore::SVGElementInstance::setOnclick):
+        (WebCore::SVGElementInstance::oncontextmenu):
+        (WebCore::SVGElementInstance::setOncontextmenu):
+        (WebCore::SVGElementInstance::ondblclick):
+        (WebCore::SVGElementInstance::setOndblclick):
+        (WebCore::SVGElementInstance::onerror):
+        (WebCore::SVGElementInstance::setOnerror):
+        (WebCore::SVGElementInstance::onfocus):
+        (WebCore::SVGElementInstance::setOnfocus):
+        (WebCore::SVGElementInstance::oninput):
+        (WebCore::SVGElementInstance::setOninput):
+        (WebCore::SVGElementInstance::onkeydown):
+        (WebCore::SVGElementInstance::setOnkeydown):
+        (WebCore::SVGElementInstance::onkeypress):
+        (WebCore::SVGElementInstance::setOnkeypress):
+        (WebCore::SVGElementInstance::onkeyup):
+        (WebCore::SVGElementInstance::setOnkeyup):
+        (WebCore::SVGElementInstance::onload):
+        (WebCore::SVGElementInstance::setOnload):
+        (WebCore::SVGElementInstance::onmousedown):
+        (WebCore::SVGElementInstance::setOnmousedown):
+        (WebCore::SVGElementInstance::onmousemove):
+        (WebCore::SVGElementInstance::setOnmousemove):
+        (WebCore::SVGElementInstance::onmouseout):
+        (WebCore::SVGElementInstance::setOnmouseout):
+        (WebCore::SVGElementInstance::onmouseover):
+        (WebCore::SVGElementInstance::setOnmouseover):
+        (WebCore::SVGElementInstance::onmouseup):
+        (WebCore::SVGElementInstance::setOnmouseup):
+        (WebCore::SVGElementInstance::onmousewheel):
+        (WebCore::SVGElementInstance::setOnmousewheel):
+        (WebCore::SVGElementInstance::onbeforecut):
+        (WebCore::SVGElementInstance::setOnbeforecut):
+        (WebCore::SVGElementInstance::oncut):
+        (WebCore::SVGElementInstance::setOncut):
+        (WebCore::SVGElementInstance::onbeforecopy):
+        (WebCore::SVGElementInstance::setOnbeforecopy):
+        (WebCore::SVGElementInstance::oncopy):
+        (WebCore::SVGElementInstance::setOncopy):
+        (WebCore::SVGElementInstance::onbeforepaste):
+        (WebCore::SVGElementInstance::setOnbeforepaste):
+        (WebCore::SVGElementInstance::onpaste):
+        (WebCore::SVGElementInstance::setOnpaste):
+        (WebCore::SVGElementInstance::ondragenter):
+        (WebCore::SVGElementInstance::setOndragenter):
+        (WebCore::SVGElementInstance::ondragover):
+        (WebCore::SVGElementInstance::setOndragover):
+        (WebCore::SVGElementInstance::ondragleave):
+        (WebCore::SVGElementInstance::setOndragleave):
+        (WebCore::SVGElementInstance::ondrop):
+        (WebCore::SVGElementInstance::setOndrop):
+        (WebCore::SVGElementInstance::ondragstart):
+        (WebCore::SVGElementInstance::setOndragstart):
+        (WebCore::SVGElementInstance::ondrag):
+        (WebCore::SVGElementInstance::setOndrag):
+        (WebCore::SVGElementInstance::ondragend):
+        (WebCore::SVGElementInstance::setOndragend):
+        (WebCore::SVGElementInstance::onreset):
+        (WebCore::SVGElementInstance::setOnreset):
+        (WebCore::SVGElementInstance::onresize):
+        (WebCore::SVGElementInstance::setOnresize):
+        (WebCore::SVGElementInstance::onscroll):
+        (WebCore::SVGElementInstance::setOnscroll):
+        (WebCore::SVGElementInstance::onsearch):
+        (WebCore::SVGElementInstance::setOnsearch):
+        (WebCore::SVGElementInstance::onselect):
+        (WebCore::SVGElementInstance::setOnselect):
+        (WebCore::SVGElementInstance::onselectstart):
+        (WebCore::SVGElementInstance::setOnselectstart):
+        (WebCore::SVGElementInstance::onsubmit):
+        (WebCore::SVGElementInstance::setOnsubmit):
+        (WebCore::SVGElementInstance::onunload):
+        (WebCore::SVGElementInstance::setOnunload):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::parseMappedAttribute):
+
+2009-04-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Approved by Mark Rowe, Cameron Zwarich, Oliver Hunt, and Ojan Vafai.
+        
+        Used svn merge to roll out revisions 42678, 42690, 42694, 42697 because
+        they broke the Tiger and Windows buildbots.
+
+        * css/html4.css:
+        * css/themeWin.css:
+        * platform/graphics/SimpleFontData.cpp:
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        * platform/graphics/win/SimpleFontDataCGWin.cpp:
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        * rendering/RenderTextControl.cpp:
+        * rendering/RenderTextControlMultiLine.cpp:
+        * rendering/RenderTextControlSingleLine.cpp:
+
+2009-04-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Adam Roben.
+
+        One last loose end, discovered using COLLECT_ON_EVERY_ALLOCATION, for
+        https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+        
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::mark): Don't ASSERT that an ElementInstance's
+        correspondingElement has a JS wrapper. If a GC falls exactly between the
+        allocation of the ElementInstance wrapper and the correspondingElement
+        wrapper, the correspondingElement won't have a wrapper at the time we
+        mark the ElementInstance's wrapper.
+
+2009-04-20  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Mark Rowe
+
+        Clean builds are broken on case-sensitive filesystems.  Let's fix, shall we?
+
+        * platform/graphics/SimpleFontData.cpp: Remove "String.h" include.  Ojan probably intended to include
+          "PlatformString.h" which was unnecessary because it is pulled in through other headers.  This wasn't a 
+          build failure on case-insensitive file systems because those systems would find the system <string.h>, averting
+          the warning.
+
+2009-04-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Last patch for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+        
+        Converted "lazy" event listeners to be unprotected, just like all the others.
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        (WebCore::JSEventListener::jsFunction):
+        (WebCore::JSEventListener::markJSFunction):
+        (WebCore::JSEventListener::handleEvent):
+        (WebCore::JSEventListener::virtualIsInline):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::isInline): Merged JSAbstractEventListener
+        into JSEventListener. Now that the only difference between JSEventListener
+        and JSLazyEventListener is that JSLazyEventListener compiles lazily,
+        there's no need for an abstract base class.
+
+        * bindings/js/JSLazyEventListener.cpp: Converted JSLazyEventListener to
+        inherit from JSEventListener and match its un-GC-protected behavior.
+        (WebCore::JSLazyEventListener::JSLazyEventListener): ditto
+        (WebCore::JSLazyEventListener::parseCode): ditto
+        (WebCore::createInlineEventListener): When creating a lazy event listener,
+        ensure that the related node has a JS wrapper to mark the listener. Since
+        the parser makes these listeners, it's possible that no JS reference has
+        been made to the node yet.
+        * bindings/js/JSLazyEventListener.h: ditto
+
+        * dom/EventListener.h:
+        (WebCore::EventListener::clearJSFunction): Removed an usused function.
+
+2009-04-20  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25299
+        Don't bound caret to root line box if it is still inside its containing block
+        
+        Can't yet write tests for behavior of non-standard caret widths.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::localCaretRect):
+
+2009-04-20  Steve Falkenburg  <sfalken@apple.com>
+
+        Separate JavaScriptCore.dll from WebKit.dll.
+        Slight performance improvement or no change on benchmarks.
+        
+        Allows us to break a circular dependency between CFNetwork and WebKit on Windows,
+        and simplifies standalone JavaScriptCore builds.
+
+        Reviewed by Oliver Hunt.
+
+        * config.h: Specify __declspec(dllexport/dllimport) appropriately when exporting data.
+
+2009-04-20  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6722845> In the Cocoa event model, NPWindow's window field should be null
+
+        * bridge/npapi.h:
+        (_NPCocoaEvent::):
+        Add a CGContextRef member to the draw struct. Add an NPCoordinateSpace enum.
+        
+        * plugins/npfunctions.h:
+        Add a prototype for NPN_ConvertPoint.
+
+2009-04-10  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Make textarea and text input metrics more closely match IEs.
+        https://bugs.webkit.org/show_bug.cgi?id=15312
+
+        This involves:
+        -set text input width to size*avgCharWidth + maxCharWidth - avgCharWidth
+        -set textarea width to cols*avgCharWidth
+        -Make default CSS match IEs
+        -Correctly initializing m_avgCharWidth and m_maxCharWidth for each platform and SVG.
+
+        Those values for textarea and inputs were derived by doing a ton of manual
+        testing of IE's width values for various textareas and fonts.
+
+        To get the average and max character width of a font, we do the following
+        for each platform:
+        -Win: TextMetrics expose avgCharWidth and maxCharWidth
+        -SVG: avgCharWidth = width of an '0', fallback on width of a space glyph, then m_xHeight
+            maxCharWidth = width of a 'W' for roman fonts, fallback on m_ascent
+        -Linux: avgCharWidth = width of an '0', fallback on m_xHeight
+            maxCharWidth = max of avgCharWidth and m_ascent
+        -Mac: look in the OS/2 table for avgCharWidth and grab the maxCharWidth off the font.
+            If either one is not there, then calculate the value using the Linux approach.
+
+        Linux ports could probably dig into the OS/2 table as well, but I'll leave
+        that up to them to implement.
+
+        Tests: fast/forms/text-control-intrinsic-widths.html
+               fast/forms/textarea-metrics.html
+               svg/custom/svg-fonts-in-text-controls.html
+
+        * css/html4.css:
+        * css/themeWin.css:
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData):
+        (WebCore::SimpleFontData::initCharWidths):
+        * platform/graphics/SimpleFontData.h:
+        (WebCore::SimpleFontData::maxCharWidth):
+        (WebCore::SimpleFontData::avgCharWidth):
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/win/SimpleFontDataCGWin.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+        (WebCore::SimpleFontData::initGDIFont):
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        (WebCore::SimpleFontData::platformCharWidthInit):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::calcPrefWidths):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::preferredContentWidth):
+
+2009-04-17  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Remove m_absoluteBounds hack from SVG renderers and move outlineBoundsForRepaint into RenderSVGModelObject
+        https://bugs.webkit.org/show_bug.cgi?id=25276
+
+        This also exposed a buggy paint check in RenderSVGContainer::layout()
+        we should repaint if we are self painting OR if our kids changed, not AND.
+
+        Writing real outlineBoundsForRepaint required writing a mapLocalToContainer() function
+
+        No functional changes, thus no tests.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::localToParentTransform):
+        (WebCore::RenderPath::layout):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::layout):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::mapLocalToContainer):
+        (WebCore::RenderSVGModelObject::outlineBoundsForRepaint):
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::layout):
+        (WebCore::RenderSVGRoot::paint):
+        (WebCore::RenderSVGRoot::localToParentTransformWithoutCSSParentOffset):
+        (WebCore::RenderSVGRoot::localToParentTransform):
+        (WebCore::RenderSVGRoot::computeRectForRepaint):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::layout):
+
+2009-04-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel
+
+        https://bugs.webkit.org/show_bug.cgi?id=25282
+        
+        outlineBoundsForRepaint() should compute a quad relative to the
+        repaintContainer. This fixes the repaint issues originally fixed in
+        https://bugs.webkit.org/show_bug.cgi?id=12885 for elements in compositing layers.
+        Failure was only apparent when building with ACCELERATED_COMPOSITING enabled.
+
+        Tests: compositing/repaint/content-into-overflow.html
+               compositing/repaint/overflow-into-content.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::outlineBoundsForRepaint):
+
+2009-04-20  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Tim Hatcher.
+
+        Add licenses for xcconfig files.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/FeatureDefines.xcconfig:
+        * Configurations/Version.xcconfig:
+        * Configurations/WebCore.xcconfig:
+
+2009-04-20  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25261
+        Implement the V8 binding for DOMWindow.event similarly to JSC, by using
+        the custom getter boilerplate from the IDL file. 
+        Also, stub out DOMWindow.crypto which is defined by the idl.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+
+2009-04-20  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25243
+        Crash when data:// loads are cancelled
+
+        Properly handle cancellation of the load for data:// loads. This
+        fixes crashing in the followin test:
+
+        plugins/return-error-from-new-stream-callback-in-full-frame-plugin.html
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::parseDataUrl):
+
+2009-04-19  Dan Bernstein  <mitz@apple.com>
+
+        - maybe fix release builds
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::notifyFinished):
+
+2009-04-19  Dan Bernstein  <mitz@apple.com>
+
+        - not fix release builds
+
+        * dom/Document.cpp:
+        (WebCore::Document::executeScriptSoonTimerFired):
+
+2009-04-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix <rdar://problem/6734365> REGRESSION eBay "Save this search" link
+          does nothing the second time search results are opened
+
+        Test: fast/dom/HTMLScriptElement/nested-execution.html
+
+        Instead of executing scripts as soon as they finish loading, which may
+        happen synchronously during execution of another script, defer their
+        execution until the next run loop iteration, using a queue that is
+        similar to the HTML5 notion of the "list of scripts that will execute as
+        soon as possible", and in my testing was consistent with how Firefox
+        behaved.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Initialize m_executeScriptSoonTimer.
+        (WebCore::Document::~Document): deref() script elements in
+        m_scriptsToExecuteSoon.
+        (WebCore::Document::executeScriptSoonTimerFired): Added. Executes the
+        scripts in m_scriptsToExecuteSoon and deref()s them.
+        (WebCore::Document::executeScriptSoon): Added. Appends to
+        m_scriptsToExecuteSoon and ref()s the script element, which keeps the
+        ScriptElementData alive as well.
+        * dom/Document.h:
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::ScriptElementData): Initialize m_requested.
+        (WebCore::ScriptElementData::requestScript): Set m_requested to true, to
+        prevent further load requests.
+        (WebCore::ScriptElementData::execute): Added. Moved the code from
+        notifyFinished() which should not execute synchronously here, to be
+        called by the Document on a 0-interval timer.
+        (WebCore::ScriptElementData::notifyFinished): Moved the code to
+        dispatch events and evaluate the script, which should not execute
+        synchronously, out of here.
+        (WebCore::ScriptElementData::ignoresLoadRequest): Changed to test for
+        m_requested instead of m_cachedScript, because the latter is cleared
+        before the script is evaluated.
+        * dom/ScriptElement.h:
+
+2009-04-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Antti Koivisto and Darin Adler.
+
+        <rdar://problem/6127705> Excessive memory consumption on image load failure
+
+        When we fail to decode an image we clear most of the image data, but not the
+        input data itself, which can be backed by a CFData object that itself holds onto
+        a few hundred Kbs of memory.  This patch merely ensures that this buffer gets
+        cleared.
+
+        * loader/CachedImage.cpp:
+        (WebCore::CachedImage::error):
+
+2009-04-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add hooks so sudden termination will not cause loss of icons or local storage.
+        rdar://problem/5951701
+
+        * loader/icon/IconDatabase.cpp: Marked various constants static to give them
+        internal linkage.
+        (WebCore::IconDatabase::IconDatabase): Added initial value for m_syncTimer.
+        Removed unneeded initial value for m_defaultIconRecord. Changed assertion to
+        work cross-platform.
+        (WebCore::IconDatabase::wakeSyncThread): Added disableSuddenTermination, so
+        we won't terminate until the sync thread has done its thing.
+        (WebCore::IconDatabase::scheduleOrDeferSyncTimer): Added disableSuddenTermination,
+        so we won't terminate if we have an outstanding sync timer.
+        (WebCore::IconDatabase::syncTimerFired): Added enableSuddenTermination, to
+        balance the one in scheduleOrDeferSyncTimer.
+        (WebCore::IconDatabase::syncThreadMainLoop): Added enableSuddenTermination, to
+        balance the one in wakeSyncThread.
+        (WebCore::IconDatabase::deleteAllPreparedStatements): Use clear() instead of set(0).
+
+        * loader/icon/IconDatabase.h: Use a Timer instead of an OwnPtr<Timer>.
+
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::scheduleFinalSync): Added disableSuddenTermination.
+        (WebCore::LocalStorageArea::scheduleItemForSync): Ditto.
+        (WebCore::LocalStorageArea::scheduleClear): Ditto.
+        (WebCore::LocalStorageArea::syncTimerFired): Added a disableSuddenTermination if
+        we schedule a performSync callback for later and an unconditional
+        enableSuddenTermination to balance the ones in the schedule calls above.
+        (WebCore::LocalStorageArea::sync): Factored out the work of the sync function so it
+        can continue to use early return idiom.
+        (WebCore::LocalStorageArea::performSync): Added a call to enableSuddenTermination.
+
+        * storage/LocalStorageArea.h: Added declaration of the sync function.
+
+2009-04-19  David Kilzer  <ddkilzer@apple.com>
+
+        Make FEATURE_DEFINES completely dynamic
+
+        Reviewed by Darin Adler.
+
+        Make FEATURE_DEFINES depend on individual ENABLE_FEATURE_NAME
+        variables for each feature, making it possible to remove all
+        knowledge of FEATURE_DEFINES from build-webkit.
+
+        * Configurations/FeatureDefines.xcconfig: Extract a variable
+        from FEATURE_DEFINES for each feature setting.
+
+2009-04-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        More fix for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+        
+        Removed a little more complexity from event handler creation and destruction.
+        
+        Removed the jsProtectedEventListeners, jsProtectedInlineEventListeners,
+        and jsInlineEventListeners maps, and all the code for managing them.
+        
+        ProtectedEventListeners don't exist anymore, so they're easy to nix.
+        
+        Inline EventListeners do still exist, but there's no reason to track
+        them in a map. The map exists to enable 'removeEventListener' to associate
+        a unique JSEventListener with a given JavaScript function. But the
+        'removeEventListener' API only works with non-inline event listeners!
+        
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::~JSDOMGlobalObject):
+        (WebCore::JSDOMGlobalObject::findJSEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSEventListener):
+        (WebCore::JSDOMGlobalObject::createJSInlineEventListener):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::clearJSFunctionInline):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::~JSLazyEventListener):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-04-18  Dan Bernstein  <mitz@apple.com>
+
+        - try to fix the Windows build
+
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::characterAfter):
+
+2009-04-18  Dan Bernstein  <mitz@apple.com>
+
+        - revert the previous change, which was to a file that the Windows
+          port does not even use
+
+        * icu/unicode/utf16.h:
+
+2009-04-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        - try to fix the Windows build
+
+        * icu/unicode/utf16.h:
+
+2009-04-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Antti Koivisto.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25066
+        
+        When a <video> element gained a RenderLayer via opacity, reflection etc., the
+        layer hierarchy was not correctly updated because RenderMedia skipped a level
+        when asked for its children; it skipped m_controlsShadowRoot's renderer, which
+        actually has a layer.
+
+        Test: fast/layers/video-layer.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlShadowRootElement::MediaControlShadowRootElement):
+        Don't manually call setParent() on the renderer. It will happen later
+        as a result of addChild().
+        
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createControlsShadowRoot):
+        Add m_controlsShadowRoot's renderer as a child. 
+
+        * rendering/RenderMedia.h:
+        (WebCore::RenderMedia::children):
+        Now maintain a RenderObjectChildList, m_children, and remove the unneeded
+        removeChild() method. Make the two children() methods inline.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::moveLayers):
+        Assert if moveLayers() is called with an oldParent that is not the
+        layer's actual parent (which would have revealed this bug).
+
+2009-04-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fixed a layout test failure, caused by my last check-in
+        (fast/dom/script-element-gc.html).
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM):
+        * html/HTMLScriptElement.h:
+        (WebCore::HTMLScriptElement::haveFiredLoadEvent): Treat script elements
+        just like image elements: if a script element is loading, mark its JS
+        wrapper, even if the element is not in the document.
+
+2009-04-18  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25170
+        Upstream V8WorkerCustom.cpp and V8WorkerContextCustom.cpp for V8 bindings.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8WorkerContextCustom.cpp: Added.
+        * bindings/v8/custom/V8WorkerCustom.cpp: Added.
+
+2009-04-18  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/post_bug.cg://bugs.webkit.org/show_bug.cgi?id=25167 
+        Change createHiddenXHRDependency and removeHiddenXHRDependency so that they can be used by other custom code in V8 bindings.
+
+        * bindings/v8/V8Utilities.cpp: Renamed from WebCore/bindings/v8/V8XMLHttpRequestUtilities.cpp.
+        (WebCore::createHiddenDependency):
+        (WebCore::removeHiddenDependency):
+        * bindings/v8/V8Utilities.h: Renamed from WebCore/bindings/v8/V8XMLHttpRequestUtilities.h.
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp:
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-04-18  Drew Wilson  <amw@apple.com>
+
+        <rdar://problem/6781407> VisiblePosition.characterAfter should return UChar32
+
+        Reviewed by Dan Bernstein.
+
+        No test case since there is no change in behavior.
+
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::characterAfter): Now handles surrogate
+        pairs correctly and returns a UChar32.
+        * editing/VisiblePosition.h:
+        (WebCore::VisiblePosition::characterBefore): Now returns a UChar32.
+        * editing/visible_units.cpp:
+        (WebCore::endOfFirstWordBoundaryContext): Renamed
+        firstNonComplexContextLineBreak() to this. Changed it to use the
+        generic requiresContextForWordBoundary() instead of
+        hasLineBreakingPropertyComplexContext().
+        (WebCore::startOfLastWordBoundaryContext): Replaces
+        lastNonComplexContextLineBreak(), but returns the offset of
+        the character after the last character that does not require
+        context for word breaking. Also changed to use
+        requiresContextForWordBoundary().
+        (WebCore::previousBoundary): Updated for the above changes in
+        names and semantics, and changed to use
+        requiresContextForWordBoundary().
+        (WebCore::nextBoundary): Ditto.
+        (WebCore::startWordBoundary): Ditto.
+        (WebCore::endWordBoundary): Ditto.
+        (WebCore::previousWordPositionBoundary): Ditto.
+        (WebCore::nextWordPositionBoundary): Ditto.
+        * platform/text/TextBoundaries.h:
+        (WebCore::requiresContextForWordBoundary): Added.
+        * platform/text/mac/TextBoundaries.mm:
+
+2009-04-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fixed <rdar://problem/6797442> | https://bugs.webkit.org/show_bug.cgi?id=25285
+        REGRESSION (r42569): Profiles cannot be selected in inspector profiler
+        
+        EventListeners are shared; RegisteredEventListeners are not. Therefore,
+        when a node wrapper needs to invalidate the node's JS event listeners,
+        it should invalidate its RegisteredEventListeners, not its EventListeners.
+        Otherwise, it might invalidate an EventListener shared by another node.
+
+        * dom/RegisteredEventListener.h:
+        (WebCore::invalidateEventListeners): ditto
+
+2009-04-18  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6781295> video.buffered and video.seekable are not
+        the same. video.buffered should return only what is buffered and
+        not what is seekable
+
+        * WebCore.base.exp: Added wkQTMovieMaxTimeSeekable.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::maxTimeSeekable): Return wkQTMovieMaxTimeSeekable.
+
+        * platform/mac/WebCoreSystemInterface.h: Add wkQTMovieMaxTimeSeekable.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+
+2009-04-18  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/6747241> work around QTKit no longer reaching
+        QTMovieLoadStateComplete
+
+        * WebCore.base.exp: Export wkQTMovieMaxTimeLoadedChangeNotification.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovie): observe QTMovieMaxTimeLoadedChangeNotification.
+        (WebCore::MediaPlayerPrivate::updateStates): compare duuration() with maxTimeLoaded() instead of
+        using QTMovieLoadStateComplete to determine if a movie are fully loaded.
+
+        * platform/mac/WebCoreSystemInterface.h: Add wkQTMovieMaxTimeLoadedChangeNotification.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+
+2009-04-18  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Make WML work again, most regressions test were failing.
+
+        * dom/Document.cpp: Be sure to create WML elements in WML namespace. Otherwhise hasTagName() comparisions fail.
+        (WebCore::Document::createElement):
+        * wml/WMLCardElement.cpp: Add ASSERT(hasTagName(cardTag)) to catch errors like this in future.
+        (WebCore::WMLCardElement::WMLCardElement):
+        * wml/WMLTagNames.in: Wrap comment in #if 0/#endif blocks, to silence the generation script.
+
+2009-04-17  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25277
+        If there is no line wrapping, a caret can leave its containing block but it shouldn't leave its root line box
+        
+        Also added code to handle a caret wider than one pixel.
+        
+        Added fast/inline/25277.html and fast/inline/25277-2.html
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::localCaretRect): Distribute a caret's width to either side of the offset,
+        so that a caret between two characters doesn't hang over one character more than the other.
+        If there is no wrapping, the caret can leave its containing block, but not its root line box.
+
+2009-04-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        More fix for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+        
+        Some refactoring of "inline" event listeners.
+        
+        Renames:
+            dispatchEventForType => dispatchEvent
+            setWindowInlineEventListenerForTypeAndAttribute => setWindowInlineEventListener
+            removeInlineEventListenerForType => clearInlineEventListener
+            setInlineEventListenerForType => setInlineEventListener
+            inlineEventListenerForType => getInlineEventListener
+
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::eventParameterName):
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::createInlineEventListener):
+        * bindings/js/JSLazyEventListener.h: Added two helper functions for
+        creating "inline" event listeners. These replace Document::createEventListener,
+        and abstract the creation of JS event listeners for DOM attributes out
+        of the DOM. Removed legacy JSProtectedEventListener constructor code for
+        adding the event listener's function to a map, since lazy event listeners
+        don't have functions at construction time.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * dom/Document.h:
+        (WebCore::Document::isSVGDocument):
+        * dom/Element.cpp:
+        (WebCore::Element::setWindowInlineEventListener):
+        * dom/Element.h: Updated for renames. Nixed Document::createEventListener,
+        mentioned above. Moved setWindowInlineEventListenerForTypeAndAttribute
+        to Element, for simplicity.
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::setValueFromRenderer):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchFocusEvent):
+        (WebCore::Node::dispatchBlurEvent):
+        (WebCore::Node::dispatchEvent):
+        (WebCore::Node::clearInlineEventListener):
+        (WebCore::Node::setInlineEventListener):
+        (WebCore::Node::getInlineEventListener):
+        (WebCore::Node::onabort):
+        (WebCore::Node::setOnabort):
+        (WebCore::Node::etc.):
+        * dom/Node.h: Updated for renames.
+        
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment): Updated for renames.
+        
+        Updated these files for renames, and to use the new createInlineEventListener
+        helper function:
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::parseMappedAttribute):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::onChange):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::prepareSubmit):
+        (WebCore::HTMLFormElement::reset):
+        (WebCore::HTMLFormElement::parseMappedAttribute):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::parseMappedAttribute):
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::dispatchLoadEvent):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::onSearch):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadInternal):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parseMappedAttribute):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::parseMappedAttribute):
+        (WebCore::HTMLScriptElement::dispatchLoadEvent):
+        (WebCore::HTMLScriptElement::dispatchErrorEvent):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::notifyFinished):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::mouseButtonListener):
+        * page/DOMWindow.cpp:
+        * page/DOMWindow.h:
+        (WebCore::DOMWindow::eventListeners):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::canMouseDownStartSelect):
+        (WebCore::EventHandler::canMouseDragExtendSelect):
+        (WebCore::EventHandler::sendScrollEvent):
+        * page/Page.cpp:
+        (WebCore::networkStateChanged):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::valueChanged):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::selectionChanged):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::parseMappedAttribute):
+        * svg/SVGElementInstance.cpp:
+        * svg/SVGImageLoader.cpp:
+        (WebCore::SVGImageLoader::dispatchLoadEvent):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::parseMappedAttribute):
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::dispatchErrorEvent):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-04-17  David Kilzer  <ddkilzer@apple.com>
+
+        Simplify FEATURE_DEFINES definition
+
+        Reviewed by Darin Adler.
+
+        This moves FEATURE_DEFINES and its related ENABLE_FEATURE_NAME
+        variables to their own FeatureDefines.xcconfig file.  It also
+        extracts a new ENABLE_GEOLOCATION variable so that
+        FEATURE_DEFINES only needs to be defined once.
+
+        * Configurations/FeatureDefines.xcconfig: Added.
+        * Configurations/WebCore.xcconfig: Removed definition of
+        ENABLE_SVG_DOM_OBJC_BINDINGS and FEATURE_DEFINES.  Added include
+        of FeatureDefines.xcconfig.
+        * WebCore.xcodeproj/project.pbxproj: Added
+        FeatureDefines.xcconfig file.
+        * bindings/scripts/CodeGeneratorObjC.pm: When creating a list of
+        command-line macro definitions, split on one-or-more spaces
+        instead of a single space since the FEATURE_DEFINES macro may
+        now contain more than one space between macros if some macros
+        aren't defined.
+
+2009-04-17  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Mark Rowe
+
+        <rdar://problem/6786999> Tiger WebKit shouldn't try to POST on back/forward without nagging.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::willLoadFromCache):
+
+2009-04-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Added sudden termination functions that can be called without involving
+        the page or client.
+
+        * GNUmakefile.am: Added SuddenTermination.h.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto. Also added SuddenTermination.mm.
+
+        * platform/SuddenTermination.h: Added.
+        * platform/mac/SuddenTermination.mm: Added.
+
+2009-04-17  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Move more code into RenderSVGModelObject
+
+        needsLayer() already returns false from RenderSVGModelObject
+        lineHeight and baselinePosition are from days of RenderPath having RenderBox parents.
+
+        I also added comments to explain how focus rings work (now that I understand)
+        I got rid of two more uses of m_absoluteBounds (nearly dead!)
+
+        * rendering/RenderPath.cpp:
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+        (WebCore::RenderSVGContainer::addFocusRingRects):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::absoluteRects):
+        (WebCore::RenderSVGModelObject::absoluteQuads):
+        * rendering/RenderSVGModelObject.h:
+
+2009-04-16  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25238
+        Invalidate the hovered scrollbar part when resetting the pressed part,
+        since once there is no pressed part we can draw a hovered state.
+
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::setHoveredPart):
+        (WebCore::Scrollbar::setPressedPart):
+
+2009-04-16  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25223
+        REGRESSION: Back button after form submission to the same URL fails to navigate.
+
+        Test: http/tests/navigation/post-goback-same-url.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem): Check if the page we are leaving has
+        FormData.
+
+2009-04-17  Nikolas Zimmermann  <nikolas.zimmerman@torchmobile.com>
+
+        Not reviewed. Fix WML enabled builds.
+
+        * rendering/RenderTableRow.cpp: Remove dead code, which is no longer necessary.
+        (WebCore::RenderTableRow::addChild):
+        * wml/WMLInputElement.cpp: Apply same fix HTMLInputElement received. Covert RenderObject's to RenderTextControl where needed.
+        (WebCore::WMLInputElement::defaultEventHandler):
+
+2009-04-17  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24849
+
+        Add support for the media element 'played' attribute.
+        This involves support of "normalized TimeRanges" as described by
+        the spec.
+
+        Test: media/video-played.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Renamed 
+        m_currentTimeDuringSeek->m_lastSeekTime. Added m_playing and m_playedTimeRanges.
+        (WebCore::HTMLMediaElement::loadInternal): Reset m_playing, m_lastSeekTime, and
+        m_playedTimeRanges
+        (WebCore::HTMLMediaElement::seek): Set current time to m_playedTimeRanges
+        (WebCore::HTMLMediaElement::currentTime): m_currentTimeDuringSeek -> m_lastSeekTime
+        (WebCore::HTMLMediaElement::played): Returns m_playedTimeRanges.
+        (WebCore::HTMLMediaElement::updatePlayState): Add the new played time ranges when pausing. 
+        Set the m_playing flag.
+        * html/HTMLMediaElement.h:
+
+        * html/TimeRanges.cpp:
+        (TimeRanges::add): Merge range(s) if overlap.
+        * html/TimeRanges.h: Add various helpers (below).
+        (WebCore::TimeRanges::Range::isPointInRange): Added.
+        (WebCore::TimeRanges::Range::isOverlappingRange): Ditto.
+        (WebCore::TimeRanges::Range::unionWithOverlappingRange): Ditto.
+        (WebCore::TimeRanges::Range::isBeforeRange): Ditto.
+
+2009-04-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Bug 25210: don't use ObjC methods to wrap/unwrap DOM objects with ObjC
+        https://bugs.webkit.org/show_bug.cgi?id=25210
+
+        * WebCore.base.exp: Export the core and kit function overloads that are used
+        in WebKit. Also resorted this file.
+
+        * WebCore.xcodeproj/project.pbxproj: Re-added DOMHTMLCanvasElement.h to fix
+        a strange problem with the file type.
+
+        * bindings/objc/DOM.mm: Removed the many extraneous includes. Added new includes
+        so we can use and implement the new core and kit functions. Import DOMInternal.h
+        first so it can do its public/private magic.
+        (-[DOMNode _rootObject]): Changed to use early-return style.
+        (kitClass): Added. Tells the wrapper generator what kind of node class to create
+        to wrap DOM nodes. This has the code that used to be in the _wrapNode method.
+        (kit): Added. Takes an EventTarget and makes the appropriate type of wrapper,
+        dpending on whether it's a Node or an SVGElementInstance. This replace methods
+        that used to be on both of those classes.
+        (-[DOMNode boundingBox]): Changed to use early return, and the core function.
+        (-[DOMNode lineBoxRects]): Ditto.
+        (-[DOMNode renderedImage]): Ditto.
+        (-[DOMRange boundingBox]): Ditto.
+        (-[DOMRange lineBoxRects]): Ditto.
+        (-[DOMElement image]): Ditto.
+        (-[DOMElement _font]): Ditto.
+        (-[DOMElement _imageTIFFRepresentation]): Ditto.
+        (-[DOMElement _getURLAttribute:]): Ditto.
+        (-[DOMElement isFocused]): Ditto.
+        (kit): Hand-wrote the version of this for NodeFilter, since it's a protocol,
+        not a class in the binding.
+        (core): Ditto.
+        (-[DOMNodeFilter acceptNode:]): Use core.
+
+        * bindings/objc/DOMAbstractView.mm:
+        (-[DOMAbstractView document]): Use kit.
+        (-[DOMAbstractView _disconnectFrame]): Call removeDOMWrapper, which is no longer
+        in the WebCore namespace, since it's headed for WebKit in the future.
+        (core): Hand-wrote the version of this for DOMAbstractView.mm, since we store
+        a pointer to the Frame, not the DMWindow.
+        (kit): Ditto.
+
+        * bindings/objc/DOMCSS.mm:
+        (kitClass): Added. Tells the wrapper generator what kind of node class to create
+        to wrap CSS objects. This has the code that used to be in the _wrapStyleSheet,
+        _wrapCSSRule, and _wrapCSSValue methods.
+
+        * bindings/objc/DOMEvents.mm:
+        (kitClass): Added. Tells the wrapper generator what kind of node class to create
+        to wrap event objects. This has the code that used to be in the _wrapEvent methods.
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLDocument createDocumentFragmentWithMarkupString:baseURL:]): Use kit and core.
+        (-[DOMHTMLDocument createDocumentFragmentWithText:]): Ditto.
+        (-[DOMHTMLDocument _createDocumentFragmentWithMarkupString:baseURLString:]): Ditto.
+        (-[DOMHTMLInputElement _rectOnScreen]): Ditto.
+        (-[DOMHTMLInputElement _replaceCharactersInRange:withString:selectingFromIndex:]): Ditto.
+        (-[DOMHTMLInputElement _selectedRange]): Ditto.
+        (-[DOMHTMLInputElement _setAutofilled:]): Ditto.
+        (-[DOMHTMLSelectElement _activateItemAtIndex:]): Ditto.
+        (-[DOMHTMLInputElement _isEdited]): Ditto.
+        (-[DOMHTMLTextAreaElement _isEdited]): Ditto.
+        (kitClass): Added. Gives HTMLOptionCollection objects an appropriate wrapper.
+
+        * bindings/objc/DOMInternal.h: Removed most of the imports. There's no reason
+        to have this header include all the other internal DOM headers. Removed unneeded
+        interfaces, including the redeclaration of _init in DOMObject, since it's already
+        inherited from WebScriptObject. Moved all the functions out of the WebCore
+        namespace since this code is destined for WebKit, which doesn't use a namespace.
+        Added kit and core functions for the two classes that live in this header.
+
+        * bindings/objc/DOMInternal.mm:
+        (-[WebScriptObject _initializeScriptDOMNodeImp]): Use core.
+
+        * bindings/objc/DOMObject.h: Made the _internal field be private instead of
+        protected. This also allows the "#define private public" trick to be used to
+        make the field accessible inside the bindings code.
+
+        * bindings/objc/DOMObject.mm:
+        (-[DOMObject dealloc]): Updated for namespace change.
+        (-[DOMObject sheet]): Use core and kit functions.
+
+        * bindings/objc/DOMRGBColor.mm:
+        (-[DOMRGBColor dealloc]): Updated for namespace change.
+        (-[DOMRGBColor red]): Use kit function.
+        (-[DOMRGBColor green]): Ditto.
+        (-[DOMRGBColor blue]): Ditto.
+        (-[DOMRGBColor alpha]): Ditto.
+        (core): Added. Replaces the _RGBColor method.
+        (kit): Added. Replaces the _wrapRGBColor method.
+
+        * bindings/objc/DOMSVGPathSegInternal.mm:
+        (kitClass): Added. Replaces the _wrapSVGPathSeg method.
+
+        * bindings/objc/DOMUtility.mm:
+        (JSC::createDOMWrapper): Use kit function.
+        (createDOMWrapper): Ditto.
+
+        * bindings/objc/DOMXPath.mm:
+        (core): Added. Replaces the _xpathNSResolver method.
+        (kit): Added. Replaces the _wrapXPathNSResolver method.
+
+        * bindings/objc/ObjCEventListener.mm:
+        (WebCore::ObjCEventListener::find): Changed to use early return.
+        (WebCore::ObjCEventListener::handleEvent): Use kit function.
+
+        * bindings/objc/ObjCNodeFilterCondition.mm:
+        (WebCore::ObjCNodeFilterCondition::acceptNode): Use kit function.
+
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject scriptObjectForJSObject:originRootObject:rootObject:]):
+        Updated for namespace change.
+
+        * bindings/scripts/CodeGeneratorObjC.pm: Changed spelling of "license"
+        to U.S. spelling. Removed GetObjCTypeMaker, GetObjCTypeGetterName,
+        GetInternalTypeGetterSignature, and GetInternalTypeMakerSignature.
+        Changed includes to conform to new scheme. Generate core and kit
+        functions instead of methods and calls to those functions. Added a new
+        attribute, Polymorphic, to indicate classes that have derived subclasses.
+        Removed the old ObjCCustomInternalImpl attribute.
+
+        * css/CSSRule.idl: Use Polymorphic attribute, so core and kit functions
+        will be generated, with kit calling kitClass. This requires less hand-
+        written code than the old ObjCCustomInternalImpl.
+        * css/CSSValue.idl: Ditto.
+        * css/StyleSheet.idl: Ditto.
+        * dom/Event.idl: Ditto.
+        * dom/Node.idl: Ditto.
+        * html/HTMLCollection.idl: Ditto.
+        * svg/SVGPathSeg.idl: Ditto.
+
+        * editing/TextAffinity.h: Moved kit and core functions out of the
+        WebCore namespace since this code is destined for WebKit, which
+        doesn't use a namespace
+
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::declareAndWriteDragImage): Use kit function.
+
+        * platform/mac/DragDataMac.mm:
+        (WebCore::DragData::asFragment): Use core function.
+
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeSelection): Use kit function.
+
+        * svg/SVGElementInstance.idl: Removed now-unneeded ObjCCustomInternalImpl
+        function. This can be generated in a standard way now.
+        * svg/SVGViewSpec.idl: Ditto.
+
+2009-04-17  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Maciej Stachowiak
+
+        <rdar://problem/5753299> "Private Browsing" doesn't affect HTML 5 Database storage
+
+        If the Page is in private browsing mode when a statement is queued up, flag that 
+        statement as read-only.
+
+        It would be better to set the read-only flag on the database thread when it actually
+        executes, but that would either require making Settings access a lock-protected operation
+        or involve a synchronous callback to the WebCore thread, neither of which seem worth it.
+        If it becomes an issue in practice, we can revisit this later.
+
+        Test: storage/private-browsing-readonly.html
+
+        * storage/Database.cpp:
+        (WebCore::Database::setAuthorizerReadOnly):
+        * storage/Database.h:
+
+        * storage/DatabaseAuthorizer.cpp:  For all action types that would alter the database,
+          deny when in read-only mode.
+        (WebCore::DatabaseAuthorizer::reset):
+        (WebCore::DatabaseAuthorizer::createTable):
+        (WebCore::DatabaseAuthorizer::dropTable):
+        (WebCore::DatabaseAuthorizer::allowAlterTable):
+        (WebCore::DatabaseAuthorizer::createIndex):
+        (WebCore::DatabaseAuthorizer::dropIndex):
+        (WebCore::DatabaseAuthorizer::createTrigger):
+        (WebCore::DatabaseAuthorizer::dropTrigger):
+        (WebCore::DatabaseAuthorizer::createVTable):
+        (WebCore::DatabaseAuthorizer::dropVTable):
+        (WebCore::DatabaseAuthorizer::allowDelete):
+        (WebCore::DatabaseAuthorizer::allowInsert):
+        (WebCore::DatabaseAuthorizer::allowUpdate):
+        (WebCore::DatabaseAuthorizer::setReadOnly):
+        * storage/DatabaseAuthorizer.h:
+
+        * storage/SQLStatement.cpp:
+        (WebCore::SQLStatement::create): Add a m_readOnly flag.
+        (WebCore::SQLStatement::SQLStatement): Ditto.
+        (WebCore::SQLStatement::execute): If m_readOnly is set, tell the authorizer to change
+          to read-only mode.
+        * storage/SQLStatement.h:
+
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::executeSQL): Flag the statement as read-only if the Page is
+          currently in private browsing mode.
+
+2009-04-17  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Antti Koivisto.
+
+        Move RenderPath and RenderSVGContainer onto a unified clippedOverflowRectForRepaint
+        https://bugs.webkit.org/show_bug.cgi?id=25268
+
+        Lots of minus lines.  Now we're sharing more sane code
+        (which will respect -webkit-transforms! and scroll offsets correctly)
+
+        Which means this fixes:
+        https://bugs.webkit.org/show_bug.cgi?id=20769 and
+        https://bugs.webkit.org/show_bug.cgi?id=21968 too!
+
+        We're no longer expanding the paint rect "for anti-aliasing", since
+        I can't find a case where that's required.  If it is, repaintRectInLocalCoordinates()
+        should be fixed to handle those cases instead of here.
+
+        This fixes svg/custom/scroll-hit-test (now that we respect scroll offsets when repainting)
+        as well as improves our focus ring drawing seen in svg/custom/focus-ring
+        focus rings are now closer to transformed content by a couple pixels (they were needlessly outset by the antialiasing hack)
+        Also, it fixes the dumped rects for markers, causing a progression in svg/custom/marker-overflow-clip
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        (WebCore::RenderPath::setPath):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGModelObject::computeRectForRepaint):
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::computeRectForRepaint):
+        * rendering/RenderSVGRoot.h:
+
+2009-04-17  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 25259: AX: VoiceOver cmd-cntl-space does not follow the google.com->more link
+        https://bugs.webkit.org/show_bug.cgi?id=25259
+  
+        When a node becomes visible or hidden, accessibility needs to be told to update.
+
+        Test: accessibility/visible-elements.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+
+2009-04-17  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, added missing header.
+
+        * platform/graphics/wx/TransformationMatrixWx.cpp:
+
+2009-04-17  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed build fix.
+
+        Fix the build with enabled SVG filters
+
+        * rendering/RenderSVGModelObject.cpp: Include SVGResourceFilter.h.
+
+2009-04-16  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25196
+        Add a missing V8DOMMap include.
+
+        * bindings/v8/WorkerScriptController.cpp: Included V8DOMMap.h.
+
+2009-04-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25260
+        Finish V8 custom bindings for InspectorController.
+
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL): Added.
+
+2009-04-16  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Switch to wxGraphicsBitmap when using wxGraphicsContext so that we're not doing
+        unnecessary conversions internally when drawing bitmaps.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25248
+
+        * platform/graphics/ImageSource.h:
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::ImageSource::createFrameAtIndex):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImage::drawPattern):
+
+2009-04-16  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Performing a block style change in an editable root that contains only a br adds a newline
+        https://bugs.webkit.org/show_bug.cgi?id=25256
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::moveParagraphContentsToNewBlockIfNecessary): Fix a bad check for an root
+        block that didn't handle a root that contained a placeholder.
+
+2009-04-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Fix computeContainerBoundingBox to respect viewport translations
+        https://bugs.webkit.org/show_bug.cgi?id=25254
+
+        Previously computeContainerBoundingBox was just adding the viewportTranslation.
+        Which, although it has a confusing name, only contains the scale and translation
+        for the viewBox/preserveAspectRatio adjustment.  It does not contain the
+        translation for the x/y offset of the viewport.
+        localToParentTransform() does contain this offset, so we use that instead
+        of the previous hacky code.
+
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::computeContainerBoundingBox):
+
+2009-04-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Add a localToParentTransform() method which includes the
+        full transform between local and parent local coordinates.
+        https://bugs.webkit.org/show_bug.cgi?id=25226
+
+        Moved m_localTransform up into RenderSVGTransformableContainer
+        and added a comment to RenderSVGViewportContainer to make it more
+        clear that it does not have a localTransform().
+
+        This patch reveals two more failed design decisions:
+        1.  Use of RenderBox::absoluteTransform() to mean "absoluteTransform()
+            including only my localTransform()" callers are probably using it
+            incorrectly anyway and are just masking bugs in the confused code.
+        2.  computeContainerBoundingBox does not include viewport translations in
+            its computed bounding box, so bounding boxes will be off for parents of
+            inner <svg> elements.  I'll fix this an updated the results in a separate change.
+
+        No functional changes, thus no tests.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::localToParentTransform):
+        (WebCore::RenderObject::absoluteTransform):
+        * rendering/RenderObject.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::layout):
+        * rendering/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::viewportTransform):
+        * rendering/RenderSVGHiddenContainer.cpp:
+        * rendering/RenderSVGHiddenContainer.h:
+        (WebCore::RenderSVGHiddenContainer::absoluteTransform):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::localToParentTransform):
+        (WebCore::RenderSVGRoot::absoluteTransform):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGTransformableContainer.cpp:
+        (WebCore::RenderSVGTransformableContainer::localToParentTransform):
+        (WebCore::RenderSVGTransformableContainer::localTransform):
+        * rendering/RenderSVGTransformableContainer.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::localToParentTransform):
+        (WebCore::RenderSVGViewportContainer::absoluteTransform):
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::computeContainerBoundingBox):
+
+2009-04-16  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Fix Chromium's rendering of <option> elements inside of <optgroups>.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25244
+
+        Test (will included as a manual test by https://bugs.webkit.org/show_bug.cgi?id=24900):
+
+        <select>
+          <optgroup label="Should be bold">
+            <option>Should not be bold</option>
+          </optgroup>
+        </select>
+
+        * css/themeWin.css: adding comments
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::getRowFont): use menuStyle() rather than the item's style
+
+2009-04-16  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25218
+
+        Make DOMWindow::inlineEventListenerForType not have the "inline"
+        keyword. As this method gets used outside of DOMWindow.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::inlineEventListenerForType):
+
+2009-04-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Fix <rdar://problem/6766969>
+        
+        When deferred repaints are enabled and being reset and there is a active
+        timer, stop the timer and do the deferred repaints immediately.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::resetDeferredRepaintDelay):
+
+2009-04-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25241
+        Remove superfluous NotImplemented.h includes.
+
+        * html/CanvasRenderingContext2D.cpp:
+        * html/CanvasStyle.cpp:
+        * page/AccessibilityRenderObject.cpp:
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        * platform/graphics/GraphicsContext.cpp:
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        * platform/graphics/cairo/PathCairo.cpp:
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        * platform/graphics/gtk/FontGtk.cpp:
+        * platform/graphics/gtk/IconGtk.cpp:
+        * platform/graphics/qt/IconQt.cpp:
+        * platform/graphics/qt/ImageQt.cpp:
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        * platform/graphics/skia/ImageSkia.cpp:
+        * platform/graphics/win/ColorSafari.cpp:
+        * platform/graphics/win/FontWin.cpp:
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        * platform/graphics/win/SimpleFontDataCairoWin.cpp:
+        * platform/graphics/wx/ImageWx.cpp:
+        * platform/graphics/wx/TransformationMatrixWx.cpp:
+        * platform/gtk/PlatformScreenGtk.cpp:
+        * platform/gtk/PopupMenuGtk.cpp:
+        * platform/gtk/ScrollViewGtk.cpp:
+        * platform/gtk/ScrollbarGtk.cpp:
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        * platform/posix/FileSystemPOSIX.cpp:
+        * platform/qt/DragDataQt.cpp:
+        * platform/qt/FileSystemQt.cpp:
+        * platform/qt/Localizations.cpp:
+        * platform/qt/PopupMenuQt.cpp:
+        * platform/win/EditorWin.cpp:
+        * platform/win/PasteboardWin.cpp:
+        * platform/wx/KeyboardEventWx.cpp:
+        * platform/wx/PopupMenuWx.cpp:
+        * platform/wx/SharedTimerWx.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/mac/PluginPackageMac.cpp:
+        * plugins/qt/PluginPackageQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+        * rendering/RenderThemeChromiumLinux.cpp:
+        * svg/graphics/SVGImage.cpp:
+
+2009-04-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More fix for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+        
+        Some cleanup in event handling code.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        * bindings/js/JSDOMGlobalObject.h: Removed findJSProtectedEventListener
+        and findJSProtectedEventListener because they are now unused.
+
+        * bindings/js/JSEventListener.cpp:
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::clearGlobalObject):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::~JSLazyEventListener):
+        (WebCore::JSLazyEventListener::globalObject):
+        * bindings/js/JSLazyEventListener.h:
+        (WebCore::JSLazyEventListener::clearGlobalObject): Nixed JSProtectedEventListener,
+        and merged it with JSLazyEventListener, the only remaining event listener
+        that still GC-protects its function and global object.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::ScriptController):
+        * bindings/js/ScriptController.h:
+        (WebCore::ScriptController::setEventHandlerLineNumber):
+        (WebCore::ScriptController::eventHandlerLineNumber): Renamed handlerLineno =>
+        handlerLineNumber, because anything less would be uncivilized. Removed
+        createInlineEventListener because it mostly did irrelevent work, so it
+        just got in the way of understanding how event handler creation works.
+
+        * dom/Document.cpp:
+        (WebCore::Document::createEventListener):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::startElementNs):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::processToken): Ditto.
+
+2009-04-16  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=20765 Website 
+        crashes on load due to messy HTML in search form
+        -and corresponding-
+        <rdar://problem/6210633>
+
+        Before this patch, <form>s were allowed to sit inside tables 
+        without being wrapped by anonymous table parts. There was also a 
+        concept that such a form could be "demoted" and would not be 
+        allowed to have any children. This patch has the HTML parser mark 
+        form elements that have been demoted as such, and then the demoted 
+        forms are not given renderers. I also removed the code that allowed 
+        forms to sit in tables without anonymous table sections. So now any 
+        forms that do manage to get a renderer inside a table will also be 
+        wrapped with appropriate table parts.
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::HTMLFormElement):
+        (WebCore::HTMLFormElement::rendererIsNeeded):
+        * html/HTMLFormElement.h:
+        (WebCore::HTMLFormElement::setDemoted):
+        (WebCore::HTMLFormElement::isDemoted):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::insertNode):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::addChild):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::addChild):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addChild):
+
+2009-04-16  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=24527
+        caret does not paint the first time you focus on a 0px right padding RTL div
+
+        Test: fast/forms/caret-rtl.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::localCaretRect): When calculating x-axis if 
+        alignment is alignRight, we need to subtract the caretWidth so that the
+        caret at IntRect(x, y, caretWidth, height) is inside the block.
+
+2009-04-16  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25228
+        SelectionController::absoluteCaretBounds returns an inflated caret (the caret repaint rect)
+        
+        Return the bounds of the transformed caret, not the transformed repaint rect for the caret (which is inflated).
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::localCaretRect):
+        (WebCore::SelectionController::absoluteBoundsForLocalRect):
+        (WebCore::SelectionController::caretRepaintRect):
+        (WebCore::SelectionController::recomputeCaretRect):
+        * editing/SelectionController.h:
+
+2009-04-16  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25187
+        Bug 25187: <video> may not be rendered upon certain racy conditions
+
+        Always create the video renderer when the load state reaches QTMovieLoadStateLoaded and
+        the element is visible, not just when the movie has just been opened.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::updateStates): Make sure we do not make false
+        assumption on the state changes order. Create the renderer if none is present,
+        when movie is loaded instead.
+
+2009-04-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add filterBoundingBox() to RenderSVGModelObject to share a tiny bit of code
+
+        RenderSVGModelObject has much more interesting code it can share,
+        but I'm just trying to get the commits out of my local branch and into
+        the repository in any order I can. :)  This one was small.
+
+        This will be used by the unified RenderSVGModelObject
+        clippedOverflowRectForRepaint patch coming soon.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::filterBoundingBox):
+        * rendering/RenderSVGModelObject.h:
+
+2009-04-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Eric Seidel and Adam Roben.
+
+        More fix for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+        
+        Simplified some EventHandler creation code.
+        
+        Removed a pile of code whose sole purpose was to allow SVG event handlers
+        to supply a parameter named "evt" instead of the normal "event", and
+        replaced it with a single parameter to JSLazyEventListener's constructor
+        specifying the parameter name to use.
+
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSLazyEventListener.h:
+        (WebCore::JSLazyEventListener::create):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::createInlineEventListener):
+        * bindings/js/ScriptController.h:
+        * dom/Document.cpp:
+        (WebCore::Document::createEventListener):
+
+2009-04-15  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Split out objectBoundingBox and repaintRectInLocalCoordinates from relativeBBox
+        in preparation for simplifying (and fixing) repaint logic in the SVG rendering tree.
+        https://bugs.webkit.org/show_bug.cgi?id=25224
+
+        objectBoundingBox() matches the SVG 1.1 concept of a "bounding box"
+
+        repaintRectInLocalCoordinates() should return the a rect covering all painted content.
+        However, repaintRectInLocalCoordinates() still only returns the "stroke bounding box"
+        in this patch.  In a future patch, repaintRectInLocalCoordinates will be fixed to return
+        a rect covering all painted content.  In order to avoid changing several hundred layout test results, I've left
+        the behavior as-is for now.  The returned rect is used by various repaintRectInLocalCoordinates
+        implementations and sometimes adjusted to include all painted content, but not always, and
+        the places where the adjustments are made are sometimes wrong.  Again, will be fixed in
+        an upcoming patch.
+
+        This patch discovered a bug in Font::drawTextUsingSVGFont, which is probably causing
+        bounding-box relative gradients on SVGFont glyphs to not paint correctly.
+        I chose not to try and fix the bug in this patch and instead left a FIXME.
+
+        This patch also discovered that at least tspan.getBBox() is broken.  This
+        along with the foreignObject.getBBox() change will be tested (and fixed) in a
+        later patch.  https://bugs.webkit.org/show_bug.cgi?id=25225
+
+        No change in behavior (besides the above mentioned foreignObject.getBBox()), thus no tests.
+
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::objectBoundingBox): this is a behavior improvement for getBBox() test case coming in a later patch
+        (WebCore::RenderForeignObject::repaintRectInLocalCoordinates): only really used for layout test results, might some day be used for repaint.
+        * rendering/RenderForeignObject.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::objectBoundingBox): new methods, ASSERT if used but not implemented.
+        (WebCore::RenderObject::repaintRectInLocalCoordinates):
+        * rendering/RenderObject.h:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::objectBoundingBox):
+        (WebCore::RenderPath::repaintRectInLocalCoordinates):
+        (WebCore::RenderPath::clippedOverflowRectForRepaint):
+        (WebCore::RenderPath::lineHeight):
+        (WebCore::RenderPath::baselinePosition):
+        (WebCore::RenderPath::paint):
+        (WebCore::RenderPath::addFocusRingRects):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+        (WebCore::RenderSVGContainer::objectBoundingBox):
+        (WebCore::RenderSVGContainer::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGGradientStop.h:
+        (WebCore::RenderSVGGradientStop::objectBoundingBox):
+        (WebCore::RenderSVGGradientStop::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGHiddenContainer.cpp:
+        (WebCore::RenderSVGHiddenContainer::objectBoundingBox):
+        (WebCore::RenderSVGHiddenContainer::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGHiddenContainer.h:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::objectBoundingBox):
+        (WebCore::RenderSVGImage::repaintRectInLocalCoordinates):
+        (WebCore::RenderSVGImage::calculateAbsoluteBounds):
+        (WebCore::RenderSVGImage::addFocusRingRects):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paint):
+        (WebCore::RenderSVGRoot::objectBoundingBox):
+        (WebCore::RenderSVGRoot::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGTSpan.h:
+        (WebCore::RenderSVGTSpan::objectBoundingBox):
+        (WebCore::RenderSVGTSpan::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGText::absoluteRects):
+        (WebCore::RenderSVGText::absoluteQuads):
+        (WebCore::RenderSVGText::objectBoundingBox):
+        (WebCore::RenderSVGText::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGText.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::viewportTransform):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::computeContainerBoundingBox):
+        * rendering/SVGRenderSupport.h:
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        * svg/SVGFont.cpp:
+        (WebCore::Font::drawTextUsingSVGFont):
+        * svg/SVGLocatable.cpp:
+        (WebCore::SVGLocatable::getBBox):
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::buildPattern):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::createMaskAndSwapContextForTextGradient):
+        (WebCore::clipToTextMask):
+        (WebCore::SVGPaintServerGradient::setup):
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2009-04-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6032139> Table cell widths calculated
+          incorrectly on table that uses table-layout:fixed, colspans, and a mix
+          of percentage and pixel widths
+
+        Test: fast/table/fixed-granular-cols.html
+
+        The incorrect widths resulted from incorrect handling of the case where
+        the <col> elements are more granular than the table cells.
+
+        * rendering/FixedTableLayout.cpp:
+        (WebCore::FixedTableLayout::calcWidthArray): When processing <col>
+        elements, append effective columns or split existing effective columns
+        as needed.
+
+2009-04-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        <rdar://problem/6795285> Infinite recursion in ResourceHandle::receivedRequestToContinueWithoutCredential
+
+        Rolled out <http://trac.webkit.org/projects/webkit/changeset/42536> - the two instances of
+        authentication challenge are different, after all. Added a FIXME comment about a possible
+        future improvement.
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::clearAuthentication):
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::ResourceHandle::receivedRequestToContinueWithoutCredential):
+        (WebCore::ResourceHandle::receivedCancellation):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::didCancelAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::ResourceHandle::receivedRequestToContinueWithoutCredential):
+        (WebCore::ResourceHandle::receivedCancellation):
+
+2009-04-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+        
+        More fix for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+
+        Also fixed <rdar://problem/6792909> WebInspector crashes when reloading
+        a page with breakpoints set
+        
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::clearJSFunctionInline):
+        (WebCore::JSEventListener::markJSFunction):
+        * bindings/js/JSEventListener.h: Actually clear our function and global
+        object pointers when our client instructs us to. (Oops!) Also, mark
+        our global object while we still intend to use it.
+
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::mark):
+        (WebCore::toJS):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * svg/SVGElementInstance.idl: For every SVGElementInstance wrapper, ensure
+        that the corresponding element also has a wrapper, to keep its event
+        listeners alive.
+
+2009-04-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25201
+        Add ScriptFunctionCall/ScriptObject for V8.
+
+        * bindings/v8/ScriptFunctionCall.cpp: Added.
+        * bindings/v8/ScriptFunctionCall.h: Added.
+        * bindings/v8/ScriptObject.cpp: Added.
+        * bindings/v8/ScriptObject.h: Added.
+        * bindings/v8/ScriptObjectQuarantine.cpp: Added.
+        * bindings/v8/ScriptObjectQuarantine.h: Added.
+        * bindings/v8/ScriptScope.cpp: Added.
+        * bindings/v8/ScriptScope.h: Added.
+        * bindings/v8/ScriptState.h:
+        (WebCore::ScriptState::ScriptState): Added new constructors.
+        (WebCore::ScriptState::frame): Added Frame ptr accessor.
+        * bindings/v8/ScriptString.h:
+        (WebCore::ScriptString::ScriptString): Added default constructor.
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::isEqual): Added.
+
+2009-04-15  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix. Add RenderSVGModelObject.* to GTK+'s build.
+
+        * GNUmakefile.am:
+
+2009-04-15  Steve Falkenburg  <sfalken@apple.com>
+
+        <rdar://problem/6785760> WebCore should use a maximum of 6 connections per host, not 4
+
+        Reviewed by Adam Roben.
+
+        * platform/network/ResourceRequestBase.cpp:
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::initializeMaximumHTTPConnectionCountPerHost):
+
+2009-04-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Add special casing to bindings generator so that custom functions
+        starting with xml or xslt conform to WebKit style guidelines.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::xmlHttpRequest):
+        (WebCore::JSDOMWindow::xsltProcessor):
+        * bindings/scripts/CodeGenerator.pm:
+
+2009-04-15  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Add minimal RenderSVGModelObject and make RenderPath and RenderSVGContainer use it.
+        https://bugs.webkit.org/show_bug.cgi?id=25221
+        
+        RenderSVGModelObject is the base rendering class for things which live
+        in the SVG rendering tree.  Not all SVG renders are RenderSVGModelObjects yet.
+        
+        More patches coming.  This is just adding the class, future patches
+        will pull more logic out of RenderPath and RenderSVGContainer into RenderSVGModelObject.
+
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::RenderPath):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::RenderSVGContainer):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGModelObject.cpp: Added.
+        (WebCore::RenderSVGModelObject::RenderSVGModelObject):
+        * rendering/RenderSVGModelObject.h: Added.
+        (WebCore::RenderSVGModelObject::requiresLayer):
+        * rendering/RenderTreeAsText.cpp:
+        * rendering/SVGRenderTreeAsText.cpp:
+
+2009-04-15  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Remove more dead code from RenderSVGHiddenContainer.
+
+        lineHeight and baselinePosition used to be on RenderSVGContainer
+        (of which this is a subclass) because RenderSVGContainer used
+        to be a RenderBox and always the renderer for <svg>
+        Now <svg> uses RenderSVGRoot when needing a RenderBox (inside HTML)
+        and RenderSVGViewportContainer (when inside SVG content)
+        so there is no need for RenderSVGHiddenContainer to have these HTML-specific methods.
+
+        * rendering/RenderSVGHiddenContainer.cpp:
+        * rendering/RenderSVGHiddenContainer.h:
+
+2009-04-15  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Remove unneeded (broken) code from SVG renderers
+        https://bugs.webkit.org/show_bug.cgi?id=25214
+
+        Mostly due to my historical confusions about the render tree
+        and some methods not being removed after classes were split.
+
+        RenderSVGRoot is an RenderBox and should just use all the
+        standard RenderBox methods for inspector and repaint rects.
+
+        RenderSVGContainer is *not* a RenderBox (any more) and thus
+        doesn't need lineHeight or width/height or calcBounds.
+
+        RenderSVGViewportContainer had some broken code which tried
+        to see if the click was inside the container at all, but it
+        was using width/height metrics based off of the containing
+        block (from calcWidth) which is wrong (since its real
+        width/height are from its containing viewport not containing block).
+
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::RenderSVGContainer):
+        (WebCore::RenderSVGContainer::layout):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGRoot.cpp:
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::layout):
+        (WebCore::RenderSVGViewportContainer::nodeAtPoint):
+
+2009-04-15  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser and Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25217
+        Simplify nearestViewportElement and farthestViewportElement using isViewportElement and a for loop
+        Add ASSERT(element) to all these functions since they should never be passed a null element.
+
+        * svg/SVGLocatable.cpp:
+        (WebCore::isViewportElement):
+        (WebCore::SVGLocatable::nearestViewportElement):
+        (WebCore::SVGLocatable::farthestViewportElement):
+        (WebCore::SVGLocatable::getBBox):
+        (WebCore::SVGLocatable::getCTM):
+        (WebCore::SVGLocatable::getScreenCTM):
+
+2009-04-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Remove support for the ObjCIvar extended attribute from the Objective-C
+        bindings generator.  It is not used anymore.
+
+        * bindings/scripts/CodeGeneratorObjC.pm:
+
+2009-04-15  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25204
+        Create a fast path for ReplaceSelectionCommand that merges text nodes
+        
+        During simple pastes, where we're just pasting a text node into a run of text, we would split the current
+        text and insert the new node in between.  This is slow and we hit this bug:
+
+        https://bugs.webkit.org/show_bug.cgi?id=6148
+
+        in the layout and rendering code where adjacent text nodes don't shape correctly in Arabic.
+        
+        This change creates a fast path for ReplaceSelectionCommand that inserts text directly into the
+        text node that holds the selection (very similar to the fast path we wrote for InsertTextCommand).
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+        (WebCore::ReplaceSelectionCommand::performTrivialReplace):
+        * editing/ReplaceSelectionCommand.h:
+        * editing/TextIterator.cpp:
+
+2009-04-15  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Move VDMX parsing into the Chromium Linux port.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25116
+
+        VDMX tables are optional tables in TrueType fonts which contain the
+        exact pixel height of a given font at a given pel size. In order to
+        match Windows font metrics we have to use these numbers.
+
+        Previously, the parsing was performed in Skia. As part of the merge
+        with upstream Skia, an interface for getting table data from a font
+        has been added to Skia and we're moving the parsing into WebKit.
+
+        This does not change any layout tests.
+
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::uniqueID):
+        * platform/graphics/chromium/FontPlatformDataLinux.h:
+        * platform/graphics/chromium/FontTrueTypeLinux.cpp: Added.
+        * platform/graphics/chromium/FontTrueTypeLinux.h: Added.
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+
+2009-04-15  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25180
+
+        Restore stroked outlines to PlatformContextSkia::drawRect().
+        These were removed inadvertently in r41805, aka
+        https://bugs.webkit.org/show_bug.cgi?id=24662.
+        SkRect is { left, top, right, bottom }, not { left, top, width, height }.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::drawRect):
+
+2009-04-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6777374> Generated content with display: run-in
+          causes a crash
+
+        Test: fast/runin/generated.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleRunInChild): Check if the run-in block is
+        generated, and if so, make the RenderInline anonymous instead of passing
+        a 0 node to the RenderInline constructor. If the run-in itself is
+        generated, do move :before and :after children from the block into the
+        inline, as they will not be regenerated. Changed nested ifs into early
+        returns.
+
+2009-04-15  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25192
+
+        Expose DOMWindow::removeInlineEventListenerForType and
+        DOMWindow::inlineEventListenerForType as public.
+
+        * page/DOMWindow.h:
+
+2009-04-14  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25198
+
+        Wrap RegisteredEventListener's markEventListeners and invalidateEventListeners
+        in a USE(JSC), since it doesn't compile with V8 bindings.
+
+        * dom/RegisteredEventListener.h:
+
+2009-04-15  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25194
+
+        Fix a caller of Settings::javaScriptCanOpenWindowsAutomatically() to
+        use the new name.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+
+2009-04-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Don't keep platform objects for authentication challenge in ResourceHandleInternal.
+        We already have a copy in AuthenticationChallenge object.
+
+        * platform/network/ResourceHandle.cpp:
+        (WebCore::ResourceHandle::clearAuthentication):
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::ResourceHandle::receivedRequestToContinueWithoutCredential):
+        (WebCore::ResourceHandle::receivedCancellation):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::didCancelAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::ResourceHandle::receivedRequestToContinueWithoutCredential):
+        (WebCore::ResourceHandle::receivedCancellation):
+
+2009-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Nixed some now-defunct autogeneration code.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-04-14  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+        
+        Fix <rdar://problem/6755724> <audio> and <video> elements can reference local 
+        file:/// URLs from remote in Safari
+
+        Tests: http/tests/security/local-video-poster-from-remote.html
+               http/tests/security/local-video-source-from-remote.html
+               http/tests/security/local-video-src-from-remote.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loadResource): Don't pass url to media engine unless loader->canLoad()
+        says it is OK.
+
+2009-04-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Part of <rdar://problem/6150868>
+        Fix incorrect handling of content that needs to go into the head element
+        once the head element has been removed.
+
+        Test: fast/parser/head-content-after-head-removal.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::HTMLParser): Remove unneeded initializer of m_head.
+        (WebCore::HTMLParser::handleError): Update since m_head is now a RefPtr.
+        (WebCore::HTMLParser::createHead): Ditto.
+        * html/HTMLParser.h: Make m_head a RefPtr.
+
+2009-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Used svn merge -r42529:42528 to roll out my last patch because it broke
+        the build.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::~JSDOMGlobalObject):
+        (WebCore::JSDOMGlobalObject::findJSProtectedEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSProtectedEventListener):
+        (WebCore::JSDOMGlobalObject::jsProtectedEventListeners):
+        (WebCore::JSDOMGlobalObject::jsProtectedInlineEventListeners):
+        * bindings/js/JSDOMGlobalObject.h:
+
+2009-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Nixed some now-dead code related to protected event listeners.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::~JSDOMGlobalObject):
+        * bindings/js/JSDOMGlobalObject.h:
+
+2009-04-14  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        More fix for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+
+        Stop using protected event listeners on SVGElementInstance.
+
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::mark): Mark our event listeners, since
+        they're not protected anymore.
+
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener): Make unprotected
+        event listeners, since we mark them now.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Autogenerate event listener
+        invalidation for SVGElementInstance.
+
+        * svg/SVGElementInstance.h:
+        (WebCore::SVGElementInstance::eventListeners): Added an accessor, for
+        the sake of autogenerated code.
+
+        * svg/SVGElementInstance.idl: Removed the ProtectedEventListener attribute
+        from event listener properties. Added a CustomMarkFunction attribute,
+        since we need to mark our event listeners.
+
+2009-04-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-04-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Add header guards to WebCore forwarding headers.
+        
+        Speeds up WebCore debug build on Windows by 12% on my system,
+        since Visual Studio appears to not optimize for standard header
+        guards in included files.
+        
+        Rubber stamped by Ada Chan.
+
+        * ForwardingHeaders/debugger/Debugger.h:
+        * ForwardingHeaders/debugger/DebuggerActivation.h:
+        * ForwardingHeaders/debugger/DebuggerCallFrame.h:
+        * ForwardingHeaders/interpreter/CallFrame.h:
+        * ForwardingHeaders/interpreter/Interpreter.h:
+        * ForwardingHeaders/masm/X86Assembler.h:
+        * ForwardingHeaders/parser/Parser.h:
+        * ForwardingHeaders/parser/SourceCode.h:
+        * ForwardingHeaders/parser/SourceProvider.h:
+        * ForwardingHeaders/pcre/pcre.h:
+        * ForwardingHeaders/profiler/Profile.h:
+        * ForwardingHeaders/profiler/ProfileNode.h:
+        * ForwardingHeaders/profiler/Profiler.h:
+        * ForwardingHeaders/runtime/ArgList.h:
+        * ForwardingHeaders/runtime/ArrayPrototype.h:
+        * ForwardingHeaders/runtime/BooleanObject.h:
+        * ForwardingHeaders/runtime/CallData.h:
+        * ForwardingHeaders/runtime/Collector.h:
+        * ForwardingHeaders/runtime/CollectorHeapIterator.h:
+        * ForwardingHeaders/runtime/Completion.h:
+        * ForwardingHeaders/runtime/ConstructData.h:
+        * ForwardingHeaders/runtime/DateInstance.h:
+        * ForwardingHeaders/runtime/Error.h:
+        * ForwardingHeaders/runtime/FunctionConstructor.h:
+        * ForwardingHeaders/runtime/FunctionPrototype.h:
+        * ForwardingHeaders/runtime/Identifier.h:
+        * ForwardingHeaders/runtime/InitializeThreading.h:
+        * ForwardingHeaders/runtime/InternalFunction.h:
+        * ForwardingHeaders/runtime/JSArray.h:
+        * ForwardingHeaders/runtime/JSByteArray.h:
+        * ForwardingHeaders/runtime/JSFunction.h:
+        * ForwardingHeaders/runtime/JSGlobalData.h:
+        * ForwardingHeaders/runtime/JSGlobalObject.h:
+        * ForwardingHeaders/runtime/JSLock.h:
+        * ForwardingHeaders/runtime/JSNumberCell.h:
+        * ForwardingHeaders/runtime/JSObject.h:
+        * ForwardingHeaders/runtime/JSString.h:
+        * ForwardingHeaders/runtime/JSValue.h:
+        * ForwardingHeaders/runtime/Lookup.h:
+        * ForwardingHeaders/runtime/ObjectPrototype.h:
+        * ForwardingHeaders/runtime/Operations.h:
+        * ForwardingHeaders/runtime/PropertyMap.h:
+        * ForwardingHeaders/runtime/PropertyNameArray.h:
+        * ForwardingHeaders/runtime/Protect.h:
+        * ForwardingHeaders/runtime/PrototypeFunction.h:
+        * ForwardingHeaders/runtime/StringObject.h:
+        * ForwardingHeaders/runtime/StringObjectThatMasqueradesAsUndefined.h:
+        * ForwardingHeaders/runtime/StringPrototype.h:
+        * ForwardingHeaders/runtime/Structure.h:
+        * ForwardingHeaders/runtime/SymbolTable.h:
+        * ForwardingHeaders/runtime/UString.h:
+        * ForwardingHeaders/wrec/WREC.h:
+        * ForwardingHeaders/wtf/ASCIICType.h:
+        * ForwardingHeaders/wtf/AlwaysInline.h:
+        * ForwardingHeaders/wtf/Assertions.h:
+        * ForwardingHeaders/wtf/ByteArray.h:
+        * ForwardingHeaders/wtf/CurrentTime.h:
+        * ForwardingHeaders/wtf/Deque.h:
+        * ForwardingHeaders/wtf/DisallowCType.h:
+        * ForwardingHeaders/wtf/FastMalloc.h:
+        * ForwardingHeaders/wtf/Forward.h:
+        * ForwardingHeaders/wtf/GetPtr.h:
+        * ForwardingHeaders/wtf/HashCountedSet.h:
+        * ForwardingHeaders/wtf/HashFunctions.h:
+        * ForwardingHeaders/wtf/HashMap.h:
+        * ForwardingHeaders/wtf/HashSet.h:
+        * ForwardingHeaders/wtf/HashTable.h:
+        * ForwardingHeaders/wtf/HashTraits.h:
+        * ForwardingHeaders/wtf/ListHashSet.h:
+        * ForwardingHeaders/wtf/ListRefPtr.h:
+        * ForwardingHeaders/wtf/Locker.h:
+        * ForwardingHeaders/wtf/MainThread.h:
+        * ForwardingHeaders/wtf/MathExtras.h:
+        * ForwardingHeaders/wtf/MessageQueue.h:
+        * ForwardingHeaders/wtf/Noncopyable.h:
+        * ForwardingHeaders/wtf/NotFound.h:
+        * ForwardingHeaders/wtf/OwnArrayPtr.h:
+        * ForwardingHeaders/wtf/OwnPtr.h:
+        * ForwardingHeaders/wtf/PassRefPtr.h:
+        * ForwardingHeaders/wtf/Platform.h:
+        * ForwardingHeaders/wtf/PtrAndFlags.h:
+        * ForwardingHeaders/wtf/RandomNumber.h:
+        * ForwardingHeaders/wtf/RefCounted.h:
+        * ForwardingHeaders/wtf/RefCountedLeakCounter.h:
+        * ForwardingHeaders/wtf/RefPtr.h:
+        * ForwardingHeaders/wtf/RetainPtr.h:
+        * ForwardingHeaders/wtf/StdLibExtras.h:
+        * ForwardingHeaders/wtf/StringExtras.h:
+        * ForwardingHeaders/wtf/ThreadSpecific.h:
+        * ForwardingHeaders/wtf/Threading.h:
+        * ForwardingHeaders/wtf/TypeTraits.h:
+        * ForwardingHeaders/wtf/UnusedParam.h:
+        * ForwardingHeaders/wtf/Vector.h:
+        * ForwardingHeaders/wtf/VectorTraits.h:
+        * ForwardingHeaders/wtf/dtoa.h:
+        * ForwardingHeaders/wtf/unicode/Collator.h:
+        * ForwardingHeaders/wtf/unicode/UTF8.h:
+        * ForwardingHeaders/wtf/unicode/Unicode.h:
+        * ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h:
+
+2009-04-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        Use a template function to generalize the way we create non-caching
+        JS function getters.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDOMWindowCustom.h:
+        (WebCore::nonCachingStaticFunctionGetter):
+        (WebCore::JSDOMWindow::customGetOwnPropertySlot):
+
+2009-04-14  Benjamin C Meyer  <benjamin.meyer@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25099
+
+        When creating a QNetworkRequest make sure to populate the
+        CacheLoadControlAttribute with the value set by the ResourceRequest::cachePolicy() so that the cache will be used as WebKit expects.
+
+        * WebKit/qt/tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::requestCache):
+
+        * platform/network/qt/ResourceRequestQt.cpp:
+        (WebCore::ResourceRequest::toNetworkRequest):
+
+2009-04-14  Timothy Hatcher  <timothy@apple.com>
+
+        Fix a world leak caused by opening the Web Inspector. This was
+        a regression caused by the InspectorController becoming refcounted.
+
+        <rdar://problem/6782944>
+
+        Reviewed by Darin Adler.
+
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptGlobalObject::get): Renamed to better match the
+        other functions.
+        (WebCore::ScriptGlobalObject::remove): Added. Deletes the property.
+        * bindings/js/ScriptObject.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::~InspectorController): Do less work
+        at destruction time since the object lifetime is tied to JS GC.
+        Assert that inspectedPageDestroyed cleared everything needed.
+        (WebCore::InspectorController::inspectedPageDestroyed): Do most
+        of the work that ~InspectorController was doing.
+        (WebCore::InspectorController::scriptObjectReady): Renamed getObject.
+
+2009-04-14  Antony Sargent  <asargent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        This is some cleanup motivated by the crash in http://crbug.com/9775 , which 
+        happens because of calling window.open inside a window.onload handler. 
+
+        These changes are just part of the fix, along with some asserts to help prevent
+        breakage on future changes. 
+
+        https://bugs.webkit.org/show_bug.cgi?id=25132
+
+        * bindings/v8/V8EventListenerList.cpp:
+        (WebCore::V8EventListenerList::add):
+        (WebCore::V8EventListenerList::remove):
+        (WebCore::V8EventListenerList::clear):
+        * bindings/v8/V8EventListenerList.h:
+        (WebCore::V8EventListenerList::size):
+
+2009-04-14  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25142
+        Fix a race that can occur between flex and the perl script that parses
+        its output.
+
+        * css/maketokenizer: Consume all input.
+
+2009-04-14  Rohit Rao  <rohitrao@google.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25184
+        Do not change the text color for selected text in Mac Chromium.
+
+        * rendering/RenderThemeChromiumMac.h:
+        (WebCore::RenderThemeChromiumMac::supportsSelectionForegroundColors):
+        Now returns false, matching the behavior of Safari on Mac.
+
+2009-04-14  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25172
+        Extra partial layout during the first keypress in an empty block
+        
+        Determining if a placeholder needs to be removed requires the creation of a VisiblePosition 
+        which was triggering layout before we were finished modifying the DOM for the insert operation.
+        
+        Find out if we need to remove a placeholder near the start of the operation, and if we do remember 
+        where it's located.  Then, later, remove it along with all of the other DOM operations we perform.
+        
+        Renamed lineBreakExistsAtPosition to lineBreakExistsAtVisiblePosition and added a lineBreakExistsAtPosition
+        that takes in a Position.  In InsertTextCommand, we can use the latter, since we normalize manually.
+        
+        removePlaceholderAt now takes in a Position that it assumes has already been checked for a placeholder.
+        
+        No test added as this only effects performance.
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::removePlaceholderAt):
+        (WebCore::CompositeEditCommand::moveParagraphs):
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
+        * editing/CompositeEditCommand.h:
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::calculateTypingStyleAfterDelete):
+        (WebCore::DeleteSelectionCommand::doApply):
+        * editing/FormatBlockCommand.cpp:
+        (WebCore::FormatBlockCommand::doApply):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::input):
+        * editing/htmlediting.cpp:
+        (WebCore::lineBreakExistsAtVisiblePosition):
+        (WebCore::lineBreakExistsAtPosition):
+        * editing/htmlediting.h:
+
+2009-04-14  Adam Roben  <aroben@apple.com>
+
+        Remove support for profile-guided optimization on Windows
+
+        Rubber-stamped by Steve Falkenburg.
+
+        * WebCore.vcproj/WebCore.vcproj: Removed the Release_PGO
+        configuration.
+
+2009-04-14  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25163
+        Upstream fix for releasing v8 objects on worker thread termination in Chromium.
+
+        * bindings/v8/V8DOMMap.cpp:
+        (WebCore::domDataList): Now uses Vector instead of HashMap.
+        (WebCore::domDataListMutex):
+        (WebCore::ThreadSpecificDOMData::ThreadSpecificDOMData):  remove usage of currentThread();
+        (WebCore::ThreadSpecificDOMData::~ThreadSpecificDOMData): ditto.
+        (WebCore::NonMainThreadSpecificDOMData::~NonMainThreadSpecificDOMData): moved call to removeAllDOMObjectsInCurrentThread() to ~WorkerScriptController.
+        (WebCore::handleWeakObjectInOwningThread):
+        (WebCore::derefDelayedObjects):
+        (WebCore::removeAllDOMObjectsInCurrentThread): not static anymore.
+        * bindings/v8/V8DOMMap.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::dispose): removed code that avoided dual-dereference of WorkerContext.
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded): this ref() is countered in removeAllDOMObjectsInCurrentThread(), when the WorkerContext is removed from the v8 map.
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::~WorkerScriptController):
+
+2009-04-14  Adam Roben  <aroben@apple.com>
+
+        Fix Bug 25183: Split up WebCore.vcproj's settings into vsprops files
+
+        <https://bugs.webkit.org/show_bug.cgi?id=25183>
+
+        WebCore.vcproj now uses a set of .vsprops files to store most of its
+        settings.
+
+        Reviewed by Darin Adler.
+
+        * WebCore.vcproj/WebCore.vcproj: Moved settings from here into the new
+        .vsprops files.
+
+        * WebCore.vcproj/WebCoreCFNetwork.vsprops: Added. Contains settings
+        for ports that build against CFNetwork.
+        * WebCore.vcproj/WebCoreCG.vsprops: Added. Contains settings for ports
+        that build against CoreGraphics.
+        * WebCore.vcproj/WebCoreCURL.vsprops: Added. Contains settings for
+        ports that build against libcurl.
+        * WebCore.vcproj/WebCoreCairo.vsprops: Added. Contains settings for
+        ports that build against Cairo.
+        * WebCore.vcproj/WebCoreCommon.vsprops: Added. Contains settings
+        shared by all ports.
+        * WebCore.vcproj/WebCoreMediaQT.vsprops: Added. Contains settings for
+        ports that use QTMovieWin to implement the MediaPlayerPrivate
+        interface.
+        * WebCore.vcproj/WebCorePthreads.vsprops: Added. Contains settings for
+        ports that build against pthreads.
+
+2009-04-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        http/tests/xmlhttprequest/basic-auth.html fails on Tiger.
+
+        Turns out that NSURLCredentialPersistenceNone doesn't work on Tiger, so we have to use
+        session persistence.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Route the credential through
+        receivedCredential(), ensuring that the Tiger-specific need to use session credentials
+        is honored.
+        (WebCore::ResourceHandle::receivedCredential): On Tiger, change PersistenceNone to
+        PersistenceForSession, because the former doesn't work.
+
+2009-04-14  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/6703873> Triple-click quoted line and type Return creates an extra quoted blank line
+
+        Test: editing/inserting/6703873.html
+
+        * editing/BreakBlockquoteCommand.cpp: (WebCore::BreakBlockquoteCommand::doApply):
+        If the startNode's original parent is now empty, we can remove it.  Its already been cloned and copied with the startNode,
+        so we only need to keep it around if it actually holds some original content, otherwise it will look like an extra empty 
+        container in the document.
+
+2009-04-14  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Add a proper implementation of AtkText::get_text and
+        AtkText::get_character_count, which takes into account non
+        TextControl text. With this the 'Text' field in Accerciser's
+        Interface Viewer is filled correctly.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-14  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Remove some dead code and g_return_if_fail from static functions.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-14  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Also implement text interface for StaticTextRole, which covers
+        most of the text in web pages.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Another Windows build fix.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::WebCoreSynchronousLoader::load):
+
+2009-04-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Windows build fix.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::WebCoreSynchronousLoader::willSendRequest):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge):
+
+2009-04-13  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6698851> Implement XMLHttpRequest withCredentials attribute
+
+        * WebCore.xcodeproj/project.pbxproj: Made ThreadableLoader.h private, as enum definitions
+        from it are now used in otehr private headers.
+
+        * xml/XMLHttpRequest.h:
+        * xml/XMLHttpRequest.idl:
+        Added withCredentials attribute. When it is false (default), neither credentials nor cookies
+        are sent with cross origin requests, When it is true, those are sent, but the server needs
+        to allow handling results via Access-Control-Allow-Credentials header. It was always possible
+        to send a cross-site request with credentials via IFRAME or IMG, so this just adds a way to
+        read results, as long as the server reports that it's allowed.
+        Having the default set to false ensures that requests won't fail unexpectedly because of
+        stored credentials and cookies for other resources in the target protection space.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::loadRequestSynchronously): Allow stored credentials for same origin
+        requests, and for cross origin ones that have withCredentials attribute set. Such code already
+        existed for cookies (but it's simpler, because we could just set a ResourceRequest flag).
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously): Ditto.
+
+        * platform/network/ResourceHandle.h: Added willSendRequest() - just like for other callbacks,
+        is is easier to have code in the class. Also, loadResourceSynchronously() now takes a
+        StoredCredentials option, matching async case.
+
+        * platform/network/ResourceHandleClient.h:
+        (WebCore::ResourceHandleClient::receivedCredential): Removed. This method could never be
+        called, and no client used it.
+        (WebCore::ResourceHandleClient::receivedRequestToContinueWithoutCredential): Ditto.
+
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal): Split username and password out
+        of request URL. We want to always get a callback for credentials to manage them in WebCore,
+        so network back-end shouldn't see them too early.
+
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::removeCredentials):
+        * platform/network/ResourceRequestBase.h:
+        Added a removeCredentials() method that removes login and password parts from request URL.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCoreCredentialStorage): Added a simple storage class for per-session credentials.
+        (WebCore::ResourceHandle::loadResourceSynchronously): Pass allowStoredCredentials through.
+        (WebCore::ResourceHandle::willSendRequest): On a redirect, credentials should be replaced.
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge): Try credentials from the URL
+        and per-session credentials. Code was partially moved from Obj-C callback.
+        (WebCore::ResourceHandle::receivedCredential): Intercept per-session credentials and store
+        them in WebCore storage.
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]): Don't
+        store the redirected URL - we only needed credentials, which are now stored separately.
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveAuthenticationChallenge:]): Removed
+        code that was setting credentials from URL. First, the code is now in ResourceHandle, and
+        also, it wasn't actually needed in Leopard release before this patch, see <rdar://problem/5298142>.
+        (-[WebCoreSynchronousLoader dealloc]): Release credentials. Note that unlike ResourceHandle,
+        this class still needs to track URL for checking whether a redirect is allowed. This is
+        not a great solution, and we should unify client code to use the same checks in sync and
+        async cases.
+        (-[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]): Just like in
+        async case, put credentials aside to ensure that network back-end asks for them.
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Use credentials
+        from URL, or from WebCore storage.
+        (-[WebCoreSynchronousLoader connectionShouldUseCredentialStorage:]): Don't use stored
+        credentials when not allowed to.
+        (+[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]):
+        Put credentials aside to ensure that network back-end asks for them.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::WebCoreCredentialStorage::set):
+        (WebCore::WebCoreCredentialStorage::get):
+        (WebCore::willSendRequest):
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::willSendRequest):
+        (WebCore::ResourceHandle::didReceiveAuthenticationChallenge):
+        (WebCore::ResourceHandle::receivedCredential):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        (WebCore::WebCoreSynchronousLoader::willSendRequest):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge):
+        (WebCore::WebCoreSynchronousLoader::shouldUseCredentialStorage):
+        (WebCore::WebCoreSynchronousLoader::load):
+        Same changes as in Mac case.
+
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        Trying not to break the build.
+
+        * dom/XMLTokenizerLibxml2.cpp: (WebCore::openFunc):
+        * xml/XSLTProcessor.cpp: (WebCore::docLoaderFunc):
+        Unconditionally allow stored credentials for these, as they only support same origin loads.
+
+        * workers/WorkerContext.cpp: (WebCore::WorkerContext::importScripts):
+        WorkerContext.importScripts() can be cross-origin, but sending credentials with it is no worse
+        than sending them with <script src=...>, so this is also unconditionally allowed.
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::loadResourceSynchronously): Pass through storedCredentials.
+        (WebCore::DocumentThreadableLoader::create): Ditto.
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader): Save storedCredentials and
+        sameOrigin flags foruse in callbacks.
+        (WebCore::DocumentThreadableLoader::willSendRequest): Assert that loaders aren't all confused.
+        (WebCore::DocumentThreadableLoader::didSendData): Ditto.
+        (WebCore::DocumentThreadableLoader::didReceiveResponse): Ditto.
+        (WebCore::DocumentThreadableLoader::didReceiveData): Ditto.
+        (WebCore::DocumentThreadableLoader::didFinishLoading): Ditto.
+        (WebCore::DocumentThreadableLoader::didFail): Ditto.
+        (WebCore::DocumentThreadableLoader::getShouldUseCredentialStorage): Don't use credential
+        storage if that's not allowed by the code that invoked DocumentThreadableLoader.
+        (WebCore::DocumentThreadableLoader::didReceiveAuthenticationChallenge): Simulate a failure
+        and cancel the request if we are about to ask the user for credentials for a cross-origin
+        request, which is forbidden by CORS (and would have been very confusing if allowed).
+        (WebCore::DocumentThreadableLoader::receivedCancellation): Assert that loaders aren't all confused.
+
+        * loader/DocumentThreadableLoader.h: Updated for the new flags (storedCredentials and
+        sameOrigin) that affect the loader. Eventually, we need to move all CORS logic from XHR here.
+
+        * loader/ThreadableLoader.h: (StoredCredentials): Added another flag that affects loader
+        behavior. We should combine all of these into a structure, and use it for sync requests, too.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::loadResourceSynchronously):
+        * loader/FrameLoader.h:
+        * loader/ThreadableLoader.cpp:
+        (WebCore::ThreadableLoader::create):
+        (WebCore::ThreadableLoader::loadResourceSynchronously):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
+        (WebCore::WorkerThreadableLoader::loadResourceSynchronously):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):
+        * loader/WorkerThreadableLoader.h:
+        (WebCore::WorkerThreadableLoader::create):
+        Pass through storedCredentials.
+
+2009-04-13  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Remove an outdated comment in ScrollView.h
+
+        * platform/ScrollView.h:
+
+2009-04-13  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25177
+
+        QTTrack's -media method always return NULL in 64-bit QTKit, so
+        MediaPlayerPrivate::disableUnsupportedTracks should use 
+        QTTrackMediaTypeAttribute to get a track's type.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks):
+
+2009-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        More fix for https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+
+        Stop using protected event listeners on the window object.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::mark): Mark our event listeners, since they're
+        no longer protected.
+
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener): Create unprotected event
+        listeners, since we mark them now.
+
+        * bindings/js/JSEventListener.h: Made some functions public so
+        DOMWindow could call them.
+
+        * bindings/js/JSNodeCustom.cpp: Moved markEventListeners to a header,
+        so it could be shared.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Generate event listener marking
+        and invalidating code for the DOMWindow.
+
+        * dom/RegisteredEventListener.h:
+        (WebCore::markEventListeners):
+        (WebCore::invalidateEventListeners): Added helper functions.
+
+        * page/DOMWindow.idl: Make the window's event listener attributes not
+        protected.
+
+2009-04-13  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Mark Rowe.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25155
+
+        OS X standalone media documents should not switch from <video> to <embed> when 
+        QTKit load state is QTMovieLoadStateLoading as that happens frequently when a loading
+        with a slow network connection or when a movie is not saved fast-start.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::updateStates): Don't open movie with plug-in when QTKit's
+        loadstate is QTMovieLoadStateLoading, wait until it drops below QTMovieLoadStateError.
+
+2009-04-13  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24453
+        REGRESSION: If setTimeout is called on a iframe's window, the DOM changes to
+        the main document that timer callback makes are not flushed.
+
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        Use Document::updateStyleForAllDocuments() instead of document->updateStyleIfNeeded()
+        since timers may affect documents other then their own.
+
+2009-04-13  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by David Hyatt.
+
+        Check document for nullity to avoid crashing on GTK+, when
+        creating the WebView.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::needsLayout):
+
+2009-04-13  Ada Chan  <adachan@apple.com>
+
+        Forgot to capitalize the "US".
+
+        * platform/text/win/TextBreakIteratorInternalICUWin.cpp:
+        (WebCore::currentTextBreakLocaleID):
+
+2009-04-13  Ada Chan  <adachan@apple.com>
+
+        <rdar://problem/6564956> URL field double-click selects entire domain, rather than single word or entire URL
+        Revert back to the old word breaking behavior by using en_US_POSIX locale.        
+
+        Reviewed by Steve Falkenburg.
+
+        * platform/text/win/TextBreakIteratorInternalICUWin.cpp:
+        (WebCore::currentTextBreakLocaleID):
+
+2009-04-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        * platform/cf/BinaryPropertyList.cpp: Added comment.
+        * platform/cf/BinaryPropertyList.h: Fixed mistakes in comments.
+
+2009-04-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 25158: hit testing doesn't work right in some cases involving anonymous blocks
+        https://bugs.webkit.org/show_bug.cgi?id=25158
+        rdar://problem/6769693
+
+        Test: editing/selection/click-after-nested-block.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::isChildHitTestCandidate): Added. Helper so the two loops in positionForPoint
+        can share code.
+        (WebCore::RenderBlock::positionForPoint): Removed unneeded special case for first
+        child box. Changed special case for last child box to propertly handle the various
+        types of child box that are not hit test candidates (the same ones already handled
+        by the hit test loop below), adding in a loop so we find the last candidate.
+
+2009-04-13  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=25125.  Rework scrolling so that a layout happens first when
+        it's already needed so that the code doesn't end up making bad decisions based off invalid document sizes.
+
+        * WebCore.base.exp:
+        * page/FrameView.h:
+        (WebCore::FrameView::visibleContentsResized):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/ScrollView.h:
+
+2009-04-13  Adam Roben  <aroben@apple.com>
+
+        Add SharedBuffer::wrapCFData
+
+        This is the CF-equivalent of wrapNSData.
+
+        Reviewed by Brady Eidson.
+
+        * platform/SharedBuffer.h:
+        * platform/cf/SharedBufferCF.cpp:
+        (WebCore::SharedBuffer::wrapCFData):
+
+2009-04-13  Dan Bernstein  <mitz@apple.com>
+
+        - build fix
+
+        * page/EventHandler.cpp:
+        (WebCore::documentPointForWindowPoint):
+
+2009-04-13  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6740294> Increase the connection count per host
+        
+        Try to use six connections per host if possible.
+
+        * WebCore.base.exp:
+        * loader/loader.cpp:
+        (WebCore::Loader::Loader):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::initMaximumHTTPConnectionCountPerHost):
+        * platform/network/ResourceRequestBase.h:
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::initMaximumHTTPConnectionCountPerHost):
+
+2009-04-13  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25153
+        Can't place the caret into text field that scrolls the window on focus
+        
+        We refetch the target node in the shadow node case, and when we do so the window coordinate for the mouse event may
+        be invalid because of scrolling that the focus handler did.  Cache the document point (that we derived from the window
+        coordinate) and use that any time we refetch.
+
+        * page/EventHandler.cpp:
+        (WebCore::documentPointForWindowPoint):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::prepareMouseEvent):
+
+2009-04-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Rename JavaScriptCanOpenWindowsAutomatically to javaScriptCanOpenWindowsAutomatically
+        to conform to our style guidelines.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::allowPopUp):
+        * page/Settings.h:
+        (WebCore::Settings::javaScriptCanOpenWindowsAutomatically):
+
+2009-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Mac build fix: Made another header private.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-04-13  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25121
+        Upstream changes to handle error messages from V8 when running worker script.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::reportFatalErrorInV8):
+        (WebCore::handleConsoleMessage):
+        (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::initV8IfNeeded):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+
+2009-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix: Made setInlineEventListenerForType not inline, since Document
+        calls it now. Made RegisteredEventListener.h a private header on Mac,
+        so WebKit can use it.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::setInlineEventListenerForType):
+
+2009-04-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix <rdar://problem/6404439> REGRESSION: Overlapping text and other
+          layout issues in View Sample feature of MYOB FIrstEdge v3
+
+        * page/Navigator.cpp:
+        (WebCore::shouldHideFourDot): Added "tdqm_loader.js" to the list of
+        JavaScript files this quirk applies to.
+
+2009-04-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Move open and showModalDialog functions out of JSDOMWindowBase
+        and into JSDOMWindow by partially generating them.
+
+        This slightly changes the behavior of getting window.showModalDialog
+        when the embedding app does not support it to return undefined regardless
+        of shadowing.  This should not be an issue in a practice, but will be addressed
+        when we add a generic way to handle runtime specialization of property
+        access.
+
+        * DerivedSources.make: Remove JSDOMWindowBase.lut.h
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::):
+        (WebCore::JSDOMWindowBase::getOwnPropertySlot): Move canShowModalDialog check from
+        here to JSDOMWindow::customGetOwnPropertySlot.
+        (WebCore::JSDOMWindowBase::put): Remove dead code.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        (WebCore::JSDOMWindow::open):
+        (WebCore::JSDOMWindow::showModalDialog):
+        * bindings/js/JSDOMWindowCustom.h:
+        (WebCore::JSDOMWindow::customGetOwnPropertySlot):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::parseModalDialogFeatures): Move from JSDOMWindowBase.
+        (WebCore::DOMWindow::allowPopUp): Ditto.
+        (WebCore::DOMWindow::canShowModalDialog): Ditto.
+        (WebCore::DOMWindow::canShowModalDialogNow): Ditto.
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2009-04-13  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Moved storage for window event listeners into the window object.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener): Add / remove window event
+        listeners to / from the window object.
+
+        * dom/Document.cpp:
+        (WebCore::Document::removeAllEventListeners):
+        (WebCore::Document::clear):
+        (WebCore::Document::setWindowInlineEventListenerForTypeAndAttribute): Moved
+        a bunch of code to the DOMWindow class, and left behind a few calls through
+        to DOMWindow, to support legacy clients. (Eventually, these will go away, too.)
+
+        * dom/Document.h: ditto.
+
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchGenericEvent):
+        (WebCore::Node::dispatchWindowEvent): Dipatch window events on the window
+        object, not the document.
+
+        * dom/Node.h:
+        * dom/RegisteredEventListener.h: Moved RegisteredEventListenerVector
+        declaration, since it's required in more places now.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::clear): Updated for rename. Also, remove event
+        listeners before detaching and clearing the document's window pointer,
+        since the the document needs its window pointer in order to tell the window
+        to clear its event listeners.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision): Updated for rename, and
+        movement of window event listeners into the window.
+
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageDocument::createDocumentStructure): Updated for movement
+        of window event listeners into the window.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::handleEvent):
+        (WebCore::DOMWindow::addEventListener):
+        (WebCore::DOMWindow::removeEventListener):
+        (WebCore::DOMWindow::removeAllEventListeners):
+        (WebCore::DOMWindow::hasEventListener):
+        (WebCore::DOMWindow::setInlineEventListenerForType):
+        (WebCore::DOMWindow::removeInlineEventListenerForType):
+        (WebCore::DOMWindow::inlineEventListenerForType):
+        (WebCore::DOMWindow::addPendingFrameUnloadEventCount):
+        (WebCore::DOMWindow::removePendingFrameUnloadEventCount):
+        (WebCore::DOMWindow::addPendingFrameBeforeUnloadEventCount):
+        (WebCore::DOMWindow::removePendingFrameBeforeUnloadEventCount):
+        * page/DOMWindow.h: Moved a bunch of code to the DOMWindow class, from the Document.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::shouldClose): Updated for movement of window event listeners into the window.
+
+2009-04-13  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25149
+
+        The Geolocation timer needs to start after the UA has granted permission.
+
+        * bindings/js/JSGeolocationCustom.cpp: Use PassRefPtr<PositionOptions>
+        (WebCore::JSGeolocation::getCurrentPosition):
+        (WebCore::JSGeolocation::watchPosition):
+        * page/Geolocation.cpp: Add a RefPtr<PositionOptions> so it can be used
+        later when the timer is started. Change PositionOptions* to PassRefPtr<PositionOptions>
+        where needed.
+        (WebCore::Geolocation::GeoNotifier::GeoNotifier):
+        (WebCore::Geolocation::GeoNotifier::startTimer):
+        (WebCore::Geolocation::getCurrentPosition):
+        (WebCore::Geolocation::watchPosition):
+        (WebCore::Geolocation::setIsAllowed): Start the timer is the UA allows
+        (WebCore::Geolocation::startTimer):
+        (WebCore::Geolocation::startTimersForOneShots):
+        (WebCore::Geolocation::startTimersForWatchers):
+        (WebCore::Geolocation::startTimers):
+        * page/Geolocation.h:
+        (WebCore::Geolocation::GeoNotifier::create):
+
+2009-04-13  Pamela Greene  <pam@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix Chromium (V8) build by renaming methods to match changes
+        in http://trac.webkit.org/changeset/42377.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25141
+
+        * bindings/v8/ScheduledAction.cpp:
+     (WebCore::ScheduledAction::execute): updateRendering() -> updateStyleIfNeeded()
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::handleEvent): updateDocumentsRendering() -> updateStyleForAllDocuments()
+
+2009-04-13  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25136
+        CRASH in DocumentLoader::removeSubresourceLoader due to null m_frame
+
+        Test: fast/frames/frame-unload-crash.html
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::updateLoading): Added null check of m_frame.
+
+2009-04-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Tim Hatcher.
+
+        Put the MessagePort constructor back in ENABLE_CHANNEL_MESSAGING.
+
+        * page/DOMWindow.idl:
+
+2009-04-13  Greg Bolsinga  <bolsinga@apple.com>
+
+        Fix GTK build break.
+
+        * platform/gtk/GeolocationServiceGtk.cpp:
+        (WebCore::GeolocationServiceGtk::updatePosition):
+
+2009-04-13  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler and Dan Bernstein.
+
+        Assertion in updateStyleForAllDocuments.  Make sure to unscheduleStyleRecalc when an object goes into
+        the page cache.  Disallow scheduling of style recalcs on a document that is already in the page cache.
+        Schedule a style recalc if needed when an object comes out of the page cache.
+
+        * dom/Document.cpp:
+        (WebCore::Document::scheduleStyleRecalc):
+        (WebCore::Document::setInPageCache):
+
+2009-04-13  Timothy Hatcher  <timothy@apple.com>
+
+        Correctly sort (program) scripts in the Scripts panel popup menu.
+
+        Reviewed by Ada Chan.
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu): Refactor the code
+        and sort "(program)" options by the sourceID to maintain some order.
+        * inspector/front-end/utilities.js:
+        (indexOfObjectInListSortedByFunction): Fix a bug where identical objects would cause
+        an incorrect return value that confuses insertionIndexForObjectInListSortedByFunction.
+        Just set 'first' and break so the correct result will be returned.
+
+2009-04-13  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24770
+        
+        Add custom code for Coordinates that returns null when required by the
+        Geolocation spec.
+        
+        http://dev.w3.org/geo/api/spec-source.html#coordinates
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCoordinatesCustom.cpp: Added.
+        (WebCore::JSCoordinates::altitude): returns null if the value cannot be provided.
+        (WebCore::JSCoordinates::altitudeAccuracy): Ditto
+        (WebCore::JSCoordinates::heading): Ditto
+        (WebCore::JSCoordinates::speed): Ditto
+        * page/Coordinates.h:
+        (WebCore::Coordinates::create): Add 'canProvide' parameters and values
+        (WebCore::Coordinates::canProvideAltitude):
+        (WebCore::Coordinates::canProvideAltitudeAccuracy):
+        (WebCore::Coordinates::canProvideHeading):
+        (WebCore::Coordinates::canProvideSpeed):
+        (WebCore::Coordinates::Coordinates):
+        * page/Coordinates.idl: specify custom getters
+        * platform/mac/GeolocationServiceMac.mm: Set the values correctly if they cannot be provided.
+        (-[WebCoreCoreLocationObserver locationManager:didUpdateToLocation:fromLocation:]):
+
+2009-04-13  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/5510537> Typing return at start of block quote yields empty quoted line
+
+        Test: editing/inserting/5510537.html
+
+        * editing/BreakBlockquoteCommand.cpp: (WebCore::BreakBlockquoteCommand::doApply): If the break insertion position
+        is at the beginning of the topmost quote, then just insert the <br> before the blockquote.  Otherwise, if the break
+        insertion position is at the beginning of any quote, adjust the position so the break comes before the current quote level
+        so we don't end up with an empty line in that quote in addition to the new line we're adding with the <br>.
+
+2009-04-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix problem when encoding history files with duplicate integer arrays near the end of the file.
+        This results in an assertion failure, and if assertions are turned off, corrupted output.
+
+        When writing an integer array it's important not to add an object reference to the
+        aggregate buffer. The writing of the array does not depend on the aggregate buffer. But,
+        more importantly, it's possible this instance integer array is a duplicate and won't be
+        written out. If so, there's no guarantee there's enough space in the aggregate buffer to
+        store the object references (the references will be ignored). In some cases the aggregate
+        buffer can then overrun the data being written; normally this is prevented by the fact that
+        the data being written will include a copy of the aggregate buffer.
+
+        Also removed a bit of unneeded dead code to handle the integer -1.
+
+        * platform/cf/BinaryPropertyList.cpp:
+        (WebCore::BinaryPropertyListPlan::BinaryPropertyListPlan): Removed unneeded
+        m_integerNegativeOneObjectReference, since property lists support only non-negative integers.
+        (WebCore::BinaryPropertyListPlan::writeInteger): Removed support for
+        m_integerNegativeOneObjectReference.
+        (WebCore::BinaryPropertyListPlan::integerObjectReference): Ditto.
+        (WebCore::BinaryPropertyListSerializer::writeIntegerWithoutAddingAggregateObjectReference):
+        Added. Factored out most of writeInteger, for use in writeIntegerArray, without calling
+        addAggregateObjectReference.
+        (WebCore::BinaryPropertyListSerializer::writeInteger): Changed to call the new
+        writeIntegerWithoutAddingAggregateObjectReference function.
+        (WebCore::BinaryPropertyListSerializer::writeIntegerArray): Call the new
+        writeIntegerWithoutAddingAggregateObjectReference function and therefore remove the
+        code to save and restore m_currentAggregateBufferByte, which is no longer needed.
+
+2009-04-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed Qt build fix.
+
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::floatWidthForComplexText):
+
+2009-04-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Move the event and crypto attributes and the captureEvents and releaseEvents
+        functions out of JSDOMWindowBase by partially generating them.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::currentEvent): Make const.
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::crypto): Not implemented.
+        (WebCore::JSDOMWindow::event):
+        (WebCore::JSDOMWindow::captureEvents): Not implemented.
+        (WebCore::JSDOMWindow::releaseEvents): Ditto.
+        * page/DOMWindow.idl:
+
+2009-04-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Move more attributes out of JSDOMWindowBase by
+        partially generating them.
+
+        - Expose the MessagePort constructor.
+
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::getDOMConstructor):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (setJSDOMWindowBaseEvent):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::image):
+        (WebCore::JSDOMWindow::option):
+        (WebCore::JSDOMWindow::audio):
+        (WebCore::JSDOMWindow::webKitPoint):
+        (WebCore::JSDOMWindow::webKitCSSMatrix):
+        (WebCore::JSDOMWindow::xMLHttpRequest):
+        (WebCore::JSDOMWindow::xSLTProcessor):
+        (WebCore::JSDOMWindow::messageChannel):
+        (WebCore::JSDOMWindow::worker):
+        * page/DOMWindow.idl:
+
+2009-04-12  Timothy Hatcher  <timothy@apple.com>
+
+        A resource's filename is not correct after a redirect in the Inspector.
+
+        Reviewed by Dan Bernstein.
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateScriptObject): Fix a typo in the
+        lastPathComponent property name.
+
+2009-04-12  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Test: editing/inserting/6609479-1.html
+
+        Follow-up to <rdar://problem/6609479>.
+
+        Before my last change, a Mail blockquote would've been broken up earlier, and you would've been guaranteed that the inserted content
+        was at the start of a paragraph.  Now we need to check for that explicitly, and only merge the start of the inserted content if it is 
+        at the start of a paragraph.
+
+        * editing/ReplaceSelectionCommand.cpp: (WebCore::ReplaceSelectionCommand::shouldMergeStart):
+
+2009-04-11  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6609479> Pressing return inside a table cell that's inside quoted content will split the table
+
+        Test: editing/inserting/6609479.html
+
+        Don't break a blockquote if pasting or inserting into a table.
+
+        * editing/ReplaceSelectionCommand.cpp: (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/TypingCommand.cpp: (WebCore::TypingCommand::insertParagraphSeparatorInQuotedContent):
+
+2009-04-11  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6643103> Unscaled values from body.scrollHeight
+
+        Test: fast/css/zoom-body-scroll.html
+
+        Adjust scroll{Left,Top,Width,Height} values for zoom in getters and
+        setters.
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::adjustForZoom):
+        (WebCore::HTMLBodyElement::scrollLeft):
+        (WebCore::HTMLBodyElement::setScrollLeft):
+        (WebCore::HTMLBodyElement::scrollTop):
+        (WebCore::HTMLBodyElement::setScrollTop):
+        (WebCore::HTMLBodyElement::scrollHeight):
+        (WebCore::HTMLBodyElement::scrollWidth):
+
+2009-04-10  Timothy Hatcher  <timothy@apple.com>
+
+        Allow page navigation and reload while stopped at a breakpoint.
+
+        <rdar://problem/6781108> Having a breakpoint active prevents page reload
+
+        Reviewed by Darin Adler.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didContinue): Call the resumedScript function.
+        * inspector/InspectorController.h: Added didContinue.
+        * inspector/JavaScriptDebugListener.h: Ditto.
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::pauseIfNeeded): Call didContinue on the listeners.
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.debuggerResumed): Update the interface and state.
+        * inspector/front-end/inspector.js:
+        (WebInspector.resumedScript): Call ScriptsPanel.debuggerResumed.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy): Call resumeDebugger.
+
+2009-04-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        Remove unused include for JSLock.
+
+        * page/mac/FrameMac.mm:
+
+2009-04-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add back the keepAlive timer for after the script execution to
+        protect the callers of evaluate, as was part of the original intent
+        of timer.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * page/mac/FrameMac.mm:
+
+2009-04-10  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=25137
+
+        If we reload, the animation controller sticks around and has
+        a stale animation time. So the needed delay is computed wrong.
+        I added a reset of the animation timer on load.
+
+        I did not do a test case because this only happens on reload so I
+        couldn't make an automated test. I tried using an iframe and using
+        reload() but that doesn't tickle the bug.
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitOpen):
+
+2009-04-10  Grace Kloba  <klobag@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Move WORKERS header files inside ENABLE(WORKERS).
+        So if WORKERS is not enabled and the generated files are not generated, the build is still working.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        * bindings/js/ScheduledAction.cpp:
+
+2009-04-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/6773515> crash in push_heap inside WebCore when printing
+
+        The crash was due to manipulating a timer on a different thread than the one it was created on.
+        This adds some diagnostics so we'll catch that kind of mistake immediately.
+
+        * platform/Timer.cpp:
+        (WebCore::TimerBase::TimerBase): Store the thread identifier in debug versions.
+        (WebCore::TimerBase::start): Assert it's the same thread the timer was created on.
+        (WebCore::TimerBase::stop): Ditto.
+        (WebCore::TimerBase::isActive): Ditto.
+        (WebCore::TimerBase::setNextFireTime): Ditto.
+
+        * platform/Timer.h: Added the thread identifier data member.
+
+2009-04-10  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=25108
+
+        If you remove a class with a transition while that transition is running
+        the animation timer will continue to fire after the transition is finished.
+        This has no visual indication, but it does drain the processor. And in some
+        cases it might even cause a glitch in future animations. Unfortunately there
+        is no way to test this without putting in printfs.
+
+        This happens because the animation logic is never traversed after a transition
+        is removed, so we never get a chance to cleanup. So I added cleanup in the logic
+        that fires the dispatch of the last style change when the animation finishes.
+
+        Test: transitions/remove-transition-style.html
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateTransitions):
+        (WebCore::CompositeAnimation::animate):
+        (WebCore::CompositeAnimation::cleanupFinishedAnimations):
+        * page/animation/CompositeAnimation.h:
+
+2009-04-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix for <rdar://problem/6648858>
+        CrashTracer: [REGRESSION(Safari 4)] 60 crashes in Safari at com.apple.WebCore • WebCore::ScriptController::evaluate + 241
+
+        The Frame (and therefore ScriptController) were being destroyed
+        during JavaScript execution causing the JSDOMWindowShell to become
+        null.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Use a RefPtr to protect the Frame
+        instead of the keep-alive timer, since a nested event loop used from with-in 
+        JavaScript execution could cause the timer to fire before returning.
+
+2009-04-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25133
+        Fix an error in InspectorController's bindings, clean up a few header
+        includes, make empty object construction in ScriptObject less ambiguous.
+
+        * bindings/js/JSInspectorControllerCustom.cpp:
+        (WebCore::JSInspectorController::setSetting): Send correct argument from
+            the bindings.
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::ScriptObject::createNew): Added.
+        * bindings/js/ScriptObject.h: Removed constructor, added decl for createNew.
+        * inspector/ConsoleMessage.cpp: Remove unused header.
+        * inspector/ConsoleMessage.h: Ditto.
+        * inspector/InspectorResource.cpp:
+        (WebCore::createHeadersObject): Changed to use ScriptObject::createNew.
+
+2009-04-10  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=25134
+
+        This both fixes a bug where I was not sending in the right time
+        to continue the animation and was not recomputing current time
+        when coming out of suspend.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::suspendAnimations):
+        (WebCore::AnimationControllerPrivate::resumeAnimations):
+
+2009-04-10  Adam Roben  <aroben@apple.com>
+
+        Give Windows's <select> popup menus drop shadows
+
+        Rubber-stamped by Steve Falkenburg.
+
+        No test possible.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::registerPopup): Use the CS_DROPSHADOW window class style.
+
+2009-04-10  Timothy Hatcher  <timothy@apple.com>
+
+        Fix a bug in the Web Inspector where it would show scripts
+        from previous pages when toggling the debugger off and back on.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25095
+        rdar://problem/6769970
+
+        Reviewed by John Sullivan.
+
+        * bindings/js/ScriptCachedFrameData.cpp:
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData): Null out the
+        debugger for the scriptController. This balances the attachDebugger
+        that was already in ScriptCachedFrameData::restore.
+        (WebCore::ScriptCachedFrameData::restore): Clean up an if statement.
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::clearWindowShell): Clear the debugger from
+        the current window before setting the new window.
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions): Only accumulate
+        source providers for code associated this as the debugger.
+
+2009-04-10  Pierre d'Herbemont  <pdherbemont@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/6646998> Avoid starting QTKitServer if possible
+        When possible avoid asking QTKit for the MIME types that require QTKitServer
+        when running 64-bit.
+
+        * WebCore.base.exp: Added new entry point.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::addFileTypesToCache): Add an NSArray of types to the cache.
+        (WebCore::mimeCommonTypesCache): Add all "common" QTKit types to the cache.
+        (WebCore::mimeModernTypesCache): Add only "modern" QTKit types to the cache (this list does 
+        not start QTKitServer if it is not already running).
+        (WebCore::MediaPlayerPrivate::getSupportedTypes): Refactored.
+        (WebCore::MediaPlayerPrivate::supportsType): Look in list of "modern" types first to avoid
+        starting QTKitServer if possible.
+
+        * platform/mac/WebCoreSystemInterface.h: Add wkQTIncludeOnlyModernMediaFileTypes.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+
+2009-04-10  Adam Roben  <aroben@apple.com>
+
+        Turn on window animations for <select> popup menus
+
+        We turned these off back when <select> popup menus were partially
+        transparent. Now that they're opaque, there's no reason not to
+        animate them.
+
+        Reviewed by Steve Falkenburg.
+
+        No test possible.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show): Remove the #ifdef that was disabling the
+        window animation.
+
+2009-04-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix a regression from r42379 which made zero-width characters affect
+          line height
+
+        Test: fixes fast/text/wide-zero-width-space.html
+
+        * platform/graphics/mac/FontMacATSUI.mm:
+        (WebCore::overrideLayoutOperation): Add to the fallback font list set
+        here, and only if the glyph is not zero-width...
+        (WebCore::ATSULayoutParameters::initialize): ...instead of doing it
+        here. This matches WidthIterator's behavior.
+
+2009-04-10  Darin Fisher  <darin@chromium.org>
+
+        Fixing build bustage caused by warnings being treated as errors.
+        1- A local variable was only be used inside a debug assertion, which
+           caused grief for the release build.
+        2- Missing initializer for member 'DocumentMarker::activeMatch'
+
+        * dom/Document.cpp:
+        (WebCore::Document::addMarker):
+        (WebCore::Document::setMarkersActive):
+
+2009-04-10  Finnur Thorarinsson  <finnur.webkit@gmail.com>
+
+        Reviewed by John Sullivan.
+
+        Fixing: https://bugs.webkit.org/show_bug.cgi?id=25117
+        (TextMatches don't have a concept of active match)
+
+        For the ports that use the DocumentMarker as highlighting for FindInPage it is
+        useful to have a flag that specifies which marker is active, so it can be drawn
+        in a different color.
+
+        This allows me to remove the hack to use the SelectionController to highlight
+        the active match (in the ChromiumWin port).
+
+        * dom/Document.cpp:
+        (WebCore::Document::setMarkersActive):
+        * dom/Document.h:
+        * dom/DocumentMarker.h:
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::platformActiveTextSearchHighlightColor):
+        (WebCore::RenderTheme::platformInactiveTextSearchHighlightColor):
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumWin::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeChromiumWin::platformActiveTextSearchHighlightColor):
+        (WebCore::RenderThemeChromiumWin::platformInactiveTextSearchHighlightColor):
+        * rendering/RenderThemeChromiumWin.h:
+
+2009-04-10  Pamela Greene  <pam@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Build fix for Chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=12440
+
+        * page/chromium/FrameChromium.cpp:
+        (WebCore::computePageRectsForFrame): change docWidth() to overflowWidth()
+
+2009-04-09  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt
+
+        Add a timer for style recalc (similar to the one used for scheduling layouts).  For now in order
+        to reduce the risk of regressions, I have left in all the synchronous machinery for updating style
+        following DOM events and JavaScript timeouts.  Eventually these calls will be removed.
+
+        Where the timer will really kick in and be useful is for clients that do style changes from
+        Objective-C DOM bindings or that execute JavaScript to manipulate style from the JavaScriptCore C API.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::ContainerNode::removeChild):
+        (WebCore::ContainerNode::appendChild):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        (WebCore::Document::scheduleStyleRecalc):
+        (WebCore::Document::unscheduleStyleRecalc):
+        (WebCore::Document::styleRecalcTimerFired):
+        (WebCore::Document::updateStyleForAllDocuments):
+        (WebCore::Document::detach):
+        * dom/Document.h:
+        * dom/Node.cpp:
+        (WebCore::Node::setNeedsStyleRecalc):
+        (WebCore::Node::lazyAttach):
+
+2009-04-09  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        <rdar://problem/6586787> JS debugger does not work in 64-bit
+
+        Don't truncate the source id in JSCallFrame
+
+        * inspector/JavaScriptCallFrame.h:
+
+2009-04-09  Adam Roben  <aroben@apple.com>
+
+        Start compiling HistoryPropertyList on Windows
+
+        Reviewed by Darin Adler.
+
+        * WebCore.vcproj/WebCore.vcproj: Added HistoryPropertyList and its
+        dependencies to the project. Copy headers from history/cf to
+        $WebKitOutputDir.
+        * history/cf/HistoryPropertyList.cpp: Added StringExtras.h so that
+        this file will compile on Windows.
+
+2009-04-09  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6166612> Text boxes' metrics should be based on
+          the actual fonts used in them, not just the primary font
+
+        Covered by many existing layout tests
+
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::floatWidth): Added a fallbackFonts parameter. If the
+        platform supports collecting fallback fonts in its complex font path
+        and fallbackFonts is not null, all fallback fonts used for the text run
+        will be added to it.
+
+        * platform/graphics/Font.h:
+        (WebCore::Font::width): Ditto.
+
+        * platform/graphics/FontFastPath.cpp:
+        (WebCore::Font::glyphDataForCharacter): Removed an unnecessary namespace
+        qualifier.
+        (WebCore::Font::floatWidthForSimpleText): Added a fallbackFonts
+        parameter, which is passed down to WidthIterator.
+
+        * platform/graphics/WidthIterator.cpp:
+        (WebCore::WidthIterator::WidthIterator): Added a fallbackFonts parameter
+        and used it to initialize the m_fallbackFonts member.
+        (WebCore::WidthIterator::advance): Track the fonts being used and add
+        any fallback fonts to the m_fallbackFonts set. Make sure to only add
+        non-small-caps fonts.
+
+        * platform/graphics/WidthIterator.h:
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::canReturnFallbackFontsForComplexText): Added an
+        implementation that returns false, meaning this platform's
+        implementation of floatWidthForComplexText() does not populate the
+        fallbackFonts set.
+        (WebCore::Font::floatWidthForComplexText): Updated for the new
+        prototype.
+
+        * platform/graphics/chromium/FontLinux.cpp: Ditto.
+
+        * platform/graphics/gtk/FontGtk.cpp: Ditto.
+
+        * platform/graphics/mac/CoreTextController.cpp:
+        (WebCore::CoreTextController::CoreTextController): Added a fallbackFonts
+        parameter and used it to initialize the m_fallbackFonts member.
+        (WebCore::CoreTextController::collectCoreTextRunsForCharacters): Add
+        fallback fonts to m_fallbackFonts.
+
+        * platform/graphics/mac/CoreTextController.h:
+
+        * platform/graphics/mac/FontMac.mm:
+        (WebCore::Font::canReturnFallbackFontsForComplexText): Added an
+        implementation that returns true, indicating that the Mac
+        implementations of floatWidthForComplexText() populate the fallbackFonts
+        set.
+        * platform/graphics/mac/FontMacATSUI.mm:
+        (WebCore::ATSULayoutParameters::ATSULayoutParameters): Added a
+        fallbackFonts parameter and used it to initialize the m_fallbackFonts
+        member.
+        (WebCore::ATSULayoutParameters::initialize): Add fallback fonts to
+        m_fallbackFonts.
+        (WebCore::Font::floatWidthForComplexText): Added a fallbackFonts
+        parameter, which is passed down to ATSULayoutParameters.
+
+        * platform/graphics/mac/FontMacCoreText.cpp:
+        (WebCore::Font::floatWidthForComplexText): Added a fallbackFonts
+        parameter, which is passed down to CoreTextController.
+
+        * platform/graphics/win/FontWin.cpp:
+        (WebCore::Font::canReturnFallbackFontsForComplexText): Added an
+        implementation that returns true, indicating that the
+        UniscribeController-based implementations of floatWidthForComplexText()
+        populate the fallbackFonts set.
+        (WebCore::Font::floatWidthForComplexText): Added a fallbackFonts
+        parameter, which is passed down to UniscribeController.
+
+        * platform/graphics/win/UniscribeController.cpp:
+        (WebCore::UniscribeController::UniscribeController): Added a
+        fallbackfonts parameter and used it to initialize m_fallbackFonts.
+        (WebCore::UniscribeController::advance): Add fallback fonts to
+        m_fallbackFonts.
+
+        * platform/graphics/win/UniscribeController.h:
+        
+        * platform/graphics/wx/FontWx.cpp:
+        (WebCore::Font::canReturnFallbackFontsForComplexText): Added an
+        implementation that returns false, meaning this platform's
+        implementation of floatWidthForComplexText() does not populate the
+        fallbackFonts set.
+        (WebCore::Font::floatWidthForComplexText): Updated for the new
+        prototype.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights): For an InlineTextBox
+        with multiple fonts, compute a common baseline and line height by
+        considering all fonts' ascents and descents (and line spacing, if
+        applicable).
+
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::setFallbackFonts): Added. Temporarily stores
+        the set of fallback fonts in a vector.
+        (WebCore::InlineTextBox::takeFallbackFonts): Added. Returns the fallback
+        fonts previously stored and removes them from storage.
+
+        * rendering/InlineTextBox.h:
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::RenderText): Initialized the
+        m_knownNotToUseFallbackFonts to false.
+        (WebCore::RenderText::styleDidChange): Reset
+        m_knownNotToUseFallbackFonts to false if the style difference is such that
+        affects layout.
+        (WebCore::RenderText::widthFromCache): Added a fallbackFonts parameter,
+        which is passed down to Font::width().
+        (WebCore::RenderText::trimmedPrefWidths): Updated for the change to
+        widthFromCache().
+        (WebCore::RenderText::calcPrefWidths): Made this call a private version
+        of calcPrefWidths() that takes a fallbackFonts parameter and set the
+        m_knownNotToUseFallbackFonts to true if the set comes back empty.
+        The private version passes the fallbackFonts set to widthFromCache().
+        (WebCore::RenderText::setText): Reset m_knownNotToUseFallbackFonts to
+        false.
+        (WebCore::RenderText::createFallbackFontMetricsBox): Added.
+        (WebCore::RenderText::width): Added a fallbackFonts parameter, which is
+        passed down to calcPrefWidths(), widthFromCache() and Font::width().
+        Set m_knownNotToUseFallbackFonts to true when appropriate.
+
+        * rendering/RenderText.h:
+
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::constructLine): Added an assertion and a continue
+        statement to remove one level of indentation.
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine): Temporarily
+        store the set of fallback fonts in the InlineTextBox.
+        (WebCore::RenderBlock::computeVerticalPositionsForLine): Added an
+        assertion.
+
+2009-04-09  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben
+
+        Rename all of the changed()/setChanged()/setDocumentChanged() methods to mention style recalc
+        explicitly instead.
+
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSAbstractEventListener::handleEvent):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::updateStyleIfNeededForBindings):
+        (WebCore::ScriptController::initJavaJSBindings):
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::removeProperty):
+        (WebCore::CSSMutableStyleDeclaration::setNeedsStyleRecalc):
+        (WebCore::CSSMutableStyleDeclaration::setProperty):
+        (WebCore::CSSMutableStyleDeclaration::setStringProperty):
+        (WebCore::CSSMutableStyleDeclaration::setImageProperty):
+        (WebCore::CSSMutableStyleDeclaration::parseDeclaration):
+        (WebCore::CSSMutableStyleDeclaration::addParsedProperties):
+        (WebCore::CSSMutableStyleDeclaration::setCssText):
+        (WebCore::CSSMutableStyleDeclaration::merge):
+        (WebCore::CSSMutableStyleDeclaration::removePropertiesInSet):
+        * css/CSSMutableStyleDeclaration.h:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::allVisitedStateChanged):
+        (WebCore::CSSStyleSelector::SelectorChecker::visitedStateChanged):
+        * css/CSSVariablesDeclaration.cpp:
+        (WebCore::CSSVariablesDeclaration::removeVariable):
+        (WebCore::CSSVariablesDeclaration::setVariable):
+        (WebCore::CSSVariablesDeclaration::setNeedsStyleRecalc):
+        * css/CSSVariablesDeclaration.h:
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::ContainerNode::removeChild):
+        (WebCore::ContainerNode::appendChild):
+        (WebCore::ContainerNode::detach):
+        (WebCore::ContainerNode::setFocus):
+        (WebCore::ContainerNode::setActive):
+        (WebCore::ContainerNode::setHovered):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        (WebCore::Document::scheduleStyleRecalc):
+        (WebCore::Document::unscheduleStyleRecalc):
+        (WebCore::Document::recalcStyle):
+        (WebCore::Document::updateStyleIfNeeded):
+        (WebCore::Document::updateStyleForAllDocuments):
+        (WebCore::Document::updateLayout):
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::prepareMouseEvent):
+        (WebCore::Document::setFocusedNode):
+        (WebCore::Document::setCSSTarget):
+        * dom/Document.h:
+        * dom/Element.cpp:
+        (WebCore::Element::recalcStyle):
+        (WebCore::checkForSiblingStyleChanges):
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::parseMaxLengthAttribute):
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::MouseRelatedEvent::receivedTarget):
+        * dom/Node.cpp:
+        (WebCore::Node::Node):
+        (WebCore::Node::setNeedsStyleRecalc):
+        (WebCore::Node::lazyAttach):
+        (WebCore::Node::dispatchGenericEvent):
+        * dom/Node.h:
+        (WebCore::Node::needsStyleRecalc):
+        (WebCore::Node::childNeedsStyleRecalc):
+        (WebCore::Node::setChildNeedsStyleRecalc):
+        * dom/OptionElement.cpp:
+        (WebCore::OptionElement::setSelectedState):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::evaluateScript):
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::attributeChanged):
+        (WebCore::StyledElement::classAttributeChanged):
+        (WebCore::StyledElement::parseMappedAttribute):
+        * dom/Text.cpp:
+        (WebCore::Text::recalcStyle):
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::insertErrorMessageBlock):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::enable):
+        * editing/Editor.cpp:
+        (WebCore::Editor::setBaseWritingDirection):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::nodeWillBeRemoved):
+        (WebCore::SelectionController::layout):
+        (WebCore::SelectionController::focusedOrActiveStateChanged):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::parseMappedAttribute):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::setInnerText):
+        (WebCore::HTMLElement::isContentEditable):
+        (WebCore::HTMLElement::isContentRichlyEditable):
+        (WebCore::HTMLElement::contentEditable):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::updateWidget):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::parseMappedAttribute):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        (WebCore::HTMLFrameSetElement::recalcStyle):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::setChecked):
+        (WebCore::HTMLInputElement::setIndeterminate):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setAutofilled):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::finishParsingChildren):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::updateWidget):
+        (WebCore::HTMLObjectElement::finishParsingChildren):
+        (WebCore::HTMLObjectElement::childrenChanged):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::recalcStyle):
+        (WebCore::HTMLSelectElement::restoreState):
+        (WebCore::HTMLSelectElement::setRecalcListItems):
+        (WebCore::HTMLSelectElement::reset):
+        (WebCore::HTMLSelectElement::typeAheadFind):
+        * html/HTMLTableElement.cpp:
+        (WebCore::setTableCellsChanged):
+        (WebCore::HTMLTableElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::setValue):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::executeScript):
+        (WebCore::FrameLoader::gotoAnchor):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::alert):
+        (WebCore::DOMWindow::confirm):
+        (WebCore::DOMWindow::prompt):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hoverTimerFired):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::needsLayout):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::setNeedsStyleRecalc):
+        (WebCore::AnimationBase::updateStateMachine):
+        * page/animation/AnimationBase.h:
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
+        (WebCore::AnimationControllerPrivate::clear):
+        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
+        (WebCore::AnimationControllerPrivate::updateStyleIfNeededDispatcherFired):
+        (WebCore::AnimationControllerPrivate::startupdateStyleIfNeededDispatcher):
+        (WebCore::AnimationControllerPrivate::addEventToDispatch):
+        (WebCore::AnimationControllerPrivate::addNodeChangeToDispatch):
+        (WebCore::AnimationControllerPrivate::animationTimerFired):
+        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
+        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
+        (WebCore::AnimationControllerPrivate::addToStartTimeResponseWaitList):
+        (WebCore::AnimationController::cancelAnimations):
+        * page/animation/AnimationControllerPrivate.h:
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::sendTransitionEvent):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::endAnimation):
+        (WebCore::KeyframeAnimation::sendAnimationEvent):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::updateDragState):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::selectionBounds):
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::svgAttributeChanged):
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::setTargetAttributeAnimatedValue):
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::svgAttributeChanged):
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::setNeedsUpdate):
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::addCSSPropertyAndNotifyAttributeMap):
+        * svg/SVGStopElement.cpp:
+        (WebCore::SVGStopElement::parseMappedAttribute):
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::parseMappedAttribute):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::svgAttributeChanged):
+        (WebCore::SVGUseElement::childrenChanged):
+        (WebCore::SVGUseElement::recalcStyle):
+        * svg/animation/SMILTimeContainer.cpp:
+        (WebCore::SMILTimeContainer::updateAnimations):
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::parseMappedAttribute):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::parseMappedAttribute):
+        * wml/WMLNoopElement.cpp:
+        (WebCore::WMLNoopElement::insertedIntoDocument):
+
+2009-04-09  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        When there is a shadow set but it specifies "no shadow", clear the
+        shadow shader. This will prevent Chromium from thinking there's a
+        shadow and using the Skia codepath rather than Windows.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2009-04-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Crash when accessing svg.viewport on a detached SVGSVGElement
+        https://bugs.webkit.org/show_bug.cgi?id=25105
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::isOutermostSVG): return "true" that we are the "outermost" SVG element if we have no parent.  (The spec is unclear as to what behavior we should have in this case, and I doubt anyone cares for now).
+
+2009-04-09  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25084
+        Upstream changes to V8 bindings for XHR so that it can work under either DOMWindow or WorkerContext.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::retrieve):
+        (WebCore::WorkerContextExecutionProxy::initContextIfNeeded):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateEventListenerHelper):
+        (WebCore::WorkerContextExecutionProxy::FindOrCreateEventListener):
+        (WebCore::WorkerContextExecutionProxy::findOrCreateObjectEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::getEventListener):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-04-09  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders Carlsson and Sam Weinig.
+
+        Part of <rdar://problem/5438063> Saving history containing 100,000 entries causes pauses of 2s while browsing
+
+        Longer term solution is to change the design so Safari doesn't read and write all of history.
+        This patch is step one: Do the serializing, which is done on the main thread, much faster.
+
+        * WebCore.base.exp: Added new entry points.
+        * WebCore.xcodeproj/project.pbxproj: Added new source files.
+
+        * history/cf: Added.
+
+        * history/cf/HistoryPropertyList.cpp: Added.
+        * history/cf/HistoryPropertyList.h: Added. Code to write history files. In the future we'll also
+        have code for reading here too.
+
+        * platform/cf/BinaryPropertyList.cpp: Added.
+        * platform/cf/BinaryPropertyList.h: Added. Code to write binary property list files.
+
+2009-04-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Antti Koivisto
+
+        https://bugs.webkit.org/show_bug.cgi?id=25122
+
+        If deferred repainting is active, we need to ensure that there are no repaints
+        pending at the end of layoutIfNeededRecursive, which is called just before
+        painting via -viewWillDraw.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layoutIfNeededRecursive):
+
+2009-04-09  John Grabowski  <jrg@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25117
+        Fix Mac Chromium form controls.
+
+        * rendering/RenderThemeChromiumMac.mm:
+        When rendering native controls in Mac Chromium, use a clean NSGraphicsContext.
+        Properly save and restore native graphics context.
+        (WebCore::RenderThemeChromiumMac::paintCheckbox):
+        (WebCore::RenderThemeChromiumMac::paintRadio):
+        (WebCore::RenderThemeChromiumMac::paintMenuList):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumMac::paintSearchFieldResultsButton):
+
+2009-04-09  Drew Wilson  <atwilson@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25030
+        Refactor MessagePort code to enable Chrome to use a MessagePortProxy object
+        instead of a real MessagePort for the entangledPort, since it could
+        theoretically live in a separate process.
+
+        The goal of this refactoring is to remove all assumptions that the object
+        representing the entangled port is actually of type MessagePort. All
+        operations that were previously directly modifying private MessagePort member
+        variables in the entangled port (i.e. entangle(), postMessage()) have been changed
+        to invoke functions in the  MessagePortProxy interface instead which will allow
+        the Chrome bindings to proxy these calls to another process.
+
+        No new layout tests, as this is just a refactoring with no bug fixes
+        or new functionality.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::mark):
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::clone):
+        (WebCore::MessagePort::postMessage):
+        (WebCore::MessagePort::deliverMessage):
+        (WebCore::MessagePort::startConversation):
+        (WebCore::MessagePort::close):
+        (WebCore::MessagePort::entangle):
+        (WebCore::MessagePort::unentangle):
+        * dom/MessagePort.h:
+        (WebCore::MessagePort::entangledPort):
+        * dom/MessagePortProxy.h: Added.
+        (WebCore::MessagePortProxy::~MessagePortProxy):
+
+2009-04-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey "Big Boy" Garen.
+
+        Fix for <rdar://problem/5745677> Possible to stop load during an unload event
+        Also fixes https://bugs.webkit.org/show_bug.cgi?id=20605
+
+        Tests: fast/events/stop-load-in-unload-handler-using-document-write.html
+               fast/events/stop-load-in-unload-handler-using-window-stop.html
+
+        Don't allow calling methods that would stop the new load inside the unload
+        event.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::stopAllLoaders):
+        * loader/FrameLoader.h:
+
+2009-04-09  David Kilzer  <ddkilzer@apple.com>
+
+        Reinstating <rdar://problem/6718589> Option to turn off SVG DOM Objective-C bindings
+
+        Rolled r42345 back in.  The build failure was caused by an
+        internal script which had not been updated the same way that
+        build-webkit was updated.
+
+        * Configurations/WebCore.xcconfig:
+        * DerivedSources.make:
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap):
+        (+[DOMNode _wrapNode:WebCore::]):
+        * bindings/objc/DOMCSS.mm:
+        (+[DOMCSSValue _wrapCSSValue:WebCore::]):
+        * bindings/objc/DOMEvents.mm:
+        (+[DOMEvent _wrapEvent:WebCore::]):
+        * bindings/objc/DOMInternal.h:
+        * bindings/objc/ExceptionHandlers.mm:
+        (WebCore::raiseDOMException):
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLFrameElement.idl:
+        * html/HTMLIFrameElement.idl:
+        * html/HTMLObjectElement.idl:
+
+2009-04-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=25109
+
+        Eliminate CompositeAnimationPrivate, which was a needless level
+        of abstraction. Remove the methods like addToStyleAvailableWaitList()
+        that simply turn around and call the animation controller.
+        
+        Rename animationControllerPriv() to animationController().
+        Rename willNeedService() to timeToNextService().
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::~AnimationBase):
+        (WebCore::AnimationBase::updateStateMachine):
+        (WebCore::AnimationBase::timeToNextService):
+        (WebCore::AnimationBase::beginAnimationUpdateTime):
+        * page/animation/AnimationBase.h:
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::~CompositeAnimation):
+        (WebCore::CompositeAnimation::clearRenderer):
+        (WebCore::CompositeAnimation::updateTransitions):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::animate):
+        (WebCore::CompositeAnimation::getAnimatedStyle):
+        (WebCore::CompositeAnimation::setAnimating):
+        (WebCore::CompositeAnimation::timeToNextService):
+        (WebCore::CompositeAnimation::getAnimationForProperty):
+        (WebCore::CompositeAnimation::cleanupFinishedAnimations):
+        (WebCore::CompositeAnimation::suspendAnimations):
+        (WebCore::CompositeAnimation::resumeAnimations):
+        (WebCore::CompositeAnimation::overrideImplicitAnimations):
+        (WebCore::CompositeAnimation::resumeOverriddenImplicitAnimations):
+        (WebCore::CompositeAnimation::isAnimatingProperty):
+        (WebCore::CompositeAnimation::pauseAnimationAtTime):
+        (WebCore::CompositeAnimation::pauseTransitionAtTime):
+        (WebCore::CompositeAnimation::numberOfActiveAnimations):
+        * page/animation/CompositeAnimation.h:
+        (WebCore::CompositeAnimation::animationController):
+        (WebCore::CompositeAnimation::isSuspended):
+        (WebCore::CompositeAnimation::hasAnimations):
+        (WebCore::CompositeAnimation::CompositeAnimation):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::sendTransitionEvent):
+        (WebCore::ImplicitAnimation::timeToNextService):
+        * page/animation/ImplicitAnimation.h:
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::sendAnimationEvent):
+        (WebCore::KeyframeAnimation::timeToNextService):
+        * page/animation/KeyframeAnimation.h:
+
+2009-04-09  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reverting <rdar://problem/6718589> Option to turn off SVG DOM Objective-C bindings.
+        It broke Mac build, and I don't know how to fix it.
+
+        * Configurations/WebCore.xcconfig:
+        * DerivedSources.make:
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap):
+        (+[DOMNode _wrapNode:WebCore::]):
+        * bindings/objc/DOMCSS.mm:
+        (+[DOMCSSValue _wrapCSSValue:WebCore::]):
+        * bindings/objc/DOMEvents.mm:
+        (+[DOMEvent _wrapEvent:WebCore::]):
+        * bindings/objc/DOMInternal.h:
+        * bindings/objc/ExceptionHandlers.mm:
+        (WebCore::raiseDOMException):
+        * html/HTMLEmbedElement.idl:
+        * html/HTMLFrameElement.idl:
+        * html/HTMLIFrameElement.idl:
+        * html/HTMLObjectElement.idl:
+
+2009-04-09  Xan Lopez  <xlopez@igalia.com>
+
+        Unreviewed build fix.
+
+        RenderView::docWidth() was made private by r42334. That commit
+        changes its usage for overflowWidth(), so do that here too.
+
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::computePageRects):
+
+2009-04-09  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Based on a patch by Alp Toker.
+
+        Implement AtkObject::ref_state_set. Still quite a few states not
+        implemented.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-09  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Based on a patch by Alp Toker.
+
+        Move fallback object creation to its own function, as it will be
+        used in several places.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (fallbackObject):
+
+2009-04-09  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Based on a patch by Alp Toker.
+
+        Move AccessibilityObject methods to their file.
+
+        * page/gtk/AccessibilityObjectAtk.cpp:
+        (WebCore::AccessibilityObject::wrapper):
+        (WebCore::AccessibilityObject::setWrapper):
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-09  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+        [GTK] ATK accessibility enhancements
+
+        Rework accessibility type generation code, based on Mozilla a11y
+        implementation.
+
+        Have one base a11y type, and generate derived types that implement
+        only the necessary interfaces at runtime, based on the specific
+        object we are wrapping. This allows to save a lot of code while
+        covering all possible cases.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-04-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix document.implementation.createDocument(null, "a:b") not to crash!
+        https://bugs.webkit.org/show_bug.cgi?id=25096
+
+        Test: fast/dom/DOMImplementation/createDocument-namespace-err.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::addChild): add ASSERT() to give a better crash next time
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument): check the exception code before using the result
+
+2009-04-08  Adam Roben  <aroben@apple.com>
+
+        Make <select>s in application chrome documents match the Vista system
+        dialog look
+
+        Reviewed by Dave Hyatt.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::documentIsInApplicationChromeMode): Added this simple helper
+        function.
+        (WebCore::RenderThemeWin::getThemeData): In application chrome mode,
+        the drop down button never uses any look but the "normal" look.
+        (WebCore::RenderThemeWin::paintMenuList): In application chrome mode,
+        use the "readonly" style to match system dialogs.
+
+2009-04-08  Adam Roben  <aroben@apple.com>
+
+        Fix <rdar://6592515> Crash closing tab with Top Sites or Cover Flow
+        showing after clicking "Go Back" in phishing alert
+
+        RenderButton's m_timer is not stopped when its Document enters the
+        page cache. When the WebView was torn down, the timer would fire after
+        the Frame's Page had been destroyed, leading to a crash. This patch
+        just makes the timer do nothing when it fires. Making the timer not
+        fire when in the page cache is covered by bug 25110.
+
+        Reviewed by Dave Hyatt.
+
+        No test possible.
+
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::timerFired): Do nothing when we're in the page
+        cache.
+
+2009-04-09  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben
+
+        Fix bugs where we would mistakenly turn off blitting for iframes if an external paint
+        caused the checks to be triggered too early in the loading process of the frame.
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+
+2009-04-08  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Cameron Zwarich
+
+        https://bugs.webkit.org/show_bug.cgi?id=25106
+        
+        Fix signature of virtual function on AnimationBase so that it matches
+        those in the derived classes, by removing unused parameter.
+        
+        * page/animation/AnimationBase.h:
+        (WebCore::AnimationBase::endAnimation):
+
+2009-04-08  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6718589> Option to turn off SVG DOM Objective-C bindings
+
+        Reviewed by Darin Adler and Maciej Stachowiak.
+
+        Introduce the ENABLE_SVG_DOM_OBJC_BINDINGS feature define so
+        that SVG DOM Objective-C bindings may be optionally disabled.
+
+        * Configurations/WebCore.xcconfig: Added
+        ENABLE_SVG_DOM_OBJC_BINDINGS variable and use it in
+        FEATURE_DEFINES and EXCLUDED_SOURCE_FILE_NAMES.  When SVG DOM
+        Objective-C bindings are disabled, two generated header files no
+        longer exist and none of the generated DOMSVG*.mm files should
+        be compiled.
+        * DerivedSources.make: All of the WebCore.SVG*.exp files contain
+        SVG DOM Objective-C bindings classes, so exclude them unless
+        ENABLE_SVG_DOM_OBJC_BINDINGS is set.
+        * bindings/objc/DOM.mm: Switched from using ENABLE(SVG) to using
+        ENABLE(SVG_DOM_OBJC_BINDINGS).
+        (WebCore::createElementClassMap):
+        (+[DOMNode _wrapNode:WebCore::]):
+        * bindings/objc/DOMCSS.mm: Ditto.
+        (+[DOMCSSValue _wrapCSSValue:WebCore::]):
+        * bindings/objc/DOMEvents.mm: Ditto.
+        (+[DOMEvent _wrapEvent:WebCore::]):
+        * bindings/objc/DOMInternal.h: Ditto.
+        * bindings/objc/ExceptionHandlers.mm: Added use of
+        ENABLE(SVG_DOM_OBJC_BINDINGS).
+        (WebCore::raiseDOMException):
+        * html/HTMLEmbedElement.idl: Excluded -getSVGDocument method
+        in generated Objective-C DOM classes if SVG DOM Objective-C
+        bindings are disabled.
+        * html/HTMLFrameElement.idl: Ditto.
+        * html/HTMLIFrameElement.idl: Ditto.
+        * html/HTMLObjectElement.idl: Ditto.
+
+2009-04-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - limit the workaround for <rdar://problem/5781372> to Mac OS X versions
+          that need it
+
+        * platform/mac/WebFontCache.mm:
+        (fixUpWeight): Changed this function to be a no-op post-Leopard.
+
+2009-04-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6771547> Appending to a RenderText causes all its
+          lines to be dirtied
+
+        Test: fast/repaint/text-append-dirty-lines.html
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::setTextWithOffset): If no text boxes intersected
+        with or came after the new text, dirty the last root box, since the new
+        text may begin there. Having at least one dirty line prevents the
+        incorrect dirtying of all lines later during layoutInlineChildren().
+
+2009-04-08  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25100
+
+        Fixes a Chromium-specific crash in WebCore::ImageBuffer::context that
+        occurs when rendering semi-transparent RTL text.
+
+        Test: fast/text/complex-text-opacity.html
+
+        * platform/graphics/chromium/FontChromiumWin.cpp: Handle RTL when computing text bounds.
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareUniscribePainter::estimateTextBounds):
+
+2009-04-08  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin
+
+        Fix a porting error in my previous patch.  A != was supposed to be an ==.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+2009-04-08  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben and Darin Adler
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=12440, repaints inconsistent for
+        fixed positioned elements.
+
+        Rewrite the updateScrollers method to be more correct in its results.
+
+        Test: fast/block/positioning/fixed-positioning-scrollbar-bug.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        (WebCore::Document::implicitClose):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::createScrollbar):
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::adjustPageHeight):
+        * page/FrameView.h:
+        * page/win/FrameWin.cpp:
+        (WebCore::computePageRectsForFrame):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/ScrollView.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::layout):
+        (WebCore::RenderView::docHeight):
+        (WebCore::RenderView::docWidth):
+        * rendering/RenderView.h:
+
+2009-04-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for <rdar://problem/6226200> Implement Microsoft's X-FRAME-OPTIONS anti-framing defense
+
+        Tests: http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-in-body.html
+               http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-allow.html
+               http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag-parent-same-origin-deny.html
+               http/tests/security/XFrameOptions/x-frame-options-deny-meta-tag.html
+               http/tests/security/XFrameOptions/x-frame-options-deny.html
+               http/tests/security/XFrameOptions/x-frame-options-parent-same-origin-allow.html
+               http/tests/security/XFrameOptions/x-frame-options-parent-same-origin-deny.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::processHttpEquiv): Stop the current load and redirect to about:blank
+        if an X-FRAME-OPTIONS <meta> tag http-equiq dictates we should.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::shouldInterruptLoadForXFrameOptions): Add logic to parse
+        the X-FRAME-OPTIONS parameter.
+        * loader/FrameLoader.h:
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didReceiveResponse): Stop the current load if framed and
+        a X-FRAME-OPTIONS header and its parameter dictate that we should.
+
+2009-04-08  Adam Roben  <aroben@apple.com>
+
+        Fix http/tests/xmlhttprequest/xmlhttprequest-unsafe-redirect.html on Windows
+
+        Reviewed by Sam Weinig.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::loadResourceSynchronously): Mimic the
+        ResourceHandleMac code by propagating the CFError's error code for
+        kCFErrorDomainCFNetwork errors to the ResourceResponse.
+
+2009-04-08  Anders Carlsson  <andersca@apple.com>
+
+        Try to fix the PPC build.
+        
+        * plugins/npfunctions.h:
+
+2009-04-08  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/5908616> tokenizer resizer should handle edge cases consistently
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::enlargeBuffer): Handle edge cases the same way as a failed fastMalloc.
+        (WebCore::HTMLTokenizer::enlargeScriptBuffer): Ditto.
+
+2009-04-08  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler
+
+        Make sure that cloneNode works with SVG attributes that require synchronization.  This fixes
+        issues with <use> element shadow tree cloning where the clones can end up not obtaining the
+        correct attribute values.
+
+        A subsequent patch of mine will expose this problem and cause it to be covered by existing
+        layout tests, so no test is required at this time for this problem.
+
+        * dom/Element.cpp:
+        (WebCore::Element::cloneElementWithoutChildren):
+
+2009-04-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25093
+        REGRESSION: some scripts are showing in the Inspector with only "true"
+        as the source.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didParseSource): Fixed conversion issue.
+        (WebCore::InspectorController::failedToParseSource): Ditto.
+
+2009-04-08  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24904
+
+        Verify the MIME type of stylesheets (in standards mode) by looking
+        at the Content-Type header directly.  This bypasses any content
+        sniffing that might be confusing the issue.
+
+        Test: http/tests/mime/standard-mode-loads-stylesheet-without-content-type-header.html
+
+        * loader/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::canUseSheet):
+
+2009-04-08  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25041
+        <rdar://problem/6697754>
+        Bug 25041: HTMLMediaElement: OSX autoplay broken by r41907
+        
+        OSX media player should set readyState to HAVE_ENOUGH_DATA when the movie's load state
+        reaches QTMovieLoadStatePlaythroughOK, not when the entire file has been downloaded,
+        so autoplay can begin when it should.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::updateStates): Set readState to 
+        HAVE_ENOUGH_DATA when QTMovie load state reaches QTMovieLoadStatePlaythroughOK.
+        (WebCore::MediaPlayerPrivate::paint): Add braces missed in r42203.
+
+2009-04-08  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by David Kilzer. Based on a patch by Grace Kloba.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24656
+        cacheControlContainsNoCache() in ResourceResponseBase.h is wrong
+
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::parseCacheControlDirectives): Removed misused code for
+        parsing directive values, fixing parsing of directives that we care about.
+
+        * platform/network/ResourceResponseBase.h:
+        (WebCore::ResourceResponseBase::cacheControlContainsNoCache): Fixed a copy/paste mistake,
+        m_cacheControlContainsMustRevalidate was returned instead of m_cacheControlContainsNoCache.
+
+2009-04-08  Adam Roben  <aroben@apple.com>
+
+        Make text fields match the system look on Vista
+
+        Reviewed by Dave Hyatt.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::getThemeData): Use the new-to-Vista
+        EP_EDITBORDER_NOSCROLL part for text fields.
+
+2009-04-07  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24957
+        REGRESSION: Google calendar widget no longer shows upcoming events
+
+        Test: http/tests/xmlhttprequest/authorization-header.html
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequestStaticData::XMLHttpRequestStaticData): Removed Authorization from
+        the list of forbidden headers.
+
+2009-04-07  miggilin  <mr.diggilin@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Remove no longer needed debug warning and Windows-specific codepaths
+        (as we now use the Safari/Win port's timer there)
+
+        https://bugs.webkit.org/show_bug.cgi?id=25070
+
+        * platform/wx/SharedTimerWx.cpp:
+        (WebCore::setSharedTimerFireTime):
+
+
+2009-04-07  Adam Roben  <aroben@apple.com>
+
+        Fix many <video> regression tests on Windows
+
+        Reviewed by Dave Hyatt.
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::getNaturalSize): Call GetMovieNaturalBoundsRect, which
+        returns the movie's natural bounds (duh), rather than GetMovieBox,
+        which returns the movie's current displayed size/position.
+
+2009-04-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler and Sam Weinig
+
+        <rdar://problem/5968249> "Private Browsing" doesn't affect HTML 5 LocalStorage
+
+        The expected behavior for persistent storage when private browsing mode is undefined by the spec.
+        For now we're going with a "read-only when in private browsing" policy until we can get feedback
+        and/or get the behavior specified in the spec.
+
+        Note that I purposefully made the change to restrict SessionStorage to read-only, also, with the
+        understanding that the spec allows for SessionStorage to persist across relaunches, even though
+        our implementation currently doesn't do this.
+
+        * dom/DOMCoreException.idl: Add some new ExceptionCodes defined in HTML5, one of which is needed
+          for LocalStorage changes (QUOTA_EXCEEDED_ERR)
+        * dom/ExceptionCode.cpp: 
+        * dom/ExceptionCode.h:
+
+        * storage/StorageArea.cpp:
+        (WebCore::StorageArea::internalSetItem): If private browsing is enabled, throw the QUOTA_EXCEEDED_ERR
+          exception as the spec allows.
+        (WebCore::StorageArea::internalRemoveItem): If private browsing is enabled, silently fail to remove
+          the item.
+        (WebCore::StorageArea::internalClear): If private browsing is enabled, silently fail to clear the area.
+
+2009-04-07  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6148255>
+
+        Standalone media documents can not always handle everything
+        using a <video> element. In these cases switch to an <embed>
+        element that uses the QuickTime plugin, in the hope that it
+        will have more luck. Typical media types that trigger this
+        are streamed media and QTVR.
+
+        Equivalent Windows fix to come once reviewed. Note also that
+        this area of code needs a cleanup:
+        https://bugs.webkit.org/show_bug.cgi?id=25085
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerSawUnsupportedTracks):
+        * html/HTMLMediaElement.h:
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::mediaElementSawUnsupportedTracks):
+        (WebCore::MediaDocument::replaceVideoWithEmbed):
+        * loader/MediaDocument.h:
+            - removes the <video> element and puts in an <embed>
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayerClient::mediaPlayerSawUnsupportedTracks):
+            - new internal method for flagging a problem
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::updateStates):
+            - looks for the types of content we don't handle
+        (WebCore::MediaPlayerPrivate::rateChanged):
+        (WebCore::MediaPlayerPrivate::sizeChanged):
+        (WebCore::MediaPlayerPrivate::timeChanged):
+        (WebCore::MediaPlayerPrivate::didEnd):
+        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks):
+        (WebCore::MediaPlayerPrivate::sawUnsupportedTracks):
+            - inform the MediaClient that we have a potential problem
+
+2009-04-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6767428> Resurrect
+          +[WebFontCache fontWithFamily:traits:size:] for clients that call it
+          directly
+
+        WebFontCache is a class in the WebCore framework and is not WebKit API,
+        but apparently (perhaps mistakenly) some clients call this private
+        interface.
+
+        This change resurrects the interface and gives it reasonable behavior
+        (however, note that WebCore will not call the old interface, so hacks that
+        override it will have no effect on WebKit clients).
+
+        * platform/mac/WebFontCache.h:
+        * platform/mac/WebFontCache.mm:
+        (+[WebFontCache fontWithFamily:traits:size:]): Added. Call through to
+        +fontWithFamily:traits:weight:size:.
+
+2009-04-07  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Adam Roben
+
+        Fix ScrollView's algorithm that determines whether or not to show scrollbars.  There was a bug
+        with the method mainly because RenderView will size itself to the viewport's size, making it
+        impossible to really know the document's "true" size.
+
+        In order to solve this problem ScrollView now has a minimumContentsSize method.  This method
+        returns the document size excluding the RenderView from the calculation.  This width/height
+        is now cached on RenderView in m_docWidth/m_docHeight member variables.
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::adjustPageHeight):
+        (WebCore::FrameView::minimumContentsSize):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::minimumContentsSize):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::layout):
+        (WebCore::RenderView::calcDocHeight):
+        (WebCore::RenderView::calcDocWidth):
+        * rendering/RenderView.h:
+        (WebCore::RenderView::docWidth):
+        (WebCore::RenderView::docHeight):
+
+2009-04-07  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Build fix, not reviewed.
+
+        * WebCore.xcodeproj/project.pbxproj: Made ScriptObject.h private.
+
+2009-04-07  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25063
+        Refactor InspectorController to use ScriptObject/State.
+
+        * GNUmakefile.am: Added ScriptState.cpp.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+        * bindings/js/JSInspectorControllerCustom.cpp:
+        (WebCore::JSInspectorController::addSourceToFrame): Fixed argument index typo.
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::call): Added reportExceptions parameter.
+        (WebCore::ScriptFunctionCall::construct): Ditto.
+        * bindings/js/ScriptFunctionCall.h: Ditto.
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::handleException): Added exception-reporting heloper.
+        (WebCore::ScriptObject::set): Changed to use handleException.
+        (WebCore::ScriptGlobalObject::set): Ditto,
+        * bindings/js/ScriptObject.cpp: Added ScriptGlobalObject.
+        (WebCore::ScriptGlobalObject::set): Added.
+        (WebCore::ScriptGlobalObject::getObject): Added.
+        * bindings/js/ScriptObject.h: Added ScriptGlobalObject decls.
+        (WebCore::ScriptGlobalObject::ScriptGlobalObject): Added.
+        * bindings/js/ScriptState.cpp: Added.
+        * bindings/js/ScriptState.h: Added scriptStateFromPage decl.
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::addToConsole): Changed to not report exceptions
+            to avoid re-entrancy.
+        * inspector/InspectorController.cpp: Refactored to use ScriptState/Object.
+        * inspector/InspectorController.h: Ditto.
+
+2009-04-07  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25083
+
+        Skia was previously calculating the leading value incorrectly, leading
+        us to add fHeight to get the height of a line of text. Now that Skia
+        is calculating fLeading correctly, we can remove fHeight.
+
+        This doesn't affect any layout tests.
+
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-04-07  Brian Weinstein  <bweinstein@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24851
+
+        This fix removes the status code from the status message in a ResourceResponse, which allows a few more tests in http to pass.
+
+        * platform/network/cf/ResourceResponseCFNet.cpp:
+        (WebCore::ResourceResponse::platformLazyInit):
+
+2009-04-07  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25081
+
+        Skia is changing from reporting the XRange to reporting the XMin and
+        XMax.  Obviously these are equivalent, but other users of the metrics
+        need the two numbers to be separate.
+
+        This doesn't affect any layout tests.
+
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-04-07  Adam Roben  <aroben@apple.com>
+
+        Make the look of <select>s match the system look on Vista
+
+        Reviewed by Dave Hyatt.
+
+        * rendering/RenderThemeWin.cpp: Added new constants.
+        (WebCore::RenderThemeWin::getThemeData): On Vista, use the
+        CP_DROPDOWNBUTTONRIGHT part for drop down buttons.
+        (WebCore::RenderThemeWin::paintMenuList): On Vista, use the CP_BORDER
+        part to draw the border of <select>s.
+        (WebCore::RenderThemeWin::paintMenuListButton): On Vista, outset the
+        drop down button to make its border coincide with the <select>'s
+        border.
+
+2009-04-07  Adam Roben  <aroben@apple.com>
+
+        Move isRunningOnVistaOrLater to a shared location
+
+        Rubber-stamped in advance by Dave Hyatt.
+
+        * WebCore.vcproj/WebCore.vcproj: Added SystemInfo.{cpp,h}, and let VS
+        have its way with the rest of the file.
+        * platform/win/ScrollbarThemeWin.cpp: Moved isRunningOnVistaOrLater
+        from here...
+        * platform/win/SystemInfo.cpp: Added.
+        (WebCore::isRunningOnVistaOrLater): ...to here.
+        * platform/win/SystemInfo.h: Added.
+
+2009-04-07  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24692
+        Enable PopupMenuChromium to handle HTML select popups using native
+        cocoa controls on the Mac, all other platforms are unchanged.
+
+        We also split out the storage container for the popup menu items
+        so that ChromeClientChromium can access them for forwarding to
+        the embedding host (Chromium.app or test_shell).
+
+        * page/chromium/ChromeClientChromium.h:
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::items):
+        (WebCore::PopupContainer::PopupContainer):
+        (WebCore::PopupContainer::~PopupContainer):
+        (WebCore::PopupContainer::showPopup):
+        (WebCore::PopupContainer::showExternal):
+        (WebCore::PopupContainer::menuItemHeight):
+        (WebCore::popupData):
+        (WebCore::PopupListBox::pointToRowIndex):
+        (WebCore::PopupListBox::getRowBounds):
+        (WebCore::PopupListBox::isSelectableItem):
+        (WebCore::PopupListBox::updateFromElement):
+        (WebCore::PopupListBox::layout):
+        (WebCore::PopupListBox::clear):
+        (WebCore::PopupMenu::show):
+        * platform/chromium/PopupMenuChromium.h:
+        (WebCore::PopupItem::):
+        (WebCore::PopupItem::PopupItem):
+
+2009-04-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+        
+        Added some double-checking to event handler marking. Now, when the
+        wrapper that's responsible for marking an event handler's JavaScript
+        function gets collected, it clears the event handler's JavaScript function
+        so we won't dereference it after it's collected.
+        
+        In theory, we would never dereference a JavaScript event handler after
+        its node's wrapper was collected anyway, but it's nice to be safe.
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::mark):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::jsFunction):
+        (WebCore::JSEventListener::invalidateJSFunction):
+        (WebCore::JSEventListener::markJSFunction):
+        * bindings/js/JSEventListener.h:
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::mark):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::markEventListeners):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::mark):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::mark):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::mark):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::mark):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventListener.h:
+        (WebCore::EventListener::invalidateJSFunction):
+        (WebCore::EventListener::markJSFunction):
+        (WebCore::markIfNotNull):
+
+2009-04-07  David Levin  <levin@chromium.org>
+
+        Build fix.
+
+        r44280 undid the change in r42268 that made CookieJar.h private.
+        This redoes the change.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-04-07  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Upstream changes to WorkerContextExecutionProxy for enabling V8 preemption.
+        https://bugs.webkit.org/show_bug.cgi?id=25034
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+
+2009-04-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6764359> Thai word selection misbehaves for the
+          last sentence in the document
+
+        Test: editing/selection/thai-word-at-document-end.html
+
+        * editing/visible_units.cpp:
+            - Added a BoundarySearchContextAvailability enum used to indicate
+            whether the caller to a boundary search function may be able to provide
+            additional text in the search direction and call again.
+            - Added a named type for the boundary search function signature. Changed
+            the signature to take a context availability parameter and a boolean
+            out parameter indicating whether more context is needed to perform
+            the search.
+        (WebCore::previousBoundary): If the beginning of the range was reached
+            but the last search wanted more context, perform the search again, this
+            time indicating that there is no earlier text.
+        (WebCore::nextBoundary): Similarly, in the other direction.
+        (WebCore::startWordBoundary): Check whether more context may be available
+            and ask for more context if needed.
+        (WebCore::endWordBoundary): Ditto.
+        (WebCore::previousWordPositionBoundary): Ditto.
+        (WebCore::nextWordPositionBoundary): Ditto.
+        (WebCore::startSentenceBoundary):  Updated signature.
+        (WebCore::endSentenceBoundary): Ditto.
+        (WebCore::previousSentencePositionBoundary): Ditto.
+        (WebCore::nextSentencePositionBoundary): Ditto.
+
+2009-04-07  Geoffrey Garen  <ggaren@apple.com>
+
+        Rubber stamped by Sam Weinig.
+        
+        A little renaming:
+        
+        function => jsFunction
+        listener => jsFunction
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSAbstractEventListener::handleEvent):
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        (WebCore::JSEventListener::jsFunction):
+        (WebCore::JSEventListener::mark):
+        (WebCore::JSProtectedEventListener::JSProtectedEventListener):
+        (WebCore::JSProtectedEventListener::~JSProtectedEventListener):
+        (WebCore::JSProtectedEventListener::jsFunction):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSProtectedEventListener::create):
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::jsFunction):
+        (WebCore::JSLazyEventListener::parseCode):
+        * dom/EventListener.h:
+        (WebCore::EventListener::jsFunction):
+
+2009-04-07  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler
+
+        While working on <rdar://problem/5968249>, noticed some glaring problems with LocalStorage.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::localStorage): Return the cached m_localStorage object if it exists to 
+          avoid creating multiple representations for the same underlying StorageArea.
+        * page/DOMWindow.h:
+        (WebCore::DOMWindow::optionalLocalStorage): Return m_localStorage, not m_sessionStorage.
+
+2009-04-07  Darin Adler  <darin@apple.com>
+
+        Roll out incorrect build fix.
+
+        * WebCore.NPAPI.exp: Reverted.
+
+2009-04-07  Darin Adler  <darin@apple.com>
+
+        Another build fix.
+
+        * WebCore.NPAPI.exp: Added new functions.
+
+2009-04-07  Anders Carlsson  <andersca@apple.com>
+
+        Another build fix.
+        
+        * plugins/npfunctions.h:
+
+2009-04-07  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed build fix. Fix non-Mac builds.
+
+        * bridge/npapi.h:
+
+2009-04-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=25082
+        
+        Clean up repaint logic when RenderLayers become and stop being composited.
+
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::rendererContentChanged):
+        (WebCore::RenderLayer::repaintIncludingNonCompositingDescendants):
+        New compositing-only method that repaints a layer and all its non-composited descendants.
+        Takes a repaintContainer for performance; all the repaints necessarily share the same
+        repaintContainer.
+
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        Rather than use calculateCompositedBounds() to compute the repaint rect (which gave
+        the wrong answer when the composited layer tree was in flux), use the new
+        repaintOnCompositingChange() method.
+        
+        (WebCore::RenderLayerCompositor::repaintOnCompositingChange):
+        Call repaintIncludingNonCompositingDescendants(), and if necessary make sure
+        that the view/layer drawing synchronization happens.
+        
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        Do a repaintOnCompositingChange() when a layer is going to be composited. This is
+        a good place because we haven't started to change the compositing tree.
+        
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        After we've finished updating all the descendant layers, we can do a repaint for
+        layers that ceased compositing.
+
+2009-04-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25069
+        
+        Clean up the accelerated compositing code that determines the format of
+        the GraphicsLayer hierarchy, being more explicit about which parts have
+        to happen before and after descendant layers have been updated. Also remove
+        some unhelpful caching of state.
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        Only call updateCompositingLayers() if we know we're not going to be
+        doing a layout soon.
+        
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setDrawsContent):
+        Toggling drawsContent from false to true should do a setNeedsDisplay().
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::styleChanged):
+        updateLayerCompositingState() no longer updates the layer geometry, so
+        do that here if we're not going to rebuild layers anyway.
+        Also, updateLayerCompositingState() no longer does a setContentsNeedDisplay,
+        so do that if the style change indicates that a repaint is required.
+        
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+        The 'drawing optimizations' logic has been rolled into updateGraphicsLayerConfiguration()
+        and updateGraphicsLayerGeometry().
+        
+        (WebCore::RenderLayerBacking::updateGraphicsLayerConfiguration):
+        Group that code that decides what GraphicsLayers are needed into this method,
+        which deals with clipping layers and 'direct compositing': images that can be
+        rendered via the compositor.
+        
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        Call setDrawsContent() if updateGraphicsLayerConfiguration() didn't already
+        figure it out for image layers.
+        
+        (WebCore::RenderLayerBacking::isSimpleContainerCompositingLayer):
+        Remove the m_simpleCompositingLayerStatusDirty cache indicator, since we just
+        computed it every time anyway.
+        
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        updateGraphicsLayers() was renamed to updateGraphicsLayerConfiguration(),
+        which calls clippedByAncestor() etc. itself rather than having everything passed in.
+        Repaints are taken care of by styleChanged() and setDrawsContent().
+        
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        !layer->isComposited() && layer->transform() is a synonym for paintsWithTransform().
+        
+        (WebCore::RenderLayerCompositor::setCompositingParent):
+        No need to call updateGraphicsLayerGeometry() here, because we're going to
+        rebuild layers anyway.
+        
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        Add comments, and test layerBacking instead of layer->isComposited().
+
+2009-04-07  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+        
+        * WebCore.base.exp:
+
+2009-04-07  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6667001> NPAPI: need NPN_Get/SetValueForURL() and NPN_GetAuthenticationInfo()
+        
+        * WebCore.base.exp:
+        Add symbols needed by WebKit.
+        
+        * WebCore.xcodeproj/project.pbxproj:
+        Make CookieJar a private header.
+        
+        * bridge/npapi.h:
+        Add function definitions.
+        
+        * plugins/npfunctions.h:
+        Fix the NPN_SetValueForURLProcPtr signature.
+
+2009-04-07  Adam Roben  <aroben@apple.com>
+
+        Fix <rdar://6520933> REGRESSION (3.2.1-ToT): Scroll bar disappears in
+        WebView and Bookmarks view after switching theme or turning on High
+        Contrast mode
+
+        Reviewed by Dave Hyatt.
+
+        * platform/win/ScrollbarThemeWin.cpp:
+        (WebCore::ScrollbarThemeWin::themeChanged): Null out scrollbarTheme
+        after closing it so that we'll re-open the theme next time we paint.
+
+2009-04-07  Adam Roben  <aroben@apple.com>
+
+        Small cleanup/correctness fix in ScrollbarThemeWin
+
+        Reviewed by Dave Hyatt.
+
+        * platform/win/ScrollbarThemeWin.cpp: Removed the now-unused
+        haveTheme boolean.
+        (WebCore::checkAndInitScrollbarTheme): Check IsThemeActive() before
+        calling OpenThemeData. This seems to be what MSDN recommends.
+        (WebCore::ScrollbarThemeWin::themeChanged): Null-check scrollbarTheme
+        before closing it, rather than indirectly null-checking it via
+        checking haveTheme.
+
+2009-04-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - when -webkit-line-break: after-white-space is specified but the text
+          does not auto-wrap, do not shrink the trailing space to fit in the
+          available width
+
+        Test: fast/text/whitespace/nowrap-line-break-after-white-space.html
+
+        - when shrinking such trailing space, do not shrink below zero
+
+        Covered by existing tests
+
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2009-04-07  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move RangeBoundaryPoint off of Position, per Darin's suggestion
+        https://bugs.webkit.org/show_bug.cgi?id=24966
+
+        Rename setToChild to setToBeforeChild (since that's what the method does)
+
+        * dom/Position.h:
+        (WebCore::Position::offsetInContainerNode):
+        * dom/Range.cpp:
+        (WebCore::Range::insertNode):
+        (WebCore::Range::selectNodeContents):
+        (WebCore::boundaryNodeWillBeRemoved):
+        * dom/Range.h:
+        (WebCore::Range::startPosition):
+        (WebCore::Range::endPosition):
+        * dom/RangeBoundaryPoint.h:
+        (WebCore::RangeBoundaryPoint::RangeBoundaryPoint):
+        (WebCore::RangeBoundaryPoint::container):
+        (WebCore::RangeBoundaryPoint::childBefore):
+        (WebCore::RangeBoundaryPoint::position):
+        (WebCore::RangeBoundaryPoint::offset):
+        (WebCore::RangeBoundaryPoint::clear):
+        (WebCore::RangeBoundaryPoint::set):
+        (WebCore::RangeBoundaryPoint::setOffset):
+        (WebCore::RangeBoundaryPoint::setToBeforeChild):
+        (WebCore::RangeBoundaryPoint::setToStartOfNode):
+        (WebCore::RangeBoundaryPoint::setToEndOfNode):
+        (WebCore::RangeBoundaryPoint::childBeforeWillBeRemoved):
+        (WebCore::RangeBoundaryPoint::invalidateOffset):
+
+2009-04-07  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add containerNode(), computeOffsetInContainerNode(),
+        computeNodeBeforePosition() and computeNodeAfterPosition().
+        https://bugs.webkit.org/show_bug.cgi?id=24763
+
+        These functions will replace uses of rangeCompliantPosition()
+        in future patches.
+
+        No changes in behavior, thus no tests.
+
+        * dom/Position.cpp:
+        (WebCore::Position::containerNode):
+        (WebCore::Position::computeOffsetInContainerNode):
+        (WebCore::Position::computeNodeBeforePosition):
+        (WebCore::Position::computeNodeAfterPosition):
+        (WebCore::Position::anchorType):
+        * dom/Position.h:
+        (WebCore::Position::):
+
+2009-04-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Bottleneck dispatching mutation events in a new dispatchMutationEvent
+        function.
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::dispatchModifiedEvent):
+        * dom/ContainerNode.cpp:
+        (WebCore::dispatchChildInsertionEvents):
+        (WebCore::dispatchChildRemovalEvents):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchSubtreeModifiedEvent):
+        (WebCore::Node::dispatchMutationEvent):
+        * dom/Node.h:
+
+2009-04-06  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25059
+        Remove references to dominantScript, getGenericFontForScript.
+
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp: Removed references
+            to getGenericFontForScript.
+        (WebCore::FontCache::getLastResortFallbackFont): Removed calls to dominantScript.
+        * platform/graphics/chromium/FontCacheLinux.cpp: Ditto.
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::defaultGUIFont): Removed Document* arg.
+        (WebCore::RenderThemeChromiumLinux::systemFont): Ditto.
+        * rendering/RenderThemeChromiumLinux.h: Ditto.
+        * rendering/RenderThemeChromiumMac.h: Ditto.
+        * rendering/RenderThemeChromiumMac.mm: Ditto.
+        (WebCore::RenderThemeChromiumMac::systemFont): Ditto.
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::defaultGUIFont): Ditto.
+        (WebCore::RenderThemeChromiumWin::systemFont): Ditto.
+        * rendering/RenderThemeChromiumWin.h: Ditto.
+
+2009-04-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=21260
+        Unbounded memory growth when churning elements with anonymous event handler functions
+
+        The problem was that a protected event listener's scope chain would end
+        up with a reference to the Node protecting it, causing a cycle. The
+        solution is to stop protecting event listeners and rely on marking instead.
+
+        This patch converts most Node event listeners to use marking instead of
+        GC protection.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::isObservableThroughDOM):
+        (WebCore::markDOMNodesForDocument): Refactored the test for whether a Node
+        needs marking, and added a case for marking the node in order to mark its
+        event listeners.
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::markEventListeners):
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        (WebCore::JSNode::mark): Added code to mark a Node's event listeners when
+        marking the Node. Changed code using protected event listeners to use event
+        listeners.
+
+        * dom/Node.idl: Changed code using protected event listeners to use event
+        listeners.
+
+2009-04-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove unchecked bool return values for some dispatch event functions.
+
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchSubtreeModifiedEvent):
+        (WebCore::Node::dispatchUIEvent):
+        (WebCore::Node::dispatchWebKitAnimationEvent):
+        (WebCore::Node::dispatchWebKitTransitionEvent):
+        (WebCore::Node::dispatchProgressEvent):
+        * dom/Node.h:
+
+2009-04-06  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25058
+        Fix chromium build bustage caused by r42216
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * page/DOMWindow.idl:
+
+2009-04-06  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Rubber-stamped by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20575
+        No localization in WebKitGtk
+
+        * platform/gtk/FileChooserGtk.cpp: Remove usage of glib/gi18n.h,
+        since there are not translatable strings.
+        * platform/gtk/LocalizedStringsGtk.cpp: Use the glib i18n header
+        that is specific for libraries.
+
+2009-04-06  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24978
+        Use custom implementations of a few Node methods so that
+        we don't over-aggressively create JS wrappers here.
+
+        * bindings/v8/custom/V8NodeCustom.cpp: Added custom implementations.
+        * dom/Node.idl: Removed JSC-specifier, making impl custom for V8 as well.
+
+2009-04-06  Dave Moore  <davemoore@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25031
+        Make the V8 element collections check for named properties *before*
+        checking if there are any elements with the same name. Otherwise
+        it is both incorrect and slow.
+
+        Test: fast/dom/HTMLSelectElement/length-not-overridden.html
+
+        Both of these interceptors were attempting to find an element in the
+        collection that had a name or id of the property name before checking
+        for a JS property with that name.
+        * bindings/v8/V8Collection.h:
+        (WebCore::collectionNamedPropertyGetter):
+        (WebCore::nodeCollectionNamedPropertyGetter):
+
+2009-04-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=25052
+        
+        Pull the call to updateGraphicsLayerGeometry() out of updateGraphicsLayers(),
+        because we need to call it at the end of rebuildCompositingLayerTree() once
+        we've determined which descendant layers are composited, otherwise
+        calculateCompositedBounds() can give the wrong answer.
+        
+        Now that updateLayerCompositingState() doesn't end up calling updateGraphicsLayerGeometry(),
+        call that explicitly from styleChanged(), if we know a layer update is not pending,
+        and similarly from updateAfterLayout().
+
+        Test: compositing/overflow/overflow-positioning.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::styleChanged):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateAfterLayout):
+        (WebCore::RenderLayerBacking::updateGraphicsLayers):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+
+2009-04-06  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add accessors to AtomicString which take String/const char* arguments
+        so that we don't accidentally thrash the AtomicString table.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24979
+
+        * platform/text/AtomicString.h:
+
+2009-04-03  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        Make col and row work in WebCore/manual-tests/cursor.html. The issue
+        was spotted in the WebKit inspector.
+
+        * platform/gtk/CursorGtk.cpp:
+        (WebCore::columnResizeCursor):
+        (WebCore::rowResizeCursor):
+
+2009-04-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Don't show and hide the platformPluginWidget, as it's our QWebView
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
+        (WebCore::PluginView::setParentVisible):
+
+2009-04-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Add new files to the Qt build.
+        Export helper function from the Qt JSC binding, needed in WebKit/qt.
+
+        * WebCore.pro: Add new files.
+        * bridge/qt/qt_runtime.h: Declare convertQVariantToValue.
+
+2009-04-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Changed ScriptFunctionCall's last argument from a const char* as the function name to a String.
+
+        Internally the function name is stored as a WebCore::String and the Qt port wants to use this
+        constructor programmatically where the function name is also a WebCore::String.
+
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::ScriptFunctionCall):
+        * bindings/js/ScriptFunctionCall.h:
+
+2009-04-06  Mike Belshe <mike@belshe.com>
+
+        Reviewed by Eric Seidel.
+
+        HTMLCanvasElement crash when ImageBuffer creation fails.
+        https://bugs.webkit.org/show_bug.cgi?id=23212
+
+        Check for NULL before using the ImageBuffer as we might
+        be low on memory and creation may have failed.
+
+        Test case creation blocked by:
+        https://bugs.webkit.org/show_bug.cgi?id=25055
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createImageBuffer):
+
+2009-04-05  Geoffrey Garen  <ggaren@apple.com>
+
+        [Originally] Reviewed by Sam Weinig.
+
+        Rolled back in r42214 with crashes fixed.
+
+        [Removed irrelevant ExecState* parameter from event handler registration code.]
+        
+        [No change in behavior.]
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::findOrCreateJSProtectedEventListener):
+        (WebCore::JSDOMGlobalObject::findJSEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSEventListener):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::addEventListener):
+        (WebCore::JSWorker::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-04-05  Erik L. Bunce  <elbunce@xendom.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25050
+
+        Fix an assert failure when dropping an 'empty' text/uri-list on a QWebView. 
+
+        * platform/qt/DragDataQt.cpp:
+        (WebCore::DragData::asURL):
+
+2009-04-05  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the Qt build.
+
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createPrototype): Take the JSGlobalObject
+        as second argument.
+
+2009-04-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fixes for wxMac/Tiger.
+
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
+        (wxFontProperties::wxFontProperties):
+        * rendering/break_lines.cpp:
+        (WebCore::nextBreakablePosition):
+        * webcore-wx.bkl:
+
+2009-04-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Cameron Zwarich
+
+        https://bugs.webkit.org/show_bug.cgi?id=24648
+        
+        Ensure that mapPoint(const IntPoint&) calls the FloatPoint
+        version to avoid infinite recursion.
+        
+        No test because mapPoint(const IntPoint&) isn't ever called
+        on Mac, so I can't reproduce.
+        
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::mapPoint):
+
+2009-04-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix <rdar://problem/6757862> REGRESSION: Cannot use the mouse to place
+          the insertion point inside a Thai character
+
+        Test: fast/text/international/thai-offsetForPosition-inside-character.html
+
+        * platform/graphics/mac/CoreTextController.cpp:
+        (WebCore::CoreTextController::offsetForPosition): Changed to use
+        cursorMovementIterator instead of characterBreakIterator, allowing this
+        function to return a valid cursor position even if it is not at
+        a character boundary.
+
+2009-04-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix an assertion failure when clicking at the beginning of a
+          glyph cluster at the beginning of a text run
+
+        Test: fast/text/offsetForPosition-cluster-at-zero.html
+
+        * platform/graphics/mac/CoreTextController.cpp:
+        (WebCore::CoreTextController::offsetForPosition): Corrected the bound
+        check on firstGlyphBeforeCluster, letting it be 0 or -1, but not less
+        than -1.
+
+2009-04-03  Brian Weinstein  <bweinstein@gmail.com>
+
+        Allows 16 HTML/CSS standard colors to be shown as swatch backgrounds
+        when the names are given.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25044
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.updateTitle):
+
+2009-04-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6330929>
+        https://bugs.webkit.org/show_bug.cgi?id=21456
+
+        Don't update the document pointer for all inactive windows on navigations.
+        This change causes us to differ slightly from Firefox when accessing the
+        document from within a closure tied to a navigated context, but as all
+        browsers differ on this edge case, I don't foresee compatibility issues.
+
+        Test: http/tests/security/cross-frame-access-document-direct.html
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::~JSDOMWindowBase):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        * bindings/js/ScriptController.h:
+
+2009-04-03  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Test: transitions/bad-transition-shorthand-crash.html
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=24787.
+
+        We were starting transitions with 0 duration and delay, which is 
+        useless. With accelerated compositing on, this went through a code
+        path that tried to use m_toStyle, which never got set because the 
+        transitions was short circuited before it had a chance to. So I
+        both protect against using that null pointer and avoid starting
+        the transition in the first place.
+
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::updateTransitions):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::blendPropertyValueInStyle):
+
+2009-04-03  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes a bug where you could not type any more in the Web Inspector's
+        search field after the first match is selected in the Resources panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23982
+        rdar://problem/6592367
+
+        Reviewed by Darin Adler.
+
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._jumpToSearchResult): Use the
+        window object of the frame to set the selection, not the main window.
+
+2009-04-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22081
+        <rdar://problem/6346030>
+        Don't allow overriding the return value of window.location.
+
+        Tests: fast/dom/Window/Location/location-override-toString-on-proto-using-defineGetter.html
+               fast/dom/Window/Location/location-override-toString-on-proto-using-with.html
+               fast/dom/Window/Location/location-override-toString-on-proto.html
+               fast/dom/Window/Location/location-override-toString-using-defineGetter.html
+               fast/dom/Window/Location/location-override-toString-using-with.html
+               fast/dom/Window/Location/location-override-toString.html
+               fast/dom/Window/Location/location-override-valueOf-on-proto-using-defineGetter.html
+               fast/dom/Window/Location/location-override-valueOf-on-proto-using-with.html
+               fast/dom/Window/Location/location-override-valueOf-on-proto.html
+               fast/dom/Window/Location/location-override-valueOf-using-defineGetter.html
+               fast/dom/Window/Location/location-override-valueOf-using-with.html
+               fast/dom/Window/Location/location-override-valueOf.html
+               fast/dom/Window/Location/window-override-location-using-defineGetter.html
+               fast/dom/Window/Location/window-override-window-using-defineGetter.html
+               fast/dom/Window/Location/window-shadow-location-using-js-object-with-toString.html
+               fast/dom/Window/Location/window-shadow-location-using-string.html
+               fast/dom/Window/Location/window-shadow-window-using-js-object-with-location-field.html
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::defineGetter):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::customPut):
+        (WebCore::JSLocation::defineGetter):
+        (WebCore::JSLocationPrototype::customPut):
+        (WebCore::JSLocationPrototype::defineGetter):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * page/Location.idl:
+
+2009-04-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Rolled out r42214 since it seems to have caused crashes on the buildbot.
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::findOrCreateJSProtectedEventListener):
+        (WebCore::JSDOMGlobalObject::findJSEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSEventListener):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::addEventListener):
+        (WebCore::JSWorker::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-04-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for <rdar://problem/6476356>
+        https://bugs.webkit.org/show_bug.cgi?id=23148
+
+        - Use the window object the Location and History objects are directly associated with
+          instead of the lexical global object to pick the object prototype to serve as the
+          base of the their respective prototype chains.
+        - Re-factor as necessary to allow passing the correct global object to the createPrototype
+          functions.
+
+        Tests: http/tests/security/cross-frame-access-history-prototype.html
+               http/tests/security/cross-frame-access-location-prototype.html
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::getCachedDOMStructure):
+        (WebCore::cacheDOMStructure):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::getDOMStructure):
+        (WebCore::getDOMPrototype):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::history):
+        (WebCore::JSDOMWindow::location):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::location):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
+        * bindings/js/JSNamedNodesCollection.h:
+        (WebCore::JSNamedNodesCollection::createPrototype):
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSRGBColor.h:
+        (WebCore::JSRGBColor::createPrototype):
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor):
+        * bindings/js/JSWebKitPointConstructor.cpp:
+        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor):
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::JSWorkerConstructor::JSWorkerConstructor):
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createPrototype):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createPrototype):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createPrototype):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createPrototype):
+        * page/DOMWindow.idl:
+
+2009-04-03  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25009
+        Upstream changes to WorkerContextExecutionProxy for V8 bindings in order to use V8EventListenerList as container.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::WorkerContextExecutionProxy):
+        (WebCore::WorkerContextExecutionProxy::dispose):
+        (WebCore::WorkerContextExecutionProxy::FindOrCreateEventListener):
+        (WebCore::WorkerContextExecutionProxy::RemoveEventListener):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+
+2009-04-03  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed irrelevant ExecState* parameter from event handler registration code.
+        
+        No change in behavior.
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::findOrCreateJSProtectedEventListener):
+        (WebCore::JSDOMGlobalObject::findJSEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSEventListener):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::addEventListener):
+        (WebCore::JSWorker::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-04-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix <rdar://problem/6634771> Under full-page zoom, cannot scroll
+          MobileMe contact list
+
+        Test: fast/css/zoom-in-length-round-trip.html
+
+        * dom/Element.cpp:
+        (WebCore::adjustForLocalZoom): For zoom factors greater than 1, ensure
+        that the returned value is equal to the original unscaled value.
+        (WebCore::adjustForAbsoluteZoom): Ditto.
+
+2009-04-03  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=24941
+
+        This fix essentially does a -viewWillDraw call for layout. It adds 
+        a CFRunLoopObserver which performs layout just before drawing on the 
+        Mac platform. This makes sure layout is complete before rendering and 
+        avoids a flash.
+
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::scheduleViewUpdate):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::setCompositingLayersNeedUpdate):
+        (WebCore::RenderLayerCompositor::scheduleViewUpdate):
+        * rendering/RenderLayerCompositor.h:
+
+2009-04-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=24648
+
+        Optimize mapPoint(), mapRect() and mapQuad() for identity matrix and translations.
+        
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::mapPoint):
+        (WebCore::TransformationMatrix::mapRect):
+        (WebCore::TransformationMatrix::mapQuad):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::mapPoint):
+
+2009-04-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=25018
+        
+        Add containsPoint() and containsQuad() methods to FloatQuad.
+
+        * platform/graphics/FloatQuad.cpp:
+        (WebCore::dot):
+        (WebCore::isPointInTriangle):
+        (WebCore::FloatQuad::containsPoint):
+        (WebCore::FloatQuad::containsQuad):
+        * platform/graphics/FloatQuad.h:
+
+2009-04-03  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Darin.
+
+        *  loader/ProgressTracker.cpp: Included DocumentLoader.h
+        (WebCore::ProgressTracker::incrementProgress): Limit the 50%-clamp rule to 
+        documents that use WebCore's layout system.
+
+2009-04-03  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25029
+        <rdar://problem/6336092> REGRESSION: movie does not resize correctly
+
+        Test: media/video-size-intrinsic-scale.html
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::naturalSize): Use QTMovieCurrentSizeAttribute instead 
+        of QTMovieNaturalSizeAttribute so we return the correct size for movies saved
+        with a non-default matrix.
+        (WebCore::MediaPlayerPrivate::setSize): Don't resize the QTMovieView
+        because [QTMovieView setFrame] also resizes the movie itself, and as
+        the renderer calls setSize immediately when a movie reports a size change
+        (QTMovieSizeDidChangeNotification) we can get into a feedback loop
+        observing the size change and resetting the size, and this can cause
+        QuickTime to miss correctly setting a movie's size when the media size
+        changes after opening (as happens with an rtsp movie once the server sends
+        the track sizes). Instead, remember the size passed to paint() and 
+        resize the view when it changes.
+        (WebCore::MediaPlayerPrivate::paint): Resize the view when passed a new size.
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::getNaturalSize): Use GetMovieBox instead of GetMovieNaturalBoundsRect
+        so we return the correct size for movies saved with non-default matrix.
+
+2009-04-03  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Restore FrameLoader::policyDocumentLoader to fix the Chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=25028
+
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::policyDocumentLoader):
+
+2009-04-02  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Use long long, not int64, when working in webcore (sorry).
+        https://bugs.webkit.org/show_bug.cgi?id=25011
+
+        No change in functionality, so no tests.
+
+        * platform/network/chromium/ResourceResponse.h:
+        (WebCore::ResourceResponse::getAppCacheID):
+        (WebCore::ResourceResponse::setAppCacheID):
+
+2009-04-03  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        Remove pre-processor checks for GTK+ >= 2.10, since we now require
+        at least that version.
+
+        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        * platform/gtk/ContextMenuItemGtk.cpp:
+        (WebCore::gtkStockIDFromContextMenuAction):
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/gtk/LocalizedStringsGtk.cpp:
+        (WebCore::contextMenuItemTagSelectAll):
+        * platform/gtk/MouseEventGtk.cpp:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/gtk/PasteboardGtk.cpp:
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::documentFragment):
+        * platform/gtk/WheelEventGtk.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-04-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+        
+        https://bugs.webkit.org/show_bug.cgi?id=25021
+        
+        Fix repainting an element with a reflection and transform after layout.
+        Telling the reflection to repaint directly is wrong, because, with
+        LayoutState enabled, it only takes the reflection's transform into account,
+        not that of the element. We can fix this, and keep the benefits of LayoutState,
+        by computing the reflected repaint rect, and repainting that using the original
+        renderer.
+
+        Test: fast/repaint/reflection-repaint-test.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+
+2009-04-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+        
+        https://bugs.webkit.org/show_bug.cgi?id=23307
+        
+        When repainting during layout (when LayoutState is enabled), we need
+        to apply the transform to the dirty rect, before applying x(), y() and
+        the offset storted in the LayoutState.
+        
+        Also bypass LayoutState in mapLocalToContainer() if we have a repaintContainer,
+        since LayoutState is always root-relative.
+
+        Test: fast/repaint/transform-layout-repaint.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        (WebCore::RenderBox::computeRectForRepaint):
+
+2009-04-02  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Mac build after r42191.
+
+        * WebCore.base.exp:
+
+2009-04-02  Mark Rowe  <mrowe@apple.com>
+
+        Fix Windows build after r42190.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::keyEvent):  Update to use the new name of the constant.
+
+2009-04-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/6625840> Previous Page isn't loaded after hitting back button at http://www.breakingnews.ie/
+
+        Test: http/tests/navigation/onload-navigation-iframe-2.html
+
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::HTMLFrameElement): Removed unneeded createdByParser flag.
+        * html/HTMLFrameElement.h: Ditto.
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::HTMLFrameElementBase): Ditto.
+        * html/HTMLFrameElementBase.h: Ditto.
+        * html/HTMLFrameOwnerElement.cpp:
+        (WebCore::HTMLFrameOwnerElement::HTMLFrameOwnerElement): Ditto.
+        * html/HTMLFrameOwnerElement.h: Ditto.
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::HTMLIFrameElement): Ditto.
+        * html/HTMLIFrameElement.h: Ditto.
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::HTMLPlugInElement): Ditto.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::submitForm): Removed unneeded check of the createdByParser flag.
+        The original change that introduced this, http://trac.webkit.org/changeset/25410, does
+        not make it clear why this check was needed. And it seems it is not needed.
+
+2009-04-02  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add a way to get a list of focusable nodes.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        (WebCore::Document::getFocusableNodes):
+        * dom/Document.h:
+
+2009-04-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6654255> crash due to null FrameView in EventHandler
+
+        Lots of code was added to EventHandler that used view() and page() without
+        null checking, but both of those can become null due to the frame lifetime.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+        (WebCore::EventHandler::eventMayStartDrag):
+        (WebCore::EventHandler::handleAutoscroll):
+        (WebCore::EventHandler::autoscrollTimerFired):
+        (WebCore::EventHandler::setPanScrollCursor):
+        (WebCore::EventHandler::allowDHTMLDrag):
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        (WebCore::EventHandler::stopAutoscrollTimer):
+        (WebCore::EventHandler::selectCursor):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        (WebCore::EventHandler::dispatchDragEvent):
+        (WebCore::EventHandler::prepareMouseEvent):
+        (WebCore::EventHandler::dispatchMouseEvent):
+        (WebCore::EventHandler::handleWheelEvent):
+        (WebCore::EventHandler::hoverTimerFired):
+        (WebCore::EventHandler::keyEvent):
+        (WebCore::EventHandler::dragHysteresisExceeded):
+        (WebCore::EventHandler::shouldDragAutoNode):
+        (WebCore::EventHandler::handleDrag):
+        (WebCore::EventHandler::handleTextInputEvent):
+        (WebCore::EventHandler::addPendingFrameUnloadEventCount):
+        (WebCore::EventHandler::removePendingFrameUnloadEventCount):
+        (WebCore::EventHandler::clearPendingFrameUnloadEventCount):
+        (WebCore::EventHandler::addPendingFrameBeforeUnloadEventCount):
+        (WebCore::EventHandler::removePendingFrameBeforeUnloadEventCount):
+        (WebCore::EventHandler::clearPendingFrameBeforeUnloadEventCount):
+        Added null checks for view() and page(). Made minor code cleanups.
+
+2009-04-02  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix regression in <object> layout test.  Make sure that even though a 404 image loads, that <object>
+        still considers it an error for the purposes of firing onerror.
+
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::dispatchLoadEvent):
+
+2009-04-02  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25010
+        Refactor InspectorController to replace all JS function invocations with
+        ScriptFunctionCall.
+
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument): Added int, UString,
+            and JSValuePtr methods.
+        (WebCore::ScriptFunctionCall::call): Added simplified, exception-eating
+            method.
+        * bindings/js/ScriptFunctionCall.h: Decls for above.
+        * bindings/js/ScriptObjectQuarantine.cpp: Added helper for Node and DOMWindow.
+        (WebCore::getQuarantinedScriptObject):
+        * bindings/js/ScriptObjectQuarantine.h: Decls for above.
+        * inspector/InspectorController.cpp:
+        (WebCore::callSimpleFunction): Made into a static.
+        (WebCore::InspectorController::focusNode): Refactored to use ScriptFunctionCall.
+        (WebCore::InspectorController::toggleRecordButton): Ditto.
+        (WebCore::InspectorController::startGroup): Ditto.
+        (WebCore::InspectorController::setAttachedWindow): Ditto.
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared): Ditto.
+        (WebCore::InspectorController::addScriptProfile): Ditto.
+        (WebCore::InspectorController::didParseSource): Ditto.
+        (WebCore::InspectorController::failedToParseSource): Ditto.
+        (WebCore::InspectorController::didPause): Ditto.
+        * inspector/InspectorController.h: Removed callFunction and callSimpleFunction
+            decls.
+
+2009-04-02  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Upstream changes to V8WorkerContextEventListener for V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=25007
+
+        * bindings/v8/V8ObjectEventListener.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+
+2009-04-02  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Upstream V8WorkerContextObjectEventListener for V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=25005
+
+        * bindings/v8/V8WorkerContextObjectEventListener.cpp: Added.
+        * bindings/v8/V8WorkerContextObjectEventListener.h: Added.
+
+2009-04-02  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Upstream V8EventListenerList for V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=25004
+
+        * bindings/v8/V8EventListenerList.cpp: Added.
+        * bindings/v8/V8EventListenerList.h: Added.
+
+2009-04-02  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Chromium's ResourceRequest and ResourceResponse structs need some new data members.
+        https://bugs.webkit.org/show_bug.cgi?id=24897
+
+        These fields are needed to facilitate Chromium's implementation of the HTML5
+        ApplicationCache feature. We need to know what frame (or context) is doing the
+        requesting, and from what cache the resulting resource was retrieved.
+
+        No change in functionality, so no tests.
+
+        * platform/network/chromium/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::appCacheContextID):
+        (WebCore::ResourceRequest::setAppCacheContextID):
+        * platform/network/chromium/ResourceResponse.h:
+        (WebCore::ResourceResponse::ResourceResponse):
+        (WebCore::ResourceResponse::getAppCacheID):
+        (WebCore::ResourceResponse::setAppCacheID):
+
+2009-04-02  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=24643.
+        
+        Make sure images just ignore HTTP error codes and keep loading anyway.  Only <object> checks http error codes and falls back.  Everyone
+        else just ignores it and displays the image anyway.
+
+        Added http/tests/misc/image-error.html
+
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::notifyFinished):
+        * loader/CachedImage.cpp:
+        (WebCore::CachedImage::CachedImage):
+        * loader/CachedImage.h:
+        (WebCore::CachedImage::httpStatusCodeError):
+        (WebCore::CachedImage::httpStatusCodeErrorOccurred):
+        * loader/CachedResource.h:
+        (WebCore::CachedResource::httpStatusCodeError):
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::didReceiveData):
+
+2009-04-02  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add XHR constructor in WorkerContext.idl for V8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=24962
+
+        * workers/WorkerContext.idl:
+
+2009-04-02  Ben Murdoch  <benm@google.com>
+
+        Fix Bug 19743: Release build fails on 32-bit Windows
+
+        <https://bugs.webkit.org/show_bug.cgi?id=19743>
+
+        Combines all the HTML element cpp files into one to help reduce the
+        size of WebCore.lib so we can build in release mode on 32bit Windows.
+
+        Reviewed by Adam Roben.
+
+        * WebCore.vcproj/WebCore.vcproj: Excluded all the separate
+        HTML*Element.cpp files from the build. Added HTMLElementsAllInOne.cpp
+        to the build.
+        * html/HTMLElementsAllInOne.cpp: Added.
+
+2009-04-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=24999
+        
+        Optimize hit testing with transforms.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        (WebCore::RenderBox::mapAbsoluteToLocalPoint):
+        getTransformFromContainer() change to return the matrix by reference.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::update3DTransformedDescendantStatus):
+        The method failed to set m_3DTransformedDescendantStatusDirty to false,
+        so did the work every time.
+
+        (WebCore::RenderLayer::createLocalTransformState):
+        Only call the expensive getTransformFromContainer() if there is a transform,
+        otherwise we just have a translation.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::getTransformFromContainer):
+        * rendering/RenderObject.h:
+        Change transformFromContainer() to getTransformFromContainer(), and return
+        the matrix by reference to reduce copying.
+        New enum values for arguments for readability.
+
+        * rendering/TransformState.cpp:
+        (WebCore::TransformState::move):
+        (WebCore::TransformState::applyTransform):
+        (WebCore::HitTestingTransformState::translate):
+        New method that adds a translation to the accumulated matrix, optionally
+        without flattening. Cheaper than applyTransform().
+
+        (WebCore::HitTestingTransformState::applyTransform):
+        (WebCore::HitTestingTransformState::flatten):
+        (WebCore::HitTestingTransformState::flattenWithTransform):
+        Add flattenWithTransform(), which is a helper that allows us to
+        avoid doing the inverse() twice.
+
+        * rendering/TransformState.h:
+        (WebCore::TransformState::):
+        (WebCore::TransformState::move):
+        (WebCore::HitTestingTransformState::):
+        New method on HitTestingTransformState that adds a translation to the
+        accumulated matrix, optionally without flattening. Cheaper than applyTransform().
+        New enum values for arguments for readability.
+
+2009-04-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24648
+        
+        Optimize common code paths in TransformationMatrix.
+
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::translate):
+        (WebCore::TransformationMatrix::translate3d):
+        Optimize to avoid matrix copy.
+        
+        (WebCore::TransformationMatrix::isInvertible):
+        Test for identity and translation matrices before computing
+        the determinant.
+        
+        (WebCore::TransformationMatrix::inverse):
+        Optimize for identity matrix and translations.
+        
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::isIdentityOrTranslation):
+        Utility method.
+
+2009-04-02  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24930
+        [Gtk] ISO files content is displayed inside the webview instead of being downloaded
+
+        Also sniff content of types declared as text/plain. This is
+        justified by the fact that it is common to have Apache HTTP
+        servers configured to send text/plain as Content-Type by default.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::gotHeadersCallback):
+
+2009-04-02  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Protect the handle when notifying the client that the response was
+        received also in gotChunkCallback, or we crash in didReceiveData
+        when the load is cancelled in didReceiveResponse.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::gotChunkCallback):
+
+2009-04-02  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=25001
+        Crash when content type parameters have no value
+
+        Handle the case where a Content-Type header parameter has no
+        value (i.e. no = character), to work-around a bug in libsoup.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+
+2009-04-02  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24490
+
+        Enable web workers in Qt.
+
+        * WebCore.pro:
+
+2009-04-01  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler. Based on work of Julien Chaffraix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22475
+        REGRESSION: Async XMLHttpRequest never finishes on nonexistent files anymore
+
+        https://bugs.webkit.org/show_bug.cgi?id=24886
+        XHR requests opened when offline never return
+
+        Tests: fast/xmlhttprequest/xmlhttprequest-nonexistent-file.html
+               http/tests/xmlhttprequest/state-after-network-error.html
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener): Only dispatch load event if this
+        wasn't an error.
+        (WebCore::XMLHttpRequest::abort): Fixed formatting.
+        (WebCore::XMLHttpRequest::genericError): Change state to DONE and dispatch readystatechange.
+        The comment saying that this doesn't match Firefox was added in r33559 without explanation
+        or tests, and I don't think that it's accurate. Also, Firefox and Safari 3 both change state
+        to HEADERS_RECEIVED before DONE on error - this doesn't match the spec, and I doubt
+        that any code depends on this, so I went with the spec here.
+
+2009-04-01  Steve Falkenburg  <sfalken@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=24997
+        Race conditions in icon database threading code
+        
+        m_syncThreadRunning set was mistakenly eliminated in r27717.
+        This reintroduces it.
+
+        Reviewed by Oliver Hunt.
+
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open): Set m_syncThreadRunning.
+
+2009-04-01  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6748609> Use ActiveDOMObject to suspend marquees
+        
+        Make marquees ActiveDOMObjects, get rid of the special suspension code.
+
+        * html/HTMLMarqueeElement.cpp:
+        (WebCore::HTMLMarqueeElement::HTMLMarqueeElement):
+        (WebCore::HTMLMarqueeElement::canSuspend):
+        (WebCore::HTMLMarqueeElement::suspend):
+        (WebCore::HTMLMarqueeElement::resume):
+        * html/HTMLMarqueeElement.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::clearTimers):
+        * rendering/RenderLayer.cpp:
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::marquee):
+
+2009-04-01  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Darin Adler
+
+        Make constant values static in previous commit, as suggested
+        by Darin.
+
+        * rendering/RenderVideo.cpp:
+
+2009-04-01  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser
+
+        https://bugs.webkit.org/show_bug.cgi?id=24993
+
+        Standalone media should have a smaller instrinsic
+        height.
+
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::RenderVideo):
+
+2009-04-01  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 22378: Crash submitting a form when parsing an XHTML document
+        https://bugs.webkit.org/show_bug.cgi?id=22378
+        rdar://problem/6388377
+
+        Tests: fast/loader/submit-form-while-parsing-1.xhtml
+               fast/loader/submit-form-while-parsing-2.html
+
+        * WebCore.base.exp: Updated.
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem): Renamed m_subItems to m_children.
+        Used uncheckedAppend because we reserveInitialCapacity.
+        (WebCore::HistoryItem::addChildItem): Renamed m_subItems to m_children.
+        Added an assertion that this is only used to add items that don't have
+        duplicate frame names.
+        (WebCore::HistoryItem::setChildItem): Added. Replaces an existing item
+        if any, preserving the isTargetItem flag.
+        (WebCore::HistoryItem::childItemWithTarget): Renamed from childItemWithName
+        for consistency with the other functions here that all call the frame name the
+        "target". Also updated for rename of m_subItems to m_children.
+        (WebCore::HistoryItem::findTargetItem): Renamed from recurseToFindTargetItem.
+        Removed unneeded size check.
+        (WebCore::HistoryItem::targetItem): Changed to always return the top item
+        if no item has the isTargetItem flag set. The old version would instead return
+        0 in some cases, but return the top item if it had no children.
+        (WebCore::HistoryItem::children): Renamed m_subItems to m_children.
+        (WebCore::HistoryItem::hasChildren): Ditto.
+        (WebCore::HistoryItem::showTreeWithIndent): Ditto.
+
+        * history/HistoryItem.h: Name changes.
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::submit): Create and pass a FormState instead of
+        attaching "recorded form values" and "form about to be submitted" to the frame
+        loader. Parameter work fine for this; there's no need to store state on the
+        FrameLoader.
+
+        * loader/FormState.cpp:
+        (WebCore::FormState::FormState): Adopt a vector instead of copying a hash map.
+        (WebCore::FormState::create): Ditto.
+        * loader/FormState.h: Update to use a vector that we adopt instead of hash map
+        that we copy for auto-fill text field values.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::ScheduledRedirection::ScheduledRedirection): Added a new case for
+        form submissions and turned the "wasDuringLoad" state into a separate boolean
+        instead of using a special redirection type to track it.
+        (WebCore::FrameLoader::createWindow): Updated for name and argument change of
+        loadFrameRequest.
+        (WebCore::FrameLoader::urlSelected): Ditto.
+        (WebCore::FrameLoader::submitForm): Removed the "deferred form submission"
+        machinery, replacing it with the "scheduled redirection" mechanism, shared
+        with other kinds of redirection and navigation. Moved frame targeting here
+        so we can schedule the redirection on the right frame. Moved the multiple
+        form submission protection here. Moved the code to implement the rule that
+        m_navigationDuringLoad was used for here too.
+        (WebCore::FrameLoader::didOpenURL): Use the new wasDuringLoad flag instead
+        of the locationChangeDuringLoad type to detect location change during a load.
+        (WebCore::FrameLoader::executeScript): Removed call to now-obsolete function,
+        submitFormAgain.
+        (WebCore::FrameLoader::scheduleLocationChange): Moved the code to stop loading
+        out of this function into scheduleRedirection, so it can be shared with the
+        new scheduleFormSubmission function.
+        (WebCore::FrameLoader::scheduleFormSubmission): Added. Almost the same as
+        scheduleLocationChange, but with the arguments for a form submission.
+        (WebCore::FrameLoader::scheduleRefresh): Updated for the change to the
+        duringLoad flag.
+        (WebCore::FrameLoader::isLocationChange): Added case for formSubmission
+        and removed case for locationChangeDuringLoad.
+        (WebCore::FrameLoader::redirectionTimerFired): Ditto. Also removed unneeded
+        completeURL call and just use KURL constructor to match the other cases.
+        (WebCore::FrameLoader::provisionalLoadStarted): Removed the code to set up
+        the m_navigationDuringLoad, which is no longer needed. The new version of
+        this is in the submitForm function and sets the lockHistory boolean.
+        (WebCore::FrameLoader::scheduleRedirection): Moved the code to stop a load
+        in here that used to be in scheduleLocationChange.
+        (WebCore::FrameLoader::startRedirectionTimer): Added case for formSubmission
+        and removed case for locationChangeDuringLoad.
+        (WebCore::FrameLoader::stopRedirectionTimer): Ditto.
+        (WebCore::FrameLoader::completed): Removed call to now-obsolete function,
+        submitFormAgain.
+        (WebCore::FrameLoader::loadFrameRequest): Renamed from
+        loadFrameRequestWithFormAndValues. Replaced form element and form values
+        argument with a single FormState argument. Changed frame targeting code
+        to use the source frame in the case of a form submission to better match
+        the actual target frame.
+        (WebCore::FrameLoader::loadURL): Don't search for existing frames in the
+        form submission case since we already did that in the submitForm function.
+        (WebCore::FrameLoader::clientRedirected): Changed to work with the
+        m_isExecutingJavaScriptFormAction data member directly instead of taking
+        it as a function parameter.
+        (WebCore::FrameLoader::loadPostRequest): Don't search for existing frames
+        in the form submission case since we already did that in the submitForm
+        function.
+        (WebCore::FrameLoader::addBackForwardItemClippedAtTarget): Moved comment
+        in here that was misplaced elsewhere in the file.
+        (WebCore::FrameLoader::findFrameForNavigation): Changed to use the early
+        return idiom.
+        (WebCore::FrameLoader::recursiveGoToItem): Updated for HistoryItem changes.
+        (WebCore::FrameLoader::childFramesMatchItem): Ditto.
+        (WebCore::FrameLoader::updateHistoryForStandardLoad): Removed the
+        m_navigationDuringLoad logic; that's now handled by setting lockHistory
+        to true in the submitForm function.
+        (WebCore::FrameLoader::updateHistoryForRedirectWithLockedBackForwardList):
+        Use the new setChildItem function so we don't get multiple items for the
+        same frame name in the history item tree in the back/forward list.
+
+        * loader/FrameLoader.h: Renamed loadFrameRequestWithFormAndValues to
+        loadFrameRequest and made it take a form state object instead of the
+        form element and form values. Removed the unused functions
+        loadEmptyDocumentSynchronously, provisionalDocumentLoader,
+        notifyIconChnaged, and updateBaseURLForEmptyDocument. Changed the
+        submitForm function to take a form state argument. Eliminated the
+        clearRecordedFormValues, setFormAboutToBeSubmitted, and recordFormValue
+        functions, which are replaced by the form state arguments to submitForm
+        and loadFrameRequest. Removed the isJavaScriptFormAction argument from
+        the clientRedirected function; instead it looks at a data member directly.
+        Eliminated the submitFormAgain and overload of the submitForm function;
+        these are now subsumed into the remaining submitForm function and the
+        scheduleFormSubmission function. Removed unused and obsolete data
+        members m_navigationDuringLoad, m_deferredFormSubmission,
+        m_formAboutToBeSubmitted and m_formValuesAboutToBeSubmitted.
+
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        Updated for name and argument change of loadFrameRequest.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::~Frame): Removed call to the now-unneeded
+        clearRecordedFormValues function.
+
+2009-04-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Unreviewed, fixing previous commit.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24994
+        Revert V8DOMMap.cpp change which accidentally snuck into the previous
+        commit.
+
+        * bindings/v8/V8DOMMap.cpp: Revert change in previous commit.
+
+2009-04-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24994
+        Fix miscellaneous merge/upstreaming divergencies in Chromium port.
+
+        * bindings/v8/V8Collection.h: Added an include.
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::baseAsString): Added to match KURL.cpp.
+        * platform/chromium/ClipboardChromium.cpp: Added an include.
+
+2009-04-01  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24989
+        Refactor InspectorResource to use ScriptObject/FunctionCall.
+
+        * bindings/js/JSInspectorControllerCustom.cpp:
+        (WebCore::JSInspectorController::addResourceSourceToFrame): Tweaked to use
+            a more appropriate type conversion.
+        (WebCore::JSInspectorController::getResourceDocumentNode): Tweaked to
+            accommodate for InspectorResource refactoring.
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument): Added long long type to match
+            existing jsNumber call signature.
+        * bindings/js/ScriptFunctionCall.h: Declaration for above.
+        * bindings/js/ScriptObject.cpp:
+        (WebCore::createEmptyObject): Added.
+        (WebCore::ScriptObject::ScriptObject):
+        (WebCore::ScriptObject::set): Added a bunch of property setters.
+        * bindings/js/ScriptObject.h: Declarations for above.
+        * inspector/InspectorController.cpp: Moved all InspectorResource-managing code
+            to InspectorResource.cpp
+        (WebCore::InspectorController::populateScriptObjects): Changed to use
+            refactored InspectorResource.
+        (WebCore::InspectorController::resetScriptObjects): Ditto.
+        (WebCore::InspectorController::pruneResources): Ditto.
+        (WebCore::InspectorController::didCommitLoad): Ditto.
+        (WebCore::InspectorController::addResource): Ditto.
+        (WebCore::InspectorController::removeResource): Ditto.
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache): Ditto.
+        (WebCore::InspectorController::identifierForInitialRequest): Ditto.
+        (WebCore::InspectorController::willSendRequest): Ditto.
+        (WebCore::InspectorController::didReceiveResponse): Ditto.
+        (WebCore::InspectorController::didReceiveContentLength): Ditto.
+        (WebCore::InspectorController::didFinishLoading): Ditto.
+        (WebCore::InspectorController::didFailLoading): Ditto,
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest): Ditto.
+        (WebCore::InspectorController::scriptImported): Ditto.
+        * inspector/InspectorController.h: Removed InspectorResource-managing code decls
+            and tweaked some signatures to use ScriptString and long long for identifier.
+        * inspector/InspectorController.idl: Changed to use long long for identifier.
+        * inspector/InspectorResource.cpp: Refactored to use ScriptObject/FunctionCall.
+        (WebCore::InspectorResource::InspectorResource): Ditto.
+        (WebCore::InspectorResource::~InspectorResource): Ditto.
+        (WebCore::InspectorResource::createCached): Added.
+        (WebCore::InspectorResource::updateRequest): Added.
+        (WebCore::InspectorResource::updateResponse): Added.
+        (WebCore::createHeadersObject): Added.
+        (WebCore::InspectorResource::createScriptObject): Added.
+        (WebCore::InspectorResource::updateScriptObject): Added.
+        (WebCore::InspectorResource::releaseScriptObject): Added.
+        (WebCore::InspectorResource::type): Tweaked to use ScriptString.
+        (WebCore::InspectorResource::setXMLHttpResponseText): Added.
+        (WebCore::InspectorResource::sourceString): Tweaked to use ScriptString.
+        (WebCore::InspectorResource::startTiming): Added.
+        (WebCore::InspectorResource::markResponseReceivedTime): Added.
+        (WebCore::InspectorResource::endTiming): Added.
+        (WebCore::InspectorResource::markFailed): Added.
+        (WebCore::InspectorResource::addLength): Added.
+        * inspector/InspectorResource.h: Added decls for newly refactored-in methods.
+        (WebCore::InspectorResource::create): Added.
+        (WebCore::InspectorResource::isSameLoader): Added.
+        (WebCore::InspectorResource::markMainResource): Added.
+        (WebCore::InspectorResource::identifier): Added.
+        (WebCore::InspectorResource::requestURL): Added.
+        (WebCore::InspectorResource::frame): Added.
+        (WebCore::InspectorResource::mimeType): Added.
+        (WebCore::InspectorResource::Changes::Changes): Added new class to track
+            resource changes.
+        (WebCore::InspectorResource::Changes::hasChange): Added.
+        (WebCore::InspectorResource::Changes::set): Added.
+        (WebCore::InspectorResource::Changes::clear): Added.
+        (WebCore::InspectorResource::Changes::setAll): Added.
+        (WebCore::InspectorResource::Changes::clearAll): Added.
+
+2009-04-01  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Ensure the right click doesn't deselect text under it.  This was
+        happening in the Chromium and GTK+ ports because they don't select
+        the text under the cursor on right click.
+        
+        This was regressed in r41715, https://bugs.webkit.org/show_bug.cgi?id=19737
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24946
+
+        Test: fast/events/context-no-deselect.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+
+2009-04-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24991
+        
+        Need to use toRenderBoxModelObject(), not toRenderBox(), to test for layer()
+        when getting the transform.
+        
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::transformFromContainer):
+
+2009-03-31  Darin Adler  <darin@apple.com>
+
+        Rolled out that last change until I can investigate the regression test failures it seems
+        to have caused.
+
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::decrement):
+        * dom/PositionIterator.h:
+        (WebCore::PositionIterator::PositionIterator):
+
+2009-03-31  Darin Adler  <darin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Bug 24621: PositionIterator doesn't iterate "after last child" positions when going backwards
+        https://bugs.webkit.org/show_bug.cgi?id=24621
+
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::decrement): Make sure that when the parent has no children, we
+        don't ever use Position::uncheckedPreviousOffset. This is consistent with the forward
+        iterator, but also should never arise because of the fix below.
+        * dom/PositionIterator.h:
+        (WebCore::PositionIterator::PositionIterator): Fixed so m_offset will always be 0 when
+        the passed-in node has no children. Like the change above, this is consistent with the rest
+        of the class, although in the long run I think it's a bit strange to treat a <p> element
+        with no children differently than a <p> element with children.
+
+2009-03-31  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24965
+        Bug 24965: HTMLMediaElement: network state changes can be missed
+        
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setNetworkState): Always update m_networkState when the
+        state changes, even when no event needs to be fired.
+
+2009-03-31  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24964
+        Bug 24964: HTMLMediaElement: 'waiting' event may fire twice
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setReadyState): Only fire 'waiting' event once when ready state
+        drops below HAVE_FUTURE_DATA.
+
+2009-03-31  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24846
+        Bug 24846: HTMLMediaElement should implement 'autobuffer' attribute
+
+        Add 'autobuffer' attrubute to media element. 'autobuffer' is a hint that
+        the author recommends downloading the entire resource optimistically, so the
+        attribute is made available to the media engine to use if it is able.
+
+        Test: media/video-dom-autobuffer.html
+
+        * html/HTMLAttributeNames.in: Add autobuffer.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::parseMappedAttribute): New.
+        (WebCore::HTMLMediaElement::autobuffer): Ditto.
+        (WebCore::HTMLMediaElement::setAutobuffer): Ditto.
+
+        * html/HTMLMediaElement.h: Declare autobuffer and setAutobuffer.
+
+        * html/HTMLMediaElement.idl: Add autobuffer.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::MediaPlayer): Initialize m_autobuffer.
+        (WebCore::MediaPlayer::autobuffer): New.
+        (WebCore::MediaPlayer::setAutobuffer): Ditto.
+        * platform/graphics/MediaPlayer.h: Declare m_autobuffer, autobuffer and setAutobuffer
+
+        * platform/graphics/MediaPlayerPrivate.h:
+        (WebCore::MediaPlayerPrivateInterface::setAutobuffer): Declare setAutobuffer.
+
+2009-03-31  Craig Schlenter  <craig.schlenter@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24550
+        Check return value of vasprintf. This should keep gcc 4.3.3
+        happy rather than have it complain about attribute warn_unused_result.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::error):
+
+2009-03-31  Dean Jackson  <dino@apple.com>
+
+        Style guide violation!
+
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::defaultEventHandler):
+
+2009-03-31  Dean Jackson  <dino@apple.com>
+
+        Fix Tiger build.
+
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::defaultEventHandler):
+
+2009-03-31  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Upstream V8DOMMap for v8 bindings.
+        https://bugs.webkit.org/show_bug.cgi?id=24951
+
+        * bindings/v8/V8DOMMap.cpp: Added.
+        * bindings/v8/V8DOMMap.h: Added.
+
+2009-03-31  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24955
+
+        Spacebar didn't play/pause in standalone MediaDocument
+
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::defaultEventHandler):
+
+2009-03-31  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24901
+        Added the following methods to MediaPlayerPrivate for Chromium port.
+        void sizeChanged();
+        void rateChanged();
+        void durationChanged();
+
+        The above changes are to reflect changes in MediaPlayer.cpp.
+        More details can be found in the original changeset.
+        http://trac.webkit.org/changeset/41907
+
+        * platform/graphics/chromium/MediaPlayerPrivateChromium.h:
+
+2009-03-31  Rafael Weinstein  <rafaelw@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24947
+
+        Special-case drawing text-shadow on win32, to let GDI draw in cases
+        when both fill & shadow color are opaque and the shadow has no blur.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::windowsCanHandleDrawTextShadow):
+        (WebCore::windowsCanHandleTextDrawing):
+        * platform/graphics/skia/SkiaFontWin.h:
+
+2009-03-31  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        r42055 removed some functions in FrameLoader used by Chrome,
+        this CL backs out some of those changes to unbreak the Chrome build.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24949
+
+        * WebCore.base.exp:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+
+2009-03-31  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Build fixes for Chromium.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24945
+
+        * dom/Document.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::imageToMarkup):
+
+2009-03-31  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer): Use NamedNodeMap instead of NamedAttrMap.
+
+2009-03-30  Steve Falkenburg  <sfalken@apple.com>
+
+        Don't create CFDataRef with a fixed size.
+        Fixes synchronous XMLHTTPRequests on Windows.
+        
+        Reviewed by Ada Chan.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::WebCoreSynchronousLoader::didReceiveData):
+
+2009-03-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 24594: PolicyDelegate NavigationAction is WebNavigationTypeOther instead of WebNavigationTypeReload
+        https://bugs.webkit.org/show_bug.cgi?id=24594
+        rdar://problem/6682110
+
+        Test: fast/loader/reload-policy-delegate.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadWithDocumentLoader): Set the triggering action here where we know it's
+        the policy loader and can use m_policyLoadType rather than letting it get set inside
+        checkNavigationPolicy.
+
+2009-03-30  Timothy Hatcher  <timothy@apple.com>
+
+        <rdar://problem/5838871> CrashTracer: 1483 crashes Quicklooking
+        in Finder (painting without up to date layout)
+
+        Reviewed by Dan Bernstein.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents): Add an early return when
+        painting is attempted when layout is needed.
+
+2009-03-30  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24938
+        
+        Sort alphabetically.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+2009-03-30  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24938
+        
+        Build fixes for building --3d-rendering and --no-svg
+
+        * rendering/RenderLayerBacking.cpp:
+
+2009-03-30  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24938
+
+        Build fixes when building --no-svg
+        
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue): Add missing CSS properties
+        * css/CSSCursorImageValue.cpp:
+        (WebCore::CSSCursorImageValue::updateIfSVGCursorIsUsed): Handle unused param
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Add missing CSS properties
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Add missing CSS properties
+        * dom/Node.cpp:
+        (WebCore::updateSVGElementInstancesAfterEventListenerChange): Handle unused param
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::floatWidth): Handle unused param
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData): Handle unused param
+
+2009-03-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Bug 24916: REGRESSION: NavigationAction policy dispatch broken
+        https://bugs.webkit.org/show_bug.cgi?id=24916
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadURL): Rearrange the code so that the "event" PassRefPtr
+        is not used twice. This also optimizes the case where a frame name is specified,
+        but it's the name of the frame being loaded. Also called release in all the final
+        uses of FormState.
+
+2009-03-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Bug 24937: NamedNodeMap and NamedAttrMap should not be separate classes
+        https://bugs.webkit.org/show_bug.cgi?id=24937
+
+        Also should fix the Windows COM bindings build.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Removed special case for NamedNodeMap.
+        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
+
+        * dom/NamedAttrMap.h: Renamed class from NamedAttrMap to
+        NamedNodeMap and removed NamedNodeMap base class. Made the NamedNodeMap
+        functions all public and non-virtual. Removed virtualLength.
+
+        * dom/NamedNodeMap.h: Replaced file with just an include
+        of NamedAttrMap.h. As a follow up we will rename the NamedAttrMap
+        files and remove this file.
+
+        * bindings/js/JSNamedNodesCollection.cpp: Renamed from NamedAttrMap to NamedNodeMap.
+        * dom/Attr.h: Ditto.
+        * dom/Attribute.h: Ditto.
+        * dom/Document.cpp:
+        (WebCore::Document::importNode): Ditto.
+        * dom/Element.cpp:
+        (WebCore::Element::attributes): Ditto.
+        (WebCore::Element::setAttributeMap): Ditto.
+        (WebCore::Element::createAttributeMap): Ditto.
+        (WebCore::Element::insertedIntoDocument): Ditto.
+        (WebCore::Element::removedFromDocument): Ditto.
+        (WebCore::Element::openTagStartToString): Ditto.
+        (WebCore::Element::removeAttributeNode): Ditto.
+        (WebCore::Element::getAttributeNode): Ditto.
+        (WebCore::Element::getAttributeNodeNS): Ditto.
+        (WebCore::Element::hasAttribute): Ditto.
+        (WebCore::Element::hasAttributeNS): Ditto.
+        (WebCore::Element::normalizeAttributes): Ditto.
+        * dom/Element.h: Ditto.
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedNodeMap::detachAttributesFromElement): Ditto.
+        (WebCore::NamedNodeMap::~NamedNodeMap): Ditto.
+        (WebCore::NamedNodeMap::isMappedAttributeMap): Ditto.
+        (WebCore::NamedNodeMap::getNamedItem): Ditto.
+        (WebCore::NamedNodeMap::getNamedItemNS): Ditto.
+        (WebCore::NamedNodeMap::removeNamedItem): Ditto.
+        (WebCore::NamedNodeMap::removeNamedItemNS): Ditto.
+        (WebCore::NamedNodeMap::setNamedItem): Ditto.
+        (WebCore::NamedNodeMap::item): Ditto.
+        (WebCore::NamedNodeMap::getAttributeItem): Ditto.
+        (WebCore::NamedNodeMap::clearAttributes): Ditto.
+        (WebCore::NamedNodeMap::detachFromElement): Ditto.
+        (WebCore::NamedNodeMap::setAttributes): Ditto.
+        (WebCore::NamedNodeMap::addAttribute): Ditto.
+        (WebCore::NamedNodeMap::removeAttribute): Ditto.
+        (WebCore::NamedNodeMap::mapsEquivalent): Ditto.
+        * dom/NamedMappedAttrMap.cpp:
+        (WebCore::NamedMappedAttrMap::clearAttributes): Ditto.
+        * dom/NamedMappedAttrMap.h:
+        (WebCore::NamedMappedAttrMap::NamedMappedAttrMap): Ditto.
+        * dom/Node.cpp:
+        (WebCore::Node::dumpStatistics): Ditto.
+        (WebCore::Node::isEqualNode): Ditto.
+        (WebCore::Node::isDefaultNamespace): Ditto.
+        (WebCore::Node::lookupNamespaceURI): Ditto.
+        (WebCore::Node::lookupNamespacePrefix): Ditto.
+        (WebCore::Node::compareDocumentPosition): Ditto.
+        * dom/Node.h: Ditto.
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::XMLTokenizer): Ditto.
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::isSpanWithoutAttributesOrUnstyleStyleSpan): Ditto.
+        (WebCore::isEmptyFontTag): Ditto.
+        (WebCore::areIdenticalElements): Ditto.
+        * editing/markup.cpp:
+        (WebCore::appendStartMarkup): Ditto.
+        (WebCore::completeURLs): Ditto.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleError): Ditto.
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget): Ditto.
+        * svg/SVGAnimatedProperty.h:
+        (WebCore::synchronizeProperty): Ditto.
+        * xml/XPathFunctions.cpp:
+        (WebCore::XPath::FunLang::evaluate): Ditto.
+        * xml/XPathStep.cpp:
+        (WebCore::XPath::Step::nodesInAxis): Ditto.
+
+2009-03-30  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24750
+        [GTK] requests download instead of displaying page
+
+        Use soup facilities to append parameters to the content type, to
+        make that more robust;
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+
+2009-03-30  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6735683> Move SECTORDER_FLAGS from Xcode project to WebCore.xcconfig
+
+        Reviewed by Timothy Hatcher, Mark Rowe and Darin Adler.
+
+        * Configurations/Base.xcconfig: Moved Production definition of
+        SECTORDER_FLAGS to here from Xcode project file.
+        * Configurations/DebugRelease.xcconfig: Override SECTORDER_FLAGS
+        in Base.xcconfig to the empty string since it is not used for
+        Debug and Release configurations.
+        * WebCore.xcodeproj/project.pbxproj: Removed SECTORDER_FLAGS.
+
+2009-03-30  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after recent Node.idl changes
+
+        * bindings/scripts/CodeGeneratorCOM.pm: Touched this to force sources
+        of classes that derive from Node to rebuild.
+
+2009-03-30  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * svg/graphics/SVGImage.cpp: Added a missing #include.
+
+2009-03-30  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24879
+        Add frame accessor to Screen, Console, and BarInfo objects. Add type 
+        accessor to BarInfo objects.
+
+        In the V8 JavaScript bindings, we need access to the frame and
+        type for already created Screen, Console, and BarInfo objects in
+        order to keep their wrappers alive across GCs.
+
+        * page/BarInfo.cpp:
+        (WebCore::BarInfo::frame): Added.
+        (WebCore::BarInfo::type): Added.
+        * page/BarInfo.h:
+        * page/Console.cpp:
+        (WebCore::Console::frame): Added.
+        * page/Console.h:
+        * page/Screen.cpp:
+        (WebCore::Screen::frame): Added.
+        * page/Screen.h:
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Requested by Antti Koivisto.
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::subresource): Tweaked code to be a little clearer and added
+        a better comment.
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 23445: Copying certain hidden text causes a crash
+        https://bugs.webkit.org/show_bug.cgi?id=23445
+        rdar://problem/6512520
+
+        Test: editing/pasteboard/copy-display-none.html
+
+        * editing/markup.cpp:
+        (WebCore::createMarkup): Added a check for the case where adjusting the start node moves
+        the start of the selection past the end of the range entirely. If we try to iterate we'll
+        never hit the end of the range and will probably crash iterating the rest of the document.
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 24672: ASSERTION FAILURE: !m_purgeableData in WebCore::CachedResource::data() saving a WebArchive
+        https://bugs.webkit.org/show_bug.cgi?id=24672
+        rdar://problem/6574263
+
+        I couldn't create a test case for this. In fact, the case in the bug doesn't exist any more,
+        but there is an Apple-internal website I was able to use to reproduce and fix.
+
+        * loader/CachedResource.h: Made makePurgeable public.
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::subresource): Call makePurgeable to make the resource non-purgeable
+        so we can get its data if it hasn't yet been purged.
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Fix build again.
+
+        * loader/EmptyClients.h: Fix typo in name of FormState.h.
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Try to fix the release build.
+
+        * history/CachedPage.cpp: Make include unconditional, not debug-only.
+
+2009-03-29  Greg Bolsinga  <bolsinga@apple.com>
+
+        Undo that last build fix, since it turned out the file wasn't deleted.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-03-29  Greg Bolsinga  <bolsinga@apple.com>
+
+        Fix build break by removing references to deleted header files.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Try to fix the Windows build.
+
+        * loader/EmptyClients.h: Added include of FormState.h.
+        * loader/MainResourceLoader.cpp: Ditto.
+
+2009-03-29  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24926
+        Fix Chromium build break.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL(DOMWindowShowModalDialog)): renamed 'features' into 'windowFeatures'.
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Another attempt to fix the Qt build.
+
+        * WebCore.pro: Added CheckedRadioButtons.cpp.
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 24921: remove include of HTMLFormElement.h from Document.h
+        https://bugs.webkit.org/show_bug.cgi?id=24921
+
+        * GNUmakefile.am: Added CheckedRadioButtons source files.
+        * WebCore.scons: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+        * bindings/objc/PublicDOMInterfaces.h: Changed type of parentElement to Element.
+
+        * dom/CheckedRadioButtons.cpp: Copied from WebCore/html/HTMLFormElement.cpp.
+        Removed all the code except for CheckedRadioButtons, and moved that out to be
+        a namespace-level class instead of a member of HTMLFormElement.
+
+        * dom/CheckedRadioButtons.h: Copied from WebCore/html/HTMLFormElement.h.
+        Removed all the code except for CheckedRadioButtons, and moved that out to be
+        a namespace-level class instead of a member of HTMLFormElement.
+
+        * dom/Document.h: Removed unneeded includes, including HTMLFormElement.h.
+        Added include of CheckedRadioButtons.h. Changed uses of CheckedRadioButtons
+        class to use a namespace-level class instead of a member of HTMLFormElement.
+
+        * dom/Node.idl: Changed the type of parentElement from Node to Element for
+        two reasons. 1) Node was incorrect, since parentElement returns an Element.
+        2) The bindings won't compile any more unless they know parentElement's
+        return value is an Element due to include changes.
+
+        * html/HTMLFormElement.cpp: Moved definitions of the functions in the
+        CheckedRadioButtons class to the new CheckedRadioButtons.cpp.
+
+        * html/HTMLFormElement.h: Moved definition of the CheckedRadioButtons
+        class to the new CheckedRadioButtons.h.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::checkedRadioButtons): Changed use of CheckedRadioButtons
+        class to use a namespace-level class instead of a member of HTMLFormElement.
+
+        * page/Chrome.cpp:
+        (WebCore::Chrome::createWindow): Tweaked formatting.
+
+        * css/CSSGrammar.y: Added newly-needed include.
+        * dom/Range.cpp: Ditto.
+        * editing/BreakBlockquoteCommand.cpp: Ditto.
+        * editing/CompositeEditCommand.cpp: Ditto.
+        * editing/InsertLineBreakCommand.cpp: Ditto.
+        * editing/ModifySelectionListLevel.cpp: Ditto.
+        * editing/RemoveFormatCommand.cpp: Ditto.
+        * editing/TextIterator.cpp: Ditto.
+        * editing/VisiblePosition.cpp: Ditto.
+        * loader/DocLoader.cpp: Ditto.
+        * page/AccessibilityRenderObject.cpp: Ditto.
+        * page/Page.cpp: Ditto.
+        * rendering/RenderBlock.cpp: Ditto.
+        * rendering/RenderLayer.cpp: Ditto.
+        * rendering/RenderObject.h: Ditto.
+        * storage/LocalStorageArea.cpp: Ditto.
+        * storage/SessionStorageArea.cpp: Ditto.
+
+2009-03-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6015407> attr parsing should allow only identifiers
+
+        Test: fast/css/attr-parsing.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseContent): Allow only CSS_IDENT, and filter out
+        identifiers that start with "-".
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::cssText): Added a case for CSS_ATTR so the test
+        case works. This has the pleasant side effect of fixing a bug too.
+
+2009-03-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        <rdar://problem/6492712> Cross-origin redirects are not handled correctly.
+
+        Forgot to save the file after applying changes for review comments.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willSendRequest):
+        (WebCore::didReceiveResponse):
+        (WebCore::didReceiveData):
+        (WebCore::didSendBodyData):
+        (WebCore::didFinishLoading):
+        (WebCore::didFail):
+        (WebCore::willCacheResponse):
+        (WebCore::didReceiveChallenge):
+        (WebCore::WebCoreSynchronousLoader::willSendRequest):
+        (WebCore::WebCoreSynchronousLoader::didReceiveResponse):
+        (WebCore::WebCoreSynchronousLoader::didReceiveData):
+        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
+        (WebCore::WebCoreSynchronousLoader::didFail):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge):
+
+2009-03-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6492712> Cross-origin redirects are not handled correctly.
+
+        Test: http/tests/xmlhttprequest/redirect-cross-origin-tripmine.html
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        (WebCore::WebCoreSynchronousLoader::willSendRequest):
+        (WebCore::WebCoreSynchronousLoader::didReceiveResponse):
+        (WebCore::WebCoreSynchronousLoader::didReceiveData):
+        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
+        (WebCore::WebCoreSynchronousLoader::didFail):
+        (WebCore::WebCoreSynchronousLoader::didReceiveChallenge):
+        (WebCore::WebCoreSynchronousLoader::load):
+        Match Mac behavior more closely - we shouldn't rely on underlying library handling of
+        synchronous requests.
+
+        * loader/DocumentThreadableLoader.cpp: (WebCore::DocumentThreadableLoader::willSendRequest):
+        -[NSURLConnection cancel] doesn't fully cancel the connection if called from willSendRequest
+        delegate method for a redirect.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]):
+        Match async behavior more closely.
+
+2009-03-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 24914: empty-string assertion crash when running storage tests
+        https://bugs.webkit.org/show_bug.cgi?id=24914
+
+        * storage/Database.cpp:
+        (WebCore::Database::performOpenAndVerify): Don't store empty version strings
+        in the map, since empty strings are per-thread.
+
+2009-03-28  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24910
+        Fixes for Chromium build.
+
+        * bindings/v8/V8LazyEventListener.h: renamed IsInline() into virtualIsInline()
+        * bindings/v8/custom/V8CustomEventListener.h: ditto.
+        * dom/EventListener.h: used #if USE(JSC) to fix the build on non-JSC platform.
+
+2009-03-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Not reviewed, correcting landing error.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24812
+        Custom bindings should be in v8/custom, not v8.
+
+        * bindings/v8/V8HTMLDocumentCustom.cpp: Removed.
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp: Moved from parent dir.
+
+2009-03-28  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24616
+        Add V8 custom bindings for DOMWindow.
+
+        * bindings/v8/custom/V8DOMWindowCustom.cpp: Added.
+
+2009-03-28  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24812
+        Add V8 custom bindings for HTMLDocument.
+
+        * bindings/v8/V8HTMLDocumentCustom.cpp: Added.
+
+2009-03-27  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix two SVG test failures in 64-bit.
+
+        getSubStringLength's arguments were declared as unsigned in the IDL and as signed long in the implementation.
+        This led to a value of -1 in JavaScript being converted to MAX_UINT in the bindings.  In 32-bit this was
+        identical to -1 when interpeted as signed long, but in 64-bit it was still equal to MAX_UINT.
+
+        The solution for this is to use the IsIndex attribute on arguments that the SVG spec declares as "unsigned long"
+        but requires an exception be thrown when a negative value is passed.  This results in the JS bindings handling the
+        check for a negative value and lets the implementation treat the arguments purely as unsigned values.
+
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::getNumberOfChars):
+        (WebCore::SVGTextContentElement::getSubStringLength):
+        (WebCore::SVGTextContentElement::getStartPositionOfChar):
+        (WebCore::SVGTextContentElement::getEndPositionOfChar):
+        (WebCore::SVGTextContentElement::getExtentOfChar):
+        (WebCore::SVGTextContentElement::getRotationOfChar):
+        (WebCore::SVGTextContentElement::getCharNumAtPosition):
+        (WebCore::SVGTextContentElement::selectSubString):
+        * svg/SVGTextContentElement.h:
+        * svg/SVGTextContentElement.idl:
+
+2009-03-27  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Get mailto code out of FrameLoader.
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::transferMailtoPostFormDataToURL): Added. Factored out the mailto
+        logic so HTMLFormElement::submit isn't full of ugly bits. This includes the
+        part of the logic that involves transformeing the URL that was previously
+        inside FrameLoader.
+        (WebCore::HTMLFormElement::submit): Call transferMailtoPostFormDataToURL and
+        also release the data for slightly less refcount churn.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::submitForm): Removed all the special casing for mailto,
+        since HTMLFormElement now properly prepares both the URL and the form data.
+
+2009-03-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix <rdar://problem/6724514> A bit of OpenTypeUtilities cleanup
+
+        * platform/graphics/chromium/FontCustomPlatformData.cpp:
+        (WebCore::EOTStream::EOTStream): Changed to use EOTHeader.
+        (WebCore::createFontCustomPlatformData): Ditto.
+        * platform/graphics/opentype/OpenTypeUtilities.cpp:
+        (WebCore::EOTHeader::EOTHeader): Added. Initializes the buffer size to
+        the size of an EOTPrefix.
+        (WebCore::EOTHeader::updateEOTSize): Added. Updates the size field in
+        the prefix.
+        (WebCore::EOTHeader::appendBigEndianString): Changed the static
+        appendBigEndianStringToEOTHeader() into this member function.
+        (WebCore::EOTHeader::appendPaddingShort): Added.
+        (WebCore::getEOTHeader): Changed to use EOTHeader.
+        * platform/graphics/opentype/OpenTypeUtilities.h:
+        (WebCore::EOTHeader::size):
+        (WebCore::EOTHeader::data):
+        (WebCore::EOTHeader::prefix):
+        * platform/graphics/win/FontCustomPlatformData.cpp:
+        (WebCore::EOTStream::EOTStream): Changed to use EOTHeader.
+        (WebCore::createFontCustomPlatformData): Ditto.
+
+2009-03-27  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        To prepare for work on a form loading fix, remove some unused functions,
+        consolidate some functions, and make many more functions private in
+        FrameLoader.
+
+        * WebCore.base.exp: Remove some unused entry points, update another.
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach): Clear m_frame directly instead of using
+        clearFramePointer.
+        * dom/Document.h: Ditto.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::urlSelected): Consolidate the two functions
+        of this name into a single function. Also changed the event argument
+        to be PassRefPtr<Event>.
+        (WebCore::FrameLoader::submitForm): Changed the event argument to
+        be PassRefPtr<Event>.
+        (WebCore::FrameLoader::scheduleLocationChange): Call completeURL
+        explicitly so we can remove the version of changeLocation that does
+        completeURL for us.
+        (WebCore::FrameLoader::redirectionTimerFired): Ditto.
+        (WebCore::FrameLoader::loadURLIntoChildFrame): Set m_provisionalHistoryItem
+        directly so we don't need a setProvisionalHistoryItem function.
+        (WebCore::FrameLoader::canCachePageContainingThisFrame): Get at
+        m_quickRedirectComing directly so we don't need a isQuickRedirectComing
+        function.
+        (WebCore::FrameLoader::logCanCacheFrameDecision): Ditto.
+        (WebCore::FrameLoader::loadFrameRequestWithFormAndValues): Changed the
+        event argument to be PassRefPtr<Event>.
+        (WebCore::FrameLoader::loadURL): Move the logic of the continueLoadWithData
+        function here because this is the only caller. If we want to make the
+        resulting function smaller we should refactor some other way. Also
+        streamlined the user-chosen encoding logic, but did not change what it does.
+        (WebCore::FrameLoader::finishedLoadingDocument): Changed the event argument
+        to be PassRefPtr<Event>.
+        (WebCore::FrameLoader::loadPostRequest): Ditto.
+        (WebCore::FrameLoader::receivedMainResourceError): Moved the logic from
+        the didNotOpenURL function here, since this was the only caller.
+
+        * loader/FrameLoader.h: Removed include of FormState.h and used a forward
+        declaration instead. Removed unneeded forward declation of Element.
+        Moved many functions into the private section, and removed some other
+        unused or uneeded functions.
+
+2009-03-27  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=24303
+        Using keyboard select RTL text, Highlights goes to opposite direction from Firefox and IE.
+
+        Test: editing/selection/extend-selection.html
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::directionOfEnclosingBlock): Added
+        (WebCore::SelectionController::modifyExtendingRight): Added. Currenctly 
+        implemented for character and word granularity, all other granularities
+        are treated as "forward".
+        (WebCore::SelectionController::modifyExtendingForward): Renamed 
+        modifyExtendingRightForward() to this.
+        (WebCore::SelectionController::modifyExtendingLeft): Added. Currenctly
+        implemented for character and word granularity, all other granularities
+        are treated as "backward".
+        (WebCore::SelectionController::modifyExtendingBackward): Renamed
+        modifyExtendingLeftBackward() to this.
+        (WebCore::SelectionController::modify): Change to call either the 
+        left/right or backward/forward methods depending on the 'dir' argument
+        for extends.
+        * editing/SelectionController.h:
+
+2009-03-27  John Abd-El-Malek  <jam@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24836
+        Fix navigator.plugins.refresh(false) in Chromium.
+
+        * plugins/chromium/PluginDataChromium.cpp:
+        (WebCore::PluginData::refresh):
+
+2009-03-27  Timothy Hatcher  <timothy@apple.com>
+
+        Make scrollLeft, scrollTop, scrollWidth, and scrollHeight
+        virtual to fix the broken layout tests from my last commit.
+
+        Reviewed by Mark Rowe.
+
+        * dom/Element.cpp:
+        (WebCore::Element::scrollLeft):
+        (WebCore::Element::scrollTop):
+        (WebCore::Element::scrollWidth):
+        (WebCore::Element::scrollHeight):
+        * dom/Element.h:
+        * html/HTMLBodyElement.h:
+
+2009-03-27  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=24876>.
+        Bug 24876: fast/forms/select-max-length.html times out in debug builds due to HTMLSelectElement::setLength being O(N^2)
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setLength): Repeatedly calling remove to remove elements causes us to recalculate the list
+        items after each node is removed, leading to O(N^2) behaviour.  By inlining the batch removal in to setLength we can avoid
+        this gratuitous recalcuation.
+
+2009-03-27  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        We don't support images for GtkCursors yet. We need a  placeholder to avoid crashes.
+        I took crosshair to have a common behavior with firefox.
+
+        [GTK] SVG - Crash on setting the cursor icon
+        https://bugs.webkit.org/show_bug.cgi?id=24565
+
+        * platform/gtk/CursorGtk.cpp:
+        (WebCore::Cursor::Cursor):
+
+2009-03-27  Timothy Hatcher  <timothy@apple.com>
+
+        Remove redundant attributes and functions from IDL files that have the
+        same attributes and functions defined in the super class.
+
+        Reviewed by Simon Fraser.
+
+        * WebCore.xcodeproj/project.pbxproj: Remove DOMHTMLBodyElementPrivate.h.
+        * bindings/objc/PublicDOMInterfaces.h: Remove focus and blur from DOMHTMLElement.
+        * html/HTMLBodyElement.idl: Remove scrollLeft, scrollTop, scrollWidth
+        and scrollHeight.
+        * html/HTMLElement.idl: Remove blur and focus.
+
+2009-03-27  Adam Roben  <aroben@apple.com>
+
+        Don't include substitute data URLs in global history redirect chains
+
+        <rdar://6690169>
+
+        Reviewed by Darin Adler.
+
+        This might be testable if:
+          - support were added to DRT for providing substitute data on failed
+            loads
+          - support were added to DRT for dumping redirect chains
+
+        I tried doing the above and was still unable to make a test.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::updateHistoryForStandardLoad):
+        (WebCore::FrameLoader::updateHistoryForRedirectWithLockedBackForwardList):
+        Call updateGlobalHistoryRedirectLinks only if the load succeeded
+        (i.e., there is no unreachableURL). Previous the FrameLoaderClient
+        implementations were unconditionally calling
+        updateGlobalHistoryRedirectLinks from within updateGlobalHistory.
+
+2009-03-27  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24861
+        Chromium port did not render decorations for <input type="search">.
+        This copies RenderThemeWin.*.
+
+        * css/themeChromiumWin.css: Removed.
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::extraDefaultStyleSheet):
+        (WebCore::RenderThemeChromiumLinux::adjustSearchFieldCancelButtonStyle):
+        (WebCore::RenderThemeChromiumLinux::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumLinux::adjustSearchFieldDecorationStyle):
+        (WebCore::RenderThemeChromiumLinux::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::RenderThemeChromiumLinux::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumLinux::adjustSearchFieldResultsButtonStyle):
+        (WebCore::RenderThemeChromiumLinux::paintSearchFieldResultsButton):
+        * rendering/RenderThemeChromiumLinux.h:
+        (WebCore::RenderThemeChromiumLinux::paintSearchField):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::):
+        (WebCore::RenderThemeChromiumWin::extraDefaultStyleSheet):
+        (WebCore::RenderThemeChromiumWin::adjustSearchFieldCancelButtonStyle):
+        (WebCore::RenderThemeChromiumWin::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumWin::adjustSearchFieldDecorationStyle):
+        (WebCore::RenderThemeChromiumWin::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::RenderThemeChromiumWin::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumWin::adjustSearchFieldResultsButtonStyle):
+        (WebCore::RenderThemeChromiumWin::paintSearchFieldResultsButton):
+        * rendering/RenderThemeChromiumWin.h:
+        (WebCore::RenderThemeChromiumWin::paintSearchField):
+
+2009-03-27  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser
+
+        If an object has a self-painting layer, don't count it as part of a block's visual overflow.
+        This fix has only been made for block-level children.   The inline-level case is still broken
+        (and covered by an existing bug).
+
+        Added fast/block/positioning/negative-rel-position.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+
+2009-03-27  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6642221>
+        REGRESSION: With the Movie widget, movie trailer fails to load if movie had been previously viewed
+        
+        Add a dashboard specific workaround so that we always create renderers for object elements, even if display:none is set.
+        
+        I've filed <rdar://problem/6731022> against the Movies widget.
+        
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::rendererIsNeeded):
+
+2009-03-25  Timothy Hatcher  <timothy@apple.com>
+
+        Expose new DOM methods as public Objective-C API.
+
+        <rdar://problem/5837350> Expose new DOM classes and methods
+        as public API (match the additions to the JavaScript DOM)
+
+        Reviewed by Mark Rowe and Darin Adler.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/objc/DOMHTML.h:
+        * bindings/objc/DOMPrivate.h:
+        * bindings/objc/PublicDOMInterfaces.h:
+
+2009-03-27  Zack Rusin <zack@kde.org>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24280
+
+        Fix propagation of fill rules when rendering paths in the Qt build.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::toQtFillRule):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+
+2009-03-27  Zack Rusin <zack@kde.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24275
+
+        Fix text field theming in the Qt build with the KDE 4 Oxygen
+        style by adjusting the size vertically and horizontally to
+        set padding on the element equal to the width of the style painted border.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::RenderThemeQt):
+        (WebCore::RenderThemeQt::computeSizeBasedOnStyle):
+        (WebCore::RenderThemeQt::adjustTextFieldStyle):
+        (WebCore::RenderThemeQt::paintTextField):
+        * platform/qt/RenderThemeQt.h:
+
+2009-03-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24852
+        Build fix for GNU mode RVCT compilation
+
+        * html/PreloadScanner.cpp:
+
+2009-03-27  Erik L. Bunce  <elbunce@xendom.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24868
+
+        Make text of the writing direction items more user friendly.
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::contextMenuItemTagLeftToRight):
+        (WebCore::contextMenuItemTagRightToLeft):
+
+2009-03-27  Erik L. Bunce  <elbunce@xendom.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24274
+
+        Fixed the Qt 4.4 Mac build with netscape plugins enabled.
+
+        * plugins/mac/PluginViewMac.cpp:
+
+2009-03-26  Mark Rowe  <mrowe@apple.com>
+
+        Try and fix the Qt build.
+
+        * platform/text/TextEncodingDetectorNone.cpp:
+        (WebCore::detectTextEncoding):
+
+2009-03-26  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24874
+        24874: HTMLMediaElement: 'duration' defaults to NaN, deal with it
+        
+        The 'duration' attribute is NaN when no media is available, so the
+        media element should take care when comparing with duration().
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): Don't compare with duration when
+        it is NaN.
+        (WebCore::HTMLMediaElement::endedPlayback): Ditto.
+
+2009-03-26  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build.
+
+        * platform/text/TextEncodingDetectorICU.cpp:
+        * platform/text/TextEncodingDetectorNone.cpp:
+
+2009-03-26  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Cameron Zwarich.
+
+        1. Fix the crash in setHintEncoding
+        2. Fix build failures on Tiger and Qt.
+        UnusedParam.h was not included by TextEncodingDetector{None,ICU}.cpp
+        in the patch landed in r42023
+        for http://bugs.webkit.org/show_bug.cgi?id=16482
+
+        * loader/TextResourceDecoder.h:
+        (WebCore::TextResourceDecoder::setHintEncoding):
+        * platform/text/TextEncodingDetectorICU.cpp:
+        * platform/text/TextEncodingDetectorNone.cpp:
+
+2009-03-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix when ACCELERATED_COMPOSITING is turned on.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::canUseDirectCompositing):
+
+2009-03-26  Eric Seidel  <eric@webkit.org>
+
+        No additional review, committing previously reviewed files for build fix only.
+
+        Add files I missed when commiting Jungshik's patch in r42022.
+        https://bugs.webkit.org/show_bug.cgi?id=16482
+
+        * icu/unicode/ucsdet.h: Added.
+        * platform/text/TextEncodingDetector.h: Added.
+        * platform/text/TextEncodingDetectorICU.cpp: Added.
+        (WebCore::detectTextEncoding):
+        * platform/text/TextEncodingDetectorNone.cpp: Added.
+        (WebCore::detectTextEncoding):
+
+2009-03-26  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add an encoding detector 'hook' to TextResourceDecoder.
+         - add |usesEncodingDetector| to Settings. It's off by default.
+         - add a new encoding source type |EncodingFromParent| 
+           to distinguish cases when the encoding is inherited from
+           the parent frame from cases when it's actually auto-detected.
+         - add TextEncodingDetector* to platform/text. Currently,
+           the only implementation uses ICU. Stub is added for 
+           ports that do not use ICU and a build on Tiger. Mac OS 
+           Tiger comes with ICU 3.2 that does not support encoding detector.
+         - add ucsdet.h to icu/unicode for ports using ICU.
+
+        Layout tests will be added once bug 20534 is fixed and a WebPreference
+        can be controlled in test_shell. With UsesEncodingDetector off, there
+        is no change to test. 
+
+        http://bugs.webkit.org/show_bug.cgi?id=16482
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCore/GNUmakefile.am
+        * WebCore/WebCore.pro
+        * WebCore/WebCore.scons
+        * WebCore/WebCoreSources.bkl
+        * WebCore.base.exp
+        * icu/unicode/ucsdet.h
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::write): turn on/off encoding detector depending on Settings and set hintEncoding of TextResourceDecoder to the parent frame encoding if necessary and the security policy allows refering to the parent frame encoding.
+        * loader/TextResourceDecoder.cpp:
+        (WebCore::TextResourceDecoder::TextResourceDecoder):
+        (WebCore::TextResourceDecoder::checkForCSSCharset): add check for EncodingFromParentFrame
+        (WebCore::TextResourceDecoder::checkForHeadCharset): ditto
+        (WebCore::TextResourceDecoder::shouldAutoDetect):
+        (WebCore::TextResourceDecoder::decode): call encoding detector if shouldAutoDetect returns true.
+        (WebCore::TextResourceDecoder::flush): if encoding is not determined by now, call encoding detector if shouldAutoDetect returns true.
+        * loader/TextResourceDecoder.h:
+        (WebCore::TextResourceDecoder::):
+        (WebCore::TextResourceDecoder::create):
+        (WebCore::TextResourceDecoder::setHintEncoding):
+        (WebCore::TextResourceDecoder::source):
+        * page/Settings.cpp: add m_usesEncodingDetector
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setUsesEncodingDetector):
+        * page/Settings.h:
+        (WebCore::Settings::usesEncodingDetector):
+        * platform/text/TextEncodingDetector.h: Added.
+        * platform/text/TextEncodingDetectorICU.cpp: Added.
+        (WebCore::detectTextEncoding):
+        * platform/text/TextEncodingDetectorNone.cpp: Added.
+        (WebCore::detectTextEncoding):
+
+2009-03-26  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Removed code that casts EventListener down to derived classes
+        without type checking. A crash could happen if you added event
+        listeners with Objective-C and then manipulated the class with
+        JavaScript.
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::mark): Removed all the casts
+        and used the markIfNotNull function and mark functions on
+        EventListener instead.
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::mark): Ditto.
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::mark): Ditto.
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::mark): Ditto.
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::mark): Ditto.
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::mark): Ditto.
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSAbstractEventListener::handleEvent): Used function,
+        the new name for what used to be called listenerObj.
+        (WebCore::JSAbstractEventListener::virtualIsInline): Renamed since
+        this doesn't need to be virtual for callers who have a pointer to
+        this class, not the base class.
+        (WebCore::JSEventListener::function): Renamed from listenerObj.
+        (WebCore::JSProtectedEventListener::function): Ditto.
+
+        * bindings/js/JSEventListener.h: Removed unneeded forward class
+        declarations. Made all virtual functions private since there's no
+        need to call any of them on a particular derived class, only on
+        EventListener. Explicitly declare JSEventListener::mark as virtual
+        since it's now overriding a function in the EventListener base class.
+        Made JSProtectedEventListener::m_globalObject protected so the
+        JSLazyEventListener derived class can use it directly instead of using
+        a virtual function to get the pointer.
+
+        * bindings/js/JSLazyEventListener.cpp:
+        (WebCore::JSLazyEventListener::parseCode): Use m_globalObject instead
+        of globalObject since the latter is a virtual function and there's no
+        need to pay virtual function overhead.
+        (WebCore::JSLazyEventListener::function): Renamed from listenerObj.
+
+        * bindings/js/JSLazyEventListener.h: Moved forward declaration of the
+        Node class here from JSEventListener.h.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Removed now-unneeded cast to
+        JSEventListener when getting the script object from a listener.
+
+        * dom/EventListener.h: Added virtual function and mark functions
+        so we can extract the JavaScript function object or mark a JavaScript
+        event listener in a type safe manner.
+
+2009-03-26  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24859
+        Use CSS file instead of code to adjust search field styling.
+
+        * css/themeWin.css:
+        * rendering/RenderThemeWin.cpp:
+        * rendering/RenderThemeWin.h:
+
+2009-03-26  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Split JSLazyEventListener out into its own separate source file.
+        We'll be removing JSAbstractEventListener and JSProtectedEventListener soon,
+        so leave those in the same file with JSEventListener.
+
+        * GNUmakefile.am: Added JSLazyEventListener.
+        * WebCore.pro: Ditto.
+        * WebCore.scons: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+        * bindings/js/JSEventListener.cpp: Removed the JSLazyEventListener part.
+        Removed unneeded includes. Removed incorrect ASSERT_CLASS_FITS_IN_CELL, since
+        JSAbstractEventListener is not derived from JSCell.
+
+        * bindings/js/JSEventListener.h: Removed the JSLazyEventListener part
+        and the now-unneeded include of PlatformString.h.
+
+        * bindings/js/JSLazyEventListener.cpp: Copied from bindings/js/JSEventListener.cpp.
+        Kept only the JSLazyEventListener part.
+        (WebCore::eventParameterName): Made this have internal linkage by adding "static".
+        Also moved the default case out of the switch statement so we will get a warning
+        if we omit any cases in the future.
+
+        * bindings/js/JSLazyEventListener.h: Copied from bindings/js/JSEventListener.h.
+        Kept only the JSLazyEventListener part.
+
+        * bindings/js/ScriptController.cpp: Removed unneeded includes and sorted the
+        remanining ones. Include JSLazyEventListener.h instead of JSEventListener.h.
+
+2009-03-26  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Renamed JSUnprotectedEventListener to JSEventListener.
+        And related renames.
+
+        Soon Geoff will make all JavaScript event listeners use mark instead
+        of protect, so there's no need to emphasize "unprotected".
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::mark):
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::~JSDOMGlobalObject):
+        (WebCore::JSDOMGlobalObject::findJSEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSEventListener):
+        (WebCore::JSDOMGlobalObject::jsEventListeners):
+        (WebCore::JSDOMGlobalObject::jsInlineEventListeners):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        (WebCore::JSEventListener::listenerObj):
+        (WebCore::JSEventListener::globalObject):
+        (WebCore::JSEventListener::clearGlobalObject):
+        (WebCore::JSEventListener::mark):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSEventListener::create):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::mark):
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::mark):
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::mark):
+        (WebCore::JSWorker::addEventListener):
+        (WebCore::JSWorker::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::mark):
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::mark):
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        All just renaming.
+
+2009-03-26  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Renamed JSEventListener to JSProtectedEventListener.
+        And related renames.
+
+        Soon Geoff will make all JavaScript event listeners use mark instead
+        of protect, and so this class will be be obsolete. We will rename
+        JSUnrpotectedEventListener to JSEventListener in the next check-in,
+        since that one will remain.
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::~JSDOMGlobalObject):
+        (WebCore::JSDOMGlobalObject::findJSProtectedEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSProtectedEventListener):
+        (WebCore::JSDOMGlobalObject::jsProtectedEventListeners):
+        (WebCore::JSDOMGlobalObject::jsProtectedInlineEventListeners):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSProtectedEventListener::JSProtectedEventListener):
+        (WebCore::JSProtectedEventListener::~JSProtectedEventListener):
+        (WebCore::JSProtectedEventListener::listenerObj):
+        (WebCore::JSProtectedEventListener::globalObject):
+        (WebCore::JSProtectedEventListener::clearGlobalObject):
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSProtectedEventListener::create):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        All just renaming.
+
+2009-03-26  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        - fix <rdar://problem/6725042> BidiResolver::createBidiRunsForLine can
+          create runs extending beyond the end
+
+        No test because Safari does not use this version of
+        createBidiRunsForLine() with the end iterator not pointing to the end
+        of the text run.
+
+        * platform/text/BidiResolver.h:
+        (WebCore::BidiResolver::appendRun): Cap the end of the run at the end
+        of the line and set the reachedEndOfLine flag. This mirrors the logic
+        in the specialized version of appendRun() in bidi.cpp, which is why the
+        problem did not show up in HTML. Also avoid creating empty runs.
+
+2009-03-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24864
+
+        Change the terminology from "inner content layer" to "direct compositing"
+        for cases where we can push an image directly over to the compositing system,
+        without having to draw it.
+        
+        Clean up much of the code which looks at style to determine if this is possible,
+        and fix some bugs when backgrounds change dynamically.
+        
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::hasBorderOutlineOrShadow):
+        (WebCore::hasBoxDecorations):
+        (WebCore::hasBoxDecorationsWithBackgroundImage):
+        (WebCore::RenderLayerBacking::canBeSimpleContainerCompositingLayer):
+        (WebCore::RenderLayerBacking::canUseDirectCompositing):
+        (WebCore::RenderLayerBacking::detectDrawingOptimizations):
+        (WebCore::RenderLayerBacking::rendererContentChanged):
+        (WebCore::RenderLayerBacking::updateImageContents):
+        * rendering/RenderLayerBacking.h:
+
+2009-03-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+        
+        https://bugs.webkit.org/show_bug.cgi?id=23914
+
+        Tests: compositing/overflow/ancestor-overflow.html
+               compositing/overflow/parent-overflow.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::calculateClipRects):
+        * rendering/RenderLayer.h:
+        (WebCore::ClipRects::infiniteRect):
+        New static method that returns a large rect that is used by the clipping
+        logic.
+        
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        Use parentClipRects(), rather than calculateRects(), to compute the overflow
+        rect that we'll use to create a masking layer for composited clipping.
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::clippedByAncestor):
+        Use parentClipRects() to see whether there's a layer between us and our
+        compositing ancestor which applies clipping.
+        
+        (WebCore::RenderLayerCompositor::clipsCompositingDescendants):
+        A layer which imposes clipping to its children doesn't have to be a stacking
+        context; it might be a normal flow layer; in either case, we can rely on the
+        hasCompositingDescendant() bit.
+
+2009-03-26  Steve Falkenburg  <sfalken@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=24837
+        Escape key should dismiss select menu
+
+        Reviewed by Adam Roben.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupWndProc):
+
+2009-03-26  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Make sure the script uses LF line endings even on Windows.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24805
+
+        * WebCore/make-generated-sources.sh: Change svn:eol-style to LF
+
+2009-03-26  Eli Fidler  <eli.fidler@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Remove warnings all over the place by making operator precedence
+        explicit in cases like x && y || z.  No functional change.
+
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::addFontFaceRule):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseShadow):
+        * dom/Document.cpp:
+        (WebCore::Document::shouldScheduleLayout):
+        * dom/Node.cpp:
+        (WebCore::Node::isBlockFlowOrBlockTable):
+        * dom/Node.h:
+        (WebCore::Node::document):
+        * dom/Position.cpp:
+        (WebCore::Position::next):
+        (WebCore::Position::upstream):
+        (WebCore::Position::downstream):
+        (WebCore::Position::getInlineBoxAndOffset):
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::atStart):
+        * dom/Range.cpp:
+        (WebCore::Range::intersectsNode):
+        * editing/Editor.cpp:
+        (WebCore::Editor::setBaseWritingDirection):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::advance):
+        (WebCore::SimplifiedBackwardsTextIterator::advance):
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::leftVisuallyDistinctCandidate):
+        (WebCore::VisiblePosition::rightVisuallyDistinctCandidate):
+        (WebCore::VisiblePosition::canonicalPosition):
+        * editing/htmlediting.cpp:
+        (WebCore::isMailBlockquote):
+        (WebCore::lineBreakExistsAtPosition):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::parseMappedAttribute):
+        * loader/FTPDirectoryDocument.cpp:
+        (WebCore::processFileDateString):
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageLoader::updateFromElement):
+        * loader/TextResourceDecoder.cpp:
+        (WebCore::TextResourceDecoder::checkForHeadCharset):
+        * page/AccessibilityObject.cpp:
+        (WebCore::updateAXLineStartForVisiblePosition):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::sendContextMenuEvent):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::PropertyWrapperGetter::equals):
+        (WebCore::PropertyWrapperShadow::equals):
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::adjustScrollbarsAvoidingResizerCount):
+        * platform/text/Base64.cpp:
+        (WebCore::base64Encode):
+        * platform/text/BidiResolver.h:
+        (WebCore::::raiseExplicitEmbeddingLevel):
+        (WebCore::::createBidiRunsForLine):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::placeEllipsisBox):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addChild):
+        (WebCore::RenderBlock::repaintOverhangingFloats):
+        (WebCore::RenderBlock::fillInlineSelectionGaps):
+        (WebCore::RenderBlock::positionForPoint):
+        (WebCore::RenderBlock::calcInlinePrefWidths):
+        (WebCore::RenderBlock::hasLineIfEmpty):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::imageChanged):
+        (WebCore::RenderBox::localCaretRect):
+        (WebCore::RenderBox::positionForPoint):
+        (WebCore::RenderBox::shrinkToAvoidFloats):
+        * rendering/RenderObject.h:
+        (WebCore::objectIsRelayoutBoundary):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::calcPrefWidths):
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::determineStartPosition):
+        (WebCore::textWidth):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * rendering/style/StyleInheritedData.cpp:
+        (WebCore::cursorDataEquivalent):
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::shadowDataEquivalent):
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::shadowDataEquivalent):
+        (WebCore::StyleRareNonInheritedData::animationDataEquivalent):
+        (WebCore::StyleRareNonInheritedData::transitionDataEquivalent):
+
+2009-03-26  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24804
+        [GTK] 401 responses cause rogue content to be loaded
+
+        Our soup code handles 401 responses itself, so we should not feed
+        the headers and data of those responses to the loader.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::gotHeadersCallback):
+        (WebCore::gotChunkCallback):
+
+2009-03-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt and Darin Adler.
+        
+        Fixed <rdar://problem/6603167> Crash in WebKit!JSC::JSGlobalObject::resetPrototype
+        during Stress test (#3 & #7 WER crashes for Safari 4 Beta)
+        
+        The problem was that allocation of the global object would, for just a
+        moment, leave the global object's prototype unprotected from GC. This
+        bug doesn't apply to non-global DOM objects because their prototypes are
+        cached and marked by the global object.
+
+        No test case because the crashing condition is hard to deterministically
+        produce in a normal build, and in a Windows Release build with
+        COLLECT_ON_EVERY_ALLOCATION set to 1, existing tests crash/hang.
+
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::setWindow):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::initScript): Protect the global object's
+        prototype from GC during construction, since the global object does not
+        yet point to it, and therefore won't mark it.
+
+2009-03-25  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser
+
+        https://bugs.webkit.org/show_bug.cgi?id=23361
+
+        When using hardware compositing, some images can be directly
+        rendered by the hardware - no need to draw them into a separate
+        context, therefore saving memory.
+        Only images with certain style properties can be directly
+        composited - basically anything that is not a simple image requires
+        the usual rendering path (eg. if the image has borders).
+
+        Test: compositing/direct-image-compositing.html
+
+        * manual-tests/resources/simple_image.png: Added.
+        * manual-tests/simple-image-compositing.html: Added.
+        * platform/graphics/Image.h:
+        (WebCore::Image::startAnimation):
+            - move this to public
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::imageChanged):
+            - poke compositing layer if image has changed
+        (WebCore::RenderImage::notifyFinished):
+            - let the compositing layer know that it can render the image
+        * rendering/RenderImage.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::rendererContentChanged):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::canUseInnerContentLayer):
+        (WebCore::RenderLayerBacking::detectDrawingOptimizations):
+        (WebCore::RenderLayerBacking::rendererContentChanged):
+        * rendering/RenderLayerBacking.h:
+            - code to hook up direct compositing of images where
+              possible
+
+2009-03-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Chromium build fix. Fix #include in V8NodeFilterCondition.cpp due to the
+        rename of V8NodeFilter to V8NodeFilterCondition.
+
+        * bindings/v8/V8NodeFilterCondition.cpp:
+
+2009-03-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24817
+        
+        When the slider range is zero, avoid a divide by zero, which caused the
+        thumb to be positioned off in the weeds, which broke painting.
+
+        Test: media/video-empty-source.html
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::SliderRange::proportionFromValue):
+        (WebCore::SliderRange::valueFromProportion):
+        (WebCore::sliderPosition):
+        (WebCore::RenderSlider::setValueForPosition):
+
+2009-03-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove dead code and style cleanup
+        https://bugs.webkit.org/show_bug.cgi?id=24684
+
+        * html/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::CanvasStyle):
+          Coverty was annoyed that we didn't initialize all of our members.  I agree, but I didn't
+          want to paste all 8 members each time, so I just cleaned up the existing constructors and left them.
+        * page/FocusController.cpp:
+        (WebCore::FocusController::setFocusedNode):
+          "node" was checked just above and is already known to be non-null
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::insertOnlyThisLayer):
+          We were already using parentLayer w/o a NULL check above, so just add an explicit ASSERT and use it w/o NULL check
+        (WebCore::RenderLayer::resize):
+          element is already ASSERTed above, no need to null check it here
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addCell):
+          currentCell.cell was just assigned to the value "cell" which is known to be non-null, no need to null check again.
+
+2009-03-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move ASSERT(foo) to before where foo-> is used
+        https://bugs.webkit.org/show_bug.cgi?id=24684
+
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeImage):
+          Move ASSERTs to the top of the function, code was using "node" before ASSERT(node), once I moved
+          ASSERT(node) to the top of the function it made sense to move the rest of them there too.
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::prepareToRenderSVGContent):
+          move ASSERT(object) to *before* we use "object" :)
+
+2009-03-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Make TextTokenizer ASSERT that the buffer was freed
+        https://bugs.webkit.org/show_bug.cgi?id=24684
+
+        * loader/TextDocument.cpp:
+        (WebCore::TextTokenizer::TextTokenizer):
+        (WebCore::TextTokenizer::~TextTokenizer):
+        (WebCore::TextTokenizer::finish):
+          Make it clear by adding a ~TextTokenizer that finish() will always be called and the memory never leaked.
+
+2009-03-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix case where lBreak.obj->isBR() when lBreak.obj was NULL
+        https://bugs.webkit.org/show_bug.cgi?id=24684
+
+        I don't have a test case where we were taking the wrong path here
+        However, adding an ASSERT(lBreak.obj) before this usage caused
+        multiple bidi tests to fail, so lBreak.obj can be null here.
+
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::findNextLineBreak):
+          lBreak.obj can be null, so we can't call ->isBR() on it unconditionally.
+
+2009-03-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Style cleanup and dead code removal in dom, editing
+        https://bugs.webkit.org/show_bug.cgi?id=24684
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::getUpperLeftCorner):
+        (WebCore::ContainerNode::getLowerRightCorner):
+        (WebCore::ContainerNode::getRect):
+          Coverty was (rightly) confused as to what the hell "o" was being used for
+          and whether or not it would ever be NULL.  I added some ASSERTS so that people (and machines)
+          would be less confused about the logic in getUpperLeftCorner/getLowerRightCorner
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+          Remove dead code, this block already checked that change == Force
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::removeInlineStyle):
+          Coverty correctly identified that traversePreviousNodePostOrder can return NULL, thus
+          prev will be null, and we don't really explicitly handle it (like we probably should)
+          It's OK though, because we end up creating a null position object, which may not have
+          been what we intended, but we certainly don't crash.
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+          Remove dead code, insertionPosition.node() is already checked to be non-null above.
+        * editing/markup.cpp:
+        (WebCore::appendStartMarkup):
+          removed dead code, annotate is already known to be true at this point in the file
+          !annotate was checked above, and break; was called.
+
+2009-03-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        CSS dead code removal and cleanup from Coverty errors
+        https://bugs.webkit.org/show_bug.cgi?id=24684
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+          Every other place in the code we check settings() for NULL, so I made these places
+          check too, even though we should never be resolving style against a document which has
+          no frame (which I believe is the only time settings() can be null)
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::styleSheetChanged):
+          Removing dead code, "root" can never be null here.
+        * css/SVGCSSStyleSelector.cpp:
+        (WebCore::colorFromSVGColorCSSValue):
+        (WebCore::CSSStyleSelector::applySVGProperty):
+          Extra returns in the old macros caused dead code.  Removing the old macros and use modern
+          ones instead. :)
+          Extra null checks to value were not needed.  Added an ASSERT at the top of the function
+          to make it clear that value will never be NULL.
+          Added colorFromSVGColorCSSValue to clean up the code a little.
+
+2009-03-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Font fallback cleanup and added ASSERT for GlyphPageTreeNode
+        https://bugs.webkit.org/show_bug.cgi?id=24684
+
+        * css/CSSFontSelector.cpp:
+        (WebCore::compareFontFaces):
+          Coverty was concerned that it was possible to index off the end of weightFallbackRuleSets
+          I can't read the code well enough to tell, so I tried to make the code clearer
+          and added an ASSERT.        
+        * platform/graphics/GlyphPageTreeNode.cpp:
+        (WebCore::GlyphPageTreeNode::initializePage):
+          Coverty believes we can crash here due to j being larger than GlyphPage::size.  I think to is already
+          known to be < GlyphPage::size due to the min() statement above, but not being sure I added an ASSERT.
+
+2009-03-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Coverty inspired fixes in Animations/Transforms
+        https://bugs.webkit.org/show_bug.cgi?id=24684
+
+        * page/animation/AnimationBase.h:
+          Fix animate() signatures to match so that the virtual methods actually override one another. :)
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::removeFromStartTimeResponseWaitList):
+          Attempt to fix this method, prevAnimation was never set to anything but NULL,
+          as far as I can tell the author originally intended to update it at the end
+          of the loop, which is what I changed this code to do.
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::animate):
+          Make method signature match AnimationBase::animate
+        * page/animation/ImplicitAnimation.h:
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::animate):
+          Make method signature match AnimationBase::animate
+        * page/animation/KeyframeAnimation.h:
+        * platform/graphics/transforms/PerspectiveTransformOperation.cpp:
+        (WebCore::PerspectiveTransformOperation::blend):
+          if (blendToIdentity) already returned above.
+        * platform/graphics/transforms/RotateTransformOperation.cpp:
+        (WebCore::RotateTransformOperation::blend):
+          if (blendToIdentity) already returned above.
+
+2009-03-25  Eli Fidler  <eli.fidler@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fix compiler warnings regarding assignments in if statements.
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::createFormData):
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::compare):
+
+2009-03-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6472150> repro crash in
+          RenderBlock::rightmostPosition(bool, bool) const at mercotte.fr using
+          menus
+
+        Test: fast/inline/continuation-positioned-reparenting.html
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::splitFlow): When repurposing the existing
+        container as the "pre" block, clear its positioned objects list, because
+        positioned descendants may end up in a different block after the split.
+
+2009-03-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24784
+        
+        Length values in transform operations need to take zoom into account.
+
+        Test: fast/transforms/transforms-with-zoom.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::createTransformOperations):
+
+2009-03-25  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24809, background-clip/origin don't use the correct
+        values.  Add support for the new values (while preserving the old values for backwards
+        compatibility).
+
+        Changed some existing test cases to use the new values.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFillProperty):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EFillBox):
+        * css/CSSValueKeywords.in:
+
+2009-03-25  Brett Wilson  <brettw@dhcp-172-22-71-191.mtv.corp.google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix complex text opacity on the Chromium Windows port.
+        https://bugs.webkit.org/show_bug.cgi?id=24757
+
+        Test: fast/text/complex-text-opacity.html
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::TransparencyAwareFontPainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::init):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::initializeForGDI):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::~TransparencyAwareFontPainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::TransparencyAwareGlyphPainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::~TransparencyAwareGlyphPainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::estimateTextBounds):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareGlyphPainter::drawGlyphs):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareUniscribePainter::hdc):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareUniscribePainter::TransparencyAwareUniscribePainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareUniscribePainter::~TransparencyAwareUniscribePainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareUniscribePainter::estimateTextBounds):
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+
+2009-03-25  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Seidel
+
+        Fix for bug 23198, border images should not clip to border radii.  The border-image should just ignore
+        the border-radius, since the assumption is that any desired rounding will be built into the border-image
+        itself.
+
+        Note that I do not agree with this change, but I am matching the spec.
+
+        Added fast/borders/border-image-border-radius.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintNinePieceImage):
+
+2009-03-25  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24750
+        [GTK] requests download instead of displaying page
+
+        Fix the Content-Type headers we get from soup, so that we set a
+        proper media type on the ResourceResponse.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+
+2009-03-25  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24600
+        [GTK] responses with status code >= 400 should not be given special treatment
+
+        Do not special case requests that have HTTP responses >=
+        400. Redirects are handled automatically by libsoup, but the rest
+        of the responses should be treated like any other.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+        (WebCore::gotHeadersCallback):
+        (WebCore::gotChunkCallback):
+        (WebCore::finishedCallback):
+
+2009-03-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Tidy up LegacyWebArchive a bit. And don't include favicons in web archives when
+        they are being used only for selections, not an entire document.
+
+        * WebCore.base.exp: Remove exported function that's not used in WebKit.
+
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::createPropertyListRepresentation): Made a static member
+        function so it can share private things with other member functions. Added some FIXME
+        comments to a branch of code I think is dead. Changed boolean argument into a named
+        one. Renamed to match other similar functions.
+        (WebCore::LegacyWebArchive::createResourceResponseFromPropertyListData): Ditto.
+        (WebCore::LegacyWebArchive::createResource): Ditto.
+        (WebCore::LegacyWebArchive::create): Merged the create and init functions.
+        (WebCore::LegacyWebArchive::rawDataRepresentation): Added some assertions because
+        we should never fail to write (we can fail to read).
+        (WebCore::LegacyWebArchive::createResourceResponseFromMacArchivedData): Made a static
+        member function as above.
+        (WebCore::LegacyWebArchive::createFromSelection): Ditto.
+        (WebCore::LegacyWebArchive::create): Iterate the vector with indices rather than
+        iterators. Only include the favicon if the first node is the document since we don't
+        want to include the favicon when copying and pasting.
+
+        * loader/archive/cf/LegacyWebArchive.h: Made one of the create functions private.
+        Made the Mac-specific functions be static member functions. Made other helpers be
+        static member functions. Removed the nit function.
+
+        * loader/archive/cf/LegacyWebArchiveMac.mm:
+        (WebCore::LegacyWebArchive::createResourceResponseFromMacArchivedData): Updated
+        comment and made this a static member function.
+        (WebCore::LegacyWebArchive::createPropertyListRepresentation): Ditto. Also made
+        it so we only type cast in one place.
+
+2009-03-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Bug 24740: crash in RenderSlider::setPositionFromValue when calling pause() after setting <video> to display: none
+        https://bugs.webkit.org/show_bug.cgi?id=24740
+        rdar://problem/6679873
+
+        Bug 12104: Native Slider: When the thumb's height is specified as a percentage, it is not centered properly
+        https://bugs.webkit.org/show_bug.cgi?id=12104
+
+        Test: media/video-display-none-crash.html
+
+        The problem here was that RenderSlider was trying to position its thumb in a way that
+        requires it to call updateLayout inside rendering code. The right way to position a
+        child renderer is to do layout, so I had to write a layout function. And then fix a few
+        other small problems shown by the same test case.
+
+        * rendering/RenderSlider.cpp: Made defaultTrackLength have internal linkage.
+        Renamed HTMLSliderThumbElement to SliderThumbElement because we only use the HTML
+        prefix for public DOM classes, not elements used as implementation details.
+        Made SliderThumbElement function members private and got rid of unneeded default
+        argument value for shadowParent.
+        (WebCore::SliderRange::SliderRange): Added. Parses precision, max, and min attributes.
+        (WebCore::SliderRange::clampValue): Added. Does standard clamping based on the above.
+        (WebCore::SliderRange::valueFromElement): Added. Reads the value from the element in
+        a way that clamps to the range.
+        (WebCore::sliderPosition): Added. Computes the slider position: a double.
+        (WebCore::SliderThumbElement::SliderThumbElement): Removed unneeded explicit
+        initialization of m_initialClickPoint.
+        (WebCore::SliderThumbElement::defaultEventHandler): Call setValueForPosition instead
+        of calling setCurrentPosition and valueChanged.
+        (WebCore::RenderSlider::RenderSlider): Remove unneeded explicit initialization of m_thumb.
+        (WebCore::RenderSlider::styleDidChange): Remove unneeded second argument to createThumbStyle.
+        (WebCore::RenderSlider::createThumbStyle): Remove unneeded second argument. Get rid of code
+        setting the position to relative and setting the left and top. We now handle positioning
+        in a custom layout function.
+        (WebCore::RenderSlider::layout): Rewrote to handle positioning of the thumb as layout.
+        (WebCore::RenderSlider::updateFromElement): Added code to immediately update the value
+        in the element if it's out of range. This clamping used to be done as a side effect of
+        setPositionFromValue. Also, this has nothing to do with the renderer, so at some point
+        it could be moved into HTMLInputElement. Removed call to setPositionFromValue
+        and instead just rely on the call to setNeedsLayout. Fix the setNeedsLayout call to be
+        a normal setNeedsLayout(true), not a setNeedsLayout(true, false), because we do want
+        this to be propagated to the parent -- it's not called during layout.
+        (WebCore::RenderSlider::setValueForPosition): Refactor to use the new SliderRange
+        class. Also don't call setCurrentPosition; instead just call setNeedsLayout.
+        (WebCore::RenderSlider::currentPosition): Use the actual position of the renderer rather
+        than the style to find the position; that means this needs to be done after layout is done.
+        Also removed unneeded runtime checks and replaced them with assertions, after checking
+        all callers to see they already guarantee this.
+        (WebCore::RenderSlider::trackSize): Removed unneeded runtime checks and replaced them
+        with assertions, after checking all callers to see they already guarantee this.
+        (WebCore::RenderSlider::inDragMode): Added a null check for m_thumb so this won't
+        crash if called early on a brand new RenderSlider.
+
+        * rendering/RenderSlider.h: Made all functions private except for forwardEvent and inDragMode.
+        Renamed HTMLSliderThumbElement to SliderThumbElement because we only use the HTML
+        prefix for public DOM classes, not elements used as implementation details. Made the
+        mouseEventIsInThumb function non-virtual. Removed the return value and argument from
+        setPositionFromValue. Removed valueChanged and setCurrentPosition. Removed the oldStyle
+        argument to createThumbStyle (see above). Made SliderThumbElement a friend so it can use some
+        private member functions.
+
+2009-03-25  Eli Fidler  <eli.fidler@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fix ambiguous else cases by adding braces to nested if()s with elses.
+
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::continueAfterContentPolicy):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateDragAndDrop):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::toArmenianUnder10000):
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::TextControlInnerTextElement::defaultEventHandler):
+
+2009-03-24  Eli Fidler  <eli.fidler@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Move variable into proper platform block to quiet warning.
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+
+2009-03-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Fix for <rdar://problem/6719375> Deal with QTKit loadstate changes when playing streaming movies
+
+        *  WebCore/html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setNetworkState): Deal with media engine reviving after having
+        network state of NETWORK_NO_SOURCE.
+
+        *  WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::updateStates): Reset m_readyState at each state change since
+        some types of movies currently cause QTKit's load state to bounce around. QTMovieLoadStatePlaythroughOK
+        corresponds to HaveFutureData, not HaveEnoughData.
+
+2009-03-24  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=24707
+        <rdar://problem/6593021> Deleting with a caret in a blank, quoted line decreases the quoting, but does not delete the line
+
+        * editing/TypingCommand.cpp: (WebCore::TypingCommand::deleteKeyPressed):
+        After breaking out of an empty mail blockquote, we still want continue with the deletion
+        so actual content will get deleted, and not just the quote style.
+
+2009-03-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        <rdar://problem/6624662> REGRESSION (r39904): can't save certain web pages as web archive (ones without favicons!)
+
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::create): Added a null check.
+
+2009-03-24  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24685
+
+        The Skia drawLine function takes subpixel values and attempts to draw
+        a line with subpixel precision. This is complex and slow for drawing
+        scrollbars which use only vertical and horizontal lines.
+
+        This changes the Chromium Linux scrollbar code to use drawIRect.
+
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromium::invalidateOnMouseEnterExit):
+        (WebCore::drawVertLine):
+        (WebCore::drawHorizLine):
+        (WebCore::drawBox):
+        (WebCore::ScrollbarThemeChromium::paintTrackPiece):
+        (WebCore::ScrollbarThemeChromium::paintThumb):
+
+2009-03-24  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 23310: Setting an absolute path (/abs) on an <iframe> with no src doesn't resolve the URL properly
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23310>
+
+        Reviewed by Darin Adler.
+
+        Test: fast/frames/iframe-no-src-set-location.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::completeURL): If m_baseURL is empty or is
+        about:blank and we have a parent document, use the parent
+        document's URL for the base when completing a new URL.
+
+2009-03-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24659
+        
+        When hit-testing 3d-transformed layers, it doesn't make sense to project the hitTestRect
+        into the coordinate space of the layer, and doing so can result in pathalogical quads
+        that break hit testing. In that case, simply use the same bounds as used for painting,
+        which are the composited bounds for this layer.
+
+        Test: transforms/3d/hit-testing/rotated-hit-test.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestLayer):
+
+2009-03-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24436
+        
+        When compositing is enabled, painting and hit testing end up using different
+        clipping roots, because, for painting, every composited layer is a clipping root,
+        but for hit testing only layers with transforms are. To fix this, we use
+        temporary clip rects for hit testing, if the page is in compositing mode.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::parentClipRects):
+        (WebCore::RenderLayer::calculateRects):
+        * rendering/RenderLayer.h:
+
+2009-03-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24782
+
+        Fix regression with CSS clip rects with non-length values, by reverting to
+        the original code, but passing the zoom multiplier through convertToLength().
+        
+        Also make stylistic change in createTransformOperations(), renaming 'inStyle'
+        to 'style.
+        
+        Tested by existing tests.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::convertToLength):
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::createTransformOperations):
+
+2009-03-24  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser
+
+        https://bugs.webkit.org/show_bug.cgi?id=21789, overflow:hidden elements should clip their foreground contents
+        to a border-radius.
+
+        This patch makes non-self-painting overflow layers and control clips work with border-radius.  RenderLayers
+        that should be clipped by overflow ancestors with border-radius are still broken.
+
+        Added fast/clip/overflow-border-radius-clip.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::pushContentsClip):
+
+2009-03-24  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser
+
+        https://bugs.webkit.org/show_bug.cgi?id=21789, overflow:hidden elements should clip their foreground contents.
+        
+        This first patch makes overflow:hidden properly clip the foreground contents of overflow:hidden replaced elements.  Common
+        replaced elements now default to overflow:hidden in the UA stylesheet (this is what the spec specifically recommends be
+        done).
+    
+        Added fast/replaced/border-radius-clip.html
+
+        * css/html4.css:
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+
+2009-03-24  Adele Peterson  <adele@apple.com>
+
+        RS by Mark Rowe.
+
+        Only build these Mail quirks checks in on the Mac.
+
+        * dom/Document.cpp: (WebCore::disableRangeMutation):
+        * html/HTMLElement.cpp: (WebCore::HTMLElement::inEitherTagList):
+
+2009-03-24  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix, no review.
+
+        Remove ResourceLoaderCFNet.cpp from build list for Cairo Releas
+        and Debug targets.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-03-24  Eric Carlson  <eric.carlson@apple.com>
+
+        Fix layout tests broken by r41907.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::setReadyState): Don't set "was playing" based on the new ready state
+
+2009-03-24  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24689
+        Fix Chromium compilation errors.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::FindOrCreateEventListener):
+        (WebCore::WorkerContextExecutionProxy::RemoveEventListener):
+
+2009-03-24  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24759
+        Add missing methods Element.prototype.removeMatchingStyleClasses and
+        Node.prototype.enclosingNodeOrSelfWithNodeNameInArray to SourceFrame content
+        iframe. These methods are called by Element.prototype.removeStyleClass and
+        Node.prototype.enclosingNodeOrSelfWithNodeName.
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._loaded):
+
+2009-03-24  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24653
+        WebKit should be buildable without prefix header injection.
+        Adds missing #includes and forward declarations as needed.
+
+        * editing/SmartReplaceCF.cpp:
+        * platform/graphics/mac/ColorMac.mm:
+        * platform/graphics/mac/FontCacheMac.mm:
+        * platform/graphics/mac/FontCustomPlatformData.h:
+        * platform/graphics/mac/FontMac.mm:
+        * platform/graphics/mac/FontMacATSUI.mm:
+        * platform/graphics/mac/FontPlatformData.h:
+        * platform/graphics/mac/FontPlatformDataMac.mm:
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        * platform/mac/FoundationExtras.h:
+        * platform/mac/LocalCurrentGraphicsContext.h:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        * platform/mac/WebCoreTextRenderer.h:
+        * platform/mac/WebCoreTextRenderer.mm:
+        * platform/mac/WebFontCache.h:
+        * platform/mac/WebFontCache.mm:
+        * platform/text/PlatformString.h:
+        * platform/text/mac/ShapeArabic.c:
+        * platform/text/mac/StringMac.mm:
+        * rendering/RenderThemeChromiumMac.h:
+
+2009-03-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6107874> by capping the nesting depth of
+          "block-level" elements generated by the parser
+
+        Test: fast/parser/block-nesting-cap.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::HTMLParser):
+        (WebCore::HTMLParser::insertNode):
+        (WebCore::HTMLParser::pushBlock):
+        (WebCore::HTMLParser::popOneBlockCommon):
+        (WebCore::HTMLParser::freeBlock):
+        * html/HTMLParser.h:
+
+2009-03-23  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by David Kilzer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24771
+        
+        DOMTimeStamps are based upon 1970.
+
+        * platform/mac/GeolocationServiceMac.mm:
+        (-[WebCoreCoreLocationObserver locationManager:didUpdateToLocation:fromLocation:]):
+
+2009-03-23  Eric Seidel  <eric@webkit.org>
+
+        Build fix, no review.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createVisiblePosition): change .container to .isNotNull()
+
+2009-03-23  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Rename Position::container to m_anchorNode and make it private
+        https://bugs.webkit.org/show_bug.cgi?id=24760
+
+        More code cleanup for Position.
+
+        Change all uses of m_container to node()
+        Eventually most uses of node() should change to anchorNode() to designate
+        that it's the node the Position is anchored to, but not necessarily the
+        container of the position (it could be the before/after neighbor).
+
+        Remove any code which sets m_container, and change it to use a new
+        Position::moveToPosition function which takes a node and offset.
+        It never makes sense to change the node and leave the offset.
+
+        * dom/Position.h:
+        (WebCore::Position::Position):
+        (WebCore::Position::clear):
+        (WebCore::Position::anchorNode):
+        (WebCore::Position::node):
+        (WebCore::Position::moveToPosition):
+        (WebCore::Position::moveToOffset):
+        (WebCore::Position::isNull):
+        (WebCore::Position::isNotNull):
+        (WebCore::operator==):
+        * dom/Range.cpp:
+        (WebCore::Range::create):
+        (WebCore::Range::compareBoundaryPoints):
+        * dom/RangeBoundaryPoint.h:
+        (WebCore::RangeBoundaryPoint::container):
+        (WebCore::RangeBoundaryPoint::set):
+        (WebCore::RangeBoundaryPoint::setOffset):
+        (WebCore::RangeBoundaryPoint::setToChild):
+        (WebCore::RangeBoundaryPoint::setToStart):
+        (WebCore::RangeBoundaryPoint::setToEnd):
+
+2009-03-17  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        document.write() should be able to make a document strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=24336
+
+        Remove an implicit write of "<html>" on the first document.write call
+        this was added as part of a KDE import http://trac.webkit.org/changeset/798
+        with no layout test or explanation.  I can't think of any reason why
+        an implicit <html> write is necessary (or correct), so I'm removing it and
+        adding a test for the correct behavior.  The parser will add any necessary
+        HTMLHTMLElements during the write() anyway.
+
+        Our behavior is now tested by fast/dom/Document/document-write-doctype
+        and matches IE, FF fails this new test.  Mozilla bug filed:
+        https://bugzilla.mozilla.org/show_bug.cgi?id=483908
+
+        * dom/Document.cpp:
+        (WebCore::Document::write):
+
+2009-03-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6140966>
+        Empty Caches does not clear the Cross-site XMLHttpRequest preflight cache
+
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/CrossOriginPreflightResultCache.cpp:
+        (WebCore::CrossOriginPreflightResultCache::empty):
+        * loader/CrossOriginPreflightResultCache.h:
+
+2009-03-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Bug 24726: hit testing doesn't work right when the click is on anonymous content
+        https://bugs.webkit.org/show_bug.cgi?id=24726
+        rdar://problem/6696992
+
+        Test: editing/selection/hit-test-anonymous.html
+
+        * rendering/RenderBR.cpp:
+        (WebCore::RenderBR::positionForPoint): Call createVisiblePosition instead of
+        creating a VisiblePosition directly. It will handle finding non-anonymous
+        content nearby if node() is 0.
+        * rendering/RenderBlock.cpp:
+        (WebCore::positionForPointRespectingEditingBoundaries): Ditto.
+        (WebCore::positionForPointWithInlineChildren): Ditto.
+        (WebCore::RenderBlock::positionForPoint): Ditto.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::positionForPoint): Ditto.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::positionForPoint): Ditto.
+        (WebCore::RenderObject::createVisiblePosition): Added.
+        * rendering/RenderObject.h: Added createVisiblePosition.
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::positionForPoint): Call createVisiblePosition.
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::positionForPoint): Ditto.
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::positionForPoint): Ditto.
+
+2009-03-23  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler & Dave Hyatt.
+
+        Fix for <rdar://problem/6621310> REGRESSION(35185): Apple Travel HTML emails missing some style after Safari 4 upgrade
+
+        Leopard Mail doesn't expect <style> to be in the body.  This change reverts back to the old behavior of
+        moving <style> to <head> for that version of Mail.
+
+        * html/HTMLElement.cpp: (WebCore::HTMLElement::inEitherTagList):
+
+2009-03-23  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Mark Rowe & Dave Hyatt.
+
+        Merge some of the individual Mail quirks into two settings that we can check for future quirks.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::disableRangeMutation):
+        (WebCore::Document::nodeChildrenChanged):
+        (WebCore::Document::nodeWillBeRemoved):
+        (WebCore::Document::textInserted):
+        (WebCore::Document::textRemoved):
+        (WebCore::Document::textNodesMerged):
+        (WebCore::Document::textNodeSplit):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setNeedsLeopardMailQuirks):
+        (WebCore::Settings::setNeedsTigerMailQuirks):
+        * page/Settings.h:
+        (WebCore::Settings::needsLeopardMailQuirks):
+        (WebCore::Settings::needsTigerMailQuirks):
+
+2009-03-23  Ada Chan  <adachan@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=24762
+        Support text-indent in <option> elements on windows platform.
+
+        Reviewed by Adele Peterson.
+
+        * css/themeWin.css:
+        * platform/PopupMenuStyle.h: We don't honor font specified on <option> elements right now.  Make this
+        explicit via windows themed default stylesheet.
+        (WebCore::PopupMenuStyle::PopupMenuStyle): Also store text-indent and text-direction.
+        (WebCore::PopupMenuStyle::textIndent):
+        (WebCore::PopupMenuStyle::textDirection):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::paint): Adjust the text's x-coordinate if text-indent is supported for options and 
+        text-indent is specified with LTR direction.
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::updateOptionsWidth): Take text-indent into account if theme supports text-indent for options.
+        (WebCore::RenderMenuList::itemStyle): Use new PopupMenuStyle constructor on windows.
+        (WebCore::RenderMenuList::menuStyle): Ditto.
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::menuStyle): Ditto.
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::popupOptionSupportsTextIndent): Added.  Default is false since we are only supporting it in windows for now.
+        * rendering/RenderThemeWin.h:
+        (WebCore::RenderThemeWin::popupOptionSupportsTextIndent): Returns true for windows.
+
+2009-03-23  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=24699
+        REGRESSION: Java Applets broken
+        <rdar://problem/6707494>
+
+        Fix loading Java applets without a codeBase. Only pass the base (up to the
+        the last path component) of the baseURL to the plug-in.
+
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::createRenderer):
+        * platform/KURL.cpp:
+        (WebCore::KURL::baseAsString):
+        * platform/KURL.h:
+
+2009-03-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * platform/KURL.h: Removed now-incorrect comments.
+        None of the parts include the separator characters any more, now that
+        query doesn't include the "?", so the comments explaining which do and do
+        not are no-longer helpful.
+
+2009-03-23  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24764
+
+        Renamed files V8NodeFilter -> V8NodeFilterCondition to reflect
+        class names.  Also fixed some headers that got mangled in search/replace
+        operations.
+
+        No change in behavior, so no test.
+
+        * bindings/v8/V8NodeFilter.h: Removed.
+        * bindings/v8/V8NodeFilterCondition.cpp: Renamed from WebCore/bindings/v8/V8NodeFilter.cpp.
+        * bindings/v8/V8NodeFilterCondition.h: Added.
+        * bindings/v8/custom/V8ClipboardCustom.cpp:
+        * bindings/v8/custom/V8DocumentCustom.cpp:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp:
+        * bindings/v8/custom/V8NavigatorCustom.cpp:
+
+2009-03-23  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Antti Koivisto.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24741
+
+        Adds a unique across-browser-sessions identifier to FormData, which may
+        be used by ResourceHandle as a secondary cache key to enable cached
+        form submissions.
+
+        At issue: two otherwise identical form submissions may result in
+        completely independent responses, which may each be appropriate to
+        store and reuse from cache.
+
+        * html/HTMLFormElement.cpp: Added call to FormData::setIdentifier so that
+        we only enable cached form submissions for those generated by HTML.  This
+        way we do not bother with POSTs generated by XMLHttpRequest.
+        (WebCore::generateFormDataIdentifier):
+        (WebCore::HTMLFormElement::createFormData):
+        * platform/network/FormData.cpp: Initialize m_identifier to 0, which means
+        the unspecified identifier.  So by default there is no identifier and
+        nothing changes.
+        (WebCore::FormData::FormData):
+        * platform/network/FormData.h: Added m_identifier with setter and getter.
+        (WebCore::FormData::setIdentifier):
+        (WebCore::FormData::identifier):
+
+2009-03-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Antti Koivisto
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24733
+        
+        Fix media controller with full-page zoom. Previously, the media controller
+        shadow nodes never saw style changes on the RenderMedia, so did not respond
+        to zooming at all. Now, we update the style on the shadow renderers
+        whenever RenderMedia gets a style change. Also fix the video thumb in
+        the theme to be scaled properly.
+
+        Test: media/video-controls-zoomed.html
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlShadowRootElement::updateStyle):
+        (WebCore::MediaTextDisplayElement::MediaTextDisplayElement):
+        (WebCore::MediaTextDisplayElement::updateStyle):
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+        (WebCore::MediaControlInputElement::updateStyle):
+        * rendering/MediaControlElements.h:
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::styleDidChange):
+        * rendering/RenderMedia.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::adjustSliderThumbSize):
+
+2009-03-23  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24739
+
+        Rework StringImpl::create methods to try to allocate a single buffer
+        rather than allocating both the StringImpl class and a separate data
+        buffer.
+
+        * platform/text/StringImpl.cpp:
+        * platform/text/StringImpl.h:
+
+2009-03-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Based on a patch by Nico Weber <nicolasweber@gmx.de>
+
+        Bug 24755: LayoutTests/http/tests/misc/url-in-utf16le.html regression
+        https://bugs.webkit.org/show_bug.cgi?id=24755
+
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::isUTF7Encoding): Added. Checks if the current encoding
+        is UTF7 without loading extended codecs.
+        (WebCore::TextEncoding::encodingForFormSubmission): Use isUTF7Encoding() instead
+        of comparing with UTF7Encoding(). Eliminate the explicit check of
+        noExtendedTextEncodingNameUsed() because that's now handled by the functions
+        that this function calls instead.
+
+        * platform/text/TextEncoding.h: Added isUTF7Encoding function.
+        Also tweaked formatting a bit.
+
+2009-03-20  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24720
+        RenderThemeChromium should draw something for Slider parts instead of
+        dropping them on the floor.
+
+        * platform/chromium/ChromiumBridge.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::adjustSliderThumbSize):
+        (WebCore::RenderThemeChromiumWin::paintSliderTrack):
+        (WebCore::RenderThemeChromiumWin::determineSliderThumbState):
+        (WebCore::RenderThemeChromiumWin::getThemeData):
+        * rendering/RenderThemeChromiumWin.h:
+        (WebCore::RenderThemeChromiumWin::paintSliderThumb):
+
+2009-03-23  Glen Murphy  <glen@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24657
+
+        Fix Skia drawing of highly scaled bitmaps; the conversion to
+        IntRect produced visible layout test failures in highly scaled 
+        coordinate systems.
+
+        Test: svg/custom/image-small-width-height.svg
+
+        * WebCore\platform\graphics\skia\ImageSkia.cpp:
+
+2009-03-23  David Kilzer  <ddkilzer@apple.com>
+
+        Provide JavaScript exception information after slow script timeout
+
+        Reviewed by Oliver Hunt.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Changed to report
+        exceptions for the Interrupted completion type as well.
+
+2009-03-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=24736
+        
+        Fix three mostly-unrelated problems with full-page zoom:
+        
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint):
+        Document::elementFromPoint() needs to take full-page zoom into account.
+        
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::MouseRelatedEvent::receivedTarget):
+        Take full-page zoom into account when computing offsetX/offsetY.
+        
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
+        Don't use offsetX/offsetY when hit testing list boxes; offsets were broken
+        with full-page zoom, and using pageX/pageY is easier because we don't
+        have to worry about the event target, and we already have a point in
+        absolute coordinates.
+
+        Tests: fast/forms/listbox-hit-test-zoomed.html
+               fast/forms/search-zoomed.html
+               fast/forms/slider-zoomed.html
+
+2009-03-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=24753
+        
+        The rect for CSS 'clip' needs to have zooming applied to it.
+
+        Test: fast/css/clip-zooming.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+2009-03-23  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adam Roben.
+
+        <rdar://problem/6704282>
+        https://bugs.webkit.org/show_bug.cgi?id=24719
+        QTMovieWinTimer logic inversion
+
+        Fix logic inversion in the Win32 timer used by QTMovieWin that caused it to always
+        use SetTimer, even when the intervals was below USER_TIMER_MINIMUM. A side effect of
+        this was that a movie timer would sometimes be blocked for significant amounts of time 
+        because WM_TIMER messages are not processed when the thread's message queue has any
+        higher priority messages, and WebCore/Win's timer uses PostMessage for low interval
+        timers. Also change SetTimer call to use HWND and custom message instead of 
+        timer function since the timer already has an HWND for processing PostMessage.
+
+        Not possible to make a test for this because it is so timing dependant.
+
+        * platform/graphics/win/QTMovieWinTimer.cpp:
+        (TimerWindowWndProc):
+        (setSharedTimerFireDelay):
+
+2009-03-23  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24588
+        
+        Update media element implementation to current HTML5 spec
+
+        New tests: 
+               media/media-constants.html
+               media/video-seek-no-src-exception.html
+               media/video-source-add-src.html
+               media/video-src-invalid-remove.html
+               media/video-src-plus-source.html
+               media/video-timeupdate-during-playback.html
+
+        * dom/EventNames.h: Remove obsolute events, add new ones.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize new member vars.
+        (WebCore::HTMLMediaElement::attributeChanged): Trigger load() only when we don't
+        have a source.
+        (WebCore::HTMLMediaElement::removedFromDocument): Deal with state name changes.
+        (WebCore::HTMLMediaElement::scheduleProgressEvent): New, create a progress event and 
+        add it to the event queue to be dispatch when the timer fires.
+        (WebCore::HTMLMediaElement::scheduleEvent): New, create a generic event and add
+        it to the event queue to be dispatch when the timer fires.
+        (WebCore::HTMLMediaElement::enqueueEvent): Add an event to the queue and ticke the 
+        asynch event timer.
+        (WebCore::HTMLMediaElement::asyncEventTimerFired): Dispatch all pending events.
+        (WebCore::HTMLMediaElement::loadTimerFired): Either trigger the initial load or
+        try to load the next <source> url.
+        (WebCore::HTMLMediaElement::load): Minor style change.
+        (WebCore::HTMLMediaElement::loadInternal): The first part of the spec load algorithm, cleanup
+        the current load (if any) and set up state for a new load.
+        (WebCore::HTMLMediaElement::selectMediaResource): Deal with no 'src' or <source>, post 'loadstart'
+        event, and initiate load from 'src' if present.
+        (WebCore::HTMLMediaElement::loadNextSourceChild): Initiate load from next <source> url, or trigger
+        noneSupported() if no more to consider.
+        (WebCore::HTMLMediaElement::loadResource): Instantiate a new MediaPlayer and ask it to load a url.
+        (WebCore::HTMLMediaElement::startProgressEventTimer): Start the repeating progress event timer.
+        (WebCore::HTMLMediaElement::noneSupported): Post error event and set up state when no valid 
+        media url was found.
+        (WebCore::HTMLMediaElement::mediaEngineError): Post error event and set up state when no valid 
+        media engine failed with a decode error or a network error.
+        (WebCore::HTMLMediaElement::mediaPlayerNetworkStateChanged):
+        (WebCore::HTMLMediaElement::setNetworkState): Updated for new spec network states.
+        (WebCore::HTMLMediaElement::mediaPlayerReadyStateChanged):
+        (WebCore::HTMLMediaElement::setReadyState): Updated for new spec ready state.
+        (WebCore::HTMLMediaElement::progressEventTimerFired): Bail if the network is not active.
+        (WebCore::HTMLMediaElement::seek): Return INVALID_STATE_ERR exception if state is too low or
+        if player hasn't been set up yet. This is necessary becase load() is async. Clear the flag
+        we use to guard against sending 'ended' more than once.
+        (WebCore::HTMLMediaElement::duration): Don't bother calling media engine before it has metadata.
+        (WebCore::HTMLMediaElement::setDefaultPlaybackRate): Remove exception param, 0 is no longer an
+        invalid rate. 
+        (WebCore::HTMLMediaElement::setPlaybackRate): Remove exception param, 0 is no longer an
+        invalid rate. Cache rate being set so we can use it later if media engine isn't ready now.
+        (WebCore::HTMLMediaElement::play): Remove exception param, play() before load() now just
+        starts loading asynchronously.
+        (WebCore::HTMLMediaElement::playInternal): Remove exception param. Fire 'waiting' or 'playing'
+        event depending on current state.
+        (WebCore::HTMLMediaElement::pause): Remove exception param, pause() before load() now just
+        starts loading asynchronously.
+        (WebCore::HTMLMediaElement::pauseInternal): Remove exception param.
+        (WebCore::HTMLMediaElement::setVolume): dispatchEventAsync -> scheduleEvent
+        (WebCore::HTMLMediaElement::setMuted): dispatchEventAsync -> scheduleEvent
+        (WebCore::HTMLMediaElement::togglePlayState): Remove exception param.
+        (WebCore::HTMLMediaElement::beginScrubbing): pause() doesn't take an exception param.
+        (WebCore::HTMLMediaElement::startPlaybackProgressTimer): New, starts timer that fires 4 times per
+        second when the movie is playing to timeupdate so we can post 'timeupdate' events.
+        (WebCore::HTMLMediaElement::playbackProgressTimerFired): Timer proc.
+        (WebCore::HTMLMediaElement::scheduleTimeupdateEvent): Bottleneck around scheduling a 'timeupdate'
+        event because we both fire them them when the spec says we should and when the media engine
+        says that time has jumped, but we don't want to fire more than one at a given movie time. We also
+        use this bottleneck to keep track of the last time one was posted so we won't fire too often
+        during playback.
+        (WebCore::HTMLMediaElement::canPlay): readyState now tracks whether or not we have metadata.
+        (WebCore::HTMLMediaElement::havePotentialSourceChild): New, checks to see if there are a <source>
+        element with a 'src' attribute that we have not tried to load yet.
+        (WebCore::HTMLMediaElement::nextSourceChild): New, returns the url and content type of the next
+        <source> element that we haven't tried to load.
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): Schedule 'seeked' event when seeking completes.
+        Set a flag when we post the 'ended' event, clear it when time changed and we aren't at the end since
+        some media engines call this proc more than once when playback reaches the end and stops, but we
+        don't want to post 'ended' more than once.
+        (WebCore::HTMLMediaElement::mediaPlayerDurationChanged): New, added so media engine can inform
+        when the movie duration changes and we can post 'durationchanged' event.
+        (WebCore::HTMLMediaElement::mediaPlayerRateChanged): New, added so media engine can inform when
+        the rate changed and we can updated our cached rate. This is useful because we only want to know
+        post periodic 'timeupdate' events when the movie is actually playing, and because we want to know
+        the actual playback rate when it differs from what we tried to set.
+        (WebCore::HTMLMediaElement::mediaPlayerSizeChanged): New, added so media engine can inform when
+        a movie's intrinsic size changes and we can inform the renderer.
+        (WebCore::HTMLMediaElement::potentiallyPlaying): Renamed from activelyPlaying since the spec now
+        uses "actively playing" for this concept. Update logic for new state names and un-comment calls
+        to stoppedDueToErrors() and pausedForUserInteraction() since the spec says those condiditons
+        are part of the answer.
+        (WebCore::HTMLMediaElement::endedPlayback): Update logic for new state names. 
+        (WebCore::HTMLMediaElement::stoppedDueToErrors): New, spec says this logic should be part of
+        the determination of "potentially playing".
+        (WebCore::HTMLMediaElement::pausedForUserInteraction): New, placeholder for when (if) user
+        agent supports this spec concept.
+        (WebCore::HTMLMediaElement::updatePlayState): Stop timer used to fire periodic 'timeupdate' 
+        events when we pauses the movie. Set the media engine rate before calling play() in case it
+        wasn't set up when the rate was changed.
+        (WebCore::HTMLMediaElement::stopPeriodicTimers): New, stop the progress event and 'timeupate'
+        event timers.
+        (WebCore::HTMLMediaElement::userCancelledLoad): New, logic pulled out of documentWillBecomeInactive
+        and updated for the current spec.
+        (WebCore::HTMLMediaElement::documentWillBecomeInactive): Moved some logic to userCancelledLoad.
+        (WebCore::HTMLMediaElement::documentDidBecomeActive): Update comments.
+        (WebCore::HTMLMediaElement::initialURL): Update for refactoring of code that determines the 
+        initial url.
+        * html/HTMLMediaElement.h: Change ReadyState and NetworkState enums to match names in the spec,
+        update for changes in .cpp.
+        (WebCore::HTMLMediaElement::):
+
+        * html/HTMLMediaElement.idl: Update ready state and network state constants for spec changes.
+        defaultPlaybackRate, playbackRate, play(), and pause() no longer raise exceptions.
+
+        * html/HTMLSourceElement.cpp:
+        (WebCore::HTMLSourceElement::insertedIntoDocument): Update for network state name changes.
+
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::updatePosterImage): Update for ready state name changes.
+
+        * html/MediaError.h:
+        (WebCore::MediaError::): add MEDIA_ERR_NONE_SUPPORTED.
+
+        * html/MediaError.idl: add MEDIA_ERR_NONE_SUPPORTED.
+
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::defaultEventHandler): play() and pause() don't take an exception.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::readyState): Update for newtork state name changes.
+        (WebCore::MediaPlayer::sizeChanged): New, so engine can report intrinsic size changes.
+        (WebCore::MediaPlayer::rateChanged): New, so engine can report rate changes.
+        (WebCore::MediaPlayer::durationChanged): New, so engine can report duration changes.
+        * platform/graphics/MediaPlayer.h: Update NetworkState and ReadyState enum names to match spec
+        states.
+        (WebCore::MediaPlayerClient::mediaPlayerDurationChanged): New.
+        (WebCore::MediaPlayerClient::mediaPlayerRateChanged): New.
+        (WebCore::MediaPlayerClient::mediaPlayerSizeChanged): New.
+        (WebCore::MediaPlayer::):
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Update for network/ready state name changes.
+        (WebCore::MediaPlayerPrivate::load): Ditto.
+        (WebCore::MediaPlayerPrivate::updateStates): Ditto.
+        (WebCore::MediaPlayerPrivate::loadingFailed): Ditto.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h: Update for network/ready state name changes.
+        Remove endPointTimer, it is no longer necessary. Add m_enabledTrackCount and m_duration.
+        (WebCore::MediaPlayerPrivate::metaDataAvailable):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): No more m_endPointTimer or m_endTime. Initialize
+        m_enabledTrackCount and m_duration. Update for network/ready state name changes.
+        (WebCore::MediaPlayerPrivate::load): Update for network/ready state name changes.
+        (WebCore::MediaPlayerPrivate::play): No more m_endPointTimer.
+        (WebCore::MediaPlayerPrivate::pause): Ditto.
+        (WebCore::MediaPlayerPrivate::currentTime): No more m_endTime.
+        (WebCore::MediaPlayerPrivate::seek): Ditto.
+        (WebCore::MediaPlayerPrivate::doSeek): Ditto, plus don't call setRate(0) when the rate is
+        already zero.
+        (WebCore::MediaPlayerPrivate::setEndTime): No more m_endTime.
+        (WebCore::MediaPlayerPrivate::updateStates): Update for network/ready state name changes. Return
+        different errors depending on what causes a failure. Watch for and report duration changes.
+        (WebCore::MediaPlayerPrivate::rateChanged): Report rate changes.
+        (WebCore::MediaPlayerPrivate::sizeChanged): Report size changes.
+        (WebCore::MediaPlayerPrivate::didEnd): No more endpoint timer.
+        (WebCore::MediaPlayerPrivate::setVisible): Update for network/ready state name changes.
+        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks): Don't return number of unsupported
+        tracks, store in m_enabledTrackCount so we can use it to help determine causes of failure.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Update for network/ready state name changes.
+        (WebCore::MediaPlayerPrivate::load): Ditto.
+        (WebCore::MediaPlayerPrivate::duration): Ditto.
+        (WebCore::MediaPlayerPrivate::updateStates): Ditto.
+        (WebCore::MediaPlayerPrivate::naturalSize): Ditto.
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): No more m_endPointTimer. Update for 
+        network/ready state name changes.
+        (WebCore::MediaPlayerPrivate::load): Update for network/ready state name changes. No more
+        m_endPointTimer.
+        (WebCore::MediaPlayerPrivate::play): No more m_endPointTimer.
+        (WebCore::MediaPlayerPrivate::pause): Ditto. 
+        (WebCore::MediaPlayerPrivate::setEndTime): Ditto.
+        (WebCore::MediaPlayerPrivate::updateStates): Update for network/ready state name changes.
+        (WebCore::MediaPlayerPrivate::didEnd): No more m_endPointTimer.
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlPlayButtonElement::defaultEventHandler): Update for network/ready state 
+        name changes.
+        (WebCore::MediaControlSeekButtonElement::defaultEventHandler): Ditto.
+
+2009-03-22  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxGTK build fix. Add missing header.
+
+        * platform/wx/wxcode/gtk/non-kerned-drawing.cpp:
+
+2009-03-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24665
+        
+        Image-map code in RenderImage could result in RenderImage::nodeAtPoint()
+        setting HitTestResult::innerNode(), but returning false, which violates
+        hit testing rules. Use a temporary HitTestResult so that we only fill in
+        result when we know we've hit.
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::nodeAtPoint):
+
+2009-03-22  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24743
+        
+        Fix hit testing regression from r41840. We need to pass the temporary
+        HitTestResult when testing sublayers, then only copy to 'result' when
+        the layer is known to have been hit.
+
+        Test: fast/layers/zindex-hit-test.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestLayer):
+
+2009-03-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=24733
+        
+        Fix hit testing on video controls after full page zoom by fixing wider issue
+        with event->pageX(), pageY() with zooming. pageX and pageY are "fixed" to be
+        invariant under zooming (for JavaScript), so we keep an actual page point around
+        in MouseEvent::absoluteLocation() to avoid the need to factor in zooming everywhere.
+
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::MouseRelatedEvent::initCoordinates):
+        (WebCore::MouseRelatedEvent::computePageLocation):
+        * dom/MouseRelatedEvent.h:
+        (WebCore::MouseRelatedEvent::absoluteLocation):
+        (WebCore::MouseRelatedEvent::setAbsoluteLocation):
+        Member var, and getter and setter for absoluteLocation.
+        New method, computePageLocation(), to compute the actual page point,
+        and call it when creating and initting mouse-related events.
+
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchMouseEvent):
+        (WebCore::Node::dispatchWheelEvent):
+        Keep non-adjusted pageX and pageY around, and call setAbsoluteLocation()
+        on the event to replace a potentially rounded point.
+        
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        Clean up slider handling code.
+        
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
+        Add FIXME comment for use of offsetX/offsetY.
+        
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::handleContextMenuEvent):
+        Use absoluteLocation() when hit testing for context menus.
+        
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::userResize):
+        Use absoluteLocation() when resizing frames.
+        
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::forwardEvent):
+        Use absoluteLocation() when hit testing media controls.
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::HTMLSliderThumbElement::defaultEventHandler):
+        (WebCore::RenderSlider::mouseEventIsInThumb):
+        Use absoluteLocation() when handling slider events.
+
+        (WebCore::RenderSlider::forwardEvent):
+        Factor some code out of HTMLInputElement::defaultEventHandler().
+        
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::forwardEvent):
+        Use absoluteLocation() when hit testing search field buttons, which fixees
+        bugs in the search field with zooming.
+
+2009-03-21  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24727
+        Add V8XMLHttpRequest*.
+
+        * bindings/v8/V8XMLHttpRequestUtilities.cpp: Added.
+        * bindings/v8/V8XMLHttpRequestUtilities.h: Added.
+        * bindings/v8/custom/V8XMLHttpRequestConstructor.cpp: Added.
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp: Added.
+        * bindings/v8/custom/V8XMLHttpRequestUploadCustom.cpp: Added.
+
+2009-03-21  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24725
+        Add V8NodeFilter.
+
+        * bindings/v8/V8NodeFilter.cpp: Added.
+        * bindings/v8/V8NodeFilter.h: Added.
+
+2009-03-21  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Kevin Decker
+
+        - remove some redundant #include statements
+
+        * bindings/js/JSDOMWindowBase.cpp:
+
+2009-03-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix <rdar://problem/6574185> REGRESSION (3.2.2-TOT): hang in text drawing code
+
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::drawGDIGlyphs): Changed glyph stroking to fill and stroke each
+        glyph as a separate path, instead of all glyphs as a single path. This
+        matches what CGContextShowGlyphsWithAdvances() does, and has comparable
+        performance.
+
+2009-03-20  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser
+
+        Build fix for ENABLE(3D_RENDERING)
+
+        * rendering/RenderObject.h:
+        (WebCore::makeMatrixRenderable):
+
+2009-03-20  Dave Moore  <davemoore@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24705
+
+        A bug in the V8 bindings is preventing chromium from setting the href on the
+        location object...any attempt throws a security error, not just for javascript
+        protocol
+
+        * page/Location.idl:
+
+2009-03-20  Craig Schlenter  <craig.schlenter@gmail.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24608
+
+        Include stdio.h needed for printf on gcc 4.4.0
+
+        * platform/KURLGoogle.cpp:
+
+2009-03-20  Mike Belshe <mike@belshe.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24577
+
+        Don't let comments at the end of an event handler
+        break the event handler.
+
+        No change in behavior, so no test.
+
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+
+2009-03-20  Norbert Leser  <norbert.leser@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24535
+
+        Fixes missing line terminator character (;) after macro call.
+        It is common practice to add the trailing ";" where macros are substituted
+        and not where they are defined with #define.
+        This change is consistent with other macro declarations across webkit,
+        and it also solves compilation failure with symbian compilers. 
+ 
+        No change in behavior, so no test.
+
+        * bindings/js/JSDOMWindowShell.cpp:
+        * bindings/js/JSEventListener.cpp:
+        * bindings/js/JSImageConstructor.cpp:
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        * bindings/js/JSNamedNodesCollection.cpp:
+        * bindings/js/JSNodeFilterCondition.cpp:
+        * bindings/js/JSOptionConstructor.cpp:
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        * bindings/js/JSRGBColor.cpp:
+        * bindings/js/JSWorkerContextBase.cpp:
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2009-03-20  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Dimitri Glazkov and Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24324
+
+        Make the minimum timer configurable for different platforms.
+
+        * page/DOMTimer.cpp:
+        (WebCore::DOMTimer::DOMTimer):
+        (WebCore::DOMTimer::fired):
+        * page/DOMTimer.h:
+        (WebCore::DOMTimer::minTimerInterval):
+        (WebCore::DOMTimer::setMinTimerInterval):
+
+2009-03-20  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22834
+
+        Make sure to consistently match new/delete and fastMalloc/fastFree.
+
+        * css/CSSSelectorList.cpp:
+        (WebCore::CSSSelectorList::adoptSelectorVector):
+        (WebCore::CSSSelectorList::deleteSelectors):
+
+2009-03-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=23739
+          <rdar://problem/6556371> REGRESSION (r36513): iframe isn't sized properly upon load
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::percentHeightDescendants): Added this accessor.
+        * rendering/RenderBlock.h:
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows): Extended the check for
+        children that flex to include other descendants with percent height
+        which is relative to the cell.
+
+2009-03-20  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24706
+        Remove ScriptExecutionContext::encoding() since Workers do not need it.
+        WorkerContext::encoding() is simply removed, while Document::encoding()
+        made non-virtual and private. Workers use UTF-8 now except when instructed
+        otherwise by http header. Also updated test.
+
+        * dom/Document.h: Made encoding() non-virtual and private.
+        * dom/ScriptExecutionContext.h: removed encoding().
+
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
+        (WebCore::Worker::notifyFinished):
+        * workers/WorkerContext.cpp: removed encoding() implementation.
+        (WebCore::WorkerContext::WorkerContext):
+        (WebCore::WorkerContext::completeURL):
+        * workers/WorkerContext.h: removed encoding()
+        (WebCore::WorkerContext::create):
+        * workers/WorkerContextProxy.h:
+        * workers/WorkerImportScriptsClient.cpp:
+        (WebCore::WorkerImportScriptsClient::didReceiveData):
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::startWorkerContext):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadStartupData::create):
+        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
+        (WebCore::WorkerThread::create):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::workerThread):
+        * workers/WorkerThread.h:
+        In all these, removed storing encoding and 'inheriting' it from the parent.
+        Instead, they are all using UTF-8 now.
+
+2009-03-20  Timothy Hatcher  <timothy@apple.com>
+
+        Change how threading exceptions are checked so they are reported
+        by what round they were added. That way WebKit can decided the
+        behavior per-round based on linked-on-or-after checks.
+
+        <rdar://problem/6626741&6648478&6635474&6674079>
+
+        Reviewed by Darin Adler.
+
+        * WebCore.base.exp: Export the new symbols.
+        * bindings/objc/DOMAbstractView.mm: Use the new WebCoreThreadViolationCheckRoundOne macro.
+        * bindings/scripts/CodeGeneratorObjC.pm: Ditto.
+        * platform/ThreadCheck.h:
+        * platform/mac/ThreadCheck.mm:
+        (WebCore::readThreadViolationBehaviorFromUserDefaults): Refactor how the default is read.
+        (WebCore::setDefaultThreadViolationBehavior): Take a round argument.
+        (WebCore::reportThreadViolation): Ditto.
+        (WebCoreReportThreadViolation): Ditto.
+
+2009-03-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixed up an out-of-date comment.
+
+        * bindings/js/JSDOMWindowCustom.h:
+        (WebCore::JSDOMWindow::customPut):
+
+2009-03-20  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=20909 REGRESSION 
+        (r35318): A press release at pfizer.com does not display correctly
+        - and corresponding -
+        <rdar://problem/6680073>
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::invalidateContainerPrefWidths):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::markContainingBlocksForLayout):
+
+2009-03-20  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        maxDeepOffset is confusing and should be removed
+        https://bugs.webkit.org/show_bug.cgi?id=24586
+
+        Abstract some hard-to-read (but shared) logic into a new renderedAsNonInlineTableOrHR function.
+        Add first/lastDeepEditingPositionForNode Position creation functions
+        and deploy them to places we used to call maxDeepOffset.
+
+        Rename Position::atStart and atEnd to atStartOfTree atEndOfTree
+        Add a new Position::atFirst/atLastEditingPositionForNode() and use these
+        to replace a few more callers for maxDeepOffset()
+        
+        Rename maxDeepOffset to lastEditingOffsetForNode (so that we mere mortals have some clue what it does)
+
+        "Editing positions" are confusing because they have one
+        of two behaviors, depending on if the container node is ignored
+        by editing (if editingIgnoresContent(node) returns true) or not.
+        Positions referring to nodes ignored by editing are
+        neighbor-relative (they are before or after the node) where as
+        positions reffering to other nodes are container-relative
+        (they are between two child nodes of the container, identified
+        by the offset() member).  I will be fixing this confusion in
+        future patches.  These renames hopefully make the current behavior clearer.
+
+        * dom/Position.cpp:
+        (WebCore::Position::previous):
+        (WebCore::Position::next):
+        (WebCore::Position::atFirstEditingPositionForNode):
+        (WebCore::Position::atLastEditingPositionForNode):
+        (WebCore::Position::atStartOfTree):
+        (WebCore::Position::atEndOfTree):
+        (WebCore::Position::previousCharacterPosition):
+        (WebCore::Position::nextCharacterPosition):
+        (WebCore::Position::upstream):
+        (WebCore::Position::isCandidate):
+        (WebCore::firstDeepEditingPositionForNode):
+        (WebCore::lastDeepEditingPositionForNode):
+        * dom/Position.h:
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::operator Position):
+        (WebCore::PositionIterator::increment):
+        (WebCore::PositionIterator::decrement):
+        (WebCore::PositionIterator::atEnd):
+        (WebCore::PositionIterator::atEndOfNode):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::isTableCellEmpty):
+        (WebCore::DeleteSelectionCommand::removeNode):
+        (WebCore::DeleteSelectionCommand::handleGeneralDelete):
+        * editing/Editor.cpp:
+        (WebCore::Editor::advanceToNextMisspelling):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::doApply):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::positionAtEndOfInsertedContent):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::previous):
+        (WebCore::VisiblePosition::leftVisuallyDistinctCandidate):
+        (WebCore::VisiblePosition::left):
+        (WebCore::VisiblePosition::rightVisuallyDistinctCandidate):
+        (WebCore::VisiblePosition::right):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::selectionFromContentsOfNode):
+        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries):
+        * editing/htmlediting.cpp:
+        (WebCore::nextVisuallyDistinctCandidate):
+        (WebCore::previousVisuallyDistinctCandidate):
+        (WebCore::firstEditablePositionAfterPositionInRoot):
+        (WebCore::lastEditablePositionBeforePositionInRoot):
+        (WebCore::lastOffsetForEditing):
+        (WebCore::isFirstPositionAfterTable):
+        (WebCore::isLastPositionBeforeTable):
+        (WebCore::positionBeforeNode):
+        (WebCore::positionAfterNode):
+        (WebCore::enclosingEmptyListItem):
+        (WebCore::caretMaxOffset):
+        * editing/htmlediting.h:
+        * editing/visible_units.cpp:
+        (WebCore::renderedAsNonInlineTableOrHR):
+        (WebCore::startOfParagraph):
+        (WebCore::endOfParagraph):
+        (WebCore::startOfEditableContent):
+        (WebCore::endOfEditableContent):
+        * page/AccessibilityObject.cpp:
+        (WebCore::endOfStyleRange):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::visiblePositionRange):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::positionForPoint):
+
+2009-03-20  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24689
+        Add (upstream) V8 bindings for Workers. Mostly style cleaning.
+
+        * bindings/v8/WorkerContextExecutionProxy.cpp: Added.
+        * bindings/v8/WorkerContextExecutionProxy.h: Added.
+        * bindings/v8/WorkerScriptController.cpp: Added.
+        * bindings/v8/WorkerScriptController.h: Added.
+        * bindings/v8/V8Index.h: Added. This is just a wrapper for v8_index.h, like V8Proxy.h
+        * bindings/v8/V8Proxy.h: Added domObjectMap() function that wraps GetDOMObjectMap().
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::callListenerFunction): TrackEvent() renamed trackEvent()
+
+2009-03-20  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix for LayoutTests/fast/canvas/canvas-text-alignment.html
+        on chromium/skia.  The problem was that the gradient matrix
+        for text was being applied twice.  Fixed by reverting some of
+        https://bugs.webkit.org/show_bug.cgi?id=23957, so that skiaDrawText
+        is no longer responsible for measuring the text and scaling up
+        the gradient matrix.  Instead, the text bounding box is passed
+        in from SVGPaintServerGradient.  I didn't make this change for CG,
+        since it uses a different method (the gradient is drawn using the
+        text as a pre-rendered mask).
+        https://bugs.webkit.org/show_bug.cgi?id=24687
+
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::skiaDrawText):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::setup):
+
+2009-03-20  Xan Lopez  <xlopez@igalia.com>
+
+        Rubber-stamped by Holger Freyther.
+
+        There seems to be some rounding error in cairo (or in how we use
+        cairo) with some fonts, like DejaVu Sans Mono, which makes cairo
+        report a height smaller than ascent + descent, which is wrong and
+        confuses WebCore's layout system. Workaround this while we figure
+        out what's going on.
+
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformInit):
+
+2009-03-19  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24122
+        <rdar://problem/6674179>
+        REGRESSION: DOM Range extractContents/deleteContents failures seen on Moxiecode tests
+
+        Test: fast/dom/Range/deleted-range-endpoints.html
+
+        * dom/Range.cpp: (WebCore::Range::processContents): Set the final range in accordance
+        to the specification.
+
+2009-03-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6682554> Flash content not being rendered (Shockwave Flash 10.0 r22)
+        
+        If calling updateWidget for some reason resulted in another widget being added to m_widgetUpdateSet, then
+        that object would never be updated.
+        
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateWidgets):
+        Factor the widget updating code out into this method. Return true if the update set is empty.
+        
+        (WebCore::FrameView::performPostLayoutTasks):
+        Loop over the update set multiple times until all widgets have been updated or until we reach the cap.
+        
+        * page/FrameView.h:
+
+2009-03-18  Timothy Hatcher  <timothy@apple.com>
+
+        Make the defered data loading timer honor the Page's scheduled runloop pairs.
+        Introduces a new RunLoopTimer class that has an API mimicking Timer but
+        allows it to be scheduled with one or more SchedulePairs.
+
+        <rdar://problem/6687342> -[WebView scheduleInRunLoop:forMode:] has no affect on timers
+
+        Reviewed by Darin Adler.
+
+        * WebCore.xcodeproj/project.pbxproj: Adds the new RunLoopTimer.{cpp,h} files.
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::handleDataLoadNow): Use the MainResourceLoaderTimer typedef.
+        (WebCore::MainResourceLoader::startDataLoadTimer): Added. Start the timer and on
+        Mac platforms also schedule with the Page's SchedulePairs.
+        (WebCore::MainResourceLoader::handleDataLoadSoon): Call startDataLoadTimer().
+        (WebCore::MainResourceLoader::setDefersLoading): Ditto.
+        * loader/MainResourceLoader.h:
+        * platform/cf/RunLoopTimerCF.cpp: Added.
+        (WebCore::RunLoopTimerBase::~RunLoopTimerBase):
+        (WebCore::timerFired):
+        (WebCore::RunLoopTimerBase::start):
+        (WebCore::RunLoopTimerBase::schedule):
+        (WebCore::RunLoopTimerBase::stop):
+        (WebCore::RunLoopTimerBase::isActive):
+        * platform/RunLoopTimer.h: Added.
+        (WebCore::RunLoopTimerBase::RunLoopTimerBase):
+        (WebCore::RunLoopTimerBase::startRepeating):
+        (WebCore::RunLoopTimerBase::startOneShot):
+        (WebCore::RunLoopTimer::RunLoopTimer):
+        (WebCore::RunLoopTimer::fired):
+
+2009-03-19  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24702
+        Upstream miscellaneous bindings changes.
+
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute): Changed to call lower-case evaluate.
+        * bindings/v8/ScriptCallStack.h: Added an extra include.
+
+2009-03-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24686
+        
+        When hit testing a RenderLayer whose parent lives in a preserves-3D hierarchy,
+        we need to compare the computed z-offset with the depth-test z-offset before
+        deciding that such a RenderLayer was hit. This fixes an issue, tested by the
+        3d-point-mapping-overlapping.html test, where the child of a transformed element
+        is found by hit testing, even when some other element with greater Z overlaps
+        them both.
+        
+        Improved the code by adding a utility method, isHitCandidate(), which computes and tests
+        z-depth when necessary.
+
+        Tests: transforms/3d/point-mapping/3d-point-mapping-coplanar.html
+               transforms/3d/point-mapping/3d-point-mapping-overlapping.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::isHitCandidate):
+        (WebCore::RenderLayer::hitTestLayer):
+
+2009-03-19  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24456
+        Split ColorChromium.cpp into Mac & Windows variants.
+        Remove Chromium Dependency on platform/graphics/mac/ColorMac.mm since we
+        ultimately need to take a different approach.  For now, createCGColor()
+        is copied from ColorMac.mm.
+
+        No observable change in behavior, so no test.
+
+        * platform/graphics/chromium/ColorChromium.cpp:
+        (WebCore::focusRingColor):
+        * platform/graphics/chromium/ColorChromiumMac.mm: Added.
+
+2009-03-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24675
+        Unforking frontend: add custom InspectorController methods
+        implementation.
+
+        * bindings/v8/custom/V8InspectorControllerCustom.cpp: Added.
+
+2009-03-19  Jay Campan  <jcampan@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24625
+        Adding an accessor to the currently selected index in the PopupMenuChromium.
+        This is required for implementing the deletion of an autocomplete entry in Chromium.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::selectedIndex):
+        * platform/chromium/PopupMenuChromium.h:
+
+2009-03-19  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24526
+        Improve windows skia text stroking.
+
+        Test: LayoutTests/svg/custom/struct-use-09-b.svg
+
+        * platform/graphics/skia/SkiaFontWin.cpp: Close the path representing
+        each font glyph polygon, rather than only closing the path once per
+        letter. This fixes stroking for letters with multiple polygons, such
+        as 'A' or 'D'.
+        (WebCore::getPathForGlyph):
+        (WebCore::skiaDrawText):
+
+2009-03-19  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fixed support for doing calls from JavaScript into NPAPI Plugins for the Qt port on Windows.
+
+        Removed dead code for distinguishing between Widget and PluginView in the Qt port.
+
+        * bindings/js/ScriptControllerQt.cpp:
+        (WebCore::ScriptController::createScriptInstanceForWidget): Removed incorrect isNPAPI check.
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView): Removed m_isNPAPIPlugin variable.
+        * plugins/PluginView.h: Removed setter/getter.
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::init): Removed call to setIsNPAPIPlugin.
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::init): Ditto.
+
+2009-03-19  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 24596: ASSERT in JSC::PropertySlot::slotBase @ iGoogle homepage
+        <https://bugs.webkit.org/show_bug.cgi?id=24596>
+        <rdar://problem/6686493>
+
+        JSDOMWindow::customGetOwnPropertySlot() does an access check after calling
+        JSGlobalObject::getOwnPropertySlot(). This causes the PropertySlot to be
+        set twice, once to the value that is illegal to access, and then to undefined
+        This causes an assertion failure in property access caching code.
+
+        The fix is to do the access check before calling JSGlobalObject::getOwnPropertySlot().
+
+        * bindings/js/JSDOMWindowCustom.h:
+        (WebCore::JSDOMWindow::customGetOwnPropertySlot):
+
+2009-03-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24676
+        Simple cross-origin requests shouldn't dispatch upload progress events
+
+        Test: http/tests/xmlhttprequest/simple-cross-origin-progress-events.html
+
+        * loader/CrossOriginAccessControl.cpp: (WebCore::passesAccessControlCheck): Added a comment
+        explaining the somewhat unexpected behavior of this function.
+
+        * xml/XMLHttpRequestUpload.cpp: (WebCore::XMLHttpRequestUpload::hasListeners):
+        * xml/XMLHttpRequestUpload.h:
+        Report whether there are any event listeners registered.
+
+        * xml/XMLHttpRequest.h: Added m_uploadEventsAllowed.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::createRequest): Set m_uploadEventsAllowed flag.
+        (WebCore::XMLHttpRequest::makeSameOriginRequest): Ditto.
+        (WebCore::XMLHttpRequest::makeCrossOriginAccessRequest): Ditto.
+        (WebCore::XMLHttpRequest::makeSimpleCrossOriginAccessRequest): Set request body - it can be
+        non-empty for POST requests.
+        (WebCore::XMLHttpRequest::makeCrossOriginAccessRequestWithPreflight): Set m_uploadEventsAllowed flag.
+        (WebCore::XMLHttpRequest::handleAsynchronousPreflightResult): Ditto.
+        (WebCore::XMLHttpRequest::abort): Only dispatch upload progress events if allowed.
+        (WebCore::XMLHttpRequest::networkError): Ditto.
+        (WebCore::XMLHttpRequest::abortError): Ditto.
+        (WebCore::XMLHttpRequest::didSendData): Ditto.
+
+2009-03-18  Marc-Antoine Ruel  <maruel@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24398
+        Fix a crash when loading a svg file in Chromium's test_shell and
+        then reloading the page.
+
+        * history/BackForwardListChromium.cpp:
+        (WebCore::BackForwardList::BackForwardList):
+        (WebCore::BackForwardList::close):
+
+2009-03-18  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for <rdar://problem/6685235>
+        <video> element poster cannot be set dynamically if not originally set up in HTML
+        
+        Allocate the media engine immediately so the plug-in proxy is available for
+        scripting right away.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::MediaPlayer):
+
+2009-03-18  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/6636747> REGRESSION (Safari 4 PB-r41326): 
+        Popup menu appears at the wrong location on page at http://
+        www.signonsandiego.com/
+
+        This was a regression from http://trac.webkit.org/changeset/40769, 
+        which changed the base class of RenderInline to 
+        RenderBoxModelObject rather than RenderBox.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::offsetParent): offsetParent should return a 
+        RenderBoxModelObject rather than just a RenderBox, which is more 
+        restrictive. 
+
+2009-03-18  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6504776> 
+        CrashTracer: [USER] 188 crashes in Safari at com.apple.WebCore • WTF::HashTableIterator<WTF::RefPtr<WebCore::ResourceLoader>, ...
+
+        Return early in case calling the client ends up spinning the run loop and completing/cancelling the load.
+        
+        * loader/NetscapePlugInStreamLoader.cpp:
+        (WebCore::NetscapePlugInStreamLoader::didCancel):
+
+2009-03-18  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24664
+        Upstreaming v8 collection.h
+
+        No change in behavior, so no test.
+
+        * bindings/v8/V8Collection.h: Added.
+
+2009-03-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23966
+        REGRESSION: Custom arrow navigation functionality doesn't work at dropular.net
+        <rdar://problem/6589657>
+
+        Match the CSSOM spec for getClientRects and getBoundingClientRect by
+        returning a 0x0 rect at the correct top/left position for empty inline
+        boxes.
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::absoluteRects):
+        (WebCore::RenderInline::absoluteQuads):
+
+2009-03-18  David Levin  <levin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Match the changes done for windows in the bug
+        https://bugs.webkit.org/show_bug.cgi?id=24530.
+
+        No change in behavior, so no test.
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::extraDefaultStyleSheet):
+
+2009-03-18  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        Added support for SVG's stroked texts to Qt.
+
+        [Qt] SVGs stroked text support missing
+        https://bugs.webkit.org/show_bug.cgi?id=24262
+
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::drawComplexText):
+
+2009-03-18  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix fast/encoding/char-decoding.html with recent ICU.
+
+        * platform/text/TextCodecICU.cpp:
+        (WebCore::TextCodecICU::decode): Look for gb18030 case-insensitively,
+        as newer versions of ICU use GB18030 as the canonical name.
+
+2009-03-17  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24662
+        Chromium build fixes.
+
+        Bug https://bugs.webkit.org/show_bug.cgi?id=24663 tracks
+        the invalid implementation of ScriptCallStack.
+
+        No change in behavior, so no test.
+
+        * bindings/v8/ScriptCallStack.h:
+        (WebCore::ScriptCallStack::state):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::drawRect):
+
+2009-03-17  David Carson  <dacarson@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Add anchor elements to the simple style sheet so that applications that 
+        are using WebKit just for simple text and links will also take advantage
+        of the fast path.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::elementCanUseSimpleDefaultStyle):
+
+2009-03-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/6687005> Need support for new move-left/right selectors.
+
+        * editing/EditorCommand.cpp:
+        (WebCore::executeMoveToLeftEndOfLine): Added.
+        (WebCore::executeMoveToLeftEndOfLineAndModifySelection): Added.
+        (WebCore::executeMoveToRightEndOfLine): Added.
+        (WebCore::executeMoveToRightEndOfLineAndModifySelection): Added.
+        Added command entries for the functions above.
+
+2009-03-17  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Adele Peterson.
+
+        Put the padding inside scrollbars on textareas.
+        https://bugs.webkit.org/show_bug.cgi?id=24370
+        
+        Put the padding inside the scrollbars on textareas. This is done by moving the
+        overflow from the shadowNode to the RenderTextControlMultiline. As a result,
+        all of the scroll handing methods that RenderTextControl overrides can be moved
+        down into RenderTextControlSingleLine since RenderTextControlMultiline can now
+        just use RenderBlock's versions. This also allows RenderTextControlMultiLine to
+        no longer need a custom layout method since the shadowNode can now just size
+        like a regular DIV.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::styleDidChange):
+        (WebCore::RenderTextControl::selection):
+        (WebCore::RenderTextControl::calcHeight):
+        (WebCore::RenderTextControl::hitInnerTextElement):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::styleDidChange):
+        (WebCore::RenderTextControlSingleLine::autoscroll):
+        (WebCore::RenderTextControlSingleLine::scrollWidth):
+        (WebCore::RenderTextControlSingleLine::scrollHeight):
+        (WebCore::RenderTextControlSingleLine::scrollLeft):
+        (WebCore::RenderTextControlSingleLine::scrollTop):
+        (WebCore::RenderTextControlSingleLine::setScrollLeft):
+        (WebCore::RenderTextControlSingleLine::setScrollTop):
+        (WebCore::RenderTextControlSingleLine::scroll):
+        * rendering/RenderTextControlSingleLine.h:
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::RenderTextControlInnerBlock::RenderTextControlInnerBlock):
+        (WebCore::RenderTextControlInnerBlock::positionForPoint):
+        (WebCore::TextControlInnerTextElement::createRenderer):
+
+2009-03-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Bug 24517: REGRESSION (r41552): innerHTML does an updateLayout -- unneeded and can be slow
+        https://bugs.webkit.org/show_bug.cgi?id=24517
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::enable): Added a call to updateRendering, since
+        determining whether to display the delete button involves style and updateRendering
+        also updates style (should probably be named updateStyle, in fact). Not needed to fix
+        this bug, but would have prevented the crash that led to this bug in the first place.
+
+        * editing/EditCommand.cpp:
+        (WebCore::EditCommand::EditCommand): Get rid of unneeded null check. All frames have
+        delete button controllers.
+        * editing/Editor.cpp:
+        (WebCore::Editor::rangeForPoint): Ditto.
+
+        * editing/markup.cpp:
+        (WebCore::appendStartMarkup): Changed a "&" to a "&&" so that generating markup
+        doesn't depend on renderers at all when the convertBlocksToInlines boolean is false.
+        This allows us to omit the call to updateLayoutIgnorePendingStylesheets in the
+        createMarkup function that's called by innerHTML.
+        (WebCore::MarkupAccumulator::appendMarkup): Turned this into a class with a member
+        function. Added a feature where the accumulator will skip a node. Moved arguments
+        that don't change during recursion into an object. This function still is a bit
+        inefficient, since it creates a new HashMap at every level as it recurses, but for now
+        I did not tackle that. Also replaced the onlyIncludeChildren boolean with EChildrenOnly
+        for consistency and clarity.
+        (WebCore::createMarkup): Removed the call to updateLayoutIgnorePendingStylesheets.
+        Instead of calling disable/enable on the delete button controller's container element,
+        pass it in to the markup accumulator as a node to skip.
+
+2009-03-17  Scott Violet  <sky@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24651
+        Skia does not always render text fill/stroke pattern/gradient/color correctly
+
+        Changes Skia's font rendering to only render gradient/pattern if current
+        color space indicates the gradient/pattern should be used.
+        This is covered by LayoutTests/fast/canvas/canvas-text-alignment.html .
+    
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::strokeColorSpace):
+        (WebCore::GraphicsContext::fillColorSpace):
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::):
+        * platform/graphics/GraphicsContextPrivate.h:
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::paintSkiaText):
+
+2009-03-17  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=24655
+        <rdar://problem/6633727> Hitting return at the end of a line with an anchor jumps me to the bottom of the message
+
+        Test: editing/inserting/6633727.html
+
+        This changes does a few things:
+        1) Renames pos to insertionPosition.
+        2) Eliminates "startNode".  It doesn't work well to consider the node separately from the insertionPosition.  
+           The insertionPosition gets updated at various times, and it seems likely that startNode can get out of sync.
+        3) Before building up a list of ancestors to move around when we insert the new block, make sure to use the deepest
+           representation of the insertionPosition, so all ancestor nodes are correctly included.
+
+        * editing/InsertParagraphSeparatorCommand.cpp: (WebCore::InsertParagraphSeparatorCommand::doApply):
+
+2009-03-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Kevin Ollivier.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24115
+        Introduce platform independent stubs for plugins.
+
+        * plugins/PluginDataNone.cpp: Copied from WebCore/plugins/wx/PluginDataWx.cpp.
+        * plugins/PluginPackageNone.cpp: Copied from WebCore/plugins/wx/PluginPackageWx.cpp.
+        * plugins/PluginViewNone.cpp: Copied from WebCore/plugins/wx/PluginViewWx.cpp.
+        * plugins/wx/PluginDataWx.cpp: Removed.
+        * plugins/wx/PluginPackageWx.cpp: Removed.
+        * plugins/wx/PluginViewWx.cpp: Removed.
+        * webcore-wx.bkl:
+
+2009-03-17  Darin Adler  <darin@apple.com>
+
+        Earlier version reviewed by Adele Peterson.
+
+        Bug 24304: REGRESSION (r39864): Hitting the space bar to select an <input type=radio>
+        or push an <input type=button> or <button> causes the page to scroll down.
+
+        Would be best to add a regression test for Windows eventually; tested that this has
+        no effect on the Mac OS X platform.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler): Added FIXMEs and tweaked formatting.
+        Use the code that calls the base class's defaultEventHandler early only in the cases
+        where it's needed: keydown and keypress events in text fields. In other cases, do the
+        more typical thing and call the default handler only at the end of the function.
+        This function already had code to make sure the keypress event for space never gets
+        through, but it was running too late since the scrolling code was moved into the
+        base class default event handler.
+
+2009-03-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24632
+
+        Fix repaint issues when composited layers come and go (only applies
+        when ACCELERATED_COMPOSITING is turned on).
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::mustOverlayCompositedLayers):
+        (WebCore::RenderLayer::setMustOverlayCompositedLayers):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::RenderLayerBacking):
+        * rendering/RenderLayerBacking.h:
+
+        Move what used to be the 'forceCompositingLayer' flag from RenderLayerBacking
+        to RenderLayer, because we don't want the side-effects of creating RenderLayerBacking
+        when setting this flag.
+        
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        When a RenderLayer flips into or out of compositing mode, compute a repaint
+        rect relative to the containerForRepaint, and repaint it.
+        
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        Call layer->setMustOverlayCompositedLayers() rather than setForcedCompositingLayer().
+        
+        (WebCore::RenderLayerCompositor::needsToBeComposited):
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::requiresCompositingForTransform):
+        (WebCore::RenderLayerCompositor::requiresCompositingForAnimation):
+        * rendering/RenderLayerCompositor.h:
+        
+        Rename requiresCompositingLayerForTransform() to requiresCompositingForTransform()
+        and make it a class static method to match requiresCompositingForAnimation(). Both
+        now take RenderObjects, rathern than RenderLayers.
+        
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::hasTransformRelatedProperty):
+        Minor tidyup using convenience methods added in an earlier commit.
+
+2009-03-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=24396
+
+        * config.h:
+        Add WTF_USE_ACCELERATED_COMPOSITING, defined to 0 for now, and add some
+        comments to make the #ifdefs more readable.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::computedTransform):
+        Add a comment to mention that we don't flatten the matrix.
+        
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::transform_3dMediaFeatureEval):
+        Have the 'transform-3d' media query evaluate to 'true' if 3d-rendering
+        is supported.
+        
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::animateTransform):
+        No need for the #ifdef here. If we don't support 3d, we will have already flattened
+        the matrix.
+        
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::makeAffine):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        New method to convert the matrix to an affine matrix by throwing a way the non-affine
+        parts.
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateTransform):
+        (WebCore::RenderLayer::currentTransform):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateLayerTransform):
+        If 3d rendering is not supported, convert the matrix to an affine matrix
+        which can be rendered, and used for hit testing.
+        
+        * rendering/RenderLayerCompositor.cpp:
+        Change the name of the exported symbol that webkitdirs.pm uses to know if
+        3d rendering is supported. There is no other 3d-rendering-specific symbol we can sniff.
+        
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::transformFromContainer):
+        Only take perspective into account if 3d rendering is supported.
+
+        * rendering/RenderObject.h:
+        (WebCore::makeMatrixRenderable):
+        Utility method that flattens a matrix if 3d rendering is not supported.
+
+2009-03-17  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Fix typo after mouse wheel changes.
+
+        * platform/wx/MouseWheelEventWx.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-03-17  Darin Adler  <darin@apple.com>
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::isEqual): Fix build, remove stray parenthesis.
+
+2009-03-17  Darin Adler  <darin@apple.com>
+
+        Fix crash seen right away when running run-webkit-tests.
+
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::isEqual): Restore assertion to its behavior pre-refactoring.
+        Also tweaked formatting a bit.
+
+2009-03-17  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        HTMLSelectElement::add() doesn't look at exception code returned from insertBefore(), so 
+        it doesn't need to zero it out before calling.
+
+        * html/HTMLSelectElement.cpp: (WebCore::HTMLSelectElement::add): Removed "ec = 0" line.
+
+2009-03-17  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adam Roben.
+
+        - WebCore part of adding a mechanism for controlling the caching of
+          responses through WebFrameLoaderClient
+
+        Mac already has such a mechanism, and this adds one for CFNetwork ports.
+
+        * WebCore.vcproj/WebCore.vcproj: Added EmptyClients.h
+        and ResourceLoaderCFNet.cpp.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::shouldCacheResponse): Added an
+        implementation that always returns true.
+
+        * loader/FrameLoaderClient.h: Declared shouldCacheResponse().
+
+        * loader/ResourceLoader.h: Ditto.
+
+        * loader/cf/ResourceLoaderCFNet.cpp: Added.
+        (WebCore::ResourceLoader::shouldCacheResponse): Added. Calls through to
+        FrameLoaderClient::shouldCacheResponse().
+
+        * platform/network/ResourceHandleClient.h:
+        (WebCore::ResourceHandleClient::shouldCacheResponse): Added an
+        implementation that always returns true.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::willCacheResponse): Added a call to
+        ResourceHandleClient::shouldCacheResponse(). If the client returns
+        false, return 0, which will prevent CFNetwork from caching the response.
+
+2009-03-17  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=13287
+        Cannot change SELECT to a dynamically created option
+
+        Tests: fast/forms/add-and-remove-option.html
+               fast/forms/add-remove-option-modification-event.html
+               fast/forms/add-selected-option.html
+               fast/forms/select-cache-desynchronization.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::dispatchChildInsertionEvents): Increment DOM tree version. This will happen when
+        dispatching DOMSubtreeModified again, but the version should be incremented for event
+        listeners to have an up to date view of the DOM.
+        (WebCore::dispatchChildRemovalEvents): Ditto.
+
+        * html/HTMLOptionElement.cpp: (WebCore::HTMLOptionElement::insertedIntoTree):
+        Make sure that the select element knows about its new selected option.
+
+        * html/HTMLOptionElement.h: Use insertedIntoTree() instead of insertedIntoDocument(),
+        because DOM also needs to be updated for forms that are not in document yet. Similar
+        problems exist for node removing, but removedFromTree() is called at a wrong time, so
+        those problems cannot be fixed without deeper refactoring.
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setRecalcListItems): Reset m_activeSelectionAnchorIndex - it
+        doesn't make sense to keep the anchor after programmatically changing the selection, and
+        keeping it was causing a failure in fast/forms/listbox-selection.html.
+
+        * html/HTMLSelectElement.h: Removed overrides for ContainerNode methods that only called
+        base class versions.
+
+2009-03-17  Steve Falkenburg  <sfalken@apple.com>
+
+        <rdar://problem/6690324> Accessing FTP sites reads unallocated memory, can result in garbled entries or crashes
+        
+        Reviewed by Darin Adler.
+
+        * loader/FTPDirectoryDocument.cpp:
+        (WebCore::FTPDirectoryTokenizer::parseAndAppendOneLine): Assign CString to a local while we hold pointers into it.
+
+2009-03-16  David Hyatt  <hyatt@apple.com>
+
+        <rdar://problem/6648411> REGRESSION: Layout of page is wrong at http://www.popcap.com/
+
+        Make sure that the initial shouldPaint check that looks at enclosingLayers properly skips over
+        layers that don't paint themselves.  This is done by adding a new enclosingSelfPaintingLayer method
+        so that RenderObjects can walk up the enclosing layer chain and skip any layers that don't paint
+        themselves.
+
+        Reviewed by Darin Adler.
+
+        Added fast/block/float/overlapping-floats-with-overflow-hidden.html
+
+        * WebCore.base.exp:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addOverhangingFloats):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::enclosingSelfPaintingLayer):
+        * rendering/RenderObject.h:
+
+2009-03-17  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24592
+        [GTK] Crash in FcPatternHash
+
+        Style fixes.
+
+        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
+        (WebCore::FontPlatformData::operator=):
+        * platform/graphics/gtk/FontPlatformDataPango.cpp:
+
+2009-03-17  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24592
+        [GTK] Crash in FcPatternHash
+
+        Sanitize memory management in pango fonts.
+
+        Release memory allocated by FontPlatformDataPango in its own
+        destructor instead of doing it from other classes, and add copy
+        constructor and '=' operator to be able to track referenced
+        objects properly.
+
+        * platform/graphics/gtk/FontPlatformDataPango.cpp:
+        (WebCore::FontPlatformData::~FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
+        (WebCore::FontPlatformData::FontPlatformData):
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+
+2009-03-17  Darin Adler  <darin@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 24624: Crash in imageLoadEventTimerFired after adoptNode used on <img>,
+        seen with inspector, which uses adoptNode
+        https://bugs.webkit.org/show_bug.cgi?id=24624
+        rdar://problem/6422850
+
+        Test: fast/dom/HTMLImageElement/image-load-cross-document.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Removed m_imageLoadEventTimer.
+        (WebCore::Document::detach): Removed m_imageLoadEventDispatchSoonList and
+        m_imageLoadEventDispatchingList.
+        (WebCore::Document::implicitClose): Called ImageLoader::dispatchPendingLoadEvents
+        instead of dispatchImageLoadEventsNow.
+
+        * dom/Document.h: Removed ImageLoader, dispatchImageLoadEventSoon,
+        dispatchImageLoadEventsNow, removeImage, m_imageLoadEventDispatchSoonList,
+        m_imageLoadEventDispatchingList, m_imageLoadEventTimer, and imageLoadEventTimerFired.
+
+        * loader/ImageLoader.cpp:
+        (WebCore::loadEventSender): Added. Returns the single global ImageLoadEventSender
+        object used privately as the target of the load event timer.
+        (WebCore::ImageLoader::~ImageLoader): Call ImageLoadEventSender::cancelLoadEvent
+        rather than Document::removeImage.
+        (WebCore::ImageLoader::setImage): Use m_element directly, not element().
+        (WebCore::ImageLoader::updateFromElement): Ditto. Also name the local variable
+        document instead of doc.
+        (WebCore::ImageLoader::notifyFinished): Call ImageLoadEventSender::dispatchLoadEventSoon
+        rather than Document::dispatchImageLoadEventSoon.
+        (WebCore::ImageLoader::dispatchPendingLoadEvent): Added. Handles the common logic
+        about when load events can be dispatched so that dispatchLoadEvent only has to
+        have the specific part for each derived class. This includes a check that the
+        document is attached, which used to be handled by having documents empty out the
+        image load event vectors in the detach function.
+        (WebCore::ImageLoader::dispatchPendingLoadEvents): Added. Calls the appropriate
+        function on the ImageLoadEventSender, which avoids the need to have that class be
+        public in the ImageLoader header.
+        (WebCore::ImageLoadEventSender::ImageLoadEventSender): Added. Has the code that
+        was previously in the Document constructor.
+        (WebCore::ImageLoadEventSender::dispatchLoadEventSoon): Added. Has the code that
+        was previously in Document::dispatchImageLoadEventSoon.
+        (WebCore::ImageLoadEventSender::cancelLoadEvent): Added. Has the code that was
+        previously in Document::removeImage.
+        (WebCore::ImageLoadEventSender::dispatchPendingLoadEvents): Added. Has the code
+        that was previously in Document::dispatchImageLoadEventsNow.
+        (WebCore::ImageLoadEventSender::timerFired): Added. Calls dispatchPendingLoadEvents.
+
+        * loader/ImageLoader.h: Improved comments. Made the virtual functions private
+        or protected rather than public. Added static dispatchPendingLoadEvents function
+        for use by Document and private dispatchPendingLoadEvent function for use by
+        ImageLoadEventSender. Made setLoadingImage private and eliminated
+        setHaveFiredLoadEvent since that can all be done inside the class without any
+        member functions.
+
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::dispatchLoadEvent): Removed logic to check whether a
+        load event already fired and whether image() is 0. These are now both base class
+        responsibilities.
+        * svg/SVGImageLoader.cpp:
+        (WebCore::SVGImageLoader::dispatchLoadEvent): Ditto.
+        * wml/WMLImageLoader.cpp:
+        (WebCore::WMLImageLoader::dispatchLoadEvent): Ditto.
+
+2009-03-17  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24623
+        Refactor ConsoleMessage to use ScriptFuncitonCall and eliminate JSC
+        dependencies.
+
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument): Added uint and ScriptString-taking methods.
+        * bindings/js/ScriptFunctionCall.h:
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::quarantineValue): Added generic ScriptValue quarantine helper.
+        * bindings/js/ScriptObjectQuarantine.h:
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::isEqual): Added.
+        * bindings/js/ScriptValue.h:
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::addToConsole): Added.
+        (WebCore::ConsoleMessage::isEqual): Changed to use ScriptValue::isEqual.
+        * inspector/ConsoleMessage.h:
+        (WebCore::ConsoleMessage::incrementCount): Added.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addConsoleMessage): Changed to use ConsoleMessage::addToConsole.
+        (WebCore::InspectorController::populateScriptObjects): Ditto.
+        * inspector/InspectorController.h:
+
+2009-03-17  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Mark Rowe.
+
+        Get BUILDING_ON_* defines from Platform.h.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24630
+
+        * WebCorePrefix.h:
+
+2009-03-16  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24592
+        [GTK] Crash in FcPatternHash
+
+        Sanitize memory management in gtk fonts.
+
+        Release memory allocated by FontPlatformDataGtk in its own
+        destructor instead of doing it from other classes, and add copy
+        constructor and '=' operator to be able to track referenced
+        objects properly.
+
+        * platform/graphics/gtk/FontPlatformData.h:
+        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
+        (WebCore::FontPlatformData::operator=):
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::~FontPlatformData):
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformDestroy):
+
+2009-03-17  Ariya Hidayat  <ariya.hidayat@nokia.com>
+
+        Build fix for Qt < 4.5.
+
+        As reported by Yael Aharon  <yael.aharon@nokia.com>
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawLine):
+
+2009-03-17  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24614
+        Access control checks are different in cached and uncached cases
+
+        Test: http/tests/xmlhttprequest/access-control-basic-non-simple-deny-cached.html
+
+        * loader/CrossOriginAccessControl.cpp:
+        (WebCore::isOnAccessControlSimpleRequestMethodWhitelist): Factored out simple method
+        check for use in both cached and uncached cases. In cached case, an old definition that
+        omitted HEAD was still used.
+        (WebCore::isOnAccessControlSimpleRequestHeaderWhitelist): Check that content type has an
+        allowed value. This is needed in all call sites. Also changed to compare MIME type, not
+        content type.
+        (WebCore::isSimpleCrossOriginAccessRequest): Use the above methods.
+
+        * loader/CrossOriginAccessControl.h: Expose isOnAccessControlSimpleRequestMethodWhitelist.
+
+        * loader/CrossOriginPreflightResultCache.cpp:
+        (WebCore::CrossOriginPreflightResultCacheItem::allowsCrossOriginMethod):
+        (WebCore::CrossOriginPreflightResultCacheItem::allowsCrossOriginHeaders):
+        Use the new checks for simple method and header.
+
+2009-03-16  Gustavo Noronha Silva  <gns@gnome.org> and Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24638
+        [GTK] HTML5 media tags do not work
+
+        Add a repaint-requested signal to the video sink, and use it to
+        call MediaPlayerPrivate::repaint, so that the video actually
+        plays.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateRepaintCallback):
+        (WebCore::MediaPlayerPrivate::createGSTPlayBin):
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_idle_func):
+        (webkit_video_sink_render):
+        (webkit_video_sink_class_init):
+
+2009-03-16  Gustavo Noronha Silva  <gns@gnome.org> and Thadeu Lima de Souza Cascardo <cascardo@holoscopio.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24638
+        [GTK] HTML5 media tags do not work
+
+        Work-around the fact that gst_element_query_duration returns true even
+        though it is unable to figure out the duration when in stream (push)
+        mode.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::duration):
+
+2009-03-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        <rdar://problem/6642742> Top Sites malfunction when switching text zoom mode
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setNeedsReapplyStyles): Don’t do anything if the frame is
+        currently showing a non-HTML view.
+
+2009-03-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Bug 24629: moving forward or backward a paragraph fails at edge of document
+        https://bugs.webkit.org/show_bug.cgi?id=24629
+        rdar://problem/6544413
+
+        Test: editing/selection/move-paragraph-document-edges.html
+
+        * editing/visible_units.cpp:
+        (WebCore::previousParagraphPosition): Use the last result from
+        previousLinePosition rather than going all the way back to what was originally
+        passed in when we hit exception cases like null or not moving. This correctly
+        inherits the behavior of previousLinePosition when we are in a paragraph at the
+        edge of a document.
+        (WebCore::nextParagraphPosition): Ditto.
+
+2009-03-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Bug 24619: RenderObject::selectionStartEnd does not need to be a virtual function
+        https://bugs.webkit.org/show_bug.cgi?id=24619
+
+        * rendering/RenderObject.h: Remove virtual keyword from selectionStartEnd declaration.
+        * rendering/RenderView.h: Ditto.
+
+2009-03-16  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24368
+        DOM scroll events should be based off the actual number of wheel
+        ticks, not off the number of lines scrolled.  This matches IE.
+
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchWheelEvent):
+        * dom/WheelEvent.cpp:
+        (WebCore::WheelEvent::WheelEvent):
+        * dom/WheelEvent.h:
+        (WebCore::WheelEvent::create):
+        * platform/PlatformWheelEvent.h:
+        (WebCore::PlatformWheelEvent::wheelTicksX):
+        (WebCore::PlatformWheelEvent::wheelTicksY):
+        * platform/gtk/WheelEventGtk.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/mac/WheelEventMac.mm:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/qt/WheelEventQt.cpp:
+        * platform/win/WheelEventWin.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/wx/MouseWheelEventWx.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-03-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel
+        
+        Clean up a few issues in the Animation code:
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+        Whitespace
+        
+        (WebCore::AnimationBase::willNeedService):
+        Don't round to float, use std::max
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::startTimeResponse):
+        Fix erroneously copied line to null out m_lastResponseWaiter.
+
+2009-03-12  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Seidel
+
+        https://bugs.webkit.org/show_bug.cgi?id=13632
+
+        Overflow scrolling needs to account for the bottom/right padding on the object itself as well
+        as for bottom/right margins on children.
+
+        Existing tests cover this.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+
+2009-03-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix for <rdar://problem/6320555>
+        Add an upper limit for setting HTMLSelectElement.length.
+
+        Test: fast/forms/select-max-length.html
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setOption):
+        (WebCore::HTMLSelectElement::setLength):
+
+2009-03-16  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/6686721> Media document crash in 64-bit WebKit
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovieView): QTMovieContentViewClass is only used when
+        rendering inline with old versions of QuickTime, so don't look for it when we are in a 
+        media document.
+
+2009-03-16  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24590
+        Refactor InspectorDOMStorageResource to use ScriptFunctionCall.
+
+        * bindings/js/ScriptFunctionCall.cpp:
+        (WebCore::ScriptFunctionCall::appendArgument): Added method for bool argument.
+        * bindings/js/ScriptFunctionCall.h: Ditto, also cleaned up.
+        * bindings/js/ScriptObjectQuarantine.cpp:
+        (WebCore::getQuarantinedScriptObject): Added Storage helper.
+        * bindings/js/ScriptObjectQuarantine.h: Ditto.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects): Changed to use bind method.
+        (WebCore::InspectorController::resetScriptObjects): Changed to use unbind method.
+        (WebCore::InspectorController::didUseDOMStorage): Changed to use isSameHostAndType and bind methods.
+        * inspector/InspectorController.h: Removed add/remove methods for DOM storage.
+        * inspector/InspectorDOMStorageResource.cpp:
+        (WebCore::InspectorDOMStorageResource::InspectorDOMStorageResource):
+        (WebCore::InspectorDOMStorageResource::isSameHostAndType): Added.
+        (WebCore::InspectorDOMStorageResource::bind): Added.
+        (WebCore::InspectorDOMStorageResource::unbind): Added.
+        * inspector/InspectorDOMStorageResource.h:
+
+2009-03-16   Mike Belshe  <mike@belse.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24580
+        Fix query() to match KURL behavior, this time with the code that
+        compiles.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::query): Fix copy/paste mistake.
+
+2009-03-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21752
+        REGRESSION: referencing XHR constructor for a not yet loaded frame permanently breaks it
+
+        Test: fast/dom/Window/window-early-properties-xhr.html
+
+        For some transitions, the Window object is not replaced, but Document is. When this happened,
+        window.document property was updated, but references to Document kept in cached constructors
+        were not.
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        (WebCore::JSAudioConstructor::document):
+        (WebCore::JSAudioConstructor::mark):
+        * bindings/js/JSAudioConstructor.h:
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        (WebCore::JSImageConstructor::document):
+        (WebCore::JSImageConstructor::mark):
+        * bindings/js/JSImageConstructor.h:
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
+        (WebCore::JSMessageChannelConstructor::scriptExecutionContext):
+        (WebCore::JSMessageChannelConstructor::mark):
+        * bindings/js/JSMessageChannelConstructor.h:
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        (WebCore::JSOptionConstructor::document):
+        (WebCore::JSOptionConstructor::mark):
+        * bindings/js/JSOptionConstructor.h:
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
+        (WebCore::JSXMLHttpRequestConstructor::scriptExecutionContext):
+        (WebCore::JSXMLHttpRequestConstructor::mark):
+        * bindings/js/JSXMLHttpRequestConstructor.h:
+        Changed cached constructors to keep a reference to Window, not Document.
+
+2009-03-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24549
+        Impose a limit on Access-Control-Max-Age value
+
+        * loader/CrossOriginPreflightResultCache.cpp:
+        (WebCore::CrossOriginPreflightResultCacheItem::parse):
+
+2009-03-15  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by David Kilzer.
+
+        <rdar://problem/6668875> Normalize Geolocation results
+
+        * platform/mac/GeolocationServiceMac.mm:
+        (-[WebCoreCoreLocationObserver locationManager:didUpdateToLocation:fromLocation:]):
+
+2009-03-15  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Update ::toString format as suggested by Darin Adler.
+
+        * page/Geoposition.cpp:
+        (WebCore::Geoposition::toString):
+
+2009-03-15  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6668238> WebCore is registering text encodings needlessly from KURL constructor.
+
+        Reviewed by Darin Adler.
+
+        Yet another case where we would trigger extended encoding loading needlessly.
+
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::encodingForFormSubmission):
+
+2009-03-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix: no review.
+
+        * rendering/style/ContentData.h:
+
+2009-03-15  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 24542: Improve ContentData encapsulation
+
+        <https://bugs.webkit.org/show_bug.cgi?id=24542>
+
+        Reviewed by Simon Fraser.
+
+        No tests since there is no change in behavior.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createObject): Used getter methods
+        instead of data members on ContentData class.  Used isImage()
+        convenience method.
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent): Ditto.
+
+        * rendering/style/ContentData.cpp:
+        (WebCore::ContentData::clear): Extracted code into
+        deleteContent() method.
+        (WebCore::ContentData::dataEquivalent): Added.  Extracted code
+        from StyleRareNonInheritedData::contentDataEquivalent().
+        (WebCore::ContentData::deleteContent): Added.  Used by setter
+        methods.
+        * rendering/style/ContentData.h: Made m_type, m_content and
+        m_next private.
+        (WebCore::ContentData::isCounter): Added.
+        (WebCore::ContentData::isImage): Added.
+        (WebCore::ContentData::isNone): Added.
+        (WebCore::ContentData::isText): Added.
+        (WebCore::ContentData::type): Added.
+        (WebCore::ContentData::dataEquivalent): Added.
+        (WebCore::ContentData::image): Added.
+        (WebCore::ContentData::setImage): Added.
+        (WebCore::ContentData::text): Added.
+        (WebCore::ContentData::setText): Added.
+        (WebCore::ContentData::counter): Added.
+        (WebCore::ContentData::setCounter): Added.
+        (WebCore::ContentData::next): Added.
+        (WebCore::ContentData::setNext): Added.
+
+        * rendering/style/CounterContent.h:
+        (WebCore::operator!=): Removed.
+        (WebCore::operator==): Renamed operator!=() and reversed its
+        logic after extracting code from
+        StyleRareNonInheritedData::contentDataEquivalent() to create
+        ContentData::dataEquivalent().
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::setContent): Used new getters and setters
+        on ContentData class.  Changed first argument from a StringImpl*
+        to a PassRefPtr<StrimgImpl>.  Used isText() convenience method.
+        * rendering/style/RenderStyle.h:
+        (WebCore::RenderStyle::setContent): Updated declaration.
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::contentDataEquivalent):
+        Extracted most logic in while() loop into
+        ContentData::dataEquivalent().
+
+2009-03-15  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24602
+        [Gtk] Searching in thepiratebay.org doesn't work with more than 1 word
+
+        Reintroduce the URI into the soup message after having set it in
+        the KURL, on redirects, to make sure it is properly encoded. This
+        fixes bad request problems when servers give bad URIs on their
+        response's Location header.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::restartedCallback):
+
+2009-03-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19737
+        No cursor and paste not enabled right clicking text field/area
+
+        Test: fast/events/right-click-focus.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+        (WebCore::EventHandler::handleMousePressEvent):
+        Take normal code path for right clicks (we were taking it for Ctrl-clicks anyway).
+
+2009-03-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23949
+        HTMLSelectElement is in inconsistent state when handling mutation events
+
+        Test: fast/forms/mutation-event-recalc.html
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::appendChild):
+        Call childrenChanged() before dispatching modification events, not after.
+
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::insertBefore):
+        (WebCore::HTMLOptGroupElement::replaceChild):
+        (WebCore::HTMLOptGroupElement::removeChild):
+        (WebCore::HTMLOptGroupElement::appendChild):
+        (WebCore::HTMLOptGroupElement::removeChildren):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::add):
+        (WebCore::HTMLSelectElement::remove):
+        (WebCore::HTMLSelectElement::insertBefore):
+        (WebCore::HTMLSelectElement::replaceChild):
+        (WebCore::HTMLSelectElement::removeChild):
+        (WebCore::HTMLSelectElement::appendChild):
+        (WebCore::HTMLSelectElement::removeChildren):
+        Remove calls to recalcSelectOptions(). It is too late to recalc now, after mutation events
+        were already dispatched.
+
+2009-03-14  Greg Bolsinga  <bolsinga@apple.com>
+
+        <rdar://problem/6683465>
+
+        Geolocation has to be able to handle NULL Frames.
+
+        Reviewed by Mark Rowe
+    
+2009-03-14  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Geoposition::toString was missing the Coordinates after the update.
+
+        * page/Geoposition.cpp:
+        (WebCore::Geoposition::toString):
+
+2009-03-14  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        [Gtk] Build fix - pass a Coordinate to Geoposition::create
+        https://bugs.webkit.org/show_bug.cgi?id=24603
+
+        Gtk build fix per r41650
+        https://bugs.webkit.org/show_bug.cgi?id=24506
+        Geolocation in Safari differs from the spec, no Coordinates attribute on Position
+
+        Pass a Coordinate to Geoposition::create.
+
+        * platform/gtk/GeolocationServiceGtk.cpp:
+        (WebCore::GeolocationServiceGtk::updatePosition):
+
+2009-03-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24545
+        Make cross-site XHR simple request definition match current spec draft
+
+        Tests: http/tests/xmlhttprequest/access-control-basic-post-fail-non-simple-content-type.html
+               http/tests/xmlhttprequest/access-control-basic-whitelist-request-headers.html
+
+        * loader/CrossOriginAccessControl.cpp:
+        (WebCore::isOnAccessControlSimpleRequestHeaderWhitelist): Added Content-Language.
+        (WebCore::isSimpleCrossOriginAccessRequest): Added HEAD. Restricted content types to those
+        that could be sent via form submission.
+
+2009-03-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15172
+        object fallback - empty string for first argument of setAttributeNS does not work like null
+
+        https://bugs.webkit.org/show_bug.cgi?id=24548
+        createElementNS("", name) should create an element in null namespace
+
+        Tests: fast/dom/createElementNS-empty-namespace.html
+               fast/dom/setAttributeNS-empty-namespace.html
+
+        * dom/QualifiedName.h: (WebCore::QualifiedName::QualifiedNameImpl::QualifiedNameImpl):
+        Convert empty namespaces to null.
+
+2009-03-13  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Take advantage of the ability of recent versions of Xcode to easily switch the active
+        architecture.
+
+        * Configurations/DebugRelease.xcconfig:
+
+2009-03-13  John Abd-El-Malek  <jam@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24593
+        Added requestorID so we can track the request to its WebView without using frame (which was removed).
+
+        * platform/network/chromium/ResourceRequest.h:
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::requestorID):
+        (WebCore::ResourceRequest::setRequestorID):
+        (WebCore::ResourceRequest::setTargetType):
+        (WebCore::ResourceRequest::policyURL):
+        (WebCore::ResourceRequest::setPolicyURL):
+        (WebCore::ResourceRequest::requestorPid):
+        (WebCore::ResourceRequest::setRequestorPid):
+
+2009-03-13  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24561
+        Add custom V8 bindings for HTMLElementCanvas, Location.
+
+        * bindings/v8/custom/V8HTMLCanvasElementCustom.cpp: Added.
+        * bindings/v8/custom/V8LocationCustom.cpp: Added.
+
+2009-03-13  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24584
+
+        Fix transparent text rendering on Chromium.  FontChromiumWin
+        was calling beginTransparencyLayer()/endTransparencyLayer(), with
+        a TransparencyWin inside to do GDI ClearType rendering over an
+        opaque background.  TransparencyWin does its special sauce
+        in the destructor, but it was being called too late to be used
+        correctly in the layer.  Put the special sauce into a new function,
+        composite(), and call that explicitly instead.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::~TransparencyAwareFontPainter):
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::~TransparencyWin):
+        (WebCore::TransparencyWin::composite):
+        (WebCore::TransparencyWin::init):
+        * platform/graphics/chromium/TransparencyWin.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::):
+
+2009-03-13  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24562
+        Add custom implementation for getCSSCanvasContext to V8 bindings.
+
+        * bindings/v8/custom/V8DocumentCustom.cpp: Added new method.
+
+2009-03-13  Mike Belshe  <mike@belse.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24580
+        Fix query() to match KURL behavior.
+
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::query): remove extra logic around question mark.
+
+2009-03-13  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 24474: AX: in multi-body tables, asking for a cell at a specific coordinate can return nil
+        https://bugs.webkit.org/show_bug.cgi?id=24474
+
+        Test: platform/mac-snowleopard/accessibility/table-multi-bodies.html
+
+        * page/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::cellForColumnAndRow):
+
+2009-03-13  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24589
+        Upstream changes to V8 event listeners (Chromium r11133) in order to
+        fix worker functionality break in Chromium.
+
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        (WebCore::V8AbstractEventListener::handleEvent):
+        * bindings/v8/V8AbstractEventListener.h:
+        * bindings/v8/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+
+2009-03-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24524
+        Introduce ScriptObject and ScriptFunctionCall abstractions.
+
+        * GNUmakefile.am: Added ScriptObject and ScriptFunctionCall to project.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+        * bindings/js/ScriptFunctionCall.cpp: Added.
+        * bindings/js/ScriptFunctionCall.h: Added.
+        * bindings/js/ScriptObject.cpp: Added.
+        * bindings/js/ScriptObject.h: Added.
+        * bindings/js/ScriptObjectQuarantine.cpp: Added.
+        * bindings/js/ScriptObjectQuarantine.h: Added.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::populateScriptObjects): Changed to use InspectorDatabaseResource::bind.
+        (WebCore::InspectorController::resetScriptObjects): Changed to use InspectorDatabaseResource::unbind.
+        (WebCore::InspectorController::didOpenDatabase): Changed to use InspectorDatabaseResource::unbind.
+        * inspector/InspectorController.h: Removed addScriptDatabaseResource and
+        removeScriptDatabaseResource declarations.
+        * inspector/InspectorDatabaseResource.cpp:
+        (WebCore::InspectorDatabaseResource::InspectorDatabaseResource):
+        (WebCore::InspectorDatabaseResource::bind): Added.
+        (WebCore::InspectorDatabaseResource::unbind): Added.
+        * inspector/InspectorDatabaseResource.h: Added bind and unbind declarations.
+
+2009-03-13  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24467
+        Make Skia drawRect() and stroke behavior match CG.
+
+        This makes drawRect() ignore the stroke width (like CG does), and
+        adds a warning comment about that to the appropriate header.
+
+        It also eliminates some hacky code in Skia's stroke preparation,
+        which tried to adjust odd-width strokes to fall on pixel boundaries.
+        Not only did this not match CG, it wouldn't necessarily work right,
+        because there could be other transforms (e.g. full-page zoom) that
+        would affect the stroke before it reached the device pixel level.
+
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::fillRect):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::drawRect):
+        (PlatformContextSkia::setupPaintForStroking):
+
+2009-03-13  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24583
+        Need to change scope of constructor and destructor of V8ObjectEventListener from private
+        to protected so that they could be used in its derived class V8WorkerContextEventListener.
+
+        * bindings/v8/V8ObjectEventListener.h:
+
+2009-03-13  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24579
+        Many V8*Event* files are misplaced.
+
+        This code is infrastructure for supporting the bindings and thus should
+        be in the bindings/v8 directory.
+
+        * bindings/v8/V8AbstractEventListener.cpp: Renamed from WebCore/bindings/v8/custom/V8AbstractEventListener.cpp.
+        * bindings/v8/V8AbstractEventListener.h: Renamed from WebCore/bindings/v8/custom/V8AbstractEventListener.h.
+        * bindings/v8/V8LazyEventListener.cpp: Renamed from WebCore/bindings/v8/custom/V8LazyEventListener.cpp.
+        * bindings/v8/V8LazyEventListener.h: Renamed from WebCore/bindings/v8/custom/V8LazyEventListener.h.
+        * bindings/v8/V8ObjectEventListener.cpp: Renamed from WebCore/bindings/v8/custom/V8ObjectEventListener.cpp.
+        * bindings/v8/V8ObjectEventListener.h: Renamed from WebCore/bindings/v8/custom/V8ObjectEventListener.h.
+        * bindings/v8/V8WorkerContextEventListener.cpp: Renamed from WebCore/bindings/v8/custom/V8WorkerContextEventListener.cpp.
+        * bindings/v8/V8WorkerContextEventListener.h: Renamed from WebCore/bindings/v8/custom/V8WorkerContextEventListener.h.
+
+2009-03-13  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Justin Garcia.
+
+        Fix for <rdar://problem/5089327> Color of quoted content is wrong when pasted inside other quoted content
+
+        Test: editing/pasteboard/5089327.html
+
+        Handle spans being pasted within a quoted region in the same way we handle "paste as quotation" content.
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::handleStyleSpansBeforeInsertion):
+        (WebCore::ReplaceSelectionCommand::handleStyleSpans):
+
+2009-03-13  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Update Geolocation perimission dialogs to be asynchronous.
+        https://bugs.webkit.org/show_bug.cgi?id=24505
+
+        Geolocation now requests permission from the Chrome asynchronously.
+        The Chrome is passed the Geolocation object, and the Chrome sets the permission
+        on the Geolocation. Geolocation also tracks if the Chrome should clear its cache
+        of SecurityOrigins with geolocation permission. This is so that the GeolocationService
+        can inform the Chrome of its request, and the Chrome is also free to implement its
+        own policy.
+        
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/Chrome.cpp:
+        (WebCore::Chrome::requestGeolocationPermissionForFrame):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::requestGeolocationPermissionForFrame):
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::Geolocation):
+        (WebCore::Geolocation::getCurrentPosition):
+        (WebCore::Geolocation::watchPosition):
+        (WebCore::Geolocation::setIsAllowed):
+        (WebCore::Geolocation::displayChallengeIfNecessary):
+        (WebCore::Geolocation::geolocationServicePositionChanged):
+        * page/Geolocation.h:
+        (WebCore::Geolocation::isAllowed):
+        (WebCore::Geolocation::setShouldClearCache):
+        (WebCore::Geolocation::shouldClearCache):
+        (WebCore::Geolocation::):
+
+2009-03-13  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6610666> Revise the Cocoa event model text API
+        
+        Add a NPCocoaEventTextInput event type. Remove the text input variables.
+        
+        * bridge/npapi.h:
+        (_NPCocoaEvent::):
+
+2009-03-13  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Anders.
+
+        <rdar://problem/6630340> REGRESSION (39114-39115): Unity Web Player no longer works if Flip4Mac is also installed
+        
+        The code assumed if we have a plug-in that supports "application/x-oleobject" we should always prefer the object tag
+        over of an embed tag. That assumption can cause the Mac platform to load the wrong plug-in, as Flip4Mac claims supports
+        for x-oleobject.
+        
+        * rendering/RenderPartObject.cpp:
+        (WebCore::shouldUseEmbedDescendant): Made the Mac platform always return true here. 
+
+2009-03-13  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24559
+        Need to port JSC fix (r41565) to V8 in order to fix layout test onload-single-line-comment.html.
+
+        * bindings/v8/custom/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::getListenerFunction):
+        (WebCore::V8LazyEventListener::getWrappedListenerFunction):
+
+2009-03-13  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24557
+        This is to support running multiple workers in a single worker process in chromium.
+
+        * bindings/v8/custom/V8WorkerContextEventListener.cpp:
+        (WebCore::V8WorkerContextEventListener::handleEvent):
+        Add locker to v8 event listener of worker context.
+
+2009-03-13  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24575
+        XHR response is incorrect after a network error.
+
+        Tests: http/tests/xmlhttprequest/cross-site-denied-response-sync-2.html
+               http/tests/xmlhttprequest/cross-site-denied-response-sync.html
+               http/tests/xmlhttprequest/cross-site-denied-response.html
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::networkError): Call internalAbort() to fully reset the request.
+        (WebCore::XMLHttpRequest::didFailRedirectCheck): No need to call internalAbort() here. Note
+        that since internalAbort() can drop GC protection, it is not safe to use the object after
+        this call.
+        (WebCore::XMLHttpRequest::didReceiveData): Check that the request wasn't aborted, and
+        return early if it was. This can happen during sync requests, as the loader does not know
+        that it was aborted, and just synthesizes all callbacks.
+
+2009-03-13  Adam Bergkvist <adam.bergkvist@ericsson.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=3547
+        XMLHttpRequest.statusText returns always "OK"
+
+        Covered by existing tests (which now pass on all platforms but Mac).
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::statusText): Return ResourceResponse status text. It is now up
+        to each platform to correctly set the status text or set it to "OK" to retain current
+        behavior.
+
+2009-03-13  Adam Bergkvist <adam.bergkvist@ericsson.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24349
+        [QT] HTTP status text is never set
+
+        Set HTTP status text to the reason phrase attribute of QNetworkReply.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2009-03-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Mark Rowe
+
+        <rdar://problem/6622300>: Reproducible crash on
+        <http://www.editgrid.com/explore/tnc/dave/FusionChart%3A_Candlestick>
+        
+        Prevent CSSStyleSheet::checkLoaded() writing to freed memory when it gets
+        deleted from under itself. The sheetLoaded() notification can allow scripts
+        to run via HTMLTokenizer::executeScriptsWaitingForStylesheets(),
+        which can cause the last ref to the CSSStyleSheet to be released.
+
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::checkLoaded):
+
+2009-03-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Allow make-generated-sources.sh to pass args down to DerivedSources.make
+
+        * make-generated-sources.sh:
+
+2009-03-12  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24498
+        Fix the Qt port to use the same algorithm for drawing dashed and dotted
+        borders as the other ports.  This makes the Qt port pixel-for-pixel perfect
+        compared to border drawing with Apple's canonical mac port and much closer
+        to konqueror and firefox behavior.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawLine):
+
+2009-02-26  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        Clean up DOMSelection to use some helper functions
+        making the code smaller, and less error-prone.
+        https://bugs.webkit.org/show_bug.cgi?id=19221
+
+        I tried moving DOMSelection off of rangeCompliantEquivalent
+        but failed.  VisibleSelection holds positions like (table, 1) to mean
+        "after the table".
+
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::visibleSelection):
+        (WebCore::anchorPosition):
+        (WebCore::focusPosition):
+        (WebCore::basePosition):
+        (WebCore::extentPosition):
+        (WebCore::DOMSelection::anchorNode):
+        (WebCore::DOMSelection::anchorOffset):
+        (WebCore::DOMSelection::focusNode):
+        (WebCore::DOMSelection::focusOffset):
+        (WebCore::DOMSelection::baseNode):
+        (WebCore::DOMSelection::baseOffset):
+        (WebCore::DOMSelection::extentNode):
+        (WebCore::DOMSelection::extentOffset):
+        * page/DOMSelection.h:
+
+2009-03-12  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24563
+        Change ResourceRequest to be a struct rather then a class to match other declarations.
+
+        * platform/network/chromium/ResourceRequest.h:
+
+2009-03-12  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Bug 24530: width100percent-searchfield.html should be fixed for chromium.
+        <https://bugs.webkit.org/show_bug.cgi?id=24530>
+
+        Compensate for r39924 in chromium, which broke LayoutTests/fast/replaced/width100percent-searchfield.html
+
+        * css/themeChromiumWin.css: Added.
+        Overrides the changes to start supporting input[type="search"] on Windows (since
+        Chromium doesn't do anything special for this).
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::supportsFocus):
+        (WebCore::RenderThemeChromiumWin::extraDefaultStyleSheet):
+        (WebCore::RenderThemeChromiumWin::determineState):
+        (WebCore::RenderThemeChromiumWin::getThemeData):
+
+2009-03-12  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24506
+        Geolocation in Safari differs from the spec, no Coordinates attribute on Position
+        
+        Get up to date.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionOptions):
+        * page/Coordinates.cpp: Added.
+        (WebCore::Coordinates::toString):
+        * page/Coordinates.h: Added.
+        (WebCore::Coordinates::create):
+        (WebCore::Coordinates::latitude):
+        (WebCore::Coordinates::longitude):
+        (WebCore::Coordinates::altitude):
+        (WebCore::Coordinates::accuracy):
+        (WebCore::Coordinates::altitudeAccuracy):
+        (WebCore::Coordinates::heading):
+        (WebCore::Coordinates::speed):
+        (WebCore::Coordinates::Coordinates):
+        * page/Coordinates.idl: Added.
+        * page/Geoposition.cpp:
+        (WebCore::Geoposition::toString):
+        * page/Geoposition.h:
+        (WebCore::Geoposition::create):
+        (WebCore::Geoposition::coords):
+        (WebCore::Geoposition::Geoposition):
+        * page/Geoposition.idl:
+        * page/PositionOptions.h:
+        (WebCore::PositionOptions::create):
+        (WebCore::PositionOptions::maximumAge):
+        (WebCore::PositionOptions::setMaximumAge):
+        (WebCore::PositionOptions::PositionOptions):
+        * platform/mac/GeolocationServiceMac.mm:
+        (-[WebCoreCoreLocationObserver locationManager:didUpdateToLocation:fromLocation:]):
+
+2009-03-12  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24496
+        Fix console logging of non-string values by coercing the argument to
+        a string, for V8 bindings.
+
+        Test: fast/js/console-non-string-values.html
+
+        * bindings/v8/ScriptValue.cpp: Added toString method.
+        (WebCore::ScriptValue::toString):
+        * bindings/v8/ScriptValue.h: Added PlatformString, ScriptState includes
+            and toString declaration.
+
+2009-03-12  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Eliminate ChromiumBridge::uiResourceProtocol
+        https://bugs.webkit.org/show_bug.cgi?id=24558
+
+        * platform/chromium/ChromiumBridge.h:
+
+2009-03-12  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Missing breaks in switch statement
+        https://bugs.webkit.org/show_bug.cgi?id=24556
+
+        * platform/mac/GeolocationServiceMac.mm:
+        (-[WebCoreCoreLocationObserver locationManager:didFailWithError:]):
+
+2009-03-12  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24554
+        Remove some unused functions from ChromiumBridge.
+
+        * platform/chromium/ChromiumBridge.h:
+
+2009-03-02  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Fisher and Justin Garcia.
+
+        Safari crashes during drag and drop in Google presentations
+        due to mutation event handlers removing DOM content during insertNode
+        https://bugs.webkit.org/show_bug.cgi?id=22634
+
+        Added a bunch of "null" checks to make sure nodes are still
+        in the document before we operate on them.  This is an
+        inelegant solution, but it's the best we have for now.
+        
+        Test: editing/selection/crash-on-drag-with-mutation-events.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::insertNodeAt):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+
+2009-03-12  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Treat.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24525
+        REGRESSION: Inspector window doesn't close when inspected page is
+        destroyed. This is a revert of r41158, which became unnecessary when
+        InspectorController became ref-counted in r41462.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspectedPageDestroyed): Reset m_inspectedPage
+            after calling close().
+        (WebCore::InspectorController::stopUserInitiatedProfiling): Remove
+            m_inspectedPage check guard around profile logic.
+
+2009-03-12  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24502
+        Make horizontal scrolling on Windows always go the correct direction.
+
+        * platform/PlatformWheelEvent.h:
+        * platform/win/WheelEventWin.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-03-12  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24496
+        Fix console logging of non-string values by coercing the argument to
+        a string.
+
+        Test: fast/js/console-non-string-values.html
+
+        * bindings/js/ScriptValue.cpp: Removed PlatformString include.
+        * bindings/js/ScriptValue.h: Added toString method.
+        (WebCore::ScriptValue::toString):
+        * page/Console.cpp:
+        (WebCore::getFirstArgumentAsString): Changed firstArgumentAsString method to use
+            ScriptValue::toString.
+        (WebCore::Console::addMessage): added extra ScriptState argument to callsite.
+        (WebCore::Console::count): Ditto.
+
+2009-03-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Adele Peterson.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24508
+        
+        Fix updating of text field with placeholder text when value is set
+        by ensuring that updatePlaceholderVisibility() is called after
+        the value has been updated, not before.
+
+        Test: fast/forms/placeholder-set-value.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setValue):
+
+2009-03-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24552
+        
+        Hit testing involving normal flow, self-painting layers (e.g. reflections)
+        was broken because it was not null-testing the result of hitTestLayer(),
+        so bailing early with a nil hit layer.
+
+        Test: fast/layers/normal-flow-hit-test.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestLayer):
+
+2009-03-12  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Removed zero-sized files, left over from improperly applied patch.
+
+        * platform/graphics/chromium/ThemeHelperChromiumWin.cpp: Removed.
+        * platform/graphics/chromium/ThemeHelperChromiumWin.h: Removed.
+
+2009-03-12  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Do not ignore alpha color in optimization.  Hard to believe, but there
+        are websites that fill the entire page with a tiled image consisting of
+        nothing but a 100% transparent 1x1 image. <cough>orbitz.com</cough>
+
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+
+2009-03-12  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 24110: cloneNode should call cloneElement and not the reverse
+
+        - Splitted the code from cloneNode into cloneElementWithChildren and cloneElementWithChildren.
+          Now cloneNode calls one of the 2 previous methods.
+
+        - Renamed cloneElement to cloneElementWithoutChildren as it was the previous behaviour.
+
+        - Moved cloneNode to the Element private section so that WebCore callers cannot use it.
+
+        - Removed Element::cloneNode usage through WebCore.
+
+        * dom/Element.cpp:
+        (WebCore::Element::cloneNode): Moved to Element's private section and it
+        now calls the two next methods.
+        (WebCore::Element::cloneElementWithChildren): Added.
+        (WebCore::Element::cloneElementWithoutChildren): Renamed from cloneElement
+        to avoid ambiguity.
+        * dom/Element.h:
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded): Changed call to cloneElement
+        to call to cloneElementWithoutChildren.
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply): Ditto.
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::indentRegion): Ditto.
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply): Ditto.
+        * editing/ModifySelectionListLevel.cpp:
+        (WebCore::IncreaseSelectionListLevelCommand::doApply): Ditto.
+        * editing/SplitElementCommand.cpp:
+        (WebCore::SplitElementCommand::doApply): Ditto.
+        * editing/markup.cpp:
+        (WebCore::createFragmentFromText): Ditto.
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::buildShadowTree): Ditto.
+        (WebCore::SVGUseElement::expandUseElementsInShadowTree): Ditto.
+
+2009-03-12  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fixed a crash on the 1x1 pixel check for background image in gtk.
+        We need to load the image first and need to be sure that the image
+        is not null before checking the type. 
+
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+
+2009-03-12  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24544
+        Rename setUrl to setURL
+
+        Use proper case for setUrl method, rename it to setURL.
+
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::adopt):
+        * platform/network/ResourceResponseBase.h:
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::writeCallback):
+        (WebCore::headerCallback):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+        (WebCore::queryInfoCallback):
+
+2009-03-12  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24519
+        [GTK] Use two argument KURL ctor in ResourceHandleSoup
+
+        Use two argument KURL ctor, the single argument ctor expects its
+        input to be the output of a previous KURL::parse call, which is
+        not the case here.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+        (WebCore::queryInfoCallback):
+
+2009-03-11  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Fix for <rdar://6418681>
+        https://bugs.webkit.org/show_bug.cgi?id=22644
+
+        Reviewed by Steve Falkenburg.
+
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::isPluginBlacklisted): Add the Citrix ICA
+        Client plug-in to the blacklist; it requires a Mozilla-based browser.
+
+2009-03-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (build fix).
+
+        build fix.
+
+        * html/CanvasRenderingContext2D.h:
+
+2009-03-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/6673852> Widget "Simple World Clock" does not display with Safari 4
+
+        A number of dashboard widgets rely on canvas failing silently when given invalid
+        colors for gradient stops, but both the spec and firefox throw exceptions here.
+        So we work around this by creating a dashboard quirk that will only suppress the
+        exception in dashboard compatibility mode.
+
+        Test: fast/canvas/canvas-gradient-addStop-error.html
+
+        * html/CanvasGradient.cpp:
+        (WebCore::CanvasGradient::CanvasGradient):
+        (WebCore::CanvasGradient::addColorStop):
+        * html/CanvasGradient.h:
+        (WebCore::CanvasGradient::setDashboardCompatibilityMode):
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::prepareGradientForDashboard):
+        (WebCore::CanvasRenderingContext2D::createLinearGradient):
+        (WebCore::CanvasRenderingContext2D::createRadialGradient):
+        * html/CanvasRenderingContext2D.h:
+
+2009-03-11  David Kilzer  <ddkilzer@apple.com>
+
+        Clarify comments regarding order of FEATURE_DEFINES
+
+        Rubber-stamped by Mark Rowe.
+
+        * Configurations/WebCore.xcconfig: Added warning about the
+        consequences when FEATURE_DEFINES are not kept in sync.
+
+2009-03-11  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24515
+        [GTK] soup backend should use GMappedFile instead of mmap directly
+
+        Rewrite mmap code used to upload files to use GMappedFile, so that
+        it is platform-independent.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startHttp):
+
+2009-03-11  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - WebCore part of fixing <rdar://problem/3919124> Thai text selection
+          in Safari is incorrect
+
+        Test: platform/mac/editing/selection/word-thai.html
+
+        Tested on Mac, but should work on all ICU platforms (or more precisely
+        on all platforms that implement
+        WTF::Unicode::hasLineBreakingPropertyComplexContext() correctly).
+
+        * editing/TextIterator.cpp:
+        (WebCore::BackwardsCharacterIterator::BackwardsCharacterIterator):
+        Added.
+        (WebCore::BackwardsCharacterIterator::range): Added.
+        (WebCore::BackwardsCharacterIterator::advance): Added.
+
+        * editing/TextIterator.h: Added BackwardsCharacterIterator with the
+        minimal functionality required for this patch.
+        (WebCore::BackwardsCharacterIterator::atEnd): Added.
+
+        * editing/visible_units.cpp:
+        (WebCore::firstNonComplexContextLineBreak): Added this helper function
+        that returns the index of the first character in the string whose
+        Unicode line breaking property value is not SA ("Complex Context"), or
+        the length of the string if there is no such character.
+        (WebCore::lastNonComplexContextLineBreak): Added this helper function
+        that returns the index of the last character in the string whose
+        Unicode line breaking property value is not SA ("Complex Context"), or
+        -1 if there is no such character.
+        (WebCore::previousBoundary): Changed the signature of the search
+        function to include an offset parameter. Renamed the 'exception' local
+        variable to 'ec' and changed its type to ExceptionCode. Extend the
+        string forwards until the first character with Unicode line breaking
+        property value other than SA. This gives the boundary search function
+        enough context in the forward direction. Changed to use a
+        BackwardsCharacterIterator for translating the backwards offset into
+        a position.
+        (WebCore::nextBoundary): Changed the signature of the search
+        function to include an offset parameter. Extend the string backwards
+        until the first character with Unicode line breaking property value
+        other than SA. This gives the boundary search function enough context in
+        the backwards direction. Restricted the workaround for <rdar://5192593>
+        only to the line break case, because it was causing an extra character
+        to be selected following a word that ended with a combining mark.
+        (WebCore::startWordBoundary): Added an offset parameter. Check that
+        going backwards from the given offset, there is a character with Unicode
+        line breaking property value other than SA, and otherwise return 0 to
+        request more context.
+        (WebCore::endWordBoundary): Similar, but in reverse.
+        (WebCore::previousWordPositionBoundary): Similar.
+        (WebCore::nextWordPositionBoundary): Similar.
+        (WebCore::startSentenceBoundary): Updated for the new search function
+        signature.
+        (WebCore::endSentenceBoundary): Ditto.
+        (WebCore::previousSentencePositionBoundary): Ditto.
+        (WebCore::nextSentencePositionBoundary): Ditto.
+
+2009-03-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Don't use "::" in thread names because it is ugly!
+
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::open): Use "WebCore: " instead of "WebCore::".
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::loaderRunLoop): Call this "WebCore: CFNetwork Loader" to make
+        it clear this is a WebCore-created thread.
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::start): Use "WebCore: " instead of "WebCore::".
+        * storage/LocalStorageThread.cpp:
+        (WebCore::LocalStorageThread::start): Use "WebCore: " instead of "WebCore::".
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::start): Use "WebCore: " instead of "WebCore::".
+
+2009-03-11  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Darin Adler.
+
+        <rdar://problem/6653286> WebCore's implementation of screenIsMonochrome is needlessly complex
+
+        * platform/mac/PlatformScreenMac.mm:
+        (WebCore::screenIsMonochrome): Return false.
+
+2009-03-11  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=14749 percentage 
+        top value on position:relative child not calculated correctly if 
+        parent has percentage height
+        - and corresponding -
+        <rdar://problem/6172925>
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::relativePositionOffsetY):
+
+2009-03-11  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Implement ScriptValue::hasNoValue for V8.
+        https://bugs.webkit.org/show_bug.cgi?id=24507
+
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::hasNoValue):
+
+2009-03-11  David Levin  <levin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bug 24459: Add v8 bindings for event.
+        <https://bugs.webkit.org/show_bug.cgi?id=24459>
+
+        Adding custom event bindings.
+
+        * bindings/v8/custom/V8AbstractEventListener.cpp: Added.
+        * bindings/v8/custom/V8AbstractEventListener.h: Added.
+        * bindings/v8/custom/V8AttrCustom.cpp:
+        Fixed messed up copyright header.
+        * bindings/v8/custom/V8CustomEventListener.cpp: Added.
+        * bindings/v8/custom/V8CustomEventListener.h:
+        Replaced forwarding header with the real implementation.
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        * bindings/v8/custom/V8LazyEventListener.cpp: Added.
+        * bindings/v8/custom/V8LazyEventListener.h: Added.
+        * bindings/v8/custom/V8ObjectEventListener.cpp: Added.
+        * bindings/v8/custom/V8ObjectEventListener.h: Added.
+        * bindings/v8/custom/V8WorkerContextEventListener.cpp: Added.
+        * bindings/v8/custom/V8WorkerContextEventListener.h: Added.
+
+2009-03-11  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24521
+        Add some missing includes for the non-JSC build.
+
+        * platform/text/PlatformString.h: added OwnPtr.h
+        * xml/XMLHttpRequest.cpp: added SecurityOrigin.h
+
+2009-03-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=24531
+        
+        Make sure that AnimationControllerPrivate::getAnimatedStyleForRenderer() never
+        returns a null style if it has a valid renderer, which could happen if a
+        CompositeAnimation existed, but wasn't running any animations or transitions.
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::getAnimatedStyleForRenderer):
+
+2009-03-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix Scons build. Patch from Alexander Guy.
+
+        * WebCore.scons:
+
+2009-03-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+       
+        https://bugs.webkit.org/show_bug.cgi?id=23093
+        
+        When the cancel button in the search field is shown or hidden,
+        we need to explicitly setStyle() on the cancel button's renderer,
+        to ensure that repaint happens. Changing the style without telling
+        the renderer won't work.
+
+        Test: fast/repaint/search-field-cancel.html
+
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        (WebCore::RenderTextControlSingleLine::createCancelButtonStyle):
+        (WebCore::RenderTextControlSingleLine::updateCancelButtonVisibility):
+        (WebCore::RenderTextControlSingleLine::visibilityForCancelButton):
+        * rendering/RenderTextControlSingleLine.h:
+
+2009-03-11  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15790
+        Ligatures aren't accounted for when manipulating VisiblePositions
+
+        Changed cursorMovementIterator rules to prevent a cursor from moving in the middle of an
+        Indic ligature which uses a virama sign.
+        
+        Test: editing/deleting/skip-virama-001.html
+
+        * platform/text/TextBreakIteratorICU.cpp:
+        (WebCore::cursorMovementIterator):
+
+2009-03-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24513
+        REGRESSION: Cursor movement doesn't work on Tiger (ICU 3.2)
+
+        Fixes existing tests on Tiger.
+
+        * platform/text/TextBreakIteratorICU.cpp: (WebCore::cursorMovementIterator):
+        Use characterBreakIterator on Tiger (like we used to do).
+
+2009-03-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/4072827> Downloaded non-ASCII file name becomes garbled
+
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest): Correct selector name
+        in instancesRespondToSelector.
+
+2009-03-11  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        [GTK]DumpRenderTree doesn't compile for non-X11 GTK ports anymore
+        https://bugs.webkit.org/show_bug.cgi?id=2260
+
+        Add missing stdio.h include to get the build going
+
+        * plugins/gtk/PluginPackageGtk.cpp:
+
+2009-03-10  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Ken Kocienda.
+
+        * dom/Range.cpp:
+        (WebCore::Range::addLineBoxRects): If the range ended at [div, 0], addLineBoxRects
+        would include rects for the divs contents.  Set the correct RenderObject to stop at.
+
+2009-03-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6123770> Restrict access to document.cookie when making a cross-site XHR
+
+        * xml/XMLHttpRequest.cpp: (WebCore::XMLHttpRequest::responseXML): Removed an incorrect
+        comment about cookie support. Firefox doesn't expose cookies on responseXML at all, and
+        there are security concerns with exposing them for cross-origin requests, so it's not clear
+        if we want to change anything here.
+
+2009-03-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=24503
+        
+        Fix hit testing of absolutely positioned single line text controls by
+        ensuring that we set result.innerNode() correctly. If the hit node is
+        a descendant of the inner text element or if it is the <input> itself,
+        then we say we hit the innerTextElement.
+        
+        Rename hitInnerTextBlock() to hitInnerTextElement() to match the
+        'innerTextElement' terminology used elsewhere.
+        
+        Assert that if renderer()->hitTest() returns false, no-one set
+        result.innerNode().
+
+        Test: fast/forms/search-abs-pos-cancel-button.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestContents):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::hitInnerTextElement):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::nodeAtPoint):
+
+2009-03-10  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        <rdar://problem/6668238> WebCore is registering text encodings needlessly from KURL constructor.
+        
+        Another case where we would trigger extended encoding loading needlessly.
+
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::isNonByteBasedEncoding):
+
+2009-03-10  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/6624769> REGRESSION (Safari 4 PB): No 
+        scroll bar appears for long line of text with NOWRAP set
+
+        This is a regression from http://trac.webkit.org/changeset/32226
+        I talked with Dan about the original change, and we decided that 
+        the best fix was to remove his small potential-optimization that 
+        only created a separate line box for whitespace under certain 
+        circumstances. This new code will always create a separate line 
+        box.
+
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2009-03-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix for <rdar://problem/6166844>
+        https://bugs.webkit.org/show_bug.cgi?id=24495
+
+        Use same rule for loading java applets as we do for images.
+
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::createRenderer):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::createJavaAppletWidget):
+
+2009-03-10  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by David Kilzer.
+
+        Get rid of revealCaret and use revealSelection instead.
+
+        * WebCore.base.exp:
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setSelection):
+        * page/Frame.cpp:
+        (WebCore::Frame::revealSelection):
+        * page/Frame.h:
+
+2009-03-10  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Geoff Garen.
+
+        Bug 23736: WebKit Crashes on http://g-conquest.fr/~server2
+        <https://bugs.webkit.org/show_bug.cgi?id=23736>
+        <rdar://problem/6560278>
+
+        Before replacing the document, FrameLoader::executeIfJavaScriptURL()
+        should call stopAllLoaders(), just like continueLoadAfterNavigationPolicy().
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::executeIfJavaScriptURL):
+
+2009-03-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 24494: crash when deleting at end of document and merging paragraphs
+        https://bugs.webkit.org/show_bug.cgi?id=24494
+        rdar://problem/6571537
+
+        Test: editing/deleting/merge-at-end-of-document.html
+
+        * dom/Range.cpp:
+        (WebCore::Range::compareBoundaryPoints): Split out assertion. It's better not to
+        use && in assertions since we'd like to know which condition is failing.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyInlineStyleToRange): Added a null check before
+        calling compareBoundaryPoints, since a 0 for the node is ambiguous and so the
+        function doesn't know which value to return.
+
+2009-03-10  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel. Math checked by Oliver Hunt.
+
+        Implement the Cairo version of the checkForSolidColor() method. This halfes the
+        time to draw on 1x1 px background images.
+        I added two new calls to Color for the pixel manipulation on cairo_surface's.
+        They are neede to premultiply/unpremultiply the colors of the surface.
+
+        [CAIRO] Introduce single-pixel image optimizations
+        https://bugs.webkit.org/show_bug.cgi?id=17284
+
+        * platform/graphics/Color.cpp:
+        (WebCore::colorFromPremultipliedARGB):
+        (WebCore::premultipliedARGBFromColor):
+        * platform/graphics/Color.h:
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::getImageData):
+        (WebCore::ImageBuffer::putImageData):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+
+2009-03-06  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24437
+
+        Add support for registering noAccess URL schemes:
+        1-  Add FrameLoader::registerURLSchemeAsNoAccess, and have SecurityOrigin check
+        that list upon construction (similar to how isLocal is implemented).
+        2-  Make InspectorController call grantUniversalAccess on its Document's
+        SecurityOrigin at the time when windowScriptObjectAvailable is called.
+
+        This enables content such as the inspector to be loaded from a custom (non-file)
+        URL, which is how Chromium loads the inspector.  It also allows other URL schemes
+        to be treated like data: URLs, which Chromium utilizes for its various HTML-based
+        UI panels.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        * loader/FrameLoader.cpp:
+        (WebCore::localSchemes):
+        (WebCore::noAccessSchemes):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoader.h:
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::isLocal):
+
+2009-03-10  Xan Lopez  <xlopez@igalia.com>
+
+        Build fix, no review
+
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (textMarkerForVisiblePosition):
+        (visiblePositionForTextMarker):
+
+2009-03-10  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24491
+        Rename posOffset to m_offset, get rid of accessor
+
+        As suggested in dom/Position.h, this patch gets rid of the
+        'offset()' accessor and renames posOffset to m_offset. I've used
+        m_offset instead of offset to follow the style guide lines, since
+        Position is still a class and not a structure. If the long term
+        plan is still to make it a structure it would be pretty easy to
+        just s/m_offset/offset/ globally when that is achieved.
+
+        * dom/Position.cpp:
+        (WebCore::Position::previous):
+        (WebCore::Position::next):
+        (WebCore::Position::atStart):
+        (WebCore::Position::atEnd):
+        (WebCore::Position::renderedOffset):
+        (WebCore::Position::isCandidate):
+        (WebCore::Position::inRenderedText):
+        (WebCore::Position::isRenderedCharacter):
+        (WebCore::Position::rendersInDifferentPosition):
+        (WebCore::Position::leadingWhitespacePosition):
+        (WebCore::Position::debugPosition):
+        (WebCore::Position::formatForDebugger):
+        * dom/Position.h:
+        (WebCore::Position::Position):
+        * dom/PositionIterator.h:
+        (WebCore::PositionIterator::PositionIterator):
+        * dom/Range.cpp:
+        * dom/RangeBoundaryPoint.h:
+        (WebCore::RangeBoundaryPoint::position):
+        (WebCore::RangeBoundaryPoint::set):
+        (WebCore::RangeBoundaryPoint::setOffset):
+        (WebCore::RangeBoundaryPoint::setToChild):
+        (WebCore::RangeBoundaryPoint::setToStart):
+        (WebCore::RangeBoundaryPoint::setToEnd):
+        (WebCore::RangeBoundaryPoint::childBeforeWillBeRemoved):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
+        (WebCore::ApplyStyleCommand::applyInlineStyleToRange):
+        (WebCore::ApplyStyleCommand::removeInlineStyle):
+        (WebCore::ApplyStyleCommand::nodeFullySelected):
+        (WebCore::ApplyStyleCommand::nodeFullyUnselected):
+        (WebCore::ApplyStyleCommand::splitTextAtStartIfNeeded):
+        (WebCore::ApplyStyleCommand::splitTextAtEndIfNeeded):
+        (WebCore::ApplyStyleCommand::splitTextElementAtStartIfNeeded):
+        (WebCore::ApplyStyleCommand::splitTextElementAtEndIfNeeded):
+        (WebCore::ApplyStyleCommand::mergeStartWithPreviousIfIdentical):
+        (WebCore::ApplyStyleCommand::mergeEndWithNextIfIdentical):
+        (WebCore::ApplyStyleCommand::joinChildTextNodes):
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::insertNodeAt):
+        (WebCore::CompositeEditCommand::positionOutsideTabSpan):
+        (WebCore::CompositeEditCommand::rebalanceWhitespaceAt):
+        (WebCore::CompositeEditCommand::prepareWhitespaceAtPositionForSplit):
+        (WebCore::CompositeEditCommand::deleteInsignificantText):
+        (WebCore::CompositeEditCommand::removePlaceholderAt):
+        (WebCore::CompositeEditCommand::moveParagraphs):
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::updatePositionForNodeRemoval):
+        (WebCore::updatePositionForTextRemoval):
+        (WebCore::DeleteSelectionCommand::handleGeneralDelete):
+        (WebCore::DeleteSelectionCommand::fixupWhitespace):
+        * editing/Editor.cpp:
+        (WebCore::Editor::setComposition):
+        (WebCore::Editor::advanceToNextMisspelling):
+        (WebCore::Editor::getCompositionSelection):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::performTrivialReplace):
+        (WebCore::InsertTextCommand::input):
+        (WebCore::InsertTextCommand::insertTab):
+        * editing/MoveSelectionCommand.cpp:
+        (WebCore::MoveSelectionCommand::doApply):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::debugRenderer):
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::rangeFromLocationAndLength):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::characterAfter):
+        (WebCore::VisiblePosition::debugPosition):
+        (WebCore::makeRange):
+        (WebCore::setStart):
+        (WebCore::setEnd):
+        * editing/VisibleSelection.cpp:
+        (WebCore::VisibleSelection::toNormalizedRange):
+        (WebCore::makeSearchRange):
+        (WebCore::VisibleSelection::debugPosition):
+        (WebCore::VisibleSelection::showTreeForThis):
+        * editing/htmlediting.cpp:
+        (WebCore::comparePositions):
+        (WebCore::rangeCompliantEquivalent):
+        (WebCore::isFirstPositionAfterTable):
+        (WebCore::isLastPositionBeforeTable):
+        * editing/visible_units.cpp:
+        (WebCore::previousBoundary):
+        (WebCore::nextBoundary):
+        (WebCore::startPositionForLine):
+        (WebCore::startOfLine):
+        (WebCore::endPositionForLine):
+        (WebCore::nextLinePosition):
+        (WebCore::startOfParagraph):
+        (WebCore::endOfParagraph):
+        * page/AccessibilityObject.cpp:
+        (WebCore::updateAXLineStartForVisiblePosition):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::indexForVisiblePosition):
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::anchorOffset):
+        (WebCore::DOMSelection::baseOffset):
+        (WebCore::DOMSelection::focusOffset):
+        (WebCore::DOMSelection::extentOffset):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionLayoutChanged):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::indexForVisiblePosition):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeSelection):
+
+2009-03-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 23564: REGRESSION (r39230-39286): crash loading page that changes <input> display type and then calls innerHTML
+        https://bugs.webkit.org/show_bug.cgi?id=23564
+        rdar://problem/6537238
+
+        Test: fast/dom/HTMLElement/innerHTML-selection-crash.html
+
+        * editing/markup.cpp: (WebCore::createMarkup): Added updateLayoutIgnorePendingStylesheets
+        call to the one of the two overloads of this function that wasn't calling it. This fixes
+        this crash and other possible crashes inside innerHTML.
+
+2009-03-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24285
+        Text resource loading checks for BOM twice
+
+        This removes TextDecoder class, since its only purpose was to check for BOM, which is
+        already done in TextResourceDecoder. Callers that use TextEncoding::decode() won't get
+        BOM checked, but I didn't find any cases where it would significantly change behavior.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        Remove TextDecoder.{h,cpp}.
+
+        * platform/text/TextDecoder.cpp: Removed.
+        * platform/text/TextDecoder.h: Removed.
+
+        * loader/TextResourceDecoder.h: Instead of a TextDecoder object, keep TextEncoding and
+        TextCodec separately.
+
+        * loader/TextResourceDecoder.cpp:
+        (WebCore::TextResourceDecoder::TextResourceDecoder): Updated for m_encoding being a member.
+        (WebCore::TextResourceDecoder::setEncoding): Ditto.
+        (WebCore::TextResourceDecoder::checkForBOM): Removed a FIXME saying that a BOM could override
+        even a user-chosen encoding - this is how it already worked due to TextDecoder checking for
+        BOM again. Made this function return the detected BOM length.
+        (WebCore::TextResourceDecoder::decode): Skip the BOM if it was found at the beginning of
+        a text resource.
+        (WebCore::TextResourceDecoder::flush): Reset m_checkedForBOM, so that re-decoding the same
+        resource again (as frequently done by CachedResource subclasses) will skip the BOM correctly.
+
+        * platform/text/TextEncoding.cpp: (WebCore::TextEncoding::decode):
+        Use TextCodec directly without a TextDecoder wrapper. This means that this method no longer
+        checks for BOM, which was a counter-intuitive feature.
+
+        * loader/CachedScript.cpp:
+        (WebCore::CachedScript::CachedScript):
+        (WebCore::CachedScript::setEncoding):
+        (WebCore::CachedScript::encoding):
+        (WebCore::CachedScript::script):
+        * loader/CachedScript.h:
+        * loader/appcache/ManifestParser.cpp:
+        (WebCore::parseManifest):
+        Use TextResourceDecoder, as TextEncoding::decode() no longer checks for BOM.
+        A side effect of this is that these resources will now be subject to encoding auto-detection.
+
+        * loader/CachedFont.cpp: (WebCore::CachedFont::ensureSVGFontData):
+        * page/Page.cpp: (WebCore::Page::userStyleSheet):
+        Be sure to flush TextResourceDecoder, pushing any remaining bytes out, and making the decoder
+        re-usable (for repeated decoding of the same resource).
+
+        * platform/text/TextEncodingRegistry.h: Updated comments for newTextCodec().
+
+2009-03-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24488
+        An assertion failure when updating an offline application cache after emptying caches
+
+        Emptying appcache cannot be performed automatically, so no test.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete): Ensure that the cache is in disk
+        storage, even if the application wasn't updated server side.
+
+2009-03-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        <rdar://problem/6425807> Implement WorkerUtils.importScripts()
+        <https://bugs.webkit.org/show_bug.cgi?id=22721>
+
+        Implement importScripts, currently uses a series of synchronous loads
+        to fetch the scripts, but this is simpler than a synchronous load of
+        multiple loads in parallel.  In future we'll want to switch to parallel
+        loading, but this will do for now.
+        
+        Test: http/tests/workers/worker-importScripts.html
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::importScripts):
+        * bindings/js/ScriptValue.h:
+        (WebCore::ScriptValue::hasNoValue):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        (WebCore::WorkerScriptController::setException):
+        * bindings/js/WorkerScriptController.h:
+        * dom/Document.cpp:
+        (WebCore::Document::scriptImported):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::scriptImported):
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::setScriptProperties):
+        * inspector/InspectorResource.h:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::scriptImported):
+        (WebCore::WorkerContext::importScripts):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+        * workers/WorkerImportScriptsClient.cpp: Added.
+        (WebCore::WorkerImportScriptsClient::didReceiveResponse):
+        (WebCore::WorkerImportScriptsClient::didReceiveData):
+        (WebCore::WorkerImportScriptsClient::didFinishLoading):
+        (WebCore::WorkerImportScriptsClient::didFail):
+        (WebCore::WorkerImportScriptsClient::didFailRedirectCheck):
+        (WebCore::WorkerImportScriptsClient::didReceiveAuthenticationCancellation):
+        * workers/WorkerImportScriptsClient.h: Added.
+        (WebCore::WorkerImportScriptsClient::WorkerImportScriptsClient):
+        (WebCore::WorkerImportScriptsClient::script):
+        (WebCore::WorkerImportScriptsClient::failed):
+
+2009-03-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24462
+        Move cross-origin access control code out of XMLHttpRequest
+
+        Step 1: move preflight result cache and access control helper functions.
+
+        No change in behavior, so no test.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * loader/CrossOriginAccessControl.cpp: Added.
+        (WebCore::isOnAccessControlSimpleRequestHeaderWhitelist):
+        (WebCore::isSimpleCrossOriginAccessRequest):
+        (WebCore::createAllowedCrossOriginResponseHeadersSet):
+        (WebCore::isOnAccessControlResponseHeaderWhitelist):
+        (WebCore::passesAccessControlCheck):
+        * loader/CrossOriginAccessControl.h: Added.
+        * loader/CrossOriginPreflightResultCache.cpp: Added.
+        (WebCore::parseAccessControlMaxAge):
+        (WebCore::addToAccessControlAllowList):
+        (WebCore::parseAccessControlAllowList):
+        (WebCore::CrossOriginPreflightResultCacheItem::parse):
+        (WebCore::CrossOriginPreflightResultCacheItem::allowsCrossOriginMethod):
+        (WebCore::CrossOriginPreflightResultCacheItem::allowsCrossOriginHeaders):
+        (WebCore::CrossOriginPreflightResultCacheItem::allowsRequest):
+        (WebCore::CrossOriginPreflightResultCache::shared):
+        (WebCore::CrossOriginPreflightResultCache::appendEntry):
+        (WebCore::CrossOriginPreflightResultCache::canSkipPreflight):
+        * loader/CrossOriginPreflightResultCache.h: Added.
+        (WebCore::CrossOriginPreflightResultCacheItem::CrossOriginPreflightResultCacheItem):
+        (WebCore::CrossOriginPreflightResultCache::CrossOriginPreflightResultCache):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequestStaticData::XMLHttpRequestStaticData):
+        (WebCore::XMLHttpRequest::createRequest):
+        (WebCore::XMLHttpRequest::makeCrossOriginAccessRequest):
+        (WebCore::XMLHttpRequest::makeSimpleCrossOriginAccessRequest):
+        (WebCore::XMLHttpRequest::makeCrossOriginAccessRequestWithPreflight):
+        (WebCore::XMLHttpRequest::didReceiveResponse):
+        (WebCore::XMLHttpRequest::didReceiveResponsePreflight):
+        * xml/XMLHttpRequest.h:
+
+2009-03-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19797
+        Bring the list of forbidden headers in sync with XMLHttpRequest spec draft
+
+        Added new checks to http/tests/xmlhttprequest/set-dangerous-headers.html.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequestStaticData::XMLHttpRequestStaticData): Added all headers from
+        XMLHttpRequest 2 draft.
+
+2009-03-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=23975
+          <rdar://problem/6593610> REGRESSION: Scrollbar arrow not repainted
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::invalidateScrollbarRect): Corrected the vertical
+        scrollbar rect calculation.
+
+2009-03-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein, Oliver Hunt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24475
+        
+        When repainting replaced elements, need to union the selection
+        and overflow rects because either may extend outside the other.
+        
+        Test: fast/repaint/transform-replaced-shadows.html
+
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
+
+2009-03-09  Stephanie Lewis  <slewis@apple.com>
+
+        Fix build.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::advanceToNextMisspelling):
+        (WebCore::markAllMisspellingsAndBadGrammarInRanges):
+
+2009-03-09  Kim Christensen  <kimworking@gmail.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24276
+        Dropdown / select boxes do not consider the windows task bar in Chromium.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::showPopup):
+
+2009-03-09  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adele Peterson and Dave Hyatt.
+
+        - fix <rdar://problem/6654344> REGRESSION (r41041): Zillow.com has
+          misaligned edit fields
+
+        Test: fast/forms/legend-display-none.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle): Change the display
+        property of legend elements to 'block' unless it is 'none'.
+        * css/html4.css: Do not force the display property of legend elements to
+        'block' using CSS, because that prevents style rules from setting it to
+        'none'.
+
+2009-03-09  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23024
+
+        Fix an incorrect criteria in the if statement that leaves references to
+        deleted floating objects in RenderBlock.
+
+        Test: fast/block/float/crash-on-absolute-positioning.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::markAllDescendantsWithFloatsForLayout):
+
+2009-03-09  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Eric Seidel.
+
+        Unify JSC/V8 idl file.
+        https://bugs.webkit.org/show_bug.cgi?id=24424
+
+        * page/Location.idl:
+
+2009-03-09  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Eric Seidel.
+
+        Unify JSC/V8 for History.idl.
+
+        * page/History.idl:
+
+2009-03-09  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Eric Seidel.
+
+        Unify JSC/V8 implementations of DOMWindow.idl.
+
+        * page/DOMWindow.idl:
+
+2009-03-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24163
+        
+        Implement mapping of FloatQuads through 3D transforms.
+        
+        Removed the redundant localToContainerQuad() methods, which can now 
+        shared code with the old mapLocalToAbsolutePoint(), which was
+        renamed to mapLocalToContainer(). This can now convert a point,
+        and optionally a FloatQuad, which are carried along in the TransformState.
+        
+        Optimized TransformState to reduce to simple FloatPoint.move()
+        if there are no transforms, and to heap-allocate a transform only if
+        necessary to accumulate transforms (when using preserve-3d).
+        
+        Tested by 3d point mapping tests, and the inspector highlight (which now shows
+        the correct quads for 3d-transformed elements).
+
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::projectQuad):
+        (WebCore::TransformationMatrix::translateRight):
+        (WebCore::TransformationMatrix::translateRight3d):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToContainer):
+        (WebCore::RenderBox::mapAbsoluteToLocalPoint):
+        * rendering/RenderBox.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::localToAbsolute):
+        (WebCore::RenderObject::absoluteToLocal):
+        (WebCore::RenderObject::mapLocalToContainer):
+        (WebCore::RenderObject::localToContainerQuad):
+        * rendering/RenderObject.h:
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::mapLocalToContainer):
+        * rendering/RenderTableCell.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::mapLocalToContainer):
+        * rendering/RenderView.h:
+        * rendering/TransformState.cpp:
+        (WebCore::TransformState::move):
+        (WebCore::TransformState::applyTransform):
+        (WebCore::TransformState::flatten):
+        (WebCore::TransformState::mappedPoint):
+        (WebCore::TransformState::mappedQuad):
+        (WebCore::TransformState::flattenWithTransform):
+        (WebCore::HitTestingTransformState::mappedQuad):
+        * rendering/TransformState.h:
+        (WebCore::TransformState::TransformState):
+        (WebCore::TransformState::move):
+        (WebCore::TransformState::lastPlanarPoint):
+        (WebCore::TransformState::lastPlanarQuad):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::preserves3D):
+
+2009-03-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24433
+        
+        During hit testing with transforms, if a layer has backface-visibility: hidden,
+        we need to check for it whether or not the layer has a transform, because it
+        might be an ancestor that is transformed.
+
+        Test: transforms/3d/hit-testing/backface-no-transform-hit-test.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestLayer):
+
+2009-03-09  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24353
+        Allow to overrule default build options for Qt build.
+
+        * WebCore.pro: Allow to overrule ENABLE_VIDEO and ENABLE_NETSCAPE_PLUGIN_API
+
+2009-03-09  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24463
+        WebCore::qstring is detaching and copying twice for every single
+        WebCore::TextRun that is processed and drawn.  This elevates this method
+        to one of the top-ten most expensive methods in all of QtWebKit according
+        to profiling.  This changes the method so that QString only detaches
+        when absolutely necessary.
+
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::qstring):
+        (WebCore::fixSpacing):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+
+2009-03-08  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Split ScrollAlignment and ScrollBehavior out of RenderLayer.h so that
+        Frame.h no longer needs to include it.  This cuts the size of the symbols
+        for a debug build by around 3%.
+
+        * dom/Element.cpp:
+        (WebCore::Element::scrollIntoView):
+        (WebCore::Element::scrollIntoViewIfNeeded):
+        * editing/Editor.cpp:
+        (WebCore::Editor::insertTextWithoutSendingTextEvent):
+        (WebCore::Editor::revealSelectionAfterEditingOperation):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setSelection):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::gotoAnchor):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/Frame.cpp:
+        (WebCore::Frame::revealSelection):
+        (WebCore::Frame::revealCaret):
+        * page/Frame.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::getRectToExpose):
+        (WebCore::RenderLayer::autoscroll):
+        * rendering/RenderLayer.h:
+        * rendering/ScrollBehavior.cpp: Added.
+        (WebCore::):
+        * rendering/ScrollBehavior.h: Added.
+        (WebCore::):
+        (WebCore::ScrollAlignment::getVisibleBehavior):
+        (WebCore::ScrollAlignment::getPartialBehavior):
+        (WebCore::ScrollAlignment::getHiddenBehavior):
+
+        Add the new files to the build systems:
+        * GNUmakefile.am:
+        * WebCore.base.exp:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+
+        Add includes that were previously pulled in by way of RenderLayer.h from Frame.h:
+        * dom/Clipboard.cpp:
+        * editing/EditorCommand.cpp:
+        * editing/InsertLineBreakCommand.cpp:
+        * editing/TypingCommand.cpp:
+        * html/HTMLFormControlElement.cpp:
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        * loader/icon/IconLoader.cpp:
+        * page/animation/AnimationController.cpp:
+        * rendering/RenderSlider.cpp:
+        * rendering/RenderTextControl.cpp:
+
+
+2009-03-08  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed Dan Bernstein.
+
+        Push the include of Frame.h out of RenderView.h and down to those files
+        that need it.  This cuts the size of symbols for RenderFoo object files
+        by around 15% in a debug build.
+
+        * bindings/objc/DOM.mm:
+        * rendering/RenderFileUploadControl.cpp:
+        * rendering/RenderInline.cpp:
+        * rendering/RenderObject.cpp:
+        * rendering/RenderReplaced.cpp:
+        * rendering/RenderText.cpp:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::zoomFactor):
+        * rendering/RenderView.h:
+
+2009-03-08  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Remove some unnecessary or redundant includes from files related to the JS bindings.
+        This cuts the size of the symbols for a debug build by around 3%.
+
+        * bindings/js/JSCustomPositionCallback.cpp:
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        * bindings/js/JSCustomVoidCallback.cpp:
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        * bindings/js/JSDocumentCustom.cpp:
+        * bindings/js/JSPluginElementFunctions.cpp:
+        * bindings/js/JSSVGPODTypeWrapper.h:
+
+2009-03-08  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Remove the unused methods previousHistoryItem(), setPreviousHistoryItem()
+        and provisionalHistoryItem() from FrameLoader.
+
+        * WebCore.base.exp:
+        * WebCore.order:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::frameLoadCompleted):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoader.h:
+
+2009-03-08  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Implement proper logging for the GTK+ port, inspired by the one in
+        Qt. We use the WEBKIT_DEBUG environment variable which was already
+        being used to decide whether to setup a logger for soup or not.
+
+        * platform/gtk/LoggingGtk.cpp:
+        (WebCore::getChannelFromName):
+        (WebCore::InitializeLoggingChannelsIfNecessary):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ensureSessionIsInitialized):
+
+2009-03-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - WebCore part of removing build-time and run-time support for legacy
+          versions of CFNetwork and Core Graphics
+
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/win/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        * platform/graphics/win/FontPlatformDataCGWin.cpp:
+        (WebCore::FontPlatformData::platformDataInit):
+        * platform/network/cf/FormDataStreamCFNet.cpp:
+        (WebCore::setHTTPBody):
+        (WebCore::httpBodyFromRequest):
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::didSendBodyData):
+        (WebCore::shouldUseCredentialStorageCallback):
+        (WebCore::ResourceHandle::start):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::filterCookies):
+
+2009-03-07  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=24444
+        No multiple JS property for <input type="file" multiple />
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::multiple):
+        (WebCore::HTMLInputElement::setMultiple):
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl:
+
+2009-03-07  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24358
+        [GTK] Scrollbars not clipped correctly
+
+        ScrollView scrollbars in subframes are *not* native, so take that
+        into account again.
+
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::getLocationInParentWindow):
+        (ScrollbarGtk::frameRectsChanged):
+        (ScrollbarGtk::paint):
+        * platform/gtk/ScrollbarGtk.h:
+
+2009-03-06  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24405
+        Horizontal scrolling on Windows was reversed from Mac (and intuition).
+
+        * platform/gtk/WheelEventGtk.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/win/WheelEventWin.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-03-06  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Sam Weinig.
+
+        Convert some C-style casts to static_cast<>()s.
+
+        * platform/gtk/WheelEventGtk.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/mac/WheelEventMac.mm:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/win/WheelEventWin.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/wx/MouseWheelEventWx.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-03-06  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for <rdar://problem/6607524> REGRESSION (Safari 3-4): I can't tab back to the URL field in an empty window (key loop is broken)
+
+        I haven't been able to make a test for this since the problem is not reproducible within an empty iframe.
+
+        * page/EventHandler.cpp: (WebCore::eventTargetNodeForDocument): We used to ensure that every html document had a body element.
+          That is no longer true, so we should return the document element for a truly empty document.
+
+2009-03-06  Jay Campan  <jcampan@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24306
+
+        Adding a flag to ResourceRequestBase to indicate whether or not upload
+        progress notifications are needed for a resource. This is useful to
+        avoid sending these notifications when there are no consumers
+        (especially in the Chromium case where IPC is involved). 
+
+        * platform/network/ResourceRequestBase.h:
+        (WebCore::ResourceRequestBase::reportUploadProgress):
+        (WebCore::ResourceRequestBase::setReportUploadProgress):
+        (WebCore::ResourceRequestBase::ResourceRequestBase):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
+
+2009-03-06  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24150
+        Add virtual ScriptExecutionContext::encoding()
+
+        Test: http/tests/workers/text-encoding.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::encoding):
+        * dom/Document.h:
+        (WebCore::Document::inputEncoding):
+        (WebCore::Document::charset):
+        (WebCore::Document::characterSet):
+        Add new virtual method and route DOM synonym functions on Document through it.
+
+        * dom/ScriptExecutionContext.h:
+        * workers/Worker.cpp:
+        (WebCore::Worker::Worker):
+        (WebCore::Worker::notifyFinished):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::WorkerContext):
+        (WebCore::WorkerContext::encoding):
+        (WebCore::WorkerContext::completeURL): Added comment on why this is different from Document::completeURL
+        * workers/WorkerContext.h:
+        (WebCore::WorkerContext::create):
+        * workers/WorkerContextProxy.h:
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::startWorkerContext):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThreadStartupData::create):
+        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
+        (WebCore::WorkerThread::create):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::workerThread):
+        * workers/WorkerThread.h:
+        All of the above route the 'encoding' parameter of parent context to the new
+        instance of WorkerContext - from Worker::notifyFinished() via WorkerMessagingProxy
+        through WorkerThread through WorkerThreadStartupData and into constructor of WorkerContext.
+
+2009-03-06  Peter Kasting  <pkasting@google.com>
+
+        Build bustage fix.
+
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchWheelEvent):
+
+2009-03-06  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTMovieView):  Delay callback while setting up movieview.
+
+2009-03-06  Douglas R. Davidson  <ddavidso@apple.com>
+
+        Reviewed by Justin Garcia.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24108
+
+        Update spelling and grammar checking to use the new combined text 
+        checking (with automatic language identification) on Snow Leopard. 
+        Tested manually in Mail and Safari; automated tests to come later. 
+        
+        * editing/Editor.cpp:
+        (WebCore::findFirstMisspellingOrBadGrammarInRange):
+        (WebCore::Editor::advanceToNextMisspelling):
+        (WebCore::guessesForMisspelledOrUngrammaticalRange):
+        (WebCore::Editor::guessesForMisspelledOrUngrammaticalSelection):
+        (WebCore::Editor::markMisspellingsAfterTypingToPosition):
+        (WebCore::markAllMisspellingsAndBadGrammarInRanges):
+        (WebCore::Editor::markMisspellingsAndBadGrammar):
+        * editing/Editor.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyEditorClient::checkSpellingAndGrammarOfParagraph):
+        * page/EditorClient.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::respondToChangedSelection):
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+
+2009-03-06  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24407
+        Windows scroll amount was too small, and wheel scroll distance
+        conversion code was overly complex.
+
+        * page/EventHandler.cpp:
+        (WebCore::scrollAndAcceptEvent):
+        * platform/PlatformWheelEvent.h:
+        (WebCore::):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/Scrollbar.h:
+        * platform/gtk/WheelEventGtk.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/mac/WheelEventMac.mm:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/qt/WheelEventQt.cpp:
+        * platform/win/WheelEventWin.cpp:
+        (WebCore::horizontalScrollChars):
+        (WebCore::verticalScrollLines):
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/wx/MouseWheelEventWx.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2009-03-06  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        Generate valid bindings with HTML5 database support disabled. 
+
+        * inspector/InspectorController.idl: Added feature guard around 
+        databaseTableNames definition.
+
+2009-03-04  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24358
+        [GTK] Scrollbars not clipped correctly
+
+        Do not take into account the case of being a ScrollView scrollbar,
+        since those are native in our case.
+
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::frameRectsChanged):
+
+2009-03-04  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24358
+        [GTK] Scrollbars not clipped correctly
+
+        Move Widget::paint to ScrollbarGtk::paint, since it's scrollbar
+        specific and it's our only Widget anyway.
+
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::paint):
+        * platform/gtk/ScrollbarGtk.h:
+        * platform/gtk/WidgetGtk.cpp:
+
+2009-03-04  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24358
+        [GTK] Scrollbars not clipped correctly
+
+        Use correct clip rectangle and apply coordinate translation needed
+        for non-ScrollView scrollbars.
+
+        We were ignoring the clip rectangle passed as parameter, which is
+        wrong in the case of non coalesced expose events. This, in turn,
+        uncovers the fact that we were not applying coordinate translation
+        to our position.
+
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::paint):
+
+2009-03-06  Eric Carlson  <eric.carlson@apple.com>
+
+        Build fix, no review
+
+        * platform/graphics/chromium/MediaPlayerPrivateChromium.h: fix setSize declaration
+
+2009-03-06  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22790
+        Bug 22790: [Transforms] MediaPlayer::setRect() makes no sense with transforms
+        Replace media engine setRect with setSize since they don't use about the 
+        position anyway.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::setSize): Changed from setRect.
+        (WebCore::MediaPlayer::setSize): Ditto.
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayer::size): Changed from rect().
+
+        * platform/graphics/MediaPlayerPrivate.h: Changed setRect to setSize.
+
+        * platform/graphics/chromium/MediaPlayerPrivateChromium.h: Ditto.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp: 
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Initialize m_size instead of m_rect
+        (WebCore::MediaPlayerPrivate::setSize): Changed from setRect
+        (WebCore::MediaPlayerPrivate::paint): update comment
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h: m_rect -> m_size.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:  m_rect
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate): Initialize m_rect.
+        (WebCore::MediaPlayerPrivate::createQTMovieView): setRect-> setSize.
+        (WebCore::MediaPlayerPrivate::setSize): Changed from setRect
+        (WebCore::MediaPlayerPrivate::paint): Call view:setFrame: when in a media document so 
+        the movie is drawn in the correct location.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::setSize):  Changed from setRect
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::setSize):  Changed from setRect
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::updatePlayer): Call setSize instead of setRect.
+
+2009-03-06  Darin Adler  <darin@apple.com>
+
+        Reviewed by Darin Fisher.
+
+        Bug 24422: REGRESSION: null-URL crash in FrameLoader setting location.hash on new window
+        https://bugs.webkit.org/show_bug.cgi?id=24422
+        rdar://problem/6402208
+
+        Test: fast/dom/location-new-window-no-crash.html
+
+        The issue here is empty (or null) URLs. I picked the "schedule navigation" bottleneck
+        to add some checks for empty URLs. We could also put the empty URL checks at some
+        other bottleneck level and add more assertions over time. I tried adding a few more
+        assertions to functions like loadURL and hit them while running the regression tests,
+        so it's probably going to be a bit tricky to clean this up throughout the loader.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::ScheduledRedirection::ScheduledRedirection): Explicitly marked this struct
+        immutable by making all its members const. Added assertions about the arguments,
+        including that the URL is not empty. Initialized one uninitialized member in one of
+        the constructors.
+        (WebCore::FrameLoader::scheduleHTTPRedirection): Added an early exit to make this
+        a no-op if passed an empty URL.
+        (WebCore::FrameLoader::scheduleLocationChange): Ditto.
+        (WebCore::FrameLoader::scheduleRefresh): Ditto.
+
+2009-03-06  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24423
+        Use new soup_message_body_set_accumulate API in soup backend
+
+        Disable accumulating chunks for request_body on file uploads,
+        using the new soup API.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startHttp):
+
+2009-03-06  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Replace use of deprecated SOUP_MESSAGE_OVERWRITE_CHUNKS flag with
+        the new soup_message_body_set_accumulate API in soup.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::gotHeadersCallback):
+        (WebCore::ResourceHandle::startHttp):
+
+2009-03-06  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24051
+        Soup backend needs content sniffing capabilities
+
+        Perform content sniffing when using soup, so that we have a chance
+        of figuring out the Content-Type of the file if it's not sent by
+        the server.
+
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::gotHeadersCallback):
+        (WebCore::gotChunkCallback):
+
+2009-03-06  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24342
+        Cannot insert a Thai character after a Thai prepend character when using ICU 4.0
+
+        This change creates a new break iterator "cursorMovementIterator" for
+        moving cursors and use it when moving an input cursor.
+        In "TextBreakIteratorICU.cpp", this break iterator uses custom ruleset
+        based on the one of ICU 3.8.
+        On the other hand, in "TextBreakIteratorQt.cpp", this break iterator
+        just calls the characterBreakIterator() function.
+
+        Test: editing/inserting/insert-thai-characters-001.html
+
+        * platform/text/TextBreakIterator.h: Added a new function cursorMovementIterator().
+        * platform/text/TextBreakIteratorICU.cpp: Implemented the cursorMovementIterator() function for ICU.
+        (WebCore::setUpIteratorWithRules): Ditto.
+        (WebCore::cursorMovementIterator): Ditto.
+        * platform/text/qt/TextBreakIteratorQt.cpp: Implemented the cursorMovementIterator() function for Qt.
+        (WebCore::cursorMovementIterator): Ditto.
+        * rendering/RenderText.cpp: Call the cursorMovementIterator() function when moving an input cursor.
+        (WebCore::RenderText::previousOffset): Ditto.
+        (WebCore::RenderText::nextOffset): Ditto.
+
+2009-03-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6621701> Safari 4 Beta Breaks XMLHttpRequest Response Text With Special
+        Characters (a compatibility issue with widgets).
+
+        Test: http/tests/xmlhttprequest/broken-xml-encoding.html
+
+        Revert part of an Acid 3 fix - now we are no longer strict when decoding XMLHttpRequest XML
+        responses.
+
+        * loader/TextResourceDecoder.cpp:
+        (WebCore::TextResourceDecoder::TextResourceDecoder):
+        (WebCore::TextResourceDecoder::decode):
+        (WebCore::TextResourceDecoder::flush):
+        * loader/TextResourceDecoder.h:
+        (WebCore::TextResourceDecoder::useLenientXMLDecoding):
+        Don't stop on XML decoding errors if useLenientXMLDecoding() was called.
+
+        * xml/XMLHttpRequest.cpp: (WebCore::XMLHttpRequest::didReceiveData): Don't stop on XML
+        decoding errors. This behavior is now limited to other kinds of XML content.
+
+2009-03-05  Simone Fiorentino  <simone.fiorentino@consulenti.fastweb.it>
+
+        Bug 24382: request to add SH4 platform
+
+        <https://bugs.webkit.org/show_bug.cgi?id=24382>
+
+        Reviewed by David Kilzer.
+
+        * platform/text/AtomicString.cpp:
+        (WebCore::equal): Aligned memory access on SH4 platform.
+
+2009-03-05  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=24215
+
+        Gears expects an object tag with display:none to instantiate the plugin,
+        so we add a workaround to make this work and fix Gears on WebKit trunk.
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::rendererIsNeeded):
+
+2009-03-05  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Need to have Chromium Mac match Safari Mac's accesskey handling
+        https://bugs.webkit.org/show_bug.cgi?id=24404
+
+        * page/chromium/EventHandlerChromium.cpp:
+        (WebCore::EventHandler::accessKeyModifiers): Share access key modifiers with Mac Safari when building for the Mac.
+
+2009-03-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24412
+        
+        Fix crash when hit-testing elements with -webkit-transform-style: preserve-3d
+        but no transform. We need to make localTransformState if we see preserve-3d.
+        Also need to call update3DTransformedDescendantStatus() before we test
+        m_has3DTransformedDescendant.
+
+        Test: transforms/3d/hit-testing/hit-preserves-3d.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestLayer):
+
+2009-03-05  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Changes to RenderLayer destruction to hopefully help catch an elusive crasher
+        https://bugs.webkit.org/show_bug.cgi?id=24409
+        
+        Added a new RenderBoxModelObject::destroyLayer() call which is
+        now the only way which RenderLayers should ever be destroyed.
+        This ensures that the pointer to the layer is cleared in the
+        RenderObject after destruction, allowing us to ASSERT in the
+        RenderBoxModelObject destructor.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::~RenderBoxModelObject):
+        (WebCore::RenderBoxModelObject::destroyLayer):
+        (WebCore::RenderBoxModelObject::destroy):
+        (WebCore::RenderBoxModelObject::styleDidChange):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::stackingContext):
+        (WebCore::RenderLayer::destroy):
+        (WebCore::RenderLayer::removeOnlyThisLayer):
+        * rendering/RenderLayer.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy):
+
+2009-03-05  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Remove old, unused IE 5.5 scrollbar-* CSS properties.
+        Sort the unimplemented getComputedStyle properties so it's
+        easier to see which ones actually need implementation.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+
+2009-03-05  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        WebViewDidChangeSelectionNotifications weren't being sent for commands that change the selection's position
+        within the document without changing its position in the DOM.  For example, pressing return in (caret marked by ^):
+        <div contentEditable="true"><div>^Hello</div></div>
+        Undo was being enabled, shouldDeleteDOMRange called, etc. when doing no-op deletes (a delete in an empty document 
+        for example). 
+
+        Changes to layout tests demonstrate fix.
+        
+        * editing/EditCommand.cpp:
+        (WebCore::EditCommand::apply): Don't call applyEditing for a TypingCommand.  The TypingCommand knows whether or
+        not it did work that needs to be applied.
+        * editing/Editor.cpp:
+        (WebCore::Editor::appliedEditing): Moved code (but did not alter) to changeSelectionAfterCommand.
+        (WebCore::Editor::unappliedEditing): Ditto.
+        (WebCore::Editor::reappliedEditing): Ditto.
+        (WebCore::Editor::changeSelectionAfterCommand): Moved code from *appliedEditing into here.  Also call out to
+        EditorClient::respondToChangedSelection() for commands that changed the selection's position in the document
+        even if they did not change it's position in the DOM.  Any TypingCommand that gets this far changed it's position
+        in the document.
+        * editing/Editor.h:
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::TypingCommand): Removed unused m_appliedEditing.
+        (WebCore::TypingCommand::typingAddedToOpenCommand): Always apply editing.  We won't get this far if we don't need to.
+        (WebCore::TypingCommand::deleteKeyPressed): Don't do any of the things that only make sense for Range selections, like
+        adding to the killring and responding to a change in selections if the delete was a no-op.
+        (WebCore::TypingCommand::forwardDeleteKeyPressed): Ditto.
+        * editing/TypingCommand.h:
+
+2009-03-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        Eliminate a ref-counting leak in InspectorController.
+
+        * inspector/InspectorController.h: Made constructor private, added static create method.
+        * page/Page.cpp:
+        (WebCore::Page::Page): Change initializer to use static create method.
+
+2009-03-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24355
+        Add InspectorController.idl and convert InspectorController.cpp to use
+        JSC bindings.
+
+        * DerivedSources.make: Added InspectorController.idl
+        * WebCore.xcodeproj/project.pbxproj: Added idl, bindings files.
+        * bindings/js/JSInspectorControllerCustom.cpp: Added.
+        * bindings/scripts/CodeGeneratorJS.pm: Added Array to no-header types.
+        * inspector/InspectorController.cpp: Removed hand-rolled bindings.
+        * inspector/InspectorController.h: Added platform and addSourceToFrame methods.
+        * inspector/InspectorController.idl: Added.
+        * page/Page.h: Changed member to RefPtr since InspectorController is now ref-counted.
+
+2009-03-05  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24400
+        Bug 24400: Remove "start", "end", "loopStart", "loopEnd", "currentLoop", and "playCount" 
+        media element attributes
+
+        Test: media/video-loop.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement):
+        (WebCore::HTMLMediaElement::loadInternal):
+        (WebCore::HTMLMediaElement::setNetworkState):
+        (WebCore::HTMLMediaElement::seek):
+        (WebCore::HTMLMediaElement::playInternal):
+        (WebCore::HTMLMediaElement::loop):
+        (WebCore::HTMLMediaElement::setLoop):
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged):
+        (WebCore::HTMLMediaElement::endedPlayback):
+        (WebCore::HTMLMediaElement::updatePlayState):
+        * html/HTMLMediaElement.h:
+        * html/HTMLMediaElement.idl:
+
+2009-03-05  Steve Falkenburg  <sfalken@apple.com>
+
+        <rdar://problem/6651112> Safari asks about re-posting a form even when page is cached
+        
+        Reviewed by Ada Chan.
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::ResourceHandle::willLoadFromCache): Ported from Mac version.
+
+2009-03-05  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Seidel
+
+        https://bugs.webkit.org/show_bug.cgi?id=24248
+
+        Make sure painting of overflow controls checks that visibility:visible is set on the block before
+        painting.  Pixel tests caught this regression.
+
+        Make sure resizer painting pushes a clip of the corner rect.  It was relying on the clip layers happened
+        to do to their bounds (which had nothing to do with overflow).
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paint):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintResizer):
+
+2009-03-05  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24386
+        A faster implementation of extractMIMETypeFromMediaType.
+
+        * platform/network/HTTPParsers.cpp:
+        (WebCore::extractMIMETypeFromMediaType):
+
+2009-03-05  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Antti Koivisto.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24392
+        Do not get the current time for unless we're doing PRELOAD_DEBUG as this
+        can be unnecessarily expensive.
+
+        * html/PreloadScanner.cpp:
+        (WebCore::PreloadScanner::write):
+
+2009-03-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24327
+        
+        When mapping points and hit testing through transforms, work
+        correctly when acclerated animations of transforms are running.
+        
+        Tested by LayoutTests/animations/animation-hit-test-transform.html,
+        which only failed when ACCELERATED_COMPOSITING was turned on.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::currentTransform):
+        * rendering/RenderLayer.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::transformFromContainer):
+
+2009-03-05  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24391
+        Frame.cpp uses JSC specific includes
+
+        * page/Frame.cpp:
+
+2009-03-05  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24389
+        WebKitGTK+ crashes when cancelling plugin loads
+
+        Remove bogus calls to the client's didFinishLoading method from
+        our ResourceHandle::cancel implementation. Calling
+        didFinishLoading here is mostly inoffensive for most loads, but
+        causes crashes when plugin loads are cancelled.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::cancel):
+
+2009-03-05  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+        
+        * WebCore.vcproj/QTMovieWin.vcproj:
+
+2009-03-05  Adam Treat  <adam.treat@torchmobile.com>
+
+        Build fix for when ENABLE_NETSCAPE_PLUGIN_API = 0.  The method
+        ScriptController::jsObjectForPluginElement(HTMLPlugInElement*); is not
+        protected by an #if and uses HTMLPlugInElement so it must be included.
+
+        * bindings/js/ScriptController.cpp:
+
+2009-03-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        GTK Build fix.
+
+        * inspector/ConsoleMessage.h: Use proper header.
+
+2009-03-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24376
+        Split InspectorController.cpp file into separate classes.
+
+        * GNUmakefile.am: Modified to include new files.
+        * WebCore.pro: Ditto.
+        * WebCore.scons: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+        * inspector/ConsoleMessage.cpp: Added.
+        * inspector/ConsoleMessage.h: Added.
+        * inspector/InspectorController.cpp:
+        * inspector/InspectorDOMStorageResource.cpp: Added.
+        * inspector/InspectorDOMStorageResource.h: Added.
+        * inspector/InspectorDatabaseResource.cpp: Added.
+        * inspector/InspectorDatabaseResource.h: Added.
+        * inspector/InspectorResource.cpp: Added.
+        * inspector/InspectorResource.h: Added.
+
+2009-03-05  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=24387
+        Remove media element bufferingRate attribute. No test necessary as there
+        were none for this attribute.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Don't initialize m_bufferingRate.
+        (WebCore::HTMLMediaElement::loadInternal): Ditto.
+        (WebCore::HTMLMediaElement::setNetworkState): Ditto.
+        (WebCore::HTMLMediaElement::progressEventTimerFired): Don't calculate m_bufferingRate.
+        * html/HTMLMediaElement.h: Remove m_bufferingRate.
+        * html/HTMLMediaElement.idl: Ditto.
+
+2009-03-05  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24377
+        [GTK] Comply better with coding style guidelines in ResourceHandleSoup
+
+        Use C++ booleans, 0 instead of NULL, prefix boolean variables with
+        'is', do not use 'else if' if the previous if had a return, delete
+        trailing whitespace, etc.
+
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader):
+        (WebCore::fillResponseFromMessage):
+        (WebCore::restartedCallback):
+        (WebCore::finishedCallback):
+        (WebCore::parseDataUrl):
+        (WebCore::ensureSessionIsInitialized):
+        (WebCore::ResourceHandle::startHttp):
+        (WebCore::reportUnknownProtocolError):
+        (WebCore::ResourceHandle::start):
+        (WebCore::cleanupGioOperation):
+        (WebCore::closeCallback):
+        (WebCore::readCallback):
+        (WebCore::openCallback):
+        (WebCore::queryInfoCallback):
+        (WebCore::ResourceHandle::startGio):
+
+2009-03-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel
+
+        https://bugs.webkit.org/show_bug.cgi?id=24328
+        
+        If an element has backface-visibility: hidden, hit testing should not
+        hit the back sides of elements. Test for that by inverting the accumulated
+        transform and looking at the z vector.
+
+        Tested by transforms/3d/hit-testing/backface-hit-test.html
+        
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestLayer):
+
+2009-03-04  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        r41362 mistakenly added functions "RenderThemeWin::" into
+        RenderThemeChromiumGtk.cpp. When correcting this, I somehow changed
+        them to void return types. This patch switches them back to ints.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24360
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::RenderThemeChromiumLinux::buttonInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumLinux::buttonInternalPaddingRight):
+        (WebCore::RenderThemeChromiumLinux::buttonInternalPaddingTop):
+        (WebCore::RenderThemeChromiumLinux::buttonInternalPaddingBottom):
+
+2009-03-04  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Chromium Linux: change some metrics to better match Windows after
+        r41416. Aesthetically this may be worse, but web-compat is king.
+
+        Also, the previous code had an off by one error when drawing
+        scrollbars which caused the scrollbar to overflow it's bounds by 1px
+        at the right and bottom edges.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24369
+
+        * rendering/RenderThemeChromiumLinux.cpp:
+        (WebCore::):
+        (WebCore::RenderThemeChromiumLinux::systemFont):
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromium::paintTrackPiece):
+
+2009-03-04  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Add an ASSERT to better demonstrate the cause of the crash in
+        https://bugs.webkit.org/show_bug.cgi?id=23736
+
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::~DocLoader):
+
+2009-03-04  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 24337: Assert when doing sync XHR in a worker for a cacheable response.
+        <https://bugs.webkit.org/show_bug.cgi?id=24337>
+
+        Tests: http/tests/xmlhttprequest/access-control-basic-denied-preflight-cache.html
+               http/tests/xmlhttprequest/workers/xmlhttprequest-file-not-found.html
+
+        * loader/mac/ResourceLoaderMac.mm:
+        (WebCore::ResourceLoader::willCacheResponse):
+        An identifier is only asssigned if resource load callbacks are done.  So don't send
+        willCacheResponse which uses identifier if resource load callbacks aren't being sent.
+
+2009-03-04  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 24330: Sync xhr in workers should send an abort exception when the worker is terminated.
+        <https://bugs.webkit.org/show_bug.cgi?id=24330>
+
+        Test: http/tests/xmlhttprequest/workers/abort-exception-assert.html
+
+        * dom/ExceptionCode.cpp:
+        (WebCore::xmlHttpRequestExceptionNames):
+        Added missing ABORT_ERR whose absence caused an assert.
+
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::loadResourceSynchronously):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::cancel):
+        Add more logic to handle the termination case for sync xhr.
+
+2009-03-04  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24364
+        Add support for HTMLMediaElement canPlayType method. Make
+        MediaPlayer::supportsType take a ContentType instead of a
+        separate mime type and codecs parameter.
+
+        Test: media/video-can-play-type.html
+
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::canPlayType): Add canPlayType method.
+        (WebCore::HTMLMediaElement::loadInternal): selectMediaURL returns a ContentType.
+        (WebCore::HTMLMediaElement::selectMediaURL): Return a ContentType instead of raw MIME type.
+        (WebCore::HTMLMediaElement::initialURL): selectMediaURL returns a ContentType.
+        * html/HTMLMediaElement.h: Add prototype.
+        * html/HTMLMediaElement.idl: Ditto.
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::load): Take a ContentType instead of raw MIME type.
+        (WebCore::MediaPlayer::supportsType): Ditto.
+        * platform/graphics/MediaPlayer.h:
+
+2009-03-04  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24359
+        Repaint throttling mechanism
+        
+        Excessive repainting can slow down page loadind. This implements a timer
+        based throttling mechanism. It is behind ENABLE(REPAINT_THROTTLING) and not 
+        enabled by default.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkCompleted):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dispatchDragEvent):
+        (WebCore::EventHandler::dispatchMouseEvent):
+        (WebCore::EventHandler::keyEvent):
+        (WebCore::EventHandler::handleTextInputEvent):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::reset):
+        (WebCore::FrameView::repaintContentRectangle):
+        (WebCore::FrameView::beginDeferredRepaints):
+        (WebCore::FrameView::endDeferredRepaints):
+        (WebCore::FrameView::checkStopDelayingDeferredRepaints):
+        (WebCore::FrameView::doDeferredRepaints):
+        (WebCore::FrameView::updateDeferredRepaintDelay):
+        (WebCore::FrameView::resetDeferredRepaintDelay):
+        (WebCore::FrameView::adjustedDeferredRepaintDelay):
+        (WebCore::FrameView::deferredRepaintTimerFired):
+        (WebCore::FrameView::paintContents):
+        * page/FrameView.h:
+
+2009-03-04  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Antti Koivisto.
+
+        Remove LOW_BANDWIDTH_DISPLAY as it is not being used by any platforms.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
+        (WebCore::Document::haveStylesheetsLoaded):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler):
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestResource):
+        * loader/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::checkNotify):
+        * loader/DocLoader.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::requestFrame):
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::begin):
+        (WebCore::FrameLoader::write):
+        (WebCore::FrameLoader::endIfNotLoadingMainResource):
+        (WebCore::FrameLoader::checkCompleted):
+        (WebCore::FrameLoader::requestObject):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoader.h:
+
+2009-03-02  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24287
+        [GTK] Move auth dialog feature to WebKit/
+
+        Remove WebKitSoupAuthDialog files from build and stop using it.
+
+        * GNUmakefile.am:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ensureSessionIsInitialized):
+        * platform/network/soup/webkit-soup-auth-dialog.c: Removed.
+        * platform/network/soup/webkit-soup-auth-dialog.h: Removed.
+
+2009-03-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24361
+        
+        Reinstate code that sets result.innerNode when hitTest() returns true,
+        but never filled in the innerNode. Fixes hit testing of generated content.
+
+        Test: fast/css-generated-content/hit-test-generated-content.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestContents):
+
+2009-03-04  Adam Barth  <abath@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24356
+
+        Fix WebKit style for allowUniversalAccessFromFileURLs.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setAllowUniversalAccessFromFileURLs):
+        * page/Settings.h:
+        (WebCore::Settings::allowUniversalAccessFromFileURLs):
+
+2009-03-04  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/6619630> Quick Look of vCards stuck on image of first card opened.
+
+        I narrowed this down to http://trac.webkit.org/changeset/39304 which, among other things,
+        consolidated some of the various decision making pieces of the Cache into the new method
+        FrameLoader::cachePolicy().
+
+        Before 39304, when deciding whether to use an existing CachedResource, we checked if the FrameLoader 
+        is reloading.  If it is, we'd evict any existing resource then recreate it.  Quick looks uses the
+        same URL for this image every time and expects it to be reloaded with each new card.
+
+        The FrameLoader::isReloading() check did one thing - Ask the DocumentLoader if it's cache policy
+        is "ReloadIgnoringCacheData".  This check was lost in the consolidation to the new method.  
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::cachePolicy): Restore the DocumentLoader's cachePolicy check as a possible
+          condition for returning CachePolicyReload.
+
+2009-03-04  Timothy Hatcher  <timothy@apple.com>
+
+        * English.lproj/localizedStrings.js: Update strings to include "DATABASES",
+        "LOCAL STORAGE" and "SESSION STORAGE".
+
+2009-03-04  Timothy Hatcher  <timothy@apple.com>
+
+        Fix a regression where the Web Inspector console would not animate
+        in or out correctly.
+
+        Reviewed by Anders Carlsson.
+
+        * inspector/front-end/inspector.css: Move a z-index to a child element
+        to get the correct stacking order during the animation.
+
+2009-03-03  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=24201, pathologically bad block layout.
+
+        Make sure to factor clear deltas into y position estimates.  Also avoid doing the comparison of
+        the final position against the y position estimate until after the clear has happened.  This gets rid
+        of some duplicated cut/pasted code and also ensures a layout delta only has to be put in once.
+
+        Reviewed by Dan Bernstein
+
+        Added fast/block/float/nested-clearance.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::clearFloatsIfNeeded):
+        (WebCore::RenderBlock::estimateVerticalPosition):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::getClearDelta):
+        * rendering/RenderBlock.h:
+
+2009-03-02  Kim Grönholm  <kim.gronholm@nomovok.com>
+
+        Reviewed by Simon Hausmann.
+
+        Improvement to 3d transformations rendering in QtWebKit. QTransform is used
+        instead of QMatrix. This allows perspective transformations since QTransform is
+        a true 3x3 matrix.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp: Use QTransform instead of QMatrix everywhere.
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::restorePlatformState):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::translate):
+        (WebCore::GraphicsContext::rotate):
+        (WebCore::GraphicsContext::scale):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::translate):
+        (WebCore::Path::transform):
+        * platform/graphics/qt/PatternQt.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+        * platform/graphics/qt/TransformationMatrixQt.cpp:
+        (WebCore::TransformationMatrix::operator QTransform): Replace the conversion operator
+        to QMatrix with one to QTransform.
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * platform/graphics/qt/FontQt.cpp:
+
+2009-02-24  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24151
+        Fix Qt/S60 build break
+
+        * platform/FileSystem.h: Create a default case for non-win and non-mac Qt builds
+        * platform/qt/FileSystemQt.cpp: Ditto
+        (WebCore::unloadModule):
+
+2009-03-03  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21939
+        Uninitialized ExceptionCode in DOMWindow::postMessage
+
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::postMessage):
+
+2009-03-03  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6581203> WebCore and WebKit should install the same set of headers during installhdrs phase as build phase
+
+        Reviewed by Mark Rowe.
+
+        The fix is to add INSTALLHDRS_COPY_PHASE = YES and
+        INSTALLHDRS_SCRIPT_PHASE = YES to WebCore.xcconfig, then to make
+        sure various build phase scripts work with the installhdrs build
+        phase.
+
+        * Configurations/Base.xcconfig: Defined REAL_PLATFORM_NAME
+        based on PLATFORM_NAME to work around the missing definition on
+        Tiger.
+        * Configurations/WebCore.xcconfig: Added
+        JAVASCRIPTCORE_PRIVATE_HEADERS_DIR variable to simplify logic in
+        the "Generate Derived Sources" script.  Added
+        INSTALLHDRS_COPY_PHASE = YES and INSTALLHDRS_SCRIPT_PHASE = YES.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        - Added shell code to prevent running "Check For Global
+          Initializers", "Check For Exit Time Destructors" and "Check
+          For Weak VTables" scripts during the installhdrs build phase.
+        - Made "Generate Derived Sources" work for the installhdrs build
+          phase.  Also simplified setting of CREATE_HASH_TABLE by using
+          JAVASCRIPTCORE_PRIVATE_HEADERS_DIR.
+
+2009-03-02  Adam Langley  <agl@google.com>
+
+        Reviewed by Darin Fisher.
+
+        Chromium Linux: Switch to using Skia to render widgets.
+
+        In order to sandbox the Chromium renderer on Linux we need to remove
+        the X connection. GTK cannot render without an X connection so, for
+        now, we render widgets ourselves.
+
+        Previously didn't use anti-alias fonts in order to match Windows font
+        rendering exactly. This was helpful when bootstrapping our layout
+        tests. Now, however, we are ready to enable it.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24244
+
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        (WebCore::ScrollbarThemeChromium::buttonSize):
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromium::scrollbarThickness):
+        (WebCore::ScrollbarThemeChromium::paintTrackPiece):
+        (WebCore::ScrollbarThemeChromium::paintButton):
+        (WebCore::ScrollbarThemeChromium::paintThumb):
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::setupPaint):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::PlatformContextSkia):
+        (PlatformContextSkia::~PlatformContextSkia):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        * rendering/RenderThemeChromiumGtk.cpp: Removed.
+        * rendering/RenderThemeChromiumGtk.h: Removed.
+        * rendering/RenderThemeChromiumLinux.cpp: Added.
+        * rendering/RenderThemeChromiumLinux.h: Added.
+
+2009-03-03  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24261
+        Fix return types.
+
+        Test: LayoutTests/dom/svg/level3/xpath/XPathEvaluator_evaluate_TYPE_ERR.svg
+
+        * bindings/v8/V8Binding.h:
+        (WebCore::toInt32): change return type to int
+        (WebCore::toFloat): change return type to float.
+
+2009-03-03  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by John Sullivan.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22884
+        <rdar://problem/6449783>
+        modified layout test crashes Safari
+
+        Null check NPStream before dereferencing it.
+        
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::destroyStream):
+
+2009-03-03  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Fix for <rdar://problem/6641045>
+        Don't call QTKit to get movie properties until movie metadata has been loaded.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        (WebCore::MediaPlayerPrivate::metaDataAvailable): defined
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::createQTTime): return default if !metaDataAvailable.
+        (WebCore::MediaPlayerPrivate::play): Ditto.
+        (WebCore::MediaPlayerPrivate::pause): Ditto.
+        (WebCore::MediaPlayerPrivate::duration): Ditto.
+        (WebCore::MediaPlayerPrivate::currentTime): Ditto.
+        (WebCore::MediaPlayerPrivate::seek): Ditto.
+        (WebCore::MediaPlayerPrivate::seekTimerFired): Ditto.
+        (WebCore::MediaPlayerPrivate::paused): Ditto.
+        (WebCore::MediaPlayerPrivate::seeking): Ditto.
+        (WebCore::MediaPlayerPrivate::naturalSize): Ditto.
+        (WebCore::MediaPlayerPrivate::hasVideo): Ditto.
+        (WebCore::MediaPlayerPrivate::setVolume): Ditto.
+        (WebCore::MediaPlayerPrivate::setRate): Ditto.
+        (WebCore::MediaPlayerPrivate::dataRate): Ditto.
+        (WebCore::MediaPlayerPrivate::maxTimeLoaded): Ditto.
+        (WebCore::MediaPlayerPrivate::totalBytes): Ditto.
+
+2009-03-03  Kevin McCullough  <kmccullough@apple.com>
+
+        - Spelling fix.
+
+        * page/Console.cpp:
+        (WebCore::Console::profile):
+
+2009-03-03  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23657
+        Remove Database API callback IDLs from the project. 
+        They were removed in r40633.
+
+        * WebCore.xcodeproj/project.pbxproj: Removed IDL files from the project.
+
+2009-03-03  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6639110> console.profile() doesn't work without a title
+
+        * page/Console.cpp:
+        (WebCore::Console::profile): If there is no title assume this is a user
+        initiated profile and give it the next incremented title name.
+
+2009-03-03  Timothy Hatcher  <timothy@apple.com>
+
+        Fix a regression that broke dirxml and caused an ASSERT in debug builds. Also simplified
+        the console code and refactored things to have fewer code paths and duplication.
+
+        rdar://problem/6367127
+        https://bugs.webkit.org/show_bug.cgi?id=24329
+
+        Reviewed by Kevin McCullough.
+
+        Test: manual-tests/inspector/console-dir.html
+
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::wrap): Use the lexicalGlobalObject instead of dynamicGlobalObject
+        to fix an ASSERT about using a wrapper from the wrong ExecState.
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper): Ditto.
+        (WebCore::JSQuarantinedObjectWrapper::allowsUnwrappedAccessFrom): Ditto.
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._format): Remove the inline argument and add forceObjectFormat.
+        When forceObjectFormat is true, the only formatter used is _formatobject.
+        (WebInspector.Console.prototype._formatvalue): Remove the inline argument.
+        (WebInspector.Console.prototype._formatstring): Ditto.
+        (WebInspector.Console.prototype._formatregexp): Ditto.
+        (WebInspector.Console.prototype._formatarray): Ditto.
+        (WebInspector.Console.prototype._formatnode): Remove the inline argument and make a DOM tree instead of an anchor.
+        (WebInspector.Console.prototype._formatobject): Remove the inline argument and always make a property graph.
+        (WebInspector.Console.prototype._formaterror): Remove the inline argument.
+        (WebInspector.ConsoleMessage): Remove the case for MessageLevel.Node and
+        simplify the case for MessageLevel.Object to use the normal _format code path with the %O formatter.
+        (WebInspector.ConsoleMessage.prototype._format.formatForConsole): Don't pass an additional true argument for inline.
+        (WebInspector.ConsoleMessage.prototype._format.formatAsObjectForConsole): Added. Pass a true argument for forceObjectFormat.
+        (WebInspector.ConsoleMessage.prototype._format): Added support for the %O formatter. Use formatForConsole for all arguments.
+        (WebInspector.ConsoleMessage.prototype.toString): Add the other message levels.
+        * inspector/front-end/inspector.css: Tweak styles to look and work correctly.
+        * inspector/front-end/utilities.js:
+        (Object.type): Return "node" for Node objects.
+        (Object.describe): Handle the "node" type.
+        * page/Console.cpp:
+        (WebCore::printMessageSourceAndLevelPrefix): Fix an assert by adding the other message level types.
+        (WebCore::Console::dirxml): Use the standard log fuction since it prints a DOM tree for nodes by default.
+        * page/Console.h:
+        (WebCore::enum MessageLevel): Removed NodeMessageLevel. Added a FIXME.
+
+2009-03-03  Scott Violet  <sky@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24325
+        Crash on replacing document contents during drop.
+
+        Makes sure a node is in the document during a move before using it.
+
+        Test: fast/events/crash-on-mutate-during-drop.html
+
+        * editing/MoveSelectionCommand.cpp:
+        (WebCore::MoveSelectionCommand::doApply):
+
+2009-03-03  Jungshik Shin <jshin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23028
+        Enable dynamic web font support to Chromium on Windows.
+        Files that were omitted by mistake in the latest patch
+        that was landed.
+
+        * loader/CachedFont.cpp:
+        (WebCore::CachedFont::~CachedFont):
+        (WebCore::CachedFont::ensureCustomFontData):
+        (WebCore::CachedFont::platformDataFromCustomData):
+        (WebCore::CachedFont::allClientsRemoved):
+        * platform/graphics/chromium/FontCustomPlatformData.cpp:
+        (WebCore::EOTStream::EOTStream):
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/win/FontCustomPlatformData.cpp:
+        (WebCore::EOTStream::EOTStream):
+        (WebCore::createFontCustomPlatformData):
+
+2009-03-03  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16826
+        [Gtk] Implement WebKitDownload
+
+        Make the Soup backend able to handle requests without a frame,
+        since we may have such things now that we support downloads.
+
+        * platform/network/ResourceHandleInternal.h:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::start):
+
+2009-03-03  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24331
+        Add custom V8 bindings for Element, Attr, HTMLFrame, and HTMLIFrame.
+
+        * bindings/v8/custom/V8AttrCustom.cpp: Added.
+        * bindings/v8/custom/V8CustomBinding.cpp: Added.
+        * bindings/v8/custom/V8CustomBinding.h: Added attribute-checking helpers.
+        * bindings/v8/custom/V8ElementCustom.cpp: Added.
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp: Added.
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp: Added.
+
+2009-03-03  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/6616664> - Quick looks of various file types is broken
+
+        In http://trac.webkit.org/changeset/40553 there was an attempt to prevent NSURLRequest churn
+        for non-HTTP loads when the underlying ResourceRequest changed.  Unfortunately it was a little
+        overzealous as the mainDocumentURL is relevant for all loads, not only HTTP/HTTPS loads.
+
+        Partially reverted behavior to always set the mainDocumentURL in situations when we would've
+        before that patch.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::addExtraFieldsToRequest):
+
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::setMainDocumentURL):
+
+2009-03-03  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24256
+
+        Added a WebCoreForceSoftwareAnimation flag.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::forceSoftwareAnimation):
+        (WebCore::GraphicsLayerCA::setOpacity):
+        (WebCore::GraphicsLayerCA::animateTransform):
+        (WebCore::GraphicsLayerCA::animateFloat):
+
+2009-03-02  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24257
+
+        Added prototype properties for several classes with constructors that
+        were missing them, including the one mentioned in the bug.
+
+        Test: fast/dom/Window/custom-constructors.html
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (jsDOMWindowBaseWebKitCSSMatrix):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor):
+        * bindings/js/JSWebKitCSSMatrixConstructor.h:
+        * bindings/js/JSWebKitPointConstructor.cpp:
+        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor):
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::JSWorkerConstructor::JSWorkerConstructor):
+
+2009-03-03  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24321
+        Add V8 bindings headers.
+
+        * bindings/v8/V8Binding.h: Added.
+        * bindings/v8/V8Proxy.h: Added.
+        * bindings/v8/custom/V8CustomBinding.h: Added.
+        * bindings/v8/custom/V8CustomEventListener.h: Added.
+
+2009-03-03  Jungshik Shin <jshin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23803
+        Fix an 'off-by-1' error in ChromiumWin's font fallback.
+
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        (WebCore::FontCache::getFontDataForCharacters):
+
+2009-03-03  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        http://bugs.webkit.org/show_bug.cgi?id=23028
+        Enable dynamic web font support to Chromium on Windows: Part 1
+        - Move OpenTypeUtilities.{cpp,h} to platform/graphics/opentype
+          from platform/graphics/win because both Windows port and Chromium Windows
+          port will use them.
+        - Adjust WebCore.vcproj accordingly.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/graphics/opentype: Added.
+        * platform/graphics/opentype/OpenTypeUtilities.cpp: Copied from WebCore/platform/graphics/win/OpenTypeUtilities.cpp.
+        * platform/graphics/opentype/OpenTypeUtilities.h: Copied from WebCore/platform/graphics/win/OpenTypeUtilities.h.
+        * platform/graphics/win/OpenTypeUtilities.cpp: Removed.
+        * platform/graphics/win/OpenTypeUtilities.h: Removed.
+
+2009-03-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24312
+        
+        Take 3D transforms into account when hit testing:
+        
+        1. Maintain a bit on each RenderLayer that is set when the layer
+           has 3d descendants, so that we know when to fall into the slow
+           hit testing path.
+           
+        2. Make a ref-counted HitTestingTransformState, which is used to store
+           an accumulated transform, and the hit test point, and hitTestRect
+           in the plane of the ancestor non-3d ('flattening') layer.
+           
+           It's ref-counted so we can heap allocate it (to avoid stack bloat),
+           and avoid copying when hitTestLayer calls itself after applying the transform.
+           
+        3. Add logic to hitTestLayer to depth-test just direct descendants, if any have
+           3D transforms, or to do deep depth-testing when traversing a preserves-3d
+           hierarchy. When hit, layers compute a z-offset from the ancestor flattening
+           layer, which allows for correct depth testing.
+           
+           The existing early-return codepath is unaffected when there are no 3d transforms
+           and no preserve-3d.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::updateTransform):
+        (WebCore::RenderLayer::dirty3DTransformedDescendantStatus):
+        (WebCore::RenderLayer::update3DTransformedDescendantStatus):
+        (WebCore::RenderLayer::hitTest):
+        (WebCore::computeZOffset):
+        (WebCore::RenderLayer::createLocalTransformState):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::hitTestContents):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::preserves3D):
+        (WebCore::RenderLayer::has3DTransform):
+        (WebCore::RenderLayer::setHas3DTransformedDescendant):
+        (WebCore::RenderLayer::has3DTransformedDescendant):
+        * rendering/RenderLayerBacking.cpp:
+        * rendering/TransformState.cpp:
+        (WebCore::TransformState::flatten):
+        (WebCore::TransformState::mappedPoint):
+        (WebCore::HitTestingTransformState::move):
+        (WebCore::HitTestingTransformState::applyTransform):
+        (WebCore::HitTestingTransformState::flatten):
+        (WebCore::HitTestingTransformState::mappedPoint):
+        (WebCore::HitTestingTransformState::mappedQuad):
+        * rendering/TransformState.h:
+        (WebCore::TransformState::TransformState):
+        (WebCore::HitTestingTransformState::create):
+        (WebCore::HitTestingTransformState::move):
+        (WebCore::HitTestingTransformState::HitTestingTransformState):
+
+2009-03-03  Brett Wilson  <brettw@chromium.org>
+
+        Fix uninitialized memory reads in the Chromium Windows transparency
+        code that were identified by Purify,
+
+        Reviewed by Darin Fisher.
+
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::OwnedBuffers::OwnedBuffers):
+        (WebCore::TransparencyWin::initializeNewContext):
+
+2009-03-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24312
+        
+        Factor the code that compute a transform relative to the container
+        into RenderObject::transformFromContainer().
+        
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToAbsolutePoint):
+        (WebCore::RenderBox::mapAbsoluteToLocalPoint):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::transformFromContainer):
+        * rendering/RenderObject.h:
+
+2009-03-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24317
+        
+        Always return |true| from RenderTextControlMultiLine::nodeAtPoint() if
+        the superclass found a node, otherwise we set the innerNode of the
+        HitTestResult, but don't actually report that we found a hit.
+
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
+
+2009-03-03  Onne Gorter  <onne.gorter@avinity.net>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23707
+        resizing plugins does not work, because the plugin never gets informed
+
+        Make gtk plugins resize correctly, by sending them the setwindow event
+        correctly. Also ensure that all plugin eventing is done with correct
+        locking/calling. Mostly copied from mac implementation.
+
+        manual test: manual-tests/gtk/plugin-resize-scroll.html
+
+        * plugins/PluginView.h:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        ensure locking/calling for NPEvents
+        (WebCore::PluginView::updatePluginWidget):
+        if something changed, let setNPWindowIfNeeded handle it
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        ensure calling conventions
+        (WebCore::PluginView::setNPWindowRect):
+        just pass control to setNPWindowIfNeeded
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        event the plugin correctly of new window
+        (WebCore::PluginView::init):
+        init through the new setup
+
+2009-03-03  Mike Belshe  <mike@belshe.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24311
+        Make IDL returning DOMObject use [V8Custom]
+
+        * dom/Document.idl:
+        * html/HTMLCanvasElement.idl:
+
+2009-03-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Adele Peterson
+
+        https://bugs.webkit.org/show_bug.cgi?id=24313
+        
+        If RenderTextControlSingleLine::nodeAtPoint() pokes a node into the
+        HitTestResult, then it had better well return |true|. And m_innerBlock
+        could never have been set as the hit node by the superclass, because
+        the superclass knows nothing about m_innerBlock.
+        
+        Test: fast/forms/input-hit-test-border.html
+
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::nodeAtPoint):
+
+2009-03-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Enable Geolocation (except on Tiger and Leopard).
+
+        * Configurations/WebCore.xcconfig:
+
+2009-03-02  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Adele Peterson.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=24307
+        Null out m_highlightedNode on hideHighlight().
+        Ran WebCore/manual-tests/inspector/highlight-nodes.html.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::hideHighlight):
+
+2009-03-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix for <rdar://problem/6507404> Add Geolocation support.
+
+        This is not yet turned on for any Mac platform.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/Chrome.cpp:
+        (WebCore::Chrome::shouldAllowGeolocationForFrame):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::shouldAllowGeolocationForFrame):
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::Geolocation):
+        (WebCore::Geolocation::disconnectFrame): Remove call to setUsingGeolocation as the document
+        will not be alive at this point.
+        (WebCore::Geolocation::getCurrentPosition): Check if the embedding app allows geolocation and
+        return a PERMISSION_DENIED if not.
+        (WebCore::Geolocation::watchPosition): Ditto.
+        (WebCore::Geolocation::shouldAllowGeolocation): Perform request to embedding layer of whether
+        to allow geolocation and cache the result. 
+        * page/Geolocation.h:
+        (WebCore::Geolocation::):
+        * platform/GeolocationService.cpp:
+        * platform/GeolocationService.h:
+        (WebCore::GeolocationService::~GeolocationService):
+        (WebCore::GeolocationService::stopUpdating):
+        * platform/mac/GeolocationServiceMac.h: Added.
+        (WebCore::GeolocationServiceMac::lastPosition):
+        (WebCore::GeolocationServiceMac::lastError):
+        * platform/mac/GeolocationServiceMac.mm: Added.
+        (WebCore::GeolocationService::create):
+        (WebCore::GeolocationServiceMac::GeolocationServiceMac):
+        (WebCore::GeolocationServiceMac::~GeolocationServiceMac):
+        (WebCore::GeolocationServiceMac::startUpdating):
+        (WebCore::GeolocationServiceMac::stopUpdating):
+        (WebCore::GeolocationServiceMac::suspend):
+        (WebCore::GeolocationServiceMac::resume):
+        (WebCore::GeolocationServiceMac::positionChanged):
+        (WebCore::GeolocationServiceMac::errorOccurred):
+        (-[WebCoreCoreLocationObserver initWithCallback:]):
+        (-[WebCoreCoreLocationObserver locationManager:didUpdateToLocation:fromLocation:]):
+        (-[WebCoreCoreLocationObserver locationManager:didFailWithError:]):
+
+2009-03-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fixes for wxWidgets Mac trunk build.
+
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
+        (wxFontProperties::wxFontProperties):
+        (GetTextExtent):
+        * webcore-wx.bkl:
+
+2009-03-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wxGTK missing header build fix.
+
+        * platform/wx/wxcode/gtk/fontprops.cpp:
+
+2009-03-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adam Roben.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=21811
+          REGRESSION: Windows Build Not Selecting Proper Font
+
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::createGDIFont): Added back code to verify that the created
+        HFONT has the requested face name.
+
+2009-03-02  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes a regression caused by splitting the input and output of console commands.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24293
+
+        Reviewed by Kevin McCullough.
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype.addMessage): Don't treat ConsoleCommandResult as a
+        normal ConsoleMessage when appending. This prevents resetting repeatCounts incorrectly.
+
+2009-03-02  Timothy Hatcher  <timothy@apple.com>
+
+        Make exception messages and logged Error objects display consistently.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18983
+
+        Reviewed by Adam Roben.
+
+        * English.lproj/localizedStrings.js: Remove a string for line numbers.
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._enterKeyPressed): Pass the exception
+        boolean to the ConsoleCommandResult constructor and don't pass level.
+        (WebInspector.Console.prototype._formatnode): Fix a className typo.
+        (WebInspector.Console.prototype._formaterror): Add an error-message
+        classed span around the message to show in red and remove the
+        console-message-url class from the link so it doesn't float right.
+        Instead enclose the link in parentheses and use displayNameForURL
+        to shorten the URL in the link.
+        (WebInspector.ConsoleMessage.prototype.toMessageElement): Simplify
+        how line numbers are shown since link underlining a string with
+        parentheses looks bad.
+        (WebInspector.ConsoleCommandResult): Take an exception boolean flag
+        instead of a level and get line and URL based on that flag.
+        * inspector/front-end/inspector.css: Tweaks to the styles.
+
+2009-03-02  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Adele Peterson.
+
+        Bug 24048: extra windows button padding doesn't apply when there's no appearance
+        <https://bugs.webkit.org/show_bug.cgi?id=24048>
+
+        Replace adjustButtonInnerStyle with buttonInternalPaddingLeft/Right/Top/Bottom.
+
+        No tests added as existing tests already cover this behavior.
+
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::setupInnerStyle):
+        * rendering/RenderTheme.cpp:
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::buttonInternalPaddingLeft):
+        (WebCore::RenderTheme::buttonInternalPaddingRight):
+        (WebCore::RenderTheme::buttonInternalPaddingTop):
+        * rendering/RenderThemeChromiumGtk.cpp:
+        (WebCore::RenderThemeWin::buttonInternalPaddingLeft):
+        (WebCore::RenderThemeWin::buttonInternalPaddingRight):
+        (WebCore::RenderThemeWin::buttonInternalPaddingTop):
+        (WebCore::RenderThemeWin::buttonInternalPaddingBottom):
+        * rendering/RenderThemeChromiumGtk.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::buttonInternalPaddingLeft):
+        (WebCore::RenderThemeChromiumWin::buttonInternalPaddingRight):
+        (WebCore::RenderThemeChromiumWin::buttonInternalPaddingTop):
+        (WebCore::RenderThemeChromiumWin::buttonInternalPaddingBottom):
+        * rendering/RenderThemeChromiumWin.h:
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::buttonInternalPaddingLeft):
+        (WebCore::RenderThemeWin::buttonInternalPaddingRight):
+        (WebCore::RenderThemeWin::buttonInternalPaddingTop):
+        (WebCore::RenderThemeWin::buttonInternalPaddingBottom):
+        * rendering/RenderThemeWin.h:
+
+2009-03-02  Adam Treat  <adam.treat@torchmobile.com>
+
+        Build fix for Qt port.  Remove unnecessary assert.
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::putImageData):
+
+2009-03-02  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Adam Roben and previously by Eric Seidel and Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24227
+        Ensure that the checkForSolidColor() optimization is correctly triggered
+        for all cases of drawPattern.  Currently, the optimization was not triggered
+        when the check had not been previously performed via a request for the
+        image's NativeImagePtr.
+
+        Implement the Qt version of the checkForSolidColor() method.  Combined with
+        the bug fix this reduces the time it takes to draw a repeating background
+        of a 1x1 image from ~50msecs to ~0msecs on my machine.
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        * platform/graphics/BitmapImage.h:
+        (WebCore::BitmapImage::mayFillWithSolidColor):
+        * platform/graphics/Image.h:
+        (WebCore::Image::mayFillWithSolidColor):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        (WebCore::BitmapImage::checkForSolidColor):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        (WebCore::BitmapImage::checkForSolidColor):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+
+2009-03-02  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed build fix; adding missing files to EXTRA_DIST, so that
+        they show up in the tarball.
+
+        * GNUmakefile.am:
+
+2009-03-02  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        Added putImageData to Qt. Discussed with Ariya Hidayat.
+
+        [Qt] lacks putImageData support in Canvas
+        https://bugs.webkit.org/show_bug.cgi?id=22186
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::putImageData):
+
+2009-03-02  Timothy Hatcher  <timothy@apple.com>
+
+        Show exception messages again when evaluating bad expressions in the
+        Web Inspector's console.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19890
+
+        Reviewed by Oliver Hunt.
+
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::transferExceptionToExecState):
+        Fix the order in which the exception is set and cleared now that the
+        exception is stored in the shared GlobalData, not per ExecState.
+
+2009-02-28  Timothy Hatcher  <timothy@apple.com>
+
+        Make input in the Web Inspector console print before any output
+        that might be added by the called function.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19931
+
+        Reviewed by Oliver Hunt.
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype._enterKeyPressed): Add the command
+        message before evaluating the result. Associate the originating
+        command to the result, so if they are adjacent there is no divider.
+        (WebInspector.ConsoleCommand): No longer take a result.
+        (WebInspector.ConsoleCommand.prototype.toMessageElement): Result
+        code removed since it isn't used now.
+        (WebInspector.ConsoleCommandResult): Subclass ConsoleMessage.
+        (WebInspector.ConsoleCommandResult.prototype.toMessageElement):
+        Call the ConsoleMessage toMessageElement and add a style class.
+        * inspector/front-end/inspector.css: Add a new style class for
+        adjacent results to hide the divider. Also tweak the position of
+        the disclosure triangle for objects to not use the left margin.
+
+2009-03-01  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 24282: AX Palindrome error when asking for a specific index of the AXChildren array
+        <https://bugs.webkit.org/show_bug.cgi?id=24282>
+
+        When fetching an array of elements with a range, attachment views need to be returned
+        instead of the actual attachment.
+
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityIndexOfChild:]):
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):
+
+2009-03-01  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 24251: Cleanup: replace positionForCoordinates with positionForPoint
+        <https://bugs.webkit.org/show_bug.cgi?id=24251>
+        
+        Make RenderObject::positionForCoordinate non-virtual and
+        RenderObject::positionForPoint virtual in preparation for
+        removing positionFor* from RenderObject/RenderText.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::visiblePositionForPoint):
+        * rendering/RenderBR.cpp:
+        (WebCore::RenderBR::positionForPoint):
+        * rendering/RenderBR.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::positionForPoint):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::positionForPoint):
+        * rendering/RenderBox.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::positionForPoint):
+        * rendering/RenderInline.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::positionForCoordinates):
+        (WebCore::RenderObject::positionForPoint):
+        * rendering/RenderObject.h:
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::positionForPoint):
+        * rendering/RenderReplaced.h:
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::positionForPoint):
+        * rendering/RenderSVGInlineText.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::positionForPoint):
+        * rendering/RenderText.h:
+
+2009-03-01  Larry Ewing  <lewing@novell.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24080
+        NPN_GetValue casting to the wrong type and writing outside bounds
+
+        Make sure to cast the value to the correct type so that only
+        memory owned by the value is written to.
+
+        * plugins/gtk/PluginViewGtk.cpp (PluginView::getValueStatic): 
+        * plugins/qt/PluginViewQt.cpp (PluginView::getValueStatic):
+        * plugins/mac/PluginViewMac.cpp (PluginView::getValueStatic): 
+        (PluginView::getValue):
+
+2009-03-01  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24197 and
+        https://bugs.webkit.org/show_bug.cgi?id=23512
+
+        The Windows version of cgColor() is conditionally compiled using
+        !PLATFORM(MAC) change this to PLATFORM(WIN_OS) so that Chrome
+        can use the OS X version instead of the Windows version.
+
+        Also rename cgColor() -> createCGColor()
+
+        No observable change in behavior, so no test.
+
+        * platform/graphics/Color.h:
+        * platform/graphics/cg/ColorCG.cpp:
+        (WebCore::createCGColor):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+        * platform/graphics/mac/ColorMac.mm:
+        (WebCore::createCGColor):
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::setLayerBorderColor):
+        (WebCore::setLayerBackgroundColor):
+        (WebCore::GraphicsLayerCA::setBackgroundColor):
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * svg/graphics/filters/cg/SVGFEHelpersCg.mm:
+        (WebCore::ciColor):
+
+2009-03-01  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 24271: XMLHttpRequest needs js bindings for Workers.
+        <https://bugs.webkit.org/show_bug.cgi?id=24271>
+
+        Tests: http/tests/xmlhttprequest/workers/methods-async.html
+               http/tests/xmlhttprequest/workers/methods.html
+
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::JSWorkerContextBase::getOwnPropertySlot):
+        (jsWorkerContextBaseXMLHttpRequest):
+        (setJSWorkerContextBaseXMLHttpRequest):
+        Expose XMLHttpRequest to Workers.
+
+        * bindings/js/JSWorkerContextBase.h:
+
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
+        (WebCore::constructXMLHttpRequest):
+        (WebCore::JSXMLHttpRequestConstructor::mark):
+        Removed the dependencies on Document.
+
+        * bindings/js/JSXMLHttpRequestConstructor.h:
+        (WebCore::JSXMLHttpRequestConstructor::scriptExecutionContext):
+        * dom/EventException.idl:
+        * dom/EventListener.idl:
+        Change to have the NoStaticTables attribute since they are used from XHR.
+
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::workerContextDidFinishLoading):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFinishLoading):
+        Fixed identifier to be unsigned long.
+
+        * loader/WorkerThreadableLoader.h:
+        * workers/WorkerThread.cpp:
+        (WebCore::WorkerThread::workerThread):
+        Stop active objects when the thread is getting shutdown so that xhr gets properly shutdown.
+
+        * xml/XMLHttpRequestUpload.cpp:
+
+        * xml/XMLHttpRequest.idl:
+        * xml/XMLHttpRequestException.idl:
+        * xml/XMLHttpRequestProgressEvent.idl:
+        * xml/XMLHttpRequestUpload.idl:
+        Change to have the NoStaticTables attribute since they are used from XHR.
+
+2009-03-01  Horia Olaru  <olaru@adobe.com>
+
+        Adding manual debugger test cases for bug.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21073
+
+        Reviewed by Kevin McCullough.
+
+        * manual-tests/inspector/debugger-step-on-do-while-statements.html: Added.
+        * manual-tests/inspector/debugger-step-on-for-in-statements.html: Added.
+        * manual-tests/inspector/debugger-step-on-for-statements.html: Added.
+        * manual-tests/inspector/debugger-step-on-while-statements.html: Added.
+        * manual-tests/inspector/resources/loop-statements.js: Added.
+
+2009-03-01  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6634768> Reproducible crash in RenderLayer::updateScrollCornerStyle() using full-page zoom at MobileMe Contacts
+
+        Test: fast/events/scroll-during-zoom-change.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle): Pause scheduled events during style
+        reclaculation. Changes to the zoom property result in scroll events
+        being generated during style recalc, and those events need to be
+        deferred until the render tree is consistent.
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout): Changed to account for a case in which the
+        post-layout tasks trigger a nested layout, which reactivates the
+        post-layout task timer.
+
+2009-03-01  Ross Boucher  <rboucher@gmail.com>
+
+        Alphabetically sort scripts in the Script's panel file popup menu.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23395
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype._addScriptToFilesMenu):
+        * inspector/front-end/utilities.js:
+        (insertionIndexForObjectInListSortedByFunction):
+        (indexOfObjectInListSortedByFunction):
+
+2009-03-01  Yael Aharon  <yael.aharon@nokia.com>
+
+        Pass securityOrigin->host() instead of securityOrigin->domain() to WebInspector
+        when creating databases, localStorage or sessionStorage. Changing document.domain
+        should have no affect on databases, localStorage and sessionStorage in Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23844
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addDOMStorageScriptResource):
+        (WebCore::InspectorController::didUseDOMStorage):
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+
+2009-03-01  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Avoid leaking errors when reporting GIO errors.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::readCallback):
+        (WebCore::openCallback):
+        (WebCore::queryInfoCallback):
+
+2009-03-01  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Fixes crash when the GIO backend is given the URI for a directory.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::networkErrorForFile):
+
+2009-02-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24261
+        Fix V8 custom binding scrubbing error.
+
+        Test: fast/dom/TreeWalker/TreeWalker-currentNode.html
+        Test: traversal/exception-forwarding.html
+        TesT: traversal/stay-within-root.html
+
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp:
+        (WebCore::toV8): Replace v8::Undefined() return value with v8::Null().
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp:
+        (WebCore::toV8): Ditto.
+
+2009-02-28  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24261
+        Fix V8 custom binding scrubbing error.
+
+        Test: fast/dom/CSSStyleDeclaration/css-properties-case-sensitive.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp:
+        (WebCore::cssPropertyName):  Remove dubious checks, left over from
+            incomplete conversion of parameter from pointer to pass-by-ref.
+        (WebCore::NAMED_PROPERTY_GETTER): Initialize parameter.
+        (WebCore::NAMED_PROPERTY_SETTER): Ditto.
+
+2009-02-28  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24263
+        [GTK] ref ResourceHandle until we are finished with it
+
+        Add a ref to the ResourceHandle in startHttp so we can keep it
+        alive untill all callbacks have been executed, and unref it when
+        soup tells us it's done with the SoupMessage (in
+        finishedCallback). Fixes a number of crashes when calling
+        didReceiveData whould crash because of the handle dying.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::finishedCallback):
+        (WebCore::ResourceHandle::startHttp):
+
+2009-02-28  Adam Bergkvist <adam.bergkvist@ericsson.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24226
+        [SOUP] HTTP status text is never set
+
+        Set HTTP status text to SoupMessage reason_phrase.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::fillResponseFromMessage):
+
+2009-02-28  Dan Bernstein  <mitz@apple.com>
+
+        - fix malformed project file
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-02-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=23848
+          <rdar://problem/6573250> REGRESSION: Crash when mouse cursor moves over a link on www.opportuno.de
+
+        Test: fast/layers/inline-dirty-z-order-lists.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleWillChange): Moved the code that dirties a
+        layer's and its stacking context's z-order lists when the layer's
+        z-index or visibility change from here...
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::styleWillChange): ...to here, so that
+        it will apply to RenderInline too.
+
+2009-02-27  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Don't include TextResourceDecoder.h in Document.h
+
+        This undoes inlining of Document::displayStringModifiedByEncoding() to avoid world rebuilds
+        when TextResourceDecoder.h is modified. Performance impact is expected to be negligible.
+
+        * dom/Document.cpp:
+        (WebCore::Document::displayStringModifiedByEncoding):
+        (WebCore::Document::displayBufferModifiedByEncoding):
+        * dom/Document.h:
+        * WebCore.base.exp:
+
+2009-02-27  Matt Pennig  <pennig@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Resolves: https://bugs.webkit.org/show_bug.cgi?id=24107
+        "Fixed elements have 0 as an offsetLeft property"
+        
+        Code also brings offsetLeft/Top in full conformance with the spec.
+        Added two tests, one for fixed-position elements, and one for <html>.
+        
+        Tests: fast/dom/Element/fixed-position-offset-parent.html
+               fast/dom/Element/offsetLeft-offsetTop-html.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::offsetLeft):
+        (WebCore::RenderBoxModelObject::offsetTop):
+
+2009-02-27  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        renderer()->hasTransform() returns true for elements
+        with perspective, but no transform, so test for transform
+        when hit testing. This fixes ASSERT from
+        https://bugs.webkit.org/show_bug.cgi?id=24252
+
+        Test: transforms/no_transform_hit_testing.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestLayer):
+
+2009-02-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fix scrubbing error -- a reversed condition.
+
+        * bindings/v8/ScriptValue.h:
+        (WebCore::ScriptValue::clear): Change early exit for empty value, not the opposite.
+
+2009-02-27  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add confirmMessageFromWorkerObject to WorkerObjectProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=24152
+
+        * workers/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::performTask):
+        (WebCore::WorkerMessagingProxy::confirmMessageFromWorkerObject):
+        * workers/WorkerMessagingProxy.h:
+        * workers/WorkerObjectProxy.h:
+
+2009-02-27  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Revert r41295, the fix for https://bugs.webkit.org/show_bug.cgi?id=24227 
+        because it leads to assertion failures in the Mac port.
+        
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        * platform/graphics/BitmapImage.h:
+        (WebCore::BitmapImage::mayFillWithSolidColor):
+        * platform/graphics/Image.h:
+        (WebCore::Image::mayFillWithSolidColor):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        (WebCore::BitmapImage::checkForSolidColor):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+
+2009-02-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20249
+
+        Add a preference to allow universal access from local URLs to mitigate
+        some attacks.  Some clients still want to allow this access, so we
+        expose this as a preference.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setAllowUniversalAccessFromFileUrls):
+        * page/Settings.h:
+        (WebCore::Settings::allowUniversalAccessFromFileUrls):
+
+2009-02-27  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24229
+        If an image has no alpha channel there is no reason to use SourceOver.
+
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::draw):
+
+2009-02-27  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Eric Seidel and Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24227
+        Ensure that the checkForSolidColor() optimization is correctly triggered
+        for all cases of drawPattern.  Currently, the optimization was not triggered
+        when the check had not been previously performed via a request for the
+        image's NativeImagePtr.
+
+        Implement the Qt version of the checkForSolidColor() method.  Combined with
+        the bug fix this reduces the time it takes to draw a repeating background
+        of a 1x1 image from ~50msecs to ~0msecs on my machine.
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        * platform/graphics/BitmapImage.h:
+        (WebCore::BitmapImage::mayFillWithSolidColor):
+        * platform/graphics/Image.h:
+        (WebCore::Image::mayFillWithSolidColor):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        (WebCore::BitmapImage::checkForSolidColor):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::checkForSolidColor):
+
+2009-02-27  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Zack Rusin.
+
+        Added support for gradients and pattern on Fonts for Qt.
+
+        [Qt] gradients and patterns for FontQt
+        https://bugs.webkit.org/show_bug.cgi?id=24243
+
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::drawComplexText):
+
+2009-02-27  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        WorkerContextProxy::create in WorkerMessagingProxy.cpp should only be provided for non-Chromium platform.
+        https://bugs.webkit.org/show_bug.cgi?id=24113
+
+        * workers/WorkerMessagingProxy.cpp:
+
+2009-02-27  Yael Aharon  <yael.aharon@nokia.com>
+
+        Added a refresh button to storage views.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24040
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView):
+        (WebInspector.DOMStorageItemsView.prototype.get statusBarItems):
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        (WebInspector.DOMStorageItemsView.prototype._refreshButtonClicked):
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView):
+        (WebInspector.DatabaseTableView.prototype.get statusBarItems):
+        (WebInspector.DatabaseTableView.prototype._refreshButtonClicked):
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel):
+        (WebInspector.DatabasesPanel.prototype.get statusBarItems):
+        (WebInspector.DatabasesPanel.prototype.reset):
+        (WebInspector.DatabasesPanel.prototype.showDatabase):
+        (WebInspector.DatabasesPanel.prototype.showDOMStorage):
+        (WebInspector.DatabasesPanel.prototype._updateSidebarWidth):
+        * inspector/front-end/inspector.css:
+
+2009-02-27  Yael Aharon  <yael.aharon@nokia.com>
+
+        Added support for editing/deleting localStorage and sessionStorage items
+        directly from Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23866.
+
+        Reviewed by Timothy Hatcher.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/DOMStorageDataGrid.js: Added.
+        (WebInspector.DOMStorageDataGrid):
+        (WebInspector.DOMStorageDataGrid.prototype._ondblclick):
+        (WebInspector.DOMStorageDataGrid.prototype._startEditing):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCommitted):
+        (WebInspector.DOMStorageDataGrid.prototype._editingCancelled):
+        (WebInspector.DOMStorageDataGrid.prototype.deleteSelectedRow):
+        * inspector/front-end/DOMStorageItemsView.js:
+        (WebInspector.DOMStorageItemsView):
+        (WebInspector.DOMStorageItemsView.prototype.get statusBarItems):
+        (WebInspector.DOMStorageItemsView.prototype.hide):
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        (WebInspector.DOMStorageItemsView.prototype._deleteButtonClicked):
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel):
+        (WebInspector.DatabasesPanel.prototype.get statusBarItems):
+        (WebInspector.DatabasesPanel.prototype.reset):
+        (WebInspector.DatabasesPanel.prototype.showDOMStorage):
+        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage):
+        (WebInspector.DatabasesPanel.prototype._updateSidebarWidth):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+
+2009-02-26  Brett Wilson  <brettw@chromium.org>
+
+        Fix Windows transparency for the Chromium port. Implement a helper
+        class for handling transparency on Windows. It allows semitransparent
+        ClearType and semitransparent form controls by making new layers in the
+        background.
+
+        It also replaces the "ThemeHelper" which allows better
+        scaling and transforms on Windows form controls. In addition to the
+        functionality that the ThemeHelper did, but additionally handles the
+        antialiasing properly so that the form controls aren't composited on a
+        white square.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24101
+
+        Reviewed by Eric Seidel.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::TransparencyAwareFontPainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::initializeForGDI):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::~TransparencyAwareFontPainter):
+        (WebCore::TransparencyAwareFontPainter::TransparencyAwareFontPainter::drawGlyphs):
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/chromium/ThemeHelperChromiumWin.cpp:
+        * platform/graphics/chromium/ThemeHelperChromiumWin.h:
+        * platform/graphics/chromium/TransparencyWin.cpp: Added.
+        (WebCore::):
+        (WebCore::TransparencyWin::OwnedBuffers::OwnedBuffers):
+        (WebCore::TransparencyWin::OwnedBuffers::destBitmap):
+        (WebCore::TransparencyWin::OwnedBuffers::referenceBitmap):
+        (WebCore::TransparencyWin::OwnedBuffers::canHandleSize):
+        (WebCore::TransparencyWin::TransparencyWin):
+        (WebCore::TransparencyWin::~TransparencyWin):
+        (WebCore::TransparencyWin::init):
+        (WebCore::TransparencyWin::computeLayerSize):
+        (WebCore::TransparencyWin::setupLayer):
+        (WebCore::TransparencyWin::setupLayerForNoLayer):
+        (WebCore::TransparencyWin::setupLayerForOpaqueCompositeLayer):
+        (WebCore::TransparencyWin::setupLayerForTextComposite):
+        (WebCore::TransparencyWin::setupLayerForWhiteLayer):
+        (WebCore::TransparencyWin::setupTransform):
+        (WebCore::TransparencyWin::setupTransformForKeepTransform):
+        (WebCore::TransparencyWin::setupTransformForUntransform):
+        (WebCore::TransparencyWin::setupTransformForScaleTransform):
+        (WebCore::TransparencyWin::setTextCompositeColor):
+        (WebCore::TransparencyWin::initializeNewContext):
+        (WebCore::TransparencyWin::compositeOpaqueComposite):
+        (WebCore::TransparencyWin::compositeTextComposite):
+        (WebCore::TransparencyWin::makeLayerOpaque):
+        * platform/graphics/chromium/TransparencyWin.h: Added.
+        (WebCore::TransparencyWin::):
+        (WebCore::TransparencyWin::context):
+        (WebCore::TransparencyWin::platformContext):
+        (WebCore::TransparencyWin::drawRect):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::paintSkBitmap):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::):
+        (WebCore::RenderThemeChromiumWin::paintButton):
+        (WebCore::RenderThemeChromiumWin::paintMenuList):
+        (WebCore::RenderThemeChromiumWin::paintTextFieldInternal):
+
+2009-02-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24211
+        Add ScheduledAction for V8.
+
+        * bindings/v8/ScheduledAction.cpp: Added.
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::~ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/v8/ScheduledAction.h: Added.
+        (WebCore::ScheduledAction::ScheduledAction):
+
+2009-02-27  Zack Rusin  <zack@kde.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Qt: be more reasonable about scrolled lines
+
+        cMouseWheelPixelsPerLineStep is currently a constant set to 13.3. it doesn't
+        match our metrics meaning that Qt scrolls by ~2 lines by default which is quite
+        irritating. so lets scroll vertically by the Qt set number of lines * Qt default
+        single step scroll
+
+        * platform/qt/WheelEventQt.cpp:
+
+2009-02-27  Xan Lopez  <xan@gnome.org>
+
+        Rubber-stamped by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24222
+        [GTK] Remove checks for old glib versions
+
+        libsoup, which is a hard dependency, needs at least glib 2.15.3,
+        so remove all glib checks for versions older than that.
+
+        * platform/gtk/ContextMenuGtk.cpp:
+        (WebCore::ContextMenu::ContextMenu):
+        * platform/gtk/ContextMenuItemGtk.cpp:
+        (WebCore::ContextMenuItem::setSubMenu):
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::retainPlatformWidget):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+
+2009-02-26  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Added support for Gradients and Patterns on filled or stroked Fonts
+        in Cairo. I also added support for globalAlpha on FontCairo.
+
+        [CAIRO] SVG/Canvas fonts miss gradients/pattern support
+        https://bugs.webkit.org/show_bug.cgi?id=18617
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2009-02-26  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23957
+
+        Fix for SVG gradient and pattern text for Chromium/skia. 
+        Added accessors for the fill and stroke gradients to
+        GraphicsContext.  Changed the paintSkiaText function to take a
+        GraphicsContext, so we can check for gradients/patterns. 
+        Changed the skiaDrawText function to set the SkPaint shader
+        correctly, and to scale up the gradient shader matrix to
+        encompass the entire text string.  Also offset each glyph
+        separately, rather than transforming the canvas, so that the
+        gradient/pattern stays fixed relative to the text origin.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::getFillGradient):
+        (WebCore::GraphicsContext::getStrokeGradient):
+        (WebCore::GraphicsContext::getFillPattern):
+        (WebCore::GraphicsContext::getStrokePattern):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/chromium/UniscribeHelper.cpp:
+        (WebCore::UniscribeHelper::draw):
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::windowsCanHandleTextDrawing):
+        (WebCore::skiaDrawText):
+        (WebCore::paintSkiaText):
+        * platform/graphics/skia/SkiaFontWin.h:
+
+2009-02-26  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24208
+        Add custom V8 bindings for Navigator, Clipboard, Document, and Node.
+
+        * bindings/v8/custom/V8ClipboardCustom.cpp: Added.
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8DocumentCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NavigatorCustom.cpp: Added.
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8NodeCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-02-26  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed build fix for building with GNOME Keyring enabled.
+
+        * platform/network/soup/webkit-soup-auth-dialog.c:
+        (show_auth_dialog):
+
+2009-02-26  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16947
+        [GTK] Missing HTTP Auth challenge
+
+        Add HTTP authentication dialog with optional GNOME Keyring
+        storage.
+
+        * GNUmakefile.am:
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::currentToplevelCallback):
+        (WebCore::ResourceHandle::startHttp):
+        (WebCore::ResourceHandle::start):
+        * platform/network/soup/webkit-soup-auth-dialog.c: Added.
+        (webkit_soup_auth_dialog_class_init):
+        (webkit_soup_auth_dialog_init):
+        (webkit_soup_auth_dialog_session_feature_init):
+        (free_authData):
+        (set_password_callback):
+        (response_callback):
+        (show_auth_dialog):
+        (find_password_callback):
+        (session_authenticate):
+        (attach):
+        * platform/network/soup/webkit-soup-auth-dialog.h: Added.
+
+2009-02-25  Ojan Vafai  <ojan@chromium.org> and Eric Seidel <eric@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        After Ojan's positionForCoordinates fix http://trac.webkit.org/changeset/41191
+        svg/custom/pointer-events-image.svg and svg/custom/pointer-events-text.svg
+        started failing because Ojan's new code was now *correctly* calling through to
+        SVG asking for the closest text offset in the last line box, instead of
+        just returning the offset at the end of the last line box when clicking below a box.
+
+        But!  The SVG code was wrong, in that it returned the character offset of the last
+        character when you asked for a character offset after the end of the box, instead
+        it should return the offset *after* the last character.  This patch fixes
+        that behavior by reordering the last two clauses in svgCharacterHitsPosition.
+
+        The SVG positionForCoordinates function is still wrong, and I've added some FIXMEs
+        to document what's wrong.  I've also cleaned up the code a bit so it's clearer
+        what it is doing (which also makes more obvious what's wrong with it).
+
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::positionForCoordinates):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBoxClosestCharacterToPositionWalker::SVGInlineTextBoxClosestCharacterToPositionWalker):
+        (WebCore::SVGInlineTextBoxClosestCharacterToPositionWalker::chunkPortionCallback):
+        (WebCore::SVGInlineTextBoxClosestCharacterToPositionWalker::offsetOfHitCharacter):
+        (WebCore::SVGInlineTextBox::closestCharacterToPosition):
+        (WebCore::SVGInlineTextBox::svgCharacterHitsPosition):
+
+2009-02-26  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Minor cleanup of ChromiumBridge:
+        Removing unused matchesMIMEType method and s/Javascript/JavaScript/
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/MimeTypeRegistryChromium.cpp:
+        (WebCore::MIMETypeRegistry::isSupportedImageMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedJavaScriptMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedNonImageMIMEType):
+
+2009-02-26  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Fix text-bottom vertical alignment.  It was incorrectly aligning the bottom of the descent instead of including
+        the line-height below the descent.
+
+        Added fast/inline/vertical-align-text-bottom.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::verticalPosition):
+
+2009-02-26  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Make SVG Masking platform independet with the use of ImageBuffer::getImageData(),
+        ImageBuffer::putImageData() and GraphicsContext::clipToImageBuffer(). Every platform has
+        just to implement this three methods to support SVG Masking now.
+ 
+        Make SVG Masking platform aware
+        https://bugs.webkit.org/show_bug.cgi?id=19243
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * svg/graphics/SVGResourceMasker.cpp:
+        (WebCore::SVGResourceMasker::applyMask):
+        * svg/graphics/cairo/SVGResourceMaskerCairo.cpp: Removed.
+        * svg/graphics/cg/SVGResourceMaskerCg.cpp: Removed.
+        * svg/graphics/cg/SVGResourceMaskerCg.mm: Removed.
+        * svg/graphics/qt/SVGResourceMaskerQt.cpp: Removed.
+        * svg/graphics/skia/SVGResourceMaskerSkia.cpp: Removed.
+
+2009-02-26  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Darin Adler, Antti Koivisto and Alexey Proskuryakov.
+
+        Test: http/tests/misc/slow-preload-cancel.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=24133
+        Clear all pending preloads in the DocLoader object when we decide to
+        cancel its all requests.
+
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::clearPendingPreloads):
+        * loader/DocLoader.h:
+        * loader/loader.cpp:
+        (WebCore::Loader::cancelRequests):
+
+2009-02-26  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24182
+        Add NodeFilter, NodeIterator, and TreeWalker custom V8 bindings.
+
+        * bindings/v8/custom/V8NodeFilterCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8NodeIteratorCustom.cpp: Added.
+        (WebCore::toV8):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8TreeWalkerCustom.cpp: Added.
+        (WebCore::toV8):
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-02-26  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23500
+        KURL::parse() incorrectly compares its result to original string
+
+        * platform/KURL.cpp: (WebCore::KURL::parse): Take string length into account.
+
+2009-02-26  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Kevin McCullough.
+
+        Manual test for inspector node highlighting.
+
+        * manual-tests/inspector/highlight-nodes.html: Added.
+
+2009-02-16  Anantanarayanan Iyengar  <ananta@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23973
+        ScrollView::scrollContents can be invoked during view shutdown.  In
+        this scenario the FrameView::hostWindow method can return NULL, which
+        indicates that the frame/page is being destroyed. This causes a crash
+        when we try to dereference a NULL hostWindow pointer.  Fix is to add a
+        NULL check for this.  
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+
+2009-02-26  Rahul Kuchhal  <kuchhal@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24003
+        Fix a crash caused by unsafe type conversion.
+
+        Test: fast/block/positioning/absolute-in-inline-rtl-4.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcAbsoluteHorizontalValues):
+
+2009-02-26  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24202
+        Have drawNodeHighlight clip instead of clearing. This makes it work for
+        both Safari and Chromium since Chromium draws the inspector highlighting
+        in the same buffer as the page.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::quadToPath):
+        (WebCore::drawOutlinedQuad):
+        (WebCore::drawOutlinedQuadWithClip):
+        (WebCore::drawHighlightForBox):
+
+2009-02-26  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein & Darin Adler
+
+        Make sure the border/padding are properly omitted at the start of an inline that is a continuation.
+        
+        Added fast/inline/inline-continuation-borders.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
+
+2009-02-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix, no review.
+        
+        Try to fix the wx build after r41218.
+
+        * WebCoreSources.bkl:
+
+2009-02-26  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19527
+        ASSERTION FAILED: containerA && containerB
+
+        Test: fast/dom/Range/bug-19527.html
+
+        * dom/Range.cpp:
+        (WebCore::Range::isPointInRange):
+        (WebCore::Range::comparePoint):
+        Bring the behavior in line with current Firefox, making it impossible for these methods
+        to pass a null container to compareBoundaryPoints().
+
+2009-02-26  Jonathon Jongsma  <jonathon@quotidian.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20358
+
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::smallCapsFontData): the small-caps font data
+        should set the computed size rather than the specified size, otherwise
+        the caps just get rendered normal size.
+
+2009-02-26  Benjamin Meyer  <benjamin.meyer@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24062
+        QNetworkCookieJar expects the url and not the policy url.  Sending the
+        policy url will cause QNetworkCookieJar to behave incorrectly.  One
+        example would be a cookie that does not have a path or domain.
+        QNetworkCookieJar will use the url it is given to fill in default values.
+        This allows setting cookies on the url of the main frame from an iFrame
+        when the cookie should be set on the url of the iFrame.
+
+        Originally noticed on http://writer.zoho.com/jsp/home.jsp?serviceurl=/index.do
+
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::setCookies):
+
+2009-02-26  Charles Wei  <charles.wei@torchmobile.com.cn>
+
+        Reviewed by George Staikos.
+
+        make WebKit/Qt compile with SVG disabled
+
+        * WebCore.pro:
+        * platform/graphics/qt/FontPlatformDataQt.cpp:
+
+2009-02-25  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed build fix. Add WebCore/workers to the list of paths
+        searched by the bindings generator perl script.
+
+        * GNUmakefile.am:
+
+2009-02-25  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Add canvas to the list of RenderObjects that can mark a page as
+        visually not empty.
+
+        * rendering/RenderHTMLCanvas.cpp:
+        (WebCore::RenderHTMLCanvas::RenderHTMLCanvas):
+
+2009-02-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::nodeAtPoint): Remove assertion fired when child has layer
+        as RenderMedia with controls always has a layer.
+
+2009-02-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=24130
+          <rdar://problem/6618196> Paint very slow when horizontally resizing
+
+        Test: fast/gradients/background-clipped.html
+
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended): Intersect the
+        destination rectangle passed to drawTiledImage() with the dirty
+        rectangle. This makes it more likely for the destination rect to be
+        contained in a single tile rect, which results in a faster code path
+        being taken down the road (just drawing a single tile instead of
+        tiling).
+
+2009-02-25  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix test regressions from positionForCoordinates patch.
+        https://bugs.webkit.org/show_bug.cgi?id=24148
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::positionForPointWithInlineChildren):
+        Remove ASSERT that placeholder text codepath is hitting.
+
+2009-02-25  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 24143: Crash occurs at WebCore::AccessibilityTable::isTableExposableThroughAccessibility() when applying a link in GMail
+        https://bugs.webkit.org/show_bug.cgi?id=24143
+
+        When an AX object is marked dirty, do not create AX elements while going up the parent chain.
+        Do not allow AXRenderObjects to remove their own IDs from the cache, all the cache to do that work
+        Make sure the AXObjectWrapper's have an object before calling them
+        In AXObjectCache, change get -> getOrCreate. Use get() to only retrieve an element if it exists
+
+        Test: platform/mac-snowleopard/accessibility/table-updating.html
+
+        * WebCore.base.exp:
+        * page/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::~AXObjectCache):
+        (WebCore::AXObjectCache::get):
+        (WebCore::AXObjectCache::getOrCreate):
+        (WebCore::AXObjectCache::removeAXID):
+        (WebCore::AXObjectCache::handleActiveDescendantChanged):
+        (WebCore::AXObjectCache::handleAriaRoleChanged):
+        * page/AXObjectCache.h:
+        * page/AccessibilityImageMapLink.cpp:
+        (WebCore::AccessibilityImageMapLink::parentObject):
+        * page/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::listBoxOptionAccessibilityObject):
+        (WebCore::AccessibilityListBox::doAccessibilityHitTest):
+        * page/AccessibilityListBoxOption.cpp:
+        (WebCore::AccessibilityListBoxOption::elementRect):
+        (WebCore::AccessibilityListBoxOption::parentObject):
+        * page/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::detach):
+        (WebCore::AccessibilityObject::parentObjectIfExists):
+        (WebCore::replacedNodeNeedsCharacter):
+        (WebCore::AccessibilityObject::accessibilityObjectForPosition):
+        * page/AccessibilityObject.h:
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::firstChild):
+        (WebCore::AccessibilityRenderObject::lastChild):
+        (WebCore::AccessibilityRenderObject::previousSibling):
+        (WebCore::AccessibilityRenderObject::nextSibling):
+        (WebCore::AccessibilityRenderObject::parentObjectIfExists):
+        (WebCore::AccessibilityRenderObject::parentObject):
+        (WebCore::AccessibilityRenderObject::isAttachment):
+        (WebCore::AccessibilityRenderObject::headingLevel):
+        (WebCore::AccessibilityRenderObject::anchorElement):
+        (WebCore::AccessibilityRenderObject::menuForMenuButton):
+        (WebCore::AccessibilityRenderObject::menuButtonForMenu):
+        (WebCore::AccessibilityRenderObject::checkboxOrRadioRect):
+        (WebCore::AccessibilityRenderObject::internalLinkElement):
+        (WebCore::AccessibilityRenderObject::addRadioButtonGroupMembers):
+        (WebCore::AccessibilityRenderObject::titleUIElement):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
+        (WebCore::AccessibilityRenderObject::getDocumentLinks):
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
+        (WebCore::AccessibilityRenderObject::focusedUIElement):
+        (WebCore::AccessibilityRenderObject::activeDescendant):
+        (WebCore::AccessibilityRenderObject::observableObject):
+        (WebCore::AccessibilityRenderObject::childrenChanged):
+        (WebCore::AccessibilityRenderObject::addChildren):
+        * page/AccessibilityRenderObject.h:
+        (WebCore::AccessibilityRenderObject::setRenderObject):
+        * page/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::addChildren):
+        (WebCore::AccessibilityTable::headerContainer):
+        (WebCore::AccessibilityTable::cellForColumnAndRow):
+        * page/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::isTableCell):
+        (WebCore::AccessibilityTableCell::titleUIElement):
+        * page/AccessibilityTableColumn.cpp:
+        (WebCore::AccessibilityTableColumn::headerObjectForSection):
+        * page/AccessibilityTableRow.cpp:
+        (WebCore::AccessibilityTableRow::isTableRow):
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+        * page/mac/AXObjectCacheMac.mm:
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::postNotificationToElement):
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (textMarkerForVisiblePosition):
+        (AXLinkElementForNode):
+        (nsStringForReplacedNode):
+        (-[AccessibilityObjectWrapper doAXAttributedStringForTextMarkerRange:]):
+        (-[AccessibilityObjectWrapper accessibilityActionNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityFocusedUIElement]):
+        (-[AccessibilityObjectWrapper accessibilityHitTest:]):
+        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
+        (-[AccessibilityObjectWrapper accessibilityIsIgnored]):
+        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityPerformPressAction]):
+        (-[AccessibilityObjectWrapper accessibilityPerformAction:]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+        (-[AccessibilityObjectWrapper _accessibilityParentForSubview:]):
+        (-[AccessibilityObjectWrapper accessibilityIndexOfChild:]):
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeCount:]):
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):
+
+2009-02-25  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Re-working of <rdar://problem/6487249> repro crash in 
+        WebCore::CSSParser::parseFillImage copying entire contents of this 
+        page
+        -and corresponding: https://bugs.webkit.org/show_bug.cgi?id=24172
+
+        Fixes a bunch of layout test failures I caused!
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseContent):
+        (WebCore::CSSParser::parseFillImage):
+        (WebCore::CSSParser::parseFontFaceSrc):
+        (WebCore::CSSParser::parseBorderImage):
+
+2009-02-25  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24174
+        Add more V8 custom bindings.
+
+        * bindings/v8/custom/V8CSSStyleDeclarationCustom.cpp: Added.
+        (WebCore::hasCSSPropertyNamePrefix):
+        (WebCore::cssPropertyName):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        * bindings/v8/custom/V8DOMStringListCustom.cpp: Added.
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8EventCustom.cpp: Added.
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::ACCESSOR_GETTER):
+        * bindings/v8/custom/V8HTMLDocumentCustom.cpp: Added.
+        (WebCore::NAMED_PROPERTY_DELETER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp: Added.
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8NamedNodeMapCustom.cpp: Added.
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8NodeListCustom.cpp: Added.
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8StyleSheetListCustom.cpp: Added.
+        (WebCore::NAMED_PROPERTY_GETTER):
+
+2009-02-25  Scott Violet  <sky@google.com>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24171
+        Provides a RenderTheme method for getting the scroll bar size and
+        changes RenderListBox to use it. RenderTheme returns a size of regular,
+        and Mac's override to return small. Changes ScrollbarThemeChromium to
+        use the scrollbarsize of the scrollbar when getting the size
+        instead of passing in no-args.
+
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        (WebCore::ScrollbarThemeChromium::trackRect):
+        (WebCore::ScrollbarThemeChromium::buttonSize):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::createScrollbar):
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::scrollbarControlSizeForPart):
+        * rendering/RenderThemeChromiumMac.h:
+        (WebCore::RenderThemeChromiumMac::scrollbarControlSizeForPart):
+        * rendering/RenderThemeMac.h:
+        (WebCore::RenderThemeMac::scrollbarControlSizeForPart):
+
+2009-02-25  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/6487249> repro crash in 
+        WebCore::CSSParser::parseFillImage copying entire contents of this 
+        page
+        -and corresponding: https://bugs.webkit.org/show_bug.cgi?id=24172
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Null-check m_styleSheet
+
+2009-02-25  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build.
+
+        * WebCore.pro:
+
+2009-02-25  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix. Not reviewed.
+
+        Add files to the build per r41218.
+        Rename WebkitPoint.h to WebKitPoint.h in DOMWindow.cpp
+
+        * GNUmakefile.am:
+        * page/DOMWindow.cpp:
+
+2009-02-25  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24043
+        When faced with URLs with unsupported protocol on Gtk port,
+        report the error through an idle function and return true, so
+        a proper resource handle is created.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::reportUnknownProtocolError):
+        (WebCore::ResourceHandle::start):
+
+2009-02-25  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+        Use struct to forward declare ResourceRequest.
+
+        * history/HistoryItem.h:
+        * inspector/InspectorController.h:
+        * loader/DocumentThreadableLoader.h:
+        * loader/FrameLoaderClient.h:
+        * loader/MainResourceLoader.h:
+        * loader/SubresourceLoader.h:
+        * loader/SubresourceLoaderClient.h:
+        * loader/ThreadableLoader.h:
+        * loader/WorkerThreadableLoader.h:
+        * platform/CrossThreadCopier.h:
+        * platform/network/ResourceHandle.h:
+        * platform/network/ResourceHandleClient.h:
+        * platform/network/ResourceRequestBase.h:
+        * platform/network/cf/ResourceRequestCFNet.h:
+        * xml/XMLHttpRequest.h:
+
+2009-02-25  Steve Falkenburg  <sfalken@apple.com>
+
+        Partial Windows build fix.
+        
+        * DerivedSources.cpp:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-02-25  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Ported arcTo to Qt. Qt has no native support for arcTo. This changes
+        calculate the behavior of arcTo and draws it with lineTo and arc.
+
+        [QT] implement Canvas arcTo
+        https://bugs.webkit.org/show_bug.cgi?id=23873
+
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::addArcTo):
+
+2009-02-25  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        Remove idl files from Resources, and sort.
+        
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-02-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23943
+
+        Added webkitConvertPointFromNodeToPage and webkitConvertPointFromPageToNode on
+        the window object. Also added WebKitPoint object, which is passed in and out
+        of these functions.
+
+        Test: fast/dom/Window/webkitConvertPoint.html
+
+        * DerivedSources.make:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (jsDOMWindowBaseWebKitPoint):
+        (setJSDOMWindowBaseWebKitPoint):
+        * bindings/js/JSWebKitPointConstructor.cpp: Added.
+        (WebCore::):
+        (WebCore::JSWebKitPointConstructor::JSWebKitPointConstructor):
+        (WebCore::constructWebKitPoint):
+        (WebCore::JSWebKitPointConstructor::getConstructData):
+        * bindings/js/JSWebKitPointConstructor.h: Added.
+        (WebCore::JSWebKitPointConstructor::classInfo):
+        * dom/Node.cpp:
+        (WebCore::Node::convertToPage):
+        (WebCore::Node::convertFromPage):
+        * dom/Node.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::webkitConvertPointFromNodeToPage):
+        (WebCore::DOMWindow::webkitConvertPointFromPageToNode):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * page/WebKitPoint.h: Added.
+        (WebCore::WebKitPoint::create):
+        (WebCore::WebKitPoint::x):
+        (WebCore::WebKitPoint::y):
+        (WebCore::WebKitPoint::setX):
+        (WebCore::WebKitPoint::setY):
+        (WebCore::WebKitPoint::WebKitPoint):
+        * page/WebKitPoint.idl: Added.
+
+2009-02-25  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove "#if ENABLE(WORKERS)" wrap from CrossThreadCopier files.
+        https://bugs.webkit.org/show_bug.cgi?id=24145
+
+        * platform/CrossThreadCopier.cpp:
+        * platform/CrossThreadCopier.h:
+
+2009-02-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23688: ThreadableLoader needs a sync implementation for Workers.
+        <https://bugs.webkit.org/show_bug.cgi?id=23688>
+
+        No observable change in behavior, so no test.
+
+        * loader/ThreadableLoader.cpp:
+        (WebCore::ThreadableLoader::loadResourceSynchronously):
+        * loader/ThreadableLoaderClientWrapper.h:
+        (WebCore::ThreadableLoaderClientWrapper::clearClient):
+        (WebCore::ThreadableLoaderClientWrapper::done):
+        (WebCore::ThreadableLoaderClientWrapper::didFinishLoading):
+        (WebCore::ThreadableLoaderClientWrapper::didFail):
+        (WebCore::ThreadableLoaderClientWrapper::didFailRedirectCheck):
+        (WebCore::ThreadableLoaderClientWrapper::ThreadableLoaderClientWrapper):
+        Expose whether the loader is done (based on what callbacks were done).
+
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
+        (WebCore::WorkerThreadableLoader::loadResourceSynchronously):
+        Each loader is given its own mode so that only its callbacks get through the run loop.
+
+        The xhr spec says that the readystatechange events are synchronous, so in the case of a
+        nested sync xhr no readystatechange events should be fired for the outer xhr.
+
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+
+        * loader/WorkerThreadableLoader.h:
+        (WebCore::WorkerThreadableLoader::create):
+        (WebCore::WorkerThreadableLoader::done):
+
+        * workers/WorkerRunLoop.cpp:
+        (WebCore::WorkerRunLoop::WorkerRunLoop):
+        * workers/WorkerRunLoop.h:
+        (WebCore::WorkerRunLoop::createUniqueId):
+        Simple method to create a uniqueId on demand with respect to the run loop.
+
+        * workers/WorkerThread.h:
+
+2009-02-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 24089: ThreadableLoader::loadResourceSynchronously should do callbacks like the async code.
+        <https://bugs.webkit.org/show_bug.cgi?id=24089>
+
+        Make threadable loader callbacks to happen during the sync load call.
+
+        Changes the behavior of sync xhr for insecure redirects in two ways:
+        + Sends an error event instead of an abort event (which is the same as async xhr's behavior).
+        + Throws a network exception which is what other browsers do and what the spec
+        says to do (http://www.w3.org/TR/XMLHttpRequest/).
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::loadResourceSynchronously):
+        * loader/DocumentThreadableLoader.h:
+        * loader/ThreadableLoader.cpp:
+        (WebCore::ThreadableLoader::loadResourceSynchronously):
+        * loader/ThreadableLoader.h:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::loadRequestSynchronously):
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
+        (WebCore::XMLHttpRequest::didFail):
+        (WebCore::XMLHttpRequest::didFailRedirectCheck):
+        * xml/XMLHttpRequest.h:
+
+2009-02-24  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23368
+
+        Added logic to correctly hit test accelerated layers.
+
+        Tests: animations/animation-hit-test-transform.html
+               animations/animation-hit-test.html
+               transitions/transition-hit-test-transform.html
+               transitions/transition-hit-test.html
+
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::animate):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::updateClipRects):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+
+2009-02-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24067
+        REGRESSION: Crash in WebCore::Document::initSecurityContext
+
+        The crash started to happen when we removed a check for frame->document() being null.
+        However, the original document shouldn't be null here, because it is needed to alias
+        security origins. So, this patch fixes the crash by correcting security origin behavior.
+
+        Test: http/tests/security/aboutBlank/window-open-self-about-blank.html
+        This tests for not crashing, and for inheriting the domain from the document being replaced.
+        Preserving the aliasing cannot be tested for automatically, because we'd need a non-trivial
+        domain to remove a prefix from.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::begin): Create a new document before
+        clearing the frame, so that Document::initSecurityContext() could access the old one.
+
+2009-02-25  Jay Campan  <jcampan@google.com>
+
+        Reviewed by Darin Fisher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24066
+
+        Items in drop-downs were not painted correctly.  Makes sure the
+        PopupListBox invalidates in the coordinates of the window as this is
+        FramelessScrollView::invalidateRect paints to.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::invalidateRow):
+
+2009-02-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson
+
+        https://bugs.webkit.org/show_bug.cgi?id=15081
+        
+        Make display:none work for applet, emebed and object elements
+        by calling rendererIsNeeded() on superclasses.
+
+        Tests: fast/replaced/applet-display-none.html
+               fast/replaced/embed-display-none.html
+               fast/replaced/object-display-none.html
+
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::rendererIsNeeded):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::rendererIsNeeded):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::rendererIsNeeded):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::rendererIsNeeded):
+
+2009-02-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=24137
+        
+        Fix localToAbsolute() and absoluteToLocal() to map points through 3d transforms,
+        taking perspective and transform-style: preserve-3d into account.
+        
+        In order to support transform-style: preserve-3d, which keeps elements in a
+        3d space, we have to carry along an accumulated matrix in TransformState.
+        We also need to apply the perspective from the parent, if any, with the
+        appropriate origin.
+
+        * GNUmakefile.am:
+        * WebCore.base.exp:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::TransformationMatrix::translate):
+        (WebCore::TransformationMatrix::translate3d):
+        (WebCore::TransformationMatrix::translateRight3d):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::mapLocalToAbsolutePoint):
+        (WebCore::RenderBox::mapAbsoluteToLocalPoint):
+        * rendering/RenderBox.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateTransform):
+        (WebCore::RenderLayer::perspectiveTransform):
+        (WebCore::RenderLayer::perspectiveOrigin):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::requiresCompositingLayerForTransform):
+        (WebCore::RenderLayerCompositor::layerHas3DContent):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::localToAbsolute):
+        (WebCore::RenderObject::absoluteToLocal):
+        (WebCore::RenderObject::mapLocalToAbsolutePoint):
+        (WebCore::RenderObject::mapAbsoluteToLocalPoint):
+        * rendering/RenderObject.h:
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::mapLocalToAbsolutePoint):
+        (WebCore::RenderTableCell::mapAbsoluteToLocalPoint):
+        * rendering/RenderTableCell.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::mapLocalToAbsolutePoint):
+        (WebCore::RenderView::mapAbsoluteToLocalPoint):
+        * rendering/RenderView.h:
+        * rendering/TransformState.cpp: Added.
+        (WebCore::TransformState::move):
+        (WebCore::TransformState::applyTransform):
+        (WebCore::TransformState::flatten):
+        * rendering/TransformState.h: Added.
+        (WebCore::TransformState::):
+        (WebCore::TransformState::TransformState):
+        (WebCore::TransformState::move):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::hasPerspective):
+
+2009-02-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23990
+        Regression (r40837): JavaScript image popup doesn't work
+
+        Make the getClientRects and getBoundingClientRect methods return rects
+        relative to the viewport.
+
+        Test: fast/dom/getBoundingClientRect-getClientRects-relative-to-viewport.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::getClientRects):
+        (WebCore::Element::getBoundingClientRect):
+
+2009-02-24  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        SVG pages don't have a body or an html element! 
+        Don't return early if there is no body.
+
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::canonicalPosition):
+
+2009-02-23  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Seidel
+
+        https://bugs.webkit.org/show_bug.cgi?id=23740, painting order wrong for normal flow elements with overflow: hidden
+        
+        This patch reworks the painting of overflow.  There is now the concept of a "self-painting layer."  All
+        layers are considered to be self-painting except for overflow layers that are normal flow (and that don't have
+        reflections or masks).
+        
+        If an overflow layer is not self-painting, then it ends up painted by its parent just like any other normal flow object.
+        The only difference is that the clip has to be pushed and popped when painting the object's children.
+        
+        The lightweight clipping scheme used for controls has been extended to cover overflow now in this simplified case.  With
+        the code consolidated into reusable push/pop functions, all of the renderers that use overflow have been patched to
+        use the new functions.
+        
+        Hit testing has also been patched to check the overflow clip rect first before recurring into children.
+        
+        Scrollbar paint has been moved into RenderBlock for now, since none of the table objects support scrollbars
+        yet, and scrollbar hit testing was already there anyway.  Now the two code paths are more symmetrical.
+        
+        Masks are now treated like normal flow layers (just like reflections).
+
+        A couple of test cases have been added to fast/overflow to test the stacking order. 
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        (WebCore::InlineFlowBox::paint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::repaintOverhangingFloats):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::paintChildren):
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::paintFloats):
+        (WebCore::RenderBlock::insertFloatingObject):
+        (WebCore::RenderBlock::floatRect):
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        (WebCore::RenderBlock::addOverhangingFloats):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::hitTestContents):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::nodeAtPoint):
+        (WebCore::RenderBox::pushContentsClip):
+        (WebCore::RenderBox::popContentsClip):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::paintObject):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::hasSelfPaintingLayer):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::shouldBeNormalFlowOnly):
+        (WebCore::RenderLayer::isSelfPaintingLayer):
+        * rendering/RenderLayer.h:
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paint):
+        (WebCore::RenderTable::paintObject):
+        (WebCore::RenderTable::nodeAtPoint):
+        * rendering/RenderTable.h:
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paint):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::nodeAtPoint):
+        (WebCore::RenderTableRow::paint):
+        * rendering/RenderTableRow.h:
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::paint):
+        (WebCore::RenderTableSection::paintObject):
+        (WebCore::RenderTableSection::nodeAtPoint):
+        * rendering/RenderTableSection.h:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write):
+        (WebCore::writeLayers):
+
+2009-02-24  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (build fix).
+
+        Attempted build fix for wx-mac.
+
+        * WebCoreSources.bkl:
+
+2009-02-24  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (build fix).
+
+        Attempted build fixes for qt-linux and wx-mac.
+
+        * WebCore.pro:
+        * webcore-base.bkl:
+
+2009-02-24  Ojan Vafai  <ojan@dhcp-172-31-134-214.sfo.corp.google.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix null pointer error. If the node is the Document, then ownerDocument() 
+        returns null, document() does not.
+
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::canonicalPosition):
+
+2009-02-24  Jian Li  <jianli@chromium.org>
+
+        Reviewed by NOBODY (attempted build fixes).
+
+        Fix build break for Windows and Linux.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-02-24  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24131
+        Fix-up COM/RefCounted dichotomy in Chromium port.
+
+        * page/chromium/AccessibilityObjectWrapper.h:
+        (WebCore::AccessibilityObjectWrapper::AccessibilityObjectWrapper): Added
+        explicit setting of recount.
+
+2009-02-24  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24141
+        Add clarity to V8 interceptor helper function.
+
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER): Renamed to notHandledByInterceptor.
+        (WebCore::NAMED_PROPERTY_SETTER): Ditto.
+        (WebCore::INDEXED_PROPERTY_GETTER): Ditto.
+        (WebCore::INDEXED_PROPERTY_SETTER): Ditto.
+
+2009-02-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel
+
+        Minor numeric cleanup: convert float literals to doubles.
+        
+        * platform/graphics/transforms/RotateTransformOperation.cpp:
+        (WebCore::RotateTransformOperation::blend):
+
+2009-02-24  Mark Mentovai  <mark@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24139
+        Add missing include.
+
+        * bindings/v8/ScriptInstance.h:
+
+2009-02-24  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Move worker related files from dom directory to worker directory under WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=24123
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/MigrateIDLAndScripts:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/CrossThreadCopier.cpp: Renamed from WebCore/dom/CrossThreadCopier.cpp.
+        * platform/CrossThreadCopier.h: Renamed from WebCore/dom/CrossThreadCopier.h.
+        * workers/GenericWorkerTask.h: Renamed from WebCore/dom/GenericWorkerTask.h.
+        * workers/Worker.cpp: Renamed from WebCore/dom/Worker.cpp.
+        * workers/Worker.h: Renamed from WebCore/dom/Worker.h.
+        * workers/Worker.idl: Renamed from WebCore/dom/Worker.idl.
+        * workers/WorkerContext.cpp: Renamed from WebCore/dom/WorkerContext.cpp.
+        * workers/WorkerContext.h: Renamed from WebCore/dom/WorkerContext.h.
+        * workers/WorkerContext.idl: Renamed from WebCore/dom/WorkerContext.idl.
+        * workers/WorkerContextProxy.h: Renamed from WebCore/dom/WorkerContextProxy.h.
+        * workers/WorkerLocation.cpp: Renamed from WebCore/dom/WorkerLocation.cpp.
+        * workers/WorkerLocation.h: Renamed from WebCore/dom/WorkerLocation.h.
+        * workers/WorkerLocation.idl: Renamed from WebCore/dom/WorkerLocation.idl.
+        * workers/WorkerMessagingProxy.cpp: Renamed from WebCore/dom/WorkerMessagingProxy.cpp.
+        * workers/WorkerMessagingProxy.h: Renamed from WebCore/dom/WorkerMessagingProxy.h.
+        * workers/WorkerObjectProxy.h: Renamed from WebCore/dom/WorkerObjectProxy.h.
+        * workers/WorkerRunLoop.cpp: Renamed from WebCore/dom/WorkerRunLoop.cpp.
+        * workers/WorkerRunLoop.h: Renamed from WebCore/dom/WorkerRunLoop.h.
+        * workers/WorkerThread.cpp: Renamed from WebCore/dom/WorkerThread.cpp.
+        * workers/WorkerThread.h: Renamed from WebCore/dom/WorkerThread.h.
+
+2009-02-05  Ojan Vafai  <ojan@chromium.org> and Eric Seidel <eric@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Make cursor positions match IE6/IE7/FF3 when clicking in margins/padding
+        around divs inside editable regions.
+        https://bugs.webkit.org/show_bug.cgi?id=23605
+
+        Fix clicks outside editable regions from focusing the editable region.
+        https://bugs.webkit.org/show_bug.cgi?id=23607
+
+        Removed editing/selection/contenteditable-click-outside.html as it's
+        not as useful as our new tests.
+
+        Clean up RenderBlock::positionForCoordinates to remove dead code,
+        duplicate code, and generally make it more readable.
+
+        Tests: editing/selection/click-in-margins-inside-editable-div.html
+               editing/selection/click-in-padding-with-multiple-line-boxes.html
+               editing/selection/click-outside-editable-div.html
+
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::canonicalPosition):
+        * rendering/RenderBlock.cpp:
+        (WebCore::positionForPointRespectingEditingBoundaries):
+        (WebCore::positionForPointWithInlineChildren):
+        (WebCore::RenderBlock::positionForCoordinates):
+        (WebCore::RenderBlock::updateFirstLetter):
+
+2009-02-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Related to <rdar://problem/6590295>
+        Allow disabling javascript: urls.
+
+        * WebCore.base.exp:
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::parseMappedAttribute):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::executeIfJavaScriptURL):
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::setJavaScriptURLsAreAllowed):
+        (WebCore::Page::javaScriptURLsAreAllowed):
+        * page/Page.h:
+
+2009-02-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix build when ACCELERATED_COMPOSITING is turned on
+        (overflowList() -> normalFlowList()).
+    
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::hasNonCompositingContent):
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        (WebCore::RenderLayerCompositor::computeCompositingRequirements):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::recursiveRepaintLayerRect):
+        (WebCore::RenderLayerCompositor::layerHas3DContent):
+
+2009-02-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+        
+        https://bugs.webkit.org/show_bug.cgi?id=24135
+        
+        Round the FloatPoint returned by absoluteToLocal(), rather than
+        truncating it.
+
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::MouseRelatedEvent::receivedTarget):
+
+2009-02-24  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=24004 REGRESSION: 
+        Ordered list item marker misaligned when line height is not 1.2 
+        -and corresponding <rdar://problem/6602506>
+
+        This is a regression from http://trac.webkit.org/changeset/40880 
+        where createInlineBox was taken off of RenderObject and moved to 
+        RenderBox. The problem was that the RenderBox version still needs 
+        to be virtual because there is still an existing implementation in 
+        RenderListMarker. 
+
+        * rendering/RenderBox.h:
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::createInlineBox):
+        * rendering/RenderListMarker.h:
+
+2009-02-24  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24128
+        Upstream more V8 custom bindings: constructors, XSLTProcessor.
+
+        * bindings/v8/custom/V8DOMParserConstructor.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8MessageChannelConstructor.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8WebKitCSSMatrixConstructor.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XMLSerializerConstructor.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XPathEvaluatorConstructor.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8XSLTProcessorCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-02-24  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 24090: WorkerThreadableLoader needs to be able to post tasks for a mode.
+        <https://bugs.webkit.org/show_bug.cgi?id=24090>
+
+        No observable change in behavior, so no test.
+
+        * dom/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
+        (WebCore::WorkerMessagingProxy::postTaskToWorkerContext):
+        Fixed the bug that m_unconfirmedMessageCount was getting incremented for non-message tasks.
+
+        (WebCore::WorkerMessagingProxy::postTaskForModeToWorkerContext):
+
+        * dom/WorkerMessagingProxy.h:
+        * loader/ThreadableLoader.cpp:
+        (WebCore::ThreadableLoader::create):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didSendData):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveResponse):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveData):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFinishLoading):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFail):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFailRedirectCheck):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveAuthenticationCancellation):
+        Changed these methods to post task using a mode.
+
+        * loader/WorkerThreadableLoader.h:
+        (WebCore::WorkerThreadableLoader::create):
+
+2009-02-24  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24091
+        <rdar://problem/6468660> Start of redirect chain ends up as master entry in Application Cache
+
+        Test: http/tests/appcache/access-via-redirect.php
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource): Use the URL we ended up with,
+        not the original one.
+
+2009-02-24  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Change to include WorkerObjectProxy.h instead of WorkerMessagingProxy.h in WorkerContext.cpp and WorkerScriptController.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=24112
+
+        * bindings/js/WorkerScriptController.cpp:
+        * dom/WorkerContext.cpp:
+
+2009-02-23  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6613796> Extended text codecs registered on webview creation
+
+        Comparing a text encoding with string "GBK" ended up constructing
+        TextEncoding("GBK") which in turn initialized all extended
+        text codecs.
+
+        * platform/text/TextCodecICU.cpp:
+        (WebCore::TextCodecICU::decode):
+
+2009-02-23  Sam Weinig  <sam@webkit.org>
+
+        Fix Qt build.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::valueRealType):
+
+2009-02-23  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 23956: Safari crashes when cloneNode fails (cloning a XML element with an invalid nodeName)
+
+        The crash occurred because Document::cloneNode would call Document::createElementNS. Unfortunately
+        element created with createElement could have a wrong nodeName (createElement sets the string as the
+        localName without checking for a prefix).
+
+        The fix is to call Document::createElement(const QualifiedName&, bool) that will not do any checks on the QualifiedName
+        and will always succeed.
+        Also rolled-out the HTMLElement specialisation of clonedNode as it was equivalent to what is done now (added an ASSERT
+        to ensure that).
+
+        Test: fast/dom/cloneNode.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::cloneNode): Call createElement(const QualifiedName&, bool) instead of createElementNS as it will
+        always return an element.
+
+        * html/HTMLElement.cpp:
+        * html/HTMLElement.h: Removed HTMLElement::clonedNode as it is equivalent to what is now done.
+
+2009-02-23  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24109
+        Upstream V8 Script abstractions, all except ScriptController.
+
+        * bindings/v8/ScriptCachedFrameData.h: Added.
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::~ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::restore):
+        (WebCore::ScriptCachedFrameData::clear):
+        (WebCore::ScriptCachedFrameData::domWindow):
+        * bindings/v8/ScriptCallFrame.cpp: Added.
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        (WebCore::ScriptCallFrame::~ScriptCallFrame):
+        (WebCore::ScriptCallFrame::argumentAt):
+        * bindings/v8/ScriptCallFrame.h: Added.
+        (WebCore::ScriptCallFrame::functionName):
+        (WebCore::ScriptCallFrame::sourceURL):
+        (WebCore::ScriptCallFrame::lineNumber):
+        (WebCore::ScriptCallFrame::argumentCount):
+        * bindings/v8/ScriptCallStack.cpp: Added.
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        (WebCore::ScriptCallStack::~ScriptCallStack):
+        (WebCore::ScriptCallStack::at):
+        * bindings/v8/ScriptCallStack.h: Added.
+        (WebCore::ScriptCallStack::size):
+        * bindings/v8/ScriptInstance.cpp: Added.
+        (WebCore::V8ScriptInstance::V8ScriptInstance):
+        (WebCore::V8ScriptInstance::~V8ScriptInstance):
+        (WebCore::V8ScriptInstance::instance):
+        (WebCore::V8ScriptInstance::clear):
+        (WebCore::V8ScriptInstance::set):
+        * bindings/v8/ScriptInstance.h: Added.
+        (WebCore::V8ScriptInstance::create):
+        * bindings/v8/ScriptSourceCode.h: Added.
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        (WebCore::ScriptSourceCode::isEmpty):
+        (WebCore::ScriptSourceCode::source):
+        (WebCore::ScriptSourceCode::url):
+        (WebCore::ScriptSourceCode::startLine):
+        * bindings/v8/ScriptState.h: Added.
+        (WebCore::ScriptState::hadException):
+        (WebCore::ScriptState::setException):
+        (WebCore::ScriptState::exception):
+        * bindings/v8/ScriptString.h: Added.
+        (WebCore::ScriptString::ScriptString):
+        (WebCore::ScriptString::operator String):
+        (WebCore::ScriptString::isNull):
+        (WebCore::ScriptString::size):
+        (WebCore::ScriptString::operator=):
+        (WebCore::ScriptString::operator+=):
+        * bindings/v8/ScriptValue.cpp: Added.
+        (WebCore::ScriptValue::getString):
+        * bindings/v8/ScriptValue.h: Added.
+        (WebCore::ScriptValue::ScriptValue):
+        (WebCore::ScriptValue::operator=):
+        (WebCore::ScriptValue::operator==):
+        (WebCore::ScriptValue::operator!=):
+        (WebCore::ScriptValue::isNull):
+        (WebCore::ScriptValue::isUndefined):
+        (WebCore::ScriptValue::clear):
+        (WebCore::ScriptValue::~ScriptValue):
+        (WebCore::ScriptValue::v8Value):
+
+2009-02-23  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24106
+        The Qt port is crashing on exit because the tear down procedure involves
+        the WebCore::InspectorController trying to access the JS execution context
+        for a page that is being deleted.  This patch amends the inspector so
+        that it does not try and access the execution context of the WebCore::Page
+        in the midst of deletion.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::inspectedPageDestroyed):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+
+2009-02-23  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 24088: ThreadableLoaderClient::didFailWillSendRequestCheck isn't wired up completely for workers and could use a better name.
+        <https://bugs.webkit.org/show_bug.cgi?id=24088>
+
+        No observable change in behavior, so no test.
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::create):
+        * loader/ThreadableLoaderClient.h:
+        (WebCore::ThreadableLoaderClient::didFailRedirectCheck):
+        * loader/ThreadableLoaderClientWrapper.h:
+        (WebCore::ThreadableLoaderClientWrapper::didFailRedirectCheck):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::workerContextDidFailRedirectCheck):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFailRedirectCheck):
+        * loader/WorkerThreadableLoader.h:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::didFinishLoading):
+        * xml/XMLHttpRequest.h:
+
+2009-02-23  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 24047: Need to simplify nested if's in WorkerRunLoop::runInMode
+        <https://bugs.webkit.org/show_bug.cgi?id=24047>
+
+        Made a nested if inside of WorkerRunLoop::runInMode a lot simpler by
+        using only MessageQueue::waitForMessageFilteredWithTimeout instead
+        of three different MessageQueue methods.
+
+        No observable change in behavior, so no test.
+
+        * dom/WorkerRunLoop.cpp:
+        (WebCore::ModePredicate::operator()):
+        Minor clean-up to able to pass a const ref point for ModePredicate into runInMode.
+        (WebCore::WorkerRunLoop::runInMode):
+        * dom/WorkerRunLoop.h:
+
+2009-02-23  David Hyatt  <hyatt@apple.com>
+
+        In preparation for making layers for multicol objects (so that they can properly split child layers
+        into multiple columns), rename all of the "overflowOnly" and "overflowList" members and functions
+        of RenderLayer to use the term "normal flow" instead.
+
+        Reviewed by Cameron Zwarich
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::~RenderLayer):
+        (WebCore::RenderLayer::setHasVisibleContent):
+        (WebCore::RenderLayer::enclosingCompositingLayer):
+        (WebCore::RenderLayer::addChild):
+        (WebCore::RenderLayer::removeChild):
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::dirtyNormalFlowList):
+        (WebCore::RenderLayer::updateNormalFlowList):
+        (WebCore::RenderLayer::collectLayers):
+        (WebCore::RenderLayer::updateLayerListsIfNeeded):
+        (WebCore::RenderLayer::shouldBeNormalFlowOnly):
+        (WebCore::RenderLayer::styleChanged):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::isNormalFlowOnly):
+        (WebCore::RenderLayer::normalFlowList):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeLayers):
+
+2009-02-23  David Hyatt  <hyatt@apple.com>
+
+        Fix the stacking order for column rules in multi-column layout.  Column rules should paint as part of the background of an element, just
+        after all other components of the background have been painted.  This allows negative z-index children to still paint on top of the
+        column rules (rather than ending up above the background of the box but behind the column rules).
+
+        Reviewed by Eric Seidel
+
+        Added fast/multicol/column-rules-stacking.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintColumnRules):
+        (WebCore::RenderBlock::paintColumnContents):
+        (WebCore::RenderBlock::paintObject):
+        * rendering/RenderBlock.h:
+
+2009-02-23  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by David Hyatt.
+
+        No testcases have been added or modified since this patch should not result in
+        a behavior change for ports that have layout tests enabled.
+
+        Currently, the implementation of GraphicsContext::drawLineForText amongst
+        the various ports differ in that some of them are honoring the context's
+        strokeStyle when drawing a text-decoration and some of them are not.
+        For instance, Apple's Mac port *does not* honor the context's strokeStyle(),
+        but the Cairo implementation does and has an explicit workaround that
+        sets the strokeStyle() temporarily.
+
+        This patch fixes so that all ports are consistent by explicitly making sure
+        to set the GraphicsContext strokeStyle to SolidStroke whenever
+        painting the text-decoration of an InlineFlowBox or InlineTextBox as these
+        should always use a solid stroke.
+
+        This patch addresses these bugs:
+        https://bugs.webkit.org/show_bug.cgi?id=19364
+        https://bugs.webkit.org/show_bug.cgi?id=15659
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintTextDecorations):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintDecoration):
+
+2009-02-23  Scott Violet  <sky@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24098
+        Bugs in ClipboardChromium
+
+        Fixes the following bugs in ClipboardChromium:
+        * It's possible for the extension to be empty, resulting in a bad file
+          name, for example, 'foo.' or just '.'.
+        * We weren't restricting the size of the file to MAX_PATH.
+        * We weren't removing characters that are invalid for file system names.
+
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::writeImageToDataObject):
+        * platform/chromium/ClipboardChromium.h:
+        * platform/chromium/ClipboardChromiumLinux.cpp: Added.
+        (WebCore::ClipboardChromium::validateFileName):
+        * platform/chromium/ClipboardChromiumMac.cpp: Added.
+        (WebCore::ClipboardChromium::validateFileName):
+        * platform/chromium/ClipboardChromiumWin.cpp: Added.
+        (WebCore::isInvalidFileCharacter):
+        (WebCore::ClipboardChromium::validateFileName):
+
+2009-02-23  Thiago Macieira  <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the Copyright notices in a few files
+
+        * platform/qt/RenderThemeQt.h:
+
+2009-02-23  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22624
+        [SOUP][GTK] Need API to get SoupSession from WebKit.
+
+        Allow to retrieve the Soup session and modify the code to take
+        into account users changing features on it.
+
+        * platform/network/ResourceHandle.h:
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::defaultCookieJar):
+        (WebCore::setDefaultCookieJar):
+        * platform/network/soup/CookieJarSoup.h:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::createSoupSession):
+        (WebCore::ensureSessionIsInitialized):
+        (WebCore::ResourceHandle::startHttp):
+        (WebCore::ResourceHandle::cancel):
+        (WebCore::ResourceHandle::defaultSession):
+
+2009-02-23  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22624
+        [SOUP][GTK] Need API to get SoupSession from WebKit.
+
+        Remove CURL support.
+
+        * GNUmakefile.am:
+
+2009-02-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Test: fast/dom/empty-hash-and-search.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=21147
+        hash property returns incorrect value for links w/o hash
+
+        Make hash() and search() behavior for empty and missing parts match IE and Firefox.
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::query): Changed to return query without '?', as it is already done for ref().
+        (WebCore::KURL::prettyURL): Append the query with the question mark.
+
+        * page/Location.cpp:
+        (WebCore::Location::search): Return an empty string if query is empty or missing.
+        (WebCore::Location::hash): Return an empty string for empty hashes, not only missing ones.
+
+        * dom/WorkerLocation.cpp:
+        (WebCore::WorkerLocation::search):
+        (WebCore::WorkerLocation::hash):
+        Match document.location fixes above.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::hash):
+        (WebCore::HTMLAnchorElement::search):
+        Return an empty string for empty and missing parts.
+
+2009-02-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20184
+        SELECT with no name generates invalid query string
+
+        Test: fast/forms/select-no-name.html
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::appendFormData): Added a check for empty name.
+
+2009-02-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Apply review comments for the previous check-in (forgot to save the file, oops).
+
+        * dom/ContainerNode.cpp: (WebCore::ContainerNode::removeChildren):
+
+2009-02-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15707
+        Crash when manipulating document from within an iframe onload function
+
+        Test: fast/dom/onload-open.html
+
+        * dom/ContainerNode.cpp: (WebCore::ContainerNode::removeChildren): Protect the container and
+        the current node, because anything can happen when dispatching events.
+
+2009-02-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18970
+        Numerically named input fields cause document.forms loop problems
+
+        Test: fast/forms/numeric-input-name.html
+
+        * bindings/scripts/CodeGeneratorJS.pm: Try index getter before name getter, even if the
+        latter overrides properties.
+
+2009-02-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24059
+        Tokenizer::write() return value is never used
+
+        * dom/Tokenizer.h:
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::write):
+        * dom/XMLTokenizer.h:
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::write):
+        * html/HTMLTokenizer.h:
+        * loader/FTPDirectoryDocument.cpp:
+        (WebCore::FTPDirectoryTokenizer::write):
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageTokenizer::write):
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaTokenizer::write):
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginTokenizer::write):
+        * loader/TextDocument.cpp:
+        (WebCore::TextTokenizer::write):
+        Made write() return void, not bool.
+
+2009-02-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Updated for JavaScriptCore changes to timeout checking.
+
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
+        (WebCore::JSDOMWindowBase::commonJSGlobalData):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSAbstractEventListener::handleEvent):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        (WebCore::WorkerScriptController::forbidExecution):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_Construct):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+
+2009-02-21  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23786
+        [Chromium] line-break characters in a complex text are treated as zero-width spaces
+
+        This change prevents the UniscribeHelper class from treating the line-break characters
+        as whitespaces.
+
+        Tests: fast/text/international/bidi-linebreak-001.html
+               fast/text/international/bidi-linebreak-002.html
+               fast/text/international/bidi-linebreak-003.html
+
+        * platform/graphics/chromium/UniscribeHelper.cpp:
+        (WebCore::UniscribeHelper::adjustSpaceAdvances):
+        Make the UniscribeHelper::adjustSpaceAdvances() function treat all characters in
+        the treatAsSpace() function (e.g. U+0020, U+000A, U+000D, U+00A0) as whitespaces,
+        so does when Chromium renders a simple text.
+
+2009-02-20  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23940: Use Document::createElement(const QualifiedName&, bool) when creating a known element inside WebCore
+
+        Document::createElement(const QualifiedName&, bool) does not check for the prefix as opposed the the one taking an AtomicString
+        or Document::createElementNS. This is perfectly fine internally because we know the type of element created and the check is
+        unneeded.
+
+        It also removes the use of an ExceptionCode argument which was here only to check that the prefix check was fine. Finally it
+        enables us to use some generated QualifiedName.
+
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::constructHTMLOptionElement):
+        * dom/Document.cpp:
+        (WebCore::Document::setTitle):
+        * dom/XMLTokenizer.cpp:
+        (WebCore::createXHTMLParserErrorHeader):
+        (WebCore::XMLTokenizer::insertErrorMessageBlock):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::createBlockPlaceholderElement):
+        * editing/htmlediting.cpp:
+        (WebCore::createTabSpanElement):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setLength):
+        * loader/FTPDirectoryDocument.cpp:
+        (WebCore::FTPDirectoryTokenizer::appendEntry):
+        (WebCore::FTPDirectoryTokenizer::createTDForFilename):
+        (WebCore::FTPDirectoryTokenizer::loadDocumentTemplate):
+        (WebCore::FTPDirectoryTokenizer::createBasicDocument):
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageDocument::createDocumentStructure):
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaTokenizer::createDocumentStructure):
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginTokenizer::createDocumentStructure):
+        * loader/TextDocument.cpp:
+        (WebCore::TextTokenizer::write):
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionComputedStyle):
+        (WebCore::Frame::styleForSelectionStart):
+        Document::createElement(const AtomicString&, ...) to Document::createElement(const QualifiedName&, ...) switch.
+
+        * xml/XPathFunctions.cpp:
+        (WebCore::XPath::FunLang::evaluate): Re-use langAttr instead of creating a new attribute.
+        * page/DragController.cpp:
+        (WebCore::documentFragmentFromDragData): Use the HTMLAnchorElement directly to get rid of the static cast.
+
+2009-02-19  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24060
+        Fix up to accommodate for CanvasPixelArray return.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::getImageData): Added an extra data() to call.
+        (WebCore::ImageBuffer::putImageData): Ditto.
+
+2009-02-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Simon Fraser
+
+        https://bugs.webkit.org/show_bug.cgi?id=24042
+        Bug 24042: MediaPlayer should cache plug-in proxy
+
+        The changes in https://bugs.webkit.org/show_bug.cgi?id=23917 assume that
+        MediaPlayer will always have created the private media player object before
+        the plug-in is instantiated and calls back with the proxy object. This is not
+        true on all platforms because of threading latency, so MediaPlayer should
+        cache the plug-in proxy so it can pass it to the media engine at a later time.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::setPoster): Null media engine implementation of proxy methods.
+        (WebCore::NullMediaPlayerPrivate::deliverNotification): Ditto.
+        (WebCore::NullMediaPlayerPrivate::setMediaPlayerProxy): Ditto.
+        (WebCore::MediaPlayer::MediaPlayer): Initialize m_playerProxy.
+        (WebCore::MediaPlayer::load): Pass m_playerProxy to newly created engine.
+        (WebCore::MediaPlayer::setMediaPlayerProxy): Cache m_playerProxy.
+        * platform/graphics/MediaPlayer.h: Declare m_playerProxy.
+
+2009-02-20  Eric Carlson  <eric.carlson@apple.com>
+
+        Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24063
+        Make it possible for a port to require a user gesture to play/pause an <audio> or <video> element
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement):  Rename m_loadRestrictions to m_Restrictions.
+        Initialize m_internalCall.
+        (WebCore::HTMLMediaElement::loadTimerFired): Increment m_internalCall around call to load().
+        (WebCore::HTMLMediaElement::load): Call loadInternal if restrictions check out.
+        (WebCore::HTMLMediaElement::loadInternal): New, guts of old load()
+        (WebCore::HTMLMediaElement::setNetworkState): Fix bug introduced in r40943
+        (WebCore::HTMLMediaElement::play): Call playInternal if restrictions check out.
+        (WebCore::HTMLMediaElement::playInternal): New, guts of old play()
+        (WebCore::HTMLMediaElement::pause): Call pauseInternal if restrictions check out.
+        (WebCore::HTMLMediaElement::pauseInternal): New, guts of old pause()
+        (WebCore::HTMLMediaElement::togglePlayState): Call playInternal/pauseInternal
+        (WebCore::HTMLMediaElement::deliverNotification): Remove unnecessary white space.
+        * html/HTMLMediaElement.h: Rename m_loadRestrictions to m_Restrictions, add m_internalCall,
+        add RequireUserGestureRateChangeRestriction.
+
+2009-02-20  Darin Fisher  <darin@chromium.org>
+
+        Fix build bustage in FileSystemWin.cpp.
+
+        Need to return CString() instead of 0 since there are now two CString
+        constructors that take a pointer type.
+
+        * platform/win/FileSystemWin.cpp:
+        (WebCore::openTemporaryFile):
+
+2009-02-20  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23999
+        Change license headers to accurately reflect code history.
+
+        * platform/ContentType.cpp:
+        * platform/ContentType.h:
+
+2009-02-18  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Antti Koivisto.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23999
+        Split off MIME type parsing into its own class.
+
+        * GNUmakefile.am: Added ContentType sources.
+        * WebCore.pro: Ditto.
+        * WebCore.scons: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+        * html/HTMLMediaElement.cpp: Changed to use ContentType.
+        (WebCore::HTMLMediaElement::selectMediaURL):
+        * platform/ContentType.cpp: Added.
+        (WebCore::ContentType::ContentType):
+        (WebCore::ContentType::parameter):
+        (WebCore::ContentType::type):
+        * platform/ContentType.h: Added.
+        (WebCore::ContentType::raw):
+        * platform/MIMETypeRegistry.cpp:
+        * platform/MIMETypeRegistry.h:
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::load):
+        * rendering/style/ContentData.h: Renamed ContentType to StyleContentType.
+        * rendering/style/RenderStyleConstants.h: Ditto.
+        (WebCore::):
+
+2009-02-20  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix.
+
+        Use CString() instead of 0.
+
+        * platform/gtk/FileSystemGtk.cpp:
+        (WebCore::openTemporaryFile):
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::openTemporaryFile):
+
+2009-02-20  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        When dealing with local files, use a path instead of an URI. GFile
+        has problems decoding URIs with percent signs on them.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startGio):
+
+2009-02-20  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Protect the ResourceHandle instance from being destroyed by
+        didReceiveData inside the GIO readCallback call, so that
+        cancelling caused by scripts is handled correctly.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::readCallback):
+
+2009-02-20  David Kilzer  <ddkilzer@apple.com>
+
+        Make IconDatabaseNone.cpp compile with -Wunused and pass check-for-exit-time-destructors
+
+        Reviewed by Sam Weinig.
+
+        * loader/icon/IconDatabaseNone.cpp:
+        (WebCore::IconDatabase::defaultDatabaseFilename): Use DEFINE_STATIC_LOCAL().
+        (WebCore::IconDatabase::open): Commented out unused parameter.
+        (WebCore::IconDatabase::setPrivateBrowsingEnabled): Ditto.
+        (WebCore::IconDatabase::iconForPageURL): Ditto.
+        (WebCore::IconDatabase::iconURLForPageURL): Ditto.
+        (WebCore::IconDatabase::defaultIcon): Ditto.
+        (WebCore::IconDatabase::retainIconForPageURL): Ditto.
+        (WebCore::IconDatabase::releaseIconForPageURL): Ditto.
+        (WebCore::IconDatabase::setIconDataForIconURL): Ditto.
+        (WebCore::IconDatabase::setIconURLForPageURL): Ditto.
+        (WebCore::IconDatabase::setEnabled): Ditto.
+        (WebCore::IconDatabase::pageURLMappingCount): Added stub.
+        (WebCore::IconDatabase::retainedPageURLCount): Ditto.
+        (WebCore::IconDatabase::iconRecordCount): Ditto.
+        (WebCore::IconDatabase::iconRecordCountWithData): Ditto.
+
+2009-02-20  David Kilzer  <ddkilzer@apple.com>
+
+        Add comment to generated code when shadowing a built-in object
+
+        Reviewed by Sam Weinig.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Added comment to
+        generated code output.
+
+2009-02-20  Avi Drissman  <avi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24036
+        Keyboard events need disambiguation on the Linux platform too.
+
+        * platform/chromium/PlatformKeyboardEventChromium.cpp:
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+
+2009-02-19  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24046
+
+        Several improvements to CString:
+        1- Make it possible to initialize a CString from a CStringBuffer
+        2- Make it possible to get a CStringBuffer from a CString
+        3- Change CStringBuffer::data() to return a const pointer to ward off mutation
+        4- Remove unused releaseBuffer() methods.
+        5- Make CStringBuffer::create() private to force consumers to get a CStringBuffer from a CString.
+
+        * platform/text/CString.cpp:
+        (WebCore::CString::init):
+        (WebCore::CString::mutableData):
+        (WebCore::CString::newUninitialized):
+        (WebCore::CString::copyBufferIfNeeded):
+        * platform/text/CString.h:
+        (WebCore::CStringBuffer::data):
+        (WebCore::CStringBuffer::length):
+        (WebCore::CStringBuffer::create):
+        (WebCore::CStringBuffer::mutableData):
+        (WebCore::CString::CString):
+        (WebCore::CString::buffer):
+
+2009-02-19  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24017
+        Remove some usage of Document in Worker.
+
+        * dom/WorkerContext.h:
+        (WebCore::WorkerContext::userAgent):
+        * dom/Document.cpp:
+        (WebCore::Document::userAgent):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.h:
+        Added virtual ScriptExecutionContext::userAgent(const KURL&).
+        Document implementation uses FrameLoader::userAgent and
+        WorkerContext receives the string on creation and stores it in a member.
+
+        * dom/Worker.cpp:
+        (WebCore::Worker::Worker):
+        (WebCore::Worker::notifyFinished):
+        * dom/Worker.h:
+        (WebCore::Worker::create):
+        Instead of Document the Worker constructor now gets a ScriptExecutionContext.
+        Start using some methods on SEC (like completeURL() and userAgent()).
+        For others, explicitly case to Document and add a FIXME.
+        Remove Worker::document() too.
+
+2009-02-20  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Rubber-stamped by Holger Freyther.
+
+        Do not set httpStatus to SOUP_STATUS_OK when serving local files
+        to match other ports' behavior, fixing xmlhttprequest test
+        regressions.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::queryInfoCallback):
+
+2009-02-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - WebCore part of fixing https://bugs.webkit.org/show_bug.cgi?id=24027
+          Do not send loader callbacks during CSS styling
+
+        Undo the iChat-specific quirk added in
+        <http://trac.webkit.org/changeset/41071>. Instead, always suspend memory
+        cache client callbacks during attach() and recalcStyle().
+
+        * WebCore.base.exp: Removed
+        Settings::setNeedsIChatMemoryCacheCallsQuirk().
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::suspendPostAttachCallbacks): Disable memory
+        cache client callbacks and remember to enable them afterwards if needed.
+        (WebCore::ContainerNode::resumePostAttachCallbacks): Re-enable memory
+        cache client callbacks if they were disabled in
+        suspendPostAttachCallbacks().
+        (WebCore::ContainerNode::attach): Use suspendPostAttachCallbacks() and
+        resumePostAttachCallbacks().
+        * dom/ContainerNode.h: Made suspendPostAttachCallbacks()
+        and resumePostAttachCallbacks() non-static.
+        * dom/Document.cpp:
+        (WebCore::Document::dispatchImageLoadEventsNow): Reverted iChat-specific
+        workaround.
+        * page/Settings.cpp: Removed m_needsIChatMemoryCacheCallsQuirk and
+        related code.
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+
+2009-02-19  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix.
+
+        Build fix after r41092. Make the memoryUsage method
+        public. It will be shadowed by cf/mac and for curl/soup/qt
+        the implementation from ResourceResponseBase will be used.
+
+        * platform/network/ResourceResponseBase.h:
+        (WebCore::ResourceResponseBase::memoryUsage):
+
+2009-02-19  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/6077775> Should be able to specify
+        inactive ::selection color
+
+        This patch makes the ::selction pseudo-element work with
+        the :window-inactive pseudo type. This was, a user can specify a
+        different ::selection style when a window is inactive.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkSelector):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::selectionBackgroundColor):
+        (WebCore::RenderObject::selectionForegroundColor):
+
+2009-02-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=24044
+        Update querySelector/querySelectorAll to match the latest spec
+
+        Update querySelector and querySelectorAll to match the latest version
+        of the Selectors API spec.  We now stringify null and undefined to "null"
+        and "undefined" respectively instead of to "".
+
+        Test: fast/dom/SelectorAPI/undefined-null-stringify.html
+
+        * dom/Document.idl:
+        * dom/DocumentFragment.idl:
+        * dom/Element.idl:
+
+2009-02-19  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23732
+        Rework CachedResource overhead accounting to allow platforms to diverge
+        in numbers.
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::overheadSize): Changed to ask ResourceResponse
+        for its size and to use actual URL size.
+        * platform/network/ResourceResponseBase.h:
+        (WebCore::ResourceResponseBase::size): Added default size method.
+        * platform/network/cf/ResourceResponse.h:
+        (WebCore::ResourceResponse::size): Added Win/CF size method
+        * platform/network/mac/ResourceResponse.h:
+        (WebCore::ResourceResponse::size): Added Mac size method.
+
+2009-02-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        - Fix for <rdar://problem/6604968>
+
+        On Tiger, create an autorelease pool before creating the NSGraphicsContext and drain it immediately
+        after the call to -[NSView displayRectIgnoringOpacity:inContext:].
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::paint):
+
+2009-02-19  David Hyatt  <hyatt@apple.com>
+
+        Fix a bug where reflections didn't work properly if opacity was < 1.  Make sure that replaced elements
+        also consider reflections to be part of their visual overflow.  This had already been done for blocks
+        and lines, but it wasn't being done yet for replaced elements.
+
+        Also make sure that when the object being reflected has opacity < 1 that we don't end up popping the outer
+        transparency layer early.  Since the reflected object paints twice, we don't want to end the transparency
+        layer it pushed until we're done painting the real object (rather than the reflection).
+
+        Reviewed by Dan Bernstein
+
+        Added fast/reflections/reflection-masks-opacity.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::layout):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::layout):
+        (WebCore::RenderReplaced::adjustOverflowForBoxShadowAndReflect):
+        * rendering/RenderReplaced.h:
+
+2009-02-19  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23980: WorkerRunLoop needs a way to run in a given mode similar to CFRunLoopInMode.
+        <https://bugs.webkit.org/show_bug.cgi?id=23980>
+
+        WorkerRunLoop has the ability to run in a mode which filters the tasks to be run.
+        * When WorkerRunLoop::runInMode is called, only task for that mode will run.
+        * When WorkerRunLoop::run is called (or the default mode is used), then all tasks
+          will run regardless of their posted mode.
+
+        Here's a demonstration of the api:
+
+            RefPtr<NameResolution> nameResolution = NameResolution::create(workerRunLoop);
+
+            //  Internally nameResolution will do workerRunLoop.postTaskForMode(task, "MyCoolMode")
+            //  for any tasks that need to be run during this loop.
+            nameResolution->setTaskMode("MyCoolMode");
+
+            nameResolution->start();
+            while (!nameResolution->done()) {
+                // Only tasks which are posted for "MyCoolMode" will run.
+                workerRunLoop.runInMode(context, "MyCoolMode");
+            }
+
+        No observable change in behavior, so no test.
+
+        * dom/WorkerRunLoop.cpp:
+        (WebCore::ModePredicate::ModePredicate):
+        (WebCore::ModePredicate::operator()):
+        (WebCore::WorkerRunLoop::WorkerRunLoop):
+        (WebCore::WorkerRunLoop::~WorkerRunLoop):
+        (WebCore::WorkerRunLoop::setSharedTimer):
+        (WebCore::WorkerRunLoop::resetSharedTimer):
+        (WebCore::WorkerRunLoop::run):
+        (WebCore::WorkerRunLoop::runInMode):
+        (WebCore::WorkerRunLoop::postTask):
+        (WebCore::WorkerRunLoop::postTaskForMode):
+        * dom/WorkerRunLoop.h:
+        (WebCore::WorkerRunLoop::Task::create):
+        (WebCore::WorkerRunLoop::Task::mode):
+        (WebCore::WorkerRunLoop::Task::performTask):
+        (WebCore::WorkerRunLoop::Task::Task):
+
+2009-02-19  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24034
+        Fix up Selection->VisibleSelection change.
+
+        * page/chromium/EventHandlerChromium.cpp:
+        (WebCore::EventHandler::passMousePressEventToSubframe): Renamed Selection
+        to VisibleSelection.
+
+2009-02-19  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24041
+        Correct Skia type conversion issues, fix Chromium Linux build.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::Font::drawGlyphs): changed parameters to RGBA32, not WebCore::Color.
+
+2009-02-19  Jungshik Shin <jshin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20531
+        Chromium-part follow-up to the patch landed in r40636
+        for bug 20531.
+        Remove a static member function alternateFamilyName
+        from Chromium's Win/Linux ports of FontCache. In r40636,
+        alternateFamilyName was customized using #ifdef PLATFORM(WIN_OS).
+        So, there's no more need for the static member function per
+        platform.
+
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        * platform/graphics/chromium/FontCacheLinux.cpp:
+
+2009-02-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Call documentWillBecomeInactive() from Document::detach to ensure that
+        media elements are shut down, because they may be kept alive by references
+        from JS past document teardown.
+
+        documentWillBecomeInactive() calls  renderView()->willMoveOffscreen(), so no
+        need to do that in detach() as well.
+
+        We no longer need to call documentWillBecomeInactive() from ~Page() (which
+        was added for <https://bugs.webkit.org/show_bug.cgi?id=21116>), since this
+        supersedes that change.
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+        * page/Page.cpp:
+        (WebCore::Page::~Page):
+
+2009-02-19  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24028
+        Fix up Skia path changes.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::strokePath): Removed illegal indirection.
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::boundingBoxForCurrentStroke): Changed call name.
+
+2009-02-19  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Ignore ports on local URLs. This fixes a regression in
+        fast/loader/file-URL-with-port-number.html
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startGio):
+
+2009-02-19  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24011
+        KURL's setPort doesn't unset port if 0 is given
+
+        Make setPort remove port if 0 is given to it, as promised by the
+        comment in KURL's header.
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::setPort):
+
+2009-02-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        - WebCore part of fixing <rdar://problem/6507512> Crash in iChat at CSSStyleSelector::adjustRenderStyle
+
+        The crash results from re-entry into
+        CSSMutableStyleDeclaration::setCssText, which in turn is caused by
+        the first style change causing a cached image to load from the memory
+        cache, causing load delegate dispatch, and iChat's delegate method
+        calling back into WebKit.
+
+        The workaround is to use defer delegate callbacks for memory cache. In
+        this case, deferring callbacks during image load event dispatch was
+        found to be sufficient.
+
+        The crash is a regression. See also the discussion in
+        <https://bugs.webkit.org/show_bug.cgi?id=22521>.
+
+        * WebCore.base.exp: Added
+        Settings::setNeedsIChatMemoryCacheCallsQuirk().
+        * dom/Document.cpp:
+        (WebCore::Document::dispatchImageLoadEventsNow): If the quirk is
+        enabled, defer memory cache callbacks during image load event dispatch.
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Initialize
+        m_needsIChatMemoryCacheCallsQuirk.
+        (WebCore::Settings::setNeedsIChatMemoryCacheCallsQuirk): Added this
+        setter.
+        * page/Settings.h:
+        (WebCore::Settings::needsIChatMemoryCacheCallsQuirk): Added this getter.
+
+2009-02-18  Adam Roben  <aroben@apple.com>
+
+        Export WebCore::handCursor and Cursor.h
+
+        Reviewed by John Sullivan.
+
+        * WebCore.base.exp: Added WebCore::handCursor.
+        * WebCore.xcodeproj/project.pbxproj: Made Cursor.h private.
+
+2009-02-18  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23992
+        REGRESSION: crash on windows loading http://www.stickam.com/liveStreams.do
+
+        Unable to reduce to a layout test.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::contentRenderer):
+
+2009-02-18  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23861
+        Stroke font outlines on chromium linux
+
+        TEST=LayoutTests/svg/custom/pointer-events-text.svg
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2009-02-18  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23860
+        Resync some graphics/skia files with their chromium counterparts
+
+        This comes from chromium patches <http://codereview.chromium.org/17633>
+        and <http://codereview.chromium.org/17454>
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::clipPath):
+        (WebCore::GraphicsContext::fillPath):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::addPath):
+        (PlatformContextSkia::currentPath):
+        * platform/graphics/skia/PlatformContextSkia.h:
+
+2009-02-18  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Unreviewed.
+
+        Build fix after r41060.
+
+        * GNUmakefile.am:
+
+2009-02-18  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=24005
+        Add an include to fix Chromium build.
+
+        * page/animation/AnimationController.cpp: Add UnusedParam.h include.
+
+2009-02-18  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        Fix symbols.filter location, and add other missing files to the
+        autotools build, so that make dist works.
+
+        * GNUmakefile.am:
+
+2009-02-18  Zan Dobersek  <zandobersek@gmail.com>
+
+        Rubber-stamped by Holger Hans Peter Freyther.
+
+        Allow POST method for local requests.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startGio):
+
+2009-02-18  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Hans Peter Freyther.
+
+        Use KURL in startGio instead of passing a string with the URL, so
+        that we can handle removing refs and queries more elegantly. This
+        is fixing more regressions that came from the curl->soup switch.
+
+        Original work by Zan Dobersek.
+
+        * platform/network/ResourceHandle.h:
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::startGio):
+
+2009-02-18  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Implement ResourceHandle::loadResourceSynchronously in ResourceHandleSoup.cpp
+
+        The implementation is needed to have synchronous loading, e.g. for
+        JavaScript interaction. This is fixing various regressions that
+        came from the curl->soup switch.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::WebCoreSynchronousLoader::WebCoreSynchronousLoader):
+        (WebCore::WebCoreSynchronousLoader::~WebCoreSynchronousLoader):
+        (WebCore::WebCoreSynchronousLoader::didReceiveResponse):
+        (WebCore::WebCoreSynchronousLoader::didReceiveData):
+        (WebCore::WebCoreSynchronousLoader::didFinishLoading):
+        (WebCore::WebCoreSynchronousLoader::didFail):
+        (WebCore::WebCoreSynchronousLoader::run):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+
+2009-02-18  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23989
+
+        Based on a patch by Bo Yang  <techrazy.yang@gmail.com>
+
+        Make the cursor cache global, that's all we really need and
+        otherwise we can miss cursor transitions in some situations (see
+        the bug for one testcase). Also remove some now useless code.
+
+        * platform/Widget.h:
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::~Widget):
+        (WebCore::Widget::setCursor):
+
+2009-02-17  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * loader/FrameLoader.cpp:
+        (WebCore::toPlugInElement): Don't rely on #if being processed before
+        ASSERT.
+
+2009-02-17  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23977: Unnecessary timer related headers in files.
+        <https://bugs.webkit.org/show_bug.cgi?id=23977>
+
+        No observable change in behavior, so no test.
+
+        * dom/Document.cpp:
+        * dom/WorkerRunLoop.cpp:
+        * dom/WorkerRunLoop.h:
+
+2009-02-17  Peter Abrahamsen  <rainhead@gmail.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23958
+        <rdar://problem/6587815>
+
+        Updated XMLHttpRequest with new header names from the latest Access
+        Control draft: http://www.w3.org/TR/access-control/
+        - Access-Control-Origin becomes Access-Control-Allow-Origin
+        - Access-Control-Credentials becomes Access-Control-Allow-Credentials
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::accessControlCheck):
+
+2009-02-17  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Add missing constructor used for empty values.
+
+        * platform/graphics/wx/FontPlatformData.h:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2009-02-17  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+
+        <rdar://problem/6592446> dynamically updating page doesn't seem to draw when updated
+
+        Need update after callback.
+
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+
+2009-02-17  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23917
+        Allow a WebKit plug-in to act as a proxy for the <audio> and <video>
+        element.
+
+        * DerivedSources.make: add media element proxy exports to .exp file when feature is defined.
+
+        * WebCore.VideoProxy.exp: New, define the informal protocol exported by a media element proxy.
+
+        * WebCore.xcodeproj/project.pbxproj: Add MediaPlayerProxy.h.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize m_needWidgetUpdate.
+        (WebCore::HTMLMediaElement::attributeChanged): Don't detach+attach when PLUGIN_PROXY_FOR_VIDEO, the
+        proxy plug-in handles the poster frame.
+        (WebCore::HTMLMediaElement::rendererIsNeeded): New logic for PLUGIN_PROXY_FOR_VIDEO.
+        (WebCore::HTMLMediaElement::createRenderer): Create RenderPartObject when PLUGIN_PROXY_FOR_VIDEO.
+        (WebCore::HTMLMediaElement::attach): Set m_needWidgetUpdate when PLUGIN_PROXY_FOR_VIDEO
+        (WebCore::HTMLMediaElement::load): Don't reallocate MediaPlayer when PLUGIN_PROXY_FOR_VIDEO, we keep the
+        same plug-in for the life of the element.
+        (WebCore::HTMLMediaElement::mediaPlayerNetworkStateChanged): update m_networkState when media player
+        network state changes to EMPTY, otherwise we can get out of sync with engine.
+        (WebCore::HTMLMediaElement::defaultEventHandler): pass event to widget when PLUGIN_PROXY_FOR_VIDEO
+        (WebCore::HTMLMediaElement::deliverNotification): New, deliver notification from proxy plug-in to
+        media player.
+        (WebCore::HTMLMediaElement::setMediaPlayerProxy): New, pass proxy object to media player.
+        (WebCore::HTMLMediaElement::initialURL): New, return the url from the "src" attr or the appropriate
+        <source> element to be used as the initial url for the proxy.
+        (WebCore::HTMLMediaElement::finishParsingChildren): New, allocate MediaPlayer and update widget.
+        * html/HTMLMediaElement.h: Declare new methods for proxy, add m_needWidgetUpdate.
+        (WebCore::HTMLMediaElement::setNeedWidgetUpdate):
+
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::attach): Poster image is handled by proxy when PLUGIN_PROXY_FOR_VIDEO.
+        (WebCore::HTMLVideoElement::parseMappedAttribute): Ditto.
+        * html/HTMLVideoElement.h:
+
+        * loader/FrameLoader.cpp:
+        (WebCore::toPlugInElement): Allow cast if element is <video> or <audio>
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::MediaPlayer): Remove white space.
+        (WebCore::MediaPlayer::setPoster): New, forward call to private player.
+        (WebCore::MediaPlayer::deliverNotification): Ditto.
+        (WebCore::MediaPlayer::setMediaPlayerProxy): Ditto.
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayer::mediaPlayerClient):
+
+        * platform/graphics/mac/MediaPlayerProxy.h: New, defines media player proxy interface.
+
+        * rendering/RenderPart.cpp:
+        (WebCore::RenderPart::RenderPart): Change constructor to take Element* instead of Node* as a
+        non-element node doesn't need a renderer
+        * rendering/RenderPart.h: Ditto.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::RenderPartObject): Ditto.
+        (WebCore::RenderPartObject::updateWidget): Package params for proxy plug-in when element is
+        <video> or <audio>.
+        * rendering/RenderPartObject.h:
+
+2009-02-17  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Seidel
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23985
+
+        Don't allow legends to be anything but display:block.
+
+        Added fast/forms/inline-ignored-on-legend.html
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/html4.css:
+        * html/HTMLLegendElement.cpp:
+        * html/HTMLLegendElement.h:
+        * rendering/RenderLegend.cpp: Removed.
+        * rendering/RenderLegend.h: Removed.
+        * wml/WMLInsertedLegendElement.cpp:
+        * wml/WMLInsertedLegendElement.h:
+
+2009-02-13  Brett Wilson  <brettw@dhcp-172-22-71-167.mtv.corp.google.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/attachment.cgi?id=27666
+        Fix Chromium build build: forgotten include in RenderObject, sync
+        RenderTheme to the recent changes in RenderObject.
+
+        * rendering/RenderObject.cpp:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::updatePressedState):
+
+2009-02-17  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22966
+        crash when destroying a webview that opened a page containing <script>
+        tags
+
+        Fix m_group being set to 0 instead of to m_singlePageGroup when
+        GroupName is set to empty
+
+        * page/Page.cpp:
+        (WebCore::Page::setGroupName):
+
+2009-02-16  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for <rdar://problem/6386623>
+
+        I made m_numParsedProperties and m_maxParsedProperties unsigned
+        instead of int, and then added an early return from addPropery() if
+        m_maxParsedProperties exceeds the max value.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::addProperty):
+        (WebCore::CSSParser::rollbackLastProperties):
+        (WebCore::CSSParser::clearProperties):
+        (WebCore::CSSParser::createFontFaceRule):
+        (WebCore::CSSParser::deleteFontFaceOnlyValues):
+        * css/CSSParser.h:
+
+2009-02-16  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16309
+        HTML5: The third execCommand argument for insert{un}orderedlist should be ignored
+
+        When we originally implemented this command, MSDN documentation said that IE set the
+        id attribute of inserted lists to the third argument to execCommand, but IE doesn't
+        do this nor do any other browsers.
+
+        * editing/EditorCommand.cpp:
+        (WebCore::executeInsertOrderedList):
+        (WebCore::executeInsertUnorderedList):
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::outdentParagraph):
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::insertList):
+        (WebCore::InsertListCommand::InsertListCommand):
+        (WebCore::InsertListCommand::doApply):
+        * editing/InsertListCommand.h:
+        (WebCore::InsertListCommand::create):
+
+2009-02-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        - fix <rdar://problem/6561077> REGRESSION (r39634): Unable to select an item in stocks widget with the mouse
+
+        Test: platform/mac/fast/events/pointer-events-dashboard.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty): Do not apply the
+        pointer-events property in Dashboard backwards compatibility mode,
+        in order to work around misuse of that property by the Stocks widget.
+
+2009-02-16  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15381
+        execCommand justify modifies the contentEditable node
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::moveParagraphContentsToNewBlockIfNecessary): Avoid modifying not just
+        the body element, but any root editable element.
+
+2009-02-16  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Bug 23979: AX: alt tag not returned for <input type="image">
+        https://bugs.webkit.org/show_bug.cgi?id=23979
+
+        Test: accessibility/input-image-alt.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+
+2009-02-16  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        The ref data is not properly set unless we use the CreateMatrix function.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23978
+
+        * platform/graphics/wx/TransformationMatrixWx.cpp:
+        (WebCore::TransformationMatrix::operator wxGraphicsMatrix):
+
+2009-02-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - fix <rdar://problem/6516829> FontPlatformData constructor passes NULL to CTFontCopyGraphicsFont and CTFontGetPlatformFont
+
+        * platform/graphics/FontCache.cpp:
+        (WebCore::FontDataCacheKeyTraits::emptyValue): Changed to use the
+        FontPlatformData(float, bool, bool) constructor.
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore::FontCache::createFontPlatformData): Changed to pass a valid
+        NSFont to the FontPlatformData constructor, instead of implicitly
+        passing 0 and then calling setFont().
+        * platform/graphics/mac/FontPlatformData.h: Made the NSFont parameter
+        of the constructor mandatory.
+
+2009-02-15  David Kilzer  <ddkilzer@apple.com>
+
+        Move duplicate caretWidth constants to RenderObject.h
+
+        Reviewed by Dan Bernstein.
+
+        No test since no change in behavior.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::localCaretRect): Removed caretWidth.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::localCaretRect): Ditto.
+        * rendering/RenderObject.h: Added caretWidth definition.
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::localCaretRect): Removed caretWidth.
+
+2009-02-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23955
+        V8HTMLPlugInCustom returns undefined, which fools interceptors.
+
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp:
+        (WebCore::NAMED_PROPERTY_GETTER): Use deferToInterceptor() return value.
+        (WebCore::NAMED_PROPERTY_SETTER): Ditto.
+        (WebCore::INDEXED_PROPERTY_GETTER): Ditto.
+        (WebCore::INDEXED_PROPERTY_SETTER): Ditto.
+
+2009-02-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23954
+        Add V8 custom bindings for CanvasRenderingContext2D.
+
+        * bindings/v8/custom/V8CanvasRenderingContext2DCustom.cpp: Added.
+        (WebCore::toV8):
+        (WebCore::toCanvasStyle):
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-02-13  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler and Dan Bernstein.
+
+        <rdar://problem/6583187>
+
+        * page/NavigatorBase.cpp:
+        Handle PPC64 and X86_64 as well.
+
+2009-02-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix broken tokenizer regression test that reflected a lifetime bug
+        in the document.write optimization. The test failure was trivial to
+        reproduce in COLLECT_ON_EVERY_ALLOCATION mode.
+
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::documentWrite): Convert strings to String rather than passing
+        the pointer and length to SegmentedString. The optimization is thus
+        mostly gone. However, there are two ways to bring it back: 1) Apply
+        the patch that makes UString and String share the same buffers.
+        2) Add a UString feature to SegmentedString; simple to do but might
+        risk slowing down normal document parsing.
+
+2009-02-13  Adam Treat  <adam.treat@torchmobile.com>
+
+        Caught by Darin Adler.
+
+        No reason to check m_tokenizer twice for 0 in a row.
+
+        * dom/Document.cpp:
+        (WebCore::Document::write):
+
+2009-02-13  Lyon Chen  <lyon.chen@torchmobile.com>
+
+        Reviewed by Dave Hyatt.
+
+        Take into account y() + height() when calculating getLowerRightCorner.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::getLowerRightCorner):
+
+2009-02-13  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Most of this code was in RenderBox, restore the copyright lines.
+
+        * rendering/RenderBoxModelObject.cpp:
+        * rendering/RenderBoxModelObject.h:
+
+2009-02-13  David Hyatt  <hyatt@apple.com>
+
+        Get rid of printBoxDecorations, since it is dead code.
+
+        Reviewed by Dan Bernstein
+
+        * rendering/RenderObject.h:
+
+2009-02-13  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23952
+        Add Document::write overload which takes a SegmentedString since this
+        is what the tokenizer expects anyway.  Modified JSHTMLDocument so it once
+        again calls Document::write instead of injecting the string directly into
+        the tokenizer.  This ensures that all document.write's are funneled through
+        one method again, but should still be just as fast for JSHTMLDocumentCustom.
+
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::documentWrite):
+        * dom/Document.cpp:
+        (WebCore::Document::write):
+        * dom/Document.h:
+
+2009-02-13  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser
+
+        Remove updateWidgetPosition on RenderObject.  Change RenderView's set of widgets
+        to have a tighter type: RenderWidget instead of RenderObject.  Devirtualize
+        updateWidgetPosition, since all RenderWidgets (except for applets) are now
+        RenderParts also.
+
+        * rendering/RenderObject.cpp:
+        * rendering/RenderObject.h:
+        * rendering/RenderPart.cpp:
+        * rendering/RenderPart.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::updateWidgetPositions):
+        (WebCore::RenderView::addWidget):
+        (WebCore::RenderView::removeWidget):
+        * rendering/RenderView.h:
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::updateWidgetPosition):
+        * rendering/RenderWidget.h:
+
+2009-02-13  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Seidel
+
+        Remove isEditable() on RenderObject.  It is dead code.
+
+        * rendering/RenderObject.cpp:
+        * rendering/RenderObject.h:
+
+2009-02-13  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Seidel
+
+        Add isTextControl() to RenderObject.  Patch call sites thats asked isTextField() || isTextArea() to just use
+        isTextControl() instead.
+
+        Add a toRenderTextControl converter for doing checked casting to RenderTextControls.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::updateSelectionRange):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment):
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::handleReplacedElement):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::selectionStart):
+        (WebCore::HTMLInputElement::selectionEnd):
+        (WebCore::HTMLInputElement::setSelectionStart):
+        (WebCore::HTMLInputElement::setSelectionEnd):
+        (WebCore::HTMLInputElement::select):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::selection):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::selectionStart):
+        (WebCore::HTMLTextAreaElement::selectionEnd):
+        (WebCore::HTMLTextAreaElement::setSelectionStart):
+        (WebCore::HTMLTextAreaElement::setSelectionEnd):
+        (WebCore::HTMLTextAreaElement::select):
+        (WebCore::HTMLTextAreaElement::setSelectionRange):
+        (WebCore::HTMLTextAreaElement::appendFormData):
+        (WebCore::HTMLTextAreaElement::updateValue):
+        (WebCore::HTMLTextAreaElement::selection):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isNativeTextControl):
+        (WebCore::AccessibilityRenderObject::text):
+        (WebCore::AccessibilityRenderObject::selectedText):
+        (WebCore::AccessibilityRenderObject::selectedTextRange):
+        (WebCore::AccessibilityRenderObject::setSelectedTextRange):
+        (WebCore::AccessibilityRenderObject::visiblePositionForIndex):
+        (WebCore::AccessibilityRenderObject::indexForVisiblePosition):
+        (WebCore::AccessibilityRenderObject::observableObject):
+        * page/Frame.cpp:
+        (WebCore::Frame::notifyRendererOfSelectionChange):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isTextControl):
+        (WebCore::objectIsRelayoutBoundary):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::isTextControl):
+        (WebCore::toRenderTextControl):
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::TextControlInnerTextElement::defaultEventHandler):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::select):
+        (WebCore::WMLInputElement::defaultEventHandler):
+        (WebCore::WMLInputElement::isConformedToInputMask):
+
+2009-02-13  David Hyatt  <hyatt@apple.com>
+
+        Get rid of isEdited/setEdited on RenderObject.  Devirtualize isEdited/setEdited on RenderTextControl.
+        Callers were already asking if the renderer was a text field (or a text area), so it was especially
+        pointless to waste a second virtual function call after making one just to determine the object type.
+
+        Reviewed by Simon Fraser
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * rendering/RenderObject.h:
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::isEdited):
+        (WebCore::RenderTextControl::setEdited):
+
+2009-02-13  Scott Violet  <sky@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23934
+        Skia platform doesn't render text decoration shadows.
+
+        Makes Skia render text decoration shadows correctly. We weren't
+        preparing the SkPaint correctly and didn't have a couple of checks
+        CG has. Additionally makes the fillColor/strokeColor methods
+        consistent.
+
+        This behavior is covered by existing layout tests (see bug for list).
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::drawLineForText):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::effectiveFillColor):
+        (PlatformContextSkia::effectiveStrokeColor):
+        * platform/graphics/skia/PlatformContextSkia.h:
+
+2009-02-12  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23944
+        KURLGoogle's pre-parsed canonicalSpec constructor should take a CString
+
+        * platform/KURL.h:
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURLGooglePrivate::setUtf8):
+        (WebCore::KURLGooglePrivate::setAscii):
+        (WebCore::KURLGooglePrivate::init):
+        (WebCore::KURLGooglePrivate::replaceComponents):
+        (WebCore::KURL::KURL):
+        * platform/KURLGooglePrivate.h:
+
+2009-02-13  David Hyatt  <hyatt@apple.com>
+
+        Remove leftmost/rightmost/lowestPosition from RenderObject.  They only need to be called on boxes.
+
+        Reviewed by Dan Bernstein
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::computeScrollDimensions):
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::lowestPosition):
+        (WebCore::RenderMedia::rightmostPosition):
+        (WebCore::RenderMedia::leftmostPosition):
+        * rendering/RenderObject.h:
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::lowestPosition):
+        (WebCore::RenderTableSection::rightmostPosition):
+        (WebCore::RenderTableSection::leftmostPosition):
+
+2009-02-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix build with ACCELERATED_COMPOSITING turned on.
+
+        toRenderBox()->x() asserts for a layer on an inline; use
+        m_owningLayer->renderBoxX() instead.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+
+2009-02-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Speed up document.write a bit.
+
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::documentWrite): Added. Uses SegmentedString to avoid conversion from
+        UString to String and to avoid appending strings. Also added code to handle
+        newlines efficiently.
+        (WebCore::JSHTMLDocument::write): Changed to use documentWrite.
+        (WebCore::JSHTMLDocument::writeln): Ditto.
+
+        * dom/Document.cpp:
+        (WebCore::Document::prepareToWrite): Added. Refactored the initialization part
+        of write into a separate function for use in the JavaScript binding.
+        (WebCore::Document::write): Changed to call prepareToWrite.
+
+        * dom/Document.h: Added declaration for prepareToWrite.
+
+2009-02-13  Prasanth Ullattil  <pullatti@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fixes crash in the Qt port on Windows with comboboxes
+
+        The focusWidget in the input context is not reset properly.
+        The QApplication::setFocusWidget() wont reset the IC if the reason is
+        PopupFocusReason, this is not ideal. For the time being we are going
+        to do this from webkit itself.
+
+        * platform/qt/QWebPopup.cpp:
+        (WebCore::QWebPopup::hidePopup):
+
+2009-02-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix, typo while tweaking last patch for commit.
+
+        * platform/wx/wxcode/gtk/fontprops.cpp:
+        (GetTextExtent):
+
+2009-02-12  miggilin  <mr.diggilin@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Use Cairo/PANGO to fix text measurements and implement proper
+        non-kerned text drawing on wxGTK.
+
+        https://bugs.webkit.org/show_bug.cgi?id=17727
+
+        * platform/graphics/GlyphBuffer.h:
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::fontWeightToWxFontWeight):
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        * platform/wx/wxcode/fontprops.h:
+        * platform/wx/wxcode/gtk/fontprops.cpp:
+        (wxFontProperties::wxFontProperties):
+        (GetTextExtent):
+        * platform/wx/wxcode/gtk/non-kerned-drawing.cpp:
+        (WebCore::pangoFontMap):
+        (WebCore::createPangoFontForFont):
+        (WebCore::createScaledFontForFont):
+        (WebCore::pango_font_get_glyph):
+        (WebCore::drawTextWithSpacing):
+        * platform/wx/wxcode/non-kerned-drawing.h:
+
+2009-02-12  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser
+
+        https://bugs.webkit.org/show_bug.cgi?id=23942
+
+        Hook up 3D CSS transforms to the accelerated compositor backend.
+        Not enabled by default.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc):
+        (WebCore::ensurePropertyMap):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::updateTransitions):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::willNeedService):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::willNeedService):
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::TransformValueList::makeFunctionList):
+        (WebCore::GraphicsLayer::dumpProperties):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::copyTransform):
+        (WebCore::getValueFunctionNameForTransformOperation):
+        (WebCore::GraphicsLayerCA::animateTransform):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::updateBoxModelInfoFromStyle):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateTransform):
+        (WebCore::RenderLayer::hasTransformStyle3D):
+        (WebCore::RenderLayer::hasPerspective):
+        (WebCore::RenderLayer::perspectiveTransform):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayers):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::computeTransformOrigin):
+        (WebCore::RenderLayerBacking::computePerspectiveOrigin):
+        * rendering/RenderLayerBacking.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::has3DContent):
+        (WebCore::requiresCompositingLayerForTransform):
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+        (WebCore::RenderLayerCompositor::layerHas3DContent):
+        * rendering/RenderLayerCompositor.h:
+
+2009-02-12  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Eric Seidel
+
+        Get rid of containingBlockHeight(), since it had only one implementation (despite being virtual) and just returned
+        containingBlock()->availableHeight().  The latter reads better anyway.  Rename containingBlockWidth() to
+        containingBlockWidthForContent() and move it to RenderBoxModelObject.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::localCaretRect):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::containingBlockWidthForContent):
+        (WebCore::RenderBox::calcWidth):
+        (WebCore::RenderBox::calcReplacedWidthUsing):
+        * rendering/RenderBox.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::relativePositionOffsetX):
+        (WebCore::RenderBoxModelObject::relativePositionOffsetY):
+        (WebCore::RenderBoxModelObject::containingBlockWidthForContent):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::marginLeft):
+        (WebCore::RenderInline::marginRight):
+        * rendering/RenderObject.cpp:
+        * rendering/RenderObject.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::calcReplacedWidth):
+
+2009-02-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix non-Mac builds by adding Matrix3DTransformOperation.* and
+        PerspectiveTransformOperation.*. Cleaned out some cruft in
+        the WebCore.vcproj fle.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-02-12  David Smith  <catfish.man@gmail.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=23935
+        Nested :not() and non-simple selectors in :not() should be invalid
+
+        * css/CSSGrammar.y: Reject nested :not()
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): ASSERT() rather than checking, since the parser enforces it now
+
+2009-02-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes.
+
+        * WebCoreSources.bkl:
+
+2009-02-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix build with ACCELERATED_COMPOSITING turned on.
+
+        Need to cast toRenderBox() in order to call overflowClipRect().
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+
+2009-02-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix windows build.
+
+        * css/CSSParser.h:
+
+2009-02-12  David Hyatt  <hyatt@apple.com>
+
+        Rename getOverflowClipRect and getClipRect to overflowClipRect and clipRect.  Move them to RenderBox, since these methods
+        only apply to boxes.  Devirtualize clipRect, since it was not subclassed.  Move controlClip stuff to RenderBox also.
+
+        Reviewed by Simon Fraser
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::insideVisibleArea):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::overflowClipRect):
+        (WebCore::RenderBox::clipRect):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::hasControlClip):
+        (WebCore::RenderBox::controlClipRect):
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::paint):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::calculateClipRects):
+        (WebCore::RenderLayer::calculateRects):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::hasClip):
+        (WebCore::RenderObject::hasOverflowClip):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::overflowClipRect):
+        * rendering/RenderTable.h:
+
+2009-02-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix build with ACCELERATED_COMPOSITING turned on (simple copy/paste error)
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setBasicAnimation):
+
+2009-02-12  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Not reviewed.
+
+        Release build fix when VIDEO is disabled (it should also
+        help the builds with WORKERS or XSLT disabled).
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (jsDOMWindowBaseAudio): Added an UNUSED_PARAM for exec and slot when
+        VIDEO is disabled.
+        (jsDOMWindowBaseWorker): Ditto for WORKERS.
+        (jsDOMWindowBaseXSLTProcessor): Ditto for XSLT.
+
+2009-02-12  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23923
+        Implement mediaPlayerVolumeChanged so a media engine can report autonomous volume changes.
+        Supporting this requires that we know when we are processing a media engine callback so
+        we don't turn around and tell the media player to change the volume when it is reporting
+        a volume change.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): initialize m_processingMediaPlayerCallback
+        (WebCore::HTMLMediaElement::mediaPlayerNetworkStateChanged): call begin/endProcessingMediaPlayerCallback
+        (WebCore::HTMLMediaElement::setNetworkState): logic split out of mediaPlayerNetworkStateChanged
+        to make it easier to maintain m_processingMediaPlayerCallback.
+        (WebCore::HTMLMediaElement::mediaPlayerReadyStateChanged): call begin/endProcessingMediaPlayerCallback
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): Ditto.
+        (WebCore::HTMLMediaElement::mediaPlayerRepaint): Ditto.
+        (WebCore::HTMLMediaElement::mediaPlayerVolumeChanged): New
+        (WebCore::HTMLMediaElement::updateVolume): Don't change media engine volume if we are processing
+        a callback from the engine.
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::processingMediaPlayerCallback): New, return true if (m_processingMediaPlayerCallback>0)
+        (WebCore::HTMLMediaElement::beginProcessingMediaPlayerCallback): New, increment m_processingMediaPlayerCallback
+        (WebCore::HTMLMediaElement::endProcessingMediaPlayerCallback): New, decrement m_processingMediaPlayerCallback
+
+2009-02-12  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Support MPEG content on Mac and Windows.
+        <rdar://problem/5917509>
+        https://bugs.webkit.org/show_bug.cgi?id=23495
+
+        Test: media/audio-mpeg-supported.html
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::disableUnsupportedTracks):
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::disableUnsupportedTracks):
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h: fix typo added in r40925
+
+2009-02-12  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Move containsFloats, hasOverhangingFloats, shrinkToAvoidFloats and avoidsFloats down to
+        RenderBox, since these methods only apply to boxes.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::clearFloatsIfNeeded):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::clearFloats):
+        (WebCore::RenderBlock::markAllDescendantsWithFloatsForLayout):
+        (WebCore::RenderBlock::calcBlockPrefWidths):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::containsFloats):
+        (WebCore::RenderBlock::hasOverhangingFloats):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::shrinkToAvoidFloats):
+        (WebCore::RenderBox::avoidsFloats):
+        * rendering/RenderBox.h:
+        * rendering/RenderObject.cpp:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isFloatingOrPositioned):
+        * rendering/RenderView.h:
+
+2009-02-12  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23908
+
+        Added parsing of 3d transform functions and properties
+        (perspective, perspective-origin, transform-style-3d,
+        and backface-visibility).
+
+        Test: transforms/3d/cssmatrix-3d-interface.xhtml
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::computedTransform):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseFillProperty):
+        (WebCore::CSSParser::parseTransformOriginShorthand):
+        (WebCore::TransformOperationInfo::TransformOperationInfo):
+        (WebCore::CSSParser::parseTransform):
+        (WebCore::CSSParser::parseTransformOrigin):
+        (WebCore::CSSParser::parsePerspectiveOrigin):
+        * css/CSSParser.h:
+        * css/CSSPrimitiveValue.h:
+        (WebCore::CSSPrimitiveValue::isUnitTypeLength):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        (WebCore::convertToLength):
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::mapFillSize):
+        (WebCore::CSSStyleSelector::mapFillXPosition):
+        (WebCore::CSSStyleSelector::mapFillYPosition):
+        (WebCore::getTransformOperationType):
+        (WebCore::CSSStyleSelector::createTransformOperations):
+        * css/CSSValueKeywords.in:
+        * css/WebKitCSSTransformValue.cpp:
+        (WebCore::WebKitCSSTransformValue::cssText):
+        * css/WebKitCSSTransformValue.h:
+        (WebCore::WebKitCSSTransformValue::):
+        * css/WebKitCSSTransformValue.idl:
+        * platform/graphics/transforms/Matrix3DTransformOperation.cpp:
+        * platform/graphics/transforms/Matrix3DTransformOperation.h:
+        * platform/graphics/transforms/PerspectiveTransformOperation.cpp:
+        * platform/graphics/transforms/PerspectiveTransformOperation.h:
+        * platform/graphics/transforms/RotateTransformOperation.cpp:
+        (WebCore::RotateTransformOperation::blend):
+        * platform/graphics/transforms/RotateTransformOperation.h:
+        (WebCore::RotateTransformOperation::RotateTransformOperation):
+        * platform/graphics/transforms/ScaleTransformOperation.h:
+        (WebCore::ScaleTransformOperation::ScaleTransformOperation):
+        * platform/graphics/transforms/TransformOperation.h:
+        (WebCore::TransformOperation::is3DOperation):
+        * platform/graphics/transforms/TransformOperations.h:
+        (WebCore::TransformOperations::has3DOperation):
+        * platform/graphics/transforms/TranslateTransformOperation.h:
+        (WebCore::TranslateTransformOperation::TranslateTransformOperation):
+
+2009-02-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix.
+
+        * webcore-base.bkl:
+
+2009-02-12  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler
+
+        Fix potential ref-count or null-deref problems with C++ objects as Obj-C members.
+
+        * platform/mac/SharedBufferMac.mm: Change to use RefPtr<> instead of ref()/deref().
+        (-[WebCoreSharedBufferData dealloc]):
+        (-[WebCoreSharedBufferData finalize]):
+        (-[WebCoreSharedBufferData initWithSharedBuffer:]):
+
+2009-02-12  David Hyatt  <hyatt@apple.com>
+
+        Remove calcWidth from RenderObject.  Nobody ever called it on RenderObjects.
+
+        Reviewed by Sam Weinig
+
+        * rendering/RenderObject.h:
+
+2009-02-12  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Mark Rowe
+
+        Fix for regression where form controls would paint yellow highlights.  The containsComposition check needs to
+        null check node() now.
+
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paint):
+
+2009-02-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix
+
+        Change Animation::setDirection() to take the new enum value, and fix
+        the single caller.
+
+        Fix build error in MediaPlayerPrivateQTKit.h.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::mapAnimationDirection):
+        * platform/animation/Animation.h:
+        (WebCore::Animation::setDirection):
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+
+2009-02-12  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser
+
+        Remove the overrideSize methods from RenderObject.  Devirtualize all of the accessors on RenderBox.
+
+        * rendering/RenderBox.h:
+        * rendering/RenderObject.h:
+
+2009-02-12  Eric Carlson  <eric.carlson@apple.com>
+
+        Darin Adler, Antti Koivisto, Holger Hans Peter Freyther
+
+        Bug 23797: A platform should be able to use more than one media engine for <video> and <audio>
+        https://bugs.webkit.org/show_bug.cgi?id=23797
+
+        * WebCore.xcodeproj/project.pbxproj: add MediaPlayerPrivate.h
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::load): selectMediaURL now also returns a MIME type, pass it to
+        MediaPlayer::load so it can choose the right media engine
+        (WebCore::HTMLMediaElement::selectMediaURL): renamed from pickMedia. use MIMETypeRegistry
+        functions to strip params from the url and extract the codecs parameter. call
+        MediaPlayer::supportsType to see if we can open the file since only a media engine can
+        answer questions about supported type+codecs.
+        * html/HTMLMediaElement.h:
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::MIMETypeRegistry::getParameterFromMIMEType): New, find and return a MIME type parameter
+        (WebCore::MIMETypeRegistry::stripParametersFromMIMEType): New, strip all parameters from a MIME type
+        * platform/MIMETypeRegistry.h:
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::NullMediaPlayerPrivate::NullMediaPlayerPrivate):
+        (WebCore::NullMediaPlayerPrivate::load):
+        (WebCore::NullMediaPlayerPrivate::cancelLoad):
+        (WebCore::NullMediaPlayerPrivate::play):
+        (WebCore::NullMediaPlayerPrivate::pause):
+        (WebCore::NullMediaPlayerPrivate::naturalSize):
+        (WebCore::NullMediaPlayerPrivate::hasVideo):
+        (WebCore::NullMediaPlayerPrivate::setVisible):
+        (WebCore::NullMediaPlayerPrivate::duration):
+        (WebCore::NullMediaPlayerPrivate::currentTime):
+        (WebCore::NullMediaPlayerPrivate::seek):
+        (WebCore::NullMediaPlayerPrivate::seeking):
+        (WebCore::NullMediaPlayerPrivate::setEndTime):
+        (WebCore::NullMediaPlayerPrivate::setRate):
+        (WebCore::NullMediaPlayerPrivate::paused):
+        (WebCore::NullMediaPlayerPrivate::setVolume):
+        (WebCore::NullMediaPlayerPrivate::networkState):
+        (WebCore::NullMediaPlayerPrivate::readyState):
+        (WebCore::NullMediaPlayerPrivate::maxTimeSeekable):
+        (WebCore::NullMediaPlayerPrivate::maxTimeBuffered):
+        (WebCore::NullMediaPlayerPrivate::dataRate):
+        (WebCore::NullMediaPlayerPrivate::totalBytesKnown):
+        (WebCore::NullMediaPlayerPrivate::totalBytes):
+        (WebCore::NullMediaPlayerPrivate::bytesLoaded):
+        (WebCore::NullMediaPlayerPrivate::setRect):
+        (WebCore::NullMediaPlayerPrivate::paint):
+        (WebCore::createNullMediaPlayer):
+        Do nothing media player so MediaPlayer doesn't have to NULL check before calling current engine.
+
+        (WebCore::MediaPlayerFactory::MediaPlayerFactory): New, factory constructor.
+        (WebCore::installedMediaEngines): New, returns vector of all installed engines.
+        (WebCore::addMediaEngine): New, add a media engine to the cache.
+        (WebCore::chooseBestEngineForTypeAndCodecs): New, return an engine that might support a MIME type.
+        (WebCore::MediaPlayer::MediaPlayer): create NULL media player so we have a default. Initialize m_currentMediaEngine.
+        (WebCore::MediaPlayer::~MediaPlayer): don't need to delete m_private, it is now an OwnPtr.
+        (WebCore::MediaPlayer::load): Take MIME type as well as url, since we need it to find the right
+          media engine. If no MIME type is provided, try to devine one from the url. Choose a media engine
+          based on the MIME type and codecs parameter.
+        (WebCore::MediaPlayer::currentTime): Remove excess white space.
+        (WebCore::MediaPlayer::supportsType): Take codecs param as well as MIME type. Return enum so we can
+        indicate "maybe" condition.
+        (WebCore::MediaPlayer::getSupportedTypes): Build up list of MIME types by consulting all engines.
+        (WebCore::MediaPlayer::isAvailable): return true if any media engine is installed.
+
+        * platform/graphics/MediaPlayer.h:
+        (WebCore::MediaPlayer::):
+        (WebCore::MediaPlayer::frameView): accessor function.
+
+        * platform/graphics/MediaPlayerPrivate.h: New, declares abstract interface for media engines.
+        (WebCore::MediaPlayerPrivateInterface::~MediaPlayerPrivateInterface):
+        (WebCore::MediaPlayerPrivateInterface::totalBytesKnown):
+
+        * platform/graphics/chromium/MediaPlayerPrivateChromium.h: Add support for engine factory
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivate::create): New, media engine factory function
+        (WebCore::MediaPlayerPrivate::registerMediaEngine): Register engine with MediaPlayer factory
+        (WebCore::MediaPlayerPrivate::load): URL is a const String.
+        (WebCore::MediaPlayerPrivate::duration): Declare const.
+        (WebCore::MediaPlayerPrivate::naturalSize): Ditto.
+        (WebCore::MediaPlayerPrivate::hasVideo): Ditto.
+        (WebCore::MediaPlayerPrivate::networkState): Ditto.
+        (WebCore::MediaPlayerPrivate::readyState): Ditto.
+        (WebCore::MediaPlayerPrivate::maxTimeBuffered): Ditto.
+        (WebCore::MediaPlayerPrivate::maxTimeSeekable): Ditto.
+        (WebCore::MediaPlayerPrivate::maxTimeLoaded): Ditto.
+        (WebCore::MediaPlayerPrivate::bytesLoaded): Ditto.
+        (WebCore::MediaPlayerPrivate::totalBytesKnown): Ditto.
+        (WebCore::MediaPlayerPrivate::totalBytes): Ditto.
+        (WebCore::MediaPlayerPrivate::supportsType): Return MediaPlayer::SupportsType enum instead of bool.
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.h:
+        (WebCore::MediaPlayerPrivate::isAvailable):
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivateQTKit::create): New, media engine factory function
+        (WebCore::MediaPlayerPrivateQTKit::registerMediaEngine): Register engine with MediaPlayer factory
+        (WebCore::MediaPlayerPrivate::createQTMovieView): don't access MediaPlayer->m_frameView directly,
+        use accessor function.
+        (WebCore::MediaPlayerPrivate::setUpVideoRendering): Ditto.
+        (WebCore::MediaPlayerPrivate::paint): Ditto.
+        (WebCore::mimeTypeCache): New.
+        (WebCore::MediaPlayerPrivate::getSupportedTypes): New, media engine factory function.
+        (WebCore::MediaPlayerPrivate::supportsType): return MediaPlayer::SupportsType enum instead of bool
+        (-[WebCoreMovieObserver initWithCallback:]): fix formatting
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::create):
+        (WebCore::MediaPlayerPrivate::registerMediaEngine):
+        (WebCore::MediaPlayerPrivate::supportsType):
+        (WebCore::MediaPlayerPrivate::load): URL is a const String.
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
+        (WebCore::MediaPlayerPrivate::isAvailable):
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::create): New, media engine factory function
+        (WebCore::MediaPlayerPrivate::registerMediaEngine): New, register engine with MediaPlayer factory
+        (WebCore::MediaPlayerPrivate::load): URL is a const String.
+        (WebCore::MediaPlayerPrivate::paint): don't access MediaPlayer->m_frameView directly,
+        use accessor function.
+        (WebCore::mimeTypeCache): New.
+        (WebCore::MediaPlayerPrivateQTWin::getSupportedTypes): New, media engine factory function.
+        (WebCore::MediaPlayerPrivateQTWin::supportsType): return MediaPlayer::SupportsType enum instead of bool
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.h:
+
+2009-02-12  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Test: fast/dom/prefixed-image-tag.xhtml
+
+        Bug 23915: Remove setPrefix work-around in Document::createElement(QualifiedName, bool)
+
+        Instead we now directly propage the QualifiedName inside the generated Factory.
+
+        Test: fast/dom/prefixed-image-tag.xhtml
+
+        * dom/Document.cpp:
+        (WebCore::Document::createElement): Removed the setPrefix work-around
+        and replaced it with an ASSERT to catch mistakes inside the Factory code.
+        Remove the unneeded ExceptionCode argument.
+
+        (WebCore::Document::createElementNS): Removed ExceptionCode argument.
+        * dom/Document.h: Updated the signature.
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::startElementNs): Removed ExceptionCode argument.
+        * dom/XMLTokenizerQt.cpp: Ditto.
+        (WebCore::XMLTokenizer::parseStartElement): Ditto.
+
+        * dom/make_names.pl: Implemented the QualifiedName propogation logic
+        in the Factory.
+
+2009-02-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23188
+
+        Define enum values for Animation::direction(), and one for
+        IterationCountInfinite to make the code more self-documenting.
+
+        Order the member vars of Animation to optimize packing.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * platform/animation/Animation.cpp:
+        (WebCore::Animation::Animation):
+        (WebCore::Animation::operator=):
+        (WebCore::Animation::animationsMatch):
+        * platform/animation/Animation.h:
+        (WebCore::Animation::):
+        (WebCore::Animation::direction):
+        (WebCore::Animation::initialAnimationDirection):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::setBasicAnimation):
+        (WebCore::GraphicsLayerCA::setKeyframeAnimation):
+
+2009-02-12  Christian Dywan  <christian@twotoasts.de>
+
+        Reviewed by Holger Freyther.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::startHttp): Don't use O_CLOEXEC for now.
+
+2009-02-12  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 23826: Potential bug with before/after rule while moving element from one document to another
+
+        Moved the document before/after toggle from the constructor to insertedIntoDocument.
+
+        Test: fast/css-generated-content/beforeAfter-interdocument.html
+
+        * html/HTMLQuoteElement.cpp:
+        (WebCore::HTMLQuoteElement::HTMLQuoteElement):
+        (WebCore::HTMLQuoteElement::insertedIntoDocument):
+        * html/HTMLQuoteElement.h:
+
+2009-02-12  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23912
+
+        I have no idea why this broke.  As far as I can tell the old code never should have worked in
+        the first place.  Add code to handleWheelEvent that will find an enclosing renderer for a node
+        in order to attempt a wheel scroll.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleWheelEvent):
+
+2009-02-12  David Hyatt  <hyatt@apple.com>
+
+        Move the functions that paint borders, box shadows and border images into RenderBoxModelObject.  drawBorder and drawBorderArc, because they are used
+        for outlines as well as borders, need to stay in RenderObject.  Rename them to drawLineForBoxSide and drawArcForBoxSide in order to reflect their
+        more generic use.  Rename the BorderSide struct to BoxSide, since the concept of "side" is just a rectangle concept and not a border concept.
+
+        Reviewed by Simon Fraser
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintFillLayer):
+        (WebCore::InlineFlowBox::paintBoxShadow):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintColumns):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintNinePieceImage):
+        (WebCore::RenderBoxModelObject::paintBorder):
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBorderMinusLegend):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::paintOutlineForLine):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::drawLineForBoxSide):
+        (WebCore::RenderObject::drawArcForBoxSide):
+        (WebCore::RenderObject::paintOutline):
+        * rendering/RenderObject.h:
+        (WebCore::):
+        (WebCore::RenderObject::hasBoxDecorations):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::CollapsedBorders::addBorder):
+        (WebCore::RenderTableCell::paintCollapsedBorder):
+
+2009-02-12  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser
+
+        Bug 18322: video element should have ui when scripting is disabled
+        https://bugs.webkit.org/show_bug.cgi?id=18322
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::controls): always return 'true' when JavaScript is disabled.
+        * manual-tests/media-controls-when-javascript-disabled.html: Added.
+
+2009-02-12  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23906
+        Add custom V8 bindings for HTMLPlugInElement.
+
+        * bindings/v8/custom/V8HTMLPlugInElementCustom.cpp: Added.
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::NAMED_PROPERTY_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::INDEXED_PROPERTY_GETTER):
+        (WebCore::INDEXED_PROPERTY_SETTER):
+
+2009-02-12  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Mark Rowe.
+
+        [GTK] Soup backend must handle upload of multiple files
+        https://bugs.webkit.org/show_bug.cgi?id=18343
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::):
+        (WebCore::freeFileMapping):
+        (WebCore::ResourceHandle::startHttp): Support multipart request bodies
+        mmap'ing files to be uploaded.
+
+2009-02-12  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build following r40871 which changed RenderObject::element()
+        into RenderObject::node().
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::getMediaElementFromRenderObject):
+        (WebCore::RenderThemeQt::getMediaControlForegroundColor):
+
+2009-02-12  Alexey Proskuryakov  <ap@webkit.org>
+
+        Build fix.
+
+        * platform/graphics/transforms/RotateTransformOperation.cpp: Include <algorithm>.
+
+2009-02-12  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Change worker code to use different proxy class pointers.
+        https://bugs.webkit.org/show_bug.cgi?id=23859
+
+        This is a step towards using separate proxies in multi-process implementation.
+
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        * dom/Worker.cpp:
+        (WebCore::Worker::Worker):
+        (WebCore::Worker::~Worker):
+        (WebCore::Worker::postMessage):
+        (WebCore::Worker::terminate):
+        (WebCore::Worker::hasPendingActivity):
+        (WebCore::Worker::notifyFinished):
+        (WebCore::Worker::dispatchMessage):
+        * dom/Worker.h:
+        * dom/WorkerContext.cpp:
+        (WebCore::WorkerContext::~WorkerContext):
+        (WebCore::WorkerContext::reportException):
+        (WebCore::WorkerContext::addMessage):
+        (WebCore::WorkerContext::postMessage):
+        (WebCore::WorkerContext::dispatchMessage):
+        * dom/WorkerContext.h:
+        * dom/WorkerContextProxy.h:
+        * dom/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::performTask):
+        (WebCore::MessageWorkerTask::performTask):
+        (WebCore::WorkerContextProxy::create):
+        (WebCore::WorkerMessagingProxy::WorkerMessagingProxy):
+        (WebCore::WorkerMessagingProxy::~WorkerMessagingProxy):
+        (WebCore::WorkerMessagingProxy::startWorkerContext):
+        (WebCore::postConsoleMessageTask):
+        (WebCore::WorkerMessagingProxy::postConsoleMessageToWorkerObject):
+        (WebCore::WorkerMessagingProxy::workerThreadCreated):
+        * dom/WorkerMessagingProxy.h:
+        * dom/WorkerObjectProxy.h:
+        * dom/WorkerThread.cpp:
+        (WebCore::WorkerThread::create):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::workerThread):
+        * dom/WorkerThread.h:
+        (WebCore::WorkerThread::workerObjectProxy):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
+
+2009-02-12  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23688: ThreadableLoader needs a sync implementation for Workers.
+        <https://bugs.webkit.org/show_bug.cgi?id=23688>
+
+        Add ResourceError to ThreadableLoaderClient.
+
+        No observable change in behavior, so no test.
+
+        * loader/DocumentThreadableLoader.cpp:
+        (WebCore::DocumentThreadableLoader::create):
+        (WebCore::DocumentThreadableLoader::willSendRequest):
+        (WebCore::DocumentThreadableLoader::didFail):
+        * loader/ThreadableLoaderClient.h:
+        (WebCore::ThreadableLoaderClient::didFail):
+        (WebCore::ThreadableLoaderClient::didFailWillSendRequestCheck):
+        * loader/ThreadableLoaderClientWrapper.h:
+        (WebCore::ThreadableLoaderClientWrapper::didFail):
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):
+        (WebCore::workerContextDidFail):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFail):
+        * loader/WorkerThreadableLoader.h:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::didFail):
+        (WebCore::XMLHttpRequest::didFailWillSendRequestCheck):
+        * xml/XMLHttpRequest.h:
+
+2009-02-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Fix the build on Leopard with ACCELERATED_COMPOSITING turned on.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        FloatPoint3D needs to be a private header, since it's included by GraphicsLayer.h
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::getTransformFunctionValue):
+        (WebCore::caValueFunctionSupported):
+        (WebCore::GraphicsLayerCA::setAnchorPoint):
+        (WebCore::GraphicsLayerCA::setPreserves3D):
+        (WebCore::GraphicsLayerCA::setContentsToImage):
+        (WebCore::GraphicsLayerCA::setBasicAnimation):
+        (WebCore::GraphicsLayerCA::setKeyframeAnimation):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::isRootLayer):
+        Fix isRootLayer to return true for the renderView's layer, not the root
+        renderer's layer.
+
+2009-02-11  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23910
+        <rdar://problem/6160546> REGRESSION: In Full page mode, movie controller hides when I drag the knob if movie is playing
+
+        * rendering/RenderMedia.cpp: (WebCore::RenderMedia::forwardEvent):
+        When we get a mouseOut event, consider the mouse as still within the RenderMedia if the relatedTarget is a descendant.
+
+2009-02-11  David Hyatt  <hyatt@apple.com>
+
+        Remove all of the inline box wrapper functions from RenderObject, since they only apply to RenderBox.  Devirtualize the functions.
+        Patch all of the call sites to convert to a RenderBox.
+
+        Reviewed by Simon Fraser
+
+        * dom/Position.cpp:
+        (WebCore::nextRenderedEditable):
+        (WebCore::previousRenderedEditable):
+        (WebCore::Position::getInlineBoxAndOffset):
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::deleteLine):
+        (WebCore::InlineBox::extractLine):
+        (WebCore::InlineBox::attachLine):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
+        * rendering/RenderObject.cpp:
+        * rendering/RenderObject.h:
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::removeChildNode):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::textWithHardLineBreaks):
+
+2009-02-11  David Hyatt  <hyatt@apple.com>
+
+        Eliminate createInlineBox and dirtyLineBoxes from RenderObject.  These functions have been devirtualized.
+        The single call site now calls a helper function that just bit checks and casts before calling the correct
+        type.  RenderBlock's dirtyLineBoxes function was dead code (caused by the RenderFlow deletion), so it has
+        just been removed.
+
+        Reviewed by Eric Seidel
+
+        * rendering/RenderBR.cpp:
+        * rendering/RenderBR.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::createRootInlineBox):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::createInlineBox):
+        * rendering/RenderBox.h:
+        * rendering/RenderCounter.cpp:
+        * rendering/RenderCounter.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::createInlineFlowBox):
+        * rendering/RenderInline.h:
+        * rendering/RenderObject.cpp:
+        * rendering/RenderObject.h:
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::createTextBox):
+        * rendering/RenderSVGInlineText.h:
+        (WebCore::RenderSVGInlineText::isSVGText):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::createTextBox):
+        (WebCore::RenderText::createInlineTextBox):
+        * rendering/RenderText.h:
+        * rendering/bidi.cpp:
+        (WebCore::createInlineBoxForRenderer):
+        (WebCore::RenderBlock::createLineBoxes):
+        (WebCore::RenderBlock::constructLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2009-02-11  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23905
+
+        Adds support for 3D CSS properties (transform-style-3d, perspective,
+        perspective-origin, and backface-visibility) to RenderStyle and friends
+
+        * platform/graphics/transforms/TransformOperation.h
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        (WebCore::RenderStyle::applyTransform):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::transformOriginZ):
+        (WebCore::InheritedFlags::hasTransformRelatedProperty):
+        (WebCore::InheritedFlags::transformStyle3D):
+        (WebCore::InheritedFlags::backfaceVisibility):
+        (WebCore::InheritedFlags::perspective):
+        (WebCore::InheritedFlags::perspectiveOriginX):
+        (WebCore::InheritedFlags::perspectiveOriginY):
+        (WebCore::InheritedFlags::setTransformOriginZ):
+        (WebCore::InheritedFlags::setTransformStyle3D):
+        (WebCore::InheritedFlags::setBackfaceVisibility):
+        (WebCore::InheritedFlags::setPerspective):
+        (WebCore::InheritedFlags::setPerspectiveOriginX):
+        (WebCore::InheritedFlags::setPerspectiveOriginY):
+        (WebCore::InheritedFlags::initialTransformOriginZ):
+        (WebCore::InheritedFlags::initialTransformStyle3D):
+        (WebCore::InheritedFlags::initialBackfaceVisibility):
+        (WebCore::InheritedFlags::initialPerspective):
+        (WebCore::InheritedFlags::initialPerspectiveOriginX):
+        (WebCore::InheritedFlags::initialPerspectiveOriginY):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
+        (WebCore::StyleRareNonInheritedData::operator==):
+        * rendering/style/StyleRareNonInheritedData.h:
+        * rendering/style/StyleTransformData.cpp:
+        (WebCore::StyleTransformData::StyleTransformData):
+        (WebCore::StyleTransformData::operator==):
+        * rendering/style/StyleTransformData.h:
+
+2009-02-11  Simon Fraser  <simon.fraser@apple.com>
+
+        No review.
+
+        Fix ACCELERATED_COMPOSITING build.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::createGraphicsLayer):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+
+2009-02-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23862
+
+        Add a bit on RenderStyle that gets set when running accelerated
+        transitions of transform or opacity. These ensure that styles
+        compare as different during the transition, so that interruption
+        can be detected reliably.
+
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::animate):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::isRunningAcceleratedAnimation):
+        (WebCore::InheritedFlags::setIsRunningAcceleratedAnimation):
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
+        (WebCore::StyleRareNonInheritedData::operator==):
+        * rendering/style/StyleRareNonInheritedData.h:
+
+2009-02-11  David Hyatt  <hyatt@apple.com>
+
+        Eliminate the virtual position() function from RenderObject.  Rename the position() overrides
+        in RenderText and RenderBox to positionLineBox and devirtualize them.
+
+        Patch the one call site to just check for isText() and isBox() and call the methods directly.
+
+        Remove some unnecessary overrides of position() on table sections and rows.
+
+        Reviewed by Simon Fraser
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::positionLineBox):
+        * rendering/RenderBox.h:
+        * rendering/RenderObject.h:
+        * rendering/RenderSVGRoot.cpp:
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderTableRow.h:
+        (WebCore::RenderTableRow::lineHeight):
+        * rendering/RenderTableSection.h:
+        (WebCore::RenderTableSection::lineHeight):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::positionLineBox):
+        * rendering/RenderText.h:
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::computeVerticalPositionsForLine):
+
+2009-02-11  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23901
+        Add HTML options/collections V8 custom bindings.
+
+        * bindings/v8/custom/V8HTMLCollectionCustom.cpp: Added.
+        (WebCore::getNamedItems):
+        (WebCore::getItem):
+        (WebCore::NAMED_PROPERTY_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLFormElementCustom.cpp: Added.
+        (WebCore::NAMED_PROPERTY_GETTER):
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::ACCESSOR_SETTER):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        (WebCore::removeElement):
+        * bindings/v8/custom/V8HTMLSelectElementCustom.h: Added.
+        * bindings/v8/custom/V8NamedNodesCollection.cpp: Added.
+        (WebCore::V8NamedNodesCollection::item):
+        (WebCore::V8NamedNodesCollection::itemWithName):
+        * bindings/v8/custom/V8NamedNodesCollection.h: Added.
+        (WebCore::V8NamedNodesCollection::V8NamedNodesCollection):
+        (WebCore::V8NamedNodesCollection::length):
+
+2009-02-11  Dimitri Dupuis-latour  <dupuislatour@apple.com>
+
+        Added a preference to disable some Inspector's panels (rdar://6419624, rdar://6419645).
+        This is controlled via the 'WebKitInspectorHiddenPanels' key; if nothing is specified, all panels are shown.
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/InspectorClient.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::hiddenPanels):
+        (WebCore::InspectorController::hiddenPanels):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        * inspector/InspectorController.h:
+        * inspector/front-end/inspector.js:
+        (WebInspector.loaded):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyInspectorClient::hiddenPanels):
+
+2009-02-11  David Hyatt  <hyatt@apple.com>
+
+        Combine RenderObject::element() and RenderObject::node() into a single function.
+        node() now has the "anonymous bit" checking behavior of element() and will
+        return 0 for anonymous content.  This patch switches all callers of element()
+        to node() and patches old callers of node() to deal with situations where they
+        did not expect node() to be 0.  A bunch of node() calls were calling stuff on
+        Document that they clearly didn't intend, so overall this is a nice improvement.
+
+        Reviewed by Sam Weinig
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::getUpperLeftCorner):
+        * dom/Element.cpp:
+        (WebCore::Element::offsetParent):
+        * dom/Position.cpp:
+        (WebCore::Position::hasRenderedNonAnonymousDescendantsWithHeight):
+        * editing/ModifySelectionListLevel.cpp:
+        (WebCore::getStartEndListChildren):
+        (WebCore::IncreaseSelectionListLevelCommand::doApply):
+        (WebCore::DecreaseSelectionListLevelCommand::doApply):
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::advance):
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::leftVisuallyDistinctCandidate):
+        (WebCore::VisiblePosition::rightVisuallyDistinctCandidate):
+        * editing/visible_units.cpp:
+        (WebCore::startPositionForLine):
+        (WebCore::endPositionForLine):
+        * page/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::get):
+        * page/AccessibilityList.cpp:
+        (WebCore::AccessibilityList::isUnorderedList):
+        (WebCore::AccessibilityList::isOrderedList):
+        (WebCore::AccessibilityList::isDefinitionList):
+        * page/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::doAccessibilityHitTest):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isPasswordField):
+        (WebCore::AccessibilityRenderObject::isFileUploadButton):
+        (WebCore::AccessibilityRenderObject::isInputImage):
+        (WebCore::AccessibilityRenderObject::isMultiSelect):
+        (WebCore::AccessibilityRenderObject::isControl):
+        (WebCore::AccessibilityRenderObject::getAttribute):
+        (WebCore::AccessibilityRenderObject::anchorElement):
+        (WebCore::AccessibilityRenderObject::actionElement):
+        (WebCore::AccessibilityRenderObject::mouseButtonListener):
+        (WebCore::AccessibilityRenderObject::helpText):
+        (WebCore::AccessibilityRenderObject::textUnderElement):
+        (WebCore::AccessibilityRenderObject::hasIntValue):
+        (WebCore::AccessibilityRenderObject::intValue):
+        (WebCore::AccessibilityRenderObject::labelElementContainer):
+        (WebCore::AccessibilityRenderObject::title):
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+        (WebCore::AccessibilityRenderObject::boundingBoxRect):
+        (WebCore::AccessibilityRenderObject::checkboxOrRadioRect):
+        (WebCore::AccessibilityRenderObject::titleUIElement):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::text):
+        (WebCore::AccessibilityRenderObject::ariaSelectedTextDOMRange):
+        (WebCore::AccessibilityRenderObject::accessKey):
+        (WebCore::AccessibilityRenderObject::setSelectedTextRange):
+        (WebCore::AccessibilityRenderObject::url):
+        (WebCore::AccessibilityRenderObject::isFocused):
+        (WebCore::AccessibilityRenderObject::setFocused):
+        (WebCore::AccessibilityRenderObject::setValue):
+        (WebCore::AccessibilityRenderObject::isEnabled):
+        (WebCore::AccessibilityRenderObject::visiblePositionRange):
+        (WebCore::AccessibilityRenderObject::index):
+        (WebCore::AccessibilityRenderObject::activeDescendant):
+        (WebCore::AccessibilityRenderObject::handleActiveDescendantChanged):
+        (WebCore::AccessibilityRenderObject::observableObject):
+        (WebCore::AccessibilityRenderObject::roleValue):
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        (WebCore::AccessibilityRenderObject::ariaListboxSelectedChildren):
+        * page/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
+        (WebCore::AccessibilityTable::title):
+        * page/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::titleUIElement):
+        * page/AccessibilityTableColumn.cpp:
+        (WebCore::AccessibilityTableColumn::headerObjectForSection):
+        * page/AccessibilityTableRow.cpp:
+        (WebCore::AccessibilityTableRow::headerObject):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dispatchMouseEvent):
+        (WebCore::EventHandler::canMouseDownStartSelect):
+        (WebCore::EventHandler::canMouseDragExtendSelect):
+        (WebCore::EventHandler::shouldDragAutoNode):
+        * page/Frame.cpp:
+        (WebCore::Frame::searchForLabelsAboveCell):
+        (WebCore::Frame::setFocusedNodeIfNeeded):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateOverflowStatus):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
+        (WebCore::AnimationController::cancelAnimations):
+        (WebCore::AnimationController::updateAnimations):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::KeyframeAnimation):
+        (WebCore::KeyframeAnimation::endAnimation):
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (blockquoteLevel):
+        (AXAttributeStringSetHeadingLevel):
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::searchForNSLabelsAboveCell):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::verticallyAlignBoxes):
+        (WebCore::InlineFlowBox::paint):
+        (WebCore::shouldDrawTextDecoration):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintDocumentMarkers):
+        * rendering/RenderBR.cpp:
+        (WebCore::RenderBR::positionForCoordinates):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::handleRunInChild):
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::isSelectionRoot):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::positionForBox):
+        (WebCore::RenderBlock::positionForRenderer):
+        (WebCore::RenderBlock::positionForCoordinates):
+        (WebCore::RenderBlock::hasLineIfEmpty):
+        (WebCore::RenderBlock::updateFirstLetter):
+        (WebCore::RenderBlock::updateHitTestResult):
+        (WebCore::RenderBlock::addFocusRingRects):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleWillChange):
+        (WebCore::RenderBox::updateBoxModelInfoFromStyle):
+        (WebCore::RenderBox::paintRootBoxDecorations):
+        (WebCore::RenderBox::positionForCoordinates):
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::updateFromElement):
+        (WebCore::RenderButton::canHaveChildren):
+        * rendering/RenderCounter.cpp:
+        (WebCore::planCounter):
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::findLegend):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::translationForAttributes):
+        (WebCore::RenderForeignObject::calculateLocalTransform):
+        * rendering/RenderFrame.h:
+        (WebCore::RenderFrame::element):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        (WebCore::RenderImage::imageMap):
+        (WebCore::RenderImage::nodeAtPoint):
+        (WebCore::RenderImage::updateAltText):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::cloneInline):
+        (WebCore::RenderInline::updateHitTestResult):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::isTransparent):
+        (WebCore::RenderLayer::scrollToOffset):
+        (WebCore::RenderLayer::resize):
+        (WebCore::RenderLayer::createScrollbar):
+        (WebCore::RenderLayer::updateOverflowStatus):
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
+        (WebCore::RenderLayer::enclosingElement):
+        (WebCore::RenderLayer::updateHoverActiveState):
+        (WebCore::RenderLayer::updateScrollCornerStyle):
+        (WebCore::RenderLayer::updateResizerStyle):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::isRootLayer):
+        * rendering/RenderListItem.cpp:
+        (WebCore::getParentOfFirstLineBox):
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::marqueeSpeed):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        (WebCore::RenderObject::isBody):
+        (WebCore::RenderObject::isHR):
+        (WebCore::RenderObject::isHTMLMarquee):
+        (WebCore::RenderObject::isEditable):
+        (WebCore::RenderObject::addPDFURLRect):
+        (WebCore::RenderObject::showTreeForThis):
+        (WebCore::RenderObject::draggableNode):
+        (WebCore::RenderObject::hasOutlineAnnotation):
+        (WebCore::RenderObject::positionForCoordinates):
+        (WebCore::RenderObject::updateDragState):
+        (WebCore::RenderObject::updateHitTestResult):
+        (WebCore::RenderObject::getUncachedPseudoStyle):
+        (WebCore::RenderObject::getTextDecorationColors):
+        (WebCore::RenderObject::caretMaxOffset):
+        (WebCore::RenderObject::offsetParent):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isRoot):
+        (WebCore::RenderObject::isInlineContinuation):
+        (WebCore::RenderObject::node):
+        (WebCore::RenderObject::setNode):
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::destroyLeftoverChildren):
+        * rendering/RenderPart.cpp:
+        (WebCore::RenderPart::updateWidgetPosition):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget):
+        (WebCore::RenderPartObject::viewCleared):
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::calculateLocalTransform):
+        (WebCore::RenderPath::layout):
+        (WebCore::RenderPath::paint):
+        (WebCore::RenderPath::drawMarkersIfNeeded):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::positionForCoordinates):
+        (WebCore::RenderReplaced::isSelected):
+        * rendering/RenderSVGGradientStop.cpp:
+        (WebCore::RenderSVGGradientStop::gradientElement):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::calculateLocalTransform):
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::positionForCoordinates):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::layout):
+        (WebCore::RenderSVGRoot::applyContentTransforms):
+        (WebCore::RenderSVGRoot::paint):
+        (WebCore::RenderSVGRoot::calcViewport):
+        (WebCore::RenderSVGRoot::absoluteTransform):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::calculateLocalTransform):
+        (WebCore::RenderSVGText::layout):
+        * rendering/RenderSVGTextPath.cpp:
+        (WebCore::RenderSVGTextPath::layoutPath):
+        (WebCore::RenderSVGTextPath::startOffset):
+        (WebCore::RenderSVGTextPath::exactAlignment):
+        (WebCore::RenderSVGTextPath::stretchMethod):
+        * rendering/RenderSVGTransformableContainer.cpp:
+        (WebCore::RenderSVGTransformableContainer::calculateLocalTransform):
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::calcViewport):
+        (WebCore::RenderSVGViewportContainer::viewportTransform):
+        (WebCore::RenderSVGViewportContainer::nodeAtPoint):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::addChild):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::updateFromElement):
+        (WebCore::RenderTableCell::calcPrefWidths):
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::updateFromElement):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::addChild):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addChild):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::originalText):
+        (WebCore::RenderText::positionForCoordinates):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::nodeAtPoint):
+        * rendering/RenderTextFragment.cpp:
+        (WebCore::RenderTextFragment::originalText):
+        (WebCore::RenderTextFragment::previousCharacter):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::isActive):
+        (WebCore::RenderTheme::isChecked):
+        (WebCore::RenderTheme::isIndeterminate):
+        (WebCore::RenderTheme::isEnabled):
+        (WebCore::RenderTheme::isFocused):
+        (WebCore::RenderTheme::isPressed):
+        (WebCore::RenderTheme::isReadOnlyControl):
+        (WebCore::RenderTheme::isHovered):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::updatePressedState):
+        (WebCore::RenderThemeMac::paintMediaFullscreenButton):
+        (WebCore::RenderThemeMac::paintMediaMuteButton):
+        (WebCore::RenderThemeMac::paintMediaPlayButton):
+        (WebCore::RenderThemeMac::paintMediaSeekBackButton):
+        (WebCore::RenderThemeMac::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeMac::paintMediaSliderThumb):
+        (WebCore::RenderThemeMac::paintMediaTimelineContainer):
+        (WebCore::RenderThemeMac::paintMediaCurrentTime):
+        (WebCore::RenderThemeMac::paintMediaTimeRemaining):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::paintMediaMuteButton):
+        (WebCore::RenderThemeSafari::paintMediaPlayButton):
+        (WebCore::RenderThemeSafari::paintMediaSliderTrack):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        (WebCore::writeSelection):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::setWidgetGeometry):
+        (WebCore::RenderWidget::updateWidgetPosition):
+        (WebCore::RenderWidget::nodeAtPoint):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::isEditableLeaf):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::prepareToRenderSVGContent):
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::write):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::buildLayoutInformation):
+        (WebCore::SVGRootInlineBox::layoutInlineBoxes):
+        (WebCore::SVGRootInlineBox::buildLayoutInformationForTextBox):
+        (WebCore::SVGRootInlineBox::buildTextChunks):
+        * rendering/style/SVGRenderStyle.cpp:
+        (WebCore::SVGRenderStyle::cssPrimitiveToLength):
+        * svg/SVGFont.cpp:
+        (WebCore::SVGTextRunWalker::walk):
+        (WebCore::floatWidthOfSubStringUsingSVGFont):
+        (WebCore::Font::drawTextUsingSVGFont):
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::findInlineTextBoxInTextChunks):
+        * svg/graphics/SVGPaintServer.cpp:
+        (WebCore::SVGPaintServer::fillPaintServer):
+        (WebCore::SVGPaintServer::strokePaintServer):
+
+2009-02-11  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/3541409> - Further FrameLoader and page cache cleanup
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::restore): Moved updatePlatformScriptObjects() here.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::commitProvisionalLoad): Rolled opened() into this method.  This method was
+          the only caller and - in the future - will benefit from doing parts of opened()'s work differently.
+        (WebCore::FrameLoader::open): Split off per-frame logic into open(CachedFrame&) method.
+        (WebCore::FrameLoader::closeAndRemoveChild): Added.  Do the non-tree related cleanup that
+          FrameTree::removeChild() used to do.
+        (WebCore::FrameLoader::detachFromParent): Call ::closeAndRemoveChild() instead.
+        (WebCore::FrameLoader::cachePageForHistoryItem): Perform the "can cache page" check here.
+        * loader/FrameLoader.h:
+
+        * page/FrameTree.cpp:
+        (WebCore::FrameTree::removeChild): Just remove the Frame from the tree.  Closing it and other
+          cleanup is the responsibility of the FrameLoader.
+        * page/FrameTree.h:
+        (WebCore::FrameTree::detachFromParent): Added to just clear a Frame's parent pointer
+
+2009-02-11  Scott Violet  <sky@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23882
+        GraphicsContextSkia draws round rects as solid rects
+
+        Fixes two bugs in Skia's GraphicsContext::fillRoundedRect:
+        . fillRoundedRect had an extra call to fillRect, resulting in always
+          drawing a solid rectangle.
+        . if the total radius along a given axis is greater than the size of
+          the axis to draw, a solid rect should be drawn.
+
+        The layout tests LayoutTests/fast/css/shadow-multiple.html and
+        LayoutTests/fast/box-shadow/basic-shadows.html cover this.
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::fillRoundedRect):
+
+2009-02-11  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 23536: Auto-generate HTMLElementFactory
+
+        Remove the HTMLElementFactory files. Farewell.
+
+        * html/HTMLElementFactory.cpp: Removed.
+        * html/HTMLElementFactory.h: Removed.
+
+2009-02-11  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 23536: Auto-generate HTMLElementFactory
+
+        Make the platform auto-generate the HTMLElementFactory.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * webcore-base.bkl:
+
+2009-02-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Remove unneeded ASSERTS.
+
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::width):
+        (WebCore::RenderBox::height):
+        (WebCore::RenderBox::size):
+        (WebCore::RenderBox::frameRect):
+
+2009-02-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Add function to RenderStyle to ask whether a background image has been specified.
+
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::hasBackgroundImage):
+
+2009-02-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23548
+
+        When opacity or transform change on an object which has a compositing layer,
+        avoid repainting the layer.
+
+        Added a new StyleDifference value, StyleDifferenceRecompositeLayer, which indicates
+        that the only thing styleChanged() has to do is to update composited properties of
+        the layer. RenderStyle::diff() now has an out param for a bitmask of "context sensitive"
+        properties, currently for opacity and transform. When one of these changes, we need
+        to see if we have a compositing layer before we decide whether to layout/repaint,
+        or just update the composited layer, via adjustStyleDifference().
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::adjustStyleDifference):
+        (WebCore::RenderObject::setStyle):
+        (WebCore::RenderObject::styleDidChange):
+        * rendering/RenderObject.h:
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-02-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6562920> Pasted text should be normalized to NFC
+
+        Testing requires putting non-HTML content in pasteboard, so it cannot be done with WebKit alone.
+
+        * platform/mac/PasteboardMac.mm: (WebCore::Pasteboard::plainText): Route the text through
+        -[NSString precomposedStringWithCanonicalMapping].
+
+2009-02-10  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23883
+
+        Added new TransformOperation subclasses and methods to existing ones
+        to support 3D.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/transforms/IdentityTransformOperation.h:
+        (WebCore::IdentityTransformOperation::isAffine):
+        * platform/graphics/transforms/Matrix3DTransformOperation.cpp: Added.
+        (WebCore::Matrix3DTransformOperation::blend):
+        * platform/graphics/transforms/Matrix3DTransformOperation.h: Added.
+        (WebCore::Matrix3DTransformOperation::create):
+        (WebCore::Matrix3DTransformOperation::isIdentity):
+        (WebCore::Matrix3DTransformOperation::isAffine):
+        (WebCore::Matrix3DTransformOperation::getOperationType):
+        (WebCore::Matrix3DTransformOperation::isSameType):
+        (WebCore::Matrix3DTransformOperation::operator==):
+        (WebCore::Matrix3DTransformOperation::apply):
+        (WebCore::Matrix3DTransformOperation::Matrix3DTransformOperation):
+        * platform/graphics/transforms/MatrixTransformOperation.h:
+        (WebCore::MatrixTransformOperation::isAffine):
+        (WebCore::MatrixTransformOperation::apply):
+        * platform/graphics/transforms/PerspectiveTransformOperation.cpp: Added.
+        (WebCore::PerspectiveTransformOperation::blend):
+        * platform/graphics/transforms/PerspectiveTransformOperation.h: Added.
+        (WebCore::PerspectiveTransformOperation::create):
+        (WebCore::PerspectiveTransformOperation::isIdentity):
+        (WebCore::PerspectiveTransformOperation::isAffine):
+        (WebCore::PerspectiveTransformOperation::getOperationType):
+        (WebCore::PerspectiveTransformOperation::isSameType):
+        (WebCore::PerspectiveTransformOperation::operator==):
+        (WebCore::PerspectiveTransformOperation::apply):
+        (WebCore::PerspectiveTransformOperation::PerspectiveTransformOperation):
+        * platform/graphics/transforms/RotateTransformOperation.cpp:
+        (WebCore::RotateTransformOperation::blend):
+        * platform/graphics/transforms/RotateTransformOperation.h:
+        (WebCore::RotateTransformOperation::create):
+        (WebCore::RotateTransformOperation::angle):
+        (WebCore::RotateTransformOperation::isAffine):
+        (WebCore::RotateTransformOperation::operator==):
+        (WebCore::RotateTransformOperation::apply):
+        (WebCore::RotateTransformOperation::RotateTransformOperation):
+        * platform/graphics/transforms/ScaleTransformOperation.cpp:
+        (WebCore::ScaleTransformOperation::blend):
+        * platform/graphics/transforms/ScaleTransformOperation.h:
+        (WebCore::ScaleTransformOperation::create):
+        (WebCore::ScaleTransformOperation::z):
+        (WebCore::ScaleTransformOperation::isIdentity):
+        (WebCore::ScaleTransformOperation::isAffine):
+        (WebCore::ScaleTransformOperation::operator==):
+        (WebCore::ScaleTransformOperation::apply):
+        (WebCore::ScaleTransformOperation::ScaleTransformOperation):
+        * platform/graphics/transforms/SkewTransformOperation.h:
+        (WebCore::SkewTransformOperation::isAffine):
+        * platform/graphics/transforms/TransformOperation.h:
+        (WebCore::TransformOperation::):
+        (WebCore::TransformOperation::is3DOperation):
+        * platform/graphics/transforms/TransformOperations.h:
+        (WebCore::TransformOperations::isAffine):
+        (WebCore::TransformOperations::has3DOperation):
+        * platform/graphics/transforms/TranslateTransformOperation.cpp:
+        (WebCore::TranslateTransformOperation::blend):
+        * platform/graphics/transforms/TranslateTransformOperation.h:
+        (WebCore::TranslateTransformOperation::create):
+        (WebCore::TranslateTransformOperation::z):
+        (WebCore::TranslateTransformOperation::isIdentity):
+        (WebCore::TranslateTransformOperation::isAffine):
+        (WebCore::TranslateTransformOperation::operator==):
+        (WebCore::TranslateTransformOperation::apply):
+        (WebCore::TranslateTransformOperation::TranslateTransformOperation):
+
+2009-02-11  David Hyatt  <hyatt@apple.com>
+
+        Move createAnonymousBlock() to RenderBlock.  Since anonymous blocks are always parented to some other block,
+        we can move this function to RenderBlock.  Fix a couple of call sites as a result of this restriction.
+
+        Reviewed by Simon Fraser
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::createAnonymousBlock):
+        * rendering/RenderBlock.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::childBecameNonInline):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::handleDynamicFloatPositionChange):
+        * rendering/RenderObject.h:
+
+2009-02-11  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=23895
+
+        Remove two complete nonsense lines that I accidentally added from a cut and paste error.  This
+        restores the original logic.
+
+        Reviewed by Simon Fraser
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced):
+
+2009-02-11  David Hyatt  <hyatt@apple.com>
+
+        Rename getBaselineOfFirstLineBox to firstLineBoxBaseline.  Rename getBaselineOfLastLineBox to
+        lastLineBoxBaseline.  Remove the functions from RenderObject and add them to RenderBox instead.
+
+        Reviewed by Eric Seidel
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::baselinePosition):
+        (WebCore::RenderBlock::firstLineBoxBaseline):
+        (WebCore::RenderBlock::lastLineBoxBaseline):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::firstLineBoxBaseline):
+        (WebCore::RenderBox::lastLineBoxBaseline):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        * rendering/RenderObject.h:
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::firstLineBoxBaseline):
+        * rendering/RenderTable.h:
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::baselinePosition):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::firstLineBoxBaseline):
+        * rendering/RenderTableSection.h:
+
+2009-02-11  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser
+
+        https://bugs.webkit.org/show_bug.cgi?id=23877
+        Allow port to disable progress events from <video> and <audio> elements
+
+        * html/HTMLMediaElement.cpp: Initialize m_sendProgressEvents.
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Don't post progress events if m_sendProgressEvents is false.
+        (WebCore::HTMLMediaElement::initAndDispatchProgressEvent): Ditto.
+        (WebCore::HTMLMediaElement::load): Ditto.
+        * html/HTMLMediaElement.h: Add m_sendProgressEvents
+
+2009-02-11  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * DerivedSources.cpp: Removed SVGElementFactory.cpp, since including
+        it leads to ambiguities for symbols like "aTag", which exist in both
+        the HTMLNames and SVGNames namespaces.
+
+        * WebCore.vcproj/WebCore.vcproj: Added SVGElementFactory.cpp to the
+        project directly. VS also decided to reformat this file a little bit.
+
+2009-02-10  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 23536: Auto-generate HTMLElementFactory
+
+        Those are the last auto-generation bits needed to have a working generated HTMLElementFactory:
+
+        - Added a new option mapToTagName that enables a tag to use another's options and tagName (<image>
+          uses imgTag for example) and wired the code generation to be consistent with the current factory.
+
+        - Disabled dashboard compatibility check for HTMLElementFactory as it would make at least one test case fail.
+
+        - Pass the QualifiedName down to the Element constructor for shared constructors to make the generated code as
+          close as possible to the current one. We will pass the QualifiedName for all Element in a forthcoming patch.
+
+        * dom/make_names.pl: Did all the above points and tweaked the code generation to match the current HTMLElementFactory
+          as closely as possible.
+
+        * html/HTMLElementFactory.cpp:
+        (WebCore::quoteConstructor):
+        * html/HTMLQuoteElement.cpp:
+        (WebCore::HTMLQuoteElement::HTMLQuoteElement): Moved setUsesBeforeAfterRules to HTMLQuoteElement' constructor because some
+        part of the code creates elements without using the HTMLElementFactory. Also added a FIXME as it is not the right place.
+
+        * html/HTMLTagNames.in: Corrected <image> parameters.
+
+2009-02-10  David Hyatt  <hyatt@apple.com>
+
+        Fix for pixel test regression in fast/text.  Make sure not to add in
+        the borderTop and paddingTop of the block to the baseline when painting
+        strict mode text decorations.
+
+        Reviewed by Mark Rowe
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paintTextDecorations):
+        * rendering/InlineFlowBox.h:
+
+2009-02-10  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Windows build fix after r40837.
+
+        Not reviewed.
+
+        * DerivedSources.cpp:
+
+2009-02-10  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        <rdar://6349412> REGRESSION(r37204): Page is not repainted during and
+        after pan scrolling
+
+        Reviewed by Steve Falkenburg.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents): Don't repaint the pan scroll
+        icon rect immediately; we will paint after the view has been scrolled.
+
+2009-02-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/6156755> onMouseOver events do not fire properly for cross frame drag and drop
+
+        This problem was caused by incorrectly ignoring whether or not the
+        default behaviour of the mousedown event was suppressed.  If a
+        mousedown handler in a frame prevents default handling then the
+        subsequent mousemove events fired for the drag should not be
+        captured by that frame, should the mouse move out of its bounds.
+
+        Test: fast/events/mouse-drag-from-frame.html
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::EventHandler):
+        (WebCore::EventHandler::clear):
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+            Reset new m_capturesDragging flag
+
+        (WebCore::EventHandler::handleMousePressEvent):
+            Respect the m_capturesDragging flag when we propagate
+            a mousedown event to a subframe.
+
+        * page/EventHandler.h:
+        (WebCore::EventHandler::capturesDragging):
+
+2009-02-10  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes for recent changes to TransformationMatrix and DOMElement.
+
+        * WebCoreSources.bkl:
+        * dom/Element.cpp:
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * platform/graphics/wx/TransformationMatrixWx.cpp:
+        (WebCore::TransformationMatrix::operator wxGraphicsMatrix):
+
+2009-02-10  David Hyatt  <hyatt@apple.com>
+
+        Some renames on line boxes.  xPos()/yPos() -> x()/y().  setXPos()/setYPos() -> setX()/setY().  m_object/object() -> m_renderer/renderer().  textObject() -> textRenderer().
+
+        Reviewed by Sam Weinig
+
+        * dom/Position.cpp:
+        (WebCore::Position::upstream):
+        (WebCore::Position::downstream):
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::leftVisuallyDistinctCandidate):
+        (WebCore::VisiblePosition::rightVisuallyDistinctCandidate):
+        (WebCore::VisiblePosition::localCaretRect):
+        * editing/visible_units.cpp:
+        (WebCore::startPositionForLine):
+        (WebCore::endPositionForLine):
+        (WebCore::previousLinePosition):
+        (WebCore::nextLinePosition):
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::paint):
+        (WebCore::EllipsisBox::nodeAtPoint):
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::showTreeForThis):
+        (WebCore::InlineBox::height):
+        (WebCore::InlineBox::caretMinOffset):
+        (WebCore::InlineBox::caretMaxOffset):
+        (WebCore::InlineBox::deleteLine):
+        (WebCore::InlineBox::extractLine):
+        (WebCore::InlineBox::attachLine):
+        (WebCore::InlineBox::adjustPosition):
+        (WebCore::InlineBox::paint):
+        (WebCore::InlineBox::nodeAtPoint):
+        (WebCore::InlineBox::selectionState):
+        (WebCore::InlineBox::canAccommodateEllipsis):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
+        (WebCore::InlineBox::renderer):
+        (WebCore::InlineBox::setX):
+        (WebCore::InlineBox::x):
+        (WebCore::InlineBox::setY):
+        (WebCore::InlineBox::y):
+        (WebCore::InlineBox::topOverflow):
+        (WebCore::InlineBox::bottomOverflow):
+        (WebCore::InlineBox::leftOverflow):
+        (WebCore::InlineBox::rightOverflow):
+        (WebCore::InlineBox::visibleToHitTesting):
+        (WebCore::InlineBox::boxModelObject):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::height):
+        (WebCore::InlineFlowBox::addToLine):
+        (WebCore::InlineFlowBox::removeLineBoxFromRenderObject):
+        (WebCore::InlineFlowBox::extractLineBoxFromRenderObject):
+        (WebCore::InlineFlowBox::attachLineBoxToRenderObject):
+        (WebCore::InlineFlowBox::rendererLineBoxes):
+        (WebCore::InlineFlowBox::onEndChain):
+        (WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::InlineFlowBox::verticallyAlignBoxes):
+        (WebCore::InlineFlowBox::adjustMaxAscentAndDescent):
+        (WebCore::verticalPositionForBox):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        (WebCore::InlineFlowBox::paint):
+        (WebCore::InlineFlowBox::paintFillLayer):
+        (WebCore::InlineFlowBox::paintBoxShadow):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        (WebCore::InlineFlowBox::paintTextDecorations):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::borderLeft):
+        (WebCore::InlineFlowBox::borderRight):
+        (WebCore::InlineFlowBox::borderTop):
+        (WebCore::InlineFlowBox::borderBottom):
+        (WebCore::InlineFlowBox::baseline):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::height):
+        (WebCore::InlineTextBox::selectionState):
+        (WebCore::InlineTextBox::selectionRect):
+        (WebCore::InlineTextBox::deleteLine):
+        (WebCore::InlineTextBox::extractLine):
+        (WebCore::InlineTextBox::attachLine):
+        (WebCore::InlineTextBox::placeEllipsisBox):
+        (WebCore::InlineTextBox::isLineBreak):
+        (WebCore::InlineTextBox::nodeAtPoint):
+        (WebCore::InlineTextBox::paint):
+        (WebCore::InlineTextBox::selectionStartEnd):
+        (WebCore::InlineTextBox::paintSelection):
+        (WebCore::InlineTextBox::paintCompositionBackground):
+        (WebCore::InlineTextBox::paintCustomHighlight):
+        (WebCore::InlineTextBox::paintDecoration):
+        (WebCore::InlineTextBox::paintSpellingOrGrammarMarker):
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        (WebCore::InlineTextBox::paintDocumentMarkers):
+        (WebCore::InlineTextBox::paintCompositionUnderline):
+        (WebCore::InlineTextBox::textPos):
+        (WebCore::InlineTextBox::offsetForPosition):
+        (WebCore::InlineTextBox::positionForOffset):
+        * rendering/InlineTextBox.h:
+        (WebCore::InlineTextBox::textRenderer):
+        * rendering/ListMarkerBox.cpp:
+        (WebCore::ListMarkerBox::isText):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintEllipsisBoxes):
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        (WebCore::RenderBlock::positionForBox):
+        (WebCore::RenderBlock::positionForCoordinates):
+        (WebCore::RenderBlock::getBaselineOfFirstLineBox):
+        (WebCore::RenderBlock::getBaselineOfLastLineBox):
+        (WebCore::RenderBlock::adjustForBorderFit):
+        (WebCore::RenderBlock::addFocusRingRects):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintCustomHighlight):
+        (WebCore::RenderBox::position):
+        (WebCore::RenderBox::containingBlockWidthForPositioned):
+        (WebCore::RenderBox::calcAbsoluteHorizontalValues):
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::absoluteRects):
+        (WebCore::RenderInline::absoluteQuads):
+        (WebCore::RenderInline::offsetLeft):
+        (WebCore::RenderInline::offsetTop):
+        (WebCore::RenderInline::linesBoundingBox):
+        (WebCore::RenderInline::relativePositionedInlineOffset):
+        (WebCore::RenderInline::addFocusRingRects):
+        (WebCore::RenderInline::paintOutline):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::localBoundingBox):
+        * rendering/RenderSVGTSpan.cpp:
+        (WebCore::RenderSVGTSpan::absoluteRects):
+        (WebCore::RenderSVGTSpan::absoluteQuads):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::absoluteRects):
+        (WebCore::RenderSVGText::absoluteQuads):
+        (WebCore::RenderSVGText::relativeBBox):
+        * rendering/RenderSVGTextPath.cpp:
+        (WebCore::RenderSVGTextPath::absoluteRects):
+        (WebCore::RenderSVGTextPath::absoluteQuads):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::absoluteRects):
+        (WebCore::RenderText::absoluteRectsForRange):
+        (WebCore::RenderText::absoluteQuads):
+        (WebCore::RenderText::absoluteQuadsForRange):
+        (WebCore::RenderText::localCaretRect):
+        (WebCore::RenderText::linesBoundingBox):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::height):
+        (WebCore::RootInlineBox::clearTruncation):
+        (WebCore::RootInlineBox::placeEllipsis):
+        (WebCore::RootInlineBox::paintEllipsisBox):
+        (WebCore::RootInlineBox::addHighlightOverflow):
+        (WebCore::RootInlineBox::paintCustomHighlight):
+        (WebCore::RootInlineBox::paint):
+        (WebCore::RootInlineBox::nodeAtPoint):
+        (WebCore::RootInlineBox::childRemoved):
+        (WebCore::RootInlineBox::fillLineSelectionGap):
+        (WebCore::RootInlineBox::block):
+        (WebCore::isEditableLeaf):
+        (WebCore::RootInlineBox::closestLeafChildForXPos):
+        (WebCore::RootInlineBox::setVerticalOverflowPositions):
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::bottomOverflow):
+        (WebCore::RootInlineBox::floats):
+        (WebCore::RootInlineBox::setHorizontalOverflowPositions):
+        (WebCore::RootInlineBox::setVerticalSelectionPositions):
+        * rendering/SVGCharacterLayoutInfo.cpp:
+        (WebCore::SVGCharacterLayoutInfo::addLayoutInformation):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::calculateGlyphWidth):
+        (WebCore::SVGInlineTextBoxClosestCharacterToPositionWalker::chunkPortionCallback):
+        (WebCore::SVGInlineTextBoxSelectionRectWalker::chunkPortionCallback):
+        (WebCore::SVGInlineTextBox::svgCharacterHitsPosition):
+        (WebCore::SVGInlineTextBox::nodeAtPoint):
+        (WebCore::SVGInlineTextBox::paintCharacters):
+        (WebCore::SVGInlineTextBox::paintSelection):
+        (WebCore::SVGInlineTextBox::paintDecoration):
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::writeSVGInlineTextBox):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBoxPaintWalker::SVGRootInlineBoxPaintWalker):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkStartCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkEndCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkSetupFillCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkSetupStrokeCallback):
+        (WebCore::SVGRootInlineBoxPaintWalker::chunkPortionCallback):
+        (WebCore::SVGRootInlineBox::paint):
+        (WebCore::cummulatedWidthOfInlineBoxCharacterRange):
+        (WebCore::cummulatedHeightOfInlineBoxCharacterRange):
+        (WebCore::svgTextRunForInlineTextBox):
+        (WebCore::cummulatedWidthOrHeightOfTextChunk):
+        (WebCore::applyTextAnchorToTextChunk):
+        (WebCore::SVGRootInlineBox::buildLayoutInformation):
+        (WebCore::SVGRootInlineBox::layoutInlineBoxes):
+        (WebCore::SVGRootInlineBox::buildLayoutInformationForTextBox):
+        (WebCore::SVGRootInlineBox::buildTextChunks):
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::constructLine):
+        (WebCore::RenderBlock::computeVerticalPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::checkLinesForTextOverflow):
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::cumulativeCharacterRangeLength):
+        (WebCore::SVGInlineTextBoxQueryWalker::chunkPortionCallback):
+        (WebCore::findInlineTextBoxInTextChunks):
+
+2009-02-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Clean up "fallbackAnimating" logic in AnimationBase. This flag indicates
+        that animation of an accelerated property must run in software for some reason.
+
+        Also remove use of private headers in GraphicsLayerCA related to a case
+        where we may have to fall back on software animation of transform.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::blendProperties):
+        * page/animation/AnimationBase.h:
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::animate):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::animate):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::getValueFunctionNameForTransformOperation):
+        (WebCore::caValueFunctionSupported):
+        (WebCore::GraphicsLayerCA::setBackgroundColor):
+        (WebCore::GraphicsLayerCA::setOpacity):
+        (WebCore::GraphicsLayerCA::animateTransform):
+        (WebCore::GraphicsLayerCA::animateFloat):
+        (WebCore::GraphicsLayerCA::setBasicAnimation):
+        (WebCore::GraphicsLayerCA::setKeyframeAnimation):
+
+2009-02-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Move enclosingCompositingLayer() from RenderObject to RenderLayer, since it
+        relates to the RenderLayer z-order/overflow structure, rather than the render tree
+        parent chain. Add a convenience method, ancestorCompositingLayer(), which finds
+        the enclosing layer excluding self.
+
+        Fix enclosingCompositingLayer() to correctly look at stacking context and overflow
+        lists.
+
+        Check for documentBeingDestroyed() in a few places to avoid work on document
+        teardown.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::enclosingCompositingLayer):
+        (WebCore::RenderLayer::setParent):
+        (WebCore::RenderLayer::dirtyZOrderLists):
+        (WebCore::RenderLayer::dirtyOverflowList):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::ancestorCompositingLayer):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        (WebCore::RenderLayerCompositor::calculateCompositedBounds):
+        (WebCore::RenderLayerCompositor::layerWillBeRemoved):
+        (WebCore::RenderLayerCompositor::clippedByAncestor):
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containerForRepaint):
+        * rendering/RenderObject.h:
+
+2009-02-10  David Hyatt  <hyatt@apple.com>
+
+        Rename xPos() and yPos() on RenderLayer to x() and y() to match RenderBox.  Rename setPos to setLocation.
+
+        Reviewed by Simon Fraser
+
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::MouseRelatedEvent::receivedTarget):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::convertToLayerCoords):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::x):
+        (WebCore::RenderLayer::y):
+        (WebCore::RenderLayer::setLocation):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write):
+        (WebCore::externalRepresentation):
+
+2009-02-10  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23879
+        Add missing PLATFORM(SKIA) changes to TransformationMatrix.h
+
+        * platform/graphics/transforms/TransformationMatrix.h:
+
+2009-02-10  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=15897
+        Please implement getBoundingClientRect and getClientRects
+        <rdar://problem/6139669>
+
+        Cursory implementation of Element.getBoundingClientRect and
+        Element.getClientRects. Adds necessary infrastructure classes
+        ClientRect and ClientRectList.
+
+        Tests: fast/dom/getBoundingClientRect.html
+               fast/dom/getClientRects.html
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/ClientRect.cpp: Added.
+        (WebCore::ClientRect::ClientRect):
+        * dom/ClientRect.h: Added.
+        (WebCore::ClientRect::create):
+        (WebCore::ClientRect::top):
+        (WebCore::ClientRect::right):
+        (WebCore::ClientRect::bottom):
+        (WebCore::ClientRect::left):
+        (WebCore::ClientRect::width):
+        (WebCore::ClientRect::height):
+        * dom/ClientRect.idl: Added.
+        * dom/ClientRectList.cpp: Added.
+        (WebCore::ClientRectList::ClientRectList):
+        (WebCore::ClientRectList::~ClientRectList):
+        (WebCore::ClientRectList::length):
+        (WebCore::ClientRectList::item):
+        * dom/ClientRectList.h: Added.
+        (WebCore::ClientRectList::create):
+        * dom/ClientRectList.idl: Added.
+        * dom/Element.cpp:
+        (WebCore::Element::getClientRects):
+        (WebCore::Element::getBoundingClientRect):
+        * dom/Element.h:
+        * dom/Element.idl:
+        * page/DOMWindow.idl:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::absoluteRects):
+        (WebCore::RenderInline::absoluteQuads):
+
+2009-02-10  David Hyatt  <hyatt@apple.com>
+
+        Get rid of capsLockStateMayHaveChanged on RenderObject.  It is only implemented by one class (text fields),
+        so devirtualize and just query at the single call site.
+
+        Reviewed by Eric Seidel
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::capsLockStateMayHaveChanged):
+        * rendering/RenderObject.h:
+        * rendering/RenderTextControlSingleLine.h:
+
+2009-02-10  David Hyatt  <hyatt@apple.com>
+
+        Shrink the size of all RenderObjects (except for RenderInlines) by 4 bytes.  This patch moves the cached vertical position member to RenderInlines,
+        since they were the only objects being queried across multiple lines.
+
+        Reviewed by Sam Weinig
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::verticalPositionForBox):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::verticalPosition):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::RenderInline):
+        (WebCore::RenderInline::verticalPositionFromCache):
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::invalidateVerticalPosition):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        * rendering/RenderObject.h:
+        * rendering/RenderText.cpp:
+        * rendering/RenderText.h:
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2009-02-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23868
+        Fix code style issues: removed 80-col wrapping, incorrect include style, if statement body on same line.
+
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp:
+
+2009-02-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23868
+        Add HTMLInputElement and HTMLOptionsCollection V8 custom bindings.
+
+        * bindings/v8/custom/V8HTMLInputElementCustom.cpp: Added.
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8HTMLOptionsCollectionCustom.cpp: Added.
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::ACCESSOR_SETTER):
+
+2009-02-10  Adam Roben  <aroben@apple.com>
+
+        Fix Bug 23871: Assertion failure beneath WebCore::openFunc when
+        running http/tests/security/xss-DENIED-xsl-document-redirect.xml
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23871>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Covered by existing tests.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::openFunc): Use the two-parameter KURL constructor so that
+        the string will be parsed. libxml2 gives us a UTF-8-encoded string
+        that needs to be parsed.
+
+2009-02-10  David Hyatt  <hyatt@apple.com>
+
+        Shrink the size of all replaced elements (images, form controls, plugins) by 4 bytes by packing the
+        overflow boolean into the RenderObject base class.
+
+        Reviewed by Sam Weinig
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::replacedHasOverflow):
+        (WebCore::RenderObject::setReplacedHasOverflow):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::RenderReplaced):
+        (WebCore::RenderReplaced::~RenderReplaced):
+        (WebCore::RenderReplaced::adjustOverflowForBoxShadow):
+        (WebCore::RenderReplaced::overflowHeight):
+        (WebCore::RenderReplaced::overflowWidth):
+        (WebCore::RenderReplaced::overflowLeft):
+        (WebCore::RenderReplaced::overflowTop):
+        (WebCore::RenderReplaced::overflowRect):
+        * rendering/RenderReplaced.h:
+
+2009-02-10  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23870
+        Make it possible for a port to require a user gesture for an <audio> or <video> element
+        to load a url.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Initialize m_loadRestrictions.
+        (WebCore::HTMLMediaElement::attributeChanged): Only one attribute can change so put an "else" between tests.
+        (WebCore::HTMLMediaElement::load): Return INVALID_STATE_ERR if RequireUserGestureLoadRestriction is set
+        and we are not preocessing a user gesture.
+        (WebCore::HTMLMediaElement::mediaPlayerNetworkStateChanged): Remove unnecessary white space.
+        (WebCore::HTMLMediaElement::play): Ditto.
+        (WebCore::HTMLMediaElement::endScrubbing): Remove unnecessary braces added in r40789.
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged): Cache currentTime() in a local instead of calling it
+        multiple times.
+        (WebCore::HTMLMediaElement::processingUserGesture): New.
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::): Define LoadRestrictions, add m_loadRestrictions.
+
+2009-02-10  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Sam Weinig.
+
+        Remove the SVG checks from FloatPoint3D as it is used
+        by TransformationMatrix.
+
+        * platform/graphics/FloatPoint3D.cpp:
+        * platform/graphics/FloatPoint3D.h:
+
+2009-02-10  David Hyatt  <hyatt@apple.com>
+
+        Remove the m_baseline member variable from all line boxes, since it can easily be computed when needed and did not need to be cached.
+
+        Reviewed by Sam Weinig
+
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::paint):
+        (WebCore::EllipsisBox::nodeAtPoint):
+        * rendering/EllipsisBox.h:
+        (WebCore::EllipsisBox::EllipsisBox):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::verticallyAlignBoxes):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        (WebCore::InlineFlowBox::paintTextDecorations):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::marginBorderPaddingLeft):
+        (WebCore::InlineFlowBox::marginBorderPaddingRight):
+        (WebCore::InlineFlowBox::marginLeft):
+        (WebCore::InlineFlowBox::marginRight):
+        (WebCore::InlineFlowBox::borderLeft):
+        (WebCore::InlineFlowBox::borderRight):
+        (WebCore::InlineFlowBox::borderTop):
+        (WebCore::InlineFlowBox::borderBottom):
+        (WebCore::InlineFlowBox::paddingLeft):
+        (WebCore::InlineFlowBox::paddingRight):
+        (WebCore::InlineFlowBox::paddingTop):
+        (WebCore::InlineFlowBox::paddingBottom):
+        (WebCore::InlineFlowBox::includeLeftEdge):
+        (WebCore::InlineFlowBox::includeRightEdge):
+        (WebCore::InlineFlowBox::baseline):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paint):
+        (WebCore::InlineTextBox::paintDecoration):
+        (WebCore::InlineTextBox::paintSpellingOrGrammarMarker):
+        (WebCore::InlineTextBox::paintCompositionUnderline):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::getBaselineOfFirstLineBox):
+        (WebCore::RenderBlock::getBaselineOfLastLineBox):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::baselinePosition):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::placeEllipsis):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paintDecoration):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::applyTextAnchorToTextChunk):
+        (WebCore::SVGRootInlineBox::layoutInlineBoxes):
+
+2009-02-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23867
+        Eliminate obsolete frame->document() checks
+
+        * page/FrameView.cpp: (WebCore::FrameView::paintContents): Apparently due to a typo
+        (document vs. !document), fillWithRed was always set to false, and other branches were
+        never taken. Removing the check for document restores debug-only red color filling.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::begin): Only call dispatchWindowObjectAvailable()
+        after a document is created. A client can do anything in its delegate method, so we'd need
+        to have frame->document() checks otherwise. DumpRenderTree uses this delegate to add its
+        custom property, and it was crashing due to null document in JSDOMWindowBase::getOwnPropertySlot().
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::getOwnPropertySlot):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        * bindings/js/JSNavigatorCustom.cpp:
+        (WebCore::needsYouTubeQuirk):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::updateRenderingForBindings):
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * editing/Editor.cpp:
+        (WebCore::Editor::deleteWithDirection):
+        (WebCore::Editor::dispatchCPPEvent):
+        (WebCore::Editor::applyStyle):
+        (WebCore::Editor::applyParagraphStyle):
+        * editing/EditorCommand.cpp:
+        (WebCore::Editor::Command::execute):
+        (WebCore::Editor::Command::isEnabled):
+        (WebCore::Editor::Command::state):
+        (WebCore::Editor::Command::value):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::recomputeCaretRect):
+        (WebCore::SelectionController::selectFrameElementInParentIfFullySelected):
+        (WebCore::SelectionController::selectAll):
+        (WebCore::SelectionController::setFocused):
+        * inspector/InspectorController.cpp:
+        (WebCore::getResourceDocumentNode):
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::setJavaScriptPaused):
+        * loader/DocumentLoader.cpp:
+        (WebCore::canonicalizedTitle):
+        (WebCore::DocumentLoader::stopLoading):
+        (WebCore::DocumentLoader::isLoadingInAPISense):
+        (WebCore::DocumentLoader::subresource):
+        (WebCore::DocumentLoader::getSubresources):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::urlSelected):
+        (WebCore::FrameLoader::stop):
+        (WebCore::FrameLoader::iconURL):
+        (WebCore::FrameLoader::executeIfJavaScriptURL):
+        (WebCore::FrameLoader::clear):
+        (WebCore::FrameLoader::endIfNotLoadingMainResource):
+        (WebCore::FrameLoader::restoreDocumentState):
+        (WebCore::FrameLoader::gotoAnchor):
+        (WebCore::FrameLoader::loadDone):
+        (WebCore::FrameLoader::checkCompleted):
+        (WebCore::FrameLoader::checkCallImplicitClose):
+        (WebCore::FrameLoader::scheduleRefresh):
+        (WebCore::FrameLoader::outgoingOrigin):
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        (WebCore::FrameLoader::updatePolicyBaseURL):
+        (WebCore::FrameLoader::setPolicyBaseURL):
+        (WebCore::FrameLoader::frameDetached):
+        (WebCore::FrameLoader::shouldScrollToAnchor):
+        (WebCore::FrameLoader::saveDocumentState):
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::create):
+        * loader/icon/IconFetcher.cpp:
+        (WebCore::IconFetcher::create):
+        * loader/icon/IconLoader.cpp:
+        (WebCore::IconLoader::startLoading):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::visiblePositionForPoint):
+        * page/Chrome.cpp:
+        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
+        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage):
+        (WebCore::DOMWindow::alert):
+        (WebCore::DOMWindow::confirm):
+        (WebCore::DOMWindow::prompt):
+        (WebCore::DOMWindow::scrollX):
+        (WebCore::DOMWindow::scrollY):
+        (WebCore::DOMWindow::getMatchedCSSRules):
+        (WebCore::DOMWindow::openDatabase):
+        (WebCore::DOMWindow::scrollBy):
+        (WebCore::DOMWindow::scrollTo):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::allowDHTMLDrag):
+        (WebCore::EventHandler::scrollOverflow):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseDoubleClickEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+        (WebCore::EventHandler::updateDragAndDrop):
+        (WebCore::EventHandler::handleWheelEvent):
+        (WebCore::EventHandler::sendContextMenuEvent):
+        (WebCore::EventHandler::capsLockStateMayHaveChanged):
+        (WebCore::EventHandler::sendResizeEvent):
+        (WebCore::EventHandler::sendScrollEvent):
+        * page/FocusController.cpp:
+        (WebCore::deepFocusableNode):
+        (WebCore::FocusController::advanceFocus):
+        * page/Frame.cpp:
+        (WebCore::Frame::setFocusedNodeIfNeeded):
+        (WebCore::Frame::shouldApplyTextZoom):
+        (WebCore::Frame::shouldApplyPageZoom):
+        (WebCore::Frame::setZoomFactor):
+        (WebCore::Frame::setPrinting):
+        (WebCore::Frame::reapplyStyles):
+        (WebCore::Frame::isContentEditable):
+        (WebCore::Frame::computeAndSetTypingStyle):
+        (WebCore::Frame::selectionComputedStyle):
+        (WebCore::Frame::applyEditingStyleToBodyElement):
+        (WebCore::Frame::removeEditingStyleFromBodyElement):
+        (WebCore::Frame::contentRenderer):
+        (WebCore::Frame::styleForSelectionStart):
+        (WebCore::Frame::setSelectionFromNone):
+        (WebCore::Frame::findString):
+        (WebCore::Frame::markAllMatchesForText):
+        (WebCore::Frame::setMarkedTextMatchesAreHighlighted):
+        (WebCore::Frame::documentTypeString):
+        (WebCore::Frame::shouldClose):
+        (WebCore::Frame::respondToChangedSelection):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::~FrameView):
+        (WebCore::FrameView::createScrollbar):
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::layoutTimerFired):
+        (WebCore::FrameView::scheduleRelayout):
+        (WebCore::FrameView::needsLayout):
+        (WebCore::FrameView::unscheduleRelayout):
+        (WebCore::FrameView::windowClipRect):
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::disconnectFrame):
+        * page/Page.cpp:
+        (WebCore::networkStateChanged):
+        (WebCore::Page::~Page):
+        (WebCore::Page::unmarkAllTextMatches):
+        (WebCore::Page::setMediaVolume):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateRenderingDispatcherFired):
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::currentKeyboardEvent):
+        (WebCore::EventHandler::needsKeyboardEventDisambiguationQuirks):
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::dashboardRegionsDictionary):
+        (WebCore::Frame::setUserStyleSheetLocation):
+        (WebCore::Frame::setUserStyleSheet):
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::dispatchStorageEvent):
+        * storage/SessionStorageArea.cpp:
+        (WebCore::SessionStorageArea::dispatchStorageEvent):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::setContainerSize):
+        (WebCore::SVGImage::usesContainerSize):
+        (WebCore::SVGImage::size):
+        (WebCore::SVGImage::hasRelativeWidth):
+        (WebCore::SVGImage::hasRelativeHeight):
+        Removed frame->document() checks.
+
+2009-02-10  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Attempt to fix the Qt build after r40791.
+
+        * rendering/RenderSVGRoot.cpp:
+
+2009-02-10  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Minor code cleanup.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::replaceChild):
+
+2009-02-10  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix Qt build following r40793.
+
+        * editing/qt/EditorQt.cpp:
+
+2009-02-10  Feng Qian <feng@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix crashes when accessing navigator object of a deleted frame.
+        https://bugs.webkit.org/show_bug.cgi?id=23626
+        A layout test is added: fast/dom/navigator-detached-no-crash.html
+
+        * page/Navigator.cpp:
+        (WebCore::Navigator::cookieEnabled):
+        (WebCore::Navigator::javaEnabled):
+
+2009-02-10  Sverrir Berg  <sverrir@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23630
+        Add complex font rendering using Skia instead of Windows ScriptTextOut.
+        This adds support for enhanced webkit styles when drawing complex
+        glyphs.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/chromium/UniscribeHelper.cpp:
+        (WebCore::containsMissingGlyphs):
+        (WebCore::UniscribeHelper::draw):
+        (WebCore::UniscribeHelper::shape):
+        * platform/graphics/chromium/UniscribeHelper.h:
+        * platform/graphics/skia/SkiaFontWin.cpp:
+        (WebCore::windowsCanHandleTextDrawing):
+        (WebCore::skiaDrawText):
+        (WebCore::paintSkiaText):
+        * platform/graphics/skia/SkiaFontWin.h:
+
+2009-02-10  Darin Fisher  <darin@chromium.org>
+
+        Revert r40797 as requested by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23809
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/Document.idl:
+        * html/HTMLCanvasElement.idl:
+
+2009-02-09  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23855
+        Fix TransformationMatrixSkia.cpp and GraphicsContextSkia.cpp bustage
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/skia/TransformationMatrixSkia.cpp:
+        (WebCore::TransformationMatrix::operator SkMatrix):
+
+2009-02-09  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6568942> REGRESSION: Font rendering in Wikipedia input field is incorrect (default GDI text mode)
+
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+        (WebCore::SimpleFontData::widthForGDIGlyph): Make sure that the DC is
+        in the advanced graphics mode before calling GetCharWidthI(), because
+        otherwise that function returns incorrect results for the default UI
+        font at a certain size.
+
+2009-02-09  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser
+
+        https://bugs.webkit.org/show_bug.cgi?id=23689
+
+        Added 3D functions to WebKitCSSMatrix. This depends on the 3D functions
+        added to TransformationMatrix in https://bugs.webkit.org/show_bug.cgi?id=6868
+
+        Test: transforms/3d/cssmatrix-3d-interface.xhtml
+
+        * css/WebKitCSSMatrix.cpp:
+        * css/WebKitCSSMatrix.h:
+        * css/WebKitCSSMatrix.idl:
+
+2009-02-09  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=23858>
+        Bug 23858: Crash when removing a HTMLSelectElement from the document from inside its focus event handler
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::menuListDefaultEventHandler): Don't store the renderer in a local variable
+        as it can be invalidated by any of the calls to focus() within the function.  Instead, retrieve it and
+        null-check it when it is needed.
+
+2009-02-09  David Hyatt  <hyatt@apple.com>
+
+        Remove the m_height member from InlineBox.  This shaves 4 bytes off of all inline boxes.  Unfortunately SVG
+        sets heights that are independent of the renderer or of the font, and so all SVG boxes have to retain m_height
+        member variables.
+
+        height() on InlineBox is now a virtual function that does a dynamic computation (including shrinking boxes
+        with no text children).  For SVG boxes there is also a non-virtual setHeight function for updating the
+        m_height member variable like before.
+
+        Reviewed by Darin Adler
+
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::nodeAtPoint):
+        * rendering/EllipsisBox.h:
+        (WebCore::EllipsisBox::EllipsisBox):
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::height):
+        (WebCore::InlineBox::root):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
+        (WebCore::InlineBox::isInlineFlowBox):
+        (WebCore::InlineBox::isRootInlineBox):
+        (WebCore::InlineBox::topOverflow):
+        (WebCore::InlineBox::bottomOverflow):
+        (WebCore::InlineBox::leftOverflow):
+        (WebCore::InlineBox::rightOverflow):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::height):
+        (WebCore::InlineFlowBox::adjustMaxAscentAndDescent):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        (WebCore::InlineFlowBox::shrinkBoxesWithNoTextChildren):
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::isInlineFlowBox):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::height):
+        (WebCore::InlineTextBox::nodeAtPoint):
+        (WebCore::InlineTextBox::paintSpellingOrGrammarMarker):
+        (WebCore::InlineTextBox::paintCompositionUnderline):
+        * rendering/InlineTextBox.h:
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::height):
+        (WebCore::RootInlineBox::placeEllipsis):
+        (WebCore::RootInlineBox::setVerticalOverflowPositions):
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::isRootInlineBox):
+        (WebCore::RootInlineBox::topOverflow):
+        (WebCore::RootInlineBox::bottomOverflow):
+        (WebCore::RootInlineBox::leftOverflow):
+        (WebCore::RootInlineBox::rightOverflow):
+        (WebCore::RootInlineBox::selectionBottom):
+        (WebCore::RootInlineBox::Overflow::Overflow):
+        (WebCore::RootInlineBox::setVerticalSelectionPositions):
+        * rendering/SVGInlineFlowBox.h:
+        (WebCore::SVGInlineFlowBox::SVGInlineFlowBox):
+        (WebCore::SVGInlineFlowBox::height):
+        (WebCore::SVGInlineFlowBox::setHeight):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::SVGInlineTextBox):
+        * rendering/SVGInlineTextBox.h:
+        (WebCore::SVGInlineTextBox::height):
+        (WebCore::SVGInlineTextBox::setHeight):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::layoutInlineBoxes):
+        * rendering/SVGRootInlineBox.h:
+        (WebCore::SVGRootInlineBox::SVGRootInlineBox):
+        (WebCore::SVGRootInlineBox::height):
+        (WebCore::SVGRootInlineBox::setHeight):
+
+2009-02-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Document our Selection DOM extensions
+        (in preparation for re-writing Selection to work with ranges)
+
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::type):
+        * page/DOMSelection.h:
+        * page/DOMSelection.idl:
+
+2009-02-09  Eric Seidel  <eric@webkit.org>
+
+        Attempt to fix wx build
+
+        * WebCoreSources.bkl: change Selection to VisibleSelection
+
+2009-02-06  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23809
+        Return CanvasRenderingContext2D instead of DOMObject in IDL to avoid V8 #ifdefs
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/Document.idl:
+        * html/HTMLCanvasElement.idl:
+
+2009-02-09  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Transform the gradient instead of the context for most platforms and
+        transform the context after CGContextReplacePathWithStrokedPath for CG.
+
+        REGRESSION: SVG gradient transformation/BoundingBox can cause ugly stroke thickness
+        https://bugs.webkit.org/show_bug.cgi?id=23547
+
+        * platform/graphics/Gradient.h:
+        (WebCore::Gradient::setGradientSpaceTransform):
+        (WebCore::Gradient::gradientSpaceTransform):
+        * platform/graphics/cairo/GradientCairo.cpp:
+        (WebCore::Gradient::platformGradient):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        * platform/graphics/skia/GradientSkia.cpp:
+        (WebCore::Gradient::platformGradient):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::SVGPaintServerGradient):
+        (WebCore::clipToTextMask):
+        (WebCore::SVGPaintServerGradient::setup):
+        (WebCore::SVGPaintServerGradient::teardown):
+
+2009-02-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Fix the highlight when inspecting inline elements.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::drawHighlightForBox):
+        (WebCore::drawHighlightForLineBoxes):
+        (WebCore::InspectorController::drawNodeHighlight):
+
+2009-02-09  Eric Seidel  <eric@webkit.org>
+
+        Fix the gtk build by adding VisibleSelection and removing Selection.
+
+        * GNUmakefile.am:
+
+2009-02-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Rename Selection to VisibleSelection to allow us to separate
+        the selections the user works with from the ones used by
+        the JS editing APIs.
+        https://bugs.webkit.org/show_bug.cgi?id=23852
+
+        No functional changes, thus no tests.
+
+        * WebCore.base.exp:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Element.cpp:
+        (WebCore::Element::updateFocusAppearance):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::updateStartEnd):
+        (WebCore::ApplyStyleCommand::surroundNodeRangeWithElement):
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::inputText):
+        (WebCore::CompositeEditCommand::deleteSelection):
+        (WebCore::CompositeEditCommand::rebalanceWhitespace):
+        (WebCore::CompositeEditCommand::pushAnchorElementDown):
+        (WebCore::CompositeEditCommand::pushPartiallySelectedAnchorElementsDown):
+        (WebCore::CompositeEditCommand::moveParagraphs):
+        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem):
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph):
+        * editing/CompositeEditCommand.h:
+        * editing/CreateLinkCommand.cpp:
+        (WebCore::CreateLinkCommand::doApply):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::enclosingDeletableElement):
+        (WebCore::DeleteButtonController::respondToChangedSelection):
+        * editing/DeleteButtonController.h:
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::DeleteSelectionCommand):
+        (WebCore::DeleteSelectionCommand::clearTransientState):
+        (WebCore::DeleteSelectionCommand::doApply):
+        * editing/DeleteSelectionCommand.h:
+        (WebCore::DeleteSelectionCommand::create):
+        * editing/EditCommand.cpp:
+        (WebCore::EditCommand::setStartingSelection):
+        (WebCore::EditCommand::setEndingSelection):
+        * editing/EditCommand.h:
+        (WebCore::EditCommand::startingSelection):
+        (WebCore::EditCommand::endingSelection):
+        * editing/Editor.cpp:
+        (WebCore::Editor::selectionForCommand):
+        (WebCore::Editor::respondToChangedSelection):
+        (WebCore::Editor::respondToChangedContents):
+        (WebCore::Editor::applyStyle):
+        (WebCore::Editor::applyParagraphStyle):
+        (WebCore::Editor::appliedEditing):
+        (WebCore::Editor::unappliedEditing):
+        (WebCore::Editor::reappliedEditing):
+        (WebCore::Editor::insertTextWithoutSendingTextEvent):
+        (WebCore::Editor::selectComposition):
+        (WebCore::Editor::confirmComposition):
+        (WebCore::Editor::advanceToNextMisspelling):
+        (WebCore::Editor::markMisspellingsAfterTypingToPosition):
+        (WebCore::markMisspellingsOrBadGrammar):
+        (WebCore::Editor::markMisspellings):
+        (WebCore::Editor::markBadGrammar):
+        (WebCore::Editor::rangeForPoint):
+        (WebCore::Editor::transpose):
+        * editing/Editor.h:
+        * editing/EditorCommand.cpp:
+        (WebCore::expandSelectionToGranularity):
+        (WebCore::executeSwapWithMark):
+        (WebCore::enabledVisibleSelection):
+        (WebCore::enabledVisibleSelectionAndMark):
+        (WebCore::enableCaretInEditableText):
+        * editing/FormatBlockCommand.cpp:
+        (WebCore::FormatBlockCommand::modifyRange):
+        (WebCore::FormatBlockCommand::doApply):
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::indentRegion):
+        (WebCore::IndentOutdentCommand::outdentRegion):
+        (WebCore::IndentOutdentCommand::doApply):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::modifyRange):
+        (WebCore::InsertListCommand::doApply):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::performTrivialReplace):
+        (WebCore::InsertTextCommand::input):
+        * editing/ModifySelectionListLevel.cpp:
+        (WebCore::getStartEndListChildren):
+        (WebCore::canIncreaseListLevel):
+        (WebCore::canDecreaseListLevel):
+        * editing/MoveSelectionCommand.cpp:
+        (WebCore::MoveSelectionCommand::doApply):
+        * editing/RemoveFormatCommand.cpp:
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment):
+        (WebCore::ReplaceSelectionCommand::doApply):
+        (WebCore::ReplaceSelectionCommand::completeHTMLReplacement):
+        * editing/Selection.cpp: Removed.
+        * editing/Selection.h: Removed.
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::moveTo):
+        (WebCore::SelectionController::setSelection):
+        (WebCore::SelectionController::nodeWillBeRemoved):
+        (WebCore::SelectionController::clear):
+        (WebCore::SelectionController::setBase):
+        (WebCore::SelectionController::setExtent):
+        (WebCore::SelectionController::selectFrameElementInParentIfFullySelected):
+        (WebCore::SelectionController::selectAll):
+        (WebCore::SelectionController::setSelectedRange):
+        * editing/SelectionController.h:
+        (WebCore::SelectionController::selection):
+        (WebCore::SelectionController::selectionType):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::insertText):
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        * editing/TypingCommand.h:
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::honorEditableBoundaryAtOrBefore):
+        (WebCore::VisiblePosition::honorEditableBoundaryAtOrAfter):
+        * editing/VisibleSelection.cpp: Added.
+        (WebCore::VisibleSelection::VisibleSelection):
+        (WebCore::VisibleSelection::selectionFromContentsOfNode):
+        (WebCore::VisibleSelection::setBase):
+        (WebCore::VisibleSelection::setExtent):
+        (WebCore::VisibleSelection::firstRange):
+        (WebCore::VisibleSelection::toNormalizedRange):
+        (WebCore::VisibleSelection::expandUsingGranularity):
+        (WebCore::makeSearchRange):
+        (WebCore::VisibleSelection::appendTrailingWhitespace):
+        (WebCore::VisibleSelection::setBaseAndExtentToDeepEquivalents):
+        (WebCore::VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity):
+        (WebCore::VisibleSelection::updateSelectionType):
+        (WebCore::VisibleSelection::validate):
+        (WebCore::VisibleSelection::setWithoutValidation):
+        (WebCore::VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries):
+        (WebCore::VisibleSelection::isContentEditable):
+        (WebCore::VisibleSelection::isContentRichlyEditable):
+        (WebCore::VisibleSelection::rootEditableElement):
+        (WebCore::VisibleSelection::shadowTreeRootNode):
+        (WebCore::VisibleSelection::debugPosition):
+        (WebCore::VisibleSelection::formatForDebugger):
+        (WebCore::VisibleSelection::showTreeForThis):
+        (showTree):
+        * editing/VisibleSelection.h: Added.
+        (WebCore::VisibleSelection::):
+        (WebCore::VisibleSelection::selectionType):
+        (WebCore::VisibleSelection::setAffinity):
+        (WebCore::VisibleSelection::affinity):
+        (WebCore::VisibleSelection::base):
+        (WebCore::VisibleSelection::extent):
+        (WebCore::VisibleSelection::start):
+        (WebCore::VisibleSelection::end):
+        (WebCore::VisibleSelection::visibleStart):
+        (WebCore::VisibleSelection::visibleEnd):
+        (WebCore::VisibleSelection::isNone):
+        (WebCore::VisibleSelection::isCaret):
+        (WebCore::VisibleSelection::isRange):
+        (WebCore::VisibleSelection::isCaretOrRange):
+        (WebCore::VisibleSelection::isBaseFirst):
+        (WebCore::VisibleSelection::granularity):
+        (WebCore::operator==):
+        (WebCore::operator!=):
+        * editing/htmlediting.cpp:
+        (WebCore::selectionForParagraphIteration):
+        (WebCore::avoidIntersectionWithNode):
+        * editing/htmlediting.h:
+        * editing/markup.cpp:
+        (WebCore::createMarkup):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::selection):
+        * html/HTMLInputElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::selection):
+        * html/HTMLTextAreaElement.h:
+        * page/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::selection):
+        (WebCore::AccessibilityObject::visiblePositionRangeForUnorderedPositions):
+        * page/AccessibilityObject.h:
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::selection):
+        (WebCore::AccessibilityRenderObject::setSelectedTextRange):
+        (WebCore::AccessibilityRenderObject::visiblePositionRangeForLine):
+        (WebCore::AccessibilityRenderObject::setSelectedVisiblePositionRange):
+        (WebCore::AccessibilityRenderObject::doAXRangeForLine):
+        * page/AccessibilityRenderObject.h:
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::anchorNode):
+        (WebCore::DOMSelection::anchorOffset):
+        (WebCore::DOMSelection::focusNode):
+        (WebCore::DOMSelection::focusOffset):
+        (WebCore::DOMSelection::collapseToEnd):
+        (WebCore::DOMSelection::collapseToStart):
+        (WebCore::DOMSelection::getRangeAt):
+        (WebCore::DOMSelection::addRange):
+        * page/DOMSelection.h:
+        * page/DragController.cpp:
+        (WebCore::DragController::tryDocumentDrag):
+        (WebCore::setSelectionToDragCaret):
+        (WebCore::DragController::concludeEditDrag):
+        (WebCore::prepareClipboardForImageDrag):
+        (WebCore::DragController::startDrag):
+        (WebCore::DragController::placeDragCaret):
+        * page/EditorClient.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::selectClosestWordFromMouseEvent):
+        (WebCore::EventHandler::selectClosestWordOrLinkFromMouseEvent):
+        (WebCore::EventHandler::handleMousePressEventTripleClick):
+        (WebCore::EventHandler::handleMousePressEventSingleClick):
+        (WebCore::EventHandler::updateSelectionForMouseDrag):
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+        * page/Frame.cpp:
+        (WebCore::Frame::mark):
+        (WebCore::Frame::setMark):
+        (WebCore::Frame::selectionLayoutChanged):
+        (WebCore::Frame::shouldChangeSelection):
+        (WebCore::Frame::shouldDeleteSelection):
+        (WebCore::Frame::revealSelection):
+        (WebCore::Frame::setSelectionFromNone):
+        (WebCore::Frame::findString):
+        (WebCore::Frame::respondToChangedSelection):
+        * page/Frame.h:
+        * page/Page.cpp:
+        (WebCore::Page::selection):
+        * page/Page.h:
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper textMarkerRangeForSelection]):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::fillInlineSelectionGaps):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setSelectionRange):
+        (WebCore::RenderTextControl::selection):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeSelection):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::fillLineSelectionGap):
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::selectSubString):
+
+2009-02-09  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23806
+        Fix a regression crash where an empty src value and a "text/html" type
+        on an EMBED element did not finish ResourceRequest initialization due to
+        an early return.
+
+        Test: fast/loader/empty-embed-src-attribute.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::addExtraFieldsToRequest):
+
+2009-02-09  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23816
+        Clean up RenderSVGRoot.cpp
+
+        Clean up RenderSVGRoot.cpp.
+
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paint):
+        (WebCore::RenderSVGRoot::calcViewport):
+
+2009-02-09  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Antti Koivisto
+
+        https://bugs.webkit.org/show_bug.cgi?id=23737
+        Make it possible to control media element playback without knowing so many
+        internal implementation details.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::togglePlayState): New, toggle between playing and paused state.
+        (WebCore::HTMLMediaElement::beginScrubbing): New, pause as necessary for scrubbing mode.
+        (WebCore::HTMLMediaElement::endScrubbing): New, resume playback if paused for scrubbing mode.
+        * html/HTMLMediaElement.h:
+
+        (WebCore::HTMLMediaElement::hasVideo): New, added so clients don't need to access MediaPlayer directly.
+        * html/HTMLVideoElement.h:
+
+        (WebCore::HTMLVideoElement::hasVideo): New.
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlPlayButtonElement::defaultEventHandler): Use new media element
+        togglePlayState method.
+        (WebCore::MediaControlTimelineElement::defaultEventHandler): Tell media element when scrubbing
+        begins and ends so it can deal with pausing logic. Don't call setCurrentTime unless the time
+        will change.
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls): Ask media element if it is able to play instead of including
+        internal logic here.
+        (WebCore::RenderMedia::updateControlVisibility): Ditto.
+
+2009-02-09  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Antti Koivisto
+
+        Change RenderPart and RenderPartObject constructors to take a Node*
+        instead of a HTMLFrameOwnerElement* since that is all then need.
+
+        * rendering/RenderPart.cpp:
+        (WebCore::RenderPart::RenderPart): take Node* instead of HTMLFrameOwnerElement*
+        * rendering/RenderPart.h:
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::RenderPartObject):  take Node* instead of HTMLFrameOwnerElement*
+        * rendering/RenderPartObject.h:
+
+2009-02-09  Dan Bernstein  <mitz@apple.com>
+
+        - fix -Wmissing-prototypes builds
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::isHeaderElement): Marked this function static.
+        (WebCore::haveSameTagName): Ditto.
+        * editing/markup.cpp:
+        (WebCore::isSpecialAncestorBlock): Ditto.
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::makeMapBetweenRects): Removed unused function.
+        * platform/graphics/transforms/TransformationMatrix.h: Removed unused
+        declaration of private member makeMapBetweenRects().
+
+2009-02-09  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23850
+        Code cleanup of HTMLParser class which was using a mix of m_* and bare
+        class member variable names which helps to obfuscate the code.  Also
+        changed a few of the static helper functions to take a const pointer type
+        as they should not be modifying the node.
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::HTMLParser):
+        (WebCore::HTMLParser::~HTMLParser):
+        (WebCore::HTMLParser::reset):
+        (WebCore::HTMLParser::setCurrent):
+        (WebCore::HTMLParser::parseToken):
+        (WebCore::HTMLParser::parseDoctypeToken):
+        (WebCore::isTableSection):
+        (WebCore::isTablePart):
+        (WebCore::isTableRelated):
+        (WebCore::HTMLParser::insertNode):
+        (WebCore::HTMLParser::handleError):
+        (WebCore::HTMLParser::textCreateErrorCheck):
+        (WebCore::HTMLParser::commentCreateErrorCheck):
+        (WebCore::HTMLParser::headCreateErrorCheck):
+        (WebCore::HTMLParser::bodyCreateErrorCheck):
+        (WebCore::HTMLParser::framesetCreateErrorCheck):
+        (WebCore::HTMLParser::formCreateErrorCheck):
+        (WebCore::HTMLParser::isindexCreateErrorCheck):
+        (WebCore::HTMLParser::noscriptCreateErrorCheck):
+        (WebCore::HTMLParser::pCloserStrictCreateErrorCheck):
+        (WebCore::HTMLParser::mapCreateErrorCheck):
+        (WebCore::HTMLParser::getNode):
+        (WebCore::HTMLParser::allowNestedRedundantTag):
+        (WebCore::HTMLParser::processCloseTag):
+        (WebCore::HTMLParser::isInline):
+        (WebCore::HTMLParser::handleResidualStyleCloseTagAcrossBlocks):
+        (WebCore::HTMLParser::reopenResidualStyleTags):
+        (WebCore::HTMLParser::pushBlock):
+        (WebCore::HTMLParser::popBlock):
+        (WebCore::HTMLParser::popOneBlockCommon):
+        (WebCore::HTMLParser::popOneBlock):
+        (WebCore::HTMLParser::moveOneBlockToStack):
+        (WebCore::HTMLParser::checkIfHasPElementInScope):
+        (WebCore::HTMLParser::popInlineBlocks):
+        (WebCore::HTMLParser::freeBlock):
+        (WebCore::HTMLParser::createHead):
+        (WebCore::HTMLParser::handleIsindex):
+        (WebCore::HTMLParser::startBody):
+        (WebCore::HTMLParser::finished):
+        (WebCore::HTMLParser::reportErrorToConsole):
+        * html/HTMLParser.h:
+
+2009-02-09  Alexey Proskuryakov  <ap@webkit.org>
+
+        Applying review comment on a second location.
+
+        * rendering/RenderText.cpp: (WebCore::RenderText::nextOffset):
+        Use "ifdef BUILDING_ON_TIGER".
+
+2009-02-09  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23845
+        editing/deleting/backward-deletion.html fails on Tiger
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::previousOffset):
+        (WebCore::RenderText::nextOffset):
+        Work around a bug in older ICU versions by hardcoding narrow voiced marks.
+
+2009-02-09  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * WebCore.vcproj/WebCore.vcproj: Fix the XML syntax.
+
+2009-02-09  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Make WorkerMessagingProxy derive from two base proxy classes.
+        https://bugs.webkit.org/show_bug.cgi?id=23777
+
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        * dom/Worker.cpp:
+        (WebCore::Worker::terminate):
+        (WebCore::Worker::hasPendingActivity):
+        * dom/WorkerContext.cpp:
+        (WebCore::WorkerContext::reportException):
+        * dom/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerThreadActivityReportTask::performTask):
+        (WebCore::WorkerMessagingProxy::postExceptionToWorkerObject):
+        (WebCore::WorkerMessagingProxy::workerObjectDestroyed):
+        (WebCore::WorkerMessagingProxy::terminateWorkerContext):
+        (WebCore::WorkerMessagingProxy::confirmWorkerThreadMessage):
+        (WebCore::WorkerMessagingProxy::reportPendingActivity):
+        (WebCore::WorkerMessagingProxy::reportPendingActivityInternal):
+        (WebCore::WorkerMessagingProxy::hasPendingActivity):
+        * dom/WorkerMessagingProxy.h:
+
+2009-02-09  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Introduce 2 base classes to split WorkerMessagingProxy.
+        https://bugs.webkit.org/show_bug.cgi?id=23776
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/WorkerContextProxy.h: Added.
+        (WebCore::WorkerContextProxy::~WorkerContextProxy):
+        * dom/WorkerObjectProxy.h: Added.
+        (WebCore::WorkerObjectProxy::~WorkerObjectProxy):
+
+2009-02-08  David Hyatt  <hyatt@apple.com>
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23839
+
+        Make sure that generated content is properly handled when content is moved from a block run-in
+        to an inline run-in.
+
+        Reviewed by Sam Weinig
+
+        Added fast/runin/002.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleRunInChild):
+
+2009-02-08  David Hyatt  <hyatt@apple.com>
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23832, crash when inspecting an image using the
+        Web inspector.
+
+        Reviewed by Mark Rowe
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::absoluteRectsForRange):
+        (WebCore::RenderObject::absoluteQuadsForRange):
+
+2009-02-08  Dirk Schulze  <krit@webkit.org>
+
+        Unreviewed Qt build fix.
+
+        TransformationMatrix changes in r40761 broke QT build.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::scale):
+
+2009-02-08  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        This is a follow up of the last commit. It cleans up TransformationMatrix.h
+        and convert to a series of #elif.
+
+        * platform/graphics/transforms/TransformationMatrix.h:
+
+2009-02-08  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Simon Fraser.
+
+        [CAIRO] build broken by TransformationMatrix rework
+        https://bugs.webkit.org/show_bug.cgi?id=23831
+
+        Fixed cairo build after the TransformationMatrix rework done in
+        revision 40761.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::concatCTM):
+        * platform/graphics/cairo/TransformationMatrixCairo.cpp:
+        (WebCore::TransformationMatrix::operator cairo_matrix_t):
+        * platform/graphics/transforms/TransformationMatrix.h:
+
+2009-02-07  David Hyatt  <hyatt@apple.com>
+
+        Shrink the size of all InlineTextBoxes and all InlineBoxes (for images and replaced elements) by four bytes.
+        Change the overflow variable on InlineFlowBoxes into a short and move the bits for InlineFlowBoxes out of the
+        base InlineBox class.  Since the number of bits in the base class was 35, shoving the 3 bits for InlineFlowBoxes
+        back down into that class (into the 16 bits exposed by making the overflow variable into a short), all text
+        boxes and image boxes shrink by 4 bytes.
+
+        Reviewed by Anders
+
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::InlineBox):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::InlineFlowBox):
+        (WebCore::InlineFlowBox::maxHorizontalVisualOverflow):
+        (WebCore::InlineFlowBox::hasTextChildren):
+
+2009-02-07  Dean Jackson  <dino@apple.com>
+
+        Attempted build fix for Qt. Not reviewed.
+
+        TransformationMatrix changes in r40761 broke non-Apple builds.
+
+        * platform/graphics/qt/TransformationMatrixQt.cpp:
+        (WebCore::TransformationMatrix::operator QMatrix):
+        * platform/graphics/transforms/TransformationMatrix.h:
+
+2009-02-07  David Hyatt  <hyatt@apple.com>
+
+        This patch changes the base class of RenderInline from RenderBox to RenderBoxModelObject.  This shift
+        in base class knocks 32 bytes off the size of every RenderInline.  All of the necessary functions
+        for both RenderInline and RenderBox have either been pulled up into RenderBoxModelObject for sharing
+        or split into two functions (one in each derived class).
+
+        Reviewed by Anders and Antti
+
+        * dom/Element.cpp:
+        (WebCore::Element::offsetLeft):
+        (WebCore::Element::offsetTop):
+        (WebCore::Element::offsetWidth):
+        (WebCore::Element::offsetHeight):
+        (WebCore::Element::offsetParent):
+        (WebCore::Element::clientWidth):
+        (WebCore::Element::clientHeight):
+        (WebCore::Element::scrollWidth):
+        (WebCore::Element::scrollHeight):
+        * dom/Node.cpp:
+        (WebCore::Node::renderBox):
+        (WebCore::Node::renderBoxModelObject):
+        * dom/Node.h:
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::boxModelObject):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::marginLeft):
+        (WebCore::InlineFlowBox::marginRight):
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        (WebCore::InlineFlowBox::shrinkBoxesWithNoTextChildren):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::borderLeft):
+        (WebCore::InlineFlowBox::borderRight):
+        (WebCore::InlineFlowBox::paddingLeft):
+        (WebCore::InlineFlowBox::paddingRight):
+        * rendering/RenderBlock.cpp:
+        (WebCore::getBorderPaddingMargin):
+        (WebCore::RenderBlock::calcInlinePrefWidths):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::imageChanged):
+        (WebCore::RenderBox::calcReplacedWidthUsing):
+        (WebCore::RenderBox::calcReplacedHeightUsing):
+        (WebCore::RenderBox::containingBlockWidthForPositioned):
+        (WebCore::RenderBox::containingBlockHeightForPositioned):
+        (WebCore::RenderBox::calcAbsoluteHorizontal):
+        (WebCore::RenderBox::calcAbsoluteHorizontalValues):
+        (WebCore::RenderBox::calcAbsoluteVertical):
+        (WebCore::RenderBox::calcAbsoluteVerticalValues):
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced):
+        (WebCore::RenderBox::calcAbsoluteVerticalReplaced):
+        (WebCore::RenderBox::positionForCoordinates):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::borderBoundingBox):
+        (WebCore::RenderBox::offsetHeight):
+        (WebCore::RenderBox::marginTop):
+        (WebCore::RenderBox::marginBottom):
+        (WebCore::RenderBox::marginLeft):
+        (WebCore::RenderBox::marginRight):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::offsetLeft):
+        (WebCore::RenderBoxModelObject::offsetTop):
+        (WebCore::RenderBoxModelObject::paddingTop):
+        (WebCore::RenderBoxModelObject::paddingBottom):
+        (WebCore::RenderBoxModelObject::paddingLeft):
+        (WebCore::RenderBoxModelObject::paddingRight):
+        (WebCore::RenderBoxModelObject::paintFillLayerExtended):
+        (WebCore::RenderBoxModelObject::calculateBackgroundSize):
+        (WebCore::RenderBoxModelObject::calculateBackgroundImageGeometry):
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::borderTop):
+        (WebCore::RenderBoxModelObject::borderBottom):
+        (WebCore::RenderBoxModelObject::borderLeft):
+        (WebCore::RenderBoxModelObject::borderRight):
+        (WebCore::RenderBoxModelObject::hasHorizontalBordersPaddingOrMargin):
+        (WebCore::RenderBoxModelObject::hasHorizontalBordersOrPadding):
+        (WebCore::RenderBoxModelObject::childBecameNonInline):
+        (WebCore::RenderBoxModelObject::isBoxModelObject):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::RenderInline):
+        (WebCore::RenderInline::destroy):
+        (WebCore::RenderInline::styleDidChange):
+        (WebCore::nextContinuation):
+        (WebCore::RenderInline::continuationBefore):
+        (WebCore::RenderInline::addChildIgnoringContinuation):
+        (WebCore::RenderInline::splitInlines):
+        (WebCore::RenderInline::splitFlow):
+        (WebCore::RenderInline::addChildToContinuation):
+        (WebCore::RenderInline::absoluteRects):
+        (WebCore::RenderInline::offsetLeft):
+        (WebCore::RenderInline::offsetTop):
+        (WebCore::RenderInline::marginLeft):
+        (WebCore::RenderInline::marginRight):
+        (WebCore::RenderInline::positionForCoordinates):
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        (WebCore::RenderInline::rectWithOutlineForRepaint):
+        (WebCore::RenderInline::computeRectForRepaint):
+        (WebCore::RenderInline::updateDragState):
+        (WebCore::RenderInline::childBecameNonInline):
+        (WebCore::RenderInline::updateHitTestResult):
+        (WebCore::RenderInline::imageChanged):
+        (WebCore::RenderInline::addFocusRingRects):
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::marginTop):
+        (WebCore::RenderInline::marginBottom):
+        (WebCore::RenderInline::continuation):
+        (WebCore::RenderInline::setContinuation):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        (WebCore::RenderLineBoxList::hitTest):
+        * rendering/RenderLineBoxList.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::addLayers):
+        (WebCore::RenderObject::removeLayers):
+        (WebCore::RenderObject::moveLayers):
+        (WebCore::RenderObject::findNextLayer):
+        (WebCore::RenderObject::enclosingLayer):
+        (WebCore::RenderObject::enclosingCompositingLayer):
+        (WebCore::RenderObject::setLayerNeedsFullRepaint):
+        (WebCore::RenderObject::handleDynamicFloatPositionChange):
+        (WebCore::RenderObject::destroy):
+        (WebCore::RenderObject::offsetParent):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isInlineContinuation):
+        * rendering/RenderSVGTSpan.cpp:
+        (WebCore::RenderSVGTSpan::absoluteRects):
+        (WebCore::RenderSVGTSpan::absoluteQuads):
+        * rendering/RenderSVGTextPath.cpp:
+        (WebCore::RenderSVGTextPath::absoluteRects):
+        (WebCore::RenderSVGTextPath::absoluteQuads):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::setBestTruncatedAt):
+        * rendering/RenderView.h:
+        * rendering/bidi.cpp:
+        (WebCore::getBorderPaddingMargin):
+        (WebCore::inlineWidth):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::inlineFlowRequiresLineBox):
+        (WebCore::requiresLineBox):
+        (WebCore::RenderBlock::findNextLineBreak):
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::isKeyboardFocusable):
+
+2009-02-07  Yael Aharon <yael.aharon@nokia.com>
+
+        Reviewed by Timothy Hatcher <timothy@hatcher.name>
+
+        Partial fix for <https://bugs.webkit.org/show_bug.cgi?id=21051>
+        Include localStorage and sessionStorage in DatabasesPanel.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorDOMStorageResource::create):
+        (WebCore::InspectorDOMStorageResource::setScriptObject):
+        (WebCore::InspectorDOMStorageResource::InspectorDOMStorageResource):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::addDOMStorageScriptResource):
+        (WebCore::InspectorController::removeDOMStorageScriptResource):
+        (WebCore::InspectorController::resetScriptObjects):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::didUseDOMStorage):
+        * inspector/InspectorController.h:
+        * inspector/front-end/DOMStorage.js: Added.
+        (WebInspector.DOMStorage):
+        (WebInspector.DOMStorage.prototype.get domStorage):
+        (WebInspector.DOMStorage.prototype.set domStorage):
+        (WebInspector.DOMStorage.prototype.get domain):
+        (WebInspector.DOMStorage.prototype.set domain):
+        (WebInspector.DOMStorage.prototype.get isLocalStorage):
+        (WebInspector.DOMStorage.prototype.set isLocalStorage):
+        * inspector/front-end/DOMStorageItemsView.js: Added.
+        (WebInspector.DOMStorageItemsView):
+        (WebInspector.DOMStorageItemsView.prototype.show):
+        (WebInspector.DOMStorageItemsView.prototype.update):
+        * inspector/front-end/DatabaseQueryView.js:
+        (WebInspector.DatabaseQueryView):
+        * inspector/front-end/DatabaseTableView.js:
+        (WebInspector.DatabaseTableView):
+        (WebInspector.DatabaseTableView.prototype._queryFinished):
+        (WebInspector.DatabaseTableView.prototype._queryError):
+        * inspector/front-end/DatabasesPanel.js:
+        (WebInspector.DatabasesPanel):
+        (WebInspector.DatabasesPanel.prototype.reset):
+        (WebInspector.DatabasesPanel.prototype.addDatabase):
+        (WebInspector.DatabasesPanel.prototype.addDOMStorage):
+        (WebInspector.DatabasesPanel.prototype.showDatabase):
+        (WebInspector.DatabasesPanel.prototype.showDOMStorage):
+        (WebInspector.DatabasesPanel.prototype.closeVisibleView):
+        (WebInspector.DatabasesPanel.prototype.updateDatabaseTables):
+        (WebInspector.DatabasesPanel.prototype.dataGridForDOMStorage):
+        (WebInspector.DatabasesPanel.prototype._updateSidebarWidth):
+        (WebInspector.DOMStorageSidebarTreeElement):
+        (WebInspector.DOMStorageSidebarTreeElement.prototype.onselect):
+        (WebInspector.DOMStorageSidebarTreeElement.prototype.get mainTitle):
+        (WebInspector.DOMStorageSidebarTreeElement.prototype.set mainTitle):
+        (WebInspector.DOMStorageSidebarTreeElement.prototype.get subtitle):
+        (WebInspector.DOMStorageSidebarTreeElement.prototype.set subtitle):
+        * inspector/front-end/Images/domStorage.png: Added.
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.addDOMStorage):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::sessionStorage):
+        (WebCore::DOMWindow::localStorage):
+
+2009-02-07  Feng Qian <feng@chromium.org>
+
+        Reviewed by Eric Seidel <eric@webkit.org>
+
+        Put #if ENABLE(PAN_SCROLLING) around EventHandler::setPanScrollCursor.
+        https://bugs.webkit.org/show_bug.cgi?id=23574
+
+        * page/EventHandler.cpp:
+        * page/EventHandler.h:
+
+2009-02-07  Zalan Bujtas  <zbujtas@gmail.com>
+
+        Reviewed by Rob Buis <rwlbuis@gmail.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=23788
+        call style()->isOriginalDisplayInlineType() on RenderBox instead of RenderObject.
+
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::skipLeadingWhitespace):
+
+2009-02-07  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Darin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=3248
+        Bug 3248: Mouse events on OPTION element seem to be ignored
+
+        Support mouse events on options in a select when it forms a list box.
+
+        Test: fast/forms/option-mouseevents.html
+
+        * html/HTMLSelectElement.cpp: Convert to coords relative to the list box.
+        (WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
+        * rendering/RenderListBox.cpp: Handle hit testing for option elements.
+        (WebCore::RenderListBox::nodeAtPoint):
+        * rendering/RenderListBox.h:
+
+2009-02-07  Adam Treat  <adam.treat@torchmobile.com>
+
+        Prospective build fix for all non-Apple platforms.
+
+        * platform/graphics/transforms/TransformationMatrix.h:
+
+2009-02-06  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=6868
+
+        I have not only made TransformationMatrix platform independent
+        but I've also added 3D methods, which will be used when I update
+        WebKitCSSMatrix to include 3D (see https://bugs.webkit.org/show_bug.cgi?id=23689).
+        I am now keeping a full 4x4 matrix in TransformationMatrix. I'm also doing all
+        the math as doubles rather than floats. This makes a TransformationMatrix
+        go from 24 bytes to 128 bytes, but I don't think this class is used enough to
+        make this overhead will be significant.
+
+        The change from floats to doubles has caused some differences in rounding and
+        display (sometimes things that displayed as -0.0 now display as 0.0 or vice versa),
+        so I've had to change some LayoutTest results in the SVG tests.
+
+        * platform/graphics/FloatPoint.cpp:
+        (WebCore::FloatPoint::matrixTransform):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::getCTM):
+        * platform/graphics/cg/TransformationMatrixCG.cpp:
+        (WebCore::TransformationMatrix::operator CGAffineTransform):
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        (WebCore::determinant2x2):
+        (WebCore::determinant3x3):
+        (WebCore::determinant4x4):
+        (WebCore::adjoint):
+        (WebCore::inverse):
+        (WebCore::transposeMatrix4):
+        (WebCore::v4MulPointByMatrix):
+        (WebCore::v3Length):
+        (WebCore::v3Scale):
+        (WebCore::v3Dot):
+        (WebCore::v3Combine):
+        (WebCore::v3Cross):
+        (WebCore::decompose):
+        (WebCore::slerp):
+        (WebCore::TransformationMatrix::scale):
+        (WebCore::TransformationMatrix::rotateFromVector):
+        (WebCore::TransformationMatrix::flipX):
+        (WebCore::TransformationMatrix::flipY):
+        (WebCore::makeMapBetweenRects):
+        (WebCore::TransformationMatrix::projectPoint):
+        (WebCore::TransformationMatrix::mapPoint):
+        (WebCore::TransformationMatrix::mapRect):
+        (WebCore::TransformationMatrix::mapQuad):
+        (WebCore::TransformationMatrix::scale3d):
+        (WebCore::TransformationMatrix::rotate3d):
+        (WebCore::TransformationMatrix::translate):
+        (WebCore::TransformationMatrix::translate3d):
+        (WebCore::TransformationMatrix::skew):
+        (WebCore::TransformationMatrix::applyPerspective):
+        (WebCore::TransformationMatrix::multLeft):
+        (WebCore::TransformationMatrix::multVecMatrix):
+        (WebCore::TransformationMatrix::isInvertible):
+        (WebCore::TransformationMatrix::inverse):
+        (WebCore::blendFloat):
+        (WebCore::TransformationMatrix::blend):
+        (WebCore::TransformationMatrix::decompose):
+        (WebCore::TransformationMatrix::recompose):
+        * platform/graphics/transforms/TransformationMatrix.h:
+        (WebCore::TransformationMatrix::TransformationMatrix):
+        (WebCore::TransformationMatrix::setMatrix):
+        (WebCore::TransformationMatrix::operator =):
+        (WebCore::TransformationMatrix::makeIdentity):
+        (WebCore::TransformationMatrix::isIdentity):
+        (WebCore::TransformationMatrix::map):
+        (WebCore::TransformationMatrix::m11):
+        (WebCore::TransformationMatrix::setM11):
+        (WebCore::TransformationMatrix::m12):
+        (WebCore::TransformationMatrix::setM12):
+        (WebCore::TransformationMatrix::m13):
+        (WebCore::TransformationMatrix::setM13):
+        (WebCore::TransformationMatrix::m14):
+        (WebCore::TransformationMatrix::setM14):
+        (WebCore::TransformationMatrix::m21):
+        (WebCore::TransformationMatrix::setM21):
+        (WebCore::TransformationMatrix::m22):
+        (WebCore::TransformationMatrix::setM22):
+        (WebCore::TransformationMatrix::m23):
+        (WebCore::TransformationMatrix::setM23):
+        (WebCore::TransformationMatrix::m24):
+        (WebCore::TransformationMatrix::setM24):
+        (WebCore::TransformationMatrix::m31):
+        (WebCore::TransformationMatrix::setM31):
+        (WebCore::TransformationMatrix::m32):
+        (WebCore::TransformationMatrix::setM32):
+        (WebCore::TransformationMatrix::m33):
+        (WebCore::TransformationMatrix::setM33):
+        (WebCore::TransformationMatrix::m34):
+        (WebCore::TransformationMatrix::setM34):
+        (WebCore::TransformationMatrix::m41):
+        (WebCore::TransformationMatrix::setM41):
+        (WebCore::TransformationMatrix::m42):
+        (WebCore::TransformationMatrix::setM42):
+        (WebCore::TransformationMatrix::m43):
+        (WebCore::TransformationMatrix::setM43):
+        (WebCore::TransformationMatrix::m44):
+        (WebCore::TransformationMatrix::setM44):
+        (WebCore::TransformationMatrix::a):
+        (WebCore::TransformationMatrix::setA):
+        (WebCore::TransformationMatrix::b):
+        (WebCore::TransformationMatrix::setB):
+        (WebCore::TransformationMatrix::c):
+        (WebCore::TransformationMatrix::setC):
+        (WebCore::TransformationMatrix::d):
+        (WebCore::TransformationMatrix::setD):
+        (WebCore::TransformationMatrix::e):
+        (WebCore::TransformationMatrix::setE):
+        (WebCore::TransformationMatrix::f):
+        (WebCore::TransformationMatrix::setF):
+        (WebCore::TransformationMatrix::multiply):
+        (WebCore::TransformationMatrix::rotate):
+        (WebCore::TransformationMatrix::skewX):
+        (WebCore::TransformationMatrix::skewY):
+        (WebCore::TransformationMatrix::hasPerspective):
+        (WebCore::TransformationMatrix::):
+        (WebCore::TransformationMatrix::isAffine):
+        (WebCore::TransformationMatrix::operator==):
+        (WebCore::TransformationMatrix::operator*=):
+        (WebCore::TransformationMatrix::operator*):
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::nodeAtPoint):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateTransform):
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::mapAbsolutePointToLocal):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::nodeAtPoint):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::nodeAtPoint):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::nodeAtPoint):
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::nodeAtPoint):
+        * svg/SVGAnimateMotionElement.cpp:
+        (WebCore::SVGAnimateMotionElement::resetToBaseValue):
+        (WebCore::SVGAnimateMotionElement::calculateAnimatedValue):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::viewport):
+        * svg/SVGTransform.cpp:
+        (SVGTransform::setTranslate):
+        (SVGTransform::setScale):
+        (SVGTransform::setRotate):
+        (SVGTransform::setSkewX):
+        (SVGTransform::setSkewY):
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::draw):
+
+2009-02-07  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        For the Qt port implement Image::drawPattern via
+        BitmapImage::drawPatterns' implementation and implement
+        Gradient::fill.
+
+        This partially fixes rendering of generated gradient content.
+
+        * platform/graphics/BitmapImage.h: Remove the drawPattern
+        implementation for the Qt port in BitmapImage, it's been moved to
+        Image::drawPattern.
+        * platform/graphics/qt/GradientQt.cpp:
+        (WebCore::Gradient::fill): Implement using a simple fillRect.
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::Image::drawPattern): Moved implementation from
+        BitmapImage::drawPattern.
+
+2009-02-06  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        DOMSelection.getRangeAt() returns a different range than the selection
+        https://bugs.webkit.org/show_bug.cgi?id=23601
+
+        Rename toRange to toNormalizedRange and add new firstRange which returns an unmodified range
+
+        Test: fast/dom/Selection/getRangeAt.html
+
+        * WebCore.base.exp:
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::enclosingDeletableElement):
+        * editing/Editor.cpp:
+        (WebCore::Editor::selectedRange):
+        (WebCore::Editor::fontForSelection):
+        (WebCore::Editor::applyStyleToSelection):
+        (WebCore::Editor::applyParagraphStyleToSelection):
+        (WebCore::Editor::insertTextWithoutSendingTextEvent):
+        (WebCore::Editor::insertLineBreak):
+        (WebCore::Editor::insertParagraphSeparator):
+        (WebCore::Editor::ignoreSpelling):
+        (WebCore::Editor::isSelectionUngrammatical):
+        (WebCore::Editor::guessesForUngrammaticalSelection):
+        (WebCore::markMisspellingsOrBadGrammar):
+        (WebCore::Editor::rangeForPoint):
+        * editing/EditorCommand.cpp:
+        (WebCore::expandSelectionToGranularity):
+        (WebCore::executeDeleteToMark):
+        (WebCore::executeSelectToMark):
+        * editing/RemoveFormatCommand.cpp:
+        (WebCore::RemoveFormatCommand::doApply):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment):
+        * editing/Selection.cpp:
+        (WebCore::Selection::firstRange):
+        (WebCore::Selection::toNormalizedRange):
+        * editing/Selection.h:
+        * editing/SelectionController.h:
+        (WebCore::SelectionController::toNormalizedRange):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        * editing/markup.cpp:
+        (WebCore::createMarkup):
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::createFromSelection):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaSelectedTextDOMRange):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::getRangeAt):
+        (WebCore::DOMSelection::addRange):
+        (WebCore::DOMSelection::deleteFromDocument):
+        (WebCore::DOMSelection::containsNode):
+        (WebCore::DOMSelection::toString):
+        * page/DragController.cpp:
+        (WebCore::setSelectionToDragCaret):
+        (WebCore::DragController::concludeEditDrag):
+        (WebCore::DragController::startDrag):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dispatchMouseEvent):
+        * page/Frame.cpp:
+        (WebCore::Frame::selectedText):
+        (WebCore::Frame::shouldChangeSelection):
+        (WebCore::Frame::shouldDeleteSelection):
+        (WebCore::Frame::selectionComputedStyle):
+        (WebCore::Frame::selectionTextRects):
+        (WebCore::Frame::findString):
+        (WebCore::Frame::respondToChangedSelection):
+        * platform/ContextMenu.cpp:
+        (WebCore::selectionContainsPossibleWord):
+
+2009-02-06  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        <rdar://problem/6563402> - Workaround a case where ::didReceiveData() might be called on a ResourceHandleClient
+        before ::didReceiveResponse().
+
+        No layout test, as we don't have a concrete way to reproduce these conditions.  To that effect, I've added an ASSERT
+        to catch the conditions before the workaround takes effect in case any WebKit Debug-build developer runs across
+        this case and can come up with something more reproducible.
+
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didReceiveData): If the response is null create a dummy response.  This is much
+          like the FrameLoader::init() response that is used for initial document creation.
+
+2009-02-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * WebCore.base.exp:
+
+2009-02-06  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23621
+
+        Do not use m_scrollOffset to check if we are setting the same
+        value than we already have.
+
+        m_scrollOffset starts at 0 for ScrollView, so when opening a new
+        page and scrolling to 0 (the usual case) the check will fail and
+        we won't update the adjustment value, resulting in a possibly
+        mispositioned scrollbar. Use the adjustment value directly
+        instead, which is what we are updating anyway.
+
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::platformHandleHorizontalAdjustment):
+        (WebCore::ScrollView::platformHandleVerticalAdjustment):
+
+2009-02-06  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23800
+        Header elements are not always preserved during paste
+
+        At paste time, don't merge out of header elements.  At copy time, be sure to include
+        headers in the list of special common ancestor blocks, so that copying a paragraph or less
+        of content inside a header will include the header element in the copied markup.
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::areSameHeaderElements):
+        (WebCore::ReplaceSelectionCommand::shouldMerge):
+        * editing/markup.cpp:
+        (WebCore::isSpecialAncestorBlock):
+        (WebCore::createMarkup):
+
+2009-02-06  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Part III of <rdar://problem/6552272>.
+
+        Make redirect data available to WebKit. (I tried having WebKit track this
+        data for itself, but that went wrong -- it's just too hard to figure
+        out the weird corners of the WebCore loader from within another framework.)
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::DocumentLoader):
+        * loader/DocumentLoader.h: Store a flag indicating whether we created
+        a global history entry. If we didn't, then we know that the next redirect
+        should not link to us, since we're not in history.
+
+        (WebCore::DocumentLoader::clientRedirectSourceForHistory):
+        (WebCore::DocumentLoader::clientRedirectDestinationForHistory):
+        (WebCore::DocumentLoader::setClientRedirectSourceForHistory):
+        (WebCore::DocumentLoader::serverRedirectSourceForHistory):
+        (WebCore::DocumentLoader::serverRedirectDestinationForHistory):
+        (WebCore::DocumentLoader::didCreateGlobalHistoryEntry):
+        (WebCore::DocumentLoader::setDidCreateGlobalHistoryEntry): Added accessors
+        to help WebKit wade through the muck of WebCore history.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::updateGlobalHistoryRedirectLinks): Renamed
+        this client function to say what it does, instead of when it's called.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::load):
+        (WebCore::FrameLoader::loadWithNavigationAction): In the case of a redirect,
+        store a link to the previous history URL in the new DocumentLoader, so
+        it can update WebKit with that link when the load commits.
+
+        (WebCore::FrameLoader::updateHistory*): Use our new flags and names,
+        described above.
+
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::documentLoader):
+        (WebCore::FrameLoader::policyDocumentLoader):
+        (WebCore::FrameLoader::provisionalDocumentLoader):
+        (WebCore::FrameLoader::state): Inlined a few trivial functions because
+        performance mistakes give me the itches.
+
+        * loader/FrameLoaderClient.h: Renamed this client function to say what
+        it does, instead of when it's called.
+
+2009-02-06  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        Minor refactoring and cleanup to Selection code
+        https://bugs.webkit.org/show_bug.cgi?id=23774
+
+        No functional changes, thus no tests.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::applyStyle):
+        (WebCore::Editor::applyParagraphStyle):
+        * editing/Selection.cpp:
+        (WebCore::Selection::Selection):
+        (WebCore::Selection::setBaseAndExtentToDeepEquivalents):
+        (WebCore::Selection::setStartAndEndFromBaseAndExtentRespectingGranularity):
+        (WebCore::Selection::updateSelectionType):
+        (WebCore::Selection::validate):
+        (WebCore::Selection::setWithoutValidation):
+        (WebCore::Selection::adjustSelectionToAvoidCrossingEditingBoundaries):
+        * editing/Selection.h:
+        (WebCore::Selection::):
+        (WebCore::Selection::selectionType):
+        (WebCore::Selection::extent):
+        (WebCore::Selection::isNone):
+        (WebCore::Selection::isCaret):
+        (WebCore::Selection::isRange):
+        (WebCore::Selection::isCaretOrRange):
+        * editing/SelectionController.h:
+        (WebCore::SelectionController::selectionType):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        * page/Frame.cpp:
+        (WebCore::Frame::revealSelection):
+
+2009-02-06  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23801
+        Add custom V8 bindings for SVG.
+
+        * bindings/v8/custom/V8SVGElementInstanceCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGLengthCustom.cpp: Added.
+        (WebCore::ACCESSOR_GETTER):
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SVGMatrixCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-02-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 23792: unused param is used in RenderLayer.cpp but not #include'd
+        <https://bugs.webkit.org/show_bug.cgi?id=23792>
+
+        Add include file for UnusedParam which is used in this file.
+
+        * rendering/RenderLayer.cpp:
+
+2009-02-06  David Levin  <levin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23741>
+
+        Bug 23798: KURLGoogle needs support for protocolInHTTPFamily
+        <https://bugs.webkit.org/show_bug.cgi?id=23798>
+
+        Add protocolInHTTPFamily() to the KURLGoogle implementation.
+        This is another chromium build fix to mirror r40553.
+
+        While in this file, I did some style fixes and consistency fixes:
+        + fixed many_occurences_of_underscoring_naming
+        + usages of NULL
+        + comparisons to 0
+        + changed the copyright remove an extraneous , and capitalize the (C)
+          which was suggested for other files that I've submitted.
+
+        No observable change in behavior, so no test.
+
+        * platform/KURL.h:
+        (WebCore::KURL::protocolInHTTPFamily):
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURLCharsetConverter::ConvertFromUTF16):
+        (WebCore::lowerCaseEqualsASCII):
+        (WebCore::KURLGooglePrivate::KURLGooglePrivate):
+        (WebCore::KURLGooglePrivate::setUtf8):
+        (WebCore::KURLGooglePrivate::setAscii):
+        (WebCore::KURLGooglePrivate::init):
+        (WebCore::KURLGooglePrivate::initProtocolInHTTPFamily):
+        (WebCore::KURLGooglePrivate::copyTo):
+        (WebCore::KURLGooglePrivate::replaceComponents):
+        (WebCore::KURL::KURL):
+        (WebCore::KURL::createCFURL):
+        (WebCore::KURL::isEmpty):
+        (WebCore::KURL::protocolInHTTPFamily):
+        (WebCore::KURL::query):
+        (WebCore::decodeURLEscapeSequences):
+        (WebCore::KURL::protocolIs):
+        (WebCore::encodeWithURLEscapeSequences):
+        (WebCore::KURL::invalidate):
+        (WebCore::equalIgnoringRef):
+        * platform/KURLGooglePrivate.h:
+
+2009-02-06  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 23741: StyleRareNonInheritedData::operator==() should not compare ContentData objects by pointer
+
+        Reviewed by Darin Adler.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::contentDataEquivalent): Moved method to
+        WebCore::StyleRareNonInheritedData class.
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::contentDataEquivalent): Replaced declaration
+        with inline method that calls contentDataEquivalent() on
+        WebCore::StyleRareNonInheritedData instead.
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::operator==): This is the bug fix!
+        Replaced pointer comparison of ContentData objects with call to
+        StyleRareNonInheritedData::contentDataEquivalent().
+        (WebCore::StyleRareNonInheritedData::contentDataEquivalent): Added.
+        * rendering/style/StyleRareNonInheritedData.h:
+        (WebCore::StyleRareNonInheritedData::contentDataEquivalent): Added
+        declaration.
+
+2009-02-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel
+
+        Factor code that checks whether the object is rooted in
+        repaint() and repaintRectangle() into a common isRooted()
+        method.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaint):
+        (WebCore::RenderObject::repaintRectangle):
+        (WebCore::RenderObject::isRooted):
+        * rendering/RenderObject.h:
+
+2009-02-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel
+
+        Expose an isRootLayer() method on RenderLayer that works whether the
+        layer is rooted or not, and use that in a few places in the
+        accelerated compositing code.
+
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::isRootLayer):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintingGoesToWindow):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        (WebCore::RenderLayerCompositor::requiresCompositingLayer):
+
+2009-02-06  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6552338> FontCache::releaseFontData() called on a small caps font that is not in the cache
+
+        Most platforms do not retrieve the small caps font from the FontCache,
+        but cross-platform code in ~SimpleFontData() assumes the the small caps
+        font data did come from the cache and therefore calls releaseFontData()
+        on it.
+
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::~SimpleFontData): Reordered to call
+        platformDestroy() before releasing the small caps font and pruning the
+        glyph page tree. This allows platformDestroy() to reset
+        m_smallCapsFontData to 0 if it was not obtained from the cache.
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp:
+        (WebCore::SimpleFontData::platformDestroy): Set m_smallCapsFontData to
+        0 after deleting it.
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformDestroy): Ditto.
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::platformDestroy): Ditto.
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+        (WebCore::SimpleFontData::platformCommonDestroy): Ditto.
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        (WebCore::SimpleFontData::platformDestroy): Ditto.
+
+2009-02-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel
+
+        Make RenderStyle::transitionForProperty() const.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::transitionForProperty):
+        * rendering/style/RenderStyle.h:
+
+2009-02-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix build when ACCELERATED_COMPOSITING is turned on.
+
+        Remove font smoothing changes that will be committed
+        separately.
+
+        * platform/graphics/mac/WebLayer.mm:
+        (WebCore::if):
+
+2009-02-06  Anders Carlsson  <andersca@apple.com>
+
+        Build fix.
+
+        * bridge/npapi.h:
+
+2009-02-06  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23790
+        Custom -> JSCCustom in SVGPointList.idl
+
+        * svg/SVGPointList.idl:
+
+2009-02-06  Anantanarayanan Iyengar  <ananta@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23309
+        Fix whitespace indent errors. The rest of the original patch has already
+        landed.
+
+        * platform/graphics/cairo/ImageSourceCairo.cpp:
+        (WebCore::ImageSource::clear):
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::clear):
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::clear):
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::ImageSource::clear):
+
+2009-02-06  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Fix bug in clearRect(). Use fillRect() instead of eraseRect() to get
+        the context transparent.
+
+        [QT] clearRect fill's a given rect with white
+        https://bugs.webkit.org/show_bug.cgi?id=23728
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::clearRect):
+
+2009-02-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23781
+
+        When the document is attached and detached, and when it becomes active/inactive
+        (e.g. coming out or going into the page cache) we need to call
+        RenderView::didMoveOnscreen()/willMoveOffscreen() to hook and unhook the composited
+        layers.
+
+        Also, if Document::recalcStyle() does not do a layout, it needs to
+        update the compositing layers.
+
+        * dom/Document.cpp:
+        (WebCore::Document::updateRendering):
+        (WebCore::Document::updateLayout):
+        (WebCore::Document::attach):
+        (WebCore::Document::detach):
+        (WebCore::Document::documentWillBecomeInactive):
+        (WebCore::Document::documentDidBecomeActive):
+
+2009-02-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Added support for different ownership models for wrapped QObjects in
+        the JavaScript environment.
+
+        * bindings/js/ScriptControllerQt.cpp:
+        (WebCore::ScriptController::createScriptInstanceForWidget): Specify
+        QtOwnership for scriptable widgets.
+        * bridge/npruntime_internal.h: Add "NormalState" to the list of
+        undef'ed macros as an included Qt header uses "NormalState" as value
+        in an enum.
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::QtInstance): Save and initialize ownership
+        member.
+        (JSC::Bindings::QtInstance::~QtInstance): Respect
+        QScriptEngine::ValueOwnership policy with regards to wrapped m_object.
+        (JSC::Bindings::QtInstance::getQtInstance): Pass the ownership down to
+        the instance.
+        * bridge/qt/qt_instance.h:
+        (JSC::Bindings::QtInstance::create): Ditto.
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertQVariantToValue): Use QtOwnership for
+        automatically wrapped QObjects.
+        (JSC::Bindings::QtConnectionObject::execute): Ditto.
+
+2009-02-05  Maciej Stachowiak  <mjs@apple.com> and Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Dan Bernstein and Geoff Garen.
+
+        - WebCore code to track per-day and per-week visit counts in history
+
+        The basic idea is as follows: we track daily visits for up to 13
+        days, and weekly visits for up to 5 weeks past the end of the
+        current daily visits. As soon as the number of daily counts goes
+        over 13, we squish them down into weeks, and then prune the excess weeks.
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem): Remove bogus whitespace.
+        (WebCore::timeToDay): Helper function: convert time to days from the epoch.
+        (WebCore::HistoryItem::padDailyCountsForNewVisit): Insert 0 counts if
+        a site is visited after a span of days.
+        (WebCore::HistoryItem::collapseDailyVisitsToWeekly): Core day/week upgrade
+        algorithm as described above.
+        (WebCore::HistoryItem::recordVisitAtTime): Use above helpers to record all
+        info about a visit to this history item.
+        (WebCore::HistoryItem::setLastVisitedTime): Updated.
+        (WebCore::HistoryItem::visited): Updated.
+        (WebCore::HistoryItem::recordInitialVisit): New function to
+        handle recording data about the very first visit, replacing the
+        prior practice of explicitly setting visit count to 1.
+        (WebCore::HistoryItem::adoptVisitCounts): Take ownership of
+        daily and weekly visit count vectors.
+        (WebCore::HistoryItem::mergeAutoCompleteHints): Added a comment
+        noting that this function doesn't work properly now (though
+        this shouldn't matter much in practice.)
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::dailyVisitCounts): Accessor for daily counts.
+        (WebCore::HistoryItem::weeklyVisitCounts): Ditto for weekly counts.
+        * WebCore.base.exp: Add new symbols and sort.
+
+2009-02-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6438271> Improve backspace handling of accented characters
+
+        Test: platform/mac/editing/deleting/backward-delete.html
+
+        This change makes WebKit behave like AppKit on the Mac. Other platforms are not affected,
+        because the current behavior matches their standards (tested on Windows, assumed elsewhere).
+
+        * dom/Position.cpp:
+        (WebCore::Position::previous):
+        (WebCore::Position::next):
+        (WebCore::Position::uncheckedPreviousOffsetForBackwardDeletion):
+        * dom/Position.h:
+        Added a new option for previous(), used to move to a next position for backward deletion.
+        Renamed EUsingComposedCharacters to PositionMoveType.
+
+        * editing/TypingCommand.cpp: (WebCore::TypingCommand::deleteKeyPressed):
+        Use previous(BackwardDeletion) to find a proper range to delete. Also, simplified a check
+        surrounding this code a little.
+
+        * editing/htmlediting.cpp:
+        (WebCore::nextVisuallyDistinctCandidate):
+        (WebCore::previousVisuallyDistinctCandidate):
+        Adjusted for renamed enum values.
+
+        * rendering/RenderObject.cpp:
+        * rendering/RenderObject.h:
+        * rendering/RenderText.h:
+        Added previousOffsetForBackwardDeletion().
+
+        * rendering/RenderText.cpp: (WebCore::RenderText::previousOffsetForBackwardDeletion):
+        On PLATFORM(MAC), use an algorithm that matches the one AppKit has for backward deletion.
+
+2009-02-05  Adam Roben  <aroben@apple.com>
+
+        Fix a crash in RenderWidget::destroy when navigating away from a page
+        with an <iframe>
+
+        This was a regression caused by r40679
+
+        Reviewed by Dave Hyatt.
+
+        Tested by many many tests.
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy): Only deref the RenderWidget after we
+        finish accessing its members.
+
+2009-02-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson
+
+        getAnimatedStyleForRenderer() should not create a new
+        CompositeAnimation if the object isn't already animating, and
+        it should just fall back to returning renderer->style().
+
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::getAnimatedStyleForRenderer):
+
+2009-02-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix build when ACCELERATED_COMPOSITING is turned on.
+
+        Give RenderLayerBacking some love after the great
+        RenderBoxModelObject split.
+
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateLayerTransform):
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::contentsBox):
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        (WebCore::RenderLayerBacking::startAnimation):
+        (WebCore::RenderLayerBacking::startTransition):
+        * rendering/RenderLayerBacking.h:
+        (WebCore::RenderLayerBacking::renderer):
+
+2009-02-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix build when ACCELERATED_COMPOSITING is turned on.
+
+        writeIndent() needs to be static to avoid warnings on some OSes,
+        and remove unused CAToTransform3D() method.
+
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::writeIndent):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+
+2009-02-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson
+
+        Add some methods to the TransformOperation classes that are required
+        by GraphicsLayer when ACCELERATED_COMPOSITING is turned on.
+
+        * platform/graphics/transforms/MatrixTransformOperation.h:
+        (WebCore::MatrixTransformOperation::create):
+        (WebCore::MatrixTransformOperation::MatrixTransformOperation):
+        * platform/graphics/transforms/ScaleTransformOperation.h:
+        (WebCore::ScaleTransformOperation::x):
+        (WebCore::ScaleTransformOperation::y):
+        * platform/graphics/transforms/TranslateTransformOperation.h:
+        (WebCore::TranslateTransformOperation::x):
+        (WebCore::TranslateTransformOperation::y):
+
+2009-02-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Minor clenaup: fix brace style in CompositeAnimationPrivate::updateTransitions(),
+        and correct a usage of UNUSED_PARAM().
+
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::updateTransitions):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::startAnimation):
+
+2009-02-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix build when ACCELERATED_COMPOSITING is turned on.
+
+        animationOfPropertyIsAccelerated() needs to be public because
+        it is called from AnimationController.
+
+        * page/animation/AnimationBase.h:
+
+2009-02-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson
+
+        Fix mis-typed enum value which is hidden inside #ifdefs so didn't break
+        the build.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateCompositingLayers):
+
+2009-02-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix missing checked toRenderBlock casts.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::clearFloats):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::availableHeightUsing):
+
+2009-02-05  Sam Weinig  <sam@webkit.org>
+
+        Patch from Darin Adler.
+        Reviewed by Sam Weinig.
+
+        Fix case where we were casting to RenderView.
+
+        No test case possible.
+
+        * editing/mac/SelectionControllerMac.mm:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+
+2009-02-05  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23708
+        Adds documentElementAvailable() callback to FrameLoaderClient.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::startElementNs):
+        Add call to dispatchDocumentElementAvailable()
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseStartElement):
+        Ditto.
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::insertNode):
+        Ditto.
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::documentElementAvailable):
+        Stub out documentElementAvailable().
+        * loader/FrameLoader.cpp:
+        documentElementAvailable() callback plumbing.
+        * loader/FrameLoader.h:
+        Ditto.
+        * loader/FrameLoaderClient.h:
+        Add new documentElementAvailable() callback.
+
+2009-02-05  Scott Violet  <sky@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23766
+        CanvasRenderingContext2D::setShadow needs else for other platforms.
+
+        Implements the CMYK variant of CanvasRenderingContext2D::setShadow for
+        other platforms using the CMYK color constructor.
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setShadow):
+
+2009-02-05  Scott Violet  <sky@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23687
+        Wires up Skia'a ImageBuffer::toDataURL to support pngs.
+        This helps Chromium pass a couple of layout tests.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::toDataURL):
+        * platform/image-encoders: Added.
+        * platform/image-encoders/skia: Added.
+        * platform/image-encoders/skia/PNGImageEncoder.cpp: Added.
+        (WebCore::):
+        (WebCore::PngEncoderState::EncoderWriteCallback):
+        (WebCore::PngEncoderState::ConvertBGRAtoRGB):
+        (WebCore::PngEncoderState::PngWriteStructDestroyer::PngWriteStructDestroyer):
+        (WebCore::PngEncoderState::PngWriteStructDestroyer::~PngWriteStructDestroyer):
+        (WebCore::PNGImageEncoder::encode):
+        * platform/image-encoders/skia/PNGImageEncoder.h: Added.
+
+2009-02-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix missing checked cast.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containingBlock):
+
+2009-02-05  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Fix WML enabled builds.
+
+        FrameLoader::load() got an additional 'lockHistory' parameter, pass 'false'.
+
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::executeTask):
+
+2009-02-05  Scott Violet  <sky@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23625
+        Additional fix: Skia platform doesn't render text to a canvas or support clipping to an image buffer
+
+        Fixes three bugs in PlatformContextSkia:
+
+        * When a new layer was started clipped to an image we used the
+          assignment operator to copy the SkBitmap. If the SkBitmap owns it's
+          pixels, this is not the right thing to do. Instead we need to create
+          a copy of the image.
+        * State holds an SkBitmap by value. State's copy constructor does a
+          memcpy. This is confusing and subtle, I've converted to use a member
+          initializer list which I think is clearer and less error prone.
+        * When creating a new layer there is no need to copy the clip image.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::State::State):
+        (PlatformContextSkia::save):
+        (PlatformContextSkia::beginLayerClippedToImage):
+
+2009-02-05  Scott Violet  <sky@google.com>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23462
+        Changes call from setFillColor to setStrokeColor.
+
+        * html/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyStrokeColor):
+
+2009-02-05  David Hyatt  <hyatt@apple.com>
+
+        Fix crash on svg custom stop test.  A virtual function didn't get patched properly.
+
+        Reviewed by Sam Weinig
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGGradientStop.h:
+        (WebCore::RenderSVGGradientStop::clippedOverflowRectForRepaint):
+
+2009-02-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23765
+
+        Add toRenderBoxModelObject() so that we can cast objects that
+        can have layers.
+
+        Fix getComputedStyle to return the current value of style
+        properties that are undergoing accelerated animations, by
+        asking the AnimationController if the property has accelerated
+        animations, and, if so, asking it to generate an appropriate
+        style.
+
+        Tightened up some type safety (CSSPropertyID), and code clarity
+        (replace bool with enum).
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::hasCompositedLayer):
+        (WebCore::computedTransform):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::isAnimatingPropertyOnRenderer):
+        (WebCore::AnimationController::isAnimatingPropertyOnRenderer):
+        (WebCore::AnimationController::supportsAcceleratedAnimationOfProperty):
+        * page/animation/AnimationController.h:
+        * page/animation/AnimationControllerPrivate.h:
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::startAnimation):
+        (WebCore::ImplicitAnimation::endAnimation):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::startAnimation):
+        (WebCore::KeyframeAnimation::endAnimation):
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::isBoxModelObject):
+        (WebCore::toRenderBoxModelObject):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateLayerTransform):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isBoxModelObject):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::applyTransform):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::):
+
+2009-02-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23767
+        Add custom V8 bindings for HTML5 database.
+
+        * bindings/v8/custom/V8CustomSQLStatementCallback.cpp: Added.
+        (WebCore::V8CustomSQLStatementCallback::V8CustomSQLStatementCallback):
+        (WebCore::V8CustomSQLStatementCallback::~V8CustomSQLStatementCallback):
+        (WebCore::V8CustomSQLStatementCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLStatementCallback.h: Added.
+        (WebCore::V8CustomSQLStatementCallback::create):
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.cpp: Added.
+        (WebCore::V8CustomSQLStatementErrorCallback::V8CustomSQLStatementErrorCallback):
+        (WebCore::V8CustomSQLStatementErrorCallback::~V8CustomSQLStatementErrorCallback):
+        (WebCore::V8CustomSQLStatementErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLStatementErrorCallback.h: Added.
+        (WebCore::V8CustomSQLStatementErrorCallback::create):
+        * bindings/v8/custom/V8CustomSQLTransactionCallback.cpp: Added.
+        (WebCore::V8CustomSQLTransactionCallback::V8CustomSQLTransactionCallback):
+        (WebCore::V8CustomSQLTransactionCallback::~V8CustomSQLTransactionCallback):
+        (WebCore::V8CustomSQLTransactionCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLTransactionCallback.h: Added.
+        (WebCore::V8CustomSQLTransactionCallback::create):
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.cpp: Added.
+        (WebCore::V8CustomSQLTransactionErrorCallback::V8CustomSQLTransactionErrorCallback):
+        (WebCore::V8CustomSQLTransactionErrorCallback::~V8CustomSQLTransactionErrorCallback):
+        (WebCore::V8CustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/v8/custom/V8CustomSQLTransactionErrorCallback.h: Added.
+        (WebCore::V8CustomSQLTransactionErrorCallback::create):
+        * bindings/v8/custom/V8CustomVoidCallback.cpp: Added.
+        (WebCore::V8CustomVoidCallback::V8CustomVoidCallback):
+        (WebCore::V8CustomVoidCallback::~V8CustomVoidCallback):
+        (WebCore::V8CustomVoidCallback::handleEvent):
+        (WebCore::invokeCallback):
+        * bindings/v8/custom/V8CustomVoidCallback.h: Added.
+        (WebCore::V8CustomVoidCallback::create):
+        * bindings/v8/custom/V8DatabaseCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SQLResultSetRowListCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp: Added.
+        (WebCore::CALLBACK_FUNC_DECL):
+
+2009-02-05  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23747
+        Add Chromium threading-related files.
+
+        * platform/chromium/TemporaryLinkStubs.cpp: Removed theading-related stubs.
+
+2009-02-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Add toRenderButton methods for casting RenderObjects to RenderButtons. The methods will assert if the object
+        is not a RenderButton. Also add a toRenderButton method that takes a RenderButton but returns void and that
+        is unimplemented. This method will catch anyone trying to do a cast when the object is already a RenderButton.
+
+        * rendering/RenderButton.h:
+        (WebCore::RenderButton::isRenderButton):
+        (WebCore::toRenderButton):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::paintObject):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isRenderButton):
+
+2009-02-05  David Hyatt  <hyatt@apple.com>
+
+        Move the m_layer member variable of RenderBox up into RenderBoxModelObject.  Refactor styleDidChange'
+        of RenderObject, RenderBoxModelObject and RenderBox to get more of the code in the correct subclass.
+        In order to set the various RenderObject bits properly prior to the test for whether a layer is
+        required, I added an additional method, updateBoxModelInfoAfterStyleChange, that is responsible
+        for setting all of the bits.
+
+        Eliminate hasStaticX/Y, staticX/Y, and setStaticX/Y from the render tree.  Move hasStaticX/Y to
+        RenderStyle, and just use the corresponding layer() methods for the
+        staticX/Y getters/setters.
+
+        Reviewed by Sam Weinig
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::adjustPositionedBlock):
+        (WebCore::RenderBlock::layoutOnlyPositionedObjects):
+        (WebCore::RenderBlock::layoutPositionedObjects):
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::offsetForContents):
+        (WebCore::RenderBlock::calcPrefWidths):
+        (WebCore::RenderBlock::baselinePosition):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::RenderBox):
+        (WebCore::RenderBox::destroy):
+        (WebCore::RenderBox::styleWillChange):
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::updateBoxModelInfoFromStyle):
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+        (WebCore::RenderBox::scrollLeft):
+        (WebCore::RenderBox::scrollTop):
+        (WebCore::RenderBox::setScrollLeft):
+        (WebCore::RenderBox::setScrollTop):
+        (WebCore::RenderBox::getOverflowClipRect):
+        (WebCore::RenderBox::localToAbsolute):
+        (WebCore::RenderBox::absoluteToLocal):
+        (WebCore::RenderBox::localToContainerQuad):
+        (WebCore::RenderBox::position):
+        (WebCore::RenderBox::computeRectForRepaint):
+        (WebCore::RenderBox::calcAbsoluteHorizontal):
+        (WebCore::RenderBox::calcAbsoluteVertical):
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced):
+        (WebCore::RenderBox::calcAbsoluteVerticalReplaced):
+        * rendering/RenderBox.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::RenderBoxModelObject):
+        (WebCore::RenderBoxModelObject::destroy):
+        (WebCore::RenderBoxModelObject::styleWillChange):
+        (WebCore::RenderBoxModelObject::styleDidChange):
+        (WebCore::RenderBoxModelObject::updateBoxModelInfoFromStyle):
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::layer):
+        (WebCore::RenderBoxModelObject::requiresLayer):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::updateBoxModelInfoFromStyle):
+        (WebCore::RenderInline::styleDidChange):
+        (WebCore::RenderInline::relativePositionedInlineOffset):
+        * rendering/RenderInline.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::setStaticY):
+        (WebCore::RenderLayer::updateLayerPosition):
+        * rendering/RenderLayer.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::setStyle):
+        (WebCore::RenderObject::styleDidChange):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::markContainingBlocksForLayout):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::paint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy):
+        * rendering/bidi.cpp:
+        (WebCore::appendRunsForObject):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::skipTrailingWhitespace):
+        (WebCore::RenderBlock::skipLeadingWhitespace):
+        (WebCore::RenderBlock::findNextLineBreak):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::hasStaticX):
+        (WebCore::InheritedFlags::hasStaticY):
+
+2009-02-05  Sam Weinig  <sam@webkit.org>
+
+        Fix the windows build.
+
+        * bindings/scripts/CodeGeneratorCOM.pm:
+        * dom/Node.idl:
+
+2009-02-05  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        Update to match Gecko.
+
+        * bridge/npapi.h:
+        * plugins/npfunctions.h:
+
+2009-02-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Finish merging EventTargetNode up into Node.
+
+        This also fixes a small recently introduced issue where EventListeners
+        would not be removed from the document if they were attached to comment
+        nodes outside of the documentElement.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSEventTargetNodeCustom.cpp: Removed.
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        (WebCore::JSNode::pushEventHandlerScope):
+        * bindings/scripts/CodeGenerator.pm:
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::CharacterData):
+        (WebCore::CharacterData::rendererIsNeeded):
+        * dom/CharacterData.h:
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::willRemove):
+        (WebCore::ContainerNode::attach):
+        (WebCore::ContainerNode::detach):
+        (WebCore::ContainerNode::insertedIntoDocument):
+        (WebCore::ContainerNode::removedFromDocument):
+        (WebCore::ContainerNode::setFocus):
+        (WebCore::ContainerNode::setActive):
+        (WebCore::ContainerNode::setHovered):
+        (WebCore::dispatchChildInsertionEvents):
+        (WebCore::dispatchChildRemovalEvents):
+        * dom/ContainerNode.h:
+        (WebCore::ContainerNode::ContainerNode):
+        * dom/Document.cpp:
+        (WebCore::Document::removeAllEventListenersFromAllNodes):
+        (WebCore::Document::removeAllDisconnectedNodeEventListeners):
+        (WebCore::Document::setFocusedNode):
+        * dom/EventTargetNode.cpp: Removed.
+        * dom/EventTargetNode.h: Removed.
+        * dom/Node.cpp:
+        (WebCore::Node::scriptExecutionContext):
+        (WebCore::Node::eventListeners):
+        (WebCore::Node::insertedIntoDocument):
+        (WebCore::Node::removedFromDocument):
+        (WebCore::Node::willMoveToNewOwnerDocument):
+        (WebCore::Node::didMoveToNewOwnerDocument):
+        (WebCore::updateSVGElementInstancesAfterEventListenerChange):
+        (WebCore::Node::addEventListener):
+        (WebCore::Node::removeEventListener):
+        (WebCore::Node::removeAllEventListenersSlowCase):
+        (WebCore::Node::handleLocalEvents):
+        (WebCore::eventTargetAsSVGElementInstance):
+        (WebCore::eventTargetRespectingSVGTargetRules):
+        (WebCore::Node::dispatchEvent):
+        (WebCore::Node::dispatchGenericEvent):
+        (WebCore::Node::dispatchSubtreeModifiedEvent):
+        (WebCore::Node::dispatchWindowEvent):
+        (WebCore::Node::dispatchUIEvent):
+        (WebCore::Node::dispatchKeyEvent):
+        (WebCore::Node::dispatchMouseEvent):
+        (WebCore::Node::dispatchSimulatedMouseEvent):
+        (WebCore::Node::dispatchSimulatedClick):
+        (WebCore::Node::dispatchWheelEvent):
+        (WebCore::Node::dispatchWebKitAnimationEvent):
+        (WebCore::Node::dispatchWebKitTransitionEvent):
+        (WebCore::Node::dispatchFocusEvent):
+        (WebCore::Node::dispatchBlurEvent):
+        (WebCore::Node::dispatchEventForType):
+        (WebCore::Node::dispatchProgressEvent):
+        (WebCore::Node::dispatchStorageEvent):
+        (WebCore::Node::removeInlineEventListenerForType):
+        (WebCore::Node::setInlineEventListenerForType):
+        (WebCore::Node::setInlineEventListenerForTypeAndAttribute):
+        (WebCore::Node::inlineEventListenerForType):
+        (WebCore::Node::disabled):
+        (WebCore::Node::defaultEventHandler):
+        (WebCore::Node::onabort):
+        (WebCore::Node::setOnabort):
+        (WebCore::Node::onblur):
+        (WebCore::Node::setOnblur):
+        (WebCore::Node::onchange):
+        (WebCore::Node::setOnchange):
+        (WebCore::Node::onclick):
+        (WebCore::Node::setOnclick):
+        (WebCore::Node::oncontextmenu):
+        (WebCore::Node::setOncontextmenu):
+        (WebCore::Node::ondblclick):
+        (WebCore::Node::setOndblclick):
+        (WebCore::Node::onerror):
+        (WebCore::Node::setOnerror):
+        (WebCore::Node::onfocus):
+        (WebCore::Node::setOnfocus):
+        (WebCore::Node::oninput):
+        (WebCore::Node::setOninput):
+        (WebCore::Node::onkeydown):
+        (WebCore::Node::setOnkeydown):
+        (WebCore::Node::onkeypress):
+        (WebCore::Node::setOnkeypress):
+        (WebCore::Node::onkeyup):
+        (WebCore::Node::setOnkeyup):
+        (WebCore::Node::onload):
+        (WebCore::Node::setOnload):
+        (WebCore::Node::onmousedown):
+        (WebCore::Node::setOnmousedown):
+        (WebCore::Node::onmousemove):
+        (WebCore::Node::setOnmousemove):
+        (WebCore::Node::onmouseout):
+        (WebCore::Node::setOnmouseout):
+        (WebCore::Node::onmouseover):
+        (WebCore::Node::setOnmouseover):
+        (WebCore::Node::onmouseup):
+        (WebCore::Node::setOnmouseup):
+        (WebCore::Node::onmousewheel):
+        (WebCore::Node::setOnmousewheel):
+        (WebCore::Node::onbeforecut):
+        (WebCore::Node::setOnbeforecut):
+        (WebCore::Node::oncut):
+        (WebCore::Node::setOncut):
+        (WebCore::Node::onbeforecopy):
+        (WebCore::Node::setOnbeforecopy):
+        (WebCore::Node::oncopy):
+        (WebCore::Node::setOncopy):
+        (WebCore::Node::onbeforepaste):
+        (WebCore::Node::setOnbeforepaste):
+        (WebCore::Node::onpaste):
+        (WebCore::Node::setOnpaste):
+        (WebCore::Node::ondragenter):
+        (WebCore::Node::setOndragenter):
+        (WebCore::Node::ondragover):
+        (WebCore::Node::setOndragover):
+        (WebCore::Node::ondragleave):
+        (WebCore::Node::setOndragleave):
+        (WebCore::Node::ondrop):
+        (WebCore::Node::setOndrop):
+        (WebCore::Node::ondragstart):
+        (WebCore::Node::setOndragstart):
+        (WebCore::Node::ondrag):
+        (WebCore::Node::setOndrag):
+        (WebCore::Node::ondragend):
+        (WebCore::Node::setOndragend):
+        (WebCore::Node::onreset):
+        (WebCore::Node::setOnreset):
+        (WebCore::Node::onresize):
+        (WebCore::Node::setOnresize):
+        (WebCore::Node::onscroll):
+        (WebCore::Node::setOnscroll):
+        (WebCore::Node::onsearch):
+        (WebCore::Node::setOnsearch):
+        (WebCore::Node::onselect):
+        (WebCore::Node::setOnselect):
+        (WebCore::Node::onselectstart):
+        (WebCore::Node::setOnselectstart):
+        (WebCore::Node::onsubmit):
+        (WebCore::Node::setOnsubmit):
+        (WebCore::Node::onunload):
+        (WebCore::Node::setOnunload):
+        * dom/Node.h:
+        * editing/Editor.cpp:
+        (WebCore::Editor::dispatchCPPEvent):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::handleLocalEvents):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::notifyFinished):
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::defaultEventHandler):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::mouseButtonListener):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dispatchDragEvent):
+        (WebCore::EventHandler::updateMouseEventTargetNode):
+        (WebCore::EventHandler::dispatchMouseEvent):
+        (WebCore::EventHandler::handleWheelEvent):
+        (WebCore::EventHandler::canMouseDownStartSelect):
+        (WebCore::EventHandler::canMouseDragExtendSelect):
+        (WebCore::eventTargetNodeForDocument):
+        (WebCore::EventHandler::keyEvent):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scheduleEvent):
+        (WebCore::FrameView::updateOverflowStatus):
+        * page/FrameView.h:
+        * page/Page.cpp:
+        (WebCore::networkStateChanged):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollToOffset):
+        (WebCore::RenderLayer::updateOverflowStatus):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::valueChanged):
+        * rendering/RenderMedia.h:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::selectionChanged):
+        * svg/SVGElementInstance.h:
+        (WebCore::SVGElementInstance::toNode):
+        * xml/XPathExpression.cpp:
+        (WebCore::XPathExpression::evaluate):
+        * xml/XPathResult.cpp:
+        (WebCore::XPathResult::XPathResult):
+
+2009-02-05  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build now that EventTargetNode.idl was removed in r40672.
+
+        * WebCore.pro:
+
+2009-02-05  Scott Violet  <sky@google.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23462: Add RGB -> CMYK conversion algorithm
+        <https://bugs.webkit.org/show_bug.cgi?id=23462>
+
+        Adds an RGB -> CMYK converter. This isn't perfect, but better than
+        nothing.
+
+        * html/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyStrokeColor):
+        (WebCore::CanvasStyle::applyFillColor):
+        (WebCore::CanvasStyle::cmykToRGB):
+        * html/CanvasStyle.h:
+
+2009-02-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        First stage of merging EventTargetNode up into Node. The intent of this change
+        is to both simplify the inheritance hierarchy (at the same time making it more
+        closely match the spec which states that all Nodes are EventTargets) and save
+        4 bytes per Node that the polymorphic multiple-inheritance was costing us.
+
+        This does the bare minimum to get things compiling, the next patch will clean
+
+        * DerivedSources.make:
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::mark):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toEventTarget):
+        * bindings/js/JSEventTarget.h:
+        * bindings/js/JSEventTargetNodeCustom.cpp:
+        (WebCore::JSNode::addEventListener):
+        (WebCore::JSNode::removeEventListener):
+        (WebCore::JSNode::pushEventHandlerScope):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * dom/Attr.idl:
+        * dom/CharacterData.h:
+        * dom/CharacterData.idl:
+        * dom/Document.idl:
+        * dom/DocumentFragment.idl:
+        * dom/Element.idl:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toNode):
+        * dom/EventTarget.h:
+        * dom/EventTarget.idl:
+        * dom/EventTargetNode.cpp:
+        (WebCore::Node::scriptExecutionContext):
+        (WebCore::Node::eventListeners):
+        (WebCore::Node::insertedIntoDocument):
+        (WebCore::Node::removedFromDocument):
+        (WebCore::Node::willMoveToNewOwnerDocument):
+        (WebCore::Node::didMoveToNewOwnerDocument):
+        (WebCore::Node::addEventListener):
+        (WebCore::Node::removeEventListener):
+        (WebCore::Node::removeAllEventListenersSlowCase):
+        (WebCore::Node::handleLocalEvents):
+        (WebCore::Node::dispatchEvent):
+        (WebCore::Node::dispatchGenericEvent):
+        (WebCore::Node::dispatchSubtreeModifiedEvent):
+        (WebCore::Node::dispatchWindowEvent):
+        (WebCore::Node::dispatchUIEvent):
+        (WebCore::Node::dispatchKeyEvent):
+        (WebCore::Node::dispatchMouseEvent):
+        (WebCore::Node::dispatchSimulatedMouseEvent):
+        (WebCore::Node::dispatchSimulatedClick):
+        (WebCore::Node::dispatchWheelEvent):
+        (WebCore::Node::dispatchWebKitAnimationEvent):
+        (WebCore::Node::dispatchWebKitTransitionEvent):
+        (WebCore::Node::dispatchFocusEvent):
+        (WebCore::Node::dispatchBlurEvent):
+        (WebCore::Node::dispatchEventForType):
+        (WebCore::Node::dispatchProgressEvent):
+        (WebCore::Node::dispatchStorageEvent):
+        (WebCore::Node::removeInlineEventListenerForType):
+        (WebCore::Node::setInlineEventListenerForType):
+        (WebCore::Node::setInlineEventListenerForTypeAndAttribute):
+        (WebCore::Node::inlineEventListenerForType):
+        (WebCore::Node::disabled):
+        (WebCore::Node::defaultEventHandler):
+        (WebCore::Node::onabort):
+        (WebCore::Node::setOnabort):
+        (WebCore::Node::onblur):
+        (WebCore::Node::setOnblur):
+        (WebCore::Node::onchange):
+        (WebCore::Node::setOnchange):
+        (WebCore::Node::onclick):
+        (WebCore::Node::setOnclick):
+        (WebCore::Node::oncontextmenu):
+        (WebCore::Node::setOncontextmenu):
+        (WebCore::Node::ondblclick):
+        (WebCore::Node::setOndblclick):
+        (WebCore::Node::onerror):
+        (WebCore::Node::setOnerror):
+        (WebCore::Node::onfocus):
+        (WebCore::Node::setOnfocus):
+        (WebCore::Node::oninput):
+        (WebCore::Node::setOninput):
+        (WebCore::Node::onkeydown):
+        (WebCore::Node::setOnkeydown):
+        (WebCore::Node::onkeypress):
+        (WebCore::Node::setOnkeypress):
+        (WebCore::Node::onkeyup):
+        (WebCore::Node::setOnkeyup):
+        (WebCore::Node::onload):
+        (WebCore::Node::setOnload):
+        (WebCore::Node::onmousedown):
+        (WebCore::Node::setOnmousedown):
+        (WebCore::Node::onmousemove):
+        (WebCore::Node::setOnmousemove):
+        (WebCore::Node::onmouseout):
+        (WebCore::Node::setOnmouseout):
+        (WebCore::Node::onmouseover):
+        (WebCore::Node::setOnmouseover):
+        (WebCore::Node::onmouseup):
+        (WebCore::Node::setOnmouseup):
+        (WebCore::Node::onmousewheel):
+        (WebCore::Node::setOnmousewheel):
+        (WebCore::Node::onbeforecut):
+        (WebCore::Node::setOnbeforecut):
+        (WebCore::Node::oncut):
+        (WebCore::Node::setOncut):
+        (WebCore::Node::onbeforecopy):
+        (WebCore::Node::setOnbeforecopy):
+        (WebCore::Node::oncopy):
+        (WebCore::Node::setOncopy):
+        (WebCore::Node::onbeforepaste):
+        (WebCore::Node::setOnbeforepaste):
+        (WebCore::Node::onpaste):
+        (WebCore::Node::setOnpaste):
+        (WebCore::Node::ondragenter):
+        (WebCore::Node::setOndragenter):
+        (WebCore::Node::ondragover):
+        (WebCore::Node::setOndragover):
+        (WebCore::Node::ondragleave):
+        (WebCore::Node::setOndragleave):
+        (WebCore::Node::ondrop):
+        (WebCore::Node::setOndrop):
+        (WebCore::Node::ondragstart):
+        (WebCore::Node::setOndragstart):
+        (WebCore::Node::ondrag):
+        (WebCore::Node::setOndrag):
+        (WebCore::Node::ondragend):
+        (WebCore::Node::setOndragend):
+        (WebCore::Node::onreset):
+        (WebCore::Node::setOnreset):
+        (WebCore::Node::onresize):
+        (WebCore::Node::setOnresize):
+        (WebCore::Node::onscroll):
+        (WebCore::Node::setOnscroll):
+        (WebCore::Node::onsearch):
+        (WebCore::Node::setOnsearch):
+        (WebCore::Node::onselect):
+        (WebCore::Node::setOnselect):
+        (WebCore::Node::onselectstart):
+        (WebCore::Node::setOnselectstart):
+        (WebCore::Node::onsubmit):
+        (WebCore::Node::setOnsubmit):
+        (WebCore::Node::onunload):
+        (WebCore::Node::setOnunload):
+        * dom/EventTargetNode.h:
+        (WebCore::toEventTargetNode):
+        (WebCore::EventTargetNodeCast):
+        * dom/EventTargetNode.idl: Removed.
+        * dom/MouseEvent.cpp:
+        (WebCore::MouseEvent::MouseEvent):
+        (WebCore::MouseEvent::initMouseEvent):
+        (WebCore::MouseEvent::toElement):
+        (WebCore::MouseEvent::fromElement):
+        * dom/MouseEvent.h:
+        (WebCore::MouseEvent::create):
+        (WebCore::MouseEvent::relatedTarget):
+        * dom/Node.cpp:
+        (WebCore::Node::~Node):
+        * dom/Node.h:
+        (WebCore::Node::isEventTargetNode):
+        (WebCore::Node::toNode):
+        (WebCore::Node::removeAllEventListeners):
+        (WebCore::Node::refEventTarget):
+        (WebCore::Node::derefEventTarget):
+        * dom/Node.idl:
+        * page/EventHandler.h:
+        * page/FrameView.h:
+        * xml/XPathResult.h:
+        (WebCore::XPathResult::create):
+
+2009-02-04  David Hyatt  <hyatt@apple.com>
+
+        Convert RenderLayer from having a RenderBox* m_renderer to having a RenderBoxModelObject*.  The
+        container-relative repaint methods all had to be changed as a result to use RenderBoxModelObject* also.
+
+        All of RenderLayer.cpp now uses what will be the new style for dealing with an object that can be a block
+        or an inline flow.  x()/y()/width()/height() can't be queried on an inline flow, nor can many other
+        properties (like scrollWidth() / scrollHeight()), so the code has to be tightened up to convert to RenderBox
+        under the right conditions.
+
+        There was a bogus subtraction of renderer()->y() in localBounding box for RenderInlines.  Since y was always
+        0, this subtraction wasn't necessary.  It has been removed.
+
+        Reviewed by Adam Roben
+
+        * page/animation/AnimationBase.cpp:
+        * rendering/RenderBR.h:
+        (WebCore::RenderBR::selectionRectForRepaint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::selectionGapRectsForRepaint):
+        (WebCore::RenderBlock::rectWithOutlineForRepaint):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::selectionRectForRepaint):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::outlineBoundsForRepaint):
+        (WebCore::RenderBox::localToContainerQuad):
+        (WebCore::RenderBox::clippedOverflowRectForRepaint):
+        (WebCore::RenderBox::computeRectForRepaint):
+        * rendering/RenderBox.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::relativePositionOffsetX):
+        (WebCore::RenderBoxModelObject::relativePositionOffsetY):
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::relativePositionOffset):
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::computeRectForRepaint):
+        * rendering/RenderForeignObject.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        (WebCore::RenderInline::rectWithOutlineForRepaint):
+        * rendering/RenderInline.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::updateTransform):
+        (WebCore::RenderLayer::setHasVisibleContent):
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::scrollToOffset):
+        (WebCore::RenderLayer::scrollRectToVisible):
+        (WebCore::resizerCornerRect):
+        (WebCore::RenderLayer::scrollbarCornerPresent):
+        (WebCore::RenderLayer::invalidateScrollbarRect):
+        (WebCore::RenderLayer::positionOverflowControls):
+        (WebCore::RenderLayer::computeScrollDimensions):
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
+        (WebCore::RenderLayer::paintScrollCorner):
+        (WebCore::RenderLayer::paintResizer):
+        (WebCore::RenderLayer::isPointInResizeControl):
+        (WebCore::RenderLayer::hitTestOverflowControls):
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::localBoundingBox):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::renderer):
+        (WebCore::RenderLayer::renderBox):
+        (WebCore::RenderLayer::renderBoxX):
+        (WebCore::RenderLayer::renderBoxY):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::selectionRectForRepaint):
+        * rendering/RenderListMarker.h:
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::computePosition):
+        (WebCore::RenderMarquee::timerFired):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containerForRepaint):
+        (WebCore::RenderObject::repaintUsingContainer):
+        (WebCore::RenderObject::repaint):
+        (WebCore::RenderObject::repaintRectangle):
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):
+        (WebCore::RenderObject::rectWithOutlineForRepaint):
+        (WebCore::RenderObject::clippedOverflowRectForRepaint):
+        (WebCore::RenderObject::computeRectForRepaint):
+        (WebCore::RenderObject::localToContainerQuad):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::selectionRectForRepaint):
+        (WebCore::RenderObject::outlineBoundsForRepaint):
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::clippedOverflowRectForRepaint):
+        (WebCore::RenderPath::outlineBoundsForRepaint):
+        * rendering/RenderPath.h:
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::selectionRectForRepaint):
+        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
+        * rendering/RenderReplaced.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGContainer::outlineBoundsForRepaint):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGHiddenContainer.cpp:
+        (WebCore::RenderSVGHiddenContainer::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGHiddenContainer.h:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::selectionRectForRepaint):
+        (WebCore::RenderSVGInlineText::computeRepaintRectForRange):
+        * rendering/RenderSVGInlineText.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGText.h:
+        * rendering/RenderSelectionInfo.h:
+        (WebCore::RenderSelectionInfoBase::repaintContainer):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+        (WebCore::RenderTableCell::computeRectForRepaint):
+        (WebCore::RenderTableCell::localToContainerQuad):
+        * rendering/RenderTableCell.h:
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::clippedOverflowRectForRepaint):
+        * rendering/RenderTableCol.h:
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::clippedOverflowRectForRepaint):
+        * rendering/RenderTableRow.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::clippedOverflowRectForRepaint):
+        (WebCore::RenderText::selectionRectForRepaint):
+        * rendering/RenderText.h:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::localToContainerQuad):
+        (WebCore::RenderView::computeRectForRepaint):
+        * rendering/RenderView.h:
+
+2009-02-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Build fix.
+
+        * page/animation/KeyframeAnimation.h: A function prototype had two "fromStyle" arguments.
+
+2009-02-05  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Alexey Proskuryakov.
+        Landed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23733
+
+        Use a 2 arguments constructor for KURL to avoid ASSERT failure.
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::createFromDatabaseIdentifier):
+
+2009-02-04  Feng Qian  <feng@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add Android-specific files to WebCore/editing directory.
+        https://bugs.webkit.org/show_bug.cgi?id=23294
+
+        * editing/android: Added.
+        * editing/android/EditorAndroid.cpp: Added.
+        (WebCore::Editor::newGeneralClipboard):
+
+2009-02-04  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Remove -webkit-animation-play-state
+        The AnimationController still has the code to execute the property, but
+        it is no longer parsed or recorded.
+        https://bugs.webkit.org/show_bug.cgi?id=22907
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        (WebCore::CSSParser::parseAnimationProperty):
+        * css/CSSParser.h:
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSStyleSelector.h:
+        * platform/animation/Animation.h:
+        * rendering/style/RenderStyleConstants.h:
+
+2009-02-04  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Darin Adler.
+
+        Make sure we don't load on removing the media element from the document
+        https://bugs.webkit.org/show_bug.cgi?id=22105
+
+        Test: media/remove-from-document-no-load.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::removedFromDocument):
+
+2009-02-04  David Hyatt  <hyatt@apple.com>
+
+        Add a new RenderBoxModelObject class that will eventually act as the direct base class for RenderInlines.  For
+        now just adding the class and putting it in between RenderObject and RenderBox in the hierarchy.  RenderInline remains
+        derived from RenderBox for now.
+
+        Reviewed by Sam Weinig
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::RenderBox):
+        (WebCore::RenderBox::destroy):
+        (WebCore::RenderBox::styleWillChange):
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::computeRectForRepaint):
+        * rendering/RenderBox.h:
+        * rendering/RenderBoxModelObject.cpp: Added.
+        (WebCore::RenderBoxModelObject::RenderBoxModelObject):
+        (WebCore::RenderBoxModelObject::~RenderBoxModelObject):
+        * rendering/RenderBoxModelObject.h: Added.
+        * rendering/RenderObject.h:
+
+2009-02-04  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Added accelerated animation support to AnimationController and friends. The primary
+        changes are:
+        * accelerated animations get their start time from the compositing engine, so we
+          wait for a callback (notifyAnimationStarted()) in order to get the start time.
+        * if software and accelerated animations start in the same cycle, they all need
+          to use the same start time, which is that of the accelerated animations.
+
+        Added AnimationControllerPrivate to preserve the encapsulation under
+        AnimationController.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/animation/AnimationBase.cpp:
+        (WebCore::PropertyWrapperBase::animationIsAccelerated):
+        (WebCore::PropertyWrapperAcceleratedOpacity::PropertyWrapperAcceleratedOpacity):
+        (WebCore::PropertyWrapperAcceleratedOpacity::animationIsAccelerated):
+        (WebCore::PropertyWrapperAcceleratedOpacity::blend):
+        (WebCore::PropertyWrapperAcceleratedTransform::PropertyWrapperAcceleratedTransform):
+        (WebCore::PropertyWrapperAcceleratedTransform::animationIsAccelerated):
+        (WebCore::PropertyWrapperAcceleratedTransform::blend):
+        (WebCore::ensurePropertyMap):
+        (WebCore::AnimationBase::AnimationBase):
+        (WebCore::AnimationBase::~AnimationBase):
+        (WebCore::AnimationBase::blendProperties):
+        (WebCore::AnimationBase::animationOfPropertyIsAccelerated):
+        (WebCore::AnimationBase::updateStateMachine):
+        (WebCore::AnimationBase::fireAnimationEventsIfNeeded):
+        (WebCore::AnimationBase::willNeedService):
+        (WebCore::AnimationBase::getTimeToNextEvent):
+        (WebCore::AnimationBase::goIntoEndingOrLoopingState):
+        (WebCore::AnimationBase::beginAnimationUpdateTime):
+        * page/animation/AnimationBase.h:
+        (WebCore::AnimationBase::onAnimationStartResponse):
+        (WebCore::AnimationBase::getAnimatedStyle):
+        (WebCore::AnimationBase::isAnimatingProperty):
+        (WebCore::AnimationBase::endAnimation):
+        (WebCore::AnimationBase::isFallbackAnimating):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
+        (WebCore::AnimationControllerPrivate::accessCompositeAnimation):
+        (WebCore::AnimationControllerPrivate::addNodeChangeToDispatch):
+        (WebCore::AnimationControllerPrivate::animationTimerFired):
+        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
+        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
+        (WebCore::AnimationControllerPrivate::beginAnimationUpdateTime):
+        (WebCore::AnimationControllerPrivate::getAnimatedStyleForRenderer):
+        (WebCore::AnimationControllerPrivate::styleAvailable):
+        (WebCore::AnimationControllerPrivate::addToStartTimeResponseWaitList):
+        (WebCore::AnimationControllerPrivate::removeFromStartTimeResponseWaitList):
+        (WebCore::AnimationControllerPrivate::startTimeResponse):
+        (WebCore::AnimationController::getAnimatedStyleForRenderer):
+        (WebCore::AnimationController::notifyAnimationStarted):
+        (WebCore::AnimationController::endAnimationUpdate):
+        * page/animation/AnimationController.h:
+        * page/animation/AnimationControllerPrivate.h: Added.
+        (WebCore::AnimationControllerPrivate::hasAnimations):
+        (WebCore::AnimationControllerPrivate::setBeginAnimationUpdateTime):
+        (WebCore::AnimationControllerPrivate::endAnimationUpdate):
+        (WebCore::AnimationControllerPrivate::receivedStartTimeResponse):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::CompositeAnimationPrivate):
+        (WebCore::CompositeAnimationPrivate::animationControllerPriv):
+        (WebCore::CompositeAnimationPrivate::updateTransitions):
+        (WebCore::CompositeAnimationPrivate::updateKeyframeAnimations):
+        (WebCore::CompositeAnimationPrivate::animate):
+        (WebCore::CompositeAnimationPrivate::getAnimatedStyle):
+        (WebCore::CompositeAnimationPrivate::addToStartTimeResponseWaitList):
+        (WebCore::CompositeAnimationPrivate::removeFromStartTimeResponseWaitList):
+        (WebCore::CompositeAnimation::CompositeAnimation):
+        (WebCore::CompositeAnimation::animationControllerPriv):
+        (WebCore::CompositeAnimation::getAnimatedStyle):
+        (WebCore::CompositeAnimation::addToStartTimeResponseWaitList):
+        (WebCore::CompositeAnimation::removeFromStartTimeResponseWaitList):
+        * page/animation/CompositeAnimation.h:
+        (WebCore::CompositeAnimation::create):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::shouldSendEventForListener):
+        (WebCore::ImplicitAnimation::animate):
+        (WebCore::ImplicitAnimation::getAnimatedStyle):
+        (WebCore::ImplicitAnimation::startAnimation):
+        (WebCore::ImplicitAnimation::endAnimation):
+        (WebCore::ImplicitAnimation::sendTransitionEvent):
+        (WebCore::ImplicitAnimation::willNeedService):
+        * page/animation/ImplicitAnimation.h:
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::getKeyframeAnimationInterval):
+        (WebCore::KeyframeAnimation::animate):
+        (WebCore::KeyframeAnimation::getAnimatedStyle):
+        (WebCore::KeyframeAnimation::startAnimation):
+        (WebCore::KeyframeAnimation::endAnimation):
+        (WebCore::KeyframeAnimation::shouldSendEventForListener):
+        (WebCore::KeyframeAnimation::sendAnimationEvent):
+        (WebCore::KeyframeAnimation::willNeedService):
+        * page/animation/KeyframeAnimation.h:
+        * platform/graphics/GraphicsLayerClient.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (-[WebAnimationDelegate animationDidStart:]):
+        * rendering/RenderLayerBacking.h:
+
+2009-02-04  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Not reviewed, build fix.
+
+        Remove duplicate definition of msSans in FontCache::alternateFamilyName.
+
+        * platform/graphics/FontCache.cpp:
+        (WebCore::alternateFamilyName):
+
+2009-02-04  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Reverse the meaning of the if check so that Android
+        (dpad devices) do not scroll on focus and normal platforms do
+        http://trac.webkit.org/changeset/40647
+
+        This was caught by George Staikos, and I wrote the patch.
+
+        * dom/Element.cpp:
+        (WebCore::Element::updateFocusAppearance):
+
+2009-02-04  David Hyatt  <hyatt@apple.com>
+
+        Eliminate RenderContainer.
+
+        Reviewed by Sam and Anders
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::RenderBlock):
+        (WebCore::RenderBlock::destroy):
+        (WebCore::RenderBlock::styleWillChange):
+        (WebCore::RenderBlock::styleDidChange):
+        (WebCore::RenderBlock::addChild):
+        (WebCore::RenderBlock::dirtyLineBoxes):
+        (WebCore::RenderBlock::createInlineBox):
+        (WebCore::RenderBlock::removeChild):
+        (WebCore::RenderBlock::setSelectionState):
+        (WebCore::RenderBlock::avoidsFloats):
+        (WebCore::RenderBlock::positionForCoordinates):
+        (WebCore::RenderBlock::calcInlinePrefWidths):
+        (WebCore::RenderBlock::baselinePosition):
+        (WebCore::RenderBlock::getBaselineOfFirstLineBox):
+        (WebCore::RenderBlock::getBaselineOfLastLineBox):
+        (WebCore::RenderBlock::rectWithOutlineForRepaint):
+        (WebCore::RenderBlock::hoverAncestor):
+        (WebCore::RenderBlock::updateDragState):
+        (WebCore::RenderBlock::localCaretRect):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::virtualChildren):
+        (WebCore::RenderBlock::children):
+        * rendering/RenderContainer.cpp: Removed.
+        * rendering/RenderContainer.h: Removed.
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::RenderFrameSet):
+        (WebCore::RenderFrameSet::nodeAtPoint):
+        (WebCore::RenderFrameSet::layout):
+        * rendering/RenderFrameSet.h:
+        (WebCore::RenderFrameSet::virtualChildren):
+        (WebCore::RenderFrameSet::children):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::RenderInline):
+        (WebCore::RenderInline::destroy):
+        (WebCore::RenderInline::styleDidChange):
+        (WebCore::nextContinuation):
+        (WebCore::RenderInline::continuationBefore):
+        (WebCore::RenderInline::addChildIgnoringContinuation):
+        (WebCore::RenderInline::splitInlines):
+        (WebCore::RenderInline::splitFlow):
+        (WebCore::RenderInline::addChildToContinuation):
+        (WebCore::RenderInline::offsetLeft):
+        (WebCore::RenderInline::offsetTop):
+        (WebCore::RenderInline::positionForCoordinates):
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        (WebCore::RenderInline::rectWithOutlineForRepaint):
+        (WebCore::RenderInline::updateDragState):
+        (WebCore::RenderInline::childBecameNonInline):
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::virtualChildren):
+        (WebCore::RenderInline::children):
+        (WebCore::RenderInline::continuation):
+        (WebCore::RenderInline::setContinuation):
+        * rendering/RenderLineBoxList.h:
+        * rendering/RenderObject.h:
+        * rendering/RenderObjectChildList.h:
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::computeRepaintRectForRange):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::RenderSVGRoot):
+        (WebCore::RenderSVGRoot::applyContentTransforms):
+        (WebCore::RenderSVGRoot::paint):
+        (WebCore::RenderSVGRoot::absoluteTransform):
+        (WebCore::RenderSVGRoot::nodeAtPoint):
+        (WebCore::RenderSVGRoot::position):
+        * rendering/RenderSVGRoot.h:
+        (WebCore::RenderSVGRoot::virtualChildren):
+        (WebCore::RenderSVGRoot::children):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::absoluteRects):
+        (WebCore::RenderSVGText::absoluteQuads):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::addChild):
+        (WebCore::RenderTable::removeChild):
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::RenderTableCol):
+        * rendering/RenderTableCol.h:
+        (WebCore::RenderTableCol::virtualChildren):
+        (WebCore::RenderTableCol::children):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::RenderTableRow):
+        (WebCore::RenderTableRow::destroy):
+        (WebCore::RenderTableRow::styleWillChange):
+        (WebCore::RenderTableRow::addChild):
+        * rendering/RenderTableRow.h:
+        (WebCore::RenderTableRow::virtualChildren):
+        (WebCore::RenderTableRow::children):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::RenderTableSection):
+        (WebCore::RenderTableSection::destroy):
+        (WebCore::RenderTableSection::addChild):
+        (WebCore::RenderTableSection::removeChild):
+        (WebCore::RenderTableSection::lowestPosition):
+        (WebCore::RenderTableSection::rightmostPosition):
+        (WebCore::RenderTableSection::leftmostPosition):
+        * rendering/RenderTableSection.h:
+        (WebCore::RenderTableSection::virtualChildren):
+        (WebCore::RenderTableSection::children):
+
+2009-02-04  Mads Adger  <mad@chromium.org>
+
+        Reviewed by Antti Koivisto.
+
+        Bug 23180 Reading freed memory at DocumentLoader::checkForPendingPreloads
+        https://bugs.webkit.org/show_bug.cgi?id=23180
+
+        Added a protector for the document potentially holding on the last reference to the loader we are interating with.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::didFinishLoading):
+        (WebCore::Loader::Host::didFail):
+
+2009-02-04  Cary Clark  <caryclark@google.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23163
+        Don't scroll to show current focus on devices that use
+        directional pads for navigation.
+
+        * dom/Element.cpp:
+        (WebCore::Element::updateFocusAppearance):
+
+2009-02-04  Cary Clark  <caryclark@google.com>
+
+        Reviewed by Darin Adler.
+
+        Change RenderBlock::columnGap() access permissions from protected to
+        public. ANDROID creates an array of focus rectangles for navigation
+        with a trackball or directional pad, and needs access to the column gap
+        to implement this logic.
+
+        Android has no testing harness @ webkit.org, thus no tests.
+
+        * rendering/RenderBlock.h:
+
+2009-02-04  Cary Clark  <caryclark@google.com>
+
+        Reviewed by Darin Adler and Eric Seidel.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22917
+
+        Add ENABLE_ON_FIRST_TEXTAREA_FOCUS_SELECT_ALL to permit the ANDROID
+        platform to select all when focusing on a textarea. This matches
+        the user interface guidelines other applications on the platform.
+
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::updateFocusAppearance):
+
+2009-02-04  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/6386112> Some inline-elements are not
+        becoming proper dashboard-regions
+
+        RenderInline needs its own implementation of addDashboardRegions
+        because otherwise all of the coordinate calculations are
+        inaccurate.
+
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::addDashboardRegions):
+        * rendering/RenderInline.h:
+        * rendering/RenderObject.h:
+
+2009-02-04  David Hyatt  <hyatt@apple.com>
+
+        Move addChild/removeChild from RenderContainer to RenderObject.
+
+        Reviewed by Sam Weinig
+
+        * rendering/RenderContainer.cpp:
+        * rendering/RenderContainer.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::updateListMarkerNumbers):
+        (WebCore::RenderObject::addChild):
+        (WebCore::RenderObject::removeChild):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::addChildIgnoringContinuation):
+        * rendering/RenderSVGContainer.cpp:
+        * rendering/RenderSVGContainer.h:
+
+2009-02-04  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig
+
+        <rdar://problem/3541409> - Further HistoryItem / BF cache cleanup
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame):
+        (WebCore::CachedFrame::restore):
+        * history/CachedFrame.h:
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::restore):
+        * history/CachedPage.h:
+        (WebCore::CachedPage::mainFrameView):
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem):
+        (WebCore::HistoryItem::~HistoryItem):
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::isInPageCache):
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::open):
+
+2009-02-04  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23743
+        Fix memory corruption with open-source GIF decoders.
+
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::clear):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::clearFrameBufferCache):
+        * platform/image-decoders/skia/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::clearFrameBufferCache):
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        * platform/image-decoders/skia/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::clear):
+
+2009-02-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23360
+
+        When using accelerated compositing, make repaints use the correct
+        repaint container. Hook up the RenderLayerCompositor in RenderView,
+        and add to RenderView a method that repaints both the view
+        contents, and any intersecting composited layers.
+
+        Make enclosingCompositingLayer() a method on RenderObject, and update
+        the compositor to use that. Add a helper method on the compositor to
+        get the non-self compositing ancestor: ancestorCompositingLayer().
+
+        Call repaintRectangleInViewAndCompositedLayers() in places that don't do
+        container-relative repainting: selection redraw on focus change, caret,
+        and widget updates.
+
+        Fix a bug in RenderLayerCompositor where the m_compositingLayersNeedUpdate flag
+        would get cleared for partial updates, thus preventing subsequent full updates.
+
+        Fix a bug in RenderLayer::ensureBacking() that made new backing every time.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::recomputeCaretRect):
+        (WebCore::SelectionController::invalidateCaretRect):
+        (WebCore::SelectionController::focusedOrActiveStateChanged):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::compositor):
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::removeChild):
+        (WebCore::RenderLayer::ensureBacking):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::backing):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::updateGraphicsLayerGeometry):
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        (WebCore::RenderLayerBacking::notifyTransitionStarted):
+        (WebCore::RenderLayerBacking::notifyAnimationStarted):
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateCompositingLayers):
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        (WebCore::RenderLayerCompositor::layerWillBeRemoved):
+        (WebCore::RenderLayerCompositor::ancestorCompositingLayer):
+        (WebCore::RenderLayerCompositor::clippedByAncestor):
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::enclosingCompositingLayer):
+        (WebCore::RenderObject::containingBlockWidth):
+        (WebCore::RenderObject::containingBlockHeight):
+        (WebCore::RenderObject::containerForRepaint):
+        (WebCore::RenderObject::repaintUsingContainer):
+        * rendering/RenderObject.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::shouldRepaint):
+        (WebCore::RenderView::repaintViewRectangle):
+        (WebCore::RenderView::repaintRectangleInViewAndCompositedLayers):
+        (WebCore::RenderView::setMaximalOutlineSize):
+        (WebCore::RenderView::usesCompositing):
+        (WebCore::RenderView::compositor):
+        (WebCore::RenderView::didMoveOnscreen):
+        (WebCore::RenderView::willMoveOffscreen):
+        * rendering/RenderView.h:
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::updateWidgetPosition):
+
+2009-02-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Add toRenderImage methods for casting RenderObjects to RenderImages.  The methods will assert if the object
+        is not a RenderImage.  Also add a toRenderImage method that takes a RenderImage but returns void and that
+        is unimplemented.  This method will catch anyone trying to do a cast when the object is already a RenderImage.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::defaultEventHandler):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::attach):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::parseMappedAttribute):
+        (WebCore::HTMLImageElement::attach):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::attach):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::attach):
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::attach):
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageLoader::setImage):
+        (WebCore::ImageLoader::updateFromElement):
+        (WebCore::ImageLoader::notifyFinished):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        (WebCore::AccessibilityRenderObject::addChildren):
+        * page/DragController.cpp:
+        (WebCore::getCachedImage):
+        (WebCore::getImage):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeImage):
+        * rendering/RenderImage.h:
+        (WebCore::toRenderImage):
+        * wml/WMLImageElement.cpp:
+        (WebCore::WMLImageElement::parseMappedAttribute):
+        (WebCore::WMLImageElement::attach):
+
+2009-02-04  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Eric Seidel and Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20531
+
+        Make alternateFamilyName customized for Windows and Chromium.
+
+        * platform/graphics/FontCache.cpp:
+        (WebCore::alternateFamilyName):
+
+2009-02-04  Jungshik Shin <jshin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        This comes from Chromium patch (http://codereview.chromium.org/17624).
+
+        Add m_disableFontFallback to UniscriberHelper class and set it
+        to true when filling up glyph pages for non-BMP code points.
+        When it's set true, UniscriberHelper does not do its own font
+        fallback. Neither does it do glyph placement. Font fallback
+        will be taken care of in the simple script font path and glyph
+        placement is not necessary for simple scripts.
+
+        Layout test is missing at the moment due to the lack of freely
+        distributable font covering a non-BMP code page. A test page
+        is available at http://i18nl10n.com/webkit/nonbmp2.html
+
+        See also https://bugs.webkit.org/show_bug.cgi?id=23602
+
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
+        (WebCore::fillNonBMPGlyphs):
+        * platform/graphics/chromium/UniscribeHelper.cpp:
+        (WebCore::UniscribeHelper::UniscribeHelper):
+        (WebCore::UniscribeHelper::shape):
+        (WebCore::UniscribeHelper::fillShapes):
+        * platform/graphics/chromium/UniscribeHelper.h:
+        (WebCore::UniscribeHelper::setDisableFontFallback):
+
+2009-02-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Remove some unnecessary #includes of RenderStyle.h
+
+        * css/CSSPrimitiveValueMappings.h:
+        * css/SVGCSSComputedStyleDeclaration.cpp:
+        * dom/Node.h:
+        * rendering/PointerEventsHitRules.h:
+        * rendering/RenderImageGeneratedContent.h:
+        * rendering/RenderMarquee.h:
+        * rendering/RenderScrollbar.h:
+
+2009-02-04  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23657
+        Clean up WebCore/storage IDLs.
+
+        * storage/SQLError.idl: Changed to match spec.
+        * storage/SQLResultSet.idl: Changed to match spec.
+        * storage/SQLStatementCallback.idl: Removed.
+        * storage/SQLStatementErrorCallback.idl: Removed.
+        * storage/SQLTransactionCallback.idl: Removed.
+        * storage/SQLTransactionErrorCallback.idl: Removed.
+
+2009-02-04  David Hyatt  <hyatt@apple.com>
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23734, blank content on blogs.msdn.com.
+
+        Add debugging code that will catch the incorrect dirtying of a table section immediately if it happens
+        during calcRowHeight or layoutRows.  This should make it possible to discover future bugs where table sections don't
+        paint.
+
+        The bug in blogs.msdn.com, which was caused by a bad setNeedsLayout in RenderLayer::updateScrollInfoAtferLayout.  Make
+        sure to do only a local setNeedsLayout inside that function.
+
+        Reviewed by Beth Dakin
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isSetNeedsLayoutForbidden):
+        (WebCore::RenderObject::setNeedsLayoutIsForbidden):
+        (WebCore::RenderObject::setNeedsLayout):
+        (WebCore::RenderObject::setChildNeedsLayout):
+        (WebCore::RenderObject::markContainingBlocksForLayout):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::calcRowHeight):
+        (WebCore::RenderTableSection::layoutRows):
+
+2009-02-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Rename RenderStyle::Diff to StyleDifference and move it to
+        RenderStyleConstants.h.
+
+        * rendering/RenderBR.cpp:
+        (WebCore::RenderBR::styleDidChange):
+        * rendering/RenderBR.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::styleWillChange):
+        (WebCore::RenderBlock::styleDidChange):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleWillChange):
+        (WebCore::RenderBox::styleDidChange):
+        * rendering/RenderBox.h:
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::styleWillChange):
+        (WebCore::RenderButton::styleDidChange):
+        * rendering/RenderButton.h:
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::styleDidChange):
+        * rendering/RenderFieldset.h:
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::styleDidChange):
+        * rendering/RenderFileUploadControl.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::styleDidChange):
+        * rendering/RenderInline.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::styleChanged):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        (WebCore::RenderLayerCompositor::rebuildCompositingLayerTree):
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::styleDidChange):
+        * rendering/RenderListBox.h:
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::styleDidChange):
+        * rendering/RenderListItem.h:
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::styleWillChange):
+        (WebCore::RenderListMarker::styleDidChange):
+        * rendering/RenderListMarker.h:
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::styleDidChange):
+        * rendering/RenderMenuList.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::setStyle):
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::styleDidChange):
+        * rendering/RenderObject.h:
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::styleDidChange):
+        * rendering/RenderReplaced.h:
+        * rendering/RenderSVGGradientStop.cpp:
+        (WebCore::RenderSVGGradientStop::styleDidChange):
+        * rendering/RenderSVGGradientStop.h:
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::styleDidChange):
+        * rendering/RenderSVGInlineText.h:
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::styleWillChange):
+        (WebCore::RenderScrollbarPart::styleDidChange):
+        * rendering/RenderScrollbarPart.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::styleDidChange):
+        * rendering/RenderSlider.h:
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::styleDidChange):
+        * rendering/RenderTable.h:
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::styleWillChange):
+        (WebCore::RenderTableCell::styleDidChange):
+        * rendering/RenderTableCell.h:
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::styleWillChange):
+        * rendering/RenderTableRow.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::styleDidChange):
+        * rendering/RenderText.h:
+        (WebCore::RenderText::styleWillChange):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::styleDidChange):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::styleDidChange):
+        * rendering/RenderTextControlSingleLine.h:
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::styleDidChange):
+        * rendering/RenderWidget.h:
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        (WebCore::RenderStyle::setClip):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-02-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Move PseudoId enum out of RenderStyle and into RenderStyleConstants.h
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::matchRulesForList):
+        (WebCore::CSSStyleSelector::initForStyleResolve):
+        (WebCore::CSSStyleSelector::SelectorChecker::SelectorChecker):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkSelector):
+        (WebCore::CSSStyleSelector::styleForElement):
+        (WebCore::CSSStyleSelector::pseudoStyleForElement):
+        (WebCore::CSSStyleSelector::checkSelector):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass):
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSStyleSelector.h:
+        * dom/Node.cpp:
+        (WebCore::Node::diff):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::createScrollbar):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paint):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaTextDisplayElement::MediaTextDisplayElement):
+        (WebCore::MediaTimeDisplayElement::MediaTimeDisplayElement):
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+        (WebCore::MediaControlMuteButtonElement::MediaControlMuteButtonElement):
+        (WebCore::MediaControlPlayButtonElement::MediaControlPlayButtonElement):
+        (WebCore::MediaControlSeekButtonElement::MediaControlSeekButtonElement):
+        (WebCore::MediaControlTimelineElement::MediaControlTimelineElement):
+        (WebCore::MediaControlFullscreenButtonElement::MediaControlFullscreenButtonElement):
+        * rendering/MediaControlElements.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::styleDidChange):
+        (WebCore::RenderBlock::updateBeforeAfterContent):
+        (WebCore::RenderBlock::firstLineBlock):
+        (WebCore::RenderBlock::updateFirstLetter):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::isAfterContent):
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::updateBeforeAfterContent):
+        * rendering/RenderButton.h:
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::createButtonStyle):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::styleDidChange):
+        (WebCore::isAfterContent):
+        (WebCore::RenderInline::addChildIgnoringContinuation):
+        (WebCore::RenderInline::splitInlines):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::createScrollbar):
+        (WebCore::RenderLayer::updateScrollCornerStyle):
+        (WebCore::RenderLayer::updateResizerStyle):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::createScrollbar):
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createPanel):
+        (WebCore::RenderMedia::createTimelineContainer):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::createScrollbar):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::selectionBackgroundColor):
+        (WebCore::RenderObject::selectionForegroundColor):
+        (WebCore::RenderObject::firstLineStyleSlowCase):
+        (WebCore::RenderObject::getCachedPseudoStyle):
+        (WebCore::RenderObject::getUncachedPseudoStyle):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isAnonymousBlock):
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::destroyLeftoverChildren):
+        (WebCore::beforeAfterContainer):
+        (WebCore::RenderObjectChildList::invalidateCounters):
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+        * rendering/RenderObjectChildList.h:
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::getScrollbarPseudoStyle):
+        (WebCore::pseudoForScrollbarPart):
+        * rendering/RenderScrollbar.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::createThumbStyle):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):
+        (WebCore::RenderTextControlSingleLine::createResultsButtonStyle):
+        (WebCore::RenderTextControlSingleLine::createCancelButtonStyle):
+        (WebCore::RenderTextControlSingleLine::createScrollbar):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::pseudoBit):
+        * rendering/style/RenderStyle.h:
+        (WebCore::):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+
+2009-02-04  David Kilzer  <ddkilzer@apple.com>
+
+        CrashTracer: [REGRESSION] 53 crashes in Safari at com.apple.WebCore: WebCore::LegacyWebArchive::create + 2706
+
+        <rdar://problem/6509514>
+
+        Reviewed by Mark Rowe.
+
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::create): Fix it correctly this time.
+        Check for the value returned from WebCore::IconDatabase::iconForPageURL(),
+        not WebCore::Image::data().
+
+2009-02-04  David Hyatt  <hyatt@apple.com>
+
+        Rename removeFromObjectLists and move it into RenderBox, since it only applies to boxes.
+
+        Reviewed by Adam Roben
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::removeFloatingOrPositionedChildFromBlockLists):
+        (WebCore::RenderBox::styleWillChange):
+        * rendering/RenderBox.h:
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::removeChild):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+        * rendering/RenderObject.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::removeChild):
+
+2009-02-04  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23471
+        Fix text-overflow:ellipsis; for RTL case.
+
+        Test: fast/css/text-overflow-ellipses.html
+
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::placeEllipsisBox): Add support for rtl placement.
+        (WebCore::InlineTextBox::paintDecoration): Correctly draw decorations
+        for rtl truncation.
+
+2009-02-04  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23700
+        Upstream local changes to due to unforking of SimpleFontData
+        (corresponds to Chromium check-in http://src.chromium.org/viewvc/chrome?view=rev&revision=8646).
+
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
+        (WebCore::fillBMPGlyphs): Removed extra checks for ZWS chars.
+
+2009-02-04  David Hyatt  <hyatt@apple.com>
+
+        <rdar://problem/6554115> REGRESSION (r40475): World leak (JS global object) after viewing a photo on Facebook
+
+        Fix a ginormous leak. (GINORMOUS!) Make sure to disconnect the event listeners attached to the Document,
+        because, like, they point to a lot of stuff... like ... everything...
+
+        Reviewed by Darin Adler
+
+        * dom/Document.cpp:
+        (WebCore::Document::removeAllEventListenersFromAllNodes):
+
+2009-02-04  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23731
+        Add JSCCustom and V8Custom as extended IDL attributes
+
+        This helps avoid having to add #ifdefs to the IDL files to support V8 bindings.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/Document.idl:
+        * dom/Node.idl:
+        * svg/SVGPathSegList.idl:
+        * svg/SVGPointList.idl:
+        * svg/SVGTransformList.idl:
+
+2009-02-04  Dan Bernstein  <mitz@apple.com>
+
+        - build fix
+
+        * rendering/RenderImageGeneratedContent.h:
+
+2009-02-04  miggilin  <mr.diggilin@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Switch to using a ref-counted wxFont pointer for FontPlatformData to fix a crash
+        with assigning to uninitialized HashTable buckets.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23669
+
+        * platform/graphics/SimpleFontData.h:
+        (WebCore::SimpleFontData::getWxFont):
+        * platform/graphics/wx/FontPlatformData.h:
+        (WebCore::):
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::font):
+        (WebCore::FontPlatformData::operator==):
+        * platform/graphics/wx/FontPlatformDataWx.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::computeHash):
+        (WebCore::FontPlatformData::~FontPlatformData):
+        * platform/graphics/wx/SimpleFontDataWx.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        * platform/wx/wxcode/gtk/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+
+2009-02-04  David Hyatt  <hyatt@apple.com>
+
+        Fix a crash in generated content when a generated image with an already-cached background image gets
+        created.  It's not completely clear how to reproduce this crash.
+
+        Reviewed by Adam Roben
+
+        * rendering/RenderImageGeneratedContent.h:
+        (WebCore::RenderImageGeneratedContent::imagePtr):
+
+2009-02-04  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed Qt build fix.
+
+        Changed ASSERT(image) to ASSERT(!image.isNull()).
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::getImageData):
+
+2009-02-04  Trenton Schulz <trenton.schulz@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix implementation of PluginViewMac::invalidateRect to update only the
+        specified rect, not the entire browser window.
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::invalidateRect):
+
+2009-02-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber stamped by Mark Rowe.
+
+        FramePrivate was removed in r40024 remove the forward
+        declaration as well.
+
+        * page/Frame.h:
+
+2009-02-04  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23426
+
+        Make isFrameSet virtual and by default return false. Reimplement
+        it in HTMLDocument.
+
+        * dom/Document.cpp:
+        * dom/Document.h:
+        (WebCore::Document::isFrameSet):
+        * html/HTMLDocument.cpp:
+        (WebCore::HTMLDocument::isFrameSet):
+        * html/HTMLDocument.h:
+
+2009-02-03  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by John Sullivan.
+
+        <rdar://problem/6554092> Slow script dialog starts coming up over and over again
+
+        Work around <rdar://problem/6554067> by consuming any exceptions that are
+        thrown by _web_localizedDescription
+
+        * platform/network/mac/ResourceErrorMac.mm:
+        (WebCore::ResourceError::platformLazyInit):
+
+2009-02-03  David Hyatt  <hyatt@apple.com>
+
+        Move the isRenderInline checks for clientWidth/Height and scrollWidth/Height to the DOM element
+        versions of the functions.  Since internal render tree usage doesn't ever (incorrectly) call these
+        functions on RenderInlines, this manages to get virtual function calls out of contentWidth/Height and
+        availableWidth/Height.
+
+        Reviewed by Mark Rowe
+
+        * dom/Element.cpp:
+        (WebCore::Element::clientWidth):
+        (WebCore::Element::clientHeight):
+        (WebCore::Element::scrollWidth):
+        (WebCore::Element::scrollHeight):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::clientWidth):
+        (WebCore::RenderBox::clientHeight):
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+
+2009-02-03  Brad Garcia  <bgarcia@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20443
+        Remove call to canResize when trying to determine if pointer
+        is within a frame.
+        Also removed the implementation of canResize as it is no longer used.
+
+        Test: fast/frames/frame-dead-region.html
+
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::nodeAtPoint):
+        * rendering/RenderFrameSet.h:
+
+2009-02-03  David Hyatt  <hyatt@apple.com>
+
+        Reduce the number of calls to virtualChildren (indirectly made via RenderObject::firstChild()).
+        This is a small gain on the PLT.
+
+        Reviewed by Mark Rowe
+
+        * rendering/bidi.cpp:
+        (WebCore::inlineWidth):
+        (WebCore::bidiNext):
+
+2009-02-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23628
+
+        Fix selection repainting to do container-relative repaints. RenderView now
+        repaints the selection using the containerForRepaint() for each RenderSelectionInfo.
+        selectionRect() is now a wrapper for selectionRectForRepaint() with no container.
+
+        Pull SelectionInfo out of RenderObject.h, and BlockSelectionInfo out
+        of RenderBlock.h and move them into RenderSelectionInfo.h, with some
+        sharing and refactoring.
+
+        RenderBlock::selectionGapRectsForRepaint() is not yet container-aware.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderBR.h:
+        (WebCore::RenderBR::selectionRectForRepaint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::selectionGapRectsForRepaint):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::selectionRectForRepaint):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::paint):
+        (WebCore::RenderListMarker::selectionRectForRepaint):
+        * rendering/RenderListMarker.h:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::selectionRect):
+        (WebCore::RenderObject::selectionRectForRepaint):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::selectionRectForRepaint):
+        * rendering/RenderReplaced.h:
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::absoluteRects):
+        (WebCore::RenderSVGInlineText::absoluteQuads):
+        (WebCore::RenderSVGInlineText::selectionRectForRepaint):
+        (WebCore::RenderSVGInlineText::computeRepaintRectForRange):
+        * rendering/RenderSVGInlineText.h:
+        * rendering/RenderSelectionInfo.h: Added.
+        (WebCore::RenderSelectionInfoBase::RenderSelectionInfoBase):
+        (WebCore::RenderSelectionInfoBase::object):
+        (WebCore::RenderSelectionInfoBase::repaintContainer):
+        (WebCore::RenderSelectionInfoBase::state):
+        (WebCore::RenderSelectionInfo::RenderSelectionInfo):
+        (WebCore::RenderSelectionInfo::repaint):
+        (WebCore::RenderSelectionInfo::rect):
+        (WebCore::RenderBlockSelectionInfo::RenderBlockSelectionInfo):
+        (WebCore::RenderBlockSelectionInfo::repaint):
+        (WebCore::RenderBlockSelectionInfo::block):
+        (WebCore::RenderBlockSelectionInfo::rects):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::selectionRectForRepaint):
+        * rendering/RenderText.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::selectionBounds):
+        (WebCore::RenderView::setSelection):
+        * rendering/RenderView.h:
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+
+2009-02-03  David Hyatt  <hyatt@apple.com>
+
+        Add inline capacity back to CSSMutableStyleDeclaration now that the bug in Vector has been fixed.
+
+        Reviewed by Darin Adler & Sam Weinig
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::removePropertiesInSet):
+        * css/CSSMutableStyleDeclaration.h:
+
+2009-02-03  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=13490
+        Implement execCommand("styleWithCSS", ...)
+
+        Determine whether or not to use HTML formatting tags for styling on the new
+        boolean on Editor instead of whether or not the document is quirks mode.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::StyleChange):
+        (WebCore::StyleChange::init):
+        (WebCore::ApplyStyleCommand::applyBlockStyle):
+        (WebCore::ApplyStyleCommand::applyTextDecorationStyle):
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded):
+        * editing/Editor.cpp:
+        (WebCore::Editor::Editor):
+        (WebCore::Editor::clear):
+        * editing/Editor.h:
+        (WebCore::Editor::setShouldStyleWithCSS):
+        (WebCore::Editor::shouldStyleWithCSS):
+        * editing/EditorCommand.cpp:
+        (WebCore::executeStyleWithCSS):
+        (WebCore::stateStyleWithCSS):
+        (WebCore::CommandEntry::):
+
+2009-02-03  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        This is a follow up of r40546. Call toImage() once speeds up ImageBuffer::getImageData()
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::getImageData):
+
+2009-02-03  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        - Fix for <rdar://problem/6549743>
+
+        On Tiger, create an autorelease pool before creating the NSGraphicsContext and drain it immediately
+        after the call to -[NSView displayRectIgnoringOpacity:inContext:].
+
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::paint):
+
+2009-02-03  David Hyatt  <hyatt@apple.com>
+
+        Back this change out since it is causing layout tests to crash.  There is something subtle going on
+        here.
+
+        Reviewed by Darin Adler
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::removePropertiesInSet):
+        * css/CSSMutableStyleDeclaration.h:
+
+2009-02-03  David Hyatt  <hyatt@apple.com>
+
+        Give the properties vector of mutable style declarations an initial inline capacity to reduce malloc churn.
+
+        Reviewed by Sam Weinig
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::removePropertiesInSet):
+        * css/CSSMutableStyleDeclaration.h:
+
+2009-02-03  David Hyatt  <hyatt@apple.com>
+
+        Avoid creating extra copies of NSURLRequests for non-HTTP URLs.  Only mark platform requests
+        as needing updating when HTTP fields change if the scheme of the URL is actually HTTP or HTTPS.
+        Thus cuts down significantly on the number of copied NSURLRequests and is about a 1% gain on the PLT.
+
+        Reviewed by Darin Adler
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::addExtraFieldsToRequest):
+        * platform/KURL.cpp:
+        (WebCore::KURL::invalidate):
+        (WebCore::KURL::KURL):
+        * platform/KURL.h:
+        (WebCore::KURL::isHTTPOrHTTPS):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::setCachePolicy):
+        (WebCore::ResourceRequestBase::setTimeoutInterval):
+        (WebCore::ResourceRequestBase::setMainDocumentURL):
+        (WebCore::ResourceRequestBase::setHTTPMethod):
+        (WebCore::ResourceRequestBase::setHTTPHeaderField):
+        (WebCore::ResourceRequestBase::setResponseContentDispositionEncodingFallbackArray):
+        (WebCore::ResourceRequestBase::setHTTPBody):
+        (WebCore::ResourceRequestBase::setAllowHTTPCookies):
+
+2009-02-03  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23711
+
+        Add manual test for floating divs with scrollbars.
+
+        * manual-tests/gtk/floatingdiv.html: Added.
+
+2009-02-03  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23711
+
+        There's no need to hold an extra ref to the scrollbar, calling
+        setPlatformWidget takes ownership of it.
+
+        Also do not disconnect the signals when destroying the widget,
+        it's superfluous.
+
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::ScrollbarGtk):
+        * platform/gtk/ScrollbarGtk.h:
+
+2009-02-03  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23711
+
+        Declare scrollBar as GtkWidget* to avoid needless
+        casting.
+
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::ScrollbarGtk):
+        (ScrollbarGtk::~ScrollbarGtk):
+
+2009-02-03  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23711
+
+        Properly calculate the scrollbar location for their
+        usage in RenderLayout.
+
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::frameRectsChanged):
+
+2009-02-03  David Hyatt  <hyatt@apple.com>
+
+        Rename addLineBoxRects to absoluteRectsForRange, and do the same thing for the corresponding quads methods.  Move the RenderContainer implementations
+        of these methods up to RenderObject.
+
+        Reviewed by Beth Dakin
+
+        * bindings/objc/DOM.mm:
+        (-[DOMNode lineBoxRects]):
+        * dom/Range.cpp:
+        (WebCore::Range::addLineBoxRects):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::drawNodeHighlight):
+        * rendering/RenderContainer.cpp:
+        * rendering/RenderContainer.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::absoluteRectsForRange):
+        (WebCore::RenderObject::absoluteQuadsForRange):
+        * rendering/RenderObject.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::absoluteRectsForRange):
+        (WebCore::RenderText::absoluteQuadsForRange):
+        * rendering/RenderText.h:
+
+2009-02-03  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Sam Weinig and Oliver Hunt.
+
+        Added getImageData() support for QtWebKit.
+
+        [QT] lacks getImageData / putImageData support in Canvas
+        https://bugs.webkit.org/show_bug.cgi?id=22186
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::getImageData):
+
+2009-02-03  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Holger Freyther.
+
+        Fix FrameChromium.cpp following r40473 which moved Frame::adjustPageHeight to FrameView::adjustPageHeight.
+
+        * page/chromium/FrameChromium.cpp:
+        (WebCore::computePageRectsForFrame):
+
+2009-02-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23358
+
+        Hook accelerated compositing into RenderLayer.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::~RenderLayer):
+        Init and clean up backing and the hasCompositingDescendant bit.
+
+        (WebCore::RenderLayer::compositor):
+        Shortcut to get to the RenderLayerCompositor.
+
+        (WebCore::RenderLayer::updateLayerPositions):
+        We need to let full repaints propagate to all compositing layers, and
+        update the backing after layout here.
+
+        (WebCore::RenderLayer::transparentAncestor):
+        (WebCore::transparencyClipBox):
+        (WebCore::RenderLayer::beginTransparencyLayers):
+        Account for the fact that opacity may be rendered via the compositing
+        layer sometimes.
+
+        (WebCore::RenderLayer::addChild):
+        (WebCore::RenderLayer::removeChild):
+        (WebCore::RenderLayer::removeOnlyThisLayer):
+        Tell the compositor when the RenderLayer hierarchy changes.
+
+        (WebCore::RenderLayer::scrollToOffset):
+        Update layer geometry after scrolling.
+
+        (WebCore::RenderLayer::paintLayer):
+        We short-circuit painting on composited layers, because these layers
+        are painted on a callback from the compositing system.
+
+        (WebCore::RenderLayer::hitTestLayer):
+        Only apply transforms if we are rendering them in software.
+
+        (WebCore::RenderLayer::localBoundingBox):
+        (WebCore::RenderLayer::boundingBox):
+        (WebCore::RenderLayer::absoluteBoundingBox):
+        Refactor bounding box code that we can compute local, and ancestor-relative
+        bounding box, as well as absolute.
+
+        (WebCore::RenderLayer::ensureBacking):
+        (WebCore::RenderLayer::clearBacking):
+        RenderLayerBacking creation and destruction.
+
+        (WebCore::RenderLayer::setParent):
+        Tell the compositor when the RenderLayer hierarchy changes.
+
+        (WebCore::RenderLayer::dirtyZOrderLists):
+        (WebCore::RenderLayer::dirtyStackingContextZOrderLists):
+        (WebCore::RenderLayer::dirtyOverflowList):
+        When the z-order and overflow lists change, we need to tell the
+        compositor that the composited layers need to be rejiggered soon.
+
+        (WebCore::RenderLayer::updateZOrderLists):
+        Whitespace cleanup.
+
+        (WebCore::RenderLayer::setBackingNeedsRepaint):
+        (WebCore::RenderLayer::setBackingNeedsRepaintInRect):
+        Dirty composited layer contents for painting.
+
+        (WebCore::RenderLayer::styleChanged):
+        Update the layer backing after style changes.
+
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::isComposited):
+        (WebCore::RenderLayer::backing):
+        Accessors for testing and getting the backing for this RenderLayer.
+
+        (WebCore::RenderLayer::paintsWithTransparency):
+        (WebCore::RenderLayer::paintsWithTransform):
+        Transform and opacity can be applied via the compositing layer, or rendered
+        in software. These methods tell us if we need to account for them in the
+        non-compositing path.
+
+        (WebCore::RenderLayer::hasCompositingDescendant):
+        (WebCore::RenderLayer::setHasCompositingDescendant):
+        Maintain a bit to tell if this layer has composited descendants.
+
+2009-02-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23365
+
+        Hook up accelerated compositing layers the native
+        view system on Mac.
+
+        * WebCore.base.exp:
+        Export new Page methods.
+
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::attachRootGraphicsLayer):
+        (WebCore::ChromeClient::setNeedsOneShotDrawingSynchronization):
+        New methods for attaching/detaching the root GraphicsLayer, and
+        synchronizing layer changes with window drawing.
+
+        * page/FrameView.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateCompositingLayers):
+        (WebCore::FrameView::setNeedsOneShotDrawingSynchronization):
+        (WebCore::FrameView::didMoveOnscreen):
+        (WebCore::FrameView::willMoveOffscreen):
+        New methods to update the compositing layer hierarchy,
+        and pass-throughs to the RenderLayerCompositor.
+
+        (WebCore::FrameView::layout):
+        Update compositing layers after layout() and updateLayerPositions().
+
+        * page/Page.cpp:
+        (WebCore::Page::didMoveOnscreen):
+        (WebCore::Page::willMoveOffscreen):
+        * page/Page.h:
+        New methods to allow the native view system to tell the Page when it
+        starts to be presented on-screen, and when it will be hidden.
+
+        * rendering/RenderLayerCompositor.h:
+        * rendering/RenderLayerCompositor.cpp:
+        (WebCore::RenderLayerCompositor::updateLayerCompositingState):
+        (WebCore::RenderLayerCompositor::didMoveOnscreen):
+        (WebCore::RenderLayerCompositor::willMoveOffscreen):
+        (WebCore::RenderLayerCompositor::ensureRootPlatformLayer):
+        Rename 'attached' methods to 'moveOnscreen/moveOffscreen' to match
+        the calls through from Page, FrameView.
+
+        (WebCore::RenderLayerCompositor::layerWillBeRemoved):
+        Dont' try to repaint or update layers if the document is being torn
+        down.
+
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::didMoveOnscreen):
+        (WebCore::RenderView::willMoveOffscreen):
+        * rendering/RenderView.h:
+        New methods.
+
+2009-02-03  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Holger Hans Peter Freyther.
+
+        Fixed getImageData and putImageData and respect pre-
+        multiplied colors.
+
+        Cairo's ImageBuffer::getImageData() does not handle alpha=0 case correctly
+        https://bugs.webkit.org/show_bug.cgi?id=21575
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::getImageData):
+        (WebCore::ImageBuffer::putImageData):
+
+2009-02-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        - fix <rdar://problem/6550530> REGRESSION (r40508): Window opened with window.open has no initial history item (global and back/forward)
+
+        Test: fast/history/window-open.html
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::createWindow): Pass the missing lockBackForwardList parameter
+        to FrameLoader::changeLocation().
+
+2009-02-03  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build after r40536.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertQVariantToValue):
+
+2009-02-03  Dan Bernstein  <mitz@apple.com>
+
+        - fix -Wmissing-prototypes builds
+
+        * loader/WorkerThreadableLoader.cpp:
+        (WebCore::workerContextDidSendData): Marked this function static.
+        (WebCore::workerContextDidReceiveResponse): Ditto.
+        (WebCore::workerContextDidReceiveData): Ditto.
+        (WebCore::workerContextDidFinishLoading): Ditto.
+        (WebCore::workerContextDidFail): Ditto.
+        (WebCore::workerContextDidGetCancelled): Ditto.
+        (WebCore::workerContextDidReceiveAuthenticationCancellation): Ditto.
+
+2009-02-03  David Kilzer  <ddkilzer@apple.com>
+
+        CrashTracer: [REGRESSION] 53 crashes in Safari at com.apple.WebCore: WebCore::LegacyWebArchive::create + 2706
+
+        <rdar://problem/6509514>
+
+        Reviewed by Adam Roben.
+
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::create): Null check the value returned
+        from WebCore::IconDatabase::iconForPageURL().
+
+2009-02-03  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix conversion of QByteArray to JavaScript and back. Instead of
+        converting it to a String (data loss!) we now map it to JSByteArray.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::):
+        (JSC::Bindings::valueRealType): Added JSByteArray as converstion type.
+        (JSC::Bindings::convertValueToQVariant): Convert from JSByteArray to
+        QVariant(QByteArray).
+        (JSC::Bindings::convertQVariantToValue): Convert from
+        QVariant::ByteArray to jsByteArray.
+
+2009-02-03  Alexey Proskuryakov  <ap@webkit.org>
+
+        Build fix.
+
+        * GNUmakefile.am: Removed WorkerTask.{h,cpp}.
+
+2009-02-03  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22718
+        Implement WindowTimers interface in Workers.
+
+        This patch moves timeoutID from Document to ScriptExecutionContext
+        and exposes JS methods setTimeout/setInterval/clearTimeout/clearInterval inside of a Worker.
+        Also added a test for those methods.
+
+        Test: fast/workers/worker-timeout.html
+
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::setTimeoutOrInterval):
+        Creates ScheduledAction and calls WorkerContext::installTimeout to actually add a timer.
+
+        (WebCore::JSWorkerContext::setTimeout):
+        (WebCore::JSWorkerContext::clearTimeout):
+        (WebCore::JSWorkerContext::setInterval):
+        (WebCore::JSWorkerContext::clearInterval):
+        Added methods exposed to JS.
+
+        * dom/Document.cpp:
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::addTimeout):
+        (WebCore::ScriptExecutionContext::removeTimeout):
+        (WebCore::ScriptExecutionContext::findTimeout):
+        * dom/ScriptExecutionContext.h:
+        The timerID map moves from Document to ScriptExecutionContext,
+        to be available to Document and to WorkerContext.
+
+        * dom/WorkerContext.cpp:
+        (WebCore::WorkerContext::installTimeout): Adds a DOMTimeout.
+        (WebCore::WorkerContext::removeTimeout): Removes a DOMTimeout.
+        * dom/WorkerContext.h:
+
+        * page/DOMTimer.cpp:
+        (WebCore::DOMTimer::DOMTimer):
+        (WebCore::DOMTimer::~DOMTimer):
+        (WebCore::DOMTimer::removeById):
+        Code change here reflects move of timeoutID map to the ScriptExecutionContext.
+        Some checks and casts are no longer needed.
+
+2009-02-03  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23560
+        Implement SharedTimer for Workers.
+
+        * dom/WorkerRunLoop.cpp:
+        Added private class WorkerSharedTimer that implements SharedTimer interface for worker threads.
+        (WebCore::WorkerSharedTimer::WorkerSharedTimer):
+        (WebCore::WorkerSharedTimer::setFiredFunction):
+        (WebCore::WorkerSharedTimer::setFireTime):
+        (WebCore::WorkerSharedTimer::stop):
+        (WebCore::WorkerSharedTimer::isActive):
+        (WebCore::WorkerSharedTimer::fireTime):
+        (WebCore::WorkerSharedTimer::fire):
+        (WebCore::WorkerRunLoop::WorkerRunLoop):
+        Initializes a WorkerSharedTimer instance.
+        (WebCore::WorkerRunLoop::~WorkerRunLoop):
+        The destructor is here so compiler is ok with having OwnPtr<WorkerSharedTimer> in .h file w/o defining WorkerSharedTimer.
+        (WebCore::WorkerRunLoop::run):
+        Set/reset shared timer interface on ThreadTimers, use MessageQueue::waitForMessageTimed() if timer is active.
+        * dom/WorkerRunLoop.h:
+        Add member of type OwnPtr<WorkerSharedTimer>
+
+2009-02-03  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-02-03  Alexey Proskuryakov  <ap@webkit.org>
+
+        Windows build fix.
+
+        * dom/CrossThreadCopier.h: Changed forward declarations to use struct instead of class where
+        appropriate.
+
+2009-02-02  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23636: Make the async api of ThreadableLoader functional for the worker context.
+        <https://bugs.webkit.org/show_bug.cgi?id=23636>
+
+        Enable the async portion of ThreadableLoader for workers.
+
+        No observable change in behavior, so no test.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/CrossThreadCopier.h:
+        * dom/GenericWorkerTask.h:
+        * dom/WorkerThread.cpp:
+        * loader/ThreadableLoader.cpp:
+        (WebCore::ThreadableLoader::create):
+        * loader/ThreadableLoaderClient.h:
+        (WebCore::ThreadableLoaderClient::didFinishLoading):
+        * loader/ThreadableLoaderClientWrapper.h: Added.
+        (WebCore::ThreadableLoaderClientWrapper::create):
+        (WebCore::ThreadableLoaderClientWrapper::clearClient):
+        (WebCore::ThreadableLoaderClientWrapper::didSendData):
+        (WebCore::ThreadableLoaderClientWrapper::didReceiveResponse):
+        (WebCore::ThreadableLoaderClientWrapper::didReceiveData):
+        (WebCore::ThreadableLoaderClientWrapper::didFinishLoading):
+        (WebCore::ThreadableLoaderClientWrapper::didFail):
+        (WebCore::ThreadableLoaderClientWrapper::didGetCancelled):
+        (WebCore::ThreadableLoaderClientWrapper::didReceiveAuthenticationCancellation):
+        (WebCore::ThreadableLoaderClientWrapper::ThreadableLoaderClientWrapper):
+        * loader/WorkerThreadableLoader.cpp: Added.
+        (WebCore::WorkerThreadableLoader::WorkerThreadableLoader):
+        (WebCore::WorkerThreadableLoader::~WorkerThreadableLoader):
+        (WebCore::WorkerThreadableLoader::cancel):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::MainThreadBridge):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::~MainThreadBridge):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadDestroy):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::destroy):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::mainThreadCancel):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::cancel):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::clearClientWrapper):
+        (WebCore::workerContextDidSendData):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didSendData):
+        (WebCore::workerContextDidReceiveResponse):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveResponse):
+        (WebCore::workerContextDidReceiveData):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveData):
+        (WebCore::workerContextDidFinishLoading):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFinishLoading):
+        (WebCore::workerContextDidFail):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didFail):
+        (WebCore::workerContextDidGetCancelled):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didGetCancelled):
+        (WebCore::workerContextDidReceiveAuthenticationCancellation):
+        (WebCore::WorkerThreadableLoader::MainThreadBridge::didReceiveAuthenticationCancellation):
+        * loader/WorkerThreadableLoader.h: Added.
+        (WebCore::WorkerThreadableLoader::create):
+        (WebCore::WorkerThreadableLoader::refThreadableLoader):
+        (WebCore::WorkerThreadableLoader::derefThreadableLoader):
+
+2009-02-02  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23636: Make the async api of ThreadableLoader functional for the worker context.
+        <https://bugs.webkit.org/show_bug.cgi?id=23636>
+
+        No observable change in behavior, so no test.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Worker.cpp:
+        * dom/Worker.h:
+        * dom/WorkerContext.cpp:
+        (WebCore::WorkerContext::addMessage):
+        (WebCore::WorkerContext::postTask):
+        (WebCore::WorkerContext::postTaskToWorkerObject):
+        * dom/WorkerContext.h:
+        * dom/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::performTask):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
+        (WebCore::WorkerMessagingProxy::postTaskToWorkerContext):
+        Expose postTaskToWorkerContext for use by the worker object thread.
+
+        (WebCore::WorkerMessagingProxy::postTaskToWorkerObject):
+        Change the name of postTaskToParentContext to postTaskToWorkerObject for consistency
+        with postMessageToWorkerObject.
+
+        * dom/WorkerMessagingProxy.h:
+        * dom/WorkerRunLoop.cpp:
+        (WebCore::WorkerRunLoop::run):
+        (WebCore::WorkerRunLoop::postTask):
+        * dom/WorkerRunLoop.h:
+        * dom/WorkerTask.cpp: Removed.
+        * dom/WorkerTask.h: Removed.
+        Removed WorkerTask and replaced with the existing ScriptExecutionContext::Task.
+
+        The resulted in the class going away along with an adapter that made
+        a ScriptExecutionContext::Task look like a WorkerTask.
+
+        * dom/WorkerThread.cpp:
+        * dom/WorkerThread.h:
+
+2009-02-02  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23618: Templated worker tasks should be more error proof to use.
+        <https://bugs.webkit.org/show_bug.cgi?id=23618>
+
+        Add the generic worker tasks templates needed for the WorkerThreadableLoader.
+
+        No observable change in behavior, so no test.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/CrossThreadCopier.cpp: Added.
+        * dom/CrossThreadCopier.h: Added.
+        (WebCore::CrossThreadCopierPassThrough::copy):
+        * dom/GenericWorkerTask.h:
+        Stop doing the WorkerMessagingProxy::askedToTerminate call automatically
+        in performTask because was not obvious that it would be done and not always needed.
+
+        (WebCore::GenericWorkerTask1::create):
+        (WebCore::GenericWorkerTask1::GenericWorkerTask1):
+        (WebCore::GenericWorkerTask1::performTask):
+        (WebCore::GenericWorkerTask2::create):
+        (WebCore::GenericWorkerTask2::GenericWorkerTask2):
+        (WebCore::GenericWorkerTask2::performTask):
+        (WebCore::GenericWorkerTask3::create):
+        (WebCore::GenericWorkerTask3::GenericWorkerTask3):
+        (WebCore::GenericWorkerTask3::performTask):
+        (WebCore::GenericWorkerTask4::create):
+        (WebCore::GenericWorkerTask4::GenericWorkerTask4):
+        (WebCore::GenericWorkerTask4::performTask):
+        (WebCore::GenericWorkerTask5::create):
+        (WebCore::GenericWorkerTask5::GenericWorkerTask5):
+        (WebCore::GenericWorkerTask5::performTask):
+        (WebCore::GenericWorkerTask6::create):
+        (WebCore::GenericWorkerTask6::GenericWorkerTask6):
+        (WebCore::GenericWorkerTask6::performTask):
+        (WebCore::GenericWorkerTask7::create):
+        (WebCore::GenericWorkerTask7::GenericWorkerTask7):
+        (WebCore::GenericWorkerTask7::performTask):
+        (WebCore::createCallbackTask):
+        * dom/WorkerContext.cpp:
+        (WebCore::addMessageTask):
+        (WebCore::WorkerContext::addMessage):
+        * dom/WorkerMessagingProxy.h:
+        (WebCore::WorkerMessagingProxy::askedToTerminate):
+
+2009-02-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David "The Barnabas Jones" Hyatt.
+
+        Move removeChildNode, appendChildNode and insertChildNode from
+        RenderContainer into RenderObjectChildList.  Make moveChildNode
+        static in RenderBlock, as that was the only user.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::moveChild):
+        (WebCore::RenderBlock::makeChildrenNonInline):
+        (WebCore::RenderBlock::removeChild):
+        (WebCore::RenderBlock::handleRunInChild):
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::addChild):
+        (WebCore::RenderContainer::removeChild):
+        * rendering/RenderContainer.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::splitInlines):
+        (WebCore::RenderInline::splitFlow):
+        (WebCore::RenderInline::childBecameNonInline):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::handleDynamicFloatPositionChange):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::createsAnonymousWrapper):
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::updateListMarkerNumbers):
+        (WebCore::RenderObjectChildList::removeChildNode):
+        (WebCore::RenderObjectChildList::appendChildNode):
+        (WebCore::RenderObjectChildList::insertChildNode):
+        * rendering/RenderObjectChildList.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::addChild):
+        (WebCore::RenderSVGContainer::removeChild):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::removeChild):
+        * rendering/RenderTable.h:
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::removeChild):
+        * rendering/RenderTableSection.h:
+
+2009-02-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Alder.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23697
+        Leaks seen on Worker tests
+
+        * dom/WorkerMessagingProxy.cpp: (WebCore::WorkerMessagingProxy::workerContextDestroyedInternal):
+        Zero out m_workerThread, so that the proxy could be deleted once workerObjectDestroyed()
+        is called.
+
+2009-02-02  David Hyatt  <hyatt@apple.com>
+
+        Move positionForCoordinates up from RenderContainer into RenderBox.
+
+        Reviewed by Sam Weinig
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::positionForCoordinates):
+        * rendering/RenderBox.h:
+        * rendering/RenderContainer.cpp:
+        * rendering/RenderContainer.h:
+
+2009-02-02  Hiroaki Nakamura <hnakamur@gmail.com>
+
+        Reviewed by Adam Roben.
+
+        Fixes https://bugs.webkit.org/show_bug.cgi?id=15813
+        Modify pre-build step to properly handle the errorlevel
+        shell command.
+
+        * WebCore.vcproj/WebCore.vcproj: Change errorlevel handling
+        for all targets so prefast is only enabled in builds
+        where /analyze is available.
+
+2009-02-02  David Hyatt  <hyatt@apple.com>
+
+        Refactor the handling of before/after content and generated content.  Move most of the functions from
+        RenderContainer into RenderObjectChildList.
+
+        Reviewed by Sam Weinig
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateBeforeAfterContent):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::isAfterContent):
+        * rendering/RenderBox.h:
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::updateBeforeAfterContent):
+        * rendering/RenderContainer.cpp:
+        * rendering/RenderContainer.h:
+        * rendering/RenderCounter.cpp:
+        (WebCore::destroyCounterNodeChildren):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::styleDidChange):
+        (WebCore::RenderInline::addChildIgnoringContinuation):
+        (WebCore::RenderInline::splitInlines):
+        * rendering/RenderObject.h:
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::beforeAfterContainer):
+        (WebCore::findBeforeAfterParent):
+        (WebCore::invalidateCountersInContainer):
+        (WebCore::RenderObjectChildList::invalidateCounters):
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+        * rendering/RenderObjectChildList.h:
+
+2009-02-02  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23661
+        Fix Chromium build.
+
+        * history/HistoryItem.h: need to include <wtf/OwnPtr.h>
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::adjustMenuListStyle): isEnabled() is now on FormControlElement.
+
+2009-02-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::performRequest):
+
+2009-02-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Build fix.
+
+        * WebCore.base.exp:
+
+2009-02-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Track redirects in global history.
+
+        * WebCore.base.exp: Renamed some exports.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::createWindow):
+        (windowProtoFuncOpen):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::setLocation):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::submit):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::setHref):
+        (WebCore::JSLocation::setProtocol):
+        (WebCore::JSLocation::setHost):
+        (WebCore::JSLocation::setHostname):
+        (WebCore::JSLocation::setPort):
+        (WebCore::JSLocation::setPathname):
+        (WebCore::JSLocation::setSearch):
+        (WebCore::JSLocation::setHash):
+        (WebCore::JSLocation::assign): Treat any navigation that is not initiated
+        by the user as a redirect from the perspective of global history.
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::addRedirectURL): Store the last URL in the redirect
+        chain.
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::DocumentLoader):
+        * loader/DocumentLoader.h:
+        (WebCore::DocumentLoader::urlForHistoryReflectsServerRedirect):
+        (WebCore::DocumentLoader::urlForHistoryReflectsClientRedirect):
+        (WebCore::DocumentLoader::setURLForHistoryReflectsClientRedirect): Sadly,
+        added yet another way to track redirect state during loading, since none
+        of the others did what I wanted, and I didn't want to cause behavior
+        changes in existing code.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::updateGlobalHistoryForRedirectWithoutHistoryItem):
+        Stubbed out a client function to keep things building.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::isBackForwardLoadType):
+        (WebCore::FrameLoader::restoreDocumentState): Renamed FrameLoadTypeRedirect =>
+        FrameLoadTypeRedirectWithLockedBackForwardList, to distinguish from all
+        the other meanings of "redirect" in the loading code.
+
+        (WebCore::FrameLoader::scheduleHTTPRedirection): Treat any HTTP refresh
+        redirect as a redirect from the perspective of global history.
+
+        (WebCore::FrameLoader::loadURLIntoChildFrame): Updated for rename and extra
+        parameter.
+
+        (WebCore::FrameLoader::startRedirectionTimer): Removed unused parameter.
+
+        (WebCore::FrameLoader::loadFrameRequestWithFormAndValues):
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::load): Updated for rename and extra parameter.
+
+        (WebCore::FrameLoader::loadWithNavigationAction): Track redirect status
+        in the DocumentLoader, so it's accessible to WebKit's global history code.
+
+        (WebCore::FrameLoader::clientRedirected): Ignore lockHistory, since it
+        only has meaning to global history, and m_quickRedirectComing pertains
+        to other kinds of history.
+
+        (WebCore::FrameLoader::loadPostRequest):
+        (WebCore::FrameLoader::loadEmptyDocumentSynchronously):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::FrameLoader::continueLoadAfterNewWindowPolicy):
+        (WebCore::FrameLoader::loadItem): Updated for extra parameter and rename.
+
+        (WebCore::FrameLoader::updateHistory*): Notify WebKit about redirect
+        navigations even if they don't create new history items, so we can track
+        the redirect in the existing history item.
+
+        * loader/FrameLoader.h: See above.
+
+        * loader/FrameLoaderClient.h: New client interface used by
+        FrameLoader::updateHistory* to record a redirect even if it doesn't create
+        a new history item of its own.
+
+        * loader/FrameLoaderTypes.h: See above.
+        (WebCore::):
+
+        * page/DragController.cpp:
+        (WebCore::DragController::performDrag):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::dataChanged): Updated for extra parameter.
+
+2009-02-02  David Hyatt  <hyatt@apple.com>
+
+        Make calcPrefWidths non-abstract on RenderBox and just give it RenderContainer's implementation.
+        Remove RenderSVGContainer's implementation, since it was never called.
+
+        Reviewed by Beth Dakin
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::minPrefWidth):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::calcPrefWidths):
+        * rendering/RenderContainer.h:
+        (WebCore::RenderContainer::moveChildNode):
+        * rendering/RenderSVGContainer.h:
+
+2009-02-02  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add jsObjectForPluginElement to ScriptController, and have createScriptObjectForPluginElement call it.
+
+        * WebCore.LP64.exp:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
+        (WebCore::ScriptController::jsObjectForPluginElement):
+        * bindings/js/ScriptController.h:
+
+2009-02-02  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel (and Ojan Vafai).
+
+        https://bugs.webkit.org/show_bug.cgi?id=23696
+        Select element doesn't show new value when focus is switched in
+        onchange event.
+
+        Fix PopupMenuChromium to hide itself before calling valueChanged.  This
+        better matches the behavior of the other ports.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::create):
+        (WebCore::PopupContainer::PopupContainer):
+        (WebCore::PopupContainer::showPopup):
+        (WebCore::PopupContainer::hidePopup):
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::acceptIndex):
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::hide):
+
+2009-02-02  David Hyatt  <hyatt@apple.com>
+
+        Make sure scrollWidth/Height just return 0 for inline flows.
+
+        Reviewed by Beth Dakin
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+
+2009-02-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Bug 23676: Speed up uses of reserveCapacity on new vectors by adding a new reserveInitialCapacity
+        https://bugs.webkit.org/show_bug.cgi?id=23676
+
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::cssPropertyName):
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::CSSMutableStyleDeclaration):
+        (WebCore::CSSMutableStyleDeclaration::removePropertiesInSet):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::cssText):
+        * css/CSSStyleDeclaration.cpp:
+        (WebCore::CSSStyleDeclaration::copyPropertiesInSet):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::sortMatchedRules):
+        * dom/Document.cpp:
+        (WebCore::Document::formElementsState):
+        * dom/NamedAttrMap.h:
+        (WebCore::NamedAttrMap::reserveInitialCapacity):
+        * editing/TextIterator.cpp:
+        (WebCore::CharacterIterator::string):
+        (WebCore::SearchBuffer::SearchBuffer):
+        (WebCore::plainTextToMallocAllocatedBuffer):
+        * editing/markup.cpp:
+        (WebCore::joinMarkups):
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::Token::addAttribute):
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::items):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::toString):
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (convertToVector):
+        * platform/graphics/FontCache.cpp:
+        (WebCore::FontCache::purgeInactiveFontData):
+        (WebCore::FontCache::invalidate):
+        * platform/network/FormData.cpp:
+        (WebCore::FormData::deepCopy):
+        * platform/network/HTTPHeaderMap.cpp:
+        (WebCore::HTTPHeaderMap::copyData):
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::copyData):
+        * platform/network/mac/FormDataStreamMac.mm:
+        (WebCore::formCreate):
+        * xml/XPathNodeSet.cpp:
+        (WebCore::XPath::NodeSet::sort):
+        Use reserveInitialCapacity instead of of reserveCapacity in all these call sites,
+        which are working on new vectors that are guaranteed not to be empty.
+
+2009-02-26  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Build fix after r40486.
+
+        Rubber-stamped by Ada Chan.
+
+        * dom/Document.h: Changed HitTestRequest to a class from a struct.
+        * page/EventHandler.h: Ditto.
+        * rendering/EllipsisBox.h: Ditto.
+        * rendering/InlineBox.h: Ditto.
+        * rendering/InlineFlowBox.h: Ditto.
+        * rendering/RenderLayer.h: Ditto.
+
+2009-02-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Bug 23694: REGRESSION: Running svg/custom tests crashes, randomly, depending on the order of tests
+        https://bugs.webkit.org/show_bug.cgi?id=23694
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertedIntoDocument): Added back the call through to EventTargetNode.
+        (WebCore::ContainerNode::removedFromDocument): Ditto.
+        * dom/EventTargetNode.cpp:
+        (WebCore::EventTargetNode::insertedIntoDocument): Changed this to not call through to Node.
+        (WebCore::EventTargetNode::removedFromDocument): Ditto.
+        * dom/Node.cpp:
+        (WebCore::Node::insertedIntoDocument): Updated comment.
+        (WebCore::Node::removedFromDocument): Ditto.
+
+2009-02-02  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        More plug-in cleanup.
+
+        * WebCore.NPAPI.exp:
+        Add new symbols.
+
+        * bindings/objc/DOM.mm:
+        * bindings/objc/DOMPrivate.h:
+        Remove methods that WebKit doesn't use anymore.
+
+2009-02-02  Jay Campan  <jcampan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Clean up PopupMenuChromium a little.
+        https://bugs.webkit.org/show_bug.cgi?id=23653
+
+        No functional changes, only code cleanup, thus no tests.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::):
+        (WebCore::PopupListBox::PopupListBox):
+        (WebCore::PopupContainer::create):
+        (WebCore::PopupContainer::PopupContainer):
+        (WebCore::PopupContainer::showPopup):
+        (WebCore::PopupListBox::handleKeyEvent):
+        (WebCore::PopupListBox::isSelectableItem):
+        (WebCore::PopupListBox::selectNextRow):
+        (WebCore::PopupListBox::selectPreviousRow):
+        (WebCore::PopupMenu::show):
+        * platform/chromium/PopupMenuChromium.h:
+
+2009-02-02  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Change createPlugin to take a HTMLPlugInElement, and createJavaAppletWidget to take a HTMLAppletElement.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::createPlugin):
+        (WebCore::EmptyFrameLoaderClient::createJavaAppletWidget):
+        * loader/FrameLoader.cpp:
+        (WebCore::toPlugInElement):
+        (WebCore::FrameLoader::loadPlugin):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoader.h:
+        * loader/FrameLoaderClient.h:
+
+2009-02-02  Genevieve Mak  <gen@staikos.net>
+
+        Reviewed by George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23508
+        Returns Blank Page for all "about" protocols
+
+        * loader/MainResourceLoader.cpp:
+        Fix shouldLoadAsEmptyDocument() to return a blank page for an empty
+        url or about:blank only (for now, exclusively for Torch Mobile platform).
+
+2009-02-02  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by George Staikos.
+
+        Fixes https://bugs.webkit.org/show_bug.cgi?id=23691.
+        Correct build break caused by @r40366 by moving the
+        common code implmentations from GraphicsContextCGWin.cpp
+        into the base Windows class (GraphicsContextWin.cpp).  Also
+        move inTransparencyLayer since it is identical in both
+        children.
+
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+          Added member m_shouldIncludeChildWindows to Windows version,
+          similar to GraphicsContextPlatformPrivateCG.h.
+        * platform/graphics/win/GraphicsContextCGWin.cpp: Remove the
+          implementations of shouldIncludeChildWindows,
+          setShouldIncludeChildWindows, and inTransparencyLayer.
+        * platform/graphics/win/GraphicsContextCairoWin.cpp: Remove
+          the implementation of inTransparencyLayer.
+        * platform/graphics/win/GraphicsContextWin.cpp: Move common code
+          from GraphicsContextCGWin.cpp and GraphicsContextCairoWin.cpp.
+        (WebCore::GraphicsContext::inTransparencyLayer):
+        (WebCore::GraphicsContext::setShouldIncludeChildWindows):
+        (WebCore::GraphicsContext::shouldIncludeChildWindows):
+
+2009-02-02  Darin Adler  <darin@apple.com>
+
+        Try to fix Wx build, and maybe Chromium build too.
+
+        * WebCore.scons: Added IdentifierRep.cpp.
+        * WebCoreSources.bkl: Ditto.
+
+2009-02-02  Darin Adler  <darin@apple.com>
+
+        Try to fix Wx build.
+
+        * html/HTMLAreaElement.cpp: Added missing include of "Path.h".
+
+2009-02-02  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23587
+        Refactor HitTestRequest to eliminate all the ugly boolean arguments and
+        use an enum bitflag instead.  Cleanup all the code that constructs the
+        various HitTestRequests to make the code more readable.
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint):
+        (WebCore::Document::prepareMouseEvent):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::contains):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::visiblePositionForPoint):
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::eventMayStartDrag):
+        (WebCore::EventHandler::updateSelectionForMouseDrag):
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseDoubleClickEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+        (WebCore::EventHandler::updateDragAndDrop):
+        (WebCore::EventHandler::handleWheelEvent):
+        (WebCore::EventHandler::sendContextMenuEvent):
+        (WebCore::EventHandler::hoverTimerFired):
+        (WebCore::EventHandler::handleDrag):
+        * page/EventHandler.h:
+        * rendering/HitTestRequest.h:
+        (WebCore::HitTestRequest::):
+        (WebCore::HitTestRequest::HitTestRequest):
+        (WebCore::HitTestRequest::readOnly):
+        (WebCore::HitTestRequest::active):
+        (WebCore::HitTestRequest::mouseMove):
+        (WebCore::HitTestRequest::mouseUp):
+        (WebCore::HitTestRequest::ignoreClipping):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::nodeAtPoint):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTest):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::updateHoverActiveState):
+
+2009-02-02  George Staikos  <george.staikos@torchmobile.com>
+
+        Reviewed by Niko Zimmermann.
+
+        Fix WML build by including the inlined renderStyle().
+
+        * wml/WMLOptGroupElement.cpp:
+        * wml/WMLOptionElement.cpp:
+
+2009-02-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Niko Zimmermann.
+
+        Bug 23686: REGRESSION (r40475): Failure in fast/xpath/4XPath/Core/test_core_functions.html
+        https://bugs.webkit.org/show_bug.cgi?id=23686
+        rdar://problem/6547971
+
+        Also fix other XPath tests that are crashing.
+
+        * xml/XPathFunctions.cpp:
+        (WebCore::XPath::FunLang::evaluate): Fix order of arguments when creating QualifiedName.
+        * xml/XPathStep.cpp:
+        (WebCore::XPath::Step::nodesInAxis): Use createAttrIfNeeded() rather than attr() since we
+        need to make Attr nodes here. Yuck!
+
+2009-02-02  Yichao Yin  <yichao.yin@torchmobile.com.cn>
+
+        Reviewed by Niko Zimmermann.
+
+        Test: wml/input-format.html
+
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::WMLInputElement):
+        (WebCore::formatCodes):
+        (WebCore::WMLInputElement::dispatchBlurEvent):
+        (WebCore::WMLInputElement::parseMappedAttribute):
+        (WebCore::WMLInputElement::attach):
+        (WebCore::WMLInputElement::defaultEventHandler):
+        (WebCore::WMLInputElement::init):
+        (WebCore::WMLInputElement::validateInputMask):
+        (WebCore::WMLInputElement::isConformedToInputMask):
+        (WebCore::WMLInputElement::cursorPositionToMaskIndex):
+        * wml/WMLInputElement.h:
+
+2009-02-02  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix only, no review.
+
+        Fixes https://bugs.webkit.org/show_bug.cgi?id=23685.
+        Correct build break caused by @r40473.
+
+        * page/win/FrameWin.cpp: Correct access for adjustPageHeight.
+        (WebCore::computePageRectsForFrame):
+
+2009-02-02  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Fix WML enabled builds.
+        FrameLoader::urlSelected() got a new parameter: lockBackForwardList. Pass 'false', as HTMLAnchorElement does.
+
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::defaultEventHandler):
+
+2009-02-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6451610> Reloading a AppCache page doesn't ever hit the server
+
+        Not easily testable.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::createResourceHandle): A new method that creates a resource
+        handle in a manner that is closer to what CachedResource does. We now make conditional
+        requests for better performance, and set max-age to ensure that stale responses are not used.
+        (WebCore::ApplicationCacheGroup::update): Use the new createResourceHandle() method.
+        (WebCore::ApplicationCacheGroup::didReceiveResponse): If the response code for the resource
+        is 304, take it from the newest cache.
+        (WebCore::ApplicationCacheGroup::didFail): Pre-compute request URL.
+        (WebCore::ApplicationCacheGroup::didReceiveManifestResponse): Don't create a resource for
+        the manifest if the response code was 304 - it won't be needed.
+        (WebCore::ApplicationCacheGroup::didReceiveManifestData): Replaced an assertion that
+        m_manifestResource is not null with a check.
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest): Treat null m_manifestResource as
+        an indication that the response was 304.
+        (WebCore::ApplicationCacheGroup::startLoadingEntry): Use createResourceHandle().
+
+        * loader/appcache/ApplicationCacheGroup.h: Added createResourceHandle().
+
+2009-02-01  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Bug 23674: Speed up some things based on profiling the page load test
+        https://bugs.webkit.org/show_bug.cgi?id=23674
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement): Use the newly named cssTarget instead
+        of the old name, getCSSTarget.
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): Ditto.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertedIntoDocument): Moved code from Node in here rather than
+        calling through to EventTargetNode::insertedIntoDocument.
+        (WebCore::ContainerNode::removedFromDocument): Ditto.
+        (WebCore::ContainerNode::insertedIntoTree): Tweaked a bit.
+        (WebCore::ContainerNode::removedFromTree): Ditto.
+
+        * dom/ContainerNode.h: Moved the constructor definition here and made it inline.
+
+        * dom/Document.cpp:
+        (WebCore::Document::removeAllEventListenersFromAllNodes): Iterate the document element and
+        its contents only to avoid the document type node. This allows us to remove the virtual
+        function call to isEventTargetNode from the loop.
+        (WebCore::Document::setCSSTarget): Changed argument to be an Element rather than Node.
+
+        * dom/Document.h: Changed CSS target to be an Element rather than a Node. Renamed
+        getCSSTarget to cssTarget.
+
+        * dom/EventTargetNode.cpp:
+        (WebCore::EventTargetNode::removeAllEventListenersSlowCase): Renamed and turned the
+        rare data check into an assertion.
+
+        * dom/EventTargetNode.h: Made the fast case of removeAllEventListeners be inline.
+        Also moved the constructor definition here and made it inline. And added toEventTargetNode,
+        matching the design of the render tree checked casts. Later we can migrate all callers
+        from EventTargetNodeCast to toEventTargetNode.
+
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedAttrMap::detachAttributesFromElement): Added. Factored out from
+        clearAttributes, so we could use this loop in cases where we're not clearing the attributes.
+        (WebCore::NamedAttrMap::~NamedAttrMap): Call detachAttributesFromElement instead of
+        clearAttributes here.
+        (WebCore::NamedAttrMap::clearAttributes): Call detachAttributesFromElement here.
+        (WebCore::NamedAttrMap::detachFromElement): Call detachAttributesFromElement instead of
+        clearAttributes. We don't need to clear the attributes array just because the element is
+        going away, so don't.
+        (WebCore::NamedAttrMap::virtualLength): Added.
+
+        * dom/NamedAttrMap.h: Made all the virtual functions inherited from NamedNodeMap be private.
+        These are all unnecessarily inefficient for use outside the DOM. Changed length to be a
+        non-virtual function. This was a fairly hot function.
+
+        * dom/NamedMappedAttrMap.cpp:
+        (WebCore::NamedMappedAttrMap::setClass): Changed to use element() function now that the
+        m_element data member is private.
+
+        * dom/NamedMappedAttrMap.h: Made a few functions private. Made the
+        hasMappedAttributes function non-virtual.
+
+        * dom/NamedNodeMap.h: Made length a non-virtual inline function that calls a virtual
+        function, name virtualLength. This lets NamedAttrMap::length be a non-virtual function.
+
+        * dom/Node.cpp:
+        (WebCore::Node::insertedIntoDocument): Removed call to insertedIntoTree, since it's
+        only non-empty in subclasses of ContainerNode.
+        (WebCore::Node::removedFromDocument): Ditto. Also removed setCSSTarget. Since a CSS
+        target has to be an Element, this can be moved down to ContainerNode (or it could be
+        moved down to Element for that matter).
+
+        * dom/QualifiedName.cpp:
+        (WebCore::QualifiedName::QualifiedName): Removed double initialization of m_impl.
+
+        * dom/QualifiedName.h: Moved the destructor, copy constructor, assignment operator, and
+        setPrefix function definitions into the header and made them inline.
+
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::mapMouseEvent): Updated since the stored region is now
+        an OwnPtr.
+        (WebCore::HTMLAreaElement::accessKey): Use AtomicString.
+        (WebCore::HTMLAreaElement::setAccessKey): Ditto.
+        (WebCore::HTMLAreaElement::alt): Ditto.
+        (WebCore::HTMLAreaElement::setAlt): Ditto.
+        (WebCore::HTMLAreaElement::coords): Ditto.
+        (WebCore::HTMLAreaElement::setCoords): Ditto.
+        (WebCore::HTMLAreaElement::setHref): Ditto.
+        (WebCore::HTMLAreaElement::shape): Ditto.
+        (WebCore::HTMLAreaElement::setShape): Ditto.
+        (WebCore::HTMLAreaElement::setTarget): Ditto.
+
+        * html/HTMLAreaElement.h: Use AtomicString in the getter and setter DOM operations.
+        Change the region data member to be an OwnPtr<Path> instead of a Path to optimize
+        the common case where an area element is parsed but never hit-tested. This could
+        also have been done by changing the Path class's null case to be more efficient,
+        but this seems fine.
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::createContainingTable): Use addAttribute instead
+        of insertAttribute.
+        (WebCore::HTMLViewSourceDocument::addSpanWithClassName): Ditto.
+        (WebCore::HTMLViewSourceDocument::addLine): Ditto.
+        (WebCore::HTMLViewSourceDocument::addLink): Ditto.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::gotoAnchor): Use cssTarget under its new name instead
+        of its old name getCSSTarget.
+
+        * platform/graphics/GlyphWidthMap.cpp:
+        (WebCore::GlyphWidthMap::locatePageSlowCase): Refactored from locatePage.
+
+        * platform/graphics/GlyphWidthMap.h: Made most of this class inline.
+        Changed m_pages to use OwnPtr.
+
+        * platform/text/PlatformString.h: Remove include no longer needed since
+        StringImpl.h includes it.
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::createStrippingNullCharactersSlowCase): Refactored
+        from createStrippingNullCharacters.
+        * platform/text/StringImpl.h: Moved the definition of
+        createStrippingNullCharacters here and made it inline.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::firstLineStyleSlowCase): Refactored from
+        firstLineStyle.
+
+        * rendering/RenderObject.h: Moved the definition of the firstLineStyle
+        function here and made it inline. Moved the definition of the
+        documentBeingDestroyed function here and made it inline.
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::getCTM): Use getAttributeItem instead of
+        getNamedItem here since it accomplishes the same thing but is more efficient.
+        (WebCore::SVGSVGElement::getScreenCTM): Ditto.
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::getPresentationAttribute): Ditto.
+
+        * xml/XPathFunctions.cpp:
+        (WebCore::XPath::FunLang::evaluate): Use getAttributeItem instead of
+        getNamedItemNS.
+
+        * xml/XPathStep.cpp:
+        (WebCore::XPath::Step::nodesInAxis): Use attributeItem instead of item here.
+
+2009-02-02  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        Move Frame::forceLayout, Frame::adjustPageHeight and Frame::forceLayoutWithPageWidthRange to FrameView
+
+        https://bugs.webkit.org/show_bug.cgi?id=23428
+
+        FrameView::forceLayout could be killed but the comment might
+        contain a value over the the plain FrameView::layout...
+
+        Adjust the WebCore/WebKit consumers of these methods.
+
+        * WebCore.base.exp:
+        * page/Frame.cpp:
+        (WebCore::Frame::setPrinting):
+        * page/Frame.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::forceLayout):
+        (WebCore::FrameView::forceLayoutWithPageWidthRange):
+        (WebCore::FrameView::adjustPageHeight):
+        * page/FrameView.h:
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::computePageRects):
+
+2009-02-01  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - fix <rdar://problem/6546625> REGRESSION (r40432): iframes added to global history at haaretz.co.il
+
+        Fixes http/tests/navigation/multiple-back-forward-entries.html
+
+        r40432 added a parameter to FrameLoader::scheduleLocationChange() and
+        failed to update all call sites.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::createWindow): Pass the lockBackForwardHistory parameter,
+        giving it the same value as the lockHistory parameter.
+        (windowProtoFuncOpen): Ditto.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation): Ditto.
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::setLocation): Ditto.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::requestFrame): Ditto.
+
+2009-01-31  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - fix <rdar://problem/6546549> Eliminate some RenderText::width() overhead from findNextLineBreak()
+
+        On the PLT, this results in 0.36x the number of virtual function calls
+        to RenderText::width() and 0.69x the number of calls to
+        Font::isFixedPitch(), but makes 1.0004x the number of calls to
+        Font::width().
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::width): Replaced bounds checks on 'from' and 'len'
+        with an assertion.
+        * rendering/bidi.cpp:
+        (WebCore::textWidth): Added this inlined helper function which calls
+        Font::width() directly in the non-fixed-pitch, non-full-range case, and
+        otherwise calls RenderText::width().
+        (WebCore::RenderBlock::findNextLineBreak): Cache whether the font has
+        fixed pitch (in which case RenderText::width() will be called in order
+        to take advantage of the widthFromCache() optimization for fixed-pitch
+        fonts). Replaced all calls to RenderText::width() with calls to the
+        textWidth() helper function.
+
+2009-01-31  David Hyatt  <hyatt@apple.com>
+
+        Inline all of the setNeedsLayout method and its associated functions.  Also inline setChildNeedsLayout
+        and setNeedsPositionedMovementLayout.
+
+        Reviewed by Dan Bernstein
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::setLayerNeedsFullRepaint):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::setNeedsLayout):
+        (WebCore::RenderObject::setChildNeedsLayout):
+        (WebCore::RenderObject::setNeedsPositionedMovementLayout):
+        (WebCore::objectIsRelayoutBoundary):
+        (WebCore::RenderObject::markContainingBlocksForLayout):
+
+2009-01-31  Darin Adler  <darin@apple.com>
+
+        Fix Mac build.
+
+        * loader/FrameLoader.cpp: Moved FrameLoaderClient::hasHTMLView in here.
+        We need it to not be an inline. Sadly, FrameLoaderClient.cpp was prematurely
+        deleted and I don't want to bring it back just to fix the build.
+
+        * loader/FrameLoaderClient.h: Rearrange virtual functions and corrected
+        a possibly-confusing comment.
+
+2009-01-31  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23664
+        Remove unused dead code from RenderTable class.  The dead code includes
+        two enums and the associated member variables as well as one getter function.
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::RenderTable):
+        * rendering/RenderTable.h:
+
+2009-01-31  David Hyatt  <hyatt@apple.com>
+
+        More removal of code from RenderContainer.  Move removeLeftoverAnonymousBlock down into RenderBlock.
+        Move destroyLeftoverChildren into the RenderObjectChildList.  Convert all containers to use the
+        RenderObjectChildList.
+
+        Reviewed by Sam Weinig
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::destroy):
+        (WebCore::RenderBlock::addChild):
+        (WebCore::RenderBlock::removeLeftoverAnonymousBlock):
+        (WebCore::RenderBlock::layoutPositionedObjects):
+        (WebCore::RenderBlock::childBecameNonInline):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::layout):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::firstChildBox):
+        (WebCore::RenderBox::lastChildBox):
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::addChild):
+        (WebCore::RenderContainer::removeChildNode):
+        (WebCore::RenderContainer::updateBeforeAfterContentForContainer):
+        (WebCore::RenderContainer::appendChildNode):
+        (WebCore::RenderContainer::insertChildNode):
+        (WebCore::RenderContainer::positionForCoordinates):
+        (WebCore::RenderContainer::addLineBoxRects):
+        (WebCore::RenderContainer::collectAbsoluteLineBoxQuads):
+        * rendering/RenderContainer.h:
+        (WebCore::RenderContainer::virtualChildren):
+        (WebCore::RenderContainer::children):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::destroy):
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::layout):
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::destroy):
+        (WebCore::RenderMedia::children):
+        * rendering/RenderMedia.h:
+        (WebCore::RenderMedia::virtualChildren):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        (WebCore::RenderObject::layout):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::firstChild):
+        (WebCore::RenderObject::lastChild):
+        (WebCore::RenderObject::virtualChildren):
+        (WebCore::RenderObject::canHaveChildren):
+        * rendering/RenderObjectChildList.cpp: Added.
+        (WebCore::RenderObjectChildList::destroyLeftoverChildren):
+        * rendering/RenderObjectChildList.h:
+        * rendering/RenderReplaced.h:
+        (WebCore::RenderReplaced::canHaveChildren):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::RenderSVGContainer):
+        (WebCore::RenderSVGContainer::destroy):
+        (WebCore::RenderSVGContainer::removeChildNode):
+        (WebCore::RenderSVGContainer::appendChildNode):
+        (WebCore::RenderSVGContainer::insertChildNode):
+        * rendering/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::virtualChildren):
+        (WebCore::RenderSVGContainer::children):
+
+2009-01-31  David Hyatt  <hyatt@apple.com>
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=11363
+
+        Remove the hacks in table code around the DeleteButtonController and fix tables so that positioned children don't get wrapped in anonymous objects.
+        With the removal of a non-positioned DeleteButtonController renderer, table layout can be tightened up to only lay out table sections.  Table section
+        layout is tightened up to ignore non-table rows.  When a table has multiple captions, only the real one will do a layout now.  The other ones will
+        be properly ignored.
+
+        Reviewed by Oliver Hunt
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::createDeletionUI):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::addChild):
+        (WebCore::RenderTable::layout):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layout):
+        * rendering/RenderTableSection.h:
+
+2009-01-31  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23663
+        Add a void toRenderBox() method which catches unnecessary casts at compile
+        time and also fix the four cases where this was happening.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::determineHorizontalPosition):
+        * rendering/RenderBox.h:
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::updateHitTestResult):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+
+2009-01-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Add a pref to disable web security.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::SecurityOrigin):
+        (WebCore::SecurityOrigin::canAccess):
+        (WebCore::SecurityOrigin::canRequest):
+        (WebCore::SecurityOrigin::grantUniversalAccess):
+        * page/SecurityOrigin.h:
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setWebSecurityEnabled):
+        * page/Settings.h:
+        (WebCore::Settings::isWebSecurityEnabled):
+
+2009-01-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Build fix.
+
+        Move the inline virtual destructor after a non-inline virtual
+        function so that the symbol for the vtable is not marked as a
+        weakly exported symbol.
+
+        This trick was previously used at revision 36122 in JSObject.h
+
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::~FrameLoaderClient):
+
+2009-01-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Stephanie Lewis
+
+        Inline SimpleFontData::widthForGlyph for a minor page load improvement.
+
+        * platform/graphics/SimpleFontData.cpp:
+        * platform/graphics/SimpleFontData.h:
+        (WebCore::SimpleFontData::widthForGlyph):
+
+2009-01-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Build fix for WX and maybe even Windows.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+
+2009-01-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        Move Frame::sendResizeEvent and Frame::sendScrollEvent to EventHandler
+
+        Carry out the move and catch up in two call sites.
+
+        * WebCore.base.exp:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::sendResizeEvent):
+        (WebCore::EventHandler::sendScrollEvent):
+        * page/EventHandler.h:
+        * page/Frame.cpp:
+        * page/Frame.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::performPostLayoutTasks):
+        (WebCore::FrameView::valueChanged):
+
+2009-01-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        Move Frame::isFrameSet to Document::isFrameSet
+
+        Changed the FrameLoader callsite. I assume that as this
+        point m_frame.document() might return a null pointer. Change
+        the condition to either not having a document or not having a
+        frame set. This should be semantically equivalent to the
+        old code.
+
+        Make Document::body() const to be able to call it from within
+        Document::isFrameSet. Leave the isHTMLDocument() check as this
+        is a stronger condition than simply having a HTMLElement in the
+        DOM.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::isFrameSet):
+        (WebCore::Document::body):
+        * dom/Document.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::shouldScrollToAnchor):
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::createFromSelection):
+        * page/Frame.cpp:
+        * page/Frame.h:
+
+2009-01-30  Aurelian Maga  <aurelianmaga@yahoo.com>
+
+        Reviewed by Holger Freyther.
+
+        [GTK] Logic fixes and build fixes
+
+        https://bugs.webkit.org/show_bug.cgi?id=22022
+
+        Catch up with the internal GeoLocation API and fix the logic of
+        the previous version.
+
+        * platform/gtk/GeolocationServiceGtk.cpp:
+        (WebCore::GeolocationServiceGtk::startUpdating):
+        (WebCore::GeolocationServiceGtk::updateLocationInformation):
+        (WebCore::GeolocationServiceGtk::position_changed):
+
+2009-01-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        [GTK] Implement GeolocationService using the Geoclue library
+
+        https://bugs.webkit.org/show_bug.cgi?id=22022
+
+        Untested implementation of the GeolocationService using the geoclue
+        library. Velocity handling is completely missing and the accuracy
+        handling might be wrong.
+
+        * platform/gtk/GeolocationServiceGtk.cpp:
+        (WTF::GeoclueAccuracy):
+        (WebCore::GeolocationServiceGtk::GeolocationServiceGtk):
+        (WebCore::GeolocationServiceGtk::~GeolocationServiceGtk):
+        (WebCore::GeolocationServiceGtk::startUpdating):
+        (WebCore::GeolocationServiceGtk::stopUpdating):
+        (WebCore::GeolocationServiceGtk::suspend):
+        (WebCore::GeolocationServiceGtk::resume):
+        (WebCore::GeolocationServiceGtk::lastPosition):
+        (WebCore::GeolocationServiceGtk::lastError):
+        (WebCore::GeolocationServiceGtk::updateLocationInformation):
+        (WebCore::GeolocationServiceGtk::updatePosition):
+        (WebCore::GeolocationServiceGtk::position_changed):
+        (WebCore::GeolocationServiceGtk::setError):
+        * platform/gtk/GeolocationServiceGtk.h:
+
+2009-01-30  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.  Declare preferredSize as static.
+
+        * platform/text/cf/StringImplCF.cpp:
+        (WebCore::StringWrapperCFAllocator::preferredSize):
+
+2009-01-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 23622: create CFString and NSString objects from WebCore::String without copying the characters
+        https://bugs.webkit.org/show_bug.cgi?id=23622
+
+        * platform/text/cf/StringImplCF.cpp:
+        (WebCore::StringWrapperCFAllocator::allocator): Added. Returns the allocator.
+        (WebCore::StringWrapperCFAllocator::retain): Added. Callback for allocator.
+        (WebCore::StringWrapperCFAllocator::release): Ditto.
+        (WebCore::StringWrapperCFAllocator::copyDescription): Ditto.
+        (WebCore::StringWrapperCFAllocator::allocate): Ditto.
+        (WebCore::StringWrapperCFAllocator::reallocate): Ditto.
+        (WebCore::StringWrapperCFAllocator::deallocate): Ditto.
+        (WebCore::StringWrapperCFAllocator::preferredSize): Ditto.
+        (WebCore::StringWrapperCFAllocator::create): Added. Creates the allocator, but
+        returns 0 if garbage collection is enabled.
+        (WebCore::StringImpl::createCFString): Use StringWrapperCFAllocator if possible.
+
+        * platform/text/mac/StringImplMac.mm:
+        (WebCore::StringImpl::operator NSString *): Use CFString and toll-free bridging,
+        rather than using NSString directly. This lets NSString benefit from the above.
+
+2009-01-30  Darin Adler  <darin@apple.com>
+
+        * page/Frame.cpp:
+        (WebCore::Frame::createView): Fix debug build by removing get() from assert.
+
+2009-01-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22056
+
+        Kill FrameLoaderClient.cpp, move the code over to Frame::createView
+
+        FrameLoaderClient is supposed to be an interface, move the
+        to be shared code to Frame which is a controller and is
+        allowed to create a FrameView.
+
+        * GNUmakefile.am:
+        * WebCore.base.exp:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/FrameLoaderClient.cpp: Removed.
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::~FrameLoaderClient):
+        * page/Frame.cpp:
+        (WebCore::Frame::createView):
+        * page/Frame.h:
+
+2009-01-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23357
+
+        New files to support accelerated compositing at the RenderLayer
+        level.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        New files added to project, and run through the sort script.
+
+        * rendering/RenderLayerBacking.cpp: Added.
+        * rendering/RenderLayerBacking.h: Added.
+        New object to store compositing-related data for a single
+        RenderLayer.
+
+        * rendering/RenderLayerCompositor.cpp: Added.
+        * rendering/RenderLayerCompositor.h: Added.
+        Per-RenderView controller object for compositing hierarchy
+        maintenance.
+
+2009-01-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23356
+
+        Add new files related to accelerated compositing:
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Add the files to the project. Also add ColorCG.cpp, for the
+        Color(CGColorRef) constructor.
+
+        * platform/graphics/GraphicsLayer.cpp: Added.
+        * platform/graphics/GraphicsLayer.h: Added.
+        GraphicsLayer is a platform abstraction for a hardware-backed
+        layer.
+
+        * platform/graphics/GraphicsLayerClient.h: Added.
+        Client of GraphicsLayer, allowing GraphicsLayer to call out
+        to WebCore code.
+
+        * platform/graphics/mac/GraphicsLayerCA.h: Added.
+        * platform/graphics/mac/GraphicsLayerCA.mm: Added.
+        Mac Core Animation implementation of GraphicsLayer.
+
+        * platform/graphics/mac/WebLayer.h: Added.
+        * platform/graphics/mac/WebLayer.mm: Added.
+        * platform/graphics/mac/WebTiledLayer.h: Added.
+        * platform/graphics/mac/WebTiledLayer.mm: Added.
+        Subclasses of CALayer and CATiledLayer -- helpers for the
+        GraphicsLayerCA implementation.
+
+2009-01-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Split "lockHistory" into "lockHistory" and "lockBackForwardList" in
+        preparation for setting them differently during a redirect.
+
+        * WebCore.base.exp:
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::submit):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::navigateIfAllowed):
+        (WebCore::JSLocation::setHref):
+        (WebCore::JSLocation::setProtocol):
+        (WebCore::JSLocation::setHost):
+        (WebCore::JSLocation::setHostname):
+        (WebCore::JSLocation::setPort):
+        (WebCore::JSLocation::setPathname):
+        (WebCore::JSLocation::setSearch):
+        (WebCore::JSLocation::setHash):
+        (WebCore::JSLocation::replace):
+        (WebCore::JSLocation::assign):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::defaultEventHandler):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::submit):
+        * html/HTMLFormElement.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FormSubmission::FormSubmission):
+        (WebCore::ScheduledRedirection::ScheduledRedirection):
+        (WebCore::isBackForwardLoadType):
+        (WebCore::FrameLoader::createWindow):
+        (WebCore::FrameLoader::changeLocation):
+        (WebCore::FrameLoader::urlSelected):
+        (WebCore::FrameLoader::submitFormAgain):
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::restoreDocumentState):
+        (WebCore::FrameLoader::scheduleHTTPRedirection):
+        (WebCore::FrameLoader::scheduleLocationChange):
+        (WebCore::FrameLoader::scheduleRefresh):
+        (WebCore::FrameLoader::redirectionTimerFired):
+        (WebCore::FrameLoader::loadURLIntoChildFrame):
+        (WebCore::FrameLoader::startRedirectionTimer):
+        (WebCore::FrameLoader::loadFrameRequestWithFormAndValues):
+        (WebCore::FrameLoader::transitionToCommitted):
+        (WebCore::FrameLoader::clientRedirected):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoader.h:
+        * loader/FrameLoaderTypes.h:
+        (WebCore::):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::contextMenuItemSelected):
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::defaultEventHandler):
+
+2009-01-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6545095>
+        ASSERTION FAILED: RenderBlock.h:519: !o || o->isRenderBlock()
+
+        Test: fast/block/float/crash-replaced-display-block.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlockChildren): Move RenderBlock only code into
+        isRenderBlock if-statement.
+
+2009-01-30  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 23656: AX hierarchy for iFrames is incorrect
+        https://bugs.webkit.org/show_bug.cgi?id=23656
+
+        The AX hierarchy when an iFrame was present was incorrect. A different scroll area was
+        returned when going down compared to when going up.
+
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (convertToNSArray):
+
+2009-01-30  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix Qt build to include new class IdentifierRep introduced in revision 40412.
+
+        * WebCore.pro:
+
+2009-01-30  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Make IdentifierRep.h a private header, and add symbols needed by WebKit to WebCore.LP64.exp.
+
+        * WebCore.LP64.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-01-30  Sam Weinig  <sam@webkit.org>
+
+        Commit files I forgot to in the previous commit.
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::layoutCount):
+        * page/Frame.cpp:
+        (WebCore::Frame::contentRenderer):
+        (WebCore::Frame::forceLayoutWithPageWidthRange):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::nodeAtPoint):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintUsingContainer):
+        (WebCore::RenderObject::repaint):
+        (WebCore::RenderObject::repaintRectangle):
+        (WebCore::RenderObject::view):
+        (WebCore::RenderObject::scheduleRelayout):
+        (WebCore::RenderObject::maximalOutlineSize):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::clampImageBufferSizeToViewport):
+        * svg/SVGLength.cpp:
+        (WebCore::SVGLength::PercentageOfViewport):
+
+2009-01-30  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        More scaffolding for redirect tracking. No behavior change yet.
+
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::submit): Added scaffolding necessary for
+        redirect checking in a form submission through JS. (Currently, we
+        just specify "no redirect.")
+
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        (WebCore::ScriptController::processingUserGestureEvent):
+        (WebCore::ScriptController::isJavaScriptAnchorNavigation): Refactored
+        user gesture check to make it more clear.
+
+        (WebCore::ScriptController::pageIsProcessingUserGesture): Added a helper
+        for checking if there's a user gesture in any frame on the page (a more
+        relaxed rule than our popup blocking rule, which requires the user
+        gesture to occur in the frame that's executing JavaScript.)
+
+        * html/HTMLFormElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::submit): Added scaffolding necessary for
+        redirect checking in a form submission through the DOM. (Currently, we
+        just specify "no redirect.")
+
+        * html/HTMLFormElement.idl: Made submit custom so it can participate
+        in redirect checking.
+
+        * loader/FrameLoader.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FormSubmission::FormSubmission): Clarified some names, and
+        added a "lockHistory" parameter to form submissions, to match other
+        navigations.
+
+        (WebCore::FrameLoader::submitFormAgain):
+        (WebCore::FrameLoader::submitForm): Use the lockHistory parameter.
+
+        (WebCore::FrameLoader::userGestureHint): Refactored this function for
+        clarity, and added a FIXME for a change I was too scared to make myself.
+        (Really, we should just get rid of this function.)
+
+        (WebCore::FrameLoader::loadFrameRequestWithFormAndValues): Refactored
+        to pass a FrameLoadType to form posts, too, so they can participate in
+        redirect tracking.
+
+        (WebCore::FrameLoader::loadPostRequest):
+        (WebCore::FrameLoader::continueFragmentScrollAfterNavigationPolicy):
+        (WebCore::FrameLoader::loadItem): Use the lockHistory parameter.
+
+2009-01-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Mark Rowe.
+
+        [Gtk+] Use AccessibilityObject::stringValue for the AtkObject name
+
+        https://bugs.webkit.org/show_bug.cgi?id=21546
+
+        The API documentation at http://library.gnome.org/devel/atk/stable/AtkText.html
+        states that: "AtkObjects whose text content is simple, unattributed, and very
+        brief may expose that content via atk_object_get_name instead"
+
+        As we are currently not able to always provide a AtkTextInterface
+        implementation this will make the whole content available to accerciser,
+        and other tools.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+
+2009-01-30  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix.
+
+        Include string.h for strdup.
+
+        * bridge/IdentifierRep.h:
+
+2009-01-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Add toRenderView methods for casting RenderObjects to RenderViews.  The methods will assert if the object
+        is not a RenderView.
+
+        * dom/Document.cpp:
+        (WebCore::Document::renderView):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::nodeWillBeRemoved):
+        (WebCore::SelectionController::recomputeCaretRect):
+        (WebCore::SelectionController::invalidateCaretRect):
+        (WebCore::SelectionController::focusedOrActiveStateChanged):
+        * editing/mac/SelectionControllerMac.mm:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::repaintLayerRectsForImage):
+        (WebCore::RenderBox::availableHeightUsing):
+        * rendering/RenderView.h:
+        (WebCore::toRenderView):
+
+2009-01-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23360
+
+        Really use the container-relative repaint rect methods
+        for repaint during layout
+
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::LayoutRepainter::LayoutRepainter):
+
+2009-01-30  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Get rid of PrivateIdentifier and use IdentifierRep instead.
+
+        * bridge/NP_jsobject.cpp:
+        (_NPN_Invoke):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::getPropertyNames):
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertNPStringToUTF16):
+        * bridge/c/c_utility.h:
+        * bridge/npruntime.cpp:
+        (_NPN_GetStringIdentifier):
+        (_NPN_GetStringIdentifiers):
+        (_NPN_GetIntIdentifier):
+        (_NPN_IdentifierIsString):
+        (_NPN_UTF8FromIdentifier):
+        (_NPN_IntFromIdentifier):
+
+2009-01-30  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig and Darin Adler.
+
+        Make IdentifierRep a real class, add necessary class methods.
+
+        * bridge/IdentifierRep.cpp:
+        (WebCore::identifierSet):
+        Returns a set of all identifiers.
+
+        (WebCore::IdentifierRep::isValid):
+        Return whether an identifier is valid, meaning that it's present in the
+        set of identifiers.
+
+        * bridge/IdentifierRep.h:
+        (WebCore::IdentifierRep::isString):
+        (WebCore::IdentifierRep::number):
+        (WebCore::IdentifierRep::string):
+        (WebCore::IdentifierRep::IdentifierRep):
+        (WebCore::IdentifierRep::):
+
+2009-01-30  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add IdentifierRep which will be used by both plug-in implementations.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bridge/IdentifierRep.cpp: Added.
+        (WebCore::IdentifierRep::IdentifierRep):
+        (WebCore::IdentifierRep::):
+        (WebCore::intIdentifierMap):
+        (WebCore::identifierRep):
+        (WebCore::stringIdentifierMap):
+        * bridge/IdentifierRep.h: Added.
+        * bridge/c/c_utility.h:
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::fromUTF8WithLatin1Fallback):
+
+2009-01-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Add toRenderInline methods for casting RenderObjects to RenderInlines.  The methods will assert if the object
+        is not a RenderInline.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::removeLineBoxFromRenderObject):
+        (WebCore::InlineFlowBox::extractLineBoxFromRenderObject):
+        (WebCore::InlineFlowBox::attachLineBoxToRenderObject):
+        (WebCore::InlineFlowBox::rendererLineBoxes):
+        (WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
+        (WebCore::InlineFlowBox::paint):
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::addFocusRingRects):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::offsetFromContainer):
+        (WebCore::RenderBox::computeRectForRepaint):
+        (WebCore::RenderBox::containingBlockWidthForPositioned):
+        (WebCore::RenderBox::containingBlockHeightForPositioned):
+        (WebCore::RenderBox::calcAbsoluteHorizontalValues):
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced):
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::updateBeforeAfterContentForContainer):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::inlineContinuation):
+        (WebCore::nextContinuation):
+        (WebCore::RenderInline::splitInlines):
+        * rendering/RenderInline.h:
+        (WebCore::toRenderInline):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::boundingBox):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
+        * rendering/RenderText.h:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::createLineBoxes):
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2009-01-30  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23647
+        Fix PLATFORM(SKIA)'s ImageSource::clear method to match other ports
+
+        * platform/graphics/skia/ImageSourceSkia.cpp:
+        (WebCore::ImageSource::clear):
+
+2009-01-30  David Hyatt  <hyatt@apple.com>
+
+        Add toRenderBlock methods for casting RenderObjects to RenderBlocks.  The methods will assert if the object
+        is not a RenderBlock.  Also add a toRenderBlock method that takes a RenderBlock but returns void and that
+        is unimplemented.  This method will catch anyone trying to do a cast when the object is already a RenderBlock.
+
+        Making this change caught a bad cast in RenderBlock::layoutBlockChildren, so that is also fixed by this
+        patch with a containsFloats() check.
+
+        Reviewed by Darin Adler
+
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::isCandidate):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::addBlockPlaceholderIfNeeded):
+        * editing/Editor.cpp:
+        (WebCore::Editor::hasBidiSelection):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::anchorElement):
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::styleWillChange):
+        (WebCore::RenderBlock::removeChild):
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::clearFloatsIfNeeded):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::fillBlockSelectionGaps):
+        (WebCore::RenderBlock::markAllDescendantsWithFloatsForLayout):
+        (WebCore::RenderBlock::firstLineBlock):
+        (WebCore::getLineAtIndex):
+        (WebCore::getHeightForLineCount):
+        (WebCore::RenderBlock::lineCount):
+        (WebCore::RenderBlock::adjustForBorderFit):
+        (WebCore::RenderBlock::clearTruncation):
+        * rendering/RenderBlock.h:
+        (WebCore::toRenderBlock):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::offsetFromContainer):
+        (WebCore::RenderBox::computeRectForRepaint):
+        (WebCore::RenderBox::calcReplacedHeightUsing):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::inlineContinuation):
+        (WebCore::nextContinuation):
+        (WebCore::RenderInline::positionForCoordinates):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
+        * rendering/RenderListItem.cpp:
+        (WebCore::getParentOfFirstLineBox):
+        (WebCore::RenderListItem::positionListMarker):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containingBlock):
+        (WebCore::RenderObject::computeRectForRepaint):
+        (WebCore::RenderObject::removeFromObjectLists):
+        (WebCore::RenderObject::getTextDecorationColors):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::addChild):
+        (WebCore::RenderTable::recalcSections):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::styleDidChange):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::adjustControlHeightBasedOnLineHeight):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::block):
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::createLineBoxes):
+
+2009-01-30  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig
+
+        - Let CachedFrame handle the suspending/resuming of active DOM objects itself instead of
+          relying on some outside force.
+        - Clear the previous history item inside FrameLoader instead of relying on multiple
+          FrameLoaderClients to do it.
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame): Suspend active DOM objects here.
+        (WebCore::CachedFrame::restore): Resume those DOM objects here.
+        * history/CachedFrame.h:
+        (WebCore::CachedFrame::domWindow):
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::commitProvisionalLoad): Let CachedFrame  creation handle the
+          suspending of active DOM objects.
+        (WebCore::FrameLoader::open): Let CachedFrame::restore() handle resuming those DOM objects.
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame): Call frameLoadCompleted() instead
+          of performing a client call by itself.
+        (WebCore::FrameLoader::frameLoadCompleted):
+
+2009-01-30  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6448823> Application Cache is kept after a private browsing session
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::selectCache):
+        (WebCore::ApplicationCacheGroup::update):
+        Cache update will not be started if private browsing is enabled. Existing cache version
+        from disk database will be used.
+
+        * loader/appcache/ApplicationCacheGroup.h: Made postListenerTask() static, in order to call
+        it when refusing to update from selectCache().
+
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::addDynamicEntry):
+        (WebCore::ApplicationCache::removeDynamicEntry):
+        Added reminders about private browsing to unimplemented methods.
+
+2009-01-30  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Bug 23580: GNU mode RVCT compilation support
+        <https://bugs.webkit.org/show_bug.cgi?id=23580>
+
+        * html/PreloadScanner.cpp: Use COMPILER(GCC) instead of __GNUC__.
+
+2009-01-30  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23616: Various "template helpers" should be consolidated from isolated files in JavaScriptCore.
+        <https://bugs.webkit.org/show_bug.cgi?id=23616>
+
+        Added forwarding header.
+
+        * ForwardingHeaders/wtf/TypeTraits.h: Added.
+
+2009-01-30  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23599: ResourceError needs to be copyable for use in another thread.
+        <https://bugs.webkit.org/show_bug.cgi?id=23599>
+
+        Add ResourceErrorBase::copy method.  (Not yet used.)
+
+        * platform/network/ResourceErrorBase.cpp:
+        (WebCore::ResourceErrorBase::copy):
+        * platform/network/ResourceErrorBase.h:
+
+2009-01-29  Stephanie Lewis <slewis@apple.com>
+
+        RS by Oliver Hunt.
+
+        Update the order files.
+
+        * WebCore.order:
+
+2009-01-29  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23488
+
+        Make TimerBase thread-aware (for Workers).
+        Added new class ThreadTimers - it keeps a heap of all timers for a thread (previously kept in a static global).
+        Pointer to instance of ThreadTimers is stored in GlobalThreadData.
+        Most static methods of TimerBase went to ThreadTimers.
+
+        The TimerBase functionality did not change (it maintains the timer heap which computes the nearest firing).
+
+        Added new abstract class SharedTimer, so worker threads can provide their own implementation (will be implemented on WorkerRunLoop).
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        Added new ThreadTimers.cpp to build files.
+
+        * platform/SharedTimer.h:
+        (WebCore::SharedTimer::~SharedTimer):
+        (WebCore::MainThreadSharedTimer::setFiredFunction):
+        (WebCore::MainThreadSharedTimer::setFireTime):
+        (WebCore::MainThreadSharedTimer::stop):
+        Added abstract SharedTimer and MainThreadSharedTimer which redirects to the existing port-supplied functions.
+
+        * platform/ThreadGlobalData.cpp:
+        (WebCore::ThreadGlobalData::ThreadGlobalData):
+        (WebCore::ThreadGlobalData::~ThreadGlobalData):
+        * platform/ThreadGlobalData.h:
+        (WebCore::ThreadGlobalData::threadTimers):
+        Added ThreadTimers to ThreadGlobalData.
+
+        * platform/ThreadTimers.cpp: Added.
+        (WebCore::mainThreadSharedTimer):
+        Static getter for a MainThreadSharedTimer singleton.
+
+        (WebCore::ThreadTimers::ThreadTimers):
+        (WebCore::ThreadTimers::setSharedTimer):
+        (WebCore::ThreadTimers::updateSharedTimer):
+        (WebCore::ThreadTimers::collectFiringTimers):
+        (WebCore::ThreadTimers::fireTimers):
+        (WebCore::ThreadTimers::sharedTimerFired):
+        (WebCore::ThreadTimers::sharedTimerFiredInternal):
+        (WebCore::ThreadTimers::fireTimersInNestedEventLoop):
+        ThreadTimers implementation. Most of the code is moved from previous static functions on TimerBase.
+        Need a new class so each thread may get ts own copy of the timer heap.
+
+        * platform/ThreadTimers.h: Added.
+        (WebCore::ThreadTimers::timerHeap):
+        (WebCore::ThreadTimers::timersReadyToFire):
+
+        * platform/Timer.cpp:
+        (WebCore::timerHeap):
+        (WebCore::timersReadyToFire):
+        (WebCore::TimerHeapElement::TimerHeapElement):
+        (WebCore::TimerHeapElement::checkConsistency):
+        (WebCore::TimerHeapElement::operator=):
+        (WebCore::TimerHeapIterator::checkConsistency):
+        (WebCore::TimerBase::TimerBase):
+        (WebCore::TimerBase::~TimerBase):
+        (WebCore::TimerBase::isActive):
+        (WebCore::TimerBase::checkHeapIndex):
+        (WebCore::TimerBase::heapDelete):
+        (WebCore::TimerBase::heapDeleteMin):
+        (WebCore::TimerBase::heapInsert):
+        (WebCore::TimerBase::heapPopMin):
+        (WebCore::TimerBase::setNextFireTime):
+        (WebCore::TimerBase::fireTimersInNestedEventLoop):
+        Now instead of static timer heap these use accessor functions that pull thread-specific heap instance.
+
+        * platform/Timer.h:
+        static methods moved to ThreadTimers.
+
+2009-01-29  David Hyatt  <hyatt@apple.com>
+
+        Beginning of work to eliminate RenderContainer and make containership "pluggable" into any spot in the render tree.  The first step is to create
+        the new object that will handle children: RenderObjectChildList and move RenderContainer's member variables into it.  Subsequent patches will begin
+        moving RenderContainer's functionality into RenderObjectChildList.
+
+        Reviewed by Eric Seidel
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::RenderContainer):
+        (WebCore::RenderContainer::destroyLeftoverChildren):
+        (WebCore::RenderContainer::addChild):
+        (WebCore::RenderContainer::removeChildNode):
+        (WebCore::RenderContainer::updateBeforeAfterContentForContainer):
+        (WebCore::RenderContainer::appendChildNode):
+        (WebCore::RenderContainer::insertChildNode):
+        (WebCore::RenderContainer::layout):
+        (WebCore::RenderContainer::removeLeftoverAnonymousBlock):
+        (WebCore::RenderContainer::positionForCoordinates):
+        (WebCore::RenderContainer::addLineBoxRects):
+        (WebCore::RenderContainer::collectAbsoluteLineBoxQuads):
+        * rendering/RenderContainer.h:
+        (WebCore::RenderContainer::firstChild):
+        (WebCore::RenderContainer::lastChild):
+        (WebCore::RenderContainer::firstChildBox):
+        (WebCore::RenderContainer::lastChildBox):
+        * rendering/RenderObjectChildList.h: Added.
+        (WebCore::RenderObjectChildList::RenderObjectChildList):
+        (WebCore::RenderObjectChildList::firstChild):
+        (WebCore::RenderObjectChildList::lastChild):
+        (WebCore::RenderObjectChildList::setFirstChild):
+        (WebCore::RenderObjectChildList::setLastChild):
+
+2009-01-29  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        http://bugs.webkit.org/show_bug.cgi?id=23598
+        Replace smart-quotes in UTF-8 with ASCII double-quotes to avoid
+        the compilation error on CJK Windows
+
+        * wml/WMLTableElement.cpp:
+        (WebCore::WMLTableElement::parseMappedAttribute):
+
+2009-01-29  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23627
+        Fix the PLATFORM(SKIA) build.
+
+        * svg/graphics/SVGPaintServer.cpp:
+        (WebCore::SVGPaintServer::teardown):
+
+2009-01-29  Scott Violet  <sky@google.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23625
+        Skia platform doesn't render text to a canvas or support clipping to an image buffer
+
+        Fixes two bugs in Skia rendering to a canvas:
+        . Text was not rendered at all. This is because we never properly
+          fixed up the alpha values. The fix is to create a layer when
+          rendering text to a layer.
+        . We were not honoring clipping to an image buffer.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (PlatformContextSkia::PlatformContextSkia):
+        (PlatformContextSkia::setDrawingToImageBuffer):
+        (PlatformContextSkia::isDrawingToImageBuffer):
+        (PlatformContextSkia::beginLayerClippedToImage):
+        (PlatformContextSkia::restore):
+        (PlatformContextSkia::applyClipFromImage):
+        * platform/graphics/skia/PlatformContextSkia.h:
+
+2009-01-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        First step in tracking the urls a HistoryItem was redirected through.
+
+        * WebCore.base.exp:
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem):
+        (WebCore::HistoryItem::addRedirectURL):
+        (WebCore::HistoryItem::redirectURLs):
+        (WebCore::HistoryItem::setRedirectURLs):
+        * history/HistoryItem.h:
+
+2009-01-29  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann, Eric Seidel.
+
+        Just transform the pattern directly instead of transforming the context fixes this
+        problem. Texts or strokes are no longer affected by transformations.
+
+        SVG pattern transformation/BoundingBox can cause ugly stroke thickness or text positions
+        https://bugs.webkit.org/show_bug.cgi?id=23472
+
+        Test: svg/custom/pattern-with-transformation.svg
+
+        * platform/graphics/Pattern.h:
+        (WebCore::Pattern::setPatternSpaceTransform):
+        * platform/graphics/cairo/PatternCairo.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+        * platform/graphics/cg/PatternCG.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+        * platform/graphics/qt/PatternQt.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2009-01-29  David Hyatt  <hyatt@apple.com>
+
+        Move the line box list member out of RenderFlow and down into RenderBlock and RenderInline.  Eliminate RenderFlow from the tree.
+
+        Reviewed by Sam Weinig
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/HTMLAnchorElement.cpp:
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::rendererLineBoxes):
+        (WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
+        * rendering/InlineFlowBox.h:
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::RenderBlock):
+        (WebCore::RenderBlock::destroy):
+        (WebCore::RenderBlock::styleWillChange):
+        (WebCore::RenderBlock::styleDidChange):
+        (WebCore::RenderBlock::dirtyLineBoxes):
+        (WebCore::RenderBlock::removeChild):
+        (WebCore::RenderBlock::setSelectionState):
+        (WebCore::RenderBlock::avoidsFloats):
+        (WebCore::RenderBlock::positionForCoordinates):
+        (WebCore::RenderBlock::calcInlinePrefWidths):
+        (WebCore::RenderBlock::baselinePosition):
+        (WebCore::RenderBlock::getBaselineOfFirstLineBox):
+        (WebCore::RenderBlock::getBaselineOfLastLineBox):
+        (WebCore::RenderBlock::rectWithOutlineForRepaint):
+        (WebCore::RenderBlock::hoverAncestor):
+        (WebCore::RenderBlock::updateDragState):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::lineBoxes):
+        (WebCore::RenderBlock::firstLineBox):
+        (WebCore::RenderBlock::lastLineBox):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::offsetFromContainer):
+        (WebCore::RenderBox::computeRectForRepaint):
+        (WebCore::RenderBox::containingBlockWidthForPositioned):
+        (WebCore::RenderBox::calcAbsoluteHorizontalValues):
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced):
+        * rendering/RenderBox.h:
+        * rendering/RenderFlow.cpp: Removed.
+        * rendering/RenderFlow.h: Removed.
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::RenderInline):
+        (WebCore::RenderInline::destroy):
+        (WebCore::RenderInline::styleDidChange):
+        (WebCore::RenderInline::addChildIgnoringContinuation):
+        (WebCore::RenderInline::cloneInline):
+        (WebCore::RenderInline::splitInlines):
+        (WebCore::RenderInline::offsetLeft):
+        (WebCore::RenderInline::offsetTop):
+        (WebCore::RenderInline::positionForCoordinates):
+        (WebCore::RenderInline::rectWithOutlineForRepaint):
+        (WebCore::RenderInline::updateDragState):
+        (WebCore::RenderInline::relativePositionedInlineOffset):
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::lineBoxes):
+        (WebCore::RenderInline::firstLineBox):
+        (WebCore::RenderInline::lastLineBox):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::rendererLineBoxes):
+        * rendering/RootInlineBox.h:
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::createLineBoxes):
+        * wml/WMLAElement.cpp:
+
+2009-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Cleaned up some naming in ScheduledRedirection.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::ScheduledRedirection::ScheduledRedirection):
+
+2009-01-29  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Update to use new API.
+
+        * platform/graphics/mac/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
+        (WebCore::createFontCustomPlatformData):
+
+2009-01-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23619
+        ASSERT(!error.isNull()) in DocumentLoader::mainReceivedError() when an SVG image load
+        is cancelled
+
+        Covered by existing tests (as a random crash).
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::cancelledError):
+        (WebCore::EmptyFrameLoaderClient::blockedError):
+        (WebCore::EmptyFrameLoaderClient::cannotShowURLError):
+        (WebCore::EmptyFrameLoaderClient::interruptForPolicyChangeError):
+        (WebCore::EmptyFrameLoaderClient::cannotShowMIMETypeError):
+        (WebCore::EmptyFrameLoaderClient::fileDoesNotExistError):
+        (WebCore::EmptyFrameLoaderClient::pluginWillHandleLoadError):
+        Create non-null errors.
+
+2009-01-29  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Removed an unused case of "lockHistory" to help make the other cases
+        clearer.
+
+        * page/FrameLoadRequest.h:
+        (WebCore::FrameLoadRequest::FrameLoadRequest):
+
+2009-01-29  David Hyatt  <hyatt@apple.com>
+
+        Move all of the contination insertion code from RenderFlow to RenderInline.  addChildToFlow is renamed to addChildIgnoringContinuation, and it has been moved to
+        RenderContainer so that it can still be called on either blocks or inlines.  The base class implementation in RenderContainer is what RenderBlock uses.  RenderInline
+        subclasses it to do all the work it used to do in addChildToFlow.
+
+        RenderBlock's old addChildToFlow can just become addChild.  This simplification is possible because addChild was actually never being called on anonymous
+        block continuations.
+
+        The code dealing with anonymous table parts in the old addChildWithContinuation method can now be removed as a result with no harmful side effects.  Falling through to the
+        base class and ignoring a block continuation makes the right thing happen.
+
+        addChildWithContinuation moved to RenderInline and has been renamed to addChildToContinuation.
+
+        Reviewed by Eric Seidel
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addChild):
+        * rendering/RenderBlock.h:
+        * rendering/RenderContainer.h:
+        (WebCore::RenderContainer::addChildIgnoringContinuation):
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::styleDidChange):
+        (WebCore::RenderInline::addChild):
+        (WebCore::nextContinuation):
+        (WebCore::RenderInline::continuationBefore):
+        (WebCore::RenderInline::addChildIgnoringContinuation):
+        (WebCore::RenderInline::splitInlines):
+        (WebCore::RenderInline::splitFlow):
+        (WebCore::RenderInline::addChildToContinuation):
+        (WebCore::RenderInline::childBecameNonInline):
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::continuation):
+        (WebCore::RenderInline::setContinuation):
+
+2009-01-29  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Oliver Hunt
+
+        <rdar://problem/6337157> hyundaiusa.com closes window or tab during load
+
+        Test: fast/loader/subframe-self-close.html
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::close): Only allow mainframes to close the window.
+
+2009-01-29  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by David Hyatt.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=23539
+
+        Remove several virtual functions from Node & Element related to form control / input elements,
+        that shouldn't reside there, but move to approriate locations, in the new form control /
+        input element abstract base classes.
+
+        Remove the isControl() method from Node, as it's redundant - isFormControlElement() provides the same information.
+        Move isEnabled( / isReadOnlyControl() / isTextControl() from Node to FormControlElement.
+        Move isAutofilled() / isChecked() / isIndeterminate() from Node to InputElement.
+        Move isInputTypeHidden() / isPasswordField() from Element to InputElement.
+
+        Querying these methods requires using the toInputElement/toFormControlElement casting helper functions
+        to cast Element pointers to InputElement/FormControlElement pointers.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement):
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * dom/Element.h:
+        (WebCore::Element::isFormControlElementWithState):
+        * dom/FormControlElement.h:
+        * dom/InputElement.h:
+        * dom/Node.h:
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::advance):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::attach):
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::isTextControl):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::CheckedRadioButtons::removeButton):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::isAutofilled):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isPasswordField):
+        (WebCore::AccessibilityRenderObject::isIndeterminate):
+        (WebCore::AccessibilityRenderObject::isChecked):
+        (WebCore::AccessibilityRenderObject::isControl):
+        (WebCore::AccessibilityRenderObject::isEnabled):
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (textMarkerForVisiblePosition):
+        * platform/ContextMenu.cpp:
+        (WebCore::ContextMenu::populate):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::resize):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::itemIsEnabled):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::updateUserModifyProperty):
+        (WebCore::RenderTextControl::adjustInnerTextStyle):
+        (WebCore::RenderTextControl::updateFromElement):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::isChecked):
+        (WebCore::RenderTheme::isIndeterminate):
+        (WebCore::RenderTheme::isEnabled):
+        (WebCore::RenderTheme::isReadOnlyControl):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::adjustMenuListStyle):
+        * wml/WMLFormControlElement.cpp:
+        (WebCore::WMLFormControlElement::isFocusable):
+        * wml/WMLFormControlElement.h:
+        (WebCore::WMLFormControlElement::isEnabled):
+        (WebCore::WMLFormControlElement::isReadOnlyControl):
+        (WebCore::WMLFormControlElement::isTextControl):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::isKeyboardFocusable):
+        (WebCore::WMLInputElement::isMouseFocusable):
+        * wml/WMLInputElement.h:
+        (WebCore::WMLInputElement::isAutofilled):
+
+2009-01-29  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Fix WML build - apply same fix as HTMLAnchorElement received.
+
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::isKeyboardFocusable):
+
+2009-01-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23620
+        Crash in appcache/resource-redirect.html on Tiger
+
+        There was a bug in the test case - it didn't send a Location header, and on Tiger, this
+        resulted in a failure callback being sent. It turned out that proper redirects weren't
+        caught at all.
+
+        Tests: http/tests/appcache/manifest-redirect-2.html
+               http/tests/appcache/resource-redirect-2.html
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didFail): Fixed this function to not crash if
+        didReceiveResponse() wasn't called for this request.
+        (WebCore::ApplicationCacheGroup::didReceiveResponse): Fixed to check for redirects correctly.
+        (WebCore::ApplicationCacheGroup::didReceiveManifestResponse): Ditto.
+
+2009-01-29  David Hyatt  <hyatt@apple.com>
+
+        Move dirtyLinesFromChangedChild into RenderLineBoxList so that it can be shared by RenderBlock and RenderInline.
+
+        Reviewed by Sam Weinig
+
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::dirtyLinesFromChangedChild):
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::dirtyLinesFromChangedChild):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::dirtyLinesFromChangedChild):
+        * rendering/RenderLineBoxList.h:
+
+2009-01-29  Adam Roben  <aroben@apple.com>
+
+        Fix Bug 23623: Windowed Flash instances aren't captured when a WebView
+        receives a WM_PRINTCLIENT message
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23623>
+        <rdar://problem/6513921>
+        <rdar://problem/6536874>
+
+        Flash doesn't seem to respond to WM_PRINTCLIENT, so we change
+        WM_PRINTCLIENT messages into WM_PAINT messages and hook into the
+        BeginPaint/EndPaint APIs to return the HDC we received from
+        WM_PRINTCLIENT. This causes the plugin to paint into the
+        WM_PRINTCLIENT HDC via its normal WM_PAINT handler. This technique
+        came from <http://www.fengyuan.com/article/wmprint.html>.
+
+        No test possible.
+
+        Reviewed by Darin Adler.
+
+        * platform/graphics/GraphicsContext.h: Added
+        [set]ShouldIncludeChildWindows on Windows.
+
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h: Added
+        m_shouldIncludeChildWindows.
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        Initialize the new member.
+
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::setShouldIncludeChildWindows):
+        (WebCore::GraphicsContext::shouldIncludeChildWindows):
+        Added simple setter and getter.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView): Initialize the new member.
+
+        * plugins/PluginView.h: Added m_wmPrintHDC and various functions
+        required for making WM_PRINTCLIENT work.
+
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::hookedBeginPaint):
+        (WebCore::PluginView::hookedEndPaint):
+        (WebCore::hook):
+        (WebCore::setUpOffscreenPaintingHooks):
+        Added. Code was modified from code available on fengyuan.com.
+
+        (WebCore::PluginView::wndProc): Turn WM_PRINTCLIENT messages into
+        WM_PAINT messages and save off the HDC that we're supposed to paint
+        into.
+
+        (WebCore::PluginView::paintWindowedPluginIntoContext): Added. Gets an
+        HDC from the GraphicsContext, translates it into client coordinates,
+        gets the plugin to draw into the HDC by sending a WM_PRINTCLIENT
+        message, and returns the HDC to the GraphicsContext.
+
+        (WebCore::PluginView::paint): If we're trying to paint a windowed
+        plugin into the GraphicsContext, call paintWindowedPluginIntoContext.
+
+        (WebCore::PluginView::init): Call setUpOffscreenPaintingHooks to make
+        our WM_PRINTCLIENT trick work.
+
+2009-01-29  David Hyatt  <hyatt@apple.com>
+
+        Move RenderFlow::destroy down into RenderBlock and RenderInline.
+
+        Reviewed by Anders Carlsson
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::destroy):
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::destroy):
+
+2009-01-29  David Kilzer  <ddkilzer@apple.com>
+
+        Remove semi-colons from the end of ObjC method implementations
+
+        Rubber-stamped by Adam Roben.
+
+        $ find WebCore -name \*.m -o -name \*.mm -exec perl -e 'undef $/; $s = <>; while ($s =~ m/[\n\r][-+].*;[\s\r\n]+\{/g) { print "$ARGV: $&\n"; }' {} \;
+
+        * bridge/testbindings.mm:
+
+2009-01-29  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23609
+        Use the two-arg constructor for implicit QUrl->KURL conversion as the
+        single argument ctors assume that KURL::parse has already been called
+        and assert if the parse results in a different string.  This was causing
+        an assert for QUrl's with no path and without a trailing slash.
+
+        * platform/qt/KURLQt.cpp:
+        (WebCore::KURL::KURL):
+
+2009-01-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        Renamed ApplicationCacheResource::Implicit to Master, because that's the word HTML5 uses,
+        and it describes the meaning better.
+
+        * loader/appcache/ApplicationCache.cpp:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        * loader/appcache/ApplicationCacheResource.cpp:
+        * loader/appcache/ApplicationCacheResource.h:
+
+2009-01-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Release build fix.
+
+        * loader/appcache/ApplicationCacheGroup.cpp: (WebCore::ApplicationCacheGroup::selectCache):
+        Got rid of a variable that wasn't used in release builds.
+
+2009-01-29  David Hyatt  <hyatt@apple.com>
+
+        Get rid of createAnonymousFlow.  It was only called in one spot, so just inline the code.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::updateFirstLetter):
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+
+2009-01-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23476
+        HTTP redirect should make application cache updating fail
+
+        Tests: http/tests/appcache/manifest-redirect.html
+               http/tests/appcache/resource-redirect.html
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didReceiveResponse):
+        (WebCore::ApplicationCacheGroup::didReceiveManifestResponse):
+        Fail if response code isn't 2xx.
+
+2009-01-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23592
+        Update appcache manifest signature parsing
+
+        Test: http/tests/appcache/wrong-signature-2.html
+
+        * loader/appcache/ManifestParser.cpp: (WebCore::parseManifest): Allow comments on signature
+        line. Removed code that replaced nulls with 0xFFFD characters, because there is no such
+        requirement in the spec.
+
+2009-01-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23584
+        Update application cache code for the latest round of spec changes
+
+        The changes mostly affect the update process - events are sent at a different
+        time, and caches are associated with documents earlier.
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::mainReceivedError): Changed an always passing test to an assertion.
+        (WebCore::DocumentLoader::shouldLoadResourceFromApplicationCache): Caches are now associated
+        with DocumentLoader before being complete, but they only affect loading after being completed.
+        (WebCore::DocumentLoader::getApplicationCacheFallbackResource): Ditto.
+
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::setGroup): Allow setting the group to the same one, to simplify
+        ApplicationCacheGroup code.
+        (WebCore::ApplicationCache::isComplete): A new method that tells whether the cache is
+        complete, as defined in HTML5.
+        * loader/appcache/ApplicationCache.h: Added isComplete().
+
+        * loader/appcache/ApplicationCacheGroup.h:
+        (WebCore::ApplicationCacheUpdateOption): Per HTML5, cache updating should work differently
+        when invoked with or without a browsing context (Frame). A Frame is currently always needed
+        for updating in WebKit, so a new argument to update() tells whether we should pretend that
+        there isn't one.
+        (WebCore::ApplicationCacheGroup::cacheIsBeingUpdated): A helper for ApplicationCache::isComplete().
+        (WebCore::ApplicationCacheGroup::CompletionType): Cache update algorithm now waits for
+        ne main resources to finish loading in more cases. A member variable of this type is used to
+        distinguish between different cases when waiting.
+        (WebCore::ApplicationCacheGroup::m_cacheCandidates): The new algorithm doesn't track cache
+        candidates. Caches are associated with documents much earlier, but the ones whose main resources
+        have not been loaded from a cache are being tracked in a pending master entry list.
+
+        * loader/appcache/DOMApplicationCache.cpp: (WebCore::DOMApplicationCache::update):
+        An explicit call to update() invokes the algorithm without a browsing context.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::ApplicationCacheGroup):
+        (WebCore::ApplicationCacheGroup::~ApplicationCacheGroup):
+        (WebCore::ApplicationCacheGroup::selectCache):
+        (WebCore::ApplicationCacheGroup::selectCacheWithoutManifestURL):
+        (WebCore::ApplicationCacheGroup::finishedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::failedLoadingMainResource):
+        (WebCore::ApplicationCacheGroup::stopLoading):
+        (WebCore::ApplicationCacheGroup::disassociateDocumentLoader):
+        (WebCore::ApplicationCacheGroup::cacheDestroyed):
+        (WebCore::ApplicationCacheGroup::setNewestCache):
+        (WebCore::ApplicationCacheGroup::update):
+        (WebCore::ApplicationCacheGroup::didReceiveResponse):
+        (WebCore::ApplicationCacheGroup::didFinishLoading):
+        (WebCore::ApplicationCacheGroup::didFail):
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        (WebCore::ApplicationCacheGroup::cacheUpdateFailed):
+        (WebCore::ApplicationCacheGroup::manifestNotFound):
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete):
+        (WebCore::ApplicationCacheGroup::startLoadingEntry):
+        (WebCore::ApplicationCacheGroup::deliverDelayedMainResources):
+        (WebCore::ApplicationCacheGroup::addEntry):
+        (WebCore::ApplicationCacheGroup::associateDocumentLoaderWithCache):
+        (WebCore::CallCacheListenerTask::create):
+        (WebCore::CallCacheListenerTask::performTask):
+        (WebCore::CallCacheListenerTask::CallCacheListenerTask):
+        (WebCore::ApplicationCacheGroup::postListenerTask):
+        Rewrote the update algorithm.
+
+2009-01-28  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Merged FrameLoadTypeReloadAllowingStaleData with FrameLoadTypeReload.
+
+        Technically, selecting View->Text Encoding->[Non-Default Encoding] on
+        a page with frames may now be slightly slower than it used to be. Oh well.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::isBackForwardLoadType):
+        (WebCore::FrameLoader::restoreDocumentState): Subbed in FrameLoadTypeReload.
+
+        (WebCore::FrameLoader::loadURLIntoChildFrame): No need to account for
+        non-back-forward navigations anymore.
+
+        (WebCore::FrameLoader::canCachePage):
+        (WebCore::FrameLoader::logCanCachePageDecision):
+        (WebCore::FrameLoader::reloadWithOverrideEncoding):
+        (WebCore::FrameLoader::transitionToCommitted):
+        (WebCore::FrameLoader::loadItem): Subbed in FrameLoadTypeReload.
+
+        * loader/FrameLoader.h: Renamed reloadAllowingStaleData => reloadWithOverrideEncoding,
+        since that's what it actually does.
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Move hit testing and painting of lines from RenderFlow into RenderLineBoxList.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintContents):
+        (WebCore::RenderBlock::hitTestContents):
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::paint):
+        (WebCore::RenderInline::nodeAtPoint):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        (WebCore::RenderLineBoxList::hitTest):
+        * rendering/RenderLineBoxList.h:
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Fix SVG pixel test regressions.  I wish I could say that I understand this fix, but I don't.  For
+        some reason the original code returned 0 for RenderSVGInlineText::yPos() and somehow my literal
+        replacement of yPos() with the body of that method changed the results.  I am completely baffled,
+        but all SVG pixel tests pass again when I just take the code out.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::computeAbsoluteRectForRange):
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Move dirtyLineBoxes from RenderFlow to RenderInline and RenderBlock.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::dirtyLineBoxes):
+        * rendering/RenderBlock.h:
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::dirtyLineBoxes):
+        * rendering/RenderInline.h:
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::dirtyLineBoxes):
+        * rendering/RenderLineBoxList.h:
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Back out my change to scrollWidth/Height from an earlier checkin since it broke stuff.  The current
+        behavior is not correct, but this will need to be investigated before being changed again.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Move paintOutline and paintOutlineWithLine from RenderFlow to RenderInline, since they only apply to inlines.  Tighten up all of the code that
+        called paintOutline to use RenderInline as the type instead of RenderFlow.
+
+        Reviewed by cpst
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::addContinuationWithOutline):
+        (WebCore::RenderBlock::paintContinuationOutlines):
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::paintLines):
+        * rendering/RenderFlow.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::paintOutline):
+        (WebCore::RenderInline::paintOutlineForLine):
+        * rendering/RenderInline.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::paintOutline):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::PaintInfo::PaintInfo):
+
+2009-01-28  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23596
+        XMLHttpRequest.cpp no longer compiles without USE(JSC)
+
+        * xml/XMLHttpRequest.cpp:
+
+2009-01-28  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23597
+        Make it possible to compile Database.cpp when USE(JSC) is not defined
+
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+
+2009-01-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6077047> REGRESSION (r34544): Custom icon does not
+          appear in address field on first visit to any site
+
+        * loader/icon/IconLoader.cpp:
+        (WebCore::IconLoader::finishLoading): Changed to set the icon data only
+        after establishing a mapping from the page URL(s) to the icon. Doing
+        things the other way around resulted in the data not being cached
+        in the icon-URL to IconRecord map (because there was no interested page
+        at the time) and subsequently having to be fetched asynchronously from
+        the database when the page-to-icon mapping was established.
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Move addFocusRingRects from RenderFlow down into RenderBlock and RenderInline.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addFocusRingRects):
+        * rendering/RenderBlock.h:
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::addFocusRingRects):
+        * rendering/RenderInline.h:
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Move localCaretRect from RenderFlow into RenderBlock, since it only applied to blocks anyway and
+        was misplaced from the start.
+
+        Reviewed by Antti Koivisto.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::localCaretRect):
+        * rendering/RenderBlock.h:
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+
+2009-01-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        Add forwarding header.
+
+        * ForwardingHeaders/debugger/DebuggerActivation.h: Added.
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Move createInlineBox out of RenderFlow and down into RenderInline and RenderBlock.
+
+        Reviewed by Beth Dakin
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::createInlineBox):
+        * rendering/RenderBlock.h:
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::createInlineBox):
+        * rendering/RenderInline.h:
+        * rendering/bidi.cpp:
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Move calcMargins from RenderFlow to RenderInline, since it was only ever called on RenderInlines.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::calcMargins):
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Refactor the first and last line box member variables from RenderFlow.  Encapsulate them into a new class called RenderLineBoxList that manages all modifications to
+        the list.  This change will make it easier to give RenderInline and RenderBlock separate versions of the line box list without having to duplicate very much code.
+
+        Reviewed by Oliver Hunt
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::deleteLine):
+        (WebCore::InlineFlowBox::removeLineBoxFromRenderObject):
+        (WebCore::InlineFlowBox::extractLine):
+        (WebCore::InlineFlowBox::extractLineBoxFromRenderObject):
+        (WebCore::InlineFlowBox::attachLine):
+        (WebCore::InlineFlowBox::attachLineBoxToRenderObject):
+        * rendering/InlineFlowBox.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::deleteLineBoxTree):
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::destroy):
+        (WebCore::RenderFlow::dirtyLineBoxes):
+        (WebCore::RenderFlow::createInlineBox):
+        * rendering/RenderFlow.h:
+        (WebCore::RenderFlow::RenderFlow):
+        (WebCore::RenderFlow::lineBoxes):
+        (WebCore::RenderFlow::firstLineBox):
+        (WebCore::RenderFlow::lastLineBox):
+        * rendering/RenderLineBoxList.cpp: Added.
+        (WebCore::RenderLineBoxList::~RenderLineBoxList):
+        (WebCore::RenderLineBoxList::appendLineBox):
+        (WebCore::RenderLineBoxList::deleteLineBoxTree):
+        (WebCore::RenderLineBoxList::extractLineBox):
+        (WebCore::RenderLineBoxList::attachLineBox):
+        (WebCore::RenderLineBoxList::removeLineBox):
+        (WebCore::RenderLineBoxList::deleteLineBoxes):
+        (WebCore::RenderLineBoxList::checkConsistency):
+        * rendering/RenderLineBoxList.h: Added.
+        (WebCore::RenderLineBoxList::RenderLineBoxList):
+        (WebCore::RenderLineBoxList::firstLineBox):
+        (WebCore::RenderLineBoxList::lastLineBox):
+        (WebCore::RenderLineBoxList::checkConsistency):
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::createInlineBox):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::createInlineBox):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::removeLineBoxFromRenderObject):
+        (WebCore::RootInlineBox::extractLineBoxFromRenderObject):
+        (WebCore::RootInlineBox::attachLineBoxToRenderObject):
+        * rendering/RootInlineBox.h:
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2009-01-28  David Kilzer  <ddkilzer@apple.com>
+
+        Clean up FontPlatformData constructor
+
+        Reviewed by David Hyatt.
+
+        * platform/graphics/mac/FontPlatformData.h: Updated copyright.
+        (WebCore::FontPlatformData::FontPlatformData): Provide readable
+        names for constructor arguments and reformat member variables.
+        * platform/graphics/mac/FontPlatformDataMac.mm: Updated copyright.
+        (WebCore::FontPlatformData::FontPlatformData): Provide readable
+        names for constructor arguments and reformat member variables.
+
+2009-01-28  Tony Chang  <tony@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23593
+        Compile fixes for RenderThemeChromiumMac and RenderThemeChromiumWin.
+        This is a follow up for hyatt's RenderBox changes.
+
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::baselinePosition):
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::paintMenuList):
+
+2009-01-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23582
+
+        Fix assertions when inline elements have both opacity (or something
+        else that creates a RenderLayer), and transform by ensuring that
+        setHasTransform() is only called for non-inline or replaced elements.
+        We also have to ensure that RenderReplicas will get transforms applied
+        to them by lying about them being replaced.
+
+        Tests: fast/transforms/transform-on-inline.html
+               fast/transforms/transform-table-row.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::RenderReplica):
+        * rendering/RenderTableRow.h:
+        (WebCore::RenderTableRow::requiresLayer):
+
+2009-01-28  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Justin Garcia.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18835
+        Spelling underlines disappear when they shouldn't
+
+        The WebCore::InsertLineBreakCommand::doApply() function splits a text node
+        without copying existing markers. To fix this bug, change code which
+        manually splits a text node into a CompositeEditCommand::splitTextNode() call.
+
+        Test: editing/spelling/spelling-linebreak.html
+
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Move the m_lineHeight member variable out of RenderFlow and down into RenderBlock and RenderInline.  Shift the line height computation into RenderStyle so
+        that it isn't repeated in three places.
+
+        Reviewed by Sam Weinig
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::RenderBlock):
+        (WebCore::RenderBlock::lineHeight):
+        * rendering/RenderBlock.h:
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+        (WebCore::RenderFlow::RenderFlow):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::RenderInline):
+        (WebCore::RenderInline::lineHeight):
+        * rendering/RenderInline.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::lineHeight):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::computedLineHeight):
+
+2009-01-28  Zachary Kuznia  <zork@chromiuum.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22070
+        Add an option to allow scripts to close windows.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setAllowScriptsToCloseWindows):
+        * page/Settings.h:
+        (WebCore::Settings::allowScriptsToCloseWindows):
+
+2009-01-28  Adam Langley  <agl@google.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23573
+        Make PlatformWidget on chromium an intptr_t to match changes made in Chromium
+
+        * platform/chromium/PlatformWidget.h:
+
+2009-01-28  David Hyatt  <hyatt@apple.com>
+
+        Fix for
+
+        <rdar://problem/6531287> REGRESSION: CrashTracer: [USER] 12 crashes in Safari at com.apple.WebCore • WebCore::RenderBlock::removeFloatingObject + 59
+
+        My tightening up of markAllDescendantsWithFloatsForLayout exposed a buggy check in that code that could
+        lead to a bad cast.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::markAllDescendantsWithFloatsForLayout):
+
+2009-01-27  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=23576
+
+        Work towards eliminating RenderFlow from the tree.
+
+        Move the m_continuation variable down from RenderFlow into RenderInline and RenderBlock.  Since a block can only have an inline continuation following it, the type
+        of the member and methods reflect this (inlineContinuation() and m_inlineContinuation).  Since an inline can have either a block or an inline continuation following it,
+        a base class of RenderBox* is used for the type of object returned (in anticipation of the removal of RenderFlow).
+
+        Since moving the continuation variable down into the subclasses increased the size of RenderInline and RenderBlock by 4 bytes, this patch also moves all of the bitfield
+        members of RenderFlow up to RenderObject.  Since they fit within the available bits on RenderObject, this patch actually results in a net savings of 4 bytes on RenderInlines
+        and RenderBlocks!
+
+        One bitfield member was eliminated rather than moved: m_firstLine.  This was really more of a state variable used during line layout only, so I removed it as a member
+        and just passed firstLine down to various methods as needed.  Doing so uncovered some potential bugs where the first line state was not being respected when querying for
+        line offsets.
+
+        Continuations have been completely hidden from all files except for RenderFlow, RenderBlock and RenderInline.  All of the code that referenced continuations directly
+        from base classes has been refactored to use virtual methods on RenderBlock and RenderInline instead.
+
+        RenderFlow still has a common addChildWithContinuation method that is used by both blocks and inlines.  Since refactoring that method will be pretty tricky, I've held
+        off on that for a later patch.
+
+        Reviewed by Oliver Hunt
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::anchorElement):
+        (WebCore::AccessibilityRenderObject::boundingBoxRect):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
+        (WebCore::InlineFlowBox::paint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::RenderBlock):
+        (WebCore::RenderBlock::~RenderBlock):
+        (WebCore::RenderBlock::destroy):
+        (WebCore::RenderBlock::addChildToFlow):
+        (WebCore::RenderBlock::makeChildrenNonInline):
+        (WebCore::RenderBlock::removeChild):
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::expandsToEncloseOverhangingFloats):
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::determineHorizontalPosition):
+        (WebCore::RenderBlock::setCollapsedBottomMargin):
+        (WebCore::RenderBlock::layoutOnlyPositionedObjects):
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::addContinuationWithOutline):
+        (WebCore::RenderBlock::setSelectionState):
+        (WebCore::RenderBlock::shouldPaintSelectionGaps):
+        (WebCore::RenderBlock::fillSelectionGaps):
+        (WebCore::RenderBlock::leftSelectionOffset):
+        (WebCore::RenderBlock::rightSelectionOffset):
+        (WebCore::RenderBlock::leftOffset):
+        (WebCore::RenderBlock::leftRelOffset):
+        (WebCore::RenderBlock::rightOffset):
+        (WebCore::RenderBlock::rightRelOffset):
+        (WebCore::RenderBlock::lineWidth):
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        (WebCore::RenderBlock::getClearDelta):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::offsetForContents):
+        (WebCore::RenderBlock::availableWidth):
+        (WebCore::RenderBlock::setDesiredColumnCountAndWidth):
+        (WebCore::RenderBlock::desiredColumnWidth):
+        (WebCore::RenderBlock::desiredColumnCount):
+        (WebCore::RenderBlock::columnRects):
+        (WebCore::RenderBlock::layoutColumns):
+        (WebCore::RenderBlock::adjustPointToColumnContents):
+        (WebCore::RenderBlock::adjustRectForColumns):
+        (WebCore::RenderBlock::absoluteRects):
+        (WebCore::RenderBlock::absoluteQuads):
+        (WebCore::RenderBlock::rectWithOutlineForRepaint):
+        (WebCore::RenderBlock::hoverAncestor):
+        (WebCore::RenderBlock::updateDragState):
+        (WebCore::RenderBlock::outlineStyleForRepaint):
+        (WebCore::RenderBlock::childBecameNonInline):
+        (WebCore::RenderBlock::updateHitTestResult):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::rightOffset):
+        (WebCore::RenderBlock::leftOffset):
+        (WebCore::RenderBlock::inlineContinuation):
+        (WebCore::RenderBlock::setInlineContinuation):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::absoluteRects):
+        (WebCore::RenderBox::absoluteQuads):
+        (WebCore::RenderBox::addFocusRingRects):
+        (WebCore::RenderBox::containingBlockWidth):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::collapsedMarginBottom):
+        (WebCore::RenderBox::childBecameNonInline):
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::updateBeforeAfterContentForContainer):
+        (WebCore::RenderContainer::removeLeftoverAnonymousBlock):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderFlow.cpp:
+        (WebCore::nextContinuation):
+        (WebCore::RenderFlow::continuationBefore):
+        (WebCore::RenderFlow::addChildWithContinuation):
+        (WebCore::RenderFlow::addChild):
+        (WebCore::RenderFlow::destroy):
+        (WebCore::RenderFlow::addFocusRingRects):
+        * rendering/RenderFlow.h:
+        (WebCore::RenderFlow::RenderFlow):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::RenderInline):
+        (WebCore::RenderInline::destroy):
+        (WebCore::RenderInline::inlineContinuation):
+        (WebCore::RenderInline::styleDidChange):
+        (WebCore::RenderInline::addChildToFlow):
+        (WebCore::RenderInline::cloneInline):
+        (WebCore::RenderInline::splitInlines):
+        (WebCore::RenderInline::splitFlow):
+        (WebCore::RenderInline::positionForCoordinates):
+        (WebCore::RenderInline::rectWithOutlineForRepaint):
+        (WebCore::RenderInline::updateDragState):
+        (WebCore::RenderInline::childBecameNonInline):
+        (WebCore::RenderInline::updateHitTestResult):
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::isRenderInline):
+        (WebCore::RenderInline::continuation):
+        (WebCore::RenderInline::setContinuation):
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::positionListMarker):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::RenderListMarker):
+        (WebCore::RenderListMarker::setSelectionState):
+        * rendering/RenderListMarker.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):
+        (WebCore::RenderObject::rectWithOutlineForRepaint):
+        (WebCore::RenderObject::handleDynamicFloatPositionChange):
+        (WebCore::RenderObject::updateDragState):
+        (WebCore::RenderObject::updateHitTestResult):
+        (WebCore::RenderObject::getTextDecorationColors):
+        (WebCore::RenderObject::adjustRectForOutlineAndShadow):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isInlineBlockOrInlineTable):
+        (WebCore::RenderObject::childrenInline):
+        (WebCore::RenderObject::setChildrenInline):
+        (WebCore::RenderObject::hasColumns):
+        (WebCore::RenderObject::setHasColumns):
+        (WebCore::RenderObject::cellWidthChanged):
+        (WebCore::RenderObject::setCellWidthChanged):
+        (WebCore::RenderObject::isInlineContinuation):
+        (WebCore::RenderObject::hoverAncestor):
+        (WebCore::RenderObject::outlineStyleForRepaint):
+        (WebCore::RenderObject::setHasMarkupTruncation):
+        (WebCore::RenderObject::hasMarkupTruncation):
+        (WebCore::RenderObject::selectionState):
+        (WebCore::RenderObject::setSelectionState):
+        (WebCore::RenderObject::hasSelectedChildren):
+        (WebCore::RenderObject::isTopMarginQuirk):
+        (WebCore::RenderObject::isBottomMarginQuirk):
+        (WebCore::RenderObject::setTopMarginQuirk):
+        (WebCore::RenderObject::setBottomMarginQuirk):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::RenderReplaced):
+        (WebCore::RenderReplaced::setSelectionState):
+        * rendering/RenderReplaced.h:
+        (WebCore::RenderReplaced::canBeSelectionLeaf):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::calcWidth):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::updateWidth):
+        (WebCore::RenderTableCell::layout):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::RenderText):
+        (WebCore::RenderText::localCaretRect):
+        (WebCore::RenderText::setSelectionState):
+        * rendering/RenderText.h:
+        (WebCore::RenderText::canBeSelectionLeaf):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::updateHitTestResult):
+        * rendering/RenderView.h:
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::selectionTop):
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::createLineBoxes):
+        (WebCore::RenderBlock::constructLine):
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::determineStartPosition):
+        (WebCore::RenderBlock::skipTrailingWhitespace):
+        (WebCore::RenderBlock::skipLeadingWhitespace):
+        (WebCore::RenderBlock::fitBelowFloats):
+        (WebCore::RenderBlock::findNextLineBreak):
+        (WebCore::RenderBlock::checkLinesForTextOverflow):
+
+2009-01-28  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Nikolas Zimmermann and George Staikos.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23557
+        Allow option of hit testing frame content without clipping to the visible
+        viewport.
+
+        * WebCore.base.exp:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        * page/EventHandler.h:
+        * rendering/HitTestRequest.h:
+        (WebCore::HitTestRequest::HitTestRequest):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTest):
+
+2009-01-28  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Fix the build with Qt on Windows.
+
+        Make sure that the QTWEBKIT_EXPORT macro becomes the Q_DECL_EXPORT macro
+        instead of the import macro when building the dll, by defining
+        QT_MAKEDLL.
+
+        SystemTimeWin.cpp is needed on Windows for userIdleTime(), which for the
+        other Qt platforms comes from TemporaryLinkStubs.cpp.
+
+        * WebCore.pro:
+
+2009-01-28  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Speed-up clipping: avoid calling expensive QPainter::clipRegion().
+        Beside, the check is not necessary since QPainter::setClipRect() will
+        work just fine if there is no clip region yet.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::clip):
+
+2009-01-28  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23546
+        Upstream GoogleURL implementation of KURL
+
+        * platform/KURL.h:
+        * platform/KURLGoogle.cpp: Added.
+        * platform/KURLGooglePrivate.h: Added.
+
+2009-01-27  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION (r40234): Launching iTunes from a link displays a
+        "Safari can't find the Internet plug-in" sheet in Safari
+        rdar://problem/6533678
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::havePlugin): Put the check for empty string in here.
+        (WebCore::serviceTypeForClassId): Only return activeXType() if
+        we have a plug-in that can handle that type. While it might be logical
+        to return an Active X type for any <object> with a classId in it,
+        even if we don't have a plug-in that implements Active X, existing
+        clients, such as Safari, don't expect that.
+
+2009-01-27  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        - fix <rdar://problem/6524351> Text looks bad when font smoothing is
+          forced off
+
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs): Changed to use GDI rather than Core
+        Graphics if the client has turned font smoothing off.
+
+2009-01-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23360
+
+        Use the new container-relative repaint methods to compute
+        post-layout repaints, and repaints using RenderLayer's
+        cached repaintRect() relative to that container, rather than
+        using absolute coords.
+
+        Replaced lots of boilerplate old/new rect code in various
+        layout methods with a stack-based LayoutRepainter class, and
+        fixed a bug in RenderTable which set didFullRepaint to
+        'true' every time.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::layout):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::setHasVisibleContent):
+        * rendering/RenderLayer.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintUsingContainer):
+        (WebCore::RenderObject::repaint):
+        (WebCore::RenderObject::repaintRectangle):
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::LayoutRepainter::LayoutRepainter):
+        (WebCore::RenderObject::LayoutRepainter::repaintAfterLayout):
+        (WebCore::RenderObject::LayoutRepainter::checkForRepaint):
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::layout):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::layout):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::layout):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::layout):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::layout):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::layout):
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::layout):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2009-01-27  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/3541409> - More groundwork and cleanup for CachedFrames
+
+        * history/CachedFrame.cpp:
+        (WebCore::CachedFrame::CachedFrame): Make the savePlatformDataToCachedFrame() client call here,
+          and add the code for caching subframes.
+        (WebCore::CachedFrame::clear):
+        * history/CachedFrame.h: Change to be RefCounted
+        (WebCore::CachedFrame::create):
+        (WebCore::CachedFrame::url):
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::CachedPage):
+        (WebCore::CachedPage::restore):
+        * history/CachedPage.h:
+        (WebCore::CachedPage::document):
+        (WebCore::CachedPage::documentLoader):
+        (WebCore::CachedPage::view):
+        (WebCore::CachedPage::url):
+        (WebCore::CachedPage::domWindow):
+        (WebCore::CachedPage::cachedMainFrame):
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::cachePageForHistoryItem): Move the platform data saving into the
+          CachedFrame itself.
+
+2009-01-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Flip the arguments of computeRectForRepaint() from
+            computeRectForRepaint(IntRect&, RenderBox* repaintContainer, bool)
+        to
+            computeRectForRepaint(RenderBox* repaintContainer, IntRect&, bool)
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::clippedOverflowRectForRepaint):
+        (WebCore::RenderBox::computeRectForRepaint):
+        * rendering/RenderBox.h:
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::computeRectForRepaint):
+        * rendering/RenderForeignObject.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::computeRectForRepaint):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::computeAbsoluteRepaintRect):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+        (WebCore::RenderTableCell::computeRectForRepaint):
+        * rendering/RenderTableCell.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::computeRectForRepaint):
+        * rendering/RenderView.h:
+
+2009-01-27  David Kilzer  <ddkilzer@apple.com>
+
+        Add missing header guards to AccessibilityObjectWrapper.h
+
+        Reviewed by Anders Carlsson.
+
+        * page/mac/AccessibilityObjectWrapper.h: Added missing header guards.
+
+2009-01-27  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23567
+
+        Fix crash of svg/custom/stop-crash.svg testcase because of
+        infinite recursion, as I missed replacing absoluteClippedOverflowRect()
+        with clippedOverflowRectForRepaint() in RenderSVGGradientStop.
+
+        Also fix a missed conversion in RenderTableCol, and add a couple
+        of comments.
+
+        * rendering/RenderSVGGradientStop.h:
+        (WebCore::RenderSVGGradientStop::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::imageChanged):
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::clippedOverflowRectForRepaint):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::layout):
+
+2009-01-27  Adele Peterson  <adele@apple.com>
+
+        RS by Dave Hyatt
+
+        Use the textfield appearance for search fields in themeWin.css so the border/background
+        styling will work correctly on these fields.
+
+        * css/themeWin.css:
+
+2009-01-27  Dan Bernstein  <mitz@apple.com>
+
+        - build fix
+
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        (WebCore::JSHTMLInputElement::setSelectionStart):
+        (WebCore::JSHTMLInputElement::setSelectionEnd):
+        (WebCore::JSHTMLInputElement::setSelectionRange):
+
+2009-01-27  Dan Bernstein  <mitz@apple.com>
+
+        - build fix
+
+        * platform/graphics/Gradient.cpp:
+        (WebCore::Gradient::setSpreadMethod):
+
+2009-01-27  Paul Godavari  <paul@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23561
+        Explicitly send the MIME type from an image dragged from a web
+        page to the desktop, to Chromium so that it can properly generate
+        a file name.
+
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::clear):
+        (WebCore::ChromiumDataObject::hasData):
+        * platform/chromium/ChromiumDataObject.h:
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::writeImageToDataObject):
+
+2009-01-27  Mads Ager  <ager@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23300
+        Follow Firefox in throwing exceptions when using selection
+        functions on HTMLInputElements that cannot have selection.
+
+        This requires custom setSelectionRange, setSelectionStart and
+        setSelectionEnd implementations, but it gets rid of the custom
+        getOwnPropertySlot.
+
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        (WebCore::JSHTMLInputElement::selectionStart):
+        (WebCore::JSHTMLInputElement::selectionEnd):
+        (WebCore::JSHTMLInputElement::setSelectionRange):
+        * html/HTMLInputElement.idl:
+
+2009-01-27  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23435
+        Make spreadMethod a member of Gradient rather than GraphicsContext.
+        Implement spreadMethod for Skia.
+
+        * platform/graphics/Gradient.cpp:
+        (WebCore::Gradient::Gradient):
+        * platform/graphics/Gradient.h:
+        (WebCore::Gradient::setSpreadMethod):
+        (WebCore::Gradient::spreadMethod):
+        * platform/graphics/GraphicsContext.cpp:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/GraphicsContextPrivate.h:
+        * platform/graphics/GraphicsTypes.h:
+        (WebCore::):
+        * platform/graphics/cairo/GradientCairo.cpp:
+        (WebCore::Gradient::platformGradient):
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        * platform/graphics/qt/GradientQt.cpp:
+        (WebCore::Gradient::platformGradient):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        * platform/graphics/skia/GradientSkia.cpp:
+        (WebCore::Gradient::platformGradient):
+        * svg/SVGLinearGradientElement.cpp:
+        (WebCore::SVGLinearGradientElement::buildGradient):
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::buildGradient):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::SVGPaintServerGradient):
+        (WebCore::SVGPaintServerGradient::setup):
+        (WebCore::SVGPaintServerGradient::externalRepresentation):
+        * svg/graphics/SVGPaintServerGradient.h:
+
+2009-01-27  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Rubber-stamped by Simon Hausmann.
+
+        http://www.qtsoftware.com/developer/task-tracker/index_html?id=238662&method=entry
+
+        [Qt] Map function keys F1 to F24.
+
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2009-01-27  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        Rework FrameLoaderClient to work on a CachedFrame basis instead of CachedPage
+
+        * WebCore.base.exp:
+        * history/CachedPage.cpp:
+        * history/CachedPage.h:
+        (WebCore::CachedPage::cachedMainFrame):
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::savePlatformDataToCachedFrame):
+        (WebCore::EmptyFrameLoaderClient::transitionToCommittedFromCachedFrame):
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::restoreDocumentState):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        (WebCore::FrameLoader::transitionToCommitted):
+        (WebCore::FrameLoader::cachePageForHistoryItem):
+        * loader/FrameLoaderClient.h:
+
+2009-01-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23360
+
+        Add variants of all the methods that compute dirty rects for repainting
+        with versions that compute those rects relative to some container
+        RenderBox that acts as a painting root.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::outlineBoundsForRepaint):
+        (WebCore::RenderBox::localToContainerQuad):
+        (WebCore::RenderBox::clippedOverflowRectForRepaint):
+        (WebCore::RenderBox::computeRectForRepaint):
+        * rendering/RenderBox.h:
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::computeRectForRepaint):
+        * rendering/RenderForeignObject.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::clippedOverflowRectForRepaint):
+        * rendering/RenderInline.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::containerForRepaint):
+        (WebCore::RenderObject::repaint):
+        (WebCore::RenderObject::repaintRectangle):
+        (WebCore::RenderObject::rectWithOutlineForRepaint):
+        (WebCore::RenderObject::clippedOverflowRectForRepaint):
+        (WebCore::RenderObject::computeRectForRepaint):
+        (WebCore::RenderObject::localToContainerQuad):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::localToAbsoluteQuad):
+        (WebCore::RenderObject::absoluteClippedOverflowRect):
+        (WebCore::RenderObject::computeAbsoluteRepaintRect):
+        (WebCore::RenderObject::absoluteOutlineBounds):
+        (WebCore::RenderObject::outlineBoundsForRepaint):
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::clippedOverflowRectForRepaint):
+        (WebCore::RenderPath::outlineBoundsForRepaint):
+        * rendering/RenderPath.h:
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::clippedOverflowRectForRepaint):
+        * rendering/RenderReplaced.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::clippedOverflowRectForRepaint):
+        (WebCore::RenderSVGContainer::outlineBoundsForRepaint):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGHiddenContainer.cpp:
+        (WebCore::RenderSVGHiddenContainer::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGHiddenContainer.h:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::clippedOverflowRectForRepaint):
+        * rendering/RenderSVGText.h:
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+        (WebCore::RenderTableCell::computeRectForRepaint):
+        (WebCore::RenderTableCell::localToContainerQuad):
+        * rendering/RenderTableCell.h:
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::clippedOverflowRectForRepaint):
+        * rendering/RenderTableCol.h:
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::clippedOverflowRectForRepaint):
+        * rendering/RenderTableRow.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::clippedOverflowRectForRepaint):
+        * rendering/RenderText.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::localToContainerQuad):
+        (WebCore::RenderView::computeRectForRepaint):
+        * rendering/RenderView.h:
+
+2009-01-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by David Hyatt
+
+        Back out r40285, because it was checked in with no bug number, no
+        testcase, is rendering change that did not get thorough review,
+        and broke the Mac build.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        * page/EventHandler.h:
+        * rendering/HitTestRequest.h:
+        (WebCore::HitTestRequest::HitTestRequest):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTest):
+
+2009-01-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler
+
+        -Make the recently added back/forward cache logging much better by actually
+         walking the entire frame tree and indenting the resulting output.
+        -Fix a null-termination bug in HistoryItem tree logging
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::showTreeWithIndent):
+
+        * loader/FrameLoader.cpp:
+        (WebCore::pageCacheLogPrefix):
+        (WebCore::pageCacheLog):
+        (WebCore::FrameLoader::logCanCachePageDecision):
+        (WebCore::FrameLoader::logCanCacheFrameDecision):
+        * loader/FrameLoader.h:
+
+2009-01-26  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Allow option of hit testing frame content without clipping to the visible
+        viewport.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        * page/EventHandler.h:
+        * rendering/HitTestRequest.h:
+        (WebCore::HitTestRequest::HitTestRequest):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTest):
+
+2009-01-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=18141
+        Acid3 tests 77 and 78 fail on reload due to SVG font race
+        <rdar://problem/6504899>
+
+        Match Opera's behavior of loading SVGFonts as soon as <font-face-uri>
+        tag is inserted into the document and not at the first use of the font
+        as is done for CSS web fonts.
+
+        This fixes a race condition noticeable by some in the Acid3 test that
+        happened because the onload event handler for an iframe containing a
+        <font-face-uri> with an external reference was not delayed by the pending
+        load of the font.
+
+        Test: http/tests/misc/SVGFont-delayed-load.html
+
+        * svg/SVGFontFaceUriElement.cpp:
+        (WebCore::SVGFontFaceUriElement::~SVGFontFaceUriElement):
+        (WebCore::SVGFontFaceUriElement::parseMappedAttribute): Call loadFont if
+        the href attribute changes.
+        (WebCore::SVGFontFaceUriElement::insertedIntoDocument): Call loadFont.
+        (WebCore::SVGFontFaceUriElement::loadFont): Force a load of the
+        font specified in href attribute.
+        * svg/SVGFontFaceUriElement.h:
+
+2009-01-26  Timothy Hatcher  <timothy@apple.com>
+
+        Change Web Archive serialization back to the binary property list format.
+
+        <rdar://problem/6127865> Web archives saved with Safari 4 cannot be read by Safari 3
+
+        Reviewed by Brady Eidson.
+
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::rawDataRepresentation):
+
+2009-01-26  Anders Carlsson  <andersca@apple.com>
+
+        Fix 64-bit build.
+
+        * WebCore.LP64.exp:
+
+2009-01-26  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23511
+        Move DOMTimer from bindings/js to page/.
+        This was prepared by moving all JSC dependencies from DOMTimer
+        to ScheduledAction earlier, and helps unfork the Chromuim version
+        of the DOMTimer.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/DOMTimer.cpp: Removed.
+        * bindings/js/DOMTimer.h: Removed.
+        * page/DOMTimer.cpp: Copied from WebCore/bindings/js/DOMTimer.cpp.
+        * page/DOMTimer.h: Copied from WebCore/bindings/js/DOMTimer.h.
+
+2009-01-26  David Hyatt  <hyatt@apple.com>
+
+        Eliminate rightmostPosition, lowestPosition and leftmostPosition from RenderFlow.  Move the code into
+        RenderBlock's methods.
+
+        Reviewed by Eric Seidel
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+
+2009-01-26  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23553
+        Upstream changes from jcampan to fix chromium bugs 6692 and 6694.
+
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupListBox::setLoopSelectionNavigation):
+        (WebCore::PopupListBox::PopupListBox):
+        (WebCore::PopupContainer::setLoopSelectionNavigation):
+        (WebCore::PopupListBox::handleKeyEvent):
+        (WebCore::PopupListBox::paintRow):
+        (WebCore::PopupListBox::clearSelection):
+        (WebCore::PopupListBox::selectNextRow):
+        (WebCore::PopupListBox::selectPreviousRow):
+        * platform/chromium/PopupMenuChromium.h:
+
+2009-01-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Remove some historical CachedPage time stamp fluff.
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::CachedPage):
+        * history/CachedPage.h:
+        (WebCore::CachedPage::timeStamp):
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::cachePageForHistoryItem):
+
+2009-01-26  David Hyatt  <hyatt@apple.com>
+
+        Move absoluteClippedOverflowRect, linesBoundingBox and borderBoundingBox from RenderFlow to RenderInline.
+
+        Reviewed by Eric Seidel
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::containingBlockHeightForPositioned):
+        * rendering/RenderFlow.cpp:
+        * rendering/RenderFlow.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::linesBoundingBox):
+        (WebCore::RenderInline::absoluteClippedOverflowRect):
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::borderBoundingBox):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+
+2009-01-26  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22650
+        Implement support for "Immutable" attribute to CodeGeneratorJS.pm, thus
+        allowing to explicitly mark methods as immutable (i.e. returning a new
+        instance rather than a reference to an existing instance).
+
+        * bindings/js/JSSVGMatrixCustom.cpp: Removed custom methods.
+        * bindings/scripts/CodeGeneratorJS.pm: Added check for Immutable
+            attribute when generating function call.
+        * svg/SVGMatrix.idl: Replaced Custom attribute with Immutable on
+            methods.
+
+2009-01-26  David Hyatt  <hyatt@apple.com>
+
+        Eliminate isInlineFlow() now that a RenderBlock can never be an inline flow.  isInlineFlow() is now
+        equivalent to isRenderInline(), so all calls to isInlineFlow() have been replaced with isRenderInline().
+
+        Reviewed by Eric Seidel
+
+        * dom/Text.cpp:
+        (WebCore::Text::rendererIsNeeded):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::shouldDrawTextDecoration):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::hitTestContents):
+        (WebCore::InlineMinMaxIterator::next):
+        (WebCore::RenderBlock::calcInlinePrefWidths):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::isBlockFlow):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::clientWidth):
+        (WebCore::RenderBox::clientHeight):
+        (WebCore::RenderBox::nodeAtPoint):
+        (WebCore::RenderBox::imageChanged):
+        (WebCore::RenderBox::offsetForPositionedInContainer):
+        (WebCore::RenderBox::containingBlockWidthForPositioned):
+        (WebCore::RenderBox::containingBlockHeightForPositioned):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::width):
+        (WebCore::RenderBox::height):
+        (WebCore::RenderBox::size):
+        (WebCore::RenderBox::frameRect):
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::updateBeforeAfterContentForContainer):
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::dirtyLinesFromChangedChild):
+        (WebCore::RenderFlow::createInlineBox):
+        (WebCore::RenderFlow::paintLines):
+        (WebCore::RenderFlow::hitTestLines):
+        (WebCore::RenderFlow::absoluteClippedOverflowRect):
+        (WebCore::RenderFlow::lowestPosition):
+        (WebCore::RenderFlow::rightmostPosition):
+        (WebCore::RenderFlow::leftmostPosition):
+        * rendering/RenderFlow.h:
+        (WebCore::RenderFlow::borderBoundingBox):
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::isRenderInline):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::intersectsDamageRect):
+        (WebCore::RenderLayer::boundingBox):
+        * rendering/RenderListItem.cpp:
+        (WebCore::getParentOfFirstLineBox):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::getAbsoluteRepaintRectWithOutline):
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::firstLineStyle):
+        * rendering/RenderObject.h:
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::createInlineBox):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::createInlineBox):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::nodeAtPoint):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::nodeAtPoint):
+        * rendering/RenderText.cpp:
+        (WebCore::isInlineFlowOrEmptyText):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        * rendering/bidi.cpp:
+        (WebCore::bidiNext):
+        (WebCore::bidiFirst):
+        (WebCore::appendRunsForObject):
+        (WebCore::RenderBlock::createLineBoxes):
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::inlineFlowRequiresLineBox):
+        (WebCore::requiresLineBox):
+        (WebCore::RenderBlock::skipTrailingWhitespace):
+        (WebCore::RenderBlock::skipLeadingWhitespace):
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2009-01-26  David Hyatt  <hyatt@apple.com>
+
+        Drop support for display:compact.
+
+        (1) display:compact is no longer part of CSS2.1.
+        (2) Shipping Safari has completely broken compact support with severely broken rendering
+        (all of the compact text just piles on top of the text in the inserted block and on top of itself as well).
+        (3) This has been broken in WebKit for years (ever since blocks converted to painting lines directly) without
+        anyone even noticing.
+
+        Reviewed by Eric Seidel
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleSpecialChild):
+        (WebCore::RenderBlock::handleRunInChild):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::positionForCoordinates):
+        (WebCore::shouldCheckLines):
+        (WebCore::getHeightForLineCount):
+        (WebCore::RenderBlock::renderName):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::sizesToIntrinsicWidth):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::width):
+        (WebCore::RenderBox::height):
+        (WebCore::RenderBox::size):
+        (WebCore::RenderBox::frameRect):
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::paintLines):
+        (WebCore::RenderFlow::hitTestLines):
+        (WebCore::RenderFlow::absoluteClippedOverflowRect):
+        (WebCore::RenderFlow::linesBoundingBox):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isInline):
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        * rendering/bidi.h:
+        (WebCore::BidiRun::BidiRun):
+
+2009-01-26  Adam Langley  <agl@google.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        gtk2drawing: fix compiler warnings
+
+        g_object_set_data expects a gpointer as the last argument. Cast the
+          TRUE/FALSE values to avoid a warning.
+        gtk_tree_view_column_new doesn't return a GtkWidget.
+
+        * platform/gtk/gtk2drawing.c:
+        (setup_widget_prototype):
+        (moz_gtk_get_combo_box_inner_button):
+        (moz_gtk_get_combo_box_button_inner_widgets):
+        (ensure_combo_box_widgets):
+        (moz_gtk_get_combo_box_entry_inner_widgets):
+        (moz_gtk_get_combo_box_entry_arrow):
+        (ensure_combo_box_entry_widgets):
+        (ensure_toolbar_widget):
+        (ensure_menu_bar_item_widget):
+        (ensure_menu_popup_widget):
+        (ensure_menu_item_widget):
+        (ensure_image_menu_item_widget):
+        (ensure_menu_separator_widget):
+        (ensure_check_menu_item_widget):
+        (ensure_tree_header_cell_widget):
+        (moz_gtk_entry_paint):
+
+2009-01-26  David Hyatt  <hyatt@apple.com>
+
+        Change display:run-in handling so that we no longer reuse RenderBlock as though it is an inline flow.
+        Instead we create a new RenderInline, move the RenderBlock's children underneath it, and then set the
+        inline as the new element's renderer.
+
+        Reviewed by Dan Bernstein
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::handleRunInChild):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::renderName):
+
+2009-01-26  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23480
+        Add missing method stubs to BackForwardListChromium.
+
+        * history/BackForwardListChromium.cpp:
+        (WebCore::BackForwardList::backItem):
+        (WebCore::BackForwardList::forwardItem):
+
+2009-01-25  Darin Adler  <darin@apple.com>
+
+        Try to fix Tiger buildbot.
+
+        * WebCore.xcodeproj/project.pbxproj: Turn off cast-qual for WebDashboardRegion.m.
+        * page/mac/WebDashboardRegion.m:
+        (typeName): Added.
+        (-[WebDashboardRegion description]): Use typeName.
+        (-[WebDashboardRegion isEqual:]): Added comment.
+
+2009-01-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23535
+        Strengthen debug checks in KURL
+
+        Covered (and prompted) by existing tests.
+
+        * platform/KURL.cpp:
+        (WebCore::checkEncodedString): Check that the first character of the URL is an allowed
+        first scheme character, not just that it isn't a slash.
+        (WebCore::KURL::KURL): Assert that parsing didn't affect the string (which must be the case
+        because of parsing being idempotent).
+
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::create): Added a check for the URL being valid - if it is not, an
+        empty security origin is created.
+        (WebCore::SecurityOrigin::createFromString): Parse the string as URL, do not just convert
+        it - it is not guaranteed to be properly encoded.
+
+        * dom/Document.cpp: (WebCore::Document::updateBaseURL): As documentURI is an arbitrary
+        string, it needs to be parsed into an URL, not just converted into one.
+
+        * html/CanvasRenderingContext2D.cpp: (WebCore::CanvasRenderingContext2D::createPattern):
+        Create the security origin with createFromString() instead of create(). I do not know where
+        the string comes from and whether it might not be properly encoded, but this change can't
+        hurt, and makes the code slightly more clear.
+
+        * xml/XMLHttpRequest.cpp: (WebCore::XMLHttpRequest::accessControlCheck): Create the security
+        origin with createFromString() instead of create(). The string comes from an HTTP response
+        header, so it may not be a properly encoded URL.
+
+        * loader/DocLoader.cpp: (WebCore::DocLoader::requestResource): Do not try to request using
+        invalid URLs.
+
+        * page/DOMWindow.cpp: (WebCore::DOMWindow::postMessage): Updated to call
+        SecurityOrigin::createFromString() (no change in behavior).
+
+2009-01-25  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Dan Bernstein.
+
+        Improve the consistency of settings in our .xcconfig files.
+
+        * Configurations/Base.xcconfig: Enable GCC_OBJC_CALL_CXX_CDTORS to match other projects,
+        and handle all cases in GCC_GENERATE_DEBUGGING_SYMBOLS.
+
+2009-01-25  David Hyatt  <hyatt@apple.com>
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23524, lots of missing content in table sections.
+
+        The new table code created a bug involving  markAllDescendantsWithFloatsForLayout, namely that it could
+        end up marking ancestors of a block as needing layout when that block was still in the process of
+        doing a layout.
+
+        The fix is to add a parameter to markAllDescendantsWithFloatsForLayout that says whether or not
+        we are "mid-layout."  If this flag is set, then the method will make sure to do only local dirtying
+        of objects to avoid accidentally marking a clean ancestor as needing layout again.
+
+        Ultimately the second parameter to setNeedsLayout and setChildNeedsLayout should just be removed,
+        with a check of whether or not we are mid-layout being done by those methods instead.
+
+        Reviewed by Oliver Hunt
+
+        Added fast/repaint/dynamic-table-vertical-alignment-change.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::clearFloatsIfNeeded):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::markAllDescendantsWithFloatsForLayout):
+        * rendering/RenderBlock.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::removeFromObjectLists):
+        * rendering/RenderObject.h:
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows):
+
+2009-01-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 23352: Turn on more compiler warnings in the Mac build
+        https://bugs.webkit.org/show_bug.cgi?id=23352
+
+        Turn on the following warnings:
+
+            -Wcast-qual
+            -Wextra-tokens
+            -Wformat=2
+            -Winit-self
+            -Wmissing-noreturn
+            -Wpacked
+            -Wrendundant-decls
+
+        * Configurations/Base.xcconfig: Added the new warnings. Switched to -Wextra instead of
+        -W for clarity since we don't have to support the older versions of gcc that require the
+        old -W syntax. Since we now use -Wformat=2, removed -Wformat-security. Also removed
+        -Wno-format-y2k since we can have that one on now.
+
+2009-01-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - fix <rdar://problem/6525618> REGRESSION (r39566): NewsFire crashes in
+          string hashing code when opening a Digg RSS article
+
+        Test: fast/loader/null-request-after-willSendRequest.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem): Null-check the request returned from
+        the client's willSendRequest method.
+
+2009-01-25  David Hyatt  <hyatt@apple.com>
+
+        Fix for <rdar://problem/6525392> REGRESSION (r40180): Scroll wheel events over text scroll the page
+        instead of the ancestor overflow (23525)
+
+        Make sure that we always call scroll() on the nearest enclosing RenderBox.  No test case is possible
+        here, since wheel scrolling is currently untestable (the offset varies from machine to machine).
+
+        Reviewed by Dan Bernstein
+
+        * page/EventHandler.cpp:
+        (WebCore::scrollAndAcceptEvent):
+        (WebCore::EventHandler::scrollOverflow):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::enclosingBox):
+        * rendering/RenderObject.h:
+
+2009-01-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 23538: REGRESSION (r39969): Garbage text instead of blank content rendered when plug-ins are disabled
+        https://bugs.webkit.org/show_bug.cgi?id=23538
+        rdar://problem/6523719
+
+        I'm not sure how to make a regression test for this, since it depends on plug-ins being disabled.
+
+        The main problem here is that when plug-ins were disabled, the code ignored the classId attribute and
+        the <embed> element entirely. That resulted in a page treating a Flash document as plain HTML rather
+        than doing fallback.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::createClassIdToTypeMap): Added. Broke this out into a separate function so we could get rid of an
+        inelegant if statement.
+        (WebCore::activeXType): Added. To avoid repeating the MIME type for ActiveX and possibly having a typo.
+        (WebCore::havePlugin): Added. Helper function to make sure we don't forget the null check.
+        (WebCore::serviceTypeForClassId): Give this function a return value since that's a more natural way to
+        return a string than an "out" parameter.  Fixed the logic to only prefer the ActiveX type over the
+        type guessed from the classId when there actually is an ActiveX plug-in to use. The old function assumed
+        there was one, which I presume right for Chrome on Windows when plug-ins are enabled, but wrong in many
+        other cases, and wrong all the time for all clients on Mac. We don't want to assume either way. Use the
+        new havePlugin function so we handle the case where pluginData is 0.
+        (WebCore::shouldUseEmbedDescendant): Renamed. Simplified the comment. Changed to use serviceTypeForClassId
+        instead of the old version that used an out parameter. Always use the <embed> if there isn't a plug-in
+        that knows how to handle <object> elements.
+        (WebCore::RenderPartObject::updateWidget): Removed null checks of pluginData. The two functions that
+        use this data still need to be called; they still do something even if no plug-ins are present. And
+        they have now been corrected to handle 0 properly.
+
+2009-01-25  Darin Adler  <darin@apple.com>
+
+        * rendering/RenderMenuList.cpp: Fix build by adding back needed include.
+
+2009-01-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23352: Turn on more compiler warnings in the Mac build
+        https://bugs.webkit.org/show_bug.cgi?id=23352
+
+        Fourth patch: Deal with the last few stray warnings.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::firstLineBlock): Handle the const_cast a little better.
+        Also make the local variable be a RenderBlock so the cast is closer to the code
+        that guarantees it's correct.
+
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::writeStyle): Put the enum into a local variable that's a built-in
+        type before using it with TextStream, so we don't get a warning due to -Wsign-promo.
+
+2009-01-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23522: use checked casts for render tree
+        https://bugs.webkit.org/show_bug.cgi?id=23522
+
+        Step one: RenderText.
+
+        Also change set of RenderFlow* to be a ListHashSet as the comment in the
+        header indicated.
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::setData): Use toRenderText.
+        (WebCore::CharacterData::appendData): Ditto.
+        (WebCore::CharacterData::insertData): Ditto.
+        (WebCore::CharacterData::deleteData): Ditto.
+        (WebCore::CharacterData::replaceData): Ditto.
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::getUpperLeftCorner): Ditto.
+        (WebCore::ContainerNode::getLowerRightCorner): Ditto.
+        * dom/Position.cpp:
+        (WebCore::nextRenderedEditable): Ditto.
+        (WebCore::previousRenderedEditable): Ditto.
+        (WebCore::Position::renderedOffset): Ditto. Also use function members
+        instead of data members of InlineTextBox.
+        (WebCore::Position::upstream): Ditto.
+        (WebCore::Position::downstream): Ditto.
+        (WebCore::Position::hasRenderedNonAnonymousDescendantsWithHeight): Ditto.
+        (WebCore::Position::inRenderedText): Ditto.
+        (WebCore::Position::isRenderedCharacter): Ditto.
+        (WebCore::searchAheadForBetterMatch): Ditto.
+        (WebCore::Position::getInlineBoxAndOffset): Ditto.
+
+        * dom/Range.cpp: Added include of VisiblePosition.h now that it's no longer
+        included in RenderObject.h.
+
+        * dom/Text.cpp:
+        (WebCore::Text::splitText): Use toRenderText.
+        (WebCore::Text::recalcStyle): Ditto.
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::deleteInsignificantText): Ditto.
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::debugRenderer): Ditto.
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::handleTextNode): Ditto.
+        (WebCore::TextIterator::handleTextBox): Ditto.
+        (WebCore::TextIterator::emitText): Ditto.
+        (WebCore::SimplifiedBackwardsTextIterator::handleTextNode): Ditto.
+
+        * editing/VisiblePosition.cpp: Added include of FloatQuad.h now that it's
+        no longer included in RenderObject.h.
+        * inspector/InspectorController.cpp: Ditto.
+        * page/Frame.cpp: Ditto.
+        * rendering/RenderBox.cpp: Ditto.
+        * rendering/RenderInline.cpp: Ditto.
+        * rendering/RenderPath.cpp: Ditto.
+        * rendering/RenderSVGContainer.cpp: Ditto.
+        * rendering/RenderSVGImage.cpp: Ditto.
+        * rendering/RenderSVGInlineText.cpp: Ditto.
+        * rendering/RenderSVGTSpan.cpp: Ditto.
+        * rendering/RenderSVGText.cpp: Ditto.
+        * rendering/RenderSVGTextPath.cpp: Ditto.
+        * rendering/RenderTableCell.cpp: Ditto.
+        * rendering/RenderView.cpp: Ditto.
+
+        * editing/visible_units.cpp:
+        (WebCore::startPositionForLine): Use function members instead of data
+        members of InlineTextBox.
+        (WebCore::endPositionForLine): Ditto.
+        (WebCore::startOfParagraph): Use toRenderText.
+        (WebCore::endOfParagraph): Ditto.
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored): Use toRenderText.
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally): Ditto.
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::deleteLine): Ditto.
+        (WebCore::InlineTextBox::extractLine): Ditto.
+        (WebCore::InlineTextBox::attachLine): Ditto.
+        (WebCore::InlineTextBox::placeEllipsisBox): Ditto.
+        (WebCore::InlineTextBox::paintDecoration): Ditto.
+        (WebCore::InlineTextBox::paintCompositionUnderline): Ditto.
+        (WebCore::InlineTextBox::offsetForPosition): Ditto.
+        (WebCore::InlineTextBox::positionForOffset): Ditto.
+
+        * rendering/InlineTextBox.h: Made most members private. Use toRenderText.
+
+        * rendering/RenderArena.cpp:
+        (WebCore::RenderArena::allocate): Use static_cast instead of C-style cast.
+        (WebCore::RenderArena::free): Ditto.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addContinuationWithOutline): Use ListHashSet<RenderFlow*>
+        instead of RenderFlowSequencedSet.
+        (WebCore::RenderBlock::paintContinuationOutlines): Ditto.
+        (WebCore::stripTrailingSpace): Ditto.
+        (WebCore::RenderBlock::calcInlinePrefWidths): Ditto.
+        (WebCore::RenderBlock::updateFirstLetter): Ditto.
+
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::addChild): Use toRenderText.
+
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::dirtyLinesFromChangedChild): Use ListHashSet<RenderFlow*>
+        instead of RenderFlowSequencedSet.
+        (WebCore::RenderFlow::paintLines): Ditto.
+
+        * rendering/RenderMenuList.cpp: Removed some unneeded includes.
+
+        * rendering/RenderMenuList.h: Added now-needed forward declaration of RenderText.
+        Made more members private.
+
+        * rendering/RenderObject.cpp: Updated includes.
+        (WebCore::RenderObject::isEditable): Use toRenderText.
+        (WebCore::RenderObject::positionForPoint): Made non-inline so we wouldn't have to
+        include VisiblePosition.h in the header just for this.
+
+        * rendering/RenderObject.h: Removed unneeded includes and forward declarations.
+        Changed special vertical position values to be constants rather than an enum.
+        Eliminated RenderFlowSequencedSet, and changed clients to use ListHashSet<RenderFlow*>.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::findNextInlineTextBox): Use function members instead of
+        data members of InlineTextBox.
+        (WebCore::RenderText::positionForCoordinates): Ditto.
+        (WebCore::isInlineFlowOrEmptyText): Use toRenderText.
+        (WebCore::RenderText::previousCharacter): Use function members instead of
+        data members of InlineTextBox.
+        (WebCore::RenderText::position): Ditto.
+        (WebCore::RenderText::caretMinOffset): Ditto.
+        (WebCore::RenderText::caretMaxOffset): Ditto.
+        (WebCore::RenderText::caretMaxRenderedOffset): Ditto.
+
+        * rendering/RenderText.h: Added definition of toRenderText.
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::textWithHardLineBreaks): Use toRenderText.
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<): Use toRenderText and toRenderBox.
+        (WebCore::writeTextRun): Ditto.
+        (WebCore::write): Ditto.
+
+        * rendering/bidi.cpp:
+        (WebCore::InlineIterator::increment): Use toRenderText.
+        (WebCore::InlineIterator::current): Ditto.
+        (WebCore::checkMidpoints): Ditto.
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine): Ditto.
+        (WebCore::RenderBlock::layoutInlineChildren): Ditto.
+        (WebCore::RenderBlock::determineStartPosition): Ditto.
+        (WebCore::shouldSkipWhitespaceAfterStartObject): Ditto.
+        (WebCore::RenderBlock::findNextLineBreak): Ditto.
+
+2009-01-25  Thiago Macieira  <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix gcc compiler warning (deprecated conversion from constant string to char*)
+
+        "" cannot be stored in a char*
+
+        * plugins/PluginStream.cpp:
+        (WebCore::PluginStream::destroyStream):
+
+2009-01-24  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/5954398> REGRESSION: 1.1% PLT regression from 33577 and 33578 (encoding fixes)
+
+        Changed single argument KURL constructors back to always expect an already encoded string,
+        eliminating extra conversions.
+
+        This is a rather unstable situation, as it is often unclear whether a given string is safe
+        to convert to KURL without resolving. I think that going forward, the solution is to try to
+        keep encoded URLs as KURL instances, and not as strings.
+
+        * platform/KURL.h: Updated comments.
+
+        * platform/KURL.cpp:
+        (WebCore::KURL::KURL): In debug builds, verify that the passed string is ASCII-only. The
+        intention is to verify that it is already parsed and encoded by KURL or equivalent code, but
+        since encoding is scheme-dependent, such a verification would be quite complicated.
+        Don't encode the string as UTF-8, as it supposed to be ASCII-only.
+        Removed a hack that made strings beginning with "/" turn into "file:" URLs. I didn't find
+        any reason for it to exist, but I saw several cases where this code path was taken
+        inadvertently (see examples in LayoutTests/ChangeLog).
+        (WebCore::KURL::setProtocol): Using a user-provided string without validation or encoding
+        is clearly wrong here (e.g., the "protocol" can be set to a full URL, effectively replacing
+        the old one), and an already encoded string is expected by parse().
+        In debug builds, non-ASCII input will make an assertion in parse() fail. Added a FIXME.
+        (WebCore::KURL::setHost): Ditto.
+        (WebCore::KURL::setPort): Ditto.
+        (WebCore::KURL::setHostAndPort): Ditto.
+        (WebCore::KURL::setUser): Ditto.
+        (WebCore::KURL::setPass): Ditto.
+        (WebCore::KURL::setRef): Ditto.
+        (WebCore::KURL::setQuery): Ditto.
+        (WebCore::KURL::setPath): Ditto.
+        (WebCore::KURL::parse): Verify that the passed string is already encoded.
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::parseMappedAttribute):
+        (WebCore::HTMLLinkElement::process):
+        * html/HTMLLinkElement.h:
+        Changed to avoid using invalid URLs (this was causing problems on DNS prefetch tests, see
+        LayoutTests/ChangeLog).
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::init): Create an empty KURL without indirection for a small speedup.
+        (WebCore::FrameLoader::requestFrame): Resolve and encode javascript URLs properly, now that
+        String to KURL conversion requires the string to be already encoded.
+
+        * page/DOMWindow.cpp: (WebCore::DOMWindow::postMessage): Resolve and encode the origin.
+        HTML5 seems a little unclear on how this should work (it talks about "either parsing it as
+        a URL, or resolving it", and then somehow compares unaltered targetOrigin string to a
+        security origin object), so I just made the code as close to what we already had as possible.
+
+2009-01-24  Darin Adler  <darin@apple.com>
+
+        Try to fix Qt build.
+
+        * WebCore.pro: Added JSTextCustom.cpp.
+
+2009-01-23  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23467
+
+        Change styleAvailable functionality to be a linked list
+        rather than scanning every CompositeAnimation for
+        Animations that are waiting for styleAvailable. This has
+        potential for large performance improvement in cases where
+        there are many animations firing at once. But it will also
+        help in my next fix, which is to synchronize software and
+        accelerated animations.
+
+        I also changed slightly when the beginAnimationUpdate and
+        endAnimationUpdate calls are made. But this has no real
+        effect on performance or behavior.
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        (WebCore::Document::updateRendering):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::AnimationBase):
+        (WebCore::AnimationBase::~AnimationBase):
+        (WebCore::AnimationBase::updateStateMachine):
+        * page/animation/AnimationBase.h:
+        (WebCore::AnimationBase::next):
+        (WebCore::AnimationBase::setNext):
+        (WebCore::AnimationBase::styleAvailable):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
+        (WebCore::AnimationControllerPrivate::addToStyleAvailableWaitList):
+        (WebCore::AnimationControllerPrivate::removeFromStyleAvailableWaitList):
+        (WebCore::AnimationControllerPrivate::styleAvailable):
+        (WebCore::AnimationController::AnimationController):
+        (WebCore::AnimationController::endAnimationUpdate):
+        (WebCore::AnimationController::addToStyleAvailableWaitList):
+        (WebCore::AnimationController::removeFromStyleAvailableWaitList):
+        * page/animation/AnimationController.h:
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::addToStyleAvailableWaitList):
+        (WebCore::CompositeAnimationPrivate::removeFromStyleAvailableWaitList):
+        (WebCore::CompositeAnimation::addToStyleAvailableWaitList):
+        (WebCore::CompositeAnimation::removeFromStyleAvailableWaitList):
+        * page/animation/CompositeAnimation.h:
+
+2009-01-24  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6368059> REGRESSION: URL encoding problems on http://www.cineman.ch
+
+        Test: http/tests/xmlhttprequest/encode-request-url-2.html
+
+        * platform/KURL.cpp:
+        (WebCore::appendASCII): Added a helper function.
+        (WebCore::KURL::KURL): Explicitly encode the URL to call two-argument parse() with better
+        specified behavior.
+        (WebCore::KURL::init): Ditto. This avoids trying to round-trip an URL encoded into a byte
+        stream, but not yet transformed to ASCII-only using percent escapes. Since different parts
+        of the byte stream can use different encodings, round-tripping is not possible.
+        (WebCore::KURL::parse): Reverted an earlier change that made the single-argument version of
+        this function convert the string to utf-8. I think that on the remanining code paths, it is
+        correct to assume that the string is all ASCII, but I'm not yet confident enough to drop a
+        FIXME warning.
+
+2009-01-24  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix after r40170
+
+        * GNUmakefile.am: Removed editing/RemoveNodeAttributeCommand.cpp
+        and editing/RemoveNodeAttributeCommand.h
+
+2009-01-23  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build after r40205.
+
+        * WebCore.pro:
+
+2009-01-23  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler
+
+        In CachedPage, break off per-Frame pieces of data into a CachedFrame object.
+
+        * GNUmakefile.am:
+        * WebCore.base.exp:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+
+        * history/CachedFrame.cpp: Added.
+        (WebCore::cachedFrameCounter):
+        (WebCore::CachedFrame::CachedFrame):
+        (WebCore::CachedFrame::~CachedFrame):
+        (WebCore::CachedFrame::restore):
+        (WebCore::CachedFrame::clear):
+        (WebCore::CachedFrame::setCachedFramePlatformData):
+        (WebCore::CachedFrame::cachedFramePlatformData):
+        * history/CachedFrame.h: Added.
+        (WebCore::CachedFrame::document):
+        (WebCore::CachedFrame::documentLoader):
+        (WebCore::CachedFrame::view):
+        (WebCore::CachedFrame::mousePressNode):
+        (WebCore::CachedFrame::url):
+        (WebCore::CachedFrame::domWindow):
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::CachedPage):
+        (WebCore::CachedPage::restore):
+        (WebCore::CachedPage::clear):
+        (WebCore::CachedPage::setCachedFramePlatformData):
+        (WebCore::CachedPage::cachedFramePlatformData):
+        * history/CachedPage.h:
+        (WebCore::CachedPage::document):
+        (WebCore::CachedPage::documentLoader):
+        (WebCore::CachedPage::view):
+        (WebCore::CachedPage::mousePressNode):
+        (WebCore::CachedPage::url):
+        (WebCore::CachedPage::domWindow):
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::cachePageForHistoryItem): Setting the DocumentLoader independently of
+          creating a CachedPage was a historical relic.  Take the opportunity to clean that up.
+
+2009-01-23  David Hyatt  <hyatt@apple.com>
+
+        Add ASSERTs to catch anyone trying to obtain the width/height of an inline flow.  Fix up all the places
+        that triggered the ASSERT (since all of these places are effectively regressions from my landing that
+        devirtualized width()/height()).
+
+        Reviewed by Adele
+
+        * dom/Position.cpp:
+        (WebCore::Position::hasRenderedNonAnonymousDescendantsWithHeight):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::clientWidth):
+        (WebCore::RenderBox::clientHeight):
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+        (WebCore::RenderBox::absoluteOutlineBounds):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::width):
+        (WebCore::RenderBox::height):
+        (WebCore::RenderBox::size):
+        (WebCore::RenderBox::frameRect):
+        (WebCore::RenderBox::borderBoundingBox):
+        * rendering/RenderFlow.h:
+        (WebCore::RenderFlow::borderBoundingBox):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::styleWillChange):
+        * rendering/RenderScrollbarPart.h:
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::isKeyboardFocusable):
+
+2009-01-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Bug 23352: Turn on more compiler warnings in the Mac build
+        https://bugs.webkit.org/show_bug.cgi?id=23352
+
+        Second patch: Slightly less simple cases of various warnings.
+
+        * bridge/jni/jni_runtime.h:
+        (JSC::Bindings::JavaString::_commonInit): Use reinterpret_cast here and avoid casting
+        away const.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::PendingCallbacks::appendStartElementNSCallback): Use static_cast instead of
+        reinterpret_cast; this is casting the result of malloc, and the idiom is to use
+        static_cast, which works because we're casting from void*.
+        (WebCore::PendingCallbacks::PendingStartElementNSCallback::call): Use const_cast instead
+        C-style casts.
+
+        * xml/XSLTUnicodeSort.cpp:
+        (inlineXSLTTransformError): Tweak soft linking of xsltTransformError to use a macro
+        instead of redefining the function.
+
+2009-01-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Bug 23475: fast/text/find-backwards.html fails with ICU disabled SearchBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=23475
+
+        * editing/TextIterator.cpp:
+        (WebCore::SearchBuffer::search): Set the character start flag to false to
+        ensure we won't ever return the same result twice. There are other ways we
+        could accomplish this, mentioned in the comment, but this one was the smallest
+        and cleanest I could think of.
+
+2009-01-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Bug 23510: REGRESSION (r40171): CDATASection objects not getting proper JavaScript wrappers
+        https://bugs.webkit.org/show_bug.cgi?id=23510
+
+        That patch fixed the optimization that's supposed to give a faster path for
+        allocating the wrappers for DOM Text objects. But CDATASection is the one
+        subclass of Text objects.
+
+        * GNUmakefile.am: Added JSCDATASectionCustom.cpp.
+        * WebCore.scons: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+        * bindings/js/JSCDATASectionCustom.cpp: Copied from bindings/js/JSTextCustom.cpp.
+        (WebCore::toJSNewlyCreated): Changed to do CDATASection, not Text.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Added another toJSNewlyCreated function
+        for CDATASection. We don't want to have to check when creating a wrapper for a
+        Text object whether it's a CDATASection object or not, so we need to do this overload
+        at compile time.
+
+2009-01-23  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Add a base class for WML form control elements: WMLFormControlElement (as it's designed in HTML as well).
+        WMLFormControlElement inherits from WMLElement and FormControlElement (just like the HTMLFormControlElement equivalent).
+
+        WMLInputElement / WMLOptionElement / WMLOptGroupElement are supposed to inherit from the new WMLFormControlElement class.
+        Now WMLInputElement & WMLOptGroupElement only inherit from WMLElement and FormControlElement, but WMLOptionElement inherits
+        from WMLEventHandlingElement (which in turn inherits from WMLElement) and FormControlElement. In order to introduce a shared
+        base class, WMLEventHandlingElement is no longer allowed to inherit from WMLElement directly. Instead it should turn into
+        another base class, just like FormControlElement.
+
+        Add a base class for form control elements 'with state': FormControlElementWithState, serving as base class for
+        HTMLFormControlElementWithState and WMLFormControlElementWithState. -> Make Document operate on FormControlElementWithState
+        objects instead of HTMLFormControlElementWithState objects, to support save/restore control state for non HTMLFormControlElements.
+
+        Rename isGenericFormElement() to isFormControlElement(), and move it to Element.h
+        Add new virtual function isFormControlElementWithState() to Element.h.
+
+        * GNUmakefile.am:
+        * WebCore.order:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/Document.cpp:
+        (WebCore::Document::formElementsState):
+        * dom/Document.h:
+        (WebCore::Document::registerFormElementWithState):
+        (WebCore::Document::unregisterFormElementWithState):
+        * dom/Element.h:
+        (WebCore::Element::isFormControlElement):
+        (WebCore::Element::isFormControlElementWithState):
+        * dom/FormControlElement.cpp:
+        (WebCore::toFormControlElement):
+        * dom/FormControlElement.h:
+        * dom/FormControlElementWithState.cpp: Added.
+        (WebCore::FormControlElementWithState::registerFormControlElementWithState):
+        (WebCore::FormControlElementWithState::unregisterFormControlElementWithState):
+        (WebCore::FormControlElementWithState::finishParsingChildren):
+        (WebCore::toFormControlElementWithState):
+        * dom/FormControlElementWithState.h: Added.
+        (WebCore::FormControlElementWithState::~FormControlElementWithState):
+        (WebCore::FormControlElementWithState::FormControlElementWithState):
+        * html/HTMLElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElementWithState::HTMLFormControlElementWithState):
+        (WebCore::HTMLFormControlElementWithState::~HTMLFormControlElementWithState):
+        (WebCore::HTMLFormControlElementWithState::willMoveToNewOwnerDocument):
+        (WebCore::HTMLFormControlElementWithState::didMoveToNewOwnerDocument):
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::isFormControlElement):
+        (WebCore::HTMLFormControlElementWithState::isFormControlElementWithState):
+        (WebCore::HTMLFormControlElementWithState::toFormControlElement):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::formElementIndex):
+        * html/HTMLLabelElement.cpp:
+        (WebCore::HTMLLabelElement::correspondingControl):
+        * html/HTMLLegendElement.cpp:
+        (WebCore::HTMLLegendElement::formElement):
+        * page/Frame.cpp:
+        (WebCore::Frame::searchForLabelsBeforeElement):
+        (WebCore::scanForForm):
+        (WebCore::Frame::currentForm):
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::searchForLabelsBeforeElement):
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::WMLCardElement):
+        (WebCore::WMLCardElement::parseMappedAttribute):
+        (WebCore::WMLCardElement::insertedIntoDocument):
+        * wml/WMLCardElement.h:
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::insertedIntoDocument):
+        * wml/WMLElement.h:
+        (WebCore::WMLElement::isWMLElement):
+        * wml/WMLEventHandlingElement.cpp:
+        (WebCore::WMLEventHandlingElement::WMLEventHandlingElement):
+        (WebCore::WMLEventHandlingElement::registerDoElement):
+        (WebCore::toWMLEventHandlingElement):
+        * wml/WMLEventHandlingElement.h:
+        * wml/WMLFormControlElement.cpp: Added.
+        (WebCore::WMLFormControlElement::WMLFormControlElement):
+        (WebCore::WMLFormControlElement::~WMLFormControlElement):
+        (WebCore::WMLFormControlElementWithState::WMLFormControlElementWithState):
+        (WebCore::WMLFormControlElementWithState::~WMLFormControlElementWithState):
+        * wml/WMLFormControlElement.h: Added.
+        (WebCore::WMLFormControlElement::isFormControlElement):
+        (WebCore::WMLFormControlElement::valueMatchesRenderer):
+        (WebCore::WMLFormControlElement::setValueMatchesRenderer):
+        (WebCore::WMLFormControlElement::name):
+        (WebCore::WMLFormControlElementWithState::isFormControlElementWithState):
+        (WebCore::WMLFormControlElementWithState::toFormControlElement):
+        * wml/WMLInputElement.cpp:
+        (WebCore::WMLInputElement::WMLInputElement):
+        (WebCore::WMLInputElement::type):
+        * wml/WMLInputElement.h:
+        * wml/WMLOnEventElement.cpp:
+        (WebCore::WMLOnEventElement::registerTask):
+        * wml/WMLOptGroupElement.cpp:
+        (WebCore::WMLOptGroupElement::WMLOptGroupElement):
+        (WebCore::WMLOptGroupElement::type):
+        * wml/WMLOptGroupElement.h:
+        * wml/WMLOptionElement.cpp:
+        (WebCore::WMLOptionElement::WMLOptionElement):
+        (WebCore::WMLOptionElement::type):
+        * wml/WMLOptionElement.h:
+        * wml/WMLTemplateElement.cpp:
+        (WebCore::WMLTemplateElement::WMLTemplateElement):
+        (WebCore::WMLTemplateElement::parseMappedAttribute):
+        * wml/WMLTemplateElement.h:
+
+2009-01-23  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 23509: Crash at -[WebCoreAXObject doAXNextSentenceEndTextMarkerForTextMarker:]
+        https://bugs.webkit.org/show_bug.cgi?id=23509
+
+        Add null checking in makeRange instead of AX code
+
+        * editing/VisiblePosition.cpp:
+        (WebCore::makeRange):
+        * page/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::nextSentenceEndPosition):
+        (WebCore::AccessibilityObject::previousSentenceStartPosition):
+
+2009-01-23  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Gtk build too after removal of RenderBox::toConstRenderBox
+
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::baselinePosition):
+
+2009-01-23  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build after rename of RenderBox::toConstRenderBox -> toRenderBox
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::baselinePosition):
+
+2009-01-23  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build after r40168.
+
+        * WebCore.pro:
+
+2009-01-23  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Darin Adler
+
+        Rename CachedPagePlatformData to CachedFramePlatformData to more accurately reflect its true role.
+
+        * GNUmakefile.am:
+        * WebCore.base.exp:
+        * WebCore.order:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        * history/CachedFramePlatformData.h: Copied from WebCore/history/CachedPagePlatformData.h.
+        (WebCore::CachedFramePlatformData::~CachedFramePlatformData):
+        * history/CachedPagePlatformData.h: Removed.
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::clear):
+        (WebCore::CachedPage::setCachedFramePlatformData):
+        (WebCore::CachedPage::cachedFramePlatformData):
+        * history/CachedPage.h:
+
+2009-01-23  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Fix drawing in situations where sub-portions of the bitmap are to be
+        drawn to the screen.
+
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::draw):
+
+2009-01-23  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Build fixes for recent changes.
+
+        * WebCoreSources.bkl:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::invalidateWindowlessPluginRect):
+
+2009-01-23  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adele Peterson
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23407
+
+        Implement QTMovieWin::hasVideo so the controller on an audio-only <video> element
+        is never hidden (as with an <audio> element).
+
+        Test: media/video-controls-visible-audio-only.html
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp:
+        (WebCore::MediaPlayerPrivate::hasVideo):
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::hasVideo):
+        * platform/graphics/win/QTMovieWin.h:
+
+2009-01-23  David Hyatt  <hyatt@apple.com>
+
+        Make toRenderBox a non-member function.  Rename toConstRenderBox to just also be called toRenderBox.
+
+        Reviewed by Oliver Hunt
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::sizingBox):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::getUpperLeftCorner):
+        (WebCore::ContainerNode::getLowerRightCorner):
+        * dom/Element.cpp:
+        (WebCore::Element::scrollByUnits):
+        * dom/Position.cpp:
+        (WebCore::endsOfNodeAreVisuallyDistinctPositions):
+        (WebCore::Position::hasRenderedNonAnonymousDescendantsWithHeight):
+        (WebCore::Position::isCandidate):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+        * editing/EditorCommand.cpp:
+        (WebCore::verticalScrollDistance):
+        * editing/TextIterator.cpp:
+        (WebCore::shouldEmitExtraNewlineForNode):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::isFocusable):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::width):
+        (WebCore::HTMLFrameElementBase::height):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseDraggedEvent):
+        (WebCore::EventHandler::autoscrollTimerFired):
+        (WebCore::EventHandler::updateAutoscrollRenderer):
+        (WebCore::EventHandler::stopAutoscrollTimer):
+        (WebCore::EventHandler::scrollOverflow):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc):
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::adjustPosition):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::renderBox):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::clearFloats):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::offsetFromContainer):
+        (WebCore::RenderBox::computeAbsoluteRepaintRect):
+        (WebCore::RenderBox::containingBlockWidthForPositioned):
+        (WebCore::RenderBox::containingBlockHeightForPositioned):
+        (WebCore::RenderBox::calcAbsoluteHorizontal):
+        (WebCore::RenderBox::calcAbsoluteVertical):
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced):
+        (WebCore::RenderBox::calcAbsoluteVerticalReplaced):
+        * rendering/RenderBox.h:
+        (WebCore::toRenderBox):
+        (WebCore::RenderBox::previousSiblingBox):
+        (WebCore::RenderBox::nextSiblingBox):
+        (WebCore::RenderBox::parentBox):
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::absoluteClippedOverflowRect):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::resize):
+        (WebCore::RenderLayer::boundingBox):
+        * rendering/RenderObject.cpp:
+        (WebCore::addLayers):
+        (WebCore::RenderObject::removeLayers):
+        (WebCore::RenderObject::moveLayers):
+        (WebCore::RenderObject::findNextLayer):
+        (WebCore::RenderObject::enclosingLayer):
+        (WebCore::RenderObject::setNeedsLayout):
+        (WebCore::RenderObject::setNeedsPositionedMovementLayout):
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):
+        (WebCore::RenderObject::getAbsoluteRepaintRectWithOutline):
+        (WebCore::RenderObject::computeAbsoluteRepaintRect):
+        (WebCore::RenderObject::localToAbsolute):
+        (WebCore::RenderObject::absoluteToLocal):
+        (WebCore::RenderObject::localToAbsoluteQuad):
+        (WebCore::RenderObject::offsetFromContainer):
+        (WebCore::RenderObject::removeFromObjectLists):
+        (WebCore::RenderObject::destroy):
+        (WebCore::RenderObject::updateHitTestResult):
+        (WebCore::RenderObject::addDashboardRegions):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::hitTestMediaControlPart):
+        (WebCore::RenderTheme::baselinePosition):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::hitTestMediaControlPart):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::externalRepresentation):
+        * rendering/bidi.cpp:
+        (WebCore::inlineWidth):
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+        (WebCore::requiresLineBox):
+        (WebCore::RenderBlock::findNextLineBreak):
+        * svg/SVGLength.cpp:
+        (WebCore::SVGLength::PercentageOfViewport):
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::isKeyboardFocusable):
+        * wml/WMLInputElement.cpp:
+        (WebCore::isInputFocusable):
+
+2009-01-23  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 23509: Crash at -[WebCoreAXObject doAXNextSentenceEndTextMarkerForTextMarker:]
+        https://bugs.webkit.org/show_bug.cgi?id=23509
+
+        Add null checking around next/previous sentence retrieval in AX code
+
+        * page/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::nextSentenceEndPosition):
+        (WebCore::AccessibilityObject::previousSentenceStartPosition):
+
+2009-01-23  David Hyatt  <hyatt@apple.com>
+
+        Fix for <rdar://problem/6518850> REGRESSION: hover feedback not showing on many sites
+
+        Inline flow repainting was broken because it relied on width() and height().  Give RenderFlow a linesBoundingBox
+        method for obtaining a reasonable bounding box to use for repainting.  Eliminate the methods from RenderInline
+        since compacts/run-ins need them too, so putting them on RenderFlow is necessary.
+
+        For consistency, change RenderText's version of these methods into the single linesBoundingBox method as
+        well.
+
+        Reviewed by Oliver Hunt
+
+        * WebCore.base.exp:
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::getUpperLeftCorner):
+        (WebCore::ContainerNode::getLowerRightCorner):
+        * dom/Position.cpp:
+        (WebCore::Position::hasRenderedNonAnonymousDescendantsWithHeight):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::containingBlockHeightForPositioned):
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::absoluteClippedOverflowRect):
+        (WebCore::RenderFlow::linesBoundingBox):
+        * rendering/RenderFlow.h:
+        * rendering/RenderInline.cpp:
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::offsetWidth):
+        (WebCore::RenderInline::offsetHeight):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::linesBoundingBox):
+        * rendering/RenderText.h:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::write):
+
+2009-01-23  David Hyatt  <hyatt@apple.com>
+
+        Move layer() into RenderBox and make it non-virtual.  Move all of the scrolling functions from RenderObject
+        to RenderBox and devirtualize as many as possible.  Clean up styleWillChange to factor code specific to
+        RenderBox and RenderBlock into their appropriate subclasses.  Stubbed out an empty styleWillChange on
+        RenderText, since none of the work done in styleWillChange was relevant to text nodes.
+
+        Reviewed by Sam Weinig
+
+        * dom/Document.cpp:
+        (WebCore::Document::elementFromPoint):
+        (WebCore::Document::renderView):
+        (WebCore::Document::prepareMouseEvent):
+        * dom/Document.h:
+        * dom/Element.cpp:
+        (WebCore::Element::scrollByUnits):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::contains):
+        * html/HTMLMarqueeElement.cpp:
+        (WebCore::HTMLMarqueeElement::start):
+        (WebCore::HTMLMarqueeElement::stop):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::topRenderer):
+        (WebCore::AccessibilityRenderObject::visiblePositionForPoint):
+        (WebCore::AccessibilityRenderObject::doAccessibilityHitTest):
+        * page/AccessibilityRenderObject.h:
+        * page/EventHandler.cpp:
+        (WebCore::scrollAndAcceptEvent):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseDraggedEvent):
+        (WebCore::EventHandler::updateSelectionForMouseDrag):
+        (WebCore::EventHandler::autoscrollTimerFired):
+        (WebCore::EventHandler::updateAutoscrollRenderer):
+        (WebCore::EventHandler::stopAutoscrollTimer):
+        (WebCore::EventHandler::scrollOverflow):
+        (WebCore::EventHandler::handleWheelEvent):
+        (WebCore::EventHandler::hoverTimerFired):
+        * page/Frame.cpp:
+        (WebCore::Frame::clearTimers):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::styleWillChange):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleWillChange):
+        (WebCore::RenderBox::verticalScrollbarWidth):
+        (WebCore::RenderBox::horizontalScrollbarHeight):
+        (WebCore::RenderBox::scroll):
+        (WebCore::RenderBox::canBeProgramaticallyScrolled):
+        (WebCore::RenderBox::autoscroll):
+        (WebCore::RenderBox::panScroll):
+        (WebCore::RenderBox::offsetFromContainer):
+        (WebCore::RenderBox::computeAbsoluteRepaintRect):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::layer):
+        (WebCore::RenderBox::requiresLayer):
+        (WebCore::RenderBox::stopAutoscroll):
+        (WebCore::RenderBox::hasAutoVerticalScrollbar):
+        (WebCore::RenderBox::hasAutoHorizontalScrollbar):
+        (WebCore::RenderBox::scrollsOverflow):
+        (WebCore::RenderBox::scrollsOverflowX):
+        (WebCore::RenderBox::scrollsOverflowY):
+        (WebCore::RenderBox::includeVerticalScrollbarSize):
+        (WebCore::RenderBox::includeHorizontalScrollbarSize):
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::absoluteClippedOverflowRect):
+        (WebCore::RenderFlow::addFocusRingRects):
+        * rendering/RenderForeignObject.cpp:
+        * rendering/RenderForeignObject.h:
+        (WebCore::RenderForeignObject::requiresLayer):
+        * rendering/RenderInline.cpp:
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::requiresLayer):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::childrenClipRect):
+        (WebCore::RenderLayer::selfClipRect):
+        * rendering/RenderListBox.cpp:
+        * rendering/RenderListBox.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::addLayers):
+        (WebCore::RenderObject::removeLayers):
+        (WebCore::RenderObject::moveLayers):
+        (WebCore::RenderObject::findNextLayer):
+        (WebCore::RenderObject::enclosingLayer):
+        (WebCore::RenderObject::setNeedsLayout):
+        (WebCore::RenderObject::setNeedsPositionedMovementLayout):
+        (WebCore::RenderObject::computeAbsoluteRepaintRect):
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::localToAbsolute):
+        (WebCore::RenderObject::absoluteToLocal):
+        (WebCore::RenderObject::localToAbsoluteQuad):
+        (WebCore::RenderObject::offsetFromContainer):
+        (WebCore::RenderObject::destroy):
+        * rendering/RenderObject.h:
+        * rendering/RenderPath.cpp:
+        * rendering/RenderPath.h:
+        (WebCore::RenderPath::requiresLayer):
+        * rendering/RenderReplica.h:
+        (WebCore::RenderReplica::requiresLayer):
+        * rendering/RenderSVGContainer.cpp:
+        * rendering/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::requiresLayer):
+        * rendering/RenderSVGHiddenContainer.cpp:
+        * rendering/RenderSVGHiddenContainer.h:
+        (WebCore::RenderSVGHiddenContainer::requiresLayer):
+        * rendering/RenderSVGImage.cpp:
+        * rendering/RenderSVGImage.h:
+        (WebCore::RenderSVGImage::requiresLayer):
+        * rendering/RenderSVGInline.h:
+        (WebCore::RenderSVGInline::requiresLayer):
+        * rendering/RenderSVGInlineText.h:
+        (WebCore::RenderSVGInlineText::requiresLayer):
+        * rendering/RenderSVGText.cpp:
+        * rendering/RenderSVGText.h:
+        (WebCore::RenderSVGText::requiresLayer):
+        * rendering/RenderScrollbarPart.h:
+        (WebCore::RenderScrollbarPart::requiresLayer):
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::setCurrentPosition):
+        * rendering/RenderTableCell.cpp:
+        * rendering/RenderTableCell.h:
+        (WebCore::RenderTableCell::requiresLayer):
+        * rendering/RenderTableCol.h:
+        (WebCore::RenderTableCol::requiresLayer):
+        * rendering/RenderTableRow.h:
+        (WebCore::RenderTableRow::requiresLayer):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows):
+        * rendering/RenderText.h:
+        (WebCore::RenderText::styleWillChange):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::autoscroll):
+        (WebCore::RenderTextControl::scroll):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write):
+        (WebCore::externalRepresentation):
+
+2009-01-23  Anders Carlsson  <andersca@apple.com>
+
+        Fix tyop.
+
+        * editing/markup.cpp:
+        (WebCore::joinMarkups):
+
+2009-01-23  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        * Configurations/Base.xcconfig:
+        Fix GCC 4.0 build.
+
+        * editing/markup.cpp:
+        (WebCore::joinMarkups):
+        Pass a const reference to the vector.
+
+        * html/HTMLElement.cpp:
+        * platform/text/String.cpp:
+        Add comments indicating that these functions are for use in the debugger.
+
+2009-01-23  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Turn on -Wmissing-prototypes and fix the resulting warnings.
+
+        * Configurations/Base.xcconfig:
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::nonCachingStaticBackFunctionGetter):
+        (WebCore::nonCachingStaticForwardFunctionGetter):
+        (WebCore::nonCachingStaticGoFunctionGetter):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::nonCachingStaticReplaceFunctionGetter):
+        (WebCore::nonCachingStaticReloadFunctionGetter):
+        (WebCore::nonCachingStaticAssignFunctionGetter):
+        (WebCore::JSLocation::customGetOwnPropertySlot):
+        * bindings/objc/DOMRGBColor.mm:
+        (WebCore::getWrapperForRGB):
+        (WebCore::setWrapperForRGB):
+        (WebCore::removeWrapperForRGB):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::globalExceptionString):
+        * bridge/runtime_object.cpp:
+        (JSC::callRuntimeConstructor):
+        * css/CSSParser.cpp:
+        (WebCore::parseGradientColorStop):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::scaleFactorForConversion):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::operator >):
+        (WebCore::operator <=):
+        (WebCore::getTransformOperationType):
+        * dom/make_names.pl:
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::updatePositionForTextRemoval):
+        * editing/EditorCommand.cpp:
+        (WebCore::valueBackColor):
+        (WebCore::valueFontName):
+        (WebCore::valueFontSize):
+        (WebCore::valueFontSizeDelta):
+        (WebCore::valueForeColor):
+        * editing/VisiblePosition.cpp:
+        (WebCore::canonicalizeCandidate):
+        * editing/htmlediting.cpp:
+        * editing/markup.cpp:
+        (WebCore::joinMarkups):
+        * html/HTMLElement.cpp:
+        (WebCore::inlineTagList):
+        (WebCore::blockTagList):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::serializeTimeOffset):
+        (WebCore::parseTimeOffset):
+        * page/mac/FrameMac.mm:
+        (WebCore::regExpForLabels):
+        * platform/Arena.cpp:
+        * platform/graphics/Color.cpp:
+        (WebCore::colorFloatToRGBAByte):
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::imageSourceOptions):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::CGPathApplierToPathApplier):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::initFontData):
+        * platform/mac/PlatformMouseEventMac.mm:
+        * platform/text/String.cpp:
+        * rendering/RenderBlock.cpp:
+        (WebCore::continuationOutlineTable):
+        (WebCore::getHeightForLineCount):
+        * rendering/RenderView.cpp:
+        (WebCore::rendererAfterPosition):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::isEditableLeaf):
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::hasFractions):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::positionedObjectMoved):
+        * svg/SVGFont.cpp:
+        (WebCore::floatWidthUsingSVGFontCallback):
+        (WebCore::floatWidthMissingGlyphCallback):
+        (WebCore::drawTextUsingSVGFontCallback):
+        (WebCore::drawTextMissingGlyphCallback):
+        * svg/SVGTransformable.cpp:
+        (WebCore::parseTransformParamList):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::operator<<):
+        * xml/XPathGrammar.y:
+        * xml/XSLTExtensions.cpp:
+
+2009-01-23  Eric Seidel  <eric@webkit.org>
+
+        No review, removing an empty file.
+
+        Remove RemoveNodeAttributeCommand since it was empty.
+
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * editing/RemoveNodeAttributeCommand.cpp: Removed.
+        * editing/RemoveNodeAttributeCommand.h: Removed.
+
+2009-01-23  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Sam Weinig
+
+        Rework ScriptCachedPageData to ScriptCachedFrameData to more accurately reflect its true purpose
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+
+        * bindings/js/ScriptCachedFrameData.cpp: Copied from bindings/js/ScriptCachedPageData.cpp.
+        (WebCore::ScriptCachedFrameData::ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::domWindow):
+        (WebCore::ScriptCachedFrameData::~ScriptCachedFrameData):
+        (WebCore::ScriptCachedFrameData::restore):
+        (WebCore::ScriptCachedFrameData::clear):
+        * bindings/js/ScriptCachedFrameData.h: Copied from bindings/js/ScriptCachedPageData.h.
+        * bindings/js/ScriptCachedPageData.cpp: Removed.
+        * bindings/js/ScriptCachedPageData.h: Removed.
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::CachedPage):
+        (WebCore::CachedPage::restore):
+        * history/CachedPage.h:
+
+2009-01-23  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix build.
+
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::baselinePosition):
+
+2009-01-23  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23506
+        Upstream Chromium's image decoders for use with PLATFORM(SKIA)
+
+        * platform/image-decoders/skia/BMPImageDecoder.cpp: Added.
+        * platform/image-decoders/skia/BMPImageDecoder.h: Added.
+        * platform/image-decoders/skia/BMPImageReader.cpp: Added.
+        * platform/image-decoders/skia/BMPImageReader.h: Added.
+        * platform/image-decoders/skia/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoderPrivate::GIFImageDecoderPrivate):
+        (WebCore::GIFImageDecoderPrivate::decode):
+        (WebCore::GIFImageDecoderPrivate::getColorMap):
+        (WebCore::GIFImageDecoder::GIFImageDecoder):
+        (WebCore::GIFImageDecoder::isSizeAvailable):
+        (WebCore::GIFImageDecoder::frameCount):
+        (WebCore::GIFImageDecoder::frameBufferAtIndex):
+        (WebCore::GIFImageDecoder::clearFrameBufferCache):
+        (WebCore::GIFImageDecoder::decode):
+        (WebCore::GIFImageDecoder::sizeNowAvailable):
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        (WebCore::GIFImageDecoder::prepEmptyFrameBuffer):
+        (WebCore::GIFImageDecoder::haveDecodedRow):
+        (WebCore::GIFImageDecoder::frameComplete):
+        * platform/image-decoders/skia/GIFImageDecoder.h:
+        (WebCore::GIFImageDecoder::filenameExtension):
+        (WebCore::GIFImageDecoder::frameDurationAtIndex):
+        (WebCore::GIFImageDecoder::):
+        * platform/image-decoders/skia/GIFImageReader.cpp:
+        (GIFImageReader::do_lzw):
+        (GIFImageReader::read):
+        * platform/image-decoders/skia/GIFImageReader.h:
+        * platform/image-decoders/skia/ICOImageDecoder.cpp: Added.
+        * platform/image-decoders/skia/ICOImageDecoder.h: Added.
+        * platform/image-decoders/skia/ImageDecoder.h:
+        (WebCore::RefCountedNativeImageSkia::create):
+        (WebCore::RefCountedNativeImageSkia::bitmap):
+        (WebCore::RefCountedNativeImageSkia::RefCountedNativeImageSkia):
+        (WebCore::RGBA32Buffer::):
+        (WebCore::RGBA32Buffer::RGBA32Buffer):
+        (WebCore::RGBA32Buffer::~RGBA32Buffer):
+        (WebCore::RGBA32Buffer::operator=):
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::RGBA32Buffer::copyBitmapData):
+        (WebCore::RGBA32Buffer::bitmap):
+        (WebCore::RGBA32Buffer::setSize):
+        (WebCore::RGBA32Buffer::width):
+        (WebCore::RGBA32Buffer::height):
+        (WebCore::RGBA32Buffer::rect):
+        (WebCore::RGBA32Buffer::status):
+        (WebCore::RGBA32Buffer::duration):
+        (WebCore::RGBA32Buffer::disposalMethod):
+        (WebCore::RGBA32Buffer::hasAlpha):
+        (WebCore::RGBA32Buffer::setRect):
+        (WebCore::RGBA32Buffer::setStatus):
+        (WebCore::RGBA32Buffer::setDuration):
+        (WebCore::RGBA32Buffer::setDisposalMethod):
+        (WebCore::RGBA32Buffer::setHasAlpha):
+        (WebCore::RGBA32Buffer::setRGBA):
+        (WebCore::ImageDecoder::ImageDecoder):
+        (WebCore::ImageDecoder::~ImageDecoder):
+        (WebCore::ImageDecoder::setData):
+        (WebCore::ImageDecoder::isSizeAvailable):
+        (WebCore::ImageDecoder::size):
+        (WebCore::ImageDecoder::frameCount):
+        (WebCore::ImageDecoder::repetitionCount):
+        (WebCore::ImageDecoder::supportsAlpha):
+        (WebCore::ImageDecoder::failed):
+        (WebCore::ImageDecoder::setFailed):
+        (WebCore::ImageDecoder::clearFrameBufferCache):
+        (WebCore::ImageDecoder::setSize):
+        (WebCore::ImageDecoder::isOverSize):
+        * platform/image-decoders/skia/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageReader::JPEGImageReader):
+        (WebCore::JPEGImageReader::decode):
+        (WebCore::JPEGImageDecoder::isSizeAvailable):
+        (WebCore::JPEGImageDecoder::outputScanlines):
+        * platform/image-decoders/skia/JPEGImageDecoder.h:
+        (WebCore::JPEGImageDecoder::filenameExtension):
+        (WebCore::JPEGImageDecoder::supportsAlpha):
+        (WebCore::JPEGImageDecoder::reader):
+        * platform/image-decoders/skia/PNGImageDecoder.cpp:
+        (WebCore::PNGImageReader::close):
+        (WebCore::PNGImageDecoder::PNGImageDecoder):
+        (WebCore::PNGImageDecoder::isSizeAvailable):
+        (WebCore::PNGImageDecoder::frameBufferAtIndex):
+        (WebCore::PNGImageDecoder::decode):
+        (WebCore::PNGImageDecoder::decodingFailed):
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::rowAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+        (WebCore::PNGImageDecoder::pngComplete):
+        * platform/image-decoders/skia/PNGImageDecoder.h:
+        (WebCore::PNGImageDecoder::filenameExtension):
+        (WebCore::PNGImageDecoder::reader):
+        * platform/image-decoders/skia/XBMImageDecoder.cpp: Added.
+        * platform/image-decoders/skia/XBMImageDecoder.h: Added.
+
+2009-01-23  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23506
+        Copy existing ImageDecoder.h in preparation for landing Skia changes on top.
+
+        * platform/image-decoders/skia/ImageDecoder.h: Copied from platform/image-decoders/ImageDecoder.h.
+
+2009-01-23  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23506
+        Copy existing image-decoders in preparation for landing Skia changes on top.
+
+        * platform/image-decoders/skia: Added.
+        * platform/image-decoders/skia/GIFImageDecoder.cpp: Copied from platform/image-decoders/gif/GIFImageDecoder.cpp.
+        * platform/image-decoders/skia/GIFImageDecoder.h: Copied from platform/image-decoders/gif/GIFImageDecoder.h.
+        * platform/image-decoders/skia/GIFImageReader.cpp: Copied from platform/image-decoders/gif/GIFImageReader.cpp.
+        * platform/image-decoders/skia/GIFImageReader.h: Copied from platform/image-decoders/gif/GIFImageReader.h.
+        * platform/image-decoders/skia/JPEGImageDecoder.cpp: Copied from platform/image-decoders/jpeg/JPEGImageDecoder.cpp.
+        * platform/image-decoders/skia/JPEGImageDecoder.h: Copied from platform/image-decoders/jpeg/JPEGImageDecoder.h.
+        * platform/image-decoders/skia/PNGImageDecoder.cpp: Copied from platform/image-decoders/png/PNGImageDecoder.cpp.
+        * platform/image-decoders/skia/PNGImageDecoder.h: Copied from platform/image-decoders/png/PNGImageDecoder.h.
+
+2009-01-23  Holger Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix.
+
+        Based on https://bugs.webkit.org/show_bug.cgi?id=23498
+        from craig.schlenter@gmail.com
+
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::baselinePosition):
+
+2009-01-23  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 22720: Make XMLHttpRequest work in Workers
+        <https://bugs.webkit.org/show_bug.cgi?id=22720>
+
+        Add copy/adopt for ResourceResponse(Base)/ResourceRequest(Base) to allow the
+        data to be passed across threads.
+
+        No observable change in behavior, so no test.
+
+        * platform/network/FormData.cpp:
+        (WebCore::FormData::deepCopy):
+        * platform/network/FormData.h:
+        * platform/network/HTTPHeaderMap.cpp:
+        (WebCore::HTTPHeaderMap::copyData):
+        (WebCore::HTTPHeaderMap::adopt):
+        * platform/network/HTTPHeaderMap.h:
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::adopt):
+        (WebCore::ResourceRequestBase::copyData):
+        * platform/network/ResourceRequestBase.h:
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::adopt):
+        (WebCore::ResourceResponseBase::copyData):
+        * platform/network/ResourceResponseBase.h:
+
+2009-01-23  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23374
+        Add WorkerRunLoop to encapsulate message queue and timer heap.
+        This is first half (timer heap is added as separate patch).
+
+        * GNUmakefile.am: Added WorkerRunLoop.cpp to the build.
+        * WebCore.vcproj/WebCore.vcproj: Same as above.
+        * WebCore.xcodeproj/project.pbxproj: Same as above
+        * dom/WorkerContext.cpp:
+        (WebCore::WorkerContext::postTask):
+        * dom/WorkerContext.h:
+        * dom/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
+        (WebCore::WorkerMessagingProxy::workerThreadCreated):
+        * dom/WorkerRunLoop.cpp: Added.
+        (WebCore::WorkerRunLoop::run): Runs the loop until terminate() is called.
+        (WebCore::WorkerRunLoop::terminate): Causes the loop to exit.
+        (WebCore::WorkerRunLoop::postTask): Adds a task to the internal queue.
+        * dom/WorkerRunLoop.h: Added.
+        (WebCore::WorkerRunLoop::WorkerRunLoop):
+        * dom/WorkerThread.cpp:
+        (WebCore::WorkerThread::workerThread):
+        (WebCore::WorkerThread::stop):
+        * dom/WorkerThread.h:
+        (WebCore::WorkerThread::runLoop):
+
+2009-01-23  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Holger Hans Peter Freyther.
+
+        Redo previous patch http://trac.webkit.org/changeset/34260 which fixes a
+        huge memory leak by ensuring that the timer is fired one last time on
+        application tear down thus triggering the GCController thereby freeing
+        JavaScript objects as well as triggering other timer based tear down methods.
+
+        * platform/qt/SharedTimerQt.cpp:
+        (WebCore::SharedTimerQt::~SharedTimerQt):
+
+2009-01-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23459
+        Workers are not properly terminated if execution hasn't begun yet
+
+        Doesn't affect observable behavior, so test case is not possible.
+
+        * dom/WorkerThread.cpp: (WebCore::WorkerThread::workerThread): Call forbidExecution() if
+        it couldn't be called earlier.
+
+2009-01-23  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        [Qt] Fix the build after RenderBox refactoring in r40153.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::baselinePosition):
+
+2009-01-23  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Rubber-stamped by Alexey Proskuryakov.
+
+        Fix the build after RenderBox refactoring in r40153.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::invalidateWindowlessPluginRect):
+
+2009-01-23  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Simplify the assertion.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::getWindowsContext):
+        (WebCore::GraphicsContext::releaseWindowsContext):
+
+2009-01-22  David Hyatt  <hyatt@apple.com>
+
+        Move the border and padding methods from RenderObject to RenderBox.
+
+        Reviewed by Oliver Hunt
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::createDeletionUI):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::borderLeft):
+        (WebCore::InlineFlowBox::borderRight):
+        (WebCore::InlineFlowBox::paddingLeft):
+        (WebCore::InlineFlowBox::paddingRight):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::clearFloats):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paddingTop):
+        (WebCore::RenderBox::paddingBottom):
+        (WebCore::RenderBox::paddingLeft):
+        (WebCore::RenderBox::paddingRight):
+        (WebCore::RenderBox::calcHeight):
+        (WebCore::RenderBox::containingBlockWidthForPositioned):
+        (WebCore::RenderBox::containingBlockHeightForPositioned):
+        (WebCore::RenderBox::calcAbsoluteHorizontal):
+        (WebCore::RenderBox::calcAbsoluteHorizontalValues):
+        (WebCore::RenderBox::calcAbsoluteVertical):
+        (WebCore::RenderBox::calcAbsoluteVerticalValues):
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced):
+        (WebCore::RenderBox::calcAbsoluteVerticalReplaced):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::borderTop):
+        (WebCore::RenderBox::borderBottom):
+        (WebCore::RenderBox::borderLeft):
+        (WebCore::RenderBox::borderRight):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):
+        * rendering/RenderObject.h:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::textBlockWidth):
+        (WebCore::RenderTextControl::calcHeight):
+        (WebCore::RenderTextControl::calcPrefWidths):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::preferredContentWidth):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::repaintViewRectangle):
+
+2009-01-22  David Hyatt  <hyatt@apple.com>
+
+        Devirtualize the marginTop/Right/Left/Bottom functions and move them to RenderBox (along with some of the
+        other margin functions that have to come along for the ride).
+
+        Reviewed by Oliver Hunt
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * editing/TextIterator.cpp:
+        (WebCore::shouldEmitExtraNewlineForNode):
+        * rendering/InlineBox.cpp:
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::renderBox):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::marginLeft):
+        (WebCore::InlineFlowBox::marginRight):
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        (WebCore::InlineFlowBox::shrinkBoxesWithNoTextChildren):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::isSelfCollapsingBlock):
+        (WebCore::RenderBlock::adjustPositionedBlock):
+        (WebCore::RenderBlock::handleCompactChild):
+        (WebCore::RenderBlock::estimateVerticalPosition):
+        (WebCore::getBorderPaddingMargin):
+        (WebCore::RenderBlock::calcInlinePrefWidths):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcHeight):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::hasHorizontalBordersPaddingOrMargin):
+        (WebCore::RenderBox::hasHorizontalBordersOrPadding):
+        (WebCore::RenderBox::marginTop):
+        (WebCore::RenderBox::marginBottom):
+        (WebCore::RenderBox::marginLeft):
+        (WebCore::RenderBox::marginRight):
+        (WebCore::RenderBox::isSelfCollapsingBlock):
+        (WebCore::RenderBox::collapsedMarginTop):
+        (WebCore::RenderBox::collapsedMarginBottom):
+        (WebCore::RenderBox::isTopMarginQuirk):
+        (WebCore::RenderBox::isBottomMarginQuirk):
+        (WebCore::RenderBox::maxTopMargin):
+        (WebCore::RenderBox::maxBottomMargin):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::getAbsoluteRepaintRectWithOutline):
+        * rendering/RenderObject.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::lineHeight):
+        (WebCore::RenderSVGContainer::baselinePosition):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::calcHeight):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::baselinePosition):
+        * rendering/bidi.cpp:
+        (WebCore::getBorderPaddingMargin):
+        (WebCore::inlineWidth):
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+        (WebCore::inlineFlowRequiresLineBox):
+        (WebCore::requiresLineBox):
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2009-01-22  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Anders Carlsson.
+
+        Disable GCC_WARN_ABOUT_MISSING_PROTOTYPES temporarily.
+
+        Current versions of Xcode only respect it for C and Objective-C files,
+        and our code doesn't currently compile if it is applied to C++ and
+        Objective-C++ files.
+
+        * Configurations/Base.xcconfig:
+
+2009-01-22  David Hyatt  <hyatt@apple.com>
+
+        Move the m_widthChanged bit on RenderTableCell into RenderFlow's set of bits.  Let intrinsicPaddingTop and
+        intrinsicPaddingBottom just be normal non-bitfield values.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderFlow.h:
+        (WebCore::RenderFlow::RenderFlow):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::RenderTableCell):
+        (WebCore::RenderTableCell::updateWidth):
+        (WebCore::RenderTableCell::layout):
+        * rendering/RenderTableCell.h:
+
+2009-01-22  David Hyatt  <hyatt@apple.com>
+
+        Properly encapsulate m_frameRect.y() behind the RenderBox::y() method now that they are the same thing.
+        Make m_frameRect private.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::clearFloats):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::offsetTop):
+        (WebCore::RenderBox::nodeAtPoint):
+        (WebCore::RenderBox::paint):
+        (WebCore::RenderBox::paintCustomHighlight):
+        (WebCore::RenderBox::containingBlockWidth):
+        (WebCore::RenderBox::localToAbsolute):
+        (WebCore::RenderBox::offsetFromContainer):
+        (WebCore::RenderBox::computeAbsoluteRepaintRect):
+        (WebCore::RenderBox::repaintDuringLayoutIfMoved):
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::layout):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::paint):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        (WebCore::RenderImage::nodeAtPoint):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::paint):
+        (WebCore::RenderListMarker::getRelativeMarkerRect):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        (WebCore::RenderReplaced::shouldPaint):
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::paint):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::applyContentTransforms):
+        (WebCore::RenderSVGRoot::paint):
+        (WebCore::RenderSVGRoot::absoluteTransform):
+        (WebCore::RenderSVGRoot::nodeAtPoint):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::calcWidth):
+        (WebCore::RenderTable::layout):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paint):
+        (WebCore::RenderTableCell::paintBackgroundsBehindCell):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::setCellWidths):
+        (WebCore::RenderTableSection::calcRowHeight):
+        (WebCore::RenderTableSection::layoutRows):
+        (WebCore::RenderTableSection::paint):
+        (WebCore::RenderTableSection::nodeAtPoint):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+
+2009-01-22  David Hyatt  <hyatt@apple.com>
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23487.
+
+        This patch completely reworks vertical alignment of table cells.  The current system uses methods called borderTopExtra() and borderBottomExtra() to
+        add extra space above and below the content of a cell.  This system was not confined to the table code and spilled out into all the other RenderObjects.
+        The y-position of the table cell box was set to the outer edge of the cell, but the y() method of RenderBox lied and added in borderTopExtra().  height()
+        also excluded the extra space, so did not accurately reflect the true size of the cell.
+
+        With the new system, the table cell box is completely accurate.  The extra space becomes part of the padding of the cell.  Padding has been reworked so that
+        additional intrinsic padding can be added on to the specified padding from style.  Only the table code has to deal with the extra cell padding.
+
+        localToAbsoluteForContent has now been removed, since there no longer has to be a special hacked content box.
+
+        A number of table layout tests progress with this change, since the new layout system actually fixes existing bugs in baseline alignment of cells.
+
+        Reviewed by Oliver Hunt
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        Make CSSComputedStyleDeclaration ask for padding values that exclude the built-in intrinsic padding.  This ensures that getComputedStyle continues
+        to give the right answer.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::getLowerRightCorner):
+        * editing/visible_units.cpp:
+        (WebCore::previousLinePosition):
+        (WebCore::nextLinePosition):
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        Remove borderTopExtra()/borderBottomExtra() hacks and localToAbsoluteForContent calls.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::overflowRect):
+        Remove borderTopExtra()/borderBottomExtra() hacks and localToAbsoluteForContent calls.
+
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::expandsToEncloseOverhangingFloats):
+        The expandsToEncloseOverhangingFloats logic has been reworked.  Table cells and fieldsets did not properly handle floats that spilled into the bottom padding.  The
+        resulting box needed to not only expand to encompass the float, but also needed to place the full bottom padding after the float.  The switch to make the extra table cell
+        space into padding exposed this issue.  No extra layout test is required, since an existing table layout test exposes this issue and progresses to match Firefox with
+        this change.
+
+        (WebCore::RenderBlock::selectionGapRects):
+        (WebCore::RenderBlock::paintSelection):
+        (WebCore::RenderBlock::fillSelectionGaps):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::positionForCoordinates):
+        (WebCore::RenderBlock::offsetForContents):
+        Remove borderTopExtra()/borderBottomExtra() hacks and localToAbsoluteForContent calls.
+
+        * rendering/RenderBlock.h:
+        Add the new simplified method for expanding to encompass overhanging floats.  The method has been devirtualized and made to include all of the cases (and not just a subset).
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::absoluteRects):
+        (WebCore::RenderBox::absoluteQuads):
+        (WebCore::RenderBox::absoluteContentBox):
+        (WebCore::RenderBox::paintBoxDecorations):
+        (WebCore::RenderBox::paintMask):
+        (WebCore::RenderBox::getOverflowClipRect):
+        (WebCore::RenderBox::localToAbsolute):
+        (WebCore::RenderBox::absoluteToLocal):
+        (WebCore::RenderBox::localToAbsoluteQuad):
+        Remove borderTopExtra()/borderBottomExtra() hacks and localToAbsoluteForContent calls.
+
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::y):
+        (WebCore::RenderBox::location):
+        (WebCore::RenderBox::borderBoxRect):
+        (WebCore::RenderBox::offsetHeight):
+        Remove borderTopExtra()/borderBottomExtra() hacks and localToAbsoluteForContent calls.
+
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::addLineBoxRects):
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBoxDecorations):
+        (WebCore::RenderFieldset::paintMask):
+        * rendering/RenderFieldset.h:
+        (WebCore::RenderFieldset::avoidsFloats):
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::localCaretRect):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::boundingBox):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::isPointInOverflowControl):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::localToAbsolute):
+        (WebCore::RenderObject::absoluteToLocal):
+        (WebCore::RenderObject::localToAbsoluteQuad):
+        (WebCore::RenderObject::offsetFromContainer):
+        (WebCore::RenderObject::paddingTop):
+        (WebCore::RenderObject::paddingBottom):
+        (WebCore::RenderObject::paddingLeft):
+        (WebCore::RenderObject::paddingRight):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::hasOverhangingFloats):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::selectionRect):
+        (WebCore::RenderReplaced::localSelectionRect):
+        Remove borderTopExtra()/borderBottomExtra() hacks and localToAbsoluteForContent calls.  Also modifed paddingLeft/Top/Right/Bottom to take an argument indicating
+        whether or not the intrinsic padding of an object should be included (by default it is).  getComputedStyle needs to exclude it, which is why this argument is
+        necessary.
+
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::RenderTableCell):
+        (WebCore::RenderTableCell::paddingTop):
+        (WebCore::RenderTableCell::paddingBottom):
+        The new paddingTop() and paddingBottom() methods on table cells include the extra intrinsic padding.
+
+        (WebCore::RenderTableCell::setOverrideSize):
+        When a table's override size gets altered, the intrinsic padding needs to be cleared.
+
+        (WebCore::RenderTableCell::absoluteClippedOverflowRect):
+        (WebCore::RenderTableCell::computeAbsoluteRepaintRect):
+        (WebCore::RenderTableCell::baselinePosition):
+        (WebCore::RenderTableCell::paint):
+        (WebCore::RenderTableCell::paintBackgroundsBehindCell):
+        (WebCore::RenderTableCell::paintBoxDecorations):
+        (WebCore::RenderTableCell::paintMask):
+        Remove borderTopExtra()/borderBottomExtra() hacks and localToAbsoluteForContent calls.
+
+        * rendering/RenderTableCell.h:
+        (WebCore::RenderTableCell::setIntrinsicPaddingTop):
+        (WebCore::RenderTableCell::setIntrinsicPaddingBottom):
+        (WebCore::RenderTableCell::setIntrinsicPadding):
+        (WebCore::RenderTableCell::clearIntrinsicPadding):
+        (WebCore::RenderTableCell::intrinsicPaddingTop):
+        (WebCore::RenderTableCell::intrinsicPaddingBottom):
+        Add new helper methods for getting/setting a cell's intrinsic padding.
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::calcRowHeight):
+        calcRowHeight has been modified to exclude the intrinsic padding when calculating the base height of rows prior to flexing.  Because a cell now includes that
+        extra space, it has to be subtracted out in this method.
+
+        (WebCore::RenderTableSection::layoutRows):
+        Modify the code that sets up the intrinsic padding so that it does a relayout if the intrinsic padding changes.   There was also an error where the baseline
+        position mismatched leading to negative intrinsic padding being added in (this error exists in ToT).  The code now properly ignores cells that don't establish
+        a baseline.  A number of tests progress with this change.
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::addLineBoxRects):
+        Remove borderTopExtra()/borderBottomExtra() hacks and localToAbsoluteForContent calls.
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        (WebCore::writeTextRun):
+        Modify the render tree dumping code to continue to produce the same results as before.  This is really a hack, since we're now capable of indicating the correct
+        position for the descendants of cells with intrinsic padding (and also indicating what the correct cell box is).  A future patch can remove these hacks so that the
+        layout test results can all be regenerated.
+
+2009-01-22  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Remove <strong>/<em> tags when toggling bold/italic since IE inserts them instead of <b>/<i>
+        https://bugs.webkit.org/show_bug.cgi?id=23486
+
+        Test: editing/execCommand/toggle-styles.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::isHTMLStyleNode):
+
+2009-01-22  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        Remove <span> turds left by editing commands
+        https://bugs.webkit.org/show_bug.cgi?id=23466
+
+        Tests:
+        * editing/execCommand/empty-span-removal.html
+        * editing/execCommand/toggle-styles.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::styleSpanClassString):
+        (WebCore::isStyleSpan):
+        (WebCore::isUnstyledStyleSpan):
+        (WebCore::isSpanWithoutAttributesOrUnstyleStyleSpan):
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
+        (WebCore::ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock):
+        (WebCore::ApplyStyleCommand::removeHTMLBidiEmbeddingStyle):
+        (WebCore::ApplyStyleCommand::removeCSSStyle):
+
+2009-01-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Rename some of the casting functions in dom/*Element.cpp:
+        formControlElementForElement -> toFormControlElement
+        inputElementForElement -> toInputElement
+        optionElementForElement -> toOptionElement
+        optionGroupElementForElement -> toOptionGroupElement
+
+        Suggested by Alexey, while refactoring the Element*->ScriptElement* code.
+        The Element*->ScriptElement* helper function is already named 'toScriptElement'.
+
+        * dom/FormControlElement.cpp:
+        (WebCore::toFormControlElement):
+        * dom/FormControlElement.h:
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::setValueFromRenderer):
+        (WebCore::toInputElement):
+        * dom/InputElement.h:
+        * dom/OptionElement.cpp:
+        (WebCore::OptionElement::collectOptionTextRespectingGroupLabel):
+        (WebCore::toOptionElement):
+        * dom/OptionElement.h:
+        * dom/OptionGroupElement.cpp:
+        (WebCore::toOptionGroupElement):
+        * dom/OptionGroupElement.h:
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::updateFromElement):
+        (WebCore::RenderListBox::paintItemForeground):
+        (WebCore::RenderListBox::paintItemBackground):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::updateOptionsWidth):
+        (WebCore::RenderMenuList::setTextFromOption):
+        (WebCore::RenderMenuList::itemText):
+        (WebCore::RenderMenuList::itemIsSelected):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::formControlElement):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::inputElement):
+
+2009-01-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Rubber-stamped by George Staikos.
+
+        Forgot to include in my last commit: Activate code depending on WMLOptionElement/WMLOptGroupElement.
+
+        * dom/OptionElement.cpp:
+        (WebCore::optionElementForElement):
+        * dom/OptionGroupElement.cpp:
+        (WebCore::optionGroupElementForElement):
+
+2009-01-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=23454
+
+        Add WML <option>/<optgroup> element support.
+        Currently the implementation is stubbed, all relevant parts can be enabled
+        once WMLSelectElement/SelectElement has been created.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * wml/WMLOptGroupElement.cpp: Added.
+        (WebCore::WMLOptGroupElement::WMLOptGroupElement):
+        (WebCore::WMLOptGroupElement::~WMLOptGroupElement):
+        (WebCore::WMLOptGroupElement::insertBefore):
+        (WebCore::WMLOptGroupElement::replaceChild):
+        (WebCore::WMLOptGroupElement::removeChild):
+        (WebCore::WMLOptGroupElement::appendChild):
+        (WebCore::WMLOptGroupElement::removeChildren):
+        (WebCore::ownerSelectElement):
+        (WebCore::WMLOptGroupElement::accessKeyAction):
+        (WebCore::WMLOptGroupElement::childrenChanged):
+        (WebCore::WMLOptGroupElement::parseMappedAttribute):
+        (WebCore::WMLOptGroupElement::attach):
+        (WebCore::WMLOptGroupElement::detach):
+        (WebCore::WMLOptGroupElement::setRenderStyle):
+        (WebCore::WMLOptGroupElement::nonRendererRenderStyle):
+        (WebCore::WMLOptGroupElement::groupLabelText):
+        (WebCore::WMLOptGroupElement::recalcSelectOptions):
+        * wml/WMLOptGroupElement.h: Added.
+        (WebCore::WMLOptGroupElement::title):
+        (WebCore::WMLOptGroupElement::valueMatchesRenderer):
+        (WebCore::WMLOptGroupElement::setValueMatchesRenderer):
+        (WebCore::WMLOptGroupElement::rendererIsNeeded):
+        * wml/WMLOptionElement.cpp: Added.
+        (WebCore::WMLOptionElement::WMLOptionElement):
+        (WebCore::WMLOptionElement::~WMLOptionElement):
+        (WebCore::ownerSelectElement):
+        (WebCore::WMLOptionElement::accessKeyAction):
+        (WebCore::WMLOptionElement::childrenChanged):
+        (WebCore::WMLOptionElement::parseMappedAttribute):
+        (WebCore::WMLOptionElement::attach):
+        (WebCore::WMLOptionElement::detach):
+        (WebCore::WMLOptionElement::setRenderStyle):
+        (WebCore::WMLOptionElement::insertedIntoDocument):
+        (WebCore::WMLOptionElement::selected):
+        (WebCore::WMLOptionElement::setSelectedState):
+        (WebCore::WMLOptionElement::value):
+        (WebCore::WMLOptionElement::textIndentedToRespectGroupLabel):
+        (WebCore::WMLOptionElement::nonRendererRenderStyle):
+        (WebCore::WMLOptionElement::handleIntrinsicEventIfNeeded):
+        * wml/WMLOptionElement.h: Added.
+        (WebCore::WMLOptionElement::valueMatchesRenderer):
+        (WebCore::WMLOptionElement::setValueMatchesRenderer):
+        (WebCore::WMLOptionElement::rendererIsNeeded):
+        * wml/WMLTagNames.in:
+
+2009-01-22  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20806
+        Send referrer for history navigations.
+
+        Test: http/tests/navigation/back-send-referrer.html
+
+        Consolidates HistoryItem::rssFeedReferrer and HistoryItem::formReferrer into a single HistoryItem::referrer property.
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem):
+        (WebCore::HistoryItem::referrer):
+        (WebCore::HistoryItem::setReferrer):
+        (WebCore::HistoryItem::formReferrer):
+        (WebCore::HistoryItem::rssFeedReferrer):
+        (WebCore::HistoryItem::setRSSFeedReferrer):
+        (WebCore::HistoryItem::setFormInfoFromRequest):
+        * history/HistoryItem.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem):
+
+2009-01-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=23465
+
+        Further enhancments to share code between HTMLOptionElement and the upcoming WMLOptionElement.
+
+        Rename optionText() to textIndentedToRespectGroupLabel() in (HTML)OptionElement, as it fits better.
+        optionText() returns the options text prefixed with some spaces, in case it got an optgroup parent.
+
+        Add two more pure-virtual functions to OptionElement: setSelectedState(bool) & value().
+        These aren't used outside of html/ at the moment (unlike the other pure-virtual functions
+        used by RenderMenuList/RenderListBox) - but they will be used by SelectElement, once it exists.
+
+        * dom/OptionElement.cpp:
+        (WebCore::OptionElement::setSelectedState):
+        (WebCore::OptionElement::collectOptionText):
+        (WebCore::OptionElement::collectOptionTextRespectingGroupLabel):
+        (WebCore::OptionElement::collectOptionValue):
+        (WebCore::OptionElementData::OptionElementData):
+        (WebCore::OptionElementData::~OptionElementData):
+        * dom/OptionElement.h:
+        (WebCore::OptionElementData::element):
+        (WebCore::OptionElementData::value):
+        (WebCore::OptionElementData::setValue):
+        (WebCore::OptionElementData::label):
+        (WebCore::OptionElementData::setLabel):
+        (WebCore::OptionElementData::selected):
+        (WebCore::OptionElementData::setSelected):
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::HTMLOptionElement):
+        (WebCore::HTMLOptionElement::text):
+        (WebCore::HTMLOptionElement::parseMappedAttribute):
+        (WebCore::HTMLOptionElement::value):
+        (WebCore::HTMLOptionElement::selected):
+        (WebCore::HTMLOptionElement::setSelected):
+        (WebCore::HTMLOptionElement::setSelectedState):
+        (WebCore::HTMLOptionElement::label):
+        (WebCore::HTMLOptionElement::textIndentedToRespectGroupLabel):
+        * html/HTMLOptionElement.h:
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::typeAheadFind):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::updateFromElement):
+        (WebCore::RenderListBox::paintItemForeground):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::updateOptionsWidth):
+        (WebCore::RenderMenuList::setTextFromOption):
+        (WebCore::RenderMenuList::itemText):
+
+2009-01-22  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Justin Garcia.
+
+        Bug 23464: Infinite recursion at SelectionController::setSelection
+        https://bugs.webkit.org/show_bug.cgi?id=23464
+
+        Check for conditions leading to infinite recursion.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setSelection):
+
+2009-01-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Fix WML build problem in RenderBox.cpp, WMLNames is undefined.
+
+        * rendering/RenderBox.cpp:
+
+2009-01-22  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build after RenderBox changes.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::baselinePosition):
+
+2009-01-22  David Hyatt  <hyatt@apple.com>
+
+        Fix regressions in list box selection on Mac.  The wrong color was being used for the list box
+        background, and list box colors actually weren't even being properly fetched because of a bug in
+        the RenderTheme base class.  Existing pixel tests cover the bug fix.
+
+        Reviewed by Jon Honeycutt
+
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::activeListBoxSelectionBackgroundColor):
+        (WebCore::RenderTheme::inactiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderTheme::activeListBoxSelectionForegroundColor):
+        (WebCore::RenderTheme::inactiveListBoxSelectionForegroundColor):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::platformInactiveListBoxSelectionBackgroundColor):
+
+2009-01-22  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 22720: Make XMLHttpRequest work in Workers
+        <https://bugs.webkit.org/show_bug.cgi?id=22720>
+
+        Add copy/adopt for HTTPHeaderMap to allow the data to be passed across threads.
+
+        No observable change in behavior, so no test.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * platform/network/HTTPHeaderMap.cpp: Added.
+        (WebCore::HTTPHeaderMap::copyData):
+        (WebCore::HTTPHeaderMap::adopt):
+        * platform/network/HTTPHeaderMap.h:
+
+2009-01-21  David Hyatt  <hyatt@apple.com>
+
+        Back out a portion of my patch that I did not mean to land.  Revert paintOutline back to the way it
+        was before my landing.  Fixes failing SVG focus ring tests.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::paintOutline):
+        * rendering/RenderObject.h:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+
+2009-01-21  David Hyatt  <hyatt@apple.com>
+
+        Fix Node's renderBox() method on Windows.
+
+        * dom/Node.cpp:
+        (WebCore::Node::renderBox):
+
+2009-01-21  David Hyatt  <hyatt@apple.com>
+
+        Fix RenderThemeSafari bustage on Win32.
+
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::baselinePosition):
+
+2009-01-21  David Hyatt  <hyatt@apple.com>
+
+        Fix bustage in RenderThemeWin. It's actually terrible that RenderThemeWin is using absoluteContentBox,
+        but that's a problem for another day.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeWin::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeWin::paintSearchFieldResultsButton):
+
+2009-01-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Bug 23470: Crash when page load occurs while processing scroll event with MallocScribble enabled
+        <https://bugs.webkit.org/show_bug.cgi?id=23470>
+
+        Add a RefPtr protector to handleWheelEvent to guard against destruction
+        while processing the scroll event.  Alas the absurd set of circumstances
+        required to trigger this do not appear to be reproducible in DRT.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleWheelEvent):
+
+2009-01-21  David Hyatt  <hyatt@apple.com>
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23453
+
+        Devirtualize the width/height/x/y methods of the render tree.  The methods are now non-virtual on RenderBox.
+        Many functions that were previously in RenderObject.cpp are now in RenderBox.cpp.
+
+        Reviewed by Eric Seidel and Darin Adler
+
+        * WebCore.base.exp:
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::sizingBox):
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::getUpperLeftCorner):
+        (WebCore::ContainerNode::getLowerRightCorner):
+        * dom/Element.cpp:
+        (WebCore::Element::offsetLeft):
+        (WebCore::Element::offsetTop):
+        (WebCore::Element::offsetWidth):
+        (WebCore::Element::offsetHeight):
+        (WebCore::Element::offsetParent):
+        (WebCore::Element::clientLeft):
+        (WebCore::Element::clientTop):
+        (WebCore::Element::clientWidth):
+        (WebCore::Element::clientHeight):
+        (WebCore::Element::scrollLeft):
+        (WebCore::Element::scrollTop):
+        (WebCore::Element::setScrollLeft):
+        (WebCore::Element::setScrollTop):
+        (WebCore::Element::scrollWidth):
+        (WebCore::Element::scrollHeight):
+        * dom/Node.cpp:
+        (WebCore::Node::renderBox):
+        (WebCore::Node::getRect):
+        * dom/Node.h:
+        * dom/Position.cpp:
+        (WebCore::endsOfNodeAreVisuallyDistinctPositions):
+        (WebCore::Position::hasRenderedNonAnonymousDescendantsWithHeight):
+        (WebCore::Position::isCandidate):
+        * dom/PositionIterator.cpp:
+        (WebCore::PositionIterator::isCandidate):
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::addBlockPlaceholderIfNeeded):
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::removeNode):
+        * editing/Editor.cpp:
+        (WebCore::Editor::insideVisibleArea):
+        * editing/EditorCommand.cpp:
+        (WebCore::verticalScrollDistance):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::willDraw):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::isFocusable):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::width):
+        (WebCore::HTMLFrameElementBase::height):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::width):
+        (WebCore::HTMLImageElement::height):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::drawNodeHighlight):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::createScrollbar):
+        (WebCore::FrameView::updateDashboardRegions):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc):
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::imageRect):
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::renderBox):
+        (WebCore::InlineBox::adjustPosition):
+        * rendering/InlineBox.h:
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesHorizontally):
+        (WebCore::InlineFlowBox::verticallyAlignBoxes):
+        (WebCore::InlineFlowBox::placeBoxesVertically):
+        * rendering/InlineFlowBox.h:
+        * rendering/RenderApplet.cpp:
+        (WebCore::RenderApplet::createWidgetIfNecessary):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::overflowHeight):
+        (WebCore::RenderBlock::overflowWidth):
+        (WebCore::RenderBlock::overflowRect):
+        (WebCore::RenderBlock::isSelfCollapsingBlock):
+        (WebCore::RenderBlock::layout):
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::adjustPositionedBlock):
+        (WebCore::RenderBlock::adjustFloatingBlock):
+        (WebCore::RenderBlock::handleSpecialChild):
+        (WebCore::RenderBlock::handlePositionedChild):
+        (WebCore::RenderBlock::handleFloatingChild):
+        (WebCore::RenderBlock::handleCompactChild):
+        (WebCore::RenderBlock::insertCompactIfNeeded):
+        (WebCore::RenderBlock::handleRunInChild):
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::clearFloatsIfNeeded):
+        (WebCore::RenderBlock::estimateVerticalPosition):
+        (WebCore::RenderBlock::determineHorizontalPosition):
+        (WebCore::RenderBlock::handleBottomOfBlock):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::layoutOnlyPositionedObjects):
+        (WebCore::RenderBlock::layoutPositionedObjects):
+        (WebCore::RenderBlock::markPositionedObjectsForLayout):
+        (WebCore::RenderBlock::repaintOverhangingFloats):
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::paintChildren):
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::paintFloats):
+        (WebCore::RenderBlock::paintContinuationOutlines):
+        (WebCore::clipOutPositionedObjects):
+        (WebCore::RenderBlock::fillSelectionGaps):
+        (WebCore::RenderBlock::fillBlockSelectionGaps):
+        (WebCore::RenderBlock::leftSelectionOffset):
+        (WebCore::RenderBlock::rightSelectionOffset):
+        (WebCore::RenderBlock::insertPositionedObject):
+        (WebCore::RenderBlock::removePositionedObject):
+        (WebCore::RenderBlock::removePositionedObjects):
+        (WebCore::RenderBlock::insertFloatingObject):
+        (WebCore::RenderBlock::removeFloatingObject):
+        (WebCore::RenderBlock::positionNewFloats):
+        (WebCore::RenderBlock::newLine):
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        (WebCore::RenderBlock::clearFloats):
+        (WebCore::RenderBlock::addOverhangingFloats):
+        (WebCore::RenderBlock::markAllDescendantsWithFloatsForLayout):
+        (WebCore::RenderBlock::getClearDelta):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::positionForCoordinates):
+        (WebCore::RenderBlock::layoutColumns):
+        (WebCore::RenderBlock::getBaselineOfFirstLineBox):
+        (WebCore::RenderBlock::getBaselineOfLastLineBox):
+        (WebCore::getHeightForLineCount):
+        (WebCore::RenderBlock::adjustForBorderFit):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::FloatWithRect::FloatWithRect):
+        (WebCore::RenderBlock::hasOverhangingFloats):
+        (WebCore::RenderBlock::CompactInfo::compact):
+        (WebCore::RenderBlock::CompactInfo::set):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::RenderBox):
+        (WebCore::RenderBox::offsetLeft):
+        (WebCore::RenderBox::offsetTop):
+        (WebCore::RenderBox::offsetParent):
+        (WebCore::RenderBox::clientWidth):
+        (WebCore::RenderBox::clientHeight):
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::scrollHeight):
+        (WebCore::RenderBox::scrollLeft):
+        (WebCore::RenderBox::scrollTop):
+        (WebCore::RenderBox::setScrollLeft):
+        (WebCore::RenderBox::setScrollTop):
+        (WebCore::RenderBox::absoluteRects):
+        (WebCore::RenderBox::absoluteQuads):
+        (WebCore::RenderBox::absoluteContentBox):
+        (WebCore::RenderBox::absoluteContentQuad):
+        (WebCore::RenderBox::absoluteOutlineBounds):
+        (WebCore::RenderBox::addFocusRingRects):
+        (WebCore::RenderBox::reflectionBox):
+        (WebCore::RenderBox::reflectionOffset):
+        (WebCore::RenderBox::reflectedRect):
+        (WebCore::RenderBox::overrideWidth):
+        (WebCore::RenderBox::overrideHeight):
+        (WebCore::RenderBox::nodeAtPoint):
+        (WebCore::RenderBox::paint):
+        (WebCore::RenderBox::maskClipRect):
+        (WebCore::RenderBox::repaintLayerRectsForImage):
+        (WebCore::RenderBox::paintCustomHighlight):
+        (WebCore::RenderBox::getOverflowClipRect):
+        (WebCore::RenderBox::getClipRect):
+        (WebCore::RenderBox::containingBlockWidth):
+        (WebCore::RenderBox::localToAbsolute):
+        (WebCore::RenderBox::offsetFromContainer):
+        (WebCore::RenderBox::position):
+        (WebCore::RenderBox::computeAbsoluteRepaintRect):
+        (WebCore::RenderBox::repaintDuringLayoutIfMoved):
+        (WebCore::RenderBox::calcWidth):
+        (WebCore::RenderBox::calcWidthUsing):
+        (WebCore::RenderBox::calcHorizontalMargins):
+        (WebCore::RenderBox::calcHeight):
+        (WebCore::RenderBox::calcPercentageHeight):
+        (WebCore::RenderBox::calcReplacedHeightUsing):
+        (WebCore::RenderBox::containingBlockWidthForPositioned):
+        (WebCore::RenderBox::containingBlockHeightForPositioned):
+        (WebCore::RenderBox::calcAbsoluteHorizontal):
+        (WebCore::RenderBox::calcAbsoluteVertical):
+        (WebCore::RenderBox::calcAbsoluteVerticalValues):
+        (WebCore::RenderBox::calcAbsoluteHorizontalReplaced):
+        (WebCore::RenderBox::calcAbsoluteVerticalReplaced):
+        (WebCore::RenderBox::localCaretRect):
+        (WebCore::RenderBox::lowestPosition):
+        (WebCore::RenderBox::rightmostPosition):
+        (WebCore::RenderBox::leftmostPosition):
+        (WebCore::RenderBox::localTransform):
+        * rendering/RenderBox.h:
+        (WebCore::):
+        (WebCore::RenderBox::x):
+        (WebCore::RenderBox::y):
+        (WebCore::RenderBox::width):
+        (WebCore::RenderBox::height):
+        (WebCore::RenderBox::setX):
+        (WebCore::RenderBox::setY):
+        (WebCore::RenderBox::setWidth):
+        (WebCore::RenderBox::setHeight):
+        (WebCore::RenderBox::location):
+        (WebCore::RenderBox::size):
+        (WebCore::RenderBox::setLocation):
+        (WebCore::RenderBox::setSize):
+        (WebCore::RenderBox::move):
+        (WebCore::RenderBox::frameRect):
+        (WebCore::RenderBox::setFrameRect):
+        (WebCore::RenderBox::borderBoxRect):
+        (WebCore::RenderBox::contentBoxRect):
+        (WebCore::RenderBox::previousSiblingBox):
+        (WebCore::RenderBox::nextSiblingBox):
+        (WebCore::RenderBox::parentBox):
+        (WebCore::RenderBox::overflowHeight):
+        (WebCore::RenderBox::overflowWidth):
+        (WebCore::RenderBox::setOverflowHeight):
+        (WebCore::RenderBox::setOverflowWidth):
+        (WebCore::RenderBox::overflowLeft):
+        (WebCore::RenderBox::overflowTop):
+        (WebCore::RenderBox::overflowRect):
+        (WebCore::RenderBox::contentWidth):
+        (WebCore::RenderBox::contentHeight):
+        (WebCore::RenderBox::offsetWidth):
+        (WebCore::RenderBox::offsetHeight):
+        (WebCore::RenderBox::clientLeft):
+        (WebCore::RenderBox::clientTop):
+        (WebCore::RenderBox::availableWidth):
+        (WebCore::RenderBox::tryLayoutDoingPositionedMovementOnly):
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::controlClipRect):
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::layout):
+        (WebCore::RenderContainer::positionForCoordinates):
+        * rendering/RenderContainer.h:
+        (WebCore::RenderContainer::firstChildBox):
+        (WebCore::RenderContainer::lastChildBox):
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::calcPrefWidths):
+        (WebCore::RenderFieldset::layoutLegend):
+        (WebCore::RenderFieldset::findLegend):
+        (WebCore::RenderFieldset::paintBoxDecorations):
+        (WebCore::RenderFieldset::paintMask):
+        * rendering/RenderFieldset.h:
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::maxFilenameWidth):
+        (WebCore::RenderFileUploadControl::paintObject):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::FlexBoxIterator::FlexBoxIterator):
+        (WebCore::FlexBoxIterator::first):
+        (WebCore::FlexBoxIterator::next):
+        (WebCore::RenderFlexibleBox::calcHorizontalPrefWidths):
+        (WebCore::RenderFlexibleBox::calcVerticalPrefWidths):
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        (WebCore::RenderFlexibleBox::placeChild):
+        (WebCore::RenderFlexibleBox::allowedChildFlex):
+        * rendering/RenderFlexibleBox.h:
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::absoluteClippedOverflowRect):
+        (WebCore::RenderFlow::lowestPosition):
+        (WebCore::RenderFlow::rightmostPosition):
+        (WebCore::RenderFlow::leftmostPosition):
+        (WebCore::RenderFlow::localCaretRect):
+        (WebCore::RenderFlow::addFocusRingRects):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::paint):
+        (WebCore::RenderFrameSet::layout):
+        (WebCore::RenderFrameSet::positionFrames):
+        * rendering/RenderHTMLCanvas.cpp:
+        (WebCore::RenderHTMLCanvas::paintReplaced):
+        (WebCore::RenderHTMLCanvas::canvasSizeChanged):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::imageChanged):
+        (WebCore::RenderImage::paintReplaced):
+        (WebCore::RenderImage::nodeAtPoint):
+        (WebCore::RenderImage::calcReplacedWidth):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::absoluteRects):
+        (WebCore::RenderInline::boundingBoxWidth):
+        (WebCore::RenderInline::boundingBoxHeight):
+        (WebCore::RenderInline::positionForCoordinates):
+        * rendering/RenderInline.h:
+        (WebCore::RenderInline::offsetWidth):
+        (WebCore::RenderInline::offsetHeight):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateTransform):
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::scrollbarCornerPresent):
+        (WebCore::RenderLayer::createScrollbar):
+        (WebCore::RenderLayer::positionOverflowControls):
+        (WebCore::RenderLayer::paintScrollCorner):
+        (WebCore::RenderLayer::paintResizer):
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::calculateRects):
+        (WebCore::RenderLayer::boundingBox):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::calcHeight):
+        (WebCore::RenderListBox::controlClipRect):
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::positionListMarker):
+        (WebCore::RenderListItem::paint):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::paint):
+        (WebCore::RenderListMarker::layout):
+        (WebCore::RenderListMarker::imageChanged):
+        (WebCore::RenderListMarker::getRelativeMarkerRect):
+        (WebCore::RenderListMarker::selectionRect):
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::computePosition):
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::layout):
+        (WebCore::RenderMedia::lowestPosition):
+        (WebCore::RenderMedia::rightmostPosition):
+        (WebCore::RenderMedia::leftmostPosition):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::controlClipRect):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::RenderObject):
+        (WebCore::RenderObject::markAllDescendantsWithFloatsForLayout):
+        (WebCore::RenderObject::paintOutline):
+        (WebCore::RenderObject::addLineBoxRects):
+        (WebCore::RenderObject::absoluteBoundingBoxRect):
+        (WebCore::RenderObject::addAbsoluteRectForLayer):
+        (WebCore::RenderObject::paintingRootRect):
+        (WebCore::RenderObject::container):
+        (WebCore::RenderObject::removeFromObjectLists):
+        (WebCore::RenderObject::updateHitTestResult):
+        (WebCore::RenderObject::addDashboardRegions):
+        (WebCore::RenderObject::localTransform):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isBox):
+        (WebCore::RenderObject::hasMask):
+        (WebCore::RenderObject::setIsText):
+        (WebCore::RenderObject::setIsBox):
+        (WebCore::RenderObject::borderTop):
+        (WebCore::RenderObject::borderBottom):
+        (WebCore::RenderObject::absoluteRects):
+        (WebCore::RenderObject::collectAbsoluteLineBoxQuads):
+        (WebCore::RenderObject::absoluteQuads):
+        (WebCore::RenderObject::hasReflection):
+        (WebCore::RenderObject::addFocusRingRects):
+        (WebCore::RenderObject::absoluteOutlineBounds):
+        * rendering/RenderPart.cpp:
+        (WebCore::RenderPart::updateWidgetPosition):
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::layout):
+        (WebCore::RenderPath::paint):
+        (WebCore::RenderPath::absoluteOutlineBounds):
+        * rendering/RenderPath.h:
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::layout):
+        (WebCore::RenderReplaced::paint):
+        (WebCore::RenderReplaced::shouldPaint):
+        (WebCore::RenderReplaced::positionForCoordinates):
+        (WebCore::RenderReplaced::localSelectionRect):
+        (WebCore::RenderReplaced::adjustOverflowForBoxShadow):
+        (WebCore::RenderReplaced::overflowRect):
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::layout):
+        (WebCore::RenderReplica::calcPrefWidths):
+        (WebCore::RenderReplica::paint):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+        (WebCore::RenderSVGContainer::absoluteOutlineBounds):
+        * rendering/RenderSVGContainer.h:
+        (WebCore::RenderSVGContainer::width):
+        (WebCore::RenderSVGContainer::height):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::layout):
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::computeAbsoluteRectForRange):
+        (WebCore::RenderSVGInlineText::positionForCoordinates):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::layout):
+        (WebCore::RenderSVGRoot::applyContentTransforms):
+        (WebCore::RenderSVGRoot::paint):
+        (WebCore::RenderSVGRoot::absoluteTransform):
+        (WebCore::RenderSVGRoot::nodeAtPoint):
+        * rendering/RenderSVGTSpan.cpp:
+        (WebCore::RenderSVGTSpan::absoluteRects):
+        (WebCore::RenderSVGTSpan::absoluteQuads):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::layout):
+        (WebCore::RenderSVGText::relativeBBox):
+        * rendering/RenderSVGTextPath.cpp:
+        (WebCore::RenderSVGTextPath::absoluteRects):
+        (WebCore::RenderSVGTextPath::absoluteQuads):
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::nodeAtPoint):
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::createCustomScrollbar):
+        (WebCore::RenderScrollbar::RenderScrollbar):
+        (WebCore::RenderScrollbar::setParent):
+        * rendering/RenderScrollbar.h:
+        (WebCore::RenderScrollbar::owningRenderer):
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::layout):
+        (WebCore::RenderScrollbarPart::layoutHorizontalPart):
+        (WebCore::RenderScrollbarPart::layoutVerticalPart):
+        (WebCore::RenderScrollbarPart::computeScrollbarWidth):
+        (WebCore::RenderScrollbarPart::computeScrollbarHeight):
+        (WebCore::RenderScrollbarPart::paintIntoRect):
+        * rendering/RenderSlider.cpp:
+        (WebCore::HTMLSliderThumbElement::defaultEventHandler):
+        (WebCore::RenderSlider::layout):
+        (WebCore::RenderSlider::mouseEventIsInThumb):
+        (WebCore::RenderSlider::positionForOffset):
+        (WebCore::RenderSlider::trackSize):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::calcWidth):
+        (WebCore::RenderTable::layout):
+        (WebCore::RenderTable::paint):
+        (WebCore::RenderTable::getBaselineOfFirstLineBox):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::updateWidth):
+        (WebCore::RenderTableCell::computeAbsoluteRepaintRect):
+        (WebCore::RenderTableCell::localToAbsolute):
+        (WebCore::RenderTableCell::absoluteToLocal):
+        (WebCore::RenderTableCell::localToAbsoluteQuad):
+        (WebCore::RenderTableCell::paint):
+        (WebCore::RenderTableCell::paintBackgroundsBehindCell):
+        * rendering/RenderTableCell.h:
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addChild):
+        (WebCore::RenderTableSection::addCell):
+        (WebCore::RenderTableSection::setCellWidths):
+        (WebCore::RenderTableSection::calcRowHeight):
+        (WebCore::RenderTableSection::layoutRows):
+        (WebCore::RenderTableSection::lowestPosition):
+        (WebCore::RenderTableSection::rightmostPosition):
+        (WebCore::RenderTableSection::leftmostPosition):
+        (WebCore::RenderTableSection::getBaselineOfFirstLineBox):
+        (WebCore::RenderTableSection::paint):
+        (WebCore::RenderTableSection::recalcCells):
+        (WebCore::RenderTableSection::nodeAtPoint):
+        * rendering/RenderTableSection.h:
+        (WebCore::RenderTableSection::overflowWidth):
+        (WebCore::RenderTableSection::overflowHeight):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::RenderText):
+        (WebCore::RenderText::boundingBoxX):
+        (WebCore::RenderText::boundingBoxY):
+        (WebCore::RenderText::firstRunX):
+        (WebCore::RenderText::firstRunY):
+        (WebCore::RenderText::boundingBoxHeight):
+        (WebCore::RenderText::boundingBoxWidth):
+        * rendering/RenderText.h:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::textBlockHeight):
+        (WebCore::RenderTextControl::textBlockWidth):
+        (WebCore::RenderTextControl::setSelectionRange):
+        (WebCore::RenderTextControl::calcHeight):
+        (WebCore::RenderTextControl::hitInnerTextBlock):
+        (WebCore::RenderTextControl::controlClipRect):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::layout):
+        (WebCore::RenderTextControlMultiLine::adjustControlHeightBasedOnLineHeight):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::paint):
+        (WebCore::RenderTextControlSingleLine::layout):
+        (WebCore::RenderTextControlSingleLine::nodeAtPoint):
+        (WebCore::RenderTextControlSingleLine::forwardEvent):
+        (WebCore::RenderTextControlSingleLine::textBlockWidth):
+        (WebCore::RenderTextControlSingleLine::adjustControlHeightBasedOnLineHeight):
+        (WebCore::RenderTextControlSingleLine::clientPaddingLeft):
+        (WebCore::RenderTextControlSingleLine::clientPaddingRight):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::hitTestMediaControlPart):
+        (WebCore::RenderTheme::baselinePosition):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeMac::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeMac::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeMac::hitTestMediaControlPart):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::videoBox):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::RenderView):
+        (WebCore::RenderView::calcHeight):
+        (WebCore::RenderView::calcWidth):
+        (WebCore::RenderView::layout):
+        (WebCore::RenderView::viewRect):
+        (WebCore::RenderView::docHeight):
+        (WebCore::RenderView::docWidth):
+        (WebCore::RenderView::setBestTruncatedAt):
+        * rendering/RenderView.h:
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::paint):
+        (WebCore::RenderWidget::updateWidgetPosition):
+        (WebCore::RenderWidget::nodeAtPoint):
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::floats):
+        (WebCore::RootInlineBox::floatsPtr):
+        * rendering/SVGInlineFlowBox.cpp:
+        (WebCore::SVGInlineFlowBox::verticallyAlignBoxes):
+        * rendering/SVGInlineFlowBox.h:
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        (WebCore::write):
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::verticallyAlignBoxes):
+        (WebCore::SVGRootInlineBox::computePerCharacterLayoutInformation):
+        (WebCore::SVGRootInlineBox::layoutInlineBoxes):
+        * rendering/SVGRootInlineBox.h:
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::computeHorizontalPositionsForLine):
+        (WebCore::RenderBlock::computeVerticalPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::determineStartPosition):
+        (WebCore::RenderBlock::matchedEndLine):
+        (WebCore::RenderBlock::skipTrailingWhitespace):
+        (WebCore::RenderBlock::skipLeadingWhitespace):
+        (WebCore::RenderBlock::fitBelowFloats):
+        (WebCore::RenderBlock::findNextLineBreak):
+        (WebCore::RenderBlock::checkLinesForOverflow):
+        * svg/SVGLength.cpp:
+        (WebCore::SVGLength::PercentageOfViewport):
+
+2009-01-21  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * WebCore.LP64.exp:
+        Add some bridge related symbols.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Make runtime_object.h a private header.
+
+2009-01-20  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 22720: Make XMLHttpRequest work in Workers
+        <https://bugs.webkit.org/show_bug.cgi?id=22720>
+
+        More removal of document usage from XMLHttpRequest.
+        * Abstracted away the sync and async requests behind the ThreadableLoader class, which
+          will get an implementation for Workers.  ThreadableLoader follows the same model as
+          SubresourceLoader because DocumentThreadableLoader is a thin wrapper around SubresourceLoader.
+          Also, WorkerThreadableLoader (coming soon) will use DocumentThreadableLoader to get things done.
+        * Consolidated dashboard compatibility checks into usesDashboardBackwardCompatibilityMode
+          which handles workers.
+
+        No observable change in behavior, so no test.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * loader/DocumentThreadableLoader.cpp: Added.
+        (WebCore::DocumentThreadableLoader::create):
+        (WebCore::DocumentThreadableLoader::DocumentThreadableLoader):
+        (WebCore::DocumentThreadableLoader::~DocumentThreadableLoader):
+        (WebCore::DocumentThreadableLoader::cancel):
+        (WebCore::DocumentThreadableLoader::willSendRequest):
+        (WebCore::DocumentThreadableLoader::didSendData):
+        (WebCore::DocumentThreadableLoader::didReceiveResponse):
+        (WebCore::DocumentThreadableLoader::didReceiveData):
+        (WebCore::DocumentThreadableLoader::didFinishLoading):
+        (WebCore::DocumentThreadableLoader::didFail):
+        (WebCore::DocumentThreadableLoader::receivedCancellation):
+        * loader/DocumentThreadableLoader.h: Added.
+        (WebCore::DocumentThreadableLoader::refThreadableLoader):
+        (WebCore::DocumentThreadableLoader::derefThreadableLoader):
+        * loader/SubresourceLoaderClient.h:
+        (WebCore::SubresourceLoaderClient::didReceiveData):
+        * loader/ThreadableLoader.cpp: Added.
+        (WebCore::ThreadableLoader::create):
+        (WebCore::ThreadableLoader::loadResourceSynchronously):
+        * loader/ThreadableLoader.h: Added.
+        (WebCore::):
+        (WebCore::ThreadableLoader::ref):
+        (WebCore::ThreadableLoader::deref):
+        (WebCore::ThreadableLoader::~ThreadableLoader):
+        * loader/ThreadableLoaderClient.h: Added.
+        (WebCore::ThreadableLoaderClient::didSendData):
+        (WebCore::ThreadableLoaderClient::didReceiveResponse):
+        (WebCore::ThreadableLoaderClient::didReceiveData):
+        (WebCore::ThreadableLoaderClient::didFinishLoading):
+        (WebCore::ThreadableLoaderClient::didFail):
+        (WebCore::ThreadableLoaderClient::didGetCancelled):
+        (WebCore::ThreadableLoaderClient::didReceiveAuthenticationCancellation):
+        (WebCore::ThreadableLoaderClient::~ThreadableLoaderClient):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::usesDashboardBackwardCompatibilityMode):
+        (WebCore::XMLHttpRequest::send):
+        (WebCore::XMLHttpRequest::loadRequestSynchronously):
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
+        (WebCore::XMLHttpRequest::setRequestHeader):
+        (WebCore::XMLHttpRequest::processSyncLoadResults):
+        (WebCore::XMLHttpRequest::didFail):
+        (WebCore::XMLHttpRequest::didGetCancelled):
+        (WebCore::XMLHttpRequest::didFinishLoading):
+        (WebCore::XMLHttpRequest::didFinishLoadingPreflight):
+        (WebCore::XMLHttpRequest::didSendData):
+        (WebCore::XMLHttpRequest::didReceiveResponse):
+        (WebCore::XMLHttpRequest::didReceiveResponsePreflight):
+        (WebCore::XMLHttpRequest::didReceiveAuthenticationCancellation):
+        (WebCore::XMLHttpRequest::didReceiveData):
+        * xml/XMLHttpRequest.h:
+
+2009-01-19  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23317
+
+        The high CPU usage was really from repeatedly firing transitions caused
+        by a bug in the way we handle background-color animations. If animating
+        from a valid background color to no background color, we sometimes left
+        (based on timing) the background color as transparent black, but valid
+        rather than invalid, which it should be. Fixing that got rid of the
+        repeated firing.
+
+        But we really were doing more expensive iteration of all objects with
+        animations or transitions on them (running or not). So I added two
+        optimizations to quickly short circuit when an object had no running
+        animations or transitions. Things are now as zippy as ever.
+
+        Test: transitions/repeated-firing-background-color.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::hasAnimations):
+        (WebCore::CompositeAnimationPrivate::clearRenderer):
+        (WebCore::CompositeAnimationPrivate::animate):
+        (WebCore::CompositeAnimationPrivate::setAnimating):
+        (WebCore::CompositeAnimationPrivate::willNeedService):
+        (WebCore::CompositeAnimationPrivate::getAnimationForProperty):
+        (WebCore::CompositeAnimationPrivate::cleanupFinishedAnimations):
+        (WebCore::CompositeAnimationPrivate::setAnimationStartTime):
+        (WebCore::CompositeAnimationPrivate::setTransitionStartTime):
+        (WebCore::CompositeAnimationPrivate::suspendAnimations):
+        (WebCore::CompositeAnimationPrivate::resumeAnimations):
+        (WebCore::CompositeAnimationPrivate::overrideImplicitAnimations):
+        (WebCore::CompositeAnimationPrivate::resumeOverriddenImplicitAnimations):
+        (WebCore::CompositeAnimationPrivate::styleAvailable):
+        (WebCore::CompositeAnimationPrivate::isAnimatingProperty):
+        (WebCore::CompositeAnimationPrivate::numberOfActiveAnimations):
+        (WebCore::CompositeAnimation::hasAnimations):
+        * page/animation/CompositeAnimation.h:
+
+2009-01-21  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        Remove the style='' turds left by some editing commands
+        https://bugs.webkit.org/show_bug.cgi?id=23463
+
+        Test: editing/execCommand/toggle-styles.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::removeCSSStyle): check if we just removed the last CSS property and remove the style attribute as well
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::removeNodeAttribute): remove extra ;
+
+2009-01-21  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix.
+
+        Fix release-only build failure (and do a tiny code-cleanup).
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::createFontElement):
+        (WebCore::createStyleSpanElement):
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded):
+
+2009-01-21  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 23443: Table accessibility should be re-enabled after fixing crash that occurs at WebCore::AccessibilityTable::isTableExposableThroughAccessibility()
+        https://bugs.webkit.org/show_bug.cgi?id=23443
+
+        Test: accessibility/table-modification-crash.html
+
+        * page/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::updateBackingStore):
+        * page/AccessibilityObject.h:
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::childrenChanged):
+        (WebCore::AccessibilityRenderObject::children):
+        (WebCore::AccessibilityRenderObject::updateBackingStore):
+        * page/AccessibilityRenderObject.h:
+        (WebCore::AccessibilityRenderObject::markChildrenDirty):
+        * page/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::AccessibilityTable):
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityActionNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilityFocusedUIElement]):
+        (-[AccessibilityObjectWrapper accessibilityHitTest:]):
+        (-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]):
+        (-[AccessibilityObjectWrapper accessibilityIsIgnored]):
+        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityPerformPressAction]):
+        (-[AccessibilityObjectWrapper accessibilityPerformAction:]):
+        (-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
+        (-[AccessibilityObjectWrapper accessibilityIndexOfChild:]):
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeCount:]):
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::destroy):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy):
+
+2009-01-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        Fix execCommand() 'super' and 'sub' commands to add <sup> and <sub> in quirks mode, and to toggle when called twice
+        https://bugs.webkit.org/show_bug.cgi?id=17733
+
+        Test changed: editing/execCommand/toggle-styles-expected.txt
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::applySubscript):
+        (WebCore::StyleChange::applySuperscript):
+        (WebCore::StyleChange::StyleChange):
+        (WebCore::StyleChange::init):
+        (WebCore::StyleChange::checkForLegacyHTMLStyleChange):
+        (WebCore::ApplyStyleCommand::isHTMLStyleNode):
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded):
+        * editing/EditorCommand.cpp:
+        (WebCore::executeSubscript):
+        (WebCore::executeSuperscript):
+        * editing/htmlediting.cpp:
+        (WebCore::createHTMLElement):
+        * editing/htmlediting.h:
+
+2009-01-21  Anders Carlsson  <andersca@apple.com>
+
+        Fix 64-bit build.
+
+        * WebCore.LP64.exp:
+
+2009-01-21  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23458: Reintroduce CanvasPixelArray in ImageData.idl
+        <https://bugs.webkit.org/show_bug.cgi?id=23458>
+
+        Return CanvasPixelArray, et al -- the only difference between this
+        and the original CPA implementation is that it now uses a ByteArray
+        rather than a vector.  JSC still uses a custom wrapper, but this allows
+        ObjC, COM, and V8 bindings to be autogenerated again.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * html/CanvasPixelArray.cpp: Added.
+        (WebCore::CanvasPixelArray::create):
+        (WebCore::CanvasPixelArray::CanvasPixelArray):
+        * html/CanvasPixelArray.h: Added.
+        (WebCore::CanvasPixelArray::data):
+        (WebCore::CanvasPixelArray::length):
+        (WebCore::CanvasPixelArray::set):
+        (WebCore::CanvasPixelArray::get):
+        * html/CanvasPixelArray.idl: Added.
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::createEmptyImageData):
+        * html/ImageData.cpp:
+        (WebCore::ImageData::ImageData):
+        * html/ImageData.h:
+        (WebCore::ImageData::data):
+        * html/ImageData.idl:
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::getImageData):
+        (WebCore::ImageBuffer::putImageData):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::getImageData):
+        (WebCore::ImageBuffer::putImageData):
+
+2009-01-21  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Remove last relics of platform dependent PaintServer in SVG.
+        We draw everything with the help of GraphicsContext.
+
+        Remove SVGPaintServerPlatform's
+        [https://bugs.webkit.org/show_bug.cgi?id=23439]
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * svg/graphics/SVGPaintServer.cpp:
+        (WebCore::SVGPaintServer::draw):
+        (WebCore::SVGPaintServer::renderPath):
+        (WebCore::SVGPaintServer::teardown):
+        * svg/graphics/SVGPaintServer.h:
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        * svg/graphics/SVGPaintServerGradient.h:
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        * svg/graphics/SVGPaintServerPattern.h:
+        * svg/graphics/SVGPaintServerSolid.cpp:
+        * svg/graphics/SVGPaintServerSolid.h:
+        * svg/graphics/cairo/SVGPaintServerCairo.cpp: Removed.
+        * svg/graphics/cg/SVGPaintServerCg.cpp: Removed.
+        * svg/graphics/qt/SVGPaintServerQt.cpp: Removed.
+        * svg/graphics/skia/SVGPaintServerSkia.cpp: Removed.
+
+2009-01-21  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Move "Element -> ScriptElement" casting functionality into ScriptElement.h
+        to be consistent with FormControlElement/InputElement/OptionElement/OptionGroupElement.
+
+        It was living in XMLTokenizer before, which is not an obvious place for this.
+        TODO: Rename 'formControlElementForElement' to 'toFormControlElement' (analogous changes for InputElement etc.)
+              as suggested by Alexey, it really reads better this way.
+
+        * dom/ScriptElement.cpp:
+        (WebCore::toScriptElement):
+        * dom/ScriptElement.h:
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::notifyFinished):
+        * dom/XMLTokenizer.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::startElementNs):
+        (WebCore::XMLTokenizer::endElementNs):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseStartElement):
+        (WebCore::XMLTokenizer::parseEndElement):
+
+2009-01-20  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=23444
+
+        Refactor some functionality from HTMLOption/OptGroupElement needed by RenderListBox/RenderMenuList
+        in two abstract base classes: OptionElement & OptionGroupElement living in dom/ - just like it
+        has been done before for FormControlElement and RenderTextControl.
+
+        This is needed to prepare the addtion of WMLOption/OptGroupElement.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/OptionElement.cpp: Added.
+        (WebCore::optionElementForElement):
+        * dom/OptionElement.h: Added.
+        (WebCore::OptionElement::~OptionElement):
+        (WebCore::OptionElement::OptionElement):
+        * dom/OptionGroupElement.cpp: Added.
+        (WebCore::optionGroupElementForElement):
+        * dom/OptionGroupElement.h: Added.
+        (WebCore::OptionGroupElement::~OptionGroupElement):
+        (WebCore::OptionGroupElement::OptionGroupElement):
+        * html/HTMLOptGroupElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::optionText):
+        * html/HTMLOptionElement.h:
+        (WebCore::HTMLOptionElement::selected):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::updateFromElement):
+        (WebCore::RenderListBox::paintItemForeground):
+        (WebCore::RenderListBox::paintItemBackground):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::updateOptionsWidth):
+        (WebCore::RenderMenuList::setTextFromOption):
+        (WebCore::RenderMenuList::itemText):
+        (WebCore::RenderMenuList::itemIsSelected):
+
+2009-01-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23448: memory leak in Mac version of preferredExtensionForImageSourceType
+        https://bugs.webkit.org/show_bug.cgi?id=23448
+
+        * platform/graphics/cg/ImageSourceCGMac.mm:
+        (WebCore::preferredExtensionForImageSourceType): Use RetainPtr to avoid the leak.
+
+2009-01-20  Darin Adler  <darin@apple.com>
+
+        Try to fix Wx build.
+
+        * platform/wx/PasteboardWx.cpp:
+        (WebCore::Pasteboard::writeSelection): Removed code that replaces backslash
+        with backslashAsCurrencySymbol. I'm pretty sure this is not needed when writing
+        to the clipboard. Other platforms don't do it. If it was needed, the new function
+        to use would be displayStringModifiedByEncoding.
+
+2009-01-19  Brent Fulgham  <bfulgham@gmail.com>
+
+        Reviewed by Mitz Pettel.
+
+        Fixes https://bugs.webkit.org/show_bug.cgi?id=23423.
+
+        The Windows Cairo post-build targets (Release/Debug) do not
+        copy all of the headers that the CG-based build does.
+
+        * WebCore.vcproj/WebCore.vcproj: Extend WebCore Cairo build targets
+          to copy the page/animation/*.h files into WebKitBuild so that
+          WebKit can find them.
+
+2009-01-20  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23413
+        Remove unused WebCore::setDeferringTimers()
+
+        * platform/Timer.cpp:
+        (WebCore::updateSharedTimer):
+        * platform/Timer.h:
+
+2009-01-20  David Hyatt  <hyatt@apple.com>
+
+        Tighten up the type of RenderObject owned by RenderLayer to be a RenderBox.  Rename m_object to
+        m_renderer to be consistent with the corresponding member function.
+
+        Reviewed by Jon Honeycutt
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::updateVisibilityStatus):
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::stackingContext):
+        (WebCore::RenderLayer::enclosingPositionedAncestor):
+        (WebCore::RenderLayer::enclosingTransformedAncestor):
+        (WebCore::RenderLayer::isTransparent):
+        (WebCore::RenderLayer::convertToLayerCoords):
+        (WebCore::RenderLayer::scrollByRecursively):
+        (WebCore::RenderLayer::scrollToOffset):
+        (WebCore::RenderLayer::scrollRectToVisible):
+        (WebCore::RenderLayer::resize):
+        (WebCore::RenderLayer::scrollbarCornerPresent):
+        (WebCore::RenderLayer::createScrollbar):
+        (WebCore::RenderLayer::setHasHorizontalScrollbar):
+        (WebCore::RenderLayer::setHasVerticalScrollbar):
+        (WebCore::RenderLayer::positionOverflowControls):
+        (WebCore::RenderLayer::computeScrollDimensions):
+        (WebCore::RenderLayer::updateOverflowStatus):
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
+        (WebCore::RenderLayer::paintOverflowControls):
+        (WebCore::RenderLayer::paintScrollCorner):
+        (WebCore::RenderLayer::paintResizer):
+        (WebCore::RenderLayer::isPointInResizeControl):
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::updateClipRects):
+        (WebCore::RenderLayer::calculateClipRects):
+        (WebCore::RenderLayer::calculateRects):
+        (WebCore::RenderLayer::clearClipRects):
+        (WebCore::RenderLayer::repaintIncludingDescendants):
+        (WebCore::RenderLayer::styleChanged):
+        (WebCore::RenderLayer::updateScrollCornerStyle):
+        (WebCore::RenderLayer::updateResizerStyle):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::renderer):
+        (WebCore::RenderLayer::hasReflection):
+        (WebCore::RenderLayer::hasTransform):
+
+2009-01-20  David Hyatt  <hyatt@apple.com>
+
+        Fix Mac build bustage from my selection changes.  I forgot to implement the functions on RenderThemeMac
+        for returning the appropriate listbox selection colors.
+
+        Reviewed by Adele
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::platformActiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeMac::platformInactiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeMac::platformInactiveListBoxSelectionBackgroundColor):
+
+2009-01-20  Dave Hyatt  <hyatt@apple.com>
+
+        Fix for focus rings on Windows.  Make sure that focus rings draw for all controls but buttons.
+
+        Fix list box selection colors on Windows.  Also add a cache for all of the selection colors (and not just the two
+        background selection colors).
+
+        Reviewed by Adam Roben
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::selectionForegroundColor):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::activeSelectionBackgroundColor):
+        (WebCore::RenderTheme::inactiveSelectionBackgroundColor):
+        (WebCore::RenderTheme::activeSelectionForegroundColor):
+        (WebCore::RenderTheme::inactiveSelectionForegroundColor):
+        (WebCore::RenderTheme::activeListBoxSelectionBackgroundColor):
+        (WebCore::RenderTheme::inactiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderTheme::activeListBoxSelectionForegroundColor):
+        (WebCore::RenderTheme::inactiveListBoxSelectionForegroundColor):
+        (WebCore::RenderTheme::platformActiveSelectionForegroundColor):
+        (WebCore::RenderTheme::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderTheme::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderTheme::platformActiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderTheme::platformActiveListBoxSelectionForegroundColor):
+        (WebCore::RenderTheme::platformInactiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderTheme::platformInactiveListBoxSelectionForegroundColor):
+        (WebCore::RenderTheme::platformColorsDidChange):
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::supportsForegroundSelectionColors):
+        (WebCore::RenderTheme::supportsForegroundListBoxSelectionColors):
+        * rendering/RenderThemeMac.h:
+        (WebCore::RenderThemeMac::supportsForegroundSelectionColors):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::platformActiveListBoxSelectionBackgroundColor):
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeWin::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderThemeWin::supportsFocus):
+        (WebCore::RenderThemeWin::supportsFocusRing):
+        * rendering/RenderThemeWin.h:
+
+2009-01-20  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=23434
+
+        Add WML <input> element support - it required a lot of changes to the RenderText*/HTMLInput* code.
+        Now any language can provide <input>-style elements, without having to inherit from HTML* classes.
+
+        No WML specific features/attributes are handled so far. A follow-up patch will provide those bits.
+        Added very simple fast/wml/input.wml, just checking that input elements can be rendered properly now.
+        Detailed testcases will follow in conjunction with the WML specific attribute support.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        * dom/FormControlElement.cpp: Activate disabled code from previous checking.
+        (WebCore::formControlElementForElement):
+        * dom/InputElement.cpp: Ditto.
+        (WebCore::inputElementForElement):
+        * wml/WMLInputElement.cpp: Added.
+        (WebCore::WMLInputElement::WMLInputElement):
+        (WebCore::WMLInputElement::~WMLInputElement):
+        (WebCore::isInputFocusable):
+        (WebCore::WMLInputElement::isKeyboardFocusable):
+        (WebCore::WMLInputElement::isMouseFocusable):
+        (WebCore::WMLInputElement::dispatchFocusEvent):
+        (WebCore::WMLInputElement::dispatchBlurEvent):
+        (WebCore::WMLInputElement::updateFocusAppearance):
+        (WebCore::WMLInputElement::aboutToUnload):
+        (WebCore::WMLInputElement::size):
+        (WebCore::WMLInputElement::name):
+        (WebCore::WMLInputElement::value):
+        (WebCore::WMLInputElement::setValue):
+        (WebCore::WMLInputElement::setValueFromRenderer):
+        (WebCore::WMLInputElement::saveState):
+        (WebCore::WMLInputElement::restoreState):
+        (WebCore::WMLInputElement::select):
+        (WebCore::WMLInputElement::accessKeyAction):
+        (WebCore::WMLInputElement::parseMappedAttribute):
+        (WebCore::WMLInputElement::copyNonAttributeProperties):
+        (WebCore::WMLInputElement::createRenderer):
+        (WebCore::WMLInputElement::attach):
+        (WebCore::WMLInputElement::detach):
+        (WebCore::WMLInputElement::appendFormData):
+        (WebCore::WMLInputElement::reset):
+        (WebCore::WMLInputElement::defaultEventHandler):
+        (WebCore::WMLInputElement::cacheSelection):
+        (WebCore::WMLInputElement::constrainValue):
+        (WebCore::WMLInputElement::documentDidBecomeActive):
+        (WebCore::WMLInputElement::placeholderShouldBeVisible):
+        (WebCore::WMLInputElement::willMoveToNewOwnerDocument):
+        (WebCore::WMLInputElement::didMoveToNewOwnerDocument):
+        * wml/WMLInputElement.h: Added.
+        (WebCore::WMLInputElement::valueMatchesRenderer):
+        (WebCore::WMLInputElement::setValueMatchesRenderer):
+        (WebCore::WMLInputElement::shouldUseInputMethod):
+        (WebCore::WMLInputElement::isChecked):
+        (WebCore::WMLInputElement::isIndeterminate):
+        (WebCore::WMLInputElement::isTextControl):
+        (WebCore::WMLInputElement::isRadioButton):
+        (WebCore::WMLInputElement::isTextField):
+        (WebCore::WMLInputElement::isSearchField):
+        (WebCore::WMLInputElement::isInputTypeHidden):
+        (WebCore::WMLInputElement::isPasswordField):
+        (WebCore::WMLInputElement::searchEventsShouldBeDispatched):
+        (WebCore::WMLInputElement::placeholderValue):
+        * wml/WMLTagNames.in:
+
+2009-01-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Remove a little dead code left over after the fix for
+        https://bugs.webkit.org/show_bug.cgi?id=11395, which
+        moved pointer-events from SVG to be shared with HTML.
+
+        * css/SVGCSSParser.cpp:
+        (WebCore::CSSParser::parseSVGValue): Remove SVG's parsing of this
+        property since it's handled in the non-SVG function now so we'll
+        never get here.
+
+2009-01-20  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 23438: Provide a default value to the .in file parser
+
+        Added the default value 1 as it simplifies some of
+        the format by removing some "=1" that were awkward.
+
+        This was suggested by Darin Adler as par of a previous
+        review.
+
+        * bindings/scripts/InFilesParser.pm: When no value
+        was entered (the second part of the split is undef),
+        provide the default value.
+
+        * html/HTMLAttributeNames.in: Removed unnecessary "=1".
+        * html/HTMLTagNames.in: Ditto.
+        * svg/svgattrs.in: Ditto.
+        * svg/svgtags.in: Ditto.
+        * svg/xlinkattrs.in: Ditto.
+        * wml/WMLAttributeNames.in: Ditto.
+
+2009-01-20  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        * bridge/c/c_class.cpp:
+        * bridge/c/c_class.h:
+        Get rid of CClass::name().
+
+        * bridge/jni/jni_class.h:
+        Get rid of JavaClass::name().
+
+        * bridge/objc/objc_class.h:
+        * bridge/objc/objc_class.mm:
+        Get rid of ObjcClass::name().
+
+        * bridge/objc/objc_instance.h:
+        Get rid of supportsSetValueOfUndefinedField.
+
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::setValueOfUndefinedField):
+        Fold supportsSetValueOfUndefinedField into setValueOfUndefinedField.
+
+        * bridge/runtime.cpp:
+        Get rid of getValueOfField and setValueOfField.
+
+        * bridge/runtime.h:
+        (JSC::Bindings::Instance::setValueOfUndefinedField):
+        Have this return a bool and get rid of supportsSetValueOfUndefinedField
+
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::fieldGetter):
+        Call Field::valueFromInstance on the field.
+
+        (JSC::RuntimeObjectImp::put):
+        Call Field::setValueToInstance on the field.
+
+2009-01-20  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Forgot to land build changes for non-mac platforms.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+
+2009-01-20  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Roben.
+
+        Fix last-minute regression, introduced by simplifying max length determination - by
+        clamping using min/max, negative maxLength values got broken.
+
+        * dom/InputElement.cpp:
+        (WebCore::InputElement::parseMaxLengthAttribute):
+
+2009-01-20  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Roben.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=23433
+
+        Add InputElement abstraction, similar to the FormControlElement refactorization
+        done a month ago. The goal is to share as much code as possible between HTML/WMLInputElement.
+        In a previous patch the RenderTextControl class has been split-up in RenderTextControlSingle/MultiLine,
+        RenderTextControl itself only depends on FormControlElement, RenderTextControlSingleLine still
+        depends on HTMLInputElement directly -> change that and make it use the new InputElement abstraction.
+
+        A lot of code from HTMLInputElement now lives in InputElement, as static member functions - the
+        InputElement class itself is an abstract virtual class, just like ScriptElement. HTML/WMLInputElement
+        derive from InputElement, and hold a InputElementData member variable, that they pass to the
+        static functions in InputElement. The abstraction is equal to the one chosen for HTML/SVGScriptElement.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/FormControlElement.cpp: Added.
+        (WebCore::formControlElementForElement):
+        * dom/FormControlElement.h:
+        * dom/InputElement.cpp: Added.
+        (WebCore::InputElement::dispatchFocusEvent):
+        (WebCore::InputElement::dispatchBlurEvent):
+        (WebCore::InputElement::updatePlaceholderVisibility):
+        (WebCore::InputElement::updateFocusAppearance):
+        (WebCore::InputElement::updateSelectionRange):
+        (WebCore::InputElement::aboutToUnload):
+        (WebCore::InputElement::setValueFromRenderer):
+        (WebCore::numCharactersInGraphemeClusters):
+        (WebCore::InputElement::constrainValue):
+        (WebCore::numGraphemeClusters):
+        (WebCore::InputElement::handleBeforeTextInsertedEvent):
+        (WebCore::InputElement::parseSizeAttribute):
+        (WebCore::InputElement::parseMaxLengthAttribute):
+        (WebCore::InputElement::updateValueIfNeeded):
+        (WebCore::InputElement::notifyFormStateChanged):
+        (WebCore::InputElementData::InputElementData):
+        (WebCore::InputElementData::~InputElementData):
+        (WebCore::InputElementData::name):
+        (WebCore::inputElementForElement):
+        * dom/InputElement.h: Added.
+        (WebCore::InputElement::~InputElement):
+        (WebCore::InputElement::InputElement):
+        (WebCore::InputElementData::inputElement):
+        (WebCore::InputElementData::element):
+        (WebCore::InputElementData::placeholderShouldBeVisible):
+        (WebCore::InputElementData::setPlaceholderShouldBeVisible):
+        (WebCore::InputElementData::setName):
+        (WebCore::InputElementData::value):
+        (WebCore::InputElementData::setValue):
+        (WebCore::InputElementData::size):
+        (WebCore::InputElementData::setSize):
+        (WebCore::InputElementData::maxLength):
+        (WebCore::InputElementData::setMaxLength):
+        (WebCore::InputElementData::cachedSelectionStart):
+        (WebCore::InputElementData::setCachedSelectionStart):
+        (WebCore::InputElementData::cachedSelectionEnd):
+        (WebCore::InputElementData::setCachedSelectionEnd):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::HTMLInputElement):
+        (WebCore::HTMLInputElement::name):
+        (WebCore::HTMLInputElement::updateFocusAppearance): Moved to InputElement.
+        (WebCore::HTMLInputElement::aboutToUnload): Ditto.
+        (WebCore::HTMLInputElement::dispatchFocusEvent): Ditto.
+        (WebCore::HTMLInputElement::dispatchBlurEvent): Ditto.
+        (WebCore::HTMLInputElement::setSelectionRange): Moved to InputElement::updateSelectionRange, call it from here.
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::size): Make virtual and override InputElements abstract version.
+        (WebCore::HTMLInputElement::copyNonAttributeProperties):
+        (WebCore::HTMLInputElement::value): Make virtual and override InputElements abstract version.
+        (WebCore::HTMLInputElement::setValue): Ditto.
+        (WebCore::HTMLInputElement::placeholderValue): Ditto.
+        (WebCore::HTMLInputElement::searchEventsShouldBeDispatched): Ditto.
+        (WebCore::HTMLInputElement::setValueFromRenderer): Ditto.
+        (WebCore::HTMLInputElement::setFileListFromRenderer): Use new code in InputElement::setValueFromRenderer
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::setDefaultName): Added as helper function for HTMLIsIndexElement.
+        (WebCore::HTMLInputElement::maxLength): Added accesor.
+        (WebCore::HTMLInputElement::constrainValue): Move functionality to InputElement::constrainValue.
+        (WebCore::HTMLInputElement::cacheSelection): Move functionality to InputElement::cacheSelection.
+        (WebCore::HTMLInputElement::selection):
+        (WebCore::HTMLInputElement::placeholderShouldBeVisible): Make virtual and override InputElements abstract version.
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::isTextField):
+        (WebCore::HTMLInputElement::isSearchField):
+        (WebCore::HTMLInputElement::isAutofilled):
+        * html/HTMLIsIndexElement.cpp:
+        (WebCore::HTMLIsIndexElement::HTMLIsIndexElement):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::formControlElement):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::placeholderShouldBeVisible):
+        (WebCore::RenderTextControlSingleLine::addSearchResult):
+        (WebCore::RenderTextControlSingleLine::stopSearchEventTimer):
+        (WebCore::RenderTextControlSingleLine::showPopup):
+        (WebCore::RenderTextControlSingleLine::hidePopup):
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        (WebCore::RenderTextControlSingleLine::capsLockStateMayHaveChanged):
+        (WebCore::RenderTextControlSingleLine::preferredContentWidth):
+        (WebCore::RenderTextControlSingleLine::createSubtreeIfNeeded):
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        (WebCore::RenderTextControlSingleLine::cacheSelection):
+        (WebCore::RenderTextControlSingleLine::createInnerBlockStyle):
+        (WebCore::RenderTextControlSingleLine::createResultsButtonStyle):
+        (WebCore::RenderTextControlSingleLine::createCancelButtonStyle):
+        (WebCore::RenderTextControlSingleLine::updateCancelButtonVisibility):
+        (WebCore::RenderTextControlSingleLine::startSearchEventTimer):
+        (WebCore::RenderTextControlSingleLine::searchEventTimerFired):
+        (WebCore::RenderTextControlSingleLine::valueChanged):
+        (WebCore::RenderTextControlSingleLine::setTextFromItem):
+        (WebCore::RenderTextControlSingleLine::inputElement):
+        * rendering/RenderTextControlSingleLine.h:
+
+2009-01-20  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Make SVG pattern platform independent and remove platform code.
+
+        Make SVGPattern platform independent
+        https://bugs.webkit.org/show_bug.cgi?id=21205
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::applyStrokePattern):
+        (WebCore::GraphicsContext::applyFillPattern):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::strokeRect):
+        * svg/graphics/SVGPaintServerPattern.cpp:
+        (WebCore::SVGPaintServerPattern::SVGPaintServerPattern):
+        (WebCore::SVGPaintServerPattern::~SVGPaintServerPattern):
+        (WebCore::SVGPaintServerPattern::setup):
+        (WebCore::SVGPaintServerPattern::renderPath):
+        (WebCore::SVGPaintServerPattern::teardown):
+        * svg/graphics/SVGPaintServerPattern.h:
+        * svg/graphics/cairo/SVGPaintServerPatternCairo.cpp: Removed.
+        * svg/graphics/cg/SVGPaintServerPatternCg.cpp: Removed.
+        * svg/graphics/qt/SVGPaintServerPatternQt.cpp: Removed.
+        * svg/graphics/skia/SVGPaintServerPatternSkia.cpp: Removed.
+
+2009-01-20  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23436
+        Upstream rendering/RenderThemeChromium*
+
+        * rendering/RenderThemeChromiumGtk.cpp: Added.
+        * rendering/RenderThemeChromiumGtk.h: Added.
+        * rendering/RenderThemeChromiumMac.h: Added.
+        * rendering/RenderThemeChromiumMac.mm: Added.
+        * rendering/RenderThemeChromiumWin.cpp: Added.
+        * rendering/RenderThemeChromiumWin.h: Added.
+
+2009-01-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Bug 23352: Turn on more compiler warnings in the Mac build
+        https://bugs.webkit.org/show_bug.cgi?id=23352
+
+        First patch: Fix some simple cases of various warnings.
+
+        * platform/DeprecatedPtrListImpl.cpp:
+        (WebCore::DeprecatedPtrListImpl::insert): Use const_cast to change const-ness.
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::containsCharacters): Ditto.
+
+        * platform/text/PlatformString.h: Overload for short and unsigned short to avoid
+        ambiguity leading to warnings.
+        * platform/text/String.cpp:
+        (WebCore::String::number): Implemented overloads.
+
+        * platform/text/TextStream.cpp:
+        (WebCore::TextStream::operator<<): Overload for bool to avoid ambiguity leading
+        to warnings.
+        * platform/text/TextStream.h: Ditto.
+
+        * rendering/InlineFlowBox.h: Fix declaration that was specifying the wrong type.
+
+        * svg/graphics/filters/cg/WKLinearTransferFilter.m: Fix stray characters after
+        #endif that should be a comment instead.
+        * svg/graphics/filters/cg/WKSpecularLightingFilter.h: Ditto.
+
+        * xml/XPathPath.h: Remove unneeded redundant declaration.
+
+2009-01-20  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Build fix for WML enabled builds, not reviewed.
+
+        Fix unused variable warning.
+
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::executeTask):
+
+2009-01-20  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Build fix for WML enabled builds, not reviewed.
+
+        Rename 'continuation' to 'virtualContinuation'.
+
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::isKeyboardFocusable):
+
+2009-01-20  Oliver Hunt  <oliver@apple.com>
+
+        RS=Dan Bernstein
+
+        Move runtime/ByteArray to wtf/ByteArray
+
+        * ForwardingHeaders/wtf/ByteArray.h: Renamed from WebCore/ForwardingHeaders/runtime/ByteArray.h.
+        * html/CanvasRenderingContext2D.cpp:
+        * html/ImageData.cpp:
+        (WebCore::ImageData::ImageData):
+        * html/ImageData.h:
+        (WebCore::ImageData::data):
+
+2009-01-20  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23391
+        Upstream plugins/chromium/
+
+        * plugins/chromium: Added.
+        * plugins/chromium/PluginDataChromium.cpp: Added.
+
+2009-01-19  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix Windows release build.
+        Move SVG files into all-in-one file for Windows build.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * svg/SVGAllInOne.cpp: Added.
+
+2009-01-19  Steve Falkenburg  <sfalken@apple.com>
+
+        Partial build fix.
+        Move new derived sources into all-in-one DerivedSources.cpp
+
+        * DerivedSources.cpp:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-01-19  Sam Weinig  <sam@webkit.org>
+
+        Fix Qt build.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::mark):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::valueRealType):
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        (JSC::Bindings::QtConnectionObject::execute):
+
+2009-01-19  Sam Weinig  <sam@webkit.org>
+
+        Fix wx build.
+
+        * plugins/PluginView.cpp:
+        (WebCore::getString):
+
+2009-01-19  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Gavin Barraclough.
+
+        Remove temporary operator-> from JSValuePtr.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::constructAudio):
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::toHTMLCanvasStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillColor):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
+        (WebCore::JSCanvasRenderingContext2D::strokeRect):
+        (WebCore::JSCanvasRenderingContext2D::drawImage):
+        (WebCore::JSCanvasRenderingContext2D::drawImageFromRect):
+        (WebCore::JSCanvasRenderingContext2D::setShadow):
+        (WebCore::JSCanvasRenderingContext2D::createPattern):
+        (WebCore::JSCanvasRenderingContext2D::putImageData):
+        (WebCore::JSCanvasRenderingContext2D::fillText):
+        (WebCore::JSCanvasRenderingContext2D::strokeText):
+        * bindings/js/JSClipboardCustom.cpp:
+        (WebCore::JSClipboard::clearData):
+        (WebCore::JSClipboard::getData):
+        (WebCore::JSClipboard::setData):
+        (WebCore::JSClipboard::setDragImage):
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        (WebCore::toVoidCallback):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::create):
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::hasItem):
+        (WebCore::JSDOMApplicationCache::add):
+        (WebCore::JSDOMApplicationCache::remove):
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::valueToStringWithNullCheck):
+        (WebCore::valueToStringWithUndefinedOrNullCheck):
+        (WebCore::reportException):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::findJSEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSEventListener):
+        (WebCore::JSDOMGlobalObject::findJSUnprotectedEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSUnprotectedEventListener):
+        * bindings/js/JSDOMStringListCustom.cpp:
+        (WebCore::JSDOMStringList::item):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::getOwnPropertySlot):
+        (windowProtoFuncOpen):
+        (WebCore::toJSDOMWindow):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::JSDOMWindow::postMessage):
+        (WebCore::setTimeoutOrInterval):
+        (WebCore::JSDOMWindow::clearTimeout):
+        (WebCore::JSDOMWindow::clearInterval):
+        (WebCore::JSDOMWindow::atob):
+        (WebCore::JSDOMWindow::btoa):
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        (WebCore::toDOMWindow):
+        * bindings/js/JSDatabaseCustom.cpp:
+        (WebCore::JSDatabase::changeVersion):
+        (WebCore::JSDatabase::transaction):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::setLocation):
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::JSElement::setAttribute):
+        (WebCore::JSElement::setAttributeNS):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSAbstractEventListener::handleEvent):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSEventTargetNodeCustom.cpp:
+        (WebCore::JSEventTargetNode::addEventListener):
+        (WebCore::JSEventTargetNode::removeEventListener):
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionOptions):
+        (WebCore::JSGeolocation::getCurrentPosition):
+        (WebCore::JSGeolocation::watchPosition):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLCollection::canGetItemsForName):
+        (WebCore::JSHTMLCollection::item):
+        (WebCore::JSHTMLCollection::namedItem):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::open):
+        (WebCore::writeHelper):
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::JSHTMLOptionsCollection::setLength):
+        (WebCore::JSHTMLOptionsCollection::add):
+        * bindings/js/JSHTMLSelectElementCustom.cpp:
+        (WebCore::JSHTMLSelectElement::remove):
+        (WebCore::selectIndexSetter):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::constructImage):
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::wrap):
+        (WebCore::JSInspectedObjectWrapper::prepareIncomingValue):
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::wrap):
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::evaluate):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::setHref):
+        (WebCore::JSLocation::setProtocol):
+        (WebCore::JSLocation::setHost):
+        (WebCore::JSLocation::setHostname):
+        (WebCore::JSLocation::setPort):
+        (WebCore::JSLocation::setPathname):
+        (WebCore::JSLocation::setSearch):
+        (WebCore::JSLocation::setHash):
+        (WebCore::JSLocation::replace):
+        (WebCore::JSLocation::assign):
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::mark):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::startConversation):
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::mark):
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSNodeFilterCondition.h:
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::toNodeFilter):
+        * bindings/js/JSNodeListCustom.cpp:
+        (WebCore::callNodeList):
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::constructHTMLOptionElement):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::asWrapper):
+        (WebCore::JSQuarantinedObjectWrapper::construct):
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        (WebCore::JSSQLResultSetRowList::item):
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        (WebCore::JSSQLTransaction::executeSql):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSSVGLengthCustom.cpp:
+        (WebCore::JSSVGLength::convertToSpecifiedUnits):
+        * bindings/js/JSSVGMatrixCustom.cpp:
+        (WebCore::JSSVGMatrix::translate):
+        (WebCore::JSSVGMatrix::scale):
+        (WebCore::JSSVGMatrix::scaleNonUniform):
+        (WebCore::JSSVGMatrix::rotate):
+        (WebCore::JSSVGMatrix::rotateFromVector):
+        (WebCore::JSSVGMatrix::skewX):
+        (WebCore::JSSVGMatrix::skewY):
+        * bindings/js/JSSVGPathSegListCustom.cpp:
+        (WebCore::JSSVGPathSegList::getItem):
+        (WebCore::JSSVGPathSegList::insertItemBefore):
+        (WebCore::JSSVGPathSegList::replaceItem):
+        (WebCore::JSSVGPathSegList::removeItem):
+        * bindings/js/JSSVGPointListCustom.cpp:
+        (WebCore::JSSVGPointList::getItem):
+        (WebCore::JSSVGPointList::insertItemBefore):
+        (WebCore::JSSVGPointList::replaceItem):
+        (WebCore::JSSVGPointList::removeItem):
+        * bindings/js/JSSVGTransformListCustom.cpp:
+        (WebCore::JSSVGTransformList::getItem):
+        (WebCore::JSSVGTransformList::insertItemBefore):
+        (WebCore::JSSVGTransformList::replaceItem):
+        (WebCore::JSSVGTransformList::removeItem):
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::deleteProperty):
+        (WebCore::JSStorage::customPut):
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::constructWebKitCSSMatrix):
+        * bindings/js/JSWorkerConstructor.cpp:
+        (WebCore::constructWorker):
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::addEventListener):
+        (WebCore::JSWorker::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::open):
+        (WebCore::JSXMLHttpRequest::setRequestHeader):
+        (WebCore::JSXMLHttpRequest::send):
+        (WebCore::JSXMLHttpRequest::getResponseHeader):
+        (WebCore::JSXMLHttpRequest::overrideMimeType):
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/JSXSLTProcessorCustom.cpp:
+        (WebCore::JSXSLTProcessor::importStylesheet):
+        (WebCore::JSXSLTProcessor::transformToFragment):
+        (WebCore::JSXSLTProcessor::transformToDocument):
+        (WebCore::JSXSLTProcessor::setParameter):
+        (WebCore::JSXSLTProcessor::getParameter):
+        (WebCore::JSXSLTProcessor::removeParameter):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::executeFunctionInContext):
+        * bindings/js/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::initialize):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::getString):
+        (WebCore::ScriptValue::isNull):
+        (WebCore::ScriptValue::isUndefined):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_HasMethod):
+        (_NPN_Construct):
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertValueToNPVariant):
+        * bridge/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::convertValueToJObject):
+        * bridge/jni/jni_runtime.cpp:
+        (JavaField::dispatchValueFromInstance):
+        (JavaField::valueFromInstance):
+        (JavaField::dispatchSetValueToInstance):
+        (JavaField::setValueToInstance):
+        * bridge/jni/jni_utility.cpp:
+        (JSC::Bindings::convertArrayInstanceToJavaArray):
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::callObjCFallbackObject):
+        * bridge/objc/objc_utility.mm:
+        (JSC::Bindings::convertValueToObjcValue):
+        * bridge/runtime_method.cpp:
+        (JSC::callRuntimeMethod):
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getOwnPropertySlot):
+        (JSC::callRuntimeConstructor):
+
+2009-01-20  Gustavo Noronha Silva  <gns@gnome.org>
+
+         Reviewed by Mark Rowe.
+
+         https://bugs.webkit.org/show_bug.cgi?id=23419
+         removal of FramePrivate.h breaks GTK+'s make dist
+
+         * GNUmakefile.am: No longer mention FramePrivate.h in our build,
+         since it was removed.
+
+2009-01-20  Alexander V. Butenko  <alex@digiqube.com>
+
+        Reviewed by Holger Freyther.
+
+        http://bugs.webkit.org/show_bug.cgi?id=23116
+        [GTK] Fix crash due a callback called from GIO after the
+        destruction of the ResourceHandle
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::cancel): Only call didFinishLoading if
+        'client' is set, otherwise cancelling a load could lead to a crash.
+
+2009-01-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Build fix: remove duplicate entries in the Xcode project, and
+        sort the project with sort-Xcode-project-file .
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-01-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=18078
+
+        Support animations and transitions of shorthand properties by creating
+        PropertyWrappers that simply wrap a vector of atomic wrappers, and implement
+        equal() and blend(). Build that collection of shorthand wrappers using the
+        shorthand map that CSSMutableStyleDeclaration already has. Skip comparing these
+        shorthand wrappers during 'all' transitions.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        Add CSSPropertyLonghand.h/cpp.
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::removeShorthandProperty):
+        Move CSSPropertyLonghand to its own file.
+
+        * css/CSSPropertyLonghand.cpp: Added.
+        (WebCore::initShorthandMap):
+        (WebCore::longhandForProperty):
+        * css/CSSPropertyLonghand.h: Added.
+        (WebCore::CSSPropertyLonghand::CSSPropertyLonghand):
+        (WebCore::CSSPropertyLonghand::properties):
+        (WebCore::CSSPropertyLonghand::length):
+        Code moved from CSSMutableStyleDeclaration.h/cpp
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::PropertyWrapperBase::isShorthandWrapper):
+        (WebCore::ShorthandPropertyWrapper::ShorthandPropertyWrapper):
+        (WebCore::ShorthandPropertyWrapper::isShorthandWrapper):
+        (WebCore::ShorthandPropertyWrapper::equals):
+        (WebCore::ShorthandPropertyWrapper::blend):
+        Add a wrapper class for shorthand properties that simply wraps an
+        array of atomic property wrappers.
+
+        (WebCore::ensurePropertyMap):
+        (WebCore::addPropertyWrapper):
+        (WebCore::addShorthandProperties):
+        (WebCore::wrapperForProperty):
+        (WebCore::AnimationBase::propertiesEqual):
+        (WebCore::AnimationBase::getPropertyAtIndex):
+        Some minor refactoring to re-use wrapperForProperty(), and ensure that gPropertyWrapperMap
+        is filled with an invalid index (-1), not 0.
+
+        (WebCore::AnimationBase::blendProperties):
+        * page/animation/AnimationBase.h:
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::updateTransitions):
+        When doing 'all' transitions, skip shorthand wrappers, since 'all' transitions
+        just need to compare all the atomic property wrappers.
+
+2009-01-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Actually add the new header.
+
+        * dom/GenericWorkerTask.h: Added.
+
+2009-01-19  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22720
+
+        Provide a generic class to handle the pattern of task callbacks across worker/parent threads.  It
+        only works for methods that need 6 parameters but similar classes could be added as needed for
+        other numbers of parameters.
+
+        Add addMessage and resourceRetrievedByXMLHttpRequest to ScriptExecutionContext.
+
+        Use these methods and others to remove document() from XMLHttpRequest in a few more places.
+
+        No observable change in behavior, so no test.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Sorted project file while adding GenericWorkerTask.h
+
+        * bindings/js/ScriptString.h:
+        (WebCore::ScriptString::operator=):
+        (WebCore::ScriptString::operator+=):
+        (WebCore::ScriptString::operator==):
+        (WebCore::ScriptString::operator!=):
+        Removed unnecessary JSLock.
+
+        * dom/Document.cpp:
+        (WebCore::Document::addMessage):
+        (WebCore::Document::resourceRetrievedByXMLHttpRequest):
+        * dom/Document.h:
+        * dom/GenericWorkerTask.h: Added.
+        (WebCore::GenericWorkerTaskBase::GenericWorkerTaskBase):
+        (WebCore::GenericWorkerTaskBase::canPerformTask):
+        (WebCore::GenericWorkerTask6::create):
+        (WebCore::GenericWorkerTask6::GenericWorkerTask6):
+        (WebCore::GenericWorkerTask6::performTask):
+        (WebCore::createCallbackTask):
+        * dom/ScriptExecutionContext.h:
+        * dom/WorkerContext.cpp:
+        (WebCore::addMessageTask):
+        (WebCore::WorkerContext::addMessage):
+        (WebCore::WorkerContext::resourceRetrievedByXMLHttpRequest):
+        (WebCore::WorkerContext::postTaskToParentContext):
+        * dom/WorkerContext.h:
+        * dom/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerMessagingProxy::postTaskToParentContext):
+        * dom/WorkerMessagingProxy.h:
+        * dom/WorkerThread.h:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::dropProtection):
+        (WebCore::reportUnsafeUsage):
+        (WebCore::XMLHttpRequest::setRequestHeader):
+        (WebCore::XMLHttpRequest::getResponseHeader):
+        (WebCore::XMLHttpRequest::didFinishLoading):
+        * xml/XMLHttpRequest.h:
+        (WebCore::XMLHttpRequest::create):
+
+
+2009-01-19  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 23422: AX: AXLinks should expose access key information
+        https://bugs.webkit.org/show_bug.cgi?id=23422
+
+        Test: accessibility/accesskey.html
+
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+
+2009-01-19  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23417
+        Implement application cache obsolete state
+
+        Test: http/tests/appcache/remove-cache.html
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::mark):
+        * dom/EventNames.h:
+        * loader/appcache/DOMApplicationCache.h:
+        (WebCore::DOMApplicationCache::Status):
+        (WebCore::DOMApplicationCache::setOnobsolete):
+        (WebCore::DOMApplicationCache::onobsolete):
+        * loader/appcache/DOMApplicationCache.idl:
+        Added "obsolete" event and status.
+
+        * loader/appcache/ApplicationCacheGroup.h:
+        (WebCore::ApplicationCacheGroup::savedNewestCachePointer): Removed, there is no longer
+        any need to track what the newest cache was during teardown.
+        (WebCore::ApplicationCacheGroup::updateStatus): Renamed Status to UpdateStatus, reducing
+        confusion with cache group lifecycle status.
+        (WebCore::ApplicationCacheGroup::m_isObsolete): Added an obsolete state flag.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::ApplicationCacheGroup): Initialize m_isObsolete.
+        (WebCore::ApplicationCacheGroup::cacheForMainRequest): Assert that the returned cache does
+        not belong to an obsolete group.
+        (WebCore::ApplicationCacheGroup::fallbackCacheForMainRequest): Ditto.
+        (WebCore::ApplicationCacheGroup::disassociateDocumentLoader): Disassociation can now happen
+        via a JS swapCache() call, not only when the loader is destroyed.
+        (WebCore::ApplicationCacheGroup::cacheDestroyed): Don't track m_savedNewestCachePointer.
+        (WebCore::ApplicationCacheGroup::setNewestCache): Remove old newest cache from storage is
+        a caller responsibility, because this method is also used when loading caches from disk.
+        (WebCore::ApplicationCacheGroup::makeObsolete): Added. Mark the cache group as obsolete, and
+        inform cache storage, so that it could be removed.
+        (WebCore::ApplicationCacheGroup::didFailToLoadManifest): Removed, as all this method did
+        was call cacheUpdateFailed().
+        (WebCore::ApplicationCacheGroup::didReceiveResponse): Added a FIXME about correct failure
+        handing.
+        (WebCore::ApplicationCacheGroup::didFail): Ditto.
+        (WebCore::ApplicationCacheGroup::didReceiveManifestResponse): Call a new manifestNotFound()
+        method for 404 and 410 responses.
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest): Call cacheUpdateFailed()
+        directly, instead of the removed didFailToLoadManifest().
+        (WebCore::ApplicationCacheGroup::manifestNotFound): Implement "remove a cache" algorithm.
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete): Remove superceded cache from storage
+        after update successfully finishes (moved from setNewestCache()).
+        (WebCore::ApplicationCacheGroup::associateDocumentLoaderWithCache): Revive the group using
+        an explicitly passed pointer, without the need to save it during teardown.
+
+        * loader/DocumentLoader.cpp: (WebCore::DocumentLoader::~DocumentLoader):
+        Call the general ApplicationCacheGroup::disassociateDocumentLoader() method.
+
+        * loader/appcache/ApplicationCacheStorage.h: Added a cacheGroupMadeObsolete() method, updated
+        some comments.
+
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::cacheGroupForURL): Assert that iterated caches are not
+        obsolete.
+        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL): Ditto.
+        (WebCore::ApplicationCacheStorage::cacheGroupDestroyed): Don't do anything for obsolete
+        groups, as they cannot be in storage.
+        (WebCore::ApplicationCacheStorage::cacheGroupMadeObsolete): Remove the cache group from storage
+        completely, so that a new one could replace it, if necessary.
+        (WebCore::ApplicationCacheStorage::storeNewestCache): Added assertions.
+        (WebCore::ApplicationCacheStorage::remove): Remove cache group if its newest cache is removed.
+
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::status): Added support for OBSOLETE state.
+        (WebCore::DOMApplicationCache::swapCache): Disassociate document loader from cache if the
+        application was removed server-side.
+        (WebCore::DOMApplicationCache::callObsoleteListener): Added support for obsolete event.
+
+        * loader/appcache/DOMApplicationCache.h:
+        (WebCore::DOMApplicationCache::Status):
+        (WebCore::DOMApplicationCache::setOnobsolete):
+        (WebCore::DOMApplicationCache::onobsolete):
+        Added support for OBSOLETE state and obsolete event.
+
+        * loader/appcache/DOMApplicationCache.idl: Ditto.
+
+2009-01-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        Allow plug-in views to return an instance directly.
+
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+
+2009-01-19  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by David Hyatt.
+
+        AX: some buttons don't expose AXPress as an action
+        https://bugs.webkit.org/show_bug.cgi?id=23399
+
+        Test: accessibility/button-press-action.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::actionElement):
+
+2009-01-19  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * WebCore.vcproj/WebCore.vcproj: Copy headers from page/animation into
+        $WebKitOutputDir so that WebKit can access them.
+
+        * html/HTMLBaseFontElement.cpp: Touched this file to cause a rebuild
+        and header copy.
+
+2009-01-19  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        http://www.qtsoftware.com/developer/task-tracker/index_html?id=211228&method=entry
+
+        [Qt] Show focus rect when a button gets the focus for the first time.
+        This is important at least for Windows style.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::applyTheme):
+
+2009-01-19  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        [Qt] Build fix after r39971.
+
+        * platform/qt/LoggingQt.cpp:
+        (WebCore::InitializeLoggingChannelsIfNecessary):
+
+2009-01-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23415
+        Remove FramePrivate
+
+        Minor PLT speedup.
+
+        * WebCore.base.exp:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/FrameLoader.cpp:
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        (WebCore::Frame::~Frame):
+        (WebCore::Frame::init):
+        (WebCore::Frame::loader):
+        (WebCore::Frame::view):
+        (WebCore::Frame::setView):
+        (WebCore::Frame::script):
+        (WebCore::Frame::document):
+        (WebCore::Frame::setDocument):
+        (WebCore::Frame::settings):
+        (WebCore::Frame::selection):
+        (WebCore::Frame::editor):
+        (WebCore::Frame::selectionGranularity):
+        (WebCore::Frame::setSelectionGranularity):
+        (WebCore::Frame::dragCaretController):
+        (WebCore::Frame::animation):
+        (WebCore::Frame::mark):
+        (WebCore::Frame::setMark):
+        (WebCore::Frame::setCaretVisible):
+        (WebCore::Frame::clearCaretRectIfNeeded):
+        (WebCore::Frame::selectionLayoutChanged):
+        (WebCore::Frame::caretBlinkTimerFired):
+        (WebCore::Frame::paintCaret):
+        (WebCore::Frame::paintDragCaret):
+        (WebCore::Frame::zoomFactor):
+        (WebCore::Frame::isZoomFactorTextOnly):
+        (WebCore::Frame::shouldApplyTextZoom):
+        (WebCore::Frame::shouldApplyPageZoom):
+        (WebCore::Frame::setZoomFactor):
+        (WebCore::Frame::setPrinting):
+        (WebCore::Frame::setJSStatusBarText):
+        (WebCore::Frame::setJSDefaultStatusBarText):
+        (WebCore::Frame::jsStatusBarText):
+        (WebCore::Frame::jsDefaultStatusBarText):
+        (WebCore::Frame::setNeedsReapplyStyles):
+        (WebCore::Frame::needsReapplyStyles):
+        (WebCore::Frame::reapplyStyles):
+        (WebCore::Frame::isContentEditable):
+        (WebCore::Frame::updateSecureKeyboardEntryIfActive):
+        (WebCore::Frame::typingStyle):
+        (WebCore::Frame::setTypingStyle):
+        (WebCore::Frame::clearTypingStyle):
+        (WebCore::Frame::computeAndSetTypingStyle):
+        (WebCore::Frame::selectionComputedStyle):
+        (WebCore::Frame::applyEditingStyleToBodyElement):
+        (WebCore::Frame::removeEditingStyleFromBodyElement):
+        (WebCore::Frame::keepAlive):
+        (WebCore::Frame::cancelAllKeepAlive):
+        (WebCore::Frame::clearDOMWindow):
+        (WebCore::Frame::ownerElement):
+        (WebCore::Frame::ownerRenderer):
+        (WebCore::Frame::isDisconnected):
+        (WebCore::Frame::setIsDisconnected):
+        (WebCore::Frame::excludeFromTextSearch):
+        (WebCore::Frame::setExcludeFromTextSearch):
+        (WebCore::Frame::selectionBounds):
+        (WebCore::Frame::selectionTextRects):
+        (WebCore::Frame::isFrameSet):
+        (WebCore::Frame::currentForm):
+        (WebCore::Frame::forceLayout):
+        (WebCore::Frame::sendScrollEvent):
+        (WebCore::Frame::clearTimers):
+        (WebCore::Frame::styleForSelectionStart):
+        (WebCore::Frame::inViewSourceMode):
+        (WebCore::Frame::setInViewSourceMode):
+        (WebCore::Frame::markAllMatchesForText):
+        (WebCore::Frame::markedTextMatchesAreHighlighted):
+        (WebCore::Frame::setMarkedTextMatchesAreHighlighted):
+        (WebCore::Frame::tree):
+        (WebCore::Frame::setDOMWindow):
+        (WebCore::Frame::domWindow):
+        (WebCore::Frame::clearFormerDOMWindow):
+        (WebCore::Frame::page):
+        (WebCore::Frame::eventHandler):
+        (WebCore::Frame::pageDestroyed):
+        (WebCore::Frame::disconnectOwnerElement):
+        (WebCore::Frame::documentAtPoint):
+        * page/Frame.h:
+        * page/FramePrivate.h: Removed.
+        * page/FrameTree.h:
+        * page/chromium/FrameChromium.cpp:
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::imageFromRect):
+        (WebCore::Frame::selectionImage):
+        (WebCore::Frame::snapshotDragImage):
+        (WebCore::Frame::nodeImage):
+        (WebCore::Frame::setUserStyleSheetLocation):
+        (WebCore::Frame::setUserStyleSheet):
+        * page/qt/FrameQt.cpp:
+        (WebCore::Frame::setUserStyleSheetLocation):
+        (WebCore::Frame::setUserStyleSheet):
+        * page/win/FrameCGWin.cpp:
+        (WebCore::Frame::nodeImage):
+        * page/win/FrameWin.cpp:
+
+2009-01-18  Eric Carlson  <eric.carlson@apple.com>
+
+        Build fix for !ENABLE(VIDEO) following r40016.
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::mouseEventIsInThumb):
+
+2009-01-17  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+2009-01-17  David Hyatt  <hyatt@apple.com>
+
+        Optimize isTextNode() the same way isElementNode() was optimized in an earlier checkin.  isTextNode()
+        on Node is now non-virtual and just checks a bit that is set at construction time by Text.
+
+        Reviewed by Sam Weinig
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::CharacterData):
+        * dom/CharacterData.h:
+        * dom/EventTargetNode.cpp:
+        (WebCore::EventTargetNode::EventTargetNode):
+        * dom/EventTargetNode.h:
+        * dom/Node.cpp:
+        (WebCore::Node::Node):
+        * dom/Node.h:
+        (WebCore::Node::isTextNode):
+        (WebCore::Node::isAttributeNode):
+        * dom/Text.cpp:
+        (WebCore::Text::Text):
+        * dom/Text.h:
+
+2009-01-17  David Hyatt  <hyatt@apple.com>
+
+        Change how backslashAsCurrencySymbol() works.  Instead of forcing call sites to do the direct
+        replacement themselves, the exact transformation is instead done by the encoding (indirectly through
+        a method on Document).
+
+        These changes allow the fast case (where no replacement is needed) checks to be completely inlined for
+        a slight speedup, and also allow encodings to do future alterations to displayed string content without
+        having to patch call sites again.
+
+        Reviewed by Oliver Hunt
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        * dom/Document.h:
+        (WebCore::Document::displayStringModifiedByEncoding):
+        (WebCore::Document::displayBufferModifiedByEncoding):
+        * editing/Editor.cpp:
+        (WebCore::Editor::addToKillRing):
+        * editing/TextIterator.cpp:
+        (WebCore::plainTextToMallocAllocatedBuffer):
+        (WebCore::plainText):
+        * editing/TextIterator.h:
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::groupLabelText):
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::text):
+        * loader/DocumentLoader.cpp:
+        (WebCore::canonicalizedTitle):
+        * page/Chrome.cpp:
+        (WebCore::displayString):
+        (WebCore::Chrome::runJavaScriptAlert):
+        (WebCore::Chrome::runJavaScriptConfirm):
+        (WebCore::Chrome::runJavaScriptPrompt):
+        (WebCore::Chrome::setStatusbarText):
+        * page/Frame.cpp:
+        (WebCore::Frame::shouldClose):
+        * page/Frame.h:
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeSelection):
+        * platform/text/TextCodecICU.cpp:
+        (WebCore::TextCodecICU::encode):
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::TextEncoding):
+        * platform/text/TextEncoding.h:
+        (WebCore::TextEncoding::displayString):
+        (WebCore::TextEncoding::displayBuffer):
+        * rendering/HitTestResult.cpp:
+        (WebCore::displayString):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderObject.cpp:
+        * rendering/RenderObject.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::RenderText):
+        (WebCore::RenderText::setTextInternal):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setInnerTextValue):
+        (WebCore::RenderTextControl::finishText):
+
+2009-01-17  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adele Peterson
+
+        Complete <rdar://problem/6293969>
+
+        * DerivedSources.make: include mediaControlsQT.css for Mac build.
+
+        * WebCore.xcodeproj/project.pbxproj: add mediaControlsQT.css
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): add MediaTimelineContainerPart,
+        CSSValueMediaCurrentTimeDisplay, and CSSValueMediaTimeRemainingDisplay
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): include new media controller element styles
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::): Ditto.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):  include new media
+        controller element styles
+
+        * css/CSSValueKeywords.in: add keywords for new media time display controls
+
+        * css/mediaControls.css: adjust css for new control elements
+
+        * css/mediaControlsQT.css: Added.
+
+        * platform/ThemeTypes.h:
+        (WebCore::): add media time display controls to ControlPart
+
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm: pass controller style to WKSI functions
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaTextDisplayElement::MediaTextDisplayElement): Added
+        (WebCore::MediaTextDisplayElement::attachToParent): Added
+        (WebCore::MediaTextDisplayElement::update): Added
+        (WebCore::MediaTimeDisplayElement::MediaTimeDisplayElement): Added
+        (WebCore::MediaControlInputElement::MediaControlInputElement): Added
+        (WebCore::MediaControlInputElement::hitTest): Added
+        (WebCore::MediaControlTimelineElement::defaultEventHandler): Update the time display when
+        dragging the thumb
+        * rendering/MediaControlElements.h:
+        (WebCore::): Add MediaTextDisplayElement
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createTimelineContainer): Added
+        (WebCore::RenderMedia::createTimeline): Parent is now the timeline container
+        (WebCore::RenderMedia::createCurrentTimeDisplay): Added
+        (WebCore::RenderMedia::createTimeRemainingDisplay): Added
+        (WebCore::RenderMedia::updateControls): Create new elements. Don't ever start the time update
+        timer when the time display elements are not visible
+        (WebCore::RenderMedia::formatTime): Handle negative times. Don't display 0 hours or minutes
+        (WebCore::RenderMedia::updateTimeDisplay): Do nothing when the time display elements are not
+        visible. Display time remaining as well as current time.
+        (WebCore::RenderMedia::updateControlVisibility): Don't assume opacity should be set to 0 when
+        visibility changes
+        (WebCore::RenderMedia::forwardEvent): Call element hitTest() method instead of local function
+        as we can't assume that all controls are rectangular
+        * rendering/RenderMedia.h: Updated
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::mouseEventIsInThumb): When slider is media timeline control, call
+        element hitTest() method instead of assuming it is rectangular
+        * rendering/RenderSlider.h: make mouseEventIsInThumb virtual
+
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::paint): Deal with time display and timeline container
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::paintMediaTimelineContainer): Updated
+        (WebCore::RenderTheme::paintMediaCurrentTime): Added
+        (WebCore::RenderTheme::paintMediaTimeRemaining): Added
+
+        * rendering/RenderThemeMac.h: Updated
+        * rendering/RenderThemeMac.mm:
+        (WebCore::):
+        (WebCore::mediaControllerTheme):
+        (WebCore::RenderThemeMac::adjustSliderThumbSize): Call WebKitSystemInterface to get the thumb
+        size when appropriate
+        (WebCore::RenderThemeMac::paintMediaFullscreenButton): pass controller style to render function
+        (WebCore::RenderThemeMac::paintMediaMuteButton): Ditto
+        (WebCore::RenderThemeMac::paintMediaPlayButton): Ditto
+        (WebCore::RenderThemeMac::paintMediaSeekBackButton): Ditto
+        (WebCore::RenderThemeMac::paintMediaSeekForwardButton): Ditto
+        (WebCore::RenderThemeMac::paintMediaSliderTrack): Ditto
+        (WebCore::RenderThemeMac::paintMediaSliderThumb): Ditto
+        (WebCore::RenderThemeMac::paintMediaTimelineContainer): Added
+        (WebCore::RenderThemeMac::paintMediaCurrentTime): Added
+        (WebCore::RenderThemeMac::paintMediaTimeRemaining): Added
+        (WebCore::RenderThemeMac::extraMediaControlsStyleSheet): Added
+        (WebCore::RenderThemeMac::hitTestMediaControlPart): Added
+        * rendering/style/RenderStyle.h: Updated
+        (WebCore::):
+
+2009-01-17  David Hyatt  <hyatt@apple.com>
+
+        Inline a few methods in FrameView for speed.
+
+        Reviewed by Oliver Hunt
+
+        * page/FrameView.cpp:
+        * page/FrameView.h:
+        (WebCore::FrameView::layoutCount):
+        (WebCore::FrameView::needsFullRepaint):
+
+2009-01-17  David Hyatt  <hyatt@apple.com>
+
+        Inline Document::documentElement(), since it is used by the (very hot) RenderObject::isRoot().  Split off
+        the code that fetches and caches the document element into a separate function and inline the part that
+        does the null check and the return of the already-cached element.
+
+        Reviewed by Oliver Hunt
+
+        * dom/Document.cpp:
+        (WebCore::Document::cacheDocumentElement):
+        * dom/Document.h:
+        (WebCore::Document::documentElement):
+
+2009-01-17  David Hyatt  <hyatt@apple.com>
+
+        Minor tweaks to RenderBox::styleChange to speed it up.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+
+2009-01-17  David Hyatt  <hyatt@apple.com>
+
+        Inline FrameLoader::client().
+
+        Reviewed by Oliver Hunt
+
+        * WebCore.base.exp:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::client):
+
+2009-01-17  David Hyatt  <hyatt@apple.com>
+
+        Inline some Image methods for speed.  Fix CachedImage's addClient method to just use isNull rather
+        than needlessly creating a rect.
+
+        Reviewed by Oliver Hunt
+
+        * loader/CachedImage.cpp:
+        (WebCore::CachedImage::addClient):
+        * platform/graphics/Image.cpp:
+        * platform/graphics/Image.h:
+        (WebCore::Image::isNull):
+        (WebCore::Image::rect):
+        (WebCore::Image::width):
+        (WebCore::Image::height):
+
+2009-01-17  David Hyatt  <hyatt@apple.com>
+
+        Avoid using the non-inlined isVariable() when adding parsed values during CSS parsing.
+
+        Reviewed by Oliver Hunt
+
+        * css/CSSParserValues.cpp:
+        (WebCore::CSSParserValueList::addValue):
+
+2009-01-17  David Hyatt  <hyatt@apple.com>
+
+        Inline Document::inPageCache(), since - because of animation code - it is now called every time
+        styles change on any element and so is now super-hot.
+
+        Reviewed by Oliver Hunt
+
+        * dom/Document.cpp:
+        * dom/Document.h:
+        (WebCore::Document::inPageCache):
+
+2009-01-16  David Hyatt  <hyatt@apple.com>
+
+        Take Font out of the GraphicsContext.  Fonts are moderately expensive to both compare and to assign to.
+        The Font's presence in the GraphicsContext was making save/restore more expensive than it needed to be,
+        and was also causing expensive comparison checks to be made before doing alterations of the Font in the
+        GraphicsContext.
+
+        A font must now be passed as a parameter to all text drawing functions.
+
+        Reviewed by Oliver Hunt
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setFont):
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawText):
+        (WebCore::GraphicsContext::drawBidiText):
+        (WebCore::GraphicsContext::drawHighlightForText):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/GraphicsContextPrivate.h:
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::paint):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::paintTextWithShadows):
+        (WebCore::InlineTextBox::paint):
+        (WebCore::InlineTextBox::paintSelection):
+        (WebCore::InlineTextBox::paintCompositionBackground):
+        (WebCore::InlineTextBox::paintSpellingOrGrammarMarker):
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        (WebCore::InlineTextBox::paintDocumentMarkers):
+        * rendering/InlineTextBox.h:
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::paintObject):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintReplaced):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::paintItemForeground):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::paint):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paintCharacters):
+        (WebCore::SVGInlineTextBox::paintSelection):
+        * rendering/SVGInlineTextBox.h:
+        * svg/SVGFont.cpp:
+        (WebCore::Font::drawTextUsingSVGFont):
+
+2009-01-16  David Hyatt  <hyatt@apple.com>
+
+        Fix a regression from the virtualContinuation()/continuation() split where I accidentally changed
+        two if statements.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::absoluteRects):
+        (WebCore::RenderObject::absoluteQuads):
+
+2009-01-16  David Hyatt  <hyatt@apple.com>
+
+        Fix a regression from my before/after optimization.  Make sure the <q> element puts the document
+        into a mode where it will respect before/after rules, since <q> implicitly uses such rules.
+
+        Make sure view source mode documents also turn on before/after rules, since they are used there also.
+
+        Reviewed by Oliver Hunt
+
+        * html/HTMLElementFactory.cpp:
+        (WebCore::quoteConstructor):
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::HTMLViewSourceDocument):
+
+2009-01-16  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 23397: AXURL is not reported for <INPUT type="image"> elements
+        https://bugs.webkit.org/show_bug.cgi?id=23397
+
+        Report an AXURL for inputs that have an image type.
+
+        Test: accessibility/input-image-url.html
+
+        * page/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isInputImage):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isInputImage):
+        (WebCore::AccessibilityRenderObject::url):
+        * page/AccessibilityRenderObject.h:
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+
+2009-01-16  Adele Peterson  <adele@apple.com>
+
+        Windows build fix.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::logCanCachePageDecision):
+
+2009-01-16  Steve Falkenburg  <sfalken@apple.com>
+
+        <rdar://problem/6502511> Safari crashes if it's running while the desktop theme is changed.
+
+        This was caused by mismatched ENABLE definitions across WebCore and WebKit.
+
+        Several virtual methods were added to RenderTheme.h, conditionalized by ENABLE(VIDEO).
+        In addition to adding ENABLE_VIDEO to WebKit, this change also adds ENABLE_DATABASE and ENABLE_ICONDATABASE
+        to Windows WebCore/WebKit, and adds ENABLE_WORKERS, and several ENABLE_SVG_ flags to WebKit on Windows.
+        Our Windows ENABLE flags now match Mac.
+
+        Reviewed by Adele Peterson.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/build-generated-files.sh:
+
+2009-01-16  Mark Rowe  <mrowe@apple.com>
+
+        40,000!
+
+        * ChangeLog: Point out revision 40,000.
+
+2009-01-16  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Justin Garcia.
+
+        Make surroundNodeRangeWithElement call insertNodeBefore implicitly
+        Make insertNodeBefore take PassRefPtr
+        Clean up the use of PassRefPtr vs. raw pointers a few places in the editing code.
+        https://bugs.webkit.org/show_bug.cgi?id=23389
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange):
+        (WebCore::ApplyStyleCommand::applyTextDecorationStyle):
+        (WebCore::ApplyStyleCommand::surroundNodeRangeWithElement):
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded):
+        * editing/ApplyStyleCommand.h:
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::insertNodeAt):
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::prepareBlockquoteLevelForInsertion):
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply):
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply):
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::insertTab):
+        * editing/ModifySelectionListLevel.cpp:
+        (WebCore::IncreaseSelectionListLevelCommand::doApply):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::removeNodePreservingChildren):
+        (WebCore::ReplacementFragment::insertNodeBefore):
+        (WebCore::ReplacementFragment::removeInterchangeNodes):
+        (WebCore::ReplaceSelectionCommand::doApply):
+        (WebCore::ReplaceSelectionCommand::insertNodeAfterAndUpdateNodesInserted):
+        (WebCore::ReplaceSelectionCommand::insertNodeAtAndUpdateNodesInserted):
+        (WebCore::ReplaceSelectionCommand::insertNodeBeforeAndUpdateNodesInserted):
+        * editing/ReplaceSelectionCommand.h:
+
+2009-01-16  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 23393: TextField has AXTitle and AXTitleUIElement
+        https://bugs.webkit.org/show_bug.cgi?id=23393
+
+        Test: accessibility/double-title.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::title):
+
+2009-01-16  Adam Treat  <adam.treat@torchmobile.com>
+
+        The correct build fix for all platforms.
+
+        * platform/graphics/Font.h:
+
+2009-01-16  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build.
+
+        * platform/graphics/Font.h:
+
+2009-01-16  David Hyatt  <hyatt@apple.com>
+
+        Add a new flag (similar to first-line and first-letter) to Document to track whether any before/after rules
+        are being used.  If not, don't waste time probing for those pseudo element styles.
+
+        Reviewed by Sam Weinig
+
+        * css/CSSGrammar.y:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
+        (WebCore::Document::usesBeforeAfterRules):
+        (WebCore::Document::setUsesBeforeAfterRules):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::styleDidChange):
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::updateBeforeAfterContentForContainer):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::styleDidChange):
+        (WebCore::RenderInline::addChildToFlow):
+        (WebCore::RenderInline::splitInlines):
+
+2009-01-16  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alp Toker.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23394
+        Remove unnecessary calls to setDeferringTimers().
+
+        Use of this function was obsoleted by better handling of EINTR.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::downloadTimerCallback): removed setDeferringTimers calls.
+
+2009-01-16  David Hyatt  <hyatt@apple.com>
+
+        Fix badness with the cursor CSS property.  For all links and form controls, resetting to a value of auto
+        was resulting in the creation of a cursor list.  clearCursorList was creating a new list rather than just
+        nulling out the pointer.  Since addCursor already lazily recreates the list, in the case of simple cursor types,
+        the clear method was wastefully creating a completely unnecessary list for all of these elements.
+
+        Also optimized the setting of simple cursor values to not alter the RenderStyle's cursor setting if it is already
+        set to the same value.  Since this is the common case, it prevents a fault and copy of StyleInheritedData for
+        all links and form controls.
+
+        This is a PLT speedup.
+
+        Reviewed by Oliver Hunt
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::clearCursorList):
+
+2009-01-16  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23384
+        PLATFORM(CHROMIUM) needs to delegate BackForwardList.cpp methods to the embedder
+
+        * history/BackForwardList.h:
+        (WebCore::BackForwardListClient::~BackForwardListClient):
+        (WebCore::BackForwardList::setClient):
+        * history/BackForwardListChromium.cpp: Added.
+
+2009-01-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Kevin Decker and Adam Roben.
+
+        - fix a regression that resulted in a crash when plug-ins were
+          disabled.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget): Added a null check.
+
+2009-01-16  David Hyatt  <hyatt@apple.com>
+
+        Split continuation() into virtual and non-virtual versions so that the non-virtual version can
+        be used whereever possible.  Eventually the virtual method can be eliminated completely.
+
+        Reviewed by Sam Weinig and Oliver Hunt
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::anchorElement):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
+        (WebCore::InlineFlowBox::paint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::removeChild):
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::updateBeforeAfterContentForContainer):
+        * rendering/RenderFlow.h:
+        (WebCore::RenderFlow::virtualContinuation):
+        (WebCore::RenderFlow::continuation):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::positionForCoordinates):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::absoluteRects):
+        (WebCore::RenderObject::absoluteQuads):
+        (WebCore::RenderObject::addFocusRingRects):
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):
+        (WebCore::RenderObject::getAbsoluteRepaintRectWithOutline):
+        (WebCore::RenderObject::handleDynamicFloatPositionChange):
+        (WebCore::RenderObject::hoverAncestor):
+        (WebCore::RenderObject::updateDragState):
+        (WebCore::RenderObject::updateHitTestResult):
+        (WebCore::RenderObject::getTextDecorationColors):
+        (WebCore::RenderObject::adjustRectForOutlineAndShadow):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::virtualContinuation):
+
+2009-01-16  David Hyatt  <hyatt@apple.com>
+
+        Inline the methods of Font for obtaining metrics such as ascent, descent and line spacing.
+
+        Reviewed by ggaren
+
+        * platform/graphics/Font.cpp:
+        * platform/graphics/Font.h:
+        (WebCore::Font::width):
+        (WebCore::Font::ascent):
+        (WebCore::Font::descent):
+        (WebCore::Font::lineSpacing):
+        (WebCore::Font::lineGap):
+        (WebCore::Font::xHeight):
+        (WebCore::Font::unitsPerEm):
+        (WebCore::Font::spaceWidth):
+
+2009-01-16  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23388
+        Remove FrameViewPrivate
+
+        Removes an indirection and is a small speedup on PLT.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::~FrameView):
+        (WebCore::FrameView::reset):
+        (WebCore::FrameView::resetScrollbars):
+        (WebCore::FrameView::init):
+        (WebCore::FrameView::clear):
+        (WebCore::FrameView::didFirstLayout):
+        (WebCore::FrameView::initScrollbars):
+        (WebCore::FrameView::updateDefaultScrollbarState):
+        (WebCore::FrameView::setCanHaveScrollbars):
+        (WebCore::FrameView::applyOverflowToViewport):
+        (WebCore::FrameView::layoutCount):
+        (WebCore::FrameView::needsFullRepaint):
+        (WebCore::FrameView::layoutRoot):
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::setMediaType):
+        (WebCore::FrameView::mediaType):
+        (WebCore::FrameView::useSlowRepaints):
+        (WebCore::FrameView::setUseSlowRepaints):
+        (WebCore::FrameView::addSlowRepaintObject):
+        (WebCore::FrameView::removeSlowRepaintObject):
+        (WebCore::FrameView::scrollRectIntoViewRecursively):
+        (WebCore::FrameView::setScrollPosition):
+        (WebCore::FrameView::repaintContentRectangle):
+        (WebCore::FrameView::beginDeferredRepaints):
+        (WebCore::FrameView::endDeferredRepaints):
+        (WebCore::FrameView::scheduleRelayout):
+        (WebCore::FrameView::scheduleRelayoutOfSubtree):
+        (WebCore::FrameView::layoutPending):
+        (WebCore::FrameView::needsLayout):
+        (WebCore::FrameView::unscheduleRelayout):
+        (WebCore::FrameView::isTransparent):
+        (WebCore::FrameView::setTransparent):
+        (WebCore::FrameView::baseBackgroundColor):
+        (WebCore::FrameView::setBaseBackgroundColor):
+        (WebCore::FrameView::shouldUpdateWhileOffscreen):
+        (WebCore::FrameView::setShouldUpdateWhileOffscreen):
+        (WebCore::FrameView::scheduleEvent):
+        (WebCore::FrameView::pauseScheduledEvents):
+        (WebCore::FrameView::resumeScheduledEvents):
+        (WebCore::FrameView::performPostLayoutTasks):
+        (WebCore::FrameView::updateOverflowStatus):
+        (WebCore::FrameView::dispatchScheduledEvents):
+        (WebCore::FrameView::wasScrolledByUser):
+        (WebCore::FrameView::setWasScrolledByUser):
+        (WebCore::FrameView::paintContents):
+        (WebCore::FrameView::setPaintRestriction):
+        (WebCore::FrameView::isPainting):
+        (WebCore::FrameView::setNodeToDraw):
+        * page/FrameView.h:
+        (WebCore::FrameView::setIsVisuallyNonEmpty): Inline.
+
+2009-01-14  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 23237: Some HTML constructors in HTMLElementFactory needs
+        an HTMLFormElement argument
+
+        - Added 'constructorNeedsFormElement' parameter to make_names.pl to account
+          for HTML form elements.
+
+        - Added the new information to HTMLTagNames.in.
+
+        * dom/make_names.pl:
+        * html/HTMLTagNames.in:
+
+2009-01-16  David Hyatt  <hyatt@apple.com>
+
+        Eliminate a bunch of save/restore pairs from commonly used GraphicsContext methods.  The most common reason
+        for needing save/restore in the line-drawing methods was antialiasing, so this has now been made part of
+        the cross-platform graphics state.  By being able to query for the current antialiasing setting, antialiasing
+        can be temporarily changed and then restored back to the real value without needing to do a save/restore.
+
+        The line drawing code also set the fill color to the stroke color and relied on save/restore to prevent
+        a permanent mutation of the fill color in the CGContext.   The new code just restores the fill color back
+        to its original value without doing the much more expensive save/restore.
+
+        Reviewed by Oliver Hunt
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setShouldAntialias):
+        (WebCore::GraphicsContext::shouldAntialias):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/GraphicsContextPrivate.h:
+        (WebCore::GraphicsContextState::GraphicsContextState):
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::setPlatformShouldAntialias):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::setPlatformShouldAntialias):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::setPlatformShouldAntialias):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::setPlatformShouldAntialias):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::setPlatformShouldAntialias):
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+
+2009-01-16  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Clean up the bridge code and get rid of Field::name() and Method::name().
+
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::invokeMethod):
+        * bridge/c/c_runtime.cpp:
+        * bridge/c/c_runtime.h:
+        (JSC::Bindings::CField::identifier):
+        (JSC::Bindings::CMethod::identifier):
+        * bridge/jni/jni_class.cpp:
+        (JavaClass::JavaClass):
+        * bridge/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bridge/jni/jni_runtime.cpp:
+        (JavaField::valueFromInstance):
+        (JavaField::setValueToInstance):
+        (JavaMethod::methodID):
+        * bridge/jni/jni_runtime.h:
+        (JSC::Bindings::JavaField::name):
+        (JSC::Bindings::JavaMethod::name):
+        * bridge/objc/objc_class.mm:
+        (JSC::Bindings::ObjcClass::methodsNamed):
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::invokeMethod):
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcMethod::isFallbackMethod):
+        (JSC::Bindings::ObjcMethod::selector):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcMethod::ObjcMethod):
+        (JSC::Bindings::ObjcMethod::getMethodSignature):
+        (JSC::Bindings::ObjcField::ObjcField):
+        (JSC::Bindings::ObjcField::valueFromInstance):
+        (JSC::Bindings::ObjcField::setValueToInstance):
+        (JSC::Bindings::callObjCFallbackObject):
+        * bridge/runtime.h:
+
+2009-01-16  David Hyatt  <hyatt@apple.com>
+
+        Optimize RenderText::styleDidChange.  Don't call the base class, which does extra meaningless work.
+        Instead just do the one check we need to do (for a diff of layout) and mark dirty as appropriate.
+        Clean up the base class method also to just bail early if no m_parent is set instead of repeatedly checking
+        for the existence of m_parent in each if clause.
+
+        Reviewed by Darin Adler
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleDidChange):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::styleDidChange):
+
+2009-01-16  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 23387: AX hierarchy is incorrect when iframes are present
+        https://bugs.webkit.org/show_bug.cgi?id=23387
+
+        The AX hierarchy is incorrect when iframes are present.
+
+        Test: accessibility/iframe-bastardization.html
+
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper renderWidgetChildren]):
+
+2009-01-16  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/3541409> - Split up some back/forward cache decision making and add detailed logging to
+        better understand what the common disqualifiers are.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePageContainingThisFrame):
+        (WebCore::FrameLoader::canCachePage): Split off what will be per-frame decision making into canCacheSubframe.
+        (WebCore::FrameLoader::logCanCachePageDecision): Detailed logging about why a page may not be considered for
+          the back/forward cache.
+        (WebCore::FrameLoader::logCanCacheFrameDecision): Same detailed logging on the per-frame basis.
+        (WebCore::FrameLoader::commitProvisionalLoad): Move the m_client->canCachePage() call into canCachePageContainingThisFrame().
+        * loader/FrameLoader.h:
+
+2009-01-16  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Test: transitions/hang-with-bad-transition-list.html
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=23088.
+        This was happening because I was calling setChanged() from inside updateRendering()
+        which causes an infinite loop. I fixed this by deferring the setChanged to the next
+        run loop iteration. That made it not infinite loop, but it still retriggers the
+        transition forever. The problem is that there is both an 'all' and specific transition
+        on 'opacity'. This tickled a bug in AnimationController which causes the opacity
+        transition to get constantly cancelled and then retriggered. The problem is that
+        the specific opacity transition has a duration of 0. I got rid of the logic to
+        flush out 0 duration transitions and it is no longer constantly triggered. The
+        logic to flush them was just an optimization, and you really need to keep them
+        around to make the logic to override earlier animations by later ones work. And there is
+        very little overhead in this case anyway, so the optimization was not that useful.
+
+        I made a LayoutTest from the original testcase which tests both the infinite
+        loop and constantly triggering animation cases.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateRenderingDispatcherFired):
+        (WebCore::AnimationControllerPrivate::addNodeChangeToDispatch):
+        (WebCore::AnimationController::addNodeChangeToDispatch):
+        * page/animation/AnimationController.h:
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::updateTransitions):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::adjustAnimations):
+        (WebCore::RenderStyle::adjustTransitions):
+
+2009-01-16  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 23385: crash at com.apple.WebCore  WebCore::HTMLAnchorElement::isKeyboardFocusable
+        https://bugs.webkit.org/show_bug.cgi?id=23385
+
+        Option-tabbing through the page mentioned in the bug causes a crash
+
+        Test: fast/events/tab-crash-with-image-map.html
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
+
+2009-01-16  Thiago Macieira  <thiago.macieira@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fixes QString and 8-bit mix fixes.
+
+        Details:  Make sure we use QLatin1String where appropriate (and don't
+        use QString when not necessary)
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::create):
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::platformInit):
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::openTemporaryFile):
+        * platform/qt/LoggingQt.cpp:
+        (WebCore::InitializeLoggingChannelsIfNecessary):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::extraMediaControlsStyleSheet):
+        * plugins/qt/PluginDataQt.cpp:
+        (WebCore::PluginData::initPlugins):
+
+2009-01-16  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22452
+
+        When plugins are disabled, plugin data should not be available for
+        the page. This ensures that navigator.plugins would not see the
+        additional MIME types supported by the plugins.
+
+        * page/Page.cpp:
+        (WebCore::Page::pluginData):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::shouldUsePlugin):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::updateWidget):
+
+2009-01-15  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Got rid of .idl file in Resources for bug https://bugs.webkit.org/show_bug.cgi?id=21421.
+        Also fixed the test case to work on ppc.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-01-16  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Another attempt at fixing the Qt build.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::getInstance):
+
+2009-01-16  David Hyatt  <hyatt@apple.com>
+
+        Fix for 1.85% PLT regression.  Since asking if a frame is "complete" actually aggressively decodes
+        the frame, we add an optimization when advancing animations.  If we have received all of the animated
+        image's data, then obviously we can go ahead and advance safely.  This prevents the first draw of an image
+        from decoding two frames' worth of data in the case where all of the image's data has been received.
+
+        While this fixes the cached case, there could in fact be a regression on the uncached PLT from this change
+        as well.  It's not immediately clear how that regression would be fixed, though, and it would likely be
+        a much smaller percentage of that overall uncached time.
+
+        Reviewed by Dan Bernstein
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::startAnimation):
+
+2009-01-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23349
+        Don't store obsolete caches in disk storage
+
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::ResourceLoader):
+        (WebCore::ResourceLoader::load):
+        (WebCore::ResourceLoader::scheduleLoadFallbackResourceFromApplicationCache):
+        * loader/ResourceLoader.h:
+        Don't maintain m_wasLoadedFromApplicationCache, which was never used.
+
+        * loader/appcache/ApplicationCache.cpp: (WebCore::ApplicationCache::addResource):
+        Assert that only implicit and dynamic resources can be added after the cache has been fully
+        loaded and stored to disk database.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::cacheDestroyed): Don't remove non-newest caches from disk
+        database, as this is now done whenever the cache becomes obsolete.
+        (WebCore::ApplicationCacheGroup::setNewestCache): Remove an obsolete cache from disk storage.
+
+        * loader/appcache/ApplicationCacheStorage.cpp: (WebCore::ApplicationCacheStorage::cacheGroupDestroyed):
+        A cache group that has never been saved should not be remembered in m_cacheHostSet. Changed
+        the check to no longer rely on savedNewestCachePointer.
+
+2009-01-15  Dimitri Dupuis-Latour  <dupuislatour@apple.com>
+
+        <rdar://problem/5870656> selectorText and cssText are clipped for :nth-child() and :nth-of-type();
+
+        Reviewed by Timothy Hatcher.
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::selectorText):
+
+2009-01-15  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6444148> Styling a selection that ends in a line break can sometimes style what's after the break
+
+        If the range to style ended at [node, 0] or inside node (and if for some reason the node didn't get split),
+        applyInlineStyle would style node.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyInlineStyle): Rename pastLast to pastEndNode, since it doesn't come from
+        Range::pastLastNode() anymore.  pastEndNode is the node after the last one that is fully selected, since
+        the work done in the loop that follows should only be performed on fully selected nodes.
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::doApply): Explicitly handle insertion into containers and after non-text nodes.
+        Those were handled accidently before.
+        * editing/htmlediting.cpp:
+        (WebCore::caretMaxOffset): In various places we call this with a container and expect to be given the number
+        of children in that container, so I changed it to match that.  RenderBR and RenderObject::caretMaxOffset() should
+        also be eliminated since maxDeepOffset handles non-text nodes.
+
+2009-01-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Get rid of the dreaded BindingLanguage once and for all. Also get rid of Instance::getInstance.
+
+        * bridge/c/c_instance.h:
+        * bridge/jni/jni_instance.h:
+        * bridge/objc/objc_instance.h:
+        * bridge/qt/qt_instance.h:
+        * bridge/runtime.cpp:
+        * bridge/runtime.h:
+        * bridge/runtime_object.h:
+
+2009-01-15  David Hyatt  <hyatt@apple.com>
+
+        Eliminate an extra virtual function call that occurs for every single RenderText by moving the SVG-specific
+        code that was placed into RenderText::styleDidChange into RenderSVGInlineText::styleDidChange.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::styleDidChange):
+        * rendering/RenderSVGInlineText.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::styleDidChange):
+
+2009-01-15  Anders Carlsson  <andersca@apple.com>
+
+        Another attempt at fixing the Qt build.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::getOwnPropertySlot):
+        (JSC::Bindings::QtInstance::put):
+        * bridge/qt/qt_instance.h:
+        * bridge/runtime.h:
+        (JSC::Bindings::Instance::getOwnPropertySlot):
+        (JSC::Bindings::Instance::put):
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getOwnPropertySlot):
+        (JSC::RuntimeObjectImp::put):
+
+2009-01-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add QtInstance::getInstance and start using it.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::mark):
+        (JSC::Bindings::QtRuntimeObjectImp::classInfo):
+        (JSC::Bindings::):
+        (JSC::Bindings::QtInstance::getInstance):
+        * bridge/qt/qt_instance.h:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+
+2009-01-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add the ability for Instance objects to override getOwnPropertySlot/put for runtime objects.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::getOwnPropertySlot):
+        (JSC::Bindings::QtInstance::put):
+        * bridge/qt/qt_instance.h:
+        * bridge/runtime.h:
+        (JSC::Bindings::Instance::getOwnPropertySlot):
+        (JSC::Bindings::Instance::put):
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getOwnPropertySlot):
+        (JSC::RuntimeObjectImp::put):
+
+2009-01-15  Anders Carlsson  <andersca@apple.com>
+
+        Fix the QT build.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::createRuntimeObject):
+        * bridge/qt/qt_instance.h:
+
+2009-01-15  David Hyatt  <hyatt@apple.com>
+
+        Fix for <rdar://problem/6500278> REGRESSION: 3.5% of samples on iBench in WebCore::Frame::setZoomFactor
+
+        setZoomFactor was supposed to bail if both the zoom factor and mode were the same.  The mode check was
+        buggy and doing the wrong thing.
+
+        Reviewed by Darin Adler
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setZoomFactor):
+
+2009-01-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Make Instance::createRuntimeObject a virtual function and override it for QtInstance.
+
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::getRuntimeObject):
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertNPVariantToValue):
+        * bridge/jni/jni_instance.cpp:
+        (JavaInstance::invokeMethod):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::convertJObjectToValue):
+        * bridge/jni/jni_runtime.cpp:
+        (JavaField::valueFromInstance):
+        (JavaArray::valueAt):
+        * bridge/objc/objc_utility.mm:
+        (JSC::Bindings::convertObjcValueToValue):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::getRuntimeObject):
+        (JSC::Bindings::QtInstance::createRuntimeObject):
+        * bridge/qt/qt_instance.h:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertQVariantToValue):
+        (JSC::Bindings::QtConnectionObject::execute):
+        * bridge/runtime.cpp:
+        (JSC::Bindings::Instance::createRuntimeObject):
+        * bridge/runtime.h:
+
+2009-01-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23354
+        Fix up graphics/chromium files to account for Uniscribe style scrubbing.
+
+        * platform/graphics/chromium/FontChromiumWin.cpp:
+        (WebCore::windowsCanHandleTextDrawing):
+        (WebCore::Font::selectionRectForComplexText):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp:
+        (WebCore::fillNonBMPGlyphs):
+
+2009-01-15  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23333
+        Adjust due to a name change that happened in a WebKit.
+
+        * svg/graphics/skia/SVGPaintServerPatternSkia.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2009-01-15  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23340
+        Add remaining bits of graphics/chromium.
+
+        * platform/graphics/chromium/SimpleFontDataChromiumWin.cpp: Added.
+        (WebCore::scaleEmToUnits):
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformDestroy):
+        (WebCore::SimpleFontData::smallCapsFontData):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        * platform/graphics/chromium/SimpleFontDataLinux.cpp: Added.
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformDestroy):
+        (WebCore::SimpleFontData::smallCapsFontData):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::platformWidthForGlyph):
+        * platform/graphics/chromium/ThemeHelperChromiumWin.cpp: Added.
+        (WebCore::ThemeHelperWin::ThemeHelperWin):
+        (WebCore::ThemeHelperWin::~ThemeHelperWin):
+        * platform/graphics/chromium/ThemeHelperChromiumWin.h: Added.
+        (WebCore::ThemeHelperWin::):
+        (WebCore::ThemeHelperWin::context):
+        (WebCore::ThemeHelperWin::rect):
+        * platform/graphics/chromium/UniscribeHelper.cpp: Added.
+        (WebCore::treatAsSpace):
+        (WebCore::containsMissingGlyphs):
+        (WebCore::setLogFontAndStyle):
+        (WebCore::UniscribeHelper::UniscribeHelper):
+        (WebCore::UniscribeHelper::~UniscribeHelper):
+        (WebCore::UniscribeHelper::initWithOptionalLengthProtection):
+        (WebCore::UniscribeHelper::width):
+        (WebCore::UniscribeHelper::justify):
+        (WebCore::UniscribeHelper::characterToX):
+        (WebCore::UniscribeHelper::xToCharacter):
+        (WebCore::UniscribeHelper::draw):
+        (WebCore::UniscribeHelper::firstGlyphForCharacter):
+        (WebCore::UniscribeHelper::fillRuns):
+        (WebCore::UniscribeHelper::shape):
+        (WebCore::UniscribeHelper::fillShapes):
+        (WebCore::UniscribeHelper::fillScreenOrder):
+        (WebCore::UniscribeHelper::adjustSpaceAdvances):
+        (WebCore::UniscribeHelper::applySpacing):
+        (WebCore::UniscribeHelper::advanceForItem):
+        * platform/graphics/chromium/UniscribeHelper.h: Added.
+        (WebCore::UniscribeHelper::directionalOverride):
+        (WebCore::UniscribeHelper::setDirectionalOverride):
+        (WebCore::UniscribeHelper::inhibitLigate):
+        (WebCore::UniscribeHelper::setInhibitLigate):
+        (WebCore::UniscribeHelper::letterSpacing):
+        (WebCore::UniscribeHelper::setLetterSpacing):
+        (WebCore::UniscribeHelper::spaceWidth):
+        (WebCore::UniscribeHelper::setSpaceWidth):
+        (WebCore::UniscribeHelper::wordSpacing):
+        (WebCore::UniscribeHelper::setWordSpacing):
+        (WebCore::UniscribeHelper::setAscent):
+        (WebCore::UniscribeHelper::init):
+        (WebCore::UniscribeHelper::tryToPreloadFont):
+        (WebCore::UniscribeHelper::Shaping::Shaping):
+        (WebCore::UniscribeHelper::Shaping::glyphLength):
+        (WebCore::UniscribeHelper::Shaping::charLength):
+        (WebCore::UniscribeHelper::Shaping::effectiveAdvances):
+        (WebCore::UniscribeHelper::nextWinFontData):
+        (WebCore::UniscribeHelper::resetFontIndex):
+        * platform/graphics/chromium/UniscribeHelperTextRun.cpp: Added.
+        (WebCore::UniscribeHelperTextRun::UniscribeHelperTextRun):
+        (WebCore::UniscribeHelperTextRun::tryToPreloadFont):
+        (WebCore::UniscribeHelperTextRun::nextWinFontData):
+        (WebCore::UniscribeHelperTextRun::resetFontIndex):
+        * platform/graphics/chromium/UniscribeHelperTextRun.h: Added.
+
+2009-01-15  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fixed Windows project file after https://bugs.webkit.org/show_bug.cgi?id=21421
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-01-15  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=15279
+        Right clicking over text (or multiple spaces) auto selects the word
+        (or multiple spaces) under it, which is not a desirable effect for some
+        platforms.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::sendContextMenuEvent):
+        Don't select words on right-click on Chromium.
+
+2009-01-15  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23345
+        SharedBuffer.h should include wtf/OwnPtr.h
+
+        * platform/SharedBuffer.h:
+
+2009-01-14  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 23338: Make "Streamline Inspector Source" build script check for a directory before using it
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23338>
+
+        Reviewed by Timothy Hatcher.
+
+        * WebCore.xcodeproj/project.pbxproj: Check to see if
+        "${TARGET_BUILD_DIR}/${UNLOCALIZED_RESOURCES_FOLDER_PATH}/inspector"
+        exists before trying to change directories into it and then
+        deleting, modifying and adding files to it.
+
+2009-01-14  miggilin  <mr.diggilin@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Fixing wx compilation for wx 2.9/trunk.
+
+        * platform/graphics/wx/FontPlatformData.h:
+        (WebCore::FontPlatformData::operator==):
+        (WebCore::FontPlatformData::computeHash):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::setCompositeOperation):
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::ImageSource::createFrameAtIndex):
+        * platform/graphics/wx/PathWx.cpp:
+        (WebCore::Path::contains):
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderThemeWx::paintButton):
+        (WebCore::RenderThemeWx::paintTextField):
+        (WebCore::RenderThemeWx::paintMenuList):
+        * platform/wx/wxcode/gtk/non-kerned-drawing.cpp:
+
+2009-01-14  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Adding WebKitCSSMatrix.
+
+        * WebCoreSources.bkl:
+
+2009-01-14  Adam Treat  <adam.treat@torchmobile.com>
+
+        Prospective build fix for Qt following r39922.
+
+        * WebCore.pro:
+
+2009-01-14  Darin Adler  <darin@apple.com>
+
+        Fix debug build.
+
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp:
+        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor):
+        Use ASSERT_UNUSED.
+
+2009-01-14  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23335
+        <rdar://problem/6247650> Update <input type="search"> for RenderThemeWin
+
+        No new tests added.  In the future, we need to update DumpRenderTree to be able to run with different RenderThemes and
+        we'll need a separate set of results for different themes.
+
+        * css/themeWin.css: Renable search fields.  Added new rules for sub-element placement.
+
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::textBlockWidth): Consider margin set on the sub-elements when computing the
+        desired width for the text block.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::supportsFocus): Treat SearchFieldPart the same as TextFieldPart.
+        (WebCore::RenderThemeWin::determineState): ditto.
+        (WebCore::RenderThemeWin::getClassicThemeData): ditto.
+        (WebCore::RenderThemeWin::getThemeData): ditto.
+        (WebCore::RenderThemeWin::paintSearchFieldCancelButton): Draw a scaled, vertically centered, version of the new artwork.
+        (WebCore::RenderThemeWin::paintSearchFieldResultsDecoration): ditto.
+        (WebCore::RenderThemeWin::paintSearchFieldResultsButton): ditto.
+        (WebCore::RenderThemeWin::adjustSearchFieldCancelButtonStyle): Set the scaled width and height.
+        (WebCore::RenderThemeWin::adjustSearchFieldResultsDecorationStyle): ditto.
+        (WebCore::RenderThemeWin::adjustSearchFieldResultsButtonStyle): ditto.
+
+2009-01-14  Alp Toker  <alp@nuanti.com>
+
+        GTK+ build fix following r39922.
+        Add WebKitCSSMatrix to the build system.
+
+        * GNUmakefile.am:
+
+2009-01-14  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Implemented 2D WebKitCSSMatrix
+        https://bugs.webkit.org/show_bug.cgi?id=21421
+
+        Test: transforms/2d/cssmatrix-interface.xhtml
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (jsDOMWindowBaseWebKitCSSMatrix):
+        (setJSDOMWindowBaseWebKitCSSMatrix):
+        * bindings/js/JSWebKitCSSMatrixConstructor.cpp: Added.
+        (WebCore::):
+        (WebCore::JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor):
+        (WebCore::constructWebKitCSSMatrix):
+        (WebCore::JSWebKitCSSMatrixConstructor::getConstructData):
+        * bindings/js/JSWebKitCSSMatrixConstructor.h: Added.
+        (WebCore::JSWebKitCSSMatrixConstructor::classInfo):
+        * bindings/objc/DOMInternal.h:
+        * css/WebKitCSSMatrix.cpp: Added.
+        (WebCore::WebKitCSSMatrix::WebKitCSSMatrix):
+        (WebCore::WebKitCSSMatrix::~WebKitCSSMatrix):
+        (WebCore::WebKitCSSMatrix::setMatrixValue):
+        (WebCore::WebKitCSSMatrix::multiply):
+        (WebCore::WebKitCSSMatrix::inverse):
+        (WebCore::WebKitCSSMatrix::translate):
+        (WebCore::WebKitCSSMatrix::scale):
+        (WebCore::WebKitCSSMatrix::rotate):
+        (WebCore::WebKitCSSMatrix::toString):
+        * css/WebKitCSSMatrix.h: Added.
+        (WebCore::WebKitCSSMatrix::create):
+        (WebCore::WebKitCSSMatrix::a):
+        (WebCore::WebKitCSSMatrix::b):
+        (WebCore::WebKitCSSMatrix::c):
+        (WebCore::WebKitCSSMatrix::d):
+        (WebCore::WebKitCSSMatrix::e):
+        (WebCore::WebKitCSSMatrix::f):
+        (WebCore::WebKitCSSMatrix::setA):
+        (WebCore::WebKitCSSMatrix::setB):
+        (WebCore::WebKitCSSMatrix::setC):
+        (WebCore::WebKitCSSMatrix::setD):
+        (WebCore::WebKitCSSMatrix::setE):
+        (WebCore::WebKitCSSMatrix::setF):
+        (WebCore::WebKitCSSMatrix::transform):
+        * css/WebKitCSSMatrix.idl: Added.
+
+2009-01-14  Michael Moss  <mmoss@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Workaround a skia limitation on repeated patterns, and remove extra
+        transformations applied to pattern.
+        https://bugs.webkit.org/show_bug.cgi?id=23332
+
+        Fixes:
+        LayoutTests/fast/canvas/patternfill-repeat.html
+        LayoutTests/svg/W3C-SVG-1.1/pservers-grad-06-b.svg
+
+        * platform/graphics/skia/PatternSkia.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+
+2009-01-14  Mark Rowe  <mrowe@apple.com>
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=23334
+        Bug 23334: Compile failure in XMLTokenizerLibxml2.cpp
+
+        Include wtf/UnusedParam.h to get UNUSED_PARAM.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::hackAroundLibXMLEntityBug):
+
+2009-01-14  David Levin  <levin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23333
+        Platform code fixes. These compensate for changes in platform
+        callbacks from WebKit and minor API tweaks.
+
+        I enumerated a few below.
+
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp:
+        fontExists has been gone since r34794.
+
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::paintSkBitmap):
+
+        (WebCore::FrameData::clear):
+        r39751 changes this api to take and return a bool.
+
+        (WebCore::Image::drawPattern):
+        * platform/graphics/skia/PathSkia.cpp:
+        (WebCore::Path::apply):
+        (WebCore::boundingBoxForCurrentStroke):
+        (WebCore::Path::strokeContains):
+        * svg/graphics/skia/RenderPathSkia.cpp: Removed due to r39805.
+
+2009-01-14  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        <https://bugs.webkit.org/show_bug.cgi?id=16829>
+        Implement NPN_SetException()
+
+        This mirrors the implementation in the obj-c bindings.
+
+        Test: plugins/netscape-throw-exception.html
+
+        * bridge/NP_jsobject.cpp:
+        (_NPN_SetException):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::getExceptionString):
+        (JSC::Bindings::CInstance::setGlobalException):
+        (JSC::Bindings::CInstance::moveGlobalExceptionToExecState):
+        (JSC::Bindings::CInstance::invokeMethod):
+        (JSC::Bindings::CInstance::invokeDefaultMethod):
+        (JSC::Bindings::CInstance::invokeConstruct):
+        (JSC::Bindings::CInstance::getPropertyNames):
+        * bridge/c/c_instance.h:
+
+2009-01-14  Pierre-Olivier Latour  <pol@apple.com>
+
+        Fixed build warning when LIBXML_VERSION >= 20627.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::hackAroundLibXMLEntityBug):
+
+2009-01-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23326
+        Resources are never deleted from application cache disk database
+
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::openDatabase): Create a trigger that deletes resources when
+        a cache is deleted. Note that this change doesn't require bumping schema version. We should
+        consider switching to foreign keys and cascade delete instead of triggers in the future.
+        (WebCore::ApplicationCacheStorage::remove): Added a comment explaining why it's sufficient
+        to only remove the cache itself.
+        (WebCore::ApplicationCacheStorage::empty): Don't delete from CacheResources, now that this
+        is done automatically when a cache is deleted.
+
+2009-01-14  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 22795: favicons should be saved to webarchives
+
+        <https://bugs.webkit.org/show_bug.cgi?id=22795>
+
+        Reviewed by Darin Adler.
+
+        Test: webarchive/test-link-rel-icon.html
+
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::addSubresourceAttributeURLs): Do not add
+        favicon URLs to the list since no ArchiveResource or CachedResource
+        is ever created for them.
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::create): Handle favicons as a special
+        case for all main resources.
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::close): Actually close the SQLite database
+        so that isOpen() returns false when called.  Added an ASSERT() for
+        good measure.
+
+2009-01-14  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23321
+        Upstream more bits of graphics/chromium.
+
+        * platform/graphics/chromium/FontPlatformDataChromiumWin.cpp: Added.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
+        (WebCore::FontPlatformData::~FontPlatformData):
+        (WebCore::FontPlatformData::RefCountedHFONT::~RefCountedHFONT):
+        (WebCore::FontPlatformData::hashTableDeletedFontValue):
+        (WebCore::FontPlatformData::scriptFontProperties):
+        * platform/graphics/chromium/FontPlatformDataChromiumWin.h: Added.
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        (WebCore::FontPlatformData::hfont):
+        (WebCore::FontPlatformData::size):
+        (WebCore::FontPlatformData::hash):
+        (WebCore::FontPlatformData::operator==):
+        (WebCore::FontPlatformData::scriptCache):
+        (WebCore::FontPlatformData::RefCountedHFONT::create):
+        (WebCore::FontPlatformData::RefCountedHFONT::hfont):
+        (WebCore::FontPlatformData::RefCountedHFONT::hash):
+        (WebCore::FontPlatformData::RefCountedHFONT::operator==):
+        (WebCore::FontPlatformData::RefCountedHFONT::RefCountedHFONT):
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp: Added.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::~FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
+        (WebCore::FontPlatformData::setupPaint):
+        (WebCore::FontPlatformData::operator==):
+        (WebCore::FontPlatformData::hash):
+        (WebCore::FontPlatformData::isFixedPitch):
+        * platform/graphics/chromium/FontPlatformDataLinux.h: Added.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::size):
+        (WebCore::FontPlatformData::isHashTableDeletedValue):
+        (WebCore::FontPlatformData::hashTableDeletedFontValue):
+        * platform/graphics/chromium/FontUtilsChromiumWin.cpp: Added.
+        (WebCore::):
+        (WebCore::FontMap::getAscent):
+        (WebCore::FontMap::FontData::FontData):
+        (WebCore::getFontFamilyForScript):
+        (WebCore::getFallbackFamily):
+        (WebCore::getDerivedFontData):
+        (WebCore::getStyleFromLogfont):
+        * platform/graphics/chromium/FontUtilsChromiumWin.h: Added.
+        (WebCore::):
+
+2009-01-14  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23325
+        Upstream even more graphics/chromium bits.
+
+        * platform/graphics/chromium/GlyphPageTreeNodeChromiumWin.cpp: Added.
+        (WebCore::fillEmptyGlyphs):
+        (WebCore::initSpaceGlyph):
+        (WebCore::fillBMPGlyphs):
+        (WebCore::fillNonBMPGlyphs):
+        (WebCore::GlyphPage::fill):
+        * platform/graphics/chromium/GlyphPageTreeNodeLinux.cpp: Added.
+        (WebCore::GlyphPage::fill):
+        * platform/graphics/chromium/IconChromiumLinux.cpp: Added.
+        (WebCore::Icon::Icon):
+        (WebCore::Icon::~Icon):
+        (WebCore::Icon::createIconForFile):
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+        * platform/graphics/chromium/IconChromiumMac.cpp: Added.
+        (WebCore::Icon::createIconForFile):
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::~Icon):
+        (WebCore::Icon::paint):
+        * platform/graphics/chromium/IconChromiumWin.cpp: Added.
+        (WebCore::Icon::Icon):
+        (WebCore::Icon::~Icon):
+        (WebCore::Icon::createIconForFile):
+        (WebCore::Icon::createIconForFiles):
+        (WebCore::Icon::paint):
+        * platform/graphics/chromium/ImageBufferData.h: Added.
+        * platform/graphics/chromium/ImageChromiumMac.mm: Added.
+        (WebCore::Image::loadPlatformResource):
+        (WebCore::BitmapImage::initPlatformData):
+        (WebCore::BitmapImage::invalidatePlatformData):
+        * platform/graphics/chromium/MediaPlayerPrivateChromium.h: Added.
+        * platform/graphics/chromium/PlatformIcon.h: Added.
+
+2009-01-14  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23328
+        Upstream remaining files from platform/chromium/
+
+        * platform/chromium/CursorChromium.cpp:
+        (WebCore::pointerCursor):
+        (WebCore::crossCursor):
+        (WebCore::handCursor):
+        (WebCore::iBeamCursor):
+        (WebCore::waitCursor):
+        (WebCore::helpCursor):
+        (WebCore::eastResizeCursor):
+        (WebCore::northResizeCursor):
+        (WebCore::northEastResizeCursor):
+        (WebCore::northWestResizeCursor):
+        (WebCore::southResizeCursor):
+        (WebCore::southEastResizeCursor):
+        (WebCore::southWestResizeCursor):
+        (WebCore::westResizeCursor):
+        (WebCore::northSouthResizeCursor):
+        (WebCore::eastWestResizeCursor):
+        (WebCore::northEastSouthWestResizeCursor):
+        (WebCore::northWestSouthEastResizeCursor):
+        (WebCore::columnResizeCursor):
+        (WebCore::rowResizeCursor):
+        (WebCore::middlePanningCursor):
+        (WebCore::eastPanningCursor):
+        (WebCore::northPanningCursor):
+        (WebCore::northEastPanningCursor):
+        (WebCore::northWestPanningCursor):
+        (WebCore::southPanningCursor):
+        (WebCore::southEastPanningCursor):
+        (WebCore::southWestPanningCursor):
+        (WebCore::westPanningCursor):
+        (WebCore::moveCursor):
+        (WebCore::verticalTextCursor):
+        (WebCore::cellCursor):
+        (WebCore::contextMenuCursor):
+        (WebCore::aliasCursor):
+        (WebCore::progressCursor):
+        (WebCore::noDropCursor):
+        (WebCore::copyCursor):
+        (WebCore::noneCursor):
+        (WebCore::notAllowedCursor):
+        (WebCore::zoomInCursor):
+        (WebCore::zoomOutCursor):
+        * platform/chromium/DragDataRef.h: Added.
+        * platform/chromium/DragImageChromium.cpp: Added.
+        (WebCore::dragImageSize):
+        (WebCore::deleteDragImage):
+        (WebCore::scaleDragImage):
+        (WebCore::dissolveDragImageToFraction):
+        (WebCore::createDragImageFromImage):
+        (WebCore::createDragImageIconForCachedImage):
+        * platform/chromium/DragImageRef.h:
+        * platform/chromium/KeyCodeConversion.h: Added.
+        * platform/chromium/KeyCodeConversionGtk.cpp: Added.
+        (WebCore::windowsKeyCodeForKeyEvent):
+        * platform/chromium/KeyboardCodes.h: Added.
+        * platform/chromium/KeyboardCodesPosix.h: Added.
+        (WebCore::):
+        * platform/chromium/KeyboardCodesWin.h: Added.
+        (WebCore::):
+        * platform/chromium/Language.cpp: Added.
+        (WebCore::defaultLanguage):
+        * platform/chromium/LinkHashChromium.cpp: Added.
+        (WebCore::visitedLinkHash):
+        * platform/chromium/MimeTypeRegistryChromium.cpp: Added.
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+        (WebCore::MIMETypeRegistry::getPreferredExtensionForMIMEType):
+        (WebCore::MIMETypeRegistry::getMIMETypeForPath):
+        (WebCore::MIMETypeRegistry::isSupportedImageMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedImageResourceMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedImageMIMETypeForEncoding):
+        (WebCore::MIMETypeRegistry::isSupportedJavaScriptMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedNonImageMIMEType):
+        (WebCore::MIMETypeRegistry::isSupportedMediaMIMEType):
+        (WebCore::MIMETypeRegistry::isJavaAppletMIMEType):
+        (WebCore::dummyHashSet):
+        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedImageResourceMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedImageMIMETypesForEncoding):
+        (WebCore::MIMETypeRegistry::getSupportedNonImageMIMETypes):
+        (WebCore::MIMETypeRegistry::getSupportedMediaMIMETypes):
+        * platform/chromium/PasteboardChromium.cpp: Added.
+        (WebCore::Pasteboard::generalPasteboard):
+        (WebCore::Pasteboard::Pasteboard):
+        (WebCore::Pasteboard::clear):
+        (WebCore::Pasteboard::writeSelection):
+        (WebCore::Pasteboard::writeURL):
+        (WebCore::Pasteboard::writeImage):
+        (WebCore::Pasteboard::canSmartReplace):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::Pasteboard::documentFragment):
+        * platform/chromium/PasteboardPrivate.h:
+        * platform/chromium/PlatformCursor.h: Added.
+        (WebCore::PlatformCursor::):
+        (WebCore::PlatformCursor::PlatformCursor):
+        (WebCore::PlatformCursor::customImage):
+        (WebCore::PlatformCursor::hotSpot):
+        (WebCore::PlatformCursor::type):
+        * platform/chromium/PlatformKeyboardEventChromium.cpp: Added.
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent):
+        (WebCore::PlatformKeyboardEvent::currentCapsLockState):
+        * platform/chromium/PlatformScreenChromium.cpp: Added.
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/chromium/PlatformWidget.h:
+        * platform/chromium/PopupMenuChromium.cpp: Added.
+        (WebCore::PopupListBox::selectedIndex):
+        (WebCore::PopupListBox::numItems):
+        (WebCore::PopupListBox::setBaseWidth):
+        (WebCore::PopupListBox::setTextOnIndexChange):
+        (WebCore::PopupListBox::setAcceptOnAbandon):
+        (WebCore::PopupListBox::):
+        (WebCore::PopupListBox::ListItem::ListItem):
+        (WebCore::PopupListBox::PopupListBox):
+        (WebCore::PopupListBox::~PopupListBox):
+        (WebCore::PopupListBox::disconnectClient):
+        (WebCore::PopupListBox::scrollToRevealSelection):
+        (WebCore::constructRelativeMouseEvent):
+        (WebCore::constructRelativeWheelEvent):
+        (WebCore::PopupContainer::create):
+        (WebCore::PopupContainer::PopupContainer):
+        (WebCore::PopupContainer::~PopupContainer):
+        (WebCore::PopupContainer::showPopup):
+        (WebCore::PopupContainer::hidePopup):
+        (WebCore::PopupContainer::layout):
+        (WebCore::PopupContainer::handleMouseDownEvent):
+        (WebCore::PopupContainer::handleMouseMoveEvent):
+        (WebCore::PopupContainer::handleMouseReleaseEvent):
+        (WebCore::PopupContainer::handleWheelEvent):
+        (WebCore::PopupContainer::handleKeyEvent):
+        (WebCore::PopupContainer::hide):
+        (WebCore::PopupContainer::paint):
+        (WebCore::PopupContainer::paintBorder):
+        (WebCore::PopupContainer::isInterestedInEventForKey):
+        (WebCore::PopupContainer::show):
+        (WebCore::PopupContainer::setTextOnIndexChange):
+        (WebCore::PopupContainer::setAcceptOnAbandon):
+        (WebCore::PopupContainer::refresh):
+        (WebCore::PopupListBox::handleMouseDownEvent):
+        (WebCore::PopupListBox::handleMouseMoveEvent):
+        (WebCore::PopupListBox::handleMouseReleaseEvent):
+        (WebCore::PopupListBox::handleWheelEvent):
+        (WebCore::PopupListBox::isInterestedInEventForKey):
+        (WebCore::PopupListBox::handleKeyEvent):
+        (WebCore::PopupListBox::hostWindow):
+        (WebCore::PopupListBox::invalidateRect):
+        (WebCore::stripLeadingWhiteSpace):
+        (WebCore::PopupListBox::typeAheadFind):
+        (WebCore::PopupListBox::paint):
+        (WebCore::PopupListBox::paintRow):
+        (WebCore::PopupListBox::getRowFont):
+        (WebCore::PopupListBox::abandon):
+        (WebCore::PopupListBox::pointToRowIndex):
+        (WebCore::PopupListBox::acceptIndex):
+        (WebCore::PopupListBox::selectIndex):
+        (WebCore::PopupListBox::setOriginalIndex):
+        (WebCore::PopupListBox::getRowHeight):
+        (WebCore::PopupListBox::getRowBounds):
+        (WebCore::PopupListBox::invalidateRow):
+        (WebCore::PopupListBox::scrollToRevealRow):
+        (WebCore::PopupListBox::isSelectableItem):
+        (WebCore::PopupListBox::adjustSelectedIndex):
+        (WebCore::PopupListBox::updateFromElement):
+        (WebCore::PopupListBox::layout):
+        (WebCore::PopupListBox::clear):
+        (WebCore::PopupListBox::isPointInBounds):
+        (WebCore::PopupMenu::PopupMenu):
+        (WebCore::PopupMenu::~PopupMenu):
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::hide):
+        (WebCore::PopupMenu::updateFromElement):
+        (WebCore::PopupMenu::itemWritingDirectionIsNatural):
+        * platform/chromium/PopupMenuChromium.h: Added.
+        (WebCore::PopupContainer::listBox):
+        * platform/chromium/PopupMenuPrivate.h: Added.
+        * platform/chromium/SSLKeyGeneratorChromium.cpp: Added.
+        (WebCore::supportedKeySizes):
+        * platform/chromium/ScrollbarThemeChromium.cpp: Added.
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeChromium::ScrollbarThemeChromium):
+        (WebCore::ScrollbarThemeChromium::~ScrollbarThemeChromium):
+        (WebCore::ScrollbarThemeChromium::themeChanged):
+        (WebCore::ScrollbarThemeChromium::hasThumb):
+        (WebCore::ScrollbarThemeChromium::backButtonRect):
+        (WebCore::ScrollbarThemeChromium::forwardButtonRect):
+        (WebCore::ScrollbarThemeChromium::trackRect):
+        (WebCore::ScrollbarThemeChromium::paintTrackBackground):
+        (WebCore::ScrollbarThemeChromium::paintTickmarks):
+        (WebCore::ScrollbarThemeChromium::paintScrollCorner):
+        (WebCore::ScrollbarThemeChromium::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeChromium::buttonSize):
+        * platform/chromium/ScrollbarThemeChromium.h: Added.
+        (WebCore::ScrollbarThemeChromium::hasButtons):
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp: Added.
+        (WebCore::ScrollbarThemeChromium::scrollbarThickness):
+        (WebCore::ScrollbarThemeChromium::invalidateOnMouseEnterExit):
+        (WebCore::initMozState):
+        (WebCore::paintScrollbarWidget):
+        (WebCore::ScrollbarThemeChromium::paintTrackPiece):
+        (WebCore::ScrollbarThemeChromium::paintButton):
+        (WebCore::ScrollbarThemeChromium::paintThumb):
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp:
+        * platform/chromium/SearchPopupMenuChromium.cpp: Added.
+        (WebCore::SearchPopupMenu::SearchPopupMenu):
+        (WebCore::SearchPopupMenu::enabled):
+        (WebCore::SearchPopupMenu::saveRecentSearches):
+        (WebCore::SearchPopupMenu::loadRecentSearches):
+        * platform/chromium/SharedTimerChromium.cpp: Added.
+        (WebCore::setSharedTimerFiredFunction):
+        (WebCore::setSharedTimerFireTime):
+        (WebCore::stopSharedTimer):
+        * platform/chromium/TemporaryLinkStubs.cpp: Added.
+        (WebCore::signedPublicKeyAndChallengeString):
+        (WebCore::getSupportedKeySizes):
+        (WebCore::KURL::fileSystemPath):
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        (WTF::scheduleDispatchFunctionsOnMainThread):
+
+2009-01-14  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23323
+        Upstream platform/text/chromium/
+
+        * platform/text/chromium: Added.
+        * platform/text/chromium/TextBreakIteratorInternalICUChromium.cpp: Added.
+        (WebCore::currentTextBreakLocaleID):
+
+2009-01-14  Steve Falkenburg  <sfalken@apple.com>
+
+        Update copyright year in version resources.
+
+        Reviewed by Adam Roben.
+
+        * WebCore.vcproj/QTMovieWin.rc:
+
+2009-01-14  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23324
+        Move platform/chromium/EditorChromium.cpp into editing/chromium/
+
+        * editing/chromium: Added.
+        * editing/chromium/EditorChromium.cpp: Copied from platform/chromium/EditorChromium.cpp.
+        * platform/chromium/EditorChromium.cpp: Removed.
+
+2009-01-14  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23320
+        Make it possible to use notImplemented outside of the WebCore namespace
+
+        * platform/NotImplemented.h:
+
+2009-01-14  Nigel Tao  <nigel.tao.gnome@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=22476
+        Check that the document's SecurityOrigin canLoadLocalResources,
+        when pages try to put NSFilenamesPboardtype data on the clipboard,
+        by calling event.dataTransfer.setData('URL', 'file:///foo/bar');
+
+        Tests: http/tests/security/dataTransfer-set-data-file-url.html
+               platform/mac/editing/pasteboard/dataTransfer-set-data-file-url.html
+
+        * platform/mac/ClipboardMac.mm:
+        (WebCore::ClipboardMac::setData):
+
+2009-01-14  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - update copyright
+
+        * Info.plist:
+
+2009-01-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23316
+        Application cache updating always fails with an assertion
+
+        Test: http/tests/appcache/update-cache.html
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::documentLoaderDestroyed): Correctly handle the case where
+        multiple caches survive the last DocumentLoader destruction, preventing a crash in release
+        builds.
+        (WebCore::ApplicationCacheGroup::setNewestCache): Removed a bogus assertion.
+
+2009-01-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Release build fix.
+
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::storeUpdatedType): Use ASSERT_UNUSED.
+
+2009-01-13  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Test: http/tests/appcache/xhr-foreign-resource.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=23256
+        Implement application cache foreign entries
+
+        * loader/DocumentLoader.cpp: (WebCore::DocumentLoader::shouldLoadResourceFromApplicationCache):
+        Removed a misplaced check for foreign resources that prevented them from being loaded altogether.
+
+        * loader/appcache/ApplicationCacheGroup.cpp: (WebCore::ApplicationCacheGroup::selectCache):
+        If a document that was loaded from appcache should be associated with a different cache,
+        mark the resource as foreign in the original cache and start over.
+
+        * loader/appcache/ApplicationCacheResource.cpp: (WebCore::ApplicationCacheResource::addType):
+        This function can now be called after a cache is stored, so it no longer asserts the opposite.
+
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::cacheGroupForURL): Fix database pass to correctly ignore
+        in-memory caches that were already rejected.
+        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL): Ditto.
+        (WebCore::ApplicationCacheStorage::storeUpdatedType): Added a function that updates type of
+        an already stored cached resource.
+
+        * loader/appcache/ApplicationCacheStorage.h: Added storeUpdatedType().
+
+2009-01-13  Mark Rowe  <mrowe@apple.com>
+
+        Fix the Tiger WebCore build after r39880.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markBadGrammar):
+        * loader/mac/DocumentLoaderMac.cpp:
+        (WebCore::DocumentLoader::schedule):
+        (WebCore::DocumentLoader::unschedule):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::Pasteboard::writeSelection):
+        * platform/mac/WebCoreObjCExtras.mm:
+        (WebCoreObjCFinalizeOnMainThread):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::schedule):
+        (WebCore::ResourceHandle::unschedule):
+
+2009-01-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23102: turn on unused parameter warnings in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=23102
+
+        Last step: Turn on the warning and fix the last few instances.
+
+        * Configurations/Base.xcconfig: Removed -Wno-unused-parameter from
+        WARNING_CFLAGS_BASE, so the unused parameter warning will fire.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (jsDOMWindowBaseMessageChannel): Separate the version for use when
+        CHANNEL_MESSAGING is turned off, so we can omit the argument names.
+        It would be better to not even have this property in that case,
+        rather than having the function return undefined, but I don't know
+        how to do that with the bindings script.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Leave out argument names in
+        functions where they're not used (the SVG context, and the property
+        name in the index getter). Use UNUSED_PARAM where arguments are
+        sometimes not used.
+
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::put): Use UNUSED_PARAM for non-QT.
+
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::animationMediaFeatureEval): Omit argument names for style and frame.
+        (WebCore::transitionMediaFeatureEval): Ditto.
+        (WebCore::transform_2dMediaFeatureEval): Ditto.
+        (WebCore::transform_3dMediaFeatureEval): Ditto.
+
+        * dom/make_names.pl: Leave out the createdByParser property name in
+        cases where it's not used.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::setJavaScriptPaused): Separate the
+        version for the Mac platform so we can omit the argument names.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::contentsSizeChanged): Removed argument name.
+
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::shouldUsePluginDocument): Commented out
+        argument name.
+
+        * loader/icon/IconFetcher.cpp:
+        (WebCore::IconFetcher::didReceiveResponse): Use ASSERT_UNUSED.
+        (WebCore::IconFetcher::didReceiveData): Ditto.
+        (WebCore::IconFetcher::didFinishLoading): Ditto.
+        (WebCore::IconFetcher::didFail): Ditto.
+
+        * platform/KURL.cpp:
+        (WebCore::assertProtocolIsGood): Separate out the NDEBUG version so
+        we can omit the argument names.
+
+        * platform/Timer.cpp:
+        (WebCore::TimerHeapIterator::checkConsistency): Use ASSERT_UNUSED.
+
+        * platform/graphics/GlyphBuffer.h:
+        (WebCore::GlyphBuffer::offsetAt): Use UNUSED_PARAM in the non-WIN case.
+        (WebCore::GlyphBuffer::add): Use UNUSED_PARAM in the non-CAIRO case.
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::clear): Removed argument name.
+
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::prepareToRenderSVGContent): Use UNUSED_PARAM when SVG_FILTERS
+        is not enabled.
+        (WebCore::finishRenderSVGContent): Ditto.
+
+2009-01-13  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Implemented https://bugs.webkit.org/show_bug.cgi?id=23298
+        Simple fix to convertToLength to catch style==null cases
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::convertToLength):
+
+2009-01-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Speculative fix for an Uninitialized Memory Read (UMR)
+        seen by purify in chormium's equivalent V8 file.
+
+        * bindings/js/JSSVGPODTypeWrapper.h:
+        (WebCore::PODTypeWrapperCacheInfo::PODTypeWrapperCacheInfo):
+
+2009-01-13  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Land portions of platform/graphics/chromium.
+        https://bugs.webkit.org/show_bug.cgi?id=23297
+
+        * platform/graphics/chromium/FontCustomPlatformData.cpp: Added.
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        (WebCore::EOTStream::EOTStream):
+        (WebCore::EOTStream::read):
+        (WebCore::readEmbedProc):
+        (WebCore::createUniqueFontName):
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/chromium/FontCustomPlatformData.h: Added.
+        (WebCore::FontCustomPlatformData::FontCustomPlatformData):
+        * platform/graphics/chromium/FontLinux.cpp: Added.
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+        * platform/graphics/chromium/FontPlatformData.h: Added.
+
+2009-01-13  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Don't copy DOMStringList.idl into the framework bundle.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2009-01-13  Christian Dywan  <christian@twotoasts.de>
+
+        Build fix, StorageEvent is only defined if we have DOM_STORAGE
+
+        * dom/Document.cpp:
+        (WebCore::Document::createEvent): Conditionalize StorageEvent
+
+2009-01-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Bug 23277: space bar scrolls the page when typed in any text field
+        https://bugs.webkit.org/show_bug.cgi?id=23277
+        rdar://problem/6490249
+
+        There's already a regression test for this, since bug 16421 was the same problem, but on
+        Mac. The regression test is fast/events/space-scroll-event.html, so I won't write a new one.
+
+        This bug doesn't affect Mac because the canEdit check in -[WebHTMLView insertText:] prevents
+        a text input event from being generated at all. That difference may in itself be a bug, but
+        the only symptom is that you get text input events in more cases on platforms other than Mac.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleTextInputEvent): Return whether the event's default was
+        handled, not the result of the dispatchEvent function, which indicates only whether the
+        default behavior was prevented, not if the default behavior did some insertion. This fix
+        makes it so the keyboard event handler can detect that no space was inserted and know that
+        the space bar keypress event can be treated as a scrolling command.
+        (WebCore::EventHandler::defaultKeyboardEventHandler): Handle the keypress event, not the
+        keydown event. Without the change above, making this change would have restored the old
+        behavior, reintroducing bug 22913 where the space bar doesn't scroll at all on Windows.
+
+2009-01-13  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Landing portions of platform/chromium/, taken from here:
+        http://src.chromium.org/viewvc/chrome/trunk/deps/third_party/WebKit/WebCore/platform/chromium/
+
+        * platform/chromium/ChromiumBridge.h: Added.
+        * platform/chromium/ChromiumDataObject.cpp: Added.
+        (WebCore::ChromiumDataObject::clear):
+        (WebCore::ChromiumDataObject::hasData):
+        * platform/chromium/ChromiumDataObject.h: Added.
+        (WebCore::ChromiumDataObject::create):
+        (WebCore::ChromiumDataObject::ChromiumDataObject):
+        * platform/chromium/ClipboardChromium.cpp: Added.
+        (WebCore::):
+        (WebCore::clipboardTypeFromMIMEType):
+        (WebCore::ClipboardChromium::ClipboardChromium):
+        (WebCore::ClipboardChromium::create):
+        (WebCore::ClipboardChromium::clearData):
+        (WebCore::ClipboardChromium::clearAllData):
+        (WebCore::ClipboardChromium::getData):
+        (WebCore::ClipboardChromium::setData):
+        (WebCore::ClipboardChromium::types):
+        (WebCore::ClipboardChromium::setDragImage):
+        (WebCore::ClipboardChromium::setDragImageElement):
+        (WebCore::ClipboardChromium::createDragImage):
+        (WebCore::imageToMarkup):
+        (WebCore::getCachedImage):
+        (WebCore::writeImageToDataObject):
+        (WebCore::ClipboardChromium::declareAndWriteDragImage):
+        (WebCore::ClipboardChromium::writeURL):
+        (WebCore::ClipboardChromium::writeRange):
+        (WebCore::ClipboardChromium::hasData):
+        * platform/chromium/ClipboardChromium.h: Added.
+        (WebCore::ClipboardChromium::~ClipboardChromium):
+        (WebCore::ClipboardChromium::dataObject):
+        * platform/chromium/ClipboardUtilitiesChromium.cpp: Added.
+        (WebCore::replaceNewlinesWithWindowsStyleNewlines):
+        (WebCore::replaceNBSPWithSpace):
+        (WebCore::urlToMarkup):
+        * platform/chromium/ClipboardUtilitiesChromium.h: Added.
+        * platform/chromium/ContextMenuChromium.cpp: Added.
+        (WebCore::ContextMenu::ContextMenu):
+        (WebCore::ContextMenu::~ContextMenu):
+        (WebCore::ContextMenu::itemCount):
+        (WebCore::ContextMenu::insertItem):
+        (WebCore::ContextMenu::appendItem):
+        (WebCore::ContextMenu::itemWithAction):
+        (WebCore::ContextMenu::itemAtIndex):
+        (WebCore::ContextMenu::setPlatformDescription):
+        (WebCore::ContextMenu::platformDescription):
+        (WebCore::ContextMenu::releasePlatformDescription):
+        * platform/chromium/ContextMenuItemChromium.cpp: Added.
+        (WebCore::ContextMenuItem::ContextMenuItem):
+        (WebCore::ContextMenuItem::~ContextMenuItem):
+        (WebCore::ContextMenuItem::releasePlatformDescription):
+        (WebCore::ContextMenuItem::type):
+        (WebCore::ContextMenuItem::action):
+        (WebCore::ContextMenuItem::title):
+        (WebCore::ContextMenuItem::platformSubMenu):
+        (WebCore::ContextMenuItem::setType):
+        (WebCore::ContextMenuItem::setAction):
+        (WebCore::ContextMenuItem::setTitle):
+        (WebCore::ContextMenuItem::setSubMenu):
+        (WebCore::ContextMenuItem::setChecked):
+        (WebCore::ContextMenuItem::setEnabled):
+        (WebCore::ContextMenuItem::enabled):
+        * platform/chromium/CursorChromium.cpp: Added.
+        (WebCore::Cursor::Cursor):
+        (WebCore::Cursor::~Cursor):
+        (WebCore::Cursor::operator=):
+        (WebCore::pointerCursor):
+        (WebCore::crossCursor):
+        (WebCore::handCursor):
+        (WebCore::iBeamCursor):
+        (WebCore::waitCursor):
+        (WebCore::helpCursor):
+        (WebCore::eastResizeCursor):
+        (WebCore::northResizeCursor):
+        (WebCore::northEastResizeCursor):
+        (WebCore::northWestResizeCursor):
+        (WebCore::southResizeCursor):
+        (WebCore::southEastResizeCursor):
+        (WebCore::southWestResizeCursor):
+        (WebCore::westResizeCursor):
+        (WebCore::northSouthResizeCursor):
+        (WebCore::eastWestResizeCursor):
+        (WebCore::northEastSouthWestResizeCursor):
+        (WebCore::northWestSouthEastResizeCursor):
+        (WebCore::columnResizeCursor):
+        (WebCore::rowResizeCursor):
+        (WebCore::middlePanningCursor):
+        (WebCore::eastPanningCursor):
+        (WebCore::northPanningCursor):
+        (WebCore::northEastPanningCursor):
+        (WebCore::northWestPanningCursor):
+        (WebCore::southPanningCursor):
+        (WebCore::southEastPanningCursor):
+        (WebCore::southWestPanningCursor):
+        (WebCore::westPanningCursor):
+        (WebCore::moveCursor):
+        (WebCore::verticalTextCursor):
+        (WebCore::cellCursor):
+        (WebCore::contextMenuCursor):
+        (WebCore::aliasCursor):
+        (WebCore::progressCursor):
+        (WebCore::noDropCursor):
+        (WebCore::copyCursor):
+        (WebCore::noneCursor):
+        (WebCore::notAllowedCursor):
+        (WebCore::zoomInCursor):
+        (WebCore::zoomOutCursor):
+        (WebCore::grabCursor):
+        (WebCore::grabbingCursor):
+        * platform/chromium/DragDataChromium.cpp: Added.
+        (WebCore::containsHTML):
+        (WebCore::DragData::createClipboard):
+        (WebCore::DragData::containsURL):
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::containsFiles):
+        (WebCore::DragData::asFilenames):
+        (WebCore::DragData::containsPlainText):
+        (WebCore::DragData::asPlainText):
+        (WebCore::DragData::containsColor):
+        (WebCore::DragData::canSmartReplace):
+        (WebCore::DragData::containsCompatibleContent):
+        (WebCore::DragData::asFragment):
+        (WebCore::DragData::asColor):
+        * platform/chromium/EditorChromium.cpp: Added.
+        (WebCore::Editor::newGeneralClipboard):
+        * platform/chromium/FileChooserChromium.cpp: Added.
+        (WebCore::FileChooser::basenameForWidth):
+        * platform/chromium/FileSystemChromium.cpp: Added.
+        (WebCore::deleteFile):
+        (WebCore::deleteEmptyDirectory):
+        (WebCore::getFileSize):
+        (WebCore::getFileModificationTime):
+        (WebCore::directoryName):
+        (WebCore::pathByAppendingComponent):
+        (WebCore::makeAllDirectories):
+        (WebCore::fileExists):
+        * platform/chromium/FileSystemChromiumLinux.cpp: Added.
+        (WebCore::pathGetFileName):
+        * platform/chromium/FileSystemChromiumMac.mm: Added.
+        (WebCore::pathGetFileName):
+        * platform/chromium/FileSystemChromiumWin.cpp: Added.
+        (WebCore::pathGetFileName):
+        * platform/chromium/FramelessScrollView.cpp: Added.
+        (WebCore::FramelessScrollView::~FramelessScrollView):
+        (WebCore::FramelessScrollView::invalidateScrollbarRect):
+        (WebCore::FramelessScrollView::isActive):
+        (WebCore::FramelessScrollView::invalidateRect):
+        (WebCore::FramelessScrollView::hostWindow):
+        (WebCore::FramelessScrollView::windowClipRect):
+        (WebCore::FramelessScrollView::paintContents):
+        (WebCore::FramelessScrollView::contentsResized):
+        (WebCore::FramelessScrollView::visibleContentsResized):
+        * platform/chromium/FramelessScrollView.h: Added.
+        (WebCore::FramelessScrollView::FramelessScrollView):
+        (WebCore::FramelessScrollView::client):
+        (WebCore::FramelessScrollView::setClient):
+        * platform/chromium/FramelessScrollViewClient.h: Added.
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp: Added.
+        (WebCore::):
+        (WebCore::ScrollbarThemeChromium::scrollbarThickness):
+        (WebCore::ScrollbarThemeChromium::invalidateOnMouseEnterExit):
+        (WebCore::ScrollbarThemeChromium::paintTrackPiece):
+        (WebCore::ScrollbarThemeChromium::paintButton):
+        (WebCore::ScrollbarThemeChromium::paintThumb):
+        (WebCore::ScrollbarThemeChromium::getThemeState):
+        (WebCore::ScrollbarThemeChromium::getThemeArrowState):
+        (WebCore::ScrollbarThemeChromium::getClassicThemeState):
+        * platform/chromium/SoundChromiumPosix.cpp: Added.
+        (WebCore::systemBeep):
+        * platform/chromium/SoundChromiumWin.cpp: Added.
+        (WebCore::systemBeep):
+        * platform/chromium/SystemTimeChromium.cpp: Added.
+        (WebCore::currentTime):
+        (WebCore::userIdleTime):
+        * platform/chromium/WidgetChromium.cpp: Added.
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::~Widget):
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        (WebCore::Widget::setCursor):
+        (WebCore::Widget::paint):
+        (WebCore::Widget::setFocus):
+        (WebCore::Widget::setIsSelected):
+        (WebCore::Widget::frameRect):
+        (WebCore::Widget::setFrameRect):
+        * platform/chromium/WindowsVersion.cpp: Added.
+        (WebCore::isVistaOrNewer):
+        * platform/chromium/WindowsVersion.h: Added.
+
+2009-01-13  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Make sure media elements dispatch the 'loaded' event
+
+        We assume that when Phonon goes into paused state that we have the
+        complete media file. Once we do media loading ourselves we can
+        distinguish between loading the first frame and the complete media.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::updateStates):
+
+2009-01-13  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Add more verbose error output when loading NPAPI plugins
+
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::load):
+
+2009-01-13  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix crash in the Qt port when deleting a popup from within a
+        JavaScript onchange handler.
+
+        * platform/qt/QWebPopup.cpp:
+        (WebCore::QWebPopup::QWebPopup): Perform the activation of the
+        combobox item (i.e. the call to the JS handler) from a different
+        call stack by using a queued connection.
+
+2009-01-12  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [GIO] Make sure to untef the GFile and the GInputStream on destruction
+
+        Make sure to call cleanupGioOperation from the ResourceHandleInternal
+        d'tor. Change the signature of cleanupGioOperation so we can do the
+        cleanup of GIO next to the cleanup of SOUP.
+
+        This is happening with many tests from dom/html/level2/html e.g.
+        LayoutTests/dom/html/level2/html/HTMLBodyElement07.html.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandleInternal::~ResourceHandleInternal):
+        (WebCore::cleanupGioOperation):
+        (WebCore::closeCallback):
+        (WebCore::readCallback):
+        (WebCore::openCallback):
+        (WebCore::queryInfoCallback):
+
+2009-01-12  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [GIO] Attach the ResourceHandle to the GObject and get it from the GObject
+
+        https://bugs.webkit.org/show_bug.cgi?id=23116 discussed with Benjamin Otte
+
+        Sometimes it is not possible to cancel a pending GIO operation and the
+        callback might be invoked with a pointer to an already destructed
+        ResourceHandle. To avoid this issue we will attach the ResourceHandle
+        to the GObject* and in the callback attempt to get the ResourceHandle
+        from the GObject*. If no ResourceHandle is attached we silently fail
+        as the cleanup has been already done.
+
+        This is happening with many tests from dom/html/level2/html e.g.
+        LayoutTests/dom/html/level2/html/HTMLBodyElement07.html.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::cleanupGioOperation):
+        (WebCore::closeCallback):
+        (WebCore::readCallback):
+        (WebCore::openCallback):
+        (WebCore::queryInfoCallback):
+        (WebCore::ResourceHandle::startGio):
+
+2009-01-12  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [GIO] Invoke cleanupGioOperation before calling didFail to avoid crashes
+
+        https://bugs.webkit.org/show_bug.cgi?id=23116
+
+        The ResourceHandle becomes invalid (e.g. got destructed) from within
+        the invocation of didFail. Avoid this by cleaning up everything before
+        calling didFail and simply return afterwards.
+
+        This is happening with many tests from dom/html/level2/html e.g.
+        LayoutTests/dom/html/level2/html/HTMLBodyElement07.html.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::readCallback):
+        (WebCore::openCallback):
+        (WebCore::queryInfoCallback):
+
+2009-01-13  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Change how themes adjust mediaControls.css to match html4/quicks.css
+
+        Instead of providing the full style sheet, the themes provide extra
+        overrides to the default style defined in UserAgentStyleSheetsData.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23210
+
+        Also, merge WebKitResources.qrc and WebCoreResources.qrc to speed up
+        build time for the Qt port.
+
+        * Resources/WebKitResources.qrc: Removed. Merged into WebCore.qrc
+        * WebCore.pro:
+        * WebCore.qrc: Added.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::styleForElement):
+        * css/qt/mediaControls-extras.css: Rename from html4-adjustments-qt.css
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::extraMediaControlsStyleSheet):
+        * platform/qt/RenderThemeQt.h:
+        * platform/qt/WebCoreResources.qrc: Removed.
+        * platform/qt/html4-adjustments-qt.css: Rename to mediaControls-extras.css
+        * rendering/RenderTheme.cpp:
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::extraMediaControlsStyleSheet):
+
+2009-01-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Deprecate JSValuePtr::getNumber() - two ways to get a number should  be enough.
+
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        (WebCore::JSSQLTransaction::executeSql):
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+
+2009-01-12  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=22919
+
+        I added a common getElapsedTime() function to AnimationBase which uses a combination of
+        the techniques from KeyframeAnimation and AnimationBase to compute elapsedTime in all
+        states.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::progress):
+        (WebCore::AnimationBase::getElapsedTime):
+        * page/animation/AnimationBase.h:
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::animate):
+
+2009-01-12  Robert Blaut  <webkit@blaut.biz>
+
+        Reviewed by Darin Adler
+
+        Fix for <https://bugs.webkit.org/show_bug.cgi?id=22096>
+        Bug 22096: REGRESSION (r35879) scrolldelay is counted in seconds
+        instead of miliseconds
+
+        Test: fast/css/webkit-marquee-speed-unit-in-quirksmode.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::validUnit): treat unitless values in quirks mode
+        as miliseconds instead of seconds.
+
+2009-01-12  David Hyatt  <hyatt@apple.com>
+
+        Apply the same idea as the previous fix but for matched declarations.
+
+        Reviewed by Dan Bernstein
+
+        * css/CSSStyleSelector.h:
+
+2009-01-12  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler
+
+        <rdar://problem/6468274> - Track Non-get requests in global history
+
+        * WebCore.base.exp:
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::HistoryItem):
+        * history/HistoryItem.h:
+        (WebCore::HistoryItem::lastVisitWasHTTPNonGet):
+        (WebCore::HistoryItem::setLastVisitWasHTTPNonGet):
+
+2009-01-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        !ENABLE(SVG_FONTS) build fix. Move defaultUnitsPerEm into a non-SVG header
+        so it can be used by all builds.
+
+        * platform/graphics/Font.h:
+        * platform/graphics/SimpleFontData.cpp:
+        * svg/SVGFontFaceElement.cpp:
+        * svg/SVGFontFaceElement.h:
+
+2009-01-12  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build typo fix.
+
+        * platform/graphics/wx/TransformationMatrixWx.cpp:
+        (WebCore::TransformationMatrix::TransformationMatrix):
+
+2009-01-12  David Hyatt  <hyatt@apple.com>
+
+        Make sure the set of matched rules has a reserved capacity of 32.  This prevents remalloc thrash as
+        elements are matched, since the Vector is shrinking and growing over and over.  1% PLT speedup.
+
+        Reviewed by Oliver Hunt
+
+        * css/CSSStyleSelector.h:
+
+2009-01-12  David Hyatt  <hyatt@apple.com>
+
+        Optimize Element::attributeChanged to just check if accessibility is enabled up front before looking at the
+        two accessibility-related attributes.  This avoids the rest of the code for all attributes on the PLT.
+        Tiny speedup.
+
+        Reviewed by Oliver Hunt
+
+        * dom/Element.cpp:
+        (WebCore::Element::attributeChanged):
+
+2009-01-12  David Hyatt  <hyatt@apple.com>
+
+        Optimize the retrieval of line height.  If the document is not using any first-line rules, just immediately
+        default to the normal case.  Tiny speedup on PLT.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::lineHeight):
+
+2009-01-12  David Hyatt  <hyatt@apple.com>
+
+        Fix 0.6% regression in PLT.  Make sure not to waste time updating NSScrollView's can blit on scroll state
+        in the ScrollView constructor, since this is always going to be properly updated by FrameView anyway.
+
+        Reviewed by Oliver Hunt
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::ScrollView):
+
+2009-01-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=23273
+
+        In RenderBox::repaintLayerRectsForImage(), the repaint rect does not have
+        to be computed in absolute coordintes. Instead, we compute a repaintRect
+        relative to the RenderObject, which can repaint itself.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::repaintLayerRectsForImage):
+
+2009-01-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=23220
+
+        Merge layoutDelta into LayoutState. This requires that we
+        push even when layoutState is disabled, so that layoutDelta
+        can still be stored.
+
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/LayoutState.h:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::layoutOnlyPositionedObjects):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::localToAbsolute):
+        (WebCore::RenderBox::absoluteToLocal):
+        (WebCore::RenderBox::computeAbsoluteRepaintRect):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::absoluteClippedOverflowRect):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::computeAbsoluteRepaintRect):
+        (WebCore::RenderTableCell::localToAbsolute):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::pushLayoutState):
+        * rendering/RenderView.h:
+        (WebCore::RenderView::layoutDelta):
+        (WebCore::RenderView::addLayoutDelta):
+        (WebCore::RenderView::doingFullRepaint):
+        (WebCore::RenderView::pushLayoutState):
+        (WebCore::RenderView::popLayoutState):
+        (WebCore::RenderView::layoutStateEnabled):
+        (WebCore::RenderView::layoutState):
+        (WebCore::LayoutStateMaintainer::LayoutStateMaintainer):
+        (WebCore::LayoutStateMaintainer::push):
+        (WebCore::LayoutStateMaintainer::pop):
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+
+2009-01-12  Julien Chaffraix  <jchaffraix@pleyo.com>
+
+        Reviewed by Holger Freyther.
+
+        [Qt] Build fix after turning the fontCache to a singleton
+        https://bugs.webkit.org/show_bug.cgi?id=23253
+
+        Add a stub implementation for WebCore::fontCache() and FontCache::FontCache().
+
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::fontCache):
+        (WebCore::FontCache::FontCache):
+
+2009-01-12  Eric Roman  <eroman@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix some bugs with Selection::appendTrailingWhitespace().
+        https://bugs.webkit.org/show_bug.cgi?id=23232
+
+        Test: editing/selection/doubleclick-whitespace-crash.html
+
+        * editing/Selection.cpp:
+        (WebCore::makeSearchRange):
+        (WebCore::Selection::appendTrailingWhitespace):
+
+2009-01-12  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add the first pieces of platform/graphics/chromium
+        https://bugs.webkit.org/show_bug.cgi?id=23257
+
+        * platform/graphics/chromium/ColorChromium.cpp: Added.
+        (WebCore::focusRingColor):
+        * platform/graphics/chromium/FontCacheChromiumWin.cpp: Added.
+        (WebCore::FontCache::platformInit):
+        (WebCore::isStringASCII):
+        (WebCore::LookupAltName):
+        (WebCore::FontCodepage::):
+        (WebCore::FontCodepage::if):
+        (WebCore::createFontIndirectAndGetWinName):
+        (WebCore::fontContainsCharacter):
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::alternateFamilyName):
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::toGDIFontWeight):
+        (WebCore::FontCache::getGenericFontForScript):
+        (WebCore::FillLogFont):
+        (WebCore::FontCache::fontExists):
+        (WebCore::TraitsInFamilyProcData::TraitsInFamilyProcData):
+        (WebCore::traitsInFamilyEnumProc):
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontCache::createFontPlatformData):
+        * platform/graphics/chromium/FontCacheLinux.cpp: Added.
+        (WebCore::FontCache::platformInit):
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::alternateFamilyName):
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        (WebCore::FontCache::getTraitsInFamily):
+        (WebCore::FontCache::createFontPlatformData):
+        (WebCore::FontCache::getGenericFontForScript):
+        * platform/graphics/chromium/FontChromiumWin.cpp: Added.
+        (WebCore::windowsCanHandleTextDrawing):
+        (WebCore::skiaDrawText):
+        (WebCore::PaintSkiaText):
+        (WebCore::Font::drawGlyphs):
+        (WebCore::Font::selectionRectForComplexText):
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+
+2009-01-12  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23254
+        Upstream page/chromium/
+
+        * page/chromium/AXObjectCacheChromium.cpp: Added.
+        (WebCore::AXObjectCache::detachWrapper):
+        (WebCore::AXObjectCache::attachWrapper):
+        (WebCore::AXObjectCache::postNotification):
+        (WebCore::AXObjectCache::postNotificationToElement):
+        (WebCore::AXObjectCache::handleFocusedUIElementChanged):
+        * page/chromium/AccessibilityObjectChromium.cpp:
+        * page/chromium/AccessibilityObjectWrapper.h:
+        * page/chromium/ChromeClientChromium.h: Added.
+        * page/chromium/DragControllerChromium.cpp: Added.
+        (WebCore::DragController::dragOperation):
+        (WebCore::DragController::isCopyKeyDown):
+        (WebCore::DragController::maxDragImageSize):
+        (WebCore::DragController::cleanupAfterSystemDrag):
+        * page/chromium/EventHandlerChromium.cpp: Added.
+        (WebCore::EventHandler::passMousePressEventToSubframe):
+        (WebCore::EventHandler::passMouseMoveEventToSubframe):
+        (WebCore::EventHandler::passMouseReleaseEventToSubframe):
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::passWidgetMouseDownEventToWidget):
+        (WebCore::EventHandler::passMouseDownEventToWidget):
+        (WebCore::EventHandler::tabsToAllControls):
+        (WebCore::EventHandler::eventActivatedView):
+        (WebCore::EventHandler::createDraggingClipboard):
+        (WebCore::EventHandler::focusDocumentView):
+        (WebCore::EventHandler::accessKeyModifiers):
+        * page/chromium/FrameChromium.cpp: Added.
+        (WebCore::computePageRectsForFrame):
+        (WebCore::Frame::dragImageForSelection):
+        * page/chromium/FrameChromium.h: Added.
+
+2009-01-12  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22936
+        Fix uninitialized memory read error, reported by Purify.
+
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData): Added initializer for
+            m_unitsPerEm using cDefaultUnitsPerEm constant.
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::unitsPerEm): Replaced literal value with
+            the constant.
+        * svg/SVGFontFaceElement.h: Added cDefaultUnitsPerEm constant.
+
+2009-01-12  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Do not set fixedLayoutSize for anything other than the mainframe during
+        the transition as this is a page level state like the viewportSize.
+
+        * loader/FrameLoaderClient.cpp:
+        (WebCore::FrameLoaderClient::transitionToCommittedForNewPage):
+
+2009-01-12  Julien Chaffraix  <jchaffraix@pleyo.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 22861: Turn the FontCache into a singleton
+        https://bugs.webkit.org/show_bug.cgi?id=22861
+
+        - Added fontCache() to get the global FontCache.
+
+        - Made all the methods in FontCache instance method.
+
+        - Changed FontCache:: to fontCache()-> in WebCore.
+
+        * WebCore.base.exp: Now export fontCache().
+        * css/CSSFontFaceSource.cpp:
+        (WebCore::CSSFontFaceSource::getFontData):
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::CSSFontSelector):
+        (WebCore::CSSFontSelector::~CSSFontSelector):
+        (WebCore::CSSFontSelector::addFontFaceRule):
+        (WebCore::fontDataForGenericFamily):
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::glyphDataForCharacter):
+        * platform/graphics/FontCache.cpp:
+        (WebCore::fontCache):
+        (WebCore::FontCache::FontCache):
+        * platform/graphics/FontCache.h:
+        * platform/graphics/FontFallbackList.cpp:
+        (WebCore::FontFallbackList::FontFallbackList):
+        (WebCore::FontFallbackList::invalidate):
+        (WebCore::FontFallbackList::releaseFontData):
+        (WebCore::FontFallbackList::fontDataAt):
+        (WebCore::FontFallbackList::fontDataForCharacters):
+        (WebCore::FontFallbackList::setPlatformFont):
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::~SimpleFontData):
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore::fontCacheATSNotificationCallback):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::smallCapsFontData):
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::getCJKCodePageMasks):
+        * platform/graphics/win/SimpleFontDataWin.cpp:
+        (WebCore::SimpleFontData::containsCharacters):
+
+2009-01-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 23247: createSVGPathSegCurvetoCubicSmoothAbs doesn't set y2 correctly
+        https://bugs.webkit.org/show_bug.cgi?id=23247
+
+        Also fix problems where partially parsed paths will still have an effect
+        rather than failing parsing and being ignored.
+
+        Test: dom/path-segments.html
+
+        * platform/graphics/Path.h:
+        (WebCore::Path::swap): Added.
+
+        * svg/SVGParserUtilities.cpp:
+        (WebCore::SVGPathParser::parseSVG): Removed unneeded special case for empty string.
+        (WebCore::PathBuilder::build): Changed to not modify the path if parsing fails.
+        (WebCore::SVGPathSegListBuilder::build): Changed to not modify the segment list if
+        parsing fails.
+        (WebCore::SVGPathSegListBuilder::svgMoveTo): Put the path element into the vector,
+        not directly into the segment list.
+        (WebCore::SVGPathSegListBuilder::svgLineTo): Ditto.
+        (WebCore::SVGPathSegListBuilder::svgLineToHorizontal): Ditto.
+        (WebCore::SVGPathSegListBuilder::svgLineToVertical): Ditto.
+        (WebCore::SVGPathSegListBuilder::svgCurveToCubic): Ditto.
+        (WebCore::SVGPathSegListBuilder::svgCurveToCubicSmooth): Ditto.
+        (WebCore::SVGPathSegListBuilder::svgCurveToQuadratic): Ditto.
+        (WebCore::SVGPathSegListBuilder::svgCurveToQuadraticSmooth): Ditto.
+        (WebCore::SVGPathSegListBuilder::svgArcTo): Ditto.
+        (WebCore::SVGPathSegListBuilder::svgClosePath): Ditto.
+
+        * svg/SVGPathSegCurvetoCubicSmooth.h:
+        (WebCore::SVGPathSegCurvetoCubicSmooth::SVGPathSegCurvetoCubicSmooth):
+        Set y2 to y2, not to y.
+
+2009-01-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 23102: turn on unused parameter warnings in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=23102
+
+        Fourth step: Remove arguments entirely in the many cases where they are not
+        needed at all. This step is a little less mechanical than the earlier ones.
+
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::isXMLMIMEType): Pass TextCaseSensitive when creating
+        the regular expression, since we already specify a-zA-Z in our expression.
+
+        * dom/Document.cpp:
+        (WebCore::Document::databaseThread): Don't pass in the document when creating
+        a DatabaseThread.
+
+        * dom/Element.cpp:
+        (WebCore::Element::createRareData): Don't pass the element when creating an
+        ElementRareData.
+        (WebCore::Element::detach): Don't pass the element when calling resetComputedStyle.
+        (WebCore::Element::recalcStyle): Ditto.
+
+        * dom/ElementRareData.h: Remove the unused Element* from the constructor and
+        the resetComputedStyle function.
+
+        * dom/EventTargetNode.cpp:
+        (WebCore::EventTargetNode::dispatchEvent): Don't pass ec to dispatchGenericEvent.
+        (WebCore::EventTargetNode::dispatchGenericEvent): Remove the unused ec argument.
+        (WebCore::EventTargetNode::dispatchWindowEvent): Don't pass ec to dispatchGenericEvent.
+        * dom/EventTargetNode.h: Remove the ExceptionCode& argument form disaptchGenericEvent.
+
+        * editing/ApplyStyleCommand.cpp: Remove the empty removeBlockStyle function.
+        (WebCore::ApplyStyleCommand::pushDownTextDecorationStyleAroundNode): Remove the unused
+        start and end arguments.
+        (WebCore::ApplyStyleCommand::pushDownTextDecorationStyleAtBoundaries): Don't pass start
+        and end to pushDownTextDecorationStyleAroundNode.
+
+        * editing/ApplyStyleCommand.h: Remove the empty removeBlockStyle function. Removed the
+        unused start and end arguments from pushDownTextDecorationStyleAroundNode.
+
+        * editing/htmlediting.cpp: Removed include of unused RegularExpression.h header.
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::Token::addAttribute): Removed unused Document* argument.
+        (WebCore::HTMLTokenizer::parseTag): Don't pass document to addAttribute.
+
+        * html/HTMLTokenizer.h: Removed unused Document* argument to to addAttribute.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::localStorage): Don't pass the frame to storageArea.
+
+        * page/DragController.cpp:
+        (WebCore::DragController::dragIsMove): Removed unused DragData argument.
+        (WebCore::DragController::performDrag): Call concludeEditDrag rather than
+        concludeDrag.
+        (WebCore::DragController::tryDocumentDrag): Don't pass dragData to dragIsMove.
+        (WebCore::DragController::concludeEditDrag): Renamed to make it clear this
+        should only be called for edit drags. Removed the action mask argument. Also
+        changed dragIsMove call sites to not pass dragData.
+
+        * page/DragController.h: Updated for above changes and tweaked comment format.
+
+        * page/Frame.cpp:
+        (WebCore::createRegExpForLabels): Pass TextCaseSensitive and TextCaseInsensitive
+        when creating regular expressions for clarity. Call match instead of search,
+        since both do the same thing except for with negative start offsets, and none
+        used here are negative.
+        (WebCore::Frame::matchLabelsAgainstElement): Ditto.
+
+        * page/Page.h: Moved TextCaseSensitivity from here to StringImpl.h in platform.
+
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (AXAttributeStringSetHeadingLevel): Removed unused object argument.
+        (AXAttributedStringAppendText): Ditto.
+        (-[AccessibilityObjectWrapper doAXAttributedStringForTextMarkerRange:]): Ditto.
+
+        * page/mac/FrameMac.mm:
+        (WebCore::regExpForLabels): Pass TextCaseSensitive and TextCaseInsensitive
+        when creating regular expressions for clarity. Call match instead of search,
+        since both do the same thing except for with negative start offsets, and none
+        used here are negative.
+        (WebCore::Frame::matchLabelsAgainstElement): Ditto.
+
+        * platform/graphics/SegmentedFontData.cpp:
+        (WebCore::SegmentedFontData::containsCharacter): Added.
+        (WebCore::SegmentedFontData::containsCharacters): Updated to check all characters
+        instead of just the first one, using containsCharacter.
+
+        * platform/graphics/SegmentedFontData.h: Made more members private.
+        Added containsCharacter function member.
+
+        * platform/mac/DragImageMac.mm:
+        (WebCore::dragImageSize): Changed to use RetainPtr<NSImage> directly instead of
+        DragImageRef for clarity, since this is platform-specific code.
+        (WebCore::deleteDragImage): Ditto. Also remove argument name to get rid of unused
+        variable warning.
+        (WebCore::scaleDragImage): Ditto.
+        (WebCore::dissolveDragImageToFraction): Ditto.
+        (WebCore::createDragImageFromImage): Ditto.
+        (WebCore::createDragImageIconForCachedImage): Ditto.
+
+        * platform/mac/WebFontCache.mm:
+        (acceptableChoice): Removed the unused weight-related arguments.
+        (betterChoice): Ditto.
+        (+[WebFontCache internalFontWithFamily:traits:weight:size:]): Ditto.
+
+        * platform/posix/FileSystemPOSIX.cpp: Removed the implementation of listDirectory
+        because we'd rather get a link error rather than a runtime error if we use it
+        for anything, and right now it's not used.
+
+        * platform/text/RegularExpression.cpp: Removed unused private data,
+        including pattern, lastMatchString, lastMatchOffsets, lastMatchCount,
+        and lastMatchPos. Made the RegularExpression::Private::regex be private
+        and use an accessor function to get at it.
+        (WebCore::RegularExpression::RegularExpression): Removed the const char* version
+        of the constructor because it's not any more efficient. Changed the boolean
+        constructor argument to use TextCaseSensitivity instead to make it less likely
+        we'll use it wrong.
+        (WebCore::RegularExpression::operator=): Since the only member is a single RefPtr,
+        just use plain old assignment on it. The only reason we do this instead of using
+        the compiler generated assignment operator is that we want the Private structure
+        to be internal to the .cpp file.
+        (WebCore::RegularExpression::match): Added a null check so we won't crash if
+        we fail to compile the regular expression. Removed the code to handle multiple
+        match strings, since that was unused.
+
+        * platform/text/RegularExpression.h: Changed the case sensitivity argument to use
+        TextCaseSensitivity and not have a default value. Removed the default constructor,
+        and the pattern, match, and pos functions.
+
+        * platform/text/StringImpl.h: Moved the TextCaseSensitivity enum here from
+        Page.h, because we should eventually use it in all the places where we have
+        an argument to control case sensitivity, starting with the functions in this
+        class.
+
+        * platform/text/mac/ShapeArabic.c:
+        (shapeUnicode): Removed the unused options and pErrorCode arguments. Even though
+        this is code borrowed from ICU, this seems like a simple safe change to make.
+        (shapeArabic): Don't pass options or pErrorCode in to shapeUnicode.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::RenderPath): Removed the unused style argument.
+        Also removed the type check. The argument already has the correct type,
+        so it's not helpful to upcast it and then check its type again, unless
+        we have some reason to believe the type is not reliable. And we don't.
+
+        * rendering/RenderPath.h: Removed the RenderStyle* argument to the
+        constructor. Also removed the explicit declaration of the destructor.
+        It's not helpful or needed.
+
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::localCaretRect): Updated the comment here to
+        make it clear that just returning an empty rect is not a good implementation.
+        Removed the argument names to get rid of the warning.
+
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::printBorderStyle): Removed the unused RenderObject argument.
+        (WebCore::operator<<): Updated for the change to printBorderStyle function.
+
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::DatabaseThread): Removed the unused document argument.
+        * storage/DatabaseThread.h: Ditto.
+
+        * storage/LocalStorage.cpp:
+        (WebCore::LocalStorage::storageArea): Removed the unused Frame* argument.
+        * storage/LocalStorage.h: Ditto.
+
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::sendSVGLoadEventIfPossible): Don't pass an exception
+        code location to dispatchGenericEvent.
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::dispatchEvent): Ditto.
+
+        * svg/SVGStyledTransformableElement.cpp: Removed include of unused RegularExpression.h.
+        (WebCore::SVGStyledTransformableElement::createRenderer): Don't pass style in to
+        the RenderPath constructor.
+
+        * svg/SVGTransformable.cpp: Removed include of unused RegularExpression.h.
+
+        * xml/XSLTProcessor.cpp:
+        (WebCore::createFragmentFromSource): Removed unused sourceNode argument.
+        (WebCore::XSLTProcessor::transformToFragment): Don't pass sourceNode to createFragmentFromSource.
+
+2009-01-11  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23165
+        Disable application cache dynamic entries support.
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        * loader/appcache/DOMApplicationCache.idl:
+
+2009-01-11  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Correct coordinate transformation for deeply nested frames on resizing.  This
+        fixes https://bugs.webkit.org/show_bug.cgi?id=20766.
+
+        Test: fast/frames/frame-deep-nested-resize.html
+
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::userResize):
+
+2009-01-11  Mark Rowe  <mrowe@apple.com>
+
+        Tiger build fix.  The connection parameter is still used on Tiger in this method.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:willCacheResponse:]):
+
+2009-01-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 23102: turn on unused parameter warnings in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=23102
+
+        Third step: Deal with cases of arguments used only in assertions.
+
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePortCloseEventTask::performTask): Use ASSERT_UNUSED.
+        * dom/Worker.cpp:
+        (WebCore::Worker::notifyFinished): Ditto.
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::notifyFinished): Ditto.
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::failedLoadingMainResource): Ditto.
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::verifySchemaVersion): Ditto.
+        * loader/icon/IconLoader.cpp:
+        (WebCore::IconLoader::didReceiveData): Since loader and size are only
+        used when logging, use UNUSED_PARAM when logging is disabled.
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::beforeMouseDown): Use ASSERT_UNUSED.
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::didCancelAuthenticationChallenge): Use the
+        argument since it's probably a tiny bit more efficient and gets rid
+        of the unused argument warning.
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::createInlineBox): Use ASSERT_UNUSED.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::createInlineBox): Ditto.
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::createInlineBox): Use UNUSED_PARAM.
+        I couldn't use ASSERT_UNUSED because it's a single assertion, but it's
+        the only use for two different arguments.
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::createInlineBox): Use ASSERT_UNUSED.
+        * rendering/RenderThemeMac.mm:
+        (-[WebCoreRenderThemeNotificationObserver systemColorsDidChange:]): Ditto.
+
+2009-01-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Oliver Hunt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23242
+
+        Fix CanvasRenderingContext2D::transform to do a pre-multiply,
+        rather than a post-multiply into m_transform. This bug did not affect
+        drawing, but did cause m_transform to be incorrect, which impacted
+        willDraw(), and isPointInPath.
+
+        Test: fast/canvas/canvas-incremental-repaint-2.html
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::transform):
+
+2009-01-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 23102: turn on unused parameter warnings in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=23102
+
+        Second step: Fix simple Objective-C cases where we need to use UNUSED_PARAM.
+        That's because you can't omit an argument name in Objective-C methods.
+
+        * bindings/objc/DOMObject.mm:
+        (-[DOMObject copyWithZone:]): Use UNUSED_PARAM. Also rename argument to include
+        the word "unused" so we don't just start using it without removing the macro.
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebUndefined allocWithZone:]): Ditto.
+        (-[WebUndefined initWithCoder:]): Ditto.
+        (-[WebUndefined encodeWithCoder:]): Ditto.
+        (-[WebUndefined copyWithZone:]): Ditto.
+        * page/mac/WebDashboardRegion.m:
+        (-[WebDashboardRegion copyWithZone:]): Ditto.
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::mainThreadSetNeedsDisplay): Omit argument name.
+        (-[WebCoreMovieObserver loadStateChanged:]): Use UNUSED_PARAM as above.
+        (-[WebCoreMovieObserver rateChanged:]): Ditto.
+        (-[WebCoreMovieObserver sizeChanged:]): Ditto.
+        (-[WebCoreMovieObserver timeChanged:]): Ditto.
+        (-[WebCoreMovieObserver didEnd:]): Ditto.
+        (-[WebCoreMovieObserver newImageAvailable:]): Ditto.
+        * platform/mac/ScrollbarThemeMac.mm:
+        (+[ScrollbarPrefsObserver appearancePrefsChanged:]): Ditto.
+        (+[ScrollbarPrefsObserver behaviorPrefsChanged:]): Ditto.
+        * platform/mac/SharedTimerMac.mm:
+        (-[WebCorePowerNotifier didWake:]): Ditto.
+        * platform/mac/WebCoreKeyGenerator.m:
+        (-[WebCoreKeyGenerator signedPublicKeyAndChallengeStringWithStrengthIndex:challenge:pageURL:]): Ditto.
+        * platform/network/mac/ResourceHandleMac.mm:
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]): Ditto.
+        (-[WebCoreResourceHandleAsDelegate connectionShouldUseCredentialStorage:]): Ditto.
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveAuthenticationChallenge:]): Ditto.
+        (-[WebCoreResourceHandleAsDelegate connection:didCancelAuthenticationChallenge:]): Ditto.
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]): Ditto.
+        (-[WebCoreResourceHandleAsDelegate connection:didReceiveData:lengthReceived:]): Ditto.
+        (-[WebCoreResourceHandleAsDelegate connection:willStopBufferingData:]): Ditto.
+        (-[WebCoreResourceHandleAsDelegate connection:didSendBodyData:totalBytesWritten:totalBytesExpectedToWrite:]): Ditto.
+        (-[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:]): Ditto.
+        (-[WebCoreResourceHandleAsDelegate connection:didFailWithError:]): Ditto.
+        (-[WebCoreResourceHandleAsDelegate connection:willCacheResponse:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didReceiveResponse:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didReceiveData:]): Ditto.
+        (-[WebCoreSynchronousLoader connectionDidFinishLoading:]): Ditto.
+        (-[WebCoreSynchronousLoader connection:didFailWithError:]): Ditto.
+
+2009-01-11  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move platform dependent strokeContains back to RenderPath, Path and delete
+        unneeded Code in svg.
+
+        RenderPath clean-up for strokeContains
+        [https://bugs.webkit.org/show_bug.cgi?id=22957]
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/Path.h:
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::strokeContains):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::Path::strokeContains):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::strokeContains):
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::strokeContains):
+        * svg/graphics/cairo/RenderPathCairo.cpp: Removed.
+        * svg/graphics/cg/CgSupport.cpp: Removed.
+        * svg/graphics/cg/CgSupport.h: Removed.
+        * svg/graphics/cg/RenderPathCg.cpp: Removed.
+        * svg/graphics/cg/SVGPaintServerPatternCg.cpp:
+        * svg/graphics/cg/SVGResourceMaskerCg.mm:
+        * svg/graphics/qt/RenderPathQt.cpp: Removed.
+
+2009-01-11  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Anders Carlsson.
+
+        [GTK] make distcheck complains that distclean is not deleting JSWorkerContextBase.lut.h
+
+        make distcheck pass by adding JSWorkerContextBase.lut.h to the
+        CLEANFILES that will be cleaned on a make distclean.
+
+        * GNUmakefile.am:
+
+2009-01-11  Zalan Bujtas  <zbujtas@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23235
+        Build fix for non-VIDEO builds.
+
+        * rendering/RenderTheme.cpp:
+        * rendering/RenderTheme.h:
+
+2009-01-11  Gabriella Toth  <gtoth@inf.u-szeged.hu>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19287
+        return value of malloc() is not checked in npruntime.cpp
+
+        Checking whether malloc can allocate memory or not. If it can't, CRASH macro is invoked
+        (like in fastMalloc).
+
+        * bridge/npruntime.cpp:
+        (_NPN_GetStringIdentifier):
+        (_NPN_GetIntIdentifier):
+        (NPN_InitializeVariantWithStringCopy):
+        (_NPN_CreateObject):
+
+2009-01-11  Glenn Wilson  <gwilson@google.com>
+
+        Reviewed by Darin Adler.
+
+        Changes radio buttons so they can be 'checked' even if they
+        don't have the name attribute set.
+
+        See https://bugs.webkit.org/show_bug.cgi?id=21534
+
+        Test: fast/html/select-unnamed-radio.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::preDispatchEventHandler):
+
+2009-01-11  Bernhard Rosenkraenzer <bero@arklinux.ch>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22205
+        Fix compatibility with bison 2.4, partially based on older patch by
+        Priit Laes <amd@store20.com>
+
+        * WebCore/css/CSSGrammar.y: Made compatible with bison 2.4
+
+2009-01-11  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16001
+        Incorrect assumption that selection is always contiguous LTR.
+
+        Test: editing/selection/extend-selection-bidi.html
+
+        * rendering/RootInlineBox.cpp: (WebCore::RootInlineBox::fillLineSelectionGap):
+        Make this function  not assume a contiguous visual LTR selection range.
+
+2009-01-11  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23207
+        Moved currentTime() to from WebCore to WTF.
+
+        Most of these files only have a different header file included.
+        Various build files reflect removal of SystemTimeGtk, Wx, Qt and Linux
+        which were removed since they only implemented currentTime().
+
+        * ForwardingHeaders/wtf/CurrentTime.h: Added.
+        * GNUmakefile.am:
+        * WebCore.base.exp:
+        * WebCore.pro:
+        * dom/ContainerNode.cpp:
+        * dom/Document.cpp:
+        * dom/Event.cpp:
+        * history/CachedPage.cpp:
+        * history/PageCache.cpp:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::load):
+        (WebCore::HTMLMediaElement::progressEventTimerFired):
+        * html/HTMLTokenizer.cpp:
+        * html/PreloadScanner.cpp:
+        * inspector/InspectorController.cpp:
+        * loader/Cache.cpp:
+        (WebCore::Cache::pruneLiveResources):
+        * loader/CachedImage.cpp:
+        * loader/CachedResource.cpp:
+        * loader/FrameLoader.cpp:
+        * loader/ProgressTracker.cpp:
+        * loader/icon/IconDatabase.cpp:
+        * loader/icon/IconRecord.cpp:
+        * page/DragController.cpp:
+        * page/Frame.cpp:
+        * page/FrameView.cpp:
+        * page/animation/AnimationBase.cpp:
+        * page/animation/AnimationController.cpp:
+        * page/animation/KeyframeAnimation.cpp:
+        * platform/SystemTime.h:
+        * platform/Timer.cpp:
+        * platform/graphics/BitmapImage.cpp:
+        * platform/gtk/MouseEventGtk.cpp:
+        * platform/gtk/SharedTimerGtk.cpp:
+        * platform/gtk/SystemTimeGtk.cpp: Removed.
+        * platform/gtk/SystemTimeLinux.cpp: Removed.
+        * platform/mac/SystemTimeMac.cpp:
+        * platform/qt/PlatformMouseEventQt.cpp:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/qt/SharedTimerQt.cpp:
+        * platform/qt/SharedTimerQt.h:
+        * platform/qt/SystemTimeQt.cpp: Removed.
+        * platform/win/SharedTimerWin.cpp:
+        * platform/win/SystemTimeWin.cpp:
+        * platform/wx/MouseEventWx.cpp:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/wx/SharedTimerWx.cpp:
+        * platform/wx/SystemTimeWx.cpp: Removed.
+        * rendering/RenderImage.cpp:
+        * rendering/RenderMedia.cpp:
+        * svg/animation/SMILTimeContainer.cpp:
+        * webcore-wx.bkl:
+        * xml/XMLHttpRequest.cpp:
+
+2009-01-11  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Make ScheduledAction (Timeout callback) able to execute the callback under WorkerContext.
+        Part of 'Timers in Workers' work.
+        https://bugs.webkit.org/show_bug.cgi?id=23223
+
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute): new method that takes WorkerContext.
+        (WebCore::ScheduledAction::executeFunctionInContext): Executes a JSFunction in proper context with 'this' object.
+        * bindings/js/ScheduledAction.h:
+
+2009-01-10  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23210
+        Make it easier for ports to define custom UI for media controls
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::styleForElement): call theme()->styleSheetForMediaControls to
+        get the media controller style sheet
+
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlInputElement::hitTest): Added
+        * rendering/MediaControlElements.h: Updated
+
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::forwardEvent): Call element hitTest() method instead of local function
+        so control elements don't necessarily have to be rectangular
+
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::styleSheetForMediaControls):  Added
+        (WebCore::RenderTheme::hitTestMediaControlPart):  Added
+        * rendering/RenderTheme.h: Updated
+
+2009-01-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=23222
+
+        We need to disable LayoutState when an object has transforms,
+        because LayoutState is not transform-aware and therefore
+        repaint rects can be computed incorrectly.
+
+        Test: fast/repaint/transform-disable-layoutstate.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::layoutOnlyPositionedObjects):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+
+2009-01-09  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [QT] Make SharedTimer use QBasicTimer
+
+        Kill the SharedTimerQt.h and the usage of signal and slots
+        by using QBasicTimer.
+
+        * WebCore.pro:
+        * platform/qt/SharedTimerQt.cpp:
+        (WebCore::SharedTimerQt::SharedTimerQt):
+        (WebCore::SharedTimerQt::inst):
+        (WebCore::SharedTimerQt::start):
+        (WebCore::SharedTimerQt::stop):
+        (WebCore::SharedTimerQt::timerEvent):
+        (WebCore::setSharedTimerFiredFunction):
+        (WebCore::setSharedTimerFireTime):
+        (WebCore::stopSharedTimer):
+        * platform/qt/SharedTimerQt.h: Removed.
+
+2009-01-09  Adam Bergkvist <adam.bergkvist@ericsson.com>
+
+        Reviewed by Holger Freyther.
+
+        [CURL] POST without body becomes GET
+        https://bugs.webkit.org/show_bug.cgi?id=23182
+
+        Make sure that method is always set to POST even when the body is
+        empty. Cleaned up httpBody null check.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::setupPOST):
+
+2009-01-09  Adam Treat  <adam.treat@torchmobile.com>
+
+        Build fix.
+
+        * plugins/PluginView.cpp:
+
+2009-01-09  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix infinite recursion in clientPaddingLeft and clientPaddingRight.  This changes the code back to
+        how it was before RenderTextControlSingleLine was split out from RenderTextControl.
+
+        No test added since this code is only exercised when trying to place a search field's recent searches popup menu.
+
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::clientPaddingLeft):
+        (WebCore::RenderTextControlSingleLine::clientPaddingRight):
+
+2009-01-09  Darin Adler  <darin@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Bug 22913: REGRESSION: Space bar doesn't scroll on windows
+        https://bugs.webkit.org/show_bug.cgi?id=22913
+        rdar://problem/6479834
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::defaultKeyboardEventHandler): Added code to call
+        defaultSpaceEventHandler.
+        (WebCore::EventHandler::defaultSpaceEventHandler): Added. Scrolls down or up based
+        on the shift key.
+        * page/EventHandler.h: Added defaultSpaceEventHandler.
+
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::platformScroll): Return false, because this function does
+        not scroll. In an earlier version of this patch, I used this to prevent the
+        patch from affecting the Mac, but I decided to use #if instead.
+
+2009-01-09  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Delete references to JSValue, removing this class.
+
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::self):
+        * bindings/js/ScriptCallStack.h:
+
+2009-01-09  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add svg/graphics/skia files.
+        https://bugs.webkit.org/show_bug.cgi?id=23147
+
+        * svg/graphics/skia/RenderPathSkia.cpp: Added.
+        (WebCore::RenderPath::strokeContains):
+        * svg/graphics/skia/SVGPaintServerPatternSkia.cpp: Added.
+        (WebCore::SVGPaintServerPattern::setup):
+        * svg/graphics/skia/SVGPaintServerSkia.cpp: Added.
+        (WebCore::SVGPaintServer::draw):
+        (WebCore::SVGPaintServer::teardown):
+        (WebCore::SVGPaintServer::renderPath):
+        * svg/graphics/skia/SVGResourceFilterSkia.cpp: Added.
+        (WebCore::SVGResourceFilter::createPlatformData):
+        (WebCore::SVGResourceFilter::prepareFilter):
+        (WebCore::SVGResourceFilter::applyFilter):
+        * svg/graphics/skia/SVGResourceMaskerSkia.cpp: Added.
+        (WebCore::SVGResourceMasker::applyMask):
+
+2009-01-09  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add SkiaFontWin to platform/graphics/chromium
+        https://bugs.webkit.org/show_bug.cgi?id=23215
+
+        * platform/graphics/skia/SkiaFontWin.cpp: Added.
+        (WebCore::CachedOutlineKey::CachedOutlineKey):
+        (WebCore::operator==):
+        (WebCore::CachedOutlineKeyHash::hash):
+        (WebCore::CachedOutlineKeyHash::equal):
+        (WebCore::FIXEDToSkScalar):
+        (WebCore::deleteOutline):
+        (WebCore::addPolyCurveToPath):
+        (WebCore::getPathForGlyph):
+        (WebCore::SkiaWinOutlineCache::lookupOrCreatePathForGlyph):
+        (WebCore::SkiaWinOutlineCache::removePathsForFont):
+        * platform/graphics/skia/SkiaFontWin.h: Added.
+
+2009-01-09  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+
+        * WebCore.LP64.exp:
+
+2009-01-09  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add PlatformContextSkia and PlatformGraphics.h to platform/graphics/skia
+        https://bugs.webkit.org/show_bug.cgi?id=23215
+
+        * platform/graphics/skia/PlatformContextSkia.cpp: Added.
+        (PlatformContextSkia::State::State):
+        (PlatformContextSkia::State::~State):
+        (PlatformContextSkia::State::applyAlpha):
+        (PlatformContextSkia::PlatformContextSkia):
+        (PlatformContextSkia::~PlatformContextSkia):
+        (PlatformContextSkia::setCanvas):
+        (PlatformContextSkia::save):
+        (PlatformContextSkia::restore):
+        (PlatformContextSkia::drawRect):
+        (PlatformContextSkia::setupPaintCommon):
+        (PlatformContextSkia::setupPaintForFilling):
+        (PlatformContextSkia::setupPaintForStroking):
+        (PlatformContextSkia::setDrawLooper):
+        (PlatformContextSkia::setMiterLimit):
+        (PlatformContextSkia::setAlpha):
+        (PlatformContextSkia::setLineCap):
+        (PlatformContextSkia::setLineJoin):
+        (PlatformContextSkia::setPorterDuffMode):
+        (PlatformContextSkia::setFillColor):
+        (PlatformContextSkia::getDrawLooper):
+        (PlatformContextSkia::getStrokeStyle):
+        (PlatformContextSkia::setStrokeStyle):
+        (PlatformContextSkia::setStrokeColor):
+        (PlatformContextSkia::getStrokeThickness):
+        (PlatformContextSkia::setStrokeThickness):
+        (PlatformContextSkia::getTextDrawingMode):
+        (PlatformContextSkia::setTextDrawingMode):
+        (PlatformContextSkia::setUseAntialiasing):
+        (PlatformContextSkia::fillColor):
+        (PlatformContextSkia::beginPath):
+        (PlatformContextSkia::addPath):
+        (PlatformContextSkia::setFillRule):
+        (PlatformContextSkia::setGradient):
+        (PlatformContextSkia::setPattern):
+        (PlatformContextSkia::setDashPathEffect):
+        (PlatformContextSkia::paintSkPaint):
+        (PlatformContextSkia::bitmap):
+        (PlatformContextSkia::isPrinting):
+        * platform/graphics/skia/PlatformContextSkia.h: Added.
+        (PlatformContextSkia::currentPath):
+        (PlatformContextSkia::canvas):
+        (PlatformContextSkia::gdk_skia):
+        * platform/graphics/skia/PlatformGraphics.h: Added.
+
+2009-01-09  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add TransformationMatrixSkia to platform/graphics/skia
+        https://bugs.webkit.org/show_bug.cgi?id=23215
+
+        * platform/graphics/skia/TransformationMatrixSkia.cpp: Added.
+        (WebCore::TransformationMatrix::TransformationMatrix):
+        (WebCore::TransformationMatrix::setMatrix):
+        (WebCore::TransformationMatrix::map):
+        (WebCore::TransformationMatrix::mapRect):
+        (WebCore::TransformationMatrix::isIdentity):
+        (WebCore::TransformationMatrix::reset):
+        (WebCore::TransformationMatrix::scale):
+        (WebCore::TransformationMatrix::rotate):
+        (WebCore::TransformationMatrix::translate):
+        (WebCore::TransformationMatrix::shear):
+        (WebCore::TransformationMatrix::det):
+        (WebCore::TransformationMatrix::inverse):
+        (WebCore::TransformationMatrix::operator SkMatrix):
+        (WebCore::TransformationMatrix::operator==):
+        (WebCore::TransformationMatrix::operator*=):
+        (WebCore::TransformationMatrix::operator*):
+        (WebCore::TransformationMatrix::a):
+        (WebCore::TransformationMatrix::setA):
+        (WebCore::TransformationMatrix::b):
+        (WebCore::TransformationMatrix::setB):
+        (WebCore::TransformationMatrix::c):
+        (WebCore::TransformationMatrix::setC):
+        (WebCore::TransformationMatrix::d):
+        (WebCore::TransformationMatrix::setD):
+        (WebCore::TransformationMatrix::e):
+        (WebCore::TransformationMatrix::setE):
+        (WebCore::TransformationMatrix::f):
+        (WebCore::TransformationMatrix::setF):
+
+2009-01-09  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6477502> Repro crash reloading page using HTML5 AppCache on Windows
+
+        Test: http/tests/appcache/reload.html
+
+        On Windows, reloading resulted in the following sequence of events:
+        1) A new main resource loader was created and associated with the cache. Its document loader
+        was not associated with the cache yet.
+        2) The old document loader was destroyed, and since it was the last one, ApplicationCacheGroup
+        teardown started, with newestCache being zeroed out.
+        3) The new document loader was associated with the cache group, and cache update started.
+        4) Since newestCache was null, this caused many problems.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::documentLoaderDestroyed): Improve comments and assertions,
+        no functional changes.
+        (WebCore::ApplicationCacheGroup::associateDocumentLoaderWithCache): Revive the cache group
+        if its newest cache pointer is already saved for teardown. Note that the cache pointer
+        validity is ensured by MainResourceLoader that holds a reference to it.
+
+2009-01-09  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23214
+        Upstream platform/network/chromium/
+
+        * platform/network/chromium/AuthenticationChallenge.h: Added.
+        (WebCore::AuthenticationChallenge::AuthenticationChallenge):
+        (WebCore::AuthenticationChallenge::sourceHandle):
+        * platform/network/chromium/AuthenticationChallengeChromium.cpp: Added.
+        (WebCore::AuthenticationChallenge::platformCompare):
+        * platform/network/chromium/CookieJarChromium.cpp: Added.
+        (WebCore::setCookies):
+        (WebCore::cookies):
+        (WebCore::cookiesEnabled):
+        * platform/network/chromium/DNSChromium.cpp: Added.
+        (WebCore::prefetchDNS):
+        * platform/network/chromium/NetworkStateNotifierChromium.cpp: Added.
+        (WebCore::NetworkStateNotifier::updateState):
+        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+        * platform/network/chromium/NetworkStateNotifierPrivate.h: Added.
+        * platform/network/chromium/ResourceError.h: Added.
+        (WebCore::ResourceError::ResourceError):
+        * platform/network/chromium/ResourceRequest.h: Added.
+        (WebCore::ResourceRequest::):
+        (WebCore::ResourceRequest::ResourceRequest):
+        (WebCore::ResourceRequest::frame):
+        (WebCore::ResourceRequest::setFrame):
+        (WebCore::ResourceRequest::setTargetType):
+        (WebCore::ResourceRequest::targetType):
+        (WebCore::ResourceRequest::originPid):
+        (WebCore::ResourceRequest::setOriginPid):
+        (WebCore::ResourceRequest::securityInfo):
+        (WebCore::ResourceRequest::setSecurityInfo):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        * platform/network/chromium/ResourceResponse.h:
+        (WebCore::ResourceResponse::ResourceResponse):
+        (WebCore::ResourceResponse::getSecurityInfo):
+        (WebCore::ResourceResponse::setSecurityInfo):
+        (WebCore::ResourceResponse::isContentFiltered):
+        (WebCore::ResourceResponse::setIsContentFiltered):
+        (WebCore::ResourceResponse::doUpdateResourceResponse):
+
+2009-01-09  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22995
+        Fix flaky image animation by resetting the metadata for a frame when
+        we get new data for that frame.  This fixes animations that halted
+        when the next frame of the animation wasn't complete by the time the
+        current frame's duration expired.
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::destroyDecodedData):
+        (WebCore::BitmapImage::dataChanged):
+        * platform/graphics/BitmapImage.h:
+        (WebCore::FrameData::~FrameData):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::FrameData::clear):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::FrameData::clear):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::FrameData::clear):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::FrameData::clear):
+
+2009-01-09  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Tor Arne Vestbø.
+
+        Swap the .h and the .cpp output in the Qt build for the
+        UserAgentStyleSheetData files, to put the definition in the .cpp file
+        and the declaration in the header file.
+
+        * WebCore.pro:
+
+2009-01-09  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23175
+
+        Added forwarding header.
+
+        * ForwardingHeaders/wtf/PtrAndFlags.h: Added.
+
+2009-01-09  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Prevent qmake from generating duplicate rules for embedded stylesheets
+
+        The STYLESHEETS_EMBED variable used to contain only one file name, but
+        now that it is a list of files we need to change it to be a dependency
+        for the stylesheet generator instead of the input.
+
+        * WebCore.pro:
+
+2009-01-09  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix qmake warning about missing test function, a contains() call was
+        missing.
+
+        * WebCore.pro:
+
+2009-01-09  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Tor Arne Vestbø.
+
+        Add the Qt API headers to HEADERS, too, for improved completion in IDEs.
+
+        * WebCore.pro:
+
+2009-01-09  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23199
+
+        Fix deref's of string happening on two different threads.
+
+        No observable change in behavior, so no test.  However, there are asserts
+        being added for https://bugs.webkit.org/show_bug.cgi?id=23175 which
+        will detect this issue while running the normal worker tests.
+
+        * dom/WorkerThread.cpp:
+        (WebCore::WorkerThreadStartupData::create):
+        (WebCore::WorkerThreadStartupData::WorkerThreadStartupData):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::workerThread):
+        * dom/WorkerThread.h:
+
+2009-01-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adam Roben.
+
+        - use native glyph support in Core Graphics when available
+
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs): Changed to use drawGDIGlyphs() only if
+        native glyph support is not available or stroking is required. Changed
+        to pass the font's useGDI() flag to wkSetCGContextFontRenderingStyle to
+        request the use of native glyphs.
+        * platform/graphics/win/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData): Added a call to
+        wkSetFontPlatformInfo to attach the LOGFONT to the CGFont.
+        * platform/graphics/win/FontPlatformDataCGWin.cpp:
+        (WebCore::FontPlatformData::platformDataInit): Ditto.
+
+2009-01-08  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22929
+        Fix memory regression when decoding large animated GIFs.
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::clear):
+
+2009-01-08  Scott Violet  <sky@chromium.org>
+
+        Reviewed by Eric Seidel (and Adam Barth).
+
+        Fix Images to return their file extension
+        http://code.google.com/p/chromium/issues/detail?id=5827
+
+        * platform/graphics/skia/ImageSourceSkia.cpp:
+        (WebCore::ImageSource::filenameExtension):
+
+2009-01-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add PathSkia and PatternSkia implementations to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=23200
+
+        * platform/graphics/skia/PathSkia.cpp: Added.
+        (WebCore::Path::Path):
+        (WebCore::Path::~Path):
+        (WebCore::Path::operator=):
+        (WebCore::Path::isEmpty):
+        (WebCore::Path::contains):
+        (WebCore::Path::translate):
+        (WebCore::Path::boundingRect):
+        (WebCore::Path::moveTo):
+        (WebCore::Path::addLineTo):
+        (WebCore::Path::addQuadCurveTo):
+        (WebCore::Path::addBezierCurveTo):
+        (WebCore::Path::addArcTo):
+        (WebCore::Path::closeSubpath):
+        (WebCore::Path::addArc):
+        (WebCore::Path::addRect):
+        (WebCore::Path::addEllipse):
+        (WebCore::Path::clear):
+        (WebCore::convertPathPoints):
+        (WebCore::Path::apply):
+        (WebCore::Path::transform):
+        (WebCore::Path::debugString):
+        (WebCore::boundingBoxForCurrentStroke):
+        (WebCore::Path::strokeBoundingRect):
+        * platform/graphics/skia/PatternSkia.cpp: Added.
+        (WebCore::shaderRule):
+        (WebCore::Pattern::createPlatformPattern):
+
+2009-01-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ImageSourceSkia to platform/graphics/skia
+        https://bugs.webkit.org/show_bug.cgi?id=23200
+
+        ImageSourceSkia is mostly a hack to support our
+        ICO decoder model.  See ImageSourceSkia.h for more
+        explanation.  Eventually we'd like to make our ICO
+        decoder lazy.
+
+        * platform/graphics/ImageSource.h: mark m_decoder as protected
+        * platform/graphics/skia/ImageSourceSkia.cpp: Added.
+        (WebCore::createDecoder):
+        (WebCore::ImageSource::ImageSource):
+        (WebCore::ImageSource::~ImageSource):
+        (WebCore::ImageSource::clear):
+        (WebCore::ImageSource::initialized):
+        (WebCore::ImageSource::setData):
+        (WebCore::ImageSource::isSizeAvailable):
+        (WebCore::ImageSource::size):
+        (WebCore::ImageSource::frameSizeAtIndex):
+        (WebCore::ImageSource::repetitionCount):
+        (WebCore::ImageSource::frameCount):
+        (WebCore::ImageSource::createFrameAtIndex):
+        (WebCore::ImageSource::frameIsCompleteAtIndex):
+        (WebCore::ImageSource::frameDurationAtIndex):
+        (WebCore::ImageSource::frameHasAlphaAtIndex):
+        (WebCore::ImageSourceSkia::setData):
+        (WebCore::ImageSource::filenameExtension):
+        * platform/graphics/skia/ImageSourceSkia.h: Added.
+
+2009-01-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add NativeImageSkia (PlatformImagePtr) to platform/graphics/skia
+        https://bugs.webkit.org/show_bug.cgi?id=23200
+
+        * platform/graphics/skia/NativeImageSkia.cpp: Added.
+        (NativeImageSkia::NativeImageSkia):
+        (NativeImageSkia::decodedSize):
+        (NativeImageSkia::hasResizedBitmap):
+        (NativeImageSkia::resizedBitmap):
+        (NativeImageSkia::shouldCacheResampling):
+        * platform/graphics/skia/NativeImageSkia.h: Added.
+        (NativeImageSkia::setDataComplete):
+        (NativeImageSkia::isDataComplete):
+
+2009-01-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add ImageBufferSkia and ImageSkia files.
+        https://bugs.webkit.org/show_bug.cgi?id=23200
+        For now we've left BitmapImage and BitmapImageSingleFrameSkia
+        implementations in the ImageSkia file (like ImageCG has), but
+        we intend to break them out into their own files.
+
+        * platform/graphics/skia/ImageBufferSkia.cpp: Added.
+        (WebCore::ImageBufferData::ImageBufferData):
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::~ImageBuffer):
+        (WebCore::ImageBuffer::context):
+        (WebCore::ImageBuffer::image):
+        (WebCore::ImageBuffer::getImageData):
+        (WebCore::ImageBuffer::putImageData):
+        (WebCore::ImageBuffer::toDataURL):
+        * platform/graphics/skia/ImageSkia.cpp: Added.
+        (WebCore::):
+        (WebCore::FrameData::clear):
+        (WebCore::Image::loadPlatformResource):
+        (WebCore::Image::drawPattern):
+        (WebCore::BitmapImage::initPlatformData):
+        (WebCore::BitmapImage::invalidatePlatformData):
+        (WebCore::BitmapImage::checkForSolidColor):
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImageSingleFrameSkia::draw):
+        (WebCore::BitmapImageSingleFrameSkia::create):
+
+2009-01-08  James Robinson  <jamesr@google.com>
+
+        Reviewed by Mark Rowe.
+        Landed by Pamela Greene.
+
+        WebCore::Event::timeStamp() is a simple accessor and should be const
+
+        https://bugs.webkit.org/show_bug.cgi?id=23176
+
+        * dom/Event.h:
+        (WebCore::Event::timeStamp):
+
+2009-01-08  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix <rdar://problem/6467206>
+        Resources loaded from the memory cache do not get correctly inserted into the DocLoader resource map (22994)
+
+        Use CachedResourceHandle in document resource map so resources get updated correctly when using
+        using cache validation conditionals.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::evict):
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::~DocLoader):
+        (WebCore::DocLoader::requestResource):
+        (WebCore::DocLoader::setAutoLoadImages):
+        (WebCore::DocLoader::removeCachedResource):
+        * loader/DocLoader.h:
+        (WebCore::DocLoader::cachedResource):
+        (WebCore::DocLoader::allCachedResources):
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::getSubresources):
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageLoader::updateFromElement):
+
+2009-01-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add a cleaned-up GraphicsContextSkia implementation to WebKit.
+        https://bugs.webkit.org/show_bug.cgi?id=23191
+
+        * platform/graphics/skia/GraphicsContextSkia.cpp: Added.
+        (WebCore::):
+        (WebCore::GraphicsContext::GraphicsContext):
+        (WebCore::GraphicsContext::~GraphicsContext):
+        (WebCore::GraphicsContext::platformContext):
+        (WebCore::GraphicsContext::savePlatformState):
+        (WebCore::GraphicsContext::restorePlatformState):
+        (WebCore::GraphicsContext::beginTransparencyLayer):
+        (WebCore::GraphicsContext::endTransparencyLayer):
+        (WebCore::GraphicsContext::addInnerRoundedRectClip):
+        (WebCore::GraphicsContext::addPath):
+        (WebCore::GraphicsContext::beginPath):
+        (WebCore::GraphicsContext::clearPlatformShadow):
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::clip):
+        (WebCore::GraphicsContext::clipOut):
+        (WebCore::GraphicsContext::clipOutEllipseInRect):
+        (WebCore::GraphicsContext::clipPath):
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        (WebCore::GraphicsContext::concatCTM):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        (WebCore::GraphicsContext::drawLineForText):
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::getCTM):
+        (WebCore::GraphicsContext::roundToDevicePixels):
+        (WebCore::GraphicsContext::scale):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::setCompositeOperation):
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::setLineCap):
+        (WebCore::GraphicsContext::setLineDash):
+        (WebCore::GraphicsContext::setLineJoin):
+        (WebCore::GraphicsContext::setMiterLimit):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::setPlatformShadow):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformStrokeStyle):
+        (WebCore::GraphicsContext::setPlatformStrokeThickness):
+        (WebCore::GraphicsContext::setPlatformTextDrawingMode):
+        (WebCore::GraphicsContext::setURLForRect):
+        (WebCore::GraphicsContext::setUseAntialiasing):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::rotate):
+        (WebCore::GraphicsContext::translate):
+
+2009-01-08  David Hyatt  <hyatt@apple.com>
+
+        Fix for <rdar://problem/6465682> REGRESSION: In Mail, can't force a message to auto scroll.
+
+        Make scrollRectIntoViewRecursively call out to the HostWindow to continue the recursive scroll for
+        any scrollable views that may contain a WebView.  Does nothing on platforms other than the Mac, but
+        might eventually be of interest to other platforms.
+
+        Reviewed by Oliver Hunt
+
+        * WebCore.base.exp:
+        * page/Chrome.cpp:
+        (WebCore::Chrome::scrollRectIntoView):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::scrollRectIntoView):
+        * platform/HostWindow.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollRectIntoViewRecursively):
+
+2009-01-08  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by David Hyatt.
+
+        No need to make this part of HostWindow and moreover HostWindow should
+        not have any reference to non-platform parts of WebCore.
+
+        * page/Chrome.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setContentsSize):
+        * platform/HostWindow.h:
+
+2009-01-08  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Simplify Mac interfaces for drawing media controller elements
+
+        <rdar://problem/6293969>
+
+        * WebCore.base.exp: update for changed WebKitSystemInterface media controller functions
+
+        * platform/mac/WebCoreSystemInterface.h: Ditto
+        * platform/mac/WebCoreSystemInterface.mm: Ditto
+
+        * rendering/MediaControlElements.h:
+        (WebCore::): Add MediaControlElements enum
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintMediaFullscreenButton):  update for changed WebKitSystemInterface
+        media controller functions
+        (WebCore::RenderThemeMac::paintMediaMuteButton): Ditto
+        (WebCore::RenderThemeMac::paintMediaPlayButton): Ditto
+        (WebCore::RenderThemeMac::paintMediaSeekBackButton): Ditto
+        (WebCore::RenderThemeMac::paintMediaSeekForwardButton): Ditto
+        (WebCore::RenderThemeMac::paintMediaSliderTrack): Ditto
+        (WebCore::RenderThemeMac::paintMediaSliderThumb): Ditto
+
+2009-01-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add two more files for platform/graphics/skia.
+        https://bugs.webkit.org/show_bug.cgi?id=23191
+
+        * platform/graphics/skia/GradientSkia.cpp: Added.
+        (WebCore::Gradient::platformDestroy):
+        (WebCore::F2B):
+        (WebCore::makeSkColor):
+        (WebCore::totalStopsNeeded):
+        (WebCore::fillStops):
+        (WebCore::compareStops):
+        (WebCore::Gradient::platformGradient):
+        (WebCore::Gradient::fill):
+        * platform/graphics/skia/GraphicsContextPlatformPrivate.h: Copied from WebCore/bindings/js/ScriptValue.h.
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContextPlatformPrivate::context):
+
+2009-01-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Commit the right files this time!  (Instead of the ugly unfixed ones.)
+        https://bugs.webkit.org/show_bug.cgi?id=23191
+
+        * platform/graphics/skia/BitmapImageSingleFrameSkia.h:
+        * platform/graphics/skia/FloatPointSkia.cpp:
+        * platform/graphics/skia/FloatRectSkia.cpp:
+        * platform/graphics/skia/IntPointSkia.cpp:
+        * platform/graphics/skia/IntRectSkia.cpp:
+        (WebCore::IntRect::operator SkRect):
+        * platform/graphics/skia/SkiaUtils.cpp:
+        (WebCore::):
+        (WebCore::WebCoreCompositeToSkiaComposite):
+        (WebCore::SkPMColorToWebCoreColor):
+        (WebCore::IntersectRectAndRegion):
+        (WebCore::ClipRectToCanvas):
+        (WebCore::SkPathContainsPoint):
+        (WebCore::scratchContext):
+        * platform/graphics/skia/SkiaUtils.h:
+        (WebCore::WebCoreFloatToSkScalar):
+        (WebCore::WebCoreDoubleToSkScalar):
+
+2009-01-08  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add the first few files from platform/graphics/skia
+        https://bugs.webkit.org/show_bug.cgi?id=23191
+
+        These are all pretty simple.
+        Eventually BitmapImageSingleFrameSkia might grow a .cpp file, for now it's just a header.
+        SkiaUtils needs to die, but that can come later, no need to block up-streaming now.
+
+        * platform/graphics/skia/BitmapImageSingleFrameSkia.h: Added.
+        (WebCore::BitmapImageSingleFrameSkia::isBitmapImage):
+        (WebCore::BitmapImageSingleFrameSkia::size):
+        (WebCore::BitmapImageSingleFrameSkia::destroyDecodedData):
+        (WebCore::BitmapImageSingleFrameSkia::decodedSize):
+        (WebCore::BitmapImageSingleFrameSkia::nativeImageForCurrentFrame):
+        (WebCore::BitmapImageSingleFrameSkia::BitmapImageSingleFrameSkia):
+        * platform/graphics/skia/FloatPointSkia.cpp: Copied from WebCore/platform/graphics/mac/FloatPointMac.mm.
+        (WebCore::FloatPoint::FloatPoint):
+        (WebCore::FloatPoint::operator SkPoint):
+        * platform/graphics/skia/FloatRectSkia.cpp: Copied from WebCore/platform/graphics/qt/IntRectQt.cpp.
+        (WebCore::FloatRect::FloatRect):
+        (WebCore::FloatRect::operator SkRect):
+        * platform/graphics/skia/IntPointSkia.cpp: Copied from WebCore/platform/graphics/win/IntPointWin.cpp.
+        (WebCore::IntPoint::IntPoint):
+        (WebCore::IntPoint::operator SkIPoint):
+        (WebCore::IntPoint::operator SkPoint):
+        * platform/graphics/skia/IntRectSkia.cpp: Copied from WebCore/platform/graphics/qt/IntRectQt.cpp.
+        (WebCore::IntRect::operator SkIRect):
+        (WebCore::IntRect::operator SkRect):
+        (WebCore::IntRect::IntRect):
+        * platform/graphics/skia/SkiaUtils.cpp: Added.
+        (WebCore::WebCorePointToSkiaPoint):
+        (WebCore::WebCoreRectToSkiaRect):
+        (WebCore::):
+        (WebCore::WebCoreCompositeToSkiaComposite):
+        (WebCore::InvScaleByte):
+        (WebCore::SkPMColorToColor):
+        (WebCore::SkPMColorToWebCoreColor):
+        (WebCore::IntersectRectAndRegion):
+        (WebCore::ClipRectToCanvas):
+        (WebCore::SkPathContainsPoint):
+        (WebCore::scratchContext):
+        * platform/graphics/skia/SkiaUtils.h: Added.
+        (WebCore::WebCoreFloatToSkScalar):
+        (WebCore::WebCoreDoubleToSkScalar):
+
+2009-01-08  Pierre-Olivier Latour  <pol@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fixed CSS Transitions with zero-duration but non-zero-delay not starting or ending properly.
+
+        Also updated AnimationController::numberOfActiveAnimations() which now returns the number of "active" animations,
+        instead of simply the "running" ones.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23177
+
+        Tests: transitions/zero-duration-with-non-zero-delay-end.html
+               transitions/zero-duration-with-non-zero-delay-start.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::fireAnimationEventsIfNeeded):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::animationTimerFired):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::numberOfActiveAnimations):
+
+2009-01-08  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6477501> Repro crash loading HTML5 AppCache manifest directly
+
+        The crash happened whenever a cached resource was downloaded, as opposed to used directly.
+
+        No test, as downloading cannot be tested automatically.
+
+        * loader/MainResourceLoader.cpp: (WebCore::MainResourceLoader::continueAfterContentPolicy):
+        Cancel downloads that do not have an associated ResourceHandle, such as downloads from the
+        application cache. Activity window shows "The URL can't be shown", and the frame remains empty.
+
+2009-01-08  Justin McPherson <justin.mcpherson@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the Qt build on older X11 systems with special X paths.
+
+        * WebCore.pro: Use the x11 qmake config to pull in extra paths
+        needed for NPAPI.
+
+2009-01-08  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r39699
+
+        * DerivedSources.cpp: Added JSDOMStringList.cpp.
+
+2009-01-08  Kent Hansen  <khansen@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix copy & paste of images in the Qt port.
+
+        Store the QPixmap itself in the mimedata, not a QPixmap* converted to bool.
+
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::declareAndWriteDragImage):
+
+2009-01-08  Hiroyuki Ikezoe  <poincare@ikezoe.net>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23127
+
+        Invoke pango_coverage_get with each Unicode character.
+
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::containsCharacters):
+
+2009-01-07  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Part one of
+        https://bugs.webkit.org/show_bug.cgi?id=23165
+        Add support for application cache dynamic entries
+
+        Test: http/tests/appcache/dynamic-entries-no-cache.html
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        Added new files.
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp: (WebCore::JSDOMApplicationCache::hasItem):
+        Added binding for hasItem(). Like other DOMApplicationCache methods, it needs to be custom
+        to resolve relative URLs correctly.
+
+        * bindings/js/JSDOMStringListCustom.cpp: Added.
+        * dom/DOMStringList.cpp: Added.
+        * dom/DOMStringList.h: Added.
+        * dom/DOMStringList.idl: Added.
+        Added an implementation of DOM 3 Core DOMStringList interface, which is returned by
+        DOMApplicationCache items attribute.
+
+        * dom/StaticStringList.cpp: Added.
+        * dom/StaticStringList.h: Added.
+        An implementation of DOMStringList that makes a snapshot (for DOMApplicationCache, this
+        matches Firefox, as the spec doesn't say whether the returned list should be live or not).
+
+        * loader/appcache/ApplicationCache.h: Added a list of pending dynamic entry actions, to be
+        used in the near future.
+
+        * loader/appcache/DOMApplicationCache.idl: Updated for spec changes. Instead of length
+        attribute and item(), we now have an items attribute that returns a DOMStringList, and a
+        hasItem convenience method.
+
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::items):
+        (WebCore::DOMApplicationCache::hasItem):
+        * loader/appcache/DOMApplicationCache.h:
+        Added implementations of items attribute and hasItem() (note that underlying ApplicationCache
+        methods are still unimplemented though).
+
+        * page/DOMWindow.idl: Expose a DOMStringList global constructor.
+
+2009-01-07  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23122
+
+        This completes the removal of dependencies on WebKit from the platform code
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::getDelayValue):
+        (WebCore::getDurationValue):
+        (WebCore::getTimingFunctionValue):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSHelper.h:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::mapAnimationDelay):
+        (WebCore::CSSStyleSelector::mapAnimationDirection):
+        (WebCore::CSSStyleSelector::mapAnimationDuration):
+        (WebCore::CSSStyleSelector::mapAnimationIterationCount):
+        (WebCore::CSSStyleSelector::mapAnimationName):
+        (WebCore::CSSStyleSelector::mapAnimationPlayState):
+        (WebCore::CSSStyleSelector::mapAnimationProperty):
+        (WebCore::CSSStyleSelector::mapAnimationTimingFunction):
+        * platform/animation/Animation.cpp:
+        (WebCore::Animation::Animation):
+        * platform/animation/Animation.h:
+        (WebCore::Animation::initialAnimationDelay):
+        (WebCore::Animation::initialAnimationDirection):
+        (WebCore::Animation::initialAnimationDuration):
+        (WebCore::Animation::initialAnimationIterationCount):
+        (WebCore::Animation::initialAnimationName):
+        (WebCore::Animation::initialAnimationPlayState):
+        (WebCore::Animation::initialAnimationProperty):
+        (WebCore::Animation::initialAnimationTimingFunction):
+        * rendering/style/RenderStyle.h:
+
+2008-01-07  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22929
+
+        Fix errors while decoding GIFs by not calling setData() repeatedly
+        when it's not necessary.  Pushes the responsibility for calling
+        setData() after clear() into the ImageSource which presumably knows
+        better than BitmapImage what needs to be done.
+
+        NOTE: The above bug is mainly about a memory regression, which this
+        patch does not fix.
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::destroyDecodedData):
+        * platform/graphics/ImageSource.h:
+        * platform/graphics/cairo/ImageSourceCairo.cpp:
+        (WebCore::ImageSource::clear):
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::clear):
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::~ImageSource):
+        (WebCore::ImageSource::clear):
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::ImageSource::~ImageSource):
+        (WebCore::ImageSource::clear):
+
+2009-01-07  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6355786> Find fails for queries that contain a line break
+
+        * editing/TextIterator.cpp:
+        (WebCore::findPlainText): Allow find with queries that contain newlines.
+
+2009-01-07  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Allow removal of inline shorthand properties for
+        animation, transition and transform origin. Also
+        add getter for shorthand animation property.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22605
+
+        Test: fast/css/transform-inline-style-remove.html
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
+            Getter for animation property shorthand
+        (WebCore::initShorthandMap):
+            Adds initialisation for transform-origin, animation and transition
+
+2009-01-07  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandleInternal::~ResourceHandleInternal):
+        (WebCore::parseDataUrl):
+        (WebCore::ResourceHandle::startData): keep track of the idle handler
+        we add and remove it in the destructor
+
+2009-01-07  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Finish renaming of AffineTransform to TransformationMatrix, this
+        time ensuring that the platform implementations get the correct
+        name. Also, clean up some whitespace cruft in old content.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23151
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/cairo/AffineTransformCairo.cpp: Removed.
+        * platform/graphics/cairo/TransformationMatrixCairo.cpp: Copied from WebCore/platform/graphics/cairo/AffineTransformCairo.cpp.
+        * platform/graphics/cg/AffineTransformCG.cpp: Removed.
+        * platform/graphics/cg/TransformationMatrixCG.cpp: Copied from WebCore/platform/graphics/cg/AffineTransformCG.cpp.
+        * platform/graphics/qt/AffineTransformQt.cpp: Removed.
+        * platform/graphics/qt/TransformationMatrixQt.cpp: Copied from WebCore/platform/graphics/qt/AffineTransformQt.cpp.
+        * platform/graphics/transforms/TransformationMatrix.cpp:
+        * platform/graphics/transforms/TransformationMatrix.h:
+        * platform/graphics/wx/AffineTransformWx.cpp: Removed.
+        * platform/graphics/wx/TransformationMatrixWx.cpp: Copied from WebCore/platform/graphics/wx/AffineTransformWx.cpp.
+        * webcore-wx.bkl:
+
+2009-01-07  Anders Carlsson  <andersca@apple.com>
+
+        Another build fix.
+
+        * WebCore.LP64.exp:
+
+2008-12-16  David Hyatt  <hyatt@apple.com>
+
+        Make Safari RSS behave nicely with full page zoom.  Need to add a new value to enable resetting of zoom
+        back to the document-level default.
+
+        Reviewed by Darin Adler
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+
+2009-01-07  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 23160: add setMemoryCacheClientCallsEnabled SPI so Safari can be faster with activity window closed
+        https://bugs.webkit.org/show_bug.cgi?id=23160
+
+        * WebCore.base.exp: Added Page::setMemoryCacheClientCallsEnabled.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache): Updated to take a CachedResource
+        so that there's no extra work the caller has to do when the inspector is disabled.
+        * inspector/InspectorController.h: Ditto.
+
+        * loader/DocumentLoader.h: Added recordMemoryCacheLoadForFutureClientNotification,
+        takeMemoryCacheLoadsForClientNotification, and m_resourcesLoadedFromMemoryCacheForClientNotification.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadedResourceFromMemoryCache): Streamlined code so less work is done when
+        there's no inspector or client call needed. Added code to check areMemoryCacheClientCallsEnabled
+        and if it's false, use recordMemoryCacheLoadForFutureClientNotification.
+        (WebCore::FrameLoader::tellClientAboutPastMemoryCacheLoads): Added.
+        * loader/FrameLoader.h: Ditto.
+
+        * page/Page.cpp:
+        (WebCore::Page::Page): Initialize m_areMemoryCacheClientCallsEnabled to be compatible with old behavior.
+        (WebCore::Page::setMemoryCacheClientCallsEnabled): Added.
+        * page/Page.h: Added setMemoryCacheClientCallsEnabled, areMemoryCacheClientCallsEnabled,
+        and m_areMemoryCacheClientCallsEnabled.
+
+2009-01-07  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Rubber-stamped by Simon Hausmann.
+
+        Qt build fix after r39670.
+
+        * bridge/qt/qt_class.cpp:
+        (JSC::Bindings::QtClass::fallbackObject):
+        * bridge/qt/qt_class.h:
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::mark):
+        (JSC::Bindings::QtInstance::invokeMethod):
+        (JSC::Bindings::QtInstance::defaultValue):
+        (JSC::Bindings::QtInstance::stringValue):
+        (JSC::Bindings::QtInstance::numberValue):
+        (JSC::Bindings::QtInstance::booleanValue):
+        (JSC::Bindings::QtInstance::valueOf):
+        (JSC::Bindings::QtField::valueFromInstance):
+        (JSC::Bindings::QtField::setValueToInstance):
+        * bridge/qt/qt_instance.h:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::valueRealType):
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::convertQVariantToValue):
+        (JSC::Bindings::findMethodIndex):
+        (JSC::Bindings::QtRuntimeMetaMethod::call):
+        (JSC::Bindings::QtRuntimeMetaMethod::lengthGetter):
+        (JSC::Bindings::QtRuntimeMetaMethod::connectGetter):
+        (JSC::Bindings::QtRuntimeMetaMethod::disconnectGetter):
+        (JSC::Bindings::QtRuntimeConnectionMethod::call):
+        (JSC::Bindings::QtRuntimeConnectionMethod::lengthGetter):
+        (JSC::Bindings::::setValueAt):
+        (JSC::Bindings::::valueAt):
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructure):
+
+2009-01-06  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6391734> SnowLeopard: Crash doing Copy Image from context menu
+
+        Can't create an automated test case for specific contextual menu items yet and
+        a normal Copy doesn't cause a crash.
+
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::fileWrapperForImage): The SharedBuffer may not have platform data.  It may,
+        for example, have a purgeable or regular buffer.
+
+2009-01-06  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=23157>.
+        Bug 23157: Crashes on Acid 3
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle): Null-check the frame.
+
+2009-01-05  Gavin Barraclough  <baraclough@apple.com>
+
+        Rubber Stamped by Oliver Hunt.
+
+        Replace all uses of JSValue* with new wrapper class, JSValuePtr.
+        See JavaScriptCore/ChangeLog for more detailed description.
+
+        * bindings/js/JSAttrCustom.cpp:
+        (WebCore::JSAttr::setValue):
+        * bindings/js/JSCSSRuleCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::JSCSSStyleDeclaration::nameGetter):
+        (WebCore::JSCSSStyleDeclaration::customPut):
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSCanvasPixelArrayCustom.h:
+        (WebCore::JSCanvasPixelArray::getByIndex):
+        (WebCore::JSCanvasPixelArray::indexSetter):
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::toJS):
+        (WebCore::toHTMLCanvasStyle):
+        (WebCore::JSCanvasRenderingContext2D::strokeStyle):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeStyle):
+        (WebCore::JSCanvasRenderingContext2D::fillStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillStyle):
+        (WebCore::JSCanvasRenderingContext2D::setFillColor):
+        (WebCore::JSCanvasRenderingContext2D::setStrokeColor):
+        (WebCore::JSCanvasRenderingContext2D::strokeRect):
+        (WebCore::JSCanvasRenderingContext2D::drawImage):
+        (WebCore::JSCanvasRenderingContext2D::drawImageFromRect):
+        (WebCore::JSCanvasRenderingContext2D::setShadow):
+        (WebCore::JSCanvasRenderingContext2D::createPattern):
+        (WebCore::JSCanvasRenderingContext2D::putImageData):
+        (WebCore::JSCanvasRenderingContext2D::fillText):
+        (WebCore::JSCanvasRenderingContext2D::strokeText):
+        * bindings/js/JSClipboardCustom.cpp:
+        (WebCore::JSClipboard::types):
+        (WebCore::JSClipboard::clearData):
+        (WebCore::JSClipboard::getData):
+        (WebCore::JSClipboard::setData):
+        (WebCore::JSClipboard::setDragImage):
+        * bindings/js/JSConsoleCustom.cpp:
+        (WebCore::JSConsole::profiles):
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        (WebCore::toVoidCallback):
+        * bindings/js/JSCustomVoidCallback.h:
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::create):
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSCustomXPathNSResolver.h:
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::add):
+        (WebCore::JSDOMApplicationCache::remove):
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::jsStringOrNull):
+        (WebCore::jsOwnedStringOrNull):
+        (WebCore::jsStringOrUndefined):
+        (WebCore::jsStringOrFalse):
+        (WebCore::valueToStringWithNullCheck):
+        (WebCore::valueToStringWithUndefinedOrNullCheck):
+        (WebCore::reportException):
+        (WebCore::reportCurrentException):
+        (WebCore::setDOMException):
+        (WebCore::objectToStringFunctionGetter):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::getDOMObjectWrapper):
+        (WebCore::getDOMNodeWrapper):
+        (WebCore::toJS):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::findJSEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSEventListener):
+        (WebCore::JSDOMGlobalObject::findJSUnprotectedEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSUnprotectedEventListener):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::createWindow):
+        (WebCore::showModalDialog):
+        (jsDOMWindowBaseCrypto):
+        (jsDOMWindowBaseEvent):
+        (jsDOMWindowBaseImage):
+        (jsDOMWindowBaseMessageChannel):
+        (jsDOMWindowBaseOption):
+        (jsDOMWindowBaseXMLHttpRequest):
+        (jsDOMWindowBaseAudio):
+        (jsDOMWindowBaseWorker):
+        (jsDOMWindowBaseXSLTProcessor):
+        (setJSDOMWindowBaseEvent):
+        (setJSDOMWindowBaseAudio):
+        (setJSDOMWindowBaseImage):
+        (setJSDOMWindowBaseMessageChannel):
+        (setJSDOMWindowBaseOption):
+        (setJSDOMWindowBaseWorker):
+        (setJSDOMWindowBaseXMLHttpRequest):
+        (setJSDOMWindowBaseXSLTProcessor):
+        (WebCore::JSDOMWindowBase::childFrameGetter):
+        (WebCore::JSDOMWindowBase::indexGetter):
+        (WebCore::JSDOMWindowBase::namedItemGetter):
+        (WebCore::JSDOMWindowBase::getOwnPropertySlot):
+        (WebCore::JSDOMWindowBase::put):
+        (WebCore::JSDOMWindowBase::clear):
+        (windowProtoFuncOpen):
+        (windowProtoFuncShowModalDialog):
+        (windowProtoFuncNotImplemented):
+        (WebCore::JSDOMWindowBase::setReturnValueSlot):
+        (WebCore::JSDOMWindowBase::installTimeout):
+        (WebCore::toJS):
+        (WebCore::toJSDOMWindow):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::lookupGetter):
+        (WebCore::JSDOMWindow::lookupSetter):
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::JSDOMWindow::postMessage):
+        (WebCore::setTimeoutOrInterval):
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::clearTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        (WebCore::JSDOMWindow::clearInterval):
+        (WebCore::JSDOMWindow::atob):
+        (WebCore::JSDOMWindow::btoa):
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        (WebCore::toDOMWindow):
+        (WebCore::nonCachingStaticCloseFunctionGetter):
+        (WebCore::nonCachingStaticBlurFunctionGetter):
+        (WebCore::nonCachingStaticFocusFunctionGetter):
+        (WebCore::nonCachingStaticPostMessageFunctionGetter):
+        * bindings/js/JSDOMWindowCustom.h:
+        (WebCore::JSDOMWindow::customPut):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::put):
+        (WebCore::JSDOMWindowShell::putWithAttributes):
+        (WebCore::JSDOMWindowShell::lookupGetter):
+        (WebCore::JSDOMWindowShell::lookupSetter):
+        (WebCore::toJS):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSDatabaseCustom.cpp:
+        (WebCore::JSDatabase::changeVersion):
+        (WebCore::JSDatabase::transaction):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::location):
+        (WebCore::JSDocument::setLocation):
+        (WebCore::toJS):
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::JSElement::setAttribute):
+        (WebCore::JSElement::setAttributeNode):
+        (WebCore::JSElement::setAttributeNS):
+        (WebCore::JSElement::setAttributeNodeNS):
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::JSEvent::clipboardData):
+        (WebCore::toJS):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSAbstractEventListener::handleEvent):
+        (WebCore::eventParameterName):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSEventTarget.h:
+        * bindings/js/JSEventTargetBase.h:
+        * bindings/js/JSEventTargetNodeCustom.cpp:
+        (WebCore::JSEventTargetNode::addEventListener):
+        (WebCore::JSEventTargetNode::removeEventListener):
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionOptions):
+        (WebCore::JSGeolocation::getCurrentPosition):
+        (WebCore::JSGeolocation::watchPosition):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSHTMLAppletElementCustom.cpp:
+        (WebCore::JSHTMLAppletElement::customPut):
+        (WebCore::JSHTMLAppletElement::nameGetter):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems):
+        (WebCore::callHTMLCollection):
+        (WebCore::JSHTMLCollection::nameGetter):
+        (WebCore::JSHTMLCollection::item):
+        (WebCore::JSHTMLCollection::namedItem):
+        (WebCore::toJS):
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::nameGetter):
+        (WebCore::JSHTMLDocument::all):
+        (WebCore::JSHTMLDocument::setAll):
+        (WebCore::JSHTMLDocument::open):
+        (WebCore::JSHTMLDocument::write):
+        (WebCore::JSHTMLDocument::writeln):
+        * bindings/js/JSHTMLEmbedElementCustom.cpp:
+        (WebCore::JSHTMLEmbedElement::customPut):
+        (WebCore::JSHTMLEmbedElement::nameGetter):
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter):
+        * bindings/js/JSHTMLFrameElementCustom.cpp:
+        (WebCore::JSHTMLFrameElement::setSrc):
+        (WebCore::JSHTMLFrameElement::setLocation):
+        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
+        (WebCore::JSHTMLFrameSetElement::nameGetter):
+        * bindings/js/JSHTMLIFrameElementCustom.cpp:
+        (WebCore::JSHTMLIFrameElement::setSrc):
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        (WebCore::JSHTMLInputElement::selectionStart):
+        (WebCore::JSHTMLInputElement::selectionEnd):
+        * bindings/js/JSHTMLObjectElementCustom.cpp:
+        (WebCore::JSHTMLObjectElement::customPut):
+        (WebCore::JSHTMLObjectElement::nameGetter):
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::JSHTMLOptionsCollection::length):
+        (WebCore::JSHTMLOptionsCollection::setLength):
+        (WebCore::JSHTMLOptionsCollection::indexSetter):
+        (WebCore::JSHTMLOptionsCollection::add):
+        (WebCore::JSHTMLOptionsCollection::remove):
+        * bindings/js/JSHTMLSelectElementCustom.cpp:
+        (WebCore::JSHTMLSelectElement::remove):
+        (WebCore::selectIndexSetter):
+        (WebCore::JSHTMLSelectElement::indexSetter):
+        * bindings/js/JSHTMLSelectElementCustom.h:
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::nonCachingStaticBackFunctionGetter):
+        (WebCore::nonCachingStaticForwardFunctionGetter):
+        (WebCore::nonCachingStaticGoFunctionGetter):
+        (WebCore::JSHistory::customPut):
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::wrap):
+        (WebCore::JSInspectedObjectWrapper::prepareIncomingValue):
+        * bindings/js/JSInspectedObjectWrapper.h:
+        (WebCore::JSInspectedObjectWrapper::wrapOutgoingValue):
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::wrap):
+        (WebCore::JSInspectorCallbackWrapper::prepareIncomingValue):
+        * bindings/js/JSInspectorCallbackWrapper.h:
+        (WebCore::JSInspectorCallbackWrapper::wrapOutgoingValue):
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::evaluate):
+        (WebCore::JSJavaScriptCallFrame::thisObject):
+        (WebCore::JSJavaScriptCallFrame::type):
+        (WebCore::JSJavaScriptCallFrame::scopeChain):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::nonCachingStaticReplaceFunctionGetter):
+        (WebCore::nonCachingStaticReloadFunctionGetter):
+        (WebCore::nonCachingStaticAssignFunctionGetter):
+        (WebCore::JSLocation::customPut):
+        (WebCore::JSLocation::setHref):
+        (WebCore::JSLocation::setProtocol):
+        (WebCore::JSLocation::setHost):
+        (WebCore::JSLocation::setHostname):
+        (WebCore::JSLocation::setPort):
+        (WebCore::JSLocation::setPathname):
+        (WebCore::JSLocation::setSearch):
+        (WebCore::JSLocation::setHash):
+        (WebCore::JSLocation::replace):
+        (WebCore::JSLocation::reload):
+        (WebCore::JSLocation::assign):
+        (WebCore::JSLocation::toString):
+        * bindings/js/JSMessageChannelConstructor.h:
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::startConversation):
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSMimeTypeArrayCustom.cpp:
+        (WebCore::JSMimeTypeArray::nameGetter):
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::nameGetter):
+        * bindings/js/JSNamedNodesCollection.cpp:
+        (WebCore::JSNamedNodesCollection::lengthGetter):
+        (WebCore::JSNamedNodesCollection::indexGetter):
+        * bindings/js/JSNamedNodesCollection.h:
+        (WebCore::JSNamedNodesCollection::createStructure):
+        * bindings/js/JSNavigatorCustom.cpp:
+        (WebCore::needsYouTubeQuirk):
+        (WebCore::JSNavigator::appVersion):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::insertBefore):
+        (WebCore::JSNode::replaceChild):
+        (WebCore::JSNode::removeChild):
+        (WebCore::JSNode::appendChild):
+        (WebCore::createWrapper):
+        (WebCore::toJSNewlyCreated):
+        (WebCore::toJS):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::JSNodeFilterCondition):
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSNodeFilterCondition.h:
+        (WebCore::JSNodeFilterCondition::create):
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::JSNodeFilter::acceptNode):
+        (WebCore::toNodeFilter):
+        * bindings/js/JSNodeIteratorCustom.cpp:
+        (WebCore::JSNodeIterator::nextNode):
+        (WebCore::JSNodeIterator::previousNode):
+        * bindings/js/JSNodeListCustom.cpp:
+        (WebCore::callNodeList):
+        (WebCore::JSNodeList::nameGetter):
+        * bindings/js/JSPluginArrayCustom.cpp:
+        (WebCore::JSPluginArray::nameGetter):
+        * bindings/js/JSPluginCustom.cpp:
+        (WebCore::JSPlugin::nameGetter):
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::runtimeObjectGetter):
+        (WebCore::runtimeObjectPropertyGetter):
+        (WebCore::runtimeObjectCustomPut):
+        (WebCore::callPlugin):
+        * bindings/js/JSPluginElementFunctions.h:
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::asWrapper):
+        (WebCore::JSQuarantinedObjectWrapper::cachedValueGetter):
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertySlot):
+        (WebCore::JSQuarantinedObjectWrapper::put):
+        (WebCore::JSQuarantinedObjectWrapper::construct):
+        (WebCore::JSQuarantinedObjectWrapper::hasInstance):
+        (WebCore::JSQuarantinedObjectWrapper::call):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/js/JSRGBColor.cpp:
+        (WebCore::getJSRGBColor):
+        (jsRGBColorRed):
+        (jsRGBColorGreen):
+        (jsRGBColorBlue):
+        * bindings/js/JSRGBColor.h:
+        (WebCore::JSRGBColor::createStructure):
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        (WebCore::JSSQLResultSetRowList::item):
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        (WebCore::JSSQLTransaction::executeSql):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSSVGLengthCustom.cpp:
+        (WebCore::JSSVGLength::value):
+        (WebCore::JSSVGLength::convertToSpecifiedUnits):
+        * bindings/js/JSSVGMatrixCustom.cpp:
+        (WebCore::JSSVGMatrix::multiply):
+        (WebCore::JSSVGMatrix::inverse):
+        (WebCore::JSSVGMatrix::translate):
+        (WebCore::JSSVGMatrix::scale):
+        (WebCore::JSSVGMatrix::scaleNonUniform):
+        (WebCore::JSSVGMatrix::rotate):
+        (WebCore::JSSVGMatrix::rotateFromVector):
+        (WebCore::JSSVGMatrix::flipX):
+        (WebCore::JSSVGMatrix::flipY):
+        (WebCore::JSSVGMatrix::skewX):
+        (WebCore::JSSVGMatrix::skewY):
+        * bindings/js/JSSVGPathSegCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSSVGPathSegListCustom.cpp:
+        (WebCore::JSSVGPathSegList::clear):
+        (WebCore::JSSVGPathSegList::initialize):
+        (WebCore::JSSVGPathSegList::getItem):
+        (WebCore::JSSVGPathSegList::insertItemBefore):
+        (WebCore::JSSVGPathSegList::replaceItem):
+        (WebCore::JSSVGPathSegList::removeItem):
+        (WebCore::JSSVGPathSegList::appendItem):
+        * bindings/js/JSSVGPointListCustom.cpp:
+        (WebCore::finishGetter):
+        (WebCore::finishSetter):
+        (WebCore::finishSetterReadOnlyResult):
+        (WebCore::JSSVGPointList::clear):
+        (WebCore::JSSVGPointList::initialize):
+        (WebCore::JSSVGPointList::getItem):
+        (WebCore::JSSVGPointList::insertItemBefore):
+        (WebCore::JSSVGPointList::replaceItem):
+        (WebCore::JSSVGPointList::removeItem):
+        (WebCore::JSSVGPointList::appendItem):
+        * bindings/js/JSSVGTransformListCustom.cpp:
+        (WebCore::finishGetter):
+        (WebCore::finishSetter):
+        (WebCore::finishSetterReadOnlyResult):
+        (WebCore::JSSVGTransformList::clear):
+        (WebCore::JSSVGTransformList::initialize):
+        (WebCore::JSSVGTransformList::getItem):
+        (WebCore::JSSVGTransformList::insertItemBefore):
+        (WebCore::JSSVGTransformList::replaceItem):
+        (WebCore::JSSVGTransformList::removeItem):
+        (WebCore::JSSVGTransformList::appendItem):
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::nameGetter):
+        (WebCore::JSStorage::deleteProperty):
+        (WebCore::JSStorage::customPut):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSStyleSheetListCustom.cpp:
+        (WebCore::JSStyleSheetList::nameGetter):
+        * bindings/js/JSTextCustom.cpp:
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSTreeWalkerCustom.cpp:
+        (WebCore::JSTreeWalker::parentNode):
+        (WebCore::JSTreeWalker::firstChild):
+        (WebCore::JSTreeWalker::lastChild):
+        (WebCore::JSTreeWalker::nextSibling):
+        (WebCore::JSTreeWalker::previousSibling):
+        (WebCore::JSTreeWalker::previousNode):
+        (WebCore::JSTreeWalker::nextNode):
+        * bindings/js/JSWorkerContextBase.cpp:
+        (WebCore::JSWorkerContextBase::put):
+        * bindings/js/JSWorkerContextBase.h:
+        * bindings/js/JSWorkerContextCustom.cpp:
+        (WebCore::JSWorkerContext::self):
+        (WebCore::JSWorkerContext::setSelf):
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        * bindings/js/JSWorkerCustom.cpp:
+        (WebCore::JSWorker::addEventListener):
+        (WebCore::JSWorker::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::open):
+        (WebCore::JSXMLHttpRequest::setRequestHeader):
+        (WebCore::JSXMLHttpRequest::send):
+        (WebCore::JSXMLHttpRequest::getResponseHeader):
+        (WebCore::JSXMLHttpRequest::overrideMimeType):
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        (WebCore::JSXMLHttpRequest::responseText):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/js/JSXSLTProcessorCustom.cpp:
+        (WebCore::JSXSLTProcessor::importStylesheet):
+        (WebCore::JSXSLTProcessor::transformToFragment):
+        (WebCore::JSXSLTProcessor::transformToDocument):
+        (WebCore::JSXSLTProcessor::setParameter):
+        (WebCore::JSXSLTProcessor::getParameter):
+        (WebCore::JSXSLTProcessor::removeParameter):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScheduledAction.h:
+        * bindings/js/ScriptCallStack.cpp:
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        (WebCore::ScriptCallStack::initialize):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
+        * bindings/js/ScriptValue.cpp:
+        (WebCore::ScriptValue::getString):
+        (WebCore::ScriptValue::isNull):
+        (WebCore::ScriptValue::isUndefined):
+        * bindings/js/ScriptValue.h:
+        (WebCore::ScriptValue::ScriptValue):
+        (WebCore::ScriptValue::jsValue):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject webScriptValueAtIndex:]):
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bindings/objc/WebScriptObjectPrivate.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_GetProperty):
+        (_NPN_HasMethod):
+        (_NPN_Construct):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::invokeMethod):
+        (JSC::Bindings::CInstance::invokeDefaultMethod):
+        (JSC::Bindings::CInstance::invokeConstruct):
+        (JSC::Bindings::CInstance::defaultValue):
+        (JSC::Bindings::CInstance::stringValue):
+        (JSC::Bindings::CInstance::numberValue):
+        (JSC::Bindings::CInstance::booleanValue):
+        (JSC::Bindings::CInstance::valueOf):
+        * bridge/c/c_instance.h:
+        * bridge/c/c_runtime.cpp:
+        (JSC::Bindings::CField::valueFromInstance):
+        (JSC::Bindings::CField::setValueToInstance):
+        * bridge/c/c_runtime.h:
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertValueToNPVariant):
+        (JSC::Bindings::convertNPVariantToValue):
+        * bridge/c/c_utility.h:
+        * bridge/jni/jni_instance.cpp:
+        (JavaInstance::stringValue):
+        (JavaInstance::numberValue):
+        (JavaInstance::booleanValue):
+        (JavaInstance::invokeMethod):
+        (JavaInstance::defaultValue):
+        (JavaInstance::valueOf):
+        * bridge/jni/jni_instance.h:
+        * bridge/jni/jni_jsobject.h:
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        (JavaJSObject::getMember):
+        (JavaJSObject::getSlot):
+        (JavaJSObject::convertValueToJObject):
+        (JavaJSObject::convertJObjectToValue):
+        * bridge/jni/jni_objc.mm:
+        (JSC::Bindings::dispatchJNICall):
+        * bridge/jni/jni_runtime.cpp:
+        (JavaArray::convertJObjectToArray):
+        (JavaField::dispatchValueFromInstance):
+        (JavaField::valueFromInstance):
+        (JavaField::dispatchSetValueToInstance):
+        (JavaField::setValueToInstance):
+        (JavaArray::setValueAt):
+        (JavaArray::valueAt):
+        * bridge/jni/jni_runtime.h:
+        * bridge/jni/jni_utility.cpp:
+        (JSC::Bindings::convertArrayInstanceToJavaArray):
+        (JSC::Bindings::convertValueToJValue):
+        * bridge/jni/jni_utility.h:
+        * bridge/objc/WebScriptObject.h:
+        * bridge/objc/objc_class.h:
+        * bridge/objc/objc_class.mm:
+        (JSC::Bindings::ObjcClass::fallbackObject):
+        * bridge/objc/objc_instance.h:
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::invokeMethod):
+        (ObjcInstance::invokeDefaultMethod):
+        (ObjcInstance::setValueOfUndefinedField):
+        (ObjcInstance::getValueOfUndefinedField):
+        (ObjcInstance::defaultValue):
+        (ObjcInstance::stringValue):
+        (ObjcInstance::numberValue):
+        (ObjcInstance::booleanValue):
+        (ObjcInstance::valueOf):
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcField::valueFromInstance):
+        (JSC::Bindings::convertValueToObjcObject):
+        (JSC::Bindings::ObjcField::setValueToInstance):
+        (JSC::Bindings::ObjcArray::setValueAt):
+        (JSC::Bindings::ObjcArray::valueAt):
+        (JSC::Bindings::ObjcFallbackObjectImp::put):
+        (JSC::Bindings::callObjCFallbackObject):
+        (JSC::Bindings::ObjcFallbackObjectImp::defaultValue):
+        * bridge/objc/objc_utility.h:
+        * bridge/objc/objc_utility.mm:
+        (JSC::Bindings::convertValueToObjcValue):
+        (JSC::Bindings::convertNSStringToString):
+        (JSC::Bindings::convertObjcValueToValue):
+        * bridge/runtime.cpp:
+        (JSC::Bindings::Instance::getValueOfField):
+        (JSC::Bindings::Instance::setValueOfField):
+        * bridge/runtime.h:
+        (JSC::Bindings::Class::fallbackObject):
+        (JSC::Bindings::Instance::getValueOfUndefinedField):
+        (JSC::Bindings::Instance::setValueOfUndefinedField):
+        (JSC::Bindings::Instance::invokeDefaultMethod):
+        (JSC::Bindings::Instance::invokeConstruct):
+        (JSC::Bindings::Instance::valueOf):
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::lengthGetter):
+        (JSC::RuntimeArray::indexGetter):
+        (JSC::RuntimeArray::put):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::lengthGetter):
+        (JSC::callRuntimeMethod):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::fallbackObjectGetter):
+        (JSC::RuntimeObjectImp::fieldGetter):
+        (JSC::RuntimeObjectImp::methodGetter):
+        (JSC::RuntimeObjectImp::put):
+        (JSC::RuntimeObjectImp::defaultValue):
+        (JSC::callRuntimeObject):
+        (JSC::callRuntimeConstructor):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+        * inspector/InspectorController.cpp:
+        * inspector/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+        * inspector/JavaScriptCallFrame.h:
+        * inspector/JavaScriptProfile.cpp:
+        (WebCore::toJS):
+        * inspector/JavaScriptProfile.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::toJS):
+        * inspector/JavaScriptProfileNode.h:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::dropProtection):
+
+2009-01-06  Pierre-Olivier Latour  <pol@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Added new API on AnimationController::numberOfActiveAnimations() to be used by DRT.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23126
+
+        Test: animations/animation-controller-drt-api.html
+
+        * WebCore.base.exp:
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::numberOfActiveAnimations):
+        (WebCore::AnimationController::numberOfActiveAnimations):
+        * page/animation/AnimationController.h:
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::numberOfActiveAnimations):
+        (WebCore::CompositeAnimation::numberOfActiveAnimations):
+        * page/animation/CompositeAnimation.h:
+
+2009-01-06  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Gavin Barraclough.
+
+        Upstream 3 more files to get the WebCore-Chromium build a bit further.
+
+        * WebCore.scons:
+        * page/chromium/AccessibilityObjectChromium.cpp: Added.
+        (WebCore::AccessibilityObject::accessibilityIgnoreAttachment):
+        * page/chromium/AccessibilityObjectWrapper.h: Added.
+        (WebCore::AccessibilityObjectWrapper::~AccessibilityObjectWrapper):
+        (WebCore::AccessibilityObjectWrapper::attached):
+        (WebCore::AccessibilityObjectWrapper::accessibilityObject):
+        (WebCore::AccessibilityObjectWrapper::AccessibilityObjectWrapper):
+        * platform/chromium/PasteboardPrivate.h: Added.
+        (WebCore::PasteboardPrivate::):
+
+2009-01-06  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Tests: animations/simultaneous-start-left.html
+               animations/simultaneous-start-transform.html
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=22870
+
+        I added calls beginAnimationUpdate() and endAnimationUpdate() calls
+        to AnimationController. These are called by Document at the start
+        and end of the recalcStyle cycle. Right now, I'm just using the
+        beginAnimationUpdate() method to reset an animation time value.
+        The first time the animation time is accessed after this reset I set
+        it to the currentTime. So all animations in that cycle get the same
+        start time.
+
+        The test cases checked in test this, but in the case of the 'left'
+        test it actually doesn't make any difference in most cases. This is
+        because values are clamped to whole pixels, so the start times would
+        have to be pretty far off for the test to fail using the old
+        currentTime() model. Still, under really heavy load, it's possible for
+        the test to fail without these changes.
+
+        The 'transform' test is another story. It animates to the full resolution
+        of a floating point number, so the test fails miserably without this
+        fix.
+
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+        (WebCore::AnimationBase::fireAnimationEventsIfNeeded):
+        (WebCore::AnimationBase::willNeedService):
+        (WebCore::AnimationBase::progress):
+        (WebCore::AnimationBase::goIntoEndingOrLoopingState):
+        (WebCore::AnimationBase::beginAnimationUpdateTime):
+        * page/animation/AnimationBase.h:
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::beginAnimationUpdateTime):
+        (WebCore::AnimationControllerPrivate::setBeginAnimationUpdateTime):
+        (WebCore::AnimationControllerPrivate::AnimationControllerPrivate):
+        (WebCore::AnimationController::updateAnimations):
+        (WebCore::AnimationController::beginAnimationUpdateTime):
+        (WebCore::AnimationController::beginAnimationUpdate):
+        (WebCore::AnimationController::endAnimationUpdate):
+        * page/animation/AnimationController.h:
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::animate):
+
+2009-01-06  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Bug 22858: Simplify make_names.pl code for avoiding multiple definitions or inclusions
+        https://bugs.webkit.org/show_bug.cgi?id=22858
+
+        I had introduced an awkward situation using hasCustomJSWrapper and
+        sometimes boolean parameter in order to ensure JS wrapper generated once
+        or header included once.
+
+        Simplified the code by using a %seenTag hash to detect multiple definitions
+        or inclusions and skipping it.
+
+        Also cleaned up a bit make_names.pl by using more explicit names and moving
+        code to where it belongs.
+
+        * dom/make_names.pl:
+        * html/HTMLTagNames.in: Necessary changes that were not detected by
+        the previous syntax but will be required for autogenerating HTMLElementFactory.
+
+2009-01-06  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add a way for frame loader clients to always create a PluginDocument, regardless of
+        the real document MIME type.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        (WebCore::FrameLoader::shouldUsePlugin):
+        * loader/FrameLoaderClient.h:
+        (WebCore::FrameLoaderClient::shouldUsePluginDocument):
+
+2009-01-06  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Extend Media Queries to cover transitions,
+        animations, transform-2d and transform-3d
+        http://webkit.org/specs/MediaQueriesExtensions.html
+        Note that the implementation uses -webkit- prefixes
+        even though the spec doesn't have them.
+        https://bugs.webkit.org/show_bug.cgi?id=22494
+
+        Tests: fast/media/mq-animation.html
+               fast/media/mq-transform-01.html
+               fast/media/mq-transform-02.html
+               fast/media/mq-transform-03.html
+               fast/media/mq-transform-04.html
+               fast/media/mq-transition.html
+
+        * css/MediaFeatureNames.h:
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::animationMediaFeatureEval):
+        (WebCore::transitionMediaFeatureEval):
+        (WebCore::transform_2dMediaFeatureEval):
+        (WebCore::transform_3dMediaFeatureEval):
+
+2009-01-06  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Bring the Chromium-WebCore build closer to building
+        by upstreaming PlatformWidget.h add adding the JSC
+        plugin bridge files to the build.
+
+        * WebCore.scons:
+        * platform/chromium/PlatformWidget.h: Added.
+
+2009-01-06  Eric Seidel  <eric@webkit.org>
+
+        Build fix only, no review.
+
+        Bring the Chromium-WebCore build back closer to building
+        by adding files from recent commits.
+
+        * WebCore.scons:
+
+2009-01-06  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6474973> REGRESSION: PLT ~2% slower due to 39465 (consolidate thread data)
+
+        I could not reproduce the slowdown on my PowerPC test machine, but the change should bring
+        performance back.
+
+        * platform/ThreadGlobalData.cpp: (WebCore::threadGlobalData): Don't use AtomicallyInitializedStatic.
+        Prior to r39465, it was only used for cached converters, which was necessary because the
+        first access to ICU or TEC one could happen on a secondary thread, but now they are all
+        initialized from ThreadGlobalData constructor.
+
+2009-01-06  David Smith  <catfish.man@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23129
+        Devirtualize Node::childNodes().
+
+2009-01-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed build fix.
+
+        Fix the Qt build with Qt 4.4.x, the HTTP-only cookie support was
+        added in Qt 4.5.
+
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::setCookies):
+        (WebCore::cookies):
+
+2009-01-06  Zalan Bujtas  <zbujtas@gmail.com>
+
+        Reviewed by David Kilzer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23133
+        Fix SVG disabled build. Move 'pointer-events' from SVGCSSPropertyNames.in to
+        CSSPropertyNames.in and move PointerEvents functions out of #if ENABLE(SVG)
+
+        NOTE: Property name fixes landed as part of r39648.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EPointerEvents):
+        * css/CSSPropertyNames.in:
+        * css/SVGCSSPropertyNames.in:
+
+2009-01-06  David Kilzer  <ddkilzer@apple.com>
+
+        BUILD FIX (r39634): Fix build for non-SVG builds (Wx)
+
+        * css/CSSPropertyNames.in: Added 'pointer-events'.
+        * css/SVGCSSPropertyNames.in: Commented out pointer-events
+        since it's now a plain CSS property.
+
+2009-01-06  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Lars Knoll.
+
+        Added support for HTTP-only cookies to the Qt build.
+
+        * platform/qt/CookieJarQt.cpp:
+        (WebCore::setCookies): Don't set HTTP-only cookies through the DOM.
+        (WebCore::cookies): Don't return HTTP-only cookies to the DOM.
+
+2009-01-05  David Smith  <catfish.man@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23084
+        Avoid redundant AtomicString conversions
+
+        * dom/Node.cpp: Create an AtomicString early to avoid converting twice
+        (WebCore::Node::getElementsByTagNameNS):
+        * dom/QualifiedName.h: Use the appropriate AtomicString constructor instead of converting from a String
+
+2009-01-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=22985
+
+        Add an assertion that clip rects are being used when painting with the same
+        rootLayer that they were computed with.
+
+        Fix two issues detected by the assertion:
+
+        RenderLayer::updateClipRects() should not unconditionally update the clip rects
+        on its parent, but stop when reaching rootLayer (just like calculateClipRects()).
+
+        We need to pass the temporaryClipRects flag down through reflection painting
+        to handle the case of nested reflections.
+
+        Also use temporary clip rects in RenderTreeAsText, since that code does not
+        reset the painting root for transformed layers, so cached clip rects will not
+        match those used for painting.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::updateClipRects):
+        (WebCore::RenderLayer::clearClipRects):
+        * rendering/RenderLayer.h:
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeLayers):
+
+2009-01-05  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build
+
+        * platform/graphics/qt/AffineTransformQt.cpp:
+        (WebCore::TransformationMatrix::TransformationMatrix):
+
+2009-01-05  Mark Rowe  <mrowe@apple.com>
+
+        Fix the build some more.
+
+        * platform/graphics/cairo/AffineTransformCairo.cpp:
+        (WebCore::TransformationMatrix::TransformationMatrix):
+
+2009-01-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix Cairo/Gtk build
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::putImageData):
+
+2009-01-05  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Rename AffineTransform to TransformationMatrix in
+        preparation for future enhancements (non-affine matrices)
+
+        https://bugs.webkit.org/show_bug.cgi?id=22943
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * platform/graphics/transforms/AffineTransform.cpp: Removed.
+        * platform/graphics/transforms/AffineTransform.h: Removed.
+        * platform/graphics/transforms/TransformationMatrix.cpp: Copied from WebCore/platform/graphics/transforms/AffineTransform.cpp.
+        * platform/graphics/transforms/TransformationMatrix.h: Copied from WebCore/platform/graphics/transforms/AffineTransform.h.
+        * lots of other files with s/AffineTransform/TransformationMatrix/g
+
+2008-01-05  Dean Jackson  <dino@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Implement 'pointer-events' for HTML content. This involved
+        adding a new value 'auto' which behaves as 'visiblePainted'
+        in SVG content.
+
+        Moved the property out of the SVG CSS code and into
+        the general CSS (both parsing and RenderStyle).
+
+        Changes to the hit testing functionality of the Render tree,
+        specifically the nodeAtPoint methods. Where they used to
+        test for visibility, they now use a helper function defined
+        on base classes (RenderObject and InlineBox) that checks both
+        visibility and pointer-events.
+
+        https://bugs.webkit.org/show_bug.cgi?id=11395
+
+        Tests: fast/events/pointer-events-2.html
+               fast/events/pointer-events.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator EPointerEvents):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/SVGCSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getSVGPropertyCSSValue):
+        * css/SVGCSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applySVGProperty):
+        * manual-tests/pointer-events.html: Added.
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::nodeAtPoint):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::visibleToHitTesting):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::nodeAtPoint):
+        * rendering/PointerEventsHitRules.cpp:
+        (WebCore::PointerEventsHitRules::PointerEventsHitRules):
+        * rendering/PointerEventsHitRules.h:
+        (WebCore::PointerEventsHitRules::):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::nodeAtPoint):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::nodeAtPoint):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::visibleToHitTesting):
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::nodeAtPoint):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::nodeAtPoint):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::nodeAtPoint):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::nodeAtPoint):
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::SearchFieldCancelButtonElement::defaultEventHandler):
+        * rendering/style/RenderStyle.h:
+        (WebCore::):
+        (WebCore::InheritedFlags::setBitDefaults):
+        (WebCore::InheritedFlags::pointerEvents):
+        (WebCore::InheritedFlags::setPointerEvents):
+        (WebCore::InheritedFlags::initialPointerEvents):
+        * rendering/style/RenderStyleConstants.h:
+        (WebCore::):
+        * rendering/style/SVGRenderStyle.h:
+        (WebCore::SVGRenderStyle::InheritedFlags::operator==):
+        (WebCore::SVGRenderStyle::setBitDefaults):
+        * rendering/style/SVGRenderStyleDefs.h:
+        * css/CSSValueKeywords.in:
+        * css/SVGCSSValueKeywords.in:
+
+2009-01-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Fix Cairo/Gtk build
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::getImageData):
+
+2009-01-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        CanvasPixelArray performance is too slow
+        <https://bugs.webkit.org/show_bug.cgi?id=23123>
+
+        Remove the WebCore CanvasPixelArray implementation and replace
+        CPA usage with JSC::ByteArray.  Replace the JSCanvasPixelArray
+        wrapper with an explicitly instantiated JSByteArray put on the
+        JSImageData object as an ordinary ReadOnly, DontDelete property.
+
+        * DerivedSources.make:
+        * ForwardingHeaders/runtime/ByteArray.h: Added.
+        * ForwardingHeaders/runtime/JSByteArray.h: Added.
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasPixelArrayCustom.h: Removed.
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * html/CanvasPixelArray.cpp: Removed.
+        * html/CanvasPixelArray.h: Removed.
+        * html/CanvasPixelArray.idl: Removed.
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::createEmptyImageData):
+        * html/ImageData.cpp:
+        (WebCore::ImageData::ImageData):
+        * html/ImageData.h:
+        (WebCore::ImageData::data):
+        * html/ImageData.idl:
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::getImageData):
+        (WebCore::ImageBuffer::putImageData):
+
+2009-01-05  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Add notification for contentsSizeChanged which the Qt API will
+        introduce.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::contentsSizeChanged):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::contentsSizeChanged):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setContentsSize):
+        * page/FrameView.h:
+        * platform/HostWindow.h:
+        * platform/ScrollView.h:
+
+2009-01-05  Anders Carlsson  <andersca@apple.com>
+
+        Build fix.
+
+        * plugins/PluginView.h:
+        (WebCore::PluginManualLoader::~PluginManualLoader):
+
+2009-01-05  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        Add an abstract PluginManualLoader class and make PluginView inherit from it.
+
+        Add some error checking that currently exists in WebKit (but not for long!)
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::didReceiveResponse):
+        (WebCore::PluginView::didReceiveData):
+        (WebCore::PluginView::didFinishLoading):
+        (WebCore::PluginView::didFail):
+        * plugins/PluginView.h:
+
+2009-01-05  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes FrameView to respect the state of scrollbarmode when it is explicitly
+        set programatically via a webkit API.
+
+        * loader/FrameLoaderClient.cpp:
+        (WebCore::FrameLoaderClient::transitionToCommittedForNewPage):
+        * loader/FrameLoaderClient.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::initScrollbars):
+        (WebCore::FrameView::updateDefaultScrollbarState):
+        * page/FrameView.h:
+
+2009-01-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 23109: REGRESSION: Backwards search in a long document matches incorrectly
+        https://bugs.webkit.org/show_bug.cgi?id=23109
+
+        Test: fast/text/find-backwards.html
+
+        * editing/TextIterator.cpp:
+        (WebCore::SearchBuffer::append): Fix incorrect size passed to memcpy.
+        (WebCore::SearchBuffer::search): Handle case where we have an empty buffer but
+        we're at a break; must not try to search because ICU will give us an error.
+        Fix incorrect size passed to memcpy and memmove.
+        (WebCore::findPlainText): Fix case where we found a match and need to search
+        again because we want to find the last match. We need to try again without
+        adding any more text or handling the break before moving on.
+
+2009-01-05  Adam Treat  <adam.treat@torchmobile.com>
+
+        Fix the Qt build
+
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::put):
+
+2009-01-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Fix platforms that don't have Workers enabled.
+
+        * platform/ThreadGlobalData.cpp: (WebCore::threadGlobalData): Create ThreadGlobalData in
+        two stages, so that EventNames constructor can access the just-created atomic string table.
+        This matches what happens in ThreadSpecific case.
+
+2009-01-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Suggested by Dave Levin.
+
+        Mac release build fix.
+
+        * WebCore.base.exp: Remove ThreadGlobalData::eventNames(), which is now inline.
+
+2009-01-05  Darin Adler  <darin@apple.com>
+
+        * dom/Document.cpp: Fix build. Oops again.
+
+2009-01-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Fix hang whenever following an anchor.
+
+        * dom/Document.cpp:
+        (WebCore::Document::findAnchor): Oops!
+
+2009-01-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23073
+        <rdar://problem/6471129> Workers crash on Windows Release builds
+
+        * platform/ThreadGlobalData.cpp: (WebCore::ThreadGlobalData::ThreadGlobalData):
+        * platform/ThreadGlobalData.h: (WebCore::ThreadGlobalData::eventNames):
+        Now that ThreadSpecific sets up the pointer before invoking data constructor, we can
+        initialize EventNames right away.
+
+2009-01-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Bug 23106: HTMLFormCollection::namedItem ignores caseSensitive argument
+        https://bugs.webkit.org/show_bug.cgi?id=23106
+
+        This led me to a bunch of dead code. It turns out that HTML collections
+        were carrying the case-insensitive code just so they could be used to
+        find anchors, something we can do more simply and efficiently without
+        creating a DOM HTMLCollection object.
+
+        No behavior change. Just adding a new function findAnchor function and
+        removing some dead code.
+
+        * dom/Document.cpp:
+        (WebCore::Document::findAnchor): Added.
+        * dom/Document.h: Ditto.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::accessKey): Take and return AtomicString
+        references for better efficiency.
+        (WebCore::HTMLAnchorElement::setAccessKey): Ditto.
+        (WebCore::HTMLAnchorElement::charset): Ditto.
+        (WebCore::HTMLAnchorElement::setCharset): Ditto.
+        (WebCore::HTMLAnchorElement::coords): Ditto.
+        (WebCore::HTMLAnchorElement::setCoords): Ditto.
+        (WebCore::HTMLAnchorElement::setHref): Ditto.
+        (WebCore::HTMLAnchorElement::hreflang): Ditto.
+        (WebCore::HTMLAnchorElement::setHreflang): Ditto.
+        (WebCore::HTMLAnchorElement::name): Ditto.
+        (WebCore::HTMLAnchorElement::setName): Ditto.
+        (WebCore::HTMLAnchorElement::rel): Ditto.
+        (WebCore::HTMLAnchorElement::setRel): Ditto.
+        (WebCore::HTMLAnchorElement::rev): Ditto.
+        (WebCore::HTMLAnchorElement::setRev): Ditto.
+        (WebCore::HTMLAnchorElement::shape): Ditto.
+        (WebCore::HTMLAnchorElement::setShape): Ditto.
+        (WebCore::HTMLAnchorElement::setTarget): Ditto.
+        (WebCore::HTMLAnchorElement::type): Ditto.
+        (WebCore::HTMLAnchorElement::setType): Ditto.
+        * html/HTMLAnchorElement.h: Ditto.
+
+        * html/HTMLCollection.cpp:
+        (WebCore::HTMLCollection::checkForNameMatch): Changed argument to an
+        AtomicString and removed the caseSensitive boolean, since we're now always
+        case sensitive.
+        (WebCore::HTMLCollection::namedItem): Ditto.
+        (WebCore::HTMLCollection::nextNamedItem): Ditto.
+        * html/HTMLCollection.h: Ditto.
+        * html/HTMLFormCollection.cpp:
+        (WebCore::HTMLFormCollection::getNamedItem): Ditto.
+        (WebCore::HTMLFormCollection::getNamedFormItem): Ditto.
+        (WebCore::HTMLFormCollection::nextNamedItemInternal): Ditto.
+        (WebCore::HTMLFormCollection::namedItem): Ditto.
+        (WebCore::HTMLFormCollection::nextNamedItem): Ditto.
+        * html/HTMLFormCollection.h: Ditto.
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::namedItem): Ditto.
+        * html/HTMLSelectElement.h: Ditto.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::gotoAnchor): Use the new findAnchor function.
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::internalLinkElement): Ditto.
+
+2009-01-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Bug 23104: minor mistakes in init functions for animation and transition events
+        https://bugs.webkit.org/show_bug.cgi?id=23104
+
+        Test: fast/events/init-events.html
+
+        Also fixed two StorageEvent problems the test case uncovered:
+
+            Made document.createEvent("StorageEvent") work.
+            Allow null values for StorageEvent.oldValue and StorageEvent.newValue.
+
+        * dom/Document.cpp:
+        (WebCore::Document::createEvent): Sorted alphabetically by the name of the event
+        class. Added StorageEvent.
+
+        * dom/UIEvent.idl: Fixed typo in a comment.
+
+        * dom/WebKitAnimationEvent.cpp:
+        (WebCore::WebKitAnimationEvent::initWebKitAnimationEvent): Use all the arguments.
+        * dom/WebKitTransitionEvent.cpp:
+        (WebCore::WebKitTransitionEvent::initWebKitTransitionEvent): Ditto.
+
+        * storage/StorageEvent.idl: Use the ConvertNullToNullString keyword on the
+        arguments to initStorageEvent so it can create events with null values for the
+        oldValue and newValue, just like the real storage events. Note that the properties
+        already had ConvertNullStringTo=Null, so this is just the other half of that.
+
+2009-01-05  Darin Adler  <darin@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 23102: turn on unused parameter warnings in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=23102
+
+        First step: Fix the simple cases where we can just remove an argument name.
+        Also made a few more things protected and private.
+
+        * many files
+
+2009-01-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23115
+        Create a version of ASSERT for use with otherwise unused variables
+
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::verifySchemaVersion): Use the new ASSERT_UNUSED macro.
+
+2009-01-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Non-Mac build fix.
+
+        * loader/appcache/ApplicationCacheStorage.cpp: Include wtf/StringExtras.h for snprintf.
+
+2009-01-05  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Remove unnecessary methods from EmptyFrameLoaderClient
+
+        * loader/EmptyClients.h:
+
+2009-01-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23077
+        Make application cache use SQLite built-in user_version
+
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::verifySchemaVersion): Changed to track versions with
+        PRAGMA user_version.
+
+        * loader/appcache/ApplicationCacheResource.h: (WebCore::ApplicationCacheResource::):
+        Used the occasion to get rid of the hole in bitmask that was a leftover from opportunistic
+        cache entries.
+
+2009-01-04  David Smith  <catfish.man@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23084
+        Avoid redundant AtomicString conversions
+
+        * dom/Node.cpp:
+        (WebCore::Node::getElementsByTagName): Pass starAtom instead of "*"
+        (WebCore::Node::getElementsByTagNameNS): Take an AtomicString for the namespace URI
+        (WebCore::Node::isDefaultNamespace): Ditto
+        (WebCore::Node::lookupPrefix): Ditto
+        (WebCore::Node::lookupNamespacePrefix): Ditto
+        * dom/Node.h: Ditto
+
+2009-01-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 23105: canvas setFillColor function ignores alpha argument
+        https://bugs.webkit.org/show_bug.cgi?id=23105
+
+        Test: fast/canvas/set-colors.html
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setFillColor): Pass alpha value through instead
+        of ignoring it and always passing 1.
+
+        * html/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyStrokeColor): Fix spelling of transparent in comments.
+        (WebCore::CanvasStyle::applyFillColor): Ditto.
+
+2009-01-04  Darin Adler  <darin@apple.com>
+
+        Bug 23086: REGRESSION(r39540/r39541): Windows build fails due to ICU errors
+        https://bugs.webkit.org/show_bug.cgi?id=23086
+
+        * editing/TextIterator.cpp: Check UCONFIG_NO_COLLATION and don't compile
+        in the new search path if it's 0.
+
+2009-01-04  David Kilzer  <ddkilzer@apple.com>
+
+        Don't install *.idl and *.in files as resources
+
+        Reviewed by Oliver Hunt.
+
+        Don't install these files as resources in the WebCore framework:
+        - WMLAttributeNames.in
+        - WMLTagNames.in
+        - WorkerContext.idl
+        - WorkerLocation.idl
+        - WorkerNavigator.idl
+
+        * WebCore.xcodeproj/project.pbxproj: Removed resources.
+
+2009-01-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=23090
+
+        If an object gets a Layout hint, and the style change will result in
+        the creation of a RenderLayer, then we need to repaint the old position
+        of the object. This was done for transform, but we have to test opacity too.
+
+        Test: fast/repaint/create-layer-repaint.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+
+2009-01-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 23103: Safari's auto-fill no longer works for <select> elements
+        https://bugs.webkit.org/show_bug.cgi?id=23103
+        rdar://problem/6472061
+
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLSelectElement _activateItemAtIndex:]): Implemented this.
+
+2009-01-04  Adam Treat  <adam.treat@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Add fixedLayoutSize feature to ScrollView to allow for controlling the
+        layout beyond the constraint of the current viewports dynamic size
+
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::heightMediaFeatureEval):
+        (WebCore::widthMediaFeatureEval):
+        * dom/Element.cpp:
+        (WebCore::Element::clientWidth):
+        (WebCore::Element::clientHeight):
+        * loader/FrameLoaderClient.cpp:
+        (WebCore::FrameLoaderClient::transitionToCommittedForNewPage):
+        * loader/FrameLoaderClient.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::layoutWidth):
+        (WebCore::ScrollView::layoutHeight):
+        (WebCore::ScrollView::fixedLayoutSize):
+        (WebCore::ScrollView::setFixedLayoutSize):
+        (WebCore::ScrollView::useFixedLayout):
+        (WebCore::ScrollView::setUseFixedLayout):
+        * platform/ScrollView.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::viewHeight):
+        (WebCore::RenderView::viewWidth):
+        * rendering/RenderView.h:
+
+2009-01-03  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Darin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22660
+        SVG elements that are moved are nor fully invalidated/earsed
+
+        Mark the SVG root as needing a layout when its position changes.
+
+        Tests: svg/custom/circle-move-invalidation.svg
+
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::position):
+        * rendering/RenderSVGRoot.h:
+
+2009-01-03  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+        * loader/FrameLoader.h:
+
+2009-01-02  Cary Clark  <caryclark@google.com>
+
+        Reviewed and landed by Darin Adler.
+
+        Bug 22963: write icons before reading them
+        https://bugs.webkit.org/show_bug.cgi?id=22963
+
+        Reverse the order in the icon database main thread loop to
+        write the pending icons to the database before trying
+        to read any requested icons. This ensures that a requested icon
+        has the correct data when read.
+
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::syncThreadMainLoop):
+
+2009-01-02  Darin Adler  <darin@apple.com>
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem): One small thing I forgot in my last check-in.
+        This cuts down on the number of hash table operations during loading.
+
+2009-01-02  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed and landed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23025
+        DOMTimer lifetime cleanup: timeoutMap methods on Document now do not delete the timer.
+        Instead, all 3 places that delete timers do it directly calling 'delete' and then timer's dtor removes the ID from the timeoutMap.
+        Note that in case the context is destroyed and timers are deleted at once, the check in ~DOMTimer() prevents
+        unnecessary HashMap remove in case the Document is being destroyed.
+
+        * bindings/js/DOMTimer.cpp:
+        (WebCore::DOMTimer::~DOMTimer): removes the id from the timeoutMap.
+        (WebCore::DOMTimer::install):
+        (WebCore::DOMTimer::removeById): simply uses 'delete this'.
+        (WebCore::DOMTimer::fired): same.
+        (WebCore::DOMTimer::contextDestroyed): same.
+        * dom/Document.cpp:
+        (WebCore::Document::removeTimeout): now it only removes the id from the map, does not delete the timer.
+
+2009-01-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23072: REGRESSION (r37371): In the Dictionary application, scroll bar appears
+        inside its web view when resizing its window
+        https://bugs.webkit.org/show_bug.cgi?id=23072
+        rdar://problem/6368028
+
+        The first attempt at fixing this did not work.
+        This time I was able to reproduce the bug and test the fix.
+
+        Bug 11212: REGRESSION: Activity window doesn't always list all files until refresh
+        https://bugs.webkit.org/show_bug.cgi?id=11212
+        rdar://problem/4959702
+
+        I had to fix this second bug because otherwise the WebKit code to trigger the first
+        fix didn't run.
+
+        Also fixes memory use that kept growing as we maintained a set of all URLs loaded in
+        a particular frame. Bad idea! It's bad enough that we do it for each document, but
+        the old version kept the set around forever as you moved from one document to the next.
+
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute): Change this so that we allow
+        turning off scrolling when the quirk is enabled. We just don't allow turning it on.
+        This fixes one of the two problems with the initial patch; the other fix is in WebKit.
+
+        * loader/DocumentLoader.h: Moved didTellClientAboutLoad and haveToldClientAboutLoad
+        here from FrameLoader. The old way meant that a given frame would forever remember
+        the URL of any resources loaded in that frame and never send any "loaded from cache"
+        client calls about those URLs.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadResourceSynchronously): Removed call to didTellCientAboutLoad.
+        This is now handled by dispatchWillSendRequest, which is safer since that's the actual
+        function that tells the client about the load.
+        (WebCore::FrameLoader::loadedResourceFromMemoryCache): Changed calls to
+        haveToldClientAboutLoad and didTellClientAboutLoad to call the document loader.
+        Also removed the call in the case where we don't load from the cache, since
+        dispatchWillSendRequest now takes care of it.
+        (WebCore::FrameLoader::dispatchWillSendRequest): Put calls to didTellClientAboutLoad
+        here. Call it both on the URL we pass in and the URL the client returns; we won't
+        tell the client about either if it's loaded from the memory cache.
+
+        * loader/FrameLoader.h: Removed didTellClientAboutLoad, haveToldClientAboutLoad, and
+        m_urlsClientKnowsAbout.
+
+        * loader/SubresourceLoader.cpp: Removed unneeded load function that called
+        didTellClientAboutLoad. That's now taken care of in dispatchWillSendRequest.
+
+        * loader/SubresourceLoader.h: Removed load function. Also made all members private
+        except for create and clearClient.
+
+2009-01-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=23082
+
+        Fix GIF animation by ensuring that the signature of
+        startAnimation() in the base class matches the method in BitmapImage.
+
+        Test: fast/backgrounds/animated-gif-as-background.html
+
+        * platform/graphics/Image.h:
+        (WebCore::Image::startAnimation):
+
+2009-01-02  David Smith  <catfish.man@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22699
+        Enable NodeList caching for getElementsByTagName
+
+        test: fast/dom/getelementsbytagnamens-mixed-namespaces.html
+
+        * dom/Document.cpp:
+        (WebCore::FormElementKeyHash::hash): Use WTF::stringHashingStartValue
+        * dom/Node.cpp:
+        (WebCore::Node::getElementsByTagNameNS): Ensure rare data and add a node list cache
+        (WebCore::NodeListsNodeData::invalidateCaches): Invalidate the tag name node list cache as well as the others
+        (WebCore::NodeListsNodeData::isEmpty): Check the tag name node list cache as well as the others
+        * dom/NodeRareData.h: Add m_tagNodeListCaches
+        * dom/QualifiedName.cpp:
+        * dom/QualifiedName.h: Move QNameHash to the header, make it work on QualifiedNames, and rename to QualifiedNameHash
+        * dom/StyledElement.cpp:
+        (WebCore::MappedAttributeHash::hash): Use WTF::stringHashingStartValue
+        * dom/TagNodeList.cpp:
+        (WebCore::TagNodeList::TagNodeList): Add a NodeList cache argument
+        * dom/TagNodeList.h:
+        (WebCore::TagNodeList::create): Add a NodeList cache argument
+        * platform/text/StringHash.h:
+        (WebCore::CaseFoldingHash::hash): Use WTF::stringHashingStartValue
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::TextEncodingNameHash::hash): Use WTF::stringHashingStartValue
+
+2009-01-02  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=23066 & <rdar://problem/6028417>
+        Full Page Zoom: a <video> element that doesn't include width/height attribute does not scale
+
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::calcReplacedWidth): Multiply aspect ratio width by style()->effectiveZoom()
+        (WebCore::RenderVideo::calcReplacedHeight): Multiply aspect ratio height by style()->effectiveZoom()
+
+2009-01-02  David Kilzer  <ddkilzer@apple.com>
+
+        BUILD FIX (r39552): Add mediaControls.css to other build files
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2009-01-02  David Kilzer  <ddkilzer@apple.com>
+
+        Try to fix Wx build after r39427
+
+        * platform/graphics/wx/PathWx.cpp:
+        (WebCore::Path::strokeBoundingRect): Added stub.
+
+2009-01-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/6471356> Failed assertion on quit
+
+        * platform/ThreadGlobalData.cpp: (WebCore::ThreadGlobalData::~ThreadGlobalData):
+        Only assert that empty string are all removed on secondary threads.
+
+2009-01-02  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 23081: These files are no longer part of the KDE libraries
+
+        <https://bugs.webkit.org/show_bug.cgi?id=23081>
+
+        Reviewed by Darin Adler.
+
+        Removed "This file is part of the KDE libraries" comment from
+        source files.  Added or updated Apple copyrights as well.
+
+        No tests since there are only changes to comments.
+
+        * bridge/testbindings.cpp:
+        * html/HTMLEntityNames.gperf:
+        * loader/Cache.h:
+        * loader/CachedCSSStyleSheet.h:
+        * loader/CachedResourceClient.h:
+        * loader/CachedResourceClientWalker.cpp:
+        * loader/CachedResourceClientWalker.h:
+        * loader/CachedScript.cpp:
+        * loader/CachedScript.h:
+        * loader/CachedXBLDocument.cpp:
+        * loader/CachedXBLDocument.h:
+        * loader/CachedXSLStyleSheet.cpp:
+        * loader/CachedXSLStyleSheet.h:
+        * rendering/GapRects.h:
+        * xml/XMLSerializer.cpp:
+
+2009-01-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        Use an OwnPtr for m_chromeClient.
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::~SVGImage):
+        (WebCore::SVGImage::dataChanged):
+        * svg/graphics/SVGImage.h:
+
+2009-01-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=22981
+
+        Repaints inside of an SVGImage were thrown on the floor,
+        which broke incremental painting due to loading, or SVG animation.
+        Fix this by assigning the SVGImage a ChromeClient subclass that passes
+        along repaints via a new method on ImageObserver, which also takes
+        a rect parameter for the changed rect, allowing incremental repaints.
+        Fix RenderImage::imageChanged to take advantage of this changedRect to
+        only repaint the changed parts of the image.
+
+        This also enables incremental painting for canvas-as-image, so
+        add tests for that too.
+
+        Tests: fast/backgrounds/animated-svg-as-background.html
+               fast/backgrounds/animated-svg-as-mask.html
+               fast/canvas/canvas-as-image-incremental-repaint.html
+               fast/canvas/canvas-as-image.html
+               fast/images/animated-svg-as-image.html
+
+        * css/CSSCanvasValue.cpp:
+        (WebCore::CSSCanvasValue::canvasChanged):
+        * loader/CachedImage.cpp:
+        (WebCore::CachedImage::notifyObservers):
+        (WebCore::CachedImage::data):
+        (WebCore::CachedImage::changedInRect):
+        * loader/CachedImage.h:
+        * loader/CachedResourceClient.h:
+        (WebCore::CachedResourceClient::imageChanged):
+        * platform/graphics/ImageObserver.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::imageChanged):
+        * rendering/RenderBox.h:
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::imageChanged):
+        * rendering/RenderImage.h:
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::imageChanged):
+        * rendering/RenderListMarker.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::imageChanged):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::imageChanged):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::imageChanged):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::imageChanged):
+        * rendering/RenderScrollbarPart.h:
+        * rendering/RenderTableCol.cpp:
+        (WebCore::RenderTableCol::imageChanged):
+        * rendering/RenderTableCol.h:
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::imageChanged):
+        * rendering/RenderTableRow.h:
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::imageChanged):
+        * rendering/RenderTableSection.h:
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImageChromeClient::SVGImageChromeClient):
+        (WebCore::SVGImageChromeClient::image):
+        (WebCore::SVGImageChromeClient::chromeDestroyed):
+        (WebCore::SVGImageChromeClient::repaint):
+        (WebCore::SVGImage::SVGImage):
+        (WebCore::SVGImage::~SVGImage):
+        (WebCore::SVGImage::dataChanged):
+        * svg/graphics/SVGImage.h:
+
+2009-01-02  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=23043
+
+        Pull media controls css out of html4.css into separate file. Don't generate
+        wml, svg, or media css globals unless the feature is enabled.
+
+        * DerivedSources.make:
+            Don't include css for unused features.
+
+        * WebCore.xcodeproj/project.pbxproj:
+            include mediaControls.css
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::styleForElement):
+            don't parse or add media css unless VIDEO feature is enabled and the target
+            element is video or audio
+
+        * css/html4.css:
+            moved media controls css to mediaControls.css
+
+        * css/mediaControls.css: Added.
+
+2009-01-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23022
+        Fix multiple issues with appcache online whitelist handling
+
+        Test: http/tests/appcache/online-whitelist.html
+
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::isURLInOnlineWhitelist): Test whitelist entries as prefixes,
+        making it possible to use them for CGI invocation (as required by HTML5).
+
+        * loader/DocumentLoader.cpp: (WebCore::DocumentLoader::shouldLoadResourceFromApplicationCache):
+        Re-ordered checks, so that resources that are cached, but are also listed in online whitelist
+        are loaded from the cache. This is required by HTML5, although Firefox doesn't match.
+
+        * loader/appcache/ManifestParser.cpp:
+        (WebCore::parseManifest):
+        * loader/appcache/ManifestParser.h:
+        * loader/appcache/ApplicationCache.h:
+        (WebCore::ApplicationCache::onlineWhitelist):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::store):
+        (WebCore::ApplicationCacheStorage::loadCache):
+        Changed online whitelist to be a vector of URLs, which is better suited for the new algorithm.
+
+2009-01-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 23072: REGRESSION (r37371): In the Dictionary application, scroll bar appears inside its web view when resizing its window
+        https://bugs.webkit.org/show_bug.cgi?id=23072
+        rdar://problem/6368028
+
+        * WebCore.base.exp: Updated.
+        * WebCore.xcodeproj/project.pbxproj: Mark HTMLHeadElement.h Private so it can be used in WebKit.
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document): Initialize m_frameElementsShouldIgnoreScrolling to false.
+        * dom/Document.h: Added setFrameElementsShouldIgnoreScrolling, frameElementsShouldIgnoreScrolling,
+        and m_frameElementsShouldIgnoreScrolling.
+
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute): Don't allow changes to the scrolling attribute
+        to affect the scrolling mode if frameElementsShouldIgnoreScrolling() returns true. This is only
+        triggered on Mac OS X when running the Dictionary application.
+
+2009-01-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23036
+        <rdar://problem/6451666> Implement AppCache fallback entries (23036)
+
+        Test: http/tests/appcache/fallback.html
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::loadResourceSynchronously): Use fallback
+        entries if normal loading fails.
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::shouldLoadResourceFromApplicationCache): Do not prevent normal
+        loading for resources that match fallback namespaces - they are only loaded from the cache
+        if that fails.
+        (WebCore::DocumentLoader::getApplicationCacheFallbackResource): Get a fallback entry for
+        resource from associated appcache, or from passed in one, if any.
+        (WebCore::DocumentLoader::scheduleLoadFallbackResourceFromApplicationCache): If a fallback
+        entry for resourse exists, add it to pending substitute loads.
+
+        * loader/DocumentLoader.h: Added new functions for loading fallback data for resources.
+
+        * loader/ResourceLoader.h:
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::scheduleLoadFallbackResourceFromApplicationCache): This function
+        is called when normal loading fails (which includes network failures, 4xx and 5xx responses,
+        and cross-origin redirects) to load appcache fallback data instead. It can use either the
+        cache that is associated with the browsing context, or a custom one if association is yet
+        to take place.
+        (WebCore::ResourceLoader::willSendRequest): Try using fallback data.
+        (WebCore::ResourceLoader::didReceiveResponse): Ditto.
+        (WebCore::ResourceLoader::didFail): Ditto.
+
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didReceiveResponse): Locate an appropriate cache and load
+        fallback data from it if loading fails. The browsing context may still be associated with
+        its previous document here, so the cache to load from must be passed explicitly.
+        (WebCore::MainResourceLoader::didFail): Ditto.
+        (WebCore::MainResourceLoader::load): Remove unnecessary check and FIXME.
+
+        * loader/appcache/ApplicationCache.cpp:
+        (WebCore::ApplicationCache::setFallbackURLs):
+        (WebCore::ApplicationCache::urlMatchesFallbackNamespace):
+        * loader/appcache/ApplicationCache.h:
+        (WebCore::ApplicationCache::fallbackURLs):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::cacheGroupForURL):
+        (WebCore::ApplicationCacheStorage::fallbackCacheGroupForURL):
+        (WebCore::ApplicationCacheStorage::store):
+        (WebCore::ApplicationCacheStorage::loadCache):
+        (WebCore::ApplicationCacheStorage::storeCopyOfCache):
+        * loader/appcache/ApplicationCacheStorage.h:
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::fallbackCacheForMainRequest):
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        * loader/appcache/ApplicationCacheGroup.h:
+        Implement fallback map saving and loading, pass it to the cache.
+
+        * loader/appcache/ManifestParser.h: Use a correct data structure for fallback map - keys
+        are matched by prefix, so HAshMap cannot be used.
+
+        * loader/appcache/ManifestParser.cpp: (WebCore::parseManifest): Fix bugs in fallback section
+        parsing.
+
+2009-01-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6450530> WebCore::FontPlatformData should not leak
+
+        Whoops, previous patch should also have fixed the font referencing in
+        the constructor.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/mac/FontPlatformDataMac.mm:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2009-01-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/6450530> WebCore::FontPlatformData should not leak
+
+        Make sure we only adopt the new font, rather than re-referencing (and so leaking).
+
+        * platform/graphics/mac/FontPlatformDataMac.mm:
+        (WebCore::FontPlatformData::setFont):
+
+2009-01-01  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 23071: REGRESSION (r39536): New test failures after committing patch in bug 23051 (ICU search)
+        https://bugs.webkit.org/show_bug.cgi?id=23071
+
+        Also fix some things that Dan suggested during review of the ICU search patch that I forgot
+        the first time around.
+
+        * editing/TextIterator.cpp: Use ICU search on all platforms that use ICU, now that
+        we've double checked it works everywhere, removing HAVE_ICU_SEARCH entirely.
+        Removed unused m_atBreak data member from the non-ICU code path.
+        (WebCore::TextIterator::TextIterator): Move null check up.
+        (WebCore::TextIterator::handleTextBox): Fix mistake that made the iterator include
+        collapsed whitespace. This was left over from an earlier version of the patch.
+        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator):
+        Move null check up.
+
+2009-01-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler, Oliver Hunt
+
+        https://bugs.webkit.org/show_bug.cgi?id=23065
+
+        Enable incremental painting of canvas. This turns incremental painting
+        back on, and fixes issues with stroke width and miters, calling willDraw()
+        for strokeText and fillText, and taking shadows into account.
+
+        Test: fast/canvas/canvas-incremental-repaint.html
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasStrokeStyleApplier::CanvasStrokeStyleApplier):
+        (WebCore::CanvasStrokeStyleApplier::strokeStyle):
+        (WebCore::CanvasRenderingContext2D::stroke):
+        (WebCore::CanvasRenderingContext2D::willDraw):
+        (WebCore::CanvasRenderingContext2D::putImageData):
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        * html/CanvasRenderingContext2D.h:
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::willDraw):
+        * platform/graphics/FloatRect.h:
+        (WebCore::mapRect): new method to map a rect contained
+        in one rect to an equivalent rect inside another rect.
+
+2008-12-29  Konstantin Käfer  <kkaefer@gmail.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=17229
+        <rdar://problem/5732829> Inspector should show properties of all JS objects in Console
+
+        Prints objects not as plain text but makes them expandable so that
+        they can be inspected.
+
+        * inspector/front-end/Console.js:
+        (): added a parameter "inline" to the WebInspector.Console._format function which indicates
+            whether the object is printed in the context of another string (with console.log()) or
+            as sole element.
+        (.): objects and DOM nodes are now printed in an expandable form when they are printed alone
+            (i.e. not in the context of a console.log() string) so that they can be inspected.
+        * inspector/front-end/PropertiesSection.js:
+        (WebInspector.PropertiesSection.prototype.set title): Allow DOM Nodes as title instead of strings
+            in that case, the Node is inserted into the title instead of the string value of the passed
+            object. This is used for displaying linkified titles, for example when inspecting DOM nodes,
+            the syntax highlighted HTML representation is shown instead of the plain source code.
+        * inspector/front-end/inspector.css: correct the offsetParent for the expandable object inspector.
+
+2009-01-01  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 23051: web page searching should use ICU's search so it can ignore diacritical differences
+        https://bugs.webkit.org/show_bug.cgi?id=23051
+        rdar://problem/3574497
+
+        Test: editing/execCommand/findString-diacriticals.html
+
+        * editing/TextIterator.cpp: Changed the CircularSearchBuffer class to have a new
+        name, since it doesn't always use a circular buffer any more. Changed the interface
+        so it can work well in the new chunky comparison mode for ICU search, and also
+        added private data members for both the ICU-search and non-ICU-search code paths.
+        (WebCore::TextIterator::TextIterator): Use the versions of the Range functions
+        that don't take an exception code.
+        (WebCore::TextIterator::handleTextBox): Added a special case to handle the position
+        of a collapsed-away space better. This is not needed for search mechanism, but was
+        helpful in an earlier version of this patch, and is still an improvement.
+        (WebCore::SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator): Use the
+        versions of the Range functions that don't take an exception code.
+        (WebCore::CharacterIterator::range): Ditto.
+        (WebCore::characterSubrange): Added. Helper function used in both places below where
+        we want to convert a range and character offsets into a subrange.
+        (WebCore::WordAwareIterator::advance): Use the versions of the Range functions that
+        don't take an exception code.
+        (WebCore::createSearcher): Added.
+        (WebCore::searcher): Added.
+        (WebCore::lockSearcher): Added.
+        (WebCore::unlockSearcher): Added.
+        (WebCore::SearchBuffer::SearchBuffer): Added.
+        (WebCore::SearchBuffer::~SearchBuffer): Added.
+        (WebCore::SearchBuffer::append): Added.
+        (WebCore::SearchBuffer::atBreak): Added.
+        (WebCore::SearchBuffer::reachedBreak): Added.
+        (WebCore::SearchBuffer::search): Added.
+        (WebCore::SearchBuffer::length): Added.
+        (WebCore::TextIterator::subrange): Changed to call the characterSubrange
+        function above.
+        (WebCore::TextIterator::rangeFromLocationAndLength): Use the versions of the
+        Range functions that don't take an exception code. Also tweak some other details
+        of the code.
+        (WebCore::isAllCollapsibleWhitespace): Added.
+        (WebCore::collapsedToBoundary): Added.
+        (WebCore::findPlainText): Rewrote to use new interface and streamline the
+        logic a bit.
+
+        Add the relevant files in the icu directory. As icu/README says, the "icu"
+        directory is really just for Mac OS X, where we have the ICU library but not
+        the headers installed. It should be moved inside platform/mac at some point
+        to make this more clear (and the copy in JavaScriptCore should be moved
+        somewhere similar for the same reason).
+
+        * icu/unicode/ucoleitr.h: Added.
+        * icu/unicode/usearch.h: Added.
+
+2009-01-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        CrashTracer: [REGRESSION] 1090 crashes in Safari at com.apple.JavaScriptCore: KJS::JSGlobalObject::stopTimeoutCheck + 0
+        <rdar://problem/5821130>
+
+        This was caused by a plugin instance calling into JS code that removed the plugin
+        object.  This fix is to cache the global object locally in a ProtectedPtr so we don't
+        need to rely on the continued existence of the plugin instance.
+
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_Construct):
+
+2008-12-31  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Holger Freyther.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22964
+
+        MinGW build failure.
+
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::containsCharacters):
+
+2008-12-31  Alexander V. Butenko  <alex@digiqube.com>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22750
+        [gtk] webkit up to r39121 crash on image urls like
+        http:///sitename.com
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::start):
+
+2008-12-31  Hiroyuki Ikezoe  <poincare@ikezoe.net>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18310
+
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::determinePitch): Do not invoke
+        isFixedPitch() when the font is a custom font.
+
+2008-12-31  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        More work on Bug 3781: Animation via canvas could be faster
+        <https://bugs.webkit.org/show_bug.cgi?id=3781>
+
+        Make use of the fast path parsing of color strings that Color
+        uses.  This improves performance of '#rgb', '#rrggbb', etc and
+        named (eg. 'green') colors.
+
+        Improves frame rate of test by around 40%
+
+        * html/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyStrokeColor):
+        (WebCore::CanvasStyle::applyFillColor):
+
+2008-12-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=23042
+
+        Rather than doing a repaint() inside of computeAbsoluteRepaintRect()
+        when there is a reflection, compute the location of the rect inside
+        the reflection and take the union of the unreflected and reflected rects.
+
+        Test: fast/repaint/reflection-redraw.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeAbsoluteRepaintRect):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::reflectedRect):
+        * rendering/RenderObject.h:
+
+2008-12-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        - fix <rdar://problem/6469944> REGRESSION(3.2.1-ToT): Repro crash in WebCore::HTMLInputElement::updatePlaceholderVisibility opening http://billshrink.com
+
+        Test: fast/forms/placeholder-non-textfield.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute): Only call
+        updatePlaceholderVisibility() when the placeholder attribute changes if
+        the element is a text field.
+
+2008-12-30  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        First step of Bug 3781: Animation via canvas could be faster
+
+        Amortise the cost of calling repaint by coalescing repaint rects
+        while the canvas is drawn to.  In a later step we'll stop calling
+        repaint() directly, and instead have all dirty canvases repaint
+        at the end of JS execution.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::willDraw):
+        (WebCore::HTMLCanvasElement::paint):
+        * html/HTMLCanvasElement.h:
+
+2008-12-30  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Antti Koivisto.
+
+        Bug 22931: Using the inspector with purgeable resources leads to assertion failures
+        <https://bugs.webkit.org/show_bug.cgi?id=22931>
+
+        Change InspectorResource::sourceString() so that it doesn't attempt to
+        unsafely get the data of a purgeable CachedResource.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorResource::sourceString): Attempt to make a purgeable
+        resource unpurgeable, and if this not possible, return an empty string.
+        * loader/CachedResource.h: Make InspectorResource a friend of CachedResource.
+
+2008-12-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23023
+        Remove incomplete support for opportunistic appcache entries
+
+        No change in behavior, thus no test.
+
+        * loader/appcache/ApplicationCacheResource.h:
+        (WebCore::ApplicationCacheResource::Type): Removed Opportunistic bit, will re-use when schema
+        version changes.
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::scheduleApplicationCacheLoad):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didFinishLoadingManifest):
+        * loader/appcache/ApplicationCacheResource.cpp:
+        (WebCore::ApplicationCacheResource::dumpType):
+
+2008-12-29  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Add arcTo support for Cairo. This is needed by Canvas.
+        Cairo has no native support for arcTo. We have to make our
+        own implementation.
+
+        [Canvas] Cairo needs arcTo
+        https://bugs.webkit.org/show_bug.cgi?id=23003
+
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::addArcTo):
+
+2008-12-29  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Bug 23030: Cannot setTransform with a non-invertible ctm
+
+        Removed a series of unnecessary and incorrect checks for an invertible
+        transform.
+
+        Test: fast/canvas/canvas-set-properties-with-non-invertible-ctm.html
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setStrokeStyle):
+        (WebCore::CanvasRenderingContext2D::setFillStyle):
+            These properties are not effected by the current CTM, so there
+            is no need to prevent them from being assigned.
+
+        (WebCore::CanvasRenderingContext2D::setTransform):
+            The whole point of tracking whether the current CTM was expected to be
+            non-invertible was to allow setTransform to be used when the CTM had become
+            non-invertible.
+
+        (WebCore::CanvasRenderingContext2D::beginPath):
+        (WebCore::CanvasRenderingContext2D::closePath):
+            beginPath and closePath change the state of the path, but not any of
+            its coordinates so there is no need prevent them from being called.
+
+2008-12-29  Josh Roesslein  <jroesslein@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22968
+
+        Context menu rendering error when full page zoomed
+
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::handleContextMenuEvent):
+
+2008-12-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Add some basic memory statistic logging for Node.
+
+        * dom/Node.cpp:
+        (WebCore::Node::dumpStatistics):
+        (WebCore::Node::Node):
+        (WebCore::Node::~Node):
+        (WebCore::Node::setDocument):
+        * dom/Node.h:
+
+2008-12-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Remove one use of DeprecatedPtrList.
+
+        * css/CSSRuleList.cpp:
+        (WebCore::CSSRuleList::~CSSRuleList):
+        (WebCore::CSSRuleList::length):
+        (WebCore::CSSRuleList::item):
+        (WebCore::CSSRuleList::deleteRule):
+        (WebCore::CSSRuleList::append):
+        (WebCore::CSSRuleList::insertRule):
+        * css/CSSRuleList.h: Change m_lstCSSRules from using DeprecatedPtrList to a Vector.
+        I measured no performance change and was comforted by the fact that we use a Vector
+        for StyleList, which serves the exact same purpose.
+
+2008-12-29  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21797
+        <rdar://problem/6310682> REGRESSION: Crash in CFHTTPCookieStorageCopy beneath WebCore::cookies() when
+        running fast/dom/document-attribute-js-null.html and http/tests/security/cookies/create-document.html
+
+        Return early if the document is trying to get or set a cookie with an empty cookie url.
+
+        * dom/Document.cpp:
+        (WebCore::Document::cookie):
+        (WebCore::Document::setCookie):
+
+2008-12-28  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Sam Weinig.
+
+        Bug 23016: JavaScriptDebugServer::recompileAllJSFunctions() should not execute JS while reparsing all functions
+        <https://bugs.webkit.org/show_bug.cgi?id=23016>
+        <rdar://problem/6425077>
+
+        JavaScriptDebugServer::recompileAllJSFunctions() calls sourceParsed() while
+        reparsing all JS functions, which will execute JS in the inspector. Depending
+        on the order in which functions are recompiled, a function could have a new
+        body but other functions that have not been recompiled could have an optimized
+        (in the sense of inline caching) call to it, bypassing the check of whether or
+        not there is generated bytecode. This leads to a crash caused by accessing
+        indices off of a null pointer.
+
+        To fix the problem, simply delay calling sourceParsed() until after all functions
+        have been reparsed. The crash isn't 100% reproducible, but on the one test case
+        I have, this makes it impossible to reproduce after a large number of attempts,
+        when it used to happen every few attempts.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+
+2008-12-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Rubber-stamped by Antti Koivisto.
+        Oops, remove some last minute ASSERTS that are obviously wrong.
+
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
+
+2008-12-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Antti Koivisto.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=23015
+
+        Don't rely on HTMLFormControlElement in RenderTextControl.
+
+        Introduce an abstract FormControlElement class, containing the
+        valueMatchesRenderer/setValueMatchesRenderer, the only HTMLFormControlElement
+        specific methods that RenderTextControl relies on.
+
+        This makes it possible for WML to reuse RenderTextControl.
+        RenderTextControlSingleLine still relies on HTMLInputElement,
+        this will change if WMLInputElement is introduced.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/FormControlElement.h: Added.
+        (WebCore::FormControlElement::~FormControlElement):
+        (WebCore::FormControlElement::FormControlElement):
+        * html/HTMLFormControlElement.h:
+        (WebCore::HTMLFormControlElement::valueMatchesRenderer):
+        (WebCore::HTMLFormControlElement::setValueMatchesRenderer):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::updateValue):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::adjustInnerTextStyle):
+        (WebCore::RenderTextControl::updateFromElement):
+        (WebCore::RenderTextControl::setInnerTextValue):
+        (WebCore::RenderTextControl::selectionChanged):
+        (WebCore::RenderTextControl::formControlElement):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+
+2008-12-28  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Darin Adler.
+
+        Bug 23006: Many Loader::Host member functions are not safe to use reentrantly
+        <https://bugs.webkit.org/show_bug.cgi?id=23006>
+        <rdar://problem/6216106>
+
+        Many Loader::Host member functions set m_processingResource to true when they
+        begin processing a resource and set it to false when they are done. Thanks to
+        JavaScript and the web inspector, almost anything can happen during the
+        processing of a resource, including these functions being called reentrantly,
+        which is unsafe due to this way of using m_processingResource.
+
+        This can theoretically cause a Loader::Host to be used after it is freed,
+        because when Loader::servedPendingRequests() is called, it will free Hosts
+        that have m_processingResource set to false.
+
+        To fix this, we replace m_processingResource with m_numResourcesProcessing,
+        which is incremented and decremented using a helper object, ProcessingResource.
+
+        There are no occurrences of crashes caused by this bug that are reproducible
+        by multiple people, but this fixes the problem of m_processingResource being
+        set to false while a Host is still alive.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::Host):
+        (WebCore::Loader::Host::didFinishLoading): Change to use ProcessingResource
+        instead of manually setting m_processingResource.
+        (WebCore::Loader::Host::didFail): Ditto.
+        (WebCore::Loader::Host::didReceiveData): Ditto.
+        * loader/loader.h:
+        (WebCore::Loader::Host::ProcessingResource::ProcessingResource): Added.
+        (WebCore::Loader::Host::ProcessingResource::~ProcessingResource): Added.
+        (WebCore::Loader::Host::processingResource): Change to use m_numResourcesProcessing
+        instead of just getting m_processingResource.
+
+2008-12-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23007
+        REGRESSION: Timer-related crash when closing Web Inspector
+
+        Test: fast/dom/Window/remove-timeout-crash.html
+
+        * bindings/js/DOMTimer.cpp: (WebCore::DOMTimer::fired): Besides deleting the timer, make
+        sure to remove it from a Document map.
+
+2008-12-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23012
+        Bring application cache manifest parsing up to date
+
+        Test: http/tests/appcache/manifest-parsing.html
+
+        * loader/appcache/ManifestParser.cpp:
+        (WebCore::Mode): Added a constant for unknown sections, which are ignored when parsing. This
+        is necessary for future extensions.
+        (WebCore::parseManifest): Parse unknown sections correctly. Ignore trailing tokens in
+        supported sections.
+
+2008-12-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22996
+
+        RenderTextControl heavily depends on HTMLInputElement & HTMLTextAreaElement.
+        It handles multi & single line text control rendering in one class. Split up
+        in two new classes: RenderTextControlSingleLine & RenderTextControlMultiLine.
+
+        This has several benefits - code is more readable now, the memory usage
+        for RenderTextControlMultiLine is reduced, as all stuff related to search fields
+        lives in RenderTextControlSingleLine, and it's easier to introduce an
+        abstraction for input/textarea-like elements for other HTML flavours like WML.
+
+        * GNUmakefile.am:
+        * WebCore.order:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::createRenderer):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::updatePlaceholderVisibility):
+        (WebCore::HTMLInputElement::addSearchResult):
+        (WebCore::HTMLInputElement::onSearch):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::createRenderer):
+        (WebCore::HTMLTextAreaElement::defaultEventHandler):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::RenderTextControl):
+        (WebCore::RenderTextControl::~RenderTextControl):
+        (WebCore::RenderTextControl::styleDidChange):
+        (WebCore::RenderTextControl::adjustInnerTextStyle):
+        (WebCore::RenderTextControl::createSubtreeIfNeeded):
+        (WebCore::RenderTextControl::textBlockHeight):
+        (WebCore::RenderTextControl::textBlockWidth):
+        (WebCore::RenderTextControl::updateFromElement):
+        (WebCore::RenderTextControl::setInnerTextValue):
+        (WebCore::RenderTextControl::setSelectionRange):
+        (WebCore::RenderTextControl::visiblePositionForIndex):
+        (WebCore::RenderTextControl::indexForVisiblePosition):
+        (WebCore::RenderTextControl::subtreeHasChanged):
+        (WebCore::RenderTextControl::scrollbarThickness):
+        (WebCore::RenderTextControl::calcHeight):
+        (WebCore::RenderTextControl::hitInnerTextBlock):
+        (WebCore::RenderTextControl::forwardEvent):
+        (WebCore::RenderTextControl::calcPrefWidths):
+        (WebCore::RenderTextControl::selectionChanged):
+        (WebCore::RenderTextControl::innerTextElement):
+        * rendering/RenderTextControl.h:
+        (WebCore::RenderTextControl::hasControlClip):
+        (WebCore::RenderTextControl::canHaveChildren):
+        (WebCore::RenderTextControl::avoidsFloats):
+        (WebCore::RenderTextControl::isEdited):
+        (WebCore::RenderTextControl::setEdited):
+        * rendering/RenderTextControlMultiLine.cpp: Added.
+        (WebCore::RenderTextControlMultiLine::RenderTextControlMultiLine):
+        (WebCore::RenderTextControlMultiLine::~RenderTextControlMultiLine):
+        (WebCore::RenderTextControlMultiLine::subtreeHasChanged):
+        (WebCore::RenderTextControlMultiLine::layout):
+        (WebCore::RenderTextControlMultiLine::nodeAtPoint):
+        (WebCore::RenderTextControlMultiLine::forwardEvent):
+        (WebCore::RenderTextControlMultiLine::preferredContentWidth):
+        (WebCore::RenderTextControlMultiLine::adjustControlHeightBasedOnLineHeight):
+        (WebCore::RenderTextControlMultiLine::baselinePosition):
+        (WebCore::RenderTextControlMultiLine::updateFromElement):
+        (WebCore::RenderTextControlMultiLine::cacheSelection):
+        (WebCore::RenderTextControlMultiLine::createInnerTextStyle):
+        * rendering/RenderTextControlMultiLine.h: Added.
+        (WebCore::RenderTextControlMultiLine::isTextArea):
+        * rendering/RenderTextControlSingleLine.cpp: Added.
+        (WebCore::RenderTextControlSingleLine::RenderTextControlSingleLine):
+        (WebCore::RenderTextControlSingleLine::~RenderTextControlSingleLine):
+        (WebCore::RenderTextControlSingleLine::placeholderShouldBeVisible):
+        (WebCore::RenderTextControlSingleLine::updatePlaceholderVisibility):
+        (WebCore::RenderTextControlSingleLine::addSearchResult):
+        (WebCore::RenderTextControlSingleLine::stopSearchEventTimer):
+        (WebCore::RenderTextControlSingleLine::showPopup):
+        (WebCore::RenderTextControlSingleLine::hidePopup):
+        (WebCore::RenderTextControlSingleLine::subtreeHasChanged):
+        (WebCore::RenderTextControlSingleLine::paint):
+        (WebCore::RenderTextControlSingleLine::layout):
+        (WebCore::RenderTextControlSingleLine::nodeAtPoint):
+        (WebCore::RenderTextControlSingleLine::forwardEvent):
+        (WebCore::RenderTextControlSingleLine::styleDidChange):
+        (WebCore::RenderTextControlSingleLine::capsLockStateMayHaveChanged):
+        (WebCore::RenderTextControlSingleLine::textBlockWidth):
+        (WebCore::RenderTextControlSingleLine::preferredContentWidth):
+        (WebCore::RenderTextControlSingleLine::adjustControlHeightBasedOnLineHeight):
+        (WebCore::RenderTextControlSingleLine::createSubtreeIfNeeded):
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+        (WebCore::RenderTextControlSingleLine::cacheSelection):
+        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):
+        (WebCore::RenderTextControlSingleLine::createInnerBlockStyle):
+        (WebCore::RenderTextControlSingleLine::createResultsButtonStyle):
+        (WebCore::RenderTextControlSingleLine::createCancelButtonStyle):
+        (WebCore::RenderTextControlSingleLine::updateCancelButtonVisibility):
+        (WebCore::RenderTextControlSingleLine::autosaveName):
+        (WebCore::RenderTextControlSingleLine::startSearchEventTimer):
+        (WebCore::RenderTextControlSingleLine::searchEventTimerFired):
+        (WebCore::RenderTextControlSingleLine::valueChanged):
+        (WebCore::RenderTextControlSingleLine::itemText):
+        (WebCore::RenderTextControlSingleLine::itemIsEnabled):
+        (WebCore::RenderTextControlSingleLine::itemStyle):
+        (WebCore::RenderTextControlSingleLine::menuStyle):
+        (WebCore::RenderTextControlSingleLine::clientInsetLeft):
+        (WebCore::RenderTextControlSingleLine::clientInsetRight):
+        (WebCore::RenderTextControlSingleLine::clientPaddingLeft):
+        (WebCore::RenderTextControlSingleLine::clientPaddingRight):
+        (WebCore::RenderTextControlSingleLine::listSize):
+        (WebCore::RenderTextControlSingleLine::selectedIndex):
+        (WebCore::RenderTextControlSingleLine::itemIsSeparator):
+        (WebCore::RenderTextControlSingleLine::itemIsLabel):
+        (WebCore::RenderTextControlSingleLine::itemIsSelected):
+        (WebCore::RenderTextControlSingleLine::setTextFromItem):
+        (WebCore::RenderTextControlSingleLine::fontSelector):
+        (WebCore::RenderTextControlSingleLine::hostWindow):
+        (WebCore::RenderTextControlSingleLine::createScrollbar):
+        * rendering/RenderTextControlSingleLine.h: Added.
+        (WebCore::RenderTextControlSingleLine::hasControlClip):
+        (WebCore::RenderTextControlSingleLine::isTextField):
+        (WebCore::RenderTextControlSingleLine::placeholderIsVisible):
+        (WebCore::RenderTextControlSingleLine::popupIsVisible):
+        (WebCore::RenderTextControlSingleLine::shouldPopOver):
+        (WebCore::RenderTextControlSingleLine::valueShouldChangeOnHotTrack):
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::RenderTextControlInnerBlock::nodeAtPoint):
+        (WebCore::SearchFieldResultsButtonElement::defaultEventHandler):
+
+2008-12-28  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22755
+        Prepare to add create/remove timeout methods to JSWorkerContext by moving
+        timer-specific code from JSDOMWindowBase to DOMTimer.
+        Moved everything JS-related from DOMTimer to ScheduledAction.
+        Now ScheduledAction is what it wanted to be all the time: a JS engine-specific
+        container for timer callback that knows how to invoke it.
+        DOMTimer is not anymore JS-specific.
+
+        This is mostly moving the code around. No intended functional changes.
+
+        * bindings/js/DOMTimer.cpp:
+        (WebCore::DOMTimer::DOMTimer):
+        (WebCore::DOMTimer::~DOMTimer):
+        (WebCore::DOMTimer::install):
+        (WebCore::DOMTimer::removeById):
+        (WebCore::DOMTimer::fired):
+        (WebCore::DOMTimer::stop):
+        * bindings/js/DOMTimer.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::installTimeout):
+        (WebCore::JSDOMWindowBase::removeTimeout):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScheduledAction.h:
+        * dom/Document.cpp:
+        (WebCore::Document::addTimeout):
+
+2008-12-26  Zalan Bujtas  <zbujtas@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22999
+        Check if database thread exists.
+
+        * storage/Database.cpp:
+        (WebCore::Database::openAndVerifyVersion):
+        (WebCore::Database::markAsDeletedAndClose):
+        (WebCore::Database::tableNames):
+
+2008-12-26  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=23001
+        A call to applicationCache.update() from a cached event listener should be ignored
+
+        Test: http/tests/appcache/idempotent-update.html
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::checkIfLoadIsComplete): Only reset m_status after
+        dispatching events.
+
+2008-12-26  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22997
+        ASSERTION FAILED: !m_resources.contains(url) in ApplicationCache::addResource()
+
+        Tests: http/tests/appcache/top-frame-1.html
+               http/tests/appcache/top-frame-2.html
+               http/tests/appcache/top-frame-3.html
+               http/tests/appcache/top-frame-4.html
+
+        * loader/appcache/ApplicationCacheGroup.cpp: (WebCore::ApplicationCacheGroup::cacheForMainRequest):
+        Fixed one more instance of top level frame being used for caching purposes.
+
+2008-12-26  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22987
+        Fix for broken test editing/execCommand/5763082.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::mergeIdenticalElements): Used local RefPtr to hold onto
+        function parameter across multiple calls.
+
+2008-12-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22993
+        Application cache shouldn't be inherited by subframes
+
+        <rdar://problem/6284708> AppCache crashes in ApplicationCacheResource::addType()
+        This crash happened because main resource for subframe was looked up in top frame's
+        appcache. If not for the spec change, it could have been fixed by preventing the load
+        altogether.
+
+        Test: http/tests/appcache/foreign-iframe-main.html
+        I intend to write additional tests for the behavior change.
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::shouldLoadResourceFromApplicationCache):
+        * loader/DocumentLoader.h:
+        (WebCore::DocumentLoader::applicationCache):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::load):
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::associatedCache):
+        Removed DocumentLoader::topLevelApplicationCache(), and changed callers accordingly.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::selectCache):
+        (WebCore::ApplicationCacheGroup::selectCacheWithoutManifestURL):
+        Removed checks for the frame being top-level one, now that subframes are cached independently.
+
+2008-12-25  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6465669> Frequent !isPurgeable() assertion in WebCore::CachedResource::addClient
+
+        Disallow turning resources that are being revalidated to purgable state.
+
+        No test, the condition is difficult to produce in DRT.
+
+        * loader/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::allClientsRemoved):
+        * loader/CachedImage.cpp:
+        (WebCore::CachedImage::destroyDecodedData):
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::isSafeToMakePurgeable):
+        (WebCore::CachedResource::makePurgeable):
+        * loader/CachedResource.h:
+        * loader/CachedScript.cpp:
+        (WebCore::CachedScript::destroyDecodedData):
+
+2008-12-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Qt build fix.
+
+        * WebCore.pro: Added ThreadGlobalData.cpp.
+
+2008-12-24  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * WebCore.base.exp:  Remove a symbol from the export file now that it is no longer generated.
+
+2008-12-24  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed build fix to find addSubresourceURL
+
+        This is needed to compile on WebKit/Gtk+
+
+        * css/CSSFontFaceSrcValue.cpp:
+
+2008-12-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22980
+        WebCore uses more thread specific keys than it really needs
+
+        Consolidated ThreadSpecific data into a single ThreadGlobalData structure.
+
+        * GNUmakefile.am:
+        * WebCore.base.exp:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/EventNames.cpp:
+        * dom/EventNames.h:
+        (WebCore::eventNames):
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        * platform/ThreadGlobalData.cpp: Added.
+        (WebCore::threadGlobalData):
+        (WebCore::ThreadGlobalData::ThreadGlobalData):
+        (WebCore::ThreadGlobalData::~ThreadGlobalData):
+        * platform/ThreadGlobalData.h: Added.
+        (WebCore::ThreadGlobalData::eventNames):
+        (WebCore::ThreadGlobalData::emptyString):
+        (WebCore::ThreadGlobalData::atomicStringTable):
+        (WebCore::ThreadGlobalData::cachedConverterICU):
+        (WebCore::ThreadGlobalData::cachedConverterTEC):
+        * platform/text/AtomicString.cpp:
+        (WebCore::stringTable):
+        (WebCore::AtomicString::add):
+        (WebCore::AtomicString::remove):
+        (WebCore::AtomicString::find):
+        (WebCore::AtomicString::init):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::empty):
+        * platform/text/StringImpl.h:
+        * platform/text/TextCodecICU.cpp:
+        (WebCore::ICUConverterWrapper::~ICUConverterWrapper):
+        (WebCore::cachedConverterICU):
+        * platform/text/TextCodecICU.h:
+        (WebCore::ICUConverterWrapper::ICUConverterWrapper):
+        * platform/text/mac/TextCodecMac.cpp:
+        (WebCore::cachedConverterTEC):
+        * platform/text/mac/TextCodecMac.h:
+        (WebCore::TECConverterWrapper::TECConverterWrapper):
+        (WebCore::TECConverterWrapper::~TECConverterWrapper):
+
+2008-12-23  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * WebCore.xcodeproj/project.pbxproj: CSSPropertyNames.h is a generated file so it needs to be explicitly copied
+        into the PrivateHeaders directory, rather than relying on the automatic copying of headers which runs before the
+        derived sources are generated.
+
+2008-12-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=22941
+
+        If the document element has opacity, we need to erase the view background to
+        white before painting.
+
+        Test: fast/backgrounds/opacity-on-document-element.html
+
+        * rendering/RenderView.cpp:
+        (WebCore::rendererObscuresBackground):
+
+2008-12-23  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=21910
+
+        Fix SVGImage painting by ensuring that the SVGImage resizes its FrameView correctly.
+        Otherwise the FrameView is left at 0x0, and nothing paints.
+
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::draw):
+
+2008-12-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - improve robustness of undo/redo in HTML editing to fix the following bugs
+          <https://bugs.webkit.org/show_bug.cgi?id=19703> Crash in WebCore::InsertNodeBeforeCommand::doUnapply()
+          <rdar://problem/4059423> DOM operations performed on editable HTML can cause a crash later during Undo
+
+        Major categories of improvements:
+
+            1) Added null checks.
+            2) Eliminated type casts without corresponding type checks.
+            3) Avoided possible infinite loops by building up lists of nodes to operate on
+               before starting to make DOM changes.
+            4) Use more RefPtr.
+
+        No test at this time, but test cases should follow in separate patches.
+
+        * WebCore.xcodeproj/project.pbxproj: Set the role of CSSPropertyNames.h to Private so it
+        can be used in other Private headers, specifically editing ones.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::locateCousinList): Adopt parentElement.
+        (WebCore::CSSStyleSelector::locateSharedStyle): Ditto.
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): Ditto.
+
+        * dom/Element.cpp: (WebCore::Element::cloneElement): Added.
+        * dom/Element.h: Added cloneElement and an implementation of parentElement.
+        * dom/Node.h: Moved parentElement from here to Element.h and changed its
+        implementation so it will return 0 when the parent is not an element
+        (document, document fragment, etc.).
+
+        * editing/AppendNodeCommand.cpp:
+        (WebCore::AppendNodeCommand::AppendNodeCommand): Made parent be an Element.
+        Moved assertions from doApply in here.
+        (WebCore::AppendNodeCommand::doApply): Simplified to just a single unchecked
+        appendChild call.
+        (WebCore::AppendNodeCommand::doUnapply): Simplified to just a single remove call.
+        * editing/AppendNodeCommand.h: Updated.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::createStyleSpanElement): Eliminate casting by creating an element in a more
+        direct way with new instead of createElementNS.
+        (WebCore::ApplyStyleCommand::ApplyStyleCommand): Use PassRefPtr.
+        (WebCore::ApplyStyleCommand::removeCSSStyle): Use CSSPropertyID.
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded): Use cloneElement.
+        * editing/ApplyStyleCommand.h:
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply): Use Element* and cloneElement.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::applyStyledElement): Use PassRefPtr and unsigned.
+        (WebCore::CompositeEditCommand::removeStyledElement): Ditto.
+        (WebCore::CompositeEditCommand::insertNodeBefore): Ditto.
+        (WebCore::CompositeEditCommand::insertNodeAfter): Ditto.
+        (WebCore::CompositeEditCommand::insertNodeAt): Ditto.
+        (WebCore::CompositeEditCommand::appendNode): Ditto.
+        (WebCore::CompositeEditCommand::removeChildrenInRange): Ditto. Also use a vector to
+        make the list of children in case removing them has side effects.
+        (WebCore::CompositeEditCommand::removeNode): Ditto.
+        (WebCore::CompositeEditCommand::removeNodePreservingChildren): Ditto.
+        (WebCore::CompositeEditCommand::removeNodeAndPruneAncestors): Ditto.
+        (WebCore::CompositeEditCommand::splitTextNode): Ditto.
+        (WebCore::CompositeEditCommand::splitElement): Ditto.
+        (WebCore::CompositeEditCommand::mergeIdenticalElements): Ditto.
+        (WebCore::CompositeEditCommand::wrapContentsInDummySpan): Ditto.
+        (WebCore::CompositeEditCommand::splitTextNodeContainingElement): Ditto.
+        (WebCore::CompositeEditCommand::joinTextNodes): Ditto.
+        (WebCore::CompositeEditCommand::inputText): Ditto.
+        (WebCore::CompositeEditCommand::insertTextIntoNode): Ditto.
+        (WebCore::CompositeEditCommand::deleteTextFromNode): Ditto.
+        (WebCore::CompositeEditCommand::replaceTextInNode): Ditto.
+        (WebCore::CompositeEditCommand::insertNodeAtTabSpanPosition): Ditto.
+        (WebCore::CompositeEditCommand::removeCSSProperty): Ditto.
+        (WebCore::CompositeEditCommand::removeNodeAttribute): Ditto. Implement by calling
+        setNodeAttribute instead of with its own SimpleEditCommand.
+        (WebCore::CompositeEditCommand::setNodeAttribute): Ditto.
+        (WebCore::CompositeEditCommand::deleteInsignificantText): Ditto.
+        (WebCore::CompositeEditCommand::appendBlockPlaceholder): Ditto.
+        (WebCore::CompositeEditCommand::addBlockPlaceholderIfNeeded): Ditto.
+        (WebCore::CompositeEditCommand::insertNewDefaultParagraphElementAt): Ditto. Don't
+        bother using an undoable operation to put the break element into the paragraph
+        element because there's no need to split them and redo this when doing undo/redo.
+        (WebCore::CompositeEditCommand::moveParagraphs): Ditto.
+        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem): Ditto.
+        * editing/CompositeEditCommand.h: Ditto.
+
+        * editing/DeleteFromTextNodeCommand.cpp:
+        (WebCore::DeleteFromTextNodeCommand::DeleteFromTextNodeCommand): Use unsigned.
+        (WebCore::DeleteFromTextNodeCommand::doApply): Eliminated inappropriate assertions.
+        (WebCore::DeleteFromTextNodeCommand::doUnapply): Ditto.
+        * editing/DeleteFromTextNodeCommand.h:
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::removeNode): Use PassRefPtr.
+        (WebCore::DeleteSelectionCommand::deleteTextFromNode): Ditto.
+        * editing/DeleteSelectionCommand.h:
+
+        * editing/FormatBlockCommand.cpp:
+        (WebCore::FormatBlockCommand::FormatBlockCommand): Use AtomicString.
+        (WebCore::FormatBlockCommand::doApply): Use Element.
+        * editing/FormatBlockCommand.h:
+
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::createIndentBlockquoteElement): Use new to create the element
+        instead of calling a function so we have a more specific type.
+        (WebCore::IndentOutdentCommand::prepareBlockquoteLevelForInsertion):
+        Use RefPtr and Element.
+        (WebCore::IndentOutdentCommand::indentRegion): Ditto.
+        (WebCore::IndentOutdentCommand::outdentParagraph): Ditto.
+        * editing/IndentOutdentCommand.h:
+
+        * editing/InsertIntoTextNodeCommand.cpp:
+        (WebCore::InsertIntoTextNodeCommand::InsertIntoTextNodeCommand):
+        Use unsigned. Added an assertion.
+        (WebCore::InsertIntoTextNodeCommand::doApply): Eliminated inappropriate assertions.
+        (WebCore::InsertIntoTextNodeCommand::doUnapply): Ditto.
+        * editing/InsertIntoTextNodeCommand.h:
+
+        * editing/InsertLineBreakCommand.cpp:
+        (WebCore::InsertLineBreakCommand::insertNodeAfterPosition): Use Element.
+        (WebCore::InsertLineBreakCommand::insertNodeBeforePosition): Ditto.
+
+        * editing/InsertListCommand.cpp:
+        (WebCore::InsertListCommand::doApply): Use Element.
+
+        * editing/InsertNodeBeforeCommand.cpp:
+        (WebCore::InsertNodeBeforeCommand::InsertNodeBeforeCommand): Moved assertions
+        here from doApply.
+        (WebCore::InsertNodeBeforeCommand::doApply): Eliminated inappropriate assertions.
+        Added a null check.
+        (WebCore::InsertNodeBeforeCommand::doUnapply): Simplified to just a single remove call.
+
+        * editing/InsertParagraphSeparatorCommand.cpp:
+        (WebCore::InsertParagraphSeparatorCommand::doApply): Use Element and cloneElement.
+
+        * editing/JoinTextNodesCommand.cpp:
+        (WebCore::JoinTextNodesCommand::doApply): Eliminated inappropriate assertions.
+        Added some runtime checks. Don't store anything in m_offset.
+        (WebCore::JoinTextNodesCommand::doUnapply): Ditto.
+        * editing/JoinTextNodesCommand.h:
+
+        * editing/MergeIdenticalElementsCommand.cpp:
+        (WebCore::MergeIdenticalElementsCommand::MergeIdenticalElementsCommand): Moved
+        an assertion here from doApply.
+        (WebCore::MergeIdenticalElementsCommand::doApply): Eliminated inappropriate assertions.
+        Added a null check. Changed implementation to use remove to avoid null parent issue.
+        Use a vector of nodes to avoid possible infinite loop if mutation happens while iterating.
+        (WebCore::MergeIdenticalElementsCommand::doUnapply): Ditto.
+
+        * editing/ModifySelectionListLevel.cpp:
+        (WebCore::ModifySelectionListLevelCommand::appendSiblingNodeRange): Use Element*.
+        (WebCore::IncreaseSelectionListLevelCommand::doApply): Ditto.
+        * editing/ModifySelectionListLevel.h:
+
+        * editing/RemoveCSSPropertyCommand.cpp:
+        (WebCore::RemoveCSSPropertyCommand::RemoveCSSPropertyCommand): Use PassRefPtr and
+        CSSPropertyID. Also renamed m_decl to m_style.
+        (WebCore::RemoveCSSPropertyCommand::doApply): Eliminated inappropriate assertions.
+        (WebCore::RemoveCSSPropertyCommand::doUnapply): Ditto.
+
+        * editing/RemoveNodeAttributeCommand.cpp: Removed contents of this file. To be deleted.
+        Use SetNodeAttributeCommand instead.
+        * editing/RemoveNodeAttributeCommand.h: Ditto.
+
+        * editing/RemoveNodeCommand.cpp:
+        (WebCore::RemoveNodeCommand::RemoveNodeCommand): Moved assertions here from doApply.
+        Don't initialize m_refChild here; rather do it in doApply.
+        (WebCore::RemoveNodeCommand::doApply): Eliminated inappropriate assertions. Added
+        checks and streamlined implementation.
+        (WebCore::RemoveNodeCommand::doUnapply): Ditto.
+        * editing/RemoveNodeCommand.h:
+
+        * editing/RemoveNodePreservingChildrenCommand.cpp:
+        (WebCore::RemoveNodePreservingChildrenCommand::doApply): Use a vector.
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::insertFragmentForTestRendering): Removed now-unneeded cast.
+
+        * editing/SetNodeAttributeCommand.cpp:
+        (WebCore::SetNodeAttributeCommand::SetNodeAttributeCommand): Use AtomicString.
+        Removed assertion that prevents us from using this to remove an attribute.
+        (WebCore::SetNodeAttributeCommand::doApply): Eliminated inappropriate assertions.
+        (WebCore::SetNodeAttributeCommand::doUnapply): Ditto.
+        * editing/SetNodeAttributeCommand.h:
+
+        * editing/SplitElementCommand.cpp:
+        (WebCore::SplitElementCommand::SplitElementCommand): Moved assertion here from doApply.
+        (WebCore::SplitElementCommand::doApply): Check some more invariants and use a vector
+        to avoid possible infinite loops.
+        (WebCore::SplitElementCommand::doUnapply): Ditto.
+
+        * editing/SplitTextNodeCommand.cpp:
+        (WebCore::SplitTextNodeCommand::SplitTextNodeCommand): Moved assertions and comment
+        here from doApply.
+        (WebCore::SplitTextNodeCommand::doApply): Check for null and failures when applying.
+        (WebCore::SplitTextNodeCommand::doUnapply): Ditto.
+
+        * editing/SplitTextNodeContainingElementCommand.cpp:
+        (WebCore::SplitTextNodeContainingElementCommand::doApply): Use Element.
+
+        * editing/WrapContentsInDummySpanCommand.cpp:
+        (WebCore::WrapContentsInDummySpanCommand::doApply): Check for null and ignore failures.
+        Don't reuse the dummy span. Simplified logic.
+        (WebCore::WrapContentsInDummySpanCommand::doUnapply): Ditto.
+
+        * editing/htmlediting.cpp:
+        (WebCore::isBlock): Make sure this returns true only for elements.
+        (WebCore::enclosingBlock): Return an Element*.
+        (WebCore::enclosingTableCell): Ditto.
+        (WebCore::enclosingList): Return an HTMLElement*.
+        (WebCore::outermostEnclosingList): Return an HTMLElement*.
+        (WebCore::createDefaultParagraphElement): Return an HTMLElement*.
+        (WebCore::createBreakElement): Return an HTMLElement*.
+        (WebCore::createOrderedListElement): Return an HTMLElement*.
+        (WebCore::createUnorderedListElement): Return an HTMLElement*.
+        (WebCore::createListItemElement): Return an HTMLElement*.
+        (WebCore::createHTMLElement): Return an HTMLElement*.
+        * editing/htmlediting.h:
+
+        * editing/markup.cpp:
+        (WebCore::createFragmentFromText): Use createBreakElement and use Element*.
+
+        * page/MouseEventWithHitTestResults.cpp:
+        (WebCore::MouseEventWithHitTestResults::targetNode): Use parentElement.
+
+2008-12-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        * dom/Node.h: Tweak comments and order of bits that Sam moved
+        here last night.
+        * dom/Node.cpp: Ditto.
+
+2008-12-22  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 11106: Some XMLHttpRequest URI resolving tests fail
+        https://bugs.webkit.org/show_bug.cgi?id=11106
+
+        Use the ScriptExecutionContext to resolve the URI when calling open in JavaScript.
+        The previous code was using the containing DOMWindow to do so which would fail for
+        XMLHttpRequest object being passed between iframe.
+
+        Tests: http/tests/xmlhttprequest/uri-resolution-opera-open-004.html
+               http/tests/xmlhttprequest/uri-resolution-opera-open-005.html
+               http/tests/xmlhttprequest/uri-resolution-opera-open-006.html
+               http/tests/xmlhttprequest/uri-resolution-opera-open-007.html
+               http/tests/xmlhttprequest/uri-resolution-opera-open-008.html
+               http/tests/xmlhttprequest/uri-resolution-opera-open-009.html
+               http/tests/xmlhttprequest/uri-resolution-opera-open-010.html
+
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::open): Use the ScriptExecutionContext
+        to resolve the URL.
+
+        * dom/Document.cpp:
+        (WebCore::Document::virtualCompleteURL): Virtual method added to
+        avoid performance hit on completeURL call.
+
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.h:
+        (WebCore::ScriptExecutionContext::completeURL): Non-virtual method
+        that wrap the call to the virtual call.
+        * dom/WorkerContext.cpp:
+        (WebCore::WorkerContext::virtualCompleteURL): Pure virtual method.
+        * dom/WorkerContext.h:
+
+2008-12-23  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=22978
+          a couple tweaks to the new strokeBoundingRect functions
+
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::strokeBoundingRect): Only create a GraphicsContext
+        if the applier is non-null.
+
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::putBytesNowhere): Added.
+        (WebCore::createScratchContext): Changed to use a "/dev/null" type
+        function to discard bytes rather than using a data object. This
+        eliminates the possibility that memory will be used if someone draws
+        into the scratch context by accident. Also moved to the top of the
+        file; it was in a slightly strange place before.
+        (WebCore::Path::strokeBoundingRect): Only create a GraphicsContext
+        if the applier is non-null. Simplify the empty path special case.
+
+2008-12-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Save a word in all Elements by moving the 5 loose bits to Node,
+        where we had 16 spare.
+
+        * dom/Element.cpp:
+        (WebCore::Element::Element):
+        * dom/Element.h:
+        * dom/Node.cpp:
+        (WebCore::Node::Node):
+        * dom/Node.h:
+
+2008-12-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22972
+
+        Add WML <meta> element support. All needed functionality is present
+        in Document::processHttpEquiv, already covered by tests.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * wml/WMLMetaElement.cpp: Added.
+        (WebCore::WMLMetaElement::WMLMetaElement):
+        (WebCore::WMLMetaElement::parseMappedAttribute):
+        (WebCore::WMLMetaElement::insertedIntoDocument):
+        * wml/WMLMetaElement.h: Added.
+        * wml/WMLTagNames.in:
+
+2008-12-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Rubber-stamped by Darin Adler.
+
+        Don't reference specific layout tests in comments.
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::createFormData):
+
+2008-12-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22965
+
+        Add WML <head> element support. Doesn't require a WMLHeadElement.
+        No functional behaviour, as we already created a WMLElement for headTag, by default.
+        It's just cleaner to list <head> in WMLTagNames, forwarding to a WMLElement constructor.
+
+        * wml/WMLTagNames.in:
+
+2008-12-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22971
+
+        Fix regression caused by the HTMLFormElement refactorization.
+        File form elements without a name have to be included in multipart/form-data
+        submission. Cover this behaviour with a new test case.
+
+        Test: http/tests/misc/empty-file-formdata.html
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::createFormData):
+        * wml/WMLTagNames.in:
+
+2008-12-22  David Kilzer  <ddkilzer@apple.com>
+
+        <rdar://problem/6438298> Bump schema version for app cache
+
+        Reviewed by Alexey Proskuryakov.
+
+        * loader/appcache/ApplicationCacheStorage.cpp: Increment
+        SchemaVersion from 2 to 3.
+
+2008-12-22  David Kilzer  <ddkilzer@apple.com>
+
+        Use Deque in CSSStyleSheet::addSubresourceStyleURLs()
+
+        Reviewed by Darin Adler.
+
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::addSubresourceStyleURLs): Replaced
+        use of ListHashSet with more efficient Deque.
+
+2008-12-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix obvious crash fix for WML enabled builds.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+
+2008-12-22  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 11850: Webarchive fails to save images referenced in CSS
+
+        <https://bugs.webkit.org/show_bug.cgi?id=11850>
+
+        Reviewed by Darin Adler.
+
+        This entry contains two parts since the tests for adding a
+        completeURL() method to StyleSheet and CSSStyleSheet (part 1) depend
+        on Bug 11850 being fixed (part 2).
+
+        --
+
+        Tests: http/tests/webarchive/test-css-url-encoding-shift-jis.html
+               http/tests/webarchive/test-css-url-encoding-utf-8.html
+               http/tests/webarchive/test-css-url-encoding.html
+
+        Added completeURL() methods to StyleSheet and CSSStyleSheet that
+        match the behavior of Document::completeURL().  Most notably,
+        CSSStyleSheet::completeURL() uses the charset of the stylesheet
+        (if it exists) to construct URLs, just like Document::completeURL().
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Use CSSStyleSheet::completeURL().
+        (WebCore::CSSParser::parseContent): Ditto.
+        (WebCore::CSSParser::parseFillImage): Ditto.
+        (WebCore::CSSParser::parseFontFaceSrc): Ditto.
+        (WebCore::CSSParser::parseBorderImage): Ditto.
+
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::completeURL): Added.
+        * css/CSSStyleSheet.h:
+        (WebCore::CSSStyleSheet::completeURL): Added declaration.
+
+        * css/StyleSheet.cpp:
+        (WebCore::StyleSheet::completeURL): Added.
+        * css/StyleSheet.h:
+        (WebCore::StyleSheet::completeURL): Added declaration.
+
+        * dom/Document.cpp:
+        (WebCore::Document::completeURL): Added comment referring to the new
+        completeURL() methods in StyleSheet and CSSStyleSheet.
+
+        --
+
+        Tests: webarchive/test-css-url-resources-in-stylesheets.html
+               webarchive/test-css-url-resources-inline-styles.html
+
+        Walk stylesheets and inline style attributes for url() references
+        when building a list of URLs to include in a webarchive.  Note that
+        not all URLs found this way will be included in the webarchive if
+        they were not used (and thus not downloaded) when laying out the
+        page.
+
+        The key method for CSS stylesheets is
+        CSSStyleSheet::addSubresourceStyleURLs() which iterates over all
+        CSSStyleSheet objects recursively referenced from its own stylesheet
+        through @import rules.  Starting with the CSSRule objects in each
+        sheet and continuing down through the CSSMutableStyleDeclaration and
+        CSSValue objects, addSubresourceStyleURLs() methods are called to
+        gather URLs.
+
+        For inline style attributes in HTML DOM elements,
+        StyledElement::addSubresourceAttributeURLs() calls
+        CSSMutableStyleDeclaration::addSubresourceStyleURLs() to gather URLs
+        from each element, hence the need to call
+        addSubresourceAttributeURLs() on superclasses when the method is
+        implemented on the element class itself.
+
+        * css/CSSBorderImageValue.cpp:
+        (WebCore::CSSBorderImageValue::addSubresourceStyleURLs): Added.
+        * css/CSSBorderImageValue.h:
+        (WebCore::CSSBorderImageValue::addSubresourceStyleURLs): Added
+        declaration.
+
+        * css/CSSFontFaceRule.cpp:
+        (WebCore::CSSFontFaceRule::addSubresourceStyleURLs): Added.
+        * css/CSSFontFaceRule.h:
+        (WebCore::CSSFontFaceRule::addSubresourceStyleURLs): Added
+        declaration.
+
+        * css/CSSFontFaceSrcValue.cpp:
+        (WebCore::CSSFontFaceSrcValue::addSubresourceStyleURLs): Added.
+        * css/CSSFontFaceSrcValue.h:
+        (WebCore::CSSFontFaceSrcValue::addSubresourceStyleURLs): Added
+        declaration.
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::addSubresourceStyleURLs): Added.
+        * css/CSSImportRule.h:
+        (WebCore::CSSImportRule::addSubresourceStyleURLs): Added
+        declaration.
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::addSubresourceStyleURLs): Added.
+        Iterates over m_properties vector of CSSProperty objects calling
+        addSubresourceStyleURLs() on each property's CSSValue object.
+        * css/CSSMutableStyleDeclaration.h:
+        (WebCore::CSSMutableStyleDeclaration::addSubresourceStyleURLs): Added
+        declaration.
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::addSubresourceStyleURLs): Added.
+        * css/CSSPrimitiveValue.h:
+        (WebCore::CSSPrimitiveValue::addSubresourceStyleURLs): Added
+        declaration.
+
+        * css/CSSReflectValue.cpp:
+        (WebCore::CSSReflectValue::addSubresourceStyleURLs): Added.
+        * css/CSSReflectValue.h:
+        (WebCore::CSSReflectValue::addSubresourceStyleURLs): Added
+        declaration.
+
+        * css/CSSRule.h:
+        (WebCore::CSSRule::addSubresourceStyleURLs): Added.  Virtual
+        method with empty implementation that's overridden by subclasses
+        as needed.
+
+        * css/CSSStyleRule.cpp:
+        (WebCore::CSSStyleRule::addSubresourceStyleURLs): Added.
+        * css/CSSStyleRule.h:
+        (WebCore::CSSStyleRule::addSubresourceStyleURLs): Added
+        declaration.
+
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::addSubresourceStyleURLs): Updated to
+        call CSSRule::addSubresourceStyleURLs on each rule to extract
+        URLs.  Removed unneeded baseURL parameter now that the
+        completeURL() method exists.
+        * css/CSSStyleSheet.h:
+        (WebCore::CSSStyleSheet::addSubresourceStyleURLs): Updated
+        declaration.
+
+        * css/CSSValue.h:
+        (WebCore::CSSValue::addSubresourceStyleURLs): Added.  Virtual
+        method with empty implementation that's overridden by subclasses
+        as needed.
+
+        * css/CSSValueList.cpp:
+        (WebCore::CSSValueList::addSubresourceStyleURLs): Added.
+        Iterates over m_values vector of CSSValue objects calling
+        addSubresourceStyleURLs() on each.
+        * css/CSSValueList.h:
+        (WebCore::CSSValueList::addSubresourceStyleURLs): Added
+        declaration.
+
+        * css/StyleSheet.h:
+        (WebCore::StyleSheet::addSubresourceStyleURLs): Updated
+        declaration to remove unneeded baseURL parameter.
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::addSubresourceAttributeURLs):
+        Fixed to use the StyleBase::baseURL() method to get the
+        stylesheet's URL instead of calling Document::completeURL().
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::addSubresourceAttributeURLs): Added method
+        to extract URLs from inline style declarations.
+        * dom/StyledElement.h:
+        (WebCore::StyledElement::addSubresourceAttributeURLs): Added
+        declaration.
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::addSubresourceAttributeURLs): Call
+        addSubresourceAttributeURLs() in superclass to extract URLs
+        from inline style declarations.
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::addSubresourceAttributeURLs): Ditto.
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::addSubresourceAttributeURLs): Ditto.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::addSubresourceAttributeURLs): Ditto.
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::addSubresourceAttributeURLs): Ditto.
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::addSubresourceAttributeURLs): Ditto.
+        * html/HTMLParamElement.cpp:
+        (WebCore::HTMLParamElement::addSubresourceAttributeURLs): Ditto.
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::addSubresourceAttributeURLs): Ditto.
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::addSubresourceAttributeURLs): Ditto.
+        * html/HTMLTableCellElement.cpp:
+        (WebCore::HTMLTableCellElement::addSubresourceAttributeURLs): Ditto.
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::addSubresourceAttributeURLs): Ditto.
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::addSubresourceAttributeURLs): Ditto.
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::addSubresourceAttributeURLs): Ditto.
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::addSubresourceAttributeURLs): Ditto.
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::addSubresourceAttributeURLs): Ditto.
+
+2008-12-22  Dhananjoy Chutia  <dhanrd@gmail.com>
+
+        Reviewed by David Kilzer.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22959
+        Memory leak fixes for WebKit+soup
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::finishedCallback):
+
+2008-12-22  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6277060> ASSERTION FAILED: !m_cacheBeingUpdated if the manifest is not available
+
+        Tests: http/tests/appcache/404-manifest.html
+               http/tests/appcache/fail-on-update.html
+
+        * loader/appcache/ApplicationCacheGroup.cpp: (WebCore::ApplicationCacheGroup::stopLoading):
+        Removed the incorrect assertion.
+
+        * loader/appcache/ApplicationCacheGroup.h: Added an explanation of somewhat nonintuitive
+        m_currentHandle handling.
+
+2008-12-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Alexey Proskuryakov & George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22961
+
+        Add WML <fieldset> element support.
+        Unlike HTML's <fieldset> element, WML doesn't provide a <legend> child element
+        to describe the <fieldset>. WML instead offers a 'title' attribute on the <fieldset>
+        element. To integrate within the existing RenderFieldset code, we just create an
+        internal <insertedLegend> element as first child for a WML <fieldset> element, containing
+        the title attribute value.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        * css/wml.css:
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::RenderFieldset):
+        (WebCore::RenderFieldset::findLegend):
+        * rendering/RenderFieldset.h:
+        * rendering/RenderLegend.cpp:
+        (WebCore::RenderLegend::RenderLegend):
+        * rendering/RenderLegend.h:
+        * wml/WMLFieldSetElement.cpp: Added.
+        (WebCore::WMLFieldSetElement::WMLFieldSetElement):
+        (WebCore::WMLFieldSetElement::~WMLFieldSetElement):
+        (WebCore::WMLFieldSetElement::parseMappedAttribute):
+        (WebCore::WMLFieldSetElement::insertedIntoDocument):
+        (WebCore::WMLFieldSetElement::removedFromDocument):
+        (WebCore::WMLFieldSetElement::createRenderer):
+        * wml/WMLFieldSetElement.h: Added.
+        * wml/WMLInsertedLegendElement.cpp: Added.
+        (WebCore::WMLInsertedLegendElement::WMLInsertedLegendElement):
+        (WebCore::WMLInsertedLegendElement::~WMLInsertedLegendElement):
+        (WebCore::WMLInsertedLegendElement::createRenderer):
+        * wml/WMLInsertedLegendElement.h: Added.
+        * wml/WMLTagNames.in:
+
+2008-12-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Try to fix clean Mac builds, set role=private for FormDataBuilder.h
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2008-12-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Rubber-stamped by George Staikos.
+
+        Unify all TorchMobile copyright lines. Consolidate in a single line, as requested by Mark Rowe, some time ago.
+
+        * css/CSSStyleSelector.cpp:
+        * css/wml.css:
+        * dom/DOMImplementation.cpp:
+        * dom/Document.cpp:
+        * dom/Document.h:
+        * dom/XMLTokenizer.cpp:
+        * dom/XMLTokenizerLibxml2.cpp:
+        * dom/XMLTokenizerQt.cpp:
+        * history/BackForwardList.cpp:
+        * history/BackForwardList.h:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/MainResourceLoader.cpp:
+        * page/Page.cpp:
+        * page/Page.h:
+        * platform/MIMETypeRegistry.cpp:
+        * platform/network/FormDataBuilder.cpp:
+        * platform/network/FormDataBuilder.h:
+        * platform/qt/MIMETypeRegistryQt.cpp:
+        * wml/WMLAElement.cpp:
+        * wml/WMLAElement.h:
+        * wml/WMLAccessElement.cpp:
+        * wml/WMLAccessElement.h:
+        * wml/WMLAnchorElement.cpp:
+        * wml/WMLAnchorElement.h:
+        * wml/WMLBRElement.cpp:
+        * wml/WMLBRElement.h:
+        * wml/WMLCardElement.cpp:
+        * wml/WMLCardElement.h:
+        * wml/WMLDoElement.cpp:
+        * wml/WMLDoElement.h:
+        * wml/WMLDocument.cpp:
+        * wml/WMLDocument.h:
+        * wml/WMLElement.cpp:
+        * wml/WMLElement.h:
+        * wml/WMLErrorHandling.cpp:
+        * wml/WMLErrorHandling.h:
+        * wml/WMLEventHandlingElement.cpp:
+        * wml/WMLEventHandlingElement.h:
+        * wml/WMLGoElement.cpp:
+        * wml/WMLGoElement.h:
+        * wml/WMLImageElement.cpp:
+        * wml/WMLImageElement.h:
+        * wml/WMLImageLoader.cpp:
+        * wml/WMLImageLoader.h:
+        * wml/WMLIntrinsicEvent.cpp:
+        * wml/WMLIntrinsicEvent.h:
+        * wml/WMLIntrinsicEventHandler.cpp:
+        * wml/WMLIntrinsicEventHandler.h:
+        * wml/WMLNoopElement.cpp:
+        * wml/WMLNoopElement.h:
+        * wml/WMLOnEventElement.cpp:
+        * wml/WMLOnEventElement.h:
+        * wml/WMLPElement.cpp:
+        * wml/WMLPElement.h:
+        * wml/WMLPageState.cpp:
+        * wml/WMLPageState.h:
+        * wml/WMLPostfieldElement.cpp:
+        * wml/WMLPostfieldElement.h:
+        * wml/WMLPrevElement.cpp:
+        * wml/WMLPrevElement.h:
+        * wml/WMLRefreshElement.cpp:
+        * wml/WMLRefreshElement.h:
+        * wml/WMLSetvarElement.cpp:
+        * wml/WMLSetvarElement.h:
+        * wml/WMLTableElement.cpp:
+        * wml/WMLTableElement.h:
+        * wml/WMLTaskElement.cpp:
+        * wml/WMLTaskElement.h:
+        * wml/WMLTemplateElement.cpp:
+        * wml/WMLTemplateElement.h:
+        * wml/WMLTimerElement.cpp:
+        * wml/WMLTimerElement.h:
+        * wml/WMLVariables.cpp:
+        * wml/WMLVariables.h:
+
+2008-12-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22638
+
+        Add POST method support to WMLGoElement. GET & POST over HTTP
+        covered by a new set of WML HTTP layout tests.
+
+        Tests: http/tests/wml/go-task-get-method-accept-charset.html
+               http/tests/wml/go-task-get-method.html
+               http/tests/wml/go-task-post-method-accept-charset.html
+               http/tests/wml/go-task-post-method.html
+
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::WMLGoElement):
+        (WebCore::WMLGoElement::registerPostfieldElement):
+        (WebCore::WMLGoElement::parseMappedAttribute):
+        (WebCore::WMLGoElement::executeTask):
+        (WebCore::WMLGoElement::preparePOSTRequest):
+        (WebCore::WMLGoElement::prepareGETRequest):
+        (WebCore::WMLGoElement::createFormData):
+        * wml/WMLGoElement.h:
+        * wml/WMLPostfieldElement.cpp:
+        (WebCore::encodedString):
+        (WebCore::WMLPostfieldElement::encodeData):
+        * wml/WMLPostfieldElement.h:
+
+2008-12-21  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Darin Adler and George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22949
+
+        Refactor HTMLFormElement to share a maximum level of code between HTMLFormElement & WMLGoElement.
+        Create a new helper class 'FormDataBuilder', which is hold as member variable in those classes.
+        It encapsulates all functionality needed to generate a FormData object, usable for HTML/WML form
+        submission, including boundary string generation, multi-part form handling etc.
+
+        No functional changes, no test cases affected.
+        WMLGoElement will be converted in a follow-up patch.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::HTMLFormElement):
+        (WebCore::HTMLFormElement::dataEncoding):
+        (WebCore::HTMLFormElement::createFormData):
+        (WebCore::HTMLFormElement::submit):
+        (WebCore::HTMLFormElement::parseMappedAttribute):
+        * html/HTMLFormElement.h:
+        (WebCore::HTMLFormElement::enctype):
+        (WebCore::HTMLFormElement::encoding):
+        (WebCore::HTMLFormElement::setEncoding):
+        (WebCore::HTMLFormElement::acceptCharset):
+        * platform/network/FormDataBuilder.cpp: Added.
+        (WebCore::FormDataBuilder::FormDataBuilder):
+        (WebCore::FormDataBuilder::~FormDataBuilder):
+        (WebCore::FormDataBuilder::parseEncodingType):
+        (WebCore::FormDataBuilder::parseMethodType):
+        (WebCore::FormDataBuilder::dataEncoding):
+        (WebCore::appendString):
+        (WebCore::FormDataBuilder::beginMultiPartHeader):
+        (WebCore::FormDataBuilder::addBoundaryToMultiPartHeader):
+        (WebCore::FormDataBuilder::addFileNameToMultiPartHeader):
+        (WebCore::FormDataBuilder::addContentTypeToMultiPartHeader):
+        (WebCore::FormDataBuilder::finishMultiPartHeader):
+        (WebCore::FormDataBuilder::clear):
+        (WebCore::FormDataBuilder::addKeyValuePairAsFormData):
+        (WebCore::FormDataBuilder::encodeStringAsFormData):
+        (WebCore::FormDataBuilder::generateUniqueBoundaryString):
+        * platform/network/FormDataBuilder.h: Added.
+        (WebCore::FormDataBuilder::isPostMethod):
+        (WebCore::FormDataBuilder::setIsPostMethod):
+        (WebCore::FormDataBuilder::isMultiPartForm):
+        (WebCore::FormDataBuilder::setIsMultiPartForm):
+        (WebCore::FormDataBuilder::encodingType):
+        (WebCore::FormDataBuilder::setEncodingType):
+        (WebCore::FormDataBuilder::acceptCharset):
+        (WebCore::FormDataBuilder::setAcceptCharset):
+        (WebCore::FormDataBuilder::encodedData):
+        (WebCore::FormDataBuilder::multiPartData):
+
+2008-12-21  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler, Nikolas Zimmermann.
+
+        Move the the platform dependent strokeBBox functionality out of RenderPath
+        into Path with strokeBoundingRect.
+
+        RenderPath clean-up for strokeBoundingBox
+        [https://bugs.webkit.org/show_bug.cgi?id=22902]
+
+        * GNUmakefile.am:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/Path.h:
+        * platform/graphics/StrokeStyleApplier.h: Added.
+        (WebCore::StrokeStyleApplier::~StrokeStyleApplier):
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::strokeBoundingRect):
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::createScratchContext):
+        (WebCore::scratchContext):
+        (WebCore::Path::strokeBoundingRect):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::pen):
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::strokeBoundingRect):
+        * rendering/RenderPath.cpp:
+        (WebCore::StrokeBoundingRectStyleApplier::StrokeBoundingRectStyleApplier):
+        (WebCore::StrokeBoundingRectStyleApplier::strokeStyle):
+        (WebCore::RenderPath::relativeBBox):
+        * rendering/RenderPath.h:
+        * svg/graphics/cairo/RenderPathCairo.cpp:
+        * svg/graphics/cg/RenderPathCg.cpp:
+        * svg/graphics/qt/RenderPathQt.cpp:
+
+2008-12-20  David Kilzer  <ddkilzer@apple.com>
+
+        Fix typo "CSSAferRuleValue" to "CSSAfterRuleValue"
+
+        * html/PreloadScanner.cpp:
+        (WebCore::PreloadScanner::tokenizeCSS):
+        * html/PreloadScanner.h:
+        (WebCore::PreloadScanner::CSSState):
+
+2008-12-19  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        <rdar://problem/6454076> Random crashes on JS raytracer
+
+        No test, because the crash is not readily reproducible.
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::empty):
+        * platform/text/StringImpl.h:
+        Made empty string per-thread.
+
+2008-12-19  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Replace some uses of HardRetain etc with RetainPtr.
+
+        * platform/mac/DragImageMac.mm:
+        * platform/mac/SharedBufferMac.mm:
+        (WebCore::SharedBuffer::createCFData):
+        * rendering/RenderThemeMac.mm:
+        * svg/graphics/cg/SVGResourceFilterCg.mm:
+        (WebCore::SVGResourceFilter::prepareFilter):
+        (WebCore::SVGResourceFilter::applyFilter):
+        * svg/graphics/mac/SVGResourceFilterPlatformDataMac.h:
+        * svg/graphics/mac/SVGResourceFilterPlatformDataMac.mm:
+        (WebCore::SVGResourceFilterPlatformDataMac::SVGResourceFilterPlatformDataMac):
+
+2008-12-19  miggilin  <mr.diggilin@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Add Context Menu support to wx bindings.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22675
+
+        * platform/ContextMenu.h:
+        * platform/ContextMenuItem.h:
+        (WebCore::PlatformMenuItemDescription::PlatformMenuItemDescription):
+        * platform/wx/ContextMenuItemWx.cpp: Added.
+        * platform/wx/ContextMenuWx.cpp: Added.
+        * platform/wx/LocalizedStringsWx.cpp:
+        * platform/wx/TemporaryLinkStubs.cpp:
+        * webcore-wx.bkl:
+
+
+2008-12-19  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Temporary band-aide fix for <rdar://problem/6372481> In Gmail, a
+        crash occurs at
+        AccessibilityTable::isTableExposableThroughAccessibility() when
+        attempting to create a link in a rich text message
+
+        We need to disable Accessibility Tables until we get this fixed for
+        real to prevent rampant crashing.
+
+        * page/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::AccessibilityTable):
+
+2008-12-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=22938
+
+        When the document element is transformed, we need to paint
+        the view background to avoid unpainted areas.
+
+        Test: fast/transforms/transformed-document-element.html
+
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::paintBoxDecorations):
+
+2008-12-19  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix build.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2008-12-19  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes after recent changes.
+
+        * WebCoreSources.bkl:
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::ImageSource::clear):
+        * webcore-base.bkl:
+
+2008-12-19  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Sam Weinig.
+
+        [GTK] Fix make distcheck again
+
+        These files were moved to WebCore/platform/animation
+        and WebCore/platform/graphics/transforms.
+
+        * GNUmakefile.am:
+
+2008-12-19  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22900
+
+        Fix AtomicString usage, so that building works.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+
+2008-12-19  Adam Roben  <aroben@apple.com>
+
+        Windows build fix on older versions of CFNetwork after r39393
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::highestSupportedCFURLConnectionClientVersion): Changed
+        preprocessor directives not to leave in unreachable code on old
+        versions of CFNetwork.
+
+2008-12-19  Antti Koivisto  <antti@apple.com>
+
+        Comment fix.
+
+        * platform/PurgeableBuffer.h:
+
+2008-12-19  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        [GTK] Build fix by adding the new files.
+
+        * GNUmakefile.am:
+
+2008-12-19  Jade Han <jade.han@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Allow conversion of JavaScript Number and Boolean types to Qt types
+
+        https://bugs.webkit.org/show_bug.cgi?id=22880
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+
+2008-12-19  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Holger Freyther.
+
+        Implement ImageDecoder::filenameExtension() for Qt
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::filenameExtension):
+        * platform/graphics/qt/ImageDecoderQt.h:
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::filenameExtension):
+
+2008-12-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Alder.
+
+        Implement ImageSource::filenameExtension for Cario
+          https://bugs.webkit.org/show_bug.cgi?id=22905
+
+        * platform/graphics/cairo/ImageSourceCairo.cpp:
+        (WebCore::ImageSource::filenameExtension):
+        * platform/image-decoders/ImageDecoder.h:
+        * platform/image-decoders/bmp/BMPImageDecoder.h:
+        (WebCore::BMPImageDecoder::filenameExtension):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+        (WebCore::GIFImageDecoder::filenameExtension):
+        * platform/image-decoders/ico/ICOImageDecoder.h:
+        (WebCore::ICOImageDecoder::filenameExtension):
+        * platform/image-decoders/jpeg/JPEGImageDecoder.h:
+        (WebCore::JPEGImageDecoder::filenameExtension):
+        * platform/image-decoders/png/PNGImageDecoder.h:
+        (WebCore::PNGImageDecoder::filenameExtension):
+        * platform/image-decoders/xbm/XBMImageDecoder.h:
+        (WebCore::XBMImageDecoder::filenameExtension):
+
+2008-12-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - avoid using the ResourceHandle-level credential storage, if any,
+          unless the client opts to use it; when use of the credential
+          storage is disallowed, all authentication challenges are sent to
+          the client.
+        - let the FrameLoaderClient decide whether to use the credential
+          storage.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::shouldUseCredentialStorage): Added.
+        Returns false.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::shouldUseCredentialStorage): Added. Calls through
+        to the FrameLoaderClient.
+        * loader/FrameLoader.h: Declared shouldUseCredentialStorage().
+        * loader/FrameLoaderClient.h: Declared shouldUseCredentialStorage().
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::shouldUseCredentialStorage): Added. Calls
+        through to the FrameLoader.
+        * loader/ResourceLoader.h:
+        (WebCore::ResourceLoader::shouldUseCredentialStorage): Implemented this
+        ResourceHandleClient method.
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::shouldUseCredentialStorage): Added.
+        Overrides the ResourceLoader implementation by letting the client
+        supply the return value. If the client does not do this, continues
+        with the ResourceLoader behavior of asking the FrameLoader.
+        * loader/SubresourceLoader.h: Removed an unused #include and declared
+        shouldUseCredentialStorage().
+        * loader/SubresourceLoaderClient.h:
+        (WebCore::SubresourceLoaderClient::getShouldUseCredentialStorage):
+        Added a default implementation which returns false, meaning the client
+        does not wish to decide whether the credential storage should be used.
+        * platform/network/ResourceHandle.h: Removed unused forward declarations.
+        Declared a new member function, shouldUseCredentialStorage(), on Mac and
+        CFNetwork-using builds.
+        * platform/network/ResourceHandleClient.h:
+        (WebCore::ResourceHandleClient::shouldUseCredentialStorage): Added this
+        default implementation that returns false.
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::findCFNetworkModule): Added. Returns a handle to the CFNetwork
+        module.
+        (WebCore::cfNetworkVersion): Added. Returns the high word of the
+        CFNetwork library's product version.
+        (WebCore::highestSupportedCFURLConnectionClientVersion): Added. Returns
+        the highest version of the CFURLConnectionClient structure supported by
+        the CFNetwork library. The only reason to check this at runtime is
+        that WebKit may be linking at runtime against an older version of
+        CFNetwork than the one it was built with, as is the case with nightly
+        builds.
+        (WebCore::shouldUseCredentialStorageCallback): Added this
+        CFURLConnection callback which calls through to
+        ResourceHandle::shouldUseCredentialStorage().
+        (WebCore::ResourceHandle::start): Pass a version 3 CFURLConnectionClient
+        including the shouldUseCredentialStorage callback. At runtime, clamp the
+        client structure version down to the highest supported by CFNetwork.
+        (WebCore::ResourceHandle::shouldUseCredentialStorage): Added. Calls through
+        to the client if there is one. Otherwise returns false.
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::shouldUseCredentialStorage): Ditto.
+        (-[WebCoreResourceHandleAsDelegate connectionShouldUseCredentialStorage:]):
+        Added this delegate method which callls through to
+        ResourceHandle::shouldUseCredentialStorage().
+
+2008-12-18  David Kilzer  <ddkilzer@apple.com>
+
+        Reset role to "Private" on 6 header files to fix clean builds after r39378
+
+        Reviewed by BUILD FIX.
+
+        * WebCore.xcodeproj/project.pbxproj: Added back "Private" role
+        that was lost on 6 headers when they were "moved":
+        AffineTransform.h, Animation.h, AnimationList.h,
+        TimingFunction.h, TransformOperation.h and
+        TransformOperations.h.
+
+2008-12-18  Pamela Greene  <pam@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Add initializer for m_textDirectionSubmenuInclusionBehavior.
+        https://bugs.webkit.org/show_bug.cgi?id=22926
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Initialize m_textDirectionSubmenuInclusionBehavior
+
+2008-12-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by John Sullivan.
+
+        Add new FrameLoaderClient method to indicate the first visually
+        non-empty layout based on an heuristic.  Right now that heuristic
+        is the first layout after an image, text or plugin has been added
+        to the render tree, but I can imagine it becoming much smarter.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::dispatchDidFirstVisuallyNonEmptyLayout):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::didFirstVisuallyNonEmptyLayout):
+        * loader/FrameLoader.h:
+        * loader/FrameLoaderClient.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameViewPrivate::reset):
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::performPostLayoutTasks):
+        (WebCore::FrameView::setIsVisuallyNonEmpty):
+        * page/FrameView.h:
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::RenderImage):
+        * rendering/RenderPartObject.cpp:
+        (WebCore::RenderPartObject::RenderPartObject):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::RenderText):
+
+2008-12-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix <rdar://problem/6449841> reduce memory use of ResourceResponseBase by removing two maps
+
+        We were parsing the cache-control and pragma header field values into maps.
+        I changed that so instead we only cache two bits with the data we were actually
+        using. Later we might want to move this responsibility out of this class entirely;
+        we can cache it at the higher level instead.
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::mustRevalidate): Changed to call a specific API to get at
+        the bits in quest instead of a general "cache control directives" API.
+
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::setHTTPHeaderField): Remove the logic for the
+        pragma header field since no one is using this for now.
+        (WebCore::ResourceResponseBase::parseCacheControlDirectives): Eliminated the return
+        value and made this function have side effects only. Changed it so it's the caller's
+        responsibility to check m_haveParsedCacheControl. Set m_cacheControlContainsNoCache
+        and m_cacheControlContainsMustRevalidate rather than keeping a map around.
+
+        * platform/network/ResourceResponseBase.h:
+        (WebCore::ResourceResponseBase::cacheControlContainsNoCache): Added.
+        (WebCore::ResourceResponseBase::cacheControlContainsMustRevalidate): Added.
+        (WebCore::ResourceResponseBase::ResourceResponseBase): Updated since I removed
+        m_haveParsedCacheControl and renamed m_haveParsedCacheControlHeader to remove
+        the imprecise use of the term "header".
+
+2008-12-18  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+        Delete 2nd copy of code in these files.
+
+        * platform/animation/Animation.cpp:
+        * platform/animation/Animation.h:
+        * platform/animation/AnimationList.cpp:
+        * platform/animation/AnimationList.h:
+        * platform/animation/TimingFunction.h:
+        * platform/graphics/transforms/AffineTransform.cpp:
+        * platform/graphics/transforms/AffineTransform.h:
+        * platform/graphics/transforms/IdentityTransformOperation.h:
+        * platform/graphics/transforms/MatrixTransformOperation.cpp:
+        * platform/graphics/transforms/MatrixTransformOperation.h:
+        * platform/graphics/transforms/RotateTransformOperation.cpp:
+        * platform/graphics/transforms/RotateTransformOperation.h:
+        * platform/graphics/transforms/ScaleTransformOperation.cpp:
+        * platform/graphics/transforms/ScaleTransformOperation.h:
+        * platform/graphics/transforms/SkewTransformOperation.cpp:
+        * platform/graphics/transforms/SkewTransformOperation.h:
+        * platform/graphics/transforms/TransformOperation.h:
+        * platform/graphics/transforms/TransformOperations.cpp:
+        * platform/graphics/transforms/TransformOperations.h:
+        * platform/graphics/transforms/TranslateTransformOperation.cpp:
+        * platform/graphics/transforms/TranslateTransformOperation.h:
+
+2008-12-18  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22859
+        Abstract away the use of JSDOMWindow in CachedPage and introduce
+        ScriptCachedPageData abstraction.
+
+        * GNUmakefile.am: Added ScriptCachedPageData to project.
+        * WebCore.pro: Added ScriptCachedPageData to project.
+        * WebCore.vcproj/WebCore.vcproj: Added ScriptCachedPageData to project.
+        * WebCore.xcodeproj/project.pbxproj: Added ScriptCachedPageData to
+            project.
+        * bindings/js/ScriptCachedPageData.cpp: Added.
+        (WebCore::ScriptCachedPageData::ScriptCachedPageData):
+        (WebCore::ScriptCachedPageData::~ScriptCachedPageData):
+        (WebCore::ScriptCachedPageData::restore):
+        (WebCore::ScriptCachedPageData::clear):
+        * bindings/js/ScriptCachedPageData.h: Added.
+        * history/CachedPage.cpp: Replaced JSDOMWindow and ProtectedPtr with
+            ScriptCachedPageData.
+        (WebCore::CachedPage::CachedPage):
+        (WebCore::CachedPage::domWindow):
+        (WebCore::CachedPage::restore):
+        (WebCore::CachedPage::clear):
+        * history/CachedPage.h: Replaced JSDOMWindow and ProtectedPtr with
+            ScriptCachedPageData.
+
+2008-12-18  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22888
+
+        To avoid future dependency issues, all the TransformOperations and Animation related files need to be moved to platform
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/animation: Added.
+        * platform/animation/Animation.cpp: Copied from WebCore/rendering/style/Animation.cpp.
+        * platform/animation/Animation.h: Copied from WebCore/rendering/style/Animation.h.
+        * platform/animation/AnimationList.cpp: Copied from WebCore/rendering/style/AnimationList.cpp.
+        * platform/animation/AnimationList.h: Copied from WebCore/rendering/style/AnimationList.h.
+        * platform/animation/TimingFunction.h: Copied from WebCore/rendering/style/TimingFunction.h.
+        * platform/graphics/AffineTransform.cpp: Removed.
+        * platform/graphics/AffineTransform.h: Removed.
+        * platform/graphics/transforms: Added.
+        * platform/graphics/transforms/AffineTransform.cpp: Copied from WebCore/platform/graphics/AffineTransform.cpp.
+        * platform/graphics/transforms/AffineTransform.h: Copied from WebCore/platform/graphics/AffineTransform.h.
+        * platform/graphics/transforms/IdentityTransformOperation.h: Copied from WebCore/rendering/style/IdentityTransformOperation.h.
+        * platform/graphics/transforms/MatrixTransformOperation.cpp: Copied from WebCore/rendering/style/MatrixTransformOperation.cpp.
+        * platform/graphics/transforms/MatrixTransformOperation.h: Copied from WebCore/rendering/style/MatrixTransformOperation.h.
+        * platform/graphics/transforms/RotateTransformOperation.cpp: Copied from WebCore/rendering/style/RotateTransformOperation.cpp.
+        * platform/graphics/transforms/RotateTransformOperation.h: Copied from WebCore/rendering/style/RotateTransformOperation.h.
+        * platform/graphics/transforms/ScaleTransformOperation.cpp: Copied from WebCore/rendering/style/ScaleTransformOperation.cpp.
+        * platform/graphics/transforms/ScaleTransformOperation.h: Copied from WebCore/rendering/style/ScaleTransformOperation.h.
+        * platform/graphics/transforms/SkewTransformOperation.cpp: Copied from WebCore/rendering/style/SkewTransformOperation.cpp.
+        * platform/graphics/transforms/SkewTransformOperation.h: Copied from WebCore/rendering/style/SkewTransformOperation.h.
+        * platform/graphics/transforms/TransformOperation.h: Copied from WebCore/rendering/style/TransformOperation.h.
+        * platform/graphics/transforms/TransformOperations.cpp: Copied from WebCore/rendering/style/TransformOperations.cpp.
+        * platform/graphics/transforms/TransformOperations.h: Copied from WebCore/rendering/style/TransformOperations.h.
+        * platform/graphics/transforms/TranslateTransformOperation.cpp: Copied from WebCore/rendering/style/TranslateTransformOperation.cpp.
+        * platform/graphics/transforms/TranslateTransformOperation.h: Copied from WebCore/rendering/style/TranslateTransformOperation.h.
+        * rendering/style/Animation.cpp: Removed.
+        * rendering/style/Animation.h: Removed.
+        * rendering/style/AnimationList.cpp: Removed.
+        * rendering/style/AnimationList.h: Removed.
+        * rendering/style/IdentityTransformOperation.h: Removed.
+        * rendering/style/MatrixTransformOperation.cpp: Removed.
+        * rendering/style/MatrixTransformOperation.h: Removed.
+        * rendering/style/RotateTransformOperation.cpp: Removed.
+        * rendering/style/RotateTransformOperation.h: Removed.
+        * rendering/style/ScaleTransformOperation.cpp: Removed.
+        * rendering/style/ScaleTransformOperation.h: Removed.
+        * rendering/style/SkewTransformOperation.cpp: Removed.
+        * rendering/style/SkewTransformOperation.h: Removed.
+        * rendering/style/TimingFunction.h: Removed.
+        * rendering/style/TransformOperation.h: Removed.
+        * rendering/style/TransformOperations.cpp: Removed.
+        * rendering/style/TransformOperations.h: Removed.
+        * rendering/style/TranslateTransformOperation.cpp: Removed.
+        * rendering/style/TranslateTransformOperation.h: Removed.
+
+2008-12-18  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Bug 21855: REGRESSION (r37323): Gmail complains about popup blocking when opening a link
+        <https://bugs.webkit.org/show_bug.cgi?id=21855>
+        <rdar://problem/6278244>
+
+        If JavaScript is not currently executing, the handleEvent member function
+        of JSAbstractEventListener should set the dynamic global object to the
+        global object of the context in which the event occurred.
+
+        If this is not set, then JavaScriptCore will simply take the global object
+        of the context where the event handler function was created, which may be
+        a different frame. This will cause the popup blocker to incorrectly block
+        windows opened from onclick events inside of an iframe whose handler was
+        created in the outer frame, as it will check the outer frame and see that
+        it is not processing any events.
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSAbstractEventListener::handleEvent):
+
+2008-12-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=22570
+
+        Add the ability to compute clip rects independently from
+        caching them on the RenderLayer. When painting reflections, use
+        such temporarily computed clipRects, otherwise the layer may cache
+        clipRects which are invalid, since they have been computed with
+        a rootLayer that is not the one usually used to paint.
+
+        Test: fast/reflections/reflection-overflow-hidden.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::updateClipRects):
+        (WebCore::RenderLayer::calculateClipRects):
+        (WebCore::RenderLayer::calculateRects):
+        * rendering/RenderLayer.h:
+        (WebCore::ClipRects::ClipRects):
+        (WebCore::ClipRects::reset):
+        (WebCore::ClipRects::overflowClipRect):
+        (WebCore::ClipRects::setOverflowClipRect):
+        (WebCore::ClipRects::fixedClipRect):
+        (WebCore::ClipRects::setFixedClipRect):
+        (WebCore::ClipRects::posClipRect):
+        (WebCore::ClipRects::setPosClipRect):
+        (WebCore::ClipRects::setFixed):
+        (WebCore::ClipRects::operator==):
+        (WebCore::ClipRects::operator=):
+        * rendering/RenderReplica.cpp:
+        (WebCore::RenderReplica::paint):
+
+2008-12-17  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22618
+
+        Fix MinGW QtWebKit linking problems and also make the
+        QtWebKit build system more robust.
+
+        * WebCore.pro:
+
+2008-12-17  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22866
+
+        wml.css is based on an older copy of html4.css. Synchronize them.
+        Remove all entries, that are irrelevant for WML.
+
+        Fix <do> appearance: should behave like HTMLs <button>.
+
+        * css/wml.css:
+
+2008-12-17  Yury Semikhatsky <yurys@google.com>
+
+        Reviewed by Timothy Hatcher.
+        Landed by Adam Barth.
+
+        Added more checks that WebInspector.panels.{resources,scripts} are
+        defined where they are accessed from other panels and WebInspector
+        (some panels are not yet supported in Chrome).
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype.addMessage):
+        (WebInspector.Console.prototype.clearMessages):
+        (WebInspector.Console.prototype.completions):
+        * inspector/front-end/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertyTreeElement.prototype.evaluateExpression):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.get searchableViews):
+        (WebInspector.ScriptsPanel.prototype._sourceViewForScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._sourceFrameForScriptOrResource):
+        (WebInspector.ScriptsPanel.prototype._showScriptOrResource):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._addBreakpoint):
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+        (WebInspector.removeResource):
+        (WebInspector.showResourceForURL):
+
+2008-12-17  Cary Clark  < caryclark@google.com>
+
+        Reviewed by Darin Adler.
+        Landed by Adam Barth.
+
+        Add ENABLE_TEXT_CARET to permit the ANDROID platform
+        to invalidate and draw the caret in a separate thread.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::clearCaretRectIfNeeded): Body of
+        function does nothing if text caret is disabled.
+        (WebCore::Frame::selectionLayoutChanged): Do nothing
+        if text caret is disabled and the caret only blinked.
+        (WebCore::Frame::caretBlinkTimerFired):
+        (WebCore::Frame::paintCaret):
+        (WebCore::Frame::paintDragCaret): Body of
+        functions does nothing if text caret is disabled.
+
+2008-12-16  Darin Adler  <darin@apple.com>
+
+        Reviewed and landed by Cameron Zwarich.
+
+        Change the style of AtomicString::add() to match Identifier:add().
+
+        * platform/text/AtomicString.cpp:
+        (WebCore::AtomicString::add):
+
+2008-12-16  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22827
+        <rdar://problem/6247724> RenderThemeWin buttons have weird heavy text
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::fillFontDescription): Add version that takes a font size.
+        (WebCore::RenderThemeWin::systemFont): Use the default GUI font for control fonts, but specify the size.
+        This will match Firefox.
+
+2008-12-16  Stephanie Lewis  <slewis@apple.com>
+
+        Another build fix.
+
+        * platform/text/AtomicString.h:
+        (WebCore::AtomicString::AtomicString):
+
+2008-12-16  Stephanie Lewis  <slewis@apple.com>
+
+        Windows Build Fix.
+
+        * platform/text/AtomicString.h:
+        (WebCore::AtomicString::AtomicString):
+        (WebCore::AtomicString::createCFString):
+
+2008-12-16  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22885
+        Fix memory corruption in GIFImageDecoder.cpp with certain GIFs.
+
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::frameComplete):
+
+2008-12-16  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Change HTTPHeaderMap to use an AtomicString as its key.
+        Shaves ~1MB off of the Mozilla Memory Test
+        No functionality difference
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/InspectorController.cpp:
+        (WebCore::addHeaders):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::parseHeader):
+        * platform/network/HTTPHeaderMap.h:
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::httpHeaderField):
+        (WebCore::ResourceRequestBase::setHTTPHeaderField):
+        (WebCore::ResourceRequestBase::addHTTPHeaderField):
+        * platform/network/ResourceRequestBase.h:
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::httpHeaderField):
+        (WebCore::ResourceResponseBase::setHTTPHeaderField):
+        * platform/network/ResourceResponseBase.h:
+        * platform/text/StringHash.h:
+        (WebCore::CaseFoldingHash::hash):
+        (WebCore::CaseFoldingHash::equal):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::isSetCookieHeader):
+        (WebCore::XMLHttpRequest::setRequestHeader):
+        (WebCore::XMLHttpRequest::setRequestHeaderInternal):
+        (WebCore::XMLHttpRequest::getRequestHeader):
+        (WebCore::XMLHttpRequest::getResponseHeader):
+        * xml/XMLHttpRequest.h:
+
+2008-12-16  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22876
+
+        Remove legacy randomNumber() functionality from HTMLFormElement, and use the new wtf/RandomNumber.h.
+        Also remove an uneeded QFileInfo include while I'm at it - there is no Qt usage in this file.
+
+        * ForwardingHeaders/wtf/RandomNumber.h: Added.
+        * html/HTMLFormElement.cpp:
+        (WebCore::getUniqueBoundaryString):
+
+2008-12-16 Yael Aharon <yael.aharon@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Qt/Win build fix
+
+        * platform/win/SystemTimeWin.cpp:
+
+2008-12-16  Kalle Vahlman  <kalle.vahlman@movial.com>
+
+        Reviewed by Holger Freyther.
+
+        [CURL] memory leak of ResouceHandles
+        http://bugs.webkit.org/show_bug.cgi?id=20777
+
+        Fix ResourceHandle ref management to be consistent and correct.
+        Original patch from Marco Barisione.
+
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::start):
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::removeFromCurl):
+        (WebCore::ResourceHandleManager::add):
+        (WebCore::ResourceHandleManager::removeScheduledJob):
+
+2008-12-16  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build.
+
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::clear): Adjust to new signature.
+
+2008-12-15  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Cameron Zwarich.
+
+        <rdar://problem/6289933> Change WebKit-related projects to build with GCC 4.2 on Leopard.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+
+2008-12-15  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22871
+        <rdar://problem/6417316> RenderThemeWin buttons are too short/thin
+
+        * rendering/RenderButton.cpp: (WebCore::RenderButton::setupInnerStyle):
+        Check if the button's style (not the new inner style) has appearance set to determine whether we should set padding on the inner style.
+
+2008-12-15  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22865
+
+        Add complete WML <table> / <tr> / <td> element support.
+        Proper handling of all table related attributes, including tests.
+
+        Tests: fast/wml/table-element-align-attribute-invalid.wml (variable reference in 'align' attribute, raises error)
+               fast/wml/table-element-columns-attribute-invalid-number.wml (columns='0', raises error)
+               fast/wml/table-element-columns-attribute-invalid.wml (non-numeric 'columns' attribute value, raises error)
+               fast/wml/table-element-columns-attribute-missing.wml (missing 'columns')
+               fast/wml/table-element-columns-attribute.wml (test 'columns' attribute and <td> count mismatches)
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::offsetParent):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::addChild):
+        * wml/WMLTableElement.cpp: Added.
+        (WebCore::WMLTableElement::WMLTableElement):
+        (WebCore::WMLTableElement::~WMLTableElement):
+        (WebCore::WMLTableElement::mapToEntry):
+        (WebCore::WMLTableElement::parseMappedAttribute):
+        (WebCore::WMLTableElement::finishParsingChildren):
+        * wml/WMLTableElement.h: Added.
+        * wml/WMLTagNames.in:
+
+2008-12-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix <rdar://problem/6427048> crash due to infinite recursion after setting window.__proto__ = window
+
+        Test: fast/dom/Window/window-custom-prototype.html
+
+        Replaced toGlobalObject with the more generally useful unwrappedObject.
+
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::unwrappedObject): Added.
+        * bindings/js/JSDOMWindowShell.h: Declared unwrappedObject.
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::unwrappedObject): Ditto.
+
+2008-12-15  Gustavo Noronha Silva  <kov@kov.eti.br>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22686
+
+        GTK+ build fix.
+
+        * GNUmakefile.am:
+
+2008-12-15  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22847
+        Geolocation PositionOptions cannot be an arbitrary object.
+
+        Allow the PositionOptions to be a vanilla JS object and parse it
+        appropriately.
+
+        * DerivedSources.make: Remove PositionOptions.
+        * GNUmakefile.am: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+        * bindings/js/JSGeolocationCustom.cpp:
+        (WebCore::createPositionOptions): Added. Extracts the enableHighAccuracy
+        and timeout fields from a vanilla JS object in order to create the
+        PositionOptions object, checking for exceptions as necessary.
+        (WebCore::JSGeolocation::getCurrentPosition): Use createPositionOptions
+        instead of toPositionOptions.
+        (WebCore::JSGeolocation::watchPosition): Ditto.
+        * page/PositionOptions.idl: Removed
+
+2008-12-15  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22108
+        Large animated GIFs weren't always animating.  The code that deleted
+        the entire decoder after each frame of a large image was resulting in
+        us forgetting the loop count, breaking animations intermittently.
+
+        Instead of throwing the whole decoder away, we're more careful to just
+        delete frames we don't care about.  This additionally addresses
+        problems in the Cairo and Chromium ports with excessive peak memory
+        use and CPU use when decoding large animated GIFs because it leads to
+        much less redecoding (O(n) instead of O(n^2) CPU, and O(1) instead of
+        O(n) memory).
+
+        This change has less impact on the CG decoder, which seems to throw
+        away frames automatically when their external references are dropped;
+        this means the CG decoder didn't suffer from the peak memory usage
+        issue before (and still doesn't), but it also still burns excessive
+        CPU redecoding earlier frames, that in theory it wouldn't need to
+        redecode if it would judiciously save the most recent frames.  At
+        least this patch plumbs some useful info to the ImageSource so it can
+        help guide the CG decoder heuristics in the future.
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::frameBytes):
+        (WebCore::BitmapImage::destroyDecodedData):
+        (WebCore::BitmapImage::destroyDecodedDataIfNecessary):
+        (WebCore::BitmapImage::destroyMetadataAndNotify):
+        (WebCore::BitmapImage::clearFrame):
+        (WebCore::BitmapImage::cacheFrame):
+        (WebCore::BitmapImage::dataChanged):
+        (WebCore::BitmapImage::startAnimation):
+        (WebCore::BitmapImage::resetAnimation):
+        (WebCore::BitmapImage::internalAdvanceAnimation):
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/GeneratedImage.h:
+        (WebCore::GeneratedImage::destroyDecodedData):
+        * platform/graphics/Image.h:
+        * platform/graphics/ImageSource.h:
+        * platform/graphics/cairo/ImageSourceCairo.cpp:
+        (WebCore::ImageSource::~ImageSource):
+        (WebCore::ImageSource::clear):
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::~ImageSource):
+        (WebCore::ImageSource::clear):
+        * platform/graphics/cg/PDFDocumentImage.h:
+        (WebCore::PDFDocumentImage::destroyDecodedData):
+        * platform/graphics/qt/StillImageQt.h:
+        (WebCore::StillImage::destroyDecodedData):
+        * platform/image-decoders/ImageDecoder.h:
+        (WebCore::RGBA32Buffer::clear):
+        (WebCore::ImageDecoder::clearFrameBufferCache):
+        * platform/image-decoders/gif/GIFImageDecoder.cpp:
+        (WebCore::GIFImageDecoder::repetitionCount):
+        (WebCore::GIFImageDecoder::clearFrameBufferCache):
+        (WebCore::GIFImageDecoder::initFrameBuffer):
+        * platform/image-decoders/gif/GIFImageDecoder.h:
+        * platform/image-decoders/gif/GIFImageReader.h:
+        (GIFImageReader::GIFImageReader):
+        * svg/graphics/SVGImage.h:
+        (WebCore::SVGImage::destroyDecodedData):
+
+2008-12-15  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 22562: REGRESSION (r37971): events not firing after going back in back/forward cache
+        <https://bugs.webkit.org/show_bug.cgi?id=22562>
+        <rdar://problem/6414593>
+
+        Restore the Frame's DOMWindow to its previous value when going back in
+        the back/forward cache. The fact that it was not getting set before may
+        have always caused some subtle bugs with the back/forward cache, but
+        after r37971, it causes no events to fire after restoring a page.
+
+        Previously, ScriptController::clearScriptObjects() was calling
+        clearPlatformScriptObjects(), which was not actually clearing any
+        objects, only updating them to reflect some change in state. Since the
+        window shell was not updated until after the call to clearScriptObjects(),
+        this didn't actually make that much sense.
+
+        We rename clearPlatformScriptObjects() to reflect its actual purpose and
+        call it after the window shell has been updated rather than before.
+
+        Unfortunately, there is no way to test this with a layout test because
+        it involves the back/forward cache.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::updatePlatformScriptObjects): Renamed from
+        clearPlatformScriptObjects(), because the only nonempty implementation
+        doesn't actually clear any objects, it updates them. Also made public.
+        (WebCore::ScriptController::clearScriptObjects): Remove the call to
+        clearPlatformScriptObjects().
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::updatePlatformScriptObjects):
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::domWindow): Added.
+        * history/CachedPage.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::cancelAndClear): Added call to updatePlatformScriptObjects().
+        (WebCore::FrameLoader::begin): Added call to updatePlatformScriptObjects().
+        (WebCore::FrameLoader::open): Added call to updatePlatformScriptObjects().
+        * page/Frame.cpp:
+        (WebCore::Frame::setDOMWindow): Added.
+        (WebCore::Frame::pageDestroyed): Added call to updatePlatformScriptObjects().
+        * page/Frame.h:
+
+2008-12-15  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin Adler.
+
+        When a resource is cached locally, WebKit should follow RFC 2616 "Specific end-to-end revalidation" instead of "Unspecified end-to-end revalidation"
+        https://bugs.webkit.org/show_bug.cgi?id=17998
+
+        - Enable conditional revalidation for reloads by default.
+        - Add a parameter to FrameLoader::reload() for forcing end-to-end reload.
+        - To avoid duplicating state remove m_cachePolicy variables from FrameLoader and DocLoader.
+          Instead synthezise the policy on demand.
+
+        This speeds up reloads and makes them use way less bandwidth.
+
+        * WebCore.base.exp:
+        * loader/CachePolicy.h: Rename CachePolicyRefresh to CachePolicyRevalidate.
+        (WebCore::):
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::DocLoader):
+        (WebCore::DocLoader::checkForReload): Support CachePolicyRevalidate.
+        (WebCore::DocLoader::requestResource):
+        (WebCore::DocLoader::cachePolicy):
+        * loader/DocLoader.h: Get rid of m_cachePolicy member.
+        * loader/FrameLoader.cpp:
+        (WebCore::ScheduledRedirection::ScheduledRedirection):
+            Add parameter to differentiate refresh from other types of redirects.
+            m_cachePolicy was used for signaling this before.
+        (WebCore::isBackForwardLoadType):
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::changeLocation):
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::receivedFirstData):
+        (WebCore::FrameLoader::write):
+        (WebCore::FrameLoader::startIconLoader):
+        (WebCore::FrameLoader::restoreDocumentState):
+        (WebCore::FrameLoader::scheduleHTTPRedirection):
+        (WebCore::FrameLoader::scheduleLocationChange):
+        (WebCore::FrameLoader::scheduleRefresh):
+        (WebCore::FrameLoader::redirectionTimerFired):
+        (WebCore::FrameLoader::canCachePage):
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::reload):
+            Differentiate between revalidation and reload.
+            No need to use setHTTPHeaderField here, addExtraFieldsToRequest will set the headers.
+        (WebCore::FrameLoader::transitionToCommitted):
+        (WebCore::FrameLoader::cachePolicy): Determine the cache policy based on current load type.
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame):
+        (WebCore::FrameLoader::addExtraFieldsToRequest): Set Cache-control: no-cache for FrameLoadTypeReloadFromOrigin
+        (WebCore::FrameLoader::shouldScrollToAnchor):
+        (WebCore::FrameLoader::loadItem):
+        (WebCore::FrameLoader::updateHistoryForReload):
+        (WebCore::FrameLoader::updateHistoryForCommit):
+        (WebCore::FrameLoader::switchOutLowBandwidthDisplayIfReady):
+        * loader/FrameLoader.h:
+        * loader/FrameLoaderTypes.h: Add FrameLoadTypeReloadFromOrigin
+        (WebCore::):
+        * loader/NavigationAction.cpp:
+        (WebCore::navigationType):  Support FrameLoadTypeReloadFromOrigin
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::servePendingRequests):
+
+2008-12-15  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        Add null checks to PlatformScreenQt
+
+        The other ports do the null checks and JSDOMWindowBase is
+        at least one caller that is passing 0.
+
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+
+2008-12-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        <rdar://problem/6444455> Worker Thread crash running multiple workers for a moderate amount of time
+
+        * dom/WorkerThread.cpp: (WebCore::WorkerThread::workerThread):
+        Detach the thread. Without this, one page of its stack was never unmmaped, and fragmentation
+        made RegisterFile allocaiton fail after a while.
+
+2008-12-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - half of https://bugs.webkit.org/show_bug.cgi?id=17425
+          eliminate DeprecatedPtrList
+
+        * dom/Document.cpp:
+        (WebCore::Document::removeImage): Change to set slots in the vector
+        to 0 rather than removing items from a list.
+        (WebCore::Document::dispatchImageLoadEventsNow): Rewrite to process
+        the list. Since we now use a "set to zero" design, we don't need to
+        be careful about where the iterator points while iterating the list,
+        instead we just have to skip zeros.
+
+        * dom/Document.h: Use Vector instead of DeprecatedPtrList.
+
+        * dom/EventTargetNode.cpp:
+        (WebCore::EventTargetNode::dispatchGenericEvent): Use a Vector instead
+        of a DeprecatedPtrList for the list of nodes to handle. Also streamlined
+        the logic a bit and used goto in a couple key places.
+
+        * dom/Node.cpp:
+        (WebCore::Node::eventParentNode): Moved this function into this file
+        because it's a virtual function so already can't be inlined. Also updated
+        to return a ContainerNode, so it needs to be in a place where the
+        definition of ContainerNode is visible, not the header file.
+
+        * dom/Node.h: Changed return type of eventParentNode to ContainerNode
+        and moved its definition into the cpp file.
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::PendingCallbacks::~PendingCallbacks): Added a call to
+        deleteAllValues here instead of setAutoDelete in the constructor, since
+        we're using Deque instead of DeprecatedPtrList.
+        (WebCore::PendingCallbacks::callAndRemoveFirstCallback): Changed the
+        code to use an OwnPtr since the deque won't delete the callback object.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyRelativeFontStyleChange): Use a
+        Vector instead of a DeprecatedPtrList.
+
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::eventParentNode): Moved this function into this file
+        because it's a virtual function so already can't be inlined. Also updated
+        to return a ContainerNode.
+
+        * svg/SVGElement.h: Changed setShadowParentNode to take a ContainerNode*,
+        made eventParentNode return a ContainerNode*, and made m_shadowParent a
+        ContainerNode*.
+
+2008-12-14  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22857
+
+        Jumps within a WML deck using <go> task elements fail. Manual reloading
+        is necessary to display the page - fix cache-policy in WMLGoElement::executeTask
+        to prevent the problem.
+
+        Refactor setActiveCardInDocument in two new functions: findNamedCardInDocument
+        and determineActiveCard, to fix a side-effect of executing a <go> task:
+        when switching cards within a deck the active card was changed before the load
+        was fired which resulted in a flash effect on the screen, and doing unnecessary work.
+
+        Test: wml/go-task-animation.html
+
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::findNamedCardInDocument):
+        (WebCore::WMLCardElement::determineActiveCard):
+        * wml/WMLCardElement.h:
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::finishedParsing):
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::executeTask):
+        (WebCore::WMLGoElement::prepareGETRequest):
+        * wml/WMLGoElement.h:
+
+2008-12-14  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fixes an issue in cairo. A fully transparent color can cause wrong
+        drawings on canvas' composite.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22846
+        [CAIRO] Canvas: transparent color and composite
+
+        Test: fast/canvas/canvas-transparency-and-composite.html
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+
+2008-12-13  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 22665: Remove setCreatedByParser(bool) from the few elements that use it
+        https://bugs.webkit.org/show_bug.cgi?id=22665
+
+        Remove setCreatedByParser from frame and iframe.
+
+        * html/HTMLElementFactory.cpp:
+        (WebCore::frameConstructor):
+        (WebCore::iframeConstructor):
+        (WebCore::objectConstructor):
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::HTMLFrameElement):
+        * html/HTMLFrameElement.h:
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::HTMLFrameElementBase):
+        * html/HTMLFrameElementBase.h:
+        * html/HTMLFrameOwnerElement.cpp:
+        (WebCore::HTMLFrameOwnerElement::HTMLFrameOwnerElement):
+        * html/HTMLFrameOwnerElement.h:
+        (WebCore::HTMLFrameOwnerElement::createdByParser):
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::HTMLIFrameElement):
+        * html/HTMLIFrameElement.h:
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::HTMLPlugInElement):
+        * html/HTMLTagNames.in:
+
+2008-12-13  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22843
+        Auto-generate JSWorkerContext
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/WorkerContext.idl: Added.
+        * page/DOMWindow.idl:
+        Added ExtendsDOMGlobalObject, a new attribute for behaviors common to DOMWindow and
+        WorkerContext.
+
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::initScript):
+        Made JSWorkerContext creation look more like JSDOMWindow creation, to work with generated code.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSWorkerContext.cpp: Removed.
+        * bindings/js/JSWorkerContext.h: Removed.
+        * bindings/js/JSWorkerContextBase.cpp: Copied from WebCore/bindings/js/JSWorkerContext.cpp.
+        (WebCore::JSWorkerContextBase::JSWorkerContextBase):
+        (WebCore::JSWorkerContextBase::~JSWorkerContextBase):
+        (WebCore::JSWorkerContextBase::scriptExecutionContext):
+        (WebCore::getJSWorkerContextBaseTable):
+        (WebCore::):
+        (WebCore::JSWorkerContextBase::put):
+        * bindings/js/JSWorkerContextBase.h: Copied from WebCore/bindings/js/JSWorkerContext.h.
+        * bindings/js/JSWorkerContextCustom.cpp: Added.
+        (WebCore::JSWorkerContext::customGetOwnPropertySlot):
+        (WebCore::JSWorkerContext::mark):
+        (WebCore::JSWorkerContext::self):
+        (WebCore::JSWorkerContext::setSelf):
+        (WebCore::JSWorkerContext::addEventListener):
+        (WebCore::JSWorkerContext::removeEventListener):
+        Moved code around. Note that currently, JSWorkerContextBase lookup table is empty, but we'll
+        need to add some global objects to it in the future, as it is done in JSDOMWindowBase.
+
+        * page/WorkerNavigator.cpp:
+        * page/WorkerNavigator.h:
+        Added ENABLE(WORKERS) ifdefs.
+
+2008-12-13  Darin Adler  <darin@apple.com>
+
+        - fix Release build
+
+        * dom/Node.cpp:
+        (WebCore::Node::rareData): Remove inappropriate inline directive.
+
+2008-12-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=18734
+          REGRESSION (r31081): Focus problems in Gmail 2/Plain text message text
+          <rdar://problem/5892415>
+
+        Test: fast/forms/textarea-selection-preservation.html
+
+        The regression reported was caused by the fact that the renderer code had
+        a bug where it would constantly think the newline at the end of text was
+        missing, and so it would replace all the text even though it wasn't changing,
+        which would destroy the selection.
+
+        When writing the regression test I discovered another problem: The value
+        property in HTMLTextAreaElement was intentionally changing the selection
+        to the end of the textarea, but doing that even when the value wasn't changing.
+
+        This patch fixes both and the test checks both.
+
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::setValue): Exit early if the value is
+        not changing.
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::text): Add a newline character for each <br>
+        element encountered in the control
+
+2008-12-13  Darin Adler  <darin@apple.com>
+
+        - file deletion part of https://bugs.webkit.org/show_bug.cgi?id=17497
+          eliminate DeprecatedValueList
+
+        * GNUmakefile.am: Removed references to deleted files.
+        * WebCore.pro: Ditto.
+        * WebCore.scons: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+        * platform/DeprecatedPtrQueue.h: Removed.
+        * platform/DeprecatedValueList.h: Removed.
+        * platform/DeprecatedValueListImpl.cpp: Removed.
+        * platform/DeprecatedValueListImpl.h: Removed.
+
+2008-12-13  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=17497
+          eliminate DeprecatedValueList
+
+        * css/CSSStyleDeclaration.cpp: Removed unneeded include.
+
+        * dom/Document.cpp:
+        (WebCore::Document::removeAllEventListenersFromAllNodes):
+        Set the removed flag on the window event listeners in case we
+        are in the middle of dispatching events on this window.
+        (WebCore::Document::clear): Ditto.
+        (WebCore::Document::handleWindowEvent): Changed to use a vector
+        instead of a DeprecatedPtrList.
+        (WebCore::Document::windowInlineEventListenerForType): Ditto.
+        (WebCore::Document::removeWindowInlineEventListenerForType): Ditto.
+        Also added a call to setRemoved, which is needed here just as in
+        other functions that remove.
+        (WebCore::Document::removeWindowEventListener): Ditto.
+        (WebCore::Document::hasWindowEventListener): Ditto.
+
+        * dom/Document.h: Changed RegisteredEventListenerList to
+        RegisteredEventListeners.
+
+        * dom/Element.cpp:
+        (WebCore::Element::attach): Use a function to access rare data instead
+        of getting directly at the data field.
+        (WebCore::Element::focus): Ditto.
+        (WebCore::Element::cancelFocusAppearanceUpdate): Ditto.
+
+        * dom/ElementRareData.h: Use "using" to make things that are protected
+        in NodeRareData be public here.
+
+        * dom/EventTarget.h: Removed include of DeprecatedValueList and
+        related declearations that weren't needed. Tweaked the definitions
+        of the forbidEventDispatch functions too.
+
+        * dom/EventTargetNode.cpp:
+        (WebCore::EventTargetNode::EventTargetNode): Eliminated code that
+        was used to initialized m_regdListeners.
+        (WebCore::EventTargetNode::~EventTargetNode): Elminated delete of
+        m_regdListeners. Changed code to use eventListeners() instead of
+        m_regdListeners.
+        (WebCore::EventTargetNode::eventListeners): Added.
+        (WebCore::EventTargetNode::insertedIntoDocument): Use eventListeners.
+        (WebCore::EventTargetNode::removedFromDocument): Ditto.
+        (WebCore::EventTargetNode::willMoveToNewOwnerDocument): Ditto.
+        (WebCore::EventTargetNode::didMoveToNewOwnerDocument): Ditto.
+        (WebCore::EventTargetNode::addEventListener): Ditto.
+        (WebCore::EventTargetNode::removeEventListener): Ditto.
+        (WebCore::EventTargetNode::removeAllEventListeners): Ditto.
+        Also added code to call setRemoved on all the listeners.
+        (WebCore::EventTargetNode::handleLocalEvents): Ditto.
+        (WebCore::EventTargetNode::dispatchGenericEvent): Fixed indentation.
+        (WebCore::EventTargetNode::removeInlineEventListenerForType): Use
+        the new event listeners vector. Also added missing call to setRemoved.
+        (WebCore::EventTargetNode::inlineEventListenerForType): Ditto.
+
+        * dom/EventTargetNode.h: Added a new RegisteredEventListenerVector
+        type and replaced the old localEventListeners function with a new
+        eventListeners function. Removed m_regdListeners.
+
+        * dom/Node.cpp:
+        (WebCore::Node::childNodes): Removed unneeded std prefix.
+        (WebCore::Node::setFocus): Use function instead of going directly
+        at rare data.
+        (WebCore::Node::rareDataFocused): Ditto.
+        (WebCore::Node::registerDynamicNodeList): Removed unneeded std prefix.
+        (WebCore::Node::getElementsByName): Ditto.
+        (WebCore::Node::getElementsByClassName): Ditto.
+        (WebCore::Node::compareDocumentPosition): Ditto.
+
+        * dom/Node.h: Removed unneeded forward declaration of
+        RegisteredEventListener. This is now in EventTargetNode.
+
+        * dom/NodeRareData.h: Renamed m_focused to m_isFocused and made it
+        private. Made m_needsFocusAppearanceUpdateSoonAfterAttach private.
+        Added listeners and ensureListeners functions as well as isFocused,
+        setFocused, and focus-appearance functions. Made all data members private.
+
+        * dom/RegisteredEventListener.cpp: Removed operator ==.
+        * dom/RegisteredEventListener.h: Removed operator == and !=.
+
+        * svg/SVGElement.cpp:
+        (WebCore::hasLoadListener): Rewrote to work with the vector.
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::transferEventListenersToShadowTree): Ditto.
+
+2008-12-13  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22824
+
+        Change ENABLE(FONT_FAST_PATH) to USE(FONT_FAST_PATH). With r39206
+        floatWidth always used the complex path causing a regression
+        in the pixel tests.
+
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::floatWidth): Use the fast path again
+
+2008-12-13  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fixes behavior of gradients on empty path in canvas/Cg
+
+        https://bugs.webkit.org/show_bug.cgi?id=22844
+        [Cg] Canvas fill() draws gradients even without a path
+
+        Test: fast/canvas/canvas-gradient-without-path.html
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::fill):
+        (WebCore::CanvasRenderingContext2D::stroke):
+
+2008-12-13  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix.
+
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::ImageSource::filenameExtension):
+
+2008-12-12  Brent Fulgham  <bfulgham@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22805
+
+        Provides implementation of image dragging logic for Windows Cairo
+        back-end.
+
+        * platform/win/DragImageCGWin.cpp:
+        (WebCore::deallocContext): Add a generic CGContextRef destructor.
+        * platform/win/DragImageCairoWin.cpp:
+        (WebCore::deallocContext): Add a generic cairo_* destructor.
+        (WebCore::allocImage):  New implementation to allocate a Cairo
+        surface of a specified size.
+        (WebCore::createCairoContextFromBitmap): New implementation to
+        create a Cairo surface from a Windows BITMAP.
+        (WebCore::scaleDragImage): Replace stub with implementation to
+        actually create a scaled image.
+        (WebCore::createDragImageFromImage): Replace stub with implementation
+        to actually create an image.
+
+2008-12-12  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Expose WebKitAnimationEvent, WebKitTransitionEvent,
+        WebKitCSSTransformValue, WebKitCSSKeyframeRule and
+        WebKitCSSKeyframesRule to Window object.
+        This required generating constructors for the event
+        interfaces.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20560
+
+        * dom/WebKitAnimationEvent.idl:
+        * dom/WebKitTransitionEvent.idl:
+        * page/DOMWindow.idl:
+
+2008-12-12  Dave Moore  <davemoore@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=22798
+
+        In Font::drawTextUsingSVGFont() a variable of type SVGTextRunWalkerDrawTextData
+        is created on the stack (called data). One of its fields, charsConsumed, is
+        unitialized, leading to random values after calling walk() on the
+        SVGTextRunWalker created with it. I now initialize the variable
+
+        This bug was revealed in our Purify run. I don't know of any specific incorrect
+        behavior caused by it but it would lead to the charsConsumed field having a
+        a wrong value.
+
+        * svg/SVGFont.cpp:
+        (WebCore::Font::drawTextUsingSVGFont):
+
+2008-12-12  Beth Dakin  <bdakin@apple.com>
+
+        Rubber Stamped by Steve Falkenburg.
+
+        Build fix.
+
+        * platform/KURL.h:
+
+2008-12-12  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add the ability so that Google-URL can optionally be used in a build
+        of WebKit without changing the shared header. The guts of KURL are
+        optionally ifdefed out, and the replacement code goes in a different
+        header to avoid polluting KURL.h
+
+        * platform/KURL.cpp:
+        * platform/KURL.h:
+        (WebCore::KURL::string):
+        (WebCore::KURL::operator const String&):
+        (WebCore::KURL::operator JSC::UString):
+        (WebCore::KURL::operator NSString*):
+        (WebCore::KURL::parsed):
+        (WebCore::KURL::utf8String):
+        (WebCore::KURL::isNull):
+        (WebCore::KURL::isEmpty):
+        (WebCore::KURL::isValid):
+        (WebCore::KURL::hostStart):
+        (WebCore::KURL::hostEnd):
+        (WebCore::KURL::pathStart):
+        (WebCore::KURL::pathEnd):
+        (WebCore::KURL::pathAfterLastSlash):
+
+2008-12-11  Steve Falkenburg  <sfalken@apple.com>
+
+        Delete the previous timer-queue timer in the main thread, just prior to scheduling a new timer.
+        The code previously called DeleteTimerQueueTimer in the timer callback proc.
+
+        The new technique simplifies the code, since we now create and delete timers on the
+        same thread, and don't access the timer queue or timer handles in the callback.
+        This allows us to remove some mutex use, and more importantly, it solves a race
+        condition that was occuring between ChangeTimerQueueTimer and DeleteTimerQueueTimer.
+
+        Since the timer callback isn't passed the timer handle, we were retrieving that handle
+        via a global. If the timer callback code was entered, but then a new timer was immediately
+        scheduled (prior to the callback acquiring the mutex and calling DeleteTimerQueueTimer),
+        there was a small window where the timer could be re-scheduled via ChangeTimerQueueTimer
+        and then immediately deleted once the already running callback acquired the mutex and
+        then called DeleteTimerQueueTimer. This resulted in the newly scheduled timer never firing.
+
+        Reviewed by Oliver Hunt.
+
+        * platform/win/SharedTimerWin.cpp:
+        (WebCore::queueTimerProc): Don't delete the timer in the callback.
+        (WebCore::setSharedTimerFireTime): Always delete and create the timer instead of using ChangeTimerQueueTimer.
+        (WebCore::stopSharedTimer): Call DeleteTimerQueueTimer directly.
+
+2008-12-12  Kai Brüning  <kai@granus.net>
+
+        Reviewed and tweaked by Darin Adler.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=18205
+          DOMNode objects are garbage collected although there are strong references
+          <rdar://problem/6441200>
+
+        Fixes resurrection bug for wrapper objects by using an NSMapTable with zeroing weak
+        memory for the wrapper reference for DOMWrapperCache (DOMInternal.mm),
+        JSWrapperCache (WebScriptObject.mm) and wrapperCache (DOMRGBColor.mm).
+        BUILDING_ON_TIGER is used to create a Leopard-only NSMapTable or an old-style
+        procedural map table for Tiger systems.
+
+        No regression tests yet since we don't currently run any tests in GC mode.
+
+        * bindings/objc/DOMInternal.h: added WebCore::createWrapperCache for use by all three caches
+        * bindings/objc/DOMInternal.mm:
+        (WebCore::createWrapperCache): Contains the compile-time check for map table creation
+        (WebCore::getDOMWrapper): HashMap -> NSMapTable
+        (WebCore::addDOMWrapper): ditto
+        (WebCore::removeDOMWrapper): ditto
+        * bindings/objc/DOMObject.mm: removed [DOMObject finalize]
+        * bindings/objc/DOMRGBColor.mm: removed [DOMRGBColor finalize]
+        (WebCore::getWrapperForRGB): CFMutableDictionaryRef -> NSMapTable
+        (WebCore::setWrapperForRGB): ditto
+        (WebCore::removeWrapperForRGB): ditto
+        * bindings/objc/WebScriptObject.mm:
+        (WebCore::getJSWrapper): HashMap -> NSMapTable
+        (WebCore::addJSWrapper): ditto
+        (WebCore::removeJSWrapper): ditto
+        (-[WebScriptObject finalize]): removed call of removeJSWrapper()
+
+2008-12-12  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22813
+        Remove unused references to JSDOMBinding, CallFrame, and JSLock.
+
+        * dom/Node.cpp: Removed CallFrame and JSLock header includes.
+        * loader/FrameLoader.cpp: Removed JSDOMBinding header include.
+
+2008-12-12  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        Update the WebKit.qrc and add a script to automatically generate the file.
+
+        With the way rcc and qmake work this can not be done at build time
+        as the WebKit.qrc must sit inside the directory that contains the files
+        and at build time we may not change the content of the source directory.
+
+        * inspector/front-end/WebKit.qrc: Updated with new script
+
+2008-12-12  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        REGRESSION: Canvas is broken in high dpi mode
+        <rdar://problem/6432739> <https://bugs.webkit.org/show_bug.cgi?id=22823>
+
+        Simply made sure that we correctly scale the graphics context to
+        account for the difference between logical and buffer resolution.
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createImageBuffer):
+        (WebCore::HTMLCanvasElement::baseTransform):
+
+2008-12-12  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Share PluginView::paintMissingPluginIcon() between ports
+
+        Also, enable this feature for Qt/X11, Qt/Mac and GTK
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::paintMissingPluginIcon):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::paint):
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::paint):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paint):
+        * plugins/win/PluginViewWin.cpp:
+
+2008-12-12  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt/Mac] Implement PluginView::updatePluginWidget()
+
+        We should update the window and clip rect regardless of whether or
+        not the plugin has been loaded, for example to ensure that the
+        missing plugin image is placed correctly.
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::updatePluginWidget):
+
+2008-12-12  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Rubber-stamped by Oliver Hunt.
+
+        Make PluginView::updatePluginWidget() non-const
+
+        We can do this now since frameRectsChanged() is no longer const. This
+        also allows us to get rid of the mutables in the PluginView.
+
+        * platform/qt/TemporaryLinkStubs.cpp:
+        (PluginView::updatePluginWidget):
+        * plugins/PluginView.h:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        * plugins/wx/PluginViewWx.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+
+2008-12-12  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Implement ImageSource::filenameExtension() for the Qt port
+
+        We're using QImageReader::imageFormat().toLower() to check
+        that the image format is supported, and if it is we store
+        the resulting extension when creating the ImageDecoderQt.
+
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        (WebCore::ImageDecoderQt::create):
+        (WebCore::ImageDecoderQt::ImageDecoderQt):
+        (WebCore::ImageDecoderQt::imageFormat):
+        * platform/graphics/qt/ImageDecoderQt.h:
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::setData):
+        (WebCore::ImageSource::filenameExtension):
+
+2008-12-11  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Geoff Garen
+
+        Account for the size of the response and request headers as well as other overhead
+        when calculating the size a resource takes up in the cache.  Halts unbounded
+        growth in the cache.  Reduced stress test memory high water marks by > 50%.
+
+        Uses estimates gathered from the stress test to set the overhead size.
+        A version of the patch was created that calculated most of the sizes, but it was
+        decided that the patch was still at a basic level an estimate.  What gains it made
+        in accuracy was offset by the complexity involved in creating and updating the
+        estimate.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::resourceAccessed):
+        (WebCore::Cache::TypeStatistic::addResource):
+        (WebCore::Cache::dumpLRULists):
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::overheadSize):
+        * loader/CachedResource.h:
+        (WebCore::CachedResource::size):
+
+2008-12-11  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Holger Freyther.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22814
+
+        Add <wml> image element support. Based on HTML/SVGImage{Element/Loader}, with
+        the only difference that WML defines a second source attribute 'localsrc', that
+        takes precedence over the 'src' attribute. If loading the 'localsrc' attribute
+        fails, the user agent should try loading the 'src' attribute. If both fail the
+        'alt' fallback content will be used - just like in HTML.
+
+        Fixes: fast/wml/img-localsrc.wml (<img> and 'localsrc' attribute)
+               fast/wml/img-src-localsrc-alt.wml ('localsrc'/'src' fallback handling)
+               fast/wml/img-src.wml (<img> and 'src' attribute)
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::altDisplayString):
+        (WebCore::HitTestResult::absoluteImageURL):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::updateAltText):
+        * wml/WMLImageElement.cpp: Added.
+        (WebCore::WMLImageElement::WMLImageElement):
+        (WebCore::WMLImageElement::~WMLImageElement):
+        (WebCore::WMLImageElement::mapToEntry):
+        (WebCore::WMLImageElement::parseMappedAttribute):
+        (WebCore::WMLImageElement::attach):
+        (WebCore::WMLImageElement::createRenderer):
+        (WebCore::WMLImageElement::insertedIntoDocument):
+        (WebCore::WMLImageElement::isURLAttribute):
+        (WebCore::WMLImageElement::imageSourceAttributeName):
+        (WebCore::WMLImageElement::altText):
+        * wml/WMLImageElement.h: Added.
+        (WebCore::WMLImageElement::useFallbackAttribute):
+        (WebCore::WMLImageElement::setUseFallbackAttribute):
+        * wml/WMLImageLoader.cpp: Added.
+        (WebCore::WMLImageLoader::WMLImageLoader):
+        (WebCore::WMLImageLoader::~WMLImageLoader):
+        (WebCore::WMLImageLoader::dispatchLoadEvent):
+        (WebCore::WMLImageLoader::sourceURI):
+        (WebCore::WMLImageLoader::notifyFinished):
+        * wml/WMLImageLoader.h: Added.
+        * wml/WMLTagNames.in:
+
+2008-12-11  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22043
+
+        Do not run into the WebCore::DocumentLoader::updateLoading
+        ASSERT on Gtk+/CURL when trying to load tests from our LayoutTests.
+
+        Do not call setPrimaryLoadComplete when the
+        activeDocumentLoader has already been replaced. This can happen
+        when a script executed from within FramerLoader::didFinishLoading will
+        navigate to another URL.
+
+        The assertion is caused by existing tests (e.g.
+        fast/history/clicked-link-is-visited.html) reproducing this with
+        network backends not equal to curl is tough or maybe not
+        even possible.
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::setPrimaryLoadComplete):
+
+2008-12-11  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Eric Seidel.
+
+        - Remove some dead, commented-out code from WMLAElement.
+        - Add missing virtual destructor for <noop>, as suggested by Alexey.
+        - Refactor addHTMLAlignment in a static helper function to share with WML.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::addHTMLAlignment):
+        (WebCore::HTMLElement::addHTMLAlignmentToStyledElement):
+        * html/HTMLElement.h:
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::defaultEventHandler):
+        * wml/WMLNoopElement.cpp:
+        (WebCore::WMLNoopElement::~WMLNoopElement):
+        * wml/WMLNoopElement.h:
+
+2008-12-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/6302405> Crash (null-deref) when using :before pseudoselector with content CSS rule in SVG
+        <https://bugs.webkit.org/show_bug.cgi?id=22804>
+
+        This issue was caused by css generated content resulting in non-svg flowboxes
+        being injected into SVG content.  As SVG spec does not describe behaviour in
+        this case, and neither Opera nor Firefox displays such generated content, so
+        now we make svg text layout and rendering just ignore any such content.
+
+        Test: svg/css/crash-css-generated-content.xhtml
+
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::buildLayoutInformation):
+        (WebCore::SVGRootInlineBox::layoutInlineBoxes):
+        (WebCore::SVGRootInlineBox::buildTextChunks):
+
+2008-12-11  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Bug 21256: REGRESSION (r36906): horizontally repeating image leaves ghosts when vertical scrolling
+        <https://bugs.webkit.org/show_bug.cgi?id=21256>
+        <rdar://problem/6362978>
+
+        The ScrollView refactoring in r36906 caused the ScrollView and the
+        platform widget to disagree about whether optimizing scrolling via
+        blitting is allowed. The easiest way to fix this is to make ScrollView
+        simply ask the platform widget whether this is safe on platforms that
+        are affected.
+
+        It is not possible to write a layout test for this bug because it
+        involves the back/forward cache.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::setCanBlitOnScroll):
+        (WebCore::ScrollView::canBlitOnScroll):
+        (WebCore::ScrollView::platformSetCanBlitOnScroll):
+        (WebCore::ScrollView::platformCanBlitOnScroll):
+        * platform/ScrollView.h:
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::platformSetCanBlitOnScroll):
+        (WebCore::ScrollView::platformCanBlitOnScroll):
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::platformSetCanBlitOnScroll):
+        (WebCore::ScrollView::platformCanBlitOnScroll):
+
+2008-12-11  Brent Fulgham  <bfulgham@gmail.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22808
+
+        Correct build break due to malformed XML in Visual Studio project
+        following @r39205 change.
+
+        * WebCore.vcproj/WebCore.vcproj: Correct file entry so project loads.
+
+2008-12-10  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=22738
+
+        This gets rid of the per-animation timers which were used when an animation
+        started, ended and looped. Their job is now done by the main AnimationController's
+        timer. It is now set to fire as needed. For instance, if there is a delay, it will
+        fire after the delay time and then every 30ms to run the animation. The start, loop
+        and end events are generated as needed during the firing of this timer.
+
+        I had to add one more bit of code. When animation timers used to fire the animation events.
+        This would always happen from the RunLoop, so any style changes that happened in the
+        event handler would get picked up on the next updateRendering() call. But now the start
+        event is generated during the styleIsAvailable() call, which is in the middle of the
+        updateRendering() cycle. And calling an event handler in the middle of updateRendering()
+        is not allowed and causes style changes to get missed. We already have a mechanism in
+        AnimationController to defer updateRendering() calls. So I added logic to defer all
+        event handling to there. Now, I put any request for event handling into a list and ask
+        for a deferred updateRendering() call. When that deferred timer fires, I go through that
+        list, send all the events and then call updateRendering().
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::AnimationBase):
+        (WebCore::AnimationBase::updateStateMachine):
+        (WebCore::AnimationBase::fireAnimationEventsIfNeeded):
+        (WebCore::AnimationBase::willNeedService):
+        (WebCore::AnimationBase::goIntoEndingOrLoopingState):
+        * page/animation/AnimationBase.h:
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
+        (WebCore::AnimationControllerPrivate::updateRenderingDispatcherFired):
+        (WebCore::AnimationControllerPrivate::addEventToDispatch):
+        (WebCore::AnimationControllerPrivate::animationTimerFired):
+        (WebCore::AnimationController::addEventToDispatch):
+        * page/animation/AnimationController.h:
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::updateTransitions):
+        (WebCore::CompositeAnimationPrivate::willNeedService):
+        (WebCore::CompositeAnimationPrivate::getAnimationForProperty):
+        (WebCore::CompositeAnimation::willNeedService):
+        (WebCore::CompositeAnimation::getAnimationForProperty):
+        * page/animation/CompositeAnimation.h:
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::animate):
+        (WebCore::ImplicitAnimation::onAnimationEnd):
+        (WebCore::ImplicitAnimation::sendTransitionEvent):
+        * page/animation/ImplicitAnimation.h:
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::animate):
+        (WebCore::KeyframeAnimation::sendAnimationEvent):
+        * page/animation/KeyframeAnimation.h:
+        (WebCore::KeyframeAnimation::setUnanimatedStyle):
+
+2008-12-11  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build with an empty filenameExtension() implementation.
+
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::filenameExtension):
+
+2008-12-11  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        Fix crash in the cairo implementation of the SVGPaintServer
+
+        For SVGFonts the RenderObject can be zero. The existing SVGFont
+        test cases is exposing this bug. Qt and other ports have fixed
+        this issue by adding null checks as well.
+
+        * svg/graphics/cairo/SVGPaintServerCairo.cpp:
+        (WebCore::SVGPaintServer::renderPath):
+
+2008-12-11  Holger Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20953
+
+        Make the Qt port follow the Win, Mac, Gtk+ port in regard to Font
+        handling. FontQt.cpp from now on is only implementing the complex path. Create
+        FontFallbackListQt.cpp and FontPlatformDataQt.cpp to work within
+        the framework set by the Font code.
+
+        Sharing the Font.cpp implementation allows the Qt port to support
+        the CSS font faces and SVG fonts.
+
+        Split out the Qt4.3 Font handling into FonQt43.cpp to allow to more
+        easily deprecate it.
+
+        This commit is removing a lot of #ifdefs from Font.h as the Qt Font
+        implementation is now in line with the rest of WebCore.
+
+        * WebCore.pro:
+        * platform/graphics/Font.h: Remove #ifdefs
+        (WebCore::Font::letterSpacing):
+        (WebCore::Font::setLetterSpacing):
+        (WebCore::Font::isPlatformFont):
+        * platform/graphics/FontFallbackList.h:
+        * platform/graphics/SimpleFontData.cpp:
+        (WebCore::SimpleFontData::SimpleFontData):
+        (WebCore::SimpleFontData::platformGlyphInit): There is no GlyphCache
+        on Qt, move the initialisation over.
+        (WebCore::SimpleFontData::~SimpleFontData):
+        * platform/graphics/SimpleFontData.h:
+        (WebCore::SimpleFontData::getQtFont):
+        * platform/graphics/qt/FontCacheQt.cpp:
+        (WebCore::FontCache::getCachedFontPlatformData): Remove unused parameter
+        (WebCore::FontCache::releaseFontData): Add to build
+        * platform/graphics/qt/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData):
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+        (WebCore::createFontCustomPlatformData):
+        * platform/graphics/qt/FontCustomPlatformData.h:
+        * platform/graphics/qt/FontFallbackListQt.cpp: Added.
+        (WebCore::FontFallbackList::FontFallbackList):
+        (WebCore::FontFallbackList::invalidate):
+        (WebCore::FontFallbackList::releaseFontData):
+        (WebCore::FontFallbackList::determinePitch):
+        (WebCore::FontFallbackList::fontDataAt):
+        (WebCore::FontFallbackList::fontDataForCharacters):
+        (WebCore::FontFallbackList::setPlatformFont):
+        * platform/graphics/qt/FontPlatformData.h:
+        (WebCore::FontPlatformData::font):
+        (WebCore::FontPlatformData::size):
+        * platform/graphics/qt/FontPlatformDataQt.cpp: Added.
+        (WebCore::FontPlatformData::FontPlatformData):
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+        (WebCore::Font::font):
+        * platform/graphics/qt/FontQt43.cpp: Added. Moved Qt4.3 code from FontQt.cpp
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+        * platform/graphics/qt/GlyphPageTreeNodeQt.cpp:
+        (WebCore::GlyphPageTreeNode::pruneTreeCustomFontData):
+        (WebCore::GlyphPageTreeNode::pruneTreeFontData):
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        (WebCore::SimpleFontData::determinePitch):
+        (WebCore::SimpleFontData::containsCharacters):
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformGlyphInit):
+        (WebCore::SimpleFontData::platformDestroy):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::adjustButtonStyle): Avoid crashes.
+
+2008-12-11  Holger Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20953
+
+        For Qt it is not pratical to have a FontCache and GlyphPageTreeNode
+        implementation. This is one of the reasons why the Qt port is currently not
+        using WebCore/platform/graphics/Font.cpp. By allowing to not use
+        the simple/fast-path the Qt port will be able to use it.
+
+        Introduce USE(FONT_FAST_PATH) and define it for every port but the
+        Qt one.
+
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::drawText):
+        (WebCore::Font::floatWidth):
+        (WebCore::Font::selectionRectForText):
+        (WebCore::Font::offsetForPosition):
+        * platform/graphics/Font.h:
+
+2008-12-11  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20953
+
+        Split out the font fast path from Fast.cpp into FontFastPath.cpp. This
+        will allow the Qt port to share most of WebCore::Font
+        implementation but the fast path. Qt does not provide the API to get
+        individual Glyphs making the fast path hard to support.
+
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * platform/graphics/Font.cpp:
+        * platform/graphics/FontFastPath.cpp: Added.
+        (WebCore::Font::glyphDataForCharacter):
+
+2008-12-11  Robert Carr  <racarr@svn.gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22560
+
+        Code in PlatformScreenGtk for screenDepth and screenRect can not
+        assume that the platformWindow for the widget has a valid "window"
+        member. For example in the case of, a new browser view opening as a
+        child of a GtkNotebook, but never being switched to, or manually
+        realized. Solve by using the toplevel window of the widget, rather
+        than the widget itself.
+
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::screenDepth):
+        (WebCore::screenRect):
+
+2008-12-08  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Darin Adler and Holger Freyther.
+
+        Make Widget::frameRectsChanged() and overrides non-const
+
+        This will hopefully allow us to get rid of some of the mutables in
+        the classes that react to the callback by changing their own state.
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::frameRectsChanged):
+        * platform/ScrollView.h:
+        * platform/Widget.h:
+        (WebCore::Widget::frameRectsChanged):
+        * platform/gtk/ScrollbarGtk.cpp: Remove non-const version since
+        this was more complex and did the same thing, changed const of
+        the leftover frameRectsChanged() method.
+        (ScrollbarGtk::frameRectsChanged):
+        * platform/gtk/ScrollbarGtk.h:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::frameRectsChanged):
+        * plugins/PluginView.h:
+
+2008-12-11  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed and implemented with Tor Arne Vestbø.
+
+        Reimplement RenderTheme::caretBlinkInterval for Qt.
+
+        The QApplication::cursorFlashTime is in milliseconds and describes
+        the whole cycle while WebCore expects half a cycle.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::caretBlinkInterval):
+        * platform/qt/RenderThemeQt.h:
+
+2008-12-09  Trenton Schulz <trenton.schulz@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt/Mac] Don't call HIGetScaleFactor() if we're not on Tiger or better
+
+        * plugins/mac/PluginViewMac.cpp:
+        (WebCore::tigerOrBetter):
+        (WebCore::PluginView::globalMousePosForPlugin):
+
+2008-12-10  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Eric Seidel and George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22799
+
+        Add WML <template> support. The <template> element is specified at deck-level
+        and declares a template for all <card> elements in the document.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * editing/htmlediting.cpp:
+        (WebCore::canHaveChildrenForEditing): Treat <do> just like a <button>.
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::WMLCardElement):
+        (WebCore::WMLCardElement::setTemplateElement):
+        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded):
+        (WebCore::WMLCardElement::handleDeckLevelTaskOverridesIfNeeded):
+        * wml/WMLCardElement.h:
+        (WebCore::WMLCardElement::templateElement):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::insertedIntoDocument):
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::finishedParsing):
+        * wml/WMLErrorHandling.cpp:
+        (WebCore::errorMessageForErrorCode):
+        * wml/WMLErrorHandling.h:
+        (WebCore::):
+        * wml/WMLEventHandlingElement.cpp:
+        (WebCore::WMLEventHandlingElement::~WMLEventHandlingElement):
+        * wml/WMLEventHandlingElement.h:
+        (WebCore::WMLEventHandlingElement::doElements):
+        * wml/WMLTagNames.in:
+        * wml/WMLTemplateElement.cpp: Added.
+        (WebCore::WMLTemplateElement::WMLTemplateElement):
+        (WebCore::WMLTemplateElement::~WMLTemplateElement):
+        (WebCore::WMLTemplateElement::parseMappedAttribute):
+        (WebCore::WMLTemplateElement::registerTemplatesInDocument):
+        * wml/WMLTemplateElement.h: Added.
+        * wml/WMLTimerElement.cpp:
+        (WebCore::WMLTimerElement::timerFired):
+
+2008-12-09  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix memory leak - need to call stopActiveDOMObjects
+        when cached pages get destroyed.
+        https://bugs.webkit.org/show_bug.cgi?id=22753
+
+        * dom/Document.cpp:
+        (WebCore::Document::detach):
+
+2008-12-10  Alice Liu  <alice.liu@apple.com>
+
+        Manual test for https://bugs.webkit.org/show_bug.cgi?id=20685
+
+        Reviewed by Darin Adler.
+
+        * manual-tests/drag-image-to-desktop.html: Added.
+
+2008-12-10  Alice Liu  <alice.liu@apple.com>
+
+        fixed https://bugs.webkit.org/show_bug.cgi?id=20685
+
+        Reviewed by Darin Adler.
+
+        Manual test case is manual-tests/drag-image-to-desktop.html
+
+        Added new files to projects
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        * page/DragController.cpp:
+        (WebCore::DragController::startDrag):
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypes):
+        (WebCore::initializeSupportedImageMIMETypesForEncoding):
+
+        These changes add a method to obtain the extension for an image
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::filenameExtension):
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/Image.h:
+        (WebCore::Image::filenameExtension):
+        * platform/graphics/ImageSource.h:
+        * platform/graphics/cairo/ImageSourceCairo.cpp:
+        (WebCore::ImageSource::filenameExtension):
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::filenameExtension):
+
+        These changes added a utility that returns the preferred extension for a UTI
+        * platform/graphics/cg/ImageSourceCG.h: Added.
+        * platform/graphics/cg/ImageSourceCGMac.mm: Added.
+        (WebCore::MIMETypeForImageSourceType):
+        (WebCore::preferredExtensionForImageSourceType):
+        * platform/graphics/cg/ImageSourceCGWin.cpp: Added.
+        (WebCore::MIMETypeForImageSourceType):
+        (WebCore::preferredExtensionForImageSourceType):
+
+        * platform/mac/MIMETypeRegistryMac.mm:
+        moved getMIMETypeForUTI to ImageSourceCGMac.mm
+
+        Ask image for its file extension instead of relying on MIME type and file path
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::createGlobalImageFileDescriptor):
+
+        Remove extraneous code from getPreferredExtensionForMIMEType.
+        Also moved getMIMETypeForUTI to ImageSourceCGWin.cpp
+        * platform/win/MIMETypeRegistryWin.cpp:
+        (WebCore::MIMETypeRegistry::getPreferredExtensionForMIMEType):
+
+2008-12-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Antti Koivisto
+
+        <rdar://problem/6431224>
+
+        When updating the value of a slider, don't mark the parents
+        as needing layout, because the size of the slider can never
+        change. This fixes full-page repaints in some cases.
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::updateFromElement):
+
+2008-12-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Potential build fix. The forward declaration of FloatPoint should
+        be inside the WebCore namespace.
+
+        * platform/graphics/FloatPoint3D.h:
+
+2008-12-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22793
+
+        Cleanup FloatPoint3D: inline the getters and setters,
+        fix a potential divide-by-zero in normalize(), and add
+        a FloatPoint constructor.
+
+        * platform/graphics/FloatPoint3D.cpp:
+        (WebCore::FloatPoint3D::FloatPoint3D):
+        (WebCore::FloatPoint3D::normalize):
+        * platform/graphics/FloatPoint3D.h:
+        (WebCore::FloatPoint3D::x):
+        (WebCore::FloatPoint3D::setX):
+        (WebCore::FloatPoint3D::y):
+        (WebCore::FloatPoint3D::setY):
+        (WebCore::FloatPoint3D::z):
+        (WebCore::FloatPoint3D::setZ):
+
+2008-12-09  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 22665: Remove setCreatedByParser(bool) from the few elements that use it
+        https://bugs.webkit.org/show_bug.cgi?id=22665
+
+        - Removed setCreatedByParser from style and link elements.
+
+        - Removed XMLTokenizer::eventuallyMarkAsCreatedByParser.
+
+        * dom/XMLTokenizer.cpp:
+        * dom/XMLTokenizer.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::startElementNs):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseStartElement):
+        * html/HTMLElementFactory.cpp:
+        (WebCore::linkConstructor):
+        (WebCore::styleConstructor):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::HTMLLinkElement):
+        * html/HTMLLinkElement.h:
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::HTMLStyleElement):
+        * html/HTMLStyleElement.h:
+        * html/HTMLTagNames.in:
+        * svg/SVGStyleElement.cpp:
+        (WebCore::SVGStyleElement::SVGStyleElement):
+        * svg/SVGStyleElement.h:
+        * svg/svgtags.in:
+
+2008-12-10  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin
+
+        https://bugs.webkit.org/show_bug.cgi?id=22194 and <rdar://problem/6388378> -
+        Dialog when going back to a page from whence you submitted a form
+
+        http://trac.webkit.org/changeset/37317 changed the manner in which headers are added to
+        http requests, which caused the networking layer to have an incomplete set of headers
+        just before consulting the Policy Delegate.  This caused a cache miss and incorrectly made
+        us believe we'd be resubmitting the form.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem):  Being careful to maintain the new behavior required by
+          the Origin header mechanism as discussed in bug 22194, restore the previous behavior of
+          setting all the headers before the networking layer is asked about the cache lookup.
+
+2008-12-10  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Add back ability to end all profiling via console by invoking profileEnd
+        with no arguments.
+
+        * page/Console.cpp:
+        (WebCore::Console::profileEnd): Removed title null-checking and
+            subsequent early exit.
+
+2008-12-10  Pierre-Olivier Latour  <pol@apple.com>
+
+        Reviewed by Darin Adler.
+
+        KeyframeAnimation::animate() needs to compute the elapsed animation time
+        properly taking into account its paused state.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22773
+
+        Test: animations/animation-drt-api-multiple-keyframes.html
+
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::animate):
+
+2008-12-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        Part of
+        https://bugs.webkit.org/show_bug.cgi?id=22570
+
+        Rename methods on RenderLayer for clarity:
+            clearClipRects -> clearClipRectsIncludingDescendants
+            clearClipRect  -> clearClipRects
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::destroy):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::removeOnlyThisLayer):
+        (WebCore::RenderLayer::insertOnlyThisLayer):
+        (WebCore::RenderLayer::clearClipRectsIncludingDescendants):
+        (WebCore::RenderLayer::clearClipRects):
+        * rendering/RenderLayer.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy):
+
+2008-12-10  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix after the script call stack/frame additions.
+
+        * WebCoreSources.bkl:
+
+2008-12-10   Srinivasa Rao M. Hamse  <msrinirao@gmail.com>
+
+        Reviewed by Holger Freyther.
+
+        F1-F12 key mappings for WebKit Gtk Port
+
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::windowsKeyCodeForKeyEvent):
+
+2008-12-10  Enrico Ros  <enrico.ros@m31.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the Qt build when SVG is disabled. A broken dependancy caused
+        unnecessary rebuilds even with no changes.
+
+        * WebCore.pro: fix a broken build dependancy
+
+2008-12-10  Hironori Bono  <hbono@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 21820: Unable to enter the Tamil UNICODE Characters via Thamizha Phonetic IME
+        https://bugs.webkit.org/show_bug.cgi?id=21820
+
+        <rdar://problem/5683248> Typing backspace to delete a diacritical mark also deletes the character before (Arabic)
+        <rdar://problem/5702038> Backspace removes Thai Character in wrong sequence
+
+        Tests: editing/deleting/delete-ligature-001.html
+               editing/deleting/delete-ligature-002.html
+               editing/deleting/delete-ligature-003.html
+
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed): Delete only the last character
+        of a ligature which consists of multiple Unicode characters when deleting it with
+        a backspace key.
+
+2008-12-10  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22177
+        Fix the windows build by removing calls to notifyFormStateChanged
+        where they didn't appear in the original reviewed patch.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::type):
+        (WebCore::HTMLInputElement::attach):
+
+2008-12-09  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Add ScriptController::updateSecurityOrigin to notify the bindings
+        that a document's securityOrigin has been updated.  This is used by
+        V8 to update its security context.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::updateSecurityOrigin):
+        * bindings/js/ScriptController.h:
+        * dom/Document.cpp:
+        (WebCore::Document::setDomain):
+
+2008-12-09  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        Fix a few config issues to let the Chromium Windows WebCore build get further.
+
+        * WebCore.scons:
+
+2008-12-09  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22177
+
+        Add a callback on ChromeClient that the state of form elements on
+        the page has changed. This is to allow clients implementing session
+        saving to know when the current state is dirty.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::notifyFormStateChanged):
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::type):
+        (WebCore::HTMLInputElement::attach):
+        (WebCore::HTMLInputElement::setValue):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        (WebCore::HTMLInputElement::setFileListFromRenderer):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::setSelectedIndex):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::notifyFormStateChanged):
+        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
+        (WebCore::HTMLTextAreaElement::updateValue):
+        (WebCore::HTMLTextAreaElement::setValue):
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::formStateDidChange):
+        * page/ChromeClient.h:
+
+2008-12-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19762
+
+        Fix intermittent crash in buildbot. The CSSCursorImageValues and
+        SVGCursorElements held onto raw SVGElement pointers without any
+        guarantee that the element is still around.
+
+        We did not fix the design that resulted in this issue, we just fixed
+        the pointer lifetimes.
+
+        * css/CSSCursorImageValue.cpp:
+        (WebCore::CSSCursorImageValue::~CSSCursorImageValue): Zero out the back pointers.
+        (WebCore::CSSCursorImageValue::updateIfSVGCursorIsUsed): Set up a back pointer.
+        (WebCore::CSSCursorImageValue::removeReferencedElement): Added. Used when the element
+        is destroyed.
+        * css/CSSCursorImageValue.h: Added removeReferencedElement.
+
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::~SVGCursorElement): Zero out the back pointers.
+        (WebCore::SVGCursorElement::addClient): Set up a back pointer.
+        (WebCore::SVGCursorElement::removeClient): Zero out the back pointer.
+
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::SVGElement): Initialize back pointers to zero.
+        (WebCore::SVGElement::~SVGElement): Call both the element and cursor image value
+        to remove the element from their sets.
+        * svg/SVGElement.h:
+        (WebCore::SVGElement::setCursorElement): Added.
+        (WebCore::SVGElement::setCursorImageValue): Added.
+
+2008-12-09  David Hyatt  <hyatt@apple.com>
+
+        Add code that will create custom CSS scrollbars from the <body>, the document element (<html>) and the owning
+        frame/iframe.  If any of them set a custom style, it will be used.  The scrollbars do not update dynamically
+        yet as you switch from page to page (until they are destroyed and recreated).
+
+        Reviewed by Adele
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::createScrollbar):
+
+2008-12-09  Ojan Vafai  <ojan@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22689
+        Match Firefox button metrics on Windows.
+
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::addChild):
+        (WebCore::RenderButton::styleDidChange):
+        (WebCore::RenderButton::setupInnerStyle):
+        * rendering/RenderButton.h:
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustButtonInnerStyle):
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::adjustSliderThumbSize):
+        (WebCore::RenderThemeWin::adjustButtonInnerStyle):
+        * rendering/RenderThemeWin.h:
+
+2008-12-09  Darin Fisher  <darin@chromium.org>
+
+        Fixes bustages.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22631
+        Adding missing files from previous commit.
+
+        * bindings/js/ScriptCallFrame.cpp: Added.
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        (WebCore::ScriptCallFrame::~ScriptCallFrame):
+        (WebCore::ScriptCallFrame::argumentAt):
+        * bindings/js/ScriptCallFrame.h: Added.
+        (WebCore::ScriptCallFrame::functionName):
+        (WebCore::ScriptCallFrame::sourceURL):
+        (WebCore::ScriptCallFrame::lineNumber):
+        (WebCore::ScriptCallFrame::argumentCount):
+        * bindings/js/ScriptCallStack.cpp: Added.
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        (WebCore::ScriptCallStack::~ScriptCallStack):
+        (WebCore::ScriptCallStack::at):
+        (WebCore::ScriptCallStack::size):
+        (WebCore::ScriptCallStack::initialize):
+        * bindings/js/ScriptCallStack.h: Added.
+        (WebCore::ScriptCallStack::state):
+
+2008-12-09  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22631
+        Streamline Console.cpp, abstract out the use of JSC::ExecState and
+        JSC::ArgList by introducing ScriptCallFrame and ScriptCallStack
+        abstractions.
+
+        * GNUmakefile.am: Added ScriptCallFrame and ScriptCallStack to build
+        * WebCore.pro:  Added ScriptCallFrame and ScriptCallStack to build
+        * WebCore.vcproj/WebCore.vcproj: Added ScriptCallFrame and
+        ScriptCallStack to project
+        * WebCore.xcodeproj/project.pbxproj: Added ScriptCallFrame and
+        ScriptCallStack to project
+        * bindings/js/JSConsoleCustom.cpp: Remove custom bindings.
+        * bindings/js/ScriptCallFrame.cpp: Added.
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        (WebCore::ScriptCallFrame::~ScriptCallFrame):
+        (WebCore::ScriptCallFrame::argumentAt):
+        * bindings/js/ScriptCallFrame.h: Added.
+        (WebCore::ScriptCallFrame::functionName):
+        (WebCore::ScriptCallFrame::sourceURL):
+        (WebCore::ScriptCallFrame::lineNumber):
+        (WebCore::ScriptCallFrame::argumentCount):
+        * bindings/js/ScriptCallStack.cpp: Added.
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        (WebCore::ScriptCallStack::~ScriptCallStack):
+        (WebCore::ScriptCallStack::at):
+        (WebCore::ScriptCallStack::size):
+        (WebCore::ScriptCallStack::initialize):
+        * bindings/js/ScriptCallStack.h: Added.
+        (WebCore::ScriptCallStack::ScriptCallStack):
+        (WebCore::ScriptCallStack::~ScriptCallStack):
+        (WebCore::ScriptCallStack::state):
+        (WebCore::ScriptCallStack::at):
+        (WebCore::ScriptCallStack::size):
+        (WebCore::ScriptCallStack::initialize):
+        * bindings/js/ScriptString.h: Added missing PlatformString include.
+        (WebCore::ScriptString::ScriptString): Added default constructor.
+        (WebCore::ScriptString::operator==): Added equality operator.
+        (WebCore::ScriptString::operator!=):
+        * bindings/js/ScriptValue.cpp: Added isNull and isUndefined.
+        (WebCore::ScriptValue::isNull):
+        (WebCore::ScriptValue::isUndefined):
+        * bindings/js/ScriptValue.h: Added isNull and isUndefined
+        * bindings/scripts/CodeGeneratorJS.pm: Add handling for
+        CustomArgumentHandling attribute.
+        * inspector/InspectorController.cpp: Refactored to use
+        ScriptCallFrame and ScriptCallStack.
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::InspectorController::addMessageToConsole):
+        (WebCore::InspectorController::startGroup):
+        (WebCore::InspectorController::addScriptConsoleMessage):
+        (WebCore::InspectorController::count):
+        (WebCore::InspectorController::startTiming):
+        (WebCore::InspectorController::stopTiming):
+        * inspector/InspectorController.h: Refactored to use ScriptCallFrame and
+        ScriptCallStack.
+        * inspector/front-end/Console.js: Modified to use argument value itself
+        rather than f.name for stack trace.
+        * page/Console.cpp: Refactored to use ScriptCallFrame and
+        ScriptCallStack.
+        (WebCore::getFirstArgumentAsString):
+        (WebCore::Console::addMessage):
+        (WebCore::Console::debug):
+        (WebCore::Console::error):
+        (WebCore::Console::info):
+        (WebCore::Console::log):
+        (WebCore::Console::dir):
+        (WebCore::Console::dirxml):
+        (WebCore::Console::trace):
+        (WebCore::Console::assertCondition):
+        (WebCore::Console::count):
+        (WebCore::Console::profile):
+        (WebCore::Console::profileEnd):
+        (WebCore::Console::time):
+        (WebCore::Console::timeEnd):
+        (WebCore::Console::group):
+        (WebCore::Console::warn):
+        * page/Console.h:
+        * page/Console.idl: Removed Custom attributes, added
+        CustomArgumentHandling attributes, and tweaked argument defs.
+
+2008-12-09  Darin Adler  <darin@apple.com>
+
+        Try to fix non-Mac builds.
+
+        * GNUmakefile.am: Added NavigatorBase.
+        * WebCore.pro: Ditto.
+        * WebCore.scons: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+        Unrelated tweak sitting in my tree.
+
+        * bindings/objc/DOMAbstractView.mm: Remove pointless override of finalize method.
+
+2008-12-09  Darin Adler  <darin@apple.com>
+
+        Try to fix Tiger build.
+
+        * platform/network/mac/NetworkStateNotifierMac.cpp: Declare CFRunLoopGetMain.
+
+2008-12-09  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22719
+        Implement Navigator object in Workers
+
+        Test: fast/workers/worker-navigator.html
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Added WorkerNavigator sources.
+
+        * bindings/js/JSWorkerContext.cpp: (WebCore::jsWorkerContextNavigator):
+        Worker.navigator returns a WoerkerNavigator object (it is named just Navigator in the spec,
+        but it is not the same interface that is available on Windows).
+
+        * dom/Worker.cpp:
+        (WebCore::Worker::notifyFinished):
+        * dom/WorkerContext.cpp:
+        (WebCore::WorkerContext::WorkerContext):
+        (WebCore::WorkerContext::navigator):
+        * dom/WorkerContext.h:
+        (WebCore::WorkerContext::create):
+        * dom/WorkerThread.cpp:
+        (WebCore::WorkerThread::create):
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::workerThread):
+        * dom/WorkerThread.h:
+        Pass a pre-computed user agent string into worker, because it cannot call a client method
+        directly, and pre-computing is easier than sending a synchronous message to the main thread.
+
+        * page/Navigator.cpp:
+        * page/Navigator.h:
+        * page/NavigatorBase.cpp: Added.
+        * page/NavigatorBase.h: Added.
+        Factor out common (and uncommon, but very similar) functionality into a base class.
+
+        * page/WorkerNavigator.cpp: Added.
+        * page/WorkerNavigator.h: Added.
+        * page/WorkerNavigator.idl: Added.
+        Per Web Workers and HTML5, implement a small subset of what we currently have in Window.Navigator.
+
+        * platform/network/NetworkStateNotifier.cpp: (WebCore::networkStateNotifier):
+        Make networkStateNotifier() static constructor thread safe. The object is created on the
+        thread it is first called from, while callbacks are registered on the main thread. Calls to
+        onLine() from other threads are safe, because it is just loading a boolean.
+
+        * platform/network/mac/NetworkStateNotifierMac.cpp: (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+        Schedule notifications on main event loop, not the current one.
+
+2008-12-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Rubber-stamped by Alexey Proskuryakov.
+
+        Forgot to update Qt/WML build - add some new files to the build.
+
+        * WebCore.pro:
+
+2008-12-09  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22637
+
+        Implement the GET method for WMLGoElement, and some test covering it's behaviour.
+        Update all build systems supporting WML that haven't been updated since a while.
+
+        Add WMLPostField stub implementation, needed for implementing POST method.
+
+        Tests: wml/go-task-get-method-external-deck-with-href.html
+               wml/go-task-get-method-external-deck.html
+               wml/go-task-get-method-same-deck.html
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::resetWMLPageState):
+        * wml/WMLCardElement.cpp:
+        * wml/WMLCardElement.h:
+        * wml/WMLEventHandlingElement.cpp:
+        (WebCore::WMLCardElement::registerDoElement):
+        * wml/WMLEventHandlingElement.h:
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::WMLGoElement):
+        (WebCore::WMLGoElement::registerPostfieldElement):
+        (WebCore::WMLGoElement::parseMappedAttribute):
+        (WebCore::WMLGoElement::executeTask):
+        (WebCore::WMLGoElement::parseContentType):
+        (WebCore::WMLGoElement::preparePOSTRequest):
+        (WebCore::WMLGoElement::prepareGETRequest):
+        * wml/WMLGoElement.h:
+        * wml/WMLPostfieldElement.cpp: Added.
+        (WebCore::WMLPostfieldElement::WMLPostfieldElement):
+        (WebCore::WMLPostfieldElement::parseMappedAttribute):
+        (WebCore::WMLPostfieldElement::insertedIntoDocument):
+        * wml/WMLPostfieldElement.h: Added.
+        (WebCore::WMLPostfieldElement::name):
+        (WebCore::WMLPostfieldElement::value):
+        * wml/WMLTagNames.in:
+
+2008-12-08  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16814
+        Allow ports to disable ActiveX->NPAPI conversion for Media Player.
+        Improve handling of miscellaneous ActiveX objects.
+
+        * rendering/RenderPartObject.cpp:
+        (WebCore::mapClassIdToServiceType):
+        (WebCore::shouldUseChildEmbedOfObject):
+        (WebCore::RenderPartObject::updateWidget):
+
+2008-12-08  Darin Adler  <darin@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=22409
+          REGRESSION: cmd-shift-left/right don't switch tabs, instead select text
+
+        Tests: editing/execCommand/enabling-and-selection-2.html
+               editing/execCommand/enabling-and-selection.html
+
+        * editing/EditorCommand.cpp: Updated table to use these functions by their new names.
+        (WebCore::enabledVisibleSelection): Renamed this to reflect its new algorithm.
+        An invisible selection with a position that selects no characters doesn't count
+        as a visible selection.
+        (WebCore::enabledVisibleSelectionAndMark): Ditto.
+
+2008-12-08  David Kilzer  <ddkilzer@apple.com>
+
+        Remove duplicate entries from WebCore project.
+
+        Reviewed by Eric Seidel.
+
+        Bug 22555: Sort "children" sections in Xcode project files.
+        <https://bugs.webkit.org/show_bug.cgi?id=22555>
+
+        Recipe for removing duplicates:
+        $ ./WebKitTools/Scripts/sort-Xcode-project-file project.pbxproj
+        $ uniq < project.pbxproj | diff -u project.pbxproj - | patch -p0 project.pbxproj
+
+        * WebCore.xcodeproj/project.pbxproj: Removed duplicates.
+
+2008-12-08  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 22665: Remove setCreatedByParser(bool) from the few elements that use it
+        https://bugs.webkit.org/show_bug.cgi?id=22665
+
+        Remove setCreatedByParser from the script elements (HTML and SVG).
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::eventuallyMarkAsParserCreated): Removed
+        call to setCreatedByParser for the 2 elements.
+
+        * dom/make_names.pl: Modified to call the constructor with
+        the createByParser parameter if 'constructorNeedsCreatedByParser'
+        is set.
+
+        * html/HTMLElementFactory.cpp:
+        (WebCore::scriptConstructor):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::HTMLScriptElement):
+        * html/HTMLScriptElement.h:
+        * html/HTMLTagNames.in: Added constructorNeedsCreatedByParser
+        to script.
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::SVGScriptElement):
+        * svg/SVGScriptElement.h:
+        * svg/svgtags.in: Added constructorNeedsCreatedByParser
+        to script.
+
+2008-12-08  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 22555: Sort "children" sections in Xcode project files
+
+        <https://bugs.webkit.org/show_bug.cgi?id=22555>
+
+        Reviewed by Eric Seidel.
+
+        * WebCore.xcodeproj/project.pbxproj: Sorted.
+        * manual-tests/NPN_Invoke/NPN_Invoke.xcodeproj/project.pbxproj: Sorted.
+
+2008-12-08  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add a bool to GraphicsContext so that shadows can ignore
+        transformations.  This is needed by HTML canvas element
+        where the spec says shadows are applied w/o transformations.
+        https://bugs.webkit.org/show_bug.cgi?id=22580
+
+        No functional changes, thus no tests.
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setShadow):
+        (WebCore::CanvasRenderingContext2D::applyShadow):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::createImageBuffer):
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setShadowsIgnoreTransforms):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/GraphicsContextPrivate.h:
+        (WebCore::GraphicsContextState::GraphicsContextState):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setPlatformShadow):
+
+2008-12-08  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 17897: Not Rendering Images Imported from XHTML Document
+        <rdar://problem/5827614>
+
+        When we were loading document with XMLHttpRequest that contained images, the images
+        would not be fetched as they would not be displayed. However if we inserted such
+        an image element into a rendered document, we would not fetch the image and thus never
+        display it.
+
+        Now we check if the image has been loaded when we insert an HTMLImageElement into a
+        document.
+        To enable this, the image loader has an error flag. To avoid doing several attempts
+        when we know that the image is in error, we store the failed URL.
+        However Firefox and Opera ignore errors when the 'src' attribute changes and thus
+        we also have an updateFromElementIgnoringPreviousError to match the other browser.
+
+        Tests: http/tests/misc/image-blocked-src-change.html
+               http/tests/misc/image-blocked-src-no-change.html
+               http/tests/xmlhttprequest/xmlhttprequest-image-not-loaded-svg.svg
+               http/tests/xmlhttprequest/xmlhttprequest-image-not-loaded.html
+
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::parseMappedAttribute): Changed to call updateFromElementIgnoringPreviousError.
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::parseMappedAttribute): Ditto.
+        (WebCore::HTMLImageElement::insertedIntoDocument): Call updateFromElement if we do not have
+        an image.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute): Changed to call updateFromElementIgnoringPreviousError.
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parseMappedAttribute): Ditto.
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::parseMappedAttribute): Ditto.
+        * loader/ImageLoader.cpp:
+        (WebCore::ImageLoader::setImage): Added an assertion.
+        (WebCore::ImageLoader::updateFromElement): Added a check for load error (to avoid displaying
+        multiple errors in the console for a single image load).
+
+        (WebCore::ImageLoader::updateFromElementIgnoringPreviousError): This method clears previous error
+        before calling updateFromElement.
+
+        (WebCore::ImageLoader::notifyFinished): Added an assertion.
+        * loader/ImageLoader.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::svgAttributeChanged): Changed to call updateFromElementIgnoringPreviousError.
+
+2008-12-08  David Hyatt  <hyatt@apple.com>
+
+        Make scrollbar creation virtual on ScrollView so that FrameView can have the capability to create
+        custom CSS scrollbars.
+
+        Reviewed by Eric Seidel
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::createScrollbar):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::setHasVerticalScrollbar):
+        (WebCore::ScrollView::createScrollbar):
+        * platform/ScrollView.h:
+
+2008-12-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - WebCore part of tracking the global history item for a WebView
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkLoadCompleteForThisFrame): Set the page's
+        global history item to the current back/forward list item, respecting
+        private browsing mode.
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy): Ditto in this
+        case.
+        (WebCore::FrameLoader::goToItem): Ditto in this case.
+        (WebCore::FrameLoader::updateHistoryForStandardLoad): If this load
+        creates a new global history item, set the page's global history item
+        to it.
+        (WebCore::FrameLoader::updateHistoryForRedirectWithLockedHistory):
+        Ditto.
+        * page/Page.cpp:
+        (WebCore::Page::setGlobalHistoryItem): Added this setter.
+        * page/Page.h: Added a m_globalHistoryItem data member.
+        (WebCore::Page::globalHistoryItem): Added this getter.
+
+2008-12-08  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Kilzer.
+
+        A few stylistic fixes suggested by Dave Kilzer.
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::createIdentifier):
+        (WebCore::CSSPrimitiveValue::create):
+
+2008-12-08  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22737
+        Try debug version when locating CFNetwork
+
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::findCFNetworkModule):
+        (WebCore::findCFURLRequestSetContentDispositionEncodingFallbackArrayFunction):
+        (WebCore::findCFURLRequestCopyContentDispositionEncodingFallbackArrayFunction):
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::findCFNetworkModule):
+        (WebCore::findIsHTTPOnlyFunction):
+
+2008-12-08  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Stephanie Lewis.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22301
+        Make dispatchDidFinishLoading() always fire before didFinishLoadForFrame().
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::finishedParsing):
+
+2008-12-08  Trenton Schulz <trenton.schulz@nokia.com>
+
+        Rubber-stamped by Tor Arne Vestbø.
+
+        Fix build warning on Mac
+
+        * platform/text/mac/StringImplMac.mm:
+
+2008-12-08  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Fix the Qt build.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertQVariantToValue): Pass JSGlobalData to RegExp
+          constructor.
+
+2008-12-08  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Bug 22398: r39059: Crash when clearing webkitTransitionDuration in webkitTransitionEnd event handler
+        <rdar://problem/6426245> REGRESSION(r39059): Reproducible crash when clearing webkitTransitionDuration in webkitTransitionEnd event handler (22398)
+
+        This regression was caused by r39059 replacing the protector on the active
+        animation with a protector on just the composition.  It turns out that both
+        protectors are necessary.
+
+        Test: transitions/transition-duration-cleared-in-transitionend-crash.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::animationTimerCallbackFired):
+
+2008-12-08  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22732
+        Remove unused files PausedTimeouts.h,.cpp
+        The change that deprecated this code was https://bugs.webkit.org/show_bug.cgi?id=22620
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.scons:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+          These are build files which had PausedTimeouts referenced.
+
+        * bindings/js/PausedTimeouts.cpp: Removed.
+        * bindings/js/PausedTimeouts.h: Removed.
+        * bindings/js/ScriptController.cpp: Removed '#include'
+        * page/Chrome.cpp: Removed '#include' and unused variable.
+
+2008-12-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=22594
+
+        Fix issues which break reading inline style for -webkit-transition
+        and -webkit-transform-origin.
+
+        Test: fast/css/transform-inline-style.html
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getPropertyValue): Add cases
+        for CSSPropertyWebkitTransformOrigin and CSSPropertyWebkitTransition
+        so that these shorthand properties are returned correctly.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseAnimationProperty): Create CSSPrimitiveValues
+        with the correct CSSValueAll and CSSValueNone identifiers, not the
+        RenderStyle-level cAnimateAll, cAnimateNone.
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::mapAnimationProperty): Special-case CSSValueAll
+        and CSSValueNone values to set cAnimateAll and cAnimateNone transition properties.
+
+2008-12-07  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22717
+        Make CSS values use less memory
+
+        Share CSSPrimitiveValue objects for commonly used values including
+        - idents
+        - colors
+        - small integers
+
+        This reduces the amount CSSPrimitiveValue instances by > 80%.
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::createIdentifier):
+        (WebCore::CSSPrimitiveValue::createColor):
+        (WebCore::CSSPrimitiveValue::create):
+        * css/CSSPrimitiveValue.h:
+        (WebCore::CSSPrimitiveValue::create):
+
+2008-12-07  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22717
+        Make CSS values use less memory
+
+        Get CSSValues off from the common StyleBase base class. They don't
+        need a parent pointer or anything else there and there is no real
+        reason to have them in same data structures with other CSSOM objects.
+
+        Disabled (instead of refactoring around the lack of common base) the ability
+        to have style declaration blocks as CSS variable values. They don't exist in
+        the spec so I wasn't sure if they have future or not. It would not be hard to
+        get them back. CSS variables are in any case an experimental feature and
+        not enabled by default.
+
+        * css/CSSInitialValue.h:
+        (WebCore::CSSInitialValue::createExplicit):
+        (WebCore::CSSInitialValue::createImplicit):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::addVariableDeclarationBlock):
+        * css/CSSParser.h:
+        * css/CSSValue.h:
+        (WebCore::CSSValue::~CSSValue):
+        (WebCore::CSSValue::parserValue):
+        * css/CSSVariablesDeclaration.cpp:
+        (WebCore::CSSVariablesDeclaration::CSSVariablesDeclaration):
+        (WebCore::CSSVariablesDeclaration::getVariableValue):
+        (WebCore::CSSVariablesDeclaration::removeVariable):
+        (WebCore::CSSVariablesDeclaration::addParsedVariable):
+        (WebCore::CSSVariablesDeclaration::getParsedVariable):
+        (WebCore::CSSVariablesDeclaration::getParsedVariableDeclarationBlock):
+        * css/CSSVariablesDeclaration.h:
+        (WebCore::CSSVariablesDeclaration::create):
+        * css/StyleBase.h:
+
+2008-12-07  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Add gradient and pattern support for strokeRect on canvas/Cg.
+
+        Canvas strokeRect() doesn't support gradients
+        https://bugs.webkit.org/show_bug.cgi?id=19790
+
+        Test: fast/canvas/canvas-strokeRect.html
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::strokeRect):
+
+2008-12-06  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Add support for setTransform() in canvas.
+
+        <canvas> lacks transform() and setTransform()
+        https://bugs.webkit.org/show_bug.cgi?id=16604
+
+        Test: fast/canvas/canvas-setTransform.html
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::State::State):
+        (WebCore::CanvasRenderingContext2D::setStrokeStyle):
+        (WebCore::CanvasRenderingContext2D::setFillStyle):
+        (WebCore::CanvasRenderingContext2D::scale):
+        (WebCore::CanvasRenderingContext2D::rotate):
+        (WebCore::CanvasRenderingContext2D::translate):
+        (WebCore::CanvasRenderingContext2D::transform):
+        (WebCore::CanvasRenderingContext2D::setTransform):
+        (WebCore::CanvasRenderingContext2D::beginPath):
+        (WebCore::CanvasRenderingContext2D::closePath):
+        (WebCore::CanvasRenderingContext2D::moveTo):
+        (WebCore::CanvasRenderingContext2D::lineTo):
+        (WebCore::CanvasRenderingContext2D::quadraticCurveTo):
+        (WebCore::CanvasRenderingContext2D::bezierCurveTo):
+        (WebCore::CanvasRenderingContext2D::arcTo):
+        (WebCore::CanvasRenderingContext2D::arc):
+        (WebCore::CanvasRenderingContext2D::rect):
+        (WebCore::CanvasRenderingContext2D::fill):
+        (WebCore::CanvasRenderingContext2D::stroke):
+        (WebCore::CanvasRenderingContext2D::clip):
+        (WebCore::CanvasRenderingContext2D::isPointInPath):
+        (WebCore::CanvasRenderingContext2D::clearRect):
+        (WebCore::CanvasRenderingContext2D::fillRect):
+        (WebCore::CanvasRenderingContext2D::strokeRect):
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        (WebCore::CanvasRenderingContext2D::drawImageFromRect):
+        (WebCore::CanvasRenderingContext2D::willDraw):
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        * html/CanvasRenderingContext2D.h:
+        * html/CanvasRenderingContext2D.idl:
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::baseTransform):
+        * html/HTMLCanvasElement.h:
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::ImageBuffer::baseTransform):
+
+2008-12-06  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Also copy m_implicit field. Darin wanted this change commited separately.
+
+        * css/CSSProperty.h:
+        (WebCore::CSSProperty::operator=):
+
+2008-12-06  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22379
+        Make CSSOM use less memory
+
+        Use vector instead of a double linked list for properties in CSSMutableStyleDeclaration.
+
+        Taught setter functions to use existing slots to avoid memory moves, plus some
+        other optimizations.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::CSSMutableStyleDeclaration):
+        (WebCore::CSSMutableStyleDeclaration::operator=):
+        (WebCore::CSSMutableStyleDeclaration::getPropertyCSSValue):
+        (WebCore::CSSMutableStyleDeclaration::removeShorthandProperty):
+        (WebCore::CSSMutableStyleDeclaration::removeProperty):
+        (WebCore::CSSMutableStyleDeclaration::getPropertyPriority):
+        (WebCore::CSSMutableStyleDeclaration::getPropertyShorthand):
+        (WebCore::CSSMutableStyleDeclaration::isPropertyImplicit):
+        (WebCore::CSSMutableStyleDeclaration::setProperty):
+        (WebCore::CSSMutableStyleDeclaration::setPropertyInternal):
+        (WebCore::CSSMutableStyleDeclaration::setStringProperty):
+        (WebCore::CSSMutableStyleDeclaration::setImageProperty):
+        (WebCore::CSSMutableStyleDeclaration::parseDeclaration):
+        (WebCore::CSSMutableStyleDeclaration::addParsedProperties):
+        (WebCore::CSSMutableStyleDeclaration::addParsedProperty):
+        (WebCore::CSSMutableStyleDeclaration::setLengthProperty):
+        (WebCore::CSSMutableStyleDeclaration::length):
+        (WebCore::CSSMutableStyleDeclaration::item):
+        (WebCore::CSSMutableStyleDeclaration::cssText):
+        (WebCore::CSSMutableStyleDeclaration::setCssText):
+        (WebCore::CSSMutableStyleDeclaration::merge):
+        (WebCore::CSSMutableStyleDeclaration::removePropertiesInSet):
+        (WebCore::CSSMutableStyleDeclaration::copy):
+        (WebCore::CSSMutableStyleDeclaration::findPropertyWithId):
+        * css/CSSMutableStyleDeclaration.h:
+        (WebCore::CSSMutableStyleDeclarationConstIterator::operator*):
+        (WebCore::CSSMutableStyleDeclarationConstIterator::operator->):
+        (WebCore::CSSMutableStyleDeclarationConstIterator::operator!=):
+        (WebCore::CSSMutableStyleDeclarationConstIterator::operator==):
+        (WebCore::CSSMutableStyleDeclaration::create):
+        (WebCore::CSSMutableStyleDeclaration::begin):
+        (WebCore::CSSMutableStyleDeclaration::end):
+        (WebCore::CSSMutableStyleDeclarationConstIterator::CSSMutableStyleDeclarationConstIterator):
+        (WebCore::CSSMutableStyleDeclarationConstIterator::~CSSMutableStyleDeclarationConstIterator):
+        (WebCore::CSSMutableStyleDeclarationConstIterator::operator=):
+        (WebCore::CSSMutableStyleDeclarationConstIterator::operator++):
+        (WebCore::CSSMutableStyleDeclarationConstIterator::operator--):
+        * css/CSSProperty.h:
+        (WTF::):
+        * css/CSSStyleDeclaration.cpp:
+        (WebCore::CSSStyleDeclaration::diff):
+        (WebCore::CSSStyleDeclaration::copyPropertiesInSet):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::resolveVariablesForDeclaration):
+        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
+        (WebCore::CSSStyleSelector::applyDeclarations):
+        * dom/EventTarget.h:
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::StyleChange::init):
+        (WebCore::ApplyStyleCommand::isHTMLStyleNode):
+        (WebCore::ApplyStyleCommand::removeHTMLFontStyle):
+        (WebCore::ApplyStyleCommand::removeCSSStyle):
+        * editing/Editor.cpp:
+        (WebCore::Editor::selectionStartHasStyle):
+        (WebCore::updateState):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::handleStyleSpans):
+        * editing/markup.cpp:
+        (WebCore::appendStartMarkup):
+
+2008-12-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Antti Koivisto, Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=22088
+
+        Fix logic related to repainting when transform changes:
+        If an object has a layer, and the transform changes, then we need
+        to do a repaintIncludingDescendants(), not just a repaint.
+
+        Test: fast/repaint/transform-repaint-descendants.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+
+2008-12-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=15739
+
+        When painting the selection on a replaced element, paint
+        using local coordinates so that the selection is correctly
+        painted for transformed elements.
+
+        Test: fast/replaced/selection-rect-transform.html
+
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+
+2008-12-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=15671
+
+        Fix caret rendering to behave correctly with transforms:
+        * Rename caretRect() methods to localCaretRect() and
+          absoluteCaretBounds() as appropriate
+        * Fix localCaretRect() methods to return a rect in the
+          appropriate coordinates.
+        * Pass tx, ty down through the paintCaret() methods, after fixing them
+          up to account for differences between contents coords, and renderer-local
+          coords (via RenderBlock::offsetForContents()).
+        * Remove m_caretPositionOnLayout from SelectionController, and instead
+          call invalidateSelection() from RenderLayer::scrollToOffset(), because
+          we can no longer assume simple x/y offsets from scrolling with transforms.
+        * Move the logic to compute which RenderObject actually paints the caret into
+          SelectionController::caretRenderer(), rather than having it in RenderBlock.
+        * SelectionController now computes and caches a local caret rect. For invalidation,
+          it computes the absolute bounds of that (possibly transformed) local rect.
+          The local rect is computed in the coordinate system of the RenderObject that
+          will paint the caret (this may require offsetting from the actual renderer
+          at the start of the selection).
+        * Fix LayoutState(RenderObject* root) to take transforms into account
+        * Make offsetFromContainer() a virtual method on RenderObject, and implement
+          the RenderObject version. It's used to map from selection start renderer
+          to caret renderer.
+
+        Test: fast/transforms/transformed-caret.html
+
+        * WebCore.base.exp:
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::mergeParagraphs):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::SelectionController):
+        (WebCore::absoluteCaretY):
+        (WebCore::SelectionController::modify):
+        (WebCore::SelectionController::xPosForVerticalArrowNavigation):
+        (WebCore::SelectionController::layout):
+        (WebCore::SelectionController::caretRenderer):
+        (WebCore::SelectionController::localCaretRect):
+        (WebCore::SelectionController::absoluteCaretBounds):
+        (WebCore::SelectionController::caretRepaintRect):
+        (WebCore::SelectionController::recomputeCaretRect):
+        (WebCore::SelectionController::invalidateCaretRect):
+        (WebCore::SelectionController::paintCaret):
+        (WebCore::SelectionController::caretRendersInsideNode):
+        * editing/SelectionController.h:
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::localCaretRect):
+        (WebCore::VisiblePosition::absoluteCaretBounds):
+        (WebCore::VisiblePosition::xOffsetForVerticalNavigation):
+        * editing/VisiblePosition.h:
+        * editing/mac/SelectionControllerMac.mm:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::isContentEditable):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::boundsForVisiblePositionRange):
+        * page/Frame.cpp:
+        (WebCore::Frame::firstRectForRange):
+        (WebCore::Frame::selectionLayoutChanged):
+        (WebCore::Frame::paintCaret):
+        (WebCore::Frame::paintDragCaret):
+        (WebCore::Frame::revealSelection):
+        (WebCore::Frame::revealCaret):
+        * page/Frame.h:
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintCaret):
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::positionForCoordinates):
+        (WebCore::RenderBlock::offsetForContents):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::localCaretRect):
+        * rendering/RenderBox.h:
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::localCaretRect):
+        * rendering/RenderFlow.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollToOffset):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::localCaretRect):
+        * rendering/RenderObject.h:
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::localCaretRect):
+        * rendering/RenderSVGInlineText.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::RenderText):
+        (WebCore::RenderText::localCaretRect):
+        * rendering/RenderText.h:
+
+2008-12-06  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 22711: Current svn (build 39065) fails to compile
+
+        <https://bugs.webkit.org/show_bug.cgi?id=22711>
+
+        BUILD FIX for r39065: Forgot parentheses after "document".
+
+        Bug 22666: Clean up data structures used when collecting URLs of subresources for webarchives
+        <https://bugs.webkit.org/show_bug.cgi?id=22666>
+
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::addSubresourceAttributeURLs): Changed
+        document to document().
+
+2008-12-06  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22710
+        Memory leak due to circular reference Document->DOMTimer->ScheduledAction->[JS objects]->Document
+
+        * bindings/js/DOMTimer.cpp:
+        (WebCore::DOMTimer::stop): Delete ScheduledAction, which contains a protected object.
+
+2008-12-06  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 22666: Clean up data structures used when collecting URLs of subresources for webarchives
+
+        <https://bugs.webkit.org/show_bug.cgi?id=22666>
+
+        Reviewed by Darin Adler.
+
+        When creating a webarchive from WebCore::LegacyWebArchive::create(),
+        HashSet<String>, Vector<KURL> and Vector<String> were all used to
+        store a list of URLs for resources found in the document.  Instead
+        use a single ListHashSet<KURL> to store the list and resolve the
+        relative URLs as they're added.  We use a new inline method called
+        WebCore::addSubresourceURL() to add KURL objects to the ListHashSet
+        to prevent "null" KURL objects from crashing in the KURL hashing
+        function.
+
+        * WebCore.base.exp: Changed export of
+        WebCore::Node::getSubresourceURLs() to take a ListHashSet<KURL>
+        argument instead of a Vector<KURL>.
+
+        * WebCore.xcodeproj/project.pbxproj: Marked KURLHash.h as a private
+        header for use in WebKit.
+
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::addSubresourceStyleURLs): Renamed from
+        addSubresourceURLStrings().  Changed to use ListHashSet<KURL>
+        instead of HashSet<String>.  Cleaned up code.
+        * css/CSSStyleSheet.h:
+        (WebCore::CSSStyleSheet::addSubresourceStyleURLs): Ditto.
+        * css/StyleSheet.h:
+        (WebCore::StyleSheet::addSubresourceStyleURLs): Ditto.
+
+        * dom/Node.cpp:
+        (WebCore::Node::getSubresourceURLs): Changed to use
+        ListHashSet<KURL> instead of Vector<KURL>.  Cleaned up code.
+        * dom/Node.h:
+        (WebCore::Node::getSubresourceURLs): Ditto.
+        (WebCore::Node::addSubresourceAttributeURLs): Renamed from
+        getSubresourceAttributeStrings().  Changed to use ListHashSet<KURL>
+        instead of Vector<String>.
+        (WebCore::addSubresourceURL): Added.  Safely adds new KURL objects
+        to a ListHashSet<KURL> object.  A "null" KURL object will cause the
+        hash function to crash since it contains a null StringImpl.  Used in
+        Node::addSubresourceAttributeURLs() and addSubresourceStyleURLs() in
+        the style subsystem.
+
+        * dom/ProcessingInstruction.cpp:
+        (WebCore::ProcessingInstruction::addSubresourceAttributeURLs):
+        Renamed from getSubresourceAttributeStrings().  Changed to use
+        ListHashSet<KURL> instead of Vector<String>.  Use
+        WebCore::addSubresourceURL() to add new KURL objects.
+        * dom/ProcessingInstruction.h: Ditto.
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::addSubresourceAttributeURLs): Ditto.
+        * html/HTMLBodyElement.h: Ditto.
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::addSubresourceAttributeURLs): Ditto.
+        * html/HTMLEmbedElement.h: Ditto.
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::addSubresourceAttributeURLs): Ditto.
+        * html/HTMLImageElement.h: Ditto.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::addSubresourceAttributeURLs): Ditto.
+        * html/HTMLInputElement.h: Ditto.
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::addSubresourceAttributeURLs): Ditto.
+        * html/HTMLLinkElement.h: Ditto.
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::addSubresourceAttributeURLs): Ditto.
+        * html/HTMLObjectElement.h: Ditto.
+        * html/HTMLParamElement.cpp:
+        (WebCore::HTMLParamElement::addSubresourceAttributeURLs): Ditto.
+        * html/HTMLParamElement.h: Ditto.
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::addSubresourceAttributeURLs): Ditto.
+        * html/HTMLScriptElement.h: Ditto.
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::addSubresourceAttributeURLs): Ditto.
+        * html/HTMLStyleElement.h: Ditto.
+        * html/HTMLTableCellElement.cpp:
+        (WebCore::HTMLTableCellElement::addSubresourceAttributeURLs): Ditto.
+        * html/HTMLTableCellElement.h: Ditto.
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::addSubresourceAttributeURLs): Ditto.
+        * html/HTMLTableElement.h: Ditto.
+
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::create): Changed from using
+        HashSet<String> to ListHashSet<KURL> for tracking unique
+        subresources.  Changed from using Vector<KURL> to ListHashSet<KURL>
+        when calling WebCore::Node::getSubresourceURLs().  Cleaned up code.
+
+        * svg/SVGCursorElement.cpp:
+        (WebCore::SVGCursorElement::addSubresourceAttributeURLs): Renamed
+        from getSubresourceAttributeStrings().  Changed to use
+        ListHashSet<KURL> instead of Vector<String>.  Use
+        WebCore::addSubresourceURL() to add new KURL objects.
+        * svg/SVGCursorElement.h: Ditto.
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::addSubresourceAttributeURLs): Ditto.
+        * svg/SVGFEImageElement.h: Ditto.
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::addSubresourceAttributeURLs): Ditto.
+        * svg/SVGImageElement.h: Ditto.
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::addSubresourceAttributeURLs): Ditto.
+        * svg/SVGScriptElement.h: Ditto.
+
+2008-12-05  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Make the page group use the proper link hashing functions rather than
+        calling the string hash functions directly. Add Chromium-specfic ifdefs
+        in the visited link computation functions to allow integration.
+
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::isLinkVisited):
+        (WebCore::PageGroup::addVisitedLink):
+        * platform/LinkHash.cpp:
+        (WebCore::visitedLinkHash):
+        * platform/LinkHash.h:
+
+2008-12-05  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22635
+        For iteration and end events, previous fixes to prevent the deletion of
+        Animation objects (ref counting and hanging onto a ref during event callbacks)
+        was sufficient to prevent dangling pointers. But start events are sent in
+        the styleAvailable() call, which iterates over CompositeAnimation objects,
+        which are not ref counted. So that object can get destroyed in the event
+        handler while still active. So I added refcounting for CompositeAnimations.
+
+        Additionally, when am iterating over the CompositingAnimation list, it can
+        be deleted, which mutates the list. So I now make one pass over the list
+        building a vector of CompositeAnimation objects that need to be called and
+        then iterate over that vector to make the actual calls.
+
+        Finally, to make sure the lifetime of the CompositeAnimation exceeds that of
+        the Animation objects it owns, I now keep a ref to the CompositeAnimation
+        in the timer callback for the iteration and end events. That means I no
+        longer need to keep a ref to the Animation objects themselves in that timer
+        callback, since the CompositeAnimation already has one.
+
+        Tests: animations/animation-iteration-event-destroy-renderer.html
+               animations/animation-start-event-destroy-renderer.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+        (WebCore::AnimationBase::animationTimerCallbackFired):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::~AnimationControllerPrivate):
+        (WebCore::AnimationControllerPrivate::accessCompositeAnimation):
+        (WebCore::AnimationControllerPrivate::clear):
+        (WebCore::AnimationControllerPrivate::styleAvailable):
+        (WebCore::AnimationControllerPrivate::updateAnimationTimer):
+        (WebCore::AnimationControllerPrivate::animationTimerFired):
+        (WebCore::AnimationControllerPrivate::isAnimatingPropertyOnRenderer):
+        (WebCore::AnimationControllerPrivate::suspendAnimations):
+        (WebCore::AnimationControllerPrivate::resumeAnimations):
+        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
+        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
+        (WebCore::AnimationController::updateAnimations):
+        (WebCore::AnimationController::setAnimationStartTime):
+        (WebCore::AnimationController::setTransitionStartTime):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::animationController):
+        (WebCore::CompositeAnimationPrivate::isWaitingForStyleAvailable):
+        (WebCore::CompositeAnimationPrivate::~CompositeAnimationPrivate):
+        (WebCore::CompositeAnimationPrivate::clearRenderer):
+        (WebCore::CompositeAnimation::clearRenderer):
+        (WebCore::CompositeAnimation::animationController):
+        (WebCore::CompositeAnimation::isWaitingForStyleAvailable):
+        * page/animation/CompositeAnimation.h:
+        (WebCore::CompositeAnimation::create):
+
+2008-12-05  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 22609: Provide a build-time choice when generating hash tables for properties of built-in DOM objects
+
+        <https://bugs.webkit.org/show_bug.cgi?id=22609>
+        <rdar://problem/6331749>
+
+        Reviewed by Darin Adler.
+
+        Initial patch by Yosen Lin.  Adapted for ToT WebKit by David Kilzer.
+
+        Added back the code that generates a "compact" hash (instead of a
+        perfect hash) as a build-time option using the
+        ENABLE(PERFECT_HASH_SIZE) macro as defined in Lookup.h.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        (GenerateImplementation): Compute the number of elements that will
+        be stored in each hash table and pass it to GenerateHashTable().
+        (GenerateHashTable): Added new second parameter representing the
+        number of elements to store in the compact hash table.  Added back
+        code to compute compact hash tables.  Generate both hash table sizes
+        and emit conditionalized code based on ENABLE(PERFECT_HASH_SIZE).
+
+2008-12-05  Brett Wilson  <brettw@chromium.org>
+
+        Fix build bustage from previous patch.
+
+        * css/CSSSelector.h:
+
+2008-12-05  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Add a missing include for OwnPtr to make CSSSelector compile without
+        precompiled headers.
+
+        * css/CSSSelector.h:
+
+2008-12-05  Finnur Thorarinsson  <finnur.webkit@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 22579: Providing a function to ScrollbarClient.h which allows us to get at the tickmarks
+        without relying on high-level WebCore types, as requested by Dave Hyatt.
+
+        No functional changes, thus no test cases.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::getTickmarks):
+        * page/FrameView.h:
+        * platform/ScrollbarClient.h:
+
+2008-12-05  Dean Jackson  <dino@apple.com>
+
+        Reviewed by David Hyatt.
+
+        Make sure Window event listeners also tell the
+        Document about the event type, so noisy events
+        will be dispatched even if nothing in the document
+        is listening.
+        https://bugs.webkit.org/show_bug.cgi?id=20572
+
+        * dom/Document.cpp:
+        (WebCore::Document::addWindowEventListener):
+
+2008-12-05  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r39026
+
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        Add some missing .get()s.
+
+2008-12-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Tiger build fix.
+
+        * platform/network/mac/ResourceRequestMac.mm: Define NSUInteger.
+
+2008-12-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6405599> Tiger Mail crashes when using "Mail Contents of This Page"
+        in Safari before opening a mail message in Mail
+
+        * platform/mac/WebCoreObjCExtras.mm:
+        (WebCoreObjCFinalizeOnMainThread):
+        Don't call initializeThreading: we now expect the caller to do it, to simplify keeping
+        Tiger and post-Tiger behavior in line.
+
+        * bindings/objc/DOMRGBColor.mm:
+        (+[DOMRGBColor initialize]):
+        * bindings/objc/WebScriptObject.mm:
+        (+[WebScriptObject initialize]):
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (+[AccessibilityObjectWrapper initialize]):
+        * platform/mac/SharedBufferMac.mm:
+        (+[WebCoreSharedBufferData initialize]):
+        Call JSC::initializeThreading();
+
+2008-12-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/4072827> Downloaded non-ASCII file name becomes garbled
+
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::setResponseContentDispositionEncodingFallbackArray):
+        * platform/network/ResourceRequestBase.h:
+        * platform/network/cf/ResourceRequestCFNet.cpp:
+        (WebCore::findCFURLRequestSetContentDispositionEncodingFallbackArrayFunction):
+        (WebCore::findCFURLRequestCopyContentDispositionEncodingFallbackArrayFunction):
+        (WebCore::setContentDispositionEncodingFallbackArray):
+        (WebCore::copyContentDispositionEncodingFallbackArray):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdateResourceRequest):
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):
+        Added a way to specify encoding fallback list for Content-Disposition header.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::addExtraFieldsToRequest): Generate and
+        pass a list of encodings to try when decoding Content-Disposition header, as described
+        in comments.
+
+2008-12-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22672
+        ASSERT(m_table) when xhr.onabort creates another xhr or calls setTimeout
+
+        Test: http/tests/xmlhttprequest/send-on-abort.html
+
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::canSuspendActiveDOMObjects):
+        (WebCore::ScriptExecutionContext::suspendActiveDOMObjects):
+        (WebCore::ScriptExecutionContext::resumeActiveDOMObjects):
+        (WebCore::ScriptExecutionContext::stopActiveDOMObjects):
+        Add a comment explaining that ActiveDOMObject methods shouldn't execute arbitrary JS.
+
+        * xml/XMLHttpRequest.cpp: (WebCore::XMLHttpRequest::stop): Don't dispatch events. This
+        reverts a recent change that made the behavior slightly closer to Firefox - but the
+        compatibility effect should be very minor if any, and Firefox itself behaves inconsistently.
+
+2008-12-05  Tobias König <tobias.koenig@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Record required package dependencies for the Qt build for a correct
+        pkg-config file.
+
+        * WebCore.pro:
+
+2008-12-05  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Rubber-stamped by Simon Hausmann.
+
+        [Qt/Mac] Blacklist QuickTime plugin until we support the QuickDraw drawing model
+
+        * plugins/mac/PluginPackageMac.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+        (WebCore::PluginPackage::isPluginBlacklisted):
+
+2008-12-05  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22472
+
+        Revises charset alias map for TextCodecICU.
+        - Uses windows-949 and windows-874 instead of windows-949-2000 and windows-874-2000
+        - Replaces 'windows874' in a couple of place with 'windows-874' (for the canonical name)
+        - Maps 'dos-874' to 'windows-874'. Currently, it's aliases to 'cp874', which is in turn
+          mapped to 'TIS-620'. 'TIS-620' is manually aliased to 'windows-874'. We'd better directly
+          alias 'dos-874' to 'windows-874'.
+        - Replaces 'EUC-CN' with 'GBK' when it's used as the canonical name.
+          Similar to the above case, we're getting rid of indirection that eventually leads to 'GBK' by
+          directly going to 'GBK'.
+        - Adds 'x-uhc' as an alias for 'windows-949'. It's used in some web pages.
+
+        Tests: fast/encoding/char-decoding-mac.html
+               fast/encoding/char-decoding.html
+
+        * platform/text/TextCodecICU.cpp:
+        (WebCore::TextCodecICU::registerExtendedEncodingNames):
+
+2008-12-04  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Add a MIME mapping for the .htm extension to wx and GTK ports.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22668
+
+        * platform/gtk/MIMETypeRegistryGtk.cpp:
+        (WebCore::):
+        * platform/wx/MimeTypeRegistryWx.cpp:
+        (WebCore::):
+
+2008-12-04  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Implement basic text paste support in wx and add notImplemented stubs
+        to catch other methods.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22667
+
+        * platform/wx/PasteboardWx.cpp:
+        (WebCore::Pasteboard::canSmartReplace):
+        (WebCore::Pasteboard::plainText):
+        (WebCore::Pasteboard::documentFragment):
+        (WebCore::Pasteboard::writeImage):
+
+2008-12-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for !USE(WXGC) build config.
+
+        * platform/graphics/wx/PathWx.cpp:
+        (WebCore::Path::contains):
+        (WebCore::Path::addLineTo):
+        (WebCore::Path::addQuadCurveTo):
+        (WebCore::Path::addBezierCurveTo):
+        (WebCore::Path::addArcTo):
+        (WebCore::Path::closeSubpath):
+        (WebCore::Path::addArc):
+        (WebCore::Path::addRect):
+        (WebCore::Path::addEllipse):
+        (WebCore::Path::transform):
+        (WebCore::Path::apply):
+        (WebCore::Path::isEmpty):
+
+2008-12-04  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Turn off styled controls until we can implement them properly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22662
+
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderThemeWx::isControlStyled):
+
+2008-12-04  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        wx implementations for Path API.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22661
+
+        * platform/graphics/wx/PathWx.cpp:
+        (WebCore::Path::~Path):
+        (WebCore::Path::contains):
+        (WebCore::Path::addLineTo):
+        (WebCore::Path::addQuadCurveTo):
+        (WebCore::Path::addBezierCurveTo):
+        (WebCore::Path::addArcTo):
+        (WebCore::Path::closeSubpath):
+        (WebCore::Path::addArc):
+        (WebCore::Path::addRect):
+        (WebCore::Path::addEllipse):
+        (WebCore::Path::transform):
+        (WebCore::Path::isEmpty):
+
+2008-12-04  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 22564: Make HTML elements' constructors take a QualifiedName
+        https://bugs.webkit.org/show_bug.cgi?id=22564
+
+        Updated the remaining constructors.
+
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::constructImage):
+        * dom/Document.cpp:
+        (WebCore::Document::getCSSCanvasElement):
+        * editing/DeleteButton.cpp:
+        (WebCore::DeleteButton::DeleteButton):
+        * html/HTMLAppletElement.cpp:
+        (WebCore::HTMLAppletElement::HTMLAppletElement):
+        * html/HTMLAppletElement.h:
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::HTMLAreaElement):
+        * html/HTMLAreaElement.h:
+        * html/HTMLBaseFontElement.cpp:
+        (WebCore::HTMLBaseFontElement::HTMLBaseFontElement):
+        * html/HTMLBaseFontElement.h:
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::HTMLCanvasElement):
+        * html/HTMLCanvasElement.h:
+        * html/HTMLElementFactory.cpp:
+        (WebCore::hrConstructor):
+        (WebCore::paragraphConstructor):
+        (WebCore::basefontConstructor):
+        (WebCore::fontConstructor):
+        (WebCore::anchorConstructor):
+        (WebCore::imageConstructor):
+        (WebCore::mapConstructor):
+        (WebCore::areaConstructor):
+        (WebCore::canvasConstructor):
+        (WebCore::appletConstructor):
+        (WebCore::embedConstructor):
+        (WebCore::objectConstructor):
+        (WebCore::paramConstructor):
+        (WebCore::scriptConstructor):
+        (WebCore::tableConstructor):
+        (WebCore::tableCaptionConstructor):
+        (WebCore::tableRowConstructor):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::HTMLEmbedElement):
+        * html/HTMLEmbedElement.h:
+        * html/HTMLFontElement.cpp:
+        (WebCore::HTMLFontElement::HTMLFontElement):
+        * html/HTMLFontElement.h:
+        * html/HTMLHRElement.cpp:
+        (WebCore::HTMLHRElement::HTMLHRElement):
+        * html/HTMLHRElement.h:
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::HTMLImageElement):
+        * html/HTMLImageElement.h:
+        * html/HTMLMapElement.cpp:
+        (WebCore::HTMLMapElement::HTMLMapElement):
+        * html/HTMLMapElement.h:
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::HTMLObjectElement):
+        * html/HTMLObjectElement.h:
+        * html/HTMLParagraphElement.cpp:
+        (WebCore::HTMLParagraphElement::HTMLParagraphElement):
+        * html/HTMLParagraphElement.h:
+        * html/HTMLParamElement.cpp:
+        (WebCore::HTMLParamElement::HTMLParamElement):
+        * html/HTMLParamElement.h:
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleError):
+        (WebCore::HTMLParser::mapCreateErrorCheck):
+        (WebCore::HTMLParser::handleIsindex):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::HTMLScriptElement):
+        * html/HTMLScriptElement.h:
+        * html/HTMLTableCaptionElement.cpp:
+        (WebCore::HTMLTableCaptionElement::HTMLTableCaptionElement):
+        * html/HTMLTableCaptionElement.h:
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::HTMLTableElement):
+        (WebCore::HTMLTableElement::createCaption):
+        (WebCore::HTMLTableElement::insertRow):
+        * html/HTMLTableElement.h:
+        * html/HTMLTableRowElement.cpp:
+        (WebCore::HTMLTableRowElement::HTMLTableRowElement):
+        * html/HTMLTableRowElement.h:
+        * html/HTMLTableSectionElement.cpp:
+        (WebCore::HTMLTableSectionElement::insertRow):
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::createContainingTable):
+        (WebCore::HTMLViewSourceDocument::addLine):
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageDocumentElement::ImageDocumentElement):
+
+2008-12-04  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        Add file missing from last commit.
+
+        * bindings/js/ScriptState.h: Added.
+
+2008-12-04  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Geoff Garen.
+
+        Implement ScriptState abstraction (initially, a simple typedef)
+        as means of carrying exception information across bindings boundaries
+        and in a script engine-independent way.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::scriptStateFromNode):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSNodeFilterCondition.h:
+        * bindings/js/ScriptState.h: Added.
+        * dom/NodeFilter.cpp:
+        (WebCore::NodeFilter::acceptNode):
+        * dom/NodeFilter.h:
+        (WebCore::NodeFilter::acceptNode):
+        * dom/NodeFilterCondition.cpp:
+        (WebCore::NodeFilterCondition::acceptNode):
+        * dom/NodeFilterCondition.h:
+        * dom/NodeIterator.cpp:
+        (WebCore::NodeIterator::nextNode):
+        (WebCore::NodeIterator::previousNode):
+        * dom/NodeIterator.h:
+        (WebCore::NodeIterator::nextNode):
+        (WebCore::NodeIterator::previousNode):
+        * dom/Traversal.cpp:
+        (WebCore::Traversal::acceptNode):
+        * dom/Traversal.h:
+        * dom/TreeWalker.cpp:
+        (WebCore::TreeWalker::parentNode):
+        (WebCore::TreeWalker::firstChild):
+        (WebCore::TreeWalker::lastChild):
+        (WebCore::TreeWalker::previousSibling):
+        (WebCore::TreeWalker::nextSibling):
+        (WebCore::TreeWalker::previousNode):
+        (WebCore::TreeWalker::nextNode):
+        * dom/TreeWalker.h:
+        (WebCore::TreeWalker::parentNode):
+        (WebCore::TreeWalker::firstChild):
+        (WebCore::TreeWalker::lastChild):
+        (WebCore::TreeWalker::previousSibling):
+        (WebCore::TreeWalker::nextSibling):
+        (WebCore::TreeWalker::previousNode):
+        (WebCore::TreeWalker::nextNode):
+
+2008-12-04  Pierre-Olivier Latour  <pol@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fixed pauseTransitionAtTimeOnElementWithId() in DRT asserting when passed invalid property name
+        and potential similar issue with pauseAnimationAtTimeOnElementWithId().
+
+        https://bugs.webkit.org/show_bug.cgi?id=22641
+
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::pauseAnimationAtTime):
+        (WebCore::CompositeAnimationPrivate::pauseTransitionAtTime):
+
+2008-12-04  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Remove unused Completion.h include.
+
+        * html/CanvasRenderingContext2D.cpp: Removed Completion.h include.
+
+2008-11-13  David Hyatt  <hyatt@apple.com>
+
+        Fix a bug in ScrollView's refactoring.  An isVisible check should have been isSelfVisible.
+
+        Reviewed by Darin Adler
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setParentVisible):
+
+2008-12-04  Friedemann Kleint  <friedemann.kleint@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix small translation glitch in the Qt file chooser.
+
+        * platform/qt/FileChooserQt.cpp:
+        (WebCore::FileChooser::basenameForWidth):
+
+2008-12-04  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Rubber-stamped by Simon Hausmann.
+
+        Blacklist Silverlight plugin on Qt/Mac until supported
+
+        Currently the plugin crashes with a corrupted stack trace, possibly
+        related to https://bugs.webkit.org/show_bug.cgi?id=20635
+
+        * plugins/mac/PluginPackageMac.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+        (WebCore::PluginPackage::isPluginBlacklisted):
+
+2008-12-03  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix non-Mac build.
+
+        * page/Chrome.cpp: (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
+
+2008-12-03  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove uses of document() in XMLHttpRequest where simple.
+        https://bugs.webkit.org/show_bug.cgi?id=22619
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::responseXML):
+        Return NULL in the worker case which is according to spec (and avoids using document()).
+
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+        (WebCore::XMLHttpRequest::initSend):
+        Use scriptExecutionContext() instead of document().
+
+2008-12-03  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Make ScriptExecutionContextTaskWorkerTask::performTask a pure virtual function.
+        https://bugs.webkit.org/show_bug.cgi?id=22642
+
+        * dom/Document.cpp:
+        (WebCore::ScriptExecutionContextTaskTimer::ScriptExecutionContextTaskTimer):
+        (WebCore::ScriptExecutionContextTaskTimer::fired):
+        (WebCore::PerformTaskContext::PerformTaskContext):
+        (WebCore::performTask):
+        (WebCore::Document::postTask):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.cpp:
+        * dom/ScriptExecutionContext.h:
+        * dom/WorkerContext.cpp:
+        (WebCore::ScriptExecutionContextTaskWorkerTask::create):
+        (WebCore::ScriptExecutionContextTaskWorkerTask::ScriptExecutionContextTaskWorkerTask):
+        (WebCore::ScriptExecutionContextTaskWorkerTask::performTask):
+        (WebCore::WorkerContext::postTask):
+        * dom/WorkerContext.h:
+
+2008-12-03  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Using ActiveDOMObject as base class for DOMTimer.
+        https://bugs.webkit.org/show_bug.cgi?id=22620
+
+        Using ActiveDOMObject simplifies the code because ActiveDOMObject
+        is wired for stop/pause/resume on loading/unloading/caching the page etc
+        so the timer-specific code that does the same can be removed.
+        In addition, timers can be now paused/resumed 'in place' which
+        makes it unnecessary to 'serialize' them into special PausedTimeouts
+        instance, so pause/resumeTimeouts implementation in JSDOMWindowBase can also be removed.
+        Also, moving TimeoutMap from JSDOMWindowBase to Document matches lifetime
+        of timeouts and makes it possible to not roundtrip them via PausedTimeouts
+        every time when JSDOMWindow wrapper is destroyed while the page is in the b/f cache.
+
+        Timeouts are now paused with other ActiveDOMObjects:
+        - before creating CachedPage in FrameLoader::commitProvisionalLoad()
+        - in JavaScriptDebugServer::setJavaScriptPaused
+        - during modal UI operations in Chrome::*
+        this is equivalent to previous usage of JSDOMWindowBase::pauseTimeouts()
+
+        Timeouts are stopped to prevent future firing from:
+        - FrameLoader::clear()
+        - FrameLoader::frameDetached()
+        this is equivalent to previous usage of JSDOMWindowBase::clearAllTimeouts()
+
+        This is also one of the steps to having timers in Workers. See the plan of
+        the next steps in the bug above.
+
+        * bindings/js/DOMTimer.cpp:
+        (WebCore::DOMTimer::DOMTimer):
+        (WebCore::DOMTimer::fired):
+        (WebCore::DOMTimer::hasPendingActivity):
+        (WebCore::DOMTimer::contextDestroyed):
+        (WebCore::DOMTimer::stop):
+        (WebCore::DOMTimer::suspend):
+        (WebCore::DOMTimer::resume):
+        (WebCore::DOMTimer::canSuspend): Implemented ActiveDOMObject methods.
+
+        * bindings/js/DOMTimer.h:
+        * bindings/js/JSDOMBinding.cpp: ActiveDOMObject can have no JS wrapper
+        (WebCore::markActiveObjectsForContext):
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::~JSDOMWindowBase):
+        (WebCore::JSDOMWindowBase::clear):
+        (WebCore::JSDOMWindowBase::installTimeout):
+        (WebCore::JSDOMWindowBase::removeTimeout):
+        (WebCore::JSDOMWindowBase::timerFired):
+        (WebCore::JSDOMWindowBase::disconnectFrame):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/ScriptController.cpp:
+        * bindings/js/ScriptController.h:
+
+        * dom/Document.cpp: Document now holds a hash map id->timeout
+        (WebCore::Document::addTimeout):
+        (WebCore::Document::removeTimeout):
+        (WebCore::Document::findTimeout):
+        * dom/Document.h:
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::CachedPage):
+        (WebCore::CachedPage::restore):
+        (WebCore::CachedPage::clear):
+        * history/CachedPage.h:
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::~JavaScriptDebugServer):
+        (WebCore::JavaScriptDebugServer::setJavaScriptPaused):
+        * inspector/JavaScriptDebugServer.h:
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        removed clearAllTimeouts since all ActiveDOMObjects will be stopped in FrameLoader::clear();
+        I don't see how the old comment can be correct - the code in the same method proceeds to invoke 'onunload'
+        and then calls into client which can be external code and can cause any active object created in onunload
+        to fire. We can stop them all before firing onunload but it does not make a lot of sense.
+        I have a test to go with the next patch which verifies that timers set in onunload do not fire.
+
+        (WebCore::FrameLoader::open):
+        * page/Chrome.cpp:
+        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
+        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
+
+2008-12-03  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        <rdar://problem/6018653> Extra blank line when pasting paragraph in plain text
+
+        In SnowLeopard, Mail occasionally adds an empty, unstyled paragraph at the
+        end of pasted content so that users don't get stuck with non-standard pargraph
+        spacing.  This content threw off our handling of interchange newlines.  Any interchange
+        newline, regardless of it's position in the incoming fragment was considered to be
+        "at the start" of the fragment, and would result in us inserting in a newline before
+        inserted content.  This patch makes the checks for interchange newlines more strict,
+        and treats interchange newlines found elsewhere as normal <br>s.
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment):
+        (WebCore::ReplacementFragment::removeInterchangeNodes):
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::init):
+        (WebCore::VisiblePosition::canonicalPosition):
+        * editing/VisiblePosition.h:
+
+2008-12-03  Eric Seidel  <eric@webkit.org>
+
+        Rubber-stamped by David Hyatt.
+
+        Bring the WebCore chromium build a couple steps closer to building.
+
+        * WebCore.scons:
+
+2008-12-03  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix.
+
+        * WebCoreSources.bkl:
+
+2008-12-03  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22636
+
+        Implement WML variable substitution & validation.
+        Created a framework for scriptable WML layout tests, that are able to test variable substiution & validation.
+
+        Tests: wml/variable-reference-invalid-character.html
+               wml/variable-reference-valid.html
+
+        * wml/WMLVariables.cpp:
+        (WebCore::isValidFirstVariableNameCharacter):
+        (WebCore::isValidVariableNameCharacter):
+        (WebCore::isValidVariableEscapingModeString):
+        (WebCore::isValidVariableName):
+        (WebCore::containsVariableReference):
+        (WebCore::substituteVariableReferences):
+        * wml/WMLVariables.h:
+
+2008-12-03  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Further preparations for WML layout tests.
+        - Enable variable substitution in Text.cpp - if the parent is a WMLElement derived class.
+        - Dump WMLMessageSource messages to the console, just like it's done for JSMessageSource
+        - Add helper method in Document.idl, to reset the WML page state to a well-known default state.
+          (will be used in the upcoming LayoutTests/wml testcases)
+
+         * dom/Document.cpp:
+        (WebCore::Document::resetWMLPageState):
+        * dom/Document.h:
+        * dom/Document.idl:
+        * dom/Text.cpp:
+        (WebCore::Text::insertedIntoDocument):
+        * dom/Text.h:
+        * page/Console.cpp:
+        (WebCore::Console::addMessage):
+        * wml/WMLPageState.h: Readd heper function
+        (WebCore::WMLPageState::hasVariables):
+
+2008-12-03  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Don't leak selectors in case selector list parsing failed.
+
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::~CSSParser):
+
+2008-12-03  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=22520
+
+        This is a regression (causes a crash of LayoutTests/animations/transform-animation-event-destroy-element.html).
+        This patch fixes the testcase.
+
+        This is another case of animations getting destroyed in the end animation callback and causing dangling
+        pointers on return. This one involves iterating over the CompositeAnimation, which has been destroyed.
+        So I now check for a null m_object pointer (which is nullified when the CompositeAnimation is destroyed)
+        and skip that call.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+
+2008-12-03  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22379
+        Make CSSOM use less memory
+
+        Reduce size of the CSSSelector by one more pointer by using an array
+        instead of a linked list to store them.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::CSSParser):
+        (WebCore::CSSParser::parseSelector):
+        (WebCore::CSSParser::createStyleRule):
+        * css/CSSParser.h:
+        (WebCore::CSSParser::reusableSelectorVector):
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::CSSSelector):
+        (WebCore::CSSSelector::~CSSSelector):
+        (WebCore::CSSSelector::isLastInSelectorList):
+        (WebCore::CSSSelector::setLastInSelectorList):
+        * css/CSSStyleRule.cpp:
+        (WebCore::CSSStyleRule::CSSStyleRule):
+        (WebCore::CSSStyleRule::~CSSStyleRule):
+        (WebCore::CSSStyleRule::selectorText):
+        * css/CSSStyleRule.h:
+        (WebCore::CSSStyleRule::adoptSelectorVector):
+        (WebCore::CSSStyleRule::selectorList):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSRuleSet::addRulesFromSheet):
+        * dom/Node.cpp:
+        (WebCore::forEachSelector):
+        (WebCore::selectorNeedsNamespaceResolution):
+        (WebCore::Node::querySelector):
+        (WebCore::Node::querySelectorAll):
+        * dom/SelectorNodeList.cpp:
+        (WebCore::createSelectorNodeList):
+        * dom/SelectorNodeList.h:
+
+2008-12-03  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22630
+        Assertion failure in XMLHttpRequest::contextDestroyed
+
+        Test: http/tests/xmlhttprequest/close-window.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::clear):
+        (WebCore::FrameLoader::commitProvisionalLoad):
+        Move stopping active objects to clear(), so that closing a window is also covered.
+
+        * xml/XMLHttpRequest.cpp: (WebCore::XMLHttpRequest::abort): Protect the object in abort(),
+        because internalAbort() deref()'s.
+
+2008-12-03  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Implement CSS 3 <angle> turn unit and support it
+        in rotations.
+        https://bugs.webkit.org/show_bug.cgi?id=22497
+
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::validUnit):
+        (WebCore::unitFromString):
+        (WebCore::CSSParser::lex):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::cssText):
+        (WebCore::CSSPrimitiveValue::parserValue):
+        * css/CSSPrimitiveValue.h:
+        (WebCore::CSSPrimitiveValue::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::createTransformOperations):
+        * css/tokenizer.flex:
+
+2008-12-03  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Make use of the gradient code in GraphicsContext and get rid of most of the
+        platform dependent code.
+
+        SVG should use the new Gradient support on GraphicsContext
+        https://bugs.webkit.org/show_bug.cgi?id=20543
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/FloatSize.h:
+        (WebCore::FloatSize::shrunkTo):
+        * svg/SVGLinearGradientElement.cpp:
+        (WebCore::SVGLinearGradientElement::buildGradient):
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::buildGradient):
+        * svg/graphics/SVGPaintServer.h:
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::SVGPaintServerGradient::SVGPaintServerGradient):
+        (WebCore::SVGPaintServerGradient::~SVGPaintServerGradient):
+        (WebCore::SVGPaintServerGradient::gradient):
+        (WebCore::SVGPaintServerGradient::setGradient):
+        (WebCore::findTextRootObject):
+        (WebCore::createMaskAndSwapContextForTextGradient):
+        (WebCore::clipToTextMask):
+        (WebCore::SVGPaintServerGradient::setup):
+        (WebCore::SVGPaintServerGradient::renderPath):
+        (WebCore::SVGPaintServerGradient::teardown):
+        * svg/graphics/SVGPaintServerGradient.h:
+        (WebCore::SVGPaintServerGradient::setGradientStops):
+        (WebCore::SVGPaintServerGradient::gradientStops):
+        * svg/graphics/SVGPaintServerLinearGradient.h:
+        * svg/graphics/SVGPaintServerRadialGradient.h:
+        * svg/graphics/cairo/SVGPaintServerGradientCairo.cpp: Removed.
+        * svg/graphics/cg/SVGPaintServerCg.cpp:
+        * svg/graphics/cg/SVGPaintServerGradientCg.cpp: Removed.
+        * svg/graphics/qt/SVGPaintServerGradientQt.cpp: Removed.
+        * svg/graphics/qt/SVGPaintServerLinearGradientQt.cpp: Removed.
+        * svg/graphics/qt/SVGPaintServerRadialGradientQt.cpp: Removed.
+
+2008-12-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix formatting.
+
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::createRareData):
+
+2008-12-03  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Adam Roben.
+
+        As Adam Roben noticed, synchronize MessageSource enum with Console.js, and add a comment.
+
+        * inspector/front-end/Console.js:
+        * page/Console.h:
+
+2008-12-03  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Next steps to make LayoutTests work:
+        Never access the main frame from WMLRefreshElement/WMLCardElement, but
+        the current documents frame (WML layout tests will run in an <iframe>)
+
+        Prepare WMLErrorHandling for the case that no tokenizer is available anymore
+        -> report errors through Console::addMessage(), so they get logged in the
+           expected layout test results.
+
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::setActiveCardInDocument):
+        * wml/WMLErrorHandling.cpp:
+        (WebCore::reportWMLError):
+        (WebCore::errorMessageForErrorCode):
+        * wml/WMLErrorHandling.h:
+        * wml/WMLRefreshElement.cpp:
+        (WebCore::WMLRefreshElement::executeTask):
+        * page/Console.cpp: Handle WMLMessageSource.
+        (WebCore::printMessageSourceAndLevelPrefix):
+        * page/Console.h: Add WMLMessageSource.
+        (WebCore::):
+
+2008-12-03  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Allow passing jsNull and jsUndefined to Qt plugins
+
+        Currently limited to functions with QString and QVariant arguments,
+        and properties of these types. Both jsNull and jsUndefined ends up
+        as default-constructed QStrings and QVariants, which means you can
+        check for isEmpty() and isValid() in the native plugin code.
+
+        Based on patches by Jade Han <jade.han@nokia.com>
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertValueToQVariant):
+        (JSC::Bindings::findMethodIndex):
+
+2008-12-03  Trenton Schulz  <trenton.schulz@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix the build with Qt for Mac OS X.
+
+        * platform/PurgeableBuffer.h: Use the dummy wrappers for now.
+
+2008-12-03  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix error handling in WMLSetvarElement. If an invalid variable reference is contained
+        in the 'name' attribute of <setvar>, a 'WMLErrorInvalidVariableName' error should be
+        reported, instead of 'WMLErrorInvalidVariableReference'.
+
+        * wml/WMLElement.cpp:
+        (WebCore::WMLElement::parseValueSubstitutingVariableReferences):
+        (WebCore::WMLElement::parseValueForbiddingVariableReferences):
+        * wml/WMLElement.h:
+        * wml/WMLSetvarElement.cpp:
+        (WebCore::WMLSetvarElement::parseMappedAttribute):
+        * wml/WMLSetvarElement.h:
+        (WebCore::WMLSetvarElement::name):
+        (WebCore::WMLSetvarElement::value):
+
+2008-12-03  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Preparations to get WML layout tests going.
+        Make WMLPageState an OwnPtr to Page, and let Page create it on demand.
+
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::wmlPageState):
+        * page/Page.h:
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::WMLDocument):
+        (WebCore::WMLDocument::finishedParsing):
+        (WebCore::wmlPageStateForDocument):
+        * wml/WMLPageState.h: Don't inherit from RefCounted anymore.
+        (WebCore::WMLPageState::hasVariables): Remove helper function.
+
+2008-12-03  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22627
+        fast/workers/worker-terminate.html fails randomly
+
+        The problem is that worker termination uses script timeouts, so an InterruptedExecutionError
+        is raised, and it sometimes reaches the main thread.
+
+        * dom/WorkerMessagingProxy.cpp:
+        (WebCore::WorkerExceptionTask::create):
+        (WebCore::WorkerExceptionTask::WorkerExceptionTask):
+        (WebCore::WorkerExceptionTask::performTask):
+        (WebCore::WorkerMessagingProxy::postWorkerException):
+        * dom/WorkerMessagingProxy.h:
+        Ignore exceptions that happen in terminated workers.
+
+2008-12-03  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove some unncessary includes.
+
+        * wml/WMLAccessElement.cpp:
+        * wml/WMLDocument.h:
+        * wml/WMLRefreshElement.cpp:
+
+2008-12-03  Alexey Proskuryakov  <ap@webkit.org>
+
+        Rubber-stamped by Cameron Zwarich and Adam Roben.
+
+        Fix a typo: m_executionForbidded.
+
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::WorkerScriptController):
+        (WebCore::WorkerScriptController::evaluate):
+        (WebCore::WorkerScriptController::forbidExecution):
+        * bindings/js/WorkerScriptController.h:
+
+2008-12-03  Dean McNamee  <deanm@chromium.org>
+
+        Bug 22623: Uninitialized memory access in cache parsing code
+        <https://bugs.webkit.org/show_bug.cgi?id=22623>
+
+        Reviewed by David Kilzer.
+
+        Initialize m_haveParsedCacheControlHeader and m_haveParsedPragmaHeader.
+
+        * platform/network/ResourceResponseBase.h:
+        (WebCore::ResourceResponseBase::ResourceResponseBase):
+
+2008-12-03  Antti Koivisto  <antti@apple.com>
+
+        Probable build fix.
+
+        * WebCoreSources.bkl:
+
+2008-12-03  Antti Koivisto  <antti@apple.com>
+
+        Forgot to commit these.
+
+        * dom/Node.cpp:
+        (WebCore::forEachTagSelector):
+        (WebCore::SelectorNeedsNamespaceResolutionFunctor::operator()):
+        (WebCore::Node::querySelector):
+        * dom/SelectorNodeList.cpp:
+        (WebCore::createSelectorNodeList):
+
+2008-12-03  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dan Bernstein and Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22379
+        Make CSSOM use less memory
+
+        Reduce size of the CSSSelector by 3/8 by moving rarely used fields to a rare data
+        struct. Browsing around with some instrumentation showed that ~0.1% of all selectors
+        encountered had rare data.
+
+        This also eliminates the CSSNthSelector subclass which will make possible to store
+        CSSSelectors in an array instead of a linked list for futher memory savings.
+
+        * css/CSSGrammar.y:
+        * css/CSSNthSelector.cpp: Removed.
+        * css/CSSNthSelector.h: Removed.
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::createFloatingSelector):
+        * css/CSSParser.h:
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::specificity):
+        (WebCore::CSSSelector::operator==):
+        (WebCore::CSSSelector::selectorText):
+        (WebCore::CSSSelector::setTagHistory):
+        (WebCore::CSSSelector::attribute):
+        (WebCore::CSSSelector::setAttribute):
+        (WebCore::CSSSelector::setArgument):
+        (WebCore::CSSSelector::setSimpleSelector):
+        (WebCore::CSSSelector::parseNth):
+        (WebCore::CSSSelector::matchNth):
+        (WebCore::CSSSelector::RareData::parseNth):
+        (WebCore::CSSSelector::RareData::matchNth):
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::CSSSelector):
+        (WebCore::CSSSelector::~CSSSelector):
+        (WebCore::CSSSelector::tagHistory):
+        (WebCore::CSSSelector::hasAttribute):
+        (WebCore::CSSSelector::argument):
+        (WebCore::CSSSelector::simpleSelector):
+        (WebCore::CSSSelector::RareData::RareData):
+        (WebCore::CSSSelector::createRareData):
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkSelector):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+
+2008-12-03  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove unneeded included file in WorkerThread.cpp.
+        https://bugs.webkit.org/show_bug.cgi?id=22613
+
+        * dom/WorkerThread.cpp: No need to include JSWorkerContext.h.
+
+2008-12-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22543
+        Consolidate ActiveDOMObject page cache interaction
+
+        Test: http/tests/xmlhttprequest/abort-on-leaving-page.html
+
+        * dom/ActiveDOMObject.cpp:
+        (WebCore::ActiveDOMObject::canSuspend):
+        (WebCore::ActiveDOMObject::suspend):
+        (WebCore::ActiveDOMObject::resume):
+        * dom/ActiveDOMObject.h:
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::canSuspendActiveDOMObjects):
+        (WebCore::ScriptExecutionContext::suspendActiveDOMObjects):
+        (WebCore::ScriptExecutionContext::resumeActiveDOMObjects):
+        * dom/ScriptExecutionContext.h:
+        Added methods for suspending and resuming active objects.
+
+        * dom/Worker.cpp:
+        (WebCore::Worker::canSuspend):
+        (WebCore::Worker::stop):
+        * dom/Worker.h:
+        Workers cannot be suspended yet. This is a change in behavior, as workers used to keep
+        running until their owner was destroyed.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading): No longer call stopActiveDOMObjects() here, because
+        their activity is not necessarily loading.
+        (WebCore::FrameLoader::canCachePage): Can only cache if all active objects can be suspended.
+        Previously, stopLoading() cancelled outstanding XMLHttpRequests, which made the page
+        uncacheable due to no-null main document error.
+        (WebCore::FrameLoader::commitProvisionalLoad): Suspend or stop active objects, depending on
+        whether the document will be cached.
+        (WebCore::FrameLoader::frameDetached): Stop active objects to let them clean up before their
+        context is destroyed.
+
+        * xml/XMLHttpRequest.h: added canSuspend().
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::canSuspend): Only XHRs that are not loading can be suspended.
+        (WebCore::XMLHttpRequest::stop): Call abort() instead of internalAbort() to dispatch events
+        for Firefox compatibility. This is a change in behavior that helps test that requests do
+        get aborted.
+        (WebCore::XMLHttpRequest::contextDestroyed): The request must have been stopped by now, so
+        assert that.
+
+2008-12-02  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 22606: Can <th> serves as the AXTitleUIElement for <td>?
+
+        Test: accessibility/th-as-title-ui.html
+
+        * page/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isGroup):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isGroup):
+        * page/AccessibilityRenderObject.h:
+        * page/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::rowIndexRange):
+        (WebCore::AccessibilityTableCell::columnIndexRange):
+        (WebCore::AccessibilityTableCell::titleUIElement):
+        * page/AccessibilityTableCell.h:
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+
+2008-12-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=22472
+
+        Override absoluteClippedOverflowRect() in RenderReplaced to return a rect
+        that is large enough to encompass the selection, so that the repainting of
+        selected replaced elements works correctly.
+
+        Test: fast/repaint/selected-replaced.html
+
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::selectionRect):
+        (WebCore::RenderReplaced::localSelectionRect):
+        (WebCore::RenderReplaced::absoluteClippedOverflowRect):
+        * rendering/RenderReplaced.h:
+
+2008-12-02  Gregory Hughes  <ghughes@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 22513: ZOOM: text selection does not send correct zoom bounds
+
+        When zoomed, text selection must send the zoom bounds in flipped
+        screen coordinates.
+
+        * editing/mac/SelectionControllerMac.mm:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+        * page/mac/WebCoreViewFactory.h:
+
+2008-12-02  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove support for 'now' from CSS (was
+        erroneously added to transition and animation delay)
+        https://bugs.webkit.org/show_bug.cgi?id=22571
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseAnimationDelay):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::mapAnimationDelay):
+        * css/CSSValueKeywords.in:
+
+2008-12-02  Eric Seidel  <eric@webkit.org>
+
+        Build fix, no review.
+
+        Fix the Mac and gtk builds:
+        Don't use a float to hold a double.
+        Remove a now duplicate symbol.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionLayoutChanged):
+        * platform/gtk/TemporaryLinkStubs.cpp:
+
+2008-12-02  Chris Fleizach  <cfleizach@apple.com>
+
+        Bug 22596: Some elements don't report AXBlockQuoteLevel
+        https://bugs.webkit.org/show_bug.cgi?id=22596
+
+        Reviewed by John Sullivan.
+
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (blockquoteLevel):
+        (AXAttributeStringSetBlockquoteLevel):
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+
+2008-12-02  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Correctly handle a theme returning a non-blinking interval.  We should
+        not set any timers when the interval is 0 (non-blinking), otherwise we
+        repeatedly set and destroy a blinking timer, causing a paint and timer
+        storm.  This is applicable to GTK and Windows, where a user can set a
+        non-blinking caret in their system preferences.
+
+        Renamed caretBlinkFrequency to the more accurate caretBlinkInterval.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionLayoutChanged):
+        * platform/Theme.h:
+        (WebCore::Theme::caretBlinkInterval):
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::caretBlinkInterval):
+        * platform/gtk/RenderThemeGtk.h:
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::caretBlinkInterval):
+
+2008-12-02  David Levin  <levin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22538
+
+        startsWith uses find which searches through the whole string if no match is found.
+        Using reverseFind with an index of 0 has the benefit of only searching for the match
+        at the beginning of the string.  This may only be a small benefit in the overall program,
+        but it may help in some cases when the string is big.
+
+        No observable change in behavior, so no test.
+
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::startsWith):
+
+2008-10-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Wrap a JSC-only hack in a USE(JSC) block to fix the v8 build.
+        https://bugs.webkit.org/show_bug.cgi?id=21951
+
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::forgetWrapper):
+
+2008-12-02  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add an ASSERT to try and catch the root cause of:
+        https://bugs.webkit.org/show_bug.cgi?id=22168
+        http://code.google.com/p/chromium/issues/detail?id=4122
+
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::emitText):
+
+2008-12-02  Brent Fulgham  <bfulgham@gmail.com>
+
+        Reviewed by Adam Roben.
+
+        Remove some CG-specific code from the Windows Cairo build.
+        https://bugs.webkit.org/show_bug.cgi?id=22586
+
+        No new test cases since this update should create no user-visible
+        changes, and should be fully covered by the existing regression
+        tests.
+
+        * WebCore.vcproj/WebCore.vcproj: Remove FontDatabase from
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::focusRingColor): Add stub method
+        * platform/win/TemporaryLinkStubs.cpp:
+        (WebCore::populateFontDatabase): Add stub method.
+
+2008-12-01 Laszlo Gombos <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        MinGW compilation fix for PluginPackageWin.cpp
+
+        https://bugs.webkit.org/show_bug.cgi?id=22585
+
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+
+2008-12-02  Adam Roben  <aroben@apple.com>
+
+        Build fix for Windows projects with NOMINMAX defined globally
+
+        * platform/win/COMPtr.h: Don't redefine NOMINMAX if it's already
+        defined.
+
+2008-12-02  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Build JavaScriptCore into libQtWebKit.so through a direct build
+        instead of a static library. When linking a static library into
+        a shared library qmake generates an incorrect .prl file, which
+        causes all sorts of different build problems when linking against
+        QtWebKit. Fixing this in qmake requires bigger changes that are
+        currently not possible, so we need to work around this limitation
+        for now. The advantages of the separate build did not outweight the
+        build problems it caused.
+
+        * WebCore.pro: include JavaScriptCore.pri, re-enable prl support
+        and rename the lut generator to domlut to avoid a conflict with
+        JavaScriptCore.pri's lut generator.
+
+2008-12-02  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22588
+        Move securityOrigin() from Document and WorkerContext into ScriptExecutionContext.
+
+        No observable change in behavior, so no test.
+
+        * dom/Document.cpp:
+        (WebCore::Document::open):
+        (WebCore::Document::domain):
+        (WebCore::Document::setDomain):
+        (WebCore::Document::initSecurityContext):
+        (WebCore::Document::setSecurityOrigin):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::setSecurityOrigin):
+        * dom/ScriptExecutionContext.h:
+        (WebCore::ScriptExecutionContext::securityOrigin):
+        * dom/WorkerContext.cpp:
+        (WebCore::WorkerContext::WorkerContext):
+        * dom/WorkerContext.h:
+        These changes are for the move of securityOrigin().
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::createRequest):
+        (WebCore::XMLHttpRequest::makeSimpleCrossSiteAccessRequest):
+        (WebCore::XMLHttpRequest::makeCrossSiteAccessRequestWithPreflight):
+        (WebCore::XMLHttpRequest::handleAsynchronousPreflightResult):
+        (WebCore::XMLHttpRequest::setRequestHeader):
+        (WebCore::XMLHttpRequest::getAllResponseHeaders):
+        (WebCore::XMLHttpRequest::getResponseHeader):
+        (WebCore::XMLHttpRequest::processSyncLoadResults):
+        (WebCore::XMLHttpRequest::willSendRequest):
+        (WebCore::XMLHttpRequest::accessControlCheck):
+        (WebCore::XMLHttpRequest::didReceiveResponsePreflight):
+        Change XMLHttpRequest to use ScriptExecutionContext instead of Document to access securityOrigin().
+
+2008-12-02  André Pönitz  <apoenitz@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Disable the creation of debug information for the Qt build when done
+        inside Qt. With 670 mb it was slowing down gdb start significantly
+        for third-party applications that usually don't need it.
+
+        * WebCore.pro:
+
+2008-12-01  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=13736 REGRESSION
+        (r19811): Using the down arrow in a textarea gets "stuck" at the
+        end of a wrapped line
+        And corresponding: <rdar://problem/5347931>
+
+        The basic problem here is that Position::getInlineBoxAndOffset()
+        failed to look beyond a single renderer. This patch looks for a
+        better match beyond the first renderer when the affinity is
+        downstream and we failed to find a "perfect" match.
+        * dom/Position.cpp:
+        (WebCore::isNonTextLeafChild):
+        (WebCore::searchAheadForBetterMatch):
+        (WebCore::Position::getInlineBoxAndOffset):
+
+        This is a fix I made based on code inspection. It looks like the
+        old code here and skipped over the parent as a possible match.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::nextInPreOrderAfterChildren):
+
+2008-12-01  Brent Fulgham  <bfulgham@gmail.com>
+
+        Reviewed by Adam Roben.
+
+        Add WML related files to Visual Studio projects.
+        https://bugs.webkit.org/show_bug.cgi?id=22561
+
+        * WebCore.vcproj/WebCore.vcproj:
+          1. Add files from the wml directory to the set of windows files.
+          2. Extend include paths with new wml directory.
+          3. Add new autogenerated WML files to DerivedSources.
+          4. Alphabetize preprocesor includes (holdover from earlier debugging).
+
+2008-12-01  Steve Falkenburg  <sfalken@apple.com>
+
+        Revise node/selection image fix.
+        Moved updateLayout call so selection rect is fetched after the layout.
+
+        Reviewed by Adam Roben.
+
+        * page/win/FrameCGWin.cpp:
+        (WebCore::imageFromRect):
+        (WebCore::imageFromSelection):
+        (WebCore::Frame::nodeImage):
+
+2008-12-01  Steve Falkenburg  <sfalken@apple.com>
+
+        Support needed to implement renderedImage for Windows.
+        https://bugs.webkit.org/show_bug.cgi?25648
+
+        Reviewed by Adam Roben.
+
+        * page/Frame.h:
+        * page/win/FrameCGWin.cpp:
+        (WebCore::imageFromRect):
+        (WebCore::imageFromSelection):
+        (WebCore::Frame::nodeImage):
+        * page/win/FrameCairoWin.cpp:
+        (WebCore::imageFromNode):
+
+2008-12-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=22581
+
+        Fix the painting of the caps lock indicator for transformed text inputs,
+        by replacing a call to absoluteContentBox() with code that computes the
+        painting rect for the input contents.
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::paint):
+
+2008-12-01  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Add two new helper functions to WMLElement, parseValueSubstitutingVariableReferences/parseValueForbiddingVariableReferences.
+
+        Convert all elements to parse their attribute values using these new helper functions. This simplifies the
+        actual attribute parsing code in all WMLElement derived classes, as most WML attribute values either report
+        an error if there's a variable reference used in the attribute value, or if it's invalid.
+
+        Split the WMLErrorInvalidVariableReference error which covered both 'invalid syntax' / 'wrong location'
+        in two seperated error codes: WMLErrorInvalidVariableReference / WMLErrorInvalidVariableReferenceLocation.
+
+        * wml/WMLAccessElement.cpp:
+        (WebCore::WMLAccessElement::parseMappedAttribute):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::defaultEventHandler):
+        (WebCore::WMLDoElement::parseMappedAttribute):
+        * wml/WMLElement.cpp:
+        (WebCore::WMLElement::parseValueSubstitutingVariableReferences):
+        (WebCore::WMLElement::parseValueForbiddingVariableReferences):
+        * wml/WMLElement.h:
+        * wml/WMLErrorHandling.cpp:
+        (WebCore::reportWMLError):
+        * wml/WMLErrorHandling.h:
+        (WebCore::):
+        * wml/WMLOnEventElement.cpp:
+        (WebCore::WMLOnEventElement::parseMappedAttribute):
+        * wml/WMLPrevElement.cpp:
+        (WebCore::WMLPrevElement::executeTask):
+        * wml/WMLSetvarElement.cpp:
+        (WebCore::WMLSetvarElement::parseMappedAttribute):
+        * wml/WMLTimerElement.cpp:
+        (WebCore::WMLTimerElement::parseMappedAttribute):
+
+2008-12-01  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fix switching active cards within a document. No way to test, until <go> support is implemented.
+
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::showCard):
+        (WebCore::WMLCardElement::hideCard):
+        (WebCore::WMLCardElement::setActiveCardInDocument):
+        * wml/WMLCardElement.h:
+
+2008-12-01  David Kilzer  <ddkilzer@apple.com>
+
+        Fix logic error in LegacyWebArchive::create() from r38884.
+
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::create): Only continue if the
+        subresource is actually added.
+
+2008-12-01  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 22466: REGRESSION (35867): Many resources missing when saving webarchive of webkit.org
+
+        <https://bugs.webkit.org/show_bug.cgi?id=22466>
+        <rdar://problem/6403593>
+
+        Reviewed by Brady Eidson.
+
+        Test: http/tests/webarchive/test-preload-resources.html
+
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::create): Check the WebCore cache for
+        resources if DocumentLoader::subresource() doesn't return them.
+        Note that the DocumentLoader::subresource() method returned
+        preloaded resources before r35867, but this caused a regression in
+        Mail.
+
+2008-12-01  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 22564: Make HTML elements' constructors take a QualifiedName
+        https://bugs.webkit.org/show_bug.cgi?id=22564
+
+        - Modified the remaining HTML elements' constructors to take a QualifiedName.
+
+        - Added an assertion that the QualifiedName given corresponds to the element constructed.
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::constructAudio):
+        * html/HTMLAudioElement.cpp:
+        (WebCore::HTMLAudioElement::HTMLAudioElement):
+        * html/HTMLAudioElement.h:
+        * html/HTMLBRElement.cpp:
+        (WebCore::HTMLBRElement::HTMLBRElement):
+        * html/HTMLBRElement.h:
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::setInnerText):
+        * html/HTMLElementFactory.cpp:
+        (WebCore::brConstructor):
+        (WebCore::quoteConstructor):
+        (WebCore::marqueeConstructor):
+        (WebCore::audioConstructor):
+        (WebCore::videoConstructor):
+        (WebCore::sourceConstructor):
+        * html/HTMLMarqueeElement.cpp:
+        (WebCore::HTMLMarqueeElement::HTMLMarqueeElement):
+        * html/HTMLMarqueeElement.h:
+        * html/HTMLQuoteElement.cpp:
+        (WebCore::HTMLQuoteElement::HTMLQuoteElement):
+        * html/HTMLQuoteElement.h:
+        * html/HTMLSourceElement.cpp:
+        (WebCore::HTMLSourceElement::HTMLSourceElement):
+        * html/HTMLSourceElement.h:
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::HTMLVideoElement):
+        * html/HTMLVideoElement.h:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::updateFromElement):
+
+2008-12-01  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Antti Koivisto.
+
+        Bug 22441: Bridge the gap between the generated ElementFactory and HTMLElementFactory
+        https://bugs.webkit.org/show_bug.cgi?id=22441
+
+        Add an assertion to the modified HTML elements' constructor
+        to check that the QualifiedName parameter is the one that
+        matches the Element's.
+
+        * html/HTMLBaseElement.cpp:
+        (WebCore::HTMLBaseElement::HTMLBaseElement):
+        * html/HTMLBlockquoteElement.cpp:
+        (WebCore::HTMLBlockquoteElement::HTMLBlockquoteElement):
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::HTMLBodyElement):
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::HTMLButtonElement):
+        * html/HTMLDListElement.cpp:
+        (WebCore::HTMLDListElement::HTMLDListElement):
+        * html/HTMLDirectoryElement.cpp:
+        (WebCore::HTMLDirectoryElement::HTMLDirectoryElement):
+        * html/HTMLDivElement.cpp:
+        (WebCore::HTMLDivElement::HTMLDivElement):
+        * html/HTMLFieldSetElement.cpp:
+        (WebCore::HTMLFieldSetElement::HTMLFieldSetElement):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::HTMLFormElement):
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::HTMLFrameElement):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::HTMLFrameSetElement):
+        * html/HTMLHeadElement.cpp:
+        (WebCore::HTMLHeadElement::HTMLHeadElement):
+        * html/HTMLHtmlElement.cpp:
+        (WebCore::HTMLHtmlElement::HTMLHtmlElement):
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::HTMLIFrameElement):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::HTMLInputElement):
+        * html/HTMLIsIndexElement.cpp:
+        (WebCore::HTMLIsIndexElement::HTMLIsIndexElement):
+        * html/HTMLKeygenElement.cpp:
+        (WebCore::HTMLKeygenElement::HTMLKeygenElement):
+        * html/HTMLLIElement.cpp:
+        (WebCore::HTMLLIElement::HTMLLIElement):
+        * html/HTMLLabelElement.cpp:
+        (WebCore::HTMLLabelElement::HTMLLabelElement):
+        * html/HTMLLegendElement.cpp:
+        (WebCore::HTMLLegendElement::HTMLLegendElement):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::HTMLLinkElement):
+        * html/HTMLMenuElement.cpp:
+        (WebCore::HTMLMenuElement::HTMLMenuElement):
+        * html/HTMLMetaElement.cpp:
+        (WebCore::HTMLMetaElement::HTMLMetaElement):
+        * html/HTMLOListElement.cpp:
+        (WebCore::HTMLOListElement::HTMLOListElement):
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::HTMLOptGroupElement):
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::HTMLOptionElement):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::HTMLSelectElement):
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::HTMLStyleElement):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
+        * html/HTMLTitleElement.cpp:
+        (WebCore::HTMLTitleElement::HTMLTitleElement):
+        * html/HTMLUListElement.cpp:
+        (WebCore::HTMLUListElement::HTMLUListElement):
+
+2008-12-01  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22046
+
+        Fixed another case of crashing because the animation object is getting deleted when
+        it's in the middle of a callback. I actually moved where I am retaining the pointer
+        up out of the lower level AnimationBase code and into the timer callback that calls
+        them. So now the pointer is valid throughout the entire sequence of callback code.
+
+        The testcase for https://bugs.webkit.org/show_bug.cgi?id=22052 also exhibits a
+        crash which this patch fixes.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+        (WebCore::AnimationBase::animationTimerCallbackFired):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::setAnimationStartTime):
+        (WebCore::CompositeAnimationPrivate::setTransitionStartTime):
+        (WebCore::CompositeAnimationPrivate::styleAvailable):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::sendTransitionEvent):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::sendAnimationEvent):
+        (WebCore::KeyframeAnimation::resumeOverriddenAnimations):
+
+2008-12-01  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt/Mac] Initialize NPAPI plugins before getting their entry points
+
+        The old behavior (calling NP_GetEntryPoints before NP_Initialize) was
+        copied from Windows, but caused Silverlight on Mac to crash when loaded.
+
+        Apparently the call order of NP_Initialize and NP_GetEntryPoints is
+        reversed on Mac. See https://bugzilla.mozilla.org/show_bug.cgi?id=344425
+
+        Reported-by: Peter Johnson <peter@zattoo.com>
+
+        * plugins/mac/PluginPackageMac.cpp:
+        (WebCore::PluginPackage::load):
+
+2008-11-30  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by John Sullivan.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22510
+        Crash at WebCore::AccessibilityRenderObject::activeDescendant() on Google Reader with ARIA (22510)
+
+        A nil pointer needed to be checked
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::activeDescendant):
+
+2008-11-30  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22530
+        Assertion failures seen on buildbot due to uninitialized WorkerThread::m_threadID
+
+        * dom/WorkerThread.cpp:
+        (WebCore::WorkerThread::start): Protect worker startup with a mutex to ensure that this
+        function runs to completion before the thread begins execution.
+        (WebCore::WorkerThread::workerThread): Updated comments.
+        (WebCore::WorkerThread::stop): Ditto.
+        * dom/WorkerThread.h: Renamed m_workerContextMutex to m_threadCreationMutex, because it now
+        protects startup as a whole.
+
+        * storage/DatabaseThread.cpp:
+        * storage/DatabaseThread.h:
+        * storage/LocalStorageThread.cpp:
+        * storage/LocalStorageThread.h:
+        Fixed the same m_threadID problem.
+
+2008-11-29  Brent Fulgham  <bfulgham@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove Visual Studio project dependencies on non-redistributable
+        components in the Debug_Cairo and Release_Cairo build targets.
+        See https://bugs.webkit.org/show_bug.cgi?id=22527
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2008-11-29  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Alexey Proskuryakov.
+
+        Fix some sorting
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2008-11-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21063
+        NULL pointer crash in dispatchEvent(null);
+
+        Test: fast/events/dispatchEvent-crash.html
+
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::dispatchEvent):
+        * dom/Worker.cpp:
+        (WebCore::Worker::dispatchEvent):
+        * dom/WorkerContext.cpp:
+        (WebCore::WorkerContext::dispatchEvent):
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::dispatchEvent):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::dispatchEvent):
+        * xml/XMLHttpRequestUpload.cpp:
+        (WebCore::XMLHttpRequestUpload::dispatchEvent):
+
+2008-11-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=22454
+          <rdar://problem/6405550> REGRESSION (3.2-TOT): Crash below FontFallbackList::fontDataAt on jacobian.org
+
+        Test: http/tests/misc/font-face-in-multiple-segmented-faces.html
+
+        The crash happened because style recalculation was invoked by
+        CSSFontSelector after one CSSSegmentedFontFace had pruned its tables but
+        before another CSSSegmentedFontFace using the same CSSFontFace had done
+        so. The fix is to let all CSSSegmentedFontFaces using the CSSFontFace
+        prune their tables before telling the CSSFontSelector to recalc style.
+
+        * css/CSSFontFace.cpp:
+        (WebCore::CSSFontFace::fontLoaded):
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::fontLoaded):
+        * css/CSSFontSelector.h:
+        * css/CSSSegmentedFontFace.cpp:
+        (WebCore::CSSSegmentedFontFace::fontLoaded):
+
+2008-11-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=14968
+        document.open() erroneously returns void instead of the new Document
+
+        Test: fast/dom/HTMLDocument/document-open-return-value.html
+
+        * bindings/js/JSHTMLDocumentCustom.cpp: (WebCore::JSHTMLDocument::open):
+        Return the document on which this method was invoked, per HTML5.
+
+2008-11-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22550
+
+        Add <timer> element support. It provides a way to execute a task with a delay.
+        The user is notified by firing the task associated with the <card>'s ontimer attribute.
+        Only one timer element is allowed per <card> (fix wrong error message in reportWMLError)
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::WMLCardElement):
+        (WebCore::WMLCardElement::setIntrinsicEventTimer):
+        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded):
+        * wml/WMLCardElement.h:
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::defaultEventHandler):
+        * wml/WMLErrorHandling.cpp:
+        (WebCore::reportWMLError):
+        * wml/WMLPageState.h:
+        (WebCore::WMLPageState::getVariable):
+        * wml/WMLPrevElement.cpp:
+        (WebCore::WMLPrevElement::executeTask):
+        * wml/WMLRefreshElement.cpp:
+        (WebCore::WMLRefreshElement::executeTask):
+        * wml/WMLTagNames.in:
+        * wml/WMLTimerElement.cpp: Added.
+        (WebCore::WMLTimerElement::WMLTimerElement):
+        (WebCore::WMLTimerElement::parseMappedAttribute):
+        (WebCore::WMLTimerElement::insertedIntoDocument):
+        (WebCore::WMLTimerElement::timerFired):
+        (WebCore::WMLTimerElement::start):
+        (WebCore::WMLTimerElement::stop):
+        (WebCore::WMLTimerElement::storeIntervalToPageState):
+        * wml/WMLTimerElement.h: Added.
+
+2008-11-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Holger Freyther.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22549
+
+        Add <do> element support. It provides a way to bind a task element to a <template>/<card> element.
+        Changes numerous of layout tests which contain <do> elements, as they render as buttons now.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::updateFromElement):
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::registerDoElement):
+        * wml/WMLCardElement.h:
+        * wml/WMLDoElement.cpp: Added.
+        (WebCore::WMLDoElement::WMLDoElement):
+        (WebCore::WMLDoElement::defaultEventHandler):
+        (WebCore::WMLDoElement::parseMappedAttribute):
+        (WebCore::WMLDoElement::insertedIntoDocument):
+        (WebCore::WMLDoElement::createRenderer):
+        (WebCore::WMLDoElement::recalcStyle):
+        * wml/WMLDoElement.h: Added.
+        (WebCore::WMLDoElement::registerTask):
+        (WebCore::WMLDoElement::isActive):
+        (WebCore::WMLDoElement::label):
+        (WebCore::WMLDoElement::name):
+        (WebCore::WMLDoElement::setActive):
+        (WebCore::WMLDoElement::setNoop):
+        * wml/WMLNoopElement.cpp:
+        (WebCore::WMLNoopElement::insertedIntoDocument):
+        * wml/WMLTagNames.in:
+        * wml/WMLTaskElement.cpp:
+        (WebCore::WMLTaskElement::insertedIntoDocument):
+
+2008-11-28  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22545
+
+        Add onenterforward/onenterbackward/ontimer support for <card> elements.
+
+        No testing possible at the moment because WMLGoElement is not yet implemented.
+        After that we can add tests covering the <card> event handling.
+
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::WMLCardElement):
+        (WebCore::WMLCardElement::handleIntrinsicEventIfNeeded):
+        (WebCore::WMLCardElement::parseMappedAttribute):
+        (WebCore::WMLCardElement::setActiveCardInDocument):
+        * wml/WMLCardElement.h:
+        (WebCore::WMLCardElement::isNewContext):
+        (WebCore::WMLCardElement::isOrdered):
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::finishedParsing):
+        * wml/WMLIntrinsicEvent.cpp:
+        (WebCore::WMLIntrinsicEvent::WMLIntrinsicEvent):
+        * wml/WMLIntrinsicEvent.h:
+        (WebCore::WMLIntrinsicEvent::create):
+
+2008-11-27  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Regression seen on QtWebKit - causes a build failure on Win using MinGW
+
+        https://bugs.webkit.org/show_bug.cgi?id=22536
+
+        * WebCore.pro:
+
+2008-11-28  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix compilation and linking on Windows CE.
+
+        Use WIN_OS instead of WIN and therefore exclude determineModuleVersionFromDescription()
+        from the Windows'ish build.
+
+        Link against the newly required mmtimer.
+
+        * WebCore.pro:
+        * plugins/PluginPackage.cpp:
+
+2008-11-28  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        http://bugs.webkit.org/show_bug.cgi?id=22524
+
+        Made static initializations in XMLHttpRequest.cpp thread-safe in preparation for usage
+        of XMLHttpRequest by Workers (on threads).
+
+        No observable change in behavior, so no test.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequestStaticData::XMLHttpRequestStaticData):
+        (WebCore::PreflightResultCacheItem::allowsCrossSiteMethod):
+        (WebCore::PreflightResultCacheItem::allowsCrossSiteHeaders):
+        (WebCore::PreflightResultCacheItem::allowsRequest):
+        (WebCore::createXMLHttpRequestStaticData):
+        (WebCore::initializeXMLHttpRequestStaticData):
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::isSafeRequestHeader):
+        (WebCore::XMLHttpRequest::isOnAccessControlResponseHeaderWhitelist):
+        * xml/XMLHttpRequest.h:
+
+2008-11-27  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        r38825, was committed without checking whether anything in WebCore
+        uses JSFunction::m_body. Use the appropriate getters and setters
+        instead.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+
+2008-11-27  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22529
+        Crashes seen on buildbots due to trying to stop a worker thread twice
+
+        * dom/WorkerMessagingProxy.cpp: (WebCore::WorkerMessagingProxy::workerObjectDestroyed):
+        Don't try to stop the thread if it's already stopping.
+
+2008-11-27  Kent Hansen  <khansen@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Make JavaScript bindings for Qt plugin widgets work again
+        this was a regression; need to handle non-NPAPI plugins as in 4.4.
+
+        * bindings/js/ScriptControllerQt.cpp:
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+
+2008-11-26  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22522
+
+        Catch WML errors (invalid variable name/reference, multiple access elements, etc)
+        while parsing the document, and stop parsing immediately and wrap the document
+        fragment in a XHTML error document, just like it's done from XML parsing errors.
+
+        Until now all card elements were hidden by default (no renderer created), and
+        WMLDocument::finishedParsing() took care of showing the right card (either the first,
+        or any named card in the document, specified by document URL reference). Change this
+        behaviour to support displaying partially parsed WML document fragments: Mark the first
+        WMLCardElement inserted into the document as visible. If the document parsing finishes
+        without problems, WMLDocument::finishedParsing() will be called, which takes care of
+        showing the desired card (common case: first card in the document, which is already
+        visible, so nothing actually has to be done). If an error occours, the document is
+        correctly rendered until the error happened - wrapped in a XHTML document.
+
+        Fixes: fast/wml/err-event-binding-conflict.wml
+               fast/wml/err-invalid-variable-name.wml
+               fast/wml/err-multi-access.wml
+               fast/wml/err-unallowed-task-in-anchor.wml
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * wml/WMLAccessElement.cpp:
+        (WebCore::WMLAccessElement::parseMappedAttribute):
+        (WebCore::WMLAccessElement::insertedIntoDocument):
+        * wml/WMLAccessElement.h:
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::insertedIntoDocument):
+        (WebCore::WMLCardElement::setActiveCardInDocument):
+        * wml/WMLCardElement.h:
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::finishedParsing):
+        * wml/WMLErrorHandling.cpp: Added.
+        (WebCore::reportWMLError):
+        * wml/WMLErrorHandling.h: Added.
+        (WebCore::):
+        * wml/WMLIntrinsicEventHandler.cpp:
+        (WebCore::WMLIntrinsicEventHandler::registerIntrinsicEvent):
+        * wml/WMLIntrinsicEventHandler.h:
+        * wml/WMLNoopElement.cpp:
+        (WebCore::WMLNoopElement::insertedIntoDocument):
+        * wml/WMLOnEventElement.cpp:
+        (WebCore::WMLOnEventElement::parseMappedAttribute):
+        (WebCore::WMLOnEventElement::registerTask):
+        * wml/WMLPageState.cpp:
+        (WebCore::WMLPageState::setNeedCheckDeckAccess):
+        * wml/WMLPageState.h:
+        * wml/WMLSetvarElement.cpp:
+        (WebCore::WMLSetvarElement::parseMappedAttribute):
+
+2008-11-26  Glenn Wilson  <gwilson@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fixed bug http://bugs.webkit.org/show_bug.cgi?id=21953
+
+        This fixes the crash when the small-caps font variant is used
+        on a lower-case glyph that does not have a corresponding
+        upper-case glyph defined in the set of available fonts.
+
+        This changes Font.cpp to check if the font being used exists before trying to apply the small-caps variant.
+
+        Test: fast/css/small-caps-crash.html
+
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::glyphDataForCharacter):
+
+2008-11-26  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        Add a new platform specific method cleanupAfterSystemDrag
+        that platforms can ue to clean up drag state after a
+        system drag.  Use this method on PLAFORM(MAC).
+        https://bugs.webkit.org/show_bug.cgi?id=21956
+
+        * ChangeLog:
+        * page/DragController.cpp:
+        (WebCore::DragController::doSystemDrag):
+        * page/DragController.h:
+        * page/gtk/DragControllerGtk.cpp:
+        (WebCore::DragController::cleanupAfterSystemDrag):
+        * page/mac/DragControllerMac.mm:
+        (WebCore::DragController::cleanupAfterSystemDrag):
+        * page/qt/DragControllerQt.cpp:
+        (WebCore::DragController::cleanupAfterSystemDrag):
+        * page/win/DragControllerWin.cpp:
+        (WebCore::DragController::cleanupAfterSystemDrag):
+        * page/wx/DragControllerWx.cpp:
+      (WebCore::DragController::cleanupAfterSystemDrag):
+
+2008-11-26  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix path to string logic, correctly taking closed (sub-)paths into account.
+        Code was just broken on cg, observed by Dirk Schulze.
+
+        QPainterPath doesn't seem to expose any functionality to detect closed sub paths,
+        using the elementAt() function. There might be a workaround - Dirk will investigate.
+
+        * platform/graphics/cg/PathCG.cpp:
+        (WebCore::CGPathToCFStringApplierFunction):
+        * platform/graphics/cairo/PathCairo.cpp:
+        (WebCore::Path::debugString):
+
+2008-11-26  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22519
+        Remove unnecessary include.
+
+        * dom/XMLTokenizer.cpp:
+
+2008-11-26  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Oliver Hunt.
+
+        Add <noop> element support, completing the task element support.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * wml/WMLNoopElement.cpp: Added.
+        (WebCore::WMLNoopElement::WMLNoopElement):
+        (WebCore::WMLNoopElement::insertedIntoDocument):
+        * wml/WMLNoopElement.h: Added.
+        * wml/WMLTagNames.in: Reorganize file a bit.
+
+2008-11-26  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 22441: Bridge the gap between the generated ElementFactory and HTMLElementFactory
+        https://bugs.webkit.org/show_bug.cgi?id=22441
+
+        Make more HTML elements' constructors take a QualifiedName.
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::createDeletionUI):
+        * html/HTMLBlockquoteElement.cpp:
+        (WebCore::HTMLBlockquoteElement::HTMLBlockquoteElement):
+        * html/HTMLBlockquoteElement.h:
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::HTMLButtonElement):
+        * html/HTMLButtonElement.h:
+        * html/HTMLDListElement.cpp:
+        (WebCore::HTMLDListElement::HTMLDListElement):
+        * html/HTMLDListElement.h:
+        * html/HTMLDirectoryElement.cpp:
+        (WebCore::HTMLDirectoryElement::HTMLDirectoryElement):
+        * html/HTMLDirectoryElement.h:
+        * html/HTMLDivElement.cpp:
+        (WebCore::HTMLDivElement::HTMLDivElement):
+        * html/HTMLDivElement.h:
+        * html/HTMLElementFactory.cpp:
+        (WebCore::styleConstructor):
+        (WebCore::titleConstructor):
+        (WebCore::frameConstructor):
+        (WebCore::framesetConstructor):
+        (WebCore::iframeConstructor):
+        (WebCore::formConstructor):
+        (WebCore::buttonConstructor):
+        (WebCore::inputConstructor):
+        (WebCore::isindexConstructor):
+        (WebCore::fieldsetConstructor):
+        (WebCore::keygenConstructor):
+        (WebCore::labelConstructor):
+        (WebCore::legendConstructor):
+        (WebCore::optgroupConstructor):
+        (WebCore::optionConstructor):
+        (WebCore::selectConstructor):
+        (WebCore::textareaConstructor):
+        (WebCore::dlConstructor):
+        (WebCore::ulConstructor):
+        (WebCore::olConstructor):
+        (WebCore::dirConstructor):
+        (WebCore::menuConstructor):
+        (WebCore::liConstructor):
+        (WebCore::blockquoteConstructor):
+        (WebCore::divConstructor):
+        (WebCore::headingConstructor):
+        * html/HTMLFieldSetElement.cpp:
+        (WebCore::HTMLFieldSetElement::HTMLFieldSetElement):
+        * html/HTMLFieldSetElement.h:
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::HTMLFormElement):
+        * html/HTMLFormElement.h:
+        * html/HTMLFrameElement.cpp:
+        (WebCore::HTMLFrameElement::HTMLFrameElement):
+        * html/HTMLFrameElement.h:
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::HTMLFrameSetElement):
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::HTMLIFrameElement::HTMLIFrameElement):
+        * html/HTMLIFrameElement.h:
+        * html/HTMLInputElement.cpp:
+        * html/HTMLInputElement.h:
+        * html/HTMLIsIndexElement.cpp:
+        (WebCore::HTMLIsIndexElement::HTMLIsIndexElement):
+        * html/HTMLIsIndexElement.h:
+        * html/HTMLKeygenElement.cpp:
+        (WebCore::HTMLKeygenElement::HTMLKeygenElement):
+        * html/HTMLKeygenElement.h:
+        * html/HTMLLIElement.cpp:
+        (WebCore::HTMLLIElement::HTMLLIElement):
+        * html/HTMLLIElement.h:
+        * html/HTMLLabelElement.cpp:
+        (WebCore::HTMLLabelElement::HTMLLabelElement):
+        * html/HTMLLabelElement.h:
+        * html/HTMLLegendElement.cpp:
+        (WebCore::HTMLLegendElement::HTMLLegendElement):
+        * html/HTMLLegendElement.h:
+        * html/HTMLMenuElement.cpp:
+        (WebCore::HTMLMenuElement::HTMLMenuElement):
+        * html/HTMLMenuElement.h:
+        * html/HTMLOListElement.cpp:
+        (WebCore::HTMLOListElement::HTMLOListElement):
+        * html/HTMLOListElement.h:
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::HTMLOptGroupElement):
+        * html/HTMLOptGroupElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::HTMLOptionElement):
+        * html/HTMLOptionElement.h:
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::formCreateErrorCheck):
+        (WebCore::HTMLParser::handleIsindex):
+        * html/HTMLSelectElement.cpp:
+        * html/HTMLSelectElement.h:
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::HTMLStyleElement):
+        * html/HTMLStyleElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::HTMLTextAreaElement):
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLTitleElement.cpp:
+        (WebCore::HTMLTitleElement::HTMLTitleElement):
+        * html/HTMLTitleElement.h:
+        * html/HTMLUListElement.cpp:
+        (WebCore::HTMLUListElement::HTMLUListElement):
+        * html/HTMLUListElement.h:
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::createContainingTable):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlShadowRootElement::MediaControlShadowRootElement):
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::HTMLFileUploadInnerButtonElement::HTMLFileUploadInnerButtonElement):
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createPanel):
+        (WebCore::RenderMedia::createTimeDisplay):
+        * rendering/RenderSlider.cpp:
+        (WebCore::HTMLSliderThumbElement::HTMLSliderThumbElement):
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::TextControlInnerElement::TextControlInnerElement):
+
+2008-11-26  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix obvious problem in WMLPageState constructor, m_page was not set to the passed Page pointer.
+
+        * wml/WMLPageState.cpp:
+        (WebCore::WMLPageState::WMLPageState):
+
+2008-11-26  Matt Perry  <mpcomplete@gmail.com>
+
+        Fix Qt bustage.
+
+        See https://bugs.webkit.org/show_bug.cgi?id=22051
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::extraDefaultStyleSheet):
+
+2008-11-26  Matt Perry  <mpcomplete@gmail.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=22051
+        Renderthemes should be able to supply additional CSS rules to the core
+        ones.
+
+        * DerivedSources.make:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::parseUASheet):
+        (WebCore::loadFullDefaultStyle):
+        (WebCore::loadSimpleDefaultStyle):
+        * css/themeWin.css: Added.
+        * css/themeWinQuirks.css: Added.
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::extraDefaultStyleSheet):
+        * platform/qt/RenderThemeQt.h:
+        * rendering/RenderTheme.cpp:
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::extraDefaultStyleSheet):
+        (WebCore::RenderTheme::extraQuirksStyleSheet):
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::extraDefaultStyleSheet):
+        (WebCore::RenderThemeWin::extraQuirksStyleSheet):
+        * rendering/RenderThemeWin.h:
+
+2008-11-26  David Kilzer  <ddkilzer@apple.com>
+
+        Make CSSStyleSheet::addSubresourceURLStrings() iterative
+
+        Part of the fix for Bug 11850: Webarchive fails to save images referenced in CSS
+        <https://bugs.webkit.org/show_bug.cgi?id=11850>
+
+        Reviewed by Brady Eidson.
+
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::addSubresourceURLStrings): Switch algorithm
+        from recursive to iterative for gathering the list of all CSS
+        stylesheets referenced in @import statements.
+
+2008-11-26  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Transformations to the context shouldn't transform the currentPath.
+        Fixed this on Qt.
+
+        [QT] GraphicsContext's currenPath can be transformed
+        https://bugs.webkit.org/show_bug.cgi?id=22163
+
+        * platform/graphics/GraphicsContextPrivate.h:
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::restorePlatformState):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::translate):
+        (WebCore::GraphicsContext::rotate):
+        (WebCore::GraphicsContext::scale):
+        (WebCore::GraphicsContext::concatCTM):
+
+2008-11-26  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build script minor fixes. Not reviewed.
+
+        * GNUmakefile.am:
+          - Add ScriptInstance.h (introduced in r38774) to
+        the build.
+          - Move WML and GEOLOCATION conditionals before the SVG
+        conditional to be consistent with the style of the script.
+          - Move GeolocationGtk sources to webcoregtk_sources.
+
+2008-11-26  Dmitry Titov  <dimich@chromium.org>
+
+        Reviewed by Darin Adler and Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22469
+
+        Move the class DOMWindowTimer from JSDOMWindowBase into its own file in
+        preparation to making it work for Workers. For now, just move the code and couple
+        of global variables.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::installTimeout):
+        (WebCore::JSDOMWindowBase::pauseTimeouts):
+        (WebCore::JSDOMWindowBase::resumeTimeouts):
+        (WebCore::JSDOMWindowBase::timerFired):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/DOMTimer.cpp: Added.
+        (WebCore::DOMTimer::DOMTimer):
+        (WebCore::DOMTimer::~DOMTimer):
+        (WebCore::DOMTimer::fired):
+        * bindings/js/DOMTimer.h: Added.
+        (WebCore::DOMTimer::timeoutId):
+        (WebCore::DOMTimer::nestingLevel):
+        (WebCore::DOMTimer::setNestingLevel):
+        (WebCore::DOMTimer::action):
+        (WebCore::DOMTimer::takeAction):
+
+2008-11-25  Darin Fisher  <darin@chromium.org>
+
+        Fix bustage.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22493
+        Need to expose bridge/*.h to the WebKit build.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2008-11-25  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Fix build, by removing some wrong last-minute changes.
+
+        * wml/WMLIntrinsicEvent.cpp:
+        (WebCore::createTaskElement):
+        * wml/WMLOnEventElement.cpp:
+        (WebCore::WMLOnEventElement::registerTask):
+
+2008-11-25  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22493
+        Abstract away JSC:: usage in WebCore/html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::pluginInstance):
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+        * bindings/js/ScriptInstance.h: Added.
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::~HTMLPlugInElement):
+        (WebCore::HTMLPlugInElement::getInstance):
+        * html/HTMLPlugInElement.h:
+
+2008-11-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22477
+
+        A WMLTaskElement checks wheter it's parent is an <anchor>/<do>/<onevent> element, and calls registerTask(this) on the parent.
+        Add a isWMLTaskElement() function to WMLElement, making it possible to cast to WMLTaskElement directly.
+
+        Add WMLEventHandlingElement class, inheriting from WMLElement, to serve as common base WMLTemplate/Option/CardElement,
+        centralizing the eventHandler() / createEventHandlerIfNeeded() implementation. Add a isWMLEventHandlingElement()
+        function to WMLElement, so WMLOnEventElement can create event handlers, without knowing wheter it's a
+        <template>/<option> or <card> element.
+
+        Add complete <onevent> support.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::WMLCardElement):
+        (WebCore::WMLCardElement::setActiveCardInDocument):
+        * wml/WMLCardElement.h:
+        (WebCore::WMLCardElement::isVisible):
+        (WebCore::WMLCardElement::setVisible):
+        * wml/WMLElement.h:
+        (WebCore::WMLElement::isWMLTaskElement):
+        * wml/WMLEventHandlingElement.cpp: Added.
+        (WebCore::WMLEventHandlingElement::WMLEventHandlingElement):
+        (WebCore::WMLEventHandlingElement::createEventHandlerIfNeeded):
+        * wml/WMLEventHandlingElement.h: Added.
+        (WebCore::WMLEventHandlingElement::isWMLEventHandlingElement):
+        (WebCore::WMLEventHandlingElement::eventHandler):
+        * wml/WMLOnEventElement.cpp: Added.
+        (WebCore::WMLOnEventElement::WMLOnEventElement):
+        (WebCore::WMLOnEventElement::parseMappedAttribute):
+        (WebCore::WMLOnEventElement::registerTask):
+        * wml/WMLOnEventElement.h: Added.
+        * wml/WMLSetvarElement.cpp:
+        (WebCore::WMLSetvarElement::parseMappedAttribute):
+        (WebCore::WMLSetvarElement::insertedIntoDocument):
+        * wml/WMLTagNames.in:
+        * wml/WMLTaskElement.cpp:
+        (WebCore::WMLTaskElement::insertedIntoDocument):
+        * wml/WMLTaskElement.h:
+        (WebCore::WMLTaskElement::isWMLTaskElement):
+
+2008-11-25  Pierre-Olivier Latour  <pol@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        createFontCustomPlatformData() crashes if CGFontCreateWithPlatformFont() returns NULL
+
+        https://bugs.webkit.org/show_bug.cgi?id=22503
+
+        * platform/graphics/mac/FontCustomPlatformData.cpp:
+        (WebCore::createFontCustomPlatformData):
+
+2008-11-25  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Bug 22441: Bridge the gap between the generated ElementFactory and HTMLElementFactory
+        https://bugs.webkit.org/show_bug.cgi?id=22441
+
+        Element's other than HTML ones take a QualifiedName in their constructors.
+        To make HTMLElementFactory closer to the other ElementFactory, we need
+        to make them take the same arguments.
+        This patch only makes the 5 first one in HTMLElementFactory abide by that. The others
+        will go into the next patch.
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        * html/HTMLBaseElement.cpp:
+        (WebCore::HTMLBaseElement::HTMLBaseElement):
+        * html/HTMLBaseElement.h:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::HTMLBodyElement):
+        * html/HTMLBodyElement.h:
+        * html/HTMLElementFactory.cpp:
+        (WebCore::htmlConstructor):
+        (WebCore::headConstructor):
+        (WebCore::bodyConstructor):
+        (WebCore::baseConstructor):
+        (WebCore::linkConstructor):
+        (WebCore::metaConstructor):
+        * html/HTMLHeadElement.cpp:
+        (WebCore::HTMLHeadElement::HTMLHeadElement):
+        * html/HTMLHeadElement.h:
+        * html/HTMLHtmlElement.cpp:
+        (WebCore::HTMLHtmlElement::HTMLHtmlElement):
+        * html/HTMLHtmlElement.h:
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::HTMLLinkElement):
+        * html/HTMLLinkElement.h:
+        * html/HTMLMetaElement.cpp:
+        (WebCore::HTMLMetaElement::HTMLMetaElement):
+        * html/HTMLMetaElement.h:
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleError):
+        (WebCore::HTMLParser::headCreateErrorCheck):
+        (WebCore::HTMLParser::createHead):
+        (WebCore::HTMLParser::finished):
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::createContainingTable):
+
+2008-11-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22487
+        I was not checking for the case of 0 length keyframe lists and dereffing a null pointer.
+
+        Tests: animations/empty-keyframes.html
+               animations/fill-unset-properties.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
+
+2008-11-25  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=22046
+
+        Fix a crash when an animation or transition end event handler
+        removes the element upon which the transition/animation is running,
+        by keeping a reference to the AnimationBase object on the stack.
+
+        Tests: animations/transform-animation-event-destroy-element.html
+               transitions/transform-transition-event-destroy-element.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::setChanged):
+        (WebCore::AnimationBase::updateStateMachine):
+        * page/animation/AnimationBase.h:
+        (WebCore::AnimationBase::clearRenderer):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::clear):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::~CompositeAnimationPrivate):
+        * page/animation/CompositeAnimation.h:
+
+2008-11-25  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Better wx build fix - support PurgeableBuffer on Mac.
+
+        * platform/PurgeableBuffer.h:
+        * webcore-wx.bkl:
+
+2008-11-25  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by David Kilzer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22022
+
+        Add GeoleocationServiceGtk stubs and integrate it into the buildsystem
+
+        Add stubs for a Gtk Implementation.
+
+        * GNUmakefile.am:
+        * platform/gtk/GeolocationServiceGtk.cpp: Added.
+        (WebCore::GeolocationService::create):
+        (WebCore::GeolocationServiceGtk::GeolocationServiceGtk):
+        (WebCore::GeolocationServiceGtk::startUpdating):
+        (WebCore::GeolocationServiceGtk::stopUpdating):
+        (WebCore::GeolocationServiceGtk::suspend):
+        (WebCore::GeolocationServiceGtk::resume):
+        (WebCore::GeolocationServiceGtk::lastPosition):
+        (WebCore::GeolocationServiceGtk::lastError):
+        * platform/gtk/GeolocationServiceGtk.h: Added.
+
+2008-11-25  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix - we don't support PurgeableBuffer on Leopard for now.
+
+        * platform/PurgeableBuffer.h:
+
+2008-11-25  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=22483
+        Assertion failure in CachedResource::makePurgeable during layout tests
+
+        Deleting SVG image can re-enter destroyDecodedData.
+
+        * loader/CachedImage.cpp:
+        (WebCore::CachedImage::destroyDecodedData):
+
+2008-11-25  David Levin  <levin@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22443
+        Made the PreflightResultCache thread-safe in preparation for usage of XMLHttpRequest by
+        Workers on threads.
+
+        No observable change in behavior, so no test.
+
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::String::substringCopy):
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::substringCopy):
+        * platform/text/StringImpl.h:
+        Added the ability to copy a substring.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::PreflightResultCacheItem::PreflightResultCacheItem):
+        (WebCore::PreflightResultCache::PreflightResultCache):
+        (WebCore::PreflightResultCacheItem::addToAccessControlAllowList):
+        (WebCore::PreflightResultCacheItem::parseAccessControlAllowList):
+        (WebCore::PreflightResultCacheItem::parseAccessControlMaxAge):
+        (WebCore::PreflightResultCacheItem::parse):
+        (WebCore::PreflightResultCacheItem::allowsRequest):
+        (WebCore::PreflightResultCache::shared):
+        (WebCore::PreflightResultCache::appendEntry):
+        (WebCore::PreflightResultCache::canSkipPreflight):
+        (WebCore::XMLHttpRequest::makeCrossSiteAccessRequestWithPreflight):
+        (WebCore::XMLHttpRequest::didReceiveResponsePreflight):
+        Made the PreflightResultCache threadsafe.
+
+        (WebCore::PreflightResultCacheItem::allowsCrossSiteMethod):
+        (WebCore::PreflightResultCacheItem::allowsCrossSiteHeaders):
+        Consolidation of duplicate logic.
+
+2008-11-24  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        For Unicode encodings other than UTF-8, use UTF-8 for
+        form submission and URL query part encoding.
+
+        See https://bugs.webkit.org/show_bug.cgi?id=21635
+
+        Tests: http/tests/misc/submit-get-in-utf16be.html
+               http/tests/misc/submit-get-in-utf16le.html
+               http/tests/misc/submit-get-in-utf32be.html
+               http/tests/misc/submit-get-in-utf32le.html
+               http/tests/misc/submit-get-in-utf7.html
+               http/tests/misc/submit-post-in-utf16be.html
+               http/tests/misc/submit-post-in-utf16le.html
+               http/tests/misc/submit-post-in-utf32be.html
+               http/tests/misc/submit-post-in-utf32le.html
+               http/tests/misc/submit-post-in-utf7.html
+               http/tests/misc/url-in-utf16be.html
+               http/tests/misc/url-in-utf16le.html
+               http/tests/misc/url-in-utf32be.html
+               http/tests/misc/url-in-utf32le.html
+               http/tests/misc/url-in-utf7.html
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::formData):
+        * loader/TextResourceDecoder.cpp:
+        (WebCore::TextResourceDecoder::setEncoding):
+        * platform/KURL.cpp:
+        (WebCore::KURL::KURL):
+        * platform/text/TextEncoding.cpp:
+        (WebCore::UTF7Encoding):
+        (WebCore::TextEncoding::isNonByteBasedEncoding):
+        (WebCore::TextEncoding::closestByteBasedEquivalent):
+        (WebCore::TextEncoding::encodingForFormSubmission):
+        * platform/text/TextEncoding.h:
+
+2008-11-24  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 22441: Bridge the gap between the generated ElementFactory and HTMLElementFactory
+        https://bugs.webkit.org/show_bug.cgi?id=22441
+
+        - Make the generated ElementFactory constructors return PassRefPtr instead of raw pointers.
+
+        - Tweaked the generated files to better match our coding style.
+
+        * dom/make_names.pl:
+
+2008-11-24  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22073
+        REGRESSION(r33544): Palace in the Sky crashes WebKit
+
+        HTMLTokenizer::m_hasScriptsWaitingForStylesheets would still be set while
+        there were no scripts left to execute.
+
+        If m_hasScriptsWaitingForStylesheets becomes true during script execution
+        bail out from executing more scripts synchronously.
+
+        Test: fast/tokenizer/nested-cached-scripts-and-stylesheet.html
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::reset):
+        (WebCore::HTMLTokenizer::notifyFinished):
+
+2008-11-24  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22465
+        Define KURL::copy() and use it in WorkerThread.cpp
+
+        * dom/WorkerThread.cpp:
+        (WebCore::WorkerThread::WorkerThread):
+        * platform/KURL.cpp:
+        (WebCore::KURL::copy):
+        * platform/KURL.h:
+
+2008-11-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Sam Weinig.
+
+        Name enum values in a style guide compatible way.
+        Allow WMLIntrinsicEvent inclusion, without needing other includes.
+
+        * wml/WMLIntrinsicEvent.cpp:
+        (WebCore::createTaskElement):
+        * wml/WMLIntrinsicEvent.h:
+        * wml/WMLIntrinsicEventHandler.cpp:
+        * wml/WMLIntrinsicEventHandler.h:
+        (WebCore::):
+
+2008-11-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Sam Weinig.
+
+        Add wmlPageStateForDocument() helper function and use it in some places.
+
+        * wml/WMLAccessElement.cpp:
+        (WebCore::WMLAccessElement::parseMappedAttribute):
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::WMLDocument):
+        (WebCore::WMLDocument::finishedParsing):
+        (WebCore::wmlPageStateForDocument):
+        * wml/WMLDocument.h:
+        * wml/WMLGoElement.cpp:
+        (WebCore::WMLGoElement::executeTask):
+        * wml/WMLPrevElement.cpp:
+        (WebCore::WMLPrevElement::executeTask):
+        * wml/WMLRefreshElement.cpp:
+        (WebCore::WMLRefreshElement::executeTask):
+        * wml/WMLTaskElement.cpp:
+        (WebCore::WMLTaskElement::storeVariableState):
+        * wml/WMLTaskElement.h:
+
+2008-11-24  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Geoff Garen and Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22214
+        Keep dead resources in memory cache in purgeable memory.
+        <rdar://problem/6333088>
+
+        OS X 10.5 has purgeable memory kernel facility that allows marking reserved memory
+        areas as less important. Under memory pressure system can steal pages that have
+        been marked purgeable for (hopefully) better uses. This is ideal for caches.
+
+        Only resources larger than 16KB will be moved to the purgeable memory.
+
+        * WebCore.base.exp:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestResource):
+        (WebCore::Cache::requestUserCSSStyleSheet):
+        (WebCore::Cache::resourceForURL):
+        (WebCore::Cache::pruneDeadResources):
+        (WebCore::Cache::TypeStatistic::addResource):
+        (WebCore::Cache::getStatistics):
+        (WebCore::Cache::dumpStats):
+        * loader/Cache.h:
+        (WebCore::Cache::TypeStatistic::TypeStatistic):
+        * loader/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::allClientsRemoved):
+        (WebCore::CachedCSSStyleSheet::sheetText):
+        * loader/CachedCSSStyleSheet.h:
+        * loader/CachedImage.cpp:
+        (WebCore::CachedImage::addClient):
+        (WebCore::CachedImage::image):
+        (WebCore::CachedImage::imageSize):
+        (WebCore::CachedImage::imageRect):
+        (WebCore::CachedImage::destroyDecodedData):
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::addClient):
+        (WebCore::CachedResource::makePurgeable):
+        (WebCore::CachedResource::isPurgeable):
+        (WebCore::CachedResource::wasPurged):
+        * loader/CachedResource.h:
+        (WebCore::CachedResource::data):
+        * loader/CachedScript.cpp:
+        (WebCore::CachedScript::allClientsRemoved):
+        (WebCore::CachedScript::script):
+        (WebCore::CachedScript::destroyDecodedData):
+        * platform/PurgeableBuffer.h: Added.
+        (WebCore::PurgeableBuffer::create):
+        (WebCore::PurgeableBuffer::size):
+        (WebCore::PurgeableBuffer::):
+        (WebCore::PurgeableBuffer::purgePriority):
+        (WebCore::PurgeableBuffer::isPurgeable):
+        (WebCore::PurgeableBuffer::~PurgeableBuffer):
+        (WebCore::PurgeableBuffer::data):
+        (WebCore::PurgeableBuffer::setPurgePriority):
+        (WebCore::PurgeableBuffer::wasPurged):
+        (WebCore::PurgeableBuffer::makePurgeable):
+        * platform/SharedBuffer.cpp:
+        (WebCore::SharedBuffer::~SharedBuffer):
+        (WebCore::SharedBuffer::adoptPurgeableBuffer):
+        (WebCore::SharedBuffer::size):
+        (WebCore::SharedBuffer::data):
+        (WebCore::SharedBuffer::append):
+        (WebCore::SharedBuffer::clear):
+        (WebCore::SharedBuffer::releasePurgeableBuffer):
+        * platform/SharedBuffer.h:
+        (WebCore::SharedBuffer::hasPurgeableBuffer):
+        * platform/cf/SharedBufferCF.cpp:
+        * platform/mac/PurgeableBufferMac.cpp: Added.
+        (WebCore::PurgeableBuffer::PurgeableBuffer):
+        (WebCore::PurgeableBuffer::~PurgeableBuffer):
+        (WebCore::PurgeableBuffer::create):
+        (WebCore::PurgeableBuffer::makePurgeable):
+        (WebCore::PurgeableBuffer::wasPurged):
+        (WebCore::PurgeableBuffer::setPurgePriority):
+        (WebCore::PurgeableBuffer::data):
+
+2008-11-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos & Eric Seidel.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22430
+
+        Regenerate WML layout test results after implementing WML specific <card> handling:
+        Only the first <card> element should be visible after loading the document, others
+        can be shown by using the <go> task element.
+
+        * dom/Document.h: Make 'finishedParsing()' a virtual function.
+        * wml/WMLCardElement.cpp:
+        (WebCore::WMLCardElement::WMLCardElement):
+        (WebCore::WMLCardElement::~WMLCardElement):
+        (WebCore::WMLCardElement::createRenderer):
+        (WebCore::WMLCardElement::setActiveCardInDocument):
+        (WebCore::WMLCardElement::setVisibility):
+        * wml/WMLCardElement.h:
+        * wml/WMLDocument.cpp:
+        (WebCore::WMLDocument::finishedParsing): Execute WML specific logic after tokenzing.
+        * wml/WMLDocument.h:
+
+2008-11-24  Glenn Wilson  <gwilson@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        http://bugs.webkit.org/show_bug.cgi?id=15643
+
+        Added support for clients that wish to disable smart insert/delete
+        and enable the "trailing whitespace selection" work-around.
+
+        Tests: editing/selection/doubleclick-whitespace.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::selectTrailingWhitespaceEnabled):
+        * editing/Editor.h:
+        * editing/Selection.cpp:
+        (WebCore::Selection::includeTrailingWhitespace):
+        * editing/Selection.h:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyEditorClient::selectTrailingWhitespaceEnabled):
+        * page/EditorClient.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::selectClosestWordFromMouseEvent):
+
+2008-11-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Forgot to include WMLPageState.h in last commit.
+
+        * wml/WMLPageState.h:
+        (WebCore::WMLPageState::restrictDeckAccessToDomain):
+        (WebCore::WMLPageState::restrictDeckAccessToPath):
+
+2008-11-24  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Oliver Hunt & Eric Seidel.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22431
+
+        Implement WMLAccessElement. It just propogates two attributes values to WMLPageState.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * wml/WMLAccessElement.cpp: Added.
+        (WebCore::WMLAccessElement::WMLAccessElement):
+        (WebCore::WMLAccessElement::parseMappedAttribute):
+        * wml/WMLAccessElement.h: Added.
+        * wml/WMLTagNames.in:
+        * wml/WMLPageState.h: Rename functions.
+        (WebCore::WMLPageState::restrictDeckAccessToDomain):
+        (WebCore::WMLPageState::restrictDeckAccessToPath):
+        * wml/WMLVariables.cpp: Add new helper function.
+        (WebCore::valueContainsVariableReference):
+        * wml/WMLVariables.h:
+        (WebCore::):
+
+2008-11-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=22470
+          remove unneeded URL argument from FrameLoaderClient::updateGlobalHistory
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::updateGlobalHistory): Remove argument.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::updateHistoryForStandardLoad): Don't pass the URL.
+        (WebCore::FrameLoader::updateHistoryForRedirectWithLockedHistory): Ditto.
+        * loader/FrameLoaderClient.h: Remove argument.
+
+2008-11-24  Finnur Thorarinsson  <finnur.webkit@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22432
+
+        Add plumbing for tickmark support for the scrollbars. The painting code
+        for the scrollbar just needed to call paintTickmarks at the right time
+        and a default no-op implementation is provided, which the ports will
+        need to override.
+
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::paint):
+        * platform/ScrollbarThemeComposite.h:
+        (WebCore::ScrollbarThemeComposite::paintTickmarks):
+
+2008-11-24  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22448
+        Create an abstraction for JSC::SourceCode
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/CachedScriptSourceProvider.h:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptSourceCode.h: Added.
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        (WebCore::ScriptSourceCode::length):
+        (WebCore::ScriptSourceCode::jsSourceCode):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::Workevn ScriptController::evaluate):
+        * bindings/js/WorkerScriptController.h:
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElement::insertedIntoDocument):
+        (WebCore::ScriptElement::childrenChanged):
+        (WebCore::ScriptElementData::evaluateScript):
+        (WebCore::ScriptElementData::notifyFinished):
+        * dom/ScriptElement.h:
+        * dom/WorkerThread.cpp:
+        (WebCore::WorkerThread::workerThread):
+        * dom/WorkerThread.h:
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::notifyFinished):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::endElementNs):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseEndElement):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler):
+        (WebCore::HTMLTokenizer::scriptExecution):
+        (WebCore::HTMLTokenizer::notifyFinished):
+        * html/HTMLTokenizer.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::executeScript):
+        * loader/FrameLoader.h:
+
+2008-11-24  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        - finish https://bugs.webkit.org/show_bug.cgi?id=22295
+          track which history items are from page load failures
+
+        * WebCore.base.exp: Exported new function.
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::urlForHistoryReflectsFailure): Added.
+        * loader/DocumentLoader.h: Ditto.
+
+2008-11-24  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 22461: AccessibilityListBox::doAccessibilityHitTest() signature does not match the base class
+        https://bugs.webkit.org/show_bug.cgi?id=22461
+
+        Changing AccessibilityListBox to use its parent's signature for hit testing
+
+        * page/AccessibilityListBox.cpp:
+        (WebCore::AccessibilityListBox::doAccessibilityHitTest):
+        * page/AccessibilityListBox.h:
+
+2008-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix Windows build: selectionRect() -> selectionBounds().
+
+        * page/win/FrameCGWin.cpp:
+        (WebCore::imageFromSelection):
+
+2008-11-24  Glenn Wilson  <gwilson@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        http://bugs.webkit.org/show_bug.cgi?id=18703
+        "Changing the 'size' property on a text input does not affect its length"
+
+        Text fields would not repaint themselves after having their "size"
+        attributes modified.  This fix tells the object to recalculate its
+        width and repaint itself when its "size" attribute is parsed.
+
+        Test: fast/js/text-field-resize.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+
+2008-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        Followup from changes for https://bugs.webkit.org/show_bug.cgi?id=22433
+
+        Make RenderView::selectionRect() private to cause compile-time
+        errors if someone tries to call it.
+
+        * rendering/RenderView.h:
+
+2008-11-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        Via: https://bugs.webkit.org/show_bug.cgi?id=22433
+
+        Rename RenderView::selectionRect() to selectionBounds(), to remove
+        longstanding ambiguity with the base class selectionRect() method.
+        Do the same on Frame for consistency with RenderView. Assert
+        that RenderView::selectionRect() is never called.
+
+        * WebCore.base.exp:
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::focusedOrActiveStateChanged):
+        * page/DragController.cpp:
+        (WebCore::dragLocForSelectionDrag):
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionBounds):
+        (WebCore::Frame::revealSelection):
+        * page/Frame.h:
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::selectionImage):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::selectionRect):
+        (WebCore::RenderView::selectionBounds):
+        * rendering/RenderView.h:
+
+2008-11-19  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 22441: Bridge the gap between the generated ElementFactory and HTMLElementFactory
+        https://bugs.webkit.org/show_bug.cgi?id=22441
+
+        - Make HTMLElementFactory::createHTMLElement take a QualifiedName instead of
+        an AtomicString.
+
+        - Updated the elements' constructors and the callers to reflect the previous change.
+
+        * dom/Document.cpp:
+        (WebCore::Document::createElement):
+        * html/HTMLDocument.cpp:
+        (WebCore::HTMLDocument::createElement):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::cloneNode):
+        * html/HTMLElementFactory.cpp:
+        (WebCore::htmlConstructor):
+        (WebCore::headConstructor):
+        (WebCore::bodyConstructor):
+        (WebCore::baseConstructor):
+        (WebCore::linkConstructor):
+        (WebCore::metaConstructor):
+        (WebCore::styleConstructor):
+        (WebCore::titleConstructor):
+        (WebCore::frameConstructor):
+        (WebCore::framesetConstructor):
+        (WebCore::iframeConstructor):
+        (WebCore::formConstructor):
+        (WebCore::buttonConstructor):
+        (WebCore::inputConstructor):
+        (WebCore::isindexConstructor):
+        (WebCore::fieldsetConstructor):
+        (WebCore::keygenConstructor):
+        (WebCore::labelConstructor):
+        (WebCore::legendConstructor):
+        (WebCore::optgroupConstructor):
+        (WebCore::optionConstructor):
+        (WebCore::selectConstructor):
+        (WebCore::textareaConstructor):
+        (WebCore::dlConstructor):
+        (WebCore::ulConstructor):
+        (WebCore::olConstructor):
+        (WebCore::dirConstructor):
+        (WebCore::menuConstructor):
+        (WebCore::liConstructor):
+        (WebCore::blockquoteConstructor):
+        (WebCore::divConstructor):
+        (WebCore::headingConstructor):
+        (WebCore::hrConstructor):
+        (WebCore::paragraphConstructor):
+        (WebCore::preConstructor):
+        (WebCore::basefontConstructor):
+        (WebCore::fontConstructor):
+        (WebCore::modConstructor):
+        (WebCore::anchorConstructor):
+        (WebCore::imageConstructor):
+        (WebCore::mapConstructor):
+        (WebCore::areaConstructor):
+        (WebCore::canvasConstructor):
+        (WebCore::appletConstructor):
+        (WebCore::embedConstructor):
+        (WebCore::objectConstructor):
+        (WebCore::paramConstructor):
+        (WebCore::scriptConstructor):
+        (WebCore::tableConstructor):
+        (WebCore::tableCaptionConstructor):
+        (WebCore::tableColConstructor):
+        (WebCore::tableRowConstructor):
+        (WebCore::tableCellConstructor):
+        (WebCore::tableSectionConstructor):
+        (WebCore::brConstructor):
+        (WebCore::quoteConstructor):
+        (WebCore::marqueeConstructor):
+        (WebCore::audioConstructor):
+        (WebCore::videoConstructor):
+        (WebCore::sourceConstructor):
+        (WebCore::HTMLElementFactory::createHTMLElement):
+        * html/HTMLElementFactory.h:
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode):
+
+2008-11-24  Brent Fulgham  <bfulgham@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22444
+
+        Correct bad default constructor for Cairo FontPlatformData so that
+        the m_scaledFont member is initialized.  Previously this would be
+        set to 0xbaadf00d, which would result in infinite loops while
+        attempting to deal with the font cache.
+
+        * platform/graphics/win/FontPlatformData.h:
+        (WebCore::FontPlatformData::FontPlatformData): Initialize m_scaledFont to 0
+
+2008-11-24  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22455
+        Add support for Worker.terminate()
+
+        Test: fast/workers/worker-terminate.html
+
+        * dom/Worker.idl:
+        * dom/Worker.cpp:
+        * dom/Worker.h:
+        Added terminate().
+
+        * dom/WorkerMessagingProxy.h: (WebCore::WorkerMessagingProxy::askedToTerminate):
+        * dom/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerTask::performTask): Don't dispatch messages if the worker was asked
+        to terminate (this is not mentioned in draft spec, but makes sense anyway).
+        (WebCore::WorkerMessagingProxy::WorkerMessagingProxy): The proxy now remembers if it was
+        asked to terminate in m_askedToTerminate member variable. Also, changed m_unconfirmedMessageCount
+        to only track messages that were posted to worker thread, avoiding a leak if the script
+        could not be loaded.
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext): Return early if terminating.
+        (WebCore::WorkerMessagingProxy::workerThreadCreated): Stop the thread if already asked for.
+        (WebCore::WorkerMessagingProxy::workerContextDestroyedInternal): Even if worker context
+        was destroyed, the worker object may still be alive now, so don't delete self in this case.
+        (WebCore::WorkerMessagingProxy::terminate): Stop the thread if it was already created, or
+        remember to stop it when it is created.
+        (WebCore::WorkerMessagingProxy::reportWorkerThreadActivityInternal): Don't track activity
+        if the thread asked to stop anyway.
+        (WebCore::WorkerMessagingProxy::workerThreadHasPendingActivity): Ditto.
+
+        * dom/WorkerThread.cpp:
+        * dom/WorkerThread.h:
+        Fixed a race condition in stop().
+
+2008-11-24  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22439
+        Won't load stylesheets with filenames less than 2 characters long in xhtml.
+
+        Test: http/tests/misc/single-character-pi-stylesheet.xhtml
+
+        * dom/ProcessingInstruction.cpp: (WebCore::ProcessingInstruction::checkStyleSheet):
+        Fix up the logic.
+
+2008-11-24  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Mark Rowe.
+
+        [Gtk+] Add configure option to enable Web Workers and enable it by default
+
+        Add --enable-workers to the buildsystem (used by build-webkit) add
+        the to be build files to the GNUmakefile.am and change build-webkit
+        to enable Web Workers by default.
+
+        * GNUmakefile.am:
+
+2008-11-24  Alexey Proskuryakov  <ap@webkit.org>
+
+        Build fix (for Windows Cairo port?)
+
+        * page/DOMWindow.idl: Use ENABLE_CHANNEL_MESSAGING instead of ENABLE(CHANNEL_MESSAGING), as
+        the ENABLE macro is not available in idls.
+
+2008-11-22  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22421
+        Added ScriptValue to Visual Studio and XCode projects.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+2008-11-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Holger Freyther.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22426
+
+        Add WMLInstrinsicEvent/EventHandler implementation. Code not yet used.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * wml/WMLIntrinsicEvent.cpp: Added.
+        (WebCore::createTaskElement):
+        (WebCore::WMLIntrinsicEvent::WMLIntrinsicEvent):
+        * wml/WMLIntrinsicEvent.h: Added.
+        (WebCore::WMLIntrinsicEvent::create):
+        (WebCore::WMLIntrinsicEvent::createWithTask):
+        (WebCore::WMLIntrinsicEvent::taskElement):
+        * wml/WMLIntrinsicEventHandler.cpp: Added.
+        (WebCore::WMLIntrinsicEventHandler::WMLIntrinsicEventHandler):
+        (WebCore::WMLIntrinsicEventHandler::registerIntrinsicEvent):
+        (WebCore::WMLIntrinsicEventHandler::triggerIntrinsicEvent):
+        (WebCore::WMLIntrinsicEventHandler::hasIntrinsicEvent):
+        * wml/WMLIntrinsicEventHandler.h: Added.
+        (WebCore::):
+
+2008-11-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Holger Freyther.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22423
+
+        Add <go> stub implementation. Add complete <prev>/<refresh> and <setvar> implementation.
+        Activate code handling <setvar> registration in WMLTaskElement.
+
+        * wml/WMLGoElement.cpp: Added.
+        (WebCore::WMLGoElement::WMLGoElement):
+        (WebCore::WMLGoElement::~WMLGoElement):
+        (WebCore::WMLGoElement::parseMappedAttribute):
+        (WebCore::WMLGoElement::executeTask):
+        * wml/WMLGoElement.h: Added.
+        * wml/WMLPrevElement.cpp: Added.
+        (WebCore::WMLPrevElement::WMLPrevElement):
+        (WebCore::WMLPrevElement::~WMLPrevElement):
+        (WebCore::WMLPrevElement::executeTask):
+        * wml/WMLPrevElement.h: Added.
+        * wml/WMLRefreshElement.cpp: Added.
+        (WebCore::WMLRefreshElement::WMLRefreshElement):
+        (WebCore::WMLRefreshElement::~WMLRefreshElement):
+        (WebCore::WMLRefreshElement::executeTask):
+        * wml/WMLRefreshElement.h: Added.
+        * wml/WMLSetvarElement.cpp: Added.
+        (WebCore::WMLSetvarElement::WMLSetvarElement):
+        (WebCore::WMLSetvarElement::~WMLSetvarElement):
+        (WebCore::WMLSetvarElement::parseMappedAttribute):
+        (WebCore::WMLSetvarElement::insertedIntoDocument):
+        (WebCore::WMLSetvarElement::name):
+        (WebCore::WMLSetvarElement::value):
+        * wml/WMLSetvarElement.h: Added.
+        * wml/WMLTagNames.in:
+        * wml/WMLTaskElement.cpp:
+        (WebCore::WMLTaskElement::registerVariableSetter):
+        (WebCore::WMLTaskElement::storeVariableState):
+        * wml/WMLTaskElement.h:
+        * WebCore.xcodeproj/project.pbxproj:
+
+2008-11-22  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Forgot to include WMLPageState.* in the last commit.
+
+        * wml/WMLPageState.cpp:
+        (WebCore::WMLPageState::setNeedCheckDeckAccess):
+        * wml/WMLPageState.h:
+        (WebCore::WMLPageState::storeVariables):
+
+2008-11-21  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22397
+        Worker threads are not destroyed if running a JS loop
+
+        Since the event loop is not ever entered again in this case, the fix necessarily involves
+        some shared data hackery.
+
+        * dom/WorkerThread.cpp: (WebCore::WorkerThread::stop):
+        * dom/WorkerThread.h:
+        Added a stop() method, which asks the thread to exit as soon as possible. In the future, it
+        may need to abort other kinds of synchronous processing, such as importScripts or XHR.
+
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::WorkerScriptController):
+        (WebCore::WorkerScriptController::evaluate):
+        (WebCore::WorkerScriptController::forbidExecution):
+        * bindings/js/WorkerScriptController.h:
+        Added a forbidExecution() method, which interrupts currently running JS, and makes any
+        future calls to evaluate() return immediately.
+
+        * dom/WorkerMessagingProxy.cpp: (WebCore::WorkerMessagingProxy::workerObjectDestroyed):
+        Call WorkerThread::stop().
+
+2008-11-21  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Improve wx image drawing performance considerably when using wxGraphicsContext
+        by avoiding unnecessary copies and drawing.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22404
+
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::draw):
+        (WebCore::BitmapImage::drawPattern):
+
+
+2008-11-21  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Implementation of AffineTransform::mapRect for wx.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22401
+
+        * platform/graphics/wx/AffineTransformWx.cpp:
+        (WebCore::AffineTransform::mapRect):
+
+2008-11-21  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/5381788> Match NSTextView editing behavior at the end of hyperlink text
+
+        Change link editing behavior to match TextEdit and MS Word when editing before and after
+        a link (Pages has two caret positions at link boundaries, Thunderbird and FF behave like we
+        used to, so it's difficult to get out of link editing mode):
+        When inserting before or after a link, always insert content outside of the link.  This
+        makes it impossible to get stuck in link editing mode, while making it slightly more
+        difficult to edit link labels.  WebKit editors that care about this can add UI for editing
+        link labels, like GMail and GoogleDocs have done.  We never actually had any bugs complaining
+        about how it was difficult to edit link labels at the start/end, the code was just introduced
+        with another bug fix without much thought.
+
+        Don't remember removed links anymore, no other editor does this and it made it
+        difficult/impossible to get out of link editing mode.  This code was added to fix
+        <rdar://problem/4069359>, which is fixed instead by removing the styles from an
+        enclosing anchor element from those styles that we remember when we delete content.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::positionAvoidingSpecialElementBoundary):
+        * editing/CompositeEditCommand.h:
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::removeEnclosingAnchorStyle):
+        (WebCore::DeleteSelectionCommand::saveTypingStyleState):
+        (WebCore::DeleteSelectionCommand::doApply):
+        * editing/DeleteSelectionCommand.h:
+        * editing/EditCommand.cpp:
+        (WebCore::EditCommand::apply):
+        * editing/Editor.cpp:
+        (WebCore::Editor::appliedEditing):
+        * editing/InsertTextCommand.cpp:
+        (WebCore::InsertTextCommand::prepareForTextInsertion):
+        (WebCore::InsertTextCommand::input):
+        * editing/RemoveFormatCommand.cpp:
+        (WebCore::RemoveFormatCommand::doApply):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setSelection):
+        * editing/SelectionController.h:
+
+2008-11-21  Alice Liu  <alice.liu@apple.com>
+
+        Rubber-stamped by Dan Bernstein.
+
+        fixed <rdar://6340771> crashing on print preview
+
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::drawWindowsBitmap):
+
+2008-11-21  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Geoffrey Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22390
+        Abstract away JSC:: usage in WebCore/xml
+
+        * bindings/js/ScriptString.h: Added.
+        (WebCore::ScriptString::ScriptString):
+        (WebCore::ScriptString::operator JSC::UString):
+        (WebCore::ScriptString::isNull):
+        (WebCore::ScriptString::size):
+        (WebCore::ScriptString::operator=):
+        (WebCore::ScriptString::operator+=):
+        * inspector/InspectorController.cpp:
+        (WebCore::XMLHttpRequestResource::XMLHttpRequestResource):
+        (WebCore::InspectorResource::setXMLHttpRequestProperties):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        * inspector/InspectorController.h:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::responseText):
+        (WebCore::XMLHttpRequest::clearResponse):
+        (WebCore::XMLHttpRequest::dropProtection):
+        (WebCore::XMLHttpRequest::didFinishLoading):
+        (WebCore::XMLHttpRequest::didReceiveData):
+        * xml/XMLHttpRequest.h:
+        (WebCore::XMLHttpRequest::setLastSendURL):
+
+2008-11-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Destroy script decoded data on a zero-delay timer after
+        decoding.  This means we now have no decoded script data
+        at the end of Membuster.
+
+        * loader/CachedScript.cpp:
+        (WebCore::CachedScript::CachedScript):
+        (WebCore::CachedScript::allClientsRemoved):
+        (WebCore::CachedScript::script):
+        (WebCore::CachedScript::decodedDataDeletionTimerFired):
+        * loader/CachedScript.h:
+
+2008-11-21  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=22159
+
+        RenderBox::absoluteClippedOverflowRect() needs to inflate the rect by
+        maximalOutlineSize(), since a child might have an outline which projects
+        outside the parent overflowRect().
+
+        We also need to ensure that maximalOutlineSize() is updated early in styleDidChange,
+        so that it is valid for these repaints.
+
+        Test: fast/repaint/outline-child-repaint.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::absoluteClippedOverflowRect):
+
+2008-11-21  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk, Qt, and Wx build fix.
+
+        Add LinkHash.cpp in the build scripts.
+        Add LinkHash.h to Gtk's build script.
+
+        LinkHash.cpp/h was introduced in r38661.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCoreSources.bkl:
+
+2008-11-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Third step in https://bugs.webkit.org/show_bug.cgi?id=22394
+        Be more eager in destroying script decoded data
+
+        Destroy the decoded data when all clients are removed from a CachedScript.
+
+        * loader/CachedScript.cpp:
+        (WebCore::CachedScript::allClientsRemoved):
+        * loader/CachedScript.h:
+        (WebCore::CachedScript::allClientsRemoved):
+
+2008-11-21  Pierre-Olivier Latour  <pol@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        WebKit should be using Device RGB colorspace everywhere for
+        consistency.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22300
+
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (CreateCGColorIfDifferent):
+        * platform/graphics/mac/ColorMac.h:
+        * platform/graphics/mac/ColorMac.mm:
+        (WebCore::nsColor):
+        (+[WebCoreControlTintObserver controlTintDidChange]):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::convertNSColorToColor):
+        (WebCore::menuBackgroundColor):
+
+2008-11-20  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 22388: Add JSInterfaceName to the .in files
+        https://bugs.webkit.org/show_bug.cgi?id=22388
+
+        Add JSInterfaceName that is similar to interfaceName but
+        for the JS wrappers. JSInterfaceName is always equal to interfaceName
+        unless explicitly set.
+
+        * dom/make_names.pl:
+        * html/HTMLTagNames.in:
+        * svg/svgtags.in:
+
+2008-11-21  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Second step in https://bugs.webkit.org/show_bug.cgi?id=22394
+        Be more eager in destroying script decoded data
+
+        Use a new CachedScriptSourceProvider to keep CachedScripts as
+        CachedScripts, even down into JSC.  This has the added benefit
+        of showing the CachedScripts as live in the Caches window.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/CachedScriptSourceProvider.h: Added.
+        (WebCore::CachedScriptSourceProvider::create):
+        (WebCore::CachedScriptSourceProvider::~CachedScriptSourceProvider):
+        (WebCore::CachedScriptSourceProvider::getRange):
+        (WebCore::CachedScriptSourceProvider::data):
+        (WebCore::CachedScriptSourceProvider::length):
+        (WebCore::CachedScriptSourceProvider::CachedScriptSourceProvider):
+        (WebCore::makeSource):
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::notifyFinished):
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::notifyFinished):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::notifyFinished):
+
+2008-11-21  Brett Wilson  <brettw@chromium.org>
+
+        Fix debug-only build bustage due to a typo in an assert, and add new
+        files to the Windows build.
+
+        * Info.plist:
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/LinkHash.h:
+        (WebCore::LinkHashHash::avoidDeletedValue):
+
+2008-11-20  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22131
+
+        Factor out visited link hashing and types into a new file, LinkHash.
+        This also changes the hash type to 64 bits, but does not actually use
+        the extra bits yet.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkPseudoState):
+        (WebCore::CSSStyleSelector::SelectorChecker::visitedStateChanged):
+        * css/CSSStyleSelector.h:
+        (WebCore::CSSStyleSelector::visitedStateChanged):
+        * dom/Document.cpp:
+        * dom/Document.h:
+        * page/Page.cpp:
+        (WebCore::Page::visitedStateChanged):
+        * page/Page.h:
+        * page/PageGroup.cpp:
+        (WebCore::PageGroup::isLinkVisited):
+        (WebCore::PageGroup::addVisitedLink):
+        * page/PageGroup.h:
+        * platform/LinkHash.cpp: Added.
+        (WebCore::findSlashDotDotSlash):
+        (WebCore::findSlashSlash):
+        (WebCore::findSlashDotSlash):
+        (WebCore::containsColonSlashSlash):
+        (WebCore::cleanPath):
+        (WebCore::matchLetter):
+        (WebCore::needsTrailingSlash):
+        (WebCore::visitedLinkHash):
+        * platform/LinkHash.h: Added
+        (WebCore::LinkHashHash::hash):
+        (WebCore::LinkHashHash::equal):
+        (WebCore::LinkHashHash::avoidDeletedValue):
+
+2008-11-21  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        No need to use getElementsByTagNameNS() in WML documents. Revert to using getElementByTagName() again.
+
+        * wml/WMLPElement.cpp:
+        (WebCore::WMLPElement::insertedIntoDocument):
+
+2008-11-21  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix some coding style/formatting issues in WMLAElement.
+
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::parseMappedAttribute):
+        (WebCore::WMLAElement::defaultEventHandler):
+        * wml/WMLAElement.h:
+
+2008-11-21  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22399
+
+        Implement <anchor> support for WML, add WMLVariables file containing helper functions
+        for variable support, and a WMLTaskElement base class for WMLPrev/Go/RefreshElement.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::linkAttribute):
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::absoluteImageURL):
+        (WebCore::HitTestResult::absoluteLinkURL):
+        (WebCore::HitTestResult::isLiveLink):
+        * wml/WMLAnchorElement.cpp: Added.
+        (WebCore::WMLAnchorElement::WMLAnchorElement):
+        (WebCore::WMLAnchorElement::~WMLAnchorElement):
+        (WebCore::WMLAnchorElement::defaultEventHandler):
+        * wml/WMLAnchorElement.h: Added.
+        (WebCore::WMLAnchorElement::registerTask):
+        * wml/WMLTagNames.in:
+        * wml/WMLTaskElement.cpp: Added.
+        (WebCore::WMLTaskElement::WMLTaskElement):
+        (WebCore::WMLTaskElement::~WMLTaskElement):
+        (WebCore::WMLTaskElement::insertedIntoDocument):
+        (WebCore::WMLTaskElement::addVariableSetter):
+        (WebCore::WMLTaskElement::removeVariableSetter):
+        (WebCore::WMLTaskElement::storeVariableState):
+        * wml/WMLTaskElement.h: Added.
+        * wml/WMLVariables.cpp: Added.
+        (WebCore::isValidVariableCharacter):
+        (WebCore::isValidVariableReferenceCharacter):
+        (WebCore::isValidVariableName):
+        (WebCore::substituteVariableReferences):
+        * wml/WMLVariables.h: Added.
+        (WebCore::):
+
+2008-11-21  Julien Chaffraix  <jchaffraix@pleyo.com>
+
+        Rubber-stamped by Alexey Proskuryakov.
+
+        Build fix when building without WORKERS on non-POSIX, non-WINDOWS
+        machine.
+
+        Spotted by Mario Bensi.
+
+        * platform/text/TextCodecICU.cpp:
+
+2008-11-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        First step in https://bugs.webkit.org/show_bug.cgi?id=22394
+        Be more eager in destroying script decoded data
+
+        Pass data to be used in script execution around as JSC::SourceCode instead
+        of a source, url, and starting line.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/js/ScriptController.h:
+        * bindings/js/StringSourceProvider.h:
+        (WebCore::makeSource):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        * bindings/js/WorkerScriptController.h:
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElement::insertedIntoDocument):
+        (WebCore::ScriptElement::childrenChanged):
+        (WebCore::ScriptElementData::evaluateScript):
+        (WebCore::ScriptElementData::notifyFinished):
+        * dom/ScriptElement.h:
+        * dom/WorkerThread.cpp:
+        (WebCore::WorkerThread::workerThread):
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::notifyFinished):
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::endElementNs):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseEndElement):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::scriptHandler):
+        (WebCore::HTMLTokenizer::scriptExecution):
+        (WebCore::HTMLTokenizer::notifyFinished):
+        * html/HTMLTokenizer.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::executeScript):
+        * loader/FrameLoader.h:
+
+2008-11-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22392
+        REGRESION: XMLHttpRequest.responseText does unnecessary trip though WebCore::String
+
+        - Use jsOwnedStringOrNull to avoid conversion to WebCore::String.
+
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::responseText):
+        * xml/XMLHttpRequest.idl:
+
+2008-11-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=19623
+
+        When an non-layer object gained a transform, it would only repaint
+        the bounds of the new layer, which could result in redraw artifacts
+        if the new layer was smaller. So if we're gaining a transform, we
+        repaint.
+
+        Test: fast/repaint/change-transform.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::styleWillChange):
+
+2008-11-20  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/6111436> Support upload progress events on Windows
+
+        * platform/network/cf/ResourceHandleCFNet.cpp:
+        (WebCore::didSendBodyData): Added.
+        (WebCore::ResourceHandle::start): Hook up didSendBodyData callback.
+
+2008-11-20  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/2610675> Blank line that is quoted can't be deleted
+
+        If the caret is in an empty quoted paragraph, and either there is nothing before that
+        paragraph, or what is before is unquoted, and the user presses delete, unquote that
+        paragraph.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph): Added.
+        Removes the line break that holds open an empty paragraph and then attempts to
+        prune the blockquote(s) that held that line break in case they have been emptied
+        out.  Places a line break to create in empty unquoted paragraph in place of the
+        quoted one that was removed.
+        * editing/CompositeEditCommand.h:
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::deleteKeyPressed): Call breakOutOfEmptyBlockquotedParagraph.
+        * editing/htmlediting.cpp:
+        (WebCore::highestEnclosingNodeOfType): Added.
+        * editing/htmlediting.h:
+
+2008-11-20  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Antti Koivisto
+
+        https://bugs.webkit.org/show_bug.cgi?id=21247
+
+        Make transition shorthand property accept transition-delay.
+
+        Test: transitions/transition-shorthand-delay.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseTransitionShorthand):
+
+2008-11-20  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Antti Koivisto
+
+        https://bugs.webkit.org/show_bug.cgi?id=22368
+
+        Make sure pauseTransition API takes transition delay into account.
+
+        Test: transitions/transition-drt-api-delay.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::pauseAtTime):
+
+2008-11-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=20368
+
+        Implement getComputedStyle for animation properties. Remove individual
+        computed values for transform-origin-x, transform-origin-y, and just
+        return transform-origin instead. Return "none" for default animation-name,
+        and fix the initial value.
+
+        Tests: animations/computed-style.html
+               transforms/computed-style-origin.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::):
+        (WebCore::getDelayValue):
+        (WebCore::getDurationValue):
+        (WebCore::getTimingFunctionValue):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::initialAnimationName):
+
+2008-11-20  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Preparation for:
+        <rdar://problem/2610675> Blank line that is quoted can't be deleted
+
+        To fix this we need to make changes to the code that creates selections to delete
+        when the user does a backward or forward delete with a caret selection.  For certain
+        caret positions, we now want to remove something other than the standard "caret extended
+        backward/forward by one unit".  The problem is that there were two pieces of code
+        responsible for doing this, one in Editor::deleteWithDirection, and another inside
+        TypingCommand::deleteKeyPressed.  The code in deleteWithDirection is a recent
+        addition (r19172), and adding it there caused regressions because it prevented the
+        code in deleteKeyPressed from ever running.  The regressions were never caught because
+        JS deletion uses deleteKeyPressed while manual deletion uses deleteWithDirection.
+
+        This patch removes selection creation code from deleteWithDirection so that deleteKeyPressed
+        can handle it.  That required moving code to handle the kill ring down into deleteKeyPressed.
+
+        Follow up patches will fix <rdar://problem/2610675>, and attempt to eliminate the rest of the
+        discrepancies between the behavior of JS deletions and manual deletions, so that we
+        have better test coverage.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::deleteWithDirection): Early return if m_frame->document() is null, instead
+        of checking for that periodically throughout the function.  There's really nothing to be done
+        if it's null anyway.
+        Move kill ring code down into deleteKeyPressed.
+        * editing/Editor.h:
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::TypingCommand):
+        (WebCore::TypingCommand::deleteKeyPressed):
+        (WebCore::TypingCommand::forwardDeleteKeyPressed):
+        (WebCore::TypingCommand::doApply):
+        * editing/TypingCommand.h:
+        (WebCore::TypingCommand::create):
+
+2008-11-20  Darin Adler  <darin@apple.com>
+
+        Earlier version reviewed by Justin Garcia.
+
+        - fix <rdar://problem/4108572> REGRESSION: Can't extend selection with shift-arrow in read only mode
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::handleKeyboardEvent): Remove isContentEditable check -- keyboard events can be
+        handled even when the selection is not in an editable area.
+        (WebCore::Editor::handleInputMethodKeydown): Ditto.
+
+        * editing/EditorCommand.cpp: Changed the enabled rule for operations that change the selection to
+        allow use when there's a selection even if it's not in an editable area. This includes commands
+        like shift-arrow keys to extend the slection, but not commands like arrow keys to move the
+        insertion point.
+
+2008-11-20  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22380
+        Fix WorkerContext refcounting
+
+        * dom/WorkerContext.cpp:
+        (WebCore::WorkerContext::WorkerContext):
+        * dom/WorkerContext.h:
+        (WebCore::WorkerContext::script):
+        (WebCore::WorkerContext::clearScript):
+        Added a method to manually destroy WorkerScriptController.
+
+        * dom/WorkerThread.cpp: (WebCore::WorkerThread::workerThread):
+        Destroy WorkerScriptController to release any references to WorkerContext.
+
+2008-11-19  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Last part of bug 21106: .in format discussed changes
+        https://bugs.webkit.org/show_bug.cgi?id=21106
+
+        - Renamed isAudioHack to wrapperOnlyIfMediaIsAvailable as requested.
+
+        - Cleaned up additionnal function parameters that were unneeded.
+
+        * dom/make_names.pl:
+        * html/HTMLTagNames.in:
+
+2008-11-20  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22383
+        Worker tests spill error messages over to consequent tests
+
+        * dom/Worker.cpp: (WebCore::Worker::Worker):
+        Raise an exception immediately if URL is empty. Dcoument::completeURL() returns document URL
+        in this case, and there is no sense in starting a thread and trying to parse document source
+        as JavaScript.
+
+        * bindings/js/JSWorkerConstructor.cpp: (WebCore::constructWorker):
+        Return quickly if toString() raised an exception.
+
+2008-11-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22190
+
+        Fix the painting and event handling in transformed search fields.
+        When painting the cancel and results button parts,  get the rect from AppKit
+        relative to the input bounds (rather than in absolute coords), then convert
+        it into the coords of the part's renderer (which is the one that is painting).
+        To do this we need to compute an offset relative to some container, so expose
+        a method on RenderObject for that.
+
+        Also fix the location at which the search popup shows up to take transforms
+        into account, and fix the math that is used to figure out if the search
+        results button, or the cancel button should get the mouse events.
+
+        Test: fast/forms/search-transformed.html
+
+        * rendering/RenderBox.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::offsetFromContainer):
+        * rendering/RenderObject.h:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::forwardEvent):
+        (WebCore::RenderTextControl::showPopup):
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::convertToPaintingRect):
+        (WebCore::RenderThemeMac::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeMac::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeMac::paintSearchFieldResultsButton):
+
+2008-11-20  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Steps towards making the the Qt port of WebKit compile on Windows CE
+
+        https://bugs.webkit.org/show_bug.cgi?id=20746
+
+        * WebCore.pro: Various fixes to include windows specific build options
+        also in the Windows CE build.
+        * loader/icon/IconDatabase.cpp: Removed unnecessary errno.h inclusion.
+        * platform/FileSystem.h: Changed Q_OS_WIN32 to Q_OS_WIN to include CE.
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::getWindowsContext): SetWorldTransform is
+        not available on CE.
+        * platform/graphics/qt/PathQt.cpp: Added local definition of M_PI.
+        * platform/qt/FileSystemQt.cpp: Changed Q_OS_WIN32 to Q_OS_WIN to include CE.
+        * platform/qt/KeyboardCodes.h: Extend #idefs to define the missing OEM
+        constants on CE.
+        * platform/qt/TemporaryLinkStubs.cpp: Added stubs for plugins.
+        * platform/text/RegularExpression.cpp: Removed unused sys/types.h and
+        pcre.h inclusions.
+        * platform/win/SystemTimeWin.cpp:
+        (WebCore::userIdleTime): Don't use GetLastInputInfo on CE, it does not
+        exist.
+
+2008-11-20  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22379
+        Make CSSOM use less memory
+
+        - Shrink CSSProperty by half by using bitfields.
+        - Get rid of m_strictParsing field in StyleBase by moving it up to CSSStyleSheet
+          and CSSMutableStyleDeclaration. This reduces size of many highly popular objects.
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::CSSMutableStyleDeclaration):
+        (WebCore::CSSMutableStyleDeclaration::operator=):
+        * css/CSSMutableStyleDeclaration.h:
+        (WebCore::CSSMutableStyleDeclaration::setStrictParsing):
+        (WebCore::CSSMutableStyleDeclaration::useStrictParsing):
+        * css/CSSProperty.h:
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::CSSStyleSheet):
+        * css/CSSStyleSheet.h:
+        (WebCore::CSSStyleSheet::setStrictParsing):
+        (WebCore::CSSStyleSheet::useStrictParsing):
+        * css/StyleBase.h:
+        (WebCore::StyleBase::useStrictParsing):
+        (WebCore::StyleBase::StyleBase):
+
+2008-11-19  Darin Fisher  <darin@chromium.org>
+
+        Fix bustage.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22373
+        Ports busted by addition of ScriptValue.{h,cpp}
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::performRequest):
+
+2008-11-19  Darin Fisher  <darin@chromium.org>
+
+        Bustage fix.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22373
+        Ports busted by addition of ScriptValue.{h,cpp}
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCoreSources.bkl:
+        * dom/XMLTokenizerQt.cpp:
+        * plugins/PluginView.cpp:
+
+2008-11-19  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Geoff Garen.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22345
+        Define ScriptValue as a thin container for a JSC::Value*.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScheduledAction.cpp:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptValue.cpp: Added.
+        (WebCore::ScriptValue::getString):
+        * bindings/js/ScriptValue.h: Added.
+        (WebCore::ScriptValue::ScriptValue):
+        (WebCore::ScriptValue::jsValue):
+        * dom/ScriptElement.cpp:
+        * dom/XMLTokenizer.cpp:
+        * dom/XMLTokenizerLibxml2.cpp:
+        * html/HTMLTokenizer.cpp:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::executeIfJavaScriptURL):
+        (WebCore::FrameLoader::executeScript):
+        * loader/FrameLoader.h:
+
+2008-11-19  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Justin Garcia.
+
+        Fix for <rdar://problem/5472507> Remove color property when a user
+        sets color to black
+
+        This patch prevents us from inserting font nodes during the
+        ApplyStyleCommand if they will not change the computed style of an
+        element.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::fontColorChangesComputedStyle):
+        (WebCore::fontSizeChangesComputedStyle):
+        (WebCore::fontFaceChangesComputedStyle):
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded):
+
+2008-11-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Antti Koivisto
+
+        https://bugs.webkit.org/show_bug.cgi?id=22111
+
+        Fix hit testing in controls on transformed video elements
+        by replacing absoluteBoundingBoxRect().contains() with
+        code that maps the point into local coords, taking
+        transforms into account.
+
+        Test: media/video-controls-transformed.html
+
+        * platform/graphics/MediaPlayer.h:
+        * rendering/RenderMedia.cpp:
+        (WebCore::rendererContainsPoint):
+        (WebCore::RenderMedia::forwardEvent):
+
+2008-11-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=22348
+
+        Need to educate style sharing about autofill, so that style does not
+        get shared between input elements that are autofilled, and those
+        that are not. Setting autofill should also do a setChanged on the node.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::canShareStyleWithElement):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * dom/Node.h:
+        (WebCore::Node::isAutofilled):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setAutofilled):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::isAutofilled):
+
+2008-11-19  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by Antti Koivisto.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22349
+
+        Clear the subresource loader client when the client is removed in
+        response to a 304 (not modified). This prevents an inconsistent state
+        where the loader thinks it's active and the loader::Host doesn't.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::didReceiveResponse):
+
+2008-11-19  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22355
+        Systematize code for replacing global constructors
+
+        Test: fast/workers/worker-replace-global-constructor.html
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (setJSDOMWindowBaseEvent): Changed to put the value as property, matching what generated
+        code for global constructor setters does.
+        (setJSDOMWindowBaseAudio): Ditto.
+        (setJSDOMWindowBaseImage): Ditto.
+        (setJSDOMWindowBaseMessageChannel): Ditto.
+        (setJSDOMWindowBaseOption): Ditto.
+        (setJSDOMWindowBaseWorker): Ditto.
+        (setJSDOMWindowBaseXMLHttpRequest): Ditto.
+        (setJSDOMWindowBaseXSLTProcessor): Ditto.
+        (WebCore::JSDOMWindowBase::put): Removed special cases for global constructors.
+
+        * bindings/js/JSWorkerContext.cpp:
+        (WebCore::JSWorkerContext::getOwnPropertySlot): Look up overrides before own properties,
+        as it is done for Window.
+        (WebCore::setJSWorkerContextMessageEvent): Implemented in the same way as Window global
+        constructors are.
+        (WebCore::setJSWorkerContextWorkerLocation): Ditto.
+
+2008-11-19  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22341
+        Text codecs should not use static data without locking
+
+        * platform/text/TextCodecICU.cpp:
+        * platform/text/mac/TextCodecMac.cpp:
+        Made cached converters per-thread.
+
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::encodingRegistryMutex): Added a mutex for codec maps access.
+        (WebCore::addToTextCodecMap): Don't use TextEncoding just to canonicalize the name, as it
+        causes a deadlock due to a recursive call into registry.
+        (WebCore::buildBaseTextCodecMaps): Added assertions.
+        (WebCore::newTextCodec): Take a lock to avoid concurrent access to codec maps.
+        (WebCore::atomicCanonicalTextEncodingName): Ditto.
+        (WebCore::noExtendedTextEncodingNameUsed): Added a comment, explaining why locking is not
+        necessary here.
+
+2008-11-19  Alexey Proskuryakov  <ap@webkit.org>
+
+        Touch WebCorePrefix.h to force a rebuild, needed because of changed feature defines.
+
+        * WebCorePrefix.h:
+
+2008-11-19  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22310
+        Worker exceptions should be printed to console
+
+        * dom/Document.cpp: (WebCore::Document::reportException):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.h:
+        * dom/WorkerContext.cpp: (WebCore::WorkerContext::reportException):
+        * dom/WorkerContext.h:
+        Added a reportException() method on ScriptExecutionContext. It forwards the exception info
+        up until it finds a Document context, and then it prints it to console.
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSAbstractEventListener::handleEvent): Don't talk to Console directly, use
+        ScriptExecutionContext::reportException. Also, fixed a bug where Document::updateDocumentsRendering()
+        could be called from workers.
+        (WebCore::JSLazyEventListener::parseCode): Moved variable declaration inside if block for clarity.
+
+        * bindings/js/WorkerScriptController.cpp: (WebCore::WorkerScriptController::evaluate):
+        Report exceptions to ScriptExecutionContext.
+
+        * dom/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerTask::performTask):
+        (WebCore::WorkerExceptionTask::create):
+        (WebCore::WorkerExceptionTask::WorkerExceptionTask):
+        (WebCore::WorkerExceptionTask::performTask):
+        (WebCore::WorkerMessagingProxy::postWorkerException):
+        * dom/WorkerMessagingProxy.h:
+        Added a task for posting exception information.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::reportException):
+        (WebCore::reportCurrentException):
+        * bindings/js/JSDOMBinding.h:
+        Added helper methods for reporting exceptions via ScriptExecutionContext.
+
+        * page/Console.cpp:
+        * page/Console.h:
+        Removed methods for directly reporting exceptions to console.
+
+        * bindings/js/JSCustomPositionCallback.cpp:
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/objc/WebScriptObject.mm:
+        (WebCore::addExceptionToConsole):
+        Switch to JSDOMBinding methods for reporting exceptions.
+
+2008-11-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - WebCore part of https://bugs.webkit.org/show_bug.cgi?id=22331
+          <rdar://problem/6381657> REGRESSION: Contextual menu no longer has an "Inspect Element" item
+
+        * platform/ContextMenuItem.h:
+        (WebCore::ContextMenuAction): Reorder this enum to keep it in sync with
+        the one in WebUIDelegate.h.
+
+2008-11-18  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22346
+        PlatformString should also include HashSet.h for non-JSC builds
+
+        * platform/text/PlatformString.h:
+
+2008-11-18  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Holger Hans Peter Freyther.
+
+        Flip check added in recent refactoring so the background gets updated when the background color is valid, not invalid.
+
+        * loader/FrameLoaderClient.cpp: (WebCore::FrameLoaderClient::transitionToCommittedForNewPage):
+
+2008-11-18  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22343
+        Remove unused runtime/Collector, JSLock includes in Page.cpp
+
+        * page/Page.cpp:
+
+2008-11-18  Ada Chan  <adachan@apple.com>
+
+        Bug 22344: Make select popup window opaque
+        https://bugs.webkit.org/show_bug.cgi?id=22344
+
+        Reviewed by Steve Falkenburg.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+
+2008-11-18  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22342
+        Remove unused JSLock.h include
+
+        * dom/Document.cpp:
+
+2008-11-18  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Sam Weinig.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22334
+
+        Add WMLBRElement, correcting <br/> behaviour in WML.
+        Enable entity replacment for WML documents.
+        Handle WML specific <p> 'mode' attribute.
+
+        Generate layout tests results for fast/wml.
+
+        Tests cases that pass now:
+        fast/wml/br-element-in-table.wml
+        fast/wml/br-element-in-text.wml
+        fast/wml/case-sensitivity.wml
+        fast/wml/cdata-section.wml
+        fast/wml/comment.wml
+        fast/wml/entity.wml
+        fast/wml/p-align.wml
+        fast/wml/p-mode.wml
+        fast/wml/text-emphasis.wml
+        fast/wml/validate-dtd.wml
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::isWMLDocument):
+        (WebCore::XMLTokenizer::insertErrorMessageBlock):
+        * dom/XMLTokenizer.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::internalSubset):
+        (WebCore::getEntityHandler):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parse):
+        * wml/WMLBRElement.cpp: Added.
+        (WebCore::WMLBRElement::WMLBRElement):
+        (WebCore::WMLBRElement::mapToEntry):
+        (WebCore::WMLBRElement::parseMappedAttribute):
+        (WebCore::WMLBRElement::createRenderer):
+        * wml/WMLBRElement.h: Added.
+        * wml/WMLPElement.cpp:
+        (WebCore::WMLPElement::parseMappedAttribute):
+        (WebCore::WMLPElement::insertedIntoDocument):
+        * wml/WMLPElement.h:
+        * wml/WMLTagNames.in:
+
+2008-11-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        Windows build fix.
+
+        * WebCore.vcproj/WebCore.vcproj: Fix relative paths to use $(WebKitOutputDir).
+
+2008-11-18  Darin Adler  <darin@apple.com>
+
+        - try to fix Wx build
+
+        * WebCoreSources.bkl: Added FrameLoaderClient.cpp.
+
+2008-11-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22337
+        Enable workers by default
+
+        Tests: fast/workers/worker-constructor.html
+               fast/workers/worker-event-listener.html
+               fast/workers/worker-gc.html
+               fast/workers/worker-location.html
+
+        * Configurations/WebCore.xcconfig:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.vcproj/build-generated-files.sh:
+        Define ENABLE_WORKERS.
+
+2008-11-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        - first cut at https://bugs.webkit.org/show_bug.cgi?id=10957
+          <rdar://problem/5516594> please add support for HTTP-only cookies
+
+        Test: http/tests/xmlhttprequest/get-dangerous-headers.html
+
+        No test for HTTP-only support in JavaScript yet, since the Mac and Win changes
+        require an updated CFNetwork.
+
+        * platform/mac/CookieJar.mm:
+        (WebCore::isHTTPOnly): Added.
+        (WebCore::filterCookies): Added.
+        (WebCore::cookies): Use filterCookies to prevent getting HTTP-only cookies.
+        (WebCore::setCookies): Use filterCookies to prevent setting HTTP-only cookies.
+
+        * platform/network/win/CookieJarCFNetWin.cpp:
+        (WebCore::isHTTPOnly): Added.
+        (WebCore::filterCookies): Added.
+        (WebCore::setCookies): Use filterCookies to prevent getting HTTP-only cookies.
+        (WebCore::cookies): Use filterCookies to prevent getting HTTP-only cookies.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::isSetCookieHeader): Added.
+        (WebCore::XMLHttpRequest::getAllResponseHeaders): Hide Set-Cookie headers from
+        clients that don't have local-resource privileges.
+        (WebCore::XMLHttpRequest::getResponseHeader): Ditto.
+
+        - clean soup-specific details out of shared cookie jar header
+
+        * platform/CookieJar.h: Removed the soup-specific parts of this.
+        * platform/network/soup/CookieJarSoup.cpp: Changed to include
+        CookieJarSoup.h. Tweaked implementation a bit to handle UTF-8 better.
+        * platform/network/soup/CookieJarSoup.h: Added. Has the Soup-specified
+        part of CookieJar.h.
+        * platform/network/soup/ResourceHandleSoup.cpp: Changed to include
+        CookieJarSoup.h.
+
+2008-11-18  Steve Falkenburg  <sfalken@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=22329
+        Improper bitwise and tests against 0 in Windows context menu code
+
+        Reviewed by John Sullivan.
+
+        * platform/win/ContextMenuItemWin.cpp:
+        (WebCore::ContextMenuItem::type):
+        (WebCore::ContextMenuItem::enabled):
+
+2008-11-18  John Sullivan  <sullivan@apple.com>
+
+        Yet more Mac build fixing
+
+        * WebCore.base.exp: Export __ZTVN7WebCore17FrameLoaderClientE
+
+2008-11-18  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        React properly to frame rect changes for QWidget based plugins
+
+        We now set the geometry of the QWidget in frameRectsChanged,
+        intead of setFrameRect, which means we pick up the changes to
+        the frame rect when scrolling. We also set a mask on the
+        widget to keep it from painting over scrollbars and the like
+
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::setFrameRect):
+
+2008-11-18  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Rubber-stamped by Simon Hausmann.
+
+        Don't mark scrollbars as focused in QtWebKit
+
+        When initing from the widget we also got the focus state,
+        but this does not make sense for scrollbars.
+
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::styleOptionSlider):
+
+2008-11-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        More Mac build fixing.
+
+        * WebCore.base.exp: Export FrameLoaderClient destructor.
+
+2008-11-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        Mac build fix.
+
+        * WebCore.xcodeproj/project.pbxproj: Add FrameLoaderClient.cpp for now.
+
+2008-11-18  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22056
+
+        Attempt to share transitionToCommittedForNewPage of FrameLoaderClient with the different ports
+
+        After Hyatt's work on Widget and ScrollView there is little difference
+        between the implementation of Qt, Gtk+ and Win. In fact any kind of
+        difference is mostly a bug. Alp has fixed two of such errors for the Gtk+
+        port and the Qt port has at least one of them left.
+
+        The only difference between the implementations is in getting the the
+        IntSize for the new FrameView, the background color to be applied and
+        eventually some post processing.
+
+        Unify the implementations by providing a static helper function that
+        takes a Frame, IntSize, color and transparency bit and calling it from
+        the Gtk+, the Qt and the Windows port.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * loader/FrameLoaderClient.cpp: Added.
+        (WebCore::FrameLoaderClient::~FrameLoaderClient):
+        (WebCore::FrameLoaderClient::transitionToCommittedForNewPage):
+        * loader/FrameLoaderClient.h:
+
+2008-11-18  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22056
+
+        Move setting the background color and transparency from WebKit/win
+        to WebCore. This allows WebKit/win, WebKit/Qt and WebKit/Gtk+
+        to share this code.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::updateBackgroundRecursively):
+        * page/FrameView.h:
+
+2008-11-18  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix the bug where select elements are painted without border.
+        http://trolltech.com/developer/task-tracker/index_html?id=218957&method=entry
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintMenuList):
+
+2008-11-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix. Not reviewed.
+
+        * GNUmakefile.am: Fix USER_AGENT_STYLESHEETS, wml.css is in css/,
+        not in wml/.
+
+2008-11-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22308
+        Improve Worker GC behavior
+
+        * dom/ActiveDOMObject.cpp: (WebCore::ActiveDOMObject::hasPendingActivity):
+        * dom/ActiveDOMObject.h:
+        Made hasPendingActivity() virtual, letting Worker add behavior to it.
+
+        * bindings/js/WorkerScriptController.cpp: (WebCore::WorkerScriptController::evaluate):
+        * dom/WorkerThread.cpp: (WebCore::WorkerThread::workerThread):
+        Tell message proxy whether there are active objects in the worker whenever JS execution
+        finishes.
+
+        * dom/ScriptExecutionContext.h: (WebCore::ScriptExecutionContext::activeDOMObjects):
+        Added a typedef for activeDOMObjects() return type, necessary to declare iterators.
+
+        * dom/Worker.h:
+        * dom/Worker.cpp: (WebCore::Worker::hasPendingActivity): A Worker is active if it is still
+        loading, or if it has unconfirmed messages, or it the worker thread has pending activity.
+
+        * dom/WorkerContext.h:
+        * dom/WorkerContext.cpp: (WebCore::WorkerContext::hasPendingActivity): Check all registered
+        active objects for pending activity.
+
+        * dom/WorkerMessagingProxy.cpp:
+        (WebCore::MessageWorkerContextTask::performTask):
+        (WebCore::WorkerThreadActivityReportTask::create):
+        (WebCore::WorkerThreadActivityReportTask::WorkerThreadActivityReportTask):
+        (WebCore::WorkerThreadActivityReportTask::performTask):
+        (WebCore::WorkerMessagingProxy::WorkerMessagingProxy):
+        (WebCore::WorkerMessagingProxy::postMessageToWorkerContext):
+        (WebCore::WorkerMessagingProxy::workerObjectDestroyed):
+        (WebCore::WorkerMessagingProxy::workerContextDestroyedInternal):
+        (WebCore::WorkerMessagingProxy::confirmWorkerThreadMessage):
+        (WebCore::WorkerMessagingProxy::reportWorkerThreadActivity):
+        (WebCore::WorkerMessagingProxy::reportWorkerThreadActivityInternal):
+        (WebCore::WorkerMessagingProxy::workerThreadHasPendingActivity):
+        * dom/WorkerMessagingProxy.h:
+        Track outstanding messages, and activity reported by worker thread.
+
+2008-11-18  Alexey Proskuryakov  <ap@webkit.org>
+
+        Rubber-stamped by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22306
+        Disable channel messaging support
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (jsDOMWindowBaseMessageChannel):
+        * page/DOMWindow.idl:
+        Hide MesssagePort and MessageChannel global constructors. Due to the way MessageChannel
+        constructor is added, it remains enumerable, but undefined.
+
+2008-11-17  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by Mark Rowe.
+
+        Remove WBXML code. MainResourceLoader is not an appropriate location.
+        Revert until we find a better place.
+
+        The mime type which belongs to wmlc should be enabled anyway so WML documents get build.
+        Remove the ENABLE(WBXML) blocks around these types in MIMETypeRegistry / DOMImplementation.
+
+        * WebCore.pro:
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::addData):
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedNonImageMimeTypes):
+
+2008-11-17  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Not reviewed. Build fix.
+
+        Oops, disable WML by default on Qt.
+
+        * WebCore.pro:
+
+2008-11-17  Nikolas Zimmermann  <nikolas.zimmermann@torchmobile.com>
+
+        Reviewed by George Staikos.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=22324 (Add basic subset of WML elements)
+
+        Add first bits of WML support. Only <card> & <p> and <a> elements are supported in this first patch.
+        Support for most other elements will be added step-by-step (merging in small chunks from a big patch).
+
+        WML is not build by default.
+
+        * DerivedSources.make: Handle WMLNames/WMLElementFactory generation.
+        * GNUmakefile.am: Add new files and generator hooks.
+        * WebCore.pro: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * css/CSSStyleSelector.cpp: Load wml.css on demand, just like it's done for SVG.
+        (WebCore::linkAttribute):
+        (WebCore::CSSStyleSelector::styleForElement):c
+        * css/wml.css: Added.
+        * dom/DOMImplementation.cpp: Handle WMLDocument creation
+        (WebCore::DOMImplementation::createDocument):
+        * dom/Document.cpp: Handle WMLElement creation.
+        (WebCore::Document::createElement):
+        * dom/Document.h: Add helper function identifying WML documents.
+        (WebCore::Document::isWMLDocument):
+        * dom/Node.h: Add heper function identifying WML elements.
+        (WebCore::Node::isWMLElement):
+        * dom/XMLTokenizer.cpp: Handle errors in WML documents
+        (WebCore::XMLTokenizer::insertErrorMessageBlock):
+        * dom/XMLTokenizerLibxml2.cpp: Add WML DTD checks.
+        (WebCore::XMLTokenizer::internalSubset):
+        * dom/XMLTokenizerQt.cpp: Ditto.
+        (WebCore::):
+        * dom/make_names.pl: Force internal linkage for the "tagConstructor" functions, avoiding SVG<->WML clashes.
+        * history/BackForwardList.cpp: Add WML specific function for clearing the history.
+        (WebCore::BackForwardList::clearWmlPageHistory):
+        * history/BackForwardList.h:
+        * loader/FrameLoader.cpp: Add WML specific 'shouldReload' logic.
+        (WebCore::FrameLoader::FrameLoader):
+        (WebCore::FrameLoader::setForceReloadWmlDeck):
+        (WebCore::FrameLoader::shouldReload):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoader.h:
+        * loader/MainResourceLoader.cpp: Add WBXML support (only enabled on Linux/Qt at the moment)
+        (WebCore::MainResourceLoader::addData):
+        * page/Frame.cpp: Initialize WMLNames.
+        (WebCore::Frame::Frame):
+        * page/Page.cpp: Maintain WMLPageState object per Page.
+        (WebCore::Page::Page):
+        (WebCore::Page::setWMLPageState):
+        (WebCore::Page::wmlPageState):
+        * page/Page.h:
+        * platform/MIMETypeRegistry.cpp: Recognize WML extensions.
+        (WebCore::initializeSupportedNonImageMimeTypes):
+        * platform/gtk/MIMETypeRegistryGtk.cpp: Ditto.
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+        * platform/qt/MIMETypeRegistryQt.cpp: Ditto.
+        (WebCore::):
+        * platform/win/MIMETypeRegistryWin.cpp: Ditto.
+        (WebCore::MIMETypeRegistry::getMIMETypeForExtension):
+        * manual-tests/wml: Added.
+        * manual-tests/wml/a-br-element.wml: Added.
+        * manual-tests/wml/a-element.wml: Added.
+        * manual-tests/wml/a-img-element.wml: Added.
+        * manual-tests/wml/access-target.wml: Added.
+        * manual-tests/wml/anchor-br-element.wml: Added.
+        * manual-tests/wml/anchor-element.wml: Added.
+        * manual-tests/wml/anchor-img-element.wml: Added.
+        * manual-tests/wml/card-newcontext-attr.wml: Added.
+        * manual-tests/wml/card-onenterbackward.wml: Added.
+        * manual-tests/wml/card-onenterforward.wml: Added.
+        * manual-tests/wml/card-ontimer.wml: Added.
+        * manual-tests/wml/deck-access-control.wml: Added.
+        * manual-tests/wml/go-element.wml: Added.
+        * manual-tests/wml/input-emptyok.wml: Added.
+        * manual-tests/wml/input-format.wml: Added.
+        * manual-tests/wml/onevent-go.wml: Added.
+        * manual-tests/wml/onevent-noop.wml: Added.
+        * manual-tests/wml/onevent-prev.wml: Added.
+        * manual-tests/wml/onevent-refresh.wml: Added.
+        * manual-tests/wml/onevent-shadow.wml: Added.
+        * manual-tests/wml/postfield-get.wml: Added.
+        * manual-tests/wml/postfield-post.wml: Added.
+        * manual-tests/wml/select-element.wml: Added.
+        * manual-tests/wml/select-onpick-event.wml: Added.
+        * manual-tests/wml/setvar-element.wml: Added.
+        * manual-tests/wml/targetdeck.wml: Added.
+        * manual-tests/wml/task-go-in-anchor.wml: Added.
+        * manual-tests/wml/task-noop-in-do.wml: Added.
+        * manual-tests/wml/task-noop-in-onevent.wml: Added.
+        * manual-tests/wml/task-prev-in-anchor.wml: Added.
+        * manual-tests/wml/task-refresh-in-anchor.wml: Added.
+        * manual-tests/wml/template-go.wml: Added.
+        * manual-tests/wml/template-onevent.wml: Added.
+        * manual-tests/wml/template-ontimer.wml: Added.
+        * manual-tests/wml/timer.wml: Added.
+        * manual-tests/wml/variable-substitution.wml: Added.
+        * wml: Added.
+        * wml/WMLAElement.cpp: Added.
+        (WebCore::WMLAElement::WMLAElement):
+        (WebCore::WMLAElement::parseMappedAttribute):
+        (WebCore::WMLAElement::supportsFocus):
+        (WebCore::WMLAElement::isFocusable):
+        (WebCore::WMLAElement::isMouseFocusable):
+        (WebCore::WMLAElement::isKeyboardFocusable):
+        (WebCore::WMLAElement::defaultEventHandler):
+        (WebCore::WMLAElement::accessKeyAction):
+        (WebCore::WMLAElement::isURLAttribute):
+        (WebCore::WMLAElement::target):
+        * wml/WMLAElement.h: Added.
+        * wml/WMLAttributeNames.in: Added.
+        * wml/WMLCardElement.cpp: Added.
+        (WebCore::WMLCardElement::WMLCardElement):
+        * wml/WMLCardElement.h: Added.
+        * wml/WMLDocument.cpp: Added.
+        (WebCore::WMLDocument::WMLDocument):
+        (WebCore::WMLDocument::~WMLDocument):
+        * wml/WMLDocument.h: Added.
+        (WebCore::WMLDocument::create):
+        (WebCore::WMLDocument::isWMLDocument):
+        * wml/WMLElement.cpp: Added.
+        (WebCore::WMLElement::WMLElement):
+        (WebCore::WMLElement::mapToEntry):
+        (WebCore::WMLElement::parseMappedAttribute):
+        (WebCore::WMLElement::rendererIsNeeded):
+        (WebCore::WMLElement::createRenderer):
+        * wml/WMLElement.h: Added.
+        (WebCore::WMLElement::isWMLElement):
+        * wml/WMLPElement.cpp: Added.
+        (WebCore::WMLPElement::WMLPElement):
+        (WebCore::WMLPElement::mapToEntry):
+        (WebCore::WMLPElement::parseMappedAttribute):
+        * wml/WMLPElement.h: Added.
+        * wml/WMLPageState.cpp: Added.
+        (WebCore::WMLPageState::WMLPageState):
+        (WebCore::WMLPageState::~WMLPageState):
+        (WebCore::WMLPageState::reset):
+        (WebCore::WMLPageState::setNeedCheckDeckAccess):
+        (WebCore::WMLPageState::isDeckAccessible):
+        * wml/WMLPageState.h: Added.
+        (WebCore::WMLPageState::storeVariable):
+        (WebCore::WMLPageState::storeVariables):
+        (WebCore::WMLPageState::getVaribale):
+        (WebCore::WMLPageState::hasVariables):
+        (WebCore::WMLPageState::historyLength):
+        (WebCore::WMLPageState::setHistoryLength):
+        (WebCore::WMLPageState::page):
+        (WebCore::WMLPageState::activeCard):
+        (WebCore::WMLPageState::setActiveCard):
+        (WebCore::WMLPageState::setDeckAccessDomain):
+        (WebCore::WMLPageState::setDeckAccessPath):
+        (WebCore::WMLPageState::hasDeckAccess):
+        * wml/WMLTagNames.in: Added.
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Updated for JavaScriptCore renames.
+
+        * WebCore.pro:
+        * webcore-base.bkl:
+
+2008-11-17  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        <rdar://problem/4922709> Copying less than a paragraph of quoted text and pasting it doesn't retain quote level
+
+        There was code to intentionally avoid quoting pasted content if less than a paragraph of
+        it was copied.  That was added for <rdar://problem/5006779>, but was unnecessary because
+        that bug was about Paste and Match style for single paragraphs.  And quote stripping for
+        Paste and Match style is handled elsewhere.
+
+        * editing/markup.cpp:
+        (WebCore::createMarkup):
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Updated for JavaScriptCore rename.
+
+        * ForwardingHeaders/interpreter/CallFrame.h: Copied from WebCore/ForwardingHeaders/runtime/ExecState.h.
+        * ForwardingHeaders/runtime/ExecState.h: Removed.
+        * bindings/objc/WebScriptObject.mm:
+        * bridge/c/c_instance.cpp:
+        * bridge/jni/jni_jsobject.mm:
+        * dom/Node.cpp:
+        * dom/NodeFilter.cpp:
+        * dom/NodeIterator.cpp:
+        * dom/TreeWalker.cpp:
+        * inspector/JavaScriptCallFrame.h:
+
+2008-11-17  Pierre-Olivier Latour  <pol@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Added functionality to AnimationController to allow pausing a running
+        animation or transition at a given time for testing purposes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21261
+
+        Tests: animations/animation-drt-api.html
+               transitions/transition-drt-api.html
+
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+        (WebCore::AnimationBase::progress):
+        (WebCore::AnimationBase::pauseAtTime):
+        * page/animation/AnimationBase.h:
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::pauseAnimationAtTime):
+        (WebCore::AnimationControllerPrivate::pauseTransitionAtTime):
+        (WebCore::AnimationController::pauseAnimationAtTime):
+        (WebCore::AnimationController::pauseTransitionAtTime):
+        * page/animation/AnimationController.h:
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::isAnimating):
+        (WebCore::CompositeAnimationPrivate::pauseAnimationAtTime):
+        (WebCore::CompositeAnimationPrivate::pauseTransitionAtTime):
+        (WebCore::CompositeAnimation::pauseAnimationAtTime):
+        (WebCore::CompositeAnimation::pauseTransitionAtTime):
+        * page/animation/CompositeAnimation.h:
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::animate):
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Updated for JavaScriptCore renames.
+
+        * ForwardingHeaders/VM: Removed.
+        * ForwardingHeaders/VM/Machine.h: Removed.
+        * ForwardingHeaders/interpreter: Added.
+        * ForwardingHeaders/interpreter/Interpreter.h: Copied from ForwardingHeaders/VM/Machine.h.
+        * WebCore.pro:
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        * page/Console.cpp:
+        * webcore-base.bkl:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Updated for JavaScriptCore renames.
+
+        * ForwardingHeaders/runtime/Interpreter.h: Removed.
+        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/WorkerScriptController.cpp:
+        * bindings/objc/WebScriptObject.mm:
+        * bridge/NP_jsobject.cpp:
+        * bridge/jni/jni_jsobject.mm:
+        * html/CanvasRenderingContext2D.cpp:
+        * inspector/JavaScriptCallFrame.cpp:
+        * page/Console.cpp:
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Try to fix wx build.
+
+        * webcore-base.bkl:
+
+2008-11-17  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21810
+        Remove use of static C++ objects that are destroyed at exit time (destructors)
+
+        Find some missing DEFINE_STATIC_LOCAL use cases.
+
+        * bindings/js/JSSVGPODTypeWrapper.h:
+        (WebCore::PODTypeWrapperCacheInfoTraits::emptyValue):
+        (WebCore::JSSVGDynamicPODTypeWrapperCache::dynamicWrapperHashMap):
+        * dom/make_names.pl: Generate code to use DEFINE_STATIC_LOCAL.
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::RoleEntry::): This method is only called once, so the array does not have to be static.
+        * platform/graphics/FontCache.cpp:
+        (WebCore::FontPlatformDataCacheKeyTraits::emptyValue):
+        (WebCore::FontDataCacheKeyTraits::emptyValue):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::initialTransform):
+
+2008-11-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Try to fix Qt build.
+
+        * WebCore.pro:
+
+2008-11-16  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=22118
+
+        Fix resize corner tracking in transformed elements by using
+        mapping the point into local coords using absoluteToLocal,
+        rather than convertToLayerCoords.
+
+        Test: fast/css/resize-corner-tracking-transformed.html
+
+        * page/EventHandler.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::absoluteToContents):
+        (WebCore::RenderLayer::offsetFromResizeCorner):
+        (WebCore::RenderLayer::isPointInResizeControl):
+        * rendering/RenderLayer.h:
+
+2008-11-16  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Try to fix Qt build.
+
+        * WebCore.pro:
+
+2008-11-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Use RefPtr and PassRefPtr where appropriate.
+
+        * loader/FTPDirectoryDocument.cpp:
+        (WebCore::createTemplateDocumentData):
+
+2008-11-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Fix build break for real.
+
+        * loader/FTPDirectoryDocument.cpp:
+        (WebCore::createTemplateDocumentData):
+
+2008-11-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Fix build break and bug.
+
+        * loader/FTPDirectoryDocument.cpp:
+        (WebCore::createTemplateDocumentData):
+
+2008-11-16  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21810
+        Remove use of static C++ objects that are destroyed at exit time (destructors)
+
+        Use DEFINE_STATIC_LOCAL for static RetainPtr<T>, RefPtr<T>. Add additional
+        uses of DEFINE_STATIC_LOCAL where appropriate.
+
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::addSharedCellBordersDecl): new the AtomicStrings
+        * loader/CachedImage.cpp:
+        (WebCore::brokenImage):
+        (WebCore::nullImage):
+        * loader/FTPDirectoryDocument.cpp:
+        (WebCore::_createTemplateDocumentData): Created so accessor has one line initialization
+        (WebCore::FTPDirectoryTokenizer::loadDocumentTemplate):
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::loadDefaultIconRecord):
+        * page/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::actionVerb):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::actionVerb):
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::currentEvent):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::paint):
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::nullImage):
+        * platform/graphics/mac/ColorMac.mm:
+        (WebCore::nsColor):
+        * platform/graphics/mac/FontCacheMac.mm: new the Strings
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::_createPatternColor): Created so accessor has one line initialization
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::webFallbackFontFamily):
+        * platform/mac/PasteboardMac.mm:
+        (WebCore::writableTypesForURL):
+        (WebCore::createWritableTypesForImage): Created so accessor has one line initialization
+        (WebCore::writableTypesForImage):
+        (WebCore::stripAttachmentCharacters):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintResizer):
+
+2008-11-16  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Darin Adler.
+
+        Do not spit Curl errors into the stdout as this is used by DRT
+
+        We have failing tests results due the curl errors printed to stdout,
+        move them to stderr to be able to pass those tests.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::startJob):
+
+2008-11-16  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        - fix the Gtk+ build
+
+        * GNUmakefile.am:
+
+2008-11-16  Darin Adler  <darin@apple.com>
+
+        - try to fix Qt build
+
+        * WebCore.pro: Add the worker-related source files.
+
+2008-11-16  Darin Adler  <darin@apple.com>
+
+        Suggested by Alexey Proskuryakov.
+
+        - fix the GTK build another way
+
+        * GNUmakefile.am: Add the worker-related source files.
+        * bindings/js/JSEventTarget.cpp: Take the #if back out.
+
+2008-11-16  Darin Adler  <darin@apple.com>
+
+        - try to fix GTK build
+
+        * bindings/js/JSEventTarget.cpp: Put worker includes inside an #if.
+
+2008-11-16  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=22295
+          track which history items are from page load failures
+
+        * history/HistoryItem.cpp: Sort includes, add newly needed ones, and remove
+        no-longer-needed ones.
+        (WebCore::HistoryItem::HistoryItem): Initialize m_lastVisitWasFailure to false.
+        (WebCore::HistoryItem::showTreeWithIndent): Rewrote to avoid appending to a
+        String, since that's not efficient.
+
+        * history/HistoryItem.h: Removed unneeded includes. Added lastVisitWasFailure,
+        setLastVisitWasFailure, and m_lastVisitWasFailure.
+
+        * history/mac/HistoryItemMac.mm: Add newly-needed include
+        (WebCore::HistoryItem::setTransientProperty): Rewrote to avoid keeping a
+        m_transientProperties map around when it is empty.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::createHistoryItem): Call setLastVisitWasFailure when
+        the page was unreachable or an HTTP page with a status code that indicates
+        failure.
+
+2008-11-16  Yong Li  <yong.li@torchmobile.com>
+
+        Reviewed by Timothy Hatcher.
+        Landed by George Staikos.
+
+        Optimization: don't relayout, repaint, or emit a DOM event if the
+        scroll event didn't scroll anywhere.
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollToOffset): add early exit
+
+2008-11-16  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22290
+        Remove cross-heap GC and MessagePort multi-threading support
+
+        It is broken (and may not be implementable at all), and no longer needed, as we
+        don't use MessagePorts for communication with workers any more.
+
+        * bindings/js/JSDOMBinding.cpp:
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowBase.h:
+        Removed cross-heap GC implementation.
+
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::hasPendingActivity):
+        * dom/MessagePort.h:
+        Made objects RefCounted instead of ThreadSafeShared, added FIXME comments for code that is
+        unnecessarily complicated for single threaded case.
+
+2008-11-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22266
+        Stop using MessagePort for communication with workers
+
+        The current MessagePort specification is not well suited for being implemented in a
+        multi-threaded or multi-process environment, and this doesn't appear to be easily fixable.
+        This patch implements a simpler Mozilla API for workers instead.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * DerivedSources.make:
+        * bindings/js/JSDOMWindowBase.cpp: (jsDOMWindowBaseWorker):
+        * bindings/js/JSDedicatedWorkerConstructor.cpp: Removed.
+        * bindings/js/JSDedicatedWorkerConstructor.h: Removed.
+        * bindings/js/JSDedicatedWorkerCustom.cpp: Removed.
+        * bindings/js/JSWorkerConstructor.cpp: Copied from WebCore/bindings/js/JSDedicatedWorkerConstructor.cpp.
+        * bindings/js/JSWorkerConstructor.h: Copied from WebCore/bindings/js/JSDedicatedWorkerConstructor.h.
+        * bindings/js/JSWorkerCustom.cpp: Copied from WebCore/bindings/js/JSDedicatedWorkerCustom.cpp.
+        * dom/DedicatedWorker.cpp: Removed.
+        * dom/DedicatedWorker.h: Removed.
+        * dom/DedicatedWorker.idl: Removed.
+        Renamed DedicatedWorker to Worker to match Mozilla and current WHATWG cpec.
+
+        * bindings/js/JSEventListener.cpp: (WebCore::JSAbstractEventListener::handleEvent):
+        Clear worker exceptions to avoid hitting an assertion.
+
+        * dom/EventTarget.cpp: (WebCore::EventTarget::toWorker):
+        * dom/EventTarget.h:
+        * bindings/js/JSEventTarget.cpp: (WebCore::toJS):
+        WorkerContext is now an EventTarget, too.
+
+        * bindings/js/JSWorkerContext.cpp: Removed onconnect, constructors for MessageChannel and
+        MessagePort. Added postMessage() and onmessage.
+
+        * dom/ScriptExecutionContext.cpp: (WebCore::performTask): Do not reference ScriptExecutionContext
+        when posting a task - this operation is not thread safe. It is also not necessary any more,
+        as the context is kept alive by WorkerMessagingProxy.
+
+        * dom/Worker.cpp: Copied from WebCore/dom/DedicatedWorker.cpp.
+        (WebCore::Worker::Worker): Start loading the script right away - there is no reason to do
+        that on a timer.
+        (WebCore::Worker::~Worker): Notify messaging proxy.
+        (WebCore::Worker::postMessage): Just ask the proxy to post the message.
+        (WebCore::Worker::notifyFinished): Notify messaging proxy when a thread object becomes
+        available. Also, it is now safe to unsetPendingActivity(), making the object collectable.
+        I'm not sure if this is the right lifetime for workers, as unreachable workers with event
+        listeners should probably be kept alive, but it at least lets the object be collected.
+        (WebCore::Worker::addEventListener): Added an EventTarget implementation.
+        (WebCore::Worker::removeEventListener): Added an EventTarget implementation.
+        (WebCore::Worker::dispatchEvent): Added an EventTarget implementation.
+
+        * dom/Worker.h: Copied from WebCore/dom/DedicatedWorker.h.
+        * dom/Worker.idl: Copied from WebCore/dom/DedicatedWorker.idl.
+        Removed onclose, made an EventListener. Actual messaging is now handled by WorkerMessagingProxy.
+
+        * dom/WorkerContext.cpp:
+        (WebCore::WorkerContext::~WorkerContext): Notify messaging proxy that the context was shut
+        down successfully.
+        (WebCore::WorkerContext::postMessage): Added. Post the message via messaging proxy.
+
+        * dom/WorkerContext.h: Added postMessage and onmessage, removed onconnect.
+
+        * dom/WorkerMessagingProxy.cpp: Added.
+        * dom/WorkerMessagingProxy.h: Added.
+        This new class implements actual messaging. It is notified when a Worker is garbage collected,
+        and asks the thread to shut down. It also owns the thread object, and references script
+        execution context, making it safe to post messages to it remotely.
+
+        * dom/WorkerThread.cpp:
+        * dom/WorkerThread.h:
+        Keep a reference to messaging proxy, not to Worker itself. Also, the thread object no longer
+        keeps itself alive - it is now the job of messaging proxy.
+
+2008-11-15  Darin Adler  <darin@apple.com>
+
+        Rubber stamped by Geoff Garen.
+
+        - do the long-planned StructureID -> Structure rename
+
+        * ForwardingHeaders/runtime/Structure.h: Copied from WebCore/ForwardingHeaders/runtime/StructureID.h.
+        * ForwardingHeaders/runtime/StructureID.h: Removed.
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::getCachedDOMStructure):
+        (WebCore::cacheDOMStructure):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObject::DOMObject):
+        (WebCore::getDOMStructure):
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObject):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::JSDOMWindowShell):
+        (WebCore::JSDOMWindowShell::setWindow):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructure):
+        * bindings/js/JSDedicatedWorkerConstructor.cpp:
+        (WebCore::JSDedicatedWorkerConstructor::JSDedicatedWorkerConstructor):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::JSHTMLAllCollection):
+        (WebCore::JSHTMLAllCollection::createStructure):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::wrap):
+        (WebCore::JSInspectedObjectWrapper::JSInspectedObjectWrapper):
+        * bindings/js/JSInspectedObjectWrapper.h:
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::leakInspectorCallbackWrapperStructure):
+        (WebCore::JSInspectorCallbackWrapper::wrap):
+        (WebCore::JSInspectorCallbackWrapper::JSInspectorCallbackWrapper):
+        * bindings/js/JSInspectorCallbackWrapper.h:
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
+        * bindings/js/JSNamedNodesCollection.h:
+        (WebCore::JSNamedNodesCollection::createStructure):
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructure):
+        * bindings/js/JSRGBColor.h:
+        (WebCore::JSRGBColor::createStructure):
+        * bindings/js/JSWorkerContext.cpp:
+        (WebCore::createJSWorkerContextStructure):
+        (WebCore::JSWorkerContext::JSWorkerContext):
+        (WebCore::JSWorkerContext::createPrototype):
+        * bindings/js/JSWorkerContext.h:
+        (WebCore::JSWorkerContext::createStructure):
+        (WebCore::JSWorkerContextPrototype::JSWorkerContextPrototype):
+        (WebCore::JSWorkerContextPrototype::createStructure):
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructure):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtConnectionObject::execute):
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructure):
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructure):
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructure):
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::RuntimeObjectImp):
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructure):
+
+2008-11-15  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        - fix just-introduced crash in the svg/custom/svg-fonts-in-html.html test
+
+        This gets rid of the crash. It restores the behavior of the CG case from before Dirk
+        Shulze removed the platorm-dependent code, but perhaps it should be changed further
+        in the future so that the default for no style is "no stroke". I think the patch is
+        fine for fill.
+
+        * svg/graphics/SVGPaintServerSolid.cpp:
+        (WebCore::SVGPaintServerSolid::setup): Added null checks for svgStyle.
+        (WebCore::SVGPaintServerSolid::renderPath): Added null checks for style and svgStyle.
+
+2008-11-15  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Timothy Hatcher.
+
+        Initialize m_networkStateChangedFunction to 0 as otherwise the check for null will fail.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22284
+
+        * platform/network/NetworkStateNotifier.h:
+        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+
+2008-11-15  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        r38426 caused a wrong drawing of a LayoutTest. Use another
+        way to set the color to pass this test again.
+
+        * svg/graphics/SVGPaintServerSolid.cpp:
+        (WebCore::SVGPaintServerSolid::setup):
+
+2008-11-15  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Removed platform dependent code on SVGPaintServerSolid.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * svg/graphics/SVGPaintServerSolid.cpp:
+        (WebCore::SVGPaintServerSolid::setup):
+        (WebCore::SVGPaintServerSolid::renderPath):
+        * svg/graphics/SVGPaintServerSolid.h:
+        * svg/graphics/cairo/SVGPaintServerSolidCairo.cpp: Removed.
+        * svg/graphics/cg/SVGPaintServerSolidCg.cpp: Removed.
+        * svg/graphics/qt/SVGPaintServerSolidQt.cpp: Removed.
+
+2008-11-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Updated for JavaScriptCore renames.
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::mark):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/js/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject evaluateWebScript:]):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_Evaluate):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::eval):
+        * page/Console.cpp:
+        (WebCore::retrieveLastCaller):
+        (WebCore::Console::trace):
+
+2008-11-14  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21810
+        Remove use of static C++ objects that are destroyed at exit time (destructors)
+
+        Create DEFINE_STATIC_LOCAL macro. Change static local objects to leak to avoid
+        exit-time destructor. Update code that was changed to fix this issue that ran
+        into a gcc bug (<rdar://problem/6354696> Codegen issue with C++ static reference
+        in gcc build 5465). Also typdefs for template types needed to be added in some
+        cases so the type could make it through the macro successfully.
+
+        Basically code of the form:
+        static T m;
+        becomes:
+        DEFINE_STATIC_LOCAL(T, m, ());
+
+        Also any code of the form:
+        static T& m = *new T;
+        also becomes:
+        DEFINE_STATIC_LOCAL(T, m, ());
+
+        * ForwardingHeaders/wtf/StdLibExtras.h: Added.
+        * bindings/js/GCController.cpp:
+        (WebCore::gcController):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::wrapperSet):
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::wrappers):
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::wrappers):
+        * bindings/js/JSNavigatorCustom.cpp:
+        (WebCore::needsYouTubeQuirk):
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::rootObjectSet):
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::initShorthandMap):
+        (WebCore::CSSMutableStyleDeclaration::removeProperty):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::cssText):
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::screenEval):
+        (WebCore::printEval):
+        * dom/DOMImplementation.cpp:
+        (WebCore::addString):
+        (WebCore::isSVG10Feature):
+        (WebCore::isSVG11Feature):
+        (WebCore::DOMImplementation::isXMLMIMEType):
+        * dom/Document.cpp:
+        (WebCore::Document::hasPrefixNamespaceMismatch):
+        * dom/ScriptElement.cpp:
+        (WebCore::isSupportedJavaScriptLanguage):
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::styleSpanClassString):
+        * editing/HTMLInterchange.cpp:
+        (WebCore::):
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::indentBlockquoteString):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::isInterchangeNewlineNode):
+        (WebCore::isInterchangeConvertedSpaceSpan):
+        * editing/htmlediting.cpp:
+        (WebCore::stringWithRebalancedWhitespace):
+        (WebCore::nonBreakingSpaceString):
+        * editing/markup.cpp:
+        (WebCore::appendAttributeValue):
+        (WebCore::appendEscapedContent):
+        (WebCore::shouldAddNamespaceAttr):
+        (WebCore::appendNamespace):
+        (WebCore::appendStartMarkup):
+        (WebCore::createMarkup):
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::type):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::isRecognizedTagName):
+        (WebCore::inlineTagList):
+        (WebCore::blockTagList):
+        * html/HTMLFieldSetElement.cpp:
+        (WebCore::HTMLFieldSetElement::type):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::type):
+        * html/HTMLKeygenElement.cpp:
+        (WebCore::HTMLKeygenElement::type):
+        * html/HTMLLegendElement.cpp:
+        (WebCore::HTMLLegendElement::type):
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::type):
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::type):
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode):
+        (WebCore::HTMLParser::isHeaderTag):
+        (WebCore::HTMLParser::isResidualStyleTag):
+        (WebCore::HTMLParser::isAffectedByResidualStyle):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::type):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::type):
+        * inspector/InspectorController.cpp:
+        (WebCore::platform):
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::shared):
+        * inspector/JavaScriptProfile.cpp:
+        (WebCore::profileCache):
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::profileNodeCache):
+        * loader/FrameLoader.cpp:
+        (WebCore::localSchemes):
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::cacheStorage):
+        * loader/archive/ArchiveFactory.cpp:
+        (WebCore::archiveMIMETypes):
+        (WebCore::ArchiveFactory::registerKnownArchiveMIMETypes):
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::defaultDatabaseFilename):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dragState):
+        * page/Frame.cpp:
+        (WebCore::createRegExpForLabels):
+        (WebCore::keepAliveSet):
+        * page/Page.cpp:
+        (WebCore::Page::groupName):
+        * page/SecurityOrigin.cpp:
+        (WebCore::isDefaultPortForProtocol):
+        (WebCore::SecurityOrigin::databaseIdentifier):
+        * page/mac/FrameMac.mm:
+        (WebCore::regExpForLabels):
+        * platform/KURL.cpp:
+        (WebCore::blankURL):
+        * platform/graphics/FontCache.cpp:
+        (WebCore::alternateFamilyName):
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        (WebCore::FontCache::getLastResortFallbackFont):
+        * platform/mac/CursorMac.mm:
+        (WebCore::leakNamedCursor):
+        (WebCore::pointerCursor):
+        (WebCore::crossCursor):
+        (WebCore::handCursor):
+        (WebCore::moveCursor):
+        (WebCore::verticalTextCursor):
+        (WebCore::cellCursor):
+        (WebCore::contextMenuCursor):
+        (WebCore::aliasCursor):
+        (WebCore::zoomInCursor):
+        (WebCore::zoomOutCursor):
+        (WebCore::copyCursor):
+        (WebCore::noneCursor):
+        (WebCore::progressCursor):
+        (WebCore::noDropCursor):
+        (WebCore::notAllowedCursor):
+        (WebCore::iBeamCursor):
+        (WebCore::waitCursor):
+        (WebCore::helpCursor):
+        (WebCore::eastResizeCursor):
+        (WebCore::northResizeCursor):
+        (WebCore::northEastResizeCursor):
+        (WebCore::northWestResizeCursor):
+        (WebCore::southResizeCursor):
+        (WebCore::southEastResizeCursor):
+        (WebCore::southWestResizeCursor):
+        (WebCore::westResizeCursor):
+        (WebCore::northSouthResizeCursor):
+        (WebCore::eastWestResizeCursor):
+        (WebCore::northEastSouthWestResizeCursor):
+        (WebCore::northWestSouthEastResizeCursor):
+        (WebCore::columnResizeCursor):
+        (WebCore::rowResizeCursor):
+        (WebCore::grabCursor):
+        (WebCore::grabbingCursor):
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarTheme::nativeTheme):
+        * platform/mac/ThemeMac.mm:
+        (WebCore::platformTheme):
+        * platform/mac/ThreadCheck.mm:
+        (WebCoreReportThreadViolation):
+        * platform/network/NetworkStateNotifier.cpp:
+        (WebCore::networkStateNotifier):
+        * platform/network/mac/FormDataStreamMac.mm:
+        (WebCore::getStreamFormDataMap):
+        (WebCore::getStreamResourceHandleMap):
+        * platform/network/mac/ResourceResponseMac.mm:
+        (WebCore::ResourceResponse::platformLazyInit):
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::isJapanese):
+        * plugins/PluginMainThreadScheduler.cpp:
+        (WebCore::PluginMainThreadScheduler::scheduler):
+        * rendering/RenderBlock.cpp:
+        (WebCore::continuationOutlineTable):
+        (WebCore::RenderBlock::addContinuationWithOutline):
+        (WebCore::RenderBlock::paintContinuationOutlines):
+        * rendering/RenderCounter.cpp:
+        (WebCore::counterMaps):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::markerText):
+        * rendering/RenderScrollbarTheme.cpp:
+        (WebCore::RenderScrollbarTheme::renderScrollbarTheme):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::systemFont):
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::checkLinesForTextOverflow):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::initialDashboardRegions):
+        (WebCore::RenderStyle::noneDashboardRegions):
+        * storage/Database.cpp:
+        (WebCore::guidMutex):
+        (WebCore::guidToVersionMap):
+        (WebCore::guidToDatabaseMap):
+        (WebCore::Database::databaseInfoTableName):
+        (WebCore::databaseVersionKey):
+        (WebCore::Database::getVersionFromDatabase):
+        (WebCore::Database::setVersionInDatabase):
+        (WebCore::guidForOriginAndName):
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::tracker):
+        (WebCore::notificationMutex):
+        (WebCore::notificationQueue):
+        * storage/LocalStorage.cpp:
+        (WebCore::localStorageMap):
+        * svg/SVGAnimateMotionElement.cpp:
+        (WebCore::SVGAnimateMotionElement::rotateMode):
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::calcMode):
+        (WebCore::SVGAnimationElement::attributeType):
+        (WebCore::SVGAnimationElement::isAdditive):
+        (WebCore::SVGAnimationElement::isAccumulated):
+        * svg/SVGLangSpace.cpp:
+        (WebCore::SVGLangSpace::xmlspace):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::contentScriptType):
+        (WebCore::SVGSVGElement::contentStyleType):
+        * svg/SVGStyleElement.cpp:
+        (WebCore::SVGStyleElement::type):
+        (WebCore::SVGStyleElement::media):
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::parseMappedAttribute):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::parseClockValue):
+        (WebCore::SVGSMILElement::restart):
+        (WebCore::SVGSMILElement::fill):
+        (WebCore::SVGSMILElement::repeatCount):
+        (WebCore::SVGSMILElement::notifyDependentsIntervalChanged):
+        * svg/graphics/SVGResource.cpp:
+        (WebCore::clientMap):
+        (WebCore::SVGResource::removeClient):
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::draw):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::PreflightResultCacheItem::PreflightResultCacheItem):
+        (WebCore::preflightResultCache):
+        (WebCore::appendPreflightResultCacheEntry):
+        (WebCore::isSafeRequestHeader):
+        (WebCore::isOnAccessControlResponseHeaderWhitelist):
+        (WebCore::XMLHttpRequest::didReceiveResponsePreflight):
+        * xml/XPathExpressionNode.cpp:
+        (WebCore::XPath::Expression::evaluationContext):
+        * xml/XPathParser.cpp:
+        (WebCore::XPath::setUpAxisNamesMap):
+        (WebCore::XPath::isAxisName):
+        (WebCore::XPath::isNodeTypeName):
+        * xml/XPathValue.cpp:
+        (WebCore::XPath::Value::toNodeSet):
+
+2008-11-14  Dan Bernstein  <mitz@apple.com>
+
+        - attempt to fix the Qt build
+
+        * platform/qt/Localizations.cpp:
+        (WebCore::contextMenuItemTagTextDirectionMenu): Added. Maybe this string
+        needs to go somewhere else in addition to here.
+
+2008-11-14  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix.
+
+        * platform/wx/LocalizedStringsWx.cpp:
+        (WebCore::contextMenuItemTagTextDirectionMenu):
+
+2008-11-14  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - <rdar://problem/6234307> Support action methods for setting and clearing character-level directionality
+        - WebCore part of <rdar://problem/6234337> Add a Text Direction menu to the default context menu when appropriate
+
+        * WebCore.base.exp: Exported
+        WebCore::Settings::setTextDirectionSubmenuInclusionBehavior().
+
+        * editing/ApplyStyleCommand.cpp:
+        (StyleChange::init): Changed to always include the direction property
+        in the result if the unicode-bidi property is included.
+        (ApplyStyleCommand::splitAncestorsWithUnicodeBidi): Added. Finds the
+        highest ancestor of the given node that establishes bidi embedding. If
+        that embedding agrees with the given allowed direction, finds the
+        second-highest embedding ancestor. Splits all nodes through that
+        ancestor. If the highest embedding ancestor did not need to be split,
+        it is returned.
+        (ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock): Added. Removes
+        bidi embedding attributes and styles from all ancestors of the given
+        node up to its enclosing block or the given node.
+        (ApplyStyleCommand::applyInlineStyle): Added code to handle the
+        unicode-bidi property. Applying style the includes this property
+        involves removing all bidi embedding in effect, except  for one-level
+        embedding that agrees with the desired embedding, then applying the
+        desired embedding where it is not already in effect.
+        (ApplyStyleCommand::applyInlineStyleToRange): Factored out from
+        applyInlineStyle().
+        (ApplyStyleCommand::removeHTMLBidiEmbeddingStyle): Added. Removed the
+        "dir" attribute if necessary and the element if it becomes an unstyled
+        style span.
+        (ApplyStyleCommand::removeCSSStyle): Changed to remove the direction
+        property when removing the unicode-bidi property.
+        (ApplyStyleCommand::removeInlineStyle): Added a call to
+        removeHTMLBidiEmbeddingStyle().
+
+        * editing/ApplyStyleCommand.h:
+        * editing/Editor.cpp:
+        (Editor::textDirectionForSelection): Added. Returns the character-level
+        writing direction of the selection if it is uniform and simple (at most
+        one level of embedding).
+        (Editor::hasBidiSelection): Added. Returns true if the selection lies
+        entirely within a single block, and that block has direction:rtl or
+        contains any inline boxes with non-zero bidi embedding level.
+
+        * editing/Editor.h:
+        * editing/EditorCommand.cpp:
+        (stateTextWritingDirection): Added this helper function for deciding
+        the state of Text Direction submenu items.
+        (executeMakeTextWritingDirectionLeftToRight): Added. Applies
+        "unicode-bidi: embed; direction: ltr;".
+        (executeMakeTextWritingDirectionNatural): Added. Applies
+        "unicode-bidi: normal;"
+        (executeMakeTextWritingDirectionRightToLeft): Added. Applies
+        "unicode-bidi: embed; direction: rtl;".
+        (stateTextWritingDirectionLeftToRight): Added.
+        (stateTextWritingDirectionNatural): Added.
+        (stateTextWritingDirectionRightToLeft): Added.
+        (createCommandMap): Added "MakeTextWritingDirectionLeftToRight",
+        "MakeTextWritingDirectionNatural",
+        and "MakeTextWritingDirectionRightToLeft".
+
+        * editing/InsertTextCommand.cpp:
+        (InsertTextCommand::input): Added code to maintain the unicode-bidi
+        and direction properties in the typing style. Even if they have the
+        same values as the computed style at the caret, they need to be included
+        in the typing style so that inserted text will not inherit any nested
+        embedding.
+
+        * page/ContextMenuController.cpp:
+        (ContextMenuController::contextMenuItemSelected): Added calls to
+        the editor for the text direction menu items.
+
+        * page/Frame.cpp
+        (Frame::computeAndSetTypingStyle): Added code to maintain the
+        unicode-bidi and direction properties in the typing style.
+
+        * page/Settings.cpp:
+        (Settings::setTextDirectionSubmenuInclusionBehavior): Added this setter.
+
+        * page/Settings.h: Added a TextDirectionSubmenuInclusionBehavior enum,
+        an m_textDirectionSubmenuInclusionBehavior member, and accessors.
+
+        * page/mac/WebCoreViewFactory.h:
+        * platform/ContextMenu.cpp:
+        (WebCore::createAndAppendTextDirectionSubMenu): Added.
+        (ContextMenu::populate): Added the Text Direction submenu item based on
+        the inclusion behavior and the existence of a bidi selection.
+        (ContextMenu::checkOrEnableIfNeeded): Added code for the text direction
+        menu items.
+
+        * platform/ContextMenuItem.h:
+        * platform/LocalizedStrings.h: Declared
+        contextMenuItemTagTextDirectionMenu().
+
+        * platform/mac/LocalizedStringsMac.mm: Defined
+        contextMenuItemTagTextDirectionMenu().
+
+        * rendering/RenderBlock.cpp:
+        (RenderBlock::containsNonZeroBidiLevel): Added.
+        * rendering/RenderBlock.h:
+
+2008-11-14  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22264
+        Need to update to latest Geolocation spec (13 November 2008)
+
+        Update to new error code constants and values.
+
+        * page/Geolocation.cpp: Use new named ErrorCode enums
+        (WebCore::Geolocation::GeoNotifier::timerFired):
+        (WebCore::Geolocation::getCurrentPosition):
+        (WebCore::Geolocation::watchPosition):
+        * page/PositionError.h: Have ErrorCode enum names match new error constant names and values
+        (WebCore::PositionError::):
+        * page/PositionError.idl: Add new named error constants
+
+2008-11-14  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Justin Garcia.
+
+        Fix (again) for <rdar://problem/5089327> Too much indentation when
+        pasting quoted paragraphs
+
+        This patch goes back to Justin's original approach to fix this bug,
+        written in revision 38273. That fix was mostly rolled out by
+        revision 38310 because of styling issues created by the addition of
+        extra blockquote nodes. This patch again goes back to Justin's
+        original fix because of cases we discovered the newer fix could not
+        possibly cover. This version of the patch minimizes the styling
+        issues of extra blockquotes by opting into the merge start code.
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::hasMatchingQuoteLevel): We want shouldMergeStart to
+        return true when the quoting level of the end of the inserted
+        content matches the quoting level of the end of the existing
+        content.
+        (WebCore::ReplaceSelectionCommand::shouldMergeStart): Now calls
+        hasMatchingQuoteLevel
+        (WebCore::ReplaceSelectionCommand::doApply):
+
+2008-11-14  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by Eric Seidel.
+
+        Made SVGResourceClipper platform independent.
+        https://bugs.webkit.org/show_bug.cgi?id=21444
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::clipPath):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::clipPath):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::addPath):
+        (WebCore::GraphicsContext::clipPath):
+        * svg/graphics/SVGResourceClipper.cpp:
+        (WebCore::SVGResourceClipper::applyClip):
+        * svg/graphics/cairo/SVGResourceClipperCairo.cpp: Removed.
+        * svg/graphics/cg/SVGResourceClipperCg.cpp: Removed.
+        * svg/graphics/qt/SVGResourceClipperQt.cpp: Removed.
+
+2008-11-14  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Combine loadFrameRequestWithFormState to loadFrameRequestWithFormAndValues.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadFrameRequestWithFormAndValues):
+        * loader/FrameLoader.h:
+
+2008-11-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove unneeded forward declaration.
+
+        * plugins/Plugin.h:
+
+2008-11-14  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22251
+        HTMLCanvasElement.cpp unnecessarily includes runtime/Interpreter.h
+
+        * html/HTMLCanvasElement.cpp:
+
+2008-11-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add new files from the Qt port to the build.
+
+        * WebCore.pro:
+
+2008-11-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Made DatabaseTracker::hasEntryForOrigin() public. This allows the Qt
+        port to apply a default quota only if there is no entry in the
+        database for a given origin yet.
+
+        * storage/DatabaseTracker.h:
+
+2008-11-14  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Make it possible to get the cache directory set in the application
+        cache storage.
+
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::ApplicationCacheStorage::cacheDirectory): Added.
+        * loader/appcache/ApplicationCacheStorage.h:
+
+2008-11-14  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        <rdar://problem/4230923> "Make Plain Text" doesn't reset text alignment in single paragraph messages
+
+        When applying block styles, we would add block properties to the body element, and Mail's
+        Make Plain Text feature isn't equipped to remove those.  This could have been fixed on our side,
+        but this change has the advantage that it fixes the bug on Tiger, where Mail does not plan future updates.
+
+        We have code that puts the paragraphs that we're operating on into blocks of their own before
+        adding or removing block properties from the blocks that enclose them.  We need to run this code
+        when the enclosing block is the body element.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::insertNewDefaultParagraphElementAt): Added, moved code from moveParagraphContents
+        to here.
+        (WebCore::CompositeEditCommand::moveParagraphContentsToNewBlockIfNecessary): Renamed some variables for clarity.
+        Added a few comments.  Fixed bug by not bailing out when the block about to be used is the body element.
+        * editing/CompositeEditCommand.h:
+
+2008-11-14  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 22245: Move wtf/dtoa.h into the WTF namespace
+        <https://bugs.webkit.org/show_bug.cgi?id=22245>
+
+        Move wtf/dtoa.h into the WTF namespace from the JSC namespace.
+
+        * platform/text/String.cpp:
+        (WebCore::charactersToDouble):
+
+2008-11-14  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Rubber-stamped by Simon Hausmann.
+
+        Make sure Qt scrollbars follow the style with regard to context menus
+
+        * platform/qt/ScrollbarQt.cpp:
+        (WebCore::Scrollbar::contextMenu):
+
+2008-11-14  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Rubber-stamped by Simon Hausmann.
+
+        Make scrollbar look active when the window is active on Qt/Mac
+
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::styleOptionSlider):
+        (WebCore::ScrollbarThemeQt::paint):
+
+2008-11-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Add a basic Scons-based build system for building
+        Chromium-Mac WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=21991
+
+        The build currently fails due to missing files from our
+        platform directory (platform skia and platform chromium)
+        I will be sending those up shortly in separate patches.
+        I expect it will be a while before our WebCore build links.
+
+        * SConstruct: Added.
+        * WebCore.scons: Added.
+
+2008-11-13  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22248
+        AtomicString.cpp uses JSC types outside of #if USE(JSC)
+
+        * platform/text/AtomicString.cpp:
+        (WebCore::AtomicString::add):
+
+2008-11-13  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18620
+        Long hang under TextIterator::advance() when loading http://www.lsvd.de/
+
+        A huge section at the beginning of this document is invisible.  As we iterate through it,
+        we create VisiblePositions unnecessarily.
+
+        * editing/TextIterator.cpp:
+        (WebCore::TextIterator::shouldRepresentNodeOffsetZero): Don't proceed to VisiblePosition
+        creation if m_node is unrendered or invisible.  The answers wouldn't have much meaning
+        and would be wasteful.  Also fixed some comments to reflect the fact that this function
+        isn't specifically about emitting a newline.
+
+2008-11-13  Pierre-Olivier Latour  <pol@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove unused or unnecessary code from AnimationBase class.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::AnimationBase):
+        (WebCore::AnimationBase::playStatePlaying):
+        * page/animation/AnimationBase.h:
+
+2008-11-12  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Inital implementation of PluginPackage and PluginView for Mac NPAPI support in WebCore
+
+        Currently only used by QtWebKit. See also:
+
+        https://bugs.webkit.org/show_bug.cgi?id=21427
+
+        * WebCore.pro:
+        * platform/qt/TemporaryLinkStubs.cpp:
+        (PluginView::userAgentStatic):
+        (PluginView::getValueStatic):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::handleEvent):
+        (WebCore::PluginView::setValue):
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        (WebCore::PluginView::setPlatformPluginWidget):
+        * plugins/mac/PluginPackageMac.cpp: Added.
+        (WebCore::PluginPackage::determineQuirks):
+        (WebCore::readPListFile):
+        (WebCore::stringListFromResourceId):
+        (WebCore::PluginPackage::fetchInfo):
+        (WebCore::PluginPackage::load):
+        (WebCore::PluginPackage::hash):
+        (WebCore::PluginPackage::equal):
+        (WebCore::PluginPackage::compareFileVersion):
+        * plugins/mac/PluginViewMac.cpp: Added.
+        (WebCore::nativeWindowFor):
+        (WebCore::cgHandleFor):
+        (WebCore::topLevelOffsetFor):
+        (WebCore::PluginView::init):
+        (WebCore::PluginView::~PluginView):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::setParent):
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
+        (WebCore::PluginView::setFocus):
+        (WebCore::PluginView::setParentVisible):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::invalidateRegion):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::nullEventTimerFired):
+        (WebCore::modifiersForEvent):
+        (WebCore::PluginView::globalMousePosForPlugin):
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::userAgent):
+        (WebCore::PluginView::userAgentStatic):
+        (WebCore::PluginView::handlePostReadFile):
+
+2008-11-12  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22200
+        Crash when close event is dispatched to MessagePort due to document destruction
+
+        Test: fast/events/message-port-onclose.html
+
+        * dom/MessagePort.cpp: (WebCore::MessagePort::contextDestroyed):
+        Don't dispatch close event, even though HTML5 currently says that we should. It is not
+        right for GC to have observable effects.
+
+2008-11-12  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22203
+        Implement Worker messaging
+
+        No test cases included, because this functionality is disabled by default.
+
+        The implementation is known to still have many race condition, but works quite well for
+        testing.
+
+        * WebCore.xcodeproj/project.pbxproj: Added WorkerTask.{h,cpp}.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markActiveObjectsForContext): Re-worded comments a little.
+        (WebCore::markCrossHeapDependentObjectsForContext): Existing cross-heap GC protocol was
+        incorrect, changed it to a much simpler (but still incorrect) version.
+
+        * dom/WorkerTask.cpp: Added.
+        (WebCore::WorkerTask::~WorkerTask):
+        * dom/WorkerTask.h: Added.
+        Tasks posted to workers implement this new interface.
+
+        * bindings/js/JSDedicatedWorkerCustom.cpp:
+        (WebCore::JSDedicatedWorker::mark):
+        (WebCore::JSDedicatedWorker::connect):
+        * dom/DedicatedWorker.h:
+        * dom/DedicatedWorker.idl:
+        Auto-generate event listener attributes. Renamed startConversation() to connect(), tracking
+        WHATWG discussions.
+
+        * dom/DedicatedWorker.cpp:
+        (WebCore::WorkerConnectTask::WorkerConnectTask): A task that performs worker-side connect()
+        operations.
+        (WebCore::DedicatedWorker::DedicatedWorker): Initialize WorkerThread pointer.
+        (WebCore::DedicatedWorker::connect): Connect() creates a pair of entangled ports, and posts
+        one to worker. Since message port registration in ScriptExecutionContext is not thread safe,
+        this port starts with a null context pointer.
+        (WebCore::DedicatedWorker::notifyFinished): Since Worker methods should work immediately
+        after creation, we have to queue tasks until after a WorkerThread object is created. Then we
+        forward all queued tasks to its queue.
+
+        * dom/EventTarget.cpp: (WebCore::EventTarget::toWorkerContext):
+        * dom/EventTarget.h:
+        * bindings/js/JSEventTarget.cpp: (WebCore::toJS):
+        Added cases for WorkerContext, which is now an EventTarget, too.
+
+        * bindings/js/JSWorkerContext.h: Added JSWorkerContext::put() to make onconnect settable.
+        * bindings/js/JSWorkerContext.cpp:
+        (WebCore::JSWorkerContext::mark): Mark event listeners.
+        (WebCore::JSWorkerContext::createPrototype): Fixed a typo, use the right StructureID.
+        (WebCore::JSWorkerContext::put): Implemented.
+        (WebCore::jsWorkerContextPrototypeFunctionAddEventListener): Added an EventTarget implementation.
+        (WebCore::jsWorkerContextPrototypeFunctionRemoveEventListener): Ditto.
+        (WebCore::jsWorkerContextPrototypeFunctionDispatchEvent): Ditto.
+        (WebCore::jsWorkerContextOnconnect): Added.
+        (WebCore::setJSWorkerContextOnconnect): Added.
+
+        * bindings/js/WorkerScriptController.cpp: (WebCore::WorkerScriptController::evaluate):
+        Made it actually work by adding necessary setup.
+
+        * bindings/js/WorkerScriptController.h: (WebCore::WorkerScriptController::initScriptIfNeeded):
+        Check the right variable - it is the wrapper that may not be initialized yet.
+
+        * dom/ActiveDOMObject.cpp:
+        (WebCore::ActiveDOMObject::ActiveDOMObject):
+        (WebCore::ActiveDOMObject::~ActiveDOMObject):
+        Assert being called from the correct thread, as active DOM object tracking is not thread safe.
+
+        * dom/ScriptExecutionContext.h: Added a Task interface and a postTask() method, to be used
+        for asynchronously executing tasks in context's thread.
+
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ProcessMessagesSoonTask): Changed from a Timer to a Task
+        (WebCore::ScriptExecutionContext::ScriptExecutionContext): Removed m_firedMessagePortTimer.
+        It was an optimization that couldn't be easily preserved without introducing race conditions
+        in multithreading case.
+        (WebCore::ScriptExecutionContext::processMessagePortMessagesSoon): Use postTask().
+        (WebCore::ScriptExecutionContext::dispatchMessagePortEvents): Added a comment explaining
+        why it's OK to not ref() ports in a frozen copy.
+        (WebCore::ScriptExecutionContext::createdMessagePort): Assert that we're not being called
+        from a wrong thread.
+        (WebCore::ScriptExecutionContext::destroyedMessagePort): Ditto.
+        (WebCore::ScriptExecutionContextTaskTimer): Part of
+        ScriptExecutionContext::Task implementation - use Timer if posting from main thread to main
+        thread.
+        (WebCore::ScriptExecutionContextTaskWorkerTask): Another part - use WorkerTask if posting
+        to a worker.
+        (WebCore::PerformTaskContext::PerformTaskContext): Finally, use callOnMainThread() if posting
+        to main thread from a secondary one.
+        (WebCore::performTask): A helper function for callOnMainThread().
+        (WebCore::ScriptExecutionContext::postTask): Use one of the above implementations.
+
+        * dom/MessagePort.h: Fixed message queue to keep EventData pointers - otherwise, we would
+        ref/deref EventData::message from different threads, which is not allowed.
+
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePortCloseEventTask): Use a task instead of a timer to work across threads.
+        (WebCore::MessagePort::EventData::create): Updated for EventData being refcountable now.
+        (WebCore::MessagePort::EventData::EventData): Ditto.
+        (WebCore::MessagePort::MessagePort): ScriptExecutionContext is now allowed to be null at
+        first, because we need to create ports for posting to other threads, and it is not possible
+        to register in a context from another thread.
+        (WebCore::MessagePort::clone): Always create ports with null contexts - it is now message
+        receiver's job to set the context.
+        (WebCore::MessagePort::postMessage): Enable posting to ports that are not attached to any
+        context yet.
+        (WebCore::MessagePort::startConversation): Ditto. Data port is always posted unattached.
+        (WebCore::MessagePort::contextDestroyed): Assert that we had a context.
+        (WebCore::MessagePort::attachToContext): Called when receiving a data port to register in
+        context.
+        (WebCore::MessagePort::scriptExecutionContext): Moved from header, as the function is virtual.
+        (WebCore::MessagePort::dispatchMessages): Attach data port to receiving context. Use postTask().
+        (WebCore::MessagePort::queueCloseEvent): Use postTask().
+        (WebCore::MessagePort::hasPendingActivity): Reworded comment a little. As mentioned above,
+        MessagePort cross-heap GC is still quite wrong.
+
+        * dom/WorkerContext.h: Made WorkerContext an event target, added onconnect attribute.
+        * dom/WorkerContext.cpp: Keep a pointer to WorkerThread. It is only used for debug assertions
+        now, but there is no harm in tracking it in release builds, too.
+
+        * dom/WorkerThread.cpp:
+        (WebCore::WorkerThread::create): WorkerThread is refcountable, construct with create().
+        (WebCore::WorkerThread::workerThread): Implemented a message loop.
+        * dom/WorkerThread.h:
+        (WebCore::WorkerThread::threadID): Also only used for assertions.
+        (WebCore::WorkerThread::messageQueue): Return a reference to queue, so clients can post to it.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::postMessage): MessagePort::clone() no longer takes a context, as it
+        always sets it to null.
+        (WebCore::DOMWindow::postMessageTimerFired): Attach data port to receiving context.
+
+2008-11-12  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed Darin Adler.
+
+        use strokeColor.alpha() instead of fillColor.alpha()
+        on GraphicsContext::strokePath()
+
+        [Canvas] Transparent fillStyle stops line rendering
+        https://bugs.webkit.org/show_bug.cgi?id=21888
+
+        Test: fast/canvas/canvas-stroke-empty-fill.html
+
+        * ChangeLog:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::strokePath):
+
+2008-11-12  Stephanie  <slewis@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix context leak in XSLStyleSheets.
+        See bug https://bugs.webkit.org/show_bug.cgi?id=15715
+
+        * xml/XSLStyleSheet.cpp:
+        (WebCore::XSLStyleSheet::parseString):
+
+2008-11-12  Alp Toker  <alp@nuanti.com>
+
+        autotools: List web worker-related headers needed for a successful
+        build. distcheck is passing again with this change.
+
+        * GNUmakefile.am:
+
+2008-11-12  Alp Toker  <alp@nuanti.com>
+
+        autotools build system fix-up only. Add FloatQuad.h to the source
+        lists and sort them.
+
+        * GNUmakefile.am:
+
+2008-11-12  Alp Toker  <alp@nuanti.com>
+
+        Build fixes for r38346. FloatQuad.cpp is missing:
+
+        1) #include "config.h"
+        2) #include <algorithm> for various mathematical definitions it uses.
+
+        * platform/graphics/FloatQuad.cpp:
+
+2008-11-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=22212
+
+        Rename absoluteOutlineBox() to absoluteOutlineBounds(), to indicate that
+        it may be the bounding outline box of a transformed element, and fix it
+        to respect transforms by mapping the outline box to an absolute quad and
+        taking the enclosing rect.
+
+        RenderBox::localToAbsoluteQuad() can no longer assert that there is no
+        LayoutState, but LayoutState cannot be used during quad mapping (it knows
+        nothing about transforms).
+
+        Finally, fix a bug in RenderBox::localToAbsoluteQuad() which was getting
+        borderTopExtra() from the object, rather than its container (as localToAbsolute()
+        does).
+
+        Test: fast/repaint/transform-absolute-child.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::localToAbsoluteQuad):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::layout):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::setHasVisibleContent):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::repaintAfterLayoutIfNeeded):
+        (WebCore::RenderObject::absoluteOutlineBounds):
+        * rendering/RenderObject.h:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::layout):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::layout):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::layout):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::layout):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::layout):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::layout):
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::layout):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+
+2008-11-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=21942
+        https://bugs.webkit.org/show_bug.cgi?id=18557
+
+        Add methods which can be used to map renderer-local rectangles
+        to quads in absolute coordinates, taking transforms into account:
+            localToAbsoluteQuad() converts a local rect into an absolute quad.
+            collectAbsoluteLineBoxQuads() is an analogue of addLineBoxRects()
+                that works with quads.
+            absoluteQuads() is an analogue of absoluteRects(), for quads.
+
+        Use the quad methods to fix the inspector highlight for transformed
+        elements.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * inspector/InspectorController.cpp:
+        (WebCore::drawOutlinedQuad):
+        (WebCore::drawHighlightForBoxes):
+        (WebCore::frameToMainFrameOffset):
+        (WebCore::InspectorController::drawNodeHighlight):
+        * platform/graphics/AffineTransform.cpp:
+        (WebCore::AffineTransform::mapQuad):
+        * platform/graphics/AffineTransform.h:
+        * platform/graphics/FloatQuad.cpp: Added.
+        (WebCore::min4):
+        (WebCore::max4):
+        (WebCore::FloatQuad::boundingBox):
+        * platform/graphics/FloatQuad.h: Added.
+        (WebCore::FloatQuad::FloatQuad):
+        (WebCore::FloatQuad::p1):
+        (WebCore::FloatQuad::p2):
+        (WebCore::FloatQuad::p3):
+        (WebCore::FloatQuad::p4):
+        (WebCore::FloatQuad::setP1):
+        (WebCore::FloatQuad::setP2):
+        (WebCore::FloatQuad::setP3):
+        (WebCore::FloatQuad::setP4):
+        (WebCore::FloatQuad::isEmpty):
+        (WebCore::FloatQuad::enclosingBoundingBox):
+        (WebCore::FloatQuad::move):
+        (WebCore::operator+=):
+        (WebCore::operator-=):
+        (WebCore::operator==):
+        (WebCore::operator!=):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::localToAbsoluteQuad):
+        * rendering/RenderBox.h:
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::collectAbsoluteLineBoxQuads):
+        * rendering/RenderContainer.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::absoluteQuads):
+        * rendering/RenderInline.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::absoluteBoundingBoxRect):
+        (WebCore::RenderObject::collectAbsoluteLineBoxQuads):
+        (WebCore::RenderObject::absoluteQuads):
+        (WebCore::RenderObject::localToAbsoluteQuad):
+        (WebCore::RenderObject::absoluteContentQuad):
+        * rendering/RenderObject.h:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::absoluteQuads):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::absoluteQuads):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGHiddenContainer.cpp:
+        (WebCore::RenderSVGHiddenContainer::absoluteQuads):
+        * rendering/RenderSVGHiddenContainer.h:
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::calculateAbsoluteBounds):
+        (WebCore::RenderSVGImage::absoluteQuads):
+        * rendering/RenderSVGImage.h:
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::absoluteQuads):
+        (WebCore::RenderSVGInlineText::computeAbsoluteRectForRange):
+        * rendering/RenderSVGInlineText.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::absoluteQuads):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGTSpan.cpp:
+        (WebCore::RenderSVGTSpan::absoluteRects):
+        (WebCore::RenderSVGTSpan::absoluteQuads):
+        * rendering/RenderSVGTSpan.h:
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::absoluteRects):
+        (WebCore::RenderSVGText::absoluteQuads):
+        * rendering/RenderSVGText.h:
+        * rendering/RenderSVGTextPath.cpp:
+        (WebCore::RenderSVGTextPath::absoluteRects):
+        (WebCore::RenderSVGTextPath::absoluteQuads):
+        * rendering/RenderSVGTextPath.h:
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::localToAbsolute):
+        (WebCore::RenderTableCell::localToAbsoluteQuad):
+        * rendering/RenderTableCell.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::absoluteQuads):
+        (WebCore::RenderText::collectAbsoluteLineBoxQuads):
+        * rendering/RenderText.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::localToAbsoluteQuad):
+        (WebCore::RenderView::absoluteQuads):
+        * rendering/RenderView.h:
+
+2008-11-12  Brent Fulgham <bfulgham@gmail.com>
+
+        Fix Bug 22178: Build errors in WebKit Cairo port
+
+        <https://bugs.webkit.org/show_bug.cgi?id=22178>
+
+        Reviewed by Mark Rowe.
+
+        * platform/graphics/cairo/PatternCairo.cpp: Correct build error under
+        Visual Studio.
+        (WebCore::Pattern::createPlatformPattern):
+
+2008-11-12  Adam Roben  <aroben@apple.com>
+
+        Fix a typo in the include path for the Release_Cairo configuration
+
+        * WebCore.vcproj/WebCore.vcproj: Fixed "caro" -> "cairo" typo.
+
+2008-11-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=17840
+        Patch 2
+
+        Code cleanup in RenderBox::computeAbsoluteRepaintRect().
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeAbsoluteRepaintRect):
+
+2008-11-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=17840
+
+        Fix repainting when the transform on a positioned element changes.
+        In computeAbsoluteRepaintRect(), add the offsets due to relative positioning,
+        and being in a positioned container after applying the transform to the local
+        rect.
+
+        Tests: fast/repaint/transform-absolute-in-positioned-container.html
+               fast/repaint/transform-relative-position.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeAbsoluteRepaintRect):
+
+2008-11-12  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        <rdar://problem/5495723> Selecting and deleting quoted text quotes other text
+        <rdar://problem/4775313> Deleting lines from the bottom of a messages leaves the last blank line quoted
+
+        We don't want to merge into a block if it will mean changing the quote level of content after deleting
+        selections that contain a whole number paragraphs plus a line break, since it is unclear to most users
+        that such a selection actually ends at the start of the next paragraph.  Instead we want to completely
+        remove the selected paragraph(s) and all evidence of the first one's quote level.  This matches TextEdit behavior
+        for indented paragraphs.
+
+        * editing/DeleteSelectionCommand.cpp:
+        (WebCore::DeleteSelectionCommand::initializePositionData): For the selections described above, do not
+        try to merge after the deletion.  Instead try and prune the start block or blocks if they've been emptied
+        so that we remove evidence of the deleted paragraphs' quote level.
+        (WebCore::DeleteSelectionCommand::mergeParagraphs): Try and prune the start block(s) if necessary.  Also
+        make sure that the caret is placed correctly so that it ends up on the same line that the deleted selection
+        started on, instead of one higher.
+        * editing/DeleteSelectionCommand.h:
+        * editing/htmlediting.cpp:
+        (WebCore::numEnclosingMailBlockquotes): Added.
+        * editing/htmlediting.h:
+
+2008-11-10  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Move _web_encodingForResource from WebKit into WebCore and change return type
+
+        This change is needed to implement NSAPI in WebCore for Mac, see:
+
+        https://bugs.webkit.org/show_bug.cgi?id=21427
+
+        * WebCore.base.exp:
+        * platform/mac/WebCoreNSStringExtras.h:
+        * platform/mac/WebCoreNSStringExtras.mm:
+        (stringEncodingForResource):
+
+2008-11-10  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Moved the implementation of _webkit_isCaseInsensitiveEqualToString to
+        WebCore's WebCoreNSStringExtras as _stringIsCaseInsensitiveEqualToString.
+
+        This change is needed to implement NSAPI in WebCore for Mac, see:
+
+        https://bugs.webkit.org/show_bug.cgi?id=21427
+
+        * WebCore.base.exp:
+        * platform/mac/WebCoreNSStringExtras.h:
+        * platform/mac/WebCoreNSStringExtras.mm:
+        (stringIsCaseInsensitiveEqualToString):
+
+2008-11-11  Stephanie  <slewis@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Null check image data before setting it as image source.
+
+        Test: fast/images/image-empty-data.html
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::destroyDecodedData):
+
+2008-11-11  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Remove ifdef so future OS versions can use the new delegate method.
+
+        * platform/network/mac/ResourceHandleMac.mm: (WebCore::ResourceHandle::didSendBodyDataDelegateExists):
+
+2008-11-11  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Antti Koivisto and Sam Weinig.
+
+        Clean up HTMLTokenizer a litle
+        https://bugs.webkit.org/show_bug.cgi?id=22188
+
+        Rename pendingScripts to m_pendingScripts
+        Rename scriptNode to m_scriptNode make the type specific
+        Rename pendingSrc to m_pendingSrc
+        Rename currentPrependingSrc to m_currentPrependingSrc
+        Rename noMoreData to m_noMoreData and cBuffer to m_cBuffer
+        Remove long-since-dead kdDebug and qDebug calls
+        Rename brokenComments to m_brokenComments
+        Remove HTMLTokenizer includes and document the rest
+        Rename src to m_src
+        Rename parser to m_parser and make it an OwnPtr
+        Rename inWrite to m_inWrite and jsProxy to scriptController
+        Rename brokenServer to m_brokenServer
+        Rename buffer to m_buffer and dest to m_dest
+        Rename size to m_bufferSize
+        Rename attrName to m_attrName
+        Rename searchStopper to m_searchStopper and searchStopperLen to m_searchStopperLen
+        Rename scriptCode* to m_scriptCode* and change scriptCodeMax to m_scriptCodeCapacity
+        Rename scriptStartLineno to m_currentScriptTagStartLineNumber and tagStartLineno to m_currentTagStartLineNumber
+        Rename scriptSrc to m_scriptTagSrcAttrValue and scriptSrcCharset to m_scriptTagCharsetAttrValue -- a bit unwieldy, but more precise
+        Rename flat to selfClosingTag
+        Rename currToken to m_currentToken
+
+        * css/CSSParser.cpp:
+        * dom/XMLTokenizer.cpp:
+        * dom/XMLTokenizerLibxml2.cpp:
+        * html/HTMLDocument.cpp:
+        * html/HTMLElement.cpp:
+        * html/HTMLFormControlElement.cpp:
+        * html/HTMLParser.h:
+        * html/HTMLTokenizer.cpp:
+        (WebCore::Token::addAttribute):
+        (WebCore::HTMLTokenizer::HTMLTokenizer):
+        (WebCore::HTMLTokenizer::reset):
+        (WebCore::HTMLTokenizer::begin):
+        (WebCore::HTMLTokenizer::processListing):
+        (WebCore::HTMLTokenizer::parseSpecial):
+        (WebCore::HTMLTokenizer::scriptHandler):
+        (WebCore::HTMLTokenizer::scriptExecution):
+        (WebCore::HTMLTokenizer::parseComment):
+        (WebCore::HTMLTokenizer::parseServer):
+        (WebCore::HTMLTokenizer::parseProcessingInstruction):
+        (WebCore::HTMLTokenizer::parseText):
+        (WebCore::HTMLTokenizer::parseEntity):
+        (WebCore::HTMLTokenizer::parseTag):
+        (WebCore::HTMLTokenizer::write):
+        (WebCore::HTMLTokenizer::processingData):
+        (WebCore::HTMLTokenizer::end):
+        (WebCore::HTMLTokenizer::finish):
+        (WebCore::HTMLTokenizer::processToken):
+        (WebCore::HTMLTokenizer::processDoctypeToken):
+        (WebCore::HTMLTokenizer::~HTMLTokenizer):
+        (WebCore::HTMLTokenizer::enlargeBuffer):
+        (WebCore::HTMLTokenizer::enlargeScriptBuffer):
+        (WebCore::HTMLTokenizer::notifyFinished):
+        (WebCore::HTMLTokenizer::setSrc):
+        * html/HTMLTokenizer.h:
+        (WebCore::Token::Token):
+        (WebCore::Token::reset):
+        (WebCore::HTMLTokenizer::processingContentWrittenByScript):
+        (WebCore::HTMLTokenizer::htmlParser):
+        (WebCore::HTMLTokenizer::checkBuffer):
+        (WebCore::HTMLTokenizer::checkScriptBuffer):
+        * html/HTMLViewSourceDocument.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::leftRelOffset):
+        (WebCore::RenderBlock::rightRelOffset):
+        (WebCore::RenderBlock::lineWidth):
+        * xml/XSLTProcessor.cpp:
+
+2008-11-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=22189
+        Track CachedScript decoded data
+
+        We now track the decoded size of CachedScripts in the Cache allowing
+        them to accounted for when deciding when to evict data.  The decoded
+        data itself can be evicted when Cache pressure gets high enough through
+        CachedScript::destroyDecodedData.
+
+        * loader/CachedResource.h:
+        (WebCore::CachedResource::allClientsRemoved):
+        (WebCore::CachedResource::destroyDecodedData):
+        * loader/CachedScript.cpp:
+        (WebCore::CachedScript::script):
+        (WebCore::CachedScript::data):
+        (WebCore::CachedScript::destroyDecodedData):
+        * loader/CachedScript.h:
+
+2008-11-11  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Remove pointless dependencies on the now-deleted kjs directory and
+        mentions of it in comments that are no longer relevant.
+
+        * WebCore.pro:
+        * webcore-base.bkl:
+
+2008-11-11  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adam Roben.
+
+        WebCore part of adding a master volume control for media elements in a WebView
+
+        * WebCore.base.exp: Exported WebCore::Page::setMediaVolume().
+        * dom/Document.cpp:
+        (WebCore::Document::mediaVolumeDidChange): Added. Called by the Page
+        when the media volume is changed.
+        (WebCore::Document::registerForMediaVolumeCallbacks): Added. Allows
+        elements to register for a callback when the media volume is changed.
+        (WebCore::Document::unregisterForMediaVolumeCallbacks): Added. Allows
+        elements to unregister for the callback.
+        * dom/Document.h:
+        * dom/Element.h:
+        (WebCore::Element::mediaVolumeDidChange): Added an empty implementation.
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Added a call to
+        registerForMediaVolumeCallbacks().
+        (WebCore::HTMLMediaElement::~HTMLMediaElement): Added a call to
+        unregisterForMediaVolumeCallbacks().
+        (WebCore::HTMLMediaElement::updateVolume): Changed to multiply the
+        element's intrinsic volume by the master volume from the page.
+        (WebCore::HTMLMediaElement::mediaVolumeDidChange): Added. Calls
+        updateVolume().
+        * html/HTMLMediaElement.h:
+        * page/Page.cpp:
+        (WebCore::Page::Page): Initialize m_mediaVolume to 1.
+        (WebCore::Page::setMediaVolume): Added. Calls mediaVolumeDidChange() on
+        every document in the page when the master volume changes.
+        * page/Page.h:
+        (WebCore::Page::mediaVolume): Added this getter.
+
+2008-11-11  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=22182
+
+        Fix problems with scrollbars when the OS setting for clicks in the track jumping the thumb to that location
+        is turned on.  Make sure to only jump the thumb if the click happens in the track.  Also fix some math
+        errors when jumping the thumb that cause dragging after the jump to incorrectly jump the thumb again.
+
+        Reviewed by Adele
+
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::mouseDown):
+
+2008-11-11  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/5089327> Too much indentation when pasting
+        quoted paragraphs
+
+        This patch re-addresses pasting blockquotes into blockquotes. It
+        backs out most of revision 38273. 38273 fixed the bug by inserting
+        the pasted content as a sibling blockquote node to the pre-existing
+        blockquote node. The problem with that is that by default,
+        blockquotes have a giant margin, so visually, this can be weird.
+        This patch instead inserts the pasted content as siblings of the
+        the content already inside the outer blockquote, and then removes
+        the blockquote node from the pasted content itself, so that it
+        doesn't nest itself into the outer blockquote.
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::doApply):
+
+        Move contains() from Element to Node since there is nothing
+        Element-specific about it.
+        * dom/Element.cpp:
+        * dom/Element.h:
+        * dom/Node.cpp:
+        (WebCore::Node::contains):
+        * dom/Node.h:
+
+2008-11-11  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=17997
+
+        Stop using the new Leopard API tiling call for scaled tiles when drawing background images.  The method
+        is buggy.  Fall back to using the slower (and more correct) pattern tiling that Tiger still uses.  This
+        is a Leopard-only workaround, since the API has been fixed on Snow Leopard.
+
+        Reviewed by John Sullivan
+
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::Image::drawPattern):
+
+2008-11-10  David Hyatt  <hyatt@apple.com>
+
+        Disable the Aqua look for menu lists when full page zoom is turned on.  Because the control is buggy
+        when scaling and because it's impossible to paint into an offscreen bitmap without completely rewriting
+        how we draw the control on Mac, our only real option for now is to just switch to our styled look when zoomed.
+
+        Reviewed by Adam Roben
+
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::isControlStyled):
+
+2008-11-11  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=22160
+        speculative fix for <rdar://problem/5995450> Nil deref because nextLinePosition
+        (previousLinePosition, too) uses a nil node
+
+        * editing/visible_units.cpp:
+        (WebCore::nextLinePosition): Use RenderObject::node instead of RenderObject::element
+        to check editingIgnoresContent. It makes sense to use the associated DOM node for
+        this, even in cases of anonymous content, and it avoids the case where element() can
+        be 0.
+        (WebCore::previousLinePosition): Ditto.
+
+2008-11-11  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by Darin Adler.
+
+        Removed default: in applySpreadMethod. This causes the problems
+        in radial gradients. We don't need CAIRO_EXTEND_NONE in SVG, Canvas
+        or CSS.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::applySpreadMethod):
+
+2008-11-11  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix crash when rendering the file chooser.
+        Also proper implementation for multi-selected files.
+
+        * platform/qt/FileChooserQt.cpp:
+        (WebCore::FileChooser::basenameForWidth):
+
+2008-11-11  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by Oliver Hunt.
+
+        PatternCairo needs to invert the pattern matrix because
+        of transformation from user space to pattern space.
+        Give a identity matrix to pattern for Qt and Cairo. Because the
+        context is transformed already.
+
+        [CAIRO][QT] Canvas transformations applied twice to Patterns
+        https://bugs.webkit.org/show_bug.cgi?id=21555
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        * platform/graphics/cairo/PatternCairo.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+
+2008-11-10  Stephanie Lewis  <slewis@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Clear the image source cache even if we haven't decoded any of the image data.
+        We use the image source cache when calculating layout.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::pruneDeadResources):
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::destroyDecodedData):
+
+2008-11-10  Adam Roben  <aroben@apple.com>
+
+        Fix Bug 22161: Assertion failure in RenderThemeWin::systemColor when
+        loading microsoftpdc.com
+
+        <https://bugs.webkit.org/show_bug.cgi?id=22161>
+
+        Reviewed by Dan Bernstein.
+
+        Test: fast/css/outline-invert-assertion.html
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::systemColor): If we can't determine a good
+        Win32 system color to use, defer to RenderTheme instead of asserting.
+        This matches what RenderThemeMac does.
+
+2008-11-10  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        <rdar://problem/4037481> REGRESSION (Mail): pasting quoted text
+        into quoted text yields double-quoting
+
+        Don't nest inserted content in Mail blockquotes.  Perform a
+        BreakBlockquoteCommand if we're in
+        one and insert the incoming fragment between the split blockquotes.
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::shouldMerge): Renamed from ->
+        source and to -> destination.
+        (WebCore::ReplaceSelectionCommand::doApply):
+
+2008-11-10  Adam Roben  <aroben@apple.com>
+
+        Fix Bug 22158: Would like to turn on WebCore logging channels via an
+        environment variable
+
+        <https://bugs.webkit.org/show_bug.cgi?id=22158>
+
+        Logging channels can now be enabled by setting the WebCoreLogLevel
+        environment variable to a hexadecimal number.
+
+        Reviewed by Anders Carlsson.
+
+        * WebCore.vcproj/WebCore.vcproj: Added LoggingWin.cpp.
+        * platform/win/LoggingWin.cpp: Copied from WebCore/platform/mac/LoggingMac.mm.
+        (WebCore::initializeWithUserDefault): Read in the WebCoreLogLevel
+        environment variable, parse its value as a hexadecimal number, and
+        turn the channel on/off based on whether the mask bit is set.
+        (WebCore::InitializeLoggingChannelsIfNecessary): Initialize each
+        logging channel in turn.
+
+2008-11-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=22103
+          Changing fonts in preferences does not immediately update WebViews
+
+        This broke when the meaning of FrameView::invalidate changed.
+        I changed setNeedsReapplyStyles to no longer depend on invalidate.
+
+        * dom/Document.cpp: (WebCore::Document::shouldScheduleLayout):
+        Removed the part of this function that duplicated what's already in
+        FrameView::needsLayout, since the copy here left out a few key things.
+        For example, it didn't handle the fact that "needs reapply styles"
+        counts as needing layout.
+
+        * page/Frame.cpp: (WebCore::Frame::setNeedsReapplyStyles): This called
+        FrameView::invalidate before. There were two things wrong with that.
+        1) It requested that the entire view repaint even if the style change
+        didn't necessitate that. 2) FrameView::invalidate no longer causes any
+        repainting at all in certain cases, because of Hyatt's changes to how
+        widgets and the host window are involved in the repainting process.
+        So call FrameView::scheduleRelayout instead, which is more precisely
+        what we want and need here.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scheduleRelayout): Add a call to needsLayout here
+        so that Document::shouldScheduleLayout doesn't have to replicate the
+        logic that's in needsLayout and can instead rely on the fact that it
+        was already called.
+        (WebCore::FrameView::needsLayout): Tweaked the comments and formatting
+        in this function.
+
+2008-11-10  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        - speculative fix for <rdar://problem/5557243> crashes in Safari at
+          WebCore::HTMLSelectElement::updateListBoxSelection + 280
+
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::updateListBoxSelection):
+        Check index against size of vector before indexing into the vector.
+
+2008-11-10  Tom Cooksey  <thomas.cooksey@trolltech.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Fix QtWebkit build failure on arm.
+
+        pen.widthF() is a qreal, which means it's a float on arm.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::setLineDash):
+
+2008-11-10  Morten Sørvig  <msorvig@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Improve mouse wheel scolling on Qt/Cocoa.
+        Cocoa differs from Carbon (and other platforms I think) in that the
+        mouse wheel events we get have a much higher acceleration factor.
+
+        This submit switches over to scroll-per-pixel from scroll-per-line
+        for most of our scrolling views. This matches the native views
+        and works well with the increased acceleration.
+
+        * platform/qt/WheelEventQt.cpp:
+
+2008-11-09  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 19541: Null pointer in showModalDialog()
+        <https://bugs.webkit.org/show_bug.cgi?id=19541>
+
+        Add null frame->page() checks to JSDOMWindowBase::canShowModalDialog()
+        and JSDOMWindowBase::canShowModalDialogNow()C
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::canShowModalDialog):
+        (WebCore::canShowModalDialogNow):
+
+2008-11-09  Darin Adler  <darin@apple.com>
+
+        - try to fix Windows build
+
+        * platform/graphics/Color.cpp: For some reason MSVC doesn't follow the rules
+        about needed a separate definition for static const integer data members.
+        Until I get to the bottom of this, put the definitions inside an ifdef.
+
+2008-11-09  David Kilzer  <ddkilzer@apple.com>
+
+        BUILD FIX: Qt build broke after r38235.
+
+        Added HAVE(ACCESSIBILITY) header guards to platform implementation
+        source files.
+
+        * page/gtk/AccessibilityObjectAtk.cpp: Added HAVE(ACCESSIBILITY)
+        guards.
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp: Ditto.
+        * page/qt/AccessibilityObjectQt.cpp: Ditto.
+        * page/win/AccessibilityObjectWin.cpp: Ditto.
+        * page/wx/AccessibilityObjectWx.cpp: Ditto.
+
+2008-11-09  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22104
+        Javascript URL percent encoding/decoding broken by some characters
+
+        Test: fast/loader/javascript-url-encoding-2.html
+
+        * platform/KURL.cpp: (WebCore::encodeRelativeString): Don't try to break down javascript URLs.
+
+2008-11-09  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed and tweaked by Darin Adler.
+
+        * platform/graphics/Color.cpp: Added definitions for the static data members
+        in this class. Static data members need a definition, even when they are the
+        simple integer constant kind that can be initialized in the header.
+
+2008-11-08  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=22141
+        REGRESSION: Safari error page is not fully styled when loaded from cache
+
+        Reset text decoder on flush so it does not pass through the BOM when it is reused.
+
+        Test: fast/encoding/css-cached-bom.html
+
+        * loader/TextResourceDecoder.cpp:
+        (WebCore::TextResourceDecoder::flush):
+
+2008-11-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Mark Rowe.
+
+        Send URL errors to stderr rather than stdout. While debugging wx DumpRenderTree,
+        it was causing these errors to end up in the page's text representation.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::downloadTimerCallback):
+
+2008-11-08  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes after addition of JSCore parser and bycompiler dirs.
+
+        * webcore-base.bkl:
+        * webcore-wx.bkl:
+
+2008-11-08  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=21906
+
+        Override addFocusRingRects() in RenderTextControl to avoid
+        the RenderFlow behavior of recursing on descendent renderers.
+        RenderTextControl should only ever need a simple focus rect.
+
+        This fixes focus ring issues with transforms on text controls.
+
+        Test: fast/transforms/transformed-focused-text-input.html
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::addFocusRingRects):
+        * rendering/RenderTextControl.h:
+
+2008-11-08  Dimitri Dupuis-Latour  <dupuislatour@apple.com>
+
+        Make sure the icon thumbnail width/height is at least 1px in
+        the Web Inspector's resource panel.
+
+        <rdar://problem/5988888>
+
+        Reviewed by Tim Hatcher.
+
+        * inspector/front-end/inspector.css:
+
+2008-11-08  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 22137: PLATFORM(MAC) build broken with HAVE(ACCESSIBILITY) disabled
+
+        <https://bugs.webkit.org/show_bug.cgi?id=22137>
+
+        Reviewed by Darin Adler.
+
+        * page/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::accessibilityIgnoreAttachment):
+        Provide a default implementation when HAVE(ACCESSIBILITY) is false.
+        * page/mac/AXObjectCacheMac.mm: Added HAVE(ACCESSIBILITY) guard.
+        * page/mac/AccessibilityObjectMac.mm: Ditto.
+        * page/mac/AccessibilityObjectWrapper.mm: Ditto.
+
+2008-11-08  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - WebCore part of adding WebPreferences for controlling databases and local storage
+
+        * WebCore.base.exp: Exported Settings::setDatabasesEnabled() and
+        Settings::setLocalStorageEnabled().
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::localStorage): Changed to return 0 if local storage
+        is disabled in settings.
+        (WebCore::DOMWindow::openDatabase): Changed to return 0 if databases
+        are disabled in settings.
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Initialize m_databasesEnabled and
+        m_localStorageEnabled.
+        (WebCore::Settings::setDatabasesEnabled): Added.
+        (WebCore::Settings::setLocalStorageEnabled): Added.
+        * page/Settings.h:
+        (WebCore::Settings::databasesEnabled): Added.
+        (WebCore::Settings::localStorageEnabled): Added.
+
+2008-11-07  Alp Toker  <alp@nuanti.com>
+
+        Fix build with bleeding edge GTK+ versions. GTK+ and other libraries
+        now require that only their top-level header file is included.
+
+        Patch tested and still builds fine with older GTK+ versions (back to
+        2.8).
+
+        Future WebKit GTK+ contributions are required to adhere to this
+        policy.
+
+        * platform/gtk/FileSystemGtk.cpp:
+        * platform/gtk/KeyEventGtk.cpp:
+        * platform/gtk/MouseEventGtk.cpp:
+        * platform/gtk/WheelEventGtk.cpp:
+        * platform/gtk/gtkdrawing.h:
+        * plugins/gtk/gtk2xtbin.c:
+        * plugins/gtk/gtk2xtbin.h:
+
+2008-11-07  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Kevin Decker
+
+        Explicitly initialize the NPDrawingModelCoreAnimation.
+
+        * bridge/npapi.h:
+
+2008-11-07  Alp Toker  <alp@nuanti.com>
+
+        autotools fix. Always use the configured perl binary (which may be
+        different to the one in $PATH) when generating sources.
+
+        * GNUmakefile.am:
+
+2008-11-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        https://bugs.webkit.org/show_bug.cgi?id=22122
+
+        Use a stack-based object to simplify the pushLayoutState/popLayoutState
+        code. LayoutStateMaintainer either pushes in the constructor, or allows
+        an explicit push() later. Both cases require an explicit pop().
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::layoutOnlyPositionedObjects):
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::layout):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::layout):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::layout):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::setCellWidths):
+        (WebCore::RenderTableSection::calcRowHeight):
+        (WebCore::RenderTableSection::layoutRows):
+        * rendering/RenderView.h:
+        (WebCore::LayoutStateMaintainer::LayoutStateMaintainer):
+        (WebCore::LayoutStateMaintainer::~LayoutStateMaintainer):
+        (WebCore::LayoutStateMaintainer::pop):
+        (WebCore::LayoutStateMaintainer::push):
+        (WebCore::LayoutStateMaintainer::didPush):
+
+2008-11-07  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Fix the QtWebKit build on Mac
+
+        * platform/qt/TemporaryLinkStubs.cpp:
+        (PluginView::invalidateRect):
+
+2008-11-07  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Rubber-stamped by Simon Hausmann.
+
+        Don't allow Phonon's invisible video widget to keep the app running
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+
+2008-11-07  Henrik Hartz  <henrik.hartz@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Fix valgrind warning about uninitialized lastStop variable.
+
+        * platform/graphics/qt/GradientQt.cpp:
+        (WebCore::Gradient::platformGradient):
+
+2008-11-07  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Fix layout test brokenness following r38211.
+
+        * page/EventHandler.cpp: (WebCore::EventHandler::handleAccessKey):
+        Restore old Shift key behavior. We ignore Shift key state when matching access keys (which
+        matches neither IE nor Firefox), and this patch made WebKit behave like Firefox
+        inadvertently. This may or may not be a good thing, but it's certainly not something that
+        should change by accident.
+
+2008-11-06  Antti Koivisto  <antti@apple.com>
+
+        Eh, this trivial last minute change was wrong.
+
+        * loader/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::sheetText):
+
+2008-11-06  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22093
+
+        Delaying the text decoding caused regression since the decoding
+        also determines the encoding in case of @charset rule.
+
+        Decode immediately in data() and keep the decoded string around
+        during the checkNotify().
+
+        * loader/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::sheetText):
+        (WebCore::CachedCSSStyleSheet::data):
+        * loader/CachedCSSStyleSheet.h:
+
+2008-11-06  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22097
+        Expose MessageEvent constructor on WorkerContext
+
+        * bindings/js/JSWorkerContext.cpp:
+        (WebCore::jsWorkerContextMessageEvent):
+        (WebCore::setJSWorkerContextMessageEvent):
+
+2008-11-06  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21107
+        <rdar://problem/6264219> New access key combination conflicts with VoiceOver
+
+        * page/EventHandler.h:
+        * page/gtk/EventHandlerGtk.cpp:
+        (WebCore::EventHandler::accessKeyModifiers):
+        * page/qt/EventHandlerQt.cpp:
+        (WebCore::EventHandler::accessKeyModifiers):
+        * page/win/EventHandlerWin.cpp:
+        (WebCore::EventHandler::accessKeyModifiers):
+        * page/wx/EventHandlerWx.cpp:
+        (WebCore::EventHandler::accessKeyModifiers):
+        Access access key modifiers via a function, not a static variable.
+
+        * page/mac/EventHandlerMac.mm: (WebCore::EventHandler::accessKeyModifiers):
+        Use Ctrl when VoiceOver is enabled, because a conflict with Emacs-style key bindings is
+        less troublesome than one with VO keys.
+
+        * page/EventHandler.cpp: (WebCore::EventHandler::handleAccessKey):
+        Also fix an access key matching bug introduced in r32424 - Any superset of specified
+        modifier set invoked access keys. We can use simple equality comparison instead because
+        CapsLock is not part of modifiers(), so it doesn't need to be ignored explicitly.
+
+2008-11-06  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22115
+        NPN_HasPropertyUPP and NPN_HasMethodUPP entries in NPNetscapeFuncs are NULL
+
+        Export _NPN_HasMethod and _NPN_HasProperty.
+
+        * WebCore.NPAPI.exp:
+
+2008-11-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Antti Koivisto
+
+        https://bugs.webkit.org/show_bug.cgi?id=15678
+
+        Fix transformed menu selects to show the popup in the correct
+        location.
+
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::showPopup):
+
+2008-11-06  David Kilzer  <ddkilzer@apple.com>
+
+        BUILD FIX: Backed out r38189 (and r38203) for Xcode 3.0.
+
+        Apparently older versions of gcc have issues with this patch.
+        Backing out a second time until the issues are resolved.
+
+2008-11-06  Julien Chaffraix  <jchaffraix@pleyo.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21106: .in format discussed changes
+        https://bugs.webkit.org/show_bug.cgi?id=21106
+
+        Include the namespace into the interfaceName.
+
+        * dom/make_names.pl: Do not append the namespace when
+        using the interfaceName.
+        * html/HTMLTagNames.in: Added namespace prefix for custom
+        interfaceName.
+        * svg/svgtags.in: Ditto.
+
+2008-11-06  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Move the remaining files in the kjs subdirectory of JavaScriptCore to
+        a new parser subdirectory, and remove the kjs subdirectory entirely.
+
+        * ForwardingHeaders/kjs: Removed.
+        * ForwardingHeaders/kjs/Parser.h: Removed.
+        * ForwardingHeaders/kjs/SavedBuiltins.h: Removed.
+        * ForwardingHeaders/kjs/SourceCode.h: Removed.
+        * ForwardingHeaders/kjs/SourceProvider.h: Removed.
+        * ForwardingHeaders/parser: Added.
+        * ForwardingHeaders/parser/Parser.h: Copied from ForwardingHeaders/kjs/Parser.h.
+        * ForwardingHeaders/parser/SourceCode.h: Copied from ForwardingHeaders/kjs/SourceCode.h.
+        * ForwardingHeaders/parser/SourceProvider.h: Copied from ForwardingHeaders/kjs/SourceProvider.h.
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/StringSourceProvider.h:
+        * bindings/js/WorkerScriptController.cpp:
+        * bridge/NP_jsobject.cpp:
+        * bridge/jni/jni_jsobject.mm:
+        * bridge/testbindings.pro:
+        * inspector/JavaScriptDebugServer.cpp:
+
+2008-11-06  David Kilzer  <ddkilzer@apple.com>
+
+        BUILD WAS NOT BROKEN: Rolling r38189 back in.
+
+        Please perform a clean build if you see crashes.
+
+2008-11-06  David Kilzer  <ddkilzer@apple.com>
+
+        BUILD FIX: Backed out r38189 since it apparently broke the world.
+
+2008-11-06  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Bug 22112: if a <body> has contenteditable=true, it should report a writable AXValue
+        https://bugs.webkit.org/show_bug.cgi?id=22112
+
+        Test: accessibility/content-editable.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isReadOnly):
+
+2008-11-06  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Alice Liu.
+
+        Fix failed assert at launch caused by unintialized data member on the mac.
+
+        * platform/network/mac/NetworkStateNotifierMac.cpp:
+        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+
+2008-11-06  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix failed assert at launch caused by unintialized data member.
+
+        Reviewed by Maciej Stachowiak.
+
+        * platform/network/win/NetworkStateNotifierWin.cpp:
+        (WebCore::NetworkStateNotifier::NetworkStateNotifier):
+
+2008-11-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Antti Koivisto
+
+        https://bugs.webkit.org/show_bug.cgi?id=22109
+        Make <input type="range"> work correctly with transforms
+
+        Test: fast/forms/slider-transformed.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+            Compute a correct local point when the event is retargeted
+        * rendering/RenderSlider.cpp:
+        (WebCore::HTMLSliderThumbElement::defaultEventHandler):
+            Compute m_initialClickPoint in slider-local coords, so that
+            deltas are computed correctly with transforms
+        (WebCore::RenderSlider::mouseEventIsInThumb):
+            Rather than computing an absolute bounds for the thumb,
+            convert the point to local coords and compare it with the border box.
+
+2008-11-06  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 21810: Remove use of static C++ objects that are destroyed at exit time (destructors)
+        https://bugs.webkit.org/show_bug.cgi?id=21810
+
+        * bindings/js/GCController.cpp:
+        (WebCore::gcController): Changed to leak an object to avoid an exit-time destructor.
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::wrapperSet): Ditto
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::wrappers): Ditto
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::wrappers): Ditto
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::rootObjectSet): Ditto
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::removeProperty): Ditto
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::cssText): Ditto
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType): Ditto
+        * css/CSSStyleSelector.cpp:
+        (WebCore::screenEval): Ditto
+        (WebCore::printEval): Ditto
+        * dom/DOMImplementation.cpp:
+        (WebCore::isSVG10Feature): Ditto
+        (WebCore::isSVG11Feature): Ditto
+        (WebCore::DOMImplementation::isXMLMIMEType): Ditto
+        * dom/Document.cpp:
+        (WebCore::Document::hasPrefixNamespaceMismatch): Ditto
+        * dom/ScriptElement.cpp:
+        (WebCore::isSupportedJavaScriptLanguage): Ditto
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::styleSpanClassString): Ditto
+        * editing/HTMLInterchange.cpp:
+        (WebCore::): Ditto
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::indentBlockquoteString): Ditto
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::isInterchangeNewlineNode): Ditto
+        (WebCore::isInterchangeConvertedSpaceSpan): Ditto
+        * editing/htmlediting.cpp:
+        (WebCore::stringWithRebalancedWhitespace): Ditto
+        (WebCore::nonBreakingSpaceString): Ditto
+        * editing/markup.cpp:
+        (WebCore::appendAttributeValue): Ditto
+        (WebCore::appendEscapedContent): Ditto
+        (WebCore::shouldAddNamespaceAttr): Ditto
+        (WebCore::appendNamespace): Ditto
+        (WebCore::appendStartMarkup): Ditto
+        (WebCore::createMarkup): Ditto
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::type): Ditto
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::isRecognizedTagName): Ditto
+        (WebCore::inlineTagList): Ditto
+        (WebCore::blockTagList): Ditto
+        * html/HTMLFieldSetElement.cpp:
+        (WebCore::HTMLFieldSetElement::type): Ditto
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::type): Ditto
+        * html/HTMLKeygenElement.cpp:
+        (WebCore::HTMLKeygenElement::type): Ditto
+        * html/HTMLLegendElement.cpp:
+        (WebCore::HTMLLegendElement::type): Ditto
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::type): Ditto
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::type): Ditto
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::getNode): Ditto
+        (WebCore::HTMLParser::isHeaderTag): Ditto
+        (WebCore::HTMLParser::isResidualStyleTag): Ditto
+        (WebCore::HTMLParser::isAffectedByResidualStyle): Ditto
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::type): Ditto
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::type): Ditto
+        * inspector/InspectorController.cpp:
+        (WebCore::platform): Ditto
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::shared): Ditto
+        * inspector/JavaScriptProfile.cpp:
+        (WebCore::profileCache): Ditto
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::profileNodeCache): Ditto
+        * loader/FrameLoader.cpp:
+        (WebCore::localSchemes): Ditto
+        * loader/appcache/ApplicationCacheStorage.cpp:
+        (WebCore::cacheStorage): Ditto
+        * loader/archive/ArchiveFactory.cpp:
+        (WebCore::archiveMIMETypes): Ditto
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::defaultDatabaseFilename): Ditto
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dragState): Ditto
+        * page/Frame.cpp:
+        (WebCore::createRegExpForLabels): Ditto
+        (WebCore::keepAliveSet): Ditto
+        * page/Page.cpp:
+        (WebCore::Page::groupName): Ditto
+        * page/SecurityOrigin.cpp:
+        (WebCore::isDefaultPortForProtocol): Ditto
+        (WebCore::SecurityOrigin::databaseIdentifier): Ditto
+        * page/mac/FrameMac.mm:
+        (WebCore::regExpForLabels): Ditto
+        * platform/KURL.cpp:
+        (WebCore::blankURL): Ditto
+        * platform/graphics/FontCache.cpp:
+        (WebCore::alternateFamilyName): Ditto
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore::FontCache::getSimilarFontPlatformData): Ditto
+        (WebCore::FontCache::getLastResortFallbackFont): Ditto
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarTheme::nativeTheme): Ditto
+        * platform/mac/ThemeMac.mm:
+        (WebCore::platformTheme): Ditto
+        * platform/mac/ThreadCheck.mm:
+        (WebCoreReportThreadViolation): Ditto
+        * platform/network/NetworkStateNotifier.cpp:
+        (WebCore::networkStateNotifier): Ditto
+        * platform/network/mac/FormDataStreamMac.mm:
+        (WebCore::getStreamFormDataMap): Ditto
+        (WebCore::getStreamResourceHandleMap): Ditto
+        * platform/network/mac/ResourceResponseMac.mm:
+        (WebCore::ResourceResponse::platformLazyInit): Ditto
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::isJapanese): Ditto
+        * rendering/RenderBlock.cpp:
+        (WebCore::continuationOutlineTable): Ditto
+        * rendering/RenderCounter.cpp:
+        (WebCore::counterMaps): Ditto
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutVerticalBox): Ditto
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::markerText): Ditto
+        * rendering/RenderScrollbarTheme.cpp:
+        (WebCore::RenderScrollbarTheme::renderScrollbarTheme): Ditto
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::systemFont): Ditto
+        * rendering/bidi.cpp:
+        (WebCore::RenderBlock::checkLinesForTextOverflow): Ditto
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::initialDashboardRegions): Ditto
+        (WebCore::RenderStyle::noneDashboardRegions): Ditto
+        * storage/LocalStorage.cpp:
+        (WebCore::localStorageMap): Ditto
+        * svg/SVGAnimateMotionElement.cpp:
+        (WebCore::SVGAnimateMotionElement::rotateMode): Ditto
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::calcMode): Ditto
+        (WebCore::SVGAnimationElement::attributeType): Ditto
+        (WebCore::SVGAnimationElement::isAdditive): Ditto
+        (WebCore::SVGAnimationElement::isAccumulated): Ditto
+        * svg/SVGLangSpace.cpp:
+        (WebCore::SVGLangSpace::xmlspace): Ditto
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::contentScriptType): Ditto
+        (WebCore::SVGSVGElement::contentStyleType): Ditto
+        * svg/SVGStyleElement.cpp:
+        (WebCore::SVGStyleElement::type): Ditto
+        (WebCore::SVGStyleElement::media): Ditto
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::parseMappedAttribute): Ditto
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::parseClockValue): Ditto
+        (WebCore::SVGSMILElement::restart): Ditto
+        (WebCore::SVGSMILElement::fill): Ditto
+        (WebCore::SVGSMILElement::repeatCount): Ditto
+        (WebCore::SVGSMILElement::notifyDependentsIntervalChanged): Ditto
+        * svg/graphics/SVGResource.cpp:
+        (WebCore::clientMap): Ditto
+        * svg/graphics/SVGResourceMarker.cpp:
+        (WebCore::SVGResourceMarker::draw): Ditto
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::preflightResultCache): Ditto
+        (WebCore::isSafeRequestHeader): Ditto
+        (WebCore::isOnAccessControlResponseHeaderWhitelist): Ditto
+        * xml/XPathExpressionNode.cpp:
+        (WebCore::XPath::Expression::evaluationContext): Ditto
+        * xml/XPathParser.cpp:
+        (WebCore::XPath::isAxisName): Ditto
+        (WebCore::XPath::isNodeTypeName): Ditto
+        * xml/XPathValue.cpp:
+        (WebCore::XPath::Value::toNodeSet): Ditto
+
+2008-11-06  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Rubber-stamped by Simon Hausmann.
+
+        Remove a bunch of unused methods in the Qt media element implementation
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
+
+2008-11-05  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=21870
+
+        Implement absoluteToLocal() to convert a point from absolute
+        to local coordinates, optionally taking transforms into account.
+
+        Use this to set offsetX/offsetY in mouse events, thus fixing
+        offsetX/offsetY in events on elements with transforms.
+
+        Test: fast/events/offsetX-offsetY.html
+
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::MouseRelatedEvent::receivedTarget):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::localToAbsolute):
+        (WebCore::RenderBox::absoluteToLocal):
+        (WebCore::RenderBox::offsetFromContainer):
+        * rendering/RenderBox.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::absoluteToLocal):
+        * rendering/RenderObject.h:
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::localToAbsolute):
+        (WebCore::RenderTableCell::absoluteToLocal):
+        * rendering/RenderTableCell.h:
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::absoluteToLocal):
+        * rendering/RenderView.h:
+
+2008-11-06  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Cameron Zwarich.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22067
+        [GTK] Sun Java plugin segfaults at PluginPackage::createPackage()
+
+        null-check symbols loaded from plugin modules, initialize the function
+        table (like Win already does) and update it with the latest
+        additions. Adjust whitespace for easy diff'ing with the Win port code
+        from which it was forked.
+
+        This fixes crashes with libnspr4.so and any other plugins that don't
+        provide the symbols we expect.
+
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+        (WebCore::PluginPackage::load):
+
+2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Removed dead (and broken) code from an ancient Symbian port.
+
+        * config.h:
+        * platform/text/AtomicString.h:
+        * platform/text/PlatformString.h:
+
+2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Use QLibrary as PlatformModule when compiling with Qt for S60.
+
+        * platform/FileSystem.h:
+
+2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Compile fix for Symbian.
+        The snprintf function is defined in stdio.h, the inclusion
+        of snprintf.h inside this PLATFORM(SYMBIAN) block does not
+        compile.
+
+        * config.h:
+
+2008-11-06  Kristian Amlie  <kristian.amlie@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Disable webkit plugins for Symbian.
+
+        * WebCore.pro:
+
+2008-11-06  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Fix build break in debug mode when XSLT is not enabled
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::dumpStats):
+
+2008-11-06  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon Hausmann.
+
+        Repaint video on UpdateRequest to prevent recursive painting
+
+        Calling QWidget::render() to update the video generates a paint
+        event that's then picked up by the event filter once more :(
+
+        We're really only interested in updates from Phonon, which we
+        get through the UpdateRequest for each new frame.
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::eventFilter):
+
+2008-11-06  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Fix the WebCore build for some platforms by changing build scripts to
+        account for the recent move of the create_hash_table script from the kjs
+        subdirectory of JavaScriptCore to the root directory.
+
+        * WebCore.pro:
+        * make-generated-sources.sh:
+
+2008-11-06  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Fix a case-sensitivity issue in Mac forwarding headers. Strangely
+        enough, this does not always cause the build to break, even with a
+        case-sensitive filesystem.
+
+        * ForwardingHeaders/runtime/Interpreter.h:
+
+2008-11-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22083
+        MessageEvents cannot be used across threads
+
+        * dom/Event.idl:
+        * dom/MessageEvent.idl:
+        Add a NoStaticTables attribute - MessageEvent is used in worker threads, so static tables
+        won't work.
+
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::EventData::EventData):
+        (WebCore::MessagePort::EventData::~EventData):
+        (WebCore::MessagePort::clone):
+        (WebCore::MessagePort::postMessage):
+        (WebCore::MessagePort::startConversation):
+        (WebCore::MessagePort::dispatchMessages):
+        * dom/MessagePort.h:
+        Don't create a MessageEvent until dispatch time - messages can be posted across threads,
+        but MessageEvents are tied to the thread that they were created in.
+
+2008-11-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22066
+        Implement Worker global object
+
+        * DerivedSources.make: Added WorkerLocation IDL and JSWorkerContext lookup table.
+
+        * WebCore.xcodeproj/project.pbxproj: Only adding files to Mac project for now, as Worker
+        support is still disabled by default.
+
+        * bindings/js/JSDOMGlobalObject.cpp: (WebCore::toJSDOMGlobalObject): Implemented Worker case.
+
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor): Ditto.
+
+        * bindings/js/JSWorkerContext.cpp: Added.
+        * bindings/js/JSWorkerContext.h: Added.
+        * bindings/js/WorkerScriptController.cpp: Added.
+        * bindings/js/WorkerScriptController.h: Added.
+        * dom/WorkerContext.cpp: Added.
+        * dom/WorkerContext.h: Added.
+        Added an implementation of worker contexts.
+
+        * dom/DedicatedWorker.cpp:
+        (WebCore::DedicatedWorker::startLoad): Fixed a lifetime bug I saw on my tests.
+        (WebCore::DedicatedWorker::notifyFinished): Create a thread. Currently, object ownership
+        and lifetime is not clear at all.
+
+        * dom/WorkerLocation.cpp: Added.
+        * dom/WorkerLocation.h: Added.
+        * dom/WorkerLocation.idl: Added.
+        Added WorkerLocation, which is one of the objects available to workers.
+
+        * dom/WorkerThread.cpp: Added.
+        (WebCore::WorkerThread::WorkerThread):
+        (WebCore::WorkerThread::start):
+        (WebCore::WorkerThread::workerThreadStart):
+        (WebCore::WorkerThread::workerThread):
+        * dom/WorkerThread.h: Added.
+        (WebCore::WorkerThread::create):
+        Run some code in a worker thread (no message loop yet).
+
+2008-11-05  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22093
+        Don't keep decoded stylesheet data in cache
+
+        <rdar://problem/6343588>
+
+        Don't keep decoded stylesheet string around in the cache. There are no sharing benefits and
+        performance benefits are negligible (no measured PLT impact). Reduces memory consumption of
+        style sheet data in cache by 2/3 in common case.
+
+        * loader/CachedCSSStyleSheet.cpp:
+        (WebCore::CachedCSSStyleSheet::sheetText):
+        (WebCore::CachedCSSStyleSheet::data):
+        * loader/CachedCSSStyleSheet.h:
+
+2008-11-05  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 21596: WebCore::Cache should use parsed Pragma and Cache-Control headers
+
+        <https://bugs.webkit.org/show_bug.cgi?id=21596>
+
+        Reviewed by Antti.
+
+        This patch adds real parsing for Pragma and Cache-Control headers
+        based on RFC 2616, Sections 2, 14.9 and 14.32.  It also adds some
+        new String and StringImpl methods to assist with the parsing.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::dumpStats): Added.  Convenience method for dumping
+        stats outside of Safari.
+        * loader/Cache.h: Declared dumpStats().
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::mustRevalidate): Updated to use
+        ResourceResponseBase::cacheControlDirectives() instead of substring
+        matching of the entire Cache-Control header.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::didReceiveResponse): Used the local
+        'resource' variable instead of 'request->cachedResource()'.
+
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::setHTTPHeaderField): Set
+        m_haveParsedCacheControlHeader to false when a "Cache-Control"
+        header is set.  Ditto for m_haveParsedPragmaHeader and "Pragma".
+        (WebCore::ResourceResponseBase::parsePragmaDirectives): Added.
+        Provides parsed Pragma header directives.
+        (WebCore::ResourceResponseBase::parseCacheControlDirectives): Added.
+        Provides parsed Cache-Control header directives.
+        (WebCore::isCacheHeaderSeparator): Added.  Returns true if a
+        character is a separator character per RFC 2616, Section 2.2, else
+        returns false.
+        (WebCore::isControlCharacter): Added.  Returns true if a character
+        is a control character per RFC 2616 Section 2.2, else returns false.
+        (WebCore::trimToNextSeparator): Added.  Returns a string truncated
+        at the first separator character per isCacheHeaderSeparator().
+        (WebCore::parseCacheHeader): Added.  This is the main parsing
+        routine for both Cache-Control and Pragma headers.
+        (WebCore::parseCacheControlDirectiveValues): Added.  This splits
+        certain Cache-Control directive values into a vector of strings.
+        * platform/network/ResourceResponseBase.h:
+        (WebCore::CacheControlDirectiveMap): Added.  Typedef for a parsed
+        Cache-Control header.
+        (WebCore::PragmaDirectiveMap): Added.  Typedef for a parsed Pragma
+        header.
+        (WebCore::ResourceResponseBase::parsePragmaDirectives): Added
+        declaration.
+        (WebCore::ResourceResponseBase::parseCacheControlDirectives): Ditto.
+        (WebCore::ResourceResponseBase::m_haveParsedCacheControlHeader):
+        Added.  Boolean to describe when the "Cache-Control" header needs to
+        be reparsed.
+        (WebCore::ResourceResponseBase::m_haveParsedPragmaHeader):  Added.
+        Boolean to describe when the "Pragma" header needs to be reparsed.
+        (WebCore::ResourceResponseBase::m_cacheControlDirectiveMap): Added.
+        Cached map to hold parsed "Cache-Control" headers.
+        (WebCore::ResourceResponseBase::m_pragmaDirectiveMap): Added.
+        Cached map to hold parsed "Pragma" headers.
+
+        * platform/text/PlatformString.h:
+        (WebCore::String::find): Added.  Returns the first match based on
+        the character-matching function pointer passed in.
+        (WebCore::String::removeCharacters): Added declaration.
+        (WebCore::find): Added.  Inline method that takes a character-
+        matching function pointer.  Called by StringImpl::find().
+        * platform/text/String.cpp:
+        (WebCore::String::removeCharacters): Added.  Calls
+        StringImpl::removeCharacters().
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::removeCharacters): Added.  Returns a string
+        with all characters removed that match the character-matching
+        function pointer passed in.  If there is no change to the string, it
+        returns itself.  Based heavily on StringImpl::simplifyWhitespace().
+        (WebCore::StringImpl::find): Added.  Calls WebCore::find().
+        * platform/text/StringImpl.h:
+        (WebCore::FindMatchFunctionPtr): Added.  Typedef for a character-
+        matching function pointer.
+        (WebCore::StringImpl::removeCharacters): Added declaration.
+        (WebCore::StringImpl::find): Ditto.
+
+2008-11-05  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        <rdar://problem/5480736> In Mail and Gmail, copied indented text pastes with line break
+
+        As a rule, we don't allow merges out of blockquotes.  In the bug, we are inserting a text node
+        between two blockquotes.  Because the start merge moves the text node into a blockquote, when we
+        determine whether or not we should do the end merge, it incorrectly appears as though the end merge
+        is merging out of a blockquote.  The fix is to determine whether or not we should do the end merge
+        before we do the start merge, so that the start merge doesn't effect our decision.
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplaceSelectionCommand::ReplaceSelectionCommand): Initialize the new boolean.
+        (WebCore::ReplaceSelectionCommand::mergeEndIfNeeded): Moved code from doApply() here for clarity.
+        (WebCore::ReplaceSelectionCommand::doApply): Set m_shouldMergeEnd before we do the start merge.
+        * editing/ReplaceSelectionCommand.h: Added m_shouldMergeEnd.
+
+2008-11-05  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Speculatively fix the Windows build, even though these changes may not
+        actually matter for anything in the build, because the Windows bots are
+        behind.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2008-11-05  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Fix the Qt build.
+
+        * bridge/qt/qt_class.cpp:
+        * bridge/qt/qt_runtime.h:
+
+2008-11-05  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Move more files to the runtime subdirectory of JavaScriptCore.
+
+        * ForwardingHeaders/kjs/collector.h: Removed.
+        * ForwardingHeaders/kjs/completion.h: Removed.
+        * ForwardingHeaders/kjs/identifier.h: Removed.
+        * ForwardingHeaders/kjs/interpreter.h: Removed.
+        * ForwardingHeaders/kjs/lookup.h: Removed.
+        * ForwardingHeaders/kjs/operations.h: Removed.
+        * ForwardingHeaders/kjs/protect.h: Removed.
+        * ForwardingHeaders/kjs/ustring.h: Removed.
+        * ForwardingHeaders/runtime/Collector.h: Copied from ForwardingHeaders/kjs/collector.h.
+        * ForwardingHeaders/runtime/Completion.h: Copied from ForwardingHeaders/kjs/completion.h.
+        * ForwardingHeaders/runtime/Identifier.h: Copied from ForwardingHeaders/kjs/identifier.h.
+        * ForwardingHeaders/runtime/Interpreter.h: Copied from ForwardingHeaders/kjs/interpreter.h.
+        * ForwardingHeaders/runtime/Lookup.h: Copied from ForwardingHeaders/kjs/lookup.h.
+        * ForwardingHeaders/runtime/Operations.h: Copied from ForwardingHeaders/kjs/operations.h.
+        * ForwardingHeaders/runtime/Protect.h: Copied from ForwardingHeaders/kjs/protect.h.
+        * ForwardingHeaders/runtime/UString.h: Copied from ForwardingHeaders/kjs/ustring.h.
+        * bindings/js/GCController.cpp:
+        * bindings/js/JSCustomPositionCallback.h:
+        * bindings/js/JSCustomPositionErrorCallback.h:
+        * bindings/js/JSCustomSQLStatementCallback.h:
+        * bindings/js/JSCustomSQLStatementErrorCallback.h:
+        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
+        * bindings/js/JSCustomVoidCallback.h:
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSEventListener.h:
+        * bindings/js/ScheduledAction.h:
+        * bindings/js/ScriptController.cpp:
+        * bindings/js/ScriptController.h:
+        * bindings/objc/WebScriptObject.mm:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/NP_jsobject.cpp:
+        * bridge/c/c_class.cpp:
+        * bridge/jni/jni_class.cpp:
+        * bridge/jni/jni_jsobject.mm:
+        * bridge/npruntime.cpp:
+        * bridge/runtime_root.h:
+        * history/CachedPage.h:
+        * html/CanvasRenderingContext2D.cpp:
+        * html/HTMLCanvasElement.cpp:
+        * inspector/InspectorController.cpp:
+        * inspector/JavaScriptCallFrame.cpp:
+        * page/Console.cpp:
+        * page/Page.cpp:
+        * platform/text/AtomicString.cpp:
+        * platform/text/PlatformString.h:
+
+2008-11-05  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=22085
+        The Plugin JS object should expose item() and namedItem() methods to match Firefox
+
+        * bindings/js/JSPluginCustom.cpp:
+        (WebCore::JSPlugin::nameGetter):
+        * plugins/Plugin.cpp:
+        (WebCore::Plugin::namedItem):
+        * plugins/Plugin.h:
+        * plugins/Plugin.idl:
+
+2008-11-05  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21060
+        Range#surroundContents incorrectly throws BAD_BOUNDARYPOINTS_ERR
+
+        Test: fast/dom/Range/surroundContents-check-boundary-points.html
+
+        * dom/Range.cpp: (WebCore::Range::surroundContents): Fix BAD_BOUNDARYPOINTS_ERR checks.
+
+2008-11-05  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Remove two global destructors from CoreTextController.
+
+        * platform/graphics/mac/CoreTextController.cpp:
+        (WebCore::CoreTextController::collectCoreTextRunsForCharacters):
+
+2008-11-05  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        CRASH at Scrollbar::invalidateRect due to null m_client
+        https://bugs.webkit.org/show_bug.cgi?id=22080
+
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::isWindowActive):
+        (WebCore::Scrollbar::invalidateRect):
+
+2008-11-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=21648
+        navigator.mimeTypes and navigator.plugins don't expose item and namedItem to JS
+
+        - Also adds constructors for Plugin, PluginArray, MimeType and MimeTypeArray.
+
+        * bindings/js/JSMimeTypeArrayCustom.cpp:
+        (WebCore::JSMimeTypeArray::nameGetter):
+        * bindings/js/JSPluginArrayCustom.cpp:
+        (WebCore::JSPluginArray::nameGetter):
+        * page/DOMWindow.idl:
+        * plugins/MimeType.idl:
+        * plugins/MimeTypeArray.cpp:
+        (WebCore::MimeTypeArray::namedItem):
+        * plugins/MimeTypeArray.h:
+        * plugins/MimeTypeArray.idl:
+        * plugins/Plugin.idl:
+        * plugins/PluginArray.cpp:
+        (WebCore::PluginArray::namedItem):
+        * plugins/PluginArray.h:
+        * plugins/PluginArray.idl:
+
+2008-11-05  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+
+        * plugins/PluginPackage.cpp:
+
+2008-11-05  Jeff Cook  <cookiecaper@gmail.com>
+
+        Reviewed by Simon Hausmann and Tor Arne.
+
+        Fix crash in the Qt port when unloading swfdec and Flash 10
+        by reordering window destruction and plugin stop.
+
+        See https://bugs.webkit.org/show_bug.cgi?id=20779
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::stop):
+
+2008-11-05  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø
+
+        Fix loading of Flash 10 in the Qt port by faking the toolkit to be Gtk.
+
+        Otherwise Flash refuses to load and function :(
+
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::determineQuirks):
+        * plugins/PluginQuirkSet.h:
+        (WebCore::):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::getValue):
+
+2008-11-05  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Tor Arne Vestbø
+
+        Unify determineQuirks between the Qt and the Gtk PluginPackage.
+        Share the code for parsing the module version from the description.
+        This is currently used to determine Flash based quirks.
+
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::createPackage):
+        (WebCore::PluginPackage::determineQuirks):
+        (WebCore::PluginPackage::determineModuleVersionFromDescription):
+        * plugins/PluginPackage.h:
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+
+2008-11-04  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Move kjs/dtoa.h to the wtf subdirectory of JavaScriptCore.
+
+        * ForwardingHeaders/kjs/dtoa.h: Removed.
+        * ForwardingHeaders/wtf/dtoa.h: Copied from ForwardingHeaders/kjs/dtoa.h.
+        * css/CSSParser.cpp:
+        * platform/text/String.cpp:
+        * platform/text/StringImpl.cpp:
+
+2008-11-04  Jonathan Haas  <myrdred@gmail.com>
+
+        Addiitonal tweaks and patch prep by Pamela Greene <pam@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fixed an issue which could cause memory corruption using ToT libxml.
+        See https://bugs.webkit.org/show_bug.cgi?id=15715
+
+        Test: fast/xsl/xslt-nested-stylesheets.xml
+
+        * xml/XSLImportRule.cpp:
+        (WebCore::XSLImportRule::setXSLStyleSheet): Set parent rather than owner document
+        * xml/XSLStyleSheet.cpp:
+        (WebCore::XSLStyleSheet::XSLStyleSheet): Initialize m_parentStyleSheet
+        (WebCore::XSLStyleSheet::parseString): Make all child stylesheets use parent's dictionary
+        (WebCore::XSLStyleSheet::setParentStyleSheet): Added
+        * xml/XSLStyleSheet.h: Added m_parentStyleSheet member
+
+2008-11-04  Simon Fraser  <simon.fraser@apple.com>
+
+        No review.
+
+        Improved buid fix: include MathExtras.h to get roundf on all platforms.
+
+        * platform/graphics/FloatPoint.h:
+
+2008-11-04  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by John Sullivan
+
+        Add a simple "visited" method to HistoryItem for use by global history
+
+        * WebCore.base.exp:
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::visited):  Update the title on the item, set last visited time,
+          and bump the visit count.  All things that should happen when a url is visited again!
+        * history/HistoryItem.h:
+
+2008-11-04  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Build fix. Not reviewed.
+
+        * platform/graphics/FloatPoint.h: include math.h.
+        reported by zdobersek in #webkit.
+
+2008-11-04  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Anders Carlsson.
+
+        No need to clobber all ResourceRequest fields in FrameLoader::reload()
+        https://bugs.webkit.org/show_bug.cgi?id=21949
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::reload):
+
+2008-11-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        * storage/Database.cpp:
+        (WebCore::databaseVersionKey): Tweaked formatting.
+
+2008-11-03  Darin Adler  <darin@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=22061
+          create script to check for exit-time destructors
+
+        * WebCore.xcodeproj/project.pbxproj: Added a script
+        phase that runs the check-for-exit-time-destructors script.
+
+        * html/HTMLAttributeNames.in: Removed some unused attribute names.
+
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::parseMappedAttribute): Removed code that
+        sets the write-only m_pluginPage.
+        * html/HTMLEmbedElement.h: Ditto.
+
+        * platform/mac/CursorMac.mm:
+        (WebCore::leakNamedCursor): Changed to return a Cursor&.
+        (WebCore::pointerCursor): Changed to leak an object to avoid an
+        exit-time destructor.
+        (WebCore::crossCursor): Ditto.
+        (WebCore::handCursor): Ditto.
+        (WebCore::moveCursor): Ditto.
+        (WebCore::verticalTextCursor): Ditto.
+        (WebCore::cellCursor): Ditto.
+        (WebCore::contextMenuCursor): Ditto.
+        (WebCore::aliasCursor): Ditto.
+        (WebCore::zoomInCursor): Ditto.
+        (WebCore::zoomOutCursor): Ditto.
+        (WebCore::copyCursor): Ditto.
+        (WebCore::noneCursor): Ditto.
+        (WebCore::progressCursor): Ditto.
+        (WebCore::noDropCursor): Ditto.
+        (WebCore::notAllowedCursor): Ditto.
+        (WebCore::iBeamCursor): Ditto.
+        (WebCore::waitCursor): Ditto.
+        (WebCore::helpCursor): Ditto.
+        (WebCore::eastResizeCursor): Ditto.
+        (WebCore::northResizeCursor): Ditto.
+        (WebCore::northEastResizeCursor): Ditto.
+        (WebCore::northWestResizeCursor): Ditto.
+        (WebCore::southResizeCursor): Ditto.
+        (WebCore::southEastResizeCursor): Ditto.
+        (WebCore::southWestResizeCursor): Ditto.
+        (WebCore::westResizeCursor): Ditto.
+        (WebCore::northSouthResizeCursor): Ditto.
+        (WebCore::eastWestResizeCursor): Ditto.
+        (WebCore::northEastSouthWestResizeCursor): Ditto.
+        (WebCore::northWestSouthEastResizeCursor): Ditto.
+        (WebCore::columnResizeCursor): Ditto.
+        (WebCore::rowResizeCursor): Ditto.
+        (WebCore::grabCursor): Ditto.
+        (WebCore::grabbingCursor): Ditto.
+
+        * storage/Database.cpp:
+        (WebCore::guidMutex): Changed to leak an object to avoid an
+        exit-time destructor. Also added a comment explaining why it's
+        thread safe.
+        (WebCore::guidToVersionMap): Ditto.
+        (WebCore::guidToDatabaseMap): Ditto.
+        (WebCore::Database::databaseInfoTableName): Ditto.
+        (WebCore::databaseVersionKey): Ditto.
+        (WebCore::Database::getVersionFromDatabase): Ditto.
+        (WebCore::Database::setVersionInDatabase): Ditto.
+        (WebCore::guidForOriginAndName): Ditto.
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::tracker): Ditto.
+        (WebCore::notificationMutex): Ditto.
+        (WebCore::notificationQueue): Ditto.
+        (WebCore::DatabaseTracker::notifyDatabasesChanged): Ditto.
+
+2008-11-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=21941
+
+        Rename absolutePosition() to localToAbsolute(), and add the ability
+        to optionally take transforms into account (which will eventually be the
+        default behavior).
+
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::getUpperLeftCorner):
+        (WebCore::ContainerNode::getLowerRightCorner):
+        (WebCore::ContainerNode::getRect):
+        * dom/ContainerNode.h:
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::MouseRelatedEvent::receivedTarget):
+        * dom/Node.cpp:
+        (WebCore::Node::getRect):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::layout):
+        (WebCore::SelectionController::caretRect):
+        * editing/visible_units.cpp:
+        (WebCore::previousLinePosition):
+        (WebCore::nextLinePosition):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::isKeyboardFocusable):
+        (WebCore::HTMLAnchorElement::defaultEventHandler):
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::getRect):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::x):
+        (WebCore::HTMLImageElement::y):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        * html/HTMLInputElement.h:
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::boundingBoxRect):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleDrag):
+        * platform/graphics/FloatPoint.h:
+        (WebCore::roundedIntPoint):
+        * platform/graphics/IntSize.h:
+        (WebCore::IntSize::expand):
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::paintObject):
+        (WebCore::RenderBlock::selectionGapRects):
+        (WebCore::RenderBlock::fillBlockSelectionGaps):
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::positionForCoordinates):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::localToAbsolute):
+        (WebCore::RenderBox::computeAbsoluteRepaintRect):
+        (WebCore::RenderBox::caretRect):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::relativePositionOffset):
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::addLineBoxRects):
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::absoluteClippedOverflowRect):
+        (WebCore::RenderFlow::caretRect):
+        (WebCore::RenderFlow::addFocusRingRects):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPosition):
+        (WebCore::RenderLayer::convertToLayerCoords):
+        (WebCore::RenderLayer::addScrolledContentOffset):
+        (WebCore::RenderLayer::subtractScrolledContentOffset):
+        (WebCore::RenderLayer::scrollRectToVisible):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::scrolledContentOffset):
+        (WebCore::RenderLayer::relativePositionOffset):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::panScroll):
+        (WebCore::RenderListBox::scrollToward):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::selectionRect):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::absoluteBoundingBoxRect):
+        (WebCore::RenderObject::computeAbsoluteRepaintRect):
+        (WebCore::RenderObject::localToAbsolute):
+        (WebCore::RenderObject::addDashboardRegions):
+        (WebCore::RenderObject::absoluteContentBox):
+        (WebCore::RenderObject::absoluteOutlineBox):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::localToAbsoluteForContent):
+        * rendering/RenderPart.cpp:
+        (WebCore::RenderPart::updateWidgetPosition):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::selectionRect):
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::computeAbsoluteRectForRange):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::absoluteRects):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::localToAbsolute):
+        * rendering/RenderTableCell.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::addLineBoxRects):
+        (WebCore::RenderText::caretRect):
+        (WebCore::RenderText::selectionRect):
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::updatePlayer):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::localToAbsolute):
+        * rendering/RenderView.h:
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::updateWidgetPosition):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::getScreenCTM):
+
+2008-11-03  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Add methods for getting and setting user data on History Item.
+        This change is limited to QT port only. Tests were added in
+        the patch for https://bugs.webkit.org/show_bug.cgi?id=21864.
+
+        Minor change by Simon: made the functions inline and added a missing
+        const.
+
+        * history/HistoryItem.h:
+
+2008-11-01  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22030
+        Make EventNames usable from multiple threads
+
+        * platform/text/AtomicString.cpp:
+        (WebCore::stringTable):
+        (WebCore::AtomicString::add):
+        (WebCore::AtomicString::remove):
+        (WebCore::AtomicString::find):
+        (WebCore::AtomicString::init):
+        * platform/text/AtomicString.h:
+        Atomic string table is now per-thread. Individual strings cannot be shared between threads,
+        so global AtomicString constants cannot be used from threads other than the main one.
+
+        * dom/EventNames.cpp:
+        (WebCore::EventNames::EventNames):
+        (WebCore::eventNames):
+        (WebCore::EventNames::init):
+        * dom/EventNames.h:
+        Made EventNames a ThreadSpecific struct. Individual event names are now accessed as
+        eventNames().fooEvent, not EventNames::fooEvent. This makes EventNames usable from all
+        threads.
+
+        * WebCore.base.exp:
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSEventListener.cpp:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        * dom/BeforeTextInsertedEvent.cpp:
+        (WebCore::BeforeTextInsertedEvent::BeforeTextInsertedEvent):
+        * dom/BeforeUnloadEvent.cpp:
+        (WebCore::BeforeUnloadEvent::BeforeUnloadEvent):
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::dispatchModifiedEvent):
+        * dom/ContainerNode.cpp:
+        (WebCore::dispatchChildInsertionEvents):
+        (WebCore::dispatchChildRemovalEvents):
+        * dom/DedicatedWorker.cpp:
+        (WebCore::DedicatedWorker::dispatchErrorEvent):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::setFocusedNode):
+        (WebCore::Document::addListenerTypeIfNeeded):
+        (WebCore::Document::removeWindowInlineEventListenerForType):
+        (WebCore::Document::addWindowEventListener):
+        (WebCore::Document::removeWindowEventListener):
+        (WebCore::Document::finishedParsing):
+        * dom/EventTargetNode.cpp:
+        (WebCore::EventTargetNode::dispatchGenericEvent):
+        (WebCore::EventTargetNode::dispatchSubtreeModifiedEvent):
+        (WebCore::EventTargetNode::dispatchWindowEvent):
+        (WebCore::EventTargetNode::dispatchUIEvent):
+        (WebCore::EventTargetNode::dispatchSimulatedClick):
+        (WebCore::EventTargetNode::dispatchMouseEvent):
+        (WebCore::EventTargetNode::dispatchFocusEvent):
+        (WebCore::EventTargetNode::dispatchBlurEvent):
+        (WebCore::EventTargetNode::defaultEventHandler):
+        (WebCore::EventTargetNode::on*): (multiple methods)
+        (WebCore::EventTargetNode::setOn*): (multiple methods)
+        * dom/KeyboardEvent.cpp:
+        (WebCore::eventTypeForKeyboardEventType):
+        (WebCore::KeyboardEvent::keyCode):
+        (WebCore::KeyboardEvent::charCode):
+        * dom/MessageEvent.cpp:
+        (WebCore::MessageEvent::MessageEvent):
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::dispatchMessages):
+        (WebCore::MessagePort::dispatchCloseEvent):
+        * dom/MouseEvent.cpp:
+        (WebCore::MouseEvent::isDragEvent):
+        (WebCore::MouseEvent::toElement):
+        (WebCore::MouseEvent::fromElement):
+        * dom/OverflowEvent.cpp:
+        (WebCore::OverflowEvent::OverflowEvent):
+        * dom/TextEvent.cpp:
+        (WebCore::TextEvent::TextEvent):
+        * dom/WebKitAnimationEvent.cpp:
+        (WebCore::WebKitAnimationEvent::WebKitAnimationEvent):
+        (WebCore::WebKitAnimationEvent::~WebKitAnimationEvent):
+        (WebCore::WebKitAnimationEvent::initWebKitAnimationEvent):
+        (WebCore::WebKitAnimationEvent::animationName):
+        (WebCore::WebKitAnimationEvent::elapsedTime):
+        * dom/WebKitTransitionEvent.cpp:
+        (WebCore::WebKitTransitionEvent::WebKitTransitionEvent):
+        (WebCore::WebKitTransitionEvent::~WebKitTransitionEvent):
+        (WebCore::WebKitTransitionEvent::initWebKitTransitionEvent):
+        (WebCore::WebKitTransitionEvent::propertyName):
+        (WebCore::WebKitTransitionEvent::elapsedTime):
+        * dom/WheelEvent.cpp:
+        (WebCore::WheelEvent::WheelEvent):
+        (WebCore::WheelEvent::initWheelEvent):
+        * dom/XMLTokenizerLibxml2.cpp:
+        * dom/XMLTokenizerQt.cpp:
+        * editing/DeleteButton.cpp:
+        (WebCore::DeleteButton::defaultEventHandler):
+        * editing/EditCommand.cpp:
+        * editing/Editor.cpp:
+        (WebCore::Editor::canDHTMLCut):
+        (WebCore::Editor::canDHTMLCopy):
+        (WebCore::Editor::canDHTMLPaste):
+        (WebCore::Editor::tryDHTMLCopy):
+        (WebCore::Editor::tryDHTMLCut):
+        (WebCore::Editor::tryDHTMLPaste):
+        (WebCore::dispatchEditableContentChangedEvents):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::setFocused):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::defaultEventHandler):
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::parseMappedAttribute):
+        (WebCore::HTMLButtonElement::defaultEventHandler):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::onChange):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::handleLocalEvents):
+        (WebCore::HTMLFormElement::prepareSubmit):
+        (WebCore::HTMLFormElement::reset):
+        (WebCore::HTMLFormElement::parseMappedAttribute):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::parseMappedAttribute):
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::dispatchLoadEvent):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        (WebCore::HTMLInputElement::preDispatchEventHandler):
+        (WebCore::HTMLInputElement::postDispatchEventHandler):
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        (WebCore::HTMLInputElement::onSearch):
+        * html/HTMLLabelElement.cpp:
+        (WebCore::HTMLLabelElement::defaultEventHandler):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::load):
+        (WebCore::HTMLMediaElement::mediaPlayerNetworkStateChanged):
+        (WebCore::HTMLMediaElement::setReadyState):
+        (WebCore::HTMLMediaElement::progressEventTimerFired):
+        (WebCore::HTMLMediaElement::seek):
+        (WebCore::HTMLMediaElement::setDefaultPlaybackRate):
+        (WebCore::HTMLMediaElement::setPlaybackRate):
+        (WebCore::HTMLMediaElement::play):
+        (WebCore::HTMLMediaElement::pause):
+        (WebCore::HTMLMediaElement::setVolume):
+        (WebCore::HTMLMediaElement::setMuted):
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged):
+        (WebCore::HTMLMediaElement::documentWillBecomeInactive):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parseMappedAttribute):
+        * html/HTMLOptionElement.cpp:
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::parseMappedAttribute):
+        (WebCore::HTMLScriptElement::dispatchLoadEvent):
+        (WebCore::HTMLScriptElement::dispatchErrorEvent):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::parseMappedAttribute):
+        (WebCore::HTMLSelectElement::defaultEventHandler):
+        (WebCore::HTMLSelectElement::menuListDefaultEventHandler):
+        (WebCore::HTMLSelectElement::listBoxDefaultEventHandler):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        (WebCore::HTMLTextAreaElement::defaultEventHandler):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::notifyFinished):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::canCachePage):
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageEventListener::handleEvent):
+        * loader/ImageLoader.cpp:
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocument::defaultEventHandler):
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::callCheckingListener):
+        (WebCore::DOMApplicationCache::callErrorListener):
+        (WebCore::DOMApplicationCache::callNoUpdateListener):
+        (WebCore::DOMApplicationCache::callDownloadingListener):
+        (WebCore::DOMApplicationCache::callProgressListener):
+        (WebCore::DOMApplicationCache::callUpdateReadyListener):
+        (WebCore::DOMApplicationCache::callCachedListener):
+        * page/AccessibilityObject.cpp:
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::mouseButtonListener):
+        * page/ContextMenuController.cpp:
+        (WebCore::ContextMenuController::handleContextMenuEvent):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::on*): (multiple methods)
+        (WebCore::DOMWindow::setOn*): (multiple methods)
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseDoubleClickEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+        (WebCore::EventHandler::updateDragAndDrop):
+        (WebCore::EventHandler::cancelDragAndDrop):
+        (WebCore::EventHandler::performDragAndDrop):
+        (WebCore::EventHandler::updateMouseEventTargetNode):
+        (WebCore::EventHandler::dispatchMouseEvent):
+        (WebCore::EventHandler::sendContextMenuEvent):
+        (WebCore::EventHandler::canMouseDownStartSelect):
+        (WebCore::EventHandler::canMouseDragExtendSelect):
+        (WebCore::EventHandler::defaultKeyboardEventHandler):
+        (WebCore::EventHandler::dragSourceMovedTo):
+        (WebCore::EventHandler::dragSourceEndedAt):
+        (WebCore::EventHandler::handleDrag):
+        (WebCore::EventHandler::handleTextInputEvent):
+        * page/FocusController.cpp:
+        * page/Frame.cpp:
+        (WebCore::Frame::sendResizeEvent):
+        (WebCore::Frame::sendScrollEvent):
+        * page/Page.cpp:
+        (WebCore::networkStateChanged):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+        (WebCore::AnimationBase::animationTimerCallbackFired):
+        (WebCore::AnimationBase::primeEventTimers):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::onAnimationEnd):
+        (WebCore::ImplicitAnimation::sendTransitionEvent):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::onAnimationStart):
+        (WebCore::KeyframeAnimation::onAnimationIteration):
+        (WebCore::KeyframeAnimation::onAnimationEnd):
+        (WebCore::KeyframeAnimation::sendAnimationEvent):
+        * page/gtk/EventHandlerGtk.cpp:
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::isKeyboardOptionTab):
+        * page/mac/FrameMac.mm:
+        * page/qt/EventHandlerQt.cpp:
+        (WebCore::isKeyboardOptionTab):
+        * plugins/PluginView.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlMuteButtonElement::defaultEventHandler):
+        (WebCore::MediaControlPlayButtonElement::defaultEventHandler):
+        (WebCore::MediaControlSeekButtonElement::defaultEventHandler):
+        (WebCore::MediaControlTimelineElement::defaultEventHandler):
+        (WebCore::MediaControlFullscreenButtonElement::defaultEventHandler):
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::userResize):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollToOffset):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::valueChanged):
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::forwardEvent):
+        * rendering/RenderObject.cpp:
+        * rendering/RenderSlider.cpp:
+        (WebCore::HTMLSliderThumbElement::defaultEventHandler):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::forwardEvent):
+        (WebCore::RenderTextControl::selectionChanged):
+        * rendering/RenderWidget.cpp:
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::TextControlInnerTextElement::defaultEventHandler):
+        (WebCore::SearchFieldResultsButtonElement::defaultEventHandler):
+        (WebCore::SearchFieldCancelButtonElement::defaultEventHandler):
+        * storage/LocalStorageArea.cpp:
+        (WebCore::LocalStorageArea::dispatchStorageEvent):
+        * storage/SessionStorageArea.cpp:
+        (WebCore::SessionStorageArea::dispatchStorageEvent):
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::defaultEventHandler):
+        * svg/SVGDocument.cpp:
+        (WebCore::SVGDocument::dispatchZoomEvent):
+        (WebCore::SVGDocument::dispatchScrollEvent):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::parseMappedAttribute):
+        (WebCore::hasLoadListener):
+        (WebCore::SVGElement::sendSVGLoadEventIfPossible):
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::on*): (multiple methods)
+        (WebCore::SVGElementInstance::setOn*): (multiple methods)
+        * svg/SVGImageLoader.cpp:
+        (WebCore::SVGImageLoader::dispatchLoadEvent):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::parseMappedAttribute):
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::dispatchErrorEvent):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::dispatchReadyStateChangeEvent):
+        (WebCore::XMLHttpRequest::dispatchAbortEvent):
+        (WebCore::XMLHttpRequest::dispatchErrorEvent):
+        (WebCore::XMLHttpRequest::dispatchLoadEvent):
+        (WebCore::XMLHttpRequest::dispatchLoadStartEvent):
+        (WebCore::XMLHttpRequest::dispatchProgressEvent):
+        * xml/XMLHttpRequestUpload.cpp:
+        (WebCore::XMLHttpRequestUpload::dispatchAbortEvent):
+        (WebCore::XMLHttpRequestUpload::dispatchErrorEvent):
+        (WebCore::XMLHttpRequestUpload::dispatchLoadEvent):
+        (WebCore::XMLHttpRequestUpload::dispatchLoadStartEvent):
+        (WebCore::XMLHttpRequestUpload::dispatchProgressEvent):
+        * xml/XPathResult.cpp:
+        (WebCore::XPathResult::XPathResult):
+        (WebCore::XPathResult::~XPathResult):
+        (WebCore::XPathResult::invalidateIteratorState):
+        Access event names via eventNames() function.
+
+2008-11-04  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Delete unused forwarding headers.
+
+        * ForwardingHeaders/kjs/Activation.h: Removed.
+        * ForwardingHeaders/kjs/Register.h: Removed.
+        * ForwardingHeaders/kjs/RegisterID.h: Removed.
+
+2008-11-04  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Fix stupid typo in previous build fix.
+
+        * bindings/js/JSStorageCustom.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/NP_jsobject.cpp:
+
+2008-11-03  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Fix the build for all non-Mac platforms.
+
+        * ForwardingHeaders/kjs/PropertyNameArray.h: Removed.
+        * ForwardingHeaders/runtime/PropertyNameArray.h: Copied from ForwardingHeaders/kjs/PropertyNameArray.h.
+        * bindings/js/JSStorageCustom.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/NP_jsobject.cpp:
+
+2008-11-03  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Fix the wxWindows build.
+
+        * bridge/c/c_instance.cpp:
+
+2008-11-03  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Maciej Stachowiak.
+
+        Move more files into the runtime subdirectory of JavaScriptCore.
+
+        * ForwardingHeaders/kjs/ArgList.h: Removed.
+        * ForwardingHeaders/kjs/CollectorHeapIterator.h: Removed.
+        * ForwardingHeaders/kjs/ExecState.h: Removed.
+        * ForwardingHeaders/kjs/InitializeThreading.h: Removed.
+        * ForwardingHeaders/kjs/JSGlobalData.h: Removed.
+        * ForwardingHeaders/kjs/JSLock.h: Removed.
+        * ForwardingHeaders/kjs/SymbolTable.h: Removed.
+        * ForwardingHeaders/runtime/ArgList.h: Copied from ForwardingHeaders/kjs/ArgList.h.
+        * ForwardingHeaders/runtime/CollectorHeapIterator.h: Copied from ForwardingHeaders/kjs/CollectorHeapIterator.h.
+        * ForwardingHeaders/runtime/ExecState.h: Copied from ForwardingHeaders/kjs/ExecState.h.
+        * ForwardingHeaders/runtime/InitializeThreading.h: Copied from ForwardingHeaders/kjs/InitializeThreading.h.
+        * ForwardingHeaders/runtime/JSGlobalData.h: Copied from ForwardingHeaders/kjs/JSGlobalData.h.
+        * ForwardingHeaders/runtime/JSLock.h: Copied from ForwardingHeaders/kjs/JSLock.h.
+        * ForwardingHeaders/runtime/SymbolTable.h: Copied from ForwardingHeaders/kjs/SymbolTable.h.
+        * bindings/js/GCController.cpp:
+        * bindings/js/JSCustomPositionCallback.cpp:
+        * bindings/js/JSCustomPositionErrorCallback.cpp:
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        * bindings/js/JSCustomVoidCallback.cpp:
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSEventCustom.cpp:
+        * bindings/js/JSEventListener.cpp:
+        * bindings/js/JSNodeFilterCondition.cpp:
+        * bindings/js/ScheduledAction.cpp:
+        * bindings/js/ScriptController.cpp:
+        * bindings/js/ScriptControllerMac.mm:
+        * bindings/objc/WebScriptObject.mm:
+        * bridge/NP_jsobject.cpp:
+        * bridge/c/c_class.cpp:
+        * bridge/c/c_instance.cpp:
+        * bridge/c/c_runtime.cpp:
+        * bridge/c/c_utility.cpp:
+        * bridge/jni/jni_class.cpp:
+        * bridge/jni/jni_instance.cpp:
+        * bridge/jni/jni_jsobject.mm:
+        * bridge/jni/jni_objc.mm:
+        * bridge/jni/jni_runtime.cpp:
+        * bridge/jni/jni_runtime.h:
+        * bridge/jni/jni_utility.cpp:
+        * bridge/npruntime.cpp:
+        * bridge/objc/objc_instance.mm:
+        * bridge/objc/objc_runtime.mm:
+        * bridge/objc/objc_utility.mm:
+        * bridge/runtime.cpp:
+        * dom/Document.cpp:
+        * dom/Node.cpp:
+        * dom/NodeFilter.cpp:
+        * dom/NodeIterator.cpp:
+        * dom/TreeWalker.cpp:
+        * history/CachedPage.cpp:
+        * inspector/InspectorController.cpp:
+        * inspector/JavaScriptCallFrame.cpp:
+        * inspector/JavaScriptCallFrame.h:
+        * inspector/JavaScriptDebugServer.cpp:
+        * inspector/JavaScriptProfileNode.cpp:
+        * loader/FrameLoader.cpp:
+        * loader/icon/IconDatabase.cpp:
+        * page/Console.cpp:
+        * page/Page.cpp:
+        * page/mac/FrameMac.mm:
+        * plugins/PluginView.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+        * storage/Database.cpp:
+        * xml/XMLHttpRequest.cpp:
+
+2008-11-03  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove the forwarding header for FunctionCallProfile, because it was
+        renamed to ProfileNode in r33466.
+
+        * ForwardingHeaders/kjs/FunctionCallProfile.h: Removed.
+
+2008-11-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=22026
+
+        When computing the bounds of the transparency layer, we need to
+        map the clipRect through the enclosing transform.
+
+        Test: fast/layers/opacity-transforms.html
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::transparencyClipBox):
+
+2008-11-03  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22053
+
+        Added additional support needed for the NPDrawingModelCoreAnimation drawing model.
+
+        * bridge/npapi.h:
+
+2008-11-03  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Alp Toker.
+
+        Update parseDataUrl() function in the libsoup http backend with
+        the one from the curl backend which has recent correctness and crash
+        fixes.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::parseDataUrl):
+
+2008-11-03  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Alp Toker.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22041
+        Fix CURL crashes on the test suite
+
+        Fix segfault with setDefersLoading(). Do not call into curl when we
+        don't have a CURL handle.
+
+        It is attempted to defer the loading before the load has been
+        started (no curl handle was allocated yet). If that happens then
+        just remember that. ResourceHandleManager::startJob is already taking
+        care of this and in initResourceHandle the the downloading will
+        be paused if needed.
+
+        Fixes fast/loader/simultaneous-reloads-assert.html
+
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::setDefersLoading):
+
+2008-11-03  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Alp Toker.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22041
+        Fix CURL crashes on the test suite
+
+        Do not send "no data" to WebCore in parseDataUrl().
+
+        Fixes assert on fast/tokenizer/image-empty-crash.html
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::parseDataUrl):
+
+2008-11-02  Xan Lopez  <xan@gnome.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22009
+        HTML5 Video with GStreamer pulls gnome-vfs without using it
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        Remove gnome-vfs include.
+
+2008-11-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Be sure to check the final URLs of requested resources to make sure we
+        don't get fooled by HTTP redirects.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21963
+
+        Tests: http/tests/security/xss-DENIED-xsl-document-redirect.xml
+               http/tests/security/xss-DENIED-xsl-external-entity-redirect.xml
+
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::openFunc):
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::canRequest):
+        (WebCore::DocLoader::requestResource):
+        * loader/DocLoader.h:
+        * xml/XSLTProcessor.cpp:
+        (WebCore::docLoaderFunc):
+
+2008-11-01  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22001
+        AtomicStringImpl* keys of event listener maps can outlive their strings
+
+        Test: fast/events/destroyed-atomic-string.html
+
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::addEventListener):
+        (WebCore::MessagePort::removeEventListener):
+        (WebCore::MessagePort::dispatchEvent):
+        * dom/MessagePort.h:
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::addEventListener):
+        (WebCore::DOMApplicationCache::removeEventListener):
+        (WebCore::DOMApplicationCache::dispatchEvent):
+        * loader/appcache/DOMApplicationCache.h:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::addEventListener):
+        (WebCore::XMLHttpRequest::removeEventListener):
+        (WebCore::XMLHttpRequest::dispatchEvent):
+        * xml/XMLHttpRequest.h:
+        * xml/XMLHttpRequestUpload.cpp:
+        (WebCore::XMLHttpRequestUpload::addEventListener):
+        (WebCore::XMLHttpRequestUpload::removeEventListener):
+        (WebCore::XMLHttpRequestUpload::dispatchEvent):
+        * xml/XMLHttpRequestUpload.h:
+        Changed EventListenersMap to use AtomicString as key (instead of AtomicStringImpl*).
+
+2008-10-31  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21998
+        Use JSDOMGlobalObject in EventListener-related bindings
+
+        * dom/MessagePort.idl: Auto-generate bindings for onclose and onmessage.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Use JSDOMGlobalObject instead of JSDOMWindow in JS
+        bindings for inline event handlers.
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSEventTargetNodeCustom.cpp:
+        (WebCore::JSEventTargetNode::addEventListener):
+        (WebCore::JSEventTargetNode::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::removeEventListener):
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        Use ScriptExecutionContext and JSDOMGlobalObject in bindings.
+
+        * dom/EventTarget.h:
+        * dom/EventTargetNode.cpp:
+        (WebCore::EventTargetNode::scriptExecutionContext):
+        * dom/EventTargetNode.h:
+        * dom/MessagePort.cpp:
+        * dom/MessagePort.h:
+        (WebCore::MessagePort::scriptExecutionContext):
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::scriptExecutionContext):
+        * loader/appcache/DOMApplicationCache.h:
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::scriptExecutionContext):
+        * svg/SVGElementInstance.h:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::scriptExecutionContext):
+        * xml/XMLHttpRequest.h:
+        * xml/XMLHttpRequestUpload.cpp:
+        (WebCore::XMLHttpRequestUpload::scriptExecutionContext):
+        * xml/XMLHttpRequestUpload.h:
+        Remove associatedFrame() method, and provide scriptExecutionContext() where it wasn't
+        available yet.
+
+2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Geoff Garen.
+
+        Rename SourceRange.h to SourceCode.h.
+
+        * ForwardingHeaders/kjs/SourceCode.h: Copied from ForwardingHeaders/kjs/SourceRange.h.
+        * ForwardingHeaders/kjs/SourceRange.h: Removed.
+        * bindings/js/StringSourceProvider.h:
+        * bridge/NP_jsobject.cpp:
+
+2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 22019: Move JSC::Interpreter::shouldPrintExceptions() to WebCore::Console
+        <https://bugs.webkit.org/show_bug.cgi?id=22019>
+
+        * WebCore.base.exp:
+        * page/Console.cpp:
+        (WebCore::printToStandardOut):
+        (WebCore::Console::shouldPrintExceptions):
+        (WebCore::Console::setShouldPrintExceptions):
+        * page/Console.h:
+
+2008-10-31  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - WebCore part of <rdar://problem/6334641> Add WebView SPI for disabling document.cookie
+
+        * dom/Document.cpp:
+        (WebCore::Document::cookie): Added checking if cookies are disabled.
+        (WebCore::Document::setCookie): Ditto.
+        * page/Navigator.cpp:
+        (WebCore::Navigator::cookieEnabled): Ditto.
+        * page/Page.cpp:
+        (WebCore::Page::Page): Initialize m_cookieEnabled to true.
+        * page/Page.h:
+        (WebCore::Page::cookieEnabled): Added.
+        (WebCore::Page::setCookieEnabled): Added.
+
+2008-10-31  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WebCore Windows part of fix for <rdar://problem/5839256> FILE CONTROL: multi-file upload.
+        https://bugs.webkit.org/show_bug.cgi?id=22008
+
+        * platform/FileChooser.cpp: (WebCore::FileChooser::chooseIcon):
+        Rename newIconForFile and newIconForFiles to createIconForFile and createIconForFiles.
+        * platform/graphics/Icon.h: ditto.
+        * platform/graphics/gtk/IconGtk.cpp:
+        (WebCore::Icon::createIconForFile): ditto.
+        (WebCore::Icon::createIconForFiles): ditto.
+        * platform/graphics/mac/IconMac.mm:
+        (WebCore::Icon::createIconForFile): ditto.
+        (WebCore::Icon::createIconForFiles): ditto.
+        * platform/graphics/qt/IconQt.cpp:
+        (WebCore::Icon::createIconForFile): ditto.
+        (WebCore::Icon::createIconForFiles): ditto.
+        * platform/wx/TemporaryLinkStubs.cpp:
+        (Icon::createIconForFile): ditto.
+        (Icon::createIconForFiles): ditto.
+        * platform/graphics/win/IconWin.cpp:
+        (WebCore::Icon::createIconForFile): ditto.
+        (WebCore::Icon::createIconForFiles): Add creation of an icon for multiple files.
+
+        * rendering/RenderThemeWin.cpp: (WebCore::RenderThemeWin::paintSearchFieldResultsDecoration):
+        Improve icon creation code to match new code in Icon::createIconForFiles
+
+2008-10-31  Timothy Hatcher  <timothy@apple.com>
+
+        Add manual tests that check breakpoints on a blockless body of "for" loops.
+
+        https://bugs.webkit.org/show_bug.cgi?id=22004
+
+        Reviewed by Darin Adler.
+
+        * manual-tests/inspector/debugger-pause-on-for-in-statements.html: Added.
+        * manual-tests/inspector/debugger-pause-on-for-statements.html: Added.
+
+2008-10-31  Darin Adler  <darin@apple.com>
+
+        - fix build
+
+        * platform/win/WCDataObject.cpp: Added missing include of "config.h".
+
+2008-10-30  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21970
+        Make MessagePort event dispatch work in workers
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        (WebCore::JSDOMGlobalObject::JSDOMGlobalObjectData::JSDOMGlobalObjectData):
+        (WebCore::JSDOMGlobalObject::~JSDOMGlobalObject):
+        (WebCore::JSDOMGlobalObject::findJSEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSEventListener):
+        (WebCore::JSDOMGlobalObject::findJSUnprotectedEventListener):
+        (WebCore::JSDOMGlobalObject::findOrCreateJSUnprotectedEventListener):
+        (WebCore::JSDOMGlobalObject::jsEventListeners):
+        (WebCore::JSDOMGlobalObject::jsInlineEventListeners):
+        (WebCore::JSDOMGlobalObject::jsUnprotectedEventListeners):
+        (WebCore::JSDOMGlobalObject::jsUnprotectedInlineEventListeners):
+        (WebCore::JSDOMGlobalObject::setCurrentEvent):
+        (WebCore::JSDOMGlobalObject::currentEvent):
+        (WebCore::toJSDOMGlobalObject):
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData):
+        (WebCore::JSDOMWindowBase::~JSDOMWindowBase):
+        (WebCore::JSDOMWindowBase::clearHelperObjectProperties):
+        * bindings/js/JSDOMWindowBase.h:
+        Moved event listener tracking from JSDOMWindow to JSDOMGlobalObject.
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSAbstractEventListener::handleEvent):
+        (WebCore::JSUnprotectedEventListener::JSUnprotectedEventListener):
+        (WebCore::JSUnprotectedEventListener::~JSUnprotectedEventListener):
+        (WebCore::JSUnprotectedEventListener::globalObject):
+        (WebCore::JSUnprotectedEventListener::clearGlobalObject):
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        (WebCore::JSEventListener::globalObject):
+        (WebCore::JSEventListener::clearGlobalObject):
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSUnprotectedEventListener::create):
+        (WebCore::JSEventListener::create):
+        (WebCore::JSLazyEventListener::create):
+        Changed to use JSDOMGlobalObject and ScriptExecutionContext.
+
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::startConversation):
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        (WebCore::JSMessagePort::setOnmessage):
+        (WebCore::JSMessagePort::setOnclose):
+        Updated bindings to work with JSDOMGlobalObject. Next step is to make code generator emit
+        such code, and stop using a custom implementation for JSMessagePort inline event handler
+        getters and setters.
+
+        * dom/Document.cpp:
+        (WebCore::Document::virtualURL):
+        * dom/Document.h:
+        * dom/ScriptExecutionContext.h:
+        Expose url() method on ScriptExecutionContext (necessary for compiling scripts in
+        JSLazyEventListener).
+
+2008-10-31  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Speculative wxWindows build fix.
+
+        * webcore-base.bkl:
+
+2008-10-30  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Jon Homeycutt.
+
+        Explicitly default to building for only the native architecture in debug and release builds.
+
+        * Configurations/DebugRelease.xcconfig:
+
+2008-10-30  Cameron Zwarich  <zwarich@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Create a debugger directory in JavaScriptCore and move the relevant
+        files to it.
+
+        * ForwardingHeaders/debugger: Added.
+        * ForwardingHeaders/debugger/Debugger.h: Copied from ForwardingHeaders/kjs/debugger.h.
+        * ForwardingHeaders/debugger/DebuggerCallFrame.h: Copied from ForwardingHeaders/kjs/DebuggerCallFrame.h.
+        * ForwardingHeaders/kjs/DebuggerCallFrame.h: Removed.
+        * ForwardingHeaders/kjs/debugger.h: Removed.
+        * WebCore.pro:
+        * bindings/js/ScriptController.cpp:
+        * inspector/JavaScriptCallFrame.cpp:
+        * inspector/JavaScriptCallFrame.h:
+        * inspector/JavaScriptDebugServer.cpp:
+        * inspector/JavaScriptDebugServer.h:
+
+2008-10-30  Tony Chang <tony@chromium.org>
+
+        Fix 2 Windows theme bugs:
+        1) Checkboxes marked readonly were rendered incorrectly
+        2) If a button has focus and is pressed, it was rendered
+           as focused rather than pressed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21859
+
+        Reviewed by Dave Hyatt.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::determineState):
+        (WebCore::RenderThemeWin::determineButtonState):
+
+2008-10-30  Benjamin K. Stuhl  <bks24@cornell.edu>
+
+        gcc 4.3.3/linux-x86 generates "suggest parentheses around && within ||"
+        warnings; add some parentheses to disambiguate things. No functional
+        changes, so no tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21973
+        Add parentheses to clean up some gcc warnings
+
+        Reviewed by Dan Bernstein.
+
+        * platform/graphics/Font.h:
+        (WebCore::Font::treatAsZeroWidthSpace):
+
+2008-10-30  Aaron Boodman  <aa@chromium.org>
+
+        Added an explicit dependency on HashMap.h. It was getting pulled in via
+        <kjs/identifier.h> in the case of JSC, causing errors for the Chromium port.
+
+        Reviewed by Darin Adler.
+
+        * platform/text/PlatformString.h:
+
+2008-10-30  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Sam Weinig
+
+        https://bugs.webkit.org/show_bug.cgi?id=21967
+
+        For some platforms the GeolocationService must be suspended and resumed.
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::clearWatch): now uses Geolocation::hasListeners()
+        (WebCore::Geolocation::suspend): calls GeolocationService::suspend() if there are listeners
+        (WebCore::Geolocation::resume): calls GeolocationService::resume() if there are listeners
+        (WebCore::Geolocation::geolocationServicePositionChanged): now uses Geolocation::hasListeners()
+        * page/Geolocation.h:
+        (WebCore::Geolocation::hasListeners): Indicates of the Geolocation has interested GeolocationService listeners
+        * platform/GeolocationService.h:
+        (WebCore::GeolocationService::suspend): empty implementation
+        (WebCore::GeolocationService::resume): empty implementation
+
+2008-10-30  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Sam Weinig
+
+        https://bugs.webkit.org/show_bug.cgi?id=21966
+
+        The Geolocation spec was updated on 10/27/2008. This brings WebCore up to date.
+        http://dev.w3.org/geo/api/spec-source.html
+
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::GeoNotifier::GeoNotifier): PositionOptions' timeout now unsigned
+        * page/Geoposition.cpp: velocity is now called speed
+        (WebCore::Geoposition::toString):
+        * page/Geoposition.h: velocity is now called speed
+        (WebCore::Geoposition::create):
+        (WebCore::Geoposition::speed):
+        (WebCore::Geoposition::Geoposition):
+        * page/Geoposition.idl: velocity is now called speed
+        * page/PositionOptions.h: timeout is now unsigned
+        (WebCore::PositionOptions::create):
+        (WebCore::PositionOptions::timeout):
+        (WebCore::PositionOptions::setTimeout):
+        (WebCore::PositionOptions::PositionOptions):
+        * page/PositionOptions.idl: timeout is now unsigned long
+
+2008-10-30  Justin Garcia  <justin.garcia@apple.com>
+
+        Also handle preserved newlines.
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+
+2008-10-30  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        <rdar://problem/6104369> Hitting return at the end of a quoted line creates an extraneous quoted line
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+        Don't store the endingSelection() in selection, just call endingSelection() in the few places it's
+        needed.  This function is cheap since it just returns a reference to a Selection instead of creating one.
+        Don't store an affinity.  In the one place that it was used, isLastVisiblePositionInNode(VisiblePosition(pos, affinity), topBlockquote),
+        we now use visiblePos (in order to avoid VisiblePosition creation).
+        Set pos after we delete the current selection (if there is one), and be consistent about what we set
+        pos to.  Before, we upstream()ed it if there was a selection to delete and left it alone otherwise.  In fact...
+        ...we need to use downstream() for pos so that when a caret is at the boundary between two nodes, pos is
+        in the first node that we want to move.  This fixes the bug, since it lets code that checks for the case
+        where the caret is between text and a br work correctly.
+
+2008-10-30  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Fix the Qt build.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21969
+
+        * inspector/front-end/WebKit.qrc:
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBufferData::ImageBufferData):
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::context):
+        (WebCore::ImageBuffer::image):
+        (WebCore::ImageBuffer::toDataURL):
+
+2008-10-30  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Darin Adler.
+
+        More preparation for:
+        <rdar://problem/6104369> Hitting return at the end of a quoted line creates an extraneous quoted line
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply): Added comments.  Don't need to use newStartNode.  If the
+        startNode needs to change, change it.  Afterwords, check to make sure that it hasn't left topBlockquote.
+        This is slightly stricter than before, where we just made sure that it still had a topBlockquote.  This
+        doesn't really fix a bug, since we can't really get into a situation where we move to a different
+        topBlockquote, but it simplifies the code.
+
+2008-10-30  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by Alp Toker.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21883
+        [CAIRO] globalAlpha has to be stored and restored
+
+        Cairo's globalAlpha has to be stored and reloaded on calling
+        save() and restore(). We use the power of GraphicsContextState for this.
+
+        * platform/graphics/GraphicsContextPrivate.h:
+        (WebCore::GraphicsContextState::GraphicsContextState):
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::getAlpha):
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+
+2008-10-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Rename "attachedToEventTargetNode" to "isInline".
+
+        Inline (onXXX) attributes are used not just with event target nodes, but also with Window,
+        XMLHttpRequest, MessagePort et al.
+
+        Also renamed createHTMLEventHandler() (which was a leftover from earlier isHTMLEvent ->
+        attachedToEventTargetNode rename made for SVG) to createInlineEventListener().
+        And also renamed EventTargetNode, Document and Window "eventListenerForType" methods to
+        "inlineEventListenerForType", as they work with inline listeners.
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::setOnmessage):
+        (WebCore::JSMessagePort::setOnclose):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        Pass a correct value for this argument - callers used to be confused, because they didn't
+        consider themselves event target nodes. This doesn't affect behavior however, as the only
+        difference between inline and non-inline event handlers is that the former treat
+        "return false" as "event.preventDefault()", which is not important to any of these objects.
+
+        * bindings/js/JSEventListener.cpp: (WebCore::JSLazyEventListener::parseCode):
+        Assert that isInline is true instead of checking its value, as the constructor of this class
+        always sets it to true.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::~JSDOMWindowBase):
+        (WebCore::JSDOMWindowBase::findJSEventListener):
+        (WebCore::JSDOMWindowBase::findOrCreateJSEventListener):
+        (WebCore::JSDOMWindowBase::findJSUnprotectedEventListener):
+        (WebCore::JSDOMWindowBase::findOrCreateJSUnprotectedEventListener):
+        (WebCore::JSDOMWindowBase::jsInlineEventListeners):
+        (WebCore::JSDOMWindowBase::jsUnprotectedInlineEventListeners):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSAbstractEventListener::handleEvent):
+        (WebCore::JSAbstractEventListener::isInline):
+        (WebCore::JSUnprotectedEventListener::JSUnprotectedEventListener):
+        (WebCore::JSUnprotectedEventListener::~JSUnprotectedEventListener):
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        (WebCore::JSLazyEventListener::parseCode):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSAbstractEventListener::JSAbstractEventListener):
+        (WebCore::JSUnprotectedEventListener::create):
+        (WebCore::JSEventListener::create):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::createInlineEventHandler):
+        * bindings/js/ScriptController.h:
+        * dom/Document.cpp:
+        (WebCore::Document::setWindowInlineEventListenerForType):
+        (WebCore::Document::windowInlineEventListenerForType):
+        (WebCore::Document::removeWindowInlineEventListenerForType):
+        (WebCore::Document::createEventListener):
+        (WebCore::Document::setWindowInlineEventListenerForTypeAndAttribute):
+        * dom/Document.h:
+        * dom/EventListener.h:
+        (WebCore::EventListener::isInline):
+        * dom/EventTargetNode.cpp:
+        (WebCore::EventTargetNode::removeInlineEventListenerForType):
+        (WebCore::EventTargetNode::setInlineEventListenerForType):
+        (WebCore::EventTargetNode::setInlineEventListenerForTypeAndAttribute):
+        (WebCore::EventTargetNode::inlineEventListenerForType):
+        (WebCore::EventTargetNode::on*): (many methods)
+        (WebCore::EventTargetNode::setOn*): (many methods)
+        * dom/EventTargetNode.h:
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment):
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::parseMappedAttribute):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::parseMappedAttribute):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::parseMappedAttribute):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parseMappedAttribute):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::parseMappedAttribute):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::mouseButtonListener):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::setInlineEventListenerForType):
+        (WebCore::DOMWindow::inlineEventListenerForType):
+        (WebCore::DOMWindow::on*): (many methods)
+        (WebCore::DOMWindow::setOn*): (many methods)
+        * page/DOMWindow.h:
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::parseMappedAttribute):
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::on*): (many methods)
+        (WebCore::SVGElementInstance::setOn*): (many methods)
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::parseMappedAttribute):
+        Rename things, as described above.
+
+2008-10-29  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed and slightly changed by Holger Freyther.
+
+        Added all the files that need to be installed for the Inspector to
+        work.
+
+        * GNUmakefile.am: Invoke the shell to get the files.
+
+2008-10-29  Andrew Scherkus  <scherkus@chromium.org>
+
+        Reviewed by Darin Adler
+
+        Add MediaPlayerPrivateChromium to MediaPlayer
+        https://bugs.webkit.org/show_bug.cgi?id=21930
+
+        * platform/graphics/MediaPlayer.cpp:
+
+2008-10-29  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Some preparation for:
+        <rdar://problem/6104369> Hitting return at the end of a quoted line creates an extraneous quoted line
+
+        Added an early return to avoid a level of if-nesting.  No other changes.  We probably don't
+        need to rebalance whitespace before the early return but for now don't risk any change in behavior
+        I'll revisit that later.
+
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+
+2008-10-29  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes after addition of runtime and ImageBuffer changes.
+
+        * platform/graphics/wx/ImageBufferData.h: Added.
+        * platform/graphics/wx/ImageBufferWx.cpp:
+        (WebCore::ImageBufferData::ImageBufferData):
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::context):
+        * webcore-base.bkl:
+
+2008-10-29  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by Darin Adler
+        https://bugs.webkit.org/attachment.cgi?id=24745
+
+        Allow Skia implementations to get text style changed notifications.
+
+        * platform/graphics/GraphicsContext.cpp:
+
+2008-10-29  Timothy Hatcher  <timothy@apple.com>
+
+        Add a manual test that checks breakpoints on a blockless body of
+        an "else" statement.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21944
+
+        Reviewed by Maciej Stachowiak.
+
+        * manual-tests/inspector/debugger-pause-on-else-statements.html: Added.
+
+2008-10-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21921
+        MessagePort messages are dispatched to documents that are not fully active
+
+        Covered by corrected fast/events/message-port-inactive-document.html
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSAbstractEventListener::handleEvent): Don't dispatch messages to contexts
+        that are not fully active.
+
+2008-10-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21922
+        Expose MessagePort global constructor
+
+        Covered by existing dumper tests.
+
+        * dom/MessagePort.idl:
+        * page/DOMWindow.idl:
+
+2008-10-29  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21924
+        HashTable internal index is not always deleted
+
+        * bindings/js/JSDOMBinding.cpp: (WebCore::DOMObjectHashTableMap::~DOMObjectHashTableMap):
+        Call deleteTable for HashTables that are being deleted.
+
+2008-10-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21923
+        Create an abstraction for script execution context
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        Added ScriptExecutionContext.{h,cpp}.
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSAudioConstructor.h:
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSImageConstructor.h:
+        * bindings/js/JSOptionConstructor.cpp:
+        (WebCore::JSOptionConstructor::JSOptionConstructor):
+        * bindings/js/JSOptionConstructor.h:
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
+        * bindings/js/JSXMLHttpRequestConstructor.h:
+        Pass ScriptExecutionContext instead of Document to make getDOMConstructor() happy.
+        Since these objects can only work within documents now, it is immediately converted back
+        to Document.
+
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor):
+        (WebCore::JSMessageChannelConstructor::construct):
+        * bindings/js/JSMessageChannelConstructor.h:
+        (WebCore::JSMessageChannelConstructor::scriptExecutionContext):
+        MessageChannel needs to be supported in workers right away, so the constructor operates with
+        it directly.
+
+        * dom/ActiveDOMObject.cpp:
+        (WebCore::ActiveDOMObject::ActiveDOMObject):
+        (WebCore::ActiveDOMObject::~ActiveDOMObject):
+        (WebCore::ActiveDOMObject::contextDestroyed):
+        * dom/ActiveDOMObject.h:
+        (WebCore::ActiveDOMObject::scriptExecutionContext):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markActiveObjectsForContext):
+        (WebCore::markCrossHeapDependentObjectsForContext):
+        Use ScriptExecutionContext instead of Document, now that ActiveDOMObject and MessagePort
+        tracking is handled by ScriptExecutionContext.
+
+        * bindings/js/JSDOMBinding.h: (WebCore::getDOMPrototype): Moved to JSDOMGlobalObject.
+
+        * bindings/js/JSDOMGlobalObject.h:
+        (WebCore::getDOMConstructor): Moved to this file, as constructors live in JSDOMGlobalObject.
+        Also, the two-argument version that used to be in JSDOMWindowBase.cpp need to be accessible
+        to worker context implementation.
+        (WebCore::scriptExecutionContext): Added a pure virtual method to access
+        ScriptExecutionContext, implemented by subclasses.
+
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowBase.cpp: (WebCore::JSDOMWindowBase::scriptExecutionContext):
+        Implement by returning the associated document. Note that this method currently gives bogus
+        results after navigation - DOMWindow Frame reference is not zeroed out, so we get a document
+        that is currently in the frame, not the one associated with this window.
+
+        * bindings/js/JSDedicatedWorkerConstructor.cpp: Removed unnecessary include of DOMWindow.h.
+
+        * bindings/js/JSDocumentCustom.cpp: (WebCore::JSDocument::mark):
+        Call markActiveObjectsForContext() by its new name.
+
+        * dom/DedicatedWorker.cpp:
+        (WebCore::DedicatedWorker::DedicatedWorker):
+        (WebCore::DedicatedWorker::document):
+        * dom/DedicatedWorker.h:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::document):
+        * xml/XMLHttpRequest.h:
+        Added a document() function that upcasts ScriptExecutionContext, as these objects only work
+        within documents currently (at least for XMLHttpRequest, this will change soon though).
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::~Document):
+        Moved active object and MessagePort tracking up to ScriptExecutionContext, to share code
+        with workers.
+
+        * dom/Document.h:
+        (WebCore::Document::isDocument):
+        (WebCore::Document::refScriptExecutionContext):
+        (WebCore::Document::derefScriptExecutionContext):
+        Inherit from ScriptExecutionContext.
+
+        * dom/MessageChannel.cpp:
+        (WebCore::MessageChannel::MessageChannel):
+        * dom/MessageChannel.h:
+        (WebCore::MessageChannel::create):
+        Use ScriptExecutionContext instead of Document.
+
+        * dom/MessagePort.cpp:
+        (WebCore::CloseMessagePortTimer::CloseMessagePortTimer): Make m_port a RefPtr, because
+        MessagePort doesn't ref() itself when posting this event any more (this is a fix for an
+        unrelated issue that was causing random crashes in layout tests).
+        (WebCore::MessagePort::MessagePort):
+        (WebCore::MessagePort::~MessagePort):
+        (WebCore::MessagePort::associatedFrame):
+        (WebCore::MessagePort::clone):
+        (WebCore::MessagePort::postMessage):
+        (WebCore::MessagePort::startConversation):
+        (WebCore::MessagePort::start):
+        (WebCore::MessagePort::contextDestroyed):
+        (WebCore::MessagePort::dispatchMessages):
+        * dom/MessagePort.h:
+        (WebCore::MessagePort::create):
+        (WebCore::MessagePort::scriptExecutionContext):
+        Use ScriptExecutionContext instead of Document. This is a step toward making MessagePort
+        work in worker contexts - we need to also make some its method thread safe for cross-thread
+        messaging, and make event dispatching thread safe.
+
+        * dom/ScriptExecutionContext.cpp: Added.
+        * dom/ScriptExecutionContext.h: Added.
+        ActiveDOMObject and MessagePort tracking is moved from Document.
+        It is debatable whether ScriptExecutionContext should be a parent of Document or DOMWindow,
+        but as I'm just moving Document code, and it is Document that is the main context object
+        in our implementation currently.
+        Changing ScriptExecutionContext to be a parent of DOMWindow causes a number of bugs that
+        seem non-trivial to fix, and isn't really a part of this task.
+
+2008-10-28  Alp Toker  <alp@nuanti.com>
+
+        List newly-added ImageBufferData.h in build system.
+
+        * GNUmakefile.am:
+
+2008-10-28  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Cameron Zwarich.
+
+        De-list unused WebCore ForwardingHeaders to fix the dist target.
+
+        * GNUmakefile.am:
+
+2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Attempt to fix the Windows build by generating Forwardingheaders for the
+        runtime directory in JavaScriptCore.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2008-10-28  Justin Garcia  <justin.garcia@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/5188560> REGRESSION: Spell checker doesn't clear spelling/grammar marker after error is marked as Ignored
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::ignoreSpelling): Remove misspelling markers from the word.
+        (WebCore::Editor::learnSpelling): Added a FIXME about <rdar://problem/5396072>, which
+        will probably require a change more complicated than just marking the learned word as
+        misspelled.  I'll address it with a separate patch.
+        * editing/EditorCommand.cpp:
+        (WebCore::executeIgnoreSpelling): Added.
+        (WebCore::CommandEntry::): Added an entry for IgnoreSpelling.
+
+2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Move ForwardingHeaders to their correct location after the creation of
+        the runtime directory in JavaScriptCore.
+
+        * ForwardingHeaders/kjs/ArrayPrototype.h: Removed.
+        * ForwardingHeaders/kjs/BooleanObject.h: Removed.
+        * ForwardingHeaders/kjs/CallData.h: Removed.
+        * ForwardingHeaders/kjs/ConstructData.h: Removed.
+        * ForwardingHeaders/kjs/DateInstance.h: Removed.
+        * ForwardingHeaders/kjs/Error.h: Removed.
+        * ForwardingHeaders/kjs/FunctionConstructor.h: Removed.
+        * ForwardingHeaders/kjs/FunctionPrototype.h: Removed.
+        * ForwardingHeaders/kjs/InternalFunction.h: Removed.
+        * ForwardingHeaders/kjs/JSArray.h: Removed.
+        * ForwardingHeaders/kjs/JSFunction.h: Removed.
+        * ForwardingHeaders/kjs/JSGlobalObject.h: Removed.
+        * ForwardingHeaders/kjs/JSNumberCell.h: Removed.
+        * ForwardingHeaders/kjs/JSObject.h: Removed.
+        * ForwardingHeaders/kjs/JSString.h: Removed.
+        * ForwardingHeaders/kjs/JSValue.h: Removed.
+        * ForwardingHeaders/kjs/ObjectPrototype.h: Removed.
+        * ForwardingHeaders/kjs/PropertyMap.h: Removed.
+        * ForwardingHeaders/kjs/PrototypeFunction.h: Removed.
+        * ForwardingHeaders/kjs/StringObject.h: Removed.
+        * ForwardingHeaders/kjs/StringObjectThatMasqueradesAsUndefined.h: Removed.
+        * ForwardingHeaders/kjs/StringPrototype.h: Removed.
+        * ForwardingHeaders/kjs/StructureID.h: Removed.
+        * ForwardingHeaders/runtime: Added.
+        * ForwardingHeaders/runtime/ArrayPrototype.h: Copied from ForwardingHeaders/kjs/ArrayPrototype.h.
+        * ForwardingHeaders/runtime/BooleanObject.h: Copied from ForwardingHeaders/kjs/BooleanObject.h.
+        * ForwardingHeaders/runtime/CallData.h: Copied from ForwardingHeaders/kjs/CallData.h.
+        * ForwardingHeaders/runtime/ConstructData.h: Copied from ForwardingHeaders/kjs/ConstructData.h.
+        * ForwardingHeaders/runtime/DateInstance.h: Copied from ForwardingHeaders/kjs/DateInstance.h.
+        * ForwardingHeaders/runtime/Error.h: Copied from ForwardingHeaders/kjs/Error.h.
+        * ForwardingHeaders/runtime/FunctionConstructor.h: Copied from ForwardingHeaders/kjs/FunctionConstructor.h.
+        * ForwardingHeaders/runtime/FunctionPrototype.h: Copied from ForwardingHeaders/kjs/FunctionPrototype.h.
+        * ForwardingHeaders/runtime/InternalFunction.h: Copied from ForwardingHeaders/kjs/InternalFunction.h.
+        * ForwardingHeaders/runtime/JSArray.h: Copied from ForwardingHeaders/kjs/JSArray.h.
+        * ForwardingHeaders/runtime/JSFunction.h: Copied from ForwardingHeaders/kjs/JSFunction.h.
+        * ForwardingHeaders/runtime/JSGlobalObject.h: Copied from ForwardingHeaders/kjs/JSGlobalObject.h.
+        * ForwardingHeaders/runtime/JSNumberCell.h: Copied from ForwardingHeaders/kjs/JSNumberCell.h.
+        * ForwardingHeaders/runtime/JSObject.h: Copied from ForwardingHeaders/kjs/JSObject.h.
+        * ForwardingHeaders/runtime/JSString.h: Copied from ForwardingHeaders/kjs/JSString.h.
+        * ForwardingHeaders/runtime/JSValue.h: Copied from ForwardingHeaders/kjs/JSValue.h.
+        * ForwardingHeaders/runtime/ObjectPrototype.h: Copied from ForwardingHeaders/kjs/ObjectPrototype.h.
+        * ForwardingHeaders/runtime/PropertyMap.h: Copied from ForwardingHeaders/kjs/PropertyMap.h.
+        * ForwardingHeaders/runtime/PrototypeFunction.h: Copied from ForwardingHeaders/kjs/PrototypeFunction.h.
+        * ForwardingHeaders/runtime/StringObject.h: Copied from ForwardingHeaders/kjs/StringObject.h.
+        * ForwardingHeaders/runtime/StringObjectThatMasqueradesAsUndefined.h: Copied from ForwardingHeaders/kjs/StringObjectThatMasqueradesAsUndefined.h.
+        * ForwardingHeaders/runtime/StringPrototype.h: Copied from ForwardingHeaders/kjs/StringPrototype.h.
+        * ForwardingHeaders/runtime/StructureID.h: Copied from ForwardingHeaders/kjs/StructureID.h.
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        * bindings/js/JSClipboardCustom.cpp:
+        * bindings/js/JSConsoleCustom.cpp:
+        * bindings/js/JSCustomPositionCallback.h:
+        * bindings/js/JSCustomPositionErrorCallback.h:
+        * bindings/js/JSCustomSQLStatementCallback.h:
+        * bindings/js/JSCustomSQLStatementErrorCallback.h:
+        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
+        * bindings/js/JSCustomVoidCallback.h:
+        * bindings/js/JSCustomXPathNSResolver.h:
+        * bindings/js/JSDOMBinding.cpp:
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMGlobalObject.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDOMWindowShell.cpp:
+        * bindings/js/JSDatabaseCustom.cpp:
+        * bindings/js/JSEventListener.cpp:
+        * bindings/js/JSEventTarget.h:
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        * bindings/js/JSHistoryCustom.cpp:
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        * bindings/js/JSLocationCustom.cpp:
+        * bindings/js/JSNodeFilterCondition.h:
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        * bindings/objc/WebScriptObject.mm:
+        * bindings/objc/WebScriptObjectPrivate.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/NP_jsobject.cpp:
+        * bridge/c/c_instance.cpp:
+        * bridge/c/c_utility.cpp:
+        * bridge/c/c_utility.h:
+        * bridge/jni/jni_instance.cpp:
+        * bridge/jni/jni_jsobject.h:
+        * bridge/jni/jni_jsobject.mm:
+        * bridge/jni/jni_runtime.cpp:
+        * bridge/jni/jni_utility.cpp:
+        * bridge/jni/jni_utility.h:
+        * bridge/objc/objc_instance.mm:
+        * bridge/objc/objc_runtime.h:
+        * bridge/objc/objc_runtime.mm:
+        * bridge/objc/objc_utility.h:
+        * bridge/objc/objc_utility.mm:
+        * bridge/runtime.h:
+        * bridge/runtime_array.cpp:
+        * bridge/runtime_array.h:
+        * bridge/runtime_method.cpp:
+        * bridge/runtime_method.h:
+        * bridge/runtime_object.cpp:
+        * bridge/runtime_object.h:
+        * bridge/runtime_root.cpp:
+        * inspector/JavaScriptCallFrame.cpp:
+        * inspector/JavaScriptProfile.cpp:
+        * inspector/JavaScriptProfile.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        * inspector/JavaScriptProfileNode.h:
+        * loader/FrameLoader.cpp:
+        * page/Console.cpp:
+        * plugins/PluginView.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        * plugins/qt/PluginViewQt.cpp:
+        * plugins/win/PluginViewWin.cpp:
+
+2008-10-28  Adele Peterson  <adele@apple.com>
+
+        Windows build fix.  This removes Cairo include directories from non-Cairbo build configurations.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2008-10-28  Adele Peterson  <adele@apple.com>
+
+        Windows build fix.
+
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::ImageBuffer::create):
+
+2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Roll out a mistaken attempt at fixing the GTK build in r37947.
+
+        * GNUmakefile.am:
+
+2008-10-28  Adele Peterson  <adele@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21880
+        "files" string for multifile uploads needs to be localized
+
+        * page/mac/WebCoreViewFactory.h:
+        * platform/LocalizedStrings.h:
+        * platform/gtk/FileChooserGtk.cpp: (WebCore::FileChooser::basenameForWidth):
+        * platform/gtk/LocalizedStringsGtk.cpp: (WebCore::multipleFileUploadText):
+        * platform/mac/FileChooserMac.mm: (WebCore::FileChooser::basenameForWidth):
+        * platform/mac/LocalizedStringsMac.mm: (WebCore::multipleFileUploadText):
+        * platform/qt/Localizations.cpp: (WebCore::multipleFileUploadText):
+        * platform/wx/LocalizedStringsWx.cpp: (WebCore::multipleFileUploadText):
+
+2008-10-28  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21816
+
+        Remove platform ifdefs in ImageBuffer.h by moving platform specific code
+        into a new PlatformImageBuffer class. Move the static create function
+        into the header because it can be cross-platform. Initialization now
+        happens in the cunstructor which sets a flag that create uses to know
+        whether it should return null or not. I also made passing of IntSize
+        more consistent (always by reference).
+
+        This change also changes the ifdefs in GraphicsContext to allow Skia
+        ports to implement text drawing modes.
+
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::ImageBuffer::create):
+        (WebCore::ImageBuffer::size):
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBufferData::ImageBufferData):
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::~ImageBuffer):
+        (WebCore::ImageBuffer::image):
+        (WebCore::ImageBuffer::getImageData):
+        (WebCore::ImageBuffer::putImageData):
+        * platform/graphics/cairo/ImageBufferData.h:
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBufferData::ImageBufferData):
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::~ImageBuffer):
+        (WebCore::ImageBuffer::getImageData):
+        (WebCore::ImageBuffer::putImageData):
+        * platform/graphics/cg/ImageBufferData.h:
+        * platform/graphics/qt/ImageBufferData.h:
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBufferData::ImageBufferData):
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::~ImageBuffer):
+
+2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Fix the GTK build.
+
+        * GNUmakefile.am:
+
+2008-10-28  Cameron Zwarich  <zwarich@apple.com>
+
+        Not reviewed.
+
+        Another Qt build fix.
+
+        * WebCore.pro:
+
+2008-10-28  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by David Kilzer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21932
+        Add non-pointer constant lookups to SoftLinking.h
+
+        * platform/mac/SoftLinking.h:
+
+2008-10-28  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by David Kilzer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=2192
+        Missing semi-colons in Geoposition.idl
+
+        * page/Geoposition.idl: Add missing semi-colons
+
+2008-10-28  Timothy Hatcher  <timothy@apple.com>
+
+        Make the Profiles panel in the Web Inspector have an enable screen.
+        Profiling now needs to be enabled before console.profile() works.
+
+        <rdar://problem/6211578> Make the JavaScript profiler opt-in, so it does
+        not slow down JavaScript all the time
+
+        Reviewed by Darin Adler and Kevin McCullough.
+
+        * English.lproj/localizedStrings.js: New strings.
+        * WebCore.base.exp: New and changed exports.
+        * WebCore.vcproj/WebCore.vcproj: Add the PanelEnablerView.js file.
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::supportsProfiling): Call InspectorController:profilerEnabled.
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController): Initialize the m_startProfiling
+        Timer to call InspectorController::startUserInitiatedProfiling.
+        (WebCore::InspectorController::startUserInitiatedProfilingSoon): Start a one-shot timer
+        that calls InspectorController::startUserInitiatedProfiling.
+        (WebCore::InspectorController::startUserInitiatedProfiling): Recompile all JavaScript
+        and enable the profiler if the profiler was not enabled.
+        (WebCore::InspectorController::stopUserInitiatedProfiling): Rearrange code for readability.
+        (WebCore::InspectorController::enableProfiler): Recompile all the JavaScript functions
+        if the skipRecompile argument is false. Call the profilerWasEnabled script function.
+        (WebCore::InspectorController::disableProfiler): Recompile all the JavaScript functions.
+        Call the profilerWasEnabled script function.
+        (WebCore::InspectorController::disableDebugger): Set m_attachDebuggerWhenShown to false,
+        so it won't be started later.
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::profilerEnabled): Return enabled() && m_profilerEnabled.
+        * inspector/front-end/Images/debuggingButtons.png: Remove.
+        * inspector/front-end/Images/enableButtons.png: Added.
+        * inspector/front-end/Images/profilesSilhouette.png: Added.
+        * inspector/front-end/Images/scriptsSilhouette.png: Added.
+        * inspector/front-end/PanelEnablerView.js: Added.
+        (WebInspector.PanelEnablerView):
+        (WebInspector.PanelEnablerView.prototype._enableButtonCicked): Fire the "enable clicked"
+        event so listeners can do their thing.
+        (WebInspector.PanelEnablerView.prototype._windowResized): Test if the icon should be hidden.
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel): Create the PanelEnablerView and the strings needed for it.
+        (WebInspector.ProfilesPanel.prototype.get statusBarItems): Include the enableToggleButton.
+        (WebInspector.ProfilesPanel.prototype.profilerWasEnabled): Call reset and populateInterface.
+        (WebInspector.ProfilesPanel.prototype.profilerWasDisabled): Call reset.
+        (WebInspector.ProfilesPanel.prototype.reset): Call _updateInterface.
+        (WebInspector.ProfilesPanel.prototype.setRecordingProfile): Moved in the code, no changes.
+        (WebInspector.ProfilesPanel.prototype._updateInterface): Update the toggle button and
+        show/hide other buttons. Also show/hide the PanelEnablerView.
+        (WebInspector.ProfilesPanel.prototype._enableProfiling): Call _toggleProfiling if not enabled.
+        (WebInspector.ProfilesPanel.prototype._toggleProfiling): Call InspectorController's
+        disableProfiler or enableProfiler.
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel): Replace the overlay element with a PanelEnablerView. Replace the
+        debuggingButton with the enableToggleButton.
+        (WebInspector.ScriptsPanel.prototype.get statusBarItems): Replace the debuggingButton with
+        the enableToggleButton.
+        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons): Hide/show the pauseOnExceptionButton
+        when needed. Replace the overlay element with a PanelEnablerView. Replace the debuggingButton
+        with the enableToggleButton.
+        (WebInspector.ScriptsPanel.prototype._enableDebugging): Call _toggleDebugging when not enabled.
+        (WebInspector.ScriptsPanel.prototype._toggleDebugging): Remove the call to _clearInterface,
+        since reset is called from debuggerWasEnabled and debuggerWasDisabled.
+        * inspector/front-end/View.js: Inherit from WebInspector.Object.
+        * inspector/front-end/WebKit.qrc: Add the PanelEnablerView.js file.
+        * inspector/front-end/inspector.css: New styles for the PanelEnablerView.
+        * inspector/front-end/inspector.html: Add the PanelEnablerView.js file.
+        * inspector/front-end/inspector.js:
+        (WebInspector.profilerWasEnabled): Added. Calls the ProfilesPanel.
+        (WebInspector.profilerWasDisabled): Ditto.
+        * page/Console.cpp:
+        (WebCore::Console::error): Remove null check for m_frame, since m_frame isn't used.
+        (WebCore::Console::info): Ditto.
+        (WebCore::Console::log): Ditto.
+        (WebCore::Console::assertCondition): Ditto.
+        (WebCore::Console::dirxml): Remove null check for m_frame and use this->page().
+        (WebCore::Console::count): Ditto.
+        (WebCore::Console::profile): Return early if InspectorController::profilerEnabled is false.
+        (WebCore::Console::profileEnd): Ditto.
+        (WebCore::Console::warn): Remove null check for m_frame, since m_frame isn't used.
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Remove initialization of m_didInitializeDeveloperExtrasEnabled.
+        (WebCore::Settings::setDeveloperExtrasEnabled): Remove code that recompiled functions.
+        Now just sets the member boolean.
+        * page/Settings.h: Remove m_didInitializeDeveloperExtrasEnabled.
+
+2008-10-28  Timothy Hatcher  <timothy@apple.com>
+
+        Rename a few methods related to attaching and detaching the debugger. Also
+        adds stub methods for enabling and disabling the profiler.
+
+        * Rename attachDebugger to enableDebugger.
+        * Rename detachDebugger to disableDebugger.
+        * Rename the debuggerAttached getter to debuggerEnabled.
+        * Rename the debuggerAttached callback to debuggerWasEnabled.
+        * Rename the debuggerDetached callback to debuggerWasDisabled.
+
+        Reviewed by Darin Adler.
+
+        * WebCore.base.exp:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::close):
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
+        (WebCore::InspectorController::enableDebugger):
+        (WebCore::InspectorController::disableDebugger):
+        (WebCore::InspectorController::pauseInDebugger):
+        (WebCore::InspectorController::resumeDebugger):
+        (WebCore::InspectorController::stepOverStatementInDebugger):
+        (WebCore::InspectorController::stepIntoStatementInDebugger):
+        (WebCore::InspectorController::stepOutOfFunctionInDebugger):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::profilerEnabled):
+        (WebCore::InspectorController::debuggerEnabled):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointsSidebarPane.prototype.addBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype.removeBreakpoint):
+        (WebInspector.BreakpointsSidebarPane.prototype._breakpointEnableChanged):
+        * inspector/front-end/Object.js:
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.get statusBarItems):
+        (WebInspector.ScriptsPanel.prototype.debuggerWasEnabled):
+        (WebInspector.ScriptsPanel.prototype.debuggerWasDetached):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        (WebInspector.ScriptsPanel.prototype.canShowResource):
+        (WebInspector.ScriptsPanel.prototype._updatePauseOnExceptionsButton):
+        (WebInspector.ScriptsPanel.prototype._updateDebuggerButtons):
+        (WebInspector.ScriptsPanel.prototype._toggleDebugging):
+        * inspector/front-end/View.js:
+        * inspector/front-end/inspector.css:
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.addResource):
+        (WebInspector.debuggerWasEnabled):
+        (WebInspector.debuggerWasDisabled):
+
+2008-10-28  Timothy Hatcher  <timothy@apple.com>
+
+        Fix an exception when searching the Resources panel while there
+        and resources queued to be added to the list.
+
+        Reviewed by Kevin McCullough.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.searchCanceled): Null check
+        the _resourcesTreeElement property.
+        (WebInspector.ResourcesPanel.prototype.performSearch): Ditto.
+
+2008-10-28  Alp Toker  <alp@nuanti.com>
+
+        GTK+ build fix for older versions of Pango where PANGO_VERSION_CHECK
+        isn't defined.
+
+        * platform/graphics/gtk/FontGtk.cpp:
+        (WebCore::getDefaultPangoLayout):
+        * platform/graphics/gtk/FontPlatformDataPango.cpp:
+
+2008-10-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21893
+        Character set is incorrect for external scripts in XHTML pages
+
+        <rdar://problem/6317451> Incorrect encoding for text in a popup at http://xpoint.ru/
+
+        Test: fast/encoding/external-script-charset.xhtml
+
+        Expose scriptCharset() function on all ScriptElements, and call it from XML tokenizer.
+
+        * dom/ScriptElement.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::XMLTokenizer::endElementNs):
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::parseEndElement):
+        * html/HTMLScriptElement.h:
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::scriptCharset):
+        * svg/SVGScriptElement.h:
+
+2008-10-28  Alp Toker  <alp@nuanti.com>
+
+        Include copyright license files in the autotools dist target and
+        exclude unused zlib headers.
+
+        Change suggested by Mike Hommey.
+
+        * GNUmakefile.am:
+
+2008-10-27  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Clear the window shell when destroying a page to allow documents
+        which have no way of being reached anymore, to be torn down.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::pageDestroyed):
+
+2008-10-27  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Update the active state as well as the focused state as both need to be true
+        for the caret to be drawn.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21900
+
+        * WebView.cpp:
+        (wxWebView::OnSetFocus):
+        (wxWebView::OnKillFocus):
+
+2008-10-27  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix on Linux/GTK. Enable support for #include <JavaScriptCore/XYZ.h> style includes.
+
+        * webcore-wx.bkl:
+
+2008-10-27  Michael Knaup  <michael.knaup@mac.com>
+
+        Reviewed and tweaked by Darin Adler.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=8988
+
+        Bug 8988: Add support for Mozilla CSS custom cursors.
+        Added -webkit-grab and -webkit-grabbing cursor suppport
+        for the Mac, dummy implementations for other platforms.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Updated since the
+        -webkit-grabbing cursor is now the last one.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue): Added
+        CURSOR_WEBKIT_GRAB and CURSOR_WEBKIT_GRABBING.
+
+        * css/CSSValueKeywords.in: Added -webkit-grab and
+        -webkit-grabbing.
+
+        * manual-tests/cursor.html: Added -webkit-zoom-in,
+        webkit-zoom-out, -webkit-grab, and -webkit-grabbing.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::selectCursor): Added
+        CURSOR_WEBKIT_GRAB and CURSOR_WEBKIT_GRABBING.
+
+        * platform/Cursor.h: Added grabCursor and grabbingCursor.
+
+        * platform/gtk/CursorGtk.cpp:
+        (WebCore::grabCursor): Added.
+        (WebCore::grabbingCursor): Added.
+        * platform/mac/CursorMac.mm:
+        (WebCore::grabCursor): Added.
+        (WebCore::grabbingCursor): Added.
+        * platform/qt/CursorQt.cpp:
+        (WebCore::grabCursor): Added.
+        (WebCore::grabbingCursor): Added.
+        * platform/win/CursorWin.cpp:
+        (WebCore::grabCursor): Added.
+        (WebCore::grabbingCursor): Added.
+        * platform/wx/CursorWx.cpp:
+        (WebCore::grabCursor): Added.
+        (WebCore::grabbingCursor): Added.
+
+        * rendering/style/RenderStyleConstants.h:
+        Added CURSOR_WEBKIT_GRAB and CURSOR_WEBKIT_GRABBING.
+        Also broke ECursor out into a single constant per line.
+        Also added a couple of comments.
+
+2008-10-27  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        * svg/SVGAnimatedTemplate.h: needed a HashMap define
+
+2008-10-21  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Dave Hyatt.
+
+        Infinite recursion crash in WebCore::RenderSVGRoot::absoluteClippedOverflowRect on a <stop> element outside of a gradient block
+        https://bugs.webkit.org/show_bug.cgi?id=20400
+
+        Test: svg/custom/stop-crash.svg
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderSVGGradientStop.h:
+        (WebCore::RenderSVGGradientStop::absoluteClippedOverflowRect):
+
+2008-10-27  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        No need to call release if the connection is null.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+
+2008-10-27  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Kevin Decker.
+
+        <rdar://problem/6322650> Crash in fast/loader/simultaneous-reloads-assert.html
+
+        Make sure to null check the NSURLConnection object.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::setDefersLoading):
+
+2008-10-27  Alexey Proskuryakov  <ap@webkit.org>
+
+        Fix non-Mac builds.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+        Renamed JSHTMLOptionElementConstructor to JSOptionConstructor.
+
+2008-10-26  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21886
+        window.HTMLOptionElement == "[object HTMLElementConstructor]" instead of HTMLOptionElementConstructor
+
+        Test: fast/dom/HTMLOptionElement/option-prototype.html
+
+        We now have separate objects for window.Option and window.HTMLOptionElement - the latter
+        "constructor" cannot be used to construct anything. This matches Firefox behavior.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (jsDOMWindowBaseOption):
+        * bindings/js/JSHTMLOptionElementConstructor.cpp: Removed.
+        * bindings/js/JSHTMLOptionElementConstructor.h: Removed.
+        * bindings/js/JSOptionConstructor.cpp: Copied from WebCore/bindings/js/JSHTMLOptionElementConstructor.cpp.
+        * bindings/js/JSOptionConstructor.h: Copied from WebCore/bindings/js/JSHTMLOptionElementConstructor.h.
+        * html/HTMLOptionElement.idl:
+        Renamed JSHTMLOptionElementConstructor to JSOptionConstructor.
+
+        * html/HTMLOptionElement.idl: Generate a constructor.
+
+2008-10-25  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Try to fix Mac debug build on the buildbot.
+
+        * platform/FileChooser.cpp:
+        (WebCore::FileChooserClient::~FileChooserClient):
+        * platform/FileChooser.h: Moved destructor to .cpp file, to avoid a
+        weak exported symbol.
+
+2008-10-25  Jade Han  <jade.han@nokia.com>
+
+        Reviewed by Anders.
+
+        Enable custom properties for Qt runtime objects in QtWebKit
+
+        https://bugs.webkit.org/show_bug.cgi?id=21813
+
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::getOwnPropertySlot):
+        (JSC::RuntimeObjectImp::put):
+
+2008-10-24  Sam Weinig  <sam@webkit.org>
+
+        Fix windows build.
+
+        * page/Chrome.cpp:
+        * page/Chrome.h:
+
+2008-10-24  Sam Weinig  <sam@webkit.org>
+
+        Fix Qt build.
+
+        * platform/qt/FileChooserQt.cpp:
+
+2008-10-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=21759
+        Layering violation: FileChooser should not depend on Document/Frame/Page
+
+        Move file choosing into WebKit ChromeClient.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::runOpenPanel):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::runOpenPanel):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * page/mac/ChromeMac.mm:
+        * platform/FileChooser.h:
+        * platform/mac/FileChooserMac.mm:
+        * platform/qt/FileChooserQt.cpp:
+        * platform/win/FileChooserWin.cpp:
+        * platform/wx/TemporaryLinkStubs.cpp:
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::click):
+
+2008-10-24  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix - add newIconForFiles stub.
+
+        * platform/wx/TemporaryLinkStubs.cpp:
+        (Icon::newIconForFiles):
+
+2008-10-24  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier.
+
+        Use the CGFont metrics APIs for more accurate measurements, and tweak the y
+        value the text is drawn at (it was a couple pixels off before because wx
+        internally adds to the y value.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21853
+
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
+        (wxFontProperties::wxFontProperties):
+        * platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+
+2008-10-24  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Generate missing constructors and add test to prevent missing ones in the future
+        https://bugs.webkit.org/show_bug.cgi?id=21846
+
+        Test: fast/js/global-constructors.html
+
+        * css/CSSStyleSheet.idl:
+        * css/RGBColor.idl:
+        * dom/NodeIterator.idl:
+        * dom/TreeWalker.idl:
+        * xml/XPathExpression.idl:
+
+2008-10-24  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21836
+        REGRESSION: Sign-in on Fancast.com causes crash in Webkit nightly
+
+        Test: http/tests/xmlhttprequest/detaching-frame.html
+
+        * xml/XMLHttpRequest.cpp: (WebCore::XMLHttpRequest::dropProtection): Null check the window -
+        even though XHR needs a context (AKA frame) to be serviced, the frame may be disconnected
+        when dispatching the same callback that results in this function being called.
+
+2008-10-24  David Kilzer  <ddkilzer@apple.com>
+
+        Gtk build fix.
+
+        * platform/gtk/TemporaryLinkStubs.cpp:
+        (WebCore::setFocusRingColorChangeFunction): Removed in r37858.
+
+2008-10-24  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/6164952> Use constant kCGInterpolationMedium in GraphicsContextCG.cpp rather than hard-coded values.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::imageInterpolationQuality):
+
+2008-10-24  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/5440917> Support NPN_Construct
+
+        * WebCore.NPAPI.exp:
+        Export _NPN_Construct.
+
+        * bridge/NP_jsobject.cpp:
+        (_NPN_Construct):
+        Implement this.
+
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::supportsConstruct):
+        (JSC::Bindings::CInstance::invokeConstruct):
+        Have this call the appropriate NPClass method.
+
+        * bridge/npruntime.h:
+        Add NPN_Construct.
+
+        * bridge/npruntime_impl.h:
+        Add _NPN_Construct.
+
+        * bridge/runtime.h:
+        (JSC::Bindings::Instance::supportsConstruct):
+        (JSC::Bindings::Instance::invokeConstruct):
+        New methods.
+
+        * bridge/runtime_object.cpp:
+        (JSC::callRuntimeConstructor):
+        Call the native instance.
+
+        (JSC::RuntimeObjectImp::getConstructData):
+        Implement this.
+
+        * bridge/runtime_object.h:
+        Add new method declarations.
+
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::PluginPackage::load):
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::load):
+        * plugins/win/PluginPackageWin.cpp:
+        (WebCore::PluginPackage::load):
+        Initialize m_pluginFuncs.construct.
+
+2008-10-24  Adele Peterson  <adele@apple.com>
+
+        Build fix.
+
+        * platform/FileChooser.h: (WebCore::FileChooserClient::~FileChooserClient):
+        * platform/graphics/mac/IconMac.mm: (WebCore::Icon::newIconForFiles):
+
+2008-10-24  Greg Bolsinga  <bolsinga@apple.com>
+
+        Fix GTK build break.
+
+        Reviewed by David Kilzer.
+
+        * GNUmakefile.am: Do not include .idl files whose generated files should not be
+        compiled.
+
+2008-10-24  David Kilzer  <ddkilzer@apple.com>
+
+        Wx build fix.
+
+        * platform/wx/TemporaryLinkStubs.cpp:
+        (WebCore::setFocusRingColorChangeFunction): Removed in r37858.
+
+2008-10-24  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        WebCore part of fix for <rdar://problem/5839256> FILE CONTROL: multi-file upload.
+
+        This change adds support for multiple file selection in an <input type="file"> control when the "multiple" attribute is used.
+        This is consistent with the direction HTML5 will be going in the future.
+
+        The initial implementation here will show "n files" as the text next to the control when multiple files are selected.  You can view
+        the individual files in a tooltip for now.  Improvements to this control will come later.
+
+        Web developers will be able to access the FileList from the HTMLInputElement element, where they can get a base name and a size for each file.
+        These FileList Files can also be sent in an XMLHTTPRequest.
+
+        * manual-tests/post-multi-file-upload.html: Added.
+        * manual-tests/resources/multiFileResources: Added.
+        * manual-tests/resources/multiFileResources/post-echo-and-notify-done.cgi: Added.
+        * manual-tests/resources/multiFileResources/testFile1.html: Added.
+        * manual-tests/resources/multiFileResources/testFile2.html: Added.
+        * manual-tests/resources/multiFileResources/testFile3.html: Added.
+
+        * WebCore.base.exp: Added support to export the new "chooseFilenames" method to be used in WebKit.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute): Add support for the multiple attribute.
+        (WebCore::HTMLInputElement::value): Added comments.  The HTML5 spec says that value shouldn't apply for the file upload control,
+        but we don't want to break the behavior for existing websites that may rely on this.
+        (WebCore::HTMLInputElement::setValue): ditto.
+        (WebCore::HTMLInputElement::setValueFromRenderer): This is no longer used for file upload controls. setFileListFromRenderer is used instead.
+        (WebCore::HTMLInputElement::setFileListFromRenderer): Added.
+        * html/HTMLInputElement.h:
+
+        * page/Chrome.cpp: (WebCore::Chrome::setToolTip): Show a tooltip with the file name list for the multi-file upload control.
+
+        * page/DragController.cpp: (WebCore::DragController::concludeDrag): Updated to support multiple files.
+
+        * platform/FileChooser.cpp: Add support for maintaining a list of file paths that can be retrieved by the renderer.
+        (WebCore::FileChooser::FileChooser):
+        (WebCore::FileChooser::create):
+        (WebCore::FileChooser::clear):
+        (WebCore::FileChooser::chooseFile):
+        (WebCore::FileChooser::chooseFiles):
+        (WebCore::FileChooser::chooseIcon):
+        * platform/FileChooser.h:
+        (WebCore::FileChooser::filePaths):
+        (WebCore::FileChooser::allowsMultipleFiles):
+
+        * platform/graphics/Icon.h:
+        * platform/graphics/mac/IconMac.mm: (WebCore::Icon::newIconForFiles): Returns a generic icon for multiple files.
+        * platform/graphics/gtk/IconGtk.cpp: (WebCore::Icon::newIconForFiles): stubbed out.
+        * platform/graphics/qt/IconQt.cpp: (WebCore::Icon::newIconForFiles): ditto.
+        * platform/graphics/win/IconWin.cpp: (WebCore::Icon::newIconForFiles): ditto.
+
+        * platform/gtk/FileChooserGtk.cpp: (WebCore::FileChooser::basenameForWidth):  Updated to deal with new filenames vector.
+        * platform/mac/FileChooserMac.mm: (WebCore::FileChooser::basenameForWidth): ditto.
+        * platform/qt/FileChooserQt.cpp:
+        (WebCore::FileChooser::openFileChooser):
+        (WebCore::FileChooser::basenameForWidth):
+        * platform/win/FileChooserWin.cpp: (WebCore::FileChooser::basenameForWidth):
+
+        * platform/network/mac/FormDataStreamMac.mm: (WebCore::disassociateStreamWithResourceHandle):
+        Removed unnecessary assertion.  This can get hit when connectionDidFinishLoading and cancel
+        both get called for the same ResourceHandle.  This getting called twice has no negative effect.
+
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::valueChanged):  Calls setFileListFromRenderer.
+        (WebCore::RenderFileUploadControl::allowsMultipleFiles):  Added.
+        (WebCore::RenderFileUploadControl::updateFromElement):  Uses the new filenames call from FileChooser.
+        (WebCore::RenderFileUploadControl::receiveDroppedFiles):  Updated to support multiple files.
+        * rendering/RenderFileUploadControl.h:
+
+2008-10-23  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21844
+        Remove setFocusRingColorChangeFunction.
+
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        * platform/graphics/Color.h:
+        * platform/graphics/mac/ColorMac.mm:
+        (WebCore::focusRingColor):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        * platform/graphics/win/ColorSafari.cpp:
+
+2008-10-24  David Kilzer  <ddkilzer@apple.com>
+
+        Build fix for Qt.
+
+        Reviewed by Greg.
+
+        * WebCore.pro: Added missing *.idl files.
+
+2008-10-24  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21475
+
+        Provide support for the Geolocation API
+
+        http://dev.w3.org/geo/api/spec-source.html
+
+        Test: geolocation/geolocation-not-implemented.html
+
+        * DerivedSources.make:
+        * GNUmakefile.am: Added Geolocation support
+        * WebCore.pro: Added Geolocation support
+        * WebCore.vcproj/WebCore.vcproj: Added Geolocation support
+        * WebCore.xcodeproj/project.pbxproj: Added Geolocation support
+        * WebCoreSources.bkl: Added Geolocation support
+        * bindings/js/JSCustomPositionCallback.cpp: Added.
+        (WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionCallback.h: Added.
+        (WebCore::JSCustomPositionCallback::create):
+        * bindings/js/JSCustomPositionErrorCallback.cpp: Added.
+        (WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.h: Added.
+        (WebCore::JSCustomPositionErrorCallback::create):
+        * bindings/js/JSDOMBinding.cpp: move markDOMObjectWrapper here from JSDOMWindowCustom
+        (WebCore::markDOMObjectWrapper):
+        * bindings/js/JSDOMBinding.h: move markDOMObjectWrapper here from JSDOMWindowCustom
+        * bindings/js/JSDOMWindowCustom.cpp: move markDOMObjectWrapper to JSDOMBinding
+        * bindings/js/JSGeolocationCustom.cpp: Added.
+        (WebCore::JSGeolocation::getCurrentPosition):
+        (WebCore::JSGeolocation::watchPosition):
+        * bindings/js/JSNavigatorCustom.cpp: handle marking Geolocation
+        (WebCore::JSNavigator::mark):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
+        (WebCore::Document::setUsingGeolocation):
+        (WebCore::Document::usingGeolocation):
+        * loader/FrameLoader.cpp: don't add to back forward cache if using Geolocation
+        (WebCore::FrameLoader::canCachePage):
+        * page/Geolocation.cpp: Added.
+        (WebCore::Geolocation::GeoNotifier::GeoNotifier):
+        (WebCore::Geolocation::GeoNotifier::timerFired):
+        (WebCore::Geolocation::Geolocation):
+        (WebCore::Geolocation::disconnectFrame):
+        (WebCore::Geolocation::getCurrentPosition):
+        (WebCore::Geolocation::watchPosition):
+        (WebCore::Geolocation::clearWatch):
+        (WebCore::Geolocation::stopUpdatingIfEmpty):
+        (WebCore::Geolocation::sendErrorToOneShots):
+        (WebCore::Geolocation::sendErrorToWatchers):
+        (WebCore::Geolocation::sendPositionToOneShots):
+        (WebCore::Geolocation::sendPositionToWatchers):
+        (WebCore::Geolocation::handleError):
+        (WebCore::Geolocation::geolocationServicePositionChanged):
+        (WebCore::Geolocation::geolocationServiceErrorOccurred):
+        * page/Geolocation.h: Added.
+        (WebCore::Geolocation::create):
+        (WebCore::Geolocation::~Geolocation):
+        (WebCore::Geolocation::lastPosition):
+        (WebCore::Geolocation::GeoNotifier::create):
+        * page/Geolocation.idl: Added.
+        * page/Geoposition.cpp: Added.
+        (WebCore::Geoposition::toString):
+        * page/Geoposition.h: Added.
+        (WebCore::Geoposition::create):
+        (WebCore::Geoposition::latitude):
+        (WebCore::Geoposition::longitude):
+        (WebCore::Geoposition::altitude):
+        (WebCore::Geoposition::accuracy):
+        (WebCore::Geoposition::altitudeAccuracy):
+        (WebCore::Geoposition::heading):
+        (WebCore::Geoposition::velocity):
+        (WebCore::Geoposition::timestamp):
+        (WebCore::Geoposition::Geoposition):
+        * page/Geoposition.idl: Added.
+        * page/Navigator.cpp:
+        (WebCore::Navigator::disconnectFrame): disconnect Geolocation
+        (WebCore::Navigator::geolocation): accessor for Geolocation
+        * page/Navigator.h:
+        (WebCore::Navigator::optionalGeolocation): accessor for Geolocation
+        * page/Navigator.idl: accessor for Geolocation
+        * page/PositionCallback.h: Added.
+        (WebCore::PositionCallback::~PositionCallback):
+        * page/PositionCallback.idl: Added.
+        * page/PositionError.h: Added.
+        (WebCore::PositionError::):
+        (WebCore::PositionError::create):
+        (WebCore::PositionError::code):
+        (WebCore::PositionError::message):
+        (WebCore::PositionError::PositionError):
+        * page/PositionError.idl: Added.
+        * page/PositionErrorCallback.h: Added.
+        (WebCore::PositionErrorCallback::~PositionErrorCallback):
+        * page/PositionErrorCallback.idl: Added.
+        * page/PositionOptions.h: Added.
+        (WebCore::PositionOptions::create):
+        (WebCore::PositionOptions::enableHighAccuracy):
+        (WebCore::PositionOptions::setEnableHighAccuracy):
+        (WebCore::PositionOptions::timeout):
+        (WebCore::PositionOptions::setTimeout):
+        (WebCore::PositionOptions::PositionOptions):
+        * page/PositionOptions.idl: Added.
+        * platform/GeolocationService.cpp: Added.
+        (WebCore::GeolocationService::GeolocationService):
+        (WebCore::GeolocationService::positionChanged):
+        (WebCore::GeolocationService::errorOccurred):
+        * platform/GeolocationService.h: Added.
+        (WebCore::GeolocationServiceClient::~GeolocationServiceClient):
+        (WebCore::GeolocationServiceClient::geolocationServicePositionChanged):
+        (WebCore::GeolocationServiceClient::geolocationServiceErrorOccurred):
+        (WebCore::GeolocationService::~GeolocationService):
+
+2008-10-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=21818
+
+        Add HashTraits for AtomicString so that AtomicString can be used as
+        the key for a HashMap or HashSet.
+
+        * GNUmakefile.am: add AtomicStringHash.h
+        * WebCore.vcproj/WebCore.vcproj: add AtomicStringHash.h
+        * WebCore.xcodeproj/project.pbxproj: add AtomicStringHash.h
+        * platform/text/AtomicString.h:
+        (WebCore::AtomicString::AtomicString):
+        (WebCore::AtomicString::isHashTableDeletedValue):
+            specialize DefaultHash for AtomicString to use AtomicStringHash
+        * platform/text/AtomicStringHash.h: Added.
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::StringImpl):
+            compute the hash up-front for the empty string
+        * platform/text/StringImpl.h:
+        (WebCore::StringImpl::existingHash):
+            method to get the hash without a test and branch, for callers like
+            AtomicStringHash who can guarantee that the hash has already been computed.
+
+2008-10-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Sam Weinig
+
+        https://bugs.webkit.org/show_bug.cgi?id=21857
+
+        Add WebKitCSSKeyframeRule and WebKitCSSKeyframesRule to the
+        switch in _wrapCSSRule.
+
+        * bindings/objc/DOMCSS.mm:
+        (+[DOMCSSRule _wrapCSSRule:WebCore::]):
+
+2008-10-24  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * plugins/PluginView.cpp:
+
+2008-10-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=21851
+          <rdar://problem/6304151> REGRESSION (r36513): Crash when removing a widget with percent height
+
+        Test: fast/replaced/percent-height-in-anonymous-block-widget.html
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy): Copied code added to
+        RenderBox::destroy() in r36513 into this function.
+
+2008-10-24  Timothy Hatcher  <timothy@apple.com>
+
+        Add a mechanism to ask the InspectorClient for key/value setting pairs.
+        These settings can be strings, numbers, booleans or string vectors. The
+        settings are also bridged to and from JavaScript.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21856
+
+        Reviewed by Darin Adler.
+
+        * WebCore.base.exp: Expose the String CFStringRef constructor.
+        * inspector/InspectorClient.h:
+        (WebCore::InspectorClient::populateSetting): Added, pure virtual.
+        (WebCore::InspectorClient::storeSetting): Ditto.
+        (WebCore::InspectorClient::removeSetting): Ditto.
+        * inspector/InspectorController.cpp:
+        (WebCore::setting): Calls InspectorController::setting and wraps the result in script types.
+        (WebCore::setSetting): Calls InspectorController::setSetting after converting from script types.
+        (WebCore::InspectorController::InspectorController): Increment a global static
+        to track the number of live InspectorControllers.
+        (WebCore::InspectorController::~InspectorController): Decrement the global static
+        that tracks the number of live InspectorControllers. Delete the setting cache if there
+        are no more live controllers.
+        (WebCore::InspectorController::setting): Check the cache and return the setting from there,
+        otherwise make a new Setting and ask the client to populate it.
+        (WebCore::InspectorController::setSetting): Change the cache and ask the client to store it.
+        (WebCore::InspectorController::windowScriptObjectAvailable): Add setting and setSetting
+        to the InspectorController script class.
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::Setting::Setting):
+        (WebCore::InspectorController::Setting::operator=):
+        (WebCore::InspectorController::Setting::type): Return m_type.
+        (WebCore::InspectorController::Setting::string): Return m_string. Assert the type is correct.
+        (WebCore::InspectorController::Setting::stringVector): Return m_stringVector.
+        Assert the type is correct.
+        (WebCore::InspectorController::Setting::doubleValue): Return m_simpleContent.m_double.
+        Assert the type is correct.
+        (WebCore::InspectorController::Setting::integerValue): Return m_simpleContent.m_integer.
+        Assert the type is correct.
+        (WebCore::InspectorController::Setting::booleanValue): Return m_simpleContent.m_boolean.
+        Assert the type is correct.
+        (WebCore::InspectorController::Setting::set): Overloaded for each data type, sets the right
+        field and the type.
+        * loader/EmptyClients.h:
+        (WebCore::EmptyInspectorClient::populateSetting): Added, empty method.
+        (WebCore::EmptyInspectorClient::storeSetting): Ditto.
+        (WebCore::EmptyInspectorClient::removeSetting): Ditto.
+
+2008-10-24  Cameron Zwarich  <zwarich@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove some C-style casts.
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::addViewSourceToken):
+
+2008-10-24  Darin Adler  <darin@apple.com>
+
+        - finish rolling out https://bugs.webkit.org/show_bug.cgi?id=21732
+
+        * bindings/js/JSAttrCustom.cpp:
+        * bindings/js/JSCSSRuleCustom.cpp:
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        * bindings/js/JSCSSValueCustom.cpp:
+        * bindings/js/JSCanvasPixelArrayCustom.h:
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        * bindings/js/JSClipboardCustom.cpp:
+        * bindings/js/JSConsoleCustom.cpp:
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        * bindings/js/JSCustomVoidCallback.cpp:
+        * bindings/js/JSCustomVoidCallback.h:
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        * bindings/js/JSCustomXPathNSResolver.h:
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        * bindings/js/JSDOMBinding.cpp:
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDOMWindowCustom.h:
+        * bindings/js/JSDOMWindowShell.cpp:
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSDatabaseCustom.cpp:
+        * bindings/js/JSDedicatedWorkerCustom.cpp:
+        * bindings/js/JSDocumentCustom.cpp:
+        * bindings/js/JSElementCustom.cpp:
+        * bindings/js/JSEventCustom.cpp:
+        * bindings/js/JSEventListener.cpp:
+        * bindings/js/JSEventTarget.cpp:
+        * bindings/js/JSEventTarget.h:
+        * bindings/js/JSEventTargetBase.h:
+        * bindings/js/JSEventTargetNodeCustom.cpp:
+        * bindings/js/JSHTMLAllCollection.h:
+        * bindings/js/JSHTMLAppletElementCustom.cpp:
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        * bindings/js/JSHTMLEmbedElementCustom.cpp:
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        * bindings/js/JSHTMLFrameElementCustom.cpp:
+        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
+        * bindings/js/JSHTMLIFrameElementCustom.cpp:
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        * bindings/js/JSHTMLObjectElementCustom.cpp:
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        * bindings/js/JSHTMLSelectElementCustom.cpp:
+        * bindings/js/JSHTMLSelectElementCustom.h:
+        * bindings/js/JSHistoryCustom.cpp:
+        * bindings/js/JSImageDataCustom.cpp:
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        * bindings/js/JSInspectedObjectWrapper.h:
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        * bindings/js/JSInspectorCallbackWrapper.h:
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        * bindings/js/JSLocationCustom.cpp:
+        * bindings/js/JSMessagePortCustom.cpp:
+        * bindings/js/JSMimeTypeArrayCustom.cpp:
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        * bindings/js/JSNamedNodesCollection.cpp:
+        * bindings/js/JSNamedNodesCollection.h:
+        * bindings/js/JSNavigatorCustom.cpp:
+        * bindings/js/JSNodeCustom.cpp:
+        * bindings/js/JSNodeFilterCondition.cpp:
+        * bindings/js/JSNodeFilterCondition.h:
+        * bindings/js/JSNodeFilterCustom.cpp:
+        * bindings/js/JSNodeIteratorCustom.cpp:
+        * bindings/js/JSNodeListCustom.cpp:
+        * bindings/js/JSPluginArrayCustom.cpp:
+        * bindings/js/JSPluginCustom.cpp:
+        * bindings/js/JSPluginElementFunctions.cpp:
+        * bindings/js/JSPluginElementFunctions.h:
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSRGBColor.cpp:
+        * bindings/js/JSRGBColor.h:
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        * bindings/js/JSSVGLengthCustom.cpp:
+        * bindings/js/JSSVGMatrixCustom.cpp:
+        * bindings/js/JSSVGPathSegCustom.cpp:
+        * bindings/js/JSSVGPathSegListCustom.cpp:
+        * bindings/js/JSSVGPointListCustom.cpp:
+        * bindings/js/JSSVGTransformListCustom.cpp:
+        * bindings/js/JSStorageCustom.cpp:
+        * bindings/js/JSStyleSheetCustom.cpp:
+        * bindings/js/JSStyleSheetListCustom.cpp:
+        * bindings/js/JSTextCustom.cpp:
+        * bindings/js/JSTreeWalkerCustom.cpp:
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        * bindings/js/JSXSLTProcessorCustom.cpp:
+        * bindings/js/ScheduledAction.cpp:
+        * bindings/js/ScheduledAction.h:
+        * bindings/js/ScriptController.cpp:
+        * bindings/js/ScriptController.h:
+        * bindings/objc/WebScriptObject.mm:
+        * bindings/objc/WebScriptObjectPrivate.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/NP_jsobject.cpp:
+        * bridge/c/c_instance.cpp:
+        * bridge/c/c_instance.h:
+        * bridge/c/c_runtime.cpp:
+        * bridge/c/c_runtime.h:
+        * bridge/c/c_utility.cpp:
+        * bridge/c/c_utility.h:
+        * bridge/jni/jni_instance.cpp:
+        * bridge/jni/jni_instance.h:
+        * bridge/jni/jni_jsobject.h:
+        * bridge/jni/jni_jsobject.mm:
+        * bridge/jni/jni_objc.mm:
+        * bridge/jni/jni_runtime.cpp:
+        * bridge/jni/jni_runtime.h:
+        * bridge/jni/jni_utility.cpp:
+        * bridge/jni/jni_utility.h:
+        * bridge/objc/WebScriptObject.h:
+        * bridge/objc/objc_class.h:
+        * bridge/objc/objc_class.mm:
+        * bridge/objc/objc_instance.h:
+        * bridge/objc/objc_instance.mm:
+        * bridge/objc/objc_runtime.h:
+        * bridge/objc/objc_runtime.mm:
+        * bridge/objc/objc_utility.h:
+        * bridge/objc/objc_utility.mm:
+        * bridge/qt/qt_class.cpp:
+        * bridge/qt/qt_class.h:
+        * bridge/qt/qt_instance.cpp:
+        * bridge/qt/qt_instance.h:
+        * bridge/qt/qt_runtime.cpp:
+        * bridge/qt/qt_runtime.h:
+        * bridge/runtime.cpp:
+        * bridge/runtime.h:
+        * bridge/runtime_array.cpp:
+        * bridge/runtime_array.h:
+        * bridge/runtime_method.cpp:
+        * bridge/runtime_method.h:
+        * bridge/runtime_object.cpp:
+        * bridge/runtime_object.h:
+        * bridge/testqtbindings.cpp:
+        * inspector/JavaScriptCallFrame.cpp:
+        * inspector/JavaScriptCallFrame.h:
+        * inspector/JavaScriptProfile.cpp:
+        * inspector/JavaScriptProfile.h:
+        * inspector/JavaScriptProfileNode.cpp:
+        * inspector/JavaScriptProfileNode.h:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * page/Console.cpp:
+        * page/Console.h:
+        * plugins/MimeTypeArray.h:
+        * plugins/Plugin.h:
+        * plugins/PluginArray.h:
+        * plugins/PluginView.cpp:
+        * xml/XMLHttpRequest.cpp:
+        Use JSValue* instead of JSValuePtr.
+
+2008-10-24  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the Qt build.
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtField::valueFromInstance):
+
+2008-10-24  David Kilzer  <ddkilzer@apple.com>
+
+        Rolled out r37840 and r37841.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSCustomPositionCallback.cpp: Removed.
+        * bindings/js/JSCustomPositionCallback.h: Removed.
+        * bindings/js/JSCustomPositionErrorCallback.cpp: Removed.
+        * bindings/js/JSCustomPositionErrorCallback.h: Removed.
+        * bindings/js/JSDOMBinding.cpp:
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::markDOMObjectWrapper):
+        * bindings/js/JSGeolocationCustom.cpp: Removed.
+        * bindings/js/JSNavigatorCustom.cpp:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::canCachePage):
+        * page/Geolocation.cpp: Removed.
+        * page/Geolocation.h: Removed.
+        * page/Geolocation.idl: Removed.
+        * page/Geoposition.cpp: Removed.
+        * page/Geoposition.h: Removed.
+        * page/Geoposition.idl: Removed.
+        * page/Navigator.cpp:
+        (WebCore::Navigator::disconnectFrame):
+        * page/Navigator.h:
+        * page/Navigator.idl:
+        * page/PositionCallback.h: Removed.
+        * page/PositionCallback.idl: Removed.
+        * page/PositionError.h: Removed.
+        * page/PositionError.idl: Removed.
+        * page/PositionErrorCallback.h: Removed.
+        * page/PositionErrorCallback.idl: Removed.
+        * page/PositionOptions.h: Removed.
+        * page/PositionOptions.idl: Removed.
+        * platform/GeolocationService.cpp: Removed.
+        * platform/GeolocationService.h: Removed.
+
+2008-10-23  David Kilzer  <ddkilzer@apple.com>
+
+        Attempt to fix GTK build.
+
+        * GNUmakefile.am: Added new *.idl files that were missing.
+
+2008-10-23  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21475
+
+        Provide support for the Geolocation API
+
+        http://dev.w3.org/geo/api/spec-source.html
+
+        Test: geolocation/geolocation-not-implemented.html
+
+        * DerivedSources.make:
+        * GNUmakefile.am: Added Geolocation support
+        * WebCore.pro: Added Geolocation support
+        * WebCore.vcproj/WebCore.vcproj: Added Geolocation support
+        * WebCore.xcodeproj/project.pbxproj: Added Geolocation support
+        * WebCoreSources.bkl: Added Geolocation support
+        * bindings/js/JSCustomPositionCallback.cpp: Added.
+        (WebCore::JSCustomPositionCallback::JSCustomPositionCallback):
+        (WebCore::JSCustomPositionCallback::handleEvent):
+        * bindings/js/JSCustomPositionCallback.h: Added.
+        (WebCore::JSCustomPositionCallback::create):
+        * bindings/js/JSCustomPositionErrorCallback.cpp: Added.
+        (WebCore::JSCustomPositionErrorCallback::JSCustomPositionErrorCallback):
+        (WebCore::JSCustomPositionErrorCallback::handleEvent):
+        * bindings/js/JSCustomPositionErrorCallback.h: Added.
+        (WebCore::JSCustomPositionErrorCallback::create):
+        * bindings/js/JSDOMBinding.cpp: move markDOMObjectWrapper here from JSDOMWindowCustom
+        (WebCore::markDOMObjectWrapper):
+        * bindings/js/JSDOMBinding.h: move markDOMObjectWrapper here from JSDOMWindowCustom
+        * bindings/js/JSDOMWindowCustom.cpp: move markDOMObjectWrapper to JSDOMBinding
+        * bindings/js/JSGeolocationCustom.cpp: Added.
+        (WebCore::JSGeolocation::getCurrentPosition):
+        (WebCore::JSGeolocation::watchPosition):
+        * bindings/js/JSNavigatorCustom.cpp: handle marking Geolocation
+        (WebCore::JSNavigator::mark):
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        * dom/Document.h:
+        (WebCore::Document::setUsingGeolocation):
+        (WebCore::Document::usingGeolocation):
+        * loader/FrameLoader.cpp: don't add to back forward cache if using Geolocation
+        (WebCore::FrameLoader::canCachePage):
+        * page/Geolocation.cpp: Added.
+        (WebCore::Geolocation::GeoNotifier::GeoNotifier):
+        (WebCore::Geolocation::GeoNotifier::timerFired):
+        (WebCore::Geolocation::Geolocation):
+        (WebCore::Geolocation::disconnectFrame):
+        (WebCore::Geolocation::getCurrentPosition):
+        (WebCore::Geolocation::watchPosition):
+        (WebCore::Geolocation::clearWatch):
+        (WebCore::Geolocation::stopUpdatingIfEmpty):
+        (WebCore::Geolocation::sendErrorToOneShots):
+        (WebCore::Geolocation::sendErrorToWatchers):
+        (WebCore::Geolocation::sendPositionToOneShots):
+        (WebCore::Geolocation::sendPositionToWatchers):
+        (WebCore::Geolocation::handleError):
+        (WebCore::Geolocation::geolocationServicePositionChanged):
+        (WebCore::Geolocation::geolocationServiceErrorOccurred):
+        * page/Geolocation.h: Added.
+        (WebCore::Geolocation::create):
+        (WebCore::Geolocation::~Geolocation):
+        (WebCore::Geolocation::lastPosition):
+        (WebCore::Geolocation::GeoNotifier::create):
+        * page/Geolocation.idl: Added.
+        * page/Geoposition.cpp: Added.
+        (WebCore::Geoposition::toString):
+        * page/Geoposition.h: Added.
+        (WebCore::Geoposition::create):
+        (WebCore::Geoposition::latitude):
+        (WebCore::Geoposition::longitude):
+        (WebCore::Geoposition::altitude):
+        (WebCore::Geoposition::accuracy):
+        (WebCore::Geoposition::altitudeAccuracy):
+        (WebCore::Geoposition::heading):
+        (WebCore::Geoposition::velocity):
+        (WebCore::Geoposition::timestamp):
+        (WebCore::Geoposition::Geoposition):
+        * page/Geoposition.idl: Added.
+        * page/Navigator.cpp:
+        (WebCore::Navigator::disconnectFrame): disconnect Geolocation
+        (WebCore::Navigator::geolocation): accessor for Geolocation
+        * page/Navigator.h:
+        (WebCore::Navigator::optionalGeolocation): accessor for Geolocation
+        * page/Navigator.idl: accessor for Geolocation
+        * page/PositionCallback.h: Added.
+        (WebCore::PositionCallback::~PositionCallback):
+        * page/PositionCallback.idl: Added.
+        * page/PositionError.h: Added.
+        (WebCore::PositionError::):
+        (WebCore::PositionError::create):
+        (WebCore::PositionError::code):
+        (WebCore::PositionError::message):
+        (WebCore::PositionError::PositionError):
+        * page/PositionError.idl: Added.
+        * page/PositionErrorCallback.h: Added.
+        (WebCore::PositionErrorCallback::~PositionErrorCallback):
+        * page/PositionErrorCallback.idl: Added.
+        * page/PositionOptions.h: Added.
+        (WebCore::PositionOptions::create):
+        (WebCore::PositionOptions::enableHighAccuracy):
+        (WebCore::PositionOptions::setEnableHighAccuracy):
+        (WebCore::PositionOptions::timeout):
+        (WebCore::PositionOptions::setTimeout):
+        (WebCore::PositionOptions::PositionOptions):
+        * page/PositionOptions.idl: Added.
+        * platform/GeolocationService.cpp: Added.
+        (WebCore::GeolocationService::GeolocationService):
+        (WebCore::GeolocationService::positionChanged):
+        (WebCore::GeolocationService::errorOccurred):
+        * platform/GeolocationService.h: Added.
+        (WebCore::GeolocationServiceClient::~GeolocationServiceClient):
+        (WebCore::GeolocationServiceClient::geolocationServicePositionChanged):
+        (WebCore::GeolocationServiceClient::geolocationServiceErrorOccurred):
+        (WebCore::GeolocationService::~GeolocationService):
+
+2008-10-23  Alp Toker  <alp@nuanti.com>
+
+        Fix typo in comment in previous commit. GTK -> GLIB
+
+        * platform/gtk/guriescape.c:
+
+2008-10-23  Kalle Vahlman  <kalle.vahlman@movial.com>
+
+        Reviewed by Alp Toker.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21824
+        [GTK] FileSystem abstraction uses features from Glib 2.16
+
+        Wrap g_uri_unescape_string() to fix building with pre-2.16 Glib
+
+        * platform/gtk/guriescape.c:
+        (unescape_character):
+        (_webcore_g_uri_unescape_segment):
+        (_webcore_g_uri_unescape_string):
+        * platform/gtk/guriescape.h:
+
+2008-10-23  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Fix Gtk build typo introduced in http://trac.webkit.org/changeset/37826.
+
+        * GNUmakefile.am:
+
+2008-10-23  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        m_frame null checked but then dereferenced
+        https://bugs.webkit.org/show_bug.cgi?id=21845
+
+        This error was found using a static analysis tool, and so I do not know
+        how to produce a null m_frame on entry to this method.  Hence, I have
+        not included a regression test.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::allowDHTMLDrag): Add an early return.
+
+2008-10-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig with no hesitation.
+
+        - fix the HTML/CSS case of https://bugs.webkit.org/show_bug.cgi?id=19839
+          <rdar://problem/6304805> A PDF,RLE sequence that should be a no-op affects bidi reordering
+
+        Test: fast/text/bidi-embedding-pop-and-push-same.html
+
+        * platform/text/BidiResolver.h:
+        (WebCore::BidiResolver::embed): Changed to only add the embedding
+        operation to a vector of pending operations.
+
+        (WebCore::BidiResolver::lowerExplicitEmbeddingLevel): Added. Moved the
+        code that used to be in the PDF case of embed() here, except the part
+        that sets the context.
+
+        (WebCore::BidiResolver::raiseExplicitEmbeddingLevel): Added. Moved the
+        code that used to be in the non-PDF case of embed() here, except the
+        part the sets the context.
+
+        (WebCore::BidiResolver::commitExplicitEmbedding): Added. Processes the
+        explicit embedding operations in the vector by creating an updated
+        context and determining the old and new embedding levels. If the levels
+        are not the same, calls {lower,raise}ExplicitEmbeddingLevel(). Always
+        sets the context to the new one.
+
+        (WebCore::BidiResolver::createBidiRunsForLine): Added calls to
+        commitExplicitEmbedding() after calling embed() and after calling
+        increment().
+
+        * rendering/bidi.cpp:
+        (WebCore::bidiFirst): Added calls to commitExplicitEmbedding() because
+        this function increments the resolver.
+
+        (WebCore::RenderBlock::skipLeadingWhitespace): Ditto.
+
+2008-10-23  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix. Not reviewed.
+
+        Add DNSCurl and DNSSoup to the Gtk build
+
+        * GNUmakefile.am:
+        * platform/gtk/TemporaryLinkStubs.cpp:
+        * platform/network/soup/DNSSoup.cpp: Copied from WebCore/platform/network/curl/DNSCurl.cpp.
+        (WebCore::prefetchDNS):
+
+2008-10-23  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Un-break the Darwin build.
+
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        * platform/graphics/cg/ImageCG.cpp:
+
+2008-10-23  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix forward decls to be struct instead of class.
+        https://bugs.webkit.org/show_bug.cgi?id=21838
+
+        * rendering/style/StyleRareInheritedData.h:
+        * rendering/style/StyleRareNonInheritedData.h:
+
+2008-10-23  Brent Fulgham  <bfulgham@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        * platform/network/curl/ResourceRequest.h:  A better implementation
+          of CFURLRequest, rather than void*.  This gives better compatibility
+          with the WebKit.idl interface.
+        (WebCore::ResourceRequest::cfURLRequest):
+
+2008-10-23  Mike Pinkerton  <pinkerton@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        PLATFORM(CHROMIUM) uses CG the same way PLATFORM(MAC) does so fix
+        ifdefs to reflect that.
+
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        * platform/graphics/cg/ImageCG.cpp:
+
+2008-10-23  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21833
+        Place JavaScript Debugger hooks under #if ENABLE(JAVASCRIPT_DEBUGGER).
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::close):
+        * inspector/InspectorController.h:
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+
+2008-10-23  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21817
+        Bug 21817: Manual profiler tests should be made into layout tests
+
+        -Moving the tests before diffing so that it's clear what changed.
+
+        * manual-tests/inspector/profiler-test-anonymous-event-handler.html: Removed.
+        * manual-tests/inspector/profiler-test-anonymous-function-called-from-different-contexts.html: Removed.
+        * manual-tests/inspector/profiler-test-anonymous-function-calls-built-in-functions.html: Removed.
+        * manual-tests/inspector/profiler-test-anonymous-function-calls-eval.html: Removed.
+        * manual-tests/inspector/profiler-test-apply.html: Removed.
+        * manual-tests/inspector/profiler-test-built-in-function-calls-anonymous.html: Removed.
+        * manual-tests/inspector/profiler-test-built-in-function-calls-user-defined-function.html: Removed.
+        * manual-tests/inspector/profiler-test-call-nodelist-as-function.html: Removed.
+        * manual-tests/inspector/profiler-test-calling-the-function-that-started-the-profiler-from-another-scope.html: Removed.
+        * manual-tests/inspector/profiler-test-compare-multiple-profiles.html: Removed.
+        * manual-tests/inspector/profiler-test-constructor.html: Removed.
+        * manual-tests/inspector/profiler-test-dead-time.html: Removed.
+        * manual-tests/inspector/profiler-test-deep-recursion.html: Removed.
+        * manual-tests/inspector/profiler-test-document-dot-write.html: Removed.
+        * manual-tests/inspector/profiler-test-event-handler.html: Removed.
+        * manual-tests/inspector/profiler-test-execution-context-and-eval-on-same-line.html: Removed.
+        * manual-tests/inspector/profiler-test-heavy-view.html: Removed.
+        * manual-tests/inspector/profiler-test-inline-event-handler.html: Removed.
+        * manual-tests/inspector/profiler-test-multiple-and-different-scoped-anonymous-function-calls.html: Removed.
+        * manual-tests/inspector/profiler-test-multiple-and-different-scoped-function-calls.html: Removed.
+        * manual-tests/inspector/profiler-test-multiple-frames.html: Removed.
+        * manual-tests/inspector/profiler-test-multiple-windows.html: Removed.
+        * manual-tests/inspector/profiler-test-nested-anonymous-functon.html: Removed.
+        * manual-tests/inspector/profiler-test-nested-start-and-stop-profiler.html: Removed.
+        * manual-tests/inspector/profiler-test-no-execution-context.html: Removed.
+        * manual-tests/inspector/profiler-test-one-execution-context.html: Removed.
+        * manual-tests/inspector/profiler-test-profile-calls-in-included-file.html: Removed.
+        * manual-tests/inspector/profiler-test-profiling-from-a-nested-location-but-stop-profiling-outside-the-nesting.html: Removed.
+        * manual-tests/inspector/profiler-test-profiling-from-a-nested-location.html: Removed.
+        * manual-tests/inspector/profiler-test-simple-event-call.html: Removed.
+        * manual-tests/inspector/profiler-test-simple-no-level-change.html: Removed.
+        * manual-tests/inspector/profiler-test-start-and-stop-profiler-multiple-times.html: Removed.
+        * manual-tests/inspector/profiler-test-start-and-stop-profiling-in-the-same-function.html: Removed.
+        * manual-tests/inspector/profiler-test-start-but-dont-stop-profiling.html: Removed.
+        * manual-tests/inspector/profiler-test-stop-profiling-after-setTimeout.html: Removed.
+        * manual-tests/inspector/profiler-test-stop-then-function-call.html: Removed.
+        * manual-tests/inspector/profiler-test-throw-exception-from-eval.html: Removed.
+        * manual-tests/inspector/profiler-test-two-execution-contexts.html: Removed.
+        * manual-tests/inspector/profiler-test-user-defined-function-calls-built-in-functions.html: Removed.
+        * manual-tests/inspector/profiler-test-window-dot-eval.html: Removed.
+        * manual-tests/inspector/resources/other-frame.html: Removed.
+        * manual-tests/inspector/resources/other-window.html: Removed.
+        * manual-tests/inspector/resources/profiler-test-JS-resources.js: Removed.
+
+2008-10-23  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21826
+
+        Add accessor for SecurityOrigin::m_domainWasSetInDOM.
+
+        * page/SecurityOrigin.h:
+        (WebCore::SecurityOrigin::domainWasSetInDOM):
+
+2008-10-23  Darin Adler  <darin@apple.com>
+
+        - roll out https://bugs.webkit.org/show_bug.cgi?id=21732
+
+        * bindings/js/ScheduledAction.h:
+        * inspector/InspectorController.cpp:
+        ProtectedPtr<JSValue> instead of ProtectedPtr<JSValuePtr>.
+
+2008-10-23  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the Qt build.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtConnectionObject::execute):
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructureID):
+
+2008-10-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21825
+        JSDOMBinding should not blindly cast the global object to JSDOMWindow
+
+        * bindings/js/JSDOMGlobalObject.cpp:
+        * bindings/js/JSDOMGlobalObject.h:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        Added JSDOMGlobalObject, a base class to be used by both Window and worker contexts.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::getCachedDOMStructure):
+        (WebCore::cacheDOMStructure):
+        (WebCore::getCachedDOMConstructor):
+        (WebCore::cacheDOMConstructor):
+        Cast to JSDOMGlobalObject, as DOM objects live in DOM global objects.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::mark):
+        Moved constructor and structure tracking to JSDOMGlobalObject.
+
+2008-10-23  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21787
+
+        Update postMessage to send origin = "null" for non-serializable
+        origins to match latest spec.  Merge SecurityOrigin::toString and
+        SecurityOrigin::toHTTPOrigin because they are now the same.
+
+        Test: http/tests/security/postMessage/data-url-sends-null-origin.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::outgoingOrigin):
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::addHTTPOriginIfNeeded):
+        (WebCore::FrameLoader::loadItem):
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::servePendingRequests):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::toString):
+        * page/SecurityOrigin.h:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::makeSimpleCrossSiteAccessRequest):
+        (WebCore::XMLHttpRequest::makeCrossSiteAccessRequestWithPreflight):
+        (WebCore::XMLHttpRequest::handleAsynchronousPreflightResult):
+        (WebCore::XMLHttpRequest::didReceiveResponsePreflight):
+
+2008-10-22  David Kilzer  <ddkilzer@apple.com>
+
+        Bug 21781: WebCore::Settings should have a maximum decoded image size setting
+
+        <https://bugs.webkit.org/show_bug.cgi?id=21781>
+
+        Reviewed by Antti.
+
+        No tests since there is no change in behavior.
+
+        * loader/CachedImage.cpp:
+        (WebCore::CachedImage::maximumDecodedImageSize): Added.  Returns
+        WebCore::Settings::maximumDecodedImageSize() or 0 on error.
+        (WebCore::CachedImage::data): Flag an error if the image being
+        loaded is too big.
+        * loader/CachedImage.h:
+        (WebCore::CachedImage::maximumDecodedImageSize): Added declaration.
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Initialize m_maximumDecodedImageSize
+        to the maximum value of size_t.
+        * page/Settings.h:
+        (WebCore::Settings::setMaximumDecodedImageSize): Added method.
+        (WebCore::Settings::maximumDecodedImageSize): Ditto.
+
+2008-10-22  Mike Pinkerton  <pinkerton@chromium.org>
+
+        Reviewed by Dan Bernstein.
+        Landed and tweaked a bit by Darin Adler.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=21809
+
+        Remove PLATFORM(MAC) wrapping USE(ATSUI). It's redundant and inhibits
+        its use for PLATFORM(CHROMIUM) in the future.
+
+        * platform/graphics/SimpleFontData.h:
+
+2008-10-22  David Smith  <catfish.man@gmail.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19974
+        getElementsByClassName not live enough
+
+        Test: fast/dom/getElementsByClassName/015.html
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::classAttributeChanged): call dispatchSubtreeModifiedEvent()
+
+2008-10-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=21294
+          Bug 21294: Devirtualize getOwnPropertySlot()
+
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::createStructureID): Added. Returns a structure without
+        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
+
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::wrap): Change to use a unique structure
+        for this class rather than sharing nullProtoStructureID, which no longer exists.
+
+        * bindings/js/JSNamedNodesCollection.h:
+        (WebCore::JSNamedNodesCollection::createStructureID): Added. Returns a structure without
+        HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
+        * bindings/js/JSRGBColor.h:
+        (WebCore::JSRGBColor::createStructureID): Ditto.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Added createStructureID functions for the wrappers,
+        constructors, and prototypes in any case where they override getOwnPropertySlot, without
+        HasStandardGetOwnPropertySlot.
+
+        * bridge/objc/objc_runtime.h:
+        (JSC::Bindings::ObjcFallbackObjectImp::createStructureID): Added. Returns a structure
+        without HasStandardGetOwnPropertySlot since this class overrides getOwnPropertySlot.
+        * bridge/qt/qt_runtime.h:
+        (JSC::Bindings::QtRuntimeMethod::createStructureID): Ditto.
+        * bridge/runtime_array.h:
+        (JSC::RuntimeArray::createStructureID): Ditto.
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createStructureID): Ditto.
+        * bridge/runtime_object.h:
+        (JSC::RuntimeObjectImp::createStructureID): Ditto.
+
+2008-10-22  Brent Fulgham  <bfulgham@gmail.com>
+
+        Bring Windows Cairo Port's font handling in line with CG.
+        http://bugs.webkit.org/show_bug.cgi?id=21812.
+
+        Reviewed by Adam Roben.
+
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::createGDIFont): Remove unnecessary special-case for Cairo
+        TrueType font search. It should match CG in all font selections.
+
+2008-10-22  Brent Fulgham  <bfulgham@gmail.com>
+
+        http://bugs.webkit.org/show_bug.cgi?id=21812.
+        Bring Windows Cairo Port's font handling in line with CG.
+
+        Reviewed by David Hyatt.
+
+        * platform/graphics/win/FontCacheWin.cpp:
+        (WebCore::createGDIFont):  Remove unnecessary special-case for Cairo TrueType font search.  It should match CG in all font selections.
+
+2008-10-22  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Adam Roben
+
+        <rdar://6261773> - autocomplete="off" doesn't work on Windows
+
+        Visual Studio makes a poor decision regarding the combination of enums and bitfields, such that a
+        statement like "m_autocomplete = Off" followed by "return m_autocomplete == Off" would return "false"
+        instead of the much more correct "true."
+
+        In the past we have worked around this by declaring the bitfield member as an unsigned instead
+        of the enum type.
+
+        For more discussion, see http://trac.webkit.org/changeset/25329
+
+        * html/HTMLInputElement.h:  Work around insane Visual Studio enum issue  *sigh*
+
+2008-10-22  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Oliver Hunt and Tim Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19225
+        Bug 19225: JSProfiler: Create automated profiler tests
+        - This change exports profiles on the console object so that they can be
+        iterated over via JavaScript, and thus can be used in automated tests.
+
+        * bindings/js/JSConsoleCustom.cpp: Get the profiles and return an array
+        that JS can use.
+        (WebCore::JSConsole::profiles):
+        * inspector/InspectorController.h: Use the new typedef.
+        (WebCore::InspectorController::profiles):
+        * page/Console.cpp: Keep our own array of profile objects.
+        (WebCore::Console::profileEnd):
+        * page/Console.h: Ditto.
+        (WebCore::Console::profiles):
+        * page/Console.idl: Expose the profiles to JS.
+
+2008-10-22  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21775
+
+        Convert buttons over to use the new Theme API on OS X.
+
+        Reviewed by Adam Roben
+
+        * platform/LengthBox.h:
+        (WebCore::LengthBox::LengthBox):
+        * platform/Theme.cpp:
+        (WebCore::Theme::controlBorder):
+        (WebCore::Theme::controlPadding):
+        * platform/Theme.h:
+        (WebCore::Theme::controlFont):
+        (WebCore::Theme::controlSize):
+        (WebCore::Theme::minControlSize):
+        (WebCore::Theme::controlRequiresPreWhiteSpace):
+        * platform/mac/ThemeMac.h:
+        (WebCore::ThemeMac::controlRequiresPreWhiteSpace):
+        * platform/mac/ThemeMac.mm:
+        (WebCore::checkboxSize):
+        (WebCore::radioSize):
+        (WebCore::buttonSizes):
+        (WebCore::buttonMargins):
+        (WebCore::button):
+        (WebCore::paintButton):
+        (WebCore::ThemeMac::controlFont):
+        (WebCore::ThemeMac::controlSize):
+        (WebCore::ThemeMac::minControlSize):
+        (WebCore::ThemeMac::controlBorder):
+        (WebCore::ThemeMac::controlPadding):
+        (WebCore::ThemeMac::inflateControlPaintRect):
+        (WebCore::ThemeMac::paint):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        (WebCore::RenderTheme::paint):
+        (WebCore::RenderTheme::controlStatesForRenderer):
+        (WebCore::RenderTheme::isDefault):
+        (WebCore::RenderTheme::adjustRadioStyle):
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::setRadioSize):
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::adjustRepaintRect):
+        (WebCore::menuListButtonSizes):
+        (WebCore::RenderThemeMac::adjustMenuListStyle):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::paddingBox):
+        (WebCore::InheritedFlags::setPaddingBox):
+
+2008-10-22  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Make sure that the AtomicString that identifies a set of animation keyframes
+        stays live by keeping a copy in the WebKitCSSKeyframesRule.
+
+        Also call styleSheetChanged() when the keyframes name changes, but
+        add an internal method that doesn't call styleSheetChanged() for use
+        during normal stylesheet parsing.
+
+        Test: animations/change-keyframes-name.html
+
+        * css/CSSGrammar.y:
+        * css/WebKitCSSKeyframesRule.cpp:
+        (WebCore::WebKitCSSKeyframesRule::setName):
+        * css/WebKitCSSKeyframesRule.h:
+        (WebCore::WebKitCSSKeyframesRule::setNameInternal):
+
+2008-10-22  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21791
+        WebCore JS bindings should be able to use non-static hash tables for properties
+
+        Add a map for HashTables to WebCore JS client data.
+
+        This makes property access noticeably slower, so it is an opt-in. For classes that need to be
+        supported in workers in forseeable future this is not critical.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::DOMObjectHashTableMap::get):
+        (WebCore::DOMObjectHashTableMap::mapFor):
+        (WebCore::getHashTableForGlobalData):
+        (WebCore::DOMObjectWrapperMap::mapFor):
+        WebCore client data is now a class that contains both a DOM wrapper map and a property hash
+        table one.
+
+        * bindings/js/JSDOMBinding.h: Added getHashTableForGlobalData() to query the hash table map.
+
+        * bindings/scripts/CodeGeneratorJS.pm: If the class has a NoStaticTables attribute, use
+        JSDOMBinding map to access its property hash tables.
+
+        * dom/MessageChannel.idl:
+        * dom/MessagePort.idl:
+        Added NoStaticTables attribute.
+
+2008-10-22  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Build failure because of missing include
+        https://bugs.webkit.org/show_bug.cgi?id=21765
+
+        Build failure fix for WebKit/GTK+; added missing
+        include (GOwnPtr.h)
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+
+2008-10-22  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Adam Roben.
+
+        Fix crashes on older GTK+ versions (2.8). gtk_widget_style_get()
+        doesn't initialize values if the requested property doesn't exist, so
+        initialize the values to the documented defaults before calling it
+        where necessary. Additionally, avoid critical warnings by not calling
+        gtk_widget_style_get() when we know the property isn't available.
+
+        Note that this is an imported source file which doesn't follow the
+        WebKit coding style.
+
+        * platform/gtk/gtk2drawing.c:
+        (moz_gtk_init):
+        (moz_gtk_button_get_inner_border):
+        (moz_gtk_combo_box_paint):
+        (moz_gtk_toolbar_separator_paint):
+        (moz_gtk_menu_separator_paint):
+        (moz_gtk_get_widget_border):
+        (moz_gtk_get_tab_scroll_arrow_size):
+        (moz_gtk_get_toolbar_separator_width):
+        (moz_gtk_get_menu_separator_height):
+
+2008-10-22  Alp Toker  <alp@nuanti.com>
+
+        Fix build for Cairo 1.2.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::clipOut):
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::paintMozWidget):
+
+2008-10-22  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        A little more PLATFORM(CHROMIUM) in WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=21758
+
+        * page/AccessibilityObject.h:
+        * platform/graphics/Icon.h:
+
+2008-10-21  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Test: fast/events/message-channel-gc-3.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=21769
+        MessagePort should be GC protected if there are messages to be delivered
+
+        * dom/MessagePort.h: Removed pending activity count. Now we track if a close event is
+        pending, and check if the queue is non-empty.
+        (WebCore::MessagePort::workerContext): Added a stub implementation for a cross-heap GC bug
+        fix (below).
+
+        * dom/MessagePort.cpp:
+        (WebCore::CloseMessagePortTimer::fired):
+        (WebCore::MessagePort::MessagePort):
+        (WebCore::MessagePort::queueCloseEvent):
+        (WebCore::MessagePort::dispatchCloseEvent):
+        (WebCore::MessagePort::hasPendingActivity):
+        Track message and close event activity separately.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markCrossHeapDependentObjectsForDocument): Fixed a bug in cross-heap GC that was
+        causing same-heap ports to never be deleted.
+
+2008-10-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - remove unreachable code
+
+        * platform/text/BidiResolver.h:
+        (WebCore::::embed):
+
+2008-10-21  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=20352
+        REGRESSION(r31030-31055): Choosing "Print window" from frame set
+        prints blank page
+        and corresponding: <rdar://problem/6142398>
+
+        viewHeight() and viewWidth() only return valuable information if we
+        are not printing. Everywhere else in the code, we make sure we are
+        not printing before we call these functions. Adding a check for
+        printing here fixes this bug, and framesets print again.
+
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::layout):
+
+2008-10-21  Yael Aharon <yael.aharon@nokia.com>
+
+        Reviewed by Simon.
+
+        Pixmap in canvas tag was not getting initialized.
+
+        See https://bugs.webkit.org/show_bug.cgi?id=21771
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::create):
+
+2008-10-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        Add a comment explaining layoutDelta(), and an assertion
+        that checks that delta changes were correctly paired during layout.
+
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::layout):
+        * rendering/RenderView.h:
+
+2008-10-20  Timothy Hatcher  <timothy@apple.com>
+
+        Make auto-complete only suggest properties that are valid syntax
+        when using dot-notation. Also when completing numeric properties,
+        the quotes are omitted inside the brackets.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21760
+        https://bugs.webkit.org/show_bug.cgi?id=21761
+
+        Reviewed by Oliver Hunt.
+
+        * inspector/front-end/Console.js:
+        (WebInspector.Console.prototype.completions): Skip properties that
+        are not valid identifies when using dot-notation. And omit the quotes
+        when completing numbers in bracket-notation.
+
+2008-10-20  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes the Profiles panel in the Web Inspector, which was broken by
+        the JSValue base-class changes. Also renames some functions and
+        variables in JavaScriptProfileNode.cpp that where title case.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21764
+
+        Reviewed by Oliver Hunt.
+
+        * inspector/JavaScriptProfile.cpp:
+        (WebCore::toJS): Use a JSObject pointer instead of JSValuePtr so the
+        returned JSValuePtr will be treated as an object and not a value.
+        * inspector/JavaScriptProfileNode.cpp:
+        (WebCore::toJS): Ditto.
+
+2008-10-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Remove FrameLoaderClient::detachedFromParent4.  It is no longer used by any port.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::detachedFromParent4):.
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::detachFromParent):
+        * loader/FrameLoaderClient.h:
+
+2008-10-20  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=21763
+        REGRESSION (r36108-r36113): Can't load picture content on wired.com galleries
+        <rdar://problem/6285025
+
+        If we get 304 response we need to explicitly check if that completes the frame load.
+
+        No test case, simulating the condition is pretty difficult.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::didReceiveResponse):
+
+2008-10-20  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        Work around <rdar://problem/6301728>.
+
+        Don't assert that loads are deferred when we're using CFNetwork on Mac or Windows.
+
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didReceiveResponse):
+        (WebCore::MainResourceLoader::didReceiveData):
+        (WebCore::MainResourceLoader::didFinishLoading):
+        (WebCore::MainResourceLoader::didFail):
+
+2008-10-20  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Speculative fix for <rdar://problem/6242585> CrashTracer: [USER] 19
+        crashes in Safari at com.apple.WebCore
+        WebCore::ScrollView::visibleContentRect const + 153
+
+        d->m_view can be null and is null-checked at other points in the
+        code. The logs indicate that this crash occurs when closing a
+        window containing a PDF, so in case where we crash, the PDF's view
+        is probably already null. So the fix is to simply add a null-check.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::selectionRect):
+
+2008-10-20  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        * html/HTMLFormElement.cpp: (WebCore::HTMLFormElement::formData):
+        Removed stray increment that would screw up any form with multiple files in it.
+
+2008-10-20  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by David Hyatt.
+
+        Split LengthBox and LengthSize into their own files.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/Length.h:
+        (WebCore::Length::blend):
+        * platform/LengthBox.h: Copied from platform/Length.h.
+        (WebCore::LengthBox::LengthBox):
+        (WebCore::LengthBox::nonZero):
+        * platform/LengthSize.h: Copied from platform/Length.h.
+        (WebCore::LengthSize::LengthSize):
+        (WebCore::LengthSize::setWidth):
+        (WebCore::LengthSize::setHeight):
+        (WebCore::LengthSize::height):
+        * platform/Theme.h:
+        * rendering/style/FillLayer.h:
+        * rendering/style/NinePieceImage.h:
+        (WebCore::NinePieceImage::NinePieceImage):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/StyleDashboardRegion.h:
+        * rendering/style/StyleSurroundData.h:
+        * rendering/style/StyleVisualData.h:
+
+2008-10-20  Dan Bernstein  <mitz@apple.com>
+
+        - Mac build fix
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2008-10-20  Alp Toker  <alp@nuanti.com>
+
+        Fix autotools dist build target by listing recently added header
+        files only. Not reviewed.
+
+        * GNUmakefile.am:
+
+2008-10-20  David Hyatt  <hyatt@apple.com>
+
+        Clean up some USE(NEW_THEME) ifdefs (I botched one of them and have broken non-Mac platforms).  Also
+        refactor some of the code that I put in ThemeMac to be cross-platform, since it was in RenderTheme.cpp
+        originally.
+
+        ifdef some methods in RenderTheme.cpp also that are no longer needed with the new Theme.
+
+        Reviewed by Adam Roben
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/Theme.cpp: Added.
+        (WebCore::Theme::controlSupportsBorder):
+        (WebCore::Theme::controlSupportsPadding):
+        * platform/Theme.h:
+        * platform/mac/ThemeMac.h:
+        * platform/mac/ThemeMac.mm:
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        * rendering/RenderTheme.h:
+
+2008-10-20  David Hyatt  <hyatt@apple.com>
+
+        Rename LengthBox's members to have m_ in front of them.
+
+        Reviewed by Sam Weinig
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::valueForNinePieceImage):
+        (WebCore::getPositionOffsetValue):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::mapNinePieceImage):
+        * platform/Length.h:
+        (WebCore::LengthBox::LengthBox):
+        (WebCore::LengthBox::left):
+        (WebCore::LengthBox::right):
+        (WebCore::LengthBox::top):
+        (WebCore::LengthBox::bottom):
+        (WebCore::LengthBox::operator==):
+        (WebCore::LengthBox::nonZero):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::paintNinePieceImage):
+        (WebCore::RenderObject::addDashboardRegions):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::positionedObjectMoved):
+        (WebCore::RenderStyle::setClip):
+        (WebCore::RenderStyle::noneDashboardRegions):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::left):
+        (WebCore::InheritedFlags::right):
+        (WebCore::InheritedFlags::top):
+        (WebCore::InheritedFlags::bottom):
+        (WebCore::InheritedFlags::clipLeft):
+        (WebCore::InheritedFlags::clipRight):
+        (WebCore::InheritedFlags::clipTop):
+        (WebCore::InheritedFlags::clipBottom):
+        (WebCore::InheritedFlags::marginTop):
+        (WebCore::InheritedFlags::marginBottom):
+        (WebCore::InheritedFlags::marginLeft):
+        (WebCore::InheritedFlags::marginRight):
+        (WebCore::InheritedFlags::paddingTop):
+        (WebCore::InheritedFlags::paddingBottom):
+        (WebCore::InheritedFlags::paddingLeft):
+        (WebCore::InheritedFlags::paddingRight):
+        (WebCore::InheritedFlags::setLeft):
+        (WebCore::InheritedFlags::setRight):
+        (WebCore::InheritedFlags::setTop):
+        (WebCore::InheritedFlags::setBottom):
+        (WebCore::InheritedFlags::setDashboardRegion):
+        (WebCore::InheritedFlags::setClipLeft):
+        (WebCore::InheritedFlags::setClipRight):
+        (WebCore::InheritedFlags::setClipTop):
+        (WebCore::InheritedFlags::setClipBottom):
+        (WebCore::InheritedFlags::setMarginTop):
+        (WebCore::InheritedFlags::setMarginBottom):
+        (WebCore::InheritedFlags::setMarginLeft):
+        (WebCore::InheritedFlags::setMarginRight):
+        (WebCore::InheritedFlags::setPaddingTop):
+        (WebCore::InheritedFlags::setPaddingBottom):
+        (WebCore::InheritedFlags::setPaddingLeft):
+        (WebCore::InheritedFlags::setPaddingRight):
+
+2008-10-20  Timothy Hatcher  <timothy@apple.com>
+
+        Make the Resource panel perform graph updates atomically, so when resources
+        are added the graph and summary graph update at the same time.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21755
+
+        Reviewed by Kevin McCullough.
+
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype.get startTime): Return -1 if the _startTime
+        property is undefined, null or 0. This allows callers to check for -1 and not
+        the other values when there is no startTime yet.
+        (WebInspector.Resource.prototype.get responseReceivedTime): Ditto.
+        (WebInspector.Resource.prototype.get endTime): Ditto.
+        (WebInspector.Resource.prototype.get duration): Remove an extra empty line.
+        (WebInspector.Resource.prototype.get latency): Ditto.
+        (WebInspector.Resource.prototype.get contentLength): Return 0 if the _duration
+        property is undefined or null. This allows callers to always assume a number.
+        (WebInspector.Resource.prototype.get expectedContentLength): Ditto.
+        (WebInspector.Resource.prototype.get errors): Simplify the case where there is
+        no _errors property yet.
+        (WebInspector.Resource.prototype.set errors): Remove the check if the new value
+        if the same as the previous value, since there is no work to guard.
+        (WebInspector.Resource.prototype.get warnings): Simplify the case where there is
+        no _warnings property yet.
+        (WebInspector.Resource.prototype.set warnings): Remove the check if the new value
+        if the same as the previous value, since there is no work to guard.
+        (WebInspector.Resource.CompareByResponseReceivedTime): Add cases for when the
+        responseReceivedTime is -1.
+        (WebInspector.Resource.CompareByEndTime): Add cases for when the endTime is -1.
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.get searchableViews): If a resource does not
+        have a _resourcesTreeElement yet, exclude it from the searchable views.
+        (WebInspector.ResourcesPanel.prototype.set calculator): Set _staleResource to _resources
+        and call refresh to refresh the entire graph.
+        (WebInspector.ResourcesPanel.prototype.set needsRefresh): Set a timeout if the panel
+        is visible that calls refresh.
+        (WebInspector.ResourcesPanel.prototype.refresh): Create the resource tree element and
+        graph for a resource if it hasn't been created yet. If the boundaries changed during
+        the first stale resource pass, do a full pass of all resources when updating the graphs.
+        (WebInspector.ResourcesPanel.prototype.reset): Remove the legend items.
+        (WebInspector.ResourcesPanel.prototype.addResource): Don't create the tree element and
+        graph, these are now created during the first refresh.
+        (WebInspector.ResourcesPanel.prototype.removeResource): Null check _resourcesTreeElement.
+        (WebInspector.ResourcesPanel.prototype.addMessageToResource): Ditto.
+        (WebInspector.ResourcesPanel.prototype.clearMessages): Ditto.
+        (WebInspector.ResourcesPanel.prototype.refreshResource): Remove most of the work, just
+        add the resource to the _staleResources and set needsRefresh.
+        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded): Null check
+        _resourcesTreeElement.
+        (WebInspector.ResourcesPanel.prototype._sortResourcesIfNeeded): Remove code to clear
+        the timeout used by the deleted _sortResourcesSoonIfNeeded. Remove call to removeChild
+        since the insertBefore call will do it if needed.
+        (WebInspector.ResourcesPanel.prototype._updateGraphDividersIfNeeded): Remove code to
+        clear the timeout used by the deleted _updateGraphDividersSoonIfNeeded.
+        (WebInspector.ResourcesPanel.prototype._updateSummaryGraph): Remove code to clear the
+        timeout used by the deleted _updateSummaryGraphSoon. No need to remove the totalLegendLabel,
+        since all the legend items are removed in one pass right before.
+        (WebInspector.ResourcesPanel.prototype._changeSortingFunction): Set the sortingFunction
+        before the calculator so the correct sortingFunction is there when a refresh happens.
+        (WebInspector.ResourceTimeCalculator.prototype.computeBarGraphPercentages): Set start to 0
+        when the startTime is -1, since that looks best visually. Also set middle and end
+        to the start and middle (respectfully) when startAtZero. This looks best visually.
+        (WebInspector.ResourceGraph): Start the graph as hidden until the first refresh.
+        (WebInspector.ResourceGraph.prototype.refresh): Remove the hidden class.
+
+2008-10-20  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21733
+
+        Make sure that the haveMetadata flag is set to true for generated images from image buffers, so that
+        no attempt is made to re-cache the frame from a non-existent image source.
+
+        Reviewed by Sam Weinig
+
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+
+2008-10-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - make hasARenderedDescendant() have internal linkage
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::hasARenderedDescendant):
+
+2008-10-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Jon Honeycutt
+
+        Fix a crash in Accessibility where a table section was being
+        referenced without first checking if it was null
+
+        https://bugs.webkit.org/show_bug.cgi?id=21721
+
+        Test: accessibility/table-nofirstbody.html
+
+        * page/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::addChildren):
+
+2008-10-20  David Hyatt  <hyatt@apple.com>
+
+        Avoid some stderr spew from CG by checking if we have a decoder yet in ImageSourceCG.
+
+        Reviewed by Darin Adler
+
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::repetitionCount):
+        (WebCore::ImageSource::frameDurationAtIndex):
+
+2008-10-20  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix the pthread conditionals in the FTP code to correctly define
+        threadsafe *_r functions on Windows. Partly fixes the GTK+/Win32
+        build.
+
+        * loader/FTPDirectoryDocument.cpp:
+        * loader/FTPDirectoryParser.cpp:
+
+2008-10-20  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21751
+
+        Convert checkboxes and radio buttons on OS X over to the new Theme API.
+
+        Reviewed by Adam Roben
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::mapFillSize):
+        * platform/Length.h:
+        (WebCore::LengthSize::LengthSize):
+        (WebCore::LengthSize::operator==):
+        (WebCore::LengthSize::width):
+        (WebCore::LengthSize::height):
+        (WebCore::LengthSize::setWidth):
+        (WebCore::LengthSize::setHeight):
+        * platform/Theme.h:
+        (WebCore::Theme::controlSize):
+        (WebCore::Theme::controlSupportsBorder):
+        (WebCore::Theme::controlSupportsPadding):
+        (WebCore::Theme::paint):
+        (WebCore::Theme::inflateControlPaintRect):
+        * platform/ThemeTypes.h:
+        (WebCore::):
+        * platform/mac/ThemeMac.h:
+        * platform/mac/ThemeMac.mm:
+        (WebCore::):
+        (WebCore::controlSizeForFont):
+        (WebCore::sizeFromFont):
+        (WebCore::setControlSize):
+        (WebCore::updateStates):
+        (WebCore::inflateRect):
+        (WebCore::checkboxSizes):
+        (WebCore::checkboxMargins):
+        (WebCore::checkboxSize):
+        (WebCore::checkbox):
+        (WebCore::paintCheckbox):
+        (WebCore::radioSizes):
+        (WebCore::radioMargins):
+        (WebCore::radioSize):
+        (WebCore::radio):
+        (WebCore::paintRadio):
+        (WebCore::ThemeMac::baselinePositionAdjustment):
+        (WebCore::ThemeMac::controlSize):
+        (WebCore::ThemeMac::controlSupportsBorder):
+        (WebCore::ThemeMac::controlSupportsPadding):
+        (WebCore::ThemeMac::inflateControlPaintRect):
+        (WebCore::ThemeMac::paint):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calculateBackgroundSize):
+        * rendering/RenderObject.cpp:
+        (WebCore::mustRepaintFillLayers):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        (WebCore::RenderTheme::paint):
+        (WebCore::RenderTheme::baselinePosition):
+        (WebCore::RenderTheme::adjustRepaintRect):
+        (WebCore::RenderTheme::controlStatesForRenderer):
+        (WebCore::RenderTheme::isFocused):
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::adjustRepaintRect):
+        * rendering/style/FillLayer.cpp:
+        (WebCore::FillLayer::operator==):
+
+2008-10-18  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=21735
+        Emit profiling instrumentation only if the Web Inspector's profiling
+        feature is enabled
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::supportsProfiling):
+        * bindings/js/JSDOMWindowBase.h: Implemented the interface for specifying
+        whether a target global object has the Web Inspector's profiling feature
+        enabled.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctionsSoon):
+        (WebCore::JavaScriptDebugServer::didAddListener):
+        (WebCore::JavaScriptDebugServer::didRemoveListener):
+        * inspector/JavaScriptDebugServer.h: Exported an API for recompiling,
+        used by the Settings object.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        (WebCore::Settings::setDeveloperExtrasEnabled):
+        * page/Settings.h: Recompile when the developer menu is enabled/disabled
+        for the first time, to add/remove profiling hooks. In the future, with
+        better Web Inspector UI, we can do this on a page-by-page basis,
+        instead of a global basis.
+
+2008-10-20  David Hyatt  <hyatt@apple.com>
+
+        Move Length to platform/.
+
+        Reviewed by Adam Roben
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * platform/Length.cpp: Copied from rendering/Length.cpp.
+        * platform/Length.h: Copied from rendering/Length.h.
+
+2008-10-20  Darin Adler  <darin@apple.com>
+
+        - try to fix Qt build
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMetaMethod::connectGetter): Add asObject calls.
+        (JSC::Bindings::QtRuntimeMetaMethod::disconnectGetter): Ditto.
+
+2008-10-20  Darin Adler  <darin@apple.com>
+
+        - try to fix Qt build
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::mark): Use JSValue* instead of JSValuePtr.
+        (JSC::Bindings::QtField::valueFromInstance): Ditto.
+        * bridge/qt/qt_instance.h: Ditto.
+
+2008-10-20  Darin Adler  <darin@apple.com>
+
+        - try to fix Tiger build
+
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::invokeMethod): Add a const_cast to remove the unwanted
+        volatile qualifier.
+        (ObjcInstance::invokeDefaultMethod): Ditto.
+        (ObjcInstance::getValueOfUndefinedField): Ditto.
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::ObjcField::valueFromInstance): Ditto.
+
+2008-10-20  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21750
+        Eliminate the notion of "temporary events"
+
+        We mark some events as temporary when dispatching, for the sole reason of
+        manually calling forgetDOMObject when done dispatching.
+
+        There doesn't seem to be any reason to call it manually, as JSEvent destructor
+        will do this automatically right away.
+
+        * bindings/js/ScriptController.cpp:
+        * bindings/js/ScriptController.h:
+        Removed ScriptController::finishedWithEvent(), which was called after dispatching
+        a temporary event.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::dispatchChildInsertionEvents):
+        (WebCore::dispatchChildRemovalEvents):
+        * dom/EventTarget.h:
+        * dom/EventTargetNode.cpp:
+        (WebCore::EventTargetNode::dispatchEvent):
+        (WebCore::EventTargetNode::dispatchGenericEvent):
+        (WebCore::EventTargetNode::dispatchSubtreeModifiedEvent):
+        (WebCore::EventTargetNode::dispatchWindowEvent):
+        (WebCore::EventTargetNode::dispatchUIEvent):
+        (WebCore::EventTargetNode::dispatchKeyEvent):
+        (WebCore::EventTargetNode::dispatchMouseEvent):
+        (WebCore::EventTargetNode::dispatchWheelEvent):
+        (WebCore::EventTargetNode::dispatchWebKitAnimationEvent):
+        (WebCore::EventTargetNode::dispatchWebKitTransitionEvent):
+        (WebCore::EventTargetNode::dispatchEventForType):
+        (WebCore::EventTargetNode::dispatchProgressEvent):
+        (WebCore::EventTargetNode::dispatchStorageEvent):
+        * dom/EventTargetNode.h:
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::dispatchMessages):
+        (WebCore::MessagePort::dispatchCloseEvent):
+        (WebCore::MessagePort::dispatchEvent):
+        * dom/MessagePort.h:
+        * editing/Editor.cpp:
+        (WebCore::Editor::dispatchCPPEvent):
+        (WebCore::dispatchEditableContentChangedEvents):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment):
+        * editing/TypingCommand.cpp:
+        (WebCore::TypingCommand::insertText):
+        * loader/appcache/DOMApplicationCache.cpp:
+        (WebCore::DOMApplicationCache::dispatchEvent):
+        (WebCore::DOMApplicationCache::callListener):
+        * loader/appcache/DOMApplicationCache.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::dispatchDragEvent):
+        (WebCore::EventHandler::keyEvent):
+        (WebCore::EventHandler::handleTextInputEvent):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scheduleEvent):
+        (WebCore::FrameView::updateOverflowStatus):
+        (WebCore::FrameView::dispatchScheduledEvents):
+        * page/FrameView.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollToOffset):
+        (WebCore::RenderLayer::updateOverflowStatus):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::sendSVGLoadEventIfPossible):
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::dispatchEvent):
+        * svg/SVGElementInstance.h:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::dispatchEvent):
+        (WebCore::XMLHttpRequest::dispatchReadyStateChangeEvent):
+        (WebCore::XMLHttpRequest::dispatchXMLHttpRequestProgressEvent):
+        * xml/XMLHttpRequest.h:
+        * xml/XMLHttpRequestUpload.cpp:
+        (WebCore::XMLHttpRequestUpload::dispatchEvent):
+        (WebCore::XMLHttpRequestUpload::dispatchXMLHttpRequestProgressEvent):
+        * xml/XMLHttpRequestUpload.h:
+        Don't pass the tempEvent boolean around.
+
+2008-10-20  Alp Toker  <alp@nuanti.com>
+
+        Remove unused includes only. Partial GTK+/Win build fix.
+
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+
+2008-10-20  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21705
+        Implement Web Workers client-side API
+
+        The implementation is experimental, and disabled by default. It doesn't quite match the
+        published draft, being influenced by further WHATWG discussions.
+
+        This only implements the client-side API, and does not actually create any threads or
+        global contexts yet.
+
+        * DerivedSources.make: Added DedicatedWorker. SharedWorker is not implemented yet, as I'm
+        still not sure if having separate classes for these helps at all.
+
+        * WebCore.xcodeproj/project.pbxproj: Added new files.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (jsDOMWindowBaseWorker):
+        (WebCore::JSDOMWindowBase::put):
+        (setJSDOMWindowBaseWorker):
+        Added window.Worker constructor. Moved JSXSLTProcessorConstructor.h include out of ifdef
+        to match prevailing style.
+
+        * bindings/js/JSDedicatedWorkerConstructor.cpp: Added.
+        * bindings/js/JSDedicatedWorkerConstructor.h: Added.
+        * bindings/js/JSDedicatedWorkerCustom.cpp: Added.
+        The implementation of event listeners are left custom intentionally, for easier implementation
+        of listeners that are not tied to any Document in the future.
+
+        * dom/DedicatedWorker.cpp: Added.
+        * dom/DedicatedWorker.h: Added.
+        * dom/DedicatedWorker.idl: Added.
+        Added an implementation that can only load requested scripts for now.
+
+2008-10-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        - fix assertion seen when opening inspector
+
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertySlot):
+        Removed unneeded asObject cast.
+
+2008-10-19  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Timothy Hatcher.
+
+        - remove empty directories and correct the MIME type of inspector images
+
+        * page/inspector: Removed.
+        * page/inspector/Images: Removed.
+
+2008-10-19  Timothy Hatcher  <timothy@apple.com>
+
+        Make the Web Inspector Resources panel open quicker and change graphs
+        faster. There was some accidental n^2 logic at fault when updating the
+        graph boundaries.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21742
+
+        Reviewed by Darin Adler.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.set calculator): Return early for
+        a null calculator. Remove the second argument passed to _refreshAllResources.
+        (WebInspector.ResourcesPanel.prototype.refresh): Call updateBoundaries on
+        the calculator for all the stale resources before calling refreshResource.
+        Pass true for the first argument of refreshResource to skip the boundary update.
+        (WebInspector.ResourcesPanel.prototype._updateGraphBoundariesIfNeeded): Remove
+        the second argument passed to _refreshAllResources.
+        (WebInspector.ResourcesPanel.prototype._refreshAllResourcesSoon): Remove the
+        skipSort argument since every passed true, and it would be bad to pass false.
+        (WebInspector.ResourcesPanel.prototype._refreshAllResources): Ditto. And if
+        skipBoundaryUpdate is false, call updateBoundaries on the calculator for all
+        the resources before calling refreshResource. Pass true for the first argument
+        of refreshResource to skip the boundary update.
+
+2008-10-19  Timothy Hatcher  <timothy@apple.com>
+
+        Visually distinguish resources that loaded from the memory cache.
+
+        https://bugs.webkit.org/show_bug.cgi?id=14279
+
+        Reviewed by Dan Bernstein.
+
+        * English.lproj/localizedStrings.js: New string.
+        * inspector/front-end/Images/timelineHollowPillBlue.png: Added.
+        * inspector/front-end/Images/timelineHollowPillGray.png: Added.
+        * inspector/front-end/Images/timelineHollowPillGreen.png: Added.
+        * inspector/front-end/Images/timelineHollowPillOrange.png: Added.
+        * inspector/front-end/Images/timelineHollowPillPurple.png: Added.
+        * inspector/front-end/Images/timelineHollowPillRed.png: Added.
+        * inspector/front-end/Images/timelineHollowPillYellow.png: Added.
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourceCalculator.prototype.computeBarGraphLabels):
+        Add the "(from cache)" suffix to the tooltip.
+        (WebInspector.ResourceTimeCalculator.prototype.computeBarGraphLabels):
+        Add the "(from cache)" suffix to the tooltip.
+        (WebInspector.ResourceGraph): Add the "resource-cached" class.
+        * inspector/front-end/inspector.css: New styles to make the timeline
+        bars use the hollow pill images.
+
+2008-10-19  Timothy Hatcher  <timothy@apple.com>
+
+        Update the scroll position in the Resources panel when loading
+        a new page or toggling on small resource rows.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20114
+
+        Reviewed by Darin Adler.
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.reset): Scroll to the top,
+        since all the resource are being removed.
+        (WebInspector.ResourcesPanel.prototype.removeResource): Call
+        _adjustScrollPosition in case the view is shorter and needs scrolled.
+        (WebInspector.ResourcesPanel.prototype._toggleLargerResources): Ditto.
+        (WebInspector.ResourcesPanel.prototype._adjustScrollPosition): Check
+        the height of the sidebar against the scrollTop and height of the
+        resourcesContainerElement. If the sidebar is shorter, scroll up
+        so the last resource is at the bottom again.
+
+2008-10-19  Timothy Hatcher  <timothy@apple.com>
+
+        Show per resource times and sizes when hovering over the bar graph for a resource.
+
+        https://bugs.webkit.org/show_bug.cgi?id=14300
+        rdar://problem/5712802
+
+        Reviewed by Cameron Zwarich.
+
+        * English.lproj/localizedStrings.js: Add new strings.
+        * inspector/front-end/Images/graphLabelCalloutLeft.png: Added.
+        * inspector/front-end/Images/graphLabelCalloutRight.png: Added.
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.refreshResource): Pass the calculator to the
+        ResourceGraph.refresh function.
+        (WebInspector.ResourceCalculator.prototype.computeBarGraphLabels): Default implementation
+        returns the formatted value.
+        (WebInspector.ResourceTimeCalculator.prototype.computeBarGraphLabels): Return discrete values
+        for the latency and download times. Also generate a custom tooltip.
+        (WebInspector.ResourceGraph): Add a mouseover event listener that calls refreshLabelPositions.
+        (WebInspector.ResourceGraph.prototype.refreshLabelPositions): Added. Updates the label positions
+        in case the bar has changed size.
+        (WebInspector.ResourceGraph.prototype.refresh): Set the label text and tooltips.
+        * inspector/front-end/inspector.css: New styles for the labels.
+
+2008-10-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - next step of https://bugs.webkit.org/show_bug.cgi?id=21732
+          improve performance by eliminating JSValue as a base class for JSCell
+
+        Remove most uses of JSValue, which will be removed in a future patch.
+
+        * bindings/js/JSCustomXPathNSResolver.h: Removed declaration of JSValue
+        and used JSValuePtr instead.
+        * bindings/js/JSEventTarget.h: Ditto.
+        * bindings/js/JSNodeFilterCondition.h: Ditto.
+        * bindings/js/ScheduledAction.h: Ditto.
+        * bindings/js/ScriptController.h: Ditto.
+        * bindings/objc/WebScriptObjectPrivate.h: Ditto.
+        * bridge/c/c_utility.h: Ditto.
+        * bridge/jni/jni_jsobject.h: Ditto.
+        * bridge/jni/jni_utility.h: Ditto.
+        * bridge/objc/WebScriptObject.h: Ditto.
+        * dom/Traversal.h: Ditto.
+        * inspector/InspectorController.cpp: Ditto.
+        * inspector/JavaScriptProfile.h: Ditto.
+        * inspector/JavaScriptProfileNode.h: Ditto.
+        * loader/FrameLoader.h: Ditto.
+        * page/Console.h: Ditto.
+        * plugins/MimeTypeArray.h: Ditto.
+        * plugins/Plugin.h: Ditto.
+        * plugins/PluginArray.h: Ditto.
+        * plugins/PluginView.cpp:
+        (WebCore::getString): Ditto.
+        (WebCore::PluginView::performRequest): Ditto.
+        * plugins/gtk/PluginViewGtk.cpp: Ditto.
+        * plugins/qt/PluginViewQt.cpp: Ditto.
+        * plugins/win/PluginViewWin.cpp: Ditto.
+
+        * bridge/qt/qt_class.cpp:
+        (JSC::Bindings::QtClass::fallbackObject): Use JSValuePtr and JSObject*
+        instead of JSValue*.
+        * bridge/qt/qt_class.h: Ditto.
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::mark): Ditto.
+        (JSC::Bindings::QtInstance::invokeMethod): Ditto.
+        (JSC::Bindings::QtInstance::defaultValue): Ditto.
+        (JSC::Bindings::QtInstance::stringValue): Ditto.
+        (JSC::Bindings::QtInstance::numberValue): Ditto.
+        (JSC::Bindings::QtInstance::booleanValue): Ditto.
+        (JSC::Bindings::QtInstance::valueOf): Ditto.
+        (JSC::Bindings::QtField::valueFromInstance): Ditto.
+        (JSC::Bindings::QtField::setValueToInstance): Ditto.
+        * bridge/qt/qt_instance.h: Ditto.
+        * bridge/qt/qt_runtime.cpp: Ditto.
+        (JSC::Bindings::valueRealType): Ditto.
+        (JSC::Bindings::convertValueToQVariant): Ditto.
+        (JSC::Bindings::convertQVariantToValue): Ditto.
+        (JSC::Bindings::findMethodIndex): Ditto.
+        (JSC::Bindings::QtRuntimeMetaMethod::call): Ditto.
+        (JSC::Bindings::QtRuntimeMetaMethod::lengthGetter): Ditto.
+        (JSC::Bindings::QtRuntimeMetaMethod::connectGetter): Ditto.
+        (JSC::Bindings::QtRuntimeMetaMethod::disconnectGetter): Ditto.
+        (JSC::Bindings::QtRuntimeConnectionMethod::call): Ditto.
+        (JSC::Bindings::QtRuntimeConnectionMethod::lengthGetter): Ditto.
+        (JSC::Bindings::QtArray::setValueAt): Ditto.
+        (JSC::Bindings::QtArray::valueAt): Ditto.
+        * bridge/qt/qt_runtime.h: Ditto.
+
+        * bridge/testqtbindings.cpp:
+        (main): Use JSValuePtr.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - next step of https://bugs.webkit.org/show_bug.cgi?id=21732
+          improve performance by eliminating JSValue as a base class for JSCell
+
+        Tweak a little more to get closer to where we can make JSValuePtr a class.
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor): Use asObject.
+        (WebCore::constructAudio): Ditto.
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::JSCSSStyleDeclaration::nameGetter): Ditto.
+
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::toHTMLCanvasStyle): Use asString and asObject.
+        (WebCore::JSCanvasRenderingContext2D::setFillColor): Ditto.
+        (WebCore::JSCanvasRenderingContext2D::setStrokeColor): Ditto.
+        (WebCore::JSCanvasRenderingContext2D::drawImage): Ditto.
+        (WebCore::JSCanvasRenderingContext2D::drawImageFromRect): Ditto.
+        (WebCore::JSCanvasRenderingContext2D::setShadow): Ditto.
+        (WebCore::JSCanvasRenderingContext2D::createPattern): Ditto.
+
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent): Use JSValuePtr.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::setDOMException): Use noValue.
+
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::getDOMPrototype): Use asObject.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::showModalDialog): Use noValue.
+        (jsDOMWindowBaseEvent): Use asObject.
+        (jsDOMWindowBaseImage): Ditto.
+        (jsDOMWindowBaseMessageChannel): Ditto.
+        (jsDOMWindowBaseOption): Ditto.
+        (jsDOMWindowBaseXMLHttpRequest): Ditto.
+        (jsDOMWindowBaseAudio): Ditto.
+        (jsDOMWindowBaseXSLTProcessor): Ditto.
+        (WebCore::JSDOMWindowBase::childFrameGetter): Ditto.
+        (WebCore::JSDOMWindowBase::indexGetter): Ditto.
+        (WebCore::JSDOMWindowBase::namedItemGetter): Ditto.
+        (WebCore::JSDOMWindowBase::getOwnPropertySlot): Ditto.
+        (WebCore::JSDOMWindowBase::findJSEventListener): Ditto.
+        (WebCore::JSDOMWindowBase::findOrCreateJSEventListener): Ditto.
+        (WebCore::JSDOMWindowBase::findJSUnprotectedEventListener): Ditto.
+        (WebCore::JSDOMWindowBase::findOrCreateJSUnprotectedEventListener): Ditto.
+        (windowProtoFuncOpen): Use noValue.
+        (WebCore::toJSDOMWindow): Use asObject.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::setTimeoutOrInterval): Use asString.
+        (WebCore::toDOMWindow): Use asObject.
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSAbstractEventListener::handleEvent): Use noValue.
+        (WebCore::JSLazyEventListener::parseCode): Use asObject.
+
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::JSHTMLCollection::nameGetter): Use asObject.
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        (WebCore::JSHTMLDocument::nameGetter): Ditto.
+        * bindings/js/JSHTMLElementCustom.cpp:
+        (WebCore::JSHTMLElement::pushEventHandlerScope): Ditto.
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter): Ditto.
+        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
+        (WebCore::JSHTMLFrameSetElement::nameGetter): Ditto.
+        * bindings/js/JSHTMLOptionElementConstructor.cpp:
+        (WebCore::JSHTMLOptionElementConstructor::JSHTMLOptionElementConstructor): Ditto.
+        (WebCore::constructHTMLOptionElement): Ditto.
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        (WebCore::JSHTMLOptionsCollection::remove): Ditto.
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor): Ditto.
+        (WebCore::constructImage): Ditto.
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::wrap): Ditto.
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::wrap): Ditto.
+
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        (WebCore::JSJavaScriptCallFrame::evaluate): Use noValue.
+
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::JSMessageChannelConstructor): Use asObject.
+        (WebCore::JSMessageChannelConstructor::construct): Ditto.
+        * bindings/js/JSMimeTypeArrayCustom.cpp:
+        (WebCore::JSMimeTypeArray::nameGetter): Ditto.
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        (WebCore::JSNamedNodeMap::nameGetter): Ditto.
+        * bindings/js/JSNamedNodesCollection.cpp:
+        (WebCore::JSNamedNodesCollection::lengthGetter): Ditto.
+        (WebCore::JSNamedNodesCollection::indexGetter): Ditto.
+        * bindings/js/JSNodeFilterCustom.cpp:
+        (WebCore::toNodeFilter): Ditto.
+        * bindings/js/JSNodeListCustom.cpp:
+        (WebCore::JSNodeList::nameGetter): Ditto.
+        * bindings/js/JSPluginArrayCustom.cpp:
+        (WebCore::JSPluginArray::nameGetter): Ditto.
+        * bindings/js/JSPluginCustom.cpp:
+        (WebCore::JSPlugin::nameGetter): Ditto.
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::runtimeObjectGetter): Ditto.
+        (WebCore::runtimeObjectPropertyGetter): Ditto.
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::asWrapper): Ditto.
+        (WebCore::JSQuarantinedObjectWrapper::getOwnPropertySlot): Ditto.
+        (WebCore::JSQuarantinedObjectWrapper::construct): Ditto.
+        * bindings/js/JSRGBColor.cpp:
+        (jsRGBColorRed): Ditto.
+        (jsRGBColorGreen): Ditto.
+        (jsRGBColorBlue): Ditto.
+
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        (WebCore::JSSQLResultSetRowList::item): Use noValue.
+
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::nameGetter): Use asObject.
+        (WebCore::JSStorage::deleteProperty): Ditto.
+        (WebCore::JSStorage::customPut): Ditto.
+        * bindings/js/JSStyleSheetListCustom.cpp:
+        (WebCore::JSStyleSheetList::nameGetter): Ditto.
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor): Ditto.
+        * bindings/js/JSXSLTProcessorCustom.cpp:
+        (WebCore::JSXSLTProcessor::importStylesheet): Ditto.
+        (WebCore::JSXSLTProcessor::transformToFragment): Ditto.
+        (WebCore::JSXSLTProcessor::transformToDocument): Ditto.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate): Use noValue.
+        * bindings/objc/DOMInternal.mm:
+        (-[WebScriptObject _initializeScriptDOMNodeImp]): Ditto.
+
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject evaluateWebScript:]): Use JSValuePtr.
+        (-[WebScriptObject valueForKey:]): Ditto.
+        (-[WebScriptObject webScriptValueAtIndex:]): Ditto.
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        Use asObject and asString.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Use asObject.
+
+        * bridge/c/c_instance.h: Use JSValuePtr.
+        * bridge/c/c_runtime.cpp:
+        (JSC::Bindings::CField::setValueToInstance): Ditto.
+
+        * bridge/c/c_utility.cpp:
+        (JSC::Bindings::convertValueToNPVariant): Use asObject.
+
+        * bridge/jni/jni_instance.cpp:
+        (JavaInstance::booleanValue): Use JSValuePtr.
+        (JavaInstance::invokeMethod): Ditto. And noValue.
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::getSlot): Ditto.
+        (JavaJSObject::convertValueToJObject): Ditto.
+        * bridge/jni/jni_runtime.cpp:
+        (JavaField::dispatchValueFromInstance): Ditto.
+        (JavaField::valueFromInstance): Ditto.
+        (JavaField::dispatchSetValueToInstance): Ditto.
+        (JavaField::setValueToInstance): Ditto.
+        (JavaArray::setValueAt): Ditto.
+        (JavaArray::valueAt): Ditto.
+        * bridge/jni/jni_runtime.h: Ditto.
+
+        * bridge/jni/jni_utility.cpp:
+        (JSC::Bindings::convertArrayInstanceToJavaArray): Take a JSArray*
+        instead of a JSValue*.
+        (JSC::Bindings::convertValueToJValue): Use asObject and asArray.
+
+        * bridge/objc/objc_class.h: Use JSValuePtr.
+        * bridge/objc/objc_instance.h: Ditto.
+        * bridge/objc/objc_runtime.h: Ditto.
+
+        * bridge/objc/objc_runtime.mm:
+        (JSC::Bindings::callObjCFallbackObject): Use asObject.
+
+        * bridge/objc/objc_utility.h: Use JSValuePtr.
+        * bridge/objc/objc_utility.mm:
+        (JSC::Bindings::convertValueToObjcValue): Use JSValuePtr and asObject.
+        (JSC::Bindings::convertObjcValueToValue): Use jsUndefined() instead of 0.
+
+        * bridge/runtime.cpp:
+        (JSC::Bindings::Instance::getValueOfField): Use JSValuePtr.
+        (JSC::Bindings::Instance::setValueOfField): Ditto.
+
+        * bridge/runtime_array.cpp:
+        (JSC::RuntimeArray::lengthGetter): Use JSValuePtr and asObject.
+        (JSC::RuntimeArray::indexGetter): Ditto.
+        * bridge/runtime_array.h: Ditto.
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::lengthGetter): Ditto.
+        (JSC::callRuntimeMethod): Ditto.
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::fallbackObjectGetter): Ditto.
+        (JSC::RuntimeObjectImp::fieldGetter): Ditto.
+        (JSC::RuntimeObjectImp::methodGetter): Ditto.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::executeScript): Use noValue.
+
+        * page/Console.cpp:
+        (WebCore::Console::trace): Use asInternalFunction.
+
+2008-10-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        - lower the default button repaint frequency
+
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::styleDidChange): Changed the timer interval from
+        0.01 to 0.03.
+
+2008-10-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - Windows build fix
+
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::paintMediaFullscreenButton):
+        (WebCore::RenderThemeSafari::paintMediaMuteButton):
+        (WebCore::RenderThemeSafari::paintMediaPlayButton):
+        (WebCore::RenderThemeSafari::paintMediaSeekBackButton):
+        (WebCore::RenderThemeSafari::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeSafari::paintMediaSliderThumb):
+
+2008-10-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - WebCore part of https://bugs.webkit.org/show_bug.cgi?id=21736
+          Long-dead decoded image data make up for most of the object cache's memory use over time
+
+        Add a cache setting for how long decoded image data should be allowed to
+        persist in memory after the image has died. By default, this is set to
+        0, which means "forever".
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::Cache): Initialize m_deadDecodedDataDeletionInterval.
+        * loader/Cache.h:
+        (WebCore::Cache::setDeadDecodedDataDeletionInterval): Added a setter.
+        (WebCore::Cache::deadDecodedDataDeletionInterval): Added a getter.
+        * loader/CachedImage.cpp:
+        (WebCore::CachedImage::CachedImage): Initialize the decoded data
+        deletion timer.
+        (WebCore::CachedImage::decodedDataDeletionTimerFired): Added. Destroys
+        the decoded image data.
+        (WebCore::CachedImage::addClient): Stop the timer if it is active.
+        (WebCore::CachedImage::allClientsRemoved): Start the decoded data
+        deletion timer.
+        * loader/CachedImage.h:
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=21645
+          REGRESSION (r37469-r37605): File Input not Uploaded in Multipart/Form-data Form
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::formData):
+        Fix loop that goes through the FormDataList to go two at a time in a clearer
+        way. My last patch screwed up the way it got form content from the items.
+        This "two at a time" approach is a confusing way to do things, which explains
+        why I got it wrong last time through, but I decided to just fix it locally for
+        now rather than changing the design of FormDataList.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - next step on https://bugs.webkit.org/show_bug.cgi?id=21732
+          improve performance by eliminating JSValue as a base class for JSCell
+
+        Use JSValuePtr everywhere instead of JSValue*. In the future, we'll be
+        changing JSValuePtr to be a class, and then eventually renaming it
+        to JSValue once that's done.
+
+        * bindings/js/JSAttrCustom.cpp:
+        * bindings/js/JSCSSRuleCustom.cpp:
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        * bindings/js/JSCSSValueCustom.cpp:
+        * bindings/js/JSCanvasPixelArrayCustom.h:
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        * bindings/js/JSClipboardCustom.cpp:
+        * bindings/js/JSConsoleCustom.cpp:
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        * bindings/js/JSCustomVoidCallback.cpp:
+        * bindings/js/JSCustomVoidCallback.h:
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        * bindings/js/JSDOMBinding.cpp:
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        * bindings/js/JSDOMWindowCustom.h:
+        * bindings/js/JSDOMWindowShell.cpp:
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSDatabaseCustom.cpp:
+        * bindings/js/JSDocumentCustom.cpp:
+        * bindings/js/JSElementCustom.cpp:
+        * bindings/js/JSEventCustom.cpp:
+        * bindings/js/JSEventListener.cpp:
+        * bindings/js/JSEventTarget.cpp:
+        * bindings/js/JSEventTargetBase.h:
+        * bindings/js/JSEventTargetNodeCustom.cpp:
+        * bindings/js/JSHTMLAllCollection.h:
+        * bindings/js/JSHTMLAppletElementCustom.cpp:
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        * bindings/js/JSHTMLEmbedElementCustom.cpp:
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        * bindings/js/JSHTMLFrameElementCustom.cpp:
+        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
+        * bindings/js/JSHTMLIFrameElementCustom.cpp:
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        * bindings/js/JSHTMLObjectElementCustom.cpp:
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        * bindings/js/JSHTMLSelectElementCustom.cpp:
+        * bindings/js/JSHTMLSelectElementCustom.h:
+        * bindings/js/JSHistoryCustom.cpp:
+        * bindings/js/JSImageDataCustom.cpp:
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        * bindings/js/JSInspectedObjectWrapper.h:
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        * bindings/js/JSInspectorCallbackWrapper.h:
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        * bindings/js/JSLocationCustom.cpp:
+        * bindings/js/JSMessagePortCustom.cpp:
+        * bindings/js/JSMimeTypeArrayCustom.cpp:
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        * bindings/js/JSNamedNodesCollection.cpp:
+        * bindings/js/JSNamedNodesCollection.h:
+        * bindings/js/JSNavigatorCustom.cpp:
+        * bindings/js/JSNodeCustom.cpp:
+        * bindings/js/JSNodeFilterCondition.cpp:
+        * bindings/js/JSNodeFilterCustom.cpp:
+        * bindings/js/JSNodeIteratorCustom.cpp:
+        * bindings/js/JSNodeListCustom.cpp:
+        * bindings/js/JSPluginArrayCustom.cpp:
+        * bindings/js/JSPluginCustom.cpp:
+        * bindings/js/JSPluginElementFunctions.cpp:
+        * bindings/js/JSPluginElementFunctions.h:
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSRGBColor.cpp:
+        * bindings/js/JSRGBColor.h:
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        * bindings/js/JSSVGLengthCustom.cpp:
+        * bindings/js/JSSVGMatrixCustom.cpp:
+        * bindings/js/JSSVGPathSegCustom.cpp:
+        * bindings/js/JSSVGPathSegListCustom.cpp:
+        * bindings/js/JSSVGPointListCustom.cpp:
+        * bindings/js/JSSVGTransformListCustom.cpp:
+        * bindings/js/JSStorageCustom.cpp:
+        * bindings/js/JSStyleSheetCustom.cpp:
+        * bindings/js/JSStyleSheetListCustom.cpp:
+        * bindings/js/JSTextCustom.cpp:
+        * bindings/js/JSTreeWalkerCustom.cpp:
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        * bindings/js/JSXSLTProcessorCustom.cpp:
+        * bindings/js/ScheduledAction.cpp:
+        * bindings/js/ScheduledAction.h:
+        * bindings/js/ScriptController.cpp:
+        * bindings/js/ScriptController.h:
+        * bindings/objc/WebScriptObject.mm:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/NP_jsobject.cpp:
+        * bridge/c/c_instance.cpp:
+        * bridge/c/c_instance.h:
+        * bridge/c/c_runtime.cpp:
+        * bridge/c/c_runtime.h:
+        * bridge/c/c_utility.cpp:
+        * bridge/jni/jni_instance.cpp:
+        * bridge/jni/jni_instance.h:
+        * bridge/jni/jni_jsobject.mm:
+        * bridge/jni/jni_objc.mm:
+        * bridge/jni/jni_runtime.cpp:
+        * bridge/jni/jni_runtime.h:
+        * bridge/jni/jni_utility.cpp:
+        * bridge/objc/objc_class.mm:
+        * bridge/objc/objc_instance.h:
+        * bridge/objc/objc_instance.mm:
+        * bridge/objc/objc_runtime.h:
+        * bridge/objc/objc_runtime.mm:
+        * bridge/objc/objc_utility.h:
+        * bridge/objc/objc_utility.mm:
+        * bridge/runtime.h:
+        * bridge/runtime_array.cpp:
+        * bridge/runtime_array.h:
+        * bridge/runtime_method.cpp:
+        * bridge/runtime_method.h:
+        * bridge/runtime_object.cpp:
+        * bridge/runtime_object.h:
+        * inspector/JavaScriptCallFrame.cpp:
+        * inspector/JavaScriptCallFrame.h:
+        * inspector/JavaScriptProfile.cpp:
+        * inspector/JavaScriptProfileNode.cpp:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * page/Console.cpp:
+        * page/Console.h:
+        * plugins/MimeTypeArray.h:
+        * plugins/Plugin.h:
+        * plugins/PluginArray.h:
+        * xml/XMLHttpRequest.cpp:
+        Replace JSValue* with JSValuePtr.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - first step of https://bugs.webkit.org/show_bug.cgi?id=21732
+          improve performance by eliminating JSValue as a base class for JSCell
+
+        Update for change to make PreferredPrimitiveType no longer
+        a member of JSValue.
+
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::defaultValue): Removed JSValue:: prefix.
+        * bridge/jni/jni_instance.cpp:
+        (JavaInstance::defaultValue): Ditto.
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::defaultValue): Ditto.
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::defaultValue): Ditto.
+        * bridge/runtime.h: Ditto. Also removed typedef.
+
+2008-10-18  Darin Adler  <darin@apple.com>
+
+        - try to fix Windows build
+
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::paintCheckbox): Explicitly qualify part name with
+        SafariTheme namespace, since there is now an identically named constant in
+        the ControlPart enum.
+        (WebCore::RenderThemeSafari::paintButton): Ditto.
+        (WebCore::RenderThemeSafari::paintTextField): Ditto.
+        (WebCore::RenderThemeSafari::paintTextArea): Ditto.
+        (WebCore::RenderThemeSafari::paintSearchField): Ditto.
+        (WebCore::RenderThemeSafari::paintSearchFieldCancelButton): Ditto.
+        (WebCore::RenderThemeSafari::paintSearchFieldResultsDecoration): Ditto.
+        (WebCore::RenderThemeSafari::paintSearchFieldResultsButton): Ditto.
+
+2008-10-18  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Alp Toker.
+
+        [GTK] crash after selecting a file on an <input type=file>
+        https://bugs.webkit.org/show_bug.cgi?id=21385
+
+        Follow Mac and Win's behaviors for Icon::paint
+
+        * platform/graphics/gtk/IconGtk.cpp:
+        (WebCore::Icon::paint): check if painting is enabled before
+        painting the icon
+
+2008-10-18  Zan Dobersek  <zandobersek@gmail.com>
+
+        Reviewed by Oliver Hunt.
+
+        Qt port build fix.
+
+        * platform/qt/RenderThemeQt.h:
+
+2008-10-17  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Kevin Ollivier
+
+        Fix wx port's scrollbar and drawing handling after recent changes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21720
+
+        * platform/ScrollView.h:
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::platformVisibleContentRect):
+        (WebCore::ScrollView::platformContentsSize):
+        (WebCore::ScrollView::platformSetContentsSize):
+        * platform/wx/WidgetWx.cpp:
+        (WebCore::Widget::paint):
+
+2008-10-17  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. EAppearance -> ControlPart.
+
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderThemeWx::isControlStyled):
+        (WebCore::RenderThemeWx::adjustRepaintRect):
+        (WebCore::RenderThemeWx::controlSupportsTints):
+        (WebCore::RenderThemeWx::supportsFocus):
+        (WebCore::RenderThemeWx::paintButton):
+
+2008-10-17  David Hyatt  <hyatt@apple.com>
+
+        Eliminate the EAppearance enum in favor of the new ControlPart enum.  Cut out the scrollbar
+        values from the enum since they are handled by ScrollbarTheme instead.
+
+        Reviewed by Tim Hatcher
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator ControlPart):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        * css/CSSValueKeywords.in:
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::supportsFocus):
+        (WebCore::RenderThemeGtk::baselinePosition):
+        (WebCore::setToggleSize):
+        (WebCore::RenderThemeGtk::setCheckboxSize):
+        (WebCore::RenderThemeGtk::setRadioSize):
+        (WebCore::RenderThemeGtk::adjustButtonStyle):
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::baselinePosition):
+        (WebCore::RenderThemeQt::controlSupportsTints):
+        (WebCore::RenderThemeQt::adjustRepaintRect):
+        (WebCore::RenderThemeQt::isControlStyled):
+        (WebCore::computeSizeBasedOnStyle):
+        (WebCore::RenderThemeQt::paintButton):
+        (WebCore::RenderThemeQt::paintTextField):
+        (WebCore::RenderThemeQt::paintMenuList):
+        (WebCore::RenderThemeQt::supportsFocus):
+        (WebCore::RenderThemeQt::applyTheme):
+        (WebCore::RenderThemeQt::adjustSliderThumbSize):
+        * platform/qt/RenderThemeQt.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::createThumbStyle):
+        (WebCore::RenderSlider::layout):
+        (WebCore::RenderSlider::setValueForPosition):
+        (WebCore::RenderSlider::setPositionFromValue):
+        (WebCore::RenderSlider::positionForOffset):
+        (WebCore::RenderSlider::currentPosition):
+        (WebCore::RenderSlider::setCurrentPosition):
+        (WebCore::RenderSlider::trackSize):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        (WebCore::RenderTheme::paint):
+        (WebCore::RenderTheme::paintBorderOnly):
+        (WebCore::RenderTheme::paintDecorations):
+        (WebCore::RenderTheme::isControlContainer):
+        (WebCore::RenderTheme::isControlStyled):
+        (WebCore::RenderTheme::supportsFocusRing):
+        (WebCore::RenderTheme::isDefault):
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::isControlStyled):
+        (WebCore::RenderThemeMac::adjustRepaintRect):
+        (WebCore::RenderThemeMac::baselinePosition):
+        (WebCore::RenderThemeMac::controlSupportsTints):
+        (WebCore::RenderThemeMac::adjustButtonStyle):
+        (WebCore::RenderThemeMac::setButtonCellState):
+        (WebCore::RenderThemeMac::popupInternalPaddingLeft):
+        (WebCore::RenderThemeMac::popupInternalPaddingRight):
+        (WebCore::RenderThemeMac::popupInternalPaddingTop):
+        (WebCore::RenderThemeMac::popupInternalPaddingBottom):
+        (WebCore::RenderThemeMac::paintSliderTrack):
+        (WebCore::RenderThemeMac::paintSliderThumb):
+        (WebCore::RenderThemeMac::adjustSliderThumbSize):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::isControlStyled):
+        (WebCore::RenderThemeSafari::adjustRepaintRect):
+        (WebCore::RenderThemeSafari::baselinePosition):
+        (WebCore::RenderThemeSafari::controlSupportsTints):
+        (WebCore::RenderThemeSafari::adjustButtonStyle):
+        (WebCore::RenderThemeSafari::popupInternalPaddingLeft):
+        (WebCore::RenderThemeSafari::popupInternalPaddingRight):
+        (WebCore::RenderThemeSafari::popupInternalPaddingTop):
+        (WebCore::RenderThemeSafari::popupInternalPaddingBottom):
+        (WebCore::RenderThemeSafari::paintSliderTrack):
+        (WebCore::RenderThemeSafari::adjustSliderThumbSize):
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::supportsFocus):
+        (WebCore::RenderThemeWin::determineClassicState):
+        (WebCore::RenderThemeWin::getClassicThemeData):
+        (WebCore::RenderThemeWin::getThemeData):
+        (WebCore::drawControl):
+        (WebCore::RenderThemeWin::paintSliderTrack):
+        (WebCore::RenderThemeWin::adjustSliderThumbSize):
+        * rendering/RenderThemeWin.h:
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::hasAppearance):
+        (WebCore::InheritedFlags::appearance):
+        (WebCore::InheritedFlags::setAppearance):
+        (WebCore::InheritedFlags::initialAppearance):
+        * rendering/style/RenderStyleConstants.h:
+
+2008-10-17  David Hyatt  <hyatt@apple.com>
+
+        Beginning of the RenderTheme re-architecture (to share more code).  Add the new Theme API header
+        file.  Add new USE(NEW_THEME) switch that is enabled on Mac.  The Mac theme will be converted first.
+
+        Reviewed by Tim Hatcher
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * config.h:
+        * platform/Theme.h: Added.
+        (WebCore::Theme::Theme):
+        (WebCore::Theme::~Theme):
+        (WebCore::Theme::baselinePositionAdjustment):
+        (WebCore::Theme::controlHasInactiveAppearance):
+        (WebCore::Theme::controlsCanHaveInactiveAppearance):
+        (WebCore::Theme::controlsCanHaveHoveredAppearance):
+        (WebCore::Theme::controlDrawsBorder):
+        (WebCore::Theme::controlDrawsBackground):
+        (WebCore::Theme::controlDrawsFocusOutline):
+        (WebCore::Theme::selectionColor):
+        (WebCore::Theme::textSearchHighlightColor):
+        (WebCore::Theme::systemColor):
+        (WebCore::Theme::systemFont):
+        (WebCore::Theme::caretBlinkFrequency):
+        (WebCore::Theme::themeChanged):
+        (WebCore::Theme::controlSize):
+        (WebCore::Theme::controlFont):
+        (WebCore::Theme::controlPadding):
+        (WebCore::Theme::controlInternalPadding):
+        (WebCore::Theme::controlBorder):
+        (WebCore::Theme::controlBorderRadius):
+        (WebCore::Theme::paint):
+        (WebCore::Theme::inflateControlPaintRect):
+        * platform/ThemeTypes.h: Added.
+        (WebCore::):
+        (WebCore::ControlBox::ControlBox):
+        (WebCore::ControlBox::top):
+        (WebCore::ControlBox::right):
+        (WebCore::ControlBox::bottom):
+        (WebCore::ControlBox::left):
+        * platform/mac/ThemeMac.h: Added.
+        (WebCore::ThemeMac::ThemeMac):
+        (WebCore::ThemeMac::~ThemeMac):
+        * platform/mac/ThemeMac.mm: Added.
+        (WebCore::platformTheme):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::RenderTheme):
+        * rendering/RenderTheme.h:
+
+2008-10-17  Marco Barisione  <marco.barisione@collabora.co.uk>
+
+        Reviewed by Sam Weinig. Landed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21603
+        [GTK] Minor fixes to GOwnPtr
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateErrorCallback):
+
+2008-10-17  Timothy Hatcher  <timothy@apple.com>
+
+        Recompile the JavaScript functions when removing any listener, so functions that are
+        not being debugged can resume normal speed again.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21715
+
+        Reviewed by Geoffrey Garen.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::globalExec): Changed an assert into an if check. This assert
+        was firing when closing the window and having the recompile fire after. This was an
+        overzelious assert now.
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::didRemoveListener): Start the recompile timer.
+        (WebCore::JavaScriptDebugServer::didRemoveLastListener): Removed the recompile timer start.
+
+2008-10-17  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes a regression where starting a debugging session in
+        another Web Inspector window would not show any scripts.
+        Also only attach the debugger to only the required Pages.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21708
+
+        Reviewed by Darin Adler.
+
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::addListener): Add an assert and
+        remove the call to willAddFirstListener(). Add a call to
+        didAddListener().
+        (WebCore::JavaScriptDebugServer::removeListener): Add an assert
+        and call to didRemoveListener().
+        (WebCore::JavaScriptDebugServer::pageCreated): Attach the debugger
+        if there is a listener interested in the new Page.
+        (WebCore::JavaScriptDebugServer::hasListenersInterestedInPage):
+        Use hasGlobalListeners() instead of isEmpty().
+        (WebCore::JavaScriptDebugServer::sourceParsed): Ditto.
+        (WebCore::JavaScriptDebugServer::didAddListener): Added. Attach the
+        debugger to the page if non-null, or all pages if page is null.
+        (WebCore::JavaScriptDebugServer::didRemoveListener): Added. Detach
+        the debugger only if there are no interested listeners.
+        (WebCore::JavaScriptDebugServer::didRemoveLastListener): Remove the
+        call to Page::setDebuggerForAllPages().
+        * inspector/JavaScriptDebugServer.h:
+        (WebCore::JavaScriptDebugServer::hasGlobalListeners): Added.
+
+2008-10-15  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Have ImageDocument generate its own filename for the title of images
+        without relying on the suggested filename from the network layer, which
+        may be nonexistant or not relevant.
+        https://bugs.webkit.org/show_bug.cgi?id=21565
+
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageTokenizer::finish):
+
+2008-10-17  Alexey Proskuryakov  <ap@webkit.org>
+
+        Non-Mac build fix.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+        Added ActiveDOMObject to the build.
+
+2008-10-17  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21642
+        Abstract out active object tracking
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markActiveObjectsForDocument):
+        * dom/ActiveDOMObject.cpp: Added.
+        (WebCore::ActiveDOMObject::ActiveDOMObject):
+        (WebCore::ActiveDOMObject::~ActiveDOMObject):
+        (WebCore::ActiveDOMObject::contextDestroyed):
+        (WebCore::ActiveDOMObject::stop):
+        * dom/ActiveDOMObject.h: Added.
+        (WebCore::ActiveDOMObject::document):
+        (WebCore::ActiveDOMObject::hasPendingActivity):
+        (WebCore::ActiveDOMObject::setPendingActivity):
+        (WebCore::ActiveDOMObject::unsetPendingActivity):
+        * dom/Document.cpp:
+        (WebCore::Document::~Document):
+        (WebCore::Document::stopActiveDOMObjects):
+        (WebCore::Document::createdActiveDOMObject):
+        (WebCore::Document::destroyedActiveDOMObject):
+        * dom/Document.h:
+        (WebCore::Document::activeDOMObjects):
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::contextDestroyed):
+        * dom/MessagePort.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopLoading):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::~XMLHttpRequest):
+        (WebCore::XMLHttpRequest::associatedFrame):
+        (WebCore::XMLHttpRequest::responseXML):
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+        (WebCore::XMLHttpRequest::initSend):
+        (WebCore::XMLHttpRequest::send):
+        (WebCore::XMLHttpRequest::createRequest):
+        (WebCore::XMLHttpRequest::makeSimpleCrossSiteAccessRequest):
+        (WebCore::XMLHttpRequest::makeCrossSiteAccessRequestWithPreflight):
+        (WebCore::XMLHttpRequest::handleAsynchronousPreflightResult):
+        (WebCore::XMLHttpRequest::loadRequestSynchronously):
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
+        (WebCore::XMLHttpRequest::dropProtection):
+        (WebCore::XMLHttpRequest::setRequestHeader):
+        (WebCore::XMLHttpRequest::processSyncLoadResults):
+        (WebCore::XMLHttpRequest::didFinishLoading):
+        (WebCore::XMLHttpRequest::didFinishLoadingPreflight):
+        (WebCore::XMLHttpRequest::willSendRequest):
+        (WebCore::XMLHttpRequest::accessControlCheck):
+        (WebCore::XMLHttpRequest::didReceiveResponsePreflight):
+        (WebCore::XMLHttpRequest::stop):
+        (WebCore::XMLHttpRequest::contextDestroyed):
+        * xml/XMLHttpRequest.h:
+        Move activity tracking to a new ActiveDOMObject class.
+
+2008-10-16  David Hyatt  <hyatt@apple.com>
+
+        Simplify styleForRenderer to avoid confusion.  Callers in the SVG filter code thought "forRenderer" meant
+        they would be given a style that corresponded to the RenderObject* passed in.  This is not what the code
+        did though.  This patch removes the renderer argument and the Element subclass shadow implementation
+        so that confusion like this can't occur again.
+
+        Reviewed by Oliver Hunt
+
+        * dom/Element.cpp:
+        * dom/Element.h:
+        * dom/Node.cpp:
+        (WebCore::Node::createRendererIfNeeded):
+        (WebCore::Node::styleForRenderer):
+        * dom/Node.h:
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::attach):
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::attach):
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::canvasResource):
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::build):
+        * svg/SVGFEFloodElement.cpp:
+        (WebCore::SVGFEFloodElement::build):
+        * svg/SVGFESpecularLightingElement.cpp:
+        (WebCore::SVGFESpecularLightingElement::build):
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::buildStops):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::attachShadowTree):
+
+2008-10-16  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/attachment.cgi?bugid=21647
+
+        Make RenderStyle inherit from RefCounted so that it works with RefPtr.  RenderStyle was being malloced
+        out of the RenderArena.  Years and years ago (before TCMalloc), the plan was to make RenderStyles and
+        all their associated sub-structs use the arena.  However only the RenderStyle itself was ever changed
+        to use the arena.
+
+        At a later point style sharing was implemented, which made using the arena for styles pretty pointless,
+        as the bulk of the styles on a given page are actually shared.  Not ever making the sub-structs use the
+        arena also limited the usefulness.
+
+        Now that we have RefPtr/PassRefPtr to eliminate manual ref/deref and now that we use TCMalloc for fast
+        mallocs, there is no reason to keep RenderStyles in the arena.  The benefits of being able to eliminate
+        manual ref/deref far outweigh keeping them in the arena.
+
+        Reviewed by Adam Roben
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        (WebCore::CSSStyleSelector::~CSSStyleSelector):
+        (WebCore::CSSStyleSelector::styleForElement):
+        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
+        (WebCore::CSSStyleSelector::pseudoStyleForElement):
+        These methods now return a PassRefPtr.  They will null out the m_style variable as they hand it back
+        so that it isn't left pointing to the previous style resolve RenderStyle (which is what the old code did).
+
+        (WebCore::CSSStyleSelector::updateFont):
+        (WebCore::CSSStyleSelector::checkSelector):
+        (WebCore::CSSStyleSelector::applyProperty):
+        (WebCore::CSSStyleSelector::mapFillSize):
+        (WebCore::CSSStyleSelector::mapFillXPosition):
+        (WebCore::CSSStyleSelector::mapFillYPosition):
+        * css/CSSStyleSelector.h:
+        (WebCore::CSSStyleSelector::style):
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        * dom/Element.cpp:
+        (WebCore::Element::styleForRenderer):
+        (WebCore::Element::recalcStyle):
+        (WebCore::Element::computedStyle):
+        * dom/Element.h:
+        * dom/ElementRareData.h:
+        (WebCore::ElementRareData::ElementRareData):
+        (WebCore::ElementRareData::resetComputedStyle):
+        * dom/Node.cpp:
+        (WebCore::Node::diff):
+        (WebCore::Node::createRendererIfNeeded):
+        (WebCore::Node::styleForRenderer):
+        (WebCore::Node::setRenderStyle):
+        * dom/Node.h:
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setFont):
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::attach):
+        (WebCore::HTMLOptGroupElement::detach):
+        (WebCore::HTMLOptGroupElement::setRenderStyle):
+        (WebCore::HTMLOptGroupElement::nonRendererRenderStyle):
+        * html/HTMLOptGroupElement.h:
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::attach):
+        (WebCore::HTMLOptionElement::detach):
+        (WebCore::HTMLOptionElement::setRenderStyle):
+        (WebCore::HTMLOptionElement::nonRendererRenderStyle):
+        * html/HTMLOptionElement.h:
+        * page/animation/AnimationBase.h:
+        (WebCore::AnimationBase::animate):
+        * page/animation/AnimationController.cpp:
+        (WebCore::AnimationController::updateAnimations):
+        * page/animation/AnimationController.h:
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::updateTransitions):
+        (WebCore::CompositeAnimationPrivate::updateKeyframeAnimations):
+        (WebCore::CompositeAnimationPrivate::animate):
+        (WebCore::CompositeAnimation::animate):
+        * page/animation/CompositeAnimation.h:
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::ImplicitAnimation):
+        (WebCore::ImplicitAnimation::~ImplicitAnimation):
+        (WebCore::ImplicitAnimation::animate):
+        (WebCore::ImplicitAnimation::reset):
+        (WebCore::ImplicitAnimation::isTargetPropertyEqual):
+        (WebCore::ImplicitAnimation::blendPropertyValueInStyle):
+        * page/animation/ImplicitAnimation.h:
+        (WebCore::ImplicitAnimation::create):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::KeyframeAnimation):
+        (WebCore::KeyframeAnimation::~KeyframeAnimation):
+        (WebCore::KeyframeAnimation::animate):
+        (WebCore::KeyframeAnimation::validateTransformFunctionList):
+        * page/animation/KeyframeAnimation.h:
+        (WebCore::KeyframeAnimation::create):
+        (WebCore::KeyframeAnimation::unanimatedStyle):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paint):
+        * rendering/MediaControlElements.cpp:
+        (WebCore::MediaControlShadowRootElement::MediaControlShadowRootElement):
+        (WebCore::MediaControlInputElement::MediaControlInputElement):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::styleDidChange):
+        (WebCore::RenderBlock::updateFirstLetter):
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::addChild):
+        (WebCore::RenderContainer::updateBeforeAfterContentForContainer):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::updateFromElement):
+        (WebCore::RenderFileUploadControl::createButtonStyle):
+        * rendering/RenderFileUploadControl.h:
+        * rendering/RenderFlow.cpp:
+        (WebCore::RenderFlow::createAnonymousFlow):
+        * rendering/RenderFlow.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::addChildToFlow):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateScrollCornerStyle):
+        (WebCore::RenderLayer::updateResizerStyle):
+        (WebCore::RenderLayer::updateReflectionStyle):
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::styleDidChange):
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::createPanel):
+        (WebCore::RenderMedia::createTimeDisplay):
+        (WebCore::RenderMedia::changeOpacity):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::selectionBackgroundColor):
+        (WebCore::RenderObject::selectionForegroundColor):
+        (WebCore::RenderObject::createAnonymousBlock):
+        (WebCore::RenderObject::setAnimatableStyle):
+        (WebCore::RenderObject::setStyle):
+        (WebCore::RenderObject::setStyleInternal):
+        (WebCore::RenderObject::arenaDelete):
+        (WebCore::RenderObject::firstLineStyle):
+        (WebCore::RenderObject::getPseudoStyle):
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::style):
+        * rendering/RenderSVGBlock.cpp:
+        (WebCore::RenderSVGBlock::setStyle):
+        * rendering/RenderSVGBlock.h:
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::getScrollbarPseudoStyle):
+        (WebCore::RenderScrollbar::updateScrollbarPart):
+        * rendering/RenderScrollbar.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::styleDidChange):
+        (WebCore::RenderSlider::createThumbStyle):
+        (WebCore::RenderSlider::updateFromElement):
+        * rendering/RenderSlider.h:
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::addChild):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::addChild):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::addChild):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::styleDidChange):
+        (WebCore::RenderTextControl::createInnerBlockStyle):
+        (WebCore::RenderTextControl::createInnerTextStyle):
+        (WebCore::RenderTextControl::createResultsButtonStyle):
+        (WebCore::RenderTextControl::createCancelButtonStyle):
+        (WebCore::RenderTextControl::createSubtreeIfNeeded):
+        (WebCore::RenderTextControl::updatePlaceholderVisibility):
+        * rendering/RenderTextControl.h:
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::TextControlInnerElement::attachInnerElement):
+        * rendering/TextControlInnerElements.h:
+        * rendering/style/KeyframeList.cpp:
+        (WebCore::KeyframeList::clear):
+        (WebCore::KeyframeList::operator==):
+        (WebCore::KeyframeList::insert):
+        * rendering/style/KeyframeList.h:
+        (WebCore::KeyframeValue::KeyframeValue):
+        (WebCore::KeyframeValue::~KeyframeValue):
+        (WebCore::KeyframeValue::key):
+        (WebCore::KeyframeValue::style):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::defaultStyle):
+        (WebCore::RenderStyle::create):
+        (WebCore::RenderStyle::createDefaultStyle):
+        (WebCore::RenderStyle::clone):
+        (WebCore::RenderStyle::RenderStyle):
+        (WebCore::RenderStyle::getCachedPseudoStyle):
+        (WebCore::RenderStyle::addCachedPseudoStyle):
+        * rendering/style/RenderStyle.h:
+        (WebCore::):
+        (WebCore::InheritedFlags::operator!=):
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::canvasResource):
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::buildStops):
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::resolveStyle):
+        * svg/SVGStyledElement.h:
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::recalcStyle):
+        (WebCore::SVGUseElement::attachShadowTree):
+
+2008-10-16  Kenneth Russell  <kenneth.russell@sun.com>
+
+        Reviewed and landed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21587
+        NPN_PluginThreadAsyncCall does not work properly
+
+        * plugins/PluginMainThreadScheduler.cpp:
+        (WebCore::PluginMainThreadScheduler::dispatchCalls):
+        Make sure to set m_callPending to false once the queue has been cleared.
+
+2008-10-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21609
+        Make MessagePorts protect their peers across heaps
+
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::MessagePort):
+        * dom/MessagePort.h:
+        (WebCore::MessagePort::setJSWrapperIsKnownToBeInaccessible):
+        (WebCore::MessagePort::jsWrapperIsKnownToBeInaccessible):
+        Track objects whose JS wrappers are no longer reachable in MessagePort. Unfortunately, this
+        means that the implementation object knows about JS bindings - but it is not possible to
+        access JS wrappers from another heap/thread.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::markCrossHeapDependentObjectsForDocument):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::markCrossHeapDependentObjects):
+        * bindings/js/JSDOMWindowBase.h:
+        Implement cross-heap dependency tracking for entangled MessagePorts. If a wrapper object
+        hasn't been marked normally, it is marked as inaccessible. It is then marked manually,
+        as long as its entangled port is accessible itself.
+
+2008-10-15  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Remove unneeded check of whether a Page defers loading before running it
+        in a modal dialog.
+
+        No test possible.
+
+        Reviewed by Tim Hatcher.
+
+        * page/Chrome.cpp:
+
+2008-10-15  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=21345
+        Start the debugger without reloading the inspected page
+
+        * WebCore.base.exp: New symbols.
+
+        * ForwardingHeaders/kjs/CollectorHeapIterator.h: Copied from ForwardingHeaders/kjs/ustring.h.
+        * ForwardingHeaders/kjs/Parser.h: Copied from ForwardingHeaders/kjs/ustring.h.
+        * WebCore.xcodeproj/project.pbxproj: New forwarding headers.
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        (WebCore::InspectorController::startDebugging):
+        * inspector/InspectorController.h: Renamed startDebuggingAndReloadInspectedPage
+        to startDebugging, and changed its behavior to match.
+
+        * inspector/JavaScriptDebugListener.h:
+        * inspector/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::JavaScriptDebugServer):
+        (WebCore::JavaScriptDebugServer::addListener):
+        (WebCore::JavaScriptDebugServer::removeListener):
+        (WebCore::JavaScriptDebugServer::recompileAllJSFunctions):
+        (WebCore::JavaScriptDebugServer::willAddFirstListener):
+        (WebCore::JavaScriptDebugServer::didRemoveLastListener):
+        * inspector/JavaScriptDebugServer.h: Refactored the
+        JavaScriptDebugServer to centralize handling of adding the first listener
+        and removing the last. Then, added a feature to recompile all JS functions
+        in these cases. This allows us to dynamically add and remove hooks like
+        the debugger hooks without reloading the page.
+
+        * inspector/front-end/ScriptsPanel.js:
+        * English.lproj/localizedStrings.js: Updated for startDebuggingAndReloadInspectedPage =>
+        startDebugging rename. Removed all UI that claimed that starting the
+        debugger would reload the page.
+
+2008-10-15  Adele Peterson  <adele@apple.com>
+
+        Attempt to fix the Tiger build.
+
+        * platform/network/mac/ResourceHandleMac.mm:
+
+2008-10-15  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Build fix attempt.
+
+        Try to fix static/non-static declaration of g_string_append_uri_escape
+        by renaming that string. Another look needs to be taken.
+
+        * platform/gtk/guriescape.c:
+        (_webcore_g_string_append_uri_escaped):
+        (_webcore_g_uri_escape_string):
+
+2008-10-15  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Build fix.
+
+        m_animatingImageType is gone.
+
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+
+2008-10-15  Jeff Cook <cookiecaper@gmail.com>
+
+        Reviewed by Holger Freyther.
+
+        Stop SIGSEGV when leaving a page with a Flash object by reordering
+        window destruction and plugin stop.
+
+        See https://bugs.webkit.org/show_bug.cgi?id=20779
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::stop):
+
+2008-10-15  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Implement didSendBodyData delegate method, and use older code path when that delegate doesn't exist.
+
+        * platform/network/ResourceHandle.h:
+        * platform/network/mac/FormDataStreamMac.mm: (WebCore::formRead):
+        * platform/network/mac/ResourceHandleMac.mm:
+        (WebCore::ResourceHandle::didSendBodyDataDelegateExists):
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::cancel):
+        (-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]):
+        (-[WebCoreResourceHandleAsDelegate connection:didSendBodyData:totalBytesWritten:totalBytesExpectedToWrite:]):
+        (-[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:]):
+        (-[WebCoreResourceHandleAsDelegate connection:didFailWithError:]):
+
+2008-10-15  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Hyatt.
+
+        Qt build bustage fix.
+
+        * platform/graphics/qt/StillImageQt.h:
+        (WebCore::StillImage::destroyDecodedData):
+
+2008-10-15  David Hyatt  <hyatt@apple.com>
+
+        Make sure scrollbar styles get deleted if they aren't assigned to a renderer.
+
+        Reviewed by Mark Rowe
+
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::getScrollbarPseudoStyle):
+        (WebCore::RenderScrollbar::updateScrollbarPart):
+
+2008-10-15  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19663 (Second attempt)
+        Account for paint and timer lag when animating images.  Also pretend
+        that images whose animations were paused (by becoming invisible)
+        continued to animate, by "catching up" to the correct frame when they're
+        shown again.
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        (WebCore::BitmapImage::destroyDecodedData):
+        (WebCore::BitmapImage::cacheFrame):
+        (WebCore::BitmapImage::frameIsCompleteAtIndex):
+        (WebCore::BitmapImage::frameDurationAtIndex):
+        (WebCore::BitmapImage::frameHasAlphaAtIndex):
+        (WebCore::BitmapImage::repetitionCount):
+        (WebCore::BitmapImage::shouldAnimate):
+        (WebCore::BitmapImage::startAnimation):
+        (WebCore::BitmapImage::resetAnimation):
+        (WebCore::BitmapImage::advanceAnimation):
+        (WebCore::BitmapImage::internalAdvanceAnimation):
+        (WebCore::BitmapImage::notifyObserverAndTrimDecodedData):
+        * platform/graphics/BitmapImage.h:
+        (WebCore::FrameData::FrameData):
+        (WebCore::BitmapImage::):
+        * platform/graphics/GeneratedImage.h:
+        (WebCore::GeneratedImage::destroyDecodedData):
+        * platform/graphics/Image.h:
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::FrameData::clear):
+        (WebCore::BitmapImage::BitmapImage):
+        (WebCore::BitmapImage::draw):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::FrameData::clear):
+        (WebCore::BitmapImage::BitmapImage):
+        (WebCore::BitmapImage::draw):
+        * platform/graphics/cg/PDFDocumentImage.h:
+        (WebCore::PDFDocumentImage::destroyDecodedData):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::FrameData::clear):
+        (WebCore::BitmapImage::draw):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::FrameData::clear):
+        (WebCore::BitmapImage::draw):
+        * svg/graphics/SVGImage.h:
+        (WebCore::SVGImage::destroyDecodedData):
+
+2008-10-14  Maxime Britto  <britto@apple.com>
+
+        Reviewed by Darin Adler, tweaked and landed by Beth.
+
+        * WebCore.base.exp: Exposes two functions to be able to create a
+        selection from a point on the screen. Also exposes the new
+        TextIterator::currentNode function.
+        * WebCore/editing/TextIterator.cpp:
+        (TextIterator::currentNode) : New function that returns the current
+        text node or NULL if there is no text node.
+
+2008-10-15  Marco Barisione  <marco.barisione@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        http://bugs.webkit.org/show_bug.cgi?id=21211
+        [CURL] Upload doesn't work because cancel is called
+
+        FormDataStream::read returns 0 when retrieving data from the form
+        fails, but also when there is no more data to send. This means that
+        ResourceHandleManager::cancel is always called even when the data was
+        successfully sent.
+
+        Check if there are more elements in the form before calling
+        FormDataStream::read.
+
+        * platform/network/curl/FormDataStreamCurl.cpp:
+        (WebCore::FormDataStream::hasMoreElements):
+        * platform/network/curl/FormDataStreamCurl.h:
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::readCallback):
+
+2008-10-15  Marco Barisione  <marco.barisione@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        http://bugs.webkit.org/show_bug.cgi?id=20664
+        [GTK] File names are not always encodable in UTF-8
+
+        On Linux file names are just raw data and cannot always be directly
+        encoded in UTF-8 or in any other encodings, so we escape them before
+        storing the file name in a String and unescape them before passing
+        them to native functions handling files.
+
+        * GNUmakefile.am:
+        * platform/FileSystem.h:
+        * platform/gtk/FileChooserGtk.cpp:
+        (WebCore::stringByAdoptingFileSystemRepresentation):
+        (WebCore::FileChooser::basenameForWidth):
+        * platform/gtk/FileSystemGtk.cpp:
+        (WebCore::filenameToString):
+        (WebCore::filenameFromString):
+        (WebCore::filenameForDisplay):
+        (WebCore::fileExists):
+        (WebCore::deleteFile):
+        (WebCore::deleteEmptyDirectory):
+        (WebCore::getFileSize):
+        (WebCore::getFileModificationTime):
+        (WebCore::makeAllDirectories):
+        (WebCore::homeDirectoryPath):
+        (WebCore::pathGetFileName):
+        (WebCore::listDirectory):
+        * platform/gtk/KURLGtk.cpp:
+        (WebCore::KURL::fileSystemPath):
+        * platform/gtk/SharedBufferGtk.cpp:
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * platform/gtk/guriescape.c: Added.
+        (is_valid):
+        (gunichar_ok):
+        (g_string_append_uri_escaped):
+        (_webcore_g_uri_escape_string):
+        * platform/gtk/guriescape.h: Added.
+
+2008-10-15  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by Eric Seidel.
+
+        - part of https://bugs.webkit.org/show_bug.cgi?id=20543
+          Moved gradient spread method out of SVG into the GraphicsContext.
+
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::spreadMethod):
+        (WebCore::GraphicsContext::setSpreadMethod):
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::):
+        * platform/graphics/GraphicsContextPrivate.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::applySpreadMethod):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::applySpreadMethod):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        * svg/GradientAttributes.h:
+        (WebCore::GradientAttributes::GradientAttributes):
+        (WebCore::GradientAttributes::spreadMethod):
+        (WebCore::GradientAttributes::setSpreadMethod):
+        * svg/SVGGradientElement.cpp:
+        (WebCore::SVGGradientElement::parseMappedAttribute):
+        * svg/SVGGradientElement.h:
+        * svg/SVGLinearGradientElement.cpp:
+        (WebCore::SVGLinearGradientElement::collectGradientProperties):
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::collectGradientProperties):
+        * svg/graphics/SVGPaintServerGradient.cpp:
+        (WebCore::operator<<):
+        (WebCore::SVGPaintServerGradient::SVGPaintServerGradient):
+        (WebCore::SVGPaintServerGradient::spreadMethod):
+        (WebCore::SVGPaintServerGradient::setGradientSpreadMethod):
+        (WebCore::SVGPaintServerGradient::externalRepresentation):
+        * svg/graphics/SVGPaintServerGradient.h:
+        * svg/graphics/cairo/SVGPaintServerGradientCairo.cpp:
+        (WebCore::SVGPaintServerGradient::setup):
+        * svg/graphics/qt/SVGPaintServerGradientQt.cpp:
+        (WebCore::SVGPaintServerGradient::setup):
+
+2008-10-09  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        Make pan scrolling a platform configurable option
+        https://bugs.webkit.org/show_bug.cgi?id=21515
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleAutoscroll):
+        (WebCore::EventHandler::autoscrollTimerFired):
+        (WebCore::EventHandler::stopAutoscrollTimer):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::keyEvent):
+
+2008-10-10  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Add some PLATFORM(CHROMIUM) ifdefs to WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=21511
+
+        * loader/FTPDirectoryDocument.cpp:
+        * loader/FTPDirectoryParser.cpp:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::finishedLoadingDocument):
+        * platform/ContextMenuItem.h:
+        * platform/Cursor.h:
+        * platform/DragData.h:
+        * platform/DragImage.h:
+        * platform/Pasteboard.h:
+        * platform/PlatformKeyboardEvent.h:
+        (WebCore::PlatformKeyboardEvent::isSystemKey):
+        * platform/PlatformMenuDescription.h:
+        * platform/PlatformMouseEvent.h:
+        * platform/PlatformWheelEvent.h:
+        * platform/PopupMenu.h:
+        * platform/ScrollView.h:
+        * platform/Widget.h:
+        * platform/network/NetworkStateNotifier.h:
+
+2008-10-14  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=21490
+        Optimize keyframe style sheet changes by avoiding styleSheetChanged()
+
+        Test: css3/change-keyframes.html
+
+        * css/WebKitCSSKeyframesRule.cpp:
+        (WebCore::WebKitCSSKeyframesRule::append):
+        (WebCore::WebKitCSSKeyframesRule::deleteRule):
+
+2008-10-14  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21595
+
+        Clean up background and overflow propagation from the body to the viewport.  Make it match the
+        latest CSS2.1 spec thinking.
+
+        Reviewed by Adam Roben
+
+        Added many tests at fast/body-propagation/.  These are Simon Pieters' tests of propagation handling
+        (available at http://simon.html5.org/test/css/magic-body/).
+
+        * dom/Document.cpp:
+        (WebCore::Document::body):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::paintRootBoxDecorations):
+        (WebCore::RenderBox::paintBoxDecorations):
+        (WebCore::RenderBox::repaintLayerRectsForImage):
+
+2008-10-14  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed and landed by Sam Weinig.
+
+        Due to change in spec (http://dev.w3.org/2006/webapi/selectors-api/#namespace),
+        remove NSResolver code, leaving only checking for selectors that need
+        NS resolution and throwing a coresponding error.
+
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSDocumentCustom.cpp:
+        * bindings/js/JSDocumentFragmentCustom.cpp:
+        * bindings/js/JSElementCustom.cpp:
+        * bindings/js/JSNSResolver.cpp: Removed.
+        * bindings/js/JSNSResolver.h: Removed.
+        * dom/Document.idl:
+        * dom/DocumentFragment.idl:
+        * dom/Element.idl:
+        * dom/NSResolver.h: Removed.
+        * dom/NSResolver.idl: Removed.
+        * dom/Node.h:
+        * dom/Node.cpp:
+        (WebCore::forEachTagSelector):
+        (WebCore::SelectorNeedsNamespaceResolutionFunctor::operator()):
+        (WebCore::selectorNeedsNamespaceResolution):
+        (WebCore::Node::querySelector):
+        (WebCore::Node::querySelectorAll):
+
+2008-10-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig (all but the FormDataListItem rename).
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21593
+          Bug 21593: add multiple-file support to HTMLFormElement
+
+        * html/FormDataList.cpp: Removed appendFile since it's now inline.
+        Also took incorrect old copyrights off of this file that are left
+        over from when it was split.
+        * html/FormDataList.h: Ditto. Renamed FormDataListItem to Item and
+        made it a member of FormDataList. Changed it to hold a File object
+        instead of a path. And made its data members private. Changed
+        FormDataList::appendFile accordingly.
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::formData): Updated for above changes.
+        Removed the code that special-cases HTMLInputElement, because now
+        the FormDataListItem has everything we need. And if there are
+        multiple files, we'll get multiple list items for them.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::appendFormData): Changed the code for
+        <input type=file> to use File objects instead of path strings and
+        also to append multiple files if the file list has them.
+
+2008-10-14  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix QtWebKit scrollbar painting errors
+
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::ScrollbarThemeQt::paint):
+        (WebCore::ScrollbarThemeQt::paintScrollCorner):
+
+2008-10-14  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix scrollbar arrows for horizontal scrollbars
+
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::styleOptionSlider):
+
+2008-10-14  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Use style-painter to draw scrollbars in ScrollbarThemeQt
+
+        This has the benefit of setting up the painter properly without
+        antialiasing and saving and restoring the brush. It also ensures
+        that we use the style of the QWebView over the QApplication style
+        if possible.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::StylePainter::StylePainter):
+        (WebCore::StylePainter::init):
+        * platform/qt/RenderThemeQt.h:
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::ScrollbarThemeQt::paint):
+
+2008-10-13  David Hyatt  <hyatt@apple.com>
+
+        Add support for CSS transitions on some SVG properties.  This patch is intended to be a guideline
+        for how to add support for the rest.
+
+        Reviewed by Oliver Hunt
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::ensurePropertyMap):
+        * rendering/style/RenderStyle.h:
+        (WebCore::RenderStyle::fillOpacity):
+        (WebCore::RenderStyle::setFillOpacity):
+        (WebCore::RenderStyle::strokeOpacity):
+        (WebCore::RenderStyle::setStrokeOpacity):
+        (WebCore::RenderStyle::floodOpacity):
+        (WebCore::RenderStyle::setFloodOpacity):
+
+2008-10-13  David Hyatt  <hyatt@apple.com>
+
+        <rdar://problem/6289712> REGRESSION(r37432-37490): Scroll bar is not drawn in Bookmark View, Preferences sheets.
+
+        Fix for disabled scrollbars not painting in Windows Safari.  Make sure that the Windows theme
+        implements paintTrackBackground so that when the thumb is not present the track still paints.
+
+        Reviewed by Oliver Hunt
+
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::paint):
+        * platform/win/ScrollbarThemeWin.cpp:
+        (WebCore::ScrollbarThemeWin::paintTrackBackground):
+        * platform/win/ScrollbarThemeWin.h:
+
+2008-10-13  David Hyatt  <hyatt@apple.com>
+
+        Fix over-invalidation of native scrollbars.
+
+        Reviewed by Oliver Hunt
+
+        * platform/Scrollbar.h:
+        (WebCore::Scrollbar::styleChanged):
+        * platform/mac/ScrollbarThemeMac.mm:
+        (+[ScrollbarPrefsObserver appearancePrefsChanged:]):
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::styleChanged):
+
+2008-10-13  Alp Toker  <alp@nuanti.com>
+
+        Fix autotools dist build target by listing recently added header
+        files only. Not reviewed.
+
+        * GNUmakefile.am:
+
+2008-10-13  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        Don't run a SQLite query on every iteration of the sync thread when the query
+        will touch a large portion of the icon database while performing no useful work.
+
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::IconDatabase::writeToDatabase): Don't call checkForDanglingPageURLs unless
+        we modified the database.
+        (WebCore::IconDatabase::checkForDanglingPageURLs): Don't do any work in a release build
+        unless we've been asked to prune any dangling pageURLs that we find.
+
+2008-10-13  Maciej Stachowiak  <mjs@apple.com>
+
+        Rubber stamped by Mark Rowe.
+
+        - use gcc 4.2 when building with Xcode 3.1 or newer on Leopard, even though this is not the default
+
+        * Configurations/DebugRelease.xcconfig:
+
+2008-10-13  David Hyatt  <hyatt@apple.com>
+
+        Make dropdown lists on Windows work with CSS custom scrollbars.
+
+        Reviewed by Adele
+
+        * platform/PopupMenu.h:
+        (WebCore::PopupMenu::scrollbarCornerPresent):
+        * platform/PopupMenuClient.h:
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::createScrollbar):
+        * rendering/RenderMenuList.h:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::createScrollbar):
+        * rendering/RenderTextControl.h:
+
+2008-10-13  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        <rdar://problem/6271864> Links from image maps not being included in AXLinkUIElements
+
+        Links from image maps were not being included in the web area's AXLinkUIElements attribute.
+        The position of image map links was being reported incorrectly and the parent-chain
+        hierarchy for image map links was incorrect because image map links did not have a reference
+        to their parent image.
+
+        Test: accessibility/document-links.html
+
+        * page/AccessibilityImageMapLink.cpp:
+        (WebCore::AccessibilityImageMapLink::parentObject):
+        (WebCore::AccessibilityImageMapLink::actionElement):
+        (WebCore::AccessibilityImageMapLink::elementRect):
+        * page/AccessibilityImageMapLink.h:
+        (WebCore::AccessibilityImageMapLink::setHTMLMapElement):
+        (WebCore::AccessibilityImageMapLink::setParent):
+        * page/AccessibilityObject.cpp:
+        * page/AccessibilityObject.h:
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityParentForImageMap):
+        (WebCore::AccessibilityRenderObject::getDocumentLinks):
+        (WebCore::AccessibilityRenderObject::addChildren):
+        * page/AccessibilityRenderObject.h:
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+
+2008-10-13  David Hyatt  <hyatt@apple.com>
+
+        Make RenderListBox work with CSS scrollbars.  Refactoring this code to support creation/destruction in
+        the same way RenderLayer does also fixes a bug where the PLT would assert on the next-to-last page (no
+        idea how to make a test case for that, though, since I couldn't repro without running the whole PLT).
+
+        Reviewed by Tim Hatcher
+
+        Added scrollbars/listbox-scrollbar-combinations.html
+
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::~RenderListBox):
+        (WebCore::RenderListBox::updateFromElement):
+        (WebCore::RenderListBox::createScrollbar):
+        (WebCore::RenderListBox::destroyScrollbar):
+        (WebCore::RenderListBox::setHasVerticalScrollbar):
+        * rendering/RenderListBox.h:
+
+2008-10-13  David Hyatt  <hyatt@apple.com>
+
+        In order to always match the :corner-present pseudo-class properly, delay initial updating of
+        scrollbar styles until the layer has the scrollbars in its member variables.
+
+        Reviewed by Tim Hatcher
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::setHasHorizontalScrollbar):
+        (WebCore::RenderLayer::setHasVerticalScrollbar):
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::RenderScrollbar):
+
+2008-10-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21577
+        5 false positive StructureID leaks
+
+        In WebCore, we intentionally leak the common JSGlobalData which in turn
+        leaks 5 StructureIDs.  Use the new JSGlobalData::createLeaked in order to
+        ignore the StructureIDs leaked within.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::commonJSGlobalData):
+
+2008-10-13  David Hyatt  <hyatt@apple.com>
+
+        Add support for the :corner-present pseudoclass, which enables scrollbar pieces to change their
+        artwork based on whether there is a scrollbar corner present.
+
+        Reviewed by Tim Hatcher
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollbarCornerPresent):
+        * platform/ScrollView.h:
+        * platform/ScrollbarClient.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::cornerRect):
+        (WebCore::scrollCornerRect):
+        (WebCore::resizerCornerRect):
+        (WebCore::RenderLayer::scrollbarCornerPresent):
+        (WebCore::RenderLayer::setHasHorizontalScrollbar):
+        (WebCore::RenderLayer::setHasVerticalScrollbar):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::horizontalScrollbar):
+        (WebCore::RenderLayer::verticalScrollbar):
+        * rendering/RenderListBox.h:
+        (WebCore::RenderListBox::scrollbarCornerPresent):
+
+2008-10-13  David Hyatt  <hyatt@apple.com>
+
+        Make resizers and scrollbar corners respect :window-inactive (one more bug fix and then Tim's master
+        test case for all this can land).
+
+        Reviewed by Tim Hatcher
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkSelector):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintOverflowControls):
+        (WebCore::RenderLayer::paintScrollCorner):
+        (WebCore::RenderLayer::paintResizer):
+        (WebCore::RenderLayer::styleChanged):
+        (WebCore::RenderLayer::updateScrollCornerStyle):
+        (WebCore::RenderLayer::updateResizerStyle):
+        * rendering/RenderLayer.h:
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::paint):
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::paintIntoRect):
+
+2008-10-13  David Hyatt  <hyatt@apple.com>
+
+        Rework resizer and scroll corner painting so that custom resizers and scroll corners will paint
+        and invalidate properly as images load, etc.
+
+        Reviewed by Tim Hatcher
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::cornerRect):
+        (WebCore::scrollCornerRect):
+        (WebCore::resizerCornerRect):
+        (WebCore::RenderLayer::positionOverflowControls):
+        (WebCore::RenderLayer::paintOverflowControls):
+        (WebCore::RenderLayer::paintScrollCorner):
+        (WebCore::RenderLayer::paintResizer):
+        (WebCore::RenderLayer::isPointInResizeControl):
+        (WebCore::RenderLayer::hitTestOverflowControls):
+        (WebCore::RenderLayer::styleChanged):
+        * rendering/RenderLayer.h:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::setRect):
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::styleDidChange):
+        (WebCore::RenderScrollbarPart::imageChanged):
+
+2008-10-13  Marco Barisione  <marco.barisione@collabora.co.uk>
+
+        Reviewed by Darin Adler. Landed by Jan Alonzo.
+
+        WebKit GTK Port needs a smartpointer to handle g_free (GFreePtr?)
+        http://bugs.webkit.org/show_bug.cgi?id=20483
+
+        Start the conversion to use GOwnPtr and fix a memory leak.
+
+        * platform/graphics/gtk/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::mediaPlayerPrivateErrorCallback):
+
+2008-10-12  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Windows build fix.
+
+        * loader/TextResourceDecoder.cpp:
+
+2008-10-12  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=21229
+          Bug 21229: NetworkStateNotifier.h lacks a #include <windows.h> for PLATFORM(WIN)
+
+        * platform/network/NetworkStateNotifier.h: Add the #include.
+
+2008-10-12  Darin Adler  <darin@apple.com>
+
+        Based on work by Holger Freyther.
+
+        - part of https://bugs.webkit.org/show_bug.cgi?id=20953
+          Split WidthIterator into its own source file.
+
+        * GNUmakefile.am: Added new source files.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Ditto.
+
+        * platform/graphics/Font.cpp: Use WidthIterator from its new place.
+        * platform/graphics/WidthIterator.cpp: Added.
+        * platform/graphics/WidthIterator.h: Added.
+
+2008-10-12  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Sam Weinig.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21480
+          Remove duplicate definitions of MimeClassInfo and PluginInfo.
+
+        * plugins/PluginInfoStore.cpp: Added an include.
+        * plugins/PluginInfoStore.h: Removed struct declarations.
+
+2008-10-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21563
+          Bug 21563: platform Gradient class should not use the CSS parser
+
+        * platform/graphics/Gradient.cpp: Removed the overload of addColorStop
+        that accepts a CSS color string. That's handled in the DOM now, not here.
+        (WebCore::Gradient::addColorStop): Use getRGBA instead of having our own
+        copy of it here.
+        * platform/graphics/Gradient.h: More of the same. Tweak formatting a bit.
+
+2008-10-12  Glenn Wilson  <gwilson@google.com>
+
+        Reviewed by Darin Adler.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=20461
+
+        Added feature to allow multi-line inputs into text fields.
+        HTMLInputElement would cut the set text at the first 'system' character,
+        so it would truncate at the first carriage return or newline.
+        This fix modifies that behavior to truncate at any non-space system character
+        but changes \r, \n, and \r\n to a single space.
+
+        Tests: editing/pasteboard/paste-multiline-text-input.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::constrainValue):
+
+2008-10-12  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by Eric Seidel.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=20435
+
+        Added exception codes to canvas gradients to match current specification.
+
+        Tests: fast/canvas/gradient-addColorStop-with-invalid-color.html
+               fast/canvas/linearGradient-infinite-values.html
+               fast/canvas/radialGradient-infinite-values.html
+
+        * html/CanvasGradient.cpp:
+        (WebCore::CanvasGradient::addColorStop):
+        * html/CanvasGradient.h:
+        * html/CanvasGradient.idl:
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::createLinearGradient):
+        (WebCore::CanvasRenderingContext2D::createRadialGradient):
+        * html/CanvasRenderingContext2D.h:
+        * html/CanvasRenderingContext2D.idl:
+
+2008-10-12  Eric Roman  <eroman@chromium.org>
+
+        - https://bugs.webkit.org/show_bug.cgi?id=20246
+          Implement RenderThemeWin::systemColor() to match Windows colors.
+
+        Reviewed by David Hyatt.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::cssValueIdToSysColorIndex):
+        (WebCore::RenderThemeWin::systemColor):
+        * rendering/RenderThemeWin.h:
+
+2008-10-12  Aaron Bockover  <abockover@novell.com>
+
+        Reviewed by Alp Toker.
+
+        Add version parsing for Flash, and the PluginQuirkDontSetNullWindowHandleOnDestroy
+        plugin quirk if Flash 10 or newer since at least in b218, setting a NULL window
+        handler on destroy crashes WebKit <https://bugs.webkit.org/show_bug.cgi?id=19859>
+
+        * plugins/gtk/PluginPackageGtk.cpp:
+
+2008-10-12  Jonathon Jongsma  <jonathon.jongsma@collabora.co.uk>
+
+        Reviewed by Oliver Hunt.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=19331
+          <rdar://problem/5984433>: Drag and drop of links in edit mode violates assert in MoveSelectionCommand::doApply()
+
+        * page/DragController.cpp:
+        (WebCore::DragController::startDrag): When a link is dragged without any
+        text selected (note: for this to work, the EditableLinkBehavior setting must be
+        set to 'live' or 'default') and then dropped into an editable html document it
+        will eventually violate an ASSERT in MoveSelectionCommand that requires that there
+        is a selection.  To prevent this, expand the selection to the enclosing anchor tag
+        when the drag begins.
+
+2008-10-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=21557
+          Bug 21557: REGRESSION: generated-layer-scrollbar-crash.html is crashing
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::getPseudoStyle): Keep walking up the parent chain
+        until we hit an Element. Nowadays, Node::isElementNode() is just as efficient
+        as RenderObject::isText(), and this guarantees that the node can be cast to
+        Element*, which is done just below. The reason this is hit is that RenderLayer
+        can call getPseudoStyle on a RenderView, which has the document as its
+        element() -- and a document is neither a Text node nor an Element. A loose
+        end is that this seems to mean you can't style the scrollbar corner or the
+        resizer on a RenderView. Hyatt may want to look into that later.
+
+2008-10-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21556
+          Bug 21556: non-ASCII digits are allowed in places where only ASCII should be
+
+        Tests: fast/dom/HTMLFontElement/size-attribute.html
+               fast/dom/HTMLInputElement/size-attribute.html
+               fast/dom/HTMLTableElement/cellpadding-attribute.html
+
+        * html/HTMLFontElement.cpp:
+        (WebCore::parseFontSizeNumber): Use isASCIIDigit instead of
+        Unicode::isDigit, since non-ASCII digits are not valid here.
+        * html/HTMLFontElement.h: Tweaked formatting a bit and removed
+        the unneeded destructor declaration.
+        * platform/text/String.cpp:
+        (WebCore::lengthOfCharactersAsInteger): Use isASCIIDigit instead
+        of Unicode::isDigit, since non-ASCII digits are not valid.
+
+2008-10-12  Jungshik Shin  <jshin@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Treat x-user-defined as windows-1252 for html files with meta charset
+        declaration to be compatible with Indian web sites.
+        ( https://bugs.webkit.org/show_bug.cgi?id=18270 )
+
+        Test: fast/encoding/charset-xuser-defined.html
+
+        * loader/TextResourceDecoder.cpp:
+        (WebCore::TextResourceDecoder::setEncoding):
+
+2008-10-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Remove unneeded forward declaration.
+
+        * platform/graphics/ImageBuffer.h:
+
+2008-10-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21560
+        Layering violation: String should not be responsible for creating Lengths
+
+        It was a layering violation for String to know haw to parse
+        into Lengths, LengthArrays, and CoordsArrays.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::parseMappedAttribute):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        * platform/text/AtomicString.h:
+        (WebCore::AtomicString::percentage):
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        * platform/text/StringImpl.cpp:
+        * platform/text/StringImpl.h:
+        * rendering/Length.cpp: Added.
+        (WebCore::parseLength):
+        (WebCore::countCharacter):
+        (WebCore::newCoordsArray):
+        (WebCore::newLengthArray):
+        * rendering/Length.h:
+        (WebCore::LengthSize::LengthSize):
+
+2008-10-12  Brad Garcia  <bgarcia@google.com>
+
+        Reviewed by Darin Adler.
+
+        Interpret fractional percentage values for %MultiLength values.
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=3591
+        Test: fast/frames/frame-length-fractional-percentage.html
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::parseLength):
+
+2008-10-12  Timothy Hatcher  <timothy@apple.com>
+
+        Remember the expanded state of the rules in the Styles pane. So
+        collapsing a rule will persist across all the elements that have
+        that same rule. The same applies to Computed Style, so the Computed
+        Style rule is now collapsed by default. This should help lessen the
+        confusion on why Computed Style can't be edited (a common confusion.)
+
+        https://bugs.webkit.org/show_bug.cgi?id=21553
+
+        Reviewed by Darin Adler.
+
+        * inspector/front-end/PropertiesSection.js:
+        (WebInspector.PropertiesSection): Set the _expanded property directly,
+        instead of using the setter. Expanded is the default, so no work is needed.
+        This prevents calling StylesSidebarPane.collapse before object initialization
+        is complete.
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylesSidebarPane.prototype.update): Check the Preferences object
+        for the expanded state of the StylePropertiesSection. Collapse computed style
+        by default and expand everything else.
+        (WebInspector.StylePropertiesSection): Make a semi unique identifier to be used
+        when remembering expanded state.
+        (WebInspector.StylePropertiesSection.prototype.expand): Set the expanded state
+        to true for this identifier in Preferences.styleRulesExpandedState. Don't remember
+        the state if the dontRememberState property is true.
+        (WebInspector.StylePropertiesSection.prototype.collapse): Set the expanded state
+        to false for this identifier in Preferences.styleRulesExpandedState.
+        * inspector/front-end/inspector.js:
+        (Preferences.styleRulesExpandedState): Initialize to an empty object.
+
+2008-10-12  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Alp Toker.
+
+        [Gtk] Remove libWebCoreJS.la when doing make clean
+        https://bugs.webkit.org/show_bug.cgi?id=21544
+
+        Remove libWebCoreJS.la when doing a clean target
+
+        * GNUmakefile.am: add libWebCoreJS.la to CLEANFILES
+
+2008-10-11  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20592
+        The focus ring is not shown while navigating on some pages
+
+        Fix drawFocusRing() so it doesn't depend on the current graphics
+        state, thus matching other platforms which already work this way.
+
+        This patch provides two code paths: one using straight Cairo and
+        one specialised for the GTK+ port with a more conventional appearance.
+
+        Also change focusRingColor() to return a null color, allowing the
+        focus ring to pick up the style's current color if it isn't overridden
+        with CSS.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/gtk/TemporaryLinkStubs.cpp:
+        (WebCore::focusRingColor):
+
+2008-10-11  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        - change all internal callers to use Cache::evict() instead of remove()
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::revalidateResource):
+        (WebCore::Cache::revalidationSucceeded):
+        (WebCore::Cache::pruneDeadResources):
+        (WebCore::Cache::setDisabled):
+
+2008-10-11  David Hyatt  <hyatt@apple.com>
+
+        Make sure invalidatePart knows how to invalidate the track and scrollbar backgrounds.
+
+        Reviewed by Tim Hatcher
+
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::invalidatePart):
+
+2008-10-11  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21549 (regression in before/after track pieces).
+
+        Also fixed resizer positioning problems.
+
+        Reviewed by Tim Hatcher
+
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::splitTrack):
+        (WebCore::ScrollbarThemeComposite::trackPosition):
+        (WebCore::ScrollbarThemeComposite::trackLength):
+        * platform/ScrollbarThemeComposite.h:
+        (WebCore::ScrollbarThemeComposite::constrainTrackRectToTrackPieces):
+        * rendering/RenderLayer.cpp:
+        (WebCore::scrollCornerRect):
+        (WebCore::RenderLayer::positionOverflowControls):
+        (WebCore::RenderLayer::paintOverflowControls):
+        (WebCore::RenderLayer::isPointInResizeControl):
+        (WebCore::RenderLayer::hitTestOverflowControls):
+        * rendering/RenderScrollbarTheme.cpp:
+        (WebCore::RenderScrollbarTheme::constrainTrackRectToTrackPieces):
+        * rendering/RenderScrollbarTheme.h:
+
+2008-10-11  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by David Hyatt.
+
+        Implement release/retain for Widget GTK+.
+
+        * platform/Widget.cpp:
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::~Widget):
+        (WebCore::Widget::releasePlatformWidget):
+        (WebCore::Widget::retainPlatformWidget):
+
+2008-10-11  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - rename WebCoreSetAlwaysUseATSU to WebCoreSetAlwaysUsesComplexTextCodePath
+          and add a corresponding getter; add the same functions on Windows
+
+        * WebCore.base.exp:
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::setCodePath):
+        (WebCore::codePath):
+        (WebCore::Font::canUseGlyphCache):
+        * platform/graphics/Font.h:
+        * platform/mac/WebCoreTextRenderer.h:
+        * platform/mac/WebCoreTextRenderer.mm:
+        (WebCoreSetAlwaysUsesComplexTextCodePath):
+        (WebCoreAlwaysUsesComplexTextCodePath):
+        * platform/win/WebCoreTextRenderer.cpp:
+        (WebCore::WebCoreSetAlwaysUsesComplexTextCodePath):
+        (WebCore::WebCoreAlwaysUsesComplexTextCodePath):
+        * platform/win/WebCoreTextRenderer.h:
+
+2008-10-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Stop leaking the event parameter names.  The protected strings were showing up
+        in the caches window after one use.  No measurable performance loss.
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::eventParameterName):
+
+2008-10-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Remove unused function getNodeEventListener.
+
+        * bindings/js/JSEventListener.cpp:
+        * bindings/js/JSEventListener.h:
+
+2008-10-11  David Hyatt  <hyatt@apple.com>
+
+        Add support for both positive and negative margins to tracks and track pieces.
+
+        Reviewed by Tim Hatcher
+
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::paint):
+        (WebCore::ScrollbarThemeComposite::hitTest):
+        (WebCore::ScrollbarThemeComposite::splitTrack):
+        (WebCore::ScrollbarThemeComposite::trackPieceRects):
+        (WebCore::ScrollbarThemeComposite::trackPosition):
+        (WebCore::ScrollbarThemeComposite::trackLength):
+        * platform/ScrollbarThemeComposite.h:
+        (WebCore::ScrollbarThemeComposite::adjustTrackPieceRect):
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::trackRect):
+        (WebCore::RenderScrollbar::trackPieceRectWithMargins):
+        * rendering/RenderScrollbar.h:
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::computeScrollbarWidth):
+        (WebCore::RenderScrollbarPart::computeScrollbarHeight):
+        * rendering/RenderScrollbarTheme.cpp:
+        (WebCore::RenderScrollbarTheme::adjustTrackPieceRect):
+        * rendering/RenderScrollbarTheme.h:
+
+2008-10-10  David Hyatt  <hyatt@apple.com>
+
+        Drop -webkit-scrollbar- from all the scrollbar pseudo-classes, since they are scoped to
+        the scrollbar pseudo-elements anyway.
+
+        Reviewed by Tim Hatcher
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass):
+
+2008-10-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - separate Cache::remove() into a private method and a public interface,
+          then make Cache::pruneDeadResources() use the private method.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::pruneDeadResources):
+        (WebCore::Cache::evict):
+        * loader/Cache.h:
+        (WebCore::Cache::remove):
+
+2008-10-10  David Hyatt  <hyatt@apple.com>
+
+        Fix a math error when splitting a vertical track.  Clean up more of ScrollbarThemeComposite
+        now that the track pieces meet under the thumb.
+
+        Reviewed by Tim Hatcher
+
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::paint):
+        (WebCore::ScrollbarThemeComposite::splitTrack):
+
+2008-10-10  David Hyatt  <hyatt@apple.com>
+
+        Make the track pieces of a scrollbar extend under the thumb (each gets half the thumb).
+
+        Reviewed by Tim Hatcher
+
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::hitTest):
+        (WebCore::ScrollbarThemeComposite::splitTrack):
+
+2008-10-10  David Hyatt  <hyatt@apple.com>
+
+        Make sure specialized ::scrollbar rules are still triggering custom scrollbar creation.
+
+        Reviewed by Tim Hatcher
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::createScrollbar):
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::createCustomScrollbar):
+        (WebCore::RenderScrollbar::RenderScrollbar):
+        (WebCore::RenderScrollbar::setParent):
+        (WebCore::RenderScrollbar::updateScrollbarParts):
+        (WebCore::RenderScrollbar::updateScrollbarPart):
+        * rendering/RenderScrollbar.h:
+        * rendering/style/RenderStyle.h:
+        (WebCore::RenderStyle::):
+
+2008-10-10  David Hyatt  <hyatt@apple.com>
+
+        Make sure scrollbar background images cause proper part invalidation to occur.
+
+        Reviewed by Tim Hatcher
+
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::setHoveredPart):
+        (WebCore::RenderScrollbar::setPressedPart):
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::styleDidChange):
+        (WebCore::RenderScrollbarPart::imageChanged):
+        * rendering/RenderScrollbarPart.h:
+
+2008-10-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=21538
+
+        The blendFunc() for TransformOperations should never mess with the
+        operation lists by replacing some ops with identity, otherwise the lists
+        no longer match and transitions break.
+
+        Test: transitions/matched-transform-functions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc):
+
+2008-10-10  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler
+
+        https://bugs.webkit.org/show_bug.cgi?id=21537
+
+        Fix re-targetting a running transition; if the target property
+        changes, we do need to make a new ImplicitAnimation.
+
+        Test: transitions/retargetted-transition.html
+
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::updateTransitions):
+
+2008-10-10  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Part of <rdar://problem/6278147> Cannot stop a slow script -- Fix assertion.
+
+        When JS is terminated by the user choosing to stop a slow script
+        the exception toString method throws, yet the console logger does
+        not perform exception checks after logging.  This leaves an
+        exception on the Machine, which in turn results in an assertion
+        failure next time we attempt to enter JS.  The solution is just to
+        clear the exception state after attempting to record the exception.
+
+        * page/Console.cpp:
+        (WebCore::Console::reportException):
+
+2008-10-10  David Hyatt  <hyatt@apple.com>
+
+        Make textareas work with custom CSS scrollbars and resizers.  Need to access the correct renderer
+        when looking for pseudo styles.
+
+        Reviewed by Tim Hatcher
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::createScrollbar):
+        (WebCore::RenderLayer::styleChanged):
+
+2008-10-10  David Hyatt  <hyatt@apple.com>
+
+        Add the ability to style the scroll corner and the resizer from CSS.
+
+        Reviewed by Tim Hatcher
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::RenderLayer):
+        (WebCore::RenderLayer::~RenderLayer):
+        (WebCore::RenderLayer::paintOverflowControls):
+        (WebCore::RenderLayer::paintScrollCorner):
+        (WebCore::RenderLayer::paintResizer):
+        (WebCore::RenderLayer::styleChanged):
+        * rendering/RenderLayer.h:
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::updateScrollbarPart):
+        (WebCore::RenderScrollbar::paintPart):
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::RenderScrollbarPart):
+        (WebCore::RenderScrollbarPart::paintIntoRect):
+        * rendering/RenderScrollbarPart.h:
+        * rendering/style/RenderStyle.h:
+        (WebCore::RenderStyle::):
+
+2008-10-10  David Hyatt  <hyatt@apple.com>
+
+        Make CSS scrollbars respect the OS setting regarding where buttons should be placed.
+
+        Reviewed by Sam Weinig
+
+        No test case possible, since the OS setting can vary.
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass):
+        * platform/Scrollbar.h:
+        (WebCore::Scrollbar::styleChanged):
+        * platform/mac/ScrollbarThemeMac.mm:
+        (+[ScrollbarPrefsObserver appearancePrefsChanged:]):
+        (WebCore::ScrollbarThemeMac::preferencesChanged):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::invalidateScrollbarRect):
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::styleChanged):
+        (WebCore::RenderScrollbar::updateScrollbarPart):
+        * rendering/RenderScrollbar.h:
+        * rendering/RenderScrollbarTheme.h:
+        (WebCore::RenderScrollbarTheme::buttonsPlacement):
+
+2008-10-10  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes a regression with input search fields, where the placeholder text
+        would not be updated when the value of the placeholder attribute changed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21521
+
+        Reviewed by Adele Peterson.
+
+        Test: fast/forms/search-placeholder-value-changed.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute): Pass true for the
+        placeholderValueChanged parameter of updatePlaceholderVisibility.
+        (WebCore::HTMLInputElement::updatePlaceholderVisibility): Add parameter
+        for placeholderValueChanged that informs the method that the value changed.
+        * html/HTMLInputElement.h: Add the placeholderValueChanged to the
+        updatePlaceholderVisibility method. Made it default to false.
+
+2008-10-10  David Hyatt  <hyatt@apple.com>
+
+        Allow the track part to have negative margins so that it can slightly overlap buttons.  This
+        is necessary to emulate the Aqua look in CSS.
+
+        Reviewed by Sam Weinig
+
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::paint):
+        (WebCore::ScrollbarThemeComposite::hitTest):
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::setHoveredPart):
+        (WebCore::RenderScrollbar::trackRect):
+        * rendering/RenderScrollbar.h:
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::computeScrollbarWidth):
+        (WebCore::RenderScrollbarPart::computeScrollbarHeight):
+        * rendering/RenderScrollbarTheme.cpp:
+        (WebCore::RenderScrollbarTheme::backButtonRect):
+        (WebCore::RenderScrollbarTheme::forwardButtonRect):
+        (WebCore::RenderScrollbarTheme::trackRect):
+
+2008-10-10  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21527
+
+        Make CSS scrollbars support :not, :hover and :active.
+
+        Reviewed by Adam Roben
+
+        Added WebCore/manual-tests/scrollbar-hover-active.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass):
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::autoscrollPressedPart):
+        (WebCore::Scrollbar::startTimerIfNeeded):
+        (WebCore::Scrollbar::setHoveredPart):
+        (WebCore::Scrollbar::setPressedPart):
+        (WebCore::Scrollbar::mouseMoved):
+        (WebCore::Scrollbar::mouseExited):
+        (WebCore::Scrollbar::mouseUp):
+        (WebCore::Scrollbar::mouseDown):
+        * platform/Scrollbar.h:
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::setHoveredPart):
+        (WebCore::RenderScrollbar::setPressedPart):
+        (WebCore::RenderScrollbar::updateScrollbarParts):
+        (WebCore::pseudoForScrollbarPart):
+        (WebCore::RenderScrollbar::updateScrollbarPart):
+        * rendering/RenderScrollbar.h:
+
+2008-10-10  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21025
+        CSS transition with duration=0 and delay=0 doesn't override ongoing transition
+
+        Test: transitions/interrupt-zero-duration.html
+
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateTransitions):
+
+2008-10-10  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Add new scrollbar-related sources.
+
+        * WebCoreSources.bkl:
+
+2008-10-10  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21522
+
+        Support increment/decrement/start/end on scrollbars.  Allows a fully functional scrollbar to be
+        created.  (Just :hover/:active left to finish it up.)
+
+        Reviewed by Adam Roben
+
+        Added scrollbars/scrollbar-buttons.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass):
+
+2008-10-10  David Hyatt  <hyatt@apple.com>
+
+        Rename some pseudoclasses.  Removing "-scrollbar-" from a bunch of the pseudoclasses.  Renaming
+        back/forward to decrement/increment.  Adding start/end pseudoclasses.
+
+        Reviewed by Eric Seidel
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass):
+
+2008-10-10  David Hyatt  <hyatt@apple.com>
+
+        Switch window-active to window-inactive, since that will work better as far as degrading in other
+        browsers.
+
+        Reviewed by Tim Hatcher
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass):
+
+2008-10-09  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21310
+
+        Redesigned how animation events are sent in order to get rid of
+        AnimationEventDispatcher. ImplicitAnimation and KeyframeAnimation
+        are now ref counted. While calling the event handler, I keep a
+        reference to this class to avoid it getting destroyed out from under me.
+
+        I also moved most of the functionality of CompositeAnimation to
+        and internal class (CompositeAnimationPrivate) to reduce the exposure
+        of the internals of the various animation classes.
+
+        We have several transition and animation LayoutTests which verify that
+        this fix works as expected and continues to avoid crashes.
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::AnimationBase):
+        * page/animation/AnimationBase.h:
+        (WebCore::AnimationBase::cancelTimers):
+        (WebCore::AnimationBase::waitingForStyleAvailable):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimationPrivate::CompositeAnimationPrivate):
+        (WebCore::CompositeAnimationPrivate::suspended):
+        (WebCore::CompositeAnimationPrivate::~CompositeAnimationPrivate):
+        (WebCore::CompositeAnimationPrivate::updateTransitions):
+        (WebCore::CompositeAnimationPrivate::updateKeyframeAnimations):
+        (WebCore::CompositeAnimationPrivate::animate):
+        (WebCore::CompositeAnimationPrivate::setAnimating):
+        (WebCore::CompositeAnimationPrivate::animating):
+        (WebCore::CompositeAnimationPrivate::getAnimationForProperty):
+        (WebCore::CompositeAnimationPrivate::resetTransitions):
+        (WebCore::CompositeAnimationPrivate::resetAnimations):
+        (WebCore::CompositeAnimationPrivate::cleanupFinishedAnimations):
+        (WebCore::CompositeAnimationPrivate::setAnimationStartTime):
+        (WebCore::CompositeAnimationPrivate::setTransitionStartTime):
+        (WebCore::CompositeAnimationPrivate::suspendAnimations):
+        (WebCore::CompositeAnimationPrivate::resumeAnimations):
+        (WebCore::CompositeAnimationPrivate::overrideImplicitAnimations):
+        (WebCore::CompositeAnimationPrivate::resumeOverriddenImplicitAnimations):
+        (WebCore::compareAnimationIndices):
+        (WebCore::CompositeAnimationPrivate::styleAvailable):
+        (WebCore::CompositeAnimationPrivate::isAnimatingProperty):
+        (WebCore::CompositeAnimationPrivate::setWaitingForStyleAvailable):
+        (WebCore::CompositeAnimation::CompositeAnimation):
+        (WebCore::CompositeAnimation::~CompositeAnimation):
+        (WebCore::CompositeAnimation::animate):
+        (WebCore::CompositeAnimation::animating):
+        (WebCore::CompositeAnimation::setWaitingForStyleAvailable):
+        (WebCore::CompositeAnimation::resetTransitions):
+        (WebCore::CompositeAnimation::suspendAnimations):
+        (WebCore::CompositeAnimation::resumeAnimations):
+        (WebCore::CompositeAnimation::suspended):
+        (WebCore::CompositeAnimation::styleAvailable):
+        (WebCore::CompositeAnimation::setAnimating):
+        (WebCore::CompositeAnimation::isAnimatingProperty):
+        (WebCore::CompositeAnimation::setAnimationStartTime):
+        (WebCore::CompositeAnimation::setTransitionStartTime):
+        (WebCore::CompositeAnimation::overrideImplicitAnimations):
+        (WebCore::CompositeAnimation::resumeOverriddenImplicitAnimations):
+        * page/animation/CompositeAnimation.h:
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::sendTransitionEvent):
+        * page/animation/ImplicitAnimation.h:
+        (WebCore::ImplicitAnimation::create):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::sendAnimationEvent):
+        * page/animation/KeyframeAnimation.h:
+        (WebCore::KeyframeAnimation::create):
+
+2008-10-09  David Hyatt  <hyatt@apple.com>
+
+        Add support for scrollbar orientation as a pseudoclass.  Add support for whether or not the scrollbar
+        is active as well.
+
+        Reviewed by Tim Hatcher
+
+        Added scrollbars/scrollbar-orientation.html
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass):
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::isWindowActive):
+        * platform/Scrollbar.h:
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::paint):
+        (WebCore::RenderScrollbar::partForStyleResolve):
+        * rendering/RenderScrollbar.h:
+
+2008-10-09  David Hyatt  <hyatt@apple.com>
+
+        Add support for pseudo classes on scrollbar pseudo elements.  As an initial proof of concept only
+        :enabled/:disabled are supported.  More pseudo classes will follow quickly now that this works.
+
+        Reviewed by Tim Hatcher
+
+        Added scrollbars/disabled-scrollbar.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkSelector):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        (WebCore::CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass):
+        * css/CSSStyleSelector.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::getPseudoStyle):
+        * rendering/RenderObject.h:
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::setEnabled):
+        (WebCore::RenderScrollbar::scrollbarForStyleResolve):
+        (WebCore::RenderScrollbar::getScrollbarPseudoStyle):
+        (WebCore::RenderScrollbar::paintPart):
+        * rendering/RenderScrollbar.h:
+
+2008-10-09  Eric Carlson  <eric.carlson@apple.com>
+
+        Media controls should not show when element is not visible
+
+        https://bugs.webkit.org/show_bug.cgi?id=21155
+
+        Reviewed by Adele Peterson.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::recalcStyle): New, call renderer()->updateFromElement to stay
+        in sync with visibility changes
+        * html/HTMLMediaElement.h:
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::RenderMedia): initialize m_previousVisible
+        (WebCore::RenderMedia::updateControlVisibility): consider style()->visibility() when determining
+        if element is visible or not. Don't animate controller visibility when change triggered by
+        showing or hiding media element.
+        * rendering/RenderMedia.h: declare m_previousVisible
+
+2008-10-09  Timothy Hatcher  <timothy@apple.com>
+
+        Annotate the Objective-C DOM APIs with the JavaScriptCore/WebKitAvailability.h
+        availability macros and version macros.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21496
+        rdar://problem/6259225
+
+        Reviewed by Sam Weinig.
+
+        * bindings/objc/DOMCSS.h: Add a version #if around catgory interface.
+        * bindings/objc/DOMEventException.h: Include JavaScriptCore/WebKitAvailability.h
+        and add an #if around the enum.
+        * bindings/objc/DOMException.h: Ditto. Give the enum a name and remove the
+        comment to match the other headers.
+        * bindings/objc/DOMExtensions.h: Annotate the methods with version 3.0 or later.
+        * bindings/objc/DOMObject.h: Add a version #if around class interface.
+        * bindings/objc/DOMRangeException.h: Include JavaScriptCore/WebKitAvailability.h
+        and add a version #if around the enum.
+        * bindings/objc/DOMSVGException.h: Ditto. Use the latest version since SVG is new.
+        * bindings/objc/DOMXPathException.h: Ditto. Use the 3.0 version.
+        * bindings/objc/PublicDOMInterfaces.h: Annotate classes and protocols for
+        when they where added to WebKit. Also annotate individual methods that are
+        deprecated or where added after the class was added to WebKit.
+        * bindings/objc/WebScriptObject.h: Include JavaScriptCore/WebKitAvailability.h
+        since this header is included by most DOM headers. Annotate the JSObject method.
+
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        (ReadPublicInterfaces): Parse out the availability macro for each function/property.
+        And parse out the availability version for the class/protocol. Default to
+        WEBKIT_VERSION_LATEST if the class is new.
+        (GenerateHeader): Include JavaScriptCore/WebKitAvailability.h if needed. Add the
+        interface availability version check if the class has a required version. Create
+        a public interface key (used to lookup in $publicInterfaces) and make a declaration
+        suffix that includes the availability macro (if needed). Use the "available in 1.3
+        and later but deprecated in 3.0" macro instead of "deprecated in 10.5 and later" as
+        the default availability macro for old style methods. Tweak line breaks in the generated
+        headers to look good and not have too many extra lines.
+
+2008-10-09  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=20947
+
+        Refactor setStyle() methods into styleWillChange()
+        and styleDidChange(), so most of the setStyle() overrides can
+        be removed.
+
+        * rendering/RenderBR.cpp:
+        (WebCore::RenderBR::styleDidChange):
+        * rendering/RenderBR.h:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::styleWillChange):
+        (WebCore::RenderBlock::styleDidChange):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::~RenderBox):
+        (WebCore::RenderBox::destroy):
+        (WebCore::RenderBox::styleWillChange):
+        (WebCore::RenderBox::styleDidChange):
+        * rendering/RenderBox.h:
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::styleWillChange):
+        (WebCore::RenderButton::styleDidChange):
+        * rendering/RenderButton.h:
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::styleDidChange):
+        * rendering/RenderFieldset.h:
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::styleDidChange):
+        * rendering/RenderFileUploadControl.h:
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::styleDidChange):
+        * rendering/RenderInline.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::styleChanged):
+        * rendering/RenderLayer.h:
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::styleDidChange):
+        * rendering/RenderListBox.h:
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::styleDidChange):
+        * rendering/RenderListItem.h:
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::styleWillChange):
+        (WebCore::RenderListMarker::styleDidChange):
+        * rendering/RenderListMarker.h:
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::styleDidChange):
+        * rendering/RenderMenuList.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::setStyle):
+        (WebCore::RenderObject::setStyleInternal):
+        (WebCore::RenderObject::styleWillChange):
+        (WebCore::RenderObject::styleDidChange):
+        * rendering/RenderObject.h:
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::styleDidChange):
+        * rendering/RenderReplaced.h:
+        * rendering/RenderSVGGradientStop.cpp:
+        (WebCore::RenderSVGGradientStop::styleDidChange):
+        * rendering/RenderSVGGradientStop.h:
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::styleDidChange):
+        * rendering/RenderScrollbarPart.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::styleDidChange):
+        * rendering/RenderSlider.h:
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::styleDidChange):
+        * rendering/RenderTable.h:
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::styleWillChange):
+        (WebCore::RenderTableCell::styleDidChange):
+        * rendering/RenderTableCell.h:
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::styleWillChange):
+        * rendering/RenderTableRow.h:
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::styleDidChange):
+        * rendering/RenderText.h:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::styleDidChange):
+        * rendering/RenderTextControl.h:
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::styleDidChange):
+        * rendering/RenderWidget.h:
+
+2008-10-09  David Hyatt  <hyatt@apple.com>
+
+        Make sure to destroy a custom scrollbar's RenderObjects before the arena goes away.  When our widget
+        parent is nulled out is a good time.
+
+        Reviewed by Oliver Hunt
+
+        * rendering/RenderScrollbar.cpp:
+        (WebCore::RenderScrollbar::~RenderScrollbar):
+        (WebCore::RenderScrollbar::setParent):
+        (WebCore::RenderScrollbar::updateScrollbarPart):
+        * rendering/RenderScrollbar.h:
+
+2008-10-09  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21446
+
+        This patch gets CSS scrollbars up and limping.  There's no way to distinguish between states or between
+        orientation and back vs. forward on the buttons, but it's a start.
+
+        Reviewed by Oliver Hunt
+
+        Added scrollbars/basic-scrollbar.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        * platform/ScrollTypes.h:
+        (WebCore::):
+        * platform/Scrollbar.h:
+        (WebCore::Scrollbar::styleChanged):
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::paint):
+        (WebCore::ScrollbarThemeComposite::splitTrack):
+        * platform/ScrollbarThemeComposite.h:
+        (WebCore::ScrollbarThemeComposite::paintScrollbarBackground):
+        (WebCore::ScrollbarThemeComposite::paintTrackBackground):
+        (WebCore::ScrollbarThemeComposite::paintTrackPiece):
+        * platform/win/ScrollbarThemeSafari.cpp:
+        (WebCore::ScrollbarThemeSafari::paintTrackBackground):
+        * platform/win/ScrollbarThemeSafari.h:
+        * platform/win/ScrollbarThemeWin.cpp:
+        (WebCore::ScrollbarThemeWin::paintTrack):
+        * platform/win/ScrollbarThemeWin.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::createScrollbar):
+        (WebCore::RenderLayer::styleChanged):
+        * rendering/RenderScrollbar.cpp: Added.
+        (WebCore::RenderScrollbar::createCustomScrollbar):
+        (WebCore::RenderScrollbar::RenderScrollbar):
+        (WebCore::RenderScrollbar::~RenderScrollbar):
+        (WebCore::RenderScrollbar::getScrollbarPseudoStyle):
+        (WebCore::RenderScrollbar::updateScrollbarParts):
+        (WebCore::RenderScrollbar::updateScrollbarPart):
+        (WebCore::RenderScrollbar::paintPart):
+        (WebCore::RenderScrollbar::buttonRect):
+        (WebCore::RenderScrollbar::minimumThumbLength):
+        * rendering/RenderScrollbar.h: Added.
+        (WebCore::RenderScrollbar::styleChanged):
+        (WebCore::RenderScrollbar::owningRenderer):
+        * rendering/RenderScrollbarPart.cpp: Added.
+        (WebCore::RenderScrollbarPart::RenderScrollbarPart):
+        (WebCore::RenderScrollbarPart::~RenderScrollbarPart):
+        (WebCore::RenderScrollbarPart::layout):
+        (WebCore::RenderScrollbarPart::layoutHorizontalPart):
+        (WebCore::RenderScrollbarPart::layoutVerticalPart):
+        (WebCore::calcScrollbarThicknessUsing):
+        (WebCore::RenderScrollbarPart::computeScrollbarWidth):
+        (WebCore::RenderScrollbarPart::computeScrollbarHeight):
+        (WebCore::RenderScrollbarPart::calcPrefWidths):
+        (WebCore::RenderScrollbarPart::setStyle):
+        * rendering/RenderScrollbarPart.h: Added.
+        (WebCore::RenderScrollbarPart::renderName):
+        (WebCore::RenderScrollbarPart::requiresLayer):
+        * rendering/RenderScrollbarTheme.cpp: Added.
+        (WebCore::RenderScrollbarTheme::renderScrollbarTheme):
+        (WebCore::RenderScrollbarTheme::buttonSizesAlongTrackAxis):
+        (WebCore::RenderScrollbarTheme::hasButtons):
+        (WebCore::RenderScrollbarTheme::hasThumb):
+        (WebCore::RenderScrollbarTheme::minimumThumbLength):
+        (WebCore::RenderScrollbarTheme::backButtonRect):
+        (WebCore::RenderScrollbarTheme::forwardButtonRect):
+        (WebCore::RenderScrollbarTheme::trackRect):
+        (WebCore::RenderScrollbarTheme::paintScrollCorner):
+        (WebCore::RenderScrollbarTheme::paintScrollbarBackground):
+        (WebCore::RenderScrollbarTheme::paintTrackBackground):
+        (WebCore::RenderScrollbarTheme::paintTrackPiece):
+        (WebCore::RenderScrollbarTheme::paintButton):
+        (WebCore::RenderScrollbarTheme::paintThumb):
+        * rendering/RenderScrollbarTheme.h: Added.
+        (WebCore::RenderScrollbarTheme::~RenderScrollbarTheme):
+        (WebCore::RenderScrollbarTheme::scrollbarThickness):
+        (WebCore::RenderScrollbarTheme::buttonsPlacement):
+        (WebCore::RenderScrollbarTheme::supportsControlTints):
+        (WebCore::RenderScrollbarTheme::shouldCenterOnThumb):
+        (WebCore::RenderScrollbarTheme::initialAutoscrollTimerDelay):
+        (WebCore::RenderScrollbarTheme::autoscrollTimerDelay):
+        (WebCore::RenderScrollbarTheme::registerScrollbar):
+        (WebCore::RenderScrollbarTheme::unregisterScrollbar):
+        * rendering/style/RenderStyle.h:
+        (WebCore::RenderStyle::):
+
+2008-10-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix Canvex DOOM Game
+        Gradient clips were not getting cleared after filling the
+        gradient, this was causing nothing to draw in Canvex
+        https://bugs.webkit.org/show_bug.cgi?id=21498
+
+        Tests forthcoming.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+
+2008-10-09  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix transformed patterns
+        https://bugs.webkit.org/show_bug.cgi?id=21498
+
+        Test: fast/canvas/patternfill-repeat.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setStrokePattern):
+        (WebCore::GraphicsContext::setFillPattern):
+        (WebCore::GraphicsContext::setStrokeGradient):
+        (WebCore::GraphicsContext::setFillGradient):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::applyStrokePattern):
+        (WebCore::applyFillPattern):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+
+2008-10-09  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes.
+
+        * platform/wx/WidgetWx.cpp:
+        * plugins/wx/PluginViewWx.cpp:
+        (WebCore::PluginView::invalidateRect):
+        * webcore-base.bkl:
+
+2008-10-09  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21217
+        Animations assert when navigating from page
+
+        Changed assertions to test the right flag for the paused state
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::updateStateMachine):
+
+2008-10-09  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fixed > 180 degree rotation bug
+        Ensure that validateTransformFunctionList() is called after updating keyframe styles
+
+        https://bugs.webkit.org/show_bug.cgi?id=21420
+
+        Test: animations/big-rotation.html
+
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::KeyframeAnimation):
+
+2008-10-09  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Anders
+
+        <rdar://problem/6250856> - Calling [WebView close] from within a redirection callback can cause bad things
+
+        The API usage to reveal this crash was so particular that a layout test is not possible with our current infrastructure.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::changeLocation): Protect the Frame from deletion
+        (WebCore::FrameLoader::continueLoadAfterNavigationPolicy): stopAllLoaders() might clear the Frame's page,
+          so perform a second null check on the page.  Bail if it has been cleared.
+
+2008-10-09  Alp Toker  <alp@nuanti.com>
+
+        Build fix for recent DOM generation Makefile changes when custom
+        CFLAGS/CXXFLAGS are passed in.
+
+        * GNUmakefile.am:
+
+2008-10-09  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Alp Toker.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21390
+        [Gtk] Linux/Gtk: GtkLauncher crashes on Acid3 (but after test 80 this time)
+
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::platformRemoveChild):
+
+2008-10-09  Darin Adler  <darin@apple.com>
+
+       - try to fix Qt build
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertQVariantToValue): Pass JSGlobalData instead of ExecState to RegExp constructor.
+
+2008-10-08  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Oliver Hunt & Sam Weinig.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=15413 (SVGElementInstance does not implement EventTarget)
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=15430 (SVGElementInstances should rebuild themselves lazily)
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=20550 (SVGUseElement.setAttribute crashes Safari)
+
+        Rebuild SVG use element shadow tree lazily. Mark SVGElementInstance with the "needsUpdate" flag.
+        Next time SVGUseElement::recalcStyle is invoked (ie. via Document::updateDocumentsRendering()) the
+        use tree is rebuild.
+
+        Make SVGElementInstance a real EventTarget, as the SVG specification demands.
+        When dispatching events to a shadow tree element of a use element, the associated SVGElementInstance
+        is used as event target. The SVGElementInstance, the shadow tree element and the corresponding element
+        share an event listener list. Every event listener change on the SVGElementInstance object is forwared
+        to the corresponding element. Each change marks the SVGElementInstance tree dirty, and causes a reclone.
+        Each event listener defined via attributes (onclick/onkeydown/...) is copied from the correspondingElement
+        to the shadow tree element - through the cloneNode calls - if the use element's shadow tree gets rebuild.
+        Each listener, dynamically created using addEventListener, gets copied to the corersponding element as well.
+
+        Now that the target/currentTarget properties of the Events are correct, event bubbling works as expected,
+        see resources/use-instanceRoot-event-bubbling.js for details.
+
+        Tests: svg/custom/use-elementInstance-event-target.svg (reenabled)
+               svg/custom/use-elementInstance-methods.svg (reenabled)
+               svg/custom/use-setAttribute-crash.svg (covers bug 20550)
+               svg/custom/use-instanceRoot-as-event-target.xhtml (covers bug 15413)
+               svg/custom/use-instanceRoot-event-bubbling.xhtml (covers bug 15413)
+               svg/custom/use-instanceRoot-event-listeners.xhtml (covers bug 15413 & 15430)
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSLazyEventListener::wasCreatedFromMarkup):
+        * bindings/js/JSEventTarget.cpp:
+        * bindings/js/JSEventTargetSVGElementInstance.cpp: Removed.
+        * bindings/js/JSEventTargetSVGElementInstance.h: Removed.
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::JSSVGElementInstance::addEventListener):
+        (WebCore::JSSVGElementInstance::removeEventListener):
+        (WebCore::JSSVGElementInstance::pushEventHandlerScope):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * dom/EventListener.h:
+        (WebCore::EventListener::wasCreatedFromMarkup):
+        * dom/EventTargetNode.cpp:
+        (WebCore::updateSVGElementInstancesAfterEventListenerChange):
+        (WebCore::EventTargetNode::addEventListener):
+        (WebCore::EventTargetNode::removeEventListener):
+        (WebCore::eventTargetAsSVGElementInstance):
+        (WebCore::eventTargetRespectingSVGTargetRules):
+        (WebCore::EventTargetNode::dispatchEvent):
+        (WebCore::EventTargetNode::dispatchGenericEvent):
+        (WebCore::EventTargetNode::removeEventListenerForType):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::clear):
+        (WebCore::instanceAssociatedWithShadowTreeElement):
+        (WebCore::EventHandler::updateMouseEventTargetNode):
+        * page/EventHandler.h:
+        * svg/EventTargetSVGElementInstance.cpp: Removed.
+        * svg/EventTargetSVGElementInstance.h: Removed.
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::SVGElementInstance):
+        (WebCore::SVGElementInstance::~SVGElementInstance):
+        (WebCore::SVGElementInstance::childNodes):
+        (WebCore::SVGElementInstance::setShadowTreeElement):
+        (WebCore::SVGElementInstance::forgetWrapper):
+        (WebCore::SVGElementInstance::appendChild):
+        (WebCore::SVGElementInstance::invalidateAllInstancesOfElement):
+        (WebCore::SVGElementInstance::setNeedsUpdate):
+        (WebCore::SVGElementInstance::associatedFrame):
+        (WebCore::SVGElementInstance::addEventListener):
+        (WebCore::SVGElementInstance::removeEventListener):
+        (WebCore::SVGElementInstance::dispatchEvent):
+        (WebCore::SVGElementInstance::onabort):
+        (WebCore::SVGElementInstance::setOnabort):
+        (WebCore::SVGElementInstance::onblur):
+        (WebCore::SVGElementInstance::setOnblur):
+        (WebCore::SVGElementInstance::onchange):
+        (WebCore::SVGElementInstance::setOnchange):
+        (WebCore::SVGElementInstance::onclick):
+        (WebCore::SVGElementInstance::setOnclick):
+        (WebCore::SVGElementInstance::oncontextmenu):
+        (WebCore::SVGElementInstance::setOncontextmenu):
+        (WebCore::SVGElementInstance::ondblclick):
+        (WebCore::SVGElementInstance::setOndblclick):
+        (WebCore::SVGElementInstance::onerror):
+        (WebCore::SVGElementInstance::setOnerror):
+        (WebCore::SVGElementInstance::onfocus):
+        (WebCore::SVGElementInstance::setOnfocus):
+        (WebCore::SVGElementInstance::oninput):
+        (WebCore::SVGElementInstance::setOninput):
+        (WebCore::SVGElementInstance::onkeydown):
+        (WebCore::SVGElementInstance::setOnkeydown):
+        (WebCore::SVGElementInstance::onkeypress):
+        (WebCore::SVGElementInstance::setOnkeypress):
+        (WebCore::SVGElementInstance::onkeyup):
+        (WebCore::SVGElementInstance::setOnkeyup):
+        (WebCore::SVGElementInstance::onload):
+        (WebCore::SVGElementInstance::setOnload):
+        (WebCore::SVGElementInstance::onmousedown):
+        (WebCore::SVGElementInstance::setOnmousedown):
+        (WebCore::SVGElementInstance::onmousemove):
+        (WebCore::SVGElementInstance::setOnmousemove):
+        (WebCore::SVGElementInstance::onmouseout):
+        (WebCore::SVGElementInstance::setOnmouseout):
+        (WebCore::SVGElementInstance::onmouseover):
+        (WebCore::SVGElementInstance::setOnmouseover):
+        (WebCore::SVGElementInstance::onmouseup):
+        (WebCore::SVGElementInstance::setOnmouseup):
+        (WebCore::SVGElementInstance::onmousewheel):
+        (WebCore::SVGElementInstance::setOnmousewheel):
+        (WebCore::SVGElementInstance::onbeforecut):
+        (WebCore::SVGElementInstance::setOnbeforecut):
+        (WebCore::SVGElementInstance::oncut):
+        (WebCore::SVGElementInstance::setOncut):
+        (WebCore::SVGElementInstance::onbeforecopy):
+        (WebCore::SVGElementInstance::setOnbeforecopy):
+        (WebCore::SVGElementInstance::oncopy):
+        (WebCore::SVGElementInstance::setOncopy):
+        (WebCore::SVGElementInstance::onbeforepaste):
+        (WebCore::SVGElementInstance::setOnbeforepaste):
+        (WebCore::SVGElementInstance::onpaste):
+        (WebCore::SVGElementInstance::setOnpaste):
+        (WebCore::SVGElementInstance::ondragenter):
+        (WebCore::SVGElementInstance::setOndragenter):
+        (WebCore::SVGElementInstance::ondragover):
+        (WebCore::SVGElementInstance::setOndragover):
+        (WebCore::SVGElementInstance::ondragleave):
+        (WebCore::SVGElementInstance::setOndragleave):
+        (WebCore::SVGElementInstance::ondrop):
+        (WebCore::SVGElementInstance::setOndrop):
+        (WebCore::SVGElementInstance::ondragstart):
+        (WebCore::SVGElementInstance::setOndragstart):
+        (WebCore::SVGElementInstance::ondrag):
+        (WebCore::SVGElementInstance::setOndrag):
+        (WebCore::SVGElementInstance::ondragend):
+        (WebCore::SVGElementInstance::setOndragend):
+        (WebCore::SVGElementInstance::onreset):
+        (WebCore::SVGElementInstance::setOnreset):
+        (WebCore::SVGElementInstance::onresize):
+        (WebCore::SVGElementInstance::setOnresize):
+        (WebCore::SVGElementInstance::onscroll):
+        (WebCore::SVGElementInstance::setOnscroll):
+        (WebCore::SVGElementInstance::onsearch):
+        (WebCore::SVGElementInstance::setOnsearch):
+        (WebCore::SVGElementInstance::onselect):
+        (WebCore::SVGElementInstance::setOnselect):
+        (WebCore::SVGElementInstance::onselectstart):
+        (WebCore::SVGElementInstance::setOnselectstart):
+        (WebCore::SVGElementInstance::onsubmit):
+        (WebCore::SVGElementInstance::setOnsubmit):
+        (WebCore::SVGElementInstance::onunload):
+        (WebCore::SVGElementInstance::setOnunload):
+        * svg/SVGElementInstance.h:
+        (WebCore::SVGElementInstance::needsUpdate):
+        (WebCore::SVGElementInstance::toNode):
+        (WebCore::SVGElementInstance::toSVGElementInstance):
+        (WebCore::SVGElementInstance::correspondingElement):
+        (WebCore::SVGElementInstance::correspondingUseElement):
+        (WebCore::SVGElementInstance::shadowTreeElement):
+        (WebCore::SVGElementInstance::parentNode):
+        (WebCore::SVGElementInstance::previousSibling):
+        (WebCore::SVGElementInstance::nextSibling):
+        (WebCore::SVGElementInstance::firstChild):
+        (WebCore::SVGElementInstance::lastChild):
+        (WebCore::SVGElementInstance::ownerDocument):
+        (WebCore::SVGElementInstance::hasChildNodes):
+        (WebCore::SVGElementInstance::setFirstChild):
+        (WebCore::SVGElementInstance::setLastChild):
+        (WebCore::SVGElementInstance::setNextSibling):
+        (WebCore::SVGElementInstance::setPreviousSibling):
+        (WebCore::SVGElementInstance::refEventTarget):
+        (WebCore::SVGElementInstance::derefEventTarget):
+        * svg/SVGElementInstance.idl:
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::svgAttributeChanged):
+        (WebCore::SVGStyledElement::childrenChanged):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::svgAttributeChanged):
+        (WebCore::shadowTreeContainsChangedNodes):
+        (WebCore::SVGUseElement::recalcStyle):
+        (WebCore::dumpInstanceTree):
+        (WebCore::SVGUseElement::buildPendingResource):
+        (WebCore::SVGUseElement::buildInstanceTree):
+        (WebCore::SVGUseElement::transferEventListenersToShadowTree):
+        * svg/SVGUseElement.h:
+
+2008-10-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21241
+        REGRESSION (r36977): getRGBColorValue().red returning incorrect value
+
+        Update JSRGBColor to use the new static function per getter approach.
+
+        Test: fast/dom/css-RGBValue.html
+
+        * bindings/js/JSRGBColor.cpp:
+        (WebCore::):
+        (jsRGBColorRed):
+        (jsRGBColorGreen):
+        (jsRGBColorBlue):
+        * bindings/js/JSRGBColor.h:
+
+2008-10-08  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler, Nikolas Zimmermann and Dave Hyatt.
+
+        svgElement.className.baseValue = "foo" does not work
+        https://bugs.webkit.org/show_bug.cgi?id=20651
+
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::classAttributeChanged):
+        (WebCore::StyledElement::parseMappedAttribute):
+        * dom/StyledElement.h:
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::svgAttributeChanged):
+
+2008-10-08  Anthony Ricaud  <rik24d@gmail.com>
+
+        Make the toolbar label text-shadow not disappear when clicking on the
+        search result count or around the search field.
+
+        Reviewed by Timothy Hatcher.
+
+        * inspector/front-end/inspector.css:
+        (.toolbar-item:active .toolbar-label): Make this rule also require the
+        toggleable class with the toolbar-item class.
+
+2008-10-08  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Updated the qrc file for the Web Inspector to contain the current set
+        of images.
+
+        * inspector/front-end/WebKit.qrc:
+
+2008-10-08  Prasanth Ullattil  <pullatti@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix the linking of applications against WebKit on Qt/Windows.
+
+        The prl files that qmake creates are buggy on Unix, but we they're
+        fine on Windows and we have to have them there in order to get the
+        dependencies correct.
+
+        * WebCore.pro:
+
+2008-10-08  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Simon.
+
+        Speed up rectangle filling by not re-creating a QBrush all the time.
+
+        This triggers faster path in QPainter where the brush is reused.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        (WebCore::GraphicsContext::fillRect):
+
+2008-10-08  Thiago Macieira  <thiago.macieira@nokia.com>
+
+        Reviewed by Simon.
+
+        Fixes: Encoding of Qt URLs
+
+        This encoding was added by Simon and I because QUrl's
+        tolerant parser wasn't tolerant enough. Now it is, so we don't need
+        this anymore.
+
+        * platform/qt/KURLQt.cpp:
+        (WebCore::KURL::operator QUrl):
+
+2008-10-08  Marius Storm-Olsen  <marius@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fixes dependencies in qmake generated visual studio projects.
+
+        Only add debug lib name if we're in the debug build_pass, else the release version.
+        The MSVC solution generator would pick up the debug javascriptcore lib as a dependency.
+
+        * WebCore.pro:
+
+2008-10-08  Prasanth Ullattil  <pullatti@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix compilation errors on VS2008 64Bit
+
+        * platform/text/TextStream.cpp:
+        (WebCore::TextStream::operator<<):
+        * platform/text/TextStream.h:
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::init):
+
+2008-10-07  Alp Toker  <alp@nuanti.com>
+
+        GTK+ build fix for older automake versions (1.7). Discussed in bug
+        #21392.
+
+        * GNUmakefile.am:
+
+2008-10-07  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        <rdar://problem/6273887> Crash in ApplicationCacheGroup
+
+        Make sure to stop loading even before a cache update is in progress so that the
+        manifest load will be stopped.
+
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::~ApplicationCacheGroup):
+        (WebCore::ApplicationCacheGroup::stopLoading):
+        (WebCore::ApplicationCacheGroup::cacheUpdateFailed):
+
+2008-10-07  Timothy Hatcher  <timothy@apple.com>
+
+        Auto-generate DOMDocument's createNodeIterator: and createTreeWalker: methods.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21433
+
+        Reviewed by Sam Weinig.
+
+        * WebCore.xcodeproj/project.pbxproj: Add ObjCNodeFilterCondition.{mm,h}.
+        * bindings/objc/DOM.mm: Remove previous category implementations
+        on DOMDocument for createNodeIterator: and createTreeWalker:. Also
+        moves ObjCNodeFilterCondition to its own file.
+        * bindings/objc/DOMTraversal.h: Remove the category methods that added
+        createNodeIterator: and createTreeWalker: to DOMDocument. This is fine
+        to do since DOmDocument.h is included still, and has these methods.
+        * bindings/objc/DOMUtility.mm:
+        (JSC::createDOMWrapper): Remove special case for JSNodeIterator and
+        JSTreeWalker now that the ObjC binding conforms to the standard wrap.
+        * bindings/objc/ObjCNodeFilterCondition.h: Split out from DOM.mm.
+        (WebCore::ObjCNodeFilterCondition::create): Moved from DOM.mm.
+        (WebCore::ObjCNodeFilterCondition::ObjCNodeFilterCondition): Ditto.
+        * bindings/objc/ObjCNodeFilterCondition.mm: Split out from DOM.mm.
+        (WebCore::ObjCNodeFilterCondition::acceptNode): Moved from DOM.mm.
+        * bindings/objc/PublicDOMInterfaces.h: Add the createNodeIterator: and
+        createTreeWalker: methods to DOMDocument.
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        (GetObjCTypeGetter): Add a case for NodeFilter.
+        (AddIncludesForType): Include ObjCNodeFilterCondition.h for NodeFilter.
+        (GenerateImplementation): Remove existing NodeFilter special case that
+        used the m_filter member variable. Add a new special getter for protocol
+        types that aren't EventTarget, so the right class is used for NodeFilter.
+        Add a special case for NodeFilter where it creates an ObjCNodeFilterCondition.
+        * dom/Document.idl: Remove the #ifdef LANGUAGE_OBJECTIVE_C. Add the
+        OldStyleObjC extended attribute to createNodeIterator and createTreeWalker.
+        Rename the entityReferenceExpansion parameter to expandEntityReferences to
+        match the previous ObjC API.
+        * dom/NodeIterator.idl: Remove ObjCIvar from the filter attribute. The
+        m_filter member variable was never used in practice, it was always nil!
+        We can remove it and not pad the object because this can't be subclassed.
+        * dom/TreeWalker.idl: Ditto.
+
+2008-10-07  Timothy Hatcher  <timothy@apple.com>
+
+        Auto-generate the DOMEventTarget protocol implementation for
+        DOMNode and DOMSVGElementInstance.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21432
+
+        Reviewed by Darin Adler.
+
+        * WebCore.xcodeproj/project.pbxproj: Add ObjCEventListener.{mm,h}.
+        * bindings/objc/DOM.mm: Remove many unneeded header includes. Move
+        ObjCEventListener to it's own file. Remove the manual impelmentations
+        of the DOMEventTarget protocol for DOMNode and DOMSVGElementInstance.
+        * bindings/objc/DOMEvents.h: Remove the categories that defined
+        DOMEventTarget for DOMNode and DOMSVGElementInstance.
+        * bindings/objc/ObjCEventListener.h: Split out from DOM.mm.
+        * bindings/objc/ObjCEventListener.mm: Split out from DOM.mm.
+        (WebCore::ObjCEventListener::find): Moved from DOM.mm.
+        (WebCore::ObjCEventListener::wrap): Use PassRefPtr to prevent the
+        callers from doing a manual deref.
+        (WebCore::ObjCEventListener::ObjCEventListener): Moved from DOM.mm.
+        (WebCore::ObjCEventListener::~ObjCEventListener): Ditto.
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        (GetObjCTypeGetter): Add a case for EventListener and use WTF::getPtr.
+        (AddIncludesForType): Include ObjCEventListener.h for EventListener.
+        And include EventTargetSVGElementInstance.h for SVGElementInstance.
+        (GenerateHeader): Remove the check for multiple parents.
+        (GenerateImplementation): Remove the check for multiple parents. Remove
+        the @deprecatedFunctions array since deprecated methods get generated
+        into the main @interface now to work with protocols. Add support
+        for the EventTargetNodeCast extended attribute. Add support for
+        EventListener parameters.
+        * dom/Node.idl: Define superclasses for ObjC so the implementation
+        and interface implement the DOMEventTarget protocol. Explicitly
+        specify Object as a superclass to use DOMEventTarget. Object will turn
+        into DOMObject. This is needed to take the code generator down the right
+        path of multiple super-classes as protocols. It is ObjC only for legacy
+        reasons. The event target methods are normally on NodeEventTarget, a
+        subclass of Node. But the ObjC API has never has this subclass and
+        they are on DOMNode.
+        * svg/SVGElementInstance.idl: Ditto.
+
+2008-10-07  David Hyatt  <hyatt@apple.com>
+
+        Add new pseudo-elements and pseudo-classes that will enable scrollbars to be styled by CSS.
+
+        The new pseudo-elements are:
+            scrollbar
+            scrollbar-button
+            scrollbar-corner
+            scrollbar-thumb
+            scrollbar-track
+
+        These elements will work with all the usual pseudo-classes (:hover, :active, :enabled, :disabled, etc.) and with
+        the following new pseudo-classes:
+            scrollbar-active
+            scrollbar-back
+            scrollbar-forward
+            scrollbar-horizontal
+            scrollbar-vertical
+
+        Reviewed by Adele
+
+        * css/CSSSelector.cpp:
+        (WebCore::CSSSelector::extractPseudoType):
+        * css/CSSSelector.h:
+        (WebCore::CSSSelector::):
+
+2008-10-06  Timothy Hatcher  <timothy@apple.com>
+
+        Add support to the Resources panel for queries like "#123", "foo #123",
+        "line: 123" and "foo line: 123". These will match the query limiting
+        the search only to the line specified. If only a line is specified,
+        the whole line is matched.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21422
+
+        Reviewed by Darin Adler.
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.sourceRow): Don't return the last
+        row if the index is greater than the rows collection. Let it return
+        undefined by indexing out-of-bounds.
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype.performSearch): Add support for
+        queries like "#123", "foo #123", "line: 123" and "foo line: 123".
+        Also match the whole query to the whole document in case there are
+        colors like "#333".
+
+2008-10-07  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21392
+        [GTK] Auto-generate JS DOM binding sources list
+
+        Remove the huge lists of generated DOM binding sources and headers in
+        the build system. These are difficult to maintain and can be derived
+        automatically.
+
+        The new strategy is to re-use the existing lists of IDL sources (which
+        are needed for dist support anyway). This will also ease the addition
+        of new language bindings.
+
+        * GNUmakefile.am:
+
+2008-10-07  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Don't attempt to paint when updating control tints
+
+        We don't have a valid PlatformGraphicsContext so schedule
+        the dirty scrollbar/scrollview area for repaint instead.
+
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::ScrollbarThemeQt::paint):
+        (WebCore::ScrollbarThemeQt::paintScrollCorner):
+
+2008-10-07  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        [qt] Build fix after Scrollbar.h and Widget.h changes.
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::init):
+
+2008-10-06  David Hyatt  <hyatt@apple.com>
+
+        Enable viewless Mac WebKit to (kinda sorta) paint basic pages (with no frames on them).
+
+        Reviewed by Sam Weinig
+
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::hasWebView):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadWithDocumentLoader):
+        (WebCore::FrameLoader::transitionToCommitted):
+        * loader/FrameLoaderClient.h:
+        * page/FocusController.cpp:
+        (WebCore::FocusController::setActive):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::init):
+        (WebCore::FrameView::layoutIfNeededRecursive):
+        * page/FrameView.h:
+
+2008-10-06  Dan Bernstein  <mitz@apple.com>
+
+        - build fix
+
+        * bindings/objc/DOMEvents.h:
+
+2008-10-06  Mark Mentovai  <mark@moxienet.com>
+
+        Reviewed by Tim Hatcher.
+
+        Use #if ENABLE(feature) where possible, and #if ENABLE_feature where
+        Platform.h is not available, in preference to #ifdef ENABLE_feature.
+        #ifdef is wrong now that features are disabled by #defining
+        ENABLE_feature to 0.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21338
+
+        * bindings/objc/DOMEvents.h:
+        * bindings/objc/PublicDOMInterfaces.h:
+        * dom/Document.idl:
+        * page/DOMWindow.idl:
+        * svg/svgtags.in:
+
+2008-10-06  Mark Mentovai  <mark@moxienet.com>
+
+        Reviewed by Sam Weinig.
+
+        * platform/network/mac/FormDataStreamMac.mm: #import <wtf/Threading.h>
+        to get the declaration for isMainThread().
+
+2008-10-06  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Tim Hatcher.
+
+        WebCoreObjCExtras.c is actually an obj-c++ file, so change its name
+        to reflect that.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/mac/WebCoreObjCExtras.c: Removed.
+        * platform/mac/WebCoreObjCExtras.mm: Copied from WebCore/platform/mac/WebCoreObjCExtras.c.
+
+2008-10-06  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Added C++ forward declaration for the NSURLAuthenticationChallenge class
+        so that the m_currentMacChallenge variable doesn't cause a
+        compilation error when ResourceHandleInternal.h is included from a C++ file.
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=21411
+
+        * platform/network/ResourceHandleInternal.h:
+
+2008-10-06  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2008-10-06  Steve Falkenburg  <sfalken@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21416
+        Add missing null checks identified by Application Verifier.
+
+        Reviewed by Darin Adler.
+
+        * platform/win/SharedTimerWin.cpp:
+        (WebCore::clearTimer):
+
+2008-10-06  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Removed accidentally left in debugging statement.
+
+        * inspector/front-end/inspector.js:
+
+2008-10-06  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim Hatcher and Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21412
+        Bug 21412: Refactor user initiated profile count to be more stable
+
+        * inspector/InspectorController.cpp: Keep track of the user-initiated
+        profiles here now.
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        * inspector/InspectorController.h:
+        The front end will now need to check for the existence of the user-
+        initiated profile title and use its count instead of keeping its own.
+        * inspector/front-end/ProfilesPanel.js:
+
+2008-10-06  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - separate GDI text drawing into its own function
+
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::drawGDIGlyphs):
+        (WebCore::Font::drawGlyphs):
+
+2008-10-03  Steve Falkenburg  <sfalken@apple.com>
+
+        <rdar://problem/6249833> Fix default button appearance
+
+        Reviewed by Adele Peterson.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::supportsFocus):
+        (WebCore::RenderThemeWin::determineClassicState):
+        (WebCore::RenderThemeWin::determineButtonState):
+        (WebCore::RenderThemeWin::getClassicThemeData):
+        (WebCore::RenderThemeWin::getThemeData):
+        (WebCore::drawControl):
+        * rendering/RenderThemeWin.h:
+
+2008-10-06  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Add native virtual keycode to PlatformKeyboardEvent
+
+        * platform/PlatformKeyboardEvent.h:
+        * platform/gtk/KeyEventGtk.cpp:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/mac/KeyEventMac.mm:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/win/KeyEventWin.cpp:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+        * platform/wx/KeyboardEventWx.cpp:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+
+2008-10-06  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Enable WebCore::String <> CFStringRef conversion functions for QtWebKit/Mac
+
+        * platform/text/PlatformString.h:
+        * platform/text/StringImpl.h:
+        * platform/text/cf/StringCF.cpp:
+        * platform/text/cf/StringImplCF.cpp:
+
+2008-10-06  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Use bundles on QtWebKit/Mac for platform modules
+
+        * platform/FileSystem.h:
+        * platform/qt/FileSystemQt.cpp:
+        (WebCore::unloadModule):
+
+2008-10-06  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Simon.
+
+        Build fix for MinGW.
+
+        * platform/win/SystemTimeWin.cpp:
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::invalidateRect):
+
+2008-10-06  Adam Roben  <aroben@apple.com>
+
+        Mimic the inspector/ directory structure in WebCore.vcproj
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2008-10-06  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * WebCore.vcproj/WebCore.vcproj: Update the Include path for all
+        configurations to include WebCore/inspector.
+
+2008-10-04  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        SVG should support ascent and descent properties <font-face> instead of <font>!
+        https://bugs.webkit.org/show_bug.cgi?id=21365
+
+        Tested by many many existing SVG tests.
+
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::ascent):
+        (WebCore::SVGFontFaceElement::descent):
+
+2008-10-05  Darin Fisher  <darin@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        REGRESSION: crash in ScriptElement::notifyFinished
+        Fixes https://bugs.webkit.org/show_bug.cgi?id=21329
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::notifyFinished): Revert part of r35744 to
+        ensure that the ScriptElementData object is not destroyed prematurely.
+
+2008-10-05  Chris Lord  <chris@openedhand.com>
+
+        Reviewed by Alp Toker. Landed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20624
+        WebKit-gtk uses deprecated GtkType/GtkObject
+
+        * plugins/gtk/gtk2xtbin.c:
+        (gtk_xtbin_get_type):
+        * plugins/gtk/gtk2xtbin.h:
+
+2008-10-05  Luke Kenneth Casson Leighton  <lkcl@lkcl.net>
+
+        Reviewed by David Hyatt.
+
+        GTK_WINDOW_HWND not GTK_WINDOWING_HWND
+        https://bugs.webkit.org/show_bug.cgi?id=20725
+
+        Updated to ToT by Jan Alonzo.
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::getValue):
+
+2008-10-05  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Invalid cast from GdkWindow to GtkWidget
+        https://bugs.webkit.org/show_bug.cgi?id=21391
+
+        Fix a misplaced closing parenthesis to actually cast the widget, not the window
+
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::screenDepth):
+
+2008-10-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Alder.
+
+        Attach the Origin header to POST requests to help defend against
+        cross-site request forgery.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20792
+
+        Collin Jackson <collinj@webkit.org> also contributed to this patch.
+
+        Tests: http/tests/security/originHeader/origin-header-for-data.html
+               http/tests/security/originHeader/origin-header-for-empty.html
+               http/tests/security/originHeader/origin-header-for-get.html
+               http/tests/security/originHeader/origin-header-for-https.html
+               http/tests/security/originHeader/origin-header-for-post.html
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::createWindow):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::createWindow):
+        (WebCore::FrameLoader::urlSelected):
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::outgoingOrigin):
+        (WebCore::FrameLoader::loadURL):
+        (WebCore::FrameLoader::addExtraFieldsToRequest):
+        (WebCore::FrameLoader::loadPostRequest):
+        (WebCore::FrameLoader::loadResourceSynchronously):
+        (WebCore::FrameLoader::loadItem):
+        * loader/FrameLoader.h:
+        * loader/SubresourceLoader.cpp:
+        (WebCore::SubresourceLoader::create):
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::servePendingRequests):
+        * platform/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::toHTTPOrigin):
+        * platform/SecurityOrigin.h:
+        * platform/network/ResourceRequestBase.h:
+        (WebCore::ResourceRequestBase::httpOrigin):
+        (WebCore::ResourceRequestBase::setHTTPOrigin):
+        (WebCore::ResourceRequestBase::clearHTTPOrigin):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::makeSimpleCrossSiteAccessRequest):
+        (WebCore::XMLHttpRequest::makeCrossSiteAccessRequestWithPreflight):
+        (WebCore::XMLHttpRequest::handleAsynchronousPreflightResult):
+        (WebCore::XMLHttpRequest::didReceiveResponsePreflight):
+
+2008-10-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Bug 21381: Incremental parsing of html causes bogus line numbers in some cases
+        <https://bugs.webkit.org/show_bug.cgi?id=21381>
+
+        If we hit a parsing boundary (end of a packet, etc) in the middle of a
+        <script> element when we are doing an incremental parse, we exit the
+        parser, and reenter later when more data is available.  During this
+        reentry we incorrectly reset the scriptStartLineno to the current line
+        in the parser, which is now part way through the script element.
+
+        The solution is to track whether we are entering or reentering the parsing
+        of a script element.  We do this simply by 0 checking scriptStartLineno,
+        and resetting it after we complete parsing of each script element.
+
+        Test: http/tests/incremental/pause-in-script-element.pl
+
+        * ChangeLog:
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::parseSpecial):
+        (WebCore::HTMLTokenizer::scriptHandler):
+
+2008-10-04  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by David Hyatt. Landed by Jan Alonzo.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20924
+        [Gtk] Linux/Gtk: Recent tree revisions fail Acid2 and Acid3
+
+        https://bugs.webkit.org/show_bug.cgi?id=19578
+        [CURL] problem in parseDataUrl
+
+        De-obfuscate parseDataUrl() and fix regressions introduced in r35954.
+        This patch also fixes encoding support in escaped (non-Base64) data
+        URLs. All manual data URL tests now pass in both GLib and non-GLib
+        code paths.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::parseDataUrl):
+
+2008-10-04  Timothy Hatcher  <timothy@apple.com>
+
+        Makes breakpoints and debugging code during page load work in the
+        Web Inspector's debugger. Specifically, this makes the source
+        code for loading resources show up in the Scripts panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19053
+        rdar://problem/5933408
+
+        Reviewed by Mark Rowe.
+
+        * WebCore.xcodeproj/project.pbxproj: Mark the inspector group as
+        not using tabs and a tab width of 8.
+        * inspector/InspectorController.cpp:
+        (WebCore::addResourceSourceToFrame): Return a bool to report if the
+        source was added successfully or not.
+        (WebCore::addSourceToFrame): Ditto.
+        * inspector/front-end/ScriptView.js:
+        (WebInspector.ScriptView.prototype.setupSourceFrameIfNeeded):
+        Return early if the InspectorController.addSourceToFrame fails.
+        Moved the delete of the _frameNeedsSetup property after that call so
+        if the source wasn't added it will be attempted again.
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype.detach): Move a comment.
+        (WebInspector.SourceView.prototype.setupSourceFrameIfNeeded):
+        Don't check if the resource is finished or failed, just attempt
+        to add the source to the frame. WebCore has the source, but the
+        finished property hasn't been set yet. Return early if the
+        InspectorController.addSourceToFrame fails. Moved the delete
+        of the _frameNeedsSetup property after that call so if the source
+        wasn't added it will be attempted again.
+        (WebInspector.SourceView.prototype._resourceLoadingFinished):
+        Clear the _frameNeedsSetup and _sourceFrameSetup properties so
+        the source frame will we populated again now that the resource
+        load has finished.
+        * manual-tests/inspector/debugger-pause-during-load.html: Added.
+
+2008-10-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Add a 'Check For Weak VTables' build phase to catch weak vtables as early as possible.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2008-10-04  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21373
+
+        Tear down scrollbars in FrameView rather than ScrollView so that the connection to the hostWindow()
+        is still present.
+
+        Reviewed by Mark Rowe
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::~FrameView):
+
+2008-10-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Avoid copying a Vector when using getSupportedKeySizes.
+
+        * html/HTMLKeygenElement.cpp:
+        (WebCore::HTMLKeygenElement::HTMLKeygenElement):
+        * platform/SSLKeyGenerator.h:
+        * platform/gtk/TemporaryLinkStubs.cpp:
+        (WebCore::getSupportedKeySizes):
+        * platform/mac/SSLKeyGeneratorMac.mm:
+        (WebCore::getSupportedKeySizes):
+        * platform/qt/TemporaryLinkStubs.cpp:
+        (WebCore::getSupportedKeySizes):
+        * platform/win/TemporaryLinkStubs.cpp:
+        (WebCore::getSupportedKeySizes):
+        * platform/wx/TemporaryLinkStubs.cpp:
+        (WebCore::getSupportedKeySizes):
+
+2008-10-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - prepare for https://bugs.webkit.org/show_bug.cgi?id=21295
+          Bug 21295: Replace ExecState with a call frame Register pointer
+
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::allowsUnwrappedAccessFrom):
+        Remove bogus "const".
+        * bindings/js/JSQuarantinedObjectWrapper.h: Ditto.
+
+2008-10-04  David Hyatt  <hyatt@apple.com>
+
+        Make PopupMenuClient obey the platform abstraction.  Remove any connection to Document and RenderStyle.
+
+        Reviewed by Darin Adler
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/PopupMenuClient.h:
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/mac/PopupMenuMac.mm:
+        (WebCore::PopupMenu::populate):
+        (WebCore::PopupMenu::show):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::populate):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::calculatePositionAndSize):
+        (WebCore::PopupMenu::paint):
+        (WebCore::PopupWndProc):
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::itemStyle):
+        (WebCore::RenderMenuList::menuStyle):
+        (WebCore::RenderMenuList::hostWindow):
+        * rendering/RenderMenuList.h:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::itemStyle):
+        (WebCore::RenderTextControl::menuStyle):
+        (WebCore::RenderTextControl::hostWindow):
+        * rendering/RenderTextControl.h:
+
+2008-10-04  Matt Lilek  <webkit@mattlilek.com>
+
+        Build fix - restore Private role to headers that had it before the move.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2008-10-04  Darin Adler  <darin@apple.com>
+
+        - try to fix build
+
+        * DerivedSources.make: Add new inspector directory to VPATH.
+        * GNUmakefile.am: Add new inspector directory to includes.
+        Re-sort the IDL_BINDINGS list. Add new inspector directory
+        to VPATH.
+
+2008-10-04  Matt Lilek  <webkit@mattlilek.com>
+
+        Not reviewed, attempt to fix Gtk build.
+
+        * GNUmakefile.am:
+
+2008-10-03  Timothy Hatcher  <timothy@apple.com>
+
+        Move the Web Inspector files into a top-level "inspector" folder.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21359
+
+        Reviewed by Dave Hyatt.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * inspector/InspectorClient.h: Renamed from WebCore/page/InspectorClient.h.
+        * inspector/InspectorController.cpp: Renamed from WebCore/page/InspectorController.cpp.
+        * inspector/InspectorController.h: Renamed from WebCore/page/InspectorController.h.
+        * inspector/JavaScriptCallFrame.cpp: Renamed from WebCore/page/JavaScriptCallFrame.cpp.
+        * inspector/JavaScriptCallFrame.h: Renamed from WebCore/page/JavaScriptCallFrame.h.
+        * inspector/JavaScriptCallFrame.idl: Renamed from WebCore/page/JavaScriptCallFrame.idl.
+        * inspector/JavaScriptDebugListener.h: Renamed from WebCore/page/JavaScriptDebugListener.h.
+        * inspector/JavaScriptDebugServer.cpp: Renamed from WebCore/page/JavaScriptDebugServer.cpp.
+        * inspector/JavaScriptDebugServer.h: Renamed from WebCore/page/JavaScriptDebugServer.h.
+        * inspector/JavaScriptProfile.cpp: Renamed from WebCore/page/JavaScriptProfile.cpp.
+        * inspector/JavaScriptProfile.h: Renamed from WebCore/page/JavaScriptProfile.h.
+        * inspector/JavaScriptProfileNode.cpp: Renamed from WebCore/page/JavaScriptProfileNode.cpp.
+        * inspector/JavaScriptProfileNode.h: Renamed from WebCore/page/JavaScriptProfileNode.h.
+        * inspector/front-end/Breakpoint.js: Renamed from WebCore/page/inspector/Breakpoint.js.
+        * inspector/front-end/BreakpointsSidebarPane.js: Renamed from WebCore/page/inspector/BreakpointsSidebarPane.js.
+        * inspector/front-end/CallStackSidebarPane.js: Renamed from WebCore/page/inspector/CallStackSidebarPane.js.
+        * inspector/front-end/Console.js: Renamed from WebCore/page/inspector/Console.js.
+        * inspector/front-end/DataGrid.js: Renamed from WebCore/page/inspector/DataGrid.js.
+        * inspector/front-end/Database.js: Renamed from WebCore/page/inspector/Database.js.
+        * inspector/front-end/DatabaseQueryView.js: Renamed from WebCore/page/inspector/DatabaseQueryView.js.
+        * inspector/front-end/DatabaseTableView.js: Renamed from WebCore/page/inspector/DatabaseTableView.js.
+        * inspector/front-end/DatabasesPanel.js: Renamed from WebCore/page/inspector/DatabasesPanel.js.
+        * inspector/front-end/ElementsPanel.js: Renamed from WebCore/page/inspector/ElementsPanel.js.
+        * inspector/front-end/ElementsTreeOutline.js: Renamed from WebCore/page/inspector/ElementsTreeOutline.js.
+        * inspector/front-end/FontView.js: Renamed from WebCore/page/inspector/FontView.js.
+        * inspector/front-end/ImageView.js: Renamed from WebCore/page/inspector/ImageView.js.
+        * inspector/front-end/Images/back.png: Renamed from WebCore/page/inspector/Images/back.png.
+        * inspector/front-end/Images/checker.png: Renamed from WebCore/page/inspector/Images/checker.png.
+        * inspector/front-end/Images/clearConsoleButtons.png: Renamed from WebCore/page/inspector/Images/clearConsoleButtons.png.
+        * inspector/front-end/Images/closeButtons.png: Renamed from WebCore/page/inspector/Images/closeButtons.png.
+        * inspector/front-end/Images/consoleButtons.png: Renamed from WebCore/page/inspector/Images/consoleButtons.png.
+        * inspector/front-end/Images/database.png: Renamed from WebCore/page/inspector/Images/database.png.
+        * inspector/front-end/Images/databaseTable.png: Renamed from WebCore/page/inspector/Images/databaseTable.png.
+        * inspector/front-end/Images/databasesIcon.png: Renamed from WebCore/page/inspector/Images/databasesIcon.png.
+        * inspector/front-end/Images/debuggerContinue.png: Renamed from WebCore/page/inspector/Images/debuggerContinue.png.
+        * inspector/front-end/Images/debuggerPause.png: Renamed from WebCore/page/inspector/Images/debuggerPause.png.
+        * inspector/front-end/Images/debuggerStepInto.png: Renamed from WebCore/page/inspector/Images/debuggerStepInto.png.
+        * inspector/front-end/Images/debuggerStepOut.png: Renamed from WebCore/page/inspector/Images/debuggerStepOut.png.
+        * inspector/front-end/Images/debuggerStepOver.png: Renamed from WebCore/page/inspector/Images/debuggerStepOver.png.
+        * inspector/front-end/Images/debuggingButtons.png: Renamed from WebCore/page/inspector/Images/debuggingButtons.png.
+        * inspector/front-end/Images/disclosureTriangleSmallDown.png: Renamed from WebCore/page/inspector/Images/disclosureTriangleSmallDown.png.
+        * inspector/front-end/Images/disclosureTriangleSmallDownBlack.png: Renamed from WebCore/page/inspector/Images/disclosureTriangleSmallDownBlack.png.
+        * inspector/front-end/Images/disclosureTriangleSmallDownWhite.png: Renamed from WebCore/page/inspector/Images/disclosureTriangleSmallDownWhite.png.
+        * inspector/front-end/Images/disclosureTriangleSmallRight.png: Renamed from WebCore/page/inspector/Images/disclosureTriangleSmallRight.png.
+        * inspector/front-end/Images/disclosureTriangleSmallRightBlack.png: Renamed from WebCore/page/inspector/Images/disclosureTriangleSmallRightBlack.png.
+        * inspector/front-end/Images/disclosureTriangleSmallRightDown.png: Renamed from WebCore/page/inspector/Images/disclosureTriangleSmallRightDown.png.
+        * inspector/front-end/Images/disclosureTriangleSmallRightDownBlack.png: Renamed from WebCore/page/inspector/Images/disclosureTriangleSmallRightDownBlack.png.
+        * inspector/front-end/Images/disclosureTriangleSmallRightDownWhite.png: Renamed from WebCore/page/inspector/Images/disclosureTriangleSmallRightDownWhite.png.
+        * inspector/front-end/Images/disclosureTriangleSmallRightWhite.png: Renamed from WebCore/page/inspector/Images/disclosureTriangleSmallRightWhite.png.
+        * inspector/front-end/Images/dockButtons.png: Renamed from WebCore/page/inspector/Images/dockButtons.png.
+        * inspector/front-end/Images/elementsIcon.png: Renamed from WebCore/page/inspector/Images/elementsIcon.png.
+        * inspector/front-end/Images/errorIcon.png: Renamed from WebCore/page/inspector/Images/errorIcon.png.
+        * inspector/front-end/Images/errorMediumIcon.png: Renamed from WebCore/page/inspector/Images/errorMediumIcon.png.
+        * inspector/front-end/Images/excludeButtons.png: Renamed from WebCore/page/inspector/Images/excludeButtons.png.
+        * inspector/front-end/Images/focusButtons.png: Renamed from WebCore/page/inspector/Images/focusButtons.png.
+        * inspector/front-end/Images/forward.png: Renamed from WebCore/page/inspector/Images/forward.png.
+        * inspector/front-end/Images/glossyHeader.png: Renamed from WebCore/page/inspector/Images/glossyHeader.png.
+        * inspector/front-end/Images/glossyHeaderPressed.png: Renamed from WebCore/page/inspector/Images/glossyHeaderPressed.png.
+        * inspector/front-end/Images/glossyHeaderSelected.png: Renamed from WebCore/page/inspector/Images/glossyHeaderSelected.png.
+        * inspector/front-end/Images/glossyHeaderSelectedPressed.png: Renamed from WebCore/page/inspector/Images/glossyHeaderSelectedPressed.png.
+        * inspector/front-end/Images/goArrow.png: Renamed from WebCore/page/inspector/Images/goArrow.png.
+        * inspector/front-end/Images/largerResourcesButtons.png: Renamed from WebCore/page/inspector/Images/largerResourcesButtons.png.
+        * inspector/front-end/Images/nodeSearchButtons.png: Renamed from WebCore/page/inspector/Images/nodeSearchButtons.png.
+        * inspector/front-end/Images/paneBottomGrow.png: Renamed from WebCore/page/inspector/Images/paneBottomGrow.png.
+        * inspector/front-end/Images/paneBottomGrowActive.png: Renamed from WebCore/page/inspector/Images/paneBottomGrowActive.png.
+        * inspector/front-end/Images/paneGrowHandleLine.png: Renamed from WebCore/page/inspector/Images/paneGrowHandleLine.png.
+        * inspector/front-end/Images/pauseOnExceptionButtons.png: Renamed from WebCore/page/inspector/Images/pauseOnExceptionButtons.png.
+        * inspector/front-end/Images/percentButtons.png: Renamed from WebCore/page/inspector/Images/percentButtons.png.
+        * inspector/front-end/Images/profileGroupIcon.png: Renamed from WebCore/page/inspector/Images/profileGroupIcon.png.
+        * inspector/front-end/Images/profileIcon.png: Renamed from WebCore/page/inspector/Images/profileIcon.png.
+        * inspector/front-end/Images/profileSmallIcon.png: Renamed from WebCore/page/inspector/Images/profileSmallIcon.png.
+        * inspector/front-end/Images/profilesIcon.png: Renamed from WebCore/page/inspector/Images/profilesIcon.png.
+        * inspector/front-end/Images/recordButtons.png: Renamed from WebCore/page/inspector/Images/recordButtons.png.
+        * inspector/front-end/Images/reloadButtons.png: Renamed from WebCore/page/inspector/Images/reloadButtons.png.
+        * inspector/front-end/Images/resourceCSSIcon.png: Renamed from WebCore/page/inspector/Images/resourceCSSIcon.png.
+        * inspector/front-end/Images/resourceDocumentIcon.png: Renamed from WebCore/page/inspector/Images/resourceDocumentIcon.png.
+        * inspector/front-end/Images/resourceDocumentIconSmall.png: Renamed from WebCore/page/inspector/Images/resourceDocumentIconSmall.png.
+        * inspector/front-end/Images/resourceJSIcon.png: Renamed from WebCore/page/inspector/Images/resourceJSIcon.png.
+        * inspector/front-end/Images/resourcePlainIcon.png: Renamed from WebCore/page/inspector/Images/resourcePlainIcon.png.
+        * inspector/front-end/Images/resourcePlainIconSmall.png: Renamed from WebCore/page/inspector/Images/resourcePlainIconSmall.png.
+        * inspector/front-end/Images/resourcesIcon.png: Renamed from WebCore/page/inspector/Images/resourcesIcon.png.
+        * inspector/front-end/Images/resourcesSizeGraphIcon.png: Renamed from WebCore/page/inspector/Images/resourcesSizeGraphIcon.png.
+        * inspector/front-end/Images/resourcesTimeGraphIcon.png: Renamed from WebCore/page/inspector/Images/resourcesTimeGraphIcon.png.
+        * inspector/front-end/Images/scriptsIcon.png: Renamed from WebCore/page/inspector/Images/scriptsIcon.png.
+        * inspector/front-end/Images/searchSmallBlue.png: Renamed from WebCore/page/inspector/Images/searchSmallBlue.png.
+        * inspector/front-end/Images/searchSmallBrightBlue.png: Renamed from WebCore/page/inspector/Images/searchSmallBrightBlue.png.
+        * inspector/front-end/Images/searchSmallGray.png: Renamed from WebCore/page/inspector/Images/searchSmallGray.png.
+        * inspector/front-end/Images/searchSmallWhite.png: Renamed from WebCore/page/inspector/Images/searchSmallWhite.png.
+        * inspector/front-end/Images/segment.png: Renamed from WebCore/page/inspector/Images/segment.png.
+        * inspector/front-end/Images/segmentEnd.png: Renamed from WebCore/page/inspector/Images/segmentEnd.png.
+        * inspector/front-end/Images/segmentHover.png: Renamed from WebCore/page/inspector/Images/segmentHover.png.
+        * inspector/front-end/Images/segmentHoverEnd.png: Renamed from WebCore/page/inspector/Images/segmentHoverEnd.png.
+        * inspector/front-end/Images/segmentSelected.png: Renamed from WebCore/page/inspector/Images/segmentSelected.png.
+        * inspector/front-end/Images/segmentSelectedEnd.png: Renamed from WebCore/page/inspector/Images/segmentSelectedEnd.png.
+        * inspector/front-end/Images/splitviewDimple.png: Renamed from WebCore/page/inspector/Images/splitviewDimple.png.
+        * inspector/front-end/Images/splitviewDividerBackground.png: Renamed from WebCore/page/inspector/Images/splitviewDividerBackground.png.
+        * inspector/front-end/Images/statusbarBackground.png: Renamed from WebCore/page/inspector/Images/statusbarBackground.png.
+        * inspector/front-end/Images/statusbarBottomBackground.png: Renamed from WebCore/page/inspector/Images/statusbarBottomBackground.png.
+        * inspector/front-end/Images/statusbarButtons.png: Renamed from WebCore/page/inspector/Images/statusbarButtons.png.
+        * inspector/front-end/Images/statusbarMenuButton.png: Renamed from WebCore/page/inspector/Images/statusbarMenuButton.png.
+        * inspector/front-end/Images/statusbarMenuButtonSelected.png: Renamed from WebCore/page/inspector/Images/statusbarMenuButtonSelected.png.
+        * inspector/front-end/Images/statusbarResizerHorizontal.png: Renamed from WebCore/page/inspector/Images/statusbarResizerHorizontal.png.
+        * inspector/front-end/Images/statusbarResizerVertical.png: Renamed from WebCore/page/inspector/Images/statusbarResizerVertical.png.
+        * inspector/front-end/Images/timelinePillBlue.png: Renamed from WebCore/page/inspector/Images/timelinePillBlue.png.
+        * inspector/front-end/Images/timelinePillGray.png: Renamed from WebCore/page/inspector/Images/timelinePillGray.png.
+        * inspector/front-end/Images/timelinePillGreen.png: Renamed from WebCore/page/inspector/Images/timelinePillGreen.png.
+        * inspector/front-end/Images/timelinePillOrange.png: Renamed from WebCore/page/inspector/Images/timelinePillOrange.png.
+        * inspector/front-end/Images/timelinePillPurple.png: Renamed from WebCore/page/inspector/Images/timelinePillPurple.png.
+        * inspector/front-end/Images/timelinePillRed.png: Renamed from WebCore/page/inspector/Images/timelinePillRed.png.
+        * inspector/front-end/Images/timelinePillYellow.png: Renamed from WebCore/page/inspector/Images/timelinePillYellow.png.
+        * inspector/front-end/Images/tipBalloon.png: Renamed from WebCore/page/inspector/Images/tipBalloon.png.
+        * inspector/front-end/Images/tipBalloonBottom.png: Renamed from WebCore/page/inspector/Images/tipBalloonBottom.png.
+        * inspector/front-end/Images/tipIcon.png: Renamed from WebCore/page/inspector/Images/tipIcon.png.
+        * inspector/front-end/Images/tipIconPressed.png: Renamed from WebCore/page/inspector/Images/tipIconPressed.png.
+        * inspector/front-end/Images/toolbarItemSelected.png: Renamed from WebCore/page/inspector/Images/toolbarItemSelected.png.
+        * inspector/front-end/Images/treeDownTriangleBlack.png: Renamed from WebCore/page/inspector/Images/treeDownTriangleBlack.png.
+        * inspector/front-end/Images/treeDownTriangleWhite.png: Renamed from WebCore/page/inspector/Images/treeDownTriangleWhite.png.
+        * inspector/front-end/Images/treeRightTriangleBlack.png: Renamed from WebCore/page/inspector/Images/treeRightTriangleBlack.png.
+        * inspector/front-end/Images/treeRightTriangleWhite.png: Renamed from WebCore/page/inspector/Images/treeRightTriangleWhite.png.
+        * inspector/front-end/Images/treeUpTriangleBlack.png: Renamed from WebCore/page/inspector/Images/treeUpTriangleBlack.png.
+        * inspector/front-end/Images/treeUpTriangleWhite.png: Renamed from WebCore/page/inspector/Images/treeUpTriangleWhite.png.
+        * inspector/front-end/Images/userInputIcon.png: Renamed from WebCore/page/inspector/Images/userInputIcon.png.
+        * inspector/front-end/Images/userInputPreviousIcon.png: Renamed from WebCore/page/inspector/Images/userInputPreviousIcon.png.
+        * inspector/front-end/Images/warningIcon.png: Renamed from WebCore/page/inspector/Images/warningIcon.png.
+        * inspector/front-end/Images/warningMediumIcon.png: Renamed from WebCore/page/inspector/Images/warningMediumIcon.png.
+        * inspector/front-end/Images/warningsErrors.png: Renamed from WebCore/page/inspector/Images/warningsErrors.png.
+        * inspector/front-end/MetricsSidebarPane.js: Renamed from WebCore/page/inspector/MetricsSidebarPane.js.
+        * inspector/front-end/Object.js: Renamed from WebCore/page/inspector/Object.js.
+        * inspector/front-end/ObjectPropertiesSection.js: Renamed from WebCore/page/inspector/ObjectPropertiesSection.js.
+        * inspector/front-end/Panel.js: Renamed from WebCore/page/inspector/Panel.js.
+        * inspector/front-end/Placard.js: Renamed from WebCore/page/inspector/Placard.js.
+        * inspector/front-end/ProfileView.js: Renamed from WebCore/page/inspector/ProfileView.js.
+        * inspector/front-end/ProfilesPanel.js: Renamed from WebCore/page/inspector/ProfilesPanel.js.
+        * inspector/front-end/PropertiesSection.js: Renamed from WebCore/page/inspector/PropertiesSection.js.
+        * inspector/front-end/PropertiesSidebarPane.js: Renamed from WebCore/page/inspector/PropertiesSidebarPane.js.
+        * inspector/front-end/Resource.js: Renamed from WebCore/page/inspector/Resource.js.
+        * inspector/front-end/ResourceCategory.js: Renamed from WebCore/page/inspector/ResourceCategory.js.
+        * inspector/front-end/ResourceView.js: Renamed from WebCore/page/inspector/ResourceView.js.
+        * inspector/front-end/ResourcesPanel.js: Renamed from WebCore/page/inspector/ResourcesPanel.js.
+        * inspector/front-end/ScopeChainSidebarPane.js: Renamed from WebCore/page/inspector/ScopeChainSidebarPane.js.
+        * inspector/front-end/Script.js: Renamed from WebCore/page/inspector/Script.js.
+        * inspector/front-end/ScriptView.js: Renamed from WebCore/page/inspector/ScriptView.js.
+        * inspector/front-end/ScriptsPanel.js: Renamed from WebCore/page/inspector/ScriptsPanel.js.
+        * inspector/front-end/SidebarPane.js: Renamed from WebCore/page/inspector/SidebarPane.js.
+        * inspector/front-end/SidebarTreeElement.js: Renamed from WebCore/page/inspector/SidebarTreeElement.js.
+        * inspector/front-end/SourceFrame.js: Renamed from WebCore/page/inspector/SourceFrame.js.
+        * inspector/front-end/SourceView.js: Renamed from WebCore/page/inspector/SourceView.js.
+        * inspector/front-end/StylesSidebarPane.js: Renamed from WebCore/page/inspector/StylesSidebarPane.js.
+        * inspector/front-end/TextPrompt.js: Renamed from WebCore/page/inspector/TextPrompt.js.
+        * inspector/front-end/View.js: Renamed from WebCore/page/inspector/View.js.
+        * inspector/front-end/WebKit.qrc: Renamed from WebCore/page/inspector/WebKit.qrc.
+        * inspector/front-end/inspector.css: Renamed from WebCore/page/inspector/inspector.css.
+        * inspector/front-end/inspector.html: Renamed from WebCore/page/inspector/inspector.html.
+        * inspector/front-end/inspector.js: Renamed from WebCore/page/inspector/inspector.js.
+        * inspector/front-end/treeoutline.js: Renamed from WebCore/page/inspector/treeoutline.js.
+        * inspector/front-end/utilities.js: Renamed from WebCore/page/inspector/utilities.js.
+
+2008-10-03  Timothy Hatcher  <timothy@apple.com>
+
+        Adds support to the Web Inspector's Elements panel for fast tag name,
+        class name, id and attribute name searching. The panel first tries
+        using getElementById, getElementsByClassName and getElementsByTagName
+        with the search query. Then does a slower search using XPath for partial
+        matches, text and comment matches.
+
+        Adds support for search queries like "<div>", "<h" and "frame>".
+        These forms limit the search to tag names, text and comment matches.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21353
+
+        Reviewed by Maciej Stachowiak.
+
+        * page/inspector/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.performSearch): Add tag syntax
+        support. Add new search functions that try exact matches first.
+
+2008-10-03  Timothy Hatcher  <timothy@apple.com>
+
+        Changes how searching works in the Web Inspector's Elements
+        panel. The search tasks are divided into chunks that are small
+        units of work that are performed at a time interval. This
+        change also prevents queries that will select all elements,
+        since that isn't useful.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21285
+
+        Reviewed by Oliver Hunt.
+
+        * page/inspector/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.searchCancled):
+        Remove the searchResultsProperty form results since there might
+        be an unfinished search.
+        (WebInspector.ElementsPanel.prototype.performSearch): Divide the
+        documents and search functions into chunks that are performed on
+        a interval of 25ms. Prevent searches for "//*" and "*".
+
+2008-10-03  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - "this" object in methods called on primitives should be wrapper object
+        https://bugs.webkit.org/show_bug.cgi?id=21362
+
+        Updated so toThis conversion for the split window is handled properly.
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2008-10-03  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David "The Motivator" Hyatt.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=21355
+        Move SecurityOrigin out of platform/ to page/.
+
+        It was a layering violation for SecurityOrigin to be in platform
+        as it depended on FrameLoader.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * page/SecurityOrigin.cpp: Copied from platform/SecurityOrigin.cpp.
+        * page/SecurityOrigin.h: Copied from platform/SecurityOrigin.h.
+        * page/SecurityOriginHash.h: Copied from platform/SecurityOriginHash.h.
+        * platform/SecurityOrigin.cpp: Removed.
+        * platform/SecurityOrigin.h: Removed.
+        * platform/SecurityOriginHash.h: Removed.
+
+2008-10-03  Marco Barisione  <marco.barisione@collabora.co.uk>
+
+        Reviewed by Alp Toker.
+
+        http://bugs.webkit.org/show_bug.cgi?id=18832
+        [curl] file upload does not work
+
+        The curl_off_t integer type has a different size depending if large
+        file support is enabled or not. There is no different public API for
+        the two cases, so the same function accepts a different type based on
+        a compilation option the could be different in WebKit and libcurl.
+        To fix the bug we query libcurl at runtime for large file support and
+        pass the right type based on that.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::setupPOST):
+
+2008-10-03  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by David Hyatt.
+
+        Gtk build fixes.
+
+        * platform/gtk/FileChooserGtk.cpp:
+        (WebCore::FileChooser::openFileChooser):
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenAvailableRect):
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::platformAddChild):
+        (WebCore::ScrollView::platformRemoveChild):
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::setCursor):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::init):
+
+2008-10-03  David Hyatt  <hyatt@apple.com>
+
+        Fix Qt bustage from missing include.
+
+        * platform/qt/PlatformScreenQt.cpp:
+
+2008-10-03  David Hyatt  <hyatt@apple.com>
+
+        Fix Windows scrollbar bustage in popup menus.
+
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupWndProc):
+
+2008-10-03  David Hyatt  <hyatt@apple.com>
+
+        Fix Windows bustage.
+
+        * platform/win/FileChooserWin.cpp:
+        (WebCore::FileChooser::openFileChooser):
+        * platform/win/PlatformScreenWin.cpp:
+        (WebCore::monitorInfoForWidget):
+        * platform/win/WidgetWin.cpp:
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::init):
+
+2008-10-03  Darin Adler  <darin@apple.com>
+
+        * bindings/js/JSInspectedObjectWrapper.cpp: Try to fix a build failure
+        seen on some machines but not others by adding an include.
+
+2008-10-03  Darin Adler  <darin@apple.com>
+
+        - Qt build fix
+
+        * bridge/qt/qt_runtime.cpp: Remove long-obsolete codeType and
+        execute functions. Declarations for these relied on the CodeType
+        enumeration, which used to be in ExecState.h; but the functions
+        aren't needed at all.
+        * bridge/qt/qt_runtime.h: Ditto.
+
+2008-10-03  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        - next step of https://bugs.webkit.org/show_bug.cgi?id=21295
+          Turn ExecState into a call frame pointer.
+
+        Remove m_globalObject and m_globalData from ExecState.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData):
+        Removed an argument now that JSGlobalObject doesn't need it any more.
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase): Removed the argument from
+        the JSDOMWindowBaseData constructor, and added the this argument to the
+        JSGlobalObject constructor. This is because a couple key bits of
+        initialization moved from the data constructor to the JSGlobalObject
+        constructor.
+        * bindings/js/JSDOMWindowBase.h: Ditto.
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::QtRuntimeMethod::QtRuntimeMethod):
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::RuntimeMethod):
+        Pass JSGlobalData* instead of ExecState* to the InternalFunction
+        constructor.
+
+2008-10-03  David Hyatt  <hyatt@apple.com>
+
+        Fix Windows/Qt build bustage.
+
+        Reviewed by ggaren
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::platformWindow):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::platformWindow):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * platform/HostWindow.h:
+        * platform/qt/PlatformScreenQt.cpp:
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/qt/PopupMenuQt.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+        (WebCore::PopupMenu::calculatePositionAndSize):
+        (WebCore::PopupWndProc):
+
+2008-10-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Make setStyle() take a const RenderStyle, to ensure that an
+        earlier RenderStyle::diff() remains valid.
+
+        * rendering/RenderBR.cpp:
+        * rendering/RenderBR.h:
+        * rendering/RenderBlock.cpp:
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        * rendering/RenderBox.h:
+        * rendering/RenderButton.cpp:
+        * rendering/RenderButton.h:
+        * rendering/RenderFieldset.cpp:
+        * rendering/RenderFieldset.h:
+        * rendering/RenderFileUploadControl.cpp:
+        * rendering/RenderFileUploadControl.h:
+        * rendering/RenderInline.cpp:
+        * rendering/RenderInline.h:
+        * rendering/RenderListBox.cpp:
+        * rendering/RenderListBox.h:
+        * rendering/RenderListItem.cpp:
+        * rendering/RenderListItem.h:
+        * rendering/RenderListMarker.cpp:
+        * rendering/RenderListMarker.h:
+        * rendering/RenderMenuList.cpp:
+        * rendering/RenderMenuList.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::setStyle):
+        * rendering/RenderObject.h:
+        * rendering/RenderReplaced.cpp:
+        * rendering/RenderReplaced.h:
+        * rendering/RenderSVGBlock.cpp:
+        (WebCore::RenderSVGBlock::setStyle):
+        * rendering/RenderSVGBlock.h:
+        * rendering/RenderSVGGradientStop.cpp:
+        * rendering/RenderSVGGradientStop.h:
+        * rendering/RenderSlider.cpp:
+        * rendering/RenderSlider.h:
+        * rendering/RenderTable.cpp:
+        * rendering/RenderTable.h:
+        * rendering/RenderTableCell.cpp:
+        * rendering/RenderTableCell.h:
+        * rendering/RenderTableRow.cpp:
+        * rendering/RenderTableRow.h:
+        * rendering/RenderText.cpp:
+        * rendering/RenderText.h:
+        * rendering/RenderTextControl.cpp:
+        * rendering/RenderTextControl.h:
+        * rendering/RenderWidget.cpp:
+        * rendering/RenderWidget.h:
+        * rendering/style/RenderStyle.h:
+        (WebCore::RenderStyle::isDisplayReplacedType):
+        (WebCore::RenderStyle::isDisplayInlineType):
+
+2008-10-03  David Hyatt  <hyatt@apple.com>
+
+        Preparation for enabling scrollbars to hit test properly inside transforms.  Clean up the scrollbar
+        event handlers to no longer be virtual.  Don't pass a mouse event where none is needed.  Add a new
+        method on Scrollbars called transformEvent that will apply all of the transforms to make a new event
+        that will work properly for hit testing.  This patch just stubs out that method to return the same
+        event untransformed.
+
+        Reviewed by Darin Adler
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseDoubleClickEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+        (WebCore::EventHandler::passMousePressEventToScrollbar):
+        * page/gtk/EventHandlerGtk.cpp:
+        * page/mac/EventHandlerMac.mm:
+        * page/qt/EventHandlerQt.cpp:
+        * page/win/EventHandlerWin.cpp:
+        * page/wx/EventHandlerWx.cpp:
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::mouseMoved):
+        (WebCore::Scrollbar::mouseExited):
+        (WebCore::Scrollbar::mouseUp):
+        (WebCore::Scrollbar::mouseDown):
+        (WebCore::Scrollbar::transformEvent):
+        * platform/Scrollbar.h:
+
+2008-10-03  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21340
+
+        Remove "containingWindow()/setContainingWindow()" from Widget.  HostWindow covers this now.
+
+        Reviewed by Dan Bernstein & Darin Adler
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::addChild):
+        * platform/Widget.cpp:
+        (WebCore::Widget::init):
+        * platform/Widget.h:
+        * platform/mac/WidgetMac.mm:
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::show):
+
+2008-10-03  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        * css/CSSFontSelector.cpp: (WebCore::fontDataForGenericFamily):
+        Return early if settings is nil.
+
+2008-10-03  Rob Buis  <buis@kde.org>
+
+        Reviewed by Darin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20134
+        REGRESSION (2.0.4-3.0.4): No default value set for <input type=range> with an even difference of (max - min)
+
+        Make sure the input element gets the right default value when no value is set.
+
+        Test: fast/forms/range-default-value.html
+
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::setPositionFromValue):
+
+2008-10-03  David Hyatt  <hyatt@apple.com>
+
+        Instead of a cross-platform init/destroy that forces every ScrollView platform to have a constructor/
+        destructor that calls them, switch to having a cross-platform constructor/destructor that calls
+        platform-specific init/destroy methods.
+
+        With this change, ScrollViewWin.cpp can be removed from the build (yay!).
+
+        Reviewed by Darin Adler
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::~ScrollView):
+        (WebCore::ScrollView::platformInit):
+        (WebCore::ScrollView::platformDestroy):
+        (WebCore::ScrollView::platformAddChild):
+        (WebCore::ScrollView::platformRemoveChild):
+        * platform/ScrollView.h:
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::platformInit):
+        (WebCore::ScrollView::platformDestroy):
+        * platform/mac/ScrollViewMac.mm:
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::platformInit):
+        (WebCore::ScrollView::platformDestroy):
+        * platform/win/ScrollViewWin.cpp: Removed.
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::platformInit):
+        (WebCore::ScrollView::platformDestroy):
+        (WebCore::ScrollView::setPlatformWidget):
+
+2008-10-03  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for <rdar://problem/6012018>
+        https://bugs.webkit.org/show_bug.cgi?id=21335
+        CrashTracer: [USER] 4959 crashes in Safari at com.apple.WebCore: WebCore::Frame::settings const + 8
+
+        * css/CSSFontSelector.cpp: (WebCore::fontDataForGenericFamily): Return early if the frame is nil.
+
+2008-10-03  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Build fix.
+
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::invalidateRect):
+
+2008-10-03  Alp Toker  <alp@nuanti.com>
+
+        Remove some left-over GTK+ includes. No change in functionality.
+
+        * platform/Cursor.h:
+        * platform/graphics/Icon.h:
+        * platform/gtk/RenderThemeGtk.h:
+
+2008-10-03  Alp Toker  <alp@nuanti.com>
+
+        Build fix for trailing comment after #endif
+
+        * dom/ElementRareData.h:
+
+2008-10-03  David Hyatt  <hyatt@apple.com>
+
+        Remove addToDirtyRegion.
+
+        Reviewed by Oliver Hunt
+
+        * page/Chrome.cpp:
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * platform/ScrollView.h:
+        * platform/gtk/ScrollViewGtk.cpp:
+        * platform/qt/ScrollViewQt.cpp:
+        * platform/win/ScrollViewWin.cpp:
+
+2008-10-03  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        - fix a CachedResource leak introduced in r37176
+
+        Undo r37176 and instead allow pruneDeadResources() to be re-entered, but
+        afterwards bail out of the outer pruneDeadResources().
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::Cache):
+        (WebCore::Cache::pruneDeadResources):
+        (WebCore::Cache::remove):
+        * loader/Cache.h:
+
+2008-10-03  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21330
+
+        Fix Gtk adjustments so that they are properly checked again before creating horizontal/vertical
+        scrollbars.
+
+        Reviewed by Oliver Hunt
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::setHasVerticalScrollbar):
+        (WebCore::ScrollView::platformHasHorizontalAdjustment):
+        (WebCore::ScrollView::platformHasVerticalAdjustment):
+        * platform/ScrollView.h:
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::adjustmentChanged):
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::~ScrollView):
+        (WebCore::ScrollView::setGtkAdjustments):
+        (WebCore::ScrollView::platformHandleHorizontalAdjustment):
+        (WebCore::ScrollView::platformHandleVerticalAdjustment):
+
+2008-10-03  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21106: .in format discussed changes
+        https://bugs.webkit.org/show_bug.cgi?id=21106
+
+        Change "upperCase" to "interfaceName" per-tag parameter as
+        discussed on the mailing list. Removed the per-attribute version
+        as it was not used.
+
+        Also add the "Element" suffix to all interfaceName parameter to match
+        the class name (and thus remove it from make_names.pl).
+
+        * dom/make_names.pl:
+        * html/HTMLTagNames.in:
+        * svg/svgtags.in:
+
+2008-10-03  David Hyatt  <hyatt@apple.com>
+
+        Preserve Qt's disabling of blitting when any native widgets are present anywhere on the page (ick).
+        Hopefully this is a temporary hack that could eventually be removed.
+
+        Reviewed by Sam Weinig
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::rootPreventsBlitting):
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::~ScrollView):
+        (WebCore::ScrollView::platformAddChild):
+        (WebCore::ScrollView::platformRemoveChild):
+
+2008-10-02  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21328
+
+        Make widget invalidation more cross-platform.
+
+        (1) Make invalidateRect a pure virtual function on Widget.  All leaf widgets must now implement this function.
+
+        (2) Scrollbars now send invalidations through the ScrollbarClient.  windowClipRect on ScrollbarClient has been removed and replaced with this invalidation call.
+        This allows all scrollbar invalidations to go through the render tree so that transforms and reflections will be respected.
+
+        (3) Plugins now have the native window invalidation code for windowed plugins.  Windowless plugins do a repaintRectangle on the plugin's renderer.
+
+        (4) FrameViews now do a repaintRectangle on their owner element's renderer.
+
+        Reviewed by Sam Weinig
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::invalidateRect):
+        (WebCore::FrameView::invalidateScrollbarRect):
+        * page/FrameView.h:
+        * platform/PopupMenu.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        * platform/ScrollView.h:
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::setEnabled):
+        (WebCore::Scrollbar::invalidateRect):
+        * platform/Scrollbar.h:
+        * platform/ScrollbarClient.h:
+        * platform/Widget.h:
+        * platform/gtk/WidgetGtk.cpp:
+        * platform/mac/WidgetMac.mm:
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::invalidateScrollbarRect):
+        * platform/win/WidgetWin.cpp:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::invalidateTimerFired):
+        (WebCore::PluginView::invalidateWindowlessPluginRect):
+        * plugins/PluginView.h:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::invalidateRect):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::invalidateRect):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::invalidateRegion):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::invalidateScrollbarRect):
+        * rendering/RenderLayer.h:
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::paintObject):
+        (WebCore::RenderListBox::paintScrollbar):
+        (WebCore::RenderListBox::invalidateScrollbarRect):
+        * rendering/RenderListBox.h:
+
+2008-10-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Geoffrey Garen and Sam Weinig.
+
+        - fix SVGFontFaceElement leaks seen in Acid3
+        - make font-face elements take effect only when they are in the document tree
+
+        Test: svg/custom/font-face-not-in-document.svg
+
+        * svg/SVGFontData.h: Changed the m_svgFontFaceElement member from a
+        RefPtr to a plain pointer to break a ref cycle.
+        (WebCore::SVGFontData::svgFontFaceElement):
+
+        * svg/SVGFontFaceElement.cpp: Changed to insert and remove the
+        @font-face rule from the document's mapped element sheet when the
+        element is inserted and removed from the document, and to update it
+        only when the element is in the document.
+        (WebCore::SVGFontFaceElement::SVGFontFaceElement):
+        (WebCore::SVGFontFaceElement::parseMappedAttribute):
+        (WebCore::SVGFontFaceElement::rebuildFontFace):
+        (WebCore::SVGFontFaceElement::insertedIntoDocument):
+        (WebCore::SVGFontFaceElement::removedFromDocument):
+        (WebCore::SVGFontFaceElement::childrenChanged):
+        (WebCore::SVGFontFaceElement::removeFromMappedElementSheet):
+        * svg/SVGFontFaceElement.h:
+
+2008-10-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Fix RenderFileUploadControl::setStyle() and
+        RenderMenuList::setStyle() to not touch the style; replace
+        with html4.css and CSSStyleSelector changes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21287
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        * css/html4.css:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::setStyle):
+        * rendering/RenderFileUploadControl.cpp:
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::setStyle):
+
+2008-10-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Clean up code that changes the RenderStyle passed in to
+        table renderer setStyle() methods.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21287
+
+        Tests: fast/table/floating-th.html
+               fast/table/table-display-types-strict.html
+               fast/table/table-display-types.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::setStyle):
+        * rendering/RenderTableRow.cpp:
+        (WebCore::RenderTableRow::setStyle):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::setStyle):
+
+2008-10-02  Darin Adler  <darin@apple.com>
+
+        - fix build
+
+        * bindings/scripts/CodeGeneratorJS.pm: Need to replace the -> with a . here too.
+        Not just locally in my generated file!
+
+2008-10-02  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21299
+        REGRESSION: <input> color specified in inline style applies to placeholder
+
+        I recently added a pseudo-class for the placeholder, but that can be overridden by inline style changes.  A pseudo-element
+        is more appropriate.  This change adds "-webkit-input-placeholder".
+
+        * css/CSSSelector.cpp: (WebCore::CSSSelector::extractPseudoType):
+        Added definition for "-webkit-input-placeholder" pseudo element.
+        * css/CSSSelector.h: (WebCore::CSSSelector::): Added PseudoInputPlaceholder.
+        * css/CSSStyleSelector.cpp: (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        Added case for PseudoInputPlaceholder.
+        * css/html4.css: Added rule for -webkit-input-placeholder pseudo-element.
+        * rendering/style/RenderStyle.h: (WebCore::RenderStyle::): Added INPUT_PLACEHOLDER.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setValue): Check that its a text field before calling updatePlaceholderVisibility.
+        (WebCore::HTMLInputElement::setValueFromRenderer): ditto.
+        (WebCore::HTMLInputElement::updatePlaceholderVisibility): Instead of calling setChanged(), call updatePlaceholderVisibility on the renderer.
+        setChanged wouldn't actually trigger setStyle since the style for the input element won't actually change.
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::createInnerTextStyle): Get the pseudoStyle when the placeholder is visible.
+        (WebCore::RenderTextControl::updatePlaceholderVisibility): Sets the style on the inner text block, and calls updateFromElement so
+        the text will be updated correctly.
+        * rendering/RenderTextControl.h:
+
+2008-10-02  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21280
+        <rdar://problem/6227690> There are a bunch of tables on this page that don't seem to be real tables
+
+        Updated AXTable detection to be more robust to false-positives. Specifically, added checks
+        to ensure that there is more than one valid table cell, and that at least half of the cells
+        have borders or have specific background colors. Modified the table detection layout test
+        to test for the tables mentioned in the bug
+
+        * page/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
+
+2008-10-02  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21321
+          Bug 21321: speed up JavaScriptCore by inlining Heap in JSGlobalData
+
+        * bindings/js/GCController.cpp:
+        (WebCore::collect): Use heap. instead of heap-> to work with the heap.
+        (WebCore::GCController::gcTimerFired): Ditto.
+        (WebCore::GCController::garbageCollectNow): Ditto.
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::operator new): Ditto.
+        * storage/Database.cpp:
+        (WebCore::Database::Database): Ditto.
+
+2008-10-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        - fix a Database leak that resulted in Document leaks
+
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase): Account for the fact that RefCounted
+        objects start out with a ref count of 1.
+
+2008-10-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mr. Geoffrey Garen.
+
+        Always mark your parent before marking members.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::mark):
+
+2008-10-02  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21314
+
+        Make scrollBackingStore cross-platform.
+
+        Reviewed by Sam Weinig
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::repaint):
+        (WebCore::EmptyChromeClient::scroll):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::repaint):
+        (WebCore::Chrome::scroll):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleAutoscroll):
+        * platform/HostWindow.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::addPanScrollIcon):
+        (WebCore::ScrollView::removePanScrollIcon):
+        * platform/ScrollView.h:
+        * platform/gtk/ScrollViewGtk.cpp:
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
+        (WebCore::ScrollView::~ScrollView):
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::~ScrollView):
+
+2008-10-02  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes after Frame/ScrollView changes.
+
+        * WebCoreSources.bkl:
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::platformContentsToScreen):
+        (WebCore::ScrollView::platformScreenToContents):
+        (WebCore::ScrollView::platformIsOffscreen):
+
+2008-10-02  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by Sam Weinig
+
+        https://bugs.webkit.org/show_bug.cgi?id=21292
+
+        Revert the changes to enclosingIntRect made in r12530 since the new code
+        doesn't round correctly.
+
+        * ChangeLog:
+        * platform/graphics/FloatRect.cpp:
+        (WebCore::enclosingIntRect):
+
+2008-10-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson and Eric Seidel.
+
+        - fix HTMLCanvaseElement leak from -webkit-canvas() values
+
+        Changed the m_element member of CSSCanvasValue from a RefPtr to a plain
+        pointer, as the document owns the canvas elements. Added code to release
+        those elements in Document::removedLastRef() because they reference
+        the document.
+
+        * css/CSSCanvasValue.cpp:
+        (WebCore::CSSCanvasValue::element):
+        * css/CSSCanvasValue.h:
+        (WebCore::CSSCanvasValue::CSSCanvasValue):
+        * dom/Document.cpp:
+        (WebCore::Document::removedLastRef):
+
+2008-10-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Build fix for platforms that don't implement WTF::ThreadSpecific.
+
+        * bindings/js/JSDOMBinding.cpp: (WebCore::wrapperSet):
+        Guard ThreadSpecific use with #if ENABLE(WORKERS). No platform defines this yet, but this
+        code is only needed for JS bindings in worker threads.
+
+2008-10-01  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21298
+
+        Make updateScrollbars cross-platform.  For now a stubbed out scrollContents function is invoked to do the scrolling of the backing store.  Next patch
+        will make that cross-platform.
+
+        The ScrollView now implements ScrollbarClient, which means that there was a clash of windowClipRect methods from the
+        multiple inheritance.  For now I solved this by adding a Scrollbar* to the ScrollbarClient version of the method, but longer term
+        windowClipRect is going to be removed from ScrollbarClient (when Widget invalidation gets rewritten).
+
+        Reviewed by Sam Weinig
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::windowClipRect):
+        (WebCore::FrameView::isActive):
+        * page/FrameView.h:
+        (WebCore::FrameView::visibleContentsResized):
+        * platform/PopupMenu.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::init):
+        (WebCore::ScrollView::destroy):
+        (WebCore::ScrollView::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::setHasVerticalScrollbar):
+        (WebCore::ScrollView::valueChanged):
+        (WebCore::ScrollView::updateScrollbars):
+        (WebCore::ScrollView::scrollContents):
+        (WebCore::ScrollView::platformHandleHorizontalAdjustment):
+        (WebCore::ScrollView::platformHandleVerticalAdjustment):
+        * platform/ScrollView.h:
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::windowClipRect):
+        * platform/ScrollbarClient.h:
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::platformHandleHorizontalAdjustment):
+        (WebCore::ScrollView::platformHandleVerticalAdjustment):
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::scrollContents):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::windowClipRect):
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::scrollContents):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::windowClipRect):
+        * rendering/RenderLayer.h:
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::panScroll):
+        (WebCore::RenderListBox::windowClipRect):
+        * rendering/RenderListBox.h:
+
+2008-10-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21304
+        Stop using a static wrapper map for WebCore JS bindings
+
+        The static domObjects map was not thread safe.
+
+        * dom/Document.h:
+        (WebCore::Document::messagePorts): Added an accessor for JSDocument to iterate over message
+        ports.
+        (WebCore::Document::xmlHttpRequests): Ditto for XMLHttpRequests.
+
+        * dom/Document.cpp:
+        (WebCore::Document::createdXMLHttpRequest):
+        (WebCore::Document::destroyedXMLHttpRequest):
+        Moved XMLHttpRequest tracking from a global map to Document.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * webcore-base.bkl:
+        * bindings/DOMProtect.cpp: Removed.
+        * bindings/DOMProtect.h: Removed.
+        Removed gcProtect(Unprotect)DOMObject - its callers do not have a JSGlobalData reference,
+        so they can no longer protect bindings objects.
+
+        * dom/MessagePort.cpp:
+        (WebCore::CloseMessagePortTimer::CloseMessagePortTimer):
+        (WebCore::CloseMessagePortTimer::fired):
+        (WebCore::MessagePort::MessagePort):
+        (WebCore::MessagePort::queueCloseEvent):
+        (WebCore::MessagePort::setPendingActivity):
+        (WebCore::MessagePort::unsetPendingActivity):
+        * dom/MessagePort.h:
+        (WebCore::MessagePort::hasPendingActivity):
+        MessagePort now counts outstanding async events, so JSDocument::mark can decide whether
+        to protect it.
+
+        * xml/XMLHttpRequest.h:
+        (WebCore::XMLHttpRequest::hasPendingActivity):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::~XMLHttpRequest):
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
+        (WebCore::XMLHttpRequest::dropProtection):
+        (WebCore::XMLHttpRequest::didFinishLoadingPreflight):
+        (WebCore::XMLHttpRequest::cancelRequests):
+        (WebCore::XMLHttpRequest::detachRequests):
+        (WebCore::XMLHttpRequest::setPendingActivity):
+        (WebCore::XMLHttpRequest::unsetPendingActivity):
+        Moved XMLHttpRequest tracking from a global map to Document.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::wrapperSet):
+        (WebCore::DOMObjectWrapperMap::mapFor):
+        (WebCore::DOMObjectWrapperMap::get):
+        (WebCore::DOMObjectWrapperMap::set):
+        (WebCore::DOMObjectWrapperMap::remove):
+        (WebCore::getCachedDOMObjectWrapper):
+        (WebCore::cacheDOMObjectWrapper):
+        (WebCore::forgetDOMObject):
+        (WebCore::getCachedDOMNodeWrapper):
+        (WebCore::forgetDOMNode):
+        (WebCore::cacheDOMNodeWrapper):
+        (WebCore::markActiveObjectsForDocument):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::createDOMObjectWrapper):
+        (WebCore::getDOMObjectWrapper):
+        Wrapper map is now kept as JSGlobalData::clientData. Also changed debug-only wrapperSet
+        to be per-thread (this is slower than going to JSGlobalData, but fast enough for debug).
+        WebCore objects can never migrate between threads.
+
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::mark):
+        Call markActiveObjectsForDocument() from JSDOMBinding.
+
+        * bindings/js/JSCSSRuleCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::markDOMObjectWrapper):
+        (WebCore::JSDOMWindow::mark):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSEventTarget.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSMessageChannelCustom.cpp:
+        (WebCore::JSMessageChannel::mark):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::mark):
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::mark):
+        * bindings/js/JSSVGPathSegCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::mark):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::mark):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::finishedWithEvent):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        Pass a JSGlobalData reference to functions that track JS wrapper objects.
+
+2008-10-02  Dan Bernstein  <mitz@apple.com>
+
+        - build fix
+
+        * page/JavaScriptCallFrame.idl:
+
+2008-10-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by NOBODY (Build fix).
+
+        Add new file to project files
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+
+2008-10-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Try to fix some more builds.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+
+2008-10-02  Geoffrey Garen  <ggaren@apple.com>
+
+        Not reviewed.
+
+        Try to fix Windows build.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2008-10-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler and Cameron Zwarich.
+
+        Updated for JavaScriptCore API changes: use a SourceCode instead of
+        broken out parameters; treat sourceId as intptr_t.
+
+        * ForwardingHeaders/kjs/SourceRange.h: Copied from ForwardingHeaders/kjs/SourceProvider.h.
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        * bindings/js/StringSourceProvider.h:
+        (WebCore::StringSourceProvider::create):
+        (WebCore::StringSourceProvider::StringSourceProvider):
+
+        (WebCore::makeSource): Added a makeSource function for convenience.
+
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject evaluateWebScript:]):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_Evaluate):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        (JavaJSObject::getMember):
+        (JavaJSObject::setMember):
+        (JavaJSObject::removeMember):
+
+        * bridge/jni/jni_runtime.h:
+        (JSC::Bindings::JavaString::operator UString): Replaced the explicit
+        ustring() function with an implicit operator because this class already
+        holds a UString::rep.
+
+        * page/Console.cpp:
+        (WebCore::retrieveLastCaller):
+        (WebCore::Console::trace):
+        * page/InspectorController.cpp:
+        (WebCore::jsStringRef):
+        (WebCore::InspectorController::addBreakpoint):
+        (WebCore::InspectorController::removeBreakpoint):
+        (WebCore::InspectorController::didParseSource):
+        (WebCore::InspectorController::failedToParseSource):
+        * page/InspectorController.h:
+        * page/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::JavaScriptCallFrame):
+        * page/JavaScriptCallFrame.h:
+        (WebCore::JavaScriptCallFrame::create):
+        (WebCore::JavaScriptCallFrame::sourceIdentifier):
+        (WebCore::JavaScriptCallFrame::update):
+        * page/JavaScriptDebugListener.h:
+        * page/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::addBreakpoint):
+        (WebCore::JavaScriptDebugServer::removeBreakpoint):
+        (WebCore::JavaScriptDebugServer::hasBreakpoint):
+        (WebCore::dispatchDidParseSource):
+        (WebCore::dispatchFailedToParseSource):
+        (WebCore::JavaScriptDebugServer::sourceParsed):
+        (WebCore::JavaScriptDebugServer::callEvent):
+        (WebCore::JavaScriptDebugServer::atStatement):
+        (WebCore::JavaScriptDebugServer::returnEvent):
+        (WebCore::JavaScriptDebugServer::exception):
+        (WebCore::JavaScriptDebugServer::willExecuteProgram):
+        (WebCore::JavaScriptDebugServer::didExecuteProgram):
+        (WebCore::JavaScriptDebugServer::didReachBreakpoint):
+        * page/JavaScriptDebugServer.h:
+        * page/inspector/ScriptsPanel.js: Renamed internal uses of sourceId and
+        sourceIdentifier to sourceID.
+
+2008-10-01  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        - fix SVGFontFaceElement leak seen on svg/custom/acid3-test-77.html
+
+        Broke a ref cycle by changing the m_svgFontFaceElement members of
+        CSSFontFaceSource and CSSFontFaceSrcValue from RefPtrs to plain
+        pointers. Also made sure that the @font-face rule added by
+        SVGFontFaceElement to the document's mapped element sheet is removed
+        when the font-face element is deleted or moved to another document.
+
+        * css/CSSFontFaceSource.cpp:
+        (WebCore::CSSFontFaceSource::CSSFontFaceSource):
+        (WebCore::CSSFontFaceSource::getFontData):
+        * css/CSSFontFaceSource.h:
+        (WebCore::CSSFontFaceSource::svgFontFaceElement):
+        * css/CSSFontFaceSrcValue.h:
+        (WebCore::CSSFontFaceSrcValue::svgFontFaceElement):
+        (WebCore::CSSFontFaceSrcValue::CSSFontFaceSrcValue):
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::~SVGFontFaceElement):
+        (WebCore::SVGFontFaceElement::willMoveToNewOwnerDocument):
+        (WebCore::SVGFontFaceElement::didMoveToNewOwnerDocument):
+        (WebCore::SVGFontFaceElement::removeFromMappedElementSheet):
+        * svg/SVGFontFaceElement.h:
+
+2008-10-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20315: Memory leak with Canvas getImageData
+        <https://bugs.webkit.org/show_bug.cgi?id=20315>
+
+        This wasn't a leak, the issue was that we were reporting the cost
+        of the CanvasPixelArray when creating the JSCanvasPixelArray wrapper
+        and we should have been reporting the cost when we create the
+        JSImageData wrapper.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasPixelArrayCustom.cpp: Removed.
+          This was only needed to report the extra memory cost
+          of the CPA.
+        * bindings/js/JSImageDataCustom.cpp:
+        (WebCore::toJS):
+          We need a custom toJS function now so that we can report
+          the extra memory cost.
+        * bindings/scripts/CodeGeneratorJS.pm:
+          Need to replace the reference to CanvasPixelArray with ImageData
+          to be able to create the custom toJS implementation.
+        * html/CanvasPixelArray.idl:
+        * html/ImageData.idl:
+
+2008-10-01  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21293
+          REGRESSION: Crash beneath RenderSVGViewportContainer::viewportTransform() during SVGSVGElement destruction
+
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::~SVGMarkerElement): Call detach() here so
+        that renderer destruction happens before the SVGMarkerElement is
+        destroyed.
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::~SVGSVGElement): Ditto for SVGSVGElement.
+
+2008-10-01  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20669
+
+        * css/makeprop.pl:
+        Die if gperf fails.
+
+2008-10-01  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        * loader/icon/IconDatabase.h:
+        IconDatabase uses HashMap, so it needs to #include the header.
+
+2008-10-01  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix an assertion failure in http/tests/security/canvas-remote-read-svg-image.html due to re-entry into Cache::pruneDeadResources()
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::remove): Disable pruning temporarily during
+        CachedResource deletion.
+
+2008-10-01  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix SVGFontElement leaks seen on buildbot by breaking a ref cycle
+
+        * svg/SVGFontFaceElement.cpp:
+        (WebCore::SVGFontFaceElement::rebuildFontFace):
+        * svg/SVGFontFaceElement.h:
+        (WebCore::SVGFontFaceElement::associatedFontElement):
+
+2008-10-01  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Document the rounding behavior of the mapRect(IntRect) function in
+        AffineTransform.h.
+
+        * platform/graphics/AffineTransform.h:
+
+2008-10-01  David Hyatt  <hyatt@apple.com>
+
+        Move prohibitsScrolling from the Frame to the ScrollView.
+
+        Reviewed by Sam Weinig
+
+        * WebCore.base.exp:
+        * page/Frame.cpp:
+        (WebCore::FramePrivate::FramePrivate):
+        * page/Frame.h:
+        * page/FramePrivate.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollRectIntoViewRecursively):
+        (WebCore::FrameView::setScrollPosition):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::init):
+        (WebCore::ScrollView::scrollRectIntoViewRecursively):
+        (WebCore::ScrollView::setScrollPosition):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::setProhibitsScrolling):
+        (WebCore::ScrollView::prohibitsScrolling):
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+2008-10-01  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Fix leaks seen during http/tests/xmlhttprequest/access-control-basic-non-simple-allow.html.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::didFinishLoadingPreflight): Balance the ref and GC protect
+        that we do during the loadRequestAsynchronously of the preflight request with a deref and
+        GC unprotect.
+
+2008-10-01  David Hyatt  <hyatt@apple.com>
+
+        Rename allowsScrolling/setAllowsScrolling to canHaveScrollbars/setCanHaveScrollbars to make it more
+        clear that the boolean doesn't actually stop all scrolling.  It just gets rid of scrollbars.
+
+        Reviewed by Tim Hatcher
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setCanHaveScrollbars):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setCanHaveScrollbars):
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::canHaveScrollbars):
+
+2008-10-01  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix some CachedResource leaks seen on buildbot
+
+        The issue here was that emptying the cache was a no-op when it only
+        contained resources with no data. Changed to go after those
+        resources when the desired cache capacity is zero.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::pruneLiveResources):
+        (WebCore::Cache::pruneDeadResources):
+        * loader/Cache.h:
+        (WebCore::Cache::prune):
+
+2008-10-01  David Hyatt  <hyatt@apple.com>
+
+        Make isOffscreen cross-platform.  Only Mac implements this method, so hold off on adding API to the
+        HostWindow object until other platforms decide they want this method.  (We need it for Win though at some point.)
+
+        Reviewed by Adam Roben
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::isOffscreen):
+        (WebCore::ScrollView::platformIsOffscreen):
+        * platform/ScrollView.h:
+        * platform/gtk/ScrollViewGtk.cpp:
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::platformIsOffscreen):
+        * platform/qt/ScrollViewQt.cpp:
+        * platform/wx/ScrollViewWx.cpp:
+
+2008-10-01  David Hyatt  <hyatt@apple.com>
+
+        Make show/hide/setParentVisible cross-platform on ScrollView.
+
+        Reviewed by Adam Roben
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setParentVisible):
+        (WebCore::ScrollView::show):
+        (WebCore::ScrollView::hide):
+        * platform/ScrollView.h:
+        * platform/win/ScrollViewWin.cpp:
+
+2008-10-01  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21284
+        Bug 21284: Max height affects max width
+        - Looks like a cut and paste bug
+        - Added layout test fast/css/max-height-and-max-width.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+2008-10-01  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21282
+
+        Make contentsToScreen/screenToContents cross-platform.  Only implemented by Mac/Win right now.
+
+        Reviewed by Adam Roben
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::screenToWindow):
+        (WebCore::EmptyChromeClient::windowToScreen):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::screenToWindow):
+        (WebCore::Chrome::windowToScreen):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * platform/HostWindow.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::contentsToScreen):
+        (WebCore::ScrollView::screenToContents):
+        (WebCore::ScrollView::platformContentsToScreen):
+        (WebCore::ScrollView::platformScreenToContents):
+        * platform/ScrollView.h:
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::platformContentsToScreen):
+        (WebCore::ScrollView::platformScreenToContents):
+        * platform/win/ScrollViewWin.cpp:
+
+2008-10-01  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6255862> domfuzz: null deref in WebCore::HTMLParser::handleResidualStyleCloseTagAcrossBlocks(WebCore::HTMLStackElem*)
+
+        Test: fast/parser/residual-style-close-across-removed-block.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleResidualStyleCloseTagAcrossBlocks): Removed
+        an assertion that turned out to be wrong in this case, and changed to
+        terminate the algorithm at the first empty block.
+
+2008-10-01  David Hyatt  <hyatt@apple.com>
+
+        Make setFrameRect on ScrollView cross-platform.
+
+        Reviewed by Sam Weinig
+
+        * page/FrameView.h:
+        (WebCore::FrameView::contentsResized):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setFrameRect):
+        * platform/ScrollView.h:
+        * platform/gtk/ScrollViewGtk.cpp:
+        * platform/qt/ScrollViewQt.cpp:
+        * platform/win/ScrollViewWin.cpp:
+
+2008-10-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        Move setTimeout, clearTimeout, setInterval, clearInterval, atob and btoa
+        to JSDOMWindow from JSDOMWindowBase.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::removeTimeout):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::setTimeoutOrInterval):
+        (WebCore::JSDOMWindow::setTimeout):
+        (WebCore::JSDOMWindow::clearTimeout):
+        (WebCore::JSDOMWindow::setInterval):
+        (WebCore::JSDOMWindow::clearInterval):
+        (WebCore::JSDOMWindow::atob):
+        (WebCore::JSDOMWindow::btoa):
+        * page/DOMWindow.idl:
+
+2008-10-01  Dan Bernstein  <mitz@apple.com>
+
+        - Mac build fix
+
+        * WebCore.base.exp:
+
+2008-10-01  Timothy Hatcher  <timothy@apple.com>
+
+        Prevent stealing focus from the search field when focusing a DOM node.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21275
+
+        Reviewed by Kevin McCullough.
+
+        * page/inspector/ElementsPanel.js:
+        (WebInspector.ElementsPanel.treeOutline.focusedNodeChanged):
+        Don't steal focus if the current focus element is the search field.
+
+2008-09-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Nikolas Zimmermann and Alexey Proskuryakov.
+
+        Final patch for https://bugs.webkit.org/show_bug.cgi?id=21122
+        Autogenerate JS event listeners
+
+        - Generate getting/setting of EventListeners.
+
+        - Adding a new named EventListener now has the same process as adding any other DOM
+          attribute. (Add a method with the same name in the c++ file).
+
+        (The EventListeners for MessagePort have been intentionally left custom so that we
+        can continue to experiment with making those EventListeners work in a frame-less world.)
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp: Remove custom methods.
+        * bindings/js/JSDOMWindowCustom.cpp: ditto.
+        * bindings/js/JSEventTargetNodeCustom.cpp: ditto.
+        * bindings/js/JSXMLHttpRequestCustom.cpp: ditto.
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp: ditto.
+        * bindings/scripts/CodeGeneratorJS.pm: Add code to generate EventListener
+        getter/setters
+        * dom/EventTargetNode.cpp: Add getter/setters for named EventListener.
+        * dom/EventTargetNode.h: ditto.
+        * dom/EventTargetNode.idl: Mark EventListeners as Protected so that the codegenerator
+        will use JSEventListerner instead of JSUnprotectedEventListener.
+        * loader/appcache/DOMApplicationCache.idl: Remove custom attributes..
+        * page/DOMWindow.cpp: Add getter/setters for named EventListener
+        * page/DOMWindow.h: ditto.
+        * page/DOMWindow.idl: Mark EventListeners as Protected so that the codegenerator
+        will use JSEventListerner instead of JSUnprotectedEventListener.
+        * xml/XMLHttpRequest.idl: Remove custom attributes.
+        * xml/XMLHttpRequestUpload.idl: ditto.
+
+2008-09-30  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Add a leak counter for CachedResources since we've had two recent leaks involving them.
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::CachedResource):
+        (WebCore::CachedResource::~CachedResource):
+
+2008-09-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=21127
+          <rdar://problem/6259134> REGRESSION: CFF format fonts fail to load
+
+        If TTLoadEmbeddedFont fails, use AddFontMemResourceEx after changing
+        the font name in memory.
+
+        * WebCore.vcproj/WebCore.vcproj: Renamed GetEOTHeader.* to
+        OpenTypeUtilities.*.
+
+        * platform/graphics/win/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::~FontCustomPlatformData): Added a call
+        to RemoveFontMemResourceEx to match AddFontMemResourceEx when it is
+        used.
+        (WebCore::FontCustomPlatformData::fontPlatformData): Added a code path
+        for fonts loaded using AddFontMemResourceEx.
+        (WebCore::createFontCustomPlatformData): Added a call to
+        renameAndActivateFont() if TTLoadEmbeddedFont fails. If
+        TTLoadEmbeddedFont succeeds, set the font name to the null string, as
+        fontPlatformData() will retrieve the name from the font reference.
+
+        * platform/graphics/win/FontCustomPlatformData.h:
+        (WebCore::FontCustomPlatformData::FontCustomPlatformData): Added a
+        font name member.
+
+        * platform/graphics/win/GetEOTHeader.cpp: Renamed.
+        * platform/graphics/win/GetEOTHeader.h: Renamed.
+
+        * platform/graphics/win/OpenTypeUtilities.cpp: Copied from platform/graphics/win/GetEOTHeader.cpp.
+        (WebCore::BigEndianUShort::BigEndianUShort): Added a constructor.
+        (WebCore::BigEndianULong::BigEndianULong): Ditto.
+        (WebCore::renameAndActivateFont): Added. Creates an in-memory copy of
+        the font data and modifies it to have the given name, then activates
+        it using AddFontMemResourceEx.
+
+        * platform/graphics/win/OpenTypeUtilities.h: Copied from platform/graphics/win/GetEOTHeader.h.
+
+2008-09-30  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix many leaks seen on fast/backgrounds/svg-as-mask.html.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::arenaDelete): Balance the calls to addClient on maskLayer's images
+        with calls to removeClient when we're being destroyed.
+
+2008-09-30  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21243
+
+        Fix loopstart and loopend default values.
+
+        Tests: media/loopend-limits.html
+               media/loopstart-limits.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::loopStart): the spec says start() is the default value
+        (WebCore::HTMLMediaElement::loopEnd): the spec says end() is the default value
+
+2008-09-30  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes. Add file to build and remove call to (now gone) ScrollView::update.
+
+        * WebCoreSources.bkl:
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::OnScrollWinEvents):
+
+2008-09-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix HTMLViewSourceDocument leaks by breaking a ref cycle which
+          was fixed in r17249 and re-introduced in r31435.
+
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::HTMLViewSourceDocument):
+        (WebCore::HTMLViewSourceDocument::addSpanWithClassName):
+        (WebCore::HTMLViewSourceDocument::addLine):
+        (WebCore::HTMLViewSourceDocument::addLink):
+        * html/HTMLViewSourceDocument.h:
+
+2008-09-30  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        More for https://bugs.webkit.org/show_bug.cgi?id=21122
+        Autogenerate JS event listeners
+
+        - Make EventListener getter/setters names in c++ files match those in
+          JS (ie. onLoadListener -> onload).
+        - Add standard way to access the frame associated with the EventTarget
+          for EventListener lookup.
+        - Autogenerate dispatchEvent, it wasn't doing anything custom.
+
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::mark):
+        (WebCore::JSDOMApplicationCache::addEventListener):
+        (WebCore::JSDOMApplicationCache::removeEventListener):
+        (WebCore::JSDOMApplicationCache::setOnchecking):
+        (WebCore::JSDOMApplicationCache::onchecking):
+        (WebCore::JSDOMApplicationCache::setOnerror):
+        (WebCore::JSDOMApplicationCache::onerror):
+        (WebCore::JSDOMApplicationCache::setOnnoupdate):
+        (WebCore::JSDOMApplicationCache::onnoupdate):
+        (WebCore::JSDOMApplicationCache::setOndownloading):
+        (WebCore::JSDOMApplicationCache::ondownloading):
+        (WebCore::JSDOMApplicationCache::setOnprogress):
+        (WebCore::JSDOMApplicationCache::onprogress):
+        (WebCore::JSDOMApplicationCache::setOnupdateready):
+        (WebCore::JSDOMApplicationCache::onupdateready):
+        (WebCore::JSDOMApplicationCache::setOncached):
+        (WebCore::JSDOMApplicationCache::oncached):
+        * bindings/js/JSEventTargetNodeCustom.cpp:
+        (WebCore::JSEventTargetNode::addEventListener):
+        (WebCore::JSEventTargetNode::removeEventListener):
+        (WebCore::JSEventTargetNode::getListener):
+        (WebCore::JSEventTargetNode::setListener):
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::mark):
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        (WebCore::JSMessagePort::setOnmessage):
+        (WebCore::JSMessagePort::onmessage):
+        (WebCore::JSMessagePort::setOnclose):
+        (WebCore::JSMessagePort::onclose):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::mark):
+        (WebCore::JSXMLHttpRequest::onreadystatechange):
+        (WebCore::JSXMLHttpRequest::setOnreadystatechange):
+        (WebCore::JSXMLHttpRequest::onabort):
+        (WebCore::JSXMLHttpRequest::setOnabort):
+        (WebCore::JSXMLHttpRequest::onerror):
+        (WebCore::JSXMLHttpRequest::setOnerror):
+        (WebCore::JSXMLHttpRequest::onload):
+        (WebCore::JSXMLHttpRequest::setOnload):
+        (WebCore::JSXMLHttpRequest::onloadstart):
+        (WebCore::JSXMLHttpRequest::setOnloadstart):
+        (WebCore::JSXMLHttpRequest::onprogress):
+        (WebCore::JSXMLHttpRequest::setOnprogress):
+        (WebCore::JSXMLHttpRequest::addEventListener):
+        (WebCore::JSXMLHttpRequest::removeEventListener):
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::mark):
+        (WebCore::JSXMLHttpRequestUpload::onabort):
+        (WebCore::JSXMLHttpRequestUpload::setOnabort):
+        (WebCore::JSXMLHttpRequestUpload::onerror):
+        (WebCore::JSXMLHttpRequestUpload::setOnerror):
+        (WebCore::JSXMLHttpRequestUpload::onload):
+        (WebCore::JSXMLHttpRequestUpload::setOnload):
+        (WebCore::JSXMLHttpRequestUpload::onloadstart):
+        (WebCore::JSXMLHttpRequestUpload::setOnloadstart):
+        (WebCore::JSXMLHttpRequestUpload::onprogress):
+        (WebCore::JSXMLHttpRequestUpload::setOnprogress):
+        (WebCore::JSXMLHttpRequestUpload::addEventListener):
+        (WebCore::JSXMLHttpRequestUpload::removeEventListener):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventTarget.h:
+        * dom/EventTargetNode.cpp:
+        (WebCore::EventTargetNode::associatedFrame):
+        * dom/EventTargetNode.h:
+        * dom/EventTargetNode.idl:
+        * dom/MessagePort.cpp:
+        (WebCore::MessagePort::associatedFrame):
+        * dom/MessagePort.h:
+        (WebCore::MessagePort::setOnmessage):
+        (WebCore::MessagePort::onmessage):
+        (WebCore::MessagePort::setOnclose):
+        (WebCore::MessagePort::onclose):
+        * dom/MessagePort.idl:
+        * loader/appcache/DOMApplicationCache.h:
+        (WebCore::DOMApplicationCache::setOnchecking):
+        (WebCore::DOMApplicationCache::onchecking):
+        (WebCore::DOMApplicationCache::setOnerror):
+        (WebCore::DOMApplicationCache::onerror):
+        (WebCore::DOMApplicationCache::setOnnoupdate):
+        (WebCore::DOMApplicationCache::onnoupdate):
+        (WebCore::DOMApplicationCache::setOndownloading):
+        (WebCore::DOMApplicationCache::ondownloading):
+        (WebCore::DOMApplicationCache::setOnprogress):
+        (WebCore::DOMApplicationCache::onprogress):
+        (WebCore::DOMApplicationCache::setOnupdateready):
+        (WebCore::DOMApplicationCache::onupdateready):
+        (WebCore::DOMApplicationCache::setOncached):
+        (WebCore::DOMApplicationCache::oncached):
+        (WebCore::DOMApplicationCache::associatedFrame):
+        * loader/appcache/DOMApplicationCache.idl:
+        * svg/EventTargetSVGElementInstance.cpp:
+        (WebCore::EventTargetSVGElementInstance::associatedFrame):
+        (WebCore::EventTargetSVGElementInstance::addEventListener):
+        (WebCore::EventTargetSVGElementInstance::removeEventListener):
+        (WebCore::EventTargetSVGElementInstance::dispatchEvent):
+        * svg/EventTargetSVGElementInstance.h:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::associatedFrame):
+        * xml/XMLHttpRequest.h:
+        (WebCore::XMLHttpRequest::setOnreadystatechange):
+        (WebCore::XMLHttpRequest::onreadystatechange):
+        (WebCore::XMLHttpRequest::setOnabort):
+        (WebCore::XMLHttpRequest::onabort):
+        (WebCore::XMLHttpRequest::setOnerror):
+        (WebCore::XMLHttpRequest::onerror):
+        (WebCore::XMLHttpRequest::setOnload):
+        (WebCore::XMLHttpRequest::onload):
+        (WebCore::XMLHttpRequest::setOnloadstart):
+        (WebCore::XMLHttpRequest::onloadstart):
+        (WebCore::XMLHttpRequest::setOnprogress):
+        (WebCore::XMLHttpRequest::onprogress):
+        * xml/XMLHttpRequest.idl:
+        * xml/XMLHttpRequestUpload.cpp:
+        (WebCore::XMLHttpRequestUpload::associatedFrame):
+        * xml/XMLHttpRequestUpload.h:
+        (WebCore::XMLHttpRequestUpload::setOnabort):
+        (WebCore::XMLHttpRequestUpload::onabort):
+        (WebCore::XMLHttpRequestUpload::setOnerror):
+        (WebCore::XMLHttpRequestUpload::onerror):
+        (WebCore::XMLHttpRequestUpload::setOnload):
+        (WebCore::XMLHttpRequestUpload::onload):
+        (WebCore::XMLHttpRequestUpload::setOnloadstart):
+        (WebCore::XMLHttpRequestUpload::onloadstart):
+        (WebCore::XMLHttpRequestUpload::setOnprogress):
+        (WebCore::XMLHttpRequestUpload::onprogress):
+        * xml/XMLHttpRequestUpload.idl:
+
+2008-09-30  Darin Adler  <darin@apple.com>
+
+        - roll out assertion breaking regression tests
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::repaintContentRectangle): Temporarily remove assertion
+        that fires in regression tests. Hyatt can add it back later. The assertion
+        fires in the regression test because of layout that triggers repaint occuring
+        during the process of removing a frame.
+
+2008-09-30  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21227
+        <rdar://problem/6222134> add a way to set color for input placeholder text
+
+        Test: fast/forms/placeholder-pseudo-style.html
+
+        This change adds "-webkit-input-placeholder-mode" as a pseudo class that can be used to style
+        input elements when they are displaying the placeholder text.
+
+        * css/CSSSelector.cpp: (WebCore::CSSSelector::extractPseudoType): Add case for inputPlaceholderMode.
+        * css/CSSSelector.h: (WebCore::CSSSelector::): Add PseudoInputPlaceholderMode.
+        * css/CSSStyleSelector.cpp: (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector):
+        Add check for PseudoInputPlaceholderMode that asks the node if placeholderShouldBeVisible is true.
+        * css/html4.css: Add rule to make placeholder text default to darkGray.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::init): Initialize m_placeholderShouldBeVisible.
+        (WebCore::HTMLInputElement::dispatchFocusEvent): Call updatePlaceholderVisibility.
+        (WebCore::HTMLInputElement::dispatchBlurEvent): ditto.
+        (WebCore::HTMLInputElement::parseMappedAttribute): ditto.
+        (WebCore::HTMLInputElement::setValue): ditto.
+        (WebCore::HTMLInputElement::setValueFromRenderer): ditto.
+        (WebCore::HTMLInputElement::updatePlaceholderVisibility): Sets m_placeholderShouldBeVisible based on the current value and the focus state.
+         This calculation used to be done in the renderer, but since the node knows everything about the state, it can make that decision, and the
+         renderer will just ask the node if it should draw the placeholder.
+        * html/HTMLInputElement.h: (WebCore::HTMLInputElement::placeholderShouldBeVisible):
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::disabledTextColor): Moved to the top of the file.  If there's not very much contrast between the disabled color and the background color,
+        just leave the text color alone.  We don't want to change a good contrast color scheme so that it has really bad contrast.
+        If the the contrast was already poor, then it doesn't do any good to change it to a different poor contrast color scheme.
+        (WebCore::RenderTextControl::createInnerTextStyle): If the node says the placeholder should be visible, prepare by overriding the text security to be "none".
+        This can only happen as a result of either a setStyle call (which will be followed by a call to updateFromElement) or from createSubtreeIfNeeded, which
+        is called directly from updateFromElement.  updateFromElement will immediately update the text displayed.
+        (WebCore::RenderTextControl::updateFromElement): If the placeholder visibility has changed, update the text that is displayed.
+        (WebCore::RenderTextControl::forwardEvent): Remove calls to update the placeholder state.  This is now done in HTMLInputElement.
+        * rendering/RenderTextControl.h:
+
+2008-09-30  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=20396 Abort caused
+        by failed allocation due to invalid counter/attr
+        and corresponding: <rdar://problem/6152371>
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseCounterContent): The spec indicates that
+        only identifiers should be accepted here.
+
+2008-09-30  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 21255: console.profileEnd() without a console.profile() crashes the
+        web inspector
+
+        * page/Console.cpp:
+        (WebCore::Console::profileEnd):
+
+2008-09-30  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Bug 21252: calling console.profile() with a title that is 2 chars or
+        shorter does not linkify it
+
+        - Previously we tried to not linkify very short URLs but since profile
+        titles can be any length this is not always true.
+
+        * page/inspector/inspector.js:
+
+2008-09-30  Dave Hyatt  <hyatt@apple.com>
+
+        Remove the update() method on ScrollView.  This method was only called in one place, and its purpose
+        was to cause a display/flush to happen.  Here is a breakdown of the method use on each platform:
+        (1) Not used on Mac
+        (2) Used on Windows
+        (3) Used on Qt, but implemented incorrectly to cause a full repaint for no reason.
+        (4) Used on Gtk, but implemented incorrectly to cause a full repaint for no reason.
+        (5) Used on wx, but probably not needed (since wx has platform widgets like Mac).
+
+        There is now a paint method on HostWindow that does an immediate mode repaint of an empty rect to
+        cause the display/flush to happen if needed (thus saving an extra method on ChromeClient).
+        With the changes to this method, the new behavior is as follows:
+        (1) Not used on Mac
+        (2) Used on Windows
+        (3) Nothing happens on Qt, but only because they have not implemented immediate mode updating.
+        (4) Gtk now behaves like Windows and will process updates but not do any incorrect additional invalidation.
+        (5) Not used on wx
+
+        This method was originally added for Windows. It's not clear the display/flush is really even necessary on the other
+        platforms.  At the very least stopping unnecessary full invalidations on Qt/Gtk is a good thing. :)
+
+        Reviewed by Sam Weinig
+
+        * ChangeLog:
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        * platform/HostWindow.h:
+        (WebCore::HostWindow::paint):
+        * platform/ScrollView.h:
+        * platform/gtk/ScrollViewGtk.cpp:
+        * platform/mac/ScrollViewMac.mm:
+        * platform/qt/ScrollViewQt.cpp:
+        * platform/win/ScrollViewWin.cpp:
+        * platform/wx/ScrollViewWx.cpp:
+
+2008-09-30  Timothy Hatcher  <timothy@apple.com>
+
+        Focus the DOM tree in the Web Inspector when a node is inspected.
+        So when the search field has focus, the focus moves to the tree,
+        allowing the arrow keys work. This can happen when using the new
+        find in page feature.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21251
+
+        Reviewed by Geoff Garen.
+
+        * page/inspector/ElementsPanel.js:
+        (WebInspector.ElementsPanel): Set currentFocusElement to
+        the main-panels element if the panel is visible.
+        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
+        Remove a set of currentFocusElement since this moved.
+        * page/inspector/inspector.js:
+        (WebInspector.set currentFocusElement): Always focus the element.
+        This ensures that when focus changes in the page and we don't
+        catch it, we will still focus the elements even if we think it
+        was already focused.
+
+2008-09-30  Timothy Hatcher  <timothy@apple.com>
+
+        Make the Web Inspector's toolbar icons darker when the mouse is
+        pressed on them. This matches the standard NSToolbar look.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21249
+        rdar://problem/6033752
+
+        Reviewed by Adam Roben.
+
+        * page/inspector/Images/databasesIcon.png:
+        * page/inspector/Images/elementsIcon.png:
+        * page/inspector/Images/profilesIcon.png:
+        * page/inspector/Images/resourcesIcon.png:
+        * page/inspector/Images/scriptsIcon.png:
+        * page/inspector/Panel.js:
+        * page/inspector/inspector.css:
+
+2008-09-30  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Bug 21139: Profiler log message is wrong
+        - Correctly fix =(
+        Don't call _format twice.
+
+        * page/Page.h:
+        * page/inspector/Console.js:
+        * page/inspector/ProfilesPanel.js:
+        * page/inspector/inspector.js:
+
+2008-09-30  Dave Hyatt  <hyatt@apple.com>
+
+        http://bugs.webkit.org/show_bug.cgi?id=21250
+
+        Rename updateContents to repaintContentRectangle and make it cross-platform by always sending
+        repaints up through the ChromeClient.
+
+        Reviewed by Darin Adler
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyChromeClient::repaint):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::repaint):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::hostWindow):
+        (WebCore::FrameView::repaintContentRectangle):
+        * page/FrameView.h:
+        * platform/HostWindow.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::repaintContentRectangle):
+        (WebCore::ScrollView::platformRepaintContentRectangle):
+        * platform/ScrollView.h:
+        * platform/gtk/ScrollViewGtk.cpp:
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::platformRepaintContentRectangle):
+        * platform/qt/ScrollViewQt.cpp:
+        * platform/win/ScrollViewWin.cpp:
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::platformRepaintContentRectangle):
+
+2008-09-30  Alexey Proskuryakov  <ap@webkit.org>
+
+        Non-Mac build fixes.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCoreSources.bkl:
+        * webcore-base.bkl:
+        Added DOMProtect.{cpp,h}.
+
+2008-09-39  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by John Sullivan.
+
+        * bridge/npapi.h: Added skeleton for a new plug-in drawing model, the NPCoreAnimationDrawingModel. This model will eventually pave the way
+        for hardware accelerated drawing in plug-ins and out of process plug-in rendering.
+
+2008-09-29  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21106: .in format discussed changes
+        https://bugs.webkit.org/show_bug.cgi?id=21106
+
+        - Removed "cppNamespace" global parameter and hard-coded "WebCore" as it
+        is the only namespace used.
+
+        - Removed "generateFactory" and "generateWrapperFactory" parameters and
+        re-introduced the command line options.
+
+        - Cleaned up the output of make_names.pl (removed unneeded new line).
+
+        * DerivedSources.make: Added factories command line options.
+        * GNUmakefile.am: Ditto.
+        * WebCore.pro: Ditto and removed some arguments that were migrated to
+        the .in files.
+
+        * dom/make_names.pl: Clean up (see above).
+
+        * html/HTMLAttributeNames.in: Removed "cppNamespace", "generateFactory"
+        and "generateWrapperFactory" occurences.
+        * html/HTMLTagNames.in: Ditto.
+        * svg/svgattrs.in: Ditto.
+        * svg/svgtags.in: Ditto.
+        * svg/xlinkattrs.in: Ditto.
+        * xml/xmlattrs.in: Ditto.
+
+2008-09-29  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by John Sullivan.
+
+        <rdar://problem/6255456> AX: <file> input button shouldn't have children exposed
+        Make sure that certain types of elements do not return children and, moreover, do not waste their
+        energy trying to return children
+
+        Test: accessibility/nochildren-elements.html
+
+        * page/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::canHaveChildren):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::canHaveChildren):
+        (WebCore::AccessibilityRenderObject::addChildren):
+        * page/AccessibilityRenderObject.h:
+
+2008-09-30  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21213
+        MessagePort crash when GC collects an object with a pending close event
+
+        Test: fast/events/message-channel-gc-2.html
+              fast/events/message-channel-listener-circular-ownership.html
+
+        * bindings/DOMProtect.cpp: Added.
+        (WebCore::gcProtectDOMObject):
+        (WebCore::gcUnprotectDOMObject):
+        * bindings/DOMProtect.h: Added.
+        Added an abstraction for GC protection to avoid the need to call JS bindings code from
+        DOM objects directly.
+
+        * dom/MessagePort.cpp:
+        (WebCore::CloseMessagePortTimer::fired):
+        (WebCore::MessagePort::queueCloseEvent):
+        GC protect MessagePort wrapper while there is a pending close event.
+        This may be necessary for message events, too, but that case is not a crasher, and actually
+        behaves to the letter of the current HTML5 text, so I'll consider it later.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
+        (WebCore::XMLHttpRequest::dropProtection):
+        Use gcProtectDOMObject here, too. Unfortunately, XMLHttpRequest has more dependencies on JSC.
+
+        * bindings/js/JSMessagePortCustom.cpp:
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        (WebCore::JSMessagePort::setOnmessage):
+        (WebCore::JSMessagePort::setOnclose):
+        Don't tell DOMWindowBase that MessagePort is a NodeEventTarget, this is not true. I do not
+        know if this was causing any real issues, but we shouldn't lie to DOMWindowBase.
+
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::mark):
+        While at it, changed to use a typedef for event listeners from XMLHttpRequestUpload, not
+        from XMLHttpRequest.
+
+2008-09-30  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * DerivedSources.cpp: Add JSEventTargetNode.cpp.
+
+2008-09-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Tim Hatcher.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=21122
+        Autogenerate JS event listeners
+
+        - Generate EventTargetNode.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSEventListener.cpp:
+        * bindings/js/JSEventTarget.cpp: Added.
+        (WebCore::toJS):
+        * bindings/js/JSEventTarget.h: Added.
+        * bindings/js/JSEventTargetBase.cpp: Removed.
+        * bindings/js/JSEventTargetBase.h:
+        * bindings/js/JSEventTargetNode.cpp: Removed.
+        * bindings/js/JSEventTargetNode.h: Removed.
+        * bindings/js/JSEventTargetNodeCustom.cpp: Added.
+        (WebCore::JSEventTargetNode::addEventListener):
+        (WebCore::JSEventTargetNode::removeEventListener):
+        (WebCore::JSEventTargetNode::dispatchEvent):
+        (WebCore::JSEventTargetNode::getListener):
+        (WebCore::JSEventTargetNode::setListener):
+        (WebCore::JSEventTargetNode::pushEventHandlerScope):
+        * bindings/js/JSEventTargetSVGElementInstance.cpp:
+        (WebCore::):
+        (WebCore::JSEventTargetSVGElementInstancePrototype::self):
+        (WebCore::JSEventTargetSVGElementInstancePrototype::getOwnPropertySlot):
+        (jsEventTargetAddEventListener):
+        (jsEventTargetRemoveEventListener):
+        (jsEventTargetDispatchEvent):
+        * bindings/js/JSEventTargetSVGElementInstance.h:
+        (WebCore::JSEventTargetSVGElementInstancePrototype::JSEventTargetSVGElementInstancePrototype):
+        (WebCore::JSEventTargetSVGElementInstancePrototype::classInfo):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/EventTargetNode.idl: Added.
+
+2008-09-29  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21214
+          work on getting rid of ExecState
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase): Removed globalThisValue argument
+        for base class constructor.
+
+2008-09-29  David Hyatt  <hyatt@apple.com>
+
+        Add the new HostWindow base class.  A HostWindow hosts a hierarchy of Widgets.  The Chrome object on Page
+        now subclasses from HostWindow.  The new class will allow objects in platform/ like Widgets, Scrollbars
+        and ScrollViews to talk to the HostWindow object in order to do backing store operations and invalidations.
+        (Right now the platform layering is simply being violated by ScrollViews going directly to the ChromeClient.)
+
+        Reviewed by Sam Weinig
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/Chrome.h:
+        * platform/HostWindow.h: Added.
+        (WebCore::HostWindow::HostWindow):
+        (WebCore::HostWindow::~HostWindow):
+
+2008-09-29  Kevin Decker  <kdecker@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        * bridge/npapi.h: Tweaked NPNVariable enum. NPNVsupportsCocoaBool,  NPNVsupportsCarbonBool are now in the 3000 range instead of
+        2000.
+
+2008-09-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adam Roben.
+
+        - WebCore part of fixing <rdar://problem/6247906> REGRESSION (r19500): Crash on quit beneath CloseThemeData
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::setWebKitIsBeingUnloaded): Added.
+        (WebCore::RenderThemeWin::~RenderThemeWin): Check if WebKit is being
+        unloaded, to avoid calling uxtheme.dll functions after that library has
+        been unloaded.
+        * rendering/RenderThemeWin.h:
+
+2008-09-29  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by John Sullivan
+
+        <rdar://problem/6240743> AXLoadComplete is sent for non-top level web areas and bogus web areas
+
+        Sends AXLoadComplete only when the top level web area is finished loading
+
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+
+2008-09-29  Timothy Hatcher  <timothy@apple.com>
+
+        Makes the node highlight always show up when hovering a node in
+        the Web Inspector now that the highlight does not scroll to reveal
+        the node. Also adds a hover effect in the inspector when hovering
+        causes a highlight in the page. This ties the user hovering action
+        to the highlight so it is clear what causes the highlight to appear.
+
+        Also the highlight now temporarily shows up for 2 seconds after
+        selecting a node in the DOM tree. So arrowing around in the tree
+        will show the node on the page, providing feedback to the user.
+
+        Plus fixes an issue where quickly moving away from hovering
+        a node would keep showing the page highlight. This was happening
+        in breadcrumbs and the DOM tree.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21220
+
+        Reviewed by Kevin McCullough.
+
+        * page/inspector/Console.js:
+        (WebInspector.Console.prototype._mouseOverNode): Added. Used for
+        hovering DOM nodes in the console.
+        (WebInspector.Console.prototype._mouseOutOfNode): Ditto.
+        (WebInspector.Console.prototype._formatnode): Use the new event
+        listeners and add a class name to the anchor element.
+        * page/inspector/ElementsPanel.js:
+        (WebInspector.ElementsPanel): Add new event listeners to the
+        crumbs element to do the node hovering highlight.
+        (WebInspector.ElementsPanel.prototype.hide):
+        (WebInspector.ElementsPanel.prototype.reset):
+        (WebInspector.ElementsPanel.prototype._mouseMovedInCrumbs):
+        (WebInspector.ElementsPanel.prototype._mouseMovedOutOfCrumbs):
+        (WebInspector.ElementsPanel.prototype.updateBreadcrumb):
+        * page/inspector/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode):
+        Show the node hishlight for 2 seconds then restore the highlight
+        to the current hovered node.
+        (WebInspector.ElementsTreeOutline.prototype._onmousemove): Set the
+        hovered node and set the hovered state on the tree element.
+        (WebInspector.ElementsTreeOutline.prototype._onmouseout): Set the
+        hovered node to null and removed the hovered state from the previous
+        hovered tree element.
+        (WebInspector.ElementsTreeElement.prototype.set/get hovered): Adds
+        the hovered class to the list item.
+        (WebInspector.ElementsTreeElement.prototype.onattach): Ditto.
+        * page/inspector/inspector.css:
+        * page/inspector/inspector.js:
+        (WebInspector.set hoveredDOMNode): Pass a delay to _updateHoverHighlightSoon
+        based on the showingDOMNodeHighlight property of 50ms or 500ms. This
+        causes the highlight to change sooner if there is one already showing
+        and appear later if there isn't one showing. This is like tooltips,
+        hovering a node for 500ms will cause highlight then mousing between nodes
+        will keep the highlight and change to the new node.
+        (WebInspector._updateHoverHighlightSoon): Take a delay being passed in and
+        always reset the timeout so continuous mousing does not keep flasshing
+        the highlight on the screen.
+        (WebInspector._updateHoverHighlight): Removed the alt key check and added
+        the showingDOMNodeHighlight property.
+        (WebInspector.documentKeyDown): Removed the alt key check.
+        (WebInspector.documentKeyUp): Ditto.
+        (WebInspector.reset): Clear the hoveredDOMNode.
+
+2008-09-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Anders Carlsson
+
+        Fix RenderStyle leak in animation code, and assert that
+        keyframe resolution in CSSStyleSelector is not going to clobber
+        m_style.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::~KeyframeAnimation):
+
+2008-09-29  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=20995
+        Rewrite keyframe resolution to be like styleForElement()
+
+        Test: animations/lineheight-animation.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::addKeyframeStyle):
+        (WebCore::CSSStyleSelector::~CSSStyleSelector):
+        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
+        (WebCore::CSSRuleSet::addRulesFromSheet):
+        (WebCore::CSSStyleSelector::mapAnimationName):
+        * css/CSSStyleSelector.h:
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::KeyframeAnimation):
+        (WebCore::KeyframeAnimation::animate):
+        (WebCore::KeyframeAnimation::hasAnimationForProperty):
+        (WebCore::KeyframeAnimation::sendAnimationEvent):
+        (WebCore::KeyframeAnimation::overrideAnimations):
+        (WebCore::KeyframeAnimation::resumeOverriddenAnimations):
+        (WebCore::KeyframeAnimation::affectsProperty):
+        (WebCore::KeyframeAnimation::validateTransformFunctionList):
+        * page/animation/KeyframeAnimation.h:
+        * rendering/style/Animation.cpp:
+        (WebCore::Animation::animationsMatch):
+        * rendering/style/Animation.h:
+        * rendering/style/KeyframeList.cpp:
+        (WebCore::KeyframeList::~KeyframeList):
+        (WebCore::KeyframeList::clear):
+        (WebCore::KeyframeList::insert):
+        * rendering/style/KeyframeList.h:
+        (WebCore::KeyframeValue::KeyframeValue):
+        (WebCore::KeyframeList::KeyframeList):
+        (WebCore::KeyframeList::operator!=):
+        (WebCore::KeyframeList::animationName):
+        (WebCore::KeyframeList::addProperty):
+        (WebCore::KeyframeList::containsProperty):
+        (WebCore::KeyframeList::beginProperties):
+        (WebCore::KeyframeList::endProperties):
+        (WebCore::KeyframeList::isEmpty):
+        (WebCore::KeyframeList::size):
+        (WebCore::KeyframeList::beginKeyframes):
+        (WebCore::KeyframeList::endKeyframes):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        * rendering/style/StyleRareNonInheritedData.h:
+
+2008-09-29  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Eric Seidel
+
+        Clean up fix in PropertyWrapperGetter::equals
+        https://bugs.webkit.org/show_bug.cgi?id=21011
+
+        Test: transitions/override-transition-crash.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::PropertyWrapperGetter::equals):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateTransitions):
+
+2008-09-29  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Eric Seidel
+
+        https://bugs.webkit.org/show_bug.cgi?id=21001
+        Starting transition after animation, when animation
+        is finished, transition is wrong.
+
+        Test: animations/transition-and-animation-2.html
+
+        * page/animation/AnimationBase.h:
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateTransitions):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::resetTransitions):
+        (WebCore::CompositeAnimation::cleanupFinishedAnimations):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::ImplicitAnimation):
+        (WebCore::ImplicitAnimation::~ImplicitAnimation):
+        (WebCore::ImplicitAnimation::animate):
+        (WebCore::ImplicitAnimation::reset):
+        * page/animation/ImplicitAnimation.h:
+
+2008-09-29  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Sam Weinig
+
+        https://bugs.webkit.org/show_bug.cgi?id=20921
+        -webkit-animation-timing-function: inside of keyframes is ignored
+
+        Test: animations/keyframe-timing-functions.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::progress):
+        * page/animation/AnimationBase.h:
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::animate):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::animate):
+
+2008-09-29  Dan Bernstein  <mitz@apple.com>
+
+        - Windows build fix
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::platformScroll):
+
+2008-09-29  Dan Bernstein  <mitz@apple.com>
+
+        - another attempt at a Windows build fix
+
+        * platform/ScrollView.cpp:
+        (WebCore::platformScroll):
+
+2008-09-29  Dan Bernstein  <mitz@apple.com>
+
+        - Windows build fix
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::platformSetScrollPosition):
+
+2008-09-29  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21218
+
+        Accidentally removed a check to see if the scrollbar modes were equal.  This caused a crash on Windows.
+        It's silly that the code was this fragile, but for now just put the check back in.
+
+        Reviewed by Dan Bernstein
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setScrollbarModes):
+
+2008-09-29  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21216
+
+        Make setScrollPosition and scroll() cross-platform.
+
+        Reviewed by Anders
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setScrollPosition):
+        (WebCore::ScrollView::scroll):
+        * platform/ScrollView.h:
+        * platform/gtk/ScrollViewGtk.cpp:
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::platformSetScrollPosition):
+        (WebCore::ScrollView::platformScroll):
+        * platform/qt/ScrollViewQt.cpp:
+        * platform/win/ScrollViewWin.cpp:
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::platformSetScrollPosition):
+        (WebCore::ScrollView::platformScroll):
+
+2008-09-29  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Oliver.
+
+        Bug 21139: Profiler log message is wrong
+        - Because _format was called twice the number in the log was incremented
+        too many times, but we were passing it around in the link the whole time
+
+        * page/inspector/ProfilesPanel.js:
+        * page/inspector/inspector.js:
+
+2008-09-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Cameron Zwarich.
+
+        Autogenerate EventListeners, addEventListener and removeEventListener
+        for JSDOMWindow.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::onwebkitanimationstart):
+        (WebCore::JSDOMWindow::setOnwebkitanimationstart):
+        (WebCore::JSDOMWindow::onwebkitanimationiteration):
+        (WebCore::JSDOMWindow::setOnwebkitanimationiteration):
+        (WebCore::JSDOMWindow::onwebkitanimationend):
+        (WebCore::JSDOMWindow::setOnwebkitanimationend):
+        (WebCore::JSDOMWindow::onwebkittransitionend):
+        (WebCore::JSDOMWindow::setOnwebkittransitionend):
+        (WebCore::JSDOMWindow::addEventListener):
+        (WebCore::JSDOMWindow::removeEventListener):
+        (WebCore::JSDOMWindow::setListener):
+        (WebCore::JSDOMWindow::getListener):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * page/DOMWindow.idl:
+
+2008-09-29  Thiago Macieira  <thiago.macieira@nokia.com>
+
+        Reviewed by Simon.
+
+        Changed copyright from Trolltech ASA to Nokia.
+
+        Nokia acquired Trolltech ASA, assets were transferred on September 26th 2008.
+
+        * bindings/js/JSMimeTypeArrayCustom.cpp:
+        * bindings/js/JSNavigatorCustom.cpp:
+        * bindings/js/JSPluginArrayCustom.cpp:
+        * bindings/js/JSPluginCustom.cpp:
+        * bindings/js/ScriptControllerMac.mm:
+        * bindings/js/ScriptControllerQt.cpp:
+        * bridge/qt/qt_class.cpp:
+        * bridge/qt/qt_class.h:
+        * bridge/qt/qt_instance.cpp:
+        * bridge/qt/qt_instance.h:
+        * bridge/qt/qt_runtime.cpp:
+        * bridge/qt/qt_runtime.h:
+        * bridge/testqtbindings.cpp:
+        * css/makegrammar.pl:
+        * css/makeprop.pl:
+        * css/makevalues.pl:
+        * dom/Node.cpp:
+        * dom/TagNodeList.cpp:
+        * dom/TagNodeList.h:
+        * dom/XMLTokenizer.cpp:
+        * dom/XMLTokenizer.h:
+        * dom/XMLTokenizerLibxml2.cpp:
+        * dom/XMLTokenizerQt.cpp:
+        * editing/Editor.cpp:
+        * editing/EditorCommand.cpp:
+        * html/CanvasRenderingContext2D.cpp:
+        * html/CanvasStyle.cpp:
+        * html/HTMLAppletElement.cpp:
+        * html/HTMLEmbedElement.cpp:
+        * html/HTMLObjectElement.cpp:
+        * loader/FrameLoader.cpp:
+        * page/Chrome.cpp:
+        * page/EditorClient.h:
+        * page/Frame.cpp:
+        * page/Frame.h:
+        * page/FramePrivate.h:
+        * page/Navigator.cpp:
+        * page/Navigator.h:
+        * page/Navigator.idl:
+        * page/mac/FrameMac.mm:
+        * page/qt/EventHandlerQt.cpp:
+        * platform/graphics/qt/FontCacheQt.cpp:
+        * platform/graphics/qt/FontCustomPlatformData.cpp:
+        * platform/graphics/qt/FontCustomPlatformData.h:
+        * platform/graphics/qt/FontPlatformData.h:
+        * platform/graphics/qt/FontQt.cpp:
+        * platform/graphics/qt/GlyphPageTreeNodeQt.cpp:
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        * platform/graphics/qt/ImageDecoderQt.cpp:
+        * platform/graphics/qt/ImageDecoderQt.h:
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.h:
+        * platform/graphics/qt/SimpleFontDataQt.cpp:
+        * platform/gtk/MIMETypeRegistryGtk.cpp:
+        * platform/mac/MIMETypeRegistryMac.mm:
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        * platform/network/qt/QNetworkReplyHandler.h:
+        * platform/network/qt/ResourceHandleQt.cpp:
+        * platform/network/qt/ResourceRequestQt.cpp:
+        * platform/qt/ClipboardQt.cpp:
+        * platform/qt/EventLoopQt.cpp:
+        * platform/qt/KURLQt.cpp:
+        * platform/qt/LoggingQt.cpp:
+        * platform/qt/MIMETypeRegistryQt.cpp:
+        * platform/qt/PasteboardQt.cpp:
+        * platform/qt/PlatformScreenQt.cpp:
+        * platform/qt/PopupMenuQt.cpp:
+        * platform/qt/QWebPopup.cpp:
+        * platform/qt/QWebPopup.h:
+        * platform/qt/RenderThemeQt.cpp:
+        * platform/qt/ScrollbarQt.cpp:
+        * platform/qt/ScrollbarThemeQt.cpp:
+        * platform/qt/WheelEventQt.cpp:
+        * platform/qt/html4-adjustments-qt.css:
+        * platform/wx/MimeTypeRegistryWx.cpp:
+        * plugins/MimeType.cpp:
+        * plugins/MimeType.h:
+        * plugins/MimeType.idl:
+        * plugins/MimeTypeArray.cpp:
+        * plugins/MimeTypeArray.h:
+        * plugins/MimeTypeArray.idl:
+        * plugins/Plugin.cpp:
+        * plugins/Plugin.h:
+        * plugins/Plugin.idl:
+        * plugins/PluginArray.cpp:
+        * plugins/PluginArray.h:
+        * plugins/PluginArray.idl:
+        * plugins/PluginData.cpp:
+        * plugins/PluginData.h:
+        * plugins/gtk/PluginDataGtk.cpp:
+        * plugins/mac/PluginDataMac.mm:
+        * plugins/qt/PluginDataQt.cpp:
+        * plugins/win/PluginDataWin.cpp:
+        * rendering/RenderTableCol.cpp:
+        * rendering/RenderTableCol.h:
+
+2008-09-29  Thiago Macieira  <thiago.macieira@trolltech.com>
+
+        Reviewed by Simon
+
+        Fix compilation with gcc 4.3
+
+         gcc 4.3 is stricter and ctype.h isn't getting included
+        automatically here by dependencies. So do it directly.
+
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+
+2008-09-29  Morten Sørvig  <msorvig@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix compilation with Qt/Mac without plugins.
+
+        * platform/qt/TemporaryLinkStubs.cpp:
+
+2008-09-29  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Apply the ASCII fast path optimization from StringImpl::lower to StringImpl::upper.
+        In the few places that we call .upper() in WebCore the strings represent things like
+        tag and attribute names, which are nearly always going to be ASCII.
+
+        * platform/text/StringImpl.cpp:
+        (WebCore::StringImpl::lower): If we have to resize the buffer, be sure to pass the new length
+        in to Unicode::toLower the second time.
+        (WebCore::StringImpl::upper):
+
+2008-09-28  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Speed up getPropertyValue('clip') by 25% by using a Vector<UChar> for building a string,
+        rather than String::operator+=.
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::cssText):
+
+2008-09-28  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Speed up computedStyle.getPropertyValue('color') by 4.5x.
+
+        Using a Vector<UChar> while building up the property's cssText is substantially cheaper than using String::operator+=
+        as it avoids many memory reallocations.
+
+        This also speeds up the jQuery .offset() benchmark at <http://dev.jquery.com/~john/speed/1.2.6/offset-1.2.6.html>
+        by 20% due to jQuery's strange need to call getPropertyValue('color') when retrieving the computed styles for
+        unrelated properties on an element.
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::cssText): Build the result for the color types into a Vector<UChar>
+        and use appendNumber rather than the String::number in order to cut down on memory allocations.
+        * platform/text/PlatformString.h:
+        (WebCore::appendNumber): A helper function for formatting an unsigned character as a number
+        into a Vector<UChar>.
+
+2008-09-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Remove spurious call to lower().
+
+        * css/MediaQueryEvaluator.cpp:
+        (WebCore::MediaQueryEvaluator):
+
+2008-09-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Use a CaseFoldingHash instead of calling lower on family strings.
+
+        * css/CSSFontSelector.cpp:
+        (WebCore::CSSFontSelector::addFontFaceRule):
+        (WebCore::CSSFontSelector::getFontData):
+        * css/CSSFontSelector.h:
+
+2008-09-28  Timothy Hatcher  <timothy@apple.com>
+
+        Remove the scrollIntoViewIfNeeded() call when drawing the
+        Inspector node highlight.
+
+        <rdar://problem/6115804> Don't scroll when highlighting (21000)
+        https://bugs.webkit.org/show_bug.cgi?id=21000
+
+        Reviewed by Dan Bernstein.
+
+        * page/InspectorController.cpp:
+        (WebCore::InspectorController::drawNodeHighlight):
+
+2008-09-28  David Hyatt  <hyatt@apple.com>
+
+        Fix crash when WebKit has no instantiated Scrollbars and the appearance prefs for scrollbars are
+        changed.
+
+        Reviewed by Dan Bernstein
+
+        * platform/mac/ScrollbarThemeMac.mm:
+        (+[ScrollbarPrefsObserver appearancePrefsChanged:]):
+
+2008-09-28  Timothy Hatcher  <timothy@apple.com>
+
+        Clear the current search results in the Inspector when
+        the search query is less than 3 characters long. Incremental
+        searches only occur for 3 characters or longer, but deleting
+        under this limit would not clear the results unless the whole
+        query was deleted.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21196
+
+        Reviewed by Dan Bernstein.
+
+        * page/inspector/inspector.js:
+        (WebInspector.performSearch): Check for short queries in the
+        if statement that triggers the clear.
+
+2008-09-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6202962> "Tibetan Machine Uni" font does not work as a web font on Windows because TTLoadEmbeddedFont fails with E_NAMECHANGEFAILED
+
+        * platform/graphics/win/FontCustomPlatformData.cpp:
+        (WebCore::EOTStream::EOTStream): Added overlayDst, overlaySrc and
+        overlayLength parameters.
+        (WebCore::EOTStream::read): Added code to overlay the
+        m_overlayLength bytes starting at m_overlayDst with the same number of
+        bytes from m_overlaySrc.
+        (WebCore::createFontCustomPlatformData): Changed to get overlay
+        parameters from getEOTHeader.
+        * platform/graphics/win/GetEOTHeader.cpp:
+        (WebCore::getEOTHeader): Added code to specify overlaying of the
+        family name with the prefix of the full name if they differ, because
+        that such a difference causes TTLoadEmbeddedFont to fail.
+        * platform/graphics/win/GetEOTHeader.h:
+
+2008-09-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20366
+        Reproducible test failure for editing/undo/undo-iframe-location-change.html
+
+        * ChangeLog-2006-05-10: Added bug URLs for a fix that included this test.
+
+2008-09-28  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig (except for a few comment and header tweaks).
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21158
+          reduce use of virtual functions in Node for speed
+
+        Speeds up Dromaeo a bit less than 1%.
+
+        * bindings/js/JSNamedNodesCollection.cpp: Include Element.h instead of
+        Node.h now that some inlines are in there.
+
+        * dom/Attr.h: Override both the virtual and non-virtual name functions.
+
+        * dom/ChildNodeList.cpp:
+        (WebCore::ChildNodeList::nodeMatches): Updated to take an Element.
+        * dom/ChildNodeList.h: Ditto.
+        * dom/ClassNodeList.cpp:
+        (WebCore::ClassNodeList::nodeMatches): Ditto.
+        * dom/ClassNodeList.h: Ditto.
+
+        * dom/Document.h: Put the Node::isDocumentNode() function's inline
+        definition here where it can see the Document class definition.
+
+        * dom/DynamicNodeList.cpp:
+        (WebCore::DynamicNodeList::length): Changed to pass an Element.
+        (WebCore::DynamicNodeList::itemForwardsFromCurrent): Ditto.
+        (WebCore::DynamicNodeList::itemBackwardsFromCurrent): Ditto.
+        (WebCore::DynamicNodeList::itemWithName): Ditto.
+        * dom/DynamicNodeList.h: Ditto.
+
+        * dom/Element.cpp: Removed virtualHasTagName.
+        * dom/Element.h: Made localName, prefix, namespaceURI, and
+        styleForRenderer non-virtual. Added virtualPrefix, virtualLocalName,
+        virtualNamespaceURI, and removed virtualHasTagName. Put the
+        Node::hasTagName, Node::hasAttributes, and Node::attributes
+        functions' inline definitions here where they can see the Element
+        class definition.
+
+        * dom/NameNodeList.cpp:
+        (WebCore::NameNodeList::nodeMatches): Updated to take an Element.
+        * dom/NameNodeList.h: Ditto.
+
+        * dom/Node.cpp:
+        (WebCore::Node::virtualPrefix): Renamed from prefix.
+        (WebCore::Node::virtualLocalName): Renamed from localName.
+        (WebCore::Node::virtualNamespaceURI): Renamed from namespaceURI.
+        (WebCore::Node::styleForRenderer): Handle the Element case here.
+
+        * dom/Node.h: Removed definition of hasTagName that calls virtual,
+        since we now have a non-virtual version. Made hasAttributes,
+        attributes, remove, localName, namespaceURI, prefix, isDocumentNode,
+        and styleForRenderer non-virtual. Added virtualPrefix,
+        virtualLocalName, and virtualNamespaceURI. Removed isMalformed
+        and setMalformed, which are used only on HTMLFormElement objects.
+
+        * dom/TagNodeList.cpp:
+        (WebCore::TagNodeList::nodeMatches): Updated to take an Element.
+        * dom/TagNodeList.h: Ditto.
+
+        * html/HTMLAnchorElement.cpp: Added a comment.
+        * html/HTMLFormControlElement.cpp: Ditto.
+
+        * html/HTMLAnchorElement.h: Removed unused, unimplemented setTabIndex
+        function. Marked tabIndex function virtual explicitly for clarity.
+
+        * html/HTMLAreaElement.h: Removed unused, unimplemented setTabIndex
+        function. Marked isFocusable function virtual explicitly for clarity.
+
+        * html/HTMLElement.h: Marked tabIndex function virtual explicitly for
+        clarity.
+        * html/HTMLFormControlElement.h: Ditto.
+
+        * html/HTMLFormElement.h: Made isMalformed non-virtual.
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleError): Use the already-cast-to-HTMLElement
+        pointer to call localName since that one does not need to call a virtual
+        function.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock): Cast to HTMLFormElement before
+        calling isMalformed. We already did a tag name check so we know it's
+        an HTMLFormELement.
+
+        * xml/XPathUtil.cpp:
+        (WebCore::XPath::isValidContextNode): Rewrote to not make so many calls
+        to nodeType(), since it's a virtual function.
+
+2008-09-28  David Hyatt  <hyatt@apple.com>
+
+        Make frameRectsChanged() cross-platform on ScrollView.
+
+        Reviewed by Oliver Hunt
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::frameRectsChanged):
+        * platform/ScrollView.h:
+        * platform/gtk/ScrollViewGtk.cpp:
+        * platform/qt/ScrollViewQt.cpp:
+        * platform/win/ScrollViewWin.cpp:
+        * platform/wx/ScrollViewWx.cpp:
+
+2008-09-28  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21141: REGRESSION: Exception messages for user entered commands are poor
+        <https://bugs.webkit.org/show_bug.cgi?id=21141>
+
+        The bug repsonsible for this was the the JSInspectedObjectWrapper instances
+        were not initialising their StructureID's to indicate that the wrapper
+        overrides hasInstance, etc.  The solution is simply to use the createStructureID
+        helper on JSQuarantinedObjectWrapper to create a correct StructureID.
+
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::wrap):
+
+2008-09-28  David Hyatt  <hyatt@apple.com>
+
+        Make sure pixel wheel scrolls (formerly "continuous" wheel events) send deltas to DOM wheel events in
+        terms of lines.
+
+        Reviewed by Oliver Hunt
+
+        * dom/EventTargetNode.cpp:
+        (WebCore::EventTargetNode::dispatchWheelEvent):
+
+2008-09-28  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21191
+
+        Rework mouse wheeling significantly to make the platform event less messy and to enable wheelEvent
+        on ScrollView to be cross-platform.
+
+        Give the wheel event a concept of granularity (pixel, line or page).  What used to be called continuous
+        events are now pixel wheel events.
+
+        Page scrolling as implemented in bug 17589 was completely broken.  It had the following problems:
+        (1) Page scrolling has been corrected to be properly detected (on Windows
+        page wheeling is only done in the vertical direction and it is keyed off a special return value of -1).  The
+        old code had some bizarre incorrect heuristic for "guessing" that you should page scroll and also thought
+        you could page scroll horizontally.
+        (2) Page scrolling a layer used the enclosing ScrollView's width/height instead of the layer's width/height.
+        This caused the scroll amount for page scrolling to be way too large on layers.
+
+        Bug 17589 got the default horizontal scrolling value wrong.  It assumed 1, when the Vista default is 3.
+
+        Incorporate WebCore's line multiplier right into the deltas of the event.  This eliminates the need
+        for separate multiplier fields (or for the need to ask if you're looking for line sensitivity).
+
+        Reviewed by Oliver Hunt
+
+        * editing/EditorCommand.cpp:
+        (WebCore::verticalScrollDistance):
+        * page/EventHandler.cpp:
+        (WebCore::scrollAndAcceptEvent):
+        (WebCore::EventHandler::handleWheelEvent):
+        * platform/PlatformWheelEvent.h:
+        (WebCore::):
+        (WebCore::PlatformWheelEvent::pos):
+        (WebCore::PlatformWheelEvent::globalPos):
+        (WebCore::PlatformWheelEvent::deltaX):
+        (WebCore::PlatformWheelEvent::deltaY):
+        (WebCore::PlatformWheelEvent::granularity):
+        (WebCore::PlatformWheelEvent::x):
+        (WebCore::PlatformWheelEvent::globalX):
+        (WebCore::PlatformWheelEvent::ignore):
+        (WebCore::PlatformWheelEvent::horizontalLineMultiplier):
+        (WebCore::PlatformWheelEvent::verticalLineMultiplier):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/Scrollbar.h:
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/gtk/WheelEventGtk.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/mac/ScrollViewMac.mm:
+        * platform/mac/WheelEventMac.mm:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/qt/WheelEventQt.cpp:
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/win/WheelEventWin.cpp:
+        (WebCore::PlatformWheelEvent::horizontalLineMultiplier):
+        (WebCore::PlatformWheelEvent::verticalLineMultiplier):
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::OnScrollWinEvents):
+        (WebCore::ScrollView::wheelEvent):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateScrollInfoAfterLayout):
+
+2008-09-27  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        fix https://bugs.webkit.org/show_bug.cgi?id=20994
+        <rdar://problem/6171023> HTMLVideoElement width and height attributes are now unsigned
+
+        HTML5 spec says HTMLVideoElement width and height attributes should be unsigned. Convert
+        all unsigned media attributes from string with toUInt() instead of toInt().
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::playCount): convert from attribute with toUInt().
+
+        * html/HTMLVideoElement.cpp:
+        (WebCore::HTMLVideoElement::videoWidth):
+        (WebCore::HTMLVideoElement::videoHeight): return unsigned to match idl.
+        (WebCore::HTMLVideoElement::width): convert from attribute with toUInt() and return
+          unsigned value.
+        (WebCore::HTMLVideoElement::height): Ditto.
+        (WebCore::HTMLVideoElement::setWidth): take unsigned value.
+        (WebCore::HTMLVideoElement::setHeight): Ditto.
+
+        * html/HTMLVideoElement.h: width, height, videoWidth, and videoHeight are unsigned.
+
+        * html/HTMLVideoElement.idl: make width and height unsigned to match HTML5 spec.
+
+2008-09-27  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes an exception when typing a command in the Console.
+
+        Reviewed by Oliver Hunt.
+
+        * page/inspector/Console.js:
+        (WebInspector.Console.prototype.addMessage): Null check
+        this.previosMessage.
+
+2008-09-27  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes a bug where the Profiles panel sidebar would be empty
+        after closing and reopening the Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21179
+
+        Reviewed by Sam Weinig.
+
+        * page/inspector/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.reset): Don't call
+        populateInterface, it is called automatically.
+        (WebInspector.ProfilesPanel.prototype._populateProfiles):
+        Return early if the sidebar is already populated.
+
+2008-09-27  Dave Hyatt  <hyatt@apple.com>
+
+        Bug 21190.  The line scroll amount on Windows is way too small.  A patch for bug 17589 for wheel sensitivity
+        incorrectly applied the tinier wheel step delta (unmultiplied) to line scrolling.  Line scrolling with the
+        scrollbar has nothing to do with mouse wheeling.  This patch reverts the scrollbars to use the same line
+        step as other platforms while leaving the wheel delta alone for use with wheel scrolling.
+
+        There was a lot wrong with 17589, so more patches will be coming to deal with the fallout of this patch
+        (which should never have landed in the first place).
+
+        Reviewed by Tim Hatcher, Sam Weinig
+
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::adjustDeltaForPageScrollMode):
+        (WebCore::ScrollView::updateScrollbars):
+        (WebCore::ScrollView::wheelEvent):
+
+2008-09-27  David Hyatt  <hyatt@apple.com>
+
+        Make the scrollbarUnderMouse method cross-platform.
+
+        Reviewed by Sam Weinig
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollbarUnderMouse):
+        * platform/gtk/ScrollViewGtk.cpp:
+        * platform/mac/ScrollViewMac.mm:
+        * platform/qt/ScrollViewQt.cpp:
+        * platform/win/ScrollViewWin.cpp:
+        * platform/wx/ScrollViewWx.cpp:
+
+2008-09-27  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Gtk+ build fix.
+
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::valueChanged):
+
+2008-09-27  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20287
+        [Gtk] disable plugins for gtk/directfb target
+
+        Introduce WTF_PLATFORM_X11 for X11 builds.
+        Also use target-specific packages when building the port
+
+        * platform/gtk/PlatformScreenGtk.cpp:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::getValueStatic):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::init):
+
+2008-09-27  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21188
+
+        Make scrollbar suppression and resizer avoidance cross-platform.
+
+        Reviewed by Anders
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::transitionToCommitted):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::resetScrollbars):
+        (WebCore::FrameView::clear):
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::restoreScrollbar):
+        (WebCore::FrameView::windowResizerRect):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::init):
+        (WebCore::ScrollView::resizerOverlapsContent):
+        (WebCore::ScrollView::adjustScrollbarsAvoidingResizerCount):
+        (WebCore::ScrollView::setParent):
+        (WebCore::ScrollView::setScrollbarsSuppressed):
+        (WebCore::ScrollView::platformSetScrollbarsSuppressed):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::scrollbarsSuppressed):
+        (WebCore::ScrollView::windowResizerRect):
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::setFrameRect):
+        (WebCore::Scrollbar::setParent):
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
+        (WebCore::ScrollView::ScrollViewPrivate::adjustmentChanged):
+        (WebCore::ScrollView::updateScrollbars):
+        (WebCore::ScrollView::paint):
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::~ScrollView):
+        (WebCore::ScrollView::platformSetScrollbarsSuppressed):
+        (WebCore::ScrollView::setScrollPosition):
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
+        (WebCore::ScrollView::ScrollViewPrivate::valueChanged):
+        (WebCore::ScrollView::frameRectsChanged):
+        (WebCore::ScrollView::updateScrollbars):
+        (WebCore::ScrollView::paint):
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
+        (WebCore::ScrollView::ScrollViewPrivate::valueChanged):
+        (WebCore::ScrollView::updateScrollbars):
+        (WebCore::ScrollView::paint):
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
+
+2008-09-27  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber-stamped by Anders Carlsson.
+
+        Compile fix.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::load):
+
+2008-09-27  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        Fix <https://bugs.webkit.org/show_bug.cgi?id=21184>.
+        Bug 21184: REGRESSION: Reproducible crash below StringImpl::hash while running editing/deleting/5408255.html
+
+        Remove an assertion that was incorrect and that if made correct would have duplicated a check that occurred earlier in the function.
+
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::~CachedResource):
+
+2008-09-27  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [qt] Use QImageReader to figure out which image formats are supported
+        - Qt can have many different plugins for different image formats. Instead
+        of checking only for a few in WebCore use Qt to determine if this data
+        can be treated as an image.
+
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::canHandleImage):
+        (WebCore::createDecoder):
+
+2008-09-27  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+
+        [qt] Clean the pattern code
+        - Use save/restore on the painter after manipulating the
+        pen/brush
+        - Make the context and object null checking consistent. CG is using
+        the object unconditionally so the Qt webkit platform can do the
+        same.
+        - Move code below the early exit. Only use the m_ownerElement before
+        the early exit as the CG code is doing it.
+
+        * svg/graphics/SVGPaintServerPattern.h:
+        * svg/graphics/qt/SVGPaintServerPatternQt.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+        (WebCore::SVGPaintServerPattern::teardown):
+
+2008-09-27  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Added support for console.trace.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19157
+
+        Reviewed by Kevin McCullough and Tim Hatcher.
+
+        * bindings/js/JSConsoleCustom.cpp:
+        (WebCore::JSConsole::trace):
+        * page/Console.cpp:
+        (WebCore::Console::trace): Calls Machine::retrieveCaller to
+        get a stack trace.
+        * page/Console.h:
+        (WebCore::): Added TraceMessageLevel.
+        * page/Console.idl: Added console.trace.
+        * page/inspector/Console.js:
+        (ConsoleMessage): Added case for TraceMessageLevel.
+
+2008-09-27  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21178
+        <rdar://problem/6248651>
+
+        Check if the plug-in is allowed to load the resource. This matches Firefox.
+
+        Test: http/tests/plugins/local-geturl-from-remote.html
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::load):
+
+2008-09-22  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by Eric Seidel.
+
+        Added SVG pattern support to Qt.
+
+        [Qt] SVG patterns are missing
+        https://bugs.webkit.org/show_bug.cgi?id=20973
+
+        * svg/graphics/qt/SVGPaintServerPatternQt.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+
+2008-09-27  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Fixed a bug in the JS syntax highlighter with multiple line tokens.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21171
+
+        Reviewed by Tim Hatcher.
+
+        * page/inspector/SourceFrame.js:
+        (syntaxHighlightJavascriptLine): Initialize previousMatchLength.
+
+2008-09-27  Timothy Hatcher  <timothy@apple.com>
+
+        Change searching in the Profiles panel to not match the
+        Self and Total columns when there are no units. The only
+        column that is matched for unitless number searches is
+        now the Calls column.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21169
+
+        Reviewed by Sam Weinig.
+
+        * page/inspector/ProfileView.js:
+        (WebInspector.ProfileView.prototype.performSearch):
+
+2008-09-27  David Hyatt  <hyatt@apple.com>
+
+        Rename boundsGeometry -> boundsRect.  Rename geometryChanged -> frameRectsChanged.
+
+        Reviewed by Sam Weinig
+
+        * platform/ScrollView.h:
+        * platform/Widget.h:
+        (WebCore::Widget::boundsRect):
+        (WebCore::Widget::invalidate):
+        (WebCore::Widget::frameRectsChanged):
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollViewScrollbar::frameRectsChanged):
+        (WebCore::ScrollView::ScrollViewPrivate::scrollBackingStore):
+        (WebCore::ScrollView::setFrameRect):
+        (WebCore::ScrollView::updateScrollbars):
+        (WebCore::ScrollView::frameRectsChanged):
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::setFrameRect):
+        (ScrollbarGtk::frameRectsChanged):
+        * platform/gtk/ScrollbarGtk.h:
+        * platform/gtk/WidgetGtk.cpp:
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::scrollBackingStore):
+        (WebCore::ScrollView::setFrameRect):
+        (WebCore::ScrollView::frameRectsChanged):
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::scrollBackingStore):
+        (WebCore::ScrollView::setFrameRect):
+        (WebCore::ScrollView::updateScrollbars):
+        (WebCore::ScrollView::frameRectsChanged):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::frameRectsChanged):
+        * plugins/PluginView.h:
+
+2008-09-27  Simon Hausmann  <hausmann@webkit.org>
+
+        Refix the previous build fix to compile on non-Qt platforms, too.
+
+        * WebCore.pro: Don't pass -i to create_hashtable, added missing -n
+        WebCore to generate the PrototypeTable in the WebCore namespace
+        * bindings/js/JSEventTargetBase.h: Revert previous fix, the Prototype
+        table remains in the Webcore namespace
+        (WebCore::JSEventTargetBasePrototype::getOwnPropertySlot):
+
+2008-09-27  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix compilation with gcc 4.3 (probably > 4.0)
+
+        * bindings/js/JSDOMWindowBase.cpp: Don't define static property
+        get/put functions inside the WebCore namespace.
+        * bindings/js/JSEventTargetBase.cpp: Ditto.
+        * bindings/js/JSEventTargetNode.cpp: Ditto.
+        * bindings/js/JSEventTargetSVGElementInstance.cpp: Ditto.
+        * bindings/js/JSEventTargetBase.h: Forward declare
+        JSEventTargetPrototypeTable in the JSC namespace as the lut.h file
+        defines it in the JSC namespace.
+        (WebCore::JSEventTargetBasePrototype::getOwnPropertySlot): Add JSC::
+        prefix for PrototypeTable symbol.
+
+2008-09-27  David Hyatt  <hyatt@apple.com>
+
+        Rename frameGeometry to frameRect.  Rename setFrameGeometry to setFrameRect.
+
+        Reviewed by Dan Bernstein
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::FrameView):
+        (WebCore::FrameView::updateControlTints):
+        * platform/ScrollView.h:
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::Scrollbar):
+        (WebCore::Scrollbar::paint):
+        (WebCore::Scrollbar::setFrameRect):
+        * platform/Scrollbar.h:
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::paint):
+        * platform/Widget.h:
+        (WebCore::Widget::x):
+        (WebCore::Widget::y):
+        (WebCore::Widget::width):
+        (WebCore::Widget::height):
+        (WebCore::Widget::size):
+        (WebCore::Widget::pos):
+        (WebCore::Widget::resize):
+        (WebCore::Widget::move):
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollViewScrollbar::geometryChanged):
+        (WebCore::ScrollView::update):
+        (WebCore::ScrollView::setFrameRect):
+        (WebCore::ScrollView::updateScrollbars):
+        (WebCore::ScrollView::scrollbarUnderMouse):
+        (WebCore::ScrollView::paint):
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::setFrameRect):
+        (ScrollbarGtk::geometryChanged):
+        * platform/gtk/ScrollbarGtk.h:
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::frameRect):
+        (WebCore::Widget::setFrameRect):
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::trackRect):
+        (WebCore::ScrollbarThemeMac::paint):
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::frameRect):
+        (WebCore::Widget::setFrameRect):
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::setFrameRect):
+        (WebCore::ScrollView::updateScrollbars):
+        (WebCore::ScrollView::scrollbarUnderMouse):
+        (WebCore::ScrollView::paint):
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::styleOptionSlider):
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::frameRect):
+        (WebCore::Widget::setFrameRect):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::invalidateItem):
+        (WebCore::PopupMenu::valueChanged):
+        (WebCore::PopupWndProc):
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::setFrameRect):
+        (WebCore::ScrollView::updateScrollbars):
+        (WebCore::ScrollView::scrollbarUnderMouse):
+        (WebCore::ScrollView::paint):
+        * platform/win/ScrollbarThemeSafari.cpp:
+        (WebCore::ScrollbarThemeSafari::trackRect):
+        * platform/win/WidgetWin.cpp:
+        (WebCore::Widget::frameRect):
+        (WebCore::Widget::setFrameRect):
+        * platform/wx/WidgetWx.cpp:
+        (WebCore::Widget::frameRect):
+        (WebCore::Widget::setFrameRect):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameRect):
+        * plugins/PluginView.h:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::init):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::init):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paintMissingPluginIcon):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::init):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::positionOverflowControls):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::paintScrollbar):
+        * rendering/RenderPart.cpp:
+        (WebCore::RenderPart::updateWidgetPosition):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::setWidgetGeometry):
+        (WebCore::RenderWidget::updateWidgetPosition):
+
+2008-09-27  David Hyatt  <hyatt@apple.com>
+
+        <rdar://problem/6252041> REGRESSION (4dp-TOT): Crash in Widget::platformWidget() when closing a PDF
+
+        This crash was lurking for a while and basically got exposed by my changes to visibleContentRect() to
+        access an actual member variable.
+
+        Reviewed by Dan Bernstein
+
+        * page/FocusController.cpp:
+        (WebCore::FocusController::setFocusedFrame):
+
+2008-09-27  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Attempt to fix QT Build. Not reviewed.
+
+        * WebCore.pro: add -n WebCore parameter to create_hash_table
+
+2008-09-26  Gwenole Beauchesne  <gbeauchesne@splitted-desktop.org>
+
+        Reviewed by Eric Seidel.
+
+        http://bugs.webkit.org/show_bug.cgi?id=18905
+        [GTK] Fix build with older pango (1.14.8)
+
+        * platform/graphics/gtk/FontGtk.cpp:
+        * platform/gtk/Language.cpp:
+        (_pango_get_lc_ctype):
+        (pango_language_get_default):
+
+2008-09-26  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21168
+
+        Make contentsToWindow/windowToContents cross-platform.
+
+        Reviewed by Oliver Hunt
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::windowToContents):
+        (WebCore::ScrollView::contentsToWindow):
+        * platform/ScrollView.h:
+        * platform/gtk/ScrollViewGtk.cpp:
+        * platform/mac/ScrollViewMac.mm:
+        * platform/qt/ScrollViewQt.cpp:
+        * platform/win/ScrollViewWin.cpp:
+        * platform/wx/ScrollViewWx.cpp:
+
+2008-09-26  Sam Weinig  <sam@webkit.org>
+
+        GTK build fix.
+
+        * GNUmakefile.am:
+
+2008-09-26  David Hyatt  <hyatt@apple.com>
+
+        Eliminate shouldUpdateWhileOffscreen from ScrollView.  Make the concept of not invalidating while
+        offscreen cross-platform.  Rename the inWindow method to isOffscreen (which flips the boolean), since that
+        more clearly conveys the intent of the method.  Make isOffscreen also check NSWindow visibility on Mac.
+
+        Reviewed by Oliver Hunt
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::repaintContentRectangle):
+        * page/FrameView.h:
+        * platform/ScrollView.h:
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::isOffscreen):
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::updateContents):
+        (WebCore::ScrollView::isOffscreen):
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::isOffscreen):
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::isOffscreen):
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::isOffscreen):
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::willRenderImage):
+
+2008-09-26  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21164
+
+        Rework concept of allowsScrolling/setAllowsScrolling to be cross-platform.
+
+        Reviewed by Sam Weinig
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::setAllowsScrolling):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setAllowsScrolling):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::allowsScrolling):
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::wheelEvent):
+
+2008-09-26  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes after Widget/ScrollView changes.
+
+        * platform/wx/PopupMenuWx.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::platformSetContentsSize):
+        (WebCore::ScrollView::platformSetScrollbarModes):
+        (WebCore::ScrollView::wheelEvent):
+        * platform/wx/TemporaryLinkStubs.cpp:
+        * platform/wx/WidgetWx.cpp:
+        (WebCore::Widget::containingWindow):
+
+2008-09-26  Timothy Hatcher  <timothy@apple.com>
+
+        Allow searching for paths by always performing the
+        three search methods in the Elements panel and not
+        assume a search with a "/" is a XPath query.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21159
+
+        Reviewed by Geoff Garen.
+
+        * page/inspector/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.performSearch):
+
+2008-09-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=21152
+        Speedup static property get/put
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMBinding.cpp:
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::getDOMConstructor):
+        (WebCore::jsDOMWindowBaseCrypto):
+        (WebCore::jsDOMWindowBaseEvent):
+        (WebCore::jsDOMWindowBaseImage):
+        (WebCore::jsDOMWindowBaseMessageChannel):
+        (WebCore::jsDOMWindowBaseOption):
+        (WebCore::jsDOMWindowBaseXMLHttpRequest):
+        (WebCore::jsDOMWindowBaseAudio):
+        (WebCore::jsDOMWindowBaseXSLTProcessor):
+        (WebCore::jsDOMWindowBaseOnabort):
+        (WebCore::jsDOMWindowBaseOnblur):
+        (WebCore::jsDOMWindowBaseOnchange):
+        (WebCore::jsDOMWindowBaseOnclick):
+        (WebCore::jsDOMWindowBaseOndblclick):
+        (WebCore::jsDOMWindowBaseOnerror):
+        (WebCore::jsDOMWindowBaseOnfocus):
+        (WebCore::jsDOMWindowBaseOnkeydown):
+        (WebCore::jsDOMWindowBaseOnkeypress):
+        (WebCore::jsDOMWindowBaseOnkeyup):
+        (WebCore::jsDOMWindowBaseOnload):
+        (WebCore::jsDOMWindowBaseOnmousedown):
+        (WebCore::jsDOMWindowBaseOnmousemove):
+        (WebCore::jsDOMWindowBaseOnmouseout):
+        (WebCore::jsDOMWindowBaseOnmouseover):
+        (WebCore::jsDOMWindowBaseOnmouseup):
+        (WebCore::jsDOMWindowBaseOnMouseWheel):
+        (WebCore::jsDOMWindowBaseOnreset):
+        (WebCore::jsDOMWindowBaseOnresize):
+        (WebCore::jsDOMWindowBaseOnscroll):
+        (WebCore::jsDOMWindowBaseOnsearch):
+        (WebCore::jsDOMWindowBaseOnselect):
+        (WebCore::jsDOMWindowBaseOnsubmit):
+        (WebCore::jsDOMWindowBaseOnbeforeunload):
+        (WebCore::jsDOMWindowBaseOnunload):
+        (WebCore::jsDOMWindowBaseOnWebKitAnimationStart):
+        (WebCore::jsDOMWindowBaseOnWebKitAnimationIteration):
+        (WebCore::jsDOMWindowBaseOnWebKitAnimationEnd):
+        (WebCore::jsDOMWindowBaseOnWebKitTransitionEnd):
+        (WebCore::JSDOMWindowBase::getOwnPropertySlot):
+        (WebCore::JSDOMWindowBase::put):
+        (WebCore::setJSDOMWindowBaseOnabort):
+        (WebCore::setJSDOMWindowBaseOnblur):
+        (WebCore::setJSDOMWindowBaseOnchange):
+        (WebCore::setJSDOMWindowBaseOnclick):
+        (WebCore::setJSDOMWindowBaseOndblclick):
+        (WebCore::setJSDOMWindowBaseOnerror):
+        (WebCore::setJSDOMWindowBaseOnfocus):
+        (WebCore::setJSDOMWindowBaseOnkeydown):
+        (WebCore::setJSDOMWindowBaseOnkeypress):
+        (WebCore::setJSDOMWindowBaseOnkeyup):
+        (WebCore::setJSDOMWindowBaseOnload):
+        (WebCore::setJSDOMWindowBaseOnmousedown):
+        (WebCore::setJSDOMWindowBaseOnmousemove):
+        (WebCore::setJSDOMWindowBaseOnmouseout):
+        (WebCore::setJSDOMWindowBaseOnmouseover):
+        (WebCore::setJSDOMWindowBaseOnmouseup):
+        (WebCore::setJSDOMWindowBaseOnMouseWheel):
+        (WebCore::setJSDOMWindowBaseOnreset):
+        (WebCore::setJSDOMWindowBaseOnresize):
+        (WebCore::setJSDOMWindowBaseOnscroll):
+        (WebCore::setJSDOMWindowBaseOnsearch):
+        (WebCore::setJSDOMWindowBaseOnselect):
+        (WebCore::setJSDOMWindowBaseOnsubmit):
+        (WebCore::setJSDOMWindowBaseOnbeforeunload):
+        (WebCore::setJSDOMWindowBaseOnunload):
+        (WebCore::setJSDOMWindowBaseOnWebKitAnimationStart):
+        (WebCore::setJSDOMWindowBaseOnWebKitAnimationIteration):
+        (WebCore::setJSDOMWindowBaseOnWebKitAnimationEnd):
+        (WebCore::setJSDOMWindowBaseOnWebKitTransitionEnd):
+        (WebCore::setJSDOMWindowBaseEvent):
+        (WebCore::setJSDOMWindowBaseAudio):
+        (WebCore::setJSDOMWindowBaseImage):
+        (WebCore::setJSDOMWindowBaseMessageChannel):
+        (WebCore::setJSDOMWindowBaseOption):
+        (WebCore::setJSDOMWindowBaseXMLHttpRequest):
+        (WebCore::setJSDOMWindowBaseXSLTProcessor):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::nonCachingStaticCloseFunctionGetter):
+        (WebCore::nonCachingStaticBlurFunctionGetter):
+        (WebCore::nonCachingStaticFocusFunctionGetter):
+        (WebCore::nonCachingStaticPostMessageFunctionGetter):
+        * bindings/js/JSDOMWindowCustom.h:
+        (WebCore::JSDOMWindow::customGetOwnPropertySlot):
+        * bindings/js/JSEventTargetBase.cpp:
+        * bindings/js/JSEventTargetBase.h:
+        (WebCore::JSEventTargetBasePrototype::getOwnPropertySlot):
+        (WebCore::JSEventTargetBasePrototype::classInfo):
+        * bindings/js/JSEventTargetNode.cpp:
+        (WebCore::):
+        (WebCore::JSEventTargetNode::getOwnPropertySlot):
+        (WebCore::JSEventTargetNode::put):
+        * bindings/js/JSEventTargetNode.h:
+        (WebCore::JSEventTargetNode::classInfo):
+        (WebCore::JSEventTargetNode::prototypeClassName):
+        * bindings/js/JSEventTargetSVGElementInstance.cpp:
+        (WebCore::):
+        (WebCore::JSEventTargetSVGElementInstance::getOwnPropertySlot):
+        (WebCore::JSEventTargetSVGElementInstance::put):
+        * bindings/js/JSEventTargetSVGElementInstance.h:
+        (WebCore::JSEventTargetSVGElementInstance::classInfo):
+        (WebCore::JSEventTargetSVGElementInstance::prototypeClassName):
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        (WebCore::JSHTMLInputElement::customGetOwnPropertySlot):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::nonCachingStaticBackFunctionGetter):
+        (WebCore::nonCachingStaticForwardFunctionGetter):
+        (WebCore::nonCachingStaticGoFunctionGetter):
+        (WebCore::JSHistory::customGetOwnPropertySlot):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::nonCachingStaticReplaceFunctionGetter):
+        (WebCore::nonCachingStaticReloadFunctionGetter):
+        (WebCore::nonCachingStaticAssignFunctionGetter):
+        (WebCore::JSLocation::customGetOwnPropertySlot):
+        (WebCore::JSLocation::customPut):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2008-09-26  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21149
+
+        Make the concept of scroll modes cross-platform.  Move the scrollbars up into ScrollView as well.
+        Eliminate the unused isScrollable() method.
+
+        Reviewed by Sam Weinig
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::resetScrollbars):
+        (WebCore::FrameView::initScrollbars):
+        (WebCore::FrameView::layout):
+        * page/FrameView.h:
+        * page/mac/WebCoreFrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::init):
+        (WebCore::ScrollView::setScrollbarModes):
+        (WebCore::ScrollView::scrollbarModes):
+        (WebCore::ScrollView::platformSetScrollbarModes):
+        (WebCore::ScrollView::platformScrollbarModes):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::horizontalScrollbar):
+        (WebCore::ScrollView::verticalScrollbar):
+        (WebCore::ScrollView::isScrollViewScrollbar):
+        (WebCore::ScrollView::setHorizontalScrollbarMode):
+        (WebCore::ScrollView::setVerticalScrollbarMode):
+        (WebCore::ScrollView::horizontalScrollbarMode):
+        (WebCore::ScrollView::verticalScrollbarMode):
+        (WebCore::ScrollView::convertSelfToChild):
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
+        (WebCore::ScrollView::ScrollViewPrivate::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::ScrollViewPrivate::setHasVerticalScrollbar):
+        (WebCore::ScrollView::ScrollViewPrivate::valueChanged):
+        (WebCore::ScrollView::updateScrollbars):
+        (WebCore::ScrollView::scrollbarUnderMouse):
+        (WebCore::ScrollView::isScrollViewScrollbar):
+        (WebCore::ScrollView::paint):
+        (WebCore::ScrollView::scroll):
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::platformSetScrollbarModes):
+        (WebCore::ScrollView::platformScrollbarModes):
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::ScrollViewPrivate::setHasVerticalScrollbar):
+        (WebCore::ScrollView::ScrollViewPrivate::valueChanged):
+        (WebCore::ScrollView::horizontalScrollbar):
+        (WebCore::ScrollView::verticalScrollbar):
+        (WebCore::ScrollView::invalidateScrollbars):
+        (WebCore::ScrollView::updateScrollbars):
+        (WebCore::ScrollView::scrollbarUnderMouse):
+        (WebCore::ScrollView::paint):
+        (WebCore::ScrollView::scroll):
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
+        (WebCore::ScrollView::ScrollViewPrivate::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::ScrollViewPrivate::setHasVerticalScrollbar):
+        (WebCore::ScrollView::ScrollViewPrivate::valueChanged):
+        (WebCore::ScrollView::ScrollViewPrivate::setAllowsScrolling):
+        (WebCore::ScrollView::ScrollViewPrivate::allowsScrolling):
+        (WebCore::ScrollView::suppressScrollbars):
+        (WebCore::ScrollView::updateScrollbars):
+        (WebCore::ScrollView::scrollbarUnderMouse):
+        (WebCore::ScrollView::paint):
+        (WebCore::ScrollView::scroll):
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::platformSetScrollbarModes):
+        (WebCore::ScrollView::platformScrollbarModes):
+
+2008-09-26  David Kilzer  <ddkilzer@apple.com>
+
+        Fix Mac build with XPATH and XSLT disabled
+
+        Reviewed by Alexey.
+
+        * bindings/objc/DOMUtility.mm:
+        (JSC::createDOMWrapper): Conditionalize code with ENABLE(XPATH).
+        * dom/XMLTokenizerLibxml2.cpp:
+        (WebCore::errorFunc): Conditionalize method with ENABLE(XSLT) to
+        prevent an unused code warning.
+
+2008-09-26  Kevin McCullough  <kmccullough@apple.com>
+
+        Rubber stamped by Tim Hatcher.
+
+        Bug 21098: Crashing under Console::log
+        - Speculative ASSERT to help find the problem.
+
+        * page/InspectorController.cpp:
+        (WebCore::ConsoleMessage::isEqual):
+
+2008-09-26  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        [gtk+] Build fix for the latest ScrollView changes
+
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::adjustmentChanged):
+        (WebCore::ScrollView::ScrollViewPrivate::valueChanged):
+
+2008-09-26  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes a bug where the console message repeat count would be wrong
+        when typing commands in between repeated messages.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21145
+
+        Reviewed by Kevin McCullough.
+
+        * page/InspectorController.cpp:
+        (WebCore::InspectorController::clearConsoleMessages): Reset m_groupLevel.
+        (WebCore::InspectorController::didCommitLoad): Call clearConsoleMessages.
+        * page/inspector/Console.js:
+        (WebInspector.Console.prototype.addMessage): Remember the original repeat count
+        for each message as totalRepeatCount, since we now modify repeatCount to mean
+        repeats since previous console command. If repeatCountBeforeCommand is a number,
+        subtract that value from the repeatCount.
+        (WebInspector.Console.prototype.clearMessages): Delete the repeatCountBeforeCommand
+        and commandSincePreviousMessage properties.
+
+2008-09-26  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Antti
+
+        https://bugs.webkit.org/show_bug.cgi?id=21116
+        <rdar://problem/5726325> Audio from <video> can still be heard after navigating
+        back to page with <video>, then closing tab
+
+        Rename willSaveToCache/didRestoreFromCache callbacks to documentWillBecomeInactive/
+        documentDidBecomeActive, and post documentWillBecomeInactive when a page is marked for
+        deletion.
+
+        * dom/Document.cpp:
+        (WebCore::Document::documentWillBecomeInactive):
+        (WebCore::Document::documentDidBecomeActive):
+        (WebCore::Document::registerForDocumentActivationCallbacks):
+        (WebCore::Document::unregisterForDocumentActivationCallbacks):
+        * dom/Document.h:
+        * dom/Element.h:
+        (WebCore::Element::documentWillBecomeInactive):
+        (WebCore::Element::documentDidBecomeActive):
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::CachedPage):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::~HTMLFormElement):
+        (WebCore::HTMLFormElement::parseMappedAttribute):
+        (WebCore::HTMLFormElement::documentDidBecomeActive):
+        (WebCore::HTMLFormElement::willMoveToNewOwnerDocument):
+        (WebCore::HTMLFormElement::didMoveToNewOwnerDocument):
+        * html/HTMLFormElement.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::~HTMLInputElement):
+        (WebCore::HTMLInputElement::setInputType):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::needsActivationCallback):
+        (WebCore::HTMLInputElement::registerForActivationCallbackIfNeeded):
+        (WebCore::HTMLInputElement::unregisterForActivationCallbackIfNeeded):
+        (WebCore::HTMLInputElement::documentDidBecomeActive):
+        (WebCore::HTMLInputElement::willMoveToNewOwnerDocument):
+        (WebCore::HTMLInputElement::didMoveToNewOwnerDocument):
+        * html/HTMLInputElement.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement):
+        (WebCore::HTMLMediaElement::~HTMLMediaElement):
+        (WebCore::HTMLMediaElement::documentWillBecomeInactive):
+        (WebCore::HTMLMediaElement::documentDidBecomeActive):
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::inActiveDocument):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::opened):
+        * page/Page.cpp:
+        (WebCore::Page::~Page):
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::updateControls):
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::updatePlayer):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::SVGSVGElement):
+        (WebCore::SVGSVGElement::~SVGSVGElement):
+        (WebCore::SVGSVGElement::documentWillBecomeInactive):
+        (WebCore::SVGSVGElement::documentDidBecomeActive):
+        * svg/SVGSVGElement.h:
+
+2008-09-26  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Simon
+
+        Fix the build inside Qt, don't create faulty prl files for now.
+
+        * WebCore.pro:
+
+2008-09-26  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix compilation on Qt/Windows
+
+        * Add WebCore/ to the include path so that config.h is found that enables JSC
+        * Link against winmm for the multimedia timer functions
+        * Include DateMath.h instead of JavaScriptCore/DateMath.h as file is in the kjs/
+        subdirectory
+        * In PluginViewWin.cpp don't use setPlatformWidget with the HWND for the Qt/Windows port
+        but set m_window directly as setPlatformWidget takes a QWidget*.
+
+        * WebCore.pro:
+        * platform/win/SystemTimeWin.cpp:
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::init):
+
+2008-09-26  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 21054: Construction of certain DOM objects is heavily regressed by r36675
+        <https://bugs.webkit.org/show_bug.cgi?id=21054>
+
+        This performance regression is actually just a symptom of a correctness
+        bug.  The constructor objects for a number of properties that have security
+        checks on access were returning new objects each time.  The most obvious
+        symptom of this bug is that window.Image != window.Image, etc.
+
+        The solution to this is to make sure we cache these constructors
+        in the same way as all the other DOM constructors.  To achieve this
+        without causing any refcount cycles it is necessary to replace the
+        refcounted document pointer in the Image, MessageChannel, Option,
+        XMLHttpRequest, and Audio constructor objects with a reference to
+        the document's JS wrapper.
+
+        Tests: fast/dom/constructors-cached-navigate.html
+               fast/dom/constructors-cached.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::mark):
+        * bindings/js/JSAudioConstructor.h:
+        (WebCore::JSAudioConstructor::document):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::getDOMConstructor):
+        (WebCore::JSDOMWindowBase::getValueProperty):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSHTMLOptionElementConstructor.cpp:
+        (WebCore::JSHTMLOptionElementConstructor::mark):
+        * bindings/js/JSHTMLOptionElementConstructor.h:
+        (WebCore::JSHTMLOptionElementConstructor::document):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::mark):
+        * bindings/js/JSImageConstructor.h:
+        (WebCore::JSImageConstructor::document):
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::mark):
+        * bindings/js/JSXMLHttpRequestConstructor.h:
+        (WebCore::JSXMLHttpRequestConstructor::document):
+
+2008-09-26  Simon Hausmann  <hausmann@webkit.org>
+
+        Unreviewed one-liner build fix for the Qt/Windows build.
+
+        The build requires NPAPI support to be enabled, fix the condition in
+        the .pro file for that.
+
+        * WebCore.pro:
+
+2008-09-26  Trenton Schulz <twschulz@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix compilation with the Qt/Cocoa port.
+
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+2008-09-26  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Holger.
+
+        Fix compilation with VC9SP1, work around bug in TR1 library by
+        disabling it.
+
+        * WebCore.pro:
+
+2008-09-26  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Holger.
+
+        Fix an lupdate() warning.
+
+        Don't use tr() in a class that is not a QObject, use
+        QCoreApplication::translate() directly.
+
+        * platform/qt/ScrollbarQt.cpp:
+        (WebCore::Scrollbar::handleContextMenuEvent):
+
+2008-09-25  David Hyatt  <hyatt@apple.com>
+
+        Remove the scrollTo() method from FrameView, since it is not used by anyone.
+
+        Reviewed by Oliver Hunt
+
+        * page/FrameView.cpp:
+        * page/FrameView.h:
+
+2008-09-25  David Hyatt  <hyatt@apple.com>
+
+        Make scrollRectIntoViewRecursively cross-platform.
+
+        Reviewed by Oliver Hunt
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::scrollRectIntoViewRecursively):
+        * platform/gtk/ScrollViewGtk.cpp:
+        * platform/mac/ScrollViewMac.mm:
+        * platform/qt/ScrollViewQt.cpp:
+        * platform/win/ScrollViewWin.cpp:
+        * platform/wx/ScrollViewWx.cpp:
+
+2008-09-25  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21133
+
+        Rename resizeContents method on ScrollView to setContentsSize (to match contentsSize()).  Make it
+        cross-platform.
+
+        Reviewed by Oliver Hunt
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::adjustViewSize):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::setContentsSize):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/gtk/ScrollViewGtk.cpp:
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::platformSetContentsSize):
+        * platform/qt/ScrollViewQt.cpp:
+        * platform/win/ScrollViewWin.cpp:
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::platformSetContentsSize):
+
+2008-09-25  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21132
+
+        Clean up the methods that actually do the scrolling in ScrollView.
+
+        Reviewed by Oliver Hunt
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::setScrollLeft):
+        (WebCore::HTMLBodyElement::setScrollTop):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::restoreScrollPositionAndViewState):
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageDocument::imageClicked):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::scrollBy):
+        (WebCore::DOMWindow::scrollTo):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollTo):
+        (WebCore::FrameView::setScrollPosition):
+        * page/FrameView.h:
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::maximumScrollPosition):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::contentsWidth):
+        (WebCore::ScrollView::contentsHeight):
+        (WebCore::ScrollView::scrollBy):
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::setScrollPosition):
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::setScrollPosition):
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::setScrollPosition):
+        (WebCore::ScrollView::scrollRectIntoViewRecursively):
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::setScrollPosition):
+        (WebCore::ScrollView::scrollRectIntoViewRecursively):
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::setScrollPosition):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollByRecursively):
+        (WebCore::RenderLayer::scrollRectToVisible):
+
+2008-09-25  Dan Bernstein  <mitz@apple.com>
+
+        - attempted Windows build fix
+
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::valueChanged):
+        (WebCore::ScrollView::setContentsPos):
+        (WebCore::ScrollView::paint):
+
+2008-09-25  Timothy Hatcher  <timothy@apple.com>
+
+        Revert the padding changes done in r36905 to prevent the
+        scrollbar from overlapping the URLs in the Console.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21126
+
+        * page/inspector/inspector.css:
+
+2008-09-25  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21129
+
+        Refactor contents size and scroll offset to be cross-platform.  Reduce further the number
+        of platform-specific methods required of ScrollView implementations.
+
+        Reviewed by Tim Hatcher
+
+        * dom/MouseRelatedEvent.cpp:
+        (WebCore::contentsX):
+        (WebCore::contentsY):
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::scrollLeft):
+        (WebCore::HTMLBodyElement::setScrollLeft):
+        (WebCore::HTMLBodyElement::scrollTop):
+        (WebCore::HTMLBodyElement::setScrollTop):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::saveScrollPositionAndViewStateToItem):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::scrollX):
+        (WebCore::DOMWindow::scrollY):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::scrollTo):
+        (WebCore::FrameView::windowClipRect):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::visibleContentRect):
+        (WebCore::ScrollView::contentsSize):
+        (WebCore::ScrollView::platformContentsSize):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::scrollPosition):
+        (WebCore::ScrollView::scrollOffset):
+        (WebCore::ScrollView::scrollX):
+        (WebCore::ScrollView::scrollY):
+        (WebCore::ScrollView::contentsWidth):
+        (WebCore::ScrollView::contentsHeight):
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::adjustmentChanged):
+        (WebCore::ScrollView::setGtkAdjustments):
+        (WebCore::ScrollView::resizeContents):
+        (WebCore::ScrollView::contentsWidth):
+        (WebCore::ScrollView::contentsHeight):
+        (WebCore::ScrollView::scrollOffset):
+        (WebCore::ScrollView::maximumScroll):
+        (WebCore::ScrollView::scrollBy):
+        (WebCore::ScrollView::suppressScrollbars):
+        (WebCore::ScrollView::setHScrollbarMode):
+        (WebCore::ScrollView::setVScrollbarMode):
+        (WebCore::ScrollView::setScrollbarsMode):
+        (WebCore::ScrollView::setFrameGeometry):
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::platformContentsSize):
+        (WebCore::ScrollView::scrollBy):
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::convertFromContainingWindow):
+        (WebCore::Widget::convertToContainingWindow):
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::valueChanged):
+        (WebCore::ScrollView::resizeContents):
+        (WebCore::ScrollView::setFrameGeometry):
+        (WebCore::ScrollView::scrollOffset):
+        (WebCore::ScrollView::maximumScroll):
+        (WebCore::ScrollView::scrollBy):
+        (WebCore::ScrollView::setHScrollbarMode):
+        (WebCore::ScrollView::setVScrollbarMode):
+        (WebCore::ScrollView::setScrollbarsMode):
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::valueChanged):
+        (WebCore::ScrollView::ScrollViewPrivate::setAllowsScrolling):
+        (WebCore::ScrollView::resizeContents):
+        (WebCore::ScrollView::setFrameGeometry):
+        (WebCore::ScrollView::scrollOffset):
+        (WebCore::ScrollView::maximumScroll):
+        (WebCore::ScrollView::scrollBy):
+        (WebCore::ScrollView::setHScrollbarMode):
+        (WebCore::ScrollView::setVScrollbarMode):
+        (WebCore::ScrollView::setScrollbarsMode):
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::platformVisibleContentRect):
+        (WebCore::ScrollView::platformContentsSize):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::nodeAtPoint):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollRectToVisible):
+        (WebCore::RenderLayer::calculateClipRects):
+        (WebCore::RenderLayer::calculateRects):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::absolutePosition):
+        (WebCore::RenderView::computeAbsoluteRepaintRect):
+
+2008-09-25  David Smith  <catfish.man@gmail.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix a nasty regression I introduced in the previous commit, which caused infinite recursion on facebook.
+
+        * dom/Element.cpp:
+        (WebCore::Element::rareData):
+        * dom/Element.h:
+        * dom/Node.cpp:
+        (WebCore::Node::rareData):
+        * dom/Node.h:
+
+2008-09-25  David Smith  <catfish.man@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20980
+        Split off uncommonly used data from Node similar to ElementRareData
+
+        Saves an OwnPtr and a short on Node, as well as providing room for an isContainer bit,
+        which in turn allows inlining firstChild(), lastChild(), childNodeCount(), and childNode()
+        for a 5-10+% performance win on SlickSpeed and assorted speedups on other tests.
+
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/ChildNodeList.cpp: Include ContainerNode to pick up its definitions for childNodeCount(), etc...
+        * dom/ContainerNode.cpp: Set isContainer to true
+        (WebCore::ContainerNode::ContainerNode):
+        * dom/ContainerNode.h: These Node inlines are here to avoid including ContainerNode.h in Node.h
+        (WebCore::Node::containerChildNodeCount): Use ContainerNode's definition, having proved that the Node is a container
+        (WebCore::Node::containerChildNode): ditto
+        (WebCore::Node::containerFirstChild): ditto
+        (WebCore::Node::containerLastChild): ditto
+        * dom/Element.cpp: Most of the changes here are moving ElementRareData to ElementRareData.h and NodeRareData.h
+        (WebCore::Element::Element):
+        (WebCore::Element::~Element):
+        (WebCore::Element::rareData):
+        (WebCore::Element::ensureRareData): Renamed from createRareData
+        (WebCore::Element::createRareData): Used by ensureRareData to get the correct rareData type
+        (WebCore::Element::attach): Check hasRareData rather than null-checking rareData()
+        (WebCore::Element::detach): ditto
+        (WebCore::Element::recalcStyle): ditto
+        (WebCore::Element::focus):
+        (WebCore::Element::minimumSizeForResizing): ditto
+        (WebCore::Element::setMinimumSizeForResizing): ditto
+        (WebCore::Element::computedStyle):
+        (WebCore::Element::cancelFocusAppearanceUpdate): ditto
+        * dom/Element.h:
+        * dom/ElementRareData.h: Added; everything copied from Element.cpp
+        (WebCore::defaultMinimumSizeForResizing):
+        (WebCore::ElementRareData::ElementRareData):
+        (WebCore::ElementRareData::resetComputedStyle):
+        * dom/EventTargetNode.cpp:
+        (WebCore::EventTargetNode::EventTargetNode): Pass the isContainer flag up the chain
+        * dom/EventTargetNode.h:
+        * dom/Node.cpp:
+        (WebCore::Node::Node):
+        (WebCore::Node::~Node): rareData cleanup code moved from Element and changed to use hasRareData
+        (WebCore::Node::rareData):
+        (WebCore::Node::ensureRareData):
+        (WebCore::Node::createRareData):
+        (WebCore::Node::tabIndex): nonzero tab indexes are now in rareData
+        (WebCore::Node::setTabIndexExplicitly):
+        (WebCore::Node::childNodes): NodeLists are now in rareData
+        (WebCore::Node::setFocus):
+        (WebCore::Node::rareDataFocused):
+        (WebCore::Node::isFocusable):
+        (WebCore::Node::isKeyboardFocusable):
+        (WebCore::Node::registerDynamicNodeList): NodeLists are now in rareData
+        (WebCore::Node::unregisterDynamicNodeList): ditto
+        (WebCore::Node::notifyLocalNodeListsAttributeChanged): ditto
+        (WebCore::Node::notifyLocalNodeListsChildrenChanged): ditto
+        (WebCore::Node::getElementsByName): ditto
+        (WebCore::Node::getElementsByClassName): ditto
+        * dom/Node.h:
+        (WebCore::Node::firstChild): Use isContainerNode() to devirtualize
+        (WebCore::Node::lastChild): ditto
+        (WebCore::Node::isContainerNode): Take advantage of a newly freed bit to store whether we're a container
+        (WebCore::Node::focused): focus is in rareData if set
+        (WebCore::Node::childTypeAllowed):
+        (WebCore::Node::childNodeCount): Use isContainerNode() to devirtualize
+        (WebCore::Node::childNode): ditto
+        (WebCore::Node::hasRareData): Use another newly freed bit to store whether we have rare data; avoids doing hash lookups in the common case
+        * dom/NodeRareData.h: Added. Most of this is just properties moved from Node
+        (WebCore::NodeListsNodeData::~NodeListsNodeData): Moved from Node.cpp since we NodeRareData needs to put them in a HashTable :(
+        (WebCore::NodeRareData::NodeRareData):
+        (WebCore::NodeRareData::rareDataMap):
+        (WebCore::NodeRareData::rareDataFromMap):
+        (WebCore::NodeRareData::clearNodeLists):
+        (WebCore::NodeRareData::setNodeLists):
+        (WebCore::NodeRareData::nodeLists):
+        (WebCore::NodeRareData::tabIndex):
+        (WebCore::NodeRareData::setTabIndex):
+        (WebCore::NodeRareData::tabIndexSetExplicitly):
+        * dom/TreeWalker.cpp: Include ContainerNode to pick up its definitions for childNodeCount(), etc...
+        * xml/XPathUtil.cpp: Include ContainerNode to pick up its definitions for childNodeCount(), etc...
+
+2008-09-25  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [qt] ImageBuffer::toDataURL implementation
+
+        There needs to be a Qt specific test result for the above mentioned
+        implementation.
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::toDataURL):
+
+2008-09-25  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [qt] Implement SharedBuffer for Qt.
+
+        * WebCore.pro:
+        * platform/qt/SharedBufferQt.cpp: Added.
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+        * platform/qt/TemporaryLinkStubs.cpp:
+
+2008-09-25  Feng Qian <feng@chromium.org>
+
+        Fix bug: https://bugs.webkit.org/show_bug.cgi?id=21032
+        <rdar://problem/6243032>
+
+        Reviewed by Dave Hyatt.
+
+        Test: fast/dom/attribute-downcast-right.html
+
+        Add isMappedAttribute function to Attribute for checking if an object
+        is an instance of MappedAttribute. Removed attributeItem,
+        getAttributeItem functions from NamedMappedAttrMap, and callers
+        expecting MappedAttribute have to check isMappedAttribute before
+        downcasting the return value to MappedAttribute.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::styleForElement):
+        * dom/Attribute.h:
+        (WebCore::Attribute::isMappedAttribute):
+        * dom/MappedAttribute.h:
+        (WebCore::MappedAttribute::isMappedAttribute):
+        * dom/NamedMappedAttrMap.cpp:
+        (WebCore::NamedMappedAttrMap::declCount):
+        (WebCore::NamedMappedAttrMap::mapsEquivalent):
+        * dom/NamedMappedAttrMap.h:
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::attributeChanged):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::setInputType):
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::addCSSPropertyAndNotifyAttributeMap):
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::getPresentationAttribute):
+
+2008-09-25  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21120
+
+        Make visibleContentRect cross-platform.  Note this does add new horizontal/verticalScrollbar accessors
+        to a bunch of platforms.  This is a temporary evil until the scrollbars get made cross-platform (and I
+        didn't want to mix that change in with this patch).
+
+        Reviewed by Sam Weinig
+
+        * page/Frame.cpp:
+        (WebCore::Frame::markAllMatchesForText):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::repaintContentRectangle):
+        (WebCore::FrameView::windowClipRect):
+        (WebCore::FrameView::updateControlTints):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::visibleContentRect):
+        (WebCore::ScrollView::platformVisibleContentRect):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::visibleWidth):
+        (WebCore::ScrollView::visibleHeight):
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::horizontalScrollbar):
+        (WebCore::ScrollView::verticalScrollbar):
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::horizontalScrollbar):
+        (WebCore::ScrollView::verticalScrollbar):
+        (WebCore::ScrollView::platformVisibleContentRect):
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::horizontalScrollbar):
+        (WebCore::ScrollView::verticalScrollbar):
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::horizontalScrollbar):
+        (WebCore::ScrollView::verticalScrollbar):
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::platformVisibleContentRect):
+        (WebCore::ScrollView::horizontalScrollbar):
+        (WebCore::ScrollView::verticalScrollbar):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::scrollRectToVisible):
+        (WebCore::frameVisibleRect):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::viewRect):
+
+2008-09-25  David Smith  <catfish.man@gmail.com>
+
+        Reviewed by Timothy Hatcher
+
+        https://bugs.webkit.org/show_bug.cgi?id=21052
+        Generalize id selector special case for querySelectorAll
+
+        By checking the element we get with getElementById against the selector, we can use the special case in many more circumstances.
+        Changes results on http://native.khan.mozilla.org
+        from
+            #title: 2ms
+            h1#title: 55ms
+            div #title: 55ms
+
+        to:
+            #title: 1ms
+            h1#title: 2ms
+            div #title: 5ms
+
+        * dom/Node.cpp:
+        (WebCore::Node::querySelector):
+        * dom/SelectorNodeList.cpp:
+        (WebCore::createSelectorNodeList):
+
+2008-09-25  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21118
+
+        Make the concept of whether you can blit on scroll cross-platform on ScrollView.
+
+        Reviewed by Sam Weinig
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::clear):
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::setUseSlowRepaints):
+        (WebCore::FrameView::addSlowRepaintObject):
+        (WebCore::FrameView::removeSlowRepaintObject):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::init):
+        (WebCore::ScrollView::addChild):
+        (WebCore::ScrollView::removeChild):
+        (WebCore::ScrollView::setCanBlitOnScroll):
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::canBlitOnScroll):
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
+        (WebCore::ScrollView::ScrollViewPrivate::scrollBackingStore):
+        (WebCore::ScrollView::ScrollView):
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::platformAddChild):
+        (WebCore::ScrollView::platformRemoveChild):
+        (WebCore::ScrollView::platformSetCanBlitOnScroll):
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
+        (WebCore::ScrollView::ScrollViewPrivate::scrollBackingStore):
+        (WebCore::ScrollView::ScrollView):
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
+        (WebCore::ScrollView::ScrollViewPrivate::scrollBackingStore):
+        (WebCore::ScrollView::ScrollView):
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::scrollBy):
+
+2008-09-25  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Bug 21109: Console should right-align urls
+
+        * page/inspector/Console.js: Re-order the message elements so that when
+        it overflows it doesn't get mixed in with the next message.
+        * page/inspector/inspector.css:
+
+2008-09-25  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21113
+
+        Putting r36771 back in with a fix to the addPendingSheet check in CSSImportRule::insertedIntoParent.
+
+        Reviewed by Darin Adler
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::insertedIntoParent):
+        * css/CSSRule.cpp:
+        (WebCore::CSSRule::parentStyleSheet):
+        (WebCore::CSSRule::parentRule):
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::CSSStyleSheet):
+        * css/CSSStyleSheet.h:
+
+2008-09-25  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=21115
+          <rdar://problem/6245773> REGRESSION (r34702): Safari no longer zips
+          bundled documents
+
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::formData): Use files() instead of value()
+        to get the path, since value() now returns just the basename.
+
+2008-09-25  Brady Eidson  <beidson@apple.com>
+
+        Rubberstamped by Mark Rowe
+
+        Roll out 36771 as it caused <rdar://problem/6246554>
+        "nytimes.com doesn't display after returning to it with back/forward"
+
+        * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::insertedIntoParent):
+        * css/CSSRule.cpp:
+        (WebCore::CSSRule::parentStyleSheet):
+        (WebCore::CSSRule::parentRule):
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::CSSStyleSheet):
+        (WebCore::CSSStyleSheet::docLoader):
+        * css/CSSStyleSheet.h:
+        (WebCore::CSSStyleSheet::doc):
+
+2008-09-25  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * WebCore.vcproj/WebCore.vcproj: Add ScrollView.cpp to the project.
+
+2008-09-25  Dan Bernstein  <mitz@apple.com>
+
+        - Windows build fix
+
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::addChildPlatformWidget):
+        (WebCore::ScrollView::removeChildPlatformWidget):
+
+2008-09-25  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes a leak of ConsoleMessage seen when repeated console
+        messages occur.
+
+        Reviewed by Mark Rowe.
+
+        * page/InspectorController.cpp:
+        (WebCore::InspectorController::addConsoleMessage): Delete the repeat
+        since we don't add it to m_consoleMessages.
+
+2008-09-25  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Bug 21105: XHRs logged in the console may show the wrong URL for the
+        source
+        - Get the url at the time of the send() and pass it on to the XHR.
+
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::didFinishLoading):
+        * xml/XMLHttpRequest.h:
+        (WebCore::XMLHttpRequest::setLastSendURL):
+
+2008-09-25  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoff and Tim.
+
+        Bug 20322: XHRs logged in the console do not have line numbers
+        - Get the line number at the time of the send and pass it on to the XHR.
+
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::didFinishLoading):
+        * xml/XMLHttpRequest.h:
+        (WebCore::XMLHttpRequest::setLastSendLineNumber):
+
+2008-09-25  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        <rdar://problem/6171047> HTMLMediaElement "begin" event is now "loadstart"
+        https://bugs.webkit.org/show_bug.cgi?id=21003
+
+        * dom/EventNames.h: remove "begin" event
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::load): Post "loadstart" event instead of "begin"
+
+2008-09-25  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21097
+        Calling a MessageChannel constructor from a destroyed document results in a crash
+
+        Test: fast/events/message-port-constructor-for-deleted-document.html
+
+        * bindings/js/JSMessageChannelConstructor.cpp:
+        (WebCore::JSMessageChannelConstructor::construct):
+        * bindings/js/JSMessageChannelConstructor.h:
+        Made m_document a RefPtr.
+
+2008-09-24  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Sam Weinig, Anders Carlsson, and (unofficially) Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20879
+        Implement HTML5 channel messaging
+
+        Tests: fast/events/message-channel-gc.html
+               fast/events/message-port-deleted-document.html
+               fast/events/message-port-deleted-frame.html
+               fast/events/message-port-inactive-document.html
+               fast/events/message-port.html
+               http/tests/security/MessagePort/event-listener-context.html
+
+        * Configurations/WebCore.xcconfig:
+        Removed unused  ENABLE_CROSS_DOCUMENT_MESSAGING macro.
+
+        * DerivedSources.make:
+        Added MessageChannel and MessagePort.
+
+        * WebCore.pro: Made MessageEvent compilation unconditional, as it could not possibly be
+        turmed off anyway. Added new files.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        Added new files.
+
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowBase.cpp: (WebCore::JSDOMWindowBase::getValueProperty):
+        Added suport for window.MessageChannel constructor.
+
+        * bindings/js/JSDOMWindowCustom.cpp: (WebCore::JSDOMWindow::postMessage):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::postMessage):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        Added support for three-argument postMessage (that posts a MessagePort).
+
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::toMessagePort):
+        * dom/EventTarget.h:
+        * bindings/js/JSEventTargetBase.cpp: (WebCore::toJS): Added MessagePort as yet another
+        EventTarget variant.
+
+        * bindings/js/JSMessageChannelConstructor.h:
+        * bindings/js/JSMessageChannelConstructor.cpp: Added a custom constructor, so that it could
+        take a browsing context (document) parameter.
+
+        * bindings/js/JSMessageChannelCustom.cpp: Added.
+        (WebCore::JSMessageChannel::mark): JSMessageChannel uses a custom mark function to mark
+        port1 and port2 that it owns.
+
+        * bindings/js/JSMessagePortCustom.cpp: Added.
+        (WebCore::JSMessagePort::startConversation):
+        (WebCore::JSMessagePort::addEventListener):
+        (WebCore::JSMessagePort::removeEventListener):
+        (WebCore::JSMessagePort::dispatchEvent):
+        (WebCore::JSMessagePort::setOnmessage):
+        (WebCore::JSMessagePort::onmessage):
+        (WebCore::JSMessagePort::setOnclose):
+        (WebCore::JSMessagePort::onclose):
+        (WebCore::JSMessagePort::mark):
+        * dom/MessagePort.cpp: Added.
+        * dom/MessagePort.h: Added.
+        * dom/MessagePort.idl: Added.
+        Added a MessagePort implementation. Currently, it is not thread-safe at all, and only works
+        with Documents as contexts, but in the future, it will be used for communication with worker
+        threads.
+
+        * bindings/objc/DOMInternal.h: Include "DOMMessagePortInternal.h". The new APIs do not
+        really have Obj-C bindings, as they are far from being final, but a MessagePort stub is
+        needed for MessageEvent.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Include PlatformString.h for MessagePort happiness.
+
+        * dom/Document.cpp:
+        (WebCore::MessagePortTimer::MessagePortTimer):
+        (WebCore::MessagePortTimer::fired):
+        (WebCore::Document::processMessagePortMessagesSoon):
+        (WebCore::Document::~Document):
+        (WebCore::Document::dispatchMessagePortEvents):
+        (WebCore::Document::createdMessagePort):
+        (WebCore::Document::destroyedMessagePort):
+        * dom/Document.h:
+        Document keeps track of all MessagePort objects that were created when it was fully active
+        in its context.
+
+        * dom/EventNames.h: Added closeEvent.
+
+        * dom/MessageChannel.cpp: Added.
+        (WebCore::MessageChannel::MessageChannel):
+        (WebCore::MessageChannel::~MessageChannel):
+        * dom/MessageChannel.h: Added.
+        (WebCore::MessageChannel::create):
+        (WebCore::MessageChannel::port1):
+        (WebCore::MessageChannel::port2):
+        * dom/MessageChannel.idl: Added.
+        Addded JSMessageChannel implementation.
+
+        * dom/MessageEvent.cpp:
+        (WebCore::MessageEvent::MessageEvent):
+        (WebCore::MessageEvent::initMessageEvent):
+        * dom/MessageEvent.h:
+        (WebCore::MessageEvent::create):
+        (WebCore::MessageEvent::messagePort):
+        * dom/MessageEvent.idl:
+        MessageEvent has a MessagePort member now, making it possible to pass ports across
+        documents.
+
+2008-09-25  David Smith  <catfish.man@gmail.com>
+
+        Reviewed by Eric Seidel
+
+        fix https://bugs.webkit.org/show_bug.cgi?id=21091
+        Regression: querySelector matches tag names case sensitively
+
+        Tests: fast/dom/SelectorAPI/caseTag.html
+               fast/dom/SelectorAPI/caseTagX.xhtml
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseSelector): Add a Document argument, since tag case sensitivity is different for HTML documents
+        * css/CSSParser.h:
+        * dom/Node.cpp:
+        (WebCore::Node::querySelector):
+        (WebCore::Node::querySelectorAll):
+
+2008-09-24  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21084
+
+        Make the m_children member of ScrollView cross-platform.  Consolidate children add/remove
+        functionality.  Add platform stubs for connecting/disconnecting the platform widgets.
+
+        Reviewed by Sam Weinig
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::children):
+        * platform/Widget.h:
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::addChildPlatformWidget):
+        (WebCore::ScrollView::removeChildPlatformWidget):
+        (WebCore::ScrollView::geometryChanged):
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::addChildPlatformWidget):
+        (WebCore::ScrollView::removeChildPlatformWidget):
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::geometryChanged):
+        (WebCore::ScrollView::addChildPlatformWidget):
+        (WebCore::ScrollView::removeChildPlatformWidget):
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::geometryChanged):
+        (WebCore::ScrollView::setParentVisible):
+        (WebCore::ScrollView::show):
+        (WebCore::ScrollView::hide):
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::addChildPlatformWidget):
+        (WebCore::ScrollView::removeChildPlatformWidget):
+
+2008-09-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=21024
+          <rdar://problem/6240821> Scrollbar not painted until hovered
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::setWidgetGeometry): Replaced resizeWidget with
+        this method, which sets both the location and the size.
+        (WebCore::RenderWidget::setWidget): Replaced the call to resizeWidget
+        with a call to the new method setWidgetGeometry. Positioning the
+        widget correctly ensures that the scroll bars invalidate correctly when
+        they are created and resized.
+        * rendering/RenderWidget.h:
+
+2008-09-24  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        - create a "style" subfolder under "rendering" and move style files to that folder
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2008-09-24  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Remove staticFunctionGetter.  There is only one remaining user of
+        staticFunctionGetter and it can be converted to use setUpStaticFunctionSlot.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::getOwnPropertySlot):
+
+2008-09-24  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Test: editing/spelling/inline_spelling_markers.html
+
+        - https://bugs.webkit.org/show_bug.cgi?id=20092
+        Spelling markers positioned incorrectly in RTL text
+
+        Measure spelling markers with selectionRectForText() to fix RTL.
+
+        This patch also fixes hit-testing for spelling marker tool tips,
+        which used to work only on the first line.
+
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintSpellingOrGrammarMarker):
+
+2008-09-24  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21074
+
+        Make sure the viewless scrollbar knows how to paint properly when transformed.
+
+        Reviewed by Sam Weinig
+
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::ScrollbarThemeMac):
+        (WebCore::ScrollbarThemeMac::paint):
+
+2008-09-24  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Not reviewed. Try to fix win build.
+
+        * bindings/js/JSSVGElementInstanceCustom.cpp:
+        (WebCore::toJS):
+        * dom/ContainerNodeAlgorithms.h:
+        (WebCore::removeAllChildrenInContainer):
+        (WebCore::appendChildToContainer):
+        (WebCore::Private::addChildNodesToDeletionQueue):
+
+2008-09-24  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Oliver.
+
+        Add ContainerNodeAlgorithms.h, as central place to share algorithms
+        operating on TreeShared-derived classes with a Node-style interface.
+
+        This allows SVGElementInstance & ContainerNode to share code.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeAllChildren):
+        (WebCore::ContainerNode::addChild):
+        * dom/ContainerNode.h:
+        * dom/ContainerNodeAlgorithms.h: Added.
+        (WebCore::removeAllChildrenInContainer):
+        (WebCore::appendChildToContainer):
+        (WebCore::Private::NodeRemovalDispatcher::dispatch):
+        (WebCore::Private::addChildNodesToDeletionQueue):
+
+2008-09-24  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Wrap up dirtying the z-order list of the stacking context
+        RenderLayer into a method.
+        https://bugs.webkit.org/show_bug.cgi?id=21072
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::setHasVisibleContent):
+        (WebCore::RenderLayer::addChild):
+        (WebCore::RenderLayer::removeChild):
+        (WebCore::RenderLayer::dirtyStackingContextZOrderLists):
+        (WebCore::RenderLayer::styleChanged):
+        * rendering/RenderLayer.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::setStyle):
+
+2008-09-24  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        Bug 21070: REGRESSION Repeated messages with arguments are not repeated
+        or displayed multiple times
+        - The Insepctor Controller was comparing JSValue pointers so thought the
+        message was not a repeat, but the JS of the inspector compared the
+        strings and so knew it was the same message and so overwrote the old
+        message.
+
+        * page/InspectorController.cpp:
+        (WebCore::ConsoleMessage::isEqual):
+        (WebCore::InspectorController::addMessageToConsole):
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::startGroup):
+        (WebCore::InspectorController::endGroup):
+        * page/InspectorController.h:
+
+2008-09-24  David Hyatt  <hyatt@apple.com>
+
+        Make sure the viewless Mac scrollbar responds properly to system preference changes (including the
+        arrow placement preference and the thumb jump preference).
+
+        Reviewed by Adam Roben
+
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::Scrollbar):
+        (WebCore::Scrollbar::~Scrollbar):
+        * platform/ScrollbarTheme.h:
+        (WebCore::ScrollbarTheme::registerScrollbar):
+        (WebCore::ScrollbarTheme::unregisterScrollbar):
+        * platform/mac/ScrollbarThemeMac.h:
+        * platform/mac/ScrollbarThemeMac.mm:
+        (+[ScrollbarPrefsObserver appearancePrefsChanged:]):
+        (+[ScrollbarPrefsObserver behaviorPrefsChanged:]):
+        (+[ScrollbarPrefsObserver registerAsObserver]):
+        (WebCore::ScrollbarThemeMac::registerScrollbar):
+        (WebCore::ScrollbarThemeMac::unregisterScrollbar):
+        (WebCore::ScrollbarThemeMac::ScrollbarThemeMac):
+        (WebCore::ScrollbarThemeMac::preferencesChanged):
+
+2008-09-24  Rob Buis  <buis@kde.org>
+
+        Reviewed by Darin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20557
+        getScreenCTM() returns wrong values
+
+        Use the absolute position of the svg root when
+        determining the screen ctm.
+
+        Test: svg/custom/getscreenctm-in-mixed-content2.xhtml
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::getScreenCTM):
+
+2008-09-24  David Hyatt  <hyatt@apple.com>
+
+        Turn off support for CSS variables.
+
+        * ChangeLog:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::createVariablesRule):
+        (WebCore::CSSParser::addVariable):
+        (WebCore::CSSParser::addVariableDeclarationBlock):
+
+2008-09-24  David Hyatt  <hyatt@apple.com>
+
+        Back out the alternate forms of CSS variable call syntax (leaving only the -webkit-var version).
+
+        * css/CSSGrammar.y:
+        * css/CSSParserValues.cpp:
+        (WebCore::CSSParserValue::isVariable):
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::cleanup):
+        (WebCore::CSSPrimitiveValue::getStringValue):
+        (WebCore::CSSPrimitiveValue::cssText):
+        (WebCore::CSSPrimitiveValue::parserValue):
+        * css/CSSPrimitiveValue.h:
+        (WebCore::CSSPrimitiveValue::):
+        (WebCore::CSSPrimitiveValue::isVariable):
+
+2008-09-24  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes a regression where the "incorrect MIME-type" warning would not
+        show up correctly in the Console or the resources sidebar.
+
+        Reviewed by Kevin McCullough.
+
+        * page/inspector/Resource.js:
+        (WebInspector.Resource.prototype._addTip): Add the repeat count argument
+        to the WebInspector.ConsoleMessage constructor call.
+        (WebInspector.Resource.prototype._checkWarning): Ditto.
+
+2008-09-23  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Remove deprecated JS Qt bindings object call/construct code and fix autotests
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::QtInstance):
+        * bridge/qt/qt_instance.h:
+
+2008-09-23  Julien Chaffraix  <jchaffraix@pleyo.com>
+
+        Reviewed by Alp Toker. Landed by Jan Alonzo.
+
+        Bug 20883: [CURL] Add deferred loading
+        https://bugs.webkit.org/show_bug.cgi?id=20883
+
+        Implement deferred loading for the libcURL backend using curl_easy_pause.
+        As the method was introduced in version 7.18.0, all the code checks for libcURL
+        version.
+
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::ResourceHandle::setDefersLoading):
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::writeCallback): Add an assertion that deferred loading is not
+        activated.
+        (WebCore::headerCallback): Ditto.
+        (WebCore::readCallback): Ditto.
+        (WebCore::ResourceHandleManager::dispatchSynchronousJob): Force
+        defersLoading to be false in order to avoid triggering an assertion.
+        (WebCore::ResourceHandleManager::initializeHandle): If deferred loading is
+        activated, pause the easy handle.
+
+2008-09-23  Matt Lilek  <webkit@mattlilek.com>
+
+        Reviewed by Tim Hatcher.
+
+        Inspector search field style tweaks.
+
+        * page/inspector/inspector.css:
+
+2008-09-23  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Eric.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=21046 (Several LayoutTests crash)
+
+        Fix missing negation in EventTargetNode::insertedIntoDocument.
+        Made handleLocalEvents() virtual again, HTMLFormElement overrides it.
+        Remove code, that wasn't supposed to go in in dispatchGenericEvent().
+
+        * dom/EventTargetNode.cpp:
+        (WebCore::EventTargetNode::insertedIntoDocument):
+        (WebCore::EventTargetNode::dispatchGenericEvent):
+        * dom/EventTargetNode.h:
+
+2008-09-23  Timothy Hatcher  <timothy@apple.com>
+
+        Adds search support to the Profiles panel.
+
+        The Profiles panel supports a few types of queries:
+         * Standard string matching for function names and file URLs.
+         * Greater than and less than search for numeric columns.
+           So a query of ">24" will match all rows that have calls
+           greater than 24. Or "<=42" will match all 42 or less.
+         * Percent and time units. Adding a unit of "s", "ms" or "%"
+           is supported and will match only the Self and Total columns.
+           So a query of ">1.25s" will match all rows that took longer
+           than 1.25 seconds.
+
+        Reviewed by Oliver Hunt.
+
+        * page/inspector/ProfileView.js:
+        (WebInspector.ProfileView.prototype.hide): Reset _currentSearchResultIndex to -1. So the next time
+        it will start at the first result.
+        (WebInspector.ProfileView.prototype.refreshShowAsPercents): Moved from the bottom of the file.
+        (WebInspector.ProfileView.prototype.searchCanceled): Clear the search properties and refresh highlighted
+        data grid nodes.
+        (WebInspector.ProfileView.prototype.performSearch): Search the profile nodes.
+        (WebInspector.ProfileView.prototype.jumpToFirstSearchResult): Does what the function says. Calls _jumpToSearchResult.
+        (WebInspector.ProfileView.prototype.jumpToLastSearchResult): Ditto.
+        (WebInspector.ProfileView.prototype.jumpToNextSearchResult): Ditto.
+        (WebInspector.ProfileView.prototype.jumpToPreviousSearchResult): Ditto.
+        (WebInspector.ProfileView.prototype.showingFirstSearchResult): Does what the function says.
+        (WebInspector.ProfileView.prototype.showingLastSearchResult): Ditto.
+        (WebInspector.ProfileView.prototype._jumpToSearchResult): Select and reveal the profile node.
+        Expand all the ancestors first so the profile node will have a DataGridNode.
+        (WebInspector.ProfileView.prototype._changeView): Perform the search again on the new tree.
+        (WebInspector.ProfileDataGridNode.prototype.createCell): Add the highlight class to cells that
+        have search matches.
+        * page/inspector/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel.prototype.reset): Call searchCanceled and delete the currentQuery.
+        (WebInspector.ProfilesPanel.prototype.showProfile): Use profileViewForProfile.
+        (WebInspector.ProfilesPanel.prototype.showView): Call showProfile. Used by Panel to show a view.
+        (WebInspector.ProfilesPanel.prototype.profileViewForProfile): Create the ProfileView if needed.
+        (WebInspector.ProfilesPanel.prototype.closeVisibleView): Renamed visibleProfileView  to visibleView.
+        (WebInspector.ProfilesPanel.prototype.get searchableViews): Return all the views.
+        (WebInspector.ProfilesPanel.prototype.searchMatchFound): Update the sidebar search matches.
+        (WebInspector.ProfilesPanel.prototype.searchCanceled): Clear all the sidebar search matches.
+        (WebInspector.ProfileSidebarTreeElement.prototype.set searchMatches): Set the class and bubbleText.
+        * page/inspector/inspector.css: New style rules for the cell highlight color.
+
+2008-09-23  Timothy Hatcher  <timothy@apple.com>
+
+        Adds search support to the Resources and Scripts panels.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21005
+
+        Reviewed by Oliver Hunt.
+
+        * page/inspector/Images/searchSmallBlue.png: Added.
+        * page/inspector/Images/searchSmallBrightBlue.png: Added.
+        * page/inspector/Images/searchSmallGray.png: Added.
+        * page/inspector/Images/searchSmallWhite.png: Added.
+        * page/inspector/ResourceView.js:
+        (WebInspector.ResourceView.prototype.attach): Attempt to attach to "resource-views"
+        or "script-resource-views" since one might not be created yet.
+        * page/inspector/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.show): Hide any views that are visible that
+        are not this panel's current visible view. This can happen when a ResourceView is
+        visible in the Scripts panel then switched to the this panel.
+        (WebInspector.ResourcesPanel.prototype.get searchableViews): Return all views, with the
+        visibleView first.
+        (WebInspector.ResourcesPanel.prototype.searchResultsSortFunction): Return a sort function
+        that uses the current graph search function. So cycling through results will be in the order
+        things appear in the sidebar.
+        (WebInspector.ResourcesPanel.prototype.searchMatchFound): Update the search matches on the
+        resource's sidebar tree element.
+        (WebInspector.ResourcesPanel.prototype.searchCanceled): Restore the error and warning bubbles
+        in the sidebar. Calls the Panel prototype's searchCanceled.
+        (WebInspector.ResourcesPanel.prototype.performSearch): Hide all the error and warning bubbles
+        in the sidebar. Calls the Panel prototype's performSearch.
+        (WebInspector.ResourcesPanel.prototype.reset): Call searchCanceled and delete the currentQuery.
+        (WebInspector.ResourcesPanel.prototype.addMessageToResource): Don't call updateErrorsAndWarnings
+        if there is a current search query.
+        (WebInspector.ResourcesPanel.prototype.clearMessages): Ditto.
+        (WebInspector.ResourcesPanel.prototype.recreateViewForResourceIfNeeded): Ditto.
+        (WebInspector.ResourcesPanel.prototype.showView): Call showResource. Used by Panel to show a view.
+        (WebInspector.ResourceSidebarTreeElement.prototype.resetBubble): Clear all the classes and content.
+        (WebInspector.ResourceSidebarTreeElement.prototype.set searchMatches): Set the bubbleText and class.
+        (WebInspector.ResourceSidebarTreeElement.prototype.updateErrorsAndWarnings): Call resetBubble.
+        * page/inspector/ScriptView.js:
+        (WebInspector.ScriptView): Set _sourceFrameSetup to flase.
+        (WebInspector.ScriptView.prototype.hide): Reset _currentSearchResultIndex to -1. So the next time
+        it will start at the first result.
+        (WebInspector.ScriptView.prototype.setupSourceFrameIfNeeded): Add an event listener for "syntax
+        highlighting complete".
+        (WebInspector.ScriptView.prototype): Share many methods with SourceView.
+        * page/inspector/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.show): Hide any views that are visible that are not this
+        This can happen when a ResourceView is visible in the Resources panel then switched to the this panel.
+        (WebInspector.ScriptsPanel.prototype.get searchableViews): Return all views, with the visibleView first.
+        (WebInspector.ScriptsPanel.prototype.reset): Call searchCanceled and delete the currentQuery.
+        (WebInspector.ScriptsPanel.prototype.showView): Call _showScriptOrResource. Used by Panel to show a view.
+        (WebInspector.ScriptsPanel.prototype._sourceViewForScriptOrResource): Added helper.
+        * page/inspector/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.syntaxHighlightJavascript): Dispatch a "syntax highlighting complete" event.
+        * page/inspector/SourceView.js:
+        (WebInspector.SourceView.prototype.hide):
+        (WebInspector.SourceView.prototype.detach):
+        (WebInspector.SourceView.prototype._resourceLoadingFinished): Moved from the bottom of the file.
+        (WebInspector.SourceView.prototype._addBreakpoint): Ditto.
+        (WebInspector.SourceView.prototype.searchCanceled): Delete search properties.
+        (WebInspector.SourceView.prototype.performSearch): Search the frame if it is loaded, otherwise
+        store the worker function as _delayedFindSearchMatches and call it later in _sourceFrameSetupFinished.
+        (WebInspector.SourceView.prototype.jumpToFirstSearchResult):
+        (WebInspector.SourceView.prototype.jumpToLastSearchResult):
+        (WebInspector.SourceView.prototype.jumpToNextSearchResult):
+        (WebInspector.SourceView.prototype.jumpToPreviousSearchResult):
+        (WebInspector.SourceView.prototype.showingFirstSearchResult):
+        (WebInspector.SourceView.prototype.showingLastSearchResult):
+        (WebInspector.SourceView.prototype._jumpToSearchResult): Selects the found Range.
+        (WebInspector.SourceView.prototype._sourceFrameSetupFinished): Calls _delayedFindSearchMatches.
+        (WebInspector.SourceView.prototype._syntaxHighlightingComplete): Call _sourceFrameSetupFinished.
+        * page/inspector/inspector.css:
+
+2008-09-23  Timothy Hatcher  <timothy@apple.com>
+
+        Rename some properties of ResourcesPanel and ScriptsPanel to be the same,
+        so future code can be shared.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21005
+
+        Reviewed by Oliver Hunt.
+
+        * page/inspector/ResourcesPanel.js: Renamed resourceViews to viewsContainerElement.
+        And visibleResourceView to visibleView.
+        * page/inspector/ScriptsPanel.js: Renamed scriptResourceViews to viewsContainerElement.
+
+2008-09-23  Timothy Hatcher  <timothy@apple.com>
+
+        Highlight all matched search results in the Elements panel DOM tree.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21005
+
+        Reviewed by Oliver Hunt.
+
+        * page/inspector/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.searchCanceled): Clear the highlight
+        on all previous search results.
+        (WebInspector.ElementsPanel.prototype.performSearch): Set the hihglight
+        on all new search results.
+        * page/inspector/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement): Delay setting the title until onattach.
+        (WebInspector.ElementsTreeElement.prototype.get/set highlighted): Sets or removes
+        the highlighted class on the listItemElement.
+        (WebInspector.ElementsTreeElement.prototype.onattach): Set the highlighted class
+        if needed. Calls _updateTitle.
+        (WebInspector.ElementsTreeElement.prototype._updateTitle): Adds a span with the highlight
+        class so it can be styled when the highlighted class is present.
+        * page/inspector/inspector.css: New style rules for the hihglight.
+
+2008-09-23  Timothy Hatcher  <timothy@apple.com>
+
+        Add search support to the Elements panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21005
+
+        Reviewed by Oliver Hunt.
+
+        * page/inspector/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.searchCanceled): Call updateSearchMatchesCount
+        with a 0 match count to rest. Reset the other search properties.
+        (WebInspector.ElementsPanel.prototype.performSearch): Evaluates the search as an XPath
+        query and a CSS selector on all the Documents in the page. Remembers the found nodes
+        and avoids duplicates. Focuses the first result.
+        (WebInspector.ElementsPanel.prototype.jumpToNextSearchResult): Focuses the next result.
+        (WebInspector.ElementsPanel.prototype.jumpToPreviousSearchResult): Focuses the previous result.
+
+2008-09-23  Timothy Hatcher  <timothy@apple.com>
+
+        Add support to Panel that allows easy searching of sub-views.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21005
+
+        Reviewed by Oliver Hunt.
+
+        * page/inspector/Panel.js:
+        (WebInspector.Panel.prototype.searchCanceled): Call searchCanceled on all the
+        views in the search results and delete the currentQuery property. Call
+        WebInspector.updateSearchMatchesCount wit ha 0 match count to rest. Reset the
+        other search properties.
+        (WebInspector.Panel.prototype.performSearch): Call searchCanceled since it will
+        reset everything we need before doing a new search. Get an array of searchableViews
+        from the panel, implemented by sub-classes. Iterate over the views one-by-one
+        with an interval to prevent blocking the UI for large lists of searchableViews.
+        This keeps the interface really responsive. Pass a finishedCallback function to
+        the performSearch on each view so it can notify the panel of results.
+        (WebInspector.Panel.prototype.jumpToNextSearchResult): Finds the index in the
+        searchResults of the visibleView, so we know where in the results we are.
+        This is done every time incase the user manually navigates to a new view.
+        If the view is showing the last result, jump to the next view and show it's
+        first result. Otherwise jump to the next result in the current view.
+        (WebInspector.Panel.prototype.jumpToPreviousSearchResult): Ditto, but in reverse.
+
+2008-09-23  Timothy Hatcher  <timothy@apple.com>
+
+        Add support for asking the current panel to perform a search, find next/previous and clear.
+        A search is performed on the new new current panel when switching between panels. The search
+        label/placeholder in the toolbar now includes the panel name to make it clear that panel will
+        be searched. The search field contents are selected when Command/Control-F or Enter/Return
+        is pressed, so the user can easily type an entirely new query. The search match count shows
+        up in the toolbar next to the search field.
+
+        Also changed:
+         * Rename lastQuery to currentQuery since it better matches the truth.
+         * Set the search field "results" attribute to zero since results arn't saved for
+           how we use the search field.
+         * Make repeated presses of the Return key jump to the next search result instead
+           of doing nothing.
+         * Increased the search field width.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21005
+
+        Reviewed by Oliver Hunt.
+
+        * English.lproj/localizedStrings.js: New strings.
+        * page/inspector/inspector.css: New styles.
+        * page/inspector/inspector.html: Add the search-results-matches element. Add the
+        incremental attribute to the search field and set the results attribute to zero.
+        * page/inspector/inspector.js:
+        (WebInspector.set currentPanel): perform the search on the new panel.
+        (WebInspector.loaded): Change the event listeners and remove code that changes
+        the search label text.
+        (WebInspector.documentKeyDown): Add support for Command/Control-G and
+        Command/Control-Shift-G. To jump to the next and previous search results.
+        (WebInspector.updateSearchLabel): Added. Update the search placeholder/label.
+        This does different things depending on the attached state.
+        (WebInspector.searchKeyDown): Call preventDefault since this was the Enter key.
+        This prevents a "search" event from firing for key down. We handle the Enter key
+        on key up in searchKeyUp. This stops performSearch from being called twice in a row.
+        (WebInspector.searchKeyUp): Calls performSearch when it is the Enter key.
+        (WebInspector.performSearch): Delete the currentQuery property and call searchCanceled
+        on all the panels. Call jumpToNextSearchResult when this is the same query or a forced search.
+        Call updateSearchMatchesCount to reset the matches count in the toolbar.
+        (WebInspector.updateSearchMatchesCount): Added. Updates the matches count in the toolbar.
+
+2008-09-23  Timothy Hatcher  <timothy@apple.com>
+
+        Remove the previous Inspector search code to make room for the new stuff.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21005
+
+        Reviewed by Oliver Hunt.
+
+        * page/inspector/inspector.css:
+        * page/inspector/inspector.html:
+        * page/inspector/inspector.js:
+        (WebInspector.get/set showingSearchResults): Removed.
+        (WebInspector.searchResultsKeyDown): Removed.
+        (WebInspector.searchResultsResizerDragStart): Removed.
+        (WebInspector.searchResultsResizerDragEnd): Removed.
+        (WebInspector.searchResultsResizerDrag): Removed.
+        (WebInspector.performSearch): Removed searching parts.
+
+2008-09-23  Timothy Hatcher  <timothy@apple.com>
+
+        Use the Array.remove helper function in more places.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21037
+
+        Reviewed by Kevin McCullough.
+
+        * page/inspector/ResourceCategory.js:
+        (WebInspector.ResourceCategory.prototype.removeResource): Use Array.remove.
+        * page/inspector/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.removeResource): Ditto.
+        * page/inspector/inspector.js:
+        (WebInspector.removeResource): Ditto.
+
+2008-09-23  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes a bug where inspecting a node after reloading the page
+        would not reveal the node in the DOM tree. The TreeOutline
+        was not being told to forget decendants of a removed child.
+        So old TreeElements would be found that are not in the tree.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21036
+
+        Reviewed by Kevin McCullough.
+
+        * page/inspector/treeoutline.js:
+        (TreeOutline._removeChildAtIndex): Call _forgetChildrenRecursive
+        in addition to _forgetTreeElement.
+        (TreeOutline._removeChildren): Call _forgetChildrenRecursive
+        in addition to _forgetTreeElement.
+        (TreeOutline._rememberTreeElement): Use Array.indexOf to quickly
+        search for known elements.
+        (TreeOutline._forgetTreeElement): Use Array.remove to remove elements.
+        (TreeOutline._forgetChildrenRecursive): Recursively traverse the
+        descendants and call _forgetTreeElement.
+        * page/inspector/utilities.js:
+        (Array.prototype.remove): Speed up this function by using Array.indexOf
+        when onlyFirst is true.
+
+2008-09-23  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes a bug where inspecting some short text nodes does
+        not reveal them in the Elements panel DOM tree.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21035
+
+        Reviewed by Oliver Hunt.
+
+        * page/inspector/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeOutline.prototype.set focusedDOMNode):
+        The revealAndSelectNode() method might find a different element
+        if there is inlined text, and the select() call would change the
+        focusedDOMNode and reenter this setter. So to avoid calling
+        focusedNodeChanged() twice, first check if _focusedDOMNode is
+        the same node as the one passed in.
+        (WebInspector.ElementsTreeOutline.prototype.update): Remove use of
+        this.treeOutline, since this is the TreeOutline.
+        (WebInspector.ElementsTreeOutline.prototype.findTreeElement): Added.
+        Provides default functions for isAncestor, getParet and equal.
+        Calls the base protoype's findTreeElement. If that returns null
+        and the node is a text node, try finding it's parent.
+        (WebInspector.ElementsTreeOutline.prototype.revealNode): Removed.
+        Renamed to revealAndSelectNode.
+        (WebInspector.ElementsTreeOutline.prototype.revealAndSelectNode):
+        Selects and reveals the node passed in. Use the simple findTreeElement.
+        (WebInspector.ElementsTreeOutline.prototype._treeElementFromEvent):
+        Remove use of this.treeOutline, since this is the TreeOutline.
+
+2008-09-23  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes an exception that happened when removing a Resource
+        from the ResourcesPanel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21034
+
+        Reviewed by Kevin McCullough.
+
+        * page/inspector/ResourcesPanel.js:
+        (WebInspctor.ResourcesPanel.prototype.removeResource):
+        Remove the graphElement.
+
+2008-09-23  Kevin McCullough  <kmccullough@apple.com>
+
+        Fixed "Time" to "Tim"
+
+        * ChangeLog:
+
+2008-09-23  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Oliver.
+
+        Move mapInstanceToElement/removeInstanceMapping/instancesForElement
+        from SVGDocumentExtensions to SVGElement. It's more useful to store
+        the list of SVGElementInstances per SVGElement, instead of using
+        a document-wide hash for this purpose.
+
+        * svg/SVGAnimateMotionElement.cpp:
+        (WebCore::SVGAnimateMotionElement::applyResultsToTarget):
+        * svg/SVGAnimateTransformElement.cpp:
+        (WebCore::SVGAnimateTransformElement::applyResultsToTarget):
+        * svg/SVGAnimationElement.cpp:
+        (WebCore::SVGAnimationElement::setTargetAttributeAnimatedValue):
+        * svg/SVGDocumentExtensions.cpp:
+        (WebCore::SVGDocumentExtensions::~SVGDocumentExtensions):
+        * svg/SVGDocumentExtensions.h:
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::mapInstanceToElement):
+        (WebCore::SVGElement::removeInstanceMapping):
+        (WebCore::SVGElement::instancesForElement):
+        * svg/SVGElement.h:
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::SVGElementInstance):
+        (WebCore::SVGElementInstance::~SVGElementInstance):
+        (WebCore::SVGElementInstance::updateAllInstancesOfElement):
+        * svg/SVGElementInstance.h:
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::svgAttributeChanged):
+        (WebCore::SVGStyledElement::childrenChanged):
+        * svg/SVGStyledElement.h:
+
+2008-09-23  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix.
+
+        * WebCoreSources.bkl:
+
+2008-09-23  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Rubber stamped by Sam.
+
+        Move code from EventTarget to EventTargetNode.
+
+        I refactored most parts to live in EventTarget, a year ago,
+        though the implementation of EventTargetSVGElementInstance is
+        done in another way, that obsoletes this.
+
+        * dom/Document.cpp:
+        (WebCore::Document::addListenerTypeIfNeeded):
+        * dom/Document.h:
+        * dom/EventTarget.cpp:
+        * dom/EventTarget.h:
+        (WebCore::allowEventDispatch):
+        * dom/EventTargetNode.cpp:
+        (WebCore::EventTargetNode::insertedIntoDocument):
+        (WebCore::EventTargetNode::removedFromDocument):
+        (WebCore::EventTargetNode::willMoveToNewOwnerDocument):
+        (WebCore::EventTargetNode::didMoveToNewOwnerDocument):
+        (WebCore::EventTargetNode::addEventListener):
+        (WebCore::EventTargetNode::removeEventListener):
+        (WebCore::EventTargetNode::removeAllEventListeners):
+        (WebCore::EventTargetNode::handleLocalEvents):
+        (WebCore::setCurrentEventTargetRespectingSVGTargetRules):
+        (WebCore::EventTargetNode::dispatchEvent):
+        (WebCore::EventTargetNode::dispatchGenericEvent):
+        (WebCore::EventTargetNode::dispatchWindowEvent):
+        (WebCore::EventTargetNode::removeEventListenerForType):
+        * dom/EventTargetNode.h:
+        * svg/EventTargetSVGElementInstance.cpp:
+        (WebCore::EventTargetSVGElementInstance::dispatchEvent):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::sendSVGLoadEventIfPossible):
+        * svg/SVGElement.h:
+        (WebCore::SVGElement::supplementalTransform):
+
+2008-09-23  Dave Hyatt  <hyatt@apple.com>
+
+        Fix for bug 21012.  The Aqua scrollbar was returning the wrong track rect on Windows Aqua theme.  Make
+        sure to not accidentally fall into the vertical scrollbar case for horizontal scrollbars. :)
+
+        Reviewed by Sam Weinig
+
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::trackRect):
+        * platform/win/ScrollbarThemeSafari.cpp:
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeSafari::trackRect):
+
+2008-09-23  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=21041 "Add Contact"
+        link at gmail does not support AXPress action
+        and corresponding: <rdar://problem/6216178>
+
+        I fixed this bug by making AccessibilityObject::anchorElement
+        support ARIA links.
+
+        * page/AccessibilityImageMapLink.cpp:
+        (WebCore::AccessibilityImageMapLink::anchorElement):
+        * page/AccessibilityImageMapLink.h:
+        * page/AccessibilityObject.cpp:
+        (WebCore::AccessibilityObject::anchorElement):
+        * page/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isNativeAnchor):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isNativeAnchor):
+        (WebCore::AccessibilityRenderObject::anchorElement):
+        (WebCore::AccessibilityRenderObject::internalLinkElement):
+        (WebCore::AccessibilityRenderObject::url):
+        * page/AccessibilityRenderObject.h:
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (AXLinkElementForNode):
+
+2008-09-23  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim and Oliver.
+
+        Bug 20949: Catch repeated messages in Inspector Controller to limit
+        memory usage
+        - Store the repeat count in the Console Message object, in the
+        Inspector Controller and JS ConsoleMessage object.
+
+        * page/InspectorController.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::ConsoleMessage::operator==):
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::addScriptConsoleMessage):
+        * page/InspectorController.h:
+        * page/inspector/Console.js:
+        * page/inspector/Resource.js:
+        * page/inspector/ResourcesPanel.js:
+        * page/inspector/SourceFrame.js:
+
+2008-09-23  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Eric.
+
+        Working on proper EventTarget support for SVGElementInstance.
+
+        Add new EventTargetSVGElementInstance class, and it's corresponding JS wrapper.
+        Finally JSEventTargetBase, is actually used for another class than JSEventTargetnode.
+
+        Remove EventTarget inheritance from SVGElementInstance, and the manual "TreeShared"
+        implementation. Let it use TreeShared directly.
+
+        It's not activated so far (SVGUseElement still creating SVGElementInstance objects).
+        The transition to EventTargetSVGElementInstance will be done in a few individual patches.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSEventTargetBase.cpp:
+        (WebCore::retrieveEventTargetAndCorrespondingNode):
+        (WebCore::toJS):
+        * bindings/js/JSEventTargetBase.h:
+        * bindings/js/JSEventTargetSVGElementInstance.cpp: Added.
+        (WebCore::):
+        (WebCore::JSEventTargetSVGElementInstance::JSEventTargetSVGElementInstance):
+        (WebCore::JSEventTargetSVGElementInstance::createPrototype):
+        (WebCore::JSEventTargetSVGElementInstance::setListener):
+        (WebCore::JSEventTargetSVGElementInstance::getListener):
+        (WebCore::toEventTargetSVGElementInstance):
+        * bindings/js/JSEventTargetSVGElementInstance.h: Added.
+        (WebCore::JSEventTargetSVGElementInstance::prototypeClassName):
+        (WebCore::JSEventTargetSVGElementInstance::getOwnPropertySlot):
+        (WebCore::JSEventTargetSVGElementInstance::getValueProperty):
+        (WebCore::JSEventTargetSVGElementInstance::put):
+        (WebCore::JSEventTargetSVGElementInstance::putValueProperty):
+        * bindings/js/JSSVGElementInstanceCustom.cpp: Added.
+        (WebCore::toJS):
+        * bindings/objc/DOM.mm:
+        (+[DOMNode _wrapEventTarget:WebCore::]):
+        (-[DOMSVGElementInstance _initWithSVGElementInstance:WebCore::]):
+        (+[DOMSVGElementInstance _wrapSVGElementInstance:WebCore::]):
+        (+[DOMSVGElementInstance _wrapEventTarget:WebCore::]):
+        (-[DOMSVGElementInstance WebCore::]):
+        (-[DOMSVGElementInstance addEventListener:listener:useCapture:]):
+        (-[DOMSVGElementInstance addEventListener:::]):
+        (-[DOMSVGElementInstance removeEventListener:listener:useCapture:]):
+        (-[DOMSVGElementInstance removeEventListener:::]):
+        (-[DOMSVGElementInstance dispatchEvent:]):
+        * bindings/objc/DOMEvents.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * svg/EventTargetSVGElementInstance.cpp: Added.
+        (WebCore::EventTargetSVGElementInstance::EventTargetSVGElementInstance):
+        (WebCore::EventTargetSVGElementInstance::~EventTargetSVGElementInstance):
+        (WebCore::EventTargetSVGElementInstance::addEventListener):
+        (WebCore::EventTargetSVGElementInstance::removeEventListener):
+        (WebCore::EventTargetSVGElementInstance::dispatchEvent):
+        * svg/EventTargetSVGElementInstance.h: Added.
+        (WebCore::EventTargetSVGElementInstance::isEventTargetSVGElementInstance):
+        (WebCore::EventTargetSVGElementInstance::toNode):
+        (WebCore::EventTargetSVGElementInstance::toSVGElementInstance):
+        (WebCore::EventTargetSVGElementInstance::refEventTarget):
+        (WebCore::EventTargetSVGElementInstance::derefEventTarget):
+        (WebCore::EventTargetSVGElementInstanceCast):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::dispatchEvent):
+        * svg/SVGElementInstance.cpp:
+        (WebCore::SVGElementInstance::SVGElementInstance):
+        (WebCore::SVGElementInstance::~SVGElementInstance):
+        * svg/SVGElementInstance.h:
+        (WebCore::SVGElementInstance::isEventTargetSVGElementInstance):
+        * svg/SVGElementInstance.idl:
+
+2008-09-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=21040
+          Pass NULL instead of the identity matrix to CTFontCreateWithGraphicsFont()
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::getCTFont):
+
+2008-09-23  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21039
+
+        Teach the viewless Mac scrollbar how to avoid NSWindow's resizer.
+
+        Reviewed by Sam Weinig
+
+        * platform/ScrollView.h:
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::setFrameGeometry):
+        * platform/Scrollbar.h:
+        * platform/Widget.cpp:
+        (WebCore::Widget::convertFromContainingWindow):
+        * platform/Widget.h:
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
+        (WebCore::ScrollView::ScrollView):
+        (WebCore::ScrollView::~ScrollView):
+        (WebCore::ScrollView::windowResizerRect):
+        (WebCore::ScrollView::resizerOverlapsContent):
+        (WebCore::ScrollView::adjustOverlappingScrollbarCount):
+        (WebCore::ScrollView::setParent):
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::convertFromContainingWindow):
+
+2008-09-23  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by Darin Adler. Landed by Jan Alonzo.
+
+        Added support for getImageData() and putImageData()
+        to Cairo.
+
+        [CAIRO] needs getImageData and putImageData support
+        https://bugs.webkit.org/show_bug.cgi?id=20838
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::getImageData):
+        (WebCore::ImageBuffer::putImageData):
+
+2008-09-23  Marco Barisione  <marco.barisione@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        http://bugs.webkit.org/show_bug.cgi?id=18987
+        [GTK] Implement SharedBuffer::createWithContentsOfFile and
+        KURL::fileSystemPath
+
+        * GNUmakefile.am: Add KURLGtk.cpp and SharedBufferGtk.cpp.
+        * platform/gtk/KURLGtk.cpp: Added.
+        (WebCore::KURL::fileSystemPath): Implemented.
+        * platform/gtk/SharedBufferGtk.cpp: Added.
+        (WebCore::SharedBuffer::createWithContentsOfFile): Implemented.
+        * platform/gtk/TemporaryLinkStubs.cpp: Remove the old stubs.
+
+2008-09-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Oliver Hunt, okayed by Darin Adler.
+
+        <rdar://problem/5575547> REGRESSION: ATOK has no phrase boundary on Safari/Mail.app
+
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paintCompositionUnderline): Add 2 pixel spacing between clauses.
+
+2008-09-23  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=21023
+        Don't use TEC for encodings supported by ICU
+
+        * platform/text/mac/mac-encodings.txt: Removed x-mac-centraleurroman, x-mac-cyrillic,
+        x-mac-greek, and x-mac-turkish.
+
+        * platform/text/TextCodecICU.cpp: (WebCore::TextCodecICU::registerExtendedEncodingNames):
+        Register aliases for these encodings that are not registered automatically; updated comments.
+
+2008-09-23  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        - speed up instanceof some more
+        https://bugs.webkit.org/show_bug.cgi?id=20818
+
+        ~2% speedup on EarleyBoyer
+
+        (WebCore updates.)
+
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructureID):
+
+2008-09-22  Darin Adler  <darin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=21008
+          getting pixels by index from CanvasPixelArray is unnecessarily slow
+
+        * GNUmakefile.am: Added JSCanvasPixelArrayCustom.h.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+
+        * bindings/js/JSCanvasPixelArrayCustom.cpp: Removed indexGetter and
+          indexSetter. These are now both inlined, so in the header.
+        * bindings/js/JSCanvasPixelArrayCustom.h: Added. The getByIndex
+          function is what's used for HasCustomIndexGetter. Also moved the
+          indexSetter function here.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Changed HasCustomIndexGetter
+          to use a getByIndex member function rather than an indexGetter static
+          member function in a property slot. This lets us avoid the property
+          slot mechanism's rule where it turns numeric property names into
+          strings in the identifier table, which is good because that's slow.
+          Also added a new property CustomHeader that allows IDL files to
+          introduce headers to be included -- useful when we have functions
+          that we want to inline into the binding.
+
+        * html/CanvasPixelArray.idl: Added CustomHeader attribute.
+
+2008-09-23  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        Another blind stab in the dark.
+
+        * svg/graphics/cg/SVGResourceClipperCg.cpp: Add missing header.
+
+2008-09-23  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        Third time's the charm, eh?  My local build is sadly still not done...
+
+        * platform/graphics/AffineTransform.cpp: remove extra &
+        * platform/graphics/AffineTransform.h: remove extra &
+
+2008-09-22  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        * platform/graphics/AffineTransform.cpp: remove extra ;
+
+2008-09-22  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        Speculative fix for the build while I wait for my compile to finish.
+
+        * platform/graphics/AffineTransform.cpp:
+
+2008-09-22  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by eseidel.  Landed by eseidel.
+
+        Moved makeMapBetweenRects from SVG/CG to AffineTransform
+        Make SVGResourceClipper::applyClip more cross-platform
+
+        * platform/graphics/AffineTransform.cpp:
+        * platform/graphics/AffineTransform.h:
+        * svg/graphics/cg/CgSupport.cpp:
+        * svg/graphics/cg/CgSupport.h:
+        * svg/graphics/cg/SVGPaintServerGradientCg.cpp:
+        (WebCore::SVGPaintServerGradient::handleBoundingBoxModeAndGradientTransformation):
+        * svg/graphics/cg/SVGResourceClipperCg.cpp:
+        (WebCore::SVGResourceClipper::applyClip):
+
+2008-09-22  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by David Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16331
+        [Gtk] no focus when button/checkbox/radiobutton clicked, only when tabbed
+
+        Obey GTK+ focusing conventions for controls and anchor elements.
+
+        It could be interesting to push these decisions up to Settings or
+        ChromeClient some day but this gets things working.
+
+        Right and middle click events still need some work to match GTK+
+        conventions.
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::isMouseFocusable):
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::isMouseFocusable):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::sendContextMenuEvent):
+
+2008-09-22  Darin Adler  <darin@apple.com>
+
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::baseWritingDirectionForSelectionStart): Fix indentation.
+
+2008-09-22  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=21013
+        Match Firefox in how we hide HTMLInputElement.selectionStart, selectionEnd
+        and setSelectionRange.  This also allows us to remove the legacy JSHTMLInputElementBase
+        class!
+
+        - selectionStart, selectionEnd and setSelectionRange now are visible in iteration of
+          non-selectable input types, but return undefined when accessed.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * bindings/js/JSHTMLInputElementBase.cpp: Removed.
+        * bindings/js/JSHTMLInputElementBase.h: Removed.
+        * bindings/js/JSHTMLInputElementCustom.cpp: Added.
+        (WebCore::JSHTMLInputElement::customGetOwnPropertySlot):
+        (WebCore::JSHTMLInputElement::selectionStart):
+        (WebCore::JSHTMLInputElement::selectionEnd):
+        * bindings/js/JSHTMLInputElementCustom.h: Added.
+        * html/HTMLInputElement.idl:
+
+2008-09-22  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix <rdar://problem/5699571> Mail: Unable to change writing direction to LTR in an empty message
+
+        Not testable in DumpRenderTree or in Safari
+
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::baseWritingDirectionForSelectionStart): Account for the
+        case that the selection start node is a block.
+
+2008-09-22  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21007
+
+        Make sure that the scrollbar gets sent a release event on platforms that call handleMouseDoubleClickEvent.
+
+        Reviewed by Sam Weinig
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseDoubleClickEvent):
+
+2008-09-22  Eric Seidel  <eric@webkit.org>
+
+        No review, rollback only.
+
+        Roll out Peter's change (per his request)
+        http://trac.webkit.org/changeset/36069
+        https://bugs.webkit.org/show_bug.cgi?id=19663
+        This change has been the source of numerous regressions
+        (several of which were latent bugs revealed by this change,
+        others were bugs in this change)
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        (WebCore::BitmapImage::startAnimation):
+        (WebCore::BitmapImage::advanceAnimation):
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::draw):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::draw):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::BitmapImage::draw):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::draw):
+
+2008-09-22  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix <rdar://problem/5158514> Switch the complex text code path to Core Text
+
+        Tests: platform/mac-snowleopard/fast/text/myanmar-shaping.html
+               platform/mac-snowleopard/fast/text/thai-combining-mark-positioning.html
+
+        * config.h: Use Core Text if not building for Leopard or Tiger.
+
+2008-09-22  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=21006
+
+        Add code that paints an NSView-less scroller using HIThemeDrawTrack.  This scrollbar is still not
+        switched on.  There are still a few more refinements to make to the rendering and behavior.
+
+        Reviewed by Darin Adler
+
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::paint):
+        * platform/ScrollbarThemeComposite.h:
+        (WebCore::ScrollbarThemeComposite::paintTrack):
+        (WebCore::ScrollbarThemeComposite::paintButton):
+        (WebCore::ScrollbarThemeComposite::paintThumb):
+        * platform/mac/ScrollbarThemeMac.h:
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::backButtonRect):
+        (WebCore::ScrollbarThemeMac::forwardButtonRect):
+        (WebCore::scrollbarPartToHIPressedState):
+        (WebCore::ScrollbarThemeMac::paint):
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::invalidateRect):
+
+2008-09-22  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Sam Weinig
+
+        transition end event when -webkit-transition-property: all puts wrong
+        propertyName in event
+        https://bugs.webkit.org/show_bug.cgi?id=20903
+
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::sendTransitionEvent):
+
+2008-09-22  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6230234> AXTable should probably not be exposed in there's only one cell
+
+        Test: accessibility/table-one-cell.html
+
+        * page/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
+
+2008-09-22  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6167779> Setting AXSelectedTextRange for TextAreas in a WebView behaves incorrectly
+
+        Test: accessibility/textarea-selected-text-range.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::setSelectedTextRange):
+
+2008-09-22  David Hyatt  <hyatt@apple.com>
+
+        Clean up some parent relationships in the back end stylesheet code.  Make sure parentStyleSheet
+        properly walks up nested rule blocks to reach the parent sheet instead of giving up at the immediate
+        parent.  Also fix the doc() method so that it is properly set when the parent of the sheet is an import
+        rule.
+
+        Reviewed by Sam Weinig
+
+        Added fast/css/nested-rule-parent-sheet.html
+
+         * css/CSSImportRule.cpp:
+        (WebCore::CSSImportRule::insertedIntoParent):
+        * css/CSSRule.cpp:
+        (WebCore::CSSRule::parentStyleSheet):
+        (WebCore::CSSRule::parentRule):
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::CSSStyleSheet):
+        * css/CSSStyleSheet.h:
+
+2008-09-22  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=21002
+          Make the ATSUI code path respect spacingDisabled()
+
+        Fixes svg/text/text-spacing-01-b.svg in run-webkit-tests --complex-text
+
+        * platform/graphics/mac/FontMacATSUI.mm:
+        (WebCore::overrideLayoutOperation):
+
+2008-09-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        - speed up instanceof operator by replacing implementsHasInstance method with a TypeInfo flag
+
+        Partial work towards <https://bugs.webkit.org/show_bug.cgi?id=20818>
+
+        2.2% speedup on EarleyBoyer benchmark.
+
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::createStructureID):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2008-09-22  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * WebCore.vcproj/WebCore.vcproj: Add a missing </File> tag.
+
+2008-09-22  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Based on initial work by Darin Adler.
+
+        - replace masqueradesAsUndefined virtual method with a flag in TypeInfo
+        - use this to JIT inline code for eq_null and neq_null
+        https://bugs.webkit.org/show_bug.cgi?id=20823
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::JSCSSStyleDeclaration::nameGetter):
+        * bindings/js/JSHTMLAllCollection.cpp: Added.
+        (WebCore::):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::createStructureID):
+        (WebCore::JSHTMLAllCollection::toBoolean):
+
+2008-09-22  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix the QtWebKit build
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::construct):
+        * bridge/qt/qt_runtime.cpp:
+
+2008-09-22  Alp Toker  <alp@nuanti.com>
+
+        Suggested by David Hyatt.
+
+        Build fix: ScrollView::update() is still used by Document.cpp on !MAC
+        so make it public.
+
+        * platform/ScrollView.h:
+
+2008-09-22  David Hyatt  <hyatt@apple.com>
+
+        Fix a regression in Windows scrollbar painting.  (Also fix the same
+        bug in my new viewless Mac scrollbar painting code).  The track rect
+        was being improperly inflated when painting resulting in the scrollbar
+        being too tall and painting in the border of overflow sections.
+
+        Reviewed by Oliver Hunt
+
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::trackRect):
+        * platform/win/ScrollbarThemeSafari.cpp:
+        (WebCore::ScrollbarThemeSafari::trackRect):
+
+2008-09-22  David Hyatt  <hyatt@apple.com>
+
+        Fix a hit testing bug where events are mistakenly passed to subframes
+        if the mouse is over the border or padding area of the frame.  Add
+        a boolean flag, isOverWidget(), to hit test results so that EventHandler
+        can check it to tell if the mouse is really over the content box of a
+        RenderWidget and not just in the border/padding area.
+
+        This is not testable, since the old code properly recovered when it detected
+        that the mouse was outside the bounds of the view, but this prevents
+        the extra passdown from even occurring (and is basically a nice cleanup).
+
+        Reviewed by Oliver Hunt
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::hitTestResultAtPoint):
+        (WebCore::subframeForHitTestResult):
+        (WebCore::EventHandler::handleMouseDoubleClickEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        (WebCore::EventHandler::handleMouseReleaseEvent):
+        (WebCore::EventHandler::handleWheelEvent):
+        * page/MouseEventWithHitTestResults.h:
+        (WebCore::MouseEventWithHitTestResults::isOverWidget):
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::HitTestResult):
+        (WebCore::HitTestResult::operator=):
+        * rendering/HitTestResult.h:
+        (WebCore::HitTestResult::isOverWidget):
+        (WebCore::HitTestResult::setIsOverWidget):
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::nodeAtPoint):
+        * rendering/RenderWidget.h:
+
+2008-09-21  David Hyatt  <hyatt@apple.com>
+
+        Rename FrameView's repaintRectangle method to repaintContentRectangle.  Make
+        both it and ScrollView's updateContents method be off-limits to everyone in
+        WebCore except for RenderView.
+
+        Make repaintViewRectangle the only possible method for WebCore code to do
+        an invalidation.  This ensures that all invalidates triggered by WebCore
+        cross-platform code that cross ownerElement() boundaries are transform-aware.
+
+        Make sure that iframes/frames contained inside objects that have transforms
+        or reflections are not allowed to blit (this was already true for transparency).
+
+        It is not possible to make a test for any of this, since iframe scrolling
+        still doesn't work on Mac (since the invalidates are not being done
+        through WebCore's cross-platform invalidation code but are instead going
+        through NSScrollView's setNeedsDisplay still).
+
+        Reviewed by Oliver Hunt
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::recomputeCaretRect):
+        (WebCore::SelectionController::invalidateCaretRect):
+        (WebCore::SelectionController::focusedOrActiveStateChanged):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::repaintContentRectangle):
+        (WebCore::FrameView::endDeferredRepaints):
+        * page/FrameView.h:
+        * platform/ScrollView.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintFillLayerExtended):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::enclosingPositionedAncestor):
+        (WebCore::RenderLayer::requiresSlowRepaints):
+        * rendering/RenderLayer.h:
+        (WebCore::RenderLayer::hasTransform):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::paintBoxDecorations):
+        (WebCore::RenderView::repaintViewRectangle):
+        (WebCore::RenderView::setSelection):
+
+2008-09-21  Maciej Stachowiak  <mjs@apple.com>
+
+        Reviewed by Darin.
+
+        - introduce a TypeInfo class, for holding per-type (in the C++ class sense) date in StructureID
+        https://bugs.webkit.org/show_bug.cgi?id=20981
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor):
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::JSCSSStyleDeclaration::nameGetter):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::createDOMStructure):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::getDOMStructure):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::JSDOMWindowShell):
+        (WebCore::JSDOMWindowShell::setWindow):
+        * bindings/js/JSEventTargetNode.cpp:
+        (WebCore::JSEventTargetNode::createPrototype):
+        * bindings/js/JSHTMLOptionElementConstructor.cpp:
+        (WebCore::JSHTMLOptionElementConstructor::JSHTMLOptionElementConstructor):
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor):
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2008-09-21  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        - fix problem Maciej noticed where every JSNamedNodesCollection
+          gets its own StructureID
+
+        * bindings/js/JSNamedNodesCollection.cpp:
+        (WebCore::JSNamedNodesCollection::JSNamedNodesCollection): Use
+        getDOMStructure to get the structure.
+        * bindings/js/JSNamedNodesCollection.h:
+        (WebCore::JSNamedNodesCollection::createPrototype): Return the
+        object prototype.
+
+2008-09-20  David Hyatt  <hyatt@apple.com>
+
+        Make sure transformed scrollbars in overflow sections position
+        properly.  This patch mimics the same behavior that works for
+        iframes, namely making sure that the same code that dynamically
+        adjusts iframe widget positions at paint time for fixed positioning
+        and transforms also applies to scrollbars.  (This is as simple as passing
+        in the current translation factor at paint time rather than crawling
+        up the layer tree to compute a "false" absolute position.)
+
+        An existing transform test covers this (although only a pixel result
+        reveals the correct rendering).
+
+        Reviewed by Darin Adler
+
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateLayerPositions):
+        (WebCore::RenderLayer::positionOverflowControls):
+        (WebCore::RenderLayer::paintOverflowControls):
+        (WebCore::RenderLayer::paintLayer):
+        * rendering/RenderLayer.h:
+
+2008-09-21  Steve Falkenburg  <sfalken@apple.com>
+
+        Removed unnecessary nested timer check.
+
+        Rubber-stamped by Dan Bernstein.
+
+        * platform/win/SharedTimerWin.cpp:
+        (WebCore::TimerWindowWndProc):
+
+2008-09-21  Steve Falkenburg  <sfalken@apple.com>
+
+        Improve timer resolution on WinXP.
+        https://bugs.webkit.org/show_bug.cgi?id=20979
+
+        Removed last-chance timer. It should not be necessary.
+        Change timeEndPeriod timer to fire in 300ms instead of 20ms. Calling timeBeginPeriod/timeEndPeriod too often throws off accuracy.
+        Remove Vista checks. We now run the same code on both XP and Vista.
+
+        Call through to JSC::getCurrentUTCTimeWithMicroseconds from WebCore::currentTime.
+        The code previously called GetSystemTimeAsFileTime, which is always low-resolution on XP, even within timeBeginPeriod(1).
+
+        Reviewed by Maciej Stachowiak.
+
+        * platform/win/SharedTimerWin.cpp:
+        (WebCore::):
+        (WebCore::TimerWindowWndProc):
+        (WebCore::setSharedTimerFireTime):
+        * platform/win/SystemTimeWin.cpp:
+        (WebCore::currentTime):
+
+2008-09-21  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by eseidel.  Landed by eseidel.
+
+        All platforms use the DashArray in the GraphicsContext.
+
+        * svg/graphics/SVGPaintServer.h:
+        * svg/graphics/cairo/SVGPaintServerGradientCairo.cpp:
+        (WebCore::SVGPaintServerGradient::setup):
+        * svg/graphics/cairo/SVGPaintServerPatternCairo.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+        * svg/graphics/cairo/SVGPaintServerSolidCairo.cpp:
+        (WebCore::SVGPaintServerSolid::setup):
+        * svg/graphics/qt/SVGPaintServerGradientQt.cpp:
+        (WebCore::SVGPaintServerGradient::setup):
+        * svg/graphics/qt/SVGPaintServerQt.cpp:
+        * svg/graphics/qt/SVGPaintServerSolidQt.cpp:
+        (WebCore::SVGPaintServerSolid::setup):
+
+2008-09-21  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by eseidel.  Landed by eseidel.
+
+        Moved DashArray to GraphicsContext.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/DashArray.h: Added.
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::setLineDash):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setLineDash):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::setLineDash):
+        * svg/graphics/SVGPaintServer.cpp:
+        (WebCore::applyStrokeStyleToContext):
+        * svg/graphics/SVGPaintServer.h:
+        * svg/graphics/cg/CgSupport.cpp:
+        * svg/graphics/cg/CgSupport.h:
+
+2008-09-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - fix linker warnings
+
+        * WebCore.base.exp:
+
+2008-09-20  Darin Adler  <darin@apple.com>
+
+        - another try at fixing Qt
+
+        * bridge/qt/qt_runtime.cpp: "using namespce WebCore"
+
+2008-09-20  Darin Adler  <darin@apple.com>
+
+        - blind attempt to fix Qt build
+
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertQVariantToValue): Use regExpStructure instead
+        of regExpPrototype to make a RegExpObject. There should really be
+        some sort of public helper function for this. Same thing for
+        DateInstance and dateStructure. For JSObject, use constructEmptyObject.
+        (JSC::Bindings::):
+        (JSC::Bindings::QtRuntimeMethod::QtRuntimeMethod): Use getDOMStructure.
+        It is not correct to do this inside the constructor because it could
+        cause a garbage collect while the QtRuntimeMethod object is half-
+        allocated, which could lead to a crash; note that RuntimeMethod,
+        QtRuntimeObjectImp, and RuntimeObjectImp have the same bug.
+        * bridge/qt/qt_runtime.h: Add s_info and createPrototype.
+
+2008-09-20  Collin Jackson  <collinj@webkit.org>
+
+        Prefetch DNS for hyperlinks that the user mouses over.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20931
+
+        Reviewed by Sam Weinig.
+
+        * page/Chrome.cpp:
+        (WebCore::Chrome::mouseDidMoveOverElement):
+
+2008-09-20  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        - finish https://bugs.webkit.org/show_bug.cgi?id=20858
+          make each distinct C++ class get a distinct JSC::Structure
+
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::JSCSSStyleDeclaration::nameGetter): Pass in a structure
+        ID. Note that this makes a new structure every time -- we could
+        optimize this slightly be caching and reusing a single one.
+
+        * bridge/runtime_method.cpp:
+        (JSC::RuntimeMethod::RuntimeMethod): Create a unique structure using
+        getDOMStructure.
+        * bridge/runtime_method.h:
+        (JSC::RuntimeMethod::createPrototype): Added createPrototype so
+        getDOMStructure will work.
+
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::JSDOMWindowShell): Initialize m_window to
+        0; needed in case garbage collection happens while creating the
+        JSDOMWindow.
+
+2008-09-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=20950
+          <rdar://problem/6234059> Reproducible assertion failure running svg/custom/acid3-test-77.html multiple times under guard malloc
+
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGInlineTextBoxQueryWalker::chunkPortionCallback): Changed to
+        not include the first character in the extraCharsAvailable count.
+
+2008-09-20  Kevin Ollivier  <kevino@theolliviers.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix memory leak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20505
+
+        * platform/wx/wxcode/mac/carbon/fontprops.cpp:
+        (GetTextExtent):
+
+2008-09-20  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes. Added/removed build sources, and nativeWindow->platformWidget updates.
+
+        * WebCoreSources.bkl:
+        * platform/ScrollView.h:
+        * platform/wx/PopupMenuWx.cpp:
+        (WebCore::PopupMenu::show):
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderThemeWx::paintButton):
+        (WebCore::RenderThemeWx::paintTextField):
+        (WebCore::RenderThemeWx::paintMenuList):
+        (WebCore::RenderThemeWx::paintMenuListButton):
+        * platform/wx/ScrollViewWx.cpp:
+        (WebCore::ScrollView::setPlatformWidget):
+        (WebCore::ScrollView::updateContents):
+        (WebCore::ScrollView::update):
+        (WebCore::ScrollView::visibleWidth):
+        (WebCore::ScrollView::visibleHeight):
+        (WebCore::ScrollView::scrollBy):
+        (WebCore::ScrollView::resizeContents):
+        (WebCore::ScrollView::contentsWidth):
+        (WebCore::ScrollView::contentsHeight):
+        (WebCore::ScrollView::isScrollViewScrollbar):
+        (WebCore::ScrollView::adjustScrollbars):
+        (WebCore::ScrollView::inWindow):
+        (WebCore::ScrollView::removeChild):
+        * platform/wx/WidgetWx.cpp:
+        * plugins/wx/PluginViewWx.cpp:
+        (WebCore::PluginView::setParentVisible):
+        (WebCore::PluginView::updatePluginWidget):
+
+2008-09-20  Timothy Hatcher  <timothy@apple.com>
+
+        Fix the new Node Search button image to not be blurry.
+
+        * page/inspector/Images/nodeSearchButtons.png:
+
+2008-09-20  Matt Lilek  <webkit@mattlilek.com>
+
+        Reviewed by Tim Hatcher.
+
+        Cut down some of the inspector javascript -> InspectorController glue code
+        with two new macros. Also rearrange the exposed function list to be grouped
+        by implementation and to all explicitly use the WebCore namespace.
+
+        * page/InspectorController.cpp:
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+
+2008-09-20  Matt Lilek  <webkit@mattlilek.com>
+
+        Reviewed by Tim Hatcher.
+
+        Fix regression from my previous patch where the breadcrumbs bar was not displayed.
+
+        * page/inspector/inspector.css:
+
+2008-09-20  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Eric.
+
+        Refactor HTMLImageLoader/SVGImageLoader code.
+        Move html/HTMLImageLoader.* to loader/ImageLoader.*
+
+        Let HTMLImageLoader & SVGImageLoader inherit from the new base class.
+        SVGImageLoader used to inherit from HTMLImageLoader which is awkward.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/Document.cpp:
+        (WebCore::Document::dispatchImageLoadEventSoon):
+        (WebCore::Document::removeImage):
+        (WebCore::Document::dispatchImageLoadEventsNow):
+        * dom/Document.h:
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::HTMLImageLoader):
+        (WebCore::HTMLImageLoader::~HTMLImageLoader):
+        (WebCore::HTMLImageLoader::sourceURI):
+        (WebCore::HTMLImageLoader::notifyFinished):
+        * html/HTMLImageLoader.h:
+        * loader/DocLoader.h:
+        * loader/ImageLoader.cpp: Copied from html/HTMLImageLoader.cpp.
+        (WebCore::ImageLoader::ImageLoader):
+        (WebCore::ImageLoader::~ImageLoader):
+        (WebCore::ImageLoader::setImage):
+        (WebCore::ImageLoader::setLoadingImage):
+        (WebCore::ImageLoader::updateFromElement):
+        (WebCore::ImageLoader::notifyFinished):
+        * loader/ImageLoader.h: Copied from html/HTMLImageLoader.h.
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::attach):
+        (WebCore::SVGImageElement::insertedIntoDocument):
+        (WebCore::SVGImageElement::imageSourceAttributeName):
+        * svg/SVGImageElement.h:
+        * svg/SVGImageLoader.cpp:
+        (WebCore::SVGImageLoader::SVGImageLoader):
+        (WebCore::SVGImageLoader::dispatchLoadEvent):
+        (WebCore::SVGImageLoader::sourceURI):
+        * svg/SVGImageLoader.h:
+
+2008-09-20  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Build fix.
+
+        [qtwebkit] ScrollBar build fix after r36684.
+        BackButtonPart was split into Start and End Part
+        ForwardButtonPart was split into Start and End Part
+
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::scPart):
+        (WebCore::scrollbarPart):
+        (WebCore::styleOptionSlider):
+
+2008-09-20  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Build fix.
+
+        [qtwebkit] Make qt_instance.cpp compile.
+        Revision of 36675 introduced getDOMStructure to give unique
+        structure id's to C++ classes. Catch up. RuntimeObjectImp assigns
+        the the StructureID inside the c'tor, do the same in QtRuntimeObjectImp
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::getRuntimeObject):
+
+2008-09-20  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        [svg] Change SVGLocatable to deal with a plain SVGElement
+        There is no requirement in the code that we have to have a
+        SVGStyledElement. Remove that artificial limitation and compile
+        with SVGElement.
+
+        * svg/SVGLocatable.cpp:
+        * svg/SVGLocatable.h:
+
+2008-09-20  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        [svg] Use OwnPtr for the SVGExtensions to avoid custom lifetime
+        management.
+
+        * dom/Document.cpp:
+        (WebCore::Document::~Document):
+        (WebCore::Document::svgExtensions):
+        (WebCore::Document::accessSVGExtensions):
+        * dom/Document.h:
+
+2008-09-19  David Hyatt  <hyatt@apple.com>
+
+        Fix for crash in updateTransitions.  Make sure to test for a style
+        being null when comparing two RenderStyles.
+
+        Reviewed by Oliver Hunt
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::PropertyWrapperGetter::equals):
+
+2008-09-19  David Hyatt  <hyatt@apple.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=20954
+
+        Roll out r36628 since it has caused horrible regressions with
+        animated GIF CPU usage.
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::cacheFrame):
+        (WebCore::BitmapImage::startAnimation):
+        * platform/graphics/BitmapImage.h:
+        (WebCore::FrameData::FrameData):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::FrameData::clear):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::FrameData::clear):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::FrameData::clear):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::FrameData::clear):
+
+2008-09-20  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20913
+        Avoid redudant includes
+
+        Document.h is included excessively such that a modification to Document.h (or
+        any of the header it includes itself) triggers a rebuild of many files
+        including the whole of SVG and a lot of the JS bindings.
+
+        Some of these includes can be avoided by only including Document.h where
+        necessary.
+
+        * bindings/js/JSAttrCustom.cpp:
+        * bindings/js/JSElementCustom.cpp:
+        * bindings/js/JSEventTargetBase.cpp:
+        * bindings/js/JSEventTargetBase.h:
+        * bindings/js/JSEventTargetNode.cpp:
+        * bindings/js/JSHTMLFrameElementCustom.cpp:
+        * bindings/js/JSHTMLIFrameElementCustom.cpp:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * css/CSSCursorImageValue.cpp:
+        * css/SVGCSSStyleSelector.cpp:
+        * dom/make_names.pl:
+        * svg/SVGAnimateElement.h:
+        * svg/SVGAnimatedProperty.h:
+        (WebCore::::baseValue):
+        (WebCore::::setBaseValue):
+        (WebCore::::startAnimation):
+        (WebCore::::stopAnimation):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::accessDocumentSVGExtensions):
+        * svg/SVGElement.h:
+        * svg/SVGElementInstance.cpp:
+        * svg/SVGFitToViewBox.cpp:
+        * svg/SVGFontElement.cpp:
+        * svg/SVGFontFaceElement.cpp:
+        * svg/SVGLinearGradientElement.cpp:
+        * svg/SVGMPathElement.cpp:
+        * svg/SVGViewSpec.cpp:
+
+2008-09-19  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Antti & Eric.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=20372
+
+        Finish HTMLScriptElement / SVGScriptElement unification.
+        SVG <script> support is complete now, full SVGLoad event
+        respecting the influence of the externalResourcesRequired attribute
+        as well as SVGError event support. All other features shared with HTML.
+
+        Tests: fast/dom/HTMLScriptElement/script-reexecution.html
+               svg/dom/SVGScriptElement/script-change-externalResourcesRequired-while-loading.svg
+               svg/dom/SVGScriptElement/script-load-and-error-events.svg
+               svg/dom/SVGScriptElement/script-reexecution.svg
+               svg/dom/SVGScriptElement/script-set-href.svg
+
+        * dom/ScriptElement.cpp:
+        (WebCore::ScriptElementData::ScriptElementData):
+        (WebCore::ScriptElementData::requestScript):
+        * dom/ScriptElement.h:
+        (WebCore::ScriptElementData::haveFiredLoadEvent):
+        (WebCore::ScriptElementData::setHaveFiredLoadEvent):
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::notifyFinished):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::dispatchLoadEvent):
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::setCreatedByParser):
+        (WebCore::SVGScriptElement::parseMappedAttribute):
+        (WebCore::SVGScriptElement::svgAttributeChanged):
+        (WebCore::SVGScriptElement::insertedIntoDocument):
+        (WebCore::SVGScriptElement::removedFromDocument):
+        (WebCore::SVGScriptElement::childrenChanged):
+        (WebCore::SVGScriptElement::isURLAttribute):
+        (WebCore::SVGScriptElement::finishParsingChildren):
+        (WebCore::SVGScriptElement::type):
+        (WebCore::SVGScriptElement::setType):
+        (WebCore::SVGScriptElement::haveLoadedRequiredResources):
+        (WebCore::SVGScriptElement::dispatchLoadEvent):
+        (WebCore::SVGScriptElement::dispatchErrorEvent):
+        * svg/SVGScriptElement.h:
+
+2008-09-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=20951
+          Typo in Position::getInlineBoxAndOffset()
+          and add an assertion
+
+        Without the fix, the newly-added assertion fails in platform/mac/editing/input/caret-primary-bidi.html
+
+        * dom/Position.cpp:
+        (WebCore::Position::getInlineBoxAndOffset):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::positionForOffset):
+
+2008-09-19  David Hyatt  <hyatt@apple.com>
+
+        Add support for hit testing of all five possible scrollbar button placements.
+
+        Reviewed by Sam Weinig
+
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::paint):
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::):
+        (WebCore::ScrollbarThemeMac::backButtonRect):
+        (WebCore::ScrollbarThemeMac::forwardButtonRect):
+        (WebCore::ScrollbarThemeMac::trackRect):
+        (WebCore::ScrollbarThemeMac::paintButton):
+
+2008-09-19  Darin Adler  <darin@apple.com>
+
+        - try to fix Qt build
+
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtRuntimeObjectImp::QtRuntimeObjectImp): Add structure argument.
+        (JSC::Bindings::QtInstance::getRuntimeObject): Ditto.
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::RuntimeObjectImp): Add an overload just for Qt.
+        * bridge/runtime_object.h: Ditto.
+
+2008-09-19  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Transition starts running when it shouldn't
+        https://bugs.webkit.org/show_bug.cgi?id=20892
+
+        When there is a transition and an animation on the
+        same element, make sure the animation wins.
+
+        The fix is to save the unanimated style when an animation is started.
+        Then, when starting a transition, check to see if there is a current
+        animation on the same prop. If so, use the unanimated style as the
+        fromStyle rather than the current style.
+
+        Test: animations/transition-and-animation-1.html
+
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateTransitions):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::animate):
+        (WebCore::CompositeAnimation::getAnimationForProperty):
+        * page/animation/CompositeAnimation.h:
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::reset):
+        * page/animation/ImplicitAnimation.h:
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::hasAnimationForProperty):
+        * page/animation/KeyframeAnimation.h:
+        (WebCore::KeyframeAnimation::KeyframeAnimation):
+        (WebCore::KeyframeAnimation::unanimatedStyle):
+
+2008-09-19  David Hyatt  <hyatt@apple.com>
+
+        Add support for painting/hit testing of four possible scrollbar buttons.
+        The Windows themes simply ignore the two parts that they will never
+        show.  The Mac theme also ignores the other two buttons for now.
+
+        The cross-platform base for all three themes, ScrollbarThemeComposite,
+        has all the proper support though.
+
+        Reviewed by Sam Weinig
+
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::hitTest):
+        (WebCore::ScrollbarThemeComposite::invalidatePart):
+        * platform/ScrollbarThemeComposite.h:
+        * platform/mac/ScrollbarThemeMac.h:
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::backButtonRect):
+        (WebCore::ScrollbarThemeMac::forwardButtonRect):
+        (WebCore::ScrollbarThemeMac::paintButton):
+        * platform/win/ScrollbarThemeSafari.cpp:
+        (WebCore::ScrollbarThemeSafari::backButtonRect):
+        (WebCore::ScrollbarThemeSafari::forwardButtonRect):
+        (WebCore::ScrollbarThemeSafari::paintButton):
+        * platform/win/ScrollbarThemeSafari.h:
+        * platform/win/ScrollbarThemeWin.cpp:
+        (WebCore::ScrollbarThemeWin::backButtonRect):
+        (WebCore::ScrollbarThemeWin::forwardButtonRect):
+        (WebCore::ScrollbarThemeWin::paintButton):
+        * platform/win/ScrollbarThemeWin.h:
+
+2008-09-19  Matt Lilek  <webkit@mattlilek.com>
+
+        Reviewed by Tim Hatcher.
+
+        Bug 17772: Inspector should support point-and-click to select a node to inspect
+        https://bugs.webkit.org/show_bug.cgi?id=17772
+        <rdar://problem/5792395>
+
+        * English.lproj/localizedStrings.js:
+        * page/Chrome.cpp:
+        (WebCore::Chrome::mouseDidMoveOverElement):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMousePressEvent):
+        * page/InspectorController.cpp:
+        (WebCore::toggleNodeSearch):
+        (WebCore::searchingForNode):
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::toggleSearchForNodeInPage):
+        (WebCore::InspectorController::mouseDidMoveOverElement):
+        (WebCore::InspectorController::handleMousePressOnNode):
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        * page/InspectorController.h:
+        (WebCore::InspectorController::searchingForNodeInPage):
+        * page/inspector/ElementsPanel.js:
+        * page/inspector/Images/nodeSearchButtons.png: Added.
+        * page/inspector/inspector.css:
+
+2008-09-19  David Hyatt  <hyatt@apple.com>
+
+        Add new scrollbar parts to be able to represent back and forward buttons
+        at either end of the scrollbar.  The current scrollbar still just draws
+        a single button at either end, but the parts now exist.
+
+        Reviewed by Sam Weinig
+
+        * platform/ScrollTypes.h:
+        (WebCore::):
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::autoscrollTimerFired):
+        (WebCore::Scrollbar::pressedPartScrollDirection):
+        (WebCore::Scrollbar::pressedPartScrollGranularity):
+        (WebCore::Scrollbar::handleMouseMoveEvent):
+        * platform/ScrollbarTheme.h:
+        (WebCore::ScrollbarTheme::buttonsPlacement):
+        (WebCore::ScrollbarTheme::invalidateParts):
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::paint):
+        (WebCore::ScrollbarThemeComposite::hitTest):
+        (WebCore::ScrollbarThemeComposite::invalidatePart):
+        * platform/ScrollbarThemeComposite.h:
+
+2008-09-19  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for <rdar://problem/6231308> crash in AutoTableLayout
+
+        The code assumes later on that a TableSection's grid's row vector
+        will never be empty. So make 1 the minimum number of columns.
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::ensureRows):
+
+2008-09-19  David Hyatt  <hyatt@apple.com>
+
+        Add a new ScrollbarButtonsPlacement type for specifying where
+        the button arrows are in a scrollbar.
+
+        Read in the placement settings for Mac.  Nothing is done with the
+        setting yet.
+
+        Add a new buttonsPlacement() method to ScrollbarTheme composite
+        so that the arrow settings can be obtained.
+
+        Reviewed by Sam Weinig
+
+        * platform/ScrollTypes.h:
+        (WebCore::):
+        * platform/ScrollbarThemeComposite.h:
+        (WebCore::ScrollbarThemeComposite::buttonsPlacement):
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::updateArrowPlacement):
+        (WebCore::ScrollbarThemeMac::ScrollbarThemeMac):
+
+2008-09-19  Steve Falkenburg  <sfalken@apple.com>
+
+        Roll out r36626. It is causing variance in SunSpider numbers on XP.
+
+        Rubber stamped by Mark Rowe.
+
+        * platform/win/SharedTimerWin.cpp:
+        (WebCore::isRunningOnVistaOrLater):
+        (WebCore::setSharedTimerFireTime):
+
+2008-09-19  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20942
+        Bug 20942: Repeated messages in resources don't collapse
+        - Now repeated messages in a resource's view are collapsed and a message
+        says how many were repeated.
+
+        * English.lproj/localizedStrings.js:
+        * manual-tests/inspector/multiple-console-messages.html:
+        * page/inspector/Console.js: Send all the messages to the resource's
+        view before possibly returning early if the message is a repeat.
+        * page/inspector/SourceFrame.js: Add the text about the message being
+        repeated, if it is, and increment it when necessary.
+
+2008-09-19  Chris Fleizach  <cfleizach@apple.com>
+
+        Removed unnecessary #if
+
+        * page/mac/AccessibilityObjectWrapper.mm:
+
+2008-09-19  David Hyatt  <hyatt@apple.com>
+
+        Read in prefs for the scroll delay repeat values for buttons.  Also
+        honor the option-click pref for jumping to the thumb when clicking in
+        the track.
+
+        Reviewed by Sam Weinig
+
+        * platform/mac/ScrollbarThemeMac.h:
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::ScrollbarThemeMac):
+        (WebCore::ScrollbarThemeMac::initialAutoscrollTimerDelay):
+        (WebCore::ScrollbarThemeMac::autoscrollTimerDelay):
+        (WebCore::ScrollbarThemeMac::shouldCenterOnThumb):
+
+2008-09-19  David Hyatt  <hyatt@apple.com>
+
+        Move ScrollbarThemeMac.cpp to ScrollbarThemeMac.mm so it can use Obj-C.
+        Set the initial button repeat delay to 0.5 for Mac.
+
+        Reviewed by Sam Weinig
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/mac/ScrollbarThemeMac.cpp: Removed.
+        * platform/mac/ScrollbarThemeMac.h:
+        (WebCore::ScrollbarThemeMac::initialAutoscrollTimerDelay):
+        * platform/mac/ScrollbarThemeMac.mm: Copied from platform/mac/ScrollbarThemeMac.cpp.
+
+2008-09-19  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - part 2 of https://bugs.webkit.org/show_bug.cgi?id=20858
+          make each distinct C++ class get a distinct JSC::Structure
+
+          + Fixed all cases where we were using a shared structure for multiple
+            C++ classes in WebCore. This still has to be done in JavaScriptCore.
+
+          + Got rid of cacheGlobalObject.
+
+          + Improved use of PassRefPtr in bindings code.
+
+          + Removed a couple cases where we were potentially allocating prototypes
+            inside a JSObject's construction process -- this can lead to trouble if
+            we do a garbage collection while an object is only partly constructed.
+
+        * bindings/js/JSAudioConstructor.cpp:
+        (WebCore::JSAudioConstructor::JSAudioConstructor): Create a structure explicitly
+        so we don't implicitly share the structure with other objects that use the object
+        prototype.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::getCachedDOMConstructor): Added. To be used for constructors so we
+        don't need cacheGlobalObject any more.
+        (WebCore::cacheDOMConstructor): Ditto.
+
+        * bindings/js/JSDOMBinding.h: Removed DOMObject constructor that takes a prototype.
+        Added functions and a function template for getting cached DOM constructors.
+        Removed cacheGlobalObject function template.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::JSDOMWindowBase): Take a PassRefPtr<DOMWindow> since
+        we're taking ownership.
+        * bindings/js/JSDOMWindowBase.h: Changed constructor to take PassRefPtr, since
+        we're taking ownership. Added constructor map.
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::mark): Mark the constructors in the map.
+
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::JSDOMWindowShell): Take a PassRefPtr<DOMWindow> since
+        we're taking ownership. Use the new setWindow function to create the JSDOMWindow;
+        this is now done in only that one place.
+        (WebCore::JSDOMWindowShell::setWindow): Added. Creates the JSDOMWindow based on
+        the passed-in DOMWindow. Code was moved here and changed to allocate unique
+        structures for both the window prototype and the window.
+        * bindings/js/JSDOMWindowShell.h: Ditto.
+
+        * bindings/js/JSEventTargetBase.h: Changed class template argument so it doesn't
+        have the same name (JSEventTarget) as an actual class. Removed unhelpful use of
+        private/friend in JSEventTargetBase. Removed comments referring to defunct
+        macros. Changed JSEventTargetBasePrototype to get the prototype with the new
+        rather than its own copy of cacheGlobalObject (I missed this during pass 1).
+        Changed JSEventTargetBasePrototype so it doesn't have so many template arguments.
+
+        * bindings/js/JSEventTargetNode.cpp: Added s_info; needed for the new scheme
+        for caching structures and prototypes.
+        (WebCore::JSEventTargetNode::JSEventTargetNode): Use PassRefPtr.
+        (WebCore::JSEventTargetNode::createPrototype): Added.
+        * bindings/js/JSEventTargetNode.h: Updated for above changes.
+
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::JSHTMLAllCollection): Use PassRefPtr.
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::getNamedItems): Pass ExecState instead of prototype.
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        (WebCore::JSHTMLFormElement::nameGetter): Ditto.
+        * bindings/js/JSHTMLInputElementBase.cpp:
+        (WebCore::JSHTMLInputElementBase::JSHTMLInputElementBase): Use PassRefPtr.
+        * bindings/js/JSHTMLInputElementBase.h: Ditto.
+        * bindings/js/JSHTMLOptionElementConstructor.cpp:
+        (WebCore::JSHTMLOptionElementConstructor::JSHTMLOptionElementConstructor):
+        Create a unique structure instead of sharing.
+        * bindings/js/JSImageConstructor.cpp:
+        (WebCore::JSImageConstructor::JSImageConstructor): Ditto.
+
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::wrap): Removed overload that takes
+        a prototype rather than a structure. Made the use of inheritorID() here
+        explicit.
+        * bindings/js/JSInspectedObjectWrapper.h: Ditto.
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::wrap): Ditto.
+        * bindings/js/JSInspectorCallbackWrapper.h: Ditto.
+
+        * bindings/js/JSNamedNodesCollection.cpp:
+        (WebCore::JSNamedNodesCollection::JSNamedNodesCollection): Changed to
+        take an ExecState argument instead of a prototype. Create a unique
+        StructureID instead of sharing.
+        * bindings/js/JSNamedNodesCollection.h: Ditto.
+
+        * bindings/js/JSQuarantinedObjectWrapper.cpp: Removed overloaded
+        constructor that takes a prototype instead of a structure.
+        * bindings/js/JSQuarantinedObjectWrapper.h: Ditto.
+
+        * bindings/js/JSRGBColor.cpp:
+        (WebCore::JSRGBColor::JSRGBColor): Take ExecState instead of a
+        prototype; create a unique structure.
+        (WebCore::getJSRGBColor): Ditto.
+        * bindings/js/JSRGBColor.h: Ditto.
+
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        (WebCore::JSSQLResultSetRowList::item): Use constructEmptyObject instead
+        of explicit coding the idiom for making a new object.
+
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor):
+        Create a unique structure instead of the shared one.
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        (WebCore::JSXSLTProcessorConstructor::JSXSLTProcessorConstructor):
+        Ditto.
+
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::clearWindowShell): Let the window shell's
+        setWindow function create the JSDOMWindow instead of doing it here.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Changed to use PassRefPtr for
+        the structure and the wrapped object when creating wrappers.
+        Simplified some of the special cases for DOMWindow so they are
+        different only in ways the need to be. Eliminated the
+        JSDOMWindow::createPrototype and JSDOMWindowPrototype::self
+        functions. Moved responsibility for creating the structure and
+        parent prototype out of the prototype constructor into the
+        createPrototype function. Removed the unused "DoNotCache" flag for
+        objects other than DOMWindow. Use getDOMConstructor instead of
+        cacheGlobalObject for constructors. Make each constructor have
+        a unique structure ID.
+
+        * bridge/objc/objc_runtime.h: Added createPrototype and changed the
+        name of the info member to s_info so we can use the standard DOM
+        binding macros to handl the prototype.
+        * bridge/objc/objc_runtime.mm: Fixed namespacing a bit.
+        (JSC::Bindings::ObjcFallbackObjectImp::ObjcFallbackObjectImp):
+        Create a unique structure using getDOMStructure.
+
+        * bridge/runtime_array.cpp: Fixed namespacing a bit.
+        (JSC::RuntimeArray::RuntimeArray): Create a unique structure using
+        getDOMStructure.
+        * bridge/runtime_array.h: Added createPrototype so getDOMStructure
+        will work.
+
+        * bridge/runtime_object.cpp:
+        (JSC::RuntimeObjectImp::RuntimeObjectImp): Create a unique structure using
+        getDOMStructure.
+        * bridge/runtime_object.h: Added createPrototype so getDOMStructure
+        will work.
+
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::restore): Let the window shell's
+        setWindow function create the JSDOMWindow instead of doing it here.
+
+        * page/DOMWindow.idl: Removed DoNotCache, which is no longer used.
+
+2008-09-19  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        This optimization was suggested by Daniel Fenwick
+
+        - speed up measuring text on the Core Text code path by not specifying a paragraph writing direction
+
+        Specifying LTR paragraph directionality when measuring runs of RTL text
+        resulted in typically two CTRuns being generated for every run instead
+        of one, due to the leading space being reordered to the left.
+
+        * platform/graphics/SimpleFontData.h: Removed the ltr parameter to
+        getCFStringAttributes() and changed m_CFStringAttributes from an array
+        to a single value.
+        * platform/graphics/mac/CoreTextController.cpp:
+        (WebCore::CoreTextController::CoreTextController): Added a
+        mayUseNaturalWritingDirection parameter.
+        (WebCore::CoreTextController::collectCoreTextRunsForCharacters): Changed
+        to force the bidi embedding level whenever
+        m_mayUseNaturalWritingDirectrion is false. Since this is now a common
+        case, made the typesetter options dictionaries static.
+        * platform/graphics/mac/CoreTextController.h:
+        * platform/graphics/mac/FontMacCoreText.cpp:
+        (WebCore::Font::selectionRectForComplexText): Renamed a local variable.
+        (WebCore::Font::floatWidthForComplexText): Changed to allow the
+        CoreTextController to not set the writing direction.
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::getCFStringAttributes): Removed the ltr
+        parameter and the paragraph style attribute.
+
+2008-09-19  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig
+
+        https://bugs.webkit.org/show_bug.cgi?id=20941
+
+        Incorrect height calculation for replaced element inside nested
+        positioned elements (where the inner has a percentage height and
+        the outer implicitly has a fixed height because of explicit top/bottom
+        values).
+
+        Added fast/block/positioning/replaced-inside-top-bottom.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::availableHeightUsing):
+
+2008-09-19  Chris Fleizach  <cfleizach@apple.com>
+
+        Fix Tiger bustage
+
+        * page/mac/AccessibilityObjectWrapper.mm:
+
+2008-09-18  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6211041> Expose legend tag in accessibility
+
+        Exposes the legend tag as the titleUIElement of a fieldset
+
+        Test: accessibility/legend.html
+
+        * page/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::isFieldset):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::isFieldset):
+        (WebCore::AccessibilityRenderObject::titleUIElement):
+        * page/AccessibilityRenderObject.h:
+        * rendering/RenderFieldset.h:
+
+2008-09-19  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6213171> WebKit should use new array-centric methods for AX performance
+
+        Implement a few AX API methods that will be called by AppKit, which will
+        speed up access to accessibility objects
+
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityIndexOfChild:]):
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeCount:]):
+        (-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]):
+
+2008-09-19  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [qtwebkit] Set the m_should* flags to their proper value on entry
+        With plugins it was possible that we finished a job twice. This was
+        some kind of reentrancy in QNetworkReplyHandler::sendQueuedItems. By
+        setting the flag to (m_loadMode == LoadDeferred) they will always have
+        the right value and we will not send responses twice.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+
+2008-09-19  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon Hausmann.
+
+        [qtwebkit] Pass test 70 of acid3. Handle text decoding errors
+        Handle text decoding errors before instructing the parser to parse. We
+        have converted the text to QString and all encoding errors are gone and
+        the parser will not be able to detect them. So handle them before parsing.
+
+        * dom/XMLTokenizerQt.cpp:
+        (WebCore::XMLTokenizer::doWrite):
+
+2008-09-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        - part 1 of https://bugs.webkit.org/show_bug.cgi?id=20858
+          make each distinct C++ class get a distinct JSC::Structure
+
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        (WebCore::JSCSSStyleDeclaration::customPut): Use setDOMException
+        instead of DOMExceptionTranslator.
+
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::getCachedDOMObjectWrapper): Updated function name.
+        (WebCore::cacheDOMObjectWrapper): Ditto.
+        (WebCore::forgetDOMObject): Ditto.
+        (WebCore::getCachedDOMNodeWrapper): Ditto.
+        (WebCore::forgetDOMNode): Ditto.
+        (WebCore::cacheDOMNodeWrapper): Ditto.
+        (WebCore::forgetAllDOMNodesForDocument): Ditto.
+        (WebCore::markDOMNodesForDocument): Ditto.
+        (WebCore::updateDOMNodeDocument): Ditto.
+        (WebCore::getCachedDOMStructure): Added.
+        (WebCore::createDOMStructure): Ditto.
+
+        * bindings/js/JSDOMBinding.h: Get rid of the ScriptInterpreter
+        class and replace the static member functions with non-member
+        functions. Added many other functions for getting at structures,
+        prototypes, wrappers, and creating them. Also moved the
+        cacheGlobalObject function here from JavaScriptCore; eventually
+        I'll remove that once I get rid of the remaining callers. Also
+        removed the DOMExceptionTranslator class.
+
+        * bindings/js/JSDOMWindowBase.h: Added JSDOMStructureMap type,
+        and put one of those maps in each window.
+
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::markDOMObjectWrapper): Updated for function name change.
+        (WebCore::JSDOMWindow::mark): Added code to mark all the structures
+        in the structure map.
+
+        * bindings/js/JSEventTargetNode.cpp:
+        (WebCore::JSEventTargetNode::JSEventTargetNode): Changed to take
+        a structure instead of a prototype.
+        * bindings/js/JSEventTargetNode.h: Ditto.
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::JSHTMLAllCollection): Ditto.
+
+        * bindings/js/JSHTMLInputElementBase.cpp:
+        (WebCore::JSHTMLInputElementBase::JSHTMLInputElementBase): Removed
+        use of the JSC_IMPLEMENT_PROTOTYPE macro, and changed to take a
+        structure instead of a prototype.
+        * bindings/js/JSHTMLInputElementBase.h: Removed use of the
+        JSC_DEFINE_PROTOTYPE_WITH_PROTOTYPE macro, and changed constructor
+        to take a structure instead of a prototype. Created a dummy prototype
+        class that causes the HTMLInputElement prototype to have the
+        HTMLElement prototype.
+
+        * bindings/scripts/CodeGeneratorJS.pm: Change constructors to take
+        structures instead of prototypes. Changed the prototype self function
+        to use the getDOMPrototype function -- later we can eliminate it and
+        have callers invoke getDOMPrototype directly instead. Updated other
+        functions that have name changes. Added code to generate the
+        createPrototype member function. Changed use of cacheGlobalObject to
+        get it from the WebCore namespace instead of the JSC namespace.
+        Changed cacheDOMObject calls to use getDOMObjectWrapper instead.
+
+        * dom/Document.cpp:
+        (WebCore::Document::~Document): Updated for name change and also
+        removed unnecessary JSLock use -- there's no need to lock around this.
+        * dom/Node.cpp:
+        (WebCore::Node::setDocument): Ditto.
+
+        * dom/make_names.pl: Changed to use CREATE_DOM_NODE_WRAPPER macro
+        instead of calling new directly.
+
+        * bindings/js/JSCSSRuleCustom.cpp:
+        (WebCore::toJS): Updated for function name changes and used the
+        CREATE_DOM_OBJECT_WRAPPER macro.
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS): Ditto.
+        * bindings/js/JSCanvasPixelArrayCustom.cpp:
+        (WebCore::toJS): Ditto.
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::mark): Ditto.
+        (WebCore::toJS): Ditto.
+        * bindings/js/JSElementCustom.cpp:
+        (WebCore::toJSNewlyCreated): Ditto.
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS): Ditto.
+        * bindings/js/JSEventTargetBase.cpp:
+        (WebCore::jsEventTargetDispatchEvent): Use setDOMException instead
+        of DOMExceptionTranslator.
+        (WebCore::toJS): Updated for function name changes and used the
+        CREATE_DOM_OBJECT_WRAPPER macro.
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        (WebCore::toJS): Ditto.
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::mark): Ditto.
+        (WebCore::createWrapper): Ditto.
+        (WebCore::toJS): Ditto.
+        * bindings/js/JSSVGPathSegCustom.cpp:
+        (WebCore::toJS): Ditto.
+        * bindings/js/JSStyleSheetCustom.cpp:
+        (WebCore::toJS): Ditto.
+        (WebCore::JSStyleSheet::mark): Ditto.
+        * bindings/js/JSTextCustom.cpp:
+        (WebCore::toJSNewlyCreated): Ditto.
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        (WebCore::constructXMLHttpRequest): Ditto.
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::mark): Ditto.
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        (WebCore::JSXMLHttpRequestUpload::mark): Ditto.
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        (WebCore::constructXSLTProcessor): Ditto.
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::finishedWithEvent): Ditto.
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously): Ditto.
+        (WebCore::XMLHttpRequest::dropProtection): Ditto.
+
+2008-09-18  David Hyatt  <hyatt@apple.com>
+
+        This patch gets a viewless scrollbar working on Mac. It is turned off
+        by default.  Hit testing works.  For now the scrollbar just paints ugly
+        debug rects in the place of the buttons, track and thumb.  It does match
+        Aqua metrics though.
+
+        Reviewed by Sam Weinig
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passMousePressEventToScrollbar):
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::paint):
+        (WebCore::ScrollbarThemeComposite::trackPosition):
+        * platform/ScrollbarThemeComposite.h:
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::addChild):
+        * platform/mac/ScrollbarThemeMac.cpp:
+        (WebCore::):
+        (WebCore::ScrollbarThemeMac::hasButtons):
+        (WebCore::ScrollbarThemeMac::hasThumb):
+        (WebCore::buttonRepaintRect):
+        (WebCore::ScrollbarThemeMac::backButtonRect):
+        (WebCore::ScrollbarThemeMac::forwardButtonRect):
+        (WebCore::trackRepaintRect):
+        (WebCore::ScrollbarThemeMac::trackRect):
+        (WebCore::ScrollbarThemeMac::minimumThumbLength):
+        (WebCore::ScrollbarThemeMac::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeMac::paintTrack):
+        (WebCore::ScrollbarThemeMac::paintButton):
+        (WebCore::ScrollbarThemeMac::paintThumb):
+        * platform/mac/ScrollbarThemeMac.h:
+        (WebCore::ScrollbarThemeMac::supportsControlTints):
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::ScrollbarThemeQt::trackPosition):
+
+2008-09-18  Collin Jackson  <collinj@webkit.org>
+
+        Build fix; added missing header file to GNUmakefile.am
+
+        * GNUmakefile.am:
+
+2008-09-18  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David "the Hair" Hyatt.
+
+        Move DataRef, SVGRenderStyle and SVGRenderStyleDefs in render/style.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/DataRef.h: Removed.
+        * rendering/SVGRenderStyle.cpp: Removed.
+        * rendering/SVGRenderStyle.h: Removed.
+        * rendering/SVGRenderStyleDefs.cpp: Removed.
+        * rendering/SVGRenderStyleDefs.h: Removed.
+        * rendering/style/DataRef.h: Copied from rendering/DataRef.h.
+        * rendering/style/SVGRenderStyle.cpp: Copied from rendering/SVGRenderStyle.cpp.
+        * rendering/style/SVGRenderStyle.h: Copied from rendering/SVGRenderStyle.h.
+        * rendering/style/SVGRenderStyleDefs.cpp: Copied from rendering/SVGRenderStyleDefs.cpp.
+        * rendering/style/SVGRenderStyleDefs.h: Copied from rendering/SVGRenderStyleDefs.h.
+
+2008-09-18  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Add a means of clearing a FrameTree's name.
+
+        * WebCore.base.exp:
+        * page/FrameTree.cpp:
+        (WebCore::FrameTree::clearName):
+        * page/FrameTree.h:
+
+2008-09-18  David Hyatt  <hyatt@apple.com>
+
+        Eliminate addToSuperview from Widget, since it was only called
+        by ScrollViewMac's addChild method.  Just shift the original body
+        of addToSuperView into addChild.
+
+        Reviewed by Sam Weinig
+
+        * platform/Widget.h:
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::addChild):
+        * platform/mac/WidgetMac.mm:
+
+2008-09-18  Collin Jackson  <collinj@webkit.org>
+
+        Reviewed by Antti Koivisto and Mark Rowe.
+
+        Test: http/tests/misc/dns-prefetch-control.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=20690
+
+        Invoke WebCore::prefetchDNS() on host names that appear in
+        in the href of hyperlinks and <link rel="dns-prefetch">. This
+        can be used to implement DNS prefetching.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::processHttpEquiv):
+        (WebCore::Document::setSecurityOrigin):
+        (WebCore::Document::initDNSPrefetch):
+        (WebCore::Document::parseDNSPrefetchControlHeader):
+        * dom/Document.h:
+        (WebCore::Document::isDNSPrefetchEnabled):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::parseMappedAttribute):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::HTMLLinkElement):
+        (WebCore::HTMLLinkElement::parseMappedAttribute):
+        (WebCore::HTMLLinkElement::tokenizeRelAttribute):
+        (WebCore::HTMLLinkElement::process):
+        * html/HTMLLinkElement.h:
+        * html/PreloadScanner.cpp:
+        (WebCore::PreloadScanner::processAttribute):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::begin):
+        * platform/gtk/TemporaryLinkStubs.cpp:
+        (WebCore::prefetchDNS):
+        * platform/network/DNS.h: Added.
+        * platform/network/cf/DNSCFNet.cpp: Added.
+        (WebCore::prefetchDNS):
+        * platform/qt/TemporaryLinkStubs.cpp:
+        (WebCore::prefetchDNS):
+        * platform/wx/TemporaryLinkStubs.cpp:
+        (WebCore::prefetchDNS):
+
+2008-09-18  David Hyatt  <hyatt@apple.com>
+
+        Eliminate the convertToScreenCoordinate method on Widget, since
+        ScrollView has redundant methods that already do the same thing.
+
+        Reviewed by Sam Weinig
+
+        * editing/mac/SelectionControllerMac.mm:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+        * platform/Widget.h:
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::containingWindow):
+
+2008-09-18  David Hyatt  <hyatt@apple.com>
+
+        Move to only one constructor for Widgets.  Rename data to m_data and make
+        it have an #ifdef only for platforms that have platform-specific data (Mac
+        and Gtk).
+
+        Reviewed by Sam Weinig
+
+        * WebCore.base.exp:
+        * platform/Widget.cpp:
+        (WebCore::Widget::init):
+        * platform/Widget.h:
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::~Widget):
+        (WebCore::Widget::cursor):
+        (WebCore::Widget::setCursor):
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::~Widget):
+        (WebCore::Widget::addToSuperview):
+        (WebCore::Widget::removeFromSuperview):
+        (WebCore::Widget::beforeMouseDown):
+        (WebCore::Widget::afterMouseDown):
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::Widget):
+        * platform/win/WidgetWin.cpp:
+        (WebCore::Widget::Widget):
+        * platform/wx/WidgetWx.cpp:
+        (WebCore::Widget::Widget):
+
+2008-09-18  David Hyatt  <hyatt@apple.com>
+
+        Move Qt's isNPAPIPlugin boolean from Widget down to PluginView, since there
+        was no reason for it to be on Widget.  This change eliminates Qt ifdefs
+        from Widget.
+
+        Reviewed by Sam Weinig
+
+        * bindings/js/ScriptControllerQt.cpp:
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::WidgetPrivate::WidgetPrivate):
+        (WebCore::WidgetPrivate::~WidgetPrivate):
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::~Widget):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        (WebCore::PluginView::isNPAPIPlugin):
+        (WebCore::PluginView::setIsNPAPIPlugin):
+
+2008-09-18  David Hyatt  <hyatt@apple.com>
+
+        Make geometryChanged() cross-platform on Widget.  GTK and WIN platform
+        ifdefs are now gone from Widget!
+
+        Reviewed by Sam Weinig
+
+        * platform/Widget.h:
+        (WebCore::Widget::geometryChanged):
+        * platform/gtk/WidgetGtk.cpp:
+        * platform/qt/WidgetQt.cpp:
+
+2008-09-18  David Hyatt  <hyatt@apple.com>
+
+        Consolidate convertTo/FromContainingWindow methods so that all platforms
+        but Mac share the same code.
+
+        Move convertSelfToChild and convertChildToSelf to ScrollView, since
+        Widget should know nothing about children.  Make the methods cross-platform
+        on ScrollView.
+
+        Reviewed by Sam Weinig
+
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::convertChildToSelf):
+        (WebCore::ScrollView::convertSelfToChild):
+        * platform/Widget.cpp:
+        (WebCore::Widget::convertToContainingWindow):
+        (WebCore::Widget::convertFromContainingWindow):
+        * platform/Widget.h:
+        (WebCore::Widget::geometryChanged):
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::isScrollViewScrollbar):
+        * platform/gtk/WidgetGtk.cpp:
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::isScrollViewScrollbar):
+        * platform/mac/WidgetMac.mm:
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::isScrollViewScrollbar):
+        * platform/qt/WidgetQt.cpp:
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::isScrollViewScrollbar):
+        * platform/win/WidgetWin.cpp:
+
+2008-09-18  David Hyatt  <hyatt@apple.com>
+
+        Make the conversion methods that go to and from some containingWindow
+        cross-platform.  Implement them on Mac.
+
+        Reviewed by Sam Weinig
+
+        * platform/Widget.h:
+        (WebCore::Widget::setContainingWindow):
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::convertFromContainingWindow):
+        (WebCore::Widget::convertToContainingWindow):
+
+2008-09-18  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by David "Yeah-yeah" Hyatt.
+
+        Cleanup RenderStyle.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/style/CounterContent.h:
+        * rendering/style/RenderStyle.cpp:
+        * rendering/style/RenderStyle.h:
+
+2008-09-18  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Fixed https://bugs.webkit.org/show_bug.cgi?id=20908
+        Now TransformOperations and AnimationList no longer
+        inherit from Vector<> but rather have API to access.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::computedTransform):
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::createTransformOperations):
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc):
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateTransitions):
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        (WebCore::CompositeAnimation::animate):
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::validateTransformFunctionList):
+        * page/animation/KeyframeAnimation.cpp:
+        (WebCore::KeyframeAnimation::validateTransformFunctionList):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::updateReflectionStyle):
+        * rendering/style/AnimationList.cpp:
+        (WebCore::AnimationList::operator==):
+        * rendering/style/AnimationList.h:
+        (WebCore::AnimationList::operator!=):
+        (WebCore::AnimationList::size):
+        (WebCore::AnimationList::isEmpty):
+        (WebCore::AnimationList::resize):
+        (WebCore::AnimationList::remove):
+        (WebCore::AnimationList::append):
+        (WebCore::AnimationList::animation):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::StyleRareNonInheritedData::updateKeyframes):
+        (WebCore::RenderStyle::applyTransform):
+        (WebCore::RenderStyle::adjustAnimations):
+        (WebCore::RenderStyle::adjustTransitions):
+        (WebCore::RenderStyle::transitionForProperty):
+        * rendering/style/RenderStyle.h:
+        (WebCore::RenderStyle::hasTransform):
+        * rendering/style/TransformOperations.cpp:
+        (WebCore::TransformOperations::TransformOperations):
+        (WebCore::TransformOperations::operator==):
+        * rendering/style/TransformOperations.h:
+        (WebCore::TransformOperations::apply):
+        (WebCore::TransformOperations::operations):
+
+2008-09-18  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Build fix.
+
+        [qt] Build fixes after the Widget/ScrollView cleanup
+        topLevel() is now root()
+
+
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::scrollBackingStore):
+        (WebCore::ScrollView::addChild):
+        (WebCore::ScrollView::removeChild):
+
+2008-09-18  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20437
+
+        XMLTokenizer.cpp used to contain two different implementations. One was using
+        libxml2 and the other was using the Qt XML StreamReader. Clean up the code by
+        separating the two implementations from each other.
+        Common code and some small bits are kept inside the XMLTokenizer.cpp, the Qt code
+        was moved to XMLTokenizerQt.cpp and the Libxml2 based code was moved to
+        XMLTokenizerLibxml2.cpp. There should be no functional changes.
+
+        Attempt to add XMLTokenizerLibxml2.cpp to every buildsystem so the build continues
+        to work.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * dom/XMLTokenizer.cpp:
+        (WebCore::isScriptElement):
+        (WebCore::castToScriptElement):
+        (WebCore::XMLTokenizer::setCurrentNode):
+        (WebCore::XMLTokenizer::write):
+        (WebCore::XMLTokenizer::eventuallyMarkAsParserCreated):
+        (WebCore::XMLTokenizer::enterText):
+        (WebCore::toString):
+        (WebCore::XMLTokenizer::exitText):
+        (WebCore::XMLTokenizer::end):
+        (WebCore::XMLTokenizer::insertErrorMessageBlock):
+        * dom/XMLTokenizer.h:
+        (WebCore::XMLTokenizer::wellFormed):
+        * dom/XMLTokenizerLibxml2.cpp: Copied from WebCore/dom/XMLTokenizer.cpp.
+        (WebCore::createMemoryParser):
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        (WebCore::XMLTokenizer::~XMLTokenizer):
+        (WebCore::XMLTokenizer::doWrite):
+        (WebCore::ignorableWhitespaceHandler):
+        (WebCore::XMLTokenizer::initializeParserContext):
+        (WebCore::XMLTokenizer::doEnd):
+        (WebCore::XMLTokenizer::lineNumber):
+        (WebCore::XMLTokenizer::columnNumber):
+        (WebCore::XMLTokenizer::stopParsing):
+        (WebCore::XMLTokenizer::resumeParsing):
+        (WebCore::parseXMLDocumentFragment):
+        (WebCore::attributesStartElementNsHandler):
+        (WebCore::parseAttributes):
+        * dom/XMLTokenizerQt.cpp: Copied from WebCore/dom/XMLTokenizer.cpp.
+        (WebCore::EntityResolver::resolveUndeclaredEntity):
+        (WebCore::XMLTokenizer::XMLTokenizer):
+        (WebCore::XMLTokenizer::~XMLTokenizer):
+        (WebCore::XMLTokenizer::doWrite):
+        (WebCore::XMLTokenizer::initializeParserContext):
+        (WebCore::XMLTokenizer::doEnd):
+        (WebCore::XMLTokenizer::lineNumber):
+        (WebCore::XMLTokenizer::columnNumber):
+        (WebCore::XMLTokenizer::stopParsing):
+        (WebCore::XMLTokenizer::resumeParsing):
+        (WebCore::parseXMLDocumentFragment):
+        (WebCore::attributesStartElementNsHandler):
+        (WebCore::parseAttributes):
+        (WebCore::):
+
+2008-09-18  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Build fix for non-Mac builds.
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::cssText):
+
+2008-09-18  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by hyatt.  Landed by eseidel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20745
+        Animated GIFs do not animate properly with (at least) CG.
+
+        * WebCore\platform\graphics\BitmapImage.cpp:
+        * WebCore\platform\graphics\BitmapImage.h:
+        * WebCore\platform\graphics\cairo\ImageCairo.cpp:
+        * WebCore\platform\graphics\cg\ImageCG.cpp:
+        * WebCore\platform\graphics\qt\ImageQt.cpp:
+        * WebCore\platform\graphics\wx\ImageWx.cpp:
+
+2008-09-18  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin
+
+        <rdar://problem/6224222> AX: should not expose a <table> as an AXTable if ARIA
+        role specifies otherwise
+
+        If a <table> isn't an AXTable, the rows and cells should default to AccessibilityRenderObject
+
+        Test: accessibility/table-with-aria-role.html
+
+        * page/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
+        (WebCore::AccessibilityTable::addChildren):
+        (WebCore::AccessibilityTable::roleValue):
+        (WebCore::AccessibilityTable::accessibilityIsIgnored):
+        (WebCore::AccessibilityTable::title):
+        * page/AccessibilityTableCell.cpp:
+        (WebCore::AccessibilityTableCell::accessibilityIsIgnored):
+        (WebCore::AccessibilityTableCell::isTableCell):
+        (WebCore::AccessibilityTableCell::roleValue):
+        * page/AccessibilityTableCell.h:
+        * page/AccessibilityTableRow.cpp:
+        (WebCore::AccessibilityTableRow::roleValue):
+        (WebCore::AccessibilityTableRow::isTableRow):
+        (WebCore::AccessibilityTableRow::accessibilityIsIgnored):
+        * page/AccessibilityTableRow.h:
+
+2008-09-18  Steve Falkenburg  <sfalken@apple.com>
+
+        Use higher-resolution timers on all variants of Windows.
+
+        Reviewed by Darin Adler.
+
+        * platform/win/SharedTimerWin.cpp:
+        (WebCore::setSharedTimerFireTime):
+
+
+2008-09-18  David Hyatt  <hyatt@apple.com>
+
+        Make containingWindow() and setContainingWindow() cross-platform.
+        Add a root() function cross-platform so Qt doesn't have to
+        define its own.
+
+        Reviewed by Darin Adler
+
+        * platform/Widget.cpp:
+        (WebCore::Widget::root):
+        * platform/Widget.h:
+        (WebCore::Widget::setContainingWindow):
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::containingWindow):
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::addChild):
+        (WebCore::ScrollView::removeChild):
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::containingWindow):
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::invalidateRect):
+        (WebCore::Widget::containingWindow):
+        * platform/win/WidgetWin.cpp:
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::~Widget):
+        (WebCore::Widget::containingWindow):
+
+2008-09-18  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=20515 Crash upon
+        parsing CSS: unicode-range: searchfield-cancel-buttonpt=-webkit-
+        dashboard-region=
+        and corresponding: <rdar://problem/6174100>
+
+        This patch makes CSSParserValue::createCSSValue handle unknown
+        identifiers.
+
+        * css/CSSParserValues.cpp:
+        (WebCore::CSSParserValue::createCSSValue): If we have an identifier
+        with no id (an unknown identifier) create a CSSPrimitiveValue of
+        type CSS_PARSER_IDENTIFIER
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::CSSPrimitiveValue::cssText):
+        (WebCore::CSSPrimitiveValue::parserValue):
+        * css/CSSPrimitiveValue.h:
+        (WebCore::CSSPrimitiveValue::):
+
+2008-09-18  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by David "I'd prefer not" Hyatt.
+
+        More the remaining class out of RenderStyle.h/cpp
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * rendering/style/CursorData.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::CursorData::CursorData):
+        (WebCore::CursorData::operator==):
+        (WebCore::CursorData::operator!=):
+        * rendering/style/CursorList.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::CursorList::operator[]):
+        (WebCore::CursorList::CursorList):
+        * rendering/style/RenderStyle.cpp:
+        * rendering/style/RenderStyle.h:
+        (WebCore::RenderStyle::deref):
+        (WebCore::RenderStyle::hasOneRef):
+        (WebCore::RenderStyle::InheritedFlags::operator!=):
+        (WebCore::RenderStyle::NonInheritedFlags::operator!=):
+        (WebCore::RenderStyle::hasBackground):
+        (WebCore::RenderStyle::outlineWidth):
+        (WebCore::RenderStyle::autoWrap):
+        (WebCore::RenderStyle::preserveNewline):
+        (WebCore::RenderStyle::collapseWhiteSpace):
+        (WebCore::RenderStyle::isCollapsibleWhiteSpace):
+        (WebCore::RenderStyle::breakOnlyAfterWhiteSpace):
+        (WebCore::RenderStyle::breakWords):
+        (WebCore::RenderStyle::outlineOffset):
+        (WebCore::RenderStyle::setLeft):
+        (WebCore::RenderStyle::setRight):
+        (WebCore::RenderStyle::setTop):
+        (WebCore::RenderStyle::setBottom):
+        (WebCore::RenderStyle::setDashboardRegion):
+        (WebCore::RenderStyle::setBackgroundColor):
+        (WebCore::RenderStyle::setBorderImage):
+        (WebCore::RenderStyle::setBorderRadius):
+        (WebCore::RenderStyle::setFontDescription):
+        (WebCore::RenderStyle::adjustBackgroundLayers):
+        (WebCore::RenderStyle::adjustMaskLayers):
+        (WebCore::RenderStyle::deleteBindingURIs):
+        (WebCore::RenderStyle::inheritBindingURIs):
+        (WebCore::RenderStyle::isDisplayReplacedType):
+        (WebCore::RenderStyle::isDisplayInlineType):
+        (WebCore::RenderStyle::isOriginalDisplayInlineType):
+        * rendering/style/StyleInheritedData.cpp: Copied from rendering/style/RenderStyle.cpp.
+        * rendering/style/StyleInheritedData.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::StyleInheritedData::operator!=):
+        * rendering/style/StyleRareInheritedData.cpp: Copied from rendering/style/RenderStyle.cpp.
+        * rendering/style/StyleRareInheritedData.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::StyleRareInheritedData::operator!=):
+        * rendering/style/StyleRareNonInheritedData.cpp: Copied from rendering/style/RenderStyle.cpp.
+        * rendering/style/StyleRareNonInheritedData.h: Copied from rendering/style/RenderStyle.h.
+        * rendering/style/StyleReflection.h: Copied from rendering/style/RenderStyle.h.
+
+2008-09-18  David Hyatt  <hyatt@apple.com>
+
+        Move the concept of suppression invalidation on Widgets to Scrollbar
+        instead.  Since this is only used by Scrollbars, there is no need for
+        it to be on Widget.
+
+        Reviewed by Sam Weinig
+
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::Scrollbar):
+        (WebCore::Scrollbar::invalidateRect):
+        * platform/Scrollbar.h:
+        (WebCore::Scrollbar::suppressInvalidation):
+        (WebCore::Scrollbar::setSuppressInvalidation):
+        * platform/Widget.h:
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::invalidateRect):
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::WidgetPrivate::WidgetPrivate):
+        (WebCore::Widget::invalidateRect):
+        * platform/win/WidgetWin.cpp:
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::invalidateRect):
+
+2008-09-18  David Hyatt  <hyatt@apple.com>
+
+        Make invalidate() on Widget non-virtual and make it just call
+        invalidateRect() on the boundsGeometry() of the Widget.
+
+        Reviewed by Dan Bernstein
+
+        * platform/Widget.h:
+        (WebCore::Widget::boundsGeometry):
+        (WebCore::Widget::invalidate):
+        * platform/gtk/WidgetGtk.cpp:
+        * platform/mac/WidgetMac.mm:
+        * platform/qt/WidgetQt.cpp:
+        * platform/win/WidgetWin.cpp:
+        * platform/wx/WidgetWx.cpp:
+
+2008-09-18  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped in exile by David Hyatt.
+
+        Split Animation, AnimationList, BindingURI, ContentData, CounterContent,
+        KeyframeList, ShadowData, StyleFlexibleBoxData and TimingFunction out of
+        RenderStyle.h/cpp
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/CSSStyleSelector.cpp:
+        * css/CSSStyleSelector.h:
+        * page/animation/CompositeAnimation.cpp:
+        * page/animation/KeyframeAnimation.cpp:
+        * page/animation/KeyframeAnimation.h:
+        * rendering/RenderCounter.h:
+        * rendering/style/Animation.cpp: Copied from rendering/style/RenderStyle.cpp.
+        (WebCore::Animation::~Animation):
+        (WebCore::Animation::animationsMatch):
+        (WebCore::Animation::keyframeList):
+        (WebCore::Animation::setAnimationKeyframe):
+        * rendering/style/Animation.h: Copied from rendering/style/RenderStyle.h.
+        * rendering/style/AnimationList.cpp: Copied from rendering/style/RenderStyle.cpp.
+        * rendering/style/AnimationList.h: Copied from rendering/style/RenderStyle.h.
+        * rendering/style/BindingURI.cpp: Copied from rendering/style/RenderStyle.cpp.
+        * rendering/style/BindingURI.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::BindingURI::operator!=):
+        * rendering/style/ContentData.cpp: Copied from rendering/style/RenderStyle.cpp.
+        * rendering/style/ContentData.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::ContentData::ContentData):
+        (WebCore::ContentData::~ContentData):
+        * rendering/style/CounterContent.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::CounterContent::CounterContent):
+        * rendering/style/CounterDirectives.cpp: Copied from rendering/style/RenderStyle.cpp.
+        * rendering/style/CounterDirectives.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::CounterDirectives::CounterDirectives):
+        * rendering/style/KeyframeList.cpp: Copied from rendering/style/RenderStyle.cpp.
+        (WebCore::KeyframeList::insert):
+        * rendering/style/KeyframeList.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::KeyframeValue::KeyframeValue):
+        (WebCore::KeyframeList::create):
+        (WebCore::KeyframeList::KeyframeList):
+        * rendering/style/RenderStyle.cpp:
+        * rendering/style/RenderStyle.h:
+        * rendering/style/ShadowData.cpp: Copied from rendering/style/RenderStyle.cpp.
+        * rendering/style/ShadowData.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::ShadowData::ShadowData):
+        (WebCore::ShadowData::~ShadowData):
+        (WebCore::ShadowData::operator!=):
+        * rendering/style/StyleFlexibleBoxData.cpp: Copied from rendering/style/RenderStyle.cpp.
+        * rendering/style/StyleFlexibleBoxData.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::StyleFlexibleBoxData::operator!=):
+        * rendering/style/TimingFunction.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::TimingFunction::TimingFunction):
+        (WebCore::TimingFunction::operator==):
+
+2008-09-18  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix RenderStyle leaks.
+
+        * rendering/RenderTextControl.cpp: (WebCore::RenderTextControl::createSubtreeIfNeeded):
+
+2008-09-18  Kevin McCullough  <kmccullough@apple.com>
+
+        Accidentally checked in code.
+
+        * html/HTMLElementFactory.cpp:
+        (WebCore::frameConstructor):
+        (WebCore::iframeConstructor):
+
+2008-09-18  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        <rdar://problem/5722310> gracefully handle too many console messages
+        (20904)
+        - Keep track of the most previous message and then compare it to the
+        subsequent messages as they come in.  If there are multiple of the same
+        message create a count that indicates the current number.
+
+        * manual-tests/inspector/multiple-console-messages.html: Added.
+        * page/inspector/Console.js:
+        * page/inspector/inspector.css:
+
+2008-09-18  Jonathon Jongsma  <jonathon@quotidian.org>
+
+        Reviewed by Alp Toker
+
+        https://bugs.webkit.org/show_bug.cgi?id=20830
+        [GTK] Don't use deprecated pango API
+
+        Replace deprecated pango functions with non-deprecated ones for newer
+        versions of pango
+
+        * platform/graphics/gtk/FontGtk.cpp:
+        (WebCore::getDefaultPangoLayout):
+        * platform/graphics/gtk/FontPlatformDataPango.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2008-09-18  Alp Toker  <alp@nuanti.com>
+
+        Build fix for r36587. Add new sources (and sort the lists).
+
+        * GNUmakefile.am:
+
+2008-09-17  Sam Weinig  <sam@webkit.org>
+
+        Fix Windows build.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2008-09-17  David Hyatt  <hyatt@apple.com>
+
+        Switch back to having frameGeometry be virtual in order to keep Mac
+        the way it used to be.
+
+        Reviewed by Sam Weinig
+
+        * WebCore.base.exp:
+        * platform/Widget.cpp:
+        (WebCore::Widget::setParent):
+        * platform/Widget.h:
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::frameGeometry):
+        (WebCore::Widget::setFrameGeometry):
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::frameGeometry):
+        (WebCore::Widget::setFrameGeometry):
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::Widget::frameGeometry):
+        (WebCore::Widget::setFrameGeometry):
+        * platform/win/WidgetWin.cpp:
+        (WebCore::Widget::frameGeometry):
+        (WebCore::Widget::setFrameGeometry):
+        * platform/wx/WidgetWx.cpp:
+        (WebCore::Widget::frameGeometry):
+        (WebCore::Widget::setFrameGeometry):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameGeometry):
+        (WebCore::PluginView::geometryChanged):
+        * plugins/PluginView.h:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+
+2008-09-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix assertion in DOMWindow::adjustWindowRect where we were passing
+        in garbage values and were getting lucky that they were a not Nan.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::windowProtoFuncOpen):
+
+2008-09-17  Sam Weinig  <sam@webkit.org>
+
+        Fix gtk build.
+
+        * rendering/style/MatrixTransformOperation.cpp:
+
+2008-09-17  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped with love by David Hyatt.
+
+        Split IdentityTransformOperation, MatrixTransformOperation, RotateTransformOperation,
+        ScaleTransformOperation, SkewTransformOperation, StyleTransformData, TransformOperation,
+        TransformOperations and TranslateTransformOperation out of RenderStyle.h/cpp
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * css/CSSStyleSelector.cpp:
+        * page/animation/AnimationBase.cpp:
+        (WebCore::solveEpsilon):
+        * rendering/RenderLayer.cpp:
+        * rendering/style/IdentityTransformOperation.h: Copied from rendering/style/RenderStyle.h.
+        * rendering/style/MatrixTransformOperation.cpp: Copied from rendering/style/RenderStyle.cpp.
+        * rendering/style/MatrixTransformOperation.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::MatrixTransformOperation::MatrixTransformOperation):
+        * rendering/style/RenderStyle.cpp:
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RotateTransformOperation.cpp: Copied from rendering/style/RenderStyle.cpp.
+        * rendering/style/RotateTransformOperation.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::RotateTransformOperation::RotateTransformOperation):
+        * rendering/style/ScaleTransformOperation.cpp: Copied from rendering/style/RenderStyle.cpp.
+        * rendering/style/ScaleTransformOperation.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::ScaleTransformOperation::ScaleTransformOperation):
+        * rendering/style/SkewTransformOperation.cpp: Copied from rendering/style/RenderStyle.cpp.
+        * rendering/style/SkewTransformOperation.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::SkewTransformOperation::SkewTransformOperation):
+        * rendering/style/StyleTransformData.cpp: Copied from rendering/style/RenderStyle.cpp.
+        * rendering/style/StyleTransformData.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::StyleTransformData::operator!=):
+        * rendering/style/TransformOperation.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::TransformOperation::):
+        * rendering/style/TransformOperations.cpp: Copied from rendering/style/RenderStyle.cpp.
+        (WebCore::TransformOperations::TransformOperations):
+        * rendering/style/TransformOperations.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::TransformOperations::operator!=):
+        * rendering/style/TranslateTransformOperation.cpp: Copied from rendering/style/RenderStyle.cpp.
+        * rendering/style/TranslateTransformOperation.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::TranslateTransformOperation::TranslateTransformOperation):
+
+2008-09-17  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        * rendering/style/StyleDashboardRegion.h:  PlatformString.h rather than String.h.
+
+2008-09-17  David Hyatt  <hyatt@apple.com>
+
+        (1) Inline a bunch of methods for accessing frame geometry.
+        (2) Make sure frameGeometry() works even when you have no underlying
+        native widget.
+        (3) Cache a frame geometry rect cross-platform (even for widgets that
+        have underlying native widgets.
+        (4) PluginView's updateWindow call is now a virtual function on Widget.
+
+        Reviewed by Sam Weinig
+
+        * ChangeLog:
+        * WebCore.base.exp:
+        * platform/Widget.cpp:
+        (WebCore::Widget::setFrameGeometry):
+        * platform/Widget.h:
+        (WebCore::Widget::x):
+        (WebCore::Widget::y):
+        (WebCore::Widget::width):
+        (WebCore::Widget::height):
+        (WebCore::Widget::size):
+        (WebCore::Widget::pos):
+        (WebCore::Widget::frameGeometry):
+        (WebCore::Widget::resize):
+        (WebCore::Widget::move):
+        (WebCore::Widget::isFrameView):
+        (WebCore::Widget::windowClipRect):
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::~Widget):
+        (WebCore::Widget::updatePlatformWidgetFrameGeometry):
+        * platform/win/WidgetWin.cpp:
+        (WebCore::Widget::updatePlatformWidgetFrameGeometry):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::setFrameGeometry):
+        (WebCore::PluginView::geometryChanged):
+        * plugins/PluginView.h:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::updatePlatformWidgetFrameGeometry):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updatePlatformWidgetFrameGeometry):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::updatePlatformWidgetFrameGeometry):
+        * plugins/wx/PluginViewWx.cpp:
+
+2008-09-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by David "Waterman" Hyatt.
+
+        Fix a leak of NSViews in WidgetMac.mm.
+
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::~Widget):
+
+2008-09-17  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by David Waterman Hyatt.
+
+        Split FillLayer, StyleBackgroundData, StyleBoxData, StyleDashboardRegion, StyleMarqueeData
+        StyleMultiColData and StyleVisualData out of RenderStyle.h/cpp
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * rendering/style/FillLayer.cpp: Copied from rendering/style/RenderStyle.cpp.
+        * rendering/style/FillLayer.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::FillLayer::operator!=):
+        (WebCore::FillLayer::hasImage):
+        (WebCore::FillLayer::hasFixedImage):
+        * rendering/style/RenderStyle.cpp:
+        * rendering/style/RenderStyle.h:
+        * rendering/style/StyleBackgroundData.cpp: Copied from rendering/style/RenderStyle.cpp.
+        (WebCore::StyleBackgroundData::StyleBackgroundData):
+        * rendering/style/StyleBackgroundData.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::StyleBackgroundData::~StyleBackgroundData):
+        (WebCore::StyleBackgroundData::operator!=):
+        * rendering/style/StyleBoxData.cpp: Copied from rendering/style/RenderStyle.cpp.
+        * rendering/style/StyleBoxData.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::StyleBoxData::operator!=):
+        * rendering/style/StyleDashboardRegion.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::StyleDashboardRegion::operator!=):
+        * rendering/style/StyleMarqueeData.cpp: Copied from rendering/style/RenderStyle.cpp.
+        * rendering/style/StyleMarqueeData.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::StyleMarqueeData::operator!=):
+        * rendering/style/StyleMultiColData.cpp: Copied from rendering/style/RenderStyle.cpp.
+        * rendering/style/StyleMultiColData.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::StyleMultiColData::operator!=):
+        (WebCore::StyleMultiColData::ruleWidth):
+        * rendering/style/StyleVisualData.cpp: Copied from rendering/style/RenderStyle.cpp.
+        * rendering/style/StyleVisualData.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::StyleVisualData::operator==):
+
+2008-09-17  David Hyatt  <hyatt@apple.com>
+
+        Remove WidgetClient from Widget.
+
+        Reviewed by Sam Weinig
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/Widget.h:
+        (WebCore::Widget::setClient):
+        (WebCore::Widget::client):
+        * platform/WidgetClient.h: Removed.
+        * platform/gtk/WidgetGtk.cpp:
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::WidgetPrivate::WidgetPrivate):
+        * platform/win/WidgetWin.cpp:
+        (WebCore::Widget::Widget):
+        * platform/wx/WidgetWx.cpp:
+        (WebCore::Widget::Widget):
+
+2008-09-17  David Hyatt  <hyatt@apple.com>
+
+        Remove isEnabled/setEnabled from Widget.  The concept of being enabled now
+        only applies to Scrollbars so the method has been moved there and made
+        cross-platform.  Scrollbar subclasses that have a corresponding native
+        widget can subclass setEnabled to change the enabled state of the native
+        widget.
+
+        Reviewed by Sam Weinig & Darin Adler
+
+        * WebCore.base.exp:
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::Scrollbar):
+        * platform/Scrollbar.h:
+        (WebCore::Scrollbar::enabled):
+        (WebCore::Scrollbar::setEnabled):
+        * platform/Widget.h:
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::setEnabled):
+        * platform/gtk/ScrollbarGtk.h:
+        * platform/gtk/WidgetGtk.cpp:
+        * platform/mac/ScrollbarMac.h:
+        * platform/mac/ScrollbarMac.mm:
+        (WebCore::ScrollbarMac::scrollbarHit):
+        (WebCore::ScrollbarMac::setEnabled):
+        * platform/mac/WidgetMac.mm:
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::WidgetPrivate::WidgetPrivate):
+        * platform/win/WidgetWin.cpp:
+        (WebCore::Widget::Widget):
+        * platform/wx/WidgetWx.cpp:
+
+2008-09-17  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by David Hyatt.
+
+        Split all RenderStyle enums into their own file.
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/style/BorderValue.h:
+        * rendering/style/CollapsedBorderValue.h:
+        * rendering/style/RenderStyle.h:
+        * rendering/style/RenderStyleConstants.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::):
+        * rendering/style/StyleCachedImage.h:
+        * rendering/style/StyleGeneratedImage.h:
+        * rendering/style/StyleImage.h:
+
+2008-09-17  Steve Falkenburg  <sfalken@apple.com>
+
+        Add back isFrameView check to fix failed assertion during scroll bar teardown.
+
+        Reviewed by Dave Hyatt.
+
+        * platform/Scrollbar.cpp:
+        (WebCore::Scrollbar::setParent):
+
+2008-09-17  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Mac build fix
+
+        * WebCore.xcodeproj/project.pbxproj: Send appropriate headers to WebKit
+
+2008-09-17  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix build.
+
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::setParentVisible):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::init):
+
+2008-09-17  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon.
+
+        [QtWebKit] Implement error handling in TextCodecQt::decode
+        Use the QTextCodec parsing state to set the sawError out variable. This
+        is needed to pass Test 70 of acid3. The test case for this bug is
+        fast/encoding/invalid-xml.html that is now partially passed. To pass
+        it completely the Qt text codecs need to be adjusted to have proper
+        error handling.
+
+        * platform/text/qt/TextCodecQt.cpp:
+        (WebCore::TextCodecQt::decode):
+
+2008-09-17  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Dave Hyatt.
+
+        Split BorderData, BorderValue, CollapsedBorderValue, OutlineValue and StyleSurroundData
+        out of RenderStyle.h/cpp
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * rendering/style/BorderData.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::BorderData::hasBorderRadius):
+        (WebCore::BorderData::borderLeftWidth):
+        (WebCore::BorderData::borderRightWidth):
+        (WebCore::BorderData::borderTopWidth):
+        (WebCore::BorderData::borderBottomWidth):
+        (WebCore::BorderData::operator!=):
+        * rendering/style/BorderValue.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::):
+        (WebCore::BorderValue::BorderValue):
+        (WebCore::BorderValue::nonZero):
+        (WebCore::BorderValue::isTransparent):
+        (WebCore::BorderValue::isVisible):
+        * rendering/style/CollapsedBorderValue.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::):
+        (WebCore::CollapsedBorderValue::CollapsedBorderValue):
+        (WebCore::CollapsedBorderValue::operator==):
+        * rendering/style/OutlineValue.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::OutlineValue::OutlineValue):
+        * rendering/style/RenderStyle.cpp:
+        * rendering/style/RenderStyle.h:
+        * rendering/style/StyleSurroundData.cpp: Copied from rendering/style/RenderStyle.cpp.
+        * rendering/style/StyleSurroundData.h: Copied from rendering/style/RenderStyle.h.
+        (WebCore::StyleSurroundData::operator!=):
+
+2008-09-17  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        This is a better fix for: Invalid CSS code crashes Safari
+        https://bugs.webkit.org/show_bug.cgi?id=20512
+
+        The spec indicates that the only valid input for a counter is a
+        number or an identifier. So that is exactly what we allow.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseCounterContent):
+
+2008-09-17  Alp Toker  <alp@nuanti.com>
+
+        GTK+ build fix. Adapt to use PlatformWidget functions.
+
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollViewScrollbar::geometryChanged):
+        (WebCore::ScrollView::addChild):
+        (WebCore::ScrollView::removeChild):
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::ScrollbarGtk):
+        (ScrollbarGtk::~ScrollbarGtk):
+        (ScrollbarGtk::geometryChanged):
+
+2008-09-17  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adele Peterson.
+
+        Patch for <rdar://problem/6133884>
+        Calling window.resizeTo() on a subframe shouldn't change the window size
+
+        Test: fast/dom/Window/window-resize-and-move-sub-frame.html
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::moveBy):
+        (WebCore::DOMWindow::moveTo):
+        (WebCore::DOMWindow::resizeBy):
+        (WebCore::DOMWindow::resizeTo):
+
+2008-09-17  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=20512 Invalid CSS
+        code crashes Safari
+        and corresponding: <rdar://problem/6173832>
+
+        Reading through the spec, it seems like a function is not valid
+        input for a counter. So this patch checks for that and bails in the
+        case of invalid input.
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseCounterContent):
+
+2008-09-17  Greg Bolsinga  <bolsinga@apple.com>
+
+        Reviewed by Antti Koivisto.
+
+        Fix <rdar://problem/6227089>
+        Crash in WebCore::Frame::setNeedsReapplyStyles()
+
+        View is null checked elsewhere too.
+
+        * page/Frame.cpp:
+        (WebCore::Frame::setNeedsReapplyStyles):
+
+2008-09-17  David Hyatt  <hyatt@apple.com>
+
+        Make the notion of having a native widget backing a Widget cross-platform.
+        The PlatformWidget abstraction (which already existed) is used for this.
+             Windows = HWND
+             Qt = QWidget
+             Mac = NSView
+             wx = wxWindow
+             Gtk = GtkWidget
+
+        There are new cross-platform methods that replace all of the unique
+        platform-specific methods.
+             platformWidget()
+             setPlatformWidget()
+
+        For plugins, on every platform except Qt on Windows, the plugin's native
+        widget is now stored in the Widget base class.  Since Qt on Windows uses
+        HWNDs for plugins instead of QWidget, it is the only platform to keep the
+        m_window variable in PluginView.
+
+        Reviewed by Sam Weinig
+
+        * WebCore.base.exp:
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper attachmentView]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passMouseDownEventToWidget):
+        (WebCore::EventHandler::mouseDownViewIfStillGood):
+        (WebCore::EventHandler::passWheelEventToWidget):
+        (WebCore::EventHandler::sendFakeEventsAfterWidgetTracking):
+        * platform/Widget.cpp:
+        (WebCore::Widget::init):
+        (WebCore::Widget::setParent):
+        (WebCore::Widget::releasePlatformWidget):
+        (WebCore::Widget::retainPlatformWidget):
+        * platform/Widget.h:
+        (WebCore::Widget::platformWidget):
+        (WebCore::Widget::setPlatformWidget):
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::setFocus):
+        (WebCore::gdkDrawable):
+        (WebCore::Widget::setCursor):
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        (WebCore::Widget::setEnabled):
+        (WebCore::Widget::isEnabled):
+        (WebCore::Widget::paint):
+        * platform/mac/PlatformScreenMac.mm:
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::scrollView):
+        (WebCore::ScrollView::update):
+        (WebCore::ScrollView::inWindow):
+        * platform/mac/ScrollbarMac.mm:
+        (WebCore::ScrollbarMac::ScrollbarMac):
+        (WebCore::ScrollbarMac::~ScrollbarMac):
+        (WebCore::ScrollbarMac::updateThumbPosition):
+        (WebCore::ScrollbarMac::updateThumbProportion):
+        (WebCore::ScrollbarMac::scrollbarHit):
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::setEnabled):
+        (WebCore::Widget::isEnabled):
+        (WebCore::Widget::setFocus):
+        (WebCore::Widget::getOuterView):
+        (WebCore::Widget::paint):
+        (WebCore::Widget::invalidate):
+        (WebCore::Widget::invalidateRect):
+        (WebCore::Widget::setIsSelected):
+        (WebCore::Widget::releasePlatformWidget):
+        (WebCore::Widget::retainPlatformWidget):
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::WidgetPrivate::WidgetPrivate):
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::setFrameGeometry):
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        (WebCore::Widget::isEnabled):
+        (WebCore::Widget::setEnabled):
+        (WebCore::Widget::invalidateRect):
+        (WebCore::Widget::containingWindow):
+        * platform/win/WidgetWin.cpp:
+        (WebCore::Widget::Widget):
+        * platform/wx/WidgetWx.cpp:
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::frameGeometry):
+        (WebCore::Widget::setFocus):
+        (WebCore::Widget::setCursor):
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        (WebCore::Widget::setFrameGeometry):
+        (WebCore::Widget::setEnabled):
+        (WebCore::Widget::isEnabled):
+        (WebCore::Widget::invalidate):
+        (WebCore::Widget::invalidateRect):
+        (WebCore::Widget::paint):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        (WebCore::PluginView::platformPluginWidget):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::updateWindow):
+        (WebCore::PluginView::setFocus):
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
+        (WebCore::PluginView::setParent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::setParentVisible):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::init):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::updateWindow):
+        (WebCore::PluginView::setFocus):
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
+        (WebCore::PluginView::setParent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::setParentVisible):
+        (WebCore::PluginView::getValue):
+        (WebCore::PluginView::~PluginView):
+        (WebCore::PluginView::init):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::updateWindow):
+        (WebCore::PluginView::setFocus):
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::setParent):
+        (WebCore::PluginView::setParentVisible):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::forceRedraw):
+        (WebCore::PluginView::~PluginView):
+        (WebCore::PluginView::init):
+
+2008-09-17  Sam Weinig  <sam@webkit.org>
+
+        Fix assert.
+
+        * platform/Widget.cpp:
+        (WebCore::Widget::setParent):
+
+2008-09-17  David Hyatt  <hyatt@apple.com>
+
+        Beginnings of Widget refactoring (in order to make the mixing of
+        widgets with and without corresponding native widgets more cross-platform).
+
+        This first patch makes the concept of a parent ScrollView cross-platform.
+
+        Note the similarity of the show/hide methods on the three PluginViews.  This
+        will be refactored better in a later patch so that they can all share
+        a base class Widget show/hide method.  For now the changes were made
+        simply to be able to bring WidgetWin's setParent method up into Widget.
+
+        Reviewed by Sam Weinig
+
+        * WebCore.base.exp:
+        * platform/ScrollView.h:
+        * platform/Widget.cpp:
+        (WebCore::Widget::init):
+        (WebCore::Widget::setParent):
+        * platform/Widget.h:
+        (WebCore::Widget::isSelfVisible):
+        (WebCore::Widget::isParentVisible):
+        (WebCore::Widget::isVisible):
+        (WebCore::Widget::setParentVisible):
+        (WebCore::Widget::isPluginView):
+        (WebCore::Widget::parent):
+        (WebCore::Widget::handleEvent):
+        (WebCore::Widget::geometryChanged):
+        * platform/gtk/WidgetGtk.cpp:
+        (WebCore::Widget::Widget):
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::addChild):
+        (WebCore::ScrollView::removeChild):
+        * platform/mac/ScrollbarMac.mm:
+        (WebCore::ScrollbarMac::~ScrollbarMac):
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::~Widget):
+        * platform/qt/WidgetQt.cpp:
+        (WebCore::WidgetPrivate::WidgetPrivate):
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::topLevel):
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::ScrollViewPrivate):
+        (WebCore::ScrollView::setAncestorVisible):
+        (WebCore::ScrollView::show):
+        (WebCore::ScrollView::hide):
+        * platform/win/WidgetWin.cpp:
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::setParent):
+        * platform/wx/WidgetWx.cpp:
+        (WebCore::Widget::Widget):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
+        (WebCore::PluginView::setParentVisible):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
+        (WebCore::PluginView::setParentVisible):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::show):
+        (WebCore::PluginView::hide):
+        (WebCore::PluginView::setParentVisible):
+
+2008-09-17  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        <rdar://problem/6219577> Spew in console at launch about encoding mappings when running with ICU 4.0
+
+        * platform/text/TextCodecICU.cpp:
+        (WebCore::TextCodecICU::registerExtendedEncodingNames): Updated for new encoding names.
+
+2008-09-17  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Fix the QtWebKit/Mac build
+
+        * platform/qt/ScrollViewQt.cpp: add include
+
+2008-09-17  David Hyatt  <hyatt@apple.com>
+
+        Add a #define to control whether or not to use an NSScroller on Mac.
+        This ifdef will allow the new NSView-less NSScroller on Mac to be
+        developed side by side with the current one.
+
+        The new scroller paints a debug red if turned on (although due to
+        Widget issues you won't see anything paint yet).
+
+        Reviewed by olliej
+
+        * platform/Scrollbar.cpp:
+        * platform/Scrollbar.h:
+        * platform/mac/ScrollbarMac.h:
+        * platform/mac/ScrollbarMac.mm:
+        * platform/mac/ScrollbarThemeMac.cpp:
+        (WebCore::ScrollbarThemeMac::paint):
+        * platform/mac/ScrollbarThemeMac.h:
+
+2008-09-16  Marco Barisione  <marco.barisione@collabora.co.uk>
+
+        Reviewed by Alp Toker.
+
+        http://bugs.webkit.org/show_bug.cgi?id=20854
+        [GTK] Windows can be not realized in ScrollView::update
+
+        Do not call gdk_window_invalidate_rect on a non-realized GtkWidget.
+
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::update):
+
+2008-09-16  Alp Toker  <alp@nuanti.com>
+
+        Suggested by Dave Hyatt.
+
+        Build fix and cleanup. Rename ScrollBar to Scrollbar.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * editing/EditorCommand.cpp:
+        * page/EventHandler.cpp:
+        * page/gtk/EventHandlerGtk.cpp:
+        * page/mac/EventHandlerMac.mm:
+        * page/mac/FrameMac.mm:
+        * page/qt/EventHandlerQt.cpp:
+        * page/wx/EventHandlerWx.cpp:
+        * platform/PopupMenu.h:
+        * platform/ScrollBar.cpp: Removed.
+        * platform/ScrollBar.h: Removed.
+        * platform/Scrollbar.cpp: Copied from WebCore/platform/ScrollBar.cpp.
+        * platform/Scrollbar.h: Copied from WebCore/platform/ScrollBar.h.
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::ScrollbarGtk):
+        * platform/gtk/ScrollbarGtk.h:
+        * platform/mac/ScrollbarMac.h:
+        * platform/qt/ScrollViewQt.cpp:
+        * platform/qt/ScrollbarQt.cpp:
+        * platform/qt/ScrollbarThemeQt.cpp:
+        * platform/win/PlatformScrollBar.h:
+        * platform/win/PopupMenuWin.cpp:
+        * platform/win/ScrollViewWin.cpp:
+        * platform/win/ScrollbarThemeWin.cpp:
+        * platform/wx/ScrollViewWx.cpp:
+        * platform/wx/TemporaryLinkStubs.cpp:
+        * rendering/HitTestResult.cpp:
+        * rendering/RenderLayer.cpp:
+        * rendering/RenderTextControl.cpp:
+
+2008-09-16  David Hyatt  <hyatt@apple.com>
+
+        Fix Qt build bustage by making moveThumb a member of Scrollbar so that
+        it can be called from ScrollbarQt.
+
+        * platform/ScrollBar.cpp:
+        (WebCore::Scrollbar::moveThumb):
+        (WebCore::Scrollbar::handleMouseMoveEvent):
+        (WebCore::Scrollbar::handleMousePressEvent):
+        * platform/ScrollBar.h:
+        * platform/qt/ScrollViewQt.cpp:
+        * platform/qt/ScrollbarQt.cpp:
+        (WebCore::Scrollbar::handleContextMenuEvent):
+
+2008-09-16  David Hyatt  <hyatt@apple.com>
+
+        Eliminate PlatformScrollbar.  Mac and Gtk now have subclasses for their
+        native-widget scrollbars (ScrollbarMac and ScrollbarGtk).  Other platforms
+        now just use Scrollbar.
+
+        Reviewed by Sam Weinig
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/mac/FrameMac.mm:
+        * platform/PopupMenu.h:
+        (WebCore::PopupMenu::scrollbar):
+        * platform/ScrollBar.cpp:
+        (WebCore::createNativeScrollbar):
+        * platform/ScrollBar.h:
+        * platform/gtk/PlatformScrollBar.h: Removed.
+        * platform/gtk/PlatformScrollBarGtk.cpp: Removed.
+        * platform/gtk/ScrollbarGtk.cpp: Copied from platform/gtk/PlatformScrollBarGtk.cpp.
+        (gtkScrollEventCallback):
+        (ScrollbarGtk::ScrollbarGtk):
+        (ScrollbarGtk::~ScrollbarGtk):
+        (ScrollbarGtk::updateThumbPosition):
+        (ScrollbarGtk::updateThumbProportion):
+        (ScrollbarGtk::setFrameGeometry):
+        (ScrollbarGtk::geometryChanged):
+        (ScrollbarGtk::gtkValueChanged):
+        * platform/gtk/ScrollbarGtk.h: Copied from platform/gtk/PlatformScrollBar.h.
+        * platform/mac/PlatformScrollBar.h: Removed.
+        * platform/mac/PlatformScrollBarMac.mm: Removed.
+        * platform/mac/ScrollbarMac.h: Copied from platform/mac/PlatformScrollBar.h.
+        * platform/mac/ScrollbarMac.mm: Copied from platform/mac/PlatformScrollBarMac.mm.
+        (-[WebCoreScrollBar initWithScrollbarMac:]):
+        (-[WebCoreScrollBar detachScrollbarMac]):
+        (WebCore::Scrollbar::createNativeScrollbar):
+        (WebCore::ScrollbarMac::ScrollbarMac):
+        (WebCore::ScrollbarMac::~ScrollbarMac):
+        (WebCore::ScrollbarMac::updateThumbPosition):
+        (WebCore::ScrollbarMac::updateThumbProportion):
+        (WebCore::ScrollbarMac::scrollbarHit):
+        * platform/qt/PlatformScrollBar.h: Removed.
+        * platform/qt/PlatformScrollBarQt.cpp: Removed.
+        * platform/qt/ScrollbarQt.cpp: Copied from platform/qt/PlatformScrollBarQt.cpp.
+        (WebCore::Scrollbar::handleContextMenuEvent):
+        * rendering/HitTestResult.cpp:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::createScrollbar):
+        (WebCore::RenderLayer::destroyScrollbar):
+        * rendering/RenderLayer.h:
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::~RenderListBox):
+        (WebCore::RenderListBox::updateFromElement):
+        (WebCore::RenderListBox::isPointInOverflowControl):
+        * rendering/RenderObject.h:
+        * rendering/RenderTextControl.cpp:
+
+2008-09-16  David Hyatt  <hyatt@apple.com>
+
+        Make the scrollbar resizer-dodging logic cross-platform in the
+        Scrollbar class.
+
+        Reviewed by Sam Weinig
+
+        * platform/ScrollBar.cpp:
+        (WebCore::Scrollbar::setFrameGeometry):
+        (WebCore::Scrollbar::setParent):
+        (WebCore::Scrollbar::windowClipRect):
+        * platform/ScrollBar.h:
+        * platform/ScrollView.h:
+        (WebCore::ScrollView::windowResizerRect):
+        (WebCore::ScrollView::resizerOverlapsContent):
+        (WebCore::ScrollView::adjustOverlappingScrollbarCount):
+        * platform/Widget.h:
+        (WebCore::Widget::setParent):
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::convertToContainingWindow):
+        * platform/win/PlatformScrollBar.h:
+        * platform/win/PlatformScrollBarWin.cpp:
+
+2008-09-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=15129
+          <rdar://problem/4644824> adding a new line with DOM does unnecessary additional repaint
+
+        Covered by fast/repaint/4776765.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock): Avoid repainting this object if it
+        did not have layout in the beginning.
+        (WebCore::RenderBlock::layoutBlockChildren): If a child did not have
+        layout in the beginning, repaint it in its new position, to compensate
+        for the above (regardless of whether it "moved").
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::checkForRepaintDuringLayout): Added a comment
+        about generalizing this fix in the future.
+
+2008-09-16  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=15384
+          Div does not notice when grandparent changes height
+
+        Test: fast/block/basic/quirk-percent-height-grandchild.html
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=20714
+          Resizing Gmail inbox vertically results in whitespace at the bottom of the window
+
+        Test: fast/replaced/percent-height-in-anonymous-block.html
+
+        Added a two-way mapping between boxes with percentage heights and
+        their non-parent ancestors up to the one the height is computed relative
+        to. In quirks mode (the first bug), this can be any number of containing
+        block with auto height. In strict mode (the second bug) this can be
+        the containing block of an anonymous block containing a replaced
+        element.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::~RenderBlock): Added code to remove the all the
+        mapping to/from this block to percentage-height descendants.
+        (WebCore::RenderBlock::layoutBlockChildren): Added code to mark
+        percentage-height descendants (and their containing block ancestry chain
+        up to this block) for layout. This ensures that those descendants whose
+        height depends on the height of this block (or an ancestor) are updated.
+        (WebCore::RenderBlock::addPercentHeightDescendant): Added. Establishes
+        a two-way mapping between this block and the given box.
+        (WebCore::RenderBlock::removePercentHeightDescendant): Added. Removes
+        all the mapping to/from this box.
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::setStyle): Added calls to
+        removePercentHeightDescendant() when style changes and the box
+        previously had a percentage height. An exception is when the style
+        change does not require layout, in which case the box still has
+        a percentage height and the mappings are valid. In all other cases,
+        any required mappings will be (re-)established during layout.
+        (WebCore::RenderBox::destroy): Added a call to
+        removePercentHeightDescendant.
+        (WebCore::RenderBox::calcPercentageHeight): Added code that, in quirks
+        mode, if a higher-than-parent containing block is affecting the box's
+        height, creates a mapping between the box and that block.
+        (WebCore::RenderBox::calcReplacedHeightUsing): Changed to skip over
+        anonymous containing blocks, if any, and when that happens, use
+        addPercentHeightDescendant() to ensure that the non-anonymous block
+        is aware of the dependent percent-height box.
+
+2008-09-16  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by Oliver Hunt and Alp Toker.
+
+        Implemented toDataURL in Cairo. Only PNG support
+        at the moment.
+
+        Qt, Cairo and wx require toDataURL implementations
+        https://bugs.webkit.org/show_bug.cgi?id=17719
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedImageMIMETypesForEncoding):
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::writeFunction):
+        (WebCore::ImageBuffer::toDataURL):
+
+2008-09-16  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Hide unused media element controls in the QtWebKit port
+
+        * platform/qt/html4-adjustments-qt.css
+
+2008-09-16  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix compilation of the Qt scrollbar code.
+
+        * platform/qt/PlatformScrollBarQt.cpp:
+        (WebCore::scPart):
+        (WebCore::styleOptionSlider):
+        (WebCore::thumbLength):
+        (WebCore::pixelPosToRangeValue):
+        (WebCore::PlatformScrollbar::handleContextMenuEvent):
+
+2008-09-16  Adam Treat  <treat@kde.org>
+
+        Reviewed by Anders Carlsson.
+
+        Prevent accesses off of the end of the buffer introduced in r36450
+        and when checking for descriptions of mime. Also, coding style fix.
+
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+
+2008-09-15  Rob Buis  <buis@kde.org>
+
+        Reviewed by Eric.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20634
+        SVG transform attribute is ignored by <use> in <clipPath>
+
+        Transform the paths with the local transform when part
+        of a clip path.
+
+        Test: svg/custom/use-clipped-transform.svg
+
+        * svg/SVGClipPathElement.cpp:
+        (WebCore::SVGClipPathElement::canvasResource):
+        * svg/SVGStyledTransformableElement.cpp:
+        (WebCore::SVGStyledTransformableElement::toClipPath):
+        * svg/SVGStyledTransformableElement.h:
+
+2008-09-15  Dave Hyatt  <hyatt@apple.com>
+
+        Convert Qt over to its ScrollbarTheme.  Add cross-platform support for jumping the thumb location directly
+        to a pressed location on the track (this is done with the middle mouse on Qt and with Shift-Click on Windows).
+
+        Reviewed by Sam Weinig
+
+        * platform/ScrollBar.cpp:
+        (WebCore::thumbUnderMouse):
+        (WebCore::Scrollbar::autoscrollPressedPart):
+        (WebCore::Scrollbar::startTimerIfNeeded):
+        (WebCore::moveThumb):
+        (WebCore::Scrollbar::handleMouseMoveEvent):
+        (WebCore::Scrollbar::handleMousePressEvent):
+        * platform/ScrollBar.h:
+        (WebCore::Scrollbar::pressedPos):
+        (WebCore::Scrollbar::pixelStep):
+        (WebCore::Scrollbar::setPressedPos):
+        * platform/ScrollbarTheme.h:
+        (WebCore::ScrollbarTheme::thumbPosition):
+        (WebCore::ScrollbarTheme::thumbLength):
+        (WebCore::ScrollbarTheme::trackPosition):
+        (WebCore::ScrollbarTheme::trackLength):
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::trackPosition):
+        * platform/ScrollbarThemeComposite.h:
+        * platform/qt/PlatformScrollBarQt.cpp:
+        (WebCore::PlatformScrollbar::PlatformScrollbar):
+        (WebCore::):
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::styleOptionSlider):
+        (WebCore::ScrollbarThemeQt::hitTest):
+        (WebCore::ScrollbarThemeQt::shouldCenterOnThumb):
+        (WebCore::ScrollbarThemeQt::invalidatePart):
+        (WebCore::ScrollbarThemeQt::thumbPosition):
+        (WebCore::):
+        * platform/qt/ScrollbarThemeQt.h:
+        * platform/win/ScrollbarThemeSafari.cpp:
+        (WebCore::ScrollbarThemeSafari::shouldCenterOnThumb):
+        * platform/win/ScrollbarThemeSafari.h:
+        * platform/win/ScrollbarThemeWin.cpp:
+        (WebCore::ScrollbarThemeWin::shouldCenterOnThumb):
+        * platform/win/ScrollbarThemeWin.h:
+
+2008-09-15  David Smith  <catfish.man@gmail.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20180
+
+        Cache the result of parsing the an+b expression in :nth-child(an+b). Roughly a 2x speedup for :nth-child on SlickSpeed.
+
+        * GNUmakefile.am: Add CSSNthSelector
+        * WebCore.pro: Add CSSNthSelector
+        * WebCore.vcproj/WebCore.vcproj: Add CSSNthSelector
+        * WebCore.xcodeproj/project.pbxproj: Add CSSNthSelector
+        * css/CSSGrammar.y: Create CSSNthSelectors instead of CSSSelectors for :nth-*
+        * css/CSSNthSelector.cpp: Added.
+        (WebCore::CSSNthSelector::parseNth): Moved from CSSStyleSelector and modified to cache
+        (WebCore::CSSNthSelector::matchNth): Moved from CSSStyleSelector and modified to use the cache
+        * css/CSSNthSelector.h: Added.
+        (WebCore::CSSNthSelector::CSSNthSelector):
+        (WebCore::CSSNthSelector::~CSSNthSelector):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::createFloatingNthSelector):
+        * css/CSSParser.h:
+        * css/CSSSelector.h: Use the free bit here to store a flag for CSSNthSelector
+        (WebCore::CSSSelector::CSSSelector):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkOneSelector): Take advantage of knowing that all :nth-* selectors are CSSNthSelectors
+
+2008-09-15  Matt Lilek  <webkit@mattlilek.com>
+
+        Reviewed by Tim Hatcher.
+
+        Clean up some inspector JS callbacks to remove an extra return.
+
+        * page/InspectorController.cpp:
+        (WebCore::hideDOMNodeHighlight):
+        (WebCore::loaded):
+        (WebCore::unloading):
+        (WebCore::attach):
+        (WebCore::detach):
+        (WebCore::startDebuggingAndReloadInspectedPage):
+        (WebCore::stopDebugging):
+        (WebCore::debuggerAttached):
+        (WebCore::pauseOnExceptions):
+        (WebCore::pauseInDebugger):
+        (WebCore::resumeDebugger):
+        (WebCore::stepOverStatementInDebugger):
+        (WebCore::stepIntoStatementInDebugger):
+        (WebCore::stepOutOfFunctionInDebugger):
+        (WebCore::isWindowVisible):
+        (WebCore::closeWindow):
+
+2008-09-15  Dave Hyatt  <hyatt@apple.com>
+
+        Completely switch Windows scrollbars over to ScrollbarTheme.  The Aqua windows scrollbar and native scrollbar
+        now share most of their code.
+
+        Also removing mini size scrollbar support, since it would have crashed Windows had it ever been used, and it
+        also is never used in our code anyway.
+
+        Reviewed by Sam Weinig
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/ScrollTypes.h:
+        (WebCore::):
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::splitTrack):
+        (WebCore::ScrollbarThemeComposite::thumbLength):
+        (WebCore::ScrollbarThemeComposite::minimumThumbLength):
+        * platform/ScrollbarThemeComposite.h:
+        * platform/mac/PlatformScrollBarMac.mm:
+        (NSControlSizeForScrollBarControlSize):
+        * platform/win/PlatformScrollBar.h:
+        * platform/win/PlatformScrollBarSafari.cpp: Removed.
+        * platform/win/PlatformScrollBarWin.cpp:
+        (WebCore::PlatformScrollbar::PlatformScrollbar):
+        * platform/win/ScrollbarThemeSafari.cpp:
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::):
+        (WebCore::scrollbarControlStateFromThemeState):
+        (WebCore::ScrollbarThemeSafari::hasButtons):
+        (WebCore::ScrollbarThemeSafari::hasThumb):
+        (WebCore::buttonRepaintRect):
+        (WebCore::ScrollbarThemeSafari::backButtonRect):
+        (WebCore::ScrollbarThemeSafari::forwardButtonRect):
+        (WebCore::trackRepaintRect):
+        (WebCore::ScrollbarThemeSafari::trackRect):
+        (WebCore::ScrollbarThemeSafari::minimumThumbLength):
+        (WebCore::ScrollbarThemeSafari::paintTrack):
+        (WebCore::ScrollbarThemeSafari::paintButton):
+        (WebCore::ScrollbarThemeSafari::paintThumb):
+        * platform/win/ScrollbarThemeSafari.h:
+        * platform/win/ScrollbarThemeWin.cpp:
+        * platform/win/ScrollbarThemeWin.h:
+
+2008-09-15  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler, Beth Dakin
+
+        <rdar://problem/4003789> Expose lists as AXList
+        <rdar://problem/5707399> VO: Definition lists not announced in Safari
+
+        Lists are now exposed through AX. On the mac (in SnowLeopard) they use two new subroles
+        AXContentList for <ul>, <ol> and AXDefinitionList for <dl>
+        Inside the definition list, each <dt> "term" has an accessibility description ("term"),
+        as does each <dd> tag ("definition")
+
+        Test: accessibility/lists.html
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * page/AXObjectCache.cpp:
+        * page/AccessibilityList.cpp: Added.
+        * page/AccessibilityList.h: Added.
+        * page/AccessibilityObject.h:
+        * page/AccessibilityRenderObject.cpp:
+        * page/AccessibilityTable.cpp:
+        * page/mac/AccessibilityObjectWrapper.mm:
+        * page/mac/WebCoreViewFactory.h:
+        * platform/LocalizedStrings.h:
+        * platform/mac/LocalizedStringsMac.mm:
+        * platform/qt/Localizations.cpp:
+
+2008-09-15  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Eric.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=20865
+        Prepare HTMLScriptElement & SVGScriptElement unification, and unification of event handling.
+
+        Several renames:
+        dispatchHTMLEvent -> dispatchEventForType
+        setHTMLEventListener -> setEventListenerForType
+        getHTMLEventListener -> eventListenerForType
+        removeHTMLEventListener -> removeEventListenerForType
+        isHTMLEventListener -> isAttachedToEventTargetNode
+        ...
+
+        Similar renames for the dispatch/get/set/*Window*Event functions.
+        Kill JSSVGLazyEventListener and merge with JSLazyEventListener.
+
+        Most important change: Rename setHTMLEventListener to setEventListenerForTypeAndAttribute,
+        as there exists a generic createEventListener() method now, taking care of JSLazyEventListener creation.
+
+        setHTMLEventListener() used createHTMLEventListener() before and was HTML specific.
+        SVG is able to use the code as well now. This affects most files in html/.
+
+        No functional changes.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::~JSDOMWindowBase):
+        (WebCore::JSDOMWindowBase::setListener):
+        (WebCore::JSDOMWindowBase::getListener):
+        (WebCore::JSDOMWindowBase::findJSEventListener):
+        (WebCore::JSDOMWindowBase::findOrCreateJSEventListener):
+        (WebCore::JSDOMWindowBase::findJSUnprotectedEventListener):
+        (WebCore::JSDOMWindowBase::findOrCreateJSUnprotectedEventListener):
+        (WebCore::JSDOMWindowBase::jsEventListenersAttachedToEventTargetNodes):
+        (WebCore::JSDOMWindowBase::jsUnprotectedEventListenersAttachedToEventTargetNodes):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSAbstractEventListener::handleEvent):
+        (WebCore::JSAbstractEventListener::isAttachedToEventTargetNode):
+        (WebCore::JSUnprotectedEventListener::JSUnprotectedEventListener):
+        (WebCore::JSUnprotectedEventListener::~JSUnprotectedEventListener):
+        (WebCore::JSEventListener::JSEventListener):
+        (WebCore::JSEventListener::~JSEventListener):
+        (WebCore::JSLazyEventListener::JSLazyEventListener):
+        (WebCore::eventParameterName):
+        (WebCore::JSLazyEventListener::parseCode):
+        (WebCore::getNodeEventListener):
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSAbstractEventListener::JSAbstractEventListener):
+        (WebCore::JSUnprotectedEventListener::create):
+        (WebCore::JSEventListener::create):
+        (WebCore::JSLazyEventListener::):
+        (WebCore::JSLazyEventListener::create):
+        * bindings/js/JSEventTargetNode.cpp:
+        (WebCore::JSEventTargetNode::setListener):
+        (WebCore::JSEventTargetNode::getListener):
+        * bindings/js/JSSVGLazyEventListener.cpp: Removed.
+        * bindings/js/JSSVGLazyEventListener.h: Removed.
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::createHTMLEventHandler):
+        (WebCore::ScriptController::createSVGEventHandler):
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        (WebCore::Document::handleWindowEvent):
+        (WebCore::Document::setWindowEventListenerForType):
+        (WebCore::Document::windowEventListenerForType):
+        (WebCore::Document::removeWindowEventListenerForType):
+        (WebCore::Document::addWindowEventListener):
+        (WebCore::Document::hasWindowEventListener):
+        (WebCore::Document::removePendingFrameBeforeUnloadEventCount):
+        (WebCore::Document::createEventListener):
+        (WebCore::Document::setWindowEventListenerForTypeAndAttribute):
+        * dom/Document.h:
+        * dom/EventListener.h:
+        (WebCore::EventListener::isAttachedToEventTargetNode):
+        * dom/EventTargetNode.cpp:
+        (WebCore::EventTargetNode::dispatchFocusEvent):
+        (WebCore::EventTargetNode::dispatchBlurEvent):
+        (WebCore::EventTargetNode::dispatchEventForType):
+        (WebCore::EventTargetNode::removeEventListenerForType):
+        (WebCore::EventTargetNode::setEventListenerForType):
+        (WebCore::EventTargetNode::setEventListenerForTypeAndAttribute):
+        (WebCore::EventTargetNode::eventListenerForType):
+        * dom/EventTargetNode.h:
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::notifyFinished):
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment):
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        * html/HTMLButtonElement.cpp:
+        (WebCore::HTMLButtonElement::parseMappedAttribute):
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::parseMappedAttribute):
+        (WebCore::HTMLElement::checkDTD):
+        * html/HTMLElement.h:
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::onChange):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::prepareSubmit):
+        (WebCore::HTMLFormElement::reset):
+        (WebCore::HTMLFormElement::parseMappedAttribute):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::parseMappedAttribute):
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::dispatchLoadEvent):
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::setValueFromRenderer):
+        (WebCore::HTMLInputElement::onSearch):
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::asyncEventTimerFired):
+        (WebCore::HTMLMediaElement::load):
+        (WebCore::HTMLMediaElement::mediaPlayerNetworkStateChanged):
+        (WebCore::HTMLMediaElement::setReadyState):
+        (WebCore::HTMLMediaElement::seek):
+        (WebCore::HTMLMediaElement::mediaPlayerTimeChanged):
+        (WebCore::HTMLMediaElement::willSaveToCache):
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parseMappedAttribute):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::parseMappedAttribute):
+        (WebCore::HTMLScriptElement::dispatchLoadEvent):
+        (WebCore::HTMLScriptElement::dispatchErrorEvent):
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::parseMappedAttribute):
+        * html/HTMLTextAreaElement.cpp:
+        (WebCore::HTMLTextAreaElement::parseMappedAttribute):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::notifyFinished):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::mouseButtonListener):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::canMouseDownStartSelect):
+        (WebCore::EventHandler::canMouseDragExtendSelect):
+        * page/Frame.cpp:
+        (WebCore::Frame::sendScrollEvent):
+        * page/Page.cpp:
+        (WebCore::networkStateChanged):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::valueChanged):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::selectionChanged):
+        * svg/SVGDocumentExtensions.cpp:
+        * svg/SVGDocumentExtensions.h:
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::parseMappedAttribute):
+        (WebCore::SVGElement::finishParsingChildren):
+        * svg/SVGElement.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::parseMappedAttribute):
+        * svg/SVGSVGElement.h:
+
+2008-09-15  Dave Hyatt  <hyatt@apple.com>
+
+        Convert PlatformScrollbarWin to use ScrollbarTheme for hit testing.  PlatformScrollbarQt/Gtk still
+        need to be converted.
+
+        Reviewed by Sam Weinig
+
+        * platform/ScrollBar.cpp:
+        (WebCore::Scrollbar::Scrollbar):
+        (WebCore::Scrollbar::updateThumbPosition):
+        (WebCore::Scrollbar::updateThumbProportion):
+        (WebCore::Scrollbar::autoscrollPressedPart):
+        (WebCore::Scrollbar::startTimerIfNeeded):
+        * platform/ScrollBar.h:
+        * platform/ScrollbarTheme.h:
+        (WebCore::ScrollbarTheme::invalidateParts):
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::hitTest):
+        (WebCore::ScrollbarThemeComposite::invalidatePart):
+        (WebCore::ScrollbarThemeComposite::thumbPosition):
+        (WebCore::ScrollbarThemeComposite::thumbLength):
+        (WebCore::ScrollbarThemeComposite::trackLength):
+        * platform/ScrollbarThemeComposite.h:
+        * platform/win/PlatformScrollBarSafari.cpp:
+        (WebCore::PlatformScrollbar::PlatformScrollbar):
+        * platform/win/PlatformScrollBarWin.cpp:
+        (WebCore::PlatformScrollbar::PlatformScrollbar):
+
+2008-09-15  David Smith  <catfish.man@gmail.com>
+
+        "Just do it"'d by Mark Rowe
+
+        https://bugs.webkit.org/show_bug.cgi?id=20856
+        Add missing license header
+
+        * dom/NodeRenderStyle.h:
+
+2008-09-15  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Add default constructor for ShadowData
+        https://bugs.webkit.org/show_bug.cgi?id=20757
+
+        Test: transitions/shadow.html
+
+        * rendering/style/RenderStyle.h:
+
+2008-09-15  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        RenderStyle should update keyframes.
+        http://bugs.webkit.org/show_bug.cgi?id=20756
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::StyleRareNonInheritedData::updateKeyframes):
+
+2008-09-15  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Tim Hatcher.
+
+        Unnecessary ASSERT in ImplicitAnimation destructor.
+        https://bugs.webkit.org/show_bug.cgi?id=20817
+
+        * page/animation/ImplicitAnimation.cpp:
+        (WebCore::ImplicitAnimation::~ImplicitAnimation):
+
+2008-09-15  Adam Treat  <treat@kde.org>
+
+        Reviewed by Simon.
+
+        Fix plugin extension info. It was returning the mimetype where the
+        extension was given.
+
+        * plugins/qt/PluginPackageQt.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+
+2008-09-15  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Tim Hatcher
+
+        Coding style violation!!!! Cleanup AnimationBase.cpp
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::blendFunc):
+
+2008-09-15  David Hyatt  <hyatt@apple.com>
+
+        Move all hit testing code for scrollbars into the base class.  Refactor
+        it to accommodate all platform-specific behaviors using virtual ScrollbarTheme
+        functions.
+
+        No platform is using this code yet.  Although it has been moved and compiles
+        (even on Mac), it is not being used on any platform.
+
+        Reviewed by Sam Weinig
+
+        * platform/ScrollBar.cpp:
+        (WebCore::Scrollbar::autoscrollPressedPart):
+        (WebCore::Scrollbar::startTimerIfNeeded):
+        (WebCore::Scrollbar::handleMouseMoveEvent):
+        (WebCore::Scrollbar::handleMouseOutEvent):
+        (WebCore::Scrollbar::handleMouseReleaseEvent):
+        (WebCore::Scrollbar::handleMousePressEvent):
+        * platform/ScrollBar.h:
+        (WebCore::Scrollbar::handleContextMenuEvent):
+        * platform/ScrollbarTheme.h:
+        (WebCore::ScrollbarTheme::hitTest):
+        (WebCore::ScrollbarTheme::invalidateOnMouseEnterExit):
+        (WebCore::ScrollbarTheme::invalidatePart):
+        (WebCore::ScrollbarTheme::shouldCenterOnThumb):
+        (WebCore::ScrollbarTheme::centerOnThumb):
+        (WebCore::ScrollbarTheme::thumbPosition):
+        (WebCore::ScrollbarTheme::thumbLength):
+        (WebCore::ScrollbarTheme::trackLength):
+        (WebCore::ScrollbarTheme::initialAutoscrollTimerDelay):
+        (WebCore::ScrollbarTheme::autoscrollTimerDelay):
+        * platform/Widget.h:
+        (WebCore::Widget::parent):
+        * platform/mac/PlatformScrollBar.h:
+        (WebCore::PlatformScrollbar::handleMouseMoveEvent):
+        (WebCore::PlatformScrollbar::handleMouseOutEvent):
+        (WebCore::PlatformScrollbar::handleMousePressEvent):
+        (WebCore::PlatformScrollbar::handleMouseReleaseEvent):
+        * platform/mac/WidgetMac.mm:
+        (WebCore::Widget::convertFromContainingWindow):
+        * platform/win/ScrollbarThemeWin.cpp:
+        (WebCore::ScrollbarThemeWin::invalidateOnMouseEnterExit):
+        * platform/win/ScrollbarThemeWin.h:
+
+2008-09-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix <rdar://problem/5842247> Single long breakable word takes O(n^2) to lay out
+
+        Cache the next breakable position for text nodes in InlineIterator.
+
+        * rendering/bidi.cpp:
+        (WebCore::InlineIterator::InlineIterator):
+        (WebCore::InlineIterator::increment):
+        (WebCore::RenderBlock::findNextLineBreak):
+
+2008-09-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        Fix assertion and integral pixel issue when creating subimages.
+        https://bugs.webkit.org/show_bug.cgi?id=20786
+
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::draw):
+
+2008-09-15  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Implment seek() and clean up and improve debugging output
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (debugMediaObject):
+        (WebCore::MediaPlayerPrivate::seek):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::setMuted):
+        (WebCore::MediaPlayerPrivate::updateStates):
+        (WebCore::MediaPlayerPrivate::naturalSize):
+        (WebCore::MediaPlayerPrivate::paint):
+        (WebCore::MediaPlayerPrivate::stateChanged):
+        (WebCore::MediaPlayerPrivate::tick):
+
+2008-09-15  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon.
+
+        Remove bogus Q_ASSERTs from the MediaPlayer Phonon implementation
+
+        m_mediaObject, m_audioOutput, m_videoWidget get created in the
+        c'tor and will only be deleted in the c'tor. The Q_ASSERTs would
+        only check if we use the MediaPlayerPrivate after it has been deleted.
+
+        Acked-by: Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::play):
+        (WebCore::MediaPlayerPrivate::setVolume):
+        (WebCore::MediaPlayerPrivate::updateStates):
+
+2008-09-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Maciej.
+
+        <rdar://problem/6163988>
+        https://bugs.webkit.org/show_bug.cgi?id=20457
+        Canvas: createPattern crashes WebKit in WTF::RefPtr<WebCore::Image>::operator!() const + 9 with a 1D pattern
+
+        Check the width and height and throw an exception if any of them are 0.
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::createPattern):
+
+2008-09-15  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Render media element controls with antialiasing enabled
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintMediaMuteButton):
+        (WebCore::RenderThemeQt::paintMediaPlayButton):
+        (WebCore::RenderThemeQt::paintMediaSliderTrack):
+        (WebCore::RenderThemeQt::paintMediaSliderThumb):
+
+2008-09-15  Ariya Hidayat  <ariya.hidayat@trolltech.com>
+
+        Reviewed by Simon.
+
+        Upon non fatal error, switch to the pause state (so that playback can continue)
+
+        * platform/graphics/qt/MediaPlayerPrivatePhonon.cpp:
+        (WebCore::MediaPlayerPrivate::updateStates):
+
+2008-09-15  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Don't set WTF_USE_JSC in WebCore.pro now that it's set in config.h
+
+        * WebCore.pro:
+
+2008-09-15  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Make QtInstance::create() private and fix caching
+
+        * bindings/js/ScriptControllerQt.cpp:
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+        * bridge/qt/qt_instance.cpp:
+        (JSC::Bindings::QtInstance::getQtInstance):
+        (JSC::Bindings::QtInstance::getRuntimeObject):
+        * bridge/qt/qt_instance.h:
+        (JSC::Bindings::QtInstance::create):
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertQVariantToValue):
+        (JSC::Bindings::QtConnectionObject::execute):
+
+2008-09-15  David Smith  <catfish.man@gmail.com>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20180
+
+        >2x speedup on querySelector[All] with :nth-child by removing the collectRulesOnly argument on SelectorChecker.
+        With collectRulesOnly set to true (the default) an optimization is turned off, and no callers were intentionally leaving it true.
+        querySelector[All] assumed that the default was probably the right way to go, and so ended up being slow.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        (WebCore::CSSStyleSelector::SelectorChecker::SelectorChecker):
+        * css/CSSStyleSelector.h:
+
+2008-09-14  Dave Hyatt  <hyatt@apple.com>
+
+        Refactor PlatformScrollbarWin's painting so that it is now done by ScrollbarThemeWin.  PlatformScrollbarSafari
+        is still painting itself (a subsequent patch will move its painting into ScrollbarThemeSafari).
+
+        Reviewed by Sam Weinig
+
+        * platform/ScrollBar.h:
+        (WebCore::Scrollbar::client):
+        (WebCore::Scrollbar::currentPos):
+        (WebCore::Scrollbar::totalSize):
+        * platform/ScrollbarTheme.h:
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::pageForScrollView):
+        (WebCore::ScrollbarThemeComposite::paint):
+        * platform/ScrollbarThemeComposite.h:
+        (WebCore::ScrollbarThemeComposite::trackIsSinglePiece):
+        * platform/win/PlatformScrollBar.h:
+        * platform/win/PlatformScrollBarSafari.cpp:
+        * platform/win/PlatformScrollBarWin.cpp:
+        * platform/win/ScrollbarThemeSafari.h:
+        (WebCore::ScrollbarThemeSafari::hasButtons):
+        (WebCore::ScrollbarThemeSafari::hasThumb):
+        (WebCore::ScrollbarThemeSafari::backButtonRect):
+        (WebCore::ScrollbarThemeSafari::forwardButtonRect):
+        (WebCore::ScrollbarThemeSafari::trackRect):
+        (WebCore::ScrollbarThemeSafari::splitTrack):
+        (WebCore::ScrollbarThemeSafari::paintTrack):
+        (WebCore::ScrollbarThemeSafari::paintButton):
+        (WebCore::ScrollbarThemeSafari::paintThumb):
+        * platform/win/ScrollbarThemeWin.cpp:
+        (WebCore::isRunningOnVistaOrLater):
+        (WebCore::checkAndInitScrollbarTheme):
+        (WebCore::ScrollbarThemeWin::ScrollbarThemeWin):
+        (WebCore::ScrollbarThemeWin::themeChanged):
+        (WebCore::ScrollbarThemeWin::hasThumb):
+        (WebCore::ScrollbarThemeWin::backButtonRect):
+        (WebCore::ScrollbarThemeWin::forwardButtonRect):
+        (WebCore::ScrollbarThemeWin::trackRect):
+        (WebCore::ScrollbarThemeWin::splitTrack):
+        (WebCore::ScrollbarThemeWin::paintTrack):
+        (WebCore::ScrollbarThemeWin::paintButton):
+        (WebCore::gripperRect):
+        (WebCore::paintGripper):
+        (WebCore::ScrollbarThemeWin::paintThumb):
+        (WebCore::ScrollbarThemeWin::thumbPosition):
+        (WebCore::ScrollbarThemeWin::thumbLength):
+        (WebCore::ScrollbarThemeWin::trackLength):
+        * platform/win/ScrollbarThemeWin.h:
+        (WebCore::ScrollbarThemeWin::hasButtons):
+        (WebCore::ScrollbarThemeWin::trackIsSinglePiece):
+
+2008-09-14  Anthony Ricaud  <rik24d@gmail.com>
+
+        Moving all resource graphs under the same container for future scalable feature.
+        This is a speedup on resize but maybe a loss on changing the sorting function.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20555
+
+        Reviewed by Timothy Hatcher.
+
+        * page/inspector/ResourcesPanel.js: Added a container for all resource graphs.
+        Added WebInspector.ResourceGraph. No more _updateGraphBars on resize.
+        * page/inspector/inspector.css: Edited corresponding rules and removed unnecessaries.
+
+2008-09-14  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20738
+        compareBoundaryPoints gives incorrect results
+
+        Test: fast/dom/Range/compareBoundaryPoints-2.html
+
+        * dom/Range.cpp: (WebCore::Range::compareBoundaryPoints): Correct meanings of START_TO_END
+        and END_TO_START.
+        * page/DOMSelection.cpp: (WebCore::DOMSelection::addRange): Updated for this change.
+
+2008-09-14  Maciej Stachowiak  <mjs@apple.com>
+
+        Unreviewed build fix.
+
+        Trying again.
+
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::hasInstance):
+
+2008-09-14  Maciej Stachowiak  <mjs@apple.com>
+
+        Unreviewed build fix.
+
+        Blind attempt to fix build. Correct parameters for hasInstance.
+
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::hasInstance):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+
+2008-09-14  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Sam Weinig.
+
+        - revert <http://trac.webkit.org/changeset/36382> because it exposed
+          <https://bugs.webkit.org/show_bug.cgi?id=20846> and resulted in crashes
+          on Tiger.
+
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::getLastResortFallbackFont):
+
+2008-09-14  Dave Hyatt  <hyatt@apple.com>
+
+        Add a new ScrollbarThemeComposite base class that is shared by ScrollbarThemeSafari and
+        ScrollbarThemeWin.  Any scrollbar that wants to render by ScrollbarPart can subclass from this
+        theme.
+
+        Reviewed by Sam Weinig
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/win/ScrollbarThemeSafari.h:
+        * platform/win/ScrollbarThemeWin.h:
+
+2008-09-14  Alp Toker  <alp@nuanti.com>
+
+        https://bugs.webkit.org/show_bug.cgi?id=20320
+        [GTK] A white rectangle is visible behind widgets with rounded corners
+
+        Sync bundled gtk2drawing.c to the latest version from Mozilla (coding
+        style exempt).
+
+        Requested by Michael Monreal.
+
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::RenderThemeGtk):
+        * platform/gtk/gtk2drawing.c:
+        (moz_gtk_set_widget_name):
+        (ensure_window_widget):
+        (setup_widget_prototype):
+        (ensure_button_arrow_widget):
+        (moz_gtk_get_combo_box_inner_button):
+        (moz_gtk_get_combo_box_button_inner_widgets):
+        (ensure_combo_box_widgets):
+        (moz_gtk_get_combo_box_entry_inner_widgets):
+        (moz_gtk_get_combo_box_entry_arrow):
+        (ensure_combo_box_entry_widgets):
+        (ensure_toolbar_widget):
+        (ensure_tooltip_widget):
+        (ensure_menu_bar_widget):
+        (ensure_menu_bar_item_widget):
+        (ensure_menu_popup_widget):
+        (ensure_menu_item_widget):
+        (ensure_image_menu_item_widget):
+        (ensure_menu_separator_widget):
+        (ensure_check_menu_item_widget):
+        (ensure_tree_header_cell_widget):
+        (ensure_scrolled_window_widget):
+        (moz_gtk_button_paint):
+        (moz_gtk_init):
+        (moz_gtk_button_get_inner_border):
+        (moz_gtk_toggle_paint):
+        (calculate_button_inner_rect):
+        (calculate_arrow_rect):
+        (moz_gtk_scrollbar_button_paint):
+        (moz_gtk_scrollbar_thumb_paint):
+        (moz_gtk_caret_paint):
+        (moz_gtk_entry_paint):
+        (moz_gtk_treeview_paint):
+        (moz_gtk_tree_header_cell_paint):
+        (moz_gtk_combo_box_paint):
+        (moz_gtk_downarrow_paint):
+        (moz_gtk_combo_box_entry_button_paint):
+        (moz_gtk_toolbar_paint):
+        (moz_gtk_tab_scroll_arrow_paint):
+        (moz_gtk_menu_bar_paint):
+        (moz_gtk_menu_item_paint):
+        (moz_gtk_get_widget_border):
+        (moz_gtk_get_combo_box_entry_button_size):
+        (moz_gtk_get_tab_scroll_arrow_size):
+        (moz_gtk_get_downarrow_size):
+        (moz_gtk_images_in_menus):
+        (moz_gtk_widget_paint):
+        (moz_gtk_shutdown):
+        * platform/gtk/gtkdrawing.h:
+
+2008-09-14  David Hyatt  <hyatt@apple.com>
+
+        Convert Mac, Gtk, wx and Qt over to the new ScrollbarTheme for
+        painting.  Mac and Gtk themes don't do anything and just let the
+        underlying widget paint.  Qt now uses the theme to paint.  wx doesn't
+        do anything yet.
+
+        Reviewed by Sam Weinig
+
+        * platform/ScrollBar.cpp:
+        (WebCore::Scrollbar::paint):
+        * platform/ScrollBar.h:
+        (WebCore::Scrollbar::value):
+        (WebCore::Scrollbar::visibleSize):
+        (WebCore::Scrollbar::maximum):
+        (WebCore::Scrollbar::lineStep):
+        (WebCore::Scrollbar::pageStep):
+        (WebCore::Scrollbar::pixelStep):
+        (WebCore::Scrollbar::pressedPart):
+        (WebCore::Scrollbar::hoveredPart):
+        (WebCore::Scrollbar::theme):
+        * platform/ScrollbarTheme.h:
+        (WebCore::ScrollbarTheme::paint):
+        (WebCore::ScrollbarTheme::scrollbarThickness):
+        (WebCore::ScrollbarTheme::supportsControlTints):
+        (WebCore::ScrollbarTheme::themeChanged):
+        * platform/gtk/PlatformScrollBar.h:
+        * platform/gtk/PlatformScrollBarGtk.cpp:
+        * platform/mac/PlatformScrollBar.h:
+        * platform/mac/PlatformScrollBarMac.mm:
+        * platform/qt/PlatformScrollBar.h:
+        * platform/qt/PlatformScrollBarQt.cpp:
+        * platform/qt/ScrollbarThemeQt.cpp:
+        (WebCore::styleOptionSlider):
+        * platform/qt/ScrollbarThemeQt.h:
+        (WebCore::ScrollbarThemeQt::paint):
+        * platform/win/PlatformScrollBarSafari.cpp:
+        (WebCore::PlatformScrollbar::paint):
+        * platform/win/ScrollbarThemeSafari.h:
+        (WebCore::ScrollbarThemeSafari::supportsControlTints):
+        * platform/wx/PlatformScrollBar.h:
+        * platform/wx/TemporaryLinkStubs.cpp:
+        (PlatformScrollbar::~PlatformScrollbar):
+
+2008-09-14  Sam Weinig  <sam@webkit.org>
+
+        Qt build fix.
+
+        * platform/qt/PlatformScrollBarQt.cpp:
+
+2008-09-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Remove extraneous semicolons.
+
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::tokenizeRelAttribute):
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::charsetAttributeValue):
+        (WebCore::HTMLScriptElement::typeAttributeValue):
+        * platform/graphics/qt/GradientQt.cpp:
+        (WebCore::Gradient::platformGradient):
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::setHasHorizontalScrollbar):
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintEllipsisBoxes):
+        * svg/SVGPathSegList.cpp:
+        (WebCore::SVGPathSegList::toPathData):
+
+2008-09-14  Sam Weinig  <sam@webkit.org>
+
+        Qt build fix.
+
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+2008-09-14  Sam Weinig  <sam@webkit.org>
+
+        Qt build fix.
+
+        * platform/qt/PlatformScrollBarQt.cpp:
+        (WebCore::PlatformScrollbar::PlatformScrollbar):
+        (WebCore::PlatformScrollbar::paint):
+
+2008-09-13  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Gtk build fix, not reviewed.
+
+        * platform/gtk/PlatformScrollBarGtk.cpp:
+        (PlatformScrollbar::PlatformScrollbar):
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+
+2008-09-13  Dave Hyatt  <hyatt@apple.com>
+
+        Remove scrollbar's setRect method.  Clients can now just call setFrameGeometry (the corresponding Widget) method
+        to set the dimensions of a scrollbar.
+
+        Reviewed by Sam Weinig
+
+        * platform/ScrollBar.h:
+        * platform/gtk/PlatformScrollBar.h:
+        * platform/gtk/PlatformScrollBarGtk.cpp:
+        (PlatformScrollbar::setFrameGeometry):
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/mac/PlatformScrollBarMac.mm:
+        * platform/qt/PlatformScrollBarQt.cpp:
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/win/PlatformScrollBar.h:
+        * platform/win/PlatformScrollBarSafari.cpp:
+        (WebCore::PlatformScrollbar::PlatformScrollbar):
+        (WebCore::PlatformScrollbar::setFrameGeometry):
+        * platform/win/PlatformScrollBarWin.cpp:
+        (WebCore::PlatformScrollbar::PlatformScrollbar):
+        (WebCore::PlatformScrollbar::setFrameGeometry):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupWndProc):
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        * platform/wx/PlatformScrollBar.h:
+        * platform/wx/TemporaryLinkStubs.cpp:
+        (PlatformScrollbar::updateThumbProportion):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::positionOverflowControls):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::paintScrollbar):
+
+2008-09-13  Dave Hyatt  <hyatt@apple.com>
+
+        Remove setEnabled() from all Scrollbar classes that were just using their Widget base class methods.
+
+        Reviewed by Sam Weinig
+
+        * platform/ScrollBar.h:
+        * platform/gtk/PlatformScrollBar.h:
+        * platform/gtk/PlatformScrollBarGtk.cpp:
+        * platform/mac/PlatformScrollBar.h:
+        * platform/mac/PlatformScrollBarMac.mm:
+        * platform/win/PlatformScrollBar.h:
+        * platform/win/PlatformScrollBarSafari.cpp:
+        * platform/win/PlatformScrollBarWin.cpp:
+        * platform/wx/PlatformScrollBar.h:
+        * platform/wx/TemporaryLinkStubs.cpp:
+        (PlatformScrollbar::~PlatformScrollbar):
+
+2008-09-13  Dave Hyatt  <hyatt@apple.com>
+
+        Remove width()/height() from Scrollbar now that it derives from Widget.  Remove width()/height() from
+        all PlatformScrollbar subclasses that just called the Widget base class versions of those methods.
+
+        Reviewed by Sam Weinig
+
+        * platform/ScrollBar.h:
+        * platform/gtk/PlatformScrollBar.h:
+        * platform/gtk/PlatformScrollBarGtk.cpp:
+        * platform/mac/PlatformScrollBar.h:
+        * platform/mac/PlatformScrollBarMac.mm:
+        * platform/win/PlatformScrollBarSafari.cpp:
+        * platform/win/PlatformScrollBarWin.cpp:
+        * platform/wx/PlatformScrollBar.h:
+        * platform/wx/TemporaryLinkStubs.cpp:
+        (PlatformScrollbar::~PlatformScrollbar):
+
+2008-09-13  Dave Hyatt  <hyatt@apple.com>
+
+        Move stopTimerIfNeeded out of PlatformScrollbar destructors and into Scrollbar.
+
+        Reviewed by Sam Weinig
+
+        * platform/ScrollBar.cpp:
+        (WebCore::Scrollbar::~Scrollbar):
+        * platform/ScrollBar.h:
+        * platform/qt/PlatformScrollBarQt.cpp:
+        (WebCore::PlatformScrollbar::~PlatformScrollbar):
+        * platform/win/PlatformScrollBarSafari.cpp:
+        (WebCore::PlatformScrollbar::~PlatformScrollbar):
+        * platform/win/PlatformScrollBarWin.cpp:
+        (WebCore::PlatformScrollbar::~PlatformScrollbar):
+
+2008-09-13  David Hyatt  <hyatt@apple.com>
+
+        Move maximum() from Qt's PlatformScrollbar to be a cross-platform
+        function on Scrollbar.  Fixes Qt build bustage.
+
+        Reviewed by Sam Weinig
+
+        * platform/ScrollBar.h:
+        (WebCore::Scrollbar::orientation):
+        (WebCore::Scrollbar::value):
+        (WebCore::Scrollbar::maximum):
+        * platform/qt/PlatformScrollBar.h:
+
+2008-09-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - use the LastResort font for missing glyphs instead of showing the
+          primary font's missing glyph
+
+        Test: platform/mac/fast/text/last-resort-font.html
+
+        * platform/graphics/mac/FontCacheMac.mm:
+        (WebCore::FontCache::getFontDataForCharacters): Changed to return the
+        last resort font if a substitute font cannot be found.
+        (WebCore::FontCache::getLastResortFallbackFont): Removed an outdated
+        comment (the user's preferred standard font is included in the search
+        thanks to code in FontCache::getFontData()) and changed to return the
+        LastResort font.
+
+2008-09-13  Dave Hyatt  <hyatt@apple.com>
+
+        This patch adds ScrollbarTheme to the build.  ScrollbarTheme is similar to RenderTheme (but for
+        scrollbars only).  For now ScrollbarTheme just handles returning the size of scrollbars.  Subsequent
+        patches will move rendering and hit testing functionality into this class.
+
+        Implemented ScrollbarTheme subclasses for four ports (Mac, Win, Gtk, Qt).  The wxWidgets port does not
+        implement scrollbars yet, so I added a temporary link stub to keep things compiling on wx.
+
+        Reviewed by Sam Weinig
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/ScrollBar.cpp:
+        (WebCore::Scrollbar::Scrollbar):
+        * platform/ScrollBar.h:
+        * platform/ScrollbarTheme.h: Added.
+        (WebCore::ScrollbarTheme::~ScrollbarTheme):
+        (WebCore::ScrollbarTheme::scrollbarThickness):
+        (WebCore::ScrollbarTheme::themeChanged):
+        * platform/gtk/ScrollbarThemeGtk.cpp: Added.
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeGtk::~ScrollbarThemeGtk):
+        (WebCore::ScrollbarThemeGtk::scrollbarThickness):
+        * platform/gtk/ScrollbarThemeGtk.h: Added.
+        * platform/mac/PlatformScrollBar.h:
+        * platform/mac/ScrollbarThemeMac.cpp: Added.
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::):
+        (WebCore::ScrollbarThemeMac::~ScrollbarThemeMac):
+        (WebCore::ScrollbarThemeMac::scrollbarThickness):
+        * platform/mac/ScrollbarThemeMac.h: Added.
+        * platform/qt/PlatformScrollBarQt.cpp:
+        * platform/qt/ScrollbarThemeQt.cpp: Added.
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeQt::~ScrollbarThemeQt):
+        (WebCore::ScrollbarThemeQt::scrollbarThickness):
+        * platform/qt/ScrollbarThemeQt.h: Added.
+        * platform/win/PlatformScrollBar.h:
+        * platform/win/PlatformScrollBarSafari.cpp:
+        * platform/win/PlatformScrollBarWin.cpp:
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenu::calculatePositionAndSize):
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::updateScrollbars):
+        (WebCore::ScrollView::themeChanged):
+        * platform/win/ScrollbarThemeSafari.cpp: Added.
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::):
+        (WebCore::ScrollbarThemeSafari::~ScrollbarThemeSafari):
+        (WebCore::ScrollbarThemeSafari::scrollbarThickness):
+        * platform/win/ScrollbarThemeSafari.h: Added.
+        * platform/win/ScrollbarThemeWin.cpp: Added.
+        (WebCore::ScrollbarTheme::nativeTheme):
+        (WebCore::ScrollbarThemeWin::~ScrollbarThemeWin):
+        (WebCore::ScrollbarThemeWin::scrollbarThickness):
+        (WebCore::ScrollbarThemeWin::themeChanged):
+        * platform/win/ScrollbarThemeWin.h: Added.
+        * platform/wx/TemporaryLinkStubs.cpp:
+        (ScrollbarTheme::nativeTheme):
+        * rendering/RenderLayer.cpp:
+        (WebCore::scrollCornerRect):
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::calcHeight):
+        (WebCore::RenderTextControl::calcPrefWidths):
+
+2008-09-13  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        <rdar://problem/5060439> Web elements should have an AXTopLevelUIElement
+
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+
+2008-09-13  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Timothy Hatcher.
+
+        - fix <rdar://problem/6171280> REGRESSION (r35667): Assertion failure in WebCore::FrameView::scheduleRelayout() when releasing a page with counters from the b/f cache
+
+        No regression test because the back/forward cache is disabled in DumpRenderTree
+
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::invalidateCounters): Bail out if the document
+        is being destroyed.
+
+2008-09-13  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes for new methods recently introduced.
+
+        * platform/graphics/wx/AffineTransformWx.cpp:
+        (WebCore::AffineTransform::AffineTransform):
+        (WebCore::AffineTransform::setMatrix):
+        (WebCore::AffineTransform::setA):
+        (WebCore::AffineTransform::setB):
+        (WebCore::AffineTransform::setC):
+        (WebCore::AffineTransform::setD):
+        (WebCore::AffineTransform::setE):
+        (WebCore::AffineTransform::setF):
+        * platform/wx/LocalizedStringsWx.cpp:
+        (WebCore::AXDefinitionListTermText):
+        (WebCore::AXDefinitionListDefinitionText):
+
+2008-09-12  Dave Hyatt  <hyatt@apple.com>
+
+        Move the member variables of PlatformScrollbar up into Scrollbar.  Move autoscroll timer handling
+        up into scrollbar.  Make sure a bunch of cross-platform code now just uses "Scrollbar" instead of
+        "PlatformScrollbar."
+
+        Reviewed by Sam Weinig
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * editing/EditorCommand.cpp:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::selectCursor):
+        (WebCore::EventHandler::handleMousePressEvent):
+        (WebCore::EventHandler::handleMouseMoveEvent):
+        * page/EventHandler.h:
+        * page/MouseEventWithHitTestResults.cpp:
+        (WebCore::MouseEventWithHitTestResults::scrollbar):
+        * page/MouseEventWithHitTestResults.h:
+        * page/gtk/EventHandlerGtk.cpp:
+        (WebCore::EventHandler::passMousePressEventToScrollbar):
+        * page/mac/EventHandlerMac.mm:
+        (WebCore::EventHandler::passMousePressEventToScrollbar):
+        * page/qt/EventHandlerQt.cpp:
+        (WebCore::EventHandler::passMousePressEventToScrollbar):
+        * page/win/EventHandlerWin.cpp:
+        (WebCore::EventHandler::passMousePressEventToScrollbar):
+        * page/wx/EventHandlerWx.cpp:
+        (WebCore::EventHandler::passMousePressEventToScrollbar):
+        * platform/PopupMenu.h:
+        * platform/ScrollBar.cpp:
+        (WebCore::Scrollbar::Scrollbar):
+        (WebCore::Scrollbar::autoscrollTimerFired):
+        (WebCore::Scrollbar::autoscrollPressedPart):
+        (WebCore::Scrollbar::startTimerIfNeeded):
+        (WebCore::Scrollbar::stopTimerIfNeeded):
+        (WebCore::Scrollbar::pressedPartScrollDirection):
+        (WebCore::Scrollbar::pressedPartScrollGranularity):
+        * platform/ScrollBar.h:
+        (WebCore::Scrollbar::handleMousePressEvent):
+        (WebCore::Scrollbar::invalidatePart):
+        (WebCore::Scrollbar::thumbUnderMouse):
+        * platform/ScrollView.h:
+        * platform/ScrollbarClient.h: Added.
+        (WebCore::ScrollbarClient::~ScrollbarClient):
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::scrollbarUnderMouse):
+        * platform/qt/PlatformScrollBar.h:
+        * platform/qt/PlatformScrollBarQt.cpp:
+        (WebCore::PlatformScrollbar::PlatformScrollbar):
+        (WebCore::scrollbarPart):
+        (WebCore::PlatformScrollbar::handleMouseMoveEvent):
+        (WebCore::PlatformScrollbar::handleMouseOutEvent):
+        (WebCore::PlatformScrollbar::handleMousePressEvent):
+        (WebCore::PlatformScrollbar::handleMouseReleaseEvent):
+        * platform/qt/ScrollViewQt.cpp:
+        (WebCore::ScrollView::scrollbarUnderMouse):
+        (WebCore::ScrollView::wheelEvent):
+        * platform/win/PlatformScrollBar.h:
+        * platform/win/PlatformScrollBarSafari.cpp:
+        (WebCore::PlatformScrollbar::PlatformScrollbar):
+        * platform/win/PlatformScrollBarWin.cpp:
+        (WebCore::PlatformScrollbar::PlatformScrollbar):
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::scrollbarUnderMouse):
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::setScrollbar):
+        * rendering/HitTestResult.h:
+        (WebCore::HitTestResult::scrollbar):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestOverflowControls):
+        * rendering/RenderLayer.h:
+        * rendering/RenderListBox.h:
+
+2008-09-12  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix Mac build.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::getTransformOperationType):
+
+2008-09-12  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Make transform animation behavior match spec
+        https://bugs.webkit.org/show_bug.cgi?id=20770
+
+        Tests: transitions/transform-op-list-match.html
+               transitions/transform-op-list-no-match.html
+
+        * css/CSSStyleSelector.cpp:
+        * css/CSSStyleSelector.h:
+        * page/animation/AnimationBase.cpp:
+        * page/animation/AnimationBase.h:
+        * page/animation/ImplicitAnimation.cpp:
+        * page/animation/ImplicitAnimation.h:
+        * page/animation/KeyframeAnimation.cpp:
+        * page/animation/KeyframeAnimation.h:
+        * rendering/RenderLayer.cpp:
+        * rendering/style/RenderStyle.cpp:
+        * rendering/style/RenderStyle.h:
+
+2008-09-12  Ojan Vafai  <ojan@chromium.org>
+
+        Properly escape contents of links added to the inspector.
+        For now, just build the link with the DOM and get the
+        outerHTML. Eventually, we probably just want to do
+        this entirely with the DOM.
+
+        Reviewed by Timothy Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20684
+
+        * manual-tests/inspector/escape-links.html: Added.
+        * page/inspector/StylesSidebarPane.js:
+        * page/inspector/inspector.js:
+        * page/inspector/utilities.js:
+
+2008-09-12  Adele Peterson  <adele@apple.com>
+
+        Reviewed by John Sullivan and Kevin McCullough.
+
+        Fix for <rdar://problem/6216951> REGRESSION (r36000?): Crash due to infinite recursion into EventHandler::hitTestResultAtPoint() with disconnected frames
+
+        * page/EventHandler.cpp: (WebCore::EventHandler::hitTestResultAtPoint):
+        Hit testing again on the main frame will only work if we aren't already on the main frame.  If we are already on the main frame, that will
+        cause infinite recursion.  This change checks that we're not already on the main frame before hit testing again.
+
+2008-09-12  Kevin McCullough  <kmccullough@apple.com>
+
+        RS by Tim .
+
+        Re-introducing the code since it was not the cause of the crash.
+        See r36343.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::canBeProgramaticallyScrolled):
+        * rendering/RenderObject.h:
+
+2008-09-12  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        When changing one animation in a list, don't reset other animations
+        https://bugs.webkit.org/show_bug.cgi?id=20675
+
+        Test: animations/change-one-anim.html
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::getNumProperties):
+        * page/animation/AnimationBase.h:
+        * page/animation/AnimationController.cpp:
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateKeyframeAnimations):
+        * page/animation/CompositeAnimation.h:
+        * page/animation/ImplicitAnimation.cpp:
+        * page/animation/KeyframeAnimation.cpp:
+        * page/animation/KeyframeAnimation.h:
+        (WebCore::KeyframeAnimation::setIndex):
+
+2008-09-12  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Mitz Pettel
+
+        Fix the ASSERT and failure in webarchive/archive-empty-frame-source.html
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::mainResource): Further restoration of original WebArchive behavior.
+          Subresources can never be created from nil data, but there is always a MainResource, whether
+          or not there's any data.  So in the case where the main resource has no data, fake it for the
+          sake of creating the ArchiveResource.
+
+2008-09-12  Dave Hyatt  <hyatt@apple.com>
+
+        Preparation for major scrollbar rearchitecture.  Eliminate the concept of non-widget based
+        scrollbars (which we never supported anyway).  Make Scrollbar derive from Widget directly.
+        Remove all the isWidget and hasPlatformScrollbars guards.
+
+        Reviewed by Tim Hatcher
+
+        * platform/ScrollBar.h:
+        * platform/gtk/PlatformScrollBar.h:
+        * platform/mac/PlatformScrollBar.h:
+        * platform/qt/PlatformScrollBar.h:
+        * platform/win/PlatformScrollBar.h:
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::ScrollViewPrivate::setHasHorizontalScrollbar):
+        (WebCore::ScrollView::ScrollViewPrivate::setHasVerticalScrollbar):
+        * platform/wx/PlatformScrollBar.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::horizontalScrollbarWidget):
+        (WebCore::RenderLayer::verticalScrollbarWidget):
+        (WebCore::RenderLayer::createScrollbar):
+        (WebCore::RenderLayer::destroyScrollbar):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::~RenderListBox):
+        (WebCore::RenderListBox::updateFromElement):
+        (WebCore::RenderListBox::isPointInOverflowControl):
+
+2008-09-12  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - https://bugs.webkit.org/show_bug.cgi?id=20793 clean up page/animation
+
+        * page/animation/AnimationController.cpp:
+        * page/animation/AnimationController.h:
+        * page/animation/CompositeAnimation.cpp:
+        * page/animation/CompositeAnimation.h:
+        * page/animation/ImplicitAnimation.cpp:
+        * page/animation/ImplicitAnimation.h:
+        * page/animation/KeyframeAnimation.cpp:
+        * page/animation/KeyframeAnimation.h:
+
+2008-09-11  Timothy Hatcher  <timothy@apple.com>
+
+        Add a renderedImage method to DOMNode to get an image
+        of the rendering for the node and it's descendants.
+
+        <rdar://problem/5849349> Would like API to create
+        an image for a DOM node
+
+        Reviewed by Oliver Hunt.
+
+        * bindings/objc/DOM.mm:
+        (-[DOMNode renderedImage]): Call Frame::nodeImage.
+        * bindings/objc/DOMPrivate.h:
+        * page/Frame.h:
+        * page/mac/FrameMac.mm:
+        (WebCore::Frame::nodeImage):
+
+2008-09-08  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Need to support comma separated list of key times in keyframes selectors
+        https://bugs.webkit.org/show_bug.cgi?id=20680
+
+        Test: animations/keyframes-comma-separated.html
+
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::createKeyframeRule):
+        * css/CSSParser.h:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::addKeyframeStyle):
+        * css/WebKitCSSKeyframeRule.cpp:
+        (WebCore::WebKitCSSKeyframeRule::WebKitCSSKeyframeRule):
+        (WebCore::WebKitCSSKeyframeRule::cssText):
+        (WebCore::WebKitCSSKeyframeRule::parseKeyString):
+        * css/WebKitCSSKeyframeRule.h:
+        (WebCore::WebKitCSSKeyframeRule::keyText):
+        (WebCore::WebKitCSSKeyframeRule::setKeyText):
+        (WebCore::WebKitCSSKeyframeRule::getKeys):
+        * css/WebKitCSSKeyframesRule.cpp:
+        (WebCore::WebKitCSSKeyframesRule::append):
+        (WebCore::WebKitCSSKeyframesRule::insertRule):
+        (WebCore::WebKitCSSKeyframesRule::deleteRule):
+        (WebCore::WebKitCSSKeyframesRule::findRule):
+        (WebCore::WebKitCSSKeyframesRule::findRuleIndex):
+        * css/WebKitCSSKeyframesRule.h:
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::blendProperties):
+
+2008-09-11  Kevin McCullough  <kmccullough@apple.com>
+
+        RS by Tim.
+
+        Reverting because this caused a crash.
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::canBeProgramaticallyScrolled):
+        (WebCore::RenderObject::hasScrollableView):
+        * rendering/RenderObject.h:
+
+2008-09-11  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix assertion on transition property "none"
+        https://bugs.webkit.org/show_bug.cgi?id=20751
+
+        Test: transitions/transition-end-event-set-none.html
+
+        * page/animation/CompositeAnimation.cpp:
+        (WebCore::CompositeAnimation::updateTransitions):
+
+2008-09-11  David Smith  <catfish.man@gmail.com>
+
+        Rubber-stamped by mitzpettel.
+
+        Remove an accidentally added extra file.
+
+        * WebCore: Removed.
+
+2008-09-11  David Smith  <catfish.man@gmail.com>
+
+        Reviewed by Darin
+
+        https://bugs.webkit.org/show_bug.cgi?id=20180
+
+        This speeds up :nth-child matching as tested by querySelectorAll by around 10% by inlining the common case of Node::renderStyle(). Many thanks to mitzpettel and othermaciej for suggestions and help.
+
+        * WebCore.xcodeproj/project.pbxproj: Add NodeRenderStyle.h
+        * css/CSSStyleSelector.cpp: include NodeRenderStyle.h
+        * dom/Element.cpp: include NodeRenderStyle.h
+        * dom/Node.cpp: Remove the definition of renderStyle()
+        (WebCore::Node::nonRendererRenderStyle):
+        * dom/Node.h: Make renderStyle() nonvirtual and add nonRendererRenderStyle()
+        * dom/NodeRenderStyle.h: Added.
+        (WebCore::Node::renderStyle): Inline the common case of this, call nonRendererRenderStyle for the part that needed to be virtual
+        * html/HTMLOptGroupElement.cpp: include NodeRenderStyle.h
+        * html/HTMLOptGroupElement.h:
+        (WebCore::HTMLOptGroupElement::nonRendererRenderStyle): override to return m_style
+        * html/HTMLOptionElement.cpp: include NodeRenderStyle.h
+        * html/HTMLOptionElement.h:
+        (WebCore::HTMLOptionElement::nonRendererRenderStyle): override to return m_style
+        * rendering/RenderListBox.cpp: include NodeRenderStyle.h
+        * rendering/RenderMenuList.cpp: include NodeRenderStyle.h
+        * svg/SVGUseElement.cpp: include NodeRenderStyle.h
+
+2008-09-11  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Adele and Tim.
+
+        <rdar://problem/6100597> REGRESSION: clicking on search results in Web
+        Inspector does not scroll to the line of the results (20167)
+        - This was put in by Max to fix auto scrolling but is not correct for
+        the whole web: rdar://problem/6213098
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::canBeProgramaticallyScrolled):
+        * rendering/RenderObject.h:
+
+2008-09-11  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin
+
+        <rdar://problem/6210511> AX: if a frame has a title, that should be reported as the AXWebArea's title
+
+        Test: accessibility/frame-with-title.html
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityDescription):
+
+2008-09-11  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by Simon.
+
+        Fixed stroke() and strokeRect() to support gradients
+        and patterns on Qt.
+
+        [Qt] Canvas stroke don't work for gradients and patterns
+        [https://bugs.webkit.org/show_bug.cgi?id=20749]
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::strokeRect):
+
+2008-09-11  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by Simon.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20729
+
+        Fixed canvas gradients for Qt
+
+        [Qt] Canvas gradients don't work as expected
+        [https://bugs.webkit.org/show_bug.cgi?id=20729]
+
+        * platform/graphics/qt/GradientQt.cpp:
+        (WebCore::Gradient::platformGradient):
+
+2008-09-11  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by Simon.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20568
+
+        Add support for patterns to Qt.
+
+        * platform/graphics/qt/PatternQt.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+
+2008-09-10  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - clean up AnimationBase
+
+        * page/animation/AnimationBase.cpp:
+        * page/animation/AnimationBase.h:
+        * page/animation/CompositeAnimation.cpp:
+        * page/animation/ImplicitAnimation.cpp:
+        * page/animation/ImplicitAnimation.h:
+        * page/animation/KeyframeAnimation.cpp:
+        * page/animation/KeyframeAnimation.h:
+
+2008-09-10  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20741
+        REGRESSION: ISO-8859-8-I encoding is registered incorrectly
+
+        Turns out that there were no real behavior changes for 8859-8, as it was only a debug-only
+        check to ignore this specific registration that was failing. Yet, I decided to add a bunch of
+        tests for ISO-8859-8 encoding aliases, as we handle them in a quite complicated manner.
+
+        I also found and fixed a potential crasher for non-Mac ports.
+
+        Tests: fast/encoding/hebrew/8859-8-e.html
+               fast/encoding/hebrew/8859-8-i.html
+               fast/encoding/hebrew/8859-8.html
+               fast/encoding/hebrew/csISO88598I.html
+               fast/encoding/hebrew/hebrew.html
+               fast/encoding/hebrew/iso-ir-138.html
+               fast/encoding/hebrew/logical.html
+
+        * platform/text/TextEncodingRegistry.cpp: (WebCore::checkExistingName): Check for iso-8859-8
+        (case-insensitively, because different versions of ICU report this MIME name in different
+        case).
+
+        * platform/text/TextCodecICU.cpp:
+        (WebCore::TextCodecICU::registerExtendedEncodingNames): Updated some comments.
+        (WebCore::TextCodecICU::registerExtendedCodecs): Try both MIME and IANA names here, too.
+        There are four names in ICU that only have MIME names (x-mac-* ones), so we could end up
+        with an encoding map entry, but no codec for these. This was not an issue on the Mac, as
+        we also support these via TEC (which we should stop doing), but on Windows, this would
+        likely crash.
+
+2008-09-09  Dave Hyatt  <hyatt@apple.com
+
+        Resurrect PlatformScrollbarWin.
+
+        Reviewed by Adam Roben
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/win/PlatformScrollBarWin.cpp:
+        (WebCore::isRunningOnVistaOrLater):
+        (WebCore::checkAndInitScrollbarTheme):
+        (WebCore::PlatformScrollbar::PlatformScrollbar):
+        (WebCore::PlatformScrollbar::invalidateTrack):
+        (WebCore::PlatformScrollbar::invalidatePart):
+        (WebCore::PlatformScrollbar::paint):
+        (WebCore::PlatformScrollbar::hasButtons):
+        (WebCore::PlatformScrollbar::hasThumb):
+        (WebCore::PlatformScrollbar::backButtonRect):
+        (WebCore::PlatformScrollbar::forwardButtonRect):
+        (WebCore::PlatformScrollbar::trackRect):
+        (WebCore::PlatformScrollbar::gripperRect):
+        (WebCore::PlatformScrollbar::thumbLength):
+        (WebCore::PlatformScrollbar::paintButton):
+        (WebCore::PlatformScrollbar::paintTrack):
+        (WebCore::PlatformScrollbar::paintThumb):
+        (WebCore::PlatformScrollbar::paintGripper):
+        (WebCore::PlatformScrollbar::hitTest):
+        (WebCore::PlatformScrollbar::handleMouseMoveEvent):
+        (WebCore::PlatformScrollbar::handleMouseOutEvent):
+        (WebCore::PlatformScrollbar::themeChanged):
+
+2008-09-09  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20759: Remove MacroAssembler
+        <https://bugs.webkit.org/show_bug.cgi?id=20759>
+
+        Make the necessary changes to ForwardingHeaders to remove
+        MacroAssembler.
+
+        * ForwardingHeaders/masm/IA32MacroAsm.h: Removed.
+        * ForwardingHeaders/masm/MacroAssembler.h: Removed.
+        * ForwardingHeaders/masm/X86Assembler.h: Added.
+
+2008-09-09  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=16792
+        [GTK] Fails to render Japanese/Chinese text with simple path
+
+        https://bugs.webkit.org/show_bug.cgi?id=16942
+        [GTK] Oddities in font selection and fall back
+
+        https://bugs.webkit.org/show_bug.cgi?id=16862
+        [GTK] Custom fonts hard-coded to use grayscale antialiasing and no hinting
+
+        GTK+ font fixes and enhancements.
+
+        Implement font fallback for the simple FontConfig-based text path and
+        improve the Pango-based complex text path to make use of requested
+        font properties and available font selection.
+
+        Add text shadow support to the complex path.
+
+        * platform/graphics/gtk/FontCacheGtk.cpp:
+        (WebCore::FontCache::getFontDataForCharacters):
+        (WebCore::FontCache::getSimilarFontPlatformData):
+        * platform/graphics/gtk/FontGtk.cpp:
+        (WebCore::setPangoAttributes):
+        (WebCore::Font::drawComplexText):
+        (WebCore::getDefaultPangoLayout):
+        (WebCore::Font::floatWidthForComplexText):
+        (WebCore::Font::offsetForPositionForComplexText):
+        (WebCore::Font::selectionRectForComplexText):
+        * platform/graphics/gtk/FontPlatformData.h:
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::hash):
+        * platform/graphics/gtk/FontPlatformDataGtk.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+        * platform/graphics/gtk/SimpleFontDataGtk.cpp:
+        (WebCore::SimpleFontData::platformDestroy):
+
+2008-09-09  Dave Hyatt  <hyatt@apple.com>
+
+        Make the Windows classic case work again.  Overlap in slider constants and other constants broke
+        the push state for buttons and checkboxes.  Make sure to check the RenderObject's appearance
+        value to make sure it's really a slider thumb to resolve this conflict.
+
+        Reviewed by Adam Roben
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::drawControl):
+
+2008-09-05  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Need to handle the case when 0% or 100% keyframe is omitted
+        https://bugs.webkit.org/show_bug.cgi?id=20679
+
+        Tests: animations/keyframes-from-missing.html
+               animations/keyframes-to-missing.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::addKeyframeStyle):
+
+2008-09-09  Dave Hyatt  <hyatt@apple.com>
+
+        Resurrect Safari's original RenderThemeWin and bring it up to date with ToT.  Having a current
+        RenderThemeWin that does not have any Skia dependencies should provide a good basis for a potential
+        merge of Google Chrome's RenderThemeWin (to help us see where the Skia stuff can be cut and to see
+        what changes have been made as compared with the old RenderThemeWin).
+
+        Fix CSS2 system fonts to properly set both the rendering mode (so that they properly pick up GDI vs. CG
+        text rendering modes) and the printer font setting (so that OS X system fonts properly pick up screen
+        vs. printer advancement rounding).
+
+        Reviewed by Adam/Sam
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * platform/graphics/Icon.h:
+        (WebCore::Icon::create):
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::RenderThemeWin):
+        (WebCore::RenderThemeWin::~RenderThemeWin):
+        (WebCore::RenderThemeWin::buttonTheme):
+        (WebCore::RenderThemeWin::textFieldTheme):
+        (WebCore::RenderThemeWin::menuListTheme):
+        (WebCore::RenderThemeWin::sliderTheme):
+        (WebCore::RenderThemeWin::close):
+        (WebCore::RenderThemeWin::themeChanged):
+        (WebCore::RenderThemeWin::supportsHover):
+        (WebCore::fillFontDescription):
+        (WebCore::RenderThemeWin::systemFont):
+        (WebCore::RenderThemeWin::supportsFocus):
+        (WebCore::RenderThemeWin::determineClassicState):
+        (WebCore::RenderThemeWin::determineState):
+        (WebCore::RenderThemeWin::determineSliderThumbState):
+        (WebCore::RenderThemeWin::getClassicThemeData):
+        (WebCore::RenderThemeWin::getThemeData):
+        (WebCore::drawControl):
+        (WebCore::RenderThemeWin::paintButton):
+        (WebCore::RenderThemeWin::paintTextField):
+        (WebCore::RenderThemeWin::paintMenuList):
+        (WebCore::RenderThemeWin::adjustMenuListStyle):
+        (WebCore::RenderThemeWin::adjustMenuListButtonStyle):
+        (WebCore::RenderThemeWin::paintMenuListButton):
+        (WebCore::RenderThemeWin::paintSliderTrack):
+        (WebCore::RenderThemeWin::paintSliderThumb):
+        (WebCore::RenderThemeWin::adjustSliderThumbSize):
+        (WebCore::RenderThemeWin::paintSearchField):
+        (WebCore::RenderThemeWin::adjustSearchFieldStyle):
+        (WebCore::RenderThemeWin::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeWin::adjustSearchFieldCancelButtonStyle):
+        (WebCore::RenderThemeWin::adjustSearchFieldDecorationStyle):
+        (WebCore::RenderThemeWin::adjustSearchFieldResultsDecorationStyle):
+        (WebCore::RenderThemeWin::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeWin::adjustSearchFieldResultsButtonStyle):
+        (WebCore::RenderThemeWin::paintSearchFieldResultsButton):
+        * rendering/RenderThemeWin.h:
+        (WebCore::ThemeData::ThemeData):
+        (WebCore::RenderThemeWin::paintSearchFieldDecoration):
+        (WebCore::RenderThemeWin::adjustButtonStyle):
+        (WebCore::RenderThemeWin::adjustTextFieldStyle):
+        (WebCore::RenderThemeWin::adjustTextAreaStyle):
+
+2008-09-09  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Document::createEvent missing cases for animation and
+        transition events.
+        https://bugs.webkit.org/show_bug.cgi?id=20734
+
+        Test: transitions/transition-end-event-create.html
+        Test: animations/animation-events-create.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::createEvent):
+            - add the two cases
+
+2008-09-09  Dan Bernstein  <mitz@apple.com>
+
+        - Tiger build fix
+
+        * WebCore.Tiger.exp:
+        * WebCore.base.exp:
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2008-09-09  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - WebCore part of <rdar://problem/6206244> Use alternate character-to-glyph interface on Leopard
+
+        * WebCore.Tiger.exp:
+        * WebCore.base.exp:
+        * platform/graphics/SimpleFontData.h:
+        * platform/graphics/mac/GlyphPageTreeNodeMac.cpp:
+        (WebCore::GlyphPage::fill):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::initFontData):
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformDestroy):
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+
+2008-09-09  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        <rdar://problem/6198545> REGRESSION: Inspector debugger barfs on
+        breakpoints inside eval.
+
+        * page/inspector/inspector.js:
+
+2008-09-09  Joerg Bornemann  <joerg.bornemann@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix compilation of the Qt port with disabled plugins on Windows
+
+        * WebCore.pro:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::PluginView):
+        * plugins/PluginView.h:
+
+2008-09-09  Jungshik Shin  <jungshik.shin@gmail.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Try MIME charset names before trying IANA names
+        ( https://bugs.webkit.org/show_bug.cgi?id=17537 )
+
+        With this change, shorter and more widely used names (preferred MIME
+        names) are returned by document.charset, document.characterSet,
+        document.inputEncoding rather than IANA names. This  helps
+        fixing bug 18085 in addition to web developers who are more familiar
+        with MIME names. For instance, EUC-JP, ISO-8859-X and US-ASCII will be
+        returned instead of Extended_UNIX_Code_Packed_Format_for_Japanese,
+        ISO-8859-X:19xx, and ANSI_X3.4-1968. It also replaces IBM8xx with cp8xx.
+        Note that cp/IBM 8xx are extremly rare in today's web. Even if they're
+        used, the former is still recognized as aliases to the latter so that
+        there's very little, if any, to worry about.
+
+        * platform/text/TextCodecICU.cpp:
+        (WebCore::TextCodecICU::registerExtendedEncodingNames):
+
+2008-09-08  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Maciej Stachowiak and Oliver Hunt.
+
+        Add forwarding headers.
+
+        * ForwardingHeaders/wtf/HashFunctions.h: Added.
+
+2008-09-05  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Update grammar so that we can add a keyframe rule via the DOM.
+        https://bugs.webkit.org/show_bug.cgi?id=20613
+
+        * css/CSSGrammar.y:
+        * css/tokenizer.flex:
+
+2008-09-08  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Allow <br> for simple UA stylesheet. Editing code generates them. It does not
+        actually show up in any of the default stylesheets.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::elementCanUseSimpleDefaultStyle):
+
+2008-09-08  Dimitri Glazkov  <dglazkov@google.com>
+
+        Reviewed by Dan Bernstein.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=20237
+          Zero width and space characters are displayed incorrectly if not contained in a fallback font
+
+        Adds an extra check for Object Replacement Character (U+FFFC) to address
+        the issue with fast/text/zero-width-characters.html test when run
+        with Windows system default fonts.
+
+        * platform/graphics/Font.h:
+        (WebCore::Font::treatAsZeroWidthSpace):
+
+2008-09-08  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Code style issue I forgot to fix from previous commit.
+
+        * platform/graphics/AffineTransform.cpp:
+        (WebCore::AffineTransform::blend):
+
+2008-09-08  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Sam Weinig
+
+        - Animation of -webkit-transform matrix() function should not do linear interpolation
+          https://bugs.webkit.org/show_bug.cgi?id=20667
+
+        Test: animations/matrix-anim.html
+
+        * ChangeLog:
+        * platform/graphics/AffineTransform.cpp:
+        (WebCore::affineTransformDecompose):
+        (WebCore::affineTransformCompose):
+        (WebCore::AffineTransform::blend):
+        * platform/graphics/AffineTransform.h:
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::MatrixTransformOperation::blend):
+
+2008-09-08  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20668
+        multipart/form-data does not always include Content-type for submitted files
+
+        Cannot be tested with DRT or manual tests.
+
+        * platform/MIMETypeRegistry.cpp:
+        (WebCore::initializeSupportedNonImageMimeTypes): Fix spacing.
+        (WebCore::MIMETypeRegistry::getMIMETypeForPath): Default to application/octet-stream for
+        unknown extensions, not just missing ones.
+
+2008-09-08  Simon Hausmann  <hausmann@webkit.org>
+
+        Build fix for the Qt/Windows build, define USE_JSC to
+        enable the WebCore::String -> JSC::UString operator that
+        MSVC insists on seeing
+
+        * WebCore.pro:
+
+2008-09-08  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Maciej.
+
+        <rdar://problem/5850387> Showing bookmarks reloads Google Reader instead.
+
+        In some cases, timeouts scheduled by a page in the onunload handler could fire even when the
+        page had been unloaded and replaced by a non-HTML representation based view (such as the bookmarks view).
+
+        Fix this by clearing timeouts for pages that aren't cached when the provisional load is committed.
+
+        * bindings/js/JSDOMWindowBase.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::commitProvisionalLoad):
+
+2008-09-07  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Don't leak the simple stylesheet.
+        Also call RenderTheme::adjustDefaultStyleSheet() in right place.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::loadFullDefaultStyle):
+        (WebCore::loadSimpleDefaultStyle):
+        (WebCore::CSSStyleSelector::styleForElement):
+
+2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 20711: Change KJS prefix on preprocessor macros to JSC
+        <https://bugs.webkit.org/show_bug.cgi?id=20711>
+
+        * bindings/js/JSEventTargetBase.h:
+        * bindings/js/JSHTMLInputElementBase.cpp:
+        * bindings/js/JSHTMLInputElementBase.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+
+2008-09-07  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Reviewed by Maciej Stachowiak.
+
+        Bug 20704: Replace the KJS namespace
+        <https://bugs.webkit.org/show_bug.cgi?id=20704>
+
+        Rename the KJS namespace to JSC. There are still some uses of KJS in the
+        names of JNI functions, and I will check if these are safe to change
+        as well.
+
+        * WebCore.base.exp:
+        * bindings/js/GCController.cpp:
+        * bindings/js/JSAttrCustom.cpp:
+        * bindings/js/JSAudioConstructor.cpp:
+        * bindings/js/JSAudioConstructor.h:
+        (WebCore::JSAudioConstructor::classInfo):
+        * bindings/js/JSCSSRuleCustom.cpp:
+        * bindings/js/JSCSSStyleDeclarationCustom.cpp:
+        * bindings/js/JSCSSValueCustom.cpp:
+        * bindings/js/JSCanvasPixelArrayCustom.cpp:
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        * bindings/js/JSClipboardCustom.cpp:
+        * bindings/js/JSConsoleCustom.cpp:
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementCallback.h:
+        (WebCore::JSCustomSQLStatementCallback::create):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.h:
+        (WebCore::JSCustomSQLStatementErrorCallback::create):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.h:
+        (WebCore::JSCustomSQLTransactionCallback::create):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.h:
+        (WebCore::JSCustomSQLTransactionErrorCallback::create):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.h:
+        (WebCore::JSCustomVoidCallback::create):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::create):
+        * bindings/js/JSCustomXPathNSResolver.h:
+        * bindings/js/JSDOMApplicationCacheCustom.cpp:
+        (WebCore::JSDOMApplicationCache::dispatchEvent):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::jsOwnedStringOrNull):
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObject::DOMObject):
+        (WebCore::cacheDOMObject):
+        (WebCore::cacheSVGDOMObject):
+        (WebCore::DOMExceptionTranslator::DOMExceptionTranslator):
+        (WebCore::toJS):
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowBase.h:
+        (WebCore::JSDOMWindowBase::classInfo):
+        (WebCore::JSDOMWindowBase::d):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::getPropertyAttributes):
+        * bindings/js/JSDOMWindowCustom.h:
+        (WebCore::asJSDOMWindow):
+        (WebCore::JSDOMWindow::customGetOwnPropertySlot):
+        (WebCore::JSDOMWindow::customPut):
+        (WebCore::JSDOMWindowBase::allowsAccessFrom):
+        (WebCore::JSDOMWindowBase::allowsAccessFromNoErrorMessage):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::getPropertyAttributes):
+        * bindings/js/JSDOMWindowShell.h:
+        (WebCore::JSDOMWindowShell::classInfo):
+        * bindings/js/JSDatabaseCustom.cpp:
+        * bindings/js/JSDocumentCustom.cpp:
+        * bindings/js/JSDocumentFragmentCustom.cpp:
+        * bindings/js/JSElementCustom.cpp:
+        * bindings/js/JSEventCustom.cpp:
+        * bindings/js/JSEventListener.cpp:
+        * bindings/js/JSEventListener.h:
+        (WebCore::JSUnprotectedEventListener::create):
+        (WebCore::JSEventListener::create):
+        * bindings/js/JSEventTargetBase.cpp:
+        * bindings/js/JSEventTargetBase.h:
+        (WebCore::JSEventTargetBase::getValueProperty):
+        (WebCore::JSEventTargetBase::putValueProperty):
+        (WebCore::JSEventTargetBase::getOwnPropertySlot):
+        (WebCore::JSEventTargetBase::put):
+        (WebCore::JSEventTargetPrototype::JSEventTargetPrototype):
+        (WebCore::JSEventTargetPrototype::self):
+        (WebCore::JSEventTargetPrototype::getOwnPropertySlot):
+        (WebCore::JSEventTargetPrototype::classInfo):
+        * bindings/js/JSEventTargetNode.cpp:
+        * bindings/js/JSEventTargetNode.h:
+        (WebCore::JSEventTargetNode::getOwnPropertySlot):
+        (WebCore::JSEventTargetNode::getValueProperty):
+        (WebCore::JSEventTargetNode::put):
+        (WebCore::JSEventTargetNode::putValueProperty):
+        * bindings/js/JSHTMLAllCollection.h:
+        (WebCore::JSHTMLAllCollection::JSHTMLAllCollection):
+        (WebCore::JSHTMLAllCollection::toBoolean):
+        * bindings/js/JSHTMLAppletElementCustom.cpp:
+        * bindings/js/JSHTMLCollectionCustom.cpp:
+        * bindings/js/JSHTMLDocumentCustom.cpp:
+        * bindings/js/JSHTMLElementCustom.cpp:
+        * bindings/js/JSHTMLEmbedElementCustom.cpp:
+        * bindings/js/JSHTMLFormElementCustom.cpp:
+        * bindings/js/JSHTMLFrameElementCustom.cpp:
+        * bindings/js/JSHTMLFrameSetElementCustom.cpp:
+        * bindings/js/JSHTMLIFrameElementCustom.cpp:
+        * bindings/js/JSHTMLInputElementBase.cpp:
+        (WebCore::JSHTMLInputElementBase::JSHTMLInputElementBase):
+        (WebCore::JSHTMLInputElementBase::getOwnPropertySlot):
+        * bindings/js/JSHTMLInputElementBase.h:
+        (WebCore::JSHTMLInputElementBase::classInfo):
+        * bindings/js/JSHTMLObjectElementCustom.cpp:
+        * bindings/js/JSHTMLOptionElementConstructor.cpp:
+        * bindings/js/JSHTMLOptionElementConstructor.h:
+        (WebCore::JSHTMLOptionElementConstructor::classInfo):
+        * bindings/js/JSHTMLOptionsCollectionCustom.cpp:
+        * bindings/js/JSHTMLSelectElementCustom.cpp:
+        (WebCore::selectIndexSetter):
+        (WebCore::JSHTMLSelectElement::indexSetter):
+        * bindings/js/JSHTMLSelectElementCustom.h:
+        * bindings/js/JSHistoryCustom.cpp:
+        * bindings/js/JSImageConstructor.cpp:
+        * bindings/js/JSImageConstructor.h:
+        (WebCore::JSImageConstructor::classInfo):
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        * bindings/js/JSInspectedObjectWrapper.h:
+        (WebCore::JSInspectedObjectWrapper::wrapOutgoingValue):
+        (WebCore::JSInspectedObjectWrapper::classInfo):
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        * bindings/js/JSInspectorCallbackWrapper.h:
+        (WebCore::JSInspectorCallbackWrapper::classInfo):
+        (WebCore::JSInspectorCallbackWrapper::wrapOutgoingValue):
+        * bindings/js/JSJavaScriptCallFrameCustom.cpp:
+        * bindings/js/JSLocationCustom.cpp:
+        * bindings/js/JSMimeTypeArrayCustom.cpp:
+        * bindings/js/JSNSResolver.cpp:
+        * bindings/js/JSNSResolver.h:
+        (WebCore::JSNSResolver::create):
+        * bindings/js/JSNamedNodeMapCustom.cpp:
+        * bindings/js/JSNamedNodesCollection.cpp:
+        (WebCore::JSNamedNodesCollection::JSNamedNodesCollection):
+        * bindings/js/JSNamedNodesCollection.h:
+        (WebCore::JSNamedNodesCollection::classInfo):
+        * bindings/js/JSNavigatorCustom.cpp:
+        * bindings/js/JSNodeCustom.cpp:
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/JSNodeFilterCondition.h:
+        (WebCore::JSNodeFilterCondition::create):
+        * bindings/js/JSNodeFilterCustom.cpp:
+        * bindings/js/JSNodeIteratorCustom.cpp:
+        * bindings/js/JSNodeListCustom.cpp:
+        * bindings/js/JSPluginArrayCustom.cpp:
+        * bindings/js/JSPluginCustom.cpp:
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::getRuntimeObject):
+        * bindings/js/JSPluginElementFunctions.h:
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::construct):
+        (WebCore::JSQuarantinedObjectWrapper::call):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        (WebCore::JSQuarantinedObjectWrapper::unwrappedObject):
+        (WebCore::JSQuarantinedObjectWrapper::unwrappedGlobalObject):
+        (WebCore::JSQuarantinedObjectWrapper::className):
+        * bindings/js/JSRGBColor.cpp:
+        * bindings/js/JSRGBColor.h:
+        (WebCore::JSRGBColor::classInfo):
+        * bindings/js/JSSQLResultSetRowListCustom.cpp:
+        * bindings/js/JSSQLTransactionCustom.cpp:
+        * bindings/js/JSSVGLazyEventListener.cpp:
+        * bindings/js/JSSVGLazyEventListener.h:
+        * bindings/js/JSSVGLengthCustom.cpp:
+        * bindings/js/JSSVGMatrixCustom.cpp:
+        (WebCore::JSSVGMatrix::inverse):
+        (WebCore::JSSVGMatrix::rotateFromVector):
+        * bindings/js/JSSVGPathSegCustom.cpp:
+        * bindings/js/JSSVGPathSegListCustom.cpp:
+        (WebCore::JSSVGPathSegList::initialize):
+        (WebCore::JSSVGPathSegList::getItem):
+        (WebCore::JSSVGPathSegList::insertItemBefore):
+        (WebCore::JSSVGPathSegList::replaceItem):
+        (WebCore::JSSVGPathSegList::removeItem):
+        (WebCore::JSSVGPathSegList::appendItem):
+        * bindings/js/JSSVGPointListCustom.cpp:
+        * bindings/js/JSSVGTransformListCustom.cpp:
+        * bindings/js/JSStorageCustom.cpp:
+        * bindings/js/JSStyleSheetCustom.cpp:
+        * bindings/js/JSStyleSheetListCustom.cpp:
+        * bindings/js/JSTextCustom.cpp:
+        * bindings/js/JSTreeWalkerCustom.cpp:
+        * bindings/js/JSXMLHttpRequestConstructor.cpp:
+        * bindings/js/JSXMLHttpRequestConstructor.h:
+        (WebCore::JSXMLHttpRequestConstructor::classInfo):
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        * bindings/js/JSXMLHttpRequestUploadCustom.cpp:
+        * bindings/js/JSXSLTProcessorConstructor.cpp:
+        * bindings/js/JSXSLTProcessorConstructor.h:
+        (WebCore::JSXSLTProcessorConstructor::classInfo):
+        * bindings/js/JSXSLTProcessorCustom.cpp:
+        * bindings/js/ScheduledAction.cpp:
+        * bindings/js/ScheduledAction.h:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::attachDebugger):
+        (WebCore::ScriptController::windowScriptNPObject):
+        * bindings/js/ScriptController.h:
+        * bindings/js/ScriptControllerGtk.cpp:
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+        (WebCore::ScriptController::windowScriptObject):
+        (WebCore::ScriptController::clearPlatformScriptObjects):
+        (WebCore::updateRenderingForBindings):
+        (WebCore::ScriptController::initJavaJSBindings):
+        * bindings/js/ScriptControllerQt.cpp:
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+        * bindings/js/ScriptControllerWin.cpp:
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+        * bindings/js/ScriptControllerWx.cpp:
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+        * bindings/js/StringSourceProvider.h:
+        (WebCore::StringSourceProvider::getRange):
+        * bindings/objc/DOM.mm:
+        (-[DOMNode JSC::Bindings::]):
+        * bindings/objc/DOMInternal.h:
+        * bindings/objc/DOMInternal.mm:
+        (-[WebScriptObject _initializeScriptDOMNodeImp]):
+        * bindings/objc/DOMUtility.mm:
+        (JSC::createDOMWrapper):
+        (WebCore::createDOMWrapper):
+        * bindings/objc/WebScriptObject.mm:
+        (WebCore::createJSWrapper):
+        (-[WebScriptObject _initWithJSObject:JSC::originRootObject:JSC::Bindings::rootObject:JSC::Bindings::]):
+        * bindings/objc/WebScriptObjectPrivate.h:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/NP_jsobject.cpp:
+        * bridge/NP_jsobject.h:
+        * bridge/c/c_class.cpp:
+        * bridge/c/c_class.h:
+        * bridge/c/c_instance.cpp:
+        * bridge/c/c_instance.h:
+        * bridge/c/c_runtime.cpp:
+        * bridge/c/c_runtime.h:
+        * bridge/c/c_utility.cpp:
+        * bridge/c/c_utility.h:
+        * bridge/jni/jni_class.cpp:
+        * bridge/jni/jni_class.h:
+        * bridge/jni/jni_instance.cpp:
+        * bridge/jni/jni_instance.h:
+        * bridge/jni/jni_jsobject.h:
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::convertJObjectToValue):
+        * bridge/jni/jni_objc.mm:
+        (JSC::Bindings::dispatchJNICall):
+        * bridge/jni/jni_runtime.cpp:
+        * bridge/jni/jni_runtime.h:
+        * bridge/jni/jni_utility.cpp:
+        * bridge/jni/jni_utility.h:
+        * bridge/npruntime.cpp:
+        (_NPN_GetStringIdentifier):
+        * bridge/objc/WebScriptObject.h:
+        * bridge/objc/objc_class.h:
+        * bridge/objc/objc_class.mm:
+        * bridge/objc/objc_instance.h:
+        * bridge/objc/objc_instance.mm:
+        * bridge/objc/objc_runtime.h:
+        * bridge/objc/objc_runtime.mm:
+        * bridge/objc/objc_utility.h:
+        * bridge/objc/objc_utility.mm:
+        * bridge/qt/qt_class.cpp:
+        * bridge/qt/qt_class.h:
+        * bridge/qt/qt_instance.cpp:
+        * bridge/qt/qt_instance.h:
+        * bridge/qt/qt_runtime.cpp:
+        (JSC::Bindings::convertQVariantToValue):
+        (JSC::Bindings::):
+        * bridge/qt/qt_runtime.h:
+        * bridge/runtime.cpp:
+        * bridge/runtime.h:
+        * bridge/runtime_array.cpp:
+        * bridge/runtime_array.h:
+        * bridge/runtime_method.cpp:
+        * bridge/runtime_method.h:
+        * bridge/runtime_object.cpp:
+        * bridge/runtime_object.h:
+        * bridge/runtime_root.cpp:
+        (JSC::Bindings::RootObject::invalidate):
+        (JSC::Bindings::RootObject::gcProtect):
+        (JSC::Bindings::RootObject::gcUnprotect):
+        * bridge/runtime_root.h:
+        * bridge/testbindings.cpp:
+        * bridge/testbindings.mm:
+        * bridge/testqtbindings.cpp:
+        * dom/Document.cpp:
+        (WebCore::Document::~Document):
+        * dom/NSResolver.h:
+        * dom/Node.cpp:
+        (WebCore::Node::setDocument):
+        (WebCore::ResolveNamespaceFunctor::ResolveNamespaceFunctor):
+        (WebCore::resolveNamespacesForSelector):
+        (WebCore::Node::querySelector):
+        (WebCore::Node::querySelectorAll):
+        * dom/Node.h:
+        * dom/NodeFilter.cpp:
+        * dom/NodeFilter.h:
+        * dom/NodeFilterCondition.cpp:
+        * dom/NodeFilterCondition.h:
+        * dom/NodeIterator.cpp:
+        * dom/NodeIterator.h:
+        * dom/Traversal.cpp:
+        * dom/Traversal.h:
+        * dom/TreeWalker.cpp:
+        * dom/TreeWalker.h:
+        * dom/make_names.pl:
+        * history/CachedPage.cpp:
+        * history/CachedPage.h:
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::getInstance):
+        * html/HTMLPlugInElement.h:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::iconDatabase):
+        * page/Console.cpp:
+        * page/Console.h:
+        * page/InspectorController.cpp:
+        (WebCore::XMLHttpRequestResource::XMLHttpRequestResource):
+        (WebCore::XMLHttpRequestResource::~XMLHttpRequestResource):
+        (WebCore::InspectorResource::setXMLHttpRequestProperties):
+        (WebCore::InspectorResource::sourceString):
+        (WebCore::getResourceDocumentNode):
+        (WebCore::search):
+        (WebCore::InspectorController::focusNode):
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::addDatabaseScriptResource):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        * page/InspectorController.h:
+        (WebCore::InspectorController::profiles):
+        * page/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::scopeChain):
+        * page/JavaScriptCallFrame.h:
+        (WebCore::JavaScriptCallFrame::create):
+        (WebCore::JavaScriptCallFrame::update):
+        * page/JavaScriptDebugListener.h:
+        * page/JavaScriptDebugServer.cpp:
+        (WebCore::dispatchDidParseSource):
+        * page/JavaScriptDebugServer.h:
+        * page/JavaScriptProfile.cpp:
+        * page/JavaScriptProfile.h:
+        * page/JavaScriptProfileNode.cpp:
+        (WebCore::getTotalTime):
+        (WebCore::getSelfTime):
+        (WebCore::getTotalPercent):
+        (WebCore::getSelfPercent):
+        (WebCore::getNumberOfCalls):
+        (WebCore::getChildren):
+        (WebCore::getVisible):
+        * page/JavaScriptProfileNode.h:
+        * page/Page.cpp:
+        (WebCore::Page::setDebuggerForAllPages):
+        (WebCore::Page::setDebugger):
+        * page/Page.h:
+        (WebCore::Page::debugger):
+        * page/mac/FrameMac.mm:
+        * platform/KURL.h:
+        (WebCore::KURL::operator JSC::UString):
+        * platform/text/AtomicString.cpp:
+        (WebCore::AtomicString::add):
+        (WebCore::AtomicString::find):
+        * platform/text/AtomicString.h:
+        (WebCore::AtomicString::AtomicString):
+        * platform/text/PlatformString.h:
+        * platform/text/String.cpp:
+        (WebCore::charactersToDouble):
+        * platform/win/BString.cpp:
+        * platform/win/BString.h:
+        * plugins/MimeTypeArray.h:
+        * plugins/Plugin.h:
+        * plugins/PluginArray.h:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        (WebCore::PluginView::performRequest):
+        (WebCore::PluginView::bindingInstance):
+        * plugins/PluginView.h:
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::init):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::init):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::stop):
+        * storage/Database.cpp:
+        (WebCore::Database::Database):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::responseText):
+        (WebCore::XMLHttpRequest::loadRequestAsynchronously):
+        (WebCore::XMLHttpRequest::clearResponse):
+        (WebCore::XMLHttpRequest::dropProtection):
+        (WebCore::XMLHttpRequest::didFinishLoading):
+        (WebCore::XMLHttpRequest::didReceiveData):
+        * xml/XMLHttpRequest.h:
+
+2008-09-07  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Adopt opener restriction on frame navigation.
+          https://bugs.webkit.org/show_bug.cgi?id=20642
+
+        This restriction helps prevent an attacker from navigating top-level
+        windows that were created by another web site.
+
+        Tests: http/tests/security/frameNavigation/not-opener.html
+               http/tests/security/frameNavigation/opener.html
+
+        * loader/FrameLoader.cpp:
+        (WebCore::canAccessAncestor):
+        (WebCore::FrameLoader::shouldAllowNavigation):
+
+2008-09-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        - use the correct sign for vertical offsets of combining marks
+
+        * platform/graphics/win/UniscribeController.cpp:
+        (WebCore::UniscribeController::shapeAndPlaceItem):
+
+2008-09-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - add the combining mark offsets in two places where I forgot them
+
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2008-09-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - correct glyph advances in complex text using web fonts rendered with
+          Core Graphics
+
+        * platform/graphics/win/FontCustomPlatformData.cpp:
+        (WebCore::FontCustomPlatformData::fontPlatformData):
+
+2008-09-07  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Adds console.dirxml support to the Web Inspector.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19156
+
+        Reviewed by Timothy Hatcher.
+
+        * WebCore.vcproj/WebCore.vcproj: Added ElementsTreeOutline.js.
+        * bindings/js/JSConsoleCustom.cpp:
+        (WebCore::JSConsole::dirxml):
+        * page/Console.cpp:
+        (WebCore::Console::dirxml): Adds a ConsoleMessage with NodeMessageLevel.
+        * page/Console.h:
+        (WebCore::): Added NodeMessageLevel.
+        * page/Console.idl: Added console.dirxml.
+        * page/inspector/Console.js: A NodeMessage creates a ElementsTreeOutline.
+        * page/inspector/ElementsPanel.js: Modified to use ElementsTreeOutline. The ElementsTreeOutline
+        in the ElementsPanel has includeRootDOMNode and selectEnabled set to true.
+        * page/inspector/ElementsTreeOutline.js: Added.
+        (WebInspector.ElementsTreeOutline): A subclass of TreeOutline for displaying a DOM node tree.
+        (WebInspector.ElementsTreeElement): A subclass of TreeElement for ElementsTreeOutline.
+        * page/inspector/WebKit.qrc: Added ElementsTreeOutline.js.
+        * page/inspector/inspector.css:
+        * page/inspector/inspector.html: Added ElementsTreeOutline.js.
+        * page/inspector/inspector.js: Moved hover related methods to WebInspector.
+        (WebInspector.altKeyDown):
+        (WebInspector.forceHoverHighlight):
+        (WebInspector.hoveredDOMNode):
+        (WebInspector._updateHoverHighlightSoon):
+        (WebInspector._updateHoverHighlight):
+        (WebInspector.documentKeyDown): Updates WebInspector.altKeyDown
+        (WebInspector.documentKeyUp): Updates WebInspector.altKeyDown
+        * page/inspector/utilities.js: Added getDocumentForNode, parentNodeOrFrameElement,
+        isAncestorIncludingParentFrames.
+
+2008-09-06  Mark Rowe  <mrowe@apple.com>
+
+        Qt build fix.
+
+        * bridge/qt/qt_runtime.cpp:
+        (KJS::Bindings::convertQVariantToValue):
+
+=== End merge of squirrelfish-extreme ===
+
+2008-09-05  Oliver Hunt  <oliver@apple.com>
+
+        Start bringing up SFX on windows.
+
+        Reviewed by Mark Rowe and Sam Weinig
+
+        Start doing the work to bring up SFX on windows.  Initially
+        just working on WREC, as it does not make any calls so reduces
+        the amount of code that needs to be corrected.
+
+        Add forwarding headers
+
+        * ChangeLog:
+        * ForwardingHeaders/masm/MacroAssembler.h: Added.
+        * WebCore.vcproj/WebCore.vcproj:
+
+2008-08-27  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix the build of the full WebKit stack.
+
+        Add forwarding headers.
+
+        * ForwardingHeaders/masm/IA32MacroAsm.h: Added.
+        * ForwardingHeaders/wrec/WREC.h: Added.
+
+=== Start merge of squirrelfish-extreme ===
+
+2008-09-06  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        <rdar://problem/6187043>
+        Don't parse full HTML user agent style sheet unless it is actually needed
+        <rdar://problem/6131889>
+        WebView is significantly more expensive to create recently
+
+        Parsing the html4.css takes significant amount of time and memory (~50kb) on application
+        startup. Some clients may never use most of the rules.
+
+        With this patch we use simplified UA stylesheet until we hit something it can't handle.
+        This avoids full stylesheet parsing on application startup (due to empty document construction)
+        and also makes it possible for clients with very simple demands (divs and spans only) never to load
+        the full style.
+
+        It also delays view source style parsing until it is used.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::elementCanUseSimpleDefaultStyle):
+        (WebCore::CSSStyleSelector::CSSStyleSelector):
+        (WebCore::loadFullDefaultStyle):
+        (WebCore::loadSimpleDefaultStyle):
+        (WebCore::loadViewSourceStyle):
+        (WebCore::CSSStyleSelector::matchUARules):
+        (WebCore::CSSStyleSelector::styleForElement):
+
+2008-09-06  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix.
+
+        * WebCoreSources.bkl:
+
+2008-09-06  Antti Koivisto  <antti@apple.com>
+
+        Reverting r35953 which was causing problems on Windows which relies on
+        WebCore timers in nested event loops. r36132 did alternative fix.
+
+        * page/Chrome.cpp:
+        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
+        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
+
+2008-09-06  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix <rdar://problem/6201644>
+        https://bugs.webkit.org/show_bug.cgi?id=20493
+        Crash after OK in dialog box and reloading page in secure mode
+
+        Limited loader only fix since the general timer fix is causing problems on Windows.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::servePendingRequests):
+        (WebCore::Loader::Host::Host):
+        (WebCore::Loader::Host::didFinishLoading):
+        (WebCore::Loader::Host::didFail):
+        (WebCore::Loader::Host::didReceiveData):
+        * loader/loader.h:
+        (WebCore::Loader::Host::processingResource):
+
+2008-09-06  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        The initial Core Text adoption prototype was made by Daniel Fenwick.
+
+        - <rdar://problem/5158514> Add a Core Text-based complex text code path
+
+        Currently the Core Text code path is not used in any configuration.
+
+        * WebCore.xcodeproj/project.pbxproj: Added files.
+        * config.h: Defined WTF_USE_ATSUI and WTF_USE_CORE_TEXT.
+        * platform/graphics/Font.cpp:
+        (WebCore::WidthIterator::advance): Moved the spacingDisabled() test out
+        of the loop.
+        * platform/graphics/GlyphBuffer.h:
+        (WebCore::GlyphBuffer::add): Added this version that takes an advance.
+        * platform/graphics/SimpleFontData.h: Added ATSUI and CORE_TEXT #ifdefs.
+        Added getCTFont() and getCFStringAttributes() and corresponding data
+        members for Core Text.
+        * platform/graphics/mac/CoreTextController.cpp: Added.
+        (WebCore::roundCGFloat): Helper function.
+        (WebCore::ceilCGFloat): Helper function.
+        (WebCore::CoreTextController::CoreTextRun::CoreTextRun):
+        (WebCore::CoreTextController::CoreTextController):
+        (WebCore::CoreTextController::offsetForPosition):
+        (WebCore::CoreTextController::collectCoreTextRuns): Added. Segments the
+        run into subruns as necessary such that each subrun can be rendered with
+        a single font. Also separates out soft hyphens and replaces them with
+        real hyphens, because Core Text does not emit a glyph for soft hyphens.
+        Then calls collectCoreTextRunsForCharacters() on each subrun.
+        (WebCore::CoreTextController::advance):
+        (WebCore::CoreTextController::collectCoreTextRunsForCharacters): Creates
+        a CTLine from the given subrun and collects its CoreTextRuns.
+        (WebCore::CoreTextController::adjustGlyphsAndAdvances): Applies the
+        rounding hacks, letter- and word-spacing and glyph substitutions and
+        stores the resulting adjusted glyphs and advances.
+        * platform/graphics/mac/CoreTextController.h: Copied from WebCore/platform/graphics/win/UniscribeController.h.
+        (WebCore::CoreTextController::totalWidth):
+        (WebCore::CoreTextController::finalRoundingWidth):
+        (WebCore::CoreTextController::CoreTextRun::ctRun):
+        (WebCore::CoreTextController::CoreTextRun::glyphCount):
+        (WebCore::CoreTextController::CoreTextRun::fontData):
+        (WebCore::CoreTextController::CoreTextRun::characters):
+        (WebCore::CoreTextController::CoreTextRun::stringLocation):
+        (WebCore::CoreTextController::CoreTextRun::stringLength):
+        (WebCore::CoreTextController::CoreTextRun::indexAt):
+        * platform/graphics/mac/FontMac.mm: Moved the ATSUI-specific parts to
+        FontMacATSUI.mm.
+        * platform/graphics/mac/FontMacATSUI.mm: Copied from WebCore/platform/graphics/mac/FontMac.mm.
+        (WebCore::disableLigatures): Changed to call
+        FontPlatformData::allowsLigatures().
+        (WebCore::overrideLayoutOperation): Changed to call
+        FontPlatformData::roundsGlyphAdvances().
+        * platform/graphics/mac/FontMacCoreText.cpp: Copied from WebCore/platform/graphics/win/FontWin.cpp.
+        (WebCore::Font::selectionRectForComplexText): Changed to use
+        totalWidth() instead of advancing to the end and using runWidthSoFar().
+        (WebCore::Font::drawComplexText):
+        (WebCore::Font::floatWidthForComplexText): Ditto.
+        (WebCore::Font::offsetForPositionForComplexText):
+        * platform/graphics/mac/FontPlatformData.h:
+        * platform/graphics/mac/FontPlatformDataMac.mm:
+        (WebCore::FontPlatformData::setFont):
+        (WebCore::FontPlatformData::roundsGlyphAdvances): Added. Checks the
+        AppKit rendering mode.
+        (WebCore::FontPlatformData::allowsLigatures): Added. Implements the
+        heuristic that allows ligatures in fonts that do not have a glyph for
+        'a', based on the assumption that such fonts are only used in complex
+        text.
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformInit):
+        (WebCore::SimpleFontData::platformDestroy):
+        (WebCore::SimpleFontData::getCTFont): Added.
+        (WebCore::SimpleFontData::getCFStringAttributes): Added. Caches and
+        returns an attributes dictionary.
+        * platform/text/mac/ShapeArabic.c: Added ATSUI #ifdefs.
+        * platform/text/mac/ShapeArabic.h: Ditto.
+
+2008-09-06  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - make combining mark offsets work in CG text on Windows
+
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs): The old code tried to translate the text
+        matrix, but failed for two reasons: it did not actually change the
+        matrix, and even if it did, CGContextSetTextPosition overwrites the
+        translation values in the text matrix. Instead, just added the
+        translation to the anchor point.
+
+2008-09-05  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Reviewed by Alp Toker.
+
+        https://bugs.webkit.org/show_bug.cgi?id=18346
+        [GTK] Remove build warnings
+
+        Applied some casts, and removed an unused typedef to make the
+        compiler happy, printing less warnings when building.
+
+        * page/gtk/AccessibilityObjectWrapperAtk.cpp:
+        * platform/graphics/gtk/SimpleFontDataPango.cpp:
+        (WebCore::SimpleFontData::containsCharacters):
+        * platform/graphics/gtk/VideoSinkGStreamer.cpp:
+        (webkit_video_sink_set_caps):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+
+2008-09-05  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Build fix for WebKitWin and Chromium
+
+        * platform/FileSystem.h:
+
+2008-09-05  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Try to make Chromium compile with ToT:
+        - Wrap a few places which depend on KJS:: in #if USE(JSC)
+        - Include some windows forward declarations
+
+        * dom/Node.h:
+        * page/Console.h:
+        * page/animation/CompositeAnimation.h:
+        * platform/FileSystem.h:
+        * platform/graphics/Image.h:
+        * platform/text/AtomicString.h:
+        * platform/text/String.cpp:
+        * rendering/style/RenderStyle.h:
+
+2008-09-05  Dave Hyatt  <hyatt@apple.com>
+
+        Add support for runtime switchability of the Aqua look and the native look on Windows.
+        Make RenderThemeWin compile by default even when USE(SAFARI_THEME) is set.
+
+        Reviewed by Adam Roben
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * page/Settings.cpp:
+        (WebCore::Settings::setShouldPaintNativeControls):
+        * page/Settings.h:
+        (WebCore::Settings::shouldPaintNativeControls):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::theme):
+        * rendering/RenderThemeWin.cpp:
+
+2008-09-05  Antti Koivisto  <antti@apple.com>
+
+        Qt build fix.
+
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::build):
+
+2008-09-05  Dirk Schulze  <vbs85@gmx.de>
+
+        Gtk build fix
+
+        * GNUmakefile.am:
+
+2008-09-05  Antti Koivisto  <antti@apple.com>
+
+        Another build fix.
+
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::notifyFinished):
+
+2008-09-05  Antti Koivisto  <antti@apple.com>
+
+        Build fixes.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * svg/graphics/filters/SVGFEImage.cpp:
+        (WebCore::FEImage::cachedImage):
+
+2008-09-05  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Most of the implementation for https://bugs.webkit.org/show_bug.cgi?id=17998
+        When a resource is cached locally, WebKit should follow RFC 2616 "Specific end-to-end revalidation" instead of "Unspecified end-to-end revalidation"
+
+        Implement HTTP 1.1 "Specific end-to-end revalidation" for WebCore memory cache. This patch does
+        not yet enable it for the biggest use case, reloading. However it is good for general browsing as
+        well. Doing this in WebCore level as opposed to relying on disk cache has big benefit that
+        we avoid re-decoding resources, especially images.
+
+        To be exact the enabled case is not actually the "Specific end-to-end revalidation" since it does not include
+        CacheControl: max-age=0 header. That would be added in reload case.
+
+        The approach for revalidation is to kick the original resource out from the memory cache
+        and create a new CachedResource that represents the revalidation request. In case
+        we get 304 back for the request we put the original resource back to the cache, update
+        its expiration date and switch the clients registered to revalidation resource to be
+        clients of the original resource.
+
+        All heap allocated CachedImage pointers now use CachedResourceHandle<CachedImage> (and so on) instead.
+        This allows updating the handles to point to the original resource when the revalidation succeeds. It
+        also acts as refcounting smart pointer.
+
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * css/CSSFontFaceSource.h:
+        * css/CSSImportRule.h:
+        * dom/Clipboard.h:
+        (WebCore::Clipboard::dragImage):
+        * dom/ProcessingInstruction.h:
+        * dom/ScriptElement.h:
+        * dom/XMLTokenizer.cpp:
+        (WebCore::XMLTokenizer::isWaitingForScripts):
+        * dom/XMLTokenizer.h:
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::setImage):
+        (WebCore::HTMLImageLoader::updateFromElement):
+        (WebCore::HTMLImageLoader::notifyFinished):
+        * html/HTMLImageLoader.h:
+        (WebCore::HTMLImageLoader::image):
+        * html/HTMLLinkElement.h:
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::reset):
+        (WebCore::HTMLTokenizer::scriptHandler):
+        (WebCore::HTMLTokenizer::notifyFinished):
+        * html/HTMLTokenizer.h:
+        * loader/Cache.cpp:
+        (WebCore::Cache::revalidateResource):
+        (WebCore::Cache::revalidationSucceeded):
+        (WebCore::Cache::revalidationFailed):
+        * loader/Cache.h:
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::CachedResource):
+        (WebCore::CachedResource::~CachedResource):
+        (WebCore::CachedResource::isExpired):
+        (WebCore::CachedResource::setResponse):
+        (WebCore::CachedResource::deleteIfPossible):
+        (WebCore::CachedResource::setResourceToRevalidate):
+        (WebCore::CachedResource::clearResourceToRevalidate):
+        (WebCore::CachedResource::switchClientsToRevalidatedResource):
+        (WebCore::CachedResource::canUseCacheValidator):
+        (WebCore::CachedResource::mustRevalidate):
+        * loader/CachedResource.h:
+        (WebCore::CachedResource::canDelete):
+        (WebCore::CachedResource::registerHandle):
+        (WebCore::CachedResource::unregisterHandle):
+        (WebCore::CachedResource::isCacheValidator):
+        (WebCore::CachedResource::resourceToRevalidate):
+        (WebCore::CachedResource::setExpirationDate):
+        * loader/CachedResourceHandle.cpp: Added.
+        (WebCore::CachedResourceHandleBase::setResource):
+        * loader/CachedResourceHandle.h: Added.
+        (WebCore::CachedResourceHandleBase::~CachedResourceHandleBase):
+        (WebCore::CachedResourceHandleBase::get):
+        (WebCore::CachedResourceHandleBase::operator!):
+        (WebCore::CachedResourceHandleBase::operator UnspecifiedBoolType):
+        (WebCore::CachedResourceHandleBase::CachedResourceHandleBase):
+        (WebCore::CachedResourceHandleBase::operator=):
+        (WebCore::CachedResourceHandle::CachedResourceHandle):
+        (WebCore::CachedResourceHandle::get):
+        (WebCore::CachedResourceHandle::operator->):
+        (WebCore::CachedResourceHandle::operator=):
+        (WebCore::CachedResourceHandle::operator==):
+        (WebCore::CachedResourceHandle::operator!=):
+        (WebCore::operator==):
+        (WebCore::operator!=):
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::checkForReload):
+        * loader/UserStyleSheetLoader.h:
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::servePendingRequests):
+        (WebCore::Loader::Host::didFinishLoading):
+        (WebCore::Loader::Host::didFail):
+        (WebCore::Loader::Host::didReceiveResponse):
+        (WebCore::Loader::Host::didReceiveData):
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::selectCursor):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::setCachedImage):
+        (WebCore::RenderImage::imageChanged):
+        * rendering/RenderImage.h:
+        (WebCore::RenderImage::cachedImage):
+        (WebCore::RenderImage::imagePtr):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/StyleCachedImage.h:
+        (WebCore::StyleCachedImage::data):
+        (WebCore::StyleCachedImage::cachedImage):
+        * svg/SVGFEImageElement.h:
+        * svg/graphics/filters/SVGFEImage.h:
+        * xml/XSLImportRule.h:
+
+2008-09-04  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Mitz
+
+        <rdar://problem/6180236> - Safari times out connections after 1 or 2 minutes
+
+        A 60-second default timeout was added in http://trac.webkit.org/changeset/17144 in an attempt
+        to model default NSURLRequest behavior in a cross-platform manner.
+
+        Sadly by always enforcing this 60 second timeout, WebCore was stomping over the wishes of any Webkit
+        client that wished to enforce a much larger default timeout using NSURLRequest API.
+
+        Additionally, upon reviewing what all other browsers do, it seems apparent that "no limit" is desirable
+        behavior on the web and this restores previous Safari/WebKit behavior.
+
+        It would be easy to write a layout test for this, but to be effective it would have
+        to run for at least 61 seconds, which seems insane until will can parallelize run-webkit-tests
+
+        * manual-tests/timeout-test.html: Added.
+        * manual-tests/timeout-test.php: Added.
+
+        * platform/network/ResourceRequestBase.h:
+        (WebCore::ResourceRequestBase::ResourceRequestBase):  Rename the constant to "unspecifiedTimeoutInterval"
+          and make it UINT_MAX so platforms that do set it have an effective "no timeout."  (Windows, for example)
+        * platform/network/mac/ResourceRequestMac.mm:
+        (WebCore::ResourceRequest::doUpdatePlatformRequest):  If the timeout for this request is
+          "unspecifiedTimeoutInterval", then don't bother setting the timeout using NSURLRequest API, allowing
+          WebKit applications to enforce their own default timeout.
+
+2008-09-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        - fix <rdar://problem/6198514> Changing a button's opacity triggers relayout
+
+        Test: fast/repaint/button-spurious-layout-hint.html
+
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::setStyle): Reset the inner block's style box
+        flex to 0 to avoid getting a spurious layout hint.
+
+2008-09-04  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes.
+
+        * WebCoreSources.bkl:
+        * bindings/js/ScriptControllerWx.cpp: Added.
+        (WebCore::ScriptController::createScriptInstanceForWidget):
+        * page/wx/AccessibilityObjectWx.cpp: Added.
+        (WebCore::AccessibilityObject::accessibilityIgnoreAttachment):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        * webcore-base.bkl:
+        * webcore-wx.bkl:
+
+2008-09-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        - roll out r36050 because it made svg/custom/invalid-fill-hex.svg fail,
+          and fixing https://bugs.webkit.org/show_bug.cgi?id=15360 appears to
+          require a different approach
+
+        * css/CSSGrammar.y:
+
+2008-09-04  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=20639.
+        Bug 20639: ENABLE_DASHBOARD_SUPPORT does not need to be a FEATURE_DEFINE
+
+        * Configurations/WebCore.xcconfig: Remove ENABLE_DASHBOARD_SUPPORT from FEATURE_DEFINES.
+        * DerivedSources.make: Revert to checking for ENABLE_DASHBOARD_SUPPORT rather than looking
+        for ENABLE_DASHBOARD_SUPPORT in FEATURE_DEFINES.
+
+2008-09-04  Mark Rowe  <mrowe@apple.com>
+
+        Mac build fix.
+
+        * config.h: Only check the value of HAVE_CONFIG_H if it is defined.
+
+2008-09-04  Eric Seidel  <eric@webkit.org>
+
+        Build fix only, no review.
+
+        * dom/XMLTokenizer.cpp: Fix the Chromium merge build by adding a missing header (the Mac files must include it somewhere).
+
+2008-09-04  Marco Barisione  <marco.barisione@collabora.co.uk>
+
+        Reviewed by Eric Seidel.
+
+        http://bugs.webkit.org/show_bug.cgi?id=20380
+        [GTK][AUTOTOOLS] Include autotoolsconfig.h from config.h
+
+        * config.h: Include the configuration header generated by autotools if
+        available.
+
+2008-09-04  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by Dave Hyatt.
+
+        - rename CachedResource::allReferencesRemoved() to allClientsRemoved()
+
+        * loader/CachedFont.cpp:
+        (WebCore::CachedFont::allClientsRemoved):
+        * loader/CachedFont.h:
+        * loader/CachedImage.cpp:
+        (WebCore::CachedImage::allClientsRemoved):
+        * loader/CachedImage.h:
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::removeClient):
+        * loader/CachedResource.h:
+        (WebCore::CachedResource::allClientsRemoved):
+
+2008-09-04  Adam Roben  <aroben@apple.com>
+
+        Windows build fix after r36071
+
+        We were getting these errors:
+
+        error C2356: initialization segment must not change during translation
+        unit
+
+        This was happening because multiple files #included by
+        DerivedSources.cpp were themselves #including StaticConstructors.h. I
+        fixed the error by adding header guards to StaticConstructors.h so its
+        contents will only be included once.
+
+        But it's also not a good idea for StaticConstructors.h to end up in
+        DerivedSources.cpp, since it ends up "polluting" all the source files
+        we have in there. So I removed all the files that include
+        StaticConstructors.h and added some preprocessor directives to
+        DerivedSources.cpp to catch this error in the future.
+
+        * DerivedSources.cpp: Removed the *Names.cpp files, which include
+        StaticConstructors.h, and added some preprocessor directives to make
+        sure we don't end up accidentally including StaticConstructors.h in
+        the future.
+        * WebCore.vcproj/WebCore.vcproj: Added the *Names.cpp files.
+        * platform/StaticConstructors.h: Added header guards.
+
+2008-09-04  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * platform/graphics/win/FontPlatformData.h: Added a missing #include
+        of PassRefPtr.h, and corrected the capitalization of RefCounted.h.
+        * platform/text/PlatformString.h: Added a missing #include of
+        PassRefPtr.h.
+
+2008-09-04  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix the QtWebKit build to match changes in r36016
+
+        * WebCore.pro:
+        * bridge/qt/qt_instance.cpp:
+        (KJS::Bindings::QtInstance::getRuntimeObject):
+        * bridge/qt/qt_runtime.cpp:
+        (KJS::Bindings::convertQVariantToValue):
+        (KJS::Bindings::QtConnectionObject::execute):
+
+2008-09-04  Tor Arne Vestbø  <tavestbo@trolltech.com>
+
+        Reviewed by Simon.
+
+        Re-enable support for user stylesheets in QtWebKit
+
+        QtWebKit now follows the FRAME_LOADS_USER_STYLESHEET
+        code path, which allows us to keep API support for
+        loading user style sheets from remote URLs.
+
+        As part of the change UserStyleSheetLoader.cpp/h was
+        moved from WebCore/loader/mac to WebCore/loader.
+
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/Document.h:
+        * loader/UserStyleSheetLoader.cpp: Renamed from WebCore/loader/mac/UserStyleSheetLoader.cpp.
+        (UserStyleSheetLoader::UserStyleSheetLoader):
+        (UserStyleSheetLoader::~UserStyleSheetLoader):
+        * loader/UserStyleSheetLoader.h: Renamed from WebCore/loader/mac/UserStyleSheetLoader.h.
+        * page/qt/FrameQt.cpp:
+        (WebCore::Frame::setUserStyleSheetLocation):
+        (WebCore::Frame::setUserStyleSheet):
+
+2008-09-04  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Eric.
+
+        Remove left-over QT and CAIRO platform checks.
+
+        * html/CanvasRenderingContext2D.cpp:
+
+2008-09-04  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix leak of TextMetrics due to over-ref as see on buildbot.
+
+        * html/TextMetrics.h: use adoptRef since RefCounted starts @ refcount 1 instead of 0 now.
+
+2008-09-04  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=19717
+          <rdar://problem/6026832> REGRESSION (r31876): menu items render horizontally at the Economist
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutOnlyPositionedObjects): In the
+        positioned movement only case, call
+        tryLayoutDoingPositionedMovementOnly() and fall back on doing a full
+        layout if that fails.
+        (WebCore::RenderBlock::layoutPositionedObjects): Ditto.
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::tryLayoutDoingPositionedMovementOnly): Renamed
+        layoutDoingPositionedMovementOnly to this, and made this function
+        check if the width changed. If it did, return, leaving the object
+        dirty. The caller can then call layout(). The width can change even
+        in the "positioned movement only" case if the object is shrink-to-fit
+        and the available width constraint is met. (This was the case in the
+        bug).
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::tryLayoutDoingPositionedMovementOnly):
+        Renamed layoutDoingPositionedMovementOnly() to this.
+
+2008-09-03  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        Attempt to fix the Qt build.
+
+        * WebCore.pro: add page/animation to include path
+
+2008-09-03  Mark Rowe  <mrowe@apple.com>
+
+        Mac build fix.  Correctly detect whether dashboard support is enabled.
+
+        * DerivedSources.make:
+
+2008-09-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Clean up Platform.h and add PLATFORM(CHROMIUM), PLATFORM(SKIA) and USE(V8_BINDINGS)
+
+        * Configurations/WebCore.xcconfig: add missing ENABLE_*
+        * config.h: add rules for V8_BINDINGS
+
+2008-09-03  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20620
+
+        Add #if USE(JSC) around KJS dependencies
+        Remove !USE(JAVASCRIPTCORE_BINDINGS) support for 3 reasons:
+        1. Most platforms have it on anyway
+        2. V8 is going to want to share some of that code
+        3. Those platforms which want it off, should have a separate file instead of an #ifdef in our .cpp
+
+        * bindings/js/JSPluginElementFunctions.cpp: remove !USE(JAVASCRIPTCORE_BINDINGS) support
+        * config.h: change JAVASCRIPTCORE_BINDINGS to JSC and add USE(V8)
+        * html/HTMLAppletElement.cpp: remove USE(JAVASCRIPTCORE_BINDINGS) wrappers
+        * html/HTMLAppletElement.h: remove USE(JAVASCRIPTCORE_BINDINGS) wrappers
+        * html/HTMLEmbedElement.cpp: remove USE(JAVASCRIPTCORE_BINDINGS) wrappers
+        * html/HTMLEmbedElement.h: remove USE(JAVASCRIPTCORE_BINDINGS) wrappers
+        * html/HTMLObjectElement.cpp: remove USE(JAVASCRIPTCORE_BINDINGS) wrappers
+        * html/HTMLObjectElement.h: remove USE(JAVASCRIPTCORE_BINDINGS) wrappers
+        * html/HTMLPlugInElement.cpp: replace USE(JAVASCRIPTCORE_BINDINGS) with USE(JSC) where needed
+        * html/HTMLPlugInElement.h: replace USE(JAVASCRIPTCORE_BINDINGS) with USE(JSC) where needed
+        * platform/text/AtomicString.cpp: add USE(JSC)
+        * platform/text/AtomicString.h: add USE(JSC)
+        * platform/text/PlatformString.h: add USE(JSC)
+        * platform/text/String.cpp: add USE(JSC)
+        * platform/text/StringImpl.cpp: add USE(JSC)
+        * platform/text/StringImpl.h: add USE(JSC)
+
+2008-09-03  Dean McNamee  <deanm@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=20511
+        Bug 20511: Remove static initializers on Windows
+
+        Avoid static initializers on Windows by forcing Visual C++ to put
+        all static initializers in a code segment that is never executed.
+
+        * config.h:
+        * css/MediaFeatureNames.cpp:
+        * dom/EventNames.cpp:
+        * dom/QualifiedName.cpp:
+        * dom/make_names.pl:
+        * platform/StaticConstructors.h:
+        * platform/text/AtomicString.cpp:
+
+2008-09-03  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by Dave Hyatt.
+
+        Make FontCairo draw TextStroke and TextFill separately.
+
+        [CAIRO] draw TextFill and TextStroke separately.
+        [https://bugs.webkit.org/show_bug.cgi?id=20631]
+
+        * platform/graphics/cairo/FontCairo.cpp:
+        (WebCore::Font::drawGlyphs):
+
+2008-09-03  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19663
+        Account for paint and timer lag when animating images.  Also pretend
+        that images whose animations were paused (by becoming invisible)
+        continued to animate, by "catching up" to the correct frame when they're
+        shown again.
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::BitmapImage):
+        (WebCore::BitmapImage::startAnimation):
+        (WebCore::BitmapImage::advanceAnimation):
+        (WebCore::BitmapImage::internalAdvanceAnimation):
+        (WebCore::BitmapImage::notifyObserverAndTrimDecodedData):
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::draw):
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::draw):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::BitmapImage::draw):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::BitmapImage::draw):
+
+2008-09-03  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        Remove the rest of the "zombie" code from the profiler.
+        - There is no longer a need for the ProfilerClient callback mechanism.
+
+        * page/Console.cpp:
+        (WebCore::Console::Console):
+        (WebCore::Console::profile):
+        (WebCore::Console::profileEnd): Move the variables from the header to
+        here since we don't have to wait for a callback to use them.
+        * page/Console.h:
+        * page/InspectorController.cpp:
+        (WebCore::InspectorController::startUserInitiatedProfiling):
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+        * page/InspectorController.h:
+
+2008-09-03  Ada Chan  <adachan@apple.com>
+
+        Windows build fix.
+
+        * WebCore.vcproj/WebCore.vcproj: Added JSWebKitCSSKeyframeRule.cpp and JSWebKitCSSKeyframesRule.cpp to the project.
+
+2008-09-01  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20594
+        Add DOM interfaces for WebKitCSSKeyframeRule
+        and WebKitCSSKeyframesRule.
+
+        TEST: LayoutTests/css3/keyframes-rule.html
+
+        * css/WebKitCSSKeyframeRule.idl: Added
+        * css/WebKitCSSKeyframesRule.idl: Added
+
+        * bindings/js/JSCSSRuleCustom.cpp:
+        (WebCore::toJS):
+            Add return of new JS Keyframe rules
+        * bindings/objc/DOMInternal.h:
+            Include new internal header
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+            Build configs for new files
+
+2008-09-03  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * DerivedSources.cpp: Add JSTextMetrics.cpp to fix the build.
+        * WebCore.vcproj/WebCore.vcproj: Add JSTextMetrics.h for
+        convenience/consistency.
+
+2008-09-03  Adele Peterson  <adele@apple.com>
+
+        Build fix.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2008-09-03  David Hyatt  <hyatt@apple.com>
+
+        Fix for bug 18203, right floats should be allowed to overflow past the left border edge.
+
+        Reviewed by Darin (ages ago)
+
+        Added fast/block/float/clamped-right-float.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::positionNewFloats):
+
+2008-09-02  David Hyatt  <hyatt@apple.com>
+
+        Add support for canvas text drawing APIs.
+
+        Reviewed by olliej
+
+        Tests added as fast/canvas/canvas-text-*.html
+
+        * DerivedSources.make:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext2D::fillText):
+        (WebCore::JSCanvasRenderingContext2D::strokeText):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::initForStyleResolve):
+        (WebCore::CSSStyleSelector::applyPropertyToStyle):
+        * css/CSSStyleSelector.h:
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::State::State):
+        (WebCore::CanvasRenderingContext2D::font):
+        (WebCore::CanvasRenderingContext2D::setFont):
+        (WebCore::CanvasRenderingContext2D::textAlign):
+        (WebCore::CanvasRenderingContext2D::setTextAlign):
+        (WebCore::CanvasRenderingContext2D::textBaseline):
+        (WebCore::CanvasRenderingContext2D::setTextBaseline):
+        (WebCore::CanvasRenderingContext2D::fillText):
+        (WebCore::CanvasRenderingContext2D::strokeText):
+        (WebCore::CanvasRenderingContext2D::measureText):
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        (WebCore::CanvasRenderingContext2D::accessFont):
+        * html/CanvasRenderingContext2D.h:
+        * html/CanvasRenderingContext2D.idl:
+        * html/TextMetrics.h: Added.
+        (WebCore::TextMetrics::create):
+        (WebCore::TextMetrics::width):
+        (WebCore::TextMetrics::setWidth):
+        (WebCore::TextMetrics::TextMetrics):
+        * html/TextMetrics.idl: Added.
+        * platform/graphics/Font.cpp:
+        (WebCore::Font::lineGap):
+        * platform/graphics/Font.h:
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::drawBidiText):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/GraphicsTypes.cpp:
+        (WebCore::textAlignName):
+        (WebCore::parseTextAlign):
+        (WebCore::textBaselineName):
+        (WebCore::parseTextBaseline):
+        * platform/graphics/GraphicsTypes.h:
+        (WebCore::):
+
+2008-09-03  John Sullivan  <sullivan@apple.com>
+
+        Fixed <rdar://problem/6193022> <rdar://problem/6193022> Crash occurs at WebCore::AnimationBase::propertiesEqual () after certain steps
+
+        Fixed by Darin, reviewed by me
+
+        * page/animation/AnimationBase.cpp:
+        (WebCore::AnimationBase::propertiesEqual):
+        added ensurePropertyMap() to this static function
+        (WebCore::AnimationBase::getPropertyAtIndex):
+        ditto
+        (WebCore::AnimationBase::getNumProperties):
+        ditto
+
+2008-09-03  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Darin and Tim.
+
+        Remove most of the "zombie" mode from the profiler.  Next we will need
+        to remove the client callback mechanism in profiles.
+        - These changes are a result of changes to JSCore.
+
+        * manual-tests/inspector/profiler-test-nested-start-and-stop-profiler.html:
+        * page/Console.cpp:
+        (WebCore::retrieveLastCaller):
+        (WebCore::Console::profileEnd):
+        * page/InspectorController.cpp:
+        (WebCore::InspectorController::stopUserInitiatedProfiling):
+
+2008-09-03  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Test: fast/forms/search-display-none-cancel-button.html
+
+        Allow display:none to work on a search field's cancel button.  Prepare for adding more style-ability for the results button too.
+
+        * css/html4.css: Set display:inline-block for these buttons.  Now they can be overridden by a web author.
+
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::setStyle): Add nil checks for the button renderers.
+        (WebCore::RenderTextControl::createResultsButtonStyle): Don't set the display explicitly.  This is now done in html4.css.
+        (WebCore::RenderTextControl::createCancelButtonStyle): ditto.
+        (WebCore::RenderTextControl::createSubtreeIfNeeded):
+        Reorganize this code so our complicated way of adding shadow nodes is abstracted out into the TextControlInnerElement class.
+        (WebCore::RenderTextControl::updateFromElement): Added nil checks for the button renderers.
+        (WebCore::RenderTextControl::subtreeHasChanged): ditto.
+        (WebCore::RenderTextControl::calcHeight): ditto.
+        (WebCore::RenderTextControl::nodeAtPoint): ditto.
+        (WebCore::RenderTextControl::layout): ditto.
+        (WebCore::RenderTextControl::calcPrefWidths): ditto.
+        (WebCore::RenderTextControl::clientPaddingLeft): ditto.
+        (WebCore::RenderTextControl::clientPaddingRight): ditto.
+
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::RenderTextControlInnerBlock::RenderTextControlInnerBlock): Moved from RenderTextControl.cpp.
+        (WebCore::RenderTextControlInnerBlock::nodeAtPoint): ditto.
+        (WebCore::TextControlInnerElement::attachInnerElement): Added.
+         This does all the separate steps of attaching a shadow node that used to be repeated in RenderTextControl::createSubtreeIfNeeded for each element.
+        (WebCore::TextControlInnerTextElement::createRenderer): Added.  Creates a RenderTextControlInnerBlock.
+        * rendering/TextControlInnerElements.h:
+
+2008-08-28  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Maciej.
+
+        Elminate SQLiteAuthorizer class.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCore.vcproj/WebCore.vcproj:
+        * GNUmakefile.am
+        Removed SQLiteAuthorizer.h.
+
+        * platform/sql/SQLiteAuthorizer.cpp:
+        * platform/sql/SQLiteAuthorizer.h: Removed.
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::authorizerFunction):
+        (WebCore::SQLiteDatabase::setAuthorizer):
+        * platform/sql/SQLiteDatabase.h:
+        * storage/DatabaseAuthorizer.h:
+        (WebCore::DatabaseAuthorizer::create):
+        (WebCore::DatabaseAuthorizer::createView):
+        (WebCore::DatabaseAuthorizer::createTempView):
+        (WebCore::DatabaseAuthorizer::dropView):
+        (WebCore::DatabaseAuthorizer::dropTempView):
+        (WebCore::DatabaseAuthorizer::allowSelect):
+        (WebCore::DatabaseAuthorizer::allowReindex):
+        Merge SQLiteAuthorizer and DatabaseAuthorizer, as keeping them separate serves no purpose.
+
+2008-09-03  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by Mark Rowe.
+
+        WebKitGtk build fix.
+
+        * GNUmakefile.am:
+        * page/animation/AnimationController.h:
+
+2008-09-02  Robert Blaut  <webkit@blaut.biz>
+
+        Reviewed by Geoff Garen.
+
+        Fix for <https://bugs.webkit.org/show_bug.cgi?id=16913>
+        Misplaced elements should not close DL lists.
+
+        Test: fast/invalid/test-case-tr-th-td-should-not-close-dl-list.html
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleError):
+
+2008-09-02  Glenn Wilson  <wilsong@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <https://bugs.webkit.org/show_bug.cgi?id=15360>
+        Bug 15360: color:#{predefined colorName} is treated as colorName in Safari
+
+        We would inappropriately interpret and apply an invalid CSS "color" property
+        when the value is a predefined color preceded by a '#' symbol.  For example,
+        style="color:#gray;" would apply the color gray when it should not.
+
+        In the bison template, "hexcolor" was defined as both "HEX maybe_space" OR "IDENT maybe_space".
+        This caused identifiers not fitting the appropriate hex format but preceded by a '#' to be
+        interpreted as a valid color (CSSPrimitiveValue::CSS_PARSER_HEXCOLOR), when it was really just
+        an ignorable token.
+
+        To correct this, "IDENT maybe_space" was removed from "hexcolor" and added under "term" as
+        '#' IDENT maybe_space, which is then processed as a CSSPrimitiveValue::CSS_STRING instead of
+        CSSPrimitiveValue::CSS_PARSER_HEXCOLOR.
+
+        Test: css1/color_and_background/invalid_color.html
+
+        * css/CSSGrammar.y:
+
+2008-09-02  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=19964
+        Bug 19964: Divide by zero crash in RenderBox::calculateBackgroundSize with 0,0 bmp background image
+
+        Add a check to RenderBox::repaintLayerRectsForImage to make sure the current layer image can be rendered.
+
+        Test: css3/khtml-background-size-0x0-bmp.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::repaintLayerRectsForImage):
+
+2008-09-02  Glenn Wilson  <wilsong@gmail.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=20397
+        Bug 20397: Invalid webkit-border-bottom-left-radius property causes crash
+
+        The function checkForOrphanedUnits() would change the length of a list whose size was
+        was already determined before the call to checkForOrphanedUnits was made.  Later in
+        the caller, the old size was being used for boundary management.
+
+        This has been fixed by moving the call to checkForOrphanedUnits() earlier in the
+        calling function, before the size of the list is determined.
+
+        Test: fast/css/orphaned_units_crash.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):  Moved call to checkForOrphanedUnits() earlier in the function.
+
+2008-09-02  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by Darin Adler.
+
+        Fallback on invalid fill or stroke styles in Canvas was
+        transparent black. Changed it to last valid style.
+
+        Canvas fillStyle() and strokeStyle() needs fallback
+        https://bugs.webkit.org/show_bug.cgi?id=20474
+
+        Tests: fast/canvas/canvas-invalid-fillstyle.html
+               fast/canvas/canvas-invalid-strokestyle.html
+
+        * html/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyStrokeColor):
+        (WebCore::CanvasStyle::applyFillColor):
+
+2008-09-02  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by Darin Adler.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=20468
+        Updated drawImage() in canvas to match the current specification.
+
+        Test: fast/canvas/drawImage-with-negative-source-destination.html
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::normalizeRect):
+        (WebCore::CanvasRenderingContext2D::drawImage):
+
+2008-08-26  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/5768210> Switch back to the system version of SQLite
+
+        Use the system version of SQLite when it is new enough to provide the functionality
+        that WebCore requires.
+
+        * Configurations/Base.xcconfig:
+        * Configurations/DebugRelease.xcconfig:
+        * Configurations/WebCore.xcconfig:
+
+2008-09-02  Dan Bernstein  <mitz@apple.com>
+
+        - build fix
+
+        * page/animation/AnimationBase.h:
+
+2008-09-02  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        AnimationController.cpp should be split into separate files
+        https://bugs.webkit.org/show_bug.cgi?id=20604
+
+        Note: All makefiles, except WebCore.xcodeproj have been changed without testing, upon
+        recommendation of Dave Hyatt.
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+            Build files.
+
+        * page/AnimationController.cpp: Removed.
+        * page/AnimationController.h: Removed.
+        * page/animation: Added.
+        * page/animation/AnimationBase.cpp: Added.
+        * page/animation/AnimationBase.h: Added.
+        * page/animation/AnimationController.cpp: Copied from WebCore/page/AnimationController.cpp.
+        * page/animation/AnimationController.h: Copied from WebCore/page/AnimationController.h.
+        * page/animation/CompositeAnimation.cpp: Added.
+        * page/animation/CompositeAnimation.h: Added.
+        * page/animation/ImplicitAnimation.cpp: Added.
+        * page/animation/ImplicitAnimation.h: Added.
+        * page/animation/KeyframeAnimation.cpp: Added.
+        * page/animation/KeyframeAnimation.h: Added.
+
+2008-09-02  Dan Bernstein  <mitz@apple.com>
+
+        - release build fix
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::calculateDrawingMode):
+
+2008-09-02  Timothy Hatcher  <timothy@apple.com>
+
+        Make console functions log the correct resource URL and
+        line number for where the call originated.
+
+        https://bugs.webkit.org/show_bug.cgi?id=17234
+        <rdar://problem/5732837>
+
+        Reviewed by Kevin McCullough.
+
+        Test: manual-tests/inspector/console-call-line-numbers.html
+
+        * bindings/js/JSConsoleCustom.cpp:
+        (WebCore::JSConsole::count): Call the impl.
+        (WebCore::JSConsole::timeEnd): Ditto.
+        * manual-tests/inspector/console-call-line-numbers.html: Added.
+        * manual-tests/inspector/resources/script-console-calls.js: Added.
+        * page/Console.cpp:
+        (WebCore::retrieveLastCaller): Helper to get the URL and line.
+        (WebCore::Console::error): Call retrieveLastCaller to get the URL and
+        line number to pass to addMessageToConsole.
+        (WebCore::Console::info): Ditto.
+        (WebCore::Console::log): Ditto.
+        (WebCore::Console::assertCondition): Ditto.
+        (WebCore::Console::count): Ditto.
+        (WebCore::Console::timeEnd): Ditto.
+        (WebCore::Console::warn): Ditto.
+        * page/Console.h:
+        * page/Console.idl: Make count and timeEnd custom.
+
+2008-09-02  Timothy Hatcher  <timothy@apple.com>
+
+        Removed IDL files from WebCore's framework resources.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2008-09-02  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - <rdar://problem/5681647> pages at http://www.stendmarsofa.com/ are so slow to calculate style it seems like a hang
+
+        * html/HTMLParser.cpp:
+        (WebCore::HTMLParser::handleResidualStyleCloseTagAcrossBlocks): Added a
+        cap on the number of consecutive identical residual style tags to
+        reopen.
+        (WebCore::HTMLParser::popBlock): Ditto.
+
+2008-09-02  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        A little database quota management cleanup.
+
+        * storage/OriginQuotaManager.cpp:
+        (WebCore::OriginQuotaManager::OriginQuotaManager):
+        (WebCore::OriginQuotaManager::lock):
+        (WebCore::OriginQuotaManager::unlock):
+        (WebCore::OriginQuotaManager::trackOrigin):
+        (WebCore::OriginQuotaManager::tracksOrigin):
+        (WebCore::OriginQuotaManager::addDatabase):
+        (WebCore::OriginQuotaManager::removeDatabase):
+        (WebCore::OriginQuotaManager::removeOrigin):
+        (WebCore::OriginQuotaManager::markDatabase):
+        (WebCore::OriginQuotaManager::diskUsage):
+        * storage/OriginQuotaManager.h:
+        Changed to assert that a lock is taken more directly and reliably. Removed comments about
+        main/background threads, as this is likely to stop being true with synchronous Database calls
+        being made on worker threads.
+
+        * storage/OriginUsageRecord.cpp:
+        (WebCore::OriginUsageRecord::OriginUsageRecord):
+        (WebCore::OriginUsageRecord::addDatabase):
+        (WebCore::OriginUsageRecord::removeDatabase):
+        (WebCore::OriginUsageRecord::markDatabase):
+        (WebCore::OriginUsageRecord::diskUsage):
+        * storage/OriginUsageRecord.h:
+        (WebCore::OriginUsageRecord::DatabaseEntry::DatabaseEntry):
+        Don't use a magic value for unknown. It is totally unnecessary for DatabaseEntry, and
+        can be replaced with a single boolean for OriginUsageRecord.
+        Added assertions for string parameters being unshared.
+
+
+2008-09-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19760
+
+        Make granting LoadLocalResources conditional on a policy.
+
+        * WebCore.base.exp:
+        * dom/Document.cpp:
+        (WebCore::Document::initSecurityContext):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::setLocalLoadPolicy):
+        (WebCore::FrameLoader::restrictAccessToLocal):
+        * loader/FrameLoader.h:
+        (WebCore::FrameLoader::):
+        * platform/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::grantLoadLocalResources):
+        * platform/SecurityOrigin.h:
+
+2008-09-01  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20571
+        Make sure Window object can assign Animation/Transition event
+        listeners via attributes.
+
+        Also added a bunch of transition event tests, although
+        only transition-end-event-window is directly relevant to this patch.
+
+        (WebCore::JSDOMWindowBase::put):
+
+        Tests: transitions/transition-end-event-all-properties.html
+               transitions/transition-end-event-attributes.html
+               transitions/transition-end-event-container.html
+               transitions/transition-end-event-left.html
+               transitions/transition-end-event-multiple-01.html
+               transitions/transition-end-event-multiple-02.html
+               transitions/transition-end-event-multiple-03.html
+               transitions/transition-end-event-multiple-04.html
+               transitions/transition-end-event-nested.html
+               transitions/transition-end-event-transform.html
+               transitions/transition-end-event-window.html
+
+2008-09-01  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Sam Weinig
+
+        Code styling cleanup.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::getValueProperty):
+        (WebCore::JSDOMWindowBase::put):
+
+2008-09-01  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+
+        First cut at inline caching for access to vanilla JavaScript properties.
+
+        Updated for JavaScriptCore changes. Mostly mechanical addition of StructureIDs
+        to WebCore classes, and PutPropertySlot& arguments to put functions.
+
+        (WebCore::JSCSSStyleDeclaration::customPut): Be sure to play nice with
+        inline caching for global properties, so global assignment can be optimized.
+
+        * ForwardingHeaders/kjs/StructureID.h: Added.
+        * bindings/js/JSDOMBinding.h:
+        (WebCore::DOMObject::DOMObject):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::put):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSDOMWindowCustom.h:
+        (WebCore::JSDOMWindow::customPut):
+        * bindings/js/JSDOMWindowShell.cpp:
+        (WebCore::JSDOMWindowShell::JSDOMWindowShell):
+        (WebCore::JSDOMWindowShell::put):
+        * bindings/js/JSDOMWindowShell.h:
+        * bindings/js/JSEventTargetBase.h:
+        (WebCore::JSEventTargetBase::put):
+        * bindings/js/JSEventTargetNode.h:
+        (WebCore::JSEventTargetNode::put):
+        * bindings/js/JSHTMLAppletElementCustom.cpp:
+        (WebCore::JSHTMLAppletElement::customPut):
+        * bindings/js/JSHTMLEmbedElementCustom.cpp:
+        (WebCore::JSHTMLEmbedElement::customPut):
+        * bindings/js/JSHTMLInputElementBase.cpp:
+        (WebCore::JSHTMLInputElementBase::put):
+        * bindings/js/JSHTMLInputElementBase.h:
+        * bindings/js/JSHTMLObjectElementCustom.cpp:
+        (WebCore::JSHTMLObjectElement::customPut):
+        * bindings/js/JSHistoryCustom.cpp:
+        (WebCore::JSHistory::customPut):
+        * bindings/js/JSInspectedObjectWrapper.cpp:
+        (WebCore::JSInspectedObjectWrapper::wrap):
+        (WebCore::JSInspectedObjectWrapper::JSInspectedObjectWrapper):
+        * bindings/js/JSInspectedObjectWrapper.h:
+        * bindings/js/JSInspectorCallbackWrapper.cpp:
+        (WebCore::JSInspectorCallbackWrapper::wrap):
+        (WebCore::JSInspectorCallbackWrapper::JSInspectorCallbackWrapper):
+        * bindings/js/JSInspectorCallbackWrapper.h:
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::customPut):
+        * bindings/js/JSPluginElementFunctions.cpp:
+        (WebCore::runtimeObjectCustomPut):
+        * bindings/js/JSPluginElementFunctions.h:
+        * bindings/js/JSQuarantinedObjectWrapper.cpp:
+        (WebCore::JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper):
+        (WebCore::JSQuarantinedObjectWrapper::put):
+        * bindings/js/JSQuarantinedObjectWrapper.h:
+        * bindings/js/JSStorageCustom.cpp:
+        (WebCore::JSStorage::customPut):
+        * bindings/objc/WebScriptObject.mm:
+        (-[WebScriptObject setValue:forKey:]):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bridge/NP_jsobject.cpp:
+        (_NPN_SetProperty):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::setMember):
+        * bridge/objc/objc_class.mm:
+        (KJS::Bindings::ObjcClass::fallbackObject):
+        * bridge/objc/objc_runtime.h:
+        * bridge/objc/objc_runtime.mm:
+        (ObjcFallbackObjectImp::ObjcFallbackObjectImp):
+        (ObjcFallbackObjectImp::put):
+        * bridge/runtime.cpp:
+        (KJS::Bindings::Instance::createRuntimeObject):
+        * bridge/runtime_array.cpp:
+        (RuntimeArray::put):
+        * bridge/runtime_array.h:
+        * bridge/runtime_object.cpp:
+        (RuntimeObjectImp::RuntimeObjectImp):
+        (RuntimeObjectImp::put):
+        * bridge/runtime_object.h:
+
+2008-09-01  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by Eric Seidel.
+
+        Fixed border-radius for Cairo.
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::strokeArc):
+
+2008-09-01  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by Eric Seidel.
+
+        Added canvas's globalAlpha to cairo.
+
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::setAlpha):
+        (WebCore::GraphicsContext::getAlpha):
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+        (WebCore::GraphicsContextPlatformPrivate::GraphicsContextPlatformPrivate):
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::draw):
+
+2008-08-31  Simon Hausmann  <hausmann@webkit.org>
+
+        Unreviewed Qt build fix.
+
+        * WebCore.pro: Add TextControlInnerElements.cpp to SOURCES instead of
+        the .h file
+
+2008-08-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Maciej.
+
+        - adopt some new JavaScriptCore functions where appropriate
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::windowProtoFuncAToB): Adopted jsEmptyString.
+        (WebCore::windowProtoFuncBToA): Ditto.
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSLazyEventListener::eventParameterName): Adopted
+        jsNontrivialString.
+        * bindings/js/JSSVGLazyEventListener.cpp:
+        (WebCore::JSSVGLazyEventListener::eventParameterName): Ditto.
+
+2008-08-29  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Anders' rubberstamp
+
+        Style cleanup to match MediaTokenizer::writeRawData()
+
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginTokenizer::writeRawData):
+
+2008-08-29  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Anders
+
+        https://bugs.webkit.org/show_bug.cgi?id=20556
+        <rdar://problem/6181817> REGRESSION (r35946): media/video-click-dlbclick-standalone.html [sic] fails because load never fires
+
+        Fix regression I introducted in 35946
+        Already covered by media/video-click-dlbclick-standalone.html
+
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaTokenizer::createDocumentStructure): Don't cancel the load here - too early!
+        (WebCore::MediaTokenizer::writeRawData): Call finish() here so onload() can be called.  Also add
+          an ASSERT signifying that this method should only be called once, to more closely follow the
+          PluginDocument case.
+
+2008-08-29  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for <rdar://problem/6181588>
+
+        This patch makes hit testing take into account the new concept of a
+        disconnected frame, in which some of the content may not be
+        visible. The current hit testing mechanism starts at a target frame
+        and drills down for a HitTestResult. In some cases, drilling down
+        will find a non-visible result. When this happens, we need to try
+        again, starting at a higher level -- namely, starting at the main
+        frame.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::insideVisibleArea): New function that tests if a
+        point is inside the visible area for a disconnected frame.
+        * editing/Editor.h:
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::hitTestResultAtPoint):
+
+2008-08-29  Adele Peterson  <adele@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Rename HTMLTextFieldInnerElement.h/.cpp to TextControlInnerElements.h/.cpp
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/HTMLTextFieldInnerElement.cpp: Removed.
+        * html/HTMLTextFieldInnerElement.h: Removed.
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::createSubtreeIfNeeded):
+        * rendering/RenderTextControl.h:
+        * rendering/TextControlInnerElements.cpp: Copied from html/HTMLTextFieldInnerElement.cpp.
+        (WebCore::TextControlInnerElement::TextControlInnerElement):
+        (WebCore::TextControlInnerTextElement::TextControlInnerTextElement):
+        (WebCore::TextControlInnerTextElement::defaultEventHandler):
+        (WebCore::SearchFieldResultsButtonElement::SearchFieldResultsButtonElement):
+        (WebCore::SearchFieldResultsButtonElement::defaultEventHandler):
+        (WebCore::SearchFieldCancelButtonElement::SearchFieldCancelButtonElement):
+        (WebCore::SearchFieldCancelButtonElement::defaultEventHandler):
+        * rendering/TextControlInnerElements.h: Copied from html/HTMLTextFieldInnerElement.h.
+
+2008-08-29  Eric Seidel  <eric@webkit.org>
+
+        Rubber-stamped by aroben.
+
+        Add GraphicsContext.h include to GraphcisContextPrivate.h
+
+        GraphicsContextPrivate uses StrokeStyle which is defined
+        in GraphicsContext.h but it doesn't include that header.
+        CoreGraphics build doesn't fail here due to the order
+        it happens to include files.
+
+        * platform/graphics/GraphicsContextPrivate.h:
+
+2008-08-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by hyatt.
+
+        Fix GeneratedImage to respect Image's refcounting
+        Fixing potential crashers (future if not current)
+        https://bugs.webkit.org/show_bug.cgi?id=20567
+
+        I don't know if it's possible to make the current code
+        crash, thus I've not made a test.
+
+        * css/CSSGradientValue.cpp:
+        (WebCore::CSSGradientValue::image):
+        * css/CSSImageGeneratorValue.cpp:
+        (WebCore::CSSImageGeneratorValue::removeClient):
+        (WebCore::CSSImageGeneratorValue::getImage):
+        * css/CSSImageGeneratorValue.h:
+        * platform/graphics/GeneratedImage.h:
+        (WebCore::GeneratedImage::GeneratedImage):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::setContent):
+        * rendering/style/RenderStyle.h:
+
+2008-08-29  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adele.
+
+        Fix for <rdar://problem/6093767>
+        https://bugs.webkit.org/show_bug.cgi?id=20526
+
+        Don't allow video to render until unsupported track types have been disabled.
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWinPrivate::task):
+        (QTMovieWinPrivate::drawingComplete):
+        (QTMovieWinPrivate::clearGWorld):
+
+2008-08-29  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adele.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=20525
+        <rdar://problem/6169301>
+
+        Return the size of the movie data instead of 1000.
+
+        Test: media/progress-event-total.html
+
+        * platform/graphics/win/QTMovieWin.cpp:
+        (QTMovieWin::dataSize):
+
+2008-08-29  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Eric Seidel.
+
+        [janitor/qt] Start replacing port specific getters with the generic native getter
+        To get the native presentation of an image we currently have platform
+        specific #ifdef's and a generic getter using NativeImagePtr. This patch
+        extends this to the ImageBuffer and updates the Qt platform to get rid
+        of the special #ifdefs.
+
+        https://bugs.webkit.org/attachment.cgi?id=22861
+
+        * platform/graphics/BitmapImage.h:
+        * platform/graphics/Image.h:
+        * platform/graphics/qt/ImageQt.cpp:
+        * platform/graphics/qt/StillImageQt.cpp:
+        * platform/graphics/qt/StillImageQt.h:
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::createDragImage):
+        (WebCore::ClipboardQt::declareAndWriteDragImage):
+        * platform/qt/CursorQt.cpp:
+        * platform/qt/PasteboardQt.cpp:
+        (WebCore::Pasteboard::writeImage):
+
+2008-08-29  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon.
+
+        [svg/qt] Stop crashing... when no RenderPath/RenderObject is given...
+
+        * svg/graphics/qt/SVGPaintServerQt.cpp:
+        (WebCore::SVGPaintServer::renderPath):
+        * svg/graphics/qt/SVGPaintServerSolidQt.cpp:
+        (WebCore::SVGPaintServerSolid::setup):
+
+2008-08-29  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon.
+
+        [network/qt] Implement defering of loading ResourceHandle's
+        This is needed otherwise we end in an ASSERT in the MainResourceLoader. The
+        implementation is simply not forwarding anything to the
+        ResourceHandleClient until we are allowed to. This might lead to a deadlock
+        in Qt as we do not empty the QNetworkReply input buffer and wait until we
+        are allowed to read. If that happens we are forced to buffer the data
+        within QNetworkReplyHandler, for now this is not done.
+
+        Manual test:
+        - Open http://acid3.acidtests.org
+        - Wait for the test to complete
+        - Click on the Reference Rendering link
+        - Be fast and see the results of acid3
+        => assert
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::setLoadMode):
+        (WebCore::QNetworkReplyHandler::finish):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        (WebCore::QNetworkReplyHandler::forwardData):
+        (WebCore::QNetworkReplyHandler::start):
+        (WebCore::QNetworkReplyHandler::resetState):
+        (WebCore::QNetworkReplyHandler::sendQueuedItems):
+        * platform/network/qt/QNetworkReplyHandler.h:
+        (WebCore::QNetworkReplyHandler::):
+        * platform/network/qt/ResourceHandleQt.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::loadResourceSynchronously):
+        (WebCore::ResourceHandle::setDefersLoading):
+
+2008-08-29  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Holger.
+
+        Don't crash when drawing patterns with the HTML canvas. Patterns
+        remain unimplemented but at least they don't crash anymore. This is
+        done by changing the PlatformPatternPtr to be a brush for the Qt
+        platform.
+
+        * platform/graphics/Pattern.h:
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        * platform/graphics/qt/PatternQt.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+
+2008-08-29  Simon Hausmann  <hausmann@webkit.org>
+
+        Fix the Qt build, fontSelector() is not used by the Qt port yet
+        and we just return 0 in Font::fontSelector().
+
+        * platform/graphics/Font.h:
+
+2008-08-28  Alp Toker  <alp@nuanti.com>
+
+        GTK+ dist/build fix. List newly added header files.
+
+        * GNUmakefile.am:
+
+2008-08-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Various WebKitCSSTransformValue-related fixes
+        https://bugs.webkit.org/show_bug.cgi?id=20562
+
+        Test: css3/transform-value-types.html
+
+        * bindings/js/JSCSSValueCustom.cpp:
+        (WebCore::toJS):
+        * css/CSSValue.h:
+        * css/WebKitCSSTransformValue.cpp:
+        (WebCore::WebKitCSSTransformValue::cssText):
+        * css/WebKitCSSTransformValue.h:
+        (WebCore::WebKitCSSTransformValue::):
+        * css/WebKitCSSTransformValue.idl:
+
+2008-08-28  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        - do not let the "last chance" WM_TIMER trigger WebCore timers when they should be deferred
+
+        * platform/win/SharedTimerWin.cpp:
+        (WebCore::TimerWindowWndProc):
+
+2008-08-28  David Hyatt  <hyatt@apple.com>
+
+        RenderStyle cleanup.
+
+        Break out StyleImage, StyleGeneratedImage, StyleCachedImage and NinePieceImage into separate files.
+
+        Reviewed by Adam
+
+        * css/CSSImageGeneratorValue.cpp:
+        * css/CSSImageValue.cpp:
+        * css/CSSStyleSelector.cpp:
+        * rendering/RenderImageGeneratedContent.cpp:
+        * rendering/style/NinePieceImage.cpp: Added.
+        * rendering/style/NinePieceImage.h: Added.
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::FillLayer::operator==):
+        (WebCore::FillLayer::containsImage):
+        (WebCore::StyleInheritedData::operator==):
+        (WebCore::RenderStyle::contentDataEquivalent):
+        * rendering/style/RenderStyle.h:
+        * rendering/style/StyleCachedImage.cpp: Added.
+        * rendering/style/StyleCachedImage.h: Added.
+        * rendering/style/StyleGeneratedImage.cpp: Added.
+        * rendering/style/StyleGeneratedImage.h: Added.
+        * rendering/style/StyleImage.h: Added.
+
+2008-08-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Make all the 'isFoo()' methods on CSSValue const,
+        and fix the subclasses.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20561
+
+        * css/CSSTimingFunctionValue.h:
+        * css/CSSValue.h:
+        (WebCore::CSSValue::isFontValue):
+        (WebCore::CSSValue::isImageGeneratorValue):
+        (WebCore::CSSValue::isImageValue):
+        (WebCore::CSSValue::isImplicitInitialValue):
+        * css/CSSValueList.h:
+        * css/FontValue.h:
+
+2008-08-28  David Hyatt  <hyatt@apple.com>
+
+        The great RenderStyle cleanup begins!
+
+        Move LengthBox and LengthSize out of RenderStyle and into Length.
+
+        Reviewed by Adam
+
+        * rendering/Length.h:
+        (WebCore::):
+        (WebCore::Length::Length):
+        (WebCore::Length::operator==):
+        (WebCore::Length::operator!=):
+        (WebCore::Length::value):
+        (WebCore::Length::rawValue):
+        (WebCore::Length::percent):
+        (WebCore::Length::type):
+        (WebCore::Length::quirk):
+        (WebCore::Length::setValue):
+        (WebCore::Length::setRawValue):
+        (WebCore::Length::calcValue):
+        (WebCore::Length::calcMinValue):
+        (WebCore::Length::calcFloatValue):
+        (WebCore::Length::isUndefined):
+        (WebCore::Length::isZero):
+        (WebCore::Length::isPositive):
+        (WebCore::Length::isNegative):
+        (WebCore::Length::isAuto):
+        (WebCore::Length::isRelative):
+        (WebCore::Length::isPercent):
+        (WebCore::Length::isFixed):
+        (WebCore::Length::isStatic):
+        (WebCore::Length::isIntrinsicOrAuto):
+        (WebCore::Length::blend):
+        (WebCore::LengthBox::LengthBox):
+        (WebCore::LengthBox::operator=):
+        (WebCore::LengthBox::operator==):
+        (WebCore::LengthBox::operator!=):
+        (WebCore::LengthBox::nonZero):
+        (WebCore::LengthSize::LengthSize):
+        * rendering/style/RenderStyle.h:
+
+2008-08-28  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin
+
+        https://bugs.webkit.org/show_bug.cgi?id=18091
+
+        font-size should be animatable using -webkit-transition.
+
+        * page/AnimationController.cpp:
+        (WebCore::AnimationControllerPrivate::ensurePropertyMap):
+        * rendering/style/RenderStyle.h:
+        (WebCore::RenderStyle::setFontSize):
+
+2008-08-28  Brad Garcia  <bgarcia@google.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20549
+        Correctly determine when cursor is over a resizable border within
+        a nested frameset.
+
+        * rendering/RenderFrameSet.cpp:
+        (WebCore::RenderFrameSet::canResizeRow):
+        (WebCore::RenderFrameSet::canResizeColumn):
+
+2008-08-28  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel
+
+        Add RuleTypes to CSSRule.idl for keyframes and keyframe rules.
+        https://bugs.webkit.org/show_bug.cgi?id=20552
+
+        Test: animations/animation-css-rule-types.html
+
+        * css/CSSRule.idl:
+
+2008-08-28  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Kevin and Darin.
+
+        <rdar://problem/6182541>
+        https://bugs.webkit.org/show_bug.cgi?id=20202
+        Missing http status line from the http headers.
+
+        Add a status line to the header string.
+
+        * plugins/PluginStream.cpp:
+        (WebCore::PluginStream::startStream):
+
+2008-08-28  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Rubber-stamped by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=17261
+
+        Make it possible to theme the default Url icon and enable this for
+        the Qt port. To have a minimal usage of #ifdef in the code the setting
+        of the icon was moved to a new method which comes in two flavors.
+
+        * loader/icon/IconDatabase.cpp:
+        (WebCore::loadDefaultIconRecord): Load or set the default icon
+        (WebCore::IconDatabase::defaultIcon):
+
+2008-08-28  Holger Hans Peter Freyther <zecke@selfish.org>
+
+        Unreviewed compile fix
+
+        * platform/graphics/qt/GraphicsContextQt.cpp: Remove redefinitions
+
+2008-08-28  Adam Roben  <aroben@apple.com>
+
+        Windows (and others?) build fix
+
+        * page/Chrome.cpp: Added a missing #include.
+        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer): Fixed typo.
+
+2008-08-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Qt and Cairo support from krit (and blind stab @ wx compile support)
+        https://bugs.webkit.org/show_bug.cgi?id=20373
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::setPlatformFillColor):
+        (WebCore::GraphicsContext::setPlatformStrokeColor):
+        (WebCore::GraphicsContext::setPlatformStrokeStyle):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::imageInterpolationQuality):
+        (WebCore::GraphicsContext::setPlatformFillPattern):
+        (WebCore::GraphicsContext::setPlatformStrokePattern):
+        (WebCore::GraphicsContext::setPlatformFillGradient):
+        (WebCore::GraphicsContext::setPlatformStrokeGradient):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        (WebCore::GraphicsContext::setPlatformFillPattern):
+        (WebCore::GraphicsContext::setPlatformStrokePattern):
+        (WebCore::GraphicsContext::setPlatformFillGradient):
+        (WebCore::GraphicsContext::setPlatformStrokeGradient):
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::imageInterpolationQuality):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::imageInterpolationQuality):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::setPlatformFillPattern):
+        (WebCore::GraphicsContext::setPlatformStrokePattern):
+        (WebCore::GraphicsContext::setPlatformFillGradient):
+
+2008-08-27  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Add stroke/fill Gradient and Pattern support to GraphicsContext and update <canvas> to use it.
+        https://bugs.webkit.org/show_bug.cgi?id=20373
+
+        Changed pattern() to canvasPattern() on CanvasStyle to match canvasGradient()
+
+        Made Generator (aka Gradient) RefCounted so that GraphicsContext didn't
+        have to store large Gradient objects in the GraphicsContextState
+
+        Made Pattern RefCounted for the same reason.
+
+        Many updates to GraphicsContext to support easier drawing with
+        Patterns and Gradients.
+
+        * WebCore.xcodeproj/project.pbxproj: Add pre-existing GraphicsContextPrivate.h
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::toJS):
+        * css/CSSGradientValue.cpp:
+        (WebCore::CSSGradientValue::createGradient):
+        * css/CSSGradientValue.h:
+        * html/CanvasGradient.cpp:
+        (WebCore::CanvasGradient::CanvasGradient):
+        * html/CanvasGradient.h:
+        (WebCore::CanvasGradient::gradient):
+        (WebCore::CanvasGradient::addColorStop):
+        (WebCore::CanvasGradient::getColor):
+        * html/CanvasPattern.cpp:
+        * html/CanvasPattern.h:
+        (WebCore::CanvasPattern::pattern):
+        (WebCore::CanvasPattern::originClean):
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::State::State):
+        (WebCore::CanvasRenderingContext2D::setStrokeStyle):
+        (WebCore::CanvasRenderingContext2D::setFillStyle):
+        (WebCore::CanvasRenderingContext2D::fill):
+        (WebCore::CanvasRenderingContext2D::stroke):
+        (WebCore::CanvasRenderingContext2D::fillRect):
+        (WebCore::CanvasRenderingContext2D::strokeRect):
+        * html/CanvasRenderingContext2D.h:
+        * html/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyStrokeColor):
+        (WebCore::CanvasStyle::applyFillColor):
+        * html/CanvasStyle.h:
+        * platform/graphics/GeneratedImage.h:
+        (WebCore::GeneratedImage::GeneratedImage):
+        * platform/graphics/Generator.h:
+        * platform/graphics/Gradient.h:
+        (WebCore::Gradient::create):
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::fillRule):
+        (WebCore::GraphicsContext::setFillRule):
+        (WebCore::GraphicsContext::setStrokePattern):
+        (WebCore::GraphicsContext::setFillPattern):
+        (WebCore::GraphicsContext::setStrokeGradient):
+        (WebCore::GraphicsContext::setFillGradient):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/GraphicsContextPrivate.h:
+        (WebCore::):
+        (WebCore::GraphicsContextState::GraphicsContextState):
+        * platform/graphics/GraphicsTypes.h:
+        * platform/graphics/Path.h:
+        * platform/graphics/Pattern.h:
+        (WebCore::Pattern::create):
+        (WebCore::Pattern::tileImage):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::calculateDrawingMode):
+        (WebCore::GraphicsContext::drawPath):
+        (WebCore::fillPathWithFillRule):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::setPlatformStrokePattern):
+        (WebCore::GraphicsContext::setPlatformFillPattern):
+        (WebCore::GraphicsContext::setPlatformStrokeGradient):
+        (WebCore::GraphicsContext::setPlatformFillGradient):
+
+2008-08-20  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin and Alexey.
+
+        Close a leak of PausedTimeouts if the JavaScriptDebugServer was destroyed
+        with timeouts paused.
+        https://bugs.webkit.org/show_bug.cgi?id=20469
+
+        I attempted to clean up the memory management of PausedTimeouts, I'm not
+        sure the solution I came up with is "cleaner", but it's in some ways
+        "safer", since it no longer uses raw pointers and manual new/delete.
+
+        This also now prevents CachedPage from needlessly creating Window
+        objects when caching pages which didn't already have one. :)
+
+        I also made Chrome.cpp no longer depend on the JavaScript bindings
+        (aka JSDOMWindowBase.h), since there was no real reason for it to.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::pauseTimeouts):
+        (WebCore::JSDOMWindowBase::resumeTimeouts):
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::pauseTimeouts):
+        (WebCore::ScriptController::resumeTimeouts):
+        * bindings/js/ScriptController.h:
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::CachedPage):
+        (WebCore::CachedPage::restore):
+        * page/Chrome.cpp:
+        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
+        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
+        * page/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::~JavaScriptDebugServer):
+        (WebCore::JavaScriptDebugServer::setJavaScriptPaused):
+
+2008-08-27  Holger Hans Peter Freyther <zecke@selfish.org>
+
+        Unreviewed compile fix
+
+        Add the stub for the Qt port.
+
+        * WebCore.pro:
+        * page/qt/AccessibilityObjectQt.cpp: Added.
+        (WebCore::AccessibilityObject::accessibilityIgnoreAttachment):
+
+2008-08-27  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Eric.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20551
+        [GTK] search popup crash
+
+        * platform/gtk/SearchPopupMenuGtk.cpp:
+        (WebCore::SearchPopupMenu::enabled):
+        Fix a search popup crasher by disabling the history popup since we
+        don't support this feature yet in the GTK+ port.
+
+2008-08-27  Alp Toker  <alp@nuanti.com>
+
+        Reviewed by Eric.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20551
+        [GTK] curl crashers
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::startScheduledJobs):
+        Remove the resource handle from the pending list before starting the
+        job, not afterwards. Fixes crashers in the test suite.
+
+        Test: fast/dom/clientWidthAfterDocumentIsRemoved.html
+        Test: fast/encoding/char-encoding.html
+
+2008-08-27  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by eseidel.
+
+        Fix canvas drawImage to support composite operations.
+        Composite had no effect on canvas elements like these:
+        http://philip.html5.org/tests/canvas/suite/tests/index.2d.composite.canvas.html
+
+        [CAIRO] Canvas composite don't work on canvas-elements.
+        https://bugs.webkit.org/show_bug.cgi?id=20548
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage): pass the current composite operator to the drawImage call
+
+2008-08-27  Mario Bensi  <mbensi@pleyo.com>
+
+        Reviewed by Eric Seidel.
+
+        Fix the data content of an image with a base64.
+
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::parseDataUrl): Remove the String and use only the data
+        Vector because the data.latin1().data() convert the data content and
+        the image test ( https://bugs.webkit.org/attachment.cgi?id=21726 ) is
+        not drawn correctly.
+
+2008-08-27  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Eric Seidel.
+
+        Crash after OK in dialog box and reloading page in secure mode
+        https://bugs.webkit.org/show_bug.cgi?id=20493
+
+        The new run loop spawned by a modal dialog causes a timer in the loader to run
+        synchronously inside didFinishLoading() deleting "this" object.
+
+        Defer all WebCore timers when a modal dialog is up. They are not
+        safe to execute.
+
+        * page/Chrome.cpp:
+        (WebCore::PageGroupLoadDeferrer::PageGroupLoadDeferrer):
+        (WebCore::PageGroupLoadDeferrer::~PageGroupLoadDeferrer):
+
+2008-08-27  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Memory leaks when animating transforms
+        https://bugs.webkit.org/show_bug.cgi?id=20532
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::ScaleTransformOperation::blend):
+        (WebCore::RotateTransformOperation::blend):
+        (WebCore::SkewTransformOperation::blend):
+        (WebCore::TranslateTransformOperation::blend):
+        (WebCore::MatrixTransformOperation::blend):
+        * rendering/style/RenderStyle.h:
+
+2008-08-27  Timothy Hatcher  <timothy@apple.com>
+
+        Add support for support for -webkit-appearance: default-button on the Mac platform.
+
+        <rdar://problem/6173530>
+
+        Reviewed by Dave Hyatt.
+
+        * WebCore.base.exp: Export new symbols.
+        * platform/mac/WebCoreSystemInterface.h: Add wkAdvanceDefaultButtonPulseAnimation.
+        * platform/mac/WebCoreSystemInterface.mm: Ditto.
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::RenderButton): Remove #if PLATFORM(WIN).
+        (WebCore::RenderButton::setStyle): Ditto.
+        * rendering/RenderButton.h: Ditto.
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::adjustRepaintRect): Add a case for DefaultButtonAppearance.
+        (WebCore::RenderThemeMac::setButtonCellState): Set the key equivalent to the return
+        key if the button is default, otherwise reset the key equivalent.
+        (WebCore::RenderThemeMac::paintButton): If the button is default call setDefaultButtonCell:
+        on the window, then wkAdvanceDefaultButtonPulseAnimation before painting. Restore
+        the window's previous default button cell when finished.
+
+2008-08-26  David Hyatt  <hyatt@apple.com>
+
+        First cut at making form controls on OS X respect full page zoom.  There are lots of bugs.
+
+        Reviewed by weinig
+
+        Added fast/forms/zoomed-controls.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::addIntrinsicMargins):
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::calcPrefWidths):
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::adjustRepaintRect):
+        (WebCore::RenderThemeMac::inflateRect):
+        (WebCore::RenderThemeMac::baselinePosition):
+        (WebCore::RenderThemeMac::setControlSize):
+        (WebCore::RenderThemeMac::sizeForFont):
+        (WebCore::RenderThemeMac::sizeForSystemFont):
+        (WebCore::RenderThemeMac::setFontFromControlSize):
+        (WebCore::RenderThemeMac::paintCheckbox):
+        (WebCore::RenderThemeMac::setCheckboxCellState):
+        (WebCore::RenderThemeMac::paintRadio):
+        (WebCore::RenderThemeMac::setRadioCellState):
+        (WebCore::RenderThemeMac::setButtonPaddingFromControlSize):
+        (WebCore::RenderThemeMac::adjustButtonStyle):
+        (WebCore::RenderThemeMac::setButtonCellState):
+        (WebCore::RenderThemeMac::paintButton):
+        (WebCore::RenderThemeMac::paintMenuList):
+        (WebCore::RenderThemeMac::paintMenuListButton):
+        (WebCore::RenderThemeMac::popupInternalPaddingLeft):
+        (WebCore::RenderThemeMac::popupInternalPaddingRight):
+        (WebCore::RenderThemeMac::popupInternalPaddingTop):
+        (WebCore::RenderThemeMac::popupInternalPaddingBottom):
+        (WebCore::RenderThemeMac::setPopupButtonCellState):
+        (WebCore::RenderThemeMac::paintSliderTrack):
+        (WebCore::RenderThemeMac::paintSliderThumb):
+        (WebCore::RenderThemeMac::adjustSliderThumbSize):
+        (WebCore::RenderThemeMac::paintSearchField):
+        (WebCore::RenderThemeMac::adjustSearchFieldStyle):
+        (WebCore::RenderThemeMac::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeMac::paintSearchFieldResultsButton):
+
+2008-08-27  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Anders
+
+        <rdar://problem/6134133> - Crash when loading large movie as a standalone document
+
+        We hand off these loads to Quicktime which manages and spools the data itself, but we also continued
+        to load and buffer the data for the movie in WebCore.  With large media files, this results in blowing
+        away the virtual address space and a crash.
+
+        * loader/EmptyClients.h:
+        (WebCore::EmptyFrameLoaderClient::pluginWillHandleLoadError):
+        * loader/FrameLoaderClient.h:  Added client method to get platform specific error for
+          "plugin will handle load"
+
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaTokenizer::createDocumentStructure): Tell the MainResourceLoader to not buffer data,
+          and cancel the WebCore-managed load
+        (WebCore::MediaTokenizer::writeRawData):
+        (WebCore::MediaTokenizer::finish):
+
+2008-08-26  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel
+
+        Linear timing functions should have control points 0, 0, 1, 1.
+        https://bugs.webkit.org/show_bug.cgi?id=20535
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::mapAnimationTimingFunction):
+        * rendering/style/RenderStyle.h:
+
+2008-08-27  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * WebCore.vcproj/WebCore.vcproj: Fix file extension.
+
+2008-08-26  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        <rdar://problem/6069462> REGRESSION: webkit is returning flash objects as AXUnknown
+
+        Added platform-specific accessibilityIgnoreAttachment, which allows the platform
+        to determine if an attachment is ignored through accessibility. Added equivalent
+        methods in Gtk, Win and Mac
+
+        Test: accessibility/plugin.html
+
+        * GNUmakefile.am:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/AccessibilityObject.h:
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::accessibilityIsIgnored):
+        * page/gtk/AccessibilityObjectAtk.cpp: Added.
+        (WebCore::AccessibilityObject::accessibilityIgnoreAttachment):
+        * page/mac/AccessibilityObjectMac.mm: Added.
+        (WebCore::AccessibilityObject::accessibilityIgnoreAttachment):
+        * page/mac/AccessibilityObjectWrapper.h:
+        * page/win/AccessibilityObjectWin.cpp: Added.
+        (WebCore::AccessibilityObject::accessibilityIgnoreAttachment):
+
+2008-08-26  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        <rdar://problem/5817770> can't bring up contextual menu for embedded objects in WebText
+
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityPerformShowMenuAction]):
+        (-[AccessibilityObjectWrapper accessibilityShowContextMenu]):
+
+2008-08-26  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/6176924> CrashTracer: [USER] 4 crashes in Safari at com.apple.WebCore: WebCore::RenderTableSection::numColumns
+
+        Tests: accessibility/table-notbody.html
+
+        * page/AccessibilityTable.cpp:
+        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
+
+2008-08-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Beth Dakin.
+
+        Fix typo.
+
+        * dom/DOMCoreException.h:
+
+2008-08-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=20479
+        <rdar://problem/6167660>
+        Take image redirects into account when tainting the canvas.
+
+        Test: http/tests/security/canvas-remote-read-redirect-to-remote-image.html
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        (WebCore::CanvasRenderingContext2D::drawImageFromRect):
+
+2008-08-26  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Change canvas tainting logic to ask the image if it contains
+        any resources outside of its own origin. Since there is no
+        way to determine if SVG images contain any resources outside its
+        origin, we always assume it does.
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        (WebCore::CanvasRenderingContext2D::drawImageFromRect):
+        * platform/graphics/BitmapImage.h:
+        (WebCore::BitmapImage::hasSingleSecurityOrigin):
+        * platform/graphics/GeneratedImage.h:
+        (WebCore::GeneratedImage::hasSingleSecurityOrigin):
+        * platform/graphics/Image.h:
+        (WebCore::Image::hasSingleSecurityOrigin):
+        * platform/graphics/cg/PDFDocumentImage.h:
+        (WebCore::PDFDocumentImage::hasSingleSecurityOrigin):
+        * svg/graphics/SVGImage.h:
+
+2008-08-26  Maxime Britto  <britto@apple.com>
+
+        Reviewed by Adele.
+
+        <rdar://6159244> Pan-scrolling does not work on particular sites (starmagazine.com, nytimes.com)
+        This patch fixes the issues and modify the behavior of the panscroll by allowing it to jump to a parent layer when it reaches the end of its scrollable area.
+        This is matching the behavior of the mouse wheel when trying to scroll in a smaller layer of the page (div, textarea, ...) and when we reach the edge and keep scrolling then the whole page scrolls.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::updateAutoscrollRenderer): if we switch to the parent layer to do the scroll we want to change the renderer for the panning
+        * page/EventHandler.h:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::panScrollFromPoint): now calls the scrollByRecursively method when it has computed the xDelta and yDelta
+        (WebCore::RenderLayer::scrollByRecursively): try to scroll the current layer by the xDelta and yDelta provided, if it can't it ask its parent layer to do so.
+        * rendering/RenderLayer.h:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::canBeProgramaticallyScrolled): a RenderObject must have a RenderLayer to be programatically scrolled
+        (WebCore::RenderObject::autoscroll): No need to check for the layer anymore since we verify it's present in the upmentionned method
+        (WebCore::RenderObject::panScroll): No need to check for the layer anymore too.
+
+2008-08-25  Julien Chaffraix  <jchaffraix@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Bug 20247: setAttributeNode() does not work when attribute name has a capital letter in it
+        https://bugs.webkit.org/show_bug.cgi?id=20247
+
+        <rdar://problem/6118218>
+
+        Add a boolean parameter to getAttributeItem to choose between case sensitive and case insensitive
+        check. This keeps the behaviour for setAttribute / hasAttribute (case sensitive) and getAttribute
+        (case insensitive for HTML elements).
+
+        Test: fast/dom/Element/getAttribute-check-case-sensitivity.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::getAttribute):
+        * dom/NamedAttrMap.cpp:
+        (WebCore::NamedAttrMap::getNamedItem):
+        (WebCore::NamedAttrMap::getAttributeItem):
+        * dom/NamedAttrMap.h:
+
+2008-08-25  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=20514
+        <rdar://problem/6174096>
+        Treat SVG images as dirty when drawing to a canvas.
+
+        Test: http/tests/security/canvas-remote-read-svg-image.html
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        (WebCore::CanvasRenderingContext2D::drawImageFromRect):
+        * platform/graphics/Image.h:
+        (WebCore::Image::isSVGImage):
+        * svg/graphics/SVGImage.h:
+        (WebCore::SVGImage::isSVGImage):
+
+2008-08-25  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=20377
+        Leak in XMLHttpRequest.
+
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::makeCrossSiteAccessRequestWithPreflight):
+
+2008-08-25  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Anders
+
+        Speculative fix for <rdar://problem/6173217>
+
+        Moves the "clearArchivedResources()" call to exactly where it used to be in the old version of WebArchive code.
+        Also, adds a null check for m_documentLoader since DocumentLoader::stopLoading() can end up clearing it, rendering
+        the first null check invalid.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::stopAllLoaders):
+
+
+2008-08-25  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        <rdar://problem/6157711> Heavy/Tree view selector is not grayed out if
+        there is no profile, can cause crash
+
+        * page/inspector/ProfilesPanel.js:
+
+2008-08-25  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Make sure 'inherit' is handled by transition property.
+        https://bugs.webkit.org/show_bug.cgi?id=20513
+
+        Test: transitions/inherit.html
+        Test: transitions/inherit-other-props.html
+
+        * css/CSSStyleSelector.cpp:
+          fix macro to check existence of list before getting size
+
+2008-08-25  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Mark.
+
+        <rdar://problem/6149787> crash @ com.apple.JavaScriptCore: WTF::callOnMainThread + 37.
+
+        Initialize threading in the call to WebCoreObjCFinalizeOnMainThread. We currently assume
+        (safely) that any class that needs finalization on the main thread will also need to be deallocated
+        on the main thread, and calling initializeThreading from WebCoreObjCFinalizeOnMainThread instead of
+        calling it from WebCoreObjCScheduleDeallocateOnMainThread seems safer.
+
+        * platform/mac/WebCoreObjCExtras.c:
+        (WebCoreObjCFinalizeOnMainThread):
+
+2008-08-25  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Rename CachedResource::referenced() to CachedResource::hasClients() to
+        match previous ref() -> addClient() rename.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::pruneLiveResources):
+        (WebCore::Cache::pruneDeadResources):
+        (WebCore::Cache::remove):
+        (WebCore::Cache::getStatistics):
+        (WebCore::Cache::dumpLRULists):
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::addClient):
+        (WebCore::CachedResource::removeClient):
+        (WebCore::CachedResource::setDecodedSize):
+        (WebCore::CachedResource::setEncodedSize):
+        * loader/CachedResource.h:
+        (WebCore::CachedResource::hasClients):
+        (WebCore::CachedResource::canDelete):
+
+2008-08-25  Anthony Ricaud  <rik24d@gmail.com>
+
+        Add a missing Inspector localized string for "other".
+
+        https://bugs.webkit.org/show_bug.cgi?id=20509
+
+        Reviewed by Tim Hatcher.
+
+        * English.lproj/localizedStrings.js:
+
+2008-08-22  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoff, Mark and Tim.
+
+        <rdar://problem/6150623> JSProfiler: It would be nice if the profiles
+        in the console said what file and line number they came from
+        - Lay the foundation for getting line numbers and other data from the
+        JavaScript engine.
+
+        * ForwardingHeaders/VM: Added.
+        * ForwardingHeaders/VM/Machine.h: Added.
+        * page/Console.cpp: Gather the line number and file information when
+        profileEnd has been called, but don't use it until didFinishProfiling is
+        called.  We won't need to wait once we remove the profiler "zombie" mode
+        which this patch helps pave the foundation for.
+        (WebCore::Console::Console):
+        (WebCore::Console::profileEnd):
+        (WebCore::Console::finishedProfiling):
+        * page/Console.h:
+        * page/InspectorController.cpp: Modify calls to
+        addProfileMessageToConsole to satisfy the new arguments it takes.
+        (WebCore::InspectorController::finishedProfiling):
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::addProfileMessageToConsole):
+        (WebCore::InspectorController::finishedProfiling):
+        * page/InspectorController.h:
+
+2008-08-25  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Reviewed by Simon.
+
+        [inspector] Update the WebKit.qrc Qt resources file
+        Catchup with the changes in the directory.
+
+        * page/inspector/WebKit.qrc:
+
+2008-08-25  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by Simon.
+
+        Transformed the radian to degree, to get rotate()
+        in canvas work as expected.
+
+        [Qt] Canvas.rotate() doesn't work
+        https://bugs.webkit.org/show_bug.cgi?id=20496
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::rotate):
+
+2008-08-24  Steve Falkenburg  <sfalken@apple.com>
+
+        Add a "last chance" WM_TIMER to the Windows shared timer.
+
+        The last chance timer fires every 5 seconds to run any lost WM_TIMER based timers.
+        Failure to fire a timer is fatal to the cross-platform Timer code, since it won't re-schedule
+        timers if a timer with an earlier expiration is already pending. This results in no timers
+        firing from that point on.
+
+        We lose WM_TIMER messages occasionally (in the neighborhood of 1 per hour) probably due to a
+        buggy window message hook.
+
+        This timer will start when the first WM_TIMER is scheduled, and will
+        fire every 5 seconds thereafter, causing any lost timers to be fired.
+
+        Found this via one of its symptoms: leaking WebFrames. The fix prevents timers from stalling
+        and prevents the WebFrame leak.
+
+        Reviewed by Darin Adler, Geoff Garen.
+
+        * platform/win/SharedTimerWin.cpp:
+        (WebCore::):
+        (WebCore::TimerWindowWndProc):
+        (WebCore::setSharedTimerFireTime):
+
+2008-08-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6065547> REGRESSION (r34879): "Subject" in unread emails in Yahoo mail is not shown in bold
+
+        Test: fast/css/font-property-priority.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue): Changed to pass the 'important' flag
+        to the font-property-parsing functions.
+        (WebCore::CSSParser::parseFontStyle): Added an 'important' argument and
+        changed to use it rather than the m_important member.
+        (WebCore::CSSParser::parseFontVariant): Ditto.
+        (WebCore::CSSParser::parseFontWeight): Ditto.
+        * css/CSSParser.h:
+
+2008-08-24  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes a bug where the Inspector's UI would not animate or
+        fully function because JavaScript timeouts, intervals and
+        CSS animation timers where not firing while paused at a
+        a breakpoint in the inspected page.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20042
+
+        Reviewed by Darin Adler.
+
+        Test: manual-tests/inspector/forzen-ui-while-paused.html
+
+        * page/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::pauseIfNeeded):
+        Add a call to TimerBase::fireTimersInNestedEventLoop before
+        spinning the EventLoop.
+
+2008-08-24  Rob Buis  <buis@kde.org>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20324
+        A change in SVG Glyph wont show up
+
+        Invalidate the glyph cache when the d attribute is set.
+
+        Test: svg/custom/glyph-setting-d-attribute.svg
+
+        * svg/SVGGlyphElement.cpp:
+        (WebCore::SVGGlyphElement::invalidateGlyphCache):
+        (WebCore::SVGGlyphElement::parseMappedAttribute):
+        (WebCore::SVGGlyphElement::insertedIntoDocument):
+        (WebCore::SVGGlyphElement::removedFromDocument):
+        * svg/SVGGlyphElement.h:
+
+2008-08-24  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=13864
+          <rdar://problem/5451470> REGRESSION: Uninitialized value in RenderBlock::calcInlinePrefWidths()
+
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::trimmedPrefWidths): Moved the assignment to
+        beginWS and endWS before the early return to ensure that they are
+        initialized in that case.
+
+2008-08-23  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Rubber-stamped by Mark Rowe.
+
+        Remove modelines.
+
+        * WebCore.pro:
+        * bridge/testbindings.cpp:
+        * dom/DocPtr.h:
+        * loader/SubstituteData.h:
+        * page/Chrome.cpp:
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        * page/Frame.h:
+        * page/FrameLoadRequest.h:
+        * page/FrameTree.cpp:
+        * page/FrameTree.h:
+        * page/Page.h:
+        * page/mac/ChromeMac.mm:
+        * platform/network/HTTPHeaderMap.h:
+        * platform/network/ResourceErrorBase.cpp:
+        * platform/network/ResourceErrorBase.h:
+        * platform/network/ResourceHandleInternal.h:
+        * platform/network/ResourceRequestBase.cpp:
+        * platform/network/ResourceRequestBase.h:
+        * platform/network/ResourceResponseBase.cpp:
+        * platform/network/ResourceResponseBase.h:
+        * platform/network/cf/ResourceError.h:
+        * platform/network/cf/ResourceRequest.h:
+        * platform/network/cf/ResourceRequestCFNet.h:
+        * platform/network/cf/ResourceResponse.h:
+        * platform/network/cf/ResourceResponseCFNet.h:
+        * platform/network/curl/ResourceError.h:
+        * platform/network/curl/ResourceRequest.h:
+        * platform/network/curl/ResourceResponse.h:
+        * platform/network/mac/ResourceError.h:
+        * platform/network/mac/ResourceErrorMac.mm:
+        * platform/network/mac/ResourceRequest.h:
+        * platform/network/mac/ResourceRequestMac.mm:
+        * platform/network/mac/ResourceResponse.h:
+        * platform/network/mac/ResourceResponseMac.mm:
+        * platform/network/qt/ResourceError.h:
+        * platform/network/qt/ResourceRequest.h:
+        * platform/network/qt/ResourceResponse.h:
+        * platform/network/soup/CookieJarSoup.cpp:
+        * platform/network/soup/ResourceError.h:
+        * platform/network/soup/ResourceRequest.h:
+        * platform/network/soup/ResourceResponse.h:
+
+2008-08-23  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/6065143> Reflowed image in first line of table doesn't affect baseline
+
+        Test: fast/table/vertical-align-baseline.html
+
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::getBaselineOfFirstLineBox): Added. Returns the
+        baseline of the first table row, if there is one, -1 otherwise.
+        * rendering/RenderTable.h:
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::baselinePosition): Changed to follow the
+        CSS2.1 definition of the baseline of a table cell.
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::getBaselineOfFirstLineBox): Added. Returns
+        the baseline of the first row in the section.
+        * rendering/RenderTableSection.h:
+
+2008-08-18  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Add SPI to make a Windows WebView transparent.
+
+        Reviewed by Dan Bernstein.
+
+        * platform/graphics/GraphicsContext.h: Add a parameter, hasAlpha, that
+        determines whether the created context has an alpha channel.
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::CGContextWithHDC):
+
+2008-08-22  Timothy Hatcher  <timothy@apple.com>
+
+        Rolls out r35834 because it caused a regression in the Inspector's
+        Console where some expressions always threw a syntax error.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20487
+
+        * page/inspector/Console.js:
+        (Console.prototype._evalInInspectedWindow): Removes parenthesis
+        around the expression.
+
+2008-08-22  Timothy Hatcher  <timothy@apple.com>
+
+        Makes getStyleProperty return a value for the overflow property
+        when overflow-x and overflow-y are equal.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20485
+
+        Reviewed by Dan Bernstein.
+
+        Test: fast/css/overflow-property.html
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getPropertyValue):
+
+2008-08-22  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes a bug where while editing in the Inspector the
+        sidebar scroll position would jump to the top.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20484
+
+        Reviewed by Darin Adler.
+
+        * page/inspector/treeoutline.js:
+        (TreeOutline._removeChildren): Remove the offsetTop call that
+        was forcing a layout, since layout causes scroll positions
+        to be clamped to the new scrollHeight/Width. Layout will happen
+        normally when needed.
+
+2008-08-22  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix. Add AccessibilityTable sources.
+
+        * WebCoreSources.bkl:
+
+2008-08-21  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Jon Honeycutt and Alexey Proskuryakov.
+
+        - fix <rdar://problem/6162701> WebKit should correct Geeza Pro's font metrics
+
+        Test: platform/mac/fast/text/international/Geeza-Pro-vertical-metrics-adjustment.html
+
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::SimpleFontData::platformInit): Add 8% to Geeza Pro's reported
+        ascent and 100% to its reported descent.
+
+2008-08-21  Kalle Vahlman  <kalle.vahlman@movial.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20267
+        [GTK] Crash on some pages due to a plugin
+
+        Fix handling of badly formatted and empty plugin mime descriptions
+
+        * plugins/gtk/PluginPackageGtk.cpp:
+        (WebCore::PluginPackage::fetchInfo):
+
+2008-08-21  Kevin Watters  <kevinwatters@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Follow other ports (and IE) in ImageSourceWx.cpp never to return an
+        animated GIF frame duration of less than 50ms.
+
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::ImageSource::frameDurationAtIndex):
+
+2008-08-21  Maxime Britto  <britto@apple.com>
+
+        Reviewed by Kevin McCullough.
+
+        Test: fast/events/autoscroll-nonscrollable-iframe-in-scrollable-div.html
+        https://bugs.webkit.org/show_bug.cgi?id=20451
+
+        rdar://problem/6166435 Inspector doesn't auto scroll when selecting text (20451)
+        When we climb up the rendering tree looking for a scrollable renderer, we need to be able to jump outside of an iframe.
+        This way we can see if what is embedding the iframe can be scrolled even if the iframe content can't.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::handleMouseDraggedEvent): when we reach the document node and it can't be scrolled we set the next parent as the document's owner element if it exists.
+
+        (WebCore::EventHandler::handleMousePressEvent): ditto
+
+2008-08-21  Anthony Ricaud  <rik24d@gmail.com>
+
+        Small optimization for when the dividers in the Inspector's
+        Resources panel are updated.
+
+        Reviewed by Tim Hatcher.
+
+        * page/inspector/ResourcesPanel.js:
+        (WebInsector.ResourcesPanel.prototype._updateGraphDividersIfNeeded):
+        Combind a for loop and clone the divider element.
+
+2008-08-21  Chris Marrin  <cmarrin@apple.com>
+
+        Allow 0 (without units) for Time eg. duration
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=20467
+
+        Reviewed by Dave Hyatt.
+
+        Test: css1/units/zero-duration-without-units.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::validUnit):
+
+2008-08-21  Timothy Hatcher  <timothy@apple.com>
+
+        Make deleting all text while editing a DOM attribute in
+        the Inspector delete the attribute. This also fixes
+        an exception that would happen before.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20472
+
+        Reviewed by Kevin McCullough.
+
+        * page/inspector/ElementsPanel.js:
+        (WebInspector.DOMNodeTreeElement.prototype._attributeEditingCommitted):
+        Don't check for hasAttributes on the parseElement, continuing
+        through the function will correctly remove the attribute.
+        If the parseElement is null, call _editingCancelled not
+        editingCancelled, this fixes an exception.
+
+2008-08-21  Timothy Hatcher  <timothy@apple.com>
+
+        Update the Inspector's Metrics pane when editing in
+        the Styles pane. This makes sure the metrics shown
+        always match what the Styles pane shows.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20470
+
+        Reviewed by Kevin McCullough.
+
+        * page/inspector/ElementsPanel.js:
+        (WebInspector.ElementsPanel): Add event listeners for
+        the "style edited" and "style property toggled" events,
+        so the Metrics pane is updated.
+        (WebInspector.ElementsPanel.prototype._stylesPaneEdited):
+        Update the Metrics pane.
+        * page/inspector/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.toggleEnabled):
+        Dispatch the "style property toggled" event.
+        (WebInspector.StylePropertyTreeElement.prototype.editingCancelled):
+        Dispatch the "style edited" event when the CSS text is restored.
+        (WebInspector.StylePropertyTreeElement.prototype.applyStyleText):
+        Dispatch the "style edited" event.
+
+2008-08-21  Timothy Hatcher  <timothy@apple.com>
+
+        Make the Inspector's Metrics sidebar pane editable.
+
+        https://bugs.webkit.org/show_bug.cgi?id=17218
+        rdar://problem/5732818
+
+        Reviewed by Kevin McCullough.
+
+        * page/inspector/ElementsPanel.js:
+        (WebInspector.ElementsPanel): Add an event listener for
+        the "metrics edited" event, so the Styles pane is updated.
+        * page/inspector/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane.prototype.update): Remember the node
+        so future updates work. Add a double click event listener for the
+        metric values to start editing.
+        (WebInspector.MetricsSidebarPane.prototype.startEditing):
+        Call WebInspector.startEditing with some context.
+        (WebInspector.MetricsSidebarPane.prototype.editingCancelled):
+        (WebInspector.MetricsSidebarPane.prototype.editingCommitted):
+        Set the user input on the elements inline style. Fire the
+        "metrics edited" event.
+
+2008-08-21  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix a race condition in Windows timer code.
+        Timer function could end up being called with a 0 timer, leading to a Windows exception.
+
+        Don't post a timer message if one is already pending.
+
+        Reviewed by Ada Chan.
+
+        * platform/win/SharedTimerWin.cpp:
+        (WebCore::TimerWindowWndProc):
+        (WebCore::clearTimer):
+        (WebCore::queueTimerProc):
+        (WebCore::setSharedTimerFireTime):
+
+2008-08-21  Anthony Ricaud  <rik24d@gmail.com>
+
+        After trying to add the expression, try again with quotes for
+        easier edition.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20466
+
+        Reviewed by Tim Hatcher.
+
+        * page/inspector/ObjectPropertiesSection.js: Added an
+        evaluateExpression function.
+
+2008-08-21  Anthony Ricaud  <rik24d@gmail.com>
+
+        Perform Inspector searches on search event to clear results when
+        clicking the cross to empty it. Delete the lastQuery when the field
+        is emptied in order to perform the search if exactly the same query
+        is entered next.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20462
+
+        Reviewed by Tim Hatcher.
+
+        * page/inspector/inspector.js:
+
+2008-08-21  Marco Barisione  <marco.barisione@collabora.co.uk>
+
+        Reviewed by Mark Rowe.
+
+        http://bugs.webkit.org/show_bug.cgi?id=19656
+        [SOUP] The gio code should call didFail() instead of
+        didFinishLoading() in case of error
+
+        In case of error call didFail() instead of didReceiveResponse() and
+        didFinishLoading().
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::networkErrorForFile):
+        (WebCore::readCallback):
+        (WebCore::openCallback):
+        (WebCore::queryInfoCallback):
+
+2008-08-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Jon Honeycutt.
+
+        Fix build failure.
+
+        * bridge/c/c_instance.cpp:
+        (KJS::Bindings::CInstance::getPropertyNames): Declare count as uint32_t rather than unsigned
+        as that is what NPEnumerationFunctionPtr is declared as accepting.
+
+2008-08-20  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Build fix.  Handle kCGInterpolationMedium in switch statements if it is available.
+
+        * platform/graphics/GraphicsContext.h:
+        (WebCore::):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::setImageInterpolationQuality):
+        (WebCore::GraphicsContext::imageInterpolationQuality):
+
+2008-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Rubber-stamped by John Sullivan.
+
+        - rename shouldUpdateWhileHidden to shouldUpdateWhileOffscreen and
+          rename related methods and variables accordingly.
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameViewPrivate::FrameViewPrivate):
+        (WebCore::FrameView::shouldUpdateWhileOffscreen):
+        (WebCore::FrameView::setShouldUpdateWhileOffscreen):
+        * page/FrameView.h:
+        * platform/ScrollView.h:
+        * platform/mac/ScrollViewMac.mm:
+        (WebCore::ScrollView::updateContents):
+
+2008-08-20  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Mitzpettel
+
+        <rdar://problem/6153432> - Many images broken in Mail
+
+        This can be traced back to the preload scanner.  With that change, CachedResources are created a lot
+        sooner than before and confuse the WebArchive machinery.
+
+        When referencing WebArchive subresources directly through the WebKit API it is appropriate to ignore
+        such CachedResources since they are placeholders and have not been submitted to the ResourceLoadDelegate
+        machinery and nothing is known about where the data will eventually come from.
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::subresource):  Ignore a CachedResource if its preloadResult is
+          CachedResource::PreloadReferenced.
+
+2008-08-20  Holger Hans Peter Freyther  <zecke@selfish.org>
+
+        Unreviewed compile fix
+
+        Catch up with the JSValue::type elimination.
+
+        * bridge/qt/qt_instance.cpp:
+        (KJS::Bindings::QtRuntimeObjectImp::construct):
+        (KJS::Bindings::QtInstance::defaultValue):
+        * bridge/qt/qt_runtime.cpp:
+        (KJS::Bindings::QtRuntimeConnectionMethod::call):
+
+2008-08-20  Chris Teague  <chris.teague@gmail.com>
+
+        Reviewed by Mark Rowe.
+
+        Fix https://bugs.webkit.org/show_bug.cgi?id=20449
+        Bug 20449: Build fails if LOW_BANDWIDTH_DISPLAY is defined
+
+        * ChangeLog:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::switchOutLowBandwidthDisplayIfReady):
+
+2008-08-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        getComputedStyle() for webkitTransform should return a transform
+        that does not have the transform origin baked into it.
+        https://bugs.webkit.org/show_bug.cgi?id=20464
+
+        Test: fast/css/getComputedStyle-transform.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::computedTransform):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::applyTransform):
+        * rendering/style/RenderStyle.h:
+
+2008-08-20  Josh Aas  <joshmoz@gmail.com>
+
+        Reviewed and landed by Anders.
+
+        <rdar://problem/6163636>
+        rename NPCocoaEvent's "event" struct to "data" (20446)
+
+        * bridge/npapi.h:
+        (_NPCocoaEvent::):
+
+2008-08-20  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Fix for <rdar://problem/6145626>
+        This patch fixes a number of remaining problems getting
+        disconnected frames to work correctly with markAllMatchesForText()
+        and findString(). Details inline.
+
+        This was a static helper function in Frame, but this patch requires
+        the same functionality in Editor, so I just added it as a function
+        on Node.
+        * dom/Node.cpp:
+        (WebCore::Node::isInShadowTree):
+        * dom/Node.h:
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::insideVisibleArea): Returns false if
+        excludeFromTextSearch() is true.
+
+        In a normal (non-disconnected) frame, findString returns a range of
+        the document node if the text is not found in the frame. I changed
+        firstVisibleRange and lastVisibleRange to match that behavior when
+        the text is not found
+        (WebCore::Editor::firstVisibleRange):
+        (WebCore::Editor::lastVisibleRange):
+
+        Here are the bulk of the changes in the patch. A lot of text was
+        not being found in disconnected frames because I failed to account
+        for all of the possible problems associated with shadow trees. That
+        is fixed here.
+        (WebCore::Editor::nextVisibleRange):
+        * editing/Editor.h:
+
+        excludeFromTextSearch() is new. It allows a WebKit client to mark a
+        frame as not-text-searchable through SPI.
+        * WebCore.base.exp:
+        * page/Frame.cpp:
+        (WebCore::Frame::excludeFromTextSearch):
+        (WebCore::Frame::setExcludeFromTextSearch):
+        (WebCore::FramePrivate::FramePrivate):
+        * page/Frame.h:
+        * page/FramePrivate.h:
+
+        (WebCore::Frame::findString):
+        (WebCore::Frame::markAllMatchesForText):  I kept running into an
+        assertion failure in paining code because of the forced paint on
+        empty visible rects.
+
+2008-08-20  Timothy Hatcher  <timothy@apple.com>
+
+        Adds a positon box to the Inspector's Metrics sidebar
+        pane. When an element is not statically positioned, there
+        is now a position box that show top, right, bottom and
+        left computed values.
+
+        Reviewed by Kevin McCullough.
+
+        * English.lproj/localizedStrings.js: Updated the strings.
+        * page/inspector/MetricsSidebarPane.js:
+        (WebInspector.MetricsSidebarPane.prototype.update):
+        Renamed the boxPartValue function to createBoxPartElement
+        and made it create the entire element. Made it understand
+        how to get position style properties. Don't use the figure dash
+        when 0px is used for positions, since the 0 is meaningful there.
+        Instead use the figure dash when a position is auto.
+        * page/inspector/inspector.css: Added a new rule for position.
+
+2008-08-20  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin
+
+        Qt build fix
+
+        * WebCore.pro:
+
+2008-08-20  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        - avoid using a deprecated NSScroller method on Leopard
+
+        * platform/mac/PlatformScrollBarMac.mm:
+        (WebCore::PlatformScrollbar::updateThumbPosition):
+        (WebCore::PlatformScrollbar::updateThumbProportion):
+
+2008-08-20  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Gtk build fix
+
+        * GNUmakefile.am:
+        * page/AccessibilityTable.cpp: Change nil to 0
+        (WebCore::AccessibilityTable::cellForColumnAndRow):
+
+2008-08-19  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        Bring back shared JSGlobalData and implicit locking, because too many clients rely on it.
+
+        * ForwardingHeaders/kjs/JSLock.h: Added.
+        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/GCController.cpp:
+        (WebCore::collect):
+        (WebCore::GCController::gcTimerFired):
+        (WebCore::GCController::garbageCollectNow):
+        * bindings/js/JSCustomSQLStatementCallback.cpp:
+        (WebCore::JSCustomSQLStatementCallback::handleEvent):
+        * bindings/js/JSCustomSQLStatementErrorCallback.cpp:
+        (WebCore::JSCustomSQLStatementErrorCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionCallback.cpp:
+        (WebCore::JSCustomSQLTransactionCallback::handleEvent):
+        * bindings/js/JSCustomSQLTransactionErrorCallback.cpp:
+        (WebCore::JSCustomSQLTransactionErrorCallback::handleEvent):
+        * bindings/js/JSCustomVoidCallback.cpp:
+        (WebCore::JSCustomVoidCallback::handleEvent):
+        * bindings/js/JSCustomXPathNSResolver.cpp:
+        (WebCore::JSCustomXPathNSResolver::lookupNamespaceURI):
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::DOMWindowTimer::~DOMWindowTimer):
+        (WebCore::JSDOMWindowBase::clear):
+        (WebCore::JSDOMWindowBase::timerFired):
+        * bindings/js/JSEventCustom.cpp:
+        (WebCore::toJS):
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSAbstractEventListener::handleEvent):
+        * bindings/js/JSNSResolver.cpp:
+        (WebCore::JSNSResolver::lookupNamespaceURI):
+        * bindings/js/JSNodeFilterCondition.cpp:
+        (WebCore::JSNodeFilterCondition::acceptNode):
+        * bindings/js/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::execute):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluate):
+        (WebCore::ScriptController::clearWindowShell):
+        (WebCore::ScriptController::createHTMLEventHandler):
+        (WebCore::ScriptController::createSVGEventHandler):
+        (WebCore::ScriptController::initScript):
+        (WebCore::ScriptController::updateDocument):
+        (WebCore::ScriptController::bindingRootObject):
+        (WebCore::ScriptController::windowScriptNPObject):
+        (WebCore::ScriptController::createScriptObjectForPluginElement):
+        (WebCore::ScriptController::clearScriptObjects):
+        * bindings/js/ScriptControllerMac.mm:
+        (WebCore::ScriptController::windowScriptObject):
+        * bindings/objc/WebScriptObject.mm:
+        (_didExecute):
+        (-[WebScriptObject callWebScriptMethod:withArguments:]):
+        (-[WebScriptObject evaluateWebScript:]):
+        (-[WebScriptObject setValue:forKey:]):
+        (-[WebScriptObject valueForKey:]):
+        (-[WebScriptObject removeWebScriptKey:]):
+        (-[WebScriptObject stringRepresentation]):
+        (-[WebScriptObject webScriptValueAtIndex:]):
+        (-[WebScriptObject setWebScriptValueAtIndex:value:]):
+        (+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]):
+        * bridge/NP_jsobject.cpp:
+        (_NPN_InvokeDefault):
+        (_NPN_Invoke):
+        (_NPN_Evaluate):
+        (_NPN_GetProperty):
+        (_NPN_SetProperty):
+        (_NPN_RemoveProperty):
+        (_NPN_HasProperty):
+        (_NPN_HasMethod):
+        (_NPN_Enumerate):
+        * bridge/c/c_class.cpp:
+        (KJS::Bindings::CClass::~CClass):
+        (KJS::Bindings::CClass::methodsNamed):
+        (KJS::Bindings::CClass::fieldNamed):
+        * bridge/c/c_instance.cpp:
+        (KJS::Bindings::CInstance::invokeMethod):
+        (KJS::Bindings::CInstance::invokeDefaultMethod):
+        (KJS::Bindings::CInstance::getPropertyNames):
+        * bridge/c/c_runtime.cpp:
+        (KJS::Bindings::CField::valueFromInstance):
+        (KJS::Bindings::CField::setValueToInstance):
+        * bridge/c/c_utility.cpp:
+        (KJS::Bindings::convertValueToNPVariant):
+        (KJS::Bindings::convertNPVariantToValue):
+        * bridge/jni/jni_class.cpp:
+        (JavaClass::JavaClass):
+        (JavaClass::~JavaClass):
+        * bridge/jni/jni_instance.cpp:
+        (JavaInstance::stringValue):
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::call):
+        (JavaJSObject::eval):
+        (JavaJSObject::getMember):
+        (JavaJSObject::setMember):
+        (JavaJSObject::removeMember):
+        (JavaJSObject::getSlot):
+        (JavaJSObject::setSlot):
+        (JavaJSObject::toString):
+        (JavaJSObject::convertValueToJObject):
+        (JavaJSObject::convertJObjectToValue):
+        * bridge/jni/jni_objc.mm:
+        (KJS::Bindings::dispatchJNICall):
+        * bridge/jni/jni_runtime.cpp:
+        (appendClassName):
+        (JavaMethod::signature):
+        * bridge/jni/jni_runtime.h:
+        (KJS::Bindings::JavaString::JavaString):
+        (KJS::Bindings::JavaString::_commonInit):
+        (KJS::Bindings::JavaString::~JavaString):
+        (KJS::Bindings::JavaString::UTF8String):
+        * bridge/jni/jni_utility.cpp:
+        (KJS::Bindings::convertValueToJValue):
+        * bridge/npruntime.cpp:
+        (_NPN_GetStringIdentifier):
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::moveGlobalExceptionToExecState):
+        (ObjcInstance::invokeMethod):
+        (ObjcInstance::invokeDefaultMethod):
+        (ObjcInstance::setValueOfUndefinedField):
+        (ObjcInstance::getValueOfUndefinedField):
+        * bridge/objc/objc_runtime.mm:
+        (ObjcField::valueFromInstance):
+        (ObjcField::setValueToInstance):
+        * bridge/objc/objc_utility.mm:
+        (KJS::Bindings::convertValueToObjcValue):
+        (KJS::Bindings::convertNSStringToString):
+        (KJS::Bindings::convertObjcValueToValue):
+        * bridge/qt/qt_instance.cpp:
+        (KJS::Bindings::QtRuntimeObjectImp::removeFromCache):
+        (KJS::Bindings::QtInstance::~QtInstance):
+        (KJS::Bindings::QtInstance::getQtInstance):
+        (KJS::Bindings::QtInstance::getRuntimeObject):
+        * bridge/qt/qt_runtime.cpp:
+        (KJS::Bindings::convertValueToQVariant):
+        (KJS::Bindings::convertQVariantToValue):
+        (KJS::Bindings::QtRuntimeMetaMethod::call):
+        (KJS::Bindings::QtRuntimeConnectionMethod::call):
+        (KJS::Bindings::QtConnectionObject::QtConnectionObject):
+        (KJS::Bindings::QtConnectionObject::execute):
+        * bridge/runtime.cpp:
+        (KJS::Bindings::Instance::createRuntimeObject):
+        * bridge/testbindings.cpp:
+        (main):
+        * bridge/testbindings.mm:
+        (main):
+        * bridge/testqtbindings.cpp:
+        (main):
+        * dom/Document.cpp:
+        (WebCore::Document::~Document):
+        * dom/Node.cpp:
+        (WebCore::Node::setDocument):
+        * history/CachedPage.cpp:
+        (WebCore::CachedPage::CachedPage):
+        (WebCore::CachedPage::restore):
+        (WebCore::CachedPage::clear):
+        * loader/FrameLoader.cpp:
+        (WebCore::getString):
+        * page/InspectorController.cpp:
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        (WebCore::XMLHttpRequestResource::XMLHttpRequestResource):
+        (WebCore::XMLHttpRequestResource::~XMLHttpRequestResource):
+        (WebCore::getResourceDocumentNode):
+        (WebCore::search):
+        (WebCore::inspectedWindow):
+        (WebCore::wrapCallback):
+        (WebCore::currentCallFrame):
+        (WebCore::profiles):
+        (WebCore::InspectorController::focusNode):
+        (WebCore::InspectorController::inspectedWindowScriptObjectCleared):
+        (WebCore::InspectorController::addDatabaseScriptResource):
+        (WebCore::InspectorController::addScriptProfile):
+        * page/JavaScriptCallFrame.cpp:
+        (WebCore::JavaScriptCallFrame::evaluate):
+        * page/JavaScriptProfileNode.cpp:
+        (WebCore::getTotalTime):
+        (WebCore::getSelfTime):
+        (WebCore::getTotalPercent):
+        (WebCore::getSelfPercent):
+        (WebCore::getNumberOfCalls):
+        (WebCore::getChildren):
+        (WebCore::getVisible):
+        * page/Page.cpp:
+        * page/mac/FrameMac.mm:
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::start):
+        (WebCore::getString):
+        (WebCore::PluginView::performRequest):
+        (WebCore::PluginView::bindingInstance):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::init):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::stop):
+        (WebCore::PluginView::init):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::dispatchNPEvent):
+        (WebCore::PluginView::handleKeyboardEvent):
+        (WebCore::PluginView::handleMouseEvent):
+        (WebCore::PluginView::setNPWindowRect):
+        (WebCore::PluginView::stop):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::clearResponse):
+        (WebCore::XMLHttpRequest::didFinishLoading):
+        (WebCore::XMLHttpRequest::didReceiveData):
+
+2008-08-19  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        Add the beginnings of Skia graphics support to WebCore
+        as I try to begin the long process of un-forking the changes
+        needed to WebCore to make Andriod's WebCore build.
+
+        I'll follow this up with actual *Skia.cpp files in a separate patch.
+
+        * platform/graphics/AffineTransform.h:
+        * platform/graphics/FloatPoint.h:
+        * platform/graphics/FloatRect.h:
+        * platform/graphics/Gradient.h:
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/Image.h:
+        * platform/graphics/ImageBuffer.h:
+        * platform/graphics/ImageSource.h:
+        * platform/graphics/IntPoint.h:
+        * platform/graphics/IntRect.h:
+        * platform/graphics/Path.h:
+        * platform/graphics/Pattern.h:
+        * svg/graphics/SVGPaintServerPattern.h:
+        * svg/graphics/SVGPaintServerSolid.h:
+
+2008-08-19  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix Windows build more.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2008-08-19  Steve Falkenburg  <sfalken@apple.com>
+
+        Fix Windows build.
+
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+
+2008-08-19  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        <rdar://problem/4003764> Expose tables as AXTables
+
+        Tests: accessibility/table-attributes.html
+               accessibility/table-cell-spans.html
+               accessibility/table-cells.html
+               accessibility/table-detection.html
+               accessibility/table-sections.html
+               accessibility/table-with-rules.html
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/AXObjectCache.cpp:
+        (WebCore::AXObjectCache::get):
+        * page/AccessibilityObject.h:
+        (WebCore::):
+        (WebCore::AccessibilityObject::isDataTable):
+        (WebCore::AccessibilityObject::isTableRow):
+        (WebCore::AccessibilityObject::isTableColumn):
+        (WebCore::AccessibilityObject::isTableCell):
+        * page/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::canSetFocusAttribute):
+        * page/AccessibilityTable.cpp: Added.
+        (WebCore::AccessibilityTable::AccessibilityTable):
+        (WebCore::AccessibilityTable::~AccessibilityTable):
+        (WebCore::AccessibilityTable::create):
+        (WebCore::AccessibilityTable::isTableExposableThroughAccessibility):
+        (WebCore::AccessibilityTable::clearChildren):
+        (WebCore::AccessibilityTable::addChildren):
+        (WebCore::AccessibilityTable::headerContainer):
+        (WebCore::AccessibilityTable::columns):
+        (WebCore::AccessibilityTable::rows):
+        (WebCore::AccessibilityTable::rowHeaders):
+        (WebCore::AccessibilityTable::columnHeaders):
+        (WebCore::AccessibilityTable::cells):
+        (WebCore::AccessibilityTable::columnCount):
+        (WebCore::AccessibilityTable::rowCount):
+        (WebCore::AccessibilityTable::cellForColumnAndRow):
+        (WebCore::AccessibilityTable::roleValue):
+        (WebCore::AccessibilityTable::accessibilityIsIgnored):
+        (WebCore::AccessibilityTable::title):
+        (WebCore::AccessibilityTable::isDataTable):
+        * page/AccessibilityTable.h: Added.
+        * page/AccessibilityTableCell.cpp: Added.
+        (WebCore::AccessibilityTableCell::AccessibilityTableCell):
+        (WebCore::AccessibilityTableCell::~AccessibilityTableCell):
+        (WebCore::AccessibilityTableCell::create):
+        (WebCore::AccessibilityTableCell::accessibilityIsIgnored):
+        (WebCore::AccessibilityTableCell::rowIndexRange):
+        (WebCore::AccessibilityTableCell::columnIndexRange):
+        * page/AccessibilityTableCell.h: Added.
+        (WebCore::AccessibilityTableCell::isTableCell):
+        (WebCore::AccessibilityTableCell::roleValue):
+        * page/AccessibilityTableColumn.cpp: Added.
+        (WebCore::AccessibilityTableColumn::AccessibilityTableColumn):
+        (WebCore::AccessibilityTableColumn::~AccessibilityTableColumn):
+        (WebCore::AccessibilityTableColumn::create):
+        (WebCore::AccessibilityTableColumn::setParentTable):
+        (WebCore::AccessibilityTableColumn::elementRect):
+        (WebCore::AccessibilityTableColumn::size):
+        (WebCore::AccessibilityTableColumn::children):
+        (WebCore::AccessibilityTableColumn::headerObject):
+        (WebCore::AccessibilityTableColumn::headerObjectForSection):
+        (WebCore::AccessibilityTableColumn::addChildren):
+        * page/AccessibilityTableColumn.h: Added.
+        (WebCore::AccessibilityTableColumn::parentObject):
+        (WebCore::AccessibilityTableColumn::roleValue):
+        (WebCore::AccessibilityTableColumn::accessibilityIsIgnored):
+        (WebCore::AccessibilityTableColumn::isTableColumn):
+        (WebCore::AccessibilityTableColumn::setColumnIndex):
+        (WebCore::AccessibilityTableColumn::columnIndex):
+        * page/AccessibilityTableHeaderContainer.cpp: Added.
+        (WebCore::AccessibilityTableHeaderContainer::AccessibilityTableHeaderContainer):
+        (WebCore::AccessibilityTableHeaderContainer::~AccessibilityTableHeaderContainer):
+        (WebCore::AccessibilityTableHeaderContainer::create):
+        (WebCore::AccessibilityTableHeaderContainer::children):
+        (WebCore::AccessibilityTableHeaderContainer::elementRect):
+        (WebCore::AccessibilityTableHeaderContainer::size):
+        (WebCore::AccessibilityTableHeaderContainer::addChildren):
+        * page/AccessibilityTableHeaderContainer.h: Added.
+        (WebCore::AccessibilityTableHeaderContainer::roleValue):
+        (WebCore::AccessibilityTableHeaderContainer::setParentTable):
+        (WebCore::AccessibilityTableHeaderContainer::parentObject):
+        (WebCore::AccessibilityTableHeaderContainer::accessibilityIsIgnored):
+        * page/AccessibilityTableRow.cpp: Added.
+        (WebCore::AccessibilityTableRow::AccessibilityTableRow):
+        (WebCore::AccessibilityTableRow::~AccessibilityTableRow):
+        (WebCore::AccessibilityTableRow::create):
+        (WebCore::AccessibilityTableRow::accessibilityIsIgnored):
+        (WebCore::AccessibilityTableRow::headerObject):
+        * page/AccessibilityTableRow.h: Added.
+        (WebCore::AccessibilityTableRow::isTableRow):
+        (WebCore::AccessibilityTableRow::roleValue):
+        (WebCore::AccessibilityTableRow::setRowIndex):
+        (WebCore::AccessibilityTableRow::rowIndex):
+        * page/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeNames]):
+        (RoleEntry::):
+        (-[AccessibilityObjectWrapper roleDescription]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        (-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]):
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]):
+
+2008-08-19  Steve Falkenburg  <sfalken@apple.com>
+
+        Build fix.
+        Add buildfailed support to stop builds early (preventing inaccurate error messages).
+        Add missing post-build rule to Release.
+
+        * WebCore.vcproj/QTMovieWin.vcproj:
+
+2008-08-19  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Added support for console.count in the inspector.
+
+        Reviewed by Geoff Garen.
+
+        * page/Console.cpp:
+        (WebCore::Console::count):
+        * page/Console.h:
+        * page/Console.idl: Added console.count.
+        * page/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad): Clears m_counts.
+        (WebCore::InspectorController::count): Updates the count number
+        sing "title@source:line" as the identifier, and adds a
+        message to the console.
+        * page/InspectorController.h: Added m_counts.
+
+2008-08-19  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Clear console.time timers when changing page.
+
+        Reviewed by Geoff Garen.
+
+        * page/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+
+2008-08-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adele.
+
+        Fix for <rdar://problem/6154695> Full-page movies flicker while playing
+        https://bugs.webkit.org/show_bug.cgi?id=20404
+
+        Ignore setVisible() when visibility doesn't change.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.h:
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::MediaPlayerPrivate):
+        (WebCore::MediaPlayerPrivate::setVisible):
+
+2008-08-19  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes a bug in the Profile view where switching sort order, then
+        switching from heavy to tree mode would show the tree in the
+        previous sort order.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20441
+
+        Reviewed by Kevin McCullough.
+
+        * page/inspector/ProfileView.js:
+        (WebInspector.ProfileView.prototype._changeView): Call _sortProfile
+        on the next profile before assigning it to this.profile.
+        (WebInspector.ProfileView.prototype._sortData): Call _sortProfile.
+        (WebInspector.ProfileView.prototype._sortProfile): Moves from
+        _sortData and takes a profile argument. If the profile passed in
+        matches the this.profile, then call refresh.
+
+2008-08-18  Timothy Hatcher  <timothy@apple.com>
+
+        Changed the default sort order now that heavy view is the default.
+        Also fixes a bug where the heavy profile was not sorted at first.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20440
+
+        Reviewed by Kevin McCullough.
+
+        * page/inspector/ProfileView.js:
+        (WebInspector.ProfileView): Changed the default sort column. Also assign
+        heavyProfile to profile, so the sortSelfTimeDescending call happens
+        on the heavy profile before assigning to this.profile.
+
+2008-08-18  Timothy Hatcher  <timothy@apple.com>
+
+        Add support for editing DOM properties and scope variables by double
+        clicking a property to enter edit mode.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20415
+
+        Reviewed by Kevin McCullough.
+
+        * page/inspector/ObjectPropertiesSection.js:
+        (WebInspector.ObjectPropertiesSection): Set editable to true by default.
+        (WebInspector.ObjectPropertiesSection.prototype.onpopulate):
+        Factored out code into update, and calls update.
+        (WebInspector.ObjectPropertiesSection.prototype.update): Moved from onpopulate.
+        Call removeChildren since this method can be called multiple times now.
+        (WebInspector.ObjectPropertyTreeElement): Pass an empty title, the title
+        gets made later in onattach.
+        (WebInspector.ObjectPropertyTreeElement.prototype.onpopulate): Don't return early
+        if shouldRefreshChildren is true. Call removeChildren since this method can be
+        called multiple times now.
+        (WebInspector.ObjectPropertyTreeElement.prototype.ondblclick): Call startEditing.
+        (WebInspector.ObjectPropertyTreeElement.prototype.onattach): Call update.
+        (WebInspector.ObjectPropertyTreeElement.prototype.update): Update the title for
+        this element (code moved from the constructor.)
+        (WebInspector.ObjectPropertyTreeElement.prototype.updateSiblings): Recreate all
+        sibling property elements.
+        (WebInspector.ObjectPropertyTreeElement.prototype.startEditing): Call
+        WebInspector.startEditing after rememebring some context.
+        (WebInspector.ObjectPropertyTreeElement.prototype.editingEnded): Reset the scrollLeft
+        for the list element, since it might have scrolled during editing.
+        (WebInspector.ObjectPropertyTreeElement.prototype.editingCancelled): Call editingEnded
+        then restore the state from the context. Then call update to restore the title.
+        (WebInspector.ObjectPropertyTreeElement.prototype.editingCommitted): Call editingCancelled
+        if the user input and the previous input are the same. Call editingEnded, then call applyExpression
+        to commit the user input.
+        (WebInspector.ObjectPropertyTreeElement.prototype.applyExpression): Evaluates the input expression
+        and stores the result on the object for the property name of this element. If the expression is
+        empty, delete the property and remove the tree element.
+        * page/inspector/ScopeChainSidebarPane.js:
+        (WebInspector.ScopeChainSidebarPane.prototype.update): Set the editInSelectedCallFrameWhenPaused
+        property on each ObjectPropertiesSection.
+        (WebInspector.ScopeVariableTreeElement.prototype.onattach): Call ObjectPropertyTreeElement's onattach
+        since it is now implemented.
+        * page/inspector/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.evaluateInSelectedCallFrame): Added an updateInterface argument
+        that defaults to true if omitted. It specifies whether to call update on the scope chain.
+        * page/inspector/inspector.css: New styles.
+        * page/inspector/treeoutline.js:
+        (TreeElement.prototype._attach): Fixed an exception that fired when handling the shouldRefreshChildren
+        change. The nextSibling would exist but have a _listItemNode that didn't match the new parent.
+
+2008-08-18  Timothy Hatcher  <timothy@apple.com>
+
+        Surround the expression to be evaluated in parenthesis so the
+        result of the eval is the result of the whole expression not
+        the last potential sub-expression. So evaluating {x: 123}
+        will show the Object not 123.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20428
+
+        Reviewed by Kevin McCullough.
+
+        * page/inspector/Console.js:
+        (Console.prototype._evalInInspectedWindow): Add parenthesis
+        around the expression. And add couple comments.
+
+2008-08-19 Kevin McCullough <kmccullough@apple.com>
+
+        Reviewed by Geoff.
+
+        -Implement a page() function to extract a common code pattern.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/Console.cpp:
+        (WebCore::Console::addMessage):
+        (WebCore::Console::error):
+        (WebCore::Console::info):
+        (WebCore::Console::log):
+        (WebCore::Console::dir):
+        (WebCore::Console::assertCondition):
+        (WebCore::Console::time):
+        (WebCore::Console::timeEnd):
+        (WebCore::Console::group):
+        (WebCore::Console::groupEnd):
+        (WebCore::Console::finishedProfiling):
+        (WebCore::Console::warn):
+        (WebCore::Console::framePage):
+        * page/Console.h:
+
+2008-08-12  Darin Adler  <darin@apple.com>
+
+        Reviewed by Geoff.
+
+        - eliminate JSValue::type()
+
+        * bridge/c/c_instance.cpp:
+        (KJS::Bindings::CInstance::defaultValue): Take PreferredPrimitiveType
+        argument instead of JSType argument. Removed unneeded code to handle
+        boolean, since that's never passed.
+        * bridge/c/c_instance.h: Ditto.
+
+        * bridge/c/c_utility.cpp:
+        (KJS::Bindings::convertValueToNPVariant): Use JSValue::is functions
+        instead of JSValue::type(). Removed unneeded code to handle
+        "unspecified".
+
+        * bridge/jni/jni_instance.cpp:
+        (JavaInstance::defaultValue): Take PreferredPrimitiveType argument
+        instead of JSType argument. Removed unneeded code to handle boolean.
+        * bridge/jni/jni_instance.h: Ditto.
+
+        * bridge/jni/jni_jsobject.mm:
+        (JavaJSObject::convertValueToJObject): Use JSValue::is functions
+        instead of JSValue::type().
+
+        * bridge/objc/objc_instance.h: Take PreferredPrimitiveType argument
+        instead of JSType argument. Removed unused argument.
+        * bridge/objc/objc_instance.mm:
+        (ObjcInstance::getValueOfUndefinedField): Removed unused argument.
+        (ObjcInstance::defaultValue): Take PreferredPrimitiveType argument
+        instead of JSType argument. Removed unneeded code to handle boolean
+        and another dead code path for unknown types.
+
+        * bridge/objc/objc_runtime.h: Take PreferredPrimitiveType argument
+        instead of JSType argument. Removed override of type() that caused
+        the fallback object to return "UndefinedType" when there is no
+        invokeUndefinedMethodFromWebScript:withArguments: method defined.
+        That didn't accomplish much, since most checks for undefined don't
+        ever call type().
+        * bridge/objc/objc_runtime.mm:
+        (ObjcFallbackObjectImp::defaultValue): Ditto.
+
+        * bridge/qt/qt_instance.cpp:
+        (KJS::Bindings::QtInstance::defaultValue): Take PreferredPrimitiveType
+        argument instead of JSType argument. Removed unneeded code to handle
+        boolean.
+        * bridge/qt/qt_instance.h: Ditto.
+
+        * bridge/runtime.h:
+        (KJS::Bindings::Instance::getValueOfUndefinedField): Removed
+        unsed argument.
+        * bridge/runtime_object.cpp:
+        (RuntimeObjectImp::defaultValue): Take PreferredPrimitiveType
+        argument instead of JSType argument.
+        * bridge/runtime_object.h: Ditto.
+
+2008-08-18  Maxime Britto  <britto@apple.com>
+
+        Reviewed by Adele.
+
+        <rdar://6157207> Mouse pointer does not change when new window is opened after pan-scrolling original window
+        Related to the discussion from rdar://6102511 , we should disable every key event (except for the esc key which stops the panning).
+        We shouldn't be able to create another window while we are in pan scrolling.
+        Other browsers behaviors :
+          FF3 : Most of the keys are disabled, there is no way to create another window while in panscroll mode
+          IE7 : Keys are not disabled but stops immediately the panning.
+        This patch matches FF3 behavior by disabling every key but the esc key.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::stopAutoscrollTimer): Change the cursor back to the regular arrow cursor when the pannning is stopped.
+        (WebCore::EventHandler::keyEvent): When a key event is received while in panning or autoscroll we swallow the event early.
+
+2008-08-18  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        - fix <rdar://problem/5862634> REGRESSION (3.1.1): In iChat, inline image not resizable past current size after another IM is received
+
+        Test: fast/replaced/max-width-percent.html
+
+        Added an includeMaxWidth boolean to RenderBox::calcReplaedWidth().
+        When false, max-width is not factored into the
+        calculation.
+        Changed RenderReplaced and subclasses' calcPrefWidths() to call
+        calcReplacedWidth(false) and then apply max-width only if it has a
+        fixed, positive value.
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::calcReplacedWidth):
+        * rendering/RenderBox.h:
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::calcReplacedWidth):
+        (WebCore::RenderImage::calcPrefWidths):
+        * rendering/RenderImage.h:
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::calcPrefWidths):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::calcPrefWidths):
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::calcReplacedWidth):
+        (WebCore::RenderVideo::calcPrefWidths):
+        * rendering/RenderVideo.h:
+
+2008-08-18  Daniel Macks  <dmacks@netspace.org>
+
+        Reviewed by Mark Rowe.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20410
+        More portable/self-documenting replacement for SIZE_MAX.
+
+        * platform/network/curl/FormDataStreamCurl.cpp:
+        (WebCore::FormDataStream::read):
+
+2008-08-18  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        Need to make sure we have an Animation in the AnimationList
+        before setting the initial value.
+        https://bugs.webkit.org/show_bug.cgi?id=20408
+
+        Test: fast/css/transition_shorthand_parsing.html
+
+        * css/CSSStyleSelector.cpp:
+
+2008-08-18  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        <rdar://problem/6150593> JSProfiler: Empty profiles disappear when there
+        is another profile.
+
+        * page/inspector/ProfilesPanel.js:
+
+2008-08-18  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Geoff.
+
+        <rdar://problem/6150642> REGRESSION: Closing the Web Inspector clears
+        all console messages
+
+        * page/inspector/Console.js:
+
+2008-08-18  Dirk Schulze  <vbs85@gmx.de>
+
+        Reviewed by Eric Seidel.
+
+        Fixed Canvas for Cairo. Stroke and fill colors didn't work after
+        the canvas clean up.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20405
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::fill):
+        (WebCore::CanvasRenderingContext2D::stroke):
+        (WebCore::CanvasRenderingContext2D::fillRect):
+
+2008-08-17  Timothy Hatcher  <timothy@apple.com>
+
+        Complete in scope variables in the Console when paused.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19115
+
+        Reviewed by Geoffrey Garen.
+
+        * page/inspector/Console.js:
+        (WebInspector.Console.prototype.completions): If the expressionString
+        is null or empty and the debugger is paused, call variablesInScopeForSelectedCallFrame
+        to get an object that declares all the in scope variables. That way
+        "top level" expressions are completed.
+        * page/inspector/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.variablesInScopeForSelectedCallFrame):
+        Return an object that has all the variables that are in scope for the
+        selected call frame. The value of each property is just true.
+        The return object is useful for quick lookups or auto completion.
+
+2008-08-17  Cameron Zwarich  <cwzwarich@uwaterloo.ca>
+
+        Not reviewed.
+
+        Speculative Qt build fix.
+
+        * bridge/qt/qt_runtime.cpp:
+        (KJS::Bindings::convertValueToQVariant):
+        (KJS::Bindings::QtRuntimeMethod::QtRuntimeMethod):
+
+2008-08-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Updated project files to XCode 3.1.
+
+        * manual-tests/NPN_Invoke/NPN_Invoke.xcodeproj/project.pbxproj:
+
+2008-08-17  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Cameron Zwarich.
+
+        Made room for a free word in JSCell.
+
+        Changed JSDOMWindowBase to store its auxiliary data in a subclass of
+        JSGlobalData, so the two could share a pointer.
+
+        Added a bunch of ASSERTs, to help catch over-sized objects.
+
+2008-08-15  Mark Rowe  <mrowe@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Disable dead code stripping in debug builds.
+
+        * Configurations/Base.xcconfig:
+        * WebCore.xcodeproj/project.pbxproj:
+
+2008-08-15  Mark Rowe  <mrowe@apple.com>
+
+        Rubber-stamped by Geoff Garen.
+
+        <rdar://problem/6139914> Please include a _debug version of JavaScriptCore framework
+
+        * Configurations/Base.xcconfig: Factor out the debug-only settings so that they can shared
+        between the Debug configuration and debug Production variant.
+        * WebCore.xcodeproj/project.pbxproj: Enable the debug variant.
+
+2008-08-15  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Anders.
+
+        Don't start preloading body resources before the head is complete. This prevents
+        body preloads from slowing down initial display when there is limited amount
+        of bandwidth available.
+
+        Works by queuing up found body preloads to DocLoader and only issuing them
+        after document has rendering.
+
+        With bandwidth capped to 300kbit/s this speeds up cnn.com initial display by ~25% or 5s
+        without affecting complete load time.
+
+        * html/PreloadScanner.cpp:
+        (WebCore::PreloadScanner::PreloadScanner):
+        (WebCore::PreloadScanner::scanningBody):
+        (WebCore::PreloadScanner::emitTag):
+        (WebCore::PreloadScanner::emitCSSRule):
+        * html/PreloadScanner.h:
+        * loader/DocLoader.cpp:
+        (WebCore::DocLoader::preload):
+        (WebCore::DocLoader::checkForPendingPreloads):
+        (WebCore::DocLoader::requestPreload):
+        * loader/DocLoader.h:
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::didFinishLoading):
+        (WebCore::Loader::Host::didFail):
+
+2008-08-15  Ada Chan  <adachan@apple.com>
+
+        Use item's computed style if the render style is 0 before falling back to the <select>'s style.
+        This way style set on an <hr> within a <select> will be honored.
+
+        Reviewed by Dave Hyatt and Dan Bernstein.
+
+        * rendering/RenderMenuList.cpp:
+        (WebCore::RenderMenuList::itemStyle):
+
+2008-08-15  Antti Koivisto  <antti@apple.com>
+
+        Reviewed by Oliver.
+
+        Some loader performance tweaks:
+        - Make stylesheets highest priority instead of scripts. We block script execution on stylesheets.
+          Especially if a stylesheet @imports other stylesheets it is important to get them to the front of the queue
+          to not delay rendering.
+        - Issue the first resource load for a host immediately even if the resource is low priority. TCP connection setup
+          can take long time when latency is high so it is good to get started early.
+        - When the document is fully parsed and stylesheets have been loaded there is no need to keep managing the
+          load queues. Issue remaining loads to the network layer.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::determinePriority):
+        (WebCore::Loader::load):
+        (WebCore::Loader::Host::servePendingRequests):
+        * loader/loader.h:
+
+2008-08-15  Timothy Hatcher  <timothy@apple.com>
+
+        Detach the script debugger when the Web Inspector's window closes.
+        This has always been the intended design, but never fully implemented.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20402
+
+        Reviewed by Adam Roben.
+
+        * page/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible): Call stopDebugging()
+        if the window is no longer visible.
+
+2008-08-15  Håvard Wall  <hwall@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fixes:    compile with QT_NO_CONTEXTMENU
+
+        * platform/qt/PlatformMouseEventQt.cpp:
+        (WebCore::PlatformMouseEvent::PlatformMouseEvent):
+        * platform/qt/PlatformScrollBarQt.cpp:
+        (WebCore::PlatformScrollbar::handleMouseMoveEvent):
+        (WebCore::PlatformScrollbar::handleContextMenuEvent):
+
+2008-08-15  Håvard Wall  <hwall@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fixes: compile with QT_NO_WHEELEVENT
+
+        * platform/qt/WheelEventQt.cpp:
+        (WebCore::PlatformWheelEvent::PlatformWheelEvent):
+
+2008-08-15  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Fixed Bug 20210: Console groups are incorrect when closing and reopening the Inspector
+
+        https://bugs.webkit.org/show_bug.cgi?id=20210
+
+        Reviewed by Tim Hatcher.
+
+        * page/Console.cpp:
+        (WebCore::Console::group):
+        (WebCore::Console::groupEnd):
+        * page/Console.h:
+        (WebCore::): Removed GroupTitleMessageLevel. Added StartGroupMessaageLevel and EndGroupMessageLevel.
+        * page/InspectorController.cpp:
+        (WebCore::InspectorController::startGroup): Increments group level by
+        one and adds console message with StartGroupMessaageLevel.
+        (WebCore::InspectorController::endGroup): Decrements group level by one
+        and adds console message with EndGroupMessaageLevel.
+        * page/InspectorController.h:
+        * page/inspector/Console.js:
+        (WebInspector.Console.prototype.addMessage): Creates new ConsoleGroup
+        if the message is StartGroupMessaageLevel.
+        (WebInspector.ConsoleMessage.prototype.toMessageElement):
+        (WebInspector.ConsoleGroup.prototype.addMessage):
+        * page/inspector/inspector.js:
+
+2008-08-15  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Adds support for console.dir to the Inspector
+
+        https://bugs.webkit.org/show_bug.cgi?id=19155
+
+        Reviewed by Tim Hatcher.
+
+        * bindings/js/JSConsoleCustom.cpp:
+        (WebCore::JSConsole::dir):
+        * page/Console.cpp:
+        (WebCore::Console::dir):
+        * page/Console.h: Added ObjectMessageLevel.
+        * page/Console.idl: Added console.dir.
+        * page/inspector/Console.js:
+        (WebInspector.ConsoleMessage.prototypet.toMessageElement): Creates an
+        ObjectPropertiesSection if the MessageLevel is Object.
+        * page/inspector/ObjectPropertiesSection.js: "in" operator can't be
+        used on primitive data types.
+        * page/inspector/inspector.css:
+
+2008-08-15  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Adds support for clear() in the Inspector console.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19873
+
+        Reviewed by Tim Hatcher.
+
+        * page/inspector/Console.js:
+
+2008-08-15  Anthony Ricaud  <rik24d@gmail.com>
+
+        Cmd-F on Mac or Ctrl-F on other platforms now focus the search field.
+
+        Platform distinction and modifier key matching adjusted
+        by Daniel Jalkut <jalkut@red-sweater.com>
+
+        Bug 16313: text search (find) keybindings should work in the Web Inspector
+        https://bugs.webkit.org/show_bug.cgi?id=16313
+
+        Reviewed by Tim Hatcher.
+
+        * page/inspector/inspector.js: Added a case for the F key
+
+2008-08-15  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Fix for error when the string doesn't contain a webkit-profile link.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20399
+
+        Reviewed by Tim Hatcher.
+
+        * page/inspector/inspector.js:
+
+2008-08-15  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes two bugs where JavaScript could be executed from the page
+        while the debugger is paused.
+
+        The first issue was JSLazyEventListener not checking the paused
+        state before parsing the code.
+
+        The second issue was with the PageGroup version of
+        JavaScriptDebugServer::setJavaScriptPaused always passing false
+        to the Page version of JavaScriptDebugServer::setJavaScriptPaused,
+        and not the paused argument.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20284
+
+        Reviewed by Adam Roben.
+
+        * bindings/js/JSEventListener.cpp:
+        (WebCore::JSLazyEventListener::parseCode): Check the paused
+        state of the ScriptController. Return early if paused.
+        * manual-tests/inspector/debugger-execution-while-paused.html: Added.
+        * page/JavaScriptDebugServer.cpp:
+        (WebCore::JavaScriptDebugServer::setJavaScriptPaused):
+        Pass the paused argument to the Page version of setJavaScriptPaused.
+
+2008-08-15  Alexey Proskuryakov  <ap@webkit.org>
+
+        Reviewed by Geoff Garen.
+
+        JSStringRef is created context-free, but can get linked to one via an identifier table,
+        breaking an implicit API contract.
+
+        * page/InspectorController.cpp:
+        (WebCore::jsStringRef):
+        (WebCore::InspectorController::didParseSource):
+        (WebCore::InspectorController::failedToParseSource):
+        * page/JavaScriptProfile.cpp:
+        (WebCore::getTitleCallback):
+        Updated for JavaScriptCore changes.
+
+2008-08-14  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx !USE(WXGC) build fix. This is necessary until we find a way to replace GDI with
+        an alternative that performs reasonably well. (GDI+ is too slow in many cases.)
+
+        * platform/graphics/AffineTransform.h:
+
+2008-08-14  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adele.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=20388
+        <video> elements on Windows never becomes visible when a page is restored from the cache
+
+        Always pass "set" calls down to MediaPlayerPrivate instead of only when the
+        value is different from the cached value. Let the implementation decide when
+        to avoid work because nothing has changed.
+
+        * platform/graphics/MediaPlayer.cpp:
+        (WebCore::MediaPlayer::setVolume):
+        (WebCore::MediaPlayer::setRate):
+        (WebCore::MediaPlayer::setRect):
+        (WebCore::MediaPlayer::setVisible):
+
+2008-08-14  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Make Firebug command line API respect predefined variables.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20385
+
+        Reviewed by Tim Hatcher.
+
+        * page/inspector/Console.js:
+
+2008-08-14  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen and Timothy Hatcher.
+
+        Allow programatically setting the HTMLTokenizers time delay and chunk size
+        which are used for determining how aggressively we yield.
+
+        * WebCore.base.exp:
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::begin):
+        (WebCore::HTMLTokenizer::continueProcessing):
+        * html/HTMLTokenizer.h:
+        * page/Page.cpp:
+        (WebCore::Page::Page):
+        (WebCore::Page::setCustomHTMLTokenizerTimeDelay):
+        (WebCore::Page::setCustomHTMLTokenizerChunkSize):
+        * page/Page.h:
+        (WebCore::Page::hasCustomHTMLTokenizerTimeDelay):
+        (WebCore::Page::customHTMLTokenizerTimeDelay):
+        (WebCore::Page::hasCustomHTMLTokenizerChunkSize):
+        (WebCore::Page::customHTMLTokenizerChunkSize):
+
+2008-08-14  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Beth.
+
+        Move us one step closer to cross-platform svg/graphics code
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/CanvasStyle.cpp:
+        * platform/graphics/Color.cpp:
+        (WebCore::colorWithOverrideAlpha):
+        * platform/graphics/Color.h:
+        * svg/graphics/cg/CgSupport.cpp:
+        (WebCore::applyStrokeStyleToContext):
+        (WebCore::strokeBoundingBox):
+        * svg/graphics/cg/SVGPaintServerSolidCg.cpp:
+        (WebCore::SVGPaintServerSolid::setup):
+
+2008-08-14  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Alexey.
+
+        Remove un-need includes from HTMLCanvas and use the
+        Gradient platform abstraction in one place in CanvasStyle
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::fillRect):
+        * html/CanvasStyle.cpp:
+        * html/HTMLCanvasElement.cpp:
+
+2008-08-14  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Alexey.
+
+        Clean up GlyphBuffer.h, removing more #ifdefs
+
+        * platform/graphics/GlyphBuffer.h:
+        (WebCore::GlyphBuffer::glyphAt):
+        (WebCore::GlyphBuffer::advanceAt):
+        (WebCore::GlyphBuffer::add):
+
+2008-08-14  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Clean up AffineTransform.h, removing #ifdefs
+
+        * platform/graphics/AffineTransform.h:
+        * platform/graphics/cairo/AffineTransformCairo.cpp:
+        * platform/graphics/cg/AffineTransformCG.cpp:
+        * platform/graphics/qt/AffineTransformQt.cpp:
+        * platform/graphics/wx/AffineTransformWx.cpp:
+
+2008-08-14  Dan Bernstein  <mitz@apple.com>
+
+        - fix non-CG builds by adding an ImageSource::frameSizeAtIndex() that returns size().
+
+        * platform/graphics/cairo/ImageSourceCairo.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex):
+        * platform/graphics/qt/ImageSourceQt.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex):
+        * platform/graphics/wx/ImageSourceWx.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex):
+
+2008-08-14  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        - fix <rdar://problem/5993323> REGRESSION (r34210): Apple.com favicon appears stretched/clipped
+
+        * platform/graphics/BitmapImage.cpp:
+        (WebCore::BitmapImage::BitmapImage): Added initialization of
+        m_hasUniformFrameSize.
+        (WebCore::BitmapImage::cacheFrame): Added code to get the size of the
+        cached frame for use in decoded size computation and for setting
+        m_hasUniformFrameSize.
+        (WebCore::BitmapImage::currentFrameSize): Added.
+        (WebCore::BitmapImage::dataChanged): Added code to reset
+        m_hasUniformFrameSize.
+        * platform/graphics/BitmapImage.h: Added currentFrameSize() and
+        m_hasUniformFrameSize.
+        * platform/graphics/ImageSource.h: Added frameSizeAtIndex().
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::draw): Changed to use currentFrameSize(). This
+        fixes the bug, which resulted from assuming that the frame being drawn
+        was the same size as the first frame.
+        * platform/graphics/cg/ImageSourceCG.cpp:
+        (WebCore::ImageSource::frameSizeAtIndex): Renamed size() to this and
+        changed to get the size of the frame at the given index.
+        (WebCore::ImageSource::size): Added. Returns frameSizeAtIndex(0).
+
+2008-08-13  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Eric Seidel
+
+        Fix @font-face inside @media rule crash.
+        https://bugs.webkit.org/show_bug.cgi?id=20367
+
+        Test: fast/css/font-face-in-media-rule.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSRuleSet::addRulesFromSheet):
+
+2008-08-14  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fixes after recent changes to Canvas and Image classes.
+
+        * platform/graphics/Pattern.h:
+        * platform/graphics/wx/GradientWx.cpp:
+        (WebCore::Gradient::fill):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::applyFillPattern):
+        (WebCore::GraphicsContext::applyStrokePattern):
+        * platform/graphics/wx/ImageBufferWx.cpp:
+        (WebCore::ImageBuffer::image):
+        * platform/graphics/wx/ImageWx.cpp:
+        (WebCore::Image::loadPlatformResource):
+
+2008-08-14  Maxime Britto  <britto@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        rdar://6102511
+        When pan-scrolling, typing on the keyboard should either stop the pan scroll or be ignored
+        IE and FF are both preventing the keyboard event to interact with the page while scrolling.
+        Some differences exist between them concerning the kind of key which is pressed :
+        IE7 : every key leads to a stop of the panning
+        FF3 : the ESC and TAB keys leads to a stop, the other keys are inactive.
+        For WebKit this patch is adopting the FF3 behavior except for the TAB key which is inactive too.
+
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::keyEvent): Verifies which key has been hit and decide either to stop the pan scroll or to swallow the key event.
+
+2008-08-14  Christian Dywan  <christian@twotoasts.de>
+
+        Gtk+/ Cairo build fix, patch by Dirk Schulze.
+
+        * html/CanvasStyle.cpp:
+        * platform/graphics/cairo/PatternCairo.cpp:
+        (WebCore::Pattern::createPlatformPattern):
+        * svg/graphics/cairo/SVGResourceMaskerCairo.cpp:
+
+2008-08-14  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        <rdar://problem/6115819> Notify of profile in console
+
+        * page/InspectorController.cpp:
+        (WebCore::InspectorController::addProfile):
+        (WebCore::InspectorController::addProfileMessageToConsole): Called by
+        addProfile this is the function that adds a message to the console that
+        a profile finished.
+        * page/InspectorController.h:
+        * page/JavaScriptProfile.cpp: Expose the profiler's unique ID to match
+        the console log to the profile in the web inspector.
+        (WebCore::getUniqueIdCallback):
+        (WebCore::ProfileClass):
+        * page/inspector/ProfilesPanel.js: Created a map of all the profiles by
+        Id to bring up the requested profile.  Also select and reveal the
+        profile in the profile panel.  And created displayTitleForProfileLink()
+        which formats a title taking into account if it's user initiated or if
+        there are multiples. Lasty, I put the user initiated profile in a
+        variable.
+        * page/inspector/inspector.js: Make the profile title be a clickable
+        link that will take the user to the identified profile.  Also expose
+        the count of user initiated profiles so they can be displayed in the
+        console with the correct count.
+
+2008-08-14  Timothy Hatcher  <timothy@apple.com>
+
+        Avoid formating ConsoleMessages twice unless the message will be
+        displayed in bubbles of a SourceFrame.
+
+        Reviewed by Kevin McCullough.
+
+        * page/inspector/Console.js:
+        (WebInspector.ConsoleMessage): Only format the plain text message
+        if the URL and line are valid and the level is error or warning.
+        (WebInspector.ConsoleMessage.prototype.isErrorOrWarning): Added.
+        Helper to test for error or warning level.
+        * page/inspector/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.addMessage): Don't add the
+        message if there is no message or valid line or if the msg
+        isn't an error or warning.
+
+2008-08-14  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        partial Gtk build fix, not reviewed
+
+        * platform/graphics/cairo/PatternCairo.cpp:
+
+2008-08-13  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Fix style issue.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::pickMedia):
+
+2008-08-13  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Build fix for Cairo, not reviewed. (exposed by gtk build slave)
+        Continue Erics build fixes, after the Image cleanup.
+
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::image):
+
+2008-08-13  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Build fix for Qt, not reviewed.
+        Don't declare eventuallyMarkAsParserCreated in a block wrapped by !USE_QXMLSTREAM.
+
+        * dom/XMLTokenizer.cpp:
+        (WebCore::eventuallyMarkAsParserCreated): Was erre
+
+2008-08-13  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Build fix, not reviewed.
+        Add ScriptElement.cpp to Gtk build.
+
+        * GNUmakefile.am:
+
+2008-08-13  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Eric.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=20372
+
+        Refactor HTMLScriptElement's code into a common base class: ScriptElement.
+        SVGScriptElement will be converted to use ScriptElement in a follow-up patch.
+
+        This resolves code duplications and allows us to completly replace the old
+        SVGScriptElement (which doesn't use CachedScript, no dynamic injected scripts etc..)
+
+        As ScriptElement, doesn't actually inherit from Element, we may want to rename
+        it, though StyleElement uses the same naming convention, so I left it as is for now.
+        Eventually we'll rename both files in future.
+
+        No functional changes yet, as SVGScriptElement doesn't yet use the new base class.
+
+        * WebCore.pro: Add new ScriptElement.cpp to build.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * WebCoreSources.bkl: Dutto.
+        * dom/ScriptElement.cpp: Added. 1:1 based on HTMLScriptElement
+        (WebCore::ScriptElement::insertedIntoDocument):
+        (WebCore::ScriptElement::removedFromDocument):
+        (WebCore::ScriptElement::childrenChanged):
+        (WebCore::ScriptElement::finishParsingChildren):
+        (WebCore::ScriptElement::handleSourceAttribute):
+        (WebCore::isSupportedJavaScriptLanguage):
+        (WebCore::ScriptElementData::ScriptElementData):
+        (WebCore::ScriptElementData::~ScriptElementData):
+        (WebCore::ScriptElementData::requestScript):
+        (WebCore::ScriptElementData::evaluateScript):
+        (WebCore::ScriptElementData::stopLoadRequest):
+        (WebCore::ScriptElementData::notifyFinished):
+        (WebCore::ScriptElementData::ignoresLoadRequest):
+        (WebCore::ScriptElementData::shouldExecuteAsJavaScript):
+        (WebCore::ScriptElementData::scriptCharset):
+        (WebCore::ScriptElementData::scriptContent):
+        * dom/ScriptElement.h: Added.
+        (WebCore::ScriptElement::ScriptElement):
+        (WebCore::ScriptElement::~ScriptElement):
+        (WebCore::ScriptElementData::element):
+        (WebCore::ScriptElementData::createdByParser):
+        (WebCore::ScriptElementData::setCreatedByParser):
+        * dom/XMLTokenizer.cpp:
+        (WebCore::isScriptElement):
+        (WebCore::castToScriptElement):
+        (WebCore::eventuallyMarkAsParserCreated):
+        (WebCore::XMLTokenizer::startElementNs):
+        (WebCore::XMLTokenizer::endElementNs):
+        (WebCore::createXHTMLParserErrorHeader):
+        (WebCore::XMLTokenizer::insertErrorMessageBlock):
+        * html/HTMLScriptElement.cpp: Refactored code, pushed most code down to ScriptElement.
+        (WebCore::HTMLScriptElement::HTMLScriptElement):
+        (WebCore::HTMLScriptElement::~HTMLScriptElement):
+        (WebCore::HTMLScriptElement::isURLAttribute):
+        (WebCore::HTMLScriptElement::setCreatedByParser):
+        (WebCore::HTMLScriptElement::shouldExecuteAsJavaScript):
+        (WebCore::HTMLScriptElement::childrenChanged):
+        (WebCore::HTMLScriptElement::parseMappedAttribute):
+        (WebCore::HTMLScriptElement::finishParsingChildren):
+        (WebCore::HTMLScriptElement::insertedIntoDocument):
+        (WebCore::HTMLScriptElement::removedFromDocument):
+        (WebCore::HTMLScriptElement::text):
+        (WebCore::HTMLScriptElement::setText):
+        (WebCore::HTMLScriptElement::setHtmlFor):
+        (WebCore::HTMLScriptElement::setEvent):
+        (WebCore::HTMLScriptElement::charset):
+        (WebCore::HTMLScriptElement::src):
+        (WebCore::HTMLScriptElement::type):
+        (WebCore::HTMLScriptElement::scriptCharset):
+        (WebCore::HTMLScriptElement::scriptContent):
+        (WebCore::HTMLScriptElement::sourceAttributeValue):
+        (WebCore::HTMLScriptElement::charsetAttributeValue):
+        (WebCore::HTMLScriptElement::typeAttributeValue):
+        (WebCore::HTMLScriptElement::languageAttributeValue):
+        (WebCore::HTMLScriptElement::dispatchLoadEvent):
+        (WebCore::HTMLScriptElement::dispatchErrorEvent):
+        * html/HTMLScriptElement.h:
+        * svg/SVGScriptElement.cpp: Inherit from ScriptElement, don't actually use it yet.
+        * svg/SVGScriptElement.cpp:
+        (WebCore::SVGScriptElement::SVGScriptElement):
+        (WebCore::SVGScriptElement::scriptContent):
+        (WebCore::SVGScriptElement::sourceAttributeValue):
+        (WebCore::SVGScriptElement::charsetAttributeValue):
+        (WebCore::SVGScriptElement::typeAttributeValue):
+        (WebCore::SVGScriptElement::languageAttributeValue):
+        (WebCore::SVGScriptElement::dispatchLoadEvent):
+        (WebCore::SVGScriptElement::dispatchErrorEvent):
+        * svg/SVGScriptElement.h:
+        (WebCore::SVGScriptElement::setCreatedByParser):
+
+2008-08-13  Eric Seidel  <eric@webkit.org>
+
+        Attempt to fix the Gtk build, no review.
+
+        I removed the bogus GraphicsContext::translatePoint() hack for Gtk in the process.
+
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        * platform/graphics/qt/GradientQt.cpp:
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::paintMozWidget):
+
+2008-08-13  Eric Seidel  <eric@webkit.org>
+
+        Yet another attempt to fix the Qt build, no review.
+
+        * platform/graphics/qt/GradientQt.cpp:
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::applyStrokePattern):
+        (WebCore::GraphicsContext::applyFillPattern):
+
+2008-08-13  Eric Seidel  <eric@webkit.org>
+
+        Attempt to fix the Windows build, no review.
+
+        * platform/win/CursorWin.cpp:
+        (WebCore::loadCursorByName):
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::paint):
+
+2008-08-13  Eric Seidel  <eric@webkit.org>
+
+        Attempt to fix the Windows build, no review.
+
+        * platform/win/CursorWin.cpp:
+        (WebCore::loadCursorByName):
+        * platform/win/ScrollViewWin.cpp:
+        (WebCore::ScrollView::paint):
+
+2008-08-13  Eric Seidel  <eric@webkit.org>
+
+        Attempt to fix the Qt build, no review.
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::image):
+
+2008-08-13  Eric Seidel  <eric@webkit.org>
+
+        Attempt to fix the Windows build, no review.
+
+        * platform/graphics/win/ImageWin.cpp:
+        (WebCore::Image::loadPlatformResource):
+        * plugins/win/PluginViewWin.cpp:
+        (WebCore::PluginView::paintMissingPluginIcon):
+
+2008-08-13  Eric Seidel  <eric@webkit.org>
+
+        Another attempt to fix the Qt build, no review.
+
+        * platform/graphics/qt/ImageQt.cpp:
+        * platform/graphics/qt/StillImageQt.h:
+
+2008-08-13  Eric Seidel  <eric@webkit.org>
+
+        No review, build fix only.
+
+        Fix mac build, due to change in new code since my patch was written.
+
+        * svg/graphics/cg/SVGResourceMaskerCg.mm:
+        (WebCore::SVGResourceMasker::applyMask):
+
+2008-08-13  Eric Seidel  <eric@webkit.org>
+
+        Build fix only, no review.
+
+        Attempt to fix the Qt build.
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        * platform/graphics/qt/StillImageQt.h:
+        (WebCore::StillImage::create):
+        (WebCore::StillImage::destroyDecodedData):
+        (WebCore::StillImage::decodedSize):
+
+2008-08-13  Eric Seidel  <eric@webkit.org>
+
+        Build fix only, no review.
+
+        Attempt to fix the Qt build.
+
+        * html/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyStrokeColor):
+        (WebCore::CanvasStyle::applyFillColor):
+
+2008-08-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Sam.
+
+        Match HTML5 spec by throwing INVALID_STATE_ERR when
+        createPattern is called and the HTMLImageElement is not
+        yet done loading the image (!isComplete)
+        https://bugs.webkit.org/show_bug.cgi?id=20351
+
+        Test: http/misc/canvas-pattern-from-incremental-image.html
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::createPattern):
+
+2008-08-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Niko.
+
+        Split out a Pattern class from CanvasPattern
+        and remove all the Pattern-related #ifdefs
+        (This will break non-mac platforms!  I will fix them.)
+        https://bugs.webkit.org/show_bug.cgi?id=20351
+
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+        * html/CanvasPattern.cpp:
+        (WebCore::CanvasPattern::parseRepetitionType):
+        (WebCore::CanvasPattern::CanvasPattern):
+        * html/CanvasPattern.h:
+        (WebCore::CanvasPattern::create):
+        (WebCore::CanvasPattern::pattern):
+        (WebCore::CanvasPattern::originClean):
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::createPattern):
+        (WebCore::CanvasRenderingContext2D::applyStrokePattern):
+        (WebCore::CanvasRenderingContext2D::applyFillPattern):
+        * html/CanvasRenderingContext2D.h:
+        * html/HTMLCanvasElement.cpp:
+        * html/HTMLCanvasElement.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::createHistoryItem):
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::applyStrokePattern):
+        (WebCore::GraphicsContext::applyFillPattern):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::clipToImageBuffer):
+        (WebCore::GraphicsContext::applyStrokePattern):
+        (WebCore::GraphicsContext::applyFillPattern):
+
+2008-08-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Niko.
+
+        Make Images RefCounted (and clean up callers)
+        https://bugs.webkit.org/show_bug.cgi?id=20351
+
+        * editing/DeleteButtonController.cpp:
+        (WebCore::DeleteButtonController::createDeletionUI):
+        * loader/CachedImage.cpp:
+        (WebCore::CachedImage::CachedImage):
+        (WebCore::brokenImage):
+        (WebCore::nullImage):
+        (WebCore::CachedImage::image):
+        (WebCore::CachedImage::notifyObservers):
+        (WebCore::CachedImage::createImage):
+        * loader/CachedImage.h:
+        * loader/icon/IconRecord.cpp:
+        (WebCore::IconRecord::setImageData):
+        (WebCore::IconRecord::loadImageFromResource):
+        * loader/icon/IconRecord.h:
+        * platform/graphics/BitmapImage.h:
+        (WebCore::BitmapImage::create):
+        * platform/graphics/GeneratedImage.h:
+        * platform/graphics/Gradient.cpp:
+        * platform/graphics/Gradient.h:
+        * platform/graphics/Image.cpp:
+        (WebCore::Image::nullImage):
+        * platform/graphics/Image.h:
+        * platform/graphics/ImageBuffer.h:
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::image):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::image):
+        (WebCore::ImageBuffer::getImageData):
+        (WebCore::ImageBuffer::putImageData):
+        * platform/graphics/cg/PDFDocumentImage.h:
+        (WebCore::PDFDocumentImage::create):
+        (WebCore::PDFDocumentImage::destroyDecodedData):
+        (WebCore::PDFDocumentImage::decodedSize):
+        * platform/graphics/gtk/ImageGtk.cpp:
+        (WebCore::Image::loadPlatformResource):
+        * platform/graphics/mac/ImageMac.mm:
+        (WebCore::Image::loadPlatformResource):
+        * rendering/RenderImage.cpp:
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paintOverflowControls):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::nativeImageForCurrentFrame):
+        * svg/graphics/SVGImage.h:
+        (WebCore::SVGImage::create):
+        (WebCore::SVGImage::destroyDecodedData):
+        (WebCore::SVGImage::decodedSize):
+        (WebCore::SVGImage::frameAtIndex):
+        * svg/graphics/cairo/SVGPaintServerPatternCairo.cpp:
+        (WebCore::SVGPaintServerPattern::setup):
+        * svg/graphics/cairo/SVGResourceMaskerCairo.cpp:
+        (WebCore::SVGResourceMasker::applyMask):
+        * svg/graphics/cg/SVGPaintServerPatternCg.cpp:
+        (WebCore::patternCallback):
+        * svg/graphics/cg/SVGResourceMaskerCg.mm:
+        (WebCore::SVGResourceMasker::applyMask):
+
+2008-08-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Niko.
+
+        Remove #ifdefs from CanvasStyle by using platform/Color.h
+        https://bugs.webkit.org/show_bug.cgi?id=20351
+
+        There are some down-sides to this commit.
+        This commit limits us to 255 levels of grey for calls like:
+        context.setStrokeStyle(.37, 1.0)
+        previously CG might have used up to 32bits to store the grey level
+        Since setStrokeStyle is not part of HTML5, I don't suspect the web will notice.
+
+        Likewise, setStrokeStyle/setFillStyle calls which used float colors are now limited
+        to RGBA32 (like all the rest of colors in WebCore), thus:
+        context.setStrokStyle(.37, .24, .456, .99) will now have the same precision as:
+        context.strokeStyle = "rgba(.37, .24, .456, .99)", which is to say RGBA32
+
+        If this is a problem for Dashboard, we can either roll out this commit
+        or add a beefier Color abstraction, which can be used internally by GraphicsContext
+        when keeping state, and then GraphicsContext can grow some additional set* routines
+        for setting the a grey/float/whatever fill and stroke.
+
+        * html/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setFillStyle):
+        * html/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::CanvasStyle):
+        (WebCore::colorWithOverrideAlpha):
+        (WebCore::CanvasStyle::applyStrokeColor):
+        (WebCore::CanvasStyle::applyFillColor):
+        * html/CanvasStyle.h:
+        * platform/graphics/Color.cpp:
+        (WebCore::colorFloatToRGBAByte):
+        (WebCore::makeRGBA32FromFloats):
+        * platform/graphics/Color.h:
+
+2008-08-13  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Fix for <rdar://problem/6137931>
+        https://bugs.webkit.org/show_bug.cgi?id=20360
+        Remove all parameters from the MIME type before checking with the MIME type registry
+
+        Tests: media/video-source-type-params.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::pickMedia): only pass the portion before the first ';'
+        to isSupportedMediaMIMEType()
+
+2008-08-13  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for <rdar://problem/6141345>
+
+        This patch refines findString and markAllMatchesForText functions'
+        interactions with disconnected frames. They no longer rely on
+        knowing where a range is relative to the visible region and work
+        with disconnected frames that contain frames.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::insideVisibleArea): Now returns a bool instead of
+        the visiblity enum.
+        (WebCore::Editor::firstVisibleRange): This now returns the very
+        first visible range in the document. It's no longer dependent on
+        searching forward.
+        (WebCore::Editor::lastVisibleRange): This now returns the very last
+        visible range in the document. It's no longer dependent on
+        searching backwards.
+        (WebCore::Editor::nextVisibleRange): This returns the next visible
+        range in the appropriate direction from the current range.
+        * editing/Editor.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::findString):
+        (WebCore::Frame::markAllMatchesForText):
+
+2008-08-13  Kevin Ollivier  <kevino@theolliviers.com>
+
+        wx build fix for case-sensitive platforms, like Linux.
+
+        * WebCoreSources.bkl:
+
+2008-08-13  Marco Barisione  <marco.barisione@collabora.co.uk>
+
+        Reviewed by Holger Freyther.
+
+        http://bugs.webkit.org/show_bug.cgi?id=16881
+        [GTK] PlatformScreenGtk is unimplemented
+
+        Original patch by Christian Dywan.
+
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::screenDepth):
+        (WebCore::screenDepthPerComponent):
+        (WebCore::screenIsMonochrome):
+        (WebCore::screenRect):
+        (WebCore::screenAvailableRect):
+
+2008-08-13  Jan Michael Alonzo  <jmalonzo@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        http://bugs.webkit.org/show_bug.cgi?id=20318
+        SharedTimerGtk should use G_PRIORITY_DEFAULT_IDLE for g_idle_add
+
+        g_idle_add is the same as g_idle_add_full with a priority of
+        G_PRIORITY_DEFAULT_IDLE, so we can safely use that.
+
+        * platform/gtk/SharedTimerGtk.cpp:
+        (WebCore::setSharedTimerFireTime):
+
+2008-08-13  Timothy Hatcher  <timothy@apple.com>
+
+        Changed the InspectorController so it can be notified when the
+        attached state of the Inspector changes in WebKit.
+
+        Reviewed by Kevin McCullough.
+
+        * WebCore.base.exp: Updated the symbol for setWindowVisible.
+        * page/InspectorController.cpp:
+        (WebCore::InspectorController::setWindowVisible): Added an attached argument,
+        that defaults to false.Call setAttachedWindow with the attached argument.
+        (WebCore::InspectorController::setAttachedWindow): Call the script version
+        of setAttachedWindow.
+        * page/InspectorController.h:
+        * page/inspector/inspector.js:
+        (WebInspector.setAttachedWindow): Set the attached property.
+
+2008-08-12  Timothy Hatcher  <timothy@apple.com>
+
+        Added a close button to the Inspector's toolbar when docked.
+
+        https://bugs.webkit.org/show_bug.cgi?id=14270
+
+        Reviewed by Kevin McCullough.
+
+        * page/InspectorController.cpp:
+        (WebCore::closeWindow): Call InspectorController::closeWindow.
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        Added closeWindow to the script class.
+        * page/InspectorController.h:
+        * page/inspector/Images/closeButtons.png: Added.
+        * page/inspector/inspector.css: Added and changed styles.
+        * page/inspector/inspector.html: Added the close button.
+        * page/inspector/inspector.js:
+        (WebInspector.loaded): Added click event listener to the close button.
+        (WebInspector.close): Call InspectorController.closeWindow.
+
+2008-08-12  Timothy Hatcher  <timothy@apple.com>
+
+        Make the docked Web Inspector resizable. This is the cross platform
+        portion of the code. Each InspectorClient needs to implement the
+        real resize code.
+
+        https://bugs.webkit.org/show_bug.cgi?id=14282
+
+        Reviewed by Kevin McCullough.
+
+        * loader/EmptyClients.h: Added an empty setAttachedWindowHeight.
+        * page/InspectorClient.h: Added setAttachedWindowHeight.
+        * page/InspectorController.cpp:
+        (WebCore::setAttachedWindowHeight): Call setAttachedWindowHeight
+        on the InspectorController.
+        (WebCore::InspectorController::setAttachedWindowHeight): Call
+        setAttachedWindowHeight on the client.
+        (WebCore::InspectorController::windowScriptObjectAvailable):
+        Added setAttachedWindowHeight to the script class.
+        * page/InspectorController.h:
+        * page/inspector/inspector.css: Make the cursor on the toolbar be
+        row-resize when docked.
+        * page/inspector/inspector.js:
+        (WebInspector.loaded): Always add the toolbarDragStart event listener.
+        (WebInspector.toolbarDragStart): Return early if we are not attached
+        and not on Leopard. Call WebInspector.elementDragStart.
+        (WebInspector.toolbarDragEnd): Call WebInspector.elementDragEnd.
+        (WebInspector.toolbarDrag): When attached call setAttachedWindowHeight,
+        otherwise call moveByUnrestricted.
+
+2008-08-13  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Holger.
+
+        Initialize m_zoomsTextOnly in the Settings constructor.
+
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+
+2008-08-13  Brad Hughes <bhughes@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix compiling of QtWebKit in release mode with the Intel C++ Compiler for Linux
+
+        The latest upgrade of the intel compiler allows us to compile all of
+        Qt with optimizations enabled (yay!).
+
+        * WebCore.pro:
+
+2008-08-13  Prasanth Ullattil  <prasanth.ullattil@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix QtWebKit not displaying content on 403 HTTP responses
+
+        Just like with 404 responses also display content with 403, as
+        used by http://audiio.ejamming.proteus-tech.com/audiio/profile/original_signup/
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::finish):
+
+2008-08-13  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Holger.
+
+        Qt part of https://bugs.webkit.org/show_bug.cgi?id=18994
+
+        Make the formatting of String::format() locale independent through the use of QString::vsprintf.
+
+        * platform/text/String.cpp:
+        (WebCore::String::format):
+
+2008-08-13  Simon Hausmann  <hausmann@webkit.org>
+
+        Reviewed by Lars.
+
+        Fix QWebFrame::setHtml() not setting the new contents immediately.
+
+        Added a setter to the DocumentLoader to toggle the deferred loading of the main
+        resource when it comes from substitute data.
+
+        Disable deferred loading of the main resource when we have valid substitute data,
+        as used by QWebFrame::setHtml.
+
+        * loader/DocumentLoader.h:
+
+2008-08-13  Mark Rowe  <mrowe@apple.com>
+
+        Speculative GTK build fix.
+
+        * GNUmakefile.am:  Add dependency info for JSSVGElementWrapperFactory.cpp.
+
+2008-08-13  Thiago Macieira  <tjmaciei@trolltech.com>
+
+        Reviewed by Simon.
+
+        Fix encoding of [ and ] in the host part of the URL
+
+        Until QUrl is fixed (making QUrl's tolerant parser more tolerant), we have to
+        add this workaround to the QUrl <> WebCore::KURL conversion operator so that it
+        doesn't encode [ and ] when they are found in the host part. That is, the
+        following URL:
+        http://[::1]/
+        is valid and should not be reencoded to:
+        http://%5b::1%5d/
+
+        * platform/qt/KURLQt.cpp:
+        (WebCore::KURL::operator QUrl):
+
+2008-08-12  Mihnea Ovidenie  <mihnea@adobe.com>
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=19891
+        Broken HTML object elements cause de-reference of pointer to freed memory.
+        If we fail to load an image for an object tag and we no longer believe the object tag points at
+        an image, then clear m_imageLoader in the HTMLObjectElement so that we attempt to render the
+        fall back content.
+
+        Reviewed by Dave Hyatt and Alexey Proskuryakov.
+
+        Test: http/tests/misc/object-image-error-with-onload.html
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::renderFallbackContent):
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+
+2008-08-12  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Dave.
+
+        Fixes: https://bugs.webkit.org/show_bug.cgi?id=19798
+        Masks are translated, and the mask images are swapped on the y-axis.
+
+        Turned out that http://trac.webkit.org/changeset/31830/trunk/WebCore/svg/graphics/cg/SVGResourceMaskerCg.mm
+        is guilty. GraphicsContext::clipToImageBuffer() does some extra transformations that SVGResourcesMaskerCg does not want.
+
+        Long term goal is to remove the SVGResource*/SVGPaintServer* classes anyway, so it's okay to duplicate
+        the "clip to image buffer" functionality, in the CG specific SVGResourceMaskerCg class - as it was before.
+
+        * svg/graphics/cg/SVGResourceMaskerCg.mm:
+        (WebCore::SVGResourceMasker::applyMask): Changed back to use CG clipping again.
+
+2008-08-12  Dan Bernstein  <mitz@apple.com>
+
+        - WebCore part of <rdar://problem/6121636>
+          Make fast*alloc() abort() on failure and add "try" variants that
+          return NULL on failure.
+
+        Reviewed by Darin Adler.
+
+        * platform/Arena.cpp:
+        (WebCore::ArenaAllocate): Removed null checking of fastMalloc()'s
+        result.
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::create): Changed to use tryFastCalloc().
+
+2008-08-12  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix https://bugs.webkit.org/show_bug.cgi?id=19348
+          <rdar://problem/5978447> REGRESSION (r34193): Setting the size of a frame with javascript document.body.row no longer works
+
+        Test: fast/frames/frameset-style-recalc.html
+
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::recalcStyle): Changed to call the base
+        class implementation after marking for layout.
+
+2008-08-12  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        - move shouldUpdateWhenOffscreen from Settings to FrameView and rename it shouldUpdateWhileHidden
+
+        * WebCore.base.exp:
+        * page/FrameView.cpp:
+        (WebCore::FrameViewPrivate::FrameViewPrivate):
+        (WebCore::FrameView::shouldUpdateWhileHidden):
+        (WebCore::FrameView::setShouldUpdateWhileHidden):
+        * page/FrameView.h:
+        * page/Settings.cpp:
+        * page/Settings.h:
+
+2008-08-12  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * bindings/js/JSSVGPODTypeWrapper.h: Align
+        JSSVGDynamicPODTypeWrapper's and JSSVGStaticPODTypeWrapperWithParent's
+        members on 16-byte boundaries to avoid an alignment warning.
+
+2008-08-12  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Oliver.
+
+        Add new dynamice-update layout tests covering SVGMarkerElement.
+        Fix bug: SVGMarkerElement's SVG DOM function calls don't update rendering.
+        Fix orientAngle/orientType confusion: "auto" orient should always return "0" as angle.
+
+        Tests: svg/dynamic-updates/SVGMarkerElement-dom-markerHeight-attr.html
+               svg/dynamic-updates/SVGMarkerElement-dom-markerUnits-attr.html
+               svg/dynamic-updates/SVGMarkerElement-dom-markerWidth-attr.html
+               svg/dynamic-updates/SVGMarkerElement-dom-orient-attr.html
+               svg/dynamic-updates/SVGMarkerElement-dom-refX-attr.html
+               svg/dynamic-updates/SVGMarkerElement-dom-refY-attr.html
+               svg/dynamic-updates/SVGMarkerElement-svgdom-markerHeight-prop.html
+               svg/dynamic-updates/SVGMarkerElement-svgdom-markerUnits-prop.html
+               svg/dynamic-updates/SVGMarkerElement-svgdom-markerWidth-prop.html
+               svg/dynamic-updates/SVGMarkerElement-svgdom-orientAngle-prop.html
+               svg/dynamic-updates/SVGMarkerElement-svgdom-orientType-prop.html
+               svg/dynamic-updates/SVGMarkerElement-svgdom-refX-prop.html
+               svg/dynamic-updates/SVGMarkerElement-svgdom-refY-prop.html
+               svg/dynamic-updates/SVGMarkerElement-svgdom-setOrientToAngle-call.html
+               svg/dynamic-updates/SVGMarkerElement-svgdom-setOrientToAuto-call.html
+
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::SVGMarkerElement):
+        (WebCore::SVGMarkerElement::parseMappedAttribute):
+        (WebCore::SVGMarkerElement::svgAttributeChanged):
+        (WebCore::SVGMarkerElement::childrenChanged):
+        (WebCore::SVGMarkerElement::setOrientToAuto):
+        (WebCore::SVGMarkerElement::setOrientToAngle):
+        (WebCore::SVGMarkerElement::canvasResource):
+
+2008-08-12  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Oliver.
+
+        Add new dynamic-update layout tests covering SVGImageElement.
+        Fix bug: SVGImageElement doesn't react on 'preserveAspectRatio' changes.
+
+        Tests: svg/dynamic-updates/SVGImageElement-dom-height-attr.html
+               svg/dynamic-updates/SVGImageElement-dom-preserveAspectRatio-attr.html
+               svg/dynamic-updates/SVGImageElement-dom-width-attr.html
+               svg/dynamic-updates/SVGImageElement-dom-x-attr.html
+               svg/dynamic-updates/SVGImageElement-dom-y-attr.html
+               svg/dynamic-updates/SVGImageElement-svgdom-height-prop.html
+               svg/dynamic-updates/SVGImageElement-svgdom-preserveAspectRatio-prop.html
+               svg/dynamic-updates/SVGImageElement-svgdom-width-prop.html
+               svg/dynamic-updates/SVGImageElement-svgdom-x-prop.html
+               svg/dynamic-updates/SVGImageElement-svgdom-y-prop.html
+
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::svgAttributeChanged):
+
+2008-08-11  Anthony Ricaud  <rik24d@gmail.com>
+
+        Changed Option/Alt-Up or Down in CSS editing when the value is
+        near zero to jump to the next integer.
+
+        Reviewed by Tim Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20326
+
+        * page/inspector/StylesSidebarPane.js:
+
+2008-08-11  Anthony Ricaud  <rik24d@gmail.com>
+
+        Changed the line highlight transition for an easier animation.
+
+        Reviewed by Tim Hatcher.
+
+        * page/inspector/SourceFrame.js:
+
+2008-08-11  Keishi Hattori  <casey.hattori@gmail.com>
+
+        Added support for some Firebug Command Line APIs.
+
+        Reviewed by Tim Hatcher.
+
+        https://bugs.webkit.org/show_bug.cgi?id=19867
+        https://bugs.webkit.org/show_bug.cgi?id=19868
+        https://bugs.webkit.org/show_bug.cgi?id=19869
+        https://bugs.webkit.org/show_bug.cgi?id=19875
+        https://bugs.webkit.org/show_bug.cgi?id=19876
+        https://bugs.webkit.org/show_bug.cgi?id=19880
+
+        * page/inspector/Console.js:
+        (WebInspector.Console.prototype._evalInInspectedWindow):
+        Create an object on the inspected window that holds the console
+        command line API functions. This object is used in a with statement
+        around the typed expression.
+
+2008-08-11  Nikolas Zimmermann  <zimmermann@kde.org>
+
+        Reviewed by Antti.
+
+        Fixes: http://bugs.webkit.org/show_bug.cgi?id=17736
+
+        JS wrapper objects around SVG POD types, that contain other SVG POD types with writable properties
+        failed to update. Modification of the values were completly ignored (ie. transform.matrix.a = 50, didn't take any effect)
+
+        Added tests: svg/custom/svg-modify-currentTranslate.html
+                     svg/custom/tearoffs-with-tearoffs.html
+                     svg/custom/immutable-properties.html
+
+        Fixed tests: svg/dynamic-updates/SVGLinearGradientElement-svgdom-gradientTransform-prop.html
+
+        * bindings/js/JSSVGPODTypeWrapper.h:
+        (WebCore::JSSVGDynamicPODTypeWrapper::commitChange):
+        (WebCore::JSSVGStaticPODTypeWrapperWithPODTypeParent::create):
+        (WebCore::JSSVGStaticPODTypeWrapperWithPODTypeParent::commitChange):
+        (WebCore::JSSVGStaticPODTypeWrapperWithPODTypeParent::JSSVGStaticPODTypeWrapperWithPODTypeParent):
+        (WebCore::JSSVGStaticPODTypeWrapperWithParent::create):
+        (WebCore::JSSVGStaticPODTypeWrapperWithParent::operator PODType):
+        (WebCore::JSSVGStaticPODTypeWrapperWithParent::commitChange):
+        (WebCore::JSSVGStaticPODTypeWrapperWithParent::JSSVGStaticPODTypeWrapperWithParent):
+        * bindings/scripts/CodeGenerator.pm:
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * svg/SVGSVGElement.idl: Add [Immutable] markers to SVG POD attributes, that contain POD types with writable attributes.
+        * svg/SVGZoomEvent.idl:  SVG specification explicitely demands these attributes to be readonly, even its content.
+
+2008-08-11  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by John and Anders
+
+        Fix for <rdar://problem/6141797>
+
+        When WebArchives were entirely a WebKit concept, there was a guarantee that a WebResource
+        would never have nil data.
+
+        When they were pushed down into WebCore, that guarantee was lost, subtly changing a few
+        semantics with some WebKit applications.
+
+        The guarantee was a good one and should be restored.
+
+        Note that ApplicationCacheResource doesn't need any updates to follow this rule as it already
+        creates an empty data object in the case of null data for its own purposes.
+
+        * loader/SubstituteResource.h:
+        (WebCore::SubstituteResource::SubstituteResource): ASSERT that the data is not null.  This
+          well help any future subclassers not make this mistake.
+
+        * loader/archive/ArchiveResource.cpp:
+        (WebCore::ArchiveResource::create): Return 0 if the data is null.
+
+2008-08-11  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dave Hyatt
+
+        https://bugs.webkit.org/show_bug.cgi?id=20328
+        Fix a problem when an 'all' transition transition with more than
+        one property changing is interrupted, and did some AnimationController
+        cleanup.
+
+        Test: transitions/interrupted-all-transition.html
+
+        * page/AnimationController.cpp:
+        (WebCore::ImplicitAnimation::ImplicitAnimation):
+        (WebCore::AnimationControllerPrivate::blendProperties):
+        (WebCore::CompositeAnimation::updateTransitions):
+        (WebCore::CompositeAnimation::cleanupFinishedAnimations):
+        (WebCore::CompositeAnimation::setTransitionStartTime):
+        (WebCore::CompositeAnimation::overrideImplicitAnimations):
+        (WebCore::CompositeAnimation::resumeOverriddenImplicitAnimations):
+        (WebCore::ImplicitAnimation::animate):
+        (WebCore::ImplicitAnimation::onAnimationEnd):
+        (WebCore::ImplicitAnimation::sendTransitionEvent):
+        (WebCore::ImplicitAnimation::affectsProperty):
+        (WebCore::KeyframeAnimation::endAnimation):
+        (WebCore::KeyframeAnimation::onAnimationEnd):
+
+2008-08-11  Kevin McCullough  <kmccullough@apple.com>
+
+        Reviewed by Tim.
+
+        - Because console messages have group levels now, newly created messages
+        that do not specify the level lose their message since the number of
+        arguments is wrong.
+
+        * page/inspector/Console.js:
+        * page/inspector/Resource.js:
+
+2008-08-11  Alp Toker  <alp@nuanti.com>
+
+        Build fix. Add new files from r35666 (WebKitAnimationEvent). Also take
+        the opportunity to sort the sources lists.
+
+        * GNUmakefile.am:
+
+2008-08-11  Timothy Hatcher  <timothy@apple.com>
+
+        Speed up the the JavaScript syntax highlighter by generating
+        the finders only once per script instead of per line.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20346
+
+        Reviewed by Adam Roben.
+
+        * page/inspector/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._syntaxHighlightJavascriptLine):
+        Removed, factored into syntaxHighlightJavascript as an inline function.
+        (WebInspector.SourceFrame.prototype.syntaxHighlightJavascript):
+        Pulled in the _syntaxHighlightJavascriptLine so it will create a closure.
+        Generate the finders before iterating the lines.
+
+2008-08-11  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * WebCore.vcproj/WebCore.vcproj: Added JSWebKitAnimationEvent.cpp and
+        JSWebKitTransitionEvent.cpp to the project. Let VS reformat the file,
+        too.
+
+2008-08-11  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        - fix <rdar://problem/6131096> Reproducible crash in CounterNode::isReset under guard malloc
+
+        Test: fast/css/counters/invalidate-cached-counter-node.html
+
+        * rendering/RenderContainer.cpp:
+        (WebCore::RenderContainer::invalidateCounters): Added. Invalidates all
+        RenderCounters in :before and :after content.
+        * rendering/RenderContainer.h:
+        * rendering/RenderCounter.cpp:
+        (WebCore::RenderCounter::isCounter): Renamed isRenderCounter() to this
+        to match the RenderObject method.
+        (WebCore::RenderCounter::invalidate): Added. Resets the cached
+        CounterNode and invalidates the object's layout and preferred widths.
+        (WebCore::destroyCounterNodeChildren): Added a call to
+        invalidateCounters().
+        * rendering/RenderCounter.h:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::invalidateCounters):
+
+2008-08-11  Dean Jackson  <dino@apple.com>
+
+        Implement CSS Animation and Transition Events
+        https://bugs.webkit.org/show_bug.cgi?id=20337
+
+        Implement the events defined in the CSS Animations
+        and Transitions specifications so code can react
+        to animations and transitions.
+
+        Reviewed by Tim Hatcher and Dave Hyatt.
+
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * WebCoreSources.bkl:
+            Build configs for new files
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        * bindings/js/JSDOMWindowBase.h:
+        * bindings/js/JSEventCustom.cpp:
+        * dom/Document.h:
+        * dom/Event.cpp:
+        * dom/Event.h:
+        * dom/EventTarget.cpp:
+        * dom/EventTargetNode.cpp:
+        * dom/EventTargetNode.h:
+        * html/HTMLElement.cpp:
+        * page/AnimationController.cpp:
+            do all the new event stuff
+
+        * html/HTMLAttributeNames.in:
+            the onwebkitanimation* and onwebkittransitionend attrs
+
+        * dom/WebKitAnimationEvent.cpp: Added.
+        * dom/WebKitAnimationEvent.h: Added.
+        * dom/WebKitAnimationEvent.idl: Added.
+        * dom/WebKitTransitionEvent.cpp: Added.
+        * dom/WebKitTransitionEvent.h: Added.
+        * dom/WebKitTransitionEvent.idl: Added.
+            New files for the events
+
+        * manual-tests/transition-events.html: Added.
+            New testfile
+
+2008-08-11  Adam Roben  <aroben@apple.com>
+
+        Add a ForwardingHeader for wtf/NotFound.h
+
+        Rubberstamped by Darin Adler.
+
+        * ForwardingHeaders/wtf/NotFound.h: Added.
+
+2008-08-11  Timothy Hatcher  <timothy@apple.com>
+
+        Fixes a bug where error bubbles in JavaScript resources would
+        be clobbered by the syntax highlighter.
+
+        https://bugs.webkit.org/show_bug.cgi?id=20345
+
+        Reviewed by Adam Roben.
+
+        * manual-tests/inspector/resources/script-error.js: Added.
+        * manual-tests/inspector/styled-error-bubbles-in-scripts.html: Added.
+        * page/inspector/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype._addMessageToSource):
+        Check the nodeType and not the nodeName, this is less fragile.
+        (WebInspector.SourceFrame.prototype._syntaxHighlightJavascriptLine):
+        Check if the lastChild is an error bubble, if so remove it before
+        getting the line's textContent. Add the error bubble back at the end.
+
+== Rolled over to ChangeLog-2008-08-10 ==
diff --git a/src/3rdparty/webkit/WebCore/DerivedSources.cpp b/src/3rdparty/webkit/WebCore/DerivedSources.cpp
index f698913..3075a4b 100644
--- a/src/3rdparty/webkit/WebCore/DerivedSources.cpp
+++ b/src/3rdparty/webkit/WebCore/DerivedSources.cpp
@@ -32,6 +32,8 @@
 #include "JSCanvasRenderingContext2D.cpp"
 #include "JSCDATASection.cpp"
 #include "JSCharacterData.cpp"
+#include "JSClientRect.cpp"
+#include "JSClientRectList.cpp"
 #include "JSClipboard.cpp"
 #include "JSComment.cpp"
 #include "JSConsole.cpp"
@@ -52,6 +54,8 @@
 #include "JSCSSVariablesDeclaration.cpp"
 #include "JSCSSVariablesRule.cpp"
 #include "JSDatabase.cpp"
+#include "JSDataGridColumn.cpp"
+#include "JSDataGridColumnList.cpp"
 #include "JSDocument.cpp"
 #include "JSDocumentFragment.cpp"
 #include "JSDocumentType.cpp"
@@ -60,14 +64,12 @@
 #include "JSDOMImplementation.cpp"
 #include "JSDOMParser.cpp"
 #include "JSDOMSelection.cpp"
-#include "JSDOMStringList.cpp"
 #include "JSDOMWindow.cpp"
 #include "JSElement.cpp"
 #include "JSEntity.cpp"
 #include "JSEntityReference.cpp"
 #include "JSEvent.cpp"
 #include "JSEventException.cpp"
-#include "JSEventTargetNode.cpp"
 #include "JSFile.cpp"
 #include "JSFileList.cpp"
 #include "JSHistory.cpp"
@@ -83,6 +85,10 @@
 #include "JSHTMLButtonElement.cpp"
 #include "JSHTMLCanvasElement.cpp"
 #include "JSHTMLCollection.cpp"
+#include "JSHTMLDataGridElement.cpp"
+#include "JSHTMLDataGridCellElement.cpp"
+#include "JSHTMLDataGridColElement.cpp"
+#include "JSHTMLDataGridRowElement.cpp"
 #include "JSHTMLDirectoryElement.cpp"
 #include "JSHTMLDivElement.cpp"
 #include "JSHTMLDListElement.cpp"
@@ -312,8 +318,18 @@
 #include "JSTreeWalker.cpp"
 #include "JSUIEvent.cpp"
 #include "JSVoidCallback.cpp"
+#include "JSWebKitAnimationEvent.cpp"
+#include "JSWebKitCSSKeyframeRule.cpp"
+#include "JSWebKitCSSKeyframesRule.cpp"
 #include "JSWebKitCSSTransformValue.cpp"
+#include "JSWebKitCSSMatrix.cpp"
+#include "JSWebKitPoint.cpp"
+#include "JSWebKitTransitionEvent.cpp"
 #include "JSWheelEvent.cpp"
+#include "JSWorker.cpp"
+#include "JSWorkerContext.cpp"
+#include "JSWorkerLocation.cpp"
+#include "JSWorkerNavigator.cpp"
 #include "JSXMLHttpRequest.cpp"
 #include "JSXMLHttpRequestException.cpp"
 #include "JSXMLHttpRequestProgressEvent.cpp"
@@ -325,7 +341,6 @@
 #include "JSXPathNSResolver.cpp"
 #include "JSXPathResult.cpp"
 #include "JSXSLTProcessor.cpp"
-#include "SVGElementFactory.cpp"
 #include "UserAgentStyleSheetsData.cpp"
 
 // On MSVC, including StaticConstructors.h causes all global objects not to be
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/debugger/Debugger.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/debugger/Debugger.h
index 69b7bae..e6cfede 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/debugger/Debugger.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/debugger/Debugger.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Debugger_h
+#define WebCore_FWD_Debugger_h
 #include <JavaScriptCore/Debugger.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/debugger/DebuggerActivation.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/debugger/DebuggerActivation.h
new file mode 100644
index 0000000..c241bb7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/debugger/DebuggerActivation.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_DebuggerActivation_h
+#define WebCore_FWD_DebuggerActivation_h
+#include <JavaScriptCore/DebuggerActivation.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/debugger/DebuggerCallFrame.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/debugger/DebuggerCallFrame.h
index 474fec0..4a23742 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/debugger/DebuggerCallFrame.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/debugger/DebuggerCallFrame.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_DebuggerCallFrame_h
+#define WebCore_FWD_DebuggerCallFrame_h
 #include <JavaScriptCore/DebuggerCallFrame.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/interpreter/CallFrame.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/interpreter/CallFrame.h
index c8c60d4..8c3acee 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/interpreter/CallFrame.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/interpreter/CallFrame.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_CallFrame_h
+#define WebCore_FWD_CallFrame_h
 #include <JavaScriptCore/CallFrame.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/interpreter/Interpreter.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/interpreter/Interpreter.h
index 175ddce..1235c21 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/interpreter/Interpreter.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/interpreter/Interpreter.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Interpreter_h
+#define WebCore_FWD_Interpreter_h
 #include <JavaScriptCore/Interpreter.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/jit/JITCode.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/jit/JITCode.h
new file mode 100644
index 0000000..b996615
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/jit/JITCode.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_JITCode_h
+#define WebCore_FWD_JITCode_h
+#include <JavaScriptCore/JITCode.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/masm/X86Assembler.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/masm/X86Assembler.h
index e1f0b4d..2b7dd6c 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/masm/X86Assembler.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/masm/X86Assembler.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_X86Assembler_h
+#define WebCore_FWD_X86Assembler_h
 #include <JavaScriptCore/X86Assembler.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/Parser.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/Parser.h
index 10a2775..863df59 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/Parser.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/Parser.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Parser_h
+#define WebCore_FWD_Parser_h
 #include <JavaScriptCore/Parser.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/SourceCode.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/SourceCode.h
index 17a5069..0a1079b 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/SourceCode.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/SourceCode.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_SourceCode_h
+#define WebCore_FWD_SourceCode_h
 #include <JavaScriptCore/SourceCode.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/SourceProvider.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/SourceProvider.h
index 487aae9..0eb078b 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/SourceProvider.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/parser/SourceProvider.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_SourceProvider_h
+#define WebCore_FWD_SourceProvider_h
 #include <JavaScriptCore/SourceProvider.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/pcre/pcre.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/pcre/pcre.h
index 47c0d3d..198acc9 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/pcre/pcre.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/pcre/pcre.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_pcre_h
+#define WebCore_FWD_pcre_h
 #include <JavaScriptCore/pcre.h>
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/Profile.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/Profile.h
index b591262..d26bafd 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/Profile.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/Profile.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_Profile_h
+#define WebCore_FWD_Profile_h
 #include <JavaScriptCore/Profile.h>
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/ProfileNode.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/ProfileNode.h
index 488449f..a19a07e 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/ProfileNode.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/ProfileNode.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_ProfileNode_h
+#define WebCore_FWD_ProfileNode_h
 #include <JavaScriptCore/ProfileNode.h>
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/Profiler.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/Profiler.h
index 56c6e0e..06139ff 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/Profiler.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/profiler/Profiler.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_Profiler_h
+#define WebCore_FWD_Profiler_h
 #include <JavaScriptCore/Profiler.h>
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ArgList.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ArgList.h
index 02955d4..ce334d4 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ArgList.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ArgList.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ArgList_h
+#define WebCore_FWD_ArgList_h
 #include <JavaScriptCore/ArgList.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ArrayPrototype.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ArrayPrototype.h
index 9719fb0..51b7996 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ArrayPrototype.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ArrayPrototype.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ArrayPrototype_h
+#define WebCore_FWD_ArrayPrototype_h
 #include <JavaScriptCore/ArrayPrototype.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/BooleanObject.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/BooleanObject.h
index 3cea7c6..49d6fc3 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/BooleanObject.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/BooleanObject.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_BooleanObject_h
+#define WebCore_FWD_BooleanObject_h
 #include <JavaScriptCore/BooleanObject.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ByteArray.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ByteArray.h
deleted file mode 100644
index f4f40dc..0000000
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ByteArray.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/ByteArray.h>
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/CallData.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/CallData.h
index 15a6028..03ecef8 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/CallData.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/CallData.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_CallData_h
+#define WebCore_FWD_CallData_h
 #include <JavaScriptCore/CallData.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Collector.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Collector.h
index 6d8b5cd..d133a27 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Collector.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Collector.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Collector_h
+#define WebCore_FWD_Collector_h
 #include <JavaScriptCore/Collector.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/CollectorHeapIterator.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/CollectorHeapIterator.h
index 98166ab..fcfe26d 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/CollectorHeapIterator.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/CollectorHeapIterator.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_CollectorHeapIterator_h
+#define WebCore_FWD_CollectorHeapIterator_h
 #include <JavaScriptCore/CollectorHeapIterator.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Completion.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Completion.h
index d6a081f..9dd6291 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Completion.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Completion.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Completion_h
+#define WebCore_FWD_Completion_h
 #include <JavaScriptCore/Completion.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ConstructData.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ConstructData.h
index f8d3d3c..bd04e51 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ConstructData.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ConstructData.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ConstructData_h
+#define WebCore_FWD_ConstructData_h
 #include <JavaScriptCore/ConstructData.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/DateInstance.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/DateInstance.h
index 2429283..c75cfed 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/DateInstance.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/DateInstance.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_DateInstance_h
+#define WebCore_FWD_DateInstance_h
 #include <JavaScriptCore/DateInstance.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Error.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Error.h
index 4fbaabd..7ddeab1 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Error.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Error.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Error_h
+#define WebCore_FWD_Error_h
 #include <JavaScriptCore/Error.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/FunctionConstructor.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/FunctionConstructor.h
index bc49dca..a1962ed 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/FunctionConstructor.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/FunctionConstructor.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_FunctionConstructor_h
+#define WebCore_FWD_FunctionConstructor_h
 #include <JavaScriptCore/FunctionConstructor.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/FunctionPrototype.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/FunctionPrototype.h
index 3f71e8e..1db3b83 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/FunctionPrototype.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/FunctionPrototype.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_FunctionPrototype_h
+#define WebCore_FWD_FunctionPrototype_h
 #include <JavaScriptCore/FunctionPrototype.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Identifier.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Identifier.h
index 5c925eb..63f1e42 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Identifier.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Identifier.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Identifier_h
+#define WebCore_FWD_Identifier_h
 #include <JavaScriptCore/Identifier.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/InitializeThreading.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/InitializeThreading.h
index 835097b..bd4f735 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/InitializeThreading.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/InitializeThreading.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_InitializeThreadingn_h
+#define WebCore_FWD_InitializeThreading_h
 #include <JavaScriptCore/InitializeThreading.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/InternalFunction.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/InternalFunction.h
index f447f78..78df9aa 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/InternalFunction.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/InternalFunction.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_InternalFunction_h
+#define WebCore_FWD_InternalFunction_h
 #include <JavaScriptCore/InternalFunction.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSArray.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSArray.h
index 9d70688..5271c27 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSArray.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSArray.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSArray_h
+#define WebCore_FWD_JSArray_h
 #include <JavaScriptCore/JSArray.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSByteArray.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSByteArray.h
index 9e13ace..ce5140f 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSByteArray.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSByteArray.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSByteArray_h
+#define WebCore_FWD_JSByteArray_h
 #include <JavaScriptCore/JSByteArray.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSFunction.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSFunction.h
index 396407d..614b3da 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSFunction.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSFunction.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSFunction_h
+#define WebCore_FWD_JSFunction_h
 #include <JavaScriptCore/JSFunction.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSGlobalData.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSGlobalData.h
index e5f143a..3f98c22 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSGlobalData.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSGlobalData.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSGlobalData_h
+#define WebCore_FWD_JSGlobalData_h
 #include <JavaScriptCore/JSGlobalData.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSGlobalObject.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSGlobalObject.h
index 915d87a..47e78b2 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSGlobalObject.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSGlobalObject.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSGlobalObject_h
+#define WebCore_FWD_JSGlobalObject_h
 #include <JavaScriptCore/JSGlobalObject.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSLock.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSLock.h
index 70ad81d..8e6a629 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSLock.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSLock.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSLock_h
+#define WebCore_FWD_JSLock_h
 #include <JavaScriptCore/JSLock.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSNumberCell.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSNumberCell.h
index 3c68938..e8d3227 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSNumberCell.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSNumberCell.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSNumberCell_h
+#define WebCore_FWD_JSNumberCell_h
 #include <JavaScriptCore/JSNumberCell.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSObject.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSObject.h
index 45133f3..6c79855 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSObject.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSObject.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSObject_h
+#define WebCore_FWD_JSObject_h
 #include <JavaScriptCore/JSObject.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSString.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSString.h
index 195ed21..6409607 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSString.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSString.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSString_h
+#define WebCore_FWD_JSString_h
 #include <JavaScriptCore/JSString.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSValue.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSValue.h
index ebbed6c..d4c21ca 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSValue.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/JSValue.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_JSValue_h
+#define WebCore_FWD_JSValue_h
 #include <JavaScriptCore/JSValue.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Lookup.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Lookup.h
index 0622dca..99936d9 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Lookup.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Lookup.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Lookup_h
+#define WebCore_FWD_Lookup_h
 #include <JavaScriptCore/Lookup.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ObjectPrototype.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ObjectPrototype.h
index 54e60b7..f890af1 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ObjectPrototype.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/ObjectPrototype.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ObjectPrototype_h
+#define WebCore_FWD_ObjectPrototype_h
 #include <JavaScriptCore/ObjectPrototype.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Operations.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Operations.h
index ab763a6..95ed34c 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Operations.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Operations.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Operations_h
+#define WebCore_FWD_Operations_h
 #include <JavaScriptCore/Operations.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PropertyMap.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PropertyMap.h
index d9348b4..fc40963 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PropertyMap.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PropertyMap.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_PropertyMap_h
+#define WebCore_FWD_PropertyMap_h
 #include <JavaScriptCore/PropertyMap.h>
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PropertyNameArray.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PropertyNameArray.h
index 0840208..2fdf2d0 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PropertyNameArray.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PropertyNameArray.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_PropertyNameArray_h
+#define WebCore_FWD_PropertyNameArray_h
 #include <JavaScriptCore/PropertyNameArray.h>
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Protect.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Protect.h
index 0ba5798..76dc11c 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Protect.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Protect.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_Protect_h
+#define WebCore_FWD_Protect_h
 #include <JavaScriptCore/Protect.h>
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PrototypeFunction.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PrototypeFunction.h
index c3f3ea5..9a46fd7 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PrototypeFunction.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/PrototypeFunction.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_PrototypeFunction_h
+#define WebCore_FWD_PrototypeFunction_h
 #include <JavaScriptCore/PrototypeFunction.h>
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringObject.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringObject.h
index ca73cc0..0b9a23b 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringObject.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringObject.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_StringObject_h
+#define WebCore_FWD_StringObject_h
 #include <JavaScriptCore/StringObject.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringObjectThatMasqueradesAsUndefined.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringObjectThatMasqueradesAsUndefined.h
index 9fd9612..6faa056 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringObjectThatMasqueradesAsUndefined.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringObjectThatMasqueradesAsUndefined.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_StringObjectThatMasqueradesAsUndefined_h
+#define WebCore_FWD_StringObjectThatMasqueradesAsUndefined_h
 #include <JavaScriptCore/StringObjectThatMasqueradesAsUndefined.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringPrototype.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringPrototype.h
index ece7fdb..f0786d4 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringPrototype.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/StringPrototype.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_StringPrototype_h
+#define WebCore_FWD_StringPrototype_h
 #include <JavaScriptCore/StringPrototype.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Structure.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Structure.h
index 81853f3..2333978 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Structure.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/Structure.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Structure_h
+#define WebCore_FWD_Structure_h
 #include <JavaScriptCore/Structure.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/SymbolTable.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/SymbolTable.h
index 0868c02..cb099a0 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/SymbolTable.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/SymbolTable.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_SymbolTable_h
+#define WebCore_FWD_SymbolTable_h
 #include <JavaScriptCore/SymbolTable.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/UString.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/UString.h
index 7a36767..d985aa5 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/UString.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/runtime/UString.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_UString_h
+#define WebCore_FWD_UString_h
 #include <JavaScriptCore/UString.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wrec/WREC.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wrec/WREC.h
index cfc4aff..5749ed9 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wrec/WREC.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wrec/WREC.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_WREC_h
+#define WebCore_FWD_WREC_h
 #include <JavaScriptCore/WREC.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ASCIICType.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ASCIICType.h
index f2258d2..5851cc6 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ASCIICType.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ASCIICType.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ASCIICType_h
+#define WebCore_FWD_ASCIICType_h
 #include <JavaScriptCore/ASCIICType.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/AlwaysInline.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/AlwaysInline.h
index e591f71..e234162 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/AlwaysInline.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/AlwaysInline.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_AlwaysInline_h
+#define WebCore_FWD_AlwaysInline_h
 #include <JavaScriptCore/AlwaysInline.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Assertions.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Assertions.h
index 2144410..5445be4 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Assertions.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Assertions.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Assertions_h
+#define WebCore_FWD_Assertions_h
 #include <JavaScriptCore/Assertions.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ByteArray.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ByteArray.h
new file mode 100644
index 0000000..9c078c9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ByteArray.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_ByteArray_h
+#define WebCore_FWD_ByteArray_h
+#include <JavaScriptCore/ByteArray.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/CrossThreadRefCounted.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/CrossThreadRefCounted.h
new file mode 100644
index 0000000..26987ef
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/CrossThreadRefCounted.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/CrossThreadRefCounted.h>
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/CurrentTime.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/CurrentTime.h
new file mode 100644
index 0000000..0070915
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/CurrentTime.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_CurrentTime_h
+#define WebCore_FWD_CurrentTime_h
+#include <JavaScriptCore/CurrentTime.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/DateMath.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/DateMath.h
new file mode 100644
index 0000000..4135742
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/DateMath.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_DateMath_h
+#define WebCore_FWD_DateMath_h
+#include <JavaScriptCore/DateMath.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Deque.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Deque.h
index 81bd70a..a4eee78 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Deque.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Deque.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Deque_h
+#define WebCore_FWD_Deque_h
 #include <JavaScriptCore/Deque.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/DisallowCType.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/DisallowCType.h
index 445944b..c4d59ac 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/DisallowCType.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/DisallowCType.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_DisallowCType_h
+#define WebCore_FWD_DisallowCType_h
 #include <JavaScriptCore/DisallowCType.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/FastAllocBase.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/FastAllocBase.h
new file mode 100644
index 0000000..6e50bd8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/FastAllocBase.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_FastAllocBase_h
+#define WebCore_FWD_FastAllocBase_h
+#include <JavaScriptCore/FastAllocBase.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/FastMalloc.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/FastMalloc.h
index 1701231..b883c0b 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/FastMalloc.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/FastMalloc.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_FastMalloc_h
+#define WebCore_FWD_FastMalloc_h
 #include <JavaScriptCore/FastMalloc.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Forward.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Forward.h
index 2d707ec..3e6b8c8 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Forward.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Forward.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Forward_h
+#define WebCore_FWD_Forward_h
 #include <JavaScriptCore/Forward.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/GetPtr.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/GetPtr.h
index aedd784..5a36ce2 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/GetPtr.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/GetPtr.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_GetPtr_h
+#define WebCore_FWD_GetPtr_h
 #include <JavaScriptCore/GetPtr.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashCountedSet.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashCountedSet.h
index 7388f5a..c92e9f0 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashCountedSet.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashCountedSet.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_HashCountedSet_h
+#define WebCore_FWD_HashCountedSet_h
 #include <JavaScriptCore/HashCountedSet.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashFunctions.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashFunctions.h
index 0fa568a..65e110d 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashFunctions.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashFunctions.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_HashFunctions_h
+#define WebCore_FWD_HashFunctions_h
 #include <JavaScriptCore/HashFunctions.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashMap.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashMap.h
index 9f262e2..68ea68e 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashMap.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashMap.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_HashMap_h
+#define WebCore_FWD_HashMap_h
 #include <JavaScriptCore/HashMap.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashSet.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashSet.h
index cfe2d80..a4cf32b 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashSet.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashSet.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_HashSet_h
+#define WebCore_FWD_HashSet_h
 #include <JavaScriptCore/HashSet.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashTable.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashTable.h
index a5e4d57..5975685 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashTable.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashTable.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_HashTable_h
+#define WebCore_FWD_HashTable_h
 #include <JavaScriptCore/HashTable.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashTraits.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashTraits.h
index 412fa98..3cf24cb 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashTraits.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/HashTraits.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_HashTraits_h
+#define WebCore_FWD_HashTraits_h
 #include <JavaScriptCore/HashTraits.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ListHashSet.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ListHashSet.h
index 4aef773..c528b78 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ListHashSet.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ListHashSet.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ListHashSet_h
+#define WebCore_FWD_ListHashSet_h
 #include <JavaScriptCore/ListHashSet.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ListRefPtr.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ListRefPtr.h
index b766736..379adfb 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ListRefPtr.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ListRefPtr.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ListRefPtr_h
+#define WebCore_FWD_ListRefPtr_h
 #include <JavaScriptCore/ListRefPtr.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Locker.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Locker.h
index 75b0acd..4dbe13e 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Locker.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Locker.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Locker_h
+#define WebCore_FWD_Locker_h
 #include <JavaScriptCore/Locker.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MainThread.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MainThread.h
index ff75971..2d8e280 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MainThread.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MainThread.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_MainThread_h
+#define WebCore_FWD_MainThread_h
 #include <JavaScriptCore/MainThread.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MathExtras.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MathExtras.h
index 2955786..8594e64 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MathExtras.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MathExtras.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_MathExtras_h
+#define WebCore_FWD_MathExtras_h
 #include <JavaScriptCore/MathExtras.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MessageQueue.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MessageQueue.h
index 986cca5..c597e08 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MessageQueue.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/MessageQueue.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_MessageQueue_h
+#define WebCore_FWD_MessageQueue_h
 #include <JavaScriptCore/MessageQueue.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Noncopyable.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Noncopyable.h
index f8484d2..c512677 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Noncopyable.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Noncopyable.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Noncopyable_h
+#define WebCore_FWD_Noncopyable_h
 #include <JavaScriptCore/Noncopyable.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/NotFound.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/NotFound.h
index cfe1896..1757683 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/NotFound.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/NotFound.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_NotFound_h
+#define WebCore_FWD_NotFound_h
 #include <JavaScriptCore/NotFound.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnArrayPtr.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnArrayPtr.h
index 595817d..7700641 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnArrayPtr.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnArrayPtr.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_OwnArrayPtr_h
+#define WebCore_FWD_OwnArrayPtr_h
 #include <JavaScriptCore/OwnArrayPtr.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnFastMallocPtr.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnFastMallocPtr.h
new file mode 100644
index 0000000..036d801
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnFastMallocPtr.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/OwnFastMallocPtr.h>
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnPtr.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnPtr.h
index 9211d38..977382d 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnPtr.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnPtr.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_OwnPtr_h
+#define WebCore_FWD_OwnPtr_h
 #include <JavaScriptCore/OwnPtr.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnPtrCommon.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnPtrCommon.h
new file mode 100644
index 0000000..5826031
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/OwnPtrCommon.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_PassOwnPtr_h
+#define WebCore_FWD_PassOwnPtr_h
+#include <JavaScriptCore/PassOwnPtr.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PassOwnPtr.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PassOwnPtr.h
new file mode 100644
index 0000000..5826031
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PassOwnPtr.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_PassOwnPtr_h
+#define WebCore_FWD_PassOwnPtr_h
+#include <JavaScriptCore/PassOwnPtr.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PassRefPtr.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PassRefPtr.h
index aafd1a2..ef57e5f 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PassRefPtr.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PassRefPtr.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_PassRefPtr_h
+#define WebCore_FWD_PassRefPtr_h
 #include <JavaScriptCore/PassRefPtr.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Platform.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Platform.h
index 3b22955..9f2bb3a 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Platform.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Platform.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Platform_h
+#define WebCore_FWD_Platform_h
 #include <JavaScriptCore/Platform.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PtrAndFlags.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PtrAndFlags.h
new file mode 100644
index 0000000..bb6ed9a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/PtrAndFlags.h
@@ -0,0 +1,5 @@
+#ifndef WebCore_FWD_PtrAndFlags_h
+#define WebCore_FWD_PtrAndFlags_h
+#include <JavaScriptCore/PtrAndFlags.h>
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RandomNumber.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RandomNumber.h
index 42e148a..cb156d2 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RandomNumber.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RandomNumber.h
@@ -1 +1,5 @@
+#ifndef WebCore_FWD_RandomNumber_h
+#define WebCore_FWD_RandomNumber_h
 #include <JavaScriptCore/RandomNumber.h>
+#endif
+
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefCounted.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefCounted.h
index 628a63b..c6b2dee 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefCounted.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefCounted.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_RefCounted_h
+#define WebCore_FWD_RefCounted_h
 #include <JavaScriptCore/RefCounted.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefCountedLeakCounter.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefCountedLeakCounter.h
index 3f229d1..2abe37e 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefCountedLeakCounter.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefCountedLeakCounter.h
@@ -1,2 +1,5 @@
+#ifndef WebCore_FWD_RefCountedLeakCounter_h
+#define WebCore_FWD_RefCountedLeakCounter_h
 #include <JavaScriptCore/RefCountedLeakCounter.h>
+#endif
 
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefPtr.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefPtr.h
index 0ff6213..594929d 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefPtr.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RefPtr.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_RefPtr_h
+#define WebCore_FWD_RefPtr_h
 #include <JavaScriptCore/RefPtr.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RetainPtr.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RetainPtr.h
index 65fc27b..1352bd8 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RetainPtr.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/RetainPtr.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_RetainPtr_h
+#define WebCore_FWD_RetainPtr_h
 #include <JavaScriptCore/RetainPtr.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StdLibExtras.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StdLibExtras.h
index 3222ec1..2003295 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StdLibExtras.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StdLibExtras.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_StdLibExtras_h
+#define WebCore_FWD_StdLibExtras_h
 #include <JavaScriptCore/StdLibExtras.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StringExtras.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StringExtras.h
index 063d500..d89f238 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StringExtras.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/StringExtras.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_StringExtras_h
+#define WebCore_FWD_StringExtras_h
 #include <JavaScriptCore/StringExtras.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ThreadSpecific.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ThreadSpecific.h
index 48f1db5..1e5474f 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ThreadSpecific.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/ThreadSpecific.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_ThreadSpecific_h
+#define WebCore_FWD_ThreadSpecific_h
 #include <JavaScriptCore/ThreadSpecific.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Threading.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Threading.h
index 17359e5..ad29847 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Threading.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Threading.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Threading_h
+#define WebCore_FWD_Threading_h
 #include <JavaScriptCore/Threading.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/TypeTraits.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/TypeTraits.h
new file mode 100644
index 0000000..a4ae09f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/TypeTraits.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_TypeTraits_h
+#define WebCore_FWD_TypeTraits_h
+#include <JavaScriptCore/TypeTraits.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/UnusedParam.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/UnusedParam.h
index aa3d3d0..5202740 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/UnusedParam.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/UnusedParam.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_UnusedParam_h
+#define WebCore_FWD_UnusedParam_h
 #include <JavaScriptCore/UnusedParam.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/VMTags.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/VMTags.h
new file mode 100644
index 0000000..ffd1e12
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/VMTags.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_VMTags_h
+#define WebCore_FWD_VMTags_h
+#include <JavaScriptCore/VMTags.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Vector.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Vector.h
index c6d15fd..2c1cf7b 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Vector.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/Vector.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Vector_h
+#define WebCore_FWD_Vector_h
 #include <JavaScriptCore/Vector.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/VectorTraits.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/VectorTraits.h
index 2fc1158..87a3822 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/VectorTraits.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/VectorTraits.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_VectorTraits_h
+#define WebCore_FWD_VectorTraits_h
 #include <JavaScriptCore/VectorTraits.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/dtoa.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/dtoa.h
index 887fdfa..7fd9265 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/dtoa.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/dtoa.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_dtoa_h
+#define WebCore_FWD_dtoa_h
 #include <JavaScriptCore/dtoa.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/Collator.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/Collator.h
index 8f341a1..f28a117 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/Collator.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/Collator.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Collator_h
+#define WebCore_FWD_Collator_h
 #include <JavaScriptCore/Collator.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/UTF8.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/UTF8.h
index c7d9e92..b9daa43 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/UTF8.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/UTF8.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_UTF8_h
+#define WebCore_FWD_UTF8_h
 #include <JavaScriptCore/UTF8.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/Unicode.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/Unicode.h
index 623917f..9f06747 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/Unicode.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/Unicode.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_Unicode_h
+#define WebCore_FWD_Unicode_h
 #include <JavaScriptCore/Unicode.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h
index 6b64eb5..4819f47 100644
--- a/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h
+++ b/src/3rdparty/webkit/WebCore/ForwardingHeaders/wtf/unicode/icu/UnicodeIcu.h
@@ -1 +1,4 @@
+#ifndef WebCore_FWD_UnicodeIcu_h
+#define WebCore_FWD_UnicodeIcu_h
 #include <JavaScriptCore/UnicodeIcu.h>
+#endif
diff --git a/src/3rdparty/webkit/WebCore/Info.plist b/src/3rdparty/webkit/WebCore/Info.plist
index a131f44..525a372 100644
--- a/src/3rdparty/webkit/WebCore/Info.plist
+++ b/src/3rdparty/webkit/WebCore/Info.plist
@@ -7,7 +7,7 @@
 	<key>CFBundleExecutable</key>
 	<string>${PRODUCT_NAME}</string>
 	<key>CFBundleGetInfoString</key>
-	<string>${BUNDLE_VERSION}, Copyright 2003-2007 Apple Inc.; Copyright 1997 Martin Jones &lt;mjones@kde.org&gt;; Copyright 1998, 1999 Torben Weis &lt;weis@kde.org&gt;; Copyright 1998, 1999, 2002 Waldo Bastian &lt;bastian@kde.org&gt;; Copyright 1998-2000 Lars Knoll &lt;knoll@kde.org&gt;; Copyright 1999, 2001 Antti Koivisto &lt;koivisto@kde.org&gt;; Copyright 1999-2001 Harri Porten &lt;porten@kde.org&gt;; Copyright 2000 Simon Hausmann &lt;hausmann@kde.org&gt;; Copyright 2000, 2001 Dirk Mueller &lt;mueller@kde.org&gt;; Copyright 2000, 2001 Peter Kelly &lt;pmk@post.com&gt;; Copyright 2000 Daniel Molkentin &lt;molkentin@kde.org&gt;; Copyright 2000 Stefan Schimanski &lt;schimmi@kde.org&gt;; Copyright 1998-2000 Netscape Communications Corporation; Copyright 1998, 1999, 2000 Thai Open Source Software Center Ltd and Clark Cooper; Copyright 2001, 2002 Expat maintainers.</string>
+	<string>${BUNDLE_VERSION}, Copyright 2003-2009 Apple Inc.; Copyright 1997 Martin Jones &lt;mjones@kde.org&gt;; Copyright 1998, 1999 Torben Weis &lt;weis@kde.org&gt;; Copyright 1998, 1999, 2002 Waldo Bastian &lt;bastian@kde.org&gt;; Copyright 1998-2000 Lars Knoll &lt;knoll@kde.org&gt;; Copyright 1999, 2001 Antti Koivisto &lt;koivisto@kde.org&gt;; Copyright 1999-2001 Harri Porten &lt;porten@kde.org&gt;; Copyright 2000 Simon Hausmann &lt;hausmann@kde.org&gt;; Copyright 2000, 2001 Dirk Mueller &lt;mueller@kde.org&gt;; Copyright 2000, 2001 Peter Kelly &lt;pmk@post.com&gt;; Copyright 2000 Daniel Molkentin &lt;molkentin@kde.org&gt;; Copyright 2000 Stefan Schimanski &lt;schimmi@kde.org&gt;; Copyright 1998-2000 Netscape Communications Corporation; Copyright 1998, 1999, 2000 Thai Open Source Software Center Ltd and Clark Cooper; Copyright 2001, 2002 Expat maintainers.</string>
 	<key>CFBundleIdentifier</key>
 	<string>com.apple.${PRODUCT_NAME}</string>
 	<key>CFBundleInfoDictionaryVersion</key>
diff --git a/src/3rdparty/webkit/WebCore/Resources/panIcon.png b/src/3rdparty/webkit/WebCore/Resources/panIcon.png
new file mode 100644
index 0000000..4ca8d70
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/Resources/panIcon.png
diff --git a/src/3rdparty/webkit/WebCore/WebCore.LP64.exp b/src/3rdparty/webkit/WebCore/WebCore.LP64.exp
index 71ed666..cc04718 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.LP64.exp
+++ b/src/3rdparty/webkit/WebCore/WebCore.LP64.exp
@@ -1,3 +1,15 @@
 # This file gets appended to WebCore.exp, only for 64-bit architectures.
 
+__ZN3JSC16RuntimeObjectImp6s_infoE
+__ZN3JSC8Bindings10RootObjectD1Ev
+__ZN3JSC8Bindings8Instance19createRuntimeObjectEPNS_9ExecStateE
+__ZN3JSC8Bindings8InstanceC2EN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC8Bindings8InstanceD2Ev
+__ZN7WebCore13IdentifierRep3getEi
+__ZN7WebCore13IdentifierRep3getEPKc
+__ZN7WebCore13IdentifierRep7isValidEPS0_
+__ZN7WebCore16ScriptController16createRootObjectEPv
+__ZN7WebCore16ScriptController24jsObjectForPluginElementEPNS_17HTMLPlugInElementE
 __ZN7WebCore16ScriptController9isEnabledEv
+__ZN7WebCore6String26fromUTF8WithLatin1FallbackEPKcm
+__ZN7WebCore6String8fromUTF8EPKcm
diff --git a/src/3rdparty/webkit/WebCore/WebCore.NPAPI.exp b/src/3rdparty/webkit/WebCore/WebCore.NPAPI.exp
index 28dd051..d487ade 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.NPAPI.exp
+++ b/src/3rdparty/webkit/WebCore/WebCore.NPAPI.exp
@@ -21,3 +21,10 @@ __NPN_SetProperty
 __NPN_UTF8FromIdentifier
 __ZN7WebCore16ScriptController20windowScriptNPObjectEv
 __ZN7WebCore16ScriptController29cleanupScriptObjectsForPluginEPv
+__ZN7WebCore6String8fromUTF8EPKc
+__ZN7WebCoreplERKNS_6StringEPKc
+__ZNK7WebCore12RenderObject4viewEv
+__ZNK7WebCore14SecurityOrigin9canAccessEPKS0_
+__ZNK7WebCore4KURL7hasPathEv
+__ZNK7WebCore4KURL9prettyURLEv
+__ZNK7WebCore9FrameView22windowClipRectForLayerEPKNS_11RenderLayerEb
diff --git a/src/3rdparty/webkit/WebCore/WebCore.VideoProxy.exp b/src/3rdparty/webkit/WebCore/WebCore.VideoProxy.exp
new file mode 100644
index 0000000..cead63f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/WebCore.VideoProxy.exp
@@ -0,0 +1,4 @@
+__ZN7WebCore9HTMLNames8videoTagE
+__ZN7WebCore9HTMLNames8audioTagE
+__ZN7WebCore16HTMLMediaElement19deliverNotificationE32MediaPlayerProxyNotificationType
+__ZN7WebCore16HTMLMediaElement19setMediaPlayerProxyEP19WebMediaPlayerProxy
diff --git a/src/3rdparty/webkit/WebCore/WebCore.order b/src/3rdparty/webkit/WebCore/WebCore.order
index 67de812..ddce440 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.order
+++ b/src/3rdparty/webkit/WebCore/WebCore.order
@@ -1,30 +1,37 @@
 __ZN7WebCore12IconDatabase20delayDatabaseCleanupEv
-__ZN7WebCore21reportThreadViolationEPKc
+__ZN7WebCore21reportThreadViolationEPKcNS_20ThreadViolationRoundE
+__ZN7WebCoreL43readThreadViolationBehaviorFromUserDefaultsEv
 __ZN7WebCore12iconDatabaseEv
+__ZN7WebCore12IconDatabaseC1Ev
 __ZN7WebCore12IconDatabaseC2Ev
-__ZN7WebCore5MutexC2Ev
-__ZN7WebCore15ThreadConditionC2Ev
-__ZN7WebCore13defaultClientEv
+__ZN7WebCore9TimerBaseC2Ev
+__ZN7WebCoreL13defaultClientEv
 __ZN7WebCore14SQLiteDatabaseC1Ev
+__ZN7WebCore14SQLiteDatabaseC2Ev
 __ZN7WebCore12IconDatabase10setEnabledEb
 __ZN7WebCore12IconDatabase9setClientEPNS_18IconDatabaseClientE
 __ZN7WebCore12IconDatabase25setPrivateBrowsingEnabledEb
 __ZN7WebCore6StringC1EP8NSString
+__ZN7WebCore6StringC2EP8NSString
 __ZN7WebCore10StringImpl6createEPKtj
+__ZN7WebCore10StringImpl19createUninitializedEjRPt
+__ZN7WebCore10StringImplnwEmPv
 __ZN3WTF6VectorItLm1024EE6shrinkEm
 __ZN7WebCore12IconDatabase4openERKNS_6StringE
 __ZNK7WebCore12IconDatabase6isOpenEv
-__ZN7WebCore5Mutex4lockEv
-__ZN7WebCore5Mutex6unlockEv
 __ZNK7WebCore6String4copyEv
 __ZN7WebCore10StringImpl4copyEv
 __ZN7WebCore12IconDatabase23defaultDatabaseFilenameEv
 __ZN7WebCore6StringC1EPKc
+__ZN7WebCore6StringC2EPKc
 __ZN7WebCore10StringImpl6createEPKc
+__ZN7WebCore10StringImpl6createEPKcj
 __ZN7WebCore24pathByAppendingComponentERKNS_6StringES2_
 __ZN7WebCore10StringImpl8endsWithEPS0_b
 __ZN7WebCore10StringImpl4findEPS0_ib
 __ZN7WebCore10StringImplD1Ev
+__ZN7WebCore10StringImplD2Ev
+__ZN7WebCore10StringImpldlEPv
 __ZN7WebCoreplERKNS_6StringEPKc
 __ZN7WebCoreplERKNS_6StringES2_
 __ZNK7WebCore6String7isEmptyEv
@@ -32,15 +39,9 @@ __ZN7WebCore6String6appendERKS0_
 __ZNK7WebCore6String6lengthEv
 __ZNK7WebCore6String10charactersEv
 __ZN7WebCore10StringImpl5adoptERNS_12StringBufferE
-__ZN7WebCore12createThreadEPFPvS0_ES0_
-__ZN7WebCore35establishIdentifierForPthreadHandleERP17_opaque_pthread_t
+__ZN7WebCore10StringImplnwEm
 __ZN7WebCore12IconDatabase27iconDatabaseSyncThreadStartEPv
 __ZN7WebCore12IconDatabase22iconDatabaseSyncThreadEv
-__ZN7WebCore14threadMapMutexEv
-__ZN7WebCore9threadMapEv
-__ZNK3WTF7HashMapIjP17_opaque_pthread_tNS_7IntHashIjEENS_10HashTraitsIjEENS5_IS2_EEE3getERKj
-__ZN3WTF9HashTableIjSt4pairIjiENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENS8_IiEEEES9_E3addIjPN7WebCore17SegmentedFontDataENS_17HashMapTranslatorILb1ES1_IjSG_ENS_18PairBaseHashTraitsIS9_NS8_ISG_EEEESB_S6_EEEES1_INS_17HashTableIteratorIjS2_S4_S6_SB_S9_EEbERKT_RKT0_
-__ZN3WTF9HashTableIjSt4pairIjiENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENS8_IiEEEES9_E5clearEv
 __ZN7WebCore18makeAllDirectoriesERKNS_6StringE
 __ZN7WebCore24fileSystemRepresentationERKNS_6StringE
 __ZNK7WebCore6String14createCFStringEv
@@ -48,255 +49,99 @@ __ZN7WebCore10StringImpl14createCFStringEv
 __ZN7WebCore7CString16newUninitializedEmRPc
 __ZNK7WebCore7CString4dataEv
 __ZN3WTF6VectorIcLm0EE6shrinkEm
+__ZN7WebCore15AutodrainedPoolC1Ei
 __ZN7WebCore15AutodrainedPoolC2Ei
 __ZN7WebCore10fileExistsERKNS_6StringE
+__ZN7WebCore15AutodrainedPoolD1Ev
 __ZN7WebCore15AutodrainedPoolD2Ev
 __ZN7WebCore14SQLiteDatabase4openERKNS_6StringE
 __ZN7WebCore14SQLiteDatabase5closeEv
 __ZN7WebCore6String29charactersWithNullTerminationEv
 __ZN7WebCore10StringImpl34createWithTerminatingNullCharacterERKS0_
-_sqlite3_open16
-_sqlite3VdbeMemSetStr
-_WebCoreObjCFinalizeOnMainThread
-__ZN7WebCore16MIMETypeRegistry29getSupportedNonImageMIMETypesEv
-__ZN7WebCore26initialiseMIMETypeRegistryEv
-__ZN7WebCore38initialiseSupportedJavaScriptMIMETypesEv
-__ZN3WTF7HashSetIN7WebCore6StringENS1_10StringHashENS_10HashTraitsIS2_EEE3addERKS2_
-__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E5clearEv
-__ZN3WTF23HashTableRefCounterBaseILb1ENS_9HashTableIPN7WebCore10StringImplES4_NS_17IdentityExtractorIS4_EENS2_15CaseFoldingHashENS_10HashTraitsIS4_EES9_EENS8_INS2_6StringEEEE8derefAllERSA_
-__ZN7WebCore36initialiseSupportedNonImageMimeTypesEv
-_sqlite3VdbeMemRelease
-_sqlite3ValueText
-_sqlite3VdbeMemTranslate
-_sqlite3VdbeMemNulTerminate
-_openDatabase
-_createCollation
-_findCollSeqEntry
-_sqlite3HashInsert
-_strHash
-_sqlite3MallocX
-_rehash
-_sqlite3Error
-_strCompare
-_sqlite3BtreeOpen
-_sqlite3UnixThreadSpecificData
-_sqlite3UnixEnterMutex
-_sqlite3UnixFullPathname
-_sqlite3SetString
-_allocateUnixFile
-_findLockInfo
-_threadLockingTest
-_binHash
-_unixSectorSize
-_unixSeek
-_unixRead
-_sqlite3Realloc
-_sqlite3SchemaGet
-_sqlite3RegisterBuiltinFunctions
-_sqlite3CreateFunc
-_sqlite3FindFunction
-_sqlite3FreeX
-_sqlite3ApiExit
-_sqlite3RegisterLikeFunctions
-_sqlite3_exec
-_sqlite3Prepare
-_sqlite3RunParser
-_getToken
-_sqlite3Parser
-_yy_find_shift_action
-_yy_reduce
-_sqlite3Pragma
-_sqlite3VdbeAddOp
-_sqlite3VdbeChangeP3
-_freeP3
-_sqlite3VdbeMakeReady
-_yy_destructor
-_sqlite3DeleteTable
-_sqlite3DeleteTrigger
-_sqlite3Step
-_sqlite3VdbeExec
-_sqlite3VdbeHalt
-_sqlite3VdbeFreeCursor
-_sqlite3BtreeCommitPhaseTwo
-_sqlite3VdbeReset
-_Cleanup
-_sqlite3VdbeDelete
-__ZN7WebCore13currentThreadEv
 __ZN7WebCore15SQLiteStatementC1ERNS_14SQLiteDatabaseERKNS_6StringE
+__ZN7WebCore15SQLiteStatementC2ERNS_14SQLiteDatabaseERKNS_6StringE
 __ZN7WebCore15SQLiteStatement14executeCommandEv
 __ZN7WebCore15SQLiteStatement7prepareEv
-_sqlite3_prepare16_v2
-_sqlite3Prepare16
+_WebCoreObjCFinalizeOnMainThread
+__ZN7WebCore16MIMETypeRegistry29getSupportedNonImageMIMETypesEv
+__ZN7WebCoreL26initializeMIMETypeRegistryEv
+__ZN7WebCoreL38initializeSupportedJavaScriptMIMETypesEv
+__ZN3WTF7HashSetIN7WebCore6StringENS1_10StringHashENS_10HashTraitsIS2_EEE3addERKS2_
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E6expandEv
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E6rehashEi
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E13allocateTableEi
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E15deallocateTableE
+__ZN7WebCore5equalEPNS_10StringImplES1_
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_EC1ERKS8_
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_EC2ERKS8_
+__ZN7WebCoreL36initializeSupportedNonImageMimeTypesEv
+__ZN7WebCore14ArchiveFactory29registerKnownArchiveMIMETypesEv
+__ZN7WebCoreL16archiveMIMETypesEv
+__ZN3WTF7HashMapIN7WebCore6StringEPFNS_10PassRefPtrINS1_7ArchiveEEEPNS1_12SharedBufferEENS1_15CaseFoldingHashENS_10HashTraitsIS
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PFNS_10PassRefPtrINS1_7ArchiveEEEPNS1_12SharedBufferEEENS_18PairFirstExtractorIS
 __ZN7WebCore15SQLiteStatement4stepEv
-_sqlite3_step
 __ZN7WebCore15SQLiteStatement8finalizeEv
-_sqlite3_finalize
 __ZN7WebCore15SQLiteStatementD1Ev
+__ZN7WebCore15SQLiteStatementD2Ev
 __ZNK7WebCore12IconDatabase24shouldStopThreadActivityEv
 __ZN7WebCore12IconDatabase25performOpenInitializationEv
-__ZN7WebCore21databaseVersionNumberERNS_14SQLiteDatabaseE
+__ZN7WebCoreL21databaseVersionNumberERNS_14SQLiteDatabaseE
 __ZN7WebCore15SQLiteStatement12getColumnIntEi
-_sqlite3Expr
-_heightOfSelect
-_sqlite3ExprListAppend
-_sqlite3SrcListAppendFromTerm
-_sqlite3SrcListAppend
-_sqlite3SelectNew
-_sqlite3Select
-_sqlite3SelectResolve
-_prepSelectStmt
-_sqlite3Init
-_sqlite3InitOne
-_sqlite3InitCallback
-_sqlite3StartTable
-_sqlite3FindTable
-_sqlite3EndTable
-_sqlite3BtreeCursor
-_sqlite3BtreeBeginTrans
-_sqlite3PagerAcquire
-_unixLock
-_unixFileSize
-_sqlite3BtreeInitPage
-_sqlite3BtreeGetMeta
-_sqlite3PagerUnref
-_sqlite3MPrintf
-_base_vprintf
-_mout
-_printf_realloc
-_walkExprTree
-_nameResolverStep
-_lookupName
-_sqlite3ExprDelete
-_processOrderGroupBy
-_simpleMinMaxQuery
-_computeLimitRegisters
-_sqlite3WhereBegin
-_findTerm
-_sqlite3OpenTable
-_sqlite3TableLock
-_selectInnerLoop
-_codeOffset
-_sqlite3ExprCode
-_sqlite3ExprCodeGetColumn
-_sqlite3ValueFromExpr
-_sqlite3WhereEnd
-_generateColumnNames
-_columnType
-_clearSelect
-_sqlite3SrcListDelete
-_sqlite3VdbeIntValue
-_moveToRoot
-_sqlite3BtreeParseCellPtr
-_sqlite3MallocRaw
-_sqlite3VdbeSerialGet
-_sqlite3_value_text
-_sqlite3_snprintf
-_sqlite3CreateIndex
-_sqlite3BtreeCommitStmt
-_sqlite3BtreeNext
-_sqlite3FixSrcList
-_sqlite3FixSelect
-_sqlite3AddPrimaryKey
-_pageDestructor
-_sqlite3BtreeCloseCursor
-_sqlite3AnalysisLoad
-_unixUnlock
-_whereClauseInsert
-_exprNodeIsConstant
-_exprAnalyze
-_exprTableUsage
-_exprSelectTableUsage
-_sqlite3GetCollSeq
-_sqlite3LocateCollSeq
-_codeAllEqualityTerms
-_codeEqualityTerm
-_applyAffinity
-_sqlite3VdbeSerialPut
-_sqlite3BtreeMoveto
-_sqlite3VdbeRecordCompare
-_sqlite3MemCompare
-_binCollFunc
-_sqlite3VdbeIdxKeyCompare
-_sqlite3VdbeMemFromBtree
-_sqlite3VdbeIdxRowid
-__ZN7WebCore15SQLiteStatement11columnCountEv
-_sqlite3_data_count
-_sqlite3_column_int
 __ZN7WebCore14SQLiteDatabase11tableExistsERKNS_6StringE
 __ZN7WebCoreplEPKcRKNS_6StringE
-_whereSplit
-_sqlite3ExprIfFalse
-_codeCompare
+__ZN7WebCore14SQLiteDatabase14clearAllTablesEv
+__ZN7WebCore15SQLiteStatement17returnTextResultsEiRN3WTF6VectorINS_6StringELm0EEE
+__ZN3WTF6VectorIN7WebCore6StringELm0EE14shrinkCapacityEm
+__ZN7WebCore14SQLiteDatabase9lastErrorEv
+__ZN7WebCoreL20createDatabaseTablesERNS_14SQLiteDatabaseE
+__ZN7WebCore14SQLiteDatabase14executeCommandERKNS_6StringE
+__ZN7WebCore6String6numberEi
+__ZN7WebCore6String6formatEPKcz
+__ZN3WTF6VectorIcLm256EE4growEm
+__ZN3WTF6VectorIcLm256EE6shrinkEm
 __ZN7WebCore12IconDatabase8importedEv
-__ZN7WebCore12IconDatabase16performURLImportEv
-_sqlite3JoinType
-_setJoinExpr
-_sqlite3ExprDup
-_sqlite3ExprListDup
-_sqlite3SelectDup
-_disableTerm
-_applyNumericAffinity
-__ZN7WebCore15SQLiteStatement13getColumnTextEi
-_sqlite3_column_text16
-__ZN7WebCore6StringC2EPKt
-__ZN3WTF7HashMapIN7WebCore6StringEPNS1_13PageURLRecordENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
-__ZN7WebCore13PageURLRecordC2ERKNS_6StringE
-__ZN7WebCore12IconDatabase21getOrCreateIconRecordERKNS_6StringE
-__ZN3WTF7HashMapIN7WebCore6StringEPNS1_10IconRecordENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
-__ZN7WebCore10IconRecordC2ERKNS_6StringE
-__ZN7WebCore13PageURLRecord13setIconRecordEN3WTF10PassRefPtrINS_10IconRecordEEE
-__ZNK3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E8containsIS3_NS_22IdentityHashTranslatorIS3_S3_S6_EEEEbRKT_
-__ZN3WTF6VectorIN7WebCore6StringELm0EE11appendRangeINS_24HashTableIteratorAdapterINS_9HashTableIPNS1_10StringImplES8_NS_17IdentityExtractorIS8_EENS1_10StringHashENS_10HashTraitsIS8_EESD_EES2_EEEEvT_SG_
-__ZN7WebCore16callOnMainThreadEPFvPvES0_
--[WebCoreFunctionWrapper initWithFunction:context:]
-__ZN7WebCore12IconDatabase18syncThreadMainLoopEv
-__ZN7WebCore12IconDatabase16readFromDatabaseEv
-__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE11appendRangeINS_24HashTableIteratorAdapterINS_9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEESD_EES3_EEEEvT_SG_
-__ZN7WebCore12IconDatabase15writeToDatabaseEv
-__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE11appendRangeINS_23HashTableValuesIteratorINS_9HashTableIPNS1_10StringImplESt4pairIS8_S2_ENS_18PairFirstExtractorISA_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS8_EENSF_IS2_EEEESG_EENS1_6StringES2_EEEEvT_SM_
-__ZN3WTF23HashTableRefCounterBaseILb1ENS_9HashTableIPN7WebCore10StringImplESt4pairIS4_NS2_12IconSnapshotEENS_18PairFirstExtractorIS7_EENS2_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS4_EENSC_IS6_EEEESD_EENS_18PairBaseHashTraitsINSC_INS2_6StringEEESE_EEE8derefAllERSG_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_12IconSnapshotEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IS5_EEEESC_E6expandEv
-__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE11appendRangeINS_23HashTableValuesIteratorINS_9HashTableIPNS1_10StringImplESt4pairIS8_S2_ENS_18PairFirstExtractorISA_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS8_EENSF_IS2_EEEESG_EENS1_6StringES2_EEEEvT_SM_
-__ZN3WTF23HashTableRefCounterBaseILb1ENS_9HashTableIPN7WebCore10StringImplESt4pairIS4_NS2_15PageURLSnapshotEENS_18PairFirstExtractorIS7_EENS2_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS4_EENSC_IS6_EEEESD_EENS_18PairBaseHashTraitsINSC_INS2_6StringEEESE_EEE8derefAllERSG_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_15PageURLSnapshotEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IS5_EEEESC_E6expandEv
 __ZN7WebCore17SQLiteTransactionC1ERNS_14SQLiteDatabaseE
+__ZN7WebCore17SQLiteTransactionC2ERNS_14SQLiteDatabaseE
 __ZN7WebCore17SQLiteTransaction5beginEv
-__ZN7WebCore14SQLiteDatabase14executeCommandERKNS_6StringE
+__ZNK7WebCore12IconDatabase12databasePathEv
+__ZN7WebCore12IconDatabase11setImportedEb
 __ZN7WebCore17SQLiteTransaction6commitEv
-__ZN7WebCore12IconDatabase24checkForDanglingPageURLsEb
-__ZN7WebCore15SQLiteStatement23returnsAtLeastOneResultEv
-_codeInteger
-_sqlite3ExprIfTrue
-_sqlite3CodeSubselect
-_sqlite3PagerBegin
-_sqlite3PagerWrite
-_pager_write
-_zeroPage
-_sqlite3BtreeCreateTable
-_allocateBtreePage
-_sqlite3BtreeInsert
-_fillInCell
-_insertCell
-_allocateSpace
-_sqlite3BtreeClose
-_sqlite3BtreeRollback
-_sqlite3PagerRollback
-_pageReinit
-_pager_truncate_cache
-_sqlite3PagerClose
 __ZN7WebCore17SQLiteTransactionD1Ev
-__ZN7WebCore15ThreadCondition4waitERNS_5MutexE
+__ZN7WebCore17SQLiteTransactionD2Ev
+__ZN7WebCore12IconDatabase16performURLImportEv
+__ZN3WTF6VectorIN7WebCore6StringELm0EE11appendRangeINS_24HashTableIteratorAdapterINS_9HashTableIS2_S2_NS_17IdentityExtractorIS2
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E5clearEv
+__ZN7WebCore12IconDatabase18syncThreadMainLoopEv
+__ZN7WebCore12IconDatabase15writeToDatabaseEv
+__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE11appendRangeINS_23HashTableValuesIteratorINS_9HashTableINS1_6StringESt4pairIS7_S2
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_12IconSnapshotEENS_18PairFirstExtractorIS5_EENS1_10StringHashENS_14PairHashT
+__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE11appendRangeINS_23HashTableValuesIteratorINS_9HashTableINS1_6StringESt4pairIS7
+__ZN7WebCore12IconDatabase16readFromDatabaseEv
+__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE11appendRangeINS_24HashTableIteratorAdapterINS_9HashTableIS3_S3_NS_17IdentityExtrac
+__ZN7WebCore6StringC1EPK10__CFString
 __ZN7WebCore6StringC2EPK10__CFString
-__ZN7WebCore17getMIMETypeForUTIERKNS_6StringE
-__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E4findIS3_NS_22IdentityHashTranslatorIS3_S3_S6_EEEENS_17HashTableIteratorIS3_S3_S5_S6_S8_S8_EERKT_
+__ZN7WebCore26MIMETypeForImageSourceTypeERKNS_6StringE
+__ZN7WebCore24StringWrapperCFAllocatorL9allocatorEv
+__ZN7WebCore24StringWrapperCFAllocatorL6retainEPKv
+__ZN7WebCore24StringWrapperCFAllocatorL8allocateElmPv
+__ZN7WebCore24StringWrapperCFAllocatorL10deallocateEPvS1_
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E4findIS2_NS_22Iden
 __ZN7WebCore10StringImplcvP8NSStringEv
-__ZN7WebCore11FrameLoader24registerURLSchemeAsLocalERKNS_6StringE
-__ZN7WebCore12localSchemesEv
-__ZN3WTF7HashSetIN7WebCore6StringENS1_15CaseFoldingHashENS_10HashTraitsIS2_EEE3addERKS2_
-__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_15CaseFoldingHashENS_10HashTraitsIS3_EES8_E6expandEv
 __ZNK7WebCore12IconDatabase9isEnabledEv
 __ZN7WebCore12IconDatabase20retainIconForPageURLERKNS_6StringE
-__ZNK3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_15PageURLSnapshotEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IS5_EEEESC_E8containsIS3_NS_22IdentityHashTranslatorIS3_S6_S9_EEEEbRKT_
+__ZNK3WTF7HashMapIN7WebCore6StringEPNS1_13PageURLRecordENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3getERKS2_
+__ZN7WebCore13PageURLRecordC1ERKNS_6StringE
+__ZN7WebCore13PageURLRecordC2ERKNS_6StringE
+__ZN3WTF7HashMapIN7WebCore6StringEPNS1_13PageURLRecordENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_13PageURLRecordEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHas
+__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_15PageURLSnapshotEENS_18PairFirstExtractorIS5_EENS1_10StringHashENS_14PairH
+__ZN7WebCore11FrameLoader24registerURLSchemeAsLocalERKNS_6StringE
+__ZN7WebCoreL12localSchemesEv
+__ZN3WTF7HashSetIN7WebCore6StringENS1_15CaseFoldingHashENS_10HashTraitsIS2_EEE3addERKS2_
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E6expandEv
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E6rehashEi
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E13allocateTab
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E15deallocateT
 +[WebCoreViewFactory sharedFactory]
 -[WebCoreViewFactory init]
 +[WebCoreKeyGenerator sharedGenerator]
@@ -304,268 +149,374 @@ __ZNK3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_15PageURLSnapshotEENS_
 __ZN7WebCore36InitializeLoggingChannelsIfNecessaryEv
 __ZN7WebCore15DatabaseTracker7trackerEv
 __ZN7WebCore15DatabaseTrackerC1Ev
+__ZN7WebCore15DatabaseTrackerC2Ev
 __ZN7WebCore15DatabaseTracker24setDatabaseDirectoryPathERKNS_6StringE
 __ZN7WebCore15DatabaseTracker9setClientEPNS_21DatabaseTrackerClientE
+__ZN7WebCore12cacheStorageEv
+__ZN7WebCore23ApplicationCacheStorage17setCacheDirectoryERKNS_6StringE
 __ZN7WebCore4PageC1EPNS_12ChromeClientEPNS_17ContextMenuClientEPNS_12EditorClientEPNS_10DragClientEPNS_15InspectorClientE
+__ZN7WebCore4PageC2EPNS_12ChromeClientEPNS_17ContextMenuClientEPNS_12EditorClientEPNS_10DragClientEPNS_15InspectorClientE
+__ZN7WebCore6ChromeC1EPNS_4PageEPNS_12ChromeClientE
 __ZN7WebCore6ChromeC2EPNS_4PageEPNS_12ChromeClientE
+__ZN7WebCore19SelectionControllerC1EPNS_5FrameEb
 __ZN7WebCore19SelectionControllerC2EPNS_5FrameEb
-__ZN7WebCore9SelectionC2Ev
+__ZN7WebCore16VisibleSelectionC1Ev
+__ZN7WebCore16VisibleSelectionC2Ev
+__ZN7WebCore14DragControllerC1EPNS_4PageEPNS_10DragClientE
 __ZN7WebCore14DragControllerC2EPNS_4PageEPNS_10DragClientE
-__ZN7WebCore4KURLC1Ev
-__ZN7WebCore16DeprecatedStringC1Ev
-__ZN7WebCore20DeprecatedStringDataC2Ev
-__ZN7WebCore16DeprecatedString20makeSharedNullHandleEv
-__ZN7WebCore16DeprecatedString14makeSharedNullEv
+__ZN7WebCore4KURL10invalidateEv
+__ZN7WebCore15FocusControllerC1EPNS_4PageE
 __ZN7WebCore15FocusControllerC2EPNS_4PageE
+__ZN7WebCore21ContextMenuControllerC1EPNS_4PageEPNS_17ContextMenuClientE
 __ZN7WebCore21ContextMenuControllerC2EPNS_4PageEPNS_17ContextMenuClientE
+__ZN7WebCore19InspectorControllerC1EPNS_4PageEPNS_15InspectorClientE
 __ZN7WebCore19InspectorControllerC2EPNS_4PageEPNS_15InspectorClientE
+__ZN7WebCore8SettingsC1EPNS_4PageE
 __ZN7WebCore8SettingsC2EPNS_4PageE
 __ZN7WebCore12AtomicString4initEv
 __ZN7WebCore12AtomicString3addEPKc
 __ZN7WebCore10StringImpl5emptyEv
+__ZN7WebCore16threadGlobalDataEv
+__ZN7WebCore16ThreadGlobalDataC1Ev
+__ZN7WebCore16ThreadGlobalDataC2Ev
+__ZN7WebCore10StringImplC1Ev
 __ZN7WebCore10StringImplC2Ev
-__ZN3WTF7HashSetIPN7WebCore10StringImplENS1_10StringHashENS_10HashTraitsIS3_EEE3addINS1_11UCharBufferENS1_21UCharBufferTranslatorEEESt4pairINS_24HashTableIteratorAdapterINS_9HashTableIS3_S3_NS_17IdentityExtractorIS3_EES4_S6_S6_EES3_EEbERKT_
+__ZN7WebCore10EventNamesC1Ev
+__ZN7WebCore10EventNamesC2Ev
+__ZN3WTF7HashSetIPN7WebCore10StringImplENS1_10StringHashENS_10HashTraitsIS3_EEE3addIPKcNS1_17CStringTranslatorEEESt4pairINS_24H
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E13allocateTa
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E15deallocate
 __ZN7WebCore10StringImplC1EPKcjj
+__ZN7WebCore10StringImplC2EPKcjj
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E4findIS3_NS_
+__ZN7WebCore12AtomicStringC2EPKc
+__ZN7WebCore12ThreadTimersC1Ev
+__ZN7WebCore12ThreadTimersC2Ev
+__ZN7WebCoreL21mainThreadSharedTimerEv
+__ZN7WebCore12ThreadTimers14setSharedTimerEPNS_11SharedTimerE
+__ZN7WebCore21MainThreadSharedTimer16setFiredFunctionEPFvvE
+__ZN7WebCore27setSharedTimerFiredFunctionEPFvvE
+__ZN7WebCore12ThreadTimers17updateSharedTimerEv
+__ZN7WebCore21MainThreadSharedTimer4stopEv
+__ZN7WebCore15stopSharedTimerEv
+__ZN7WebCore15ProgressTrackerC1Ev
 __ZN7WebCore15ProgressTrackerC2Ev
 __ZN7WebCore15BackForwardListC1EPNS_4PageE
-__ZN7WebCore31setFocusRingColorChangeFunctionEPFvvE
-__ZN7WebCore11observeTintEv
-+[WebCoreControlTintObserver controlTintDidChange]
-__ZN7WebCore19makeRGBAFromNSColorEP7NSColor
-__ZN7WebCore8makeRGBAEiiii
+__ZN7WebCore15BackForwardListC2EPNS_4PageE
+__ZN7WebCore20networkStateNotifierEv
+__ZN7WebCore20NetworkStateNotifierC1Ev
+__ZN7WebCore20NetworkStateNotifierC2Ev
+__ZN7WebCore20NetworkStateNotifier11updateStateEv
+__ZN7WebCore20NetworkStateNotifier30setNetworkStateChangedFunctionEPFvvE
 __ZN3WTF7HashSetIPN7WebCore4PageENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E6expandEv
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E6rehashEi
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E13allocateTableEi
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E15deallocateTableEPii
--[WebCoreFrameBridge init]
-__ZN7WebCore9TimerBaseC2Ev
-__ZN7WebCore27setSharedTimerFiredFunctionEPFvvE
+__ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
+__ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTableEP
+__ZN7WebCore21JavaScriptDebugServer6sharedEv
+__ZN7WebCore21JavaScriptDebugServerC1Ev
+__ZN7WebCore21JavaScriptDebugServerC2Ev
+__ZN7WebCore21JavaScriptDebugServer11pageCreatedEPNS_4PageE
+__ZN7WebCore21JavaScriptDebugServer28hasListenersInterestedInPageEPNS_4PageE
+__ZNK3WTF9HashTableIPN7WebCore4PageESt4pairIS3_PNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS7_EENS_10HashTraitsIS7_
+__ZN7WebCore8Settings27setLocalStorageDatabasePathERKNS_6StringE
 __ZN7WebCore5FrameC1EPNS_4PageEPNS_21HTMLFrameOwnerElementEPNS_17FrameLoaderClientE
-__ZN7WebCore12FramePrivateC2EPNS_4PageEPNS_5FrameES4_PNS_21HTMLFrameOwnerElementEPNS_17FrameLoaderClientE
+__ZN7WebCore5FrameC2EPNS_4PageEPNS_21HTMLFrameOwnerElementEPNS_17FrameLoaderClientE
+__ZN7WebCore11FrameLoaderC1EPNS_5FrameEPNS_17FrameLoaderClientE
+__ZN7WebCore11FrameLoaderC2EPNS_5FrameEPNS_17FrameLoaderClientE
+__ZN7WebCore11PolicyCheckC1Ev
+__ZN7WebCore11PolicyCheckC2Ev
+__ZN3WTF6RefPtrIN7WebCore10StringImplEED2Ev
+__ZN7WebCore16ScriptControllerC1EPNS_5FrameE
+__ZN7WebCore16ScriptControllerC2EPNS_5FrameE
+__ZN7WebCore16ScriptController18initJavaJSBindingsEv
+__ZN3JSC8Bindings12JavaJSObject22initializeJNIThreadingEv
+__ZN3JSC8Bindings8Instance21setDidExecuteFunctionEPFvPNS_9ExecStateEPNS_8JSObjectEE
+__ZN7WebCore6EditorC1EPNS_5FrameE
 __ZN7WebCore6EditorC2EPNS_5FrameE
+__ZN7WebCore22DeleteButtonControllerC1EPNS_5FrameE
 __ZN7WebCore22DeleteButtonControllerC2EPNS_5FrameE
+__ZN7WebCore12EventHandlerC1EPNS_5FrameE
 __ZN7WebCore12EventHandlerC2EPNS_5FrameE
 __ZN7WebCore19AnimationControllerC1EPNS_5FrameE
+__ZN7WebCore19AnimationControllerC2EPNS_5FrameE
 __ZN7WebCore26AnimationControllerPrivateC1EPNS_5FrameE
-__ZN7WebCore11FrameLoaderC2EPNS_5FrameEPNS_17FrameLoaderClientE
-__ZN7WebCore11PolicyCheckC2Ev
-__ZN7WebCore16DeprecatedStringC1ERKS0_
-__ZN7WebCore16DeprecatedStringD1Ev
-__ZN7WebCore20DeprecatedStringDataD2Ev
-__ZN7WebCore10EventNames4initEv
-__ZN3WTF6RefPtrIN7WebCore10StringImplEEC2EPS2_
-__ZN3WTF10RefCountedIN7WebCore10StringImplEE3refEv
+__ZN7WebCore26AnimationControllerPrivateC2EPNS_5FrameE
 __ZN7WebCore9HTMLNames4initEv
+__ZN7WebCore13QualifiedNameC1ERKNS_12AtomicStringES3_S3_
 __ZN7WebCore13QualifiedNameC2ERKNS_12AtomicStringES3_S3_
-__ZN3WTF7HashSetIPN7WebCore13QualifiedName17QualifiedNameImplENS1_9QNameHashENS_10HashTraitsIS4_EEE3addINS1_23QualifiedNameComponentsENS1_25QNameComponentsTranslatorEEESt4pairINS_24HashTableIteratorAdapterINS_9HashTableIS4_S4_NS_17IdentityExtractorIS4_EES5_S7_S7_EES4_EEbERKT_
-__ZN3WTF9HashTableIPN7WebCore13QualifiedName17QualifiedNameImplES4_NS_17IdentityExtractorIS4_EENS1_9QNameHashENS_10HashTraitsIS4_EES9_E6expandEv
+__ZN3WTF7HashSetIPN7WebCore13QualifiedName17QualifiedNameImplENS1_17QualifiedNameHashENS_10HashTraitsIS4_EEE3addINS1_23Qualifie
+__ZN3WTF9HashTableIPN7WebCore13QualifiedName17QualifiedNameImplES4_NS_17IdentityExtractorIS4_EENS1_17QualifiedNameHashENS_10Has
 __ZN7WebCore12AtomicString3addEPNS_10StringImplE
-__ZN7WebCore12AtomicStringD1Ev
 __ZN3WTF10RefCountedIN7WebCore10StringImplEE5derefEv
-__ZN3WTF9HashTableIPN7WebCore13QualifiedName17QualifiedNameImplES4_NS_17IdentityExtractorIS4_EENS1_9QNameHashENS_10HashTraitsIS4_EES9_E4findIS4_NS_22IdentityHashTranslatorIS4_S4_S7_EEEENS_17HashTableIteratorIS4_S4_S6_S7_S9_S9_EERKT_
 __ZN7WebCore13QualifiedName4initEv
 __ZN7WebCore17MediaFeatureNames4initEv
 __ZN7WebCore8SVGNames4initEv
 __ZN7WebCore10XLinkNames4initEv
 __ZN7WebCore8XMLNames4initEv
 __ZN7WebCore4Page12setMainFrameEN3WTF10PassRefPtrINS_5FrameEEE
-__ZN7WebCore5Frame9setBridgeEP18WebCoreFrameBridge
 __ZNK7WebCore5Frame4treeEv
 __ZN7WebCore9FrameTree7setNameERKNS_12AtomicStringE
+__ZNK7WebCore9FrameTree6parentEb
 __ZN7WebCore5Frame4initEv
 __ZN7WebCore11FrameLoader4initEv
-__ZNK7WebCore6String16deprecatedStringEv
-__ZN7WebCore16DeprecatedStringC2EPKci
-__ZN7WebCore20DeprecatedStringData10initializeEPKcj
-__ZN7WebCore4KURLC1ERKNS_16DeprecatedStringE
-__ZN7WebCore4KURL5parseEPKcPKNS_16DeprecatedStringE
-__ZN7WebCore16DeprecatedStringaSEPKc
-__ZN7WebCore16DeprecatedString9setLatin1EPKci
-__ZN7WebCore16DeprecatedString26detachAndDiscardCharactersEv
-__ZN7WebCore16DeprecatedString6detachEv
-__ZN7WebCore20DeprecatedStringDataC2EPKcj
-__ZN7WebCore10freeHandleEPPNS_20DeprecatedStringDataE
+__ZN7WebCore4KURLC1EPKc
+__ZN7WebCore4KURLC2EPKc
+__ZN7WebCore4KURL5parseEPKcPKNS_6StringE
 __ZN7WebCore14DocumentLoaderC2ERKNS_15ResourceRequestERKNS_14SubstituteDataE
-__ZN3WTF6RefPtrIN7WebCore18MainResourceLoaderEEC2Ev
-__ZN3WTF7HashSetINS_6RefPtrIN7WebCore14ResourceLoaderEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZN3WTF6RefPtrIN7WebCore12SharedBufferEEC2Ev
-__ZN3WTF23HashTableRefCounterBaseILb1ENS_9HashTableIPN7WebCore10StringImplESt4pairIS4_iENS_18PairFirstExtractorIS6_EENS2_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS4_EENSB_IiEEEESC_EENS_18PairBaseHashTraitsINSB_INS2_6StringEEENSB_IjEEEEE8derefAllERSF_
-__ZN3WTF7HashMapIN7WebCore6StringES2_NS1_15CaseFoldingHashENS_10HashTraitsIS2_EES5_E3setERKS2_S8_
-__ZN7WebCore4KURLD1Ev
-__ZN3WTF9RetainPtrI12NSURLRequestEC2Ev
-__ZN7WebCore6StringC1Ev
-__ZN3WTF9RetainPtrI13NSURLResponseEC2Ev
-__ZN7WebCore13ResourceErrorC1Ev
+__ZN3WTF6VectorIN7WebCore6StringELm0EEC1ERKS3_
+__ZN3WTF6VectorIN7WebCore6StringELm0EEC2ERKS3_
 __ZN7WebCore16NavigationActionC1Ev
-__ZN3WTF6VectorIN7WebCore16ResourceResponseELm0EEC2Ev
+__ZN7WebCore16NavigationActionC2Ev
 __ZNK7WebCore5Frame4pageEv
 __ZN7WebCore11FrameLoader23setPolicyDocumentLoaderEPNS_14DocumentLoaderE
 __ZN7WebCore14DocumentLoader8setFrameEPNS_5FrameE
 __ZN7WebCore14DocumentLoader13attachToFrameEv
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_iENS_18PairFirstExtractorIS5_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSA_IiEEEESB_E4swapERSE_
 __ZN7WebCore11FrameLoader28setProvisionalDocumentLoaderEPNS_14DocumentLoaderE
 __ZN7WebCore11FrameLoader8setStateENS_10FrameStateE
 __ZN7WebCore11FrameLoader22provisionalLoadStartedEv
-__ZNK7WebCore5Frame8documentEv
-__ZNK7WebCore5Frame6loaderEv
-__ZNK7WebCore11FrameLoader10isCompleteEv
 __ZN7WebCore11FrameLoader17cancelRedirectionEb
 __ZN7WebCore11FrameLoader20stopRedirectionTimerEv
 __ZNK7WebCore9TimerBase8isActiveEv
-__ZN7WebCore14DocumentLoader11setResponseERKNS_16ResourceResponseE
-__ZN7WebCore16DeprecatedStringaSERKS0_
-__ZN7WebCore16DeprecatedString5derefEv
+__ZN7WebCoreL17timersReadyToFireEv
+__ZNK3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E8containsIS4
 __ZN7WebCore14DocumentLoader15finishedLoadingEv
 __ZN7WebCore14DocumentLoader13commitIfReadyEv
 __ZNK7WebCore14DocumentLoader11frameLoaderEv
+__ZNK7WebCore5Frame6loaderEv
 __ZN7WebCore11FrameLoader21commitProvisionalLoadEN3WTF10PassRefPtrINS_10CachedPageEEE
+__ZN7WebCore11FrameLoader23cachePageForHistoryItemEPNS_11HistoryItemE
 __ZN7WebCore11FrameLoader12canCachePageEv
 __ZNK7WebCore11FrameLoader8loadTypeEv
+__ZN7WebCore11FrameLoader31canCachePageContainingThisFrameEv
 __ZN7WebCore11FrameLoader19closeOldDataSourcesEv
 __ZN7WebCore11FrameLoader21transitionToCommittedEN3WTF10PassRefPtrINS_10CachedPageEEE
 __ZN7WebCore11FrameLoader22updateHistoryForCommitEv
 __ZN7WebCore21isBackForwardLoadTypeENS_13FrameLoadTypeE
 __ZN7WebCore11FrameLoader17setDocumentLoaderEPNS_14DocumentLoaderE
-__ZNK7WebCore11FrameLoader14documentLoaderEv
 __ZN7WebCore11FrameLoader14detachChildrenEv
-__ZNK7WebCore14DocumentLoader5titleEv
 __ZN7WebCore11FrameLoader28updateHistoryForStandardLoadEv
-__ZNK7WebCore5Frame12ownerElementEv
-__ZNK7WebCore14DocumentLoader16isClientRedirectEv
+__ZNK7WebCore5Frame8settingsEv
 __ZNK7WebCore14DocumentLoader13urlForHistoryEv
 __ZNK7WebCore19ResourceRequestBase3urlEv
 __ZNK7WebCore19ResourceRequestBase21updateResourceRequestEv
 __ZNK7WebCore5Frame4viewEv
-__ZNK7WebCore14DocumentLoader8responseEv
 __ZNK7WebCore16ResourceResponse13nsURLResponseEv
-__ZNK7WebCore4KURL8getNSURLEv
-__ZNK7WebCore16DeprecatedString6isNullEv
--[WebCoreFrameBridge createFrameViewWithNSView:marginWidth:marginHeight:]
+__ZNK7WebCore4KURLcvP5NSURLEv
+-[NSURLResponse(WebCoreURLResponse) _webcore_MIMEType]
+__ZNK7WebCore5Frame13ownerRendererEv
 __ZN7WebCore5Frame7setViewEPNS_9FrameViewE
 __ZNK7WebCore5Frame12eventHandlerEv
 __ZN7WebCore12EventHandler5clearEv
 __ZN7WebCore9TimerBase4stopEv
 __ZN7WebCore9TimerBase15setNextFireTimeEd
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E4findIS4_NS_2
 __ZN7WebCore11FrameLoader37resetMultipleFormSubmissionProtectionEv
+__ZN7WebCore9FrameViewC1EPNS_5FrameE
 __ZN7WebCore9FrameViewC2EPNS_5FrameE
+__ZN7WebCore10ScrollViewC2Ev
+__ZN7WebCore6WidgetC2EP6NSView
+__ZN7WebCore6Widget4initEP6NSView
 __ZN7WebCore9FrameView4initEv
+__ZN7WebCore9FrameView5resetEv
+__ZN3WTF6VectorIN7WebCore7IntRectELm0EE14shrinkCapacityEm
+__ZNK7WebCore5Frame8documentEv
+__ZN7WebCore10ScrollView4showEv
 __ZN7WebCore6Widget4showEv
-__ZN7WebCore6Widget7setViewEP6NSView
-__ZNK7WebCore5Frame6bridgeEv
--[WebCoreFrameBridge setDrawsBackground:]
 __ZN7WebCore9FrameView14setTransparentEb
--[WebCoreFrameBridge setBaseBackgroundColor:]
 __ZN7WebCore16colorFromNSColorEP7NSColor
+__ZN7WebCoreL19makeRGBAFromNSColorEP7NSColor
+__ZN7WebCore8makeRGBAEiiii
 __ZN7WebCore9FrameView22setBaseBackgroundColorENS_5ColorE
+__ZN7WebCore9FrameView29setShouldUpdateWhileOffscreenEb
 __ZNK7WebCore9FrameTree12traverseNextEPKNS_5FrameE
--[WebCoreFrameBridge installInFrame:]
-__ZN7WebCore5Frame13ownerRendererEv
+__ZN7WebCore6Widget21releasePlatformWidgetEv
+__ZN7WebCore6Widget20retainPlatformWidgetEv
 __ZN7WebCore9FrameView14initScrollbarsEv
-__ZNK7WebCore10ScrollView14hScrollbarModeEv
-__ZNK7WebCore6Widget7getViewEv
-__ZN7WebCore9FrameView17setScrollbarsModeENS_13ScrollbarModeE
-__ZN7WebCore10ScrollView17setScrollbarsModeENS_13ScrollbarModeE
-__ZNK7WebCore11FrameLoader6clientEv
+__ZN7WebCore9FrameView27updateDefaultScrollbarStateEv
+__ZNK7WebCore10ScrollView14scrollbarModesERNS_13ScrollbarModeES2_
+__ZNK7WebCore10ScrollView22platformScrollbarModesERNS_13ScrollbarModeES2_
+__ZN7WebCore10ScrollView17setScrollbarModesENS_13ScrollbarModeES1_
+__ZN7WebCore10ScrollView16setParentVisibleEb
+__ZNK7WebCore5Frame12ownerElementEv
 __ZNK7WebCore14DocumentLoader16responseMIMETypeEv
 __ZNK7WebCore20ResourceResponseBase8mimeTypeEv
-__ZNK7WebCore20ResourceResponseBase22updateResourceResponseEv
+__ZNK7WebCore20ResourceResponseBase8lazyInitEv
+__ZN7WebCore16ResourceResponse16platformLazyInitEv
 __ZNK7WebCore14DocumentLoader3urlEv
 __ZNK7WebCore14DocumentLoader7requestEv
 __ZNK7WebCore14DocumentLoader11responseURLEv
 __ZNK7WebCore20ResourceResponseBase3urlEv
-__ZN7WebCore4KURLC2EPKc
-__ZN7WebCore22appendEscapingBadCharsERPcPKcm
-__ZN7WebCore20DeprecatedStringData14createAndAdoptERS0_
-__ZN7WebCore20DeprecatedStringData5adoptERS0_
+__ZN7WebCore8blankURLEv
+__ZN7WebCoreL22appendEscapingBadCharsERPcPKcm
+__ZN7WebCore6StringC1EPKcj
+__ZN7WebCore6StringC2EPKcj
 __ZN3WTF6VectorIcLm4096EE6shrinkEm
 __ZN7WebCore11FrameLoader10didOpenURLERKNS_4KURLE
 __ZNK7WebCore5Frame6editorEv
-__ZN7WebCore6Editor18setLastEditCommandEN3WTF10PassRefPtrINS_11EditCommandEEE
+__ZN7WebCore6Editor20clearLastEditCommandEv
 __ZN7WebCore11FrameLoader8closeURLEv
 __ZN7WebCore11FrameLoader17saveDocumentStateEv
 __ZN7WebCore11FrameLoader11stopLoadingEb
 __ZN7WebCore6Editor23clearUndoRedoOperationsEv
 __ZNK7WebCore6Editor6clientEv
-__ZN7WebCore5Frame18setJSStatusBarTextERKNS_6StringE
-__ZN7WebCore6Chrome16setStatusbarTextEPNS_5FrameERKNS_6StringE
-__ZNK7WebCore5Frame25backslashAsCurrencySymbolEv
-__ZN7WebCore5Frame25setJSDefaultStatusBarTextERKNS_6StringE
-__ZNK7WebCore4KURL8protocolEv
-__ZNK7WebCore16DeprecatedString4leftEj
-__ZNK7WebCore16DeprecatedString3midEjj
-__ZNK7WebCore16DeprecatedString10startsWithEPKc
+__ZNK7WebCore4KURL10protocolIsEPKc
+__ZNK7WebCore6StringixEj
 __ZN7WebCore11FrameLoader7startedEv
-__ZN7WebCore11FrameLoader6openedEv
-__ZNK7WebCore14DocumentLoader23isLoadingFromCachedPageEv
 __ZN7WebCore11FrameLoader23finishedLoadingDocumentEPNS_14DocumentLoaderE
+__ZN7WebCore14ArchiveFactory17isArchiveMimeTypeERKNS_6StringE
+__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_PFNS_10PassRefPtrINS1_7ArchiveEEEPNS1_12SharedBufferEEENS_18PairFirstExtractorI
 __ZN7WebCore11FrameLoader3endEv
 __ZN7WebCore11FrameLoader27endIfNotLoadingMainResourceEv
-__ZN7WebCore11FrameLoader14checkCompletedEv
-__ZN7WebCore11FrameLoader22checkCallImplicitCloseEv
-__ZN7WebCore11FrameLoader9completedEv
-__ZN7WebCore11FrameLoader15submitFormAgainEv
-__ZN7WebCore11FrameLoader17checkLoadCompleteEv
-__ZN7WebCore11FrameLoader26recursiveCheckLoadCompleteEv
-__ZN7WebCore11FrameLoader29checkLoadCompleteForThisFrameEv
-__ZNK7WebCore14DocumentLoader19isLoadingInAPISenseEv
-__ZNK7WebCore11FrameLoader5stateEv
-__ZNK7WebCore14DocumentLoader9isLoadingEv
-__ZNK7WebCore11FrameLoader17subframeIsLoadingEv
-__ZN7WebCore11FrameLoader16markLoadCompleteEv
-__ZN7WebCore11FrameLoader18frameLoadCompletedEv
-__ZN7WebCore11FrameLoader22setPreviousHistoryItemEN3WTF10PassRefPtrINS_11HistoryItemEEE
-__ZN7WebCore11currentTimeEv
-__ZN7WebCore14DocumentLoader22stopRecordingResponsesEv
-__ZN7WebCore11FrameLoader15startIconLoaderEv
-__ZNK7WebCore11FrameLoader18isLoadingMainFrameEv
-__ZN7WebCore11FrameLoader7iconURLEv
-__ZN7WebCoreeqERKNS_16DeprecatedStringEPKc
-__ZN7WebCore6StringC1ERKNS_16DeprecatedStringE
-__ZN7WebCore20DeprecatedStringData11makeUnicodeEv
 __ZN7WebCore11FrameLoader5beginERKNS_4KURLEbPNS_14SecurityOriginE
-__ZN7WebCore11FrameLoader5clearEbb
-__ZN7WebCore6Editor5clearEv
-__ZN7WebCore4KURL7setUserERKNS_16DeprecatedStringE
-__ZN7WebCore4KURL7setPassERKNS_16DeprecatedStringE
-__ZN7WebCore4KURL6setRefERKNS_16DeprecatedStringE
 __ZNK7WebCore5Frame16inViewSourceModeEv
-__ZN7WebCore17DOMImplementation8instanceEv
 __ZN7WebCore17DOMImplementation14createDocumentERKNS_6StringEPNS_5FrameEb
 __ZN7WebCore5equalEPNS_10StringImplEPKc
-__ZN7WebCore12HTMLDocumentC2EPNS_17DOMImplementationEPNS_5FrameE
-__ZN7WebCore13ContainerNodeC2EPNS_8DocumentE
-__ZN7WebCore15EventTargetNodeC2EPNS_8DocumentE
-__ZN7WebCore4NodeC2EPNS_8DocumentE
+__ZN7WebCore12HTMLDocumentC1EPNS_5FrameE
+__ZN7WebCore12HTMLDocumentC2EPNS_5FrameE
+__ZN7WebCore8DocumentC2EPNS_5FrameEb
+__ZN7WebCore4NodeC2EPNS_8DocumentEbbb
+__ZN7WebCore22ScriptExecutionContextC2Ev
 __ZN7WebCore14StyleSheetListC1EPNS_8DocumentE
-__ZN7WebCore21DeprecatedPtrListImplC2EPFvPvE
-__ZN7WebCore23DeprecatedValueListImplC2EPFvPNS_27DeprecatedValueListImplNodeEEPFS2_S2_E
-__ZN7WebCore14HTMLCollection14CollectionInfoC2Ev
-__ZN7WebCore14HTMLCollection14CollectionInfo5resetEv
-__ZN3WTF20deleteAllPairSecondsIPNS_6VectorIPN7WebCore7ElementELm0EEEKNS_7HashMapIPNS2_16AtomicStringImplES6_NS_7PtrHashIS9_EENS_10HashTraitsIS9_EENSC_IS6_EEEEEEvRT0_
-__ZN3WTF9HashTableIiSt4pairIiiENS_18PairFirstExtractorIS2_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEES9_EES9_E4swapERSB_
-__ZN7WebCore9DocLoaderC2EPNS_5FrameEPNS_8DocumentE
+__ZN7WebCore14StyleSheetListC2EPNS_8DocumentE
+__ZN7WebCore15CollectionCacheC1Ev
+__ZN7WebCore15CollectionCacheC2Ev
+__ZN7WebCore15CollectionCache5resetEv
+__ZN3WTF20deleteAllPairSecondsIPNS_6VectorIPN7WebCore7ElementELm0EEEKNS_7HashMapIPNS2_16AtomicStringImplES6_NS_7PtrHashIS9_EENS
+__ZN7WebCore9DocLoaderC1EPNS_8DocumentE
+__ZN7WebCore9DocLoaderC2EPNS_8DocumentE
 __ZN7WebCore5cacheEv
+__ZN7WebCore5CacheC1Ev
 __ZN7WebCore5CacheC2Ev
+__ZN7WebCore6LoaderC1Ev
 __ZN7WebCore6LoaderC2Ev
+__ZN7WebCore6Loader4HostC1ERKNS_12AtomicStringEj
+__ZN7WebCore6Loader4HostC2ERKNS_12AtomicStringEj
+__ZN7WebCore43initializeMaximumHTTPConnectionCountPerHostEv
 __ZN7WebCore5Cache12addDocLoaderEPNS_9DocLoaderE
 __ZN3WTF7HashSetIPN7WebCore9DocLoaderENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore9DocLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore9DocLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore9DocLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTabl
+__ZN3WTF9HashTableIPN7WebCore9DocLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTa
+__ZN7WebCore8Document14resetLinkColorEv
+__ZN7WebCore7makeRGBEiii
+__ZN7WebCore8Document21resetVisitedLinkColorEv
+__ZN7WebCore8Document20resetActiveLinkColorEv
+__ZN7WebCore5Color13setNamedColorERKNS_6StringE
+__ZN7WebCore8Document19initSecurityContextEv
+__ZN7WebCore14SecurityOrigin6createERKNS_4KURLE
+__ZN7WebCore14SecurityOriginC1ERKNS_4KURLE
+__ZN7WebCore14SecurityOriginC2ERKNS_4KURLE
+__ZNK7WebCore4KURL8protocolEv
+__ZNK7WebCore6String9substringEjj
+__ZN7WebCore10StringImpl9substringEjj
+__ZNK7WebCore6String5lowerEv
+__ZN7WebCore10StringImpl5lowerEv
+__ZNK7WebCore4KURL4hostEv
+__ZN7WebCore24decodeURLEscapeSequencesERKNS_6StringE
+__ZN7WebCore12UTF8EncodingEv
+__ZN7WebCore12TextEncodingC1EPKc
+__ZN7WebCore12TextEncodingC2EPKc
+__ZN7WebCore31atomicCanonicalTextEncodingNameEPKc
+__ZN7WebCore15TextCodecLatin121registerEncodingNamesEPFvPKcS2_E
+__ZN7WebCoreL24addToTextEncodingNameMapEPKcS1_
+__ZNK3WTF7HashMapIPKcS2_N7WebCore20TextEncodingNameHashENS_10HashTraitsIS2_EES6_E3getERKS2_
+__ZN3WTF7HashMapIPKcS2_N7WebCore20TextEncodingNameHashENS_10HashTraitsIS2_EES6_E3addERKS2_S9_
+__ZN3WTF9HashTableIPKcSt4pairIS2_S2_ENS_18PairFirstExtractorIS4_EEN7WebCore20TextEncodingNameHashENS_14PairHashTraitsINS_10Hash
+__ZN7WebCore15TextCodecLatin114registerCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
+__ZN7WebCoreL17addToTextCodecMapEPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvES9_
+__ZN3WTF7HashMapIPKcN7WebCore16TextCodecFactoryENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS7_IS4_EEE3addERKS2_RKS4_
+__ZN3WTF9HashTableIPKcSt4pairIS2_N7WebCore16TextCodecFactoryEENS_18PairFirstExtractorIS6_EENS_7PtrHashIS2_EENS_14PairHashTraits
+__ZN7WebCore14TextCodecUTF1621registerEncodingNamesEPFvPKcS2_E
+__ZN7WebCore14TextCodecUTF1614registerCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
+__ZN7WebCore20TextCodecUserDefined21registerEncodingNamesEPFvPKcS2_E
+__ZN7WebCore20TextCodecUserDefined14registerCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
+__ZN7WebCore12TextCodecICU25registerBaseEncodingNamesEPFvPKcS2_E
+__ZN7WebCore12TextCodecICU18registerBaseCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
+__ZN7WebCoreL21encodingRegistryMutexEv
+__ZNK7WebCore12TextEncoding25backslashAsCurrencySymbolEv
+__ZN7WebCore30noExtendedTextEncodingNameUsedEv
+__ZN7WebCore24decodeURLEscapeSequencesERKNS_6StringERKNS_12TextEncodingE
+__ZN7WebCore10StringImpl4findEti
+__ZN3WTF6VectorItLm0EE6appendItEEvPKT_m
+__ZN7WebCore10StringImpl5adoptERN3WTF6VectorItLm0EEE
+__ZNK7WebCore4KURL4portEv
+__ZN7WebCore11FrameLoader30shouldTreatURLSchemeAsNoAccessERKNS_6StringE
+__ZN7WebCoreL15noAccessSchemesEv
+__ZNK3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E8containsIS2
+__ZNK7WebCore14SecurityOrigin7isLocalEv
+__ZN7WebCore11FrameLoader27shouldTreatURLSchemeAsLocalERKNS_6StringE
+__ZN7WebCoreL24isDefaultPortForProtocolEtRKNS_6StringE
+__ZN7WebCore22ScriptExecutionContext17setSecurityOriginEN3WTF10PassRefPtrINS_14SecurityOriginEEE
+__ZN7WebCore11FrameLoader32allowSubstituteDataAccessToLocalEv
 __ZNK7WebCore8Document8settingsEv
-__ZNK7WebCore5Frame8settingsEv
+__ZNK7WebCore14SecurityOrigin7isEmptyEv
+__ZN7WebCore11FrameLoader6openerEv
+__ZN7WebCore8Document15initDNSPrefetchEv
+__ZNK7WebCore8Document14parentDocumentEv
+__ZN7WebCore11FrameLoader5clearEbb
+__ZN7WebCore6Editor5clearEv
+__ZN3WTF6VectorIN7WebCore20CompositionUnderlineELm0EE14shrinkCapacityEm
+__ZN7WebCore5Frame6scriptEv
+__ZN7WebCore16ScriptController27updatePlatformScriptObjectsEv
+__ZN7WebCore4KURL7setUserERKNS_6StringE
+__ZN7WebCore4KURL7setPassERKNS_6StringE
+__ZN7WebCore4KURL6setRefERKNS_6StringE
+__ZN7WebCore5Frame11setDocumentEN3WTF10PassRefPtrINS_8DocumentEEE
+__ZNK7WebCore5Frame9selectionEv
+__ZNK7WebCore19SelectionController18isFocusedAndActiveEv
+__ZN7WebCore8Document6attachEv
+__ZN7WebCore11RenderArenaC1Ej
+__ZN7WebCore11RenderArenaC2Ej
+__ZN7WebCore13InitArenaPoolEPNS_9ArenaPoolEPKcjj
+__ZNK7WebCore8Document4viewEv
+__ZN7WebCore12RenderObjectnwEmPNS_11RenderArenaE
+__ZN7WebCore11RenderArena8allocateEm
+__ZN7WebCore13ArenaAllocateEPNS_9ArenaPoolEj
+__ZN7WebCore10RenderViewC1EPNS_4NodeEPNS_9FrameViewE
+__ZN7WebCore10RenderViewC2EPNS_4NodeEPNS_9FrameViewE
+__ZN7WebCore11RenderBlockC2EPNS_4NodeE
+__ZN7WebCore9RenderBoxC2EPNS_4NodeE
+__ZN7WebCore20RenderBoxModelObjectC2EPNS_4NodeE
+__ZN7WebCore12RenderObjectC2EPNS_4NodeE
+__ZN7WebCore12RenderObject18setPrefWidthsDirtyEbb
+__ZN7WebCore11RenderLayernwEmPNS_11RenderArenaE
+__ZN7WebCore11RenderLayerC1EPNS_20RenderBoxModelObjectE
+__ZN7WebCore11RenderLayerC2EPNS_20RenderBoxModelObjectE
+__ZNK7WebCore11RenderLayer22shouldBeNormalFlowOnlyEv
+__ZNK7WebCore11RenderBlock15virtualChildrenEv
 __ZNK7WebCore8Document14userStyleSheetEv
 __ZN7WebCore16CSSStyleSelectorC1EPNS_8DocumentERKNS_6StringEPNS_14StyleSheetListEPNS_13CSSStyleSheetEbb
-__ZN7WebCore15BackgroundLayerC2Ev
-__ZN7WebCore16CSSStyleSelector4initEv
+__ZN7WebCore16CSSStyleSelectorC2EPNS_8DocumentERKNS_6StringEPNS_14StyleSheetListEPNS_13CSSStyleSheetEbb
+__ZN7WebCore9FillLayerC1ENS_14EFillLayerTypeE
+__ZN7WebCore9FillLayerC2ENS_14EFillLayerTypeE
+__ZN7WebCore16CSSStyleSelector15SelectorCheckerC1EPNS_8DocumentEb
+__ZN7WebCore16CSSStyleSelector15SelectorCheckerC2EPNS_8DocumentEb
+__ZNK7WebCore12HTMLDocument14isHTMLDocumentEv
 __ZN7WebCore15CSSFontSelectorC1EPNS_8DocumentE
-__ZN7WebCore16CSSStyleSelector16loadDefaultStyleEv
+__ZN7WebCore15CSSFontSelectorC2EPNS_8DocumentE
+__ZN7WebCore9fontCacheEv
+__ZN7WebCore9FontCache9addClientEPNS_12FontSelectorE
+__ZN3WTF7HashSetIPN7WebCore12FontSelectorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore12FontSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore12FontSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore12FontSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocate
+__ZN3WTF9HashTableIPN7WebCore12FontSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dealloca
+__ZN7WebCore16CSSStyleSelector4initEv
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm64EE14shrinkCapacityEm
+__ZNK7WebCore8Document20cacheDocumentElementEv
+__ZN7WebCore10CSSRuleSetC1Ev
 __ZN7WebCore10CSSRuleSetC2Ev
-__ZN7WebCore12parseUASheetIA9488_cEEPNS_13CSSStyleSheetERKT_
-__ZN7WebCore12parseUASheetEPKcj
+__ZN7WebCoreL12parseUASheetEPKcj
+__ZN7WebCoreL12parseUASheetERKNS_6StringE
+__ZN7WebCore13CSSStyleSheetC1EPS0_RKNS_6StringES4_
 __ZN7WebCore13CSSStyleSheetC2EPS0_RKNS_6StringES4_
 __ZN7WebCore10StyleSheetC2EPS0_RKNS_6StringE
-__ZN7WebCore6StringC1EPKcj
-__ZN7WebCore10StringImpl6createEPKcj
 __ZN7WebCore13CSSStyleSheet11parseStringERKNS_6StringEb
+__ZN7WebCore9CSSParserC1Eb
 __ZN7WebCore9CSSParserC2Eb
 __ZN7WebCore9CSSParser10parseSheetEPNS_13CSSStyleSheetERKNS_6StringE
 __ZN7WebCore9CSSParser11setupParserEPKcRKNS_6StringES2_
@@ -573,486 +524,548 @@ __Z10cssyyparsePv
 __ZN7WebCore9CSSParser3lexEPv
 __ZN7WebCore9CSSParser3lexEv
 __ZN7WebCore9CSSParser4textEPi
-__ZNK7WebCore13CSSStyleSheet15isCSSStyleSheetEv
-__ZN7WebCore12AtomicString3addEPKti
-__ZN7WebCore13CSSStyleSheet12addNamespaceEPNS_9CSSParserERKNS_12AtomicStringES5_
 __ZNK7WebCore9CSSParser8documentEv
+__ZNK7WebCore13CSSStyleSheet15isCSSStyleSheetEv
 __ZN7WebCore9CSSParser22createFloatingSelectorEv
-__ZN7WebCore13QualifiedNameC2ERKS0_
 __ZN3WTF7HashSetIPN7WebCore11CSSSelectorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore13QualifiedNameaSERKS0_
+__ZN3WTF9HashTableIPN7WebCore11CSSSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore11CSSSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore11CSSSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateT
+__ZN3WTF9HashTableIPN7WebCore11CSSSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocat
+__ZN7WebCore12AtomicString3addEPKti
+__ZN3WTF7HashSetIPN7WebCore10StringImplENS1_10StringHashENS_10HashTraitsIS3_EEE3addINS1_11UCharBufferENS1_21UCharBufferTranslat
 __ZN7WebCore13QualifiedName5derefEv
-__ZN7WebCore13QualifiedNameD2Ev
-__ZN7WebCore11ParseString5lowerEv
-__ZN7WebCore16deprecatedStringERKNS_11ParseStringE
-__ZN7WebCore16DeprecatedStringC2EPKNS_14DeprecatedCharEj
-__ZN7WebCore20DeprecatedStringData10initializeEPKNS_14DeprecatedCharEj
-__ZN7WebCore20DeprecatedStringData9makeAsciiEv
-__ZN7WebCore13getPropertyIDEPKci
-__Z8findPropPKcj
-__ZNK7WebCore16DeprecatedString5lowerEv
-__Z9findValuePKcj
+__ZN3WTF15deleteAllValuesIPN7WebCore11CSSSelectorELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN3WTF6VectorIPN7WebCore11CSSSelectorELm0EE6shrinkEm
+__ZN7WebCore9CSSParser20sinkFloatingSelectorEPNS_11CSSSelectorE
+__ZN3WTF9HashTableIPN7WebCore11CSSSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS
+__ZN3WTF9HashTableIPN7WebCore11CSSSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAnd
+__ZN3WTF9HashTableIPN7WebCore11CSSSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3
+__ZN3WTF6VectorIPN7WebCore11CSSSelectorELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore11CSSSelectorELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore11CSSSelectorELm0EE15reserveCapacityEm
+__ZN7WebCore13cssPropertyIDERKNS_15CSSParserStringE
+__ZN7WebCoreL13cssPropertyIDEPKtj
+__ZN7WebCore17cssValueKeywordIDERKNS_15CSSParserStringE
 __ZN7WebCore9CSSParser23createFloatingValueListEv
-__ZN3WTF7HashSetIPN7WebCore9ValueListENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore9CSSParser17sinkFloatingValueERNS_5ValueE
-__ZN7WebCore9CSSParser21sinkFloatingValueListEPNS_9ValueListE
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E4findIiNS_22IdentityHashTranslatorIiiS4_EEEENS_17HashTableIteratorIiiS2_S4_S6_S6_EERKT_
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E47removeAndInvalidateWithoutEntryConsistencyCheckEPi
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E6removeEPi
+__ZN3WTF7HashSetIPN7WebCore18CSSParserValueListENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore18CSSParserValueListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6exp
+__ZN3WTF9HashTableIPN7WebCore18CSSParserValueListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6reh
+__ZN3WTF9HashTableIPN7WebCore18CSSParserValueListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13al
+__ZN3WTF9HashTableIPN7WebCore18CSSParserValueListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15de
+__ZN7WebCore9CSSParser17sinkFloatingValueERNS_14CSSParserValueE
+__ZN7WebCore18CSSParserValueList8addValueERKNS_14CSSParserValueE
+__ZN7WebCore9CSSParser21sinkFloatingValueListEPNS_18CSSParserValueListE
+__ZN3WTF9HashTableIPN7WebCore18CSSParserValueListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4fin
+__ZN3WTF9HashTableIPN7WebCore18CSSParserValueListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47re
+__ZN3WTF9HashTableIPN7WebCore18CSSParserValueListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rem
 __ZN7WebCore9CSSParser10parseValueEib
 __ZN7WebCore9CSSParser21checkForOrphanedUnitsEv
+__ZN7WebCore9CSSParser17checkForVariablesEPNS_18CSSParserValueListE
+__ZN7WebCore17CSSPrimitiveValue16createIdentifierEi
+__ZN7WebCore17CSSPrimitiveValueC1Ei
 __ZN7WebCore17CSSPrimitiveValueC2Ei
 __ZN7WebCore9CSSParser11addPropertyEiN3WTF10PassRefPtrINS_8CSSValueEEEb
-__ZN7WebCore9ValueListD2Ev
-__ZN3WTF6VectorIN7WebCore5ValueELm16EE6shrinkEm
-__ZN7WebCore9CSSParser15createStyleRuleEPNS_11CSSSelectorE
-__ZN7WebCore12CSSStyleRuleC2EPNS_9StyleBaseE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore9StyleBaseEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore9StyleBaseEEELm0EE15reserveCapacityEm
-__ZN7WebCore9CSSParser20sinkFloatingSelectorEPNS_11CSSSelectorE
+__ZN7WebCore18CSSParserValueListD1Ev
+__ZN7WebCore18CSSParserValueListD2Ev
+__ZN3WTF6VectorIN7WebCore14CSSParserValueELm4EE6shrinkEm
+__ZN7WebCore9CSSParser15createStyleRuleEPN3WTF6VectorIPNS_11CSSSelectorELm0EEE
+__ZN7WebCore12CSSStyleRuleC1EPNS_13CSSStyleSheetE
+__ZN7WebCore12CSSStyleRuleC2EPNS_13CSSStyleSheetE
+__ZN7WebCore15CSSSelectorList19adoptSelectorVectorERN3WTF6VectorIPNS_11CSSSelectorELm0EEE
+__ZN7WebCore15CSSSelectorList15deleteSelectorsEv
+__ZN7WebCore26CSSMutableStyleDeclarationC1EPNS_7CSSRuleEPKPKNS_11CSSPropertyEi
 __ZN7WebCore26CSSMutableStyleDeclarationC2EPNS_7CSSRuleEPKPKNS_11CSSPropertyEi
 __ZN7WebCore19CSSStyleDeclarationC2EPNS_7CSSRuleE
-__ZN7WebCore23DeprecatedValueListImpl10appendNodeEPNS_27DeprecatedValueListImplNodeE
-__ZN7WebCore23DeprecatedValueListImpl11copyOnWriteEv
+__ZNK7WebCore9StyleBase16useStrictParsingEv
+__ZNK7WebCore8CSSValue24isVariableDependentValueEv
 __ZN7WebCore12CSSStyleRule14setDeclarationEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9StyleBaseEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9StyleBaseEEELm0EE15reserveCapacityEm
 __ZN7WebCore9CSSParser15clearPropertiesEv
 __ZN7WebCore9StyleList6appendEN3WTF10PassRefPtrINS_9StyleBaseEEE
 __ZN7WebCore9StyleBase18insertedIntoParentEv
-__ZN3WTF6VectorIcLm256EE6shrinkEm
+__ZN7WebCore18charactersToDoubleEPKtmPb
 __ZN7WebCore9CSSParser12parse4ValuesEiPKib
-__ZN7WebCore9CSSParser9validUnitEPNS_5ValueENS0_5UnitsEb
+__ZN7WebCore9CSSParser9validUnitEPNS_14CSSParserValueENS0_5UnitsEb
+__ZN7WebCore17CSSPrimitiveValue6createEdNS0_9UnitTypesE
+__ZN7WebCore17CSSPrimitiveValueC1EdNS0_9UnitTypesE
 __ZN7WebCore17CSSPrimitiveValueC2EdNS0_9UnitTypesE
-__ZN7WebCore10StringImplC1EPKtjj
+__ZN7WebCore15CSSParserString5lowerEv
 __ZNK7WebCore11CSSSelector17extractPseudoTypeEv
-__ZN7WebCore9CSSParser12parseContentEib
+__ZN7WebCoreL9hasPrefixEPKcjS1_
+__ZN7WebCore9CSSParser14parseShorthandEiPKiib
+__ZN7WebCore12CSSValueListC1Eb
 __ZN7WebCore12CSSValueListC2Eb
-__ZN7WebCore6StringC2EPKtj
-__ZN7WebCore17CSSPrimitiveValueC2ERKNS_6StringENS0_9UnitTypesE
 __ZN7WebCore12CSSValueList6appendEN3WTF10PassRefPtrINS_8CSSValueEEE
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore8CSSValueEEELm0EE14expandCapacityEm
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore8CSSValueEEELm0EE15reserveCapacityEm
-__ZN7WebCore9CSSParser14parseShorthandEiPKiib
-__ZN7WebCore20DeprecatedStringDataC2EPKNS_14DeprecatedCharEj
-__ZN7WebCore9CSSParser10parseColorEPNS_5ValueE
-__ZN7WebCore9CSSParser19parseColorFromValueEPNS_5ValueERjb
-__ZN7WebCore9CSSParser10parseColorERKNS_6StringERjb
-__ZN7WebCore5Color13parseHexColorERKNS_6StringERj
-__ZNK7WebCore16DeprecatedString5toIntEPbi
-__ZN7WebCore24isCharacterAllowedInBaseENS_14DeprecatedCharEi
-__ZN7WebCore17CSSPrimitiveValueC2Ej
-__ZN7WebCore9CSSParser23parseBackgroundPropertyEiRiS1_RN3WTF6RefPtrINS_8CSSValueEEES6_
-__ZN7WebCore9CSSParser20parseBackgroundImageERN3WTF6RefPtrINS_8CSSValueEEE
-__ZN7WebCore13CSSImageValueC2Ev
-__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_4PairEEE
-__ZN7WebCore9CSSParser15parseFontFamilyEv
+__ZN7WebCore11CSSSelector13setTagHistoryEPS0_
+__ZN7WebCore9CSSParserD1Ev
 __ZN7WebCore9CSSParserD2Ev
-__ZN3WTF15deleteAllValuesIPN7WebCore11CSSSelectorEKNS_9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEESA_EEEEvRT0_
-__ZN3WTF15deleteAllValuesIPN7WebCore9ValueListEKNS_9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEESA_EEEEvRT0_
-__ZN3WTF15deleteAllValuesIPN7WebCore8FunctionEKNS_9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEESA_EEEEvRT0_
+__ZN7WebCore9CSSParser14clearVariablesEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore8CSSValueEEELm0EE14shrinkCapacityEm
+__ZN3WTF15deleteAllValuesIPN7WebCore11CSSSelectorEKNS_9HashTableIS3_S3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTr
+__ZN3WTF15deleteAllValuesIPN7WebCore18CSSParserValueListEKNS_9HashTableIS3_S3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_1
+__ZN3WTF15deleteAllValuesIPN7WebCore17CSSParserFunctionEKNS_9HashTableIS3_S3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10
+__ZN3WTF9HashTableIPN7WebCore17CSSParserFunctionES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dea
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore9StyleBaseEEELm0EE6shrinkEm
-__ZN7WebCore10screenEvalEv
+__ZN7WebCoreL10screenEvalEv
+__ZN7WebCore19MediaQueryEvaluatorC1EPKcb
 __ZN7WebCore19MediaQueryEvaluatorC2EPKcb
 __ZN7WebCore10CSSRuleSet17addRulesFromSheetEPNS_13CSSStyleSheetERKNS_19MediaQueryEvaluatorEPNS_16CSSStyleSelectorE
 __ZN7WebCore12CSSStyleRule11isStyleRuleEv
 __ZN7WebCore10CSSRuleSet7addRuleEPNS_12CSSStyleRuleEPNS_11CSSSelectorE
-__ZN7WebCore10CSSRuleSet12addToRuleSetEPNS_16AtomicStringImplERN3WTF7HashMapIS2_PNS_15CSSRuleDataListENS3_7PtrHashIS2_EENS3_10HashTraitsIS2_EENS9_IS6_EEEEPNS_12CSSStyleRuleEPNS_11CSSSelectorE
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_15CSSRuleDataListENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
-__ZN3WTF9HashTableIiSt4pairIiiENS_18PairFirstExtractorIS2_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEES9_EES9_E4findIiNS_22IdentityHashTranslatorIiS2_S6_EEEENS_17HashTableIteratorIiS2_S4_S6_SA_S9_EERKT_
-__ZN7WebCore9printEvalEv
-__ZN7WebCore12parseUASheetIA331_cEEPNS_13CSSStyleSheetERKT_
-__ZN7WebCore12parseUASheetIA1931_cEEPNS_13CSSStyleSheetERKT_
-__ZN7WebCore9CSSParser12parseCounterEiib
-__ZN7WebCore9CSSParser22createFloatingFunctionEv
-__ZN3WTF7HashSetIPN7WebCore8FunctionENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZNK7WebCore6String5lowerEv
-__ZN7WebCore10StringImpl5lowerEv
-__ZN7WebCore9CSSParser20parseColorParametersEPNS_5ValueEPib
-__ZN7WebCore7makeRGBEiii
-__ZN7WebCore15FontFamilyValueC2ERKNS_16DeprecatedStringE
-__ZN7WebCore17RegularExpressionC2EPKc
-__ZN7WebCore16DeprecatedStringC1EPKc
-__ZN7WebCore17RegularExpression7PrivateC2ENS_16DeprecatedStringEbb
-__ZN7WebCore17RegularExpression7Private7compileEbb
-__ZN7WebCore16DeprecatedString7replaceERKNS_17RegularExpressionERKS0_
-__ZNK7WebCore17RegularExpression5matchERKNS_16DeprecatedStringEiPi
-__ZN7WebCore9CSSParser19parseCounterContentEPNS_9ValueListEb
-__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_7CounterEEE
-__ZN7WebCore9CSSParser11parseShadowEib
-__ZN7WebCore18ShadowParseContext11commitValueEv
-__ZN7WebCore11ShadowValueC2EN3WTF10PassRefPtrINS_17CSSPrimitiveValueEEES4_S4_S4_
-__ZN7WebCore16DeprecatedString6appendEc
-__ZN7WebCore16DeprecatedString6appendERKS0_
-__ZN7WebCore16DeprecatedString6insertEjRKS0_
-__ZN7WebCore16DeprecatedString12forceUnicodeEv
-__ZN7WebCore16DeprecatedString9setLengthEj
-__ZN7WebCore20DeprecatedStringData19increaseUnicodeSizeEj
-__ZNK7WebCore8Document4viewEv
+__ZN7WebCore10CSSRuleSet12addToRuleSetEPNS_16AtomicStringImplERN3WTF7HashMapIS2_PNS_15CSSRuleDataListENS3_7PtrHashIS2_EENS3_10H
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_15CSSRuleDataListENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_15CSSRuleDataListENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_15CSSRuleDataListEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_
 __ZNK7WebCore9FrameView9mediaTypeEv
+__ZN7WebCore19MediaQueryEvaluatorC1ERKNS_6StringEb
 __ZN7WebCore19MediaQueryEvaluatorC2ERKNS_6StringEb
-__ZNK7WebCore8Document15documentElementEv
-__ZN7WebCore29DeprecatedPtrListImplIteratorC2ERKNS_21DeprecatedPtrListImplE
-__ZNK7WebCore21DeprecatedPtrListImpl11addIteratorEPNS_29DeprecatedPtrListImplIteratorE
-__ZNK7WebCore29DeprecatedPtrListImplIterator7currentEv
-__ZN7WebCore29DeprecatedPtrListImplIteratorD2Ev
-__ZNK7WebCore21DeprecatedPtrListImpl14removeIteratorEPNS_29DeprecatedPtrListImplIteratorE
-__ZN7WebCore8Document14resetLinkColorEv
-__ZN7WebCore8Document21resetVisitedLinkColorEv
-__ZN7WebCore8Document20resetActiveLinkColorEv
-__ZN7WebCore5Color13setNamedColorERKNS_6StringE
-__ZNK7WebCore16DeprecatedString10isAllASCIIEv
-__ZN7WebCore8Document18initSecurityOriginEv
-__ZN7WebCore14SecurityOrigin14createForFrameEPNS_5FrameE
-__ZN7WebCore11FrameLoader6openerEv
-__ZNK7WebCore4KURL4portEv
-__ZNK7WebCore4KURL4hostEv
-__ZN7WebCore14SecurityOrigin6createERKNS_6StringES3_tPS0_
-__ZN7WebCore14SecurityOriginC1ERKNS_6StringES3_t
-__ZN7WebCore24isDefaultPortForProtocolEtNS_6StringE
-__ZNK7WebCore14SecurityOrigin7isEmptyEv
-__ZN7WebCore5Frame11setDocumentEN3WTF10PassRefPtrINS_8DocumentEEE
-__ZNK7WebCore5Frame19selectionControllerEv
-__ZNK7WebCore19SelectionController18isFocusedAndActiveEv
-__ZN7WebCore8Document6attachEv
-__ZN7WebCore11RenderArenaC2Ej
-__ZN7WebCore13InitArenaPoolEPNS_9ArenaPoolEPKcjj
-__ZN7WebCore12RenderObjectnwEmPNS_11RenderArenaE
-__ZN7WebCore11RenderArena8allocateEm
-__ZN7WebCore13ArenaAllocateEPNS_9ArenaPoolEj
-__ZN7WebCore10RenderViewC2EPNS_4NodeEPNS_9FrameViewE
-__ZN7WebCore15RenderContainerC2EPNS_4NodeE
-__ZN7WebCore9RenderBoxC2EPNS_4NodeE
-__ZN7WebCore12RenderObjectC2EPNS_4NodeE
-__ZN7WebCore12RenderObject18setPrefWidthsDirtyEbb
-__ZN7WebCore11RenderLayernwEmPNS_11RenderArenaE
-__ZN7WebCore11RenderLayerC2EPNS_12RenderObjectE
-__ZNK7WebCore11RenderLayer20shouldBeOverflowOnlyEv
-__ZNK7WebCore15RenderContainer10firstChildEv
+__ZNK7WebCore14StyleSheetList6lengthEv
 __ZN7WebCore8Document11recalcStyleENS_4Node11StyleChangeE
-__ZNK7WebCore5Frame10isPaintingEv
+__ZNK7WebCore9FrameView10isPaintingEv
 __ZN7WebCore13ContainerNode26suspendPostAttachCallbacksEv
-__ZN7WebCore11RenderStylenwEmPNS_11RenderArenaE
+__ZNK7WebCore8Document4pageEv
+__ZN7WebCore4Page32setMemoryCacheClientCallsEnabledEb
+__ZN7WebCore6Loader22suspendPendingRequestsEv
+__ZN7WebCore9FrameView20pauseScheduledEventsEv
+__ZN7WebCore11RenderStyle6createEv
+__ZN7WebCore11RenderStyleC1Ev
 __ZN7WebCore11RenderStyleC2Ev
+__ZN7WebCore11RenderStyle18createDefaultStyleEv
+__ZN7WebCore11RenderStyleC1Eb
 __ZN7WebCore11RenderStyleC2Eb
-__ZN7WebCore11RenderStyle14setBitDefaultsEv
+__ZN7WebCore12StyleBoxDataC1Ev
 __ZN7WebCore12StyleBoxDataC2Ev
+__ZN7WebCore15StyleVisualDataC1Ev
 __ZN7WebCore15StyleVisualDataC2Ev
+__ZN7WebCore19StyleBackgroundDataC1Ev
 __ZN7WebCore19StyleBackgroundDataC2Ev
+__ZN7WebCore17StyleSurroundDataC1Ev
 __ZN7WebCore17StyleSurroundDataC2Ev
+__ZN7WebCore25StyleRareNonInheritedDataC1Ev
 __ZN7WebCore25StyleRareNonInheritedDataC2Ev
+__ZN7WebCore20StyleFlexibleBoxDataC1Ev
 __ZN7WebCore20StyleFlexibleBoxDataC2Ev
+__ZN7WebCore16StyleMarqueeDataC1Ev
 __ZN7WebCore16StyleMarqueeDataC2Ev
+__ZN7WebCore17StyleMultiColDataC1Ev
 __ZN7WebCore17StyleMultiColDataC2Ev
 __ZN7WebCore18StyleTransformDataC1Ev
+__ZN7WebCore18StyleTransformDataC2Ev
+__ZN7WebCore19TransformOperationsC1Eb
+__ZN7WebCore19TransformOperationsC2Eb
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EEC1ERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EEC2ERKS5_
+__ZN7WebCore22StyleRareInheritedDataC1Ev
 __ZN7WebCore22StyleRareInheritedDataC2Ev
+__ZN7WebCore18StyleInheritedDataC1Ev
 __ZN7WebCore18StyleInheritedDataC2Ev
 __ZN7WebCore4FontC1Ev
+__ZN7WebCore4FontC2Ev
+__ZN7WebCore14SVGRenderStyleC1Ev
 __ZN7WebCore14SVGRenderStyleC2Ev
-__ZN7WebCore14SVGRenderStyleC2Eb
+__ZN7WebCore14SVGRenderStyleC1ENS0_17CreateDefaultTypeE
+__ZN7WebCore14SVGRenderStyleC2ENS0_17CreateDefaultTypeE
+__ZN7WebCore13StyleFillDataC1Ev
 __ZN7WebCore13StyleFillDataC2Ev
 __ZN7WebCore8SVGPaint11defaultFillEv
+__ZN7WebCore8SVGPaintC1ERKNS_5ColorE
 __ZN7WebCore8SVGPaintC2ERKNS_5ColorE
+__ZN7WebCore8SVGColorC2ERKNS_5ColorE
+__ZN7WebCore15StyleStrokeDataC1Ev
 __ZN7WebCore15StyleStrokeDataC2Ev
 __ZN7WebCore8SVGPaint13defaultStrokeEv
+__ZN7WebCore8SVGPaintC1ENS0_12SVGPaintTypeE
 __ZN7WebCore8SVGPaintC2ENS0_12SVGPaintTypeE
 __ZN7WebCore8SVGColorC2Ev
+__ZN7WebCore13StyleTextDataC1Ev
 __ZN7WebCore13StyleTextDataC2Ev
+__ZN7WebCore13StyleStopDataC1Ev
 __ZN7WebCore13StyleStopDataC2Ev
+__ZN7WebCore13StyleClipDataC1Ev
 __ZN7WebCore13StyleClipDataC2Ev
+__ZN7WebCore13StyleMaskDataC1Ev
 __ZN7WebCore13StyleMaskDataC2Ev
+__ZN7WebCore13StyleMiscDataC1Ev
 __ZN7WebCore13StyleMiscDataC2Ev
+__ZN7WebCore15StyleMarkerDataC1Ev
 __ZN7WebCore15StyleMarkerDataC2Ev
+__ZNK7WebCore5Frame19shouldApplyPageZoomEv
 __ZNK7WebCore8Settings17fontRenderingModeEv
 __ZNK7WebCore16CSSStyleSelector18fontSizeForKeywordEibb
 __ZN7WebCore16CSSStyleSelector11setFontSizeERNS_15FontDescriptionEf
 __ZN7WebCore16CSSStyleSelector32getComputedSizeFromSpecifiedSizeEbf
-__ZNK7WebCore5Frame10zoomFactorEv
-__ZNK7WebCore10FontFamilyeqERKS0_
+__ZNK7WebCore5Frame19shouldApplyTextZoomEv
+__ZN7WebCoreeqERKNS_10FontFamilyES2_
+__ZN7WebCore4FontC1ERKNS_15FontDescriptionEss
 __ZN7WebCore4FontC2ERKNS_15FontDescriptionEss
+__ZN7WebCore10FontFamilyC1ERKS0_
 __ZN7WebCore10FontFamilyC2ERKS0_
+__ZN7WebCore18StyleInheritedDataC1ERKS0_
 __ZN7WebCore18StyleInheritedDataC2ERKS0_
+__ZN7WebCore4FontC1ERKS0_
 __ZN7WebCore4FontC2ERKS0_
 __ZN7WebCore4FontaSERKS0_
 __ZN7WebCore10FontFamilyaSERKS0_
+__ZN3WTF9HashTableIiSt4pairIiPN7WebCore17GlyphPageTreeNodeEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_
 __ZN7WebCore4FontD1Ev
+__ZN7WebCore4FontD2Ev
 __ZNK7WebCore4Font6updateEN3WTF10PassRefPtrINS_12FontSelectorEEE
+__ZN7WebCore16FontFallbackListC1Ev
 __ZN7WebCore16FontFallbackListC2Ev
+__ZN7WebCore9FontCache10generationEv
 __ZN7WebCore16FontFallbackList10invalidateEN3WTF10PassRefPtrINS_12FontSelectorEEE
-__ZNK7WebCore4Node4diffEPNS_11RenderStyleES2_
-__ZNK7WebCore11RenderStyle14hasPseudoStyleENS0_8PseudoIdE
-__ZN7WebCore11RenderBlock8setStyleEPNS_11RenderStyleE
-__ZN7WebCore9RenderBox8setStyleEPNS_11RenderStyleE
-__ZN7WebCore12RenderObject8setStyleEPNS_11RenderStyleE
+__ZN7WebCore16FontFallbackList15releaseFontDataEv
+__ZN3WTF6VectorISt4pairIPKN7WebCore8FontDataEbELm1EE14shrinkCapacityEm
+__ZN7WebCore4Node4diffEPNS_11RenderStyleES2_
+__ZNK7WebCore11RenderStyle14hasPseudoStyleENS_8PseudoIdE
+__ZN7WebCore12RenderObject8setStyleEN3WTF10PassRefPtrINS_11RenderStyleEEE
+__ZNK7WebCore12RenderObject21adjustStyleDifferenceENS_15StyleDifferenceEj
+__ZN7WebCore11RenderBlock15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore9RenderBox15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore20RenderBoxModelObject15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore11RenderLayer19isSelfPaintingLayerEv
+__ZN7WebCore12RenderObject15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
 __ZNK7WebCore12RenderObject4viewEv
-__ZN7WebCore12RenderObject22updateBackgroundImagesEPNS_11RenderStyleE
+__ZN7WebCore12RenderObject16updateFillImagesEPKNS_9FillLayerES3_
+__ZN7WebCore12RenderObject11updateImageEPNS_10StyleImageES2_
+__ZN7WebCore11RenderBlock14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore9RenderBox14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore20RenderBoxModelObject14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore12RenderObject14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore9RenderBox27updateBoxModelInfoFromStyleEv
+__ZN7WebCore20RenderBoxModelObject27updateBoxModelInfoFromStyleEv
 __ZNK7WebCore10RenderView12isRenderViewEv
+__ZNK7WebCore20RenderBoxModelObject13requiresLayerEv
+__ZN7WebCore11RenderLayer12styleChangedENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore11RenderLayer23updateScrollCornerStyleEv
+__ZN7WebCore4Node18shadowAncestorNodeEv
+__ZNK7WebCore4Node12isSVGElementEv
+__ZN7WebCore4Node18shadowTreeRootNodeEv
+__ZNK7WebCore4Node12isShadowNodeEv
+__ZN7WebCore11RenderLayer18updateResizerStyleEv
 __ZNK7WebCore12RenderObject6isBodyEv
-__ZNK7WebCore4Node17virtualHasTagNameERKNS_13QualifiedNameE
-__ZNK7WebCore11RenderBlock13isRenderBlockEv
-__ZN7WebCore12RenderObject13requiresLayerEv
-__ZN7WebCore11RenderLayer12styleChangedEv
-__ZNK7WebCore15RenderContainer15canHaveChildrenEv
-__ZN7WebCore15RenderContainer24updateBeforeAfterContentENS_11RenderStyle8PseudoIdE
-__ZN7WebCore15RenderContainer36updateBeforeAfterContentForContainerENS_11RenderStyle8PseudoIdEPS0_
-__ZNK7WebCore12RenderObject14getPseudoStyleENS_11RenderStyle8PseudoIdEPS1_
-__ZN7WebCore15RenderContainer20beforeAfterContainerENS_11RenderStyle8PseudoIdE
-__ZNK7WebCore15RenderContainer9lastChildEv
 __ZN7WebCore11RenderBlock17updateFirstLetterEv
-__ZN7WebCore4Node10setChangedENS_15StyleChangeTypeE
-__ZN7WebCore8Document18setDocumentChangedEb
+__ZN7WebCore4Node19setNeedsStyleRecalcENS_15StyleChangeTypeE
+__ZN7WebCore8Document21unscheduleStyleRecalcEv
+__ZN7WebCore9FrameView21resumeScheduledEventsEv
+__ZN7WebCore9FrameView23dispatchScheduledEventsEv
 __ZN7WebCore13ContainerNode25resumePostAttachCallbacksEv
+__ZN7WebCore11FrameLoader35tellClientAboutPastMemoryCacheLoadsEv
+__ZN7WebCore6Loader21resumePendingRequestsEv
+__ZNK7WebCore6Loader4Host11hasRequestsEv
 __ZN7WebCore13ContainerNode6attachEv
 __ZN7WebCore4Node6attachEv
-__ZN7WebCore8Document6setURLERKNS_16DeprecatedStringE
-__ZN7WebCoreeqERKNS_16DeprecatedStringES2_
-__ZN7WebCore8Document10setBaseURLERKNS_16DeprecatedStringE
-__ZN7WebCore11FrameLoader19updatePolicyBaseURLEv
-__ZN7WebCore11FrameLoader16setPolicyBaseURLERKNS_6StringE
+__ZN7WebCore16ScriptController14updateDocumentEv
+__ZN7WebCore8Document6setURLERKNS_4KURLE
+__ZN7WebCore8Document13updateBaseURLEv
+__ZN7WebCore4KURLC1ERKS0_RKNS_6StringE
+__ZN7WebCore4KURLC2ERKS0_RKNS_6StringE
+__ZN7WebCore4KURL4initERKS0_RKNS_6StringERKNS_12TextEncodingE
+__ZN7WebCoreL9copyASCIIEPKtiPc
+__ZN7WebCore17equalIgnoringCaseEPNS_10StringImplES1_
+__ZN3WTF6VectorIcLm512EE6shrinkEm
+__ZNK7WebCore5Frame9domWindowEv
+__ZN7WebCore9DOMWindowC1EPNS_5FrameE
+__ZN7WebCore9DOMWindowC2EPNS_5FrameE
+__ZN7WebCore11FrameLoader26updateFirstPartyForCookiesEv
+__ZN7WebCore11FrameLoader23setFirstPartyForCookiesERKNS_4KURLE
 __ZN7WebCore9DocLoader17setAutoLoadImagesEb
+__ZNK7WebCore20ResourceResponseBase15httpHeaderFieldERKNS_12AtomicStringE
+__ZNK3WTF7HashMapIN7WebCore12AtomicStringENS1_6StringENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS5_IS3_EEE3getERKS2_
+__ZN7WebCore12AtomicString6removeEPNS_10StringImplE
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E47removeAndI
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E6removeEPS3_
 __ZN7WebCore11FrameLoader20restoreDocumentStateEv
 __ZN7WebCore8Document12implicitOpenEv
 __ZN7WebCore8Document13cancelParsingEv
 __ZN7WebCore8Document5clearEv
 __ZN7WebCore13ContainerNode14removeChildrenEv
-__ZN7WebCore23DeprecatedValueListImpl5clearEv
+__ZNK7WebCore8Document9domWindowEv
+__ZN7WebCore9DOMWindow23removeAllEventListenersEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EE14shrinkCapacityEm
+__ZN7WebCoreL29pendingUnloadEventListenerMapEv
+__ZN7WebCoreL27removePendingEventListenersERN3WTF7HashMapIPNS_9DOMWindowEPNS0_6VectorINS0_6RefPtrINS_23RegisteredEventListenerE
+__ZN3WTF7HashMapIPN7WebCore9DOMWindowEPNS_6VectorINS_6RefPtrINS1_23RegisteredEventListenerEEELm0EEENS_7PtrHashIS3_EENS_10HashTr
+__ZN7WebCoreL35pendingBeforeUnloadEventListenerMapEv
 __ZN7WebCore12HTMLDocument15createTokenizerEv
 __ZN7WebCore19InspectorController13windowVisibleEv
+__ZN7WebCore13HTMLTokenizerC1EPNS_12HTMLDocumentEb
 __ZN7WebCore13HTMLTokenizerC2EPNS_12HTMLDocumentEb
+__ZN7WebCore10HTMLParserC1EPNS_12HTMLDocumentEb
 __ZN7WebCore10HTMLParserC2EPNS_12HTMLDocumentEb
 __ZN7WebCore13HTMLTokenizer5beginEv
 __ZN7WebCore13HTMLTokenizer5resetEv
+__ZN3WTF6VectorItLm0EE14shrinkCapacityEm
 __ZN7WebCore15SegmentedString5clearEv
 __ZN7WebCore8Document10setParsingEb
-__ZN7WebCore10ScrollView14resizeContentsEii
-__ZNK7WebCore10ScrollView15getDocumentViewEv
+__ZNK7WebCore5Frame9animationEv
+__ZN7WebCore19AnimationController20beginAnimationUpdateEv
+__ZN7WebCore9FrameView15setContentsSizeERKNS_7IntSizeE
+__ZN7WebCore10ScrollView15setContentsSizeERKNS_7IntSizeE
+__ZNK7WebCore10ScrollView12contentsSizeEv
+__ZNK7WebCore10ScrollView20platformContentsSizeEv
+__ZNK7WebCore10ScrollView12documentViewEv
+__ZN7WebCore16enclosingIntRectERK6CGRect
+__ZNK7WebCore6Chrome19contentsSizeChangedEPNS_5FrameERKNS_7IntSizeE
 __ZN7WebCore11FrameLoader5writeEPKcib
 __ZNK7WebCore9Tokenizer12wantsRawDataEv
 __ZN7WebCore12TextEncodingC1ERKNS_6StringE
+__ZN7WebCore12TextEncodingC2ERKNS_6StringE
 __ZN7WebCore31atomicCanonicalTextEncodingNameEPKtm
-__ZN7WebCore31atomicCanonicalTextEncodingNameEPKc
-__ZN7WebCore19TextResourceDecoderC1ERKNS_6StringERKNS_12TextEncodingE
+__ZN7WebCore19TextResourceDecoderC1ERKNS_6StringERKNS_12TextEncodingEb
+__ZN7WebCore19TextResourceDecoderC2ERKNS_6StringERKNS_12TextEncodingEb
 __ZN7WebCore19TextResourceDecoder20determineContentTypeERKNS_6StringE
 __ZN7WebCore17equalIgnoringCaseEPNS_10StringImplEPKc
 __ZN7WebCore19TextResourceDecoder15defaultEncodingENS0_11ContentTypeERKNS_12TextEncodingE
 __ZN7WebCore14Latin1EncodingEv
-__ZN7WebCore12TextEncodingC2EPKc
-__ZN7WebCore15TextCodecLatin121registerEncodingNamesEPFvPKcS2_E
-__ZN7WebCore24addToTextEncodingNameMapEPKcS1_
-__ZNK3WTF7HashMapIPKcS2_N7WebCore20TextEncodingNameHashENS_10HashTraitsIS2_EES6_E3getERKS2_
-__ZN3WTF9HashTableIPKcSt4pairIS2_iENS_18PairFirstExtractorIS4_EEN7WebCore20TextEncodingNameHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSA_IiEEEESB_E3addIS2_S2_NS_17HashMapTranslatorILb1ES3_IS2_S2_ENS_18PairBaseHashTraitsISB_SB_EESD_S8_EEEES3_INS_17HashTableIteratorIS2_S4_S6_S8_SD_SB_EEbERKT_RKT0_
-__ZN3WTF9HashTableIPKcSt4pairIS2_iENS_18PairFirstExtractorIS4_EEN7WebCore20TextEncodingNameHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSA_IiEEEESB_E6expandEv
-__ZN7WebCore15TextCodecLatin114registerCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
-__ZN7WebCore17addToTextCodecMapEPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvES9_
-__ZNK3WTF7HashMapIPKcN7WebCore16TextCodecFactoryENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS7_IS4_EEE3getERKS2_
-__ZN3WTF9HashTableIiSt4pairIiN7WebCore16TextCodecFactoryEENS_18PairFirstExtractorIS4_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E3addIPKcS3_NS_17HashMapTranslatorILb1ES1_ISH_S3_ENS_18PairBaseHashTraitsINSA_ISH_EESC_EESD_NS_7PtrHashISH_EEEEEES1_INS_17HashTableIteratorIiS4_S6_S8_SD_SB_EEbERKT_RKT0_
-__ZN3WTF9HashTableIiSt4pairIiN7WebCore16TextCodecFactoryEENS_18PairFirstExtractorIS4_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E6expandEv
-__ZN7WebCore14TextCodecUTF1621registerEncodingNamesEPFvPKcS2_E
-__ZN3WTF9HashTableIPKcSt4pairIS2_iENS_18PairFirstExtractorIS4_EEN7WebCore20TextEncodingNameHashENS_14PairHashTraitsINS_10HashTraitsIS2_EENSA_IiEEEESB_E4findIS2_NS_22IdentityHashTranslatorIS2_S4_S8_EEEENS_17HashTableIteratorIS2_S4_S6_S8_SD_SB_EERKT_
-__ZN7WebCore14TextCodecUTF1614registerCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
-__ZN7WebCore20TextCodecUserDefined21registerEncodingNamesEPFvPKcS2_E
-__ZN7WebCore20TextCodecUserDefined14registerCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
-__ZN7WebCore12TextCodecICU25registerBaseEncodingNamesEPFvPKcS2_E
-__ZN7WebCore12TextCodecICU18registerBaseCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
-__ZN7WebCore11TextDecoderC2ERKNS_12TextEncodingE
-__ZN7WebCore8Document10setDecoderEPNS_19TextResourceDecoderE
+__ZN7WebCore8Document10setDecoderEN3WTF10PassRefPtrINS_19TextResourceDecoderEEE
 __ZN7WebCore19TextResourceDecoder6decodeEPKcm
 __ZN7WebCore19TextResourceDecoder11checkForBOMEPKcm
 __ZN7WebCore19TextResourceDecoder19checkForHeadCharsetEPKcmRb
 __ZN3WTF6VectorIcLm0EE4growEm
 __ZN7WebCore19TextResourceDecoder5flushEv
-__ZN7WebCore11TextDecoder11checkForBOMEPKcmb
 __ZN7WebCore12newTextCodecERKNS_12TextEncodingE
-__ZN7WebCore36newStreamingTextDecoderWindowsLatin1ERKNS_12TextEncodingEPKv
-__ZN7WebCore15TextCodecLatin16decodeEPKcmb
+__ZNK3WTF7HashMapIPKcN7WebCore16TextCodecFactoryENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS7_IS4_EEE3getERKS2_
+__ZN7WebCoreL36newStreamingTextDecoderWindowsLatin1ERKNS_12TextEncodingEPKv
+__ZN7WebCore15TextCodecLatin16decodeEPKcmbbRb
+__ZN3WTF6VectorIcLm0EE14shrinkCapacityEm
+__ZN7WebCore15TextCodecLatin1D0Ev
+__ZN7WebCore9TextCodecD2Ev
 __ZN7WebCore8Document13finishParsingEv
 __ZN7WebCore13HTMLTokenizer6finishEv
 __ZN7WebCore13HTMLTokenizer3endEv
 __ZN7WebCore13HTMLTokenizer12processTokenEv
-__ZN7WebCore5Frame11scriptProxyEv
+__ZN7WebCore16ScriptController9isEnabledEv
 __ZN7WebCore10HTMLParser8finishedEv
-__ZNK7WebCore8Document14isDocumentNodeEv
-__ZN7WebCore15HTMLHtmlElementC2EPNS_8DocumentE
+__ZN7WebCore15HTMLHtmlElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLHtmlElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore11HTMLElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore13StyledElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore7ElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore10HTMLParser10insertNodeEPNS_4NodeEb
-__ZNK7WebCore7Element9localNameEv
+__ZNK7WebCore7Element16virtualLocalNameEv
 __ZNK7WebCore11HTMLElement13isHTMLElementEv
 __ZNK7WebCore15HTMLHtmlElement11tagPriorityEv
 __ZN7WebCore13ContainerNode8addChildEN3WTF10PassRefPtrINS_4NodeEEE
-__ZNK7WebCore12HTMLDocument14isHTMLDocumentEv
 __ZN7WebCore12HTMLDocument12childAllowedEPNS_4NodeE
-__ZNK7WebCore7Element17virtualHasTagNameERKNS_13QualifiedNameE
+__ZN7WebCore22appendChildToContainerINS_4NodeENS_13ContainerNodeEEEvPT_PT0_
+__ZN7WebCore15HTMLHtmlElement20insertedIntoDocumentEv
 __ZN7WebCore7Element20insertedIntoDocumentEv
 __ZN7WebCore13ContainerNode20insertedIntoDocumentEv
-__ZN7WebCore15EventTargetNode20insertedIntoDocumentEv
-__ZN7WebCore11EventTarget20insertedIntoDocumentEPNS_15EventTargetNodeE
 __ZN7WebCore4Node20insertedIntoDocumentEv
+__ZNK7WebCore4Node14eventListenersEv
 __ZN7WebCore13ContainerNode16insertedIntoTreeEb
-__ZN7WebCore8Document15childrenChangedEb
-__ZNK7WebCore7Element13isElementNodeEv
+__ZNK7WebCore7Element12getAttributeERKNS_13QualifiedNameE
+__ZN7WebCore21ApplicationCacheGroup29selectCacheWithoutManifestURLEPNS_5FrameE
+__ZN7WebCore8Document15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore13ContainerNode15childrenChangedEbPNS_4NodeES2_i
 __ZN7WebCore10HTMLParser9pushBlockERKNS_12AtomicStringEi
-__ZN7WebCore4Node20beginParsingChildrenEv
+__ZN7WebCoreL12isScopingTagERKNS_12AtomicStringE
+__ZN7WebCore7Element20beginParsingChildrenEv
 __ZN7WebCore7Element6attachEv
 __ZN7WebCore4Node22createRendererIfNeededEv
 __ZN7WebCore8Document21shouldCreateRenderersEv
+__ZNK7WebCore12RenderObject15canHaveChildrenEv
 __ZNK7WebCore4Node25childShouldCreateRendererEPS0_
-__ZN7WebCore7Element16styleForRendererEPNS_12RenderObjectE
+__ZN7WebCore4Node16styleForRendererEv
 __ZN7WebCore16CSSStyleSelector15styleForElementEPNS_7ElementEPNS_11RenderStyleEbb
 __ZN7WebCore16CSSStyleSelector25initElementAndPseudoStateEPNS_7ElementE
 __ZNK7WebCore13StyledElement15isStyledElementEv
 __ZN7WebCore16CSSStyleSelector17locateSharedStyleEv
 __ZN7WebCore16CSSStyleSelector16locateCousinListEPNS_7ElementEj
-__ZNK7WebCore4Node15isStyledElementEv
-__ZN7WebCore16CSSStyleSelector19initForStyleResolveEPNS_7ElementEPNS_11RenderStyleE
-__ZNK7WebCore4Node11renderStyleEv
+__ZN7WebCore16CSSStyleSelector19initForStyleResolveEPNS_7ElementEPNS_11RenderStyleENS_8PseudoIdE
 __ZN7WebCore11RenderStyle11inheritFromEPKS0_
-__ZNK7WebCore4Node12isSVGElementEv
+__ZN7WebCoreL31elementCanUseSimpleDefaultStyleEPNS_7ElementE
 __ZN7WebCore16CSSStyleSelector12matchUARulesERiS1_
 __ZNK7WebCore19MediaQueryEvaluator22mediaTypeMatchSpecificEPKc
 __ZN7WebCore16CSSStyleSelector10matchRulesEPNS_10CSSRuleSetERiS3_
+__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm32EE14shrinkCapacityEm
 __ZN7WebCore16CSSStyleSelector17matchRulesForListEPNS_15CSSRuleDataListERiS3_
 __ZN7WebCore16CSSStyleSelector13checkSelectorEPNS_11CSSSelectorE
-__ZN7WebCore16CSSStyleSelector13checkSelectorEPNS_11CSSSelectorEPNS_7ElementEbb
-__ZN7WebCore16CSSStyleSelector16checkOneSelectorEPNS_11CSSSelectorEPNS_7ElementEbb
-__ZNK7WebCore7Element12namespaceURIEv
+__ZNK7WebCore16CSSStyleSelector15SelectorChecker13checkSelectorEPNS_11CSSSelectorEPNS_7ElementEPN3WTF7HashSetIPNS_16AtomicStrin
+__ZNK7WebCore16CSSStyleSelector15SelectorChecker16checkOneSelectorEPNS_11CSSSelectorEPNS_7ElementEPN3WTF7HashSetIPNS_16AtomicSt
 __ZNK7WebCore26CSSMutableStyleDeclaration6lengthEv
-__ZNK7WebCore23DeprecatedValueListImpl5countEv
-__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm0EE15reserveCapacityEm
 __ZN7WebCore16CSSStyleSelector16sortMatchedRulesEjj
-__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm0EE6shrinkEm
+__ZN7WebCore16CSSStyleSelector21addMatchedDeclarationEPNS_26CSSMutableStyleDeclarationE
+__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm32EE6shrinkEm
 __ZNK7WebCore13StyledElement36canHaveAdditionalAttributeStyleDeclsEv
 __ZN7WebCore16CSSStyleSelector17applyDeclarationsEbbii
-__ZNK7WebCore23DeprecatedValueListImpl5beginEv
-__ZNK7WebCore23DeprecatedValueListImpl9firstNodeEv
 __ZN7WebCore16CSSStyleSelector13applyPropertyEiPNS_8CSSValueE
 __ZNK7WebCore17CSSPrimitiveValue16isPrimitiveValueEv
 __ZNK7WebCore17CSSPrimitiveValue12cssValueTypeEv
 __ZN7WebCore16CSSStyleSelector24cacheBorderAndBackgroundEv
 __ZN7WebCore16CSSStyleSelector17adjustRenderStyleEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore12StyleBoxDataC1ERKS0_
 __ZN7WebCore12StyleBoxDataC2ERKS0_
-__ZN7WebCore11RenderStyle22adjustBackgroundLayersEv
+__ZN7WebCore11RenderStyle16adjustAnimationsEv
 __ZN7WebCore11RenderStyle17adjustTransitionsEv
-__ZNK7WebCore4Node9isControlEv
+__ZNK7WebCore7Element20isFormControlElementEv
 __ZN7WebCore11HTMLElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore4Node16rendererIsNeededEPNS_11RenderStyleE
 __ZN7WebCore11HTMLElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
 __ZN7WebCore12RenderObject12createObjectEPNS_4NodeEPNS_11RenderStyleE
-__ZN7WebCore11RenderBlockC2EPNS_4NodeE
+__ZN7WebCore11RenderBlockC1EPNS_4NodeE
 __ZNK7WebCore12RenderObject14isChildAllowedEPS0_PNS_11RenderStyleE
-__ZN7WebCore12RenderObject18setAnimatableStyleEPNS_11RenderStyleE
+__ZN7WebCore12RenderObject18setAnimatableStyleEN3WTF10PassRefPtrINS_11RenderStyleEEE
+__ZNK7WebCore12RenderObject9animationEv
+__ZN7WebCore19AnimationController16updateAnimationsEPNS_12RenderObjectEPNS_11RenderStyleE
+__ZNK7WebCore12RenderObject12isRenderViewEv
 __ZN7WebCore11RenderLayer19insertOnlyThisLayerEv
-__ZN7WebCore11RenderLayer14clearClipRectsEv
+__ZN7WebCore11RenderLayer34clearClipRectsIncludingDescendantsEv
 __ZN7WebCore4Node12nextRendererEv
-__ZN7WebCore10RenderFlow8addChildEPNS_12RenderObjectES2_
-__ZNK7WebCore10RenderFlow12continuationEv
-__ZN7WebCore11RenderBlock14addChildToFlowEPNS_12RenderObjectES2_
-__ZNK7WebCore15RenderContainer14isAfterContentEPNS_12RenderObjectE
+__ZN7WebCore11RenderBlock8addChildEPNS_12RenderObjectES2_
+__ZNK7WebCore9RenderBox14isAfterContentEPNS_12RenderObjectE
 __ZN7WebCore11RenderBlock21makeChildrenNonInlineEPNS_12RenderObjectE
-__ZN7WebCore15RenderContainer8addChildEPNS_12RenderObjectES2_
+__ZN7WebCore12RenderObject8addChildEPS0_S1_
+__ZN7WebCore11RenderBlock15virtualChildrenEv
 __ZNK7WebCore12RenderObject10isListItemEv
 __ZNK7WebCore12RenderObject10isTableColEv
+__ZNK7WebCore11RenderBlock13isRenderBlockEv
 __ZNK7WebCore12RenderObject14isTableSectionEv
 __ZNK7WebCore12RenderObject10isTableRowEv
 __ZNK7WebCore12RenderObject11isTableCellEv
-__ZN7WebCore15RenderContainer15insertChildNodeEPNS_12RenderObjectES2_b
-__ZN7WebCore15RenderContainer15appendChildNodeEPNS_12RenderObjectEb
+__ZN7WebCore21RenderObjectChildList15insertChildNodeEPNS_12RenderObjectES2_S2_b
+__ZN7WebCore21RenderObjectChildList15appendChildNodeEPNS_12RenderObjectES2_b
 __ZNK7WebCore12RenderObject14enclosingLayerEv
-__ZNK7WebCore9RenderBox5layerEv
 __ZN7WebCore12RenderObject9addLayersEPNS_11RenderLayerEPS0_
-__ZN7WebCore9addLayersEPNS_12RenderObjectEPNS_11RenderLayerERS1_RS3_
+__ZN7WebCoreL9addLayersEPNS_12RenderObjectEPNS_11RenderLayerERS1_RS3_
 __ZN7WebCore12RenderObject13findNextLayerEPNS_11RenderLayerEPS0_b
 __ZN7WebCore11RenderLayer8addChildEPS0_S1_
+__ZN7WebCore11RenderLayer9setParentEPS0_
+__ZN7WebCore11RenderLayer31dirtyStackingContextZOrderListsEv
 __ZNK7WebCore11RenderLayer15stackingContextEv
 __ZN7WebCore11RenderLayer16dirtyZOrderListsEv
 __ZN7WebCore11RenderLayer22updateVisibilityStatusEv
 __ZN7WebCore11RenderLayer22childVisibilityChangedEb
-__ZNK7WebCore11RenderBlock14childrenInlineEv
-__ZN7WebCore12RenderObject14setNeedsLayoutEbb
-__ZN7WebCore12RenderObject29markContainingBlocksForLayoutEbPS0_
 __ZNK7WebCore12RenderObject9containerEv
-__ZNK7WebCore12RenderObject11isTextFieldEv
-__ZNK7WebCore12RenderObject10isTextAreaEv
+__ZNK7WebCore12RenderObject13isTextControlEv
 __ZNK7WebCore12RenderObject9isSVGRootEv
 __ZN7WebCore12RenderObject16scheduleRelayoutEv
 __ZN7WebCore9FrameView16scheduleRelayoutEv
+__ZNK7WebCore9FrameView11needsLayoutEv
+__ZNK7WebCore5Frame15contentRendererEv
+__ZNK7WebCore9FrameView13layoutPendingEv
 __ZN7WebCore8Document20shouldScheduleLayoutEv
-__ZN7WebCore8Document4bodyEv
-__ZNK7WebCore13ContainerNode17virtualFirstChildEv
+__ZNK7WebCore8Document4bodyEv
+__ZN7WebCore12RenderObject24setLayerNeedsFullRepaintEv
 __ZN7WebCore12RenderObject29invalidateContainerPrefWidthsEv
+__ZN7WebCore11FrameLoader32dispatchDocumentElementAvailableEv
 __ZN7WebCore10HTMLParser9freeBlockEv
 __ZN7WebCore10HTMLParser11popOneBlockEv
 __ZN7WebCore7Element21finishParsingChildrenEv
-__ZN7WebCore15checkStyleRulesEPNS_7ElementEPNS_11RenderStyleEb
+__ZN7WebCoreL27checkForSiblingStyleChangesEPNS_7ElementEPNS_11RenderStyleEbPNS_4NodeES5_i
 __ZN7WebCore10HTMLParser10setCurrentEPNS_4NodeE
 __ZN7WebCore8Document15finishedParsingEv
+__ZN7WebCore5EventC1ERKNS_12AtomicStringEbb
 __ZN7WebCore5EventC2ERKNS_12AtomicStringEbb
-__ZN7WebCore15EventTargetNode13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERib
-__ZN7WebCore11EventTarget35eventTargetRespectingSVGTargetRulesERPNS_15EventTargetNodeE
-__ZThn36_N7WebCore15EventTargetNode14refEventTargetEv
-__ZN7WebCore15EventTargetNode14refEventTargetEv
+__ZN7WebCore4Node13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
+__ZN7WebCore4Node14refEventTargetEv
 __ZN7WebCore5Event9setTargetEN3WTF10PassRefPtrINS_11EventTargetEEE
 __ZN7WebCore5Event14receivedTargetEv
-__ZN7WebCore11EventTarget20dispatchGenericEventEPNS_15EventTargetNodeEN3WTF10PassRefPtrINS_5EventEEERib
-__ZN7WebCore21DeprecatedPtrListImpl7prependEPKv
-__ZN7WebCore21DeprecatedPtrListImpl6insertEjPKv
+__ZN7WebCore4Node20dispatchGenericEventEN3WTF10PassRefPtrINS_5EventEEE
 __ZN7WebCore4Node15eventParentNodeEv
 __ZN7WebCore11EventTarget23preDispatchEventHandlerEPNS_5EventE
-__ZN7WebCore29DeprecatedPtrListImplIterator7toFirstEv
-__ZN7WebCore8Document17handleWindowEventEPNS_5EventEb
-__ZNK7WebCore23DeprecatedValueListImpl7isEmptyEv
-__ZN7WebCore29DeprecatedPtrListImplIterator6toLastEv
-__ZN7WebCore15EventTargetNode17handleLocalEventsEPNS_5EventEb
-__ZNK7WebCore15EventTargetNode8disabledEv
-__ZN7WebCore11EventTarget17handleLocalEventsEPNS_15EventTargetNodeEPNS_5EventEb
-__ZN7WebCore29DeprecatedPtrListImplIteratormmEv
+__ZNK7WebCore9DOMWindow8documentEv
+__ZN7WebCore9DOMWindow11handleEventEPNS_5EventEbPN3WTF6VectorINS3_6RefPtrINS_23RegisteredEventListenerEEELm0EEE
+__ZN7WebCore4Node17handleLocalEventsEPNS_5EventEb
+__ZNK7WebCore4Node8disabledEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EEC1ERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EEC2ERKS5_
 __ZN7WebCore11EventTarget24postDispatchEventHandlerEPNS_5EventEPv
-__ZN7WebCore15EventTargetNode19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore29DeprecatedPtrListImplIteratorppEv
-__ZN7WebCore8Document24updateDocumentsRenderingEv
-__ZN7WebCore21DeprecatedPtrListImpl5clearEb
-__ZN7WebCore21DeprecatedPtrListImplD2Ev
-__ZN7WebCore5EventD1Ev
-__ZThn36_N7WebCore15EventTargetNode16derefEventTargetEv
-__ZN7WebCore15EventTargetNode16derefEventTargetEv
+__ZN7WebCore4Node19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore8Document26updateStyleForAllDocumentsEv
+__ZN7WebCore5EventD0Ev
+__ZN7WebCore4Node16derefEventTargetEv
 __ZN7WebCore11FrameLoader15finishedParsingEv
-__ZN7WebCore8Document7iconURLEv
-__ZN7WebCore13HTMLTokenizerD1Ev
-__ZN7WebCore23DeprecatedValueListImplD2Ev
-__ZN7WebCore23DeprecatedValueListImpl7Private10deleteListEPNS_27DeprecatedValueListImplNodeE
+__ZN7WebCore13HTMLTokenizerD0Ev
+__ZN7WebCore10HTMLParserD0Ev
+__ZN7WebCore9TimerBaseD2Ev
 __ZN7WebCore8Document5closeEv
-__ZN7WebCore11numRequestsEPNS_8DocumentE
+__ZN7WebCore11FrameLoader14checkCompletedEv
+__ZN7WebCore9FrameView33checkStopDelayingDeferredRepaintsEv
+__ZN7WebCoreL11numRequestsEPNS_8DocumentE
 __ZN7WebCore9DocLoader12requestCountEv
+__ZN7WebCore11FrameLoader22checkCallImplicitCloseEv
 __ZN7WebCore8Document13implicitCloseEv
--[WebCoreFrameBridge setTextSizeMultiplier:]
+__ZN7WebCore11FrameLoader9completedEv
+__ZN7WebCore11FrameLoader17checkLoadCompleteEv
+__ZN7WebCore11FrameLoader26recursiveCheckLoadCompleteEv
+__ZN7WebCore11FrameLoader29checkLoadCompleteForThisFrameEv
+__ZNK7WebCore14DocumentLoader19isLoadingInAPISenseEv
+__ZNK7WebCore11FrameLoader17subframeIsLoadingEv
+__ZN7WebCore11FrameLoader16markLoadCompleteEv
+__ZN7WebCore11FrameLoader18frameLoadCompletedEv
+__ZN7WebCore14DocumentLoader22stopRecordingResponsesEv
+__ZN7WebCore8Settings16setZoomsTextOnlyEb
+__ZN7WebCore5Frame13setZoomFactorEfb
+__ZNK7WebCore5Frame20isZoomFactorTextOnlyEv
+__ZN7WebCore12SchedulePairC1EP9NSRunLoopPK10__CFString
+__ZN7WebCore12SchedulePairC2EP9NSRunLoopPK10__CFString
+__ZN7WebCore4Page15addSchedulePairEN3WTF10PassRefPtrINS_12SchedulePairEEE
+__ZN3WTF7HashSetINS_6RefPtrIN7WebCore12SchedulePairEEENS2_16SchedulePairHashENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore12SchedulePairEEES4_NS_17IdentityExtractorIS4_EENS2_16SchedulePairHashENS_10HashTraitsIS
+__ZN7WebCore14DocumentLoader8scheduleEPNS_12SchedulePairE
+__ZN7WebCoreL11scheduleAllERKN3WTF7HashSetINS0_6RefPtrINS_14ResourceLoaderEEENS0_7PtrHashIS4_EENS0_10HashTraitsIS4_EEEEPNS_12Sc
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14ResourceLoaderEEES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EE
 __ZN7WebCore4Page12setGroupNameERKNS_6StringE
-__ZN3WTF7HashMapIN7WebCore6StringEPNS_7HashSetIPNS1_4PageENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEENS1_10StringHashENS8_IS2_EENS8_ISB_EEE3addERKS2_RKSB_
+__ZN7WebCore9PageGroup9pageGroupERKNS_6StringE
+__ZN3WTF7HashMapIN7WebCore6StringEPNS1_9PageGroupENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3addERKS2_RKS4_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_9PageGroupEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTrai
+__ZN7WebCore9PageGroupC1ERKNS_6StringE
+__ZN7WebCore9PageGroupC2ERKNS_6StringE
+__ZN7WebCoreL19getUniqueIdentifierEv
+__ZN7WebCore9PageGroup7addPageEPNS_4PageE
+__ZN7WebCore12LocalStorage12localStorageERKNS_6StringE
+__ZN7WebCoreL15localStorageMapEv
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_12LocalStorageEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHash
+__ZN7WebCore12LocalStorageC1ERKNS_6StringE
+__ZN7WebCore12LocalStorageC2ERKNS_6StringE
+__ZN7WebCore18LocalStorageThread6createEv
+__ZN7WebCore18LocalStorageThreadC1Ev
+__ZN7WebCore18LocalStorageThreadC2Ev
+__ZN7WebCore18LocalStorageThread5startEv
+__ZN7WebCore18LocalStorageThread14scheduleImportEN3WTF10PassRefPtrINS_12LocalStorageEEE
+__ZN7WebCore16LocalStorageTaskC1ENS0_4TypeEN3WTF10PassRefPtrINS_12LocalStorageEEE
+__ZN7WebCore16LocalStorageTaskC2ENS0_4TypeEN3WTF10PassRefPtrINS_12LocalStorageEEE
+__ZN7WebCore18LocalStorageThread23localStorageThreadStartEPv
+__ZN3WTF5DequeINS_6RefPtrIN7WebCore16LocalStorageTaskEEEE14expandCapacityEv
+__ZN7WebCore18LocalStorageThread18localStorageThreadEv
+__ZN3WTF7HashMapIN7WebCore6StringEPNS1_12LocalStorageENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
+__ZN3WTF12MessageQueueINS_6RefPtrIN7WebCore16LocalStorageTaskEEEE19alwaysTruePredicateERS4_
+__ZN7WebCore16LocalStorageTask11performTaskEv
+__ZN7WebCore12LocalStorage13performImportEv
 __ZN7WebCore5Cache13setCapacitiesEjjj
 __ZN7WebCore9pageCacheEv
+__ZN7WebCore9PageCacheC1Ev
 __ZN7WebCore9PageCacheC2Ev
 __ZN7WebCore9PageCache11setCapacityEi
 __ZN7WebCore9PageCache5pruneEv
 __ZN3WTF7HashSetIPN7WebCore10StringImplENS1_10StringHashENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_15CaseFoldingHashENS_10HashTraitsIS3_EES8_E3addIS3_S3_NS_17HashSetTranslatorILb1ES3_S8_S8_S6_EEEESt4pairINS_17HashTableIteratorIS3_S3_S5_S6_S8_S8_EEbERKT_RKT0_
 __ZN7WebCore8Settings20setCursiveFontFamilyERKNS_12AtomicStringE
-__ZN7WebCore32setNeedsReapplyStylesInAllFramesEPNS_4PageE
+__ZN7WebCoreL32setNeedsReapplyStylesInAllFramesEPNS_4PageE
 __ZN7WebCore5Frame21setNeedsReapplyStylesEv
-__ZN7WebCore6Widget10invalidateEv
 __ZN7WebCore8Settings23setDefaultFixedFontSizeEi
 __ZN7WebCore8Settings18setDefaultFontSizeEi
 __ZN7WebCore8Settings26setDefaultTextEncodingNameERKNS_6StringE
+__ZN7WebCore8Settings23setUsesEncodingDetectorEb
 __ZN7WebCore8Settings20setFantasyFontFamilyERKNS_12AtomicStringE
 __ZN7WebCore8Settings18setFixedFontFamilyERKNS_12AtomicStringE
 __ZN7WebCore8Settings28setForceFTPDirectoryListingsEb
 __ZN7WebCore8Settings27setFTPDirectoryTemplatePathERKNS_6StringE
 __ZN7WebCore8Settings14setJavaEnabledEb
 __ZN7WebCore8Settings20setJavaScriptEnabledEb
+__ZN7WebCore8Settings21setWebSecurityEnabledEb
+__ZN7WebCore8Settings35setAllowUniversalAccessFromFileURLsEb
 __ZN7WebCore8Settings40setJavaScriptCanOpenWindowsAutomaticallyEb
 __ZN7WebCore8Settings18setMinimumFontSizeEi
 __ZN7WebCore8Settings25setMinimumLogicalFontSizeEi
 __ZN7WebCore8Settings17setPluginsEnabledEb
+__ZN7WebCore8Settings19setDatabasesEnabledEb
+__ZN7WebCore8Settings22setLocalStorageEnabledEb
 __ZN7WebCore8Settings25setPrivateBrowsingEnabledEb
 __ZN7WebCore8Settings22setSansSerifFontFamilyERKNS_12AtomicStringE
 __ZN7WebCore8Settings18setSerifFontFamilyERKNS_12AtomicStringE
@@ -1062,88 +1075,64 @@ __ZN7WebCore8Settings25setShouldPrintBackgroundsEb
 __ZN7WebCore8Settings24setTextAreasAreResizableEb
 __ZN7WebCore8Settings31setShrinksStandaloneImagesToFitEb
 __ZN7WebCore8Settings23setEditableLinkBehaviorENS_20EditableLinkBehaviorE
+__ZN7WebCore8Settings40setTextDirectionSubmenuInclusionBehaviorENS_37TextDirectionSubmenuInclusionBehaviorE
 __ZN7WebCore8Settings18setDOMPasteAllowedEb
 __ZN7WebCore8Settings16setUsesPageCacheEb
 __ZN7WebCore8Settings22setShowsURLsInToolTipsEb
 __ZN7WebCore8Settings25setDeveloperExtrasEnabledEb
 __ZN7WebCore8Settings29setAuthorAndUserStylesEnabledEb
+__ZN7WebCore8Settings24setApplicationChromeModeEb
 __ZN7WebCore4KURLC1EP5NSURL
-__ZN3WTF6VectorIcLm2048EE6shrinkEm
+__ZN7WebCore4KURLC2EP5NSURL
 __ZN7WebCore8Settings25setUserStyleSheetLocationERKNS_4KURLE
-__ZN7WebCoreeqERKNS_4KURLES2_
+__ZN7WebCore4Page29userStyleSheetLocationChangedEv
 __ZN7WebCore8Settings32setNeedsAdobeFrameReloadingQuirkEb
 __ZN7WebCore8Settings41setNeedsKeyboardEventDisambiguationQuirksEb
+__ZN7WebCore8Settings25setNeedsLeopardMailQuirksEb
+__ZN7WebCore8Settings23setNeedsTigerMailQuirksEb
+__ZN7WebCore8Settings26setNeedsSiteSpecificQuirksEb
+__ZN7WebCore8Settings29setWebArchiveDebugModeEnabledEb
+__ZN7WebCore8Settings36setOfflineWebApplicationCacheEnabledEb
+__ZN7WebCore8Settings33setEnforceCSSMIMETypeInStrictModeEb
 __ZN7WebCore4Page15backForwardListEv
 __ZN7WebCore15BackForwardList10setEnabledEb
 __ZN7WebCore15BackForwardList7enabledEv
 __ZN7WebCore15BackForwardList11setCapacityEi
-__ZN7WebCore16FontPlatformDataC1EP6NSFontbb
-__ZN7WebCore4FontC1ERKNS_16FontPlatformDataEb
-__ZN7WebCore16FontFallbackList15setPlatformFontERKNS_16FontPlatformDataE
-__ZN7WebCore9FontCache17getCachedFontDataEPKNS_16FontPlatformDataE
-__ZN3WTF7HashMapIN7WebCore16FontPlatformDataEPNS1_14SimpleFontDataENS1_20FontDataCacheKeyHashENS1_22FontDataCacheKeyTraitsENS_10HashTraitsIS4_EEE3setERKS2_RKS4_
-__ZN7WebCore14SimpleFontDataC1ERKNS_16FontPlatformDataEbbPNS_11SVGFontDataE
-__ZN7WebCore16FontPlatformDataC2ERKS0_
-__ZN7WebCore14SimpleFontData12platformInitEv
-__ZN7WebCore12initFontDataEPNS_14SimpleFontDataE
-__ZN7WebCore17GlyphPageTreeNode7getRootEj
-__ZN7WebCore17GlyphPageTreeNode8getChildEPKNS_8FontDataEj
-__ZNK7WebCore14SimpleFontData12isCustomFontEv
-__ZNK3WTF7HashMapIPKN7WebCore8FontDataEPNS1_17GlyphPageTreeNodeENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getERKS4_
-__ZN7WebCore17GlyphPageTreeNode14initializePageEPKNS_8FontDataEj
-__ZNK7WebCore14SimpleFontData11isSegmentedEv
-__ZN7WebCore9GlyphPage4fillEjjPtjPKNS_14SimpleFontDataE
-__ZNK7WebCore14SimpleFontData13widthForGlyphEt
-__ZN7WebCore13GlyphWidthMap13widthForGlyphEt
-__ZNK7WebCore14SimpleFontData21platformWidthForGlyphEt
-__ZN7WebCore13GlyphWidthMap16setWidthForGlyphEtf
-__ZN7WebCore14SimpleFontData14determinePitchEv
-__ZNK3WTF7HashMapIiPN7WebCore13GlyphWidthMap14GlyphWidthPageENS_7IntHashIjEENS_10HashTraitsIiEENS7_IS4_EEE3getERKi
-__ZN3WTF9HashTableIiSt4pairIiiENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENS8_IsEEEES9_E6expandEv
-__ZN3WTF9HashTableIN7WebCore16FontPlatformDataESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_20FontDataCacheKeyHashENS_14PairHashTraitsINS1_22FontDataCacheKeyTraitsENS_10HashTraitsIiEEEES9_E3addIS2_PNS1_14SimpleFontDataENS_17HashMapTranslatorILb1ES3_IS2_SG_ENS_18PairBaseHashTraitsIS9_NSA_ISG_EEEESC_S7_EEEES3_INS_17HashTableIteratorIS2_S4_S6_S7_SC_S9_EEbERKT_RKT0_
-__ZN3WTF9HashTableIN7WebCore16FontPlatformDataESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_20FontDataCacheKeyHashENS_14PairHashTraitsINS1_22FontDataCacheKeyTraitsENS_10HashTraitsIiEEEES9_E6expandEv
-__ZN7WebCore16FontPlatformDataD1Ev
-__ZN7WebCore15StringTruncator14centerTruncateERKNS_6StringEfRKNS_4FontEb
-__ZN7WebCore14truncateStringERKNS_6StringEfRKNS_4FontEPFjS2_jjPtEb
-__ZN7WebCore11stringWidthERKNS_4FontEPKtjb
-__ZNK7WebCore4Font10floatWidthERKNS_7TextRunE
-__ZNK7WebCore4Font16cachePrimaryFontEv
-__ZNK7WebCore16FontFallbackList10fontDataAtEPKNS_4FontEj
-__ZNK7WebCore14SimpleFontData20fontDataForCharacterEi
-__ZNK7WebCore4Font16canUseGlyphCacheERKNS_7TextRunE
-__ZNK7WebCore4Font23floatWidthForSimpleTextERKNS_7TextRunEPNS_11GlyphBufferE
-__ZN7WebCore13WidthIteratorC1EPKNS_4FontERKNS_7TextRunE
-__ZN7WebCore13WidthIterator7advanceEiPNS_11GlyphBufferE
-__ZNK7WebCore4Font21glyphDataForCharacterEibb
-__ZN3WTF7HashMapIiPN7WebCore17GlyphPageTreeNodeENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3setERKiRKS3_
-__ZNK7WebCore4Font10fontDataAtEj
-__ZN3WTF6VectorIPKN7WebCore8FontDataELm1EE6shrinkEm
-__ZN7WebCore7IntSizeC1ERK7_NSSize
+__ZN7WebCore7IntSizeC1ERK6CGSize
+__ZN7WebCore7IntSizeC2ERK6CGSize
 __ZN7WebCore12IconDatabase11defaultIconERKNS_7IntSizeE
+__ZN7WebCore10IconRecordC1ERKNS_6StringE
+__ZN7WebCore10IconRecordC2ERKNS_6StringE
+__ZN7WebCore12SharedBufferC1EPKhi
 __ZN7WebCore12SharedBufferC2EPKhi
 __ZN3WTF6VectorIcLm0EE6appendIhEEvPKT_m
 __ZN3WTF6VectorIcLm0EE14expandCapacityEm
 __ZN3WTF6VectorIcLm0EE15reserveCapacityEm
 __ZN7WebCore10IconRecord12setImageDataEN3WTF10PassRefPtrINS_12SharedBufferEEE
+__ZN7WebCore11BitmapImageC1EPNS_13ImageObserverE
 __ZN7WebCore11BitmapImageC2EPNS_13ImageObserverE
 __ZN7WebCore5ImageC2EPNS_13ImageObserverE
+__ZN7WebCore11ImageSourceC1Ev
 __ZN7WebCore11ImageSourceC2Ev
 __ZN7WebCore11BitmapImage16initPlatformDataEv
 __ZN7WebCore5Image7setDataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
 __ZNK7WebCore12SharedBuffer4sizeEv
 __ZNK7WebCore12SharedBuffer15hasPlatformDataEv
 __ZN7WebCore11BitmapImage11dataChangedEb
-__ZN7WebCore11BitmapImage18destroyDecodedDataEb
+__ZN7WebCore11BitmapImage24destroyMetadataAndNotifyEi
+__ZN7WebCore11BitmapImage22invalidatePlatformDataEv
+__ZN7WebCoreL10frameBytesERKNS_7IntSizeE
 __ZN7WebCore11ImageSource7setDataEPNS_12SharedBufferEb
 __ZN7WebCore12SharedBuffer12createCFDataEv
 +[WebCoreSharedBufferData initialize]
+-[WebCoreSharedBufferData .cxx_construct]
 -[WebCoreSharedBufferData initWithSharedBuffer:]
 -[WebCoreSharedBufferData length]
 __ZN7WebCore11BitmapImage15isSizeAvailableEv
 __ZN7WebCore11ImageSource15isSizeAvailableEv
 -[WebCoreSharedBufferData bytes]
 __ZNK7WebCore12SharedBuffer4dataEv
-__ZN7WebCore18imageSourceOptionsEv
+__ZN7WebCoreL18imageSourceOptionsEv
 __ZN7WebCore10IconRecord5imageERKNS_7IntSizeE
 __ZN7WebCore11BitmapImage10getNSImageEv
 __ZN7WebCore11BitmapImage21getTIFFRepresentationEv
@@ -1151,108 +1140,235 @@ __ZN7WebCore11BitmapImage10frameCountEv
 __ZNK7WebCore11ImageSource10frameCountEv
 __ZN7WebCore11BitmapImage12frameAtIndexEm
 __ZN7WebCore11BitmapImage10cacheFrameEm
-__ZN7WebCore11BitmapImage13shouldAnimateEv
 __ZN3WTF6VectorIN7WebCore9FrameDataELm0EE4growEm
 __ZN3WTF6VectorIN7WebCore9FrameDataELm0EE14expandCapacityEm
 __ZN3WTF6VectorIN7WebCore9FrameDataELm0EE15reserveCapacityEm
 __ZN7WebCore11ImageSource18createFrameAtIndexEm
+__ZNK7WebCore11ImageSource11initializedEv
 __ZN7WebCore11BitmapImage18checkForSolidColorEv
+__ZN7WebCore11ImageSource22frameIsCompleteAtIndexEm
+__ZN7WebCore11BitmapImage15repetitionCountEb
+__ZN7WebCore11ImageSource15repetitionCountEv
 __ZN7WebCore11ImageSource20frameHasAlphaAtIndexEm
 __ZN3WTF6VectorIP7CGImageLm0EE14expandCapacityEmPKS2_
 __ZN3WTF6VectorIP7CGImageLm0EE14expandCapacityEm
 __ZN3WTF6VectorIP7CGImageLm0EE15reserveCapacityEm
 __ZN3WTF6VectorIP7CGImageLm0EE6shrinkEm
-__ZNK7WebCore11FrameLoader25provisionalDocumentLoaderEv
+__ZN7WebCore16FontPlatformDataC1EP6NSFontbb
+__ZN7WebCore16FontPlatformDataC2EP6NSFontbb
+__ZN7WebCore4FontC1ERKNS_16FontPlatformDataEb
+__ZN7WebCore4FontC2ERKNS_16FontPlatformDataEb
+__ZN7WebCore16FontFallbackList15setPlatformFontERKNS_16FontPlatformDataE
+__ZN7WebCore9FontCache17getCachedFontDataEPKNS_16FontPlatformDataE
+__ZN3WTF9HashTableIN7WebCore16FontPlatformDataESt4pairIS2_S3_IPNS1_14SimpleFontDataEjEENS_18PairFirstExtractorIS7_EENS1_20FontD
+__ZN7WebCore14SimpleFontDataC1ERKNS_16FontPlatformDataEbbPNS_11SVGFontDataE
+__ZN7WebCore14SimpleFontDataC2ERKNS_16FontPlatformDataEbbPNS_11SVGFontDataE
+__ZN7WebCore16FontPlatformDataC1ERKS0_
+__ZN7WebCore16FontPlatformDataC2ERKS0_
+__ZN7WebCore14SimpleFontData12platformInitEv
+__ZN7WebCoreL12initFontDataEPNS_14SimpleFontDataE
+__ZN7WebCore17GlyphPageTreeNode7getRootEj
+__ZN7WebCore17GlyphPageTreeNode8getChildEPKNS_8FontDataEj
+__ZNK3WTF7HashMapIPKN7WebCore8FontDataEPNS1_17GlyphPageTreeNodeENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getERKS4_
+__ZNK7WebCore14SimpleFontData12isCustomFontEv
+__ZN3WTF7HashMapIPKN7WebCore8FontDataEPNS1_17GlyphPageTreeNodeENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3setERKS4_RKS6_
+__ZN3WTF9HashTableIPKN7WebCore8FontDataESt4pairIS4_PNS1_17GlyphPageTreeNodeEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_1
+__ZN7WebCore17GlyphPageTreeNode14initializePageEPKNS_8FontDataEj
+__ZNK7WebCore14SimpleFontData11isSegmentedEv
+__ZN7WebCore9GlyphPage4fillEjjPtjPKNS_14SimpleFontDataE
+__ZN3WTF6VectorItLm512EE6shrinkEm
+__ZN7WebCore14SimpleFontData17platformGlyphInitEv
+__ZN7WebCore13GlyphWidthMap18locatePageSlowCaseEj
+__ZNK7WebCore14SimpleFontData21platformWidthForGlyphEt
+__ZN7WebCore14SimpleFontData14determinePitchEv
+__ZN3WTF7HashMapIiPN7WebCore13GlyphWidthMap14GlyphWidthPageENS_7IntHashIjEENS_10HashTraitsIiEENS7_IS4_EEE3setERKiRKS4_
+__ZN3WTF9HashTableIiSt4pairIiPN7WebCore13GlyphWidthMap14GlyphWidthPageEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14PairHa
+__ZN7WebCore14SimpleFontData21platformCharWidthInitEv
+__ZN7WebCore14SimpleFontData14initCharWidthsEv
+__ZN3WTF7HashMapIN7WebCore16FontPlatformDataESt4pairIPNS1_14SimpleFontDataEjENS1_20FontDataCacheKeyHashENS1_22FontDataCacheKeyT
+__ZN7WebCore16FontPlatformDataaSERKS0_
+__ZN7WebCore16FontPlatformDataD1Ev
+__ZN7WebCore16FontPlatformDataD2Ev
+__ZN7WebCore15StringTruncator14centerTruncateERKNS_6StringEfRKNS_4FontEb
+__ZN7WebCoreL14truncateStringERKNS_6StringEfRKNS_4FontEPFjS2_jjPtEb
 __ZNK7WebCore11FrameLoader14frameHasLoadedEv
-_stringIsFileURL
-__ZN7WebCore12IconDatabase14iconForPageURLERKNS_6StringERKNS_7IntSizeEb
-__ZN7WebCore12IconDatabase24getOrCreatePageURLRecordERKNS_6StringE
-_urlWithDataRelativeToURL
-_urlByRemovingResourceSpecifier
-_urlByRemovingComponent
-_canonicalURL
-_urlOriginalDataAsString
-_urlOriginalData
-__ZN7WebCore11FrameLoader4loadERKNS_15ResourceRequestE
-__ZN7WebCore11FrameLoader4loadERKNS_15ResourceRequestERKNS_14SubstituteDataE
+__ZN7WebCore9FrameView14setNeedsLayoutEv
+__ZN7WebCore4Page15didMoveOnscreenEv
+__ZN7WebCore9FrameView15didMoveOnscreenEv
+__ZN7WebCore10RenderView15didMoveOnscreenEv
+_WebCoreTextFloatWidth
+__ZNK7WebCore4Font10floatWidthERKNS_7TextRunEPN3WTF7HashSetIPKNS_14SimpleFontDataENS4_7PtrHashIS8_EENS4_10HashTraitsIS8_EEEE
+__ZNK7WebCore4Font16cachePrimaryFontEv
+__ZNK7WebCore16FontFallbackList10fontDataAtEPKNS_4FontEj
+__ZNK7WebCore14SimpleFontData20fontDataForCharacterEi
+__ZNK7WebCore4Font16canUseGlyphCacheERKNS_7TextRunE
+__ZN7WebCore4Font36canReturnFallbackFontsForComplexTextEv
+__ZNK7WebCore4Font23floatWidthForSimpleTextERKNS_7TextRunEPNS_11GlyphBufferEPN3WTF7HashSetIPKNS_14SimpleFontDataENS6_7PtrHashIS
+__ZN7WebCore13WidthIteratorC1EPKNS_4FontERKNS_7TextRunEPN3WTF7HashSetIPKNS_14SimpleFontDataENS7_7PtrHashISB_EENS7_10HashTraitsI
+__ZN7WebCore13WidthIteratorC2EPKNS_4FontERKNS_7TextRunEPN3WTF7HashSetIPKNS_14SimpleFontDataENS7_7PtrHashISB_EENS7_10HashTraitsI
+__ZN7WebCore13WidthIterator7advanceEiPNS_11GlyphBufferE
+__ZNK7WebCore4Font21glyphDataForCharacterEibb
+__ZNK7WebCore4Font10fontDataAtEj
+__ZN7WebCore9FontCache15releaseFontDataEPKNS_14SimpleFontDataE
+__ZN3WTF11ListHashSetIPKN7WebCore14SimpleFontDataENS_7PtrHashIS4_EEE3addERKS4_
+__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPKN7WebCore14SimpleFontDataEEES7_NS_17IdentityExtractorIS7_EENS_28ListHashSetNodeHashF
+__ZN3WTF11ListHashSetIPKN7WebCore14SimpleFontDataENS_7PtrHashIS4_EEE10appendNodeEPNS_15ListHashSetNodeIS4_EE
+__ZN3WTF6VectorISt4pairIPKN7WebCore8FontDataEbELm1EE6shrinkEm
+__ZN3WTF11ListHashSetIPKN7WebCore14SimpleFontDataENS_7PtrHashIS4_EEE15unlinkAndDeleteEPNS_15ListHashSetNodeIS4_EE
+__ZN7WebCore12IconDatabase14iconForPageURLERKNS_6StringERKNS_7IntSizeE
+__ZN7WebCoreL11stringWidthERKNS_4FontEPKtjb
+__ZNK3WTF7HashMapIiPN7WebCore17GlyphPageTreeNodeENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3getERKi
+__ZN3WTF7HashMapIiPN7WebCore17GlyphPageTreeNodeENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3setERKiRKS3_
+__ZN7WebCore11FrameLoader4loadERKNS_15ResourceRequestEb
+__ZN7WebCore11FrameLoader4loadERKNS_15ResourceRequestERKNS_14SubstituteDataEb
 __ZN7WebCore11FrameLoader4loadEPNS_14DocumentLoaderE
 __ZN7WebCore14DocumentLoader7requestEv
-__ZN7WebCore11FrameLoader23addExtraFieldsToRequestERNS_15ResourceRequestEbb
-__ZN7WebCore11FrameLoader14applyUserAgentERNS_15ResourceRequestE
+__ZN7WebCore11FrameLoader35addExtraFieldsToMainResourceRequestERNS_15ResourceRequestE
+__ZN7WebCore11FrameLoader23addExtraFieldsToRequestERNS_15ResourceRequestENS_13FrameLoadTypeEbb
+__ZNK7WebCore19ResourceRequestBase20firstPartyForCookiesEv
 __ZN7WebCore15ResourceRequest23doUpdateResourceRequestEv
-__ZN7WebCore16DeprecatedString10setUnicodeEPKNS_14DeprecatedCharEj
-__ZN7WebCore19ResourceRequestBase18setHTTPHeaderFieldERKNS_6StringES3_
-__ZNK7WebCore19ResourceRequestBase15mainDocumentURLEv
-__ZN7WebCore19ResourceRequestBase18setMainDocumentURLERKNS_4KURLE
+__ZNK7WebCore11FrameLoader18isLoadingMainFrameEv
+__ZN7WebCore19ResourceRequestBase23setFirstPartyForCookiesERKNS_4KURLE
+__ZN7WebCore11FrameLoader14applyUserAgentERNS_15ResourceRequestE
+__ZN7WebCore19ResourceRequestBase18setHTTPHeaderFieldERKNS_12AtomicStringERKNS_6StringE
+__ZN3WTF7HashMapIN7WebCore12AtomicStringENS1_6StringENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS5_IS3_EEE3setERKS2_RKS3_
+__ZN7WebCore11FrameLoader21addHTTPOriginIfNeededERNS_15ResourceRequestENS_6StringE
+__ZNK7WebCore19ResourceRequestBase15httpHeaderFieldERKNS_12AtomicStringE
+__ZNK7WebCore19ResourceRequestBase10httpMethodEv
+__ZN7WebCore19ResourceRequestBase50setResponseContentDispositionEncodingFallbackArrayERKNS_6StringES3_S3_
+__ZN3WTF6VectorIN7WebCore6StringELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore6StringELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore6StringELm0EE15reserveCapacityEm
 __ZNK7WebCore14DocumentLoader15originalRequestEv
 __ZNK7WebCore11FrameLoader29shouldTreatURLAsSameAsCurrentERKNS_4KURLE
-__ZNK7WebCore14DocumentLoader16overrideEncodingEv
-__ZN7WebCore14DocumentLoader19setOverrideEncodingERKNS_6StringE
 __ZN7WebCore11FrameLoader34shouldReloadToHandleUnreachableURLEPNS_14DocumentLoaderE
 __ZNK7WebCore14DocumentLoader14unreachableURLEv
-__ZN7WebCore11FrameLoader4loadEPNS_14DocumentLoaderENS_13FrameLoadTypeEN3WTF10PassRefPtrINS_9FormStateEEE
+__ZN7WebCore11FrameLoader22loadWithDocumentLoaderEPNS_14DocumentLoaderENS_13FrameLoadTypeEN3WTF10PassRefPtrINS_9FormStateEEE
+__ZN7WebCore11FrameLoader20shouldScrollToAnchorEbNS_13FrameLoadTypeERKNS_4KURLE
+__ZN7WebCore11FrameLoader12shouldReloadERKNS_4KURLES3_
+__ZNK7WebCore4KURL6hasRefEv
 __ZN7WebCore11FrameLoader15stopPolicyCheckEv
 __ZN7WebCore11PolicyCheck5clearEv
 __ZN7WebCore11PolicyCheck12clearRequestEv
+__ZN3WTF6VectorIN7WebCore6StringELm0EEaSERKS3_
 __ZN7WebCore11PolicyCheck6cancelEv
-__ZN7WebCore11FrameLoader21checkNavigationPolicyERKNS_15ResourceRequestEPNS_14DocumentLoaderEN3WTF10PassRefPtrINS_9FormStateEEEPFvPvS3_S9_bESA_
-__ZNK7WebCore14DocumentLoader16triggeringActionEv
-__ZN7WebCore16NavigationActionC1ERKNS_4KURLENS_14NavigationTypeE
-__ZN7WebCore14DocumentLoader19setTriggeringActionERKNS_16NavigationActionE
-__ZNK7WebCore14DocumentLoader18lastCheckedRequestEv
+__ZN7WebCore15ResourceRequestD2Ev
+__ZN7WebCore16NavigationActionC1ERKNS_4KURLENS_13FrameLoadTypeEb
+__ZN7WebCore16NavigationActionC2ERKNS_4KURLENS_13FrameLoadTypeEb
+__ZN7WebCoreL14navigationTypeENS_13FrameLoadTypeEbb
+__ZN7WebCore11FrameLoader21checkNavigationPolicyERKNS_15ResourceRequestEPNS_14DocumentLoaderEN3WTF10PassRefPtrINS_9FormStateEEE
 __ZN7WebCore25equalIgnoringHeaderFieldsERKNS_19ResourceRequestBaseES2_
 __ZNK7WebCore19ResourceRequestBase6isNullEv
-__ZN7WebCore14DocumentLoader21setLastCheckedRequestERKNS_15ResourceRequestE
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_iENS_18PairFirstExtractorIS5_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSA_IiEEEESB_E3addINS1_6StringEjNS_17HashMapTranslatorILb0ES4_ISG_jENS_18PairBaseHashTraitsINSA_ISG_EENSA_IjEEEESD_S8_EEEES4_INS_17HashTableIteratorIS3_S5_S7_S8_SD_SB_EEbERKT_RKT0_
 __ZN7WebCore11PolicyCheck3setERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEEPFvPvS3_S7_bES8_
 __ZNK7WebCore15ResourceRequest12nsURLRequestEv
 __ZNK7WebCore19ResourceRequestBase21updatePlatformRequestEv
 __ZN7WebCore15ResourceRequest23doUpdatePlatformRequestEv
 __ZNK7WebCore4KURL11createCFURLEv
+__ZNK7WebCore4KURL12copyToBufferERN3WTF6VectorIcLm512EEE
 __ZNK7WebCore19ResourceRequestBase11cachePolicyEv
 __ZNK7WebCore19ResourceRequestBase15timeoutIntervalEv
-__ZNK7WebCore19ResourceRequestBase10httpMethodEv
 __ZNK7WebCore19ResourceRequestBase16allowHTTPCookiesEv
 __ZNK7WebCore19ResourceRequestBase16httpHeaderFieldsEv
 __ZNK7WebCore19ResourceRequestBase8httpBodyEv
 __ZN7WebCore21findEventWithKeyStateEPNS_5EventE
 __ZN7WebCore11FrameLoader29continueAfterNavigationPolicyENS_12PolicyActionE
+__ZN3WTF6VectorIN7WebCore6StringELm0EE6shrinkEm
 __ZN7WebCore11PolicyCheck4callEb
 __ZN7WebCore11FrameLoader37callContinueLoadAfterNavigationPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEEb
 __ZN7WebCore11FrameLoader33continueLoadAfterNavigationPolicyERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEEb
-__ZN7WebCore5Frame11shouldCloseEv
+__ZN7WebCore5Frame11shouldCloseEPN3WTF6VectorINS1_6RefPtrINS_23RegisteredEventListenerEEELm0EEE
 __ZN7WebCore6Chrome30canRunBeforeUnloadConfirmPanelEv
 __ZN7WebCore11FrameLoader14stopAllLoadersEv
 __ZN7WebCore11FrameLoader20stopLoadingSubframesEv
 __ZN7WebCore14DocumentLoader11stopLoadingEv
-__ZN7WebCore9cancelAllERKN3WTF7HashSetINS0_6RefPtrINS_14ResourceLoaderEEENS0_7PtrHashIS4_EENS0_10HashTraitsIS4_EEEE
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_EC2ERKS7_
+__ZN7WebCoreL9cancelAllERKN3WTF7HashSetINS0_6RefPtrINS_14ResourceLoaderEEENS0_7PtrHashIS4_EENS0_10HashTraitsIS4_EEEE
+__ZN7WebCore14DocumentLoader21clearArchiveResourcesEv
+__ZN7WebCore19InspectorController14resumeDebuggerEv
 __ZN7WebCore11FrameLoader31continueLoadAfterWillSubmitFormENS_12PolicyActionE
 __ZN7WebCore14DocumentLoader19prepareForLoadStartEv
 __ZN7WebCore14DocumentLoader22setPrimaryLoadCompleteEb
 __ZN7WebCore14DocumentLoader11clearErrorsEv
-__ZN7WebCore14DocumentLoader10setLoadingEb
 __ZN7WebCore11FrameLoader19prepareForLoadStartEv
 __ZN7WebCore15ProgressTracker15progressStartedEPNS_5FrameE
 __ZN7WebCore15ProgressTracker5resetEv
 __ZN3WTF20deleteAllPairSecondsIPN7WebCore12ProgressItemEKNS_7HashMapImS3_NS_7IntHashImEENS_10HashTraitsImEENS7_IS3_EEEEEEvRT0_
-__ZN3WTF9HashTableImSt4pairImiENS_18PairFirstExtractorIS2_EENS_7IntHashImEENS_14PairHashTraitsINS_10HashTraitsImEENS8_IiEEEES9_E6expandEv
+_stringIsCaseInsensitiveEqualToString
+__ZN7WebCore15BackForwardList11currentItemEv
+__ZN7WebCore4Page16setDefersLoadingEb
+__ZN7WebCore11FrameLoader16setDefersLoadingEb
+__ZN7WebCore14DocumentLoader16setDefersLoadingEb
+__ZN7WebCoreL19setAllDefersLoadingERKN3WTF7HashSetINS0_6RefPtrINS_14ResourceLoaderEEENS0_7PtrHashIS4_EENS0_10HashTraitsIS4_EEEE
 __ZNK7WebCore11FrameLoader20activeDocumentLoaderEv
 __ZNK7WebCore14DocumentLoader21isLoadingMainResourceEv
-__ZN7WebCore14DocumentLoader24setLoadingFromCachedPageEb
 __ZN7WebCore15ProgressTracker22createUniqueIdentifierEv
 __ZN7WebCore11FrameLoader40dispatchAssignIdentifierToInitialRequestEmPNS_14DocumentLoaderERKNS_15ResourceRequestE
 __ZN7WebCore19InspectorController27identifierForInitialRequestEmPNS_14DocumentLoaderERKNS_15ResourceRequestE
 __ZNK7WebCore19InspectorController7enabledEv
 __ZN7WebCore14DocumentLoader24startLoadingMainResourceEm
 __ZN7WebCore18MainResourceLoader6createEPNS_5FrameE
+__ZN7WebCore18MainResourceLoaderC1EPNS_5FrameE
 __ZN7WebCore18MainResourceLoaderC2EPNS_5FrameE
 __ZN7WebCore14ResourceLoaderC2EPNS_5FrameEbb
 __ZN7WebCore18MainResourceLoader4loadERKNS_15ResourceRequestERKNS_14SubstituteDataE
+__ZNK7WebCore14ResourceLoader11frameLoaderEv
+__ZN7WebCore21ApplicationCacheGroup19cacheForMainRequestERKNS_15ResourceRequestEPNS_14DocumentLoaderE
+__ZN7WebCore16ApplicationCache23requestIsHTTPOrHTTPSGetERKNS_15ResourceRequestE
+__ZN7WebCore23ApplicationCacheStorage16cacheGroupForURLERKNS_4KURLE
+__ZN7WebCore23ApplicationCacheStorage22loadManifestHostHashesEv
+__ZN7WebCore23ApplicationCacheStorage12openDatabaseEb
+__ZN7WebCoreL11urlHostHashERKNS_4KURLE
+__ZNK3WTF9HashTableIjSt4pairIjjENS_18PairFirstExtractorIS2_EEN7WebCore13AlreadyHashedENS_14PairHashTraitsINS_10HashTraitsIjEES9
+__ZN7WebCoreL25shouldLoadAsEmptyDocumentERKNS_4KURLE
+_WebCoreObjCScheduleDeallocateOnMainThread
+__ZN7WebCore15BackForwardList8backItemEv
+__ZN7WebCore15BackForwardList11forwardItemEv
+__ZN7WebCore15FocusController18focusedOrMainFrameEv
+__ZN7WebCore19SelectionController10setFocusedEb
+__ZN7WebCore19SelectionController27focusedOrActiveStateChangedEv
+__ZNK7WebCore5Frame15selectionBoundsEb
+__ZNK7WebCore10RenderView15selectionBoundsEb
+__ZN7WebCore8Document19updateStyleIfNeededEv
+__ZN7WebCoreL21rendererAfterPositionEPNS_12RenderObjectEj
+__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_PNS1_19RenderSelectionInfoEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_
+__ZNK7WebCore10ScrollView18visibleContentRectEb
+__ZNK7WebCore10ScrollView26platformVisibleContentRectEb
+__ZN7WebCore7IntRect9intersectERKS0_
+__ZN7WebCore9FloatRectC1ERKNS_7IntRectE
+__ZN7WebCore9FloatRectC2ERKNS_7IntRectE
+__ZN7WebCore10FloatPointC1ERKNS_8IntPointE
+__ZN7WebCore10FloatPointC2ERKNS_8IntPointE
+__ZN7WebCore9FloatSizeC1ERKNS_7IntSizeE
+__ZN7WebCore9FloatSizeC2ERKNS_7IntSizeE
+__ZN7WebCore16enclosingIntRectERKNS_9FloatRectE
+__ZN7WebCore10RenderView41repaintRectangleInViewAndCompositedLayersERKNS_7IntRectEb
+__ZNK7WebCore10RenderView13shouldRepaintERKNS_7IntRectE
+__ZNK7WebCore10RenderView8printingEv
+__ZN7WebCore5Frame15setCaretVisibleEb
+__ZN7WebCore12EventHandler27capsLockStateMayHaveChangedEv
+__ZNK7WebCore8Document32useSecureKeyboardEntryWhenActiveEv
+__ZN7WebCore8Document19dispatchWindowEventERKNS_12AtomicStringEbb
+__ZN7WebCore9DOMWindow13dispatchEventERKNS_12AtomicStringEbb
+__ZN7WebCore9DOMWindow13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
+__ZN7WebCore9DOMWindow14refEventTargetEv
+__ZN7WebCore9DOMWindow16derefEventTargetEv
+__ZN7WebCore9FrameView18updateControlTintsEv
+__ZN7WebCore9PageGroup26setShouldTrackVisitedLinksEb
+__ZN7WebCore9PageGroup21removeAllVisitedLinksEv
+__ZN7WebCore4Page21removeAllVisitedLinksEv
+__ZN3WTF7HashSetIPN7WebCore9PageGroupENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore9PageGroupES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore9PageGroupES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore9PageGroupES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTabl
+__ZN3WTF9HashTableIPN7WebCore9PageGroupES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTa
+__ZN7WebCore9PageGroup18removeVisitedLinksEv
+__ZN7WebCore12IconDatabase20allowDatabaseCleanupEv
+__ZN7WebCore12IconDatabase38notifyPendingLoadDecisionsOnMainThreadEPv
+__ZN7WebCore12IconDatabase26notifyPendingLoadDecisionsEv
+__ZN7WebCore14DocumentLoader36deliverSubstituteResourcesAfterDelayEv
+__ZN7WebCore18MainResourceLoader16setDefersLoadingEb
+__ZN7WebCore14ResourceLoader16setDefersLoadingEb
 __ZN7WebCore18MainResourceLoader7loadNowERNS_15ResourceRequestE
-__ZN7WebCore25shouldLoadAsEmptyDocumentERKNS_4KURLE
 __ZN7WebCore18MainResourceLoader15willSendRequestERNS_15ResourceRequestERKNS_16ResourceResponseE
-__ZNK7WebCore14ResourceLoader11frameLoaderEv
 __ZN7WebCore18MainResourceLoader25isPostOrRedirectAfterPostERKNS_15ResourceRequestERKNS_16ResourceResponseE
 __ZNK7WebCore20ResourceResponseBase14httpStatusCodeEv
 __ZN7WebCore14ResourceLoader15willSendRequestERNS_15ResourceRequestERKNS_16ResourceResponseE
@@ -1260,67 +1376,113 @@ __ZN7WebCore11FrameLoader15willSendRequestEPNS_14ResourceLoaderERNS_15ResourceRe
 __ZN7WebCore11FrameLoader23dispatchWillSendRequestEPNS_14DocumentLoaderEmRNS_15ResourceRequestERKNS_16ResourceResponseE
 __ZN7WebCore19InspectorController15willSendRequestEPNS_14DocumentLoaderEmRNS_15ResourceRequestERKNS_16ResourceResponseE
 __ZN7WebCore14DocumentLoader10setRequestERKNS_15ResourceRequestE
-__ZN7WebCore11FrameLoader21checkNavigationPolicyERKNS_15ResourceRequestEPFvPvS3_N3WTF10PassRefPtrINS_9FormStateEEEbES4_
-__ZN7WebCore5equalEPNS_10StringImplES1_
-__ZN7WebCore18MainResourceLoader33callContinueAfterNavigationPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEEb
-__ZN7WebCore18MainResourceLoader29continueAfterNavigationPolicyERKNS_15ResourceRequestEb
 __ZN7WebCore11FrameLoader32representationExistsForURLSchemeERKNS_6StringE
 __ZN7WebCore14ResourceHandle6createERKNS_15ResourceRequestEPNS_20ResourceHandleClientEPNS_5FrameEbbb
+__ZN7WebCore14ResourceHandle21shouldContentSniffURLERKNS_4KURLE
+__ZN7WebCore14ResourceHandleC1ERKNS_15ResourceRequestEPNS_20ResourceHandleClientEbbb
 __ZN7WebCore14ResourceHandleC2ERKNS_15ResourceRequestEPNS_20ResourceHandleClientEbbb
-__ZN7WebCore23AuthenticationChallengeC2Ev
+__ZN7WebCore27AuthenticationChallengeBaseC2Ev
+__ZN7WebCore15ProtectionSpaceC1Ev
 __ZN7WebCore15ProtectionSpaceC2Ev
+__ZN7WebCore10CredentialC1Ev
 __ZN7WebCore10CredentialC2Ev
-__ZN7WebCore14ResourceHandle11portAllowedERKNS_15ResourceRequestE
+__ZNK7WebCore4KURL4userEv
+__ZNK7WebCore4KURL4passEv
+__ZN7WebCore19ResourceRequestBase17removeCredentialsEv
+__ZN7WebCore4KURL5parseERKNS_6StringE
+__ZN7WebCoreL11portAllowedERKNS_15ResourceRequestE
 __ZN7WebCore14ResourceHandle5startEPNS_5FrameE
 __ZN7WebCore14ResourceHandle8delegateEv
 -[WebCoreResourceHandleAsDelegate initWithHandle:]
+__ZN7WebCore14ResourceHandle29didSendBodyDataDelegateExistsEv
+-[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]
+__ZNK7WebCore14ResourceHandle6clientEv
+-[WebCoreResourceHandleAsDelegate connectionShouldUseCredentialStorage:]
+__ZN7WebCore14ResourceHandle26shouldUseCredentialStorageEv
+__ZN7WebCore14ResourceLoader26shouldUseCredentialStorageEPNS_14ResourceHandleE
+__ZN7WebCore14ResourceLoader26shouldUseCredentialStorageEv
+__ZN7WebCore11FrameLoader26shouldUseCredentialStorageEPNS_14ResourceLoaderE
+__ZNK7WebCore15ProgressTracker17estimatedProgressEv
+__ZN7WebCore12IconDatabase24getOrCreatePageURLRecordERKNS_6StringE
+_WebCoreShouldUseFontSmoothing
+_WebCoreSetShouldUseFontSmoothing
+_WebCoreDrawTextAtPoint
+__ZN7WebCore15GraphicsContextC1EP9CGContext
+__ZN7WebCore15GraphicsContextC2EP9CGContext
+__ZN7WebCore15GraphicsContext28createGraphicsContextPrivateEv
+__ZN7WebCore15GraphicsContext19setPaintingDisabledEb
+__ZNK7WebCore15GraphicsContext9fillColorEv
+__ZN7WebCore15GraphicsContext20setPlatformFillColorERKNS_5ColorE
+__ZNK7WebCore15GraphicsContext16paintingDisabledEv
+__ZNK7WebCore15GraphicsContext15platformContextEv
+__ZN7WebCoreL14setCGFillColorEP9CGContextRKNS_5ColorE
+__ZNK7WebCore5Color7getRGBAERdS1_S1_S1_
+__ZNK7WebCore15GraphicsContext11strokeColorEv
+__ZN7WebCore15GraphicsContext22setPlatformStrokeColorERKNS_5ColorE
+__ZN7WebCore15GraphicsContext12setFillColorERKNS_5ColorE
+__ZNK7WebCore4Font8drawTextEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
+__ZNK7WebCore4Font14drawSimpleTextEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
+__ZNK7WebCore4Font15drawGlyphBufferEPNS_15GraphicsContextERKNS_11GlyphBufferERKNS_7TextRunERKNS_10FloatPointE
+__ZNK7WebCore4Font10drawGlyphsEPNS_15GraphicsContextEPKNS_14SimpleFontDataERKNS_11GlyphBufferEiiRKNS_10FloatPointE
+__ZNK7WebCore15GraphicsContext9getShadowERNS_7IntSizeERiRNS_5ColorE
+__ZN7WebCore15GraphicsContext15textDrawingModeEv
+__ZN3WTF6VectorI6CGSizeLm2048EE6shrinkEm
+__ZN3WTF6VectorItLm2048EE6shrinkEm
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm2048EE6shrinkEm
+__ZN7WebCore15GraphicsContextD1Ev
+__ZN7WebCore15GraphicsContextD2Ev
+__ZN7WebCore15GraphicsContext29destroyGraphicsContextPrivateEPNS_22GraphicsContextPrivateE
+__ZN7WebCore15SQLiteStatement11columnCountEv
+__ZN7WebCore15SQLiteStatement13getColumnTextEi
+__ZN7WebCore6StringC1EPKt
+__ZN7WebCore6StringC2EPKt
+__ZN7WebCore12IconDatabase21getOrCreateIconRecordERKNS_6StringE
+__ZNK3WTF7HashMapIN7WebCore6StringEPNS1_10IconRecordENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3getERKS2_
+__ZN3WTF7HashMapIN7WebCore6StringEPNS1_10IconRecordENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_10IconRecordEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTr
+__ZN7WebCore13PageURLRecord13setIconRecordEN3WTF10PassRefPtrINS_10IconRecordEEE
+__ZNK3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E8containsIS2_NS_2
 __ZN7WebCore11HistoryItemC1ERKNS_6StringES3_S3_d
+__ZN7WebCore11HistoryItemC2ERKNS_6StringES3_S3_d
 __ZN7WebCore11HistoryItem13setVisitCountEi
+__ZN7WebCore11HistoryItem16adoptVisitCountsERN3WTF6VectorIiLm0EEES4_
+__ZN3WTF6VectorIiLm0EE14shrinkCapacityEm
 __ZNK7WebCore11HistoryItem9urlStringEv
 __ZNK7WebCore11HistoryItem15lastVisitedTimeEv
-+[WebCoreHistory setHistoryProvider:]
-__ZN7WebCore12IconDatabase20allowDatabaseCleanupEv
--[WebCoreFunctionWrapper invoke]
-__ZN7WebCore12IconDatabase38notifyPendingLoadDecisionsOnMainThreadEPv
-__ZN7WebCore12IconDatabase26notifyPendingLoadDecisionsEv
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E5clearEv
+__ZN7WebCore11HistoryItem15setRedirectURLsESt8auto_ptrIN3WTF6VectorINS_6StringELm0EEEE
+__ZN7WebCore7Console24setShouldPrintExceptionsEb
+__ZN7WebCore10IconRecord15imageDataStatusEv
+__ZN3WTF7HashSetIPN7WebCore10IconRecordENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTa
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocate
+__ZN7WebCore12IconDatabase14wakeSyncThreadEv
+__ZN7WebCore24disableSuddenTerminationEv
+__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE15reserveCapacityEm
+__ZN7WebCore12IconDatabase37getImageDataForIconURLFromSQLDatabaseERKNS_6StringE
+__ZN7WebCore15SQLiteStatement8bindTextEiRKNS_6StringE
+__ZN7WebCore15SQLiteStatement21getColumnBlobAsVectorEiRN3WTF6VectorIcLm0EEE
+__ZN7WebCore12SharedBufferC1EPKci
+__ZN7WebCore12SharedBufferC2EPKci
+__ZN3WTF6VectorIcLm0EE6appendIcEEvPKT_m
+__ZN3WTF6VectorIcLm0EE14expandCapacityEmPKc
+__ZN7WebCore15SQLiteStatement5resetEv
+__ZNK3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8containsIS
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndI
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore15AutodrainedPool5cycleEv
+__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE6shrinkEm
+__ZN7WebCore23enableSuddenTerminationEv
 -[WebCoreResourceHandleAsDelegate connection:didReceiveResponse:]
-__ZNK7WebCore14ResourceHandle6clientEv
 __ZN7WebCore14ResourceLoader18didReceiveResponseEPNS_14ResourceHandleERKNS_16ResourceResponseE
+-[NSHTTPURLResponse(WebCoreURLResponse) _webcore_MIMEType]
+__ZL24webNSURLResponseMIMETypeP11objc_objectP13objc_selector
 __ZN7WebCore18MainResourceLoader18didReceiveResponseERKNS_16ResourceResponseE
-__ZN7WebCore16ResourceResponse24doUpdateResourceResponseEv
-__ZNK7WebCore4KURL11isLocalFileEv
-__ZN7WebCore17equalIgnoringCaseERKNS_16DeprecatedStringES2_
-__ZNK7WebCore4KURL4pathEv
-__ZN7WebCore4KURL13decode_stringERKNS_16DeprecatedStringE
-__ZN7WebCore12UTF8EncodingEv
-__ZN7WebCore4KURL13decode_stringERKNS_16DeprecatedStringERKNS_12TextEncodingE
-__ZNK7WebCore16DeprecatedString4findEci
-__ZNK7WebCore16DeprecatedString2atEj
-__ZN3WTF6VectorIcLm2048EE4growEm
-__ZNK7WebCore16DeprecatedString10copyLatin1EPcjj
-__ZNK7WebCore12TextEncoding6decodeEPKcm
-__ZN7WebCore15newTextCodecICUERKNS_12TextEncodingEPKv
-__ZN7WebCore12TextCodecICUC2ERKNS_12TextEncodingE
-__ZN7WebCore12TextCodecICU6decodeEPKcmb
-__ZNK7WebCore12TextCodecICU18createICUConverterEv
-__ZN7WebCore9TextCodec17appendOmittingBOMERN3WTF6VectorItLm0EEEPKtm
-__ZN3WTF6VectorItLm0EE6appendItEEvPKT_m
-__ZN3WTF6VectorItLm0EE14expandCapacityEmPKt
-__ZN3WTF6VectorItLm0EE14expandCapacityEm
-__ZN3WTF6VectorItLm0EE15reserveCapacityEm
-__ZN7WebCore10StringImpl5adoptERN3WTF6VectorItLm0EEE
-__ZN7WebCore12TextCodecICU29registerExtendedEncodingNamesEPFvPKcS2_E
-__ZN7WebCore12TextCodecICU22registerExtendedCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
-__ZN3WTF9HashTableIiSt4pairIiN7WebCore16TextCodecFactoryEENS_18PairFirstExtractorIS4_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E4findIiNS_22IdentityHashTranslatorIiS4_S8_EEEENS_17HashTableIteratorIiS4_S6_S8_SD_SB_EERKT_
-__ZN7WebCore12TextCodecMac21registerEncodingNamesEPFvPKcS2_E
-__ZN7WebCore12TextCodecMac14registerCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
-__ZNK7WebCore12TextCodecICU19releaseICUConverterEv
-__ZNK7WebCore16DeprecatedString11isAllLatin1Ev
-__ZN7WebCore16DeprecatedString6insertEjPKcj
-__ZN7WebCore20DeprecatedStringData17increaseAsciiSizeEj
-__ZN7WebCore16DeprecatedString6appendEPKNS_14DeprecatedCharEj
-__ZN7WebCore16DeprecatedString6insertEjPKNS_14DeprecatedCharEj
+__ZNK7WebCore20ResourceResponseBase16httpHeaderFieldsEv
 __ZN7WebCore11FrameLoader18checkContentPolicyERKNS_6StringEPFvPvNS_12PolicyActionEES4_
 __ZN7WebCore11PolicyCheck3setEPFvPvNS_12PolicyActionEES1_
 __ZN7WebCore11FrameLoader26continueAfterContentPolicyENS_12PolicyActionE
@@ -1328,7 +1490,6 @@ __ZN7WebCore11PolicyCheck4callENS_12PolicyActionE
 __ZN7WebCore18MainResourceLoader30callContinueAfterContentPolicyEPvNS_12PolicyActionE
 __ZN7WebCore18MainResourceLoader26continueAfterContentPolicyENS_12PolicyActionE
 __ZNK7WebCore11FrameLoader10isStoppingEv
-__ZNK7WebCore14DocumentLoader10isStoppingEv
 __ZN7WebCore18MainResourceLoader26continueAfterContentPolicyENS_12PolicyActionERKNS_16ResourceResponseE
 __ZNK7WebCore11FrameLoader15canShowMIMETypeERKNS_6StringE
 __ZNK7WebCore20ResourceResponseBase6isHTTPEv
@@ -1341,9 +1502,11 @@ __ZN3WTF6VectorIN7WebCore16ResourceResponseELm0EE15reserveCapacityEm
 __ZN7WebCore15ProgressTracker17incrementProgressEmRKNS_16ResourceResponseE
 __ZNK7WebCore20ResourceResponseBase21expectedContentLengthEv
 __ZNK3WTF7HashMapImPN7WebCore12ProgressItemENS_7IntHashImEENS_10HashTraitsImEENS6_IS3_EEE3getERKm
-__ZN3WTF9HashTableImSt4pairImiENS_18PairFirstExtractorIS2_EENS_7IntHashImEENS_14PairHashTraitsINS_10HashTraitsImEENS8_IiEEEES9_E3addImPN7WebCore12ProgressItemENS_17HashMapTranslatorILb1ES1_ImSG_ENS_18PairBaseHashTraitsIS9_NS8_ISG_EEEESB_S6_EEEES1_INS_17HashTableIteratorImS2_S4_S6_SB_S9_EEbERKT_RKT0_
+__ZN3WTF7HashMapImPN7WebCore12ProgressItemENS_7IntHashImEENS_10HashTraitsImEENS6_IS3_EEE3setERKmRKS3_
+__ZN3WTF9HashTableImSt4pairImPN7WebCore12ProgressItemEENS_18PairFirstExtractorIS5_EENS_7IntHashImEENS_14PairHashTraitsINS_10Has
 __ZN7WebCore11FrameLoader26dispatchDidReceiveResponseEPNS_14DocumentLoaderEmRKNS_16ResourceResponseE
 __ZN7WebCore19InspectorController18didReceiveResponseEPNS_14DocumentLoaderEmRKNS_16ResourceResponseE
+__ZN7WebCore20ResourceResponseBaseD2Ev
 -[WebCoreResourceHandleAsDelegate connection:didReceiveData:lengthReceived:]
 __ZN7WebCore14ResourceLoader14didReceiveDataEPNS_14ResourceHandleEPKcii
 __ZN7WebCore18MainResourceLoader14didReceiveDataEPKcixb
@@ -1356,40 +1519,31 @@ __ZN7WebCore14DocumentLoader12receivedDataEPKci
 __ZNK7WebCore14DocumentLoader19doesProgressiveLoadERKNS_6StringE
 __ZNK7WebCore11FrameLoader11isReplacingEv
 __ZN7WebCore14DocumentLoader10commitLoadEPKci
-__ZNK7WebCore14DocumentLoader17mainDocumentErrorEv
-__ZN7WebCore8Document7appletsEv
-__ZN7WebCore14HTMLCollectionC1EN3WTF10PassRefPtrINS_4NodeEEENS0_4TypeE
-__ZNK7WebCore14HTMLCollection6lengthEv
-__ZNK7WebCore14HTMLCollection19resetCollectionInfoEv
-__ZNK7WebCore14HTMLCollection10calcLengthEv
-__ZNK7WebCore14HTMLCollection9itemAfterEPNS_7ElementE
-__ZN7WebCore17nextNodeOrSiblingEPNS_4NodeES1_b
-__ZNK7WebCore4Node16traverseNextNodeEPKS0_
-__ZN7WebCore8Document22hasWindowEventListenerERKNS_12AtomicStringE
-__ZN7WebCore23DeprecatedValueListImpl5beginEv
-__ZN7WebCore23DeprecatedValueListImpl3endEv
-__ZNK7WebCore23DeprecatedValueListImpl3endEv
-__ZN7WebCore15BackForwardList8capacityEv
-__ZN7WebCore15EventTargetNode19dispatchWindowEventERKNS_12AtomicStringEbb
-__ZN7WebCore8Document15updateRenderingEv
-__ZN7WebCore8Document11inPageCacheEv
-__ZN7WebCore8Document35removeAllEventListenersFromAllNodesEv
+__ZN7WebCore9DOMWindow16hasEventListenerERKNS_12AtomicStringE
+__ZN7WebCore9DOMWindow19dispatchUnloadEventEPN3WTF6VectorINS1_6RefPtrINS_23RegisteredEventListenerEEELm0EEE
+__ZN7WebCore8Document23removeAllEventListenersEv
 __ZN7WebCore8Document39removeAllDisconnectedNodeEventListenersEv
-__ZNK7WebCore15EventTargetNode17isEventTargetNodeEv
-__ZN7WebCore15EventTargetNode23removeAllEventListenersEv
-__ZN7WebCore11EventTarget23removeAllEventListenersEPNS_15EventTargetNodeE
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E5clearEv
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTableEP
+__ZNK7WebCore4Node16traverseNextNodeEPKS0_
 __ZN7WebCore6Loader14cancelRequestsEPNS_9DocLoaderE
-__ZN7WebCore14XMLHttpRequest14cancelRequestsEPNS_8DocumentE
-__ZN7WebCore18requestsByDocumentEv
+__ZN7WebCore9DocLoader20clearPendingPreloadsEv
+__ZN3WTF6VectorIN7WebCore9DocLoader14PendingPreloadELm0EE14shrinkCapacityEm
+__ZN7WebCore6Loader28scheduleServePendingRequestsEv
+__ZN7WebCore9TimerBase5startEdd
+__ZN7WebCoreL9timerHeapEv
+__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE15reserveCapacityEm
+__ZN7WebCore9TimerBase15heapDecreaseKeyEv
+__ZSt11__push_heapIN7WebCore17TimerHeapIteratorEiNS0_16TimerHeapElementEEvT_T0_S4_T1_
+__ZN7WebCore21MainThreadSharedTimer11setFireTimeEd
+__ZN7WebCore22setSharedTimerFireTimeEd
+-[WebCorePowerNotifier init]
+__ZN7WebCore8Document13stopDatabasesEv
 __ZN7WebCore14DocumentLoader23stopLoadingSubresourcesEv
 __ZN7WebCore14DocumentLoader18stopLoadingPlugInsEv
 __ZN7WebCore14DocumentLoader15detachFromFrameEv
-__ZN7WebCore11FrameLoader28addHistoryForCurrentLocationEv
-__ZN7WebCore11HistoryItemC1ERKNS_6StringES3_d
-__ZN7WebCore11HistoryItem18setLastVisitedTimeEd
-__ZN7WebCore11HistoryItem22mergeAutoCompleteHintsEPS0_
-__ZN7WebCore11HistoryItemD1Ev
-__ZN7WebCore12IconDatabase21releaseIconForPageURLERKNS_6StringE
 __ZN7WebCore11FrameLoader33addBackForwardItemClippedAtTargetEb
 __ZN7WebCore15BackForwardList7entriesEv
 __ZN7WebCore11FrameLoader21createHistoryItemTreeEPNS_5FrameEb
@@ -1397,6 +1551,7 @@ __ZN7WebCore11FrameLoader17createHistoryItemEb
 __ZNK7WebCore14DocumentLoader11originalURLEv
 __ZNK7WebCore14DocumentLoader10requestURLEv
 __ZN7WebCore11HistoryItemC1ERKNS_4KURLERKNS_6StringES6_S6_
+__ZN7WebCore11HistoryItemC2ERKNS_4KURLERKNS_6StringES6_S6_
 __ZN7WebCore11HistoryItem20setOriginalURLStringERKNS_6StringE
 __ZN7WebCore11HistoryItem22setFormInfoFromRequestERKNS_15ResourceRequestE
 __ZN7WebCore11HistoryItem15setIsTargetItemEb
@@ -1404,1050 +1559,2044 @@ __ZN7WebCore15BackForwardList7addItemEN3WTF10PassRefPtrINS_11HistoryItemEEE
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE14expandCapacityEm
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE15reserveCapacityEm
 __ZN3WTF7HashSetINS_6RefPtrIN7WebCore11HistoryItemEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZN7WebCore10ScrollView18suppressScrollbarsEbb
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore11HistoryItemEEES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_
+__ZNK7WebCore14DocumentLoader28urlForHistoryReflectsFailureEv
+__ZNK7WebCore14DocumentLoader19originalRequestCopyEv
+__ZN7WebCore11HistoryItem7visitedERKNS_6StringEd
+__ZN7WebCore11HistoryItem17recordVisitAtTimeEd
+__ZN7WebCore11HistoryItem25padDailyCountsForNewVisitEd
+__ZN3WTF6VectorIiLm0EE4fillERKim
+__ZSt4fillIPiiEvT_S1_RKT0_
+__ZN3WTF6VectorIiLm0EE6insertIiEEvmPKT_m
+__ZN7WebCore11HistoryItem27collapseDailyVisitsToWeeklyEv
+__ZNK7WebCore11HistoryItem17originalURLStringEv
+__ZN7WebCore4Page20setGlobalHistoryItemEPNS_11HistoryItemE
+__ZN7WebCore9PageGroup14addVisitedLinkERKNS_4KURLE
+__ZN7WebCore15visitedLinkHashEPKtj
+__ZN3WTF7HashSetIyN7WebCore12LinkHashHashENS_10HashTraitsIyEEE3addERKy
+__ZN3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E6expandEv
+__ZN3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E6rehashEi
+__ZN3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E13allocateTableEi
+__ZN3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E15deallocateTableEPyi
+__ZN7WebCore4Page19visitedStateChangedEPNS_9PageGroupEy
+__ZN7WebCore16CSSStyleSelector15SelectorChecker19visitedStateChangedEy
+__ZNK3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E8containsIyNS_22IdentityHashTran
+__ZN7WebCore10ScrollView23setScrollbarsSuppressedEbb
+__ZN7WebCore10ScrollView31platformSetScrollbarsSuppressedEb
+__ZN7WebCore14DocumentLoaderD2Ev
 __ZNK7WebCore11HistoryItem17isCurrentDocumentEPNS_8DocumentE
-__ZN7WebCoreeqERKNS_6StringERKNS_16DeprecatedStringE
-__ZNK7WebCore12TextEncoding25backslashAsCurrencySymbolEv
-__ZN7WebCore30noExtendedTextEncodingNameUsedEv
+__ZN7WebCore5Frame18setJSStatusBarTextERKNS_6StringE
+__ZN7WebCore6Chrome16setStatusbarTextEPNS_5FrameERKNS_6StringE
+__ZNK7WebCore8Document31displayStringModifiedByEncodingERKNS_6StringE
+__ZN7WebCore5Frame25setJSDefaultStatusBarTextERKNS_6StringE
+__ZN3WTF6VectorItLm0EE14expandCapacityEmPKt
+__ZN3WTF6VectorItLm0EE14expandCapacityEm
+__ZN3WTF6VectorItLm0EE15reserveCapacityEm
+__ZNK7WebCore4KURL4pathEv
 __ZN7WebCore11FrameLoader13committedLoadEPNS_14DocumentLoaderEPKci
--[WebCoreFrameBridge receivedData:textEncodingName:]
 __ZN7WebCore11FrameLoader11setEncodingERKNS_6StringEb
 __ZN7WebCore11FrameLoader17receivedFirstDataEv
+__ZN3WTF7HashMapIN7WebCore6StringEjNS1_10StringHashENS_10HashTraitsIS2_EENS4_IjEEE3setERKS2_RKj
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_jENS_18PairFirstExtractorIS4_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTra
+__ZNK3WTF7HashMapIN7WebCore6StringEjNS1_10StringHashENS_10HashTraitsIS2_EENS4_IjEEE3getERKS2_
 __ZNK7WebCore14SecurityOrigin20isSecureTransitionToERKNS_4KURLE
+__ZN7WebCore22ScriptExecutionContext20stopActiveDOMObjectsEv
 __ZN7WebCore13ContainerNode10willRemoveEv
 __ZN7WebCore4Node10willRemoveEv
 __ZN7WebCore8Document6detachEv
+__ZN7WebCore8Document18clearAXObjectCacheEv
+__ZNK7WebCore8Document11topDocumentEv
+__ZNK7WebCore8Document12ownerElementEv
+__ZN7WebCore8Document26documentWillBecomeInactiveEv
 __ZN7WebCore13ContainerNode6detachEv
 __ZN7WebCore7Element6detachEv
 __ZN7WebCore7Element27cancelFocusAppearanceUpdateEv
 __ZN7WebCore4Node6detachEv
-__ZN7WebCore10RenderFlow7destroyEv
-__ZN7WebCore15RenderContainer23destroyLeftoverChildrenEv
-__ZNK7WebCore12RenderObject22documentBeingDestroyedEv
-__ZN7WebCore10RenderFlow15deleteLineBoxesEv
-__ZN7WebCore15RenderContainer7destroyEv
+__ZN7WebCore11RenderBlock7destroyEv
+__ZN7WebCore21RenderObjectChildList23destroyLeftoverChildrenEv
+__ZN7WebCore17RenderLineBoxList15deleteLineBoxesEPNS_11RenderArenaE
 __ZN7WebCore9RenderBox7destroyEv
-__ZN7WebCore11RenderLayer13clearClipRectEv
+__ZN7WebCore20RenderBoxModelObject7destroyEv
+__ZN7WebCore11RenderLayer14clearClipRectsEv
 __ZN7WebCore12RenderObject7destroyEv
 __ZNK7WebCore12EventHandler18autoscrollRendererEv
-__ZNK7WebCore12RenderObject19animationControllerEv
-__ZNK7WebCore5Frame19animationControllerEv
-__ZN7WebCore19AnimationController24cancelImplicitAnimationsEPNS_12RenderObjectE
+__ZN7WebCore19AnimationController16cancelAnimationsEPNS_12RenderObjectE
 __ZN7WebCore11RenderBlock11removeChildEPNS_12RenderObjectE
-__ZN7WebCore15RenderContainer11removeChildEPNS_12RenderObjectE
-__ZN7WebCore12RenderObject21removeFromObjectListsEv
-__ZN7WebCore15RenderContainer15removeChildNodeEPNS_12RenderObjectEb
+__ZN7WebCore12RenderObject11removeChildEPS0_
+__ZN7WebCore21RenderObjectChildList15removeChildNodeEPNS_12RenderObjectES2_b
 __ZN7WebCore9RenderBox20deleteLineBoxWrapperEv
+__ZN7WebCore20RenderBoxModelObject12destroyLayerEv
 __ZN7WebCore11RenderLayer7destroyEPNS_11RenderArenaE
+__ZN7WebCore11RenderLayerD0Ev
 __ZN7WebCore11RenderLayer16destroyScrollbarENS_20ScrollbarOrientationE
 __ZN7WebCore11RenderLayerdlEPvm
 __ZN7WebCore11RenderArena4freeEmPv
 __ZN7WebCore12RenderObject11arenaDeleteEPNS_11RenderArenaEPv
-__ZN7WebCore11RenderStyle11arenaDeleteEPNS_11RenderArenaE
+__ZN7WebCore11RenderBlockD0Ev
+__ZN7WebCore9RenderBoxD2Ev
+__ZN7WebCore20RenderBoxModelObjectD2Ev
+__ZN7WebCore12RenderObjectD2Ev
+__ZN7WebCore11RenderStyleD1Ev
 __ZN7WebCore11RenderStyleD2Ev
-__ZN7WebCore11RenderStyledlEPvm
 __ZN7WebCore12RenderObjectdlEPvm
+__ZN7WebCore10RenderViewD0Ev
+__ZN3WTF9HashTableIPN7WebCore12RenderWidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dealloca
+__ZN7WebCore11RenderBlockD2Ev
+__ZN7WebCore18StyleInheritedDataD1Ev
 __ZN7WebCore18StyleInheritedDataD2Ev
+__ZN7WebCore11RenderArenaD1Ev
 __ZN7WebCore11RenderArenaD2Ev
 __ZN7WebCore15FinishArenaPoolEPNS_9ArenaPoolE
-__ZN7WebCore13FreeArenaListEPNS_9ArenaPoolEPNS_5ArenaEb
+__ZN7WebCoreL13FreeArenaListEPNS_9ArenaPoolEPNS_5ArenaEb
 __ZN7WebCore8Document26removeFocusedNodeOfSubtreeEPNS_4NodeEb
 __ZN7WebCore19SelectionController5clearEv
-__ZN7WebCore19SelectionController12setSelectionERKNS_9SelectionEbbb
+__ZN7WebCore19SelectionController12setSelectionERKNS_16VisibleSelectionEbbb
 __ZN7WebCore13TypingCommand11closeTypingEPNS_11EditCommandE
 __ZN7WebCore13TypingCommand26isOpenForMoreTypingCommandEPKNS_11EditCommandE
 __ZN7WebCore5Frame16clearTypingStyleEv
 __ZN7WebCore9FrameView5clearEv
-__ZN7WebCore10ScrollView19setStaticBackgroundEb
+__ZN7WebCore10ScrollView18setCanBlitOnScrollEb
+__ZN7WebCore10ScrollView26platformSetCanBlitOnScrollEb
+__ZN7WebCore5Frame23setSelectionGranularityENS_15TextGranularityE
+__ZThn8_N7WebCore8Document14removedLastRefEv
 __ZN7WebCore8Document14removedLastRefEv
 __ZN7WebCore13ContainerNode17removeAllChildrenEv
-__ZN7WebCore13ContainerNode28addChildNodesToDeletionQueueERPNS_4NodeES3_PS0_
-__ZNK7WebCore13ContainerNode13hasChildNodesEv
+__ZN7WebCore28removeAllChildrenInContainerINS_4NodeENS_13ContainerNodeEEEvPT0_
+__ZN7WebCore7Private28addChildNodesToDeletionQueueINS_4NodeENS_13ContainerNodeEEEvRPT_S6_PT0_
+__ZN7WebCore15HTMLHtmlElementD0Ev
+__ZN7WebCore11HTMLElementD2Ev
+__ZN7WebCore13StyledElementD2Ev
 __ZN7WebCore13StyledElement22destroyInlineStyleDeclEv
-__ZN7WebCore11EventTargetD0Ev
-__ZN3WTF20deleteAllPairSecondsIPSt4pairINS_6VectorIN7WebCore14DocumentMarkerELm0EEENS2_INS3_7IntRectELm0EEEEKNS_7HashMapINS_6RefPtrINS3_4NodeEEES9_NS_7PtrHashISD_EENS_10HashTraitsISD_EENSG_IS9_EEEEEEvRT0_
-__ZN7WebCore12HTMLDocumentD1Ev
-__ZN7WebCore14XMLHttpRequest14detachRequestsEPNS_8DocumentE
-__ZN3KJS17ScriptInterpreter28forgetAllDOMNodesForDocumentEPN7WebCore8DocumentE
-__ZN3KJS19domNodesPerDocumentEv
+__ZN7WebCore7ElementD2Ev
+__ZN7WebCore13ContainerNodeD2Ev
+__ZN7WebCore4NodeD2Ev
+__ZN7WebCore11EventTargetD2Ev
+__ZN3WTF20deleteAllPairSecondsIPSt4pairINS_6VectorIN7WebCore14DocumentMarkerELm0EEENS2_INS3_7IntRectELm0EEEEKNS_7HashMapINS_6Re
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS_6RefPtrINS1_17HTMLCanvasElementEEEENS_18PairFirstExtractorIS7_EENS1_10StringH
+__ZN7WebCore12HTMLDocumentD0Ev
+__ZN7WebCore8DocumentD2Ev
+__ZN7WebCore28forgetAllDOMNodesForDocumentEPNS_8DocumentE
+__ZN7WebCore16CSSStyleSelectorD1Ev
 __ZN7WebCore16CSSStyleSelectorD2Ev
+__ZN7WebCore19MediaQueryEvaluatorD1Ev
 __ZN7WebCore19MediaQueryEvaluatorD2Ev
+__ZN7WebCore10CSSRuleSetD1Ev
 __ZN7WebCore10CSSRuleSetD2Ev
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore15CSSRuleDataListEKNS_7HashMapIPNS1_16AtomicStringImplES3_NS_7PtrHashIS6_EENS_10HashTraitsIS6_EENS9_IS3_EEEEEEvRT0_
-__ZN7WebCore15CSSFontSelectorD1Ev
-__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE6shrinkEm
-__ZN7WebCore15BackgroundLayerD2Ev
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore15CSSRuleDataListEKNS_7HashMapIPNS1_16AtomicStringImplES3_NS_7PtrHashIS6_EENS_10HashTr
+__ZN3WTF15deleteAllValuesIPN7WebCore16MediaQueryResultELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_NS_6RefPtrINS1_22WebKitCSSKeyframesRuleEEEENS_18PairFirstExtractorIS
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deal
+__ZN7WebCore15CSSFontSelectorD0Ev
+__ZN7WebCore9FontCache12removeClientEPNS_12FontSelectorE
+__ZN3WTF9HashTableIPN7WebCore12FontSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_N
+__ZN3WTF9HashTableIPN7WebCore12FontSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAn
+__ZN3WTF9HashTableIPN7WebCore12FontSelectorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS
+__ZN3WTF20deleteAllPairSecondsIPNS_6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm0EEEKNS_7HashMapINS3_6StringES7_NS3_15CaseFold
+__ZN3WTF20deleteAllPairSecondsIPNS_7HashMapIjNS_6RefPtrIN7WebCore20CSSSegmentedFontFaceEEENS_7IntHashIjEENS_10HashTraitsIjEENS8
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm64EE6shrinkEm
+__ZN7WebCore9FillLayerD1Ev
+__ZN7WebCore9FillLayerD2Ev
+__ZN7WebCore9DocLoaderD1Ev
 __ZN7WebCore9DocLoaderD2Ev
+__ZN7WebCore9DocLoader13clearPreloadsEv
+__ZN3WTF11ListHashSetIPN7WebCore14CachedResourceENS_7PtrHashIS3_EEE14deleteAllNodesEv
 __ZN7WebCore5Cache15removeDocLoaderEPNS_9DocLoaderE
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore14HTMLCollection14CollectionInfoEKNS_7HashMapIPNS1_16AtomicStringImplES4_NS_7PtrHashIS7_EENS_10HashTraitsIS7_EENSA_IS4_EEEEEEvRT0_
+__ZN3WTF9HashTableIPN7WebCore9DocLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22
+__ZN3WTF9HashTableIPN7WebCore9DocLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInv
+__ZN3WTF9HashTableIPN7WebCore9DocLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore15CollectionCacheEKNS_7HashMapIPNS1_16AtomicStringImplES3_NS_7PtrHashIS6_EENS_10HashTr
 __ZN7WebCore14StyleSheetList17documentDestroyedEv
-__ZN7WebCore14HTMLCollection14CollectionInfoD2Ev
-__ZN3WTF11ListHashSetIPN7WebCore31HTMLFormControlElementWithStateENS_7PtrHashIS3_EEE14deleteAllNodesEv
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore31HTMLFormControlElementWithStateEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_NS_7PtrHashIS4_EEEENS_10HashTraitsIS6_EESE_E19removeAndInvalidateEPS6_
+__ZN3WTF9HashTableIPN7WebCore7ElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTabl
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_15CollectionCacheEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_
+__ZN7WebCore15CollectionCacheD1Ev
+__ZN7WebCore15CollectionCacheD2Ev
+__ZN3WTF11ListHashSetIPN7WebCore7ElementENS_7PtrHashIS3_EEE14deleteAllNodesEv
+__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore7ElementEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsI
+__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE14deleteAllNodesEv
+__ZN7WebCore14StyleSheetListD1Ev
 __ZN7WebCore14StyleSheetListD2Ev
+__ZN3WTF9HashTableIPN7WebCore5RangeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTableE
+__ZN3WTF9HashTableIPN7WebCore12NodeIteratorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dealloca
+__ZN7WebCore22ScriptExecutionContextD2Ev
+__ZN3WTF9HashTableIPN7WebCore11MessagePortES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocat
 __ZN7WebCore19TextResourceDecoderD1Ev
-__ZN7WebCoreplERKNS_16DeprecatedStringES2_
-__ZNK3WTF7HashMapIN7WebCore6StringEjNS1_10StringHashENS_10HashTraitsIS2_EENS4_IjEEE3getERKS2_
-__ZN7WebCore16CSSStyleSelector13setEncodedURLERKNS_4KURLE
-__ZN7WebCore4KURL8setQueryERKNS_16DeprecatedStringE
-__ZNK7WebCore16DeprecatedString7findRevEci
-__ZN7WebCore16DeprecatedString8truncateEj
-__ZN7WebCore4KURL7setPathERKNS_16DeprecatedStringE
-__ZN7WebCore4KURL13encode_stringERKNS_16DeprecatedStringE
-__ZNK7WebCore16DeprecatedString4utf8ERi
-__ZNK7WebCore12TextEncoding6encodeEPKtmb
-__ZN7WebCore7CStringC2EPKc
-__ZN7WebCore7CString4initEPKcj
-__ZNK7WebCore7CString17deprecatedCStringEv
-__ZNK7WebCore7CString6lengthEv
-__ZN7WebCore17DeprecatedCStringC2EPKcj
-__ZN7WebCore9ArrayImplC2Emm
-__ZN7WebCore9ArrayImpl12ArrayPrivateC2Emm
-__ZN7WebCore17DeprecatedCString6resizeEj
-__ZN7WebCore9ArrayImpl6resizeEm
-__ZNK7WebCore9ArrayImpl4dataEv
-__ZNK7WebCore17DeprecatedCString6lengthEv
-__ZN7WebCore9ArrayImplD2Ev
-__ZN7WebCore9ArrayImpl12ArrayPrivateD2Ev
-__ZNK7WebCore8Document35shouldBeAllowedToLoadLocalResourcesEv
-__ZN7WebCore11FrameLoader21shouldTreatURLAsLocalERKNS_6StringE
+__ZN7WebCore19TextResourceDecoderD2Ev
 __ZNK7WebCore11HistoryItem13documentStateEv
 __ZN7WebCore8Document26setStateForNewFormElementsERKN3WTF6VectorINS_6StringELm0EEE
 __ZN7WebCore11FrameLoader21dispatchDidCommitLoadEv
-__ZN7WebCore15BackForwardList11currentItemEv
-__ZNK7WebCore11HistoryItem20getTransientPropertyERKNS_6StringE
+__ZN7WebCore4Page27setJavaScriptURLsAreAllowedEb
 __ZN7WebCore15FocusController9setActiveEb
-__ZN7WebCore15FocusController18focusedOrMainFrameEv
-__ZN7WebCore19SelectionController10setFocusedEb
+__ZN7WebCore19SelectionController21pageActivationChangedEv
+__ZN7WebCore5Frame20setSelectionFromNoneEv
+__ZNK7WebCore5Frame17isContentEditableEv
+__ZNK7WebCore6Editor16clientIsEditableEv
+__ZNK7WebCore8Document12inDesignModeEv
+__ZN7WebCore5Frame22clearCaretRectIfNeededEv
+__ZN7WebCore19SelectionController19invalidateCaretRectEv
+__ZN7WebCore5Frame22selectionLayoutChangedEv
+__ZN7WebCore19SelectionController18recomputeCaretRectEv
+__ZNK7WebCore19SelectionController14localCaretRectEv
+__ZN7WebCore19SelectionController6layoutEv
+__ZNK7WebCore19SelectionController26absoluteBoundsForLocalRectERKNS_7IntRectE
+__ZNK7WebCore19SelectionController13caretRendererEv
+__ZN7WebCore10RenderView14clearSelectionEv
+__ZN7WebCore10RenderView20repaintViewRectangleERKNS_7IntRectEb
+__ZN7WebCore10RenderView12setSelectionEPNS_12RenderObjectEiS2_iNS0_20SelectionRepaintModeE
 __ZNK7WebCore6Editor7canEditEv
-__ZNK7WebCore9Selection17isContentEditableEv
+__ZNK7WebCore16VisibleSelection17isContentEditableEv
 __ZN7WebCore18isEditablePositionERKNS_8PositionE
 __ZN7WebCore19InspectorController13didCommitLoadEPNS_14DocumentLoaderE
 __ZN7WebCore11FrameLoader29dispatchWindowObjectAvailableEv
-__ZN7WebCore8KJSProxyC2EPNS_5FrameE
-__ZN7WebCore9DocLoader14setCachePolicyENS_11CachePolicyE
-__ZNK7WebCore20ResourceResponseBase15httpHeaderFieldERKNS_6StringE
 __ZN7WebCore16parseHTTPRefreshERKNS_6StringEbRdRS0_
--[WebCoreFrameBridge addData:]
 __ZN7WebCore8Document24setShouldCreateRenderersEb
 __ZN7WebCore11FrameLoader7addDataEPKci
+__ZN7WebCore19TextResourceDecoder11setEncodingERKNS_12TextEncodingENS0_14EncodingSourceE
 __ZNK7WebCore12TextEncoding10isJapaneseEv
-__ZN7WebCore15addEncodingNameERN3WTF7HashSetIPKcNS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EEEES3_
-__ZN3WTF7HashSetIPKcNS_7PtrHashIS2_EENS_10HashTraitsIS2_EEE3addERKS2_
-__ZNK3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E8containsIiNS_22IdentityHashTranslatorIiiS4_EEEEbRKT_
-__ZN7WebCore12HTMLDocument18determineParseModeERKNS_6StringE
-__ZN7WebCore10StringImpl4findEti
-__ZNK7WebCore6StringixEj
-__ZN7WebCore14containsStringEPKcRKNS_6StringEi
-__ZNK7WebCore6String9substringEjj
-__ZN7WebCore10StringImpl9substringEjj
-__ZN7WebCore16parseDocTypePartERKNS_6StringEi
-__ZNK7WebCore6String15stripWhiteSpaceEv
-__ZN7WebCore10StringImpl15stripWhiteSpaceEv
-__ZN7WebCore12DocumentTypeC2EPNS_8DocumentERKNS_6StringES5_S5_
-__ZN7WebCore8Document10setDocTypeEN3WTF10PassRefPtrINS_12DocumentTypeEEE
-__ZNK7WebCore6String6latin1Ev
-__ZN7WebCore15TextCodecLatin16encodeEPKtmb
-__Z16findDoctypeEntryPKcj
+__ZNK7WebCore19TextResourceDecoder16shouldAutoDetectEv
+__ZN7WebCoreL15newTextCodecICUERKNS_12TextEncodingEPKv
+__ZN7WebCore12TextCodecICUC1ERKNS_12TextEncodingE
+__ZN7WebCore12TextCodecICUC2ERKNS_12TextEncodingE
+__ZN7WebCore12TextCodecICU6decodeEPKcmbbRb
+__ZNK7WebCore12TextCodecICU18createICUConverterEv
+__ZN7WebCoreL18cachedConverterICUEv
+__ZN7WebCore12TextCodecICU14decodeToBufferEPtS1_RPKcS3_PibR10UErrorCode
 __ZNK7WebCore12TextEncoding18usesVisualOrderingEv
-__ZNK7WebCore11RenderStyle21contentDataEquivalentEPKS0_
+__ZNK7WebCore25StyleRareNonInheritedData21contentDataEquivalentERKS0_
 __ZNK7WebCore11RenderStyleeqERKS0_
-__ZNK7WebCore11RenderStyle17inheritedNotEqualEPS0_
-__ZNK7WebCore11RenderStyle4diffEPKS0_
+__ZNK7WebCore18StyleInheritedDataeqERKS0_
 __ZNK7WebCore4FonteqERKS0_
 __ZN7WebCore13HTMLTokenizer5writeERKNS_15SegmentedStringEb
+__ZN7WebCore15SegmentedStringC1ERKS0_
 __ZN7WebCore15SegmentedStringC2ERKS0_
-__ZN7WebCore23DeprecatedValueListImplC2ERKS0_
 __ZN7WebCore13HTMLTokenizer6setSrcERKNS_15SegmentedStringE
 __ZN7WebCore15SegmentedStringaSERKS0_
-__ZN7WebCore23DeprecatedValueListImplaSERKS0_
 __ZN7WebCore13HTMLTokenizer8parseTagERNS_15SegmentedStringENS0_5StateE
-__ZNK7WebCore15SegmentedString6lengthEv
-__ZN7WebCore12AtomicString3addEPKt
-__ZN7WebCore5Token12addAttributeEPNS_8DocumentERNS_12AtomicStringERKS3_b
-__ZN7WebCore18NamedMappedAttrMapC2EPNS_7ElementE
-__ZNK7WebCore12NamedAttrMap16getAttributeItemERKNS_13QualifiedNameE
-__ZN7WebCore12NamedAttrMap12addAttributeEN3WTF10PassRefPtrINS_9AttributeEEE
-__ZN7WebCore10StringImpl29createStrippingNullCharactersEPKtj
+__ZN7WebCore13HTMLTokenizer12parseDoctypeERNS_15SegmentedStringENS0_5StateE
+__ZN7WebCore13HTMLTokenizer19processDoctypeTokenEv
+__ZN7WebCore10HTMLParser17parseDoctypeTokenEPNS_12DoctypeTokenE
+__ZN7WebCore12DocumentTypeC1EPNS_8DocumentERKNS_6StringES5_S5_
+__ZN7WebCore12DocumentTypeC2EPNS_8DocumentERKNS_6StringES5_S5_
+__ZNK7WebCore4Node13isCommentNodeEv
+__ZNK7WebCore12DocumentType8nodeTypeEv
+__ZN7WebCore12DocumentType20insertedIntoDocumentEv
+__ZN7WebCore8Document10setDocTypeEN3WTF10PassRefPtrINS_12DocumentTypeEEE
+__ZN7WebCore4Node11setDocumentEPNS_8DocumentE
+__ZN7WebCore12HTMLDocument18determineParseModeEv
+__ZNK7WebCore6String6latin1Ev
+__ZNK7WebCore12TextEncoding6encodeEPKtmNS_19UnencodableHandlingE
+__ZN7WebCore15TextCodecLatin16encodeEPKtmNS_19UnencodableHandlingE
+__ZNK7WebCore7CString6lengthEv
+__ZN7WebCore8Document19updateStyleSelectorEv
+__ZN7WebCore8Document19recalcStyleSelectorEv
+__ZNK7WebCore11RenderStyle17inheritedNotEqualEPS0_
+__ZNK7WebCore11RenderStyle4diffEPKS0_Rj
+__ZNK7WebCore19TransformOperationseqERKS0_
+__ZN7WebCore4Node11recalcStyleENS0_11StyleChangeE
 __ZN7WebCore10HTMLParser10parseTokenEPNS_5TokenE
+__ZNK7WebCore4Node16virtualLocalNameEv
 __ZN7WebCore4Text21createWithLengthLimitEPNS_8DocumentERKNS_6StringERjj
+__ZN7WebCore4TextC1EPNS_8DocumentERKNS_6StringE
 __ZN7WebCore4TextC2EPNS_8DocumentERKNS_6StringE
-__ZN7WebCore13CharacterDataC2EPNS_8DocumentERKNS_6StringE
-__ZNK7WebCore4Node9localNameEv
+__ZN7WebCore13CharacterDataC2EPNS_8DocumentERKNS_6StringEb
 __ZNK7WebCore4Node13isHTMLElementEv
-__ZNK7WebCore4Node13isCommentNodeEv
+__ZNK7WebCore4Text8nodeTypeEv
 __ZN7WebCore10HTMLParser11handleErrorEPNS_4NodeEbRKNS_12AtomicStringEi
-__ZNK7WebCore4Text10isTextNodeEv
 __ZNK7WebCore13CharacterData22containsOnlyWhitespaceEv
 __ZN7WebCore10StringImpl22containsOnlyWhitespaceEv
 __ZN7WebCore10TreeSharedINS_4NodeEE14removedLastRefEv
-__ZN7WebCore4TextD1Ev
-__ZN7WebCore12NamedAttrMap15clearAttributesEv
-__ZN7WebCore12AtomicString6removeEPNS_10StringImplE
+__ZThn8_N7WebCore4TextD0Ev
+__ZN7WebCore4TextD0Ev
+__ZN7WebCore13CharacterDataD2Ev
+__ZN7WebCore13HTMLTokenizer12parseCommentERNS_15SegmentedStringENS0_5StateE
+__ZNK7WebCore15SegmentedString6lengthEv
+__ZN7WebCore13HTMLTokenizer19enlargeScriptBufferEi
+__ZN7WebCore13HTMLTokenizer14processListingENS_15SegmentedStringENS0_5StateE
+__ZN7WebCore15SegmentedString15advanceSlowCaseEv
+__ZN7WebCore15SegmentedString16advanceSubstringEv
 __ZN7WebCore10HTMLParser7getNodeEPNS_5TokenE
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEMNS1_10HTMLParserEFbPNS1_5TokenERNS_6RefPtrINS1_4NodeEEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSF_ISC_EEE3getERKS3_
-__ZN3WTF9HashTableIiSt4pairIiMN7WebCore10HTMLParserEFbPNS2_5TokenERNS_6RefPtrINS2_4NodeEEEEENS_18PairFirstExtractorISC_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSI_ISB_EEEESJ_E3addIPNS2_16AtomicStringImplESB_NS_17HashMapTranslatorILb1ES1_ISP_SB_ENS_18PairBaseHashTraitsINSI_ISP_EESK_EESL_NS_7PtrHashISP_EEEEEES1_INS_17HashTableIteratorIiSC_SE_SG_SL_SJ_EEbERKT_RKT0_
-__ZN3WTF9HashTableIiSt4pairIiMN7WebCore10HTMLParserEFbPNS2_5TokenERNS_6RefPtrINS2_4NodeEEEEENS_18PairFirstExtractorISC_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSI_ISB_EEEESJ_E6expandEv
-__ZN3WTF9HashTableIiSt4pairIiMN7WebCore10HTMLParserEFbPNS2_5TokenERNS_6RefPtrINS2_4NodeEEEEENS_18PairFirstExtractorISC_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSI_ISB_EEEESJ_E4findIiNS_22IdentityHashTranslatorIiSC_SG_EEEENS_17HashTableIteratorIiSC_SE_SG_SL_SJ_EERKT_
-__ZN7WebCore18HTMLElementFactory17createHTMLElementERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore6addTagERKNS_13QualifiedNameEPFN3WTF10PassRefPtrINS_11HTMLElementEEERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEbE
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFNS_10PassRefPtrINS1_11HTMLElementEEERKNS1_12AtomicStringEPNS1_8DocumentEPNS1_15HTMLFormElementEbENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSI_ISF_EEE3getERKS3_
-__ZN7WebCore15htmlConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore7Element15setAttributeMapEPNS_12NamedAttrMapE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEMNS1_10HTMLParserEFbPNS1_5TokenERNS_6RefPtrINS1_4NodeEEEENS_7PtrHashIS3_EENS_10Ha
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_MNS1_10HTMLParserEFbPNS1_5TokenERNS_6RefPtrINS1_4NodeEEEEENS_18PairF
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEMNS1_10HTMLParserEFbPNS1_5TokenERNS_6RefPtrINS1_4NodeEEEENS_7PtrHashIS3_EENS_10H
+__ZN7WebCore10HTMLParser23commentCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore7CommentC1EPNS_8DocumentERKNS_6StringE
+__ZN7WebCore7CommentC2EPNS_8DocumentERKNS_6StringE
+__ZNK7WebCore7Comment13isCommentNodeEv
+__ZN7WebCore4Node21finishParsingChildrenEv
+__ZN7WebCore10HTMLParser15processCloseTagEPNS_5TokenE
+__ZN7WebCore12AtomicString3addEPKt
+__ZN7WebCore10StringImplC1EPKtjj
+__ZN7WebCore10StringImplC2EPKtjj
+__ZN7WebCore5Token12addAttributeERNS_12AtomicStringERKS1_b
+__ZNK7WebCore12NamedNodeMap16getAttributeItemERKNS_13QualifiedNameE
+__ZN7WebCore12NamedNodeMap12addAttributeEN3WTF10PassRefPtrINS_9AttributeEEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AttributeEEELm0EE14shrinkCapacityEm
+__ZN7WebCore18HTMLElementFactory17createHTMLElementERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCoreL6addTagERKNS_13QualifiedNameEPFN3WTF10PassRefPtrINS_11HTMLElementEEES2_PNS_8DocumentEPNS_15HTMLFormElementEbE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPFNS_10PassRefPtrINS1_11HTMLElementEEERKNS1_13QualifiedNameEPNS1_8DocumentEPNS1_1
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PFNS_10PassRefPtrINS1_11HTMLElementEEERKNS1_13QualifiedNameEPNS1_8Do
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFNS_10PassRefPtrINS1_11HTMLElementEEERKNS1_13QualifiedNameEPNS1_8DocumentEPNS1_
+__ZN7WebCoreL15htmlConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore7Element15setAttributeMapEN3WTF10PassRefPtrINS_12NamedNodeMapEEE
+__ZN7WebCore13StyledElement16attributeChangedEPNS_9AttributeEb
+__ZN7WebCore15MappedAttribute17isMappedAttributeEv
+__ZNK7WebCore11HTMLElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZNK7WebCore13StyledElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore11HTMLElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore4Node13ownerDocumentEv
+__ZN7WebCore16CSSStyleSelector23hasSelectorForAttributeERKNS_12AtomicStringE
+__ZNK3WTF9HashTableIPN7WebCore16AtomicStringImplES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8cont
+__ZN7WebCore7Element16attributeChangedEPNS_9AttributeEb
+__ZNK7WebCore8Document13axObjectCacheEv
+__ZN7WebCore13StyledElement22getMappedAttributeDeclENS_20MappedAttributeEntryEPNS_9AttributeE
+__ZN7WebCore13StyledElement14addCSSPropertyEPNS_15MappedAttributeEiRKNS_6StringE
+__ZN7WebCore13StyledElement16createMappedDeclEPNS_15MappedAttributeE
+__ZN7WebCore26CSSMutableStyleDeclarationC2EPNS_7CSSRuleE
+__ZN7WebCore8Document12elementSheetEv
+__ZN7WebCore13CSSStyleSheetC1EPNS_4NodeERKNS_6StringES5_
+__ZN7WebCore13CSSStyleSheetC2EPNS_4NodeERKNS_6StringES5_
+__ZN7WebCore10StyleSheetC2EPNS_4NodeERKNS_6StringE
+__ZN7WebCore26CSSMutableStyleDeclaration11setPropertyEiRKNS_6StringEbb
+__ZN7WebCore9CSSParser10parseValueEPNS_26CSSMutableStyleDeclarationEiRKNS_6StringEb
+__ZN7WebCore9StyleBase10stylesheetEv
+__ZNK7WebCore9StyleBase12isStyleSheetEv
+__ZNK7WebCore10StyleSheet12isStyleSheetEv
+__ZN7WebCore26CSSMutableStyleDeclaration19addParsedPropertiesEPKPKNS_11CSSPropertyEi
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EE15reserveCapacityEm
+__ZNK7WebCore26CSSMutableStyleDeclaration19getPropertyPriorityEi
+__ZNK7WebCore26CSSMutableStyleDeclaration18findPropertyWithIdEi
+__ZN7WebCore26CSSMutableStyleDeclaration14removePropertyEibb
+__ZN7WebCore26CSSMutableStyleDeclaration23removeShorthandPropertyEib
+__ZN7WebCore19longhandForPropertyEi
+__ZN7WebCoreL16initShorthandMapERN3WTF7HashMapIiNS_19CSSPropertyLonghandENS0_7IntHashIjEENS0_10HashTraitsIiEENS5_IS2_EEEE
+__ZN3WTF7HashMapIiN7WebCore19CSSPropertyLonghandENS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3setERKiRKS2_
+__ZN3WTF9HashTableIiSt4pairIiN7WebCore19CSSPropertyLonghandEENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS
+__ZNK3WTF7HashMapIiN7WebCore19CSSPropertyLonghandENS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3getERKi
+__ZN7WebCore26CSSMutableStyleDeclaration18findPropertyWithIdEi
+__ZN7WebCore26CSSMutableStyleDeclaration19setNeedsStyleRecalcEv
+__ZN7WebCore13StyledElement14addCSSPropertyEPNS_15MappedAttributeEii
+__ZN7WebCore26CSSMutableStyleDeclaration11setPropertyEiibb
+__ZN7WebCore26CSSMutableStyleDeclaration19setPropertyInternalERKNS_11CSSPropertyEPS1_
+__ZN7WebCore13StyledElement22setMappedAttributeDeclENS_20MappedAttributeEntryEPNS_9AttributeEPNS_29CSSMappedAttributeDeclaratio
+__ZN3WTF7HashMapIN7WebCore18MappedAttributeKeyEPNS1_29CSSMappedAttributeDeclarationENS1_19MappedAttributeHashENS1_24MappedAttri
+__ZN3WTF9HashTableIN7WebCore18MappedAttributeKeyESt4pairIS2_PNS1_29CSSMappedAttributeDeclarationEENS_18PairFirstExtractorIS6_EE
+__ZN7WebCore19MappedAttributeHash4hashERKNS_18MappedAttributeKeyE
 __ZNK7WebCore15HTMLHtmlElement17endTagRequirementEv
+__ZNK7WebCore14DocumentLoader28mainResourceApplicationCacheEv
 __ZN7WebCore11HTMLElement12childAllowedEPNS_4NodeE
 __ZN7WebCore4Node12childAllowedEPS0_
-__ZNK7WebCore4Text8nodeTypeEv
 __ZN7WebCore7Element16childTypeAllowedENS_4Node8NodeTypeE
-__ZNK7WebCore4Node13isElementNodeEv
 __ZN7WebCore15HTMLHtmlElement8checkDTDEPKNS_4NodeE
 __ZN7WebCore10HTMLParser20headCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore15HTMLHeadElementC2EPNS_8DocumentE
+__ZN7WebCore15HTMLHeadElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLHeadElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZNK7WebCore15HTMLHeadElement17endTagRequirementEv
 __ZN7WebCore10HTMLParser8popBlockERKNS_12AtomicStringEb
 __ZNK7WebCore15HTMLHeadElement11tagPriorityEv
 __ZNK7WebCore7Element8nodeTypeEv
-__ZN7WebCore7Element15childrenChangedEb
-__ZN7WebCore7Element20beginParsingChildrenEv
+__ZN7WebCore7Element15childrenChangedEbPNS_4NodeES2_i
+__ZNK7WebCore4Node22nonRendererRenderStyleEv
+__ZN7WebCoreL20loadFullDefaultStyleEv
+__ZN7WebCore13CSSStyleSheetD0Ev
+__ZN7WebCore10StyleSheetD2Ev
+__ZN7WebCore12CSSStyleRuleD0Ev
+__ZN7WebCore15CSSSelectorListD1Ev
+__ZN7WebCore15CSSSelectorListD2Ev
+__ZN7WebCore26CSSMutableStyleDeclarationD0Ev
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EE6shrinkEm
+__ZN7WebCore12CSSValueListD0Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore8CSSValueEEELm0EE6shrinkEm
+__ZN7WebCore11CSSSelectorD2Ev
+__ZN7WebCore5themeEv
+__ZN7WebCore14RenderThemeMacC1Ev
+__ZN7WebCore14RenderThemeMacC2Ev
+__ZN7WebCore11RenderThemeC2Ev
+__ZN7WebCore13platformThemeEv
+-[WebCoreRenderThemeNotificationObserver initWithTheme:]
+__ZN7WebCore11RenderTheme22extraDefaultStyleSheetEv
+__ZN7WebCore13CSSStyleSheet12addNamespaceEPNS_9CSSParserERKNS_12AtomicStringES5_
+__ZN7WebCore9CSSParser12parseContentEib
+__ZN7WebCore6StringC1EPKtj
+__ZN7WebCore6StringC2EPKtj
+__ZN7WebCore17CSSPrimitiveValue6createERKNS_6StringENS0_9UnitTypesE
+__ZN7WebCore17CSSPrimitiveValueC1ERKNS_6StringENS0_9UnitTypesE
+__ZN7WebCore17CSSPrimitiveValueC2ERKNS_6StringENS0_9UnitTypesE
+__ZN7WebCore9CSSParser15parseFontWeightEb
+__ZN7WebCore11CSSSelector12setAttributeERKNS_13QualifiedNameE
+__ZN7WebCore9CSSParser10parseColorEPNS_14CSSParserValueE
+__ZN7WebCore9CSSParser19parseColorFromValueEPNS_14CSSParserValueERjb
+__ZN7WebCore9CSSParser10parseColorERKNS_6StringERjb
+__ZN7WebCore17CSSPrimitiveValue11createColorEj
+__ZNK3WTF7HashMapIjNS_6RefPtrIN7WebCore17CSSPrimitiveValueEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE3getERKj
+__ZN7WebCore17CSSPrimitiveValueC1Ej
+__ZN7WebCore17CSSPrimitiveValueC2Ej
+__ZN3WTF7HashMapIjNS_6RefPtrIN7WebCore17CSSPrimitiveValueEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE3addERKjRKS4_
+__ZN7WebCore5Color13parseHexColorERKNS_6StringERj
+__ZN7WebCore9CSSParser17parseFillPropertyEiRiS1_RN3WTF6RefPtrINS_8CSSValueEEES6_
+__ZN7WebCore9CSSParser14parseFillImageERN3WTF6RefPtrINS_8CSSValueEEE
+__ZN7WebCore13CSSImageValueC1Ev
+__ZN7WebCore13CSSImageValueC2Ev
+__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_4PairEEE
+__ZN7WebCore9CSSParser14parseFontStyleEb
+__ZN7WebCore9CSSParser15parseFontFamilyEv
+__ZN7WebCoreL9printEvalEv
+__ZN7WebCore11RenderTheme21extraQuirksStyleSheetEv
+__ZN7WebCore9CSSParser16parseFontVariantEb
+__ZN7WebCore11CSSSelector17setSimpleSelectorEPS0_
 __ZN7WebCore15HTMLHeadElement12childAllowedEPNS_4NodeE
-__ZN7WebCore4Node16insertedIntoTreeEb
 __ZN7WebCore4Text6attachEv
-__ZN7WebCore4Node21finishParsingChildrenEv
-__ZN7WebCore16titleConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLTitleElementC2EPNS_8DocumentE
+__ZN7WebCoreL16titleConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLTitleElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLTitleElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZNK7WebCore11HTMLElement17endTagRequirementEv
 __ZNK7WebCore11HTMLElement11tagPriorityEv
-__ZNK7WebCore4Node10isTextNodeEv
 __ZN7WebCore15HTMLHeadElement8checkDTDEPKNS_4NodeE
 __ZN7WebCore16HTMLTitleElement20insertedIntoDocumentEv
 __ZN7WebCore8Document8setTitleERKNS_6StringEPNS_7ElementE
 __ZN7WebCore13HTMLTokenizer12parseSpecialERNS_15SegmentedStringENS0_5StateE
-__ZN7WebCore13HTMLTokenizer19enlargeScriptBufferEi
-__ZN7WebCore13HTMLTokenizer14processListingENS_15SegmentedStringENS0_5StateE
-__ZN7WebCore15SegmentedString15advanceSlowCaseEv
-__ZN7WebCore15SegmentedString16advanceSubstringEv
 __ZN7WebCore16HTMLTitleElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore16HTMLTitleElement15childrenChangedEb
+__ZN7WebCore16HTMLTitleElement15childrenChangedEbPNS_4NodeES2_i
 __ZNK7WebCore13CharacterData9nodeValueEv
 __ZN7WebCore8Document11updateTitleEv
 __ZN7WebCore11FrameLoader8setTitleERKNS_6StringE
 __ZN7WebCore14DocumentLoader8setTitleERKNS_6StringE
+__ZNK7WebCore8Document31displayBufferModifiedByEncodingEPtj
 __ZN7WebCore11FrameLoader15willChangeTitleEPNS_14DocumentLoaderE
 __ZN7WebCore11FrameLoader14didChangeTitleEPNS_14DocumentLoaderE
-__ZNK7WebCore14DocumentLoader11isCommittedEv
 __ZN7WebCore11HistoryItem8setTitleERKNS_6StringE
-__ZN7WebCore10HTMLParser15processCloseTagEPNS_5TokenE
 __ZN7WebCore10HTMLParser25isAffectedByResidualStyleERKNS_12AtomicStringE
 __ZN3WTF7HashSetIPN7WebCore16AtomicStringImplENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expan
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehas
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allo
 __ZN7WebCore10HTMLParser23reopenResidualStyleTagsEPNS_13HTMLStackElemEPNS_4NodeE
-__ZN7WebCore16styleConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLStyleElementC2EPNS_8DocumentE
+__ZN7WebCoreL15metaConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore15HTMLMetaElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLMetaElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLMetaElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15HTMLMetaElement7processEv
+__ZNK7WebCore15HTMLMetaElement17endTagRequirementEv
+__ZNK7WebCore15HTMLMetaElement11tagPriorityEv
+__ZN7WebCore15HTMLMetaElement20insertedIntoDocumentEv
+__ZN7WebCore8Document16processHttpEquivERKNS_6StringES3_
+__ZN7WebCoreL15linkConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore15HTMLLinkElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15HTMLLinkElementC2ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15HTMLLinkElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15HTMLLinkElement20tokenizeRelAttributeERKNS_12AtomicStringERbS4_S4_S4_
+__ZN7WebCore15HTMLLinkElement7processEv
+__ZN7WebCore8parseURLERKNS_6StringE
+__ZNK7WebCore8Document11completeURLERKNS_6StringE
+__ZN7WebCore4KURLC1ERKS0_RKNS_6StringERKNS_12TextEncodingE
+__ZN7WebCore4KURLC2ERKS0_RKNS_6StringERKNS_12TextEncodingE
+__ZNK7WebCore12TextEncoding25encodingForFormSubmissionEv
+__ZNK7WebCore12TextEncoding22isNonByteBasedEncodingEv
+__ZN7WebCore25UTF16LittleEndianEncodingEv
+__ZN7WebCore22UTF16BigEndianEncodingEv
+__ZNK7WebCore12TextEncoding14isUTF7EncodingEv
+__ZNK7WebCore15HTMLLinkElement17endTagRequirementEv
+__ZNK7WebCore15HTMLLinkElement11tagPriorityEv
+__ZN7WebCore15HTMLLinkElement20insertedIntoDocumentEv
+__ZN7WebCore8Document26addStyleSheetCandidateNodeEPNS_4NodeEb
+__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore4NodeEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_
+__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
+__ZN7WebCore8Document10setIconURLERKNS_6StringES3_
+__ZN7WebCore15HTMLLinkElement21finishParsingChildrenEv
+__ZN7WebCore10StringImpl7replaceEtt
+__ZNK7WebCore6String5splitEtRN3WTF6VectorIS0_Lm0EEE
+__ZNK7WebCore6String5splitERKS0_bRN3WTF6VectorIS0_Lm0EEE
+__ZN7WebCore4Node23compareDocumentPositionEPS0_
+__ZN3WTF6VectorIPN7WebCore4NodeELm16EE6shrinkEm
+__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE12insertBeforeERKS3_S8_
+__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE12insertBeforeENS_19ListHashSetIteratorIS3_S5_EERKS3_
+__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE16insertNodeBeforeEPNS_15ListHashSetNodeIS3_EES9_
+__ZN7WebCoreL16styleConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLStyleElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore16HTMLStyleElementC2ERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore12StyleElementC2Ev
-__ZNK7WebCore12NamedAttrMap6lengthEv
-__ZN7WebCore13StyledElement16attributeChangedEPNS_9AttributeEb
-__ZNK7WebCore11HTMLElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZNK7WebCore13StyledElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
 __ZN7WebCore16HTMLStyleElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore11HTMLElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore4Node13ownerDocumentEv
-__ZN7WebCore16CSSStyleSelector23hasSelectorForAttributeERKNS_12AtomicStringE
 __ZNK7WebCore16HTMLStyleElement17endTagRequirementEv
 __ZNK7WebCore16HTMLStyleElement11tagPriorityEv
 __ZN7WebCore16HTMLStyleElement20insertedIntoDocumentEv
-__ZN7WebCore13HTMLTokenizer13enlargeBufferEi
 __ZN7WebCore16HTMLStyleElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore16HTMLStyleElement15childrenChangedEb
+__ZN7WebCore16HTMLStyleElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore16HTMLStyleElement21finishParsingChildrenEv
 __ZN7WebCore12StyleElement7processEPNS_7ElementE
 __ZN7WebCore12StyleElement11createSheetEPNS_7ElementERKNS_6StringE
-__ZThn68_NK7WebCore16HTMLStyleElement4typeEv
+__ZThn112_NK7WebCore16HTMLStyleElement4typeEv
 __ZNK7WebCore16HTMLStyleElement4typeEv
-__ZNK7WebCore7Element12getAttributeERKNS_13QualifiedNameE
-__ZNK7WebCore12AtomicString16deprecatedStringEv
-__ZN7WebCore12AtomicStringC2ERKNS_16DeprecatedStringE
-__ZThn68_NK7WebCore16HTMLStyleElement5mediaEv
+__ZThn112_NK7WebCore16HTMLStyleElement5mediaEv
 __ZNK7WebCore16HTMLStyleElement5mediaEv
+__ZN7WebCore9MediaListC1EPNS_13CSSStyleSheetERKNS_6StringEb
 __ZN7WebCore9MediaListC2EPNS_13CSSStyleSheetERKNS_6StringEb
 __ZN7WebCore9MediaList12setMediaTextERKNS_6StringERi
-__ZNK7WebCore6String5splitEtb
-__ZNK7WebCore6String5splitERKS0_b
+__ZN7WebCore9MediaListC1EPNS_13CSSStyleSheetEb
+__ZN7WebCore9MediaListC2EPNS_13CSSStyleSheetEb
+__ZNK7WebCore6String15stripWhiteSpaceEv
+__ZN7WebCore10StringImpl15stripWhiteSpaceEv
+__ZN7WebCore9CSSParser15parseMediaQueryEPNS_9MediaListERKNS_6StringE
+__ZN7WebCore9CSSParser31createFloatingMediaQueryExpListEv
+__ZN7WebCore9CSSParser29sinkFloatingMediaQueryExpListEPN3WTF6VectorIPNS_13MediaQueryExpELm0EEE
+__ZN7WebCore9CSSParser24createFloatingMediaQueryENS_10MediaQuery10RestrictorERKNS_6StringEPN3WTF6VectorIPNS_13MediaQueryExpELm0
+__ZN7WebCore10MediaQueryC1ENS0_10RestrictorERKNS_6StringEPN3WTF6VectorIPNS_13MediaQueryExpELm0EEE
+__ZN7WebCore10MediaQueryC2ENS0_10RestrictorERKNS_6StringEPN3WTF6VectorIPNS_13MediaQueryExpELm0EEE
+__ZN7WebCore9CSSParser22sinkFloatingMediaQueryEPNS_10MediaQueryE
+__ZN7WebCore9MediaList16appendMediaQueryEPNS_10MediaQueryE
+__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE15reserveCapacityEm
 __ZN3WTF15deleteAllValuesIPN7WebCore10MediaQueryELm0EEEvRKNS_6VectorIT_XT0_EEE
 __ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EEaSERKS4_
+__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE6shrinkEm
+__ZN7WebCore9MediaList13notifyChangedEv
 __ZN7WebCore9MediaListD0Ev
-__ZNK7WebCore19MediaQueryEvaluator4evalEPKNS_9MediaListE
-__ZThn68_N7WebCore16HTMLStyleElement10setLoadingEb
+__ZNK7WebCore19MediaQueryEvaluator4evalEPKNS_9MediaListEPNS_16CSSStyleSelectorE
+__ZNK7WebCore19MediaQueryEvaluator14mediaTypeMatchERKNS_6StringE
+__ZN7WebCoreL15applyRestrictorENS_10MediaQuery10RestrictorEb
+__ZThn112_N7WebCore16HTMLStyleElement10setLoadingEb
 __ZN7WebCore16HTMLStyleElement10setLoadingEb
-__ZNK7WebCore8Document13inputEncodingEv
-__ZN7WebCore13CSSStyleSheetC2EPNS_4NodeERKNS_6StringES5_
-__ZN7WebCore10StyleSheetC2EPNS_4NodeERKNS_6StringE
-__ZN7WebCore9CSSParser24parseBackgroundShorthandEb
-__ZN7WebCore9CSSParser23parseBackgroundPositionERN3WTF6RefPtrINS_8CSSValueEEES5_
-__ZN7WebCore9CSSParser25parseBackgroundPositionXYERbS1_
-__ZN7WebCore9CSSParser20parseBackgroundColorEv
-__ZN7WebCore9CSSParser18addBackgroundValueERN3WTF6RefPtrINS_8CSSValueEEENS1_10PassRefPtrIS3_EE
-__ZN7WebCore9CSSParser9parseFontEb
-__ZN7WebCore10StyleSheet8setMediaEPNS_9MediaListE
+__ZNK7WebCore8Document8encodingEv
+__ZNK7WebCore12TextEncoding7domNameEv
+__ZN7WebCore9CSSParser15createMediaListEv
+__ZN7WebCore9CSSParser16createImportRuleERKNS_15CSSParserStringEPNS_9MediaListE
+__ZN7WebCore13CSSImportRuleC1EPNS_13CSSStyleSheetERKNS_6StringEN3WTF10PassRefPtrINS_9MediaListEEE
+__ZN7WebCore13CSSImportRuleC2EPNS_13CSSStyleSheetERKNS_6StringEN3WTF10PassRefPtrINS_9MediaListEEE
+__ZN7WebCore13CSSImportRule18insertedIntoParentEv
+__ZNK7WebCore7CSSRule16parentStyleSheetEv
+__ZN7WebCore9DocLoader20requestCSSStyleSheetERKNS_6StringES3_
+__ZN7WebCore9DocLoader15requestResourceENS_14CachedResource4TypeERKNS_6StringES5_b
+__ZN7WebCore9DocLoader10canRequestENS_14CachedResource4TypeERKNS_4KURLE
+__ZN7WebCore9DocLoader14checkForReloadERKNS_4KURLE
+__ZN7WebCore5Cache14resourceForURLERKNS_6StringE
+__ZNK3WTF7HashMapIN7WebCore6StringEPNS1_14CachedResourceENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3getERKS2_
+__ZN7WebCore5Cache15requestResourceEPNS_9DocLoaderENS_14CachedResource4TypeERKNS_4KURLERKNS_6StringEb
+__ZN7WebCore11FrameLoader21restrictAccessToLocalEv
+__ZN7WebCore11FrameLoader7canLoadERKNS_4KURLERKNS_6StringEPKNS_8DocumentE
+__ZN7WebCore11FrameLoader21shouldTreatURLAsLocalERKNS_6StringE
+__ZN7WebCoreL14createResourceENS_14CachedResource4TypeERKNS_4KURLERKNS_6StringE
+__ZN7WebCore19CachedCSSStyleSheetC1ERKNS_6StringES3_
+__ZN7WebCore19CachedCSSStyleSheetC2ERKNS_6StringES3_
+__ZN7WebCore14CachedResourceC2ERKNS_6StringENS0_4TypeE
+__ZN7WebCore14CachedResource4loadEPNS_9DocLoaderE
+__ZN7WebCore14CachedResource4loadEPNS_9DocLoaderEbbb
+__ZN7WebCore6Loader4loadEPNS_9DocLoaderEPNS_14CachedResourceEbbb
+__ZN7WebCore7RequestC1EPNS_9DocLoaderEPNS_14CachedResourceEbbb
+__ZN7WebCore7RequestC2EPNS_9DocLoaderEPNS_14CachedResourceEbbb
+__ZN7WebCore14CachedResource10setRequestEPNS_7RequestE
+__ZN7WebCore4KURLC1ERKNS_6StringE
+__ZN7WebCore4KURLC2ERKNS_6StringE
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_6Loader4HostENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3getERKS3_
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_6Loader4HostENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3addERKS3_RKS6
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_6Loader4HostEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_
+__ZNK7WebCore6Loader17determinePriorityEPKNS_14CachedResourceE
+__ZN7WebCore6Loader4Host10addRequestEPNS_7RequestENS0_8PriorityE
+__ZN3WTF5DequeIPN7WebCore7RequestEE14expandCapacityEv
+__ZN7WebCore9DocLoader21incrementRequestCountEv
+__ZN7WebCore6Loader4Host20servePendingRequestsENS0_8PriorityE
+__ZN7WebCore6Loader4Host20servePendingRequestsERN3WTF5DequeIPNS_7RequestEEERb
+__ZN7WebCore17SubresourceLoader6createEPNS_5FrameEPNS_23SubresourceLoaderClientERKNS_15ResourceRequestEbbb
+__ZNK7WebCore11FrameLoader16outgoingReferrerEv
+__ZN7WebCore11FrameLoader18shouldHideReferrerERKNS_4KURLERKNS_6StringE
+__ZN7WebCore10protocolIsERKNS_6StringEPKc
+__ZNK7WebCore11FrameLoader14outgoingOriginEv
+__ZNK7WebCore14SecurityOrigin8toStringEv
+__ZNK7WebCore19ResourceRequestBase13isConditionalEv
+__ZNK3WTF9HashTableIN7WebCore12AtomicStringESt4pairIS2_NS1_6StringEENS_18PairFirstExtractorIS5_EENS1_15CaseFoldingHashENS_14Pai
+__ZNK7WebCore11FrameLoader15originalRequestEv
+__ZN7WebCore19ResourceRequestBase14setCachePolicyENS_26ResourceRequestCachePolicyE
+__ZN7WebCore11FrameLoader34addExtraFieldsToSubresourceRequestERNS_15ResourceRequestE
+__ZNK7WebCore11FrameLoader8encodingEv
+__ZN7WebCore17SubresourceLoaderC1EPNS_5FrameEPNS_23SubresourceLoaderClientEbb
+__ZN7WebCore17SubresourceLoaderC2EPNS_5FrameEPNS_23SubresourceLoaderClientEbb
+__ZN7WebCore14DocumentLoader20addSubresourceLoaderEPNS_14ResourceLoaderE
+__ZN3WTF7HashSetINS_6RefPtrIN7WebCore14ResourceLoaderEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN7WebCore14ResourceLoader4loadERKNS_15ResourceRequestE
+__ZN7WebCore17SubresourceLoader15willSendRequestERNS_15ResourceRequestERKNS_16ResourceResponseE
+__ZN7WebCore11FrameLoader32assignIdentifierToInitialRequestEmRKNS_15ResourceRequestE
+__ZN7WebCore14DocumentLoader19scheduleArchiveLoadEPNS_14ResourceLoaderERKNS_15ResourceRequestERKNS_4KURLE
+__ZNK7WebCore14DocumentLoader21archiveResourceForURLERKNS_4KURLE
+__ZN7WebCore14DocumentLoader28scheduleApplicationCacheLoadEPNS_14ResourceLoaderERKNS_15ResourceRequestERKNS_4KURLE
+__ZN7WebCore14DocumentLoader38shouldLoadResourceFromApplicationCacheERKNS_15ResourceRequestERPNS_24ApplicationCacheResourceE
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore17SubresourceLoaderEEEPNS2_7RequestENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3addE
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore17SubresourceLoaderEEESt4pairIS4_PNS2_7RequestEENS_18PairFirstExtractorIS8_EENS_7PtrHash
+__ZN3WTF7HashMapIN7WebCore6StringEPNS1_14CachedResourceENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_14CachedResourceEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHa
+__ZN7WebCore5Cache16resourceAccessedEPNS_14CachedResourceE
+__ZN7WebCore5Cache17removeFromLRUListEPNS_14CachedResourceE
+__ZNK7WebCore14CachedResource12overheadSizeEv
+__ZN7WebCore5Cache10adjustSizeEbi
+__ZN7WebCore5Cache15insertInLRUListEPNS_14CachedResourceE
+__ZN7WebCore5Cache10lruListForEPNS_14CachedResourceE
+__ZN3WTF6VectorIN7WebCore5Cache7LRUListELm32EE4growEm
+__ZN3WTF7HashMapIN7WebCore6StringENS1_20CachedResourceHandleINS1_14CachedResourceEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_I
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_20CachedResourceHandleINS1_14CachedResourceEEEENS_18PairFirstExtractorIS7_EE
+__ZN7WebCore24CachedResourceHandleBase11setResourceEPNS_14CachedResourceE
+__ZN7WebCore9DocLoader22checkCacheObjectStatusEPNS_14CachedResourceE
+__ZNK7WebCore9DocLoader5frameEv
+__ZN7WebCore19CachedCSSStyleSheet9addClientEPNS_20CachedResourceClientE
+__ZN7WebCore14CachedResource9addClientEPNS_20CachedResourceClientE
+__ZN7WebCore5Cache22addToLiveResourcesSizeEPNS_14CachedResourceE
+__ZN3WTF7HashMapIPN7WebCore20CachedResourceClientEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
+__ZN7WebCore10StyleSheet8setMediaEN3WTF10PassRefPtrINS_9MediaListEEE
 __ZNK7WebCore11HTMLElement5titleEv
 __ZN7WebCore13CSSStyleSheet11checkLoadedEv
 __ZN7WebCore13CSSStyleSheet9isLoadingEv
+__ZN7WebCore13CSSImportRule12isImportRuleEv
+__ZNK7WebCore13CSSImportRule9isLoadingEv
+__ZN7WebCore12StyleElement5sheetEPNS_7ElementE
+__ZN7WebCore9CSSParser18parseFillShorthandEiPKiib
+__ZN7WebCore9CSSParser12addFillValueERN3WTF6RefPtrINS_8CSSValueEEENS1_10PassRefPtrIS3_EE
+__ZN7WebCore9CSSParser17parseFillPositionERN3WTF6RefPtrINS_8CSSValueEEES5_
+__ZN7WebCore9CSSParser19parseFillPositionXYERbS1_
+__ZN7WebCore9CSSParser20parseBackgroundColorEv
 __ZN7WebCore9StyleBase12isImportRuleEv
 __ZN7WebCore16HTMLStyleElement11sheetLoadedEv
 __ZNK7WebCore16HTMLStyleElement9isLoadingEv
 __ZN7WebCore8Document18removePendingSheetEv
-__ZN7WebCore8Document19updateStyleSelectorEv
-__ZN7WebCore8Document19recalcStyleSelectorEv
-__ZN7WebCore21DeprecatedPtrListImplC2ERKS0_
-__ZNK7WebCore8Document8nodeTypeEv
-__ZNK7WebCore4Node17virtualFirstChildEv
+__ZNK7WebCore15HTMLLinkElement9isLoadingEv
+__ZNK7WebCore15HTMLLinkElement5sheetEv
 __ZN7WebCore16HTMLStyleElement5sheetEv
-__ZN7WebCore12StyleElement5sheetEPNS_7ElementE
-__ZN7WebCore21DeprecatedPtrListImpl6appendEPKv
-__ZN7WebCore19MediaQueryEvaluatorC2ERKNS_6StringEPNS_4PageEPNS_11RenderStyleE
-__ZNK7WebCore18StyleInheritedDataeqERKS0_
-__ZNK7WebCore12RenderObject12isListMarkerEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10StyleSheetEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10StyleSheetEEELm0EE15reserveCapacityEm
+__ZN7WebCore19MediaQueryEvaluatorC1ERKNS_6StringEPNS_5FrameEPNS_11RenderStyleE
+__ZN7WebCore19MediaQueryEvaluatorC2ERKNS_6StringEPNS_5FrameEPNS_11RenderStyleE
+__ZN7WebCore14StyleSheetList4itemEj
+__ZN7WebCore9StyleBase11isStyleRuleEv
 __ZN7WebCore7Element11recalcStyleENS_4Node11StyleChangeE
 __ZNK7WebCore12StyleBoxDataeqERKS0_
-__ZN7WebCore4Node14setRenderStyleEPNS_11RenderStyleE
+__ZN7WebCore4Node14setRenderStyleEN3WTF10PassRefPtrINS_11RenderStyleEEE
 __ZN7WebCore12RenderObject7repaintEb
-__ZNK7WebCore10RenderView8printingEv
-__ZN7WebCore10RenderFlow27absoluteClippedOverflowRectEv
-__ZNK7WebCore11RenderBlock12isInlineFlowEv
-__ZN7WebCore9RenderBox27absoluteClippedOverflowRectEv
+__ZN7WebCore12RenderObject8isRootedEPPNS_10RenderViewE
+__ZNK7WebCore12RenderObject19containerForRepaintEv
+__ZN7WebCore9RenderBox29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
 __ZNK7WebCore11RenderBlock12overflowRectEb
 __ZNK7WebCore11RenderBlock12overflowLeftEb
-__ZNK7WebCore12RenderObject14borderTopExtraEv
 __ZNK7WebCore11RenderBlock11overflowTopEb
-__ZNK7WebCore9RenderBox6heightEv
-__ZNK7WebCore12RenderObject17borderBottomExtraEv
 __ZNK7WebCore11RenderBlock14overflowHeightEb
 __ZNK7WebCore11RenderBlock13overflowWidthEb
-__ZN7WebCore10RenderView26computeAbsoluteRepaintRectERNS_7IntRectEb
-__ZN7WebCore10RenderView20repaintViewRectangleERKNS_7IntRectEb
-__ZNK7WebCore12RenderObject23createsAnonymousWrapperEv
-__ZN7WebCore4Text11recalcStyleENS_4Node11StyleChangeE
-__ZNK7WebCore4Node12isShadowNodeEv
-__ZN7WebCore13HTMLTokenizer35executeScriptsWaitingForStylesheetsEv
-__ZN7WebCore16HTMLStyleElement21finishParsingChildrenEv
+__ZN7WebCore10RenderView21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZN7WebCore12RenderObject21repaintUsingContainerEPNS_20RenderBoxModelObjectERKNS_7IntRectEb
+__ZNK7WebCore7Comment8nodeTypeEv
+__ZN7WebCoreL17scriptConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLScriptElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore17HTMLScriptElementC2ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore17ScriptElementDataC1EPNS_13ScriptElementEPNS_7ElementE
+__ZN7WebCore17ScriptElementDataC2EPNS_13ScriptElementEPNS_7ElementE
+__ZN7WebCore17HTMLScriptElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore17HTMLScriptElement17endTagRequirementEv
+__ZNK7WebCore17HTMLScriptElement11tagPriorityEv
+__ZN7WebCore17HTMLScriptElement20insertedIntoDocumentEv
+__ZNK7WebCore17HTMLScriptElement20sourceAttributeValueEv
+__ZN7WebCore13ScriptElement20insertedIntoDocumentERNS_17ScriptElementDataERKNS_6StringE
+__ZNK7WebCore17HTMLScriptElement13scriptCharsetEv
+__ZNK7WebCore17ScriptElementData13scriptCharsetEv
+__ZThn112_NK7WebCore17HTMLScriptElement21charsetAttributeValueEv
+__ZNK7WebCore17HTMLScriptElement21charsetAttributeValueEv
+__ZN7WebCore13HTMLTokenizer13scriptHandlerENS0_5StateE
+__ZNK7WebCore17HTMLScriptElement25shouldExecuteAsJavaScriptEv
+__ZNK7WebCore17ScriptElementData25shouldExecuteAsJavaScriptEv
+__ZThn112_NK7WebCore17HTMLScriptElement18typeAttributeValueEv
+__ZNK7WebCore17HTMLScriptElement18typeAttributeValueEv
+__ZN7WebCore16MIMETypeRegistry29isSupportedJavaScriptMIMETypeERKNS_6StringE
+__ZN7WebCore13HTMLTokenizer13enlargeBufferEi
+__ZN7WebCore10HTMLParser20textCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore17HTMLScriptElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore17HTMLScriptElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore13ScriptElement15childrenChangedERNS_17ScriptElementDataE
+__ZNK7WebCore4Node11textContentEb
+__ZNK7WebCore4Node17appendTextContentEbRNS_13StringBuilderE
+__ZN7WebCore13StringBuilder6appendERKNS_6StringE
+__ZNK7WebCore13StringBuilder8toStringEv
+__ZN3WTF6VectorIN7WebCore6StringELm16EE6shrinkEm
+__ZN7WebCore17HTMLScriptElement21finishParsingChildrenEv
+__ZN7WebCore13ScriptElement21finishParsingChildrenERNS_17ScriptElementDataERKNS_6StringE
+__ZNK7WebCore17ScriptElementData13scriptContentEv
+__ZN7WebCore15SegmentedString7prependERKS0_
+__ZN7WebCore15SegmentedString7prependERKNS_18SegmentedSubstringE
+__ZNK7WebCore6StringcvN3JSC7UStringEEv
+__ZNK7WebCore20StringSourceProvider6lengthEv
+__ZN7WebCore13HTMLTokenizer15scriptExecutionERKNS_16ScriptSourceCodeENS0_5StateE
+__ZN7WebCore11FrameLoader13executeScriptERKNS_16ScriptSourceCodeE
+__ZN7WebCore16ScriptController8evaluateERKNS_16ScriptSourceCodeE
+__ZN7WebCore16ScriptController10initScriptEv
+__ZN7WebCore16JSDOMWindowShellnwEm
+__ZN7WebCore15JSDOMWindowBase18commonJSGlobalDataEv
+__ZN7WebCore16JSDOMWindowShellC1EN3WTF10PassRefPtrINS_9DOMWindowEEE
+__ZN7WebCore16JSDOMWindowShellC2EN3WTF10PassRefPtrINS_9DOMWindowEEE
+__ZN7WebCore16JSDOMWindowShell9setWindowEN3WTF10PassRefPtrINS_9DOMWindowEEE
+__ZN7WebCore20JSDOMWindowPrototypenwEm
+__ZN7WebCore11JSDOMWindowC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9DOMWindowEEEPNS_16JSDOMWindowShellE
+__ZN7WebCore11JSDOMWindowC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9DOMWindowEEEPNS_16JSDOMWindowShellE
+__ZN7WebCore15JSDOMWindowBaseC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9DOMWindowEEEPNS_16JSDOMWindowShellE
+__ZN7WebCore15JSDOMWindowBase19JSDOMWindowBaseDataC1EN3WTF10PassRefPtrINS_9DOMWindowEEEPNS_16JSDOMWindowShellE
+__ZN7WebCore15JSDOMWindowBase19JSDOMWindowBaseDataC2EN3WTF10PassRefPtrINS_9DOMWindowEEEPNS_16JSDOMWindowShellE
+__ZN7WebCore17JSDOMGlobalObject21JSDOMGlobalObjectDataC2Ev
+__ZN7WebCore17JSDOMGlobalObjectC2EN3WTF10PassRefPtrIN3JSC9StructureEEEPNS0_21JSDOMGlobalObjectDataEPNS3_8JSObjectE
+__ZN7WebCore15JSDOMWindowBase10globalExecEv
+__ZN7WebCore5Frame9keepAliveEv
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEENS2_16SymbolTableEntryENS2_17IdentifierRepHashENS_10HashTraitsIS5_EENS2_26Symbo
+__ZN7WebCore15JSDOMWindowBase14updateDocumentEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_4NodeE
+__ZN7WebCore23getCachedDOMNodeWrapperEPNS_8DocumentEPNS_4NodeE
+__ZNK3WTF7HashMapIPN7WebCore4NodeEPNS1_6JSNodeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
+__ZNK7WebCore8Document8nodeTypeEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8DocumentE
+__ZN7WebCore25getCachedDOMObjectWrapperERN3JSC12JSGlobalDataEPv
+__ZNK3WTF7HashMapIPvPN7WebCore9DOMObjectENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS7_IS4_EEE3getERKS1_
+__ZN7WebCore21getCachedDOMStructureEPNS_17JSDOMGlobalObjectEPKN3JSC9ClassInfoE
+__ZNK3WTF7HashMapIPKN3JSC9ClassInfoENS_6RefPtrINS1_9StructureEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENSA_IS7_EEE3getERKS4_
+__ZN7WebCore14JSHTMLDocument15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSDocumentPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSDocument15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSNodePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore6JSNode15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17cacheDOMStructureEPNS_17JSDOMGlobalObjectEN3WTF10PassRefPtrIN3JSC9StructureEEEPKNS4_9ClassInfoE
+__ZN3WTF7HashMapIPKN3JSC9ClassInfoENS_6RefPtrINS1_9StructureEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENSA_IS7_EEE3setERKS4_RKS7_
+__ZN3WTF9HashTableIPKN3JSC9ClassInfoESt4pairIS4_NS_6RefPtrINS1_9StructureEEEENS_18PairFirstExtractorIS9_EENS_7PtrHashIS4_EENS_1
+__ZN7WebCore14JSHTMLDocumentC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12HTMLDocumentEEE
+__ZN7WebCore14JSHTMLDocumentC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12HTMLDocumentEEE
+__ZN7WebCore10JSDocumentC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8DocumentEEE
+__ZN7WebCore6JSNodeC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4NodeEEE
+__ZN7WebCore21cacheDOMObjectWrapperERN3JSC12JSGlobalDataEPvPNS_9DOMObjectE
+__ZN3WTF7HashMapIPvPN7WebCore9DOMObjectENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS7_IS4_EEE3setERKS1_RKS4_
+__ZN3WTF9HashTableIPvSt4pairIS1_PN7WebCore9DOMObjectEENS_18PairFirstExtractorIS6_EENS_7PtrHashIS1_EENS_14PairHashTraitsINS_10Ha
+__ZN7WebCore16ScriptController14attachDebuggerEPN3JSC8DebuggerE
+__ZN7WebCore16ScriptController18windowScriptObjectEv
+__ZN7WebCore16ScriptController17bindingRootObjectEv
+__ZN3JSC8Bindings10RootObject6createEPKvPNS_14JSGlobalObjectE
+__ZN3JSC8Bindings10RootObjectC1EPKvPNS_14JSGlobalObjectE
+__ZN3JSC8Bindings10RootObjectC2EPKvPNS_14JSGlobalObjectE
+__ZN3JSC8BindingsL13rootObjectSetEv
+__ZN3WTF7HashSetIPN3JSC8Bindings10RootObjectENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableIPN3JSC8Bindings10RootObjectES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6expand
+__ZN3WTF9HashTableIPN3JSC8Bindings10RootObjectES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6rehash
+__ZN3WTF9HashTableIPN3JSC8Bindings10RootObjectES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E13alloc
+__ZN3WTF9HashTableIPN3JSC8Bindings10RootObjectES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E15deall
++[WebScriptObject initialize]
++[WebScriptObject scriptObjectForJSObject:originRootObject:rootObject:]
+__Z16createDOMWrapperPN3JSC8JSObjectEN3WTF10PassRefPtrINS_8Bindings10RootObjectEEES6_
+__ZNK7WebCore16JSDOMWindowShell9classInfoEv
+__ZNK7WebCore16JSDOMWindowShell4implEv
+__Z3kitPN7WebCore9DOMWindowE
+__Z13getDOMWrapperP17DOMObjectInternal
+-[WebScriptObject(WebScriptObjectInternal) _init]
+__Z13addDOMWrapperP8NSObjectP17DOMObjectInternal
+__Z18createWrapperCachev
+-[WebScriptObject _hasImp]
+-[WebScriptObject _setImp:originRootObject:rootObject:]
+__ZN7WebCore12addJSWrapperEP8NSObjectPN3JSC8JSObjectE
+__ZN3JSC8Bindings10RootObject9gcProtectEPNS_8JSObjectE
+__ZNK3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTra
+__ZN3WTF7HashMapIPN3JSC8JSObjectEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
+__ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTrai
+__ZN7WebCore19InspectorController34inspectedWindowScriptObjectClearedEPNS_5FrameE
+__ZN7WebCore6StringC1ERKN3JSC7UStringE
+__ZN7WebCore6StringC2ERKN3JSC7UStringE
+__ZNK7WebCore20StringSourceProvider4dataEv
+__ZNK7WebCore15JSDOMWindowBase17supportsProfilingEv
+__ZN7WebCore16JSDOMWindowShell18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore11JSDOMWindow18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore15JSDOMWindowBase18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore12AtomicString3addERKN3JSC10IdentifierE
+__ZN3WTF7HashSetIPN7WebCore10StringImplENS1_10StringHashENS_10HashTraitsIS3_EEE3addINS1_17HashAndCharactersENS1_27HashAndCharac
+__ZNK7WebCore9FrameTree5childERKNS_12AtomicStringE
+__ZN7WebCore20JSDOMWindowPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore15JSDOMWindowBase12toThisObjectEPN3JSC9ExecStateE
+__ZNK7WebCore15JSDOMWindowBase5shellEv
+__ZN7WebCore44jsDOMWindowPrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13toJSDOMWindowEN3JSC7JSValueE
+__ZN7WebCore11JSDOMWindow16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore17JSDOMGlobalObject27findOrCreateJSEventListenerEN3JSC7JSValueE
+__ZN7WebCore17JSDOMGlobalObject19findJSEventListenerEN3JSC7JSValueE
+__ZNK3WTF7HashMapIPN3JSC8JSObjectEPN7WebCore15JSEventListenerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3getERKS3_
+__ZN7WebCore15JSEventListenerC1EPN3JSC8JSObjectEPNS_17JSDOMGlobalObjectEb
+__ZN7WebCore15JSEventListenerC2EPN3JSC8JSObjectEPNS_17JSDOMGlobalObjectEb
+__ZN7WebCore17JSDOMGlobalObject16jsEventListenersEv
+__ZN3WTF7HashMapIPN3JSC8JSObjectEPN7WebCore15JSEventListenerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3setERKS3_RKS6_
+__ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_PN7WebCore15JSEventListenerEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3_EENS_14P
+__ZN7WebCore12AtomicString3addERKN3JSC7UStringE
+__ZN7WebCore9DOMWindow16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZN7WebCore9DOMWindow19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
+__ZN7WebCore8Document23addListenerTypeIfNeededERKNS_12AtomicStringE
+__ZN7WebCore23RegisteredEventListenerC1ERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZN7WebCore23RegisteredEventListenerC2ERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EE15reserveCapacityEm
+__ZN7WebCore15SegmentedString6appendERKS0_
+__ZN7WebCore15SegmentedString6appendERKNS_18SegmentedSubstringE
 __ZN7WebCore10HTMLParser20bodyCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore10HTMLParser10createHeadEv
 __ZN7WebCore10HTMLParser9startBodyEv
-__ZN7WebCore15bodyConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore15HTMLBodyElementC2EPNS_8DocumentE
+__ZN7WebCoreL15bodyConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore15HTMLBodyElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLBodyElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZNK7WebCore15HTMLBodyElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore13StyledElement22getMappedAttributeDeclENS_20MappedAttributeEntryEPNS_9AttributeE
 __ZN7WebCore15HTMLBodyElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore13StyledElement11addCSSColorEPNS_15MappedAttributeEiRKNS_6StringE
-__ZN7WebCore13StyledElement16createMappedDeclEPNS_15MappedAttributeE
-__ZN7WebCore26CSSMutableStyleDeclarationC2EPNS_7CSSRuleE
-__ZN7WebCore8Document12elementSheetEv
-__ZN7WebCore26CSSMutableStyleDeclaration11setPropertyEiRKNS_6StringEbbRi
-__ZN7WebCore9CSSParser10parseValueEPNS_26CSSMutableStyleDeclarationEiRKNS_6StringEb
-__ZN7WebCore9StyleBase10stylesheetEv
-__ZNK7WebCore9StyleBase12isStyleSheetEv
-__ZNK7WebCore10StyleSheet12isStyleSheetEv
-__ZN7WebCore26CSSMutableStyleDeclaration19addParsedPropertiesEPKPKNS_11CSSPropertyEi
-__ZNK7WebCore26CSSMutableStyleDeclaration19getPropertyPriorityEi
-__ZN7WebCore26CSSMutableStyleDeclaration14removePropertyEibbRi
-__ZZN7WebCore16initShorthandMapERN3WTF7HashMapIiNS_16PropertyLonghandENS0_7IntHashIjEENS0_10HashTraitsIiEENS5_IS2_EEEEE21borderColorProperties
-__ZNK3WTF7HashMapIiN7WebCore16PropertyLonghandENS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3getERKi
-__ZN3WTF9HashTableIiSt4pairIiN7WebCore16PropertyLonghandEENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E3addIiS3_NS_17HashMapTranslatorILb1ES4_NS_18PairBaseHashTraitsISB_SC_EESD_S8_EEEES1_INS_17HashTableIteratorIiS4_S6_S8_SD_SB_EEbERKT_RKT0_
-__ZN3WTF9HashTableIiSt4pairIiN7WebCore16PropertyLonghandEENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E6expandEv
-__ZN7WebCore23DeprecatedValueListImpl8fromLastEv
-__ZN7WebCore23DeprecatedValueListImpl8lastNodeEv
-__ZNK7WebCore23DeprecatedValueListImpl8lastNodeEv
-__ZN7WebCore26CSSMutableStyleDeclaration10setChangedENS_15StyleChangeTypeE
-__ZN7WebCore13StyledElement22setMappedAttributeDeclENS_20MappedAttributeEntryEPNS_9AttributeEPNS_29CSSMappedAttributeDeclarationE
-__ZNK3WTF7HashMapIN7WebCore18MappedAttributeKeyEPNS1_29CSSMappedAttributeDeclarationENS1_19MappedAttributeHashENS1_24MappedAttributeKeyTraitsENS_10HashTraitsIS4_EEE3getERKS2_
-__ZN3WTF9HashTableIN7WebCore18MappedAttributeKeyESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_19MappedAttributeHashENS_14PairHashTraitsINS1_24MappedAttributeKeyTraitsENS_10HashTraitsIiEEEES9_E3addIS2_PNS1_29CSSMappedAttributeDeclarationENS_17HashMapTranslatorILb1ES3_IS2_SG_ENS_18PairBaseHashTraitsIS9_NSA_ISG_EEEESC_S7_EEEES3_INS_17HashTableIteratorIS2_S4_S6_S7_SC_S9_EEbERKT_RKT0_
-__ZN3WTF9HashTableIN7WebCore18MappedAttributeKeyESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_19MappedAttributeHashENS_14PairHashTraitsINS1_24MappedAttributeKeyTraitsENS_10HashTraitsIiEEEES9_E6expandEv
-__ZN7WebCore19MappedAttributeHash4hashERKNS_18MappedAttributeKeyE
-__ZN7WebCore13StyledElement12addCSSLengthEPNS_15MappedAttributeEiRKNS_6StringE
-__ZN7WebCore26CSSMutableStyleDeclaration17setLengthPropertyEiRKNS_6StringEbb
+__ZN7WebCore13StyledElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore13StyledElement18getInlineStyleDeclEv
+__ZN7WebCore13StyledElement21createInlineStyleDeclEv
+__ZN7WebCore26CSSMutableStyleDeclarationC1Ev
+__ZN7WebCore26CSSMutableStyleDeclarationC2Ev
+__ZN7WebCore26CSSMutableStyleDeclaration16parseDeclarationERKNS_6StringE
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EE14shrinkCapacityEm
+__ZN7WebCore9CSSParser16parseDeclarationEPNS_26CSSMutableStyleDeclarationERKNS_6StringE
+__ZN7WebCore13StyledElement24invalidateStyleAttributeEv
 __ZNK7WebCore15HTMLBodyElement17endTagRequirementEv
 __ZNK7WebCore15HTMLBodyElement11tagPriorityEv
 __ZN7WebCore15HTMLBodyElement20insertedIntoDocumentEv
-__ZNK7WebCore8Document12ownerElementEv
-__ZN7WebCore8Document18minimumLayoutDelayEv
-__ZNK7WebCore8Document11elapsedTimeEv
-__ZN7WebCore9TimerBase5startEdd
-__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE15reserveCapacityEm
-__ZN7WebCore9TimerBase15heapDecreaseKeyEv
-__ZSt11__push_heapIN7WebCore17TimerHeapIteratorEiNS0_16TimerHeapElementEEvT_T0_S4_T1_
-__ZN7WebCore17updateSharedTimerEv
-__ZN7WebCore22setSharedTimerFireTimeEd
--[WebCorePowerNotifier init]
-__ZN7WebCore16CSSStyleSelector24canShareStyleWithElementEPNS_4NodeE
-__ZNK7WebCore18NamedMappedAttrMap19hasMappedAttributesEv
-__ZNK7WebCore9StyleBase16isPrimitiveValueEv
+__ZN7WebCore11HTMLElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore11HTMLElement15inEitherTagListEPKNS_4NodeE
+__ZN7WebCore10HTMLParser23pCloserCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCoreL14divConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore14HTMLDivElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14HTMLDivElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore7Element8updateIdERKNS_12AtomicStringES3_
+__ZNK7WebCore14HTMLDivElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore14HTMLDivElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore14HTMLDivElement17endTagRequirementEv
+__ZNK7WebCore14HTMLDivElement11tagPriorityEv
+__ZN7WebCoreL13inlineTagListEv
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findI
+__ZN7WebCoreL12blockTagListEv
+__ZN7WebCore8Document14addElementByIdERKNS_12AtomicStringEPNS_7ElementE
+__ZNK3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraits
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_7ElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3addERKS3_RKS5_
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_7ElementEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14Pa
+__ZN7WebCore13StyledElement21classAttributeChangedERKNS_12AtomicStringE
+__ZN7WebCore18NamedMappedAttrMap8setClassERKNS_6StringE
+__ZN7WebCore4Node28dispatchSubtreeModifiedEventEv
+__ZN7WebCore4Node31notifyNodeListsAttributeChangedEv
+__ZN7WebCore4Node36notifyLocalNodeListsAttributeChangedEv
+__ZN3WTF6VectorIN7WebCore14CSSParserValueELm4EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore14CSSParserValueELm4EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore14CSSParserValueELm4EE15reserveCapacityEm
+__ZN7WebCore15FontFamilyValueC1ERKNS_6StringE
+__ZN7WebCore15FontFamilyValueC2ERKNS_6StringE
+__ZN7WebCore6String8truncateEj
+__ZN7WebCoreL16imageConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLImageElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore16HTMLImageElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore15HTMLImageLoaderC1EPNS_7ElementE
+__ZN7WebCore15HTMLImageLoaderC2EPNS_7ElementE
+__ZN7WebCore11ImageLoaderC2EPNS_7ElementE
+__ZNK7WebCore16HTMLImageElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore16HTMLImageElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore11ImageLoader38updateFromElementIgnoringPreviousErrorEv
+__ZN7WebCore11ImageLoader17updateFromElementEv
+__ZNK7WebCore7Element24imageSourceAttributeNameEv
+__ZNK7WebCore15HTMLImageLoader9sourceURIERKNS_12AtomicStringE
+__ZN7WebCore9DocLoader12requestImageERKNS_6StringE
+__ZN7WebCore11CachedImageC1ERKNS_6StringE
+__ZN7WebCore11CachedImageC2ERKNS_6StringE
+__ZN7WebCore11CachedImage4loadEPNS_9DocLoaderE
+__ZN7WebCore11ImageLoader15setLoadingImageEPNS_11CachedImageE
+__ZN7WebCore11CachedImage9addClientEPNS_20CachedResourceClientE
+__ZNK3WTF7HashMapIN7WebCore18MappedAttributeKeyEPNS1_29CSSMappedAttributeDeclarationENS1_19MappedAttributeHashENS1_24MappedAttr
+__ZN7WebCore13StyledElement12addCSSLengthEPNS_15MappedAttributeEiRKNS_6StringE
+__ZN7WebCore26CSSMutableStyleDeclaration17setLengthPropertyEiRKNS_6StringEbb
+__ZNK7WebCore16HTMLImageElement17endTagRequirementEv
+__ZNK7WebCore16HTMLImageElement11tagPriorityEv
+__ZN7WebCore16HTMLImageElement20insertedIntoDocumentEv
+__ZN7WebCore12HTMLDocument12addNamedItemERKNS_12AtomicStringE
+__ZN7WebCoreL12addItemToMapERN3WTF7HashMapIPNS_16AtomicStringImplEiNS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EENS6_IiEEEERKNS_12Ato
+__ZN7WebCore12HTMLDocument17addExtraNamedItemERKNS_12AtomicStringE
+__ZN7WebCore16HTMLImageElement6attachEv
+__ZN7WebCore10HTMLParser22nestedCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCoreL17anchorConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLAnchorElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17HTMLAnchorElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17HTMLAnchorElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore11prefetchDNSERKNS_6StringE
+__ZNK7WebCore4Page24javaScriptURLsAreAllowedEv
+__ZNK7WebCore17HTMLAnchorElement17endTagRequirementEv
+__ZNK7WebCore17HTMLAnchorElement11tagPriorityEv
+__ZN7WebCore10HTMLParser27nestedStyleCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore10HTMLParser23allowNestedRedundantTagERKNS_12AtomicStringE
+__ZN7WebCore11HTMLElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL13brConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore13HTMLBRElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore13HTMLBRElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore13HTMLBRElement17endTagRequirementEv
+__ZNK7WebCore13HTMLBRElement11tagPriorityEv
+__ZN7WebCore13HTMLTokenizer11parseEntityERNS_15SegmentedStringERPtNS0_5StateERjbb
+__ZN7WebCoreL20encodeRelativeStringERKNS_6StringERKNS_12TextEncodingERN3WTF6VectorIcLm512EEE
+__ZN3WTF6VectorItLm512EE14shrinkCapacityEm
+__ZN7WebCoreL11findFirstOfEPKtiiPKc
+__ZN3WTF6VectorItLm512EE6appendItEEvPKT_m
+__ZN7WebCoreL21appendEncodedHostnameERN3WTF6VectorItLm512EEEPKtj
+__ZN7WebCore12TextCodecICU6encodeEPKtmNS_19UnencodableHandlingE
+__ZN7WebCore7CStringC1EPKcj
+__ZN7WebCore7CStringC2EPKcj
+__ZN7WebCore7CString4initEPKcj
+__ZN7WebCore12TextCodecICUD0Ev
+__ZNK7WebCore12TextCodecICU19releaseICUConverterEv
+__ZN7WebCoreL18headingConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore18HTMLHeadingElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore18HTMLHeadingElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore18HTMLHeadingElement17endTagRequirementEv
+__ZNK7WebCore18HTMLHeadingElement11tagPriorityEv
+__ZN7WebCoreL16labelConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLLabelElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLLabelElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore16HTMLLabelElement11tagPriorityEv
+__ZN7WebCore18HTMLHeadingElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore10HTMLParser20formCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore15HTMLFormElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLFormElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15FormDataBuilderC1Ev
+__ZN7WebCore15FormDataBuilderC2Ev
+__ZN7WebCore15HTMLFormElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore15HTMLFormElement17endTagRequirementEv
+__ZNK7WebCore15HTMLFormElement11tagPriorityEv
+__ZN7WebCore15HTMLFormElement20insertedIntoDocumentEv
+__ZN7WebCore15HTMLFormElement6attachEv
+__ZN7WebCoreL19fieldsetConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore19HTMLFieldSetElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore19HTMLFieldSetElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore22HTMLFormControlElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore15HTMLFormElement19registerFormElementEPNS_22HTMLFormControlElementE
+__ZN7WebCore19CheckedRadioButtons12removeButtonEPNS_22HTMLFormControlElementE
+__ZNK7WebCore22HTMLFormControlElement15formControlNameEv
+__ZN7WebCore19CheckedRadioButtons9addButtonEPNS_22HTMLFormControlElementE
+__ZNK7WebCore22HTMLFormControlElement13isRadioButtonEv
+__ZN7WebCore15HTMLFormElement16formElementIndexEPNS_22HTMLFormControlElementE
+__ZN3WTF6VectorIPN7WebCore22HTMLFormControlElementELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore22HTMLFormControlElementELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore22HTMLFormControlElementELm0EE15reserveCapacityEm
+__ZN7WebCore22HTMLFormControlElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore22HTMLFormControlElement17endTagRequirementEv
+__ZNK7WebCore19HTMLFieldSetElement11tagPriorityEv
+__ZN7WebCore22HTMLFormControlElement16insertedIntoTreeEb
+__ZN7WebCore22HTMLFormControlElement6attachEv
+__ZNK7WebCore22HTMLFormControlElement9autofocusEv
+__ZNK7WebCore7Element12hasAttributeERKNS_13QualifiedNameE
+__ZNK7WebCore7Element14hasAttributeNSERKNS_6StringES3_
+__ZNK7WebCore7Element10attributesEb
+__ZN7WebCore19HTMLFieldSetElement8checkDTDEPKNS_4NodeE
+__ZN7WebCoreL16inputConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLInputElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore16HTMLInputElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore31HTMLFormControlElementWithStateC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN3WTF11ListHashSetIPN7WebCore7ElementENS_7PtrHashIS3_EEE3addERKS3_
+__ZN3WTF11ListHashSetIPN7WebCore7ElementENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
+__ZN7WebCore16InputElementDataC1EPNS_12InputElementEPNS_7ElementE
+__ZN7WebCore16InputElementDataC2EPNS_12InputElementEPNS_7ElementE
+__ZNK7WebCore16HTMLInputElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore16HTMLInputElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore16HTMLInputElement12setInputTypeERKNS_6StringE
+__ZNK7WebCore16HTMLInputElement15formControlNameEv
+__ZNK7WebCore16InputElementData4nameEv
+__ZNK7WebCore16HTMLInputElement13isRadioButtonEv
+__ZN7WebCore12InputElement18parseSizeAttributeERNS_16InputElementDataEPNS_15MappedAttributeE
+__ZNK7WebCore6String5toIntEPb
+__ZN7WebCore10StringImpl5toIntEPb
+__ZN7WebCore15charactersToIntEPKtmPb
+__ZN7WebCoreL27lengthOfCharactersAsIntegerEPKtm
+__ZN7WebCoreL24isCharacterAllowedInBaseEti
+__ZNK7WebCore16HTMLInputElement17endTagRequirementEv
+__ZNK7WebCore16HTMLInputElement11tagPriorityEv
+__ZN7WebCore16HTMLInputElement6attachEv
+__ZNK7WebCore16HTMLInputElement17isInputTypeHiddenEv
+__ZN7WebCore31HTMLFormControlElementWithState21finishParsingChildrenEv
+__ZNK7WebCore8Document26hasStateForNewFormElementsEv
+__ZN7WebCore10HTMLParser22selectCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCoreL17selectConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLSelectElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore17HTMLSelectElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore17HTMLSelectElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore28createAttributeEventListenerEPNS_4NodeEPNS_9AttributeE
+__ZN7WebCore19createJSHTMLWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPFPNS1_6JSNodeEPN3JSC9ExecStateENS_10PassRefPtrINS1_11HTMLElementEEEENS_7PtrHashI
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PFPNS1_6JSNodeEPN3JSC9ExecStateENS_10PassRefPtrINS1_11HTMLElementEEE
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFPNS1_6JSNodeEPN3JSC9ExecStateENS_10PassRefPtrINS1_11HTMLElementEEEENS_7PtrHash
+__ZN7WebCoreL30createHTMLSelectElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLSelectElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSHTMLElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSHTMLElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLSelectElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLSelectElementEEE
+__ZN7WebCore19JSHTMLSelectElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLSelectElementEEE
+__ZN7WebCore13JSHTMLElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11HTMLElementEEE
+__ZN7WebCore9JSElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7ElementEEE
+__ZN7WebCore19cacheDOMNodeWrapperEPNS_8DocumentEPNS_4NodeEPNS_6JSNodeE
+__ZN3WTF7HashMapIPN7WebCore4NodeEPNS1_6JSNodeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS5_
+__ZN7WebCoreL18eventParameterNameEb
+__ZN7WebCore19JSLazyEventListenerC1ERKNS_6StringES3_S3_PNS_17JSDOMGlobalObjectEPNS_4NodeEi
+__ZN7WebCore19JSLazyEventListenerC2ERKNS_6StringES3_S3_PNS_17JSDOMGlobalObjectEPNS_4NodeEi
+__ZN7WebCore4Node25setAttributeEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore4Node27clearAttributeEventListenerERKNS_12AtomicStringE
+__ZN7WebCore4Node16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZN7WebCore4Node14ensureRareDataEv
+__ZN7WebCore7Element14createRareDataEv
+__ZN3WTF7HashMapIPKN7WebCore4NodeEPNS1_12NodeRareDataENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3setERKS4_RKS6_
+__ZN7WebCore4Node19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
+__ZNK7WebCore4Node8rareDataEv
+__ZNK3WTF7HashMapIPKN7WebCore4NodeEPNS1_12NodeRareDataENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getERKS4_
+__ZN7WebCore8Document42registerDisconnectedNodeWithEventListenersEPNS_4NodeE
+__ZN3WTF7HashSetIPN7WebCore4NodeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
+__ZNK7WebCore17HTMLSelectElement11tagPriorityEv
+__ZN7WebCore8Document44unregisterDisconnectedNodeWithEventListenersEPNS_4NodeE
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22Ident
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInvalida
+__ZN3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore17HTMLSelectElement16insertedIntoTreeEb
+__ZNK7WebCore17HTMLSelectElement15recalcListItemsEb
+__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE14shrinkCapacityEm
+__ZN7WebCore17HTMLSelectElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore17HTMLSelectElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore17HTMLSelectElement18setRecalcListItemsEv
+__ZN7WebCore8Document19scheduleStyleRecalcEv
+__ZN3WTF7HashSetIPN7WebCore8DocumentENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore8DocumentES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore8DocumentES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore8DocumentES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTable
+__ZN3WTF9HashTableIPN7WebCore8DocumentES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTab
+__ZN7WebCoreL17optionConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLOptionElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore17HTMLOptionElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore17OptionElementDataC1EPNS_7ElementE
+__ZN7WebCore17OptionElementDataC2EPNS_7ElementE
+__ZN7WebCore17HTMLOptionElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore17HTMLOptionElement17endTagRequirementEv
+__ZNK7WebCore17HTMLOptionElement11tagPriorityEv
+__ZN7WebCore17HTMLOptionElement16insertedIntoTreeEb
+__ZNK7WebCore17HTMLOptionElement18ownerSelectElementEv
+__ZNK7WebCore17HTMLOptionElement8selectedEv
+__ZN7WebCore17HTMLSelectElement17scrollToSelectionEv
+__ZN7WebCore17HTMLOptionElement6attachEv
+__ZN7WebCore17HTMLOptionElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore17HTMLOptionElement15childrenChangedEbPNS_4NodeES2_i
+__ZNK7WebCore17HTMLOptionElement22nonRendererRenderStyleEv
+__ZNK7WebCore17HTMLOptionElement5indexEv
+__ZNK7WebCore4Node19traverseNextSiblingEPKS0_
+__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE15reserveCapacityEm
+__ZN7WebCore17HTMLOptionElement16setSelectedStateEb
+__ZN7WebCore13OptionElement16setSelectedStateERNS_17OptionElementDataEb
+__ZN7WebCore17HTMLSelectElement16setSelectedIndexEibb
+__ZNK7WebCore17HTMLSelectElement17optionToListIndexEi
+__ZN7WebCore17HTMLSelectElement29setActiveSelectionAnchorIndexEi
+__ZN3WTF6VectorIbLm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIbLm0EE14expandCapacityEmPKb
+__ZN3WTF6VectorIbLm0EE14expandCapacityEm
+__ZN3WTF6VectorIbLm0EE15reserveCapacityEm
+__ZN7WebCore17HTMLSelectElement13deselectItemsEPNS_17HTMLOptionElementE
+__ZNK7WebCore16HTMLInputElement32storesValueSeparateFromAttributeEv
+__ZN7WebCore12InputElement19updateValueIfNeededERNS_16InputElementDataE
+__ZThn128_NK7WebCore16HTMLInputElement14constrainValueERKNS_6StringE
+__ZNK7WebCore16HTMLInputElement14constrainValueERKNS_6StringE
+__ZN7WebCore12InputElement14constrainValueERKNS_16InputElementDataERKNS_6StringEi
+__ZThn128_NK7WebCore16HTMLInputElement11isTextFieldEv
+__ZNK7WebCore16HTMLInputElement11isTextFieldEv
+__ZN7WebCore12InputElement22notifyFormStateChangedERNS_16InputElementDataEPNS_8DocumentE
+__ZN7WebCore22HTMLFormControlElement34setFormControlValueMatchesRendererEb
+__ZN7WebCoreL13hrConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore13HTMLHRElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore13HTMLHRElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore13HTMLHRElement17endTagRequirementEv
+__ZNK7WebCore13HTMLHRElement11tagPriorityEv
+__ZN7WebCore14CachedResource13makePurgeableEb
+__ZNK7WebCore9DocLoader11cachePolicyEv
+__ZNK7WebCore11FrameLoader11cachePolicyEv
+__ZNK7WebCore14CachedResource14mustRevalidateENS_11CachePolicyE
+__ZN3WTF6VectorItLm0EE4growEm
+__ZN3WTF6VectorItLm0EE6shrinkEm
+__ZN3WTF9HashTableIPN7WebCore20CachedResourceClientESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTra
+__ZNK7WebCore13HTMLBRElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore13HTMLBRElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15SegmentedString15advanceSlowCaseERi
+__ZNK7WebCore8Document15isMediaDocumentEv
+__ZN7WebCore11FrameLoader14didReceiveDataEPNS_14ResourceLoaderEPKcii
+__ZN7WebCore15ProgressTracker17incrementProgressEmPKci
+__ZNK7WebCore11FrameLoader27numPendingOrLoadingRequestsEb
+__ZNK7WebCore11FrameLoader15firstLayoutDoneEv
+__ZN7WebCore11FrameLoader31dispatchDidReceiveContentLengthEPNS_14DocumentLoaderEmi
+__ZN7WebCore19InspectorController23didReceiveContentLengthEPNS_14DocumentLoaderEmi
+-[WebCoreResourceHandleAsDelegate connection:willCacheResponse:]
+__ZN7WebCore14ResourceLoader17willCacheResponseEPNS_14ResourceHandleEP19NSCachedURLResponse
+__ZN7WebCore14ResourceLoader17willCacheResponseEPNS_14ResourceHandleERNS_18CacheStoragePolicyE
+-[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:]
+__ZN7WebCore14ResourceLoader16didFinishLoadingEPNS_14ResourceHandleE
+__ZN7WebCore18MainResourceLoader16didFinishLoadingEv
+__ZN7WebCore11FrameLoader15finishedLoadingEv
+__ZN7WebCoreL24urlEscapedEntityCallbackEPKvP25UConverterFromUnicodeArgsPKtii24UConverterCallbackReasonP10UErrorCode
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EE6shrinkEm
+__ZN3WTF9HashTableIPN7WebCore8DocumentES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22I
+__ZN3WTF9HashTableIPN7WebCore8DocumentES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInva
+__ZN3WTF9HashTableIPN7WebCore8DocumentES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore4Text11recalcStyleENS_4Node11StyleChangeE
+__ZN7WebCore22HTMLFormControlElement11recalcStyleENS_4Node11StyleChangeE
+__ZN7WebCore17HTMLSelectElement11recalcStyleENS_4Node11StyleChangeE
+__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE6shrinkEm
+__ZN7WebCore9TimerBase10heapPopMinEv
+__ZSt13__adjust_heapIN7WebCore17TimerHeapIteratorEiNS0_16TimerHeapElementEEvT_T0_S4_T1_
+__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE6shrinkEm
+__ZN7WebCore19AnimationController18endAnimationUpdateEv
+__ZN7WebCore26AnimationControllerPrivate14styleAvailableEv
+__ZN7WebCore26AnimationControllerPrivate24beginAnimationUpdateTimeEv
+__ZN7WebCore26AnimationControllerPrivate17startTimeResponseEd
+__ZN7WebCore9FrameView16restoreScrollbarEv
+__ZN7WebCore11FrameLoader10gotoAnchorEv
+__ZN7WebCore14ResourceLoader12resourceDataEv
+__ZN7WebCore14DocumentLoader13updateLoadingEv
+__ZNK7WebCore11FrameLoader9isLoadingEv
+__ZNK7WebCore14DocumentLoader21isLoadingSubresourcesEv
+__ZN7WebCore14ResourceLoader16didFinishLoadingEv
+__ZN7WebCore14ResourceLoader23didFinishLoadingOnePartEv
+__ZN7WebCore11FrameLoader13didFinishLoadEPNS_14ResourceLoaderE
+__ZN7WebCore15ProgressTracker16completeProgressEm
+__ZN7WebCore11FrameLoader24dispatchDidFinishLoadingEPNS_14DocumentLoaderEm
+__ZN7WebCore19InspectorController16didFinishLoadingEPNS_14DocumentLoaderEm
+__ZN7WebCore14ResourceLoader16releaseResourcesEv
+__ZN7WebCore14ResourceHandle9setClientEPNS_20ResourceHandleClientE
+__ZN7WebCore14ResourceHandleD1Ev
+__ZN7WebCore14ResourceHandleD2Ev
+__ZN7WebCore14ResourceHandle15releaseDelegateEv
+-[WebCoreResourceHandleAsDelegate detachHandle]
+__ZN7WebCore22ResourceHandleInternalD1Ev
+__ZN7WebCore22ResourceHandleInternalD2Ev
+__ZN7WebCore27AuthenticationChallengeBaseD2Ev
+__ZN7WebCore19ResourceRequestBaseD2Ev
+__ZN7WebCore18MainResourceLoaderD0Ev
+__ZN7WebCore16RunLoopTimerBaseD2Ev
+__ZN7WebCore16RunLoopTimerBase4stopEv
+__ZN7WebCore14ResourceLoaderD2Ev
+__ZN7WebCore12ThreadTimers16sharedTimerFiredEv
+__ZN7WebCore12ThreadTimers24sharedTimerFiredInternalEv
+__ZN7WebCore12ThreadTimers19collectFiringTimersEdRN3WTF6VectorIPNS_9TimerBaseELm0EEE
+__ZN3WTF7HashSetIPKN7WebCore9TimerBaseENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6expandEv
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6rehashEi
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E13allocateTab
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E15deallocateT
+__ZN7WebCore9TimerBase13heapDeleteMinEv
+__ZN7WebCore12ThreadTimers10fireTimersEdRKN3WTF6VectorIPNS_9TimerBaseELm0EEE
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E47removeAndIn
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6removeEPS4_
+__ZN7WebCore5TimerINS_6LoaderEE5firedEv
+__ZN7WebCore6Loader17requestTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore6Loader20servePendingRequestsENS0_8PriorityE
+__ZN3WTF6VectorIPN7WebCore6Loader4HostELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore6Loader4HostELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIPN7WebCore6Loader4HostELm0EE6shrinkEm
+__ZN7WebCore5TimerINS_5FrameEE5firedEv
+__ZN7WebCore5Frame21lifeSupportTimerFiredEPNS_5TimerIS0_EE
+__ZN3WTF9HashTableIPKN7WebCore9TimerBaseES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E5clearEv
+__ZN7WebCore17SubresourceLoader26shouldUseCredentialStorageEv
+__ZN7WebCore23SubresourceLoaderClient29getShouldUseCredentialStorageEPNS_17SubresourceLoaderERb
+__ZN7WebCore17SubresourceLoader18didReceiveResponseERKNS_16ResourceResponseE
+__ZN7WebCore6Loader4Host18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore17SubresourceLoaderEEEPNS2_7RequestENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3get
+__ZN7WebCore14CachedResource11setResponseERKNS_16ResourceResponseE
+__ZNK7WebCore20ResourceResponseBase14expirationDateEv
+__ZNK7WebCore20ResourceResponseBase16textEncodingNameEv
+__ZN7WebCore17SubresourceLoader14didReceiveDataEPKcixb
+__ZN7WebCore6Loader4Host14didReceiveDataEPNS_17SubresourceLoaderEPKci
+__ZN7WebCore17SubresourceLoader16didFinishLoadingEv
+__ZN7WebCore6Loader4Host16didFinishLoadingEPNS_17SubresourceLoaderE
+__ZN7WebCore9DocLoader21decrementRequestCountEv
+__ZN7WebCore9DocLoader17setLoadInProgressEb
+__ZN7WebCore19CachedCSSStyleSheet4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
+__ZN7WebCore14CachedResource14setEncodedSizeEj
+__ZN7WebCore19TextResourceDecoder18checkForCSSCharsetEPKcmRb
+__ZN7WebCore19CachedCSSStyleSheet11checkNotifyEv
+__ZN7WebCore26CachedResourceClientWalkerC1ERKN3WTF14HashCountedSetIPNS_20CachedResourceClientENS1_7PtrHashIS4_EENS1_10HashTrait
+__ZN7WebCore26CachedResourceClientWalkerC2ERKN3WTF14HashCountedSetIPNS_20CachedResourceClientENS1_7PtrHashIS4_EENS1_10HashTrait
+__ZN7WebCore26CachedResourceClientWalker4nextEv
+__ZNK3WTF9HashTableIPN7WebCore20CachedResourceClientESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTr
+__ZThn24_N7WebCore13CSSImportRule16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore13CSSImportRule16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore13CSSStyleSheetC1EPNS_7CSSRuleERKNS_6StringES5_
+__ZN7WebCore13CSSStyleSheetC2EPNS_7CSSRuleERKNS_6StringES5_
+__ZN7WebCore10StyleSheetC2EPNS_9StyleBaseERKNS_6StringE
+__ZNK7WebCore19CachedCSSStyleSheet9sheetTextEb
+__ZNK7WebCore19CachedCSSStyleSheet11canUseSheetEb
+__ZN7WebCore28extractMIMETypeFromMediaTypeERKNS_6StringE
+__ZN3WTF6VectorItLm64EE15reserveCapacityEm
+__ZN3WTF6VectorItLm64EE6shrinkEm
+__ZN7WebCore9CSSParser9parseFontEb
+__ZNK7WebCore13CSSStyleSheet11completeURLERKNS_6StringE
+__ZNK7WebCore9StyleBase7baseURLEv
+__ZNK7WebCore4KURL14isHierarchicalEv
+__ZN7WebCoreL20copyPathRemovingDotsEPcPKcii
+__ZN7WebCore13CSSImageValueC1ERKNS_6StringE
+__ZN7WebCore13CSSImageValueC2ERKNS_6StringE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10StyleSheetEEELm0EE6shrinkEm
+__ZN7WebCore11RenderBlock24updateBeforeAfterContentENS_8PseudoIdE
+__ZN7WebCore21RenderObjectChildList24updateBeforeAfterContentEPNS_12RenderObjectENS_8PseudoIdES2_
+__ZNK7WebCore12RenderObject20getCachedPseudoStyleENS_8PseudoIdEPNS_11RenderStyleE
+__ZN7WebCoreL20beforeAfterContainerEPNS_12RenderObjectENS_8PseudoIdE
+__ZNK7WebCore12RenderObject12isListMarkerEv
+__ZNK7WebCore12RenderObject23createsAnonymousWrapperEv
+__ZNK7WebCore8CSSValue16isPrimitiveValueEv
 __ZNK7WebCore8CSSValue12cssValueTypeEv
-__ZN7WebCore9FontValue11isFontValueEv
+__ZNK7WebCore9FontValue11isFontValueEv
 __ZN7WebCore17CSSPrimitiveValue8getIdentEv
-__ZN7WebCore17CSSPrimitiveValue18computeLengthFloatEPNS_11RenderStyleEb
-__ZN7WebCore17CSSPrimitiveValue19computeLengthDoubleEPNS_11RenderStyleEb
+__ZN7WebCore11RenderStyle18setFontDescriptionERKNS_15FontDescriptionE
 __ZNK7WebCore12CSSValueList12cssValueTypeEv
-__ZN7WebCore12CSSValueList11isValueListEv
+__ZNK7WebCore12CSSValueList11isValueListEv
+__ZN7WebCore16CSSStyleSelector26getColorFromPrimitiveValueEPNS_17CSSPrimitiveValueE
+__ZN7WebCoreL16colorForCSSValueEi
 __ZN7WebCore16CSSStyleSelector10updateFontEv
 __ZN7WebCore16CSSStyleSelector22checkForTextSizeAdjustEv
 __ZN7WebCore16CSSStyleSelector27checkForGenericFamilyChangeEPNS_11RenderStyleES2_
+__ZN7WebCore16CSSStyleSelector18checkForZoomChangeEPNS_11RenderStyleES2_
 __ZN7WebCore17CSSPrimitiveValue12isQuirkValueEv
-__ZN7WebCore17CSSPrimitiveValue25computeLengthIntForLengthEPNS_11RenderStyleE
+__ZN7WebCore17CSSPrimitiveValue25computeLengthIntForLengthEPNS_11RenderStyleEd
+__ZN7WebCore17CSSPrimitiveValue19computeLengthDoubleEPNS_11RenderStyleEdb
+__ZN7WebCore7DataRefINS_17StyleSurroundDataEE6accessEv
+__ZN7WebCore17StyleSurroundDataC1ERKS0_
 __ZN7WebCore17StyleSurroundDataC2ERKS0_
-__ZN7WebCore16CSSStyleSelector26getColorFromPrimitiveValueEPNS_17CSSPrimitiveValueE
+__ZN7WebCore7DataRefINS_19StyleBackgroundDataEE6accessEv
+__ZN7WebCore19StyleBackgroundDataC1ERKS0_
 __ZN7WebCore19StyleBackgroundDataC2ERKS0_
-__ZN7WebCore15BackgroundLayerC2ERKS0_
+__ZN7WebCore9FillLayerC1ERKS0_
+__ZN7WebCore9FillLayerC2ERKS0_
+__ZNK7WebCore8CSSValue11isValueListEv
+__ZN7WebCore16CSSStyleSelector12mapFillImageEPNS_9FillLayerEPNS_8CSSValueE
+__ZN7WebCore16CSSStyleSelector10styleImageEPNS_8CSSValueE
+__ZNK7WebCore13CSSImageValue12isImageValueEv
+__ZN7WebCore13CSSImageValue11cachedImageEPNS_9DocLoaderE
+__ZNK7WebCore17CSSPrimitiveValue14getStringValueEv
+__ZN7WebCore13CSSImageValue11cachedImageEPNS_9DocLoaderERKNS_6StringE
+__ZN7WebCore16CSSStyleSelector13mapFillRepeatEPNS_9FillLayerEPNS_8CSSValueE
 __ZNK7WebCore15CSSInitialValue12cssValueTypeEv
-__ZNK7WebCore12RenderObject12isRenderViewEv
-__ZN7WebCore11HTMLElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore11HTMLElement15inEitherTagListEPKNS_4NodeE
-__ZN7WebCore4Node16styleForRendererEPNS_12RenderObjectE
+__ZN7WebCore16CSSStyleSelector16mapFillXPositionEPNS_9FillLayerEPNS_8CSSValueE
+__ZN7WebCore16CSSStyleSelector16mapFillYPositionEPNS_9FillLayerEPNS_8CSSValueE
+__ZN7WebCore16HTMLInputElement6detachEv
+__ZN7WebCore17HTMLOptionElement6detachEv
 __ZN7WebCore4Text16rendererIsNeededEPNS_11RenderStyleE
 __ZN7WebCore13CharacterData16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore4Node16rendererIsNeededEPNS_11RenderStyleE
 __ZNK7WebCore12RenderObject7isTableEv
 __ZNK7WebCore12RenderObject10isFrameSetEv
 __ZN7WebCore4Node16previousRendererEv
-__ZN7WebCore11HTMLElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore13inlineTagListEv
-__ZN7WebCore12blockTagListEv
-__ZN7WebCore13HTMLTokenizer12parseCommentERNS_15SegmentedStringENS0_5StateE
-__ZN7WebCore10HTMLParser23commentCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore7CommentC2EPNS_8DocumentERKNS_6StringE
-__ZNK7WebCore7Comment8nodeTypeEv
-__ZNK7WebCore7Comment13isCommentNodeEv
-__ZN7WebCore16tableConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLTableElementC2EPNS_8DocumentE
-__ZNK7WebCore16HTMLTableElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore16HTMLTableElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore16HTMLTableElement11cellBordersEv
-__ZNK7WebCore6String5toIntEPb
-__ZN7WebCore10StringImpl5toIntEPb
-__ZN7WebCore21DeprecatedConstStringC2EPKNS_14DeprecatedCharEj
-__ZN7WebCore20DeprecatedStringDataC2EPNS_14DeprecatedCharEjj
-__ZN7WebCore16DeprecatedStringC2EPNS_20DeprecatedStringDataEb
-__ZN7WebCore21DeprecatedConstStringD2Ev
-__ZN7WebCore6String6numberEi
-__ZN7WebCore6String6formatEPKcz
-__ZN3WTF6VectorIcLm256EE4growEm
-__ZNK7WebCore16HTMLTableElement17endTagRequirementEv
-__ZNK7WebCore16HTMLTableElement11tagPriorityEv
-__ZN7WebCore16HTMLTableElement6attachEv
-__ZNK7WebCore16HTMLTableElement36canHaveAdditionalAttributeStyleDeclsEv
-__ZN7WebCore16HTMLTableElement29additionalAttributeStyleDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
-__ZN7WebCore17CSSPrimitiveValue18computeLengthShortEPNS_11RenderStyleE
-__ZN7WebCore11RenderTableC2EPNS_4NodeE
-__ZN3WTF6VectorIiLm0EE4fillERKim
-__ZN3WTF6VectorIiLm0EE15reserveCapacityEm
-__ZSt4fillIPiiEvT_S1_RKT0_
-__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE4fillERKS3_m
-__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE15reserveCapacityEm
-__ZSt4fillIPN7WebCore11RenderTable12ColumnStructES2_EvT_S4_RKT0_
-__ZN7WebCore11RenderTable8setStyleEPNS_11RenderStyleE
-__ZN7WebCore11RenderTable17updateFirstLetterEv
-__ZN7WebCore15AutoTableLayoutC2EPNS_11RenderTableE
-__ZN7WebCore16HTMLTableElement8addChildEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore16HTMLTableElement8checkDTDEPKNS_4NodeE
-__ZNK7WebCore11RenderTable7isTableEv
-__ZN7WebCore10HTMLParser22nestedCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore19tableRowConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore19HTMLTableRowElementC2EPNS_8DocumentE
-__ZNK7WebCore19HTMLTableRowElement17endTagRequirementEv
-__ZNK7WebCore19HTMLTableRowElement11tagPriorityEv
-__ZN7WebCore14isTableSectionEPNS_4NodeE
-__ZN7WebCore23HTMLTableSectionElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore23HTMLTableSectionElement11tagPriorityEv
-__ZNK7WebCore23HTMLTableSectionElement36canHaveAdditionalAttributeStyleDeclsEv
-__ZN7WebCore23HTMLTableSectionElement29additionalAttributeStyleDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
-__ZN7WebCore16HTMLTableElement19addSharedGroupDeclsEbRN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
-__ZNK7WebCore17CSSInheritedValue12cssValueTypeEv
-__ZN7WebCore18RenderTableSectionC2EPNS_4NodeE
-__ZN7WebCore18RenderTableSection8setStyleEPNS_11RenderStyleE
+__ZNK7WebCore12RenderObject14isRenderInlineEv
+__ZNK7WebCore7Element14getIDAttributeEv
+__ZN7WebCore7DataRefINS_12StyleBoxDataEE6accessEv
+__ZN7WebCore14ClassNamesData12createVectorEv
+__ZN7WebCore17CSSPrimitiveValue18computeLengthFloatEPNS_11RenderStyleEb
+__ZN7WebCore7DataRefINS_18StyleInheritedDataEE6accessEv
+__ZN7WebCore16HTMLImageElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore11RenderImageC1EPNS_4NodeE
+__ZN7WebCore11RenderImageC2EPNS_4NodeE
+__ZN7WebCore14RenderReplacedC2EPNS_4NodeERKNS_7IntSizeE
+__ZN7WebCore11RenderImage13updateAltTextEv
+__ZNK7WebCore16HTMLImageElement7altTextEv
+__ZN7WebCore14RenderReplaced14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
 __ZNK7WebCore12RenderObject13isRenderBlockEv
-__ZNK7WebCore18RenderTableSection14isTableSectionEv
-__ZN7WebCore11RenderTable8addChildEPNS_12RenderObjectES2_
-__ZN7WebCore10RenderFlow26dirtyLinesFromChangedChildEPNS_12RenderObjectE
-__ZN7WebCore23HTMLTableSectionElement8addChildEN3WTF10PassRefPtrINS_4NodeEEE
-__ZNK7WebCore23HTMLTableSectionElement17endTagRequirementEv
-__ZN7WebCore23HTMLTableSectionElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore14RenderTableRowC2EPNS_4NodeE
-__ZN7WebCore14RenderTableRow8setStyleEPNS_11RenderStyleE
-__ZNK7WebCore14RenderTableRow10isTableRowEv
-__ZN7WebCore14RenderTableRow13requiresLayerEv
-__ZN7WebCore18RenderTableSection8addChildEPNS_12RenderObjectES2_
-__ZN7WebCore18RenderTableSection10ensureRowsEi
-__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE4growEm
-__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE4fillERKS3_m
-__ZSt4fillIPN7WebCore18RenderTableSection10CellStructES2_EvT_S4_RKT0_
-__ZNK7WebCore12RenderObject14childrenInlineEv
-__ZN7WebCore19HTMLTableRowElement8addChildEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore19HTMLTableRowElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore10HTMLParser25tableCellCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZNK7WebCore4Font6ascentEv
-__ZNK7WebCore4Font7descentEv
+__ZNK7WebCore12RenderObject15virtualChildrenEv
+__ZN7WebCore11RenderBlock26dirtyLinesFromChangedChildEPNS_12RenderObjectE
+__ZN7WebCore17RenderLineBoxList26dirtyLinesFromChangedChildEPNS_12RenderObjectES2_
+__ZNK7WebCore11RenderImage7isImageEv
+__ZNK7WebCore11RenderImage8hasImageEv
+__ZN7WebCore11RenderImage14setCachedImageEPNS_11CachedImageE
+__ZN7WebCoreeqINS_11CachedImageES1_EEbRKNS_20CachedResourceHandleIT_EEPKT0_
+__ZNK7WebCore12RenderObject4isBREv
+__ZN7WebCore4Text14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore10RenderTextC1EPNS_4NodeEN3WTF10PassRefPtrINS_10StringImplEEE
+__ZN7WebCore10RenderTextC2EPNS_4NodeEN3WTF10PassRefPtrINS_10StringImplEEE
+__ZNK7WebCore8Document31displayStringModifiedByEncodingEN3WTF10PassRefPtrINS_10StringImplEEE
+__ZN7WebCore10RenderText15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore10RenderText14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore16CSSStyleSelector15SelectorChecker16checkPseudoStateEPNS_7ElementEb
+__ZN7WebCore15visitedLinkHashERKNS_4KURLERKNS_12AtomicStringE
+__ZN7WebCore10visitedURLERKNS_4KURLERKNS_12AtomicStringERN3WTF6VectorItLm512EEE
+__ZN7WebCore9PageGroup13isLinkVisitedEy
+__ZN7WebCore9PageGroup14addVisitedLinkEPKtm
+__ZN3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E4findIyNS_22IdentityHashTranslato
+__ZNK7WebCore11CSSSelector9attributeEv
+__ZN7WebCoreL36htmlAttributeHasCaseInsensitiveValueERKNS_13QualifiedNameE
+__ZN7WebCoreL17addLocalNameToSetEPN3WTF7HashSetIPNS_16AtomicStringImplENS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EEEERKNS_13Qualifi
+__ZN7WebCore10StringImpl11reverseFindEPS0_ib
+__ZN7WebCoregtERNS_11CSSRuleDataES1_
+__ZN7WebCore11CSSSelector11specificityEv
+__ZN7WebCore15StyleVisualDataC1ERKS0_
+__ZN7WebCore15StyleVisualDataC2ERKS0_
+__ZN7WebCore11RenderStyle15clearCursorListEv
+__ZN7WebCoreL19valueOrPropertyNameEi
+__Z12getValueNamet
+__ZN7WebCore12RenderInlineC1EPNS_4NodeE
+__ZN7WebCore12RenderInlineC2EPNS_4NodeE
+__ZN7WebCore12RenderInline14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore12RenderInline27updateBoxModelInfoFromStyleEv
+__ZNK7WebCore12RenderInline13requiresLayerEv
+__ZNK7WebCore12RenderInline18inlineContinuationEv
+__ZNK7WebCore12RenderInline15virtualChildrenEv
+__ZNK7WebCore16CSSStyleSelector14largerFontSizeEfb
+__ZN7WebCore12RenderInline8addChildEPNS_12RenderObjectES2_
+__ZN7WebCore12RenderInline28addChildIgnoringContinuationEPNS_12RenderObjectES2_
+__ZN7WebCore12RenderInline15virtualChildrenEv
+__ZN7WebCore12RenderInline26dirtyLinesFromChangedChildEPNS_12RenderObjectE
+__ZNK7WebCore15FontDescription12bolderWeightEv
+__ZN7WebCore16CSSStyleSelector24canShareStyleWithElementEPNS_4NodeE
+__ZN7WebCore13HTMLBRElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore8RenderBRC1EPNS_4NodeE
+__ZN7WebCore8RenderBRC2EPNS_4NodeE
+__ZN7WebCore8RenderBR14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore8RenderBR4isBREv
+__ZNK7WebCore16CSSStyleSelector15smallerFontSizeEfb
+__ZNK7WebCore12RenderObject22getUncachedPseudoStyleENS_8PseudoIdEPNS_11RenderStyleE
+__ZN7WebCore16CSSStyleSelector21pseudoStyleForElementENS_8PseudoIdEPNS_7ElementEPNS_11RenderStyleE
+__ZN7WebCore22CSSQuirkPrimitiveValue12isQuirkValueEv
+__ZN7WebCore17CSSPrimitiveValue18computeLengthShortEPNS_11RenderStyleEd
+__ZNK7WebCore12RenderInline14isRenderInlineEv
+__ZNK7WebCore10RenderText12originalTextEv
+__ZN7WebCore10RenderText7setTextEN3WTF10PassRefPtrINS_10StringImplEEEb
+__ZN7WebCore10RenderText15setTextInternalEN3WTF10PassRefPtrINS_10StringImplEEE
+__ZNK7WebCore12RenderObject9isSVGTextEv
+__ZN7WebCore15HTMLFormElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore11RenderBlock17deleteLineBoxTreeEv
+__ZN7WebCore17RenderLineBoxList17deleteLineBoxTreeEPNS_11RenderArenaE
+__ZNK7WebCore11RenderBlock20createAnonymousBlockEv
+__ZN7WebCoreL9moveChildEPNS_12RenderObjectEPNS_21RenderObjectChildListES1_S3_S1_
+__ZNK7WebCore12RenderObject17isSelectionBorderEv
+__ZN7WebCore9RenderBox21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZNK7WebCore11RenderBlock11isBlockFlowEv
+__ZNK7WebCore14RenderThemeMac11systemColorEi
+__ZNK3WTF9HashTableIiSt4pairIijENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENS8_IjEEEES9
+__ZN3WTF7HashMapIijNS_7IntHashIjEENS_10HashTraitsIiEENS3_IjEEE3setERKiRKj
+__ZN3WTF9HashTableIiSt4pairIijENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENS8_IjEEEES9_
+__ZNK3WTF7HashMapIijNS_7IntHashIjEENS_10HashTraitsIiEENS3_IjEEE3getERKi
+__ZNK7WebCore22HTMLFormControlElement20isFormControlElementEv
+__ZN7WebCore19HTMLFieldSetElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore14RenderFieldsetC1EPNS_4NodeE
+__ZN7WebCore14RenderFieldsetC2EPNS_4NodeE
+__ZN7WebCore14RenderFieldset14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore14toInputElementEPNS_7ElementE
+__ZThn128_NK7WebCore16HTMLInputElement12isAutofilledEv
+__ZNK7WebCore16HTMLInputElement12isAutofilledEv
+__ZNK7WebCore14RenderThemeMac10systemFontEiRNS_15FontDescriptionE
+__ZN7WebCoreL12toFontWeightEl
+__ZN7WebCore11RenderStyle13setTextShadowEPNS_10ShadowDataEb
+__ZN7WebCore22StyleRareInheritedDataC1ERKS0_
+__ZN7WebCore22StyleRareInheritedDataC2ERKS0_
+__ZN7WebCore7DataRefINS_25StyleRareNonInheritedDataEE6accessEv
+__ZN7WebCore25StyleRareNonInheritedDataC1ERKS0_
+__ZN7WebCore25StyleRareNonInheritedDataC2ERKS0_
+__ZN7WebCore9FillLayeraSERKS0_
+__ZN7WebCore11RenderTheme11adjustStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementEbRKNS_10BorderDataERKNS_9FillLayer
+__ZNK7WebCore14RenderThemeMac15isControlStyledEPKNS_11RenderStyleERKNS_10BorderDataERKNS_9FillLayerERKNS_5ColorE
+__ZNK7WebCore14NinePieceImageeqERKS0_
+__ZN7WebCore11RenderStyle12setBoxShadowEPNS_10ShadowDataEb
+__ZNK7WebCore14RenderThemeMac20adjustTextFieldStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore16HTMLInputElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore16HTMLInputElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore27RenderTextControlSingleLineC1EPNS_4NodeE
+__ZN7WebCore27RenderTextControlSingleLineC2EPNS_4NodeE
+__ZN7WebCore17RenderTextControlC2EPNS_4NodeE
+__ZN7WebCore27RenderTextControlSingleLine14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore17RenderTextControl14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore17RenderTextControl15canHaveChildrenEv
+__ZN7WebCore27RenderTextControlSingleLine17updateFromElementEv
+__ZN7WebCore27RenderTextControlSingleLine21createSubtreeIfNeededEv
+__ZNK7WebCore27RenderTextControlSingleLine12inputElementEv
+__ZThn128_NK7WebCore16HTMLInputElement13isSearchFieldEv
+__ZNK7WebCore16HTMLInputElement13isSearchFieldEv
+__ZN7WebCore17RenderTextControl21createSubtreeIfNeededEPNS_23TextControlInnerElementE
+__ZN7WebCore27TextControlInnerTextElementC1EPNS_8DocumentEPNS_4NodeE
+__ZN7WebCore27TextControlInnerTextElementC2EPNS_8DocumentEPNS_4NodeE
+__ZN7WebCore23TextControlInnerElementC2EPNS_8DocumentEPNS_4NodeE
+__ZNK7WebCore27RenderTextControlSingleLine20createInnerTextStyleEPKNS_11RenderStyleE
+__ZNK7WebCore27RenderTextControlSingleLine26placeholderShouldBeVisibleEv
+__ZThn128_NK7WebCore16HTMLInputElement26placeholderShouldBeVisibleEv
+__ZNK7WebCore16HTMLInputElement26placeholderShouldBeVisibleEv
+__ZNK7WebCore17RenderTextControl20adjustInnerTextStyleEPKNS_11RenderStyleEPS1_
+__ZNK7WebCore22HTMLFormControlElement20isEnabledFormControlEv
+__ZNK7WebCore22HTMLFormControlElement8disabledEv
+__ZNK7WebCore22HTMLFormControlElement21isReadOnlyFormControlEv
+__ZN7WebCore9FontCache11getFontDataERKNS_4FontERiPNS_12FontSelectorE
+__ZN7WebCore15CSSFontSelector11getFontDataERKNS_15FontDescriptionERKNS_12AtomicStringE
+__ZN7WebCore9FontCache25getCachedFontPlatformDataERKNS_15FontDescriptionERKNS_12AtomicStringEb
+__ZN7WebCore9FontCache12platformInitEv
+__ZN3WTF9HashTableIN7WebCore24FontPlatformDataCacheKeyESt4pairIS2_PNS1_16FontPlatformDataEENS_18PairFirstExtractorIS6_EENS1_28F
+__ZN7WebCore9FontCache22createFontPlatformDataERKNS_15FontDescriptionERKNS_12AtomicStringE
+__ZN7WebCoreL18toAppKitFontWeightENS_10FontWeightE
++[WebFontCache fontWithFamily:traits:weight:size:]
++[WebFontCache internalFontWithFamily:traits:weight:size:]
+__ZL16acceptableChoicemm
+__ZNK7WebCore14SimpleFontData9isLoadingEv
+__ZNK7WebCore11RenderBlock10lineHeightEbb
+__ZN7WebCore23TextControlInnerElement18attachInnerElementEPNS_4NodeEN3WTF10PassRefPtrINS_11RenderStyleEEEPNS_11RenderArenaE
+__ZN7WebCore27TextControlInnerTextElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZNK7WebCore23TextControlInnerElement12isShadowNodeEv
+__ZN7WebCore23TextControlInnerElement16shadowParentNodeEv
+__ZNK7WebCore12RenderObject10isTextAreaEv
+__ZNK7WebCore11RenderLayer13isTransparentEv
+__ZNK7WebCore7Element19virtualNamespaceURIEv
+__ZN7WebCore11RenderLayer19dirtyNormalFlowListEv
+__ZNK7WebCore17RenderTextControl13isTextControlEv
+__ZN7WebCore9FrameView25scheduleRelayoutOfSubtreeEPNS_12RenderObjectE
+__ZN7WebCore17RenderTextControl17updateFromElementEv
+__ZNK7WebCore22HTMLFormControlElement31formControlValueMatchesRendererEv
+__ZThn128_NK7WebCore16HTMLInputElement5valueEv
+__ZNK7WebCore16HTMLInputElement5valueEv
+__ZN7WebCore17RenderTextControl17setInnerTextValueERKNS_6StringE
+__ZN7WebCore17RenderTextControl4textEv
+__ZNK7WebCore17RenderTextControl10finishTextERN3WTF6VectorItLm0EEE
+__ZN7WebCore11HTMLElement12setInnerTextERKNS_6StringERi
+__ZNK7WebCore4Node15rareDataFocusedEv
+__ZN7WebCore20StyleFlexibleBoxDataC1ERKS0_
+__ZN7WebCore20StyleFlexibleBoxDataC2ERKS0_
+__ZN7WebCore17CSSPrimitiveValue16computeLengthIntEPNS_11RenderStyleEd
+__ZNK7WebCore11RenderTheme15isControlStyledEPKNS_11RenderStyleERKNS_10BorderDataERKNS_9FillLayerERKNS_5ColorE
+__ZNK7WebCore9FillLayereqERKS0_
+__ZNK7WebCore14RenderThemeMac19adjustMenuListStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZNK7WebCore14RenderThemeMac18controlSizeForFontEPNS_11RenderStyleE
+__ZN7WebCore11RenderStyle11resetBorderEv
+__ZN7WebCoreL19menuListButtonSizesEv
+__ZNK7WebCore14RenderThemeMac15setSizeFromFontEPNS_11RenderStyleEPKNS_7IntSizeE
+__ZNK7WebCore14RenderThemeMac11sizeForFontEPNS_11RenderStyleEPKNS_7IntSizeE
+__ZNK7WebCore14RenderThemeMac22setFontFromControlSizeEPNS_16CSSStyleSelectorEPNS_11RenderStyleEm
+__ZN7WebCore10FontFamilyD2Ev
+__ZN7WebCore17HTMLSelectElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore14RenderMenuListC1EPNS_17HTMLSelectElementE
+__ZN7WebCore14RenderMenuListC2EPNS_17HTMLSelectElementE
+__ZN7WebCore17RenderFlexibleBoxC2EPNS_4NodeE
+__ZN7WebCore14RenderMenuList14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore14RenderMenuList15canHaveChildrenEv
+__ZN7WebCore14RenderMenuList18updateOptionsWidthEv
+__ZN7WebCore15toOptionElementEPNS_7ElementE
+__ZThn128_NK7WebCore17HTMLOptionElement31textIndentedToRespectGroupLabelEv
+__ZNK7WebCore17HTMLOptionElement31textIndentedToRespectGroupLabelEv
+__ZN7WebCore13OptionElement37collectOptionTextRespectingGroupLabelERKNS_17OptionElementDataEPNS_8DocumentE
+__ZN7WebCore20toOptionGroupElementEPNS_7ElementE
+__ZN7WebCore13OptionElement17collectOptionTextERKNS_17OptionElementDataEPNS_8DocumentE
+__ZNK7WebCore6String18simplifyWhiteSpaceEv
+__ZN7WebCore10StringImpl18simplifyWhiteSpaceEv
+__ZNK7WebCore11RenderTheme29popupOptionSupportsTextIndentEv
+__ZN7WebCore9FontCache24getFontDataForCharactersERKNS_4FontEPKti
+__ZNK3WTF7HashMapIiPN7WebCore13GlyphWidthMap14GlyphWidthPageENS_7IntHashIjEENS_10HashTraitsIiEENS7_IS4_EEE3getERKi
+__ZNK7WebCore17HTMLOptionElement8disabledEv
+__ZN7WebCore17HTMLOptionElement14setRenderStyleEN3WTF10PassRefPtrINS_11RenderStyleEEE
+__ZN7WebCore14RenderMenuList17updateFromElementEv
+__ZNK7WebCore17HTMLSelectElement13selectedIndexEv
+__ZN7WebCore14RenderMenuList17setTextFromOptionEi
+__ZN7WebCore14RenderMenuList7setTextERKNS_6StringE
+__ZN7WebCore14RenderMenuList8addChildEPNS_12RenderObjectES2_
+__ZN7WebCore14RenderMenuList16createInnerBlockEv
+__ZN7WebCore14RenderMenuList16adjustInnerStyleEv
+__ZNK7WebCore14RenderThemeMac24popupInternalPaddingLeftEPNS_11RenderStyleE
+__ZNK7WebCore14RenderThemeMac18popupButtonPaddingEm
+__ZNK7WebCore14RenderThemeMac25popupInternalPaddingRightEPNS_11RenderStyleE
+__ZNK7WebCore14RenderThemeMac23popupInternalPaddingTopEPNS_11RenderStyleE
+__ZNK7WebCore14RenderThemeMac26popupInternalPaddingBottomEPNS_11RenderStyleE
+__ZN7WebCore9PopupMenu29itemWritingDirectionIsNaturalEv
+__ZN7WebCore10StringImpl23defaultWritingDirectionEv
+__ZThn128_NK7WebCore16HTMLInputElement17isInputTypeHiddenEv
+__ZN7WebCoreL21convertNSColorToColorEP7NSColor
+__ZNK7WebCore8ThemeMac13controlBorderENS_11ControlPartERKNS_4FontERKNS_9LengthBoxEf
+__ZNK7WebCore5Theme13controlBorderENS_11ControlPartERKNS_4FontERKNS_9LengthBoxEf
+__ZNK7WebCore8ThemeMac14controlPaddingENS_11ControlPartERKNS_4FontERKNS_9LengthBoxEf
+__ZNK7WebCore8ThemeMac28controlRequiresPreWhiteSpaceENS_11ControlPartE
+__ZNK7WebCore8ThemeMac11controlSizeENS_11ControlPartERKNS_4FontERKNS_10LengthSizeEf
+__ZN7WebCoreL11buttonSizesEv
+__ZN7WebCoreL12sizeFromFontERKNS_4FontERKNS_10LengthSizeEfPKNS_7IntSizeE
+__ZN7WebCoreL18controlSizeForFontERKNS_4FontE
+__ZNK7WebCore8ThemeMac18minimumControlSizeENS_11ControlPartERKNS_4FontEf
+__ZNK7WebCore8ThemeMac11controlFontENS_11ControlPartERKNS_4FontEf
+__ZN7WebCore12RenderButtonC1EPNS_4NodeE
+__ZN7WebCore12RenderButtonC2EPNS_4NodeE
+__ZN7WebCore12RenderButton15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore12RenderButton14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore12RenderButton15canHaveChildrenEv
+__ZNK7WebCore11RenderTheme9isDefaultEPKNS_12RenderObjectE
+__ZN7WebCore12RenderButton17updateFromElementEv
+__ZNK7WebCore16HTMLInputElement16valueWithDefaultEv
+__ZN7WebCore12RenderButton7setTextERKNS_6StringE
+__ZN7WebCore18RenderTextFragmentC1EPNS_4NodeEPNS_10StringImplE
+__ZN7WebCore18RenderTextFragmentC2EPNS_4NodeEPNS_10StringImplE
+__ZN7WebCore12RenderButton8addChildEPNS_12RenderObjectES2_
+__ZN7WebCore12RenderButton15setupInnerStyleEPNS_11RenderStyleE
+__ZNK7WebCore11RenderTheme24buttonInternalPaddingTopEv
+__ZNK7WebCore11RenderTheme26buttonInternalPaddingRightEv
+__ZNK7WebCore11RenderTheme27buttonInternalPaddingBottomEv
+__ZNK7WebCore11RenderTheme25buttonInternalPaddingLeftEv
+__ZN7WebCore22StyleRareInheritedDataD1Ev
+__ZN7WebCore22StyleRareInheritedDataD2Ev
+__ZN7WebCore25StyleRareNonInheritedDataD1Ev
+__ZN7WebCore25StyleRareNonInheritedDataD2Ev
+__ZN7WebCore12RenderObject17updateFromElementEv
+__ZNK7WebCore18NamedMappedAttrMap14mapsEquivalentEPKS0_
+__ZNK7WebCore18NamedMappedAttrMap9declCountEv
+__ZN7WebCore8Document18minimumLayoutDelayEv
+__ZNK7WebCore8Document11elapsedTimeEv
+__ZN7WebCore13HTMLTokenizer35executeScriptsWaitingForStylesheetsEv
+__ZN3WTF6VectorIPN7WebCore20CachedResourceClientELm0EE6shrinkEm
+__ZN7WebCore14CachedResource6finishEv
+__ZN7WebCore7RequestD1Ev
+__ZN7WebCore7RequestD2Ev
+__ZN7WebCore11FrameLoader8loadDoneEv
+__ZN7WebCore9DocLoader23checkForPendingPreloadsEv
+__ZN7WebCore14DocumentLoader23removeSubresourceLoaderEPNS_14ResourceLoaderE
+__ZN7WebCore17SubresourceLoaderD0Ev
+__ZN7WebCore11CachedImage4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
+__ZN7WebCore11CachedImage23maximumDecodedImageSizeEv
+__ZNK7WebCore11CachedImage9imageSizeEf
+__ZNK7WebCore11BitmapImage4sizeEv
+__ZNK7WebCore11ImageSource4sizeEv
+__ZNK7WebCore11ImageSource16frameSizeAtIndexEm
+__ZN7WebCore11CachedImage15notifyObserversEPKNS_7IntRectE
+__ZN7WebCore12RenderObject12imageChangedEPNS_11CachedImageEPKNS_7IntRectE
+__ZN7WebCore11RenderImage12imageChangedEPvPKNS_7IntRectE
+__ZNK7WebCore11RenderImage8imagePtrEv
+__ZNK7WebCore11RenderImage13errorOccurredEv
 __ZNK7WebCore14RenderReplaced13intrinsicSizeEv
+__ZNK7WebCore11RenderImage9imageSizeEf
 __ZN7WebCore14RenderReplaced16setIntrinsicSizeERKNS_7IntSizeE
-__ZNK7WebCore11CachedImage9imageSizeEv
+__ZNK7WebCore12RenderObject15containingBlockEv
+__ZNK7WebCore12RenderObject7isMediaEv
+__ZNK7WebCore12RenderObject14isSVGContainerEv
 __ZN7WebCore9RenderBox9calcWidthEv
 __ZNK7WebCore9FrameView10layoutRootEb
-__ZNK7WebCore9FrameView13layoutPendingEv
 __ZNK7WebCore12RenderObject13isFlexibleBoxEv
 __ZNK7WebCore9RenderBox29shouldCalculateSizeAsReplacedEv
 __ZNK7WebCore12RenderObject26isInlineBlockOrInlineTableEv
-__ZNK7WebCore11RenderImage17calcReplacedWidthEv
+__ZNK7WebCore11RenderImage17calcReplacedWidthEb
+__ZNK7WebCore11RenderImage21imageHasRelativeWidthEv
 __ZNK7WebCore11CachedImage21imageHasRelativeWidthEv
+__ZNK7WebCore5Image16hasRelativeWidthEv
 __ZNK7WebCore11RenderImage16isWidthSpecifiedEv
 __ZNK7WebCore9RenderBox22calcReplacedWidthUsingENS_6LengthE
 __ZNK7WebCore9RenderBox19calcContentBoxWidthEi
-__ZNK7WebCore9RenderBox20containingBlockWidthEv
-__ZNK7WebCore12RenderObject19shrinkToAvoidFloatsEv
+__ZNK7WebCore9RenderBox30containingBlockWidthForContentEv
+__ZNK7WebCore9RenderBox19shrinkToAvoidFloatsEv
 __ZNK7WebCore12RenderObject13isHTMLMarqueeEv
 __ZNK7WebCore11RenderBlock14availableWidthEv
-__ZNK7WebCore12RenderObject11clientWidthEv
-__ZNK7WebCore9RenderBox5widthEv
-__ZNK7WebCore15RenderTableCell10borderLeftEv
-__ZNK7WebCore15RenderTableCell11borderRightEv
-__ZNK7WebCore12RenderObject22verticalScrollbarWidthEv
-__ZNK7WebCore12RenderObject11paddingLeftEv
-__ZNK7WebCore12RenderObject12paddingRightEv
+__ZNK7WebCore9RenderBox11clientWidthEv
+__ZNK7WebCore20RenderBoxModelObject10borderLeftEv
+__ZNK7WebCore20RenderBoxModelObject11borderRightEv
+__ZNK7WebCore9RenderBox22verticalScrollbarWidthEv
+__ZNK7WebCore20RenderBoxModelObject11paddingLeftEb
+__ZNK7WebCore20RenderBoxModelObject12paddingRightEb
 __ZNK7WebCore9RenderBox12minPrefWidthEv
 __ZN7WebCore11RenderImage14calcPrefWidthsEv
-__ZNK7WebCore12RenderObject10borderLeftEv
-__ZNK7WebCore12RenderObject11borderRightEv
 __ZN7WebCore9RenderBox10calcHeightEv
 __ZN7WebCore9RenderBox19calcVerticalMarginsEv
 __ZNK7WebCore11RenderImage18calcReplacedHeightEv
 __ZNK7WebCore11RenderImage17isHeightSpecifiedEv
 __ZNK7WebCore9RenderBox23calcReplacedHeightUsingENS_6LengthE
 __ZNK7WebCore9RenderBox20calcContentBoxHeightEi
-__ZNK7WebCore12RenderObject9borderTopEv
-__ZNK7WebCore12RenderObject12borderBottomEv
-__ZNK7WebCore12RenderObject10paddingTopEv
-__ZNK7WebCore12RenderObject13paddingBottomEv
-__ZN3WTF6VectorIPN7WebCore20CachedResourceClientELm0EE6shrinkEm
+__ZNK7WebCore20RenderBoxModelObject9borderTopEv
+__ZNK7WebCore20RenderBoxModelObject12borderBottomEv
+__ZNK7WebCore20RenderBoxModelObject10paddingTopEb
+__ZNK7WebCore20RenderBoxModelObject13paddingBottomEb
+__ZN7WebCore20CachedResourceClient12imageChangedEPNS_11CachedImageEPKNS_7IntRectE
+-[WebCoreSharedBufferData dealloc]
+-[WebCoreSharedBufferData .cxx_destruct]
+__ZNK7WebCore9RenderBox12clientHeightEv
+__ZNK7WebCore9RenderBox25horizontalScrollbarHeightEv
+__ZN7WebCore12RenderObject16repaintRectangleERKNS_7IntRectEb
+__ZNK7WebCore12RenderObject11isBlockFlowEv
+__ZN7WebCore12RenderInline21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
 __ZN7WebCore11CachedImage11checkNotifyEv
+__ZN7WebCore11RenderImage14notifyFinishedEPNS_14CachedResourceE
 __ZN7WebCore15HTMLImageLoader14notifyFinishedEPNS_14CachedResourceE
-__ZN7WebCore8Document26dispatchImageLoadEventSoonEPNS_15HTMLImageLoaderE
-__ZN7WebCore20CachedResourceClient14notifyFinishedEPNS_14CachedResourceE
-__ZN7WebCore11FrameLoader8loadDoneEv
-__ZN7WebCore5Cache6removeEPNS_14CachedResourceE
-__ZN7WebCore5Cache34removeFromLiveDecodedResourcesListEPNS_14CachedResourceE
-__ZNK7WebCore9DocLoader20removeCachedResourceEPNS_14CachedResourceE
-__ZN7WebCore7RequestD2Ev
-__ZN7WebCore14DocumentLoader23removeSubresourceLoaderEPNS_14ResourceLoaderE
-__ZN7WebCore14ResourceLoader7didFailERKNS_13ResourceErrorE
-__ZN7WebCore11FrameLoader13didFailToLoadEPNS_14ResourceLoaderERKNS_13ResourceErrorE
-__ZNK7WebCore13ResourceErrorcvP7NSErrorEv
-__ZN7WebCore9RenderBox12imageChangedEPNS_11CachedImageE
-__ZNK7WebCore12RenderObject12avoidsFloatsEv
-__ZNK7WebCore9RenderBox28stretchesToMinIntrinsicWidthEv
-__ZN7WebCore9RenderBox21calcHorizontalMarginsERKNS_6LengthES3_i
-__ZNK7WebCore11CachedImage22usesImageContainerSizeEv
-__ZNK7WebCore11RenderImage20calcAspectRatioWidthEv
-__ZNK7WebCore11CachedImage22imageHasRelativeHeightEv
-__ZNK7WebCore11RenderImage21calcAspectRatioHeightEv
-__ZNK7WebCore9Tokenizer10wellFormedEv
-__ZN7WebCore8Document26dispatchImageLoadEventsNowEv
-__ZN7WebCore9TimerBase10heapPopMinEv
-__ZSt13__adjust_heapIN7WebCore17TimerHeapIteratorEiNS0_16TimerHeapElementEEvT_T0_S4_T1_
-__ZN3WTF6VectorIPN7WebCore9TimerBaseELm0EE6shrinkEm
-__ZN7WebCore21DeprecatedPtrListImpl6assignERKS0_b
-__ZN7WebCore21DeprecatedPtrListImpl4swapERS0_
-__ZN7WebCore15HTMLImageLoader17dispatchLoadEventEv
-__ZN7WebCore15EventTargetNode17dispatchHTMLEventERKNS_12AtomicStringEbb
-__ZN7WebCore8KJSProxy17finishedWithEventEPNS_5EventE
-__ZN3KJS17ScriptInterpreter15forgetDOMObjectEPv
-__ZN3KJS10domObjectsEv
-__ZN3WTF7HashMapIPvPN3KJS9DOMObjectENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS7_IS4_EEE4takeERKS1_
-__ZThn36_N7WebCore16HTMLInputElement23preDispatchEventHandlerEPNS_5EventE
-__ZN7WebCore16HTMLInputElement23preDispatchEventHandlerEPNS_5EventE
-__ZN7WebCore15HTMLFormElement17handleLocalEventsEPNS_5EventEb
-__ZThn36_N7WebCore15EventTargetNode6toNodeEv
-__ZN7WebCore15EventTargetNode6toNodeEv
-__ZThn36_N7WebCore16HTMLInputElement24postDispatchEventHandlerEPNS_5EventEPv
-__ZN7WebCore16HTMLInputElement24postDispatchEventHandlerEPNS_5EventEPv
-__ZN7WebCore16HTMLInputElement19defaultEventHandlerEPNS_5EventE
-__ZNK7WebCore5Event12isMouseEventEv
-__ZNK7WebCore5Event25isBeforeTextInsertedEventEv
-__ZN7WebCore11FrameLoader19handledOnloadEventsEv
+__ZN7WebCore11ImageLoader14notifyFinishedEPNS_14CachedResourceE
+__ZN7WebCoreL15loadEventSenderEv
+__ZN7WebCore20ImageLoadEventSenderC1Ev
+__ZN7WebCore20ImageLoadEventSenderC2Ev
+__ZN7WebCore20ImageLoadEventSender21dispatchLoadEventSoonEPNS_11ImageLoaderE
+__ZN3WTF6VectorIPN7WebCore11ImageLoaderELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore11ImageLoaderELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore11ImageLoaderELm0EE15reserveCapacityEm
+__ZN7WebCore5TimerINS_9FrameViewEE5firedEv
+__ZN7WebCore9FrameView16layoutTimerFiredEPNS_5TimerIS0_EE
 __ZN7WebCore9FrameView6layoutEb
-__ZN7WebCore15stopSharedTimerEv
+__ZNK7WebCore16CSSStyleSelector24affectedByViewportChangeEv
 __ZNK7WebCore5Frame18needsReapplyStylesEv
 __ZN7WebCore5Frame13reapplyStylesEv
 __ZN7WebCore5Frame17setUserStyleSheetERKNS_6StringE
 __ZN7WebCore8Document17setUserStyleSheetERKNS_6StringE
-__ZN7WebCore4Node11recalcStyleENS0_11StyleChangeE
-__ZN7WebCore10RenderText7setTextEN3WTF10PassRefPtrINS_10StringImplEEEb
+__ZN7WebCore11CSSRuleDataD2Ev
+__ZNK7WebCore19StyleBackgroundDataeqERKS0_
+__ZNK7WebCore17StyleSurroundDataeqERKS0_
+__ZN7WebCore15StyleVisualDataD1Ev
+__ZNK7WebCore25StyleRareNonInheritedDataeqERKS0_
+__ZN3WTFeqIN7WebCore20StyleDashboardRegionELm0EEEbRKNS_6VectorIT_XT0_EEES7_
+__ZNK7WebCore25StyleRareNonInheritedData20shadowDataEquivalentERKS0_
+__ZNK7WebCore25StyleRareNonInheritedData24reflectionDataEquivalentERKS0_
+__ZNK7WebCore25StyleRareNonInheritedData23animationDataEquivalentERKS0_
+__ZNK7WebCore25StyleRareNonInheritedData24transitionDataEquivalentERKS0_
+__ZNK7WebCore22StyleRareInheritedDataeqERKS0_
+__ZNK7WebCore22StyleRareInheritedData20shadowDataEquivalentERKS0_
+__ZNK7WebCore20StyleFlexibleBoxDataeqERKS0_
 __ZN7WebCore9FrameView23applyOverflowToViewportEPNS_12RenderObjectERNS_13ScrollbarModeES4_
-__ZNK7WebCore10ScrollView14vScrollbarModeEv
-__ZNK7WebCore6Widget6heightEv
-__ZNK7WebCore6Widget13frameGeometryEv
+__ZNK7WebCore6Widget9frameRectEv
 __ZNK7WebCore6Widget12getOuterViewEv
-__ZN7WebCore16enclosingIntRectERK7_NSRect
-__ZNK7WebCore6Widget5widthEv
-__ZN7WebCore10ScrollView17setVScrollbarModeENS_13ScrollbarModeE
-__ZN7WebCore10ScrollView17setHScrollbarModeENS_13ScrollbarModeE
-__ZNK7WebCore10ScrollView13visibleHeightEv
-__ZNK7WebCore10ScrollView12visibleWidthEv
-__ZN7WebCore9FrameView20pauseScheduledEventsEv
+__ZN7WebCore10ScrollView25platformSetScrollbarModesEv
+__ZNK7WebCore10ScrollView12layoutHeightEv
+__ZNK7WebCore10ScrollView11layoutWidthEv
+__ZN7WebCore9FrameView21beginDeferredRepaintsEv
 __ZN7WebCore10RenderView6layoutEv
-__ZN7WebCore12RenderObject19setChildNeedsLayoutEbb
+__ZNK7WebCore10RenderView9viewWidthEv
+__ZNK7WebCore10ScrollView14useFixedLayoutEv
 __ZN7WebCore11RenderBlock6layoutEv
 __ZN7WebCore11RenderBlock11layoutBlockEb
 __ZN7WebCore11RenderBlock27layoutOnlyPositionedObjectsEv
-__ZNK7WebCore12RenderObject27checkForRepaintDuringLayoutEv
-__ZNK7WebCore9FrameView16needsFullRepaintEv
 __ZNK7WebCore11RenderBlock18desiredColumnWidthEv
 __ZN7WebCore10RenderView9calcWidthEv
 __ZN7WebCore11RenderBlock15calcColumnWidthEv
 __ZN7WebCore11RenderBlock29setDesiredColumnCountAndWidthEii
 __ZN7WebCore11RenderBlock11clearFloatsEv
 __ZNK7WebCore11RenderBlock12avoidsFloatsEv
+__ZNK7WebCore9RenderBox12avoidsFloatsEv
 __ZNK7WebCore12RenderObject4isHREv
 __ZN7WebCore11RenderBlock19layoutBlockChildrenEbRi
-__ZNK7WebCore12RenderObject25horizontalScrollbarHeightEv
+__ZN7WebCore11RenderBlock10MarginInfoC1EPS0_ii
 __ZN7WebCore11RenderBlock10MarginInfoC2EPS0_ii
 __ZN7WebCore11RenderBlock12layoutLegendEb
 __ZNK7WebCore9RenderBox9marginTopEv
-__ZN7WebCore11RenderBlock18handleSpecialChildEPNS_12RenderObjectERKNS0_10MarginInfoERNS0_11CompactInfoERb
-__ZN7WebCore11RenderBlock21handlePositionedChildEPNS_12RenderObjectERKNS0_10MarginInfoERb
-__ZN7WebCore11RenderBlock19handleFloatingChildEPNS_12RenderObjectERKNS0_10MarginInfoERb
-__ZN7WebCore11RenderBlock18handleCompactChildEPNS_12RenderObjectERNS0_11CompactInfoERb
-__ZN7WebCore11RenderBlock16handleRunInChildEPNS_12RenderObjectERb
-__ZN7WebCore11RenderBlock24estimateVerticalPositionEPNS_12RenderObjectERKNS0_10MarginInfoE
-__ZN7WebCore9RenderBox6setPosEii
+__ZN7WebCore11RenderBlock18handleSpecialChildEPNS_9RenderBoxERKNS0_10MarginInfoERb
+__ZN7WebCore11RenderBlock21handlePositionedChildEPNS_9RenderBoxERKNS0_10MarginInfoERb
+__ZN7WebCore11RenderBlock19handleFloatingChildEPNS_9RenderBoxERKNS0_10MarginInfoERb
+__ZN7WebCore11RenderBlock16handleRunInChildEPNS_9RenderBoxERb
+__ZN7WebCore11RenderBlock24estimateVerticalPositionEPNS_9RenderBoxERKNS0_10MarginInfoE
+__ZN7WebCore11RenderBlock13getClearDeltaEPNS_9RenderBoxEi
 __ZNK7WebCore11RenderBlock11floatBottomEv
 __ZN7WebCore9RenderBox14calcWidthUsingENS_9WidthTypeEi
 __ZNK7WebCore9RenderBox21sizesToIntrinsicWidthENS_9WidthTypeE
 __ZNK7WebCore11RenderBlock26isInlineBlockOrInlineTableEv
 __ZNK7WebCore9RenderBox18calcBorderBoxWidthEi
+__ZNK7WebCore9RenderBox28stretchesToMinIntrinsicWidthEv
 __ZNK7WebCore11RenderBlock12maxTopMarginEb
-__ZNK7WebCore11RenderTable12avoidsFloatsEv
-__ZN7WebCore11RenderTable6layoutEv
-__ZN7WebCore11RenderTable9calcWidthEv
-__ZN7WebCore11RenderTable14calcPrefWidthsEv
-__ZN7WebCore11RenderTable23recalcHorizontalBordersEv
-__ZNK7WebCore11RenderTable14calcBorderLeftEv
-__ZNK7WebCore11RenderTable15calcBorderRightEv
-__ZN7WebCore15AutoTableLayout14calcPrefWidthsERiS1_
-__ZN7WebCore15AutoTableLayout10fullRecalcEv
-__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE6resizeEm
-__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE4fillERKS3_m
-__ZSt4fillIPN7WebCore15AutoTableLayout6LayoutES2_EvT_S4_RKT0_
-__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE4fillERKS3_m
-__ZSt4fillIPPN7WebCore15RenderTableCellES2_EvT_S4_RKT0_
-__ZN7WebCore15AutoTableLayout12recalcColumnEi
-__ZN7WebCore15RenderTableCell14calcPrefWidthsEv
-__ZN7WebCore11RenderBlock14calcPrefWidthsEv
-__ZN7WebCore11RenderBlock20calcInlinePrefWidthsEv
-__ZNK7WebCore11RenderTable10borderLeftEv
-__ZNK7WebCore11RenderTable11borderRightEv
-__ZN7WebCore20InlineMinMaxIterator4nextEv
-__ZNK7WebCore12RenderObject12isInlineFlowEv
-__ZNK7WebCore12RenderObject14isRenderInlineEv
-__ZNK7WebCore9RenderBox12maxPrefWidthEv
-__ZNK7WebCore15RenderTableCell15styleOrColWidthEv
-__ZN7WebCore11RenderBlock19calcBlockPrefWidthsEv
-__ZN7WebCore15AutoTableLayout18calcEffectiveWidthEv
-__ZN7WebCore15AutoTableLayout6layoutEv
-__ZN7WebCore11RenderTable13setCellWidthsEv
-__ZN7WebCore18RenderTableSection13setCellWidthsEv
-__ZN7WebCore15RenderTableCell8setWidthEi
-__ZN7WebCore15RenderContainer6layoutEv
-__ZN7WebCore14RenderTableRow6layoutEv
-__ZN7WebCore15RenderTableCell6layoutEv
-__ZNK7WebCore15RenderTableCell4yPosEv
-__ZN7WebCore15RenderTableCell9calcWidthEv
+__ZN7WebCore9RenderBox21calcHorizontalMarginsERKNS_6LengthES3_i
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore11RenderBlock14FloatingObjectEKNS_7HashMapIPNS1_12RenderObjectES4_NS_7PtrHashIS7_EENS_
+__ZN7WebCore11RenderBlock29markLinesDirtyInVerticalRangeEii
 __ZN7WebCore11RenderBlock20layoutInlineChildrenEbRiS1_
-__ZNK7WebCore15RenderTableCell9borderTopEv
-__ZNK7WebCore15RenderTableCell12borderBottomEv
-__ZN7WebCore9bidiFirstEPNS_11RenderBlockERNS_12BidiResolverINS_12BidiIteratorENS_7BidiRunEEEb
+__ZN7WebCoreL9bidiFirstEPNS_11RenderBlockEPNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEEb
+__ZNK7WebCore9RenderBox12marginBottomEv
+__ZNK7WebCore9RenderBox10marginLeftEv
+__ZNK7WebCore9RenderBox11marginRightEv
+__ZN3WTF6VectorIN7WebCore11RenderBlock13FloatWithRectELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN7WebCore11RenderBlock13FloatWithRectELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore11RenderBlock13FloatWithRectELm0EE15reserveCapacityEm
+__ZN7WebCore9RenderBox14dirtyLineBoxesEb
 __ZN7WebCore14RenderReplaced6layoutEv
+__ZNK7WebCore12RenderObject27checkForRepaintDuringLayoutEv
 __ZNK7WebCore11RenderImage21minimumReplacedHeightEv
-__ZN7WebCore14RenderReplaced26adjustOverflowForBoxShadowEv
-__ZN7WebCore8bidiNextEPNS_11RenderBlockEPNS_12RenderObjectERNS_12BidiResolverINS_12BidiIteratorENS_7BidiRunEEEbPb
-__ZN7WebCore11RenderBlock22determineStartPositionEbRNS_12BidiIteratorERNS_12BidiResolverIS1_NS_7BidiRunEEE
-__ZN7WebCore11RenderBlock17findNextLineBreakERNS_12BidiIteratorERNS_12BidiResolverIS1_NS_7BidiRunEEE
-__ZN7WebCore11RenderBlock14skipWhitespaceERNS_12BidiIteratorERNS_12BidiResolverIS1_NS_7BidiRunEEE
-__ZNK7WebCore11RenderBlock9lineWidthEi
+__ZN7WebCore14RenderReplaced36adjustOverflowForBoxShadowAndReflectEv
+__ZNK7WebCore12RenderObject9isCounterEv
+__ZN7WebCore10RenderText14dirtyLineBoxesEb
+__ZN7WebCore10RenderText15deleteTextBoxesEv
+__ZN7WebCore11RenderBlock22determineStartPositionERbS1_RNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERN3WTF6VectorINS0_1
+__ZN7WebCore11BidiContext6createEhN3WTF7Unicode9DirectionEbPS0_
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE23commitExplicitEmbeddingEv
+__ZN3WTF6VectorINS_7Unicode9DirectionELm8EE14shrinkCapacityEm
+__ZN7WebCore11RenderBlock17findNextLineBreakERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEEbPNS_6EClearE
+__ZN7WebCore11RenderBlock21skipLeadingWhitespaceERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEEb
+__ZNK7WebCore11RenderBlock9lineWidthEib
 __ZNK7WebCore11RenderBlock11rightOffsetEv
 __ZNK7WebCore11RenderBlock14rightRelOffsetEiibPi
 __ZNK7WebCore11RenderBlock10leftOffsetEv
 __ZNK7WebCore11RenderBlock13leftRelOffsetEiibPi
-__ZN7WebCore11RenderBlock20insertFloatingObjectEPNS_12RenderObjectE
-__ZNK7WebCore9RenderBox10marginLeftEv
-__ZNK7WebCore9RenderBox11marginRightEv
-__ZN7WebCore11RenderBlock17positionNewFloatsEv
-__ZN7WebCore21DeprecatedPtrListImpl4lastEv
-__ZNK7WebCore21DeprecatedPtrListImpl7getPrevEv
-__ZNK7WebCore9RenderBox12marginBottomEv
-__ZN7WebCore21DeprecatedPtrListImpl4nextEv
-__ZN7WebCore12BidiResolverINS_12BidiIteratorENS_7BidiRunEE10deleteRunsEv
-__ZN7WebCore11RenderBlock21checkLinesForOverflowEv
-__ZNK7WebCore11RenderBlock14hasLineIfEmptyEv
-__ZNK7WebCore11HTMLElement17isContentEditableEv
-__ZNK7WebCore5Frame17isContentEditableEv
-__ZNK7WebCore6Editor16clientIsEditableEv
-__ZNK7WebCore8Document12inDesignModeEv
-__ZNK7WebCore8Document14parentDocumentEv
-__ZN7WebCore11RenderBlock13layoutColumnsEi
-__ZN7WebCore11RenderBlock20hasOverhangingFloatsEv
-__ZNK7WebCore15RenderTableCell33expandsToEncloseOverhangingFloatsEv
-__ZNK7WebCore12RenderObject14hasControlClipEv
-__ZNK7WebCore11RenderBlock9floatRectEv
-__ZNK7WebCore14RenderReplaced12overflowRectEb
-__ZNK7WebCore9RenderBox9borderBoxEv
-__ZN7WebCore7IntRect5uniteERKS0_
-__ZN7WebCore11RenderBlock17addVisualOverflowERKNS_7IntRectE
-__ZN7WebCore11RenderBlock23layoutPositionedObjectsEb
-__ZN7WebCore11RenderBlock18positionListMarkerEv
-__ZN7WebCore9RenderBox14dirtyLineBoxesEbb
-__ZNK7WebCore12BidiIterator7currentEv
-__ZN7WebCore11inlineWidthEPNS_12RenderObjectEbb
-__ZN7WebCore11RenderBlock15bidiReorderLineERKNS_12BidiIteratorES3_RNS_12BidiResolverIS1_NS_7BidiRunEEE
-__ZN7WebCore12BidiResolverINS_12BidiIteratorENS_7BidiRunEE21createBidiRunsForLineERKS1_S5_bb
-__ZN7WebCore12BidiResolverINS_12BidiIteratorENS_7BidiRunEE9appendRunEv
+__ZN7WebCoreL11inlineWidthEPNS_12RenderObjectEbb
+__ZNK7WebCore4Font12isFixedPitchEv
+__ZNK7WebCore16FontFallbackList14determinePitchEPKNS_4FontE
+__ZNK7WebCore10RenderText11isWordBreakEv
+__ZNK7WebCore10RenderText5widthEjjRKNS_4FontEiPN3WTF7HashSetIPKNS_14SimpleFontDataENS4_7PtrHashIS8_EENS4_10HashTraitsIS8_EEEE
+__ZNK7WebCore10RenderText12maxPrefWidthEv
+__ZN7WebCore10RenderText14calcPrefWidthsEi
+__ZN7WebCore10RenderText14calcPrefWidthsEiRN3WTF7HashSetIPKNS_14SimpleFontDataENS1_7PtrHashIS5_EENS1_10HashTraitsIS5_EEEE
+__ZN7WebCore21nextBreakablePositionEPKtiib
+__ZN3WTF9HashTableIPKN7WebCore14SimpleFontDataES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E15deall
+__ZN7WebCoreL14checkMidpointsERNS_14InlineIteratorE
+__ZN7WebCoreL11addMidpointERKNS_14InlineIteratorE
+__ZN3WTF6VectorIN7WebCore14InlineIteratorELm0EE4growEm
+__ZN3WTF6VectorIN7WebCore14InlineIteratorELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore14InlineIteratorELm0EE15reserveCapacityEm
+__ZN7WebCore11RenderBlock15bidiReorderLineERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERKS2_
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE21createBidiRunsForLineERKS1_bb
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE9appendRunEv
 __ZNK7WebCore12RenderObject6lengthEv
-__ZN7WebCore19appendRunsForObjectEiiPNS_12RenderObjectERNS_12BidiResolverINS_12BidiIteratorENS_7BidiRunEEE
+__ZN7WebCoreL19appendRunsForObjectEiiPNS_12RenderObjectERNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEE
 __ZN7WebCore7BidiRunnwEmPNS_11RenderArenaE
-__ZN7WebCore11RenderBlock13constructLineERKNS_12BidiIteratorES3_
-__ZN7WebCore12RenderObject15createInlineBoxEbbb
+__ZNK7WebCore10RenderText6lengthEv
+__ZN7WebCore11RenderBlock13constructLineEjPNS_7BidiRunES2_bbPNS_12RenderObjectE
+__ZN7WebCore9RenderBox15createInlineBoxEv
 __ZN7WebCore9InlineBoxnwEmPNS_11RenderArenaE
-__ZN7WebCore11RenderBlock15createLineBoxesEPNS_12RenderObjectE
-__ZN7WebCore10RenderFlow15createInlineBoxEbbb
+__ZN7WebCore11RenderBlock15createLineBoxesEPNS_12RenderObjectEb
+__ZN7WebCore11RenderBlock19createRootInlineBoxEv
+__ZN7WebCore11RenderBlock13createRootBoxEv
+__ZN7WebCore17RenderLineBoxList13appendLineBoxEPNS_13InlineFlowBoxE
 __ZN7WebCore13InlineFlowBox9addToLineEPNS_9InlineBoxE
-__ZNK7WebCore9InlineBox6isTextEv
-__ZNK7WebCore14RenderReplaced14selectionStateEv
 __ZN7WebCore9InlineBox15isInlineTextBoxEv
 __ZN7WebCore13InlineFlowBox28determineSpacingForFlowBoxesEbPNS_12RenderObjectE
-__ZN7WebCore9InlineBox15isInlineFlowBoxEv
+__ZNK7WebCore9InlineBox15isInlineFlowBoxEv
 __ZN7WebCore13InlineFlowBox14setConstructedEv
 __ZN7WebCore9InlineBox14setConstructedEv
-__ZN7WebCore11RenderBlock33computeHorizontalPositionsForLineEPNS_13RootInlineBoxEb
+__ZN7WebCore11RenderBlock33computeHorizontalPositionsForLineEPNS_13RootInlineBoxEbPNS_7BidiRunES4_b
 __ZN7WebCore13InlineFlowBox19getFlowSpacingWidthEv
-__ZN7WebCore13InlineFlowBox23marginBorderPaddingLeftEv
-__ZN7WebCore13InlineFlowBox10marginLeftEv
-__ZN7WebCore13InlineFlowBox24marginBorderPaddingRightEv
-__ZN7WebCore13InlineFlowBox11marginRightEv
 __ZNK7WebCore9InlineBox11isLineBreakEv
 __ZN7WebCore13InlineFlowBox22placeBoxesHorizontallyEiRiS1_Rb
 __ZNK7WebCore14RenderReplaced12overflowLeftEb
 __ZNK7WebCore14RenderReplaced13overflowWidthEb
-__ZN7WebCore11RenderBlock31computeVerticalPositionsForLineEPNS_13RootInlineBoxE
-__ZN7WebCore13InlineFlowBox20verticallyAlignBoxesERi
+__ZN7WebCore11RenderBlock31computeVerticalPositionsForLineEPNS_13RootInlineBoxEPNS_7BidiRunE
+__ZN7WebCore13InlineFlowBox20verticallyAlignBoxesEi
 __ZN7WebCore13InlineFlowBox24computeLogicalBoxHeightsERiS1_S1_S1_b
-__ZN7WebCore13RootInlineBox15isRootInlineBoxEv
+__ZNK7WebCore13RootInlineBox15isRootInlineBoxEv
 __ZNK7WebCore11RenderBlock16baselinePositionEbb
 __ZNK7WebCore12RenderObject16baselinePositionEbb
 __ZNK7WebCore14RenderReplaced10lineHeightEbb
 __ZNK7WebCore14RenderReplaced16baselinePositionEbb
-__ZNK7WebCore12RenderObject20verticalPositionHintEb
-__ZNK7WebCore12RenderObject19getVerticalPositionEb
+__ZNK7WebCore20RenderBoxModelObject16verticalPositionEb
 __ZN7WebCore13InlineFlowBox20placeBoxesVerticallyEiiibRiS1_S1_S1_
 __ZNK7WebCore14RenderReplaced11overflowTopEb
 __ZNK7WebCore14RenderReplaced14overflowHeightEb
+__ZNK7WebCore9InlineBox6heightEv
 __ZN7WebCore13RootInlineBox28setVerticalOverflowPositionsEii
 __ZN7WebCore13RootInlineBox8OverflownwEmPNS_11RenderArenaE
 __ZN7WebCore13RootInlineBox29setVerticalSelectionPositionsEii
-__ZN7WebCore13InlineFlowBox29shrinkBoxesWithNoTextChildrenEii
-__ZN7WebCore13RootInlineBox14bottomOverflowEv
-__ZN7WebCore9RenderBox8positionEPNS_9InlineBoxE
+__ZNK7WebCore13RootInlineBox14bottomOverflowEv
+__ZN7WebCore9RenderBox15positionLineBoxEPNS_9InlineBoxE
 __ZN7WebCore13RootInlineBox36computePerCharacterLayoutInformationEv
-__ZN7WebCore7BidiRun7destroyEPNS_11RenderArenaE
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE10deleteRunsEv
+__ZN7WebCore7BidiRun7destroyEv
 __ZN7WebCore7BidiRundlEPvm
 __ZN7WebCore13RootInlineBox16setLineBreakInfoEPNS_12RenderObjectEjRKNS_10BidiStatusE
-__ZN7WebCore11RenderBlock7newLineEv
-__ZN7WebCore13RootInlineBox12leftOverflowEv
-__ZN7WebCore13RootInlineBox11topOverflowEv
-__ZN7WebCore13RootInlineBox13rightOverflowEv
-__ZN7WebCore18RenderTableSection13calcRowHeightEv
-__ZN3WTF6VectorIiLm0EE6resizeEm
-__ZNK7WebCore9RenderBox12overrideSizeEv
-__ZN7WebCore18RenderTableSection10layoutRowsEi
-__ZN7WebCore9RenderBox8setWidthEi
-__ZN7WebCore9RenderBox9setHeightEi
-__ZNK7WebCore15RenderTableCell14borderTopExtraEv
-__ZNK7WebCore15RenderTableCell17borderBottomExtraEv
-__ZNK7WebCore11RenderTable9borderTopEv
-__ZNK7WebCore11RenderTable12borderBottomEv
-__ZNK7WebCore18RenderTableSection12overflowLeftEb
-__ZNK7WebCore18RenderTableSection13overflowWidthEb
-__ZNK7WebCore18RenderTableSection11overflowTopEb
-__ZNK7WebCore18RenderTableSection14overflowHeightEb
-__ZNK7WebCore11RenderTable12sectionBelowEPKNS_18RenderTableSectionEb
-__ZN7WebCore11RenderBlock15collapseMarginsEPNS_12RenderObjectERNS0_10MarginInfoEi
+__ZN7WebCore11RenderBlock7newLineENS_6EClearE
+__ZN7WebCore11RenderBlock17positionNewFloatsEv
+__ZN7WebCore11RenderBlock21checkLinesForOverflowEv
+__ZNK7WebCore13RootInlineBox12leftOverflowEv
+__ZNK7WebCore13RootInlineBox11topOverflowEv
+__ZNK7WebCore13RootInlineBox13rightOverflowEv
+__ZN7WebCore11RenderBlock13layoutColumnsEi
+__ZN7WebCore9RenderBox15calcHeightUsingERKNS_6LengthE
+__ZNK7WebCore9RenderBox19calcBorderBoxHeightEi
+__ZN7WebCore11RenderBlock23layoutPositionedObjectsEb
+__ZN7WebCore11RenderBlock18positionListMarkerEv
+__ZNK7WebCore9RenderBox14hasControlClipEv
+__ZN7WebCore11RenderBlock15collapseMarginsEPNS_9RenderBoxERNS0_10MarginInfoE
 __ZNK7WebCore11RenderBlock21isSelfCollapsingBlockEv
-__ZNK7WebCore11RenderBlock16isTopMarginQuirkEv
+__ZN7WebCore11RenderBlock16setMaxTopMarginsEii
 __ZNK7WebCore11RenderBlock15maxBottomMarginEb
-__ZN7WebCore11RenderBlock19clearFloatsIfNeededEPNS_12RenderObjectERNS0_10MarginInfoEii
-__ZN7WebCore11RenderBlock13getClearDeltaEPNS_12RenderObjectE
-__ZN7WebCore11RenderBlock14containsFloatsEv
-__ZN7WebCore11RenderBlock27determineHorizontalPositionEPNS_12RenderObjectE
-__ZN7WebCore11RenderBlock20addOverhangingFloatsEPS0_iib
-__ZN7WebCore11RenderBlock21insertCompactIfNeededEPNS_12RenderObjectERNS0_11CompactInfoE
+__ZN7WebCore11RenderBlock19clearFloatsIfNeededEPNS_9RenderBoxERNS0_10MarginInfoEiii
+__ZN7WebCore11RenderBlock27determineHorizontalPositionEPNS_9RenderBoxE
+__ZNK7WebCore20RenderBoxModelObject20hasSelfPaintingLayerEv
+__ZN7WebCore11RenderBlock22insertPositionedObjectEPNS_9RenderBoxE
+__ZN3WTF11ListHashSetIPN7WebCore9RenderBoxENS_7PtrHashIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore9RenderBoxEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunction
+__ZN3WTF11ListHashSetIPN7WebCore9RenderBoxENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
+__ZNK7WebCore11RenderBlock14hasLineIfEmptyEv
+__ZNK7WebCore11HTMLElement17isContentEditableEv
+__ZN7WebCore9RenderBox22calcAbsoluteHorizontalEv
+__ZNK7WebCore9RenderBox33containingBlockWidthForPositionedEPKNS_20RenderBoxModelObjectE
+__ZN7WebCore9RenderBox28calcAbsoluteHorizontalValuesENS_6LengthEPKNS_20RenderBoxModelObjectENS_13TextDirectionEiiS1_S1_S1_S1_Ri
+__ZN7WebCoreL24fontDataForGenericFamilyEPNS_8DocumentERKNS_15FontDescriptionERKNS_12AtomicStringE
+__ZN7WebCoreeqERKNS_12AtomicStringEPKc
 __ZN7WebCore11RenderBlock19handleBottomOfBlockEiiRNS0_10MarginInfoE
 __ZN7WebCore11RenderBlock24setCollapsedBottomMarginERKNS0_10MarginInfoE
-__ZN7WebCore11RenderBlock16setMaxTopMarginsEii
-__ZN7WebCore10RenderText14dirtyLineBoxesEbb
-__ZNK7WebCore10RenderText6lengthEv
-__ZN7WebCore8RenderBR15createInlineBoxEbbb
-__ZN7WebCore10RenderText15createInlineBoxEbbb
+__ZN7WebCore9RenderBox20calcAbsoluteVerticalEv
+__ZNK7WebCore9RenderBox34containingBlockHeightForPositionedEPKNS_20RenderBoxModelObjectE
+__ZN7WebCore9RenderBox26calcAbsoluteVerticalValuesENS_6LengthEPKNS_20RenderBoxModelObjectEiiS1_S1_S1_S1_RiS5_S5_S5_
+__ZNK7WebCore11RenderBlock9floatRectEv
+__ZN7WebCore11RenderBlock17addVisualOverflowERKNS_7IntRectE
+__ZNK7WebCore9RenderBox12maxPrefWidthEv
+__ZN7WebCore11RenderBlock14calcPrefWidthsEv
+__ZN7WebCore11RenderBlock20calcInlinePrefWidthsEv
+__ZN7WebCore20InlineMinMaxIterator4nextEv
+__ZNK7WebCore12RenderInline10marginLeftEv
+__ZN7WebCoreL11getBPMWidthEiNS_6LengthE
+__ZN7WebCore10RenderText17trimmedPrefWidthsEiRiRbS1_S2_S2_S2_S1_S1_S1_S1_S2_
+__ZL12betterChoicemimimi
+__ZNK7WebCore12RenderInline11marginRightEv
+__ZN7WebCore12RenderInline14dirtyLineBoxesEb
+__ZN7WebCoreL22getBorderPaddingMarginEPNS_20RenderBoxModelObjectEb
 __ZN7WebCore10RenderText19createInlineTextBoxEv
-__ZNK7WebCore13InlineTextBox6isTextEv
+__ZN7WebCore10RenderText13createTextBoxEv
+__ZN7WebCore12RenderInline19createInlineFlowBoxEv
+__ZN7WebCore12RenderInline13createFlowBoxEv
 __ZN7WebCore13InlineTextBox15isInlineTextBoxEv
+__ZNK7WebCore13InlineFlowBox15isInlineFlowBoxEv
+__ZNK7WebCore13InlineFlowBox17rendererLineBoxesEv
+__ZNK7WebCore9InlineBox16nextOnLineExistsEv
 __ZNK7WebCore13InlineTextBox11isLineBreakEv
+__ZNK7WebCore10RenderText5widthEjjibPN3WTF7HashSetIPKNS_14SimpleFontDataENS1_7PtrHashIS5_EENS1_10HashTraitsIS5_EEEE
+__ZNK7WebCore12RenderInline10lineHeightEbb
+__ZNK7WebCore12RenderInline25verticalPositionFromCacheEb
+__ZNK7WebCore9InlineBox15isRootInlineBoxEv
+__ZN7WebCore13InlineTextBox17takeFallbackFontsERN3WTF6VectorIPKNS_14SimpleFontDataELm0EEE
+__ZNK7WebCore10RenderText10lineHeightEbb
 __ZNK7WebCore8RenderBR10lineHeightEbb
+__ZNK7WebCore12RenderObject10lineHeightEbb
 __ZNK7WebCore8RenderBR16baselinePositionEbb
-__ZNK7WebCore10RenderText20verticalPositionHintEb
-__ZN7WebCore10RenderText8positionEPNS_9InlineBoxE
-__ZN7WebCore9RenderBox15calcHeightUsingERKNS_6LengthE
-__ZNK7WebCore9RenderBox19calcBorderBoxHeightEi
-__ZNK7WebCore11RenderTable10colElementEiPbS1_
-__ZN7WebCore10RenderFlow14dirtyLineBoxesEbb
-__ZN7WebCore22getBorderPaddingMarginEPNS_12RenderObjectEb
-__ZN7WebCore21nextBreakablePositionEPKtiib
-__ZNK7WebCore10RenderText5widthEjjRKNS_4FontEi
-__ZNK7WebCore4Font12isFixedPitchEv
-__ZNK7WebCore16FontFallbackList14determinePitchEPKNS_4FontE
-__Z12betterChoicejijiji
-__ZNK7WebCore12RenderObject14selectionStateEv
-__ZN7WebCore13InlineFlowBox15isInlineFlowBoxEv
-__ZNK7WebCore9InlineBox16nextOnLineExistsEv
+__ZN7WebCore10RenderText15positionLineBoxEPNS_9InlineBoxE
+__ZN7WebCore17lineBreakIteratorEPKti
+__ZN7WebCoreL13setUpIteratorERbRPNS_17TextBreakIteratorE18UBreakIteratorTypePKti
+__ZN7WebCore24currentTextBreakLocaleIDEv
+__ZN7WebCore18textBreakFollowingEPNS_17TextBreakIteratorEi
+__ZN7WebCore9FontCache26getSimilarFontPlatformDataERKNS_4FontE
+__ZN3WTF7HashSetIPKN7WebCore14SimpleFontDataENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableIPKN7WebCore14SimpleFontDataES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6expand
+__ZN3WTF9HashTableIPKN7WebCore14SimpleFontDataES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6rehash
+__ZN3WTF9HashTableIPKN7WebCore14SimpleFontDataES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E13alloc
+__ZN7WebCore13WidthIterator21normalizeVoicingMarksEi
+__ZN7WebCore13InlineTextBox16setFallbackFontsERKN3WTF7HashSetIPKNS_14SimpleFontDataENS1_7PtrHashIS5_EENS1_10HashTraitsIS5_EEEE
+__ZN3WTF7HashMapIPN7WebCore13InlineTextBoxENS_6VectorIPKNS1_14SimpleFontDataELm0EEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSB_IS
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm0EEC1ERKS5_
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm0EEC2ERKS5_
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm0EEaSERKS5_
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm0EE15reserveCapacityEm
+__ZN3WTF9HashTableIPN7WebCore13InlineTextBoxESt4pairIS3_NS_6VectorIPKNS1_14SimpleFontDataELm0EEEENS_18PairFirstExtractorISA_EEN
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm0EE6shrinkEm
 __ZN7WebCore13InlineFlowBox10onEndChainEPNS_12RenderObjectE
-__ZNK7WebCore10RenderText5widthEjjib
-__ZNK7WebCore10RenderText12maxPrefWidthEv
-__ZN7WebCore10RenderText14calcPrefWidthsEi
-__ZN7WebCore9InlineBox15isRootInlineBoxEv
-__ZNK7WebCore10RenderText10lineHeightEbb
-__ZN7WebCore15HTMLFormElement11isMalformedEv
+__ZNK7WebCore14RenderFieldset12avoidsFloatsEv
+__ZNK7WebCore14RenderFieldset28stretchesToMinIntrinsicWidthEv
+__ZN7WebCore14RenderFieldset14calcPrefWidthsEv
 __ZN7WebCore17RenderTextControl14calcPrefWidthsEv
 __ZNK7WebCore12RenderObject7isImageEv
-__ZN7WebCore15AutoTableLayout14insertSpanCellEPNS_15RenderTableCellE
-__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE4growEm
-__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE15reserveCapacityEm
-__ZN7WebCore11getBPMWidthEiNS_6LengthE
-__ZNK7WebCore10RenderFlow11isWordBreakEv
-__ZNK7WebCore12RenderInline14isRenderInlineEv
-__ZN7WebCore10RenderText17trimmedPrefWidthsEiRiRbS1_S2_S2_S2_S1_S1_S1_S1_S2_
-__ZN7WebCore17RenderTextControl6layoutEv
+__ZN7WebCore14RenderMenuList14calcPrefWidthsEv
+__ZNK7WebCore14RenderThemeMac19minimumMenuListSizeEPNS_11RenderStyleE
+__ZNK7WebCore14RenderThemeMac13menuListSizesEv
+__ZNK7WebCore14RenderThemeMac17sizeForSystemFontEPNS_11RenderStyleEPKNS_7IntSizeE
+__ZNK7WebCore14RenderThemeMac24controlSizeForSystemFontEPNS_11RenderStyleE
+__ZN7WebCore17RenderFlexibleBox14calcPrefWidthsEv
+__ZN7WebCore17RenderFlexibleBox24calcHorizontalPrefWidthsEv
+__ZNK7WebCore14RenderFieldset10findLegendEv
+__ZN7WebCore27RenderTextControlSingleLine6layoutEv
 __ZN7WebCore17RenderTextControl10calcHeightEv
+__ZNK7WebCore4Node9renderBoxEv
+__ZN7WebCore27RenderTextControlSingleLine36adjustControlHeightBasedOnLineHeightEi
+__ZNK7WebCore17RenderTextControl16innerTextElementEv
+__ZNK7WebCore17RenderTextControl15textBlockHeightEv
+__ZNK7WebCore27RenderTextControlSingleLine14textBlockWidthEv
+__ZNK7WebCore17RenderTextControl14textBlockWidthEv
 __ZNK7WebCore17RenderTextControl12avoidsFloatsEv
 __ZNK7WebCore4Node19rootEditableElementEv
 __ZN7WebCore11RenderLayer27updateScrollInfoAfterLayoutEv
 __ZN7WebCore11RenderLayer23computeScrollDimensionsEPbS1_
-__ZNK7WebCore12RenderObject12clientHeightEv
 __ZNK7WebCore11RenderBlock17rightmostPositionEbb
-__ZNK7WebCore10RenderFlow17rightmostPositionEbb
 __ZNK7WebCore11RenderBlock14lowestPositionEbb
-__ZNK7WebCore10RenderFlow14lowestPositionEbb
 __ZN7WebCore11RenderLayer11scrollWidthEv
 __ZN7WebCore11RenderLayer12scrollHeightEv
-__ZNK7WebCore17RenderTextControl14hasControlClipEv
-__ZNK7WebCore11RenderBlock14selectionStateEv
-__ZNK7WebCore17RenderTextControl16baselinePositionEbb
-__ZNK7WebCore11RenderTheme18isControlContainerENS_11EAppearanceE
-__ZNK7WebCore11RenderBlock24getBaselineOfLastLineBoxEv
-__ZN7WebCore25inlineFlowRequiresLineBoxEPNS_12RenderObjectE
-__ZN7WebCore11RenderBlock19setMaxBottomMarginsEii
-__ZNK7WebCore11RenderBlock19isBottomMarginQuirkEv
-__ZN7WebCore14RenderMenuList14calcPrefWidthsEv
-__ZNK7WebCore14RenderThemeMac19minimumMenuListSizeEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac13menuListSizesEv
-__ZNK7WebCore14RenderThemeMac17sizeForSystemFontEPNS_11RenderStyleEPKNS_7IntSizeE
-__ZNK7WebCore14RenderThemeMac24controlSizeForSystemFontEPNS_11RenderStyleE
+__ZNK7WebCore27RenderTextControlSingleLine14hasControlClipEv
 __ZN7WebCore17RenderFlexibleBox11layoutBlockEb
 __ZN7WebCore17RenderFlexibleBox19layoutHorizontalBoxEb
 __ZN7WebCore9RenderBox15setOverrideSizeEi
 __ZNK7WebCore17RenderFlexibleBox13isFlexibleBoxEv
 __ZNK7WebCore17RenderFlexibleBox20isStretchingChildrenEv
-__ZN7WebCore17RenderFlexibleBox10placeChildEPNS_12RenderObjectEii
-__ZN7WebCore17RenderFlexibleBox16allowedChildFlexEPNS_12RenderObjectEbj
+__ZN7WebCore15FlexBoxIterator4nextEv
+__ZN7WebCore17RenderFlexibleBox10placeChildEPNS_9RenderBoxEii
+__ZN7WebCore17RenderFlexibleBox16allowedChildFlexEPNS_9RenderBoxEbj
 __ZNK7WebCore9RenderBox13overrideWidthEv
-__ZNK3WTF7HashMapIPKN7WebCore9RenderBoxEiNS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS7_IiEEE3getERKS4_
+__ZN3WTF7HashMapIPKN7WebCore9RenderBoxEiNS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS7_IiEEE3setERKS4_RKi
+__ZN3WTF9HashTableIPKN7WebCore9RenderBoxESt4pairIS4_iENS_18PairFirstExtractorIS6_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10Ha
 __ZNK7WebCore17RenderFlexibleBox17isFlexingChildrenEv
+__ZNK7WebCore9RenderBox12overrideSizeEv
+__ZNK3WTF7HashMapIPKN7WebCore9RenderBoxEiNS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS7_IiEEE3getERKS4_
 __ZN7WebCore13RootInlineBox7destroyEPNS_11RenderArenaE
 __ZN7WebCore13RootInlineBox17detachEllipsisBoxEPNS_11RenderArenaE
 __ZN7WebCore9InlineBox7destroyEPNS_11RenderArenaE
+__ZN7WebCore13RootInlineBoxD0Ev
 __ZN7WebCore9InlineBoxdlEPvm
-__ZN7WebCore13InlineTextBoxD1Ev
+__ZN7WebCore13InlineTextBoxD0Ev
 __ZNK7WebCore14RenderMenuList14hasControlClipEv
-__ZN7WebCore11addMidpointERKNS_12BidiIteratorE
-__ZN3WTF6VectorIN7WebCore12BidiIteratorELm0EE4growEm
-__ZN3WTF6VectorIN7WebCore12BidiIteratorELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore12BidiIteratorELm0EE15reserveCapacityEm
-__ZN7WebCore17lineBreakIteratorEPKti
-__ZN7WebCore13setUpIteratorERbRPNS_17TextBreakIteratorE18UBreakIteratorTypePKti
-__ZN7WebCore24currentTextBreakLocaleIDEv
-__ZN7WebCore18textBreakFollowingEPNS_17TextBreakIteratorEi
-__ZNK7WebCore12RenderObject18collapsedMarginTopEv
-__ZNK7WebCore12RenderObject21collapsedMarginBottomEv
+__ZNK7WebCore12RenderButton14hasControlClipEv
+__ZNK7WebCore11RenderTheme18isControlContainerENS_11ControlPartE
+__ZNK7WebCore11RenderBlock19lastLineBoxBaselineEv
+__ZN7WebCore13InlineFlowBox25adjustMaxAscentAndDescentERiS1_ii
+__ZN7WebCore11RenderBlock19setMaxBottomMarginsEii
+__ZNK7WebCore9RenderBox17rightmostPositionEbb
+__ZNK7WebCore20RenderBoxModelObject23relativePositionOffsetXEv
+__ZNK7WebCore9RenderBox14lowestPositionEbb
+__ZNK7WebCore20RenderBoxModelObject23relativePositionOffsetYEv
+__ZNK7WebCore4Font24floatWidthForComplexTextERKNS_7TextRunEPN3WTF7HashSetIPKNS_14SimpleFontDataENS4_7PtrHashIS8_EENS4_10HashTra
+__ZN7WebCore18CoreTextControllerC1EPKNS_4FontERKNS_7TextRunEbPN3WTF7HashSetIPKNS_14SimpleFontDataENS7_7PtrHashISB_EENS7_10HashT
+__ZN7WebCore18CoreTextControllerC2EPKNS_4FontERKNS_7TextRunEbPN3WTF7HashSetIPKNS_14SimpleFontDataENS7_7PtrHashISB_EENS7_10HashT
+__ZN7WebCore18CoreTextController19collectCoreTextRunsEv
+__ZN7WebCore18CoreTextController32collectCoreTextRunsForCharactersEPKtjjPKNS_14SimpleFontDataE
+__ZNK7WebCore14SimpleFontData21getCFStringAttributesEv
+__ZNK7WebCore14SimpleFontData9getCTFontEv
+__ZNK7WebCore16FontPlatformData15allowsLigaturesEv
+__ZN7WebCore18CoreTextController11CoreTextRunC1EPK7__CTRunPKNS_14SimpleFontDataEPKtjm
+__ZN7WebCore18CoreTextController11CoreTextRunC2EPK7__CTRunPKNS_14SimpleFontDataEPKtjm
+__ZN7WebCore18CoreTextController23adjustGlyphsAndAdvancesEv
+__ZNK7WebCore16FontPlatformData19roundsGlyphAdvancesEv
+__ZN3WTF6VectorItLm256EE6shrinkEm
+__ZN3WTF6VectorI6CGSizeLm256EE6shrinkEm
+__ZN3WTF6VectorIN7WebCore18CoreTextController11CoreTextRunELm16EE6shrinkEm
+__ZN7WebCore18CoreTextController11CoreTextRunC1EPKNS_14SimpleFontDataEPKtjmb
+__ZN7WebCore18CoreTextController11CoreTextRunC2EPKNS_14SimpleFontDataEPKtjmb
+__ZN3WTF6VectorIlLm16EE6shrinkEm
+__ZN3WTF6VectorItLm256EE4fillERKtm
+__ZSt4fillIPttEvT_S1_RKT0_
+__ZN3WTF6VectorI6CGSizeLm256EE4fillERKS1_m
+__ZSt4fillIP6CGSizeS0_EvT_S2_RKT0_
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE5embedEN3WTF7Unicode9DirectionE
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE27raiseExplicitEmbeddingLevelEN3WTF7Unicode9DirectionES6_
+__ZN3WTF6VectorINS_7Unicode9DirectionELm8EE6shrinkEm
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE27lowerExplicitEmbeddingLevelEN3WTF7Unicode9DirectionE
+__ZN3WTF10RefCountedIN7WebCore11BidiContextEE5derefEv
+__ZN7WebCore12BidiResolverINS_14InlineIteratorENS_7BidiRunEE11reverseRunsEjj
+__ZNK7WebCore9InlineBox16prevOnLineExistsEv
+__ZN7WebCore11RenderBlock20insertFloatingObjectEPNS_9RenderBoxE
+__ZN7WebCore21DeprecatedPtrListImplC1EPFvPvE
+__ZN7WebCore21DeprecatedPtrListImplC2EPFvPvE
+__ZN7WebCore21DeprecatedPtrListImpl6appendEPKv
+__ZN7WebCore21DeprecatedPtrListImpl6insertEjPKv
+__ZN7WebCore21DeprecatedPtrListImpl4lastEv
+__ZNK7WebCore21DeprecatedPtrListImpl7currentEv
+__ZNK7WebCore21DeprecatedPtrListImpl7getPrevEv
+__ZN7WebCore29DeprecatedPtrListImplIteratorC1ERKNS_21DeprecatedPtrListImplE
+__ZN7WebCore29DeprecatedPtrListImplIteratorC2ERKNS_21DeprecatedPtrListImplE
+__ZNK7WebCore21DeprecatedPtrListImpl11addIteratorEPNS_29DeprecatedPtrListImplIteratorE
+__ZNK7WebCore29DeprecatedPtrListImplIterator7currentEv
+__ZN7WebCore29DeprecatedPtrListImplIteratorppEv
+__ZN7WebCore29DeprecatedPtrListImplIteratorD1Ev
+__ZN7WebCore29DeprecatedPtrListImplIteratorD2Ev
+__ZNK7WebCore21DeprecatedPtrListImpl14removeIteratorEPNS_29DeprecatedPtrListImplIteratorE
+__ZN7WebCore21DeprecatedPtrListImpl4nextEv
+__ZN3WTF6VectorIN7WebCore11RenderBlock13FloatWithRectELm0EE6shrinkEm
+__ZNK7WebCore11RenderBlock33expandsToEncloseOverhangingFloatsEv
+__ZNK7WebCore12RenderObject10isFieldsetEv
+__ZN7WebCore11RenderBlock20addOverhangingFloatsEPS0_iib
+__ZN7WebCore11RenderBlock13containsFloatEPNS_12RenderObjectE
+__ZNK7WebCore12RenderObject26enclosingSelfPaintingLayerEv
+__ZN7WebCore11RenderBlock37markAllDescendantsWithFloatsForLayoutEPNS_9RenderBoxEb
+__ZN7WebCore11RenderBlock18addIntrudingFloatsEPS0_ii
+__ZN7WebCore21DeprecatedPtrListImpl5firstEv
+__ZNK3WTF7HashMapIPN7WebCore12RenderObjectEPNS1_11RenderBlock14FloatingObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE
+__ZN7WebCore7IntRect5uniteERKS0_
 __ZN7WebCore10RenderView10calcHeightEv
-__ZN7WebCore10RenderView20hasOverhangingFloatsEv
+__ZNK7WebCore10RenderView10viewHeightEv
 __ZN7WebCore11RenderBlock16setOverflowWidthEi
 __ZN7WebCore11RenderBlock17setOverflowHeightEi
 __ZNK7WebCore10RenderView8docWidthEv
-__ZNK7WebCore18RenderTableSection17rightmostPositionEbb
-__ZNK7WebCore9RenderBox17rightmostPositionEbb
 __ZNK7WebCore10RenderView9docHeightEv
-__ZNK7WebCore18RenderTableSection14lowestPositionEbb
-__ZNK7WebCore9RenderBox14lowestPositionEbb
+__ZNK7WebCore9RenderBox15availableHeightEv
+__ZNK7WebCore9RenderBox20availableHeightUsingERKNS_6LengthE
+__ZN7WebCore9FrameView19endDeferredRepaintsEv
+__ZNK7WebCore9FrameView28adjustedDeferredRepaintDelayEv
+__ZN7WebCore9FrameView18doDeferredRepaintsEv
+__ZNK7WebCore10ScrollView11isOffscreenEv
+__ZNK7WebCore10ScrollView19platformIsOffscreenEv
+__ZN7WebCore9FrameView26updateDeferredRepaintDelayEv
 __ZN7WebCore5Frame19invalidateSelectionEv
 __ZN7WebCore19SelectionController14setNeedsLayoutEb
-__ZN7WebCore5Frame22selectionLayoutChangedEv
-__ZN7WebCore19SelectionController18recomputeCaretRectEv
-__ZNK7WebCore19SelectionController9caretRectEv
-__ZN7WebCore19SelectionController6layoutEv
-__ZNK7WebCore5Frame8rendererEv
-__ZN7WebCore10RenderView14clearSelectionEv
-__ZN7WebCore10RenderView12setSelectionEPNS_12RenderObjectEiS2_i
 __ZN7WebCore9FrameView14adjustViewSizeEv
--[WebCoreFrameBridge forceLayoutAdjustingViewSize:]
-__ZN7WebCore5Frame11forceLayoutEb
-__ZN7WebCore17DeprecatedPtrListINS_11RenderBlock14FloatingObjectEE10deleteFuncEPv
-__ZN7WebCore13RootInlineBox8Overflow7destroyEPNS_11RenderArenaE
-__ZN7WebCore13RootInlineBox8OverflowdlEPvm
-__ZN7WebCore13InlineFlowBoxD1Ev
+__ZN7WebCore10ScrollView23platformSetContentsSizeEv
 __ZN7WebCore11RenderLayer20updateLayerPositionsEbb
-__ZN7WebCore9FrameView16repaintRectangleERKNS_7IntRectEb
-__ZN7WebCore10ScrollView14updateContentsERKNS_7IntRectEb
-__ZNK7WebCore10ScrollView18visibleContentRectEv
-__ZN7WebCore9FloatRectC1ERK7_NSRect
-__ZN7WebCore10FloatPointC2ERK8_NSPoint
-__ZN7WebCore9FloatSizeC2ERK7_NSSize
-__ZNK7WebCore9FloatRectcv7_NSRectEv
-__ZNK7WebCore7IntRectcv7_NSRectEv
+__ZN7WebCore9FrameView23repaintContentRectangleERKNS_7IntRectEb
+__ZN3WTF6VectorIN7WebCore7IntRectELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore7IntRectELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore7IntRectELm0EE15reserveCapacityEm
 __ZN7WebCore11RenderLayer19updateLayerPositionEv
-__ZN7WebCore11RenderLayer24positionOverflowControlsEv
+__ZNK7WebCore11RenderLayer20convertToLayerCoordsEPKS0_RiS3_
+__ZN7WebCore11RenderLayer24positionOverflowControlsEii
 __ZN7WebCore11RenderLayer15updateTransformEv
-__ZNK7WebCore12RenderObject18absoluteOutlineBoxEv
-__ZNK7WebCore10RenderView16absolutePositionERiS1_b
+__ZNK7WebCore9RenderBox23outlineBoundsForRepaintEPNS_20RenderBoxModelObjectE
+__ZNK7WebCore9RenderBox17borderBoundingBoxEv
 __ZNK7WebCore12RenderObject29adjustRectForOutlineAndShadowERNS_7IntRectE
-__ZN7WebCore11RenderLayer20subtractScrollOffsetERiS1_
-__ZNK7WebCore9RenderBox16absolutePositionERiS1_b
-__ZNK7WebCore15RenderTableCell16absolutePositionERiS1_b
+__ZNK7WebCore11RenderBlock22outlineStyleForRepaintEv
+__ZNK7WebCore12RenderObject20localToContainerQuadERKNS_9FloatQuadEPNS_20RenderBoxModelObjectEb
+__ZNK7WebCore10RenderView19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore14TransformState7flattenEv
+__ZNK7WebCore9FloatQuad11boundingBoxEv
+__ZNK7WebCore11RenderLayer29subtractScrolledContentOffsetERiS1_
+__ZNK7WebCore9RenderBox19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZNK7WebCore9RenderBox19offsetFromContainerEPNS_12RenderObjectE
+__ZNK7WebCore12RenderObject31shouldUseTransformFromContainerEPKS0_
+__ZN7WebCore14TransformState4moveEiiNS0_21TransformAccumulationE
+__ZNK7WebCore11RenderLayer27enclosingPositionedAncestorEv
+__ZN7WebCore10ScrollView23repaintContentRectangleERKNS_7IntRectEb
+__ZN7WebCore10ScrollView31platformRepaintContentRectangleERKNS_7IntRectEb
+__ZNK7WebCore7IntRectcv6CGRectEv
+__ZN3WTF6VectorIN7WebCore7IntRectELm0EE6shrinkEm
 __ZN7WebCore9FrameView22updateDashboardRegionsEv
 __ZNK7WebCore9FrameView15useSlowRepaintsEv
 __ZN7WebCore9FrameView22performPostLayoutTasksEv
-__ZN7WebCore10RenderView21updateWidgetPositionsEv
-__ZN7WebCore9FrameView21resumeScheduledEventsEv
-__ZNK7WebCore9FrameView11needsLayoutEv
 __ZN7WebCore11FrameLoader14didFirstLayoutEv
-__ZN7WebCore9FrameView23dispatchScheduledEventsEv
-__ZN7WebCore8Document13svgExtensionsEv
-__ZNK7WebCore14DocumentLoader16isLoadingPlugInsEv
-__ZNK7WebCore8Document16isPluginDocumentEv
-__ZNK7WebCore8Document15isImageDocumentEv
-+[WebScriptObject initialize]
-+[DOMDocument(WebCoreInternal) _wrapDocument:]
-+[DOMNode(WebCoreInternal) _wrapNode:]
-__ZN7WebCore13getDOMWrapperEP17DOMObjectInternal
--[DOMNode(WebCoreInternal) _initWithNode:]
--[DOMObject(WebCoreInternal) _init]
--[WebScriptObject(WebScriptObjectInternal) _init]
-__ZN7WebCore13addDOMWrapperEP8NSObjectP17DOMObjectInternal
-__ZNK3WTF7HashMapIP17DOMObjectInternalP8NSObjectNS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS7_IS4_EEE3getERKS2_
--[DOMDocument getElementsByTagName:]
-__ZN7WebCore4Node20getElementsByTagNameERKNS_6StringE
-__ZN7WebCore4Node22getElementsByTagNameNSERKNS_6StringES3_
-__ZN7WebCore11TagNodeListC2EN3WTF10PassRefPtrINS_4NodeEEERKNS_12AtomicStringES7_
-__ZN7WebCore15DynamicNodeListC2EN3WTF10PassRefPtrINS_4NodeEEEb
-__ZN7WebCore15DynamicNodeList6CachesC1Ev
-__ZN7WebCore4Node23registerDynamicNodeListEPNS_15DynamicNodeListE
-__ZN3WTF7HashSetIPN7WebCore15DynamicNodeListENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-+[DOMNodeList(WebCoreInternal) _wrapNodeList:]
--[DOMNodeList(WebCoreInternal) _initWithNodeList:]
--[DOMNodeList length]
-__ZNK7WebCore15DynamicNodeList6lengthEv
-__ZNK7WebCore11TagNodeList11nodeMatchesEPNS_4NodeE
-__ZN7WebCore15ProgressTracker17progressCompletedEPNS_5FrameE
-__ZN7WebCore15ProgressTracker21finalProgressCompleteEv
--[DOMNodeList dealloc]
-__ZN7WebCore4Node25unregisterDynamicNodeListEPNS_15DynamicNodeListE
--[DOMObject dealloc]
-__ZN7WebCore16removeDOMWrapperEP17DOMObjectInternal
--[WebScriptObject dealloc]
--[DOMNode dealloc]
--[WebCoreFrameBridge needsLayout]
--[WebCoreFrameBridge drawRect:]
-__ZN7WebCore15GraphicsContextC2EP9CGContext
-__ZN7WebCore15GraphicsContext28createGraphicsContextPrivateEv
-__ZN7WebCore22GraphicsContextPrivateC2Ev
-__ZN7WebCore15GraphicsContext19setPaintingDisabledEb
-__ZNK7WebCore15GraphicsContext9fillColorEv
-__ZN7WebCore15GraphicsContext20setPlatformFillColorERKNS_5ColorE
-__ZNK7WebCore15GraphicsContext16paintingDisabledEv
-__ZNK7WebCore15GraphicsContext15platformContextEv
-__ZN7WebCore14setCGFillColorEP9CGContextRKNS_5ColorE
-__ZNK7WebCore5Color7getRGBAERfS1_S1_S1_
-__ZNK7WebCore15GraphicsContext11strokeColorEv
-__ZN7WebCore15GraphicsContext22setPlatformStrokeColorERKNS_5ColorE
-__ZN7WebCore5Frame5paintEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore11FrameLoader30didFirstVisuallyNonEmptyLayoutEv
+__ZN7WebCore10RenderView21updateWidgetPositionsEv
+__ZN7WebCore9FrameView13updateWidgetsEv
+__ZN7WebCore5TimerINS_20ImageLoadEventSenderEE5firedEv
+__ZN7WebCore20ImageLoadEventSender10timerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore20ImageLoadEventSender25dispatchPendingLoadEventsEv
+__ZN7WebCore11ImageLoader24dispatchPendingLoadEventEv
+__ZN7WebCore15HTMLImageLoader17dispatchLoadEventEv
+__ZN7WebCore4Node13dispatchEventERKNS_12AtomicStringEbb
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13ContainerNodeEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13ContainerNodeEEELm0EE15reserveCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13ContainerNodeEEELm0EE6shrinkEm
+__ZN3WTF6VectorIPN7WebCore11ImageLoaderELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIPN7WebCore11ImageLoaderELm0EE6shrinkEm
+__ZN7WebCore9FrameView13paintContentsEPNS_15GraphicsContextERKNS_7IntRectE
 __ZN7WebCore8Document39invalidateRenderedRectsForMarkersInRectERKNS_7IntRectE
 __ZN7WebCore11RenderLayer5paintEPNS_15GraphicsContextERKNS_7IntRectENS_16PaintRestrictionEPNS_12RenderObjectE
-__ZN7WebCore11RenderLayer10paintLayerEPS0_PNS_15GraphicsContextERKNS_7IntRectEbNS_16PaintRestrictionEPNS_12RenderObjectE
-__ZNK7WebCore4Node12namespaceURIEv
-__ZNK7WebCore11RenderLayer14calculateRectsEPKS0_RKNS_7IntRectERS3_S6_S6_S6_
-__ZNK7WebCore11RenderLayer20convertToLayerCoordsEPKS0_RiS3_
+__ZN7WebCore11RenderLayer10paintLayerEPS0_PNS_15GraphicsContextERKNS_7IntRectEbNS_16PaintRestrictionEPNS_12RenderObjectEPN3WTF7
+__ZNK7WebCore4Node19virtualNamespaceURIEv
+__ZNK7WebCore11RenderLayer14calculateRectsEPKS0_RKNS_7IntRectERS3_S6_S6_S6_b
+__ZN7WebCore11RenderLayer24updateLayerListsIfNeededEv
 __ZN7WebCore11RenderLayer17updateZOrderListsEv
 __ZN7WebCore11RenderLayer13collectLayersERPN3WTF6VectorIPS0_Lm0EEES6_
 __ZN3WTF6VectorIPN7WebCore11RenderLayerELm0EE14expandCapacityEmPKS3_
 __ZN3WTF6VectorIPN7WebCore11RenderLayerELm0EE14expandCapacityEm
 __ZN3WTF6VectorIPN7WebCore11RenderLayerELm0EE15reserveCapacityEm
+__ZNSt17_Temporary_bufferIPPN7WebCore11RenderLayerES2_EC1ES3_S3_
 __ZNSt17_Temporary_bufferIPPN7WebCore11RenderLayerES2_EC2ES3_S3_
-__ZSt22__get_temporary_bufferIPN7WebCore11RenderLayerEESt4pairIPT_iEiS5_
-__ZSt22__stable_sort_adaptiveIPPN7WebCore11RenderLayerES3_iPFbS2_S2_EEvT_S6_T0_T1_T2_
+__ZSt22__get_temporary_bufferIPN7WebCore11RenderLayerEESt4pairIPT_lElS5_
+__ZSt22__stable_sort_adaptiveIPPN7WebCore11RenderLayerES3_lPFbS2_S2_EEvT_S6_T0_T1_T2_
 __ZSt24__merge_sort_with_bufferIPPN7WebCore11RenderLayerES3_PFbS2_S2_EEvT_S6_T0_T1_
-__ZSt22__chunk_insertion_sortIPPN7WebCore11RenderLayerEiPFbS2_S2_EEvT_S6_T0_T1_
+__ZSt22__chunk_insertion_sortIPPN7WebCore11RenderLayerElPFbS2_S2_EEvT_S6_T0_T1_
 __ZSt16__insertion_sortIPPN7WebCore11RenderLayerEPFbS2_S2_EEvT_S6_T0_
-__ZSt16__merge_adaptiveIPPN7WebCore11RenderLayerEiS3_PFbS2_S2_EEvT_S6_S6_T0_S7_T1_S7_T2_
+__ZSt16__merge_adaptiveIPPN7WebCore11RenderLayerElS3_PFbS2_S2_EEvT_S6_S6_T0_S7_T1_S7_T2_
 __ZSt16__merge_backwardIPPN7WebCore11RenderLayerES3_S3_PFbS2_S2_EET1_T_S7_T0_S8_S6_T2_
 __ZSt23return_temporary_bufferIPN7WebCore11RenderLayerEEvPT_
-__ZN7WebCore11RenderLayer18updateOverflowListEv
+__ZN7WebCore11RenderLayer20updateNormalFlowListEv
 __ZNK7WebCore11RenderLayer20intersectsDamageRectERKNS_7IntRectES3_PKS0_
-__ZN7WebCore7setClipEPNS_15GraphicsContextERKNS_7IntRectES4_
+__ZN7WebCoreL7setClipEPNS_15GraphicsContextERKNS_7IntRectES4_
 __ZN7WebCore10RenderView5paintERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore11RenderBlock11paintObjectERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore10RenderView19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore11RenderLayer21paintOverflowControlsEPNS_15GraphicsContextEiiRKNS_7IntRectE
-__ZN7WebCore11restoreClipEPNS_15GraphicsContextERKNS_7IntRectES4_
+__ZN7WebCoreL11restoreClipEPNS_15GraphicsContextERKNS_7IntRectES4_
 __ZN7WebCore11RenderBlock13paintContentsERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore11RenderBlock13paintChildrenERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore11RenderBlock14paintSelectionERNS_12RenderObject9PaintInfoEii
 __ZNK7WebCore11RenderBlock24shouldPaintSelectionGapsEv
 __ZN7WebCore11RenderBlock11paintFloatsERNS_12RenderObject9PaintInfoEiib
-__ZN7WebCore11RenderBlock10paintCaretERNS_12RenderObject9PaintInfoENS_9CaretTypeE
+__ZN7WebCore11RenderBlock10paintCaretERNS_12RenderObject9PaintInfoEiiNS_9CaretTypeE
 __ZNK7WebCore5Frame19dragCaretControllerEv
 __ZN7WebCore11RenderBlock25paintContinuationOutlinesERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore24continuationOutlineTableEv
+__ZN7WebCoreL24continuationOutlineTableEv
 __ZNK7WebCore12RenderObject20hasOutlineAnnotationEv
-__ZN7WebCore11RenderLayer18calculateClipRectsEPKS0_
+__ZNK7WebCore11RenderLayer15parentClipRectsEPKS0_RNS_9ClipRectsEb
+__ZN7WebCore11RenderLayer15updateClipRectsEPKS0_
+__ZNK7WebCore11RenderLayer18calculateClipRectsEPKS0_RNS_9ClipRectsEb
 __ZN7WebCore9ClipRectsnwEmPNS_11RenderArenaE
-__ZN7WebCore7IntRect9intersectERKS0_
+__ZN7WebCoreL13compareZIndexEPNS_11RenderLayerES1_
+__ZSt25__unguarded_linear_insertIPPN7WebCore11RenderLayerES2_PFbS2_S2_EEvT_T0_T1_
+__ZSt17__merge_sort_loopIPPN7WebCore11RenderLayerES3_lPFbS2_S2_EEvT_S6_T0_T1_T2_
+__ZSt5mergeIPPN7WebCore11RenderLayerES3_S3_PFbS2_S2_EET1_T_S7_T0_S8_S6_T2_
 __ZN7WebCore11RenderBlock5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore9RenderBox16pushContentsClipERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore9RenderBox19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore9RenderBox23paintRootBoxDecorationsERNS_12RenderObject9PaintInfoEii
-__ZNK7WebCore10ScrollView13contentsWidthEv
-__ZNK7WebCore10ScrollView14contentsHeightEv
-__ZN7WebCore9RenderBox16paintBackgroundsEPNS_15GraphicsContextERKNS_5ColorEPKNS_15BackgroundLayerEiiiiii
-__ZN7WebCore9RenderBox15paintBackgroundEPNS_15GraphicsContextERKNS_5ColorEPKNS_15BackgroundLayerEiiiiii
-__ZN7WebCore9RenderBox23paintBackgroundExtendedEPNS_15GraphicsContextERKNS_5ColorEPKNS_15BackgroundLayerEiiiiiibb
-__ZN7WebCore15GraphicsContext8fillRectERKNS_7IntRectERKNS_5ColorE
-__ZNK7WebCore7IntRectcv6CGRectEv
+__ZN7WebCore9RenderBox15paintFillLayersERKNS_12RenderObject9PaintInfoERKNS_5ColorEPKNS_9FillLayerEiiiiiiNS_17CompositeOperatorE
+__ZN7WebCore9RenderBox14paintFillLayerERKNS_12RenderObject9PaintInfoERKNS_5ColorEPKNS_9FillLayerEiiiiiiNS_17CompositeOperatorE
+__ZN7WebCore20RenderBoxModelObject22paintFillLayerExtendedERKNS_12RenderObject9PaintInfoERKNS_5ColorEPKNS_9FillLayerEiiiiiiPNS_
+__ZN7WebCore9FrameView18setContentIsOpaqueEb
+__ZNK7WebCore9FrameView19baseBackgroundColorEv
+__ZN7WebCore15GraphicsContext4saveEv
+__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE15reserveCapacityEm
+__ZN7WebCore15GraphicsContext17savePlatformStateEv
+__ZN7WebCore15GraphicsContext21setCompositeOperationENS_17CompositeOperatorE
+__ZN7WebCore15GraphicsContext8fillRectERKNS_9FloatRectERKNS_5ColorE
+__ZNK7WebCore9FloatRectcv6CGRectEv
+__ZN7WebCore15GraphicsContext7restoreEv
+__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE6shrinkEm
+__ZN7WebCore15GraphicsContext20restorePlatformStateEv
 __ZNK7WebCore12RenderObject18maximalOutlineSizeENS_10PaintPhaseE
 __ZNK7WebCore7IntRect10intersectsERKS0_
-__ZNK7WebCore11RenderBlock15borderFitAdjustERiS1_
-__ZN7WebCore12RenderObject14paintBoxShadowEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleEbb
-__ZN7WebCore11RenderTable5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore18RenderTableSection5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore15RenderTableCell26paintBackgroundsBehindCellERNS_12RenderObject9PaintInfoEiiPS1_
-__ZN7WebCore15RenderTableCell5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore15RenderTableCell19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore10RenderFlow10paintLinesERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore14RenderReplaced5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore14RenderReplaced11shouldPaintERNS_12RenderObject9PaintInfoERiS4_
-__ZNK7WebCore14RenderReplaced10isSelectedEv
-__ZN7WebCore11RenderImage13paintReplacedERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore17RenderLineBoxList5paintEPNS_20RenderBoxModelObjectERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore9InlineBox4rootEv
 __ZN7WebCore13RootInlineBox12selectionTopEv
 __ZN7WebCore13RootInlineBox5paintERNS_12RenderObject9PaintInfoEii
@@ -2455,1247 +3604,207 @@ __ZN7WebCore13InlineFlowBox5paintERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore13InlineFlowBox19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore13InlineFlowBox20paintTextDecorationsERNS_12RenderObject9PaintInfoEiib
 __ZN7WebCore9InlineBox5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore15GraphicsContext14setStrokeStyleERKNS_11StrokeStyleE
-__ZN7WebCore15GraphicsContext14setStrokeColorERKNS_5ColorE
-__ZN7WebCore15GraphicsContext12setFillColorERKNS_5ColorE
-__ZN7WebCore15GraphicsContext8drawRectERKNS_7IntRectE
-__ZNK7WebCore15GraphicsContext11strokeStyleEv
-__ZNK7WebCore9FloatRectcv6CGRectEv
-__ZNK7WebCore5Image6isNullEv
-__ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_8IntPointENS_17CompositeOperatorE
-__ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_8IntPointERKNS_7IntRectENS_17CompositeOperatorE
+__ZN7WebCore14RenderReplaced5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore14RenderReplaced11shouldPaintERNS_12RenderObject9PaintInfoERiS4_
+__ZNK7WebCore14RenderReplaced10isSelectedEv
+__ZN7WebCore11RenderImage13paintReplacedERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore11RenderImage5imageEii
+__ZNK7WebCore11CachedImage5imageEv
+__ZN7WebCore24RenderImageScaleObserver28shouldImagePaintAtLowQualityEPNS_11RenderImageERKNS_7IntSizeE
+__ZNK7WebCore11BitmapImage13isBitmapImageEv
+__ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_7IntRectENS_17CompositeOperatorEb
 __ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_7IntRectES5_NS_17CompositeOperatorEb
-__ZN7WebCore9FloatRectC2ERKNS_7IntRectE
-__ZN7WebCore10FloatPointC2ERKNS_8IntPointE
-__ZN7WebCore9FloatSizeC2ERKNS_7IntSizeE
 __ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_9FloatRectES5_NS_17CompositeOperatorEb
 __ZN7WebCore11BitmapImage4drawEPNS_15GraphicsContextERKNS_9FloatRectES5_NS_17CompositeOperatorE
--[DOMDocument forms]
-__ZN7WebCore8Document5formsEv
-+[DOMHTMLCollection(WebCoreInternal) _wrapHTMLCollection:]
--[DOMHTMLCollection(WebCoreInternal) _initWithHTMLCollection:]
--[DOMHTMLCollection length]
--[DOMHTMLCollection item:]
-__ZNK7WebCore14HTMLCollection4itemEj
-__ZN7WebCore12elementClassERKNS_13QualifiedNameEP10objc_class
-__ZN7WebCore15addElementClassERKNS_13QualifiedNameEP10objc_class
-__ZNK3WTF7HashMapIPKN7WebCore13QualifiedName17QualifiedNameImplEP10objc_classNS_7PtrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEE3getERKS5_
--[DOMHTMLFormElement elements]
-__ZN7WebCore15HTMLFormElement8elementsEv
-__ZN7WebCore18HTMLFormCollectionC1EN3WTF10PassRefPtrINS_15HTMLFormElementEEE
-__ZN7WebCore14HTMLCollectionC2EN3WTF10PassRefPtrINS_4NodeEEENS0_4TypeEPNS0_14CollectionInfoE
-__ZNK7WebCore18HTMLFormCollection10calcLengthEv
-__ZNK7WebCore15HTMLFormElement6lengthEv
-__ZNK7WebCore16HTMLInputElement14isEnumeratableEv
-__ZNK7WebCore18HTMLFormCollection4itemEj
--[DOMHTMLInputElement(FormAutoFillTransition) _isTextField]
--[DOMHTMLInputElement type]
-__ZNK7WebCore16HTMLInputElement4typeEv
--[DOMHTMLCollection dealloc]
-__ZNK7WebCore11HistoryItem17originalURLStringEv
-__ZNK7WebCore5Frame10isFrameSetEv
--[DOMDocument documentElement]
-+[DOMElement(WebCoreInternal) _wrapElement:]
--[DOMDocument createRange]
-__ZN7WebCore8Document11createRangeEv
-__ZN7WebCore5RangeC2EPNS_8DocumentE
-+[DOMRange(WebCoreInternal) _wrapRange:]
--[DOMRange(WebCoreInternal) _initWithRange:]
--[DOMRange selectNode:]
--[DOMNode(WebCoreInternal) _node]
-__ZN7WebCore5Range10selectNodeEPNS_4NodeERi
-__ZN7WebCore5Range14setStartBeforeEPNS_4NodeERi
-__ZNK7WebCore5Range11checkNodeBAEPNS_4NodeERi
-__ZNK7WebCore4Node9nodeIndexEv
-__ZN7WebCore5Range8setStartEPNS_4NodeEiRi
-__ZNK7WebCore5Range16checkNodeWOffsetEPNS_4NodeEiRi
-__ZNK7WebCore13ContainerNode14childNodeCountEv
-__ZN7WebCore5Range21compareBoundaryPointsEPNS_4NodeEiS2_i
-__ZN7WebCore5Range11setEndAfterEPNS_4NodeERi
-__ZN7WebCore5Range6setEndEPNS_4NodeEiRi
--[WebCoreFrameBridge stringForRange:]
--[DOMRange(WebCoreInternal) _range]
-__ZN7WebCore32plainTextToMallocAllocatedBufferEPKNS_5RangeERj
-__ZN7WebCore12TextIteratorC2EPKNS_5RangeEb
-__ZNK7WebCore5Range14startContainerERi
-__ZNK7WebCore5Range11startOffsetERi
-__ZNK7WebCore5Range12endContainerERi
-__ZNK7WebCore5Range9endOffsetERi
-__ZNK7WebCore5Range9startNodeEv
-__ZNK7WebCore4Node18offsetInCharactersEv
-__ZNK7WebCore13ContainerNode9childNodeEj
-__ZNK7WebCore5Range11pastEndNodeEv
-__ZN7WebCore12TextIterator7advanceEv
-__ZN7WebCore12TextIterator17handleNonTextNodeEv
-__ZN7WebCore24shouldEmitNewlineForNodeEPNS_4NodeE
-__ZN7WebCore12TextIterator23representNodeOffsetZeroEv
-__ZN7WebCore23shouldEmitTabBeforeNodeEPNS_4NodeE
-__ZN7WebCore11isTableCellEPKNS_4NodeE
-__ZN7WebCore27shouldEmitNewlineBeforeNodeEPNS_4NodeE
-__ZN7WebCore36shouldEmitNewlinesBeforeAndAfterNodeEPNS_4NodeE
-__ZN7WebCore12TextIterator29shouldRepresentNodeOffsetZeroEv
-__ZNK7WebCore4Node14isDescendantOfEPKS0_
-__ZN7WebCore12TextIterator33shouldEmitSpaceBeforeAndAfterNodeEPNS_4NodeE
-__ZNK7WebCore11RenderTable10cellBeforeEPKNS_15RenderTableCellE
-__ZNK7WebCore11RenderTable9cellAboveEPKNS_15RenderTableCellE
-__ZNK7WebCore11RenderTable12sectionAboveEPKNS_18RenderTableSectionEb
-__ZN7WebCore12TextIterator21handleReplacedElementEv
-__ZN7WebCore12TextIterator8exitNodeEv
-__ZN7WebCore12TextIterator13emitCharacterEtPNS_4NodeES2_ii
-__ZN7WebCore12TextIterator14handleTextNodeEv
-__ZN7WebCore12TextIterator13handleTextBoxEv
-__ZN7WebCore12TextIterator8emitTextEPNS_4NodeEii
-__ZN7WebCore26shouldEmitNewlineAfterNodeEPNS_4NodeE
-__ZN3WTF6VectorItLm0EE6shrinkEm
--[DOMRange dealloc]
-__ZN7WebCore5RangeD1Ev
-__ZN7WebCore9FrameView18updateControlTintsEv
-__ZNK7WebCore14RenderThemeMac20supportsControlTintsEv
-__ZN7WebCore15GraphicsContext23setUpdatingControlTintsEb
-__ZNK7WebCore14RenderThemeMac20controlSupportsTintsEPKNS_12RenderObjectE
-__ZN7WebCore14RenderThemeMac17adjustRepaintRectEPKNS_12RenderObjectERNS_7IntRectE
-__ZN7WebCore19SelectionController21pageActivationChangedEv
-__ZN7WebCore19SelectionController27focusedOrActiveStateChangedEv
-__ZNK7WebCore5Frame13selectionRectEb
-__ZNK7WebCore10RenderView13selectionRectEb
-__ZN7WebCore21rendererAfterPositionEPNS_12RenderObjectEj
-__ZN7WebCore9FloatRect9intersectERKS0_
-__ZN7WebCore5Frame15setCaretVisibleEb
-__ZN7WebCore12EventHandler27capsLockStateMayHaveChangedEv
-__ZNK7WebCore8Document32useSecureKeyboardEntryWhenActiveEv
-__ZN7WebCore5Frame20setSelectionFromNoneEv
-__ZN7WebCore5Frame22clearCaretRectIfNeededEv
-__ZN7WebCore19SelectionController19invalidateCaretRectEv
-__ZNK7WebCore19SelectionController17isInPasswordFieldEv
-__ZNK7WebCore11HistoryItem3urlEv
-__ZNK7WebCore11HistoryItem11originalURLEv
-__ZN7WebCore17BeforeUnloadEventC2Ev
--[WebCoreResourceHandleAsDelegate connection:willSendRequest:redirectResponse:]
-__ZNK7WebCore11FrameLoader21isQuickRedirectComingEv
-__ZN7WebCore11FrameLoader23cachePageForHistoryItemEPNS_11HistoryItemE
-__ZN7WebCore10CachedPage6createEPNS_4PageE
-__ZN7WebCore10CachedPageC2EPNS_4PageE
-__ZNK7WebCore12EventHandler14mousePressNodeEv
-__ZN7WebCore8Document15willSaveToCacheEv
-__ZN3KJS6Window14retrieveWindowEPN7WebCore5FrameE
-__ZN3KJS6Window8retrieveEPN7WebCore5FrameE
-__ZN7WebCore16ScriptController10initScriptEv
-__ZN7WebCore11JSDOMWindowC2EPNS_9DOMWindowE
-__ZN7WebCore20JSDOMWindowPrototype4selfEv
-__ZN3KJS6WindowC2EPNS_8JSObjectEPN7WebCore9DOMWindowE
-__ZNK7WebCore11FrameLoader9userAgentERKNS_4KURLE
-__ZN7WebCore10StringImpl4findEPKcib
-__ZN7WebCore5Frame18windowScriptObjectEv
-__ZN7WebCore5Frame17bindingRootObjectEv
-+[WebScriptObject scriptObjectForJSObject:originRootObject:rootObject:]
-__ZN7WebCore16createDOMWrapperEPN3KJS8JSObjectEN3WTF10PassRefPtrINS0_8Bindings10RootObjectEEES7_
-__ZNK7WebCore11JSDOMWindow9classInfoEv
-+[DOMAbstractView(WebCoreInternal) _wrapAbstractView:]
--[DOMAbstractView(WebCoreInternal) _initWithDOMWindow:]
--[WebScriptObject _hasImp]
--[WebScriptObject _setImp:originRootObject:rootObject:]
-__ZN7WebCore12addJSWrapperEP8NSObjectPN3KJS8JSObjectE
-__ZNK3WTF7HashMapIPN3KJS8JSObjectEP8NSObjectNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
-__ZN7WebCore5Frame11clearTimersEv
-__ZN7WebCore5Frame11clearTimersEPNS_9FrameViewE
-__ZN7WebCore9FrameView18unscheduleRelayoutEv
-__ZN7WebCore11RenderLayer15suspendMarqueesEv
-__ZN7WebCore19AnimationController17suspendAnimationsEv
-__ZNK3KJS6Window8locationEv
-__ZN7WebCore10JSLocationC1EPN3KJS8JSObjectEPNS_5FrameE
-__ZN3KJS6Window13pauseTimeoutsEv
-__ZN7WebCore8Document14setInPageCacheEb
-__ZN7WebCore9FrameView15resetScrollbarsEv
-__ZN7WebCore10CachedPage17setTimeStampToNowEv
-__ZN7WebCore10CachedPage17setDocumentLoaderEN3WTF10PassRefPtrINS_14DocumentLoaderEEE
-__ZN7WebCore10CachedPage25setCachedPagePlatformDataEPNS_22CachedPagePlatformDataE
-__ZN7WebCore9PageCache3addEN3WTF10PassRefPtrINS_11HistoryItemEEENS2_INS_10CachedPageEEE
-__ZN7WebCore9PageCache12addToLRUListEPNS_11HistoryItemE
-__ZNK7WebCore8Document17formElementsStateEv
-__ZN3WTF6VectorIN7WebCore6StringELm0EE15reserveCapacityEm
-__ZNK7WebCore16HTMLInputElement9saveStateERNS_6StringE
-__ZNK7WebCore17HTMLSelectElement9saveStateERNS_6StringE
-__ZN3WTF6VectorIcLm1024EE6shrinkEm
-__ZNK7WebCore17HTMLSelectElement4typeEv
-__ZN7WebCore11HistoryItem16setDocumentStateERKN3WTF6VectorINS_6StringELm0EEE
-__ZN3WTF6VectorIN7WebCore6StringELm0EEaSERKS3_
-__ZN3WTF6VectorIN7WebCore6StringELm0EE6shrinkEm
-__ZN7WebCore11FrameLoader36saveScrollPositionAndViewStateToItemEPNS_11HistoryItemE
-__ZN7WebCore11HistoryItem14setScrollPointERKNS_8IntPointE
-__ZN7WebCore5Frame16clearScriptProxyEv
-__ZN7WebCore8KJSProxy5clearEv
-__ZN3KJS6Window5clearEv
-__ZN3KJS6Window16clearAllTimeoutsEv
-__ZN3WTF20deleteAllPairSecondsIPN3KJS14DOMWindowTimerEKNS_7HashMapIiS3_NS_7IntHashIjEENS_10HashTraitsIiEENS7_IS3_EEEEEEvRT0_
-__ZN3KJS6Window27clearHelperObjectPropertiesEv
-__ZN7WebCore12gcControllerEv
-__ZN7WebCore12GCControllerC2Ev
-__ZN7WebCore12GCController18garbageCollectSoonEv
-__ZN7WebCore5Frame14clearDOMWindowEv
-__ZN7WebCore9DOMWindow5clearEv
-__ZN7WebCore8KJSProxy20clearDocumentWrapperEv
-__ZN7WebCore5Frame18clearScriptObjectsEv
-__ZN7WebCore5Frame26clearPlatformScriptObjectsEv
--[WebScriptObject _setOriginRootObject:andRootObject:]
-__ZN7WebCore5Frame25setUseSecureKeyboardEntryEb
-__ZN7WebCore16DeprecatedString6insertEjc
-__ZN7WebCore8Document14setFocusedNodeEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore19TextResourceDecoder11setEncodingERKNS_12TextEncodingENS0_14EncodingSourceE
-__ZN7WebCore11TextDecoder5resetERKNS_12TextEncodingE
-__ZN7WebCore15metaConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore15HTMLMetaElementC2EPNS_8DocumentE
-__ZN7WebCore15HTMLMetaElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore15HTMLMetaElement7processEv
-__ZNK7WebCore15HTMLMetaElement17endTagRequirementEv
-__ZNK7WebCore15HTMLMetaElement11tagPriorityEv
-__ZN7WebCore15HTMLMetaElement20insertedIntoDocumentEv
-__ZN7WebCore8Document16processHttpEquivERKNS_6StringES3_
-__ZN7WebCore15linkConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore15HTMLLinkElementC2EPNS_8DocumentE
-__ZN7WebCore15HTMLLinkElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore15HTMLLinkElement20tokenizeRelAttributeERKNS_12AtomicStringE
-__ZN3WTF6VectorIN7WebCore6StringELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore6StringELm0EE14expandCapacityEm
-__ZN7WebCore15HTMLLinkElement7processEv
-__ZNK7WebCore15HTMLLinkElement17endTagRequirementEv
-__ZNK7WebCore15HTMLLinkElement11tagPriorityEv
-__ZN7WebCore15HTMLLinkElement20insertedIntoDocumentEv
-__ZN7WebCore17scriptConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLScriptElementC2EPNS_8DocumentE
-__ZN7WebCore17HTMLScriptElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore17HTMLScriptElement17endTagRequirementEv
-__ZNK7WebCore17HTMLScriptElement11tagPriorityEv
-__ZN7WebCore17HTMLScriptElement20insertedIntoDocumentEv
-__ZN7WebCore13HTMLTokenizer13scriptHandlerENS0_5StateE
-__ZN7WebCore9DocLoader13requestScriptERKNS_6StringES3_
-__ZN7WebCore12CachedScriptC2EPNS_9DocLoaderERKNS_6StringES5_
-__ZNK7WebCore19ResourceRequestBase15httpHeaderFieldERKNS_6StringE
-__ZN7WebCore17HTMLScriptElement21finishParsingChildrenEv
-__ZN7WebCore15SegmentedString7prependERKS0_
-__ZN7WebCore15SegmentedString7prependERKNS_18SegmentedSubstringE
-__ZN7WebCore12CachedScript3refEPNS_20CachedResourceClientE
--[WebCoreResourceHandleAsDelegate connection:willCacheResponse:]
-__ZN7WebCore14ResourceLoader17willCacheResponseEPNS_14ResourceHandleEP19NSCachedURLResponse
-__ZN7WebCore14ResourceLoader17willCacheResponseEPNS_14ResourceHandleERNS_18CacheStoragePolicyE
-__ZN7WebCore4KURL11setProtocolERKNS_16DeprecatedStringE
-__ZN7WebCoreplERKNS_16DeprecatedStringEPKc
-__ZN7WebCore4KURL7setHostERKNS_16DeprecatedStringE
-__ZN7WebCore12TextCodecICU6encodeEPKtmb
-__ZN7WebCore7CStringC2EPKcj
+__ZN7WebCore11BitmapImage14startAnimationEb
+__ZN7WebCore11BitmapImage13shouldAnimateEv
+__ZThn392_N7WebCore11CachedImage18decodedSizeChangedEPKNS_5ImageEi
+__ZN7WebCore11CachedImage18decodedSizeChangedEPKNS_5ImageEi
+__ZN7WebCore14CachedResource14setDecodedSizeEj
+__ZN7WebCore5Cache32insertInLiveDecodedResourcesListEPNS_14CachedResourceE
+__ZN7WebCore11BitmapImage21mayFillWithSolidColorEv
+__ZNK7WebCore11BitmapImage16currentFrameSizeEv
+__ZThn392_N7WebCore11CachedImage7didDrawEPKNS_5ImageE
+__ZN7WebCore11CachedImage7didDrawEPKNS_5ImageE
+__ZN7WebCore14CachedResource20didAccessDecodedDataEd
+__ZN7WebCore5Cache34removeFromLiveDecodedResourcesListEPNS_14CachedResourceE
+__ZNK7WebCore13RootInlineBox16paintEllipsisBoxERNS_12RenderObject9PaintInfoEii
+__ZN3WTF11ListHashSetIPN7WebCore12RenderInlineENS_7PtrHashIS3_EEE14deleteAllNodesEv
+__ZN7WebCore9RenderBox16overflowClipRectEii
+__ZNK7WebCore11RenderLayer22verticalScrollbarWidthEv
+__ZNK7WebCore11RenderLayer25horizontalScrollbarHeightEv
+__ZNK7WebCore11RenderLayer11boundingBoxEPKS0_
+__ZNK7WebCore11RenderLayer16localBoundingBoxEv
+__ZN7WebCore13InlineTextBox5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore13InlineTextBox14selectionStateEv
+__ZN7WebCore13InlineTextBox20paintDocumentMarkersEPNS_15GraphicsContextEiiPNS_11RenderStyleERKNS_4FontEb
+__ZN7WebCore8Document14markersForNodeEPNS_4NodeE
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore4NodeEEEPSt4pairINS_6VectorINS2_14DocumentMarkerELm0EEENS6_INS2_7IntRectELm0EEEENS_7PtrHa
+__ZNK7WebCore13InlineTextBox7textPosEv
+__ZN7WebCore21updateGraphicsContextEPNS_15GraphicsContextERKNS_5ColorES4_f
+__ZN7WebCoreL20paintTextWithShadowsEPNS_15GraphicsContextERKNS_4FontERKNS_7TextRunEiiRKNS_8IntPointEiiiiPNS_10ShadowDataEb
+__ZN7WebCore15GraphicsContext8drawTextERKNS_4FontERKNS_7TextRunERKNS_8IntPointEii
+__ZNK7WebCore13RootInlineBox5blockEv
+__ZN7WebCore15GraphicsContext4clipERKNS_9FloatRectE
+__ZN7WebCore11RenderLayer21paintOverflowControlsEPNS_15GraphicsContextEiiRKNS_7IntRectE
+__ZN7WebCore11RenderLayer17paintScrollCornerEPNS_15GraphicsContextEiiRKNS_7IntRectE
+__ZN7WebCoreL16scrollCornerRectEPKNS_11RenderLayerERKNS_7IntRectE
+__ZN7WebCore11RenderLayer12paintResizerEPNS_15GraphicsContextEiiRKNS_7IntRectE
+__ZN7WebCore14RenderFieldset19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore11RenderBlock15borderFitAdjustERiS1_
+__ZN7WebCore20RenderBoxModelObject14paintBoxShadowEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleEbb
+__ZN7WebCore20RenderBoxModelObject11paintBorderEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleEbb
+__ZN7WebCore20RenderBoxModelObject19paintNinePieceImageEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleERKNS_14NinePieceImageENS_1
+__ZN7WebCore12RenderObject18drawLineForBoxSideEPNS_15GraphicsContextEiiiiNS_7BoxSideENS_5ColorERKS4_NS_12EBorderStyleEii
+__ZN7WebCore15GraphicsContext14setStrokeStyleERKNS_11StrokeStyleE
+__ZN7WebCore15GraphicsContext8drawRectERKNS_7IntRectE
+__ZNK7WebCore15GraphicsContext11strokeStyleEv
+__ZN7WebCore27RenderTextControlSingleLine5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore11RenderTheme5paintEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZNK7WebCore15GraphicsContext20updatingControlTintsEv
+__ZN7WebCore11RenderTheme16paintDecorationsEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore11RenderTheme15paintBorderOnlyEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac14paintTextFieldEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore27LocalCurrentGraphicsContextC1EPNS_15GraphicsContextE
+__ZN7WebCore27LocalCurrentGraphicsContextC2EPNS_15GraphicsContextE
+__ZNK7WebCore11RenderTheme9isEnabledEPKNS_12RenderObjectE
+__ZNK7WebCore11RenderTheme17isReadOnlyControlEPKNS_12RenderObjectE
+__ZN7WebCore27LocalCurrentGraphicsContextD1Ev
+__ZN7WebCore27LocalCurrentGraphicsContextD2Ev
+__ZN7WebCore9RenderBox15popContentsClipERNS_12RenderObject9PaintInfoENS_10PaintPhaseEii
+__ZN7WebCore14RenderThemeMac13paintMenuListEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac23setPopupButtonCellStateEPKNS_12RenderObjectERKNS_7IntRectE
+__ZNK7WebCore14RenderThemeMac11popupButtonEv
+__ZNK7WebCore14RenderThemeMac16popupButtonSizesEv
+__ZN7WebCore14RenderThemeMac14setControlSizeEP6NSCellPKNS_7IntSizeERS4_f
+__ZN7WebCore14RenderThemeMac18updateCheckedStateEP6NSCellPKNS_12RenderObjectE
+__ZNK7WebCore11RenderTheme15isIndeterminateEPKNS_12RenderObjectE
+__ZNK7WebCore11RenderTheme9isCheckedEPKNS_12RenderObjectE
+__ZN7WebCore14RenderThemeMac18updateEnabledStateEP6NSCellPKNS_12RenderObjectE
+__ZN7WebCore14RenderThemeMac18updatePressedStateEP6NSCellPKNS_12RenderObjectE
+__ZN7WebCore14RenderThemeMac18updateFocusedStateEP6NSCellPKNS_12RenderObjectE
+__ZNK7WebCore11RenderTheme9isFocusedEPKNS_12RenderObjectE
+__ZNK7WebCore14RenderThemeMac18popupButtonMarginsEv
+__ZNK7WebCore14RenderThemeMac11inflateRectERKNS_7IntRectERKNS_7IntSizeEPKif
+__ZNK7WebCore14RenderMenuList15controlClipRectEii
+__ZNK7WebCore11RenderTheme24controlStatesForRendererEPKNS_12RenderObjectE
+__ZNK7WebCore11RenderTheme9isHoveredEPKNS_12RenderObjectE
+__ZNK7WebCore11RenderTheme9isPressedEPKNS_12RenderObjectE
+__ZThn128_NK7WebCore16HTMLInputElement9isCheckedEv
+__ZNK7WebCore16HTMLInputElement9isCheckedEv
+__ZNK7WebCore11RenderTheme8isActiveEPKNS_12RenderObjectE
+__ZThn128_NK7WebCore16HTMLInputElement15isIndeterminateEv
+__ZNK7WebCore16HTMLInputElement15isIndeterminateEv
+__ZNK7WebCore8ThemeMac5paintENS_11ControlPartEjPNS_15GraphicsContextERKNS_7IntRectEfPNS_10ScrollViewE
+__ZN7WebCoreL6buttonENS_11ControlPartEjRKNS_7IntRectEf
+__ZN7WebCoreL14setControlSizeEP6NSCellPKNS_7IntSizeERS3_f
+__ZN7WebCoreL12updateStatesEP6NSCellj
+__ZN7WebCoreL13buttonMarginsEm
+__ZN7WebCoreL11inflateRectERKNS_7IntRectERKNS_7IntSizeEPKif
+__ZNK7WebCore12RenderButton15controlClipRectEii
+__ZN7WebCore20CachedResourceClient14notifyFinishedEPNS_14CachedResourceE
+__ZNK7WebCore9Tokenizer10wellFormedEv
+__ZN7WebCore11FrameLoader15startIconLoaderEv
+__ZN7WebCore11FrameLoader7iconURLEv
 __ZN7WebCore12IconDatabase22loadDecisionForIconURLERKNS_6StringEPNS_14DocumentLoaderE
 __ZN7WebCore11FrameLoader27commitIconURLToIconDatabaseERKNS_4KURLE
 __ZN7WebCore12IconDatabase20setIconURLForPageURLERKNS_6StringES3_
-__ZNK7WebCore13PageURLRecord8snapshotEb
-__ZN3WTF7HashMapIN7WebCore6StringENS1_15PageURLSnapshotENS1_10StringHashENS_10HashTraitsIS2_EENS5_IS3_EEE3setERKS2_RKS3_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_15PageURLSnapshotEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IS5_EEEESC_E3addINS1_6StringES5_NS_17HashMapTranslatorILb0ES4_ISH_S5_ENS_18PairBaseHashTraitsINSB_ISH_EESD_EESE_S9_EEEES4_INS_17HashTableIteratorIS3_S6_S8_S9_SE_SC_EEbERKT_RKT0_
-__ZN7WebCore12IconDatabase24scheduleOrDeferSyncTimerEv
 __ZNK7WebCore11FrameLoader18originalRequestURLEv
-__ZNK7WebCore14DocumentLoader14initialRequestEv
 __ZN7WebCore12IconDatabase23iconDataKnownForIconURLERKNS_6StringE
-__ZN7WebCore10IconRecord15imageDataStatusEv
-__ZN3WTF7HashSetIPN7WebCore10IconRecordENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore12IconDatabase14wakeSyncThreadEv
-__ZN7WebCore15ThreadCondition6signalEv
-__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE15reserveCapacityEm
-__ZN7WebCore12IconDatabase37getImageDataForIconURLFromSQLDatabaseERKNS_6StringE
-__ZN7WebCore15SQLiteStatement8bindTextEiRKNS_6StringE
-_sqlite3_bind_text16
-_bindText
-_vdbeUnbind
-_accessPayload
-__ZN7WebCore15SQLiteStatement21getColumnBlobAsVectorEiRN3WTF6VectorIcLm0EEE
-_sqlite3_column_blob
-_sqlite3_column_bytes
-__ZN3WTF6VectorIcLm0EE6resizeEm
-__ZN7WebCore12SharedBufferC2Ev
-__ZN7WebCore12SharedBuffer6appendEPKci
-__ZN7WebCore12SharedBuffer25maybeTransferPlatformDataEv
-__ZN3WTF6VectorIcLm0EE6appendIcEEvPKT_m
-__ZN3WTF6VectorIcLm0EE14expandCapacityEmPKc
-__ZN7WebCore15SQLiteStatement5resetEv
-_sqlite3_reset
-__ZN7WebCore15AutodrainedPool5cycleEv
-__ZN3WTF6VectorIPN7WebCore10IconRecordELm0EE6shrinkEm
-__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE15reserveCapacityEm
-__ZN7WebCore12IconDatabase33setIconURLForPageURLInSQLDatabaseERKNS_6StringES3_
-__ZN7WebCore12IconDatabase34getIconIDForIconURLFromSQLDatabaseERKNS_6StringE
-__ZN7WebCore15SQLiteStatement14getColumnInt64Ei
-_sqlite3_column_int64
-__ZN7WebCore12IconDatabase32setIconIDForPageURLInSQLDatabaseExRKNS_6StringE
-_sqlite3IdListAppend
-_sqlite3Insert
-_sqlite3ViewGetColumnNames
-_sqlite3BeginWriteOperation
-_autoIncBegin
-_sqlite3OpenTableAndIndices
-_sqlite3GenerateConstraintChecks
-_sqlite3GenerateRowDelete
-_sqlite3GenerateIndexKey
-_sqlite3CompleteInsertion
-_autoIncEnd
-__ZN7WebCore15SQLiteStatement9bindInt64Eix
-_sqlite3_bind_int64
-_pager_open_journal
-_unixSetFullSync
-_unixOpenDirectory
-_writeJournalHdr
-_sqlite3UnixRandomSeed
-_unixWrite
-_sqlite3PagerCommitPhaseOne
-_syncJournal
-_unixSync
-__ZN7WebCore17SubresourceLoader18didReceiveResponseERKNS_16ResourceResponseE
-__ZN7WebCore6Loader18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
-__ZNK7WebCore20ResourceResponseBase16textEncodingNameEv
-__ZN7WebCore17SubresourceLoader14didReceiveDataEPKcixb
-__ZN7WebCore6Loader14didReceiveDataEPNS_17SubresourceLoaderEPKci
-__ZN7WebCore17SubresourceLoader16didFinishLoadingEv
-__ZN7WebCore6Loader16didFinishLoadingEPNS_17SubresourceLoaderE
-__ZN7WebCore12CachedScript4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
-__ZN7WebCore5Cache10adjustSizeEbi
-__ZN7WebCore12CachedScript11checkNotifyEv
-__ZThn8_N7WebCore13HTMLTokenizer14notifyFinishedEPNS_14CachedResourceE
-__ZN7WebCore13HTMLTokenizer14notifyFinishedEPNS_14CachedResourceE
-__ZNK7WebCore21DeprecatedPtrListImpl8getFirstEv
-__ZN7WebCore21DeprecatedPtrListImpl11removeFirstEb
-__ZN7WebCore21DeprecatedPtrListImpl6removeEjb
-__ZN7WebCore14CachedResource5derefEPNS_20CachedResourceClientE
-__ZN7WebCore5Cache27removeFromLiveResourcesSizeEPNS_14CachedResourceE
-__ZN7WebCore14CachedResource20allReferencesRemovedEv
-__ZN7WebCore17HTMLScriptElement25shouldExecuteAsJavaScriptEv
-__ZN7WebCore16MIMETypeRegistry29isSupportedJavaScriptMIMETypeERKNS_6StringE
-__ZN7WebCore13HTMLTokenizer15scriptExecutionERKNS_6StringENS0_5StateES3_i
-__ZN7WebCore11FrameLoader13executeScriptERKNS_6StringEiS3_
-__ZN7WebCore8KJSProxy8evaluateERKNS_6StringEiS3_
-__ZN3KJS6Window10globalExecEv
-__ZN7WebCore5Frame9keepAliveEv
-__ZNK7WebCore6StringcvN3KJS7UStringEEv
-_pager_write_pagelist
-_pager_end_transaction
-_unixClose
-_binCompare
-__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE6shrinkEm
-__ZN7WebCore12IconDatabase20pruneUnretainedIconsEv
-__ZNK3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_iENS_18PairFirstExtractorIS5_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSA_IaEEEESB_E8containsIS3_NS_22IdentityHashTranslatorIS3_S5_S8_EEEEbRKT_
-_sqlite3DeleteFrom
-_clearCell
-_freeSpace
-__ZN7WebCore11JSDOMWindow18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore11JSDOMWindow24customGetOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore11JSDOMWindow4implEv
-__ZNK7WebCore20JSDOMWindowPrototype9classInfoEv
-__ZN3KJS6Window18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN7WebCore12AtomicString3addERKN3KJS10IdentifierE
-__ZNK7WebCore9FrameTree5childERKNS_12AtomicStringE
-__ZNK3KJS6Window16allowsAccessFromEPNS_9ExecStateE
-__ZNK3KJS6Window16allowsAccessFromEPKNS_14JSGlobalObjectERN7WebCore14SecurityOrigin6ReasonERNS4_6StringE
-__ZN7WebCore12HTMLDocument12hasNamedItemERKNS_6StringE
-__ZNK3WTF7HashMapIPN7WebCore10StringImplEiNS1_10StringHashENS_10HashTraitsIS3_EENS5_IiEEE3getERKS3_
-__ZNK7WebCore8Document14getElementByIdERKNS_12AtomicStringE
-__ZN7WebCore20JSDOMWindowPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK3KJS14JSGlobalObject14isGlobalObjectEv
-__ZN3KJS17staticValueGetterIN7WebCore11JSDOMWindowEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore11JSDOMWindow16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore9DOMWindow4selfEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_9DOMWindowE
-__ZN3KJS17staticValueGetterINS_6WindowEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK3KJS6Window16getValuePropertyEPNS_9ExecStateEi
-__ZN3KJS9NavigatorC1EPNS_8JSObjectEPN7WebCore5FrameE
-__ZN3KJS9Navigator18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS17staticValueGetterINS_9NavigatorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK3KJS9Navigator16getValuePropertyEPNS_9ExecStateEi
-__ZNK7WebCore9DOMWindow8documentEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_8DocumentE
-__ZN3KJS17ScriptInterpreter12getDOMObjectEPv
-__ZNK3WTF7HashMapIPvPN3KJS9DOMObjectENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS7_IS4_EEE3getERKS1_
-__ZN7WebCore23JSHTMLDocumentPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSDocumentPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSNodePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore14JSHTMLDocumentC1EPN3KJS8JSObjectEPNS_12HTMLDocumentE
-__ZN7WebCore10JSDocumentC1EPN3KJS8JSObjectEPNS_8DocumentE
-__ZN7WebCore17JSEventTargetNodeC2EPN3KJS8JSObjectEPNS_4NodeE
-__ZN7WebCore6JSNodeC1EPN3KJS8JSObjectEPNS_4NodeE
-__ZN3KJS17ScriptInterpreter12putDOMObjectEPvPNS_9DOMObjectE
-__ZN3WTF7HashMapIPvPN3KJS9DOMObjectENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS7_IS4_EEE3setERKS1_RKS4_
-__ZN7WebCore14JSHTMLDocument18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore14JSHTMLDocument18canGetItemsForNameEPN3KJS9ExecStateEPNS_12HTMLDocumentERKNS1_10IdentifierE
-__ZN7WebCore6StringC2ERKN3KJS10IdentifierE
-__ZN7WebCore12HTMLDocument20hasDocExtraNamedItemERKNS_6StringE
-__ZN7WebCore10JSDocument18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17JSEventTargetNode18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore6JSNode18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSHTMLDocumentPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19JSDocumentPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS20staticFunctionGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN7WebCore13JSHTMLElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore22JSHTMLElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore40jsDocumentPrototypeFunctionCreateElementEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore14JSHTMLDocument9classInfoEv
-__ZN7WebCore6StringC2ERKN3KJS7UStringE
-__ZN7WebCore12HTMLDocument13createElementERKNS_6StringERi
-__ZN7WebCore8Document11isValidNameERKNS_6StringE
-__ZN7WebCore14divConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore14HTMLDivElementC2EPNS_8DocumentE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_11EventTargetE
-__ZN7WebCore11EventTarget20toSVGElementInstanceEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN3KJS17ScriptInterpreter21getDOMNodeForDocumentEPN7WebCore8DocumentEPNS1_4NodeE
-__ZN7WebCore19createJSHTMLWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFPNS1_6JSNodeEPN3KJS9ExecStateENS_10PassRefPtrINS1_11HTMLElementEEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSG_ISD_EEE3getERKS3_
-__ZN7WebCore16createDivWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore25JSHTMLDivElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSHTMLDivElementC1EPN3KJS8JSObjectEPNS_14HTMLDivElementE
-__ZN7WebCore13JSHTMLElementC1EPN3KJS8JSObjectEPNS_11HTMLElementE
-__ZN7WebCore9JSElementC1EPN3KJS8JSObjectEPNS_7ElementE
-__ZN3KJS17ScriptInterpreter21putDOMNodeForDocumentEPN7WebCore8DocumentEPNS1_4NodeEPNS1_6JSNodeE
-__ZNK3WTF7HashMapIPN7WebCore8DocumentEPNS0_IPNS1_4NodeEPNS1_6JSNodeENS_7PtrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEEENS8_IS3_EENSA_IS3_EENSA_ISE_EEE3getERKS3_
-__ZNK3WTF7HashMapIPN7WebCore4NodeEPNS1_6JSNodeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
-__ZN3KJS15setDOMExceptionEPNS_9ExecStateEi
-__ZN7WebCore16JSHTMLDivElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore13JSHTMLElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore9JSElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore15formConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17createFormWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore26JSHTMLFormElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLFormElementC1EPN3KJS8JSObjectEPNS_15HTMLFormElementE
-__ZN7WebCore17JSHTMLFormElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore13JSHTMLElement4implEv
-__ZNK7WebCore9JSElement4implEv
-__ZN7WebCore17JSHTMLFormElement18canGetItemsForNameEPN3KJS9ExecStateEPNS_15HTMLFormElementERKNS1_10IdentifierE
-__ZN7WebCore15HTMLFormElement16getNamedElementsERKNS_12AtomicStringERN3WTF6VectorINS4_6RefPtrINS_4NodeEEELm0EEE
-__ZNK7WebCore14HTMLCollection10namedItemsERKNS_12AtomicStringERN3WTF6VectorINS4_6RefPtrINS_4NodeEEELm0EEE
-__ZNK7WebCore18HTMLFormCollection15updateNameCacheEv
-__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS_6VectorIPNS1_7ElementELm0EEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSB_IS8_EEE3addERKS3_RKS8_
-__ZN7WebCore15HTMLFormElement15elementForAliasERKNS_12AtomicStringE
-__ZN3KJS8JSObject18isActivationObjectEv
-__ZN7WebCore41jsDocumentPrototypeFunctionCreateTextNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document14createTextNodeERKNS_6StringE
-__ZN7WebCore15JSTextPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore24JSCharacterDataPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore6JSTextC1EPN3KJS8JSObjectEPNS_4TextE
-__ZN7WebCore15JSCharacterDataC2EPN3KJS8JSObjectEPNS_13CharacterDataE
-__ZN3KJS8JSObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN7WebCore18JSElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22JSEventTargetPrototypeINS_15JSNodePrototypeENS_33JSEventTargetPrototypeInformationEE18getOwnPropertySlotEPN3KJS9ExecStateERKNS4_10IdentifierERNS4_12PropertySlotE
-__ZN7WebCore15JSNodePrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore34jsNodePrototypeFunctionAppendChildEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore16JSHTMLDivElement9classInfoEv
-__ZN7WebCore6JSNode11appendChildEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore6toNodeEPN3KJS7JSValueE
-__ZNK7WebCore6JSText9classInfoEv
-__ZN7WebCore13ContainerNode11appendChildEN3WTF10PassRefPtrINS_4NodeEEERi
-__ZN7WebCore4Node13checkAddChildEPS0_Ri
-__ZN7WebCore4Node14isReadOnlyNodeEv
-__ZN7WebCore28dispatchChildInsertionEventsEPNS_4NodeERi
-__ZN7WebCore15EventTargetNode28dispatchSubtreeModifiedEventEb
-__ZN7WebCore4Node30notifyNodeListsChildrenChangedEv
-__ZN7WebCore4Node35notifyLocalNodeListsChildrenChangedEv
-__ZN7WebCore14JSHTMLDocument3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore10JSDocument3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore17JSEventTargetNode3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore6JSNode3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore6JSNode14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore17JSNodeConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore17JSNodeConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSNodeConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore9JSElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore11JSDOMWindow3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore11JSDOMWindow9customPutEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore11JSDOMWindow16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZNK7WebCore20JSElementConstructor9classInfoEv
-__ZN7WebCore20JSElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore7JSEvent14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore16JSEventPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSEventConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24JSHTMLElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS26windowProtoFuncSetIntervalEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS6Window14installTimeoutEPNS_7JSValueERKNS_4ListEib
-__ZN7WebCore15ScheduledActionC1EPN3KJS7JSValueERKNS1_4ListE
-__ZN3KJS12ProtectedPtrINS_7JSValueEEC2EPS1_
-__ZN3KJS6Window14installTimeoutEPN7WebCore15ScheduledActionEib
-__ZN3WTF7HashMapIiPN3KJS14DOMWindowTimerENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE4takeERKi
-__ZNK3KJS8JSObject21masqueradeAsUndefinedEv
-__ZN3KJS6Window3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
-__ZN3KJS31windowProtoFuncAddEventListenerEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS6Window27findOrCreateJSEventListenerEPNS_7JSValueEb
-__ZN3KJS6Window19findJSEventListenerEPNS_7JSValueEb
-__ZN3WTF7HashMapIPN3KJS8JSObjectEPN7WebCore15JSEventListenerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3setERKS3_RKS6_
-__ZN7WebCore15JSEventListenerC2EPN3KJS8JSObjectEPNS1_6WindowEb
-__ZN7WebCore23JSAbstractEventListenerC2Eb
-__ZN3KJS12ProtectedPtrINS_8JSObjectEEC2EPS1_
-__ZN3KJS12ProtectedPtrINS_6WindowEEC2EPS1_
-__ZN3KJS6Window16jsEventListenersEv
-__ZN7WebCore12AtomicString3addERKN3KJS7UStringE
-__ZN7WebCore8Document22addWindowEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
-__ZN7WebCore8Document25removeWindowEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
-__ZN7WebCore23RegisteredEventListenerC2ERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
-__ZN3KJS6Window4markEv
-__ZN7WebCore6JSNode4markEv
-__ZN7WebCore10JSDocument4markEv
-__ZN3KJS17ScriptInterpreter23markDOMNodesForDocumentEPN7WebCore8DocumentE
-__ZN3KJS17ScriptInterpreter24forgetDOMNodeForDocumentEPN7WebCore8DocumentEPNS1_4NodeE
-__ZN7WebCore14HTMLDivElementD1Ev
-__ZN7WebCore17JSHTMLFormElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore28JSHTMLFormElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18JSHTMLInputElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore27JSHTMLInputElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore31JSHTMLInputElementBasePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore29JSHTMLInputElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19JSHTMLSelectElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore28JSHTMLSelectElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore30JSHTMLSelectElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSHTMLTextAreaElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore16MIMETypeRegistry26getSupportedImageMIMETypesEv
-__ZN7WebCore15PluginInfoStore32createPluginInfoForPluginAtIndexEj
-__ZN3WTF6VectorIPN7WebCore13MimeClassInfoELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore13MimeClassInfoELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore13MimeClassInfoELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIPN7WebCore10PluginInfoELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore10PluginInfoELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore10PluginInfoELm0EE15reserveCapacityEm
-__ZN3KJS7Plugins18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS17staticValueGetterINS_7PluginsEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK3KJS7Plugins16getValuePropertyEPNS_9ExecStateEi
-__ZN3KJS7Plugins11indexGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS6Plugin18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS17staticValueGetterINS_6PluginEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK3KJS6Plugin16getValuePropertyEPNS_9ExecStateEi
-__ZNK3KJS8JSObject11toPrimitiveEPNS_9ExecStateENS_6JSTypeE
-__ZN7WebCore27jsLocationProtoFuncToStringEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore10JSLocation9classInfoEv
-__ZNK7WebCore4KURL7hasPathEv
-__ZNK7WebCore4KURL9prettyURLEv
-__ZN7WebCoreplEPKcRKNS_16DeprecatedStringE
-__ZNK7WebCore8Document8referrerEv
-__ZNK7WebCore11FrameLoader8referrerEv
-__ZN3KJS10PluginBaseD0Ev
-__ZN3WTF6VectorIPN7WebCore7ElementELm0EE6shrinkEm
-__ZN3KJS6Window15namedItemGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN7WebCore8Document16windowNamedItemsERKNS_6StringE
-__ZN7WebCore18HTMLNameCollectionC1EN3WTF10PassRefPtrINS_8DocumentEEENS_14HTMLCollection4TypeERKNS_6StringE
-__ZN7WebCore8Document18nameCollectionInfoENS_14HTMLCollection4TypeERKNS_12AtomicStringE
-__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_14HTMLCollection14CollectionInfoENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3addERKS3_RKS6_
-__ZNK7WebCore18HTMLNameCollection9itemAfterEPNS_7ElementE
-__ZNK7WebCore14HTMLCollection9firstItemEv
-__ZN7WebCore18JSHTMLImageElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore18JSHTMLImageElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore16HTMLImageElement6setSrcERKNS_6StringE
-__ZN7WebCore7Element12setAttributeERKNS_13QualifiedNameERKNS_6StringE
-__ZN7WebCore7Element12setAttributeERKNS_13QualifiedNameEPNS_10StringImplERi
-__ZN7WebCore12NamedAttrMap14isReadOnlyNodeEv
-__ZN7WebCore13StyledElement15createAttributeERKNS_13QualifiedNameEPNS_10StringImplE
-__ZN7WebCore7Element25dispatchAttrAdditionEventEPNS_9AttributeE
-__ZN7WebCore4Node31notifyNodeListsAttributeChangedEv
-__ZN7WebCore4Node36notifyLocalNodeListsAttributeChangedEv
-__ZNK7WebCore15ProgressTracker17estimatedProgressEv
-__ZN7WebCore5TimerINS_9FrameViewEE5firedEv
-__ZN7WebCore9FrameView16layoutTimerFiredEPNS_5TimerIS0_EE
-__ZNK7WebCore12RenderObject33expandsToEncloseOverhangingFloatsEv
-__ZN7WebCore11RenderBlock13containsFloatEPNS_12RenderObjectE
-__ZN7WebCore11RenderBlock22insertPositionedObjectEPNS_12RenderObjectE
-__ZN3WTF11ListHashSetIPN7WebCore12RenderObjectENS_7PtrHashIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore12RenderObjectEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_NS_7PtrHashIS4_EEEENS_10HashTraitsIS6_EESE_E3addIS4_PNS_24ListHashSetNodeAllocatorIS4_EENS_21ListHashSetTranslatorIS4_SB_EEEESt4pairINS_17HashTableIteratorIS6_S6_S8_SC_SE_SE_EEbERKT_RKT0_
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore12RenderObjectEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_NS_7PtrHashIS4_EEEENS_10HashTraitsIS6_EESE_E6expandEv
-__ZN3WTF11ListHashSetIPN7WebCore12RenderObjectENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
-__ZN7WebCore11RenderBlock21adjustPositionedBlockEPNS_12RenderObjectERKNS0_10MarginInfoE
-__ZNK7WebCore12RenderObject10hasStaticXEv
-__ZN7WebCore9RenderBox22calcAbsoluteHorizontalEv
-__ZNK7WebCore9RenderBox33containingBlockWidthForPositionedEPKNS_12RenderObjectE
-__ZN7WebCore9RenderBox28calcAbsoluteHorizontalValuesENS_6LengthEPKNS_12RenderObjectENS_13TextDirectionEiiS1_S1_S1_S1_RiS6_S6_S6_
-__ZNK7WebCore25HTMLTextFieldInnerElement12isShadowNodeEv
-__ZN7WebCore9RenderBox20calcAbsoluteVerticalEv
-__ZNK7WebCore9RenderBox34containingBlockHeightForPositionedEPKNS_12RenderObjectE
-__ZN7WebCore9RenderBox26calcAbsoluteVerticalValuesENS_6LengthEPKNS_12RenderObjectEiiS1_S1_S1_S1_RiS5_S5_S5_
-__ZNK7WebCore9RenderBox23relativePositionOffsetXEv
-__ZNK7WebCore9RenderBox23relativePositionOffsetYEv
-__ZN7WebCore9InlineBoxD1Ev
-__ZNK7WebCore11RenderLayer27enclosingPositionedAncestorEv
-__ZN7WebCore5TimerINS_13HTMLTokenizerEE5firedEv
-__ZN7WebCore13HTMLTokenizer10timerFiredEPNS_5TimerIS0_EE
-__ZNK7WebCore9RenderBox16inlineBoxWrapperEv
-__ZN7WebCore11RenderBlock17deleteLineBoxTreeEv
-__ZN7WebCore15RenderContainer13moveChildNodeEPNS_12RenderObjectE
-__ZN7WebCore20paragraphConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore20HTMLParagraphElementC2EPNS_8DocumentE
-__ZNK7WebCore20HTMLParagraphElement17endTagRequirementEv
-__ZNK7WebCore20HTMLParagraphElement11tagPriorityEv
-__ZN7WebCore20HTMLParagraphElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore11HTMLElement15inInlineTagListEPKNS_4NodeE
-__ZNK7WebCore20HTMLParagraphElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore20HTMLParagraphElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore11HTMLElement20setHTMLEventListenerERKNS_12AtomicStringEPNS_9AttributeE
-__ZN7WebCore8Document23createHTMLEventListenerERKNS_6StringES3_PNS_4NodeE
-__ZN7WebCore8KJSProxy22createHTMLEventHandlerERKNS_6StringES3_PNS_4NodeE
-__ZN7WebCore19JSLazyEventListenerC2ERKNS_6StringES3_PN3KJS6WindowEPNS_4NodeEi
-__ZN7WebCore15EventTargetNode20setHTMLEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore15EventTargetNode23removeHTMLEventListenerERKNS_12AtomicStringE
-__ZN7WebCore8Document42registerDisconnectedNodeWithEventListenersEPNS_4NodeE
-__ZN3WTF7HashSetIPN7WebCore4NodeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore8Document44unregisterDisconnectedNodeWithEventListenersEPNS_4NodeE
-__ZN7WebCore23JSAbstractEventListener11handleEventEPNS_5EventEb
-__ZNK7WebCore15JSEventListener11listenerObjEv
-__ZNK7WebCore15JSEventListener9windowObjEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_5EventE
-__ZNK7WebCore5Event15isKeyboardEventEv
-__ZNK7WebCore5Event11isTextEventEv
-__ZNK7WebCore5Event12isWheelEventEv
+__ZN7WebCore19AnimationController16resumeAnimationsEPNS_8DocumentE
+__ZN7WebCore26AnimationControllerPrivate16resumeAnimationsEPNS_8DocumentE
+__ZN7WebCore26AnimationControllerPrivate20updateAnimationTimerEb
+__ZN7WebCore11ImageLoader25dispatchPendingLoadEventsEv
+__ZN7WebCore8Document17dispatchLoadEventEv
+__ZN7WebCore9DOMWindow17dispatchLoadEventEv
+__ZN7WebCore15JSEventListener11handleEventEPNS_5EventEb
+__ZNK7WebCore15JSEventListener10jsFunctionEv
+__ZNK7WebCore15JSDOMWindowBase22scriptExecutionContextEv
+__ZThn88_NK7WebCore8Document10isDocumentEv
+__ZNK7WebCore8Document10isDocumentEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_5EventE
 __ZNK7WebCore5Event9isUIEventEv
 __ZNK7WebCore5Event15isMutationEventEv
 __ZNK7WebCore5Event15isOverflowEventEv
 __ZNK7WebCore5Event14isMessageEventEv
 __ZNK7WebCore5Event15isProgressEventEv
-__ZN7WebCore7JSEventC1EPN3KJS8JSObjectEPNS_5EventE
-__ZN3KJS6Window15setCurrentEventEPN7WebCore5EventE
-__ZN3KJS27windowProtoFuncClearTimeoutEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS6Window12clearTimeoutEib
-__ZN3KJS14DOMWindowTimerD1Ev
-__ZN3KJS12ProtectedPtrINS_7JSValueEED2Ev
-__ZN7WebCore47jsDocumentPrototypeFunctionGetElementsByTagNameEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_8NodeListE
-__ZN7WebCore19JSNodeListPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore10JSNodeListC1EPN3KJS8JSObjectEPNS_8NodeListE
-__ZN7WebCore10JSNodeList18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore10JSNodeListEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore10JSNodeList16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore10JSNodeList11indexGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZNK7WebCore15DynamicNodeList4itemEj
-__ZNK7WebCore15DynamicNodeList23itemForwardsFromCurrentEPNS_4NodeEji
-__ZN7WebCore18createInputWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLInputElementC1EPN3KJS8JSObjectEPNS_16HTMLInputElementE
-__ZN7WebCore22JSHTMLInputElementBaseC2EPN3KJS8JSObjectEN3WTF10PassRefPtrINS_16HTMLInputElementEEE
-__ZN7WebCore18JSHTMLInputElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22JSHTMLInputElementBase18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16HTMLInputElement16canHaveSelectionEv
-__ZN7WebCore27JSHTMLInputElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore31JSHTMLInputElementBasePrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore13JSHTMLElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore13JSHTMLElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore11HTMLElement9classNameEv
-__ZN7WebCore12RenderObject16setStyleInternalEPNS_11RenderStyleE
-__ZN3WTF6VectorIPN3KJS7JSValueELm8EE6shrinkEm
-__ZN7WebCore11LayoutStatenwEmPNS_11RenderArenaE
-__ZN7WebCore11LayoutStateC2EPS0_PNS_9RenderBoxERKNS_7IntSizeE
-__ZN7WebCore11RenderBlock20determineEndPositionEPNS_13RootInlineBoxERNS_12BidiIteratorERNS_10BidiStatusERi
-__ZN7WebCore13InlineFlowBox10deleteLineEPNS_11RenderArenaE
-__ZN7WebCore9InlineBox10deleteLineEPNS_11RenderArenaE
-__ZN7WebCore9RenderBox19setInlineBoxWrapperEPNS_9InlineBoxE
-__ZN7WebCore10RenderFlow13removeLineBoxEPNS_13InlineFlowBoxE
-__ZN7WebCore11LayoutState7destroyEPNS_11RenderArenaE
-__ZN7WebCore11LayoutStatedlEPvm
-__ZN7WebCore12RenderObject26repaintAfterLayoutIfNeededERKNS_7IntRectES3_
-__ZNK7WebCore12RenderObject29mustRepaintBackgroundOrBorderEv
-__ZN7WebCore9FrameView14addRepaintInfoEPNS_12RenderObjectERKNS_7IntRectE
-__ZN3WTF6VectorIN7WebCore12RenderObject11RepaintInfoELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIN7WebCore12RenderObject11RepaintInfoELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore12RenderObject11RepaintInfoELm0EE15reserveCapacityEm
-__ZN7WebCore9RenderBox26repaintDuringLayoutIfMovedERKNS_7IntRectE
-__ZN7WebCore11RenderBlock24repaintOverhangingFloatsEb
-__ZNK7WebCore12RenderObject14isDescendantOfEPKS0_
-__ZN7WebCore11RenderBlock37markAllDescendantsWithFloatsForLayoutEPNS_12RenderObjectE
-__ZN7WebCore11RenderBlock18addIntrudingFloatsEPS0_ii
-__ZN7WebCore12RenderObject24repaintOverhangingFloatsEb
-__ZN7WebCore11RenderBlock19adjustFloatingBlockERKNS0_10MarginInfoE
-__ZNK7WebCore11RenderBlock18nearestFloatBottomEi
-__ZN7WebCore12RenderObject16repaintRectangleERKNS_7IntRectEb
-__ZN3WTF6VectorIN7WebCore12RenderObject11RepaintInfoELm0EE6shrinkEm
-__ZN7WebCore13compareZIndexEPNS_11RenderLayerES1_
-__ZSt25__unguarded_linear_insertIPPN7WebCore11RenderLayerES2_PFbS2_S2_EEvT_T0_T1_
-__ZSt5mergeIPPN7WebCore11RenderLayerES3_S3_PFbS2_S2_EET1_T_S7_T0_S8_S6_T2_
-__ZN7WebCore9nullImageEv
-__ZN7WebCore12RenderObject11paintBorderEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleEbb
-__ZN7WebCore12RenderObject10drawBorderEPNS_15GraphicsContextEiiiiNS0_10BorderSideENS_5ColorERKS4_NS_12EBorderStyleEii
-__ZN7WebCore15GraphicsContext14drawTiledImageEPNS_5ImageERKNS_7IntRectERKNS_8IntPointERKNS_7IntSizeENS_17CompositeOperatorE
-__ZN7WebCore5Image9drawTiledEPNS_15GraphicsContextERKNS_9FloatRectERKNS_10FloatPointERKNS_9FloatSizeENS_17CompositeOperatorE
-__ZN7WebCore11BitmapImage26nativeImageForCurrentFrameEv
-__ZN7WebCore11ImageSource15repetitionCountEv
-__ZThn256_N7WebCore11CachedImage18decodedSizeChangedEPKNS_5ImageEi
-__ZN7WebCore11CachedImage18decodedSizeChangedEPKNS_5ImageEi
-__ZN7WebCore14CachedResource14setDecodedSizeEj
-__ZN7WebCore5Cache32insertInLiveDecodedResourcesListEPNS_14CachedResourceE
-__ZNK7WebCore5Image16hasRelativeWidthEv
-__ZNK7WebCore5Image17hasRelativeHeightEv
-__ZN7WebCore15AffineTransformC2Ev
-__ZN7WebCore15AffineTransform5scaleEdd
-__ZNK7WebCore9FloatRect8containsERKS0_
-__ZThn256_N7WebCore11CachedImage7didDrawEPKNS_5ImageE
-__ZN7WebCore11CachedImage7didDrawEPKNS_5ImageE
-__ZN7WebCore14CachedResource20didAccessDecodedDataEd
-__ZN7WebCore14RenderThemeMac16paintSearchFieldEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZNK7WebCore14RenderThemeMac6searchEv
-__ZN7WebCore14RenderThemeMac18setSearchCellStateEPNS_12RenderObjectERKNS_7IntRectE
-__ZNK7WebCore17RenderTextControl15controlClipRectEii
-__ZNK7WebCore12RenderObject10contentBoxEv
-__ZN7WebCore14RenderThemeMac26paintSearchFieldDecorationEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZNK7WebCore11RenderLayer11boundingBoxEPKS0_
-__ZNK7WebCore5Image4rectEv
-__ZNK7WebCore8Document4pageEv
-__ZNK7WebCore4Page34inLowQualityImageInterpolationModeEv
-__ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_7IntRectENS_17CompositeOperatorEb
-__ZN7WebCore11ImageSource20frameDurationAtIndexEm
-__ZN7WebCore11BitmapImage22invalidatePlatformDataEv
-__ZN7WebCore38jsDocumentPrototypeFunctionCreateEventEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document11createEventERKNS_6StringERi
-__ZN7WebCore5EventC2Ev
-__ZN7WebCore7JSEvent18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore16JSEventPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore33jsEventPrototypeFunctionInitEventEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore7JSEvent9classInfoEv
-__ZN7WebCore5Event9initEventERKNS_12AtomicStringEbb
-__ZN7WebCore7JSEvent3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore26jsEventTargetDispatchEventEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7toEventEPN3KJS7JSValueE
-__ZThn36_N7WebCore15EventTargetNode13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERib
-__ZN7WebCore5TimerINS_8DocumentEE5firedEv
-__ZN7WebCore8Document24imageLoadEventTimerFiredEPNS_5TimerIS0_EE
-__ZN3KJS30JSXMLHttpRequestConstructorImpC2EPNS_9ExecStateEPN7WebCore8DocumentE
-__ZN3KJS25JSXMLHttpRequestPrototype4selfEPNS_9ExecStateE
-__ZNK3KJS30JSXMLHttpRequestConstructorImp19implementsConstructEv
-__ZN3KJS30JSXMLHttpRequestConstructorImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS16JSXMLHttpRequestC1EPNS_8JSObjectEPN7WebCore8DocumentE
-__ZN7WebCore14XMLHttpRequestC2EPNS_8DocumentE
-__ZNK3WTF7HashMapIPN7WebCore8DocumentEPNS_7HashSetIPNS1_14XMLHttpRequestENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEENS7_IS3_EENS9_IS3_EENS9_ISC_EEE3getERKS3_
-__ZN3WTF9HashTableIiSt4pairIiiENS_18PairFirstExtractorIS2_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEES9_EES9_E3addIPN7WebCore16AtomicStringImplESF_NS_17HashMapTranslatorILb1ES1_ISF_SF_ENS_18PairBaseHashTraitsINS8_ISF_EESJ_EESA_NS_7PtrHashISF_EEEEEES1_INS_17HashTableIteratorIiS2_S4_S6_SA_S9_EEbERKT_RKT0_
-__ZN3WTF7HashSetIPN7WebCore14XMLHttpRequestENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E3addIPN7WebCore5XPath4Step8NodeTestESD_NS_17HashSetTranslatorILb1ESD_NS5_ISD_EES6_NS_7PtrHashISD_EEEEEESt4pairINS_17HashTableIteratorIiiS2_S4_S6_S6_EEbERKT_RKT0_
-__ZNK3KJS16JSXMLHttpRequest9toBooleanEPNS_9ExecStateE
-__ZN3KJS16JSXMLHttpRequest18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS17staticValueGetterINS_16JSXMLHttpRequestEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK3KJS16JSXMLHttpRequest16getValuePropertyEPNS_9ExecStateEi
-__ZNK7WebCore14XMLHttpRequest13getReadyStateEv
-__ZN3KJS25JSXMLHttpRequestPrototype18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS37jsXMLHttpRequestPrototypeFunctionOpenEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS16JSXMLHttpRequest9classInfoEv
-__ZN3KJS6Window14retrieveActiveEPNS_9ExecStateE
-__ZN7WebCore16DeprecatedStringC2ERKN3KJS7UStringE
-__ZN7WebCore11FrameLoader11completeURLERKNS_6StringE
-__ZN7WebCore14XMLHttpRequest4openERKNS_6StringERKNS_4KURLEbRi
-__ZN7WebCore14XMLHttpRequest5abortEv
-__ZNK7WebCore14XMLHttpRequest24urlMatchesDocumentDomainERKNS_4KURLE
-__ZN7WebCore12isValidTokenERKNS_6StringE
-__ZNK7WebCore6String5upperEv
-__ZN7WebCore10StringImpl5upperEv
-__ZN7WebCore14XMLHttpRequest11changeStateENS_19XMLHttpRequestStateE
-__ZN7WebCore14XMLHttpRequest28callReadyStateChangeListenerEv
-__ZN7WebCore14XMLHttpRequest13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERib
-__ZN3KJS25windowProtoFuncSetTimeoutEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS16JSXMLHttpRequest3putEPNS_9ExecStateERKNS_10IdentifierEPNS_7JSValueEi
-__ZN3KJS16JSXMLHttpRequest16putValuePropertyEPNS_9ExecStateEiPNS_7JSValueEi
-__ZN3KJS6Window38findOrCreateJSUnprotectedEventListenerEPNS_7JSValueEb
-__ZN3KJS6Window30findJSUnprotectedEventListenerEPNS_7JSValueEb
-__ZN3WTF7HashMapIPN3KJS8JSObjectEPN7WebCore26JSUnprotectedEventListenerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3setERKS3_RKS6_
-__ZN7WebCore26JSUnprotectedEventListenerC2EPN3KJS8JSObjectEPNS1_6WindowEb
-__ZN3KJS6Window31jsUnprotectedHTMLEventListenersEv
-__ZN7WebCore14XMLHttpRequest29setOnReadyStateChangeListenerEPNS_13EventListenerE
-__ZN3KJS49jsXMLHttpRequestPrototypeFunctionSetRequestHeaderEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore14XMLHttpRequest16setRequestHeaderERKNS_6StringES3_Ri
-__ZN7WebCore19canSetRequestHeaderERKNS_6StringE
-__ZNK3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_15CaseFoldingHashENS_10HashTraitsIS3_EES8_E8containsIS3_NS_22IdentityHashTranslatorIS3_S3_S6_EEEEbRKT_
-__ZN3KJS37jsXMLHttpRequestPrototypeFunctionSendEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore14XMLHttpRequest4sendERKNS_6StringERi
-__ZN7WebCore19ResourceRequestBase13setHTTPMethodERKNS_6StringE
-__ZN7WebCore19ResourceRequestBase19addHTTPHeaderFieldsERKN3WTF7HashMapINS_6StringES3_NS_15CaseFoldingHashENS1_10HashTraitsIS3_EES6_EE
-__ZN7WebCore19ResourceRequestBase18addHTTPHeaderFieldERKNS_6StringES3_
-__ZN7WebCore41jsDocumentPrototypeFunctionGetElementByIdEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore38jsElementPrototypeFunctionSetAttributeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZNK7WebCore5Event14isStorageEventEv
+__ZNK7WebCore5Event22isWebKitAnimationEventEv
+__ZNK7WebCore5Event23isWebKitTransitionEventEv
+__ZN7WebCore7JSEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN3JSC9Structure6createENS_7JSValueERKNS_8TypeInfoE
+__ZN7WebCore7JSEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_5EventEEE
+__ZN7WebCore7JSEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_5EventEEE
+__ZNK7WebCore17JSDOMGlobalObject12currentEventEv
+__ZN7WebCore17JSDOMGlobalObject15setCurrentEventEPNS_5EventE
+__ZN7WebCore14JSHTMLDocument18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore14JSHTMLDocument18canGetItemsForNameEPN3JSC9ExecStateEPNS_12HTMLDocumentERKNS1_10IdentifierE
+__ZN7WebCore12AtomicString4findERKN3JSC10IdentifierE
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_10StringHashENS_10HashTraitsIS3_EES8_E4findINS1_17
+__ZN7WebCore23JSHTMLDocumentPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19JSDocumentPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore41jsDocumentPrototypeFunctionGetElementByIdEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK3JSC6JSCell8isObjectEPKNS_9ClassInfoE
+__ZNK7WebCore14JSHTMLDocument9classInfoEv
+__ZNK7WebCore8Document14getElementByIdERKNS_12AtomicStringE
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_7ElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
+__ZN7WebCoreL29createHTMLInputElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLInputElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLInputElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLInputElementEEE
+__ZN7WebCore18JSHTMLInputElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLInputElementEEE
+__ZN7WebCore18JSHTMLInputElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore13JSHTMLElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSHTMLInputElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22JSHTMLElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore31jsElementPrototypeFunctionFocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZNK7WebCore18JSHTMLInputElement9classInfoEv
-__ZN7WebCore9JSElement12setAttributeEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore7Element12setAttributeERKNS_6StringES3_Ri
-__ZNK7WebCore12NamedAttrMap16getAttributeItemERKNS_6StringE
-__ZN7WebCore38jsElementPrototypeFunctionGetAttributeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore7Element12getAttributeERKNS_6StringE
-__ZNK7WebCore13QualifiedName8toStringEv
-__ZN3KJS14jsStringOrNullERKN7WebCore6StringE
-__ZN7WebCore9InlineBox6removeEv
-__ZN7WebCore13InlineFlowBox11removeChildEPNS_9InlineBoxE
-__ZN7WebCore13RootInlineBox12childRemovedEPNS_9InlineBoxE
-__ZN7WebCore12RenderObject12removeLayersEPNS_11RenderLayerE
-__ZN7WebCore11RenderLayer11removeChildEPS0_
-__ZN3WTF6VectorIPN7WebCore11RenderLayerELm0EE6shrinkEm
-__ZN7WebCore11RenderLayer28dirtyVisibleDescendantStatusEv
-__ZN7WebCore9InlineBox14dirtyLineBoxesEv
-__ZNK7WebCore14RenderThemeMac39adjustSearchFieldResultsDecorationStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZNK7WebCore12RenderObject5layerEv
-__ZN7WebCore15DynamicNodeList24rootNodeAttributeChangedEv
-__ZN7WebCore18JSHTMLInputElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore22JSHTMLInputElementBase3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore13JSHTMLElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore9JSElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore17JSEventTargetNode16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore25eventNameForPropertyTokenEi
-__ZNK7WebCore17JSEventTargetNode11setListenerEPN3KJS9ExecStateERKNS_12AtomicStringEPNS1_7JSValueE
-__ZN7WebCore26JSHTMLFormElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore17JSHTMLFormElement9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore6JSNodeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore6JSNode16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore34jsNodePrototypeFunctionRemoveChildEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore6JSNode11removeChildEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore13ContainerNode11removeChildEPNS_4NodeERi
-__ZN7WebCore15willRemoveChildEPNS_4NodeE
-__ZN7WebCore8Document23notifyBeforeNodeRemovalEPNS_4NodeE
-__ZN7WebCore19SelectionController17nodeWillBeRemovedEPNS_4NodeE
-__ZN7WebCore15DynamicNodeList6Caches5resetEv
-__ZN7WebCore15DynamicNodeList23rootNodeChildrenChangedEv
-__ZN7WebCore7Element19removedFromDocumentEv
-__ZN7WebCore8Document17removeElementByIdERKNS_12AtomicStringEPNS_7ElementE
-__ZN7WebCore13ContainerNode19removedFromDocumentEv
-__ZN7WebCore15EventTargetNode19removedFromDocumentEv
-__ZN7WebCore11EventTarget19removedFromDocumentEPNS_15EventTargetNodeE
-__ZN7WebCore4Node19removedFromDocumentEv
-__ZN7WebCore22HTMLGenericFormElement15removedFromTreeEb
-__ZN7WebCore15HTMLFormElement17removeFormElementEPNS_22HTMLGenericFormElementE
-__ZN7WebCore13ContainerNode15removedFromTreeEb
-__ZNK7WebCore13StyledElement18createAttributeMapEv
-__ZN7WebCore16HTMLImageElement8setWidthEi
-__ZN7WebCore16HTMLImageElement9setHeightEi
-__ZN7WebCore16HTMLImageElement9setBorderERKNS_6StringE
-__ZN7WebCore16HTMLImageElement6setAltERKNS_6StringE
-__ZN7WebCore13JSHTMLElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore11HTMLElement5setIdERKNS_6StringE
-__ZN7WebCore18JSHTMLImageElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore9JSElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore9JSElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore13StyledElement5styleEv
-__ZN7WebCore13StyledElement18getInlineStyleDeclEv
-__ZN7WebCore13StyledElement21createInlineStyleDeclEv
-__ZN7WebCore26CSSMutableStyleDeclarationC1Ev
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_19CSSStyleDeclarationE
-__ZN7WebCore30JSCSSStyleDeclarationPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore21JSCSSStyleDeclarationC1EPN3KJS8JSObjectEPNS_19CSSStyleDeclarationE
-__ZN7WebCore21JSCSSStyleDeclaration3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore21JSCSSStyleDeclaration9customPutEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore17isCSSPropertyNameERKN3KJS10IdentifierE
-__ZN7WebCore15cssPropertyNameERKN3KJS10IdentifierEPb
-__ZN7WebCore16DeprecatedStringC2ERKN3KJS10IdentifierE
-__ZN7WebCore19CSSStyleDeclaration14isPropertyNameERKNS_6StringE
-__ZN7WebCore10propertyIDERKNS_6StringE
-__ZN7WebCore19CSSStyleDeclaration11setPropertyERKNS_6StringES3_Ri
-__ZN7WebCore19CSSStyleDeclaration11setPropertyERKNS_6StringES3_S3_Ri
-__ZN7WebCore26CSSMutableStyleDeclaration11setPropertyEiRKNS_6StringEbRi
-__ZN7WebCore13StyledElement24invalidateStyleAttributeEv
-__ZNK7WebCore18JSHTMLImageElement9classInfoEv
-__ZNK7WebCore26CSSMutableStyleDeclaration7cssTextEv
-__ZNK7WebCore11CSSProperty7cssTextEv
-__ZNK7WebCore17CSSPrimitiveValue7cssTextEv
-__Z12getValueNamet
-__Z15getPropertyName13CSSPropertyID
-__ZN7WebCore17JSHTMLFormElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore23replaceChildrenWithTextEPNS_11HTMLElementERKNS_6StringERi
-__ZN7WebCore9ClipRects7destroyEPNS_11RenderArenaE
-__ZN7WebCore9ClipRectsdlEPvm
-__ZN7WebCore14RenderThemeMac33paintSearchFieldResultsDecorationEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore25HTMLTextFieldInnerElement16shadowParentNodeEv
-__ZN7WebCore12RenderObject23absoluteBoundingBoxRectEv
-__ZN7WebCore12RenderObject13absoluteRectsERN3WTF6VectorINS_7IntRectELm0EEEiib
-__ZN3WTF6VectorIN7WebCore7IntRectELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore7IntRectELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore7IntRectELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIN7WebCore7IntRectELm0EE6shrinkEm
-__ZThn8_N7WebCore14XMLHttpRequest18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
-__ZN7WebCore14XMLHttpRequest18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
-__ZN7WebCore27extractCharsetFromMediaTypeERKNS_6StringE
-__ZThn8_N7WebCore14XMLHttpRequest14didReceiveDataEPNS_17SubresourceLoaderEPKci
-__ZN7WebCore14XMLHttpRequest14didReceiveDataEPNS_17SubresourceLoaderEPKci
-__ZN7WebCore14XMLHttpRequest14refEventTargetEv
-__ZNK7WebCore26JSUnprotectedEventListener11listenerObjEv
-__ZNK7WebCore26JSUnprotectedEventListener9windowObjEv
-__ZN7WebCore11EventTarget6toNodeEv
-__ZN7WebCore14XMLHttpRequest16toXMLHttpRequestEv
-__ZNK7WebCore14XMLHttpRequest13responseIsXMLEv
-__ZNK7WebCore14XMLHttpRequest16responseMIMETypeEv
-__ZN7WebCore28extractMIMETypeFromMediaTypeERKNS_6StringE
-__ZN7WebCore17DOMImplementation13isXMLMIMETypeERKNS_6StringE
-__ZNK7WebCore17DeprecatedCString4findEPKcib
-__ZNK7WebCore17DeprecatedCString3midEjj
-__ZNK7WebCore12TextEncoding21closest8BitEquivalentEv
-__ZN7WebCore22UTF16BigEndianEncodingEv
-__ZN7WebCore25UTF16LittleEndianEncodingEv
-__ZNK7WebCore14XMLHttpRequest9getStatusERi
-__ZNK7WebCore14XMLHttpRequest13getStatusTextERi
-__ZNK7WebCore14XMLHttpRequest15getResponseTextERi
-__ZN3KJS19jsOwnedStringOrNullERKNS_7UStringE
-__ZN3KJS50jsXMLHttpRequestPrototypeFunctionGetResponseHeaderEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK7WebCore14XMLHttpRequest17getResponseHeaderERKNS_6StringERi
-__ZThn8_N7WebCore14XMLHttpRequest16didFinishLoadingEPNS_17SubresourceLoaderE
-__ZN7WebCore14XMLHttpRequest16didFinishLoadingEPNS_17SubresourceLoaderE
-__ZNK7WebCore14XMLHttpRequest14getResponseXMLERi
-__ZNK7WebCore8Document14implementationEv
-__ZN7WebCore17DOMImplementation14createDocumentEPNS_5FrameE
-__ZN7WebCore8DocumentC2EPNS_17DOMImplementationEPNS_5FrameEb
-__ZN7WebCore8Document4openEv
-__ZN7WebCore8Document15createTokenizerEv
-__ZN7WebCore12XMLTokenizerC2EPNS_8DocumentEPNS_9FrameViewE
-__ZN7WebCore12XMLTokenizer5writeERKNS_15SegmentedStringEb
-__ZNK7WebCore15SegmentedString8toStringEv
-__ZN7WebCore12XMLTokenizer23initializeParserContextEv
-__ZN7WebCore18createStringParserEP14_xmlSAXHandlerPv
-__ZN7WebCore20startDocumentHandlerEPv
-__ZN7WebCore12XMLTokenizer13startDocumentEPKhS2_i
-__ZN7WebCore8Document13setXMLVersionERKNS_6StringERi
-__ZNK7WebCore17DOMImplementation10hasFeatureERKNS_6StringES3_
-__ZN7WebCore8Document16setXMLStandaloneEbRi
-__ZN7WebCore21startElementNsHandlerEPvPKhS2_S2_iPS2_iiS3_
-__ZN7WebCore12XMLTokenizer14startElementNsEPKhS2_S2_iPS2_iiS3_
-__ZN7WebCore12XMLTokenizer8exitTextEv
-__ZN7WebCore8toStringEPKh
-__ZN7WebCore8Document13createElementERKNS_13QualifiedNameEbRi
-__ZN7WebCore7ElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore7Element14setAttributeNSERKNS_6StringES3_S3_Ri
-__ZN7WebCore8Document18parseQualifiedNameERKNS_6StringERS1_S4_
-__ZNK7WebCore7Element28updateStyleAttributeIfNeededEv
-__ZNK7WebCore7Element18createAttributeMapEv
-__ZN7WebCore12NamedAttrMapC2EPNS_7ElementE
-__ZN7WebCore7Element15createAttributeERKNS_13QualifiedNameEPNS_10StringImplE
-__ZN7WebCore7Element16attributeChangedEPNS_9AttributeEb
-__ZNK7WebCore8Document14isHTMLDocumentEv
-__ZN7WebCore12XMLTokenizer14setCurrentNodeEPNS_4NodeE
-__ZN7WebCore17charactersHandlerEPvPKhi
-__ZN7WebCore12XMLTokenizer10charactersEPKhi
-__ZN7WebCore12XMLTokenizer9enterTextEv
-__ZN3WTF6VectorIhLm0EE6appendIhEEvPKT_m
-__ZN3WTF6VectorIhLm0EE14expandCapacityEmPKh
-__ZN3WTF6VectorIhLm0EE14expandCapacityEm
-__ZN3WTF6VectorIhLm0EE15reserveCapacityEm
-__ZN7WebCore13CharacterData10appendDataERKNS_6StringERi
-__ZN7WebCore13CharacterData21dispatchModifiedEventEPNS_10StringImplE
-__ZN7WebCore4Node15childrenChangedEb
-__ZN3WTF6VectorIhLm0EE6shrinkEm
-__ZN7WebCore19endElementNsHandlerEPvPKhS2_S2_
-__ZN7WebCore12XMLTokenizer12endElementNsEv
-__ZN7WebCore16getEntityHandlerEPvPKh
-__ZN7WebCore12XMLTokenizer6finishEv
-__ZN7WebCore12XMLTokenizer3endEv
-__ZN7WebCore18endDocumentHandlerEPv
-__ZN7WebCore12XMLTokenizer11endDocumentEv
-__ZNK7WebCore12XMLTokenizer10wellFormedEv
-__ZN7WebCore12XMLTokenizerD1Ev
-__ZNK7WebCore8Document13isSVGDocumentEv
-__ZNK7WebCore10JSDocument9classInfoEv
-__ZNK7WebCore10JSNodeList14implementsCallEv
-__ZN7WebCore10JSNodeList18canGetItemsForNameEPN3KJS9ExecStateEPNS_8NodeListERKNS1_10IdentifierE
-__ZNK7WebCore15DynamicNodeList12itemWithNameERKNS_12AtomicStringE
-__ZN7WebCore19JSNodeListPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore10JSNodeList9classInfoEv
-__ZNK7WebCore15DynamicNodeList24itemBackwardsFromCurrentEPNS_4NodeEji
-__ZNK7WebCore4Node20traversePreviousNodeEPKS0_
-__ZNK7WebCore4Node16virtualLastChildEv
-__ZN7WebCore46jsElementPrototypeFunctionGetElementsByTagNameEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9JSElement9classInfoEv
-__ZN7WebCore4Node10childNodesEv
-__ZN7WebCore13ChildNodeListC1EN3WTF10PassRefPtrINS_4NodeEEEPNS_15DynamicNodeList6CachesE
-__ZN7WebCore15DynamicNodeListC2EN3WTF10PassRefPtrINS_4NodeEEEPNS0_6CachesEb
-__ZNK7WebCore13ChildNodeList6lengthEv
-__ZNK7WebCore13ChildNodeList4itemEj
-__ZN7WebCore6JSText18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore15JSCharacterData18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19createAnchorWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore28JSHTMLAnchorElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSHTMLAnchorElementC1EPN3KJS8JSObjectEPNS_17HTMLAnchorElementE
-__ZN7WebCore19JSHTMLAnchorElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore11HTMLElement12setInnerHTMLERKNS_6StringERi
-__ZN7WebCore11HTMLElement24createContextualFragmentERKNS_6StringE
-__ZN7WebCore16DocumentFragmentC2EPNS_8DocumentE
-__ZN7WebCore25parseHTMLDocumentFragmentERKNS_6StringEPNS_16DocumentFragmentE
-__ZN7WebCore13HTMLTokenizerC2EPNS_16DocumentFragmentE
-__ZN7WebCore10HTMLParserC2EPNS_16DocumentFragmentE
-__ZN7WebCore13HTMLTokenizer19setForceSynchronousEb
-__ZN7WebCore16DocumentFragment16childTypeAllowedENS_4Node8NodeTypeE
-__ZN7WebCore27replaceChildrenWithFragmentEPNS_11HTMLElementEN3WTF10PassRefPtrINS_16DocumentFragmentEEERi
-__ZN7WebCore13CharacterData7setDataERKNS_6StringERi
-__ZN7WebCore10RenderText15setTextInternalEN3WTF10PassRefPtrINS_10StringImplEEE
-__ZN7WebCore8Document13removeMarkersEPNS_4NodeE
-__ZNK7WebCore4Node13hasChildNodesEv
-__ZN7WebCore14XMLHttpRequest14dropProtectionEv
--[DOMNodeList item:]
--[DOMNode attributes]
-__ZNK7WebCore7Element10attributesEv
-+[DOMNamedNodeMap(WebCoreInternal) _wrapNamedNodeMap:]
--[DOMNamedNodeMap(WebCoreInternal) _initWithNamedNodeMap:]
--[DOMNamedNodeMap getNamedItem:]
-__ZNK7WebCore12NamedAttrMap12getNamedItemERKNS_6StringE
-__ZN7WebCore9Attribute18createAttrIfNeededEPNS_7ElementE
-__ZN7WebCore4AttrC1EPNS_7ElementEPNS_8DocumentEN3WTF10PassRefPtrINS_9AttributeEEE
-__ZN7WebCore4Attr15createTextChildEv
-__ZNK7WebCore4Attr8nodeTypeEv
--[DOMNode nodeValue]
-__ZNK7WebCore4Attr9nodeValueEv
--[DOMNamedNodeMap dealloc]
-__ZNK7WebCore9TimerBase16nextFireIntervalEv
-__ZN7WebCore6Screen15disconnectFrameEv
-__ZNK7WebCore6Screen10availWidthEv
-__ZN7WebCore19screenAvailableRectEPNS_6WidgetE
-__ZN7WebCore16HTMLInputElementD1Ev
-__ZN7WebCore22HTMLGenericFormElement14removeFromFormEv
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore31HTMLFormControlElementWithStateEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_NS_7PtrHashIS4_EEEENS_10HashTraitsIS6_EESE_E4findIS4_NS_21ListHashSetTranslatorIS4_SB_EEEENS_17HashTableIteratorIS6_S6_S8_SC_SE_SE_EERKT_
-__ZN3WTF11ListHashSetIPN7WebCore31HTMLFormControlElementWithStateENS_7PtrHashIS3_EEE15unlinkAndDeleteEPNS_15ListHashSetNodeIS3_EE
-__ZN7WebCore12NamedAttrMap17detachFromElementEv
-__ZN7WebCore18NamedMappedAttrMap15clearAttributesEv
-__ZN7WebCore14XMLHttpRequest16derefEventTargetEv
-__ZN7WebCore14XMLHttpRequest17setOnLoadListenerEPNS_13EventListenerE
-__ZN3WTF9HashTableIiSt4pairIiNS_6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EEEENS_18PairFirstExtractorIS8_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSE_IS7_EEEESF_E6expandEv
-__ZN7WebCore28removeFromRequestsByDocumentEPNS_8DocumentEPNS_14XMLHttpRequestE
-__ZN7WebCore7ElementD1Ev
-__ZN7WebCore12NamedAttrMapD1Ev
-__ZN3WTF23HashTableRefCounterBaseILb1ENS_9HashTableIPN7WebCore10StringImplESt4pairIS4_NS2_15DynamicNodeList6CachesEENS_18PairFirstExtractorIS8_EENS2_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS4_EENSD_IS7_EEEESE_EENS_18PairBaseHashTraitsINSD_INS2_6StringEEESF_EEE8derefAllERSH_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_15DynamicNodeList6CachesEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E6expandEv
-__ZN3KJS7Plugins10nameGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN7WebCore15baseConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore15HTMLBaseElementC2EPNS_8DocumentE
-__ZN7WebCore15HTMLBaseElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore15HTMLBaseElement7processEv
-__ZNK7WebCore15HTMLBaseElement17endTagRequirementEv
-__ZNK7WebCore15HTMLBaseElement11tagPriorityEv
-__ZN7WebCore15HTMLBaseElement20insertedIntoDocumentEv
-__ZN7WebCore10HTMLParser24noscriptCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore9CSSParser22rollbackLastPropertiesEi
-__ZN7WebCore9CSSParser13parseSVGValueEib
-__ZN7WebCore10IconLoader6createEPNS_5FrameE
-__ZN7WebCore10IconLoaderC2EPNS_5FrameE
-__ZN7WebCore10IconLoader12startLoadingEv
-__ZN7WebCore19DeprecatedValueListINS_18SegmentedSubstringEE8copyNodeEPNS_27DeprecatedValueListImplNodeE
-__ZN7WebCore19DeprecatedValueListINS_18SegmentedSubstringEE10deleteNodeEPNS_27DeprecatedValueListImplNodeE
-__ZN7WebCore23DeprecatedValueListImpl11prependNodeEPNS_27DeprecatedValueListImplNodeE
-__ZN7WebCore11HTMLElement19isRecognizedTagNameERKNS_13QualifiedNameE
-__ZN7WebCore9HTMLNames11getHTMLTagsEPm
-__ZN7WebCore11CSSRuleDataD2Ev
-__ZN7WebCore11RenderStyle17setHasPseudoStyleENS0_8PseudoIdE
-__ZN7WebCore11RenderStyle10setContentEPNS_10StringImplEb
-__ZN7WebCore18RenderTextFragmentC2EPNS_4NodeEPNS_10StringImplE
-__ZN7WebCore14RenderListItemC2EPNS_4NodeE
-__ZN7WebCore14RenderListItem8setStyleEPNS_11RenderStyleE
-__ZNK7WebCore14RenderListItem10isListItemEv
-__ZN7WebCore23updateListMarkerNumbersEPNS_12RenderObjectE
-__ZN7WebCore14RenderListItem18clearExplicitValueEv
-__ZNK7WebCore9DOMWindow7historyEv
-__ZN7WebCore7HistoryC2EPNS_5FrameE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_7HistoryE
-__ZN7WebCore18JSHistoryPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore9JSHistoryC1EPN3KJS8JSObjectEPNS_7HistoryE
-__ZN7WebCore9JSHistory18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore9JSHistory24customGetOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore7History5frameEv
-__ZN3KJS17staticValueGetterIN7WebCore9JSHistoryEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore9JSHistory16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore7History6lengthEv
-__ZN7WebCore11FrameLoader16getHistoryLengthEv
-__ZN7WebCore15BackForwardList13backListCountEv
-__ZN7WebCore18createUListWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore27JSHTMLUListElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLUListElementC1EPN3KJS8JSObjectEPNS_16HTMLUListElementE
-__ZN7WebCore18JSHTMLUListElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore15createLIWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore24JSHTMLLIElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSHTMLLIElementC1EPN3KJS8JSObjectEPNS_13HTMLLIElementE
-__ZN7WebCore15JSHTMLLIElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore11HTMLElement12setClassNameERKNS_6StringE
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE6shrinkEm
-__ZN7WebCore19JSHTMLAnchorElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore15JSHTMLLIElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore11ContentData5clearEv
-__ZN7WebCore12RenderInlineD1Ev
-__ZN7WebCore11RenderBlock20removeFloatingObjectEPNS_12RenderObjectE
-__ZN7WebCore14RenderListItem7destroyEv
-__ZN7WebCore18headingConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore18HTMLHeadingElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore18HTMLHeadingElement17endTagRequirementEv
-__ZNK7WebCore18HTMLHeadingElement11tagPriorityEv
-__ZN7WebCore18HTMLHeadingElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore10HTMLParser19mapCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore14HTMLMapElementC2EPNS_8DocumentE
-__ZN7WebCore14HTMLMapElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore8Document14removeImageMapEPNS_14HTMLMapElementE
-__ZN7WebCore8Document11addImageMapEPNS_14HTMLMapElementE
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_14HTMLMapElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
-__ZNK7WebCore14HTMLMapElement17endTagRequirementEv
-__ZNK7WebCore14HTMLMapElement11tagPriorityEv
-__ZN7WebCore15areaConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore15HTMLAreaElementC2EPNS_8DocumentE
-__ZN7WebCore4PathC2Ev
-__ZN7WebCore15HTMLAreaElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore6String13toCoordsArrayERi
-__ZN7WebCore10StringImpl13toCoordsArrayERi
-__ZN7WebCore14countCharacterEPNS_10StringImplEt
-__ZN7WebCore11parseLengthEPKtj
-__ZNK7WebCore15HTMLAreaElement17endTagRequirementEv
-__ZNK7WebCore15HTMLAreaElement11tagPriorityEv
-__ZN7WebCore14HTMLMapElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore26CSSMutableStyleDeclaration16parseDeclarationERKNS_6StringE
-__ZN7WebCore9CSSParser16parseDeclarationEPNS_26CSSMutableStyleDeclarationERKNS_6StringE
-__ZN7WebCore16JSHTMLDivElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore16embedConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLEmbedElementC2EPNS_8DocumentE
-__ZN7WebCore17HTMLPlugInElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore21HTMLFrameOwnerElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore16HTMLEmbedElement16attributeChangedEPNS_9AttributeEb
-__ZNK7WebCore16HTMLEmbedElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZNK7WebCore17HTMLPlugInElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore16HTMLEmbedElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore17HTMLPlugInElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore16HTMLEmbedElement17endTagRequirementEv
-__ZNK7WebCore16HTMLEmbedElement11tagPriorityEv
-__ZNK7WebCore16DocumentFragment8nodeTypeEv
-__ZN7WebCore16HTMLEmbedElement20insertedIntoDocumentEv
-__ZN7WebCore16HTMLEmbedElement6attachEv
-__ZN7WebCore13ContainerNode23queuePostAttachCallbackEPFvPNS_4NodeEES2_
-__ZN3WTF6VectorISt4pairIPFvPN7WebCore4NodeEENS_6RefPtrIS3_EEELm0EE14expandCapacityEmPKS9_
-__ZN3WTF6VectorISt4pairIPFvPN7WebCore4NodeEENS_6RefPtrIS3_EEELm0EE14expandCapacityEm
-__ZN3WTF6VectorISt4pairIPFvPN7WebCore4NodeEENS_6RefPtrIS3_EEELm0EE15reserveCapacityEm
-__ZN7WebCore16HTMLEmbedElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore16HTMLEmbedElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore16RenderPartObjectC2EPNS_21HTMLFrameOwnerElementE
-__ZN7WebCore10RenderPartC2EPNS_21HTMLFrameOwnerElementE
-__ZN7WebCore12RenderWidgetC2EPNS_4NodeE
-__ZN7WebCore14RenderReplacedC2EPNS_4NodeE
-__ZN7WebCore10RenderView9addWidgetEPNS_12RenderObjectE
-__ZN3WTF7HashSetIPN7WebCore12RenderObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore12RenderWidget8setStyleEPNS_11RenderStyleE
-__ZN7WebCore13ContainerNode27dispatchPostAttachCallbacksEv
-__ZN7WebCore17HTMLPlugInElement20updateWidgetCallbackEPNS_4NodeE
-__ZN7WebCore16HTMLEmbedElement12updateWidgetEv
-__ZN7WebCore16RenderPartObject12updateWidgetEb
-__ZN7WebCore12isURLAllowedEPNS_8DocumentERKNS_6StringE
-__ZN7WebCore16MIMETypeRegistry24isSupportedImageMIMETypeERKNS_6StringE
-__ZN3WTF6VectorISt4pairIPFvPN7WebCore4NodeEENS_6RefPtrIS3_EEELm0EE6shrinkEm
-__ZN7WebCore16HTMLImageElement9setUseMapERKNS_6StringE
-__ZN7WebCore19fieldsetConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore19HTMLFieldSetElementC2EPNS_8DocumentEPNS_15HTMLFormElementE
-__ZNK7WebCore19HTMLFieldSetElement11tagPriorityEv
-__ZNK7WebCore14RenderThemeMac11systemColorEi
-__ZN3WTF7HashMapIijNS_7IntHashIjEENS_10HashTraitsIiEENS3_IjEEE3setERKiRKj
-__ZNK3WTF7HashMapIijNS_7IntHashIjEENS_10HashTraitsIiEENS3_IjEEE3getERKi
-__ZN7WebCore19HTMLFieldSetElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore14RenderFieldsetC2EPNS_22HTMLGenericFormElementE
-__ZN7WebCore14RenderFieldset8setStyleEPNS_11RenderStyleE
-__ZN7WebCore19HTMLFieldSetElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore17legendConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLLegendElementC2EPNS_8DocumentEPNS_15HTMLFormElementE
-__ZNK7WebCore22HTMLGenericFormElement11tagPriorityEv
-__ZN7WebCore17HTMLLegendElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore12RenderLegendC2EPNS_22HTMLGenericFormElementE
-__ZN7WebCore13dlConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLDListElementC2EPNS_8DocumentE
-__ZNK7WebCore16HTMLDListElement17endTagRequirementEv
-__ZNK7WebCore16HTMLDListElement11tagPriorityEv
-__ZN7WebCore10HTMLParser18dtCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCoreleERNS_11CSSRuleDataES1_
-__ZNK7WebCore10RenderText12originalTextEv
-__ZN7WebCore10HTMLParser18ddCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZNK7WebCore16HTMLInputElement17isInputTypeHiddenEv
-__ZN7WebCore21convertNSColorToColorEP7NSColor
-__ZN7WebCore12RenderButtonC2EPNS_4NodeE
-__ZN7WebCore12RenderButton8setStyleEPNS_11RenderStyleE
-__ZNK7WebCore12RenderButton15canHaveChildrenEv
-__ZN7WebCore12RenderButton17updateFromElementEv
-__ZNK7WebCore16HTMLInputElement16valueWithDefaultEv
-__ZN7WebCore12RenderButton7setTextERKNS_6StringE
-__ZN7WebCore12RenderButton8addChildEPNS_12RenderObjectES2_
-__ZN7WebCore14JSHTMLDocument10nameGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore8Document18documentNamedItemsERKNS_6StringE
-__ZNK7WebCore22HTMLGenericFormElement14isEnumeratableEv
-__ZN7WebCore15HTMLFormElement15addElementAliasEPNS_22HTMLGenericFormElementERKNS_12AtomicStringE
-__ZN7WebCore17JSHTMLFormElement10nameGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEENS1_INS2_22HTMLGenericFormElementEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3setEPS3_RKS6_
-__ZN7WebCore40jsHTMLInputElementPrototypeFunctionFocusEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
 __ZN7WebCore7Element5focusEb
 __ZN7WebCore8Document36updateLayoutIgnorePendingStylesheetsEv
-__ZN7WebCore9RenderBox10setStaticXEi
-__ZN7WebCore9RenderBox10setStaticYEi
-__ZNK7WebCore9RenderBox7staticXEv
-__ZNK7WebCore9RenderBox7staticYEv
-__ZN7WebCore14RenderReplaced14calcPrefWidthsEv
-__ZNK7WebCore9RenderBox17calcReplacedWidthEv
-__ZN7WebCore16RenderPartObject6layoutEv
-__ZNK7WebCore9RenderBox18calcReplacedHeightEv
-__ZN7WebCore12RenderWidget6layoutEv
-__ZN7WebCore9FrameView17addWidgetToUpdateEPNS_16RenderPartObjectE
-__ZN3WTF7HashSetIPN7WebCore16RenderPartObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZNK7WebCore14RenderFieldset12avoidsFloatsEv
-__ZNK7WebCore14RenderFieldset28stretchesToMinIntrinsicWidthEv
-__ZN7WebCore14RenderFieldset14calcPrefWidthsEv
-__ZN7WebCore17RenderFlexibleBox14calcPrefWidthsEv
-__ZNK7WebCore14RenderFieldset10findLegendEv
-__ZN7WebCore14RenderFieldset12layoutLegendEb
-__ZN7WebCore14RenderListItem6layoutEv
-__ZN7WebCore14RenderListItem20updateMarkerLocationEv
-__ZN7WebCore14RenderListItem14calcPrefWidthsEv
-__ZN7WebCore14RenderListItem18positionListMarkerEv
-__ZNK7WebCore17RenderFlexibleBox12avoidsFloatsEv
-__ZNK7WebCore12RenderButton14hasControlClipEv
-__ZNK7WebCore12RenderObject12maxTopMarginEb
-__ZNK7WebCore12RenderObject21isSelfCollapsingBlockEv
-__ZNK7WebCore12RenderObject16isTopMarginQuirkEv
-__ZNK7WebCore12RenderObject15maxBottomMarginEb
-__ZN7WebCore12RenderObject14containsFloatsEv
-__ZNK7WebCore12RenderObject21containingBlockHeightEv
-__ZNK7WebCore12RenderInline5widthEv
-__ZNK7WebCore12RenderInline6heightEv
-__ZNK7WebCore12RenderObject13overflowWidthEb
-__ZNK7WebCore12RenderObject14overflowHeightEb
-__ZN7WebCore10RenderPart20updateWidgetPositionEv
-__ZN3WTF6VectorIPN7WebCore16RenderPartObjectELm0EE6resizeEm
-__ZN3WTF6VectorIPN7WebCore16RenderPartObjectELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore16RenderPartObjectELm0EE15reserveCapacityEm
-__ZN7WebCore11FrameLoader13requestObjectEPNS_10RenderPartERKNS_6StringERKNS_12AtomicStringES5_RKN3WTF6VectorIS3_Lm0EEESD_
-__ZN7WebCore11FrameLoader15shouldUsePluginERKNS_4KURLERKNS_6StringEbRb
-__ZN7WebCore11FrameLoader10loadPluginEPNS_10RenderPartERKNS_4KURLERKNS_6StringERKN3WTF6VectorIS6_Lm0EEESD_b
--[WebCoreFrameBridge baseURL]
-__ZN7WebCore6WidgetC1EP6NSView
-__ZN7WebCore10RenderPart9setWidgetEPNS_6WidgetE
-__ZNK7WebCore6Widget11isFrameViewEv
-__ZN7WebCore12RenderWidget9setWidgetEPNS_6WidgetE
-__ZN7WebCore17widgetRendererMapEv
-__ZNK3WTF7HashMapIPKN7WebCore6WidgetEPNS1_12RenderWidgetENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getERKS4_
-__ZN7WebCore12RenderWidget12resizeWidgetEPNS_6WidgetEii
-__ZN7WebCore10ScrollView8addChildEPNS_6WidgetE
-__ZN7WebCore6Widget14addToSuperviewEP6NSView
--[DOMElement(WebPrivate) _windowClipRect]
--[DOMElement(WebCoreInternal) _element]
-__ZNK7WebCore9FrameView22windowClipRectForLayerEPKNS_11RenderLayerEb
-__ZNK7WebCore11RenderLayer16childrenClipRectEv
-__ZNK7WebCore10ScrollView16contentsToWindowERKNS_7IntRectE
-__ZN7WebCore7IntRectC2ERKNS_9FloatRectE
-__ZNK7WebCore9FrameView14windowClipRectEv
-__ZNK7WebCore9FrameView14windowClipRectEb
-__ZN7WebCore5Frame20windowScriptNPObjectEv
-__ZNK7WebCore9DOMWindow3topEv
-__ZN7WebCore4Page16setDefersLoadingEb
-__ZN7WebCore11FrameLoader16setDefersLoadingEb
-__ZN7WebCore14DocumentLoader16setDefersLoadingEb
-__ZN7WebCore19setAllDefersLoadingERKN3WTF7HashSetINS0_6RefPtrINS_14ResourceLoaderEEENS0_7PtrHashIS4_EENS0_10HashTraitsIS4_EEEEb
-__ZN7WebCore14ResourceLoader16setDefersLoadingEb
-__ZN7WebCore14ResourceHandle16setDefersLoadingEb
-_urlIsEmpty
-__ZN7WebCore26NetscapePlugInStreamLoader6createEPNS_5FrameEPNS_32NetscapePlugInStreamLoaderClientE
-__ZN7WebCore26NetscapePlugInStreamLoaderC1EPNS_5FrameEPNS_32NetscapePlugInStreamLoaderClientE
-__ZN7WebCore14ResourceLoader19setShouldBufferDataEb
-__ZN7WebCore14DocumentLoader21addPlugInStreamLoaderEPNS_14ResourceLoaderE
-__ZN7WebCore16RenderPartObject11viewClearedEv
-__ZN7WebCore6Widget16setFrameGeometryERKNS_7IntRectE
-__ZN7WebCore12RenderWidget5derefEPNS_11RenderArenaE
-__ZN3WTF6VectorIPN7WebCore16RenderPartObjectELm0EE6shrinkEm
-__ZNK7WebCore22HTMLGenericFormElement13supportsFocusEv
-__ZNK7WebCore22HTMLGenericFormElement11isFocusableEv
+__ZN7WebCore8Document12updateLayoutEv
+__ZNK7WebCore22HTMLFormControlElement13supportsFocusEv
+__ZNK7WebCore22HTMLFormControlElement11isFocusableEv
 __ZN7WebCore15FocusController14setFocusedNodeEPNS_4NodeEN3WTF10PassRefPtrINS_5FrameEEE
 __ZN7WebCore15FocusController15setFocusedFrameEN3WTF10PassRefPtrINS_5FrameEEE
+__ZN7WebCore8Document14setFocusedNodeEN3WTF10PassRefPtrINS_4NodeEEE
 __ZN7WebCore16HTMLInputElement18dispatchFocusEventEv
-__ZN7WebCore15EventTargetNode18dispatchFocusEventEv
+__ZN7WebCore12InputElement18dispatchFocusEventERNS_16InputElementDataEPNS_8DocumentE
+__ZN7WebCore12InputElement27updatePlaceholderVisibilityERNS_16InputElementDataEPNS_8DocumentEb
+__ZThn128_NK7WebCore16HTMLInputElement15isPasswordFieldEv
+__ZNK7WebCore16HTMLInputElement15isPasswordFieldEv
+__ZN7WebCore4Node18dispatchFocusEventEv
+__ZN7WebCore16HTMLInputElement23preDispatchEventHandlerEPNS_5EventE
+__ZN7WebCore15HTMLFormElement17handleLocalEventsEPNS_5EventEb
+__ZN7WebCore4Node6toNodeEv
+__ZN7WebCore16HTMLInputElement24postDispatchEventHandlerEPNS_5EventEPv
+__ZN7WebCore16HTMLInputElement19defaultEventHandlerEPNS_5EventE
+__ZNK7WebCore5Event25isBeforeTextInsertedEventEv
+__ZNK7WebCore5Event12isMouseEventEv
 __ZNK7WebCore5Event11isDragEventEv
+__ZNK7WebCore5Event12isWheelEventEv
+__ZN7WebCore27RenderTextControlSingleLine12forwardEventEPNS_5EventE
+__ZN7WebCore27RenderTextControlSingleLine27capsLockStateMayHaveChangedEv
 __ZN7WebCore17RenderTextControl12forwardEventEPNS_5EventE
-__ZN7WebCore17RenderTextControl27capsLockStateMayHaveChangedEv
-__ZN7WebCore15EventTargetNode15dispatchUIEventERKNS_12AtomicStringEiN3WTF10PassRefPtrINS_5EventEEE
-__ZN7WebCore7UIEventC2ERKNS_12AtomicStringEbbPNS_9DOMWindowEi
+__ZN7WebCore4Node15dispatchUIEventERKNS_12AtomicStringEiN3WTF10PassRefPtrINS_5EventEEE
+__ZN7WebCore7UIEventC1ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEi
+__ZN7WebCore7UIEventC2ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEi
+__ZN7WebCore5Event18setUnderlyingEventEN3WTF10PassRefPtrIS0_EE
+__ZN7WebCore7UIEventD0Ev
+__ZN7WebCore5EventD2Ev
 __ZN7WebCore13ContainerNode8setFocusEb
+__ZN7WebCore4Node8setFocusEb
 __ZN7WebCore14focusRingColorEv
++[WebCoreControlTintObserver controlTintDidChange]
 __ZN7WebCore26usesTestModeFocusRingColorEv
 __ZNK7WebCore14SVGRenderStyle17inheritedNotEqualEPKS0_
-__ZN7WebCore13widgetForNodeEPNS_4NodeE
+__ZN7WebCore14RenderThemeMac17adjustRepaintRectEPKNS_12RenderObjectERNS_7IntRectE
+__ZN7WebCoreL13widgetForNodeEPNS_4NodeE
+__ZNK7WebCore12RenderObject8isWidgetEv
 __ZN7WebCore6Widget8setFocusEv
 __ZN7WebCore5Frame14frameForWidgetEPKNS_6WidgetE
 __ZN7WebCore12RenderWidget4findEPKNS_6WidgetE
+__ZN7WebCoreL17widgetRendererMapEv
+__ZNK3WTF7HashMapIPKN7WebCore6WidgetEPNS1_12RenderWidgetENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getERKS4_
 -[NSScrollView(WebCoreView) _webcore_effectiveFirstResponder]
 -[NSClipView(WebCoreView) _webcore_effectiveFirstResponder]
 -[NSView(WebCoreView) _webcore_effectiveFirstResponder]
@@ -3703,2139 +3812,2584 @@ __ZN7WebCore6Chrome11focusNSViewEP6NSView
 __ZNK7WebCore16HTMLInputElement20shouldUseInputMethodEv
 __ZN7WebCore8Document27cancelFocusAppearanceUpdateEv
 __ZN7WebCore16HTMLInputElement21updateFocusAppearanceEb
+__ZN7WebCore12InputElement21updateFocusAppearanceERNS_16InputElementDataEPNS_8DocumentEb
+__ZThn128_N7WebCore16HTMLInputElement6selectEv
 __ZN7WebCore16HTMLInputElement6selectEv
 __ZN7WebCore17RenderTextControl6selectEv
 __ZN7WebCore17RenderTextControl17setSelectionRangeEii
 __ZN7WebCore17RenderTextControl23visiblePositionForIndexEi
+__ZN7WebCore15VisiblePositionC1EPNS_4NodeEiNS_9EAffinityE
 __ZN7WebCore15VisiblePositionC2EPNS_4NodeEiNS_9EAffinityE
-__ZN7WebCore8PositionC2EPNS_4NodeEi
+__ZN7WebCore8PositionC1EN3WTF10PassRefPtrINS_4NodeEEEi
+__ZN7WebCore8PositionC2EN3WTF10PassRefPtrINS_4NodeEEEi
+__ZN7WebCore8Position34anchorTypeForLegacyEditingPositionEPNS_4NodeEi
+__ZN7WebCore21editingIgnoresContentEPKNS_4NodeE
+__ZN7WebCore25canHaveChildrenForEditingEPKNS_4NodeE
 __ZN7WebCore15VisiblePosition4initERKNS_8PositionENS_9EAffinityE
 __ZN7WebCore15VisiblePosition17canonicalPositionERKNS_8PositionE
 __ZNK7WebCore8Position8upstreamEv
-__ZN7WebCore14enclosingBlockEPNS_4NodeE
-__ZN7WebCore19enclosingNodeOfTypeERKNS_8PositionEPFbPKNS_4NodeEE
-__ZN7WebCore19highestEditableRootERKNS_8PositionE
-__ZN7WebCore23editableRootForPositionERKNS_8PositionE
-__ZN7WebCore17isContentEditableEPKNS_4NodeE
-__ZN7WebCore7isBlockEPKNS_4NodeE
+__ZN7WebCoreL23enclosingVisualBoundaryEPNS_4NodeE
+__ZN7WebCoreL38endsOfNodeAreVisuallyDistinctPositionsEPNS_4NodeE
+__ZNK7WebCore13ContainerNode9childNodeEj
 __ZNK7WebCore16PositionIterator7atStartEv
-__ZN7WebCore8PositionC2ERKNS_16PositionIteratorE
+__ZNK7WebCore16PositionIteratorcvNS_8PositionEEv
 __ZNK7WebCore8Position11isCandidateEv
 __ZN7WebCore14isTableElementEPNS_4NodeE
-__ZN7WebCore21editingIgnoresContentEPKNS_4NodeE
-__ZN7WebCore25canHaveChildrenForEditingEPKNS_4NodeE
 __ZN7WebCore8Position44hasRenderedNonAnonymousDescendantsWithHeightEPNS_12RenderObjectE
 __ZNK7WebCore12RenderObject27nextInPreOrderAfterChildrenEv
+__ZNK7WebCore8Position29atFirstEditingPositionForNodeEv
 __ZN7WebCore8Position20nodeIsUserSelectNoneEPNS_4NodeE
-__ZN7WebCore9SelectionC2ERKNS_15VisiblePositionES3_
-__ZN7WebCore9Selection8validateEv
+__ZN7WebCore16VisibleSelectionC1ERKNS_15VisiblePositionES3_
+__ZN7WebCore16VisibleSelectionC2ERKNS_15VisiblePositionES3_
+__ZN7WebCore16VisibleSelection8validateEv
+__ZN7WebCore16VisibleSelection33setBaseAndExtentToDeepEquivalentsEv
+__ZN7WebCore15VisiblePositionC1ERKNS_8PositionENS_9EAffinityE
 __ZN7WebCore15VisiblePositionC2ERKNS_8PositionENS_9EAffinityE
 __ZN7WebCore16comparePositionsERKNS_8PositionES2_
-__ZN7WebCore9Selection24adjustForEditableContentEv
+__ZN7WebCore5Range21compareBoundaryPointsEPNS_4NodeEiS2_i
+__ZN7WebCore16VisibleSelection52setStartAndEndFromBaseAndExtentRespectingGranularityEv
+__ZN7WebCore16VisibleSelection47adjustSelectionToAvoidCrossingEditingBoundariesEv
+__ZN7WebCore19highestEditableRootERKNS_8PositionE
+__ZN7WebCore23editableRootForPositionERKNS_8PositionE
 __ZN7WebCore22lowestEditableAncestorEPNS_4NodeE
+__ZN7WebCore16VisibleSelection19updateSelectionTypeEv
 __ZN7WebCore5Frame22setFocusedNodeIfNeededEv
-__ZNK7WebCore9Selection19rootEditableElementEv
-__ZNK7WebCore25HTMLTextFieldInnerElement16isMouseFocusableEv
+__ZNK7WebCore16VisibleSelection19rootEditableElementEv
+__ZNK7WebCore23TextControlInnerElement16isMouseFocusableEv
 __ZNK7WebCore16HTMLInputElement16isMouseFocusableEv
-__ZN7WebCore10RenderFlow9caretRectEiNS_9EAffinityEPi
-__ZNK7WebCore11RenderTheme19caretBlinkFrequencyEv
+__ZNK7WebCore15VisiblePosition14localCaretRectERPNS_12RenderObjectE
+__ZNK7WebCore8Position21getInlineBoxAndOffsetENS_9EAffinityERPNS_9InlineBoxERi
+__ZNK7WebCore8Position21getInlineBoxAndOffsetENS_9EAffinityENS_13TextDirectionERPNS_9InlineBoxERi
+__ZN7WebCore11RenderBlock14localCaretRectEPNS_9InlineBoxEiPi
+__ZNK7WebCore19SelectionController22caretRendersInsideNodeEPNS_4NodeE
 __ZNK7WebCore19SelectionController16caretRepaintRectEv
+__ZNK7WebCore11RenderTheme18caretBlinkIntervalEv
 __ZN7WebCore19SelectionController41selectFrameElementInParentIfFullySelectedEv
 __ZN7WebCore5Frame31notifyRendererOfSelectionChangeEb
-__ZNK7WebCore17RenderTextControl10isTextAreaEv
 __ZN7WebCore17RenderTextControl16selectionChangedEb
 __ZN7WebCore17RenderTextControl12selectionEndEv
 __ZN7WebCore17RenderTextControl23indexForVisiblePositionERKNS_15VisiblePositionE
+__ZN7WebCore5Range6createEN3WTF10PassRefPtrINS_8DocumentEEE
+__ZN7WebCore8Document11attachRangeEPNS_5RangeE
+__ZN3WTF7HashSetIPN7WebCore5RangeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore5RangeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore5RangeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore5RangeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
+__ZN7WebCore5Range8setStartEN3WTF10PassRefPtrINS_4NodeEEEiRi
+__ZNK7WebCore5Range16checkNodeWOffsetEPNS_4NodeEiRi
 __ZN7WebCore5Range8collapseEbRi
+__ZN7WebCore5Range6setEndEN3WTF10PassRefPtrINS_4NodeEEEiRi
 __ZN7WebCore12TextIterator11rangeLengthEPKNS_5RangeEb
+__ZN7WebCore12TextIteratorC1EPKNS_5RangeEbb
+__ZN7WebCore12TextIteratorC2EPKNS_5RangeEbb
+__ZNK7WebCore5Range9firstNodeEv
+__ZNK7WebCore4Node18offsetInCharactersEv
+__ZNK7WebCore5Range12pastLastNodeEv
+__ZN7WebCore12TextIterator7advanceEv
+__ZN7WebCore12TextIterator23representNodeOffsetZeroEv
+__ZN7WebCoreL23shouldEmitTabBeforeNodeEPNS_4NodeE
+__ZN7WebCore11isTableCellEPKNS_4NodeE
+__ZN7WebCoreL27shouldEmitNewlineBeforeNodeEPNS_4NodeE
+__ZN7WebCoreL36shouldEmitNewlinesBeforeAndAfterNodeEPNS_4NodeE
+__ZN7WebCore12TextIterator29shouldRepresentNodeOffsetZeroEv
+__ZN7WebCore5RangeD1Ev
+__ZN7WebCore5RangeD2Ev
+__ZN7WebCore8Document11detachRangeEPNS_5RangeE
+__ZN3WTF9HashTableIPN7WebCore5RangeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22Iden
+__ZN3WTF9HashTableIPN7WebCore5RangeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInvalid
+__ZN3WTF9HashTableIPN7WebCore5RangeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
 __ZN7WebCore17RenderTextControl14selectionStartEv
-__ZN7WebCore5Frame25respondToChangedSelectionERKNS_9SelectionEb
+__ZN7WebCore27RenderTextControlSingleLine14cacheSelectionEii
+__ZThn128_N7WebCore16HTMLInputElement14cacheSelectionEii
+__ZN7WebCore16HTMLInputElement14cacheSelectionEii
+__ZN7WebCore5Frame25respondToChangedSelectionERKNS_16VisibleSelectionEb
 __ZN7WebCore6Editor32isContinuousSpellCheckingEnabledEv
 __ZN7WebCore6Editor24isGrammarCheckingEnabledEv
 __ZN7WebCore9endOfWordERKNS_15VisiblePositionENS_9EWordSideE
 __ZN7WebCore16isEndOfParagraphERKNS_15VisiblePositionE
 __ZN7WebCore14endOfParagraphERKNS_15VisiblePositionE
+__ZN7WebCoreL28renderedAsNonInlineTableOrHREPNS_12RenderObjectE
+__ZN7WebCore14enclosingBlockEPNS_4NodeE
+__ZN7WebCore19enclosingNodeOfTypeERKNS_8PositionEPFbPKNS_4NodeEEb
+__ZN7WebCore17isContentEditableEPKNS_4NodeE
+__ZN7WebCore7isBlockEPKNS_4NodeE
 __ZN7WebCore11startOfWordERKNS_15VisiblePositionENS_9EWordSideE
-__ZN7WebCore16previousBoundaryERKNS_15VisiblePositionEPFjPKtjE
+__ZN7WebCoreL16previousBoundaryERKNS_15VisiblePositionEPFjPKtjjNS_33BoundarySearchContextAvailabilityERbE
 __ZNK7WebCore4Node25enclosingBlockFlowElementEv
 __ZNK7WebCore4Node11isBlockFlowEv
 __ZN7WebCore24rangeCompliantEquivalentERKNS_8PositionE
+__ZNK7WebCore15VisiblePosition8previousEb
+__ZN7WebCore33previousVisuallyDistinctCandidateERKNS_8PositionE
+__ZNK7WebCore8Position10downstreamEv
+__ZNK7WebCore16PositionIterator5atEndEv
+__ZN7WebCore20lastOffsetForEditingEPKNS_4NodeE
+__ZNK7WebCore8Position13atStartOfTreeEv
+__ZNK7WebCore15VisiblePosition14characterAfterEv
+__ZN7WebCore31SimplifiedBackwardsTextIteratorC1EPKNS_5RangeE
 __ZN7WebCore31SimplifiedBackwardsTextIteratorC2EPKNS_5RangeE
+__ZNK7WebCore13ContainerNode14childNodeCountEv
 __ZN7WebCore31SimplifiedBackwardsTextIterator7advanceEv
 __ZNK7WebCore31SimplifiedBackwardsTextIterator5rangeEv
-__ZN7WebCore5RangeC1EPNS_8DocumentEPNS_4NodeEiS4_i
-__ZNK7WebCore5Range13startPositionEv
-__ZNK7WebCore9Selection7toRangeEv
+__ZN7WebCore5Range6createEN3WTF10PassRefPtrINS_8DocumentEEENS2_INS_4NodeEEEiS6_i
+__ZNK7WebCore16VisibleSelection17toNormalizedRangeEv
+__ZN7WebCore5Range6createEN3WTF10PassRefPtrINS_8DocumentEEERKNS_8PositionES7_
 __ZN7WebCore8Document13removeMarkersEPNS_5RangeENS_14DocumentMarker10MarkerTypeE
 __ZN7WebCore8Document13removeMarkersENS_14DocumentMarker10MarkerTypeE
-__ZN7WebCore6Editor25respondToChangedSelectionERKNS_9SelectionE
--[WebCoreFrameBridge fontForSelection:]
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore4NodeEEESt4pairIS4_PS5_INS_6VectorINS2_14DocumentMarkerELm0EEENS6_INS2_7IntRectELm0EEEEE
+__ZN7WebCore6Editor25respondToChangedSelectionERKNS_16VisibleSelectionE
 __ZNK7WebCore6Editor16fontForSelectionERb
 __ZNK7WebCore5Frame22styleForSelectionStartERPNS_4NodeE
-__ZN7WebCore22DeleteButtonController25respondToChangedSelectionERKNS_9SelectionE
-__ZN7WebCore25enclosingDeletableElementERKNS_9SelectionE
+__ZN7WebCore22DeleteButtonController25respondToChangedSelectionERKNS_16VisibleSelectionE
+__ZN7WebCoreL25enclosingDeletableElementERKNS_16VisibleSelectionE
 __ZNK7WebCore5Range23commonAncestorContainerERi
 __ZN7WebCore5Range23commonAncestorContainerEPNS_4NodeES2_
-__ZN7WebCore18isDeletableElementEPKNS_4NodeE
+__ZN7WebCoreL18isDeletableElementEPKNS_4NodeE
 __ZN7WebCore19SelectionController37notifyAccessibilityForSelectionChangeEv
-__ZNK7WebCore5Frame23setSelectionGranularityENS_15TextGranularityE
-__ZNK7WebCore5Frame15revealSelectionERKNS_11RenderLayer15ScrollAlignmentE
-__ZN7WebCore11RenderLayer19scrollRectToVisibleERKNS_7IntRectERKNS0_15ScrollAlignmentES6_
-__ZN7WebCore11RenderLayer15getRectToExposeERKNS_7IntRectES3_RKNS0_15ScrollAlignmentES6_
-__ZNK7WebCore10ScrollView46visibleContentRectConsideringExternalScrollersEv
+__ZN7WebCore5Frame15revealSelectionERKNS_15ScrollAlignmentEb
+__ZN7WebCore19SelectionController19absoluteCaretBoundsEv
+__ZN7WebCore11RenderLayer19scrollRectToVisibleERKNS_7IntRectEbRKNS_15ScrollAlignmentES6_
+__ZNK7WebCore12RenderObject15localToAbsoluteENS_10FloatPointEbb
+__ZN7WebCore11RenderLayer15getRectToExposeERKNS_7IntRectES3_RKNS_15ScrollAlignmentES6_
+__ZNK7WebCore9RenderBox28canBeProgramaticallyScrolledEb
 __ZN7WebCore9FrameView29scrollRectIntoViewRecursivelyERKNS_7IntRectE
-__ZNK7WebCore5Frame18prohibitsScrollingEv
 __ZN7WebCore10ScrollView29scrollRectIntoViewRecursivelyERKNS_7IntRectE
-__ZN7WebCore17JSHTMLFormElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore15HTMLFormElement9setActionERKNS_6StringE
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLInputElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLInputElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore18JSHTMLInputElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore16HTMLInputElement8setValueERKNS_6StringE
-__ZNK7WebCore19SelectionController12isInsideNodeEv
-__ZNK7WebCore9FrameView13isTransparentEv
-__ZNK7WebCore9FrameView19baseBackgroundColorEv
-__ZN7WebCore15GraphicsContext17drawConvexPolygonEmPKNS_10FloatPointEb
-__ZN7WebCore12RenderWidget5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore6Widget4moveEii
-__ZN7WebCore6Widget5paintEPNS_15GraphicsContextERKNS_7IntRectE
-__ZNK7WebCore5Frame10paintCaretEPNS_15GraphicsContextERKNS_7IntRectE
-__ZN7WebCore19SelectionController10paintCaretEPNS_15GraphicsContextERKNS_7IntRectE
-__ZNK7WebCore12RenderButton15controlClipRectEii
-__ZN7WebCore14RenderListItem5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore13InlineFlowBox16paintBackgroundsEPNS_15GraphicsContextERKNS_5ColorEPKNS_15BackgroundLayerEiiiiii
-__ZN7WebCore13InlineFlowBox15paintBackgroundEPNS_15GraphicsContextERKNS_5ColorEPKNS_15BackgroundLayerEiiiiii
-__ZN7WebCore12RenderInline5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore10IconLoader18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
-__ZN7WebCore10IconLoader14didReceiveDataEPNS_17SubresourceLoaderEPKci
-__ZN7WebCore10IconLoader16didFinishLoadingEPNS_17SubresourceLoaderE
-__ZNK7WebCore14ResourceHandle7requestEv
-__ZN7WebCore10IconLoader13finishLoadingERKNS_4KURLEN3WTF10PassRefPtrINS_12SharedBufferEEE
-__ZN7WebCore12IconDatabase21setIconDataForIconURLEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_6StringE
-__ZNK7WebCore12SharedBuffer4copyEv
-__ZN7WebCore12SharedBufferC2EPKci
-__ZN3WTF6VectorIN7WebCore6StringELm0EE11appendRangeINS_29HashTableConstIteratorAdapterINS_9HashTableIPNS1_10StringImplES8_NS_17IdentityExtractorIS8_EENS1_10StringHashENS_10HashTraitsIS8_EESD_EES2_EEEEvT_SG_
-__ZNK7WebCore10IconRecord8snapshotEb
-__ZN3WTF7HashMapIN7WebCore6StringENS1_12IconSnapshotENS1_10StringHashENS_10HashTraitsIS2_EENS5_IS3_EEE3setERKS2_RKS3_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_12IconSnapshotEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IS5_EEEESC_E3addINS1_6StringES5_NS_17HashMapTranslatorILb0ES4_ISH_S5_ENS_18PairBaseHashTraitsINSB_ISH_EESD_EESE_S9_EEEES4_INS_17HashTableIteratorIS3_S6_S8_S9_SE_SC_EEbERKT_RKT0_
-__ZN7WebCore10IconLoader17clearLoadingStateEv
-__ZN7WebCore23DeprecatedValueListImpl9firstNodeEv
-__ZN7WebCore23DeprecatedValueListImpl14removeIteratorERNS_31DeprecatedValueListImplIteratorE
-__ZN7WebCore13olConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLOListElementC2EPNS_8DocumentE
-__ZNK7WebCore16HTMLOListElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore16HTMLOListElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore16HTMLOListElement17endTagRequirementEv
-__ZNK7WebCore16HTMLOListElement11tagPriorityEv
-__ZNK7WebCore16CSSStyleSelector15smallerFontSizeEfb
-__ZN7WebCore13hrConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore13HTMLHRElementC2EPNS_8DocumentE
-__ZNK7WebCore13HTMLHRElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore13HTMLHRElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore13HTMLHRElement17endTagRequirementEv
-__ZNK7WebCore13HTMLHRElement11tagPriorityEv
-__ZN7WebCore11RenderLayer27repaintIncludingDescendantsEv
-__ZN7WebCore11RenderBlock23removePositionedObjectsEPS0_
-__ZN7WebCore19ImageConstructorImpC2EPN3KJS9ExecStateEPNS_8DocumentE
-__ZNK7WebCore19ImageConstructorImp19implementsConstructEv
-__ZN7WebCore19ImageConstructorImp9constructEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore16RenderListMarkerC2EPNS_14RenderListItemE
-__ZN7WebCore16RenderListMarker8setStyleEPNS_11RenderStyleE
-__ZN7WebCore15RenderTableCell27absoluteClippedOverflowRectEv
-__ZN7WebCore9RenderBox30calcAbsoluteHorizontalReplacedEv
-__ZN7WebCore9RenderBox28calcAbsoluteVerticalReplacedEv
-__ZN7WebCore23getParentOfFirstLineBoxEPNS_11RenderBlockEPNS_12RenderObjectE
-__ZN7WebCore11RenderBlock32generatesLineBoxesForInlineChildEPNS_12RenderObjectE
-__ZN7WebCore16RenderListMarker14calcPrefWidthsEv
-__ZNK7WebCore16RenderListMarker7isImageEv
-__ZNK7WebCore14RenderListItem14updateValueNowEv
-__ZN7WebCore14listMarkerTextENS_14EListStyleTypeEi
-__ZN7WebCore16RenderListMarker13updateMarginsEv
-__ZNK7WebCore16RenderListMarker8isInsideEv
-__ZN7WebCore16RenderListMarker6layoutEv
-__ZNK7WebCore16RenderListMarker12isListMarkerEv
-__ZN7WebCore36shouldSkipWhitespaceAfterStartObjectEPNS_11RenderBlockEPNS_12RenderObjectERNS_12BidiResolverINS_12BidiIteratorENS_7BidiRunEEE
-__ZN7WebCore16RenderListMarker15createInlineBoxEbbb
-__ZN7WebCore13ListMarkerBoxC2EPNS_12RenderObjectE
-__ZNK7WebCore13ListMarkerBox6isTextEv
-__ZNK7WebCore16RenderListMarker14selectionStateEv
-__ZNK7WebCore9RenderBox13intrinsicSizeEv
-__ZNK7WebCore16RenderListMarker10lineHeightEbb
-__ZNK7WebCore16RenderListMarker16baselinePositionEbb
-__ZN7WebCore9InlineBox14adjustPositionEii
-__ZSt17__merge_sort_loopIPPN7WebCore11RenderLayerES3_iPFbS2_S2_EEvT_S6_T0_T1_T2_
-__ZNK7WebCore9RenderBox15borderFitAdjustERiS1_
-__ZN7WebCore16RenderListMarker5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore16RenderListMarker21getRelativeMarkerRectEv
-__ZN7WebCore26NetscapePlugInStreamLoader18didReceiveResponseERKNS_16ResourceResponseE
-__ZN7WebCore26NetscapePlugInStreamLoader14didReceiveDataEPKcixb
-__ZN7WebCore26NetscapePlugInStreamLoader16didFinishLoadingEv
-__ZN7WebCore14DocumentLoader24removePlugInStreamLoaderEPNS_14ResourceLoaderE
-__ZN7WebCore26NetscapePlugInStreamLoader16releaseResourcesEv
-__ZNK7WebCore5Image17usesContainerSizeEv
-__ZZN7WebCore5Image11drawPatternEPNS_15GraphicsContextERKNS_9FloatRectERKNS_15AffineTransformERKNS_10FloatPointENS_17CompositeOperatorES5_E16patternCallbacks
-__ZNK7WebCore15AffineTransform12isInvertibleEv
-__ZNK7WebCore15AffineTransform3detEv
-__ZNK7WebCore15AffineTransform1dEv
-__ZNK7WebCore15AffineTransform1aEv
-__ZN7WebCore17createHeadWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore26JSHTMLHeadElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLHeadElementC1EPN3KJS8JSObjectEPNS_15HTMLHeadElementE
-__ZNK7WebCore18JSHTMLUListElement9classInfoEv
-__ZN7WebCore28JSHTMLAnchorElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore11HTMLElement2idEv
-__ZN3KJS17staticValueGetterIN7WebCore17JSEventTargetNodeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSEventTargetNode16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore17JSEventTargetNode11getListenerERKNS_12AtomicStringE
-__ZN7WebCore15EventTargetNode20getHTMLEventListenerERKNS_12AtomicStringE
-__ZN7WebCore20createHeadingWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore29JSHTMLHeadingElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore20JSHTMLHeadingElementC1EPN3KJS8JSObjectEPNS_18HTMLHeadingElementE
-__ZN7WebCore20JSHTMLHeadingElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSHTMLAnchorElement9classInfoEv
-__ZNK7WebCore11HTMLElement8nodeNameEv
-__ZNK7WebCore15JSHTMLLIElement9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore19JSHTMLAnchorElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSHTMLAnchorElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore17HTMLAnchorElement4hrefEv
-__ZNK7WebCore13JSHTMLElement9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore17JSHTMLFormElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSHTMLFormElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore18createOListWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore27JSHTMLOListElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLOListElementC1EPN3KJS8JSObjectEPNS_16HTMLOListElementE
-__ZN7WebCore18JSHTMLOListElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSHTMLOListElement9classInfoEv
-__ZN7WebCore18createDListWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore27JSHTMLDListElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLDListElementC1EPN3KJS8JSObjectEPNS_16HTMLDListElementE
-__ZN7WebCore15highestAncestorEPNS_4NodeE
-__ZN7WebCore4Node15removedFromTreeEb
-__ZN7WebCore11RenderLayer20setHasVisibleContentEb
-__ZN7WebCore7Element12offsetHeightEv
-__ZN7WebCore13InlineTextBox10deleteLineEPNS_11RenderArenaE
-__ZN7WebCore10RenderText13removeTextBoxEPNS_13InlineTextBoxE
-__ZNK7WebCore13RootInlineBox19lineBreakBidiStatusEv
-__ZNK7WebCore12RenderObject12offsetHeightEv
-__ZN3KJS6Window14installTimeoutERKNS_7UStringEib
-__ZN7WebCore17createLinkWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore26JSHTMLLinkElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLLinkElementC1EPN3KJS8JSObjectEPNS_15HTMLLinkElementE
-__ZN7WebCore17JSHTMLLinkElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore17JSHTMLLinkElement9classInfoEv
-__ZN7WebCore17JSHTMLHeadElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore17JSHTMLHeadElement9classInfoEv
-__ZN7WebCore19createScriptWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore28JSHTMLScriptElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSHTMLScriptElementC1EPN3KJS8JSObjectEPNS_17HTMLScriptElementE
-__ZN7WebCore19JSHTMLScriptElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSHTMLScriptElement9classInfoEv
-__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
-__ZN7WebCore8Document5linksEv
-__ZN3KJS17staticValueGetterIN7WebCore16JSHTMLCollectionEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSHTMLCollection16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore16JSHTMLCollection11indexGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore17createAreaWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore26JSHTMLAreaElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLAreaElementC1EPN3KJS8JSObjectEPNS_15HTMLAreaElementE
-__ZN7WebCore17JSHTMLAreaElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSLazyEventListener11listenerObjEv
-__ZNK7WebCore19JSLazyEventListener9parseCodeEv
-__ZNK7WebCore19JSLazyEventListener18eventParameterNameEv
-__ZNK7WebCore6StringcvN3KJS10IdentifierEEv
-__ZNK7WebCore13JSHTMLElement21pushEventHandlerScopeEPN3KJS9ExecStateERNS1_10ScopeChainE
-__ZNK7WebCore11HTMLElement11virtualFormEv
-__ZNK7WebCore11HTMLElement16findFormAncestorEv
-__ZN7WebCore17JSHTMLAreaElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore19JSLazyEventListenerD1Ev
-__ZN3KJS12ProtectedPtrINS_6WindowEED2Ev
-__ZN3KJS12ProtectedPtrINS_8JSObjectEED2Ev
-__ZNK7WebCore17JSHTMLAreaElement9classInfoEv
-__ZN7WebCore11FrameLoader13executeScriptERKNS_6StringEb
-__ZN7WebCore16HTMLEmbedElement6detachEv
-__ZN7WebCore12RenderWidget7destroyEv
-__ZN7WebCore10RenderView12removeWidgetEPNS_12RenderObjectE
-__ZNK7WebCore8Document13axObjectCacheEv
-__ZNK7WebCore8Document11topDocumentEv
-__ZN7WebCore13AXObjectCache6removeEPNS_12RenderObjectE
-__ZN7WebCore9FrameView20removeWidgetToUpdateEPNS_16RenderPartObjectE
-__ZN7WebCore12RenderWidget12deleteWidgetEv
-__ZNK7WebCore12RenderObject12overflowRectEb
-__ZN7WebCore13ListMarkerBoxD1Ev
-__ZThn68_N7WebCore17HTMLScriptElement14notifyFinishedEPNS_14CachedResourceE
-__ZN7WebCore17HTMLScriptElement14notifyFinishedEPNS_14CachedResourceE
-__ZN7WebCore17HTMLScriptElement14evaluateScriptERKNS_6StringES3_
-__ZNK7WebCore11HTMLElement9innerHTMLEv
-__ZN7WebCore12createMarkupEPKNS_4NodeENS_13EChildrenOnlyEPN3WTF6VectorIPS0_Lm0EEE
-__ZN7WebCore22DeleteButtonController7disableEv
-__ZN7WebCore22DeleteButtonController4hideEv
-__ZN7WebCore12appendMarkupERN3WTF6VectorItLm0EEEPNS_4NodeEbPNS1_IS5_Lm0EEEPKNS0_7HashMapIPNS_16AtomicStringImplESA_NS0_7PtrHashISA_EENS0_10HashTraitsISA_EESE_EE
-__ZZN7WebCore17appendStartMarkupERN3WTF6VectorItLm0EEEPKNS_4NodeEPKNS_5RangeENS_23EAnnotateForInterchangeEbPNS0_7HashMapIPNS_16AtomicStringImplESD_NS0_7PtrHashISD_EENS0_10HashTraitsISD_EESH_EEE11stylePrefix
-__ZNK7WebCore7Element22nodeNamePreservingCaseEv
-__ZNK7WebCore7Element14isURLAttributeEPNS_9AttributeE
-__ZN7WebCore20appendAttributeValueERN3WTF6VectorItLm0EEERKNS_6StringE
-__ZNK7WebCore17HTMLAnchorElement14isURLAttributeEPNS_9AttributeE
-__ZN7WebCore29appendQuotedURLAttributeValueERN3WTF6VectorItLm0EEENS_6StringE
-__ZN7WebCore20appendEscapedContentERN3WTF6VectorItLm0EEESt4pairIPKtmE
-__ZN7WebCore15appendEndMarkupERN3WTF6VectorItLm0EEEPKNS_4NodeE
-__ZN7WebCore22DeleteButtonController6enableEv
-__ZN7WebCore22DeleteButtonController4showEPNS_11HTMLElementE
-__ZN7WebCore27removingNodeRemovesPositionEPNS_4NodeERKNS_8PositionE
-__ZNK7WebCore7Element8containsEPKNS_4NodeE
-__ZN7WebCore5Range21compareBoundaryPointsERKNS_8PositionES3_
-__ZN7WebCore11HTMLElementD1Ev
-__ZN7WebCore21createFieldSetWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore30JSHTMLFieldSetElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore21JSHTMLFieldSetElementC1EPN3KJS8JSObjectEPNS_19HTMLFieldSetElementE
-__ZN7WebCore21JSHTMLFieldSetElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore21JSHTMLFieldSetElement9classInfoEv
-__ZN7WebCore32jsEventTargetRemoveEventListenerEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZThn36_N7WebCore15EventTargetNode19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
-__ZN7WebCore15EventTargetNode19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
-__ZN7WebCore16HTMLImageElementD1Ev
-__ZN7WebCore11CachedImage20allReferencesRemovedEv
-__ZN7WebCore11BitmapImage14resetAnimationEv
-__ZN7WebCore11BitmapImage13stopAnimationEv
-__ZN7WebCore8Document11removeImageEPNS_15HTMLImageLoaderE
-__ZN7WebCore17HTMLAnchorElementD1Ev
-__ZNK7WebCore9DOMWindow6lengthEv
-__ZN7WebCore5Frame20caretBlinkTimerFiredEPNS_5TimerIS0_EE
-__ZNK7WebCore12RenderWidget8isWidgetEv
-__ZN3WTF6VectorIPN7WebCore17SubresourceLoaderELm256EE6shrinkEm
-__ZNK7WebCore11FrameLoader14cancelledErrorERKNS_15ResourceRequestE
-__ZN7WebCore14DocumentLoader20setMainDocumentErrorERKNS_13ResourceErrorE
-__ZN7WebCore11FrameLoader20setMainDocumentErrorEPNS_14DocumentLoaderERKNS_13ResourceErrorE
-__ZN7WebCore14ResourceLoader6cancelEv
-__ZN7WebCore14ResourceLoader6cancelERKNS_13ResourceErrorE
-__ZN7WebCore14ResourceLoader14cancelledErrorEv
-__ZN7WebCore17SubresourceLoader9didCancelERKNS_13ResourceErrorE
-__ZN7WebCore14ResourceLoader9didCancelERKNS_13ResourceErrorE
-__ZN7WebCore14ResourceHandle19clearAuthenticationEv
-__ZN7WebCore23AuthenticationChallenge7nullifyEv
-__ZN7WebCore11FrameLoader24cancelPendingArchiveLoadEPNS_14ResourceLoaderE
-__ZN7WebCore14ResourceHandle6cancelEv
-__ZN7WebCore18MainResourceLoader16setDefersLoadingEb
-__ZN7WebCore16HTMLInputElement13aboutToUnloadEv
-__ZN7WebCore5Frame22textFieldDidEndEditingEPNS_7ElementE
-+[DOMHTMLInputElement(WebCoreInternal) _wrapHTMLInputElement:]
-__ZN3KJS34windowProtoFuncRemoveEventListenerEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore18RenderTextFragment7destroyEv
-__ZN7WebCore18RenderTextFragmentD1Ev
-__ZN3WTF11ListHashSetIPN7WebCore12RenderObjectENS_7PtrHashIS3_EEE14deleteAllNodesEv
-__ZN7WebCore10ScrollView11removeChildEPNS_6WidgetE
-__ZN7WebCore6Widget19removeFromSuperviewEv
-__ZN7WebCore23safeRemoveFromSuperviewEP6NSView
-__ZN7WebCore5Frame29cleanupScriptObjectsForPluginEPv
-__ZN7WebCore6WidgetD1Ev
-__ZN7WebCore12RenderButton11removeChildEPNS_12RenderObjectE
-__ZN7WebCore15RenderTableCell7destroyEv
-__ZN7WebCore14RenderTableRow7destroyEv
-__ZN7WebCore18RenderTableSection15removeChildNodeEPNS_12RenderObjectEb
-__ZN7WebCore18RenderTableSection7destroyEv
-__ZN7WebCore11RenderTable15removeChildNodeEPNS_12RenderObjectEb
-__ZN7WebCore18RenderTableSection9clearGridEv
-__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE6shrinkEm
-__ZN3WTF6VectorIiLm0EE6shrinkEm
-__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE6shrinkEm
-__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE6shrinkEm
-__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE6shrinkEm
-__ZN7WebCore7History15disconnectFrameEv
-__ZN3WTF6VectorIN7WebCore16ResourceResponseELm0EE6shrinkEm
-__ZN7WebCore27JSHTMLImageElementPrototypeD0Ev
-__ZN7WebCore25JSHTMLDivElementPrototypeD0Ev
-__ZN7WebCore24JSHTMLLIElementPrototypeD0Ev
-__ZN7WebCore27JSHTMLUListElementPrototypeD0Ev
-__ZN7WebCore22JSHTMLElementPrototypeD0Ev
-__ZN7WebCore26JSHTMLHeadElementPrototypeD0Ev
-__ZN7WebCore26JSHTMLBodyElementPrototypeD0Ev
-__ZN7WebCore27JSHTMLOListElementPrototypeD0Ev
-__ZN7WebCore13JSHTMLElementD0Ev
-__ZN7WebCore11CachedImageD1Ev
-__ZN7WebCore29JSHTMLHeadingElementPrototypeD0Ev
-__ZN7WebCore30JSHTMLFieldSetElementPrototypeD0Ev
-__ZN7WebCore15HTMLLinkElement19removedFromDocumentEv
-__ZN7WebCore17HTMLScriptElement19removedFromDocumentEv
-__ZN7WebCore17HTMLScriptElementD1Ev
-__ZN7WebCore16HTMLTitleElementD1Ev
-__ZN7WebCore16HTMLStyleElementD1Ev
-__ZN7WebCore14HTMLMapElementD1Ev
-__ZN7WebCore16HTMLImageElement19removedFromDocumentEv
-__ZN7WebCore12HTMLDocument15removeNamedItemERKNS_6StringE
-__ZN7WebCore17removeItemFromMapERN3WTF7HashMapIPNS_10StringImplEiNS_10StringHashENS0_10HashTraitsIS3_EENS5_IiEEEERKNS_6StringE
-__ZN7WebCore12HTMLDocument23removeDocExtraNamedItemERKNS_6StringE
-__ZN3WTF6VectorIPN7WebCore22HTMLGenericFormElementELm0EE6shrinkEm
-__ZN7WebCore16HTMLEmbedElementD1Ev
-__ZN7WebCore16HTMLTableElementD1Ev
-__ZN7WebCore16HTMLLabelElementD1Ev
-__ZN7WebCore23HTMLTableSectionElementD1Ev
-__ZN7WebCore19HTMLTableRowElementD1Ev
-__ZN7WebCore20HTMLTableCellElementD1Ev
-__ZN7WebCore12CSSValueListD1Ev
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore8CSSValueEEELm0EE6shrinkEm
-__ZN7WebCore22JSEventTargetPrototypeINS_15JSNodePrototypeENS_33JSEventTargetPrototypeInformationEED0Ev
-__ZN7WebCore17JSScreenPrototypeD0Ev
-__ZN7WebCore4PathD2Ev
-__ZN7WebCore26JSHTMLAreaElementPrototypeD0Ev
-__ZN7WebCore28JSHTMLScriptElementPrototypeD0Ev
-__ZN7WebCore15HTMLLinkElementD1Ev
-__ZN7WebCore26JSHTMLLinkElementPrototypeD0Ev
-__ZN7WebCore27JSHTMLDListElementPrototypeD0Ev
-__ZN7WebCore13AXObjectCacheD2Ev
-__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEEN7WebCore14AXIDHashTraitsES6_E6expandEv
-__ZN7WebCore12CSSStyleRuleD1Ev
-__ZN7WebCore11CSSSelectorD2Ev
-__ZN7WebCore13CSSImageValueD1Ev
-__ZN7WebCore8Document26setHTMLWindowEventListenerERKNS_12AtomicStringEPNS_9AttributeE
-__ZN7WebCore17iframeConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLIFrameElementC2EPNS_8DocumentE
-__ZN7WebCore20HTMLFrameElementBaseC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore17HTMLIFrameElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore17HTMLIFrameElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore20HTMLFrameElementBase20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore20HTMLFrameElementBase11setLocationERKNS_6StringE
-__ZNK7WebCore17HTMLIFrameElement17endTagRequirementEv
-__ZNK7WebCore17HTMLIFrameElement11tagPriorityEv
-__ZN7WebCore17HTMLIFrameElement20insertedIntoDocumentEv
-__ZN7WebCore20HTMLFrameElementBase20insertedIntoDocumentEv
-__ZN7WebCore17HTMLIFrameElement6attachEv
-__ZN7WebCore20HTMLFrameElementBase6attachEv
-__ZN7WebCore20HTMLFrameElementBase25setNameAndOpenURLCallbackEPNS_4NodeE
-__ZN7WebCore20HTMLFrameElementBase17setNameAndOpenURLEv
-__ZNK7WebCore9FrameTree15uniqueChildNameERKNS_12AtomicStringE
-__ZN7WebCoreeqERKNS_12AtomicStringEPKc
-__ZN7WebCore20HTMLFrameElementBase7openURLEv
-__ZNK7WebCore20HTMLFrameElementBase12isURLAllowedERKNS_12AtomicStringE
-__ZN7WebCore11FrameLoader12requestFrameEPNS_21HTMLFrameOwnerElementERKNS_6StringERKNS_12AtomicStringE
-__ZN7WebCore11FrameLoader12loadSubframeEPNS_21HTMLFrameOwnerElementERKNS_4KURLERKNS_6StringES8_
-__ZNK7WebCore20HTMLFrameElementBase13scrollingModeEv
-__ZN7WebCore11FrameLoader7canLoadERKNS_4KURLERKNS_6StringE
-__ZN7WebCore9FrameTree11appendChildEN3WTF10PassRefPtrINS_5FrameEEE
--[WebCoreFrameBridge _frame]
-__ZN7WebCore11FrameLoader18currentHistoryItemEv
-__ZNK7WebCore11HistoryItem8childrenEv
-__ZN7WebCore11FrameLoader4loadERKNS_4KURLERKNS_6StringENS_13FrameLoadTypeES6_PNS_5EventEN3WTF10PassRefPtrINS_9FormStateEEE
-__ZN7WebCore16NavigationActionC2ERKNS_4KURLENS_13FrameLoadTypeEbN3WTF10PassRefPtrINS_5EventEEE
-__ZN7WebCore14navigationTypeENS_13FrameLoadTypeEbb
-__ZN7WebCore11FrameLoader12shouldReloadERKNS_4KURLES3_
-__ZN7WebCore11FrameLoader4loadERKNS_15ResourceRequestERKNS_16NavigationActionENS_13FrameLoadTypeEN3WTF10PassRefPtrINS_9FormStateEEE
-__ZNK7WebCore5Frame19setInViewSourceModeEb
-__ZN7WebCore13ContainerNode12insertBeforeEN3WTF10PassRefPtrINS_4NodeEEEPS3_Ri
-__ZN7WebCore15HTMLFormElement18registerImgElementEPNS_16HTMLImageElementE
-__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE15reserveCapacityEm
-__ZN3KJS6Window16childFrameGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore14SecurityOrigin9canAccessEPKS0_RNS0_6ReasonE
-__ZN7WebCore11FrameLoader24shouldTreatSchemeAsLocalERKNS_6StringE
-__ZN7WebCore7Element9offsetTopEv
-__ZNK7WebCore11CSSRuleList6lengthEv
-__ZN7WebCore11CSSRuleList4itemEj
-__ZN7WebCore17HTMLOptionElement6detachEv
-__ZN7WebCore17HTMLIFrameElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore17HTMLIFrameElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZNK7WebCore9FrameView11isFrameViewEv
-__ZN7WebCore6Widget4hideEv
-__ZNK7WebCore14RenderThemeMac17adjustButtonStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZNK7WebCore14RenderThemeMac31setButtonPaddingFromControlSizeEPNS_11RenderStyleEj
-__ZN3WTF9HashTableIN7WebCore16FontPlatformDataESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_20FontDataCacheKeyHashENS_14PairHashTraitsINS1_22FontDataCacheKeyTraitsENS_10HashTraitsIiEEEES9_E4findIS2_NS_22IdentityHashTranslatorIS2_S4_S7_EEEENS_17HashTableIteratorIS2_S4_S6_S7_SC_S9_EERKT_
-__ZN7WebCore9FontCache24getFontDataForCharactersERKNS_4FontEPKti
-__ZN7WebCore17RenderFlexibleBox24calcHorizontalPrefWidthsEv
-__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE15reserveCapacityEm
-__ZNK7WebCore10RenderView8viewRectEv
-__ZNK7WebCore12RenderObject9offsetTopEv
-__ZNK7WebCore12RenderObject12offsetParentEv
-__ZN7WebCore7Element12offsetParentEv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE6shrinkEm
-__ZN7WebCore12RenderObject10moveLayersEPNS_11RenderLayerES2_
-__ZNK7WebCore15RenderTableCell14borderHalfLeftEb
-__ZNK7WebCore15RenderTableCell19collapsedLeftBorderEb
-__ZN7WebCore14compareBordersERKNS_20CollapsedBorderValueES2_
-__ZNK7WebCore15RenderTableCell15borderHalfRightEb
-__ZNK7WebCore15RenderTableCell20collapsedRightBorderEb
-__ZNK7WebCore11RenderTable9cellAfterEPKNS_15RenderTableCellE
-__ZNK7WebCore15RenderTableCell13borderHalfTopEb
-__ZNK7WebCore15RenderTableCell18collapsedTopBorderEv
-__ZNK7WebCore15RenderTableCell16borderHalfBottomEb
-__ZNK7WebCore15RenderTableCell21collapsedBottomBorderEv
-__ZNK7WebCore11RenderTable9cellBelowEPKNS_15RenderTableCellE
-__ZN7WebCore18RenderTableSection17recalcOuterBorderEv
-__ZNK7WebCore18RenderTableSection18calcOuterBorderTopEv
-__ZNK7WebCore18RenderTableSection21calcOuterBorderBottomEv
-__ZNK7WebCore18RenderTableSection19calcOuterBorderLeftEb
-__ZNK7WebCore18RenderTableSection20calcOuterBorderRightEb
-__ZNK7WebCore11RenderTable16outerBorderRightEv
-__ZNK7WebCore11RenderTable15outerBorderLeftEv
-__ZNK7WebCore11RenderTable14outerBorderTopEv
-__ZNK7WebCore11RenderTable17outerBorderBottomEv
-__ZN7WebCore14RenderThemeMac18setButtonCellStateEPKNS_12RenderObjectERKNS_7IntRectE
-__ZNK7WebCore14RenderThemeMac6buttonEv
-__ZNK7WebCore16HTMLInputElement15isIndeterminateEv
-__ZNK7WebCore16HTMLInputElement9isCheckedEv
-__ZNK7WebCore14RenderThemeMac13buttonMarginsEv
-__ZN7WebCore13InlineFlowBox25adjustMaxAscentAndDescentERiS1_ii
-__ZN7WebCore11RenderLayer25setHasHorizontalScrollbarEb
-__ZN7WebCore11RenderLayer23setHasVerticalScrollbarEb
-__ZN7WebCore11RenderLayer15createScrollbarENS_20ScrollbarOrientationE
-__ZN7WebCore17PlatformScrollbarC2EPNS_15ScrollbarClientENS_20ScrollbarOrientationENS_20ScrollbarControlSizeE
-__ZN7WebCore9ScrollbarC2EPNS_15ScrollbarClientENS_20ScrollbarOrientationENS_20ScrollbarControlSizeE
--[WebCoreScrollBar initWithPlatformScrollbar:]
-__ZThn8_NK7WebCore17PlatformScrollbar5widthEv
-__ZNK7WebCore17PlatformScrollbar5widthEv
-__ZThn8_N7WebCore17PlatformScrollbar10setEnabledEb
-__ZN7WebCore17PlatformScrollbar10setEnabledEb
-__ZN7WebCore6Widget10setEnabledEb
-__ZN7WebCore9Scrollbar8setStepsEiii
-__ZN7WebCore9Scrollbar13setProportionEii
-__ZThn8_N7WebCore17PlatformScrollbar21updateThumbProportionEv
-__ZN7WebCore17PlatformScrollbar21updateThumbProportionEv
-__ZThn8_N7WebCore17PlatformScrollbar7setRectERKNS_7IntRectE
-__ZN7WebCore17PlatformScrollbar7setRectERKNS_7IntRectE
-__ZNK7WebCore12RenderObject14nextInPreOrderEv
-__ZNK7WebCore15RenderTableCell19collectBorderStylesERN3WTF6VectorINS_20CollapsedBorderValueELm100EEE
-__ZN7WebCore14addBorderStyleERN3WTF6VectorINS_20CollapsedBorderValueELm100EEES2_
-__ZN7WebCore15RenderTableCell16sortBorderStylesERN3WTF6VectorINS_20CollapsedBorderValueELm100EEE
-__ZN7WebCore15RenderTableCell20paintCollapsedBorderEPNS_15GraphicsContextEiiii
-__ZN7WebCore20collapsedBorderStyleENS_12EBorderStyleE
-__ZN3WTF6VectorIN7WebCore20CollapsedBorderValueELm100EE6shrinkEm
-__ZNK7WebCore13RootInlineBox11ellipsisBoxEv
-__ZN7WebCore14RenderThemeMac11paintButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore11FrameLoader41updateHistoryForRedirectWithLockedHistoryEv
-__ZN7WebCore11HistoryItem12addChildItemEN3WTF10PassRefPtrIS0_EE
-__ZNK7WebCore17DeprecatedCString5lowerEv
-__ZN7WebCore9ArrayImplC2ERKS0_
-__ZN7WebCore9ArrayImplaSERKS0_
-__ZN7WebCore22characterBreakIteratorEPKti
-__ZNK7WebCore22HTMLGenericFormElement11virtualFormEv
-__ZNK7WebCore17HTMLSelectElement14isEnumeratableEv
-__ZN7WebCore16HTMLInputElement17setSelectionRangeEii
-__ZN7WebCore18createTableWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore27JSHTMLTableElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLTableElementC1EPN3KJS8JSObjectEPNS_16HTMLTableElementE
-__ZN7WebCore18JSHTMLTableElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22createTableCellWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore31JSHTMLTableCellElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore22JSHTMLTableCellElementC1EPN3KJS8JSObjectEPNS_20HTMLTableCellElementE
-__ZN7WebCore22JSHTMLTableCellElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19createSelectWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore19JSHTMLSelectElementC1EPN3KJS8JSObjectEPNS_17HTMLSelectElementE
-__ZN7WebCore19JSHTMLSelectElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore19JSHTMLSelectElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore22HTMLGenericFormElement11setDisabledEb
-__ZN7WebCore9JSElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore7Element12setScrollTopEi
-__ZN7WebCore12RenderObject12setScrollTopEi
-__ZN7WebCore11RenderLayer14scrollToOffsetEiibb
-__ZN7WebCore9Scrollbar8setValueEi
-__ZN7WebCore9FrameView13scheduleEventEN3WTF10PassRefPtrINS_5EventEEENS2_INS_15EventTargetNodeEEEb
-__ZNK7WebCore13HTMLTokenizer15isHTMLTokenizerEv
-__ZN7WebCore11RenderBlock22removePositionedObjectEPNS_12RenderObjectE
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore12RenderObjectEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_NS_7PtrHashIS4_EEEENS_10HashTraitsIS6_EESE_E4findIS4_NS_21ListHashSetTranslatorIS4_SB_EEEENS_17HashTableIteratorIS6_S6_S8_SC_SE_SE_EERKT_
-__ZN3WTF11ListHashSetIPN7WebCore12RenderObjectENS_7PtrHashIS3_EEE15unlinkAndDeleteEPNS_15ListHashSetNodeIS3_EE
+__ZN7WebCore10ScrollView17setScrollPositionERKNS_8IntPointE
+__ZN7WebCore10ScrollView25platformSetScrollPositionERKNS_8IntPointE
+__ZN7WebCore12EventHandler15sendScrollEventEv
+__ZN7WebCore9FrameView20setWasScrolledByUserEb
+__ZNK7WebCore11RenderBlock17offsetForContentsERiS1_
+__ZNK7WebCore11RenderLayer24addScrolledContentOffsetERiS1_
+__ZNK7WebCore5Frame10paintCaretEPNS_15GraphicsContextEiiRKNS_7IntRectE
+__ZN7WebCore19SelectionController10paintCaretEPNS_15GraphicsContextEiiRKNS_7IntRectE
 __ZN7WebCore12RenderObject12paintOutlineEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleE
 __ZNK7WebCore11RenderTheme17supportsFocusRingEPKNS_11RenderStyleE
 __ZN7WebCore15GraphicsContext13initFocusRingEii
 __ZN7WebCore15GraphicsContext14clearFocusRingEv
-__ZN7WebCore10RenderFlow17addFocusRingRectsEPNS_15GraphicsContextEii
+__ZN7WebCore17RenderTextControl17addFocusRingRectsEPNS_15GraphicsContextEii
 __ZN7WebCore15GraphicsContext16addFocusRingRectERKNS_7IntRectE
 __ZN7WebCore15GraphicsContext13drawFocusRingERKNS_5ColorE
 __ZNK7WebCore15GraphicsContext14focusRingWidthEv
 __ZNK7WebCore15GraphicsContext15focusRingOffsetEv
-__ZN7WebCore7cgColorERKNS_5ColorE
+__ZN7WebCore13createCGColorERKNS_5ColorE
 __ZN7WebCore7nsColorERKNS_5ColorE
-__ZN7WebCore18CGColorFromNSColorEP7NSColor
+__ZN7WebCoreL18CGColorFromNSColorEP7NSColor
 __ZNK7WebCore15GraphicsContext14focusRingRectsEv
-__ZNK7WebCore11BitmapImage10solidColorEv
-__ZN7WebCore9FloatRectC2ERK6CGRect
-__ZN7WebCore10FloatPointC2ERK7CGPoint
-__ZN7WebCore9FloatSizeC2ERK6CGSize
-__ZN7WebCore5Image18fillWithSolidColorEPNS_15GraphicsContextERKNS_9FloatRectERKNS_5ColorENS_17CompositeOperatorE
-__ZN7WebCore26CSSMutableStyleDeclaration21removePropertiesInSetEPKijb
-__ZNK7WebCore15CSSInitialValue7cssTextEv
-__ZN7WebCore11FrameLoader29loadedResourceFromMemoryCacheEPKNS_14CachedResourceE
-__ZN7WebCore19InspectorController30didLoadResourceFromMemoryCacheEPNS_14DocumentLoaderERKNS_15ResourceRequestERKNS_16ResourceResponseEi
+__ZNK7WebCore9FrameView10hostWindowEv
+__ZNK7WebCore6Chrome18scrollRectIntoViewERKNS_7IntRectEPKNS_10ScrollViewE
+__ZN3WTF6VectorIN3JSC8RegisterELm8EE6shrinkEm
+__ZN7WebCore20jsDOMWindowNavigatorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow9navigatorEv
+__ZN7WebCore9NavigatorC1EPNS_5FrameE
+__ZN7WebCore9NavigatorC2EPNS_5FrameE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9NavigatorE
+__ZN7WebCore11JSNavigator15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSNavigatorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9NavigatorEEE
+__ZN7WebCore11JSNavigatorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9NavigatorEEE
+__ZN7WebCore11JSNavigator18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19jsNavigatorLanguageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9Navigator8languageEv
+__ZN7WebCore15defaultLanguageEv
+__ZN7WebCore16jsDocumentCookieEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Document6cookieEv
+__ZN7WebCore7cookiesEPKNS_8DocumentERKNS_4KURLE
+__ZN7WebCoreL13filterCookiesEP7NSArray
+__ZN7WebCore19JSHTMLSelectElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore27setJSHTMLSelectElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26valueToStringWithNullCheckEPN3JSC9ExecStateENS0_7JSValueE
+__ZN7WebCore17HTMLSelectElement8setValueERKNS_6StringE
+__ZNK7WebCore17HTMLOptionElement5valueEv
+__ZN7WebCore13OptionElement18collectOptionValueERKNS_17OptionElementDataEPNS_8DocumentE
+__ZN3WTF6VectorIbLm0EE6shrinkEm
+__ZN7WebCore11FrameLoader19handledOnloadEventsEv
+__ZN7WebCore8Document13svgExtensionsEv
+__ZNK7WebCore14DocumentLoader16isLoadingPlugInsEv
+__ZNK7WebCore8Document16isPluginDocumentEv
+__ZNK7WebCore8Document15isImageDocumentEv
+__Z3kitPN7WebCore8DocumentE
+__Z3kitPN7WebCore4NodeE
+__Z8kitClassPN7WebCore4NodeE
+-[DOMDocument getElementsByTagName:]
+__ZN7WebCore4Node20getElementsByTagNameERKNS_6StringE
+__ZN7WebCore4Node22getElementsByTagNameNSERKNS_12AtomicStringERKNS_6StringE
+__ZN7WebCore4Node14createRareDataEv
+__ZN7WebCore15DynamicNodeList6CachesC1Ev
+__ZN7WebCore15DynamicNodeList6CachesC2Ev
+__ZN3WTF7HashMapIN7WebCore13QualifiedNameEPNS1_15DynamicNodeList6CachesENS1_17QualifiedNameHashENS_10HashTraitsIS2_EENS7_IS5_EE
+__ZN3WTF9HashTableIN7WebCore13QualifiedNameESt4pairIS2_PNS1_15DynamicNodeList6CachesEENS_18PairFirstExtractorIS7_EENS1_17Qualif
+__ZN7WebCore11TagNodeListC1EN3WTF10PassRefPtrINS_4NodeEEERKNS_12AtomicStringES7_PNS_15DynamicNodeList6CachesE
+__ZN7WebCore11TagNodeListC2EN3WTF10PassRefPtrINS_4NodeEEERKNS_12AtomicStringES7_PNS_15DynamicNodeList6CachesE
+__ZN7WebCore15DynamicNodeListC2EN3WTF10PassRefPtrINS_4NodeEEEPNS0_6CachesE
+__ZN7WebCore4Node23registerDynamicNodeListEPNS_15DynamicNodeListE
+__Z3kitPN7WebCore8NodeListE
+-[DOMNodeList length]
+__ZNK7WebCore15DynamicNodeList6lengthEv
+__ZNK7WebCore11TagNodeList11nodeMatchesEPNS_7ElementE
+-[DOMNodeList item:]
+__ZNK7WebCore15DynamicNodeList4itemEj
+__ZNK7WebCore15DynamicNodeList23itemForwardsFromCurrentEPNS_4NodeEji
+__ZN7WebCoreL12elementClassERKNS_13QualifiedNameEP10objc_class
+__ZN7WebCoreL15addElementClassERKNS_13QualifiedNameEP10objc_class
+__ZN3WTF7HashMapIPKN7WebCore13QualifiedName17QualifiedNameImplEP10objc_classNS_7PtrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEE3s
+__ZN3WTF9HashTableIPKN7WebCore13QualifiedName17QualifiedNameImplESt4pairIS5_P10objc_classENS_18PairFirstExtractorIS9_EENS_7PtrH
+__ZN7WebCoreL18lookupElementClassERKNS_13QualifiedNameE
+__ZNK3WTF7HashMapIPKN7WebCore13QualifiedName17QualifiedNameImplEP10objc_classNS_7PtrHashIS5_EENS_10HashTraitsIS5_EENSA_IS7_EEE3
+-[DOMNode attributes]
+__ZNK7WebCore7Element10attributesEv
+__Z3kitPN7WebCore12NamedNodeMapE
+-[DOMNamedNodeMap getNamedItem:]
+__ZNK7WebCore12NamedNodeMap12getNamedItemERKNS_6StringE
+__ZNK7WebCore12NamedNodeMap16getAttributeItemERKNS_6StringEb
+__ZNK7WebCore13QualifiedName8toStringEv
+__ZN7WebCore9Attribute18createAttrIfNeededEPNS_7ElementE
+__ZN7WebCore4AttrC1EPNS_7ElementEPNS_8DocumentEN3WTF10PassRefPtrINS_9AttributeEEE
+__ZN7WebCore4AttrC2EPNS_7ElementEPNS_8DocumentEN3WTF10PassRefPtrINS_9AttributeEEE
+__ZN7WebCore4Attr15createTextChildEv
+__ZN7WebCore8Document14createTextNodeERKNS_6StringE
+__ZNK7WebCore4Attr8nodeTypeEv
+-[DOMNode nodeValue]
+__ZNK7WebCore4Attr9nodeValueEv
+__ZNK7WebCore11HistoryItem20getTransientPropertyERKNS_6StringE
+__ZN7WebCore15ProgressTracker17progressCompletedEPNS_5FrameE
+__ZN7WebCore15ProgressTracker21finalProgressCompleteEv
+-[DOMNode dealloc]
+__ZThn8_N7WebCore4AttrD0Ev
+__ZN7WebCore4AttrD0Ev
+-[DOMObject dealloc]
+__Z16removeDOMWrapperP17DOMObjectInternal
+-[WebScriptObject dealloc]
+-[DOMNamedNodeMap dealloc]
+-[DOMNodeList dealloc]
+__ZN7WebCore11TagNodeListD0Ev
+__ZN7WebCore15DynamicNodeListD2Ev
+__ZN7WebCore4Node25unregisterDynamicNodeListEPNS_15DynamicNodeListE
+__ZNK7WebCore19SelectionController17isInPasswordFieldEv
+__ZN7WebCore6Loader4HostD0Ev
+-[DOMDocument forms]
+__ZN7WebCore8Document5formsEv
+__ZN7WebCore14HTMLCollection6createEN3WTF10PassRefPtrINS_4NodeEEENS_14CollectionTypeE
+__ZN7WebCore14HTMLCollectionC1EN3WTF10PassRefPtrINS_4NodeEEENS_14CollectionTypeE
+__ZN7WebCore14HTMLCollectionC2EN3WTF10PassRefPtrINS_4NodeEEENS_14CollectionTypeE
+__Z3kitPN7WebCore14HTMLCollectionE
+__Z8kitClassPN7WebCore14HTMLCollectionE
+-[DOMHTMLCollection length]
+__ZNK7WebCore14HTMLCollection6lengthEv
+__ZNK7WebCore14HTMLCollection19resetCollectionInfoEv
+__ZNK7WebCore14HTMLCollection10calcLengthEv
+__ZNK7WebCore14HTMLCollection9itemAfterEPNS_7ElementE
+__ZN7WebCoreL17nextNodeOrSiblingEPNS_4NodeES1_b
+-[DOMHTMLCollection item:]
+__ZNK7WebCore14HTMLCollection4itemEj
+-[DOMHTMLFormElement elements]
+__ZN7WebCore15HTMLFormElement8elementsEv
+__ZN7WebCore18HTMLFormCollection6createEN3WTF10PassRefPtrINS_15HTMLFormElementEEE
+__ZN7WebCore18HTMLFormCollectionC1EN3WTF10PassRefPtrINS_15HTMLFormElementEEE
+__ZN7WebCore18HTMLFormCollectionC2EN3WTF10PassRefPtrINS_15HTMLFormElementEEE
+__ZN7WebCore14HTMLCollectionC2EN3WTF10PassRefPtrINS_4NodeEEENS_14CollectionTypeEPNS_15CollectionCacheE
+__ZNK7WebCore18HTMLFormCollection10calcLengthEv
+__ZNK7WebCore15HTMLFormElement6lengthEv
+__ZNK7WebCore22HTMLFormControlElement14isEnumeratableEv
+__ZNK7WebCore16HTMLInputElement14isEnumeratableEv
+__ZNK7WebCore17HTMLSelectElement14isEnumeratableEv
+__ZNK7WebCore18HTMLFormCollection4itemEj
+-[DOMHTMLInputElement(FormAutoFillTransition) _isTextField]
+__Z4coreP19DOMHTMLInputElement
+__ZNK7WebCore5Frame11currentFormEv
+__Z3kitPN7WebCore7ElementE
+__Z4coreP10DOMElement
+-[DOMElement offsetWidth]
 __ZN7WebCore7Element11offsetWidthEv
-__ZThn8_NK7WebCore17PlatformScrollbar8isWidgetEv
-__ZNK7WebCore17PlatformScrollbar8isWidgetEv
-__ZN7WebCore6Widget16removeFromParentEv
--[WebCoreScrollBar detachPlatformScrollbar]
-__ZNK7WebCore12RenderObject11offsetWidthEv
-__ZN7WebCore44jsDOMWindowPrototypeFunctionGetComputedStyleEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9toElementEPN3KJS7JSValueE
+__ZNK7WebCore4Node20renderBoxModelObjectEv
+__ZNK7WebCore20RenderBoxModelObject16isBoxModelObjectEv
+__ZNK7WebCore9RenderBox11offsetWidthEv
+__ZN7WebCoreL21adjustForAbsoluteZoomEiPNS_12RenderObjectE
+-[DOMElement offsetHeight]
+__ZN7WebCore7Element12offsetHeightEv
+__ZNK7WebCore9RenderBox12offsetHeightEv
+-[DOMNode ownerDocument]
+-[DOMDocument getComputedStyle:pseudoElement:]
 __ZNK7WebCore9DOMWindow16getComputedStyleEPNS_7ElementERKNS_6StringE
+__ZN7WebCore27CSSComputedStyleDeclarationC1EN3WTF10PassRefPtrINS_4NodeEEE
 __ZN7WebCore27CSSComputedStyleDeclarationC2EN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore21JSCSSStyleDeclaration18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSCSSStyleDeclaration18canGetItemsForNameEPN3KJS9ExecStateEPNS_19CSSStyleDeclarationERKNS1_10IdentifierE
-__ZN7WebCore21JSCSSStyleDeclaration10nameGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore19CSSStyleDeclaration19getPropertyCSSValueERKNS_6StringE
+__Z3kitPN7WebCore19CSSStyleDeclarationE
+-[DOMCSSStyleDeclaration getPropertyValue:]
+__ZN7WebCore19CSSStyleDeclaration16getPropertyValueERKNS_6StringE
+__ZN7WebCore13cssPropertyIDERKNS_6StringE
+__ZNK7WebCore27CSSComputedStyleDeclaration16getPropertyValueEi
 __ZNK7WebCore27CSSComputedStyleDeclaration19getPropertyCSSValueEi
 __ZNK7WebCore27CSSComputedStyleDeclaration19getPropertyCSSValueEiNS_13EUpdateLayoutE
 __ZN7WebCore7Element13computedStyleEv
-__ZN7WebCore7Element10offsetLeftEv
-__ZNK7WebCore12RenderObject10offsetLeftEv
-__ZN7WebCore19CSSStyleDeclaration16getPropertyValueERKNS_6StringE
-__ZNK7WebCore26CSSMutableStyleDeclaration16getPropertyValueEi
-__ZN7WebCore19CSSCursorImageValueC2ERKNS_6StringERKNS_8IntPointEPNS_9StyleBaseE
-__ZN7WebCore11RenderStyle9addCursorEPNS_11CachedImageERKNS_8IntPointE
-__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE15reserveCapacityEm
-__ZNK7WebCore12CSSValueList7cssTextEv
-__ZNK7WebCore15FontFamilyValue7cssTextEv
-__ZN7WebCore15JSTextPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24JSCharacterDataPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore4Font7xHeightEv
-__ZNK7WebCore11RenderTheme19adjustCheckboxStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZNK7WebCore14RenderThemeMac15setCheckboxSizeEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac13checkboxSizesEv
-__ZN3WTF6VectorIPN7WebCore12RenderObjectELm16EE6shrinkEm
-__ZN7WebCore11RenderLayer25dirtyVisibleContentStatusEv
-__ZN7WebCore14RenderThemeMac20setCheckboxCellStateEPKNS_12RenderObjectERKNS_7IntRectE
-__ZNK7WebCore14RenderThemeMac8checkboxEv
-__ZNK7WebCore14RenderThemeMac15checkboxMarginsEv
-__ZNK7WebCore14RenderThemeMac16baselinePositionEPKNS_12RenderObjectE
-__ZN7WebCore7Element11clientWidthEv
-__ZN7WebCore7Element12clientHeightEv
-__ZN7WebCore10RenderView15pushLayoutStateEPNS_12RenderObjectE
-__ZN7WebCore11LayoutStateC2EPNS_12RenderObjectE
-__ZN7WebCore27isObjectAncestorContainerOfEPNS_12RenderObjectES1_
-__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE6shrinkEm
-__ZN7WebCore22JSHTMLTableCellElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore19JSHTMLAnchorElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore17HTMLAnchorElement7setHrefERKNS_6StringE
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLImageElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLImageElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore16HTMLImageElement8completeEv
-__ZNK7WebCore16HTMLImageElement3srcEv
-__ZN7WebCore27CSSComputedStyleDeclarationD1Ev
-__ZN7WebCore16HTMLInputElement10setCheckedEbb
-__ZN7WebCore23DeprecatedValueListImpl16removeEqualNodesEPNS_27DeprecatedValueListImplNodeEPFbPKS1_S4_E
-__ZN7WebCore19DeprecatedValueListINS_11CSSPropertyEE10nodesEqualEPKNS_27DeprecatedValueListImplNodeES5_
-__ZN7WebCoreeqERKNS_11CSSPropertyES2_
-__ZNK7WebCore11RenderTheme12stateChangedEPNS_12RenderObjectENS_12ControlStateE
-__ZN7WebCore13textBreakNextEPNS_17TextBreakIteratorE
-__ZN7WebCore18createStyleWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore27JSHTMLStyleElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLStyleElementC1EPN3KJS8JSObjectEPNS_16HTMLStyleElementE
-__ZN7WebCore18JSHTMLStyleElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSHTMLStyleElement9classInfoEv
-__ZN7WebCore18JSHTMLStyleElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore12StyleElement20insertedIntoDocumentEPNS_8DocumentEPNS_7ElementE
-__ZN7WebCore17JSHTMLBodyElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore11FrameLoader15parentCompletedEv
-__ZN7WebCore19JSHTMLScriptElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore12CachedScript11setEncodingERKNS_6StringE
-__ZN7WebCore12RenderInline11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore13InlineTextBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
+__ZNK7WebCore17CSSPrimitiveValue7cssTextEv
+__ZN7WebCore17CSSPrimitiveValueD0Ev
+__ZN7WebCore17CSSPrimitiveValue7cleanupEv
+__ZNK7WebCore16HTMLInputElement12autoCompleteEv
+-[DOMHTMLCollection dealloc]
+__ZN7WebCore14HTMLCollectionD0Ev
+-[DOMCSSStyleDeclaration dealloc]
+__ZN7WebCore27CSSComputedStyleDeclarationD0Ev
+__ZN7WebCore18HTMLFormCollectionD0Ev
+__ZN7WebCore14HTMLCollectionD2Ev
+__ZNK7WebCore4Font15drawComplexTextEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
+__ZN7WebCore18CoreTextController7advanceEjPNS_11GlyphBufferE
+__ZN7WebCore5Frame20caretBlinkTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore11HistoryItemC1ERKNS_6StringES3_d
+__ZN7WebCore11HistoryItemC2ERKNS_6StringES3_d
+__ZN7WebCore11HistoryItem18recordInitialVisitEv
+__ZN3WTF6VectorIiLm0EE14expandCapacityEmPKi
+__ZN3WTF6VectorIiLm0EE14expandCapacityEm
+__ZN3WTF6VectorIiLm0EE15reserveCapacityEm
+__ZNK7WebCore11HistoryItem10visitCountEv
+__ZN7WebCore13ScriptElement21handleSourceAttributeERNS_17ScriptElementDataERKNS_6StringE
+__ZNK7WebCore17ScriptElementData18ignoresLoadRequestEv
+__ZN7WebCore9DocLoader13requestScriptERKNS_6StringES3_
+__ZN7WebCore12CachedScriptC1ERKNS_6StringES3_
+__ZN7WebCore12CachedScriptC2ERKNS_6StringES3_
+__ZN7WebCore17DOMImplementation13isXMLMIMETypeERKNS_6StringE
+__ZN7WebCore17RegularExpressionC1ERKNS_6StringENS_19TextCaseSensitivityE
+__ZN7WebCore17RegularExpressionC2ERKNS_6StringENS_19TextCaseSensitivityE
+__ZNK7WebCore17RegularExpression5matchERKNS_6StringEiPi
+__ZN3WTF5DequeIN7WebCore20CachedResourceHandleINS1_12CachedScriptEEEE14expandCapacityEv
+__ZN7WebCore12CachedScript9addClientEPNS_20CachedResourceClientE
+__ZN7WebCore14PreloadScannerC1EPNS_8DocumentE
+__ZN7WebCore14PreloadScannerC2EPNS_8DocumentE
+__ZN7WebCore14PreloadScanner5beginEv
+__ZN7WebCore14PreloadScanner5resetEv
+__ZN3WTF6VectorItLm32EE14shrinkCapacityEm
+__ZN3WTF6VectorItLm16EE14shrinkCapacityEm
+__ZN7WebCore14PreloadScanner5writeERKNS_15SegmentedStringE
+__ZN7WebCore14PreloadScanner8tokenizeERKNS_15SegmentedStringE
+__ZN7WebCore14PreloadScanner16processAttributeEv
+__ZN3WTF6VectorItLm32EE6shrinkEm
+__ZN7WebCore14PreloadScanner7emitTagEv
+__ZNK7WebCore14PreloadScanner12scanningBodyEv
+__ZN7WebCore9DocLoader7preloadENS_14CachedResource4TypeERKNS_6StringES5_b
+__ZN7WebCore9DocLoader14requestPreloadENS_14CachedResource4TypeERKNS_6StringES5_
+__ZNK3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore14CachedResourceEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashF
+__ZN3WTF11ListHashSetIPN7WebCore14CachedResourceENS_7PtrHashIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore14CachedResourceEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFu
+__ZN3WTF11ListHashSetIPN7WebCore14CachedResourceENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
+__ZN3WTF5DequeIN7WebCore18SegmentedSubstringEE14expandCapacityEv
+__ZN3WTF6VectorIN7WebCore9DocLoader14PendingPreloadELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN7WebCore9DocLoader14PendingPreloadELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore9DocLoader14PendingPreloadELm0EE15reserveCapacityEm
+__ZN7WebCore14PreloadScanner13consumeEntityERNS_15SegmentedStringERb
+__ZN3WTF6VectorIcLm10EE6shrinkEm
+__ZN3WTF6VectorItLm10EE6shrinkEm
+__ZNK7WebCore12HTMLDocument10isFrameSetEv
+-[DOMDocument documentElement]
+-[DOMDocument createRange]
+__ZN7WebCore8Document11createRangeEv
+__Z3kitPN7WebCore5RangeE
+-[DOMRange selectNode:]
+__Z4coreP7DOMNode
+__ZN7WebCore5Range10selectNodeEPNS_4NodeERi
+__ZN7WebCore5Range14setStartBeforeEPNS_4NodeERi
+__ZNK7WebCore5Range11checkNodeBAEPNS_4NodeERi
+__ZNK7WebCore4Node9nodeIndexEv
+__ZN7WebCore5Range11setEndAfterEPNS_4NodeERi
+__Z4coreP8DOMRange
+__ZN7WebCore32plainTextToMallocAllocatedBufferEPKNS_5RangeERjb
+__ZN7WebCore12TextIterator17handleNonTextNodeEv
+__ZN7WebCoreL24shouldEmitNewlineForNodeEPNS_4NodeE
+__ZNK7WebCore4Node14isDescendantOfEPKS0_
 __ZNK7WebCore4Node17isContentEditableEv
-__ZNK7WebCore4Node17canStartSelectionEv
-__ZN7WebCore11iBeamCursorEv
-__ZN7WebCore12EventHandler8keyEventEP7NSEvent
-__ZN7WebCore21PlatformKeyboardEventC1EP7NSEvent
-__ZN7WebCore25windowsKeyCodeForKeyEventEP7NSEvent
-__ZN7WebCore12EventHandler8keyEventERKNS_21PlatformKeyboardEventE
-__ZN7WebCore26eventTargetNodeForDocumentEPNS_8DocumentE
-__ZN7WebCore12EventHandler15handleAccessKeyERKNS_21PlatformKeyboardEventE
-__ZNK7WebCore12EventHandler38needsKeyboardEventDisambiguationQuirksEv
-__ZNK7WebCore16DeprecatedString10startsWithEPKcb
-__ZN7WebCore21PlatformKeyboardEvent24disambiguateKeyDownEventENS0_4TypeEb
-__ZN7WebCore13KeyboardEventC2ERKNS_21PlatformKeyboardEventEPNS_9DOMWindowE
-__ZN7WebCore6Editor24handleInputMethodKeydownEPNS_13KeyboardEventE
-__ZN7WebCore6Editor19selectionForCommandEPNS_5EventE
-__ZNK7WebCore13KeyboardEvent15isKeyboardEventEv
-__ZN7WebCore24JSKeyboardEventPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSUIEventPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSKeyboardEventC1EPN3KJS8JSObjectEPNS_13KeyboardEventE
-__ZN7WebCore9JSUIEventC1EPN3KJS8JSObjectEPNS_7UIEventE
-__ZN7WebCore15JSKeyboardEvent18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore15JSKeyboardEventEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore15JSKeyboardEvent16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore5Event20storesResultAsStringEv
-__ZN7WebCore5Frame27doTextFieldCommandFromEventEPNS_7ElementEPNS_13KeyboardEventE
-__ZN7WebCore12EventHandler27defaultKeyboardEventHandlerEPNS_13KeyboardEventE
-__ZN7WebCore6Editor19handleKeyboardEventEPNS_13KeyboardEventE
-__ZN7WebCore6Editor7commandERKNS_6StringE
-__ZN7WebCore6Editor7commandERKNS_6StringENS_19EditorCommandSourceE
-__ZN7WebCore16createCommandMapEv
-__ZN3WTF7HashMapIN7WebCore6StringEPKNS1_21EditorInternalCommandENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERKS2_RKS5_
-__ZN7WebCore6Editor7CommandC1EN3WTF10PassRefPtrINS_5FrameEEEPKNS_21EditorInternalCommandENS_19EditorCommandSourceE
-__ZNK7WebCore6Editor7Command15isTextInsertionEv
-__ZN3WTF6VectorIN7WebCore15KeypressCommandELm0EEaSERKS3_
-__ZN3WTF6VectorIN7WebCore15KeypressCommandELm0EE15reserveCapacityEm
-__ZN7WebCore6Editor10insertTextERKNS_6StringEPNS_5EventE
-__ZN7WebCore12EventHandler20handleTextInputEventERKNS_6StringEPNS_5EventEbb
-__ZN7WebCore9TextEventC2EPNS_9DOMWindowERKNS_6StringE
-__ZNK7WebCore9TextEvent11isTextEventEv
-__ZN7WebCore12EventHandler28defaultTextInputEventHandlerEPNS_9TextEventE
-__ZN7WebCore6Editor33insertTextWithoutSendingTextEventERKNS_6StringEbPNS_5EventE
-__ZNK7WebCore6Editor16shouldInsertTextERKNS_6StringEPNS_5RangeENS_18EditorInsertActionE
-__ZN7WebCore13TypingCommand10insertTextEPNS_8DocumentERKNS_6StringERKNS_9SelectionEbb
-__ZN7WebCore23BeforeTextInsertedEventC2ERKNS_6StringE
-__ZN7WebCore29HTMLTextFieldInnerTextElement19defaultEventHandlerEPNS_5EventE
-__ZNK7WebCore23BeforeTextInsertedEvent25isBeforeTextInsertedEventEv
-__ZN7WebCore19numGraphemeClustersEPNS_10StringImplE
-__ZN7WebCore9plainTextEPKNS_5RangeE
-__ZN7WebCore13TypingCommandC2EPNS_8DocumentENS0_14ETypingCommandERKNS_6StringEbNS_15TextGranularityE
-__ZN7WebCore20CompositeEditCommandC2EPNS_8DocumentE
-__ZN7WebCore11EditCommandC2EPNS_8DocumentE
-__ZN7WebCore25avoidIntersectionWithNodeERKNS_9SelectionEPNS_4NodeE
-__ZN7WebCore11EditCommand20setStartingSelectionERKNS_9SelectionE
-__ZN7WebCore11EditCommand18setEndingSelectionERKNS_9SelectionE
-__ZN7WebCore12applyCommandEN3WTF10PassRefPtrINS_11EditCommandEEE
-__ZN7WebCore11EditCommand5applyEv
-__ZNK7WebCore9Selection23isContentRichlyEditableEv
-__ZN7WebCore24isRichlyEditablePositionERKNS_8PositionE
-__ZNK7WebCore11HTMLElement23isContentRichlyEditableEv
-__ZNK7WebCore13TypingCommand13editingActionEv
-__ZNK7WebCore11EditCommand12updateLayoutEv
-__ZN7WebCore13TypingCommand7doApplyEv
-__ZN7WebCore13TypingCommand10insertTextERKNS_6StringEb
-__ZN7WebCore13TypingCommand28insertTextRunWithoutNewlinesERKNS_6StringEb
-__ZNK7WebCore5Frame11typingStyleEv
-__ZN7WebCore17InsertTextCommandC2EPNS_8DocumentE
-__ZN7WebCore20CompositeEditCommand23applyCommandToCompositeEN3WTF10PassRefPtrINS_11EditCommandEEE
-__ZN7WebCore11EditCommand9setParentEPNS_20CompositeEditCommandE
-__ZN7WebCore17InsertTextCommand7doApplyEv
-__ZNK7WebCore11EditCommand20preservesTypingStyleEv
-__ZN7WebCore11EditCommand14setTypingStyleEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11EditCommandEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11EditCommandEEELm0EE15reserveCapacityEm
-__ZN7WebCore17InsertTextCommand5inputERKNS_6StringEb
-__ZN7WebCore18positionBeforeNodeEPKNS_4NodeE
-__ZNK7WebCore8Position10downstreamEv
-__ZNK7WebCore16PositionIterator5atEndEv
-__ZN7WebCore13maxDeepOffsetEPKNS_4NodeE
-__ZN7WebCore20CompositeEditCommand23deleteInsignificantTextERKNS_8PositionES3_
-__ZN7WebCore20CompositeEditCommand38positionAvoidingSpecialElementBoundaryERKNS_8PositionEb
-__ZN7WebCore22enclosingAnchorElementERKNS_8PositionE
-__ZN7WebCore17InsertTextCommand23prepareForTextInsertionERKNS_8PositionE
-__ZN7WebCore8Document21createEditingTextNodeERKNS_6StringE
-__ZN7WebCore11EditingTextC2EPNS_8DocumentERKNS_6StringE
-__ZN7WebCore20CompositeEditCommand12insertNodeAtEPNS_4NodeERKNS_8PositionE
-__ZN7WebCore20CompositeEditCommand10appendNodeEPNS_4NodeES2_
-__ZN7WebCore17AppendNodeCommandC2EPNS_4NodeEN3WTF10PassRefPtrIS1_EE
-__ZN7WebCore17AppendNodeCommand7doApplyEv
-__ZN7WebCore11EditingText16rendererIsNeededEPNS_11RenderStyleE
-__ZNK7WebCore10RenderText6heightEv
-__ZN7WebCore9RenderBox9caretRectEiNS_9EAffinityEPi
-__ZNK7WebCore4Node9childNodeEj
-__ZN7WebCore10isStreamerERKNS_16PositionIteratorE
+__ZN7WebCoreL10isStreamerERKNS_16PositionIteratorE
 __ZN7WebCore12isAtomicNodeEPKNS_4NodeE
+__ZNK7WebCore16PositionIterator13atStartOfNodeEv
 __ZN7WebCore16PositionIterator9decrementEv
-__ZNK7WebCore8Position14inRenderedTextEv
-__ZN7WebCore16PositionIterator9incrementEv
 __ZNK7WebCore13CharacterData18offsetInCharactersEv
 __ZNK7WebCore13CharacterData18maxCharacterOffsetEv
+__ZN7WebCore8Position23uncheckedPreviousOffsetEPKNS_4NodeEi
+__ZN7WebCore18positionBeforeNodeEPKNS_4NodeE
+__ZNK7WebCore12RenderObject14nextInPreOrderEv
+__ZN7WebCore16PositionIterator9incrementEv
 __ZN7WebCore13nextCandidateERKNS_8PositionE
 __ZNK7WebCore16PositionIterator11isCandidateEv
-__ZNK7WebCore16PositionIterator13atStartOfNodeEv
-__ZN7WebCore21canonicalizeCandidateERKNS_8PositionE
+__ZN7WebCore8Position19uncheckedNextOffsetEPKNS_4NodeEi
+__ZN7WebCoreL21canonicalizeCandidateERKNS_8PositionE
+__ZNK7WebCore16PositionIterator11atEndOfNodeEv
 __ZN7WebCore17previousCandidateERKNS_8PositionE
-__ZN7WebCore20CompositeEditCommand19removePlaceholderAtERKNS_15VisiblePositionE
-__ZN7WebCore12isEndOfBlockERKNS_15VisiblePositionE
-__ZN7WebCore10endOfBlockERKNS_15VisiblePositionE
-__ZN7WebCore8Position23uncheckedPreviousOffsetEPKNS_4NodeEi
-__ZNK7WebCore12RenderObject14previousOffsetEi
-__ZN7WebCore18isStartOfParagraphERKNS_15VisiblePositionE
-__ZN7WebCore16startOfParagraphERKNS_15VisiblePositionE
-__ZN7WebCore25lineBreakExistsAtPositionERKNS_15VisiblePositionE
-__ZNK7WebCore15VisiblePosition14characterAfterEv
-__ZN7WebCore20CompositeEditCommand18insertTextIntoNodeEPNS_4TextEiRKNS_6StringE
-__ZN7WebCore25InsertIntoTextNodeCommandC2EPNS_4TextEiRKNS_6StringE
-__ZN7WebCore25InsertIntoTextNodeCommand7doApplyEv
-__ZN7WebCore13CharacterData10insertDataEjRKNS_6StringERi
-__ZN7WebCore13CharacterData22checkCharDataOperationEjRi
-__ZN7WebCore6String6insertERKS0_j
-__ZN7WebCore6String6insertEPKtjj
-__ZN7WebCore6String6appendEPKtj
-__ZN7WebCore10RenderText17setTextWithOffsetEN3WTF10PassRefPtrINS_10StringImplEEEjjb
-__ZN7WebCore8Document12shiftMarkersEPNS_4NodeEjiNS_14DocumentMarker10MarkerTypeE
-__ZN7WebCore20CompositeEditCommand21rebalanceWhitespaceAtERKNS_8PositionE
-__ZN7WebCore9Selection20setWithoutValidationERKNS_8PositionES3_
-__ZNK7WebCore8Position13computedStyleEv
-__ZNK7WebCore8Position7elementEv
-__ZNK7WebCore19CSSStyleDeclaration4diffEPNS_26CSSMutableStyleDeclarationE
-__ZN7WebCore9SelectionC2ERKNS_8PositionENS_9EAffinityE
-__ZNK7WebCore10RenderText14caretMinOffsetEv
-__ZNK7WebCore13InlineTextBox19containsCaretOffsetEi
-__ZN7WebCore10RenderText9caretRectEiNS_9EAffinityEPi
-__ZNK7WebCore13InlineTextBox17positionForOffsetEi
-__ZNK7WebCore4Font20selectionRectForTextERKNS_7TextRunERKNS_8IntPointEiii
-__ZNK7WebCore4Font26selectionRectForSimpleTextERKNS_7TextRunERKNS_8IntPointEiii
-__ZNK7WebCore12RenderObject16absolutePositionERiS1_b
-__ZNK7WebCore10RenderText14previousOffsetEi
-__ZN7WebCore18textBreakPrecedingEPNS_17TextBreakIteratorEi
-__ZNK7WebCore10RenderText10nextOffsetEi
-__ZN7WebCore13TypingCommand24typingAddedToOpenCommandEv
-__ZN7WebCore13TypingCommand27markMisspellingsAfterTypingEv
-__ZNK7WebCore15VisiblePosition8previousEb
-__ZN7WebCore33previousVisuallyDistinctCandidateERKNS_8PositionE
-__ZNK7WebCore8Position7atStartEv
-__ZNK7WebCore8Position8previousENS_24EUsingComposedCharactersE
-__ZN7WebCore31SimplifiedBackwardsTextIterator8exitNodeEv
-__ZN7WebCore31SimplifiedBackwardsTextIterator13emitCharacterEtPNS_4NodeEii
-__ZN3WTF6VectorItLm1024EE7prependItEEvPKT_m
-__ZN3WTF6VectorItLm1024EE6insertItEEvmPKT_m
-__ZN7WebCore17startWordBoundaryEPKtj
-__ZN7WebCore16findWordBoundaryEPKtiiPiS2_
-__ZN7WebCore31SimplifiedBackwardsTextIterator14handleTextNodeEv
-__ZNK7WebCore5Range11endPositionEv
-__ZNK7WebCore13TypingCommand20preservesTypingStyleEv
-__ZN7WebCore6Editor14appliedEditingEN3WTF10PassRefPtrINS_11EditCommandEEE
-__ZN7WebCore36dispatchEditableContentChangedEventsERKNS_11EditCommandE
-__ZN7WebCore17RenderTextControl17subtreeHasChangedEv
-__ZN7WebCore16HTMLInputElement20setValueFromRendererERKNS_6StringE
-__ZN7WebCore5Frame24textFieldDidBeginEditingEPNS_7ElementE
--[DOMHTMLInputElement value]
--[WebCoreFrameBridge formForElement:]
-__Z26inputElementFromDOMElementP10DOMElement
--[WebCoreFrameBridge controlsInForm:]
-__Z25formElementFromDOMElementP10DOMElement
--[DOMElement offsetWidth]
--[DOMElement offsetHeight]
--[DOMNode ownerDocument]
--[DOMDocument getComputedStyle:pseudoElement:]
-+[DOMCSSStyleDeclaration(WebCoreInternal) _wrapCSSStyleDeclaration:]
--[DOMCSSStyleDeclaration(WebCoreInternal) _initWithCSSStyleDeclaration:]
--[DOMCSSStyleDeclaration getPropertyValue:]
-__ZNK7WebCore27CSSComputedStyleDeclaration16getPropertyValueEi
--[WebCoreFrameBridge elementIsPassword:]
--[WebCoreFrameBridge elementDoesAutoComplete:]
--[DOMElement getAttribute:]
-__ZN7WebCore5Frame24textDidChangeInTextFieldEPNS_7ElementE
-+[WebCoreFrameBridge bridgeForDOMDocument:]
--[DOMDocument(WebCoreInternal) _document]
--[DOMHTMLInputElement form]
-+[DOMHTMLFormElement(WebCoreInternal) _wrapHTMLFormElement:]
--[DOMHTMLFormElement action]
-__ZNK7WebCore15HTMLFormElement6actionEv
--[DOMHTMLInputElement(FormPromptAdditions) _isEdited]
--[DOMNode parentNode]
-__ZNK7WebCore5Frame21shouldChangeSelectionERKNS_9SelectionE
-__ZNK7WebCore5Frame21shouldChangeSelectionERKNS_9SelectionES3_NS_9EAffinityEb
-__ZNK7WebCore10RenderText22caretMaxRenderedOffsetEv
-__ZNK7WebCore10RenderText14caretMaxOffsetEv
-__ZN7WebCore6Editor24respondToChangedContentsERKNS_9SelectionE
--[DOMCSSStyleDeclaration dealloc]
-__ZN7WebCore15EventTargetNode16dispatchKeyEventERKNS_21PlatformKeyboardEventE
-__ZN7WebCore9JSUIEvent18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore9JSUIEventEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore9JSUIEvent16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore13KeyboardEvent7keyCodeEv
-__ZNK7WebCore13TypingCommand15isTypingCommandEv
-__ZNK7WebCore17InsertTextCommand19isInsertTextCommandEv
-__ZN7WebCore17isTabSpanTextNodeEPKNS_4NodeE
-__ZN7WebCore13isTabSpanNodeEPKNS_4NodeE
-__ZNK7WebCore4Node29traversePreviousNodePostOrderEPKS0_
-__ZN7WebCore6Editor37markMisspellingsAfterTypingToPositionERKNS_15VisiblePositionE
-__ZN7WebCore12nextBoundaryERKNS_15VisiblePositionEPFjPKtjE
-__ZN7WebCore5Range18selectNodeContentsEPNS_4NodeERi
-__ZNK7WebCore5Range12maxEndOffsetEv
-__ZN3WTF6VectorItLm1024EE6appendItEEvPKT_m
-__ZN7WebCore15endWordBoundaryEPKtj
-__ZN7WebCore17CharacterIteratorC2EPKNS_5RangeEb
-__ZN7WebCore17CharacterIterator7advanceEi
-__ZNK7WebCore17CharacterIterator5rangeEv
-__ZNK7WebCore12TextIterator5rangeEv
 __ZN7WebCore10inSameLineERKNS_15VisiblePositionES2_
 __ZN7WebCore11startOfLineERKNS_15VisiblePositionE
-__ZN7WebCore20startPositionForLineERKNS_15VisiblePositionE
-__ZN7WebCore14rootBoxForLineERKNS_15VisiblePositionE
-__ZN7WebCore10RenderText9inlineBoxEiNS_9EAffinityE
+__ZN7WebCoreL20startPositionForLineERKNS_15VisiblePositionE
+__ZN7WebCoreL14rootBoxForLineERKNS_15VisiblePositionE
+__ZNK7WebCore9InlineBox14caretMinOffsetEv
+__ZNK7WebCore12RenderObject14caretMinOffsetEv
+__ZNK7WebCore9InlineBox14caretMaxOffsetEv
+__ZNK7WebCore12RenderObject14caretMaxOffsetEv
+__ZN7WebCore9InlineBox13prevLeafChildEv
+__ZN7WebCore13InlineFlowBox22lastLeafChildBeforeBoxEPNS_9InlineBoxE
 __ZN7WebCore13InlineFlowBox14firstLeafChildEv
 __ZN7WebCore13InlineFlowBox22firstLeafChildAfterBoxEPNS_9InlineBoxE
 __ZN7WebCore9InlineBox14firstLeafChildEv
-__ZN7WebCore36positionAvoidingFirstPositionInTableERKNS_15VisiblePositionE
+__ZN7WebCoreL36positionAvoidingFirstPositionInTableERKNS_15VisiblePositionE
+__ZNK7WebCore8Position8previousENS_16PositionMoveTypeE
+__ZN7WebCore30lastDeepEditingPositionForNodeEPNS_4NodeE
 __ZN7WebCore25isLastPositionBeforeTableERKNS_15VisiblePositionE
 __ZNK7WebCore15VisiblePosition30honorEditableBoundaryAtOrAfterERKS0_
-__ZN7WebCore6Editor16markMisspellingsERKNS_9SelectionE
-__ZN7WebCore28markMisspellingsOrBadGrammarEPNS_6EditorERKNS_9SelectionEb
-__ZNK7WebCore5Range10isDetachedEv
-__ZN7WebCore27findFirstMisspellingInRangeEPNS_12EditorClientEPNS_5RangeERib
-__ZN7WebCore17WordAwareIteratorC2EPKNS_5RangeE
-__ZN7WebCore17WordAwareIterator7advanceEv
-__ZNK7WebCore17WordAwareIterator10charactersEv
-__ZNK7WebCore17WordAwareIterator6lengthEv
-__ZN7WebCore5TimerINS_12IconDatabaseEE5firedEv
-__ZN7WebCore12IconDatabase14syncTimerFiredEPNS_5TimerIS0_EE
-__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE15reserveCapacityEm
-__ZN7WebCore12IconDatabase30writeIconSnapshotToSQLDatabaseERKNS_12IconSnapshotE
-__ZN7WebCore15SQLiteStatement9isExpiredEv
-_sqlite3_expired
-__ZN7WebCore14SQLiteDatabase15lastInsertRowIDEv
-_sqlite3_last_insert_rowid
-__ZN7WebCore15SQLiteStatement8bindBlobEiPKvi
-_sqlite3_bind_blob
-_balance_deeper
-_balance_nonroot
-__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE6shrinkEm
--[DOMHTMLInputElement disabled]
--[WebCoreFrameBridge matchLabels:againstElement:]
-__ZN7WebCore5Frame25matchLabelsAgainstElementEP7NSArrayPNS_7ElementE
-__ZN7WebCore17RegularExpressionD2Ev
-__ZN7WebCore17RegularExpression7PrivateD2Ev
-__ZNK7WebCore16DeprecatedString4findENS_14DeprecatedCharEi
-__ZN7WebCore16DeprecatedStringC2ENS_14DeprecatedCharE
-__ZNK7WebCore16DeprecatedString4findERKS0_ib
-__ZN7WebCore15regExpForLabelsEP7NSArray
-__ZN7WebCore16DeprecatedString12fromNSStringEP8NSString
-__ZN7WebCore16DeprecatedString21setBufferFromCFStringEPK10__CFString
-__ZNK7WebCore17RegularExpression6searchERKNS_16DeprecatedStringEi
-__ZN7WebCore17RegularExpressionC2ERKNS_16DeprecatedStringEbb
-__ZN3WTF6VectorIPN7WebCore17RegularExpressionELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore17RegularExpressionELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore17RegularExpressionELm0EE15reserveCapacityEm
--[WebCoreFrameBridge searchForLabels:beforeElement:]
-__ZN7WebCore5Frame28searchForLabelsBeforeElementEP7NSArrayPNS_7ElementE
-__ZNK7WebCore11HTMLElement20isGenericFormElementEv
-__ZN7WebCore5Frame24searchForLabelsAboveCellEPNS_17RegularExpressionEPNS_20HTMLTableCellElementE
-__ZNK7WebCore17RegularExpression9searchRevERKNS_16DeprecatedStringE
-__ZNK7WebCore22HTMLGenericFormElement20isGenericFormElementEv
-__ZNK7WebCore6Editor7Command11isSupportedEv
-__ZN7WebCore29supportedFromMenuOrKeyBindingEPNS_5FrameENS_19EditorCommandSourceE
-__ZNK7WebCore6Editor7Command7executeEPNS_5EventE
-__ZNK7WebCore6Editor7Command7executeERKNS_6StringEPNS_5EventE
-__ZNK7WebCore6Editor7Command9isEnabledEPNS_5EventE
-__ZN7WebCore21enabledInEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
-__ZN7WebCore21executeDeleteBackwardEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore6Editor19deleteWithDirectionENS_19SelectionController10EDirectionENS_15TextGranularityEbb
-__ZN7WebCore19SelectionController6modifyENS0_11EAlterationENS0_10EDirectionENS_15TextGranularityEb
-__ZN7WebCore19SelectionController14willBeModifiedENS0_11EAlterationENS0_10EDirectionE
-__ZN7WebCore9Selection7setBaseERKNS_8PositionE
-__ZN7WebCore9Selection9setExtentERKNS_8PositionE
-__ZN7WebCore19SelectionController27modifyExtendingLeftBackwardENS_15TextGranularityE
-__ZNK7WebCore15VisiblePosition31honorEditableBoundaryAtOrBeforeERKS0_
-__ZN7WebCore19SelectionController30xPosForVerticalArrowNavigationENS0_13EPositionTypeE
-__ZN7WebCore19SelectionController9setExtentERKNS_15VisiblePositionEb
-__ZN7WebCore9SelectionC2ERKNS_8PositionES3_NS_9EAffinityE
-__ZN7WebCore19SelectionController16setSelectedRangeEPNS_5RangeENS_9EAffinityEb
-__ZNK7WebCore5Range9collapsedERi
-__ZN7WebCore10RenderText17setSelectionStateENS_12RenderObject14SelectionStateE
-__ZNK7WebCore12RenderObject17selectionStartEndERiS1_
-__ZNK7WebCore10RenderView17selectionStartEndERiS1_
-__ZNK7WebCore13InlineTextBox10isSelectedEii
-__ZN7WebCore13RootInlineBox22setHasSelectedChildrenEb
-__ZN7WebCore11RenderBlock17setSelectionStateENS_12RenderObject14SelectionStateE
-__ZNK7WebCore12RenderObject7childAtEj
-__ZNK7WebCore10RenderText18canBeSelectionLeafEv
-__ZN7WebCore10RenderText13selectionRectEb
-__ZN7WebCore13InlineTextBox13selectionRectEiiii
-__ZN7WebCore13InlineTextBox12selectionTopEv
-__ZN7WebCore13InlineTextBox15selectionHeightEv
-__ZN7WebCore12RenderObject26computeAbsoluteRepaintRectERNS_7IntRectEb
-__ZNK3WTF7HashMapIPN7WebCore12RenderObjectEPNS2_13SelectionInfoENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
-__ZN7WebCore11RenderBlock17selectionGapRectsEv
-__ZNK7WebCore11RenderBlock15isSelectionRootEv
-__ZN7WebCore11RenderBlock19leftSelectionOffsetEPS0_i
-__ZN7WebCore11RenderBlock20rightSelectionOffsetEPS0_i
-__ZN7WebCore11RenderBlock17fillSelectionGapsEPS0_iiiiRiS2_S2_PKNS_12RenderObject9PaintInfoE
-__ZN7WebCore11RenderBlock23fillInlineSelectionGapsEPS0_iiiiRiS2_S2_PKNS_12RenderObject9PaintInfoE
-__ZN7WebCore13RootInlineBox20fillLineSelectionGapEiiPNS_11RenderBlockEiiiiPKNS_12RenderObject9PaintInfoE
-__ZN7WebCore13RootInlineBox14selectionStateEv
-__ZN7WebCore11RenderBlock29getHorizontalSelectionGapInfoENS_12RenderObject14SelectionStateERbS3_
-__ZN7WebCore13RootInlineBox16firstSelectedBoxEv
-__ZN7WebCore13RootInlineBox15lastSelectedBoxEv
-__ZN7WebCore13InlineFlowBox13lastLeafChildEv
-__ZN7WebCore13InlineFlowBox22lastLeafChildBeforeBoxEPNS_9InlineBoxE
-__ZN7WebCore9InlineBox13lastLeafChildEv
-__ZNK3WTF7HashMapIPN7WebCore11RenderBlockEPNS2_18BlockSelectionInfoENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
-__ZN7WebCore11RenderBlock22fillBlockSelectionGapsEPS0_iiiiRiS2_S2_PKNS_12RenderObject9PaintInfoE
-__ZNK7WebCore10RenderView14selectionStartEv
-__ZNK7WebCore12RenderObject18canBeSelectionLeafEv
-__ZNK7WebCore5Range20editingStartPositionEv
-__ZN7WebCore13TypingCommand16deleteKeyPressedEPNS_8DocumentEbNS_15TextGranularityE
-__ZN7WebCore13TypingCommand16deleteKeyPressedENS_15TextGranularityE
-__ZN7WebCore25isFirstPositionAfterTableERKNS_15VisiblePositionE
-__ZNK7WebCore5Frame21shouldDeleteSelectionERKNS_9SelectionE
-__ZN7WebCore20CompositeEditCommand15deleteSelectionERKNS_9SelectionEbbbb
-__ZN7WebCore22DeleteSelectionCommandC2ERKNS_9SelectionEbbbb
-__ZN7WebCore22DeleteSelectionCommand7doApplyEv
-__ZN7WebCore5Frame28textWillBeDeletedInTextFieldEPNS_7ElementE
-__ZN7WebCore22DeleteSelectionCommand22initializePositionDataEv
-__ZN7WebCore22DeleteSelectionCommand18initializeStartEndERNS_8PositionES2_
-__ZN7WebCore38positionBeforeContainingSpecialElementERKNS_8PositionEPPNS_4NodeE
-__ZN7WebCore21firstInSpecialElementERKNS_8PositionE
-__ZN7WebCore16isSpecialElementEPKNS_4NodeE
-__ZN7WebCore37positionAfterContainingSpecialElementERKNS_8PositionEPPNS_4NodeE
-__ZN7WebCore20lastInSpecialElementERKNS_8PositionE
-__ZN7WebCore10isTableRowEPKNS_4NodeE
-__ZN7WebCore18enclosingTableCellERKNS_8PositionE
-__ZNK7WebCore8Position25leadingWhitespacePositionENS_9EAffinityEb
-__ZNK7WebCore8Position25previousCharacterPositionENS_9EAffinityE
-__ZN7WebCore13isStartOfLineERKNS_15VisiblePositionE
-__ZNK7WebCore8Position26rendersInDifferentPositionERKS0_
-__ZNK7WebCore8Position14renderedOffsetEv
-__ZNK7WebCore4Node12nextEditableEv
-__ZNK7WebCore4Node12nextLeafNodeEv
-__ZNK7WebCore4Node30nextNodeConsideringAtomicNodesEv
-__ZNK7WebCore4Node16previousEditableEv
-__ZNK7WebCore4Node16previousLeafNodeEv
-__ZNK7WebCore4Node34previousNodeConsideringAtomicNodesEv
-__ZN7WebCore4Node32inSameContainingBlockFlowElementEPS0_
-__ZNK7WebCore8Position26trailingWhitespacePositionENS_9EAffinityEb
-__ZNK7WebCore4Node32enclosingBlockFlowOrTableElementEv
-__ZNK7WebCore4Node23isBlockFlowOrBlockTableEv
-__ZN7WebCore20CompositeEditCommand33deleteInsignificantTextDownstreamERKNS_8PositionE
-__ZNK7WebCore15VisiblePosition4nextEb
-__ZN7WebCore29nextVisuallyDistinctCandidateERKNS_8PositionE
-__ZNK7WebCore8Position5atEndEv
-__ZN7WebCore22DeleteSelectionCommand20saveTypingStyleStateEv
-__ZN7WebCore21positionBeforeTabSpanERKNS_8PositionE
-__ZNK7WebCore27CSSComputedStyleDeclaration25copyInheritablePropertiesEv
-__ZNK7WebCore19CSSStyleDeclaration19copyPropertiesInSetEPKij
-__ZN7WebCore17CSSPrimitiveValueC1ERKNS_6LengthE
-__ZN7WebCore24currentColorOrValidColorEPNS_11RenderStyleERKNS_5ColorE
-__ZN7WebCore26CSSMutableStyleDeclarationC2EPNS_7CSSRuleERKNS_19DeprecatedValueListINS_11CSSPropertyEEE
-__ZN7WebCore26CSSMutableStyleDeclaration14removePropertyEiRi
-__ZNK7WebCore9StyleBase15isCSSStyleSheetEv
-__ZN7WebCore21nearestMailBlockquoteEPKNS_4NodeE
-__ZN7WebCore16isMailBlockquoteEPKNS_4NodeE
-__ZN7WebCore22DeleteSelectionCommand23saveFullySelectedAnchorEv
-__ZN7WebCore20enclosingNodeWithTagERKNS_8PositionERKNS_13QualifiedNameE
-__ZNK7WebCore8Position4nextENS_24EUsingComposedCharactersE
-__ZN7WebCore22DeleteSelectionCommand25handleSpecialCaseBRDeleteEv
-__ZN7WebCore22DeleteSelectionCommand19handleGeneralDeleteEv
-__ZN7WebCore14caretMaxOffsetEPKNS_4NodeE
-__ZN7WebCore22DeleteSelectionCommand18deleteTextFromNodeEPNS_4TextEii
-__ZN7WebCore28updatePositionForTextRemovalEPNS_4NodeEiiRNS_8PositionE
-__ZN7WebCore20CompositeEditCommand18deleteTextFromNodeEPNS_4TextEii
-__ZN7WebCore25DeleteFromTextNodeCommandC2EPNS_4TextEii
-__ZN7WebCore25DeleteFromTextNodeCommand7doApplyEv
-__ZN7WebCore13CharacterData13substringDataEjjRi
-__ZN7WebCore13CharacterData10deleteDataEjjRi
-__ZN7WebCore6String6removeEji
-__ZN7WebCore8Document13removeMarkersEPNS_4NodeEjiNS_14DocumentMarker10MarkerTypeE
-__ZN7WebCore22DeleteSelectionCommand15fixupWhitespaceEv
-__ZN7WebCore22DeleteSelectionCommand15mergeParagraphsEv
-__ZN7WebCore22DeleteSelectionCommand38removePreviouslySelectedEmptyTableRowsEv
-__ZN7WebCore22DeleteSelectionCommand31calculateTypingStyleAfterDeleteEPNS_4NodeE
-__ZN7WebCore4Node13computedStyleEv
-__ZN3WTF6VectorIiLm0EE14expandCapacityEmPKi
-__ZN7WebCore11quoteStringERKNS_6StringE
-__ZN7WebCore10StringImpl7replaceEtPS0_
+__ZN7WebCore12TextIterator33shouldEmitSpaceBeforeAndAfterNodeEPNS_4NodeE
+__ZN7WebCore12TextIterator21handleReplacedElementEv
+__ZN7WebCore12TextIterator14handleTextNodeEv
+__ZN7WebCore12TextIterator8exitNodeEv
+__ZN7WebCoreL26shouldEmitNewlineAfterNodeEPNS_4NodeE
+__ZN7WebCore12TextIterator13emitCharacterEtPNS_4NodeES2_ii
+__ZN7WebCore12TextIterator13handleTextBoxEv
+__ZN7WebCore12TextIterator8emitTextEPNS_4NodeEii
+__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE15reserveCapacityEm
+__ZSt16__introsort_loopIPPN7WebCore13InlineTextBoxElPFbPKS1_S5_EEvT_S8_T0_T1_
+__ZSt22__final_insertion_sortIPPN7WebCore13InlineTextBoxEPFbPKS1_S5_EEvT_S8_T0_
+__ZSt16__insertion_sortIPPN7WebCore13InlineTextBoxEPFbPKS1_S5_EEvT_S8_T0_
+__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE6shrinkEm
+-[DOMRange dealloc]
+__ZN7WebCore12CachedScript4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
+__ZN7WebCore12CachedScript11checkNotifyEv
+__ZThn16_N7WebCore13HTMLTokenizer14notifyFinishedEPNS_14CachedResourceE
+__ZN7WebCore13HTMLTokenizer14notifyFinishedEPNS_14CachedResourceE
+__ZNK7WebCore26CachedScriptSourceProvider6lengthEv
+__ZN7WebCore12CachedScript6scriptEv
+__ZN7WebCore14CachedResource12removeClientEPNS_20CachedResourceClientE
+__ZNK7WebCore26CachedScriptSourceProvider4dataEv
+__ZN7WebCoreL23addPendingEventListenerERN3WTF7HashMapIPNS_9DOMWindowEPNS0_6VectorINS0_6RefPtrINS_23RegisteredEventListenerEEELm
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowESt4pairIS3_PNS_6VectorINS_6RefPtrINS1_23RegisteredEventListenerEEELm0EEEENS_18PairFirst
+__ZN7WebCore19MediaQueryEvaluatorC1Eb
+__ZN7WebCore19MediaQueryEvaluatorC2Eb
+__ZN7WebCore11FrameLoader29loadedResourceFromMemoryCacheEPKNS_14CachedResourceE
+__ZN7WebCore19InspectorController30didLoadResourceFromMemoryCacheEPNS_14DocumentLoaderEPKNS_14CachedResourceE
+__ZThn112_N7WebCore15HTMLLinkElement16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore15HTMLLinkElement16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore9CSSParser22createFloatingFunctionEv
+__ZN3WTF7HashSetIPN7WebCore17CSSParserFunctionENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore17CSSParserFunctionES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expa
+__ZN3WTF9HashTableIPN7WebCore17CSSParserFunctionES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6reha
+__ZN3WTF9HashTableIPN7WebCore17CSSParserFunctionES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13all
+__ZN3WTF9HashTableIPN7WebCore17CSSParserFunctionES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4find
+__ZN3WTF9HashTableIPN7WebCore17CSSParserFunctionES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47rem
+__ZN3WTF9HashTableIPN7WebCore17CSSParserFunctionES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6remo
+__ZN7WebCore9CSSParser13parseSVGValueEib
+__ZN7WebCore9CSSParser22rollbackLastPropertiesEi
+__ZN7WebCore9CSSParser12parseReflectEib
+__ZN7WebCore9CSSParser16parseBorderImageEibRN3WTF6RefPtrINS_8CSSValueEEE
+__ZN7WebCoreL17equalIgnoringCaseERKNS_15CSSParserStringEPKc
+__ZN7WebCore9CSSParser13parseGradientERN3WTF6RefPtrINS_8CSSValueEEE
+__ZN7WebCore22CSSImageGeneratorValueC2Ev
+__ZN7WebCoreL18parseGradientPointEPNS_14CSSParserValueEb
+__ZN3WTF6VectorIN7WebCore20CSSGradientColorStopELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore20CSSGradientColorStopELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore20CSSGradientColorStopELm0EE15reserveCapacityEm
+__ZN7WebCore9CSSParser20parseColorParametersEPNS_14CSSParserValueEPib
+__ZN7WebCore23BorderImageParseContext17commitBorderImageEPNS_9CSSParserEb
+__ZN7WebCore19CSSBorderImageValueC1EN3WTF10PassRefPtrINS_8CSSValueEEENS2_INS_4RectEEEii
+__ZN7WebCore19CSSBorderImageValueC2EN3WTF10PassRefPtrINS_8CSSValueEEENS2_INS_4RectEEEii
+__ZN7WebCore9CSSParser19createKeyframesRuleEv
+__ZN7WebCore22WebKitCSSKeyframesRuleC1EPNS_13CSSStyleSheetE
+__ZN7WebCore22WebKitCSSKeyframesRuleC2EPNS_13CSSStyleSheetE
+__ZN7WebCore11CSSRuleListC1Ev
+__ZN7WebCore11CSSRuleListC2Ev
+__ZN7WebCore9CSSParser14parseTransformEv
+__ZN7WebCore22TransformOperationInfoC2ERKNS_15CSSParserStringE
+__ZN7WebCore23WebKitCSSTransformValueC1ENS0_22TransformOperationTypeE
+__ZN7WebCore23WebKitCSSTransformValueC2ENS0_22TransformOperationTypeE
+__ZN7WebCore9CSSParser22parseAnimationPropertyEiRN3WTF6RefPtrINS_8CSSValueEEE
+__ZN7WebCore9CSSParser28parseAnimationTimingFunctionEv
+__ZN7WebCore9CSSParser18createKeyframeRuleEPNS_18CSSParserValueListE
 __ZN7WebCore6String6numberEd
-__ZN7WebCore5Frame14setTypingStyleEPNS_26CSSMutableStyleDeclarationE
-__ZN7WebCore22DeleteSelectionCommand19clearTransientStateEv
-__ZN7WebCore8Position5clearEv
-__ZNK7WebCore22DeleteSelectionCommand20preservesTypingStyleEv
-__ZN7WebCore9InlineBox13nextLeafChildEv
-__ZN7WebCore9InlineBox13prevLeafChildEv
-__ZN7WebCore6Editor36revealSelectionAfterEditingOperationEv
-__ZNK7WebCore11HistoryItem5titleEv
-__ZNK7WebCore11EditCommand19isInsertTextCommandEv
-__ZNK7WebCore11HistoryItem14alternateTitleEv
-__ZNK7WebCore11HistoryItem10visitCountEv
-__ZN7WebCore12TextIterator8subrangeEPNS_5RangeEii
-__ZN7WebCore8Document9addMarkerEPNS_5RangeENS_14DocumentMarker10MarkerTypeENS_6StringE
-__ZN7WebCore8Document9addMarkerEPNS_4NodeENS_14DocumentMarkerE
-__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE15reserveCapacityEm
-__ZN7WebCore24placeholderRectForMarkerEv
-__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EEC2ERKS3_
-__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE6shrinkEm
-__ZN7WebCore13InlineTextBox28paintSpellingOrGrammarMarkerEPNS_15GraphicsContextEiiNS_14DocumentMarkerEPNS_11RenderStyleEPKNS_4FontEb
-__ZN7WebCore15GraphicsContext34drawLineForMisspellingOrBadGrammarERKNS_8IntPointEib
+__ZN7WebCore21WebKitCSSKeyframeRuleC1EPNS_13CSSStyleSheetE
+__ZN7WebCore21WebKitCSSKeyframeRuleC2EPNS_13CSSStyleSheetE
+__ZN7WebCore21WebKitCSSKeyframeRule14setDeclarationEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE
+__ZN7WebCore22WebKitCSSKeyframesRule6appendEPNS_21WebKitCSSKeyframeRuleE
+__ZN7WebCore11CSSRuleList6appendEPNS_7CSSRuleE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore7CSSRuleEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore7CSSRuleEEELm0EE15reserveCapacityEm
+__ZN7WebCore9CSSParser19parseAnimationDelayEv
+__ZN7WebCore9CSSParser22parseAnimationDurationEv
+__ZN7WebCore9CSSParser18parseAnimationNameEv
+__ZN7WebCore15HTMLLinkElement11sheetLoadedEv
+__ZN7WebCore9StyleBase11isMediaRuleEv
+__ZN7WebCore9StyleBase14isFontFaceRuleEv
+__ZN7WebCore9StyleBase15isVariablesRuleEv
+__ZN7WebCore22WebKitCSSKeyframesRule15isKeyframesRuleEv
+__ZN7WebCore16CSSStyleSelector16addKeyframeStyleEN3WTF10PassRefPtrINS_22WebKitCSSKeyframesRuleEEE
+__ZNK7WebCore22WebKitCSSKeyframesRule4nameEv
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplENS_6RefPtrINS1_22WebKitCSSKeyframesRuleEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEN
+__ZN7WebCore10HTMLParser24noscriptCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore18NamedMappedAttrMapD0Ev
+__ZN7WebCore12NamedNodeMapD2Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AttributeEEELm0EE6shrinkEm
+__ZN7WebCore15MappedAttributeD0Ev
+__ZN7WebCoreL16audioConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore11MediaPlayer11isAvailableEv
+__ZN7WebCoreL21installedMediaEnginesEv
+__ZN7WebCore18MediaPlayerPrivate19registerMediaEngineEPFvPFPNS_27MediaPlayerPrivateInterfaceEPNS_11MediaPlayerEEPFvRN3WTF7HashS
+__ZN7WebCore18MediaPlayerPrivate11isAvailableEv
+__ZL12QTKitLibraryv
+__ZN7WebCoreL14addMediaEngineEPFPNS_27MediaPlayerPrivateInterfaceEPNS_11MediaPlayerEEPFvRN3WTF7HashSetINS_6StringENS_10StringHa
+__ZN3WTF6VectorIPN7WebCore18MediaPlayerFactoryELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore18MediaPlayerFactoryELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore18MediaPlayerFactoryELm0EE15reserveCapacityEm
+__ZN7WebCore16HTMLAudioElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLAudioElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLMediaElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore8Document38registerForDocumentActivationCallbacksEPNS_7ElementE
+__ZN3WTF7HashSetIPN7WebCore7ElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore7ElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore7ElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore7ElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableE
+__ZN7WebCore8Document31registerForMediaVolumeCallbacksEPNS_7ElementE
+__ZN7WebCore16HTMLMediaElement16attributeChangedEPNS_9AttributeEb
+__ZN7WebCore16HTMLMediaElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore16HTMLAudioElement11tagPriorityEv
+__ZN7WebCore16HTMLMediaElement20insertedIntoDocumentEv
+__ZNK7WebCore16HTMLMediaElement3srcEv
+__ZN7WebCore16HTMLMediaElement12scheduleLoadEv
+__ZN7WebCore16HTMLMediaElement6attachEv
+__ZN7WebCore14RenderThemeMac28extraMediaControlsStyleSheetEv
+__ZN7WebCoreL20mediaControllerThemeEv
+__ZN7WebCore16HTMLMediaElement16rendererIsNeededEPNS_11RenderStyleE
+__ZNK7WebCore16HTMLMediaElement8controlsEv
+__ZN7WebCore16CSSStyleSelector17mapNinePieceImageEPNS_8CSSValueERNS_14NinePieceImageE
+__ZNK7WebCore8CSSValue12isImageValueEv
+__ZNK7WebCore22CSSImageGeneratorValue21isImageGeneratorValueEv
+__ZN7WebCore22CSSImageGeneratorValue14generatedImageEv
+__ZNK7WebCore22CSSImageGeneratorValue11isFixedSizeEv
+__ZN7WebCore17CSSPrimitiveValue14getDoubleValueEt
+__ZN7WebCore16StyleCachedImage9addClientEPNS_12RenderObjectE
+__ZN7WebCore11RenderLayer16createReflectionEv
+__ZN7WebCore13RenderReplicaC1EPNS_4NodeE
+__ZN7WebCore13RenderReplicaC2EPNS_4NodeE
+__ZN7WebCore11RenderLayer21updateReflectionStyleEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE15reserveCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE6shrinkEm
+__ZN7WebCore18StyleTransformDataC1ERKS0_
+__ZN7WebCore18StyleTransformDataC2ERKS0_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EEaSERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE14shrinkCapacityEm
+__ZN7WebCore19StyleGeneratedImage9addClientEPNS_12RenderObjectE
+__ZN7WebCore22CSSImageGeneratorValue9addClientEPNS_12RenderObjectERKNS_7IntSizeE
+__ZN3WTF7HashMapIPN7WebCore12RenderObjectENS1_7IntSizeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS7_IS4_EEE3addERKS3_RKS4_
+__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_NS1_7IntSizeEENS_18PairFirstExtractorIS6_EENS_7PtrHashIS3_EENS_14PairHas
+__ZNK7WebCore13RenderReplica13requiresLayerEv
+__ZNK7WebCore11RenderLayer15reflectionLayerEv
+__ZNK7WebCore9RenderBox13overflowWidthEb
+__ZNK7WebCore9RenderBox14overflowHeightEb
+__ZNK7WebCore11RenderStyle14applyTransformERNS_20TransformationMatrixERKNS_7IntSizeENS0_20ApplyTransformOriginE
+__ZNK7WebCore27TranslateTransformOperation16getOperationTypeEv
+__ZNK7WebCore23ScaleTransformOperation16getOperationTypeEv
+__ZN7WebCore20TransformationMatrix11translate3dEddd
+__ZNK7WebCore27TranslateTransformOperation5applyERNS_20TransformationMatrixERKNS_7IntSizeE
+__ZNK7WebCore23ScaleTransformOperation5applyERNS_20TransformationMatrixERKNS_7IntSizeE
+__ZN7WebCore20TransformationMatrix7scale3dEddd
+__ZN7WebCore20TransformationMatrix8multLeftERKS0_
+__ZN7WebCore20TransformationMatrix10makeAffineEv
+__ZNK7WebCore9RenderBox12overflowRectEb
+__ZNK7WebCore20TransformationMatrix7mapRectERKNS_7IntRectE
+__ZNK7WebCore20TransformationMatrix7mapRectERKNS_9FloatRectE
+__ZNK7WebCore20TransformationMatrix7mapQuadERKNS_9FloatQuadE
+__ZNK7WebCore20TransformationMatrix8mapPointERKNS_10FloatPointE
+__ZNK7WebCore20TransformationMatrix13multVecMatrixEddRdS1_
+__ZNK7WebCore9RenderBox13reflectedRectERKNS_7IntRectE
+__ZNK7WebCore9RenderBox16reflectionOffsetEv
+__ZNK7WebCore12RenderObject22outlineStyleForRepaintEv
+__ZNK7WebCore12RenderObject25getTransformFromContainerEPKS0_RKNS_7IntSizeERNS_20TransformationMatrixE
+__ZN7WebCore20TransformationMatrix9translateEdd
+__ZNK7WebCore11RenderLayer16currentTransformEv
+__ZN7WebCore14TransformState14applyTransformERKNS_20TransformationMatrixENS0_21TransformAccumulationE
+__ZN7WebCore14TransformState20flattenWithTransformERKNS_20TransformationMatrixE
+__ZN7WebCore12RenderObject26repaintAfterLayoutIfNeededEPNS_20RenderBoxModelObjectERKNS_7IntRectES5_
+__ZNK7WebCore12RenderObject29mustRepaintBackgroundOrBorderEv
+__ZN7WebCoreL21mustRepaintFillLayersEPKNS_12RenderObjectEPKNS_9FillLayerE
+__ZN7WebCore12RenderObject29markContainingBlocksForLayoutEbPS0_
+__ZN7WebCoreL16videoConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLVideoElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLVideoElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLVideoElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore16HTMLVideoElement11tagPriorityEv
+__ZN7WebCore16HTMLVideoElement6attachEv
+__ZN7WebCore16HTMLVideoElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore16HTMLVideoElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore11RenderVideoC1EPNS_16HTMLMediaElementE
+__ZN7WebCore11RenderVideoC2EPNS_16HTMLMediaElementE
+__ZN7WebCore11RenderMediaC2EPNS_16HTMLMediaElementE
+__ZN7WebCore14RenderReplacedC2EPNS_4NodeE
+__ZN7WebCore11RenderMedia14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore11RenderMedia15virtualChildrenEv
+__ZN7WebCore11RenderVideo17updateFromElementEv
+__ZN7WebCore11RenderMedia17updateFromElementEv
+__ZN7WebCore11RenderMedia14updateControlsEv
+__ZNK7WebCore11RenderMedia12mediaElementEv
+__ZN7WebCore11RenderVideo12updatePlayerEv
+__ZNK7WebCore11RenderMedia6playerEv
+__ZN7WebCore16HTMLMediaElement8checkDTDEPKNS_4NodeE
+__ZNK7WebCore14RenderReplaced15canHaveChildrenEv
+__ZNK3WTF7HashMapIN7WebCore6StringENS1_20CachedResourceHandleINS1_14CachedResourceEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_
+__ZN3WTF6VectorIN7WebCore9DocLoader14PendingPreloadELm0EE6shrinkEm
+__ZN7WebCore5TimerINS_12CachedScriptEE5firedEv
+__ZN7WebCore12CachedScript29decodedDataDeletionTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore12CachedScript18destroyDecodedDataEv
+__ZNK7WebCore14CachedResource21isSafeToMakePurgeableEv
+__ZN7WebCore16HTMLMediaElement11recalcStyleENS_4Node11StyleChangeE
+__ZNK7WebCore9FillLayer13containsImageEPNS_10StyleImageE
+__ZNK7WebCore16StyleCachedImage4dataEv
+__ZNK7WebCore18StyleTransformDataeqERKS0_
+__ZNK7WebCore27TranslateTransformOperationeqERKNS_18TransformOperationE
+__ZNK7WebCore27TranslateTransformOperation10isSameTypeERKNS_18TransformOperationE
+__ZNK7WebCore23ScaleTransformOperationeqERKNS_18TransformOperationE
+__ZNK7WebCore23ScaleTransformOperation10isSameTypeERKNS_18TransformOperationE
+__ZN7WebCore27TranslateTransformOperationD0Ev
+__ZN7WebCore23ScaleTransformOperationD0Ev
+__ZN7WebCore11RenderBlock29removePercentHeightDescendantEPNS_9RenderBoxE
+__ZNK7WebCore11RenderImage22usesImageContainerSizeEv
+__ZNK7WebCore11CachedImage22usesImageContainerSizeEv
+__ZNK7WebCore11RenderImage20calcAspectRatioWidthEv
+__ZNK7WebCore11RenderImage22imageHasRelativeHeightEv
+__ZNK7WebCore11CachedImage22imageHasRelativeHeightEv
+__ZNK7WebCore11RenderImage21calcAspectRatioHeightEv
+__ZN7WebCore9RenderBox20calcPercentageHeightERKNS_6LengthE
+__ZNK7WebCore9RenderBox13reflectionBoxEv
+__ZN7WebCore11RenderLayer10setStaticYEi
+__ZN7WebCore11RenderBlock19calcBlockPrefWidthsEv
+__ZN7WebCore11RenderVideo6layoutEv
+__ZN7WebCore11RenderMedia6layoutEv
+__ZNK7WebCore14RenderReplaced21minimumReplacedHeightEv
+__ZNK7WebCore11RenderVideo17calcReplacedWidthEb
+__ZNK7WebCore11RenderVideo16isWidthSpecifiedEv
+__ZN7WebCore11RenderVideo14calcPrefWidthsEv
+__ZNK7WebCore11RenderVideo18calcReplacedHeightEv
+__ZNK7WebCore11RenderVideo17isHeightSpecifiedEv
+__ZNK7WebCore11RenderMedia17rightmostPositionEbb
+__ZNK7WebCore11RenderMedia14lowestPositionEbb
+__ZN7WebCore13RenderReplica6layoutEv
+__ZN7WebCore14RenderReplaced29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZNK7WebCore14RenderReplaced12overflowRectEb
+__ZNK7WebCore14RenderReplaced18localSelectionRectEb
+__ZN7WebCore5TimerINS_16HTMLMediaElementEE5firedEv
+__ZN7WebCore16HTMLMediaElement14loadTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore16HTMLMediaElement12loadInternalEv
+__ZN7WebCore16HTMLMediaElement18stopPeriodicTimersEv
+__ZN7WebCore16HTMLMediaElement31cancelPendingEventsAndCallbacksEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5EventEEELm0EE14shrinkCapacityEm
+__ZNK7WebCore16HTMLMediaElement19defaultPlaybackRateEv
+__ZN7WebCore16HTMLMediaElement15setPlaybackRateEf
+__ZN7WebCore16HTMLMediaElement19selectMediaResourceEv
+__ZN7WebCore16HTMLMediaElement21scheduleProgressEventERKNS_12AtomicStringE
+__ZN7WebCore13ProgressEventC1ERKNS_12AtomicStringEbjj
+__ZN7WebCore13ProgressEventC2ERKNS_12AtomicStringEbjj
+__ZN7WebCore16HTMLMediaElement12enqueueEventEN3WTF6RefPtrINS_5EventEEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5EventEEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5EventEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5EventEEELm0EE15reserveCapacityEm
+__ZN7WebCore11ContentTypeC1ERKNS_6StringE
+__ZN7WebCore11ContentTypeC2ERKNS_6StringE
+__ZN7WebCore16HTMLMediaElement15isSafeToLoadURLERKNS_4KURLENS0_19InvalidSourceActionE
+__ZN7WebCore16HTMLMediaElement12loadResourceERKNS_4KURLERNS_11ContentTypeE
+__ZN7WebCore16HTMLMediaElement23startProgressEventTimerEv
+__ZN7WebCore11MediaPlayerC1EPNS_17MediaPlayerClientE
+__ZN7WebCore11MediaPlayerC2EPNS_17MediaPlayerClientE
+__ZN7WebCoreL21createNullMediaPlayerEPNS_11MediaPlayerE
+__ZN7WebCore16HTMLMediaElement12updateVolumeEv
+__ZN7WebCore11MediaPlayer9setVolumeEf
+__ZN7WebCore22NullMediaPlayerPrivate9setVolumeEf
+__ZN7WebCore11MediaPlayer4loadERKNS_6StringERKNS_11ContentTypeE
+__ZNK7WebCore11ContentType4typeEv
+__ZNK7WebCore11ContentType9parameterERKNS_6StringE
+__ZN7WebCore16MIMETypeRegistry18getMIMETypeForPathERKNS_6StringE
+__ZN7WebCore10StringImpl11reverseFindEti
+__ZN7WebCore16MIMETypeRegistry23getMIMETypeForExtensionERKNS_6StringE
+__ZN7WebCoreL32chooseBestEngineForTypeAndCodecsERKNS_6StringES2_
+__ZN7WebCore18MediaPlayerPrivate12supportsTypeERKNS_6StringES3_
+__ZN7WebCoreL20mimeModernTypesCacheEv
+__ZL11initQTMoviev
+__ZN7WebCoreL19addFileTypesToCacheEP7NSArrayRN3WTF7HashSetINS_6StringENS_10StringHashENS2_10HashTraitsIS4_EEEE
+__ZN7WebCore22NullMediaPlayerPrivateD0Ev
+__ZN7WebCore18MediaPlayerPrivate6createEPNS_11MediaPlayerE
+__ZN7WebCore18MediaPlayerPrivateC1EPNS_11MediaPlayerE
+__ZN7WebCore18MediaPlayerPrivateC2EPNS_11MediaPlayerE
+-[WebCoreMovieObserver initWithCallback:]
+__ZN7WebCore18MediaPlayerPrivate4loadERKNS_6StringE
+__ZN7WebCore11MediaPlayer19networkStateChangedEv
+__ZThn112_N7WebCore16HTMLMediaElement30mediaPlayerNetworkStateChangedEPNS_11MediaPlayerE
+__ZN7WebCore16HTMLMediaElement30mediaPlayerNetworkStateChangedEPNS_11MediaPlayerE
+__ZN7WebCore11MediaPlayer12networkStateEv
+__ZNK7WebCore18MediaPlayerPrivate12networkStateEv
+__ZN7WebCore16HTMLMediaElement15setNetworkStateENS_11MediaPlayer12NetworkStateE
+__ZN7WebCore18MediaPlayerPrivate10cancelSeekEv
+-[WebCoreMovieObserver setDelayCallbacks:]
+__ZN7WebCore18MediaPlayerPrivate13createQTMovieERKNS_6StringE
+__ZL32initQTMovieApertureModeAttributev
+__ZL28initQTMovieApertureModeCleanv
+__ZL41initQTMovieAskUnresolvedDataRefsAttributev
+__ZL40initQTSecurityPolicyNoCrossSiteAttributev
+__ZL43initQTMoviePreventExternalURLLinksAttributev
+__ZL23initQTMovieURLAttributev
+__ZL15QTMovieFunctionv
+__ZNK7WebCore11MediaPlayer6volumeEv
+__ZL41initQTMovieLoadStateDidChangeNotificationv
+__ZL36initQTMovieRateDidChangeNotificationv
+__ZL36initQTMovieSizeDidChangeNotificationv
+__ZL36initQTMovieTimeDidChangeNotificationv
+__ZL29initQTMovieDidEndNotificationv
+-[WebCoreMovieObserver loadStateChanged:]
+__ZNK7WebCore11RenderVideo8videoBoxEv
+__ZN7WebCore11MediaPlayer7setSizeERKNS_7IntSizeE
+__ZN7WebCore22NullMediaPlayerPrivate7setSizeERKNS_7IntSizeE
+__ZN7WebCore11MediaPlayer10setVisibleEb
+__ZN7WebCore22NullMediaPlayerPrivate10setVisibleEb
+__ZL36QTMovieApertureModeAttributeFunctionv
+__ZL32QTMovieApertureModeCleanFunctionv
+__ZL45QTMovieAskUnresolvedDataRefsAttributeFunctionv
+__ZL44QTSecurityPolicyNoCrossSiteAttributeFunctionv
+__ZL47QTMoviePreventExternalURLLinksAttributeFunctionv
+__ZL27QTMovieURLAttributeFunctionv
+__ZL45QTMovieLoadStateDidChangeNotificationFunctionv
+__ZL40QTMovieRateDidChangeNotificationFunctionv
+__ZL40QTMovieSizeDidChangeNotificationFunctionv
+__ZL40QTMovieTimeDidChangeNotificationFunctionv
+__ZL33QTMovieDidEndNotificationFunctionv
+__ZN7WebCore18MediaPlayerPrivate7setSizeERKNS_7IntSizeE
+__ZN7WebCore18MediaPlayerPrivate10setVisibleEb
+__ZNK7WebCore20TransformationMatrix12isInvertibleEv
+__ZN7WebCoreL14determinant4x4ERA4_A4_Kd
+__ZN7WebCoreL14determinant3x3Eddddddddd
+__ZN7WebCoreL14determinant2x2Edddd
+__ZN7WebCore11RenderLayer23beginTransparencyLayersEPNS_15GraphicsContextEPKS0_
+__ZN7WebCore11RenderLayer27transparentPaintingAncestorEv
+__ZN7WebCore15GraphicsContext9concatCTMERKNS_20TransformationMatrixE
+__ZNK7WebCore20TransformationMatrixcv17CGAffineTransformEv
+__ZNK7WebCore20TransformationMatrix7inverseEv
+__ZN7WebCoreL7inverseERA4_A4_KdRA4_A4_d
+__ZN7WebCoreL19transparencyClipBoxERKNS_20TransformationMatrixEPKNS_11RenderLayerES5_
+__ZN7WebCore9RenderBox12maskClipRectEv
+__ZN7WebCore15GraphicsContext22beginTransparencyLayerEf
+__ZN7WebCore13RenderReplica5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore9RenderBox9paintMaskERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore9RenderBox15borderFitAdjustERiS1_
+__ZN7WebCore9RenderBox15paintMaskImagesERKNS_12RenderObject9PaintInfoEiiiiii
+__ZNK7WebCore10StyleImage8isLoadedEv
+__ZNK7WebCore10StyleImage9canRenderEf
+__ZN7WebCore19StyleGeneratedImage21setImageContainerSizeERKNS_7IntSizeE
+__ZNK7WebCore19StyleGeneratedImage9imageSizeEPKNS_12RenderObjectEf
+__ZNK7WebCore19StyleGeneratedImage5imageEPNS_12RenderObjectERKNS_7IntSizeE
+__ZN7WebCore16CSSGradientValue5imageEPNS_12RenderObjectERKNS_7IntSizeE
+__ZN7WebCore22CSSImageGeneratorValue8getImageEPNS_12RenderObjectERKNS_7IntSizeE
+__ZNK3WTF7HashMapIPN7WebCore12RenderObjectENS1_7IntSizeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS7_IS4_EEE3getERKS3_
+__ZN7WebCore22CSSImageGeneratorValue12removeClientEPNS_12RenderObjectE
+__ZN3WTF7HashMapIN7WebCore7IntSizeEjNS_7IntHashIS2_EENS_10HashTraitsIS2_EENS5_IjEEE3addERKS2_RKj
+__ZN3WTF9HashTableIN7WebCore7IntSizeESt4pairIS2_jENS_18PairFirstExtractorIS4_EENS_7IntHashIS2_EENS_14PairHashTraitsINS_10HashTr
+__ZNK3WTF7HashMapIN7WebCore7IntSizeENS_6RefPtrINS1_5ImageEEENS_7IntHashIS2_EENS_10HashTraitsIS2_EENS8_IS5_EEE3getERKS2_
+__ZN7WebCore16CSSGradientValue14createGradientEPNS_12RenderObjectERKNS_7IntSizeE
+__ZN7WebCore16CSSGradientValue12resolvePointEPNS_17CSSPrimitiveValueES2_RKNS_7IntSizeEf
+__ZN7WebCore8GradientC1ERKNS_10FloatPointES3_
+__ZN7WebCore8GradientC2ERKNS_10FloatPointES3_
+__ZN7WebCore16CSSGradientValue17sortStopsIfNeededEv
+__ZNSt17_Temporary_bufferIPN7WebCore20CSSGradientColorStopES1_EC1ES2_S2_
+__ZNSt17_Temporary_bufferIPN7WebCore20CSSGradientColorStopES1_EC2ES2_S2_
+__ZSt22__get_temporary_bufferIN7WebCore20CSSGradientColorStopEESt4pairIPT_lElS4_
+__ZSt26__uninitialized_fill_n_auxIPN7WebCore20CSSGradientColorStopElS1_EvT_T0_RKT1_St12__false_type
+__ZSt22__stable_sort_adaptiveIPN7WebCore20CSSGradientColorStopES2_lPFbRKS1_S4_EEvT_S7_T0_T1_T2_
+__ZSt24__merge_sort_with_bufferIPN7WebCore20CSSGradientColorStopES2_PFbRKS1_S4_EEvT_S7_T0_T1_
+__ZSt22__chunk_insertion_sortIPN7WebCore20CSSGradientColorStopElPFbRKS1_S4_EEvT_S7_T0_T1_
+__ZSt16__insertion_sortIPN7WebCore20CSSGradientColorStopEPFbRKS1_S4_EEvT_S7_T0_
+__ZN7WebCoreL12compareStopsERKNS_20CSSGradientColorStopES2_
+__ZSt25__unguarded_linear_insertIPN7WebCore20CSSGradientColorStopES1_PFbRKS1_S4_EEvT_T0_T1_
+__ZSt16__merge_adaptiveIPN7WebCore20CSSGradientColorStopElS2_PFbRKS1_S4_EEvT_S7_S7_T0_S8_T1_S8_T2_
+__ZSt16__merge_backwardIPN7WebCore20CSSGradientColorStopES2_S2_PFbRKS1_S4_EET1_T_S8_T0_S9_S7_T2_
+__ZSt23return_temporary_bufferIN7WebCore20CSSGradientColorStopEEvPT_
+__ZN7WebCore8Gradient12addColorStopEfRKNS_5ColorE
+__ZNK7WebCore5Color7getRGBAERfS1_S1_S1_
+__ZN3WTF6VectorIN7WebCore8Gradient9ColorStopELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN7WebCore8Gradient9ColorStopELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore8Gradient9ColorStopELm0EE15reserveCapacityEm
+__ZN7WebCore8Gradient15platformDestroyEv
+__ZN7WebCore22CSSImageGeneratorValue8putImageERKNS_7IntSizeEN3WTF10PassRefPtrINS_5ImageEEE
+__ZN3WTF7HashMapIN7WebCore7IntSizeENS_6RefPtrINS1_5ImageEEENS_7IntHashIS2_EENS_10HashTraitsIS2_EENS8_IS5_EEE3addERKS2_RKS5_
+__ZN7WebCore15GraphicsContext14drawTiledImageEPNS_5ImageERKNS_7IntRectES5_NS1_8TileRuleES6_NS_17CompositeOperatorE
+__ZN7WebCore14GeneratedImage4drawEPNS_15GraphicsContextERKNS_9FloatRectES5_NS_17CompositeOperatorE
+__ZN7WebCore15GraphicsContext9translateEff
+__ZN7WebCore15GraphicsContext8fillRectERKNS_9FloatRectERNS_9GeneratorE
+__ZN7WebCore8Gradient4fillEPNS_15GraphicsContextERKNS_9FloatRectE
+__ZN7WebCore8Gradient16platformGradientEv
+__ZNK7WebCore10FloatPointcv7CGPointEv
+__ZN7WebCoreL16gradientCallbackEPvPKdPd
+__ZNK7WebCore8Gradient8getColorEfPfS1_S1_S1_
+__ZNK7WebCore8Gradient8findStopEf
+__ZN7WebCore15GraphicsContext20endTransparencyLayerEv
+__ZN7WebCore9RenderBox12imageChangedEPvPKNS_7IntRectE
+__ZN7WebCore9RenderBox25repaintLayerRectsForImageEPvPKNS_9FillLayerEb
+__ZNK7WebCore16StyleCachedImage9canRenderEf
+__ZN7WebCore20RenderBoxModelObject32calculateBackgroundImageGeometryEPKNS_9FillLayerEiiiiRNS_7IntRectERNS_8IntPointERNS_7IntSiz
+__ZNK7WebCore20RenderBoxModelObject23calculateBackgroundSizeEPKNS_9FillLayerEii
+__ZN7WebCore16StyleCachedImage21setImageContainerSizeERKNS_7IntSizeE
+__ZN7WebCore11CachedImage21setImageContainerSizeERKNS_7IntSizeE
+__ZN7WebCore5Image16setContainerSizeERKNS_7IntSizeE
+__ZNK7WebCore16StyleCachedImage9imageSizeEPKNS_12RenderObjectEf
+__ZN7WebCore12RenderObject12imageChangedEPvPKNS_7IntRectE
+__ZN7WebCore14ResourceHandle15willSendRequestERNS_15ResourceRequestERKNS_16ResourceResponseE
+__ZN7WebCore14ResourceLoader15willSendRequestEPNS_14ResourceHandleERNS_15ResourceRequestERKNS_16ResourceResponseE
+__ZN7WebCore27protocolHostAndPortAreEqualERKNS_4KURLES2_
+__ZN7WebCore23SubresourceLoaderClient15willSendRequestEPNS_17SubresourceLoaderERNS_15ResourceRequestERKNS_16ResourceResponseE
+__ZN7WebCore18MediaPlayerPrivate16loadStateChangedEv
+__ZN7WebCore18MediaPlayerPrivate12updateStatesEv
+__ZL29initQTMovieLoadStateAttributev
+__ZNK7WebCore18MediaPlayerPrivate7seekingEv
+__ZL33QTMovieLoadStateAttributeFunctionv
+__ZN7WebCore16HTMLMediaElement20asyncEventTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore16HTMLMediaElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore13ProgressEventD0Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5EventEEELm0EE6shrinkEm
+__ZNK7WebCore11RenderMedia7isMediaEv
+__ZN7WebCore11RenderMedia12forwardEventEPNS_5EventE
+__ZNK7WebCore5Image17usesContainerSizeEv
+__ZNK7WebCore9RenderBox18calcReplacedHeightEv
+__ZNK7WebCore5Image17hasRelativeHeightEv
+__ZNK7WebCore9RenderBox17calcReplacedWidthEb
+__ZN7WebCore14PreloadScannerD1Ev
+__ZN7WebCore14PreloadScannerD2Ev
+__ZN7WebCore4KURL11setProtocolERKNS_6StringE
+__ZN7WebCore4KURL7setHostERKNS_6StringE
+__ZN7WebCore4KURL7setPathERKNS_6StringE
+__ZN7WebCore28encodeWithURLEscapeSequencesERKNS_6StringE
+__ZNK7WebCore6String4utf8Ev
+__ZN7WebCore10IconLoader6createEPNS_5FrameE
+__ZN7WebCore10IconLoaderC1EPNS_5FrameE
+__ZN7WebCore10IconLoaderC2EPNS_5FrameE
+__ZN7WebCore10IconLoader12startLoadingEv
+__ZN7WebCore20jsNavigatorUserAgentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9Navigator9userAgentEv
+__ZNK7WebCore11FrameLoader9userAgentERKNS_4KURLE
+__ZN7WebCoreL29createHTMLAudioElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLAudioElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSHTMLMediaElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLMediaElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLAudioElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLAudioElementEEE
+__ZN7WebCore18JSHTMLAudioElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLAudioElementEEE
+__ZN7WebCore18JSHTMLMediaElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLMediaElementEEE
+__ZN7WebCoreL29createHTMLVideoElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLVideoElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLVideoElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLVideoElementEEE
+__ZN7WebCore18JSHTMLVideoElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLVideoElementEEE
+__ZN7WebCore18JSHTMLAudioElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSHTMLMediaElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSHTMLMediaElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore15JSNodePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsNodePrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore18JSHTMLAudioElement9classInfoEv
+__ZN7WebCore6JSNode16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore4Node22scriptExecutionContextEv
+__ZN7WebCore19toJSDOMGlobalObjectEPNS_22ScriptExecutionContextE
+__ZN7WebCore13toJSDOMWindowEPNS_5FrameE
+__ZN7WebCore47jsDocumentPrototypeFunctionGetElementsByTagNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8NodeListE
+__ZN7WebCore10JSNodeList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSNodeListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8NodeListEEE
+__ZN7WebCore10JSNodeListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8NodeListEEE
+__ZN7WebCore10JSNodeList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsNodeListLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSNodeList18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore10JSNodeList11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore21jsHTMLMediaElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsHTMLMediaElementPrototypeFunctionLoadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16HTMLMediaElement4loadERi
+__ZN7WebCore11MediaPlayer15totalBytesKnownEv
+__ZNK7WebCore18MediaPlayerPrivate15totalBytesKnownEv
+__ZNK7WebCore18MediaPlayerPrivate10totalBytesEv
+__ZN7WebCore11MediaPlayer11bytesLoadedEv
+__ZNK7WebCore18MediaPlayerPrivate11bytesLoadedEv
+__ZNK7WebCore18MediaPlayerPrivate8durationEv
+__ZN7WebCore11MediaPlayer10totalBytesEv
+__ZN7WebCore4Node21dispatchProgressEventERKNS_12AtomicStringEbjj
+__ZNK7WebCore16HTMLMediaElement18potentiallyPlayingEv
+__ZNK7WebCore16HTMLMediaElement6pausedEv
+__ZN7WebCore11MediaPlayer5pauseEv
+__ZN7WebCore18MediaPlayerPrivate5pauseEv
+__ZN7WebCore11MediaPlayer4seekEf
+__ZN7WebCore18MediaPlayerPrivate4seekEf
+__ZN7WebCore11MediaPlayerD0Ev
+__ZN7WebCore18MediaPlayerPrivateD0Ev
+__ZN7WebCore18MediaPlayerPrivate22tearDownVideoRenderingEv
+__ZN7WebCore18MediaPlayerPrivate22destroyQTVideoRendererEv
+-[WebCoreMovieObserver disconnect]
+__ZN7WebCore15setDOMExceptionEPN3JSC9ExecStateEi
+__ZN7WebCore18JSHTMLVideoElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSHTMLVideoElement9classInfoEv
+__ZN7WebCore21jsDocumentStyleSheetsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document11styleSheetsEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14StyleSheetListE
+__ZN7WebCore16JSStyleSheetList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSStyleSheetListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14StyleSheetListEEE
+__ZN7WebCore16JSStyleSheetListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14StyleSheetListEEE
+__ZN7WebCore16JSStyleSheetList18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore16JSStyleSheetList11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10StyleSheetE
+__ZN7WebCore15JSCSSStyleSheet15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSStyleSheetPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSStyleSheet15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSCSSStyleSheetC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CSSStyleSheetEEE
+__ZN7WebCore15JSCSSStyleSheetC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CSSStyleSheetEEE
+__ZN7WebCore12JSStyleSheetC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10StyleSheetEEE
+__ZN7WebCore15JSCSSStyleSheet18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20jsCSSStyleSheetRulesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13CSSStyleSheet8cssRulesEb
+__ZN7WebCore11CSSRuleListC1EPNS_9StyleListEb
+__ZN7WebCore11CSSRuleListC2EPNS_9StyleListEb
+__ZN7WebCore7CSSRule6isRuleEv
+__ZN7WebCore9StyleBase13isCharsetRuleEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_11CSSRuleListE
+__ZN7WebCore13JSCSSRuleList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSCSSRuleListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11CSSRuleListEEE
+__ZN7WebCore13JSCSSRuleListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11CSSRuleListEEE
+__ZN7WebCore13JSCSSRuleList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19jsCSSRuleListLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11CSSRuleList6lengthEv
+__ZN7WebCore13JSCSSRuleList18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore13JSCSSRuleList11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore11CSSRuleList4itemEj
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_7CSSRuleE
+__ZNK7WebCore12CSSStyleRule4typeEv
+__ZN7WebCore14JSCSSStyleRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSCSSRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSCSSRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSCSSStyleRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CSSStyleRuleEEE
+__ZN7WebCore14JSCSSStyleRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CSSStyleRuleEEE
+__ZN7WebCore9JSCSSRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7CSSRuleEEE
+__ZN7WebCore14JSCSSStyleRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore9JSCSSRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsCSSRuleCssTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12CSSStyleRule7cssTextEv
+__ZNK7WebCore12CSSStyleRule12selectorTextEv
+__ZNK7WebCore11CSSSelector12selectorTextEv
+__ZNK7WebCore26CSSMutableStyleDeclaration7cssTextEv
+__ZNK7WebCore11CSSProperty7cssTextEv
+__Z15getPropertyName13CSSPropertyID
+__ZNK7WebCore15CSSInitialValue7cssTextEv
+__ZN7WebCore14jsStringOrNullEPN3JSC9ExecStateERKNS_6StringE
+__ZNK7WebCore9FontValue7cssTextEv
+__ZNK7WebCore12CSSValueList7cssTextEv
+__ZNK7WebCore15FontFamilyValue7cssTextEv
+__ZN7WebCore10StringImpl7replaceEtPS0_
+__ZN7WebCore27jsDOMWindowImageConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15JSDOMWindowBase16allowsAccessFromEPN3JSC9ExecStateE
+__ZNK7WebCore11JSDOMWindow5imageEPN3JSC9ExecStateE
+__ZNK3WTF7HashMapIPKN3JSC9ClassInfoEPNS1_8JSObjectENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getERKS4_
+__ZN7WebCore18JSImageConstructorC1EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore18JSImageConstructorC2EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore27JSHTMLImageElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLImageElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN3WTF7HashMapIPKN3JSC9ClassInfoEPNS1_8JSObjectENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3setERKS4_RKS6_
+__ZN3WTF9HashTableIPKN3JSC9ClassInfoESt4pairIS4_PNS1_8JSObjectEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHashTrai
+__ZN7WebCore18JSImageConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCoreL14constructImageEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZNK7WebCore18JSImageConstructor8documentEv
+__ZN7WebCoreL29createHTMLImageElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLImageElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLImageElementEEE
+__ZN7WebCore18JSHTMLImageElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLImageElementEEE
+__ZN7WebCore18JSHTMLImageElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSHTMLImageElement9classInfoEv
+__ZN7WebCore18JSHTMLImageElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore24setJSHTMLImageElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement6setSrcERKNS_6StringE
+__ZN7WebCore7Element12setAttributeERKNS_13QualifiedNameERKNS_12AtomicStringE
+__ZN7WebCore7Element12setAttributeERKNS_13QualifiedNameERKNS_12AtomicStringERi
+__ZNK7WebCore13StyledElement18createAttributeMapEv
+__ZN7WebCore13StyledElement15createAttributeERKNS_13QualifiedNameERKNS_12AtomicStringE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AttributeEEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AttributeEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AttributeEEELm0EE15reserveCapacityEm
+__ZNK7WebCore14CachedResource9isExpiredEv
+__ZNK7WebCore20ResourceResponseBase27parseCacheControlDirectivesEv
+__ZN7WebCoreL16parseCacheHeaderERKNS_6StringERN3WTF6VectorISt4pairIS0_S0_ELm0EEE
+__ZNK7WebCore6String16removeCharactersEPFbtE
+__ZN7WebCore10StringImpl16removeCharactersEPFbtE
+__ZN7WebCoreL18isControlCharacterEt
+__ZN7WebCore10StringImpl4findEPFbtEi
+__ZN7WebCoreL22isCacheHeaderSeparatorEt
+__ZN3WTF6VectorISt4pairIN7WebCore6StringES3_ELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorISt4pairIN7WebCore6StringES3_ELm0EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIN7WebCore6StringES3_ELm0EE15reserveCapacityEm
+__ZN3WTF6VectorISt4pairIN7WebCore6StringES3_ELm0EE6shrinkEm
+__ZN7WebCore7Element25dispatchAttrAdditionEventEPNS_9AttributeE
+__ZNK7WebCore15CSSReflectValue7cssTextEv
+__ZNK7WebCore19CSSBorderImageValue7cssTextEv
+__ZNK7WebCore16CSSGradientValue7cssTextEv
+__ZNK7WebCore22WebKitCSSKeyframesRule4typeEv
+__ZN7WebCore24JSWebKitCSSKeyframesRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSWebKitCSSKeyframesRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22WebKitCSSKeyframesRuleEEE
+__ZN7WebCore24JSWebKitCSSKeyframesRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22WebKitCSSKeyframesRuleEEE
+__ZN7WebCore24JSWebKitCSSKeyframesRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore22WebKitCSSKeyframesRule7cssTextEv
+__ZNK7WebCore21WebKitCSSKeyframeRule7cssTextEv
+__ZNK7WebCore23WebKitCSSTransformValue7cssTextEv
+__ZN7WebCoreL19quoteStringIfNeededERKNS_6StringE
+__ZN7WebCore11LayoutStatenwEmPNS_11RenderArenaE
+__ZN7WebCore11LayoutStateC1EPS0_PNS_9RenderBoxERKNS_7IntSizeE
+__ZN7WebCore11LayoutStateC2EPS0_PNS_9RenderBoxERKNS_7IntSizeE
+__ZN7WebCore9InlineBox14dirtyLineBoxesEv
+__ZN7WebCore11RenderBlock20determineEndPositionEPNS_13RootInlineBoxERNS_14InlineIteratorERNS_10BidiStatusERi
+__ZN7WebCore13InlineFlowBox10deleteLineEPNS_11RenderArenaE
+__ZN7WebCore9InlineBox10deleteLineEPNS_11RenderArenaE
+__ZN7WebCore9InlineBoxD0Ev
+__ZN7WebCore13RootInlineBox29removeLineBoxFromRenderObjectEv
+__ZN7WebCore17RenderLineBoxList13removeLineBoxEPNS_13InlineFlowBoxE
+__ZN7WebCore13RootInlineBox8Overflow7destroyEPNS_11RenderArenaE
+__ZN7WebCore13RootInlineBox8OverflowdlEPvm
+__ZN7WebCore11LayoutState7destroyEPNS_11RenderArenaE
+__ZN7WebCore11LayoutStatedlEPvm
+__ZN7WebCore9ClipRects7destroyEPNS_11RenderArenaE
+__ZN7WebCore9ClipRectsdlEPvm
+__ZN7WebCore11ImageSource20frameDurationAtIndexEm
+__ZN7WebCore10IconLoader18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
+__ZN7WebCore10IconLoader14didReceiveDataEPNS_17SubresourceLoaderEPKci
+__ZN7WebCore10IconLoader16didFinishLoadingEPNS_17SubresourceLoaderE
+__ZNK7WebCore14ResourceHandle7requestEv
+__ZN7WebCore10IconLoader13finishLoadingERKNS_4KURLEN3WTF10PassRefPtrINS_12SharedBufferEEE
+__ZNK7WebCore13PageURLRecord8snapshotEb
+__ZN3WTF7HashMapIN7WebCore6StringENS1_15PageURLSnapshotENS1_10StringHashENS_10HashTraitsIS2_EENS5_IS3_EEE3setERKS2_RKS3_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_15PageURLSnapshotEENS_18PairFirstExtractorIS5_EENS1_10StringHashENS_14PairHa
+__ZN7WebCore12IconDatabase24scheduleOrDeferSyncTimerEv
+__ZN7WebCore12IconDatabase21setIconDataForIconURLEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_6StringE
+__ZNK7WebCore12SharedBuffer4copyEv
+__ZN3WTF6VectorIN7WebCore6StringELm0EE11appendRangeINS_29HashTableConstIteratorAdapterINS_9HashTableIS2_S2_NS_17IdentityExtract
+__ZNK7WebCore10IconRecord8snapshotEb
+__ZN3WTF7HashMapIN7WebCore6StringENS1_12IconSnapshotENS1_10StringHashENS_10HashTraitsIS2_EENS5_IS3_EEE3setERKS2_RKS3_
+__ZN7WebCore10IconLoader17clearLoadingStateEv
+__ZN7WebCore12SharedBufferD1Ev
+__ZN7WebCore12SharedBufferD2Ev
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_11EventTargetE
+__ZN7WebCore11EventTarget20toSVGElementInstanceEv
+__ZN7WebCore18MediaPlayerPrivate24disableUnsupportedTracksEv
+__ZL20initQTMediaTypeVideov
+__ZL20initQTMediaTypeSoundv
+__ZL19initQTMediaTypeTextv
+__ZL19initQTMediaTypeBasev
+__ZL19initQTMediaTypeMPEGv
+__ZL29initQTTrackMediaTypeAttributev
+__ZN7WebCore11MediaPlayer15inMediaDocumentEv
+__ZN7WebCore18MediaPlayerPrivate15cacheMovieScaleEv
+__ZL31initQTMovieNaturalSizeAttributev
+__ZNK7WebCore18MediaPlayerPrivate11currentTimeEv
+__ZNK7WebCore18MediaPlayerPrivate13maxTimeLoadedEv
+__ZN7WebCore11MediaPlayer17readyStateChangedEv
+__ZThn112_N7WebCore16HTMLMediaElement28mediaPlayerReadyStateChangedEPNS_11MediaPlayerE
+__ZN7WebCore16HTMLMediaElement28mediaPlayerReadyStateChangedEPNS_11MediaPlayerE
+__ZN7WebCore11MediaPlayer10readyStateEv
+__ZNK7WebCore18MediaPlayerPrivate10readyStateEv
+__ZN7WebCore16HTMLMediaElement13setReadyStateENS_11MediaPlayer10ReadyStateE
+__ZN7WebCore16HTMLMediaElement13scheduleEventERKNS_12AtomicStringE
+__ZN7WebCore11RenderVideo16videoSizeChangedEv
+__ZN7WebCore11MediaPlayer11naturalSizeEv
+__ZNK7WebCore18MediaPlayerPrivate11naturalSizeEv
+__ZL35QTMovieNaturalSizeAttributeFunctionv
+__ZN7WebCore18MediaPlayerPrivate6doSeekEv
+__ZNK7WebCore18MediaPlayerPrivate12createQTTimeEf
+__ZL29initQTMovieTimeScaleAttributev
+__ZL14initQTMakeTimexl
+__ZN7WebCore16HTMLMediaElement15updatePlayStateEv
+__ZNK7WebCore11MediaPlayer6pausedEv
+__ZNK7WebCore18MediaPlayerPrivate6pausedEv
+__ZNK7WebCore11MediaPlayer7visibleEv
+__ZN7WebCore18MediaPlayerPrivate19setUpVideoRenderingEv
+__ZN7WebCoreL20QTVideoRendererClassEv
+__ZN7WebCore18MediaPlayerPrivate21createQTVideoRendererEv
+__ZL58initQTVideoRendererWebKitOnlyNewImageAvailableNotificationv
+-[WebCoreMovieObserver timeChanged:]
+__ZN7WebCore18MediaPlayerPrivate11timeChangedEv
+__ZNK7WebCore16HTMLMediaElement8autoplayEv
+__ZNK7WebCore16HTMLVideoElement7isVideoEv
+__ZN7WebCore16HTMLVideoElement17updatePosterImageEv
+__ZNK7WebCore16HTMLVideoElement6posterEv
+__ZL28initQTMovieDataSizeAttributev
+__ZL32QTMovieDataSizeAttributeFunctionv
+__ZN7WebCore11MediaPlayer11timeChangedEv
+__ZThn112_N7WebCore16HTMLMediaElement22mediaPlayerTimeChangedEPNS_11MediaPlayerE
+__ZN7WebCore16HTMLMediaElement22mediaPlayerTimeChangedEPNS_11MediaPlayerE
+__ZNK7WebCore16HTMLMediaElement11currentTimeEv
+__ZNK7WebCore11MediaPlayer11currentTimeEv
+__ZNK7WebCore16HTMLMediaElement8durationEv
+__ZNK7WebCore11MediaPlayer8durationEv
+__ZN7WebCore16HTMLMediaElement23progressEventTimerFiredEPNS_5TimerIS0_EE
+__ZNK7WebCore13ProgressEvent15isProgressEventEv
+__ZNK7WebCore5Event29isXMLHttpRequestProgressEventEv
+__ZN7WebCore15JSProgressEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSProgressEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13ProgressEventEEE
+__ZN7WebCore15JSProgressEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13ProgressEventEEE
+__ZNK7WebCore10RenderText16linesBoundingBoxEv
+__ZNK7WebCore8Position14inRenderedTextEv
+__ZNK7WebCore13InlineTextBox19containsCaretOffsetEi
+__ZNK7WebCore13InlineTextBox14caretMinOffsetEv
+__ZNK7WebCore13InlineTextBox14caretMaxOffsetEv
+__ZNK7WebCore10RenderText14caretMinOffsetEv
+-[WebCoreMovieObserver newImageAvailable:]
+-[WebCoreMovieObserver repaint]
+__ZN7WebCore18MediaPlayerPrivate7repaintEv
+__ZN7WebCore11MediaPlayer7repaintEv
+__ZThn112_N7WebCore16HTMLMediaElement18mediaPlayerRepaintEPNS_11MediaPlayerE
+__ZN7WebCore16HTMLMediaElement18mediaPlayerRepaintEPNS_11MediaPlayerE
+__ZN7WebCore12EventHandler10mouseMovedEP7NSEvent
+__ZN7WebCoreL12currentEventEv
+__ZN7WebCore18PlatformMouseEventC1EP7NSEvent
+__ZN7WebCore18PlatformMouseEventC2EP7NSEvent
+__ZN7WebCore13pointForEventEP7NSEvent
+__ZN7WebCore8IntPointC1ERK7CGPoint
+__ZN7WebCore8IntPointC2ERK7CGPoint
+__ZN7WebCore19globalPointForEventEP7NSEvent
+__ZN7WebCore11globalPointERK7CGPointP8NSWindow
+__ZN7WebCore15screenForWindowEP8NSWindow
+__ZN7WebCore15flipScreenPointERK7CGPointP8NSScreen
+__ZN7WebCore12EventHandler10mouseMovedERKNS_18PlatformMouseEventE
+__ZN7WebCore13HitTestResultC1ERKNS_8IntPointE
+__ZN7WebCore13HitTestResultC2ERKNS_8IntPointE
+__ZN7WebCore12EventHandler20handleMouseMoveEventERKNS_18PlatformMouseEventEPNS_13HitTestResultE
+__ZN7WebCore12EventHandler17prepareMouseEventERKNS_14HitTestRequestERKNS_18PlatformMouseEventE
+__ZN7WebCoreL27documentPointForWindowPointEPNS_5FrameERKNS_8IntPointE
+__ZNK7WebCore10ScrollView16windowToContentsERKNS_8IntPointE
+__ZNK7WebCore6Widget27convertFromContainingWindowERKNS_8IntPointE
 __ZNK7WebCore8IntPointcv7CGPointEv
-__ZN7WebCore20executeInsertNewlineEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore11targetFrameEPNS_5FrameEPNS_5EventE
-__ZNK7WebCore6Editor13canEditRichlyEv
-__ZNK7WebCore4Node23isContentRichlyEditableEv
-__ZNK7WebCore17RenderTextControl8isEditedEv
-__ZN7WebCore22HTMLGenericFormElement8onChangeEv
-__ZN7WebCore17RenderTextControl9setEditedEb
-__ZN7WebCore15HTMLFormElement11submitClickEPNS_5EventE
-__ZNK7WebCore16HTMLInputElement24isSuccessfulSubmitButtonEv
-__ZN7WebCore15EventTargetNode22dispatchSimulatedClickEN3WTF10PassRefPtrINS_5EventEEEbb
-__ZN7WebCore15EventTargetNode27dispatchSimulatedMouseEventERKNS_12AtomicStringEN3WTF10PassRefPtrINS_5EventEEE
-__ZNK7WebCore10MouseEvent12isMouseEventEv
-__ZN7WebCore21JSMouseEventPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore12JSMouseEventC1EPN3KJS8JSObjectEPNS_10MouseEventE
-__ZN7WebCore12JSMouseEvent18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore7JSEventEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore7JSEvent16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore21createTableRowWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore30JSHTMLTableRowElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore21JSHTMLTableRowElementC1EPN3KJS8JSObjectEPNS_19HTMLTableRowElementE
-__ZN7WebCore21JSHTMLTableRowElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25createTableSectionWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore34JSHTMLTableSectionElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore25JSHTMLTableSectionElementC1EPN3KJS8JSObjectEPNS_23HTMLTableSectionElementE
-__ZN7WebCore25JSHTMLTableSectionElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17createHtmlWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore26JSHTMLHtmlElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLHtmlElementC1EPN3KJS8JSObjectEPNS_15HTMLHtmlElementE
-__ZN7WebCore17JSHTMLHtmlElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore22JSHTMLTableCellElement9classInfoEv
-__ZN7WebCore30JSHTMLTableRowElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore21JSHTMLTableRowElement9classInfoEv
-__ZN7WebCore34JSHTMLTableSectionElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore25JSHTMLTableSectionElement9classInfoEv
-__ZN7WebCore27JSHTMLTableElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSHTMLTableElement9classInfoEv
-__ZNK7WebCore17JSHTMLHtmlElement9classInfoEv
-__ZNK7WebCore7UIEvent9isUIEventEv
-__ZN7WebCore15HTMLFormElement13prepareSubmitEPNS_5EventE
-__ZNK7WebCore12AtomicStringcvN3KJS7UStringEEv
-__ZN7WebCore19JSHTMLSelectElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore19JSHTMLSelectElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSHTMLSelectElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore16HTMLInputElement7setTypeERKNS_6StringE
-__ZN7WebCore22HTMLGenericFormElement7setNameERKNS_12AtomicStringE
-__ZN7WebCore15HTMLFormElement6submitEPNS_5EventEb
-__ZN7WebCore11FrameLoader23clearRecordedFormValuesEv
-__ZNK7WebCore16HTMLInputElement17isActivatedSubmitEv
-__ZN7WebCore11FrameLoader15recordFormValueERKNS_6StringES3_N3WTF10PassRefPtrINS_15HTMLFormElementEEE
-__ZNK3WTF7HashMapIN7WebCore6StringES2_NS1_10StringHashENS_10HashTraitsIS2_EES5_E3getERKS2_
-__ZNK7WebCore22HTMLGenericFormElement17isActivatedSubmitEv
-__ZNK7WebCore22HTMLGenericFormElement24isSuccessfulSubmitButtonEv
-__ZNK7WebCore15HTMLFormElement8formDataEPKc
-__ZN7WebCore17DeprecatedCStringC2EPKc
-__ZNK7WebCore15HTMLFormElement12dataEncodingEv
-__ZNK7WebCore15HTMLFormElement12isMailtoFormEv
-__ZN7WebCore12FormDataListC2ERKNS_12TextEncodingE
-__ZN7WebCore16HTMLInputElement14appendFormDataERNS_12FormDataListEb
-__ZN7WebCore12FormDataList12appendStringERKNS_6StringE
-__ZN3WTF6VectorIN7WebCore16FormDataListItemELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore16FormDataListItemELm0EE15reserveCapacityEm
-__ZNK7WebCore17DeprecatedCString7isEmptyEv
-__ZN7WebCoreeqERKNS_7CStringES2_
-__ZN7WebCore13encodeCStringERKNS_7CStringE
-__ZNK7WebCore17DeprecatedCString8containsEcb
-__ZN7WebCore17DeprecatedCStringC2Ei
-__ZN7WebCore17DeprecatedCString8truncateEj
-__ZN7WebCore17DeprecatedCString6appendEPKc
-__ZN7WebCore9ArrayImpl6detachEv
-__ZN3WTF6VectorIN7WebCore16FormDataListItemELm0EE6shrinkEm
-__ZN7WebCore17DeprecatedCString6appendEc
-__ZN7WebCore8FormData10appendDataEPKvm
-__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIcLm0EEC2ERKS1_
-__ZN7WebCore11FrameLoader10submitFormEPKcRKNS_6StringEN3WTF10PassRefPtrINS_8FormDataEEES5_S5_S5_PNS_5EventE
-__ZN7WebCore19ResourceRequestBaseC2ERKNS_4KURLENS_26ResourceRequestCachePolicyE
-__ZNK7WebCore8FormData15flattenToStringEv
-__ZNK7WebCore8FormData7flattenERN3WTF6VectorIcLm0EEE
-__ZN7WebCore19ResourceRequestBase6setURLERKNS_4KURLE
-__ZN7WebCore11FrameLoader10submitFormERKNS_16FrameLoadRequestEPNS_5EventE
-__ZNK7WebCore9FrameTree4findERKNS_12AtomicStringE
-__ZNK7WebCore9FrameTree14isDescendantOfEPKNS_5FrameE
-__ZN7WebCore11FrameLoader4loadERKNS_16FrameLoadRequestEbbPNS_5EventEPNS_15HTMLFormElementERKN3WTF7HashMapINS_6StringESA_NS_10StringHashENS8_10HashTraitsISA_EESD_EE
-__ZN7WebCore11FrameLoader22findFrameForNavigationERKNS_12AtomicStringE
-__ZNK7WebCore11FrameLoader21shouldAllowNavigationEPNS_5FrameE
-__ZN7WebCore9FormState6createEN3WTF10PassRefPtrINS_15HTMLFormElementEEERKNS1_7HashMapINS_6StringES6_NS_10StringHashENS1_10HashTraitsIS6_EES9_EENS2_INS_5FrameEEE
-__ZN7WebCore9FormStateC1EN3WTF10PassRefPtrINS_15HTMLFormElementEEERKNS1_7HashMapINS_6StringES6_NS_10StringHashENS1_10HashTraitsIS6_EES9_EENS2_INS_5FrameEEE
+__ZN7WebCore8Document17prepareMouseEventERKNS_14HitTestRequestERKNS_8IntPointERKNS_18PlatformMouseEventE
+__ZNK7WebCore8Document10renderViewEv
+__ZN7WebCore11RenderLayer7hitTestERKNS_14HitTestRequestERNS_13HitTestResultE
+__ZN7WebCore11RenderLayer12hitTestLayerEPS0_S1_RKNS_14HitTestRequestERNS_13HitTestResultERKNS_7IntRectERKNS_8IntPointEbPKNS_24H
+__ZN7WebCore11RenderLayer35update3DTransformedDescendantStatusEv
+__ZN7WebCoreL14isHitCandidateEPKNS_11RenderLayerEbPdPKNS_24HitTestingTransformStateE
+__ZN7WebCore13HitTestResultD1Ev
+__ZN7WebCore13HitTestResultD2Ev
+__ZNK7WebCore11RenderLayer15hitTestContentsERKNS_14HitTestRequestERNS_13HitTestResultERKNS_7IntRectERKNS_8IntPointENS_13HitTest
+__ZN7WebCore12RenderObject7hitTestERKNS_14HitTestRequestERNS_13HitTestResultERKNS_8IntPointEiiNS_13HitTestFilterE
+__ZN7WebCore11RenderBlock11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore11RenderBlock15hitTestContentsERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore29DeprecatedPtrListImplIterator6toLastEv
+__ZN7WebCore29DeprecatedPtrListImplIteratormmEv
+__ZN7WebCore11RenderBlock24isPointInOverflowControlERNS_13HitTestResultEiiii
+__ZN7WebCore11RenderBlock19updateHitTestResultERNS_13HitTestResultERKNS_8IntPointE
+__ZN7WebCore13HitTestResult12setInnerNodeEPNS_4NodeE
+__ZN7WebCore13HitTestResult21setInnerNonSharedNodeEPNS_4NodeE
+__ZN7WebCore13HitTestResultaSERKS0_
+__ZN7WebCore11RenderLayer22updateHoverActiveStateERKNS_14HitTestRequestERNS_13HitTestResultE
+__ZN7WebCore8Document12setHoverNodeEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore13ContainerNode9setActiveEbb
+__ZN7WebCore13ContainerNode10setHoveredEb
+__ZNK7WebCore11RenderBlock13hoverAncestorEv
+__ZN7WebCore28MouseEventWithHitTestResultsC1ERKNS_18PlatformMouseEventERKNS_13HitTestResultE
+__ZN7WebCore28MouseEventWithHitTestResultsC2ERKNS_18PlatformMouseEventERKNS_13HitTestResultE
+__ZN7WebCore13HitTestResultC1ERKS0_
+__ZN7WebCore13HitTestResultC2ERKS0_
+__ZN7WebCore10ScrollView19scrollbarUnderMouseERKNS_18PlatformMouseEventE
+__ZNK7WebCore28MouseEventWithHitTestResults9scrollbarEv
+__ZN7WebCoreL24subframeForHitTestResultERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore12EventHandler12selectCursorERKNS_28MouseEventWithHitTestResultsEPNS_9ScrollbarE
+__ZNK7WebCore28MouseEventWithHitTestResults10targetNodeEv
+__ZNK7WebCore28MouseEventWithHitTestResults10isOverLinkEv
+__ZNK7WebCore11RenderLayer22isPointInResizeControlERKNS_8IntPointE
+__ZN7WebCore13pointerCursorEv
+__ZN7WebCore6CursorC1EP8NSCursor
+__ZN7WebCore6CursorC2EP8NSCursor
+__ZN7WebCore6CursorC1ERKS0_
+__ZN7WebCore6CursorC2ERKS0_
+__ZN7WebCore6Widget9setCursorERKNS_6CursorE
+__ZN7WebCore6CursorD1Ev
+__ZN7WebCore6CursorD2Ev
+__ZN7WebCore12EventHandler18dispatchMouseEventERKNS_12AtomicStringEPNS_4NodeEbiRKNS_18PlatformMouseEventEb
+__ZN7WebCore9FrameView25resetDeferredRepaintDelayEv
+__ZN7WebCore12EventHandler26updateMouseEventTargetNodeEPNS_4NodeERKNS_18PlatformMouseEventEb
+__ZN7WebCore4Node18dispatchMouseEventERKNS_18PlatformMouseEventERKNS_12AtomicStringEiPS0_
+__ZN7WebCore4Node18dispatchMouseEventERKNS_12AtomicStringEiiiiiibbbbbPS0_N3WTF10PassRefPtrINS_5EventEEE
+__ZN7WebCore10MouseEventC1ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEiiiiibbbbtNS5_INS_11EventTargetEEENS5_INS_9C
+__ZN7WebCore10MouseEventC2ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEiiiiibbbbtNS5_INS_11EventTargetEEENS5_INS_9C
+__ZN7WebCore17MouseRelatedEventC2ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEiiiiibbbbb
+__ZN7WebCoreL9contentsXEPNS_9DOMWindowE
+__ZN7WebCoreL9contentsYEPNS_9DOMWindowE
+__ZN7WebCore17MouseRelatedEvent15initCoordinatesEv
+__ZN7WebCore17MouseRelatedEvent19computePageLocationEv
 __ZNK7WebCore17MouseRelatedEvent5pageYEv
 __ZNK7WebCore17MouseRelatedEvent5pageXEv
-__ZN7WebCore12EventHandler20hitTestResultAtPointERKNS_8IntPointEb
--[DOMDocument URL]
-__ZNK7WebCore16DeprecatedString11getNSStringEv
-+[DOMHTMLElement(WebCoreInternal) _wrapHTMLElement:]
--[WebCoreFrameBridge elementWithName:inForm:]
-__ZNK7WebCore6Chrome5focusEv
-__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE6shrinkEm
-__ZN7WebCore10RenderPart12deleteWidgetEv
-__ZN7WebCore11RenderLayer23hitTestOverflowControlsERNS_13HitTestResultE
-__ZN7WebCore16HTMLTitleElement7setTextERKNS_6StringE
-__ZN7WebCore13ContainerNode12replaceChildEN3WTF10PassRefPtrINS_4NodeEEEPS3_Ri
-__ZN7WebCore4Node17checkReplaceChildEPS0_S1_Ri
-__ZN7WebCore4Node15canReplaceChildEPS0_S1_
-__ZN7WebCore14RenderTableRow27absoluteClippedOverflowRectEv
-__ZN7WebCore15HTMLFormElement19removedFromDocumentEv
-__ZN7WebCore31jsElementPrototypeFunctionFocusEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore4Node13supportsFocusEv
-__ZNK7WebCore11HTMLElement11isFocusableEv
-__ZN7WebCore19createIFrameWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore28JSHTMLIFrameElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSHTMLIFrameElementC1EPN3KJS8JSObjectEPNS_17HTMLIFrameElementE
-__ZN7WebCore19JSHTMLIFrameElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore19JSHTMLIFrameElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSHTMLIFrameElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore21HTMLFrameOwnerElement13contentWindowEv
-__ZN7WebCore35jsNodePrototypeFunctionReplaceChildEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore6JSNode12replaceChildEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore16HTMLStyleElement19removedFromDocumentEv
-__ZN7WebCore12StyleElement19removedFromDocumentEPNS_8DocumentE
-__ZN7WebCore12CSSMediaRuleD1Ev
-__ZN7WebCore11CSSRuleListD2Ev
-__ZN7WebCore10MediaQueryD2Ev
-__ZN3WTF15deleteAllValuesIPN7WebCore13MediaQueryExpELm0EEEvRKNS_6VectorIT_XT0_EEE
-__ZN7WebCore13KeyboardEventD1Ev
-__ZN3WTF6VectorIN7WebCore15KeypressCommandELm0EE6shrinkEm
-__ZN7WebCore13HitTestResult13setURLElementEPNS_7ElementE
-__ZN7WebCore17HTMLAnchorElement9setActiveEbb
-__ZN7WebCore10handCursorEv
-__ZN7WebCore15leakNamedCursorEPKcii
-__ZN7WebCore17HTMLAnchorElement19defaultEventHandlerEPNS_5EventE
-__ZNK7WebCore13HitTestResult11targetFrameEv
-__ZNK7WebCore17HTMLAnchorElement6targetEv
-_urlByRemovingFragment
+__ZN7WebCore17MouseRelatedEvent14receivedTargetEv
+__ZNK7WebCore12RenderObject15absoluteToLocalENS_10FloatPointEbb
+__ZNK7WebCore9RenderBox23mapAbsoluteToLocalPointEbbRNS_14TransformStateE
+__ZNK7WebCore10RenderView23mapAbsoluteToLocalPointEbbRNS_14TransformStateE
+__ZN7WebCore10MouseEventD0Ev
+__ZN7WebCore7UIEventD2Ev
+__ZN7WebCore12EventHandler23handleMouseDraggedEventERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore12EventHandler10handleDragERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore13HitTestResult22setToNonShadowAncestorEv
+__ZN7WebCore6Chrome23mouseDidMoveOverElementERKNS_13HitTestResultEj
+__ZNK7WebCore13HitTestResult15absoluteLinkURLEv
+__ZN7WebCore19InspectorController23mouseDidMoveOverElementERKNS_13HitTestResultEj
+__ZN7WebCore6Chrome10setToolTipERKNS_13HitTestResultE
+__ZNK7WebCore13HitTestResult15spellingToolTipEv
+__ZN7WebCore8Document21markerContainingPointERKNS_8IntPointENS_14DocumentMarker10MarkerTypeE
+__ZNK7WebCore13HitTestResult5titleEv
+__ZNK7WebCore17RenderLineBoxList7hitTestEPNS_20RenderBoxModelObjectERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestA
+__ZN7WebCore13RootInlineBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
+__ZN7WebCore13InlineFlowBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
+__ZN7WebCore9InlineBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
+__ZN7WebCore11RenderImage11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore9RenderBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZL33QTTrackMediaTypeAttributeFunctionv
+__ZL33QTMovieTimeScaleAttributeFunctionv
+__ZNK7WebCore16HTMLMediaElement7isVideoEv
+__ZN7WebCore39jsHTMLMediaElementPrototypeFunctionPlayEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16HTMLMediaElement4playEv
+__ZN7WebCore16HTMLMediaElement12playInternalEv
+__ZNK7WebCore16HTMLMediaElement13endedPlaybackEv
+__ZNK7WebCore16HTMLMediaElement18stoppedDueToErrorsEv
+__ZNK7WebCore16HTMLMediaElement24pausedForUserInteractionEv
+__ZN7WebCore11MediaPlayer7setRateEf
+__ZN7WebCore18MediaPlayerPrivate7setRateEf
+__ZN7WebCore11MediaPlayer4playEv
+__ZN7WebCore18MediaPlayerPrivate4playEv
+__ZNK7WebCore11MediaPlayer4rateEv
+__ZN7WebCore16HTMLMediaElement26startPlaybackProgressTimerEv
+__ZNK3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_iENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraits
+__ZN7WebCore14jsDocumentBodyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL28createHTMLBodyElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLBodyElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLBodyElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLBodyElementEEE
+__ZN7WebCore17JSHTMLBodyElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLBodyElementEEE
+__ZN7WebCore17JSHTMLBodyElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore13JSHTMLElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25setJSHTMLElementClassNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement12setClassNameERKNS_6StringE
+__ZN7WebCore17NodeListsNodeData38invalidateCachesThatDependOnAttributesEv
+__ZNK7WebCore17NodeListsNodeData7isEmptyEv
+__ZN7WebCore12RenderObject16setStyleInternalEN3WTF10PassRefPtrINS_11RenderStyleEEE
+__ZN7WebCore11RenderStyle16accessAnimationsEv
+__ZN7WebCore9Animation6createEv
+__ZN7WebCore9AnimationC1Ev
+__ZN7WebCore9AnimationC2Ev
+__ZN7WebCore13AnimationList6appendEN3WTF10PassRefPtrINS_9AnimationEEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AnimationEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AnimationEEELm0EE15reserveCapacityEm
+__ZN7WebCore16CSSStyleSelector17mapAnimationDelayEPNS_9AnimationEPNS_8CSSValueE
+__ZN7WebCore16CSSStyleSelector20mapAnimationDurationEPNS_9AnimationEPNS_8CSSValueE
+__ZN7WebCore16CSSStyleSelector16mapAnimationNameEPNS_9AnimationEPNS_8CSSValueE
+__ZN7WebCore13AnimationList19fillUnsetPropertiesEv
+__ZN7WebCore26AnimationControllerPrivate24accessCompositeAnimationEPNS_12RenderObjectE
+__ZNK3WTF7HashMapIPN7WebCore12RenderObjectENS_6RefPtrINS1_18CompositeAnimationEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_
+__ZN3WTF7HashMapIPN7WebCore12RenderObjectENS_6RefPtrINS1_18CompositeAnimationEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_E
+__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_NS_6RefPtrINS1_18CompositeAnimationEEEENS_18PairFirstExtractorIS8_EENS_7
+__ZN7WebCore18CompositeAnimation7animateEPNS_12RenderObjectEPNS_11RenderStyleES4_
+__ZN7WebCore18CompositeAnimation24updateKeyframeAnimationsEPNS_12RenderObjectEPNS_11RenderStyleES4_
+__ZN3WTF6VectorIPN7WebCore16AtomicStringImplELm0EE14shrinkCapacityEm
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplENS_6RefPtrINS1_17KeyframeAnimationEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_I
+__ZN7WebCore17KeyframeAnimationC1EPKNS_9AnimationEPNS_12RenderObjectEiPNS_18CompositeAnimationEPNS_11RenderStyleE
+__ZN7WebCore17KeyframeAnimationC2EPKNS_9AnimationEPNS_12RenderObjectEiPNS_18CompositeAnimationEPNS_11RenderStyleE
+__ZN7WebCore13AnimationBaseC2EPKNS_9AnimationEPNS_12RenderObjectEPNS_18CompositeAnimationE
+__ZN7WebCore12KeyframeList6insertEfN3WTF10PassRefPtrINS_11RenderStyleEEE
+__ZN3WTF6VectorIN7WebCore13KeyframeValueELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore13KeyframeValueELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore13KeyframeValueELm0EE15reserveCapacityEm
+__ZN7WebCore16CSSStyleSelector26keyframeStylesForAnimationEPNS_7ElementEPKNS_11RenderStyleERNS_12KeyframeListE
+__ZN7WebCore12KeyframeList5clearEv
+__ZN3WTF6VectorIN7WebCore13KeyframeValueELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore13KeyframeValueELm0EE6shrinkEm
+__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIjEENS_10HashTraitsIiEES6_E5clearEv
+__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIjEENS_10HashTraitsIiEES6_E15deallocateTableEPii
+__ZNK3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_NS_6RefPtrINS1_22WebKitCSSKeyframesRuleEEEENS_18PairFirstExtractorI
+__ZNK7WebCore22WebKitCSSKeyframesRule6lengthEv
+__ZNK7WebCore22WebKitCSSKeyframesRule4itemEj
+__ZN7WebCore21WebKitCSSKeyframeRule14isKeyframeRuleEv
+__ZN7WebCore11RenderStyle5cloneEPKS0_
+__ZN7WebCore11RenderStyleC1ERKS0_
+__ZN7WebCore11RenderStyleC2ERKS0_
+__ZN7WebCore16CSSStyleSelector25createTransformOperationsEPNS_8CSSValueEPNS_11RenderStyleERNS_19TransformOperationsE
+__ZN7WebCoreL25getTransformOperationTypeENS_23WebKitCSSTransformValue22TransformOperationTypeE
+__ZN7WebCore16CSSStyleSelector26mapAnimationTimingFunctionEPNS_9AnimationEPNS_8CSSValueE
+__ZN3WTF7HashSetIiNS_7IntHashIjEENS_10HashTraitsIiEEE3addERKi
+__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIjEENS_10HashTraitsIiEES6_E6expandEv
+__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIjEENS_10HashTraitsIiEES6_E6rehashEi
+__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIjEENS_10HashTraitsIiEES6_E13allocateTableEi
+__ZN7WebCore21WebKitCSSKeyframeRule14parseKeyStringERKNS_6StringERN3WTF6VectorIfLm0EEE
+__ZN3WTF6VectorIfLm0EE14shrinkCapacityEm
+__ZNK7WebCore6String7toFloatEPb
+__ZN7WebCore10StringImpl7toFloatEPb
+__ZN7WebCore17charactersToFloatEPKtmPb
+__ZN3WTF6VectorIfLm0EE14expandCapacityEmPKf
+__ZN3WTF6VectorIfLm0EE14expandCapacityEm
+__ZN3WTF6VectorIfLm0EE15reserveCapacityEm
+__ZN3WTF6VectorIfLm0EE6shrinkEm
+__ZN7WebCore17KeyframeAnimation29validateTransformFunctionListEv
+__ZNK3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIjEENS_10HashTraitsIiEES6_E8containsIiNS_22IdentityHashTranslatorIii
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplENS_6RefPtrINS1_17KeyframeAnimationEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS
+__ZN3WTF6VectorIPN7WebCore16AtomicStringImplELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore16AtomicStringImplELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore16AtomicStringImplELm0EE15reserveCapacityEm
+__ZN7WebCore18CompositeAnimation17updateTransitionsEPNS_12RenderObjectEPNS_11RenderStyleES4_
+__ZN7WebCore17KeyframeAnimation7animateEPNS_18CompositeAnimationEPNS_12RenderObjectEPKNS_11RenderStyleEPS5_RN3WTF6RefPtrIS5_EE
+__ZN7WebCore13AnimationBase27fireAnimationEventsIfNeededEv
+__ZN7WebCore13AnimationBase18updateStateMachineENS0_14AnimStateInputEd
+__ZNK7WebCore13AnimationBase24beginAnimationUpdateTimeEv
+__ZN7WebCore18CompositeAnimation25cleanupFinishedAnimationsEv
+__ZNK7WebCore18CompositeAnimation17timeToNextServiceEv
+__ZN7WebCore17KeyframeAnimation17timeToNextServiceEv
+__ZN7WebCore13AnimationBase17timeToNextServiceEv
+__ZN7WebCoreL15convertToLengthEPNS_17CSSPrimitiveValueEPNS_11RenderStyleEdPb
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AnimationEEELm0EE6shrinkEm
+__ZN7WebCore9AnimationD1Ev
+__ZN7WebCore9AnimationD2Ev
+-[WebCoreMovieObserver rateChanged:]
+__ZN7WebCore18MediaPlayerPrivate11rateChangedEv
+__ZN7WebCore11MediaPlayer11rateChangedEv
+__ZThn112_N7WebCore16HTMLMediaElement22mediaPlayerRateChangedEPNS_11MediaPlayerE
+__ZN7WebCore16HTMLMediaElement22mediaPlayerRateChangedEPNS_11MediaPlayerE
+__ZN7WebCore12EventHandler20hitTestResultAtPointERKNS_8IntPointEbb
 __ZNK7WebCore13HitTestResult10isSelectedEv
 __ZN7WebCore19SelectionController8containsERKNS_8IntPointE
 __ZN7WebCore12EventHandler9mouseDownEP7NSEvent
 __ZN7WebCore12EventHandler21handleMousePressEventERKNS_18PlatformMouseEventE
 __ZN7WebCore8Document13setActiveNodeEN3WTF10PassRefPtrINS_4NodeEEE
-__ZNK7WebCore17HTMLAnchorElement11isFocusableEv
-__ZNK7WebCore17HTMLAnchorElement16isMouseFocusableEv
-__ZNK7WebCore17HTMLAnchorElement17canStartSelectionEv
+__ZNK7WebCore11HTMLElement11isFocusableEv
+__ZNK7WebCore4Node11isFocusableEv
+__ZNK7WebCore4Node16isMouseFocusableEv
+__ZNK7WebCore12EventHandler14mousePressNodeEv
+__ZNK7WebCore4Node17canStartSelectionEv
+__ZN7WebCore6Editor29markMisspellingsAndBadGrammarERKNS_16VisibleSelectionEbS3_
+__ZN7WebCore6Editor40markAllMisspellingsAndBadGrammarInRangesEbPNS_5RangeEbS2_b
+__ZN7WebCoreL29paragraphAlignedRangeForRangeEPNS_5RangeERiRNS_6StringE
+__ZNK7WebCore5Range10cloneRangeERi
+__ZN7WebCore16startOfParagraphERKNS_15VisiblePositionE
+__ZN7WebCore8setStartEPNS_5RangeERKNS_15VisiblePositionE
+__ZN7WebCore24rangeCompliantEquivalentERKNS_15VisiblePositionE
+__ZN7WebCore6setEndEPNS_5RangeERKNS_15VisiblePositionE
+__ZNK7WebCore5Range14startContainerERi
+__ZN7WebCore9plainTextEPKNS_5RangeE
 __ZN7WebCore16HTMLInputElement17dispatchBlurEventEv
-__ZN7WebCore15EventTargetNode17dispatchBlurEventEv
+__ZN7WebCore12InputElement17dispatchBlurEventERNS_16InputElementDataEPNS_8DocumentE
+__ZThn128_NK7WebCore16HTMLInputElement11placeholderEv
+__ZNK7WebCore16HTMLInputElement11placeholderEv
+__ZN7WebCore5Frame22textFieldDidEndEditingEPNS_7ElementE
+__Z3kitPN7WebCore16HTMLInputElementE
+__ZN7WebCore4Node17dispatchBlurEventEv
+__ZN7WebCore11RenderLayer14scrollToOffsetEiibb
 __ZN7WebCore12EventHandler21handleMousePressEventERKNS_28MouseEventWithHitTestResultsE
 __ZN7WebCore12EventHandler9dragStateEv
 __ZN7WebCore12EventHandler23canMouseDownStartSelectEPNS_4NodeE
-__ZN7WebCore12EventHandler32passWidgetMouseDownEventToWidgetERKNS_28MouseEventWithHitTestResultsE
+__ZNK7WebCore8Document13isSVGDocumentEv
 __ZN7WebCore12EventHandler17focusDocumentViewEv
 __ZN7WebCore12EventHandler32handleMousePressEventSingleClickERKNS_28MouseEventWithHitTestResultsE
-__ZNK7WebCore12RenderObject16shouldAutoscrollEv
+__ZNK7WebCore28MouseEventWithHitTestResults10localPointEv
+__ZN7WebCore11RenderBlock16positionForPointERKNS_8IntPointE
+__ZN7WebCore11RenderBlock34positionForPointWithInlineChildrenERKNS_8IntPointE
+__ZN7WebCore12RenderObject21createVisiblePositionEiNS_9EAffinityE
+__ZNK7WebCore10RenderText14previousOffsetEi
+__ZN7WebCore22cursorMovementIteratorEPKti
+__ZN7WebCore18textBreakPrecedingEPNS_17TextBreakIteratorEi
+__ZNK7WebCore8Position28atLastEditingPositionForNodeEv
+__ZN7WebCore16VisibleSelectionC1ERKNS_15VisiblePositionE
+__ZN7WebCore16VisibleSelectionC2ERKNS_15VisiblePositionE
+__ZNK7WebCore5Frame21shouldChangeSelectionERKNS_16VisibleSelectionE
+__ZNK7WebCore5Frame21shouldChangeSelectionERKNS_16VisibleSelectionES3_NS_9EAffinityEb
+__ZN7WebCore9RenderBox14localCaretRectEPNS_9InlineBoxEiPi
+__ZN7WebCore12EventHandler12mouseDraggedEP7NSEvent
+__ZN7WebCore11iBeamCursorEv
+__ZN7WebCore12EventHandler27eventLoopHandleMouseDraggedERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore12EventHandler24mouseDownViewIfStillGoodEv
+__ZNK7WebCore12EventHandler14allowDHTMLDragERbS1_
+__ZNK7WebCore10ScrollView16contentsToWindowERKNS_8IntPointE
+__ZNK7WebCore6Widget25convertToContainingWindowERKNS_8IntPointE
+__ZN7WebCore14DragController24delegateDragSourceActionERKNS_8IntPointE
+__ZNK7WebCore12RenderObject13draggableNodeEbbiiRb
+__ZNK7WebCore12EventHandler18shouldDragAutoNodeEPNS_4NodeERKNS_8IntPointE
+__ZN7WebCore12EventHandler16handleAutoscrollEPNS_12RenderObjectE
+__ZN7WebCore12EventHandler21setAutoscrollRendererEPNS_12RenderObjectE
+__ZN7WebCore12EventHandler20startAutoscrollTimerEv
+__ZN7WebCore12EventHandler27updateSelectionForMouseDragEPNS_4NodeERKNS_8IntPointE
+__ZN7WebCore12EventHandler24canMouseDragExtendSelectEPNS_4NodeE
+__ZN7WebCore16VisibleSelection9setExtentERKNS_15VisiblePositionE
+__ZNK7WebCore5Frame20selectionGranularityEv
+__ZN7WebCore5TimerINS_12EventHandlerEE5firedEv
+__ZN7WebCore12EventHandler20autoscrollTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore9RenderBox10autoscrollEv
+__ZN7WebCore11RenderLayer10autoscrollEv
+__ZN7WebCore12EventHandler27updateSelectionForMouseDragEv
+__ZNK7WebCore12EventHandler20currentMousePositionEv
 __ZN7WebCore12EventHandler7mouseUpEP7NSEvent
 __ZN7WebCore12EventHandler23handleMouseReleaseEventERKNS_18PlatformMouseEventE
-__ZN7WebCore19JSHTMLIFrameElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore19JSHTMLIFrameElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore19JSHTMLIFrameElement6setSrcEPN3KJS9ExecStateEPNS1_7JSValueE
-__ZN7WebCore20HTMLFrameElementBase6setSrcERKNS_6StringE
-__ZN7WebCore11FrameLoader15userGestureHintEv
-__ZNK7WebCore8KJSProxy21processingUserGestureEv
-__ZN3KJS6Window12currentEventEv
-__ZN7WebCore11FrameLoader22scheduleLocationChangeERKNS_6StringES3_bb
-__ZN7WebCore11FrameLoader19scheduleRedirectionEPNS_20ScheduledRedirectionE
-__ZN7WebCore11FrameLoader21startRedirectionTimerEv
-__ZN7WebCore11FrameLoader16clientRedirectedERKNS_4KURLEddbb
+__ZNK7WebCore7UIEvent9isUIEventEv
 __ZN7WebCore12EventHandler23handleMouseReleaseEventERKNS_28MouseEventWithHitTestResultsE
 __ZN7WebCore12EventHandler19stopAutoscrollTimerEb
-__ZN7WebCore12EventHandler21setAutoscrollRendererEPNS_12RenderObjectE
+__ZN7WebCore9RenderBox14stopAutoscrollEv
 __ZN7WebCore12EventHandler13handleMouseUpERKNS_28MouseEventWithHitTestResultsE
 __ZN7WebCore12EventHandler22eventLoopHandleMouseUpERKNS_28MouseEventWithHitTestResultsE
-__ZN7WebCore12EventHandler24mouseDownViewIfStillGoodEv
 __ZNK7WebCore12EventHandler18eventActivatedViewERKNS_18PlatformMouseEventE
 __ZN7WebCore12EventHandler15invalidateClickEv
+__ZN7WebCore16HTMLMediaElement26playbackProgressTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore16HTMLMediaElement23scheduleTimeupdateEventEb
+__ZN7WebCore5TimerINS_26AnimationControllerPrivateEE5firedEv
+__ZN7WebCore26AnimationControllerPrivate19animationTimerFiredEPNS_5TimerIS0_EE
+__ZNK7WebCore13AnimationListeqERKS0_
+__ZNK7WebCore9Animation15animationsMatchEPKS0_b
+__ZN7WebCore26AnimationControllerPrivate27addToStyleAvailableWaitListEPNS_13AnimationBaseE
+__ZN7WebCore26AnimationControllerPrivate23addNodeChangeToDispatchEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EE15reserveCapacityEm
+__ZN7WebCore26AnimationControllerPrivate34startUpdateStyleIfNeededDispatcherEv
+__ZNK7WebCore17KeyframeAnimation28getKeyframeAnimationIntervalERPKNS_11RenderStyleES4_Rd
+__ZNK7WebCore13AnimationBase14getElapsedTimeEv
+__ZNK7WebCore13AnimationBase8progressEddPKNS_14TimingFunctionE
+__ZN7WebCore13AnimationBase15blendPropertiesEPKS0_iPNS_11RenderStyleEPKS3_S6_d
+__ZN7WebCoreL17ensurePropertyMapEv
+__ZN3WTF6VectorIPN7WebCore19PropertyWrapperBaseELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore19PropertyWrapperBaseELm0EE15reserveCapacityEm
+__ZN7WebCoreL22addShorthandPropertiesEv
+__ZN7WebCoreL18wrapperForPropertyEi
+__ZN3WTF6VectorIPN7WebCore19PropertyWrapperBaseELm0EE14expandCapacityEmPKS3_
+__ZN7WebCoreL18addPropertyWrapperEiPNS_19PropertyWrapperBaseE
+__ZNK7WebCore15PropertyWrapperIRKNS_19TransformOperationsEE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS8_SB_d
+__ZNK7WebCore11RenderStyle9transformEv
+__ZN7WebCore23ScaleTransformOperation5blendEPKNS_18TransformOperationEdb
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE14expandCapacityEmPKS4_
+__ZN7WebCore11RenderStyle12setTransformERKNS_19TransformOperationsE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AnimationEEELm0EEC1ERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9AnimationEEELm0EEC2ERKS5_
+__ZNK7WebCore15PropertyWrapperIfE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS5_S8_d
+__ZNK7WebCore11RenderStyle7opacityEv
+__ZN7WebCore11RenderStyle10setOpacityEf
+__ZN7WebCore11RenderLayer27repaintIncludingDescendantsEv
+__ZN7WebCore20TransformationMatrix5blendERKS0_d
+__ZNK7WebCore20TransformationMatrix9decomposeERNS0_14DecomposedTypeE
+__ZN7WebCoreL8v3LengthEPd
+__ZN7WebCoreL7v3ScaleEPdd
+__ZN7WebCoreL5v3DotEPKdS1_
+__ZN7WebCoreL9v3CombineEPKdS1_Pddd
+__ZN7WebCore20TransformationMatrix9recomposeERKNS0_14DecomposedTypeE
+__ZN7WebCore17KeyframeAnimation18overrideAnimationsEv
+__ZN7WebCore18CompositeAnimation26overrideImplicitAnimationsEi
+__ZN7WebCore17KeyframeAnimation16onAnimationStartEd
+__ZN7WebCore17KeyframeAnimation18sendAnimationEventERKNS_12AtomicStringEd
+__ZNK7WebCore17KeyframeAnimation26shouldSendEventForListenerENS_8Document12ListenerTypeE
+__ZN7WebCore26AnimationControllerPrivate18addEventToDispatchEN3WTF10PassRefPtrINS_7ElementEEERKNS_12AtomicStringERKNS_6StringEd
+__ZN3WTF6VectorIN7WebCore26AnimationControllerPrivate15EventToDispatchELm0EE4growEm
+__ZN3WTF6VectorIN7WebCore26AnimationControllerPrivate15EventToDispatchELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore26AnimationControllerPrivate15EventToDispatchELm0EE15reserveCapacityEm
+__ZNK7WebCore13AnimationBase10overriddenEv
+__ZN7WebCore17KeyframeAnimation14startAnimationEd
+__ZN7WebCore26AnimationControllerPrivate30addToStartTimeResponseWaitListEPNS_13AnimationBaseEb
+__ZN7WebCore13AnimationBase26goIntoEndingOrLoopingStateEv
+__ZNK7WebCore13AnimationBase18getTimeToNextEventERdRb
+__ZN7WebCore9FrameView11forceLayoutEb
+__ZNK7WebCore26Matrix3DTransformOperation16getOperationTypeEv
+__ZNK7WebCore26Matrix3DTransformOperation5applyERNS_20TransformationMatrixERKNS_7IntSizeE
+__ZN7WebCore26AnimationControllerPrivate34updateStyleIfNeededDispatcherFiredEPNS_5TimerIS0_EE
+__ZN7WebCore4Node28dispatchWebKitAnimationEventERKNS_12AtomicStringERKNS_6StringEd
+__ZN7WebCore20WebKitAnimationEventC1ERKNS_12AtomicStringERKNS_6StringEd
+__ZN7WebCore20WebKitAnimationEventC2ERKNS_12AtomicStringERKNS_6StringEd
+__ZNK7WebCore20WebKitAnimationEvent22isWebKitAnimationEventEv
+__ZN7WebCore22JSWebKitAnimationEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSWebKitAnimationEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20WebKitAnimationEventEEE
+__ZN7WebCore22JSWebKitAnimationEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20WebKitAnimationEventEEE
+__ZN7WebCore22JSWebKitAnimationEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore35jsWebKitAnimationEventAnimationNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20WebKitAnimationEvent13animationNameEv
+__ZN3WTF6VectorIN7WebCore26AnimationControllerPrivate15EventToDispatchELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore26AnimationControllerPrivate15EventToDispatchELm0EE6shrinkEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EE6shrinkEm
+__ZNK7WebCore26Matrix3DTransformOperationeqERKNS_18TransformOperationE
+__ZNK7WebCore26Matrix3DTransformOperation10isSameTypeERKNS_18TransformOperationE
+__ZN7WebCore26Matrix3DTransformOperationD0Ev
+__ZNK7WebCore16StyleCachedImage5imageEPNS_12RenderObjectERKNS_7IntSizeE
+__ZN7WebCore15GraphicsContext14drawTiledImageEPNS_5ImageERKNS_7IntRectERKNS_8IntPointERKNS_7IntSizeENS_17CompositeOperatorE
+__ZN7WebCore5Image9drawTiledEPNS_15GraphicsContextERKNS_9FloatRectERKNS_10FloatPointERKNS_9FloatSizeENS_17CompositeOperatorE
+__ZN7WebCore20TransformationMatrix15scaleNonUniformEdd
+__ZNK7WebCore9FloatRect8containsERKS0_
+__ZNK7WebCore11HistoryItem5titleEv
+__ZN7WebCore24StringWrapperCFAllocatorL22deallocateOnMainThreadEPv
+__ZNK7WebCore24RotateTransformOperation5applyERNS_20TransformationMatrixERKNS_7IntSizeE
+__ZN7WebCore20TransformationMatrix8rotate3dEdddd
+__ZNK7WebCore13ResourceErrorcvP7NSErrorEv
+__ZN7WebCore13InlineTextBox10deleteLineEPNS_11RenderArenaE
+__ZN7WebCore10RenderText13removeTextBoxEPNS_13InlineTextBoxE
+__ZN7WebCore5TimerINS_12IconDatabaseEE5firedEv
+__ZN7WebCore12IconDatabase14syncTimerFiredEPNS_5TimerIS0_EE
+__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE15reserveCapacityEm
+__ZN7WebCore12IconDatabase30writeIconSnapshotToSQLDatabaseERKNS_12IconSnapshotE
+__ZN7WebCore12IconDatabase34getIconIDForIconURLFromSQLDatabaseERKNS_6StringE
+__ZN7WebCore15SQLiteStatement9bindInt64Eix
+__ZN7WebCore14SQLiteDatabase15lastInsertRowIDEv
+__ZN7WebCore15SQLiteStatement8bindBlobEiPKvi
+__ZN7WebCore12IconDatabase33setIconURLForPageURLInSQLDatabaseERKNS_6StringES3_
+__ZN7WebCore15SQLiteStatement9isExpiredEv
+__ZN7WebCore15SQLiteStatement14getColumnInt64Ei
+__ZN7WebCore12IconDatabase32setIconIDForPageURLInSQLDatabaseExRKNS_6StringE
+__ZN7WebCore12IconDatabase24checkForDanglingPageURLsEb
+__ZN7WebCore15SQLiteStatement23returnsAtLeastOneResultEv
+__ZN3WTF6VectorIN7WebCore15PageURLSnapshotELm0EE6shrinkEm
+__ZN3WTF6VectorIN7WebCore12IconSnapshotELm0EE6shrinkEm
+__ZN7WebCore12IconDatabase20pruneUnretainedIconsEv
+__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_13PageURLRecordEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHa
+__ZN7WebCore17KeyframeAnimation14onAnimationEndEd
+__ZN7WebCore17KeyframeAnimation12endAnimationEb
+__ZN7WebCore13AnimationBase19setNeedsStyleRecalcEPNS_4NodeE
+__ZN7WebCore17KeyframeAnimation26resumeOverriddenAnimationsEv
+__ZN7WebCore18CompositeAnimation34resumeOverriddenImplicitAnimationsEi
+__ZN7WebCore17KeyframeAnimationD0Ev
+__ZN7WebCore12KeyframeListD1Ev
+__ZN7WebCore12KeyframeListD2Ev
+__ZN7WebCore13AnimationBaseD2Ev
+__ZN7WebCore26AnimationControllerPrivate32removeFromStyleAvailableWaitListEPNS_13AnimationBaseE
+__ZN7WebCore26AnimationControllerPrivate35removeFromStartTimeResponseWaitListEPNS_13AnimationBaseE
+__ZN3WTF6VectorIPN7WebCore16AtomicStringImplELm0EE6shrinkEm
+__ZN7WebCore24RotateTransformOperationD0Ev
+__ZN3WTF6VectorIPN7WebCore11RenderLayerELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIPN7WebCore11RenderLayerELm0EE6shrinkEm
+__ZN7WebCore11RenderVideo13paintReplacedERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore11MediaPlayer5paintEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore18MediaPlayerPrivate5paintEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore15GraphicsContext5scaleERKNS_9FloatSizeE
+__ZN7WebCore15GraphicsContext28setImageInterpolationQualityENS_20InterpolationQualityE
+__ZN7WebCore11RenderLayer19removeOnlyThisLayerEv
+__ZN7WebCore11RenderLayer11removeChildEPS0_
+__ZN7WebCore11RenderLayer28dirtyVisibleDescendantStatusEv
+__ZSt21__inplace_stable_sortIPPN7WebCore11RenderLayerEPFbS2_S2_EEvT_S6_T0_
+__ZN7WebCore12RenderObject19updateHitTestResultERNS_13HitTestResultERKNS_8IntPointE
+__ZN7WebCore11RenderImage8imageMapEv
+__ZNK7WebCore16HTMLImageElement6useMapEv
+__ZNK7WebCore8Document11getImageMapERKNS_6StringE
+-[DOMNode(DOMNodeExtensions) boundingBox]
+__ZN7WebCore12RenderObject23absoluteBoundingBoxRectEb
+__ZN7WebCore9RenderBox13absoluteRectsERN3WTF6VectorINS_7IntRectELm0EEEii
+-[DOMNode parentNode]
+__ZN7WebCore11RenderBlock13absoluteRectsERN3WTF6VectorINS_7IntRectELm0EEEii
+__Z4coreP11DOMDocument
+__ZN7WebCore25HistoryPropertyListWriterC2Ev
+__ZN7WebCore24BinaryPropertyListWriter17writePropertyListEv
+__ZN7WebCore28BinaryPropertyListSerializerC1ERNS_24BinaryPropertyListWriterE
+__ZN7WebCore28BinaryPropertyListSerializerC2ERNS_24BinaryPropertyListWriterE
+__ZN7WebCore22BinaryPropertyListPlanC1ERNS_24BinaryPropertyListWriterE
+__ZN7WebCore22BinaryPropertyListPlanC2ERNS_24BinaryPropertyListWriterE
+__ZN7WebCore25HistoryPropertyListWriter12writeObjectsERNS_30BinaryPropertyListObjectStreamE
+__ZN7WebCore22BinaryPropertyListPlan20writeDictionaryStartEv
+__ZN7WebCore22BinaryPropertyListPlan11writeStringERKNS_6StringE
+__ZN3WTF7HashMapIN7WebCore6StringEmNS1_10StringHashENS_10HashTraitsIS2_EENS4_ImEEE3addERKS2_RKm
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_mENS_18PairFirstExtractorIS4_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTra
+__ZN7WebCore22BinaryPropertyListPlan17writeStringObjectERKNS_6StringE
+__ZN7WebCoreL25markerPlusLengthByteCountEm
+__ZN7WebCore22BinaryPropertyListPlan12writeIntegerEi
+__ZN3WTF7HashMapIimNS_7IntHashIjEENS_10HashTraitsIiEENS3_ImEEE3addERKiRKm
+__ZN3WTF9HashTableIiSt4pairIimENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENS8_ImEEEES9_
+__ZN7WebCore22BinaryPropertyListPlan15writeArrayStartEv
+__ZN7WebCore25HistoryPropertyListWriter16writeHistoryItemERNS_30BinaryPropertyListObjectStreamEPNS_11HistoryItemE
+__ZNK7WebCore11HistoryItem14alternateTitleEv
+__ZNK7WebCore11HistoryItem12redirectURLsEv
+__ZN7WebCore22BinaryPropertyListPlan17writeUniqueStringERKNS_6StringE
+__ZN7WebCore22BinaryPropertyListPlan17writeUniqueStringEPKc
+__ZN7WebCore22BinaryPropertyListPlan17writeStringObjectEPKc
+__ZN7WebCore22BinaryPropertyListPlan17writeIntegerArrayEPKim
+__ZN3WTF7HashMapIN7WebCore12IntegerArrayEmNS1_16IntegerArrayHashENS1_22IntegerArrayHashTraitsENS_10HashTraitsImEEE3addERKS2_RKm
+__ZN3WTF9HashTableIN7WebCore12IntegerArrayESt4pairIS2_mENS_18PairFirstExtractorIS4_EENS1_16IntegerArrayHashENS_14PairHashTraits
+__ZN7WebCore16IntegerArrayHash4hashERKNS_12IntegerArrayE
+__ZN7WebCore22BinaryPropertyListPlan16writeArrayObjectEm
+__ZN7WebCore22BinaryPropertyListPlan18writeDictionaryEndEm
+__ZN7WebCore22BinaryPropertyListPlan21writeDictionaryObjectEm
+__ZN7WebCore16IntegerArrayHash5equalERKNS_12IntegerArrayES3_
+__ZN7WebCore22BinaryPropertyListPlan16writeBooleanTrueEv
+__ZN7WebCore22BinaryPropertyListPlan13writeArrayEndEm
+__ZN7WebCoreL11bytesNeededEm
+__ZN7WebCore25HistoryPropertyListWriter6bufferEm
+__ZN7WebCore28BinaryPropertyListSerializer20writeDictionaryStartEv
+__ZN7WebCore28BinaryPropertyListSerializer11writeStringERKNS_6StringE
+__ZNK7WebCore22BinaryPropertyListPlan21stringObjectReferenceERKNS_6StringE
+__ZNK3WTF7HashMapIN7WebCore6StringEmNS1_10StringHashENS_10HashTraitsIS2_EENS4_ImEEE3getERKS2_
+__ZN7WebCore28BinaryPropertyListSerializer18appendStringObjectERKNS_6StringE
+__ZN7WebCore28BinaryPropertyListSerializer11startObjectEv
+__ZN7WebCore28BinaryPropertyListSerializer13appendIntegerEm
+__ZN7WebCore28BinaryPropertyListSerializer27addAggregateObjectReferenceEm
+__ZN7WebCore28BinaryPropertyListSerializer12writeIntegerEi
+__ZNK7WebCore22BinaryPropertyListPlan22integerObjectReferenceEi
+__ZNK3WTF7HashMapIimNS_7IntHashIjEENS_10HashTraitsIiEENS3_ImEEE3getERKi
+__ZN7WebCore28BinaryPropertyListSerializer19appendIntegerObjectEi
+__ZN7WebCore28BinaryPropertyListSerializer15writeArrayStartEv
+__ZN7WebCore28BinaryPropertyListSerializer17writeUniqueStringERKNS_6StringE
+__ZN7WebCore28BinaryPropertyListSerializer17writeUniqueStringEPKc
+__ZN7WebCore28BinaryPropertyListSerializer18appendStringObjectEPKc
+__ZN7WebCore28BinaryPropertyListSerializer17writeIntegerArrayEPKim
+__ZNK7WebCore22BinaryPropertyListPlan27integerArrayObjectReferenceEPKim
+__ZNK3WTF7HashMapIN7WebCore12IntegerArrayEmNS1_16IntegerArrayHashENS1_22IntegerArrayHashTraitsENS_10HashTraitsImEEE3getERKS2_
+__ZN7WebCore28BinaryPropertyListSerializer24appendIntegerArrayObjectEPKim
+__ZN7WebCore28BinaryPropertyListSerializer21appendObjectReferenceEm
+__ZN7WebCore28BinaryPropertyListSerializer18writeDictionaryEndEm
+__ZN7WebCoreL19moveAndReverseBytesEPhPKhm
+__ZN7WebCore28BinaryPropertyListSerializer16writeBooleanTrueEv
+__ZNK7WebCore22BinaryPropertyListPlan26booleanTrueObjectReferenceEv
+__ZN7WebCore28BinaryPropertyListSerializer13writeArrayEndEm
+__ZN7WebCore25HistoryPropertyListWriter11releaseDataEv
+__ZN7WebCore13InlineTextBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
+__ZN7WebCore12RenderInline19updateHitTestResultERNS_13HitTestResultERKNS_8IntPointE
+__ZN7WebCore13HitTestResult13setURLElementEPNS_7ElementE
+__ZNK7WebCore12RenderObject19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore12RenderInline13absoluteRectsERN3WTF6VectorINS_7IntRectELm0EEEii
+-[WebCoreMovieObserver didEnd:]
+__ZN7WebCore18MediaPlayerPrivate6didEndEv
+__ZNK7WebCore16HTMLMediaElement4loopEv
+__ZN7WebCore10TimeRanges3addEff
+__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE15reserveCapacityEm
+-[DOMHTMLElement idName]
+__ZNK7WebCore11HTMLElement2idEv
+-[DOMHTMLElement className]
+__ZNK7WebCore11HTMLElement9classNameEv
+-[DOMElement tagName]
+__ZNK7WebCore11HTMLElement8nodeNameEv
+__ZNK7WebCore6String5upperEv
+__ZN7WebCore10StringImpl5upperEv
+-[DOMNode firstChild]
+-[DOMNode nextSibling]
+-[DOMNode previousSibling]
+__ZN7WebCore14JSHTMLDocument3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore10JSDocument3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore21setJSDocumentLocationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSDocument11setLocationEPN3JSC9ExecStateENS1_7JSValueE
+__ZNK7WebCore16ScriptController21processingUserGestureEv
+__ZNK7WebCore16ScriptController26processingUserGestureEventEv
+__ZNK7WebCore16ScriptController28isJavaScriptAnchorNavigationEv
+__ZNK7WebCore16ScriptController30anyPageIsProcessingUserGestureEv
+__ZN7WebCore11FrameLoader22scheduleLocationChangeERKNS_6StringES3_bbb
+__ZN7WebCore11FrameLoader19scheduleRedirectionEPNS_20ScheduledRedirectionE
+__ZN7WebCore11FrameLoader21startRedirectionTimerEv
+__ZNK7WebCore9TimerBase16nextFireIntervalEv
+__ZN7WebCore11FrameLoader16clientRedirectedERKNS_4KURLEddb
 __ZN7WebCore5TimerINS_11FrameLoaderEE5firedEv
 __ZN7WebCore11FrameLoader21redirectionTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore11FrameLoader14changeLocationERKNS_6StringES3_bb
-__ZN7WebCore11FrameLoader14changeLocationERKNS_4KURLERKNS_6StringEbb
+__ZN7WebCore11FrameLoader14changeLocationERKNS_4KURLERKNS_6StringEbbbb
 __ZN7WebCore11FrameLoader22executeIfJavaScriptURLERKNS_4KURLEbb
-__ZN7WebCore11FrameLoader11urlSelectedERKNS_15ResourceRequestERKNS_6StringEPNS_5EventEbb
-__ZN7WebCore11FrameLoader11urlSelectedERKNS_16FrameLoadRequestEPNS_5EventEbb
-__ZN7WebCore14DocumentLoader19setIsClientRedirectEb
-__ZN7WebCore11HistoryItem6setURLERKNS_4KURLE
-__ZN7WebCore9PageCache6removeEPNS_11HistoryItemE
-__ZN7WebCore11HistoryItem12setURLStringERKNS_6StringE
-__ZN7WebCore11HistoryItem18clearDocumentStateEv
+__ZN7WebCore11FrameLoader11urlSelectedERKNS_15ResourceRequestERKNS_6StringEN3WTF10PassRefPtrINS_5EventEEEbbb
+__ZN7WebCore11FrameLoader16loadFrameRequestERKNS_16FrameLoadRequestEbbN3WTF10PassRefPtrINS_5EventEEENS5_INS_9FormStateEEE
+__ZN7WebCore11FrameLoader7loadURLERKNS_4KURLERKNS_6StringES6_bNS_13FrameLoadTypeEN3WTF10PassRefPtrINS_5EventEEENS9_INS_9FormSta
+__ZN7WebCore14SecurityOrigin16createFromStringERKNS_6StringE
+__ZN7WebCore11FrameLoader22findFrameForNavigationERKNS_12AtomicStringE
+__ZNK7WebCore9FrameTree4findERKNS_12AtomicStringE
+__ZNK7WebCore11FrameLoader21shouldAllowNavigationEPNS_5FrameE
+__ZN7WebCore16NavigationActionC1ERKNS_4KURLENS_13FrameLoadTypeEbN3WTF10PassRefPtrINS_5EventEEE
+__ZN7WebCore16NavigationActionC2ERKNS_4KURLENS_13FrameLoadTypeEbN3WTF10PassRefPtrINS_5EventEEE
+__ZNK7WebCore11HistoryItem3urlEv
+__ZNK7WebCore11HistoryItem11originalURLEv
+__ZN7WebCore11FrameLoader24loadWithNavigationActionERKNS_15ResourceRequestERKNS_16NavigationActionEbNS_13FrameLoadTypeEN3WTF10P
+__ZN7WebCore9DOMWindow25dispatchBeforeUnloadEventEPN3WTF6VectorINS1_6RefPtrINS_23RegisteredEventListenerEEELm0EEE
+__ZN7WebCore17BeforeUnloadEventC1Ev
+__ZN7WebCore17BeforeUnloadEventC2Ev
+__ZN7WebCore17BeforeUnloadEventD0Ev
+__ZN7WebCore18MainResourceLoader15handleEmptyLoadERKNS_4KURLEb
+__ZN7WebCore11FrameLoader29generatedMIMETypeForURLSchemeERKNS_6StringE
+__ZNK7WebCore8Document17formElementsStateEv
+__ZN7WebCore11HistoryItem16setDocumentStateERKN3WTF6VectorINS_6StringELm0EEE
+__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE6shrinkEm
+__ZN7WebCore15JSEventListenerD0Ev
+__ZN7WebCore4Node31removeAllEventListenersSlowCaseEv
+__ZN7WebCore11FrameLoader36saveScrollPositionAndViewStateToItemEPNS_11HistoryItemE
+__ZN7WebCore11HistoryItem14setScrollPointERKNS_8IntPointE
+__ZN7WebCore11HistoryItem14addRedirectURLERKNS_6StringE
+__ZN7WebCore13AXObjectCacheD1Ev
+__ZN7WebCore13AXObjectCacheD2Ev
+__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E15deallocateTableEPji
+__ZN7WebCore16HTMLMediaElement26documentWillBecomeInactiveEv
+__ZN7WebCore16HTMLMediaElement17userCancelledLoadEv
+__ZN7WebCore16HTMLMediaElement17setPausedInternalEb
+__ZL62QTVideoRendererWebKitOnlyNewImageAvailableNotificationFunctionv
+__ZN7WebCore10RenderText7destroyEv
+__ZN7WebCore12RenderObject15virtualChildrenEv
+__ZN7WebCore26AnimationControllerPrivate5clearEPNS_12RenderObjectE
+__ZN7WebCore16StyleCachedImage12removeClientEPNS_12RenderObjectE
+__ZN7WebCore10RenderTextD0Ev
+__ZN7WebCore19StyleGeneratedImage12removeClientEPNS_12RenderObjectE
+__ZNK3WTF9HashTableIN7WebCore7IntSizeESt4pairIS2_jENS_18PairFirstExtractorIS4_EENS_7IntHashIS2_EENS_14PairHashTraitsINS_10HashT
+__ZN3WTF9HashTableIN7WebCore7IntSizeESt4pairIS2_NS_6RefPtrINS1_5ImageEEEENS_18PairFirstExtractorIS7_EENS_7IntHashIS2_EENS_14Pai
+__ZN7WebCore14GeneratedImageD0Ev
+__ZN7WebCore8GradientD0Ev
+__ZN3WTF6VectorIN7WebCore8Gradient9ColorStopELm0EE6shrinkEm
+__ZN7WebCore5ImageD2Ev
+__ZN7WebCore13RenderReplicaD0Ev
+__ZN7WebCore18CompositeAnimation13clearRendererEv
+__ZN7WebCore18CompositeAnimationD1Ev
+__ZN7WebCore18CompositeAnimationD2Ev
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_NS_6RefPtrINS1_17KeyframeAnimationEEEENS_18PairFirstExtractorIS8_EEN
+__ZN7WebCore9RenderBox45removeFloatingOrPositionedChildFromBlockListsEv
+__ZN3WTF11ListHashSetIPN7WebCore9RenderBoxENS_7PtrHashIS3_EEE14deleteAllNodesEv
+__ZN7WebCore16HTMLVideoElement6detachEv
+__ZN7WebCore11RenderMedia7destroyEv
+__ZN7WebCore11RenderMedia15virtualChildrenEv
+__ZN7WebCore11RenderVideoD0Ev
+__ZN7WebCore11RenderMediaD2Ev
+__ZN7WebCore14RenderReplacedD2Ev
+__ZN7WebCore11RenderImageD0Ev
+__ZN7WebCore9FrameView18unscheduleRelayoutEv
+__ZN7WebCore9FrameViewD0Ev
+__ZN7WebCore9FrameView15resetScrollbarsEv
+__ZN7WebCore10ScrollView25setHasHorizontalScrollbarEb
+__ZN7WebCore10ScrollView23setHasVerticalScrollbarEb
+__ZN7WebCore10ScrollViewD2Ev
+__ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTable
+__ZN7WebCore6WidgetD2Ev
 __ZN7WebCore11FrameLoader33clientRedirectCancelledOrFinishedEb
-__ZN7WebCore8Document19hoveredNodeDetachedEPNS_4NodeE
-__ZN7WebCore12EventHandler24scheduleHoverStateUpdateEv
-__ZN7WebCore5TimerINS_12EventHandlerEE5firedEv
-__ZN7WebCore12EventHandler15hoverTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore22centerTruncateToBufferERKNS_6StringEjjPt
-__ZN7WebCore11isTextBreakEPNS_17TextBreakIteratorEi
-__ZN7WebCore17buttonConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLButtonElementC2EPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore17HTMLButtonElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore13HTMLBRElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore13HTMLBRElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore10HTMLParser28tableSectionCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore23tableSectionConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore19textareaConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore19HTMLTextAreaElementC2EPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore19HTMLTextAreaElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore41jsElementPrototypeFunctionRemoveAttributeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Element15removeAttributeERKNS_6StringERi
-__ZN7WebCore12NamedAttrMap15removeNamedItemERKNS_6StringERi
-__ZN7WebCore18JSHTMLTableElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore25JSHTMLTableSectionElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore21JSHTMLTableRowElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore15createBRWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore24JSHTMLBRElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSHTMLBRElementC1EPN3KJS8JSObjectEPNS_13HTMLBRElementE
-__ZN7WebCore15JSHTMLBRElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore15JSHTMLBRElement9classInfoEv
-__ZN7WebCore15JSHTMLBRElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore32jsNodePrototypeFunctionCloneNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore11HTMLElement9cloneNodeEb
-__ZN7WebCore12NamedAttrMapaSERKS0_
-__ZNK7WebCore15MappedAttribute5cloneEb
-__ZN7WebCore13StyledElement26copyNonAttributePropertiesEPKNS_7ElementE
-__ZN7WebCore13ContainerNode15cloneChildNodesEPS0_
-__ZN7WebCore26CSSMutableStyleDeclarationaSERKS0_
-__ZN7WebCore4Text9cloneNodeEb
-__ZN7WebCore12NamedAttrMap15removeNamedItemERKNS_13QualifiedNameERi
-__ZN7WebCore12NamedAttrMap15removeAttributeERKNS_13QualifiedNameE
-__ZN7WebCore7Element24dispatchAttrRemovalEventEPNS_9AttributeE
-__ZN7WebCore35jsNodePrototypeFunctionInsertBeforeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore6JSNode12insertBeforeEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore19DeprecatedValueListINS_11CSSPropertyEE8copyNodeEPNS_27DeprecatedValueListImplNodeE
-__ZN7WebCore12RenderInline9splitFlowEPNS_12RenderObjectEPNS_11RenderBlockES2_PNS_10RenderFlowE
-__ZN7WebCore11RenderBlock17setChildrenInlineEb
-__ZN7WebCore12RenderInline12splitInlinesEPNS_11RenderBlockES2_S2_PNS_12RenderObjectEPNS_10RenderFlowE
-__ZN7WebCore12RenderInline11cloneInlineEPNS_10RenderFlowE
-__ZN7WebCore14mapConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16createMapWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore25JSHTMLMapElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSHTMLMapElementC1EPN3KJS8JSObjectEPNS_14HTMLMapElementE
-__ZNK7WebCore16JSHTMLMapElement9classInfoEv
-__ZN7WebCore16JSHTMLMapElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS16JSXMLHttpRequest4markEv
-__ZNK7WebCore14XMLHttpRequest26onReadyStateChangeListenerEv
-__ZNK7WebCore14XMLHttpRequest14onLoadListenerEv
-__ZN7WebCore26JSUnprotectedEventListener4markEv
-__ZN7WebCore14CachedResource11setEncodingERKNS_6StringE
-__ZN7WebCore11BitmapImageD1Ev
-__ZN7WebCore11ImageSourceD2Ev
-__ZN7WebCore11ImageSource5clearEv
-__ZN7WebCore11JSDOMParser14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore20JSDOMParserPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore22JSDOMParserConstructor19implementsConstructEv
-__ZN7WebCore22JSDOMParserConstructor9constructEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_9DOMParserE
-__ZN7WebCore11JSDOMParserC1EPN3KJS8JSObjectEPNS_9DOMParserE
-__ZN7WebCore11JSDOMParser18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20JSDOMParserPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore43jsDOMParserPrototypeFunctionParseFromStringEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore11JSDOMParser9classInfoEv
-__ZN7WebCore9DOMParser15parseFromStringERKNS_6StringES3_
-__ZN7WebCore5Image12supportsTypeERKNS_6StringE
-__ZN7WebCore16MIMETypeRegistry32isSupportedImageResourceMIMETypeERKNS_6StringE
-__ZN7WebCore15PluginInfoStore16supportsMIMETypeERKNS_6StringE
-__ZN7WebCore17DOMImplementation14isTextMIMETypeERKNS_6StringE
-__ZNK7WebCore7Element8nodeNameEv
-__ZN3KJS17staticValueGetterIN7WebCore12JSMouseEventEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore12JSMouseEvent16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore7Element10scrollLeftEv
-__ZNK7WebCore12RenderObject10scrollLeftEv
-__ZN7WebCore7Element9scrollTopEv
-__ZNK7WebCore12RenderObject9scrollTopEv
-__ZN7WebCore6CursorC2EPNS_5ImageERKNS_8IntPointE
-__ZN7WebCore18createCustomCursorEPNS_5ImageERKNS_8IntPointE
-__ZNK7WebCore8IntPointcv8_NSPointEv
-__ZNK7WebCore4Node11isFocusableEv
-__ZNK7WebCore4Node16isMouseFocusableEv
-__ZN7WebCore21JSMouseEventPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18JSUIEventPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore39jsEventPrototypeFunctionStopPropagationEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore12JSMouseEvent9classInfoEv
-__ZN7WebCore9FrameData5clearEv
-__ZN7WebCore14RenderThemeMac13paintCheckboxEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZNK7WebCore14XMLHttpRequest16getRequestHeaderERKNS_6StringE
-__ZN7WebCore8FormDataC2ERKNS_7CStringE
-__ZN7WebCore19ResourceRequestBase11setHTTPBodyEN3WTF10PassRefPtrINS_8FormDataEEE
-__ZN7WebCore11setHTTPBodyEP19NSMutableURLRequestN3WTF10PassRefPtrINS_8FormDataEEE
-__ZN7WebCore8FormDataC2EPKvm
-__ZN7WebCore14HTMLMapElement13mapMouseEventEiiRKNS_7IntSizeERNS_13HitTestResultE
-__ZN7WebCore15HTMLAreaElement13mapMouseEventEiiRKNS_7IntSizeERNS_13HitTestResultE
-__ZNK7WebCore15HTMLAreaElement9getRegionERKNS_7IntSizeE
-__ZN7WebCore4Path6moveToERKNS_10FloatPointE
-__ZN7WebCore4Path9addLineToERKNS_10FloatPointE
-__ZN7WebCore4Path12closeSubpathEv
-__ZN7WebCore4PathC2ERKS0_
-__ZN7WebCore4PathaSERKS0_
-__ZNK7WebCore4Path8containsERKNS_10FloatPointENS_8WindRuleE
-__ZNK7WebCore4Path12boundingRectEv
-__ZN7WebCore34copyClosingSubpathsApplierFunctionEPvPK13CGPathElement
-__ZNK7WebCore10FloatPointcv7CGPointEv
-__ZN7WebCore7Element14createRareDataEv
-__ZN7WebCore11rareDataMapEv
-__ZN3WTF7HashMapIPKN7WebCore7ElementEPNS1_15ElementRareDataENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3setERKS4_RKS6_
-__ZN3KJS17staticValueGetterIN7WebCore17JSHTMLBodyElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSHTMLBodyElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore15HTMLBodyElement10scrollLeftEv
-__ZNK7WebCore15HTMLBodyElement9scrollTopEv
-__ZNK7WebCore15HTMLAreaElement6targetEv
-__ZNK7WebCore12RenderInline10offsetLeftEv
-__ZNK7WebCore12RenderInline9offsetTopEv
-__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EEC2ERKS4_
-__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE6shrinkEm
-__ZN7WebCore39jsHTMLInputElementPrototypeFunctionBlurEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Element4blurEv
-__ZNK7WebCore16HTMLImageElement17canStartSelectionEv
-__ZN7WebCore38jsEventPrototypeFunctionPreventDefaultEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12EventHandler12mouseDraggedEP7NSEvent
-__ZN7WebCore12EventHandler27eventLoopHandleMouseDraggedERKNS_28MouseEventWithHitTestResultsE
-__ZNK7WebCore16HTMLImageElement5widthEb
-__ZNK7WebCore16HTMLImageElement6heightEb
-__ZN3WTF6VectorIN7WebCore9FrameDataELm0EE6shrinkEm
-__ZN7WebCore15rareDataFromMapEPKNS_7ElementE
-__ZN7WebCore15ElementRareData18resetComputedStyleEPNS_7ElementE
-__ZSt21__inplace_stable_sortIPPN7WebCore11RenderLayerEPFbS2_S2_EEvT_S6_T0_
-__ZN3KJS9MimeTypes18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS17staticValueGetterINS_9MimeTypesEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK3KJS9MimeTypes16getValuePropertyEPNS_9ExecStateEi
-__ZNK7WebCore9RenderBox15availableHeightEv
-__ZNK7WebCore9RenderBox20availableHeightUsingERKNS_6LengthE
-__ZN7WebCore9RenderBox20calcPercentageHeightERKNS_6LengthE
-__ZN7WebCore18createEmbedWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore27JSHTMLEmbedElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLEmbedElementC1EPN3KJS8JSObjectEPNS_16HTMLEmbedElementE
-__ZN7WebCore18JSHTMLEmbedElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18JSHTMLEmbedElement18canGetItemsForNameEPN3KJS9ExecStateEPNS_16HTMLEmbedElementERKNS1_10IdentifierE
-__ZN7WebCore18JSHTMLEmbedElement24customGetOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore37runtimeObjectCustomGetOwnPropertySlotEPN3KJS9ExecStateERKNS0_10IdentifierERNS0_12PropertySlotEPNS_13JSHTMLElementEPNS_11HTMLElementE
-__ZN7WebCore16getRuntimeObjectEPN3KJS9ExecStateEPNS_4NodeE
-__ZNK7WebCore16HTMLEmbedElement11getInstanceEv
-__ZN7WebCore5Frame29createScriptInstanceForWidgetEPNS_6WidgetE
-__Z16createRootObjectPv
-__ZN7WebCore5Frame16createRootObjectEPvPN3KJS14JSGlobalObjectE
-__ZN3WTF7HashMapIPvNS_6RefPtrIN3KJS8Bindings10RootObjectEEENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS9_IS6_EEE3setERKS1_RKS6_
-__ZN7WebCore27JSHTMLEmbedElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSHTMLEmbedElement9classInfoEv
-__ZN7WebCore12EventHandler27handleMouseDoubleClickEventERKNS_18PlatformMouseEventE
-__ZN7WebCore27runtimeObjectPropertyGetterEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore18JSHTMLEmbedElement10nameGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore19runtimeObjectGetterEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_10IdentifierERKNS0_12PropertySlotE
-__ZN7WebCore17HTMLPlugInElement19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore6Widget11handleEventEPNS_5EventE
-__ZN7WebCore12EventHandler10wheelEventEP7NSEvent
-__ZN7WebCore18PlatformWheelEventC2EP7NSEvent
-__ZN7WebCore12EventHandler16handleWheelEventERNS_18PlatformWheelEventE
-__ZN7WebCore12EventHandler22passWheelEventToWidgetERNS_18PlatformWheelEventEPNS_6WidgetE
-__ZN7WebCore15EventTargetNode18dispatchWheelEventERNS_18PlatformWheelEventE
-__ZN7WebCore10WheelEventC2EffPNS_9DOMWindowEiiiibbbb
-__ZNK7WebCore10WheelEvent12isWheelEventEv
-__ZN7WebCore21JSWheelEventPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore12JSWheelEventC1EPN3KJS8JSObjectEPNS_10WheelEventE
-__ZN7WebCore12JSWheelEvent18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore12JSWheelEvent9classInfoEv
-__ZN7WebCore12RenderObject6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
-__ZN7WebCore11RenderLayer6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
-__ZN7WebCore10ScrollView10wheelEventERNS_18PlatformWheelEventE
-__ZN7WebCore24JSKeyboardEventPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore15JSKeyboardEvent9classInfoEv
-__ZN7WebCore12EventHandler26passMouseDownEventToWidgetEPNS_6WidgetE
-__ZN7WebCore18lastEventIsMouseUpEv
-__ZN7WebCore18findViewInSubviewsEP6NSViewS1_
-__ZN7WebCore21HTMLFrameOwnerElement10willRemoveEv
-__ZN7WebCore16HTMLEmbedElement19removedFromDocumentEv
-__ZNK7WebCore11RenderTheme13supportsHoverEPKNS_11RenderStyleE
-__ZN7WebCore17RenderTextControl11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZNK7WebCore19HTMLTextAreaElement9saveStateERNS_6StringE
-__ZNK7WebCore19HTMLTextAreaElement5valueEv
-__ZNK7WebCore19HTMLTextAreaElement11updateValueEv
-__ZNK7WebCore19HTMLTextAreaElement4typeEv
-__ZN7WebCore11JSDOMWindow14deletePropertyEPN3KJS9ExecStateERKNS1_10IdentifierE
-__ZN7WebCore11FrameLoader16detachFromParentEv
-__ZN7WebCore19InspectorController23frameDetachedFromParentEPNS_5FrameE
-__ZN7WebCore9FrameTree11removeChildEPNS_5FrameE
-__ZN7WebCore5Frame13pageDestroyedEv
-__ZN3KJS6Window15disconnectFrameEv
-__ZN7WebCore11FrameLoader22scheduleCheckCompletedEv
--[WebCoreFrameBridge close]
--[WebCoreFrameBridge clearFrame]
--[WebCoreFrameBridge dealloc]
-__ZN7WebCore11FrameLoader14cancelAndClearEv
-__ZN7WebCore5Frame22disconnectOwnerElementEv
-__ZN7WebCore9DOMWindow15disconnectFrameEv
-__ZN7WebCore12FramePrivateD2Ev
-__ZN7WebCore8KJSProxyD2Ev
-__ZN3KJS12ProtectedPtrIN7WebCore11JSDOMWindowEED1Ev
-__ZN7WebCore11FrameLoaderD2Ev
-__ZN7WebCore11FrameLoader9setOpenerEPNS_5FrameE
--[DOMAbstractView dealloc]
-__ZN7WebCore15removeJSWrapperEPN3KJS8JSObjectE
-__ZN7WebCore19AnimationControllerD1Ev
-__ZN7WebCore26AnimationControllerPrivateD1Ev
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore26CompositeImplicitAnimationEKNS_7HashMapIPNS1_12RenderObjectES3_NS_7PtrHashIS6_EENS_10HashTraitsIS6_EENS9_IS3_EEEEEEvRT0_
-__ZN7WebCore12EventHandlerD2Ev
-__ZN7WebCore6EditorD2Ev
-__ZN7WebCore9FrameTreeD2Ev
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11EditCommandEEELm0EE6shrinkEm
-__ZN7WebCore11EditCommandD0Ev
-__ZN7WebCore8Document10setIconURLERKNS_6StringES3_
-__ZN7WebCore31JSHTMLTableCellElementPrototypeD0Ev
-__ZN7WebCore25JSHTMLMapElementPrototypeD0Ev
-__ZN3KJS25JSXMLHttpRequestPrototypeD0Ev
-__ZN7WebCore21JSWheelEventPrototypeD0Ev
-__ZN7WebCore27JSHTMLStyleElementPrototypeD0Ev
-__ZN7WebCore26JSHTMLHtmlElementPrototypeD0Ev
-__ZN7WebCore24JSHTMLBRElementPrototypeD0Ev
-__ZN7WebCore17HTMLIFrameElementD1Ev
-__ZN7WebCore17HTMLSelectElementD1Ev
-__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE6shrinkEm
-__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE6shrinkEm
-__ZN7WebCore17HTMLOptionElementD1Ev
-__ZN7WebCore5Cache18pruneDeadResourcesEv
-__ZNK7WebCore5Cache12deadCapacityEv
-__ZN7WebCore5Cache18pruneLiveResourcesEv
-__ZNK7WebCore5Cache12liveCapacityEv
-__ZN7WebCore16CSSStyleSelector23mapBackgroundAttachmentEPNS_15BackgroundLayerEPNS_8CSSValueE
-__ZN7WebCore8Document25registerForCacheCallbacksEPNS_7ElementE
-__ZN3WTF7HashSetIPN7WebCore7ElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZNK7WebCore4KURL3refEv
-__ZN3KJS17staticValueGetterIN7WebCore14JSHTMLDocumentEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore14JSHTMLDocument16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore14JSHTMLDocument3allEPN3KJS9ExecStateE
-__ZN7WebCore8Document3allEv
-__ZNK7WebCore19JSHTMLAllCollection9toBooleanEPN3KJS9ExecStateE
-__ZN7WebCore15GraphicsContext8drawLineERKNS_8IntPointES3_
-__ZNK7WebCore26NetscapePlugInStreamLoader6isDoneEv
-__ZN7WebCore26NetscapePlugInStreamLoader9didCancelERKNS_13ResourceErrorE
-__ZN7WebCore9FrameView14setMarginWidthEi
-__ZN7WebCore9FrameView15setMarginHeightEi
--[WebCoreFrameBridge stringByEvaluatingJavaScriptFromString:forceUserGesture:]
-__ZN7WebCore11RenderLayer19transparentAncestorEv
-__ZN7WebCore9FrameView18setUseSlowRepaintsEv
-__ZN7WebCore11FrameLoader13frameDetachedEv
-__ZN7WebCore17HTMLIFrameElement19removedFromDocumentEv
-__ZN7WebCore20HTMLFrameElementBase19removedFromDocumentEv
-__ZN7WebCore11FrameLoader24checkCompletedTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore11ImageSource22frameIsCompleteAtIndexEm
-__ZN7WebCore11BitmapImage20frameDurationAtIndexEm
-__ZNK7WebCore6Screen10colorDepthEv
-__ZN7WebCore15defaultLanguageEv
-__ZN7WebCore11RenderTable11splitColumnEii
-__ZN7WebCore18RenderTableSection11splitColumnEii
-__ZN7WebCore5TimerINS_11BitmapImageEE5firedEv
-__ZN7WebCore11BitmapImage16advanceAnimationEPNS_5TimerIS0_EE
-__ZThn256_N7WebCore11CachedImage20shouldPauseAnimationEPKNS_5ImageE
-__ZN7WebCore11CachedImage20shouldPauseAnimationEPKNS_5ImageE
-__ZN7WebCore20CachedResourceClient15willRenderImageEPNS_11CachedImageE
-__ZN7WebCore12RenderObject15willRenderImageEPNS_11CachedImageE
-__ZNK7WebCore10ScrollView8inWindowEv
-__ZThn256_N7WebCore11CachedImage17animationAdvancedEPKNS_5ImageE
-__ZN7WebCore11CachedImage17animationAdvancedEPKNS_5ImageE
-__ZNK7WebCore16HTMLImageElement14isURLAttributeEPNS_9AttributeE
-__ZN7WebCore27RenderTextControlInnerBlock11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
--[WebCoreFrameBridge sendScrollEvent]
-__ZN7WebCore5Frame15sendScrollEventEv
-__ZN7WebCore9FrameView20setWasScrolledByUserEb
-__ZN7WebCore14ResourceLoader15willSendRequestEPNS_14ResourceHandleERNS_15ResourceRequestERKNS_16ResourceResponseE
-__ZN7WebCore23SubresourceLoaderClient15willSendRequestEPNS_17SubresourceLoaderERNS_15ResourceRequestERKNS_16ResourceResponseE
-__ZN7WebCore14RenderMenuList11removeChildEPNS_12RenderObjectE
-__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE6shrinkEm
-__ZN7WebCore11FrameLoader23haveToldClientAboutLoadERKNS_6StringE
-__ZN7WebCore16HTMLTitleElement19removedFromDocumentEv
-__ZN7WebCore8Document11removeTitleEPNS_7ElementE
-__ZN3WTF6VectorIN7WebCore5Cache7LRUListELm32EE6resizeEm
-__ZN7WebCore8Document27unregisterForCacheCallbacksEPNS_7ElementE
-__ZN7WebCore11hashForFontERKNS_6StringEbb
-__ZN3WTF7HashMapIN7WebCore6StringENS_6RefPtrINS1_20CSSSegmentedFontFaceEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERKS2_RKS5_
-__ZN3WTF6VectorIPKN7WebCore8FontDataELm1EE14expandCapacityEmPKS4_
-__ZN3WTF6VectorIPKN7WebCore8FontDataELm1EE14expandCapacityEm
-__ZN3WTF6VectorIPKN7WebCore8FontDataELm1EE15reserveCapacityEm
-__ZN7WebCore9FontCache26getSimilarFontPlatformDataERKNS_4FontE
-__ZNK7WebCore8Document12lastModifiedEv
-__ZNK7WebCore15HTMLBodyElement12scrollHeightEv
-__ZNK7WebCore6Screen11availHeightEv
-__ZNK7WebCore9DOMWindow4nameEv
-__ZN7WebCore18MainResourceLoader9didCancelERKNS_13ResourceErrorE
-__ZN7WebCore11FrameLoader25receivedMainResourceErrorERKNS_13ResourceErrorEb
-__ZN7WebCore11FrameLoader4stopEv
-__ZN7WebCore17ResourceErrorBase8lazyInitEv
-__ZN7WebCore11FrameLoader13didNotOpenURLERKNS_4KURLE
-__ZN7WebCore11FrameLoader31invalidateCurrentItemCachedPageEv
-__ZN7WebCore14DocumentLoader17mainReceivedErrorERKNS_13ResourceErrorEb
-__ZN7WebCore11FrameLoader25mainReceivedCompleteErrorEPNS_14DocumentLoaderERKNS_13ResourceErrorE
-__ZN7WebCore11FrameLoader20clearProvisionalLoadEv
-__ZN7WebCore16FixedTableLayoutC2EPNS_11RenderTableE
+__ZN3WTF6VectorIN7WebCore16ResourceResponseELm0EE6shrinkEm
+__ZNK7WebCore12RenderObject13hoverAncestorEv
+__ZN7WebCore17HTMLAnchorElement9setActiveEbb
+__ZN7WebCore12RenderInline29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZNK7WebCore12RenderInline16linesBoundingBoxEv
+__ZN7WebCore10handCursorEv
+__ZN7WebCoreL15leakNamedCursorEPKcii
+__ZNK7WebCore12RenderObject23mapAbsoluteToLocalPointEbbRNS_14TransformStateE
+__ZN7WebCore17HTMLAnchorElement19defaultEventHandlerEPNS_5EventE
+__ZNK7WebCore13HitTestResult11targetFrameEv
+__ZNK7WebCore17HTMLAnchorElement6targetEv
+__ZNK7WebCore13RootInlineBox11ellipsisBoxEv
+__ZN7WebCore15GraphicsContext18setStrokeThicknessEf
+__ZN7WebCore15GraphicsContext26setPlatformStrokeThicknessEf
+__ZN7WebCore15GraphicsContext14setStrokeColorERKNS_5ColorE
+__ZN7WebCore15GraphicsContext15drawLineForTextERKNS_8IntPointEib
+__ZNK7WebCore15GraphicsContext15strokeThicknessEv
+__ZN7WebCore15GraphicsContext19roundToDevicePixelsERKNS_9FloatRectE
+__ZNK7WebCore15GraphicsContext15shouldAntialiasEv
+__ZN7WebCoreL32fontCacheATSNotificationCallbackEP27ATSFontNotificationInfoRef_Pv
+__ZN7WebCore9FontCache10invalidateEv
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore16FontPlatformDataEKNS_7HashMapINS1_24FontPlatformDataCacheKeyES3_NS1_28FontPlatformDa
+__ZN7WebCore15CSSFontSelector20fontCacheInvalidatedEv
+__ZN7WebCore9FontCache21purgeInactiveFontDataEi
+__ZN7WebCore14SimpleFontDataD0Ev
+__ZN7WebCore14SimpleFontData15platformDestroyEv
+__ZN7WebCore17GlyphPageTreeNode17pruneTreeFontDataEPKNS_14SimpleFontDataE
+__ZN7WebCore17GlyphPageTreeNode13pruneFontDataEPKNS_14SimpleFontDataEj
+__ZN7WebCore17GlyphPageTreeNodeD1Ev
+__ZN7WebCore17GlyphPageTreeNodeD2Ev
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore17GlyphPageTreeNodeEKNS_7HashMapIPKNS1_8FontDataES3_NS_7PtrHashIS7_EENS_10HashTraitsIS
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore13GlyphWidthMap14GlyphWidthPageEKNS_7HashMapIiS4_NS_7IntHashIjEENS_10HashTraitsIiEENS8
+__ZN7WebCore8FontDataD2Ev
+__ZN3WTF11ListHashSetIPKN7WebCore14SimpleFontDataENS_7PtrHashIS4_EEE14deleteAllNodesEv
+__ZNK3WTF9HashTableIN7WebCore16FontPlatformDataESt4pairIS2_S3_IPNS1_14SimpleFontDataEjEENS_18PairFirstExtractorIS7_EENS1_20Font
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore12FontSelectorEEELm0EE6shrinkEm
+__ZN7WebCore21DeprecatedPtrListImpl5clearEb
+__ZN7WebCore17DeprecatedPtrListINS_11RenderBlock14FloatingObjectEE10deleteFuncEPv
+__ZN7WebCore21DeprecatedPtrListImpl4takeEv
+__ZN7WebCore21DeprecatedPtrListImpl6removeEb
+__ZN3WTF7HashMapIPN7WebCore12RenderObjectEPNS1_11RenderBlock14FloatingObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3
+__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_PNS1_11RenderBlock14FloatingObjectEENS_18PairFirstExtractorIS8_EENS_7Ptr
+__ZN7WebCore13InlineFlowBoxD0Ev
+__ZN7WebCore11RenderTheme17adjustRepaintRectEPKNS_12RenderObjectERNS_7IntRectE
+__ZNK7WebCore8ThemeMac23inflateControlPaintRectENS_11ControlPartEjRNS_7IntRectEf
+__ZN7WebCore9RenderBox26repaintDuringLayoutIfMovedERKNS_7IntRectE
+__ZN7WebCore11HistoryItemD1Ev
+__ZN7WebCore11HistoryItemD2Ev
+__ZN7WebCore12IconDatabase21releaseIconForPageURLERKNS_6StringE
+__ZN3WTF6VectorIiLm0EE6shrinkEm
+__ZNK7WebCore14RenderThemeMac20supportsControlTintsEv
+__ZN7WebCore15GraphicsContext23setUpdatingControlTintsEb
+__ZNK7WebCore14RenderThemeMac20controlSupportsTintsEPKNS_12RenderObjectE
+__ZN7WebCore9PageCache27releaseAutoreleasedPagesNowEv
+__ZN7WebCore22ScriptExecutionContext26canSuspendActiveDOMObjectsEv
+__ZN7WebCore5Frame14clearDOMWindowEv
+__ZN3WTF7HashSetIPN7WebCore9DOMWindowENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTabl
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTa
+__ZN7WebCore9DOMWindow5clearEv
+__ZN7WebCore9Navigator15disconnectFrameEv
+__ZN7WebCore16ScriptController16clearWindowShellEv
+__ZN7WebCore15JSDOMWindowBase5clearEv
+__ZN7WebCore15JSDOMWindowBase27clearHelperObjectPropertiesEv
+__ZN7WebCore12gcControllerEv
+__ZN7WebCore12GCControllerC1Ev
+__ZN7WebCore12GCControllerC2Ev
+__ZN7WebCore12GCController18garbageCollectSoonEv
+__ZN7WebCore16ScriptController18clearScriptObjectsEv
+__ZN3JSC8Bindings10RootObject10invalidateEv
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E5clearEv
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dealloca
+__ZN3WTF9HashTableIPN3JSC8Bindings10RootObjectES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E4findIS
+__ZN3WTF9HashTableIPN3JSC8Bindings10RootObjectES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E47remov
+__ZN3WTF9HashTableIPN3JSC8Bindings10RootObjectES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6remove
+-[WebScriptObject _setOriginRootObject:andRootObject:]
+__ZN3JSC8Bindings10RootObjectD1Ev
+__ZN3JSC8Bindings10RootObjectD2Ev
+__ZN7WebCore5Frame25setUseSecureKeyboardEntryEb
+__ZN7WebCore12SharedBuffer6appendEPKci
+__ZN7WebCore12SharedBuffer25maybeTransferPlatformDataEv
+__ZN7WebCore9CSSParser11parseShadowEib
+__ZN7WebCore18ShadowParseContext11commitValueEv
+__ZN7WebCore11ShadowValueC1EN3WTF10PassRefPtrINS_17CSSPrimitiveValueEEES4_S4_S4_
+__ZN7WebCore11ShadowValueC2EN3WTF10PassRefPtrINS_17CSSPrimitiveValueEEES4_S4_S4_
+__ZN7WebCore9CSSParser14createRuleListEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSRuleListEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSRuleListEEELm0EE15reserveCapacityEm
+__ZN7WebCore9CSSParser15createMediaRuleEPNS_9MediaListEPNS_11CSSRuleListE
+__ZN7WebCore12CSSMediaRuleC1EPNS_13CSSStyleSheetEN3WTF10PassRefPtrINS_9MediaListEEENS4_INS_11CSSRuleListEEE
+__ZN7WebCore12CSSMediaRuleC2EPNS_13CSSStyleSheetEN3WTF10PassRefPtrINS_9MediaListEEENS4_INS_11CSSRuleListEEE
+__ZN7WebCore9CSSParser27createFloatingMediaQueryExpERKNS_12AtomicStringEPNS_18CSSParserValueListE
+__ZN7WebCore13MediaQueryExpC1ERKNS_12AtomicStringEPNS_18CSSParserValueListE
+__ZN7WebCore13MediaQueryExpC2ERKNS_12AtomicStringEPNS_18CSSParserValueListE
+__ZN7WebCore9CSSParser25sinkFloatingMediaQueryExpEPNS_13MediaQueryExpE
+__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE15reserveCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSRuleListEEELm0EE6shrinkEm
+__ZN7WebCore12CSSMediaRule11isMediaRuleEv
+__ZNK7WebCore19MediaQueryEvaluator4evalEPKNS_13MediaQueryExpE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPFbPNS1_8CSSValueEPNS1_11RenderStyleEPNS1_5FrameENS1_18MediaFeaturePrefixEENS_7Pt
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PFbPNS1_8CSSValueEPNS1_11RenderStyleEPNS1_5FrameENS1_18MediaFeatureP
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFbPNS1_8CSSValueEPNS1_11RenderStyleEPNS1_5FrameENS1_18MediaFeaturePrefixEENS_7P
+__ZN7WebCoreL32max_device_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL28device_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore10screenRectEPNS_6WidgetE
+__ZN7WebCore11toUserSpaceERK6CGRectP8NSWindow
+__ZN7WebCore9FloatRectC1ERK6CGRect
+__ZN7WebCore9FloatRectC2ERK6CGRect
+__ZN7WebCore10FloatPointC1ERK7CGPoint
+__ZN7WebCore10FloatPointC2ERK7CGPoint
+__ZN7WebCore9FloatSizeC1ERK6CGSize
+__ZN7WebCore9FloatSizeC2ERK6CGSize
+__ZN7WebCore9FloatRect5scaleEf
+__ZN7WebCore17CSSPrimitiveValue16computeLengthIntEPNS_11RenderStyleE
+__ZN7WebCore12compareValueIiEEbT_S1_NS_18MediaFeaturePrefixE
+__ZN7WebCore17jsDOMWindowOnloadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6onloadEv
+__ZNK7WebCore9DOMWindow25getAttributeEventListenerERKNS_12AtomicStringE
+__ZN7WebCore16JSDOMWindowShell3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore11JSDOMWindow3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore20setJSDOMWindowOnloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17JSDOMGlobalObject30createJSAttributeEventListenerEN3JSC7JSValueE
+__ZN7WebCore9DOMWindow9setOnloadEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore9DOMWindow25setAttributeEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore9DOMWindow27clearAttributeEventListenerERKNS_12AtomicStringE
+__ZN7WebCore20StringSourceProviderD0Ev
+__ZN7WebCoreL16ulistConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLUListElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLUListElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore16HTMLUListElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore16HTMLUListElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore16HTMLUListElement17endTagRequirementEv
+__ZNK7WebCore16HTMLUListElement11tagPriorityEv
+__ZN7WebCore10HTMLParser29nestedPCloserCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCoreL13liConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore13HTMLLIElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore13HTMLLIElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore13HTMLLIElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore13HTMLLIElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore13HTMLLIElement17endTagRequirementEv
+__ZNK7WebCore13HTMLLIElement11tagPriorityEv
+__ZN7WebCore13HTMLLIElement6attachEv
+__ZN7WebCore15FormDataBuilder15parseMethodTypeERKNS_6StringE
+__ZN7WebCore12RenderInline9splitFlowEPNS_12RenderObjectEPNS_11RenderBlockES2_PNS_20RenderBoxModelObjectE
+__ZN7WebCore12RenderInline12splitInlinesEPNS_11RenderBlockES2_S2_PNS_12RenderObjectEPNS_20RenderBoxModelObjectE
+__ZN7WebCore12RenderInline11cloneInlineEPS0_
+__ZNK7WebCore14RenderThemeMac22adjustSearchFieldStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZNK7WebCore14RenderThemeMac18setSearchFieldSizeEPNS_11RenderStyleE
+__ZNK7WebCore14RenderThemeMac16searchFieldSizesEv
+__ZN7WebCore12RenderInline22addChildToContinuationEPNS_12RenderObjectES2_
+__ZN7WebCore12RenderInline18continuationBeforeEPNS_12RenderObjectE
+__ZN7WebCoreL16nextContinuationEPNS_12RenderObjectE
+__ZN7WebCore23TextControlInnerElementC1EPNS_8DocumentEPNS_4NodeE
+__ZNK7WebCore27RenderTextControlSingleLine21createInnerBlockStyleEPKNS_11RenderStyleE
+__ZN7WebCore31SearchFieldResultsButtonElementC1EPNS_8DocumentE
+__ZN7WebCore31SearchFieldResultsButtonElementC2EPNS_8DocumentE
+__ZNK7WebCore27RenderTextControlSingleLine24createResultsButtonStyleEPKNS_11RenderStyleE
+__ZN7WebCore11RenderStyle20getCachedPseudoStyleENS_8PseudoIdE
+__ZNK7WebCore14RenderThemeMac32adjustSearchFieldDecorationStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZNK7WebCore14RenderThemeMac18resultsButtonSizesEv
+__ZN7WebCore11RenderStyle20addCachedPseudoStyleEN3WTF10PassRefPtrIS0_EE
+__ZN7WebCore30SearchFieldCancelButtonElementC1EPNS_8DocumentE
+__ZN7WebCore30SearchFieldCancelButtonElementC2EPNS_8DocumentE
+__ZNK7WebCore27RenderTextControlSingleLine23createCancelButtonStyleEPKNS_11RenderStyleE
+__ZNK7WebCore14RenderThemeMac34adjustSearchFieldCancelButtonStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZNK7WebCore14RenderThemeMac17cancelButtonSizesEv
+__ZNK7WebCore27RenderTextControlSingleLine25visibilityForCancelButtonEv
+__ZNK7WebCore27RenderTextControlSingleLine28updateCancelButtonVisibilityEv
+__ZN7WebCore11RenderStyle17setHasPseudoStyleENS_8PseudoIdE
+__ZNK7WebCore8CSSValue21isImageGeneratorValueEv
+__ZN7WebCore11RenderStyle10setContentEN3WTF10PassRefPtrINS_10StringImplEEEb
+__ZN7WebCore11ContentData13deleteContentEv
+__ZN7WebCoreL17iframeConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLIFrameElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17HTMLIFrameElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore20HTMLFrameElementBaseC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore21HTMLFrameOwnerElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore17HTMLIFrameElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore17HTMLIFrameElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore20HTMLFrameElementBase20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore20HTMLFrameElementBase11setLocationERKNS_6StringE
+__ZNK7WebCore17HTMLIFrameElement17endTagRequirementEv
+__ZNK7WebCore17HTMLIFrameElement11tagPriorityEv
+__ZN7WebCore17HTMLIFrameElement20insertedIntoDocumentEv
+__ZN7WebCore20HTMLFrameElementBase20insertedIntoDocumentEv
+__ZN7WebCore17HTMLIFrameElement6attachEv
+__ZN7WebCore20HTMLFrameElementBase6attachEv
+__ZN7WebCore13ContainerNode23queuePostAttachCallbackEPFvPNS_4NodeEES2_
+__ZN3WTF6VectorISt4pairIPFvPN7WebCore4NodeEENS_6RefPtrIS3_EEELm0EE14expandCapacityEmPKS9_
+__ZN3WTF6VectorISt4pairIPFvPN7WebCore4NodeEENS_6RefPtrIS3_EEELm0EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIPFvPN7WebCore4NodeEENS_6RefPtrIS3_EEELm0EE15reserveCapacityEm
+__ZN7WebCore17HTMLIFrameElement16rendererIsNeededEPNS_11RenderStyleE
+__ZNK7WebCore20HTMLFrameElementBase12isURLAllowedERKNS_12AtomicStringE
+__ZN7WebCore16equalIgnoringRefERKNS_4KURLES2_
+__ZN7WebCore17HTMLIFrameElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore16RenderPartObjectC1EPNS_7ElementE
+__ZN7WebCore16RenderPartObjectC2EPNS_7ElementE
+__ZN7WebCore10RenderPartC2EPNS_7ElementE
+__ZN7WebCore12RenderWidgetC2EPNS_4NodeE
+__ZN7WebCore10RenderView9addWidgetEPNS_12RenderWidgetE
+__ZN3WTF7HashSetIPN7WebCore12RenderWidgetENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore12RenderWidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore12RenderWidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore12RenderWidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocate
+__ZN7WebCore12RenderWidget14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore13ContainerNode27dispatchPostAttachCallbacksEv
+__ZN7WebCore20HTMLFrameElementBase25setNameAndOpenURLCallbackEPNS_4NodeE
+__ZN7WebCore20HTMLFrameElementBase17setNameAndOpenURLEv
+__ZNK7WebCore9FrameTree15uniqueChildNameERKNS_12AtomicStringE
+__ZN7WebCore20HTMLFrameElementBase7openURLEv
+__ZN7WebCore11FrameLoader12requestFrameEPNS_21HTMLFrameOwnerElementERKNS_6StringERKNS_12AtomicStringE
+__ZN7WebCore11FrameLoader11completeURLERKNS_6StringE
+__ZN7WebCore11FrameLoader12loadSubframeEPNS_21HTMLFrameOwnerElementERKNS_4KURLERKNS_6StringES8_
+__ZNK7WebCore20HTMLFrameElementBase13scrollingModeEv
+__ZN7WebCore9FrameTree11appendChildEN3WTF10PassRefPtrINS_5FrameEEE
+__ZNK7WebCore10RenderPart12isRenderPartEv
+__ZN7WebCore10RenderPart9setWidgetEPNS_6WidgetE
+__ZNK7WebCore9FrameView11isFrameViewEv
+__ZN7WebCore12RenderWidget9setWidgetEPNS_6WidgetE
+__ZN3WTF7HashMapIPKN7WebCore6WidgetEPNS1_12RenderWidgetENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3addERKS4_RKS6_
+__ZN3WTF9HashTableIPKN7WebCore6WidgetESt4pairIS4_PNS1_12RenderWidgetEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHa
+__ZN7WebCore10ScrollView8addChildEPNS_6WidgetE
+__ZN7WebCore10ScrollView9setParentEPS0_
+__ZN7WebCore6Widget9setParentEPNS_10ScrollViewE
+__ZN3WTF7HashSetIPN7WebCore6WidgetENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
+__ZN7WebCore10ScrollView16platformAddChildEPNS_6WidgetE
+__ZN7WebCore16RenderPartObject11viewClearedEv
+__ZN7WebCore9FrameView20setCanHaveScrollbarsEb
+__ZN7WebCore10ScrollView20setCanHaveScrollbarsEb
+__ZNK7WebCore14SecurityOrigin9canAccessEPKS0_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE6shrinkEm
+__ZN7WebCore11FrameLoader21loadURLIntoChildFrameERKNS_4KURLERKNS_6StringEPNS_5FrameE
+__ZN7WebCore11FrameLoader18currentHistoryItemEv
+__ZNK7WebCore11HistoryItem8childrenEv
+__ZN7WebCore14DocumentLoader21popArchiveForSubframeERKNS_6StringE
+__ZN7WebCore14ResourceHandle16setDefersLoadingEb
+__ZNK7WebCore12RenderWidget8isWidgetEv
+__ZN7WebCore5Frame19setInViewSourceModeEb
+__ZN3WTF6VectorISt4pairIPFvPN7WebCore4NodeEENS_6RefPtrIS3_EEELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorISt4pairIPFvPN7WebCore4NodeEENS_6RefPtrIS3_EEELm0EE6shrinkEm
+__ZN7WebCore16RenderPartObject12updateWidgetEb
+__ZN7WebCore14RenderListItemC1EPNS_4NodeE
+__ZN7WebCore14RenderListItemC2EPNS_4NodeE
+__ZN7WebCore14RenderListItem14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore14RenderListItem10isListItemEv
+__ZN7WebCore14RenderListItem18clearExplicitValueEv
+__ZN7WebCoreL20paragraphConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore20HTMLParagraphElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore20HTMLParagraphElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore20HTMLParagraphElement17endTagRequirementEv
+__ZNK7WebCore20HTMLParagraphElement11tagPriorityEv
+__ZN7WebCore20HTMLParagraphElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore11HTMLElement15inInlineTagListEPKNS_4NodeE
 __ZN7WebCore14RenderListItem11updateValueEv
-__ZN7WebCore16FixedTableLayout14calcPrefWidthsERiS1_
-__ZN7WebCore16FixedTableLayout14calcWidthArrayEi
-__ZN3WTF6VectorIN7WebCore6LengthELm0EE6resizeEm
-__ZN3WTF6VectorIN7WebCore6LengthELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore6LengthELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIN7WebCore6LengthELm0EE4fillERKS2_m
-__ZSt4fillIPN7WebCore6LengthES1_EvT_S3_RKT0_
-__ZN7WebCore16FixedTableLayout6layoutEv
-__ZN7WebCore11RenderTable19getOverflowClipRectEii
-__ZN7WebCore11HistoryItem17setAlternateTitleERKNS_6StringE
-__ZN3WTF6VectorIN7WebCore6LengthELm0EE6shrinkEm
+__ZNK7WebCore20HTMLParagraphElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore20HTMLParagraphElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCoreleERNS_11CSSRuleDataES1_
+__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm0EE6shrinkEm
+__ZN7WebCore10StringImpl7replaceEPS0_S1_
+__ZN7WebCore22characterBreakIteratorEPKti
+__ZN7WebCoreL16olistConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLOListElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLOListElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore16HTMLOListElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore16HTMLOListElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore16HTMLOListElement17endTagRequirementEv
+__ZNK7WebCore16HTMLOListElement11tagPriorityEv
+__ZN7WebCore16RenderListMarkerC1EPNS_14RenderListItemE
+__ZN7WebCore16RenderListMarkerC2EPNS_14RenderListItemE
+__ZN7WebCore16RenderListMarker15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore16RenderListMarker14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore26CSSMutableStyleDeclaration21removePropertiesInSetEPKijb
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EEaSERKS3_
+__ZN7WebCoreL30createHTMLIFrameElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLIFrameElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLIFrameElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLIFrameElementEEE
+__ZN7WebCore19JSHTMLIFrameElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLIFrameElementEEE
+__ZN7WebCore19JSHTMLIFrameElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore9JSElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore6JSNode3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore15setJSNodeOnloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node9setOnloadEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZNK3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_7ElementEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14P
+__ZN7WebCore20JSNavigatorPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18jsDocumentLocationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore10JSDocument8locationEPN3JSC9ExecStateE
+__ZNK7WebCore9DOMWindow8locationEv
+__ZN7WebCore8LocationC1EPNS_5FrameE
+__ZN7WebCore8LocationC2EPNS_5FrameE
+__ZN7WebCore10JSLocation15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSLocationC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8LocationEEE
+__ZN7WebCore10JSLocationC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8LocationEEE
+__ZN7WebCore10JSLocation18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore10JSLocation24customGetOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21allowsAccessFromFrameEPN3JSC9ExecStateEPNS_5FrameERNS_6StringE
+__ZN7WebCore16jsLocationSearchEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Location6searchEv
+__ZNK7WebCore4KURL5queryEv
+__ZN7WebCore21jsNavigatorAppVersionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9Navigator10appVersionEv
+__ZNK7WebCore13NavigatorBase10appVersionEv
+__ZN7WebCore15JSDOMWindowBase3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore11JSDOMWindow4markEv
+__ZN7WebCore17JSDOMGlobalObject4markEv
+__ZN7WebCore16JSDOMWindowShell4markEv
+__ZN7WebCore10JSDocument4markEv
+__ZN7WebCore6JSNode4markEv
+__ZN7WebCore23markDOMNodesForDocumentEPNS_8DocumentE
+__ZN7WebCore15JSEventListener14markJSFunctionEv
+__ZN7WebCore27markActiveObjectsForContextERN3JSC12JSGlobalDataEPNS_22ScriptExecutionContextE
+__ZN7WebCore20markDOMObjectWrapperERN3JSC12JSGlobalDataEPv
+__ZN7WebCore11JSNavigator4markEv
+__ZN7WebCore20JSDOMWindowPrototypeD1Ev
+__ZN7WebCore11JSDOMWindowD1Ev
+__ZN7WebCore11JSDOMWindowD2Ev
+__ZN7WebCore15JSDOMWindowBaseD2Ev
+__ZN7WebCore17JSDOMGlobalObjectD2Ev
+__ZN7WebCore15JSDOMWindowBase19JSDOMWindowBaseDataD0Ev
+__ZN7WebCore9DOMWindowD0Ev
+__ZN7WebCore5Frame20clearFormerDOMWindowEPNS_9DOMWindowE
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInv
+__ZN3WTF9HashTableIPN7WebCore9DOMWindowES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN3JSC14JSGlobalObject18JSGlobalObjectDataD2Ev
+__ZN3WTF9HashTableIPN3JSC16ProgramCodeBlockES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dealloca
+__ZN7WebCore15JSNodePrototypeD1Ev
+__ZN7WebCore19JSDocumentPrototypeD1Ev
+__ZN7WebCore23JSHTMLDocumentPrototypeD1Ev
+__ZN7WebCore14JSHTMLDocumentD1Ev
+__ZN7WebCore10JSDocumentD2Ev
+__ZN7WebCore15forgetDOMObjectERN3JSC12JSGlobalDataEPv
+__ZN3WTF7HashMapIPvPN7WebCore9DOMObjectENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS7_IS4_EEE4takeERKS1_
+__ZN7WebCore6JSNodeD2Ev
+__ZN7WebCore13forgetDOMNodeEPNS_8DocumentEPNS_4NodeE
+__ZN3WTF7HashMapIPN7WebCore4NodeEPNS1_6JSNodeENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE4takeERKS3_
+__ZN3WTF9HashTableIPN7WebCore4NodeESt4pairIS3_PNS1_6JSNodeEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsIN
+__ZN7WebCore16JSEventPrototypeD1Ev
+__ZN7WebCore7JSEventD1Ev
+__ZN7WebCore7JSEventD2Ev
+__ZN7WebCore20JSNavigatorPrototypeD1Ev
+__ZN7WebCore11JSNavigatorD1Ev
+__ZN7WebCore11JSNavigatorD2Ev
+__ZN7WebCore9NavigatorD0Ev
+__ZN7WebCore13NavigatorBaseD2Ev
+__ZN7WebCore18JSElementPrototypeD1Ev
+__ZN7WebCore22JSHTMLElementPrototypeD1Ev
+__ZN7WebCore27JSHTMLMediaElementPrototypeD1Ev
+__ZN7WebCore27JSHTMLAudioElementPrototypeD1Ev
+__ZN7WebCore18JSHTMLAudioElementD1Ev
+__ZN7WebCore27JSHTMLVideoElementPrototypeD1Ev
+__ZN7WebCore18JSHTMLVideoElementD1Ev
+__ZN7WebCore26CachedScriptSourceProviderD0Ev
+__ZN7WebCore5Cache27removeFromLiveResourcesSizeEPNS_14CachedResourceE
+__ZN7WebCore12CachedScript17allClientsRemovedEv
+__ZN7WebCore19JSNodeListPrototypeD1Ev
+__ZN7WebCore10JSNodeListD1Ev
+__ZN7WebCore10JSNodeListD2Ev
+__ZN7WebCore25JSStyleSheetListPrototypeD1Ev
+__ZN7WebCore16JSStyleSheetListD1Ev
+__ZN7WebCore16JSStyleSheetListD2Ev
+__ZN7WebCore21JSStyleSheetPrototypeD1Ev
+__ZN7WebCore24JSCSSStyleSheetPrototypeD1Ev
+__ZN7WebCore15JSCSSStyleSheetD1Ev
+__ZN7WebCore12JSStyleSheetD2Ev
+__ZN7WebCore22JSCSSRuleListPrototypeD1Ev
+__ZN7WebCore13JSCSSRuleListD1Ev
+__ZN7WebCore13JSCSSRuleListD2Ev
+__ZN7WebCore11CSSRuleListD1Ev
+__ZN7WebCore11CSSRuleListD2Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore7CSSRuleEEELm0EE6shrinkEm
+__ZN7WebCore18JSCSSRulePrototypeD1Ev
+__ZN7WebCore23JSCSSStyleRulePrototypeD1Ev
+__ZN7WebCore14JSCSSStyleRuleD1Ev
+__ZN7WebCore9JSCSSRuleD2Ev
+__ZN7WebCore18JSImageConstructorD1Ev
+__ZN7WebCore27JSHTMLImageElementPrototypeD1Ev
+__ZN7WebCore18JSHTMLImageElementD1Ev
+__ZN7WebCore33JSWebKitCSSKeyframesRulePrototypeD1Ev
+__ZN7WebCore24JSWebKitCSSKeyframesRuleD1Ev
+__ZThn8_N7WebCore16HTMLImageElementD0Ev
+__ZN7WebCore16HTMLImageElementD0Ev
+__ZN7WebCore15HTMLImageLoaderD1Ev
+__ZN7WebCore15HTMLImageLoaderD2Ev
+__ZN7WebCore11ImageLoaderD2Ev
+__ZN7WebCore20ImageLoadEventSender15cancelLoadEventEPNS_11ImageLoaderE
+__ZN7WebCore12NamedNodeMap17detachFromElementEv
+__ZN3WTF9HashTableIPKN7WebCore4NodeESt4pairIS4_PNS1_12NodeRareDataEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairHash
+__ZN7WebCore24JSProgressEventPrototypeD1Ev
+__ZN7WebCore15JSProgressEventD1Ev
+__ZN7WebCore26JSHTMLBodyElementPrototypeD1Ev
+__ZN7WebCore17JSHTMLBodyElementD1Ev
+__ZN7WebCore31JSWebKitAnimationEventPrototypeD1Ev
+__ZN7WebCore22JSWebKitAnimationEventD1Ev
+__ZN7WebCore20WebKitAnimationEventD0Ev
+__ZN7WebCore12DocumentTypeD0Ev
+__ZN7WebCore15HTMLHeadElementD0Ev
+__ZN7WebCore15HTMLBodyElementD0Ev
+__ZN7WebCore15HTMLMetaElementD0Ev
+__ZN7WebCore16HTMLTitleElementD0Ev
+__ZN7WebCore17HTMLScriptElementD0Ev
+__ZN7WebCore17ScriptElementDataD1Ev
+__ZN7WebCore17ScriptElementDataD2Ev
+__ZN7WebCore17ScriptElementData15stopLoadRequestEv
+__ZN7WebCore15HTMLLinkElementD0Ev
+__ZN7WebCore19CachedCSSStyleSheet17allClientsRemovedEv
+__ZN7WebCore11HTMLElementD0Ev
+__ZN7WebCore16HTMLAudioElementD0Ev
+__ZN7WebCore16HTMLMediaElementD2Ev
+__ZN7WebCore8Document40unregisterForDocumentActivationCallbacksEPNS_7ElementE
+__ZN3WTF9HashTableIPN7WebCore7ElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22Id
+__ZN3WTF9HashTableIPN7WebCore7ElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInval
+__ZN3WTF9HashTableIPN7WebCore7ElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore8Document33unregisterForMediaVolumeCallbacksEPNS_7ElementE
+__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE6shrinkEm
+__ZN7WebCore14HTMLDivElementD0Ev
+__ZN7WebCore11CachedImage17allClientsRemovedEv
+__ZN7WebCore11BitmapImage14resetAnimationEv
+__ZN7WebCore11BitmapImage13stopAnimationEv
+__ZN7WebCore11BitmapImage29destroyDecodedDataIfNecessaryEb
+__ZN7WebCore18HTMLHeadingElementD0Ev
+__ZN7WebCore16HTMLVideoElementD0Ev
+__ZN7WebCore29CSSMappedAttributeDeclarationD0Ev
+__ZN7WebCore13StyledElement25removeMappedAttributeDeclENS_20MappedAttributeEntryERKNS_13QualifiedNameERKNS_12AtomicStringE
+__ZN7WebCore14CachedResource16deleteIfPossibleEv
+__ZN7WebCore9FontValueD0Ev
+__ZN7WebCore15FontFamilyValueD0Ev
+__ZN7WebCore17CSSPrimitiveValueD2Ev
+__ZN7WebCore13CSSImageValueD0Ev
+__ZN7WebCore16StyleCachedImageD0Ev
+__ZN7WebCore15CSSReflectValueD0Ev
+__ZN7WebCore19CSSBorderImageValueD0Ev
+__ZN7WebCore16CSSGradientValueD0Ev
+__ZN3WTF6VectorIN7WebCore20CSSGradientColorStopELm0EE6shrinkEm
+__ZN7WebCore22CSSImageGeneratorValueD2Ev
+__ZN7WebCore19StyleGeneratedImageD0Ev
+__ZN7WebCore22WebKitCSSKeyframesRuleD0Ev
+__ZN7WebCore21WebKitCSSKeyframeRuleD0Ev
+__ZN7WebCore23WebKitCSSTransformValueD0Ev
+__ZN7WebCore12CSSValueListD2Ev
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore15DynamicNodeList6CachesEKNS_7HashMapINS1_6StringES4_NS1_10StringHashENS_10HashTraitsI
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore15DynamicNodeList6CachesEKNS_7HashMapINS1_13QualifiedNameES4_NS1_17QualifiedNameHashEN
+__ZN3WTF9HashTableIPN7WebCore15DynamicNodeListES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deall
+__ZN7WebCore19jsDOMWindowLocationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow8locationEPN3JSC9ExecStateE
+__ZN7WebCore18jsLocationProtocolEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Location8protocolEv
+__ZN7WebCoreL28createHTMLHeadElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLHeadElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLHeadElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLHeadElementEEE
+__ZN7WebCore17JSHTMLHeadElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLHeadElementEEE
+__ZN7WebCore18jsNavigatorAppNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase7appNameEv
+__ZN7WebCore17JSHTMLBodyElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSHTMLBodyElement9classInfoEv
+__ZN7WebCore13jsDocumentURLEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsDocumentPrototypeFunctionCreateElementEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12HTMLDocument13createElementERKNS_12AtomicStringERi
+__ZN7WebCore8Document11isValidNameERKNS_6StringE
 __ZN7WebCore10StringImpl7isLowerEv
-__ZN7WebCore11RenderTable19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
-__ZNK7WebCore13HTMLTokenizer14processingDataEv
-__ZN7WebCore15RenderWordBreakC2EPNS_11HTMLElementE
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_16HTMLInputElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
-__ZNK7WebCore15RenderWordBreak11isWordBreakEv
-__ZThn8_N7WebCore17PlatformScrollbar5paintEPNS_15GraphicsContextERKNS_7IntRectE
-__ZN7WebCore17PlatformScrollbar5paintEPNS_15GraphicsContextERKNS_7IntRectE
-__ZThn8_NK7WebCore17PlatformScrollbar6heightEv
-__ZNK7WebCore17PlatformScrollbar6heightEv
-__ZN7WebCore16HTMLLabelElement9setActiveEbb
-__ZN7WebCore16HTMLLabelElement10setHoveredEb
-__ZN7WebCore16HTMLLabelElement20correspondingControlEv
-__ZN7WebCore16HTMLLabelElement19defaultEventHandlerEPNS_5EventE
--[WebCoreResourceHandleAsDelegate connection:willStopBufferingData:]
-__ZN7WebCore14ResourceLoader21willStopBufferingDataEPNS_14ResourceHandleEPKci
-__ZN7WebCore14ResourceLoader21willStopBufferingDataEPKci
-__ZN7WebCore4Page6goBackEv
-__ZN7WebCore4Page8goToItemEPNS_11HistoryItemENS_13FrameLoadTypeE
-__ZN7WebCore11FrameLoader8goToItemEPNS_11HistoryItemENS_13FrameLoadTypeE
-__ZN7WebCore15BackForwardList8goToItemEPNS_11HistoryItemE
-__ZN7WebCore11FrameLoader17recursiveGoToItemEPNS_11HistoryItemES2_NS_13FrameLoadTypeE
-__ZNK7WebCore11HistoryItem12isTargetItemEv
-__ZN7WebCore11FrameLoader8loadItemEPNS_11HistoryItemENS_13FrameLoadTypeE
-__ZN7WebCore11HistoryItem8formDataEv
-__ZN7WebCore16NavigationActionC1ERKNS_4KURLENS_13FrameLoadTypeEb
-__ZN7WebCore11FrameLoader33loadProvisionalItemFromCachedPageEv
-__ZN7WebCore11FrameLoader37updateHistoryForBackForwardNavigationEv
-__ZN7WebCore14FormElementKeyC2EPNS_16AtomicStringImplES2_
-__ZNK7WebCore14FormElementKey3refEv
-__ZN3WTF9HashTableIN7WebCore14FormElementKeyESt4pairIS2_NS_6VectorINS1_6StringELm0EEEENS_18PairFirstExtractorIS7_EENS1_18FormElementKeyHashENS_14PairHashTraitsINS1_24FormElementKeyHashTraitsENS_10HashTraitsIS6_EEEESC_E4findIS2_NS_22IdentityHashTranslatorIS2_S7_SA_EEEENS_17HashTableIteratorIS2_S7_S9_SA_SF_SC_EERKT_
-__ZN3WTF7HashMapIN7WebCore14FormElementKeyENS_6VectorINS1_6StringELm0EEENS1_18FormElementKeyHashENS1_24FormElementKeyHashTraitsENS_10HashTraitsIS5_EEE3setERKS2_RKS5_
-__ZN3WTF9HashTableIN7WebCore14FormElementKeyESt4pairIS2_NS_6VectorINS1_6StringELm0EEEENS_18PairFirstExtractorIS7_EENS1_18FormElementKeyHashENS_14PairHashTraitsINS1_24FormElementKeyHashTraitsENS_10HashTraitsIS6_EEEESC_E3addIS2_S6_NS_17HashMapTranslatorILb1ES7_NS_18PairBaseHashTraitsISC_SE_EESF_SA_EEEES3_INS_17HashTableIteratorIS2_S7_S9_SA_SF_SC_EEbERKT_RKT0_
-__ZN3WTF9HashTableIN7WebCore14FormElementKeyESt4pairIS2_NS_6VectorINS1_6StringELm0EEEENS_18PairFirstExtractorIS7_EENS1_18FormElementKeyHashENS_14PairHashTraitsINS1_24FormElementKeyHashTraitsENS_10HashTraitsIS6_EEEESC_E6expandEv
-__ZN7WebCore14FormElementKeyC2ERKS0_
-__ZN3WTF6VectorIN7WebCore6StringELm0EEC2ERKS3_
-__ZN7WebCore14FormElementKeyD2Ev
-__ZNK7WebCore14FormElementKey5derefEv
-__ZN7WebCore18FormElementKeyHash4hashERKNS_14FormElementKeyE
-__ZN7WebCore14FormElementKeyaSERKS0_
-__ZN7WebCore8Document23takeStateForFormElementEPNS_16AtomicStringImplES2_RNS_6StringE
-__ZN7WebCore24FormElementKeyHashTraits12deletedValueEv
-__ZN7WebCore16HTMLInputElement12restoreStateERKNS_6StringE
-__ZN7WebCore17HTMLSelectElement12restoreStateERKNS_6StringE
-__ZN7WebCore11FrameLoader33restoreScrollPositionAndViewStateEv
-__ZNK7WebCore9FrameView17wasScrolledByUserEv
-__ZNK7WebCore11HistoryItem11scrollPointEv
-__ZN7WebCore9FrameView14setContentsPosEii
-__ZN7WebCore10ScrollView14setContentsPosEii
-__ZN7WebCore7Element15willSaveToCacheEv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE6shrinkEm
-__ZNK7WebCore18JSHTMLEmbedElement14implementsCallEv
-__ZN7WebCore27runtimeObjectImplementsCallEPNS_11HTMLElementE
-__ZN7WebCore9PageCache27releaseAutoreleasedPagesNowEv
-__ZN3WTF9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES6_E4swapERS7_
-__ZN3WTF23HashTableRefCounterBaseILb1ENS_9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEES7_EENS6_INS_6RefPtrIN7WebCore25InspectorDatabaseResourceEEEEEE8derefAllERS8_
-__ZN7WebCore10HTMLParser10createHeadEv
-__ZNK7WebCore16CSSStyleSelector14largerFontSizeEfb
-__ZN7WebCore10HTMLParser19moveOneBlockToStackERPNS_13HTMLStackElemE
-__ZN7WebCore15GraphicsContext11drawEllipseERKNS_7IntRectE
-__ZN7WebCore12EventHandler22defaultTabEventHandlerEPNS_13KeyboardEventE
-__ZN7WebCore15FocusController12advanceFocusENS_14FocusDirectionEPNS_13KeyboardEventEb
-__ZN7WebCore8Document17nextFocusableNodeEPNS_4NodeEPNS_13KeyboardEventE
-__ZN7WebCore25nextNodeWithExactTabIndexEPNS_4NodeEiPNS_13KeyboardEventE
-__ZNK7WebCore4Node19isKeyboardFocusableEPNS_13KeyboardEventE
-__ZNK7WebCore16HTMLInputElement19isKeyboardFocusableEPNS_13KeyboardEventE
-__ZN7WebCore17deepFocusableNodeENS_14FocusDirectionEPNS_4NodeEPNS_13KeyboardEventE
-__ZNK7WebCore4Node19isFrameOwnerElementEv
-__ZN7WebCore8Document35setUseSecureKeyboardEntryWhenActiveEb
-__ZN7WebCore5Frame33updateSecureKeyboardEntryIfActiveEv
-__ZN7WebCore21PlatformKeyboardEvent20currentCapsLockStateEv
-__ZN7WebCore10StringImpl6secureEt
-__ZN7WebCore11FrameLoader4postERKNS_4KURLERKNS_6StringES6_N3WTF10PassRefPtrINS_8FormDataEEES6_PNS_5EventEPNS_15HTMLFormElementERKNS7_7HashMapIS4_S4_NS_10StringHashENS7_10HashTraitsIS4_EESI_EE
-__ZN7WebCore11FrameLoader50didReceiveServerRedirectForProvisionalLoadForFrameEv
-__ZNK7WebCore6String8toDoubleEPb
-__ZN7WebCore10StringImpl8toDoubleEPb
-__ZN7WebCore11FrameLoader23scheduleHTTPRedirectionEdRKNS_6StringE
-__ZN7WebCore11FrameLoader16isLocationChangeERKNS_20ScheduledRedirectionE
-__ZN7WebCore15HTMLBodyElement14createLinkDeclEv
-__ZN7WebCore26jsLocationProtoFuncReplaceEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore13HTMLTokenizer11stopParsingEv
-__ZN7WebCore11FrameLoader22tokenizerProcessedDataEv
-__ZN7WebCore13PageURLRecordD2Ev
-__ZN7WebCore17disabledTextColorERKNS_5ColorES2_
-__ZNK7WebCore5Color5lightEv
-__ZNK7WebCore11RenderTheme16adjustRadioStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZNK7WebCore14RenderThemeMac12setRadioSizeEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac10radioSizesEv
-__ZN7WebCore14RenderThemeMac10paintRadioEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14RenderThemeMac17setRadioCellStateEPKNS_12RenderObjectERKNS_7IntRectE
-__ZNK7WebCore14RenderThemeMac5radioEv
-__ZNK7WebCore14RenderThemeMac12radioMarginsEv
-__ZNK7WebCore28MouseEventWithHitTestResults10localPointEv
-__ZN7WebCore11RenderBlock22positionForCoordinatesEii
-__ZN7WebCore11RenderLayer12scrollOffsetERiS1_
-__ZN7WebCore9SelectionC2ERKNS_15VisiblePositionE
-__ZN7WebCore12IconDatabase28removePageURLFromSQLDatabaseERKNS_6StringE
-_reparentChildPages
-_reparentPage
--[DOMHTMLFormElement method]
-__ZNK7WebCore15HTMLFormElement6methodEv
-__ZN7WebCore6Chrome19addMessageToConsoleENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS5_
-__ZN7WebCore19InspectorController19addMessageToConsoleENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS5_
-__ZN7WebCore17HTMLSelectElement19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore17HTMLSelectElement27menuListDefaultEventHandlerEPNS_5EventE
-__ZN7WebCore17cdataBlockHandlerEPvPKhi
-__ZN7WebCore12XMLTokenizer10cdataBlockEPKhi
-__ZN7WebCore12CDATASectionC1EPNS_8DocumentERKNS_6StringE
-__ZNK7WebCore12CDATASection8nodeTypeEv
-__ZN7WebCore23JSCDATASectionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore14JSCDATASectionC1EPN3KJS8JSObjectEPNS_12CDATASectionE
-__ZN7WebCore14JSCDATASection18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore12EventHandler14allowDHTMLDragERbS1_
-__ZNK7WebCore10ScrollView16contentsToWindowERKNS_8IntPointE
-__ZN7WebCore14DragController24delegateDragSourceActionERKNS_8IntPointE
-__ZNK7WebCore12RenderObject13draggableNodeEbbiiRb
-__ZNK7WebCore12EventHandler18shouldDragAutoNodeEPNS_4NodeERKNS_8IntPointE
-__ZN7WebCore14DragController27mayStartDragAtEventLocationEPKNS_5FrameERKNS_8IntPointE
-__ZNK7WebCore13HitTestResult5imageEv
-__ZN7WebCore12EventHandler16handleAutoscrollEPNS_12RenderObjectE
-__ZN7WebCore12EventHandler20startAutoscrollTimerEv
-__ZN7WebCore12EventHandler27updateSelectionForMouseDragEPNS_4NodeERKNS_8IntPointE
-__ZN7WebCore12EventHandler24canMouseDragExtendSelectEPNS_4NodeE
-__ZN7WebCore9Selection9setExtentERKNS_15VisiblePositionE
-__ZNK7WebCore5Frame20selectionGranularityEv
-__ZN7WebCore12RenderObject14stopAutoscrollEv
-__ZNK7WebCore17RegularExpression13matchedLengthEv
-__ZN7WebCore22DeleteSelectionCommand10removeNodeEPNS_4NodeE
-__ZN7WebCore20isTableStructureNodeEPKNS_4NodeE
-__ZN7WebCore28updatePositionForNodeRemovalEPNS_4NodeERNS_8PositionE
-__ZN7WebCore20CompositeEditCommand10removeNodeEPNS_4NodeE
-__ZN7WebCore17RemoveNodeCommandC2EPNS_4NodeE
-__ZN7WebCore17RemoveNodeCommand7doApplyEv
-__ZN7WebCore18createBreakElementEPNS_8DocumentE
-__ZN7WebCore8Document15createElementNSERKNS_6StringES3_Ri
-__ZNK7WebCore8RenderBR14caretMinOffsetEv
-__ZNK7WebCore16PositionIterator11atEndOfNodeEv
-__ZN7WebCore20CompositeEditCommand16insertNodeBeforeEPNS_4NodeES2_
-__ZN7WebCore23InsertNodeBeforeCommandC2EN3WTF10PassRefPtrINS_4NodeEEEPS3_
-__ZN7WebCore23InsertNodeBeforeCommand7doApplyEv
-__ZNK7WebCore22HTMLGenericFormElement16isMouseFocusableEv
-__ZNK7WebCore16HTMLInputElement17canStartSelectionEv
-__ZNK7WebCore15HTMLFormElement19CheckedRadioButtons21checkedButtonForGroupERKNS_12AtomicStringE
-__ZN7WebCore17HTMLSelectElement18dispatchFocusEventEv
-__ZN7WebCore17HTMLSelectElement17saveLastSelectionEv
-__ZNK7WebCore4Node20shouldUseInputMethodEv
-__ZN7WebCore7Element21updateFocusAppearanceEb
-__ZNK7WebCore13ContainerNode7getRectEv
-__ZNK7WebCore13ContainerNode18getUpperLeftCornerERiS1_
-__ZNK7WebCore13ContainerNode19getLowerRightCornerERiS1_
-__ZN7WebCore14RenderMenuList9showPopupEv
-__ZN7WebCore9PopupMenuC2EPNS_15PopupMenuClientE
-__ZN7WebCore9PopupMenu4showERKNS_7IntRectEPNS_9FrameViewEi
-__ZN7WebCore9PopupMenu8populateEv
-__ZThn136_NK7WebCore14RenderMenuList13shouldPopOverEv
-__ZNK7WebCore14RenderMenuList13shouldPopOverEv
-__ZThn136_NK7WebCore14RenderMenuList8listSizeEv
-__ZNK7WebCore14RenderMenuList8listSizeEv
-__ZThn136_NK7WebCore14RenderMenuList15itemIsSeparatorEj
-__ZNK7WebCore14RenderMenuList15itemIsSeparatorEj
-__ZThn136_NK7WebCore14RenderMenuList9itemStyleEj
-__ZNK7WebCore14RenderMenuList9itemStyleEj
-__ZThn136_NK7WebCore14RenderMenuList8itemTextEj
-__ZNK7WebCore14RenderMenuList8itemTextEj
-__ZThn136_NK7WebCore14RenderMenuList13itemIsEnabledEj
-__ZNK7WebCore14RenderMenuList13itemIsEnabledEj
-__ZThn136_NK7WebCore14RenderMenuList11clientStyleEv
-__ZNK7WebCore14RenderMenuList11clientStyleEv
-__ZN7WebCore12EventHandler14currentNSEventEv
-__ZN7WebCore5Frame13willPopupMenuEP6NSMenu
--[WebCoreFrameBridge accessibilityTree]
-__ZN7WebCore13AXObjectCache3getEPNS_12RenderObjectE
-__ZN3WTF7HashMapIPN7WebCore12RenderObjectEP15WebCoreAXObjectNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS5_
-+[WebCoreAXObject initialize]
--[WebCoreAXObject initWithRenderer:]
--[WebCoreAXObject _accessibilityParentForSubview:]
--[WebCoreAXObject rendererForView:]
-__ZN7WebCore13AXObjectCache25postNotificationToElementEPNS_12RenderObjectERKNS_6StringE
-__ZThn136_N7WebCore14RenderMenuList9hidePopupEv
-__ZN7WebCore14RenderMenuList9hidePopupEv
-__ZN7WebCore9PopupMenu4hideEv
-__ZThn136_N7WebCore14RenderMenuList12valueChangedEjb
-__ZN7WebCore14RenderMenuList12valueChangedEjb
-__ZNK7WebCore17HTMLSelectElement17listToOptionIndexEi
-__ZN7WebCore17HTMLSelectElement16setSelectedIndexEibb
-__ZN7WebCore17HTMLSelectElement29setActiveSelectionAnchorIndexEi
-__ZN3WTF6VectorIbLm0EE14expandCapacityEmPKb
-__ZN3WTF6VectorIbLm0EE14expandCapacityEm
-__ZN3WTF6VectorIbLm0EE15reserveCapacityEm
-__ZN7WebCore17HTMLSelectElement13deselectItemsEPNS_17HTMLOptionElementE
-__ZN7WebCore17HTMLSelectElement16menuListOnChangeEv
-__ZN7WebCore12EventHandler33sendFakeEventsAfterWidgetTrackingEP7NSEvent
-__ZN7WebCore17HTMLSelectElement17dispatchBlurEventEv
-__ZN7WebCore13AXObjectCache29handleFocusedUIElementChangedEv
-__ZNK7WebCore16HTMLLabelElement11isFocusableEv
-__ZN7WebCore10RenderText22positionForCoordinatesEii
-__ZNK7WebCore13InlineTextBox17offsetForPositionEib
-__ZNK7WebCore4Font17offsetForPositionERKNS_7TextRunEib
-__ZNK7WebCore4Font30offsetForPositionForSimpleTextERKNS_7TextRunEib
-__ZN7WebCore13WidthIterator19advanceOneCharacterERfPNS_11GlyphBufferE
-__ZN7WebCore17positionAfterNodeEPKNS_4NodeE
-__ZN7WebCore13AXObjectCache16postNotificationEPNS_12RenderObjectERKNS_6StringE
--[WebCoreAXObject observableObject]
-__ZN7WebCore18createLabelWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore27JSHTMLLabelElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLLabelElementC1EPN3KJS8JSObjectEPNS_16HTMLLabelElementE
-__ZN7WebCore18JSHTMLLabelElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22createParagraphWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore31JSHTMLParagraphElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore22JSHTMLParagraphElementC1EPN3KJS8JSObjectEPNS_20HTMLParagraphElementE
-__ZN7WebCore22JSHTMLParagraphElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17HTMLSelectElement14appendFormDataERNS_12FormDataListEb
-__ZNK7WebCore17HTMLOptionElement5valueEv
-__ZN7WebCore22HTMLGenericFormElement14appendFormDataERNS_12FormDataListEb
-__ZN7WebCore13AXObjectCache15childrenChangedEPNS_12RenderObjectE
--[WebCoreAXObject childrenChanged]
--[WebCoreAXObject clearChildren]
--[WebCoreAXObject accessibilityIsIgnored]
--[WebCoreAXObject isAttachment]
--[WebCoreAXObject isWebArea]
--[WebCoreAXObject detach]
--[WebCoreAXObject removeAXObjectID]
--[WebCoreAXObject dealloc]
-__ZN7WebCore20JSHTMLHeadingElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore23JSCDATASectionPrototypeD0Ev
-__ZN3WTF6VectorIPN7WebCore5FrameELm16EE6shrinkEm
-__ZNK7WebCore12RenderObject15canHaveChildrenEv
-__ZN7WebCore17objectConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLObjectElementC1EPNS_8DocumentEb
+__ZN7WebCoreL17objectConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLObjectElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore17HTMLObjectElementC2ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore22HTMLPlugInImageElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17HTMLPlugInElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16toJSNewlyCreatedEPN3JSC9ExecStateEPNS_7ElementE
+__ZN7WebCoreL30createHTMLObjectElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLObjectElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLObjectElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLObjectElementEEE
+__ZN7WebCore19JSHTMLObjectElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLObjectElementEEE
+__ZN7WebCore19JSHTMLObjectElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19JSHTMLObjectElement18canGetItemsForNameEPN3JSC9ExecStateEPNS_17HTMLObjectElementERKNS1_10IdentifierE
+__ZN7WebCore19JSHTMLObjectElement24customGetOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore37runtimeObjectCustomGetOwnPropertySlotEPN3JSC9ExecStateERKNS0_10IdentifierERNS0_12PropertySlotEPNS_13JSHTMLElement
+__ZN7WebCoreL16getRuntimeObjectEPN3JSC9ExecStateEPNS_4NodeE
+__ZN7WebCoreL14pluginInstanceEPNS_4NodeE
+__ZNK7WebCore17HTMLPlugInElement11getInstanceEv
+__ZNK7WebCore17HTMLObjectElement25renderWidgetForJSBindingsEv
+__ZN7WebCore28JSHTMLObjectElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore38jsElementPrototypeFunctionSetAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore19JSHTMLObjectElement9classInfoEv
+__ZN7WebCore9JSElement12setAttributeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore7Element12setAttributeERKNS_12AtomicStringES3_Ri
+__ZNK7WebCore17HTMLPlugInElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
 __ZN7WebCore17HTMLObjectElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore17HTMLPlugInElement17endTagRequirementEv
-__ZNK7WebCore17HTMLObjectElement11tagPriorityEv
+__ZN7WebCore17HTMLPlugInElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore19JSHTMLObjectElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19JSHTMLObjectElement9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore22runtimeObjectCustomPutEPN3JSC9ExecStateERKNS0_10IdentifierENS0_7JSValueEPNS_11HTMLElementERNS0_15PutPropertySlotE
+__ZN7WebCore18setJSHTMLElementIdEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement5setIdERKNS_6StringE
+__ZN7WebCore17JSHTMLHeadElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34jsNodePrototypeFunctionAppendChildEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore17JSHTMLHeadElement9classInfoEv
+__ZN7WebCore6JSNode11appendChildEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore6toNodeEN3JSC7JSValueE
+__ZN7WebCore13ContainerNode11appendChildEN3WTF10PassRefPtrINS_4NodeEEERib
+__ZN7WebCore4Node13checkAddChildEPS0_Ri
+__ZN7WebCore8Document19nodeChildrenChangedEPNS_13ContainerNodeE
+__ZN7WebCoreL20disableRangeMutationEPNS_4PageE
+__ZN7WebCore4Node30notifyNodeListsChildrenChangedEv
+__ZN7WebCore4Node35notifyLocalNodeListsChildrenChangedEv
+__ZN7WebCore17NodeListsNodeData16invalidateCachesEv
+__ZN7WebCore15DynamicNodeList6Caches5resetEv
+__ZN7WebCoreL28dispatchChildInsertionEventsEPNS_4NodeERi
 __ZN7WebCore17HTMLObjectElement20insertedIntoDocumentEv
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEiNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IiEEE3setERKS3_RKi
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_iENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsI
+__ZN7WebCore4Node10lazyAttachEv
+__ZN7WebCore17HTMLObjectElement13canLazyAttachEv
+__ZN7WebCore17HTMLObjectElement6detachEv
+__ZN7WebCore17HTMLPlugInElement6detachEv
 __ZN7WebCore17HTMLObjectElement6attachEv
-__ZN7WebCore17HTMLObjectElement11isImageTypeEv
-__ZN7WebCore17HTMLObjectElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore17HTMLObjectElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore22HTMLPlugInImageElement11isImageTypeEv
+__ZN7WebCore17HTMLPlugInElement20updateWidgetCallbackEPNS_4NodeE
 __ZN7WebCore17HTMLObjectElement12updateWidgetEv
-__ZN7WebCore16paramConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLParamElementC2EPNS_8DocumentE
-__ZN7WebCore16HTMLParamElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore16HTMLParamElement17endTagRequirementEv
-__ZNK7WebCore16HTMLParamElement11tagPriorityEv
-__ZN7WebCore17HTMLPlugInElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore17HTMLObjectElement15childrenChangedEb
-__ZN7WebCore17HTMLObjectElement18updateDocNamedItemEv
-__ZN7WebCore17HTMLObjectElement21finishParsingChildrenEv
-__ZN7WebCore17HTMLObjectElement11recalcStyleENS_4Node11StyleChangeE
-__ZN7WebCore17HTMLObjectElement6detachEv
-__ZNK7WebCore17HTMLPlugInElement4nameEv
-__ZN3WTF6VectorIcLm256EE14expandCapacityEm
-__ZN3WTF6VectorIcLm256EE15reserveCapacityEm
-__ZNK3KJS6Window17printErrorMessageERKN7WebCore6StringE
-__ZN7WebCore17HTMLObjectElementD1Ev
-__ZN7WebCore9PageCache11autoreleaseEN3WTF10PassRefPtrINS_10CachedPageEEE
-__ZN3WTF7HashSetINS_6RefPtrIN7WebCore10CachedPageEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZN7WebCore9PageCache17removeFromLRUListEPNS_11HistoryItemE
-__ZNK7WebCore14RenderThemeMac19adjustTextAreaStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZN7WebCore19HTMLTextAreaElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore16scrollCornerRectEPNS_12RenderObjectERKNS_7IntRectE
-__ZN7WebCore5TimerINS_9PageCacheEE5firedEv
-__ZN7WebCore9PageCache39releaseAutoreleasedPagesNowOrRescheduleEPNS_5TimerIS0_EE
-__ZN7WebCore11FrameLoader23timeOfLastCompletedLoadEv
-__ZN7WebCore12userIdleTimeEv
-__ZN7WebCore10CachedPage5clearEv
-__ZN7WebCore9FrameView10clearFrameEv
-__ZN7WebCore15HTMLImageLoaderD1Ev
-__ZN3KJS21SavedBuiltinsInternalD2Ev
-__ZN3KJS12ProtectedPtrINS_20NativeErrorPrototypeEED1Ev
-__ZN3KJS12ProtectedPtrINS_14ErrorPrototypeEED1Ev
-__ZN3KJS12ProtectedPtrINS_15RegExpPrototypeEED1Ev
-__ZN3KJS12ProtectedPtrINS_13DatePrototypeEED1Ev
-__ZN3KJS12ProtectedPtrINS_15NumberPrototypeEED1Ev
-__ZN3KJS12ProtectedPtrINS_15StringPrototypeEED1Ev
-__ZN3KJS12ProtectedPtrINS_16BooleanPrototypeEED1Ev
-__ZN3KJS12ProtectedPtrINS_14ArrayPrototypeEED1Ev
-__ZN3KJS12ProtectedPtrINS_17FunctionPrototypeEED1Ev
-__ZN3KJS12ProtectedPtrINS_15ObjectPrototypeEED1Ev
-__ZN3KJS12ProtectedPtrINS_14NativeErrorImpEED1Ev
-__ZN3KJS12ProtectedPtrINS_14ErrorObjectImpEED1Ev
-__ZN3KJS12ProtectedPtrINS_15RegExpObjectImpEED1Ev
-__ZN3KJS12ProtectedPtrINS_13DateObjectImpEED1Ev
-__ZN3KJS12ProtectedPtrINS_15NumberObjectImpEED1Ev
-__ZN3KJS12ProtectedPtrINS_15StringObjectImpEED1Ev
-__ZN3KJS12ProtectedPtrINS_16BooleanObjectImpEED1Ev
-__ZN3KJS12ProtectedPtrINS_14ArrayObjectImpEED1Ev
-__ZN3KJS12ProtectedPtrINS_17FunctionObjectImpEED1Ev
-__ZN3KJS12ProtectedPtrINS_15ObjectObjectImpEED1Ev
-__ZN7WebCore10CachedPageD2Ev
-__ZN7WebCore19HTMLTextAreaElement23rendererWillBeDestroyedEv
-__ZN7WebCore13WidthIterator21normalizeVoicingMarksEi
-__ZN7WebCore12BidiResolverINS_12BidiIteratorENS_7BidiRunEE5embedEN3WTF7Unicode9DirectionE
-__ZNK7WebCore4Font24floatWidthForComplexTextERKNS_7TextRunE
-__ZN7WebCore20ATSULayoutParameters10initializeEPKNS_4FontEPKNS_15GraphicsContextE
-__ZN7WebCore19initializeATSUStyleEPKNS_14SimpleFontDataE
-__ZNK7WebCore4Font21fontDataForCharactersEPKti
-__ZNK7WebCore16FontFallbackList21fontDataForCharactersEPKNS_4FontEPKti
-__ZNK7WebCore14SimpleFontData17checkShapesArabicEv
-__ZN7WebCore23overrideLayoutOperationEmP14ATSGlyphVectormPvPm
-__ZN7WebCore27disposeATSULayoutParametersEPNS_20ATSULayoutParametersE
-__ZNK7WebCore11BidiContext5derefEv
-__ZN7WebCore12BidiResolverINS_12BidiIteratorENS_7BidiRunEE11reverseRunsEii
-__ZNK7WebCore9InlineBox16prevOnLineExistsEv
-__ZNK7WebCore4Font15drawComplexTextEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
-__ZN7WebCore14RenderFieldset19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore8Position19uncheckedNextOffsetEPKNS_4NodeEi
-__ZN7WebCore12RenderObject9inlineBoxEiNS_9EAffinityE
-__ZNK7WebCore14RenderReplaced14caretMinOffsetEv
-__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE15reserveCapacityEm
-__ZSt16__introsort_loopIPPN7WebCore13InlineTextBoxEiPFbPKS1_S5_EEvT_S8_T0_T1_
-__ZSt22__final_insertion_sortIPPN7WebCore13InlineTextBoxEPFbPKS1_S5_EEvT_S8_T0_
-__ZSt16__insertion_sortIPPN7WebCore13InlineTextBoxEPFbPKS1_S5_EEvT_S8_T0_
-__ZN3WTF6VectorIPN7WebCore13InlineTextBoxELm0EE6shrinkEm
-__ZNK7WebCore12RenderObject10isMenuListEv
--[WebCoreAXObject mouseButtonListener]
--[WebCoreAXObject parentObject]
-__ZNK7WebCore11FrameLoader14initialRequestEv
-__ZN7WebCore27JSHTMLLabelElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSHTMLLabelElement9classInfoEv
-__ZN7WebCore11HTMLElement8setTitleERKNS_6StringE
-__ZN7WebCore19CachedCSSStyleSheet11setEncodingERKNS_6StringE
-__ZN3WTF6VectorIN7WebCore5ValueELm16EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore5ValueELm16EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore5ValueELm16EE15reserveCapacityEm
-__ZN7WebCore17StyleMultiColDataC2ERKS0_
-__ZNK7WebCore12RenderObject11overflowTopEb
-__ZNK7WebCore11RenderBlock9columnGapEv
-__ZN3WTF7HashMapIPKN7WebCore9RenderBoxEPNS1_10ColumnInfoENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE4takeERKS4_
-__ZN7WebCore10RenderView18setBestTruncatedAtEiPNS_12RenderObjectEb
-__ZNK7WebCore11RenderBlock11columnRectsEv
-__ZNK7WebCore11RenderBlock20adjustRectForColumnsERNS_7IntRectE
-__ZN7WebCore16RenderListMarker12imageChangedEPNS_11CachedImageE
-__ZN7WebCore13InlineFlowBox11extractLineEv
-__ZN7WebCore10RenderFlow14extractLineBoxEPNS_13InlineFlowBoxE
-__ZN7WebCore13InlineTextBox11extractLineEv
-__ZN7WebCore10RenderText14extractTextBoxEPNS_13InlineTextBoxE
-__ZZN7WebCore11RenderBlock14matchedEndLineERKNS_12BidiIteratorERKNS_10BidiStatusES3_S6_RPNS_13RootInlineBoxERiSA_SA_E8numLines
-__ZN7WebCoreeqERKNS_11BidiContextES2_
-__ZN7WebCore13InlineFlowBox10attachLineEv
-__ZN7WebCore10RenderFlow13attachLineBoxEPNS_13InlineFlowBoxE
-__ZN7WebCore13InlineTextBox10attachLineEv
-__ZN7WebCore10RenderText13attachTextBoxEPNS_13InlineTextBoxE
-__ZN7WebCore15compareBoxStartEPKNS_13InlineTextBoxES2_
-__ZSt25__unguarded_linear_insertIPPN7WebCore13InlineTextBoxES2_PFbPKS1_S5_EEvT_T0_T1_
-__ZN7WebCore16equalIgnoringRefERKNS_4KURLES2_
-__ZN7WebCore11FrameLoader47callContinueFragmentScrollAfterNavigationPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEEb
-__ZN7WebCore11FrameLoader43continueFragmentScrollAfterNavigationPolicyERKNS_15ResourceRequestEb
-__ZN7WebCore14DocumentLoader32replaceRequestURLForAnchorScrollERKNS_4KURLE
-__ZN7WebCore11FrameLoader31addHistoryItemForFragmentScrollEv
-__ZN7WebCore11FrameLoader14scrollToAnchorERKNS_4KURLE
-__ZN7WebCore11FrameLoader10gotoAnchorERKNS_6StringE
-__ZN7WebCore8Document12setCSSTargetEPNS_4NodeE
-__ZNK7WebCore10RenderText7minXPosEv
-__ZNK7WebCore10RenderText5widthEv
-__ZNK7WebCore10RenderText4yPosEv
-__ZN7WebCore14PausedTimeoutsD1Ev
-__ZN7WebCore4Page23clearUndoRedoOperationsEv
-__ZN7WebCore14DragController9dragEndedEv
-__ZN7WebCore4PageD1Ev
-__ZN7WebCore15BackForwardList5closeEv
-__ZN7WebCore15ProgressTrackerD2Ev
-__ZN7WebCore19InspectorControllerD2Ev
-__ZN3WTF20deleteAllPairSecondsIPNS_7HashMapIxNS_6RefPtrIN7WebCore17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS8_IS5_EEEEKNS1_INS2_INS3_5FrameEEESC_NS_7PtrHashISE_EENS8_ISE_EENS8_ISC_EEEEEEvRT0_
-__ZN3WTF15deleteAllValuesIPN7WebCore14ConsoleMessageELm0EEEvRKNS_6VectorIT_XT0_EEE
-__ZN3WTF23HashTableRefCounterBaseILb1ENS_9HashTableIiSt4pairIiiENS_18PairFirstExtractorIS3_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEESA_EESA_EENS_18PairBaseHashTraitsINS9_INS_6RefPtrIN7WebCore17SubresourceLoaderEEEEENS9_IPNSF_7RequestEEEEEE8derefAllERSC_
-__ZN3WTF23HashTableRefCounterBaseILb1ENS_9HashTableIxSt4pairIxiENS_18PairFirstExtractorIS3_EENS_7IntHashIyEENS_14PairHashTraitsINS_10HashTraitsIxEENS9_IiEEEESA_EENS_18PairBaseHashTraitsISA_NS9_INS_6RefPtrIN7WebCore17InspectorResourceEEEEEEEE6refAllERSD_
-__ZN3WTF9HashTableIxSt4pairIxiENS_18PairFirstExtractorIS2_EENS_7IntHashIyEENS_14PairHashTraitsINS_10HashTraitsIxEENS8_IiEEEES9_EC1ERKSC_
-__ZN7WebCore21ContextMenuControllerD2Ev
-__ZN7WebCore14DragControllerD2Ev
-__ZN7WebCore6ChromeD2Ev
-__ZN7WebCore15BackForwardListD1Ev
-__ZN3WTF15deleteAllValuesIPN7WebCore10PluginInfoELm0EEEvRKNS_6VectorIT_XT0_EEE
-__ZN3WTF6VectorIPN7WebCore13MimeClassInfoELm0EE6shrinkEm
-__ZN3WTF6VectorIPN7WebCore10PluginInfoELm0EE6shrinkEm
-__ZN3WTF15deleteAllValuesIPN7WebCore13MimeClassInfoELm0EEEvRKNS_6VectorIT_XT0_EEE
-__ZN7WebCore13CSSImportRuleD1Ev
-_sqlite3BtreeDelete
--[DOMHTMLInputElement(FormAutoFillTransition) _selectedRange]
--[DOMHTMLInputElement(WebCoreInternal) _HTMLInputElement]
-__ZNK7WebCore16HTMLInputElement14selectionStartEv
-__ZNK7WebCore16HTMLInputElement12selectionEndEv
--[DOMHTMLInputElement(FormAutoFillTransition) _replaceCharactersInRange:withString:selectingFromIndex:]
-__ZN7WebCore10StringImpl7replaceEjjPS0_
-__ZN7WebCore13InlineTextBox14paintSelectionEPNS_15GraphicsContextEiiPNS_11RenderStyleEPKNS_4FontE
-__ZN7WebCore13InlineTextBox17selectionStartEndERiS1_
-__ZNK7WebCore12RenderObject24selectionBackgroundColorEv
-__ZNK7WebCore11RenderTheme30activeSelectionBackgroundColorEv
-__ZNK7WebCore14RenderThemeMac38platformActiveSelectionBackgroundColorEv
-__ZNK7WebCore5Color14blendWithWhiteEv
-__ZN7WebCore14blendComponentEii
-__ZN7WebCore15GraphicsContext20drawHighlightForTextERKNS_7TextRunERKNS_8IntPointEiRKNS_5ColorEii
-__ZN7WebCore15GraphicsContext8fillRectERKNS_9FloatRectERKNS_5ColorE
-__ZNK7WebCore12RenderObject24selectionForegroundColorEv
-__ZNK7WebCore11RenderTheme38platformActiveSelectionForegroundColorEv
-__ZN7WebCore20CompositeEditCommand15deleteSelectionEbbbb
-__ZN7WebCore22DeleteSelectionCommandC2EPNS_8DocumentEbbbb
-__ZN7WebCore11RenderBlock21fillRightSelectionGapEPNS_12RenderObjectEiiiPS0_iiiiPKNS1_9PaintInfoE
-__ZN7WebCore21blockquoteConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore21HTMLBlockquoteElementC2EPNS_8DocumentE
-__ZNK7WebCore21HTMLBlockquoteElement17endTagRequirementEv
-__ZNK7WebCore21HTMLBlockquoteElement11tagPriorityEv
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLTableElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLTableElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore16HTMLTableElement4rowsEv
-__ZN7WebCore23HTMLTableRowsCollectionC1EN3WTF10PassRefPtrINS_16HTMLTableElementEEE
-__ZN3KJS17staticValueGetterIN7WebCore15JSCharacterDataEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore15JSCharacterData16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore23HTMLTableRowsCollection9itemAfterEPNS_7ElementE
-__ZN7WebCore23HTMLTableRowsCollection8rowAfterEPNS_16HTMLTableElementEPNS_19HTMLTableRowElementE
-__ZN7WebCore8isInHeadEPNS_7ElementE
-__ZN7WebCore15JSCharacterData3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore15JSCharacterData16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZNK7WebCore11RenderTable14recalcSectionsEv
-__ZN7WebCore18RenderTableSection11recalcCellsEv
-__ZNK7WebCore18RenderTableSection10numColumnsEv
-__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE6resizeEm
-__ZN7WebCore23HTMLTableRowsCollectionD1Ev
-__ZN7WebCore8Document9setDomainERKNS_6StringE
-__ZN7WebCore14SecurityOrigin16setDomainFromDOMERKNS_6StringE
-__ZN7WebCore19inputElementAltTextEv
-__ZN7WebCore18MainResourceLoader15handleEmptyLoadERKNS_4KURLEb
-__ZNK7WebCore17HTMLSelectElement6lengthEv
-__ZN7WebCore17HTMLSelectElement7optionsEv
-__ZN7WebCore21HTMLOptionsCollectionC1EN3WTF10PassRefPtrINS_17HTMLSelectElementEEE
-__ZN7WebCore32JSHTMLOptionsCollectionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore23JSHTMLOptionsCollectionC1EPN3KJS8JSObjectEPNS_21HTMLOptionsCollectionE
-__ZN7WebCore23JSHTMLOptionsCollection18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore32JSHTMLOptionsCollectionPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19createOptionWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore28JSHTMLOptionElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSHTMLOptionElementC1EPN3KJS8JSObjectEPNS_17HTMLOptionElementE
-__ZN7WebCore19JSHTMLOptionElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore19JSHTMLOptionElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSHTMLOptionElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore19JSHTMLOptionElement4implEv
-__ZN7WebCore19JSHTMLOptionElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore19JSHTMLOptionElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore17HTMLOptionElement11setSelectedEb
-__ZNK7WebCore17HTMLOptionElement5indexEv
-__ZN7WebCore22JSNamedNodesCollectionC1EPN3KJS8JSObjectERKN3WTF6VectorINS4_6RefPtrINS_4NodeEEELm0EEE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EEC2ERKS5_
-__ZN7WebCore22JSNamedNodesCollection18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22JSNamedNodesCollection11indexGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore30JSHTMLOptionElementConstructorC2EPN3KJS9ExecStateEPNS_8DocumentE
-__ZNK7WebCore30JSHTMLOptionElementConstructor19implementsConstructEv
-__ZN7WebCore30JSHTMLOptionElementConstructor9constructEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore17HTMLOptionElement8setValueERKNS_6StringE
-__ZN7WebCore23JSHTMLOptionsCollection3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore23JSHTMLOptionsCollection11indexSetterEPN3KJS9ExecStateEjPNS1_7JSValueEi
-__ZNK7WebCore23JSHTMLOptionsCollection4implEv
-__ZN7WebCore17selectIndexSetterEPNS_17HTMLSelectElementEPN3KJS9ExecStateEjPNS2_7JSValueE
-__ZN7WebCore19toHTMLOptionElementEPN3KJS7JSValueE
-__ZNK7WebCore19JSHTMLOptionElement9classInfoEv
-__ZN7WebCore17HTMLSelectElement9setOptionEjPNS_17HTMLOptionElementERi
-__ZN7WebCore17HTMLSelectElement3addEPNS_11HTMLElementES2_Ri
-__ZN7WebCore17HTMLSelectElement12insertBeforeEN3WTF10PassRefPtrINS_4NodeEEEPS3_Ri
-__ZN7WebCore17HTMLSelectElement11appendChildEN3WTF10PassRefPtrINS_4NodeEEERi
-__ZN7WebCore9DOMWindow7setNameERKNS_6StringE
-__ZN3KJS9MimeTypes10nameGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS8MimeType18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS17staticValueGetterINS_8MimeTypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK3KJS8MimeType16getValuePropertyEPNS_9ExecStateEi
-__ZNK7WebCore10CachedPage9timeStampEv
-__ZN7WebCore10CachedPage14documentLoaderEv
-__ZN7WebCore14DocumentLoader18loadFromCachedPageEN3WTF10PassRefPtrINS_10CachedPageEEE
-__ZN7WebCore14DocumentLoader12setCommittedEb
-__ZN7WebCore10CachedPage22cachedPagePlatformDataEv
-__ZN7WebCore11FrameLoader4openERNS_10CachedPageE
-__ZN7WebCore10CachedPage7restoreEPNS_4PageE
-__ZN3KJS6Window14resumeTimeoutsEPN7WebCore14PausedTimeoutsE
-__ZN7WebCore19AnimationController16resumeAnimationsEv
-__ZN7WebCore12EventHandler17setMousePressNodeEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore8Document19didRestoreFromCacheEv
--[WebCoreFrameBridge reapplyStylesForDeviceType:]
-__ZN7WebCore9FrameView12setMediaTypeERKNS_6StringE
-__ZNK7WebCore17StyleMultiColDataeqERKS0_
-__ZNK7WebCore14DocumentLoader9responsesEv
-__ZN7WebCore11FrameLoader19requestFromDelegateERNS_15ResourceRequestERmRNS_13ResourceErrorE
-__ZN7WebCore4KURLaSERKS0_
-__ZN7WebCore19ResourceRequestBaseD2Ev
-__ZN7WebCore11FrameLoader29sendRemainingDelegateMessagesEmRKNS_16ResourceResponseEiRKNS_13ResourceErrorE
-__ZN7WebCore28JSHTMLOptionElementPrototypeD0Ev
-__ZN3WTF6VectorIbLm0EE6shrinkEm
-__ZNK7WebCore10HTMLParser8isInlineEPNS_4NodeE
-__ZN7WebCore9PopupMenuD2Ev
-__ZN7WebCore10IconLoaderD1Ev
-__ZN7WebCore31JSHTMLParagraphElementPrototypeD0Ev
-__ZN7WebCore19alternateFamilyNameERKNS_12AtomicStringE
-__ZN7WebCore15HTMLFormElement12parseEnctypeERKNS_6StringE
-__ZN7WebCore19HTMLTextAreaElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore19HTMLTextAreaElement15childrenChangedEb
-__ZNK7WebCore19HTMLTextAreaElement12defaultValueEv
-__ZN7WebCore19HTMLTextAreaElement8setValueERKNS_6StringE
-__ZN7WebCore16DeprecatedString7replaceERKS0_S2_
-__ZN7WebCore21createTextAreaWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore21JSHTMLTextAreaElementC1EPN3KJS8JSObjectEPNS_19HTMLTextAreaElementE
-__ZNK7WebCore19HTMLTextAreaElement14isEnumeratableEv
-__ZN7WebCore21JSHTMLTextAreaElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore21JSHTMLTextAreaElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSHTMLTextAreaElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore19HTMLTextAreaElement14selectionStartEv
-__ZN7WebCore14RenderThemeMac13paintTextAreaEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore19HTMLTextAreaElement19defaultEventHandlerEPNS_5EventE
-__ZNK7WebCore19HTMLTextAreaElement16isMouseFocusableEv
-__ZNK7WebCore19HTMLTextAreaElement20shouldUseInputMethodEv
-__ZN7WebCore13RootInlineBox23closestLeafChildForXPosEib
-__ZN3WTF6VectorItLm1024EE14expandCapacityEmPKt
-__ZN3WTF6VectorItLm1024EE14expandCapacityEm
-__ZN3WTF6VectorItLm1024EE15reserveCapacityEm
-__ZN7WebCore5Frame23textDidChangeInTextAreaEPNS_7ElementE
-+[DOMHTMLTextAreaElement(WebCoreInternal) _wrapHTMLTextAreaElement:]
--[DOMHTMLTextAreaElement form]
--[DOMHTMLTextAreaElement(FormPromptAdditions) _isEdited]
-__ZN7WebCore8RenderBR9inlineBoxEiNS_9EAffinityE
-__ZN7WebCore11RenderBlock26fillHorizontalSelectionGapEPNS_12RenderObjectEiiiiPKNS1_9PaintInfoE
-__ZN7WebCore8RenderBR13selectionRectEb
-__ZNK7WebCore8Position19isRenderedCharacterEv
-__ZN7WebCore14preConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore14HTMLPreElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore14HTMLPreElement17endTagRequirementEv
-__ZNK7WebCore14HTMLPreElement11tagPriorityEv
-__ZNK7WebCore4Font10spaceWidthEv
-__ZNK7WebCore4Node11textContentEb
-__ZN7WebCore6JSNode16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore4Node14setTextContentERKNS_6StringERi
-__ZN3KJS17staticValueGetterIN7WebCore19JSHTMLScriptElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSHTMLScriptElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore17HTMLScriptElement3srcEv
-__ZN7WebCore20HTMLFrameElementBase7setNameERKNS_6StringE
-__ZN7WebCore17HTMLIFrameElement8setWidthERKNS_6StringE
-__ZN7WebCore17HTMLIFrameElement9setHeightERKNS_6StringE
-__ZN7WebCore20HTMLFrameElementBase14setMarginWidthERKNS_6StringE
-__ZN7WebCore20HTMLFrameElementBase15setMarginHeightERKNS_6StringE
-__ZN7WebCore20HTMLFrameElementBase14setFrameBorderERKNS_6StringE
-__ZN7WebCore20HTMLFrameElementBase12setScrollingERKNS_6StringE
+__ZN7WebCoreL10isHTTPOnlyEP12NSHTTPCookie
+__ZN7WebCore33jsDOMWindowHTMLElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13JSHTMLElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23getCachedDOMConstructorEPN3JSC9ExecStateEPKNS0_9ClassInfoE
+__ZN7WebCore19cacheDOMConstructorEPN3JSC9ExecStateEPKNS0_9ClassInfoEPNS0_8JSObjectE
+__ZN7WebCoreL27createHTMLDivElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore16JSHTMLDivElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSHTMLDivElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLDivElementEEE
+__ZN7WebCore16JSHTMLDivElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLDivElementEEE
+__ZN7WebCore16JSHTMLDivElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL15formConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCoreL28createHTMLFormElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLFormElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLFormElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLFormElementEEE
+__ZN7WebCore17JSHTMLFormElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLFormElementEEE
+__ZN7WebCore17JSHTMLFormElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17JSHTMLFormElement18canGetItemsForNameEPN3JSC9ExecStateEPNS_15HTMLFormElementERKNS1_10IdentifierE
+__ZN7WebCore15HTMLFormElement16getNamedElementsERKNS_12AtomicStringERN3WTF6VectorINS4_6RefPtrINS_4NodeEEELm0EEE
+__ZNK7WebCore14HTMLCollection10namedItemsERKNS_12AtomicStringERN3WTF6VectorINS4_6RefPtrINS_4NodeEEELm0EEE
+__ZNK7WebCore18HTMLFormCollection15updateNameCacheEv
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS_6VectorIPNS1_7ElementELm0EEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSB_IS8_EE
+__ZN7WebCore15HTMLFormElement15elementForAliasERKNS_12AtomicStringE
+__ZN7WebCore41jsDocumentPrototypeFunctionCreateTextNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16toJSNewlyCreatedEPN3JSC9ExecStateEPNS_4TextE
+__ZN7WebCore6JSText15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSCharacterDataPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSCharacterData15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore6JSTextC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4TextEEE
+__ZN7WebCore6JSTextC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4TextEEE
+__ZN7WebCore15JSCharacterDataC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CharacterDataEEE
+__ZNK7WebCore16JSHTMLDivElement9classInfoEv
+__ZNK7WebCore6JSText9classInfoEv
+__ZN7WebCore4Node16insertedIntoTreeEb
+__ZN7WebCore16JSHTMLDivElementD1Ev
+__ZThn8_N7WebCore14HTMLDivElementD0Ev
+__ZN7WebCore17JSHTMLFormElementD1Ev
+__ZThn8_N7WebCore15HTMLFormElementD0Ev
+__ZN7WebCore15HTMLFormElementD0Ev
+__ZN7WebCore15FormDataBuilderD1Ev
+__ZN7WebCore15FormDataBuilderD2Ev
+__ZNK7WebCore26CachedScriptSourceProvider8getRangeEii
+__ZN7WebCore26jsDOMWindowNodeConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore6JSNode14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore17JSNodeConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18jsNodeELEMENT_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsDOMWindowElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore32setJSDOMWindowElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN3JSC8JSObject9putDirectERKNS_10IdentifierENS_7JSValueEj
+__ZNK7WebCore20JSElementConstructor9classInfoEv
+__ZN7WebCore20JSElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27jsDOMWindowEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7JSEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore18JSEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24JSHTMLElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsDOMWindowPrototypeFunctionSetIntervalEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSDOMWindow11setIntervalEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore15ScheduledAction6createEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore15ScheduledActionC1EN3JSC7JSValueERKNS1_7ArgListE
+__ZN7WebCore15ScheduledActionC2EN3JSC7JSValueERKNS1_7ArgListE
+__ZN7WebCore9DOMWindow11setIntervalEPNS_15ScheduledActionEi
+__ZNK7WebCore9DOMWindow22scriptExecutionContextEv
+__ZN7WebCore8DOMTimer7installEPNS_22ScriptExecutionContextEPNS_15ScheduledActionEib
+__ZN7WebCore8DOMTimerC1EPNS_22ScriptExecutionContextEPNS_15ScheduledActionEib
+__ZN7WebCore8DOMTimerC2EPNS_22ScriptExecutionContextEPNS_15ScheduledActionEib
+__ZN7WebCore15ActiveDOMObjectC2EPNS_22ScriptExecutionContextEPv
+__ZN7WebCore22ScriptExecutionContext22createdActiveDOMObjectEPNS_15ActiveDOMObjectEPv
+__ZN3WTF7HashMapIPN7WebCore15ActiveDOMObjectEPvNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS7_IS4_EEE3addERKS3_RKS4_
+__ZN3WTF9HashTableIPN7WebCore15ActiveDOMObjectESt4pairIS3_PvENS_18PairFirstExtractorIS6_EENS_7PtrHashIS3_EENS_14PairHashTraitsI
+__ZN7WebCore22ScriptExecutionContext10addTimeoutEiPNS_8DOMTimerE
+__ZN3WTF7HashMapIiPN7WebCore8DOMTimerENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3setERKiRKS3_
+__ZN3WTF9HashTableIiSt4pairIiPN7WebCore8DOMTimerEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTrai
+__ZN7WebCore37jsDOMWindowHTMLFormElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLFormElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLFormElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLFormElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore38jsDOMWindowHTMLInputElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLInputElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLInputElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLInputElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsDOMWindowHTMLSelectElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLSelectElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLSelectElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSHTMLSelectElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore41jsDOMWindowHTMLTextAreaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLTextAreaElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLTextAreaElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSHTMLTextAreaElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSHTMLTextAreaElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21jsDocumentDefaultViewEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9DOMWindowE
+__ZN7WebCore18jsLocationHostnameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Location8hostnameEv
+__ZN7WebCore19setJSDocumentCookieEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore8Document9setCookieERKNS_6StringE
+__ZN7WebCore10setCookiesEPNS_8DocumentERKNS_4KURLERKNS_6StringE
+__ZThn32_NK7WebCore8DOMTimer18hasPendingActivityEv
+__ZNK7WebCore8DOMTimer18hasPendingActivityEv
+__ZN7WebCore14jsLocationHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Location4hrefEv
+__ZNK7WebCore4KURL7hasPathEv
+__ZNK7WebCore4KURL9prettyURLEv
+__ZN7WebCore16jsDocumentImagesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document6imagesEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14HTMLCollectionE
+__ZN7WebCore16JSHTMLCollection15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSHTMLCollectionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLCollectionEEE
+__ZN7WebCore16JSHTMLCollectionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLCollectionEEE
+__ZN7WebCore16JSHTMLCollection18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSHTMLCollectionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsHTMLCollectionLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSHTMLCollection18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore16JSHTMLCollection11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore21jsHTMLImageElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement3srcEv
+__ZN7WebCoreL28createHTMLLinkElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLLinkElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLLinkElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLLinkElementEEE
+__ZN7WebCore17JSHTMLLinkElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLLinkElementEEE
+__ZN7WebCore17JSHTMLLinkElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21jsHTMLLinkElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement4hrefEv
+__ZNK7WebCore17JSHTMLLinkElement9classInfoEv
+__ZN7WebCore19JSHTMLIFrameElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsHTMLIFrameElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLFrameElementBase3srcEv
+__ZN7WebCore28JSHTMLIFrameElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore19JSHTMLIFrameElement9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore23JSHTMLOptionsCollectionEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore23JSHTMLOptionsCollection16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore23JSHTMLOptionsCollection6lengthEPN3KJS9ExecStateE
-__ZN7WebCore28JSHTMLIFrameElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE14expandCapacityEmPKS4_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE15reserveCapacityEm
-__ZNK7WebCore16DeprecatedString8toUShortEPbi
-__ZNK7WebCore16DeprecatedString6toUIntEPbi
-__ZSt13binary_searchIPKttEbT_S2_RKT0_
-__ZSt11lower_boundIPKttET_S2_S2_RKT0_
-__ZN7WebCore10HTMLParser23noembedCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore5Frame15sendResizeEventEv
-__ZN7WebCore17HTMLAnchorElement9setTargetERKNS_6StringE
-__ZN7WebCore18JSHTMLUListElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore15RenderContainer28removeLeftoverAnonymousBlockEPNS_11RenderBlockE
-__ZNK7WebCore17HTMLAnchorElement4typeEv
-__ZNK7WebCore17HTMLAnchorElement8protocolEv
-__ZN7WebCore17HTMLObjectElement19removedFromDocumentEv
-__ZN7WebCore17JSHTMLLinkElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore17JSHTMLLinkElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore15HTMLLinkElement11setDisabledEb
-__ZN7WebCore15HTMLLinkElement16setDisabledStateEb
-__ZN7WebCore19JSHTMLAnchorElement14getConstructorEPN3KJS9ExecStateE
-__ZN3KJS17staticValueGetterIN7WebCore16JSHTMLDivElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSHTMLDivElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore16JSHTMLDivElement14getConstructorEPN3KJS9ExecStateE
-__ZN3KJS17staticValueGetterIN7WebCore15JSHTMLLIElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore15JSHTMLLIElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore15JSHTMLLIElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore19tableColConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore19HTMLTableColElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore19HTMLTableColElement17endTagRequirementEv
-__ZNK7WebCore19HTMLTableColElement11tagPriorityEv
-__ZNK7WebCore19HTMLTableColElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore19HTMLTableColElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore19HTMLTableColElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore13JSXPathResult14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore22JSXPathResultPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore24JSXPathResultConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore24JSXPathResultConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore24JSXPathResultConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore35jsDocumentPrototypeFunctionEvaluateEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore17toXPathNSResolverEPN3KJS7JSValueE
-__ZN7WebCore23JSCustomXPathNSResolver6createEPN3KJS9ExecStateEPNS1_7JSValueE
-__ZN7WebCore13toXPathResultEPN3KJS7JSValueE
+__ZN7WebCore10JSNodeList18canGetItemsForNameEPN3JSC9ExecStateEPNS_8NodeListERKNS1_10IdentifierE
+__ZNK7WebCore15DynamicNodeList12itemWithNameERKNS_12AtomicStringE
+__ZN7WebCore19JSNodeListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore14jsLocationHostEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Location4hostEv
+__ZN7WebCore22jsHTMLElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSHTMLDivElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore36jsDOMWindowXMLHttpRequestConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow14xmlHttpRequestEPN3JSC9ExecStateE
+__ZN7WebCore27JSXMLHttpRequestConstructorC1EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore27JSXMLHttpRequestConstructorC2EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore25JSXMLHttpRequestPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSXMLHttpRequest15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSXMLHttpRequestConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCoreL23constructXMLHttpRequestEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZNK7WebCore27JSXMLHttpRequestConstructor22scriptExecutionContextEv
+__ZN7WebCore14XMLHttpRequestC1EPNS_22ScriptExecutionContextE
+__ZN7WebCore14XMLHttpRequestC2EPNS_22ScriptExecutionContextE
+__ZN7WebCoreL34initializeXMLHttpRequestStaticDataEv
+__ZN7WebCore24XMLHttpRequestStaticDataC1Ev
+__ZN7WebCore24XMLHttpRequestStaticDataC2Ev
+__ZN7WebCore16JSXMLHttpRequestC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14XMLHttpRequestEEE
+__ZN7WebCore16JSXMLHttpRequestC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14XMLHttpRequestEEE
+__ZN7WebCore16JSXMLHttpRequest18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL24getJSXMLHttpRequestTableEPN3JSC9ExecStateE
+__ZN7WebCore25getHashTableForGlobalDataERN3JSC12JSGlobalDataEPKNS0_9HashTableE
+__ZN7WebCore21DOMObjectHashTableMap6mapForERN3JSC12JSGlobalDataE
+__ZN3WTF9HashTableIPKN3JSC9HashTableESt4pairIS4_S2_ENS_18PairFirstExtractorIS6_EENS_7PtrHashIS4_EENS_14PairHashTraitsINS_10Hash
+__ZN3WTF7HashMapIPKN3JSC9HashTableES2_NS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS7_IS2_EEE3setERKS4_RS3_
+__ZN7WebCore26jsXMLHttpRequestReadyStateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14XMLHttpRequest10readyStateEv
+__ZN7WebCore25JSXMLHttpRequestPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL33getJSXMLHttpRequestPrototypeTableEPN3JSC9ExecStateE
+__ZN7WebCore37jsXMLHttpRequestPrototypeFunctionOpenEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSXMLHttpRequest9classInfoEv
+__ZN7WebCore16JSXMLHttpRequest4openEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore14XMLHttpRequest22scriptExecutionContextEv
+__ZThn88_NK7WebCore8Document18virtualCompleteURLERKNS_6StringE
+__ZNK7WebCore8Document18virtualCompleteURLERKNS_6StringE
+__ZN7WebCore14XMLHttpRequest4openERKNS_6StringERKNS_4KURLEbRi
+__ZN7WebCore14XMLHttpRequest13internalAbortEv
+__ZN7WebCore14XMLHttpRequest13clearResponseEv
+__ZN7WebCore14XMLHttpRequest12clearRequestEv
+__ZN7WebCoreL12isValidTokenERKNS_6StringE
+__ZN7WebCore14XMLHttpRequest11changeStateENS0_5StateE
+__ZN7WebCore14XMLHttpRequest28callReadyStateChangeListenerEv
+__ZN7WebCore14XMLHttpRequest29dispatchReadyStateChangeEventEv
+__ZN7WebCore14XMLHttpRequest13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
+__ZNK3WTF7HashMapIN7WebCore12AtomicStringENS_6VectorINS_6RefPtrINS1_13EventListenerEEELm0EEENS1_16AtomicStringHashENS_10HashTra
+__ZN7WebCore38jsDOMWindowPrototypeFunctionSetTimeoutEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSDOMWindow10setTimeoutEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore9DOMWindow10setTimeoutEPNS_15ScheduledActionEi
+__ZN7WebCore16JSXMLHttpRequest3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore37setJSXMLHttpRequestOnreadystatechangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore49jsXMLHttpRequestPrototypeFunctionSetRequestHeaderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSXMLHttpRequest16setRequestHeaderEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore14XMLHttpRequest16setRequestHeaderERKNS_12AtomicStringERKNS_6StringERi
+__ZNK7WebCore14XMLHttpRequest19isSafeRequestHeaderERKNS_6StringE
+__ZN7WebCore14XMLHttpRequest24setRequestHeaderInternalERKNS_12AtomicStringERKNS_6StringE
+__ZN3WTF7HashMapIN7WebCore12AtomicStringENS1_6StringENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS5_IS3_EEE3addERKS2_RKS3_
+__ZN7WebCore37jsXMLHttpRequestPrototypeFunctionSendEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSXMLHttpRequest4sendEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore14XMLHttpRequest4sendERi
+__ZN7WebCore14XMLHttpRequest4sendERKNS_6StringERi
+__ZN7WebCore14XMLHttpRequest8initSendERi
+__ZN7WebCore14XMLHttpRequest13createRequestERi
+__ZN7WebCore14XMLHttpRequest22dispatchLoadStartEventEv
+__ZN7WebCore14XMLHttpRequest35dispatchXMLHttpRequestProgressEventEPNS_13EventListenerERKNS_12AtomicStringEbjj
+__ZN7WebCore27XMLHttpRequestProgressEventD0Ev
+__ZNK7WebCore14SecurityOrigin10canRequestERKNS_4KURLE
+__ZNK7WebCore14SecurityOrigin20isSameSchemeHostPortEPKS0_
+__ZN7WebCore14XMLHttpRequest21makeSameOriginRequestERi
+__ZN7WebCore19ResourceRequestBase13setHTTPMethodERKNS_6StringE
+__ZN7WebCore19ResourceRequestBase19addHTTPHeaderFieldsERKNS_13HTTPHeaderMapE
+__ZN7WebCore19ResourceRequestBase18addHTTPHeaderFieldERKNS_12AtomicStringERKNS_6StringE
+__ZN7WebCore14XMLHttpRequest25loadRequestAsynchronouslyERNS_15ResourceRequestE
+__ZN7WebCore16ThreadableLoader6createEPNS_22ScriptExecutionContextEPNS_22ThreadableLoaderClientERKNS_15ResourceRequestENS_13Loa
+__ZNK7WebCore22ScriptExecutionContext15isWorkerContextEv
+__ZN7WebCore24DocumentThreadableLoader6createEPNS_8DocumentEPNS_22ThreadableLoaderClientERKNS_15ResourceRequestENS_13LoadCallba
+__ZN7WebCore24DocumentThreadableLoaderC1EPNS_8DocumentEPNS_22ThreadableLoaderClientERKNS_15ResourceRequestENS_13LoadCallbacksEN
+__ZN7WebCore24DocumentThreadableLoaderC2EPNS_8DocumentEPNS_22ThreadableLoaderClientERKNS_15ResourceRequestENS_13LoadCallbacksEN
+__ZNK7WebCore11ContentData14dataEquivalentERKS0_
+__ZN7WebCoreL21findBeforeAfterParentEPNS_12RenderObjectE
+__ZN7WebCore11ContentData5clearEv
+__ZN7WebCore41jsDOMWindowPrototypeFunctionClearIntervalEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow13clearIntervalEi
+__ZN7WebCore8DOMTimer10removeByIdEPNS_22ScriptExecutionContextEi
+__ZN7WebCore22ScriptExecutionContext11findTimeoutEi
+__ZNK3WTF7HashMapIiPN7WebCore8DOMTimerENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3getERKi
+__ZN7WebCore8DOMTimerD0Ev
+__ZN7WebCore22ScriptExecutionContext13removeTimeoutEi
+__ZN7WebCore15ActiveDOMObjectD2Ev
+__ZN7WebCore22ScriptExecutionContext24destroyedActiveDOMObjectEPNS_15ActiveDOMObjectE
+__ZN7WebCore16jsNodeParentNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL29createHTMLLabelElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLLabelElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLLabelElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLLabelElementEEE
+__ZN7WebCore18JSHTMLLabelElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLLabelElementEEE
+__ZN7WebCore18JSHTMLLabelElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsElementTagNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore48jsElementPrototypeFunctionGetElementsByClassNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore18JSHTMLLabelElement9classInfoEv
+__ZN7WebCore4Node22getElementsByClassNameERKNS_6StringE
+__ZN3WTF7HashMapIN7WebCore6StringEPNS1_15DynamicNodeList6CachesENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3addERKS2_RKS5
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_15DynamicNodeList6CachesEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_
+__ZN7WebCore13ClassNodeListC1EN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringEPNS_15DynamicNodeList6CachesE
+__ZN7WebCore13ClassNodeListC2EN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringEPNS_15DynamicNodeList6CachesE
+__ZNK7WebCore13ClassNodeList11nodeMatchesEPNS_7ElementE
+__ZN7WebCore14ClassNamesData11containsAllERS0_
+__ZN7WebCore16jsNodeFirstChildEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore6JSText18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore15JSCharacterData18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore15jsNodeNodeValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSCharacterData3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore18setJSNodeNodeValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore13CharacterData12setNodeValueERKNS_6StringERi
+__ZN7WebCore13CharacterData7setDataERKNS_6StringERi
+__ZN7WebCore13CharacterData21dispatchModifiedEventEPNS_10StringImplE
+__ZN7WebCore8Document11textRemovedEPNS_4NodeEjj
+__ZN7WebCore8Document13removeMarkersEPNS_4NodeEjiNS_14DocumentMarker10MarkerTypeE
+__ZN7WebCore8Document12shiftMarkersEPNS_4NodeEjiNS_14DocumentMarker10MarkerTypeE
+__ZN7WebCore12RenderObject12removeLayersEPNS_11RenderLayerE
+__ZN7WebCore27RenderTextControlInnerBlockD0Ev
+__ZN7WebCore27RenderTextControlSingleLineD0Ev
+__ZN7WebCore17RenderTextControlD2Ev
+__ZThn8_N7WebCore27TextControlInnerTextElementD0Ev
+__ZN7WebCore27TextControlInnerTextElementD0Ev
+__ZN7WebCore14HTMLDivElementD2Ev
+__ZN3WTF10RefCountedIN7WebCore16SharedFontFamilyEE5derefEv
+__ZN7WebCore38jsElementPrototypeFunctionGetAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore7Element12getAttributeERKNS_6StringE
+__ZThn8_N7WebCore23TextControlInnerElementD0Ev
+__ZN7WebCore23TextControlInnerElementD0Ev
+__ZN7WebCore7Element19removedFromDocumentEv
+__ZN7WebCore13ContainerNode19removedFromDocumentEv
+__ZN7WebCore4Node19removedFromDocumentEv
+__ZN7WebCore13ContainerNode15removedFromTreeEb
+__ZN7WebCore31SearchFieldResultsButtonElementD0Ev
+__ZN7WebCore30SearchFieldCancelButtonElementD0Ev
+__ZNK7WebCore14RenderThemeMac39adjustSearchFieldResultsDecorationStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore27RenderTextControlSingleLine27updatePlaceholderVisibilityEv
+__ZN7WebCoreL23replaceChildrenWithTextEPNS_11HTMLElementERKNS_6StringERi
+__ZN7WebCoreL30createHTMLAnchorElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLAnchorElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLAnchorElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLAnchorElementEEE
+__ZN7WebCore19JSHTMLAnchorElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLAnchorElementEEE
+__ZN7WebCore19JSHTMLAnchorElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore26setJSHTMLAnchorElementHrefEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement7setHrefERKNS_12AtomicStringE
+__ZN7WebCore19JSHTMLAnchorElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28JSHTMLAnchorElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSHTMLAnchorElement9classInfoEv
+__ZN7WebCore25setJSHTMLElementInnerHTMLEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement12setInnerHTMLERKNS_6StringERi
+__ZN7WebCore11HTMLElement24createContextualFragmentERKNS_6StringE
+__ZN7WebCore16DocumentFragmentC1EPNS_8DocumentE
+__ZN7WebCore16DocumentFragmentC2EPNS_8DocumentE
+__ZN7WebCore25parseHTMLDocumentFragmentERKNS_6StringEPNS_16DocumentFragmentE
+__ZN7WebCore13HTMLTokenizerC1EPNS_16DocumentFragmentE
+__ZN7WebCore13HTMLTokenizerC2EPNS_16DocumentFragmentE
+__ZN7WebCore10HTMLParserC1EPNS_16DocumentFragmentE
+__ZN7WebCore10HTMLParserC2EPNS_16DocumentFragmentE
+__ZN7WebCore13HTMLTokenizer19setForceSynchronousEb
+__ZN7WebCore16DocumentFragment16childTypeAllowedENS_4Node8NodeTypeE
+__ZN7WebCore13HTMLTokenizerD1Ev
+__ZN7WebCore13HTMLTokenizerD2Ev
+__ZN7WebCoreL27replaceChildrenWithFragmentEPNS_11HTMLElementEN3WTF10PassRefPtrINS_16DocumentFragmentEEERi
+__ZNK7WebCore16DocumentFragment8nodeTypeEv
+__ZN7WebCore13ContainerNode11removeChildEPNS_4NodeERi
+__ZN7WebCoreL15willRemoveChildEPNS_4NodeE
+__ZN7WebCore8Document17nodeWillBeRemovedEPNS_4NodeE
+__ZN7WebCore19SelectionController17nodeWillBeRemovedEPNS_4NodeE
+__ZThn8_N7WebCore16DocumentFragmentD0Ev
+__ZN7WebCore16DocumentFragmentD0Ev
+__ZN7WebCore13ContainerNode12replaceChildEN3WTF10PassRefPtrINS_4NodeEEEPS3_Rib
+__ZN7WebCore4Node17checkReplaceChildEPS0_S1_Ri
+__ZN7WebCore4Node15canReplaceChildEPS0_S1_
+__ZN7WebCoreL11appendASCIIERKNS_6StringEPKcmRN3WTF6VectorIcLm512EEE
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EE14expandCapacityEm
+__ZN7WebCore16jsNodeChildNodesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4Node10childNodesEv
+__ZN7WebCore13ChildNodeListC1EN3WTF10PassRefPtrINS_4NodeEEEPNS_15DynamicNodeList6CachesE
+__ZN7WebCore13ChildNodeListC2EN3WTF10PassRefPtrINS_4NodeEEEPNS_15DynamicNodeList6CachesE
+__ZNK7WebCore13ChildNodeList6lengthEv
+__ZN7WebCore14jsLocationHashEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Location4hashEv
+__ZNK7WebCore4KURL3refEv
+__ZN7WebCore49jsDocumentPrototypeFunctionGetElementsByClassNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4Node13canLazyAttachEv
+__ZN7WebCore18jsLocationPathnameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Location8pathnameEv
+__ZN7WebCore33jsDOMWindowXPathResultConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13JSXPathResult14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore24JSXPathResultConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore22JSXPathResultPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSXPathResult15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSXPathResultConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsXPathResultORDERED_NODE_SNAPSHOT_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsDocumentPrototypeFunctionEvaluateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore17toXPathNSResolverEN3JSC7JSValueE
+__ZN7WebCore23JSCustomXPathNSResolver6createEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore13toXPathResultEN3JSC7JSValueE
 __ZN7WebCore8Document8evaluateERKNS_6StringEPNS_4NodeEPNS_15XPathNSResolverEtPNS_11XPathResultERi
 __ZN7WebCore14XPathEvaluator8evaluateERKNS_6StringEPNS_4NodeEPNS_15XPathNSResolverEtPNS_11XPathResultERi
 __ZN7WebCore5XPath18isValidContextNodeEPNS_4NodeE
 __ZN7WebCore14XPathEvaluator16createExpressionERKNS_6StringEPNS_15XPathNSResolverERi
 __ZN7WebCore15XPathExpression16createExpressionERKNS_6StringEPNS_15XPathNSResolverERi
+__ZN7WebCore5XPath6ParserC1Ev
 __ZN7WebCore5XPath6ParserC2Ev
 __ZN7WebCore5XPath6Parser5resetERKNS_6StringE
 __ZN7WebCore5XPath6Parser14parseStatementERKNS_6StringEN3WTF10PassRefPtrINS_15XPathNSResolverEEERi
 __Z12xpathyyparsePv
-__Z10xpathyylexP7YYSTYPE
 __ZN7WebCore5XPath6Parser3lexEPv
 __ZN7WebCore5XPath6Parser9nextTokenEv
 __ZN7WebCore5XPath6Parser17nextTokenInternalEv
@@ -5843,10 +6397,17 @@ __ZN7WebCore5XPath6Parser6skipWSEv
 __ZN7WebCore5XPath6Parser13peekCurHelperEv
 __ZN7WebCore5XPath6Parser15peekAheadHelperEv
 __ZN7WebCore5XPath6Parser19makeTokenAndAdvanceEii
+__ZN7WebCore5XPath4StepC1ENS1_4AxisERKNS1_8NodeTestERKN3WTF6VectorIPNS0_9PredicateELm0EEE
 __ZN7WebCore5XPath4StepC2ENS1_4AxisERKNS1_8NodeTestERKN3WTF6VectorIPNS0_9PredicateELm0EEE
+__ZN3WTF6VectorIPN7WebCore5XPath9PredicateELm0EEC1ERKS5_
 __ZN3WTF6VectorIPN7WebCore5XPath9PredicateELm0EEC2ERKS5_
 __ZN7WebCore5XPath6Parser17registerParseNodeEPNS0_9ParseNodeE
 __ZN3WTF7HashSetIPN7WebCore5XPath9ParseNodeENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6expandE
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6rehashE
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E13alloca
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E15deallo
+__ZN7WebCore5XPath12LocationPathC1Ev
 __ZN7WebCore5XPath12LocationPathC2Ev
 __ZN7WebCore5XPath10ExpressionC2Ev
 __ZN7WebCore5XPath12LocationPath10appendStepEPNS0_4StepE
@@ -5854,15 +6415,26 @@ __ZN3WTF6VectorIPN7WebCore5XPath4StepELm0EE14expandCapacityEmPKS4_
 __ZN3WTF6VectorIPN7WebCore5XPath4StepELm0EE14expandCapacityEm
 __ZN3WTF6VectorIPN7WebCore5XPath4StepELm0EE15reserveCapacityEm
 __ZN7WebCore5XPath6Parser19unregisterParseNodeEPNS0_9ParseNodeE
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E4findIS4
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E47remove
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6removeE
 __ZNK7WebCore5XPath6Parser17isOperatorContextEv
 __ZN7WebCore5XPath6Parser14registerStringEPNS_6StringE
 __ZN3WTF7HashSetIPN7WebCore6StringENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTable
 __ZN7WebCore5XPath6Parser9lexNCNameERNS_6StringE
-__ZN7WebCore5XPath7charCatEt
-__ZN7WebCore5XPath14isNodeTypeNameERKNS_6StringE
+__ZN7WebCore5XPathL7charCatEt
+__ZN7WebCore5XPathL14isNodeTypeNameERKNS_6StringE
 __ZN7WebCore5XPath6Parser9lexStringEv
+__ZN7WebCore5XPath16StringExpressionC1ERKNS_6StringE
 __ZN7WebCore5XPath16StringExpressionC2ERKNS_6StringE
 __ZN7WebCore5XPath6Parser12deleteStringEPNS_6StringE
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22Ide
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInvali
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
 __ZN3WTF6VectorIPN7WebCore5XPath10ExpressionELm0EE14expandCapacityEmPKS4_
 __ZN3WTF6VectorIPN7WebCore5XPath10ExpressionELm0EE14expandCapacityEm
 __ZN3WTF6VectorIPN7WebCore5XPath10ExpressionELm0EE15reserveCapacityEm
@@ -5870,16 +6442,15 @@ __ZN7WebCore5XPath6Parser24registerExpressionVectorEPN3WTF6VectorIPNS0_10Express
 __ZN3WTF7HashSetIPNS_6VectorIPN7WebCore5XPath10ExpressionELm0EEENS_7PtrHashIS7_EENS_10HashTraitsIS7_EEE3addERKS7_
 __ZN7WebCore5XPath6Parser11expandQNameERKNS_6StringERS2_S5_
 __ZN7WebCore5XPath14createFunctionERKNS_6StringERKN3WTF6VectorIPNS0_10ExpressionELm0EEE
-__ZN7WebCore5XPath17createFunctionMapEv
+__ZN7WebCore5XPathL17createFunctionMapEv
 __ZN3WTF7HashMapIN7WebCore6StringENS1_5XPath11FunctionRecENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_5XPath11FunctionRecEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E3addINS1_6StringES6_NS_17HashMapTranslatorILb0ES4_ISI_S6_ENS_18PairBaseHashTraitsINSC_ISI_EESE_EESF_SA_EEEES4_INS_17HashTableIteratorIS3_S7_S9_SA_SF_SD_EEbERKT_RKT0_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_5XPath11FunctionRecEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E6expandEv
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_5XPath11FunctionRecEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E4findIS3_NS_22IdentityHashTranslatorIS3_S7_SA_EEEENS_17HashTableIteratorIS3_S7_S9_SA_SF_SD_EERKT_
-__ZN7WebCore5XPath15createFunConcatEv
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_5XPath11FunctionRecEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14Pair
+__ZN7WebCore5XPathL15createFunConcatEv
 __ZN7WebCore5XPath8Function12setArgumentsERKN3WTF6VectorIPNS0_10ExpressionELm0EEE
 __ZN7WebCore5XPath6Parser22deleteExpressionVectorEPN3WTF6VectorIPNS0_10ExpressionELm0EEE
 __ZN3WTF6VectorIPN7WebCore5XPath10ExpressionELm0EE6shrinkEm
-__ZN7WebCore5XPath17createFunContainsEv
+__ZN7WebCore5XPathL17createFunContainsEv
+__ZN7WebCore5XPath9PredicateC1EPNS0_10ExpressionE
 __ZN7WebCore5XPath9PredicateC2EPNS0_10ExpressionE
 __ZN3WTF6VectorIPN7WebCore5XPath9PredicateELm0EE14expandCapacityEmPKS4_
 __ZN3WTF6VectorIPN7WebCore5XPath9PredicateELm0EE14expandCapacityEm
@@ -5889,6 +6460,8 @@ __ZN3WTF7HashSetIPNS_6VectorIPN7WebCore5XPath9PredicateELm0EEENS_7PtrHashIS7_EEN
 __ZN7WebCore5XPath6Parser21deletePredicateVectorEPN3WTF6VectorIPNS0_9PredicateELm0EEE
 __ZN3WTF6VectorIPN7WebCore5XPath9PredicateELm0EE6shrinkEm
 __ZN7WebCore5XPath12LocationPath16optimizeStepPairEj
+__ZN3WTF9HashTableIPN7WebCore5XPath9ParseNodeES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E5clearEv
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E15de
 __ZN7WebCore15XPathExpression8evaluateEPNS_4NodeEtPNS_11XPathResultERi
 __ZN7WebCore5XPath10Expression17evaluationContextEv
 __ZNK7WebCore5XPath12LocationPath8evaluateEv
@@ -5902,3361 +6475,6529 @@ __ZNK7WebCore5XPath11FunContains8evaluateEv
 __ZNK7WebCore5XPath9FunConcat8evaluateEv
 __ZNK7WebCore5XPath16StringExpression8evaluateEv
 __ZNK7WebCore5XPath5Value8toStringEv
+__ZN3WTF6VectorItLm1024EE6appendItEEvPKT_m
 __ZN7WebCore7Element18getAttributeNodeNSERKNS_6StringES3_
-__ZNK7WebCore12NamedAttrMap12getNamedItemERKNS_13QualifiedNameE
+__ZNK7WebCore12NamedNodeMap12getNamedItemERKNS_13QualifiedNameE
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_S2_ENS_18PairFirstExtractorIS4_EENS1_10StringHashENS_14PairHashTraitsINS_10HashT
 __ZNK7WebCore5XPath5Value9toBooleanEv
+__ZNK7WebCore4Attr19virtualNamespaceURIEv
 __ZNK7WebCore4Attr12namespaceURIEv
 __ZNK7WebCore5XPath7NodeSet9firstNodeEv
 __ZNK7WebCore5XPath7NodeSet4sortEv
 __ZN7WebCore5XPath11stringValueEPNS_4NodeE
-__ZN7WebCore11XPathResultC2EPNS_15EventTargetNodeERKNS_5XPath5ValueE
+__ZN7WebCore11XPathResultC1EPNS_4NodeERKNS_5XPath5ValueE
+__ZN7WebCore11XPathResultC2EPNS_4NodeERKNS_5XPath5ValueE
 __ZNK7WebCore5XPath5Value9toNodeSetEv
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EEaSERKS5_
 __ZN7WebCore11XPathResult9convertToEtRi
 __ZN3WTF6VectorIPN7WebCore4NodeELm0EE14expandCapacityEmPKS3_
 __ZN3WTF6VectorIPN7WebCore4NodeELm0EE14expandCapacityEm
 __ZN3WTF6VectorIPN7WebCore4NodeELm0EE15reserveCapacityEm
-__ZN7WebCore5XPath9sortBlockEjjRN3WTF6VectorINS2_IPNS_4NodeELm0EEELm0EEEb
+__ZN7WebCore5XPathL9sortBlockEjjRN3WTF6VectorINS2_IPNS_4NodeELm0EEELm0EEEb
+__ZNK3WTF9HashTableIPN7WebCore4NodeES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8containsIS3_NS_22
 __ZN3WTF6VectorINS0_IPN7WebCore4NodeELm0EEELm0EE6shrinkEm
 __ZN3WTF6VectorIPN7WebCore4NodeELm0EE6shrinkEm
+__ZN7WebCore15XPathExpressionD1Ev
 __ZN7WebCore15XPathExpressionD2Ev
-__ZN7WebCore5XPath12LocationPathD1Ev
+__ZN7WebCore5XPath12LocationPathD0Ev
 __ZN3WTF15deleteAllValuesIPN7WebCore5XPath4StepELm0EEEvRKNS_6VectorIT_XT0_EEE
-__ZN7WebCore5XPath4StepD1Ev
+__ZN7WebCore5XPath4StepD0Ev
 __ZN3WTF15deleteAllValuesIPN7WebCore5XPath9PredicateELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN7WebCore5XPath9PredicateD1Ev
 __ZN7WebCore5XPath9PredicateD2Ev
-__ZN7WebCore5XPath8FunctionD0Ev
+__ZN7WebCore5XPath11FunContainsD0Ev
+__ZN7WebCore5XPath10ExpressionD2Ev
 __ZN3WTF15deleteAllValuesIPN7WebCore5XPath10ExpressionELm0EEEvRKNS_6VectorIT_XT0_EEE
-__ZN7WebCore5XPath16StringExpressionD1Ev
+__ZN7WebCore5XPath9FunConcatD0Ev
+__ZN7WebCore5XPath16StringExpressionD0Ev
 __ZN3WTF6VectorIPN7WebCore5XPath4StepELm0EE6shrinkEm
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_11XPathResultE
-__ZN7WebCore13JSXPathResultC1EPN3KJS8JSObjectEPNS_11XPathResultE
-__ZN7WebCore13JSXPathResult18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore13JSXPathResultEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore13JSXPathResult16getValuePropertyEPN3KJS9ExecStateEi
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_11XPathResultE
+__ZN7WebCore13JSXPathResultC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11XPathResultEEE
+__ZN7WebCore13JSXPathResultC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11XPathResultEEE
+__ZN7WebCore13JSXPathResult18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27jsXPathResultSnapshotLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore11XPathResult14snapshotLengthERi
 __ZNK7WebCore11XPathResult10resultTypeEv
-__ZN7WebCore22JSXPathResultPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore42jsXPathResultPrototypeFunctionSnapshotItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore22JSXPathResultPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsXPathResultPrototypeFunctionSnapshotItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZNK7WebCore13JSXPathResult9classInfoEv
 __ZN7WebCore11XPathResult12snapshotItemEmRi
-__ZNK7WebCore19HTMLTableColElement36canHaveAdditionalAttributeStyleDeclsEv
-__ZN7WebCore19HTMLTableColElement29additionalAttributeStyleDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
-__ZN7WebCore14RenderTableColC2EPNS_4NodeE
-__ZN7WebCore14RenderTableCol17updateFromElementEv
-__ZN7WebCore14RenderTableCol13requiresLayerEv
-__ZNK7WebCore14RenderTableCol10isTableColEv
-__ZNK7WebCore14RenderTableCol15canHaveChildrenEv
-__ZNK7WebCore14RenderTableCol14isChildAllowedEPNS_12RenderObjectEPNS_11RenderStyleE
-__ZN7WebCore13MutationEventC2ERKNS_12AtomicStringEbbPNS_4NodeERKNS_6StringES8_S8_t
+__ZN7WebCore49jsXMLHttpRequestPrototypeFunctionOverrideMimeTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSXMLHttpRequest16overrideMimeTypeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore14XMLHttpRequest16overrideMimeTypeERKNS_6StringE
+__ZN7WebCore5XPathL18createFunLocalNameEv
+__ZN7WebCore5XPath6Parser19makeTokenAndAdvanceEiNS0_8EqTestOp6OpcodeEi
+__ZN7WebCore5XPath8EqTestOpC1ENS1_6OpcodeEPNS0_10ExpressionES4_
+__ZN7WebCore5XPath8EqTestOpC2ENS1_6OpcodeEPNS0_10ExpressionES4_
+__ZN7WebCore5XPath9LogicalOpC1ENS1_6OpcodeEPNS0_10ExpressionES4_
+__ZN7WebCore5XPath9LogicalOpC2ENS1_6OpcodeEPNS0_10ExpressionES4_
+__ZNK7WebCore5XPath9LogicalOp8evaluateEv
+__ZNK7WebCore5XPath8EqTestOp8evaluateEv
+__ZNK7WebCore5XPath12FunLocalName8evaluateEv
+__ZNK7WebCore5XPath8EqTestOp7compareERKNS0_5ValueES4_
+__ZNK7WebCore5XPath9LogicalOp14shortCircuitOnEv
+__ZN7WebCore5XPath9LogicalOpD0Ev
+__ZN7WebCore5XPath8EqTestOpD0Ev
+__ZN7WebCore5XPath12FunLocalNameD0Ev
+__ZN7WebCoreL26createHTMLLIElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore15JSHTMLLIElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSHTMLLIElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13HTMLLIElementEEE
+__ZN7WebCore15JSHTMLLIElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13HTMLLIElementEEE
+__ZN7WebCore15JSHTMLLIElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore14jsNodeNodeTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL29createHTMLUListElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLUListElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLUListElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLUListElementEEE
+__ZN7WebCore18JSHTMLUListElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLUListElementEEE
+__ZN7WebCore18JSHTMLUListElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL28createHTMLHtmlElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLHtmlElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLHtmlElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLHtmlElementEEE
+__ZN7WebCore17JSHTMLHtmlElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLHtmlElementEEE
+__ZN7WebCore17JSHTMLHtmlElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSHTMLUListElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore14jsElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13StyledElement5styleEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19CSSStyleDeclarationE
+__ZN7WebCore21JSCSSStyleDeclaration15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSCSSStyleDeclarationC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19CSSStyleDeclarationEEE
+__ZN7WebCore21JSCSSStyleDeclarationC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19CSSStyleDeclarationEEE
+__ZN7WebCore21JSCSSStyleDeclaration3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore21JSCSSStyleDeclaration9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCoreL17isCSSPropertyNameERKN3JSC10IdentifierE
+__ZN7WebCoreL15cssPropertyNameERKN3JSC10IdentifierEPb
+__ZN7WebCoreL24hasCSSPropertyNamePrefixERKN3JSC10IdentifierEPKc
+__ZN7WebCore19CSSStyleDeclaration14isPropertyNameERKNS_6StringE
+__ZN7WebCore19CSSStyleDeclaration11setPropertyERKNS_6StringES3_Ri
+__ZN7WebCore10StringImpl4findEPKcib
+__ZN7WebCore19CSSStyleDeclaration11setPropertyERKNS_6StringES3_S3_Ri
+__ZN7WebCore26CSSMutableStyleDeclaration11setPropertyEiRKNS_6StringEbRi
+__ZN7WebCore34jsNodePrototypeFunctionRemoveChildEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore6JSNode11removeChildEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore12RenderInline7destroyEv
+__ZN7WebCore12RenderInlineD0Ev
+__ZN7WebCore8RenderBRD0Ev
+__ZN7WebCore14RenderListItem7destroyEv
+__ZN7WebCore16RenderListMarkerD0Ev
+__ZN7WebCore14RenderListItemD0Ev
+__ZN7WebCore11RenderBlock20removeFloatingObjectEPNS_9RenderBoxE
+__ZN7WebCore11RenderBlock22removePositionedObjectEPNS_9RenderBoxE
+__ZN7WebCore4Node21dispatchMutationEventERKNS_12AtomicStringEbN3WTF10PassRefPtrIS0_EERKNS_6StringES9_Ri
+__ZN7WebCore13MutationEventC1ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringESA_SA_t
+__ZN7WebCore13MutationEventC2ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringESA_SA_t
 __ZN7WebCore25InvalidatingEventListener11handleEventEPNS_5EventEb
 __ZN7WebCore11XPathResult23invalidateIteratorStateEv
+__ZN7WebCore13MutationEventD0Ev
+__ZN7WebCore8Document17removeElementByIdERKNS_12AtomicStringEPNS_7ElementE
+__ZN7WebCore16HTMLImageElement19removedFromDocumentEv
+__ZN7WebCore12HTMLDocument15removeNamedItemERKNS_12AtomicStringE
+__ZN7WebCoreL17removeItemFromMapERN3WTF7HashMapIPNS_16AtomicStringImplEiNS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EENS6_IiEEEERKNS_
+__ZN7WebCore12HTMLDocument20removeExtraNamedItemERKNS_12AtomicStringE
+__ZN7WebCore23jsHTMLAnchorElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement4hrefEv
+__ZN7WebCore15jsHTMLElementIdEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13StyledElement20updateStyleAttributeEv
+__ZN7WebCore38jsDocumentPrototypeFunctionCreateEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document11createEventERKNS_6StringERi
+__ZN7WebCore5EventC1Ev
+__ZN7WebCore5EventC2Ev
+__ZN7WebCore7JSEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL15getJSEventTableEPN3JSC9ExecStateE
+__ZN7WebCore16JSEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL24getJSEventPrototypeTableEPN3JSC9ExecStateE
+__ZN7WebCore33jsEventPrototypeFunctionInitEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore7JSEvent9classInfoEv
+__ZN7WebCore5Event9initEventERKNS_12AtomicStringEbb
+__ZN7WebCore7JSEvent3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore36jsNodePrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7toEventEN3JSC7JSValueE
+__ZNK7WebCore13ChildNodeList4itemEj
+__ZN7WebCore15JSHTMLLIElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore32jsNodePrototypeFunctionCloneNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore18JSHTMLUListElement9classInfoEv
+__ZN7WebCore7Element9cloneNodeEb
+__ZN7WebCore7Element27cloneElementWithoutChildrenEv
+__ZN7WebCore8Document13createElementERKNS_13QualifiedNameEb
+__ZN7WebCore13StyledElement26copyNonAttributePropertiesEPKNS_7ElementE
+__ZN7WebCoreL29createHTMLOListElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLOListElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLOListElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLOListElementEEE
+__ZN7WebCore18JSHTMLOListElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLOListElementEEE
+__ZN7WebCore4Node15removedFromTreeEb
+__ZNK7WebCore15ActiveDOMObject18hasPendingActivityEv
+__ZN7WebCore16JSXMLHttpRequest4markEv
+__ZN7WebCore27JSXMLHttpRequestConstructor4markEv
+__ZN7WebCore16JSHTMLCollectionD1Ev
+__ZN7WebCore16JSHTMLCollectionD2Ev
+__ZN7WebCore18JSHTMLInputElementD1Ev
+__ZN7WebCore19JSHTMLAnchorElementD1Ev
+__ZN7WebCore13ClassNodeListD0Ev
+__ZN7WebCore13ChildNodeListD0Ev
+__ZN7WebCore6JSTextD1Ev
+__ZN7WebCore18JSHTMLLabelElementD1Ev
+__ZN7WebCore13JSXPathResultD1Ev
+__ZN7WebCore13JSXPathResultD2Ev
+__ZN7WebCore11XPathResultD1Ev
 __ZN7WebCore11XPathResultD2Ev
-__ZN7WebCore27getExceptionCodeDescriptionEiRNS_24ExceptionCodeDescriptionE
-__ZN7WebCore13ExceptionBaseC2ERKNS_24ExceptionCodeDescriptionE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_16DOMCoreExceptionE
-__ZN7WebCore27JSDOMCoreExceptionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSDOMCoreExceptionC1EPN3KJS8JSObjectEPNS_16DOMCoreExceptionE
-__ZN7WebCore18JSDOMCoreException18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSDOMCoreExceptionPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore10RenderText22containsOnlyWhitespaceEjj
-__ZN7WebCore10JSLocation3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore31jsNodeListPrototypeFunctionItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore18JSCommentPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore9JSCommentC1EPN3KJS8JSObjectEPNS_7CommentE
-__ZN7WebCore9JSComment18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19JSHTMLScriptElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore17HTMLScriptElement6setSrcERKNS_6StringE
-__ZN7WebCore36jsDOMWindowPrototypeFunctionScrollToEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9DOMWindow8scrollToEii
-__ZN7WebCore10MouseEventC1Ev
-__ZN7WebCore17MouseRelatedEventC2Ev
-__ZN7WebCore7UIEventC1Ev
-__ZN7WebCore8Document7anchorsEv
-__ZNK7WebCore14HTMLCollection9namedItemERKNS_6StringEb
-__ZNK7WebCore14HTMLCollection17checkForNameMatchEPNS_7ElementEbRKNS_6StringEb
-__ZN7WebCore11RenderLayer19removeOnlyThisLayerEv
-__ZN7WebCore38jsDocumentPrototypeFunctionCreateRangeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_5RangeE
-__ZN7WebCore16JSRangePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore7JSRangeC1EPN3KJS8JSObjectEPNS_5RangeE
-__ZN7WebCore7JSRange18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore16JSRangePrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore42jsRangePrototypeFunctionSelectNodeContentsEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore7JSRange9classInfoEv
-__ZN7WebCore32jsRangePrototypeFunctionCollapseEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore48jsRangePrototypeFunctionCreateContextualFragmentEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore5Range24createContextualFragmentERKNS_6StringERi
-__ZN7WebCore27JSDocumentFragmentPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSDocumentFragmentC1EPN3KJS8JSObjectEPNS_16DocumentFragmentE
-__ZNK7WebCore18JSDocumentFragment9classInfoEv
-__ZN3KJS6Window11indexGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore9FrameTree5childEj
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLEmbedElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLEmbedElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore16HTMLEmbedElement4typeEv
-__ZNK7WebCore16HTMLEmbedElement3srcEv
-__ZN7WebCore16HTMLImageElement7setNameERKNS_6StringE
-__ZN7WebCore16HTMLImageElement8setAlignERKNS_6StringE
-__ZN7WebCore16HTMLImageElement9setHspaceEi
-__ZN7WebCore16HTMLImageElement9setVspaceEi
-__ZN7WebCore30JSCSSStyleDeclarationPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore54jsCSSStyleDeclarationPrototypeFunctionGetPropertyValueEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore21JSCSSStyleDeclaration9classInfoEv
-__ZN7WebCore4Path7addRectERKNS_9FloatRectE
-__ZNK7WebCore11FrameLoader13urlsMatchItemEPNS_11HistoryItemE
-__ZNK7WebCore11HistoryItem6targetEv
-__ZN3KJS17staticValueGetterIN7WebCore17JSHTMLLinkElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSHTMLLinkElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore15HTMLLinkElement8disabledEv
-__ZNK7WebCore11HistoryItem17childItemWithNameERKNS_6StringE
-__ZN7WebCore11FrameLoader25setProvisionalHistoryItemEN3WTF10PassRefPtrINS_11HistoryItemEEE
-__ZN7WebCore18JSCommentPrototypeD0Ev
-__ZN7WebCore27JSDocumentFragmentPrototypeD0Ev
-__ZN7WebCore19HTMLTableColElementD1Ev
-__ZN7WebCore19HTMLTextAreaElement12restoreStateERKNS_6StringE
-__ZN7WebCore19HTMLTextAreaElement15setDefaultValueERKNS_6StringE
-__ZN7WebCore17HTMLOptionElement7setTextERKNS_6StringERi
-__ZN7WebCore17HTMLSelectElement8setValueERKNS_6StringE
-__ZN3KJS17staticValueGetterIN7WebCore17JSHTMLAreaElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSHTMLAreaElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore15HTMLAreaElement4hrefEv
-__ZN7WebCore12EventHandler28passMouseMoveEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameEPNS_13HitTestResultE
-__ZN7WebCore12EventHandler27passSubframeEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameEPNS_13HitTestResultE
-__ZN7WebCore11FrameLoader22updateHistoryForReloadEv
-__ZNK7WebCore13HTMLLIElement4typeEv
-__ZNK7WebCore13HTMLLIElement5valueEv
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLUListElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLUListElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore16HTMLUListElement4typeEv
-__ZNK7WebCore4Page14frameNamespaceEv
-__ZNK7WebCore8Document8nodeNameEv
-__ZN7WebCore14JSHTMLDocument14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore36jsNodePrototypeFunctionHasChildNodesEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore5Color4darkEv
-__ZN7WebCore16textBreakCurrentEPNS_17TextBreakIteratorE
-__ZN7WebCore14cookiesEnabledEPKNS_8DocumentE
-__ZN7WebCore18createTitleWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore27JSHTMLTitleElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLTitleElementC1EPN3KJS8JSObjectEPNS_16HTMLTitleElementE
-__ZN7WebCore17createMetaWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore26JSHTMLMetaElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLMetaElementC1EPN3KJS8JSObjectEPNS_15HTMLMetaElementE
-__ZN7WebCore18JSHTMLTitleElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17JSHTMLMetaElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16JSEventPrototype9classInfoEv
-__ZNK7WebCore7JSEvent13clipboardDataEPN3KJS9ExecStateE
-__ZNK7WebCore5Event16isClipboardEventEv
-__ZN3KJS17staticValueGetterIN7WebCore16JSEventPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSEventPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore16HTMLTableElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore20HTMLTableCellElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore7Comment8toStringEv
-__ZNK7WebCore17HTMLScriptElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore17HTMLIFrameElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore15HTMLFormElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore16HTMLInputElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore17HTMLPlugInElement5widthEv
-__ZNK7WebCore17HTMLPlugInElement6heightEv
+__ZN7WebCore25InvalidatingEventListenerD0Ev
+__ZN7WebCore17JSHTMLHtmlElementD1Ev
+__ZN7WebCore21JSCSSStyleDeclarationD1Ev
+__ZN7WebCore21JSCSSStyleDeclarationD2Ev
+__ZN7WebCore18JSHTMLUListElementD1Ev
+__ZThn8_N7WebCore16HTMLUListElementD0Ev
+__ZN7WebCore16HTMLUListElementD0Ev
+__ZN7WebCoreL31createHTMLHeadingElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore20JSHTMLHeadingElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSHTMLHeadingElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18HTMLHeadingElementEEE
+__ZN7WebCore20JSHTMLHeadingElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18HTMLHeadingElementEEE
+__ZN7WebCore20JSHTMLHeadingElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore18JSHTMLOListElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSHTMLOListElement9classInfoEv
+__ZNK7WebCore5XPath4Step15primaryNodeTypeENS1_4AxisE
+__ZN7WebCore13JSHTMLElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11HTMLElementEEE
+__ZN7WebCore22jsHTMLElementInnerHTMLEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11HTMLElement9innerHTMLEv
+__ZN7WebCore12createMarkupEPKNS_4NodeENS_13EChildrenOnlyEPN3WTF6VectorIPS0_Lm0EEE
+__ZN7WebCore17MarkupAccumulator12appendMarkupEPNS_4NodeENS_13EChildrenOnlyEPKN3WTF7HashMapIPNS_16AtomicStringImplES7_NS4_7PtrHa
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_S3_ENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTrait
+__ZN7WebCoreL17appendStartMarkupERN3WTF6VectorItLm0EEEPKNS_4NodeEPKNS_5RangeENS_23EAnnotateForInterchangeEbPNS0_7HashMapIPNS_16
+__ZN7WebCoreL20appendEscapedContentERN3WTF6VectorItLm0EEESt4pairIPKtmEb
+__ZN7WebCoreL15appendEndMarkupERN3WTF6VectorItLm0EEEPKNS_4NodeE
+__ZNK7WebCore13JSHTMLElement9classInfoEv
+__ZN7WebCore20jsElementOffsetWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11RenderBlock21adjustPositionedBlockEPNS_9RenderBoxERKNS0_10MarginInfoE
+__ZN7WebCoreL25inlineFlowRequiresLineBoxEPNS_12RenderInlineE
+__ZNK7WebCore9InlineBox4rootEv
+__ZN7WebCore14RenderListItem6layoutEv
+__ZN7WebCore14RenderListItem20updateMarkerLocationEv
+__ZN7WebCore14RenderListItem18positionListMarkerEv
+__ZN7WebCore11RenderBlock19adjustFloatingBlockERKNS0_10MarginInfoE
+__ZN7WebCore14RenderListItem14calcPrefWidthsEv
+__ZN3WTF6VectorIPN7WebCore9RenderBoxELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore9RenderBoxELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore9RenderBoxELm0EE15reserveCapacityEm
+__ZN7WebCoreL8bidiNextEPNS_11RenderBlockEPNS_12RenderObjectEPNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEEbPb
+__ZN7WebCoreL23getParentOfFirstLineBoxEPNS_11RenderBlockEPNS_12RenderObjectE
+__ZN7WebCore11RenderBlock32generatesLineBoxesForInlineChildEPNS_12RenderObjectE
+__ZN7WebCore16RenderListMarker14calcPrefWidthsEv
+__ZNK7WebCore16RenderListMarker7isImageEv
+__ZNK7WebCore14RenderListItem14updateValueNowEv
+__ZN7WebCoreL13enclosingListEPNS_4NodeE
+__ZNK7WebCore4Node20traversePreviousNodeEPKS0_
+__ZN7WebCore14listMarkerTextENS_14EListStyleTypeEi
+__ZN7WebCore16RenderListMarker13updateMarginsEv
+__ZNK7WebCore16RenderListMarker8isInsideEv
+__ZN7WebCore16RenderListMarker6layoutEv
+__ZNK7WebCore16RenderListMarker12isListMarkerEv
+__ZN7WebCoreL36shouldSkipWhitespaceAfterStartObjectEPNS_11RenderBlockEPNS_12RenderObjectE
+__ZN7WebCore16RenderListMarker15createInlineBoxEv
+__ZNK7WebCore9RenderBox13intrinsicSizeEv
+__ZNK7WebCore16RenderListMarker10lineHeightEbb
+__ZNK7WebCore16RenderListMarker16baselinePositionEbb
+__ZN7WebCore9InlineBox14adjustPositionEii
+__ZN7WebCore16RenderPartObject6layoutEv
+__ZN7WebCore9RenderBox30calcAbsoluteHorizontalReplacedEv
+__ZN7WebCore9RenderBox28calcAbsoluteVerticalReplacedEv
+__ZN7WebCore12RenderWidget6layoutEv
+__ZN7WebCore11RenderBlock14fitBelowFloatsEibRi
+__ZNK7WebCore11RenderBlock20nextFloatBottomBelowEi
+__ZN7WebCore12RenderWidget20updateWidgetPositionEv
+__ZN7WebCore10ScrollView12setFrameRectERKNS_7IntRectE
+__ZN7WebCore6Widget12setFrameRectERKNS_7IntRectE
+__ZN7WebCore12RenderWidget5derefEPNS_11RenderArenaE
+__ZNK7WebCore12RenderInline11offsetWidthEv
+__ZN7WebCore9InlineBox6removeEv
+__ZN7WebCore13InlineFlowBox11removeChildEPNS_9InlineBoxE
+__ZN7WebCore13RootInlineBox12childRemovedEPNS_9InlineBoxE
+__ZN7WebCore10RenderText29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore21jsCharacterDataLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13RootInlineBox19lineBreakBidiStatusEv
+__ZN7WebCore13InlineFlowBox11extractLineEv
+__ZN7WebCore13RootInlineBox30extractLineBoxFromRenderObjectEv
+__ZN7WebCore17RenderLineBoxList14extractLineBoxEPNS_13InlineFlowBoxE
+__ZN7WebCore13InlineFlowBox30extractLineBoxFromRenderObjectEv
 __ZN7WebCore9InlineBox11extractLineEv
+__ZN7WebCore13InlineFlowBox29removeLineBoxFromRenderObjectEv
+__ZN7WebCore13InlineFlowBox13lastLeafChildEv
+__ZN7WebCore9InlineBox13lastLeafChildEv
+__ZN7WebCore11RenderBlock14matchedEndLineERKNS_12BidiResolverINS_14InlineIteratorENS_7BidiRunEEERKS2_RKNS_10BidiStatusERPNS_13R
+__ZN7WebCoreeqERKNS_11BidiContextES2_
+__ZN7WebCore13InlineFlowBox10attachLineEv
+__ZN7WebCore13RootInlineBox27attachLineBoxToRenderObjectEv
+__ZN7WebCore17RenderLineBoxList13attachLineBoxEPNS_13InlineFlowBoxE
+__ZN7WebCore13InlineFlowBox27attachLineBoxToRenderObjectEv
 __ZN7WebCore9InlineBox10attachLineEv
-__ZN7WebCore15SQLiteStatement8bindNullEi
-_sqlite3_bind_null
-__ZN7WebCore7JSEvent16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZNK7WebCore9DOMWindow7scrollXEv
-__ZNK7WebCore9DOMWindow7scrollYEv
-__ZN7WebCore26JSHTMLMetaElementPrototypeD0Ev
-__ZN7WebCore27JSHTMLTitleElementPrototypeD0Ev
-__ZNK7WebCore11RenderBlock14firstLineBlockEv
-__ZN7WebCore10RenderFlow24addChildWithContinuationEPNS_12RenderObjectES2_
-__ZN7WebCore10RenderFlow18continuationBeforeEPNS_12RenderObjectE
-__ZNK7WebCore12RenderObject19isBottomMarginQuirkEv
-__ZN7WebCore27compareBorderStylesForQSortEPKvS1_
-__ZN7WebCore10HTMLParser39handleResidualStyleCloseTagAcrossBlocksEPNS_13HTMLStackElemE
-__ZNK7WebCore12RenderObject24getBaselineOfLastLineBoxEv
-__ZN3KJS17staticValueGetterIN7WebCore17JSHTMLMetaElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSHTMLMetaElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore15HTMLMetaElement4nameEv
-__ZNK7WebCore15HTMLMetaElement7contentEv
-__ZN7WebCore17JSHTMLMetaElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore17JSHTMLMetaElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore15HTMLMetaElement7setNameERKNS_6StringE
-__ZN7WebCore15HTMLMetaElement10setContentERKNS_6StringE
+__ZN7WebCore13RootInlineBox14adjustPositionEii
+__ZN7WebCore13InlineFlowBox14adjustPositionEii
+__ZN7WebCore17RenderLineBoxList14dirtyLineBoxesEv
+__ZN7WebCore11RenderBlock24repaintOverhangingFloatsEb
+__ZN7WebCore15JSTextPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24JSCharacterDataPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsCharacterDataPrototypeFunctionDeleteDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13CharacterData10deleteDataEjjRi
+__ZN7WebCore13CharacterData22checkCharDataOperationEjRi
+__ZN7WebCore6String6removeEji
+__ZN7WebCore10RenderText17setTextWithOffsetEN3WTF10PassRefPtrINS_10StringImplEEEjjb
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS_6VectorIPNS1_7ElementELm0EEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSB_IS8_EEE
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS_6VectorIPNS1_7ElementELm0EEEENS_18PairFirstExtractorISA_EENS_7Pt
+__ZN3WTF6VectorIPN7WebCore7ElementELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore7ElementELm0EE15reserveCapacityEm
+__ZN7WebCore26JSHTMLFormElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSHTMLFormElement9classInfoEv
+__ZN7WebCore17JSHTMLFormElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore12RenderWidget5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore14RenderListItem5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore13InlineFlowBox15paintFillLayersERKNS_12RenderObject9PaintInfoERKNS_5ColorEPKNS_9FillLayerEiiiiiiNS_17CompositeOper
+__ZN7WebCore13InlineFlowBox14paintFillLayerERKNS_12RenderObject9PaintInfoERKNS_5ColorEPKNS_9FillLayerEiiiiiiNS_17CompositeOpera
+__ZN7WebCoreL9nullImageEv
+__ZN7WebCore14RenderThemeMac16paintSearchFieldEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZNK7WebCore14RenderThemeMac6searchEv
+__ZN7WebCore14RenderThemeMac18setSearchCellStateEPNS_12RenderObjectERKNS_7IntRectE
+__ZNK7WebCore17RenderTextControl15controlClipRectEii
+__ZN7WebCore14RenderThemeMac33paintSearchFieldResultsDecorationEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZNK7WebCore14RenderThemeMac21convertToPaintingRectEPKNS_12RenderObjectES3_RKNS_9FloatRectERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac26paintSearchFieldDecorationEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore8DOMTimer5firedEv
+__ZN7WebCore15ScheduledAction7executeEPNS_22ScriptExecutionContextE
+__ZN7WebCore15ScheduledAction7executeEPNS_8DocumentE
+__ZN7WebCore15ScheduledAction24executeFunctionInContextEPN3JSC14JSGlobalObjectENS1_7JSValueE
+__ZN7WebCore20jsDocumentReadyStateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Document10readyStateEv
+__ZNK7WebCore11FrameLoader10isCompleteEv
+__ZN7WebCore19jsStringOrUndefinedEPN3JSC9ExecStateERKNS_6StringE
+__ZN7WebCore11FrameLoader13executeScriptERKNS_6StringEb
+__ZThn16_N7WebCore24DocumentThreadableLoader29getShouldUseCredentialStorageEPNS_17SubresourceLoaderERb
+__ZN7WebCore24DocumentThreadableLoader29getShouldUseCredentialStorageEPNS_17SubresourceLoaderERb
+__ZN7WebCore12RenderInline12imageChangedEPvPKNS_7IntRectE
+__ZThn16_N7WebCore24DocumentThreadableLoader18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
+__ZN7WebCore24DocumentThreadableLoader18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
+__ZThn16_N7WebCore14XMLHttpRequest18didReceiveResponseERKNS_16ResourceResponseE
+__ZN7WebCore14XMLHttpRequest18didReceiveResponseERKNS_16ResourceResponseE
+__ZN7WebCore27extractCharsetFromMediaTypeERKNS_6StringE
+__ZThn16_N7WebCore24DocumentThreadableLoader14didReceiveDataEPNS_17SubresourceLoaderEPKci
+__ZN7WebCore24DocumentThreadableLoader14didReceiveDataEPNS_17SubresourceLoaderEPKci
+__ZThn16_N7WebCore14XMLHttpRequest14didReceiveDataEPKci
+__ZN7WebCore14XMLHttpRequest14didReceiveDataEPKci
+__ZN7WebCore14XMLHttpRequest14refEventTargetEv
+__ZN7WebCore11EventTarget6toNodeEv
+__ZN7WebCore11EventTarget11toDOMWindowEv
+__ZN7WebCore14XMLHttpRequest16toXMLHttpRequestEv
+__ZN7WebCore14XMLHttpRequest27updateAndDispatchOnProgressEj
+__ZN7WebCore14XMLHttpRequest21dispatchProgressEventEx
+__ZN7WebCore22jsXMLHttpRequestStatusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14XMLHttpRequest6statusERi
+__ZN7WebCore26jsXMLHttpRequestStatusTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14XMLHttpRequest10statusTextERi
+__ZNK7WebCore20ResourceResponseBase14httpStatusTextEv
+__ZN7WebCore28jsXMLHttpRequestResponseTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16JSXMLHttpRequest12responseTextEPN3JSC9ExecStateE
+__ZNK7WebCore14XMLHttpRequest12responseTextEv
+__ZN7WebCore19jsOwnedStringOrNullEPN3JSC9ExecStateERKNS0_7UStringE
+__ZN7WebCore50jsXMLHttpRequestPrototypeFunctionGetResponseHeaderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSXMLHttpRequest17getResponseHeaderEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore14XMLHttpRequest17getResponseHeaderERKNS_12AtomicStringERi
+__ZN7WebCoreL17isSetCookieHeaderERKNS_12AtomicStringE
+__ZThn16_N7WebCore24DocumentThreadableLoader16didFinishLoadingEPNS_17SubresourceLoaderE
+__ZN7WebCore24DocumentThreadableLoader16didFinishLoadingEPNS_17SubresourceLoaderE
+__ZThn16_N7WebCore14XMLHttpRequest16didFinishLoadingEm
+__ZN7WebCore14XMLHttpRequest16didFinishLoadingEm
+__ZThn88_N7WebCore8Document33resourceRetrievedByXMLHttpRequestEmRKNS_12ScriptStringE
+__ZN7WebCore8Document33resourceRetrievedByXMLHttpRequestEmRKNS_12ScriptStringE
+__ZN7WebCore19InspectorController33resourceRetrievedByXMLHttpRequestEmRKNS_12ScriptStringE
+__ZN7WebCore11FrameLoader31didLoadResourceByXMLHttpRequestEmRKNS_12ScriptStringE
+__ZThn88_N7WebCore8Document10addMessageENS_18MessageDestinationENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS6_
+__ZN7WebCore8Document10addMessageENS_18MessageDestinationENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS6_
+__ZN7WebCore19InspectorController19addMessageToConsoleENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS5_
+__ZN7WebCore24DocumentThreadableLoader21derefThreadableLoaderEv
+__ZN7WebCore24DocumentThreadableLoaderD0Ev
+__ZN7WebCore27jsXMLHttpRequestResponseXMLEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14XMLHttpRequest11responseXMLEv
+__ZNK7WebCore14XMLHttpRequest13responseIsXMLEv
+__ZNK7WebCore14XMLHttpRequest16responseMIMETypeEv
+__ZN7WebCore16jsDocumentDomainEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Document6domainEv
+__ZN7WebCore14jsLocationPortEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Location4portEv
+__ZN7WebCore14XMLHttpRequest17dispatchLoadEventEv
+__ZN7WebCore14XMLHttpRequest14dropProtectionEv
+__ZNK7WebCore14XMLHttpRequest8documentEv
+__ZNK7WebCore8Document14implementationEv
+__ZN7WebCore17DOMImplementation14createDocumentEPNS_5FrameE
+__ZN7WebCore8DocumentC1EPNS_5FrameEb
+__ZN7WebCore14SecurityOrigin11createEmptyEv
+__ZN7WebCore8Document4openEPS0_
+__ZN7WebCore8Document15createTokenizerEv
+__ZN7WebCore12XMLTokenizerC1EPNS_8DocumentEPNS_9FrameViewE
+__ZN7WebCore12XMLTokenizerC2EPNS_8DocumentEPNS_9FrameViewE
+__ZN7WebCore8Document5writeERKNS_6StringEPS0_
+__ZN7WebCore8Document5writeERKNS_15SegmentedStringEPS0_
+__ZN7WebCore12XMLTokenizer5writeERKNS_15SegmentedStringEb
+__ZNK7WebCore15SegmentedString8toStringEv
+__ZN7WebCore12XMLTokenizer7doWriteERKNS_6StringE
+__ZN7WebCore12XMLTokenizer23initializeParserContextEPKc
+__ZN7WebCore17XMLTokenizerScopeC1EPNS_9DocLoaderE
+__ZN7WebCore17XMLTokenizerScopeC2EPNS_9DocLoaderE
+__ZN7WebCoreL18createStringParserEP14_xmlSAXHandlerPv
+__ZN7WebCore17XMLTokenizerScopeD1Ev
+__ZN7WebCore17XMLTokenizerScopeD2Ev
+__ZN7WebCoreL20startDocumentHandlerEPv
+__ZN7WebCore12XMLTokenizer13startDocumentEPKhS2_i
+__ZNK7WebCore12TextEncoding6decodeEPKcmbRb
+__ZN7WebCore8Document13setXMLVersionERKNS_6StringERi
+__ZN7WebCore17DOMImplementation10hasFeatureERKNS_6StringES3_
+__ZN7WebCore8Document16setXMLStandaloneEbRi
+__ZN7WebCoreL18normalErrorHandlerEPvPKcz
+__ZN7WebCore12XMLTokenizer5errorENS0_9ErrorTypeEPKcP13__va_list_tag
+__ZNK7WebCore12XMLTokenizer12columnNumberEv
+__ZNK7WebCore12XMLTokenizer10lineNumberEv
+__ZN7WebCore12XMLTokenizer11handleErrorENS0_9ErrorTypeEPKcii
+__ZN7WebCoreL18endDocumentHandlerEPv
+__ZN7WebCore12XMLTokenizer11endDocumentEv
+__ZN7WebCore12XMLTokenizer8exitTextEv
+__ZN7WebCore12XMLTokenizer6finishEv
+__ZN7WebCore12XMLTokenizer3endEv
+__ZN7WebCore12XMLTokenizer5doEndEv
+__ZN7WebCore12XMLTokenizer23insertErrorMessageBlockEv
+__ZN7WebCore8Document16childTypeAllowedENS_4Node8NodeTypeE
+__ZN7WebCore13ContainerNode12insertBeforeEN3WTF10PassRefPtrINS_4NodeEEEPS3_Rib
+__ZN7WebCore12XMLTokenizer14setCurrentNodeEPNS_4NodeE
+__ZNK7WebCore12XMLTokenizer10wellFormedEv
+__ZN7WebCore12XMLTokenizerD0Ev
+__ZN3WTF15deleteAllValuesIPN7WebCore16PendingCallbacks15PendingCallbackEEEvRKNS_5DequeIT_EE
+__ZN7WebCore16jsDOMWindowEventEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow5eventEPN3JSC9ExecStateE
+__ZN7WebCore20jsEventCurrentTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8DocumentD0Ev
+__ZN7WebCore20JSHTMLHeadingElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSHTMLHeadingElement9classInfoEv
+__ZN7WebCoreL33createHTMLParagraphElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore22JSHTMLParagraphElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSHTMLParagraphElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20HTMLParagraphElementEEE
+__ZN7WebCore22JSHTMLParagraphElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20HTMLParagraphElementEEE
+__ZN7WebCore22JSHTMLParagraphElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore22JSHTMLParagraphElement9classInfoEv
+__ZN7WebCore22JSHTMLParagraphElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore10JSNodeList11getCallDataERN3JSC8CallDataE
+__ZNK3JSC8JSObject11toPrimitiveEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZNK7WebCore10JSNodeList9classInfoEv
+__ZN7WebCore20JSHTMLHeadingElementD1Ev
+__ZN7WebCore13JSHTMLElementD1Ev
+__ZThn8_N7WebCore11HTMLElementD0Ev
+__ZN7WebCore16JSXMLHttpRequestD1Ev
+__ZN7WebCore16JSXMLHttpRequestD2Ev
+__ZN7WebCore18JSHTMLOListElementD1Ev
+__ZN7WebCore14XMLHttpRequest16derefEventTargetEv
+__ZN7WebCore14XMLHttpRequestD0Ev
+__ZN7WebCore41jsElementPrototypeFunctionRemoveAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element15removeAttributeERKNS_6StringERi
+__ZN7WebCore12NamedNodeMap15removeNamedItemERKNS_6StringERi
+__ZNK7WebCore4Node15isStyledElementEv
+__ZN7WebCoreL28createHTMLMetaElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLMetaElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLMetaElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLMetaElementEEE
+__ZN7WebCore17JSHTMLMetaElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLMetaElementEEE
+__ZN7WebCore17JSHTMLMetaElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore17JSHTMLMetaElement9classInfoEv
-__ZN7WebCore10JSNodeList16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZNK7WebCore19JSNodeListPrototype9classInfoEv
-__ZNK7WebCore15HTMLMetaElement9httpEquivEv
-__ZN7WebCore17HTMLScriptElement7setTypeERKNS_6StringE
-__ZNK7WebCore10MouseEvent5whichEv
-__ZNK7WebCore17HTMLAnchorElement8hostnameEv
-__ZNK7WebCore17HTMLAnchorElement6searchEv
-__ZNK7WebCore17HTMLAnchorElement8pathnameEv
-__ZNK7WebCore17HTMLAnchorElement4textEv
-__ZNK7WebCore7Element9innerTextEv
-__ZN7WebCore15rangeOfContentsEPNS_4NodeE
-__ZN7WebCore12EventHandler32handleMousePressEventDoubleClickERKNS_28MouseEventWithHitTestResultsE
-__ZN7WebCore12EventHandler31selectClosestWordFromMouseEventERKNS_28MouseEventWithHitTestResultsE
-__ZNK7WebCore19JSHTMLAllCollection21masqueradeAsUndefinedEv
-__ZNK7WebCore4Text8nodeNameEv
-__ZN7WebCore38jsHTMLDocumentPrototypeFunctionWritelnEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore14JSHTMLDocument7writelnEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore15HTMLFormElement12setMalformedEb
-__ZN7WebCore21DeprecatedPtrListImpl4prevEv
-__ZNK7WebCore15RenderTableCell16baselinePositionEbb
-__ZN7WebCore12RenderInline22positionForCoordinatesEii
-__ZN7WebCore15RenderContainer22positionForCoordinatesEii
-__ZNK7WebCore10RenderText4xPosEv
-__ZN7WebCore11JSDOMWindow16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore11JSDOMWindow22customGetPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore17JSHTMLBaseElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore26JSHTMLBaseElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore21JSHTMLBaseFontElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore30JSHTMLBaseFontElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSHTMLIFrameElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore23JSHTMLBlockquoteElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore32JSHTMLBlockquoteElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLAudioElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore27JSHTMLAudioElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore27JSHTMLMediaElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore24JSSVGPreserveAspectRatio14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore33JSSVGPreserveAspectRatioPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow7menubarEv
-__ZN7WebCore7BarInfoC2EPNS_5FrameENS0_4TypeE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_7BarInfoE
-__ZN7WebCore18JSBarInfoPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore9JSBarInfoC1EPN3KJS8JSObjectEPNS_7BarInfoE
-__ZN7WebCore10JSSVGAngle14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore19JSSVGAnglePrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow10scrollbarsEv
-__ZN7WebCore19JSCSSPrimitiveValue14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore28JSCSSPrimitiveValuePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSCSSValuePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore10JSSVGPaint14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore19JSSVGPaintPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSSVGColorPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow12frameElementEv
-__ZN7WebCore17checkNodeSecurityEPN3KJS9ExecStateEPNS_4NodeE
-__ZN7WebCore8JSEntity14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore17JSEntityPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLMenuElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore26JSHTMLMenuElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSHTMLModElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore25JSHTMLModElementPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow6openerEv
-__ZN7WebCore12JSMouseEvent14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore11JSTextEvent14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore20JSTextEventPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow10outerWidthEv
-__ZNK7WebCore6Chrome10windowRectEv
-__ZN7WebCore18JSHTMLQuoteElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore27JSHTMLQuoteElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLHeadElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore20JSHTMLIsIndexElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore29JSHTMLIsIndexElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLImageElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore14JSCDATASection14getConstructorEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow6closedEv
-__ZN7WebCore16JSCSSCharsetRule14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore25JSCSSCharsetRulePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSCSSRulePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSHTMLAppletElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore28JSHTMLAppletElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore10JSCSSValue14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore14JSCSSValueList14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore23JSCSSValueListPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow9statusbarEv
-__ZN7WebCore25JSXMLHttpRequestException14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore34JSXMLHttpRequestExceptionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLStyleElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore23JSProcessingInstruction14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore32JSProcessingInstructionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSDOMCoreException14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore21JSHTMLFrameSetElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore30JSHTMLFrameSetElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSRangeException14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore25JSRangeExceptionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSDOMImplementation14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore28JSDOMImplementationPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore12JSWheelEvent14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLUListElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore15JSCharacterData14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore19JSHTMLLegendElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore28JSHTMLLegendElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore6JSRect14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore15JSRectPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSHTMLPreElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore25JSHTMLPreElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore14JSMessageEvent14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore23JSMessageEventPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore9JSCounter14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore18JSCounterPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore14JSNamedNodeMap14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore23JSNamedNodeMapPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore22JSHTMLTableCellElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore21JSHTMLOptGroupElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore30JSHTMLOptGroupElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore20JSHTMLHeadingElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore13JSCSSRuleList14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore22JSCSSRuleListPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow11outerHeightEv
-__ZN7WebCore22JSHTMLParagraphElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore21JSHTMLFieldSetElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore12JSStyleSheet14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore21JSStyleSheetPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow11personalbarEv
-__ZN7WebCore19JSHTMLButtonElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore28JSHTMLButtonElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSHTMLMapElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore15JSOverflowEvent14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore24JSOverflowEventPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSXPathException14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore25JSXPathExceptionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore20JSSVGGradientElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore29JSSVGGradientElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore21JSSVGElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSProgressEvent14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore24JSProgressEventPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow6statusEv
-__ZNK7WebCore5Frame15jsStatusBarTextEv
-__ZN7WebCore12JSMediaError14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore21JSMediaErrorPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore6JSAttr14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore15JSAttrPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSEntityReference14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore26JSEntityReferencePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore25JSHTMLTableCaptionElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore34JSHTMLTableCaptionElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSHTMLObjectElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore28JSHTMLObjectElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLFrameElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore27JSHTMLFrameElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore9JSCSSRule14getConstructorEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow16devicePixelRatioEv
-__ZN7WebCore6Chrome11scaleFactorEv
-__ZN7WebCore21JSCSSStyleDeclaration14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore15JSMutationEvent14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore24JSMutationEventPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow7screenXEv
-__ZN7WebCore21JSHTMLTableRowElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore22JSHTMLDirectoryElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore31JSHTMLDirectoryElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSHTMLScriptElement14getConstructorEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow7screenYEv
-__ZNK7WebCore9DOMWindow7toolbarEv
-__ZN7WebCore23JSSVGTextContentElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore32JSSVGTextContentElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLAreaElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLOListElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore19JSHTMLCanvasElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore28JSHTMLCanvasElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSCSSFontFaceRule14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore26JSCSSFontFaceRulePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore10JSDocument14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore15JSHTMLBRElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore14JSCSSStyleRule14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore23JSCSSStyleRulePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLFontElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore26JSHTMLFontElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLTitleElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore25JSHTMLTableSectionElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore6JSText14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore14JSDocumentType14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore23JSDocumentTypePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore9JSUIEvent14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore16JSEventException14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore25JSEventExceptionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSStyleSheetList14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore25JSStyleSheetListPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow13defaultStatusEv
-__ZNK7WebCore5Frame22jsDefaultStatusBarTextEv
-__ZN7WebCore7JSRange14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore14JSCSSMediaRule14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore23JSCSSMediaRulePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLEmbedElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore10JSNodeList14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore18JSSVGMarkerElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore27JSSVGMarkerElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSHTMLHRElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore24JSHTMLHRElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSCSSImportRule14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore24JSCSSImportRulePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore10JSSVGColor14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLParamElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore27JSHTMLParamElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSDocumentFragment14getConstructorEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow18offscreenBufferingEv
-__ZN7WebCore13JSCSSPageRule14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore22JSCSSPageRulePrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow11locationbarEv
-__ZN7WebCore11JSSVGLength14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore20JSSVGLengthPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSXPathEvaluator14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore25JSXPathEvaluatorPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSKeyboardEvent14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore11JSMediaList14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore20JSMediaListPrototype4selfEPN3KJS9ExecStateE
-__ZNK7WebCore9DOMWindow7consoleEv
-__ZN7WebCore7ConsoleC1EPNS_5FrameE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_7ConsoleE
-__ZN7WebCore18JSConsolePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore9JSConsoleC1EPN3KJS8JSObjectEPNS_7ConsoleE
-__ZN7WebCore9JSComment14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore10JSNotation14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore19JSNotationPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLBodyElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLDListElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLHtmlElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLLabelElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLLinkElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore20JSHTMLMarqueeElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore29JSHTMLMarqueeElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLMetaElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore21JSHTMLTableColElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore30JSHTMLTableColElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLTableElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore12JSNodeFilter14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore21JSNodeFilterPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSXMLSerializer14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore24JSXMLSerializerPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLMediaElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLVideoElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore27JSHTMLVideoElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore14JSSVGException14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore23JSSVGExceptionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore12JSSVGPathSeg14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore21JSSVGPathSegPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore20JSSVGRenderingIntent14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore29JSSVGRenderingIntentPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore20JSSVGTextPathElement14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore29JSSVGTextPathElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore14JSSVGTransform14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore23JSSVGTransformPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore14JSSVGUnitTypes14getConstructorEPN3KJS9ExecStateE
-__ZN7WebCore23JSSVGUnitTypesPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore11MediaPlayer11isAvailableEv
-__ZN7WebCore18MediaPlayerPrivate11isAvailableEv
-__ZN7WebCore18JSAudioConstructorC1EPN3KJS9ExecStateEPNS_8DocumentE
-__ZNK7WebCore6Chrome11canRunModalEv
-__ZN3KJS27XSLTProcessorConstructorImpC2EPNS_9ExecStateE
-__ZN3KJS22XSLTProcessorPrototype4selfEPNS_9ExecStateE
-__ZN7WebCore7BarInfo15disconnectFrameEv
-__ZN7WebCore7Console15disconnectFrameEv
-__ZN7WebCore25JSSVGUnitTypesConstructorD0Ev
-__ZN7WebCore25JSSVGTransformConstructorD0Ev
-__ZN7WebCore31JSSVGTextPathElementConstructorD0Ev
-__ZN7WebCore31JSSVGRenderingIntentConstructorD0Ev
-__ZN7WebCore23JSSVGPathSegConstructorD0Ev
-__ZN7WebCore25JSSVGExceptionConstructorD0Ev
-__ZN7WebCore27JSHTMLVideoElementPrototypeD0Ev
-__ZN7WebCore29JSHTMLMediaElementConstructorD0Ev
-__ZN7WebCore30JSHTMLTableColElementPrototypeD0Ev
-__ZN7WebCore19JSNotationPrototypeD0Ev
-__ZN7WebCore9JSConsoleD0Ev
-__ZN7WebCore26JSKeyboardEventConstructorD0Ev
-__ZN7WebCore22JSSVGLengthConstructorD0Ev
-__ZN7WebCore22JSCSSPageRulePrototypeD0Ev
-__ZN7WebCore27JSHTMLParamElementPrototypeD0Ev
-__ZN7WebCore21JSSVGColorConstructorD0Ev
-__ZN7WebCore24JSCSSImportRulePrototypeD0Ev
-__ZN7WebCore24JSHTMLHRElementPrototypeD0Ev
-__ZN7WebCore29JSSVGMarkerElementConstructorD0Ev
-__ZN7WebCore27JSStyleSheetListConstructorD0Ev
-__ZN7WebCore27JSEventExceptionConstructorD0Ev
-__ZN7WebCore20JSUIEventConstructorD0Ev
-__ZN7WebCore23JSDocumentTypePrototypeD0Ev
-__ZN7WebCore26JSHTMLFontElementPrototypeD0Ev
-__ZN7WebCore23JSCSSStyleRulePrototypeD0Ev
-__ZN7WebCore26JSCSSFontFaceRulePrototypeD0Ev
-__ZN7WebCore34JSSVGTextContentElementConstructorD0Ev
-__ZN7WebCore31JSHTMLDirectoryElementPrototypeD0Ev
-__ZN7WebCore34JSHTMLTableCaptionElementPrototypeD0Ev
-__ZN7WebCore26JSEntityReferencePrototypeD0Ev
-__ZN7WebCore15JSAttrPrototypeD0Ev
-__ZN7WebCore23JSMediaErrorConstructorD0Ev
-__ZN7WebCore26JSProgressEventConstructorD0Ev
-__ZN7WebCore21JSSVGElementPrototypeD0Ev
-__ZN7WebCore31JSSVGGradientElementConstructorD0Ev
-__ZN7WebCore27JSXPathExceptionConstructorD0Ev
-__ZN7WebCore26JSOverflowEventConstructorD0Ev
-__ZN7WebCore21JSStyleSheetPrototypeD0Ev
-__ZN7WebCore30JSHTMLOptGroupElementPrototypeD0Ev
-__ZN7WebCore18JSCounterPrototypeD0Ev
-__ZN7WebCore25JSMessageEventConstructorD0Ev
-__ZN7WebCore25JSHTMLPreElementPrototypeD0Ev
-__ZN7WebCore15JSRectPrototypeD0Ev
-__ZN7WebCore30JSHTMLFrameSetElementPrototypeD0Ev
-__ZN7WebCore29JSDOMCoreExceptionConstructorD0Ev
-__ZN7WebCore32JSProcessingInstructionPrototypeD0Ev
-__ZN7WebCore36JSXMLHttpRequestExceptionConstructorD0Ev
-__ZN7WebCore28JSHTMLAppletElementPrototypeD0Ev
-__ZN7WebCore25JSCSSCharsetRulePrototypeD0Ev
-__ZN7WebCore29JSHTMLIsIndexElementPrototypeD0Ev
-__ZN7WebCore27JSHTMLQuoteElementPrototypeD0Ev
-__ZN7WebCore22JSTextEventConstructorD0Ev
-__ZN7WebCore23JSMouseEventConstructorD0Ev
-__ZN7WebCore25JSHTMLModElementPrototypeD0Ev
-__ZN7WebCore26JSHTMLMenuElementPrototypeD0Ev
-__ZN7WebCore17JSEntityPrototypeD0Ev
-__ZN7WebCore21JSSVGPaintConstructorD0Ev
-__ZN7WebCore21JSSVGAngleConstructorD0Ev
-__ZN7WebCore18JSBarInfoPrototypeD0Ev
-__ZN7WebCore35JSSVGPreserveAspectRatioConstructorD0Ev
-__ZN7WebCore27JSHTMLAudioElementPrototypeD0Ev
-__ZN7WebCore32JSHTMLBlockquoteElementPrototypeD0Ev
-__ZN7WebCore30JSHTMLBaseFontElementPrototypeD0Ev
-__ZN7WebCore26JSHTMLBaseElementPrototypeD0Ev
-__ZN3KJS22XSLTProcessorPrototypeD0Ev
-__ZN7WebCore28JSHTMLSelectElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17HTMLSelectElement5valueEv
-__ZN3WTF7HashSetIPN7WebCore10StringImplENS1_15CaseFoldingHashENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore16MIMETypeRegistry20isJavaAppletMIMETypeERKNS_6StringE
-__ZN7WebCore11RenderLayer23beginTransparencyLayersEPNS_15GraphicsContextEPKS0_
-__ZN7WebCore19transparencyClipBoxERKNS_15AffineTransformEPKNS_11RenderLayerES5_
-__ZN7WebCore15GraphicsContext22beginTransparencyLayerEf
-__ZN7WebCore15GraphicsContext20endTransparencyLayerEv
-__ZNK7WebCore14RenderThemeMac25adjustMenuListButtonStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore6Loader4Host14cancelRequestsEPNS_9DocLoaderE
+__ZN7WebCore6Loader4Host21cancelPendingRequestsERN3WTF5DequeIPNS_7RequestEEEPNS_9DocLoaderE
+__ZN7WebCore11FrameLoader49updateHistoryForRedirectWithLockedBackForwardListEv
+__ZN7WebCore11HistoryItem12setChildItemEN3WTF10PassRefPtrIS0_EE
+__ZNK7WebCore10RenderView8viewRectEv
+__ZNK7WebCore9RenderBox12maxTopMarginEb
+__ZNK7WebCore9RenderBox21isSelfCollapsingBlockEv
+__ZNK7WebCore9RenderBox15maxBottomMarginEb
+__ZN7WebCore5TimerINS_12GCControllerEE5firedEv
+__ZN7WebCore12GCController12gcTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore22JSHTMLParagraphElementD1Ev
+__ZN7WebCore17JSHTMLMetaElementD1Ev
+__ZN7WebCore16HTMLLabelElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore27TextControlInnerTextElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore18JSHTMLInputElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore15setJSNodeOnblurEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node9setOnblurEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN3WTF6VectorIPN7WebCore7ElementELm0EE6shrinkEm
+__ZN7WebCore22HTMLFormControlElement15removedFromTreeEb
+__ZN7WebCore15HTMLFormElement17removeFormElementEPNS_22HTMLFormControlElementE
+__ZN7WebCore26setJSHTMLImageElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement8setWidthEi
+__ZN7WebCore27setJSHTMLImageElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement9setHeightEi
+__ZN7WebCore27setJSHTMLImageElementBorderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement9setBorderERKNS_6StringE
+__ZN7WebCore24setJSHTMLImageElementAltEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement6setAltERKNS_6StringE
+__ZN7WebCore17setJSNodeOnsubmitEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node11setOnsubmitEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore18setJSNodeOnkeydownEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node12setOnkeydownEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore16setJSNodeOnkeyupEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node10setOnkeyupEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore17jsDOMWindowParentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6parentEv
+__ZNK7WebCore5Frame14isDisconnectedEv
+__ZN7WebCore17jsDOMWindowScreenEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6screenEv
+__ZN7WebCore6ScreenC1EPNS_5FrameE
+__ZN7WebCore6ScreenC2EPNS_5FrameE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_6ScreenE
+__ZN7WebCore8JSScreen15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore8JSScreenC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_6ScreenEEE
+__ZN7WebCore8JSScreenC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_6ScreenEEE
+__ZN7WebCore8JSScreen18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore13jsScreenWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen5widthEv
+__ZN7WebCore14jsScreenHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen6heightEv
+__ZN7WebCore39jsNavigatorPrototypeFunctionJavaEnabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore11JSNavigator9classInfoEv
+__ZNK7WebCore9Navigator11javaEnabledEv
+__ZN7WebCore18jsScreenPixelDepthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen10pixelDepthEv
+__ZN7WebCore11screenDepthEPNS_6WidgetE
+__ZN7WebCore21jsDOMWindowInnerWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow10innerWidthEv
+__ZN7WebCore22jsDOMWindowInnerHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow11innerHeightEv
+__ZN7WebCore18jsNavigatorPluginsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9Navigator7pluginsEv
+__ZN7WebCore11PluginArrayC1EPNS_5FrameE
+__ZN7WebCore11PluginArrayC2EPNS_5FrameE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_11PluginArrayE
+__ZN7WebCore13JSPluginArray15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSPluginArrayC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11PluginArrayEEE
+__ZN7WebCore13JSPluginArrayC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11PluginArrayEEE
+__ZN7WebCore13JSPluginArray18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19jsPluginArrayLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11PluginArray6lengthEv
+__ZNK7WebCore11PluginArray13getPluginDataEv
+__ZNK7WebCore4Page10pluginDataEv
+__ZN7WebCore10PluginDataC1EPKNS_4PageE
+__ZN7WebCore10PluginDataC2EPKNS_4PageE
+__ZN7WebCore10PluginData11initPluginsEv
+_stringEncodingForResource
+__ZN7WebCore16MIMETypeRegistry26getSupportedImageMIMETypesEv
+__ZN3WTF6VectorIPN7WebCore13MimeClassInfoELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore13MimeClassInfoELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore13MimeClassInfoELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIPN7WebCore10PluginInfoELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore10PluginInfoELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore10PluginInfoELm0EE15reserveCapacityEm
+__ZN7WebCore13JSPluginArray18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore13JSPluginArray11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore11PluginArray4itemEj
+__ZN7WebCore6PluginC1EPNS_10PluginDataEj
+__ZN7WebCore6PluginC2EPNS_10PluginDataEj
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_6PluginE
+__ZN7WebCore8JSPlugin15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore8JSPluginC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_6PluginEEE
+__ZN7WebCore8JSPluginC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_6PluginEEE
+__ZN7WebCore8JSPlugin18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore12jsPluginNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Plugin4nameEv
+__ZN7WebCore19jsNavigatorPlatformEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase8platformEv
+__ZN7WebCore19JSLocationPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore35jsLocationPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore10JSLocation9classInfoEv
+__ZN7WebCore10JSLocation8toStringEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore21allowsAccessFromFrameEPN3JSC9ExecStateEPNS_5FrameE
+__ZNK7WebCore8Location8toStringEv
+__ZN7WebCore18jsDocumentReferrerEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Document8referrerEv
+__ZNK7WebCore11FrameLoader8referrerEv
+__ZN7WebCore20jsNavigatorMimeTypesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9Navigator9mimeTypesEv
+__ZN7WebCore13MimeTypeArrayC1EPNS_5FrameE
+__ZN7WebCore13MimeTypeArrayC2EPNS_5FrameE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_13MimeTypeArrayE
+__ZN7WebCore15JSMimeTypeArray15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSMimeTypeArrayC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13MimeTypeArrayEEE
+__ZN7WebCore15JSMimeTypeArrayC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13MimeTypeArrayEEE
+__ZN7WebCore13JSPluginArray18canGetItemsForNameEPN3JSC9ExecStateEPNS_11PluginArrayERKNS1_10IdentifierE
+__ZN7WebCore11PluginArray18canGetItemsForNameERKNS_12AtomicStringE
+__ZN7WebCore22JSPluginArrayPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore13JSPluginArray10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore11PluginArray9namedItemERKNS_12AtomicStringE
+__ZN7WebCore19jsPluginDescriptionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Plugin11descriptionEv
+__ZN3WTF6VectorIcLm512EE14expandCapacityEm
+__ZN3WTF6VectorIcLm512EE15reserveCapacityEm
+__ZN7WebCore11FrameLoader15parentCompletedEv
+__ZN7WebCore14ResourceLoader48scheduleLoadFallbackResourceFromApplicationCacheEPNS_16ApplicationCacheE
+__ZN7WebCore14DocumentLoader48scheduleLoadFallbackResourceFromApplicationCacheEPNS_14ResourceLoaderERKNS_15ResourceRequestEPNS_
+__ZN7WebCore14DocumentLoader35getApplicationCacheFallbackResourceERKNS_15ResourceRequestERPNS_24ApplicationCacheResourceEPNS_16
+__ZN7WebCore15defaultMIMETypeEv
+__ZN7WebCore15GraphicsContext9setShadowERKNS_7IntSizeEiRKNS_5ColorE
+__ZN7WebCore15GraphicsContext17setPlatformShadowERKNS_7IntSizeEiRKNS_5ColorE
+__ZNK7WebCore7IntSizecv6CGSizeEv
+__ZN7WebCore15GraphicsContext11clearShadowEv
+__ZN7WebCore15GraphicsContext19clearPlatformShadowEv
 __ZN7WebCore15GraphicsContext18addRoundedRectClipERKNS_7IntRectERKNS_7IntSizeES6_S6_S6_
 __ZN7WebCore4Path22createRoundedRectangleERKNS_9FloatRectERKNS_9FloatSizeES6_S6_S6_
+__ZN7WebCore4PathC1Ev
+__ZN7WebCore4PathC2Ev
+__ZN7WebCore4Path6moveToERKNS_10FloatPointE
+__ZN7WebCore4Path9addLineToERKNS_10FloatPointE
 __ZN7WebCore4Path16addBezierCurveToERKNS_10FloatPointES3_S3_
+__ZN7WebCore4Path12closeSubpathEv
+__ZN7WebCore4PathC1ERKS0_
+__ZN7WebCore4PathC2ERKS0_
+__ZN7WebCore4PathD1Ev
+__ZN7WebCore4PathD2Ev
 __ZN7WebCore15GraphicsContext4clipERKNS_4PathE
-__ZN7WebCore14RenderThemeMac19paintMenuListButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14RenderThemeMac28paintMenuListButtonGradientsEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore23MainGradientInterpolateEPvPKfPf
-__ZN7WebCore22TopGradientInterpolateEPvPKfPf
-__ZN7WebCore25BottomGradientInterpolateEPvPKfPf
-__ZN7WebCore15GraphicsContext23addInnerRoundedRectClipERKNS_7IntRectEi
-__ZN7WebCore12RenderObject13drawBorderArcEPNS_15GraphicsContextEiifNS_7IntSizeEiiNS0_10BorderSideENS_5ColorERKS5_NS_12EBorderStyleEb
-__ZN7WebCore15GraphicsContext9strokeArcERKNS_7IntRectEii
-__ZNK7WebCore15HTMLLinkElement3relEv
-__ZNK7WebCore15HTMLLinkElement4hrefEv
-__ZNK7WebCore15HTMLLinkElement4typeEv
-__ZN3KJS19windowProtoFuncOpenEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS37valueToStringWithUndefinedOrNullCheckEPNS_9ExecStateEPNS_7JSValueE
-__ZN3KJS10allowPopUpEPNS_9ExecStateE
-__ZN7WebCore14WindowFeaturesC1ERKNS_6StringE
-__ZN7WebCore11isSeparatorEt
-__ZN7WebCore14WindowFeatures16setWindowFeatureERKNS_6StringES3_
-__ZN7WebCore9DOMWindow16adjustWindowRectERKNS_9FloatRectERS1_S3_
-__ZN3KJS12createWindowEPNS_9ExecStateEPN7WebCore5FrameERKNS2_6StringES7_RKNS2_14WindowFeaturesEPNS_7JSValueE
-__ZN7WebCore11FrameLoader12createWindowERKNS_16FrameLoadRequestERKNS_14WindowFeaturesERb
-__ZNK7WebCore6Chrome12createWindowEPNS_5FrameERKNS_16FrameLoadRequestERKNS_14WindowFeaturesE
-__ZNK7WebCore19ResourceRequestBase7isEmptyEv
-__ZNK7WebCore6Chrome18setToolbarsVisibleEb
-__ZNK7WebCore6Chrome19setStatusbarVisibleEb
-__ZNK7WebCore6Chrome20setScrollbarsVisibleEb
-__ZN7WebCore9FrameView17setHScrollbarModeENS_13ScrollbarModeE
-__ZN7WebCore9FrameView17setVScrollbarModeENS_13ScrollbarModeE
-__ZNK7WebCore6Chrome17setMenubarVisibleEb
-__ZNK7WebCore6Chrome12setResizableEb
-__ZNK7WebCore6Chrome8pageRectEv
-__ZNK7WebCore6Chrome13setWindowRectERKNS_9FloatRectE
-__ZN7WebCore13toDeviceSpaceERKNS_9FloatRectEP8NSWindow
-__ZNK7WebCore6Chrome4showEv
-__ZN3WTF7HashSetIPN7WebCore5FrameENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore11FrameLoader14setOpenedByDOMEv
-__ZN7WebCore33jsDOMWindowPrototypeFunctionFocusEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9DOMWindow5focusEv
-__ZN7WebCore5Frame11focusWindowEv
-__ZN7WebCore20encodeRelativeStringERKNS_4KURLERKNS_16DeprecatedStringERKNS_12TextEncodingE
-__ZNK7WebCore16DeprecatedString4findEPKcib
-__ZN7WebCore5equalEPKNS_14DeprecatedCharEPKci
-__ZN7WebCore14encodeHostnameERKNS_16DeprecatedStringE
-__ZNK7WebCore16DeprecatedString4findERKNS_17RegularExpressionEi
-__ZNK7WebCore20JSHTMLHeadingElement9classInfoEv
-__ZNK7WebCore17HTMLAnchorElement4hostEv
-__ZN7WebCore11RenderBlock23deleteEllipsisLineBoxesEv
-__ZN7WebCore11RenderBlock25checkLinesForTextOverflowEv
-__ZNK7WebCore14SimpleFontData18containsCharactersEPKti
-__ZN7WebCore18MainResourceLoader26stopLoadingForPolicyChangeEv
-__ZNK7WebCore18MainResourceLoader32interruptionForPolicyChangeErrorEv
-__ZN7WebCore11FrameLoader32interruptionForPolicyChangeErrorERKNS_15ResourceRequestE
-__ZN7WebCore10IconLoader11stopLoadingEv
-__ZN7WebCore11FrameLoader21handleFallbackContentEv
--[WebScriptObject setValue:forKey:]
--[WebScriptObject _isSafeScript]
--[WebScriptObject _rootObject]
-__ZNK3KJS6Window16allowsAccessFromEPKNS_14JSGlobalObjectE
--[WebScriptObject _imp]
-__Z11_didExecuteP15WebScriptObject
-__Z26updateRenderingForBindingsPN3KJS9ExecStateEPNS_8JSObjectE
-+[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]
-__ZN7WebCore12IconDatabase17iconURLForPageURLERKNS_6StringE
-__ZN7WebCore9FrameView20addSlowRepaintObjectEv
-__ZNK7WebCore14RenderThemeMac22adjustSliderTrackStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZN7WebCore12RenderSliderC2EPNS_16HTMLInputElementE
-__ZN7WebCore12RenderSlider8setStyleEPNS_11RenderStyleE
-__ZN7WebCore12RenderSlider17updateFromElementEv
-__ZN7WebCore22HTMLSliderThumbElementC2EPNS_8DocumentEPNS_4NodeE
-__ZN7WebCore12RenderSlider16createThumbStyleEPNS_11RenderStyleES2_
-__ZNK7WebCore14RenderThemeMac22adjustSliderThumbStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZN7WebCore12RenderSlider20setPositionFromValueEb
-__ZN7WebCore12RenderSlider6layoutEv
-__ZN7WebCore12RenderSlider14calcPrefWidthsEv
-__ZNK7WebCore14RenderThemeMac21adjustSliderThumbSizeEPNS_12RenderObjectE
-__ZN7WebCore12RenderSlider9trackSizeEv
-__ZN7WebCore12RenderSlider18setCurrentPositionEi
-__ZNK7WebCore22HTMLSliderThumbElement12isShadowNodeEv
-__ZN7WebCore22HTMLSliderThumbElement16shadowParentNodeEv
-__ZNK7WebCore12RenderSlider16baselinePositionEbb
-__ZN7WebCore17RenderFlexibleBoxC2EPNS_4NodeE
-__ZN7WebCore17RenderFlexibleBox17layoutVerticalBoxEb
-__ZN7WebCore11RenderBlock30markPositionedObjectsForLayoutEv
-__ZN7WebCore11RenderBlock15clearTruncationEv
-__ZN7WebCore16shouldCheckLinesEPNS_12RenderObjectE
-__ZN7WebCore13RootInlineBox22canAccommodateEllipsisEbiii
-__ZNK7WebCore11RenderBlock25getBaselineOfFirstLineBoxEv
-__ZN7WebCore11RenderBlock9lineCountEv
-__ZN7WebCore13InlineFlowBox22canAccommodateEllipsisEbii
-__ZN7WebCore9InlineBox22canAccommodateEllipsisEbii
-__ZN7WebCore13RootInlineBox13placeEllipsisERKNS_12AtomicStringEbiiPNS_9InlineBoxE
-__ZN7WebCore13RootInlineBox16placeEllipsisBoxEbiiRb
-__ZN7WebCore13InlineFlowBox16placeEllipsisBoxEbiiRb
-__ZN7WebCore13InlineTextBox16placeEllipsisBoxEbiiRb
-__ZN7WebCore14RenderThemeMac16paintSliderTrackEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore24TrackGradientInterpolateEPvPKfPf
-__ZNK7WebCore12RenderSlider8isSliderEv
-__ZN7WebCore14RenderThemeMac16paintSliderThumbEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZNK7WebCore14RenderThemeMac21sliderThumbHorizontalEv
-__ZNK7WebCore12RenderSlider10inDragModeEv
-__ZNK7WebCore12RenderObject14caretMaxOffsetEv
-__ZNK7WebCore11HistoryItem15rssFeedReferrerEv
-__ZN7WebCore11FrameLoader6reloadEv
-__ZN7WebCore17RenderFlexibleBoxD1Ev
-__ZN7WebCore11EllipsisBoxD1Ev
-_sqlite3Update
-_defragmentPage
-_getOverflowPage
-_freePage
-__ZNK7WebCore17HTMLSelectElement17canStartSelectionEv
-__ZN7WebCore9PopupMenu5clearEv
-__ZNK7WebCore12RenderObject14caretMinOffsetEv
-__ZN7WebCore11RenderBlock13selectionRectEb
-__ZNK7WebCore12EventHandler17eventMayStartDragERKNS_18PlatformMouseEventE
-__ZN7WebCore5Range11compareNodeEPNS_4NodeERi
-__ZN7WebCore5Range12comparePointEPNS_4NodeEiRi
-__ZNK7WebCore13HitTestResult10isLiveLinkEv
-__ZNK7WebCore17HTMLAnchorElement10isLiveLinkEv
-__ZNK7WebCore12EventHandler22dragHysteresisExceededERKNS_8IntPointE
-__ZN7WebCore39jsHTMLFormElementPrototypeFunctionResetEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore15HTMLFormElement5resetEv
-__ZN7WebCore16HTMLInputElement5resetEv
-__ZNK7WebCore12RenderObject12scrollHeightEv
-__ZN7WebCore18JSConsolePrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore38jsDocumentPrototypeFunctionExecCommandEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document11execCommandERKNS_6StringEbS3_
-__ZN7WebCore7commandEPNS_8DocumentERKNS_6StringEb
-__ZN7WebCore6Editor7CommandC1Ev
-__ZN7WebCore8Document11styleSheetsEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_14StyleSheetListE
-__ZN7WebCore16JSStyleSheetListC1EPN3KJS8JSObjectEPNS_14StyleSheetListE
-__ZN7WebCore16JSStyleSheetList18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore16JSStyleSheetListEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSStyleSheetList16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore14StyleSheetList6lengthEv
-__ZN7WebCore16JSStyleSheetList11indexGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore14StyleSheetList4itemEj
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_10StyleSheetE
-__ZN7WebCore24JSCSSStyleSheetPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSCSSStyleSheetC1EPN3KJS8JSObjectEPNS_13CSSStyleSheetE
-__ZN7WebCore12JSStyleSheetC1EPN3KJS8JSObjectEPNS_10StyleSheetE
-__ZN7WebCore15JSCSSStyleSheet18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore12JSStyleSheet18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore12JSStyleSheetEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore12JSStyleSheet16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore15JSCSSStyleSheetEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore15JSCSSStyleSheet16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore13CSSStyleSheet8cssRulesEb
-__ZN7WebCore11CSSRuleListC2EPNS_9StyleListEb
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_11CSSRuleListE
-__ZN7WebCore13JSCSSRuleListC1EPN3KJS8JSObjectEPNS_11CSSRuleListE
-__ZN7WebCore13JSCSSRuleList18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore13JSCSSRuleList11indexGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_7CSSRuleE
-__ZNK7WebCore13CSSImportRule4typeEv
-__ZN7WebCore15JSCSSImportRuleC1EPN3KJS8JSObjectEPNS_13CSSImportRuleE
-__ZN7WebCore9JSCSSRuleC1EPN3KJS8JSObjectEPNS_7CSSRuleE
-__ZN7WebCore15JSCSSImportRule18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore9JSCSSRule18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18JSCSSRulePrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore12CSSStyleRule4typeEv
-__ZN7WebCore14JSCSSStyleRuleC1EPN3KJS8JSObjectEPNS_12CSSStyleRuleE
-__ZN7WebCore14JSCSSStyleRule18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore14JSCSSStyleRuleEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore14JSCSSStyleRule16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore16HTMLInputElement3srcEv
-__ZNK7WebCore21HTMLFrameOwnerElement15contentDocumentEv
-__ZN7WebCore5XPath6Parser19makeTokenAndAdvanceEiNS0_8EqTestOp6OpcodeEi
-__ZN7WebCore5XPath8EqTestOpC2ENS1_6OpcodeEPNS0_10ExpressionES4_
-__ZNK7WebCore5XPath8EqTestOp8evaluateEv
-__ZNK7WebCore5XPath8EqTestOp7compareERKNS0_5ValueES4_
-__ZN7WebCore5XPath5ValueD2Ev
-__ZNK7WebCore10ShadowDataeqERKS0_
-__ZN7WebCore15GraphicsContext9setShadowERKNS_7IntSizeEiRKNS_5ColorE
-__ZN7WebCore15GraphicsContext11clearShadowEv
-__ZN7WebCore7Element12scrollHeightEv
-__ZN7WebCore7Element11scrollWidthEv
-__ZNK7WebCore12RenderObject11scrollWidthEv
-__ZNK7WebCore12RenderObject20isInlineContinuationEv
-__ZNK7WebCore18RenderTextFragment12originalTextEv
-__ZN7WebCore18RenderTextFragment15setTextInternalEN3WTF10PassRefPtrINS_10StringImplEEE
-__ZN7WebCore18JSHTMLDListElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSHTMLDListElement9classInfoEv
-__ZN7WebCore18JSHTMLDListElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore22JSCSSRuleListPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16JSHTMLCollection14implementsCallEv
-__ZNK7WebCore17HTMLAnchorElement3relEv
-__ZN7WebCore9CSSParser17createCharsetRuleERKNS_11ParseStringE
-__ZN7WebCore14CSSCharsetRuleC2EPNS_9StyleBaseERKNS_6StringE
-__ZN7WebCore9StyleBase11isMediaRuleEv
-__ZN7WebCore9StyleBase14isFontFaceRuleEv
-__ZN7WebCore13RootInlineBox14adjustPositionEii
-__ZN7WebCore13InlineFlowBox14adjustPositionEii
-__ZNK7WebCore14CSSCharsetRule4typeEv
-__ZN7WebCore16JSCSSCharsetRuleC1EPN3KJS8JSObjectEPNS_14CSSCharsetRuleE
-__ZN7WebCore16JSCSSCharsetRule18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSCustomXPathNSResolverC1EPN3KJS8JSObjectEPNS_5FrameE
-__ZN7WebCore23JSCustomXPathNSResolverD1Ev
-__ZN7WebCore23JSCustomXPathNSResolver18lookupNamespaceURIERKNS_6StringE
-__ZN7WebCore22getPositionOffsetValueEPNS_11RenderStyleEi
-__ZNK7WebCore7Comment8nodeNameEv
-__ZN3KJS17staticValueGetterIN7WebCore9JSCommentEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore9JSComment16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore44jsHTMLAnchorElementPrototypeFunctionToStringEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore17HTMLAnchorElement8toStringEv
-__ZN7WebCore17JSHTMLHeadElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore9sizingBoxEPNS_12RenderObjectE
-__ZNK7WebCore13KeyboardEvent8charCodeEv
-__ZNK7WebCore6String19characterStartingAtEj
-__ZN7WebCore10StringImpl19characterStartingAtEj
-__ZN7WebCore40jsHTMLFormElementPrototypeFunctionSubmitEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore15HTMLFormElement6submitEv
-__ZN7WebCore14CSSCharsetRuleD1Ev
-__ZN7WebCore14RenderTableRow12imageChangedEPNS_11CachedImageE
-__ZN7WebCore12EventHandler29passMousePressEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameE
-__ZN7WebCore12EventHandler32passWidgetMouseDownEventToWidgetEPNS_12RenderWidgetE
-__ZN7WebCore12EventHandler31passMouseReleaseEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameE
-__ZNK7WebCore12RenderObject8viewRectEv
-__ZNK7WebCore12RenderObject12overflowLeftEb
-__ZN7WebCore32jsDOMWindowPrototypeFunctionBlurEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9DOMWindow4blurEv
-__ZN7WebCore5Frame13unfocusWindowEv
-__ZNK7WebCore6Chrome7unfocusEv
-__ZN7WebCore11FrameLoader15didExplicitOpenEv
-__ZN7WebCore33jsDOMWindowPrototypeFunctionCloseEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9DOMWindow5closeEv
-__ZNK7WebCore11FrameLoader11openedByDOMEv
-__ZN7WebCore5Frame13scheduleCloseEv
-__ZN7WebCore6Chrome15closeWindowSoonEv
-__ZNK3KJS7Plugins9classInfoEv
-__ZNK7WebCore16JSHTMLCollection9classInfoEv
-__ZNK7WebCore17HTMLAnchorElement4nameEv
-__ZNK7WebCore15HTMLFormElement4nameEv
-__ZN7WebCore11FrameLoader25loadResourceSynchronouslyERKNS_15ResourceRequestERNS_13ResourceErrorERNS_16ResourceResponseERN3WTF6VectorIcLm0EEE
-__ZN7WebCore19ResourceRequestBase18setTimeoutIntervalEd
-__ZN7WebCore14ResourceHandle25loadResourceSynchronouslyERKNS_15ResourceRequestERNS_13ResourceErrorERNS_16ResourceResponseERN3WTF6VectorIcLm0EEEPNS_5FrameE
-+[WebCoreSynchronousLoader loadRequest:returningResponse:error:]
--[WebCoreSynchronousLoader _isDone]
--[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]
--[WebCoreSynchronousLoader connection:didReceiveResponse:]
--[WebCoreSynchronousLoader connection:didReceiveData:]
--[WebCoreSynchronousLoader connectionDidFinishLoading:]
--[WebCoreSynchronousLoader _data]
--[WebCoreSynchronousLoader _response]
--[WebCoreSynchronousLoader _error]
--[WebCoreSynchronousLoader dealloc]
-__ZN7WebCore20ResourceResponseBaseD2Ev
-__ZN7WebCore13ResourceErroraSERKS0_
-__ZN7WebCore14XMLHttpRequest22processSyncLoadResultsERKN3WTF6VectorIcLm0EEERKNS_16ResourceResponseE
-__ZN7WebCore19createObjectWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore19JSHTMLObjectElementC1EPN3KJS8JSObjectEPNS_17HTMLObjectElementE
-__ZN7WebCore19JSHTMLObjectElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19JSHTMLObjectElement18canGetItemsForNameEPN3KJS9ExecStateEPNS_17HTMLObjectElementERKNS1_10IdentifierE
-__ZN7WebCore19JSHTMLObjectElement24customGetOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore17HTMLObjectElement11getInstanceEv
-__ZN7WebCore28JSHTMLObjectElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore11FrameLoader21fileDoesNotExistErrorERKNS_16ResourceResponseE
-__ZN7WebCore5XPath18createFunLocalNameEv
-__ZN7WebCore5XPath9LogicalOpC2ENS1_6OpcodeEPNS0_10ExpressionES4_
-__ZNK7WebCore5XPath9LogicalOp8evaluateEv
-__ZNK7WebCore5XPath12FunLocalName8evaluateEv
-__ZNK7WebCore5XPath9LogicalOp14shortCircuitOnEv
-__ZNK7WebCore12RenderButton14hasLineIfEmptyEv
-__ZN3KJS17staticValueGetterIN7WebCore16JSHTMLMapElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSHTMLMapElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore14HTMLMapElement4nameEv
-__ZNK7WebCore15HTMLAreaElement6coordsEv
-__ZN7WebCore26JSUnprotectedEventListener14clearWindowObjEv
-__ZN7WebCore12RenderObject6setPosEii
-__ZN7WebCore11FrameLoader20checkNewWindowPolicyERKNS_16NavigationActionERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEERKNS_6StringE
-__ZN7WebCore11PolicyCheck3setERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEERKNS_6StringEPFvPvS3_S7_SA_bESB_
-__ZN7WebCore11FrameLoader28continueAfterNewWindowPolicyENS_12PolicyActionE
-__ZN7WebCore11FrameLoader36callContinueLoadAfterNewWindowPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEERKNS_6StringEb
-__ZN7WebCore11FrameLoader32continueLoadAfterNewWindowPolicyERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEERKNS_6StringEb
-__ZN3KJS22pluginsFunctionRefreshEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS10PluginBase7refreshEb
-__ZN7WebCore14refreshPluginsEb
-__ZNK7WebCore17HTMLIFrameElement6heightEv
-__ZNK7WebCore19JSHTMLObjectElement9classInfoEv
-__ZN7WebCore19JSHTMLObjectElement10nameGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore9Selection22expandUsingGranularityENS_15TextGranularityE
-__ZN7WebCore15isEndOfDocumentERKNS_15VisiblePositionE
-__ZN7WebCore11isEndOfLineERKNS_15VisiblePositionE
-__ZN7WebCore9endOfLineERKNS_15VisiblePositionE
-__ZN7WebCore18endPositionForLineERKNS_15VisiblePositionE
-__ZN7WebCore11RenderBlock24fillVerticalSelectionGapEiiiiPS0_iiPKNS_12RenderObject9PaintInfoE
-__ZN7WebCore18JSHTMLEmbedElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore18JSHTMLEmbedElement9customPutEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore22runtimeObjectCustomPutEPN3KJS9ExecStateERKNS0_10IdentifierEPNS0_7JSValueEiPNS_11HTMLElementE
-__ZN7WebCore18JSHTMLEmbedElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore17HTMLPlugInElement8setWidthERKNS_6StringE
-__ZN7WebCore17HTMLPlugInElement9setHeightERKNS_6StringE
-__ZN7WebCore9CSSParser10parseShapeEib
-__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_4RectEEE
-__ZN7WebCore15convertToLengthEPNS_17CSSPrimitiveValueEPNS_11RenderStyleEPb
-__ZN7WebCore11RenderStyle7setClipENS_6LengthES1_S1_S1_
-__ZN7WebCore9RenderBox11getClipRectEii
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_15PageURLSnapshotEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IS5_EEEESC_E4findIS3_NS_22IdentityHashTranslatorIS3_S6_S9_EEEENS_17HashTableIteratorIS3_S6_S8_S9_SE_SC_EERKT_
-__ZNK7WebCore13HitTestResult16absoluteImageURLEv
-__ZNK7WebCore20HTMLFrameElementBase3srcEv
-_WebCoreDrawTextAtPoint
-__ZNK7WebCore17MouseRelatedEvent1xEv
-__ZNK7WebCore12RenderObject10nextOffsetEi
-__ZN7WebCore12EventHandler20autoscrollTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore12RenderObject10autoscrollEv
-__ZN7WebCore11RenderLayer10autoscrollEv
-__ZN7WebCore12EventHandler27updateSelectionForMouseDragEv
-__ZNK7WebCore12EventHandler20currentMousePositionEv
-__ZNK7WebCore13CharacterData19isCharacterDataNodeEv
-__ZN7WebCore31SimplifiedBackwardsTextIterator17handleNonTextNodeEv
-__ZNK7WebCore4Node19isCharacterDataNodeEv
-__ZN7WebCore18MainResourceLoader7didFailERKNS_13ResourceErrorE
-__ZN7WebCore18MainResourceLoader13receivedErrorERKNS_13ResourceErrorE
-__ZN7WebCore18MainResourceLoader18handleDataLoadSoonERNS_15ResourceRequestE
-__ZN7WebCore5TimerINS_18MainResourceLoaderEE5firedEv
-__ZN7WebCore18MainResourceLoader17handleDataLoadNowEPNS_5TimerIS0_EE
-__ZN3WTF7HashMapIPKN7WebCore13RootInlineBoxEPNS1_11EllipsisBoxENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE4takeERKS4_
-__ZN7WebCore11EllipsisBox5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore36jsHTMLDocumentPrototypeFunctionCloseEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12RenderInline13absoluteRectsERN3WTF6VectorINS_7IntRectELm0EEEiib
-__ZN7WebCore19JSHTMLSelectElement11indexGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore17HTMLSelectElement4itemEj
-__ZN7WebCore17HTMLButtonElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore12RenderButton24updateBeforeAfterContentENS_11RenderStyle8PseudoIdE
-__ZN7WebCore12RenderButton28removeLeftoverAnonymousBlockEPNS_11RenderBlockE
-__ZN7WebCore44jsDocumentPrototypeFunctionGetElementsByNameEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4Node17getElementsByNameERKNS_6StringE
-__ZN3WTF7HashMapIN7WebCore6StringENS1_15DynamicNodeList6CachesENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3addERKS2_RKS4_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_15DynamicNodeList6CachesEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E3addINS1_6StringES6_NS_17HashMapTranslatorILb0ES4_ISI_S6_ENS_18PairBaseHashTraitsINSC_ISI_EESE_EESF_SA_EEEES4_INS_17HashTableIteratorIS3_S7_S9_SA_SF_SD_EEbERKT_RKT0_
-__ZN7WebCore12NameNodeListC1EN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringEPNS_15DynamicNodeList6CachesE
-__ZNK7WebCore12NameNodeList11nodeMatchesEPNS_4NodeE
-__ZNK7WebCore17HTMLButtonElement14isEnumeratableEv
-__ZNK7WebCore13KeyboardEvent5whichEv
-__ZNK7WebCore17HTMLAnchorElement19isKeyboardFocusableEPNS_13KeyboardEventE
-__ZNK7WebCore12EventHandler11tabsToLinksEPNS_13KeyboardEventE
-__ZNK7WebCore12EventHandler24invertSenseOfTabsToLinksEPNS_13KeyboardEventE
-__ZNK7WebCore22HTMLGenericFormElement19isKeyboardFocusableEPNS_13KeyboardEventE
-__ZNK7WebCore12EventHandler17tabsToAllControlsEPNS_13KeyboardEventE
-__ZNK7WebCore17HTMLButtonElement17isActivatedSubmitEv
-__ZNK7WebCore17HTMLButtonElement24isSuccessfulSubmitButtonEv
-__ZN7WebCore17HTMLButtonElement18setActivatedSubmitEb
-__ZN7WebCore17HTMLButtonElement14appendFormDataERNS_12FormDataListEb
-__ZN7WebCore12EventHandler32handleMousePressEventTripleClickERKNS_28MouseEventWithHitTestResultsE
-__ZNK7WebCore12HTMLDocument10compatModeEv
-__ZN7WebCore36jsDOMWindowPrototypeFunctionResizeToEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9DOMWindow8resizeToEff
-__ZN7WebCore19JSHTMLObjectElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore19JSHTMLObjectElement9customPutEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN3KJS17staticValueGetterIN7WebCore19JSHTMLObjectElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSHTMLObjectElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore17HTMLObjectElement4typeEv
-__ZN7WebCore15HTMLFormElement16removeImgElementEPNS_16HTMLImageElementE
-__ZN7WebCore23JSHTMLOptionsCollection16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore21HTMLOptionsCollection16setSelectedIndexEi
-__ZNK7WebCore19JSHTMLSelectElement9classInfoEv
-__ZN7WebCore12HTMLDocument5widthEv
-__ZNK7WebCore8Document7doctypeEv
-__ZNK7WebCore12DocumentType8nodeTypeEv
-__ZN7WebCore14JSDocumentTypeC1EPN3KJS8JSObjectEPNS_12DocumentTypeE
-__ZN7WebCore12HTMLDocument6heightEv
-__ZN7WebCore17HTMLSelectElement6removeEi
-__ZN7WebCore17HTMLSelectElement11removeChildEPNS_4NodeERi
-__ZN7WebCore19createButtonWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore19JSHTMLButtonElementC1EPN3KJS8JSObjectEPNS_17HTMLButtonElementE
-__ZN7WebCore19JSHTMLButtonElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore19JSHTMLButtonElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSHTMLButtonElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore21JSCSSStyleDeclarationEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSCSSStyleDeclaration16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore9FontValue7cssTextEv
-__ZN7WebCore17createFontWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore17JSHTMLFontElementC1EPN3KJS8JSObjectEPNS_15HTMLFontElementE
-__ZN7WebCore17JSHTMLFontElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore17JSHTMLFontElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZNK7WebCore14HTMLPreElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore14HTMLPreElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore16executeMoveRightEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore19SelectionController24modifyMovingRightForwardENS_15TextGranularityE
-__ZN7WebCore19SelectionController6moveToERKNS_15VisiblePositionEb
-__ZNK7WebCore5Frame11revealCaretERKNS_11RenderLayer15ScrollAlignmentE
-__ZNK7WebCore15VisiblePosition9caretRectEv
-__ZN7WebCore10HTMLParser11isHeaderTagERKNS_12AtomicStringE
-__ZN7WebCore14RenderFieldset22paintBorderMinusLegendEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleEiii
-__ZNK7WebCore16HTMLImageElement4nameEv
-__ZNK7WebCore10MouseEvent9toElementEv
-__ZN7WebCore10RenderText17previousCharacterEv
-__ZNK7WebCore12RenderObject18previousInPreOrderEv
-__ZN7WebCore10StringImpl10capitalizeEt
-__ZN7WebCore17wordBreakIteratorEPKti
-__ZN7WebCore14textBreakFirstEPNS_17TextBreakIteratorE
-__ZN7WebCore15createHRWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore15JSHTMLHRElementC1EPN3KJS8JSObjectEPNS_13HTMLHRElementE
-__ZN7WebCore15JSHTMLHRElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25jsLocationProtoFuncReloadEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore11FrameLoader15scheduleRefreshEb
-__ZN7WebCore17HTMLAnchorElement7setNameERKNS_6StringE
-__ZN7WebCore22JSHTMLParagraphElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZNK7WebCore16HTMLInputElement5alignEv
-__ZNK7WebCore16HTMLTableElement6borderEv
-__ZN7WebCore19HTMLTextAreaElement5resetEv
-__ZN7WebCore8Document17setSecurityOriginEPNS_14SecurityOriginE
-__ZN7WebCore11FrameLoader5writeERKNS_6StringE
-__ZN7WebCore17HTMLSelectElement5resetEv
-__ZN7WebCore22HTMLGenericFormElement5resetEv
-__ZN7WebCore40jsHTMLAnchorElementPrototypeFunctionBlurEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore17HTMLScriptElement10setCharsetERKNS_6StringE
-__ZN7WebCore17RenderTextControl6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
-__ZN7WebCore9supportedEPNS_5FrameENS_19EditorCommandSourceE
-__ZNK7WebCore6Editor7Command5stateEPNS_5EventE
-__ZN7WebCore9stateNoneEPNS_5FrameEPNS_5EventE
-__ZN7WebCore10enabledCutEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
-__ZN7WebCore6Editor11canDHTMLCutEv
-__ZN7WebCore6Editor16dispatchCPPEventERKNS_12AtomicStringENS_21ClipboardAccessPolicyE
-__ZN7WebCore6Editor19newGeneralClipboardENS_21ClipboardAccessPolicyE
-__ZN7WebCore12ClipboardMacC2EbP12NSPasteboardNS_21ClipboardAccessPolicyEPNS_5FrameE
-__ZN7WebCore9ClipboardC2ENS_21ClipboardAccessPolicyEb
-__ZN7WebCore14ClipboardEventC2ERKNS_12AtomicStringEbbPNS_9ClipboardE
-__ZN7WebCore9Clipboard15setAccessPolicyENS_21ClipboardAccessPolicyE
-__ZN7WebCore12ClipboardMacD1Ev
-__ZNK7WebCore6Editor6canCutEv
-__ZNK7WebCore6Editor7canCopyEv
-__ZN7WebCore29imageElementFromImageDocumentEPNS_8DocumentE
-__ZN7WebCore11enabledCopyEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
-__ZN7WebCore6Editor12canDHTMLCopyEv
-__ZN7WebCore6Editor13canDHTMLPasteEv
-__ZNK7WebCore6Editor8canPasteEv
-__ZN7WebCore13enabledDeleteEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
-__ZN7WebCore7enabledEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
--[WebCoreFrameBridge canProvideDocumentSource]
-__ZNK7WebCore11FrameLoader16responseMIMETypeEv
-__ZN7WebCore40jsHTMLSelectElementPrototypeFunctionBlurEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore16HTMLImageElement3altEv
-__ZN7WebCore14RenderReplaced22positionForCoordinatesEii
-__ZNK7WebCore9JSComment9classInfoEv
-__ZN7WebCore9FrameView20postLayoutTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_12NamedNodeMapE
-__ZN7WebCore14JSNamedNodeMapC1EPN3KJS8JSObjectEPNS_12NamedNodeMapE
-__ZN7WebCore14JSNamedNodeMap18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSNamedNodeMapPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore14JSNamedNodeMapEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore14JSNamedNodeMap16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS49jsXMLHttpRequestPrototypeFunctionOverrideMIMETypeEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore14XMLHttpRequest16overrideMIMETypeERKNS_6StringE
-__ZN7WebCore29jsConsolePrototypeFunctionLogEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9JSConsole9classInfoEv
-__ZN7WebCore7Console3logERKNS_6StringE
-__ZN7WebCore9CSSParser27createFloatingMediaQueryExpERKNS_12AtomicStringEPNS_9ValueListE
-__ZN7WebCore13MediaQueryExpC2ERKNS_12AtomicStringEPNS_9ValueListE
-__ZN7WebCore9CSSParser25sinkFloatingMediaQueryExpEPNS_13MediaQueryExpE
-__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE15reserveCapacityEm
-__ZNK7WebCore19MediaQueryEvaluator4evalEPKNS_13MediaQueryExpE
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFbPNS1_8CSSValueEPNS1_11RenderStyleEPNS1_4PageENS1_18MediaFeaturePrefixEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSF_ISC_EEE3getERKS3_
-__ZN7WebCore25min_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore21widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore12compareValueIiEEbT_S1_NS_18MediaFeaturePrefixE
-__ZN7WebCore27JSHTMLDivElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore27JSHTMLDivElementConstructor9classInfoEv
-__ZN7WebCore26JSHTMLLIElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore26JSHTMLLIElementConstructor9classInfoEv
-__ZN7WebCore9InlineBox14selectionStateEv
-__ZN7WebCore29JSHTMLImageElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLImageElementConstructor9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore22JSHTMLTableCellElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore22JSHTMLTableCellElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore33JSHTMLTableCellElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore33JSHTMLTableCellElementConstructor9classInfoEv
-__ZN7WebCore29JSHTMLTableElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLTableElementConstructor9classInfoEv
-__ZN7WebCore28JSHTMLBodyElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore28JSHTMLBodyElementConstructor9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore21JSHTMLTableRowElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSHTMLTableRowElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore32JSHTMLTableRowElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore32JSHTMLTableRowElementConstructor9classInfoEv
-__ZN7WebCore30JSHTMLAnchorElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore30JSHTMLAnchorElementConstructor9classInfoEv
-__ZN7WebCore13MediaQueryExpD2Ev
-__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE6shrinkEm
-__ZN7WebCore4Page9goForwardEv
-__ZN7WebCore10JSDocument11setLocationEPN3KJS9ExecStateEPNS1_7JSValueE
-__ZN7WebCore8Document23activeChainNodeDetachedEPNS_4NodeE
-__ZN3KJS9MimeTypes11indexGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN7WebCore49jsDocumentPrototypeFunctionCreateDocumentFragmentEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document22createDocumentFragmentEv
-__ZNK7WebCore24JSHTMLElementConstructor9classInfoEv
-__ZNK7WebCore11RenderBlock14positionForBoxEPNS_9InlineBoxEb
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLTitleElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLTitleElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore16HTMLTitleElement4textEv
-__ZNK7WebCore15HTMLBodyElement11scrollWidthEv
-__ZN7WebCore41jsHTMLInputElementPrototypeFunctionSelectEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore19basefontConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore19HTMLBaseFontElementC2EPNS_8DocumentE
-__ZNK7WebCore19HTMLBaseFontElement17endTagRequirementEv
-__ZNK7WebCore19HTMLBaseFontElement11tagPriorityEv
-__ZN7WebCore43jsNamedNodeMapPrototypeFunctionGetNamedItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore14JSNamedNodeMap9classInfoEv
-__ZN7WebCore6JSAttrC1EPN3KJS8JSObjectEPNS_4AttrE
-__ZN7WebCore6JSAttr18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore6JSAttrEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore6JSAttr16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore16DeprecatedString7replaceEjjRKS0_
-__ZNK7WebCore11RenderTheme32inactiveSelectionBackgroundColorEv
-__ZNK7WebCore14RenderThemeMac40platformInactiveSelectionBackgroundColorEv
-__ZNK7WebCore11RenderTheme40platformInactiveSelectionForegroundColorEv
-__ZN7WebCore10IconRecordD2Ev
-__ZNK7WebCore18JSConsolePrototype9classInfoEv
-__ZN7WebCore19optgroupConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore19HTMLOptGroupElementC2EPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore19HTMLOptGroupElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore19HTMLOptGroupElement19recalcSelectOptionsEv
-__ZN7WebCore19HTMLOptGroupElement6attachEv
-__ZN7WebCore19HTMLOptGroupElement14setRenderStyleEPNS_11RenderStyleE
-__ZN7WebCore19HTMLOptGroupElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore19HTMLOptGroupElement15childrenChangedEb
-__ZNK7WebCore19HTMLOptGroupElement11renderStyleEv
-__ZN7WebCore12IconDatabase25removeIconFromSQLDatabaseERKNS_6StringE
-__ZNK7WebCore17JSNodeConstructor21implementsHasInstanceEv
-__ZThn8_N7WebCore14XMLHttpRequest7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
-__ZN7WebCore14XMLHttpRequest7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
-__ZN7WebCore19HTMLOptGroupElement6detachEv
-__ZN7WebCore30JSHTMLTextAreaElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore21JSHTMLTextAreaElement9classInfoEv
-__ZN7WebCore21JSHTMLTextAreaElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore21JSHTMLTextAreaElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZNK7WebCore14RenderThemeMac35adjustSearchFieldResultsButtonStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZN7WebCore14RenderThemeMac29paintSearchFieldResultsButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZNK7WebCore14RenderThemeMac18searchMenuTemplateEv
-__ZN7WebCore12EventHandler13freeClipboardEv
-__ZNK7WebCore12EventHandler23createDraggingClipboardEv
-__ZN7WebCore12EventHandler20dispatchDragSrcEventERKNS_12AtomicStringERKNS_18PlatformMouseEventE
-__ZN7WebCore12EventHandler17dispatchDragEventERKNS_12AtomicStringEPNS_4NodeERKNS_18PlatformMouseEventEPNS_9ClipboardE
-__ZNK7WebCore9Clipboard15sourceOperationERNS_13DragOperationE
-__ZN7WebCore14DragController9startDragEPNS_5FrameEPNS_9ClipboardENS_13DragOperationERKNS_18PlatformMouseEventERKNS_8IntPointEb
-__ZN7WebCore8getImageEPNS_7ElementE
-__ZN7WebCore12ClipboardMac7hasDataEv
-__ZNK7WebCore13HitTestResult16altDisplayStringEv
-__ZN7WebCore13displayStringERKNS_6StringEPKNS_4NodeE
-__ZN7WebCore9SelectionC2EPKNS_5RangeENS_9EAffinityE
-__ZN7WebCore14RenderReplaced17setSelectionStateENS_12RenderObject14SelectionStateE
-__ZNK7WebCore14RenderReplaced18canBeSelectionLeafEv
-__ZN7WebCore14RenderReplaced13selectionRectEb
-__ZN7WebCore12ClipboardMac24declareAndWriteDragImageEPNS_7ElementERKNS_4KURLERKNS_6StringEPNS_5FrameE
--[WebCoreFrameBridge markupStringFromNode:nodes:]
--[WebCoreFrameBridge nodesFromList:]
--[WebCoreFrameBridge _stringWithDocumentTypeStringAndMarkupString:]
-__ZNK7WebCore5Frame18documentTypeStringEv
-__ZNK7WebCore12DocumentType8toStringEv
--[DOMHTMLImageElement useMap]
-__ZNK7WebCore16HTMLImageElement6useMapEv
--[DOMHTMLImageElement src]
--[WebCoreFrameBridge URLWithAttributeString:]
--[WebCoreFrameBridge getData:andResponse:forURL:]
-__ZN7WebCore12SharedBuffer12createNSDataEv
-__ZNK7WebCore13HitTestResult9imageRectEv
-__ZNK7WebCore12RenderObject18absoluteContentBoxEv
-__ZN7WebCore14DragController11doImageDragEPNS_7ElementERKNS_8IntPointERKNS_7IntRectEPNS_9ClipboardEPNS_5FrameERS3_
-__ZN7WebCore24createDragImageFromImageEPNS_5ImageE
-__ZNK7WebCore7IntSizecv7_NSSizeEv
-__ZN7WebCore14DragController16maxDragImageSizeEv
-__ZN7WebCore21fitDragImageToMaxSizeEN3WTF9RetainPtrI7NSImageEERKNS_7IntSizeES6_
-__ZN7WebCore13dragImageSizeEN3WTF9RetainPtrI7NSImageEE
-__ZN7WebCore27dissolveDragImageToFractionEN3WTF9RetainPtrI7NSImageEEf
-__ZN7WebCore14DragController12doSystemDragEN3WTF9RetainPtrI7NSImageEERKNS_8IntPointES7_PNS_9ClipboardEPNS_5FrameEb
-__ZN7WebCore8DragDataC1EP11objc_objectRKNS_8IntPointES5_NS_13DragOperationEPNS_16PasteboardHelperE
-__ZN7WebCore14DragController11dragEnteredEPNS_8DragDataE
-__ZN7WebCore14DragController20dragEnteredOrUpdatedEPNS_8DragDataE
-__ZN7WebCore5Frame15documentAtPointERKNS_8IntPointE
-__ZN7WebCore14DragController15tryDocumentDragEPNS_8DragDataENS_21DragDestinationActionE
-__ZN7WebCore14DragController12tryDHTMLDragEPNS_8DragDataE
-__ZNK7WebCore11FrameLoader7baseURLEv
-__ZNK7WebCore8DragData15createClipboardENS_21ClipboardAccessPolicyE
-__ZN7WebCore9Clipboard18setSourceOperationENS_13DragOperationE
-__ZN7WebCore14IEOpFromDragOpENS_13DragOperationE
-__ZN7WebCore16createMouseEventEPNS_8DragDataE
-__ZN7WebCore12EventHandler17updateDragAndDropERKNS_18PlatformMouseEventEPNS_9ClipboardE
-__ZN7WebCore14DragController14canProcessDragEPNS_8DragDataE
-__ZNK7WebCore8DragData25containsCompatibleContentEv
-__ZNK7WebCore8DragData13containsFilesEv
-__ZN7WebCore14DragController16operationForLoadEPNS_8DragDataE
-__ZN7WebCore14DragController11dragUpdatedEPNS_8DragDataE
--[WebCoreFrameBridge dragSourceMovedTo:]
-__ZN7WebCore12EventHandler17dragSourceMovedToERKNS_18PlatformMouseEventE
-__ZN7WebCore14DragController10dragExitedEPNS_8DragDataE
-__ZN7WebCore12EventHandler17cancelDragAndDropERKNS_18PlatformMouseEventEPNS_9ClipboardE
-__ZN7WebCore12EventHandler14clearDragStateEv
-__ZN7WebCore14DragController10cancelDragEv
--[WebCoreFrameBridge dragSourceEndedAt:operation:]
-__ZN7WebCore12EventHandler17dragSourceEndedAtERKNS_18PlatformMouseEventENS_13DragOperationE
-__ZN7WebCore9Clipboard23setDestinationOperationENS_13DragOperationE
-__ZN7WebCore15deleteDragImageEN3WTF9RetainPtrI7NSImageEE
-__ZN7WebCore34jsDOMWindowPrototypeFunctionScrollEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore14SimpleFontData17smallCapsFontDataERKNS_15FontDescriptionE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_17DOMImplementationE
-__ZN7WebCore19JSDOMImplementationC1EPN3KJS8JSObjectEPNS_17DOMImplementationE
-__ZN7WebCore19JSDOMImplementation18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSDOMImplementationPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore13HTMLTokenizer26parseProcessingInstructionERNS_15SegmentedStringENS0_5StateE
-__ZN7WebCore5XPath12LocationPath15insertFirstStepEPNS0_4StepE
-__ZN7WebCore41jsXPathResultPrototypeFunctionIterateNextEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore11XPathResult11iterateNextERi
-__ZN7WebCore14JSNamedNodeMap11indexGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZNK7WebCore12NamedAttrMap4itemEj
-__ZN7WebCore21JSCSSStyleDeclaration16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore26CSSMutableStyleDeclaration10setCssTextERKNS_6StringERi
-__ZN7WebCore9Scrollbar6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
-__ZThn8_N7WebCore17PlatformScrollbar19updateThumbPositionEv
-__ZN7WebCore17PlatformScrollbar19updateThumbPositionEv
-__ZN7WebCore11RenderLayer12valueChangedEPNS_9ScrollbarE
-__ZN7WebCore17HTMLButtonElement19defaultEventHandlerEPNS_5EventE
-__ZNK7WebCore17HTMLButtonElement17canStartSelectionEv
-__ZN7WebCore22JSNamedNodesCollection12lengthGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZNK7WebCore21HTMLFrameOwnerElement19isKeyboardFocusableEPNS_13KeyboardEventE
-__ZNK7WebCore17HTMLSelectElement19isKeyboardFocusableEPNS_13KeyboardEventE
-__ZNK7WebCore17HTMLOptionElement11isFocusableEv
-__ZN7WebCore12NameNodeList24rootNodeAttributeChangedEv
-__ZN7WebCore30jsElementPrototypeFunctionBlurEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore11RenderLayer23verticalScrollbarWidgetEv
-__ZN7WebCore13HitTestResult12setScrollbarEPNS_17PlatformScrollbarE
-__ZN7WebCore9Scrollbar20handleMouseMoveEventERKNS_18PlatformMouseEventE
-__ZN7WebCore9Scrollbar19handleMouseOutEventERKNS_18PlatformMouseEventE
-__ZN7WebCore12HTMLDocument7bgColorEv
-__ZNK7WebCore15HTMLBodyElement7bgColorEv
-__ZN7WebCore14JSDocumentType18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore14JSDocumentTypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore14JSDocumentType16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore14JSDocumentType4implEv
-__ZN7WebCore22HTMLGenericFormElement11setTabIndexEi
-__ZN7WebCore19JSHTMLButtonElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore19JSHTMLButtonElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZNK7WebCore17HTMLButtonElement4typeEv
-__ZNK7WebCore14RenderFieldset33expandsToEncloseOverhangingFloatsEv
-__ZNK7WebCore4Node9isEnabledEv
-__ZN7WebCore35jsHTMLDocumentPrototypeFunctionOpenEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore14JSHTMLDocument4openEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore34jsDOMWindowPrototypeFunctionMoveToEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9DOMWindow6moveToEff
-__ZNK7WebCore19HTMLFieldSetElement11isFocusableEv
-__ZN7WebCore28JSHTMLButtonElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSHTMLButtonElement9classInfoEv
-__ZNK7WebCore7UIEvent7keyCodeEv
-__ZN7WebCore13ImageDocumentC2EPNS_17DOMImplementationEPNS_5FrameE
-__ZNK7WebCore13ImageDocument17shouldShrinkToFitEv
-__ZN7WebCore13ImageDocument15createTokenizerEv
-__ZNK7WebCore14ImageTokenizer12wantsRawDataEv
-__ZN7WebCore14ImageTokenizer12writeRawDataEPKci
-__ZN7WebCore13ImageDocument11cachedImageEv
-__ZN7WebCore13ImageDocument23createDocumentStructureEv
-__ZN7WebCore8Document16childTypeAllowedENS_4Node8NodeTypeE
-__ZNK7WebCore14DocumentLoader16mainResourceDataEv
-__ZN7WebCore13ImageDocument12imageChangedEv
-__ZN7WebCore14ImageTokenizer6finishEv
-__ZNK7WebCore14DocumentLoader25isLoadingMultipartContentEv
-__ZN7WebCore15finishImageLoadEPNS_8DocumentEPNS_11CachedImageE
-__ZNK7WebCore20ResourceResponseBase17suggestedFilenameEv
-__ZN7WebCore8Document4headEv
-__ZN7WebCore14ImageTokenizerD1Ev
-__ZN7WebCore10IconLoader7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
-__ZN7WebCore49jsDocumentPrototypeFunctionGetElementsByClassNameEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4Node22getElementsByClassNameERKNS_6StringE
-__ZN7WebCore13ClassNodeListC1EN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringEPNS_15DynamicNodeList6CachesE
-__ZNK7WebCore13ClassNodeList11nodeMatchesEPNS_4NodeE
-__ZN7WebCore18createParamWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLParamElementC1EPN3KJS8JSObjectEPNS_16HTMLParamElementE
-__ZN7WebCore18JSHTMLParamElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSHTMLParamElement9classInfoEv
-__ZN7WebCore48jsElementPrototypeFunctionGetElementsByClassNameEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore19JSHTMLObjectElement14implementsCallEv
-__ZN7WebCore13ClassNodeListD1Ev
-__ZN7WebCore46jsDOMImplementationPrototypeFunctionHasFeatureEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore19JSDOMImplementation9classInfoEv
-__ZN7WebCore14isSVG10FeatureERKNS_6StringE
-__ZN7WebCore10ShadowDataC2ERKS0_
-__ZN7WebCore35HTMLSearchFieldResultsButtonElement19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore34HTMLSearchFieldCancelButtonElement19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore18JSHTMLOListElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore16HTMLInputElement12setMaxLengthEi
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLLabelElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLLabelElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore16HTMLLabelElement7htmlForEv
-__ZNK7WebCore13MutationEvent15isMutationEventEv
-__ZN7WebCore15JSMutationEventC1EPN3KJS8JSObjectEPNS_13MutationEventE
-__ZN7WebCore10JSNodeList10nameGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore42jsElementPrototypeFunctionGetAttributeNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Element16getAttributeNodeERKNS_6StringE
-__ZN7WebCore12IconDatabase5closeEv
-__ZN3WTF6VectorIPN7WebCore17RegularExpressionELm0EE6shrinkEm
-___tcf_0
-___tcf_46
-___tcf_45
-___tcf_44
-___tcf_43
-___tcf_42
-___tcf_41
-___tcf_40
-___tcf_39
-___tcf_38
-___tcf_37
-___tcf_36
-___tcf_35
-___tcf_34
-___tcf_33
-___tcf_32
-___tcf_31
-___tcf_30
-___tcf_29
-___tcf_28
-___tcf_27
-___tcf_26
-___tcf_25
-___tcf_24
-___tcf_23
-___tcf_22
-___tcf_21
-___tcf_20
-___tcf_19
-___tcf_18
-___tcf_17
-___tcf_16
-___tcf_15
-___tcf_14
-___tcf_13
-___tcf_12
-___tcf_11
-___tcf_10
-___tcf_9
-___tcf_8
-___tcf_7
-___tcf_6
-___tcf_5
-___tcf_4
-___tcf_3
-___tcf_2
-__ZN7WebCore5MutexD1Ev
-__ZN7WebCore14SQLiteDatabaseD1Ev
-__ZN7WebCore20tableCellConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore5Image11drawPatternEPNS_15GraphicsContextERKNS_9FloatRectERKNS_20TransformationMatrixERKNS_10FloatPointENS_17Compos
+__ZN7WebCore11BitmapImage26nativeImageForCurrentFrameEv
+__ZN7WebCore16RenderListMarker5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore16RenderListMarker21getRelativeMarkerRectEv
+__ZNK7WebCore4Page34inLowQualityImageInterpolationModeEv
+__ZN3WTF7HashMapIPN7WebCore11RenderImageEPNS1_20RenderImageScaleDataENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3
+__ZNK3WTF7HashMapIPN7WebCore11RenderImageEPNS1_20RenderImageScaleDataENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS
+__ZN7WebCore12RenderWidget11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZNK7WebCore7Element20isEnabledFormControlEv
+__ZNK7WebCore4KURL11isLocalFileEv
+__ZN7WebCore14SecurityOrigin20grantUniversalAccessEv
+__ZN7WebCore13StyledElement11addCSSColorEPNS_15MappedAttributeEiRKNS_6StringE
+__ZN7WebCore10HTMLParser29pCloserStrictCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCoreL16tableConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLTableElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLTableElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore16HTMLTableElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore16HTMLTableElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore16HTMLTableElement11cellBordersEv
+__ZNK7WebCore16HTMLTableElement17endTagRequirementEv
+__ZNK7WebCore16HTMLTableElement11tagPriorityEv
+__ZN7WebCore16HTMLTableElement6attachEv
+__ZNK7WebCore16HTMLTableElement36canHaveAdditionalAttributeStyleDeclsEv
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE14shrinkCapacityEm
+__ZN7WebCore16HTMLTableElement29additionalAttributeStyleDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
+__ZN7WebCore11RenderTableC1EPNS_4NodeE
+__ZN7WebCore11RenderTableC2EPNS_4NodeE
+__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE4fillERKS3_m
+__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE15reserveCapacityEm
+__ZSt4fillIPN7WebCore11RenderTable12ColumnStructES2_EvT_S4_RKT0_
+__ZN7WebCore11RenderTable14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore11RenderTable17updateFirstLetterEv
+__ZN7WebCore15AutoTableLayoutC1EPNS_11RenderTableE
+__ZN7WebCore15AutoTableLayoutC2EPNS_11RenderTableE
+__ZN7WebCore16HTMLTableElement8addChildEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore16HTMLTableElement8checkDTDEPKNS_4NodeE
+__ZNK7WebCore11RenderTable7isTableEv
+__ZN7WebCoreL19tablerowConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore19HTMLTableRowElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19HTMLTableRowElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore19HTMLTableRowElement17endTagRequirementEv
+__ZNK7WebCore19HTMLTableRowElement11tagPriorityEv
+__ZN7WebCoreL14isTableSectionEPKNS_4NodeE
+__ZN7WebCore23HTMLTableSectionElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore23HTMLTableSectionElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore23HTMLTableSectionElement11tagPriorityEv
+__ZNK7WebCore23HTMLTableSectionElement36canHaveAdditionalAttributeStyleDeclsEv
+__ZN7WebCore23HTMLTableSectionElement29additionalAttributeStyleDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
+__ZN7WebCore16HTMLTableElement19addSharedGroupDeclsEbRN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
+__ZNK7WebCore17CSSInheritedValue12cssValueTypeEv
+__ZN7WebCore18RenderTableSectionC1EPNS_4NodeE
+__ZN7WebCore18RenderTableSectionC2EPNS_4NodeE
+__ZN7WebCore11RenderTable8addChildEPNS_12RenderObjectES2_
+__ZNK7WebCore18RenderTableSection14isTableSectionEv
+__ZNK7WebCore18RenderTableSection15virtualChildrenEv
+__ZN7WebCore23HTMLTableSectionElement8addChildEN3WTF10PassRefPtrINS_4NodeEEE
+__ZNK7WebCore23HTMLTableSectionElement17endTagRequirementEv
+__ZN7WebCore23HTMLTableSectionElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore14RenderTableRowC1EPNS_4NodeE
+__ZN7WebCore14RenderTableRowC2EPNS_4NodeE
+__ZN7WebCore14RenderTableRow15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore14RenderTableRow13requiresLayerEv
+__ZN7WebCore18RenderTableSection8addChildEPNS_12RenderObjectES2_
+__ZNK7WebCore14RenderTableRow10isTableRowEv
+__ZN7WebCore18RenderTableSection10ensureRowsEi
+__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE4growEm
+__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE4fillERKS3_m
+__ZSt4fillIPN7WebCore18RenderTableSection10CellStructES2_EvT_S4_RKT0_
+__ZN7WebCore18RenderTableSection15virtualChildrenEv
+__ZNK7WebCore14RenderTableRow15virtualChildrenEv
+__ZN7WebCore19HTMLTableRowElement8addChildEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore19HTMLTableRowElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore10HTMLParser25tableCellCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCoreL20tablecellConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore20HTMLTableCellElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore20HTMLTableCellElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZNK7WebCore20HTMLTableCellElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
 __ZN7WebCore20HTMLTableCellElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZNK7WebCore20HTMLTablePartElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
 __ZN7WebCore20HTMLTablePartElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore13StyledElement14addCSSPropertyEPNS_15MappedAttributeEiRKNS_6StringE
-__ZN7WebCore8parseURLERKNS_6StringE
-__ZN3WTF6VectorItLm2048EE6shrinkEm
-__ZN7WebCore8Document11completeURLERKNS_6StringE
-__ZN7WebCore8Document11completeURLERKNS_16DeprecatedStringE
-__ZN7WebCore4KURLC2ERKS0_RKNS_16DeprecatedStringERKNS_12TextEncodingE
-__ZN7WebCore4KURL4initERKS0_RKNS_16DeprecatedStringERKNS_12TextEncodingE
-__ZNK7WebCore16DeprecatedString8containsEc
-__ZNK7WebCore16DeprecatedString8containsENS_14DeprecatedCharEb
-__ZNK7WebCore4KURL14isHierarchicalEv
-__ZN7WebCore20copyPathRemovingDotsEPcPKcii
 __ZN7WebCore13StyledElement19addCSSImagePropertyEPNS_15MappedAttributeEiRKNS_6StringE
 __ZN7WebCore26CSSMutableStyleDeclaration16setImagePropertyEiRKNS_6StringEb
-__ZN7WebCore13CSSImageValueC2ERKNS_6StringEPNS_9StyleBaseE
 __ZNK7WebCore20HTMLTableCellElement17endTagRequirementEv
 __ZNK7WebCore20HTMLTableCellElement11tagPriorityEv
 __ZNK7WebCore20HTMLTableCellElement36canHaveAdditionalAttributeStyleDeclsEv
 __ZN7WebCore20HTMLTableCellElement29additionalAttributeStyleDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
 __ZN7WebCore16HTMLTableElement18addSharedCellDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
 __ZN7WebCore16HTMLTableElement24addSharedCellBordersDeclERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
+__ZN7WebCore13StyledElement22getMappedAttributeDeclENS_20MappedAttributeEntryERKNS_13QualifiedNameERKNS_12AtomicStringE
+__ZN7WebCore13StyledElement22setMappedAttributeDeclENS_20MappedAttributeEntryERKNS_13QualifiedNameERKNS_12AtomicStringEPNS_29CS
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE15reserveCapacityEm
 __ZN7WebCore16HTMLTableElement24addSharedCellPaddingDeclERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
-__ZN7WebCore9StyleBase11isValueListEv
-__ZN7WebCore16CSSStyleSelector18mapBackgroundImageEPNS_15BackgroundLayerEPNS_8CSSValueE
-__ZN7WebCore13CSSImageValue5imageEPNS_9DocLoaderE
-__ZNK7WebCore17CSSPrimitiveValue14getStringValueEv
-__ZN7WebCore9DocLoader12requestImageERKNS_6StringE
-__ZN7WebCore9DocLoader15requestResourceENS_14CachedResource4TypeERKNS_6StringEPS4_bb
-__ZNK7WebCore11FrameLoader11isReloadingEv
-__ZN7WebCore9DocLoader14checkForReloadERKNS_4KURLE
-__ZN7WebCore5Cache14resourceForURLERKNS_6StringE
-__ZN7WebCore5Cache15requestResourceEPNS_9DocLoaderENS_14CachedResource4TypeERKNS_4KURLEPKNS_6StringEbb
-__ZN7WebCore11FrameLoader21restrictAccessToLocalEv
-__ZN7WebCore11FrameLoader7canLoadERKNS_4KURLEPKNS_8DocumentE
-__ZN7WebCore11CachedImageC2EPNS_9DocLoaderERKNS_6StringEb
-__ZN7WebCore14CachedResourceC2ERKNS_6StringENS0_4TypeEbb
-__ZN7WebCore6Loader4loadEPNS_9DocLoaderEPNS_14CachedResourceEbbb
-__ZN7WebCore7RequestC2EPNS_9DocLoaderEPNS_14CachedResourceEbbb
-__ZN7WebCore14CachedResource10setRequestEPNS_7RequestE
-__ZN7WebCore9DocLoader21incrementRequestCountEv
-__ZN7WebCore6Loader20servePendingRequestsEv
-__ZN7WebCore21DeprecatedPtrListImpl4takeEj
-__ZN7WebCore21DeprecatedPtrListImpl2atEj
-__ZN7WebCore21DeprecatedPtrListImpl6removeEb
-__ZN7WebCore13InlineTextBox15paintDecorationEPNS_15GraphicsContextEiii
-__ZN7WebCore12RenderObject23getTextDecorationColorsEiRNS_5ColorES2_S2_b
-__ZN7WebCore15decorationColorEPNS_11RenderStyleE
-__ZN7WebCore15GraphicsContext18setStrokeThicknessEf
-__ZN7WebCore15GraphicsContext26setPlatformStrokeThicknessEf
-__ZN7WebCore15GraphicsContext15drawLineForTextERKNS_8IntPointEib
-__ZNK7WebCore15GraphicsContext15strokeThicknessEv
-__ZN7WebCore17RenderTextControl5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore11RenderTheme5paintEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZNK7WebCore15GraphicsContext20updatingControlTintsEv
-__ZN7WebCore11RenderTheme16paintDecorationsEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore11RenderTheme15paintBorderOnlyEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14RenderThemeMac14paintTextFieldEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore27LocalCurrentGraphicsContextC2EPNS_15GraphicsContextE
-__ZNK7WebCore11RenderTheme9isEnabledEPKNS_12RenderObjectE
-__ZNK7WebCore11RenderTheme17isReadOnlyControlEPKNS_12RenderObjectE
-__ZN7WebCore27LocalCurrentGraphicsContextD2Ev
-__ZN7WebCore14RenderThemeMac13paintMenuListEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14RenderThemeMac23setPopupButtonCellStateEPKNS_12RenderObjectERKNS_7IntRectE
-__ZNK7WebCore14RenderThemeMac11popupButtonEv
-__ZNK7WebCore14RenderThemeMac16popupButtonSizesEv
-__ZN7WebCore14RenderThemeMac14setControlSizeEP6NSCellPKNS_7IntSizeERS4_
-__ZN7WebCore14RenderThemeMac18updateCheckedStateEP6NSCellPKNS_12RenderObjectE
-__ZNK7WebCore11RenderTheme15isIndeterminateEPKNS_12RenderObjectE
-__ZNK7WebCore11RenderTheme9isCheckedEPKNS_12RenderObjectE
-__ZN7WebCore14RenderThemeMac18updateEnabledStateEP6NSCellPKNS_12RenderObjectE
-__ZN7WebCore14RenderThemeMac18updatePressedStateEP6NSCellPKNS_12RenderObjectE
-__ZN7WebCore14RenderThemeMac18updateFocusedStateEP6NSCellPKNS_12RenderObjectE
-__ZNK7WebCore11RenderTheme9isFocusedEPKNS_12RenderObjectE
-__ZNK7WebCore14RenderThemeMac18popupButtonMarginsEv
-__ZNK7WebCore14RenderThemeMac11inflateRectERKNS_7IntRectERKNS_7IntSizeEPKi
-__ZN7WebCore15GraphicsContext4clipERKNS_7IntRectE
-__ZNK7WebCore14RenderMenuList15controlClipRectEii
-__ZN7WebCore9RenderBox19getOverflowClipRectEii
-__ZNK7WebCore11RenderLayer22verticalScrollbarWidthEv
-__ZNK7WebCore11RenderLayer25horizontalScrollbarHeightEv
-__ZN7WebCore15GraphicsContextD2Ev
-__ZN7WebCore15GraphicsContext29destroyGraphicsContextPrivateEPNS_22GraphicsContextPrivateE
-__ZN7WebCore15BackForwardList8backItemEv
-__ZN7WebCore15BackForwardList11forwardItemEv
-__ZNK7WebCore12RenderObject8isWidgetEv
-__ZN7WebCore8IntPointC1ERK8_NSPoint
-__ZN7WebCore13HitTestResultC2ERKNS_8IntPointE
-__ZN7WebCore11RenderLayer7hitTestERKNS_14HitTestRequestERNS_13HitTestResultE
-__ZN7WebCore8Document12updateLayoutEv
-__ZN7WebCore16enclosingIntRectERKNS_9FloatRectE
-__ZN7WebCore11RenderLayer12hitTestLayerEPS0_RKNS_14HitTestRequestERNS_13HitTestResultERKNS_7IntRectERKNS_8IntPointE
-__ZN7WebCore12RenderObject7hitTestERKNS_14HitTestRequestERNS_13HitTestResultERKNS_8IntPointEiiNS_13HitTestFilterE
-__ZN7WebCore11RenderBlock11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore11RenderBlock24isPointInOverflowControlERNS_13HitTestResultEiiii
-__ZN7WebCore11RenderBlock15hitTestContentsERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore18RenderTableSection11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore14RenderTableRow11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore10RenderFlow12hitTestLinesERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore13RootInlineBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
-__ZN7WebCore13InlineFlowBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
-__ZN7WebCore9InlineBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
-__ZN7WebCore11RenderImage11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore9RenderBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZNK7WebCore12RenderObject9lastChildEv
-__ZN7WebCore12RenderObject19updateHitTestResultERNS_13HitTestResultERKNS_8IntPointE
-__ZNK7WebCore12RenderObject12continuationEv
-__ZN7WebCore13HitTestResult12setInnerNodeEPNS_4NodeE
-__ZN7WebCore13HitTestResult21setInnerNonSharedNodeEPNS_4NodeE
-__ZN7WebCore11RenderImage8imageMapEv
-__ZNK7WebCore8Document11getImageMapERKNS_6StringE
-__ZN7WebCore11RenderLayer22updateHoverActiveStateERKNS_14HitTestRequestERNS_13HitTestResultE
-__ZN7WebCore13HitTestResultC1ERKS0_
-__ZN7WebCore13HitTestResultD1Ev
-__ZN7WebCore13HitTestResult22setToNonShadowAncestorEv
-__ZN7WebCore4Node18shadowAncestorNodeEv
-__ZN7WebCore12EventHandler10mouseMovedEP7NSEvent
-__ZN7WebCore12currentEventEv
-__ZN7WebCore18PlatformMouseEventC1EP7NSEvent
-__ZN7WebCore13pointForEventEP7NSEvent
-__ZN7WebCore19globalPointForEventEP7NSEvent
-__ZN7WebCore11globalPointERK8_NSPointP8NSWindow
-__ZN7WebCore15screenForWindowEP8NSWindow
-__ZN7WebCore15flipScreenPointERK8_NSPointP8NSScreen
-__ZN7WebCore12EventHandler10mouseMovedERKNS_18PlatformMouseEventE
-__ZN7WebCore12EventHandler20handleMouseMoveEventERKNS_18PlatformMouseEventEPNS_13HitTestResultE
-__ZN7WebCore12EventHandler17prepareMouseEventERKNS_14HitTestRequestERKNS_18PlatformMouseEventE
-__ZNK7WebCore10ScrollView16windowToContentsERKNS_8IntPointE
-__ZN7WebCore8Document17prepareMouseEventERKNS_14HitTestRequestERKNS_8IntPointERKNS_18PlatformMouseEventE
-__ZN7WebCore8Document12setHoverNodeEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore13ContainerNode9setActiveEbb
-__ZN7WebCore13ContainerNode10setHoveredEb
-__ZNK7WebCore12RenderObject13hoverAncestorEv
-__ZN7WebCore28MouseEventWithHitTestResultsC2ERKNS_18PlatformMouseEventERKNS_13HitTestResultE
-__ZN7WebCore13HitTestResultaSERKS0_
-__ZN7WebCore10ScrollView19scrollbarUnderMouseERKNS_18PlatformMouseEventE
-__ZNK7WebCore28MouseEventWithHitTestResults9scrollbarEv
-__ZNK7WebCore28MouseEventWithHitTestResults10targetNodeEv
-__ZN7WebCore21subframeForTargetNodeEPNS_4NodeE
-__ZN7WebCore12EventHandler12selectCursorERKNS_28MouseEventWithHitTestResultsEPNS_17PlatformScrollbarE
-__ZNK7WebCore28MouseEventWithHitTestResults10isOverLinkEv
-__ZN7WebCore11RenderLayer22isPointInResizeControlERKNS_8IntPointE
-__ZN7WebCore13pointerCursorEv
-__ZN7WebCore6CursorC2EP8NSCursor
-__ZN7WebCore6CursorC2ERKS0_
-__ZN7WebCore6Widget9setCursorERKNS_6CursorE
-__ZN7WebCore6CursorD2Ev
-__ZN7WebCore12EventHandler18dispatchMouseEventERKNS_12AtomicStringEPNS_4NodeEbiRKNS_18PlatformMouseEventEb
-__ZN7WebCore12EventHandler26updateMouseEventTargetNodeEPNS_4NodeERKNS_18PlatformMouseEventEb
-__ZN7WebCore15EventTargetNode18dispatchMouseEventERKNS_18PlatformMouseEventERKNS_12AtomicStringEiPNS_4NodeE
-__ZN7WebCore15EventTargetNode18dispatchMouseEventERKNS_12AtomicStringEiiiiiibbbbbPNS_4NodeEN3WTF10PassRefPtrINS_5EventEEE
-__ZNK7WebCore8Document11defaultViewEv
-__ZNK7WebCore5Frame9domWindowEv
-__ZN7WebCore9DOMWindowC2EPNS_5FrameE
-__ZN7WebCore10MouseEventC1ERKNS_12AtomicStringEbbPNS_9DOMWindowEiiiiibbbbtPNS_15EventTargetNodeEPNS_9ClipboardEb
-__ZN7WebCore17MouseRelatedEventC2ERKNS_12AtomicStringEbbPNS_9DOMWindowEiiiiibbbbb
-__ZN7WebCore9contentsXEPNS_9DOMWindowE
-__ZNK7WebCore10ScrollView9contentsXEv
-__ZN7WebCore9contentsYEPNS_9DOMWindowE
-__ZNK7WebCore10ScrollView9contentsYEv
-__ZN7WebCore17MouseRelatedEvent15initCoordinatesEv
-__ZN7WebCore5Event18setUnderlyingEventEN3WTF10PassRefPtrIS0_EE
-__ZN7WebCore17MouseRelatedEvent14receivedTargetEv
-__ZN7WebCore12EventHandler23handleMouseDraggedEventERKNS_28MouseEventWithHitTestResultsE
-__ZN7WebCore12EventHandler10handleDragERKNS_28MouseEventWithHitTestResultsE
-__ZN7WebCore6Chrome23mouseDidMoveOverElementERKNS_13HitTestResultEj
-__ZNK7WebCore13HitTestResult15absoluteLinkURLEv
-__ZN7WebCore6Chrome10setToolTipERKNS_13HitTestResultE
-__ZNK7WebCore13HitTestResult15spellingToolTipEv
-__ZN7WebCore8Document21markerContainingPointERKNS_8IntPointENS_14DocumentMarker10MarkerTypeE
-__ZNK7WebCore13HitTestResult5titleEv
-__ZN7WebCore16HTMLInputElement6detachEv
-__ZN7WebCore21DeprecatedPtrListImpl9removeRefEPKvb
-__ZNK7WebCore11ImageSource11initializedEv
-__ZN7WebCore15GraphicsContext19roundToDevicePixelsERKNS_9FloatRectE
-__ZNK7WebCore11BitmapImage21mayFillWithSolidColorEv
-__ZNK7WebCore7IntSizecv6CGSizeEv
-__ZN7WebCore15GraphicsContext4saveEv
-__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE15reserveCapacityEm
-__ZN7WebCore15GraphicsContext17savePlatformStateEv
-__ZN7WebCore15GraphicsContext21setCompositeOperationENS_17CompositeOperatorE
-__ZN7WebCore15GraphicsContext7restoreEv
-__ZN3WTF6VectorIN7WebCore20GraphicsContextStateELm0EE6shrinkEm
-__ZN7WebCore15GraphicsContext20restorePlatformStateEv
-__ZN7WebCore11BitmapImage14startAnimationEv
-__ZN7WebCore16DeprecatedString7replaceENS_14DeprecatedCharES1_
-__ZN7WebCore15GraphicsContext7setFontERKNS_4FontE
-__ZNK7WebCore13RootInlineBox16paintEllipsisBoxERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore13InlineTextBox5paintERNS_12RenderObject9PaintInfoEii
-__ZNK7WebCore13RootInlineBox5blockEv
-__ZN7WebCore15GraphicsContext8drawTextERKNS_7TextRunERKNS_8IntPointEii
-__ZNK7WebCore15GraphicsContext4fontEv
-__ZNK7WebCore4Font8drawTextEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
-__ZNK7WebCore4Font14drawSimpleTextEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
-__ZNK7WebCore4Font15drawGlyphBufferEPNS_15GraphicsContextERKNS_11GlyphBufferERKNS_7TextRunERKNS_10FloatPointE
-__ZNK7WebCore4Font10drawGlyphsEPNS_15GraphicsContextEPKNS_14SimpleFontDataERKNS_11GlyphBufferEiiRKNS_10FloatPointE
-_WebCoreShouldUseFontSmoothing
-__ZN3WTF6VectorI6CGSizeLm2048EE6shrinkEm
-__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm2048EE6shrinkEm
-__ZN7WebCore13InlineTextBox14selectionStateEv
-__ZN7WebCore13InlineTextBox20paintDocumentMarkersEPNS_15GraphicsContextEiiPNS_11RenderStyleEPKNS_4FontEb
-__ZN7WebCore8Document14markersForNodeEPNS_4NodeE
-__ZN3WTF7HashMapINS_6RefPtrIN7WebCore4NodeEEEPSt4pairINS_6VectorINS2_14DocumentMarkerELm0EEENS6_INS2_7IntRectELm0EEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENSF_ISC_EEE3setEPS3_RKSC_
-__ZN7WebCore21updateGraphicsContextEPNS_15GraphicsContextERKNS_5ColorES4_f
-__ZN7WebCore15GraphicsContext15textDrawingModeEv
-__ZNK7WebCore13InlineTextBox7textPosEv
-__ZN7WebCore10RenderText7destroyEv
-__ZN7WebCore10RenderText15deleteTextBoxesEv
-__ZN7WebCore10RenderText27absoluteClippedOverflowRectEv
-__ZNK7WebCore12RenderObject7isMediaEv
-__ZNK7WebCore12RenderObject14isSVGContainerEv
-__ZN7WebCore9RenderBox26computeAbsoluteRepaintRectERNS_7IntRectEb
-__ZNK7WebCore11RenderBlock11isBlockFlowEv
-__ZNK7WebCore10RenderFlow10hasColumnsEv
-__ZN7WebCore15RenderTableCell26computeAbsoluteRepaintRectERNS_7IntRectEb
-__ZNK7WebCore9RenderBox4yPosEv
-__ZNK7WebCore9RenderBox4xPosEv
-__ZNK7WebCore12RenderObject11isBlockFlowEv
-__ZN7WebCore12RenderObject20deleteLineBoxWrapperEv
-__ZNK7WebCore12RenderObject17isSelectionBorderEv
-__ZNK7WebCore10RenderText14selectionStateEv
-__ZN7WebCore8RenderBRD1Ev
-__ZN7WebCore9FrameView16restoreScrollbarEv
-__ZN7WebCore11FrameLoader10gotoAnchorEv
-__ZNK7WebCore4KURL6hasRefEv
-__ZN7WebCore14ResourceLoader12resourceDataEv
-__ZN7WebCore14ResourceHandle12bufferedDataEv
-__ZN7WebCore12SharedBuffer10wrapNSDataEP6NSData
-__ZN7WebCore12SharedBufferC2EP6NSData
-__ZN7WebCore14DocumentLoader13updateLoadingEv
-__ZNK7WebCore11FrameLoader9isLoadingEv
-__ZNK7WebCore14DocumentLoader21isLoadingSubresourcesEv
-__ZN7WebCore14ResourceLoader16didFinishLoadingEv
-__ZN7WebCore14ResourceLoader23didFinishLoadingOnePartEv
-__ZN7WebCore11FrameLoader13didFinishLoadEPNS_14ResourceLoaderE
-__ZN7WebCore15ProgressTracker16completeProgressEm
-__ZN3WTF9HashTableImSt4pairImiENS_18PairFirstExtractorIS2_EENS_7IntHashImEENS_14PairHashTraitsINS_10HashTraitsImEENS8_IiEEEES9_E4findImNS_22IdentityHashTranslatorImS2_S6_EEEENS_17HashTableIteratorImS2_S4_S6_SB_S9_EERKT_
-__ZN7WebCore11FrameLoader24dispatchDidFinishLoadingEPNS_14DocumentLoaderEm
-__ZN7WebCore19InspectorController16didFinishLoadingEPNS_14DocumentLoaderEm
-__ZN7WebCore14ResourceLoader16releaseResourcesEv
-__ZN7WebCore14ResourceHandle9setClientEPNS_20ResourceHandleClientE
-__ZN7WebCore14ResourceHandleD2Ev
-__ZN7WebCore14ResourceHandle15releaseDelegateEv
--[WebCoreResourceHandleAsDelegate detachHandle]
--[WebCoreResourceHandleAsDelegate dealloc]
-__ZN7WebCore22ResourceHandleInternalD2Ev
+__ZN7WebCore15RenderTableCellC1EPNS_4NodeE
+__ZN7WebCore15RenderTableCellC2EPNS_4NodeE
+__ZN7WebCore15RenderTableCell17updateFromElementEv
+__ZN7WebCore15RenderTableCell15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore15RenderTableCell14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore15RenderTableCell13requiresLayerEv
+__ZN7WebCore14RenderTableRow8addChildEPNS_12RenderObjectES2_
+__ZNK7WebCore15RenderTableCell11isTableCellEv
+__ZN7WebCore18RenderTableSection7addCellEPNS_15RenderTableCellEPNS_14RenderTableRowE
+__ZN7WebCore14RenderTableRow15virtualChildrenEv
+__ZN7WebCore11HTMLElement16addHTMLAlignmentEPNS_15MappedAttributeE
+__ZN7WebCore11HTMLElement31addHTMLAlignmentToStyledElementEPNS_13StyledElementEPNS_15MappedAttributeE
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm0EE6shrinkEm
+__ZN7WebCore11RenderTable12appendColumnEi
+__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE4growEm
+__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE14expandCapacityEm
+__ZN7WebCore18RenderTableSection12appendColumnEi
+__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIiLm0EE4growEm
+__ZNK7WebCore26CSSMutableStyleDeclaration19getPropertyCSSValueEi
+__ZN7WebCore10HTMLParser18isResidualStyleTagERKNS_12AtomicStringE
+__ZThn112_NK7WebCore17HTMLScriptElement22languageAttributeValueEv
+__ZNK7WebCore17HTMLScriptElement22languageAttributeValueEv
+__ZN7WebCoreL29isSupportedJavaScriptLanguageERKNS_6StringE
+__ZN7WebCore15jsDocumentTitleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15reportExceptionEPN3JSC9ExecStateENS0_7JSValueE
+__ZThn88_N7WebCore8Document15reportExceptionERKNS_6StringEiS3_
+__ZN7WebCore8Document15reportExceptionERKNS_6StringEiS3_
+__ZNK7WebCore9DOMWindow7consoleEv
+__ZN7WebCore7ConsoleC1EPNS_5FrameE
+__ZN7WebCore7ConsoleC2EPNS_5FrameE
+__ZN7WebCore7Console10addMessageENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS5_
+__ZN7WebCore7Console21shouldPrintExceptionsEv
+__ZN7WebCoreL15fontConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore15HTMLFontElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLFontElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore15HTMLFontElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore15HTMLFontElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15HTMLFontElement26cssValueFromFontSizeNumberERKNS_6StringERi
+__ZN7WebCore15FontFamilyValue20appendSpaceSeparatedEPKtj
+__ZN7WebCore6String6appendEc
+__ZN7WebCore6String6appendEPKtj
+__ZNK7WebCore15HTMLFontElement17endTagRequirementEv
+__ZNK7WebCore15HTMLFontElement11tagPriorityEv
+__ZNK7WebCore6String8foldCaseEv
+__ZN7WebCore10StringImpl8foldCaseEv
+__ZN7WebCore10HTMLParser25checkIfHasPElementInScopeEv
+__ZN7WebCore6String6numberEt
+__ZNK7WebCore16HTMLInputElement7altTextEv
+__ZN7WebCore11RenderImage14resetAnimationEv
+__ZNK7WebCore15RenderTableCell10borderLeftEv
+__ZNK7WebCore15RenderTableCell11borderRightEv
+__ZN7WebCore15RenderTableCell21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZNK7WebCore15RenderTableCell9borderTopEv
+__ZNK7WebCore15RenderTableCell12borderBottomEv
 -[WebCoreResourceHandleAsDelegate connection:didFailWithError:]
 __ZN7WebCore14ResourceLoader7didFailEPNS_14ResourceHandleERKNS_13ResourceErrorE
 __ZN7WebCore17SubresourceLoader7didFailERKNS_13ResourceErrorE
-__ZN7WebCore6Loader7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
-__ZN7WebCore6Loader7didFailEPNS_17SubresourceLoaderEb
-__ZN7WebCore9DocLoader17setLoadInProgressEb
+__ZN7WebCore6Loader4Host7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
+__ZN7WebCore6Loader4Host7didFailEPNS_17SubresourceLoaderEb
 __ZN7WebCore11CachedImage5errorEv
 __ZN7WebCore11CachedImage5clearEv
 __ZN7WebCore11CachedImage18destroyDecodedDataEv
-__ZN7WebCore14CachedResource14setEncodedSizeEj
-__ZN7WebCore11CachedImage15notifyObserversEv
-__ZN7WebCore26CachedResourceClientWalkerC2ERKN3WTF14HashCountedSetIPNS_20CachedResourceClientENS1_7PtrHashIS4_EENS1_10HashTraitsIS4_EEEE
-__ZN7WebCore26CachedResourceClientWalker4nextEv
-__ZNK3WTF9HashTableIiSt4pairIiiENS_18PairFirstExtractorIS2_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEES9_EES9_E8containsIiNS_22IdentityHashTranslatorIiS2_S6_EEEEbRKT_
-__ZN7WebCore20CachedResourceClient12imageChangedEPNS_11CachedImageE
-__ZN7WebCore11RenderImage12imageChangedEPNS_11CachedImageE
 __ZN7WebCore11RenderImage22setImageSizeForAltTextEPNS_11CachedImageE
-__ZNK7WebCore11CachedImage5imageEv
-__ZN7WebCore11brokenImageEv
+__ZN7WebCoreL11brokenImageEv
 __ZN7WebCore5Image20loadPlatformResourceEPKc
+__ZN7WebCore12SharedBuffer10wrapNSDataEP6NSData
+__ZN7WebCore12SharedBufferC1EPK8__CFData
+__ZN7WebCore12SharedBufferC2EPK8__CFData
 __ZNK7WebCore12SharedBuffer16platformDataSizeEv
+__ZN7WebCore5Cache5evictEPNS_14CachedResourceE
+__ZN7WebCore14ResourceLoader7didFailERKNS_13ResourceErrorE
+__ZN7WebCore11FrameLoader13didFailToLoadEPNS_14ResourceLoaderERKNS_13ResourceErrorE
+__ZN7WebCore17ResourceErrorBaseD2Ev
+__ZNK7WebCore11RenderTable12avoidsFloatsEv
+__ZN7WebCore11RenderTable6layoutEv
+__ZN7WebCore11RenderTable9calcWidthEv
+__ZN7WebCore11RenderTable14calcPrefWidthsEv
+__ZN7WebCore11RenderTable23recalcHorizontalBordersEv
+__ZNK7WebCore11RenderTable14calcBorderLeftEv
+__ZNK7WebCore11RenderTable15calcBorderRightEv
+__ZN7WebCore15AutoTableLayout14calcPrefWidthsERiS1_
+__ZN7WebCore15AutoTableLayout10fullRecalcEv
+__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE4fillERKS3_m
+__ZSt4fillIPN7WebCore15AutoTableLayout6LayoutES2_EvT_S4_RKT0_
+__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE4fillERKS3_m
+__ZSt4fillIPPN7WebCore15RenderTableCellES2_EvT_S4_RKT0_
+__ZN7WebCore15AutoTableLayout12recalcColumnEi
+__ZN7WebCore15RenderTableCell14calcPrefWidthsEv
+__ZNK7WebCore11RenderTable10borderLeftEv
+__ZNK7WebCore11RenderTable11borderRightEv
+__ZNK7WebCore15RenderTableCell15styleOrColWidthEv
+__ZN7WebCore15AutoTableLayout18calcEffectiveWidthEv
+__ZN7WebCore15AutoTableLayout6layoutEv
+__ZN7WebCore11RenderTable13setCellWidthsEv
+__ZN7WebCore18RenderTableSection13setCellWidthsEv
+__ZN7WebCore15RenderTableCell11updateWidthEi
+__ZN7WebCore18RenderTableSection6layoutEv
+__ZN7WebCore14RenderTableRow6layoutEv
+__ZN7WebCore15RenderTableCell6layoutEv
+__ZN7WebCore15RenderTableCell9calcWidthEv
+__ZNK7WebCore15RenderTableCell10paddingTopEb
+__ZNK7WebCore15RenderTableCell13paddingBottomEb
+__ZNK7WebCore15RenderTableCell16baselinePositionEbb
+__ZN7WebCore18RenderTableSection13calcRowHeightEv
+__ZNK7WebCore11RenderTable9borderTopEv
+__ZNK7WebCore11RenderTable12borderBottomEv
+__ZN7WebCore18RenderTableSection10layoutRowsEi
+__ZNK7WebCore11RenderBlock24percentHeightDescendantsEv
+__ZNK7WebCore18RenderTableSection12overflowLeftEb
+__ZNK7WebCore18RenderTableSection13overflowWidthEb
+__ZNK7WebCore18RenderTableSection11overflowTopEb
+__ZNK7WebCore18RenderTableSection14overflowHeightEb
+__ZNK7WebCore11RenderTable12sectionBelowEPKNS_18RenderTableSectionEb
+__ZNK7WebCore11RenderTable10colElementEiPbS1_
+__ZNK7WebCore27RenderTextControlSingleLine21preferredContentWidthEf
+__ZThn128_NK7WebCore16HTMLInputElement4sizeEv
+__ZNK7WebCore16HTMLInputElement4sizeEv
+__ZN7WebCore15AutoTableLayout14insertSpanCellEPNS_15RenderTableCellE
+__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE4growEm
+__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE15reserveCapacityEm
+__ZNK7WebCore18RenderTableSection17rightmostPositionEbb
+__ZNK7WebCore18RenderTableSection14lowestPositionEbb
+__ZNK7WebCore15RenderTableCell19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore11RenderTable5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore11RenderTable11paintObjectERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore18RenderTableSection5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore18RenderTableSection11paintObjectERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore15RenderTableCell26paintBackgroundsBehindCellERNS_12RenderObject9PaintInfoEiiPS1_
+__ZN7WebCore15RenderTableCell5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore15RenderTableCell19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore13InlineTextBox15paintDecorationEPNS_15GraphicsContextEiiiPNS_10ShadowDataE
+__ZN7WebCore12RenderObject23getTextDecorationColorsEiRNS_5ColorES2_S2_b
+__ZN7WebCoreL15decorationColorEPNS_11RenderStyleE
+__ZNK7WebCore11RenderTable10cellBeforeEPKNS_15RenderTableCellE
+__ZNK7WebCore11RenderTable9cellAboveEPKNS_15RenderTableCellE
+__ZNK7WebCore11RenderTable12sectionAboveEPKNS_18RenderTableSectionEb
+__ZN7WebCore11HistoryItem17setAlternateTitleERKNS_6StringE
+__ZN7WebCore11RenderTable11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore18RenderTableSection11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore14RenderTableRow11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZNK7WebCore15RenderTableCell23mapAbsoluteToLocalPointEbbRNS_14TransformStateE
+__ZN7WebCore15BackForwardList16forwardListCountEv
+__ZN7WebCore15BackForwardList13backListCountEv
+__ZN7WebCore15BackForwardList11itemAtIndexEi
+__ZN7WebCore9DOMWindow36dispatchAllPendingBeforeUnloadEventsEv
+__ZN7WebCore12IconDatabase5closeEv
+__ZN7WebCore12IconDatabase17cleanupSyncThreadEv
+__ZN7WebCore12IconDatabase27deleteAllPreparedStatementsEv
+__ZN7WebCore9DOMWindow30dispatchAllPendingUnloadEventsEv
+__ZN7WebCore4Page23clearUndoRedoOperationsEv
+__ZN7WebCore9PageGroup17closeLocalStorageEv
+__ZN7WebCore9PageGroup12localStorageEv
+__ZN7WebCore12LocalStorage5closeEv
+__ZN7WebCore18LocalStorageThread9terminateEv
+__ZN7WebCore16LocalStorageTaskC1ENS0_4TypeEN3WTF10PassRefPtrINS_18LocalStorageThreadEEE
+__ZN7WebCore16LocalStorageTaskC2ENS0_4TypeEN3WTF10PassRefPtrINS_18LocalStorageThreadEEE
+__ZN7WebCore18LocalStorageThread16performTerminateEv
+__ZN3WTF16ThreadSafeSharedIN7WebCore18LocalStorageThreadEE5derefEv
+__ZNK7WebCore10MouseEvent12isMouseEventEv
+__ZN7WebCore5Frame34setMarkedTextMatchesAreHighlightedEb
+__ZN7WebCore5Frame21markAllMatchesForTextERKNS_6StringEbj
+__ZN7WebCore15rangeOfContentsEPNS_4NodeE
+__ZN7WebCore5Range18selectNodeContentsEPNS_4NodeERi
+__ZN7WebCore13findPlainTextEPKNS_5RangeERKNS_6StringEbb
+__ZN7WebCore17CharacterIteratorC1EPKNS_5RangeEbb
+__ZN7WebCore17CharacterIteratorC2EPKNS_5RangeEbb
+__ZN7WebCoreL8searcherEv
+__ZN7WebCore17CharacterIterator7advanceEi
+__ZN7WebCoreL17characterSubrangeERNS_17CharacterIteratorEii
+__ZNK7WebCore17CharacterIterator5rangeEv
+__ZNK7WebCore12TextIterator5rangeEv
+__ZNK7WebCore5Range9collapsedERi
+__ZN7WebCore18endVisiblePositionEPKNS_5RangeENS_9EAffinityE
+__ZNK7WebCore5Range9endOffsetERi
+__ZNK7WebCore5Range12endContainerERi
+__ZNK7WebCore10RenderText10nextOffsetEi
+__ZN7WebCore20startVisiblePositionEPKNS_5RangeENS_9EAffinityE
+__ZNK7WebCore5Range11startOffsetERi
+__ZNK7WebCore6Editor17insideVisibleAreaEPNS_5RangeE
+__ZNK7WebCore5Frame21excludeFromTextSearchEv
+__ZNK7WebCore9FrameTree3topEb
+__ZN7WebCore8Document9addMarkerEPNS_5RangeENS_14DocumentMarker10MarkerTypeENS_6StringE
+__ZN7WebCore8Document9addMarkerEPNS_4NodeENS_14DocumentMarkerE
+__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE15reserveCapacityEm
+__ZN7WebCoreL24placeholderRectForMarkerEv
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore4NodeEEEPSt4pairINS_6VectorINS2_14DocumentMarkerELm0EEENS6_INS2_7IntRectELm0EEEENS_7PtrHas
+__ZNK7WebCore5Range18shadowTreeRootNodeEv
+__ZN7WebCoreL19collapsedToBoundaryEPKNS_5RangeEb
+__ZN7WebCore4Node14isInShadowTreeEv
+__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EEC1ERKS3_
+__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EEC2ERKS3_
+__ZN7WebCore13InlineTextBox20paintTextMatchMarkerEPNS_15GraphicsContextEiiNS_14DocumentMarkerEPNS_11RenderStyleERKNS_4FontE
+__ZN7WebCore13InlineTextBox12selectionTopEv
+__ZN7WebCore13InlineTextBox15selectionHeightEv
+__ZNK7WebCore4Font20selectionRectForTextERKNS_7TextRunERKNS_8IntPointEiii
+__ZNK7WebCore4Font26selectionRectForSimpleTextERKNS_7TextRunERKNS_8IntPointEiii
+__ZN7WebCore8Document24setRenderedRectForMarkerEPNS_4NodeENS_14DocumentMarkerERKNS_7IntRectE
+__ZNK7WebCore5Frame31markedTextMatchesAreHighlightedEv
+__ZN3WTF6VectorIN7WebCore14DocumentMarkerELm0EE6shrinkEm
+__ZNK7WebCore9FrameTree20traverseNextWithWrapEb
+__ZNK7WebCore11FrameLoader14initialRequestEv
+__ZN7WebCore11FrameLoader50didReceiveServerRedirectForProvisionalLoadForFrameEv
+__ZN7WebCore11FrameLoader21checkNavigationPolicyERKNS_15ResourceRequestEPFvPvS3_N3WTF10PassRefPtrINS_9FormStateEEEbES4_
+__ZN7WebCore18MainResourceLoader33callContinueAfterNavigationPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEE
+__ZN7WebCore18MainResourceLoader29continueAfterNavigationPolicyERKNS_15ResourceRequestEb
+__ZN7WebCore15BackForwardList8capacityEv
+__ZN7WebCore10CachedPage6createEPNS_4PageE
+__ZN7WebCore10CachedPageC1EPNS_4PageE
+__ZN7WebCore10CachedPageC2EPNS_4PageE
+__ZN7WebCore11CachedFrameC1EPNS_5FrameE
+__ZN7WebCore11CachedFrameC2EPNS_5FrameE
+__ZN7WebCore22ScriptExecutionContext23suspendActiveDOMObjectsEv
+__ZN7WebCore21ScriptCachedFrameDataC1EPNS_5FrameE
+__ZN7WebCore21ScriptCachedFrameDataC2EPNS_5FrameE
+__ZN7WebCore5Frame11clearTimersEv
+__ZN7WebCore5Frame11clearTimersEPNS_9FrameViewEPNS_8DocumentE
+__ZN7WebCore19AnimationController17suspendAnimationsEPNS_8DocumentE
+__ZN7WebCore26AnimationControllerPrivate17suspendAnimationsEPNS_8DocumentE
+__ZN7WebCore8Document14setInPageCacheEb
+__ZN7WebCore11CachedFrame26setCachedFramePlatformDataEPNS_23CachedFramePlatformDataE
+__ZN7WebCore9PageCache3addEN3WTF10PassRefPtrINS_11HistoryItemEEENS2_INS_10CachedPageEEE
+__ZN7WebCore9PageCache12addToLRUListEPNS_11HistoryItemE
+__ZNK7WebCore16HTMLInputElement20saveFormControlStateERNS_6StringE
+__ZNK7WebCore16HTMLInputElement15formControlTypeEv
+__ZNK7WebCore17HTMLSelectElement20saveFormControlStateERNS_6StringE
+__ZN3WTF6VectorIcLm1024EE6shrinkEm
+__ZNK7WebCore17HTMLSelectElement15formControlTypeEv
+__ZN7WebCore7Console15disconnectFrameEv
+__ZThn112_NK7WebCore17HTMLScriptElement17forAttributeValueEv
+__ZNK7WebCore17HTMLScriptElement17forAttributeValueEv
+__ZN7WebCoreL19textareaConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore19HTMLTextAreaElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore19HTMLTextAreaElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZNK7WebCore11HTMLElement16findFormAncestorEv
+__ZN7WebCore19HTMLTextAreaElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore22HTMLFormControlElement11tagPriorityEv
+__ZNK7WebCore14RenderThemeMac19adjustTextAreaStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore11RenderBlock23removePositionedObjectsEPS0_
+__ZN7WebCore15HTMLFormElement18registerImgElementEPNS_16HTMLImageElementE
+__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE15reserveCapacityEm
+__ZN7WebCore12InputElement23parseMaxLengthAttributeERNS_16InputElementDataEPNS_15MappedAttributeE
+__ZN7WebCore13textBreakNextEPNS_17TextBreakIteratorE
+__ZN7WebCore5TimerINS_8DocumentEE5firedEv
+__ZN7WebCore8Document21styleRecalcTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCoreL23tablecaptionConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore23HTMLTableCaptionElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore23HTMLTableCaptionElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore23HTMLTableCaptionElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore23HTMLTableCaptionElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore23HTMLTableCaptionElement17endTagRequirementEv
+__ZNK7WebCore23HTMLTableCaptionElement11tagPriorityEv
+__ZN7WebCoreL30createHTMLScriptElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLScriptElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLScriptElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLScriptElementEEE
+__ZN7WebCore19JSHTMLScriptElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLScriptElementEEE
+__ZN7WebCore19JSHTMLScriptElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25setJSHTMLScriptElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLScriptElement6setSrcERKNS_6StringE
+__ZNK7WebCore19JSHTMLScriptElement9classInfoEv
+__ZN7WebCore17ScriptElementData13requestScriptERKNS_6StringE
+__ZN7WebCore12CachedScript11setEncodingERKNS_6StringE
+__ZN7WebCore17ScriptElementData14notifyFinishedEPNS_14CachedResourceE
+__ZN7WebCore8Document17executeScriptSoonEPNS_17ScriptElementDataENS_20CachedResourceHandleINS_12CachedScriptEEE
+__ZN3WTF6VectorISt4pairIPN7WebCore17ScriptElementDataENS2_20CachedResourceHandleINS2_12CachedScriptEEEELm0EE14expandCapacityEmP
+__ZN3WTF6VectorISt4pairIPN7WebCore17ScriptElementDataENS2_20CachedResourceHandleINS2_12CachedScriptEEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIPN7WebCore17ScriptElementDataENS2_20CachedResourceHandleINS2_12CachedScriptEEEELm0EE15reserveCapacityEm
+__ZN7WebCore8Document27executeScriptSoonTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore17ScriptElementData7executeEPNS_12CachedScriptE
+__ZN7WebCore17ScriptElementData14evaluateScriptERKNS_16ScriptSourceCodeE
+__ZN7WebCore17jsHTMLDocumentAllEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14JSHTMLDocument3allEPN3JSC9ExecStateE
+__ZN7WebCore8Document3allEv
+__ZNK7WebCore19JSHTMLAllCollection9toBooleanEPN3JSC9ExecStateE
+__ZN7WebCoreL32createHTMLTextAreaElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore21JSHTMLTextAreaElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLTextAreaElementEEE
+__ZN7WebCore21JSHTMLTextAreaElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLTextAreaElementEEE
+__ZN7WebCoreL29createHTMLStyleElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLStyleElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLStyleElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLStyleElementEEE
+__ZN7WebCore18JSHTMLStyleElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLStyleElementEEE
+__ZNK7WebCore18JSHTMLStyleElement9classInfoEv
+__ZN7WebCore12StyleElement20insertedIntoDocumentEPNS_8DocumentEPNS_7ElementE
+__ZN7WebCore18JSHTMLStyleElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23jsHTMLStyleElementSheetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn112_N7WebCore17HTMLScriptElement17dispatchLoadEventEv
+__ZN7WebCore17HTMLScriptElement17dispatchLoadEventEv
+__ZN3WTF6VectorISt4pairIPN7WebCore17ScriptElementDataENS2_20CachedResourceHandleINS2_12CachedScriptEEEELm0EE6shrinkEm
+__ZN7WebCore21JSHTMLTextAreaElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26jsHTMLTextAreaElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTextAreaElement5valueEv
+__ZNK7WebCore19HTMLTextAreaElement11updateValueEv
+__ZN7WebCore21JSHTMLTextAreaElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore29setJSHTMLTextAreaElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTextAreaElement8setValueERKNS_6StringE
+__ZN7WebCore16setJSNodeOnerrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node10setOnerrorEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZNK7WebCore15RenderTableCell14borderHalfLeftEb
+__ZNK7WebCore15RenderTableCell19collapsedLeftBorderEb
+__ZN7WebCoreL14compareBordersERKNS_20CollapsedBorderValueES2_
+__ZNK7WebCore15RenderTableCell15borderHalfRightEb
+__ZNK7WebCore15RenderTableCell20collapsedRightBorderEb
+__ZNK7WebCore11RenderTable9cellAfterEPKNS_15RenderTableCellE
+__ZNK7WebCore15RenderTableCell13borderHalfTopEb
+__ZNK7WebCore15RenderTableCell18collapsedTopBorderEv
+__ZNK7WebCore15RenderTableCell16borderHalfBottomEb
+__ZNK7WebCore15RenderTableCell21collapsedBottomBorderEv
+__ZNK7WebCore11RenderTable9cellBelowEPKNS_15RenderTableCellE
+__ZN7WebCore18RenderTableSection17recalcOuterBorderEv
+__ZNK7WebCore18RenderTableSection18calcOuterBorderTopEv
+__ZNK7WebCore18RenderTableSection21calcOuterBorderBottomEv
+__ZNK7WebCore18RenderTableSection19calcOuterBorderLeftEb
+__ZNK7WebCore18RenderTableSection20calcOuterBorderRightEb
+__ZNK7WebCore11RenderTable16outerBorderRightEv
+__ZNK7WebCore11RenderTable15outerBorderLeftEv
+__ZNK7WebCore11RenderTable14outerBorderTopEv
+__ZNK7WebCore11RenderTable17outerBorderBottomEv
+__ZN3WTF6VectorISt4pairIPKN7WebCore8FontDataEbELm1EE14expandCapacityEmPKS6_
+__ZN3WTF6VectorISt4pairIPKN7WebCore8FontDataEbELm1EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIPKN7WebCore8FontDataEbELm1EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE15reserveCapacityEm
+__ZNK7WebCore15RenderTableCell19collectBorderStylesERN3WTF6VectorINS_20CollapsedBorderValueELm100EEE
+__ZN7WebCoreL14addBorderStyleERN3WTF6VectorINS_20CollapsedBorderValueELm100EEES2_
+__ZN7WebCore15RenderTableCell16sortBorderStylesERN3WTF6VectorINS_20CollapsedBorderValueELm100EEE
+__ZN7WebCore15RenderTableCell20paintCollapsedBorderEPNS_15GraphicsContextEiiii
+__ZN7WebCoreL20collapsedBorderStyleENS_12EBorderStyleE
+__ZN3WTF6VectorIN7WebCore20CollapsedBorderValueELm100EE6shrinkEm
+__ZN7WebCore12JSStyleSheet4markEv
+__ZN7WebCore18JSImageConstructor4markEv
+__ZN7WebCore19JSHTMLScriptElementD1Ev
+__ZN7WebCore17JSHTMLHeadElementD1Ev
+__ZN7WebCore11BitmapImage18destroyDecodedDataEb
+__ZN7WebCore11ImageSource5clearEbmPNS_12SharedBufferEb
+__ZN7WebCore11BitmapImageD0Ev
+__ZN7WebCore11ImageSourceD1Ev
+__ZN7WebCore11ImageSourceD2Ev
+__ZN7WebCoreL27compareBorderStylesForQSortEPKvS1_
+__ZNK7WebCore19JSLazyEventListener10jsFunctionEv
+__ZNK7WebCore19JSLazyEventListener9parseCodeEv
+__ZThn88_NK7WebCore8Document10virtualURLEv
+__ZNK7WebCore8Document10virtualURLEv
+__ZNK7WebCore13JSHTMLElement21pushEventHandlerScopeEPN3JSC9ExecStateERNS1_10ScopeChainE
+__ZNK7WebCore11HTMLElement11virtualFormEv
+__ZNK7WebCore5Event15isKeyboardEventEv
+__ZNK7WebCore5Event11isTextEventEv
+__ZN7WebCore15getDOMStructureINS_12JSMouseEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore12JSMouseEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSUIEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSUIEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSMouseEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10MouseEventEEE
+__ZN7WebCore12JSMouseEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10MouseEventEEE
+__ZN7WebCore9JSUIEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7UIEventEEE
+__ZNK3JSC8JSObject16isVariableObjectEv
+__ZNK7WebCore5Event20storesResultAsStringEv
+__ZNK7WebCore17HTMLAnchorElement11isFocusableEv
+__ZNK7WebCore17HTMLAnchorElement16isMouseFocusableEv
+__ZNK7WebCore17HTMLAnchorElement17canStartSelectionEv
+__ZN7WebCore14CachedResource11setEncodingERKNS_6StringE
+__ZNK7WebCore19HTMLTextAreaElement20saveFormControlStateERNS_6StringE
+__ZNK7WebCore19HTMLTextAreaElement15formControlTypeEv
+__ZN7WebCore8Location15disconnectFrameEv
+__ZN7WebCoreL16dlistConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLDListElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLDListElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore16HTMLDListElement17endTagRequirementEv
+__ZNK7WebCore16HTMLDListElement11tagPriorityEv
+__ZN7WebCore10HTMLParser18dtCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore10HTMLParser18ddCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN3WTF6VectorIPN7WebCore9RenderBoxELm0EE6shrinkEm
+__ZN7WebCore10JSLocationD1Ev
+__ZN7WebCore10JSLocationD2Ev
+__ZN7WebCore21JSHTMLTextAreaElementD1Ev
+__ZN7WebCore12JSMouseEventD1Ev
+__ZN7WebCore10RenderView19updateHitTestResultERNS_13HitTestResultERKNS_8IntPointE
+__ZN7WebCore28createAttributeEventListenerEPNS_5FrameEPNS_9AttributeE
+__ZN7WebCore8Document31setWindowAttributeEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore8Document4headEv
+__ZN7WebCore14RenderReplaced14calcPrefWidthsEv
+__ZN7WebCoreL21subframeForTargetNodeEPNS_4NodeE
+__ZN7WebCore12EventHandler28passMouseMoveEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameEPNS_13HitTestResultE
+__ZN7WebCore12EventHandler27passSubframeEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameEPNS_13HitTestResultE
+__ZN7WebCore10ScrollView5paintEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore6Widget5paintEPNS_15GraphicsContextERKNS_7IntRectE
+__ZNK7WebCore11RenderLayer20requiresSlowRepaintsEv
+__ZNK7WebCore9FrameTree14isDescendantOfEPKNS_5FrameE
+__ZN7WebCore25setJSHTMLIFrameElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19JSHTMLIFrameElement6setSrcEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore20HTMLFrameElementBase6setSrcERKNS_6StringE
+__ZN7WebCore11FrameLoader15userGestureHintEv
+__ZN7WebCore11HistoryItem6setURLERKNS_4KURLE
+__ZN7WebCore9PageCache6removeEPNS_11HistoryItemE
+__ZN7WebCore11HistoryItem12setURLStringERKNS_6StringE
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E47removeAndInvalid
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_10StringHashENS_10HashTraitsIS2_EES7_E6removeEPS2_
+__ZN7WebCore13PageURLRecordD1Ev
+__ZN7WebCore13PageURLRecordD2Ev
+__ZN7WebCore11HistoryItem18clearDocumentStateEv
+__ZN7WebCore6Widget16removeFromParentEv
+__ZN7WebCore10ScrollView11removeChildEPNS_6WidgetE
+__ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22Ide
+__ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInvali
+__ZN3WTF9HashTableIPN7WebCore6WidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore10ScrollView19platformRemoveChildEPNS_6WidgetE
+__ZN7WebCore6Widget19removeFromSuperviewEv
+__ZN7WebCoreL23safeRemoveFromSuperviewEP6NSView
+__ZN7WebCore10RenderPart12deleteWidgetEv
+__ZNK7WebCore9RenderBox18absoluteContentBoxEv
+__ZN7WebCore12RenderWidget17setWidgetGeometryERKNS_7IntRectE
+__ZN3WTF7HashMapIPN7WebCore24OverlapTestRequestClientENS1_7IntRectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS7_IS4_EEE3setERKS3_R
+__ZThn120_N7WebCore12RenderWidget20setOverlapTestResultEb
+__ZN7WebCore12RenderWidget20setOverlapTestResultEb
+__ZN7WebCore9FrameView15setIsOverlappedEb
+__ZN7WebCore19JSHTMLIFrameElementD1Ev
+__ZN7WebCore7CommentD0Ev
+__ZN7WebCore25JSHTMLDivElementPrototypeD1Ev
+__ZN7WebCore18setJSDOMWindowNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow7setNameERKNS_6StringE
+__ZN7WebCore15jsDOMWindowNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow4nameEv
+__ZN7WebCore5TimerINS_11CachedImageEE5firedEv
+__ZN7WebCore11CachedImage29decodedDataDeletionTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore22setJSDOMWindowLocationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11JSDOMWindow11setLocationEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore19JSLazyEventListenerD0Ev
+__ZN7WebCore15JSEventListenerD2Ev
+__ZN7WebCore11FrameLoader16detachFromParentEv
+__ZN7WebCore19InspectorController23frameDetachedFromParentEPNS_5FrameE
+__ZN7WebCore11FrameLoader19closeAndRemoveChildEPNS_5FrameE
+__ZN7WebCore5Frame13pageDestroyedEv
+__ZN7WebCore16JSDOMWindowShell15disconnectFrameEv
+__ZN7WebCore15JSDOMWindowBase15disconnectFrameEv
+__ZN7WebCore9FrameTree11removeChildEPNS_5FrameE
+__ZN7WebCore11FrameLoader22scheduleCheckCompletedEv
+__ZN7WebCore21DeprecatedPtrListImplD1Ev
+__ZN7WebCore21DeprecatedPtrListImplD2Ev
+__ZN7WebCore12RenderWidget7destroyEv
+__ZN7WebCore16RenderPartObjectD0Ev
+__ZN7WebCore9FrameView20removeWidgetToUpdateEPNS_16RenderPartObjectE
+__ZN7WebCore10RenderPartD2Ev
+__ZN7WebCore12RenderWidgetD2Ev
+__ZN7WebCore12RenderWidget12deleteWidgetEv
+__ZN7WebCoreL14preConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore14HTMLPreElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14HTMLPreElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore14HTMLPreElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore14HTMLPreElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore14HTMLPreElement17endTagRequirementEv
+__ZNK7WebCore14HTMLPreElement11tagPriorityEv
+__ZN7WebCore26setJSHTMLInputElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement8setValueERKNS_6StringE
+__ZN7WebCore5FrameD1Ev
+__ZN7WebCore5FrameD2Ev
+__ZN7WebCore11FrameLoader14cancelAndClearEv
+__ZN7WebCore5Frame22disconnectOwnerElementEv
+__ZN7WebCore9DOMWindow15disconnectFrameEv
+__ZN7WebCore19AnimationControllerD1Ev
+__ZN7WebCore19AnimationControllerD2Ev
+__ZN7WebCore26AnimationControllerPrivateD1Ev
+__ZN7WebCore26AnimationControllerPrivateD2Ev
+__ZN7WebCore12EventHandlerD1Ev
+__ZN7WebCore12EventHandlerD2Ev
+__ZN7WebCore6EditorD1Ev
+__ZN7WebCore6EditorD2Ev
+__ZN7WebCore16ScriptControllerD1Ev
+__ZN7WebCore16ScriptControllerD2Ev
+__ZN7WebCore16ScriptController31disconnectPlatformScriptObjectsEv
+-[DOMAbstractView(Frame) _disconnectFrame]
+-[DOMAbstractView dealloc]
+__ZN7WebCore15removeJSWrapperEPN3JSC8JSObjectE
+__ZN7WebCore11FrameLoaderD1Ev
+__ZN7WebCore11FrameLoaderD2Ev
+__ZN7WebCore11FrameLoader9setOpenerEPNS_5FrameE
+__ZN3WTF9HashTableIPN7WebCore5FrameES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTableE
+__ZN7WebCore9FrameTreeD1Ev
+__ZN7WebCore9FrameTreeD2Ev
+__ZN7WebCoreL27createHTMLPreElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore16JSHTMLPreElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSHTMLPreElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLPreElementEEE
+__ZN7WebCore16JSHTMLPreElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLPreElementEEE
+__ZN7WebCore16JSHTMLPreElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSHTMLPreElement9classInfoEv
+__ZN7WebCoreL26createHTMLBRElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore15JSHTMLBRElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSHTMLBRElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13HTMLBRElementEEE
+__ZN7WebCore15JSHTMLBRElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13HTMLBRElementEEE
+__ZNK7WebCore15JSHTMLBRElement9classInfoEv
+__ZN7WebCore17HTMLIFrameElementD0Ev
+__ZN7WebCore21HTMLFrameOwnerElementD2Ev
+__ZN7WebCore28JSHTMLIFrameElementPrototypeD1Ev
+__ZN7WebCore16JSDOMWindowShellD1Ev
+__ZN7WebCore16JSDOMWindowShellD2Ev
+__ZN7WebCore15JSHTMLBRElementD1Ev
+__ZN7WebCore16JSHTMLPreElementD1Ev
+__ZN7WebCore12IconDatabase28removePageURLFromSQLDatabaseERKNS_6StringE
+__ZN7WebCore27RenderTextControlSingleLine11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore27RenderTextControlInnerBlock11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZNK7WebCore27RenderTextControlSingleLine11isTextFieldEv
+__ZNK7WebCore11RenderTheme12stateChangedEPNS_12RenderObjectENS_12ControlStateE
+__ZNK7WebCore11RenderTheme13supportsHoverEPKNS_11RenderStyleE
+__ZN7WebCore17RenderTextControl19hitInnerTextElementERNS_13HitTestResultEiiii
+__ZN7WebCoreL22centerTruncateToBufferERKNS_6StringEjjPt
+__ZN7WebCore11isTextBreakEPNS_17TextBreakIteratorEi
+__ZSt13binary_searchIPKttEbT_S2_RKT0_
+__ZSt11lower_boundIPKttET_S2_S2_RKT0_
+__ZN7WebCoreL16findTextEncodingEPKci
+__ZN7WebCore12TextCodecICU29registerExtendedEncodingNamesEPFvPKcS2_E
+__ZN7WebCore12TextCodecICU22registerExtendedCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
+__ZN7WebCore12TextCodecMac21registerEncodingNamesEPFvPKcS2_E
+__ZN7WebCore12TextCodecMac14registerCodecsEPFvPKcPFSt8auto_ptrINS_9TextCodecEERKNS_12TextEncodingEPKvESA_E
+__ZN3WTF6VectorIcLm64EE6shrinkEm
+__ZNK7WebCore12TextEncoding26closestByteBasedEquivalentEv
+__ZN7WebCore22UTF32BigEndianEncodingEv
+__ZN7WebCore25UTF32LittleEndianEncodingEv
+__ZN7WebCoreL15addEncodingNameERN3WTF7HashSetIPKcNS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EEEES3_
+__ZN3WTF7HashSetIPKcNS_7PtrHashIS2_EENS_10HashTraitsIS2_EEE3addERKS2_
+__ZN3WTF9HashTableIPKcS2_NS_17IdentityExtractorIS2_EENS_7PtrHashIS2_EENS_10HashTraitsIS2_EES8_E6expandEv
+__ZN3WTF9HashTableIPKcS2_NS_17IdentityExtractorIS2_EENS_7PtrHashIS2_EENS_10HashTraitsIS2_EES8_E6rehashEi
+__ZN3WTF9HashTableIPKcS2_NS_17IdentityExtractorIS2_EENS_7PtrHashIS2_EENS_10HashTraitsIS2_EES8_E13allocateTableEi
+__ZN3WTF9HashTableIPKcS2_NS_17IdentityExtractorIS2_EENS_7PtrHashIS2_EENS_10HashTraitsIS2_EES8_E15deallocateTableEPS2_i
+__ZNK3WTF9HashTableIPKcS2_NS_17IdentityExtractorIS2_EENS_7PtrHashIS2_EENS_10HashTraitsIS2_EES8_E8containsIS2_NS_22IdentityHashT
+__ZN3WTF6VectorItLm512EE14expandCapacityEmPKt
+__ZN3WTF6VectorItLm512EE14expandCapacityEm
+__ZN3WTF6VectorItLm512EE15reserveCapacityEm
+__ZN7WebCore4KURL7setPortEt
+__ZNK7WebCore9FrameView13isTransparentEv
+__ZN7WebCore15GraphicsContext11drawEllipseERKNS_7IntRectE
+__ZN7WebCore15GraphicsContext8drawPathEv
+__ZN7WebCoreL12UTF7EncodingEv
+__ZN7WebCore15HTMLBodyElement14createLinkDeclEv
+__ZN7WebCore8DragDataC1EP11objc_objectRKNS_8IntPointES5_NS_13DragOperationEPNS_16PasteboardHelperE
+__ZN7WebCore8DragDataC2EP11objc_objectRKNS_8IntPointES5_NS_13DragOperationEPNS_16PasteboardHelperE
+__ZN7WebCore14DragController11dragEnteredEPNS_8DragDataE
+__ZN7WebCore14DragController20dragEnteredOrUpdatedEPNS_8DragDataE
+__ZN7WebCore5Frame15documentAtPointERKNS_8IntPointE
+__ZN7WebCore14DragController15tryDocumentDragEPNS_8DragDataENS_21DragDestinationActionE
+__ZN7WebCore14DragController12tryDHTMLDragEPNS_8DragDataE
+__ZNK7WebCore11FrameLoader7baseURLEv
+__ZNK7WebCore8DragData15createClipboardENS_21ClipboardAccessPolicyE
+__ZN7WebCore12ClipboardMacC1EbP12NSPasteboardNS_21ClipboardAccessPolicyEPNS_5FrameE
+__ZN7WebCore12ClipboardMacC2EbP12NSPasteboardNS_21ClipboardAccessPolicyEPNS_5FrameE
+__ZN7WebCore9ClipboardC2ENS_21ClipboardAccessPolicyEb
+__ZN7WebCore9Clipboard18setSourceOperationENS_13DragOperationE
+__ZN7WebCoreL14IEOpFromDragOpENS_13DragOperationE
+__ZN7WebCoreL16createMouseEventEPNS_8DragDataE
+__ZN7WebCore12EventHandler17updateDragAndDropERKNS_18PlatformMouseEventEPNS_9ClipboardE
+__ZN7WebCore12EventHandler17dispatchDragEventERKNS_12AtomicStringEPNS_4NodeERKNS_18PlatformMouseEventEPNS_9ClipboardE
+__ZN7WebCore12ClipboardMacD0Ev
+__ZN7WebCore9ClipboardD2Ev
+__ZN7WebCore14DragController14canProcessDragEPNS_8DragDataE
+__ZNK7WebCore8DragData25containsCompatibleContentEv
+__ZNK7WebCore8DragData13containsFilesEv
+__ZN7WebCoreL11asFileInputEPNS_4NodeE
+__ZN7WebCore14DragController16operationForLoadEPNS_8DragDataE
+__ZN7WebCore14DragController13dragOperationEPNS_8DragDataE
+__ZNK7WebCore8DragData11containsURLEv
+__ZNK7WebCore8DragData5asURLEPNS_6StringE
+__ZN7WebCore14DragController11dragUpdatedEPNS_8DragDataE
+__ZN7WebCore14DragController11performDragEPNS_8DragDataE
+__ZN7WebCore14DragController16concludeEditDragEPNS_8DragDataE
+__ZNK7WebCore8Document16elementFromPointEii
+__ZNK7WebCore8DragData13containsColorEv
+__ZN7WebCore15SQLiteStatement8bindNullEi
+__ZN7WebCore12EventHandler10wheelEventEP7NSEvent
+__ZN7WebCore18PlatformWheelEventC1EP7NSEvent
+__ZN7WebCore18PlatformWheelEventC2EP7NSEvent
+__ZN7WebCore12EventHandler16handleWheelEventERNS_18PlatformWheelEventE
+__ZN7WebCore4Node18dispatchWheelEventERNS_18PlatformWheelEventE
+__ZN7WebCore10WheelEventC1EffN3WTF10PassRefPtrINS_9DOMWindowEEEiiiibbbb
+__ZN7WebCore10WheelEventC2EffN3WTF10PassRefPtrINS_9DOMWindowEEEiiiibbbb
+__ZN7WebCore10WheelEventD0Ev
+__ZNK7WebCore12RenderObject12enclosingBoxEv
+__ZN7WebCore9RenderBox6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
+__ZN7WebCore11RenderLayer6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
+__ZN7WebCore10ScrollView10wheelEventERNS_18PlatformWheelEventE
+__ZN7WebCore16LegacyWebArchive6createEPNS_4NodeE
+__ZN7WebCoreL18appendDocumentTypeERN3WTF6VectorItLm0EEEPKNS_12DocumentTypeE
+__ZNK7WebCore7Element22nodeNamePreservingCaseEv
+__ZNK7WebCore7Element14isURLAttributeEPNS_9AttributeE
+__ZN7WebCoreL20appendAttributeValueERN3WTF6VectorItLm0EEERKNS_6StringEb
+__ZNK7WebCore17HTMLAnchorElement14isURLAttributeEPNS_9AttributeE
+__ZN7WebCoreL29appendQuotedURLAttributeValueERN3WTF6VectorItLm0EEERKNS_6StringE
+__ZN7WebCore16LegacyWebArchive6createERKNS_6StringEPNS_5FrameERKN3WTF6VectorIPNS_4NodeELm0EEE
+__ZN7WebCore10utf8BufferERKNS_6StringE
+__ZN7WebCore12SharedBuffer11adoptVectorERN3WTF6VectorIcLm0EEE
+__ZN7WebCore12SharedBufferC1Ev
+__ZN7WebCore12SharedBufferC2Ev
+__ZN7WebCore15ArchiveResource6createEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_6StringESA_SA_
+__ZN7WebCore15ArchiveResourceC1EN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_6StringESA_SA_
+__ZN7WebCore15ArchiveResourceC2EN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_6StringESA_SA_
+__ZNK7WebCore4Node18getSubresourceURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK7WebCore4Node27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN3WTF11ListHashSetIN7WebCore4KURLENS1_8KURLHashEE14deleteAllNodesEv
+__ZNK7WebCore13StyledElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK7WebCore16HTMLStyleElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore13CSSStyleSheet23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN3WTF5DequeIPN7WebCore13CSSStyleSheetEE14expandCapacityEv
+__ZN7WebCore12CSSStyleRule23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore26CSSMutableStyleDeclaration23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore17CSSPrimitiveValue23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEEPKNS_13CSSStyleSheetE
+__ZNK7WebCore15HTMLBodyElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK7WebCore15HTMLBodyElement10backgroundEv
+__ZN7WebCore12IconDatabase17iconURLForPageURLERKNS_6StringE
+__ZN7WebCore16LegacyWebArchive6createEN3WTF10PassRefPtrINS_15ArchiveResourceEEERNS1_6VectorIS4_Lm0EEERNS5_INS2_IS0_EELm0EEE
+__ZN7WebCore16LegacyWebArchive6createEv
+__ZN3WTF9HashTableIN7WebCore4KURLES2_NS_17IdentityExtractorIS2_EENS1_8KURLHashENS_10HashTraitsIS2_EES7_E15deallocateTableEPS2_i
+__ZN7WebCore16LegacyWebArchive21rawDataRepresentationEv
+__ZN7WebCore16LegacyWebArchive32createPropertyListRepresentationEPNS_7ArchiveE
+__ZN7WebCore16LegacyWebArchive32createPropertyListRepresentationEPNS_15ArchiveResourceENS0_18MainResourceStatusE
+__ZN7WebCore15ArchiveResourceD0Ev
+__ZN7WebCore5Cache11setDisabledEb
+__ZN7WebCore5Cache18pruneDeadResourcesEv
+__ZNK7WebCore5Cache12deadCapacityEv
+__ZN7WebCore5Cache18pruneLiveResourcesEv
+__ZNK7WebCore5Cache12liveCapacityEv
+__ZN7WebCore18MainResourceLoader18handleDataLoadSoonERNS_15ResourceRequestE
+__ZN7WebCore18MainResourceLoader18startDataLoadTimerEv
+__ZN7WebCore16RunLoopTimerBase5startEdd
+__ZN7WebCore16RunLoopTimerBase8scheduleERKN3WTF7HashSetINS1_6RefPtrINS_12SchedulePairEEENS_16SchedulePairHashENS1_10HashTraitsI
+__ZN7WebCore16RunLoopTimerBase8scheduleEPKNS_12SchedulePairE
+__ZN7WebCoreL10timerFiredEP16__CFRunLoopTimerPv
+__ZN7WebCore12RunLoopTimerINS_18MainResourceLoaderEE5firedEv
+__ZN7WebCore18MainResourceLoader17handleDataLoadNowEPNS_12RunLoopTimerIS0_EE
 __ZNK7WebCore12SharedBuffer12platformDataEv
-__ZNK7WebCore5Image5widthEv
-__ZNK7WebCore11BitmapImage4sizeEv
-__ZNK7WebCore11ImageSource4sizeEv
-__ZNK7WebCore5Image6heightEv
-__ZNK7WebCore4Font5widthERKNS_7TextRunE
-__ZN7WebCore7Element8updateIdERKNS_12AtomicStringES3_
-__ZNK7WebCore7Element10attributesEb
-__ZNK7WebCore13StyledElement28updateStyleAttributeIfNeededEv
-__ZN7WebCore8Document14addElementByIdERKNS_12AtomicStringEPNS_7ElementE
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_7ElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
-__ZNK7WebCore7Element14getIDAttributeEv
-__ZN3WTF7HashMapIPN7WebCore10StringImplEiNS1_10StringHashENS_10HashTraitsIS3_EENS5_IiEEE3setERKS3_RKi
-__ZN7WebCore17CSSPrimitiveValue25computeLengthIntForLengthEPNS_11RenderStyleEd
-__ZN7WebCore10timerFiredEP16__CFRunLoopTimerPv
-__ZN7WebCore9TimerBase16sharedTimerFiredEv
-__ZN7WebCore9TimerBase19collectFiringTimersEdRN3WTF6VectorIPS0_Lm0EEE
-__ZN3WTF7HashSetIPKN7WebCore9TimerBaseENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZN7WebCore9TimerBase10fireTimersEdRKN3WTF6VectorIPS0_Lm0EEE
-__ZN7WebCore5TimerINS_12GCControllerEE5firedEv
-__ZN7WebCore12GCController12gcTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore11CachedImage4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
--[WebCoreSharedBufferData dealloc]
-__ZN7WebCore14CachedResource6finishEv
-__ZN7WebCore19MediaQueryEvaluatorC2Eb
-__ZNK7WebCore11FrameLoader8encodingEv
-__ZN7WebCore9DocLoader20requestCSSStyleSheetERKNS_6StringES3_b
-__ZN7WebCore19CachedCSSStyleSheetC2EPNS_9DocLoaderERKNS_6StringES5_bb
-__ZN7WebCore19CachedCSSStyleSheet3refEPNS_20CachedResourceClientE
-__ZN7WebCore15SegmentedString6appendERKS0_
-__ZN7WebCore15SegmentedString6appendERKNS_18SegmentedSubstringE
-__ZNK7WebCore23DeprecatedValueListImpl7Private8copyListEPNS_27DeprecatedValueListImplNodeERS3_S4_
-__ZN7WebCore17HTMLScriptElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore17HTMLScriptElement15childrenChangedEb
-__ZNK7WebCore17HTMLScriptElement4textEv
-__ZN7WebCore13ulConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLUListElementC2EPNS_8DocumentE
-__ZNK7WebCore16HTMLUListElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore16HTMLUListElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore16HTMLUListElement17endTagRequirementEv
-__ZNK7WebCore16HTMLUListElement11tagPriorityEv
-__ZN7WebCore13liConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore13HTMLLIElementC2EPNS_8DocumentE
-__ZNK7WebCore13HTMLLIElement17endTagRequirementEv
-__ZNK7WebCore13HTMLLIElement11tagPriorityEv
-__ZN7WebCore13HTMLLIElement6attachEv
-__ZNK7WebCore9DOMWindow6screenEv
-__ZN7WebCore6ScreenC2EPNS_5FrameE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_6ScreenE
-__ZN7WebCore17JSScreenPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore8JSScreenC1EPN3KJS8JSObjectEPNS_6ScreenE
-__ZN7WebCore8JSScreen18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore8JSScreenEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore8JSScreen16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore6Screen6heightEv
-__ZN7WebCore10screenRectEPNS_6WidgetE
-__ZN7WebCore11toUserSpaceERK7_NSRectP8NSWindow
-__ZN7WebCore9FloatRect5scaleEf
-__ZN7WebCore11writeHelperEPN3KJS9ExecStateERKNS0_4ListE
-__ZN7WebCore8Document5writeERKNS_6StringE
+__ZN7WebCore4Page9initGroupEv
+__ZN7WebCore9PageGroupC1EPNS_4PageE
+__ZN7WebCore9PageGroupC2EPNS_4PageE
+__ZNK7WebCore9FrameView26shouldUpdateWhileOffscreenEv
+-[DOMNode nodeName]
+__ZNK7WebCore8Document8nodeNameEv
+-[DOMNode nodeType]
+__ZNK7WebCore4Text8nodeNameEv
+-[DOMElement getAttribute:]
+__ZN7WebCore11FrameLoader17stopForUserCancelEb
+__ZN7WebCore15RenderTableCell7destroyEv
+__ZN7WebCore15RenderTableCellD0Ev
+__ZN7WebCore14RenderTableRow7destroyEv
+__ZN7WebCore18RenderTableSection11removeChildEPNS_12RenderObjectE
+__ZN7WebCore14RenderTableRowD0Ev
+__ZN7WebCore18RenderTableSection7destroyEv
+__ZN7WebCore11RenderTable11removeChildEPNS_12RenderObjectE
+__ZN7WebCore18RenderTableSectionD0Ev
+__ZN7WebCore18RenderTableSection9clearGridEv
+__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE6shrinkEm
+__ZN3WTF6VectorIN7WebCore18RenderTableSection9RowStructELm0EE6shrinkEm
+__ZN7WebCore11RenderTableD0Ev
+__ZN7WebCore15AutoTableLayoutD0Ev
+__ZN3WTF6VectorIN7WebCore15AutoTableLayout6LayoutELm4EE6shrinkEm
+__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE6shrinkEm
+__ZN7WebCore16HTMLStyleElementD0Ev
+__ZN7WebCore16HTMLTableElementD0Ev
+__ZN7WebCore23HTMLTableSectionElementD0Ev
+__ZN7WebCore19HTMLTableRowElementD0Ev
+__ZN7WebCore20HTMLTableCellElementD0Ev
+__ZN7WebCore11CachedImageD0Ev
+__ZN7WebCore14CachedResourceD2Ev
+__ZN7WebCore17HTMLAnchorElementD0Ev
+__ZN7WebCore13HTMLBRElementD0Ev
+__ZN7WebCore13HTMLLIElementD0Ev
+__ZN7WebCore12EventHandler15sendResizeEventEv
+__ZN7WebCore5Frame25setUserStyleSheetLocationERKNS_4KURLE
+__ZN7WebCore12base64DecodeERKN3WTF6VectorIcLm0EEERS2_
+__ZN7WebCore12base64DecodeEPKcjRN3WTF6VectorIcLm0EEE
+__ZN7WebCore6String8fromUTF8EPKc
+__ZNK7WebCore10StyleSheet11completeURLERKNS_6StringE
+__ZN7WebCore7DataRefINS_22StyleRareInheritedDataEE6accessEv
+__ZN7WebCore15RenderTableCell29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore5Frame23visiblePositionForPointERKNS_8IntPointE
+__ZN7WebCoreL43positionForPointRespectingEditingBoundariesEPNS_9RenderBoxES1_RKNS_8IntPointE
+__ZN7WebCore9RenderBox16positionForPointERKNS_8IntPointE
+__ZN7WebCore12RenderObject21createVisiblePositionERKNS_8PositionE
+__ZN7WebCore31firstDeepEditingPositionForNodeEPNS_4NodeE
+__ZN7WebCore17positionAfterNodeEPKNS_4NodeE
+-[DOMRange endOffset]
+-[DOMRange startOffset]
+-[DOMRange startContainer]
+-[DOMNode childNodes]
+-[DOMCharacterData data]
+-[DOMDocument createTextNode:]
+__Z3kitPN7WebCore4TextE
+-[DOMNode insertBefore:refChild:]
+-[DOMDocument createElement:]
+-[DOMHTMLAnchorElement setHref:]
+-[DOMNode appendChild:]
+-[DOMCharacterData setData:]
+-[DOMRange setStart:offset:]
+-[DOMRange setEnd:offset:]
+-[DOMRange(DOMRangeExtensions) lineBoxRects]
+-[DOMRange(DOMRangeExtensions) textRects]
+__ZN7WebCore13InlineTextBox11extractLineEv
+__ZN7WebCore10RenderText14extractTextBoxEPNS_13InlineTextBoxE
+__ZN7WebCore13InlineTextBox10attachLineEv
+__ZN7WebCore10RenderText13attachTextBoxEPNS_13InlineTextBoxE
+__ZN7WebCore5Range9textRectsERN3WTF6VectorINS_7IntRectELm0EEEb
+__ZN7WebCore10RenderText21absoluteRectsForRangeERN3WTF6VectorINS_7IntRectELm0EEEjjb
+__ZN7WebCore13InlineTextBox13selectionRectEiiii
+__ZN7WebCoreL3kitERKN3WTF6VectorINS_7IntRectELm0EEE
+__ZN7WebCore4Page17willMoveOffscreenEv
+__ZN7WebCore9FrameView17willMoveOffscreenEv
+__ZN7WebCore10RenderView17willMoveOffscreenEv
+__ZN3WTF7HashMapIPN7WebCore11RenderImageEPNS1_20RenderImageScaleDataENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE4takeERKS
+__ZN3WTF9HashTableIPN7WebCore11RenderImageESt4pairIS3_PNS1_20RenderImageScaleDataEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_
+__ZN7WebCore14DragController9dragEndedEv
+__ZN7WebCore4PageD1Ev
+__ZN7WebCore4PageD2Ev
+__ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22Ident
+__ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInvalida
+__ZN3WTF9HashTableIPN7WebCore4PageES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore19InspectorController22inspectedPageDestroyedEv
+__ZN7WebCore19InspectorController5closeEv
+__ZN7WebCore15BackForwardList5closeEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore9FrameDataELm0EE6shrinkEm
+__ZN7WebCore9FrameData5clearEb
+__ZN7WebCore15BackForwardListD1Ev
+__ZN7WebCore15BackForwardListD2Ev
+__ZN7WebCore15ProgressTrackerD1Ev
+__ZN7WebCore15ProgressTrackerD2Ev
+__ZN7WebCore19InspectorControllerD0Ev
+__ZN3WTF20deleteAllPairSecondsIPNS_7HashMapIxNS_6RefPtrIN7WebCore17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS8_IS
+__ZN3WTF15deleteAllValuesIPN7WebCore14ConsoleMessageELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN7WebCore21ContextMenuControllerD1Ev
+__ZN7WebCore21ContextMenuControllerD2Ev
+__ZN7WebCore14DragControllerD1Ev
+__ZN7WebCore14DragControllerD2Ev
+__ZN7WebCore6ChromeD0Ev
+__ZN7WebCore5Range19nodeChildrenChangedEPNS_13ContainerNodeE
+-[DOMRange endContainer]
+__ZN7WebCore5Range11textRemovedEPNS_4NodeEjj
+-[DOMRange setStartBefore:]
+-[DOMRange setEndAfter:]
+__ZN7WebCore16LegacyWebArchive6createEPNS_5RangeE
+__ZN7WebCore12createMarkupEPKNS_5RangeEPN3WTF6VectorIPNS_4NodeELm0EEENS_23EAnnotateForInterchangeEb
+__ZN7WebCore25avoidIntersectionWithNodeEPKNS_5RangeEPNS_4NodeE
+__ZN7WebCore22DeleteButtonController7disableEv
+__ZN7WebCore22DeleteButtonController4hideEv
+__ZNK7WebCore12RenderObject14previousOffsetEi
+__ZN7WebCoreL27needInterchangeNewlineAfterERKNS_15VisiblePositionE
+__ZNK7WebCore15VisiblePosition4nextEb
+__ZN7WebCore29nextVisuallyDistinctCandidateERKNS_8PositionE
+__ZNK7WebCore8Position11atEndOfTreeEv
+__ZNK7WebCore8Position4nextENS_16PositionMoveTypeE
+__ZN7WebCoreL14getStartMarkupEPKNS_4NodeEPKNS_5RangeENS_23EAnnotateForInterchangeEbPN3WTF7HashMapIPNS_16AtomicStringImplESA_NS7
+__ZNK7WebCore15HTMLBodyElement14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore26CSSMutableStyleDeclaration4copyEv
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm0EEC1ILm4EEERKNS0_IS2_XT_EEE
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm0EEC2ILm4EEERKNS0_IS2_XT_EEE
+__ZN7WebCore26CSSMutableStyleDeclarationC1EPNS_7CSSRuleERKN3WTF6VectorINS_11CSSPropertyELm0EEEj
+__ZN7WebCore26CSSMutableStyleDeclarationC2EPNS_7CSSRuleERKN3WTF6VectorINS_11CSSPropertyELm0EEEj
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EEC1ILm0EEERKNS0_IS2_XT_EEE
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm4EEC2ILm0EEERKNS0_IS2_XT_EEE
+__ZN7WebCoreL31styleFromMatchedRulesForElementEPNS_7ElementEb
+__ZN7WebCore16CSSStyleSelector20styleRulesForElementEPNS_7ElementEb
+__ZN7WebCore26CSSMutableStyleDeclaration5mergeEPS0_b
+__ZN7WebCore20enclosingNodeWithTagERKNS_8PositionERKNS_13QualifiedNameE
+__ZN3WTF6VectorIN7WebCore11CSSPropertyELm0EE6shrinkEm
+__ZNK7WebCore16HTMLTableElement14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore20HTMLTableCellElement14isURLAttributeEPNS_9AttributeE
+__ZN7WebCore34convertHTMLTextToInterchangeFormatERKNS_6StringEPKNS_4TextE
+__ZN7WebCoreL12getEndMarkupEPKNS_4NodeE
+__ZNK7WebCore16HTMLImageElement14isURLAttributeEPNS_9AttributeE
+__ZN7WebCore12_GLOBAL__N_120convertedSpaceStringEv
+__ZN7WebCore6String6appendEt
+__ZN7WebCore16isMailBlockquoteEPKNS_4NodeE
+__ZNK7WebCore27CSSComputedStyleDeclaration25copyInheritablePropertiesEv
+__ZNK7WebCore19CSSStyleDeclaration19copyPropertiesInSetEPKij
+__ZN7WebCoreL14valueForFamilyERKNS_12AtomicStringE
+__ZN7WebCoreL19identifierForFamilyERKNS_12AtomicStringE
+__ZN7WebCore17CSSPrimitiveValueC1ERKNS_6LengthE
+__ZN7WebCore17CSSPrimitiveValueC2ERKNS_6LengthE
+__ZN7WebCoreL24currentColorOrValidColorEPNS_11RenderStyleERKNS_5ColorE
+__ZN7WebCore26CSSMutableStyleDeclaration14removePropertyEiRi
+__ZNK7WebCore9StyleBase15isCSSStyleSheetEv
+__ZN7WebCoreL31cssIdentifierForFontSizeKeywordEi
+__ZN7WebCoreL28propertyMissingOrEqualToNoneEPNS_26CSSMutableStyleDeclarationEi
+__ZN7WebCore17isTabSpanTextNodeEPKNS_4NodeE
+__ZN7WebCore13isTabSpanNodeEPKNS_4NodeE
+__ZN7WebCore21nearestMailBlockquoteEPKNS_4NodeE
+__ZNK7WebCore19CSSStyleDeclaration4diffEPNS_26CSSMutableStyleDeclarationE
+__ZNK7WebCore10RenderText22caretMaxRenderedOffsetEv
+__ZNK7WebCore10RenderText14caretMaxOffsetEv
+__ZN7WebCore18isStartOfParagraphERKNS_15VisiblePositionE
+__ZN7WebCore22DeleteButtonController6enableEv
+__ZN7WebCore22DeleteButtonController4showEPNS_11HTMLElementE
+__ZNK7WebCore5Frame18documentTypeStringEv
+__ZNK7WebCore16HTMLTableElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK7WebCore20HTMLTableCellElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore12CSSValueList23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEEPKNS_13CSSStyleSheetE
+__ZNK7WebCore16HTMLImageElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN3WTF11ListHashSetIN7WebCore4KURLENS1_8KURLHashEE3addERKS2_
+__ZN3WTF9HashTableIPNS_15ListHashSetNodeIN7WebCore4KURLEEES5_NS_17IdentityExtractorIS5_EENS_28ListHashSetNodeHashFunctionsIS3_N
+__ZN3WTF11ListHashSetIN7WebCore4KURLENS1_8KURLHashEE10appendNodeEPNS_15ListHashSetNodeIS2_EE
+__ZNK3WTF9HashTableIN7WebCore4KURLES2_NS_17IdentityExtractorIS2_EENS1_8KURLHashENS_10HashTraitsIS2_EES7_E8containsIS2_NS_22Iden
+__ZN3WTF7HashSetIN7WebCore4KURLENS1_8KURLHashENS_10HashTraitsIS2_EEE3addERKS2_
+__ZN3WTF9HashTableIN7WebCore4KURLES2_NS_17IdentityExtractorIS2_EENS1_8KURLHashENS_10HashTraitsIS2_EES7_E6expandEv
+__ZN3WTF9HashTableIN7WebCore4KURLES2_NS_17IdentityExtractorIS2_EENS1_8KURLHashENS_10HashTraitsIS2_EES7_E6rehashEi
+__ZN3WTF9HashTableIN7WebCore4KURLES2_NS_17IdentityExtractorIS2_EENS1_8KURLHashENS_10HashTraitsIS2_EES7_E13allocateTableEi
+__ZNK7WebCore14DocumentLoader11subresourceERKNS_4KURLE
+__ZN7WebCore15ArchiveResource6createEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_16ResourceResponseE
+__ZN7WebCore15ArchiveResourceC1EN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_16ResourceResponseE
+__ZN7WebCore15ArchiveResourceC2EN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_16ResourceResponseE
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore15ArchiveResourceEEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore15ArchiveResourceEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore15ArchiveResourceEEELm0EE15reserveCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore15ArchiveResourceEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore15ArchiveResourceEEELm0EE15reserveCapacityEm
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore15ArchiveResourceEEELm0EE6shrinkEm
+__ZN7WebCore12SharedBuffer12createNSDataEv
+-[DOMRange commonAncestorContainer]
+-[DOMRange collapsed]
+-[DOMRange intersectsNode:]
+__ZN7WebCore5Range14intersectsNodeEPNS_4NodeERi
+__ZN7WebCore5Range12comparePointEPNS_4NodeEiRi
+-[DOMNode isSameNode:]
+__ZN7WebCoreL15baseConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore15HTMLBaseElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLBaseElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLBaseElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15HTMLBaseElement7processEv
+__ZNK7WebCore15HTMLBaseElement17endTagRequirementEv
+__ZNK7WebCore15HTMLBaseElement11tagPriorityEv
+__ZN7WebCore15HTMLBaseElement20insertedIntoDocumentEv
+__ZN7WebCore8Document17setBaseElementURLERKNS_4KURLE
+-[DOMDocument body]
+__Z3kitPN7WebCore11HTMLElementE
+-[DOMHTMLElement setClassName:]
+-[DOMHTMLDocument(DOMHTMLDocumentExtensions) createDocumentFragmentWithText:]
+__Z4coreP15DOMHTMLDocument
+__ZN7WebCore22createFragmentFromTextEPNS_5RangeERKNS_6StringE
+__ZN7WebCore8Document22createDocumentFragmentEv
+__ZNK7WebCore6String5splitEtbRN3WTF6VectorIS0_Lm0EEE
+__ZN7WebCore29createDefaultParagraphElementEPNS_8DocumentE
+__ZN7WebCoreL23fillContainerFromStringEPNS_13ContainerNodeERKNS_6StringE
+__ZN7WebCore30stringWithRebalancedWhitespaceERKNS_6StringEbb
+__ZN7WebCore18createBreakElementEPNS_8DocumentE
+__Z3kitPN7WebCore16DocumentFragmentE
+__ZN7WebCoreL21blockquoteConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore21HTMLBlockquoteElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore21HTMLBlockquoteElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+-[DOMElement setAttribute:value:]
+-[DOMHTMLDocument(DOMHTMLDocumentExtensions) createDocumentFragmentWithMarkupString:baseURL:]
+__ZN7WebCore24createFragmentFromMarkupEPNS_8DocumentERKNS_6StringES4_
+__ZN7WebCore10HTMLParser28tableSectionCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCoreL23tablesectionConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+-[DOMElement hasAttribute:]
+__ZNK7WebCore7Element12hasAttributeERKNS_6StringE
+-[DOMElement style]
+-[DOMCSSStyleDeclaration getPropertyCSSValue:]
+__ZN7WebCore19CSSStyleDeclaration19getPropertyCSSValueERKNS_6StringE
+__Z3kitPN7WebCore8CSSValueE
+__Z8kitClassPN7WebCore8CSSValueE
+-[DOMCSSValue cssValueType]
+-[DOMCSSPrimitiveValue primitiveType]
+-[DOMCSSPrimitiveValue getRGBColorValue]
+__ZNK7WebCore17CSSPrimitiveValue16getRGBColorValueERi
+__Z3kitj
++[DOMRGBColor initialize]
+__Z33createWrapperCacheWithIntegerKeysv
+-[DOMRGBColor red]
+__Z3kitPN7WebCore17CSSPrimitiveValueE
+-[DOMCSSPrimitiveValue getFloatValue:]
+__ZN7WebCore17CSSPrimitiveValue14getDoubleValueEtRi
+-[DOMRGBColor blue]
+-[DOMRGBColor green]
+-[DOMCSSStyleDeclaration removeProperty:]
+__ZN7WebCore19CSSStyleDeclaration14removePropertyERKNS_6StringERi
+__ZN7WebCore17CSSPrimitiveValue18computeLengthFloatEPNS_11RenderStyleEdb
+-[DOMHTMLImageElement src]
+-[DOMDocument getElementById:]
+-[DOMDocument createNodeIterator:whatToShow:filter:expandEntityReferences:]
+__ZN7WebCore8Document18createNodeIteratorEPNS_4NodeEjN3WTF10PassRefPtrINS_10NodeFilterEEEbRi
+__ZN7WebCore12NodeIteratorC1EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
+__ZN7WebCore12NodeIteratorC2EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
+__ZN7WebCore9TraversalC2EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
+__ZN7WebCore12NodeIterator11NodePointerC1EN3WTF10PassRefPtrINS_4NodeEEEb
+__ZN7WebCore12NodeIterator11NodePointerC2EN3WTF10PassRefPtrINS_4NodeEEEb
+__ZN7WebCore12NodeIterator11NodePointerC1Ev
+__ZN7WebCore12NodeIterator11NodePointerC2Ev
+__ZN7WebCore8Document18attachNodeIteratorEPNS_12NodeIteratorE
+__ZN3WTF7HashSetIPN7WebCore12NodeIteratorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore12NodeIteratorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore12NodeIteratorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore12NodeIteratorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocate
+__Z3kitPN7WebCore12NodeIteratorE
+-[DOMNodeIterator nextNode]
+__ZN7WebCore19scriptStateFromNodeEPNS_4NodeE
+__ZN7WebCore12NodeIterator8nextNodeEPN3JSC9ExecStateERi
+__ZN7WebCore12NodeIterator11NodePointer10moveToNextEPNS_4NodeE
+__ZNK7WebCore9Traversal10acceptNodeEPN3JSC9ExecStateEPNS_4NodeE
+__ZN7WebCore12NodeIterator11NodePointer5clearEv
+-[DOMElement removeAttribute:]
+__ZNK7WebCore5Frame30applyEditingStyleToBodyElementEv
+__ZNK7WebCore5Frame26applyEditingStyleToElementEPNS_7ElementE
+__ZN7WebCore16VisibleSelectionC1ERKNS_8PositionENS_9EAffinityE
+__ZN7WebCore16VisibleSelectionC2ERKNS_8PositionENS_9EAffinityE
+__ZNK7WebCore8RenderBR14caretMinOffsetEv
+__ZN7WebCore6Editor18shouldBeginEditingEPNS_5RangeE
+__ZN7WebCore6Editor15didBeginEditingEv
+__ZNK7WebCore4Node20shouldUseInputMethodEv
+__ZN7WebCore10RenderText14localCaretRectEPNS_9InlineBoxEiPi
+__ZNK7WebCore13InlineTextBox17positionForOffsetEi
+__ZNK7WebCore12RenderObject19offsetFromContainerEPS0_
+__ZN7WebCore31SimplifiedBackwardsTextIterator8exitNodeEv
+__ZN7WebCore14caretMaxOffsetEPKNS_4NodeE
+__ZN7WebCore31SimplifiedBackwardsTextIterator17handleNonTextNodeEv
+__ZN7WebCore31SimplifiedBackwardsTextIterator13emitCharacterEtPNS_4NodeEii
+__ZN3WTF6VectorItLm1024EE7prependItEEvPKT_m
+__ZN3WTF6VectorItLm1024EE6insertItEEvmPKT_m
+__ZN7WebCoreL17startWordBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
+__ZN7WebCoreL30startOfLastWordBoundaryContextEPKti
+__ZN7WebCore16findWordBoundaryEPKtiiPiS2_
+__ZN7WebCore26BackwardsCharacterIteratorC1EPKNS_5RangeE
+__ZN7WebCore26BackwardsCharacterIteratorC2EPKNS_5RangeE
+__ZN7WebCore26BackwardsCharacterIterator7advanceEi
+__ZNK7WebCore26BackwardsCharacterIterator5rangeEv
+-[DOMDocument styleSheets]
+__Z3kitPN7WebCore14StyleSheetListE
+-[DOMStyleSheetList length]
+-[DOMElement getAttributeNode:]
+__ZN7WebCore7Element16getAttributeNodeERKNS_6StringE
+__Z3kitPN7WebCore4AttrE
+-[DOMCSSStyleDeclaration length]
+-[DOMCSSStyleDeclaration item:]
+__ZNK7WebCore26CSSMutableStyleDeclaration4itemEj
+-[DOMNode hasChildNodes]
+-[DOMStyleSheetList dealloc]
+-[DOMNodeIterator dealloc]
+-[DOMNodeIterator detach]
+__ZN7WebCore12NodeIterator6detachEv
+__ZN7WebCore8Document18detachNodeIteratorEPNS_12NodeIteratorE
+__ZN3WTF9HashTableIPN7WebCore12NodeIteratorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_N
+__ZN3WTF9HashTableIPN7WebCore12NodeIteratorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAn
+__ZN3WTF9HashTableIPN7WebCore12NodeIteratorES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS
+__ZN7WebCore12NodeIteratorD1Ev
+__ZN7WebCore12NodeIteratorD2Ev
+-[DOMCSSValue dealloc]
+-[DOMRGBColor dealloc]
+__ZN7WebCore12EventHandler8keyEventEP7NSEvent
+__ZN7WebCore21PlatformKeyboardEventC1EP7NSEvent
+__ZN7WebCore21PlatformKeyboardEventC2EP7NSEvent
+__ZN7WebCoreL24keyIdentifierForKeyEventEP7NSEvent
+__ZN7WebCore12EventHandler8keyEventERKNS_21PlatformKeyboardEventE
+__ZN7WebCoreL26eventTargetNodeForDocumentEPNS_8DocumentE
+__ZN7WebCore12EventHandler15handleAccessKeyERKNS_21PlatformKeyboardEventE
+__ZN7WebCore12EventHandler18accessKeyModifiersEv
+__ZNK7WebCore12EventHandler38needsKeyboardEventDisambiguationQuirksEv
+__ZN7WebCore19applicationIsSafariEv
+__ZN7WebCore21PlatformKeyboardEvent24disambiguateKeyDownEventENS0_4TypeEb
+__ZN7WebCore13KeyboardEventC1ERKNS_21PlatformKeyboardEventEPNS_9DOMWindowE
+__ZN7WebCore13KeyboardEventC2ERKNS_21PlatformKeyboardEventEPNS_9DOMWindowE
+__ZN7WebCore6Editor24handleInputMethodKeydownEPNS_13KeyboardEventE
+__ZNK7WebCore13KeyboardEvent15isKeyboardEventEv
+__ZN7WebCore12EventHandler27defaultKeyboardEventHandlerEPNS_13KeyboardEventE
+__ZN7WebCore6Editor19handleKeyboardEventEPNS_13KeyboardEventE
+__ZN7WebCore6Editor7commandERKNS_6StringE
+__ZN7WebCore6Editor7commandERKNS_6StringENS_19EditorCommandSourceE
+__ZN7WebCoreL16createCommandMapEv
+__ZN3WTF7HashMapIN7WebCore6StringEPKNS1_21EditorInternalCommandENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERKS2
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PKNS1_21EditorInternalCommandEENS_18PairFirstExtractorIS7_EENS1_15CaseFoldingHas
+__ZNK3WTF7HashMapIN7WebCore6StringEPKNS1_21EditorInternalCommandENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS7_IS5_EEE3getERKS
+__ZN7WebCore6Editor7CommandC1EN3WTF10PassRefPtrINS_5FrameEEEPKNS_21EditorInternalCommandENS_19EditorCommandSourceE
+__ZN7WebCore6Editor7CommandC2EN3WTF10PassRefPtrINS_5FrameEEEPKNS_21EditorInternalCommandENS_19EditorCommandSourceE
+__ZNK7WebCore6Editor7Command15isTextInsertionEv
+__ZN3WTF6VectorIN7WebCore15KeypressCommandELm0EEaSERKS3_
+__ZN3WTF6VectorIN7WebCore15KeypressCommandELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore15KeypressCommandELm0EE15reserveCapacityEm
+__ZN7WebCore6Editor10insertTextERKNS_6StringEPNS_5EventE
+__ZN7WebCore12EventHandler20handleTextInputEventERKNS_6StringEPNS_5EventEbb
+__ZN7WebCore9TextEventC1EN3WTF10PassRefPtrINS_9DOMWindowEEERKNS_6StringE
+__ZN7WebCore9TextEventC2EN3WTF10PassRefPtrINS_9DOMWindowEEERKNS_6StringE
+__ZNK7WebCore9TextEvent11isTextEventEv
+__ZN7WebCore12EventHandler28defaultTextInputEventHandlerEPNS_9TextEventE
+__ZN7WebCore6Editor33insertTextWithoutSendingTextEventERKNS_6StringEbPNS_5EventE
+__ZN7WebCore6Editor19selectionForCommandEPNS_5EventE
+__ZNK7WebCore6Editor16shouldInsertTextERKNS_6StringEPNS_5RangeENS_18EditorInsertActionE
+__ZNK7WebCore5Frame11typingStyleEv
+__ZN7WebCore13TypingCommand10insertTextEPNS_8DocumentERKNS_6StringERKNS_16VisibleSelectionEbb
+__ZN7WebCore23BeforeTextInsertedEventC1ERKNS_6StringE
+__ZN7WebCore23BeforeTextInsertedEventC2ERKNS_6StringE
+__ZN7WebCore23BeforeTextInsertedEventD0Ev
+__ZN7WebCore13TypingCommandC1EPNS_8DocumentENS0_14ETypingCommandERKNS_6StringEbNS_15TextGranularityEb
+__ZN7WebCore13TypingCommandC2EPNS_8DocumentENS0_14ETypingCommandERKNS_6StringEbNS_15TextGranularityEb
+__ZN7WebCore20CompositeEditCommandC2EPNS_8DocumentE
+__ZN7WebCore11EditCommandC2EPNS_8DocumentE
+__ZN7WebCore25avoidIntersectionWithNodeERKNS_16VisibleSelectionEPNS_4NodeE
+__ZN7WebCore11EditCommand20setStartingSelectionERKNS_16VisibleSelectionE
+__ZN7WebCore11EditCommand18setEndingSelectionERKNS_16VisibleSelectionE
+__ZN7WebCore12applyCommandEN3WTF10PassRefPtrINS_11EditCommandEEE
+__ZN7WebCore11EditCommand5applyEv
+__ZNK7WebCore16VisibleSelection23isContentRichlyEditableEv
+__ZN7WebCore24isRichlyEditablePositionERKNS_8PositionE
+__ZNK7WebCore11HTMLElement23isContentRichlyEditableEv
+__ZNK7WebCore11EditCommand12updateLayoutEv
+__ZN7WebCore13TypingCommand7doApplyEv
+__ZN7WebCore13TypingCommand10insertTextERKNS_6StringEb
+__ZN7WebCore13TypingCommand28insertTextRunWithoutNewlinesERKNS_6StringEb
+__ZN7WebCore17InsertTextCommandC1EPNS_8DocumentE
+__ZN7WebCore17InsertTextCommandC2EPNS_8DocumentE
+__ZN7WebCore20CompositeEditCommand23applyCommandToCompositeEN3WTF10PassRefPtrINS_11EditCommandEEE
+__ZN7WebCore11EditCommand9setParentEPNS_20CompositeEditCommandE
+__ZN7WebCore17InsertTextCommand7doApplyEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11EditCommandEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11EditCommandEEELm0EE15reserveCapacityEm
+__ZN7WebCore17InsertTextCommand5inputERKNS_6StringEb
+__ZN7WebCore25lineBreakExistsAtPositionERKNS_8PositionE
+__ZN7WebCore12isEndOfBlockERKNS_15VisiblePositionE
+__ZN7WebCore10endOfBlockERKNS_15VisiblePositionE
+__ZN7WebCore20CompositeEditCommand23deleteInsignificantTextERKNS_8PositionES3_
+__ZN7WebCore5Range21compareBoundaryPointsERKNS_8PositionES3_
+__ZN7WebCore20CompositeEditCommand38positionAvoidingSpecialElementBoundaryERKNS_8PositionE
+__ZN7WebCore22enclosingAnchorElementERKNS_8PositionE
+__ZN7WebCore17InsertTextCommand23prepareForTextInsertionERKNS_8PositionE
+__ZN7WebCore8Document21createEditingTextNodeERKNS_6StringE
+__ZN7WebCore11EditingTextC1EPNS_8DocumentERKNS_6StringE
+__ZN7WebCore11EditingTextC2EPNS_8DocumentERKNS_6StringE
+__ZN7WebCore20CompositeEditCommand12insertNodeAtEN3WTF10PassRefPtrINS_4NodeEEERKNS_8PositionE
+__ZN7WebCore20CompositeEditCommand16insertNodeBeforeEN3WTF10PassRefPtrINS_4NodeEEES4_
+__ZN7WebCore23InsertNodeBeforeCommandC1EN3WTF10PassRefPtrINS_4NodeEEES4_
+__ZN7WebCore23InsertNodeBeforeCommandC2EN3WTF10PassRefPtrINS_4NodeEEES4_
+__ZN7WebCore23InsertNodeBeforeCommand7doApplyEv
+__ZN7WebCore11EditingText16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore20CompositeEditCommand18insertTextIntoNodeEN3WTF10PassRefPtrINS_4TextEEEjRKNS_6StringE
+__ZN7WebCore25InsertIntoTextNodeCommandC1EN3WTF10PassRefPtrINS_4TextEEEjRKNS_6StringE
+__ZN7WebCore25InsertIntoTextNodeCommandC2EN3WTF10PassRefPtrINS_4TextEEEjRKNS_6StringE
+__ZN7WebCore25InsertIntoTextNodeCommand7doApplyEv
+__ZN7WebCore13CharacterData10insertDataEjRKNS_6StringERi
+__ZN7WebCore6String6insertERKS0_j
+__ZN7WebCore6String6insertEPKtjj
+__ZN7WebCore8Document12textInsertedEPNS_4NodeEjj
+__ZN7WebCore5Range12textInsertedEPNS_4NodeEjj
+__ZN7WebCore20CompositeEditCommand21rebalanceWhitespaceAtERKNS_8PositionE
+__ZN7WebCore16VisibleSelection20setWithoutValidationERKNS_8PositionES3_
+__ZNK7WebCore8Position13computedStyleEv
+__ZNK7WebCore8Position7elementEv
+__ZNK7WebCore12RenderObject14nextInPreOrderEPS0_
+__ZNK7WebCore12RenderObject27nextInPreOrderAfterChildrenEPS0_
+__ZN7WebCore9InlineBox13nextLeafChildEv
+__ZN7WebCore13TypingCommand24typingAddedToOpenCommandEv
+__ZN7WebCore6Editor14appliedEditingEN3WTF10PassRefPtrINS_11EditCommandEEE
+__ZN7WebCoreL36dispatchEditableContentChangedEventsERKNS_11EditCommandE
+__ZN7WebCore6Editor27changeSelectionAfterCommandERKNS_16VisibleSelectionEbbPNS_11EditCommandE
+__ZN7WebCore31SimplifiedBackwardsTextIterator14handleTextNodeEv
+__ZNK7WebCore13TypingCommand20preservesTypingStyleEv
+__ZN7WebCore5Frame14setTypingStyleEPNS_26CSSMutableStyleDeclarationE
+__ZNK7WebCore13TypingCommand13editingActionEv
+__ZN7WebCore6Editor24respondToChangedContentsERKNS_16VisibleSelectionE
+__ZN7WebCore13TypingCommand27markMisspellingsAfterTypingEv
+__ZNK7WebCore13TypingCommand15isTypingCommandEv
+__ZN7WebCore9TextEventD0Ev
+__ZN7WebCore13KeyboardEventD0Ev
+__ZN3WTF6VectorIN7WebCore15KeypressCommandELm0EE6shrinkEm
+__ZNK7WebCore17InsertTextCommand19isInsertTextCommandEv
+__ZN7WebCore20CompositeEditCommand23deleteInsignificantTextEN3WTF10PassRefPtrINS_4TextEEEjj
+__ZN7WebCore4Node16dispatchKeyEventERKNS_21PlatformKeyboardEventE
+__ZNK7WebCore4Node29traversePreviousNodePostOrderEPKS0_
+__ZN7WebCore10StringImpl7replaceEjjPS0_
+__ZN7WebCore6Editor37markMisspellingsAfterTypingToPositionERKNS_15VisiblePositionE
+__ZN7WebCore6Editor35isAutomaticQuoteSubstitutionEnabledEv
+__ZN7WebCore6Editor31isAutomaticLinkDetectionEnabledEv
+__ZN7WebCore6Editor34isAutomaticDashSubstitutionEnabledEv
+__ZN7WebCore6Editor33isAutomaticTextReplacementEnabledEv
+__ZN7WebCore6Editor36isAutomaticSpellingCorrectionEnabledEv
+__ZN7WebCoreL12nextBoundaryERKNS_15VisiblePositionEPFjPKtjjNS_33BoundarySearchContextAvailabilityERbE
+__ZN7WebCoreL15endWordBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
+__ZN7WebCoreL29endOfFirstWordBoundaryContextEPKti
+__ZNK7WebCore12RenderObject11isTextFieldEv
+__ZN7WebCore6Editor13didEndEditingEv
+__ZN7WebCore13TypingCommandD0Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11EditCommandEEELm0EE6shrinkEm
+__ZN7WebCore17InsertTextCommandD0Ev
+__ZN7WebCore23InsertNodeBeforeCommandD0Ev
+__ZN7WebCore11EditCommandD2Ev
+__ZN7WebCore25InsertIntoTextNodeCommandD0Ev
+__ZN7WebCore15HTMLBaseElementD0Ev
+__ZN7WebCore11EditingTextD0Ev
+__ZN7WebCore4TextD2Ev
+__ZN7WebCore21HTMLBlockquoteElementD0Ev
+__ZN7WebCore13RootInlineBox23closestLeafChildForXPosEib
+__ZN7WebCore10RenderText16positionForPointERKNS_8IntPointE
+__ZNK7WebCore13InlineTextBox17offsetForPositionEib
+__ZNK7WebCore4Font17offsetForPositionERKNS_7TextRunEib
+__ZNK7WebCore4Font30offsetForPositionForSimpleTextERKNS_7TextRunEib
+__ZN7WebCore13WidthIterator19advanceOneCharacterERfPNS_11GlyphBufferE
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm2048EE14shrinkCapacityEm
+__ZN3WTF6VectorItLm2048EE14shrinkCapacityEm
+__ZN3WTF6VectorI6CGSizeLm2048EE14shrinkCapacityEm
+__ZN7WebCore20UserStyleSheetLoaderC1EN3WTF10PassRefPtrINS_8DocumentEEERKNS_6StringE
+__ZN7WebCore20UserStyleSheetLoaderC2EN3WTF10PassRefPtrINS_8DocumentEEERKNS_6StringE
+__ZN7WebCore9DocLoader24requestUserCSSStyleSheetERKNS_6StringES3_
+__ZN7WebCore5Cache24requestUserCSSStyleSheetEPNS_9DocLoaderERKNS_6StringES5_
+-[WebScriptObject callWebScriptMethod:withArguments:]
+-[WebScriptObject _isSafeScript]
+-[WebScriptObject _rootObject]
+__ZNK3JSC8Bindings10RootObject12globalObjectEv
+__ZNK7WebCore15JSDOMWindowBase16allowsAccessFromEPKN3JSC14JSGlobalObjectE
+-[WebScriptObject _imp]
+__ZN3WTF6VectorIPN7WebCore17SubresourceLoaderELm256EE6shrinkEm
+__ZNK7WebCore11FrameLoader14cancelledErrorERKNS_15ResourceRequestE
+__ZN7WebCore14DocumentLoader20setMainDocumentErrorERKNS_13ResourceErrorE
+__ZN7WebCore11FrameLoader20setMainDocumentErrorEPNS_14DocumentLoaderERKNS_13ResourceErrorE
+__ZN7WebCore14ResourceLoader6cancelEv
+__ZN7WebCore14ResourceLoader6cancelERKNS_13ResourceErrorE
+__ZN7WebCore14ResourceLoader14cancelledErrorEv
+__ZN7WebCore17SubresourceLoader9didCancelERKNS_13ResourceErrorE
+__ZN7WebCore14ResourceLoader9didCancelERKNS_13ResourceErrorE
+__ZN7WebCore14ResourceHandle19clearAuthenticationEv
+__ZN7WebCore27AuthenticationChallengeBase7nullifyEv
+__ZN7WebCore14DocumentLoader27cancelPendingSubstituteLoadEPNS_14ResourceLoaderE
+__ZN7WebCore14ResourceHandle6cancelEv
+__ZN7WebCore20UserStyleSheetLoaderD0Ev
+__ZN7WebCore19CachedCSSStyleSheetD0Ev
+__ZN7WebCoreL30newStreamingTextDecoderUTF16BEERKNS_12TextEncodingEPKv
+__ZN7WebCore14TextCodecUTF166decodeEPKcmbbRb
+__ZN7WebCore14TextCodecUTF16D0Ev
+__ZN7WebCore20UserStyleSheetLoader16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore9CSSParser17createCharsetRuleERKNS_15CSSParserStringE
+__ZN7WebCore14CSSCharsetRuleC1EPNS_13CSSStyleSheetERKNS_6StringE
+__ZN7WebCore14CSSCharsetRuleC2EPNS_13CSSStyleSheetERKNS_6StringE
+__ZN7WebCore9StyleBase15isKeyframesRuleEv
+__ZN3WTF6VectorIPN7WebCore15RenderTableCellELm4EE6shrinkEm
+__ZN7WebCore14RenderMenuList11removeChildEPNS_12RenderObjectE
+__ZN7WebCore14RenderMenuListD0Ev
+__ZN7WebCore17RenderFlexibleBoxD2Ev
+__ZN7WebCore9PageGroup10removePageEPNS_4PageE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE6shrinkEm
+__ZN7WebCore15HTMLFontElementD0Ev
+__ZN3WTF6VectorIPN7WebCore22HTMLFormControlElementELm0EE6shrinkEm
+__ZN7WebCore16HTMLInputElementD0Ev
+__ZN7WebCore16HTMLInputElement23needsActivationCallbackEv
+__ZN7WebCore22HTMLFormControlElement14removeFromFormEv
+__ZN7WebCore16InputElementDataD1Ev
+__ZN7WebCore16InputElementDataD2Ev
+__ZN7WebCore31HTMLFormControlElementWithStateD2Ev
+__ZN3WTF11ListHashSetIPN7WebCore7ElementENS_7PtrHashIS3_EEE15unlinkAndDeleteEPNS_15ListHashSetNodeIS3_EE
+__ZN7WebCore22HTMLFormControlElementD2Ev
+__ZN7WebCore15HTMLImageLoaderD0Ev
+__ZN7WebCore28JSHTMLAnchorElementPrototypeD1Ev
+__ZThn8_N7WebCore17HTMLAnchorElementD0Ev
+__ZN7WebCore28JSHTMLSelectElementPrototypeD1Ev
+__ZN7WebCore19JSHTMLSelectElementD1Ev
+__ZThn8_N7WebCore17HTMLSelectElementD0Ev
+__ZN7WebCore17HTMLSelectElementD0Ev
+__ZN7WebCore17HTMLOptionElementD0Ev
+__ZN7WebCore17OptionElementDataD1Ev
+__ZN7WebCore17OptionElementDataD2Ev
+-[DOMNode hasAttributes]
+__ZNK7WebCore7Element13hasAttributesEv
+__ZN7WebCore20HTMLParagraphElementD0Ev
+__ZN7WebCore14CSSCharsetRuleD0Ev
+__ZN7WebCore8Document19hoveredNodeDetachedEPNS_4NodeE
+__ZN7WebCore11HTMLElement19isRecognizedTagNameERKNS_13QualifiedNameE
+__ZN7WebCore9HTMLNames11getHTMLTagsEPm
+__ZN7WebCore13RenderListBoxC1EPNS_17HTMLSelectElementE
+__ZN7WebCore13RenderListBoxC2EPNS_17HTMLSelectElementE
+__ZN7WebCore13RenderListBox14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore13RenderListBox17updateFromElementEv
+__ZNK7WebCore13RenderListBox8numItemsEv
+__ZN7WebCore13RenderListBox23setHasVerticalScrollbarEb
+__ZN7WebCore13RenderListBox15createScrollbarEv
+__ZN7WebCore14RenderThemeMac27scrollbarControlSizeForPartENS_11ControlPartE
+__ZN7WebCore9Scrollbar21createNativeScrollbarEPNS_15ScrollbarClientENS_20ScrollbarOrientationENS_20ScrollbarControlSizeE
+__ZN7WebCore9ScrollbarC1EPNS_15ScrollbarClientENS_20ScrollbarOrientationENS_20ScrollbarControlSizeEPNS_14ScrollbarThemeE
+__ZN7WebCore9ScrollbarC2EPNS_15ScrollbarClientENS_20ScrollbarOrientationENS_20ScrollbarControlSizeEPNS_14ScrollbarThemeE
+__ZN7WebCore14ScrollbarTheme11nativeThemeEv
+__ZN7WebCore17ScrollbarThemeMacC1Ev
+__ZN7WebCore17ScrollbarThemeMacC2Ev
++[ScrollbarPrefsObserver registerAsObserver]
+__ZN7WebCore17ScrollbarThemeMac18preferencesChangedEv
+__ZN7WebCore17ScrollbarThemeMac17registerScrollbarEPNS_9ScrollbarE
+__ZN3WTF7HashSetIPN7WebCore9ScrollbarENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore9ScrollbarES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore9ScrollbarES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore9ScrollbarES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTabl
+__ZN3WTF9HashTableIPN7WebCore9ScrollbarES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTa
+__ZN7WebCore17ScrollbarThemeMac18scrollbarThicknessENS_20ScrollbarControlSizeE
+__ZN7WebCore9Scrollbar9setParentEPNS_10ScrollViewE
+__ZN7WebCore6Widget16setParentVisibleEb
+__ZN7WebCore9Scrollbar12styleChangedEv
+__ZNK7WebCore13RenderListBox15canHaveChildrenEv
+__ZN7WebCore13RenderListBox16selectionChangedEv
+__ZN7WebCore16HTMLInputElement10setCheckedEbb
+__ZNK7WebCore5Theme14controlPaddingENS_11ControlPartERKNS_4FontERKNS_9LengthBoxEf
+__ZN7WebCoreL13checkboxSizesEv
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_16HTMLInputElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3addERKS
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_16HTMLInputElementEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3
+__ZN7WebCoreL10radioSizesEv
+__ZN7WebCore13RenderListBox14calcPrefWidthsEv
+__ZN7WebCore13RenderListBox6layoutEv
+__ZNK7WebCore13RenderListBox22verticalScrollbarWidthEv
+__ZN7WebCore13RenderListBox10calcHeightEv
+__ZNK7WebCore13RenderListBox10itemHeightEv
+__ZNK7WebCore13RenderListBox4sizeEv
+__ZNK7WebCore13RenderListBox15numVisibleItemsEv
+__ZN7WebCore9Scrollbar10setEnabledEb
+__ZN7WebCore9Scrollbar14invalidateRectERKNS_7IntRectE
+__ZThn200_N7WebCore13RenderListBox23invalidateScrollbarRectEPNS_9ScrollbarERKNS_7IntRectE
+__ZN7WebCore13RenderListBox23invalidateScrollbarRectEPNS_9ScrollbarERKNS_7IntRectE
+__ZN7WebCore9Scrollbar8setStepsEiii
+__ZN7WebCore9Scrollbar13setProportionEii
+__ZN7WebCore9Scrollbar21updateThumbProportionEv
+__ZN7WebCore23ScrollbarThemeComposite14invalidatePartEPNS_9ScrollbarENS_13ScrollbarPartE
+__ZN7WebCore17ScrollbarThemeMac9trackRectEPNS_9ScrollbarEb
+__ZN7WebCore17ScrollbarThemeMac10hasButtonsEPNS_9ScrollbarE
+__ZN7WebCore23ScrollbarThemeComposite10splitTrackEPNS_9ScrollbarERKNS_7IntRectERS3_S6_S6_
+__ZN7WebCore23ScrollbarThemeComposite31constrainTrackRectToTrackPiecesEPNS_9ScrollbarERKNS_7IntRectE
+__ZN7WebCore23ScrollbarThemeComposite13thumbPositionEPNS_9ScrollbarE
+__ZN7WebCore23ScrollbarThemeComposite11thumbLengthEPNS_9ScrollbarE
+__ZNK7WebCore13RenderListBox14hasControlClipEv
+__ZN7WebCore13RenderListBox23scrollToRevealSelectionEv
+__ZNK7WebCore17HTMLSelectElement29activeSelectionStartListIndexEv
+__ZNK7WebCore17HTMLSelectElement27activeSelectionEndListIndexEv
+__ZN7WebCore13RenderListBox18listIndexIsVisibleEi
+__ZNK7WebCore13RenderListBox16baselinePositionEbb
+__ZN7WebCore23ScrollbarThemeComposite11trackLengthEPNS_9ScrollbarE
+__ZN7WebCore17ScrollbarThemeMac18minimumThumbLengthEPNS_9ScrollbarE
+__ZNK7WebCore11RenderTheme16baselinePositionEPKNS_12RenderObjectE
+__ZNK7WebCore8ThemeMac26baselinePositionAdjustmentENS_11ControlPartE
+__ZN7WebCore11RenderTable19paintBoxDecorationsERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore15GraphicsContext17drawConvexPolygonEmPKNS_10FloatPointEb
+__ZNK7WebCore5Color4darkEv
+__ZN7WebCore13RenderListBox11paintObjectERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore14RenderThemeMac13paintTextAreaEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore13RenderListBox14paintScrollbarERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore9Scrollbar12setFrameRectERKNS_7IntRectE
+__ZNK7WebCore9FrameView17windowResizerRectEv
+__ZNK7WebCore6Chrome17windowResizerRectEv
+__ZNK7WebCore6Widget27convertFromContainingWindowERKNS_7IntRectE
+__ZN7WebCore9Scrollbar5paintEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore17ScrollbarThemeMac5paintEPNS_9ScrollbarEPNS_15GraphicsContextERKNS_7IntRectE
+__ZThn200_NK7WebCore13RenderListBox8isActiveEv
+__ZNK7WebCore13RenderListBox8isActiveEv
+__ZN7WebCore17ScrollbarThemeMac8hasThumbEPNS_9ScrollbarE
+__ZNK7WebCore13RenderListBox15controlClipRectEii
+__ZN7WebCore13RenderListBox19paintItemBackgroundERNS_12RenderObject9PaintInfoEiii
+__ZThn128_NK7WebCore17HTMLOptionElement8selectedEv
+__ZN7WebCore13RenderListBox19itemBoundingBoxRectEiii
+__ZNK7WebCore11RenderTheme39inactiveListBoxSelectionBackgroundColorEv
+__ZNK7WebCore14RenderThemeMac47platformInactiveListBoxSelectionBackgroundColorEv
+__ZNK7WebCore14RenderThemeMac40platformInactiveSelectionBackgroundColorEv
+__ZN7WebCore13RenderListBox19paintItemForegroundERNS_12RenderObject9PaintInfoEiii
+__ZN7WebCore15GraphicsContext12drawBidiTextERKNS_4FontERKNS_7TextRunERKNS_10FloatPointE
+__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE21createBidiRunsForLineERKS1_bb
+__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE9appendRunEv
+__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE10deleteRunsEv
+__ZNK7WebCore11RenderTheme39inactiveListBoxSelectionForegroundColorEv
+__ZNK7WebCore11RenderTheme40supportsListBoxSelectionForegroundColorsEv
+__ZNK7WebCore14RenderThemeMac47platformInactiveListBoxSelectionForegroundColorEv
+__ZN7WebCoreL8checkboxEjRKNS_7IntRectEf
+__ZN7WebCoreL15checkboxMarginsEm
+__ZN7WebCore36jsHTMLDocumentPrototypeFunctionWriteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSHTMLDocument5writeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCoreL13documentWriteEPN3JSC9ExecStateERKNS0_7ArgListEPNS_12HTMLDocumentENS_18NewlineRequirementE
 __ZN7WebCore15SegmentedString21setExcludeLineNumbersEv
-__ZNK7WebCore14HTMLDivElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore14HTMLDivElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore14HTMLDivElement11tagPriorityEv
-__ZN7WebCore15EventTargetNode16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
-__ZN7WebCore11EventTarget16addEventListenerEPNS_15EventTargetNodeERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
-__ZN7WebCore11EventTarget19removeEventListenerEPNS_15EventTargetNodeERKNS_12AtomicStringEPNS_13EventListenerEb
-__ZN7WebCore5TimerINS_5FrameEE5firedEv
-__ZN7WebCore5Frame21lifeSupportTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore19CachedCSSStyleSheet4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
-__ZN7WebCore19TextResourceDecoder18checkForCSSCharsetEPKcmRb
-__ZN7WebCore19CachedCSSStyleSheet11checkNotifyEv
-__ZThn68_N7WebCore15HTMLLinkElement16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
-__ZN7WebCore15HTMLLinkElement16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
-__ZNK7WebCore19CachedCSSStyleSheet11canUseSheetEb
-__ZN7WebCore15HTMLLinkElement11sheetLoadedEv
-__ZNK7WebCore15HTMLLinkElement9isLoadingEv
-__ZNK7WebCore15HTMLLinkElement5sheetEv
-__ZNK7WebCore16DeprecatedString7findRevEPKci
-__ZNK7WebCore16DeprecatedString7findRevERKS0_ib
-__ZN7WebCore16DeprecatedString6removeEjj
-__ZN7WebCore19DeprecatedValueListIN3WTF6RefPtrINS_23RegisteredEventListenerEEEE8copyNodeEPNS_27DeprecatedValueListImplNodeE
-__ZN7WebCore19DeprecatedValueListIN3WTF6RefPtrINS_23RegisteredEventListenerEEEE10deleteNodeEPNS_27DeprecatedValueListImplNodeE
-__ZNK7WebCore23JSAbstractEventListener19isHTMLEventListenerEv
-__ZN3KJS6Window20jsHTMLEventListenersEv
-__ZN3WTF6VectorIPN7WebCore7ElementELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore7ElementELm0EE15reserveCapacityEm
-__ZN7WebCore10JSDocument16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN3KJS26valueToStringWithNullCheckEPNS_9ExecStateEPNS_7JSValueE
-__ZN7WebCore8Document9setCookieERKNS_6StringE
-__ZN7WebCore10setCookiesEPNS_8DocumentERKNS_4KURLES4_RKNS_6StringE
-__ZN7WebCore8Document26setHTMLWindowEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEE
-__ZN7WebCore8Document29removeHTMLWindowEventListenerERKNS_12AtomicStringE
-__ZNK7WebCore12RenderObject10hasStaticYEv
-__ZN7WebCore9RenderBox32calculateBackgroundImageGeometryEPKNS_15BackgroundLayerEiiiiRNS_7IntRectERNS_8IntPointERNS_7IntSizeE
-__ZNK7WebCore9RenderBox23calculateBackgroundSizeEPKNS_15BackgroundLayerEii
-__ZN7WebCore11CachedImage21setImageContainerSizeERKNS_7IntSizeE
-__ZN7WebCore5Image16setContainerSizeERKNS_7IntSizeE
-__ZNK7WebCore9RenderBox30offsetForPositionedInContainerEPNS_12RenderObjectE
-__ZN3KJS14DOMWindowTimer5firedEv
-__ZN3KJS6Window10timerFiredEPNS_14DOMWindowTimerE
-__ZN7WebCore15ScheduledAction7executeEPN3KJS6WindowE
-__ZN7WebCore36jsHTMLDocumentPrototypeFunctionWriteEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore14JSHTMLDocument5writeEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore14isTableRelatedEPNS_4NodeE
-__ZN7WebCore11isTablePartEPNS_4NodeE
-__ZN7WebCore12RenderObject12imageChangedEPNS_11CachedImageE
-__ZN3KJS17staticValueGetterIN7WebCore10JSDocumentEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore10JSDocument16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore8Document6cookieEv
-__ZN7WebCore7cookiesEPKNS_8DocumentERKNS_4KURLE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EE15reserveCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EE6shrinkEm
+__ZN7WebCore10HTMLParser11isHeaderTagERKNS_12AtomicStringE
+__ZNK7WebCore10HTMLParser8isInlineEPNS_4NodeE
+__ZThn8_N7WebCore20HTMLTableCellElementD0Ev
+__ZN7WebCore11RenderTable11splitColumnEii
+__ZN7WebCore18RenderTableSection11splitColumnEii
+__ZN7WebCore9FrameView14setMarginWidthEi
+__ZN7WebCore9FrameView15setMarginHeightEi
+__ZN7WebCore12RenderObject28addChildIgnoringContinuationEPS0_S1_
+__ZNK7WebCore11HistoryItem6targetEv
+__ZNK7WebCore13HTMLTokenizer14processingDataEv
+__ZN7WebCoreL19alternateFamilyNameERKNS_12AtomicStringE
+__ZN7WebCore11BitmapImage20frameDurationAtIndexEm
+__ZN7WebCore18RenderTextFragment7destroyEv
+__ZN7WebCore18RenderTextFragmentD0Ev
+__ZN7WebCore12RenderButton11removeChildEPNS_12RenderObjectE
+__ZN7WebCore12RenderButtonD0Ev
+__ZNK7WebCore6String8toDoubleEPb
+__ZN7WebCore10StringImpl8toDoubleEPb
+__ZN7WebCore11FrameLoader23scheduleHTTPRedirectionEdRKNS_6StringE
+__ZN7WebCore11FrameLoader16isLocationChangeERKNS_20ScheduledRedirectionE
+__ZN7WebCore19inputElementAltTextEv
+__ZNK7WebCore13HTMLHRElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore13HTMLHRElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore10HTMLParser19mapCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore14HTMLMapElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14HTMLMapElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14HTMLMapElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore8Document14removeImageMapEPNS_14HTMLMapElementE
+__ZN7WebCore8Document11addImageMapEPNS_14HTMLMapElementE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_14HTMLMapElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PNS1_14HTMLMapElementEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_E
+__ZNK7WebCore14HTMLMapElement17endTagRequirementEv
+__ZNK7WebCore14HTMLMapElement11tagPriorityEv
+__ZN7WebCore14HTMLMapElement8checkDTDEPKNS_4NodeE
+__ZN7WebCoreL15areaConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore15HTMLAreaElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLAreaElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLAreaElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore14newCoordsArrayERKNS_6StringERi
+__ZN7WebCoreL14countCharacterEPKtjt
+__ZN7WebCoreL11parseLengthEPKtj
+__ZN7WebCore21charactersToIntStrictEPKtmPbi
+__ZNK7WebCore15HTMLAreaElement17endTagRequirementEv
+__ZNK7WebCore15HTMLAreaElement11tagPriorityEv
+__ZNK7WebCore11BitmapImage10solidColorEv
+__ZN7WebCore5Image18fillWithSolidColorEPNS_15GraphicsContextERKNS_9FloatRectERKNS_5ColorENS_17CompositeOperatorE
+__ZN7WebCoreL5radioEjRKNS_7IntRectEf
+__ZN7WebCoreL12radioMarginsEm
+__ZN7WebCore5TimerINS_11BitmapImageEE5firedEv
+__ZN7WebCore11BitmapImage16advanceAnimationEPNS_5TimerIS0_EE
+__ZN7WebCore11BitmapImage24internalAdvanceAnimationEb
+__ZN7WebCore5TimerINS_11BitmapImageEED0Ev
+__ZThn392_N7WebCore11CachedImage20shouldPauseAnimationEPKNS_5ImageE
+__ZN7WebCore11CachedImage20shouldPauseAnimationEPKNS_5ImageE
+__ZN7WebCore20CachedResourceClient15willRenderImageEPNS_11CachedImageE
 __ZN7WebCore10HTMLParser24framesetCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore19framesetConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore19HTMLFrameSetElementC2EPNS_8DocumentE
+__ZN7WebCoreL19framesetConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore19HTMLFrameSetElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19HTMLFrameSetElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZNK7WebCore19HTMLFrameSetElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
 __ZN7WebCore19HTMLFrameSetElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore6String13toLengthArrayERi
-__ZN7WebCore10StringImpl13toLengthArrayERi
+__ZN7WebCore14newLengthArrayERKNS_6StringERi
 __ZNK7WebCore19HTMLFrameSetElement17endTagRequirementEv
 __ZNK7WebCore19HTMLFrameSetElement11tagPriorityEv
 __ZN7WebCore19HTMLFrameSetElement6attachEv
 __ZN7WebCore19HTMLFrameSetElement16rendererIsNeededEPNS_11RenderStyleE
 __ZNK7WebCore11RenderStyle16isStyleAvailableEv
 __ZN7WebCore19HTMLFrameSetElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore14RenderFrameSetC1EPNS_19HTMLFrameSetElementE
 __ZN7WebCore14RenderFrameSetC2EPNS_19HTMLFrameSetElementE
+__ZN7WebCore14RenderFrameSet8GridAxisC1Ev
 __ZN7WebCore14RenderFrameSet8GridAxisC2Ev
+__ZNK7WebCore14RenderFrameSet15virtualChildrenEv
 __ZN7WebCore19HTMLFrameSetElement8checkDTDEPKNS_4NodeE
 __ZNK7WebCore14RenderFrameSet10isFrameSetEv
-__ZN7WebCore16frameConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLFrameElementC2EPNS_8DocumentE
+__ZN7WebCoreL16frameConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLFrameElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLFrameElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore16HTMLFrameElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZNK7WebCore16HTMLFrameElement17endTagRequirementEv
 __ZNK7WebCore16HTMLFrameElement11tagPriorityEv
 __ZN7WebCore16HTMLFrameElement6attachEv
 __ZN7WebCore16HTMLFrameElement16rendererIsNeededEPNS_11RenderStyleE
 __ZN7WebCore16HTMLFrameElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore11RenderFrameC1EPNS_16HTMLFrameElementE
 __ZN7WebCore11RenderFrameC2EPNS_16HTMLFrameElementE
 __ZNK7WebCore14RenderFrameSet14isChildAllowedEPNS_12RenderObjectEPNS_11RenderStyleE
 __ZNK7WebCore11RenderFrame7isFrameEv
+__ZN7WebCore14RenderFrameSet15virtualChildrenEv
+__ZN3WTF6VectorIPN7WebCore5FrameELm16EE6shrinkEm
 __ZN7WebCore11RenderFrame11viewClearedEv
-__ZN7WebCore10HTMLParser24noframesCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
 __ZN7WebCore14RenderFrameSet6layoutEv
 __ZN7WebCore14RenderFrameSet8GridAxis6resizeEi
-__ZN3WTF6VectorIbLm0EE6resizeEm
 __ZN7WebCore14RenderFrameSet10layOutAxisERNS0_8GridAxisEPKNS_6LengthEi
 __ZN7WebCore14RenderFrameSet14positionFramesEv
+__ZN7WebCore9RenderBox6layoutEv
 __ZN7WebCore14RenderFrameSet15computeEdgeInfoEv
 __ZN3WTF6VectorIbLm0EE4fillERKbm
 __ZSt4fillIPbbEvT_S1_RKT0_
 __ZNK7WebCore11RenderFrame8edgeInfoEv
 __ZN3WTF6VectorIbLm0EEaSERKS1_
 __ZN7WebCore14RenderFrameSet16fillFromEdgeInfoERKNS_13FrameEdgeInfoEii
+__ZNK7WebCore9RenderBox11overflowTopEb
+__ZNK7WebCore9RenderBox12overflowLeftEb
 __ZN7WebCore14RenderFrameSet5paintERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore6Editor17insideVisibleAreaERKNS_8IntPointE
 __ZN7WebCore14RenderFrameSet11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
 __ZN7WebCore19HTMLFrameSetElement19defaultEventHandlerEPNS_5EventE
 __ZN7WebCore14RenderFrameSet10userResizeEPNS_10MouseEventE
-__ZNK7WebCore9DOMWindow6parentEv
-__ZN7WebCore14JSHTMLDocument16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore11RenderFrameD0Ev
+__ZN3WTF6VectorIPN7WebCore16HTMLImageElementELm0EE6shrinkEm
+__ZN7WebCore14RenderFrameSetD0Ev
+__ZN7WebCore12RenderObject15willRenderImageEPNS_11CachedImageE
+__ZThn8_N7WebCore15HTMLHtmlElementD0Ev
+__ZThn8_N7WebCore15HTMLBodyElementD0Ev
+__ZN7WebCore10HTMLParser39handleResidualStyleCloseTagAcrossBlocksEPNS_13HTMLStackElemE
+__ZN7WebCore10HTMLParser19moveOneBlockToStackERPNS_13HTMLStackElemE
+__ZN7WebCore12NamedNodeMap13setAttributesERKS0_
+__ZN7WebCore18NamedMappedAttrMap15clearAttributesEv
+__ZN7WebCore12NamedNodeMap15clearAttributesEv
+__ZNK7WebCore15MappedAttribute5cloneEv
+__ZN7WebCore14JSHTMLDocument10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore6StringC1ERKN3JSC10IdentifierE
+__ZN7WebCore6StringC2ERKN3JSC10IdentifierE
+__ZN7WebCore8Document18documentNamedItemsERKNS_6StringE
+__ZN7WebCore18HTMLNameCollectionC1EN3WTF10PassRefPtrINS_8DocumentEEENS_14CollectionTypeERKNS_6StringE
+__ZN7WebCore18HTMLNameCollectionC2EN3WTF10PassRefPtrINS_8DocumentEEENS_14CollectionTypeERKNS_6StringE
+__ZN7WebCore8Document18nameCollectionInfoENS_14CollectionTypeERKNS_12AtomicStringE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_15CollectionCacheENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3addERKS3
+__ZNK7WebCore18HTMLNameCollection9itemAfterEPNS_7ElementE
+__ZNK7WebCore14HTMLCollection9firstItemEv
+__ZN7WebCore18HTMLNameCollectionD0Ev
+__ZN7WebCore15HTMLFormElement15addElementAliasEPNS_22HTMLFormControlElementERKNS_12AtomicStringE
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEENS1_INS2_22HTMLFormControlElementEEENS_7PtrHashIS4_EENS_10HashTraitsI
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore16AtomicStringImplEEESt4pairIS4_NS1_INS2_22HTMLFormControlElementEEEENS_18PairFirstExtra
+__ZN7WebCore17JSHTMLFormElement10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEENS1_INS2_22HTMLFormControlElementEEENS_7PtrHashIS4_EENS_10HashTraits
+__ZN7WebCore15FormDataBuilder17parseEncodingTypeERKNS_6StringE
+__ZN7WebCore15HTMLFormElement19removedFromDocumentEv
+__ZN7WebCore15HTMLFormElement16removeImgElementEPNS_16HTMLImageElementE
+__ZN7WebCore26JSHTMLFormElementPrototypeD1Ev
+__ZN7WebCore19HTMLFrameSetElementD0Ev
+__ZN7WebCore16HTMLFrameElementD0Ev
+__ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_8IntPointENS_17CompositeOperatorE
+__ZN7WebCore15GraphicsContext9drawImageEPNS_5ImageERKNS_8IntPointERKNS_7IntRectENS_17CompositeOperatorE
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_14HTMLMapElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3
+__ZN7WebCore14HTMLMapElement13mapMouseEventEiiRKNS_7IntSizeERNS_13HitTestResultE
+__ZN7WebCore15HTMLAreaElement13mapMouseEventEiiRKNS_7IntSizeERNS_13HitTestResultE
+__ZNK7WebCore15HTMLAreaElement9getRegionERKNS_7IntSizeE
+__ZN7WebCore4Path10addEllipseERKNS_9FloatRectE
+__ZNK7WebCore4Path8containsERKNS_10FloatPointENS_8WindRuleE
+__ZNK7WebCore4Path12boundingRectEv
+__ZN7WebCoreL34copyClosingSubpathsApplierFunctionEPvPK13CGPathElement
+__ZN7WebCore9PageCache11autoreleaseEN3WTF10PassRefPtrINS_10CachedPageEEE
+__ZN3WTF7HashSetINS_6RefPtrIN7WebCore10CachedPageEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore10CachedPageEEES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E
+__ZN7WebCore9PageCache17removeFromLRUListEPNS_11HistoryItemE
+__ZN7WebCore16HTMLInputElement37registerForActivationCallbackIfNeededEv
+__ZNK7WebCore13HTMLTokenizer15isHTMLTokenizerEv
+__ZN7WebCore7Element26documentWillBecomeInactiveEv
+__ZN7WebCore21DeprecatedPtrListImpl4prevEv
+__ZN7WebCore21setJSDOMWindowOnerrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow10setOnerrorEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZThn8_N7WebCore19HTMLTableRowElementD0Ev
+__ZN7WebCore14HTMLMapElementD0Ev
+__ZN7WebCore15HTMLAreaElementD0Ev
+__ZN7WebCore17HTMLAnchorElementD2Ev
+__ZThn32_NK7WebCore8DOMTimer10canSuspendEv
+__ZNK7WebCore8DOMTimer10canSuspendEv
+__ZThn32_N7WebCore8DOMTimer7suspendEv
+__ZN7WebCore8DOMTimer7suspendEv
+__ZN7WebCoreL19basefontConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore19HTMLBaseFontElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19HTMLBaseFontElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore19HTMLBaseFontElement17endTagRequirementEv
+__ZNK7WebCore19HTMLBaseFontElement11tagPriorityEv
+__ZNK7WebCore18RenderTextFragment12originalTextEv
+__ZN7WebCore18RenderTextFragment15setTextInternalEN3WTF10PassRefPtrINS_10StringImplEEE
+__ZN7WebCore18RenderTextFragment17previousCharacterEv
+__ZN7WebCore10RenderText17previousCharacterEv
+__ZNK7WebCore12RenderObject18previousInPreOrderEv
+__ZN7WebCore10StringImpl10capitalizeEt
+__ZN7WebCore17wordBreakIteratorEPKti
+__ZN7WebCore14textBreakFirstEPNS_17TextBreakIteratorE
+__ZNK7WebCore11RenderBlock20firstLineBoxBaselineEv
+__ZN7WebCore15RenderTableCell15setOverrideSizeEi
+__ZNK7WebCore6String11toIntStrictEPbi
+__ZN7WebCore10StringImpl11toIntStrictEPbi
+__ZN7WebCore4Node21setTabIndexExplicitlyEs
+__ZNK7WebCore12NamedNodeMap14mapsEquivalentEPKS0_
+__ZN7WebCore17HTMLScriptElement19removedFromDocumentEv
+__ZN7WebCore13ScriptElement19removedFromDocumentERNS_17ScriptElementDataE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsI
+__ZN7WebCoreL28createHTMLAreaElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLAreaElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLAreaElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLAreaElementEEE
+__ZN7WebCore17JSHTMLAreaElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLAreaElementEEE
+__ZN7WebCoreL14isTableRelatedEPKNS_4NodeE
+__ZN7WebCoreL11isTablePartEPKNS_4NodeE
+__ZN7WebCore16HTMLLabelElementD0Ev
+__ZN7WebCore15jsDOMWindowSelfEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow4selfEv
+__ZNK7WebCore14RenderThemeMac25adjustMenuListButtonStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore14RenderThemeMac19paintMenuListButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac28paintMenuListButtonGradientsEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCoreL23MainGradientInterpolateEPvPKdPd
+__ZN7WebCoreL22TopGradientInterpolateEPvPKdPd
+__ZN7WebCoreL25BottomGradientInterpolateEPvPKdPd
+__ZN7WebCore15GraphicsContext8drawLineERKNS_8IntPointES3_
+__ZN7WebCore15GraphicsContext23addInnerRoundedRectClipERKNS_7IntRectEi
+__ZN7WebCore12RenderObject17drawArcForBoxSideEPNS_15GraphicsContextEiifNS_7IntSizeEiiNS_7BoxSideENS_5ColorERKS5_NS_12EBorderSty
+__ZN7WebCore15GraphicsContext9strokeArcERKNS_7IntRectEii
+__ZN7WebCore27JSHTMLInputElementPrototypeD1Ev
+__ZN7WebCore25JSHTMLCollectionPrototypeD1Ev
+__ZN7WebCore19JSHTMLAllCollectionD1Ev
+__ZN7WebCore5TimerINS_9PageCacheEE5firedEv
+__ZN7WebCore9PageCache39releaseAutoreleasedPagesNowOrRescheduleEPNS_5TimerIS0_EE
+__ZN7WebCore11FrameLoader23timeOfLastCompletedLoadEv
+__ZN7WebCore12userIdleTimeEv
+__ZN7WebCore38jsHTMLDocumentPrototypeFunctionWritelnEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSHTMLDocument7writelnEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore21HTMLBlockquoteElement17endTagRequirementEv
+__ZNK7WebCore21HTMLBlockquoteElement11tagPriorityEv
+__ZN7WebCore13HTMLHRElementD0Ev
+__ZN7WebCore13JSPluginArrayD1Ev
+__ZN7WebCore13JSPluginArrayD2Ev
+__ZN7WebCore8JSPluginD1Ev
+__ZN7WebCore8JSPluginD2Ev
+__ZN7WebCore6PluginD1Ev
+__ZN7WebCore6PluginD2Ev
+__ZN7WebCore6Screen15disconnectFrameEv
+__ZN7WebCore11PluginArrayD1Ev
+__ZN7WebCore16CSSStyleSelector17mapFillAttachmentEPNS_9FillLayerEPNS_8CSSValueE
+__ZN7WebCore9FrameView20addSlowRepaintObjectEv
+__ZNK7WebCore12RenderObject8viewRectEv
+__ZN7WebCore14RenderFrameSet17paintColumnBorderERKNS_12RenderObject9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderFrameSet14paintRowBorderERKNS_12RenderObject9PaintInfoERKNS_7IntRectE
+__ZN7WebCoreL15borderFillColorEv
+__ZN7WebCoreL20borderStartEdgeColorEv
+__ZN7WebCoreL18borderEndEdgeColorEv
+__ZN7WebCore13RenderListBoxD0Ev
+__ZN7WebCore13RenderListBox16destroyScrollbarEv
+__ZN7WebCore9ScrollbarD0Ev
+__ZN7WebCore9Scrollbar17stopTimerIfNeededEv
+__ZN7WebCore17ScrollbarThemeMac19unregisterScrollbarEPNS_9ScrollbarE
+__ZN3WTF9HashTableIPN7WebCore9ScrollbarES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22
+__ZN3WTF9HashTableIPN7WebCore9ScrollbarES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInv
+__ZN3WTF9HashTableIPN7WebCore9ScrollbarES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore8JSScreenD1Ev
+__ZN7WebCore8JSScreenD2Ev
+__ZN7WebCore10CachedPage5clearEv
+__ZN7WebCore11CachedFrameD1Ev
+__ZN7WebCore11CachedFrameD2Ev
+__ZN7WebCore11CachedFrame5clearEv
+__ZN7WebCore9FrameView10clearFrameEv
+__ZN7WebCore21ScriptCachedFrameDataD1Ev
+__ZN7WebCore21ScriptCachedFrameDataD2Ev
+__ZN7WebCore21ScriptCachedFrameData5clearEv
+__ZThn32_N7WebCore8DOMTimer4stopEv
+__ZN7WebCore8DOMTimer4stopEv
+__ZN7WebCore10CachedPageD1Ev
+__ZN7WebCore10CachedPageD2Ev
+__ZN7WebCore10PluginDataD1Ev
+__ZN7WebCore10PluginDataD2Ev
+__ZN3WTF15deleteAllValuesIPN7WebCore10PluginInfoELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN3WTF6VectorIPN7WebCore13MimeClassInfoELm0EE6shrinkEm
+__ZN3WTF15deleteAllValuesIPN7WebCore13MimeClassInfoELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN3WTF6VectorIPN7WebCore10PluginInfoELm0EE6shrinkEm
+__ZN7WebCore14HTMLPreElementD0Ev
+__ZThn8_N7WebCore16HTMLInputElementD0Ev
+__ZThn32_N7WebCore8DOMTimer16contextDestroyedEv
+__ZN7WebCore8DOMTimer16contextDestroyedEv
+__ZN7WebCore15ActiveDOMObject16contextDestroyedEv
+__ZN7WebCore19HTMLBaseFontElementD0Ev
+__ZN7WebCore19JSLocationPrototypeD1Ev
+__ZN7WebCore16HTMLDListElementD0Ev
+__ZN7WebCore12CSSMediaRuleD0Ev
+__ZN7WebCore10MediaQueryD1Ev
+__ZN7WebCore10MediaQueryD2Ev
+__ZN3WTF15deleteAllValuesIPN7WebCore13MediaQueryExpELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN7WebCore26JSHTMLAreaElementPrototypeD1Ev
+__ZN7WebCore17JSHTMLAreaElementD1Ev
+__ZThn8_N7WebCore15HTMLAreaElementD0Ev
+__ZN7WebCore22JSPluginArrayPrototypeD1Ev
+__ZN7WebCore17JSPluginPrototypeD1Ev
+__ZN7WebCore17JSScreenPrototypeD1Ev
+__ZN7WebCore15PurgeableBuffer6createEPKcm
+__ZN7WebCore15PurgeableBufferC1EPcm
+__ZN7WebCore15PurgeableBufferC2EPcm
+__ZN7WebCore15PurgeableBuffer13makePurgeableEb
+__ZN7WebCore12SharedBuffer20adoptPurgeableBufferEPNS_15PurgeableBufferE
+__ZNK7WebCore15PurgeableBuffer4dataEv
+__ZThn392_N7WebCore11CachedImage17animationAdvancedEPKNS_5ImageE
+__ZN7WebCore11CachedImage17animationAdvancedEPKNS_5ImageE
+__ZN7WebCore12SharedBuffer22releasePurgeableBufferEv
+__ZN7WebCore4Path7addRectERKNS_9FloatRectE
+__ZN7WebCore11BitmapImage22frameIsCompleteAtIndexEm
+__ZN7WebCore4Page18removeSchedulePairEN3WTF10PassRefPtrINS_12SchedulePairEEE
+__ZN7WebCore14DocumentLoader10unscheduleEPNS_12SchedulePairE
+__ZN7WebCoreL13unscheduleAllERKN3WTF7HashSetINS0_6RefPtrINS_14ResourceLoaderEEENS0_7PtrHashIS4_EENS0_10HashTraitsIS4_EEEEPNS_12
+-[DOMStyleSheetList item:]
+__Z3kitPN7WebCore10StyleSheetE
+__Z8kitClassPN7WebCore10StyleSheetE
+-[DOMCSSStyleSheet cssRules]
+__Z3kitPN7WebCore11CSSRuleListE
+-[DOMCSSRuleList length]
+-[DOMCSSStyleSheet insertRule:index:]
+__ZN7WebCore13CSSStyleSheet10insertRuleERKNS_6StringEjRi
+__ZN7WebCore9CSSParser9parseRuleEPNS_13CSSStyleSheetERKNS_6StringE
+__ZN7WebCore9StyleList6insertEjN3WTF10PassRefPtrINS_9StyleBaseEEE
+__ZN7WebCore13CSSStyleSheet17styleSheetChangedEv
+-[DOMCSSRuleList item:]
+__Z3kitPN7WebCore7CSSRuleE
+__Z8kitClassPN7WebCore7CSSRuleE
+-[DOMCSSStyleRule style]
+-[DOMCSSStyleDeclaration setCssText:]
+__ZN7WebCore26CSSMutableStyleDeclaration10setCssTextERKNS_6StringERi
+-[DOMElement clientHeight]
+__ZN7WebCore7Element12clientHeightEv
+-[DOMDocument createDocumentFragment]
+-[DOMNode lastChild]
+-[DOMElement getElementsByTagName:]
+-[DOMHTMLElement setInnerHTML:]
+-[DOMStyleSheet ownerNode]
+-[DOMNode setTextContent:]
+__ZN7WebCore4Node14setTextContentERKNS_6StringERi
+-[DOMCSSStyleRule selectorText]
+__ZNK7WebCore11RenderTable20firstLineBoxBaselineEv
+__ZNK7WebCore18RenderTableSection20firstLineBoxBaselineEv
+__ZN7WebCore16MIMETypeRegistry24isSupportedImageMIMETypeERKNS_6StringE
+-[DOMNode replaceChild:oldChild:]
+__ZN7WebCore17HTMLObjectElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore17HTMLObjectElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore16MIMETypeRegistry20isJavaAppletMIMETypeERKNS_6StringE
+__ZNK3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_15CaseFoldingHashENS_10HashTraitsIS3_EES8_E8conta
+__ZN7WebCoreL12isURLAllowedEPNS_8DocumentERKNS_6StringE
+__ZNK7WebCore17HTMLPlugInElement4nameEv
+__ZN7WebCore11FrameLoader13requestObjectEPNS_10RenderPartERKNS_6StringERKNS_12AtomicStringES5_RKN3WTF6VectorIS3_Lm0EEESD_
+__ZN7WebCore11FrameLoader15shouldUsePluginERKNS_4KURLERKNS_6StringEbRb
+__ZN7WebCore11FrameLoader10loadPluginEPNS_10RenderPartERKNS_4KURLERKNS_6StringERKN3WTF6VectorIS6_Lm0EEESD_b
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_15CaseFoldingHashENS_10HashTraitsIS3_EES8_E15deall
+__ZNK7WebCore14CachedResource9wasPurgedEv
+-[DOMCSSRuleList dealloc]
+-[DOMCSSRule dealloc]
+-[DOMStyleSheet dealloc]
+__ZN7WebCore4PairD0Ev
+__ZN7WebCore11ShadowValueD0Ev
+-[DOMHTMLElement innerHTML]
+__ZN7WebCore21HTMLFrameOwnerElement10willRemoveEv
+__ZN7WebCore10RenderView12removeWidgetEPNS_12RenderWidgetE
+__ZN3WTF9HashTableIPN7WebCore12RenderWidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_N
+__ZN3WTF9HashTableIPN7WebCore12RenderWidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAn
+__ZN3WTF9HashTableIPN7WebCore12RenderWidgetES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS
+__ZN7WebCore16ScriptController29cleanupScriptObjectsForPluginEPv
+__ZN3WTF9HashTableIPvSt4pairIS1_NS_6RefPtrIN3JSC8Bindings10RootObjectEEEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS1_EENS_14Pai
+__ZN7WebCore17HTMLObjectElement19removedFromDocumentEv
+-[DOMNode removeChild:]
+__ZN7WebCore14RenderTableRow29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore17HTMLObjectElementD0Ev
+__ZN7WebCore22HTMLPlugInImageElementD2Ev
+__ZN7WebCore17HTMLPlugInElementD2Ev
+__ZN7WebCore33setDefaultThreadViolationBehaviorENS_23ThreadViolationBehaviorENS_20ThreadViolationRoundE
+__ZN7WebCore11FrameLoader18setLocalLoadPolicyENS0_15LocalLoadPolicyE
+__ZN7WebCore18MainResourceLoader9didCancelERKNS_13ResourceErrorE
+__ZN7WebCore11FrameLoader25receivedMainResourceErrorERKNS_13ResourceErrorEb
+__ZN7WebCore11FrameLoader4stopEv
+__ZNK7WebCore17ResourceErrorBase8lazyInitEv
+__ZN7WebCore13ResourceError16platformLazyInitEv
+__ZN7WebCore11FrameLoader31invalidateCurrentItemCachedPageEv
+__ZN7WebCore14DocumentLoader17mainReceivedErrorERKNS_13ResourceErrorEb
+__ZN7WebCore11FrameLoader25mainReceivedCompleteErrorEPNS_14DocumentLoaderERKNS_13ResourceErrorE
+__ZN7WebCore11FrameLoader20clearProvisionalLoadEv
+-[DOMNode finalize]
+-[WebScriptObject finalize]
+__ZN7WebCore13HTMLTokenizer26parseProcessingInstructionERNS_15SegmentedStringENS0_5StateE
+__ZN7WebCore9CSSParser24parseTransitionShorthandEb
+__ZN7WebCore9CSSParser22parseAnimationPropertyEv
+__ZN7WebCore9CSSParser17addAnimationValueERN3WTF6RefPtrINS_8CSSValueEEENS1_10PassRefPtrIS3_EE
+__ZN7WebCore11FrameLoader10gotoAnchorERKNS_6StringE
+__ZN7WebCore8Document10findAnchorERKNS_6StringE
+__ZNK7WebCore17HTMLAnchorElement4nameEv
+__ZN7WebCore8Document12setCSSTargetEPNS_7ElementE
+__ZNK7WebCore13ContainerNode7getRectEv
+__ZNK7WebCore13ContainerNode18getUpperLeftCornerERNS_10FloatPointE
+__ZNK7WebCore13ContainerNode19getLowerRightCornerERNS_10FloatPointE
+__ZN7WebCore39jsElementPrototypeFunctionQuerySelectorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4Node13querySelectorERKNS_6StringERi
+__ZN7WebCore9CSSParser13parseSelectorERKNS_6StringEPNS_8DocumentERNS_15CSSSelectorListE
+__ZN7WebCoreL32selectorNeedsNamespaceResolutionERKNS_15CSSSelectorListE
+__ZN7WebCoreL18forEachTagSelectorINS_39SelectorNeedsNamespaceResolutionFunctorEEEbRT_PNS_11CSSSelectorE
+__ZN7WebCore43jsDocumentPrototypeFunctionQuerySelectorAllEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4Node16querySelectorAllERKNS_6StringERi
+__ZN7WebCore22createSelectorNodeListEPNS_4NodeERKNS_15CSSSelectorListE
+__ZNK7WebCore16CSSStyleSelector15SelectorChecker13checkSelectorEPNS_11CSSSelectorEPNS_7ElementE
+__ZNK7WebCore14StaticNodeList6lengthEv
+__ZNK7WebCore14StaticNodeList12itemWithNameERKNS_12AtomicStringE
+-[DOMHTMLElement innerText]
+__ZNK7WebCore7Element9innerTextEv
+-[DOMDocument createExpression:resolver:]
+__ZN7WebCore8Document16createExpressionERKNS_6StringEPNS_15XPathNSResolverERi
+__ZN7WebCore5XPath12LocationPath15insertFirstStepEPNS0_4StepE
+__Z3kitPN7WebCore15XPathExpressionE
+-[DOMXPathExpression evaluate:type:inResult:]
+__Z4coreP14DOMXPathResult
+__Z3kitPN7WebCore11XPathResultE
+-[DOMXPathResult iterateNext]
+__ZN7WebCore11XPathResult11iterateNextERi
+-[WebCoreSharedBufferData finalize]
+-[DOMXPathExpression finalize]
+-[DOMXPathResult finalize]
+-[DOMNodeList finalize]
+__ZNK7WebCore13HitTestResult16absoluteImageURLEv
+__ZNK7WebCore13HitTestResult17isContentEditableEv
+__ZNK7WebCore13HitTestResult5imageEv
+__ZNK7WebCore13HitTestResult18titleDisplayStringEv
+__ZN7WebCore13displayStringERKNS_6StringEPKNS_4NodeE
+__ZNK7WebCore13HitTestResult11textContentEv
+__ZNK7WebCore13HitTestResult9imageRectEv
+__ZNK7WebCore13HitTestResult16altDisplayStringEv
+__ZNK7WebCore13HitTestResult10isLiveLinkEv
+__ZNK7WebCore17HTMLAnchorElement10isLiveLinkEv
+__ZN7WebCore11FrameLoader19requestFromDelegateERNS_15ResourceRequestERmRNS_13ResourceErrorE
+__ZN7WebCore11FrameLoader29sendRemainingDelegateMessagesEmRKNS_16ResourceResponseEiRKNS_13ResourceErrorE
+__ZN7WebCore14StaticNodeListD0Ev
+__ZNK7WebCore16StyleCachedImage13errorOccurredEv
+__ZN7WebCore16RenderListMarker12imageChangedEPvPKNS_7IntRectE
+__ZNK7WebCore14StaticNodeList4itemEj
+__ZN7WebCore28setJSHTMLAnchorElementTargetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement9setTargetERKNS_12AtomicStringE
+__ZN7WebCore15GraphicsContext15fillRoundedRectERKNS_7IntRectERKNS_7IntSizeES6_S6_S6_RKNS_5ColorE
+__ZN7WebCore15GraphicsContext7addPathERKNS_4PathE
+__ZN7WebCore15GraphicsContext8fillPathEv
+__ZNK7WebCore15GraphicsContext8fillRuleEv
+__ZN7WebCore24JSHTMLElementConstructorD1Ev
+__ZN7WebCore24JSCharacterDataPrototypeD1Ev
+__ZN7WebCore15JSTextPrototypeD1Ev
+__ZN7WebCore17JSNodeConstructorD1Ev
+__ZN7WebCore20JSElementConstructorD1Ev
+__ZN7WebCore18JSEventConstructorD1Ev
+__ZN7WebCore28JSHTMLFormElementConstructorD1Ev
+__ZN7WebCore29JSHTMLInputElementConstructorD1Ev
+__ZN7WebCore30JSHTMLSelectElementConstructorD1Ev
+__ZN7WebCore32JSHTMLTextAreaElementConstructorD1Ev
+__ZN7WebCore30JSHTMLTextAreaElementPrototypeD1Ev
+__ZN7WebCore30JSCSSStyleDeclarationPrototypeD1Ev
+__ZN7WebCore15JSHTMLLIElementD1Ev
+__ZN7WebCore11FrameLoader20checkNewWindowPolicyERKNS_16NavigationActionERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateE
+__ZN7WebCore11PolicyCheck3setERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEERKNS_6StringEPFvPvS3_S7_SA_bESB_
+__ZN7WebCore11FrameLoader28continueAfterNewWindowPolicyENS_12PolicyActionE
+__ZN7WebCore11FrameLoader36callContinueLoadAfterNewWindowPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEERKNS
+__ZN7WebCore11FrameLoader32continueLoadAfterNewWindowPolicyERKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormStateEEERKNS_6Stri
+__ZN7WebCore11RenderStyle17accessTransitionsEv
+__ZN7WebCore16CSSStyleSelector20mapAnimationPropertyEPNS_9AnimationEPNS_8CSSValueE
+__ZN7WebCore24JSHTMLLIElementPrototypeD1Ev
+__ZN7WebCore29JSHTMLHeadingElementPrototypeD1Ev
+-[DOMRange finalize]
+__ZN7WebCore11FrameLoader47callContinueFragmentScrollAfterNavigationPolicyEPvRKNS_15ResourceRequestEN3WTF10PassRefPtrINS_9FormS
+__ZN7WebCore11FrameLoader43continueFragmentScrollAfterNavigationPolicyERKNS_15ResourceRequestEb
+__ZN7WebCore14DocumentLoader32replaceRequestURLForAnchorScrollERKNS_4KURLE
+__ZN7WebCore19ResourceRequestBase6setURLERKNS_4KURLE
+__ZN7WebCore11FrameLoader31addHistoryItemForFragmentScrollEv
+__ZN7WebCore11FrameLoader14scrollToAnchorERKNS_4KURLE
+__ZN7WebCore11FrameLoader28updateHistoryForAnchorScrollEv
+__ZNK7WebCore6Editor7Command11isSupportedEv
+__ZN7WebCoreL9supportedEPNS_5FrameENS_19EditorCommandSourceE
+__ZNK7WebCore6Editor7Command5stateEPNS_5EventE
+__ZN7WebCoreL9stateNoneEPNS_5FrameEPNS_5EventE
+__ZNK7WebCore6Editor7Command9isEnabledEPNS_5EventE
+__ZN7WebCoreL10enabledCutEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCore6Editor11canDHTMLCutEv
+__ZN7WebCore6Editor16dispatchCPPEventERKNS_12AtomicStringENS_21ClipboardAccessPolicyE
+__ZN7WebCore6Editor19newGeneralClipboardENS_21ClipboardAccessPolicyE
+__ZN7WebCore14ClipboardEventC1ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9ClipboardEEE
+__ZN7WebCore14ClipboardEventC2ERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9ClipboardEEE
+__ZN7WebCore9Clipboard15setAccessPolicyENS_21ClipboardAccessPolicyE
+__ZN7WebCore14ClipboardEventD0Ev
+__ZNK7WebCore6Editor6canCutEv
+__ZNK7WebCore6Editor7canCopyEv
+__ZN7WebCoreL29imageElementFromImageDocumentEPNS_8DocumentE
+__ZN7WebCoreL11enabledCopyEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCore6Editor12canDHTMLCopyEv
+__ZN7WebCore6Editor13canDHTMLPasteEv
+__ZNK7WebCore6Editor8canPasteEv
+__ZN7WebCoreL13enabledDeleteEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCoreL7enabledEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCoreL14stateUnderlineEPNS_5FrameEPNS_5EventE
+__ZN7WebCoreL10stateStyleEPNS_5FrameEiPKc
+__ZNK7WebCore6Editor17selectionHasStyleEPNS_19CSSStyleDeclarationE
+__ZN7WebCore26CSSMutableStyleDeclaration11makeMutableEv
+__ZNK7WebCore5Frame22selectionComputedStyleERPNS_4NodeE
+__ZNK7WebCore5Range20editingStartPositionEv
+__ZN7WebCoreL11updateStateEPNS_26CSSMutableStyleDeclarationEPNS_27CSSComputedStyleDeclarationERbRNS_8TriStateE
+__ZNK7WebCore26CSSMutableStyleDeclaration16getPropertyValueEi
+__ZN7WebCoreL27enabledInRichlyEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZNK7WebCore4Node23isContentRichlyEditableEv
+__ZN7WebCoreL29supportedFromMenuOrKeyBindingEPNS_5FrameENS_19EditorCommandSourceE
+__ZN7WebCoreL16stateSuperscriptEPNS_5FrameEPNS_5EventE
+__ZN7WebCoreL14stateSubscriptEPNS_5FrameEPNS_5EventE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9DOMWindowEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9DOMWindowEEELm0EE15reserveCapacityEm
+__ZNK3WTF7HashMapIPN7WebCore9DOMWindowEPNS_6VectorINS_6RefPtrINS1_23RegisteredEventListenerEEELm0EEENS_7PtrHashIS3_EENS_10HashT
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore9DOMWindowEEELm0EE6shrinkEm
+__ZN7WebCore16enclosingIntRectERK7_NSRect
+__ZN7WebCore7IntSizeC1ERK7_NSSize
+__ZN7WebCore7IntSizeC2ERK7_NSSize
+__ZThn4_N7WebCore8Document14removedLastRefEv
+__ZThn4_N7WebCore4TextD0Ev
+__ZThn56_NK7WebCore16HTMLStyleElement4typeEv
+__ZThn56_NK7WebCore16HTMLStyleElement5mediaEv
+__ZThn56_N7WebCore16HTMLStyleElement10setLoadingEb
+__ZThn56_NK7WebCore17HTMLScriptElement21charsetAttributeValueEv
+__ZThn56_NK7WebCore17HTMLScriptElement18typeAttributeValueEv
+__ZThn64_NK7WebCore16HTMLInputElement14constrainValueERKNS_6StringE
+__ZThn64_NK7WebCore16HTMLInputElement11isTextFieldEv
+__ZThn12_N7WebCore13CSSImportRule16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZThn64_NK7WebCore16HTMLInputElement12isAutofilledEv
+__ZN7WebCoreL12toFontWeightEi
+__ZThn64_NK7WebCore16HTMLInputElement13isSearchFieldEv
+__ZThn64_NK7WebCore16HTMLInputElement26placeholderShouldBeVisibleEv
+__ZL16acceptableChoicejj
+__ZThn64_NK7WebCore16HTMLInputElement5valueEv
+__ZN7WebCore7DataRefINS_20StyleFlexibleBoxDataEE6accessEv
+__ZNK7WebCore14RenderThemeMac22setFontFromControlSizeEPNS_16CSSStyleSelectorEPNS_11RenderStyleEj
+__ZThn64_NK7WebCore17HTMLOptionElement31textIndentedToRespectGroupLabelEv
+__ZNK7WebCore14RenderThemeMac18popupButtonPaddingEj
+__ZThn64_NK7WebCore16HTMLInputElement17isInputTypeHiddenEv
+__ZThn44_NK7WebCore8Document10isDocumentEv
+__ZL12betterChoicejijiji
+__ZNK7WebCore7IntRectcv7_NSRectEv
+__ZThn64_NK7WebCore16HTMLInputElement15isPasswordFieldEv
+__ZThn64_N7WebCore16HTMLInputElement6selectEv
+__ZThn64_N7WebCore16HTMLInputElement14cacheSelectionEii
+__ZThn4_N7WebCore4AttrD0Ev
+__ZSt22__get_temporary_bufferIPN7WebCore11RenderLayerEESt4pairIPT_iEiS5_
+__ZSt22__stable_sort_adaptiveIPPN7WebCore11RenderLayerES3_iPFbS2_S2_EEvT_S6_T0_T1_T2_
+__ZSt22__chunk_insertion_sortIPPN7WebCore11RenderLayerEiPFbS2_S2_EEvT_S6_T0_T1_
+__ZSt16__merge_adaptiveIPPN7WebCore11RenderLayerEiS3_PFbS2_S2_EEvT_S6_S6_T0_S7_T1_S7_T2_
+__ZSt17__merge_sort_loopIPPN7WebCore11RenderLayerES3_iPFbS2_S2_EEvT_S6_T0_T1_T2_
+__ZThn268_N7WebCore11CachedImage18decodedSizeChangedEPKNS_5ImageEi
+__ZThn268_N7WebCore11CachedImage7didDrawEPKNS_5ImageE
+__ZThn64_NK7WebCore16HTMLInputElement9isCheckedEv
+__ZThn64_NK7WebCore16HTMLInputElement15isIndeterminateEv
+__ZN7WebCoreL13buttonMarginsEj
+__ZN3WTF9HashTableIPN7WebCore24OverlapTestRequestClientESt4pairIS3_NS1_7IntRectEENS_18PairFirstExtractorIS6_EENS_7PtrHashIS3_EE
+__ZSt16__introsort_loopIPPN7WebCore13InlineTextBoxEiPFbPKS1_S5_EEvT_S8_T0_T1_
+__ZN7WebCore11RenderLayer25setHasHorizontalScrollbarEb
+__ZN7WebCore11RenderLayer23setHasVerticalScrollbarEb
+__ZN7WebCore11RenderLayer15createScrollbarENS_20ScrollbarOrientationE
+__ZN7WebCore11RenderLayer23invalidateScrollbarRectEPNS_9ScrollbarERKNS_7IntRectE
+__ZNK7WebCore11RenderLayer8isActiveEv
+__ZN7WebCore11RenderLayer23hitTestOverflowControlsERNS_13HitTestResultE
+__ZN7WebCore18jsElementOffsetTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7Element9offsetTopEv
+__ZNK7WebCore20RenderBoxModelObject9offsetTopEv
+__ZNK7WebCore12RenderObject12offsetParentEv
+__ZN7WebCoreL18adjustForLocalZoomEiPNS_12RenderObjectE
+__ZN7WebCore36jsDOMWindowPrototypeFunctionScrollToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow8scrollToEii
+__ZN7WebCore9FrameView17setScrollPositionERKNS_8IntPointE
+__ZN7WebCore40jsHTMLFormElementPrototypeFunctionSubmitEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore17JSHTMLFormElement6submitEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore15HTMLFormElement6submitEPNS_5EventEbbb
+__ZN7WebCore9FormState6createEN3WTF10PassRefPtrINS_15HTMLFormElementEEERNS1_6VectorISt4pairINS_6StringES7_ELm0EEENS2_INS_5Frame
+__ZN7WebCore15HTMLFormElement14createFormDataERKNS_7CStringE
+__ZNK7WebCore15HTMLFormElement12dataEncodingEv
+__ZNK7WebCore15HTMLFormElement12isMailtoFormEv
+__ZNK7WebCore15FormDataBuilder12dataEncodingEPNS_8DocumentE
+__ZN7WebCore8FormData6createEv
+__ZN7WebCore12FormDataListC1ERKNS_12TextEncodingE
+__ZN7WebCore12FormDataListC2ERKNS_12TextEncodingE
+__ZN7WebCore16HTMLInputElement14appendFormDataERNS_12FormDataListEb
+__ZN7WebCore12FormDataList12appendStringERKNS_6StringE
+__ZN3WTF6VectorIN7WebCore12FormDataList4ItemELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore12FormDataList4ItemELm0EE15reserveCapacityEm
+__ZN7WebCore7CStringC1EPKc
+__ZN7WebCore7CStringC2EPKc
+__ZN7WebCoreeqERKNS_7CStringES2_
+__ZN7WebCore15FormDataBuilder25addKeyValuePairAsFormDataERN3WTF6VectorIcLm0EEERKNS_7CStringES7_
+__ZN7WebCore15FormDataBuilder22encodeStringAsFormDataERN3WTF6VectorIcLm0EEERKNS_7CStringE
+__ZN3WTF6VectorIN7WebCore12FormDataList4ItemELm0EE6shrinkEm
+__ZN7WebCore8FormData10appendDataEPKvm
+__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIcLm0EEC1ERKS1_
+__ZN3WTF6VectorIcLm0EEC2ERKS1_
+__ZN7WebCoreL26generateFormDataIdentifierEv
+__ZN7WebCore11FrameLoader10submitFormEPKcRKNS_6StringEN3WTF10PassRefPtrINS_8FormDataEEES5_S5_S5_bbNS7_INS_5EventEEENS7_INS_9For
+__ZN7WebCore8FormData13generateFilesEPNS_12ChromeClientE
+__ZN7WebCore19ResourceRequestBase11setHTTPBodyEN3WTF10PassRefPtrINS_8FormDataEEE
+__ZN7WebCore11FrameLoader22scheduleFormSubmissionERKNS_16FrameLoadRequestEbbN3WTF10PassRefPtrINS_5EventEEENS5_INS_9FormStateEEE
+__ZN7WebCore11FrameLoader15loadPostRequestERKNS_15ResourceRequestERKNS_6StringES6_bNS_13FrameLoadTypeEN3WTF10PassRefPtrINS_5Eve
+__ZN7WebCore11setHTTPBodyEP19NSMutableURLRequestN3WTF10PassRefPtrINS_8FormDataEEE
+__ZN7WebCore8FormData6createEPKvm
+__ZN3WTF10RefCountedIN7WebCore9FormStateEE5derefEv
+-[WebCoreResourceHandleAsDelegate connection:didSendBodyData:totalBytesWritten:totalBytesExpectedToWrite:]
+__ZN7WebCore14ResourceLoader11didSendDataEPNS_14ResourceHandleEyy
+__ZN7WebCore14ResourceLoader11didSendDataEyy
+__ZN7WebCore8FormData28removeGeneratedFilesIfNeededEv
+__ZN7WebCore26setJSHTMLFormElementActionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLFormElement9setActionERKNS_6StringE
+__ZN7WebCore14PreloadScanner3endEv
+__ZN7WebCore9Scrollbar8setValueEi
+__ZN7WebCore9Scrollbar13setCurrentPosEf
+__ZNK7WebCore17ScrollbarThemeMac16buttonsPlacementEv
+__ZN7WebCore9Scrollbar19updateThumbPositionEv
+__ZN7WebCore11RenderLayer12valueChangedEPNS_9ScrollbarE
+__ZN7WebCore9FrameView13scheduleEventEN3WTF10PassRefPtrINS_5EventEEENS2_INS_4NodeEEE
+__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EEC1ERKS4_
+__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EEC2ERKS4_
+__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIPN7WebCore14ScheduledEventELm0EE6shrinkEm
+__ZN7WebCore10HTMLParser24noframesCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore16HTMLInputElement13aboutToUnloadEv
+__ZN7WebCore12InputElement13aboutToUnloadERNS_16InputElementDataEPNS_8DocumentE
+__ZThn8_N7WebCore13HTMLTokenizer14notifyFinishedEPNS_14CachedResourceE
+__ZThn56_NK7WebCore17HTMLScriptElement22languageAttributeValueEv
+__ZThn56_NK7WebCore17HTMLScriptElement17forAttributeValueEv
+__ZThn56_N7WebCore15HTMLLinkElement16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore14jsNodeNodeNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLDocumentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSHTMLDocument14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSHTMLDocumentPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZNK7WebCore17HTMLPlugInElement17endTagRequirementEv
+__ZNK7WebCore17HTMLObjectElement11tagPriorityEv
+__ZN7WebCore17HTMLPlugInElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore17HTMLObjectElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore17HTMLObjectElement18updateDocNamedItemEv
+__ZN7WebCoreL16paramConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLParamElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLParamElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLParamElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore16HTMLParamElement17endTagRequirementEv
+__ZNK7WebCore16HTMLParamElement11tagPriorityEv
+__ZN7WebCoreL16embedConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLEmbedElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLEmbedElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLEmbedElement16attributeChangedEPNS_9AttributeEb
+__ZNK7WebCore16HTMLEmbedElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore16HTMLEmbedElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore17jsDOMWindowFramesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSDOMWindowBase11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZNK7WebCore9FrameTree5childEj
+__ZN7WebCoreL17canAccessAncestorEPKNS_14SecurityOriginEPNS_5FrameE
+__ZN7WebCore11HistoryItem12addChildItemEN3WTF10PassRefPtrIS0_EE
+__ZN7WebCoreL27isObjectAncestorContainerOfEPNS_12RenderObjectES1_
+__ZNK7WebCore16HTMLEmbedElement17endTagRequirementEv
+__ZNK7WebCore16HTMLEmbedElement11tagPriorityEv
+__ZN7WebCore16HTMLEmbedElement20insertedIntoDocumentEv
+__ZN7WebCore16HTMLEmbedElement6attachEv
+__ZN7WebCore16HTMLEmbedElement12updateWidgetEv
+__ZN7WebCore17HTMLObjectElement11recalcStyleENS_4Node11StyleChangeE
+__ZN7WebCore17HTMLObjectElement21finishParsingChildrenEv
+__ZN7WebCore9FrameView17addWidgetToUpdateEPNS_16RenderPartObjectE
+__ZN3WTF7HashSetIPN7WebCore16RenderPartObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expan
+__ZN3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehas
+__ZN3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allo
+__ZN3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deal
+__ZN3WTF6VectorIPN7WebCore16RenderPartObjectELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore16RenderPartObjectELm0EE15reserveCapacityEm
+__ZNK7WebCore9FrameView22windowClipRectForLayerEPKNS_11RenderLayerEb
+__ZNK7WebCore11RenderLayer16childrenClipRectEv
+__ZNK7WebCore10ScrollView16contentsToWindowERKNS_7IntRectE
+__ZNK7WebCore6Widget25convertToContainingWindowERKNS_7IntRectE
+__ZN7WebCore9FloatRectC1ERK7_NSRect
+__ZN7WebCore9FloatRectC2ERK7_NSRect
+__ZN7WebCore10FloatPointC1ERK8_NSPoint
+__ZN7WebCore10FloatPointC2ERK8_NSPoint
+__ZN7WebCore9FloatSizeC1ERK7_NSSize
+__ZN7WebCore9FloatSizeC2ERK7_NSSize
+__ZN7WebCore7IntRectC1ERKNS_9FloatRectE
+__ZN7WebCore7IntRectC2ERKNS_9FloatRectE
+__ZNK7WebCore9FrameView14windowClipRectEb
+__ZN7WebCore25PluginMainThreadScheduler9schedulerEv
+__ZN7WebCore25PluginMainThreadSchedulerC1Ev
+__ZN7WebCore25PluginMainThreadSchedulerC2Ev
+__ZN7WebCore25PluginMainThreadScheduler14registerPluginEP4_NPP
+__ZN3WTF7HashMapIP4_NPPNS_5DequeIN7WebCore25PluginMainThreadScheduler4CallEEENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENSA_IS7_EEE3
+__ZN7WebCore16ScriptController20windowScriptNPObjectEv
+__Z23_NPN_CreateScriptObjectP4_NPPPN3JSC8JSObjectEN3WTF10PassRefPtrINS1_8Bindings10RootObjectEEE
+__NPN_CreateObject
+__ZL10jsAllocateP4_NPPP7NPClass
+__NPN_RetainObject
+__NPN_Evaluate
+__ZN3JSC8Bindings22convertNPStringToUTF16EPK9_NPString
+__ZN7WebCore6String26fromUTF8WithLatin1FallbackEPKcm
+__ZN7WebCore6String8fromUTF8EPKcm
+__ZN3JSC8Bindings23convertValueToNPVariantEPNS_9ExecStateENS_7JSValueEP10_NPVariant
+__NPN_GetStringIdentifier
+__ZN7WebCore13IdentifierRep3getEPKc
+__ZN7WebCoreL19stringIdentifierMapEv
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPN7WebCore13IdentifierRepENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSB_IS8_EEE3add
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_PN7WebCore13IdentifierRepEENS_18PairFirstExtractorISA_EENS_7StrHas
+__ZN7WebCoreL13identifierSetEv
+__ZN3WTF7HashSetIPN7WebCore13IdentifierRepENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore13IdentifierRepES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore13IdentifierRepES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore13IdentifierRepES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocat
+__ZN3WTF9HashTableIPN7WebCore13IdentifierRepES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dealloc
+__NPN_Invoke
+__ZN3JSC8Bindings26identifierFromNPIdentifierEPKc
+__ZL22getListFromVariantArgsPN3JSC9ExecStateEPK10_NPVariantjPNS_8Bindings10RootObjectERNS_20MarkedArgumentBufferE
+__ZN3JSC8Bindings14findRootObjectEPNS_14JSGlobalObjectE
+__NPN_ReleaseVariantValue
+__Z35NPN_InitializeVariantWithStringCopyP10_NPVariantPK9_NPString
+__NPN_ReleaseObject
+__NPN_DeallocateObject
+__ZL12jsDeallocateP8NPObject
+__ZN3JSC8Bindings10RootObject11gcUnprotectEPNS_8JSObjectE
+__ZNK3WTF7HashMapIPN3JSC8JSObjectEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3getERKS3_
+__ZN7WebCore14jsDOMWindowTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow3topEv
+__ZN7WebCore26NetscapePlugInStreamLoader6createEPNS_5FrameEPNS_32NetscapePlugInStreamLoaderClientE
+__ZN7WebCore26NetscapePlugInStreamLoaderC1EPNS_5FrameEPNS_32NetscapePlugInStreamLoaderClientE
+__ZN7WebCore26NetscapePlugInStreamLoaderC2EPNS_5FrameEPNS_32NetscapePlugInStreamLoaderClientE
+__ZN7WebCore14ResourceLoader19setShouldBufferDataEb
+__ZN7WebCore14DocumentLoader21addPlugInStreamLoaderEPNS_14ResourceLoaderE
+__ZNK3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8cont
+__ZN3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findI
+__ZN3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47remo
+__ZN3WTF9HashTableIPN7WebCore16RenderPartObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6remov
+__ZN3WTF6VectorIPN7WebCore16RenderPartObjectELm0EE6shrinkEm
+__ZThn28_NK7WebCore8DOMTimer18hasPendingActivityEv
+__ZN7WebCore5TimerINS_13HTMLTokenizerEE5firedEv
+__ZN7WebCore13HTMLTokenizer10timerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore26NetscapePlugInStreamLoader18didReceiveResponseERKNS_16ResourceResponseE
+__ZN7WebCore26NetscapePlugInStreamLoader14didReceiveDataEPKcixb
+__ZN7WebCore26NetscapePlugInStreamLoader16didFinishLoadingEv
+__ZN7WebCore14DocumentLoader24removePlugInStreamLoaderEPNS_14ResourceLoaderE
+__ZN7WebCore26NetscapePlugInStreamLoader16releaseResourcesEv
+__ZN7WebCore26NetscapePlugInStreamLoaderD0Ev
+__ZN7WebCore18jsDOMWindowHistoryEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow7historyEPN3JSC9ExecStateE
+__ZNK7WebCore9DOMWindow7historyEv
+__ZN7WebCore7HistoryC1EPNS_5FrameE
+__ZN7WebCore7HistoryC2EPNS_5FrameE
+__ZN7WebCore9JSHistory15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSHistoryC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7HistoryEEE
+__ZN7WebCore9JSHistoryC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7HistoryEEE
+__ZN7WebCore9JSHistory18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore9JSHistory24customGetOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore7History5frameEv
+__ZN7WebCore15jsHistoryLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7History6lengthEv
+__ZN7WebCore11FrameLoader16getHistoryLengthEv
+__ZN7WebCore11toUserSpaceERK7_NSRectP8NSWindow
+__ZN7WebCore18jsScreenColorDepthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen10colorDepthEv
+__ZN7WebCore22jsDocumentCharacterSetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsNavigatorCookieEnabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9Navigator13cookieEnabledEv
+__ZN7WebCore14cookiesEnabledEPKNS_8DocumentE
+__ZN7WebCoreL29createHTMLTitleElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLTitleElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLTitleElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLTitleElementEEE
+__ZN7WebCore18JSHTMLTitleElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLTitleElementEEE
+__ZN7WebCoreL29createHTMLParamElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLParamElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLParamElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLParamElementEEE
+__ZN7WebCore18JSHTMLParamElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLParamElementEEE
+__ZN7WebCoreL29createHTMLEmbedElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLEmbedElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLEmbedElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLEmbedElementEEE
+__ZN7WebCore18JSHTMLEmbedElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLEmbedElementEEE
+__ZN7WebCore19JSHTMLScriptElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSHTMLTitleElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore15JSHTMLBRElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16ScriptController29createScriptInstanceForWidgetEPNS_6WidgetE
+__ZN7WebCore16ScriptController16createRootObjectEPv
+__ZN3WTF7HashMapIPvNS_6RefPtrIN3JSC8Bindings10RootObjectEEENS_7PtrHashIS1_EENS_10HashTraitsIS1_EENS9_IS6_EEE3setERKS1_RKS6_
+__ZN3JSC8Bindings9CInstanceC1EP8NPObjectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC8Bindings9CInstanceC2EP8NPObjectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC8Bindings8InstanceC2EN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZNK3JSC8Bindings8Instance10rootObjectEv
+__ZN3JSC8Bindings8Instance19createRuntimeObjectEPNS_9ExecStateE
+__ZN3JSC16RuntimeObjectImpC1EPNS_9ExecStateEN3WTF10PassRefPtrINS_8Bindings8InstanceEEE
+__ZN3JSC16RuntimeObjectImpC2EPNS_9ExecStateEN3WTF10PassRefPtrINS_8Bindings8InstanceEEE
+__ZN3JSC8Bindings10RootObject16addRuntimeObjectEPNS_16RuntimeObjectImpE
+__ZN3WTF7HashSetIPN3JSC16RuntimeObjectImpENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocate
+__ZN3JSC16RuntimeObjectImp18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC8Bindings8Instance5beginEv
+__ZN3JSC8Bindings8Instance12virtualBeginEv
+__ZNK3JSC8Bindings9CInstance8getClassEv
+__ZN3JSC8Bindings6CClass11classForIsAEP7NPClass
+__ZNK3WTF7HashMapIP7NPClassPN3JSC8Bindings6CClassENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS9_IS6_EEE3getERKS2_
+__ZN3JSC8Bindings6CClassC1EP7NPClass
+__ZN3JSC8Bindings6CClassC2EP7NPClass
+__ZN3WTF7HashMapIP7NPClassPN3JSC8Bindings6CClassENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS9_IS6_EEE3setERKS2_RKS6_
+__ZN3WTF9HashTableIP7NPClassSt4pairIS2_PN3JSC8Bindings6CClassEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS2_EENS_14PairHashTrait
+__ZNK3JSC8Bindings6CClass10fieldNamedERKNS_10IdentifierEPNS0_8InstanceE
+__ZNK3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPNS2_8Bindings5FieldENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSB_IS8_EEE3getEPS4
+__ZNK3JSC8Bindings6CClass12methodsNamedERKNS_10IdentifierEPNS0_8InstanceE
+__ZNK3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPNS2_8Bindings6MethodENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSB_IS8_EEE3getEPS
+__NPN_UTF8FromIdentifier
+__ZN3JSC8Bindings5Class14fallbackObjectEPNS_9ExecStateEPNS0_8InstanceERKNS_10IdentifierE
+__ZN3JSC8Bindings8Instance3endEv
+__ZN3JSC8Bindings8Instance10virtualEndEv
+__ZN3JSC8Bindings8Instance18getOwnPropertySlotEPNS_8JSObjectEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN7WebCore18JSHTMLParamElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSHTMLEmbedElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSHTMLEmbedElement18canGetItemsForNameEPN3JSC9ExecStateEPNS_16HTMLEmbedElementERKNS1_10IdentifierE
+__ZN7WebCore18JSHTMLEmbedElement24customGetOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16HTMLEmbedElement25renderWidgetForJSBindingsEv
+__ZN7WebCore13jsEventTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11jsEventTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12AtomicStringcvN3JSC7UStringEEv
+__ZN7WebCore8FormDataD1Ev
+__ZN7WebCore8FormDataD2Ev
+__ZN3WTF6VectorIN7WebCore15FormDataElementELm0EE6shrinkEm
+__ZN7WebCore21JSMouseEventPrototypeD1Ev
+__ZN7WebCore18JSUIEventPrototypeD1Ev
+__ZN7WebCore12CachedScriptD0Ev
+__ZN7WebCore17JSHTMLLinkElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore24setJSHTMLLinkElementHrefEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLLinkElement7setHrefERKNS_6StringE
+__ZThn4_N7WebCore7CommentD0Ev
+__ZN7WebCore10ScrollView4hideEv
+__ZN7WebCore6Widget4hideEv
+__ZThn4_N7WebCore16DocumentFragmentD0Ev
+__ZN7WebCore11RenderLayer20setHasVisibleContentEb
+__ZN7WebCore24setJSHTMLDocumentBgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore12HTMLDocument10setBgColorERKNS_6StringE
 __ZN7WebCore15HTMLBodyElement10setBgColorERKNS_6StringE
+__ZN7WebCore24setJSHTMLDocumentFgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore12HTMLDocument10setFgColorERKNS_6StringE
 __ZN7WebCore15HTMLBodyElement7setTextERKNS_6StringE
+__ZN7WebCore26setJSHTMLDocumentLinkColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore12HTMLDocument12setLinkColorERKNS_6StringE
 __ZNK7WebCore15HTMLBodyElement4linkEv
 __ZN7WebCore15HTMLBodyElement7setLinkERKNS_6StringE
+__ZN7WebCore27setJSHTMLDocumentVlinkColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore12HTMLDocument13setVlinkColorERKNS_6StringE
 __ZNK7WebCore15HTMLBodyElement5vLinkEv
 __ZN7WebCore15HTMLBodyElement8setVLinkERKNS_6StringE
-__ZN7WebCore16HTMLFrameElementD1Ev
-__ZN7WebCore8Document18determineParseModeERKNS_6StringE
-__ZN7WebCore28processingInstructionHandlerEPvPKhS2_
-__ZN7WebCore12XMLTokenizer21processingInstructionEPKhS2_
-__ZN7WebCore8Document27createProcessingInstructionERKNS_6StringES3_Ri
-__ZN7WebCore21ProcessingInstructionC2EPNS_8DocumentERKNS_6StringES5_
-__ZN7WebCore21ProcessingInstruction15checkStyleSheetEv
-__ZN7WebCore15parseAttributesERKNS_6StringERb
-__ZN7WebCore31attributesStartElementNsHandlerEPvPKhS2_S2_iPS2_iiS3_
-__ZNK3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_iENS_18PairFirstExtractorIS5_EENS1_15CaseFoldingHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSA_IiEEEESB_E4findIS3_NS_22IdentityHashTranslatorIS3_S5_S8_EEEENS_22HashTableConstIteratorIS3_S5_S7_S8_SD_SB_EERKT_
-__ZN7WebCore7Element14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZNK7WebCore8Document10readyStateEv
-__ZN3KJS19jsStringOrUndefinedERKN7WebCore6StringE
-__ZThn52_N7WebCore21ProcessingInstruction16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
-__ZN7WebCore21ProcessingInstruction16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
-__ZN7WebCore21ProcessingInstruction15parseStyleSheetERKNS_6StringE
-__ZN7WebCore21ProcessingInstruction11sheetLoadedEv
-__ZNK7WebCore21ProcessingInstruction9isLoadingEv
-__ZNK7WebCore21ProcessingInstruction8nodeTypeEv
-__ZN7WebCore9Tokenizer35executeScriptsWaitingForStylesheetsEv
-__ZN7WebCore21ProcessingInstructionD1Ev
-__ZN7WebCore7Element9setPrefixERKNS_12AtomicStringERi
-__ZN7WebCore4Node14checkSetPrefixERKNS_12AtomicStringERi
-__ZN7WebCore13QualifiedName9setPrefixERKNS_12AtomicStringE
-__ZNK7WebCore21ProcessingInstruction18offsetInCharactersEv
-__ZNK7WebCore21ProcessingInstruction18maxCharacterOffsetEv
-__ZN3WTF6VectorISt4pairIPtjELm0EE14expandCapacityEm
-__ZN3WTF6VectorISt4pairIPtjELm0EE15reserveCapacityEm
-__ZN3WTF6VectorISt4pairIPtjELm0EE6shrinkEm
-__ZNK7WebCore7Element5titleEv
-__ZN3WTFeqIN7WebCore15FormDataElementELm0EEEbRKNS_6VectorIT_XT0_EEES7_
-__ZN3WTFeqIcLm0EEEbRKNS_6VectorIT_XT0_EEES5_
-__ZN7WebCore11asFileInputEPNS_4NodeE
-__ZN7WebCore14DragController13dragOperationEPNS_8DragDataE
-__ZNK7WebCore8DragData11containsURLEv
-__ZNK7WebCore8DragData5asURLEPNS_6StringE
-__ZNK3KJS7JSValue8toStringEPNS_9ExecStateE
-__ZN7WebCore10JSLocation18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore4KURL5queryEv
-__ZNK7WebCore16DeprecatedStringcvN3KJS7UStringEEv
-__ZN3KJS17staticValueGetterIN7WebCore10JSLocationEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore10JSLocation16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore16createPreWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore16JSHTMLPreElementC1EPN3KJS8JSObjectEPNS_14HTMLPreElementE
-__ZN7WebCore16JSHTMLPreElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16JSHTMLPreElement9classInfoEv
-__ZN7WebCore12IconDatabase14removeAllIconsEv
-__ZN7WebCore12IconDatabase22removeAllIconsOnThreadEv
-__ZN7WebCore12IconDatabase27deleteAllPreparedStatementsEv
-__ZN7WebCore14SQLiteDatabase14clearAllTablesEv
-__ZN7WebCore15SQLiteStatement17returnTextResultsEiRN3WTF6VectorINS_6StringELm0EEE
-__ZN7WebCore14SQLiteDatabase9lastErrorEv
-_sqlite3_errcode
-_sqlite3DropTable
-_sqlite3NestedParse
-_sqlite3BtreeDropTable
-_clearDatabasePage
-_sqliteResetColumnNames
-_balance_shallower
-__ZN7WebCore14SQLiteDatabase16runVacuumCommandEv
-_sqlite3RunVacuum
-_execSql
-_codeAttach
-_attachFunc
-_sqlite3UnixTempFileName
-_sqlite3FindDb
-_execExecSql
-_sqlite3VtabOverloadFunction
-_likeFunc
-_patternCompare
-_sqlite3PagerTruncate
-_unixTruncate
-_sqlite3SchemaFree
-_sqlite3ResetInternalSchema
-__ZN7WebCore20createDatabaseTablesERNS_14SQLiteDatabaseE
-_sqlite3OpenMasterTable
-_sqlite3RefillIndex
-__ZNK7WebCore12IconDatabase12databasePathEv
-__ZN7WebCore12IconDatabase11setImportedEb
-__ZN7WebCore9CSSParser31createFloatingMediaQueryExpListEv
-__ZN7WebCore9CSSParser29sinkFloatingMediaQueryExpListEPN3WTF6VectorIPNS_13MediaQueryExpELm0EEE
-__ZN7WebCore9CSSParser24createFloatingMediaQueryENS_10MediaQuery10RestrictorERKNS_6StringEPN3WTF6VectorIPNS_13MediaQueryExpELm0EEE
-__ZN7WebCore10MediaQueryC2ENS0_10RestrictorERKNS_6StringEPN3WTF6VectorIPNS_13MediaQueryExpELm0EEE
-__ZN7WebCore9CSSParser15createMediaListEv
-__ZN7WebCore9CSSParser22sinkFloatingMediaQueryEPNS_10MediaQueryE
-__ZN7WebCore9MediaList16appendMediaQueryEPNS_10MediaQueryE
-__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE15reserveCapacityEm
-__ZN7WebCore9CSSParser16createImportRuleERKNS_11ParseStringEPNS_9MediaListE
-__ZN7WebCore13CSSImportRuleC2EPNS_9StyleBaseERKNS_6StringEPNS_9MediaListE
-__ZN7WebCore13CSSImportRule18insertedIntoParentEv
-__ZN7WebCore13CSSStyleSheet9docLoaderEv
-__ZNK7WebCore7CSSRule16parentStyleSheetEv
-__ZN7WebCore9StyleBase7baseURLEv
-__ZN7WebCore13CSSImportRule12isImportRuleEv
-__ZNK7WebCore13CSSImportRule9isLoadingEv
-__ZN7WebCore19CachedCSSStyleSheet5errorEv
-__ZThn16_N7WebCore13CSSImportRule16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
-__ZN7WebCore13CSSImportRule16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
-__ZN7WebCore13CSSStyleSheetC2EPNS_7CSSRuleERKNS_6StringES5_
-__ZN7WebCore10StyleSheetC2EPNS_9StyleBaseERKNS_6StringE
-__ZN7WebCore9StyleBase11checkLoadedEv
-__ZN7WebCore9StyleBase11isStyleRuleEv
-__ZNK7WebCore19MediaQueryEvaluator14mediaTypeMatchERKNS_6StringE
-__ZN7WebCore15applyRestrictorENS_10MediaQuery10RestrictorEb
-__ZN3WTF6VectorIPN7WebCore10MediaQueryELm0EE6shrinkEm
-__ZN7WebCore18createImageWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore27JSHTMLImageElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSHTMLImageElementC1EPN3KJS8JSObjectEPNS_16HTMLImageElementE
-__ZNK7WebCore13HTMLLIElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore13HTMLLIElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore4KURLC2ERKS0_RKNS_16DeprecatedStringE
-__ZN7WebCore16CSSStyleSelector19mapBackgroundRepeatEPNS_15BackgroundLayerEPNS_8CSSValueE
-__ZN7WebCore16CSSStyleSelector22mapBackgroundXPositionEPNS_15BackgroundLayerEPNS_8CSSValueE
-__ZN7WebCore16CSSStyleSelector22mapBackgroundYPositionEPNS_15BackgroundLayerEPNS_8CSSValueE
-__ZNK7WebCore10JSDocument8locationEPN3KJS9ExecStateE
-__ZNK7WebCore6Screen5widthEv
-__ZN7WebCore11screenDepthEPNS_6WidgetE
-__ZN3KJS29navigatorProtoFuncJavaEnabledEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS9Navigator9classInfoEv
-__ZN3KJS10PluginBaseC2EPNS_9ExecStateE
-__ZN3KJS10PluginBase26cachePluginDataIfNecessaryEv
-__ZNK7WebCore15PluginInfoStore11pluginCountEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_14HTMLCollectionE
-__ZN7WebCore25JSHTMLCollectionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSHTMLCollectionC1EPN3KJS8JSObjectEPNS_14HTMLCollectionE
-__ZN7WebCore17createBodyWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore26JSHTMLBodyElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSHTMLBodyElementC1EPN3KJS8JSObjectEPNS_15HTMLBodyElementE
-__ZN7WebCore17JSHTMLBodyElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29jsEventTargetAddEventListenerEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore39retrieveEventTargetAndCorrespondingNodeEPN3KJS9ExecStateEPNS0_8JSObjectERPNS_4NodeERPNS_11EventTargetE
-__ZNK7WebCore17JSHTMLBodyElement9classInfoEv
-__ZNK3KJS7JSValue9toBooleanEPNS_9ExecStateE
-__ZThn36_N7WebCore15EventTargetNode16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
-__ZN7WebCoreeqERKNS_23RegisteredEventListenerES2_
-__ZN7WebCore8Document6imagesEv
-__ZN7WebCore16JSHTMLCollection18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSHTMLCollectionPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore16JSHTMLCollection18canGetItemsForNameEPN3KJS9ExecStateEPNS_14HTMLCollectionERKNS1_10IdentifierE
-__ZN7WebCore13getNamedItemsEPN3KJS9ExecStateEPNS_14HTMLCollectionERKNS0_10IdentifierE
-__ZNK7WebCore14HTMLCollection15updateNameCacheEv
-__ZN7WebCore16JSHTMLCollection10nameGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZNK3KJS6Window11getListenerEPNS_9ExecStateERKN7WebCore12AtomicStringE
-__ZN7WebCore8Document26getHTMLWindowEventListenerERKNS_12AtomicStringE
-__ZN3KJS6Window11setListenerEPNS_9ExecStateERKN7WebCore12AtomicStringEPNS_7JSValueE
-__ZNK7WebCore6Screen10pixelDepthEv
-__ZNK7WebCore9DOMWindow10innerWidthEv
-__ZNK7WebCore9DOMWindow11innerHeightEv
-__ZNK7WebCore8Document21getElementByAccessKeyERKNS_6StringE
-__ZN3WTF7HashMapIPN7WebCore10StringImplEPNS1_7ElementENS1_15CaseFoldingHashENS_10HashTraitsIS3_EENS7_IS5_EEE3setERKS3_RKS5_
-_WebCoreTextFloatWidth
-__ZN7WebCore16labelConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLLabelElementC2EPNS_8DocumentE
-__ZNK7WebCore16HTMLLabelElement11tagPriorityEv
-__ZN7WebCore13RenderListBoxC2EPNS_17HTMLSelectElementE
-__ZN7WebCore13RenderListBox8setStyleEPNS_11RenderStyleE
-__ZNK7WebCore13RenderListBox15canHaveChildrenEv
-__ZN7WebCore13RenderListBox17updateFromElementEv
-__ZNK7WebCore13RenderListBox8numItemsEv
-__ZN7WebCore13RenderListBox14calcPrefWidthsEv
-__ZN7WebCore13RenderListBox6layoutEv
-__ZNK7WebCore13RenderListBox22verticalScrollbarWidthEv
-__ZN7WebCore13RenderListBox10calcHeightEv
-__ZNK7WebCore13RenderListBox10itemHeightEv
-__ZNK7WebCore13RenderListBox4sizeEv
-__ZNK7WebCore13RenderListBox15numVisibleItemsEv
-__ZNK7WebCore13RenderListBox14hasControlClipEv
-__ZNK7WebCore13RenderListBox16baselinePositionEbb
-__ZN7WebCore13RenderListBox11paintObjectERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore13RenderListBox14paintScrollbarERNS_12RenderObject9PaintInfoE
-__ZNK7WebCore13RenderListBox15controlClipRectEii
-__ZN7WebCore13RenderListBox19paintItemBackgroundERNS_12RenderObject9PaintInfoEiii
-__ZN7WebCore13RenderListBox19itemBoundingBoxRectEiii
-__ZN7WebCore13RenderListBox19paintItemForegroundERNS_12RenderObject9PaintInfoEiii
-__ZN7WebCore15GraphicsContext12drawBidiTextERKNS_7TextRunERKNS_8IntPointE
-__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE21createBidiRunsForLineERKS1_S5_bb
-__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE9appendRunEv
-__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE10deleteRunsEv
-__ZN7WebCore9CSSParser15parseMediaQueryEPNS_9MediaListERKNS_6StringE
-__ZN7WebCore30JSHTMLTextAreaElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore32JSHTMLTextAreaElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore20HTMLFrameElementBase4nameEv
-__ZN7WebCore17JSHTMLHtmlElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore43jsDocumentPrototypeFunctionQuerySelectorAllEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4Node16querySelectorAllERKNS_6StringERi
-__ZN7WebCore9CSSParser9parseRuleEPNS_13CSSStyleSheetERKNS_6StringE
-__ZN7WebCore16SelectorNodeListC1EN3WTF10PassRefPtrINS_4NodeEEEPNS_11CSSSelectorE
-__ZN7WebCore13CSSStyleSheetD0Ev
-__ZNK7WebCore14StaticNodeList6lengthEv
-__ZN7WebCore5XPath10isAxisNameERKNS_6StringERNS0_4Step4AxisE
-__ZN7WebCore5XPath17setUpAxisNamesMapERN3WTF7HashMapINS_6StringENS0_4Step4AxisENS_10StringHashENS1_10HashTraitsIS3_EENS7_IS5_EEEE
-__ZN3WTF7HashMapIN7WebCore6StringENS1_5XPath4Step4AxisENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERKS2_RKS5_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_5XPath4Step4AxisEENS_18PairFirstExtractorIS8_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E3addINS1_6StringES7_NS_17HashMapTranslatorILb0ES4_ISJ_S7_ENS_18PairBaseHashTraitsINSD_ISJ_EESF_EESG_SB_EEEES4_INS_17HashTableIteratorIS3_S8_SA_SB_SG_SE_EEbERKT_RKT0_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_5XPath4Step4AxisEENS_18PairFirstExtractorIS8_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E6expandEv
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_5XPath4Step4AxisEENS_18PairFirstExtractorIS8_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E4findIS3_NS_22IdentityHashTranslatorIS3_S8_SB_EEEENS_17HashTableIteratorIS3_S8_SA_SB_SG_SE_EERKT_
-__ZN7WebCore5XPath12createFunNotEv
-__ZNK7WebCore5XPath6FunNot8evaluateEv
-__ZNK7WebCore5XPath4Step15primaryNodeTypeENS1_4AxisE
-__ZN7WebCore5XPath6FunNotD1Ev
-__ZN7WebCore5XPath14createFunCountEv
-__ZN7WebCore5XPath6Parser9lexNumberEv
-__ZN7WebCore5XPath6NumberC1Ed
-__ZN7WebCore5XPath9NumericOpC1ENS1_6OpcodeEPNS0_10ExpressionES4_
-__ZNK7WebCore5XPath9NumericOp8evaluateEv
-__ZNK7WebCore5XPath8FunCount8evaluateEv
-__ZNK7WebCore5XPath6Number8evaluateEv
-__ZNK7WebCore5XPath5Value8toNumberEv
-__ZN7WebCore5XPath8FunCountD1Ev
-__ZN7WebCore8parseNthERKNS_6StringERiS3_
-__ZN7WebCore8matchNthEiii
-__ZN7WebCore11HTMLElement8childrenEv
-__ZN7WebCore5XPath17createFunPositionEv
-__ZNK7WebCore5XPath11FunPosition8evaluateEv
-__ZN7WebCore5XPath11FunPositionD1Ev
-__ZN7WebCore5XPath19createFunStartsWithEv
-__ZNK7WebCore5XPath13FunStartsWith8evaluateEv
-__ZN7WebCore5XPath13FunStartsWithD1Ev
-__ZN7WebCore5XPath21createFunStringLengthEv
-__ZN7WebCore5XPath18createFunSubstringEv
-__ZNK7WebCore5XPath12FunSubstring8evaluateEv
-__ZNK7WebCore5XPath15FunStringLength8evaluateEv
-__ZN7WebCore5XPath8FunRound5roundEd
-__ZN7WebCore5XPath12FunSubstringD1Ev
-__ZN7WebCore5XPath15FunStringLengthD1Ev
-__ZN7WebCore11FrameLoader21setCurrentHistoryItemEN3WTF10PassRefPtrINS_11HistoryItemEEE
-__ZN7WebCore11RenderStyle14getPseudoStyleENS0_8PseudoIdE
-__ZN7WebCore16CSSStyleSelector21pseudoStyleForElementENS_11RenderStyle8PseudoIdEPNS_7ElementEPS1_
-__ZN7WebCore11RenderStyle14addPseudoStyleEPS0_
-__ZN3WTF23HashTableRefCounterBaseILb1ENS_9HashTableIPN7WebCore10StringImplESt4pairIS4_NS2_5XPath4Step4AxisEENS_18PairFirstExtractorIS9_EENS2_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS4_EENSE_IS8_EEEESF_EENS_18PairBaseHashTraitsINSE_INS2_6StringEEESG_EEE8derefAllERSI_
-__ZN7WebCore9CSSParser14createRuleListEv
-__ZN7WebCore11CSSRuleListC2Ev
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSRuleListEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSRuleListEEELm0EE15reserveCapacityEm
-__ZN7WebCore11CSSRuleList6appendEPNS_7CSSRuleE
-__ZN7WebCore11CSSRuleList10insertRuleEPNS_7CSSRuleEj
-__ZN7WebCore9CSSParser15createMediaRuleEPNS_9MediaListEPNS_11CSSRuleListE
-__ZN7WebCore12CSSMediaRuleC2EPNS_9StyleBaseEPNS_9MediaListEPNS_11CSSRuleListE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSRuleListEEELm0EE6shrinkEm
-__ZN7WebCore12CSSMediaRule11isMediaRuleEv
-__ZNK7WebCore14RenderThemeMac22adjustSearchFieldStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZNK7WebCore14RenderThemeMac18setSearchFieldSizeEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac16searchFieldSizesEv
-__ZN7WebCore25HTMLTextFieldInnerElementC2EPNS_8DocumentEPNS_4NodeE
-__ZN7WebCore17RenderTextControl21createInnerBlockStyleEPNS_11RenderStyleE
-__ZN7WebCore35HTMLSearchFieldResultsButtonElementC2EPNS_8DocumentE
-__ZN7WebCore17RenderTextControl24createResultsButtonStyleEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac32adjustSearchFieldDecorationStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZNK7WebCore14RenderThemeMac18resultsButtonSizesEv
-__ZN7WebCore34HTMLSearchFieldCancelButtonElementC2EPNS_8DocumentE
-__ZN7WebCore17RenderTextControl23createCancelButtonStyleEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac34adjustSearchFieldCancelButtonStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZNK7WebCore14RenderThemeMac17cancelButtonSizesEv
-__ZN7WebCore11RenderStyleC2ERKS0_
-__ZN7WebCore17RenderTextControl28updateCancelButtonVisibilityEPNS_11RenderStyleE
-__ZN7WebCore21ContextMenuController16clearContextMenuEv
-__ZN7WebCore12EventHandler20sendContextMenuEventERKNS_18PlatformMouseEventE
-__ZN7WebCore21ContextMenuController22handleContextMenuEventEPNS_5EventE
-__ZN7WebCore11ContextMenuC2ERKNS_13HitTestResultE
-+[WebCoreMenuTarget sharedMenuTarget]
-__ZNK7WebCore11ContextMenu10controllerEv
--[WebCoreMenuTarget setMenuController:]
-__ZN7WebCore11ContextMenu8populateEv
-__ZN7WebCore26contextMenuItemTagOpenLinkEv
-__ZN7WebCore15ContextMenuItemC2ENS_19ContextMenuItemTypeENS_17ContextMenuActionERKNS_6StringEPNS_11ContextMenuE
-__ZN7WebCore37contextMenuItemTagOpenLinkInNewWindowEv
-__ZN7WebCore36contextMenuItemTagDownloadLinkToDiskEv
-__ZN7WebCore37contextMenuItemTagCopyLinkToClipboardEv
-__ZN7WebCore38contextMenuItemTagOpenImageInNewWindowEv
-__ZN7WebCore37contextMenuItemTagDownloadImageToDiskEv
-__ZN7WebCore38contextMenuItemTagCopyImageToClipboardEv
-__ZN7WebCore35contextMenuItemTagSearchInSpotlightEv
-__ZN7WebCore36contextMenuItemTagLookUpInDictionaryEv
-__ZN7WebCore27contextMenuItemTagSearchWebEv
-__ZN7WebCore22contextMenuItemTagCopyEv
-__ZN7WebCore24contextMenuItemTagGoBackEv
-__ZN7WebCore27contextMenuItemTagGoForwardEv
-__ZN7WebCore22contextMenuItemTagStopEv
-__ZN7WebCore24contextMenuItemTagReloadEv
-__ZN7WebCore38contextMenuItemTagOpenFrameInNewWindowEv
-__ZN7WebCore32contextMenuItemTagNoGuessesFoundEv
-__ZN7WebCore32contextMenuItemTagIgnoreSpellingEv
-__ZN7WebCore31contextMenuItemTagLearnSpellingEv
-__ZN7WebCore31contextMenuItemTagIgnoreGrammarEv
-__ZN7WebCore21contextMenuItemTagCutEv
-__ZN7WebCore23contextMenuItemTagPasteEv
-__ZNK7WebCore13HitTestResult17isContentEditableEv
-__ZN7WebCore11FrameLoader16canHandleRequestERKNS_15ResourceRequestE
-__ZN7WebCore11ContextMenu10appendItemERNS_15ContextMenuItemE
-__ZNK7WebCore11ContextMenu21checkOrEnableIfNeededERNS_15ContextMenuItemE
-__ZNK7WebCore15ContextMenuItem4typeEv
-__ZNK7WebCore15ContextMenuItem6actionEv
-__ZN7WebCore15ContextMenuItem10setCheckedEb
-__ZN7WebCore15ContextMenuItem10setEnabledEb
-__ZN7WebCore15ContextMenuItem26releasePlatformDescriptionEv
-__ZN7WebCore17setMenuItemTargetEP10NSMenuItem
-__ZN7WebCore13separatorItemEv
-__ZN7WebCore15ContextMenuItemD2Ev
-__ZNK7WebCore11ContextMenu19platformDescriptionEv
-__ZN7WebCore11ContextMenu22setPlatformDescriptionEP14NSMutableArray
--[WebCoreAXObject accessibilityAttributeNames]
--[WebCoreAXObject isPasswordField]
-__Z22isPasswordFieldElementPN7WebCore4NodeE
--[WebCoreAXObject accessibilityAttributeValue:]
--[WebCoreAXObject isTextControl]
--[WebCoreAXObject accessibilityShouldUseUniqueId]
--[WebCoreMenuTarget validateMenuItem:]
-__ZN7WebCore15ContextMenuItemC2EP10NSMenuItem
-__ZNK7WebCore15ContextMenuItem7enabledEv
-__ZN7WebCore11ContextMenuD2Ev
-__ZNK7WebCore13HitTestResult18titleDisplayStringEv
-__ZNK7WebCore13HitTestResult11textContentEv
-__ZN7WebCore11FrameLoader29generatedMIMETypeForURLSchemeERKNS_6StringE
--[WebCoreFrameBridge selectionGranularity]
-__ZN7WebCore15BackForwardList12containsItemEPNS_11HistoryItemE
-__ZN7WebCore15HTMLFormElement7setNameERKNS_6StringE
-__ZN7WebCore15HTMLFormElement9setMethodERKNS_6StringE
-__ZN7WebCore15HTMLFormElement9setTargetERKNS_6StringE
-__ZN7WebCore14JSNamedNodeMap18canGetItemsForNameEPN3KJS9ExecStateEPNS_12NamedNodeMapERKNS1_10IdentifierE
-__ZN7WebCore14JSNamedNodeMap10nameGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore11FrameLoader17stopForUserCancelEb
--[DOMElement(WebPrivate) isFocused]
-__ZN7WebCore14RenderThemeMac28paintSearchFieldCancelButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore16HTMLInputElement15addSearchResultEv
-__ZN7WebCore27RenderTextControlSingleLine15addSearchResultEv
-__ZN7WebCore16HTMLInputElement8onSearchEv
-__ZN7WebCore17RenderTextControl20stopSearchEventTimerEv
-__ZN7WebCore13CharacterData12setNodeValueERKNS_6StringERi
-__ZNK7WebCore9FrameTree20traverseNextWithWrapEb
-__ZN7WebCore14DragController11performDragEPNS_8DragDataE
-__ZN7WebCore14DragController12concludeDragEPNS_8DragDataENS_21DragDestinationActionE
-__ZNK7WebCore8Document16elementFromPointEii
-__ZNK7WebCore8DragData13containsColorEv
-__ZN7WebCore5Frame23visiblePositionForPointERKNS_8IntPointE
-__ZN7WebCore14DragController10dragIsMoveEPNS_19SelectionControllerEPNS_8DragDataE
-__ZNK7WebCore5Frame14paintDragCaretEPNS_15GraphicsContextERKNS_7IntRectE
-_filenameByFixingIllegalCharacters
-__ZN7WebCore13ImageDocument17windowSizeChangedEv
-__ZNK7WebCore13ImageDocument17imageFitsInWindowEv
-__ZN7WebCore13ImageDocument16resizeImageToFitEv
-__ZNK7WebCore13ImageDocument5scaleEv
-__ZNK7WebCore13ImageDocument15isImageDocumentEv
-__ZN7WebCore12zoomInCursorEv
-__ZN7WebCore18ImageEventListener11handleEventEPNS_5EventEb
+__ZN7WebCore22jsDocumentLastModifiedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Document12lastModifiedEv
+__ZThn84_N7WebCore12RenderWidget20setOverlapTestResultEb
+__ZN7WebCore11RenderLayer25dirtyVisibleContentStatusEv
+__ZN7WebCore23jsHTMLInputElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn8_N7WebCore13HTMLBRElementD0Ev
+__ZN7WebCore11FrameLoader22updateHistoryForReloadEv
+__ZN7WebCoreL29createHTMLTableElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLTableElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLTableElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLTableElementEEE
+__ZN7WebCore18JSHTMLTableElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLTableElementEEE
+__ZN7WebCoreL33createHTMLTableCellElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore22JSHTMLTableCellElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSHTMLTableCellElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20HTMLTableCellElementEEE
+__ZN7WebCore22JSHTMLTableCellElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20HTMLTableCellElementEEE
+__ZN7WebCore44jsDOMWindowPrototypeFunctionGetComputedStyleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9toElementEN3JSC7JSValueE
+__ZNK7WebCore22JSHTMLTableCellElement9classInfoEv
+__ZN7WebCore21JSCSSStyleDeclaration18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21JSCSSStyleDeclaration18canGetItemsForNameEPN3JSC9ExecStateEPNS_19CSSStyleDeclarationERKNS1_10IdentifierE
+__ZN7WebCore30JSCSSStyleDeclarationPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore54jsCSSStyleDeclarationPrototypeFunctionGetPropertyValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZNK7WebCore21JSCSSStyleDeclaration9classInfoEv
+__ZN7WebCoreL9sizingBoxEPNS_12RenderObjectE
+__ZN7WebCore22JSHTMLTableCellElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSHistoryPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore9JSHistory3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore9JSHistory9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore46jsElementPrototypeFunctionGetElementsByTagNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore21setJSHTMLElementTitleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement8setTitleERKNS_6StringE
+__ZN7WebCore20setJSNodeOnmousedownEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node14setOnmousedownEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore16setJSNodeOnclickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node10setOnclickEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZNK7WebCore15JSEventListener18virtualisAttributeEv
+__ZNK7WebCore11RenderTable14recalcSectionsEv
+__ZN7WebCore18RenderTableSection11recalcCellsEv
+__ZNK7WebCore18RenderTableSection10numColumnsEv
+__ZN7WebCore22JSHTMLTableCellElementD1Ev
+__ZN7WebCore18JSHTMLTableElementD1Ev
+__ZN7WebCore12JSMouseEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore9JSUIEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore13jsNodeOnclickEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node7onclickEv
+__ZNK7WebCore4Node25getAttributeEventListenerERKNS_12AtomicStringE
+__ZN7WebCore7History15disconnectFrameEv
+__ZNK7WebCore11JSDOMWindow9classInfoEv
+__ZNK7WebCore16JSDOMWindowShell9classNameEv
+__ZN7WebCore17jsDOMWindowLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6lengthEv
+__ZN7WebCoreL26createHTMLHRElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore15JSHTMLHRElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSHTMLHRElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13HTMLHRElementEEE
+__ZN7WebCore15JSHTMLHRElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13HTMLHRElementEEE
+__ZN7WebCore15JSHTMLHRElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17jsNodeNextSiblingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsNodePrototypeFunctionInsertBeforeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore6JSNode12insertBeforeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore15JSHTMLLIElement9classInfoEv
+__ZN7WebCore9JSHistoryD1Ev
+__ZN7WebCore9JSHistoryD2Ev
+__ZN7WebCore15JSHTMLHRElementD1Ev
+__ZN7WebCore18JSHTMLStyleElementD1Ev
+__ZN7WebCore17JSHTMLLinkElementD1Ev
+__ZN7WebCore18JSHTMLTitleElementD1Ev
+__ZN7WebCore19jsNodeOwnerDocumentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsHTMLElementTitleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLAnchorElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLAnchorElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLAnchorElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22setJSCharacterDataDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11FrameLoader6reloadEb
+__ZN7WebCore11FrameLoader33restoreScrollPositionAndViewStateEv
+__ZNK7WebCore9FrameView17wasScrolledByUserEv
+__ZNK7WebCore11HistoryItem11scrollPointEv
+__ZN7WebCore25JSHTMLPreElementPrototypeD1Ev
+__ZThn8_N7WebCore14HTMLPreElementD0Ev
+__ZN7WebCore17HTMLSelectElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore17HTMLSelectElement27menuListDefaultEventHandlerEPNS_5EventE
+__ZN7WebCore21JSCSSStyleDeclaration10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN3WTF11ListHashSetIPN7WebCore9RenderBoxENS_7PtrHashIS3_EEE15unlinkAndDeleteEPNS_15ListHashSetNodeIS3_EE
+__ZN7WebCore21DeprecatedPtrListImpl9removeRefEPKvb
+__ZN7WebCore12RenderObject24repaintOverhangingFloatsEb
+__ZNK7WebCore16JSEventPrototype9classInfoEv
+__ZN7WebCore18jsEventReturnValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsEventTimeStampEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN3WTF12bitwise_castIldEET_T0_
+__ZN7WebCore17jsEventEventPhaseEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17jsEventSrcElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsEventClipboardDataEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7JSEvent13clipboardDataEPN3JSC9ExecStateE
+__ZNK7WebCore5Event16isClipboardEventEv
+__ZN7WebCore17jsEventCancelableEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9DOMWindow11toDOMWindowEv
+__ZN7WebCore14jsEventBubblesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsEventCancelBubbleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsEventMOUSEOUTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsEventFOCUSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13jsEventCHANGEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsEventMOUSEMOVEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsEventAT_TARGETEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13jsEventSELECTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11jsEventBLUREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsEventKEYUPEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsEventMOUSEDOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsEventMOUSEDRAGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsEventBUBBLING_PHASEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14jsEventMOUSEUPEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsEventCAPTURING_PHASEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsEventMOUSEOVEREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsEventCLICKEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsEventDBLCLICKEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14jsEventKEYDOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsEventKEYPRESSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsEventDRAGDROPEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore47jsDOMWindowPrototypeFunctionRemoveEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSDOMWindow19removeEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCoreL26removePendingEventListenerERN3WTF7HashMapIPNS_9DOMWindowEPNS0_6VectorINS0_6RefPtrINS_23RegisteredEventListenerEE
+__ZNK3WTF6VectorINS_6RefPtrIN7WebCore23RegisteredEventListenerEEELm0EE4findIPS3_EEmRKT_
+__ZN7WebCore17JSHTMLHtmlElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore17JSHTMLHeadElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore17JSHTMLMetaElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore18JSHTMLTitleElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore15JSHTMLBRElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore22jsHTMLUListElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLUListElement4typeEv
+__ZN7WebCore27jsHTMLDivElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSHTMLDivElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSHTMLDivElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN3JSC8JSObject18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN7WebCore20HTMLFrameElementBase13canLazyAttachEv
+__ZN7WebCore27JSHTMLUListElementPrototypeD1Ev
+__ZN7WebCore24JSHTMLBRElementPrototypeD1Ev
+__ZN7WebCore28JSHTMLScriptElementPrototypeD1Ev
+__ZN7WebCore26JSHTMLLinkElementPrototypeD1Ev
+__ZN7WebCore27JSHTMLTitleElementPrototypeD1Ev
+__ZN7WebCore26JSHTMLMetaElementPrototypeD1Ev
+__ZN7WebCore26JSHTMLHeadElementPrototypeD1Ev
+__ZN7WebCore26JSHTMLHtmlElementPrototypeD1Ev
+__ZThn8_N7WebCore18HTMLHeadingElementD0Ev
+__ZN7WebCore25JSHTMLDocumentConstructorD1Ev
+__ZThn8_N7WebCore13HTMLLIElementD0Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm10EE15reserveCapacityEm
+__ZNK7WebCore16HTMLInputElement14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore20StringSourceProvider8getRangeEii
+__ZN7WebCore11CachedImage19httpStatusCodeErrorEv
+__ZNK7WebCore22HTMLFormControlElement16isMouseFocusableEv
+__ZNK7WebCore16HTMLInputElement17canStartSelectionEv
+__ZNK7WebCore12JSMouseEvent9classInfoEv
+__ZNK7WebCore21JSMouseEventPrototype9classInfoEv
+__ZNK7WebCore18JSUIEventPrototype9classInfoEv
+__ZN7WebCore20jsMouseEventShiftKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsMouseEventToElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore10MouseEvent9toElementEv
+__ZN7WebCore19jsMouseEventClientYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13jsMouseEventYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore17MouseRelatedEvent1yEv
-__ZN7WebCore13ImageDocument12imageClickedEii
-__ZN7WebCore13ImageDocument16restoreImageSizeEv
-__ZN7WebCore13zoomOutCursorEv
-__ZN7WebCore11HistoryItem12setViewStateEP11objc_object
-__ZNK7WebCore11HistoryItem9viewStateEv
-__ZNK7WebCore9FrameTree24traversePreviousWithWrapEb
-__ZNK7WebCore9FrameTree13deepLastChildEv
-__ZN7WebCore12CachedScript5errorEv
-__ZN7WebCore14scaleDragImageEN3WTF9RetainPtrI7NSImageEENS_9FloatSizeE
-__ZN7WebCore13HTMLTokenizer11parseEntityERNS_15SegmentedStringERPtNS0_5StateERjbb
-__ZN7WebCore15SegmentedString15advanceSlowCaseERi
-__ZN7WebCore15fontConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore15HTMLFontElementC2EPNS_8DocumentE
-__ZNK7WebCore15HTMLFontElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore15HTMLFontElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore15HTMLFontElement26cssValueFromFontSizeNumberERKNS_6StringERi
-__ZN7WebCore13StyledElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore18NamedMappedAttrMap19parseClassAttributeERKNS_6StringE
-__ZN7WebCore10ClassNames19parseClassAttributeERKNS_6StringEb
-__ZNK7WebCore6String8foldCaseEv
-__ZN7WebCore10StringImpl8foldCaseEv
-__ZNK7WebCore15HTMLFontElement17endTagRequirementEv
-__ZNK7WebCore15HTMLFontElement11tagPriorityEv
-__ZNK7WebCore13StyledElement13getClassNamesEv
-__ZN3WTF10RefCountedIN7WebCore10FontFamilyEE5derefEv
-__ZN7WebCore12RenderInlineC2EPNS_4NodeE
-__ZN7WebCore12RenderInline8setStyleEPNS_11RenderStyleE
-__ZN7WebCore12RenderInline13requiresLayerEv
-__ZNK7WebCore12RenderInline12isInlineFlowEv
-__ZN7WebCore4Text14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore10RenderTextC2EPNS_4NodeEN3WTF10PassRefPtrINS_10StringImplEEE
-__ZN7WebCore12RenderInline14addChildToFlowEPNS_12RenderObjectES2_
-__ZNK7WebCore12RenderInline14childrenInlineEv
-__ZN7WebCore10HTMLParser27nestedStyleCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore10HTMLParser23allowNestedRedundantTagERKNS_12AtomicStringE
-__ZN7WebCore17anchorConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLAnchorElementC2EPNS_8DocumentE
-__ZN7WebCore17HTMLAnchorElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore17HTMLAnchorElement17endTagRequirementEv
-__ZNK7WebCore17HTMLAnchorElement11tagPriorityEv
-__ZN7WebCore16checkPseudoStateEPNS_7ElementEb
-__ZN7WebCore16DeprecatedString7prependERKS0_
-__ZN7WebCore15historyContainsEPKtj
-+[WebCoreHistory historyProvider]
-__ZN7WebCore15StyleVisualDataC2ERKS0_
-__ZN7WebCore11RenderStyle15clearCursorListEv
-__ZN7WebCore10HTMLParser20formCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore15HTMLFormElementC2EPNS_8DocumentE
-__ZN7WebCore15HTMLFormElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore15HTMLFormElement17endTagRequirementEv
-__ZNK7WebCore15HTMLFormElement11tagPriorityEv
-__ZN7WebCore15HTMLFormElement20insertedIntoDocumentEv
-__ZN7WebCore15HTMLFormElement6attachEv
-__ZN7WebCore22CSSQuirkPrimitiveValue12isQuirkValueEv
-__ZN7WebCore16inputConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLInputElementC2EPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore31HTMLFormControlElementWithStateC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore22HTMLGenericFormElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore15HTMLFormElement19registerFormElementEPNS_22HTMLGenericFormElementE
-__ZN7WebCore15HTMLFormElement19CheckedRadioButtons12removeButtonEPNS_22HTMLGenericFormElementE
-__ZNK7WebCore22HTMLGenericFormElement4nameEv
-__ZN7WebCore15HTMLFormElement19CheckedRadioButtons9addButtonEPNS_22HTMLGenericFormElementE
-__ZNK7WebCore22HTMLGenericFormElement13isRadioButtonEv
-__ZN7WebCore15HTMLFormElement16formElementIndexEPNS_22HTMLGenericFormElementE
-__ZN3WTF6VectorIPN7WebCore22HTMLGenericFormElementELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore22HTMLGenericFormElementELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore22HTMLGenericFormElementELm0EE15reserveCapacityEm
-__ZN3WTF11ListHashSetIPN7WebCore31HTMLFormControlElementWithStateENS_7PtrHashIS3_EEE3addERKS3_
-__ZN3WTF9HashTableIPNS_15ListHashSetNodeIPN7WebCore31HTMLFormControlElementWithStateEEES6_NS_17IdentityExtractorIS6_EENS_28ListHashSetNodeHashFunctionsIS4_NS_7PtrHashIS4_EEEENS_10HashTraitsIS6_EESE_E3addIS4_PNS_24ListHashSetNodeAllocatorIS4_EENS_21ListHashSetTranslatorIS4_SB_EEEESt4pairINS_17HashTableIteratorIS6_S6_S8_SC_SE_SE_EEbERKT_RKT0_
-__ZN3WTF11ListHashSetIPN7WebCore31HTMLFormControlElementWithStateENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
-__ZN7WebCore16HTMLInputElement4initEv
-__ZNK7WebCore16HTMLInputElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore16HTMLInputElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore16HTMLInputElement4nameEv
-__ZNK7WebCore16HTMLInputElement13isRadioButtonEv
-__ZN7WebCore16HTMLInputElement12setInputTypeERKNS_6StringE
-__ZNK7WebCore16HTMLInputElement32storesValueSeparateFromAttributeEv
-__ZN7WebCore16HTMLInputElement12recheckValueEv
-__ZNK7WebCore16HTMLInputElement5valueEv
-__ZNK7WebCore16HTMLInputElement14constrainValueERKNS_6StringE
-__ZNK7WebCore16HTMLInputElement14constrainValueERKNS_6StringEi
-__ZNK7WebCore16HTMLInputElement17endTagRequirementEv
-__ZNK7WebCore16HTMLInputElement11tagPriorityEv
-__ZN7WebCore22HTMLGenericFormElement16insertedIntoTreeEb
-__ZN7WebCore16HTMLInputElement6attachEv
-__ZN7WebCore22HTMLGenericFormElement6attachEv
-__ZN7WebCoregtERNS_11CSSRuleDataES1_
-__ZN7WebCore11CSSSelector11specificityEv
-__ZN7WebCore5themeEv
-__ZN7WebCore14RenderThemeMacC2Ev
--[WebCoreRenderThemeNotificationObserver initWithTheme:]
-__ZNK7WebCore14RenderThemeMac10systemFontEiRNS_15FontDescriptionE
-__ZN7WebCore11RenderStyle13setTextShadowEPNS_10ShadowDataEb
-__ZN7WebCore22StyleRareInheritedDataC2ERKS0_
-__ZN7WebCore7DataRefINS_25StyleRareNonInheritedDataEE6accessEv
-__ZN7WebCore25StyleRareNonInheritedDataC2ERKS0_
-__ZNK7WebCore22HTMLGenericFormElement9isControlEv
-__ZN7WebCore16HTMLInputElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore22StyleRareInheritedDataD2Ev
-__ZN7WebCore25StyleRareNonInheritedDataD2Ev
-__ZN7WebCore31HTMLFormControlElementWithState21finishParsingChildrenEv
-__ZNK7WebCore8Document26hasStateForNewFormElementsEv
-__ZN7WebCore15BackgroundLayeraSERKS0_
-__ZN7WebCore11RenderTheme11adjustStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementEbRKNS_10BorderDataERKNS_15BackgroundLayerERKNS_5ColorE
-__ZNK7WebCore14RenderThemeMac15isControlStyledEPKNS_11RenderStyleERKNS_10BorderDataERKNS_15BackgroundLayerERKNS_5ColorE
-__ZNK7WebCore14RenderThemeMac20adjustTextFieldStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZN7WebCore16HTMLInputElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore17RenderTextControlC2EPNS_4NodeEb
-__ZN7WebCore17RenderTextControl8setStyleEPNS_11RenderStyleE
-__ZNK7WebCore17RenderTextControl15canHaveChildrenEv
-__ZN7WebCore17RenderTextControl17updateFromElementEv
-__ZN7WebCore17RenderTextControl21createSubtreeIfNeededEv
-__ZN7WebCore29HTMLTextFieldInnerTextElementC2EPNS_8DocumentEPNS_4NodeE
-__ZN7WebCore17RenderTextControl20createInnerTextStyleEPNS_11RenderStyleE
-__ZNK7WebCore22HTMLGenericFormElement17isReadOnlyControlEv
-__ZNK7WebCore22HTMLGenericFormElement8disabledEv
-__ZNK7WebCore4Font11lineSpacingEv
-__ZN7WebCore9FontCache11getFontDataERKNS_4FontERiPNS_12FontSelectorE
-__ZN7WebCore15CSSFontSelector11getFontDataERKNS_15FontDescriptionERKNS_12AtomicStringE
-__ZN7WebCore9FontCache25getCachedFontPlatformDataERKNS_15FontDescriptionERKNS_12AtomicStringEb
-__ZN7WebCore9FontCache12platformInitEv
-__ZN3WTF9HashTableIN7WebCore24FontPlatformDataCacheKeyESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_28FontPlatformDataCacheKeyHashENS_14PairHashTraitsINS1_30FontPlatformDataCacheKeyTraitsENS_10HashTraitsIiEEEES9_E4findIS2_NS_22IdentityHashTranslatorIS2_S4_S7_EEEENS_17HashTableIteratorIS2_S4_S6_S7_SC_S9_EERKT_
-__ZN7WebCore9FontCache22createFontPlatformDataERKNS_15FontDescriptionERKNS_12AtomicStringE
-+[WebFontCache fontWithFamily:traits:size:]
-+[WebFontCache internalFontWithFamily:traits:size:]
-__Z16acceptableChoicejiji
-__ZN7WebCore16FontPlatformData7setFontEP6NSFont
-__ZN3WTF7HashMapIN7WebCore24FontPlatformDataCacheKeyEPNS1_16FontPlatformDataENS1_28FontPlatformDataCacheKeyHashENS1_30FontPlatformDataCacheKeyTraitsENS_10HashTraitsIS4_EEE3setERKS2_RKS4_
-__ZN3WTF9HashTableIN7WebCore24FontPlatformDataCacheKeyESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_28FontPlatformDataCacheKeyHashENS_14PairHashTraitsINS1_30FontPlatformDataCacheKeyTraitsENS_10HashTraitsIiEEEES9_E3addIS2_PNS1_16FontPlatformDataENS_17HashMapTranslatorILb1ES3_IS2_SG_ENS_18PairBaseHashTraitsIS9_NSA_ISG_EEEESC_S7_EEEES3_INS_17HashTableIteratorIS2_S4_S6_S7_SC_S9_EEbERKT_RKT0_
-__ZN3WTF9HashTableIN7WebCore24FontPlatformDataCacheKeyESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_28FontPlatformDataCacheKeyHashENS_14PairHashTraitsINS1_30FontPlatformDataCacheKeyTraitsENS_10HashTraitsIiEEEES9_E6expandEv
-__ZNK7WebCore14SimpleFontData9isLoadingEv
-__ZNK7WebCore11RenderBlock10lineHeightEbb
-__ZNK7WebCore10RenderFlow10lineHeightEbb
-__ZNK7WebCore12RenderObject14firstLineStyleEv
-__ZNK7WebCore12RenderObject10lineHeightEbb
-__ZNK7WebCore22HTMLGenericFormElement9isEnabledEv
-__ZNK7WebCore11RenderLayer13isTransparentEv
-__ZN7WebCore11RenderLayer17dirtyOverflowListEv
-__ZNK7WebCore17RenderTextControl11isTextFieldEv
-__ZN7WebCore9FrameView25scheduleRelayoutOfSubtreeEPNS_12RenderObjectE
-__ZN7WebCore17RenderTextControl17updatePlaceholderEv
-__ZN7WebCore17RenderTextControl4textEv
-__ZNK7WebCore17RenderTextControl10finishTextERN3WTF6VectorItLm0EEE
-__ZN7WebCore11HTMLElement12setInnerTextERKNS_6StringERi
-__ZNK7WebCore14HTMLDivElement17endTagRequirementEv
-__ZN7WebCore13StyledElement25removeMappedAttributeDeclENS_20MappedAttributeEntryERKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore19DeprecatedValueListINS_11CSSPropertyEE10deleteNodeEPNS_27DeprecatedValueListImplNodeE
-__ZN7WebCore17CSSPrimitiveValue7cleanupEv
-__ZN7WebCore22HTMLGenericFormElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore16HTMLInputElement7altTextEv
-__ZN7WebCore12RenderObject17updateFromElementEv
-__ZN7WebCore11RenderImage14resetAnimationEv
-__ZN7WebCore10HTMLParser22selectCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore17selectConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLSelectElementC2EPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore17HTMLSelectElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore22HTMLGenericFormElement17endTagRequirementEv
-__ZNK7WebCore17HTMLSelectElement11tagPriorityEv
-__ZNK7WebCore7Element17isInputTypeHiddenEv
-__ZN7WebCore20StyleFlexibleBoxDataC2ERKS0_
-__ZN7WebCore17CSSPrimitiveValue16computeLengthIntEPNS_11RenderStyleE
-__ZNK7WebCore11RenderTheme15isControlStyledEPKNS_11RenderStyleERKNS_10BorderDataERKNS_15BackgroundLayerERKNS_5ColorE
-__ZNK7WebCore15BackgroundLayereqERKS0_
-__ZNK7WebCore14RenderThemeMac19adjustMenuListStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
-__ZNK7WebCore14RenderThemeMac18controlSizeForFontEPNS_11RenderStyleE
-__ZN7WebCore11RenderStyle11resetBorderEv
-__ZNK7WebCore14RenderThemeMac13setButtonSizeEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac11buttonSizesEv
-__ZNK7WebCore14RenderThemeMac15setSizeFromFontEPNS_11RenderStyleEPKNS_7IntSizeE
-__ZNK7WebCore14RenderThemeMac11sizeForFontEPNS_11RenderStyleEPKNS_7IntSizeE
-__ZNK7WebCore14RenderThemeMac22setFontFromControlSizeEPNS_16CSSStyleSelectorEPNS_11RenderStyleEj
-__ZN7WebCore11RenderStyle12setBoxShadowEPNS_10ShadowDataEb
-__ZN7WebCore17HTMLSelectElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore14RenderMenuListC2EPNS_17HTMLSelectElementE
-__ZN7WebCore14RenderMenuList8setStyleEPNS_11RenderStyleE
-__ZNK7WebCore14RenderMenuList15canHaveChildrenEv
-__ZN7WebCore14RenderMenuList18updateOptionsWidthEv
-__ZN7WebCore14RenderMenuList17updateFromElementEv
-__ZNK7WebCore17HTMLSelectElement13selectedIndexEv
-__ZN7WebCore14RenderMenuList17setTextFromOptionEi
-__ZNK7WebCore17HTMLSelectElement17optionToListIndexEi
-__ZN7WebCore14RenderMenuList7setTextERKNS_6StringE
-__ZN7WebCore14RenderMenuList8addChildEPNS_12RenderObjectES2_
-__ZN7WebCore14RenderMenuList16createInnerBlockEv
-__ZN7WebCore14RenderMenuList16adjustInnerStyleEv
-__ZNK7WebCore14RenderThemeMac24popupInternalPaddingLeftEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac18popupButtonPaddingEj
-__ZNK7WebCore14RenderThemeMac25popupInternalPaddingRightEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac23popupInternalPaddingTopEPNS_11RenderStyleE
-__ZNK7WebCore14RenderThemeMac26popupInternalPaddingBottomEPNS_11RenderStyleE
-__ZN7WebCore9PopupMenu29itemWritingDirectionIsNaturalEv
-__ZN7WebCore10StringImpl23defaultWritingDirectionEv
-__ZN7WebCore17HTMLSelectElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore17HTMLSelectElement15childrenChangedEb
-__ZN7WebCore17HTMLSelectElement18setRecalcListItemsEv
-__ZN7WebCore17optionConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLOptionElementC2EPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore17HTMLOptionElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore17HTMLOptionElement17endTagRequirementEv
-__ZNK7WebCore17HTMLOptionElement11tagPriorityEv
-__ZN7WebCore17HTMLOptionElement20insertedIntoDocumentEv
-__ZNK7WebCore17HTMLOptionElement9getSelectEv
-__ZN7WebCore17HTMLSelectElement17scrollToSelectionEv
-__ZN7WebCore17HTMLOptionElement6attachEv
-__ZNK7WebCore17HTMLOptionElement8disabledEv
-__ZN7WebCore17HTMLOptionElement14setRenderStyleEPNS_11RenderStyleE
-__ZN7WebCore17HTMLOptionElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore17HTMLOptionElement15childrenChangedEb
-__ZNK7WebCore17HTMLOptionElement11renderStyleEv
-__ZN7WebCore11FrameLoader14didReceiveDataEPNS_14ResourceLoaderEPKcii
-__ZN7WebCore15ProgressTracker17incrementProgressEmPKci
-__ZNK7WebCore11FrameLoader27numPendingOrLoadingRequestsEb
-__ZNK7WebCore11FrameLoader15firstLayoutDoneEv
-__ZN7WebCore11FrameLoader31dispatchDidReceiveContentLengthEPNS_14DocumentLoaderEmi
-__ZN7WebCore19InspectorController23didReceiveContentLengthEPNS_14DocumentLoaderEmi
--[WebCoreResourceHandleAsDelegate connectionDidFinishLoading:]
-__ZN7WebCore14ResourceLoader16didFinishLoadingEPNS_14ResourceHandleE
-__ZN7WebCore18MainResourceLoader16didFinishLoadingEv
-__ZN7WebCore11FrameLoader15finishedLoadingEv
-__ZNK7WebCore4Node14isDocumentNodeEv
-__ZN7WebCore21DeprecatedPtrListImpl4takeEv
-__ZNK7WebCore21DeprecatedPtrListImpl7currentEv
-__ZNK7WebCore17StyleSurroundDataeqERKS0_
-__ZN7WebCore17HTMLSelectElement11recalcStyleENS_4Node11StyleChangeE
-__ZNK7WebCore17HTMLSelectElement15recalcListItemsEb
-__ZNK7WebCore4Node19traverseNextSiblingEPKS0_
-__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore11HTMLElementELm0EE15reserveCapacityEm
-__ZN7WebCore17HTMLOptionElement16setSelectedStateEb
-__ZN7WebCore22HTMLGenericFormElement11recalcStyleENS_4Node11StyleChangeE
-__ZNK7WebCore19StyleBackgroundDataeqERKS0_
-__ZNK7WebCore25StyleRareNonInheritedDataeqERKS0_
-__ZN3WTFeqIN7WebCore20StyleDashboardRegionELm0EEEbRKNS_6VectorIT_XT0_EEES7_
-__ZNK7WebCore20StyleFlexibleBoxDataeqERKS0_
-__ZNK7WebCore25StyleRareNonInheritedData20shadowDataEquivalentERKS0_
-__ZNK7WebCore25StyleRareNonInheritedData24transitionDataEquivalentERKS0_
-__ZNK7WebCore22StyleRareInheritedDataeqERKS0_
-__ZNK7WebCore22StyleRareInheritedData20shadowDataEquivalentERKS0_
+__ZN7WebCore13jsMouseEventXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17MouseRelatedEvent1xEv
+__ZN7WebCore19jsMouseEventCtrlKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsMouseEventRelatedTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsMouseEventClientXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsMouseEventScreenYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsMouseEventMetaKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsMouseEventOffsetXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsMouseEventAltKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsMouseEventOffsetYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsMouseEventFromElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore10MouseEvent11fromElementEv
+__ZN7WebCore19jsMouseEventScreenXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsMouseEventDataTransferEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore10MouseEvent11isDragEventEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9ClipboardE
+__ZN7WebCore18jsMouseEventButtonEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14jsUIEventPageYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsUIEventLayerYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17MouseRelatedEvent6layerYEv
+__ZN7WebCore14jsUIEventPageXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17jsUIEventCharCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7UIEvent8charCodeEv
+__ZN7WebCore13jsUIEventViewEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14jsUIEventWhichEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore10MouseEvent5whichEv
+__ZN7WebCore16jsUIEventKeyCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7UIEvent7keyCodeEv
+__ZN7WebCore15jsUIEventDetailEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsUIEventLayerXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17MouseRelatedEvent6layerXEv
+__ZN7WebCore21JSMouseEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSUIEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24jsHTMLElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsHTMLParagraphElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22JSHTMLParagraphElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSHTMLParagraphElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29jsHTMLOListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLOListElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLOListElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLOListElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore8IntPointC1ERK8_NSPoint
+__ZN7WebCore8IntPointC2ERK8_NSPoint
+__ZN7WebCore11globalPointERK8_NSPointP8NSWindow
+__ZN7WebCore15flipScreenPointERK8_NSPointP8NSScreen
+__ZNK7WebCore8IntPointcv8_NSPointEv
+__ZN7WebCore17HTMLPlugInElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore12EventHandler14currentNSEventEv
+__ZN7WebCore12EventHandler32passWidgetMouseDownEventToWidgetERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore12EventHandler26passMouseDownEventToWidgetEPNS_6WidgetE
+__ZN7WebCoreL18lastEventIsMouseUpEv
+__ZN7WebCoreL18findViewInSubviewsEP6NSViewS1_
+__ZN7WebCore11FrameLoader13frameDetachedEv
+__ZN7WebCore17HTMLIFrameElement19removedFromDocumentEv
+__ZN7WebCore20HTMLFrameElementBase19removedFromDocumentEv
+__ZThn4_N7WebCore17HTMLIFrameElementD0Ev
+__ZN7WebCore10RenderView15pushLayoutStateEPNS_12RenderObjectE
+__ZN7WebCore11LayoutStateC1EPNS_12RenderObjectE
+__ZN7WebCore11LayoutStateC2EPNS_12RenderObjectE
+__ZN7WebCore11FrameLoader24checkCompletedTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore5Cache18revalidateResourceEPNS_14CachedResourceEPNS_9DocLoaderE
+__ZNK7WebCore14CachedResource20canUseCacheValidatorEv
+__ZNK7WebCore19CachedCSSStyleSheet8encodingEv
+__ZN7WebCore14CachedResource23setResourceToRevalidateEPS0_
+__ZN3WTF7HashSetIPN7WebCore24CachedResourceHandleBaseENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZNK7WebCore14CachedResource8encodingEv
+__ZN7WebCore5Cache21revalidationSucceededEPNS_14CachedResourceERKNS_16ResourceResponseE
+__ZN7WebCore14CachedResource34switchClientsToRevalidatedResourceEv
+__ZN3WTF9HashTableIPN7WebCore24CachedResourceHandleBaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9
+__ZN3WTF6VectorIPN7WebCore20CachedResourceClientELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore20CachedResourceClientELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore20CachedResourceClientELm0EE15reserveCapacityEm
+__ZN7WebCore14CachedResource25clearResourceToRevalidateEv
+__ZN7WebCore19JSHTMLObjectElementD1Ev
+__ZN7WebCore18JSHTMLParamElementD1Ev
+__ZN7WebCore18JSHTMLEmbedElementD1Ev
+__ZN3JSC16RuntimeObjectImpD1Ev
+__ZN3JSC16RuntimeObjectImpD2Ev
+__ZN3JSC8Bindings10RootObject19removeRuntimeObjectEPNS_16RuntimeObjectImpE
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_N
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAn
+__ZN3WTF9HashTableIPN3JSC16RuntimeObjectImpES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS
+__ZN3JSC8Bindings9CInstanceD0Ev
+__ZN3JSC8Bindings8InstanceD2Ev
+__ZThn4_N7WebCore16HTMLImageElementD0Ev
+__ZNK7WebCore13KeyboardEvent8charCodeEv
+__ZNK7WebCore6String19characterStartingAtEj
+__ZN7WebCore10StringImpl19characterStartingAtEj
+__ZN7WebCoreL5equalERKNS_15CSSParserStringEPKc
+__ZN7WebCore18CSSParserValueList13deleteValueAtEj
+__ZNK7WebCore14CSSParserValue10isVariableEv
+__ZN7WebCore19setJSDOMWindowEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore14PreloadScanner11emitCSSRuleEv
+__ZN3WTF6VectorItLm16EE6shrinkEm
+__ZN7WebCore24jsHTMLDocumentCompatModeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12HTMLDocument10compatModeEv
+__ZN7WebCore25jsDocumentDocumentElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn4_N7WebCore11HTMLElementD0Ev
+__ZThn64_NK7WebCore16HTMLInputElement4sizeEv
+__ZNK7WebCore15JSDOMWindowBase29crossDomainAccessErrorMessageEPKN3JSC14JSGlobalObjectE
+__ZN3WTF6VectorIcLm256EE14expandCapacityEm
+__ZN3WTF6VectorIcLm256EE15reserveCapacityEm
+__ZN7WebCore25printErrorMessageForFrameEPNS_5FrameERKNS_6StringE
+__ZNK7WebCore15JSDOMWindowBase17printErrorMessageERKNS_6StringE
+__ZN7WebCore26setJSHTMLScriptElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLScriptElement7setTypeERKNS_6StringE
+__ZN7WebCore21jsNavigatorProductSubEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase10productSubEv
+__ZN7WebCore17jsNavigatorVendorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase6vendorEv
+__ZN7WebCore18jsNavigatorProductEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase7productEv
+__ZThn56_N7WebCore17HTMLScriptElement17dispatchLoadEventEv
+__ZNK7WebCore12RenderObject14isDescendantOfEPKS0_
+__ZN7WebCore7Element24cloneElementWithChildrenEv
+__ZN7WebCore13ContainerNode15cloneChildNodesEPS0_
+__ZN7WebCore4Text9cloneNodeEb
+__ZN7WebCore40jsDOMWindowPrototypeFunctionClearTimeoutEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow12clearTimeoutEi
+__ZN7WebCore16jsHTMLElementDirEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11HTMLElement3dirEv
+__ZN7WebCore17jsHTMLDocumentDirEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12HTMLDocument3dirEv
+__ZN7WebCore25PluginMainThreadScheduler16unregisterPluginEP4_NPP
+__ZN7WebCore16HTMLParamElementD0Ev
+__ZN7WebCore16HTMLEmbedElementD0Ev
+__ZNK7WebCore16RunLoopTimerBase8isActiveEv
+__ZN7WebCore4Page6goBackEv
+__ZN7WebCore4Page8goToItemEPNS_11HistoryItemENS_13FrameLoadTypeE
+__ZN7WebCore11FrameLoader8goToItemEPNS_11HistoryItemENS_13FrameLoadTypeE
+__ZN7WebCore15BackForwardList8goToItemEPNS_11HistoryItemE
+__ZN7WebCore11FrameLoader17recursiveGoToItemEPNS_11HistoryItemES2_NS_13FrameLoadTypeE
+__ZNK7WebCore11HistoryItem12isTargetItemEv
+__ZN7WebCore11FrameLoader8loadItemEPNS_11HistoryItemENS_13FrameLoadTypeE
+__ZN7WebCore11HistoryItem8formDataEv
+__ZNK7WebCore11FrameLoader13urlsMatchItemEPNS_11HistoryItemE
+__ZN7WebCore11FrameLoader33loadProvisionalItemFromCachedPageEv
+__ZN7WebCore14DocumentLoader18loadFromCachedPageEN3WTF10PassRefPtrINS_10CachedPageEEE
+__ZN7WebCore11FrameLoader37updateHistoryForBackForwardNavigationEv
+__ZN7WebCore11CachedFrame23cachedFramePlatformDataEv
+__ZN7WebCore11FrameLoader4openERNS_10CachedPageE
+__ZN7WebCore11FrameLoader4openERNS_11CachedFrameE
+__ZThn4_N7WebCore27TextControlInnerTextElementD0Ev
+__ZNK7WebCore21ScriptCachedFrameData9domWindowEv
+__ZN7WebCore5Frame12setDOMWindowEPNS_9DOMWindowE
+__ZN7WebCore11CachedFrame7restoreEv
+__ZN7WebCore21ScriptCachedFrameData7restoreEPNS_5FrameE
+__ZN7WebCore12EventHandler17setMousePressNodeEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore22ScriptExecutionContext22resumeActiveDOMObjectsEv
+__ZN7WebCore8Document23documentDidBecomeActiveEv
+__ZN7WebCore9FrameView12setMediaTypeERKNS_6StringE
+__ZThn4_N7WebCore17HTMLAnchorElementD0Ev
+__ZThn4_N7WebCore20HTMLParagraphElementD0Ev
+__ZThn4_N7WebCore20HTMLTableCellElementD0Ev
+__ZThn4_N7WebCore14HTMLDivElementD0Ev
+__ZN7WebCore18jsDOMWindowConsoleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_7ConsoleE
+__ZN7WebCore9JSConsole15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSConsoleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7ConsoleEEE
+__ZN7WebCore9JSConsoleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7ConsoleEEE
+__ZN7WebCore9JSConsole18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSConsolePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsNodeAttributesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12NamedNodeMapE
+__ZN7WebCore14JSNamedNodeMap15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSNamedNodeMapC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12NamedNodeMapEEE
+__ZN7WebCore14JSNamedNodeMapC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12NamedNodeMapEEE
+__ZN7WebCore14JSNamedNodeMap18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23JSNamedNodeMapPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore14JSNamedNodeMap18canGetItemsForNameEPN3JSC9ExecStateEPNS_12NamedNodeMapERKNS1_10IdentifierE
+__ZN7WebCore17CSSInheritedValueD0Ev
+__ZThn4_N7WebCore15HTMLFormElementD0Ev
+__ZN7WebCore14JSNamedNodeMapD1Ev
+__ZN7WebCore14JSNamedNodeMapD2Ev
+__ZN7WebCore25jsDOMWindowOnbeforeunloadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow14onbeforeunloadEv
+__ZN7WebCore28setJSDOMWindowOnbeforeunloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow17setOnbeforeunloadEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCoreL34allowsPendingBeforeUnloadListenersEPNS_9DOMWindowE
+__ZN7WebCore15JSMimeTypeArray18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21jsMimeTypeArrayLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13MimeTypeArray6lengthEv
+__ZNK7WebCore13MimeTypeArray13getPluginDataEv
+__ZN7WebCore19jsScreenAvailHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen11availHeightEv
+__ZN7WebCore19screenAvailableRectEPNS_6WidgetE
+__ZN7WebCore18jsScreenAvailWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen10availWidthEv
+__ZThn4_N7WebCore15HTMLBodyElementD0Ev
+__ZN7WebCoreL17buttonConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLButtonElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore17HTMLButtonElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore17HTMLButtonElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore17HTMLButtonElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore12RenderButton24updateBeforeAfterContentENS_8PseudoIdE
+__ZN7WebCore22jsHTMLInputElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLButtonElement14isEnumeratableEv
+__ZN7WebCore16HTMLEmbedElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore16HTMLEmbedElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_7ElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS5_
+__ZN7WebCore43jsNamedNodeMapPrototypeFunctionGetNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14JSNamedNodeMap9classInfoEv
+__ZN7WebCore6JSAttr15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore6JSAttrC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4AttrEEE
+__ZN7WebCore6JSAttrC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4AttrEEE
+__ZNK7WebCore10RenderText22containsOnlyWhitespaceEjj
+__ZNK7WebCore12RenderObject23outlineBoundsForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore17jsDOMWindowOpenerEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6openerEv
+__ZN7WebCore15JSMimeTypeArrayD1Ev
+__ZN7WebCore15JSMimeTypeArrayD2Ev
+__ZN7WebCore15jsDocumentFormsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSHTMLCollection18canGetItemsForNameEPN3JSC9ExecStateEPNS_14HTMLCollectionERKNS1_10IdentifierE
+__ZN7WebCoreL13getNamedItemsEPN3JSC9ExecStateEPNS_14HTMLCollectionERKNS0_10IdentifierE
+__ZNK7WebCore14HTMLCollection15updateNameCacheEv
+__ZN7WebCore16JSHTMLCollection10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore16HTMLInputElement26copyNonAttributePropertiesEPKNS_7ElementE
+__ZN7WebCore16JSDOMWindowShell16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZN7WebCore11JSDOMWindow16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZN7WebCore11JSDOMWindow22customGetPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore20JSDOMWindowPrototype9classInfoEv
+__ZN7WebCore9DOMWindow18canShowModalDialogEPKNS_5FrameE
+__ZNK7WebCore6Chrome11canRunModalEv
+__ZN7WebCore22jsHTMLInputElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18JSHTMLInputElement4typeEPN3JSC9ExecStateE
+__ZN3WTF10RefCountedIN7WebCore5XPath9ValueDataEE5derefEv
+__ZN7WebCoreL30createHTMLButtonElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLButtonElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLButtonElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLButtonElementEEE
+__ZN7WebCore19JSHTMLButtonElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLButtonElementEEE
+__ZN7WebCore19JSHTMLButtonElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28JSHTMLButtonElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19JSHTMLButtonElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZNK7WebCore19JSHTMLButtonElement9classInfoEv
+__ZN7WebCoreL29createHTMLDListElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLDListElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLDListElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLDListElementEEE
+__ZN7WebCore18JSHTMLDListElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLDListElementEEE
+__ZN7WebCore21jsElementOffsetHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsElementOffsetLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7Element10offsetLeftEv
+__ZNK7WebCore20RenderBoxModelObject10offsetLeftEv
+__ZN7WebCore21jsElementOffsetParentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7Element12offsetParentEv
+__ZN7WebCore18JSHTMLDListElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSHTMLDListElement9classInfoEv
+__ZNK7WebCore15DynamicNodeList24itemBackwardsFromCurrentEPNS_4NodeEji
+__ZN7WebCore30jsDOMWindowDocumentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSDocument14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSDocumentConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore33setJSDOMWindowDocumentConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore30setJSDOMWindowEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore12RenderInline5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCoreL22getPositionOffsetValueEPNS_11RenderStyleEi
+__ZN7WebCore12RenderObject10moveLayersEPNS_11RenderLayerES2_
+__ZNK7WebCore8Document7baseURIEv
+__ZN7WebCore10JSLocation3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore10JSLocation9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore17setJSLocationHrefEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation7setHrefEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCoreL17navigateIfAllowedEPN3JSC9ExecStateEPNS_5FrameERKNS_4KURLEbb
+__ZNK7WebCore17RenderFlexibleBox12avoidsFloatsEv
+__ZN7WebCore13HTMLTokenizer11stopParsingEv
+__ZN7WebCore11FrameLoader22tokenizerProcessedDataEv
+__ZN7WebCore18JSHTMLDListElementD1Ev
+__ZN7WebCore21jsNodePreviousSiblingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSStyleSheetList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsStyleSheetListLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSStyleSheet18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17jsStyleSheetTitleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsCSSStyleSheetCssRulesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsCSSStyleRuleStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsConsolePrototypeFunctionLogEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9JSConsole9classInfoEv
+__ZN7WebCore15ScriptCallStackC1EPN3JSC9ExecStateERKNS1_7ArgListEj
+__ZN7WebCore15ScriptCallStackC2EPN3JSC9ExecStateERKNS1_7ArgListEj
+__ZN7WebCore15ScriptCallFrameC1ERKN3JSC7UStringES4_iRKNS1_7ArgListEj
+__ZN7WebCore15ScriptCallFrameC2ERKN3JSC7UStringES4_iRKNS1_7ArgListEj
+__ZN3WTF6VectorIN7WebCore11ScriptValueELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore11ScriptValueELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore11ScriptValueELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore15ScriptCallFrameELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore15ScriptCallFrameELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore15ScriptCallFrameELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore11ScriptValueELm0EEC1ERKS3_
+__ZN3WTF6VectorIN7WebCore11ScriptValueELm0EEC2ERKS3_
+__ZN7WebCore15ScriptCallFrameD1Ev
+__ZN7WebCore15ScriptCallFrameD2Ev
+__ZN3WTF6VectorIN7WebCore11ScriptValueELm0EE6shrinkEm
+__ZN7WebCore11ScriptValueD1Ev
+__ZN7WebCore7Console3logEPNS_15ScriptCallStackE
+__ZN7WebCore7Console10addMessageENS_12MessageLevelEPNS_15ScriptCallStackEb
+__ZN7WebCore15ScriptCallStack2atEj
+__ZN7WebCoreL24getFirstArgumentAsStringEPN3JSC9ExecStateERKNS_15ScriptCallFrameERNS_6StringEb
+__ZNK7WebCore15ScriptCallFrame10argumentAtEj
+__ZN7WebCore19InspectorController19addMessageToConsoleENS_13MessageSourceENS_12MessageLevelEPNS_15ScriptCallStackE
+__ZN7WebCore15ScriptCallStackD1Ev
+__ZN7WebCore15ScriptCallStackD2Ev
+__ZN3WTF6VectorIN7WebCore15ScriptCallFrameELm0EE6shrinkEm
+__ZNK7WebCore26CSSMutableStyleDeclaration14getCommonValueEPKii
+__ZNK7WebCore26CSSMutableStyleDeclaration18isPropertyImplicitEi
+__ZN7WebCore24jsHTMLImageElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement6heightEb
+__ZN7WebCore19JSHTMLSelectElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL30createHTMLOptionElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLOptionElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLOptionElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLOptionElementEEE
+__ZN7WebCore19JSHTMLOptionElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLOptionElementEEE
+__ZN7WebCore19JSHTMLOptionElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25jsHTMLAnchorElementSearchEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement6searchEv
+__ZN7WebCore10JSLocation16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZN7WebCore10JSLocation22customGetPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore19JSLocationPrototype9classInfoEv
+__ZNK7WebCore21HTMLFrameOwnerElement15contentDocumentEv
+__ZN7WebCore17checkNodeSecurityEPN3JSC9ExecStateEPNS_4NodeE
+__ZN7WebCore33setJSHTMLIFrameElementFrameBorderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLFrameElementBase14setFrameBorderERKNS_6StringE
+__ZN7WebCore18JSHTMLDListElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore22reportCurrentExceptionEPN3JSC9ExecStateE
+__ZThn44_N7WebCore8Document15reportExceptionERKNS_6StringEiS3_
+__ZThn4_N7WebCore17HTMLScriptElementD0Ev
+__ZN7WebCore19jsDOMWindowOnresizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow8onresizeEv
+__ZN7WebCore22setJSDOMWindowOnresizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow11setOnresizeEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore19JSHTMLOptionElementD1Ev
+__ZN7WebCore15jsDocumentLinksEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document5linksEv
+__ZN7WebCore23jsHTMLAnchorElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9RenderBox36tryLayoutDoingPositionedMovementOnlyEv
+__ZThn4_N7WebCore18HTMLHeadingElementD0Ev
+__ZThn4_N7WebCore13HTMLBRElementD0Ev
+__ZN7WebCore18jsDOMWindowOnerrorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7onerrorEv
+__ZN7WebCore22jsHTMLEmbedElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27JSHTMLEmbedElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore14DragController27mayStartDragAtEventLocationEPKNS_5FrameERKNS_8IntPointE
+__ZNK7WebCore12EventHandler22dragHysteresisExceededERKNS_8IntPointE
+__ZN7WebCore47jsElementPrototypeFunctionGetBoundingClientRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore7Element21getBoundingClientRectEv
+__ZN7WebCore11RenderBlock13absoluteQuadsERN3WTF6VectorINS_9FloatQuadELm0EEE
+__ZN3WTF6VectorIN7WebCore9FloatQuadELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore9FloatQuadELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore9FloatQuadELm0EE15reserveCapacityEm
+__ZN7WebCore10ClientRectC1ERKNS_7IntRectE
+__ZN7WebCore10ClientRectC2ERKNS_7IntRectE
+__ZN3WTF6VectorIN7WebCore9FloatQuadELm0EE6shrinkEm
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10ClientRectE
+__ZN7WebCore12JSClientRect15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSClientRectC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10ClientRectEEE
+__ZN7WebCore12JSClientRectC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10ClientRectEEE
+__ZN7WebCore12JSClientRect18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsClientRectLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsElementScrollLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element10scrollLeftEv
+__ZNK7WebCore9RenderBox10scrollLeftEv
+__ZNK7WebCore15HTMLBodyElement10scrollLeftEv
+__ZN7WebCoreL13adjustForZoomEiPNS_9FrameViewE
+__ZNK7WebCore5Frame10zoomFactorEv
+__ZN7WebCore15jsClientRectTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsElementScrollTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element9scrollTopEv
+__ZNK7WebCore9RenderBox9scrollTopEv
+__ZNK7WebCore15HTMLBodyElement9scrollTopEv
+__ZN7WebCore19jsElementClientLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7Element10clientLeftEv
+__ZN7WebCore18jsElementClientTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7Element9clientTopEv
+__ZNK7WebCore17JSHTMLHtmlElement9classInfoEv
+__ZN7WebCore40jsDocumentPrototypeFunctionCreateCommentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document13createCommentERKNS_6StringE
+__ZN7WebCore16toJSNewlyCreatedEPN3JSC9ExecStateEPNS_4NodeE
+__ZN7WebCore9JSComment15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSCommentC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7CommentEEE
+__ZN7WebCore9JSCommentC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7CommentEEE
+__ZNK7WebCore9JSComment9classInfoEv
+__ZN7WebCore42jsElementPrototypeFunctionQuerySelectorAllEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15jsNodeLastChildEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSDOMWindowShell14deletePropertyEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore11JSDOMWindow14deletePropertyEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore19setJSDocumentDomainEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore8Document9setDomainERKNS_6StringE
+__ZN7WebCore14SecurityOrigin16setDomainFromDOMERKNS_6StringE
+__ZN7WebCore16ScriptController20updateSecurityOriginEv
+__ZN7WebCore12JSClientRectD1Ev
+__ZN7WebCore12JSClientRectD2Ev
+__ZN7WebCore9JSCommentD1Ev
+__ZN7WebCore19jsDOMWindowOnunloadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow8onunloadEv
+__ZN7WebCore22setJSDOMWindowOnunloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow11setOnunloadEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore38jsDocumentPrototypeFunctionExecCommandEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore37valueToStringWithUndefinedOrNullCheckEPN3JSC9ExecStateENS0_7JSValueE
+__ZN7WebCore8Document11execCommandERKNS_6StringEbS3_
+__ZN7WebCoreL7commandEPNS_8DocumentERKNS_6StringEb
+__ZN7WebCore6Editor7CommandC1Ev
+__ZN7WebCore6Editor7CommandC2Ev
+__ZNK7WebCore6Editor7Command7executeERKNS_6StringEPNS_5EventE
+__ZN7WebCore49jsDocumentPrototypeFunctionCreateDocumentFragmentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore18JSDocumentFragment15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSDocumentFragmentC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16DocumentFragmentEEE
+__ZN7WebCore18JSDocumentFragmentC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16DocumentFragmentEEE
+__ZN7WebCore18JSDocumentFragment18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSDocumentFragmentPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSDocumentFragment9classInfoEv
+__ZN7WebCore19setJSNodeOnkeypressEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node13setOnkeypressEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore18JSHTMLTableElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL36createHTMLTableSectionElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore25JSHTMLTableSectionElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSHTMLTableSectionElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23HTMLTableSectionElementEEE
+__ZN7WebCore25JSHTMLTableSectionElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23HTMLTableSectionElementEEE
+__ZN7WebCore25JSHTMLTableSectionElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL32createHTMLTableRowElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore21JSHTMLTableRowElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSHTMLTableRowElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLTableRowElementEEE
+__ZN7WebCore21JSHTMLTableRowElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLTableRowElementEEE
+__ZN7WebCore21JSHTMLTableRowElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30JSHTMLTableRowElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSHTMLTableRowElement9classInfoEv
+__ZN7WebCore46jsNodePrototypeFunctionCompareDocumentPositionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12RenderObject32handleDynamicFloatPositionChangeEv
+__ZN7WebCore11RenderBlock20childBecameNonInlineEPNS_12RenderObjectE
+__ZN3WTF6VectorIPN7WebCore4NodeELm16EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore4NodeELm16EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore4NodeELm16EE15reserveCapacityEm
+__ZN7WebCore22jsHTMLAnchorElementRelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement3relEv
+__ZN7WebCore18JSDocumentFragmentD1Ev
+__ZN7WebCore21JSHTMLTableRowElementD1Ev
+__ZN7WebCore25JSHTMLTableSectionElementD1Ev
+__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE15reserveCapacityEm
+__ZNK7WebCore15FontDescription13lighterWeightEv
+__ZN7WebCore32jsDOMWindowPrototypeFunctionOpenEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSDOMWindow4openEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore9DOMWindow10allowPopUpEPNS_5FrameE
+__ZN7WebCore42jsNodePrototypeFunctionRemoveEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore6JSNode19removeEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore15JSMimeTypeArray18canGetItemsForNameEPN3JSC9ExecStateEPNS_13MimeTypeArrayERKNS1_10IdentifierE
+__ZN7WebCore13MimeTypeArray18canGetItemsForNameERKNS_12AtomicStringE
+__ZN7WebCore15JSMimeTypeArray10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore13MimeTypeArray9namedItemERKNS_12AtomicStringE
+__ZN7WebCore8MimeTypeC1EN3WTF10PassRefPtrINS_10PluginDataEEEj
+__ZN7WebCore8MimeTypeC2EN3WTF10PassRefPtrINS_10PluginDataEEEj
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8MimeTypeE
+__ZN7WebCore10JSMimeType15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSMimeTypeC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8MimeTypeEEE
+__ZN7WebCore10JSMimeTypeC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8MimeTypeEEE
+__ZN7WebCore10JSMimeType18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23jsMimeTypeEnabledPluginEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8MimeType13enabledPluginEv
+__ZNK7WebCore18JSHTMLParamElement9classInfoEv
+__ZN7WebCore35jsNodePrototypeFunctionReplaceChildEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore6JSNode12replaceChildEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN3WTF7HashSetIPN7WebCore10StringImplENS1_15CaseFoldingHashENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_15CaseFoldingHashENS_10HashTraitsIS3_EES8_E6expand
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_15CaseFoldingHashENS_10HashTraitsIS3_EES8_E6rehash
+__ZN3WTF9HashTableIPN7WebCore10StringImplES3_NS_17IdentityExtractorIS3_EENS1_15CaseFoldingHashENS_10HashTraitsIS3_EES8_E13alloc
+__ZN7WebCore20setJSNodeOnmouseoverEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node14setOnmouseoverEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore19setJSNodeOnmouseoutEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node13setOnmouseoutEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore21setJSNodeOnmousewheelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node15setOnmousewheelEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore18jsNodeOnmousewheelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node12onmousewheelEv
+__ZN7WebCore20jsElementClientWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7Element11clientWidthEv
+__ZN7WebCore21jsElementClientHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7Comment9cloneNodeEb
+__ZN7WebCore10JSMimeTypeD1Ev
+__ZN7WebCore10JSMimeTypeD2Ev
+__ZN7WebCore8MimeTypeD1Ev
+__ZN7WebCore8MimeTypeD2Ev
+__ZN7WebCore22jsDOMWindowPageXOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7scrollXEv
+__ZN7WebCore22jsDOMWindowPageYOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7scrollYEv
+__ZN7WebCore21jsElementScrollHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLBodyElement12scrollHeightEv
+__ZNK7WebCore7Element12scrollHeightEv
+__ZNK7WebCore9RenderBox12scrollHeightEv
+__ZThn4_N7WebCore23TextControlInnerElementD0Ev
+__ZThn64_NK7WebCore16HTMLInputElement11placeholderEv
+__ZN7WebCore22JSHTMLTableCellElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore31jsNodeListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCoreL21imgToimageConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZThn44_NK7WebCore8Document10virtualURLEv
+__ZN3WTF6VectorIPN7WebCore24OverlapTestRequestClientELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore24OverlapTestRequestClientELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore24OverlapTestRequestClientELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIPN7WebCore24OverlapTestRequestClientELm0EE6shrinkEm
+__ZN7WebCore32jsHTMLSelectElementSelectedIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn44_NK7WebCore8Document18virtualCompleteURLERKNS_6StringE
+__ZN7WebCore19CSSCursorImageValueC1ERKNS_6StringERKNS_8IntPointE
+__ZN7WebCore19CSSCursorImageValueC2ERKNS_6StringERKNS_8IntPointE
+__ZN7WebCore19CSSCursorImageValue23updateIfSVGCursorIsUsedEPNS_7ElementE
+__ZN7WebCore19CSSCursorImageValue11cachedImageEPNS_9DocLoaderE
+__ZN7WebCore11RenderStyle9addCursorEPNS_11CachedImageERKNS_8IntPointE
+__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE15reserveCapacityEm
+__ZThn8_N7WebCore24DocumentThreadableLoader29getShouldUseCredentialStorageEPNS_17SubresourceLoaderERb
+__ZThn8_N7WebCore24DocumentThreadableLoader18didReceiveResponseEPNS_17SubresourceLoaderERKNS_16ResourceResponseE
+__ZThn8_N7WebCore14XMLHttpRequest18didReceiveResponseERKNS_16ResourceResponseE
+__ZThn8_N7WebCore24DocumentThreadableLoader14didReceiveDataEPNS_17SubresourceLoaderEPKci
+__ZThn8_N7WebCore14XMLHttpRequest14didReceiveDataEPKci
+__ZThn8_N7WebCore24DocumentThreadableLoader16didFinishLoadingEPNS_17SubresourceLoaderE
+__ZThn8_N7WebCore14XMLHttpRequest16didFinishLoadingEm
+__ZThn44_N7WebCore8Document33resourceRetrievedByXMLHttpRequestEmRKNS_12ScriptStringE
+__ZThn44_N7WebCore8Document10addMessageENS_18MessageDestinationENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS6_
+__ZN7WebCoreL10cornerRectEPKNS_11RenderLayerERKNS_7IntRectE
+__ZN7WebCoreL14modConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore14HTMLModElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14HTMLModElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore14HTMLModElement17endTagRequirementEv
+__ZNK7WebCore14HTMLModElement11tagPriorityEv
+__ZN7WebCore24jsHTMLIFrameElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLIFrameElement5widthEv
+__ZN7WebCore25jsHTMLIFrameElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLIFrameElement6heightEv
+__ZN7WebCore32jsHTMLIFrameElementContentWindowEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21HTMLFrameOwnerElement13contentWindowEv
+__ZN7WebCore39jsDOMWindowPrototypeFunctionPostMessageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSDOMWindow11postMessageEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore9DOMWindow11postMessageERKNS_6StringEPNS_11MessagePortES3_PS0_Ri
+__ZN7WebCore12MessageEventC1ERKNS_6StringES3_S3_N3WTF10PassRefPtrINS_9DOMWindowEEENS5_INS_11MessagePortEEE
+__ZN7WebCore12MessageEventC2ERKNS_6StringES3_S3_N3WTF10PassRefPtrINS_9DOMWindowEEENS5_INS_11MessagePortEEE
+__ZN7WebCore26jsHTMLSelectElementOptionsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17HTMLSelectElement7optionsEv
+__ZN7WebCore21HTMLOptionsCollection6createEN3WTF10PassRefPtrINS_17HTMLSelectElementEEE
+__ZN7WebCore21HTMLOptionsCollectionC1EN3WTF10PassRefPtrINS_17HTMLSelectElementEEE
+__ZN7WebCore21HTMLOptionsCollectionC2EN3WTF10PassRefPtrINS_17HTMLSelectElementEEE
+__ZN7WebCore23JSHTMLOptionsCollection15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSHTMLCollectionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSHTMLOptionsCollectionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21HTMLOptionsCollectionEEE
+__ZN7WebCore23JSHTMLOptionsCollectionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21HTMLOptionsCollectionEEE
+__ZN7WebCore23JSHTMLOptionsCollection3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore32setJSHTMLOptionsCollectionLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23JSHTMLOptionsCollection9setLengthEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore21HTMLOptionsCollection9setLengthEjRi
+__ZN7WebCore17HTMLSelectElement9setLengthEjRi
+__ZNK7WebCore17HTMLSelectElement6lengthEv
+__ZThn4_N7WebCore17HTMLOptionElementD0Ev
+__ZN7WebCore25jsHTMLSelectElementLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsDOMWindowOptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow6optionEPN3JSC9ExecStateE
+__ZN7WebCore19JSOptionConstructorC1EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore19JSOptionConstructorC2EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore28JSHTMLOptionElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSOptionConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCoreL26constructHTMLOptionElementEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZNK7WebCore19JSOptionConstructor8documentEv
+__ZN7WebCore17HTMLOptionElement8setValueERKNS_6StringE
+__ZN7WebCore17HTMLOptionElement18setDefaultSelectedEb
+__ZN7WebCore17HTMLOptionElement11setSelectedEb
+__ZN7WebCore23JSHTMLOptionsCollection3putEPN3JSC9ExecStateEjNS1_7JSValueE
+__ZN7WebCore23JSHTMLOptionsCollection11indexSetterEPN3JSC9ExecStateEjNS1_7JSValueE
+__ZN7WebCore17selectIndexSetterEPNS_17HTMLSelectElementEPN3JSC9ExecStateEjNS2_7JSValueE
+__ZN7WebCore19toHTMLOptionElementEN3JSC7JSValueE
+__ZNK7WebCore19JSHTMLOptionElement9classInfoEv
+__ZN7WebCore17HTMLSelectElement9setOptionEjPNS_17HTMLOptionElementERi
+__ZN7WebCore17HTMLSelectElement3addEPNS_11HTMLElementES2_Ri
+__ZN7WebCore19JSOptionConstructor4markEv
+__ZThn4_N7WebCore16HTMLInputElementD0Ev
+__ZN7WebCore23JSHTMLOptionsCollectionD1Ev
+__ZN7WebCore21HTMLOptionsCollectionD0Ev
+__ZN7WebCore19jsNodeOnselectstartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node13onselectstartEv
+__ZN7WebCore22setJSNodeOnselectstartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node16setOnselectstartEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore44jsHTMLDocumentPrototypeFunctionCaptureEventsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12HTMLDocument13captureEventsEv
+__ZN7WebCore41jsDOMWindowPrototypeFunctionCaptureEventsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow13captureEventsEv
+__ZN7WebCore20setJSNodeOnmousemoveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node14setOnmousemoveEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore18setJSNodeOnmouseupEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node12setOnmouseupEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore21setJSDOMWindowScrollXEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN3WTFeqIN7WebCore10CursorDataELm0EEEbRKNS_6VectorIT_XT0_EEES7_
-__ZN7WebCore17HTMLOptionElement10optionTextEv
-__ZNK7WebCore17HTMLOptionElement4textEv
-__ZNK7WebCore8Document25backslashAsCurrencySymbolEv
-__ZNK7WebCore6String18simplifyWhiteSpaceEv
-__ZN7WebCore10StringImpl18simplifyWhiteSpaceEv
-__ZN7WebCore12TextDocumentC2EPNS_17DOMImplementationEPNS_5FrameE
-__ZN7WebCore12TextDocument15createTokenizerEv
-__ZN7WebCore13TextTokenizerC2EPNS_8DocumentE
-__ZN7WebCore13TextTokenizer5writeERKNS_15SegmentedStringEb
-__ZN7WebCore13TextTokenizer6finishEv
-__ZN7WebCore13TextTokenizerD1Ev
-__ZN7WebCore12EventHandler37selectClosestWordOrLinkFromMouseEventERKNS_28MouseEventWithHitTestResultsE
-__ZN7WebCore9Selection27selectionFromContentsOfNodeEPNS_4NodeE
-__ZN7WebCore11RenderBlock20fillLeftSelectionGapEPNS_12RenderObjectEiiiPS0_iiiiPKNS1_9PaintInfoE
--[WebCoreMenuTarget forwardContextMenuAction:]
-__ZN7WebCore21ContextMenuController23contextMenuItemSelectedEPNS_15ContextMenuItemE
-__ZN7WebCore14ResourceHandle12releaseProxyEv
-__ZNK7WebCore14ResourceHandle10connectionEv
-__ZN7WebCore15StringTruncator5widthERKNS_6StringERKNS_4FontEb
-__ZN7WebCore15BackForwardList11itemAtIndexEi
-__ZN7WebCore15BackForwardList16forwardListCountEv
+__ZN7WebCore16PostMessageTimer5firedEv
+__ZN7WebCore9DOMWindow21postMessageTimerFiredEPNS_16PostMessageTimerE
+__ZN7WebCore16PostMessageTimerD0Ev
+__ZN7WebCore12MessageEventD0Ev
+__ZN7WebCore22setJSElementScrollLeftEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore7Element13setScrollLeftEi
-__ZN7WebCore12RenderObject13setScrollLeftEi
-__ZN3KJS6Plugin11indexGetterEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZN3KJS54jsXMLHttpRequestPrototypeFunctionGetAllResponseHeadersEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK7WebCore14XMLHttpRequest21getAllResponseHeadersERi
-__ZNK7WebCore20ResourceResponseBase16httpHeaderFieldsEv
-__ZN7WebCore18normalErrorHandlerEPvPKcz
-__ZN7WebCore12XMLTokenizer5errorENS0_9ErrorTypeEPKcPc
-__ZNK7WebCore12XMLTokenizer12columnNumberEv
-__ZNK7WebCore12XMLTokenizer10lineNumberEv
-__ZN7WebCore12XMLTokenizer11handleErrorENS0_9ErrorTypeEPKcii
-__ZN7WebCore12XMLTokenizer23insertErrorMessageBlockEv
-__ZN7WebCore21createTableColWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore21JSHTMLTableColElementC1EPN3KJS8JSObjectEPNS_19HTMLTableColElementE
-__ZN7WebCore21JSHTMLTableColElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSHTMLTableColElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZNK7WebCore16HTMLTableElement5tHeadEv
-__ZN3KJS17staticValueGetterIN7WebCore25JSHTMLTableSectionElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore25JSHTMLTableSectionElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore25JSHTMLTableSectionElement4implEv
-__ZN7WebCore23HTMLTableSectionElement4rowsEv
-__ZN7WebCore19HTMLTableRowElement5cellsEv
-__ZN7WebCore14RenderTableCol27absoluteClippedOverflowRectEv
-__ZN7WebCore14commentHandlerEPvPKh
-__ZN7WebCore12XMLTokenizer7commentEPKh
-__ZNK7WebCore22JSHTMLParagraphElement9classInfoEv
-__ZNK7WebCore17HTMLAnchorElement4hashEv
-__ZN7WebCoreplEcRKNS_16DeprecatedStringE
-__ZNK7WebCore17CSSInheritedValue7cssTextEv
-__ZN7WebCore17appletConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLAppletElementC2EPNS_8DocumentE
+__ZN7WebCore9RenderBox13setScrollLeftEi
+__ZN7WebCore18jsDOMWindowScrollYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25setJSXMLHttpRequestOnloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26setJSXMLHttpRequestOnerrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZNK7WebCore9FloatRectcv7_NSRectEv
+__ZN7WebCore23jsDOMWindowFrameElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow12frameElementEv
+__ZN7WebCore22jsHTMLScriptElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLScriptElement3srcEv
+__ZNK7WebCore27XMLHttpRequestProgressEvent29isXMLHttpRequestProgressEventEv
+__ZN7WebCore15getDOMStructureINS_29JSXMLHttpRequestProgressEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore29JSXMLHttpRequestProgressEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSProgressEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSXMLHttpRequestProgressEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_27XMLHttpRequestProgressEventEEE
+__ZN7WebCore29JSXMLHttpRequestProgressEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_27XMLHttpRequestProgressEventEEE
+__ZN7WebCore35setJSHTMLSelectElementSelectedIndexEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9JSComment18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSHTMLTableElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSHTMLTableElement9classInfoEv
+__ZN7WebCore34JSHTMLTableSectionElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSHTMLTableSectionElement9classInfoEv
+__ZN7WebCore28JSHTMLSelectElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSHTMLSelectElement9classInfoEv
+__ZNK7WebCore18JSHTMLEmbedElement9classInfoEv
+__ZN7WebCore30nonCachingStaticFunctionGetterIXadL_ZNS_39jsDOMWindowPrototypeFunctionPostMessageEPN3JSC9ExecStateEPNS1_8JSObject
+__ZN7WebCore18JSHTMLStyleElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25setJSHTMLStyleElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLStyleElement7setTypeERKNS_12AtomicStringE
+__ZN7WebCore25setJSHTMLElementInnerTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore31setJSCSSStyleDeclarationCssTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16jsNodeOnmouseoutEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node10onmouseoutEv
+__ZN7WebCore26setJSHTMLIFrameElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLFrameElementBase7setNameERKNS_6StringE
+__ZN7WebCore31setJSHTMLIFrameElementScrollingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLFrameElementBase12setScrollingERKNS_6StringE
+__ZNK7WebCore12RenderInline30relativePositionedInlineOffsetEPKNS_9RenderBoxE
+__ZNK7WebCore12RenderInline9offsetTopEv
+__ZNK7WebCore12RenderInline10offsetLeftEv
+__ZN7WebCore16FixedTableLayoutC1EPNS_11RenderTableE
+__ZN7WebCore16FixedTableLayoutC2EPNS_11RenderTableE
+__ZN7WebCore16FixedTableLayout14calcPrefWidthsERiS1_
+__ZN7WebCore16FixedTableLayout14calcWidthArrayEi
+__ZN3WTF6VectorIN7WebCore6LengthELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore6LengthELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore6LengthELm0EE4fillERKS2_m
+__ZSt4fillIPN7WebCore6LengthES1_EvT_S3_RKT0_
+__ZN7WebCore16FixedTableLayout6layoutEv
+__ZN7WebCore29JSXMLHttpRequestProgressEventD1Ev
+__ZThn268_N7WebCore11CachedImage20shouldPauseAnimationEPKNS_5ImageE
+__ZN7WebCore23jsHTMLImageElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement5widthEb
+__ZN7WebCore22jsHTMLParamElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLParamElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsDOMWindowDocumentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21ApplicationCacheGroup27fallbackCacheForMainRequestERKNS_15ResourceRequestEPNS_14DocumentLoaderE
+__ZN7WebCore23ApplicationCacheStorage24fallbackCacheGroupForURLERKNS_4KURLE
+__ZNK7WebCore11FrameLoader23isHostedByObjectElementEv
+__ZN7WebCore11FrameLoader21handleFallbackContentEv
+__ZN7WebCoreL12radioMarginsEj
+__ZN7WebCore5Image12supportsTypeERKNS_6StringE
+__ZN7WebCore16MIMETypeRegistry32isSupportedImageResourceMIMETypeERKNS_6StringE
+__ZN7WebCore13ImageDocumentC1EPNS_5FrameE
+__ZN7WebCore13ImageDocumentC2EPNS_5FrameE
+__ZNK7WebCore13ImageDocument17shouldShrinkToFitEv
+__ZN7WebCore13ImageDocument15createTokenizerEv
+__ZNK7WebCore14ImageTokenizer12wantsRawDataEv
+__ZN7WebCore14ImageTokenizer12writeRawDataEPKci
+__ZN7WebCore13ImageDocument11cachedImageEv
+__ZN7WebCore13ImageDocument23createDocumentStructureEv
+__ZNK7WebCore14DocumentLoader16mainResourceDataEv
+__ZN7WebCore13ImageDocument12imageChangedEv
+__ZN7WebCore14ImageTokenizer6finishEv
+__ZNK7WebCore14DocumentLoader25isLoadingMultipartContentEv
+__ZNK7WebCore4KURL17lastPathComponentEv
+__ZN7WebCore10imageTitleERKNS_6StringERKNS_7IntSizeE
+__ZN7WebCore14ImageTokenizerD0Ev
+__ZN7WebCore20jsNamedNodeMapLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSNamedNodeMap18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore14JSNamedNodeMap11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZNK7WebCore12NamedNodeMap4itemEj
+__ZN7WebCore6JSAttr18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore10jsAttrNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11jsAttrValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLAreaElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17JSHTMLAreaElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore23jsHTMLIFrameElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLFrameElementBase4nameEv
+__ZN3WTF9HashTableIjSt4pairIjNS_6RefPtrIN7WebCore17CSSPrimitiveValueEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14PairHa
+__ZN7WebCore17jsHTMLElementLangEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11HTMLElement4langEv
+__ZN7WebCore20jsHTMLLinkElementRelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement3relEv
+__ZN7WebCore11RenderTable16overflowClipRectEii
+__ZN7WebCore6JSAttrD1Ev
+__ZN7WebCore40jsDocumentPrototypeFunctionQuerySelectorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19jsCharacterDataDataEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsHTMLMetaElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLMetaElement4nameEv
+__ZN7WebCore21jsHTMLFormElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLFormElement4nameEv
+__ZN7WebCore16JSDOMWindowShell15unwrappedObjectEv
+__ZNK3JSC14JSGlobalObject14isGlobalObjectEv
+__ZN7WebCore16HTMLEmbedElement13canLazyAttachEv
+__ZN7WebCore18MainResourceLoader7didFailERKNS_13ResourceErrorE
+__ZN7WebCore18MainResourceLoader13receivedErrorERKNS_13ResourceErrorE
+__ZN7WebCore23setJSHTMLLinkElementRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLLinkElement6setRelERKNS_6StringE
+__ZN7WebCore24setJSHTMLLinkElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLLinkElement7setTypeERKNS_6StringE
+__ZN7WebCore25setJSHTMLLinkElementMediaEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLLinkElement8setMediaERKNS_6StringE
+__ZN7WebCore27setJSHTMLIFrameElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLIFrameElement8setWidthERKNS_6StringE
+__ZN7WebCore28setJSHTMLIFrameElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLIFrameElement9setHeightERKNS_6StringE
+__ZN7WebCore33setJSHTMLIFrameElementMarginWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLFrameElementBase14setMarginWidthERKNS_6StringE
+__ZN7WebCore34setJSHTMLIFrameElementMarginHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLFrameElementBase15setMarginHeightERKNS_6StringE
+__ZThn4_N7WebCore15HTMLHtmlElementD0Ev
+__ZN7WebCore11FrameLoader15didExplicitOpenEv
+__ZN7WebCore36jsHTMLDocumentPrototypeFunctionCloseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26setJSHTMLObjectElementDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLObjectElement7setDataERKNS_6StringE
+__ZN7WebCore26setJSHTMLObjectElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLObjectElement7setTypeERKNS_6StringE
+__ZN7WebCore18JSHTMLParamElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25setJSHTMLParamElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLParamElement7setNameERKNS_6StringE
+__ZN7WebCore26setJSHTMLParamElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLParamElement8setValueERKNS_6StringE
+__ZN7WebCore27RenderTextControlInnerBlock16positionForPointERKNS_8IntPointE
+__ZN7WebCore5Frame27doTextFieldCommandFromEventEPNS_7ElementEPNS_13KeyboardEventE
+__ZNK7WebCore23BeforeTextInsertedEvent25isBeforeTextInsertedEventEv
+__ZN7WebCore12InputElement29handleBeforeTextInsertedEventERNS_16InputElementDataEPNS_8DocumentEPNS_5EventE
+__ZN7WebCoreL19numGraphemeClustersEPNS_10StringImplE
+__ZN7WebCore20CompositeEditCommand10appendNodeEN3WTF10PassRefPtrINS_4NodeEEENS2_INS_7ElementEEE
+__ZN7WebCore17AppendNodeCommandC1EN3WTF10PassRefPtrINS_7ElementEEENS2_INS_4NodeEEE
+__ZN7WebCore17AppendNodeCommandC2EN3WTF10PassRefPtrINS_7ElementEEENS2_INS_4NodeEEE
+__ZN7WebCore17AppendNodeCommand7doApplyEv
+__ZN7WebCore27RenderTextControlSingleLine17subtreeHasChangedEv
+__ZN7WebCore17RenderTextControl17subtreeHasChangedEv
+__ZThn64_N7WebCore16HTMLInputElement20setValueFromRendererERKNS_6StringE
+__ZN7WebCore16HTMLInputElement20setValueFromRendererERKNS_6StringE
+__ZN7WebCore12InputElement20setValueFromRendererERNS_16InputElementDataEPNS_8DocumentERKNS_6StringE
+__ZThn64_NK7WebCore16HTMLInputElement30searchEventsShouldBeDispatchedEv
+__ZNK7WebCore16HTMLInputElement30searchEventsShouldBeDispatchedEv
+__ZN7WebCore5Frame24textFieldDidBeginEditingEPNS_7ElementE
+-[DOMHTMLInputElement value]
+__ZN7WebCore5Frame24textDidChangeInTextFieldEPNS_7ElementE
+-[DOMHTMLInputElement form]
+__Z3kitPN7WebCore15HTMLFormElementE
+-[DOMHTMLFormElement action]
+__ZNK7WebCore15HTMLFormElement6actionEv
+-[DOMHTMLInputElement(FormPromptAdditions) _isEdited]
+-[DOMHTMLInputElement disabled]
+__ZN7WebCore5Frame25matchLabelsAgainstElementEP7NSArrayPNS_7ElementE
+__ZN7WebCore7replaceERNS_6StringERKNS_17RegularExpressionERKS0_
+__ZN7WebCore17RegularExpressionD1Ev
+__ZN7WebCore17RegularExpressionD2Ev
+__ZN7WebCore17RegularExpression7PrivateD1Ev
+__ZN7WebCore17RegularExpression7PrivateD2Ev
+__ZN7WebCoreL15regExpForLabelsEP7NSArray
+__ZN3WTF6VectorIPN7WebCore17RegularExpressionELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore17RegularExpressionELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore17RegularExpressionELm0EE15reserveCapacityEm
+__ZN7WebCore5Frame28searchForLabelsBeforeElementEP7NSArrayPNS_7ElementE
+__ZNK7WebCore17RegularExpression9searchRevERKNS_6StringE
+__ZNK7WebCore17RegularExpression13matchedLengthEv
+__ZNK7WebCore6Editor7Command7executeEPNS_5EventE
+__ZN7WebCoreL21enabledInEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCoreL20executeInsertNewlineEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL11targetFrameEPNS_5FrameEPNS_5EventE
+__ZNK7WebCore6Editor13canEditRichlyEv
+__ZN7WebCore22HTMLFormControlElement8onChangeEv
+__ZN7WebCore15HTMLFormElement11submitClickEPNS_5EventE
+__ZNK7WebCore16HTMLInputElement24isSuccessfulSubmitButtonEv
+__ZN7WebCore4Node22dispatchSimulatedClickEN3WTF10PassRefPtrINS_5EventEEEbb
+__ZN7WebCore4Node27dispatchSimulatedMouseEventERKNS_12AtomicStringEN3WTF10PassRefPtrINS_5EventEEE
+__ZN7WebCore15HTMLFormElement13prepareSubmitEPNS_5EventE
+__ZNK7WebCore16HTMLInputElement17isActivatedSubmitEv
+-[DOMDocument URL]
+__ZN7WebCore27runtimeObjectPropertyGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPNS2_8Bindings6MethodENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSB_IS8_EEE3setEPS4
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_PNS2_8Bindings6MethodEENS_18PairFirstExtractorISA_EENS_7StrHashIS5
+__ZN3WTF6VectorIPN3JSC8Bindings6MethodELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorIPN3JSC8Bindings6MethodELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN3JSC8Bindings6MethodELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIPN3JSC8Bindings6MethodELm0EE6shrinkEm
+__ZN3JSC16RuntimeObjectImp12methodGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN3JSC13RuntimeMethodC1EPNS_9ExecStateERKNS_10IdentifierERN3WTF6VectorIPNS_8Bindings6MethodELm0EEE
+__ZN3JSC13RuntimeMethodC2EPNS_9ExecStateERKNS_10IdentifierERN3WTF6VectorIPNS_8Bindings6MethodELm0EEE
+__ZN3WTF6VectorIPN3JSC8Bindings6MethodELm0EEC1ERKS5_
+__ZN3WTF6VectorIPN3JSC8Bindings6MethodELm0EEC2ERKS5_
+__ZN3JSC13RuntimeMethod11getCallDataERNS_8CallDataE
+__ZN3JSCL17callRuntimeMethodEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN7WebCore18JSHTMLEmbedElement10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore19runtimeObjectGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK3JSC16RuntimeObjectImp9classInfoEv
+__ZN3JSC8Bindings9CInstance12invokeMethodEPNS_9ExecStateERKN3WTF6VectorIPNS0_6MethodELm0EEERKNS_7ArgListE
+__ZN3JSC8Bindings9CInstance30moveGlobalExceptionToExecStateEPNS_9ExecStateE
+__ZN3JSC8BindingsL21globalExceptionStringEv
+__ZN3JSC8Bindings23convertNPVariantToValueEPNS_9ExecStateEPK10_NPVariantPNS0_10RootObjectE
+__ZN3WTF6VectorI10_NPVariantLm8EE6shrinkEm
+__ZN7WebCore18JSHTMLEmbedElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore18JSHTMLEmbedElement9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore18JSHTMLLabelElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore18JSHTMLTableElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25JSHTMLTableSectionElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore21JSHTMLTableRowElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN3JSC16RuntimeObjectImp10invalidateEv
+__ZN7WebCore17AppendNodeCommandD0Ev
+__ZN7WebCore13MimeTypeArrayD1Ev
+__ZThn4_N7WebCore11EditingTextD0Ev
+__ZN3JSC13RuntimeMethodD1Ev
+__ZN7WebCore15HTMLLinkElement19removedFromDocumentEv
+__ZN7WebCore16HTMLEmbedElement19removedFromDocumentEv
+__ZThn4_N7WebCore15HTMLLinkElementD0Ev
+__ZN7WebCore21JSClientRectPrototypeD1Ev
+__ZN7WebCore24JSMimeTypeArrayPrototypeD1Ev
+__ZN7WebCore18JSHistoryPrototypeD1Ev
+__ZN7WebCore27JSHTMLStyleElementPrototypeD1Ev
+__ZThn4_N7WebCore16HTMLUListElementD0Ev
+__ZN7WebCore28JSHTMLObjectElementPrototypeD1Ev
+__ZN7WebCore27JSHTMLParamElementPrototypeD1Ev
+__ZN7WebCore27JSHTMLEmbedElementPrototypeD1Ev
+__ZN7WebCore31JSHTMLParagraphElementPrototypeD1Ev
+__ZN7WebCore27JSHTMLLabelElementPrototypeD1Ev
+__ZN7WebCore27JSHTMLTableElementPrototypeD1Ev
+__ZN7WebCore34JSHTMLTableSectionElementPrototypeD1Ev
+__ZN7WebCore30JSHTMLTableRowElementPrototypeD1Ev
+__ZN7WebCore31JSHTMLTableCellElementPrototypeD1Ev
+__ZN7WebCore16HTMLLabelElement9setActiveEbb
+__ZN7WebCore16HTMLLabelElement10setHoveredEb
+__ZN7WebCore16HTMLLabelElement20correspondingControlEv
+__ZN7WebCore26CSSMutableStyleDeclarationaSERKS0_
+__ZThn4_N7WebCore17HTMLObjectElementD0Ev
+__ZN7WebCore19JSHTMLOptionElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore15PurgeableBufferD1Ev
+__ZN7WebCore15PurgeableBufferD2Ev
+__ZN7WebCore30JSHTMLAnchorElementConstructorD1Ev
+__ZN7WebCore27JSHTMLDivElementConstructorD1Ev
+__ZN7WebCore27JSHTMLDListElementPrototypeD1Ev
+__ZN7WebCore28JSHTMLOptionElementPrototypeD1Ev
+__ZNK7WebCore16HTMLImageElement17canStartSelectionEv
+__ZN7WebCoreL17appletConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLAppletElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17HTMLAppletElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore17HTMLAppletElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZNK7WebCore17HTMLAppletElement11tagPriorityEv
 __ZN7WebCore17HTMLAppletElement20insertedIntoDocumentEv
-__ZN7WebCore17HTMLAppletElement21finishParsingChildrenEv
-__ZN7WebCore17HTMLAppletElement6detachEv
 __ZN7WebCore17HTMLAppletElement16rendererIsNeededEPNS_11RenderStyleE
 __ZN7WebCore17HTMLAppletElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN3WTF7HashMapIN7WebCore6StringES2_NS1_10StringHashENS_10HashTraitsIS2_EES5_E3setERKS2_S8_
 __ZN7WebCore12RenderAppletC1EPNS_17HTMLAppletElementERKN3WTF7HashMapINS_6StringES5_NS_10StringHashENS3_10HashTraitsIS5_EES8_EE
+__ZN7WebCore12RenderAppletC2EPNS_17HTMLAppletElementERKN3WTF7HashMapINS_6StringES5_NS_10StringHashENS3_10HashTraitsIS5_EES8_EE
+__ZN7WebCore17HTMLAppletElement21finishParsingChildrenEv
 __ZN7WebCore12RenderApplet6layoutEv
 __ZN7WebCore12RenderApplet23createWidgetIfNecessaryEv
-__ZN7WebCore11FrameLoader22createJavaAppletWidgetERKNS_7IntSizeEPNS_7ElementERKN3WTF7HashMapINS_6StringES8_NS_10StringHashENS6_10HashTraitsIS8_EESB_EE
-__ZN7WebCore6WidgetC1Ev
-__ZN7WebCore12RenderWidget20updateWidgetPositionEv
-__ZN7WebCore12RenderAppletD1Ev
-__ZN7WebCore17HTMLAppletElementD1Ev
-__ZNK3KJS40StringInstanceThatMasqueradesAsUndefined21masqueradeAsUndefinedEv
-__ZN3KJS40StringInstanceThatMasqueradesAsUndefinedD0Ev
-__ZNK7WebCore21JSMouseEventPrototype9classInfoEv
-__ZNK7WebCore18JSUIEventPrototype9classInfoEv
-__ZNK7WebCore10MouseEvent11fromElementEv
-__ZNK7WebCore10MouseEvent11isDragEventEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_9ClipboardE
-__ZNK7WebCore17MouseRelatedEvent6layerYEv
-__ZNK7WebCore7UIEvent8charCodeEv
-__ZNK7WebCore17MouseRelatedEvent6layerXEv
-__ZN7WebCore24JSCSSStyleSheetPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore39jsCSSStyleSheetPrototypeFunctionAddRuleEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore11FrameLoader22createJavaAppletWidgetERKNS_7IntSizeEPNS_17HTMLAppletElementERKN3WTF7HashMapINS_6StringES8_NS_10Stri
+__ZN7WebCore17jsDocumentAppletsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document7appletsEv
+__ZN7WebCoreL30createHTMLAppletElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLAppletElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLAppletElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLAppletElementEEE
+__ZN7WebCore19JSHTMLAppletElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLAppletElementEEE
+__ZN7WebCore19JSHTMLAppletElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19JSHTMLAppletElement18canGetItemsForNameEPN3JSC9ExecStateEPNS_17HTMLAppletElementERKNS1_10IdentifierE
+__ZN7WebCore19JSHTMLAppletElement24customGetOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement25renderWidgetForJSBindingsEv
+__ZN3JSC8Bindings12JavaInstanceC1EP8_jobjectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC8Bindings12JavaInstanceC2EP8_jobjectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC8Bindings14JObjectWrapperC1EP8_jobject
+__ZN3JSC8Bindings14JObjectWrapperC2EP8_jobject
+__ZN3JSC8Bindings9getJNIEnvEv
+__ZN3JSC8Bindings9getJavaVMEv
+__ZN3JSC8BindingsL21KJS_GetCreatedJavaVMsEPP7JavaVM_lPl
+__ZN3JSC8Bindings12JavaInstance12virtualBeginEv
+__ZNK3JSC8Bindings12JavaInstance8getClassEv
+__ZN3JSC8Bindings9JavaClassC1EP8_jobject
+__ZN3JSC8Bindings9JavaClassC2EP8_jobject
+__ZN3JSC8Bindings13callJNIMethodIP8_jobjectEET_S3_PKcS6_z
+__ZN3JSC8BindingsL14callJNIMethodVIP8_jobjectEET_S3_PKcS6_Pc
+__ZN3JSC8Bindings24getCharactersFromJStringEP8_jstring
+__ZN3JSC8Bindings29getCharactersFromJStringInEnvEP7JNIEnv_P8_jstring
+__ZN3JSC8Bindings27releaseCharactersForJStringEP8_jstringPKc
+__ZN3JSC8Bindings32releaseCharactersForJStringInEnvEP7JNIEnv_P8_jstringPKc
+__ZN3JSC8Bindings9JavaFieldC1EP7JNIEnv_P8_jobject
+__ZN3JSC8Bindings9JavaFieldC2EP7JNIEnv_P8_jobject
+__ZN3JSC8Bindings30getUCharactersFromJStringInEnvEP7JNIEnv_P8_jstring
+__ZN3JSC8Bindings33releaseUCharactersForJStringInEnvEP7JNIEnv_P8_jstringPKt
+__ZN3JSC8Bindings20JNITypeFromClassNameEPKc
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPNS2_8Bindings5FieldENS_7StrHashIS5_EENS_10HashTraitsIS5_EENSB_IS8_EEE3setEPS4_
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_PNS2_8Bindings5FieldEENS_18PairFirstExtractorISA_EENS_7StrHashIS5_
+__ZN3JSC8Bindings10JavaMethodC1EP7JNIEnv_P8_jobject
+__ZN3JSC8Bindings10JavaMethodC2EP7JNIEnv_P8_jobject
+__ZN3JSC8Bindings13callJNIMethodIlEET_P8_jobjectPKcS6_z
+__ZN3JSC8BindingsL14callJNIMethodVIlEET_P8_jobjectPKcS6_Pc
+__ZN3JSC8Bindings19callJNIStaticMethodIhEET_P7_jclassPKcS6_z
+__ZN7JNIEnv_23CallStaticBooleanMethodEP7_jclassP10_jmethodIDz
+__ZNK3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPNS_6VectorIPNS2_8Bindings6MethodELm0EEENS_7StrHashIS5_EENS_10HashTraitsIS5_EE
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC7UString3RepEEEPNS_6VectorIPNS2_8Bindings6MethodELm0EEENS_7StrHashIS5_EENS_10HashTraitsIS5_EEN
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC7UString3RepEEESt4pairIS5_PNS_6VectorIPNS2_8Bindings6MethodELm0EEEENS_18PairFirstExtractorIS
+__ZN3JSC8Bindings13JavaParameterC1EP7JNIEnv_P8_jstring
+__ZN3JSC8Bindings13JavaParameterC2EP7JNIEnv_P8_jstring
+__ZNK3JSC8Bindings9JavaClass10fieldNamedERKNS_10IdentifierEPNS0_8InstanceE
+__ZNK3JSC8Bindings9JavaClass12methodsNamedERKNS_10IdentifierEPNS0_8InstanceE
+__ZN3JSC8Bindings12JavaInstance10virtualEndEv
+__ZNK7WebCore19JSHTMLAppletElement9classInfoEv
+__ZN7WebCore19JSHTMLAppletElement10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN3JSC8Bindings12JavaInstance12invokeMethodEPNS_9ExecStateERKN3WTF6VectorIPNS0_6MethodELm0EEERKNS_7ArgListE
+__ZNK3JSC8Bindings10JavaMethod13numParametersEv
+__ZN3JSC8Bindings20convertValueToJValueEPNS_9ExecStateENS_7JSValueE7JNITypePKc
+__ZNK3JSC8Bindings10RootObject12nativeHandleEv
+__ZNK3JSC8Bindings10JavaMethod8methodIDEP8_jobject
+__ZNK3JSC8Bindings10JavaMethod9signatureEv
+__ZN3JSC8Bindings26signatureFromPrimitiveTypeE7JNIType
+__ZL15appendClassNameRN3JSC7UStringEPKc
+__ZN3JSC8Bindings11getMethodIDEP8_jobjectPKcS4_
+__ZNK3JSC8Bindings10JavaMethod13JNIReturnTypeEv
+__ZN3JSC8Bindings15dispatchJNICallEPNS_9ExecStateEPKvP8_jobjectb7JNITypeP10_jmethodIDP6jvalueRSA_PKcRNS_7JSValueE
+__ZN7WebCoreL27createHTMLModElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore16JSHTMLModElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSHTMLModElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLModElementEEE
+__ZN7WebCore16JSHTMLModElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLModElementEEE
+__ZN7WebCore16JSHTMLModElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore10ShadowDataeqERKS0_
+__ZN3WTF6VectorIN7WebCore10CursorDataELm0EE6shrinkEm
+__ZN7WebCoreL15checkboxMarginsEj
+__ZN7WebCore21jsHTMLEmbedElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLEmbedElement3srcEv
+__ZN7WebCore19jsNodeParentElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11FrameLoader21fileDoesNotExistErrorERKNS_16ResourceResponseE
+__ZN7WebCore26NetscapePlugInStreamLoader9didCancelERKNS_13ResourceErrorE
+__ZN7WebCore10IconLoaderD0Ev
+__ZN7WebCore19JSHTMLAppletElementD1Ev
+__ZN7WebCore16JSHTMLModElementD1Ev
+__ZThn4_N7WebCore16HTMLEmbedElementD0Ev
+__ZN7WebCore16HTMLTitleElement19removedFromDocumentEv
+__ZN7WebCore8Document11removeTitleEPNS_7ElementE
+__ZN7WebCore16HTMLStyleElement19removedFromDocumentEv
+__ZN7WebCore12StyleElement19removedFromDocumentEPNS_8DocumentE
+__ZN7WebCore5XPathL10isAxisNameERKNS_6StringERNS0_4Step4AxisE
+__ZN7WebCore5XPathL17setUpAxisNamesMapERN3WTF7HashMapINS_6StringENS0_4Step4AxisENS_10StringHashENS1_10HashTraitsIS3_EENS7_IS5_E
+__ZN3WTF7HashMapIN7WebCore6StringENS1_5XPath4Step4AxisENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERKS2_RKS5_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_5XPath4Step4AxisEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHas
+__ZN7WebCore5XPathL13createFunLastEv
+__ZN7WebCore5XPath6FilterC1EPNS0_10ExpressionERKN3WTF6VectorIPNS0_9PredicateELm0EEE
+__ZN7WebCore5XPath6FilterC2EPNS0_10ExpressionERKN3WTF6VectorIPNS0_9PredicateELm0EEE
+__ZNK7WebCore5XPath6Filter8evaluateEv
+__ZN7WebCore5XPath5Value17modifiableNodeSetEv
+__ZNK7WebCore5XPath7FunLast8evaluateEv
+__ZNK7WebCore5XPath5Value8toNumberEv
+__ZN7WebCore5XPath6NumberC1Ed
+__ZN7WebCore5XPath6NumberC2Ed
+__ZN7WebCore5XPathL17createFunPositionEv
+__ZNK7WebCore5XPath11FunPosition8evaluateEv
+__ZNK7WebCore5XPath6Number8evaluateEv
+__ZN7WebCore5XPath11FunPositionD0Ev
+__ZN7WebCore5XPath6NumberD0Ev
+__ZN7WebCore5XPath6FilterD0Ev
+__ZN7WebCore5XPath7FunLastD0Ev
+__ZN7WebCore23jsHTMLAnchorElementHostEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement4hostEv
+__ZN7WebCore5XPath6Parser9lexNumberEv
+__ZN7WebCore5XPath9NumericOpC1ENS1_6OpcodeEPNS0_10ExpressionES4_
+__ZN7WebCore5XPath9NumericOpC2ENS1_6OpcodeEPNS0_10ExpressionES4_
+__ZN7WebCore5XPath9NumericOpD0Ev
+__ZNK7WebCore5XPath9NumericOp8evaluateEv
+__ZN7WebCore11FrameLoader14setOpenedByDOMEv
+__ZN3WTF7HashSetIPN7WebCore5FrameENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore5FrameES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore5FrameES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore5FrameES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTableEi
+__ZN7WebCore13EventListener14markJSFunctionEv
+__ZN7WebCore12NamedNodeMap15removeAttributeERKNS_13QualifiedNameE
+__ZN7WebCore7Element24dispatchAttrRemovalEventEPNS_9AttributeE
+__ZN7WebCore12RenderInline11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN3WTF9HashTableIPN7WebCore5FrameES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22Iden
+__ZN3WTF9HashTableIPN7WebCore5FrameES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInvalid
+__ZN3WTF9HashTableIPN7WebCore5FrameES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore22JSXPathResultPrototypeD1Ev
+__ZN7WebCore24JSXPathResultConstructorD1Ev
+__ZN7WebCore16HTMLOListElementD0Ev
+__ZN7WebCore13MediaQueryExpD1Ev
+__ZN7WebCore13MediaQueryExpD2Ev
+__ZN3WTF6VectorIPN7WebCore13MediaQueryExpELm0EE6shrinkEm
+__ZN7WebCore13CSSImportRuleD0Ev
+__ZThn12_N7WebCore14XMLHttpRequest4stopEv
+__ZN7WebCore14XMLHttpRequest4stopEv
+__ZN7WebCore21JSDocumentConstructorD1Ev
+__ZN7WebCore25JSXMLHttpRequestPrototypeD1Ev
+__ZN7WebCore27JSXMLHttpRequestConstructorD1Ev
+__ZN7WebCore9JSConsoleD1Ev
+__ZN7WebCore9JSConsoleD2Ev
+__ZN7WebCore18JSConsolePrototypeD1Ev
+__ZThn4_N7WebCore13HTMLLIElementD0Ev
+__ZThn4_N7WebCore17HTMLSelectElementD0Ev
+__ZThn4_N7WebCore16HTMLDListElementD0Ev
+__ZN7WebCore23jsHTMLAnchorElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement4typeEv
+__ZNK7WebCore11RenderBlock14positionForBoxEPNS_9InlineBoxEb
+__ZN7WebCore20jsHTMLLIElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13HTMLLIElement5valueEv
+__ZN7WebCore26jsHTMLLIElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSHTMLLIElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore24JSHTMLLIElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19jsHTMLLIElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13HTMLLIElement4typeEv
+__ZNK7WebCore26CSSMutableStyleDeclaration24getLayeredShorthandValueEPKij
+__ZNK7WebCore8CSSValue22isImplicitInitialValueEv
+__ZN7WebCore29jsHTMLUListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLUListElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLUListElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore38jsEventPrototypeFunctionPreventDefaultEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore21setJSEventReturnValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39jsEventPrototypeFunctionStopPropagationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore22setJSEventCancelBubbleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore27jsHTMLAnchorElementProtocolEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement8protocolEv
+__ZN7WebCore25jsHTMLAnchorElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsAttrSpecifiedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsHTMLImageElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLImageElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLLIElementConstructorD1Ev
+__ZN7WebCore33JSHTMLParagraphElementConstructorD1Ev
+__ZN7WebCore29JSHTMLUListElementConstructorD1Ev
+__ZN7WebCore14WindowFeaturesC1ERKNS_6StringE
+__ZN7WebCore14WindowFeaturesC2ERKNS_6StringE
+__ZN7WebCore9DOMWindow16adjustWindowRectERKNS_9FloatRectERS1_S3_
+__ZN7WebCoreL12createWindowEPN3JSC9ExecStateEPNS_5FrameES4_RKNS_6StringES7_RKNS_14WindowFeaturesENS0_7JSValueE
+__ZN7WebCore11FrameLoader12createWindowEPS0_RKNS_16FrameLoadRequestERKNS_14WindowFeaturesERb
+__ZNK7WebCore6Chrome5focusEv
+__ZN7WebCore15JSDOMWindowBase16childFrameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore15JSDOMWindowBase15namedItemGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore8Document16windowNamedItemsERKNS_6StringE
+__ZN7WebCore18JSCommentPrototypeD1Ev
+__ZN7WebCore15JSAttrPrototypeD1Ev
+__ZN7WebCore23JSNamedNodeMapPrototypeD1Ev
+__ZN7WebCore29JSHTMLImageElementConstructorD1Ev
+__ZN7WebCore18setJSDocumentTitleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLTitleElement7setTextERKNS_6StringE
+__ZN7WebCore34jsDOMWindowPrototypeFunctionScrollEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12EventHandler29passMousePressEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameE
+__ZN7WebCore12EventHandler32passWidgetMouseDownEventToWidgetEPNS_12RenderWidgetE
+__ZNK7WebCore12MessageEvent14isMessageEventEv
+__ZN7WebCore15getDOMStructureINS_14JSMessageEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore14JSMessageEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSMessageEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12MessageEventEEE
+__ZN7WebCore14JSMessageEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12MessageEventEEE
+__ZN7WebCore14JSMessageEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL22getJSMessageEventTableEPN3JSC9ExecStateE
+__ZN7WebCore20jsMessageEventSourceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsMessageEventDataEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsElementScrollWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element11scrollWidthEv
+__ZNK7WebCore9RenderBox11scrollWidthEv
+__ZN3WTF9HashTableIPN7WebCore13IdentifierRepES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_
+__ZN7WebCore19JSHTMLObjectElement10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore14JSMessageEventD1Ev
+__ZN7WebCore20setJSDOMWindowStatusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow9setStatusERKNS_6StringE
+__ZN7WebCoreL27createHTMLMapElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore16JSHTMLMapElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSHTMLMapElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLMapElementEEE
+__ZN7WebCore16JSHTMLMapElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14HTMLMapElementEEE
+__ZN7WebCore16JSHTMLMapElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16JSHTMLMapElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore16JSHTMLModElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore20ImageDocumentElementD0Ev
+__ZN7WebCore16HTMLImageElementD2Ev
+__ZN7WebCore13ImageDocumentD0Ev
+__ZN7WebCore12HTMLDocumentD2Ev
+__ZN7WebCore16FixedTableLayoutD0Ev
+__ZN3WTF6VectorIN7WebCore6LengthELm0EE6shrinkEm
+__ZThn28_N7WebCore8DOMTimer4stopEv
+__ZN7WebCore23JSMessageEventPrototypeD1Ev
+__ZN7WebCore38JSXMLHttpRequestProgressEventPrototypeD1Ev
+__ZN7WebCore19CSSCursorImageValueD0Ev
+__ZN3WTF9HashTableIPN7WebCore10SVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocate
+__ZN7WebCore13CSSImageValueD2Ev
+__ZN7WebCore32JSHTMLOptionsCollectionPrototypeD1Ev
+__ZN7WebCore19JSOptionConstructorD1Ev
+__ZN7WebCore12NamedNodeMap15removeNamedItemERKNS_13QualifiedNameERi
+__ZN7WebCore27JSHTMLOListElementPrototypeD1Ev
+__ZN7WebCore16JSHTMLMapElementD1Ev
+__ZN7WebCore25JSHTMLMapElementPrototypeD1Ev
+__ZN7WebCore25JSHTMLModElementPrototypeD1Ev
+__ZN7WebCore14HTMLModElementD0Ev
+__ZThn4_N7WebCore15HTMLAreaElementD0Ev
+__ZThn28_N7WebCore8DOMTimer16contextDestroyedEv
+__ZNK7WebCore20RenderBoxModelObject30containingBlockWidthForContentEv
+__ZN7WebCore28setJSHTMLInputElementCheckedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23JSHTMLOptionsCollection18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29jsHTMLOptionsCollectionLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore23JSHTMLOptionsCollection6lengthEPN3JSC9ExecStateE
+__ZN7WebCore24jsHTMLOptionElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30setJSHTMLSelectElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore22HTMLFormControlElement11setDisabledEb
+__ZN7WebCore11RenderBlock26addPercentHeightDescendantEPNS_9RenderBoxE
+__ZNK3WTF7HashMapIPKN7WebCore11RenderBlockEPNS_7HashSetIPNS1_9RenderBoxENS_7PtrHashIS7_EENS_10HashTraitsIS7_EEEENS8_IS4_EENSA_I
+__ZN3WTF9HashTableIPKN7WebCore11RenderBlockESt4pairIS4_PNS_7HashSetIPNS1_9RenderBoxENS_7PtrHashIS8_EENS_10HashTraitsIS8_EEEEENS
+__ZN3WTF7HashSetIPN7WebCore9RenderBoxENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore9RenderBoxES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore9RenderBoxES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore9RenderBoxES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTabl
+__ZN3WTF9HashTableIPN7WebCore9RenderBoxES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTa
+__ZNK3WTF7HashMapIPKN7WebCore9RenderBoxEPNS_7HashSetIPNS1_11RenderBlockENS_7PtrHashIS7_EENS_10HashTraitsIS7_EEEENS8_IS4_EENSA_I
+__ZN3WTF9HashTableIPKN7WebCore9RenderBoxESt4pairIS4_PNS_7HashSetIPNS1_11RenderBlockENS_7PtrHashIS8_EENS_10HashTraitsIS8_EEEEENS
+__ZN3WTF7HashSetIPN7WebCore11RenderBlockENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore11RenderBlockES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore11RenderBlockES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore11RenderBlockES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateT
+__ZN3WTF9HashTableIPN7WebCore11RenderBlockES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocat
+__ZN7WebCore25jsHTMLInputElementCheckedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsHTMLSelectElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17HTMLSelectElement5valueEv
+__ZN7WebCore19JSHTMLSelectElement18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore19JSHTMLSelectElement11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore17HTMLSelectElement4itemEj
+__ZN7WebCore27setJSHTMLOptionElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26setJSHTMLOptionElementTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLOptionElement7setTextERKNS_6StringERi
+__ZN3WTF7HashMapIPKN7WebCore11RenderBlockEPNS_7HashSetIPNS1_9RenderBoxENS_7PtrHashIS7_EENS_10HashTraitsIS7_EEEENS8_IS4_EENSA_IS
+__ZN3WTF7HashMapIPKN7WebCore9RenderBoxEPNS_7HashSetIPNS1_11RenderBlockENS_7PtrHashIS7_EENS_10HashTraitsIS7_EEEENS8_IS4_EENSA_IS
+__ZN3WTF9HashTableIPN7WebCore9RenderBoxES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22
+__ZN3WTF9HashTableIPN7WebCore9RenderBoxES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInv
+__ZN3WTF9HashTableIPN7WebCore9RenderBoxES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZThn4_N7WebCore16HTMLTableElementD0Ev
+__ZN7WebCore30jsElementPrototypeFunctionBlurEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element4blurEv
+__ZNK7WebCore15HTMLBodyElement11scrollWidthEv
+__ZN7WebCore23JSMessageEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL31getJSMessageEventPrototypeTableEPN3JSC9ExecStateE
+__ZN7WebCore13HitTestResult12setScrollbarEPNS_9ScrollbarE
+__ZN7WebCore9Scrollbar14transformEventERKNS_18PlatformMouseEventE
+__ZN7WebCore9Scrollbar10mouseMovedERKNS_18PlatformMouseEventE
+__ZN7WebCore23ScrollbarThemeComposite7hitTestEPNS_9ScrollbarERKNS_18PlatformMouseEventE
+__ZN7WebCore9Scrollbar14setHoveredPartENS_13ScrollbarPartE
+__ZN7WebCore14ScrollbarTheme26invalidateOnMouseEnterExitEv
+__ZN7WebCore9Scrollbar11mouseExitedEv
+__ZN7WebCoreL28createHTMLFontElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLFontElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLFontElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLFontElementEEE
+__ZN7WebCore17JSHTMLFontElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLFontElementEEE
+__ZN7WebCore17JSHTMLFontElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17JSHTMLFontElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore17JSHTMLFontElementD1Ev
+__ZN7WebCore26JSHTMLFontElementPrototypeD1Ev
+__ZThn4_N7WebCore19HTMLTableRowElementD0Ev
+__ZThn4_N7WebCore15HTMLFontElementD0Ev
+__ZN7WebCore44jsDocumentPrototypeFunctionGetElementsByNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4Node17getElementsByNameERKNS_6StringE
+__ZN7WebCore12NameNodeListC1EN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringEPNS_15DynamicNodeList6CachesE
+__ZN7WebCore12NameNodeListC2EN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringEPNS_15DynamicNodeList6CachesE
+__ZNK7WebCore12NameNodeList11nodeMatchesEPNS_7ElementE
+__ZN7WebCore12NameNodeListD0Ev
+__ZN7WebCore27JSDocumentFragmentPrototypeD1Ev
+__ZThn4_N7WebCore15HTMLHeadElementD0Ev
+__ZN7WebCore19JSMimeTypePrototypeD1Ev
+__ZN7WebCore19setJSNodeOndblclickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node13setOndblclickEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore16setJSNodeOnfocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node10setOnfocusEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore22setJSNodeOncontextmenuEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node16setOncontextmenuEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore17setJSNodeOnchangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node11setOnchangeEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore16setJSNodeOnresetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node10setOnresetEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore17setJSNodeOnselectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node11setOnselectEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZThn268_N7WebCore11CachedImage17animationAdvancedEPKNS_5ImageE
+__ZN7WebCore12EventHandler13freeClipboardEv
+__ZNK7WebCore12EventHandler23createDraggingClipboardEv
+__ZN7WebCore12EventHandler20dispatchDragSrcEventERKNS_12AtomicStringERKNS_18PlatformMouseEventE
+__ZNK7WebCore9Clipboard15sourceOperationERNS_13DragOperationE
+__ZN7WebCore14DragController9startDragEPNS_5FrameEPNS_9ClipboardENS_13DragOperationERKNS_18PlatformMouseEventERKNS_8IntPointEb
+__ZN7WebCoreL8getImageEPNS_7ElementE
+__ZN7WebCore12ClipboardMac7hasDataEv
+__ZNK7WebCore16HTMLImageElement3altEv
+__ZN7WebCore16VisibleSelectionC1EPKNS_5RangeENS_9EAffinityE
+__ZN7WebCore16VisibleSelectionC2EPKNS_5RangeENS_9EAffinityE
+__ZN7WebCore14RenderReplaced17setSelectionStateENS_12RenderObject14SelectionStateE
+__ZNK7WebCore12RenderObject17selectionStartEndERiS1_
+__ZNK7WebCore10RenderView17selectionStartEndERiS1_
+__ZN7WebCore13RootInlineBox22setHasSelectedChildrenEb
+__ZN7WebCore11RenderBlock17setSelectionStateENS_12RenderObject14SelectionStateE
+__ZNK7WebCore12RenderObject7childAtEj
+__ZNK7WebCore14RenderReplaced18canBeSelectionLeafEv
+__ZN7WebCore14RenderReplaced23selectionRectForRepaintEPNS_20RenderBoxModelObjectEb
+__ZN3WTF7HashMapIPN7WebCore12RenderObjectEPNS1_19RenderSelectionInfoENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3
+__ZNK3WTF7HashMapIPN7WebCore11RenderBlockEPNS1_24RenderBlockSelectionInfoENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3get
+__ZN7WebCore11RenderBlock27selectionGapRectsForRepaintEPNS_20RenderBoxModelObjectE
+__ZNK7WebCore11RenderBlock15isSelectionRootEv
+__ZN3WTF7HashMapIPN7WebCore11RenderBlockEPNS1_24RenderBlockSelectionInfoENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setE
+__ZN3WTF9HashTableIPN7WebCore11RenderBlockESt4pairIS3_PNS1_24RenderBlockSelectionInfoEENS_18PairFirstExtractorIS7_EENS_7PtrHash
+__ZN7WebCore11RenderBlock19leftSelectionOffsetEPS0_i
+__ZN7WebCore11RenderBlock20rightSelectionOffsetEPS0_i
+__ZN7WebCore11RenderBlock17fillSelectionGapsEPS0_iiiiRiS2_S2_PKNS_12RenderObject9PaintInfoE
+__ZN7WebCore11RenderBlock22fillBlockSelectionGapsEPS0_iiiiRiS2_S2_PKNS_12RenderObject9PaintInfoE
+__ZNK7WebCore12RenderObject18canBeSelectionLeafEv
+__ZN7WebCore11RenderBlock23fillInlineSelectionGapsEPS0_iiiiRiS2_S2_PKNS_12RenderObject9PaintInfoE
+__ZN7WebCore13RootInlineBox20fillLineSelectionGapEiiPNS_11RenderBlockEiiiiPKNS_12RenderObject9PaintInfoE
+__ZN7WebCore13RootInlineBox14selectionStateEv
+__ZN7WebCore9InlineBox14selectionStateEv
+__ZN7WebCore11RenderBlock29getHorizontalSelectionGapInfoENS_12RenderObject14SelectionStateERbS3_
+__ZN7WebCore13RootInlineBox16firstSelectedBoxEv
+__ZN7WebCore13RootInlineBox15lastSelectedBoxEv
+__ZNK7WebCore10RenderView14selectionStartEv
+__ZN7WebCore12ClipboardMac24declareAndWriteDragImageEPNS_7ElementERKNS_4KURLERKNS_6StringEPNS_5FrameE
+__ZNK7WebCore11BitmapImage17filenameExtensionEv
+__ZNK7WebCore11ImageSource17filenameExtensionEv
+__ZN7WebCore36preferredExtensionForImageSourceTypeERKNS_6StringE
+__ZN7WebCore16LegacyWebArchive32createPropertyListRepresentationERKNS_16ResourceResponseE
+__ZN7WebCore14DragController11doImageDragEPNS_7ElementERKNS_8IntPointERKNS_7IntRectEPNS_9ClipboardEPNS_5FrameERS3_
+__ZN7WebCore24createDragImageFromImageEPNS_5ImageE
+__ZNK7WebCore7IntSizecv7_NSSizeEv
+__ZN7WebCore14DragController16maxDragImageSizeEv
+__ZN7WebCore21fitDragImageToMaxSizeEN3WTF9RetainPtrI7NSImageEERKNS_7IntSizeES6_
+__ZN7WebCore13dragImageSizeEN3WTF9RetainPtrI7NSImageEE
+__ZN7WebCore27dissolveDragImageToFractionEN3WTF9RetainPtrI7NSImageEEf
+__ZN7WebCore14DragController12doSystemDragEN3WTF9RetainPtrI7NSImageEERKNS_8IntPointES7_PNS_9ClipboardEPNS_5FrameEb
+__ZN7WebCoreL24clipOutPositionedObjectsEPKNS_12RenderObject9PaintInfoEiiPN3WTF11ListHashSetIPNS_9RenderBoxENS4_7PtrHashIS7_EEEE
+__ZN7WebCore15GraphicsContext7clipOutERKNS_7IntRectE
+__ZNK7WebCore12RenderObject24selectionBackgroundColorEv
+__ZNK7WebCore11RenderTheme30activeSelectionBackgroundColorEv
+__ZNK7WebCore14RenderThemeMac38platformActiveSelectionBackgroundColorEv
+__ZNK7WebCore5Color14blendWithWhiteEv
+__ZN7WebCoreL14blendComponentEii
+__ZN7WebCore12EventHandler17dragSourceMovedToERKNS_18PlatformMouseEventE
+__ZN7WebCore14DragController10dragExitedEPNS_8DragDataE
+__ZN7WebCore12EventHandler17cancelDragAndDropERKNS_18PlatformMouseEventEPNS_9ClipboardE
+__ZN7WebCore12EventHandler14clearDragStateEv
+__ZN7WebCore14DragController10cancelDragEv
+__ZN7WebCore12EventHandler17dragSourceEndedAtERKNS_18PlatformMouseEventENS_13DragOperationE
+__ZN7WebCore9Clipboard23setDestinationOperationENS_13DragOperationE
+__ZN7WebCore14DragController22cleanupAfterSystemDragEv
+__ZN7WebCore15deleteDragImageEN3WTF9RetainPtrI7NSImageEE
+__ZN7WebCore15highestAncestorEPNS_4NodeE
+__ZN7WebCoreL27removingNodeRemovesPositionEPNS_4NodeERKNS_8PositionE
+__ZNK7WebCore4Node8containsEPKS0_
+__ZNK3WTF7HashMapIPN7WebCore12RenderObjectEPNS1_19RenderSelectionInfoENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS
+__ZN7WebCore15jsNodeTEXT_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn28_NK7WebCore8DOMTimer10canSuspendEv
+__ZThn28_N7WebCore8DOMTimer7suspendEv
+__ZN7WebCore30JSHTMLTextAreaElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSHTMLTextAreaElement9classInfoEv
+__ZNK7WebCore19HTMLTextAreaElement14isEnumeratableEv
+__ZN7WebCore16JSStyleSheetList18canGetItemsForNameEPN3JSC9ExecStateEPNS_14StyleSheetListERKNS1_10IdentifierE
+__ZNK7WebCore14StyleSheetList12getNamedItemERKNS_6StringE
+__ZN7WebCore25JSStyleSheetListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22JSCSSRuleListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL11quoteStringERKNS_6StringE
+__ZN7WebCore21jsHTMLImageElementAltEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL21serviceTypeForClassIdERKNS_6StringEPKNS_10PluginDataE
+__ZN3WTF7HashMapIN7WebCore6StringES2_NS1_15CaseFoldingHashENS_10HashTraitsIS2_EES5_E3addERKS2_S8_
+__ZNK3WTF7HashMapIN7WebCore6StringES2_NS1_15CaseFoldingHashENS_10HashTraitsIS2_EES5_E3getERKS2_
+__ZN7WebCoreL11activeXTypeEv
+__ZNK7WebCore10PluginData16supportsMimeTypeERKNS_6StringE
+__NPN_GetProperty
+__ZThn8_N7WebCore16HTMLTableElementD0Ev
+__ZN7WebCore17HTMLPlugInElement11getNPObjectEv
+__ZN7WebCore16ScriptController34createScriptObjectForPluginElementEPNS_17HTMLPlugInElementE
+__ZN7WebCore16ScriptController24jsObjectForPluginElementEPNS_17HTMLPlugInElementE
+__NPN_GetStringIdentifiers
+__ZThn8_N7WebCore20HTMLParagraphElementD0Ev
+__ZThn8_N7WebCore16HTMLDListElementD0Ev
+__ZThn8_N7WebCore7CommentD0Ev
+__ZThn8_N7WebCore16HTMLOListElementD0Ev
+__ZN7WebCore4Path15createRectangleERKNS_9FloatRectE
+__ZN7WebCore5TimerINS_11RenderImageEE5firedEv
+__ZN7WebCore11RenderImage28highQualityRepaintTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore28jsCSSStyleDeclarationCssTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn28_N7WebCore8DOMTimer6resumeEv
+__ZN7WebCore8DOMTimer6resumeEv
+__ZN7WebCore19HTMLTextAreaElementD0Ev
+__ZN7WebCoreL11isSeparatorEt
+__ZN7WebCore14WindowFeatures16setWindowFeatureERKNS_6StringES3_
+__ZNK7WebCore6Chrome12createWindowEPNS_5FrameERKNS_16FrameLoadRequestERKNS_14WindowFeaturesE
+__ZNK7WebCore19ResourceRequestBase7isEmptyEv
+__ZN7WebCore4Page14sessionStorageEb
+__ZNK7WebCore6Chrome18setToolbarsVisibleEb
+__ZNK7WebCore6Chrome19setStatusbarVisibleEb
+__ZNK7WebCore6Chrome20setScrollbarsVisibleEb
+__ZNK7WebCore6Chrome17setMenubarVisibleEb
+__ZNK7WebCore6Chrome12setResizableEb
+__ZNK7WebCore6Chrome10windowRectEv
+__ZNK7WebCore6Chrome8pageRectEv
+__ZNK7WebCore6Chrome13setWindowRectERKNS_9FloatRectE
+__ZN7WebCore13toDeviceSpaceERKNS_9FloatRectEP8NSWindow
+__ZNK7WebCore6Chrome4showEv
+__ZNK7WebCore11ScriptValue9getStringERNS_6StringE
+__ZN7WebCore36jsDOMWindowPrototypeFunctionResizeToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow8resizeToEff
+__ZN7WebCore34jsDOMWindowPrototypeFunctionMoveToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow6moveToEff
+__ZN7WebCore16JSHTMLPreElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore38jsElementPrototypeFunctionHasAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore12CachedScript8encodingEv
+__ZN7WebCore44jsHTMLAnchorElementPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore17HTMLAnchorElement8toStringEv
+__ZN7WebCore15JSHTMLHRElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+_KJS_JSCreateNativeJSObject
+__ZN3JSC8Bindings12JavaJSObject6invokeEPNS0_19JSObjectCallContextE
+__ZN3JSC8Bindings12JavaJSObject12createNativeEx
+__ZN3JSC8Bindings24findProtectingRootObjectEPNS_8JSObjectE
+__ZN3JSC8Bindings10RootObject13gcIsProtectedEPNS_8JSObjectE
+_KJS_JSObject_JSObjectCall
+__ZN3JSC8Bindings12JavaJSObjectC1Ex
+__ZN3JSC8Bindings12JavaJSObjectC2Ex
+__ZNK3JSC8Bindings12JavaJSObject4callEP8_jstringP13_jobjectArray
+__ZNK3JSC8Bindings12JavaJSObject10rootObjectEv
+__ZNK3JSC8Bindings12JavaJSObject17getListFromJArrayEPNS_9ExecStateEP13_jobjectArrayRNS_20MarkedArgumentBufferE
+__ZNK3JSC8Bindings12JavaJSObject21convertJObjectToValueEPNS_9ExecStateEP8_jobject
+__ZNK3JSC16RuntimeObjectImp12defaultValueEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZNK3JSC8Bindings12JavaInstance12defaultValueEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZNK3JSC8Bindings12JavaInstance11stringValueEPNS_9ExecStateE
+__ZNK3JSC8Bindings12JavaJSObject21convertValueToJObjectENS_7JSValueE
+__ZN7JNIEnv_9NewObjectEP7_jclassP10_jmethodIDz
+_KJS_JSObject_JSFinalize
+__ZNK3JSC8Bindings12JavaJSObject8finalizeEv
+__ZN7WebCore19JSHTMLAppletElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19JSHTMLAppletElement9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore12RenderAppletD0Ev
+__ZN3JSC8Bindings12JavaInstanceD0Ev
+__ZN3JSC8Bindings14JObjectWrapperD1Ev
+__ZN3JSC8Bindings14JObjectWrapperD2Ev
+__ZN3JSC8Bindings9JavaClassD0Ev
+__ZN3WTF20deleteAllPairSecondsIPN3JSC8Bindings5FieldEKNS_7HashMapINS_6RefPtrINS1_7UString3RepEEES4_NS_7StrHashIS9_EENS_10HashTr
+__ZN3JSC8Bindings9JavaFieldD0Ev
+__ZN3WTF15deleteAllValuesIPN3JSC8Bindings6MethodELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN3JSC8Bindings10JavaMethodD0Ev
+__ZN3JSC8Bindings13JavaParameterD1Ev
+__ZN7WebCore17HTMLAppletElementD0Ev
+__ZN7WebCore28JSHTMLAppletElementPrototypeD1Ev
+__ZThn4_N7WebCore19HTMLTextAreaElementD0Ev
+__ZN7WebCore12EventHandler31passMouseReleaseEventToSubframeERNS_28MouseEventWithHitTestResultsEPNS_5FrameE
+__ZN7WebCore17setJSLocationHashEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation7setHashEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore12EventHandler22passWheelEventToWidgetERNS_18PlatformWheelEventEPNS_6WidgetE
+__ZN7WebCoreL42setNSScrollViewScrollWheelShouldRetainSelfEb
+__ZN7WebCoreL36selfRetainingNSScrollViewScrollWheelEP12NSScrollViewP13objc_selectorP7NSEvent
+__ZN7WebCore11RenderStyle10setContentEN3WTF10PassRefPtrINS_10StyleImageEEEb
+__ZN7WebCore27RenderImageGeneratedContentC1EPNS_4NodeE
+__ZN7WebCore27RenderImageGeneratedContentC2EPNS_4NodeE
+__ZN7WebCore27RenderImageGeneratedContent13setStyleImageEPNS_10StyleImageE
+__ZNK7WebCore16StyleCachedImage13isCachedImageEv
+__ZNK7WebCore27RenderImageGeneratedContent13errorOccurredEv
+__ZNK7WebCore27RenderImageGeneratedContent21imageHasRelativeWidthEv
+__ZNK7WebCore16StyleCachedImage21imageHasRelativeWidthEv
+__ZNK7WebCore27RenderImageGeneratedContent22usesImageContainerSizeEv
+__ZNK7WebCore16StyleCachedImage22usesImageContainerSizeEv
+__ZNK7WebCore27RenderImageGeneratedContent22imageHasRelativeHeightEv
+__ZNK7WebCore16StyleCachedImage22imageHasRelativeHeightEv
+__ZNK7WebCore27RenderImageGeneratedContent8imagePtrEv
+__ZNK7WebCore27RenderImageGeneratedContent9imageSizeEf
+__ZNK7WebCore27RenderImageGeneratedContent8hasImageEv
+__ZN7WebCore27RenderImageGeneratedContentD0Ev
+__ZN7WebCore11RenderImageD2Ev
+__ZN7WebCore27RenderImageGeneratedContent5imageEii
+__ZN7WebCore19JSHTMLButtonElementD1Ev
+__ZN7WebCore28JSHTMLButtonElementPrototypeD1Ev
+__ZN7WebCore17HTMLButtonElementD0Ev
+__ZN7WebCoreL17legendConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLLegendElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore17HTMLLegendElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore14RenderFieldset12layoutLegendEb
+__ZNK7WebCore14RenderFieldset10isFieldsetEv
+__ZN7WebCore10JSNodeList16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore19JSNodeListPrototype9classInfoEv
+__ZN7WebCore17jsNodeTextContentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16setJSNodeOnabortEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node10setOnabortEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore16StyleCachedImage8cssValueEv
+__ZNK7WebCore26NetscapePlugInStreamLoader6isDoneEv
+__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm32EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm32EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore11CSSRuleDataELm32EE15reserveCapacityEm
+__ZN7WebCore14RenderFieldsetD0Ev
+__ZN7WebCoreL19tablecolConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore19HTMLTableColElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19HTMLTableColElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore19HTMLTableColElement17endTagRequirementEv
+__ZNK7WebCore19HTMLTableColElement11tagPriorityEv
+__ZNK7WebCore19HTMLTableColElement36canHaveAdditionalAttributeStyleDeclsEv
+__ZN7WebCore19HTMLTableColElement29additionalAttributeStyleDeclsERN3WTF6VectorIPNS_26CSSMutableStyleDeclarationELm0EEE
+__ZN7WebCore14RenderTableColC1EPNS_4NodeE
+__ZN7WebCore14RenderTableColC2EPNS_4NodeE
+__ZN7WebCore14RenderTableCol17updateFromElementEv
+__ZNK7WebCore14RenderTableCol13requiresLayerEv
+__ZNK7WebCore14RenderTableCol10isTableColEv
+__ZNK7WebCore14RenderTableCol15virtualChildrenEv
+__ZN7WebCore19HTMLTableColElement8checkDTDEPKNS_4NodeE
+__ZNK7WebCore14RenderTableCol15canHaveChildrenEv
+__ZNK7WebCore19HTMLTableColElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore19HTMLTableColElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore14RenderTableCol14isChildAllowedEPNS_12RenderObjectEPNS_11RenderStyleE
+__ZN7WebCore14RenderTableCol15virtualChildrenEv
+__ZN7WebCoreL32createHTMLTableColElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore21JSHTMLTableColElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSHTMLTableColElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLTableColElementEEE
+__ZN7WebCore21JSHTMLTableColElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLTableColElementEEE
+__ZN7WebCore21JSHTMLTableColElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21JSHTMLTableColElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19HTMLFieldSetElementD0Ev
+__ZN7WebCore17HTMLLegendElementD0Ev
+__ZN7WebCore23jsHTMLTableElementTHeadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement5tHeadEv
+__ZN7WebCore29jsHTMLTableSectionElementRowsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23HTMLTableSectionElement4rowsEv
+__ZN7WebCore26jsHTMLTableRowElementCellsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19HTMLTableRowElement5cellsEv
+__ZN7WebCore14RenderTableCol29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore54jsXMLHttpRequestPrototypeFunctionGetAllResponseHeadersEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZNK7WebCore14XMLHttpRequest21getAllResponseHeadersERi
+__ZN7WebCoreL21startElementNsHandlerEPvPKhS2_S2_iPS2_iiS3_
+__ZN7WebCore12XMLTokenizer14startElementNsEPKhS2_S2_iPS2_iiS3_
+__ZN7WebCore7ElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL23handleElementAttributesEPNS_7ElementEPPKhiRi
+__ZN7WebCore7Element14setAttributeNSERKNS_12AtomicStringES3_S3_Ri
+__ZN7WebCore8Document18parseQualifiedNameERKNS_6StringERS1_S4_Ri
+__ZNK7WebCore7Element18createAttributeMapEv
+__ZN7WebCore7Element15createAttributeERKNS_13QualifiedNameERKNS_12AtomicStringE
+__ZN7WebCore15toScriptElementEPNS_7ElementE
+__ZNK7WebCore8Document14isHTMLDocumentEv
+__ZN7WebCoreL17charactersHandlerEPvPKhi
+__ZN7WebCore12XMLTokenizer10charactersEPKhi
+__ZN7WebCore12XMLTokenizer9enterTextEv
+__ZN3WTF6VectorIhLm0EE6appendIhEEvPKT_m
+__ZN3WTF6VectorIhLm0EE14expandCapacityEmPKh
+__ZN3WTF6VectorIhLm0EE14expandCapacityEm
+__ZN3WTF6VectorIhLm0EE15reserveCapacityEm
+__ZN7WebCore13CharacterData10appendDataERKNS_6StringERi
+__ZN3WTF6VectorIhLm0EE6shrinkEm
+__ZN7WebCoreL19endElementNsHandlerEPvPKhS2_S2_
+__ZN7WebCore12XMLTokenizer12endElementNsEv
+__ZN7WebCoreL14commentHandlerEPvPKh
+__ZN7WebCore12XMLTokenizer7commentEPKh
+__ZN7WebCore10JSDocumentC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8DocumentEEE
+__ZN7WebCore10JSDocument18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore10JSDocument9classInfoEv
+__ZN7WebCore9JSElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7ElementEEE
+__ZN7WebCore9JSElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore9JSElement9classInfoEv
+__ZN7WebCore36jsNodePrototypeFunctionHasChildNodesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore21JSHTMLTableColElementD1Ev
+__ZN7WebCore9JSElementD1Ev
+__ZN7WebCore10JSDocumentD1Ev
+__ZN7WebCore7ElementD0Ev
+__ZN7WebCore12NamedNodeMapD0Ev
+__ZN7WebCore9AttributeD0Ev
+__ZN7WebCore17HTMLButtonElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCoreL21executeDeleteBackwardEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore6Editor19deleteWithDirectionENS_19SelectionController10EDirectionENS_15TextGranularityEbb
+__ZN7WebCore6Editor20canSmartCopyOrDeleteEv
+__ZN7WebCore13TypingCommand16deleteKeyPressedEPNS_8DocumentEbNS_15TextGranularityEb
+__ZN7WebCore13TypingCommand16deleteKeyPressedENS_15TextGranularityEb
+__ZN7WebCore20CompositeEditCommand39breakOutOfEmptyMailBlockquotedParagraphEv
+__ZN7WebCore26highestEnclosingNodeOfTypeERKNS_8PositionEPFbPKNS_4NodeEE
+__ZN7WebCore19SelectionController6modifyENS0_11EAlterationENS0_10EDirectionENS_15TextGranularityEb
+__ZN7WebCore19SelectionController14willBeModifiedENS0_11EAlterationENS0_10EDirectionE
+__ZN7WebCore16VisibleSelection7setBaseERKNS_8PositionE
+__ZN7WebCore16VisibleSelection9setExtentERKNS_8PositionE
+__ZN7WebCore19SelectionController23modifyExtendingBackwardENS_15TextGranularityE
+__ZNK7WebCore15VisiblePosition31honorEditableBoundaryAtOrBeforeERKS0_
+__ZN7WebCore19SelectionController30xPosForVerticalArrowNavigationENS0_13EPositionTypeE
+__ZNK7WebCore15VisiblePosition28xOffsetForVerticalNavigationEv
+__ZN7WebCore19SelectionController9setExtentERKNS_15VisiblePositionEb
+__ZN7WebCore16VisibleSelectionC1ERKNS_8PositionES3_NS_9EAffinityE
+__ZN7WebCore16VisibleSelectionC2ERKNS_8PositionES3_NS_9EAffinityE
+__ZN7WebCore25isFirstPositionAfterTableERKNS_15VisiblePositionE
+__ZNK7WebCore5Frame21shouldDeleteSelectionERKNS_16VisibleSelectionE
+__ZN7WebCore20CompositeEditCommand15deleteSelectionERKNS_16VisibleSelectionEbbbb
+__ZN7WebCore22DeleteSelectionCommandC1ERKNS_16VisibleSelectionEbbbb
+__ZN7WebCore22DeleteSelectionCommandC2ERKNS_16VisibleSelectionEbbbb
+__ZN7WebCore22DeleteSelectionCommand7doApplyEv
+__ZN7WebCore5Frame28textWillBeDeletedInTextFieldEPNS_7ElementE
+__ZN7WebCore22DeleteSelectionCommand22initializePositionDataEv
+__ZN7WebCore22DeleteSelectionCommand18initializeStartEndERNS_8PositionES2_
+__ZN7WebCore38positionBeforeContainingSpecialElementERKNS_8PositionEPPNS_4NodeE
+__ZN7WebCoreL21firstInSpecialElementERKNS_8PositionE
+__ZN7WebCore16isSpecialElementEPKNS_4NodeE
+__ZN7WebCore37positionAfterContainingSpecialElementERKNS_8PositionEPPNS_4NodeE
+__ZN7WebCoreL20lastInSpecialElementERKNS_8PositionE
+__ZN7WebCoreL10isTableRowEPKNS_4NodeE
+__ZN7WebCore27numEnclosingMailBlockquotesERKNS_8PositionE
+__ZNK7WebCore8Position25leadingWhitespacePositionENS_9EAffinityEb
+__ZNK7WebCore8Position25previousCharacterPositionENS_9EAffinityE
+__ZN7WebCore13isStartOfLineERKNS_15VisiblePositionE
+__ZNK7WebCore8Position26rendersInDifferentPositionERKS0_
+__ZNK7WebCore8Position14renderedOffsetEv
+__ZNK7WebCore4Node12nextEditableEv
+__ZNK7WebCore4Node12nextLeafNodeEv
+__ZNK7WebCore4Node30nextNodeConsideringAtomicNodesEv
+__ZNK7WebCore4Node16previousEditableEv
+__ZNK7WebCore4Node16previousLeafNodeEv
+__ZNK7WebCore4Node34previousNodeConsideringAtomicNodesEv
+__ZN7WebCore4Node32inSameContainingBlockFlowElementEPS0_
+__ZNK7WebCore8Position26trailingWhitespacePositionENS_9EAffinityEb
+__ZN7WebCore20CompositeEditCommand33deleteInsignificantTextDownstreamERKNS_8PositionE
+__ZN7WebCore22DeleteSelectionCommand20saveTypingStyleStateEv
+__ZN7WebCore22DeleteSelectionCommand25handleSpecialCaseBRDeleteEv
+__ZN7WebCore22DeleteSelectionCommand19handleGeneralDeleteEv
+__ZN7WebCore22DeleteSelectionCommand18deleteTextFromNodeEN3WTF10PassRefPtrINS_4TextEEEjj
+__ZN7WebCoreL28updatePositionForTextRemovalEPNS_4NodeEiiRNS_8PositionE
+__ZN7WebCore20CompositeEditCommand18deleteTextFromNodeEN3WTF10PassRefPtrINS_4TextEEEjj
+__ZN7WebCore25DeleteFromTextNodeCommandC1EN3WTF10PassRefPtrINS_4TextEEEjj
+__ZN7WebCore25DeleteFromTextNodeCommandC2EN3WTF10PassRefPtrINS_4TextEEEjj
+__ZN7WebCore25DeleteFromTextNodeCommand7doApplyEv
+__ZN7WebCore13CharacterData13substringDataEjjRi
+__ZN7WebCore22DeleteSelectionCommand15fixupWhitespaceEv
+__ZN7WebCore22DeleteSelectionCommand15mergeParagraphsEv
+__ZN7WebCore22DeleteSelectionCommand38removePreviouslySelectedEmptyTableRowsEv
+__ZN7WebCore22DeleteSelectionCommand31calculateTypingStyleAfterDeleteEv
+__ZN7WebCore22DeleteSelectionCommand19clearTransientStateEv
+__ZN7WebCore6Editor36revealSelectionAfterEditingOperationEv
+__ZNK7WebCore11EditCommand19isInsertTextCommandEv
+__ZNK7WebCore22HTMLFormControlElement17isActivatedSubmitEv
+__ZNK7WebCore22HTMLFormControlElement24isSuccessfulSubmitButtonEv
+__ZNK7WebCore17HTMLButtonElement17isActivatedSubmitEv
+__ZNK7WebCore17HTMLButtonElement24isSuccessfulSubmitButtonEv
+__ZN7WebCore17HTMLButtonElement18setActivatedSubmitEb
+__ZN7WebCore22HTMLFormControlElement14appendFormDataERNS_12FormDataListEb
+__ZN7WebCore17HTMLButtonElement14appendFormDataERNS_12FormDataListEb
+__ZNK7WebCore8FormData15flattenToStringEv
+__ZNK7WebCore8FormData7flattenERN3WTF6VectorIcLm0EEE
+__ZN7WebCore4KURL8setQueryERKNS_6StringE
+__ZN7WebCore14RenderTableColD0Ev
+__ZN7WebCore22DeleteSelectionCommandD0Ev
+__ZN7WebCore25DeleteFromTextNodeCommandD0Ev
+__ZN7WebCore15RenderWordBreakC1EPNS_11HTMLElementE
+__ZN7WebCore15RenderWordBreakC2EPNS_11HTMLElementE
+__ZN7WebCore15RenderWordBreakD0Ev
+__ZN7WebCore39jsHTMLFormElementPrototypeFunctionResetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15HTMLFormElement5resetEv
+__ZN7WebCore16HTMLInputElement5resetEv
+__ZNK7WebCore15RenderWordBreak11isWordBreakEv
+__ZN7WebCore22jsHTMLInputElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24setJSHTMLElementTabIndexEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement11setTabIndexEi
+__ZN7WebCore23jsHTMLFormElementLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30JSHTMLTableColElementPrototypeD1Ev
+__ZN7WebCore19HTMLTableColElementD0Ev
+__ZN7WebCore22jsNavigatorAppCodeNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase11appCodeNameEv
+__ZN7WebCore25setJSHTMLInputElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement7setTypeERKNS_6StringE
+__ZN7WebCore25setJSHTMLInputElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore22HTMLFormControlElement7setNameERKNS_12AtomicStringE
+__ZN7WebCore26setJSHTMLAnchorElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement7setNameERKNS_12AtomicStringE
+__ZN7WebCore35jsHTMLDocumentPrototypeFunctionOpenEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSHTMLDocument4openEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCoreL23MainGradientInterpolateEPvPKfPf
+__ZN7WebCoreL22TopGradientInterpolateEPvPKfPf
+__ZN7WebCoreL25BottomGradientInterpolateEPvPKfPf
+__ZN7WebCore21jsHTMLDocumentScriptsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document7scriptsEv
+__ZN7WebCore16JSHTMLCollection11getCallDataERN3JSC8CallDataE
+__ZN7WebCore17jsDocumentCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24JSHTMLHRElementPrototypeD1Ev
+__ZN7WebCore27jsHTMLAnchorElementPathnameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement8pathnameEv
+__ZN7WebCore9FrameView18setUseSlowRepaintsEv
+__ZL15deallocCallbackPv
+__ZN7WebCore17jsDOMWindowClosedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6closedEv
+__ZN7WebCore33jsDOMWindowPrototypeFunctionFocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow5focusEv
+__ZN7WebCore5Frame11focusWindowEv
+__ZN7WebCore28jsHTMLBodyElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLBodyElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLBodyElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17jsNodeOnmouseoverEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node11onmouseoverEv
+__ZN7WebCore13jsNodeOnfocusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node7onfocusEv
+__ZN7WebCore29jsHTMLTableElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLTableElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLTableElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZNK7WebCore5Color5lightEv
+__ZN7WebCore17differenceSquaredERKNS_5ColorES2_
+__ZN7WebCore19HTMLTextAreaElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore26RenderTextControlMultiLineC1EPNS_4NodeE
+__ZN7WebCore26RenderTextControlMultiLineC2EPNS_4NodeE
+__ZN7WebCore26RenderTextControlMultiLine17updateFromElementEv
+__ZNK7WebCore26RenderTextControlMultiLine20createInnerTextStyleEPKNS_11RenderStyleE
+__ZNK7WebCore26RenderTextControlMultiLine10isTextAreaEv
+__ZN7WebCore26RenderTextControlMultiLine36adjustControlHeightBasedOnLineHeightEi
+__ZNK7WebCore17RenderTextControl14hasControlClipEv
+__ZNK7WebCore26RenderTextControlMultiLine16baselinePositionEbb
+__ZN7WebCoreL17resizerCornerRectEPKNS_11RenderLayerERKNS_7IntRectE
+__ZN7WebCore26RenderTextControlMultiLineD0Ev
+__ZN7WebCore19HTMLTextAreaElement23rendererWillBeDestroyedEv
+__ZN7WebCore28JSHTMLBodyElementConstructorD1Ev
+__ZN7WebCore29JSHTMLTableElementConstructorD1Ev
+__ZNK7WebCore15PurgeableBuffer9wasPurgedEv
+__ZN7WebCore16LegacyWebArchive6createEPNS_12SharedBufferE
+__ZN7WebCore16LegacyWebArchive7extractEPK14__CFDictionary
+__ZN7WebCore16LegacyWebArchive14createResourceEPK14__CFDictionary
+__ZN7WebCore15ArchiveResource6createEN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_6StringESA_SA_RKNS_16ResourceRespons
+__ZN7WebCore15ArchiveResourceC1EN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_6StringESA_SA_RKNS_16ResourceResponseE
+__ZN7WebCore15ArchiveResourceC2EN3WTF10PassRefPtrINS_12SharedBufferEEERKNS_4KURLERKNS_6StringESA_SA_RKNS_16ResourceResponseE
+__ZN7WebCore16LegacyWebArchive42createResourceResponseFromPropertyListDataEPK8__CFDataPK10__CFString
+__ZN7WebCore16LegacyWebArchive41createResourceResponseFromMacArchivedDataEPK8__CFData
+__ZNK7WebCore20ResourceResponseBase17suggestedFilenameEv
+__ZN3WTF7HashMapIN7WebCore24FontPlatformDataCacheKeyEPNS1_16FontPlatformDataENS1_28FontPlatformDataCacheKeyHashENS1_30FontPlatf
+__ZN3WTF6VectorIN7WebCore24FontPlatformDataCacheKeyELm0EE6shrinkEm
+__ZN7WebCore29jsHTMLInputElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14XMLHttpRequest16getRequestHeaderERKNS_12AtomicStringE
+__ZN7WebCore8FormData6createERKNS_7CStringE
+__ZN7WebCore17SubresourceLoader11didSendDataEyy
+__ZThn16_N7WebCore24DocumentThreadableLoader11didSendDataEPNS_17SubresourceLoaderEyy
+__ZN7WebCore24DocumentThreadableLoader11didSendDataEPNS_17SubresourceLoaderEyy
+__ZThn16_N7WebCore14XMLHttpRequest11didSendDataEyy
+__ZN7WebCore14XMLHttpRequest11didSendDataEyy
+__ZThn24_N7WebCore14XMLHttpRequest4stopEv
+__ZN7WebCore27setJSHTMLImageElementUseMapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement9setUseMapERKNS_6StringE
+__ZThn8_N7WebCore15HTMLLinkElementD0Ev
+__ZN7WebCore14jsNodeOnsubmitEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node8onsubmitEv
+__ZNK7WebCore17JSHTMLAreaElement9classInfoEv
+__ZN7WebCoreL32createHTMLFieldSetElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore21JSHTMLFieldSetElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSHTMLFieldSetElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLFieldSetElementEEE
+__ZN7WebCore21JSHTMLFieldSetElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLFieldSetElementEEE
+__ZN7WebCore21JSHTMLFieldSetElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSHTMLFieldSetElement9classInfoEv
+__ZN7WebCore20jsDOMWindowStatusbarEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow9statusbarEv
+__ZN7WebCore7BarInfoC1EPNS_5FrameENS0_4TypeE
+__ZN7WebCore7BarInfoC2EPNS_5FrameENS0_4TypeE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_7BarInfoE
+__ZN7WebCore9JSBarInfo15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSBarInfoC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7BarInfoEEE
+__ZN7WebCore9JSBarInfoC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7BarInfoEEE
+__ZN7WebCore9JSBarInfo18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsBarInfoVisibleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7BarInfo7visibleEv
+__ZNK7WebCore6Chrome16statusbarVisibleEv
+__ZNK7WebCore15HTMLFormElement14isURLAttributeEPNS_9AttributeE
+__ZN7WebCore21JSHTMLFieldSetElementD1Ev
+__ZN7WebCore30JSHTMLFieldSetElementPrototypeD1Ev
+__ZN7WebCore12InputElement20updateSelectionRangeERNS_16InputElementDataEii
+__ZN7WebCore21setJSElementScrollTopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore7Element12setScrollTopEi
+__ZN7WebCore9RenderBox12setScrollTopEi
+__ZN7WebCore8Document29removeStyleSheetCandidateNodeEPNS_4NodeE
+__ZN3WTF11ListHashSetIPN7WebCore4NodeENS_7PtrHashIS3_EEE15unlinkAndDeleteEPNS_15ListHashSetNodeIS3_EE
+__ZThn8_N7WebCore16HTMLStyleElementD0Ev
+__ZN3WTF6VectorIPN7WebCore9RenderBoxELm16EE6shrinkEm
+__ZN7WebCore28setJSHTMLLabelElementHtmlForEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLLabelElement10setHtmlForERKNS_6StringE
+__ZN7WebCore7BarInfo15disconnectFrameEv
+__ZNK7WebCore12RenderButton14hasLineIfEmptyEv
+__ZNK7WebCore22HTMLFormControlElement11virtualFormEv
+__ZN7WebCore9JSBarInfoD1Ev
+__ZN7WebCore9JSBarInfoD2Ev
+__ZN7WebCore18JSBarInfoPrototypeD1Ev
+__ZThn8_N7WebCore17HTMLIFrameElementD0Ev
+__ZThn8_N7WebCore17HTMLScriptElementD0Ev
+__ZThn8_N7WebCore16HTMLLabelElementD0Ev
+__ZN7WebCore26setJSHTMLEmbedElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLPlugInElement8setWidthERKNS_6StringE
+__ZN7WebCore27setJSHTMLEmbedElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLPlugInElement9setHeightERKNS_6StringE
+__ZN7WebCore9CSSParser10parseShapeEib
+__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_4RectEEE
+__ZN7WebCore11RenderStyle7setClipENS_6LengthES1_S1_S1_
+__ZN7WebCore9RenderBox8clipRectEii
+__ZN7WebCore9RenderBox13absoluteQuadsERN3WTF6VectorINS_9FloatQuadELm0EEE
+__ZN7WebCore23jsHTMLFormElementMethodEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLFormElement6methodEv
+__ZN7WebCore25jsHTMLFormElementElementsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsHTMLInputElementSelectionStartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18JSHTMLInputElement14selectionStartEPN3JSC9ExecStateE
+__ZNK7WebCore16HTMLInputElement16canHaveSelectionEv
+__ZNK7WebCore16HTMLInputElement14selectionStartEv
+__ZN7WebCore30jsHTMLInputElementSelectionEndEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18JSHTMLInputElement12selectionEndEPN3JSC9ExecStateE
+__ZNK7WebCore16HTMLInputElement12selectionEndEv
+__ZN7WebCore32setJSHTMLTableElementCellPaddingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLTableElement14setCellPaddingERKNS_6StringE
+__ZN7WebCore32setJSHTMLTableElementCellSpacingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLTableElement14setCellSpacingERKNS_6StringE
+__ZN7WebCore11RenderBlock28removeLeftoverAnonymousBlockEPS0_
+__ZN7WebCore24JSCSSStyleSheetPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsCSSStyleSheetPrototypeFunctionInsertRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZNK7WebCore15JSCSSStyleSheet9classInfoEv
-__ZN7WebCore13CSSStyleSheet7addRuleERKNS_6StringES3_Ri
-__ZN7WebCore13CSSStyleSheet7addRuleERKNS_6StringES3_iRi
-__ZN7WebCore13CSSStyleSheet10insertRuleERKNS_6StringEjRi
-__ZN7WebCore9StyleList6insertEjN3WTF10PassRefPtrINS_9StyleBaseEEE
-__ZN7WebCore13CSSStyleSheet17styleSheetChangedEv
-__ZN7WebCore42jsDocumentPrototypeFunctionCreateElementNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN3KJS17staticValueGetterIN7WebCore17JSHTMLHtmlElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSHTMLHtmlElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore15headConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN3KJS17staticValueGetterIN7WebCore17JSHTMLHeadElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSHTMLHeadElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore17createBaseWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore17JSHTMLBaseElementC1EPN3KJS8JSObjectEPNS_15HTMLBaseElementE
-__ZN7WebCore17JSHTMLBaseElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore17JSHTMLBaseElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSHTMLBaseElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore18isindexConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore18HTMLIsIndexElementC1EPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore16HTMLInputElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore20createIsIndexWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore20JSHTMLIsIndexElementC1EPN3KJS8JSObjectEPNS_18HTMLIsIndexElementE
-__ZN7WebCore20JSHTMLIsIndexElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore20JSHTMLIsIndexElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore20JSHTMLIsIndexElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLStyleElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLStyleElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore21createOptGroupWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore21JSHTMLOptGroupElementC1EPN3KJS8JSObjectEPNS_19HTMLOptGroupElementE
-__ZN7WebCore21JSHTMLOptGroupElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore21JSHTMLOptGroupElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSHTMLOptGroupElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore21JSHTMLFieldSetElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSHTMLFieldSetElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore19createLegendWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore19JSHTMLLegendElementC1EPN3KJS8JSObjectEPNS_17HTMLLegendElementE
-__ZN7WebCore19JSHTMLLegendElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore19JSHTMLLegendElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSHTMLLegendElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLOListElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLOListElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLDListElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLDListElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore14dirConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore20HTMLDirectoryElementC1EPNS_8DocumentE
-__ZN7WebCore22createDirectoryWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore22JSHTMLDirectoryElementC1EPN3KJS8JSObjectEPNS_20HTMLDirectoryElementE
-__ZN7WebCore22JSHTMLDirectoryElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore22JSHTMLDirectoryElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore22JSHTMLDirectoryElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore15menuConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore15HTMLMenuElementC2EPNS_8DocumentE
-__ZN7WebCore17createMenuWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore17JSHTMLMenuElementC1EPN3KJS8JSObjectEPNS_15HTMLMenuElementE
-__ZN7WebCore17JSHTMLMenuElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore17JSHTMLMenuElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSHTMLMenuElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore22JSHTMLParagraphElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore22JSHTMLParagraphElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore20JSHTMLHeadingElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore20JSHTMLHeadingElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore16quoteConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLQuoteElementC1EPNS_8DocumentE
-__ZN7WebCore18createQuoteWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLQuoteElementC1EPN3KJS8JSObjectEPNS_16HTMLQuoteElementE
-__ZN7WebCore18JSHTMLQuoteElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLQuoteElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLQuoteElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore16JSHTMLPreElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSHTMLPreElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore15JSHTMLBRElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore15JSHTMLBRElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore21createBaseFontWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore21JSHTMLBaseFontElementC1EPN3KJS8JSObjectEPNS_19HTMLBaseFontElementE
-__ZN7WebCore21JSHTMLBaseFontElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore21JSHTMLBaseFontElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSHTMLBaseFontElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore17JSHTMLFontElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSHTMLFontElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore15JSHTMLHRElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore15JSHTMLHRElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore14modConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore14HTMLModElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore16createModWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore16JSHTMLModElementC1EPN3KJS8JSObjectEPNS_14HTMLModElementE
-__ZN7WebCore16JSHTMLModElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore16JSHTMLModElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSHTMLModElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLParamElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLParamElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore19createAppletWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore19JSHTMLAppletElementC1EPN3KJS8JSObjectEPNS_17HTMLAppletElementE
-__ZN7WebCore19JSHTMLAppletElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19JSHTMLAppletElement18canGetItemsForNameEPN3KJS9ExecStateEPNS_17HTMLAppletElementERKNS1_10IdentifierE
-__ZN7WebCore19JSHTMLAppletElement24customGetOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore17HTMLAppletElement11getInstanceEv
-__ZN3KJS17staticValueGetterIN7WebCore19JSHTMLAppletElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSHTMLAppletElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore23tableCaptionConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore23HTMLTableCaptionElementC1EPNS_8DocumentE
-__ZN7WebCore25createTableCaptionWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore25JSHTMLTableCaptionElementC1EPN3KJS8JSObjectEPNS_23HTMLTableCaptionElementE
-__ZN7WebCore25JSHTMLTableCaptionElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore25JSHTMLTableCaptionElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore25JSHTMLTableCaptionElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore21JSHTMLTableColElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSHTMLTableColElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore21createFrameSetWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore21JSHTMLFrameSetElementC1EPN3KJS8JSObjectEPNS_19HTMLFrameSetElementE
-__ZN7WebCore21JSHTMLFrameSetElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSHTMLFrameSetElement18canGetItemsForNameEPN3KJS9ExecStateEPNS_19HTMLFrameSetElementERKNS1_10IdentifierE
-__ZN3KJS17staticValueGetterIN7WebCore21JSHTMLFrameSetElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSHTMLFrameSetElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore18createFrameWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLFrameElementC1EPN3KJS8JSObjectEPNS_16HTMLFrameElementE
-__ZN7WebCore18JSHTMLFrameElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLFrameElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLFrameElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore28JSHTMLHtmlElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore6JSTextEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore6JSText16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore18HTMLIsIndexElementD1Ev
-__ZN7WebCore23HTMLTableCaptionElementD1Ev
-__ZN7WebCore18JSHTMLLabelElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore5Frame13setZoomFactorEi
--[WebCoreFrameBridge stringWithData:]
+__ZN7WebCore29setJSHTMLInputElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZNK7WebCore17ScrollbarThemeMac20supportsControlTintsEv
+__ZThn8_N7WebCore17HTMLButtonElementD0Ev
+__ZN7WebCore15jsNodeOnkeydownEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node9onkeydownEv
+__ZN7WebCore16jsNodeOnkeypressEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node10onkeypressEv
+__ZN7WebCore41jsHTMLInputElementPrototypeFunctionSelectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore25jsHTMLTableElementTBodiesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16HTMLTableElement7tBodiesEv
+__ZN7WebCore38jsXMLHttpRequestPrototypeFunctionAbortEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14XMLHttpRequest5abortEv
+__ZN7WebCore14XMLHttpRequest18dispatchAbortEventEv
+__ZN7WebCoreL17reportUnsafeUsageEPNS_22ScriptExecutionContextERKNS_6StringE
+__ZN7WebCore15getDOMStructureINS_15JSKeyboardEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore15JSKeyboardEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSKeyboardEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13KeyboardEventEEE
+__ZN7WebCore15JSKeyboardEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13KeyboardEventEEE
+__ZN7WebCore15JSKeyboardEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore13KeyboardEvent7keyCodeEv
+__ZN7WebCore23jsKeyboardEventShiftKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsNodeOnblurEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node6onblurEv
+__ZThn128_N7WebCore16HTMLInputElement20setValueFromRendererERKNS_6StringE
+__ZThn128_NK7WebCore16HTMLInputElement30searchEventsShouldBeDispatchedEv
+__ZN7WebCore17jsClientRectRightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsClientRectBottomEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn16_N7WebCore24DocumentThreadableLoader7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
+__ZN7WebCore24DocumentThreadableLoader7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
+__ZThn16_N7WebCore14XMLHttpRequest7didFailERKNS_13ResourceErrorE
+__ZN7WebCore14XMLHttpRequest7didFailERKNS_13ResourceErrorE
+__ZN7WebCore14XMLHttpRequest10abortErrorEv
+__ZN7WebCore14XMLHttpRequest12genericErrorEv
+__ZN7WebCore24DocumentThreadableLoader6cancelEv
+__ZThn8_N7WebCore11EditingTextD0Ev
+__ZN7WebCore15JSKeyboardEventD1Ev
+__ZN7WebCore27setJSHTMLTableElementBorderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLTableElement9setBorderERKNS_6StringE
+__ZN7WebCore42jsElementPrototypeFunctionGetAttributeNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore21jsHTMLElementTabIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11HTMLElement8tabIndexEv
+__ZNK7WebCore4Node13supportsFocusEv
+__ZNK7WebCore4Node8tabIndexEv
+__ZN7WebCore24JSKeyboardEventPrototypeD1Ev
+__ZN3WTF9HashTableIyyNS_17IdentityExtractorIyEEN7WebCore12LinkHashHashENS_10HashTraitsIyEES6_E5clearEv
+__ZN7WebCore4Page22allVisitedStateChangedEPNS_9PageGroupE
+__ZN7WebCore16CSSStyleSelector15SelectorChecker22allVisitedStateChangedEv
+__ZN7WebCore23ApplicationCacheStorage5emptyEv
+__ZN7WebCore31CrossOriginPreflightResultCache6sharedEv
+__ZN7WebCore31CrossOriginPreflightResultCache5emptyEv
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore35CrossOriginPreflightResultCacheItemEKNS_7HashMapISt4pairINS1_6StringENS1_4KURLEES3_N
+__ZN7WebCore12IconDatabase14removeAllIconsEv
+__ZN7WebCore10IconRecordD1Ev
+__ZN7WebCore10IconRecordD2Ev
+__ZN3WTF9HashTableIPN7WebCore10IconRecordES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E5clearEv
+__ZN7WebCore12IconDatabase22removeAllIconsOnThreadEv
+__ZN7WebCore14SQLiteDatabase16runVacuumCommandEv
+__ZN7WebCore4Page14setMediaVolumeEf
+__ZN7WebCore8Document20mediaVolumeDidChangeEv
 __ZNK7WebCore12EventHandler20currentKeyboardEventEv
 __ZN7WebCore15FocusController15setInitialFocusENS_14FocusDirectionEPNS_13KeyboardEventE
-__ZN7WebCore30newStreamingTextDecoderUTF16LEERKNS_12TextEncodingEPKv
-__ZN7WebCore14TextCodecUTF166decodeEPKcmb
-__ZN7WebCore15BackForwardList17backListWithLimitEiRN3WTF6VectorINS1_6RefPtrINS_11HistoryItemEEELm0EEE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE14expandCapacityEmPKS4_
--[WebCoreFrameBridge setMarkedTextMatchesAreHighlighted:]
-__ZN7WebCore5Frame34setMarkedTextMatchesAreHighlightedEb
--[WebCoreFrameBridge markAllMatchesForText:caseSensitive:limit:]
-__ZN7WebCore5Frame21markAllMatchesForTextERKNS_6StringEbj
-__ZN7WebCore13findPlainTextEPKNS_5RangeERKNS_6StringEbb
-__ZNK7WebCore5Range10cloneRangeERi
-__ZN7WebCore20CircularSearchBufferC2ERKNS_6StringEb
-__ZNK7WebCore20CircularSearchBuffer6lengthEv
-__ZN7WebCore18endVisiblePositionEPKNS_5RangeENS_9EAffinityE
-__ZN7WebCore20startVisiblePositionEPKNS_5RangeENS_9EAffinityE
-__ZN7WebCore8setStartEPNS_5RangeERKNS_15VisiblePositionE
-__ZN7WebCore24rangeCompliantEquivalentERKNS_15VisiblePositionE
-__ZN7WebCore13InlineTextBox20paintTextMatchMarkerEPNS_15GraphicsContextEiiNS_14DocumentMarkerEPNS_11RenderStyleEPKNS_4FontE
-__ZN7WebCore8Document24setRenderedRectForMarkerEPNS_4NodeENS_14DocumentMarkerERKNS_7IntRectE
-__ZNK7WebCore5Frame31markedTextMatchesAreHighlightedEv
--[WebCoreFrameBridge searchFor:direction:caseSensitive:wrap:startInSelection:]
-__ZN7WebCore5Frame10findStringERKNS_6StringEbbbb
--[WebCoreFrameBridge unmarkAllTextMatches]
--[WebCoreFrameBridge rectsForTextMatches]
-__ZN7WebCore8Document23renderedRectsForMarkersENS_14DocumentMarker10MarkerTypeE
-__ZNK7WebCore5Frame18selectionTextRectsERN3WTF6VectorINS_9FloatRectELm0EEEb
-__ZN7WebCore5Range15addLineBoxRectsERN3WTF6VectorINS_7IntRectELm0EEEb
-__ZN7WebCore10RenderText15addLineBoxRectsERN3WTF6VectorINS_7IntRectELm0EEEjjb
-__ZN3WTF6VectorIN7WebCore9FloatRectELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore9FloatRectELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore9FloatRectELm0EE15reserveCapacityEm
-__ZNK7WebCore5Frame14selectionImageEb
-__ZNK7WebCore5Frame13imageFromRectE7_NSRect
-__ZN7WebCoreeqERKNS_5RangeES2_
--[WebCoreFrameBridge selectedString]
-__ZNK7WebCore5Frame12selectedTextEv
-__ZNK7WebCore24JSKeyboardEventPrototype9classInfoEv
-__ZNK7WebCore7UIEvent5pageYEv
-__ZNK7WebCore7UIEvent6layerYEv
-__ZNK7WebCore7UIEvent5pageXEv
-__ZNK7WebCore7UIEvent6layerXEv
-__ZN7WebCore6setEndEPNS_5RangeERKNS_15VisiblePositionE
-__ZN7WebCore41jsHTMLAnchorElementPrototypeFunctionFocusEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore17HTMLAnchorElement13supportsFocusEv
-__ZN7WebCore12RenderObject32handleDynamicFloatPositionChangeEv
-__ZN7WebCore40jsDOMWindowPrototypeFunctionGetSelectionEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9DOMWindow12getSelectionEv
-__ZN7WebCore12DOMSelectionC2EPNS_5FrameE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_12DOMSelectionE
-__ZN7WebCore23JSDOMSelectionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore14JSDOMSelectionC1EPN3KJS8JSObjectEPNS_12DOMSelectionE
-__ZN7WebCore14JSDOMSelection18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore14JSDOMSelectionEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore14JSDOMSelection16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore12DOMSelection10anchorNodeEv
-__ZNK7WebCore12DOMSelection10rangeCountEv
-__ZN7WebCore12DOMSelection15disconnectFrameEv
-__ZN3KJS17staticValueGetterIN7WebCore18JSEventConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSEventConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS29windowProtoFuncNotImplementedEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore20CompositeEditCommand23breakOutOfEmptyListItemEv
-__ZN7WebCore22enclosingEmptyListItemERKNS_15VisiblePositionE
-__ZN7WebCore18enclosingListChildEPNS_4NodeE
-__ZN7WebCore13isListElementEPNS_4NodeE
-__ZN7WebCore44jsHTMLDocumentPrototypeFunctionCaptureEventsEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12HTMLDocument13captureEventsEv
-__ZN7WebCore12RenderObject33getAbsoluteRepaintRectWithOutlineEi
-__ZNK7WebCore12RenderInline20isInlineContinuationEv
-__ZN7WebCore13InlineFlowBox10flowObjectEv
-__ZN3WTF7HashSetIPN7WebCore10RenderFlowENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore10RenderFlow12paintOutlineEPNS_15GraphicsContextEii
-__ZN7WebCore12RenderObject17addFocusRingRectsEPNS_15GraphicsContextEii
+__ZN7WebCore15FocusController12advanceFocusENS_14FocusDirectionEPNS_13KeyboardEventEb
+__ZN7WebCore8Document17nextFocusableNodeEPNS_4NodeEPNS_13KeyboardEventE
+__ZNK7WebCore4Node19isKeyboardFocusableEPNS_13KeyboardEventE
+__ZN7WebCoreL25nextNodeWithExactTabIndexEPNS_4NodeEiPNS_13KeyboardEventE
+__ZN7WebCoreL17deepFocusableNodeENS_14FocusDirectionEPNS_4NodeEPNS_13KeyboardEventE
+__ZN7WebCore8Settings41setUsesDashboardBackwardCompatibilityModeEb
+__ZN7WebCore9FrameTree9clearNameEv
+__ZN7WebCore19InspectorController15disableProfilerEv
+__ZN7WebCore29setUsesTestModeFocusRingColorEb
+-[WebScriptObject JSObject]
+__ZN7WebCore16JSDOMWindowShell17putWithAttributesEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueEj
+-[WebScriptObject setValue:forKey:]
+__ZN3JSC8Bindings23convertObjcValueToValueEPNS_9ExecStateEPvNS0_13ObjcValueTypeEPNS0_10RootObjectE
+__ZN3JSC8Bindings17webUndefinedClassEv
+__ZN3JSC8Bindings20webScriptObjectClassEv
+__ZN3JSC8Bindings12ObjcInstanceC1EP11objc_objectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC8Bindings12ObjcInstanceC2EP11objc_objectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZL11_didExecuteP15WebScriptObject
+__ZN3JSC8Bindings8Instance18didExecuteFunctionEv
+__ZN7WebCoreL30updateStyleIfNeededForBindingsEPN3JSC9ExecStateEPNS0_8JSObjectE
+__ZN7WebCore10RenderText17setSelectionStateENS_12RenderObject14SelectionStateE
+__ZNK7WebCore13InlineTextBox10isSelectedEii
+__ZNK7WebCore10RenderText18canBeSelectionLeafEv
+__ZN7WebCore10RenderText23selectionRectForRepaintEPNS_20RenderBoxModelObjectEb
+__ZN7WebCore12RenderObject21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZN7WebCore11RenderBlock23selectionRectForRepaintEPNS_20RenderBoxModelObjectEb
+__ZN7WebCore13AXObjectCache11getOrCreateEPNS_12RenderObjectE
+__ZN7WebCore13AXObjectCache3getEPNS_12RenderObjectE
+__ZNK3WTF7HashMapIPN7WebCore12RenderObjectEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3getERKS3_
+__ZNK7WebCore12RenderObject9isListBoxEv
+__ZN7WebCore13AXObjectCache14nodeIsAriaTypeEPNS_4NodeENS_6StringE
+__ZN7WebCore25AccessibilityRenderObject6createEPNS_12RenderObjectE
+__ZN7WebCore25AccessibilityRenderObjectC1EPNS_12RenderObjectE
+__ZN7WebCore25AccessibilityRenderObjectC2EPNS_12RenderObjectE
+__ZN7WebCore19AccessibilityObjectC2Ev
+__ZN7WebCore25AccessibilityRenderObject11setAriaRoleEv
+__ZNK7WebCore25AccessibilityRenderObject26determineAriaRoleAttributeEv
+__ZNK7WebCore25AccessibilityRenderObject12getAttributeERKNS_13QualifiedNameE
+__ZN7WebCore13AXObjectCache7getAXIDEPNS_19AccessibilityObjectE
+__ZNK7WebCore19AccessibilityObject10axObjectIDEv
+__ZNK3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E8containsIjNS_22IdentityHashTranslatorIjj
+__ZN3WTF7HashSetIjNS_7IntHashIjEENS_10HashTraitsIjEEE3addERKj
+__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E6expandEv
+__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E6rehashEi
+__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E13allocateTableEi
+__ZN7WebCore19AccessibilityObject13setAXObjectIDEj
+__ZN3WTF7HashMapIPN7WebCore12RenderObjectEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3setERKS3_RKj
+__ZN3WTF9HashTableIPN7WebCore12RenderObjectESt4pairIS3_jENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_1
+__ZN3WTF7HashMapIjNS_6RefPtrIN7WebCore19AccessibilityObjectEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE3setERKjRKS4_
+__ZN3WTF9HashTableIjSt4pairIjNS_6RefPtrIN7WebCore19AccessibilityObjectEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14Pair
+__ZN7WebCore13AXObjectCache13attachWrapperEPNS_19AccessibilityObjectE
++[AccessibilityObjectWrapper initialize]
+-[AccessibilityObjectWrapper initWithAccessibilityObject:]
+-[AccessibilityObjectWrapper accessibilityFocusedUIElement]
+__ZN7WebCore25AccessibilityRenderObject18updateBackingStoreEv
+__ZNK7WebCore25AccessibilityRenderObject16focusedUIElementEv
+__ZNK7WebCore25AccessibilityRenderObject27shouldFocusActiveDescendantEv
+__ZNK7WebCore25AccessibilityRenderObject17ariaRoleAttributeEv
+__ZNK7WebCore25AccessibilityRenderObject22accessibilityIsIgnoredEv
+__ZNK7WebCore25AccessibilityRenderObject31isPresentationalChildOfAriaRoleEv
+__ZNK7WebCore25AccessibilityRenderObject12parentObjectEv
+__ZNK7WebCore25AccessibilityRenderObject33ariaRoleHasPresentationalChildrenEv
+__ZNK3WTF7HashMapIjNS_6RefPtrIN7WebCore19AccessibilityObjectEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE3getERKj
+__ZNK7WebCore12RenderObject10isMenuListEv
+__ZNK7WebCore25AccessibilityRenderObject21labelElementContainerEv
+__ZNK7WebCore25AccessibilityRenderObject9isControlEv
+__ZNK7WebCore25AccessibilityRenderObject9isHeadingEv
+__ZNK7WebCore25AccessibilityRenderObject9roleValueEv
+__ZNK7WebCore25AccessibilityRenderObject6isLinkEv
+-[AccessibilityObjectWrapper accessibilityAttributeValue:]
+__ZNK7WebCore25AccessibilityRenderObject9isWebAreaEv
+__ZNK7WebCore25AccessibilityRenderObject13isTextControlEv
+__ZNK7WebCore25AccessibilityRenderObject12isAttachmentEv
+__ZNK7WebCore25AccessibilityRenderObject5titleEv
+__ZNK7WebCore25AccessibilityRenderObject22ariaLabeledByAttributeEv
+__ZNK7WebCore25AccessibilityRenderObject20ariaAccessiblityNameERKNS_6StringE
+__ZN7WebCoreL21accessibleNameForNodeEPNS_4NodeE
+__ZN7WebCore13AXObjectCache15childrenChangedEPNS_12RenderObjectE
+__ZN7WebCore13AXObjectCache25postNotificationToElementEPNS_12RenderObjectERKNS_6StringE
+__ZNK7WebCore9DOMWindow27pendingUnloadEventListenersEv
+__ZN7WebCore13InlineTextBox14paintSelectionEPNS_15GraphicsContextEiiPNS_11RenderStyleERKNS_4FontE
+__ZN7WebCore13InlineTextBox17selectionStartEndERiS1_
+__ZN7WebCore15GraphicsContext20drawHighlightForTextERKNS_4FontERKNS_7TextRunERKNS_8IntPointEiRKNS_5ColorEii
+__ZNK7WebCore12RenderObject24selectionForegroundColorEv
+__ZNK7WebCore11RenderTheme30activeSelectionForegroundColorEv
+__ZNK7WebCore14RenderThemeMac33supportsSelectionForegroundColorsEv
+__ZNK7WebCore25AccessibilityRenderObject24accessibilityDescriptionEv
+__ZNK7WebCore25AccessibilityRenderObject24ariaDescribedByAttributeEv
+__ZNK7WebCore11HistoryItem8referrerEv
+__ZThn24_NK7WebCore14XMLHttpRequest10canSuspendEv
+__ZNK7WebCore14XMLHttpRequest10canSuspendEv
+__ZThn24_N7WebCore14XMLHttpRequest16contextDestroyedEv
+__ZN7WebCore14XMLHttpRequest16contextDestroyedEv
+__ZThn8_N7WebCore7ElementD0Ev
+__ZN7WebCore19HTMLTextAreaElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore19HTMLTextAreaElement15childrenChangedEbPNS_4NodeES2_i
+__ZNK7WebCore19HTMLTextAreaElement12defaultValueEv
+__ZN7WebCore27jsHTMLOptionElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore26RenderTextControlMultiLine21preferredContentWidthEf
+__ZNK7WebCore17RenderTextControl18scrollbarThicknessEv
+__ZN7WebCore11RenderBlock22skipTrailingWhitespaceERNS_14InlineIteratorE
+__ZThn8_N7WebCore19HTMLTextAreaElementD0Ev
+__ZNK7WebCore16HTMLLabelElement11isFocusableEv
+__ZN7WebCore12RenderInline16positionForPointERKNS_8IntPointE
+__ZN7WebCore10IconLoader11stopLoadingEv
+__ZNK7WebCore10WheelEvent12isWheelEventEv
+__ZN7WebCore15getDOMStructureINS_12JSWheelEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore12JSWheelEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSWheelEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10WheelEventEEE
+__ZN7WebCore12JSWheelEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10WheelEventEEE
+__ZN7WebCore12JSWheelEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19jsWheelEventClientXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsWheelEventClientYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsWheelEventScreenXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsWheelEventScreenYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsWheelEventCtrlKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsWheelEventAltKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsWheelEventShiftKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsWheelEventMetaKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsWheelEventWheelDeltaEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsWheelEventWheelDeltaXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsElementPrototypeFunctionContainsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13AXObjectCache13detachWrapperEPNS_19AccessibilityObjectE
+-[AccessibilityObjectWrapper detach]
+-[AccessibilityObjectWrapper unregisterUniqueIdForUIElement]
+__ZN7WebCore25AccessibilityRenderObject6detachEv
+__ZN7WebCore19AccessibilityObject13clearChildrenEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EE14shrinkCapacityEm
+__ZN7WebCore19AccessibilityObject6detachEv
+__ZN7WebCore13AXObjectCache10removeAXIDEPNS_19AccessibilityObjectE
+__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E4findIjNS_22IdentityHashTranslatorIjjS4_EE
+__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E47removeAndInvalidateWithoutEntryConsisten
+__ZN3WTF9HashTableIjjNS_17IdentityExtractorIjEENS_7IntHashIjEENS_10HashTraitsIjEES6_E6removeEPj
+__ZN7WebCore25AccessibilityRenderObjectD0Ev
+__ZN7WebCore19AccessibilityObjectD2Ev
+__ZN7WebCore13AXObjectCache6removeEPNS_12RenderObjectE
+__ZN7WebCore13AXObjectCache6removeEj
+__ZN3JSC8Bindings12ObjcInstanceD0Ev
+__ZN7WebCore13AXObjectCache21handleAriaRoleChangedEPNS_12RenderObjectE
+__ZN7WebCore13AXObjectCache29handleFocusedUIElementChangedEv
+__ZN7WebCore7Element21updateFocusAppearanceEb
+__ZN7WebCoreL21ariaRoleToWebCoreRoleENS_6StringE
+__ZN3WTF7HashMapIN7WebCore6StringENS1_17AccessibilityRoleENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS5_IS3_EEE3setERKS2_RKS3_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_17AccessibilityRoleEENS_18PairFirstExtractorIS5_EENS1_15CaseFoldingHashENS_1
+__ZNK3WTF7HashMapIN7WebCore6StringENS1_17AccessibilityRoleENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS5_IS3_EEE3getERKS2_
+__ZN7WebCore19AccessibilityObject13isARIAControlENS_17AccessibilityRoleE
+__ZN7WebCore19AccessibilityObject11isARIAInputENS_17AccessibilityRoleE
+-[AccessibilityObjectWrapper accessibilityActionNames]
+__ZNK7WebCore25AccessibilityRenderObject13actionElementEv
+__ZNK7WebCore25AccessibilityRenderObject18isFileUploadButtonEv
+__ZNK7WebCore25AccessibilityRenderObject13isImageButtonEv
+__ZNK7WebCore25AccessibilityRenderObject13isNativeImageEv
+__ZNK7WebCore25AccessibilityRenderObject13anchorElementEv
+__ZNK7WebCore25AccessibilityRenderObject13axObjectCacheEv
+__ZNK7WebCore25AccessibilityRenderObject8isAnchorEv
+__ZN7WebCore11RenderBlock17addFocusRingRectsEPNS_15GraphicsContextEii
 __ZN7WebCore4Node13aboutToUnloadEv
-__ZNK7WebCore23HTMLTableCaptionElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore23HTMLTableCaptionElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore23HTMLTableCaptionElement17endTagRequirementEv
-__ZNK7WebCore23HTMLTableCaptionElement11tagPriorityEv
-__ZNK7WebCore14DocumentLoader19originalRequestCopyEv
-__ZN7WebCore9DocLoader21decrementRequestCountEv
-__ZNK7WebCore8Document6domainEv
-__ZN7WebCore17SubresourceLoader6createEPNS_5FrameEPNS_23SubresourceLoaderClientERKNS_15ResourceRequestEbbb
-__ZNK7WebCore11FrameLoader16outgoingReferrerEv
-__ZN7WebCore11FrameLoader18shouldHideReferrerERKNS_4KURLERKNS_6StringE
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_iENS_18PairFirstExtractorIS5_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSA_IaEEEESB_E4findIS3_NS_22IdentityHashTranslatorIS3_S5_S8_EEEENS_17HashTableIteratorIS3_S5_S7_S8_SD_SB_EERKT_
-__ZNK7WebCore19ResourceRequestBase13isConditionalEv
-__ZNK7WebCore11FrameLoader15originalRequestEv
-__ZN7WebCore19ResourceRequestBase14setCachePolicyENS_26ResourceRequestCachePolicyE
-__ZN7WebCore17SubresourceLoaderC2EPNS_5FrameEPNS_23SubresourceLoaderClientEbb
-__ZN7WebCore14DocumentLoader20addSubresourceLoaderEPNS_14ResourceLoaderE
-__ZN7WebCore17SubresourceLoader4loadERKNS_15ResourceRequestE
-__ZN7WebCore11FrameLoader22didTellClientAboutLoadERKNS_6StringE
-__ZN7WebCore14ResourceLoader4loadERKNS_15ResourceRequestE
-__ZN7WebCore17SubresourceLoader15willSendRequestERNS_15ResourceRequestERKNS_16ResourceResponseE
-__ZN7WebCore11FrameLoader32assignIdentifierToInitialRequestEmRKNS_15ResourceRequestE
-__ZNK7WebCore11FrameLoader14willUseArchiveEPNS_14ResourceLoaderERKNS_15ResourceRequestERKNS_4KURLE
-__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore17SubresourceLoaderEEEPNS2_7RequestENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getEPS3_
-__ZNK3WTF7HashMapIN7WebCore6StringEPNS1_14CachedResourceENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3getERKS2_
-__ZN7WebCore5Cache16resourceAccessedEPNS_14CachedResourceE
-__ZN7WebCore5Cache17removeFromLRUListEPNS_14CachedResourceE
-__ZN7WebCore5Cache15insertInLRUListEPNS_14CachedResourceE
-__ZN7WebCore5Cache10lruListForEPNS_14CachedResourceE
-__ZN3WTF6VectorIN7WebCore5Cache7LRUListELm32EE4growEm
-__ZN7WebCore9DocLoader22checkCacheObjectStatusEPNS_14CachedResourceE
-__ZN7WebCore14CachedResource3refEPNS_20CachedResourceClientE
-__ZN7WebCore5Cache22addToLiveResourcesSizeEPNS_14CachedResourceE
-__ZN3WTF7HashMapIPN7WebCore20CachedResourceClientEjNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IjEEE3addERKS3_RKj
-__ZN7WebCore16imageConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLImageElementC2EPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore15HTMLImageLoaderC2EPNS_7ElementE
-__ZNK7WebCore16HTMLImageElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore16HTMLImageElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore15HTMLImageLoader17updateFromElementEv
-__ZNK7WebCore7Element24imageSourceAttributeNameEv
-__ZN7WebCore15HTMLImageLoader15setLoadingImageEPNS_11CachedImageE
-__ZN7WebCore11CachedImage3refEPNS_20CachedResourceClientE
-__ZNK7WebCore11CachedImage9imageRectEv
-__ZNK7WebCore16HTMLImageElement17endTagRequirementEv
-__ZNK7WebCore16HTMLImageElement11tagPriorityEv
-__ZN7WebCore16HTMLImageElement20insertedIntoDocumentEv
-__ZN7WebCore12HTMLDocument12addNamedItemERKNS_6StringE
-__ZN7WebCore12addItemToMapERN3WTF7HashMapIPNS_10StringImplEiNS_10StringHashENS0_10HashTraitsIS3_EENS5_IiEEEERKNS_6StringE
-__ZN7WebCore12HTMLDocument20addDocExtraNamedItemERKNS_6StringE
-__ZN7WebCore16HTMLImageElement6attachEv
-__ZNK7WebCore8Document12getCSSTargetEv
-__ZNK7WebCore14CachedResource9isExpiredEv
-__ZNK7WebCore20ResourceResponseBase14expirationDateEv
-__ZN7WebCore11FrameLoader7canLoadERKNS_14CachedResourceEPKNS_8DocumentE
-__ZNK7WebCore12RenderObject15containingBlockEv
-__ZN7WebCore15RenderTableCellC2EPNS_4NodeE
-__ZN7WebCore15RenderTableCell17updateFromElementEv
-__ZN7WebCore15RenderTableCell8setStyleEPNS_11RenderStyleE
-__ZN7WebCore15RenderTableCell13requiresLayerEv
-__ZN7WebCore14RenderTableRow8addChildEPNS_12RenderObjectES2_
-__ZNK7WebCore15RenderTableCell11isTableCellEv
-__ZN7WebCore18RenderTableSection7addCellEPNS_15RenderTableCellEPNS_12RenderObjectE
-__ZN7WebCore11HTMLElement16addHTMLAlignmentEPNS_15MappedAttributeE
-__ZN7WebCore13StyledElement14addCSSPropertyEPNS_15MappedAttributeEii
-__ZN7WebCore26CSSMutableStyleDeclaration11setPropertyEiibb
-__ZN7WebCore36htmlAttributeHasCaseInsensitiveValueERKNS_13QualifiedNameE
-__ZN7WebCore17addLocalNameToSetEPN3WTF7HashSetIPNS_16AtomicStringImplENS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EEEERKNS_13QualifiedNameE
-__ZNK7WebCore18NamedMappedAttrMap14mapsEquivalentEPKS0_
-__ZNK7WebCore18NamedMappedAttrMap9declCountEv
-__ZN7WebCore11RenderTable12appendColumnEi
-__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE4growEm
-__ZN3WTF6VectorIN7WebCore11RenderTable12ColumnStructELm0EE14expandCapacityEm
-__ZN7WebCore18RenderTableSection12appendColumnEi
-__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE6resizeEm
-__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore18RenderTableSection10CellStructELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIiLm0EE4growEm
-__ZN3WTF6VectorIiLm0EE14expandCapacityEm
-__ZNK7WebCore26CSSMutableStyleDeclaration19getPropertyCSSValueEi
-__ZNK7WebCore23DeprecatedValueListImpl8fromLastEv
-__ZN7WebCore17CSSPrimitiveValue14getDoubleValueEt
-__ZN7WebCore10HTMLParser18isResidualStyleTagERKNS_12AtomicStringE
-__ZNK7WebCore13ContainerNode16virtualLastChildEv
-__ZN3WTF9HashTableIN7WebCore18MappedAttributeKeyESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_19MappedAttributeHashENS_14PairHashTraitsINS1_24MappedAttributeKeyTraitsENS_10HashTraitsIiEEEES9_E4findIS2_NS_22IdentityHashTranslatorIS2_S4_S7_EEEENS_17HashTableIteratorIS2_S4_S6_S7_SC_S9_EERKT_
-__ZN7WebCore13brConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore13HTMLBRElementC2EPNS_8DocumentE
-__ZNK7WebCore13HTMLBRElement17endTagRequirementEv
-__ZNK7WebCore13HTMLBRElement11tagPriorityEv
-__ZN7WebCore13HTMLBRElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore8RenderBRC2EPNS_4NodeE
-__ZN7WebCore8RenderBR8setStyleEPNS_11RenderStyleE
-__ZN7WebCore12RenderObject20createAnonymousBlockEv
-__ZNK7WebCore8RenderBR4isBREv
--[WebCoreFrameBridge stringByEvaluatingJavaScriptFromString:]
-__ZN7WebCore16HTMLImageElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore11RenderImageC2EPNS_4NodeE
-__ZN7WebCore14RenderReplacedC2EPNS_4NodeERKNS_7IntSizeE
-__ZN7WebCore11RenderImage13updateAltTextEv
-__ZNK7WebCore16HTMLImageElement7altTextEv
-__ZNK7WebCore12RenderObject10firstChildEv
-__ZNK7WebCore11RenderImage7isImageEv
-__ZN7WebCore11RenderImage14setCachedImageEPNS_11CachedImageE
-__ZNK7WebCore12RenderObject4isBREv
-__ZNK7WebCore12RenderObject25backslashAsCurrencySymbolEv
-__ZN7WebCore10StringImpl7replaceEtt
-__ZN7WebCore10RenderText8setStyleEPNS_11RenderStyleE
-__ZNK7WebCore12RenderObject9isSVGTextEv
-__ZNK7WebCore4Node15isIndeterminateEv
-__ZNK7WebCore4Node9isCheckedEv
-__ZN7WebCore17equalIgnoringCaseEPNS_10StringImplES1_
-__ZN7WebCore6Editor9copyImageERKNS_13HitTestResultE
-__ZN7WebCore10Pasteboard17generalPasteboardEv
-__ZN7WebCore10PasteboardC2EP12NSPasteboard
-__ZN7WebCore10Pasteboard10writeImageEPNS_4NodeERKNS_4KURLERKNS_6StringE
-__ZN7WebCore21writableTypesForImageEv
-__ZN7WebCore19writableTypesForURLEv
-__ZN7WebCore10Pasteboard8writeURLEP12NSPasteboardP7NSArrayRKNS_4KURLERKNS_6StringEPNS_5FrameE
-_suggestedFilenameWithMIMEType
-__ZN7WebCore16MIMETypeRegistry24getExtensionsForMIMETypeERKNS_6StringE
-__ZN7WebCore10Pasteboard32writeFileWrapperAsRTFDAttachmentEP13NSFileWrapper
-__ZN7WebCore5Image19drawPatternCallbackEPvP9CGContext
-__ZN7WebCore18marqueeConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore18HTMLMarqueeElementC1EPNS_8DocumentE
-__ZNK7WebCore18HTMLMarqueeElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
-__ZN7WebCore18HTMLMarqueeElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore18HTMLMarqueeElement17endTagRequirementEv
-__ZNK7WebCore18HTMLMarqueeElement11tagPriorityEv
-__ZN7WebCore16StyleMarqueeDataC1ERKS0_
-__ZN7WebCore7MarqueeC1EPNS_11RenderLayerE
-__ZN7WebCore7Marquee18updateMarqueeStyleEv
-__ZNK7WebCore7Marquee12isHorizontalEv
-__ZNK7WebCore7Marquee9directionEv
-__ZNK7WebCore7Marquee12marqueeSpeedEv
-__ZN7WebCore7Marquee21updateMarqueePositionEv
-__ZN7WebCore7Marquee15computePositionENS_17EMarqueeDirectionEb
-__ZN7WebCore7Marquee5startEv
-__ZN7WebCore5TimerINS_7MarqueeEE5firedEv
-__ZN7WebCore7Marquee10timerFiredEPNS_5TimerIS0_EE
-__ZNK7WebCore11HistoryItem12formReferrerEv
-__ZNK7WebCore11HistoryItem15formContentTypeEv
-__ZN7WebCore14ResourceHandle17willLoadFromCacheERNS_15ResourceRequestE
-__ZNK7WebCore15HTMLLinkElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore15HTMLBodyElement14isURLAttributeEPNS_9AttributeE
--[DOMHTMLScriptElement src]
--[DOMHTMLLinkElement rel]
--[DOMHTMLLinkElement href]
--[DOMHTMLBodyElement background]
-__ZNK7WebCore15HTMLBodyElement10backgroundEv
--[DOMHTMLInputElement src]
-__ZN3WTF7HashMapINS_6RefPtrIN7WebCore5FrameEEEPNS0_IxNS1_INS2_17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS9_IS6_EEEENS_7PtrHashIS4_EENS9_IS4_EENS9_ISD_EEE3setEPS3_RKSD_
-__ZN7WebCore21updateResourceRequestEPNS_17InspectorResourceERKNS_15ResourceRequestE
-__ZN7WebCore19InspectorController11addResourceEPNS_17InspectorResourceE
-__ZNK3WTF7HashMapIxNS_6RefPtrIN7WebCore17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS7_IS4_EEE3getERKx
-__ZN3WTF9HashTableIxSt4pairIxiENS_18PairFirstExtractorIS2_EENS_7IntHashIyEENS_14PairHashTraitsINS_10HashTraitsIxEENS8_IiEEEES9_E3addIxS2_NS_22IdentityHashTranslatorIxS2_S6_EEEES1_INS_17HashTableIteratorIxS2_S4_S6_SB_S9_EEbERKT_RKT0_
-__ZN7WebCore22updateResourceResponseEPNS_17InspectorResourceERKNS_16ResourceResponseE
-__ZN7WebCore19InspectorController14pruneResourcesEPN3WTF7HashMapIxNS1_6RefPtrINS_17InspectorResourceEEENS1_7IntHashIyEENS1_10HashTraitsIxEENS8_IS5_EEEEPNS_14DocumentLoaderE
-__ZN7WebCore19InspectorController14removeResourceEPNS_17InspectorResourceE
-__ZN3WTF9HashTableIxSt4pairIxiENS_18PairFirstExtractorIS2_EENS_7IntHashIyEENS_14PairHashTraitsINS_10HashTraitsIxEENS8_IiEEEES9_E4findIxNS_22IdentityHashTranslatorIxS2_S6_EEEENS_17HashTableIteratorIxS2_S4_S6_SB_S9_EERKT_
-__ZN7WebCore19InspectorController4showEv
-__ZN7WebCore5Frame21setProhibitsScrollingEb
-__ZN7WebCore9CSSParser19parseBackgroundSizeEv
-__ZN7WebCore9CSSParser16parseBorderImageEib
-__ZN7WebCore23BorderImageParseContext17commitBorderImageEPNS_9CSSParserEib
-__ZN7WebCore19CSSBorderImageValueC2EN3WTF10PassRefPtrINS_13CSSImageValueEEENS2_INS_4RectEEEii
-__ZN7WebCore9CSSParser24parseTransitionShorthandEb
-__ZN7WebCore9CSSParser23parseTransitionPropertyEiRN3WTF6RefPtrINS_8CSSValueEEE
-__ZN7WebCore9CSSParser23parseTransitionPropertyEv
-__ZNK7WebCore6String4utf8Ev
-__ZN7WebCore9CSSParser18addTransitionValueERN3WTF6RefPtrINS_8CSSValueEEENS1_10PassRefPtrIS3_EE
-__ZN7WebCore9CSSParser23parseTransitionDurationEv
-__ZN7WebCore9CSSParser29parseTransitionTimingFunctionEv
-__ZN7WebCore19InspectorController27windowScriptObjectAvailableEv
-__ZN7WebCore32JSCSSStyleDeclarationConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore16CSSStyleSelector17mapBackgroundSizeEPNS_15BackgroundLayerEPNS_8CSSValueE
-__ZN7WebCore11RenderStyle10setContentEPNS_14CachedResourceEb
-__ZN7WebCore11RenderStyle17accessTransitionsEv
-__ZN7WebCore10TransitionC1Ev
-__ZN7WebCore16CSSStyleSelector21mapTransitionPropertyEPNS_10TransitionEPNS_8CSSValueE
-__ZN7WebCore16CSSStyleSelector21mapTransitionDurationEPNS_10TransitionEPNS_8CSSValueE
-__ZN7WebCore16CSSStyleSelector27mapTransitionTimingFunctionEPNS_10TransitionEPNS_8CSSValueE
-__ZN7WebCore10Transition19fillUnsetPropertiesEv
-__ZN7WebCore15BackgroundLayer15cullEmptyLayersEv
-__ZN7WebCore15BackgroundLayer19fillUnsetPropertiesEv
-__ZNK7WebCore15BackgroundLayer13hasFixedImageEv
-__ZN7WebCore16localizedStringsEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController19localizedStringsURLEv
-__ZNK7WebCore10TransitioneqERKS0_
-__ZN7WebCore19AnimationController24updateImplicitAnimationsEPNS_12RenderObjectEPNS_11RenderStyleE
-__ZN7WebCore26AnimationControllerPrivate3getEPNS_12RenderObjectE
-__ZNK3WTF7HashMapIPN7WebCore12RenderObjectEPNS1_26CompositeImplicitAnimationENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
-__ZN7WebCore26CompositeImplicitAnimation7animateEPNS_12RenderObjectEPNS_11RenderStyleES4_
-__ZN7WebCore17ImplicitAnimationC1EPKNS_10TransitionE
-__ZN3WTF7HashMapIiPN7WebCore17ImplicitAnimationENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3setERKiRKS3_
-__ZN7WebCore17ImplicitAnimation7animateEPNS_26CompositeImplicitAnimationEPNS_12RenderObjectEPNS_11RenderStyleES6_RS6_
-__ZN7WebCore17ImplicitAnimation5resetEPNS_12RenderObjectEPNS_11RenderStyleES4_
-__ZN7WebCore26AnimationControllerPrivate11updateTimerEv
-__ZNK7WebCore26CompositeImplicitAnimation9animatingEv
-__ZN7WebCore26AnimationControllerPrivate5clearEPNS_12RenderObjectE
-__ZZN7WebCore8platformEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_E8platform
-__ZN7WebCore17canvasConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLCanvasElementC1EPNS_8DocumentE
-__ZN7WebCore19createCanvasWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore19JSHTMLCanvasElementC1EPN3KJS8JSObjectEPNS_17HTMLCanvasElementE
-__ZN7WebCore19JSHTMLCanvasElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSHTMLCanvasElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSHTMLCanvasElement9classInfoEv
+-[AccessibilityObjectWrapper role]
+__ZL19roleValueToNSStringN7WebCore17AccessibilityRoleE
+__ZL26createAccessibilityRoleMapv
+__ZN3WTF7HashMapIiP8NSStringNS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3setERKiRKS2_
+__ZN3WTF9HashTableIiSt4pairIiP8NSStringENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_
+__ZNK3WTF7HashMapIiP8NSStringNS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3getERKi
+__ZN7WebCore25AccessibilityRenderObject15childrenChangedEv
+__ZNK7WebCore25AccessibilityRenderObject27isAccessibilityRenderObjectEv
+__ZNK7WebCore17HTMLAnchorElement13supportsFocusEv
+__ZN7WebCore13AXObjectCache16postNotificationEPNS_12RenderObjectERKNS_6StringE
+__ZNK7WebCore25AccessibilityRenderObject16observableObjectEv
+__ZNK7WebCore25AccessibilityRenderObject4textEv
+__ZNK7WebCore25AccessibilityRenderObject15isPasswordFieldEv
+__ZNK7WebCore25AccessibilityRenderObject19isNativeTextControlEv
+__ZN7WebCore19HTMLTextAreaElement19defaultEventHandlerEPNS_5EventE
+__ZNK7WebCore19HTMLTextAreaElement20shouldUseInputMethodEv
+__ZN7WebCore19HTMLTextAreaElement21updateFocusAppearanceEb
+__ZN7WebCore19HTMLTextAreaElement17setSelectionRangeEii
+__ZNK7WebCore19HTMLTextAreaElement16isMouseFocusableEv
+__ZN7WebCore26RenderTextControlMultiLine14cacheSelectionEii
+__ZN7WebCore26RenderTextControlMultiLine12forwardEventEPNS_5EventE
+__ZNK7WebCore25AccessibilityRenderObject7isImageEv
+__ZN7WebCore25AccessibilityRenderObject12headingLevelEPNS_4NodeE
+__ZNK7WebCore19AccessibilityObject21parentObjectUnignoredEv
+-[AccessibilityObjectWrapper accessibilityArrayAttributeValues:index:maxCount:]
+__ZN7WebCore25AccessibilityRenderObject8childrenEv
+__ZN7WebCore25AccessibilityRenderObject11addChildrenEv
+__ZNK7WebCore25AccessibilityRenderObject15canHaveChildrenEv
+__ZNK7WebCore25AccessibilityRenderObject10firstChildEv
+__ZNK7WebCore19AccessibilityObject11hasChildrenEv
+__ZN7WebCore21AccessibilityARIAGrid6createEPNS_12RenderObjectE
+__ZN7WebCore21AccessibilityARIAGridC1EPNS_12RenderObjectE
+__ZN7WebCore21AccessibilityARIAGridC2EPNS_12RenderObjectE
+__ZN7WebCore18AccessibilityTableC2EPNS_12RenderObjectE
+__ZN7WebCore18AccessibilityTable36isTableExposableThroughAccessibilityEv
+__ZNK7WebCore18AccessibilityTable22accessibilityIsIgnoredEv
+__ZNK7WebCore18AccessibilityTable11isDataTableEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EE15reserveCapacityEm
+__ZNK7WebCore25AccessibilityRenderObject11nextSiblingEv
+__ZNK7WebCore25AccessibilityRenderObject19mouseButtonListenerEv
+__ZNK7WebCore12RenderObject13isRenderImageEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EEC1ERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EEC2ERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EE6shrinkEm
+-[AccessibilityObjectWrapper accessibilityAttributeNames]
+__ZNK7WebCore18AccessibilityTable9roleValueEv
+-[AccessibilityObjectWrapper subrole]
+__ZNK7WebCore19AccessibilityObject6isListEv
+-[AccessibilityObjectWrapper roleDescription]
+__ZN7WebCore18AccessibilityTable13clearChildrenEv
+__ZN7WebCore21AccessibilityARIAGrid11addChildrenEv
+__ZN7WebCore24AccessibilityARIAGridRow6createEPNS_12RenderObjectE
+__ZN7WebCore24AccessibilityARIAGridRowC1EPNS_12RenderObjectE
+__ZN7WebCore24AccessibilityARIAGridRowC2EPNS_12RenderObjectE
+__ZN7WebCore21AccessibilityTableRowC2EPNS_12RenderObjectE
+__ZNK7WebCore21AccessibilityTableRow22accessibilityIsIgnoredEv
+__ZNK7WebCore21AccessibilityTableRow10isTableRowEv
+__ZNK7WebCore24AccessibilityARIAGridRow11parentTableEv
+__ZN7WebCore21AccessibilityARIAGrid8addChildEPNS_19AccessibilityObjectERN3WTF7HashSetIS2_NS3_7PtrHashIS2_EENS3_10HashTraitsIS2_
+__ZNK3WTF9HashTableIPN7WebCore19AccessibilityObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8c
+__ZNK7WebCore21AccessibilityTableRow9roleValueEv
+__ZN7WebCore25AccessibilityARIAGridCell6createEPNS_12RenderObjectE
+__ZN7WebCore25AccessibilityARIAGridCellC1EPNS_12RenderObjectE
+__ZN7WebCore25AccessibilityARIAGridCellC2EPNS_12RenderObjectE
+__ZN7WebCore22AccessibilityTableCellC2EPNS_12RenderObjectE
+__ZNK7WebCore22AccessibilityTableCell22accessibilityIsIgnoredEv
+__ZNK7WebCore22AccessibilityTableCell11isTableCellEv
+__ZNK7WebCore25AccessibilityARIAGridCell11parentTableEv
+__ZN3WTF7HashSetIPN7WebCore19AccessibilityObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore19AccessibilityObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6ex
+__ZN3WTF9HashTableIPN7WebCore19AccessibilityObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6re
+__ZN3WTF9HashTableIPN7WebCore19AccessibilityObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13a
+__ZN3WTF9HashTableIPN7WebCore19AccessibilityObjectES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15d
+__ZN7WebCore13AXObjectCache11getOrCreateENS_17AccessibilityRoleE
+__ZN7WebCore24AccessibilityTableColumn6createEv
+__ZN7WebCore24AccessibilityTableColumnC1Ev
+__ZN7WebCore24AccessibilityTableColumnC2Ev
+__ZN7WebCore24AccessibilityTableColumn14setParentTableEPNS_18AccessibilityTableE
+__ZN7WebCore18AccessibilityTable15headerContainerEv
+__ZN7WebCore33AccessibilityTableHeaderContainer6createEv
+__ZN7WebCore33AccessibilityTableHeaderContainerC1Ev
+__ZN7WebCore33AccessibilityTableHeaderContainerC2Ev
+__ZL16convertToNSArrayRKN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EEE
+__ZNK7WebCore19AccessibilityObject12isAttachmentEv
+__ZNK7WebCore25AccessibilityRenderObject8helpTextEv
+__ZNK7WebCore25AccessibilityRenderObject21frameViewIfRenderViewEv
+__ZNK7WebCore18AccessibilityTable5titleEv
+__ZNK7WebCore25AccessibilityRenderObject4sizeEv
+__ZNK7WebCore25AccessibilityRenderObject11elementRectEv
+__ZNK7WebCore25AccessibilityRenderObject17isCheckboxOrRadioEv
+__ZNK7WebCore25AccessibilityRenderObject15boundingBoxRectEv
+__ZNK7WebCore25AccessibilityRenderObject12isInputImageEv
+__ZNK7WebCore25AccessibilityRenderObject19isProgressIndicatorEv
+__ZNK7WebCore25AccessibilityRenderObject8isSliderEv
+__ZNK7WebCore25AccessibilityRenderObject11hasIntValueEv
+__ZNK7WebCore25AccessibilityRenderObject11stringValueEv
+__ZNK7WebCore25AccessibilityRenderObject9isFocusedEv
+__ZNK7WebCore25AccessibilityRenderObject9isEnabledEv
+__ZNK7WebCore25AccessibilityRenderObject17documentFrameViewEv
+__ZNK7WebCore19AccessibilityObject10isTableRowEv
+__ZNK7WebCore19AccessibilityObject13isTableColumnEv
+__ZNK7WebCore19AccessibilityObject11isTableCellEv
+__ZNK7WebCore19AccessibilityObject9isListBoxEv
+-[AccessibilityObjectWrapper textMarkerRangeForSelection]
+__ZNK7WebCore25AccessibilityRenderObject9selectionEv
+__ZN7WebCore15startOfDocumentEPKNS_4NodeE
+__ZL28textMarkerForVisiblePositionRKN7WebCore15VisiblePositionE
+__ZN7WebCore13endOfDocumentEPKNS_4NodeE
+__ZNK7WebCore25AccessibilityRenderObject9isVisitedEv
+__ZNK7WebCore25AccessibilityRenderObject16linkedUIElementsERN3WTF6VectorINS1_6RefPtrINS_19AccessibilityObjectEEELm0EEE
+__ZNK7WebCore25AccessibilityRenderObject10isSelectedEv
+__ZL15blockquoteLevelPN7WebCore12RenderObjectE
+__ZN7WebCore18AccessibilityTable4rowsEv
+__ZN7WebCore18AccessibilityTable7columnsEv
+__ZN7WebCore18AccessibilityTable5cellsERN3WTF6VectorINS1_6RefPtrINS_19AccessibilityObjectEEELm0EEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore19AccessibilityObjectEEELm0EE6appendIS4_EEvPKT_m
+__ZN7WebCore18AccessibilityTable13columnHeadersERN3WTF6VectorINS1_6RefPtrINS_19AccessibilityObjectEEELm0EEE
+__ZN7WebCore24AccessibilityTableColumn12headerObjectEv
+__ZNK7WebCore21AccessibilityARIAGrid11isAriaTableEv
+__ZN7WebCore24AccessibilityTableColumn8childrenEv
+__ZN7WebCore24AccessibilityTableColumn11addChildrenEv
+__ZN7WebCore18AccessibilityTable8rowCountEv
+__ZN7WebCore21AccessibilityARIAGrid19cellForColumnAndRowEjj
+__ZN7WebCore18AccessibilityTable11columnCountEv
+__ZNK7WebCore22AccessibilityTableCell9roleValueEv
+__ZN7WebCore18AccessibilityTable10rowHeadersERN3WTF6VectorINS1_6RefPtrINS_19AccessibilityObjectEEELm0EEE
+__ZN7WebCore24AccessibilityARIAGridRow12headerObjectEv
+__ZNK7WebCore16HTMLTableElement7captionEv
+-[AccessibilityObjectWrapper accessibilityAttributeValue:forParameter:]
+__ZNK7WebCore19AccessibilityObject11isDataTableEv
+__ZN7WebCore25AccessibilityARIAGridCell13rowIndexRangeERSt4pairIiiE
+__ZN7WebCore25AccessibilityARIAGridCell16columnIndexRangeERSt4pairIiiE
+__ZN7WebCore19AccessibilityObject18updateBackingStoreEv
+__ZNK7WebCore19AccessibilityObject15isPasswordFieldEv
+__ZNK7WebCore19AccessibilityObject9isWebAreaEv
+__ZNK7WebCore19AccessibilityObject13isTextControlEv
+__ZNK7WebCore19AccessibilityObject8isAnchorEv
+__ZNK7WebCore19AccessibilityObject7isImageEv
+__ZNK7WebCore19AccessibilityObject6isLinkEv
+__ZNK7WebCore24AccessibilityTableColumn13isTableColumnEv
+__ZNK7WebCore24AccessibilityTableColumn9roleValueEv
+__ZNK7WebCore19AccessibilityObject8helpTextEv
+__ZNK7WebCore19AccessibilityObject27isAccessibilityRenderObjectEv
+__ZNK7WebCore24AccessibilityTableColumn12parentObjectEv
+__ZNK7WebCore19AccessibilityObject5titleEv
+__ZNK7WebCore24AccessibilityTableColumn4sizeEv
+__ZNK7WebCore24AccessibilityTableColumn11elementRectEv
+__ZNK7WebCore19AccessibilityObject24accessibilityDescriptionEv
+__ZNK7WebCore19AccessibilityObject19isProgressIndicatorEv
+__ZNK7WebCore19AccessibilityObject8isSliderEv
+__ZNK7WebCore19AccessibilityObject11hasIntValueEv
+__ZNK7WebCore19AccessibilityObject11stringValueEv
+__ZNK7WebCore19AccessibilityObject9isFocusedEv
+__ZNK7WebCore19AccessibilityObject9isEnabledEv
+__ZNK7WebCore19AccessibilityObject17documentFrameViewEv
+__ZNK7WebCore19AccessibilityObject9selectionEv
+__ZNK7WebCore19AccessibilityObject9isVisitedEv
+__ZNK7WebCore19AccessibilityObject16linkedUIElementsERN3WTF6VectorINS1_6RefPtrIS0_EELm0EEE
+__ZNK7WebCore19AccessibilityObject10isSelectedEv
+__ZNK7WebCore33AccessibilityTableHeaderContainer9roleValueEv
+__ZNK7WebCore19AccessibilityObject12isInputImageEv
+__ZNK7WebCore19AccessibilityObject9isControlEv
+__ZNK7WebCore19AccessibilityObject7isGroupEv
+__ZNK7WebCore19AccessibilityObject6isMenuEv
+__ZNK7WebCore19AccessibilityObject9isMenuBarEv
+__ZNK7WebCore19AccessibilityObject12isMenuButtonEv
+__ZNK7WebCore19AccessibilityObject10isMenuItemEv
+__ZN7WebCore33AccessibilityTableHeaderContainer8childrenEv
+__ZN7WebCore33AccessibilityTableHeaderContainer11addChildrenEv
+__ZNK7WebCore33AccessibilityTableHeaderContainer12parentObjectEv
+__ZNK7WebCore33AccessibilityTableHeaderContainer4sizeEv
+__ZNK7WebCore33AccessibilityTableHeaderContainer11elementRectEv
+__ZN7WebCore22jsHTMLElementInnerTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21AccessibilityARIAGridD0Ev
+__ZN7WebCore18AccessibilityTableD2Ev
+__ZN7WebCore25AccessibilityRenderObjectD2Ev
+__ZN7WebCore24AccessibilityARIAGridRowD0Ev
+__ZN7WebCore21AccessibilityTableRowD2Ev
+__ZN7WebCore24AccessibilityTableColumnD0Ev
+__ZN7WebCore25AccessibilityARIAGridCellD0Ev
+__ZN7WebCore22AccessibilityTableCellD2Ev
+__ZN7WebCore33AccessibilityTableHeaderContainerD0Ev
+__ZN7WebCoreL17canvasConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLCanvasElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17HTMLCanvasElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore17HTMLCanvasElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZN7WebCore17HTMLCanvasElement5resetEv
-__ZN7WebCore19JSHTMLCanvasElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore46jsHTMLCanvasElementPrototypeFunctionGetContextEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZNK7WebCore17HTMLCanvasElement17endTagRequirementEv
+__ZNK7WebCore17HTMLCanvasElement11tagPriorityEv
+__ZN7WebCore17HTMLCanvasElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore16RenderHTMLCanvasC1EPNS_17HTMLCanvasElementE
+__ZN7WebCore16RenderHTMLCanvasC2EPNS_17HTMLCanvasElementE
+-[AccessibilityObjectWrapper renderWidgetChildren]
+__ZNK7WebCore25AccessibilityRenderObject6widgetEv
+__ZNK7WebCore25AccessibilityRenderObject3urlEv
+__ZNK7WebCore25AccessibilityRenderObject9accessKeyEv
+__ZN7WebCoreL30createHTMLCanvasElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLCanvasElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLCanvasElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLCanvasElementEEE
+__ZN7WebCore19JSHTMLCanvasElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLCanvasElementEEE
+__ZN7WebCore19JSHTMLCanvasElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28JSHTMLCanvasElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore46jsHTMLCanvasElementPrototypeFunctionGetContextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore19JSHTMLCanvasElement9classInfoEv
 __ZN7WebCore17HTMLCanvasElement10getContextERKNS_6StringE
 __ZN7WebCore24CanvasRenderingContext2DC1EPNS_17HTMLCanvasElementE
+__ZN7WebCore24CanvasRenderingContext2DC2EPNS_17HTMLCanvasElementE
 __ZN7WebCore24CanvasRenderingContext2D5StateC1Ev
+__ZN7WebCore24CanvasRenderingContext2D5StateC2Ev
 __ZN7WebCore11CanvasStyleC1ERKNS_6StringE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_24CanvasRenderingContext2DE
-__ZN7WebCore35JSCanvasRenderingContext2DPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore26JSCanvasRenderingContext2DC1EPN3KJS8JSObjectEPNS_24CanvasRenderingContext2DE
-__ZN7WebCore26JSCanvasRenderingContext2D18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore35JSCanvasRenderingContext2DPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionClearRectEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore26JSCanvasRenderingContext2D9classInfoEv
-__ZN7WebCore24CanvasRenderingContext2D9clearRectEffffRi
+__ZN7WebCore11CanvasStyleC2ERKNS_6StringE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_24CanvasRenderingContext2DE
+__ZN7WebCore26JSCanvasRenderingContext2D15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24CanvasRenderingContext2D3refEv
+__ZN7WebCore26JSCanvasRenderingContext2DC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24CanvasRenderingContext2DEEE
+__ZN7WebCore26JSCanvasRenderingContext2DC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24CanvasRenderingContext2DEEE
+__ZN7WebCore26JSCanvasRenderingContext2D3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore38setJSCanvasRenderingContext2DLineWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D12setLineWidthEf
 __ZNK7WebCore24CanvasRenderingContext2D14drawingContextEv
 __ZNK7WebCore17HTMLCanvasElement14drawingContextEv
-__ZNK7WebCore17HTMLCanvasElement20createDrawingContextEv
-__ZN7WebCore24CanvasRenderingContext2D8willDrawERKNS_9FloatRectE
-__ZNK7WebCore15GraphicsContext6getCTMEv
-__ZN7WebCore15AffineTransformC1E17CGAffineTransform
-__ZNK7WebCore15AffineTransform7mapRectERKNS_9FloatRectE
-__ZN7WebCore17HTMLCanvasElement8willDrawERKNS_9FloatRectE
-__ZN7WebCore15GraphicsContext9clearRectERKNS_9FloatRectE
-__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionBeginPathEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZNK7WebCore17HTMLCanvasElement6bufferEv
+__ZNK7WebCore17HTMLCanvasElement17createImageBufferEv
+__ZNK7WebCore17HTMLCanvasElement22convertLogicalToDeviceERKNS_9FloatSizeE
+__ZN7WebCore6Chrome11scaleFactorEv
+__ZN7WebCore11ImageBufferC1ERKNS_7IntSizeEbRb
+__ZN7WebCore11ImageBufferC2ERKNS_7IntSizeEbRb
+__ZN7WebCore15ImageBufferDataC1ERKNS_7IntSizeE
+__ZN7WebCore15ImageBufferDataC2ERKNS_7IntSizeE
+__ZNK7WebCore11ImageBuffer7contextEv
+__ZN7WebCore15GraphicsContext26setShadowsIgnoreTransformsEb
+__ZN7WebCore36setJSCanvasRenderingContext2DLineCapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D10setLineCapERKNS_6StringE
+__ZN7WebCore12parseLineCapERKNS_6StringERNS_7LineCapE
+__ZN7WebCore15GraphicsContext10setLineCapENS_7LineCapE
+__ZN7WebCore26JSCanvasRenderingContext2D18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore35JSCanvasRenderingContext2DPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionBeginPathEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore26JSCanvasRenderingContext2D9classInfoEv
 __ZN7WebCore24CanvasRenderingContext2D9beginPathEv
 __ZN7WebCore4Path5clearEv
-__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionMoveToEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D6moveToEff
-__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionLineToEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D6lineToEff
-__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionClosePathEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D9closePathEv
-__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionSaveEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D4saveEv
-__ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE15reserveCapacityEm
-__ZN7WebCore26JSCanvasRenderingContext2D3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore26JSCanvasRenderingContext2D16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore24CanvasRenderingContext2D13setShadowBlurEf
-__ZN7WebCore24CanvasRenderingContext2D11applyShadowEv
-__ZN7WebCore9CSSParser10parseColorERjRKNS_6StringEb
-__ZNK7WebCore9FloatSizecv6CGSizeEv
-__ZN7WebCore24CanvasRenderingContext2D14setShadowColorERKNS_6StringE
-__ZN7WebCore9CSSParser10parseColorEPNS_26CSSMutableStyleDeclarationERKNS_6StringE
-__ZN7WebCore24CanvasRenderingContext2D16setShadowOffsetXEf
-__ZN7WebCore24CanvasRenderingContext2D16setShadowOffsetYEf
-__ZN7WebCore26JSCanvasRenderingContext2D14setStrokeStyleEPN3KJS9ExecStateEPNS1_7JSValueE
-__ZN7WebCore17toHTMLCanvasStyleEPN3KJS9ExecStateEPNS0_7JSValueE
+__ZN7WebCore53jsCanvasRenderingContext2DPrototypeFunctionStrokeRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore26JSCanvasRenderingContext2D10strokeRectEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK3JSC7JSValue7toFloatEPNS_9ExecStateE
+__ZN7WebCore24CanvasRenderingContext2D10strokeRectEffff
+__ZN7WebCoreL21validateRectForCanvasERfS0_S0_S0_
+__ZN7WebCore24CanvasRenderingContext2D10strokeRectEfffff
+__ZN7WebCore24CanvasRenderingContext2D8willDrawERKNS_9FloatRectEj
+__ZN7WebCore9FloatRect5uniteERKS0_
+__ZN7WebCore17HTMLCanvasElement8willDrawERKNS_9FloatRectE
+__ZN7WebCore7mapRectERKNS_9FloatRectES2_S2_
+__ZN7WebCore9FloatRect9intersectERKS0_
+__ZN7WebCore15GraphicsContext10strokeRectERKNS_9FloatRectEf
+__ZN7WebCore40setJSCanvasRenderingContext2DStrokeStyleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26JSCanvasRenderingContext2D14setStrokeStyleEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCoreL17toHTMLCanvasStyleEPN3JSC9ExecStateENS0_7JSValueE
 __ZN7WebCore24CanvasRenderingContext2D14setStrokeStyleEN3WTF10PassRefPtrINS_11CanvasStyleEEE
 __ZN7WebCore11CanvasStyle16applyStrokeColorEPNS_15GraphicsContextE
-__ZN7WebCore24CanvasRenderingContext2D12setLineWidthEf
-__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionStrokeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore5ColorC1ERKNS_6StringE
+__ZN7WebCore5ColorC2ERKNS_6StringE
+__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionMoveToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D6moveToEff
+__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionLineToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D6lineToEff
+__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionStrokeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore24CanvasRenderingContext2D6strokeEv
 __ZNK7WebCore4Path7isEmptyEv
+__ZN7WebCore15GraphicsContext9beginPathEv
+__ZN7WebCore4Path18strokeBoundingRectEPNS_18StrokeStyleApplierE
+__ZN7WebCoreL20createScratchContextEv
+__ZN7WebCoreL15putBytesNowhereEPvPKvm
+__ZN7WebCore24CanvasStrokeStyleApplier11strokeStyleEPNS_15GraphicsContextE
+__ZNK7WebCore24CanvasRenderingContext2D9lineWidthEv
+__ZN7WebCore15GraphicsContext11setLineJoinENS_8LineJoinE
+__ZNK7WebCore24CanvasRenderingContext2D10miterLimitEv
+__ZN7WebCore15GraphicsContext13setMiterLimitEf
+__ZN7WebCore15GraphicsContext10strokePathEv
 __ZN7WebCore24CanvasRenderingContext2D46clearPathForDashboardBackwardCompatibilityModeEv
-__ZN7WebCore50jsCanvasRenderingContext2DPrototypeFunctionRestoreEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D7restoreEv
+__ZN7WebCore16RenderHTMLCanvas13paintReplacedERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore17HTMLCanvasElement5paintEPNS_15GraphicsContextERKNS_7IntRectE
+__ZNK7WebCore11ImageBuffer5imageEv
+__ZN7WebCore11BitmapImageC1EP7CGImagePNS_13ImageObserverE
+__ZN7WebCore11BitmapImageC2EP7CGImagePNS_13ImageObserverE
+__ZN7WebCore26JSCanvasRenderingContext2DD1Ev
+__ZN7WebCore26JSCanvasRenderingContext2DD2Ev
+__ZN7WebCore24CanvasRenderingContext2D5derefEv
+__ZN7WebCore19JSHTMLCanvasElementD1Ev
+__ZN7WebCore16RenderHTMLCanvasD0Ev
+__ZNK7WebCore19AccessibilityObject29accessibilityIgnoreAttachmentEv
+-[AccessibilityObjectWrapper attachmentView]
+__ZNK7WebCore25AccessibilityRenderObject23widgetForAttachmentViewEv
+-[AccessibilityObjectWrapper accessibilityIsIgnored]
+-[AccessibilityObjectWrapper _accessibilityParentForSubview:]
+__ZNK7WebCore25AccessibilityRenderObject7isGroupEv
+__ZNK7WebCore25AccessibilityRenderObject14titleUIElementEv
+__ZNK7WebCore25AccessibilityRenderObject10isFieldsetEv
+__ZNK7WebCore25AccessibilityRenderObject21exposesTitleUIElementEv
+__ZN7WebCore13AXWebAreaTextEv
+__ZN7WebCore10RenderView13absoluteQuadsERN3WTF6VectorINS_9FloatQuadELm0EEE
+__ZN7WebCore25AccessibilityRenderObject16getDocumentLinksERN3WTF6VectorINS1_6RefPtrINS_19AccessibilityObjectEEELm0EEE
+__ZNK7WebCore25AccessibilityRenderObject8isLoadedEv
+__ZNK7WebCore25AccessibilityRenderObject11layoutCountEv
+__ZN7WebCore35JSCanvasRenderingContext2DPrototypeD1Ev
+__ZN7WebCore28JSHTMLCanvasElementPrototypeD1Ev
+__ZN7WebCore17HTMLCanvasElementD0Ev
+__ZN7WebCore11ImageBufferD1Ev
+__ZN7WebCore11ImageBufferD2Ev
 __ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE6shrinkEm
-__ZN7WebCore24CanvasRenderingContext2D27setGlobalCompositeOperationERKNS_6StringE
-__ZN7WebCore22parseCompositeOperatorERKNS_6StringERNS_17CompositeOperatorE
-__ZN7WebCore59jsCanvasRenderingContext2DPrototypeFunctionQuadraticCurveToEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D16quadraticCurveToEffff
-__ZN7WebCore4Path14addQuadCurveToERKNS_10FloatPointES3_
-__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionClipEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D4clipEv
-__ZN7WebCore26JSCanvasRenderingContext2D12setFillStyleEPN3KJS9ExecStateEPNS1_7JSValueE
-__ZN7WebCore24CanvasRenderingContext2D12setFillStyleEN3WTF10PassRefPtrINS_11CanvasStyleEEE
-__ZN7WebCore11CanvasStyle14applyFillColorEPNS_15GraphicsContextE
-__ZN7WebCore51jsCanvasRenderingContext2DPrototypeFunctionFillRectEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D8fillRectEffffRi
-__ZN7WebCore63jsCanvasRenderingContext2DPrototypeFunctionCreateLinearGradientEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D20createLinearGradientEffff
-__ZN7WebCore14CanvasGradientC1ERKNS_10FloatPointES3_
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_14CanvasGradientE
-__ZN7WebCore25JSCanvasGradientPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSCanvasGradientC1EPN3KJS8JSObjectEPNS_14CanvasGradientE
-__ZN7WebCore25JSCanvasGradientPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore45jsCanvasGradientPrototypeFunctionAddColorStopEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore16JSCanvasGradient9classInfoEv
-__ZN7WebCore14CanvasGradient12addColorStopEfRKNS_6StringE
-__ZN3WTF6VectorIN7WebCore14CanvasGradient9ColorStopELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIN7WebCore14CanvasGradient9ColorStopELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore14CanvasGradient9ColorStopELm0EE15reserveCapacityEm
-__ZN7WebCore11CanvasStyleC1EN3WTF10PassRefPtrINS_14CanvasGradientEEE
-__ZN7WebCore14CanvasGradient15platformShadingEv
-__ZN7WebCore16gradientCallbackEPvPKfPf
-__ZN7WebCore14CanvasGradient8getColorEfPfS1_S1_S1_
-__ZNSt17_Temporary_bufferIPN7WebCore14CanvasGradient9ColorStopES2_EC1ES3_S3_
-__ZSt22__get_temporary_bufferIN7WebCore14CanvasGradient9ColorStopEESt4pairIPT_iEiS5_
-__ZSt26__uninitialized_fill_n_auxIPN7WebCore14CanvasGradient9ColorStopEiS2_EvT_T0_RKT1_12__false_type
-__ZSt22__stable_sort_adaptiveIPN7WebCore14CanvasGradient9ColorStopES3_iPFbRKS2_S5_EEvT_S8_T0_T1_T2_
-__ZSt24__merge_sort_with_bufferIPN7WebCore14CanvasGradient9ColorStopES3_PFbRKS2_S5_EEvT_S8_T0_T1_
-__ZSt22__chunk_insertion_sortIPN7WebCore14CanvasGradient9ColorStopEiPFbRKS2_S5_EEvT_S8_T0_T1_
-__ZSt16__insertion_sortIPN7WebCore14CanvasGradient9ColorStopEPFbRKS2_S5_EEvT_S8_T0_
-__ZN7WebCore12compareStopsERKNS_14CanvasGradient9ColorStopES3_
-__ZSt25__unguarded_linear_insertIPN7WebCore14CanvasGradient9ColorStopES2_PFbRKS2_S5_EEvT_T0_T1_
-__ZSt16__merge_adaptiveIPN7WebCore14CanvasGradient9ColorStopEiS3_PFbRKS2_S5_EEvT_S8_S8_T0_S9_T1_S9_T2_
-__ZSt16__merge_backwardIPN7WebCore14CanvasGradient9ColorStopES3_S3_PFbRKS2_S5_EET1_T_S9_T0_SA_S8_T2_
-__ZSt23return_temporary_bufferIN7WebCore14CanvasGradient9ColorStopEEvPT_
-__ZNK7WebCore14CanvasGradient8findStopEf
-__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionTranslateEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D9translateEff
-__ZN7WebCore15GraphicsContext9translateEff
-__ZN7WebCore15AffineTransform9translateEdd
-__ZN7WebCore4Path9transformERKNS_15AffineTransformE
-__ZNK7WebCore15AffineTransformcv17CGAffineTransformEv
-__ZN7WebCore48jsCanvasRenderingContext2DPrototypeFunctionScaleEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D5scaleEff
-__ZN7WebCore15GraphicsContext5scaleERKNS_9FloatSizeE
-__ZN7WebCore6loadedEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController17scriptObjectReadyEv
-__ZN7WebCore19InspectorController16setWindowVisibleEb
-__ZN7WebCore19InspectorController23populateScriptResourcesEv
-__ZN7WebCore19InspectorController20clearScriptResourcesEv
-__ZN7WebCore18callSimpleFunctionEPK15OpaqueJSContextP13OpaqueJSValuePKc
-__ZN7WebCore19InspectorController26clearScriptConsoleMessagesEv
-__ZN7WebCore19InspectorController28clearDatabaseScriptResourcesEv
-__ZN7WebCore19InspectorController20clearNetworkTimelineEv
-__ZN7WebCore19InspectorController26addAndUpdateScriptResourceEPNS_17InspectorResourceE
-__ZN7WebCore19InspectorController17addScriptResourceEPNS_17InspectorResourceE
-__ZNK7WebCore4KURL17lastPathComponentEv
-__ZN7WebCore22scriptObjectForRequestEPK15OpaqueJSContextPKNS_17InspectorResourceE
-__ZN7WebCore10addHeadersEPK15OpaqueJSContextP13OpaqueJSValueRKN3WTF7HashMapINS_6StringES7_NS_15CaseFoldingHashENS5_10HashTraitsIS7_EESA_EE
-__ZNK7WebCore17HTMLCanvasElement17endTagRequirementEv
-__ZNK7WebCore17HTMLCanvasElement11tagPriorityEv
-__ZN7WebCore19InspectorController28updateScriptResourceResponseEPNS_17InspectorResourceE
-__ZN7WebCore19InspectorController20updateScriptResourceEPNS_17InspectorResourceEi
-__ZN7WebCore19InspectorController20updateScriptResourceEPNS_17InspectorResourceEddd
-__ZN7WebCore19InspectorController20updateScriptResourceEPNS_17InspectorResourceEbb
-__ZN7WebCore26JSCanvasRenderingContext2DD0Ev
-__ZN7WebCore16JSCanvasGradientD0Ev
-__ZN7WebCore14CanvasGradientD1Ev
-__ZN3WTF6VectorIN7WebCore14CanvasGradient9ColorStopELm0EE6shrinkEm
-__ZN7WebCore17HTMLCanvasElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore16RenderHTMLCanvasC1EPNS_17HTMLCanvasElementE
-__ZN7WebCore12RenderObject16paintBorderImageEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleE
-__ZN7WebCore15GraphicsContext14drawTiledImageEPNS_5ImageERKNS_7IntRectES5_NS1_8TileRuleES6_NS_17CompositeOperatorE
-__ZN7WebCore10TransitionD1Ev
-__ZSt5mergeIPN7WebCore14CanvasGradient9ColorStopES3_S3_PFbRKS2_S5_EET1_T_S9_T0_SA_S8_T2_
-__ZN7WebCore53jsCanvasRenderingContext2DPrototypeFunctionStrokeRectEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore26JSCanvasRenderingContext2D10strokeRectEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore24CanvasRenderingContext2D10strokeRectEffffRi
-__ZN7WebCore24CanvasRenderingContext2D10strokeRectEfffffRi
-__ZN7WebCore15GraphicsContext10strokeRectERKNS_9FloatRectEf
-__ZN7WebCore19InspectorController11showConsoleEv
-__ZNK7WebCore19HTMLTextAreaElement19isKeyboardFocusableEPNS_13KeyboardEventE
-__ZN7WebCore18columnResizeCursorEv
-__ZN7WebCore23getResourceDocumentNodeEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore36jsNodePrototypeFunctionHasAttributesEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore7Element13hasAttributesEv
-__ZN7WebCore8Document18focusedNodeRemovedEv
-__ZN7WebCore16addSourceToFrameEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZNK7WebCore21HTMLFrameOwnerElement19isFrameOwnerElementEv
-__ZN7WebCore11FrameLoader19setResponseMIMETypeERKNS_6StringE
-__ZN7WebCore11FrameLoader5beginEv
-__ZN7WebCore22HTMLViewSourceDocumentC1EPNS_17DOMImplementationEPNS_5FrameERKNS_6StringE
-__ZN7WebCore22HTMLViewSourceDocument15createTokenizerEv
-__ZN7WebCore13HTMLTokenizerC1EPNS_22HTMLViewSourceDocumentE
-__ZN7WebCore22HTMLViewSourceDocument18addViewSourceTokenEPNS_5TokenE
-__ZN7WebCore22HTMLViewSourceDocument21createContainingTableEv
-__ZN7WebCore16applyCounterListEPNS_11RenderStyleEPNS_12CSSValueListEb
+__ZNK7WebCore11RenderImage13isRenderImageEv
+__ZN7WebCore25AccessibilityImageMapLink6createEv
+__ZN7WebCore25AccessibilityImageMapLinkC1Ev
+__ZN7WebCore25AccessibilityImageMapLinkC2Ev
+__ZNK7WebCore25AccessibilityImageMapLink6isLinkEv
+__ZNK7WebCore25AccessibilityImageMapLink9roleValueEv
+__ZN7WebCore10AXLinkTextEv
+__ZN7WebCore19AccessibilityObject8childrenEv
+__ZNK7WebCore19AccessibilityObject6widgetEv
+__ZNK7WebCore25AccessibilityImageMapLink12parentObjectEv
+__ZNK7WebCore25AccessibilityImageMapLink5titleEv
+__ZNK7WebCore25AccessibilityImageMapLink4sizeEv
+__ZNK7WebCore25AccessibilityImageMapLink11elementRectEv
+__ZNK7WebCore15HTMLAreaElement7getRectEPNS_12RenderObjectE
+__ZN7WebCore4Path9translateERKNS_9FloatSizeE
+__ZNK7WebCore25AccessibilityImageMapLink24accessibilityDescriptionEv
+__ZNK7WebCore25AccessibilityImageMapLink9isEnabledEv
+__ZNK7WebCore25AccessibilityImageMapLink3urlEv
+__ZNK7WebCore15HTMLAreaElement4hrefEv
+__ZNK7WebCore19AccessibilityObject9accessKeyEv
+__ZN3WTF7HashMapIjNS_6RefPtrIN7WebCore19AccessibilityObjectEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE4takeERKj
+__ZN7WebCore25AccessibilityImageMapLinkD0Ev
+__ZN7WebCoreL15labelForElementEPNS_7ElementE
+__ZNK7WebCore25AccessibilityRenderObject16textUnderElementEv
+__ZNK7WebCore16HTMLInputElement3srcEv
+__ZN7WebCore9RenderBox17addFocusRingRectsEPNS_15GraphicsContextEii
+__ZN7WebCore12RenderInline25rectWithOutlineForRepaintEPNS_20RenderBoxModelObjectEi
+__ZN7WebCore12RenderObject25rectWithOutlineForRepaintEPNS_20RenderBoxModelObjectEi
+__ZNK7WebCore25AccessibilityRenderObject19internalLinkElementEv
+__ZN7WebCore4KURL9removeRefEv
+__ZNK7WebCore25AccessibilityRenderObject6isMenuEv
+__ZNK7WebCore25AccessibilityRenderObject9isMenuBarEv
+__ZNK7WebCore25AccessibilityRenderObject12isMenuButtonEv
+__ZNK7WebCore25AccessibilityRenderObject10isMenuItemEv
+__ZN7WebCore13AXHeadingTextEv
+__ZNK7WebCore25AccessibilityRenderObject8intValueEv
+__ZN7WebCore10RenderText13absoluteQuadsERN3WTF6VectorINS_9FloatQuadELm0EEE
+__ZN7WebCore14RenderFieldset22paintBorderMinusLegendEPNS_15GraphicsContextEiiiiPKNS_11RenderStyleEiii
+__ZN7WebCore17AccessibilityList6createEPNS_12RenderObjectE
+__ZN7WebCore17AccessibilityListC1EPNS_12RenderObjectE
+__ZN7WebCore17AccessibilityListC2EPNS_12RenderObjectE
+__ZNK7WebCore17AccessibilityList22accessibilityIsIgnoredEv
+__ZNK7WebCore17AccessibilityList9roleValueEv
+__ZNK7WebCore17AccessibilityList6isListEv
+__ZNK7WebCore17AccessibilityList15isUnorderedListEv
+__ZNK7WebCore17AccessibilityList13isOrderedListEv
+__ZNK7WebCore17AccessibilityList16isDefinitionListEv
+__ZN7WebCore24AXDefinitionListTermTextEv
+__ZN7WebCore30AXDefinitionListDefinitionTextEv
+__ZN7WebCore17AccessibilityListD0Ev
+__ZN7WebCore8FileListC1Ev
+__ZN7WebCore8FileListC2Ev
+__ZN7WebCore23RenderFileUploadControlC1EPNS_16HTMLInputElementE
+__ZN7WebCore23RenderFileUploadControlC2EPNS_16HTMLInputElementE
+__ZN7WebCore11FileChooser6createEPNS_17FileChooserClientERKNS_6StringE
+__ZN7WebCore11FileChooser10chooseIconERKNS_6StringE
+__ZN7WebCore4Icon17createIconForFileERKNS_6StringE
+__ZN7WebCore23RenderFileUploadControl14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore23RenderFileUploadControl17updateFromElementEv
+__ZN7WebCore32HTMLFileUploadInnerButtonElementC1EPNS_8DocumentEPNS_4NodeE
+__ZN7WebCore32HTMLFileUploadInnerButtonElementC2EPNS_8DocumentEPNS_4NodeE
+__ZN7WebCore25fileButtonChooseFileLabelEv
+__ZNK7WebCore23RenderFileUploadControl17createButtonStyleEPKNS_11RenderStyleE
+__ZN7WebCore16HTMLInputElement5filesEv
+__ZN7WebCore11FileChooser5clearEv
+__ZN7WebCore23RenderFileUploadControl14calcPrefWidthsEv
+__ZN7WebCore23RenderFileUploadControl11paintObjectERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore23RenderFileUploadControl16maxFilenameWidthEv
+__ZNK7WebCore11FileChooser16basenameForWidthERKNS_4FontEi
+__ZN7WebCore29fileButtonNoFileSelectedLabelEv
+__ZN7WebCore23RenderFileUploadControlD0Ev
+__ZN7WebCore11FileChooserD1Ev
+__ZN7WebCore11FileChooserD2Ev
+__ZThn8_N7WebCore32HTMLFileUploadInnerButtonElementD0Ev
+__ZN7WebCore32HTMLFileUploadInnerButtonElementD0Ev
+__ZN7WebCore16HTMLInputElementD2Ev
+__ZN7WebCore17FileChooserClientD2Ev
+__ZL35textMarkerRangeFromVisiblePositionsN7WebCore15VisiblePositionES0_
+__ZNK7WebCore25AccessibilityRenderObject10textLengthEv
+__ZNK7WebCore25AccessibilityRenderObject12selectedTextEv
+__ZNK7WebCore25AccessibilityRenderObject17selectedTextRangeEv
+__ZNK7WebCore19AccessibilityObject12selectionEndEv
+__ZNK7WebCore19AccessibilityObject14selectionStartEv
+__ZNK7WebCore25AccessibilityRenderObject23visiblePositionForIndexEjb
+__ZNK7WebCore25AccessibilityRenderObject23visiblePositionForIndexEi
+__ZNK7WebCore19AccessibilityObject15lineForPositionERKNS_15VisiblePositionE
+__ZN7WebCore13IdentifierRep7isValidEPS0_
+__ZNK3WTF9HashTableIPN7WebCore13IdentifierRepES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8contain
+__ZNK7WebCore25AccessibilityRenderObject19checkboxOrRadioRectEv
+__ZN7WebCore12RenderInline13absoluteQuadsERN3WTF6VectorINS_9FloatQuadELm0EEE
+__ZNK7WebCore25AccessibilityRenderObject26addRadioButtonGroupMembersERN3WTF6VectorINS1_6RefPtrINS_19AccessibilityObjectEEELm0EE
+__ZN7WebCore8Document35setUseSecureKeyboardEntryWhenActiveEb
+__ZN7WebCore5Frame33updateSecureKeyboardEntryIfActiveEv
+__ZN7WebCore21PlatformKeyboardEvent20currentCapsLockStateEv
+__ZN7WebCore18AccessibilityTable6createEPNS_12RenderObjectE
+__ZN7WebCore18AccessibilityTableC1EPNS_12RenderObjectE
+__ZNK7WebCore16HTMLTableElement7summaryEv
+__ZN7WebCore18AccessibilityTable11addChildrenEv
+__ZN7WebCore21AccessibilityTableRow6createEPNS_12RenderObjectE
+__ZN7WebCore21AccessibilityTableRowC1EPNS_12RenderObjectE
+__ZNK7WebCore21AccessibilityTableRow11parentTableEv
+__ZNK7WebCore18AccessibilityTable11isAriaTableEv
+__ZN7WebCore24AccessibilityTableColumn22headerObjectForSectionEPNS_18RenderTableSectionEb
+__ZN7WebCore22AccessibilityTableCell6createEPNS_12RenderObjectE
+__ZN7WebCore22AccessibilityTableCellC1EPNS_12RenderObjectE
+__ZNK7WebCore22AccessibilityTableCell11parentTableEv
+__ZN7WebCore22AccessibilityTableCell13rowIndexRangeERSt4pairIiiE
+__ZN7WebCore22AccessibilityTableCell16columnIndexRangeERSt4pairIiiE
+__ZN7WebCore21AccessibilityTableRow12headerObjectEv
+__ZN7WebCore18AccessibilityTable19cellForColumnAndRowEjj
+__ZN7WebCore22AccessibilityTableCellD0Ev
+__ZN7WebCore21AccessibilityTableRowD0Ev
+__ZN7WebCore18AccessibilityTableD0Ev
+__ZNK7WebCore16HTMLTableElement5tFootEv
+__ZNK7WebCore16HTMLTableElement5rulesEv
+__ZNK7WebCore20HTMLTableCellElement7headersEv
+__ZNK7WebCore20HTMLTableCellElement4abbrEv
+__ZNK7WebCore20HTMLTableCellElement4axisEv
+__ZNK7WebCore20HTMLTableCellElement5scopeEv
+__ZN7WebCore23HTMLTableCaptionElementD0Ev
+__ZNK7WebCore22AccessibilityTableCell14titleUIElementEv
+__ZNK7WebCore25AccessibilityRenderObject17menuButtonForMenuEv
+__ZNK7WebCore25AccessibilityRenderObject22menuItemElementForMenuEv
+__ZN7WebCoreL19siblingWithAriaRoleENS_6StringEPNS_4NodeE
+__ZN7WebCore38setJSHTMLTextAreaElementSelectionStartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTextAreaElement17setSelectionStartEi
+__ZN7WebCore17RenderTextControl17setSelectionStartEi
+__ZN7WebCore36setJSHTMLTextAreaElementSelectionEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTextAreaElement15setSelectionEndEi
+__ZN7WebCore17RenderTextControl15setSelectionEndEi
+__ZN7WebCore20previousLinePositionERKNS_15VisiblePositionEi
+__ZN7WebCoreL34enclosingNodeWithNonInlineRendererEPNS_4NodeE
+__ZN7WebCoreL31previousLeafWithSameEditabilityEPNS_4NodeE
+__ZN7WebCore35jsHTMLTextAreaElementSelectionStartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19HTMLTextAreaElement14selectionStartEv
+__ZN7WebCoreL14isEditableLeafEPNS_9InlineBoxE
+__ZN7WebCore19AccessibilityObject16doAXLineForIndexEj
+-[AccessibilityObjectWrapper accessibilitySetValue:forAttribute:]
+__ZN7WebCore25AccessibilityRenderObject20setSelectedTextRangeERKNS_14PlainTextRangeE
+__ZN7WebCore9CSSParser20parseTransformOriginEiRiS1_S1_RN3WTF6RefPtrINS_8CSSValueEEES6_S6_
+__ZN7WebCore9CSSParser29parseTransformOriginShorthandERN3WTF6RefPtrINS_8CSSValueEEES5_S5_
+__ZNK7WebCore24RotateTransformOperation16getOperationTypeEv
+__ZNK7WebCore14HTMLCollection8nextItemEv
+__ZNK7WebCore15PropertyWrapperINS_6LengthEE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS6_S9_d
+__ZNK7WebCore11RenderStyle4leftEv
+__ZN7WebCore11RenderStyle7setLeftENS_6LengthE
+__ZN7WebCore18CompositeAnimation16resumeAnimationsEv
+__ZN7WebCore13AnimationBase16getNumPropertiesEv
+__ZNK7WebCore18CompositeAnimation23getAnimationForPropertyEi
+__ZNK7WebCore17KeyframeAnimation23hasAnimationForPropertyEi
+__ZNK3WTF7HashMapIiNS_6RefPtrIN7WebCore17ImplicitAnimationEEENS_7IntHashIjEENS_10HashTraitsIiEENS7_IS4_EEE3getERKi
+__ZN7WebCore13AnimationBase15propertiesEqualEiPKNS_11RenderStyleES3_
+__ZNK7WebCore21PropertyWrapperGetterINS_6LengthEE6equalsEPKNS_11RenderStyleES5_
+__ZNK7WebCore11RenderStyle3topEv
+__ZN7WebCore17ImplicitAnimationC1EPKNS_9AnimationEiPNS_12RenderObjectEPNS_18CompositeAnimationEPNS_11RenderStyleE
+__ZN7WebCore17ImplicitAnimationC2EPKNS_9AnimationEiPNS_12RenderObjectEPNS_18CompositeAnimationEPNS_11RenderStyleE
+__ZN3WTF7HashMapIiNS_6RefPtrIN7WebCore17ImplicitAnimationEEENS_7IntHashIjEENS_10HashTraitsIiEENS7_IS4_EEE3setERKiRKS4_
+__ZNK7WebCore11RenderStyle5widthEv
+__ZN7WebCore17ImplicitAnimation7animateEPNS_18CompositeAnimationEPNS_12RenderObjectEPKNS_11RenderStyleEPS5_RN3WTF6RefPtrIS5_EE
+__ZN7WebCore17ImplicitAnimation5resetEPNS_11RenderStyleE
+__ZN7WebCore17ImplicitAnimation12endAnimationEb
+__ZN7WebCore17ImplicitAnimation29validateTransformFunctionListEv
+__ZN7WebCore11RenderStyle8setWidthENS_6LengthE
+__ZN7WebCore11RenderStyle6setTopENS_6LengthE
+__ZN7WebCore17ImplicitAnimation17timeToNextServiceEv
+__ZN7WebCore13AnimationBase18overrideAnimationsEv
+__ZN7WebCore13AnimationBase16onAnimationStartEd
+__ZNK7WebCore17ImplicitAnimation10overriddenEv
+__ZN7WebCore17ImplicitAnimation14startAnimationEd
+__ZN7WebCore17ImplicitAnimation21isTargetPropertyEqualEiPKNS_11RenderStyleE
+__ZNK7WebCore19AnimationController24numberOfActiveAnimationsEv
+__ZNK7WebCore26AnimationControllerPrivate24numberOfActiveAnimationsEv
+__ZNK7WebCore18CompositeAnimation24numberOfActiveAnimationsEv
+__ZNK7WebCore11RenderStyle6heightEv
+__ZN7WebCore11RenderStyle9setHeightENS_6LengthE
+__ZN7WebCore17ImplicitAnimationD0Ev
+__ZN7WebCore29jsDOMWindowCSSRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSCSSRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSCSSRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30jsCSSRuleWEBKIT_KEYFRAMES_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsCSSRuleWEBKIT_KEYFRAME_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19AnimationController20pauseAnimationAtTimeEPNS_12RenderObjectERKNS_6StringEd
+__ZN7WebCore26AnimationControllerPrivate20pauseAnimationAtTimeEPNS_12RenderObjectERKNS_6StringEd
+__ZN7WebCore18CompositeAnimation20pauseAnimationAtTimeERKNS_12AtomicStringEd
+__ZNK7WebCore13AnimationBase8durationEv
+__ZN7WebCore13AnimationBase11pauseAtTimeEd
+__ZN7WebCore13AnimationBase15updatePlayStateEb
+__ZN7WebCore22externalRepresentationEPNS_12RenderObjectE
+__ZN7WebCore20writeRenderResourcesERNS_10TextStreamEPNS_4NodeE
+__ZN7WebCoreL11writeLayersERNS_10TextStreamEPKNS_11RenderLayerEPS2_RKNS_7IntRectEi
+__ZN7WebCoreL5writeERNS_10TextStreamERNS_11RenderLayerERKNS_7IntRectES6_S6_S6_ii
+__ZN7WebCoreL11writeIndentERNS_10TextStreamEi
+__ZN7WebCore10TextStreamlsEPKc
+__ZN7WebCorelsERNS_10TextStreamERKNS_7IntRectE
+__ZN7WebCore10TextStreamlsEi
+__ZNK7WebCore7IntRect8containsERKS0_
+__ZN7WebCore5writeERNS_10TextStreamERKNS_12RenderObjectEi
+__ZNK7WebCore12RenderObject12isRenderPathEv
+__ZNK7WebCore12RenderObject10isSVGImageEv
+__ZNK7WebCore10RenderView10renderNameEv
+__ZN7WebCoreL10getTagNameEPNS_4NodeE
+__ZNK7WebCore11RenderBlock10renderNameEv
+__ZN7WebCore10TextStreamlsERKNS_6StringE
+__ZNK7WebCore10RenderText10renderNameEv
+__ZNK7WebCore10RenderText9firstRunYEv
+__ZNK7WebCore10RenderText9firstRunXEv
+__ZN7WebCore27quoteAndEscapeNonPrintablesERKNS_6StringE
+__ZNK7WebCore5Color4nameEv
+__ZN7WebCore10TextStream7releaseEv
+__ZN7WebCore20JSCSSRuleConstructorD1Ev
+__ZN7WebCore27TranslateTransformOperation5blendEPKNS_18TransformOperationEdb
+__ZN7WebCore12GCController17garbageCollectNowEv
+__ZN7WebCore20WebKitAnimationEventC1Ev
+__ZN7WebCore20WebKitAnimationEventC2Ev
+__ZN7WebCore33jsWebKitAnimationEventElapsedTimeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20WebKitAnimationEvent11elapsedTimeEv
+__ZN7WebCore10MouseEventC1Ev
+__ZN7WebCore10MouseEventC2Ev
+__ZN7WebCore17MouseRelatedEventC2Ev
+__ZN7WebCore7UIEventC2Ev
+__ZN7WebCore43jsDocumentPrototypeFunctionElementFromPointEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore11RenderLayer25createLocalTransformStateEPS0_S1_RKNS_7IntRectERKNS_8IntPointEPKNS_24HitTestingTransformStateE
+__ZN7WebCore24HitTestingTransformState14applyTransformERKNS_20TransformationMatrixENS0_21TransformAccumulationE
+__ZNK7WebCore24HitTestingTransformState11mappedPointEv
+__ZNK7WebCore20TransformationMatrix12projectPointERKNS_10FloatPointE
+__ZNK7WebCore24HitTestingTransformState10mappedQuadEv
+__ZNK7WebCore20TransformationMatrix11projectQuadERKNS_9FloatQuadE
+__ZN7WebCore24HitTestingTransformState7flattenEv
+__ZN7WebCore24HitTestingTransformState20flattenWithTransformERKNS_20TransformationMatrixE
+__ZN7WebCore9CSSParser28parseAnimationIterationCountEv
+__ZN7WebCore16CSSStyleSelector26mapAnimationIterationCountEPNS_9AnimationEPNS_8CSSValueE
+__ZN7WebCore17KeyframeAnimation20onAnimationIterationEd
+__ZNK7WebCore24RotateTransformOperation10isSameTypeERKNS_18TransformOperationE
+__ZN7WebCore24RotateTransformOperation5blendEPKNS_18TransformOperationEdb
+__ZNK7WebCore24RotateTransformOperationeqERKNS_18TransformOperationE
+__ZN7WebCore13jsCSSRuleTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsWebKitCSSKeyframesRuleNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24JSWebKitCSSKeyframesRule3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore31setJSWebKitCSSKeyframesRuleNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore22WebKitCSSKeyframesRule7setNameERKNS_6StringE
+__ZN7WebCore57jsCSSStyleDeclarationPrototypeFunctionGetPropertyCSSValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8CSSValueE
+__ZNK7WebCore8CSSValue25isWebKitCSSTransformValueEv
+__ZNK7WebCore8CSSValue10isSVGPaintEv
+__ZNK7WebCore8CSSValue10isSVGColorEv
+__ZN7WebCore19JSCSSPrimitiveValue15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSCSSValuePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSCSSValue15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSCSSPrimitiveValueC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17CSSPrimitiveValueEEE
+__ZN7WebCore19JSCSSPrimitiveValueC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17CSSPrimitiveValueEEE
+__ZN7WebCore10JSCSSValueC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8CSSValueEEE
+__ZN7WebCore19JSCSSPrimitiveValue18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore10JSCSSValue18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28JSCSSPrimitiveValuePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsDOMWindowCSSPrimitiveValueConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSCSSPrimitiveValue14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSCSSPrimitiveValueConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore28JSCSSPrimitiveValuePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSCSSPrimitiveValueConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29jsCSSPrimitiveValueCSS_NUMBEREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore49jsCSSPrimitiveValuePrototypeFunctionGetFloatValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore19JSCSSPrimitiveValue9classInfoEv
+__ZN7WebCore19JSCSSPrimitiveValueD1Ev
+__ZN7WebCore10JSCSSValueD2Ev
+__ZN7WebCore19JSCSSValuePrototypeD1Ev
+__ZN7WebCore28JSCSSPrimitiveValuePrototypeD1Ev
+__ZN7WebCore30JSCSSPrimitiveValueConstructorD1Ev
+__ZN7WebCore33JSWebKitCSSKeyframesRulePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore51jsWebKitCSSKeyframesRulePrototypeFunctionDeleteRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore24JSWebKitCSSKeyframesRule9classInfoEv
+__ZN7WebCore22WebKitCSSKeyframesRule10deleteRuleERKNS_6StringE
+__ZNK7WebCore22WebKitCSSKeyframesRule13findRuleIndexERKNS_6StringE
+__ZN7WebCore11CSSRuleList10deleteRuleEj
+__ZN7WebCore51jsWebKitCSSKeyframesRulePrototypeFunctionInsertRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore22WebKitCSSKeyframesRule10insertRuleERKNS_6StringE
+__ZN7WebCore9CSSParser17parseKeyframeRuleEPNS_13CSSStyleSheetERKNS_6StringE
+__ZN7WebCore9CSSParser23parseAnimationDirectionEv
+__ZN7WebCore16CSSStyleSelector21mapAnimationDirectionEPNS_9AnimationEPNS_8CSSValueE
+__ZN7WebCore37jsDOMWindowWebKitCSSMatrixConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow15webKitCSSMatrixEPN3JSC9ExecStateE
+__ZN7WebCore28JSWebKitCSSMatrixConstructorC1EPN3JSC9ExecStateE
+__ZN7WebCore28JSWebKitCSSMatrixConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore26JSWebKitCSSMatrixPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSWebKitCSSMatrix15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSWebKitCSSMatrixConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCoreL24constructWebKitCSSMatrixEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZN7WebCore15WebKitCSSMatrixC1ERKNS_6StringERi
+__ZN7WebCore15WebKitCSSMatrixC2ERKNS_6StringERi
+__ZN7WebCore15WebKitCSSMatrix14setMatrixValueERKNS_6StringERi
+__ZNK7WebCore24MatrixTransformOperation5applyERNS_20TransformationMatrixERKNS_7IntSizeE
+__ZN7WebCore24MatrixTransformOperationD0Ev
+__ZN7WebCore17JSWebKitCSSMatrixC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15WebKitCSSMatrixEEE
+__ZN7WebCore17JSWebKitCSSMatrixC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15WebKitCSSMatrixEEE
+__ZN7WebCore17JSWebKitCSSMatrix18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18jsWebKitCSSMatrixAEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsWebKitCSSMatrixBEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsWebKitCSSMatrixCEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsWebKitCSSMatrixDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsWebKitCSSMatrixEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsWebKitCSSMatrixFEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL16getDurationValueEPKNS_13AnimationListE
+__ZN7WebCoreL22getTimingFunctionValueEPKNS_13AnimationListE
+__ZNK7WebCore22CSSTimingFunctionValue7cssTextEv
+__ZN7WebCore22CSSTimingFunctionValueD0Ev
+__ZN7WebCore17JSWebKitCSSMatrixD1Ev
+__ZN7WebCore17JSWebKitCSSMatrixD2Ev
+__ZN7WebCore15WebKitCSSMatrixD0Ev
+__ZN7WebCore26JSWebKitCSSMatrixPrototypeD1Ev
+__ZN7WebCore28JSWebKitCSSMatrixConstructorD1Ev
+__ZN7WebCoreL13getDelayValueEPKNS_13AnimationListE
+__ZN7WebCore43jsDOMWindowWebKitCSSKeyframeRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSWebKitCSSKeyframeRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore32JSWebKitCSSKeyframeRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSWebKitCSSKeyframeRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore44jsDOMWindowWebKitCSSKeyframesRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24JSWebKitCSSKeyframesRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore33JSWebKitCSSKeyframesRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore37jsStyleSheetListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSStyleSheetList9classInfoEv
+__ZN7WebCore34jsCSSRuleListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore13JSCSSRuleList9classInfoEv
+__ZN7WebCore32jsWebKitCSSKeyframesRuleCssRulesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21WebKitCSSKeyframeRule4typeEv
+__ZN7WebCore23JSWebKitCSSKeyframeRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21WebKitCSSKeyframeRuleEEE
+__ZN7WebCore23JSWebKitCSSKeyframeRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21WebKitCSSKeyframeRuleEEE
+__ZN7WebCore23JSWebKitCSSKeyframeRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30jsWebKitCSSKeyframeRuleKeyTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsWebKitCSSKeyframeRuleStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsDOMWindowCSSStyleDeclarationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSCSSStyleDeclaration14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSCSSStyleDeclarationPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27jsCSSStyleDeclarationLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore49jsWebKitCSSKeyframesRulePrototypeFunctionFindRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore22WebKitCSSKeyframesRule8findRuleERKNS_6StringE
+__ZN7WebCore22WebKitCSSKeyframesRule4itemEj
+__ZN7WebCore23JSWebKitCSSKeyframeRuleD1Ev
+__ZN7WebCore35JSWebKitCSSKeyframesRuleConstructorD1Ev
+__ZN7WebCore32JSWebKitCSSKeyframeRulePrototypeD1Ev
+__ZN7WebCore34JSWebKitCSSKeyframeRuleConstructorD1Ev
+__ZN7WebCore32JSCSSStyleDeclarationConstructorD1Ev
+__ZNK7WebCore11RenderStyle10lineHeightEv
+__ZN7WebCore11RenderStyle13setLineHeightENS_6LengthE
+__ZNK7WebCore24MatrixTransformOperation10isSameTypeERKNS_18TransformOperationE
+__ZNK7WebCore24MatrixTransformOperation16getOperationTypeEv
+__ZN7WebCore24MatrixTransformOperation5blendEPKNS_18TransformOperationEdb
+__ZNK7WebCore24MatrixTransformOperationeqERKNS_18TransformOperationE
+__ZNK7WebCore21PropertyWrapperGetterIRKNS_19TransformOperationsEE6equalsEPKNS_11RenderStyleES7_
+__ZN7WebCore17ImplicitAnimation13setOverriddenEb
+__ZN7WebCoreL16printBorderStyleERNS_10TextStreamENS_12EBorderStyleE
+__ZNK7WebCore14RenderListItem10renderNameEv
+__ZNK7WebCore16RenderListMarker10renderNameEv
+__ZNK7WebCore11RenderTable10renderNameEv
+__ZNK7WebCore18RenderTableSection10renderNameEv
+__ZNK7WebCore14RenderTableRow10renderNameEv
+__ZNK7WebCore15RenderTableCell10renderNameEv
+__ZNK7WebCore12RenderInline10renderNameEv
+__ZNK7WebCore11RenderImage10renderNameEv
+__ZNK7WebCore8RenderBR10renderNameEv
+__ZNK7WebCore12RenderObject16isBoxModelObjectEv
+__ZN7WebCoreL12toAlphabeticEiPKti
+__ZN7WebCoreL7toRomanEib
+__ZN7WebCore11CSSSelector11setArgumentERKNS_12AtomicStringE
+__ZNK7WebCore14SimpleFontData17smallCapsFontDataERKNS_15FontDescriptionE
+__ZN7WebCore16FontPlatformData7setFontEP6NSFont
+__ZN7WebCore18RenderTextFragmentC1EPNS_4NodeEPNS_10StringImplEii
+__ZN7WebCore18RenderTextFragmentC2EPNS_4NodeEPNS_10StringImplEii
+__ZNK7WebCore12RenderObject22firstLineStyleSlowCaseEv
+__ZNK7WebCore11RenderBlock14firstLineBlockEv
+__ZN7WebCore15RenderScrollbar24scrollbarForStyleResolveEv
+__ZNK7WebCore17HTMLObjectElement24imageSourceAttributeNameEv
+__ZN7WebCore9CSSParser12parseCounterEiib
+__ZN7WebCore9CSSParser19parseCounterContentEPNS_18CSSParserValueListEb
+__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_7CounterEEE
+__ZN7WebCoreL16applyCounterListEPNS_11RenderStyleEPNS_12CSSValueListEb
 __ZN7WebCore11RenderStyle23accessCounterDirectivesEv
-__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEENS2_17CounterDirectivesENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS5_EEE3getEPS3_
-__ZN3WTF9HashTableIiSt4pairIiN7WebCore17CounterDirectivesEENS_18PairFirstExtractorIS4_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E3addINS_6RefPtrINS2_16AtomicStringImplEEES3_NS_17HashMapTranslatorILb0ES1_ISI_S3_ENS_18PairBaseHashTraitsINSA_ISI_EESC_EESD_NS_7PtrHashISI_EEEEEES1_INS_17HashTableIteratorIiS4_S6_S8_SD_SB_EEbERKT_RKT0_
-__ZN3WTF9HashTableIiSt4pairIiN7WebCore17CounterDirectivesEENS_18PairFirstExtractorIS4_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E6expandEv
-__ZN7WebCore22HTMLViewSourceDocument20addSpanWithClassNameERKNS_6StringE
-__ZN7WebCore22HTMLViewSourceDocument7addLineERKNS_6StringE
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEENS2_17CounterDirectivesENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS5
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore16AtomicStringImplEEESt4pairIS4_NS2_17CounterDirectivesEENS_18PairFirstExtractorIS7_EENS
 __ZN7WebCore11RenderStyle10setContentEPNS_14CounterContentEb
 __ZN7WebCore13RenderCounterC1EPNS_8DocumentERKNS_14CounterContentE
-__ZN7WebCore22HTMLViewSourceDocument7addTextERKNS_6StringES3_
-__ZN7WebCore22HTMLViewSourceDocument7addLinkERKNS_6StringEb
-__ZN7WebCore17HTMLAnchorElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN3WTFeqINS_6RefPtrIN7WebCore16AtomicStringImplEEENS2_17CounterDirectivesENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS5_EEEEbRKNS_7HashMapIT_T0_T1_T2_T3_EESJ_
-__ZNK3WTF9HashTableIiSt4pairIiN7WebCore17CounterDirectivesEENS_18PairFirstExtractorIS4_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E4findIiNS_22IdentityHashTranslatorIiS4_S8_EEEENS_22HashTableConstIteratorIiS4_S6_S8_SD_SB_EERKT_
-__ZN7WebCoreeqERKNS_17CounterDirectivesES2_
-__ZN3WTF23HashTableRefCounterBaseILb1ENS_9HashTableIiSt4pairIiN7WebCore17CounterDirectivesEENS_18PairFirstExtractorIS5_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSB_IS4_EEEESC_EENS_18PairBaseHashTraitsINSB_INS_6RefPtrINS3_16AtomicStringImplEEEEESD_EEE8derefAllERSF_
+__ZN7WebCore13RenderCounterC2EPNS_8DocumentERKNS_14CounterContentE
+__ZNK7WebCore13RenderCounter9isCounterEv
 __ZN7WebCore13RenderCounter14calcPrefWidthsEi
 __ZNK7WebCore13RenderCounter12originalTextEv
-__ZN7WebCore7counterEPNS_12RenderObjectERKNS_12AtomicStringEb
+__ZN7WebCoreL7counterEPNS_12RenderObjectERKNS_12AtomicStringEb
 __ZNK7WebCore11RenderStyle17counterDirectivesEv
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEENS2_17CounterDirectivesENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS
 __ZN7WebCore11CounterNodeC1EPNS_12RenderObjectEbi
-__ZN7WebCore11counterMapsEv
+__ZN7WebCore11CounterNodeC2EPNS_12RenderObjectEbi
+__ZN7WebCoreL11counterMapsEv
+__ZN3WTF7HashMapIPKN7WebCore12RenderObjectEPNS0_INS_6RefPtrINS1_16AtomicStringImplEEEPNS1_11CounterNodeENS_7PtrHashIS7_EENS_10H
+__ZN3WTF9HashTableIPKN7WebCore12RenderObjectESt4pairIS4_PNS_7HashMapINS_6RefPtrINS1_16AtomicStringImplEEEPNS1_11CounterNodeENS_
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEEPNS2_11CounterNodeENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore16AtomicStringImplEEESt4pairIS4_PNS2_11CounterNodeEENS_18PairFirstExtractorIS8_EENS_7Ptr
 __ZN7WebCore11CounterNode11insertAfterEPS0_S1_
 __ZNK7WebCore11CounterNode20computeCountInParentEv
-__ZN3WTF7HashMapIPKN7WebCore12RenderObjectEPNS0_INS_6RefPtrINS1_16AtomicStringImplEEEPNS1_11CounterNodeENS_7PtrHashIS7_EENS_10HashTraitsIS7_EENSC_IS9_EEEENSA_IS4_EENSC_IS4_EENSC_ISG_EEE3setERKS4_RKSG_
-__ZN3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEEPNS2_11CounterNodeENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3setEPS3_RKS6_
-__ZN7WebCore13RenderCounter14dirtyLineBoxesEbb
-__ZNK7WebCore19CachedCSSStyleSheet8encodingEv
-__ZN7WebCore13TextTokenizerC1EPNS_22HTMLViewSourceDocumentE
-__ZN7WebCore22HTMLViewSourceDocument17addViewSourceTextERKNS_6StringE
-__ZNK7WebCore14RenderReplaced21minimumReplacedHeightEv
-__ZN7WebCore13RootInlineBox15clearTruncationEv
-__ZN7WebCore13InlineFlowBox15clearTruncationEv
-__ZN7WebCore13InlineTextBox15clearTruncationEv
-__ZN7WebCore16RenderHTMLCanvas13paintReplacedERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore17HTMLCanvasElement5paintEPNS_15GraphicsContextERKNS_7IntRectE
-__ZNK7WebCore17HTMLCanvasElement19createPlatformImageEv
-__ZN7WebCore11EllipsisBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
-__ZNK7WebCore16HTMLImageElement12naturalWidthEv
-__ZNK3WTF7HashMapIPKN7WebCore14RenderReplacedENS1_7IntRectENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS5_EEE3getERKS4_
-__ZN3WTF9HashTableIiSt4pairIiN7WebCore7IntRectEENS_18PairFirstExtractorIS4_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E3addIPKNS2_14RenderReplacedES3_NS_17HashMapTranslatorILb1ES1_ISI_S3_ENS_18PairBaseHashTraitsINSA_ISI_EESC_EESD_NS_7PtrHashISI_EEEEEES1_INS_17HashTableIteratorIiS4_S6_S8_SD_SB_EEbERKT_RKT0_
-__ZN3WTF9HashTableIiSt4pairIiN7WebCore7IntRectEENS_18PairFirstExtractorIS4_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E47removeAndInvalidateWithoutEntryConsistencyCheckEPS4_
-__ZN3WTF9HashTableIiSt4pairIiN7WebCore7IntRectEENS_18PairFirstExtractorIS4_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSA_IS3_EEEESB_E4findIiNS_22IdentityHashTranslatorIiS4_S8_EEEENS_17HashTableIteratorIiS4_S6_S8_SD_SB_EERKT_
-__ZN7WebCore15GraphicsContext7clipOutERKNS_7IntRectE
-__ZN7WebCore17isStartOfDocumentERKNS_15VisiblePositionE
-__ZN7WebCore6attachEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController12attachWindowEv
+__ZNK3WTF7HashMapIPKN7WebCore12RenderObjectEPNS0_INS_6RefPtrINS1_16AtomicStringImplEEEPNS1_11CounterNodeENS_7PtrHashIS7_EENS_10
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore16AtomicStringImplEEEPNS2_11CounterNodeENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE
+__ZNK7WebCore13RenderCounter10renderNameEv
+__ZN7WebCore13RenderCounterD0Ev
 __ZN7WebCore13RenderCounter19destroyCounterNodesEPNS_12RenderObjectE
 __ZN7WebCore11CounterNode11removeChildEPS0_
 __ZN7WebCore11CounterNode7recountEv
-__ZNK7WebCore12RenderObject9isCounterEv
-__ZN7WebCore22HTMLViewSourceDocumentD1Ev
-__ZNK7WebCore15BackgroundLayer13containsImageEPNS_11CachedImageE
-__ZN7WebCore6detachEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController12detachWindowEv
-__ZN7WebCore23JSDOMSelectionPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore47jsDOMSelectionPrototypeFunctionSetBaseAndExtentEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore14JSDOMSelection9classInfoEv
-__ZN7WebCore12DOMSelection16setBaseAndExtentEPNS_4NodeEiS2_iRi
-__ZN7WebCore19SelectionController6moveToERKNS_15VisiblePositionES3_b
-__ZN7WebCore6Editor18shouldBeginEditingEPNS_5RangeE
-__ZN7WebCore6Editor15didBeginEditingEv
-__ZNK7WebCore6Editor25shouldShowDeleteInterfaceEPNS_11HTMLElementE
-__ZN7WebCore15rowResizeCursorEv
-__ZN7WebCore6Editor15insertLineBreakEv
-__ZN7WebCore13TypingCommand15insertLineBreakEPNS_8DocumentE
-__ZN7WebCore13TypingCommand15insertLineBreakEv
-__ZN7WebCore22InsertLineBreakCommandC2EPNS_8DocumentE
-__ZN7WebCore22InsertLineBreakCommand7doApplyEv
-__ZN7WebCore20CompositeEditCommand22positionOutsideTabSpanERKNS_8PositionE
-__ZN7WebCore22InsertLineBreakCommand21shouldUseBreakElementERKNS_8PositionE
-__ZN7WebCore14caretMinOffsetEPKNS_4NodeE
-__ZN7WebCore20CompositeEditCommand15insertNodeAfterEPNS_4NodeES2_
-__ZN7WebCore20CompositeEditCommand19rebalanceWhitespaceEv
-__ZNK7WebCore22InsertLineBreakCommand20preservesTypingStyleEv
-__ZN7WebCore6Editor16shouldEndEditingEPNS_5RangeE
-__ZN7WebCore6Editor13didEndEditingEv
-__ZN7WebCore20CompositeEditCommand23deleteInsignificantTextEPNS_4TextEii
-__ZN7WebCore12RenderObject27capsLockStateMayHaveChangedEv
-__ZN7WebCore15executeMoveLeftEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore19SelectionController24modifyMovingLeftBackwardENS_15TextGranularityE
-__ZN7WebCore19CSSBorderImageValueD1Ev
-__ZN7WebCore12RenderWidget17setSelectionStateENS_12RenderObject14SelectionStateE
-__ZN7WebCore6Widget13setIsSelectedEb
-__ZN7WebCore52jsCSSStyleDeclarationPrototypeFunctionRemovePropertyEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore19CSSStyleDeclaration14removePropertyERKNS_6StringERi
-__ZNK7WebCore6Widget1xEv
-__ZNK7WebCore6Widget1yEv
-__ZN7WebCore11ContextMenu21addInspectElementItemEv
-__ZN7WebCore32contextMenuItemTagInspectElementEv
-__ZN7WebCore19InspectorController7inspectEPNS_4NodeE
-__ZN7WebCore19InspectorController9focusNodeEv
-__ZN7WebCore16highlightDOMNodeEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZNK7WebCore15MappedAttribute5styleEv
-__ZN7WebCore46jsDOMWindowPrototypeFunctionGetMatchedCSSRulesEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9DOMWindow18getMatchedCSSRulesEPNS_7ElementERKNS_6StringEb
-__ZN7WebCore16CSSStyleSelector20styleRulesForElementEPNS_7ElementEb
-__ZN3KJS17staticValueGetterIN7WebCore13JSCSSRuleListEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore13JSCSSRuleList16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore21JSCSSStyleDeclaration11indexGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZNK7WebCore26CSSMutableStyleDeclaration4itemEj
-__ZNK7WebCore23DeprecatedValueListImpl6nodeAtEj
-__ZN7WebCore57jsCSSStyleDeclarationPrototypeFunctionGetPropertyPriorityEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore19CSSStyleDeclaration19getPropertyPriorityERKNS_6StringE
-__ZN7WebCore14JSCSSStyleRule3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore9JSCSSRule3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZNK7WebCore27CSSComputedStyleDeclaration6lengthEv
-__ZNK7WebCore27CSSComputedStyleDeclaration4itemEj
-__ZN7WebCore58jsCSSStyleDeclarationPrototypeFunctionGetPropertyShorthandEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore19CSSStyleDeclaration20getPropertyShorthandERKNS_6StringE
-__ZNK7WebCore27CSSComputedStyleDeclaration20getPropertyShorthandEi
-__ZNK7WebCore27CSSComputedStyleDeclaration19getPropertyPriorityEi
-__ZN7WebCore56jsCSSStyleDeclarationPrototypeFunctionIsPropertyImplicitEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore19CSSStyleDeclaration18isPropertyImplicitERKNS_6StringE
-__ZNK7WebCore27CSSComputedStyleDeclaration18isPropertyImplicitEi
-__ZN7WebCore26getBorderRadiusCornerValueENS_7IntSizeE
-__ZN7WebCore14valueForShadowEPKNS_10ShadowDataE
-__ZN7WebCore49jsCSSStyleDeclarationPrototypeFunctionSetPropertyEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EEC1ERKS3_
-__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_15DashboardRegionEEE
-__ZNK7WebCore27CSSComputedStyleDeclaration22getSVGPropertyCSSValueEiNS_13EUpdateLayoutE
-__ZNK7WebCore8SVGPaint7cssTextEv
-__ZNK7WebCore8SVGColor7cssTextEv
-__ZNK7WebCore5Color4nameEv
-__ZN7WebCore35glyphOrientationToCSSPrimitiveValueENS_17EGlyphOrientationE
-__ZNK7WebCore26CSSMutableStyleDeclaration20getPropertyShorthandEi
-__ZNK7WebCore26CSSMutableStyleDeclaration18isPropertyImplicitEi
-__ZNK7WebCore26CSSMutableStyleDeclaration10get4ValuesEPKi
-__ZNK7WebCore14JSCSSStyleRule9classInfoEv
-__ZNK7WebCore12CSSStyleRule12selectorTextEv
-__ZNK7WebCore11CSSSelector12selectorTextEv
-__ZN3KJS17staticValueGetterIN7WebCore9JSCSSRuleEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore9JSCSSRule16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore26CSSMutableStyleDeclaration17getShorthandValueEPKii
-__ZN7WebCore19InspectorController9highlightEPNS_4NodeE
--[DOMNode(DOMNodeExtensions) boundingBox]
--[DOMElement scrollIntoViewIfNeeded:]
-__ZN7WebCore7Element22scrollIntoViewIfNeededEb
-__ZN7WebCore15GraphicsContext18clipOutRoundedRectERKNS_7IntRectERKNS_7IntSizeES6_S6_S6_
-__ZN7WebCore15GraphicsContext7clipOutERKNS_4PathE
-__ZN7WebCore15GraphicsContext15fillRoundedRectERKNS_7IntRectERKNS_7IntSizeES6_S6_S6_RKNS_5ColorE
-__ZN7WebCore15GraphicsContext7addPathERKNS_4PathE
-__ZNK7WebCore11RenderLayer16enclosingElementEv
-__ZNK7WebCore26CSSMutableStyleDeclaration24getLayeredShorthandValueEPKij
-__ZNK7WebCore8CSSValue22isImplicitInitialValueEv
-__ZNK7WebCore15CSSInitialValue22isImplicitInitialValueEv
-__ZN7WebCore9InlineBox16placeEllipsisBoxEbiiRb
-__ZN7WebCore31jsConsolePrototypeFunctionErrorEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Console5errorERKNS_6StringE
-__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE15reserveCapacityEm
-__ZNK7WebCore29JSHTMLHeadingElementPrototype9classInfoEv
-__ZNK7WebCore22JSHTMLElementPrototype9classInfoEv
-__ZNK7WebCore18JSElementPrototype9classInfoEv
-__ZNK7WebCore22JSEventTargetPrototypeINS_15JSNodePrototypeENS_33JSEventTargetPrototypeInformationEE9classInfoEv
-__ZNK7WebCore15JSNodePrototype9classInfoEv
-__ZNK7WebCore18HTMLHeadingElement5alignEv
-__ZN7WebCore14JSNamedNodeMap16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZNK7WebCore23JSNamedNodeMapPrototype9classInfoEv
-__ZNK7WebCore7Element7baseURIEv
-__ZNK7WebCore8Document7baseURIEv
-__ZNK7WebCore8Document11documentURIEv
-__ZN3KJS17staticValueGetterIN7WebCore15JSNodePrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore15JSNodePrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore4Node14lastDescendantEv
-__ZN7WebCore30stringWithRebalancedWhitespaceERKNS_6StringEbb
-__ZNK7WebCore27JSHTMLUListElementPrototype9classInfoEv
-__ZNK7WebCore25JSHTMLDivElementPrototype9classInfoEv
-__ZNK7WebCore27JSHTMLImageElementPrototype9classInfoEv
-__ZN7WebCore46jsCanvasRenderingContext2DPrototypeFunctionArcEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D3arcEfffffbRi
-__ZN7WebCore4Path6addArcERKNS_10FloatPointEfffb
-__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionFillEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D4fillEv
-__ZN7WebCore19InspectorController20removeScriptResourceEPNS_17InspectorResourceE
-__ZN7WebCore20hideDOMNodeHighlightEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController13hideHighlightEv
-__ZN7WebCore10HTMLParser20reportErrorToConsoleENS_19HTMLParserErrorCodeEPKNS_12AtomicStringES4_b
-__ZNK7WebCore13HTMLTokenizer10lineNumberEv
-__ZN7WebCore30htmlParserErrorMessageTemplateENS_19HTMLParserErrorCodeE
-__ZN7WebCore10StringImpl7replaceEPS0_S1_
-__ZN7WebCore9isWarningENS_19HTMLParserErrorCodeE
-__ZN7WebCore19InspectorController23addScriptConsoleMessageEPKNS_14ConsoleMessageE
-__ZN7WebCore40jsElementPrototypeFunctionScrollIntoViewEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Element14scrollIntoViewEb
-__ZNK7WebCore11FrameLoader18canGoBackOrForwardEi
-__ZN7WebCore40lastEditablePositionBeforePositionInRootERKNS_8PositionEPNS_4NodeE
-__ZN7WebCore9unloadingEPK15OpaqueJSContextP13OpaqueJSValueS4_mPKPKS3_PS6_
-__ZN7WebCore19InspectorController5closeEv
-__ZN7WebCore26CompositeImplicitAnimation5resetEPNS_12RenderObjectE
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore17ImplicitAnimationEKNS_7HashMapIiS3_NS_7IntHashIjEENS_10HashTraitsIiEENS7_IS3_EEEEEEvRT0_
-__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE6shrinkEm
-__ZN7WebCore13RenderListBox16selectionChangedEv
-__ZN7WebCore13RenderListBox23scrollToRevealSelectionEv
-__ZNK7WebCore17HTMLSelectElement29activeSelectionStartListIndexEv
-__ZNK7WebCore17HTMLSelectElement27activeSelectionEndListIndexEv
-__ZNK7WebCore17HTMLSelectElement21lastSelectedListIndexEv
-__ZN7WebCore13RenderListBox18listIndexIsVisibleEi
-__ZNK7WebCore11RenderTheme39inactiveListBoxSelectionBackgroundColorEv
-__ZNK7WebCore11RenderTheme39inactiveListBoxSelectionForegroundColorEv
-__ZN7WebCore18RenderTextFragment17previousCharacterEv
-__ZN7WebCore14RenderFrameSet17paintColumnBorderERKNS_12RenderObject9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14RenderFrameSet14paintRowBorderERKNS_12RenderObject9PaintInfoERKNS_7IntRectE
-__ZN7WebCore15borderFillColorEv
-__ZN7WebCore20borderStartEdgeColorEv
-__ZN7WebCore18borderEndEdgeColorEv
-__ZN7WebCore5Cache13getStatisticsEv
-__ZNK7WebCore23JSHTMLDocumentPrototype9classInfoEv
-__ZNK7WebCore17JSScreenPrototype9classInfoEv
-__ZNK7WebCore19JSDocumentPrototype9classInfoEv
-__ZN7WebCore12IconDatabase19pageURLMappingCountEv
-__ZN7WebCore12IconDatabase20retainedPageURLCountEv
-__ZN7WebCore12IconDatabase15iconRecordCountEv
-__ZN7WebCore12IconDatabase23iconRecordCountWithDataEv
-__ZN7WebCore12GCController17garbageCollectNowEv
--[WebCoreFrameBridge canSaveAsWebArchive]
-__ZN7WebCore29selectionContainsPossibleWordEPNS_5FrameE
-__ZNK7WebCore6Editor9canDeleteEv
--[WebCoreFrameBridge forceLayoutWithMinimumPageWidth:maximumPageWidth:adjustingViewSize:]
-__ZN7WebCore5Frame29forceLayoutWithPageWidthRangeEffb
--[WebCoreFrameBridge computePageRectsWithPrintWidthScaleFactor:printHeight:]
-__ZN7WebCore5Frame16adjustPageHeightEPffff
-__ZN7WebCore18correctedTextColorENS_5ColorES0_
-__ZN7WebCore17differenceSquaredERKNS_5ColorES2_
-__ZN7WebCore15GraphicsContext21focusRingBoundingRectEv
-__ZN7WebCore12RenderObject13addPDFURLRectEPNS_15GraphicsContextENS_7IntRectE
-__ZN7WebCore15GraphicsContext13setURLForRectERKNS_4KURLERKNS_7IntRectE
-__ZN7WebCore38jsElementPrototypeFunctionHasAttributeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore7Element12hasAttributeERKNS_6StringE
-__ZNK7WebCore19HTMLOptGroupElement14groupLabelTextEv
-__ZNK7WebCore16DeprecatedString15stripWhiteSpaceEv
-__ZNK7WebCore16DeprecatedString18simplifyWhiteSpaceEv
-__ZN7WebCore22JSHTMLTableCellElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore20HTMLTableCellElement10setColSpanEi
-__ZN7WebCore44jsHTMLTableElementPrototypeFunctionInsertRowEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16HTMLTableElement9insertRowEiRi
-__ZNK7WebCore16HTMLTableElement8lastBodyEv
-__ZN7WebCore48jsHTMLTableRowElementPrototypeFunctionInsertCellEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore19HTMLTableRowElement10insertCellEiRi
-__ZN7WebCore20HTMLTableCellElement8setAlignERKNS_6StringE
--[WebCoreResourceHandleAsDelegate connection:didReceiveAuthenticationChallenge:]
-__ZN7WebCore4coreEP28NSURLAuthenticationChallenge
-__ZN7WebCore23AuthenticationChallengeC1EP28NSURLAuthenticationChallenge
-__ZN7WebCore4coreEP20NSURLProtectionSpace
-__ZN7WebCore15ProtectionSpaceC1ERKNS_6StringEiNS_25ProtectionSpaceServerTypeES3_NS_35ProtectionSpaceAuthenticationSchemeE
-__ZN7WebCore4coreEP15NSURLCredential
-__ZN7WebCore10CredentialC1ERKNS_6StringES3_NS_21CredentialPersistenceE
-__ZN7WebCore14ResourceHandle33didReceiveAuthenticationChallengeERKNS_23AuthenticationChallengeE
-__ZN7WebCore14ResourceLoader33didReceiveAuthenticationChallengeEPNS_14ResourceHandleERKNS_23AuthenticationChallengeE
-__ZN7WebCore14ResourceLoader33didReceiveAuthenticationChallengeERKNS_23AuthenticationChallengeE
-__ZN7WebCore11FrameLoader33didReceiveAuthenticationChallengeEPNS_14ResourceLoaderERKNS_23AuthenticationChallengeE
-__ZN7WebCore3macERKNS_23AuthenticationChallengeE
--[WebCoreResourceHandleAsDelegate useCredential:forAuthenticationChallenge:]
-__ZN7WebCore14ResourceHandle18receivedCredentialERKNS_23AuthenticationChallengeERKNS_10CredentialE
-__ZN7WebCoreneERKNS_23AuthenticationChallengeES2_
-__ZN7WebCoreeqERKNS_23AuthenticationChallengeES2_
-__ZNK7WebCore23AuthenticationChallenge6isNullEv
-__ZNK7WebCore23AuthenticationChallenge15protectionSpaceEv
-__ZN7WebCoreeqERKNS_15ProtectionSpaceES2_
-__ZNK7WebCore15ProtectionSpace4hostEv
-__ZNK7WebCore15ProtectionSpace4portEv
-__ZNK7WebCore15ProtectionSpace10serverTypeEv
-__ZNK7WebCore15ProtectionSpace5realmEv
-__ZNK7WebCore15ProtectionSpace20authenticationSchemeEv
-__ZNK7WebCore23AuthenticationChallenge18proposedCredentialEv
-__ZN7WebCoreeqERKNS_10CredentialES2_
-__ZNK7WebCore10Credential4userEv
-__ZNK7WebCore10Credential8passwordEv
-__ZNK7WebCore10Credential11persistenceEv
-__ZNK7WebCore23AuthenticationChallenge20previousFailureCountEv
-__ZNK7WebCore23AuthenticationChallenge15failureResponseEv
-__ZN7WebCoreeqERKNS_16ResourceResponseES2_
-__ZNK7WebCore20ResourceResponseBase14httpStatusTextEv
-__ZN3WTFeqIN7WebCore6StringES2_NS1_15CaseFoldingHashENS_10HashTraitsIS2_EES5_EEbRKNS_7HashMapIT_T0_T1_T2_T3_EESE_
-__ZNK7WebCore23AuthenticationChallenge5errorEv
-__ZN7WebCore3macERKNS_10CredentialE
-__ZN7WebCore14PluginDocumentC1EPNS_17DOMImplementationEPNS_5FrameE
-__ZN7WebCore14PluginDocument15createTokenizerEv
-__ZNK7WebCore15PluginTokenizer12wantsRawDataEv
-__ZN7WebCore15PluginTokenizer12writeRawDataEPKci
-__ZN7WebCore15PluginTokenizer23createDocumentStructureEv
-__ZN7WebCore16HTMLEmbedElement6setSrcERKNS_6StringE
-__ZN7WebCore16HTMLEmbedElement7setTypeERKNS_6StringE
-__ZNK7WebCore14PluginDocument16isPluginDocumentEv
-__ZN7WebCore15PluginTokenizer6finishEv
-__ZN7WebCore15PluginTokenizerD1Ev
-__ZN7WebCore14DocumentLoader22cancelMainResourceLoadERKNS_13ResourceErrorE
-__ZN7WebCore14PluginDocumentD1Ev
-__ZNK7WebCore17HTMLIFrameElement5widthEv
-__ZNK7WebCore6Chrome12canTakeFocusENS_14FocusDirectionE
-__ZNK7WebCore6Chrome9takeFocusENS_14FocusDirectionE
-__ZN7WebCore18JSHTMLStyleElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore16HTMLStyleElement7setTypeERKNS_12AtomicStringE
-__ZNK7WebCore12RenderObject7isFrameEv
-__ZNK7WebCore14RenderFrameSet8edgeInfoEv
-__ZNK7WebCore14RenderFrameSet9canResizeERKNS_8IntPointE
-__ZNK7WebCore14RenderFrameSet12hitTestSplitERKNS0_8GridAxisEi
-__ZNK7WebCore17RenderTextControl12autosaveNameEv
-__ZN7WebCore15SearchPopupMenuC1EPNS_15PopupMenuClientE
-__ZN7WebCore15SearchPopupMenu18saveRecentSearchesERKNS_12AtomicStringERKN3WTF6VectorINS_6StringELm0EEE
-__ZN7WebCore11autosaveKeyERKNS_6StringE
-__ZN7WebCore8RenderBR22positionForCoordinatesEii
-__ZN7WebCore23JSHTMLOptionsCollection9setLengthEPN3KJS9ExecStateEPNS1_7JSValueE
-__ZN7WebCore21HTMLOptionsCollection9setLengthEjRi
-__ZN7WebCore17HTMLSelectElement9setLengthEjRi
-__ZN7WebCore17HTMLOptionElement18setDefaultSelectedEb
-__ZN7WebCore40jsHTMLInputElementPrototypeFunctionClickEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore11HTMLElement5clickEv
-__ZN7WebCore21JSDocumentConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore11HTMLElement3dirEv
-__ZNK7WebCore16HTMLInputElement3altEv
-__ZNK7WebCore12RenderObject24shouldPaintSelectionGapsEv
-__ZN7WebCore17HTMLScriptElement7setTextERKNS_6StringE
-__ZNK7WebCore28JSHTMLAnchorElementPrototype9classInfoEv
-__ZNK7WebCore17HTMLAnchorElement8hreflangEv
-__ZNK7WebCore17HTMLAnchorElement5shapeEv
-__ZNK7WebCore17HTMLAnchorElement3revEv
+__ZN7WebCoreL10toGeorgianEi
+__ZN3WTFeqINS_6RefPtrIN7WebCore16AtomicStringImplEEENS2_17CounterDirectivesENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS5_EEEEb
+__ZNK3WTF9HashTableINS_6RefPtrIN7WebCore16AtomicStringImplEEESt4pairIS4_NS2_17CounterDirectivesEENS_18PairFirstExtractorIS7_EEN
+__ZN7WebCoreeqERKNS_17CounterDirectivesES2_
+__ZN7WebCore21RenderObjectChildList18invalidateCountersEPNS_12RenderObjectE
+__ZN7WebCoreL29invalidateCountersInContainerEPNS_12RenderObjectE
+__ZN7WebCore13RenderCounter10invalidateEv
+__ZN7WebCore24jsHTMLMetaElementContentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLMetaElement7contentEv
+__ZN7WebCore9CSSParser13parseFillSizeEv
+__ZN7WebCore16CSSStyleSelector11mapFillSizeEPNS_9FillLayerEPNS_8CSSValueE
+__ZN7WebCore17jsDocumentDoctypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTitleElement4textEv
+__ZN7WebCore24jsDocumentImplementationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_17DOMImplementationE
+__ZN7WebCore19JSDOMImplementation15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSDOMImplementationC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17DOMImplementationEEE
+__ZN7WebCore19JSDOMImplementationC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17DOMImplementationEEE
+__ZN7WebCore19JSDOMImplementation18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28JSDOMImplementationPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore46jsDOMImplementationPrototypeFunctionHasFeatureEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore19JSDOMImplementation9classInfoEv
+__ZN7WebCore48jsDocumentPrototypeFunctionCreateEntityReferenceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document21createEntityReferenceERKNS_6StringERi
+__ZN7WebCore27getExceptionCodeDescriptionEiRNS_24ExceptionCodeDescriptionE
+__ZN7WebCore13ExceptionBaseC2ERKNS_24ExceptionCodeDescriptionE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_16DOMCoreExceptionE
+__ZN7WebCore18JSDOMCoreException15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSDOMCoreExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16DOMCoreExceptionEEE
+__ZN7WebCore18JSDOMCoreExceptionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16DOMCoreExceptionEEE
+__ZNK3JSC8JSObject22isNotAnObjectErrorStubEv
+__ZN7WebCore18JSDOMCoreException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSDOMCoreExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK3JSC8JSObject19isWatchdogExceptionEv
+__ZN7WebCore22jsDOMCoreExceptionCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12DocumentType19removedFromDocumentEv
+__ZThn8_N7WebCore12DocumentTypeD0Ev
+__ZN7WebCore18JSDOMCoreExceptionD1Ev
+__ZN7WebCore18JSDOMCoreExceptionD2Ev
+__ZN7WebCore19JSDOMImplementationD1Ev
+__ZN7WebCore19JSDOMImplementationD2Ev
+__ZThn8_N7WebCore16HTMLTitleElementD0Ev
+__ZN7WebCore27JSDOMCoreExceptionPrototypeD1Ev
+__ZN7WebCore28JSDOMImplementationPrototypeD1Ev
+__ZN7WebCore54jsDocumentPrototypeFunctionCreateProcessingInstructionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore8Document27createProcessingInstructionERKNS_6StringES3_Ri
+__ZNK7WebCore6JSAttr9classInfoEv
+__ZN7WebCore4Attr16childTypeAllowedENS_4Node8NodeTypeE
+__ZN7WebCore4Attr15childrenChangedEbPNS_4NodeES2_i
+__ZNK7WebCore4Node9nodeValueEv
+__ZN7WebCore45jsDocumentPrototypeFunctionCreateCDATASectionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document18createCDATASectionERKNS_6StringERi
+__ZN7WebCore16toJSNewlyCreatedEPN3JSC9ExecStateEPNS_12CDATASectionE
+__ZN7WebCore8Document9cloneNodeEb
+__ZN7WebCore18jsNodeNamespaceURIEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore50jsDOMImplementationPrototypeFunctionCreateDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14toDocumentTypeEN3JSC7JSValueE
+__ZN7WebCore17DOMImplementation14createDocumentERKNS_6StringES3_PNS_12DocumentTypeERi
+__ZN7WebCore8Document15createElementNSERKNS_6StringES3_Ri
+__ZN7WebCore8Document26hasPrefixNamespaceMismatchERKNS_13QualifiedNameE
+__ZN7WebCore14JSDocumentType15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSDocumentTypeC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12DocumentTypeEEE
+__ZN7WebCore14JSDocumentTypeC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12DocumentTypeEEE
+__ZN7WebCore14JSDocumentType18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore8Document13createElementERKNS_12AtomicStringERi
+__ZN7WebCoreL15headConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore35jsNamedNodeMapPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore4Attr8nodeNameEv
+__ZNK7WebCore18JSHTMLTitleElement9classInfoEv
+__ZN7WebCore4Node26willMoveToNewOwnerDocumentEv
+__ZN7WebCore21updateDOMNodeDocumentEPNS_4NodeEPNS_8DocumentES3_
+__ZN7WebCore4Node25didMoveToNewOwnerDocumentEv
+__ZN7WebCore14JSDocumentTypeD1Ev
+__ZN7WebCore42jsDocumentPrototypeFunctionCreateAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document15createAttributeERKNS_6StringERi
+__ZN7WebCore8Document17createAttributeNSERKNS_6StringES3_Rib
+__ZN7WebCore23JSDocumentTypePrototypeD1Ev
+__ZN7WebCore4Attr9cloneNodeEb
+__ZN7WebCore6JSAttr3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore4Attr12setNodeValueERKNS_6StringERi
+__ZN7WebCore4Attr8setValueERKNS_6StringERi
+__ZN7WebCore14setJSAttrValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore6JSAttr8setValueEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore32jsNodePrototypeFunctionNormalizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4Node9normalizeEv
+__ZNK7WebCore4Node25traverseNextNodePostOrderEv
+__ZN7WebCore7Element19normalizeAttributesEv
+__ZN7WebCore8Document15textNodesMergedEPNS_4TextEj
+__ZN7WebCore4Node6removeERi
+__ZN7WebCore42jsCharacterDataPrototypeFunctionAppendDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore45jsCharacterDataPrototypeFunctionSubstringDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore43jsCharacterDataPrototypeFunctionReplaceDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore42jsCharacterDataPrototypeFunctionInsertDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13CharacterData11replaceDataEjjRKNS_6StringERi
+__ZNK7WebCore7Comment8nodeNameEv
+__ZNK7WebCore16DocumentFragment8nodeNameEv
+__ZN7WebCore18jsDocumentTypeNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore42jsElementPrototypeFunctionSetAttributeNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9JSElement16setAttributeNodeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore6toAttrEN3JSC7JSValueE
+__ZN7WebCore7Element16setAttributeNodeEPNS_4AttrERi
+__ZN7WebCore12NamedNodeMap12setNamedItemEPNS_4NodeERi
+__ZNK7WebCore4Attr15isAttributeNodeEv
+__ZN7WebCore45jsElementPrototypeFunctionRemoveAttributeNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element19removeAttributeNodeEPNS_4AttrERi
+__ZN7WebCore43jsNamedNodeMapPrototypeFunctionSetNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore46jsNamedNodeMapPrototypeFunctionRemoveNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13StyledElement25didMoveToNewOwnerDocumentEv
+__ZNK7WebCore12DocumentType8nodeNameEv
+__ZN7WebCore4Node12setNodeValueERKNS_6StringERi
+__ZN7WebCore32jsTextPrototypeFunctionSplitTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4Text9splitTextEjRi
+__ZN7WebCore4Text9createNewEN3WTF10PassRefPtrINS_10StringImplEEE
+__ZN7WebCore8Document13textNodeSplitEPNS_4TextE
+__ZN7WebCore44jsDocumentPrototypeFunctionCreateAttributeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore54jsDOMImplementationPrototypeFunctionCreateDocumentTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore17DOMImplementation18createDocumentTypeERKNS_6StringES3_S3_Ri
+__ZN7WebCore40jsElementPrototypeFunctionSetAttributeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9JSElement14setAttributeNSEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13MutationEventC1Ev
+__ZN7WebCore13MutationEventC2Ev
+__ZNK7WebCore13MutationEvent15isMutationEventEv
+__ZN7WebCore15getDOMStructureINS_15JSMutationEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore15JSMutationEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSMutationEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13MutationEventEEE
+__ZN7WebCore15JSMutationEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13MutationEventEEE
+__ZN7WebCore15JSMutationEventD1Ev
+__ZN7WebCore7UIEventC1Ev
+__ZNK7WebCore5Event14isSVGZoomEventEv
+__ZN7WebCore15getDOMStructureINS_9JSUIEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore9JSUIEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7UIEventEEE
+__ZN7WebCore9JSUIEventD1Ev
+__ZN7WebCore24JSMutationEventPrototypeD1Ev
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14EventExceptionE
+__ZN7WebCore16JSEventException15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSEventExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14EventExceptionEEE
+__ZN7WebCore16JSEventExceptionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14EventExceptionEEE
+__ZN7WebCore16JSEventException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL24getJSEventExceptionTableEPN3JSC9ExecStateE
+__ZN7WebCore25JSEventExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL33getJSEventExceptionPrototypeTableEPN3JSC9ExecStateE
+__ZN7WebCore16JSEventExceptionD1Ev
+__ZN7WebCore16JSEventExceptionD2Ev
+__ZN7WebCore20jsEventExceptionCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSEventExceptionPrototypeD1Ev
+__ZNK7WebCore15JSMutationEvent9classInfoEv
+__ZNK7WebCore9JSUIEvent9classInfoEv
+__ZN7WebCore15JSMutationEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24JSMutationEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement18containsJavaAppletEv
+__ZNK7WebCore17HTMLObjectElement4typeEv
+__ZN7WebCore17HTMLObjectElement21renderFallbackContentEv
+__ZN7WebCore28jsHTMLAnchorElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement9accessKeyEv
+__ZN7WebCore26jsHTMLAnchorElementCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore17HTMLAnchorElement7charsetEv
+__ZN7WebCore25jsHTMLAnchorElementCoordsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore17HTMLAnchorElement6coordsEv
-__ZNK7WebCore17HTMLAnchorElement9accessKeyEv
-__ZNK7WebCore17HTMLAnchorElement4portEv
-__ZN7WebCore16DeprecatedString6numberEi
-__ZN7WebCore16DeprecatedString6setNumEi
-__ZN7WebCore16DeprecatedString6formatEPKcz
-__ZNK7WebCore11HTMLElement9outerHTMLEv
-__ZNK7WebCore11HTMLElement4langEv
-__ZNK7WebCore11HTMLElement15contentEditableEv
-__ZNK7WebCore7Element9outerTextEv
-__ZN7WebCore7Element9clientTopEv
-__ZN7WebCore7Element10clientLeftEv
-__ZNK7WebCore4Node9nodeValueEv
-__ZNK7WebCore7Element6prefixEv
-__ZN7WebCore11FrameLoader21reportLocalLoadFailedEPKNS_4PageERKNS_6StringE
-__ZNK7WebCore11FrameLoader23isHostedByObjectElementEv
-__ZN3KJS38jsXMLHttpRequestPrototypeFunctionAbortEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore18JSHTMLTableElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore16HTMLTableElement14setCellSpacingERKNS_6StringE
-__ZN7WebCore16HTMLTableElement14setCellPaddingERKNS_6StringE
-__ZN7WebCore20setTableCellsChangedEPNS_4NodeE
-__ZN7WebCore15HTMLFormElement16setAcceptCharsetERKNS_6StringE
-__ZN7WebCore37jsDocumentPrototypeFunctionImportNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document10importNodeEPNS_4NodeEbRi
-__ZN7WebCore16HTMLInputElement26copyNonAttributePropertiesEPKNS_7ElementE
-__ZN7WebCore37jsHTMLCollectionPrototypeFunctionItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16JSHTMLCollection4itemEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore17HTMLScriptElement8setDeferEb
-__ZN7WebCore34jsElementPrototypeFunctionContainsEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore27jsHTMLAnchorElementHreflangEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement8hreflangEv
+__ZN7WebCore22jsHTMLAnchorElementRevEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement3revEv
+__ZN7WebCore24jsHTMLAnchorElementShapeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement5shapeEv
+__ZNK7WebCore17HTMLAnchorElement8tabIndexEv
+__ZN7WebCore8Document18focusedNodeRemovedEv
+__ZN7WebCore24jsHTMLAppletElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLPlugInElement5alignEv
+__ZN7WebCore17HTMLAppletElement19removedFromDocumentEv
+__ZThn8_N7WebCore17HTMLAppletElementD0Ev
+__ZN7WebCore22jsHTMLAppletElementAltEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement3altEv
+__ZN7WebCore26jsHTMLAppletElementArchiveEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement7archiveEv
+__ZN7WebCore23jsHTMLAppletElementCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement4codeEv
+__ZN7WebCore27jsHTMLAppletElementCodeBaseEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement8codeBaseEv
+__ZN7WebCore25jsHTMLAppletElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLPlugInElement6heightEv
+__ZN7WebCore25jsHTMLAppletElementHspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement6hspaceEv
+__ZN7WebCore23jsHTMLAppletElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLAppletElementVspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement6vspaceEv
+__ZN7WebCore24jsHTMLAppletElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLPlugInElement5widthEv
+__ZN7WebCore25jsHTMLAppletElementObjectEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAppletElement6objectEv
+__ZN7WebCore26jsHTMLAreaElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLAreaElement9accessKeyEv
+__ZN7WebCore20jsHTMLAreaElementAltEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLAreaElement3altEv
+__ZN7WebCore23jsHTMLAreaElementCoordsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLAreaElement6coordsEv
+__ZN7WebCore21jsHTMLAreaElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLAreaElementNoHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLAreaElement6noHrefEv
+__ZN7WebCore22jsHTMLAreaElementShapeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLAreaElement5shapeEv
+__ZN7WebCore23jsHTMLAreaElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLAreaElement6targetEv
+__ZN7WebCore20jsHTMLBRElementClearEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13HTMLBRElement5clearEv
+__ZN7WebCoreL28createHTMLBaseElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLBaseElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLBaseElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLBaseElementEEE
+__ZN7WebCore17JSHTMLBaseElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLBaseElementEEE
+__ZN7WebCore17JSHTMLBaseElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21jsHTMLBaseElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15HTMLBaseElement19removedFromDocumentEv
+__ZN7WebCore17JSHTMLBaseElementD1Ev
+__ZThn8_N7WebCore15HTMLBaseElementD0Ev
+__ZNK7WebCore12RenderObject7isFrameEv
+__ZN7WebCore23jsHTMLBaseElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLBaseElement6targetEv
+__ZN7WebCore19HTMLFrameSetElement11recalcStyleENS_4Node11StyleChangeE
+__ZN7WebCore26JSHTMLBaseElementPrototypeD1Ev
+__ZN7WebCoreL32createHTMLBaseFontElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore21JSHTMLBaseFontElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSHTMLBaseFontElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLBaseFontElementEEE
+__ZN7WebCore21JSHTMLBaseFontElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLBaseFontElementEEE
+__ZN7WebCore21JSHTMLBaseFontElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26jsHTMLBaseFontElementColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLBaseFontElement5colorEv
+__ZN7WebCore21JSHTMLBaseFontElementD1Ev
+__ZThn8_N7WebCore19HTMLBaseFontElementD0Ev
+__ZN7WebCore25jsHTMLBaseFontElementFaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLBaseFontElement4faceEv
+__ZN7WebCore30JSHTMLBaseFontElementPrototypeD1Ev
+__ZN7WebCore25jsHTMLBaseFontElementSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLBaseFontElement4sizeEv
+__ZN7WebCore22jsHTMLBodyElementALinkEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLBodyElement5aLinkEv
+__ZN7WebCore27jsHTMLBodyElementBackgroundEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsHTMLBodyElementBgColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLBodyElement7bgColorEv
+__ZN7WebCore21jsHTMLBodyElementLinkEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14CachedResource18destroyDecodedDataEv
+__ZN7WebCore24JSMimeTypeArrayPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZThn8_N7WebCore17HTMLObjectElementD0Ev
+__ZThn8_N7WebCore16HTMLParamElementD0Ev
+__ZN7WebCore24setJSHTMLMetaElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLMetaElement7setNameERKNS_6StringE
+__ZN7WebCore27setJSHTMLMetaElementContentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLMetaElement10setContentERKNS_6StringE
+__ZN7WebCore26jsHTMLMetaElementHttpEquivEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLMetaElement9httpEquivEv
+__ZN7WebCore12RenderButton28removeLeftoverAnonymousBlockEPNS_11RenderBlockE
+__ZN7WebCore9FrameView23removeSlowRepaintObjectEv
+__ZN7WebCore5XPathL12createFunNotEv
+__ZNK7WebCore5XPath6FunNot8evaluateEv
+__ZN7WebCore5XPath6FunNotD0Ev
+__ZN7WebCore5XPath8FunctionD2Ev
+__ZN7WebCore21jsHTMLBodyElementTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLBodyElement4textEv
+__ZN7WebCore22jsHTMLBodyElementVLinkEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsNodePrototypeFunctionIsSupportedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4Node11isSupportedERKNS_6StringES3_
+__ZN3JSC8Bindings12ObjcInstance12virtualBeginEv
+__ZNK3JSC8Bindings12ObjcInstance8getClassEv
+__ZN3JSC8Bindings9ObjcClass11classForIsAEP10objc_class
+__ZN3JSC8Bindings9ObjcClassC1EP10objc_class
+__ZN3JSC8Bindings9ObjcClassC2EP10objc_class
+__ZNK3JSC8Bindings9ObjcClass10fieldNamedERKNS_10IdentifierEPNS0_8InstanceE
+__ZNK3JSC8Bindings9ObjcClass12methodsNamedERKNS_10IdentifierEPNS0_8InstanceE
+__ZN3JSC8Bindings25convertJSMethodNameToObjcEPKcPcm
+__ZN3JSC8Bindings10ObjcMethodC1EP10objc_classP13objc_selector
+__ZN3JSC8Bindings10ObjcMethodC2EP10objc_classP13objc_selector
+__ZN3JSC8Bindings12ObjcInstance10virtualEndEv
+__ZN3JSC8Bindings12ObjcInstance12invokeMethodEPNS_9ExecStateERKN3WTF6VectorIPNS0_6MethodELm0EEERKNS_7ArgListE
+__ZN3JSC8Bindings12ObjcInstance18setGlobalExceptionEP8NSStringPNS_14JSGlobalObjectE
+__ZNK3JSC8Bindings10ObjcMethod18getMethodSignatureEv
+__ZN3JSC8Bindings20objcValueTypeForTypeEPKc
+__ZN3JSC8Bindings23convertValueToObjcValueEPNS_9ExecStateENS_7JSValueENS0_13ObjcValueTypeE
++[WebScriptObject _convertValueToObjcValue:originRootObject:rootObject:]
+__ZN3JSC8Bindings23convertNSStringToStringEPNS_9ExecStateEP8NSString
+__ZN3JSC8Bindings12ObjcInstance30moveGlobalExceptionToExecStateEPNS_9ExecStateE
+__ZNK7WebCore14RenderThemeMac22adjustSliderTrackStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore12RenderSliderC1EPNS_16HTMLInputElementE
+__ZN7WebCore12RenderSliderC2EPNS_16HTMLInputElementE
+__ZN7WebCore12RenderSlider14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore12RenderSlider17updateFromElementEv
+__ZN7WebCore11SliderRangeC1EPNS_16HTMLInputElementE
+__ZN7WebCore11SliderRangeC2EPNS_16HTMLInputElementE
+__ZN7WebCore11SliderRange16valueFromElementEPNS_16HTMLInputElementEPb
+__ZN7WebCore11SliderRange10clampValueEd
+__ZN7WebCore18SliderThumbElementC1EPNS_8DocumentEPNS_4NodeE
+__ZN7WebCore18SliderThumbElementC2EPNS_8DocumentEPNS_4NodeE
+__ZN7WebCore12RenderSlider16createThumbStyleEPKNS_11RenderStyleE
+__ZNK7WebCore14RenderThemeMac22adjustSliderThumbStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore17RenderFlexibleBoxC1EPNS_4NodeE
+__ZN7WebCore11RenderBlock23deleteEllipsisLineBoxesEv
+__ZN7WebCore11RenderBlock25checkLinesForTextOverflowEv
+__ZN7WebCore12RenderSlider6layoutEv
+__ZNK7WebCore14RenderThemeMac21adjustSliderThumbSizeEPNS_12RenderObjectE
+__ZN7WebCore12RenderSlider14calcPrefWidthsEv
+__ZNK7WebCore18SliderThumbElement12isShadowNodeEv
+__ZN7WebCore18SliderThumbElement16shadowParentNodeEv
+__ZNK7WebCore12RenderSlider16baselinePositionEbb
+__ZN7WebCore17RenderFlexibleBox17layoutVerticalBoxEb
+__ZN7WebCore11RenderBlock30markPositionedObjectsForLayoutEv
+__ZN7WebCore11RenderBlock15clearTruncationEv
+__ZN7WebCoreL16shouldCheckLinesEPNS_12RenderObjectE
+__ZN7WebCore13RootInlineBox22canAccommodateEllipsisEbiii
+__ZN7WebCore11RenderBlock9lineCountEv
+__ZN7WebCore13InlineFlowBox22canAccommodateEllipsisEbii
+__ZN7WebCore9InlineBox22canAccommodateEllipsisEbii
+__ZN7WebCore13RootInlineBox13placeEllipsisERKNS_12AtomicStringEbiiiPNS_9InlineBoxE
+__ZN3WTF7HashMapIPKN7WebCore13RootInlineBoxEPNS1_11EllipsisBoxENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3addERKS4_RKS6_
+__ZN3WTF9HashTableIPKN7WebCore13RootInlineBoxESt4pairIS4_PNS1_11EllipsisBoxEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_1
+__ZN7WebCore13RootInlineBox16placeEllipsisBoxEbiiiRb
+__ZN7WebCore13InlineFlowBox16placeEllipsisBoxEbiiiRb
+__ZN7WebCore13InlineTextBox16placeEllipsisBoxEbiiiRb
+__ZN3WTF7HashMapIPKN7WebCore13RootInlineBoxEPNS1_11EllipsisBoxENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE4takeERKS4_
+__ZN7WebCore11EllipsisBoxD0Ev
+__ZN7WebCore10ScrollView36adjustScrollbarsAvoidingResizerCountEi
+__ZN7WebCore9FrameView14invalidateRectERKNS_7IntRectE
+__ZN7WebCore6Chrome7repaintERKNS_7IntRectEbbb
+__ZN7WebCore14RenderThemeMac16paintSliderTrackEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCoreL24TrackGradientInterpolateEPvPKdPd
+__ZNK7WebCore12RenderSlider8isSliderEv
+__ZN7WebCore14RenderThemeMac16paintSliderThumbEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZNK7WebCore14RenderThemeMac21sliderThumbHorizontalEv
+__ZNK7WebCore12RenderSlider10inDragModeEv
+__ZN7WebCore15ActiveDOMObject7suspendEv
+__ZN7WebCore23jsHTMLButtonElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsHTMLButtonElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLButtonElement9accessKeyEv
+__ZN7WebCore27jsHTMLButtonElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLButtonElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore22HTMLFormControlElement8tabIndexEv
+__ZN7WebCore23jsHTMLButtonElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLButtonElement15formControlTypeEv
+__ZN7WebCore24jsHTMLButtonElementValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLButtonElement5valueEv
+__ZN7WebCore22jsHTMLTableElementRowsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16HTMLTableElement4rowsEv
+__ZN7WebCore23HTMLTableRowsCollection6createEN3WTF10PassRefPtrINS_16HTMLTableElementEEE
+__ZN7WebCore23HTMLTableRowsCollectionC1EN3WTF10PassRefPtrINS_16HTMLTableElementEEE
+__ZN7WebCore23HTMLTableRowsCollectionC2EN3WTF10PassRefPtrINS_16HTMLTableElementEEE
+__ZN7WebCore37jsHTMLCollectionPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSHTMLCollection9classInfoEv
+__ZN7WebCore16JSHTMLCollection4itemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore23HTMLTableRowsCollection9itemAfterEPNS_7ElementE
+__ZN7WebCore23HTMLTableRowsCollection8rowAfterEPNS_16HTMLTableElementEPNS_19HTMLTableRowElementE
+__ZN7WebCore29jsHTMLTableRowElementRowIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableRowElement8rowIndexEv
+__ZN7WebCore23HTMLTableRowsCollectionD0Ev
+__ZN7WebCore42jsHTMLCollectionPrototypeFunctionNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSHTMLCollection9namedItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCoreL8isInHeadEPNS_7ElementE
+__ZN7WebCore44jsHTMLTableElementPrototypeFunctionInsertRowEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16HTMLTableElement9insertRowEiRi
+__ZN7WebCore16textBreakCurrentEPNS_17TextBreakIteratorE
+__ZN7WebCore37jsPluginArrayPrototypeFunctionRefreshEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore13JSPluginArray9classInfoEv
+__ZN7WebCore11PluginArray7refreshEb
+__ZN7WebCore4Page14refreshPluginsEb
+__ZN7WebCore10PluginData7refreshEv
+__ZN7WebCore19CachedCSSStyleSheet11setEncodingERKNS_6StringE
+__ZN7WebCoreL38min_device_pixel_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL34device_pixel_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore12compareValueIfEEbT_S1_NS_18MediaFeaturePrefixE
+__ZN7WebCoreL20directoryConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore20HTMLDirectoryElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore20HTMLDirectoryElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZNK7WebCore20HTMLDirectoryElement17endTagRequirementEv
 __ZNK7WebCore20HTMLDirectoryElement11tagPriorityEv
-__ZN7WebCore17JSHTMLBodyElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore15HTMLBodyElement12setScrollTopEi
-__ZN7WebCore43jsHTMLTextAreaElementPrototypeFunctionFocusEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore19HTMLTextAreaElement17setSelectionStartEi
-__ZN7WebCore17RenderTextControl17setSelectionStartEi
-__ZN7WebCore19HTMLTextAreaElement15setSelectionEndEi
-__ZN7WebCore17RenderTextControl15setSelectionEndEi
-__ZN7WebCore19HTMLTextAreaElement21updateFocusAppearanceEb
-__ZN7WebCore19HTMLTextAreaElement17setSelectionRangeEii
-__ZN7WebCore23getUniqueBoundaryStringERN3WTF6VectorIcLm0EEE
-__ZN7WebCore12randomNumberEv
+__ZN7WebCoreL33createHTMLDirectoryElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore22JSHTMLDirectoryElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSHTMLDirectoryElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20HTMLDirectoryElementEEE
+__ZN7WebCore22JSHTMLDirectoryElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20HTMLDirectoryElementEEE
+__ZN7WebCore22JSHTMLDirectoryElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29jsHTMLDirectoryElementCompactEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLDirectoryElement7compactEv
+__ZN7WebCore22JSHTMLDirectoryElementD1Ev
+__ZThn8_N7WebCore20HTMLDirectoryElementD0Ev
+__ZN7WebCore20HTMLDirectoryElementD0Ev
+__ZN7WebCore21jsHTMLDivElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14HTMLDivElement5alignEv
+__ZN7WebCore31JSHTMLDirectoryElementPrototypeD1Ev
+__ZN7WebCore25jsHTMLDListElementCompactEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLDListElement7compactEv
+__ZN7WebCore30jsHTMLIFrameElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLIFrameElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLIFrameElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23jsHTMLFormElementActionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL30createHTMLLegendElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLLegendElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLLegendElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLLegendElementEEE
+__ZN7WebCore19JSHTMLLegendElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLLegendElementEEE
+__ZN7WebCore19JSHTMLLegendElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19JSHTMLLegendElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore30JSHTMLIFrameElementConstructorD1Ev
+__ZN7WebCore19JSHTMLLegendElementD1Ev
+__ZN7WebCore28JSHTMLLegendElementPrototypeD1Ev
+__ZN7WebCore17jsDocumentAnchorsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document7anchorsEv
+__ZNK7WebCore14RenderThemeMac35adjustSearchFieldResultsButtonStyleEPNS_16CSSStyleSelectorEPNS_11RenderStyleEPNS_7ElementE
+__ZN7WebCore23jsHTMLSelectElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30setJSHTMLButtonElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26jsHTMLInputElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn8_N7WebCore14HTMLMapElementD0Ev
+__ZN7WebCore14RenderThemeMac29paintSearchFieldResultsButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZNK7WebCore14RenderThemeMac18searchMenuTemplateEv
+__ZNK7WebCore13HTMLTokenizer15executingScriptEv
+__ZN7WebCore22jsHTMLTitleElementTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsHTMLDocumentHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12HTMLDocument6heightEv
+__ZN7WebCore19jsHTMLDocumentWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12HTMLDocument5widthEv
+__ZN7WebCore20jsHTMLDocumentEmbedsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document6embedsEv
+__ZN7WebCore26jsHTMLImageElementCompleteEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement8completeEv
+__ZN7WebCore30jsHTMLImageElementNaturalWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement12naturalWidthEv
+__ZN7WebCore21jsHTMLDocumentPluginsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document7pluginsEv
+__ZN7WebCore20jsNavigatorVendorSubEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase9vendorSubEv
+__ZN7WebCore17jsScreenAvailLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen9availLeftEv
+__ZN7WebCore16jsScreenAvailTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Screen8availTopEv
+__ZN7WebCore14XMLHttpRequest24loadRequestSynchronouslyERNS_15ResourceRequestERi
+__ZN7WebCore16ThreadableLoader25loadResourceSynchronouslyEPNS_22ScriptExecutionContextERKNS_15ResourceRequestERNS_22ThreadableL
+__ZN7WebCore24DocumentThreadableLoader25loadResourceSynchronouslyEPNS_8DocumentERKNS_15ResourceRequestERNS_22ThreadableLoaderCl
+__ZN7WebCore11FrameLoader25loadResourceSynchronouslyERKNS_15ResourceRequestENS_17StoredCredentialsERNS_13ResourceErrorERNS_16Re
+__ZN7WebCore19ResourceRequestBase18setTimeoutIntervalEd
+__ZN7WebCore14ResourceHandle25loadResourceSynchronouslyERKNS_15ResourceRequestENS_17StoredCredentialsERNS_13ResourceErrorERNS_1
++[WebCoreSynchronousLoader loadRequest:allowStoredCredentials:returningResponse:error:]
+-[WebCoreSynchronousLoader _isDone]
+-[WebCoreSynchronousLoader connection:willSendRequest:redirectResponse:]
+-[WebCoreSynchronousLoader connectionShouldUseCredentialStorage:]
+-[WebCoreSynchronousLoader connection:didReceiveResponse:]
+-[WebCoreSynchronousLoader connection:didReceiveData:]
+-[WebCoreSynchronousLoader connectionDidFinishLoading:]
+-[WebCoreSynchronousLoader _data]
+-[WebCoreSynchronousLoader _response]
+-[WebCoreSynchronousLoader _error]
+-[WebCoreSynchronousLoader dealloc]
+__ZN3WTF6RefPtrIN7WebCore10StringImplEEaSERKS3_
+__ZN7WebCore16ResourceResponseD2Ev
+__ZN7WebCore29setJSDOMWindowTextConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20jsDOMWindowOnkeydownEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow9onkeydownEv
+__ZN7WebCore23setJSDOMWindowOnkeydownEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow12setOnkeydownEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore27jsHTMLInputElementMaxLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement9maxLengthEv
+__ZN7WebCore13jsNodeOnkeyupEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node7onkeyupEv
+__ZN7WebCoreL25min_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL21widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore16CSSStyleSelector36addViewportDependentMediaQueryResultEPKNS_13MediaQueryExpEb
+__ZN3WTF6VectorIPN7WebCore16MediaQueryResultELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore16MediaQueryResultELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore16MediaQueryResultELm0EE15reserveCapacityEm
+__ZThn8_N7WebCore15HTMLHeadElementD0Ev
+__ZN7WebCore21jsHTMLLinkElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement4typeEv
+__ZN7WebCore23jsHTMLScriptElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLScriptElement4typeEv
+__ZN7WebCore16DocumentFragment9cloneNodeEb
+__ZNK7WebCore26CSSMutableStyleDeclaration10get4ValuesEPKi
+__ZN7WebCore14RenderListItem16setExplicitValueEi
+__ZN7WebCore14RenderListItem20explicitValueChangedEv
+__ZN7WebCore10HTMLParser23noembedCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN3WTF6VectorIPN7WebCore16MediaQueryResultELm0EE6shrinkEm
+__ZN7WebCore5Cache18revalidationFailedEPNS_14CachedResourceE
+__ZN7WebCore9FrameView20postLayoutTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore14CachedResource19httpStatusCodeErrorEv
+__ZN7WebCore19CachedCSSStyleSheet5errorEv
+__ZN7WebCore31setJSHTMLAnchorElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement12setAccessKeyERKNS_12AtomicStringE
+__ZN7WebCore21setJSDOMWindowConsoleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCoreL19optgroupConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore19HTMLOptGroupElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore19HTMLOptGroupElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore19HTMLOptGroupElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore19HTMLOptGroupElement19recalcSelectOptionsEv
+__ZN7WebCore19HTMLOptGroupElement6attachEv
+__ZN7WebCore19HTMLOptGroupElement14setRenderStyleEN3WTF10PassRefPtrINS_11RenderStyleEEE
+__ZN7WebCore19HTMLOptGroupElement8checkDTDEPKNS_4NodeE
+__ZN7WebCore19HTMLOptGroupElement15childrenChangedEbPNS_4NodeES2_i
+__ZNK7WebCore19HTMLOptGroupElement22nonRendererRenderStyleEv
+__ZN7WebCore25jsHTMLFieldSetElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn8_N7WebCore19HTMLFieldSetElementD0Ev
+__ZN7WebCore22jsHTMLFontElementColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLFontElement5colorEv
+__ZN7WebCore12CachedScript5errorEv
+__ZThn8_N7WebCore15HTMLFontElementD0Ev
+__ZN7WebCore21jsHTMLFontElementFaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLFontElement4faceEv
+__ZN7WebCore21jsHTMLFontElementSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLFontElement4sizeEv
+__ZN7WebCore10StringImpl37createStrippingNullCharactersSlowCaseEPKtj
+__ZThn112_N7WebCore17HTMLScriptElement18dispatchErrorEventEv
+__ZN7WebCore17HTMLScriptElement18dispatchErrorEventEv
+__ZN7WebCore30jsHTMLFormElementAcceptCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsHTMLFormElementEnctypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20setJSNodeTextContentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23jsHTMLFormElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLFormElement6targetEv
+__ZN7WebCoreL15compareBoxStartEPKNS_13InlineTextBoxES2_
+__ZSt25__unguarded_linear_insertIPPN7WebCore13InlineTextBoxES2_PFbPKS1_S5_EEvT_T0_T1_
+__ZN7WebCore19HTMLTextAreaElement5resetEv
 __ZN7WebCore19HTMLTextAreaElement14appendFormDataERNS_12FormDataListEb
-__ZN7WebCore17DeprecatedCStringaSEPKc
-__ZN7WebCore9ArrayImpl9duplicateEPKvm
-__ZN7WebCore44jsHTMLTableElementPrototypeFunctionDeleteRowEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16HTMLTableElement9deleteRowEiRi
-__ZN7WebCore4Node6removeERi
-__ZNK7WebCore21JSHTMLTableColElement9classInfoEv
-__ZN7WebCore20HTMLTableCellElement9setVAlignERKNS_6StringE
-__ZN7WebCore16HTMLTableElement9setBorderERKNS_6StringE
-__ZN7WebCore21JSHTMLTableRowElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore19HTMLTableRowElement8setAlignERKNS_6StringE
-__ZN7WebCore16HTMLTableElement7tBodiesEv
-__ZN7WebCore19HTMLTableRowElement9setVAlignERKNS_6StringE
-__ZN7WebCore16HTMLTableElement8setWidthERKNS_6StringE
-__ZN7WebCore16HTMLTableElement8setAlignERKNS_6StringE
+__ZN7WebCoreL29createHTMLFrameElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLFrameElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLFrameElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLFrameElementEEE
+__ZN7WebCore18JSHTMLFrameElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLFrameElementEEE
+__ZN7WebCore18JSHTMLFrameElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29jsHTMLFrameElementFrameBorderEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLFrameElementBase11frameBorderEv
+__ZN7WebCore18JSHTMLFrameElementD1Ev
+__ZThn8_N7WebCore16HTMLFrameElementD0Ev
+__ZN7WebCore26jsHTMLFrameElementLongDescEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLFrameElementBase8longDescEv
+__ZN7WebCore27JSHTMLFrameElementPrototypeD1Ev
+__ZN7WebCore30jsHTMLFrameElementMarginHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLFrameElementBase12marginHeightEv
+__ZN7WebCore29jsHTMLFrameElementMarginWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLFrameElementBase11marginWidthEv
+__ZN7WebCore22jsHTMLFrameElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsHTMLFrameElementNoResizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsHTMLFrameElementScrollingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLFrameElementBase9scrollingEv
+__ZN7WebCore21jsHTMLFrameElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsHTMLFrameElementContentDocumentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN3WTF6VectorIN7WebCore18CoreTextController11CoreTextRunELm16EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN7WebCore18CoreTextController11CoreTextRunELm16EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore18CoreTextController11CoreTextRunELm16EE15reserveCapacityEm
+__ZN7WebCoreL32createHTMLFrameSetElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore21JSHTMLFrameSetElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSHTMLFrameSetElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLFrameSetElementEEE
+__ZN7WebCore21JSHTMLFrameSetElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLFrameSetElementEEE
+__ZN7WebCore21JSHTMLFrameSetElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21JSHTMLFrameSetElement18canGetItemsForNameEPN3JSC9ExecStateEPNS_19HTMLFrameSetElementERKNS1_10IdentifierE
+__ZN7WebCore11HTMLElement8childrenEv
+__ZNK7WebCore14HTMLCollection9namedItemERKNS_12AtomicStringE
+__ZNK7WebCore14HTMLCollection17checkForNameMatchEPNS_7ElementEbRKNS_12AtomicStringE
+__ZN7WebCore25jsHTMLFrameSetElementColsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLFrameSetElement4colsEv
+__ZN7WebCore21JSHTMLFrameSetElementD1Ev
+__ZThn8_N7WebCore19HTMLFrameSetElementD0Ev
+__ZN7WebCore25jsHTMLFrameSetElementRowsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLFrameSetElement4rowsEv
+__ZN7WebCore30JSHTMLFrameSetElementPrototypeD1Ev
+__ZN7WebCore20jsHTMLHRElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13HTMLHRElement5alignEv
+__ZThn8_N7WebCore13HTMLHRElementD0Ev
+__ZN7WebCore22jsHTMLHRElementNoShadeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13HTMLHRElement7noShadeEv
+__ZNK7WebCore11RenderBlock16leftmostPositionEbb
+__ZNK7WebCore9RenderBox16leftmostPositionEbb
+__ZN7WebCore19jsHTMLHRElementSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13HTMLHRElement4sizeEv
+__ZSt21__unguarded_partitionIPPN7WebCore13InlineTextBoxES2_PFbPKS1_S5_EET_S8_S8_T0_T1_
+__ZN7WebCore20jsHTMLHRElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13HTMLHRElement5widthEv
+__ZN7WebCore24jsHTMLHeadElementProfileEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLHeadElement7profileEv
+__ZN7WebCore25jsHTMLHeadingElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18HTMLHeadingElement5alignEv
+__ZN7WebCore24jsHTMLHtmlElementVersionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLHtmlElement7versionEv
+__ZN7WebCore24jsHTMLIFrameElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLIFrameElement5alignEv
+__ZN3WTF6VectorISt4pairIPtjELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorISt4pairIPtjELm0EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIPtjELm0EE15reserveCapacityEm
+__ZN3WTF6VectorISt4pairIPtjELm0EE6shrinkEm
+__ZN7WebCore30jsHTMLIFrameElementFrameBorderEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsHTMLElementOuterHTMLEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11HTMLElement9outerHTMLEv
+__ZN7WebCore27jsHTMLIFrameElementLongDescEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLIFrameElementMarginWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsHTMLIFrameElementMarginHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsHTMLIFrameElementScrollingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsHTMLIFrameElementContentDocumentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsHTMLImageElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement4nameEv
+__ZN7WebCore23jsHTMLImageElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement5alignEv
+__ZN7WebCore24jsHTMLImageElementBorderEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement6borderEv
+__ZN7WebCore24jsHTMLImageElementHspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement6hspaceEv
+__ZN7WebCore23jsHTMLImageElementIsMapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement5isMapEv
+__ZN7WebCore26jsHTMLImageElementLongDescEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement8longDescEv
+__ZN7WebCore24jsHTMLImageElementUseMapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsHTMLImageElementVspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement6vspaceEv
+__ZN7WebCore10StringImpl6secureEt
+__ZN7WebCore30jsHTMLInputElementDefaultValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement12defaultValueEv
+__ZN7WebCore32jsHTMLInputElementDefaultCheckedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement14defaultCheckedEv
+__ZN7WebCore24jsHTMLInputElementAcceptEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement6acceptEv
+__ZN7WebCore27jsHTMLInputElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement9accessKeyEv
+__ZN7WebCore23jsHTMLInputElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement5alignEv
+__ZN7WebCore21jsHTMLInputElementAltEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement3altEv
+__ZN7WebCore26jsHTMLInputElementReadOnlyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsHTMLInputElementSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsHTMLInputElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsHTMLInputElementUseMapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement6useMapEv
+__ZN7WebCore40jsHTMLInputElementPrototypeFunctionClickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11HTMLElement5clickEv
+__ZNK7WebCore19CheckedRadioButtons21checkedButtonForGroupERKNS_12AtomicStringE
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPNS1_16HTMLInputElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERK
+__ZN7WebCore10HTMLParser23isindexCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
+__ZN7WebCore10HTMLParser13handleIsindexEPNS_5TokenE
+__ZN7WebCore18HTMLIsIndexElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore18HTMLIsIndexElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore16HTMLInputElement14setDefaultNameERKNS_12AtomicStringE
+__ZN7WebCore18HTMLIsIndexElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore27searchableIndexIntroductionEv
+__ZN7WebCoreL31createHTMLIsIndexElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore20JSHTMLIsIndexElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSHTMLIsIndexElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18HTMLIsIndexElementEEE
+__ZN7WebCore20JSHTMLIsIndexElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18HTMLIsIndexElementEEE
+__ZN7WebCore20JSHTMLIsIndexElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26jsHTMLIsIndexElementPromptEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18HTMLIsIndexElement6promptEv
+__ZN7WebCore24jsHTMLIsIndexElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18HTMLIsIndexElementD0Ev
+__ZN7WebCore20JSHTMLIsIndexElementD1Ev
+__ZThn8_N7WebCore18HTMLIsIndexElementD0Ev
+__ZN7WebCore29JSHTMLIsIndexElementPrototypeD1Ev
+__ZN7WebCore22jsHTMLLabelElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsHTMLLabelElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLLabelElement9accessKeyEv
+__ZN7WebCore33jsDOMWindowPrototypeFunctionCloseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow5closeEv
+__ZNK7WebCore11FrameLoader11openedByDOMEv
+__ZN7WebCore5Frame13scheduleCloseEv
+__ZN7WebCore6Chrome15closeWindowSoonEv
+__ZN7WebCore25jsHTMLLabelElementHtmlForEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLLabelElement7htmlForEv
+__ZN7WebCore23jsHTMLLegendElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn8_N7WebCore17HTMLLegendElementD0Ev
+__ZN7WebCore28jsHTMLLegendElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLLegendElement9accessKeyEv
+__ZN7WebCore24jsHTMLLegendElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLLegendElement5alignEv
+__ZN7WebCore25jsHTMLLinkElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement8disabledEv
+__ZN7WebCore24jsHTMLLinkElementCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement7charsetEv
+__ZN7WebCore19HTMLOptGroupElement6detachEv
+__ZN7WebCore25jsHTMLLinkElementHreflangEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement8hreflangEv
+__ZN7WebCore19HTMLOptGroupElementD0Ev
+__ZN7WebCore22jsHTMLLinkElementMediaEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement5mediaEv
+__ZN7WebCore20jsHTMLLinkElementRevEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement3revEv
+__ZN7WebCore23jsHTMLLinkElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLLinkElement6targetEv
+__ZN7WebCore21jsHTMLMapElementAreasEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14HTMLMapElement5areasEv
+__ZN7WebCore20jsHTMLMapElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14HTMLMapElement4nameEv
+__ZN7WebCoreL15menuConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore15HTMLMenuElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15HTMLMenuElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore15HTMLMenuElement17endTagRequirementEv
+__ZNK7WebCore15HTMLMenuElement11tagPriorityEv
+__ZN7WebCoreL28createHTMLMenuElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore17JSHTMLMenuElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSHTMLMenuElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLMenuElementEEE
+__ZN7WebCore17JSHTMLMenuElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15HTMLMenuElementEEE
+__ZN7WebCore17JSHTMLMenuElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24jsHTMLMenuElementCompactEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLMenuElement7compactEv
+__ZN7WebCore17JSHTMLMenuElementD1Ev
+__ZThn8_N7WebCore15HTMLMenuElementD0Ev
+__ZN7WebCore15HTMLMenuElementD0Ev
+__ZThn8_N7WebCore15HTMLMetaElementD0Ev
+__ZN7WebCore26JSHTMLMenuElementPrototypeD1Ev
+__ZN7WebCore23jsHTMLMetaElementSchemeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15HTMLMetaElement6schemeEv
+__ZN7WebCore20jsHTMLModElementCiteEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14HTMLModElement4citeEv
+__ZThn8_N7WebCore14HTMLModElementD0Ev
+__ZN7WebCore24jsHTMLModElementDateTimeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14HTMLModElement8dateTimeEv
+__ZN7WebCore25jsHTMLOListElementCompactEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLOListElement7compactEv
+__ZN7WebCore23jsHTMLOListElementStartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsHTMLOListElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLOListElement4typeEv
+__ZN7WebCore23jsHTMLObjectElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLObjectElementCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement4codeEv
+__ZN7WebCore24jsHTMLObjectElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsHTMLObjectElementArchiveEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement7archiveEv
+__ZN7WebCore25jsHTMLObjectElementBorderEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement6borderEv
+__ZN7WebCore27jsHTMLObjectElementCodeBaseEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement8codeBaseEv
+__ZN7WebCore27jsHTMLObjectElementCodeTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement8codeTypeEv
+__ZN7WebCore23jsHTMLObjectElementDataEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement4dataEv
+__ZN7WebCore26jsHTMLObjectElementDeclareEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement7declareEv
+__ZN7WebCore25jsHTMLObjectElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLObjectElementHspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement6hspaceEv
+__ZN7WebCore26jsHTMLObjectElementStandbyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement7standbyEv
+__ZN7WebCore23jsHTMLObjectElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLObjectElementUseMapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement6useMapEv
+__ZN7WebCore25jsHTMLObjectElementVspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLObjectElement6vspaceEv
+__ZN7WebCore24jsHTMLObjectElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLObjectElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsHTMLObjectElementContentDocumentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL32createHTMLOptGroupElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore21JSHTMLOptGroupElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSHTMLOptGroupElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLOptGroupElementEEE
+__ZN7WebCore21JSHTMLOptGroupElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19HTMLOptGroupElementEEE
+__ZN7WebCore21JSHTMLOptGroupElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29jsHTMLOptGroupElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLOptGroupElementD1Ev
+__ZThn8_N7WebCore19HTMLOptGroupElementD0Ev
+__ZN7WebCore26jsHTMLOptGroupElementLabelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLOptGroupElement5labelEv
+__ZN7WebCore30JSHTMLOptGroupElementPrototypeD1Ev
+__ZN7WebCore23jsHTMLOptionElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn8_N7WebCore17HTMLOptionElementD0Ev
+__ZN7WebCore34jsHTMLOptionElementDefaultSelectedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLOptionElement15defaultSelectedEv
+__ZN7WebCore23jsHTMLOptionElementTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLOptionElement4textEv
+__ZN7WebCore24jsHTMLOptionElementIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsHTMLOptionElementLabelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLOptionElement5labelEv
+__ZN7WebCore32JSHTMLOptionsCollectionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore23JSHTMLOptionsCollection9classInfoEv
+__ZN7WebCore16HTMLInputElement39unregisterForActivationCallbackIfNeededEv
+__ZN7WebCore27jsHTMLParagraphElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLParagraphElement5alignEv
+__ZN7WebCore27jsHTMLParamElementValueTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLParamElement9valueTypeEv
+__ZN7WebCore22jsHTMLParamElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLParamElement4typeEv
+__ZN7WebCore21jsHTMLPreElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14HTMLPreElement5widthEv
+__ZN7WebCoreL16quoteConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore16HTMLQuoteElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16HTMLQuoteElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore16HTMLQuoteElement17endTagRequirementEv
+__ZNK7WebCore16HTMLQuoteElement11tagPriorityEv
+__ZN7WebCore16HTMLQuoteElement20insertedIntoDocumentEv
+__ZN7WebCoreL29createHTMLQuoteElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore18JSHTMLQuoteElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSHTMLQuoteElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLQuoteElementEEE
+__ZN7WebCore18JSHTMLQuoteElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16HTMLQuoteElementEEE
+__ZN7WebCore18JSHTMLQuoteElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsHTMLQuoteElementCiteEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLQuoteElement4citeEv
+__ZN7WebCore18JSHTMLQuoteElementD1Ev
+__ZThn8_N7WebCore16HTMLQuoteElementD0Ev
+__ZN7WebCore16HTMLQuoteElementD0Ev
+__ZN7WebCoreL34createHTMLBlockquoteElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore23JSHTMLBlockquoteElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSHTMLBlockquoteElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21HTMLBlockquoteElementEEE
+__ZN7WebCore23JSHTMLBlockquoteElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21HTMLBlockquoteElementEEE
+__ZN7WebCore23JSHTMLBlockquoteElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27jsHTMLBlockquoteElementCiteEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21HTMLBlockquoteElement4citeEv
+__ZN7WebCore23JSHTMLBlockquoteElementD1Ev
+__ZThn8_N7WebCore21HTMLBlockquoteElementD0Ev
+__ZN7WebCore27JSHTMLQuoteElementPrototypeD1Ev
+__ZN7WebCore23jsHTMLScriptElementTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLScriptElement4textEv
+__ZN7WebCore32JSHTMLBlockquoteElementPrototypeD1Ev
+__ZN7WebCore26jsHTMLScriptElementCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLScriptElement7charsetEv
+__ZN7WebCore24jsHTMLScriptElementDeferEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLScriptElement5deferEv
+__ZN7WebCore26jsHTMLScriptElementHtmlForEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLScriptElement7htmlForEv
+__ZN7WebCore24jsHTMLScriptElementEventEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLScriptElement5eventEv
+__ZN7WebCore23jsHTMLSelectElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsHTMLSelectElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsHTMLSelectElementMultipleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLSelectElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLSelectElementSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17HTMLSelectElement18dispatchFocusEventEv
+__ZN7WebCore17HTMLSelectElement26listBoxDefaultEventHandlerEPNS_5EventE
+__ZN7WebCore17HTMLSelectElement17dispatchBlurEventEv
+__ZN7WebCore42jsHTMLSelectElementPrototypeFunctionRemoveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19JSHTMLSelectElement6removeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13toHTMLElementEN3JSC7JSValueE
+__ZN7WebCore17HTMLSelectElement6removeEi
+__ZN7WebCore39jsHTMLSelectElementPrototypeFunctionAddEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26jsHTMLStyleElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLStyleElement8disabledEv
+__ZN7WebCore23jsHTMLStyleElementMediaEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsHTMLStyleElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL36createHTMLTableCaptionElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore25JSHTMLTableCaptionElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSHTMLTableCaptionElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23HTMLTableCaptionElementEEE
+__ZN7WebCore25JSHTMLTableCaptionElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23HTMLTableCaptionElementEEE
+__ZN7WebCore25JSHTMLTableCaptionElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30jsHTMLTableCaptionElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore23HTMLTableCaptionElement5alignEv
+__ZN7WebCore25JSHTMLTableCaptionElementD1Ev
+__ZThn8_N7WebCore23HTMLTableCaptionElementD0Ev
+__ZN7WebCore31jsHTMLTableCellElementCellIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore20HTMLTableCellElement9cellIndexEv
+__ZN7WebCore34JSHTMLTableCaptionElementPrototypeD1Ev
+__ZN7WebCore26jsHTMLTableCellElementAbbrEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsHTMLTableCellElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement5alignEv
+__ZN7WebCore26jsHTMLTableCellElementAxisEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsHTMLTableCellElementBgColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement7bgColorEv
+__ZN7WebCore24jsHTMLTableCellElementChEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement2chEv
+__ZN7WebCore27jsHTMLTableCellElementChOffEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement5chOffEv
+__ZN7WebCore29jsHTMLTableCellElementColSpanEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsHTMLTableCellElementHeadersEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsHTMLTableCellElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement6heightEv
+__ZN7WebCore28jsHTMLTableCellElementNoWrapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement6noWrapEv
+__ZN7WebCore29jsHTMLTableCellElementRowSpanEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsHTMLTableCellElementScopeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsHTMLTableCellElementVAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement6vAlignEv
+__ZN7WebCore27jsHTMLTableCellElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20HTMLTableCellElement5widthEv
+__ZN7WebCore26jsHTMLTableColElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableColElement5alignEv
+__ZThn8_N7WebCore19HTMLTableColElementD0Ev
+__ZN7WebCore23jsHTMLTableColElementChEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableColElement2chEv
+__ZN7WebCore26jsHTMLTableColElementChOffEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableColElement5chOffEv
+__ZN7WebCore25jsHTMLTableColElementSpanEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsHTMLTableColElementVAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableColElement6vAlignEv
+__ZN7WebCore26jsHTMLTableColElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableColElement5widthEv
+__ZN7WebCore25jsHTMLTableElementCaptionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLTableSectionElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore23HTMLTableSectionElement5alignEv
+__ZN7WebCore23jsHTMLTableElementTFootEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLTableElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement5alignEv
+__ZN7WebCore25jsHTMLTableElementBgColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement7bgColorEv
+__ZN7WebCore24jsHTMLTableElementBorderEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement6borderEv
+__ZN7WebCore29jsHTMLTableElementCellPaddingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement11cellPaddingEv
+__ZN7WebCore29jsHTMLTableElementCellSpacingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement11cellSpacingEv
+__ZN7WebCore23jsHTMLTableElementFrameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement5frameEv
+__ZN7WebCore23jsHTMLTableElementRulesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLTableElementSummaryEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLTableElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLTableElement5widthEv
+__ZN7WebCore46jsHTMLTableElementPrototypeFunctionCreateTHeadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16HTMLTableElement11createTHeadEv
+__ZN7WebCore16HTMLTableElement8setTHeadEN3WTF10PassRefPtrINS_23HTMLTableSectionElementEEERi
+__ZN7WebCore16HTMLTableElement11deleteTHeadEv
+__ZN7WebCore46jsHTMLTableElementPrototypeFunctionDeleteTHeadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZThn8_N7WebCore23HTMLTableSectionElementD0Ev
+__ZN7WebCore46jsHTMLTableElementPrototypeFunctionCreateTFootEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16HTMLTableElement11createTFootEv
+__ZN7WebCore16HTMLTableElement8setTFootEN3WTF10PassRefPtrINS_23HTMLTableSectionElementEEERi
+__ZN7WebCore16HTMLTableElement11deleteTFootEv
+__ZN7WebCore46jsHTMLTableElementPrototypeFunctionDeleteTFootEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore48jsHTMLTableElementPrototypeFunctionCreateCaptionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16HTMLTableElement13createCaptionEv
+__ZN7WebCore16HTMLTableElement10setCaptionEN3WTF10PassRefPtrINS_23HTMLTableCaptionElementEEERi
+__ZN7WebCore16HTMLTableElement13deleteCaptionEv
+__ZN7WebCore48jsHTMLTableElementPrototypeFunctionDeleteCaptionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16HTMLTableElement8lastBodyEv
+__ZN7WebCore44jsHTMLTableElementPrototypeFunctionDeleteRowEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16HTMLTableElement9deleteRowEiRi
+__ZN7WebCore23HTMLTableRowsCollection7lastRowEPNS_16HTMLTableElementE
+__ZN7WebCore36jsHTMLTableRowElementSectionRowIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableRowElement15sectionRowIndexEv
+__ZN7WebCore26jsHTMLTableRowElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableRowElement5alignEv
+__ZN7WebCore28jsHTMLTableRowElementBgColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableRowElement7bgColorEv
+__ZN7WebCore23jsHTMLTableRowElementChEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableRowElement2chEv
+__ZN7WebCore26jsHTMLTableRowElementChOffEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableRowElement5chOffEv
+__ZN7WebCore27jsHTMLTableRowElementVAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTableRowElement6vAlignEv
+__ZN7WebCore48jsHTMLTableRowElementPrototypeFunctionInsertCellEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19HTMLTableRowElement10insertCellEiRi
+__ZN7WebCore48jsHTMLTableRowElementPrototypeFunctionDeleteCellEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19HTMLTableRowElement10deleteCellEiRi
+__ZN7WebCore27jsHTMLTableSectionElementChEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore23HTMLTableSectionElement2chEv
+__ZN7WebCore30jsHTMLTableSectionElementChOffEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore23HTMLTableSectionElement5chOffEv
+__ZN7WebCore31jsHTMLTableSectionElementVAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore23HTMLTableSectionElement6vAlignEv
+__ZN7WebCore51jsHTMLTableSectionElementPrototypeFunctionInsertRowEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore23HTMLTableSectionElement9insertRowEiRi
+__ZN7WebCore51jsHTMLTableSectionElementPrototypeFunctionDeleteRowEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore23HTMLTableSectionElement9deleteRowEiRi
+__ZN7WebCore33jsHTMLTextAreaElementDefaultValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLTextAreaElementFormEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLTextAreaElementAccessKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLTextAreaElement9accessKeyEv
+__ZN7WebCore25jsHTMLTextAreaElementColsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsHTMLTextAreaElementDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLTextAreaElementNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsHTMLTextAreaElementReadOnlyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLTextAreaElementRowsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLTextAreaElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore44jsHTMLTextAreaElementPrototypeFunctionSelectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19HTMLTextAreaElement6selectEv
+__ZN7WebCore25jsHTMLUListElementCompactEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLUListElement7compactEv
+__ZN7WebCore11MediaPlayer12supportsTypeENS_11ContentTypeE
+__ZN7WebCoreL20mimeCommonTypesCacheEv
+__ZN7WebCore17DOMImplementation14isTextMIMETypeERKNS_6StringE
+__ZN7WebCore11SVGDocumentC1EPNS_5FrameE
+__ZN7WebCore11SVGDocumentC2EPNS_5FrameE
+__ZNK7WebCore11SVGDocument13isSVGDocumentEv
+__ZN7WebCore13JSSVGDocument15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSSVGDocumentC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11SVGDocumentEEE
+__ZN7WebCore13JSSVGDocumentC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11SVGDocumentEEE
 __ZN7WebCore17SVGElementFactory16createSVGElementERKNS_13QualifiedNameEPNS_8DocumentEb
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFPNS1_10SVGElementEPNS1_8DocumentEbENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSC_IS9_EEE3getERKS3_
-__ZN7WebCore14svgConstructorEPNS_8DocumentEb
+__ZN7WebCoreL6addTagERKNS_13QualifiedNameEPFN3WTF10PassRefPtrINS_10SVGElementEEES2_PNS_8DocumentEbE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPFNS_10PassRefPtrINS1_10SVGElementEEERKNS1_13QualifiedNameEPNS1_8DocumentEbENS_7P
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PFNS_10PassRefPtrINS1_10SVGElementEEERKNS1_13QualifiedNameEPNS1_8Doc
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFNS_10PassRefPtrINS1_10SVGElementEEERKNS1_13QualifiedNameEPNS1_8DocumentEbENS_7
+__ZN7WebCoreL14svgConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore13SVGSVGElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore12SVGLocatableC2Ev
 __ZN7WebCore25SVGStyledLocatableElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore16SVGStyledElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore10SVGElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore10SVGElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore11SVGStylableC2Ev
 __ZN7WebCore8SVGTestsC2Ev
 __ZN7WebCore12SVGLangSpaceC2Ev
 __ZN7WebCore28SVGExternalResourcesRequiredC2Ev
 __ZN7WebCore15SVGFitToViewBoxC2Ev
 __ZN7WebCore22SVGPreserveAspectRatioC1Ev
+__ZN7WebCore22SVGPreserveAspectRatioC2Ev
 __ZN7WebCore13SVGZoomAndPanC2Ev
-__ZN7WebCore9SVGLengthC1EPKNS_16SVGStyledElementENS_13SVGLengthModeERKNS_6StringE
+__ZN7WebCore9SVGLengthC1ENS_13SVGLengthModeERKNS_6StringE
+__ZN7WebCore9SVGLengthC2ENS_13SVGLengthModeERKNS_6StringE
 __ZN7WebCore9SVGLength16setValueAsStringERKNS_6StringE
-__ZN7WebCore13TimeSchedulerC1EPNS_8DocumentE
-__ZN7WebCore8SVGTimerC1EPNS_13TimeSchedulerEdb
+__ZN7WebCore19SVGAnimatedPropertyINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_15widthAttrStri
 __ZN7WebCore11parseNumberERPKtS1_Rfb
 __ZN7WebCore18stringToLengthTypeERKNS_6StringE
-__ZN7WebCore13SVGSVGElement17setWidthBaseValueENS_9SVGLengthE
-__ZN7WebCore8Document19accessSVGExtensionsEv
-__ZN7WebCore21SVGDocumentExtensionsC1EPNS_8DocumentE
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapINS_9SVGLengthEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS4_IPNS_10StringImplET_NS_10StringHashENS3_10HashTraitsIS9_EENSC_ISA_EEEENS3_7PtrHashIS7_EENSC_IS7_EENSC_ISG_EEEEvE14s_baseValueMap
-__ZN7WebCore13SVGSVGElement8setWidthENS_9SVGLengthE
-__ZN7WebCore13SVGSVGElement18setHeightBaseValueENS_9SVGLengthE
-__ZN7WebCore13SVGSVGElement9setHeightENS_9SVGLengthE
-__ZNK7WebCore10SVGElement12isSVGElementEv
-__ZN7WebCore18createJSSVGWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFPNS1_6JSNodeEPN3KJS9ExecStateENS_10PassRefPtrINS1_10SVGElementEEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSG_ISD_EEE3getERKS3_
-__ZN7WebCore16createSVGWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore24JSSVGSVGElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSSVGSVGElementC1EPN3KJS8JSObjectEPNS_13SVGSVGElementE
-__ZN7WebCore12JSSVGElementC1EPN3KJS8JSObjectEPNS_10SVGElementE
-__ZN7WebCore15JSSVGSVGElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore12JSSVGElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24JSSVGSVGElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore15JSSVGSVGElement9classInfoEv
+__ZN7WebCore17SMILTimeContainerC1EPNS_13SVGSVGElementE
+__ZN7WebCore17SMILTimeContainerC2EPNS_13SVGSVGElementE
 __ZN7WebCore10SVGElement16attributeChangedEPNS_9AttributeEb
 __ZNK7WebCore16SVGStyledElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
 __ZN7WebCore16SVGStyledElement32cssPropertyIdForSVGAttributeNameERKNS_13QualifiedNameE
-__ZN7WebCore25mapAttributeToCSSPropertyEPN3WTF7HashMapIPNS_16AtomicStringImplEiNS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EENS6_IiEEEERKNS_13QualifiedNameEPKc
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEiNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IiEEE3getERKS3_
 __ZN7WebCore13SVGSVGElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZNK7WebCore25SVGStyledLocatableElement22nearestViewportElementEv
-__ZN7WebCore12SVGLocatable22nearestViewportElementEPKNS_16SVGStyledElementE
+__ZN7WebCore12SVGLocatable22nearestViewportElementEPKNS_10SVGElementE
 __ZN7WebCore8SVGTests20parseMappedAttributeEPNS_15MappedAttributeE
 __ZN7WebCore12SVGLangSpace20parseMappedAttributeEPNS_15MappedAttributeE
 __ZN7WebCore28SVGExternalResourcesRequired20parseMappedAttributeEPNS_15MappedAttributeE
@@ -9267,289 +13008,251 @@ __ZN7WebCore10SVGElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZN7WebCore13SVGSVGElement19svgAttributeChangedERKNS_13QualifiedNameE
 __ZN7WebCore16SVGStyledElement19svgAttributeChangedERKNS_13QualifiedNameE
 __ZNK7WebCore16SVGStyledElement34invalidateResourcesInAncestorChainEv
-__ZNK7WebCore16SVGStyledElement21updateElementInstanceEPNS_21SVGDocumentExtensionsE
-__ZNK7WebCore21SVGDocumentExtensions19instancesForElementEPNS_10SVGElementE
-__ZN3WTF7HashMapIPN7WebCore10SVGElementEPNS_7HashSetIPNS1_18SVGElementInstanceENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEENS7_IS3_EENS9_IS3_EENS9_ISC_EEE3addERKS3_RKSC_
-__ZNK7WebCore13SVGSVGElement5widthEv
-__ZNK7WebCore9SVGLength5valueEv
-__ZNK7WebCore13SVGSVGElement6heightEv
+__ZN7WebCore18SVGElementInstance31invalidateAllInstancesOfElementEPNS_10SVGElementE
+__ZNK7WebCore10SVGElement19instancesForElementEv
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_EC1ER
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_EC2ER
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15de
+__ZNK7WebCore10SVGElement12isSVGElementEv
 __ZN7WebCore13SVGSVGElement20insertedIntoDocumentEv
+__ZN7WebCore8Document19accessSVGExtensionsEv
+__ZN7WebCore21SVGDocumentExtensionsC1EPNS_8DocumentE
+__ZN7WebCore21SVGDocumentExtensionsC2EPNS_8DocumentE
 __ZN7WebCore21SVGDocumentExtensions16addTimeContainerEPNS_13SVGSVGElementE
 __ZN3WTF7HashSetIPN7WebCore13SVGSVGElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore13SVGSVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore13SVGSVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore13SVGSVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocat
+__ZN3WTF9HashTableIPN7WebCore13SVGSVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dealloc
 __ZN7WebCore10SVGElement20insertedIntoDocumentEv
 __ZNK7WebCore10SVGElement2idEv
 __ZN7WebCore15SVGURIReference9getTargetERKNS_6StringE
 __ZNK7WebCore21SVGDocumentExtensions17isPendingResourceERKNS_12AtomicStringE
-__ZN7WebCore12parseUASheetIA359_cEEPNS_13CSSStyleSheetERKT_
 __ZNK7WebCore10SVGElement12isShadowNodeEv
 __ZN7WebCore13SVGSVGElement16rendererIsNeededEPNS_11RenderStyleE
 __ZN7WebCore13SVGSVGElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
 __ZNK7WebCore13SVGSVGElement14isOutermostSVGEv
 __ZN7WebCore13RenderSVGRootC1EPNS_16SVGStyledElementE
-__ZN7WebCore15defsConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGDefsElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore13RenderSVGRootC2EPNS_16SVGStyledElementE
+__ZNK7WebCore13RenderSVGRoot15virtualChildrenEv
+__ZN7WebCoreL15rectConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGRectElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore29SVGStyledTransformableElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore16SVGTransformableC2Ev
 __ZN7WebCore16SVGTransformListC1ERKNS_13QualifiedNameE
-__ZN7WebCore17createDefsWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore25JSSVGDefsElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSSVGDefsElementC1EPN3KJS8JSObjectEPNS_14SVGDefsElementE
-__ZN7WebCore16JSSVGDefsElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSSVGDefsElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16JSSVGDefsElement9classInfoEv
-__ZN7WebCore29SVGStyledTransformableElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore16SVGTransformListC2ERKNS_13QualifiedNameE
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEiNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IiEEE3getERKS3_
+__ZN7WebCore14SVGRectElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore10SVGElement27accessDocumentSVGExtensionsEv
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplENS1_9SVGLengthENS1_10StringHashENS_10HashTraitsIS6_EENS9_IS7_
+__ZNK7WebCore10SVGElement28setSynchronizedSVGAttributesEb
+__ZN7WebCore14SVGRectElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore10SVGElement26updateAnimatedSVGAttributeERKNS_6StringE
+__ZNK7WebCore9SVGLength5valueEPKNS_10SVGElementE
+__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_PKNS1_23SVGAnimatedPropertyBaseEENS_18PairFirstExtractorIS7_EENS1_10StringHashE
+__ZN7WebCore16SVGStyledElement15childrenChangedEbPNS_4NodeES2_i
 __ZNK7WebCore10SVGElement25childShouldCreateRendererEPNS_4NodeE
-__ZNK7WebCore14SVGDefsElement7isValidEv
+__ZNK7WebCore14SVGRectElement7isValidEv
 __ZNK7WebCore8SVGTests7isValidEv
 __ZN7WebCore16SVGStyledElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore14SVGDefsElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore24RenderSVGHiddenContainerC1EPNS_16SVGStyledElementE
-__ZN7WebCore18RenderSVGContainerC1EPNS_16SVGStyledElementE
-__ZNK7WebCore18RenderSVGContainer10firstChildEv
+__ZN7WebCore29SVGStyledTransformableElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore10RenderPathC1EPNS_29SVGStyledTransformableElementE
+__ZN7WebCore10RenderPathC2EPNS_29SVGStyledTransformableElementE
+__ZN7WebCore20RenderSVGModelObjectC2EPNS_16SVGStyledElementE
+__ZN7WebCore13RenderSVGRoot15virtualChildrenEv
 __ZNK7WebCore13RenderSVGRoot9isSVGRootEv
-__ZN7WebCore16SVGStyledElement15childrenChangedEb
-__ZN7WebCore15JSSVGSVGElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore12JSSVGElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore12gConstructorEPNS_8DocumentEb
-__ZN7WebCore11SVGGElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore14createGWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore22JSSVGGElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore13JSSVGGElementC1EPN3KJS8JSObjectEPNS_11SVGGElementE
-__ZN7WebCore15rectConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGRectElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore17createRectWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore25JSSVGRectElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSSVGRectElementC1EPN3KJS8JSObjectEPNS_14SVGRectElementE
-__ZN7WebCore16JSSVGRectElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSSVGRectElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore10SVGElement21finishParsingChildrenEv
+__ZN7WebCore10SVGElement26sendSVGLoadEventIfPossibleEb
+__ZN7WebCore10SVGElement27haveLoadedRequiredResourcesEv
+__ZThn112_NK7WebCore17HTMLScriptElement20sourceAttributeValueEv
+__ZThn112_NK7WebCore17HTMLScriptElement13scriptCharsetEv
+__ZN7WebCore12XMLTokenizer12pauseParsingEv
+__ZN3WTF5DequeIPN7WebCore16PendingCallbacks15PendingCallbackEE14expandCapacityEv
+__ZThn16_N7WebCore12XMLTokenizer14notifyFinishedEPNS_14CachedResourceE
+__ZN7WebCore12XMLTokenizer14notifyFinishedEPNS_14CachedResourceE
+__ZN7WebCore10SVGElement15eventParentNodeEv
+__ZN7WebCore12XMLTokenizer13resumeParsingEv
+__ZN7WebCore16PendingCallbacks25PendingCharactersCallback4callEPNS_12XMLTokenizerE
+__ZN7WebCore16PendingCallbacks25PendingCharactersCallbackD0Ev
+__ZN7WebCore16PendingCallbacks29PendingStartElementNSCallback4callEPNS_12XMLTokenizerE
+__ZN7WebCore16PendingCallbacks29PendingStartElementNSCallbackD0Ev
+__ZN7WebCore16PendingCallbacks27PendingEndElementNSCallback4callEPNS_12XMLTokenizerE
+__ZN7WebCore16PendingCallbacks27PendingEndElementNSCallbackD0Ev
+__ZN7WebCoreL28processingInstructionHandlerEPvPKhS2_
+__ZN7WebCore12XMLTokenizer21processingInstructionEPKhS2_
+__ZN7WebCore21ProcessingInstructionC1EPNS_8DocumentERKNS_6StringES5_
+__ZN7WebCore21ProcessingInstructionC2EPNS_8DocumentERKNS_6StringES5_
+__ZN7WebCore21ProcessingInstruction20insertedIntoDocumentEv
+__ZN7WebCore21ProcessingInstruction15checkStyleSheetEv
+__ZN7WebCore21ProcessingInstruction21finishParsingChildrenEv
+__ZN7WebCoreL21internalSubsetHandlerEPvPKhS2_S2_
+__ZN7WebCore12XMLTokenizer14internalSubsetEPKhS2_S2_
+__ZN7WebCore8Document18determineParseModeEv
+__ZN7WebCoreL16getEntityHandlerEPvPKh
+__ZN7WebCoreL21externalSubsetHandlerEPvPKhS2_S2_
+__ZN7WebCoreL17cdataBlockHandlerEPvPKhi
+__ZN7WebCore12XMLTokenizer10cdataBlockEPKhi
+__ZN7WebCore12CDATASectionC1EPNS_8DocumentERKNS_6StringE
+__ZN7WebCore12CDATASectionC2EPNS_8DocumentERKNS_6StringE
+__ZNK7WebCore21ProcessingInstruction8nodeTypeEv
+__ZN7WebCore43jsDocumentPrototypeFunctionCreateNSResolverEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document16createNSResolverEPNS_4NodeE
+__ZN7WebCore14XPathEvaluator16createNSResolverEPNS_4NodeE
+__ZN7WebCore21NativeXPathNSResolverC1EN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore21NativeXPathNSResolverC2EN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_15XPathNSResolverE
+__ZN7WebCore17JSXPathNSResolver15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSXPathNSResolverC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15XPathNSResolverEEE
+__ZN7WebCore17JSXPathNSResolverC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15XPathNSResolverEEE
+__ZNK7WebCore17JSXPathNSResolver9classInfoEv
+__ZNK7WebCore12CDATASection8nodeTypeEv
+__ZN7WebCore41jsXPathResultPrototypeFunctionIterateNextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore18jsAttrOwnerElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13JSSVGDocument18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22JSSVGDocumentPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore13JSSVGDocument9classInfoEv
+__ZN7WebCore18createJSSVGWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplEPFPNS1_6JSNodeEPN3JSC9ExecStateENS_10PassRefPtrINS1_10SVGElementEEEENS_7PtrHashIS
+__ZN3WTF9HashTableIPN7WebCore16AtomicStringImplESt4pairIS3_PFPNS1_6JSNodeEPN3JSC9ExecStateENS_10PassRefPtrINS1_10SVGElementEEEE
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplEPFPNS1_6JSNodeEPN3JSC9ExecStateENS_10PassRefPtrINS1_10SVGElementEEEENS_7PtrHashI
+__ZN7WebCoreL27createSVGRectElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGRectElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSSVGElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGRectElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGRectElementEEE
+__ZN7WebCore16JSSVGRectElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGRectElementEEE
+__ZN7WebCore12JSSVGElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10SVGElementEEE
+__ZN7WebCore16JSSVGRectElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore12JSSVGElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGRectElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore16JSSVGRectElement9classInfoEv
-__ZN7WebCore14SVGRectElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore14SVGRectElement13setXBaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGRectElement4setXENS_9SVGLengthE
-__ZN7WebCore14SVGRectElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore14SVGRectElement13setYBaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGRectElement4setYENS_9SVGLengthE
-__ZN7WebCore14SVGRectElement17setWidthBaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGRectElement8setWidthENS_9SVGLengthE
-__ZNK7WebCore14SVGRectElement5widthEv
-__ZN7WebCore14SVGRectElement18setHeightBaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGRectElement9setHeightENS_9SVGLengthE
-__ZNK7WebCore14SVGRectElement6heightEv
+__ZN7WebCore29SVGStyledTransformableElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZN7WebCore9CSSParser13parseSVGPaintEv
-__ZN7WebCore13JSSVGGElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22JSSVGGElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore13JSSVGGElement9classInfoEv
-__ZN7WebCore11SVGGElement15childrenChangedEb
-__ZN7WebCore13RenderSVGRoot6layoutEv
-__ZN7WebCore13RenderSVGRoot12calcViewportEv
-__ZNK7WebCore9SVGLength8unitTypeEv
-__ZN7WebCore13RenderSVGRoot14calcPrefWidthsEv
-__ZN7WebCore13RenderSVGRoot27absoluteClippedOverflowRectEv
-__ZN7WebCore24RenderSVGHiddenContainer27absoluteClippedOverflowRectEv
-__ZNK7WebCore13SVGSVGElement12currentScaleEv
-__ZN7WebCore24RenderSVGHiddenContainer6layoutEv
-__ZNK7WebCore13RenderSVGRoot10lineHeightEbb
-__ZNK7WebCore13RenderSVGRoot16baselinePositionEbb
-__ZN7WebCore15textConstructorEPNS_8DocumentEb
+__ZNK7WebCore16SVGStyledElement8isStyledEv
+__ZN7WebCore16SVGStyledElement14canvasResourceEv
+__ZN7WebCore8SVGTests16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore12SVGLangSpace16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore28SVGExternalResourcesRequired16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore29SVGStyledTransformableElement16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore16SVGTransformable16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore16SVGStyledElement16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore42jsDocumentPrototypeFunctionCreateElementNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCoreL15textConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore14SVGTextElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore25SVGTextPositioningElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore21SVGTextContentElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore13SVGLengthListC1ERKNS_13QualifiedNameE
+__ZN7WebCore13SVGLengthListC2ERKNS_13QualifiedNameE
 __ZN7WebCore13SVGNumberListC1ERKNS_13QualifiedNameE
-__ZN7WebCore17createTextWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore25JSSVGTextElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore36JSSVGTextPositioningElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSSVGTextElementC1EPN3KJS8JSObjectEPNS_14SVGTextElementE
-__ZN7WebCore27JSSVGTextPositioningElementC2EPN3KJS8JSObjectEPNS_25SVGTextPositioningElementE
-__ZN7WebCore23JSSVGTextContentElementC2EPN3KJS8JSObjectEPNS_21SVGTextContentElementE
-__ZN7WebCore16JSSVGTextElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSSVGTextPositioningElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSSVGTextContentElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSSVGTextElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore32JSSVGTextContentElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore13SVGNumberListC2ERKNS_13QualifiedNameE
+__ZN7WebCoreL27createSVGTextElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGTextElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore36JSSVGTextPositioningElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSSVGTextPositioningElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSSVGTextContentElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSSVGTextContentElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGTextElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGTextElementEEE
+__ZN7WebCore16JSSVGTextElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGTextElementEEE
+__ZN7WebCore27JSSVGTextPositioningElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_25SVGTextPositioningElementEEE
+__ZN7WebCore23JSSVGTextContentElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21SVGTextContentElementEEE
+__ZN7WebCore16JSSVGTextElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSSVGTextPositioningElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23JSSVGTextContentElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGTextElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore32JSSVGTextContentElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore16JSSVGTextElement9classInfoEv
 __ZN7WebCore14SVGTextElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZN7WebCore25SVGTextPositioningElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore21SVGTextContentElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore25SVGTextPositioningElement10xBaseValueEv
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapIPNS_13SVGLengthListEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS5_IPNS_10StringImplET_NS_10StringHashENS4_10HashTraitsISA_EENSD_ISB_EEEENS4_7PtrHashIS8_EENSD_IS8_EENSD_ISH_EEEEvE14s_baseValueMap
-__ZNK7WebCore25SVGTextPositioningElement1xEv
-__ZN7WebCore13SVGLengthList5parseERKNS_6StringEPKNS_16SVGStyledElementENS_13SVGLengthModeE
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEPNS1_13SVGLengthListENS1_10StringHashENS_10HashTraitsIS6_EENS
+__ZN7WebCore13SVGLengthList5parseERKNS_6StringENS_13SVGLengthModeE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_9SVGLengthEEEEELm0EE14shrinkCapacityEm
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_9SVGLengthEEEEELm0EE14expandCapacityEmPKS6_
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_9SVGLengthEEEEELm0EE14expandCapacityEm
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_9SVGLengthEEEEELm0EE15reserveCapacityEm
-__ZNK7WebCore25SVGTextPositioningElement10yBaseValueEv
-__ZNK7WebCore25SVGTextPositioningElement1yEv
-__ZNK7WebCore11SVGGElement7isValidEv
-__ZN7WebCore11SVGGElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore31RenderSVGTransformableContainerC1EPNS_29SVGStyledTransformableElementE
-__ZNK7WebCore18RenderSVGContainer15canHaveChildrenEv
-__ZNK7WebCore14SVGRectElement7isValidEv
+__ZN7WebCore14SVGTextElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCoreL26createSVGSVGElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore15JSSVGSVGElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSSVGSVGElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGSVGElementEEE
+__ZN7WebCore15JSSVGSVGElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGSVGElementEEE
+__ZN7WebCore15JSSVGSVGElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24JSSVGSVGElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore15JSSVGSVGElement9classInfoEv
 __ZN7WebCore16CSSStyleSelector16applySVGPropertyEiPNS_8CSSValueE
+__ZN7WebCore14SVGRenderStyleC1ERKS0_
 __ZN7WebCore14SVGRenderStyleC2ERKS0_
+__ZNK7WebCore8SVGPaint10isSVGPaintEv
+__ZN7WebCore7DataRefINS_13StyleFillDataEE6accessEv
 __ZN7WebCore13StyleFillDataC1ERKS0_
-__ZN7WebCore29SVGStyledTransformableElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore10RenderPathC1EPNS_11RenderStyleEPNS_29SVGStyledTransformableElementE
-__ZN7WebCore18RenderSVGContainer8addChildEPNS_12RenderObjectES2_
-__ZN7WebCore18RenderSVGContainer15insertChildNodeEPNS_12RenderObjectES2_b
-__ZN7WebCore18RenderSVGContainer15appendChildNodeEPNS_12RenderObjectEb
+__ZN7WebCore13StyleFillDataC2ERKS0_
+__ZN3WTF10RefCountedIN7WebCore8CSSValueEE5derefEv
+__ZNK7WebCore14SVGRenderStyleeqERKS0_
+__ZNK7WebCore13StyleFillDataeqERKS0_
+__ZNK7WebCore8SVGColor5colorEv
+__ZN7WebCore16SVGStyledElement6detachEv
+__ZN7WebCore11SVGResource12removeClientEPNS_16SVGStyledElementE
+__ZN7WebCoreL9clientMapEv
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementESt4pairIS3_PNS1_11ResourceSetEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS
 __ZNK7WebCore21SVGTextContentElement7isValidEv
 __ZN7WebCore14SVGTextElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
 __ZN7WebCore13RenderSVGTextC1EPNS_14SVGTextElementE
+__ZN7WebCore13RenderSVGTextC2EPNS_14SVGTextElementE
 __ZN7WebCore14RenderSVGBlockC2EPNS_10SVGElementE
-__ZN7WebCore14RenderSVGBlock8setStyleEPNS_11RenderStyleE
-__ZN7WebCore13RenderSVGText13requiresLayerEv
+__ZN7WebCore14RenderSVGBlock8setStyleEN3WTF10PassRefPtrINS_11RenderStyleEEE
+__ZNK7WebCore13RenderSVGText13requiresLayerEv
 __ZNK7WebCore14SVGTextElement25childShouldCreateRendererEPNS_4NodeE
 __ZN7WebCore19RenderSVGInlineTextC1EPNS_4NodeEN3WTF10PassRefPtrINS_10StringImplEEE
+__ZN7WebCore19RenderSVGInlineTextC2EPNS_4NodeEN3WTF10PassRefPtrINS_10StringImplEEE
+__ZN7WebCore19RenderSVGInlineText14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
 __ZNK7WebCore19RenderSVGInlineText9isSVGTextEv
-__ZN7WebCore16SVGStyledElement6detachEv
-__ZN7WebCore11SVGResource12removeClientEPNS_16SVGStyledElementE
-__ZN7WebCore9clientMapEv
-__ZN7WebCore18RenderSVGContainer7destroyEv
-__ZN7WebCore18RenderSVGContainer23destroyLeftoverChildrenEv
-__ZN7WebCore18RenderSVGContainerD0Ev
-__ZN7WebCore18RenderSVGContainer11removeChildEPNS_12RenderObjectE
-__ZN7WebCore18RenderSVGContainer15removeChildNodeEPNS_12RenderObjectEb
-__ZN7WebCore10RenderPath27absoluteClippedOverflowRectEv
-__ZNK7WebCore10RenderPath12relativeBBoxEb
-__ZNK7WebCore12RenderObject17absoluteTransformEv
-__ZNK7WebCore13RenderSVGRoot17absoluteTransformEv
-__ZNK7WebCore12RenderObject14localTransformEv
-__ZN7WebCore15AffineTransformC1Edddddd
-__ZN7WebCore15AffineTransformmlERKS0_
-__ZNK7WebCore13RenderSVGRoot14localTransformEv
-__ZN7WebCore15AffineTransform5scaleEd
-__ZNK7WebCore13SVGSVGElement16currentTranslateEv
-__ZNK7WebCore13RenderSVGRoot8viewportEv
-__ZNK7WebCore13SVGSVGElement22viewBoxToViewTransformEff
-__ZNK7WebCore13SVGSVGElement14useCurrentViewEv
-__ZNK7WebCore13SVGSVGElement7viewBoxEv
-__ZNK7WebCore15SVGFitToViewBox7viewBoxEv
-__ZNK7WebCore18RenderSVGContainer14localTransformEv
-__ZNK7WebCore10RenderPath14localTransformEv
-__ZN7WebCore9FloatRect5uniteERKS0_
-__ZN7WebCore14SVGRenderStyleD2Ev
-__ZN7WebCore13RenderSVGText27absoluteClippedOverflowRectEv
-__ZNK7WebCore13RenderSVGText12relativeBBoxEb
-__ZNK7WebCore13RenderSVGText14localTransformEv
-__ZN7WebCore19RenderSVGInlineTextD1Ev
-__ZN7WebCore13RenderSVGTextD1Ev
-__ZN7WebCore18RenderSVGContainer27absoluteClippedOverflowRectEv
-__ZN7WebCore13SVGSVGElement19removedFromDocumentEv
-__ZN7WebCore21SVGDocumentExtensions19removeTimeContainerEPNS_13SVGSVGElementE
-__ZNK7WebCore14SVGTextElement18transformBaseValueEv
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapIPNS_16SVGTransformListEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS5_IPNS_10StringImplET_NS_10StringHashENS4_10HashTraitsISA_EENSD_ISB_EEEENS4_7PtrHashIS8_EENSD_IS8_EENSD_ISH_EEEEvE14s_baseValueMap
-__ZNK7WebCore14SVGTextElement9transformEv
-__ZN7WebCore16SVGTransformable23parseTransformAttributeEPNS_16SVGTransformListERKNS_12AtomicStringE
-__ZN7WebCore16SVGTransformable23parseTransformAttributeEPNS_16SVGTransformListERPKtS4_
-__ZN7WebCore12SVGTransformC1Ev
-__ZN7WebCore16SVGTransformable19parseTransformValueEjRPKtS2_RNS_12SVGTransformE
-__ZN7WebCore23parseTransformParamListERPKtS1_Pfii
-__ZN7WebCore12SVGTransform9setRotateEfff
-__ZN7WebCore15AffineTransform5resetEv
-__ZN7WebCore15AffineTransform6rotateEd
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE14expandCapacityEmPKS6_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE15reserveCapacityEm
-__ZN7WebCore14SVGTextElement21setTransformBaseValueEPNS_16SVGTransformListE
-__ZN7WebCore14SVGTextElement12setTransformEPNS_16SVGTransformListE
-__ZN7WebCore15pathConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGPathElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore19SVGAnimatedPathDataC2Ev
-__ZN7WebCore17createPathWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore25JSSVGPathElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSSVGPathElementC1EPN3KJS8JSObjectEPNS_14SVGPathElementE
-__ZN7WebCore16JSSVGPathElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSSVGPathElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore16JSSVGPathElement9classInfoEv
-__ZN7WebCore14SVGPathElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore14SVGPathElement11pathSegListEv
-__ZN7WebCore14SVGPathSegListC1ERKNS_13QualifiedNameE
-__ZN7WebCore22pathSegListFromSVGDataEPNS_14SVGPathSegListERKNS_6StringEb
-__ZN7WebCore13SVGPathParser8parseSVGERKNS_6StringEb
-__ZN7WebCore11parseNumberERPKtS1_Rdb
-__ZN7WebCore21SVGPathSegListBuilder9svgMoveToEddbb
-__ZN7WebCore14SVGPathElement25createSVGPathSegMovetoAbsEff
-__ZN7WebCore19SVGPathSegMovetoAbsC1Eff
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE14expandCapacityEmPKS4_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE15reserveCapacityEm
-__ZN7WebCore21SVGPathSegListBuilder9svgLineToEddb
-__ZN7WebCore14SVGPathElement25createSVGPathSegLinetoAbsEff
-__ZN7WebCore19SVGPathSegLinetoAbsC1Eff
-__ZN7WebCore14SVGPathElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore21SVGPathSegListBuilder15svgCurveToCubicEddddddb
-__ZN7WebCore14SVGPathElement31createSVGPathSegCurvetoCubicAbsEffffff
-__ZN7WebCore25SVGPathSegCurvetoCubicAbsC1Effffff
-__ZN7WebCore10SVGElement19addSVGEventListenerERKNS_12AtomicStringEPKNS_9AttributeE
-__ZN7WebCore21SVGDocumentExtensions22createSVGEventListenerERKNS_6StringES3_PNS_4NodeE
-__ZN7WebCore8KJSProxy21createSVGEventHandlerERKNS_6StringES3_PNS_4NodeE
-__ZN7WebCore22JSSVGLazyEventListenerC1ERKNS_6StringES3_PN3KJS6WindowEPNS_4NodeEi
-__ZNK7WebCore16SVGStyledElement8isStyledEv
-__ZN7WebCore16SVGStyledElement14canvasResourceEv
-__ZN7WebCore15StyleStrokeDataC1ERKS0_
-__ZNK7WebCore14SVGPathElement7isValidEv
-__ZNK7WebCore13SVGSVGElement17hasRelativeValuesEv
-__ZNK7WebCore13SVGSVGElement1xEv
-__ZNK7WebCore13SVGSVGElement1yEv
-__ZN7WebCore18RenderSVGContainer6layoutEv
-__ZNK7WebCore18RenderSVGContainer13selfWillPaintEv
-__ZN7WebCore31RenderSVGTransformableContainer23calculateLocalTransformEv
+__ZN7WebCore13RenderSVGRoot6layoutEv
+__ZNK7WebCore13SVGSVGElement12currentScaleEv
+__ZN7WebCore13RenderSVGRoot12calcViewportEv
+__ZN7WebCore10RenderPath6layoutEv
 __ZNK7WebCore29SVGStyledTransformableElement22animatedLocalTransformEv
-__ZNK7WebCore29SVGStyledTransformableElement9transformEv
 __ZNK7WebCore16SVGTransformList11concatenateEv
+__ZN7WebCore12SVGTransformC1Ev
+__ZN7WebCore12SVGTransformC2Ev
 __ZNK7WebCore12SVGTransform6matrixEv
-__ZNK7WebCore15AffineTransformeqERKS0_
-__ZN7WebCore10RenderPath6layoutEv
-__ZNK7WebCore12RenderObject9borderBoxEv
-__ZNK7WebCore12RenderObject6heightEv
-__ZNK7WebCore12RenderObject5widthEv
-__ZN7WebCore10RenderPath23calculateLocalTransformEv
+__ZN7WebCore12SVGTransformD1Ev
+__ZN7WebCore12SVGTransformD2Ev
 __ZNK7WebCore14SVGRectElement10toPathDataEv
-__ZNK7WebCore14SVGRectElement1yEv
-__ZNK7WebCore14SVGRectElement1xEv
-__ZNK7WebCore7Element12hasAttributeERKNS_13QualifiedNameE
-__ZNK7WebCore7Element14hasAttributeNSERKNS_6StringES3_
-__ZN7WebCore4Path15createRectangleERKNS_9FloatRectE
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_16heightAttr
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_15widthAttrS
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_11xAttrStrin
 __ZN7WebCore10RenderPath7setPathERKNS_4PathE
-__ZNK7WebCore10RenderPath10strokeBBoxEv
-__ZNK7WebCore10RenderPath4pathEv
-__ZN7WebCore12RenderObject8setWidthEi
-__ZN7WebCore12RenderObject9setHeightEi
+__ZN7WebCore4PathaSERKS0_
 __ZN7WebCore13RenderSVGText6layoutEv
-__ZN7WebCore13RenderSVGText23calculateLocalTransformEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_25SVGTextPositioningElementENS_13SVGLengthListEXadL_ZNS_35SVGTextPositioningElementIdenti
 __ZNK7WebCore14SVGTextElement22animatedLocalTransformEv
-__ZNK7WebCore18RenderSVGContainer14isSVGContainerEv
-__ZN7WebCore19RenderSVGInlineText19createInlineTextBoxEv
+__ZN7WebCore19RenderSVGInlineText13createTextBoxEv
 __ZN7WebCore16SVGInlineTextBoxC1EPNS_12RenderObjectE
-__ZN7WebCore13RenderSVGText15createInlineBoxEbbb
+__ZN7WebCore16SVGInlineTextBoxC2EPNS_12RenderObjectE
+__ZN7WebCore13RenderSVGText13createRootBoxEv
 __ZN7WebCore16SVGRootInlineBox22placeBoxesHorizontallyEiRiS1_Rb
-__ZN7WebCore16SVGRootInlineBox20verticallyAlignBoxesERi
+__ZN7WebCore16SVGRootInlineBox20verticallyAlignBoxesEi
+__ZNK7WebCore16SVGRootInlineBox12svgBoxHeightEv
 __ZN7WebCore16SVGRootInlineBox36computePerCharacterLayoutInformationEv
+__ZN3WTF6VectorIN7WebCore7SVGCharELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore12SVGTextChunkELm0EE14shrinkCapacityEm
 __ZN7WebCore22SVGCharacterLayoutInfoC1ERN3WTF6VectorINS_7SVGCharELm0EEE
+__ZN7WebCore22SVGCharacterLayoutInfoC2ERN3WTF6VectorINS_7SVGCharELm0EEE
 __ZN7WebCore16SVGRootInlineBox22buildLayoutInformationEPNS_13InlineFlowBoxERNS_22SVGCharacterLayoutInfoE
 __ZN7WebCore22SVGCharacterLayoutInfo20addLayoutInformationEPNS_25SVGTextPositioningElementE
-__ZN7WebCore22calculateBaselineShiftEPNS_12RenderObjectE
-__ZN7WebCore22SVGCharacterLayoutInfo15addStackContentENS0_9StackTypeEPNS_13SVGLengthListE
-__ZN3WTF6VectorIfLm0EE14expandCapacityEmPKf
-__ZN3WTF6VectorIfLm0EE14expandCapacityEm
-__ZN3WTF6VectorIfLm0EE15reserveCapacityEm
+__ZN7WebCoreL22calculateBaselineShiftEPNS_12RenderObjectE
+__ZN7WebCore22SVGCharacterLayoutInfo15addStackContentENS0_9StackTypeEPNS_13SVGLengthListEPKNS_10SVGElementE
 __ZN7WebCore22SVGCharacterLayoutInfo15addStackContentENS0_9StackTypeERKNS_21PositionedFloatVectorE
 __ZN3WTF6VectorIN7WebCore21PositionedFloatVectorELm0EE14expandCapacityEmPKS2_
 __ZN3WTF6VectorIN7WebCore21PositionedFloatVectorELm0EE14expandCapacityEm
 __ZN3WTF6VectorIN7WebCore21PositionedFloatVectorELm0EE15reserveCapacityEm
 __ZN3WTF6VectorIfLm0EEC2ERKS1_
-__ZN3WTF6VectorIfLm0EE6shrinkEm
-__ZNK7WebCore25SVGTextPositioningElement2dxEv
-__ZNK7WebCore25SVGTextPositioningElement2dyEv
-__ZNK7WebCore25SVGTextPositioningElement6rotateEv
 __ZN7WebCore22SVGCharacterLayoutInfo15addStackContentENS0_9StackTypeEPNS_13SVGNumberListE
 __ZN7WebCore22SVGCharacterLayoutInfo15addStackContentENS0_9StackTypeEf
-__ZN7WebCore16SVGRootInlineBox32buildLayoutInformationForTextBoxERNS_22SVGCharacterLayoutInfoEPNS_13InlineTextBoxE
+__ZN7WebCore16SVGRootInlineBox32buildLayoutInformationForTextBoxERNS_22SVGCharacterLayoutInfoEPNS_13InlineTextBoxERNS_13LastGly
 __ZNK7WebCore22SVGCharacterLayoutInfo12inPathLayoutEv
-__ZNK7WebCore16SVGInlineTextBox19calculateGlyphWidthEPNS_11RenderStyleEi
+__ZNK7WebCore16SVGInlineTextBox19calculateGlyphWidthEPNS_11RenderStyleEiiRiRNS_6StringE
 __ZN7WebCore26svgTextRunForInlineTextBoxEPKtiPNS_11RenderStyleEPKNS_13InlineTextBoxEf
-__ZNK7WebCore16SVGInlineTextBox20calculateGlyphHeightEPNS_11RenderStyleEi
+__ZNK7WebCore4Font10floatWidthERKNS_7TextRunEiRiRNS_6StringE
+__ZNK7WebCore16SVGInlineTextBox20calculateGlyphHeightEPNS_11RenderStyleEii
 __ZNK7WebCore22SVGCharacterLayoutInfo15xValueAvailableEv
 __ZNK7WebCore22SVGCharacterLayoutInfo10xValueNextEv
 __ZNK7WebCore22SVGCharacterLayoutInfo15yValueAvailableEv
@@ -9558,6 +13261,7 @@ __ZNK7WebCore22SVGCharacterLayoutInfo16dxValueAvailableEv
 __ZNK7WebCore22SVGCharacterLayoutInfo16dyValueAvailableEv
 __ZNK7WebCore22SVGCharacterLayoutInfo19angleValueAvailableEv
 __ZNK7WebCore22SVGCharacterLayoutInfo27baselineShiftValueAvailableEv
+__ZNK7WebCore4Font9isSVGFontEv
 __ZN3WTF6VectorIN7WebCore7SVGCharELm0EE14expandCapacityEmPKS2_
 __ZN3WTF6VectorIN7WebCore7SVGCharELm0EE14expandCapacityEm
 __ZN3WTF6VectorIN7WebCore7SVGCharELm0EE15reserveCapacityEm
@@ -9569,103 +13273,82 @@ __ZN7WebCore22SVGCharacterLayoutInfo11dxStackWalkEv
 __ZN7WebCore22SVGCharacterLayoutInfo11dyStackWalkEv
 __ZN7WebCore22SVGCharacterLayoutInfo14angleStackWalkEv
 __ZN7WebCore22SVGCharacterLayoutInfo22baselineShiftStackWalkEv
-__ZN7WebCore16SVGRootInlineBox15buildTextChunksERN3WTF6VectorINS_7SVGCharELm0EEERNS2_INS_12SVGTextChunkELm0EEEPNS_13InlineFlowBoxE
-__ZN7WebCore16SVGRootInlineBox15buildTextChunksERN3WTF6VectorINS_7SVGCharELm0EEEPNS_13InlineFlowBoxERNS_22SVGTextChunkLayoutInfoE
+__ZN7WebCore16SVGRootInlineBox15buildTextChunksERN3WTF6VectorINS_7SVGCharELm0EEERNS2_INS_12SVGTextChunkELm0EEEPNS_13InlineFlowB
+__ZN7WebCore16SVGRootInlineBox15buildTextChunksERN3WTF6VectorINS_7SVGCharELm0EEEPNS_13InlineFlowBoxERNS_22SVGTextChunkLayoutInf
+__ZNK7WebCore21SVGTextContentElement13isTextContentEv
 __ZN3WTF6VectorIN7WebCore26SVGInlineBoxCharacterRangeELm0EE14expandCapacityEmPKS2_
 __ZN3WTF6VectorIN7WebCore26SVGInlineBoxCharacterRangeELm0EE14expandCapacityEm
 __ZN3WTF6VectorIN7WebCore26SVGInlineBoxCharacterRangeELm0EE15reserveCapacityEm
-__ZNK7WebCore21SVGTextContentElement10textLengthEv
-__ZNK7WebCore21SVGTextContentElement12lengthAdjustEv
 __ZN3WTF6VectorIN7WebCore12SVGTextChunkELm0EE14expandCapacityEmPKS2_
 __ZN3WTF6VectorIN7WebCore12SVGTextChunkELm0EE14expandCapacityEm
 __ZN3WTF6VectorIN7WebCore12SVGTextChunkELm0EE15reserveCapacityEm
 __ZN3WTF6VectorIN7WebCore26SVGInlineBoxCharacterRangeELm0EEC1ERKS3_
+__ZN3WTF6VectorIN7WebCore26SVGInlineBoxCharacterRangeELm0EEC2ERKS3_
 __ZN3WTF6VectorIN7WebCore26SVGInlineBoxCharacterRangeELm0EE6shrinkEm
 __ZN7WebCore16SVGRootInlineBox16layoutTextChunksEv
-__ZN7WebCore41calculateTextLengthCorrectionForTextChunkERNS_12SVGTextChunkENS_21SVGTextContentElement19SVGLengthAdjustTypeERf
-__ZNK7WebCore15AffineTransform10isIdentityEv
-__ZN7WebCore36calculateTextAnchorShiftForTextChunkERNS_12SVGTextChunkENS_11ETextAnchorE
-__ZN7WebCore26cummulatedWidthOfTextChunkERNS_12SVGTextChunkE
-__ZN7WebCore34cummulatedWidthOrHeightOfTextChunkERNS_12SVGTextChunkEb
-__ZN7WebCore40cummulatedWidthOfInlineBoxCharacterRangeERNS_26SVGInlineBoxCharacterRangeE
+__ZN7WebCoreL41calculateTextLengthCorrectionForTextChunkERNS_12SVGTextChunkENS_21SVGTextContentElement19SVGLengthAdjustTypeERf
 __ZN7WebCore31topLeftPositionOfCharacterRangeEPNS_7SVGCharES1_
 __ZNK7WebCore7SVGChar8isHiddenEv
 __ZN7WebCore16SVGRootInlineBox17layoutInlineBoxesEv
 __ZN7WebCore16SVGRootInlineBox17layoutInlineBoxesEPNS_13InlineFlowBoxERPNS_7SVGCharERiS6_S6_S6_
 __ZNK7WebCore16SVGInlineTextBox24calculateGlyphBoundariesEPNS_11RenderStyleEiRKNS_7SVGCharE
 __ZNK7WebCore7SVGChar18characterTransformEv
-__ZN7WebCore12SVGTransformC1ERKNS_15AffineTransformE
-__ZN7WebCore17strokeBoundingBoxERKNS_4PathEPNS_11RenderStyleEPKNS_12RenderObjectE
-__ZN7WebCore14scratchContextEv
-__ZN7WebCore25applyStrokeStyleToContextEPNS_15GraphicsContextEPNS_11RenderStyleEPKNS_12RenderObjectE
-__ZN7WebCore14SVGRenderStyle20cssPrimitiveToLengthEPKNS_12RenderObjectEPNS_8CSSValueEf
-__ZN7WebCore15GraphicsContext10setLineCapENS_7LineCapE
-__ZN7WebCore15GraphicsContext11setLineJoinENS_8LineJoinE
-__ZN7WebCore15GraphicsContext13setMiterLimitEf
-__ZN7WebCore27dashArrayFromRenderingStyleEPKNS_11RenderStyleE
-__ZNK7WebCore14SVGPathElement10toPathDataEv
-__ZN7WebCore14SVGPathSegList10toPathDataEv
-__ZNK7WebCore19SVGPathSegMovetoAbs11pathSegTypeEv
-__ZNK7WebCore19SVGPathSegMovetoAbs1yEv
-__ZNK7WebCore19SVGPathSegMovetoAbs1xEv
-__ZNK7WebCore19SVGPathSegLinetoAbs11pathSegTypeEv
-__ZNK7WebCore19SVGPathSegLinetoAbs1yEv
-__ZNK7WebCore19SVGPathSegLinetoAbs1xEv
-__ZNK7WebCore25SVGPathSegCurvetoCubicAbs11pathSegTypeEv
-__ZNK7WebCore25SVGPathSegCurvetoCubicAbs1yEv
-__ZNK7WebCore25SVGPathSegCurvetoCubicAbs1xEv
-__ZNK7WebCore25SVGPathSegCurvetoCubicAbs2y2Ev
-__ZNK7WebCore25SVGPathSegCurvetoCubicAbs2x2Ev
-__ZNK7WebCore25SVGPathSegCurvetoCubicAbs2y1Ev
-__ZNK7WebCore25SVGPathSegCurvetoCubicAbs2x1Ev
-__ZN7WebCore18RenderSVGContainer10calcBoundsEv
-__ZNK7WebCore18RenderSVGContainer17calcReplacedWidthEv
-__ZNK7WebCore18RenderSVGContainer18calcReplacedHeightEv
-__ZN3KJS17staticValueGetterIN7WebCore12JSWheelEventEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore12JSWheelEvent16getValuePropertyEPN3KJS9ExecStateEi
+__ZN7WebCore20TransformationMatrix8rotate3dEddd
+__ZN7WebCore16SVGRootInlineBox18isSVGRootInlineBoxEv
+__ZN7WebCore13RenderSVGRoot21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZNK7WebCore13RenderSVGRoot25localToBorderBoxTransformEv
+__ZNK7WebCore13RenderSVGRoot24borderOriginToContentBoxEv
+__ZN7WebCore20TransformationMatrix5scaleEd
+__ZNK7WebCore13SVGSVGElement16currentTranslateEv
+__ZNK7WebCore13SVGSVGElement22viewBoxToViewTransformEff
+__ZNK7WebCore13SVGSVGElement14useCurrentViewEv
+__ZNK7WebCore13RenderSVGRoot19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore21SVGDocumentExtensions15startAnimationsEv
+__ZN7WebCore17SMILTimeContainer5beginEv
+__ZN7WebCore17SMILTimeContainer16updateAnimationsENS_8SMILTimeE
+__ZN7WebCore17SMILTimeContainer14sortByPriorityERN3WTF6VectorIPNS_14SVGSMILElementELm0EEENS_8SMILTimeE
+__ZN7WebCore17SMILTimeContainer10startTimerENS_8SMILTimeES1_
+__ZNK7WebCore17SMILTimeContainer8isPausedEv
 __ZN7WebCore13RenderSVGRoot5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore13RenderSVGRoot22applyContentTransformsERNS_12RenderObject9PaintInfoEii
-__ZNK7WebCore15AffineTransform1fEv
-__ZNK7WebCore15AffineTransform1eEv
-__ZN7WebCore15GraphicsContext9concatCTMERKNS_15AffineTransformE
-__ZNK7WebCore13RenderSVGRoot12relativeBBoxEb
-__ZNK7WebCore24RenderSVGHiddenContainer12relativeBBoxEb
-__ZNK7WebCore24RenderSVGHiddenContainer14localTransformEv
-__ZNK7WebCore24RenderSVGHiddenContainer14isSVGContainerEv
-__ZNK7WebCore18RenderSVGContainer17viewportTransformEv
-__ZNK7WebCore18RenderSVGContainer12relativeBBoxEb
+__ZNK7WebCore13RenderSVGRoot12viewportSizeEv
+__ZNK7WebCore13RenderSVGRoot32localToRepaintContainerTransformERKNS_8IntPointE
+__ZNK7WebCore13RenderSVGRoot22localToParentTransformEv
+__ZNK7WebCore13RenderSVGRoot23parentOriginToBorderBoxEv
+__ZN7WebCore25applyTransformToPaintInfoERNS_12RenderObject9PaintInfoERKNS_20TransformationMatrixE
+__ZNK7WebCore13RenderSVGRoot29repaintRectInLocalCoordinatesEv
+__ZN7WebCore13SVGRenderBase27computeContainerBoundingBoxEPKNS_12RenderObjectEb
+__ZNK7WebCore10RenderPath29repaintRectInLocalCoordinatesEv
+__ZNK7WebCore10RenderPath17objectBoundingBoxEv
+__ZN7WebCore13SVGRenderBase28filterBoundingBoxForRendererEPKNS_12RenderObjectE
+__ZNK7WebCore10RenderPath22localToParentTransformEv
+__ZNK7WebCore13RenderSVGText29repaintRectInLocalCoordinatesEv
+__ZNK7WebCore13RenderSVGText17objectBoundingBoxEv
+__ZNK7WebCore16SVGInlineTextBox12svgBoxHeightEv
+__ZNK7WebCore13RenderSVGText22localToParentTransformEv
 __ZN7WebCore9RenderBox5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore24RenderSVGHiddenContainer5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore18RenderSVGContainer5paintERNS_12RenderObject9PaintInfoEii
-__ZNK7WebCore18RenderSVGContainer13drawsContentsEv
-__ZN7WebCore18RenderSVGContainer22applyContentTransformsERNS_12RenderObject9PaintInfoE
-__ZN7WebCore18RenderSVGContainer25applyAdditionalTransformsERNS_12RenderObject9PaintInfoE
 __ZN7WebCore10RenderPath5paintERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore13RenderSVGText5paintERNS_12RenderObject9PaintInfoEii
-__ZNK7WebCore15AffineTransform7inverseEv
-__ZNK7WebCore15AffineTransform7mapRectERKNS_7IntRectE
-__ZN7WebCore16enclosingIntRectERK6CGRect
-__ZN7WebCore25prepareToRenderSVGContentEPNS_12RenderObjectERNS0_9PaintInfoERKNS_9FloatRectERPNS_17SVGResourceFilterES8_
+__ZN7WebCore13SVGRenderBase25prepareToRenderSVGContentEPNS_12RenderObjectERNS1_9PaintInfoERKNS_9FloatRectERPNS_17SVGResourceFil
 __ZN7WebCore14getClipperByIdEPNS_8DocumentERKNS_12AtomicStringE
 __ZN7WebCore15getResourceByIdEPNS_8DocumentERKNS_12AtomicStringE
 __ZN7WebCore13getMaskerByIdEPNS_8DocumentERKNS_12AtomicStringE
-__ZN7WebCore15GraphicsContext9beginPathEv
 __ZN7WebCore14SVGPaintServer15fillPaintServerEPKNS_11RenderStyleEPKNS_12RenderObjectE
 __ZN7WebCore14SVGPaintServer22sharedSolidPaintServerEv
 __ZN7WebCore19SVGPaintServerSolidC1Ev
+__ZN7WebCore19SVGPaintServerSolidC2Ev
 __ZN7WebCore14SVGPaintServerC2Ev
 __ZN7WebCore11SVGResourceC2Ev
-__ZNK7WebCore8SVGColor5colorEv
 __ZN7WebCore19SVGPaintServerSolid8setColorERKNS_5ColorE
 __ZNK7WebCore19SVGPaintServerSolid5colorEv
 __ZNK7WebCore14SVGPaintServer4drawERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeE
-__ZZNK7WebCore19SVGPaintServerSolid5setupERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEbE19deviceRGBColorSpace
+__ZNK7WebCore19SVGPaintServerSolid5setupERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
+__ZN7WebCore15GraphicsContext8setAlphaEf
+__ZN7WebCore15GraphicsContext11setFillRuleENS_8WindRuleE
 __ZNK7WebCore14SVGPaintServer10renderPathERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeE
-__ZNK7WebCore14SVGPaintServer8fillPathEP9CGContextPKNS_12RenderObjectE
 __ZNK7WebCore14SVGPaintServer8teardownERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
 __ZN7WebCore14SVGPaintServer17strokePaintServerEPKNS_11RenderStyleEPKNS_12RenderObjectE
 __ZNK7WebCore16SVGStyledElement15supportsMarkersEv
-__ZN7WebCore22finishRenderSVGContentEPNS_12RenderObjectERNS0_9PaintInfoERKNS_9FloatRectERPNS_17SVGResourceFilterEPNS_15GraphicsContextE
+__ZN7WebCore13SVGRenderBase22finishRenderSVGContentEPNS_12RenderObjectERNS1_9PaintInfoERKNS_9FloatRectERPNS_17SVGResourceFilter
 __ZN7WebCore16SVGRootInlineBox5paintERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore16SVGRootInlineBox14walkTextChunksEPNS_22SVGTextChunkWalkerBaseEPKNS_16SVGInlineTextBoxE
 __ZN7WebCore18SVGTextChunkWalkerINS_27SVGRootInlineBoxPaintWalkerEE5startEPNS_9InlineBoxE
@@ -9674,238 +13357,769 @@ __ZN7WebCore18SVGTextChunkWalkerINS_27SVGRootInlineBoxPaintWalkerEE9setupFillEPN
 __ZN7WebCore27SVGRootInlineBoxPaintWalker22chunkSetupFillCallbackEPNS_9InlineBoxE
 __ZN7WebCore15GraphicsContext18setTextDrawingModeEi
 __ZN7WebCore15GraphicsContext26setPlatformTextDrawingModeEi
-__ZN7WebCore18SVGTextChunkWalkerINS_27SVGRootInlineBoxPaintWalkerEEclEPNS_16SVGInlineTextBoxEiRKNS_15AffineTransformERKPNS_7SVGCharESB_
-__ZN7WebCore27SVGRootInlineBoxPaintWalker20chunkPortionCallbackEPNS_16SVGInlineTextBoxEiRKNS_15AffineTransformERKPNS_7SVGCharES9_
+__ZN7WebCore18SVGTextChunkWalkerINS_27SVGRootInlineBoxPaintWalkerEEclEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatrixERKPNS
+__ZN7WebCore27SVGRootInlineBoxPaintWalker20chunkPortionCallbackEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatrixERKPNS_7SVGC
 __ZN7WebCore16SVGInlineTextBox15paintCharactersERNS_12RenderObject9PaintInfoEiiRKNS_7SVGCharEPKtiPNS_14SVGPaintServerE
 __ZN7WebCore18SVGTextChunkWalkerINS_27SVGRootInlineBoxPaintWalkerEE11setupStrokeEPNS_9InlineBoxE
 __ZN7WebCore27SVGRootInlineBoxPaintWalker24chunkSetupStrokeCallbackEPNS_9InlineBoxE
 __ZN7WebCore18SVGTextChunkWalkerINS_27SVGRootInlineBoxPaintWalkerEE3endEPNS_9InlineBoxE
 __ZN7WebCore27SVGRootInlineBoxPaintWalker16chunkEndCallbackEPNS_9InlineBoxE
-__ZNK7WebCore14SVGPaintServer10strokePathEP9CGContextPKNS_12RenderObjectE
-__ZNK7WebCore14SVGPathElement15supportsMarkersEv
-__ZNK7WebCore10RenderPath19drawMarkersIfNeededEPNS_15GraphicsContextERKNS_9FloatRectERKNS_4PathE
-__ZN7WebCore13getMarkerByIdEPNS_8DocumentERKNS_12AtomicStringE
-__ZNK7WebCore11RenderLayer25horizontalScrollbarWidgetEv
-__ZN7WebCore13RenderSVGRoot11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZNK7WebCore15AffineTransform3mapEddPdS1_
-__ZN7WebCore18RenderSVGContainer11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZNK7WebCore18RenderSVGContainer9lastChildEv
-__ZN7WebCore10RenderPath11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore21PointerEventsHitRulesC1ENS0_14ESVGHitTestingENS_14EPointerEventsE
-__ZNK7WebCore10RenderPath23mapAbsolutePointToLocalERKNS_10FloatPointE
-__ZN7WebCore10FloatPoint15narrowPrecisionEdd
-__ZNK7WebCore10RenderPath14strokeContainsERKNS_10FloatPointEb
-__ZN7WebCore13RenderSVGText11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore16SVGInlineTextBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
-__ZN7WebCore16SVGInlineTextBox13selectionRectEiiii
-__ZNK7WebCore16SVGInlineTextBox16svgRootInlineBoxEv
-__ZN7WebCore16SVGRootInlineBox18isSVGRootInlineBoxEv
-__ZN7WebCore18SVGTextChunkWalkerINS_35SVGInlineTextBoxSelectionRectWalkerEEclEPNS_16SVGInlineTextBoxEiRKNS_15AffineTransformERKPNS_7SVGCharESB_
-__ZN7WebCore35SVGInlineTextBoxSelectionRectWalker20chunkPortionCallbackEPNS_16SVGInlineTextBoxEiRKNS_15AffineTransformERKPNS_7SVGCharES9_
-__ZNK7WebCore10RenderPath12fillContainsERKNS_10FloatPointEb
-__ZN7WebCore10SVGElement15eventParentNodeEv
-__ZN7WebCore12EventHandler30passMousePressEventToScrollbarERNS_28MouseEventWithHitTestResultsEPNS_17PlatformScrollbarE
--[WebCoreScrollBar mouseDown:]
-__ZN7WebCore6Widget15beforeMouseDownEP6NSViewPS0_
--[WebCoreScrollBar scroll:]
-__ZN7WebCore17PlatformScrollbar12scrollbarHitEj
-__ZN7WebCore6Widget14afterMouseDownEP6NSViewPS0_
-__ZN7WebCore44jsHTMLTextAreaElementPrototypeFunctionSelectEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore19HTMLTextAreaElement6selectEv
-__ZN7WebCore55jsHTMLTextAreaElementPrototypeFunctionSetSelectionRangeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore19HTMLTextAreaElement12selectionEndEv
-__ZN7WebCore16SVGInlineTextBoxD1Ev
-__ZN7WebCore16SVGRootInlineBoxD1Ev
+-[DOMElement innerText]
+__ZN7WebCore16JSSVGTextElementD1Ev
+__ZN7WebCore15JSSVGSVGElementD1Ev
+__ZN7WebCore16JSSVGRectElementD1Ev
+__ZN7WebCore17JSXPathNSResolverD1Ev
+__ZN7WebCore17JSXPathNSResolverD2Ev
+__ZN7WebCore21NativeXPathNSResolverD0Ev
+__ZN7WebCore15XPathNSResolverD2Ev
+__ZN7WebCore13SVGSVGElement26documentWillBecomeInactiveEv
+__ZN7WebCore13SVGSVGElement15pauseAnimationsEv
+__ZN7WebCore17SMILTimeContainer5pauseEv
+__ZN7WebCore10RenderPathD0Ev
+__ZN7WebCore14SVGRenderStyleD1Ev
+__ZN7WebCore14SVGRenderStyleD2Ev
+__ZN7WebCore19RenderSVGInlineText7destroyEv
+__ZN7WebCore16SVGInlineTextBoxD0Ev
+__ZN7WebCore19RenderSVGInlineTextD0Ev
+__ZN7WebCore16SVGRootInlineBoxD0Ev
 __ZN3WTF6VectorIN7WebCore12SVGTextChunkELm0EE6shrinkEm
 __ZN3WTF6VectorIN7WebCore7SVGCharELm0EE6shrinkEm
-__ZN7WebCore11crossCursorEv
-__ZN7WebCore22JSSVGLazyEventListenerD1Ev
-__ZN7WebCore13TimeSchedulerD1Ev
-__ZN3WTF15deleteAllValuesIPN7WebCore8SVGTimerEKNS_9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEESA_EEEEvRT0_
-__ZN7WebCore15SVGFitToViewBoxD0Ev
-__ZN7WebCore22SVGPreserveAspectRatioD1Ev
-__ZN7WebCore28SVGExternalResourcesRequiredD0Ev
-__ZN7WebCore8SVGTestsD0Ev
-__ZN7WebCore25SVGStyledLocatableElementD0Ev
-__ZN7WebCore10SVGElementD0Ev
-__ZN7WebCore29SVGStyledTransformableElementD0Ev
-__ZN7WebCore16SVGTransformListD1Ev
-__ZN7WebCore16SVGTransformableD0Ev
-__ZN7WebCore25SVGTextPositioningElementD0Ev
-__ZN7WebCore13SVGNumberListD1Ev
-__ZN7WebCore13SVGLengthListD1Ev
+__ZN7WebCore13RenderSVGTextD0Ev
+__ZN7WebCore13RenderSVGRootD0Ev
+__ZN7WebCore36JSSVGTextPositioningElementPrototypeD1Ev
+__ZN7WebCore32JSSVGTextContentElementPrototypeD1Ev
+__ZN7WebCore24JSSVGSVGElementPrototypeD1Ev
+__ZN7WebCore25JSSVGTextElementPrototypeD1Ev
+__ZN7WebCore25JSSVGRectElementPrototypeD1Ev
+__ZN7WebCore21JSSVGElementPrototypeD1Ev
+__ZN7WebCore26JSXPathNSResolverPrototypeD1Ev
+__ZN7WebCore21ProcessingInstructionD0Ev
+__ZN7WebCore12CDATASectionD0Ev
+__ZN7WebCore13JSSVGDocumentD1Ev
+__ZN7WebCore13SVGSVGElementD0Ev
+__ZN7WebCore21SVGDocumentExtensions19removeTimeContainerEPNS_13SVGSVGElementE
+__ZN3WTF9HashTableIPN7WebCore13SVGSVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_
+__ZN3WTF9HashTableIPN7WebCore13SVGSVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeA
+__ZN3WTF9HashTableIPN7WebCore13SVGSVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEP
+__ZN3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallo
+__ZN7WebCore13SVGZoomAndPanD2Ev
+__ZN7WebCore15SVGFitToViewBoxD2Ev
+__ZN7WebCore22SVGPreserveAspectRatioD0Ev
+__ZN7WebCore28SVGExternalResourcesRequiredD2Ev
+__ZN7WebCore12SVGLangSpaceD2Ev
+__ZN7WebCore8SVGTestsD2Ev
+__ZN7WebCore25SVGStyledLocatableElementD2Ev
+__ZN7WebCore16SVGStyledElementD2Ev
+__ZN7WebCore11SVGStylableD2Ev
+__ZN7WebCore10SVGElementD2Ev
+__ZN7WebCore12SVGLocatableD2Ev
+__ZN7WebCore14SVGRectElementD0Ev
+__ZN7WebCore29SVGStyledTransformableElementD2Ev
+__ZN7WebCore16SVGTransformListD0Ev
+__ZN7WebCore16SVGTransformableD2Ev
+__ZN7WebCore8SVGPaintD0Ev
+__ZN7WebCore8SVGColorD2Ev
+__ZN7WebCore14SVGTextElementD0Ev
+__ZN7WebCore25SVGTextPositioningElementD2Ev
+__ZN7WebCore13SVGNumberListD0Ev
+__ZN7WebCore13SVGLengthListD0Ev
 __ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_9SVGLengthEEEEELm0EE6shrinkEm
-__ZN7WebCore21SVGTextContentElementD0Ev
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE6shrinkEm
-__ZN7WebCore14SVGPathSegListD1Ev
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE6shrinkEm
-__ZN7WebCore36JSSVGTextPositioningElementPrototypeD0Ev
+__ZN7WebCore21SVGTextContentElementD2Ev
+__ZN7WebCore11SVGDocumentD0Ev
 __ZN7WebCore21SVGDocumentExtensionsD1Ev
-__ZN3WTF20deleteAllPairSecondsIPNS_7HashSetIPN7WebCore16SVGStyledElementENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEEEKNS_7HashMapINS2_6StringESA_NS2_10StringHashENS7_ISC_EENS7_ISA_EEEEEEvRT0_
-__ZN3WTF20deleteAllPairSecondsIPNS_7HashSetIPN7WebCore18SVGElementInstanceENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEEEKNS_7HashMapIPNS2_10SVGElementESA_NS5_ISD_EENS7_ISD_EENS7_ISA_EEEEEEvRT0_
-__ZNK7WebCore14HTMLModElement17endTagRequirementEv
-__ZNK7WebCore14HTMLModElement11tagPriorityEv
-__ZN7WebCore16JSHTMLModElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZNK7WebCore16JSHTMLModElement9classInfoEv
-__ZN7WebCore23createBlockquoteWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore23JSHTMLBlockquoteElementC1EPN3KJS8JSObjectEPNS_21HTMLBlockquoteElementE
-__ZN7WebCore10moveCursorEv
-__ZN7WebCore49jsDocumentPrototypeFunctionGetElementsByTagNameNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore48jsElementPrototypeFunctionGetElementsByTagNameNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore40jsElementPrototypeFunctionGetAttributeNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore7Element14getAttributeNSERKNS_6StringES3_
-__ZNK7WebCore4Node10attributesEv
-__ZNK7WebCore4Attr8nodeNameEv
-__ZN7WebCore11HTMLElement18setContentEditableEPNS_15MappedAttributeE
-__ZNK7WebCore18JSHTMLTitleElement9classInfoEv
+__ZN7WebCore21SVGDocumentExtensionsD2Ev
+__ZN3WTF20deleteAllPairSecondsIPNS_7HashSetIPN7WebCore16SVGStyledElementENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEEEKNS_7HashMapIN
+__ZN7WebCore22JSSVGDocumentPrototypeD1Ev
+__ZN7WebCore5XPath6Parser16registerNodeTestEPNS0_4Step8NodeTestE
+__ZN3WTF7HashSetIPN7WebCore5XPath4Step8NodeTestENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEE3addERKS5_
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E6exp
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E6reh
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E13al
+__ZN7WebCore5XPath6Parser14deleteNodeTestEPNS0_4Step8NodeTestE
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E4fin
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E47re
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E6rem
+__ZN7WebCore43jsDocumentPrototypeFunctionCreateExpressionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_15XPathExpressionE
+__ZN7WebCore17JSXPathExpression15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSXPathExpressionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15XPathExpressionEEE
+__ZN7WebCore17JSXPathExpressionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15XPathExpressionEEE
+__ZN7WebCore21NativeXPathNSResolver18lookupNamespaceURIERKNS_6StringE
+__ZNK7WebCore4Node18lookupNamespaceURIERKNS_6StringE
+__ZN7WebCore5XPathL14createFunCountEv
+__ZN7WebCore5XPath6Parser19makeTokenAndAdvanceEiNS0_9NumericOp6OpcodeEi
+__ZN7WebCore5XPathL11createFunIdEv
+__ZN7WebCore5XPathL21createFunNamespaceURIEv
+__ZN7WebCore5XPathL13createFunNameEv
+__ZN7WebCore5XPathL15createFunStringEv
+__ZN7WebCore5XPathL19createFunStartsWithEv
+__ZN7WebCore5XPathL24createFunSubstringBeforeEv
+__ZN7WebCore5XPathL23createFunSubstringAfterEv
+__ZN7WebCore5XPathL18createFunSubstringEv
+__ZN7WebCore5XPathL21createFunStringLengthEv
+__ZN7WebCore5XPathL23createFunNormalizeSpaceEv
+__ZN7WebCore5XPathL18createFunTranslateEv
+__ZN7WebCore5XPathL16createFunBooleanEv
+__ZN7WebCore5XPathL13createFunTrueEv
+__ZN7WebCore5XPathL14createFunFalseEv
+__ZN7WebCore5XPathL13createFunLangEv
+__ZN7WebCore5XPathL15createFunNumberEv
+__ZN7WebCore5XPathL14createFunFloorEv
+__ZN7WebCore5XPathL16createFunCeilingEv
+__ZN7WebCore5XPathL14createFunRoundEv
+__ZN7WebCore17JSXPathExpressionD1Ev
+__ZN7WebCore17JSXPathExpressionD2Ev
+__ZN7WebCore5XPath5UnionD0Ev
+__ZN7WebCore5XPath8FunCountD0Ev
+__ZN7WebCore5XPath8NegativeD0Ev
+__ZN7WebCore5XPath5FunIdD0Ev
+__ZN7WebCore5XPath15FunNamespaceURID0Ev
+__ZN7WebCore5XPath7FunNameD0Ev
+__ZN7WebCore5XPath9FunStringD0Ev
+__ZN7WebCore5XPath13FunStartsWithD0Ev
+__ZN7WebCore5XPath18FunSubstringBeforeD0Ev
+__ZN7WebCore5XPath17FunSubstringAfterD0Ev
+__ZN7WebCore5XPath12FunSubstringD0Ev
+__ZN7WebCore5XPath15FunStringLengthD0Ev
+__ZN7WebCore5XPath17FunNormalizeSpaceD0Ev
+__ZN7WebCore5XPath12FunTranslateD0Ev
+__ZN7WebCore5XPath10FunBooleanD0Ev
+__ZN7WebCore5XPath7FunTrueD0Ev
+__ZN7WebCore5XPath8FunFalseD0Ev
+__ZN7WebCore5XPath7FunLangD0Ev
+__ZN7WebCore5XPath9FunNumberD0Ev
+__ZN7WebCore5XPath8FunFloorD0Ev
+__ZN7WebCore5XPath10FunCeilingD0Ev
+__ZN7WebCore5XPath8FunRoundD0Ev
+__ZNK7WebCore5XPath5FunId8evaluateEv
+__ZN7WebCore26JSXPathExpressionPrototypeD1Ev
+__ZN7WebCore23JSProcessingInstruction15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSProcessingInstructionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21ProcessingInstructionEEE
+__ZN7WebCore23JSProcessingInstructionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21ProcessingInstructionEEE
+__ZN7WebCore23JSProcessingInstruction18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23JSProcessingInstructionD1Ev
+__ZN7WebCore14JSCDATASection15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSTextPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSCDATASectionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CDATASectionEEE
+__ZN7WebCore14JSCDATASectionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CDATASectionEEE
+__ZN7WebCore14JSCDATASectionD1Ev
+__ZN7WebCore32JSProcessingInstructionPrototypeD1Ev
+__ZN7WebCore23JSCDATASectionPrototypeD1Ev
+__ZN3WTF15deleteAllValuesIPN7WebCore5XPath9ParseNodeEKNS_9HashTableIS4_S4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10Has
+__ZN3WTF9HashTableIPNS_6VectorIPN7WebCore5XPath9PredicateELm0EEES7_NS_17IdentityExtractorIS7_EENS_7PtrHashIS7_EENS_10HashTraits
+__ZN3WTF9HashTableIPNS_6VectorIPN7WebCore5XPath10ExpressionELm0EEES7_NS_17IdentityExtractorIS7_EENS_7PtrHashIS7_EENS_10HashTrai
+__ZN3WTF15deleteAllValuesIPN7WebCore6StringEKNS_9HashTableIS3_S3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS
+__ZN3WTF9HashTableIPN7WebCore6StringES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E5clearEv
+__ZN3WTF15deleteAllValuesIPN7WebCore5XPath4Step8NodeTestEKNS_9HashTableIS5_S5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_1
+__ZN3WTF9HashTableIPN7WebCore5XPath4Step8NodeTestES5_NS_17IdentityExtractorIS5_EENS_7PtrHashIS5_EENS_10HashTraitsIS5_EESB_E5cle
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14XPathExceptionE
+__ZN7WebCore16JSXPathException15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSXPathExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14XPathExceptionEEE
+__ZN7WebCore16JSXPathExceptionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14XPathExceptionEEE
+__ZN7WebCore16JSXPathException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSXPathExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20jsXPathExceptionCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSXPathExceptionD1Ev
+__ZN7WebCore16JSXPathExceptionD2Ev
+__ZN7WebCore25JSXPathExceptionPrototypeD1Ev
+__ZNK7WebCore4Node15ancestorElementEv
+__ZN7WebCore15EntityReferenceC1EPNS_8DocumentERKNS_6StringE
+__ZN7WebCore15EntityReferenceC2EPNS_8DocumentERKNS_6StringE
+__ZNK7WebCore15EntityReference8nodeTypeEv
+__ZN7WebCore17JSEntityReference15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSEntityReferenceC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15EntityReferenceEEE
+__ZN7WebCore17JSEntityReferenceC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15EntityReferenceEEE
+__ZNK7WebCore17JSEntityReference9classInfoEv
+__ZN7WebCore17JSEntityReferenceD1Ev
+__ZThn8_N7WebCore15EntityReferenceD0Ev
+__ZN7WebCore15EntityReferenceD0Ev
+__ZNK7WebCore5XPath9FunString8evaluateEv
+__ZN7WebCore5XPath13isRootDomNodeEPNS_4NodeE
+__ZN7WebCore26JSEntityReferencePrototypeD1Ev
+__ZN7WebCore17JSXPathExpression18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26JSXPathExpressionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsXPathExpressionPrototypeFunctionEvaluateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore17JSXPathExpression9classInfoEv
+__ZN7WebCore49jsDocumentPrototypeFunctionGetElementsByTagNameNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore48jsElementPrototypeFunctionGetElementsByTagNameNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26JSXPathNSResolverPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore52jsXPathNSResolverPrototypeFunctionLookupNamespaceURIEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore12RenderObject10nextOffsetEi
+__ZN7WebCore12jsNodePrefixEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element13virtualPrefixEv
+__ZN7WebCore23jsXPathResultResultTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsXPathResultBooleanValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11XPathResult12booleanValueERi
+__ZN7WebCore24jsXPathResultNumberValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11XPathResult11numberValueERi
+__ZN7WebCore28jsXPathResultSingleNodeValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11XPathResult15singleNodeValueERi
+__ZN7WebCore24jsXPathResultStringValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11XPathResult11stringValueERi
+__ZN7WebCore33jsXPathResultInvalidIteratorStateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11XPathResult20invalidIteratorStateEv
+__ZNK7WebCore5XPath18FunSubstringBefore8evaluateEv
+__ZNK7WebCore5XPath7NodeSet7anyNodeEv
+__ZN7WebCore15jsNodeLocalNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn112_NK7WebCore17HTMLScriptElement13scriptContentEv
+__ZNK7WebCore17HTMLScriptElement13scriptContentEv
+__ZN7WebCore26setJSHTMLTableElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLTableElement8setWidthERKNS_6StringE
+__ZNK7WebCore14JSCDATASection9classInfoEv
+__ZThn8_N7WebCore12CDATASectionD0Ev
+__ZNK7WebCore7Element8nodeNameEv
+__ZN7WebCore29jsProcessingInstructionTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsProcessingInstructionDataEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore23JSProcessingInstruction9classInfoEv
+__ZN7WebCore22jsDocumentTypeEntitiesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21ProcessingInstruction8nodeNameEv
+__ZN7WebCore17JSEntityReference18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore43jsDOMCoreExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore18JSDOMCoreException9classInfoEv
+__ZNK7WebCore13ExceptionBase8toStringEv
+__ZN7WebCore23jsDocumentTypeNotationsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL14mapConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZNK7WebCore21JSHTMLFrameSetElement9classInfoEv
+__ZNK7WebCore9Tokenizer14processingDataEv
+__ZN7WebCoreL18isindexConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZNK7WebCore11FrameLoader16responseMIMETypeEv
+__ZN7WebCore13ImageDocument17windowSizeChangedEv
+__ZNK7WebCore13ImageDocument17imageFitsInWindowEv
+__ZN7WebCore13ImageDocument16resizeImageToFitEv
+__ZNK7WebCore13ImageDocument5scaleEv
+__ZNK7WebCore13ImageDocument15isImageDocumentEv
+__ZN7WebCore18ImageEventListenerD0Ev
+__ZN7WebCore12IconDatabase25removeIconFromSQLDatabaseERKNS_6StringE
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm2048EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm2048EE14expandCapacityEm
+__ZN3WTF6VectorIPKN7WebCore14SimpleFontDataELm2048EE15reserveCapacityEm
+__ZN3WTF6VectorItLm2048EE14expandCapacityEmPKt
+__ZN3WTF6VectorItLm2048EE14expandCapacityEm
+__ZN3WTF6VectorItLm2048EE15reserveCapacityEm
+__ZN3WTF6VectorI6CGSizeLm2048EE14expandCapacityEmPKS1_
+__ZN3WTF6VectorI6CGSizeLm2048EE14expandCapacityEm
+__ZN3WTF6VectorI6CGSizeLm2048EE15reserveCapacityEm
+__ZN7WebCore13HTMLTokenizer11parseServerERNS_15SegmentedStringENS0_5StateE
+__ZN7WebCore31jsDOMWindowDOMParserConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11JSDOMParser14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore22JSDOMParserConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore20JSDOMParserPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSDOMParser15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSDOMParserConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22JSDOMParserConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCore22JSDOMParserConstructor9constructEPN3JSC9ExecStateEPNS1_8JSObjectERKNS1_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9DOMParserE
+__ZN7WebCore11JSDOMParserC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9DOMParserEEE
+__ZN7WebCore11JSDOMParserC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9DOMParserEEE
+__ZN7WebCore11JSDOMParser18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20JSDOMParserPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore43jsDOMParserPrototypeFunctionParseFromStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore11JSDOMParser9classInfoEv
+__ZN7WebCore9DOMParser15parseFromStringERKNS_6StringES3_
+__ZN7WebCore9Tokenizer35executeScriptsWaitingForStylesheetsEv
+__ZN7WebCore7Element26copyNonAttributePropertiesEPKS0_
+__ZNK7WebCore9Attribute5cloneEv
+__ZNK7WebCore4Attr13virtualPrefixEv
+__ZNK7WebCore4Attr6prefixEv
+__ZN7WebCore37jsDocumentPrototypeFunctionImportNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document10importNodeEPNS_4NodeEbRi
+__ZNK7WebCore4Attr16virtualLocalNameEv
+__ZNK7WebCore4Attr9localNameEv
+__ZN7WebCore11JSDOMParserD1Ev
+__ZN7WebCore11JSDOMParserD2Ev
+__ZN7WebCore20jsNodeATTRIBUTE_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsNodeCDATA_SECTION_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsNodeCOMMENT_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsNodeDOCUMENT_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsNodeDOCUMENT_FRAGMENT_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSDOMParserPrototypeD1Ev
+__ZN7WebCore22JSDOMParserConstructorD1Ev
+__ZNK7WebCore17HTMLScriptElement14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore17HTMLIFrameElement14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore17CSSInheritedValue7cssTextEv
 __ZNK7WebCore17JSHTMLFontElement9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore22JSHTMLInputElementBaseEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore22JSHTMLInputElementBase16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore17RenderTextControl12scrollHeightEv
-__ZN7WebCore22JSHTMLInputElementBase16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore16HTMLInputElement17setSelectionStartEi
-__ZN7WebCore16HTMLInputElement15setSelectionEndEi
-__ZN7WebCore12HTMLDocument7fgColorEv
-__ZN7WebCore14RenderListItem16setExplicitValueEi
-__ZN7WebCore14RenderListItem20explicitValueChangedEv
-__ZNK7WebCore12RenderObject14nextInPreOrderEPS0_
-__ZNK7WebCore12RenderObject27nextInPreOrderAfterChildrenEPS0_
-__ZN7WebCore17HTMLButtonElement8setValueERKNS_6StringE
-__ZNK7WebCore17HTMLButtonElement5valueEv
-__ZN7WebCore17HTMLAnchorElement11setTabIndexEi
-__ZN7WebCore15JSHTMLLIElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore13HTMLLIElement8setValueEi
-__ZNK7WebCore17HTMLObjectElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore16HTMLParamElement14isURLAttributeEPNS_9AttributeE
-__ZNK7WebCore16HTMLEmbedElement14isURLAttributeEPNS_9AttributeE
-__ZN7WebCore25JSHTMLDocumentConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSDocumentFragmentConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore14SVGRenderStyleeqERKS0_
-__ZN7WebCore18JSHTMLLabelElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore16HTMLLabelElement10setHtmlForERKNS_6StringE
-__ZN7WebCore16JSHTMLMapElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore16JSHTMLMapElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore14HTMLMapElement7setNameERKNS_6StringE
-__ZN7WebCore17JSHTMLAreaElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore15HTMLAreaElement8setShapeERKNS_6StringE
-__ZN7WebCore15HTMLAreaElement9setCoordsERKNS_6StringE
 __ZNK7WebCore15JSHTMLHRElement9classInfoEv
-__ZN7WebCore16HTMLStyleElement8setMediaERKNS_12AtomicStringE
-__ZN7WebCore19HTMLFrameSetElement11recalcStyleENS_4Node11StyleChangeE
-__ZN7WebCore19HTMLTableRowElement10setBgColorERKNS_6StringE
-__ZN7WebCore12ClipboardMac8writeURLERKNS_4KURLERKNS_6StringEPNS_5FrameE
-__ZN7WebCore15HTMLLinkElement6setRelERKNS_6StringE
-__ZN7WebCore15HTMLLinkElement7setTypeERKNS_6StringE
-__ZN7WebCore15HTMLLinkElement7setHrefERKNS_6StringE
-__ZNK7WebCore11RenderBlock16leftmostPositionEbb
-__ZNK7WebCore10RenderFlow16leftmostPositionEbb
-__ZNK7WebCore9RenderBox16leftmostPositionEbb
-__ZNK7WebCore18RenderTableSection16leftmostPositionEbb
-__ZN7WebCore16HTMLInputElement19didRestoreFromCacheEv
-__ZN7WebCore11HTMLElement6setDirERKNS_6StringE
-__ZN7WebCore15HTMLBaseElement19removedFromDocumentEv
-__ZN7WebCore21gbkCallbackSubstituteEPKvP25UConverterFromUnicodeArgsPKtii24UConverterCallbackReasonP10UErrorCode
-__ZN7WebCore10gbkEscapesEv
-__ZN3WTF7HashMapIitNS_7IntHashIjEENS_10HashTraitsIiEENS3_ItEEE3addERKiRKt
-__ZN3WTF9HashTableIiSt4pairIiiENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEES9_EES9_E3addIiPN3KJS14DOMWindowTimerENS_17HashMapTranslatorILb1ES1_IiSF_ENS_18PairBaseHashTraitsIS9_NS8_ISF_EEEESA_S6_EEEES1_INS_17HashTableIteratorIiS2_S4_S6_SA_S9_EEbERKT_RKT0_
-__ZNK3WTF9HashTableIiSt4pairIiiENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIiEES9_EES9_E8containsIiNS_22IdentityHashTranslatorIiS2_S6_EEEEbRKT_
-__ZNK3WTF7HashMapIitNS_7IntHashIjEENS_10HashTraitsIiEENS3_ItEEE3getERKi
-__ZNK7WebCore13HTMLTokenizer15executingScriptEv
-__ZN7WebCore19JSHTMLObjectElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore42jsCSSStyleSheetPrototypeFunctionInsertRuleEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore11HTMLElement12setOuterHTMLERKNS_6StringERi
-__ZNK7WebCore15HTMLBodyElement4textEv
-__ZN7WebCore12HTMLDocument9linkColorEv
-__ZN7WebCore30jsConsolePrototypeFunctionInfoEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Console4infoERKNS_6StringE
-__ZNK7WebCore15HTMLMenuElement17endTagRequirementEv
-__ZNK7WebCore15HTMLMenuElement11tagPriorityEv
-__ZN7WebCore10RenderFlow19createAnonymousFlowEPNS_8DocumentEPNS_11RenderStyleE
-__ZN7WebCore18RenderTextFragmentC1EPNS_4NodeEPNS_10StringImplEii
-__ZN7WebCore18JSHTMLParamElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore20createMarqueeWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore20JSHTMLMarqueeElementC1EPN3KJS8JSObjectEPNS_18HTMLMarqueeElementE
-__ZN7WebCore20JSHTMLMarqueeElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSHTMLMarqueeElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore7Marquee7suspendEv
-__ZN7WebCore38min_device_pixel_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore34device_pixel_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore12compareValueIfEEbT_S1_NS_18MediaFeaturePrefixE
-__ZN7WebCore15JSHTMLHRElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore12RenderObject37markAllDescendantsWithFloatsForLayoutEPS0_
-__ZN7WebCore28JSHTMLLegendElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSHTMLLegendElement9classInfoEv
-__ZN7WebCore12RenderObject13containsFloatEPS0_
-__ZNK7WebCore16HTMLImageElement5alignEv
-__ZN7WebCore18JSHTMLTitleElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore19JSHTMLLegendElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore21JSHTMLOptGroupElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore23RenderFileUploadControlC2EPNS_16HTMLInputElementE
-__ZN7WebCore11FileChooser6createEPNS_17FileChooserClientERKNS_6StringE
-__ZN7WebCore11FileChooserC2EPNS_17FileChooserClientERKNS_6StringE
-__ZN7WebCore11FileChooser10chooseIconERKNS_6StringE
-__ZN7WebCore4Icon14newIconForFileERKNS_6StringE
--[WebCoreOpenPanelController initWithFileChooser:]
-__ZN7WebCore23RenderFileUploadControl8setStyleEPNS_11RenderStyleE
-__ZN7WebCore23RenderFileUploadControl17updateFromElementEv
-__ZN7WebCore32HTMLFileUploadInnerButtonElementC2EPNS_8DocumentEPNS_4NodeE
-__ZN7WebCore25fileButtonChooseFileLabelEv
-__ZNK7WebCore23RenderFileUploadControl17createButtonStyleEPNS_11RenderStyleE
-__ZN7WebCore23RenderFileUploadControl14calcPrefWidthsEv
-__ZN7WebCore23RenderFileUploadControl11paintObjectERNS_12RenderObject9PaintInfoEii
-__ZNK7WebCore23RenderFileUploadControl16maxFilenameWidthEv
-__ZNK7WebCore11FileChooser16basenameForWidthERKNS_4FontEi
-__ZN7WebCore29fileButtonNoFileSelectedLabelEv
-__ZN7WebCore11FileChooserD2Ev
--[WebCoreOpenPanelController disconnectFileChooser]
-__ZN7WebCore17JSTextConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20JSCommentConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSCDATASectionConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore14XMLHttpRequest4openERKNS_6StringERKNS_4KURLEbS3_S3_Ri
-__ZN3KJS17staticValueGetterIN7WebCore26JSCanvasRenderingContext2DEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore26JSCanvasRenderingContext2D16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore24CanvasRenderingContext2D9lineWidthEv
+__ZN7WebCore26setJSHTMLFormElementMethodEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLFormElement9setMethodERKNS_6StringE
+__ZN7WebCore26setJSHTMLFormElementTargetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLFormElement9setTargetERKNS_6StringE
+__ZN7WebCore14jsNodeOnchangeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node8onchangeEv
+__ZN7WebCore21jsHTMLDocumentBgColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12HTMLDocument7bgColorEv
+__ZN7WebCore19JSHTMLCanvasElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore28setJSHTMLCanvasElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLCanvasElement9setHeightEi
+__ZN7WebCore27setJSHTMLCanvasElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLCanvasElement8setWidthEi
+__ZN7WebCore24jsHTMLCanvasElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLCanvasElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionClearRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D9clearRectEffff
+__ZN7WebCore15GraphicsContext9clearRectERKNS_9FloatRectE
+__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D4rectEffff
+__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionClosePathEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D9closePathEv
+__ZN7WebCore63jsCanvasRenderingContext2DPrototypeFunctionCreateLinearGradientEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS
+__ZN7WebCore24CanvasRenderingContext2D20createLinearGradientEffffRi
+__ZN7WebCore14CanvasGradientC1ERKNS_10FloatPointES3_
+__ZN7WebCore14CanvasGradientC2ERKNS_10FloatPointES3_
+__ZNK7WebCore24CanvasRenderingContext2D27prepareGradientForDashboardEPNS_14CanvasGradientE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14CanvasGradientE
+__ZN7WebCore16JSCanvasGradient15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSCanvasGradientC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14CanvasGradientEEE
+__ZN7WebCore16JSCanvasGradientC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14CanvasGradientEEE
+__ZN7WebCore25JSCanvasGradientPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore45jsCanvasGradientPrototypeFunctionAddColorStopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSCanvasGradient9classInfoEv
+__ZN7WebCore14CanvasGradient12addColorStopEfRKNS_6StringERi
+__ZN7WebCore9CSSParser10parseColorERjRKNS_6StringEb
+__ZN7WebCore9CSSParser10parseColorEPNS_26CSSMutableStyleDeclarationERKNS_6StringE
+__ZN3WTF12bitwise_castIdlEET_T0_
+__ZN7WebCore38setJSCanvasRenderingContext2DFillStyleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26JSCanvasRenderingContext2D12setFillStyleEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore11CanvasStyleC1EN3WTF10PassRefPtrINS_14CanvasGradientEEE
+__ZN7WebCore11CanvasStyleC2EN3WTF10PassRefPtrINS_14CanvasGradientEEE
+__ZN7WebCore24CanvasRenderingContext2D12setFillStyleEN3WTF10PassRefPtrINS_11CanvasStyleEEE
+__ZN7WebCore11CanvasStyle14applyFillColorEPNS_15GraphicsContextE
+__ZN7WebCore15GraphicsContext15setFillGradientEN3WTF10PassRefPtrINS_8GradientEEE
+__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionFillEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D4fillEv
+__ZNSt17_Temporary_bufferIPN7WebCore8Gradient9ColorStopES2_EC1ES3_S3_
+__ZNSt17_Temporary_bufferIPN7WebCore8Gradient9ColorStopES2_EC2ES3_S3_
+__ZSt22__get_temporary_bufferIN7WebCore8Gradient9ColorStopEESt4pairIPT_lElS5_
+__ZSt26__uninitialized_fill_n_auxIPN7WebCore8Gradient9ColorStopElS2_EvT_T0_RKT1_St12__false_type
+__ZSt22__stable_sort_adaptiveIPN7WebCore8Gradient9ColorStopES3_lPFbRKS2_S5_EEvT_S8_T0_T1_T2_
+__ZSt24__merge_sort_with_bufferIPN7WebCore8Gradient9ColorStopES3_PFbRKS2_S5_EEvT_S8_T0_T1_
+__ZSt22__chunk_insertion_sortIPN7WebCore8Gradient9ColorStopElPFbRKS2_S5_EEvT_S8_T0_T1_
+__ZSt16__insertion_sortIPN7WebCore8Gradient9ColorStopEPFbRKS2_S5_EEvT_S8_T0_
+__ZN7WebCoreL12compareStopsERKNS_8Gradient9ColorStopES3_
+__ZSt25__unguarded_linear_insertIPN7WebCore8Gradient9ColorStopES2_PFbRKS2_S5_EEvT_T0_T1_
+__ZSt16__merge_adaptiveIPN7WebCore8Gradient9ColorStopElS3_PFbRKS2_S5_EEvT_S8_S8_T0_S9_T1_S9_T2_
+__ZSt16__merge_backwardIPN7WebCore8Gradient9ColorStopES3_S3_PFbRKS2_S5_EET1_T_S9_T0_SA_S8_T2_
+__ZSt23return_temporary_bufferIN7WebCore8Gradient9ColorStopEEvPT_
+__ZN7WebCore63jsCanvasRenderingContext2DPrototypeFunctionCreateRadialGradientEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS
+__ZN7WebCore24CanvasRenderingContext2D20createRadialGradientEffffffRi
+__ZN7WebCore14CanvasGradientC1ERKNS_10FloatPointEfS3_f
+__ZN7WebCore14CanvasGradientC2ERKNS_10FloatPointEfS3_f
+__ZN7WebCore8GradientC1ERKNS_10FloatPointEfS3_f
+__ZN7WebCore8GradientC2ERKNS_10FloatPointEfS3_f
+__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionSaveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D4saveEv
+__ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE15reserveCapacityEm
+__ZN7WebCore59jsCanvasRenderingContext2DPrototypeFunctionQuadraticCurveToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7A
+__ZN7WebCore24CanvasRenderingContext2D16quadraticCurveToEffff
+__ZN7WebCore4Path14addQuadCurveToERKNS_10FloatPointES3_
+__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionClipEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D4clipEv
+__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionDrawImageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26JSCanvasRenderingContext2D9drawImageEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_16HTMLImageElementEffffRi
+__ZN7WebCoreL4sizeEPNS_16HTMLImageElementE
+__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_16HTMLImageElementERKNS_9FloatRectES5_Ri
+__ZN7WebCore24CanvasRenderingContext2D11checkOriginERKNS_4KURLE
+__ZNK7WebCore11BitmapImage23hasSingleSecurityOriginEv
+__ZSt5mergeIPN7WebCore8Gradient9ColorStopES3_S3_PFbRKS2_S5_EET1_T_S9_T0_SA_S8_T2_
+__ZN7WebCore15GraphicsContext17setStrokeGradientEN3WTF10PassRefPtrINS_8GradientEEE
+__ZN7WebCore16JSCanvasGradientD1Ev
+__ZN7WebCore16JSCanvasGradientD2Ev
+__ZThn8_N7WebCore17HTMLCanvasElementD0Ev
+__ZN7WebCore25JSCanvasGradientPrototypeD1Ev
+__ZN7WebCore33jsDOMWindowXMLDocumentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsDOMWindowXMLSerializerConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSXMLSerializer14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSXMLSerializerConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSXMLSerializerPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSXMLSerializer15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSXMLSerializerPrototypeD1Ev
+__ZN7WebCore26JSXMLSerializerConstructorD1Ev
+__ZN7WebCore20jsMessageEventOriginEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL25max_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore29setJSHTMLScriptElementCharsetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLScriptElement10setCharsetERKNS_6StringE
+__ZN7WebCore26setJSHTMLImageElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement8setAlignERKNS_6StringE
+__ZN7WebCore17jsNodeOnmousedownEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node11onmousedownEv
+__ZN7WebCore13jsNodeOnresetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node7onresetEv
+__ZNK7WebCore26CSSMutableStyleDeclaration17getShorthandValueEPKii
+__ZN7WebCore48jsHTMLElementPrototypeFunctionInsertAdjacentHTMLEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11HTMLElement18insertAdjacentHTMLERKNS_6StringES3_Ri
+__ZN7WebCore11HTMLElement14insertAdjacentERKNS_6StringEPNS_4NodeERi
+__ZN7WebCore14RenderTableRow12imageChangedEPvPKNS_7IntRectE
+__ZN7WebCore9StyleBase11checkLoadedEv
+__ZN7WebCore10ShadowDataC1ERKS0_
+__ZN7WebCore10ShadowDataC2ERKS0_
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm64EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm64EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore26CSSMutableStyleDeclarationELm64EE15reserveCapacityEm
+__ZN7WebCore28jsHTMLHtmlElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLHtmlElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLHtmlElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZNK7WebCore16JSHTMLModElement9classInfoEv
+__ZN7WebCore16PendingCallbacks25PendingCDATABlockCallback4callEPNS_12XMLTokenizerE
+__ZN7WebCore16PendingCallbacks25PendingCDATABlockCallbackD0Ev
+__ZN7WebCore16PendingCallbacks36PendingProcessingInstructionCallback4callEPNS_12XMLTokenizerE
+__ZN7WebCore16PendingCallbacks36PendingProcessingInstructionCallbackD0Ev
+__ZN7WebCore21ProcessingInstruction19removedFromDocumentEv
+__ZN7WebCore28JSHTMLHtmlElementConstructorD1Ev
+__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionTranslateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D9translateEff
+__ZN7WebCore4Path9transformERKNS_20TransformationMatrixE
+__ZN7WebCore50jsCanvasRenderingContext2DPrototypeFunctionRestoreEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D7restoreEv
+__ZN7WebCore37setJSCanvasRenderingContext2DLineJoinEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore24CanvasRenderingContext2D11setLineJoinERKNS_6StringE
 __ZN7WebCore13parseLineJoinERKNS_6StringERNS_8LineJoinE
-__ZNK7WebCore21JSHTMLOptGroupElement9classInfoEv
-__ZNK7WebCore14RenderReplaced14caretMaxOffsetEv
-__ZN7WebCore42jsHTMLMarqueeElementPrototypeFunctionStartEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore20JSHTMLMarqueeElement9classInfoEv
-__ZN7WebCore18HTMLMarqueeElement5startEv
-__ZN7WebCore16JSHTMLCollection14callAsFunctionEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_4ListE
+__ZN7WebCore14JSCDATASection18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore12CDATASection8nodeNameEv
+__ZNK7WebCore12RenderInline12offsetHeightEv
+__ZN7WebCore23setJSDocumentXMLVersionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15parseAttributesERKNS_6StringERb
+__ZN7WebCoreL31attributesStartElementNsHandlerEPvPKhS2_S2_iPS2_iiS3_
+__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_S2_ENS_18PairFirstExtractorIS4_EENS1_10StringHashENS_14PairHashTraitsINS_10Hash
+__ZNK3WTF7HashMapIN7WebCore6StringES2_NS1_10StringHashENS_10HashTraitsIS2_EES5_E3getERKS2_
+__ZN7WebCore9DocLoader20requestXSLStyleSheetERKNS_6StringE
+__ZN7WebCore19CachedXSLStyleSheetC1ERKNS_6StringE
+__ZN7WebCore19CachedXSLStyleSheetC2ERKNS_6StringE
+__ZN7WebCore19CachedXSLStyleSheet9addClientEPNS_20CachedResourceClientE
+__ZN7WebCore12XMLTokenizer11stopParsingEv
+__ZN7WebCore18xmlDocPtrForStringEPNS_9DocLoaderERKNS_6StringES4_
+__ZN7WebCore17XMLTokenizerScopeC1EPNS_9DocLoaderEPFvPvPKczEPFvS3_P9_xmlErrorES3_
+__ZN7WebCore17XMLTokenizerScopeC2EPNS_9DocLoaderEPFvPvPKczEPFvS3_P9_xmlErrorES3_
+__ZN7WebCoreL9matchFuncEPKc
+__ZN7WebCoreL8openFuncEPKc
+__ZN7WebCoreL23shouldAllowExternalLoadERKNS_4KURLE
+__ZN7WebCoreL8readFuncEPvPci
+__ZN7WebCoreL9closeFuncEPv
+__ZN7WebCore8Document18setTransformSourceEPv
+__ZN7WebCore19CachedXSLStyleSheet5errorEv
+__ZN7WebCore19CachedXSLStyleSheet11checkNotifyEv
+__ZThn88_N7WebCore21ProcessingInstruction16setXSLStyleSheetERKNS_6StringES3_
+__ZN7WebCore21ProcessingInstruction16setXSLStyleSheetERKNS_6StringES3_
+__ZN7WebCore13XSLStyleSheetC1EPNS_4NodeERKNS_6StringEb
+__ZN7WebCore13XSLStyleSheetC2EPNS_4NodeERKNS_6StringEb
+__ZN7WebCore21ProcessingInstruction15parseStyleSheetERKNS_6StringE
+__ZN7WebCore13XSLStyleSheet11parseStringERKNS_6StringEb
+__ZN7WebCore13XSLStyleSheet9docLoaderEv
+__ZN7WebCore13XSLStyleSheet15loadChildSheetsEv
+__ZN7WebCore13XSLStyleSheet8documentEv
+__ZN7WebCore14CachedResource17allClientsRemovedEv
+__ZN7WebCore13XSLStyleSheet11checkLoadedEv
+__ZN7WebCore13XSLStyleSheet9isLoadingEv
+__ZN7WebCore21ProcessingInstruction11sheetLoadedEv
+__ZNK7WebCore21ProcessingInstruction9isLoadingEv
+__ZN7WebCore8Document17applyXSLTransformEPNS_21ProcessingInstructionE
+__ZN7WebCore13XSLTProcessor17transformToStringEPNS_4NodeERNS_6StringES4_S4_
+__ZL21initxsltSetLoaderFuncPFP7_xmlDocPKhP8_xmlDictiPv12xsltLoadTypeE
+__ZN7WebCore13XSLStyleSheetD0Ev
+__ZN7WebCore19CachedXSLStyleSheetD0Ev
+__ZN7WebCore7Element14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore21jsHTMLElementChildrenEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26setJSHTMLScriptElementTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLScriptElement7setTextERKNS_6StringE
+__ZN7WebCore16PendingCallbacks22PendingCommentCallback4callEPNS_12XMLTokenizerE
+__ZN7WebCore16PendingCallbacks22PendingCommentCallbackD0Ev
+__ZN7WebCore36jsDocumentPrototypeFunctionAdoptNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document9adoptNodeEN3WTF10PassRefPtrINS_4NodeEEERi
+__ZNK7WebCore15EntityReference8nodeNameEv
+__ZNK7WebCore14JSDocumentType9classInfoEv
+__ZNK7WebCore21ProcessingInstruction9nodeValueEv
+__ZNK7WebCore14RenderFrameSet8edgeInfoEv
+__ZN7WebCore17jsDOMWindowOnblurEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6onblurEv
+__ZN7WebCore20setJSDOMWindowOnblurEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow9setOnblurEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore17jsTextConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore6JSText14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore17JSTextConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore27jsHTMLModElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSHTMLModElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSHTMLModElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZThn8_N7WebCore21ProcessingInstructionD0Ev
+__ZN7WebCore17JSTextConstructorD1Ev
+__ZN7WebCore27JSHTMLModElementConstructorD1Ev
+__ZN7WebCore8Document15canReplaceChildEPNS_4NodeES2_
+__ZN7WebCore22jsDocumentTypeSystemIdEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsDocumentDocumentURIEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsDocumentInputEncodingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsDocumentXMLEncodingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsDocumentXMLStandaloneEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsDocumentXMLVersionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10IconLoader7didFailEPNS_17SubresourceLoaderERKNS_13ResourceErrorE
+__ZN7WebCore23JSHTMLBlockquoteElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore24setJSDocumentDocumentURIEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore8Document14setDocumentURIERKNS_6StringE
+__ZN7WebCore26setJSDocumentXMLStandaloneEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41jsXPathResultUNORDERED_NODE_SNAPSHOT_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSCustomXPathNSResolverC1EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore23JSCustomXPathNSResolverC2EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore23JSCustomXPathNSResolverD0Ev
+__ZN7WebCore40jsElementPrototypeFunctionScrollIntoViewEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element14scrollIntoViewEb
+__ZN7WebCore17JSHTMLBaseElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+-[WebCoreSynchronousLoader connection:didFailWithError:]
+__ZN7WebCore20ResourceResponseBase17setHTTPStatusCodeEi
+__ZN7WebCore40jsElementPrototypeFunctionGetAttributeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore7Element14getAttributeNSERKNS_6StringES3_
+__ZN7WebCore26setJSDOMWindowOnmousewheelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow15setOnmousewheelEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore44jsElementPrototypeFunctionSetAttributeNodeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9JSElement18setAttributeNodeNSEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore7Element18setAttributeNodeNSEPNS_4AttrERi
+__ZN7WebCore9CSSParser16parseFontFaceSrcEv
+__ZN7WebCore9CSSParser18createFontFaceRuleEv
+__ZN7WebCore15CSSFontFaceRuleC1EPNS_13CSSStyleSheetE
+__ZN7WebCore15CSSFontFaceRuleC2EPNS_13CSSStyleSheetE
+__ZN7WebCore15CSSFontFaceRule14setDeclarationEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE
+__ZN7WebCore15CSSFontFaceRule14isFontFaceRuleEv
+__ZN7WebCore15CSSFontSelector15addFontFaceRuleEPKNS_15CSSFontFaceRuleE
+__ZNK7WebCore19CSSFontFaceSrcValue16isSVGFontFaceSrcEv
+__ZNK7WebCore19CSSFontFaceSrcValue17isSupportedFormatEv
+__ZN7WebCore9DocLoader11requestFontERKNS_6StringE
+__ZN7WebCore10CachedFontC1ERKNS_6StringE
+__ZN7WebCore10CachedFontC2ERKNS_6StringE
+__ZN7WebCore10CachedFont4loadEPNS_9DocLoaderE
+__ZN7WebCore17CSSFontFaceSourceC1ERKNS_6StringEPNS_10CachedFontE
+__ZN7WebCore17CSSFontFaceSourceC2ERKNS_6StringEPNS_10CachedFontE
+__ZN7WebCore10CachedFont9addClientEPNS_20CachedResourceClientE
+__ZN7WebCore11CSSFontFace9addSourceEPNS_17CSSFontFaceSourceE
+__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE15reserveCapacityEm
+__ZNK7WebCore11CSSFontFace7isValidEv
+__ZNK7WebCore17CSSFontFaceSource7isValidEv
+__ZNK3WTF7HashMapIN7WebCore6StringEPNS_6VectorINS_6RefPtrINS1_11CSSFontFaceEEELm0EEENS1_15CaseFoldingHashENS_10HashTraitsIS2_EE
+__ZN3WTF7HashMapIN7WebCore6StringEPNS_6VectorINS_6RefPtrINS1_11CSSFontFaceEEELm0EEENS1_15CaseFoldingHashENS_10HashTraitsIS2_EEN
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS_6VectorINS_6RefPtrINS1_11CSSFontFaceEEELm0EEEENS_18PairFirstExtractorISA_EEN
+__ZN7WebCore9FontCache17getTraitsInFamilyERKNS_12AtomicStringERN3WTF6VectorIjLm0EEE
++[WebFontCache getTraits:inFamily:]
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm0EE15reserveCapacityEm
+__ZNK3WTF7HashMapIN7WebCore6StringEPNS0_IjNS_6RefPtrINS1_20CSSSegmentedFontFaceEEENS_7IntHashIjEENS_10HashTraitsIjEENS8_IS5_EEE
+__ZN3WTF7HashMapIN7WebCore6StringEPNS0_IjNS_6RefPtrINS1_20CSSSegmentedFontFaceEEENS_7IntHashIjEENS_10HashTraitsIjEENS8_IS5_EEEE
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS_7HashMapIjNS_6RefPtrINS1_20CSSSegmentedFontFaceEEENS_7IntHashIjEENS_10HashTr
+__ZNK7WebCore15FontDescription10traitsMaskEv
+__ZNK3WTF7HashMapIjNS_6RefPtrIN7WebCore20CSSSegmentedFontFaceEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE3getERKj
+__ZN7WebCore20CSSSegmentedFontFaceC1EPNS_15CSSFontSelectorE
+__ZN7WebCore20CSSSegmentedFontFaceC2EPNS_15CSSFontSelectorE
+__ZN3WTF7HashMapIjNS_6RefPtrIN7WebCore20CSSSegmentedFontFaceEEENS_7IntHashIjEENS_10HashTraitsIjEENS7_IS4_EEE3setERKjRKS4_
+__ZN3WTF9HashTableIjSt4pairIjNS_6RefPtrIN7WebCore20CSSSegmentedFontFaceEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14Pai
+__ZNSt17_Temporary_bufferIPPN7WebCore11CSSFontFaceES2_EC1ES3_S3_
+__ZNSt17_Temporary_bufferIPPN7WebCore11CSSFontFaceES2_EC2ES3_S3_
+__ZSt22__get_temporary_bufferIPN7WebCore11CSSFontFaceEESt4pairIPT_lElS5_
+__ZSt22__stable_sort_adaptiveIPPN7WebCore11CSSFontFaceES3_lPFbS2_S2_EEvT_S6_T0_T1_T2_
+__ZSt24__merge_sort_with_bufferIPPN7WebCore11CSSFontFaceES3_PFbS2_S2_EEvT_S6_T0_T1_
+__ZSt22__chunk_insertion_sortIPPN7WebCore11CSSFontFaceElPFbS2_S2_EEvT_S6_T0_T1_
+__ZSt16__insertion_sortIPPN7WebCore11CSSFontFaceEPFbS2_S2_EEvT_S6_T0_
+__ZSt16__merge_adaptiveIPPN7WebCore11CSSFontFaceElS3_PFbS2_S2_EEvT_S6_S6_T0_S7_T1_S7_T2_
+__ZSt5mergeIPPN7WebCore11CSSFontFaceES3_S3_PFbS2_S2_EET1_T_S7_T0_S8_S6_T2_
+__ZN7WebCoreL16compareFontFacesEPNS_11CSSFontFaceES1_
+__ZSt23return_temporary_bufferIPN7WebCore11CSSFontFaceEEvPT_
+__ZN7WebCore20CSSSegmentedFontFace14appendFontFaceEN3WTF10PassRefPtrINS_11CSSFontFaceEEE
+__ZN7WebCore20CSSSegmentedFontFace10pruneTableEv
+__ZN7WebCore11CSSFontFace24addedToSegmentedFontFaceEPNS_20CSSSegmentedFontFaceE
+__ZN3WTF7HashSetIPN7WebCore20CSSSegmentedFontFaceENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore20CSSSegmentedFontFaceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6e
+__ZN3WTF9HashTableIPN7WebCore20CSSSegmentedFontFaceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6r
+__ZN3WTF9HashTableIPN7WebCore20CSSSegmentedFontFaceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13
+__ZN3WTF9HashTableIPN7WebCore20CSSSegmentedFontFaceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm1EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm1EE15reserveCapacityEm
+__ZN3WTF6VectorIPN7WebCore11CSSFontFaceELm32EE6shrinkEm
+__ZN7WebCore20CSSSegmentedFontFace11getFontDataERKNS_15FontDescriptionE
+__ZNK7WebCore20CSSSegmentedFontFace7isValidEv
+__ZNK3WTF7HashMapIjPN7WebCore17SegmentedFontDataENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE3getERKj
+__ZN7WebCore11CSSFontFace11getFontDataERKNS_15FontDescriptionEbb
+__ZN7WebCore17CSSFontFaceSource11getFontDataERKNS_15FontDescriptionEbbPNS_15CSSFontSelectorE
+__ZNK3WTF7HashMapIjPN7WebCore14SimpleFontDataENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE3getERKj
+__ZNK7WebCore17CSSFontFaceSource8isLoadedEv
+__ZNK7WebCore15CSSFontSelector9docLoaderEv
+__ZN7WebCore10CachedFont17beginLoadIfNeededEPNS_9DocLoaderE
+__ZN7WebCore9FontCache25getLastResortFallbackFontERKNS_15FontDescriptionE
+__ZN3WTF7HashMapIjPN7WebCore14SimpleFontDataENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE3setERKjRKS3_
+__ZN3WTF9HashTableIjSt4pairIjPN7WebCore14SimpleFontDataEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_10H
+__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE15reserveCapacityEm
+__ZN3WTF7HashMapIjPN7WebCore17SegmentedFontDataENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE3setERKjRKS3_
+__ZN3WTF9HashTableIjSt4pairIjPN7WebCore17SegmentedFontDataEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_
+__ZNK7WebCore17SegmentedFontData12isCustomFontEv
+__ZNK7WebCore17SegmentedFontData9isLoadingEv
+__ZNK7WebCore17SegmentedFontData20fontDataForCharacterEi
+__ZNK7WebCore17SegmentedFontData11isSegmentedEv
+__ZN7WebCore10CachedFont4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
+__ZN7WebCore10CachedFont11checkNotifyEv
+__ZN7WebCore17CSSFontFaceSource10fontLoadedEPNS_10CachedFontE
+__ZN7WebCore17CSSFontFaceSource10pruneTableEv
+__ZN7WebCore17GlyphPageTreeNode23pruneTreeCustomFontDataEPKNS_8FontDataE
+__ZN7WebCore17GlyphPageTreeNode19pruneCustomFontDataEPKNS_8FontDataE
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore14SimpleFontDataEKNS_7HashMapIjS3_NS_7IntHashIjEENS_10HashTraitsIjEENS7_IS3_EEEEEEvRT0
+__ZN7WebCore11CSSFontFace10fontLoadedEPNS_17CSSFontFaceSourceE
+__ZN7WebCore20CSSSegmentedFontFace10fontLoadedEPNS_11CSSFontFaceE
+__ZN3WTF20deleteAllPairSecondsIPN7WebCore17SegmentedFontDataEKNS_7HashMapIjS3_NS_7IntHashIjEENS_10HashTraitsIjEENS7_IS3_EEEEEEv
+__ZN7WebCore17SegmentedFontDataD0Ev
+__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE6shrinkEm
+__ZN7WebCore15CSSFontSelector10fontLoadedEv
+__ZN7WebCore10CachedFont20ensureCustomFontDataEv
+__ZN7WebCore28createFontCustomPlatformDataEPNS_12SharedBufferE
+__ZN7WebCore10CachedFont26platformDataFromCustomDataEfbbNS_17FontRenderingModeE
+__ZN7WebCore22FontCustomPlatformData16fontPlatformDataEibbNS_17FontRenderingModeE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm0EE6shrinkEm
+__ZN7WebCore20CSSSegmentedFontFaceD1Ev
+__ZN7WebCore20CSSSegmentedFontFaceD2Ev
+__ZN7WebCore11CSSFontFace28removedFromSegmentedFontFaceEPNS_20CSSSegmentedFontFaceE
+__ZN3WTF9HashTableIPN7WebCore20CSSSegmentedFontFaceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4f
+__ZN3WTF9HashTableIPN7WebCore20CSSSegmentedFontFaceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11CSSFontFaceEEELm1EE6shrinkEm
+__ZN7WebCore11CSSFontFaceD1Ev
+__ZN7WebCore11CSSFontFaceD2Ev
+__ZN3WTF15deleteAllValuesIPN7WebCore17CSSFontFaceSourceELm0EEEvRKNS_6VectorIT_XT0_EEE
+__ZN7WebCore17CSSFontFaceSourceD0Ev
+__ZN7WebCore10CachedFont17allClientsRemovedEv
+__ZN7WebCore22FontCustomPlatformDataD1Ev
+__ZN7WebCore22FontCustomPlatformDataD2Ev
+__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE6shrinkEm
+__ZN7WebCore10CachedFontD0Ev
+__ZN7WebCore15CSSFontFaceRuleD0Ev
+__ZN7WebCore19CSSFontFaceSrcValueD0Ev
+__ZN7WebCore13jsNodeBaseURIEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14jsStringOrNullEPN3JSC9ExecStateERKNS_4KURLE
+__ZNK7WebCore12DocumentType7baseURIEv
+__ZNK7WebCore7Element7baseURIEv
+__ZN7WebCore27setJSHTMLScriptElementDeferEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLScriptElement8setDeferEb
+__ZN7WebCore22jsDocumentTypePublicIdEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsDocumentPrototypeFunctionCreateRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_5RangeE
+__ZN7WebCore7JSRange15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore7JSRangeC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_5RangeEEE
+__ZN7WebCore7JSRangeC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_5RangeEEE
+__ZN7WebCore7JSRange18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16JSRangePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore32jsRangePrototypeFunctionSetStartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore7JSRange9classInfoEv
+__ZN7WebCore34jsRangePrototypeFunctionInsertNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore5Range10insertNodeEN3WTF10PassRefPtrINS_4NodeEEERi
+__ZNK7WebCore5Range19containedByReadOnlyEv
+__ZN7WebCore5Range13textNodeSplitEPNS_4TextE
+__ZN7WebCore7JSRangeD1Ev
+__ZN7WebCore7JSRangeD2Ev
+__ZN7WebCore5Range17nodeWillBeRemovedEPNS_4NodeE
+__ZN7WebCore16JSRangePrototypeD1Ev
+__ZN7WebCore15jsNodeOnmouseupEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node9onmouseupEv
+__ZN7WebCore44jsElementPrototypeFunctionGetAttributeNodeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore23jsHTMLAnchorElementHashEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement4hashEv
+__ZN7WebCore17jsDOMWindowStatusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow6statusEv
+__ZNK7WebCore5Frame15jsStatusBarTextEv
+__ZN7WebCore4Node12insertBeforeEN3WTF10PassRefPtrIS0_EEPS0_Rib
+__ZN7WebCore41jsNodePrototypeFunctionIsDefaultNamespaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore4Node18isDefaultNamespaceERKNS_12AtomicStringE
+__ZN7WebCore34jsNodePrototypeFunctionIsEqualNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore4Node11isEqualNodeEPS0_
+__ZNK7WebCore4Node13virtualPrefixEv
+__ZN7WebCore33jsNodePrototypeFunctionIsSameNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSNamedNodeMap10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore41jsNodePrototypeFunctionLookupNamespaceURIEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore35jsNodePrototypeFunctionLookupPrefixEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore4Node12lookupPrefixERKNS_12AtomicStringE
+__ZNK7WebCore4Node21lookupNamespacePrefixERKNS_12AtomicStringEPKNS_7ElementE
+__ZN7WebCore4Node11removeChildEPS0_Ri
+__ZSt16__merge_backwardIPPN7WebCore11CSSFontFaceES3_S3_PFbS2_S2_EET1_T_S7_T0_S8_S6_T2_
+__ZN7WebCore24jsDocumentDefaultCharsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8Document14defaultCharsetEv
 __ZN7WebCore19TextResourceDecoder22detectJapaneseEncodingEPKcm
 __ZN7WebCore9KanjiCode5judgeEPKci
-__ZN7WebCore36jsDOMWindowPrototypeFunctionScrollByEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9DOMWindow8scrollByEii
-__ZN7WebCore10ScrollView8scrollByEii
-__ZN7WebCore9InlineBox15clearTruncationEv
-__ZNK7WebCore16HTMLInputElement12defaultValueEv
-__ZN7WebCore15newTextCodecMacERKNS_12TextEncodingEPKv
-__ZN7WebCore12TextCodecMacC1Em
-__ZN7WebCore12TextCodecMac6decodeEPKcmb
-__ZNK7WebCore12TextCodecMac18createTECConverterEv
-__ZN7WebCore12TextCodecMac6decodeEPKhiRiPviS3_
-__ZNK7WebCore12TextCodecMac19releaseTECConverterEv
-__ZN7WebCore24submitButtonDefaultLabelEv
-__ZN7WebCore10helpCursorEv
-__ZN7WebCore12HTMLDocument13setDesignModeERKNS_6StringE
-__ZN7WebCore8Document13setDesignModeENS0_13InheritedBoolE
-__ZN7WebCore17JSHTMLFormElement11indexGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore15HTMLFormElement4itemEj
-__ZN7WebCore20CompositeEditCommand17replaceTextInNodeEPNS_4TextEiiRKNS_6StringE
-__ZN7WebCore41jsDOMSelectionPrototypeFunctionGetRangeAtEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12DOMSelection10getRangeAtEiRi
-__ZN7WebCore34jsRangePrototypeFunctionCloneRangeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN3KJS17staticValueGetterIN7WebCore7JSRangeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore7JSRange16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore15executeFontSizeEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore6Editor10applyStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
-__ZN7WebCore5Frame24computeAndSetTypingStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
-__ZN7WebCore26CSSMutableStyleDeclaration11makeMutableEv
-__ZNK7WebCore26CSSMutableStyleDeclaration19copyBlockPropertiesEv
+__ZN7WebCore23JSProcessingInstruction3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore21ProcessingInstruction12setNodeValueERKNS_6StringERi
+__ZN7WebCore21ProcessingInstruction7setDataERKNS_6StringERi
+__ZN7WebCore26jsCSSStyleRuleSelectorTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLEmbedElement14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore23JSHTMLBlockquoteElement9classInfoEv
+__ZN7WebCore39jsTextPrototypeFunctionReplaceWholeTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4Text16replaceWholeTextERKNS_6StringERi
+__ZN7WebCoreL33earliestLogicallyAdjacentTextNodeEPKNS_4TextE
+__ZN7WebCoreL31latestLogicallyAdjacentTextNodeEPKNS_4TextE
+__ZN7WebCore15jsTextWholeTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Text9wholeTextEv
+__ZN7WebCore21jsNodeListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSNodeList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSNodeListConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore19JSNodeListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore34jsLocationPrototypeFunctionReplaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore10JSLocation7replaceEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore21JSNodeListConstructorD1Ev
+__ZN7WebCore14RenderThemeMac28paintSearchFieldCancelButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZNK7WebCore16JSHTMLMapElement9classInfoEv
+__ZN7WebCore24jsHTMLDocumentDesignModeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12HTMLDocument10designModeEv
+__ZN7WebCore31jsHTMLHeadingElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSHTMLHeadingElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore29JSHTMLHeadingElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSHTMLHeadingElementConstructorD1Ev
+__ZN7WebCore11HTMLElement18setContentEditableEPNS_15MappedAttributeE
+__ZN7WebCore40jsDOMWindowPrototypeFunctionGetSelectionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow12getSelectionEv
+__ZN7WebCore12DOMSelectionC1EPNS_5FrameE
+__ZN7WebCore12DOMSelectionC2EPNS_5FrameE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12DOMSelectionE
+__ZN7WebCore14JSDOMSelection15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSDOMSelectionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12DOMSelectionEEE
+__ZN7WebCore14JSDOMSelectionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12DOMSelectionEEE
+__ZN7WebCore14JSDOMSelection18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23JSDOMSelectionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsDOMSelectionPrototypeFunctionSetPositionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14JSDOMSelection9classInfoEv
+__ZN7WebCore12DOMSelection11setPositionEPNS_4NodeEiRi
+__ZN7WebCore19SelectionController6moveToERKNS_15VisiblePositionEb
+__ZN7WebCore31SimplifiedBackwardsTextIterator21handleReplacedElementEv
+__ZN7WebCoreL13executeDeleteEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore32lineBreakExistsAtVisiblePositionERKNS_15VisiblePositionE
+__ZN7WebCore21positionBeforeTabSpanERKNS_8PositionE
+__ZNK7WebCore4Node14lastDescendantEv
+__ZN7WebCore14caretMinOffsetEPKNS_4NodeE
+__ZN7WebCore20CompositeEditCommand21removeChildrenInRangeEN3WTF10PassRefPtrINS_4NodeEEEjj
+__ZNK7WebCore15VisiblePosition19absoluteCaretBoundsEv
+__ZN7WebCore20CompositeEditCommand13moveParagraphERKNS_15VisiblePositionES3_S3_bb
+__ZN7WebCore20CompositeEditCommand14moveParagraphsERKNS_15VisiblePositionES3_S3_bb
+__ZN7WebCore11EditCommand15styleAtPositionERKNS_8PositionE
+__ZN7WebCore26CSSMutableStyleDeclaration21removeBlockPropertiesEv
+__ZN7WebCore20CompositeEditCommand15deleteSelectionEbbbb
+__ZN7WebCore20CompositeEditCommand27removeNodeAndPruneAncestorsEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore22DeleteSelectionCommand10removeNodeEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore20isTableStructureNodeEPKNS_4NodeE
+__ZN7WebCoreL28updatePositionForNodeRemovalEPNS_4NodeERNS_8PositionE
+__ZN7WebCore20CompositeEditCommand10removeNodeEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore17RemoveNodeCommandC1EN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore17RemoveNodeCommandC2EN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore17RemoveNodeCommand7doApplyEv
+__ZN7WebCore20CompositeEditCommand5pruneEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore14isStartOfBlockERKNS_15VisiblePositionE
+__ZN7WebCore23ReplaceSelectionCommandC1EPNS_8DocumentEN3WTF10PassRefPtrINS_16DocumentFragmentEEEbbbbbNS_10EditActionE
+__ZN7WebCore23ReplaceSelectionCommandC2EPNS_8DocumentEN3WTF10PassRefPtrINS_16DocumentFragmentEEEbbbbbNS_10EditActionE
+__ZN7WebCore23ReplaceSelectionCommand7doApplyEv
+__ZN7WebCore19ReplacementFragmentC1EPNS_8DocumentEPNS_16DocumentFragmentEbRKNS_16VisibleSelectionE
+__ZN7WebCore19ReplacementFragmentC2EPNS_8DocumentEPNS_16DocumentFragmentEbRKNS_16VisibleSelectionE
+__ZN7WebCore23ReplaceSelectionCommand21performTrivialReplaceERKNS_19ReplacementFragmentE
+__ZNK7WebCore19ReplacementFragment10firstChildEv
+__ZN7WebCore20CompositeEditCommand35prepareWhitespaceAtPositionForSplitERNS_8PositionE
+__ZN7WebCore20CompositeEditCommand22positionOutsideTabSpanERKNS_8PositionE
+__ZN7WebCoreL26isMailPasteAsQuotationNodeEPKNS_4NodeE
+__ZN7WebCore11isStyleSpanEPKNS_4NodeE
+__ZNK7WebCore19ReplacementFragment7isEmptyEv
+__ZN7WebCore20CompositeEditCommand10applyStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
+__ZN7WebCore17ApplyStyleCommandC1EPNS_8DocumentEPNS_19CSSStyleDeclarationENS_10EditActionENS0_14EPropertyLevelE
 __ZN7WebCore17ApplyStyleCommandC2EPNS_8DocumentEPNS_19CSSStyleDeclarationENS_10EditActionENS0_14EPropertyLevelE
 __ZN7WebCore17ApplyStyleCommand7doApplyEv
-__ZNK7WebCore26CSSMutableStyleDeclaration4copyEv
+__ZNK7WebCore26CSSMutableStyleDeclaration19copyBlockPropertiesEv
 __ZN7WebCore17ApplyStyleCommand28applyRelativeFontStyleChangeEPNS_26CSSMutableStyleDeclarationE
 __ZN7WebCore17ApplyStyleCommand16applyInlineStyleEPNS_26CSSMutableStyleDeclarationE
 __ZN7WebCore17ApplyStyleCommand13startPositionEv
@@ -9913,4199 +14127,9872 @@ __ZN7WebCore17ApplyStyleCommand11endPositionEv
 __ZN7WebCore17ApplyStyleCommand31splitTextElementAtStartIfNeededERKNS_8PositionES3_
 __ZN7WebCore17ApplyStyleCommand29splitTextElementAtEndIfNeededERKNS_8PositionES3_
 __ZN7WebCore17ApplyStyleCommand17removeInlineStyleEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEERKNS_8PositionES7_
+__ZN7WebCore17ApplyStyleCommand39pushDownTextDecorationStyleAtBoundariesERKNS_8PositionES3_
+__ZN7WebCore17ApplyStyleCommand37pushDownTextDecorationStyleAroundNodeEPNS_4NodeEb
 __ZNK7WebCore17ApplyStyleCommand17nodeFullySelectedEPNS_4NodeERKNS_8PositionES5_
+__ZN7WebCore17ApplyStyleCommand14updateStartEndERKNS_8PositionES3_
+__ZN7WebCore17ApplyStyleCommand23applyInlineStyleToRangeEPNS_26CSSMutableStyleDeclarationERKNS_8PositionES5_
+__ZN7WebCore17ApplyStyleCommand30cleanupUnstyledAppleStyleSpansEPNS_4NodeE
+__ZN7WebCore17RemoveNodeCommandD0Ev
+__ZN7WebCore23ReplaceSelectionCommandD0Ev
+__ZN7WebCore17ApplyStyleCommandD0Ev
+__ZN7WebCore12DOMSelection15disconnectFrameEv
+__ZN7WebCore14JSDOMSelectionD1Ev
+__ZN7WebCore14JSDOMSelectionD2Ev
+__ZN7WebCore23JSDOMSelectionPrototypeD1Ev
+__ZN7WebCore4Node13computedStyleEv
+__ZN7WebCore22DeleteSelectionCommandC1EPNS_8DocumentEbbbb
+__ZN7WebCore22DeleteSelectionCommandC2EPNS_8DocumentEbbbb
 __ZN7WebCore17ApplyStyleCommand15isHTMLStyleNodeEPNS_26CSSMutableStyleDeclarationEPNS_11HTMLElementE
 __ZN7WebCore17ApplyStyleCommand19removeHTMLFontStyleEPNS_26CSSMutableStyleDeclarationEPNS_11HTMLElementE
+__ZN7WebCore17ApplyStyleCommand28removeHTMLBidiEmbeddingStyleEPNS_26CSSMutableStyleDeclarationEPNS_11HTMLElementE
 __ZN7WebCore17ApplyStyleCommand14removeCSSStyleEPNS_26CSSMutableStyleDeclarationEPNS_11HTMLElementE
-__ZN7WebCore19isUnstyledStyleSpanEPKNS_4NodeE
-__ZN7WebCore17ApplyStyleCommand14updateStartEndERKNS_8PositionES3_
-__ZN7WebCore5RangeC2EPNS_8DocumentERKNS_8PositionES5_
-__ZNK7WebCore4Node14childNodeCountEv
 __ZN7WebCore17ApplyStyleCommand22addInlineStyleIfNeededEPNS_26CSSMutableStyleDeclarationEPNS_4NodeES4_
-__ZN7WebCore11StyleChange21styleModeForParseModeEb
-__ZN7WebCore11StyleChangeC2EPNS_19CSSStyleDeclarationERKNS_8PositionENS0_17ELegacyHTMLStylesE
+__ZN7WebCore11StyleChangeC1EPNS_19CSSStyleDeclarationERKNS_8PositionE
+__ZN7WebCore11StyleChangeC2EPNS_19CSSStyleDeclarationERKNS_8PositionE
 __ZN7WebCore11StyleChange4initEN3WTF10PassRefPtrINS_19CSSStyleDeclarationEEERKNS_8PositionE
 __ZN7WebCore11StyleChange17currentlyHasStyleERKNS_8PositionEPKNS_11CSSPropertyE
-__ZN7WebCore22createStyleSpanElementEPNS_8DocumentE
-__ZN7WebCore20styleSpanClassStringEv
-__ZN7WebCore17ApplyStyleCommand28surroundNodeRangeWithElementEPNS_4NodeES2_PNS_7ElementE
-__ZN7WebCore17ApplyStyleCommand30cleanupUnstyledAppleStyleSpansEPNS_4NodeE
-__ZNK7WebCore17ApplyStyleCommand13editingActionEv
-__ZNK7WebCore11EditCommand15isTypingCommandEv
-__ZN7WebCore27enabledInRichlyEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
-__ZN7WebCore17executeToggleBoldEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore18executeToggleStyleEPNS_5FrameENS_19EditorCommandSourceENS_10EditActionEiPKcS5_
-__ZNK7WebCore6Editor22selectionStartHasStyleEPNS_19CSSStyleDeclarationE
-__ZNK7WebCore5Frame22selectionComputedStyleERPNS_4NodeE
-__ZN7WebCore20CompositeEditCommand17removeCSSPropertyEPNS_19CSSStyleDeclarationEi
-__ZN7WebCore24RemoveCSSPropertyCommandC2EPNS_8DocumentEPNS_19CSSStyleDeclarationEi
-__ZN7WebCore24RemoveCSSPropertyCommand7doApplyEv
-__ZN7WebCore20CompositeEditCommand28removeNodePreservingChildrenEPNS_4NodeE
-__ZN7WebCore35RemoveNodePreservingChildrenCommandC2EPNS_4NodeE
-__ZN7WebCore35RemoveNodePreservingChildrenCommand7doApplyEv
-__ZN7WebCore19executeToggleItalicEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore16executeForeColorEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore17executeApplyStyleEPNS_5FrameENS_19EditorCommandSourceENS_10EditActionEiRKNS_6StringE
-__ZNK7WebCore12DOMSelection11isCollapsedEv
-__ZN7WebCore34jsDOMWindowPrototypeFunctionPromptEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9DOMWindow6promptERKNS_6StringES3_
-__ZN7WebCore6Chrome19runJavaScriptPromptEPNS_5FrameERKNS_6StringES5_RS3_
-__ZN7WebCore21PageGroupLoadDeferrerC2EPNS_4PageEb
-__ZN7WebCore21PageGroupLoadDeferrerD2Ev
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm16EE6shrinkEm
-__ZN7WebCore17executeCreateLinkEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore17CreateLinkCommandC1EPNS_8DocumentERKNS_6StringE
-__ZN7WebCore17CreateLinkCommand7doApplyEv
-__ZN7WebCore20CompositeEditCommand39pushPartiallySelectedAnchorElementsDownEv
-__ZN7WebCore20CompositeEditCommand18applyStyledElementEPNS_7ElementE
-__ZN7WebCore17ApplyStyleCommandC1EPNS_7ElementEbNS_10EditActionE
-__ZNK7WebCore17CreateLinkCommand13editingActionEv
-__ZN7WebCore20executeJustifyCenterEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore26executeApplyParagraphStyleEPNS_5FrameENS_19EditorCommandSourceENS_10EditActionEiRKNS_6StringE
-__ZN7WebCore6Editor19applyParagraphStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
-__ZN7WebCore17ApplyStyleCommand15applyBlockStyleEPNS_26CSSMutableStyleDeclarationE
-__ZN7WebCore20CompositeEditCommand42moveParagraphContentsToNewBlockIfNecessaryERKNS_8PositionE
-__ZN7WebCore17ApplyStyleCommand13addBlockStyleERKNS_11StyleChangeEPNS_11HTMLElementE
-__ZN7WebCore20CompositeEditCommand16setNodeAttributeEPNS_7ElementERKNS_13QualifiedNameERKNS_6StringE
-__ZN7WebCore23SetNodeAttributeCommandC2EPNS_7ElementERKNS_13QualifiedNameERKNS_6StringE
-__ZN7WebCore23SetNodeAttributeCommand7doApplyEv
-__ZN7WebCore12TextIterator26rangeFromLocationAndLengthEPNS_7ElementEiib
-__ZN7WebCore19executeJustifyRightEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore18executeJustifyFullEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore18executeJustifyLeftEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore24executeInsertOrderedListEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore17InsertListCommandC2EPNS_8DocumentENS0_4TypeERKNS_6StringE
-__ZN7WebCore17InsertListCommand7doApplyEv
-__ZN7WebCore17InsertListCommand11modifyRangeEv
-__ZN7WebCore30selectionForParagraphIterationERKNS_9SelectionE
-__ZN7WebCore21createListItemElementEPNS_8DocumentE
-__ZN7WebCore22outermostEnclosingListEPNS_4NodeE
-__ZN7WebCore13enclosingListEPNS_4NodeE
-__ZN7WebCore24createOrderedListElementEPNS_8DocumentE
-__ZN7WebCore20CompositeEditCommand13moveParagraphERKNS_15VisiblePositionES3_S3_bb
-__ZN7WebCore20CompositeEditCommand14moveParagraphsERKNS_15VisiblePositionES3_S3_bb
-__ZN7WebCore12createMarkupEPKNS_5RangeEPN3WTF6VectorIPNS_4NodeELm0EEENS_23EAnnotateForInterchangeEb
-__ZN7WebCore25avoidIntersectionWithNodeEPKNS_5RangeEPNS_4NodeE
-__ZN7WebCore14getStartMarkupEPKNS_4NodeEPKNS_5RangeENS_23EAnnotateForInterchangeEbPN3WTF7HashMapIPNS_16AtomicStringImplESA_NS7_7PtrHashISA_EENS7_10HashTraitsISA_EESE_EE
-__ZN7WebCore12getEndMarkupEPKNS_4NodeE
-__ZN7WebCore13computedStyleEPNS_4NodeE
-__ZN7WebCore28propertyMissingOrEqualToNoneEPNS_26CSSMutableStyleDeclarationEi
-__ZN7WebCore32elementHasTextDecorationPropertyEPKNS_4NodeE
-__ZN7WebCore34styleFromMatchedRulesAndInlineDeclEPKNS_4NodeE
-__ZN7WebCore31styleFromMatchedRulesForElementEPNS_7ElementEb
-__ZN7WebCore26CSSMutableStyleDeclaration5mergeEPS0_b
-__ZN7WebCore26CSSMutableStyleDeclaration21removeBlockPropertiesEv
-__ZN7WebCore11joinMarkupsEN3WTF6VectorINS_6StringELm0EEERKS3_
-__ZN7WebCore24createFragmentFromMarkupEPNS_8DocumentERKNS_6StringES4_
-__ZN7WebCore20CompositeEditCommand10applyStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
-__ZN7WebCore17ApplyStyleCommand39pushDownTextDecorationStyleAtBoundariesERKNS_8PositionES3_
-__ZN7WebCore17ApplyStyleCommand37pushDownTextDecorationStyleAroundNodeEPNS_4NodeERKNS_8PositionES5_b
-__ZNK7WebCore8RenderBR14caretMaxOffsetEv
-__ZN7WebCore20CompositeEditCommand27removeNodeAndPruneAncestorsEPNS_4NodeE
-__ZN7WebCore20CompositeEditCommand5pruneEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore22hasARenderedDescendantEPNS_4NodeE
-__ZN7WebCore23ReplaceSelectionCommandC2EPNS_8DocumentEN3WTF10PassRefPtrINS_16DocumentFragmentEEEbbbbbNS_10EditActionE
-__ZN7WebCore23ReplaceSelectionCommand7doApplyEv
-__ZN7WebCore19ReplacementFragmentC2EPNS_8DocumentEPNS_16DocumentFragmentEbRKNS_9SelectionE
+__ZNK7WebCore27CSSComputedStyleDeclaration36getFontSizeCSSValuePreferringKeywordEv
 __ZN7WebCore19ReplacementFragment22removeInterchangeNodesEPNS_4NodeE
-__ZN7WebCore24isInterchangeNewlineNodeEPKNS_4NodeE
-__ZN7WebCore31isInterchangeConvertedSpaceSpanEPKNS_4NodeE
-__ZN7WebCore20CompositeEditCommand35prepareWhitespaceAtPositionForSplitERNS_8PositionE
-__ZNK7WebCore19ReplacementFragment10firstChildEv
-__ZN7WebCore11isStyleSpanEPKNS_4NodeE
-__ZNK7WebCore19ReplacementFragment7isEmptyEv
+__ZN7WebCoreL24isInterchangeNewlineNodeEPKNS_4NodeE
+__ZN7WebCoreL31isInterchangeConvertedSpaceSpanEPKNS_4NodeE
+__ZNK7WebCore19ReplacementFragment9lastChildEv
+__ZN7WebCoreL20styleSpanClassStringEv
+__ZN7WebCore19ReplacementFragment28removeNodePreservingChildrenEPNS_4NodeE
 __ZN7WebCore19ReplacementFragment10removeNodeEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore23ReplaceSelectionCommand34insertNodeAtAndUpdateNodesInsertedEPNS_4NodeERKNS_8PositionE
+__ZN7WebCore19ReplacementFragment16insertNodeBeforeEN3WTF10PassRefPtrINS_4NodeEEEPS3_
+__ZN7WebCore23ReplaceSelectionCommand34insertNodeAtAndUpdateNodesInsertedEN3WTF10PassRefPtrINS_4NodeEEERKNS_8PositionE
 __ZN7WebCore23ReplaceSelectionCommand19updateNodesInsertedEPNS_4NodeE
 __ZN7WebCore23ReplaceSelectionCommand31removeUnrenderedTextNodesAtEndsEv
 __ZN7WebCore23ReplaceSelectionCommand36negateStyleRulesThatAffectAppearanceEv
-__ZN7WebCore23ReplaceSelectionCommand21removeRedundantStylesEPNS_4NodeE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HTMLElementEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HTMLElementEEELm0EE15reserveCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore26CSSMutableStyleDeclarationEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore26CSSMutableStyleDeclarationEEELm0EE15reserveCapacityEm
-__ZN7WebCore27CSSComputedStyleDeclaration39removeComputedInheritablePropertiesFromEPNS_26CSSMutableStyleDeclarationE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HTMLElementEEELm0EE6shrinkEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore26CSSMutableStyleDeclarationEEELm0EE6shrinkEm
 __ZN7WebCore23ReplaceSelectionCommand30positionAtEndOfInsertedContentEv
 __ZN7WebCore23ReplaceSelectionCommand32positionAtStartOfInsertedContentEv
 __ZN7WebCore23ReplaceSelectionCommand17shouldRemoveEndBREPNS_4NodeERKNS_15VisiblePositionE
-__ZN7WebCore23ReplaceSelectionCommand16shouldMergeStartEbb
 __ZN7WebCore23ReplaceSelectionCommand14shouldMergeEndEb
+__ZN7WebCore23ReplaceSelectionCommand16shouldMergeStartEbbb
+__ZN7WebCore23ReplaceSelectionCommand16mergeEndIfNeededEv
 __ZN7WebCore23ReplaceSelectionCommand26handlePasteAsQuotationNodeEv
-__ZN7WebCore26isMailPasteAsQuotationNodeEPKNS_4NodeE
 __ZN7WebCore23ReplaceSelectionCommand23completeHTMLReplacementERKNS_8PositionE
-__ZNK7WebCore17InsertListCommand13editingActionEv
-__ZN7WebCore20CompositeEditCommand21removeChildrenInRangeEPNS_4NodeEii
-__ZN7WebCore6Editor24insertParagraphSeparatorEv
-__ZN7WebCore13TypingCommand24insertParagraphSeparatorEPNS_8DocumentE
-__ZN7WebCore13TypingCommand24insertParagraphSeparatorEv
-__ZN7WebCore31InsertParagraphSeparatorCommandC2EPNS_8DocumentEb
-__ZN7WebCore31InsertParagraphSeparatorCommand7doApplyEv
-__ZN7WebCore31InsertParagraphSeparatorCommand29calculateStyleBeforeInsertionERKNS_8PositionE
-__ZN7WebCore11EditCommand15styleAtPositionERKNS_8PositionE
-__ZN7WebCore14isStartOfBlockERKNS_15VisiblePositionE
-__ZN7WebCore12startOfBlockERKNS_15VisiblePositionE
-__ZN7WebCore20CompositeEditCommand22appendBlockPlaceholderEPNS_4NodeE
-__ZN7WebCore29createBlockPlaceholderElementEPNS_8DocumentE
-__ZN7WebCore31InsertParagraphSeparatorCommand24applyStyleAfterInsertionEv
-__ZNK7WebCore31InsertParagraphSeparatorCommand20preservesTypingStyleEv
-__ZN7WebCore29createDefaultParagraphElementEPNS_8DocumentE
-__ZN7WebCore22nonBreakingSpaceStringEv
-__ZN7WebCore26executeInsertUnorderedListEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore23ReplaceSelectionCommand28removeNodePreservingChildrenEPNS_4NodeE
-__ZN7WebCore26createUnorderedListElementEPNS_8DocumentE
-__ZN7WebCore37jsRangePrototypeFunctionCloneContentsEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore5Range13cloneContentsERi
-__ZN7WebCore5Range15processContentsENS0_10ActionTypeERi
-__ZN7WebCore23JSHTMLBlockquoteElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore23JSHTMLBlockquoteElement9classInfoEv
-__ZN7WebCore4Node11setDocumentEPNS_8DocumentE
-__ZN7WebCore4Node26willMoveToNewOwnerDocumentEv
-__ZN3KJS17ScriptInterpreter21updateDOMNodeDocumentEPN7WebCore4NodeEPNS1_8DocumentES5_
-__ZN7WebCore4Node25didMoveToNewOwnerDocumentEv
-__ZN7WebCore46jsDOMSelectionPrototypeFunctionRemoveAllRangesEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12DOMSelection15removeAllRangesEv
-__ZN7WebCore38jsRangePrototypeFunctionDeleteContentsEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore5Range14deleteContentsERi
-__ZN7WebCore5Range18checkDeleteExtractERi
-__ZNK7WebCore5Range19containedByReadOnlyEv
-__ZN7WebCore30jsRangePrototypeFunctionSetEndEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore16RenderListMarker18canBeSelectionLeafEv
-__ZN7WebCore16RenderListMarker17setSelectionStateENS_12RenderObject14SelectionStateE
-__ZN7WebCore16RenderListMarker13selectionRectEb
-__ZN7WebCore24RemoveCSSPropertyCommandD1Ev
-__ZN7WebCore17CreateLinkCommandD1Ev
-__ZN7WebCore18JSDocumentFragment18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore43jsDOMCoreExceptionPrototypeFunctionToStringEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore18JSDOMCoreException9classInfoEv
-__ZNK7WebCore13ExceptionBase8toStringEv
-__ZN7WebCore33jsDOMWindowPrototypeFunctionAlertEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9DOMWindow5alertERKNS_6StringE
-__ZN7WebCore6Chrome18runJavaScriptAlertEPNS_5FrameERKNS_6StringE
-__ZNK7WebCore17BeforeUnloadEvent20storesResultAsStringEv
-__ZN7WebCore17BeforeUnloadEvent11storeResultERKNS_6StringE
-__ZN7WebCore6Chrome27runBeforeUnloadConfirmPanelERKNS_6StringEPNS_5FrameE
-__ZN7WebCore6Editor21isSelectionMisspelledEv
-__ZN7WebCore6Editor29guessesForMisspelledSelectionEv
-__ZN7WebCore30contextMenuItemTagSpellingMenuEv
-__ZN7WebCore35contextMenuItemTagShowSpellingPanelEb
-__ZN7WebCore31contextMenuItemTagCheckSpellingEv
-__ZN7WebCore42contextMenuItemTagCheckSpellingWhileTypingEv
-__ZN7WebCore42contextMenuItemTagCheckGrammarWithSpellingEv
-__ZN7WebCore6Editor22spellingPanelIsShowingEv
-__ZN7WebCore15ContextMenuItem8setTitleERKNS_6StringE
-__ZN7WebCore15ContextMenuItem10setSubMenuEPNS_11ContextMenuE
-__ZN7WebCore26contextMenuItemTagFontMenuEv
-__ZN7WebCore27contextMenuItemTagShowFontsEv
-__ZN7WebCore22contextMenuItemTagBoldEv
-__ZN7WebCore24contextMenuItemTagItalicEv
-__ZN7WebCore27contextMenuItemTagUnderlineEv
-__ZN7WebCore25contextMenuItemTagOutlineEv
-__ZN7WebCore24contextMenuItemTagStylesEv
-__ZN7WebCore28contextMenuItemTagShowColorsEv
-__ZN7WebCore8Document25createCSSStyleDeclarationEv
-__ZNK7WebCore6Editor17selectionHasStyleEPNS_19CSSStyleDeclarationE
-__ZN7WebCore11updateStateEPNS_26CSSMutableStyleDeclarationEPNS_27CSSComputedStyleDeclarationERbRNS_8TriStateE
-__ZN7WebCore28contextMenuItemTagSpeechMenuEv
-__ZN7WebCore31contextMenuItemTagStartSpeakingEv
-__ZN7WebCore30contextMenuItemTagStopSpeakingEv
-__ZN7WebCore38contextMenuItemTagWritingDirectionMenuEv
-__ZN7WebCore34contextMenuItemTagDefaultDirectionEv
-__ZN7WebCore29contextMenuItemTagLeftToRightEv
-__ZN7WebCore29contextMenuItemTagRightToLeftEv
-__ZN7WebCore6Editor21toggleGrammarCheckingEv
-__ZN7WebCore13endOfSentenceERKNS_15VisiblePositionE
-__ZN7WebCore19endSentenceBoundaryEPKtj
-__ZN7WebCore21sentenceBreakIteratorEPKti
-__ZN7WebCore15startOfSentenceERKNS_15VisiblePositionE
-__ZN7WebCore21startSentenceBoundaryEPKtj
-__ZN7WebCore6Editor14markBadGrammarERKNS_9SelectionE
-__ZN7WebCore26findFirstBadGrammarInRangeEPNS_12EditorClientEPNS_5RangeERNS_13GrammarDetailERib
-__ZN3WTF6VectorIN7WebCore13GrammarDetailELm0EE6shrinkEm
-__ZN7WebCore16executeSelectAllEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore19SelectionController9selectAllEv
-__ZNK7WebCore4Node12canSelectAllEv
-__ZN7WebCore6Editor24isSelectionUngrammaticalEv
-__ZN7WebCore20isRangeUngrammaticalEPNS_12EditorClientEPNS_5RangeERN3WTF6VectorINS_6StringELm0EEE
-__ZN7WebCore6Editor24advanceToNextMisspellingEb
-__ZNK7WebCore17RenderTextControl9scrollTopEv
-__ZN7WebCore17RenderTextControl12setScrollTopEi
--[WebCoreFrameBridge replaceSelectionWithText:selectReplacement:smartReplace:]
--[WebCoreFrameBridge documentFragmentWithText:inContext:]
-__ZN7WebCore22createFragmentFromTextEPNS_5RangeERKNS_6StringE
-__ZNK7WebCore16DeprecatedString8endsWithERKS0_
-+[DOMDocumentFragment(WebCoreInternal) _wrapDocumentFragment:]
--[WebCoreFrameBridge replaceSelectionWithFragment:selectReplacement:smartReplace:matchStyle:]
--[DOMDocumentFragment(WebCoreInternal) _documentFragment]
-__ZNK7WebCore23ReplaceSelectionCommand13editingActionEv
-__ZN7WebCore19ReplacementFragment30insertFragmentForTestRenderingEPNS_4NodeE
-__ZN7WebCore19ReplacementFragment35restoreTestRenderingNodesToFragmentEPNS_4NodeE
-__ZN7WebCore19ReplacementFragment21removeUnrenderedNodesEPNS_4NodeE
-__ZN7WebCore14isNodeRenderedEPKNS_4NodeE
-__ZN7WebCore20CompositeEditCommand13splitTextNodeEPNS_4TextEi
-__ZN7WebCore20SplitTextNodeCommandC2EPNS_4TextEi
-__ZN7WebCore20SplitTextNodeCommand7doApplyEv
-__ZN7WebCore8Document11copyMarkersEPNS_4NodeEjiS2_iNS_14DocumentMarker10MarkerTypeE
-__ZN7WebCore20CompositeEditCommand10applyStyleEPNS_19CSSStyleDeclarationERKNS_8PositionES5_NS_10EditActionE
-__ZN7WebCore17ApplyStyleCommandC2EPNS_8DocumentEPNS_19CSSStyleDeclarationERKNS_8PositionES7_NS_10EditActionENS0_14EPropertyLevelE
--[WebScriptObject valueForKey:]
--[WebScriptObject _originRootObject]
--[DOMDocument body]
-__ZN7WebCore11FrameLoader23reloadAllowingStaleDataERKNS_6StringE
-__ZN7WebCore15DatabaseTracker7originsERN3WTF6VectorINS1_6RefPtrINS_14SecurityOriginEEELm0EEE
-__ZN7WebCore15DatabaseTracker15populateOriginsEv
-__ZN7WebCore18OriginQuotaManagerC1Ev
-__ZN7WebCore15DatabaseTracker19openTrackerDatabaseEb
-__ZNK7WebCore15DatabaseTracker19trackerDatabasePathEv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SecurityOriginEEELm0EE6resizeEm
-___tcf_1
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_iENS_18PairFirstExtractorIS6_EENS2_18SecurityOriginHashENS_14PairHashTraitsINS2_20SecurityOriginTraitsENS_10HashTraitsIiEEEESB_E47removeAndInvalidateWithoutEntryConsistencyCheckEPS6_
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_xENS_18PairFirstExtractorIS6_EENS2_18SecurityOriginHashENS_14PairHashTraitsINS2_20SecurityOriginTraitsENS_10HashTraitsIxEEEESB_EC1ERKSF_
-__ZNK7WebCore32HTMLFileUploadInnerButtonElement12isShadowNodeEv
-__ZN7WebCore32HTMLFileUploadInnerButtonElement16shadowParentNodeEv
-__ZN7WebCore23RenderFileUploadControl5clickEv
-__ZN7WebCore11FileChooser15openFileChooserEPNS_8DocumentE
--[WebCoreOpenPanelController beginSheetWithFrame:]
--[WebCoreOpenPanelController chooseFilename:]
-__ZN7WebCore11FileChooser10chooseFileERKNS_6StringE
-__ZN7WebCore4IconC1EP7NSImage
-__ZThn132_N7WebCore23RenderFileUploadControl12valueChangedEv
-__ZN7WebCore23RenderFileUploadControl12valueChangedEv
-__ZN7WebCore4Icon5paintEPNS_15GraphicsContextERKNS_7IntRectE
-__ZN7WebCore12FormDataList10appendFileERKNS_6StringES3_
-__ZN7WebCore10StringImpl11reverseFindEti
-__ZN7WebCore16MIMETypeRegistry18getMIMETypeForPathERKNS_6StringE
-__ZN7WebCore16MIMETypeRegistry23getMIMETypeForExtensionERKNS_6StringE
-__ZN7WebCore8FormData10appendFileERKNS_6StringE
-__ZN7WebCore10formCreateEP14__CFReadStreamPv
-__ZN7WebCore18getStreamFormDatasEv
-__ZN7WebCore18httpBodyFromStreamEP13NSInputStream
-__ZN3WTF7HashMapIP14__CFReadStreamNS_6RefPtrIN7WebCore8FormDataEEENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS9_IS6_EEE3setERKS2_RKS6_
-__ZN7WebCore12formFinalizeEP14__CFReadStreamPv
-__ZN7WebCore18closeCurrentStreamEPNS_16FormStreamFieldsE
-__ZN7WebCore12formScheduleEP14__CFReadStreamP11__CFRunLoopPK10__CFStringPv
-__ZN7WebCore8pairHashEPKv
-__ZN7WebCore10pairRetainEPK13__CFAllocatorPKv
-__ZN7WebCore9pairEqualEPKvS1_
-__ZN7WebCore8formOpenEP14__CFReadStreamP13CFStreamErrorPhPv
-__ZN7WebCore14openNextStreamEPNS_16FormStreamFieldsE
-__ZN7WebCore20advanceCurrentStreamEPNS_16FormStreamFieldsE
-__ZN7WebCore16scheduleWithPairEPKvPv
-__ZN7WebCore17formEventCallbackEP14__CFReadStreammPv
-__ZN7WebCore8formReadEP14__CFReadStreamPhlP13CFStreamErrorS2_Pv
-__ZN7WebCore11formCanReadEP14__CFReadStreamPv
-__ZN7WebCore9formCloseEP14__CFReadStreamPv
-__ZN7WebCore4IconD1Ev
-__ZN7WebCore11pairReleaseEPK13__CFAllocatorPKv
-__ZN7WebCore11executeCopyEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore6Editor4copyEv
-__ZN7WebCore6Editor12tryDHTMLCopyEv
-__ZN7WebCore10Pasteboard5clearEv
-__ZN7WebCore6Editor20canSmartCopyOrDeleteEv
-__ZN7WebCore6Editor13selectedRangeEv
-__ZN7WebCore10Pasteboard14writeSelectionEPNS_5RangeEbPNS_5FrameE
-__ZN7WebCore10Pasteboard14writeSelectionEP12NSPasteboardPNS_5RangeEbPNS_5FrameE
--[DOMRange commonAncestorContainer]
--[DOMRange startContainer]
--[DOMNode nodeType]
--[DOMNode firstChild]
--[DOMNode nextSibling]
--[DOMRange endContainer]
--[DOMElement tagName]
--[DOMObject copyWithZone:]
--[DOMCSSStyleDeclaration getPropertyCSSValue:]
-+[DOMCSSValue(WebCoreInternal) _wrapCSSValue:]
--[DOMCSSValue(WebCoreInternal) _initWithCSSValue:]
--[DOMCSSValue cssValueType]
--[DOMCSSPrimitiveValue primitiveType]
--[DOMCSSPrimitiveValue getStringValue]
-__ZNK7WebCore17CSSPrimitiveValue14getStringValueERi
--[DOMHTMLTableElement cellSpacing]
-__ZNK7WebCore16HTMLTableElement11cellSpacingEv
--[DOMHTMLTableElement cellPadding]
-__ZNK7WebCore16HTMLTableElement11cellPaddingEv
--[DOMCSSPrimitiveValue getFloatValue:]
-__ZN7WebCore17CSSPrimitiveValue14getDoubleValueEtRi
--[DOMElement style]
--[DOMCSSPrimitiveValue getRGBColorValue]
-__ZNK7WebCore17CSSPrimitiveValue16getRGBColorValueERi
-+[DOMRGBColor initialize]
-+[DOMRGBColor(WebCoreInternal) _wrapRGBColor:]
-__ZN7WebCore16getWrapperForRGBEj
--[DOMRGBColor(WebCoreInternal) _initWithRGB:]
-__ZN7WebCore16setWrapperForRGBEP11objc_objectj
--[DOMRGBColor(WebPrivate) _color]
--[DOMRGBColor color]
--[DOMHTMLTableCellElement rowSpan]
--[DOMHTMLTableCellElement colSpan]
--[DOMHTMLTableCellElement width]
-__ZNK7WebCore20HTMLTableCellElement5widthEv
--[DOMHTMLTableCellElement height]
-__ZNK7WebCore20HTMLTableCellElement6heightEv
--[DOMRange startOffset]
--[DOMCharacterData data]
--[DOMElement(WebPrivate) _font]
--[DOMRange endOffset]
--[WebCoreFrameBridge markupStringFromRange:nodes:]
-__ZN7WebCore27needInterchangeNewlineAfterERKNS_15VisiblePositionE
-__ZN7WebCore34convertHTMLTextToInterchangeFormatERKNS_16DeprecatedStringEPKNS_4TextE
-__ZN7WebCore16DeprecatedString6appendENS_14DeprecatedCharE
-__ZN7WebCore16DeprecatedString6insertEjNS_14DeprecatedCharE
-__ZNK7WebCore5Range4textEv
-__ZN7WebCore6Editor29didWriteSelectionToPasteboardEv
--[DOMCSSValue dealloc]
--[DOMRGBColor dealloc]
-__ZN7WebCore19removeWrapperForRGBEj
-__ZN7WebCore8Document6embedsEv
-__ZNK7WebCore17HTMLScriptElement4typeEv
-__ZNK7WebCore16HTMLQuoteElement17endTagRequirementEv
-__ZNK7WebCore16HTMLQuoteElement11tagPriorityEv
-__ZN7WebCore4KURL7setPortEt
--[DOMHTMLElement idName]
--[DOMHTMLElement className]
--[DOMNode previousSibling]
-__ZN7WebCore17HTMLAnchorElement12setAccessKeyERKNS_6StringE
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm8EE15reserveCapacityEm
-__ZN7WebCore9CSSParser16parseFontFaceSrcEv
-__ZN7WebCore9CSSParser18createFontFaceRuleEv
-__ZN7WebCore15CSSFontFaceRuleC1EPNS_9StyleBaseE
-__ZN7WebCore15CSSFontFaceRule14setDeclarationEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE
-__ZN7WebCore15CSSFontFaceRule14isFontFaceRuleEv
-__ZN7WebCore15CSSFontSelector15addFontFaceRuleEPKNS_15CSSFontFaceRuleE
-__ZNK7WebCore19CSSFontFaceSrcValue16isSVGFontFaceSrcEv
-__ZNK7WebCore19CSSFontFaceSrcValue17isSupportedFormatEv
-__ZNK7WebCore11CSSFontFace7isValidEv
-__ZN7WebCore11CSSFontFaceD1Ev
-__ZN3WTF15deleteAllValuesIPN7WebCore17CSSFontFaceSourceELm0EEEvRKNS_6VectorIT_XT0_EEE
-__ZN7WebCore15CSSFontFaceRuleD1Ev
-__ZN7WebCore19CSSFontFaceSrcValueD1Ev
-__ZN7WebCore32jsNodePrototypeFunctionNormalizeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4Node9normalizeEv
-__ZN7WebCore21JSNodeListConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore21JSNodeListConstructor9classInfoEv
-__ZN7WebCore47jsHTMLInputElementBaseFunctionSetSelectionRangeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore15HTMLLinkElement8setMediaERKNS_6StringE
-__ZNK7WebCore24JSHTMLElementConstructor21implementsHasInstanceEv
-__ZN3KJS17staticValueGetterIN7WebCore19JSHTMLCanvasElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSHTMLCanvasElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionDrawImageEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore26JSCanvasRenderingContext2D9drawImageEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_16HTMLImageElementEffffRi
-__ZN7WebCore4sizeEPNS_16HTMLImageElementE
-__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_16HTMLImageElementERKNS_9FloatRectES5_Ri
-__ZN7WebCore47jsCanvasRenderingContext2DPrototypeFunctionRectEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D4rectEffffRi
-__ZN7WebCore30newStreamingTextDecoderUTF16BEERKNS_12TextEncodingEPKv
-__ZN7WebCore38jsRangePrototypeFunctionSetStartBeforeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore37jsRangePrototypeFunctionSetStartAfterEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore5Range13setStartAfterEPNS_4NodeERi
-__ZNK3KJS6Plugin9classInfoEv
-__ZN7WebCore16HTMLInputElement6setSrcERKNS_6StringE
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_15DynamicNodeList6CachesEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E4findIS3_NS_22IdentityHashTranslatorIS3_S7_SA_EEEENS_17HashTableIteratorIS3_S7_S9_SA_SF_SD_EERKT_
-__ZN7WebCore23JSHTMLBlockquoteElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore32jsRangePrototypeFunctionSetStartEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore34jsRangePrototypeFunctionInsertNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore5Range10insertNodeEN3WTF10PassRefPtrINS_4NodeEEERi
-__ZN7WebCore4Text9splitTextEjRi
-__ZN7WebCore4Text9createNewEN3WTF10PassRefPtrINS_10StringImplEEE
-__ZN7WebCore11RenderStyle13setCursorListEN3WTF10PassRefPtrINS_10CursorListEEE
-__ZN7WebCore7toRomanEib
-__ZN7WebCore16HTMLInputElement7setSizeEj
-__ZN7WebCore6String6numberEj
-__ZN7WebCore23HTMLTableRowsCollection7lastRowEPNS_16HTMLTableElementE
-__ZN7WebCore42jsDocumentPrototypeFunctionCreateAttributeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document17createAttributeNSERKNS_6StringES3_Ri
-__ZN7WebCore6JSAttr3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore4Attr12setNodeValueERKNS_6StringERi
-__ZN7WebCore4Attr8setValueERKNS_6StringERi
-__ZN7WebCore4Attr16childTypeAllowedENS_4Node8NodeTypeE
-__ZN7WebCore4Attr15childrenChangedEb
-__ZN7WebCore42jsElementPrototypeFunctionSetAttributeNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9JSElement16setAttributeNodeEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore6toAttrEPN3KJS7JSValueERb
-__ZNK7WebCore6JSAttr9classInfoEv
-__ZN7WebCore7Element16setAttributeNodeEPNS_4AttrERi
-__ZN7WebCore12NamedAttrMap12setNamedItemEPNS_4NodeERi
-__ZNK7WebCore4Attr15isAttributeNodeEv
-__ZN7WebCore16JSHTMLPreElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZNK7WebCore12HTMLDocument10designModeEv
-__ZN7WebCore42jsHTMLCollectionPrototypeFunctionNamedItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16JSHTMLCollection9namedItemEPN3KJS9ExecStateERKNS1_4ListE
-__ZNK7WebCore8Document14defaultCharsetEv
-__ZN7WebCore21webFallbackFontFamilyEv
-__ZN7WebCore4Node11appendChildEN3WTF10PassRefPtrIS0_EERi
-__ZNK7WebCore16HTMLTableElement5tFootEv
-__ZNK7WebCore19HTMLTableRowElement8rowIndexEv
-__ZN7WebCore16DocumentFragment9cloneNodeEb
-__ZN7WebCore7Element9cloneNodeEb
-__ZN7WebCore7Element26copyNonAttributePropertiesEPKS0_
-__ZNK7WebCore9Attribute5cloneEb
-__ZN7WebCore35jsNamedNodeMapPrototypeFunctionItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore4Attr6prefixEv
-__ZNK7WebCore4Attr9localNameEv
-__ZN7WebCore46jsNamedNodeMapPrototypeFunctionRemoveNamedItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore43jsNamedNodeMapPrototypeFunctionSetNamedItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore21HTMLOptionsCollection13selectedIndexEv
-__ZN7WebCore20HTMLTableCellElement8setWidthERKNS_6StringE
-__ZN7WebCore11HTMLElement7setLangERKNS_6StringE
-__ZN7WebCore13CSSStyleSheet18determineNamespaceERKNS_12AtomicStringE
-__ZN7WebCore12IconDatabase27checkIntegrityBeforeOpeningEv
-__ZN7WebCore12IconDatabase14checkIntegrityEv
-_sqlite3VdbeAddOpList
-_sqlite3OpenTempDatabase
-_sqlite3BtreeIntegrityCheck
-_checkList
-_checkTreePage
-__ZN7WebCore32max_device_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore28device_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZNK7WebCore12CDATASection8nodeNameEv
-__ZNK7WebCore11RenderTheme11systemColorEi
-__ZN7WebCore16JSHTMLDivElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore14HTMLDivElement8setAlignERKNS_6StringE
-__ZN7WebCore17HTMLAppletElement19removedFromDocumentEv
-__ZN7WebCore17HTMLObjectElement21renderFallbackContentEv
-__ZN7WebCore19JSHTMLCanvasElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore17HTMLCanvasElement8setWidthEi
-__ZN7WebCore17HTMLCanvasElement9setHeightEi
-__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_17HTMLCanvasElementERKNS_9FloatRectES5_Ri
-__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_17HTMLCanvasElementEffffRi
-__ZThn8_N7WebCore14XMLHttpRequest15willSendRequestEPNS_17SubresourceLoaderERNS_15ResourceRequestERKNS_16ResourceResponseE
-__ZN7WebCore14XMLHttpRequest15willSendRequestEPNS_17SubresourceLoaderERNS_15ResourceRequestERKNS_16ResourceResponseE
-__ZNK7WebCore16StyleMarqueeDataeqERKS0_
-__ZN7WebCore22HTMLGenericFormElement11setReadOnlyEb
-__ZN7WebCore12toAlphabeticEiPKti
-__ZNK7WebCore20HTMLFrameElementBase11frameBorderEv
-__ZN7WebCore20HTMLTableCellElement10setRowSpanEi
-__ZN7WebCore18JSHTMLOListElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore16HTMLOListElement8setStartEi
-__ZN7WebCore9FrameView23removeSlowRepaintObjectEv
-__ZNK7WebCore16HTMLStyleElement8disabledEv
-__ZN3WTF6VectorIxLm0EE14expandCapacityEmPKx
-__ZN3WTF6VectorIxLm0EE14expandCapacityEm
-__ZN3WTF6VectorIxLm0EE15reserveCapacityEm
-__ZN3WTF6VectorIxLm0EE6shrinkEm
-__ZN7WebCore41jsHTMLSelectElementPrototypeFunctionFocusEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore12DOMSelection8baseNodeEv
-__ZN7WebCore39jsDOMSelectionPrototypeFunctionToStringEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12DOMSelection8toStringEv
-__ZN7WebCore13HTMLTokenizer11parseServerERNS_15SegmentedStringENS0_5StateE
-__ZN7WebCore21internalSubsetHandlerEPvPKhS2_S2_
-__ZN7WebCore12XMLTokenizer14internalSubsetEPKhS2_S2_
-__ZN7WebCore21externalSubsetHandlerEPvPKhS2_S2_
-__ZN7WebCore23JSProcessingInstructionC1EPN3KJS8JSObjectEPNS_21ProcessingInstructionE
-__ZN7WebCore23JSProcessingInstruction18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore21ProcessingInstruction8nodeNameEv
-__ZNK7WebCore16HTMLInputElement9accessKeyEv
-__ZN7WebCore40jsDocumentPrototypeFunctionCreateCommentEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document13createCommentERKNS_6StringE
-__ZN7WebCore10HTMLParser15popInlineBlocksEv
-__ZN3WTF6VectorIPN7WebCore17SubresourceLoaderELm256EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore17SubresourceLoaderELm256EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore17SubresourceLoaderELm256EE15reserveCapacityEm
-__ZN7WebCore51jsHTMLTableSectionElementPrototypeFunctionInsertRowEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore23HTMLTableSectionElement9insertRowEiRi
-__ZN7WebCore7Comment9cloneNodeEb
-__ZN7WebCore17HTMLIFrameElement8setAlignERKNS_6StringE
-__ZN7WebCore17HTMLSelectElement14removeChildrenEv
-__ZNK3KJS27XSLTProcessorConstructorImp19implementsConstructEv
-__ZN3KJS27XSLTProcessorConstructorImp9constructEPNS_9ExecStateERKNS_4ListE
-__ZN3KJS15JSXSLTProcessorC1EPNS_8JSObjectE
-__ZN3KJS22XSLTProcessorPrototype18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
-__ZN3KJS48jsXSLTProcessorPrototypeFunctionImportStylesheetEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK3KJS15JSXSLTProcessor9classInfoEv
-__ZN3KJS44jsXSLTProcessorPrototypeFunctionSetParameterEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore13XSLTProcessor12setParameterERKNS_6StringES3_S3_
-__ZN3KJS51jsXSLTProcessorPrototypeFunctionTransformToFragmentEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore13XSLTProcessor19transformToFragmentEPNS_4NodeEPNS_8DocumentE
-__ZN7WebCore13XSLTProcessor17transformToStringEPNS_4NodeERNS_6StringES4_S4_
-__Z21initxsltSetLoaderFuncPFP7_xmlDocPKhP8_xmlDictiPv12xsltLoadTypeE
-__ZN7WebCore13XSLStyleSheetC1EPNS_4NodeERKNS_6StringEb
-__ZZN7WebCore22shouldAddNamespaceAttrEPKNS_9AttributeERN3WTF7HashMapIPNS_16AtomicStringImplES6_NS3_7PtrHashIS6_EENS3_10HashTraitsIS6_EESA_EEE8xmlnsURI
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplES3_NS_7PtrHashIS3_EENS_10HashTraitsIS3_EES7_E3getERKS3_
-__ZZN7WebCore15appendNamespaceERN3WTF6VectorItLm0EEERKNS_12AtomicStringES6_RNS0_7HashMapIPNS_16AtomicStringImplES9_NS0_7PtrHashIS9_EENS0_10HashTraitsIS9_EESD_EEE5xmlns
-__ZN7WebCore13XSLStyleSheet11parseStringERKNS_6StringEb
-__ZN7WebCore13XSLStyleSheet9docLoaderEv
-__ZN7WebCore27setLoaderForLibXMLCallbacksEPNS_9DocLoaderE
-__ZN7WebCore13XSLStyleSheet15loadChildSheetsEv
-__ZN7WebCore13XSLStyleSheet8documentEv
-__ZN7WebCore13XSLStyleSheet17compileStyleSheetEv
-__Z26initxsltParseStylesheetDocP7_xmlDoc
-__Z14libxsltLibraryv
-__ZN7WebCore13XSLStyleSheet14clearDocumentsEv
-__ZN7WebCore18xmlDocPtrForStringEPNS_9DocLoaderERKNS_6StringERKNS_16DeprecatedStringE
-__Z27initxsltNewTransformContextP15_xsltStylesheetP7_xmlDoc
-__ZN7WebCore22registerXSLTExtensionsEP21_xsltTransformContext
-__Z27initxsltRegisterExtFunctionP21_xsltTransformContextPKhS2_PFvP22_xmlXPathParserContextiE
-__Z23initxsltSetCtxtSortFuncP21_xsltTransformContextPFvS0_PP8_xmlNodeiE
-__Z23initxsltQuoteUserParamsP21_xsltTransformContextPPKc
-__Z27initxsltApplyStylesheetUserP15_xsltStylesheetP7_xmlDocPPKcS4_P7__sFILEP21_xsltTransformContext
-__Z28initxsltFreeTransformContextP21_xsltTransformContext
-__Z20initxsltSaveResultToP16_xmlOutputBufferP7_xmlDocP15_xsltStylesheet
-__ZN7WebCore13writeToVectorEPvPKci
-__ZN7WebCore6String8fromUTF8EPKcm
-__Z22initxsltFreeStylesheetP15_xsltStylesheet
-__ZN3KJS37jsXSLTProcessorPrototypeFunctionResetEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore8Document18setVisuallyOrderedEv
-__ZN7WebCore20HTMLTableCellElement9setHeightERKNS_6StringE
-__ZNK7WebCore16HTMLInputElement14defaultCheckedEv
-__ZN7WebCore16HTMLInputElement17setDefaultCheckedEb
-__ZN7WebCore29JSHTMLUListElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLUListElementConstructor9classInfoEv
-__ZN7WebCore16HTMLStyleElement11setDisabledEb
-__ZN7WebCore20parseMediaDescriptorERKNS_6StringE
-__ZN7WebCore17decodeNamedEntityEPKc
-__ZN7WebCore19HTMLOptGroupElement11appendChildEN3WTF10PassRefPtrINS_4NodeEEERi
-__ZN3KJS17staticValueGetterIN7WebCore18JSDOMCoreExceptionEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSDOMCoreException16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore23resetButtonDefaultLabelEv
-__ZNK7WebCore11ShadowValue7cssTextEv
-__ZNK7WebCore17HTMLObjectElement6vspaceEv
-__ZNK7WebCore17HTMLObjectElement6hspaceEv
-__ZN7WebCore26NetscapePlugInStreamLoader7didFailERKNS_13ResourceErrorE
-__ZN7WebCore42jsHTMLSelectElementPrototypeFunctionRemoveEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore19JSHTMLSelectElement6removeEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore13toHTMLElementEPN3KJS7JSValueE
-__ZNK7WebCore16HTMLImageElement1xEv
-__ZNK7WebCore16HTMLImageElement1yEv
-__ZN7WebCore12XMLTokenizer11stopParsingEv
-__ZNK7WebCore9Tokenizer14processingDataEv
-__ZN7WebCore17JSHTMLMenuElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZNK7WebCore17JSHTMLMenuElement9classInfoEv
-__ZNK7WebCore9FrameTree3topEv
-__ZN7WebCore14JSHTMLDocument6setAllEPN3KJS9ExecStateEPNS1_7JSValueE
-__ZN7WebCore10RenderFlow19paintOutlineForLineEPNS_15GraphicsContextEiiRKNS_7IntRectES5_S5_
-__ZNK7WebCore19JSHTMLAppletElement9classInfoEv
-__ZN7WebCore9Tokenizer11stopParsingEv
-__ZN7WebCore15HTMLLinkElement10setCharsetERKNS_6StringE
-__ZN7WebCore12XMLTokenizer12pauseParsingEv
-__ZThn8_N7WebCore12XMLTokenizer14notifyFinishedEPNS_14CachedResourceE
-__ZN7WebCore12XMLTokenizer14notifyFinishedEPNS_14CachedResourceE
-__ZN7WebCore12XMLTokenizer13resumeParsingEv
-__ZN7WebCore16PendingCallbacks25PendingCharactersCallback4callEPNS_12XMLTokenizerE
-__ZN7WebCore17DeprecatedPtrListINS_16PendingCallbacks15PendingCallbackEE10deleteFuncEPv
-__ZN7WebCore16PendingCallbacks27PendingEndElementNSCallback4callEPNS_12XMLTokenizerE
-__ZN7WebCore16PendingCallbacks29PendingStartElementNSCallback4callEPNS_12XMLTokenizerE
-__ZN7WebCore8Document13createElementERKNS_6StringERi
-__ZN7WebCore16PendingCallbacks25PendingCDATABlockCallback4callEPNS_12XMLTokenizerE
-__ZN7WebCore24CanvasRenderingContext2D5resetEv
-__ZN3WTF6VectorIN7WebCore24CanvasRenderingContext2D5StateELm1EE6resizeEm
-__ZN7WebCore12HTMLDocument3dirEv
-__ZN7WebCore43jsMouseEventPrototypeFunctionInitMouseEventEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore11toDOMWindowEPN3KJS7JSValueE
-__ZN7WebCore17toEventTargetNodeEPN3KJS7JSValueE
-__ZN7WebCore10MouseEvent14initMouseEventERKNS_12AtomicStringEbbPNS_9DOMWindowEiiiiibbbbtPNS_15EventTargetNodeE
-__ZN7WebCore7UIEvent11initUIEventERKNS_12AtomicStringEbbPNS_9DOMWindowEi
-__ZN7WebCore17MouseRelatedEvent15initCoordinatesEii
-__ZN7WebCore43jsCharacterDataPrototypeFunctionReplaceDataEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore13CharacterData11replaceDataEjjRKNS_6StringERi
-__ZN7WebCore25max_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore39jsHTMLSelectElementPrototypeFunctionAddEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore15HTMLBodyElement13setBackgroundERKNS_6StringE
-__ZN7WebCore16PendingCallbacks22PendingCommentCallback4callEPNS_12XMLTokenizerE
-__ZN7WebCore24parseXMLDocumentFragmentERKNS_6StringEPNS_16DocumentFragmentEPNS_7ElementE
-__ZN7WebCore12XMLTokenizerC1EPNS_16DocumentFragmentEPNS_7ElementE
-__ZN3WTF6VectorIPN7WebCore7ElementELm0EE14expandCapacityEmPKS3_
-__ZN7WebCore29balancedStartElementNsHandlerEPvPKhS2_S2_iPS2_iiS3_
-__ZN7WebCore25balancedCharactersHandlerEPvPKhi
-__ZN7WebCore27balancedEndElementNsHandlerEPvPKhS2_S2_
-__ZN7WebCore17HTMLAnchorElement6setRelERKNS_6StringE
-__ZN7WebCore7CSSRule6isRuleEv
-__ZN7WebCore9StyleBase13isCharsetRuleEv
-__ZNK7WebCore26JSXMLSerializerConstructor19implementsConstructEv
-__ZN7WebCore26JSXMLSerializerConstructor9constructEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_13XMLSerializerE
-__ZN7WebCore15JSXMLSerializerC1EPN3KJS8JSObjectEPNS_13XMLSerializerE
-__ZN7WebCore15JSXMLSerializer18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24JSXMLSerializerPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore49jsXMLSerializerPrototypeFunctionSerializeToStringEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore15JSXMLSerializer9classInfoEv
-__ZN7WebCore13XMLSerializer17serializeToStringEPNS_4NodeERi
-__ZN7WebCore27JSHTMLFrameElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore28JSHTMLObjectElementPrototype9classInfoEv
-__ZNK7WebCore17HTMLObjectElement4dataEv
-__ZNK7WebCore17HTMLObjectElement8codeBaseEv
-__ZNK7WebCore17HTMLObjectElement4codeEv
-__ZNK7WebCore17HTMLObjectElement7archiveEv
-__ZNK7WebCore17HTMLObjectElement8codeTypeEv
-__ZNK7WebCore17HTMLObjectElement7declareEv
-__ZNK7WebCore17HTMLObjectElement7standbyEv
-__ZNK7WebCore17HTMLObjectElement6borderEv
-__ZNK7WebCore17HTMLPlugInElement5alignEv
-__ZNK7WebCore17HTMLObjectElement6useMapEv
-__ZN7WebCore20HTMLTableCellElement9setNoWrapEb
-__ZN3KJS17staticValueGetterIN7WebCore23JSHTMLBlockquoteElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore23JSHTMLBlockquoteElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore16JSStyleSheetList18canGetItemsForNameEPN3KJS9ExecStateEPNS_14StyleSheetListERKNS1_10IdentifierE
-__ZNK7WebCore14StyleSheetList12getNamedItemERKNS_6StringE
-__ZN7WebCore16JSStyleSheetList10nameGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore37jsHTMLCollectionPrototypeFunctionTagsEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore14HTMLCollection4tagsERKNS_6StringE
-__ZN7WebCore42jsDOMSelectionPrototypeFunctionSetPositionEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12DOMSelection11setPositionEPNS_4NodeEiRi
-__ZN7WebCore13executeDeleteEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore37jsDOMSelectionPrototypeFunctionModifyEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12DOMSelection6modifyERKNS_6StringES3_S3_
-__ZN7WebCore19SelectionController27modifyExtendingRightForwardENS_15TextGranularityE
-__ZN7WebCore16nextLinePositionERKNS_15VisiblePositionEi
-__ZNK7WebCore4Node12nextEditableEi
-__ZN7WebCore14isEditableLeafEPNS_9InlineBoxE
-__ZN7WebCore15isTableRowEmptyEPNS_4NodeE
-__ZN7WebCore20CompositeEditCommand22insertBlockPlaceholderERKNS_8PositionE
-__ZN7WebCore23ReplaceSelectionCommand27removeNodeAndPruneAncestorsEPNS_4NodeE
-__ZN7WebCore17executeInsertTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore20setJSNodeOndragstartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node14setOndragstartEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCoreL17executeInsertTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore13TypingCommand10insertTextEPNS_8DocumentERKNS_6StringEbb
+__ZN7WebCore20CompositeEditCommand19removePlaceholderAtERKNS_8PositionE
+__ZN7WebCore20CompositeEditCommand23breakOutOfEmptyListItemEv
+__ZN7WebCore22enclosingEmptyListItemERKNS_15VisiblePositionE
+__ZN7WebCore18enclosingListChildEPNS_4NodeE
+__ZN7WebCore13isListElementEPNS_4NodeE
+__ZN7WebCore13TypingCommand21makeEditableRootEmptyEv
+__ZNK7WebCore7Element17firstElementChildEv
+__ZN7WebCore37jsDOMSelectionPrototypeFunctionModifyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection6modifyERKNS_6StringES3_S3_
+__ZN7WebCore19SelectionController19modifyMovingForwardENS_15TextGranularityE
+__ZN7WebCore19SelectionController22modifyExtendingForwardENS_15TextGranularityE
 __ZN7WebCore16nextWordPositionERKNS_15VisiblePositionE
-__ZN7WebCore24nextWordPositionBoundaryEPKtj
+__ZN7WebCoreL24nextWordPositionBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
 __ZN7WebCore21findNextWordFromIndexEPKtiib
-__ZN7WebCore11StyleChange29checkForLegacyHTMLStyleChangeEPKNS_11CSSPropertyE
-__ZN7WebCore9CSSParser25parseFontFaceUnicodeRangeEv
-__ZN7WebCore9FontCache10fontExistsERKNS_15FontDescriptionERKNS_12AtomicStringE
-__ZN7WebCore17CSSFontFaceSourceC1ERKNS_6StringEPNS_10CachedFontE
-__ZN7WebCore11CSSFontFace9addSourceEPNS_17CSSFontFaceSourceE
-__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE15reserveCapacityEm
-__ZNK7WebCore17CSSFontFaceSource7isValidEv
-__ZN7WebCore20CSSSegmentedFontFaceC1EPNS_15CSSFontSelectorE
-__ZN7WebCore20CSSSegmentedFontFace12overlayRangeEiiN3WTF10PassRefPtrINS_11CSSFontFaceEEE
-__ZN7WebCore20CSSSegmentedFontFace10pruneTableEv
-__ZN3WTF6VectorIN7WebCore13FontFaceRangeELm8EEC1ILm1EEERKNS0_IS2_XT_EEE
-__ZN3WTF6VectorIN7WebCore13FontFaceRangeELm1EE6shrinkEm
-__ZN3WTF6VectorIN7WebCore13FontFaceRangeELm1EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore13FontFaceRangeELm1EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore13FontFaceRangeELm1EE15reserveCapacityEm
-__ZN3WTF6VectorIN7WebCore13FontFaceRangeELm8EE6shrinkEm
-__ZN7WebCore20CSSSegmentedFontFace11getFontDataERKNS_15FontDescriptionEbb
-__ZNK7WebCore20CSSSegmentedFontFace7isValidEv
-__ZN3WTF7HashMapIjPN7WebCore17SegmentedFontDataENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE3setERKjRKS3_
-__ZN7WebCore11CSSFontFace11getFontDataERKNS_15FontDescriptionEbb
-__ZN7WebCore17CSSFontFaceSource11getFontDataERKNS_15FontDescriptionEbbPNS_15CSSFontSelectorE
-__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE15reserveCapacityEm
-__ZNK7WebCore17SegmentedFontData9isLoadingEv
-__ZNK7WebCore17SegmentedFontData11isSegmentedEv
-__ZNK7WebCore17SegmentedFontData20fontDataForCharacterEi
-__ZNK7WebCore17SegmentedFontData12isCustomFontEv
-__ZN7WebCore40firstEditablePositionAfterPositionInRootERKNS_8PositionEPNS_4NodeE
-__ZN7WebCore39jsDOMSelectionPrototypeFunctionAddRangeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7toRangeEPN3KJS7JSValueE
-__ZN7WebCore12DOMSelection8addRangeEPNS_5RangeE
+__ZN7WebCore11RenderBlock26fillHorizontalSelectionGapEPNS_12RenderObjectEiiiiPKNS1_9PaintInfoE
+__ZN7WebCoreL12nodePositionEPNS_4NodeE
+__ZN7WebCore6String6numberEj
+__ZN7WebCore4Node16shadowParentNodeEv
+__ZN7WebCore47jsDOMSelectionPrototypeFunctionSetBaseAndExtentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection16setBaseAndExtentEPNS_4NodeEiS2_iRi
+__ZN7WebCore19SelectionController6moveToERKNS_15VisiblePositionES3_b
+__ZNK7WebCore6Editor25shouldShowDeleteInterfaceEPNS_11HTMLElementE
 __ZN7WebCore21nextParagraphPositionERKNS_15VisiblePositionEi
+__ZN7WebCore16nextLinePositionERKNS_15VisiblePositionEi
+__ZN7WebCoreL27nextLeafWithSameEditabilityEPNS_4NodeE
+__ZN7WebCore20CompositeEditCommand15insertNodeAfterEN3WTF10PassRefPtrINS_4NodeEEES4_
+__ZN7WebCore11RenderBlock21fillRightSelectionGapEPNS_12RenderObjectEiiiPS0_iiiiPKNS1_9PaintInfoE
+__ZN7WebCore11RenderBlock24fillVerticalSelectionGapEiiiiPS0_iiPKNS_12RenderObject9PaintInfoE
+__ZN7WebCore11RenderBlock20fillLeftSelectionGapEPNS_12RenderObjectEiiiPS0_iiiiPKNS1_9PaintInfoE
+__ZN7WebCore20setJSDOMWindowParentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore25previousParagraphPositionERKNS_15VisiblePositionEi
-__ZN7WebCore20previousLinePositionERKNS_15VisiblePositionEi
 __ZN7WebCore15inSameParagraphERKNS_15VisiblePositionES2_
-__ZN7WebCore11enabledUndoEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCore8RenderBR23selectionRectForRepaintEPNS_20RenderBoxModelObjectEb
+__ZN7WebCore11StyleChange29checkForLegacyHTMLStyleChangeEPKNS_11CSSPropertyE
+__ZN7WebCore22createStyleSpanElementEPNS_8DocumentE
+__ZN7WebCore17createHTMLElementEPNS_8DocumentERKNS_13QualifiedNameE
+__ZN7WebCore17ApplyStyleCommand28surroundNodeRangeWithElementEPNS_4NodeES2_N3WTF10PassRefPtrINS_7ElementEEE
+__ZN7WebCore23ReplaceSelectionCommand27removeNodeAndPruneAncestorsEPNS_4NodeE
+__ZN7WebCore16VisibleSelection27selectionFromContentsOfNodeEPNS_4NodeE
+__ZN7WebCoreL16executeSelectAllEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore19SelectionController9selectAllEv
+__ZNK7WebCore4Node12canSelectAllEv
+__ZNK7WebCore8Position19isRenderedCharacterEv
+__ZN7WebCore22nonBreakingSpaceStringEv
+__ZN7WebCore20CompositeEditCommand17replaceTextInNodeEN3WTF10PassRefPtrINS_4TextEEEjjRKNS_6StringE
+__ZN7WebCore23ReplaceSelectionCommand16handleStyleSpansEv
+__ZN7WebCore20CompositeEditCommand16setNodeAttributeEN3WTF10PassRefPtrINS_7ElementEEERKNS_13QualifiedNameERKNS_12AtomicStringE
+__ZN7WebCore23SetNodeAttributeCommandC1EN3WTF10PassRefPtrINS_7ElementEEERKNS_13QualifiedNameERKNS_12AtomicStringE
+__ZN7WebCore23SetNodeAttributeCommandC2EN3WTF10PassRefPtrINS_7ElementEEERKNS_13QualifiedNameERKNS_12AtomicStringE
+__ZN7WebCore23SetNodeAttributeCommand7doApplyEv
+__ZN7WebCore40firstEditablePositionAfterPositionInRootERKNS_8PositionEPNS_4NodeE
+__ZN7WebCore23SetNodeAttributeCommandD0Ev
+__ZN7WebCore12startOfBlockERKNS_15VisiblePositionE
+__ZN7WebCore30jsRangePrototypeFunctionSetEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore39jsDOMSelectionPrototypeFunctionAddRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7toRangeEN3JSC7JSValueE
+__ZN7WebCore12DOMSelection8addRangeEPNS_5RangeE
+__ZN7WebCoreL32elementHasTextDecorationPropertyEPKNS_4NodeE
+__ZN7WebCoreL34styleFromMatchedRulesAndInlineDeclEPKNS_4NodeE
+__ZN3WTF11ListHashSetIPN7WebCore12RenderInlineENS_7PtrHashIS3_EEE3addERKS3_
+__ZN3WTF11ListHashSetIPN7WebCore12RenderInlineENS_7PtrHashIS3_EEE10appendNodeEPNS_15ListHashSetNodeIS3_EE
+__ZN7WebCore12RenderInline12paintOutlineEPNS_15GraphicsContextEii
+__ZN7WebCore12RenderInline17addFocusRingRectsEPNS_15GraphicsContextEii
+__ZN7WebCoreL15isTableRowEmptyEPNS_4NodeE
+__ZN7WebCore9CSSParser25parseFontFaceUnicodeRangeEv
+__ZN3WTF6VectorIN7WebCore11CSSFontFace12UnicodeRangeELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN7WebCore11CSSFontFace12UnicodeRangeELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore11CSSFontFace12UnicodeRangeELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIjLm0EE14expandCapacityEm
+__ZN3WTF6VectorIjLm0EE15reserveCapacityEm
+__ZN3WTF6VectorIjLm0EE6shrinkEm
+__ZSt25__unguarded_linear_insertIPPN7WebCore11CSSFontFaceES2_PFbS2_S2_EEvT_T0_T1_
+__ZN7WebCore19SelectionController20modifyMovingBackwardENS_15TextGranularityE
+__ZN3WTF6VectorIN7WebCore11CSSFontFace12UnicodeRangeELm0EE6shrinkEm
+__ZN7WebCore20CSSUnicodeRangeValueD0Ev
+__ZN7WebCore27setJSHTMLDocumentDesignModeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore12HTMLDocument13setDesignModeERKNS_6StringE
+__ZN7WebCore8Document13setDesignModeENS0_13InheritedBoolE
+__ZN7WebCore52jsHTMLInputElementPrototypeFunctionSetSelectionRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore18JSHTMLInputElement17setSelectionRangeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore16HTMLInputElement17setSelectionRangeEii
+__ZN7WebCoreL17executeCreateLinkEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore17CreateLinkCommandC1EPNS_8DocumentERKNS_6StringE
+__ZN7WebCore17CreateLinkCommandC2EPNS_8DocumentERKNS_6StringE
+__ZN7WebCore17CreateLinkCommand7doApplyEv
+__ZN7WebCore17HTMLAnchorElementC1EPNS_8DocumentE
+__ZN7WebCore17HTMLAnchorElementC2EPNS_8DocumentE
+__ZNK7WebCore11EditCommand15isTypingCommandEv
+__ZNK7WebCore11EditCommand20preservesTypingStyleEv
+__ZNK7WebCore17CreateLinkCommand13editingActionEv
+__ZNK7WebCore17RenderTextControl10renderNameEv
+__ZN7WebCore17CreateLinkCommandD0Ev
+__ZN7WebCore20CompositeEditCommand22insertBlockPlaceholderERKNS_8PositionE
+__ZN7WebCore29createBlockPlaceholderElementEPNS_8DocumentE
+__ZN7WebCore6Editor16shouldEndEditingEPNS_5RangeE
+__ZN7WebCoreL25executeDeleteWordBackwardEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore20previousWordPositionERKNS_15VisiblePositionE
+__ZN7WebCoreL28previousWordPositionBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
+__ZN7WebCore6Editor13addToKillRingEPNS_5RangeEb
+__ZN7WebCore6Editor24startNewKillRingSequenceEv
+__ZN7WebCoreL26initializeKillRingIfNeededEv
+__ZN7WebCore6Editor16appendToKillRingERKNS_6StringE
+__ZN7WebCore22DeleteButtonController16createDeletionUIEv
+__ZN7WebCore12DeleteButtonC1EPNS_8DocumentE
+__ZN7WebCore12DeleteButtonC2EPNS_8DocumentE
+__ZN7WebCore11CachedImageC1EPNS_5ImageE
+__ZN7WebCore11CachedImageC2EPNS_5ImageE
+__ZN7WebCore11ImageLoader8setImageEPNS_11CachedImageE
+__ZN7WebCore33jsDOMWindowPrototypeFunctionAlertEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow5alertERKNS_6StringE
+__ZN7WebCore6Chrome18runJavaScriptAlertEPNS_5FrameERKNS_6StringE
+__ZN7WebCore21PageGroupLoadDeferrerC1EPNS_4PageEb
+__ZN7WebCore21PageGroupLoadDeferrerC2EPNS_4PageEb
+__ZN7WebCore21PageGroupLoadDeferrerD1Ev
+__ZN7WebCore21PageGroupLoadDeferrerD2Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm16EE6shrinkEm
+__ZN7WebCore12DeleteButton19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore22DeleteButtonController12deleteTargetEv
+__ZN7WebCore12EventHandler24scheduleHoverStateUpdateEv
+__ZNK7WebCore11EditCommand13editingActionEv
+__ZN7WebCore12RenderObject17setSelectionStateENS0_14SelectionStateE
+__ZN7WebCore12RenderObject23selectionRectForRepaintEPNS_20RenderBoxModelObjectEb
++[WebUndefined undefined]
++[WebUndefined allocWithZone:]
+-[WebScriptObject valueForKey:]
+-[WebScriptObject _originRootObject]
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4FileEEELm0EE14shrinkCapacityEm
+__ZN7WebCore23ReplaceSelectionCommand28removeNodePreservingChildrenEPNS_4NodeE
+__ZN7WebCore20CompositeEditCommand28removeNodePreservingChildrenEN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore35RemoveNodePreservingChildrenCommandC1EN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore35RemoveNodePreservingChildrenCommandC2EN3WTF10PassRefPtrINS_4NodeEEE
+__ZN7WebCore35RemoveNodePreservingChildrenCommand7doApplyEv
+__ZN7WebCore35RemoveNodePreservingChildrenCommandD0Ev
+__ZN7WebCore12TextIterator8subrangeEPNS_5RangeEii
+__ZN3WTF6VectorIN7WebCore18TextCheckingResultELm0EE6shrinkEm
+__ZN7WebCoreeqERKNS_5RangeES2_
+__ZN7WebCore13InlineTextBox28paintSpellingOrGrammarMarkerEPNS_15GraphicsContextEiiNS_14DocumentMarkerEPNS_11RenderStyleERKNS_4F
+__ZN7WebCore15GraphicsContext34drawLineForMisspellingOrBadGrammarERKNS_8IntPointEib
+__ZN7WebCoreL18createPatternColorEP8NSStringP7NSColorRb
+__ZN7WebCoreL22executeInsertParagraphEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore13TypingCommand24insertParagraphSeparatorEPNS_8DocumentE
+__ZN7WebCore13TypingCommand24insertParagraphSeparatorEv
+__ZN7WebCore31InsertParagraphSeparatorCommandC1EPNS_8DocumentEb
+__ZN7WebCore31InsertParagraphSeparatorCommandC2EPNS_8DocumentEb
+__ZN7WebCore31InsertParagraphSeparatorCommand7doApplyEv
+__ZN7WebCore31InsertParagraphSeparatorCommand29calculateStyleBeforeInsertionERKNS_8PositionE
+__ZNK7WebCore31InsertParagraphSeparatorCommand32shouldUseDefaultParagraphElementEPNS_4NodeE
+__ZN7WebCore20CompositeEditCommand22appendBlockPlaceholderEN3WTF10PassRefPtrINS_7ElementEEE
+__ZN7WebCore31InsertParagraphSeparatorCommand24applyStyleAfterInsertionEPNS_4NodeE
+__ZN7WebCore31InsertParagraphSeparatorCommandD0Ev
+__ZN7WebCore30setJSHTMLOptionElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCoreL17createFontElementEPNS_8DocumentE
+__ZN7WebCoreL35executeInsertNewlineInQuotedContentEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore13TypingCommand39insertParagraphSeparatorInQuotedContentEPNS_8DocumentE
+__ZN7WebCore13TypingCommand39insertParagraphSeparatorInQuotedContentEv
+__ZN7WebCore22BreakBlockquoteCommandC1EPNS_8DocumentE
+__ZN7WebCore22BreakBlockquoteCommandC2EPNS_8DocumentE
+__ZN7WebCore22BreakBlockquoteCommand7doApplyEv
+__ZN7WebCore28isFirstVisiblePositionInNodeERKNS_15VisiblePositionEPKNS_4NodeE
+__ZN7WebCore27isLastVisiblePositionInNodeERKNS_15VisiblePositionEPKNS_4NodeE
+__ZN7WebCore20CompositeEditCommand19rebalanceWhitespaceEv
+__ZN7WebCore22BreakBlockquoteCommandD0Ev
+__ZN7WebCoreL11enabledUndoEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
 __ZN7WebCore6Editor7canUndoEv
-__ZN7WebCore11executeUndoEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL11executeUndoEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore6Editor4undoEv
 __ZN7WebCore11EditCommand7unapplyEv
 __ZN7WebCore20CompositeEditCommand9doUnapplyEv
-__ZN7WebCore17RemoveNodeCommand9doUnapplyEv
-__ZN7WebCore6Editor16unappliedEditingEN3WTF10PassRefPtrINS_11EditCommandEEE
-__ZN7WebCore23InsertNodeBeforeCommand9doUnapplyEv
-__ZN7WebCore17AppendNodeCommand9doUnapplyEv
 __ZN7WebCore25DeleteFromTextNodeCommand9doUnapplyEv
+__ZN7WebCore6Editor16unappliedEditingEN3WTF10PassRefPtrINS_11EditCommandEEE
+__ZN7WebCore26setJSHTMLTableElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLTableElement8setAlignERKNS_6StringE
+__ZNK7WebCore9RenderBox19lastLineBoxBaselineEv
+__ZN7WebCore20CompositeEditCommand27addBlockPlaceholderIfNeededEPNS_7ElementE
+__ZN7WebCoreL20executeForwardDeleteEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore13TypingCommand23forwardDeleteKeyPressedEPNS_8DocumentEbNS_15TextGranularityEb
+__ZN7WebCore13TypingCommand23forwardDeleteKeyPressedENS_15TextGranularityEb
+__ZN7WebCore16VisibleSelectionD2Ev
+__ZN7WebCoreL28fontSizeChangesComputedStyleEPNS_11RenderStyleENS_11StyleChangeE
+__ZN7WebCore15createJSWrapperEPN3JSC8JSObjectEN3WTF10PassRefPtrINS0_8Bindings10RootObjectEEES7_
+__ZN7WebCore12getJSWrapperEPN3JSC8JSObjectE
+-[WebScriptObject _initWithJSObject:originRootObject:rootObject:]
+-[WebScriptObject webScriptValueAtIndex:]
 __ZN7WebCore25InsertIntoTextNodeCommand9doUnapplyEv
-__ZN7WebCore23SetNodeAttributeCommand9doUnapplyEv
-__ZN7WebCore35executeInsertNewlineInQuotedContentEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore13TypingCommand39insertParagraphSeparatorInQuotedContentEPNS_8DocumentE
-__ZN7WebCore13TypingCommand39insertParagraphSeparatorInQuotedContentEv
-__ZN7WebCore22BreakBlockquoteCommandC2EPNS_8DocumentE
-__ZN7WebCore22BreakBlockquoteCommand7doApplyEv
-__ZN7WebCore27isLastVisiblePositionInNodeERKNS_15VisiblePositionEPKNS_4NodeE
-__ZN7WebCore20executeForwardDeleteEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore13TypingCommand23forwardDeleteKeyPressedEPNS_8DocumentEbNS_15TextGranularityE
-__ZN7WebCore13TypingCommand23forwardDeleteKeyPressedENS_15TextGranularityE
-__ZN7WebCore31SimplifiedBackwardsTextIterator21handleReplacedElementEv
+__ZN7WebCoreL18marqueeConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore18HTMLMarqueeElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore18HTMLMarqueeElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore18HTMLMarqueeElement10mapToEntryERKNS_13QualifiedNameERNS_20MappedAttributeEntryE
+__ZN7WebCore18HTMLMarqueeElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCoreL31createHTMLMarqueeElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore20JSHTMLMarqueeElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSHTMLMarqueeElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18HTMLMarqueeElementEEE
+__ZN7WebCore20JSHTMLMarqueeElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18HTMLMarqueeElementEEE
+__ZNK7WebCore18HTMLMarqueeElement17endTagRequirementEv
+__ZNK7WebCore18HTMLMarqueeElement11tagPriorityEv
+__ZN7WebCore16StyleMarqueeDataC1ERKS0_
+__ZN7WebCore16StyleMarqueeDataC2ERKS0_
+__ZN7WebCore13RenderMarqueeC1EPNS_11RenderLayerE
+__ZN7WebCore13RenderMarqueeC2EPNS_11RenderLayerE
+__ZN7WebCore13RenderMarquee18updateMarqueeStyleEv
+__ZNK7WebCore13RenderMarquee12isHorizontalEv
+__ZNK7WebCore13RenderMarquee9directionEv
+__ZNK7WebCore13RenderMarquee12marqueeSpeedEv
+__ZN7WebCore13RenderMarquee21updateMarqueePositionEv
+__ZN7WebCore13RenderMarquee15computePositionENS_17EMarqueeDirectionEb
+__ZN7WebCore13RenderMarquee5startEv
+__ZN7WebCore5TimerINS_13RenderMarqueeEE5firedEv
+__ZN7WebCore13RenderMarquee10timerFiredEPNS_5TimerIS0_EE
+__ZThn112_NK7WebCore18HTMLMarqueeElement10canSuspendEv
+__ZNK7WebCore18HTMLMarqueeElement10canSuspendEv
+__ZThn112_N7WebCore18HTMLMarqueeElement4stopEv
+__ZN7WebCore18HTMLMarqueeElement4stopEv
+__ZN7WebCore13RenderMarquee4stopEv
+__ZN7WebCore20JSHTMLMarqueeElementD1Ev
+__ZN7WebCore29JSHTMLMarqueeElementPrototypeD1Ev
+__ZN7WebCore18HTMLMarqueeElementD0Ev
+__ZNK7WebCore4Font27selectionRectForComplexTextERKNS_7TextRunERKNS_8IntPointEiii
+__ZN7WebCore26RenderTextControlMultiLine17subtreeHasChangedEv
+__ZN7WebCore5Frame23textDidChangeInTextAreaEPNS_7ElementE
+__Z3kitPN7WebCore19HTMLTextAreaElementE
+__ZN7WebCore8Position42uncheckedPreviousOffsetForBackwardDeletionEPKNS_4NodeEi
+__ZNK7WebCore10RenderText33previousOffsetForBackwardDeletionEi
+__ZN7WebCore40lastEditablePositionBeforePositionInRootERKNS_8PositionEPNS_4NodeE
+__ZNK7WebCore16RenderListMarker18canBeSelectionLeafEv
+__ZN7WebCore16RenderListMarker17setSelectionStateENS_12RenderObject14SelectionStateE
+__ZN7WebCore16RenderListMarker23selectionRectForRepaintEPNS_20RenderBoxModelObjectEb
 __ZN7WebCore17InsertTextCommand9insertTabERKNS_8PositionE
 __ZN7WebCore20createTabSpanElementEPNS_8DocumentE
 __ZN7WebCore20createTabSpanElementEPNS_8DocumentEN3WTF10PassRefPtrINS_4NodeEEE
 __ZN7WebCore11tabSpanNodeEPKNS_4NodeE
-__ZN7WebCore25enableCaretInEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
-__ZN7WebCore16executeTransposeEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore20CompositeEditCommand13splitTextNodeEN3WTF10PassRefPtrINS_4TextEEEj
+__ZN7WebCore20SplitTextNodeCommandC1EN3WTF10PassRefPtrINS_4TextEEEi
+__ZN7WebCore20SplitTextNodeCommandC2EN3WTF10PassRefPtrINS_4TextEEEi
+__ZN7WebCore20SplitTextNodeCommand7doApplyEv
+__ZN7WebCore8Document11copyMarkersEPNS_4NodeEjiS2_iNS_14DocumentMarker10MarkerTypeE
+__ZN7WebCore20SplitTextNodeCommandD0Ev
+__ZN7WebCoreL22executeInsertLineBreakEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore13TypingCommand15insertLineBreakEPNS_8DocumentE
+__ZN7WebCore13TypingCommand15insertLineBreakEv
+__ZN7WebCore22InsertLineBreakCommandC1EPNS_8DocumentE
+__ZN7WebCore22InsertLineBreakCommandC2EPNS_8DocumentE
+__ZN7WebCore22InsertLineBreakCommand7doApplyEv
+__ZN7WebCore22InsertLineBreakCommand21shouldUseBreakElementERKNS_8PositionE
+__ZN7WebCore22InsertLineBreakCommandD0Ev
+__ZN7WebCoreL29executeDeleteToEndOfParagraphEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore21createListItemElementEPNS_8DocumentE
+__ZN7WebCore39jsDocumentPrototypeFunctionGetSelectionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore8Document12getSelectionEv
+__ZN7WebCore48jsDOMSelectionPrototypeFunctionSelectAllChildrenEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection17selectAllChildrenEPNS_4NodeERi
+__ZN7WebCore44jsDOMSelectionPrototypeFunctionCollapseToEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection13collapseToEndEv
+__ZN7WebCore38jsRangePrototypeFunctionSetStartBeforeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore35jsRangePrototypeFunctionSetEndAfterEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCoreL20executeDeleteForwardEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore36jsDOMWindowHTMLDivElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL25enableCaretInEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCoreL16executeTransposeEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore6Editor9transposeEv
-__ZN7WebCore20SplitTextNodeCommand9doUnapplyEv
-__ZN7WebCore22executeInsertLineBreakEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore22executeInsertParagraphEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore20CSSSegmentedFontFaceD1Ev
-__ZN7WebCore17CSSFontFaceSource10pruneTableEv
-__ZN3WTF6VectorIPN7WebCore17CSSFontFaceSourceELm0EE6shrinkEm
-__ZN7WebCore17GlyphPageTreeNode23pruneTreeCustomFontDataEPKNS_8FontDataE
-__ZN7WebCore17GlyphPageTreeNode19pruneCustomFontDataEPKNS_8FontDataE
-__ZN7WebCore17GlyphPageTreeNodeD1Ev
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore17GlyphPageTreeNodeEKNS_7HashMapIPKNS1_8FontDataES3_NS_7PtrHashIS7_EENS_10HashTraitsIS7_EENSA_IS3_EEEEEEvRT0_
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore17SegmentedFontDataEKNS_7HashMapIjS3_NS_7IntHashIjEENS_10HashTraitsIjEENS7_IS3_EEEEEEvRT0_
-__ZN7WebCore17SegmentedFontDataD1Ev
-__ZN3WTF6VectorIN7WebCore13FontDataRangeELm1EE6shrinkEm
-__ZN7WebCore20CSSUnicodeRangeValueD1Ev
-__ZN7WebCore20startOfNextParagraphERKNS_15VisiblePositionE
-__ZN7WebCore27executeInsertHorizontalRuleEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore17executeInsertNodeEPNS_5FrameEN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore21executeInsertFragmentEPNS_5FrameEN3WTF10PassRefPtrINS_16DocumentFragmentEEE
-__ZNK7WebCore14ClipboardEvent16isClipboardEventEv
-__ZNK7WebCore14ClipboardEvent9clipboardEv
-__ZN7WebCore20JSClipboardPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore11JSClipboardC1EPN3KJS8JSObjectEPNS_9ClipboardE
-__ZN7WebCore11JSClipboard18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20JSClipboardPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore35jsClipboardPrototypeFunctionSetDataEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore11JSClipboard9classInfoEv
-__ZN7WebCore12ClipboardMac7setDataERKNS_6StringES3_
-__ZN7WebCore21cocoaTypeFromMIMETypeERKNS_6StringE
-__ZN7WebCore14supportedPasteEPNS_5FrameENS_19EditorCommandSourceE
-__ZN7WebCore14executeOutdentEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore16logicalEndOfLineERKNS_15VisiblePositionE
+__ZN7WebCoreL26getLeafBoxesInLogicalOrderEPNS_13RootInlineBoxERN3WTF6VectorIPNS_9InlineBoxELm0EEE
+__ZN3WTF6VectorIPN7WebCore9InlineBoxELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore9InlineBoxELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore9InlineBoxELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIPN7WebCore9InlineBoxELm0EE6shrinkEm
+__ZN7WebCore17inSameLogicalLineERKNS_15VisiblePositionES2_
+__ZN7WebCore18logicalStartOfLineERKNS_15VisiblePositionE
+__ZN7WebCore32jsDOMWindowPrototypeFunctionFindEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow4findERKNS_6StringEbbbbbb
+__ZN7WebCore5Frame10findStringERKNS_6StringEbbbb
+__ZNK7WebCore16VisibleSelection18shadowTreeRootNodeEv
+__ZN7WebCoreL20executeJustifyCenterEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL26executeApplyParagraphStyleEPNS_5FrameENS_19EditorCommandSourceENS_10EditActionEiRKNS_6StringE
+__ZN7WebCore6Editor19applyParagraphStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
+__ZN7WebCore17ApplyStyleCommand15applyBlockStyleEPNS_26CSSMutableStyleDeclarationE
+__ZN7WebCore20CompositeEditCommand42moveParagraphContentsToNewBlockIfNecessaryERKNS_8PositionE
+__ZN7WebCore20CompositeEditCommand34insertNewDefaultParagraphElementAtERKNS_8PositionE
+__ZN7WebCore17ApplyStyleCommand13addBlockStyleERKNS_11StyleChangeEPNS_11HTMLElementE
+__ZN7WebCore12TextIterator26rangeFromLocationAndLengthEPNS_7ElementEiib
+__ZNK7WebCore17ApplyStyleCommand13editingActionEv
+__ZN7WebCoreL16executeBackColorEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL17executeApplyStyleEPNS_5FrameENS_19EditorCommandSourceENS_10EditActionEiRKNS_6StringE
+__ZN7WebCore6Editor10applyStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
+__ZN7WebCore5Frame24computeAndSetTypingStyleEPNS_19CSSStyleDeclarationENS_10EditActionE
+__ZN7WebCoreL13executeIndentEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore20IndentOutdentCommandC1EPNS_8DocumentENS0_11EIndentTypeEi
 __ZN7WebCore20IndentOutdentCommandC2EPNS_8DocumentENS0_11EIndentTypeEi
 __ZN7WebCore20IndentOutdentCommand7doApplyEv
-__ZN7WebCore20IndentOutdentCommand13outdentRegionEv
-__ZN7WebCore20IndentOutdentCommand16outdentParagraphEv
-__ZN7WebCore24isListOrIndentBlockquoteEPKNS_4NodeE
-__ZN7WebCore18isIndentBlockquoteEPKNS_4NodeE
-__ZNK7WebCore20IndentOutdentCommand13editingActionEv
+__ZN7WebCore20IndentOutdentCommand12indentRegionEv
+__ZN7WebCore30selectionForParagraphIterationERKNS_16VisibleSelectionE
+__ZN7WebCore23indexForVisiblePositionERNS_15VisiblePositionE
+__ZN7WebCore13enclosingListEPNS_4NodeE
+__ZN7WebCoreL29createIndentBlockquoteElementEPNS_8DocumentE
+__ZN7WebCoreL22indentBlockquoteStringEv
 __ZN7WebCore20CompositeEditCommand15splitTreeToNodeEPNS_4NodeES2_b
-__ZN7WebCore20CompositeEditCommand12splitElementEPNS_7ElementEPNS_4NodeE
-__ZN7WebCore19SplitElementCommandC2EPNS_7ElementEPNS_4NodeE
-__ZN7WebCore19SplitElementCommand7doApplyEv
-__ZN7WebCore17InsertListCommand20fixOrphanedListChildEPNS_4NodeE
-__ZN7WebCore22indentBlockquoteStringEv
+__ZN7WebCore20IndentOutdentCommand34prepareBlockquoteLevelForInsertionERNS_15VisiblePositionERN3WTF6RefPtrINS_7ElementEEE
+__ZN7WebCoreL18isIndentBlockquoteEPKNS_4NodeE
+__ZNK7WebCore20IndentOutdentCommand20preservesTypingStyleEv
+__ZNK7WebCore20IndentOutdentCommand13editingActionEv
+__ZN7WebCore20IndentOutdentCommandD0Ev
+__ZN7WebCoreL18executeFormatBlockEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore13validBlockTagERKNS_6StringE
+__ZN7WebCore18FormatBlockCommandC1EPNS_8DocumentERKNS_12AtomicStringE
+__ZN7WebCore18FormatBlockCommandC2EPNS_8DocumentERKNS_12AtomicStringE
+__ZN7WebCore18FormatBlockCommand7doApplyEv
+__ZN7WebCore18FormatBlockCommand11modifyRangeEv
 __ZN7WebCore25enclosingBlockFlowElementERKNS_15VisiblePositionE
-__ZN7WebCore26enabledRangeInEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
-__ZN7WebCore19executeRemoveFormatEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore17createHTMLElementEPNS_8DocumentERKNS_12AtomicStringE
+__ZN7WebCore20CompositeEditCommand10applyStyleEPNS_19CSSStyleDeclarationERKNS_8PositionES5_NS_10EditActionE
+__ZN7WebCore17ApplyStyleCommandC1EPNS_8DocumentEPNS_19CSSStyleDeclarationERKNS_8PositionES7_NS_10EditActionENS0_14EPropertyLeve
+__ZN7WebCore17ApplyStyleCommandC2EPNS_8DocumentEPNS_19CSSStyleDeclarationERKNS_8PositionES7_NS_10EditActionENS0_14EPropertyLeve
+__ZNK7WebCore18FormatBlockCommand13editingActionEv
+__ZN7WebCore18FormatBlockCommandD0Ev
+__ZN7WebCoreL26enabledRangeInEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCoreL19executeRemoveFormatEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore6Editor24removeFormattingAndStyleEv
 __ZN7WebCore19RemoveFormatCommandC1EPNS_8DocumentE
+__ZN7WebCore19RemoveFormatCommandC2EPNS_8DocumentE
 __ZN7WebCore19RemoveFormatCommand7doApplyEv
-__ZN7WebCore20CompositeEditCommand9inputTextERKNS_6StringEb
 __ZNK7WebCore19RemoveFormatCommand13editingActionEv
-__ZN7WebCore39jsRangePrototypeFunctionExtractContentsEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore5Range15extractContentsERi
-__ZN7WebCore18executeFormatBlockEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore13validBlockTagERKNS_6StringE
-__ZN7WebCore18FormatBlockCommandC2EPNS_8DocumentERKNS_6StringE
-__ZN7WebCore18FormatBlockCommand7doApplyEv
-__ZN7WebCore13createElementEPNS_8DocumentERKNS_6StringE
-__ZNK7WebCore18FormatBlockCommand13editingActionEv
-__ZN7WebCore13executeIndentEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore20IndentOutdentCommand12indentRegionEv
-__ZN7WebCore23indexForVisiblePositionERNS_15VisiblePositionE
-__ZN7WebCore29createIndentBlockquoteElementEPNS_8DocumentE
-__ZN7WebCore20IndentOutdentCommand34prepareBlockquoteLevelForInsertionERNS_15VisiblePositionEPPNS_4NodeE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm16EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm16EE15reserveCapacityEm
-__ZN7WebCore17executeInsertHTMLEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore23ReplaceSelectionCommand37insertNodeAfterAndUpdateNodesInsertedEPNS_4NodeES2_
+__ZN7WebCore19RemoveFormatCommandD0Ev
+__ZN7WebCore20CompositeEditCommand39pushPartiallySelectedAnchorElementsDownEv
+__ZN7WebCore20CompositeEditCommand18applyStyledElementEN3WTF10PassRefPtrINS_7ElementEEE
+__ZN7WebCore17ApplyStyleCommandC1EN3WTF10PassRefPtrINS_7ElementEEEbNS_10EditActionE
+__ZN7WebCore17ApplyStyleCommandC2EN3WTF10PassRefPtrINS_7ElementEEEbNS_10EditActionE
+__ZN7WebCoreL26executeInsertUnorderedListEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore17InsertListCommandC1EPNS_8DocumentENS0_4TypeE
+__ZN7WebCore17InsertListCommandC2EPNS_8DocumentENS0_4TypeE
+__ZN7WebCore17InsertListCommand7doApplyEv
+__ZN7WebCore22outermostEnclosingListEPNS_4NodeE
+__ZN7WebCore18enclosingTableCellERKNS_8PositionE
+__ZN7WebCore26createUnorderedListElementEPNS_8DocumentE
+__ZNK7WebCore17InsertListCommand20preservesTypingStyleEv
+__ZNK7WebCore17InsertListCommand13editingActionEv
+__ZN7WebCoreL17executeToggleBoldEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL18executeToggleStyleEPNS_5FrameENS_19EditorCommandSourceENS_10EditActionEiPKcS5_
+__ZNK7WebCore6Editor22selectionStartHasStyleEPNS_19CSSStyleDeclarationE
+__ZN7WebCoreL14executeOutdentEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore20IndentOutdentCommand13outdentRegionEv
+__ZN7WebCore20IndentOutdentCommand16outdentParagraphEv
+__ZN7WebCoreL24isListOrIndentBlockquoteEPKNS_4NodeE
+__ZN7WebCore17InsertListCommandD0Ev
+__ZN7WebCore32jsDOMWindowPrototypeFunctionBlurEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow4blurEv
+__ZN7WebCore5Frame13unfocusWindowEv
+__ZNK7WebCore6Chrome7unfocusEv
+__ZN7WebCore11inSameBlockERKNS_15VisiblePositionES2_
+__ZN7WebCore8Position12moveToOffsetEi
+__ZN7WebCore20CompositeEditCommand30splitTextNodeContainingElementEN3WTF10PassRefPtrINS_4TextEEEj
+__ZN7WebCore37SplitTextNodeContainingElementCommandC1EN3WTF10PassRefPtrINS_4TextEEEi
+__ZN7WebCore37SplitTextNodeContainingElementCommandC2EN3WTF10PassRefPtrINS_4TextEEEi
+__ZN7WebCore37SplitTextNodeContainingElementCommand7doApplyEv
+__ZN7WebCore20CompositeEditCommand23wrapContentsInDummySpanEN3WTF10PassRefPtrINS_7ElementEEE
+__ZN7WebCore30WrapContentsInDummySpanCommandC1EN3WTF10PassRefPtrINS_7ElementEEE
+__ZN7WebCore30WrapContentsInDummySpanCommandC2EN3WTF10PassRefPtrINS_7ElementEEE
+__ZN7WebCore30WrapContentsInDummySpanCommand7doApplyEv
+__ZN7WebCore20CompositeEditCommand12splitElementEN3WTF10PassRefPtrINS_7ElementEEENS2_INS_4NodeEEE
+__ZN7WebCore19SplitElementCommandC1EN3WTF10PassRefPtrINS_7ElementEEENS2_INS_4NodeEEE
+__ZN7WebCore19SplitElementCommandC2EN3WTF10PassRefPtrINS_7ElementEEENS2_INS_4NodeEEE
+__ZN7WebCore19SplitElementCommand7doApplyEv
+__ZN7WebCoreL24dummySpanAncestorForNodeEPKNS_4NodeE
+__ZN7WebCore17ApplyStyleCommand27mergeEndWithNextIfIdenticalERKNS_8PositionES3_
+__ZN7WebCoreL20areIdenticalElementsEPNS_4NodeES1_
+__ZN7WebCore20CompositeEditCommand22mergeIdenticalElementsEN3WTF10PassRefPtrINS_7ElementEEES4_
+__ZN7WebCore29MergeIdenticalElementsCommandC1EN3WTF10PassRefPtrINS_7ElementEEES4_
+__ZN7WebCore29MergeIdenticalElementsCommandC2EN3WTF10PassRefPtrINS_7ElementEEES4_
+__ZN7WebCore29MergeIdenticalElementsCommand7doApplyEv
+__ZN7WebCoreL19isUnstyledStyleSpanEPKNS_4NodeE
+__ZN7WebCore37SplitTextNodeContainingElementCommandD0Ev
+__ZN7WebCore30WrapContentsInDummySpanCommandD0Ev
+__ZN7WebCore19SplitElementCommandD0Ev
+__ZN7WebCore29MergeIdenticalElementsCommandD0Ev
+__ZN7WebCoreL19executeJustifyRightEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL17executeInsertHTMLEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL21executeInsertFragmentEPNS_5FrameEN3WTF10PassRefPtrINS_16DocumentFragmentEEE
+__ZN7WebCore23ReplaceSelectionCommand37insertNodeAfterAndUpdateNodesInsertedEN3WTF10PassRefPtrINS_4NodeEEEPS3_
 __ZN7WebCore23ReplaceSelectionCommand11shouldMergeERKNS_15VisiblePositionES3_
-__ZN7WebCore16executeUnderlineEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore17executeFindStringEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore20previousWordPositionERKNS_15VisiblePositionE
-__ZN7WebCore32enabledRangeInRichlyEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
-__ZN7WebCore13executeUnlinkEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZNK7WebCore23ReplaceSelectionCommand13editingActionEv
+__ZN7WebCoreL11executeCopyEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore6Editor4copyEv
+__ZN7WebCore6Editor12tryDHTMLCopyEv
+__ZN7WebCore10Pasteboard17generalPasteboardEv
+__ZN7WebCore10PasteboardC1EP12NSPasteboard
+__ZN7WebCore10PasteboardC2EP12NSPasteboard
+__ZN7WebCore10Pasteboard5clearEv
+__ZN7WebCore6Editor13selectedRangeEv
+__ZN7WebCore10Pasteboard14writeSelectionEPNS_5RangeEbPNS_5FrameE
+__ZN7WebCore10Pasteboard14writeSelectionEP12NSPasteboardPNS_5RangeEbPNS_5FrameE
+-[DOMObject copyWithZone:]
+-[DOMCSSPrimitiveValue getStringValue]
+__ZNK7WebCore17CSSPrimitiveValue14getStringValueERi
+__ZN7WebCoreL14valueForShadowEPKNS_10ShadowDataE
+-[DOMElement(WebPrivate) _font]
+-[DOMRGBColor(WebPrivate) _color]
+-[DOMRGBColor color]
+__ZN7WebCore16LegacyWebArchive19createFromSelectionEPNS_5FrameE
+__ZNK7WebCore5Range4textEv
+__ZN7WebCore6Editor29didWriteSelectionToPasteboardEv
+__ZN7WebCoreL14supportedPasteEPNS_5FrameENS_19EditorCommandSourceE
+__ZN7WebCoreL12enabledPasteEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCoreL12executePasteEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore6Editor5pasteEv
+__ZN7WebCore6Editor13tryDHTMLPasteEv
+__ZN7WebCore14DocumentLoader22addAllArchiveResourcesEPNS_7ArchiveE
+__ZN7WebCore25ArchiveResourceCollectionC1Ev
+__ZN7WebCore25ArchiveResourceCollectionC2Ev
+__ZN7WebCore25ArchiveResourceCollection15addAllResourcesEPNS_7ArchiveE
+__Z4coreP19DOMDocumentFragment
+__ZN3WTF6VectorIPN7WebCore7ElementELm0EE14expandCapacityEmPKS3_
+__ZN7WebCore17InsertListCommand11modifyRangeEv
+__ZN7WebCore20CompositeEditCommand9inputTextERKNS_6StringEb
+__ZN7WebCore27jsHTMLOptionElementSelectedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLSelectElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17ApplyStyleCommand26extractTextDecorationStyleEPNS_4NodeE
+__ZN7WebCore20CompositeEditCommand17removeCSSPropertyEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE13CSSPropertyID
+__ZN7WebCore24RemoveCSSPropertyCommandC1EPNS_8DocumentEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE13CSSPropertyID
+__ZN7WebCore24RemoveCSSPropertyCommandC2EPNS_8DocumentEN3WTF10PassRefPtrINS_26CSSMutableStyleDeclarationEEE13CSSPropertyID
+__ZN7WebCore24RemoveCSSPropertyCommand7doApplyEv
+__ZN7WebCore20CompositeEditCommand19removeNodeAttributeEN3WTF10PassRefPtrINS_7ElementEEERKNS_13QualifiedNameE
+__ZN7WebCore24RemoveCSSPropertyCommandD0Ev
+__ZN7WebCoreL24executeInsertOrderedListEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore24createOrderedListElementEPNS_8DocumentE
+__ZN7WebCore20startOfNextParagraphERKNS_15VisiblePositionE
+__ZN7WebCore39jsRangePrototypeFunctionExtractContentsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore5Range15extractContentsERi
+__ZN7WebCore5Range18checkDeleteExtractERi
+__ZN7WebCore5Range15processContentsENS0_10ActionTypeERi
+__ZN7WebCore17ApplyStyleCommand19removeHTMLStyleNodeEPNS_11HTMLElementE
+__ZN7WebCore20CompositeEditCommand15insertLineBreakEv
+__ZN3WTF6VectorISt4pairIiiELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorISt4pairIiiELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorISt4pairIiiELm0EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIiiELm0EE15reserveCapacityEm
+__ZN3WTF6VectorISt4pairIiiELm0EE6shrinkEm
+__ZN7WebCore15isEndOfDocumentERKNS_15VisiblePositionE
+__ZN7WebCoreL32enabledRangeInRichlyEditableTextEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCoreL13executeUnlinkEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore13UnlinkCommandC1EPNS_8DocumentE
+__ZN7WebCore13UnlinkCommandC2EPNS_8DocumentE
 __ZN7WebCore13UnlinkCommand7doApplyEv
 __ZN7WebCore20CompositeEditCommand21pushAnchorElementDownEPNS_4NodeE
-__ZN7WebCore20CompositeEditCommand19removeStyledElementEPNS_7ElementE
+__ZN7WebCore20CompositeEditCommand19removeStyledElementEN3WTF10PassRefPtrINS_7ElementEEE
 __ZNK7WebCore13UnlinkCommand13editingActionEv
-__ZN7WebCore20CompositeEditCommand30splitTextNodeContainingElementEPNS_4TextEi
-__ZN7WebCore37SplitTextNodeContainingElementCommandC2EPNS_4TextEi
-__ZN7WebCore37SplitTextNodeContainingElementCommand7doApplyEv
-__ZN7WebCore24dummySpanAncestorForNodeEPKNS_4NodeE
+__ZN7WebCore13UnlinkCommandD0Ev
+__ZN7WebCoreL16executeUnderlineEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore17ApplyStyleCommand33mergeStartWithPreviousIfIdenticalERKNS_8PositionES3_
-__ZN7WebCore17ApplyStyleCommand27mergeEndWithNextIfIdenticalERKNS_8PositionES3_
-__ZN7WebCore20areIdenticalElementsEPNS_4NodeES1_
-__ZN7WebCore20CompositeEditCommand22mergeIdenticalElementsEPNS_7ElementES2_
-__ZN7WebCore29MergeIdenticalElementsCommandC2EPNS_7ElementES2_
-__ZN7WebCore29MergeIdenticalElementsCommand7doApplyEv
-__ZN7WebCore20CompositeEditCommand15insertLineBreakEv
-__ZN7WebCore12executePrintEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore6Chrome5printEPNS_5FrameE
-__ZN7WebCore44jsDocumentPrototypeFunctionQueryCommandStateEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document17queryCommandStateERKNS_6StringE
-__ZN7WebCore18stateUnorderedListEPNS_5FrameEPNS_5EventE
-__ZNK7WebCore6Editor27selectionUnorderedListStateEv
-__ZN7WebCore16stateOrderedListEPNS_5FrameEPNS_5EventE
-__ZNK7WebCore6Editor25selectionOrderedListStateEv
-__ZN7WebCore20CompositeEditCommand27addBlockPlaceholderIfNeededEPNS_4NodeE
-__ZNK7WebCore14RenderListItem7isEmptyEv
-__ZN7WebCore28previousWordPositionBoundaryEPKtj
-__ZN7WebCore16executeBackColorEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore20CompositeEditCommand23wrapContentsInDummySpanEPNS_7ElementE
-__ZN7WebCore30WrapContentsInDummySpanCommandC2EPNS_7ElementE
-__ZN7WebCore30WrapContentsInDummySpanCommand7doApplyEv
-__ZN7WebCore11JSClipboardD0Ev
-__ZN7WebCore17ApplyStyleCommand26extractTextDecorationStyleEPNS_4NodeE
-__ZN7WebCore20CompositeEditCommand19removeNodeAttributeEPNS_7ElementERKNS_13QualifiedNameE
-__ZN7WebCore26RemoveNodeAttributeCommandC1EPNS_7ElementERKNS_13QualifiedNameE
-__ZN7WebCore26RemoveNodeAttributeCommand7doApplyEv
-__ZN7WebCore7Element15removeAttributeERKNS_13QualifiedNameERi
-__ZN7WebCore20executeStrikethroughEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore17ApplyStyleCommand24applyTextDecorationStyleEPNS_4NodeEPNS_26CSSMutableStyleDeclarationE
-__ZN7WebCore17ApplyStyleCommand19removeHTMLStyleNodeEPNS_11HTMLElementE
-__ZN7WebCore18FormatBlockCommand11modifyRangeEv
-__ZN7WebCore46jsDocumentPrototypeFunctionQueryCommandEnabledEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document19queryCommandEnabledERKNS_6StringE
-__ZN7WebCore18executeInsertImageEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
-__ZN7WebCore16HTMLImageElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore10executeCutEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore48jsDocumentPrototypeFunctionQueryCommandSupportedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document21queryCommandSupportedERKNS_6StringE
+__ZN7WebCoreL19executeStyleWithCSSEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore46jsCanvasRenderingContext2DPrototypeFunctionArcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D3arcEfffffbRi
+__ZN7WebCore4Path6addArcERKNS_10FloatPointEfffb
+__ZN7WebCore51jsCanvasRenderingContext2DPrototypeFunctionFillRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D8fillRectEffff
+__ZN7WebCore15GraphicsContext8fillRectERKNS_9FloatRectE
+__ZN7WebCoreL10executeCutEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore6Editor3cutEv
 __ZN7WebCore6Editor11tryDHTMLCutEv
+__ZN7WebCoreL17executeFindStringEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL27executeInsertHorizontalRuleEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL17executeInsertNodeEPNS_5FrameEN3WTF10PassRefPtrINS_4NodeEEE
+__ZNK7WebCore14ClipboardEvent16isClipboardEventEv
+__ZNK7WebCore14ClipboardEvent9clipboardEv
+__ZN7WebCore11JSClipboard15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSClipboardC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9ClipboardEEE
+__ZN7WebCore11JSClipboardC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9ClipboardEEE
+__ZN7WebCore11JSClipboard18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20JSClipboardPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore35jsClipboardPrototypeFunctionSetDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore11JSClipboard9classInfoEv
+__ZN7WebCore11JSClipboard7setDataEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore12ClipboardMac7setDataERKNS_6StringES3_
+__ZN7WebCoreL21cocoaTypeFromMIMETypeERKNS_6StringE
+__ZN7WebCore35jsClipboardPrototypeFunctionGetDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSClipboard7getDataEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore12ClipboardMac7getDataERKNS_6StringERb
+__ZN7WebCore11JSClipboardD1Ev
+__ZN7WebCore11JSClipboardD2Ev
+__ZN7WebCore20JSClipboardPrototypeD1Ev
+__ZN7WebCore31setJSHTMLElementContentEditableEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement18setContentEditableERKNS_6StringE
+__ZN7WebCore46jsDOMSelectionPrototypeFunctionRemoveAllRangesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection15removeAllRangesEv
+__ZNK7WebCore6Editor9canDeleteEv
+__ZN7WebCoreL23enabledVisibleSelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCore46jsDocumentPrototypeFunctionQueryCommandEnabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document19queryCommandEnabledERKNS_6StringE
+__ZN7WebCore17isStartOfDocumentERKNS_15VisiblePositionE
+__ZNK7WebCore16RenderPartObject10renderNameEv
+__ZN7WebCore24setJSHTMLAreaElementHrefEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLAreaElement7setHrefERKNS_12AtomicStringE
+__ZN7WebCore26setJSHTMLAreaElementCoordsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLAreaElement9setCoordsERKNS_12AtomicStringE
+__ZN7WebCore12EventHandler32handleMousePressEventDoubleClickERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore12EventHandler31selectClosestWordFromMouseEventERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore16VisibleSelection22expandUsingGranularityENS_15TextGranularityE
+__ZN7WebCore11isEndOfLineERKNS_15VisiblePositionE
+__ZN7WebCore9endOfLineERKNS_15VisiblePositionE
+__ZN7WebCoreL18endPositionForLineERKNS_15VisiblePositionE
+__ZN7WebCore6Editor33isSelectTrailingWhitespaceEnabledEv
+__ZN7WebCore12EventHandler27handleMouseDoubleClickEventERKNS_18PlatformMouseEventE
+__ZN7WebCore11RenderBlock26addContinuationWithOutlineEPNS_12RenderInlineE
+__ZNK3WTF7HashMapIPN7WebCore11RenderBlockEPNS_11ListHashSetIPNS1_12RenderInlineENS_7PtrHashIS6_EEEENS7_IS3_EENS_10HashTraitsIS3
+__ZN3WTF7HashMapIPN7WebCore11RenderBlockEPNS_11ListHashSetIPNS1_12RenderInlineENS_7PtrHashIS6_EEEENS7_IS3_EENS_10HashTraitsIS3_
+__ZN3WTF9HashTableIPN7WebCore11RenderBlockESt4pairIS3_PNS_11ListHashSetIPNS1_12RenderInlineENS_7PtrHashIS7_EEEEENS_18PairFirstE
+__ZN7WebCore19jsDOMWindowOnscrollEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow8onscrollEv
+__ZN7WebCore22setJSDOMWindowOnscrollEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow11setOnscrollEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore17jsNodeOnmousemoveEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node11onmousemoveEv
+__ZN7WebCoreL18executeInsertImageEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL19executeToggleItalicEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL16executeForeColorEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZNK7WebCore6Editor17shouldDeleteRangeEPNS_5RangeE
 __ZNK7WebCore6Editor14canDeleteRangeEPNS_5RangeE
 __ZN7WebCore6Editor30deleteSelectionWithSmartDeleteEb
+__ZNK7WebCore22DeleteSelectionCommand20preservesTypingStyleEv
 __ZNK7WebCore22DeleteSelectionCommand13editingActionEv
-__ZN7WebCore32jsDOMWindowPrototypeFunctionFindEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9DOMWindow4findERKNS_6StringEbbbbbb
-__ZN7WebCore19RemoveFormatCommandD1Ev
-__ZN7WebCore26RemoveNodeAttributeCommandD1Ev
-__ZN7WebCore13UnlinkCommandD1Ev
-__ZN7WebCore11inSameBlockERKNS_15VisiblePositionES2_
-__ZN7WebCore22caretMaxRenderedOffsetEPKNS_4NodeE
-__ZN7WebCore20CompositeEditCommand27insertNodeAtTabSpanPositionEPNS_4NodeERKNS_8PositionE
-__ZN7WebCore11HTMLElement18setContentEditableERKNS_6StringE
-__ZN7WebCore19SplitElementCommand9doUnapplyEv
-__ZN7WebCore11enabledRedoEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCore29isCharacterSmartReplaceExemptEib
+__ZN7WebCoreL11getSmartSetEb
+__ZN7WebCoreL12executePrintEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore6Chrome5printEPNS_5FrameE
+__ZN7WebCore44jsDocumentPrototypeFunctionQueryCommandStateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document17queryCommandStateERKNS_6StringE
+__ZN7WebCoreL18stateUnorderedListEPNS_5FrameEPNS_5EventE
+__ZNK7WebCore6Editor27selectionUnorderedListStateEv
+__ZN7WebCoreL16stateOrderedListEPNS_5FrameEPNS_5EventE
+__ZNK7WebCore6Editor25selectionOrderedListStateEv
+__ZN7WebCore17InsertListCommand20fixOrphanedListChildEPNS_4NodeE
+__ZN7WebCoreL20executeStrikethroughEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore17ApplyStyleCommand24applyTextDecorationStyleEPNS_4NodeEPNS_26CSSMutableStyleDeclarationE
+__ZN7WebCore49jsCSSStyleDeclarationPrototypeFunctionSetPropertyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCoreL16executeSubscriptEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL18executeSuperscriptEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore17ApplyStyleCommand35extractAndNegateTextDecorationStyleEPNS_4NodeE
+__ZN7WebCore6Editor24insertParagraphSeparatorEv
+__ZN7WebCoreL19executeMoveBackwardEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore55jsHTMLTextAreaElementPrototypeFunctionSetSelectionRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore17InsertTextCommand21performTrivialReplaceERKNS_6StringEb
+__ZN7WebCore25setJSHTMLAnchorElementRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement6setRelERKNS_12AtomicStringE
+__ZN7WebCore20CompositeEditCommand27insertNodeAtTabSpanPositionEN3WTF10PassRefPtrINS_4NodeEEERKNS_8PositionE
+__ZNK7WebCore11RenderTheme11systemColorEi
+__ZN7WebCore10JSNodeList10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore35jsDOMWindowXSLTProcessorConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow13xsltProcessorEPN3JSC9ExecStateE
+__ZN7WebCore26JSXSLTProcessorConstructorC1EPN3JSC9ExecStateE
+__ZN7WebCore26JSXSLTProcessorConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSXSLTProcessorPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSXSLTProcessor15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSXSLTProcessorConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCoreL22constructXSLTProcessorEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZN7WebCore15JSXSLTProcessorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13XSLTProcessorEEE
+__ZN7WebCore15JSXSLTProcessorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13XSLTProcessorEEE
+__ZN7WebCore22HTMLFormControlElement5resetEv
+__ZN7WebCore15JSXSLTProcessorD1Ev
+__ZN7WebCore15JSXSLTProcessorD2Ev
+__ZN7WebCore24JSXSLTProcessorPrototypeD1Ev
+__ZN7WebCore26JSXSLTProcessorConstructorD1Ev
+__ZN7WebCore17AppendNodeCommand9doUnapplyEv
+__ZN7WebCoreL11enabledRedoEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
 __ZN7WebCore6Editor7canRedoEv
-__ZN7WebCore11executeRedoEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL11executeRedoEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore6Editor4redoEv
 __ZN7WebCore11EditCommand7reapplyEv
 __ZN7WebCore20CompositeEditCommand9doReapplyEv
 __ZN7WebCore11EditCommand9doReapplyEv
 __ZN7WebCore6Editor16reappliedEditingEN3WTF10PassRefPtrINS_11EditCommandEEE
+__ZN7WebCore12EventHandler22defaultTabEventHandlerEPNS_13KeyboardEventE
+__ZN7WebCoreL16executeInsertTabEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore19ReplacementFragment30insertFragmentForTestRenderingEPNS_4NodeE
+__ZN7WebCore19ReplacementFragment35restoreTestRenderingNodesToFragmentEPNS_4NodeE
+__ZN7WebCore19ReplacementFragment21removeUnrenderedNodesEPNS_4NodeE
+__ZN7WebCore14isNodeRenderedEPKNS_4NodeE
 __ZN7WebCore20CompositeEditCommand24insertParagraphSeparatorEb
-__ZN7WebCore105_GLOBAL__N__Volumes_QuickPerf_source_TOT_OpenSource_WebCore_editing_HTMLInterchange.cpp_00000000_A5DBA54420convertedSpaceStringEv
-__ZN7WebCore23fillContainerFromStringEPNS_13ContainerNodeERKNS_16DeprecatedStringE
-__ZN7WebCore20DeprecatedStringList5splitERKNS_14DeprecatedCharERKNS_16DeprecatedStringEb
-__ZN7WebCore20DeprecatedStringList5splitERKNS_16DeprecatedStringES3_b
-__ZN7WebCore20DeprecatedStringList9pop_frontEv
-__ZN7WebCore19DeprecatedValueListINS_16DeprecatedStringEE10deleteNodeEPNS_27DeprecatedValueListImplNodeE
-__ZN7WebCore25stripAttachmentCharactersEP18NSAttributedString
-__ZN7WebCore34jsRangePrototypeFunctionSelectNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore32jsRangePrototypeFunctionToStringEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore5Range8toStringERi
-__ZN7WebCore49jsDOMSelectionPrototypeFunctionDeleteFromDocumentEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12DOMSelection18deleteFromDocumentEv
+__ZN7WebCoreL25executePasteAndMatchStyleEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore6Editor16pasteAsPlainTextEv
+__ZN7WebCore6Editor30pasteAsPlainTextWithPasteboardEPNS_10PasteboardE
+__ZN7WebCore10Pasteboard9plainTextEPNS_5FrameE
+__ZN7WebCore6Editor29canSmartReplaceWithPasteboardEPNS_10PasteboardE
+__ZN7WebCore10Pasteboard15canSmartReplaceEv
+__ZN7WebCore6Editor24replaceSelectionWithTextERKNS_6StringEbb
+__ZN7WebCore6Editor28replaceSelectionWithFragmentEN3WTF10PassRefPtrINS_16DocumentFragmentEEEbbb
+__ZN7WebCoreL19stringValueForRangeEPKNS_4NodeEPKNS_5RangeE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore15ArchiveResourceEEELm0EE6shrinkEm
+__ZN7WebCoreL25stripAttachmentCharactersEP18NSAttributedString
+__ZN3WTF7HashMapIN7WebCore6StringENS_6RefPtrINS1_15ArchiveResourceEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERKS2
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS_6RefPtrINS1_15ArchiveResourceEEEENS_18PairFirstExtractorIS7_EENS1_10StringHas
+__ZNK7WebCore14RenderMenuList10renderNameEv
+__ZN7WebCore5Range11compareNodeEPNS_4NodeERi
+__ZN7WebCore12ClipboardMac10writeRangeEPNS_5RangeEPNS_5FrameE
+__ZN7WebCore6Editor24smartInsertDeleteEnabledEv
+__ZN7WebCore27createDragImageForSelectionEPNS_5FrameE
+__ZN7WebCore5Frame21dragImageForSelectionEv
+__ZNK7WebCore5Frame14selectionImageEb
+__ZN7WebCore9FrameView19setPaintRestrictionENS_16PaintRestrictionE
+__ZNK7WebCore5Frame13imageFromRectE6CGRect
+__ZN7WebCore14DragController10dragIsMoveEPNS_19SelectionControllerE
+__ZN7WebCore14DragController13isCopyKeyDownEv
+__ZNK7WebCore8DragData10asFragmentEPNS_8DocumentE
+__ZN7WebCore6Editor20shouldInsertFragmentEN3WTF10PassRefPtrINS_16DocumentFragmentEEENS2_INS_5RangeEEENS_18EditorInsertActionE
+__ZNK7WebCore4Node19isCharacterDataNodeEv
+__ZNK7WebCore8DragData15canSmartReplaceEv
+__ZN7WebCore20MoveSelectionCommandC1EN3WTF10PassRefPtrINS_16DocumentFragmentEEERKNS_8PositionEb
+__ZN7WebCore20MoveSelectionCommandC2EN3WTF10PassRefPtrINS_16DocumentFragmentEEERKNS_8PositionEb
+__ZN7WebCore20MoveSelectionCommand7doApplyEv
+__ZNK7WebCore20MoveSelectionCommand13editingActionEv
+__ZN7WebCore20MoveSelectionCommandD0Ev
+__ZN7WebCore42jsRangePrototypeFunctionSelectNodeContentsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26setJSHTMLOListElementStartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLOListElement8setStartEi
+__ZN7WebCore26CSSMutableStyleDeclaration17addParsedPropertyERKNS_11CSSPropertyE
+__ZN7WebCore10systemBeepEv
+__ZN7WebCore10Pasteboard10writeImageEPNS_4NodeERKNS_4KURLERKNS_6StringE
+__ZN7WebCoreL21writableTypesForImageEv
+__ZN7WebCoreL19writableTypesForURLEv
+__ZN7WebCore10Pasteboard8writeURLEP12NSPasteboardP7NSArrayRKNS_4KURLERKNS_6StringEPNS_5FrameE
+_suggestedFilenameWithMIMEType
+_filenameByFixingIllegalCharacters
+__ZN7WebCore16MIMETypeRegistry24getExtensionsForMIMETypeERKNS_6StringE
+__ZN7WebCore10Pasteboard32writeFileWrapperAsRTFDAttachmentEP13NSFileWrapper
+__ZN7WebCore14DocumentLoader18addArchiveResourceEN3WTF10PassRefPtrINS_15ArchiveResourceEEE
+__ZN7WebCore25ArchiveResourceCollection11addResourceEN3WTF10PassRefPtrINS_15ArchiveResourceEEE
+__ZN7WebCore25ArchiveResourceCollection21archiveResourceForURLERKNS_4KURLE
+__ZNK3WTF7HashMapIN7WebCore6StringENS_6RefPtrINS1_15ArchiveResourceEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3getERKS
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore14ResourceLoaderEEENS1_INS2_18SubstituteResourceEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEN
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14ResourceLoaderEEESt4pairIS4_NS1_INS2_18SubstituteResourceEEEENS_18PairFirstExtractorIS
+__ZN7WebCore5TimerINS_14DocumentLoaderEE5firedEv
+__ZN7WebCore14DocumentLoader36substituteResourceDeliveryTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore7Element5styleEv
+__ZNK7WebCore8Document10isFrameSetEv
+__ZN7WebCoreL23setSelectionToDragCaretEPNS_5FrameERNS_16VisibleSelectionERN3WTF6RefPtrINS_5RangeEEERKNS_8IntPointE
+__ZN7WebCoreL22caretMaxRenderedOffsetEPKNS_4NodeE
+__ZN7WebCore8Document23activeChainNodeDetachedEPNS_4NodeE
+__ZN7WebCore12EventHandler15hoverTimerFiredEPNS_5TimerIS0_EE
+__ZNK7WebCore11RenderTheme32inactiveSelectionBackgroundColorEv
+__ZN7WebCore14RenderReplaced16positionForPointERKNS_8IntPointE
+__ZN7WebCore12ClipboardMac8writeURLERKNS_4KURLERKNS_6StringEPNS_5FrameE
+__ZNK7WebCore12RenderButton10renderNameEv
+__ZNK7WebCore8DragData11asPlainTextEv
+__ZN7WebCoreL11executeYankEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore6Editor16yankFromKillRingEv
+__ZN7WebCore6Editor24setKillRingToYankedStateEv
+__ZN7WebCoreL33executeMoveToBeginningOfParagraphEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZNK7WebCore9Clipboard20destinationOperationERNS_13DragOperationE
+__ZN7WebCore12EventHandler18performDragAndDropERKNS_18PlatformMouseEventEPNS_9ClipboardE
+-[DOMHTMLInputElement type]
+__ZNK7WebCore16HTMLInputElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK3JSC8JSObject14isGlobalObjectEv
+__ZN3JSC16RuntimeObjectImp11getCallDataERNS_8CallDataE
+__ZNK3JSC8Bindings12ObjcInstance27supportsInvokeDefaultMethodEv
+__ZN3JSCL17callRuntimeObjectEPNS_9ExecStateEPNS_8JSObjectENS_7JSValueERKNS_7ArgListE
+__ZN3JSC8Bindings12ObjcInstance19invokeDefaultMethodEPNS_9ExecStateERKNS_7ArgListE
+__ZN7WebCore27jsHTMLAnchorElementHostnameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement8hostnameEv
+-[DOMHTMLOListElement start]
+-[DOMHTMLTableElement cellSpacing]
+-[DOMHTMLTableElement cellPadding]
+-[DOMHTMLTableCellElement rowSpan]
+-[DOMHTMLTableCellElement colSpan]
+-[DOMHTMLTableCellElement width]
+-[DOMHTMLTableCellElement height]
+__ZNK7WebCore14CSSCharsetRule4typeEv
+__ZN7WebCore16JSCSSCharsetRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSCSSCharsetRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14CSSCharsetRuleEEE
+__ZN7WebCore16JSCSSCharsetRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14CSSCharsetRuleEEE
+__ZN7WebCore16JSCSSCharsetRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18JSCSSRulePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16JSCSSCharsetRuleD1Ev
+__ZN7WebCore25JSCSSCharsetRulePrototypeD1Ev
+__ZN7WebCore30jsHTMLButtonElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLButtonElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLButtonElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSHTMLButtonElementConstructorD1Ev
+__ZN7WebCore24parseXMLDocumentFragmentERKNS_6StringEPNS_16DocumentFragmentEPNS_7ElementE
+__ZN7WebCore12XMLTokenizerC1EPNS_16DocumentFragmentEPNS_7ElementE
+__ZN7WebCore12XMLTokenizerC2EPNS_16DocumentFragmentEPNS_7ElementE
+__ZN7WebCore12XMLTokenizerD1Ev
+__ZN7WebCore12XMLTokenizerD2Ev
+__ZN7WebCore20createTabSpanElementEPNS_8DocumentERKNS_6StringE
+__ZN7WebCore17RemoveNodeCommand9doUnapplyEv
+__ZN7WebCore23InsertNodeBeforeCommand9doUnapplyEv
+__ZN7WebCore8RenderBR16positionForPointERKNS_8IntPointE
+__ZN7WebCore20nextSentencePositionERKNS_15VisiblePositionE
+__ZN7WebCoreL28nextSentencePositionBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
+__ZN7WebCore21sentenceBreakIteratorEPKti
 __ZN7WebCore24previousSentencePositionERKNS_15VisiblePositionE
-__ZN7WebCore32previousSentencePositionBoundaryEPKtj
+__ZN7WebCoreL32previousSentencePositionBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
+__ZN7WebCoreL46executeMoveToBeginningOfLineAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL40executeMoveToEndOfLineAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL51executeMoveToBeginningOfParagraphAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL45executeMoveToEndOfParagraphAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZNK7WebCore11ShadowValue7cssTextEv
+__ZN3WTF7HashMapIPKN7WebCore14RenderReplacedENS1_7IntRectENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS5_EEE3setERKS4_RKS5_
+__ZN3WTF9HashTableIPKN7WebCore14RenderReplacedESt4pairIS4_NS1_7IntRectEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS4_EENS_14Pair
+__ZNK3WTF7HashMapIPKN7WebCore14RenderReplacedENS1_7IntRectENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS8_IS5_EEE3getERKS4_
+__ZN7WebCore12EventHandler32handleMousePressEventTripleClickERKNS_28MouseEventWithHitTestResultsE
 __ZN7WebCore20endOfEditableContentERKNS_15VisiblePositionE
-__ZN7WebCore39jsDOMSelectionPrototypeFunctionCollapseEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12DOMSelection8collapseEPNS_4NodeEiRi
-__ZN7WebCore29JSDOMCoreExceptionConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore29JSDOMCoreExceptionConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore29JSDOMCoreExceptionConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore43jsDOMSelectionPrototypeFunctionContainsNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore12DOMSelection12containsNodeEPKNS_4NodeEb
-__ZN7WebCore54jsDOMImplementationPrototypeFunctionCreateDocumentTypeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore17DOMImplementation18createDocumentTypeERKNS_6StringES3_S3_Ri
-__ZN7WebCore24qualifiedNameIsMalformedERKNS_6StringE
-__ZN7WebCore12DocumentTypeC1EPNS_17DOMImplementationEPNS_8DocumentERKNS_6StringES7_S7_
-__ZNK7WebCore14JSDocumentType9classInfoEv
+__ZN7WebCore21ContextMenuController16clearContextMenuEv
+__ZN7WebCore12EventHandler20sendContextMenuEventERKNS_18PlatformMouseEventE
+__ZN7WebCore12EventHandler37selectClosestWordOrLinkFromMouseEventERKNS_28MouseEventWithHitTestResultsE
+__ZN7WebCore21ContextMenuController22handleContextMenuEventEPNS_5EventE
+__ZN7WebCore11ContextMenuC1ERKNS_13HitTestResultE
+__ZN7WebCore11ContextMenuC2ERKNS_13HitTestResultE
++[WebCoreMenuTarget sharedMenuTarget]
+__ZNK7WebCore11ContextMenu10controllerEv
+-[WebCoreMenuTarget setMenuController:]
+__ZN7WebCore11ContextMenu8populateEv
+__ZN7WebCore26contextMenuItemTagOpenLinkEv
+__ZN7WebCore15ContextMenuItemC1ENS_19ContextMenuItemTypeENS_17ContextMenuActionERKNS_6StringEPNS_11ContextMenuE
+__ZN7WebCore15ContextMenuItemC2ENS_19ContextMenuItemTypeENS_17ContextMenuActionERKNS_6StringEPNS_11ContextMenuE
+__ZN7WebCore37contextMenuItemTagOpenLinkInNewWindowEv
+__ZN7WebCore36contextMenuItemTagDownloadLinkToDiskEv
+__ZN7WebCore37contextMenuItemTagCopyLinkToClipboardEv
+__ZN7WebCore38contextMenuItemTagOpenImageInNewWindowEv
+__ZN7WebCore37contextMenuItemTagDownloadImageToDiskEv
+__ZN7WebCore38contextMenuItemTagCopyImageToClipboardEv
+__ZN7WebCore35contextMenuItemTagSearchInSpotlightEv
+__ZN7WebCore36contextMenuItemTagLookUpInDictionaryEv
+__ZN7WebCore27contextMenuItemTagSearchWebEv
+__ZN7WebCore22contextMenuItemTagCopyEv
+__ZN7WebCore24contextMenuItemTagGoBackEv
+__ZN7WebCore27contextMenuItemTagGoForwardEv
+__ZN7WebCore22contextMenuItemTagStopEv
+__ZN7WebCore24contextMenuItemTagReloadEv
+__ZN7WebCore38contextMenuItemTagOpenFrameInNewWindowEv
+__ZN7WebCore32contextMenuItemTagNoGuessesFoundEv
+__ZN7WebCore32contextMenuItemTagIgnoreSpellingEv
+__ZN7WebCore31contextMenuItemTagLearnSpellingEv
+__ZN7WebCore31contextMenuItemTagIgnoreGrammarEv
+__ZN7WebCore21contextMenuItemTagCutEv
+__ZN7WebCore23contextMenuItemTagPasteEv
+__ZN7WebCoreL29selectionContainsPossibleWordEPNS_5FrameE
+__ZN7WebCore11ContextMenu10appendItemERNS_15ContextMenuItemE
+__ZNK7WebCore11ContextMenu21checkOrEnableIfNeededERNS_15ContextMenuItemE
+__ZNK7WebCore15ContextMenuItem4typeEv
+__ZNK7WebCore15ContextMenuItem6actionEv
+__ZN7WebCore15ContextMenuItem10setCheckedEb
+__ZN7WebCore15ContextMenuItem10setEnabledEb
+__ZN7WebCore15ContextMenuItem26releasePlatformDescriptionEv
+__ZN7WebCoreL17setMenuItemTargetEP10NSMenuItem
+__ZN7WebCoreL13separatorItemEv
+__ZN7WebCore15ContextMenuItemD1Ev
+__ZN7WebCore15ContextMenuItemD2Ev
+__ZNK7WebCore11ContextMenu19platformDescriptionEv
+__ZN7WebCore11ContextMenu22setPlatformDescriptionEP14NSMutableArray
+__ZSt5mergeIPN7WebCore20CSSGradientColorStopES2_S2_PFbRKS1_S4_EET1_T_S8_T0_S9_S7_T2_
+__ZN7WebCore5Image21mayFillWithSolidColorEv
+__ZNK7WebCore14GeneratedImage4sizeEv
+__ZNK7WebCore14GeneratedImage16hasRelativeWidthEv
+__ZNK7WebCore14GeneratedImage17hasRelativeHeightEv
+__ZN7WebCoreL36executeMoveForwardAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore26jsDOMSelectionExtentOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection12extentOffsetEv
+__ZNK7WebCore12DOMSelection16visibleSelectionEv
+__ZN7WebCoreL14extentPositionERKNS_16VisibleSelectionE
+__ZN7WebCore24jsDOMSelectionBaseOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore12DOMSelection10baseOffsetEv
-__ZN7WebCore36jsDOMSelectionPrototypeFunctionEmptyEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12DOMSelection5emptyEv
-__ZN7WebCore37jsDOMSelectionPrototypeFunctionExtendEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12DOMSelection6extendEPNS_4NodeEiRi
-__ZN7WebCore19SelectionController22expandUsingGranularityENS_15TextGranularityE
-__ZN7WebCore48jsDOMSelectionPrototypeFunctionSelectAllChildrenEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12DOMSelection17selectAllChildrenEPNS_4NodeERi
+__ZN7WebCoreL12basePositionERKNS_16VisibleSelectionE
+__ZN7WebCoreL37executeMoveBackwardAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore18jsDOMSelectionTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection4typeEv
+__ZN3JSC16RuntimeObjectImp3putEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueERNS_15PutPropertySlotE
+__ZN3JSC8Bindings9ObjcFieldC1EP9objc_ivar
+__ZN3JSC8Bindings9ObjcFieldC2EP9objc_ivar
+__ZNK3JSC8Bindings9ObjcField18setValueToInstanceEPNS_9ExecStateEPKNS0_8InstanceENS_7JSValueE
+__ZN7WebCore13endOfSentenceERKNS_15VisiblePositionE
+__ZN7WebCoreL19endSentenceBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
+__ZN7WebCore15startOfSentenceERKNS_15VisiblePositionE
+__ZN7WebCoreL21startSentenceBoundaryEPKtjjNS_33BoundarySearchContextAvailabilityERb
+__ZN7WebCore24jsDOMSelectionExtentNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection10extentNodeEv
+__ZN7WebCore11ContextMenuD1Ev
+__ZN7WebCore11ContextMenuD2Ev
+__ZN7WebCore6Editor44guessesForMisspelledOrUngrammaticalSelectionERbS1_
+__ZNK7WebCore13HitTestResult14replacedStringEv
+__ZN7WebCore30contextMenuItemTagSpellingMenuEv
+__ZN7WebCore35contextMenuItemTagShowSpellingPanelEb
+__ZN7WebCore31contextMenuItemTagCheckSpellingEv
+__ZN7WebCore42contextMenuItemTagCheckSpellingWhileTypingEv
+__ZN7WebCore42contextMenuItemTagCheckGrammarWithSpellingEv
+__ZN7WebCore46contextMenuItemTagCorrectSpellingAutomaticallyEv
+__ZN7WebCore6Editor22spellingPanelIsShowingEv
+__ZN7WebCore15ContextMenuItem8setTitleERKNS_6StringE
+__ZN7WebCore15ContextMenuItem10setSubMenuEPNS_11ContextMenuE
+__ZN7WebCore35contextMenuItemTagSubstitutionsMenuEv
+__ZN7WebCore35contextMenuItemTagShowSubstitutionsEb
+__ZN7WebCore32contextMenuItemTagSmartCopyPasteEv
+__ZN7WebCore29contextMenuItemTagSmartQuotesEv
+__ZN7WebCore29contextMenuItemTagSmartDashesEv
+__ZN7WebCore28contextMenuItemTagSmartLinksEv
+__ZN7WebCore33contextMenuItemTagTextReplacementEv
+__ZN7WebCore6Editor27substitutionsPanelIsShowingEv
+__ZN7WebCore37contextMenuItemTagTransformationsMenuEv
+__ZN7WebCore31contextMenuItemTagMakeUpperCaseEv
+__ZN7WebCore31contextMenuItemTagMakeLowerCaseEv
+__ZN7WebCore28contextMenuItemTagCapitalizeEv
+__ZN7WebCore26contextMenuItemTagFontMenuEv
+__ZN7WebCore27contextMenuItemTagShowFontsEv
+__ZN7WebCore22contextMenuItemTagBoldEv
+__ZN7WebCore24contextMenuItemTagItalicEv
+__ZN7WebCore27contextMenuItemTagUnderlineEv
+__ZN7WebCore25contextMenuItemTagOutlineEv
+__ZN7WebCore24contextMenuItemTagStylesEv
+__ZN7WebCore28contextMenuItemTagShowColorsEv
+__ZN7WebCore8Document25createCSSStyleDeclarationEv
+__ZN7WebCore28contextMenuItemTagSpeechMenuEv
+__ZN7WebCore31contextMenuItemTagStartSpeakingEv
+__ZN7WebCore30contextMenuItemTagStopSpeakingEv
+__ZN7WebCore38contextMenuItemTagWritingDirectionMenuEv
+__ZN7WebCore34contextMenuItemTagDefaultDirectionEv
+__ZN7WebCore29contextMenuItemTagLeftToRightEv
+__ZN7WebCore29contextMenuItemTagRightToLeftEv
+__ZNK7WebCore6Editor16hasBidiSelectionEv
+__ZNK7WebCore11FrameLoader18canGoBackOrForwardEi
+__ZN7WebCore22jsDOMSelectionBaseNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection8baseNodeEv
+__ZN7WebCore19SelectionController16modifyMovingLeftENS_15TextGranularityE
+__ZNK7WebCore15VisiblePosition4leftEb
+__ZNK7WebCore15VisiblePosition29leftVisuallyDistinctCandidateEv
+__ZN7WebCore24jsDOMSelectionAnchorNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection10anchorNodeEv
+__ZN7WebCoreL14anchorPositionERKNS_16VisibleSelectionE
+__ZN7WebCore26jsDOMSelectionAnchorOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore12DOMSelection12anchorOffsetEv
+__ZN7WebCore19SelectionController17modifyMovingRightENS_15TextGranularityE
+__ZNK7WebCore15VisiblePosition5rightEb
+__ZNK7WebCore15VisiblePosition30rightVisuallyDistinctCandidateEv
+__ZNK7WebCore5Range21compareBoundaryPointsENS0_10CompareHowEPKS0_Ri
+__ZN7WebCore23jsDOMSelectionFocusNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore12DOMSelection9focusNodeEv
+__ZN7WebCoreL13focusPositionERKNS_16VisibleSelectionE
+__ZN7WebCore25jsDOMSelectionFocusOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore12DOMSelection11focusOffsetEv
-__ZNK7WebCore12DOMSelection10extentNodeEv
-__ZNK7WebCore12DOMSelection12extentOffsetEv
-__ZNK7WebCore5Range21compareBoundaryPointsENS0_10CompareHowEPKS0_Ri
-__ZNK7WebCore12DOMSelection4typeEv
-__ZN7WebCore20nextSentencePositionERKNS_15VisiblePositionE
-__ZN7WebCore28nextSentencePositionBoundaryEPKtj
+__ZN7WebCore36jsDOMSelectionPrototypeFunctionEmptyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection5emptyEv
 __ZNK7WebCore20HTMLFrameElementBase11isFocusableEv
 __ZN7WebCore20HTMLFrameElementBase8setFocusEb
-__ZN7WebCore17ApplyStyleCommand35extractAndNegateTextDecorationStyleEPNS_4NodeE
-__ZN7WebCore20executeFontSizeDeltaEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore24jsDOMSelectionRangeCountEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection10rangeCountEv
+__ZN7WebCore41jsDOMSelectionPrototypeFunctionGetRangeAtEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection10getRangeAtEiRi
+__ZNK7WebCore16VisibleSelection10firstRangeEv
+__ZN7WebCore21jsRangeStartContainerEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsRangeEndContainerEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsRangeStartOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsRangeEndOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17setJSDOMWindowTopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore12RenderObject22positionForCoordinatesEii
+__ZN7WebCore25jsDOMSelectionIsCollapsedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12DOMSelection11isCollapsedEv
+__ZN7WebCore43jsDOMSelectionPrototypeFunctionContainsNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore12DOMSelection12containsNodeEPKNS_4NodeEb
+__ZN7WebCore49jsDOMSelectionPrototypeFunctionDeleteFromDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection18deleteFromDocumentEv
+__ZN7WebCore5Range14deleteContentsERi
+__ZN7WebCore33setJSHTMLFormElementAcceptCharsetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLFormElement16setAcceptCharsetERKNS_6StringE
+__ZN7WebCore25setJSHTMLInputElementSizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement7setSizeEj
+__ZN7WebCore16VisibleSelection24appendTrailingWhitespaceEv
+__ZN7WebCore32jsRangePrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore5Range8toStringERi
+__ZN7WebCore19SelectionController20modifyExtendingRightENS_15TextGranularityE
+__ZN7WebCore19SelectionController25directionOfEnclosingBlockEv
+__ZN7WebCore26jsDOMWindowTextConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSTextConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19SelectionController19modifyExtendingLeftENS_15TextGranularityE
+__ZSt9__reverseIPPN7WebCore9InlineBoxEEvT_S4_St26random_access_iterator_tag
+__ZN7WebCore37jsDOMSelectionPrototypeFunctionExtendEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection6extendEPNS_4NodeEiRi
+__ZN7WebCore19SelectionController22expandUsingGranularityENS_15TextGranularityE
+__ZN7WebCore39jsDOMSelectionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection8toStringEv
+__ZN7WebCore5Range13setStartAfterEPNS_4NodeERi
+__ZNK7WebCore11RenderTheme32inactiveSelectionForegroundColorEv
+__ZN7WebCore12RenderWidget17setSelectionStateENS_12RenderObject14SelectionStateE
+__ZN3WTF6VectorItLm32EE14expandCapacityEmPKt
+__ZN3WTF6VectorItLm32EE14expandCapacityEm
+__ZN3WTF6VectorItLm32EE15reserveCapacityEm
+__ZN7WebCoreL15executeMoveLeftEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL27executeMoveToRightEndOfLineEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL26executeMoveToLeftEndOfLineEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL45executeMoveToRightEndOfLineAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL16executeMoveRightEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL44executeMoveToLeftEndOfLineAndModifySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN3JSC8Bindings9ObjcArrayC1EP11objc_objectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC8Bindings9ObjcArrayC2EP11objc_objectN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC8Bindings5ArrayC2EN3WTF10PassRefPtrINS0_10RootObjectEEE
+__ZN3JSC12RuntimeArrayC1EPNS_9ExecStateEPNS_8Bindings5ArrayE
+__ZN3JSC12RuntimeArrayC2EPNS_9ExecStateEPNS_8Bindings5ArrayE
+__ZN3JSC12RuntimeArray18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
+__ZNK3JSC8Bindings9ObjcArray9getLengthEv
+__ZN3JSC12RuntimeArray11indexGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZNK3JSC8Bindings9ObjcArray7valueAtEPNS_9ExecStateEj
+__ZNK7WebCore5Frame17firstRectForRangeEPNS_5RangeE
+__ZN3JSC12RuntimeArrayD1Ev
+__ZN3JSC8Bindings9ObjcArrayD0Ev
+__ZN3JSC8Bindings5ArrayD2Ev
+__ZN7WebCore29setJSHTMLInputElementReadOnlyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore22HTMLFormControlElement11setReadOnlyEb
+__ZN7WebCoreL17executeSelectLineEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL28expandSelectionToGranularityEPNS_5FrameENS_15TextGranularityE
+__ZN7WebCore34jsRangePrototypeFunctionSelectNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore39jsDOMSelectionPrototypeFunctionCollapseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12DOMSelection8collapseEPNS_4NodeEiRi
+__ZN7WebCore34jsDOMWindowDOMExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSDOMCoreException14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore29JSDOMCoreExceptionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore27JSDOMCoreExceptionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSDOMCoreExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore32jsDOMCoreExceptionINDEX_SIZE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSDOMCoreExceptionConstructorD1Ev
+__ZN7WebCore26setJSHTMLButtonElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore31setJSHTMLTableCellElementNoWrapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement9setNoWrapEb
+__ZN7WebCore17HTMLSelectElement5resetEv
+__ZN7WebCoreL30newStreamingTextDecoderUTF16LEERKNS_12TextEncodingEPKv
+__ZN7WebCore13RootInlineBox15clearTruncationEv
+__ZN7WebCore13InlineFlowBox15clearTruncationEv
+__ZN7WebCore13InlineTextBox15clearTruncationEv
+__ZNK3WTF7HashMapIPKN7WebCore13RootInlineBoxEPNS1_11EllipsisBoxENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getERKS4_
+__ZN7WebCore11EllipsisBox5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCoreL18executeJustifyLeftEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCoreL15executeFontSizeEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore13RootInlineBox20addHighlightOverflowEv
+__ZN7WebCore13InlineTextBox20paintCustomHighlightEiiRKNS_12AtomicStringE
+__ZN7WebCore13RootInlineBox20paintCustomHighlightERNS_12RenderObject9PaintInfoEiiRKNS_12AtomicStringE
+__ZNK7WebCore9FloatRect10intersectsERKS0_
+__ZN7WebCore42jsCSSStyleSheetPrototypeFunctionDeleteRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13CSSStyleSheet10deleteRuleEjRi
+__ZN7WebCore9StyleList6removeEj
+__ZN7WebCoreL20executeFontSizeDeltaEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
 __ZN7WebCore17ApplyStyleCommand18joinChildTextNodesEPNS_4NodeERKNS_8PositionES5_
 __ZN7WebCore17ApplyStyleCommand24splitTextAtStartIfNeededERKNS_8PositionES3_
 __ZN7WebCore17ApplyStyleCommand22splitTextAtEndIfNeededERKNS_8PositionES3_
 __ZN7WebCore17ApplyStyleCommand16computedFontSizeEPKNS_4NodeE
 __ZN3WTF7HashMapIPN7WebCore4NodeEfNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IfEEE3setERKS3_RKf
-__ZN3WTF9HashTableIiSt4pairIifENS_18PairFirstExtractorIS2_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENS8_IfEEEES9_E3addIPN7WebCore4NodeEfNS_17HashMapTranslatorILb1ES1_ISG_fENS_18PairBaseHashTraitsINS8_ISG_EESA_EESB_NS_7PtrHashISG_EEEEEES1_INS_17HashTableIteratorIiS2_S4_S6_SB_S9_EEbERKT_RKT0_
-__ZN3WTF9HashTableIiSt4pairIifENS_18PairFirstExtractorIS2_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENS8_IfEEEES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore4NodeESt4pairIS3_fENS_18PairFirstExtractorIS5_EENS_7PtrHashIS3_EENS_14PairHashTraitsINS_10HashTrai
 __ZNK3WTF7HashMapIPN7WebCore4NodeEfNS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS6_IfEEE3getERKS3_
-__ZN7WebCore42jsCSSStyleSheetPrototypeFunctionDeleteRuleEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore13CSSStyleSheet10deleteRuleEjRi
-__ZN7WebCore9StyleList6removeEj
-__ZN7WebCore13RootInlineBox20addHighlightOverflowEv
-__ZN7WebCore5Frame23customHighlightLineRectERKNS_12AtomicStringERKNS_9FloatRectEPNS_4NodeE
-__ZN7WebCore13InlineTextBox20paintCustomHighlightEiiRKNS_12AtomicStringE
-__ZN7WebCore5Frame20paintCustomHighlightERKNS_12AtomicStringERKNS_9FloatRectES6_bbPNS_4NodeE
-__ZN7WebCore13RootInlineBox20paintCustomHighlightERNS_12RenderObject9PaintInfoEiiRKNS_12AtomicStringE
-__ZNK7WebCore9FloatRect10intersectsERKS0_
-__ZN7WebCore42jsHTMLTextAreaElementPrototypeFunctionBlurEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4Node16shadowParentNodeEv
-__ZNK7WebCore5XPath5Union8evaluateEv
-__ZN7WebCore5XPath5Value17modifiableNodeSetEv
-__ZN7WebCore5XPath5UnionD1Ev
-__ZN7WebCore5XPath13isRootDomNodeEPNS_4NodeE
-__ZN3WTF15deleteAllValuesIPN7WebCore5XPath9ParseNodeEKNS_9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEESB_EEEEvRT0_
-__ZN3WTF15deleteAllValuesIPN7WebCore6StringEKNS_9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEESA_EEEEvRT0_
-__ZN3WTF15deleteAllValuesIPN7WebCore5XPath4Step8NodeTestEKNS_9HashTableIiiNS_17IdentityExtractorIiEENS_7IntHashIiEENS_10HashTraitsIiEESC_EEEEvRT0_
-__ZN7WebCore5XPath6Parser16registerNodeTestEPNS0_4Step8NodeTestE
-__ZN3WTF7HashSetIPN7WebCore5XPath4Step8NodeTestENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEE3addERKS5_
-__ZN7WebCore5XPath6Parser14deleteNodeTestEPNS0_4Step8NodeTestE
-__ZN7WebCore11SVGGElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore11SVGGElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore10SVGElement21finishParsingChildrenEv
-__ZN7WebCore10SVGElement26sendSVGLoadEventIfPossibleEb
-__ZN7WebCore10SVGElement27haveLoadedRequiredResourcesEv
-__ZN7WebCore21SVGDocumentExtensions15startAnimationsEv
-__ZN7WebCore43jsDocumentPrototypeFunctionCreateExpressionEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document16createExpressionERKNS_6StringEPNS_15XPathNSResolverERi
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_15XPathExpressionE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_14XPathExceptionE
-__ZN7WebCore16JSXPathExceptionC1EPN3KJS8JSObjectEPNS_14XPathExceptionE
-__ZN7WebCore16JSXPathException18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSXPathExceptionPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore41jsXPathExceptionPrototypeFunctionToStringEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore16JSXPathException9classInfoEv
-__ZN7WebCore5XPath11createFunIdEv
-__ZNK7WebCore5XPath5FunId8evaluateEv
-__ZN7WebCore5XPath5FunIdD1Ev
-__ZN7WebCore5XPath4PathC1EPNS0_6FilterEPNS0_12LocationPathE
-__ZNK7WebCore5XPath4Path8evaluateEv
-__ZN7WebCore5XPath6FilterC1EPNS0_10ExpressionERKN3WTF6VectorIPNS0_9PredicateELm0EEE
-__ZNK7WebCore5XPath6Filter8evaluateEv
-__ZN7WebCore5XPath6FilterD1Ev
-__ZN7WebCore5XPath23createFunSubstringAfterEv
-__ZNK7WebCore5XPath17FunSubstringAfter8evaluateEv
-__ZN7WebCore5XPath17FunSubstringAfterD1Ev
-__ZNK7WebCore11XPathResult11stringValueERi
-__ZN7WebCore5XPath6Parser19makeTokenAndAdvanceEiNS0_9NumericOp6OpcodeEi
-__ZN7WebCore5XPath13createFunLastEv
-__ZNK7WebCore5XPath7FunLast8evaluateEv
-__ZN7WebCore5XPath7FunLastD1Ev
-__ZN7WebCore5XPath13createFunNameEv
-__ZNK7WebCore5XPath7FunName8evaluateEv
-__ZN7WebCore5XPath7FunNameD1Ev
-__ZN7WebCore5XPath15createFunStringEv
-__ZNK7WebCore5XPath9FunString8evaluateEv
-__ZN7WebCore5XPath9FunStringD1Ev
-__ZN7WebCore5XPath24createFunSubstringBeforeEv
-__ZNK7WebCore5XPath18FunSubstringBefore8evaluateEv
-__ZN7WebCore5XPath18FunSubstringBeforeD1Ev
-__ZN7WebCore5XPath23createFunNormalizeSpaceEv
-__ZN7WebCore5XPath18createFunTranslateEv
-__ZNK7WebCore5XPath12FunTranslate8evaluateEv
-__ZNK7WebCore5XPath17FunNormalizeSpace8evaluateEv
-__ZN7WebCore5XPath12FunTranslateD1Ev
-__ZN7WebCore5XPath17FunNormalizeSpaceD1Ev
-__ZN7WebCore5XPath16createFunBooleanEv
-__ZN7WebCore5XPath14createFunFalseEv
-__ZNK7WebCore5XPath10FunBoolean8evaluateEv
-__ZNK7WebCore5XPath8FunFalse8evaluateEv
-__ZN7WebCore5XPath10FunBooleanD1Ev
-__ZN7WebCore5XPath8FunFalseD1Ev
-__ZN7WebCore5XPath13createFunTrueEv
-__ZNK7WebCore5XPath7FunTrue8evaluateEv
-__ZN7WebCore5XPath7FunTrueD1Ev
-__ZN7WebCore5XPath13createFunLangEv
-__ZNK7WebCore5XPath7FunLang8evaluateEv
-__ZNK7WebCore12NamedAttrMap14getNamedItemNSERKNS_6StringES3_
-__ZN7WebCore5XPath7FunLangD1Ev
-__ZN7WebCore5XPath15createFunNumberEv
-__ZNK7WebCore5XPath9FunNumber8evaluateEv
-__ZN7WebCore5XPath9FunNumberD1Ev
-__ZN7WebCore5XPath12createFunSumEv
-__ZNK7WebCore5XPath6FunSum8evaluateEv
-__ZN7WebCore5XPath6FunSumD1Ev
-__ZN7WebCore5XPath14createFunFloorEv
-__ZNK7WebCore5XPath8FunFloor8evaluateEv
-__ZN7WebCore5XPath8FunFloorD1Ev
-__ZN7WebCore5XPath16createFunCeilingEv
-__ZNK7WebCore5XPath10FunCeiling8evaluateEv
-__ZN7WebCore5XPath10FunCeilingD1Ev
-__ZN7WebCore5XPath14createFunRoundEv
-__ZNK7WebCore5XPath8FunRound8evaluateEv
-__ZN7WebCore5XPath8FunRoundD1Ev
-__ZNK7WebCore27JSXPathEvaluatorConstructor19implementsConstructEv
-__ZN7WebCore27JSXPathEvaluatorConstructor9constructEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_14XPathEvaluatorE
-__ZN7WebCore16JSXPathEvaluatorC1EPN3KJS8JSObjectEPNS_14XPathEvaluatorE
-__ZN7WebCore16JSXPathEvaluator18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSXPathEvaluatorPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore41jsXPathEvaluatorPrototypeFunctionEvaluateEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore16JSXPathEvaluator9classInfoEv
-__ZN7WebCore26JSXPathExpressionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSXPathExpressionC1EPN3KJS8JSObjectEPNS_15XPathExpressionE
-__ZN7WebCore26JSXPathExpressionPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore42jsXPathExpressionPrototypeFunctionEvaluateEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore17JSXPathExpression9classInfoEv
-__ZNK7WebCore11XPathResult11numberValueERi
-__ZNK7WebCore23JSProcessingInstruction9classInfoEv
-__ZNK7WebCore21ProcessingInstruction9nodeValueEv
-__ZNK7WebCore14JSCDATASection9classInfoEv
-__ZN7WebCore40jsElementPrototypeFunctionSetAttributeNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9JSElement14setAttributeNSEPN3KJS9ExecStateERKNS1_4ListE
-__ZNK7WebCore11XPathResult15singleNodeValueERi
-__ZNK7WebCore5XPath7NodeSet7anyNodeEv
-__ZN7WebCore43jsDocumentPrototypeFunctionCreateNSResolverEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document16createNSResolverEPNS_4NodeE
-__ZN7WebCore14XPathEvaluator16createNSResolverEPNS_4NodeE
-__ZN7WebCore21NativeXPathNSResolverC1EN3WTF10PassRefPtrINS_4NodeEEE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_15XPathNSResolverE
-__ZN7WebCore26JSXPathNSResolverPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSXPathNSResolverC1EPN3KJS8JSObjectEPNS_15XPathNSResolverE
-__ZNK7WebCore17JSXPathNSResolver9classInfoEv
-__ZN7WebCore21NativeXPathNSResolver18lookupNamespaceURIERKNS_6StringE
-__ZNK7WebCore4Node18lookupNamespaceURIERKNS_6StringE
-__ZN7WebCore14warningHandlerEPvPKcz
-__ZN7WebCore17JSXPathExpressionD0Ev
-__ZN7WebCore17JSXPathNSResolverD0Ev
-__ZN7WebCore21NativeXPathNSResolverD1Ev
-__ZN3KJS51jsXSLTProcessorPrototypeFunctionTransformToDocumentEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore13XSLTProcessor19transformToDocumentEPNS_4NodeE
-__Z17initxsltGetNsPropP8_xmlNodePKhS2_
-__ZN7WebCore16DeprecatedString8fromUtf8EPKc
-__ZN7WebCore13XSLStyleSheet14loadChildSheetERKNS_16DeprecatedStringE
-__ZN7WebCore13XSLImportRuleC1EPNS_9StyleBaseERKNS_6StringE
-__ZN7WebCore13XSLImportRule9loadSheetEv
-__ZNK7WebCore13XSLStyleSheet15isXSLStyleSheetEv
-__ZNK7WebCore13XSLImportRule16parentStyleSheetEv
-__ZN7WebCore9DocLoader20requestXSLStyleSheetERKNS_6StringE
-__ZN7WebCore19CachedXSLStyleSheetC1EPNS_9DocLoaderERKNS_6StringE
-__ZN7WebCore19CachedXSLStyleSheet5errorEv
-__ZN7WebCore19CachedXSLStyleSheet11checkNotifyEv
-__ZN7WebCore19CachedXSLStyleSheet3refEPNS_20CachedResourceClientE
-__ZN7WebCore13docLoaderFuncEPKhP8_xmlDictiPv12xsltLoadType
-__ZN7WebCore13XSLStyleSheet27locateStylesheetSubResourceEP7_xmlDocPKh
-__ZThn4_N7WebCore13XSLImportRule12isImportRuleEv
-__ZN7WebCore13XSLImportRule12isImportRuleEv
-__ZN7WebCore50jsDOMImplementationPrototypeFunctionCreateDocumentEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore14toDocumentTypeEPN3KJS7JSValueE
-__ZN7WebCore17DOMImplementation14createDocumentERKNS_6StringES3_PNS_12DocumentTypeERi
-__ZNK7WebCore21ProcessingInstruction8toStringEv
-__ZN7WebCore13XSLTProcessor24createDocumentFromSourceERKNS_6StringES3_S3_PNS_4NodeEPNS_5FrameE
-__ZN3KJS44jsXSLTProcessorPrototypeFunctionGetParameterEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZNK7WebCore13XSLTProcessor12getParameterERKNS_6StringES3_
-__ZN3KJS47jsXSLTProcessorPrototypeFunctionRemoveParameterEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore13XSLTProcessor15removeParameterERKNS_6StringES3_
-__ZN3KJS47jsXSLTProcessorPrototypeFunctionClearParametersEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore7Element5styleEv
-__ZN7WebCore8Document18setTransformSourceEPv
-__ZN7WebCore19CachedXSLStyleSheet4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
-__ZThn52_N7WebCore21ProcessingInstruction16setXSLStyleSheetERKNS_6StringES3_
-__ZN7WebCore21ProcessingInstruction16setXSLStyleSheetERKNS_6StringES3_
-__ZN7WebCore13XSLStyleSheet11checkLoadedEv
-__ZN7WebCore13XSLStyleSheet9isLoadingEv
-__ZN7WebCore8Document17applyXSLTransformEPNS_21ProcessingInstructionE
-__ZN7WebCore9matchFuncEPKc
-__ZN7WebCore8openFuncEPKc
-__ZN7WebCore8readFuncEPvPci
-__ZN7WebCore9closeFuncEPv
-__ZN7WebCore9errorFuncEPvPKcz
-__ZN7WebCore13XSLTProcessor14parseErrorFuncEPvP9_xmlError
-__Z24initxsltLoadStylesheetPIP7_xmlDoc
-__Z18initxsltNextImportP15_xsltStylesheet
-__ZN7WebCore20exsltNodeSetFunctionEP22_xmlXPathParserContexti
-__Z23initxsltFunctionNodeSetP22_xmlXPathParserContexti
-__ZN7WebCore13XSLImportRule9isLoadingEv
-__ZN7WebCore23xsltUnicodeSortFunctionEP21_xsltTransformContextPP8_xmlNodei
-__Z25initxsltComputeSortResultP21_xsltTransformContextP8_xmlNode
-__ZN7WebCore13XSLImportRule16setXSLStyleSheetERKNS_6StringES3_
-__ZN7WebCore13XSLStyleSheetC1EPNS_13XSLImportRuleERKNS_6StringE
-__ZN7WebCore13XSLStyleSheet15markAsProcessedEv
-__ZN7WebCore17raiseDOMExceptionEi
-__ZN7WebCore16videoConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLVideoElementC1EPNS_8DocumentE
-__ZN7WebCore16HTMLMediaElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore16HTMLVideoElement11tagPriorityEv
-__ZN7WebCore16HTMLMediaElement20insertedIntoDocumentEv
-__ZNK7WebCore16HTMLMediaElement3srcEv
-__ZN7WebCore16HTMLVideoElement6attachEv
-__ZN7WebCore16HTMLMediaElement6attachEv
-__ZN7WebCore16HTMLVideoElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore16HTMLVideoElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore11RenderVideoC1EPNS_16HTMLMediaElementE
-__ZN7WebCore11RenderMediaC2EPNS_16HTMLMediaElementERKNS_7IntSizeE
-__ZNK7WebCore11RenderMedia10firstChildEv
-__ZN7WebCore11RenderVideo17updateFromElementEv
-__ZN7WebCore11RenderMedia17updateFromElementEv
-__ZN7WebCore11RenderMedia14updateControlsEv
-__ZNK7WebCore11RenderMedia12mediaElementEv
-__ZNK7WebCore16HTMLMediaElement8controlsEv
-__ZN7WebCore11RenderVideo12updatePlayerEv
-__ZNK7WebCore11RenderMedia6playerEv
-__ZN7WebCore18createVideoWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLVideoElementC1EPN3KJS8JSObjectEPNS_16HTMLVideoElementE
-__ZN7WebCore18JSHTMLMediaElementC2EPN3KJS8JSObjectEPNS_16HTMLMediaElementE
-__ZN7WebCore18JSHTMLVideoElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18JSHTMLMediaElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSHTMLMediaElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSHTMLVideoElement9classInfoEv
-__ZN7WebCore18JSHTMLVideoElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore18JSHTMLMediaElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore18JSHTMLMediaElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore16HTMLMediaElement6setSrcERKNS_6StringE
-__ZN7WebCore16HTMLMediaElement16attributeChangedEPNS_9AttributeEb
-__ZN7WebCore16HTMLVideoElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore16HTMLMediaElement12scheduleLoadEv
-__ZN7WebCore11RenderVideo6layoutEv
-__ZN7WebCore11RenderMedia6layoutEv
-__ZNK7WebCore11RenderVideo17calcReplacedWidthEv
-__ZNK7WebCore11RenderVideo16isWidthSpecifiedEv
-__ZNK7WebCore11RenderVideo20calcAspectRatioWidthEv
-__ZN7WebCore11RenderVideo14calcPrefWidthsEv
-__ZNK7WebCore11RenderVideo18calcReplacedHeightEv
-__ZNK7WebCore11RenderVideo17isHeightSpecifiedEv
-__ZNK7WebCore11RenderVideo21calcAspectRatioHeightEv
-__ZN7WebCore11RenderVideo13paintReplacedERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore5TimerINS_16HTMLMediaElementEE5firedEv
-__ZN7WebCore16HTMLMediaElement14loadTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore16HTMLMediaElement4loadERi
-__ZNK7WebCore16HTMLMediaElement19defaultPlaybackRateEv
-__ZN7WebCore16HTMLMediaElement15setPlaybackRateEfRi
-__ZNK7WebCore16HTMLMediaElement12networkStateEv
-__ZN7WebCore16HTMLMediaElement9pickMediaEv
-__ZN7WebCore15EventTargetNode21dispatchProgressEventERKNS_12AtomicStringEbjj
-__ZN7WebCore13ProgressEventC1ERKNS_12AtomicStringEbjj
-__ZN7WebCore16HTMLMediaElement19defaultEventHandlerEPNS_5EventE
-__ZNK7WebCore11RenderMedia7isMediaEv
-__ZN7WebCore11RenderMedia12forwardEventEPNS_5EventE
-__ZN7WebCore13ProgressEventD1Ev
-__ZN7WebCore11MediaPlayerC1EPNS_17MediaPlayerClientE
-__ZN7WebCore18MediaPlayerPrivateC1EPNS_11MediaPlayerE
--[WebCoreMovieObserver initWithCallback:]
-__ZN7WebCore16HTMLMediaElement12updateVolumeEv
-__ZN7WebCore11MediaPlayer9setVolumeEf
-__ZNK7WebCore11RenderVideo8videoBoxEv
-__ZN7WebCore11MediaPlayer7setRectERKNS_7IntRectE
-__ZN7WebCore18MediaPlayerPrivate7setRectERKNS_7IntRectE
-__ZN7WebCore11MediaPlayer10setVisibleEb
-__ZN7WebCore18MediaPlayerPrivate10setVisibleEb
-__ZN7WebCore18MediaPlayerPrivate17createQTMovieViewEv
-__ZN7WebCore18MediaPlayerPrivate17detachQTMovieViewEv
-__ZN7WebCore11MediaPlayer4loadENS_6StringE
-__ZN7WebCore18MediaPlayerPrivate4loadERKNS_6StringE
-__ZN7WebCore11MediaPlayer19networkStateChangedEv
-__ZThn68_N7WebCore16HTMLMediaElement30mediaPlayerNetworkStateChangedEPNS_11MediaPlayerE
-__ZN7WebCore16HTMLMediaElement30mediaPlayerNetworkStateChangedEPNS_11MediaPlayerE
-__ZN7WebCore11MediaPlayer12networkStateEv
-__ZN7WebCore18MediaPlayerPrivate10cancelSeekEv
--[WebCoreMovieObserver setDelayCallbacks:]
-__ZN7WebCore18MediaPlayerPrivate13createQTMovieERKNS_6StringE
-__Z40initQTSecurityPolicyNoCrossSiteAttributev
-__Z12QTKitLibraryv
-__Z43initQTMoviePreventExternalURLLinksAttributev
-__Z23initQTMovieURLAttributev
-__Z11initQTMoviev
-__ZNK7WebCore11MediaPlayer7visibleEv
--[WebCoreMovieObserver loadStateChanged:]
-__ZN7WebCore39jsHTMLMediaElementPrototypeFunctionPlayEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16HTMLMediaElement4playERi
-__Z44QTSecurityPolicyNoCrossSiteAttributeFunctionv
-__Z47QTMoviePreventExternalURLLinksAttributeFunctionv
-__Z27QTMovieURLAttributeFunctionv
-__Z15QTMovieFunctionv
-__ZNK7WebCore11MediaPlayer6volumeEv
-__Z41initQTMovieLoadStateDidChangeNotificationv
-__Z36initQTMovieRateDidChangeNotificationv
-__Z36initQTMovieSizeDidChangeNotificationv
-__Z36initQTMovieTimeDidChangeNotificationv
-__Z29initQTMovieDidEndNotificationv
-__Z15initQTMovieViewv
--[WebCoreMovieObserver sizeChanged:]
-__ZNK7WebCore16HTMLMediaElement13endedPlaybackEv
-__ZNK7WebCore11MediaPlayer4rateEv
-__ZN7WebCore16HTMLMediaElement18dispatchEventAsyncERKNS_12AtomicStringE
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm0EE15reserveCapacityEm
-__ZN7WebCore16HTMLMediaElement15updatePlayStateEv
-__ZNK7WebCore16HTMLMediaElement11currentLoopEv
-__ZNK7WebCore16HTMLMediaElement9playCountEv
-__ZNK7WebCore16HTMLMediaElement12effectiveEndEv
-__ZNK7WebCore11MediaPlayer8durationEv
-__ZNK7WebCore18MediaPlayerPrivate8durationEv
-__ZNK7WebCore16HTMLMediaElement9loopStartEv
-__ZNK7WebCore16HTMLMediaElement22getTimeOffsetAttributeERKNS_13QualifiedNameEf
-__ZN7WebCore15parseTimeOffsetENS_6StringEPb
-__ZNK7WebCore16HTMLMediaElement5startEv
-__ZNK7WebCore16HTMLMediaElement3endEv
-__ZN7WebCore11MediaPlayer10setEndTimeEf
-__ZN7WebCore18MediaPlayerPrivate10setEndTimeEf
-__ZN7WebCore18MediaPlayerPrivate26startEndPointTimerIfNeededEv
-__ZNK7WebCore16HTMLMediaElement15activelyPlayingEv
-__ZNK7WebCore16HTMLMediaElement6pausedEv
-__ZNK7WebCore16HTMLMediaElement10readyStateEv
-__ZNK7WebCore11MediaPlayer6pausedEv
-__ZNK7WebCore18MediaPlayerPrivate6pausedEv
-__ZN7WebCore18MediaPlayerPrivate16loadStateChangedEv
-__ZN7WebCore18MediaPlayerPrivate12updateStatesEv
-__ZNK7WebCore18MediaPlayerPrivate7seekingEv
-__ZN7WebCore16HTMLMediaElement28initAndDispatchProgressEventERKNS_12AtomicStringE
-__ZN7WebCore11MediaPlayer15totalBytesKnownEv
-__ZNK7WebCore18MediaPlayerPrivate15totalBytesKnownEv
-__ZNK7WebCore18MediaPlayerPrivate10totalBytesEv
-__ZN7WebCore11MediaPlayer11bytesLoadedEv
-__ZNK7WebCore18MediaPlayerPrivate11bytesLoadedEv
-__ZN7WebCore11MediaPlayer10totalBytesEv
-__ZNK7WebCore16HTMLVideoElement7isVideoEv
-__ZN7WebCore16HTMLVideoElement17updatePosterImageEv
-__ZNK7WebCore16HTMLVideoElement6posterEv
-__ZN7WebCore16HTMLMediaElement20asyncEventTimerFiredEPNS_5TimerIS0_EE
-__ZN3WTF6VectorIN7WebCore12AtomicStringELm0EE6shrinkEm
-__ZN7WebCore11MediaPlayer5paintEPNS_15GraphicsContextERKNS_7IntRectE
-__ZN7WebCore18MediaPlayerPrivate5paintEPNS_15GraphicsContextERKNS_7IntRectE
-__Z29initQTMovieLoadStateAttributev
-__Z28initQTMovieDataSizeAttributev
-__Z32QTMovieDataSizeAttributeFunctionv
-__Z33QTMovieLoadStateAttributeFunctionv
-__ZN7WebCore16HTMLVideoElement6detachEv
-__ZN7WebCore11RenderMediaD0Ev
-__ZN7WebCore16HTMLVideoElementD1Ev
-__ZN7WebCore11MediaPlayerD1Ev
-__ZN7WebCore18MediaPlayerPrivateD1Ev
--[WebCoreMovieObserver disconnect]
-__Z45QTMovieLoadStateDidChangeNotificationFunctionv
-__Z40QTMovieRateDidChangeNotificationFunctionv
-__Z40QTMovieSizeDidChangeNotificationFunctionv
-__Z40QTMovieTimeDidChangeNotificationFunctionv
-__Z33QTMovieDidEndNotificationFunctionv
-__Z19QTMovieViewFunctionv
-__ZNK7WebCore11RenderMedia9lastChildEv
-__ZN7WebCore39jsHTMLMediaElementPrototypeFunctionLoadEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16HTMLMediaElement19removedFromDocumentEv
-__ZN7WebCore16HTMLMediaElement5pauseERi
-__ZN7WebCore10HTMLParser23isindexCreateErrorCheckEPNS_5TokenERN3WTF6RefPtrINS_4NodeEEE
-__ZN7WebCore10HTMLParser13handleIsindexEPNS_5TokenE
-__ZN7WebCore18HTMLIsIndexElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore27searchableIndexIntroductionEv
-__ZN7WebCore20JSHTMLIsIndexElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore32jsDOMWindowPrototypeFunctionStopEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9DOMWindow4stopEv
-__ZN7WebCore11FrameLoader25scheduleCheckLoadCompleteEv
-__ZNK7WebCore17HTMLObjectElement24imageSourceAttributeNameEv
-__ZN7WebCore11FrameLoader27checkLoadCompleteTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore8Document10setCharsetERKNS_6StringE
-__ZN7WebCore4KURL14setHostAndPortERKNS_16DeprecatedStringE
-__ZN7WebCore25jsLocationProtoFuncAssignEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore18JSHistoryPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore9JSHistory9classInfoEv
-__ZN3KJS49jsXMLHttpRequestPrototypeFunctionAddEventListenerEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore14XMLHttpRequest16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
-__ZN3WTF9HashTableIiSt4pairIiNS_6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EEEENS_18PairFirstExtractorIS8_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSE_IS7_EEEESF_E4findIiNS_22IdentityHashTranslatorIiS8_SC_EEEENS_17HashTableIteratorIiS8_SA_SC_SH_SF_EERKT_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EE15reserveCapacityEm
-__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplENS_6VectorINS_6RefPtrINS1_13EventListenerEEELm0EEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSB_IS8_EEE3getERKS3_
-__ZN3WTF9HashTableIiSt4pairIiNS_6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EEEENS_18PairFirstExtractorIS8_EENS_7IntHashIiEENS_14PairHashTraitsINS_10HashTraitsIiEENSE_IS7_EEEESF_E3addIPNS4_16AtomicStringImplES7_NS_17HashMapTranslatorILb1ES1_ISL_S7_ENS_18PairBaseHashTraitsINSE_ISL_EESG_EESH_NS_7PtrHashISL_EEEEEES1_INS_17HashTableIteratorIiS8_SA_SC_SH_SF_EEbERKT_RKT0_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EEC1ERKS5_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EEaSERKS5_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EE6shrinkEm
-__ZN7WebCore34newStreamingTextDecoderUserDefinedERKNS_12TextEncodingEPKv
-__ZN7WebCore20TextCodecUserDefined6decodeEPKcmb
-__ZN7WebCore20TextCodecUserDefinedD1Ev
--[WebCoreSynchronousLoader connection:didFailWithError:]
-__ZN7WebCore20ResourceResponseBase17setHTTPStatusCodeEi
-__ZNK7WebCore8Document8toStringEv
-__ZNK7WebCore7Element8toStringEv
-__ZNK7WebCore7Element20openTagStartToStringEv
-__ZNK7WebCore4Text8toStringEv
-__ZN7WebCoreplERKNS_16DeprecatedStringEc
-__ZN3KJS46jsXMLHttpRequestPrototypeFunctionDispatchEventEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN3KJS52jsXMLHttpRequestPrototypeFunctionRemoveEventListenerEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore14XMLHttpRequest19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
-__ZN7WebCore17circleConstructorEPNS_8DocumentEb
-__ZN7WebCore16SVGCircleElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore16SVGCircleElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore16SVGCircleElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore16SVGCircleElement14setCxBaseValueENS_9SVGLengthE
-__ZN7WebCore16SVGCircleElement5setCxENS_9SVGLengthE
-__ZN7WebCore16SVGCircleElement14setCyBaseValueENS_9SVGLengthE
-__ZN7WebCore16SVGCircleElement5setCyENS_9SVGLengthE
-__ZN7WebCore16SVGCircleElement13setRBaseValueENS_9SVGLengthE
-__ZN7WebCore16SVGCircleElement4setRENS_9SVGLengthE
-__ZNK7WebCore16SVGCircleElement1rEv
-__ZN7WebCore8Document7scriptsEv
-__ZN7WebCore11RenderMedia24createControlsShadowRootEv
-__ZN7WebCore29MediaControlShadowRootElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
-__ZN7WebCore11RenderMedia11createPanelEv
-__ZN7WebCore11RenderMedia16createMuteButtonEv
-__ZN7WebCore29MediaControlMuteButtonElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
-__ZN7WebCore24MediaControlInputElementC2EPNS_8DocumentENS_11RenderStyle8PseudoIdENS_6StringEPNS_16HTMLMediaElementE
-__ZN7WebCore24MediaControlInputElement14attachToParentEPNS_7ElementE
-__ZN7WebCore11RenderMedia16createPlayButtonEv
-__ZN7WebCore29MediaControlPlayButtonElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
-__ZN7WebCore11RenderMedia14createTimelineEv
-__ZN7WebCore27MediaControlTimelineElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
-__ZN7WebCore11RenderMedia20createSeekBackButtonEv
-__ZN7WebCore29MediaControlSeekButtonElementC1EPNS_8DocumentEPNS_16HTMLMediaElementEb
-__ZN7WebCore11RenderMedia23createSeekForwardButtonEv
-__ZN7WebCore11RenderMedia17createTimeDisplayEv
-__ZN7WebCore11RenderMedia22createFullscreenButtonEv
-__ZN7WebCore35MediaControlFullscreenButtonElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
-__ZN7WebCore24MediaControlInputElement6updateEv
-__ZN7WebCore27MediaControlTimelineElement6updateEb
-__ZNK7WebCore16HTMLMediaElement8durationEv
-__ZNK7WebCore16HTMLMediaElement11currentTimeEv
-__ZNK7WebCore29MediaControlShadowRootElement12isShadowNodeEv
-__ZN7WebCore29MediaControlShadowRootElement16shadowParentNodeEv
-__ZN7WebCore11RenderMedia17updateTimeDisplayEv
-__ZN7WebCore11RenderMedia10formatTimeEf
-__ZN7WebCore11RenderMedia23updateControlVisibilityEv
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLMediaElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLMediaElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore16HTMLMediaElement8autoplayEv
-__ZN7WebCore16HTMLMediaElement11setAutoplayEb
-__ZN7WebCore7Element19setBooleanAttributeERKNS_13QualifiedNameEb
-__ZN7WebCore29JSHTMLMediaElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore29JSHTMLMediaElementConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore29JSHTMLMediaElementConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore16HTMLMediaElement8setStartEf
-__ZN7WebCore16HTMLMediaElement22setTimeOffsetAttributeERKNS_13QualifiedNameEf
-__ZN7WebCore19serializeTimeOffsetEf
-__ZN7WebCore16HTMLMediaElement17checkIfSeekNeededEv
-__ZNK7WebCore11MediaPlayer11currentTimeEv
-__ZNK7WebCore18MediaPlayerPrivate11currentTimeEv
-__ZNK7WebCore16HTMLMediaElement5endedEv
-__ZN7WebCore40jsHTMLMediaElementPrototypeFunctionPauseEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16HTMLMediaElement8checkDTDEPKNS_4NodeE
-__ZN7WebCore17sourceConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLSourceElementC1EPNS_8DocumentE
-__ZNK7WebCore17HTMLSourceElement17endTagRequirementEv
-__ZNK7WebCore17HTMLSourceElement11tagPriorityEv
-__ZN7WebCore17HTMLSourceElement20insertedIntoDocumentEv
-__ZNK7WebCore18JSAudioConstructor19implementsConstructEv
-__ZN7WebCore18JSAudioConstructor9constructEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore16audioConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore16HTMLAudioElementC1EPNS_8DocumentE
-__ZN7WebCore18createAudioWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore18JSHTMLAudioElementC1EPN3KJS8JSObjectEPNS_16HTMLAudioElementE
-__ZNK7WebCore29JSHTMLAudioElementConstructor21implementsHasInstanceEv
-__ZN7WebCore29JSHTMLAudioElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18JSHTMLAudioElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore18JSHTMLAudioElement9classInfoEv
-__ZNK7WebCore13ProgressEvent15isProgressEventEv
-__ZN7WebCore15JSProgressEventC1EPN3KJS8JSObjectEPNS_13ProgressEventE
-__ZNK7WebCore16HTMLMediaElement10currentSrcEv
-__ZNK7WebCore16HTMLMediaElement7isVideoEv
-__ZNK7WebCore16HTMLAudioElement11tagPriorityEv
-__ZN7WebCore16HTMLMediaElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore16HTMLMediaElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore11RenderMediaC1EPNS_16HTMLMediaElementE
-__ZNK7WebCore16HTMLMediaElement16effectiveLoopEndEv
-__ZNK7WebCore16HTMLMediaElement7loopEndEv
-__ZNK7WebCore16HTMLMediaElement8bufferedEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_10TimeRangesE
-__ZN7WebCore21JSTimeRangesPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore12JSTimeRangesC1EPN3KJS8JSObjectEPNS_10TimeRangesE
-__ZN7WebCore12JSTimeRanges18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore12JSTimeRangesEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore12JSTimeRanges16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore21JSTimeRangesPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore34jsTimeRangesPrototypeFunctionStartEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore12JSTimeRanges9classInfoEv
-__ZNK7WebCore10TimeRanges5startEjRi
-__ZN7WebCore32jsTimeRangesPrototypeFunctionEndEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore10TimeRanges3endEjRi
-__ZNK7WebCore16HTMLVideoElement24imageSourceAttributeNameEv
-__ZN3KJS17staticValueGetterIN7WebCore18JSHTMLVideoElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSHTMLVideoElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore16HTMLMediaElement6setEndEf
-__ZN7WebCore16HTMLMediaElement10setLoopEndEf
-__ZNK7WebCore16HTMLMediaElement5mutedEv
-__ZN7WebCore16HTMLMediaElement8setMutedEb
-__ZN7WebCore18MediaPlayerPrivate9setVolumeEf
-__ZN7WebCore19createSourceWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
-__ZN7WebCore28JSHTMLSourceElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSHTMLSourceElementC1EPN3KJS8JSObjectEPNS_17HTMLSourceElementE
-__ZN7WebCore19JSHTMLSourceElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSHTMLSourceElement9classInfoEv
-__ZNK7WebCore16HTMLMediaElement5errorEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_10MediaErrorE
-__ZNK7WebCore16HTMLVideoElement10videoWidthEv
-__ZNK7WebCore16HTMLVideoElement11videoHeightEv
-__ZN7WebCore16HTMLMediaElement12setPlayCountEjRi
-__ZNK7WebCore29JSHTMLMediaElementConstructor21implementsHasInstanceEv
-__ZNK7WebCore29JSHTMLVideoElementConstructor21implementsHasInstanceEv
-__ZN7WebCore29JSHTMLVideoElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore12JSTimeRangesD0Ev
-__ZNK7WebCore16HTMLMediaElement8seekableEv
-__ZNK7WebCore16HTMLVideoElement5widthEv
-__ZNK7WebCore16HTMLVideoElement6heightEv
-__ZN7WebCore18JSHTMLVideoElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore16HTMLVideoElement8setWidthEi
-__ZN7WebCore16HTMLVideoElement9setHeightEi
-__ZNK7WebCore16HTMLMediaElement6volumeEv
-__ZN7WebCore16HTMLMediaElement9setVolumeEfRi
-__ZN7WebCore16HTMLMediaElement12setLoopStartEf
-__ZN7WebCore14RenderThemeMac20paintMediaMuteButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14RenderThemeMac20paintMediaPlayButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZNK7WebCore16HTMLMediaElement7canPlayEv
-__ZN7WebCore14RenderThemeMac21paintMediaSliderTrackEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14RenderThemeMac21paintMediaSliderThumbEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14RenderThemeMac24paintMediaSeekBackButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore14RenderThemeMac27paintMediaSeekForwardButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
-__ZN7WebCore9CSSParser14parseTransformEv
-__ZN7WebCore23WebKitCSSTransformValueC1ENS0_22TransformOperationTypeE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE14expandCapacityEmPKS4_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE15reserveCapacityEm
-__ZNK7WebCore19TransformOperationseqERKS0_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EE6shrinkEm
-__ZN7WebCore18StyleTransformDataC1ERKS0_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore18TransformOperationEEELm0EEaSERKS5_
-__ZNK7WebCore18StyleTransformDataeqERKS0_
-__ZNK7WebCore24RotateTransformOperationeqERKNS_18TransformOperationE
-__ZNK7WebCore24RotateTransformOperation17isRotateOperationEv
-__ZNK7WebCore23ScaleTransformOperationeqERKNS_18TransformOperationE
-__ZNK7WebCore23ScaleTransformOperation16isScaleOperationEv
-__ZNK7WebCore22SkewTransformOperationeqERKNS_18TransformOperationE
-__ZNK7WebCore22SkewTransformOperation15isSkewOperationEv
-__ZNK7WebCore11RenderStyle14applyTransformERNS_15AffineTransformERKNS_7IntSizeE
-__ZNK7WebCore18TransformOperation20isTranslateOperationEv
-__ZN7WebCore24RotateTransformOperation5applyERNS_15AffineTransformERKNS_7IntSizeE
-__ZN7WebCore23ScaleTransformOperation5applyERNS_15AffineTransformERKNS_7IntSizeE
-__ZN7WebCore22SkewTransformOperation5applyERNS_15AffineTransformERKNS_7IntSizeE
-__ZN7WebCore15AffineTransform4skewEdd
-__ZN7WebCore15AffineTransform5shearEdd
-__ZN7WebCore16HTMLMediaElement23progressEventTimerFiredEPNS_5TimerIS0_EE
-__ZNK7WebCore18MediaPlayerPrivate13maxTimeLoadedEv
-__ZN7WebCore15JSProgressEvent18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore15JSProgressEventEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore15JSProgressEvent16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore17HTMLSourceElement4typeEv
-__ZN7WebCore16MIMETypeRegistry24isSupportedMediaMIMETypeERKNS_6StringE
-__ZN7WebCore33initialiseSupportedMediaMIMETypesEv
-__ZN7WebCore11MediaPlayer17getSupportedTypesERN3WTF7HashSetINS_6StringENS_10StringHashENS1_10HashTraitsIS3_EEEE
-__ZN7WebCore18MediaPlayerPrivate17getSupportedTypesERN3WTF7HashSetINS_6StringENS_10StringHashENS1_10HashTraitsIS3_EEEE
-__ZNK7WebCore17HTMLSourceElement3srcEv
-__ZN7WebCore12JSMediaErrorC1EPN3KJS8JSObjectEPNS_10MediaErrorE
-__ZN7WebCore12JSMediaError18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore12JSMediaErrorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore12JSMediaError16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore23JSMediaErrorConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore23JSMediaErrorConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore23JSMediaErrorConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore17HTMLSourceElement5mediaEv
-__ZN7WebCore32min_device_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore11MediaPlayer15maxTimeBufferedEv
-__ZNK7WebCore18MediaPlayerPrivate15maxTimeBufferedEv
-__ZN7WebCore18MediaPlayerPrivate24disableUnsupportedTracksERj
-__Z20initQTMediaTypeVideov
-__Z20initQTMediaTypeSoundv
-__Z19initQTMediaTypeTextv
-__Z19initQTMediaTypeBasev
-__Z24initQTMediaTypeAttributev
-__ZNK7WebCore16HTMLMediaElement14effectiveStartEv
-__ZN7WebCore11MediaPlayer4seekEf
-__ZN7WebCore18MediaPlayerPrivate4seekEf
-__ZN7WebCore18MediaPlayerPrivate6doSeekEv
-__ZNK7WebCore18MediaPlayerPrivate12createQTTimeEf
-__Z29initQTMovieTimeScaleAttributev
-__Z14initQTMakeTimexl
--[WebCoreMovieObserver rateChanged:]
--[WebCoreMovieObserver timeChanged:]
-__ZN7WebCore16HTMLMediaElement13setReadyStateENS0_10ReadyStateE
-__ZN7WebCore11RenderVideo16videoSizeChangedEv
-__ZN7WebCore11MediaPlayer11naturalSizeEv
-__ZNK7WebCore18MediaPlayerPrivate11naturalSizeEv
-__Z31initQTMovieNaturalSizeAttributev
-__ZN7WebCore11MediaPlayer17readyStateChangedEv
-__ZThn68_N7WebCore16HTMLMediaElement28mediaPlayerReadyStateChangedEPNS_11MediaPlayerE
-__ZN7WebCore16HTMLMediaElement28mediaPlayerReadyStateChangedEPNS_11MediaPlayerE
-__ZN7WebCore11MediaPlayer10readyStateEv
-__Z28QTMediaTypeAttributeFunctionv
-__Z33QTMovieTimeScaleAttributeFunctionv
-__Z35QTMovieNaturalSizeAttributeFunctionv
-__ZN7WebCore16HTMLMediaElement14setCurrentTimeEfRi
-__ZN7WebCore16HTMLMediaElement4seekEfRi
-__ZN7WebCore11MediaPlayer15maxTimeSeekableEv
-__ZNK7WebCore18MediaPlayerPrivate15maxTimeSeekableEv
-__ZN7WebCore10TimeRangesC1Eff
-__ZN7WebCore10TimeRanges3addEff
-__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE15reserveCapacityEm
-__ZNK7WebCore10TimeRanges7containEf
-__ZN3WTF6VectorIN7WebCore10TimeRanges5RangeELm0EE6shrinkEm
-__ZN7WebCore35MediaControlFullscreenButtonElementD1Ev
-__ZN7WebCore11MediaPlayer4playEv
-__ZN7WebCore18MediaPlayerPrivate4playEv
--[WebCoreMovieObserver didEnd:]
-__ZN7WebCore18MediaPlayerPrivate6didEndEv
-__ZN7WebCore11MediaPlayer11timeChangedEv
-__ZThn68_N7WebCore16HTMLMediaElement22mediaPlayerTimeChangedEPNS_11MediaPlayerE
-__ZN7WebCore16HTMLMediaElement22mediaPlayerTimeChangedEPNS_11MediaPlayerE
-__ZNK7WebCore16HTMLMediaElement18effectiveLoopStartEv
-__ZN7WebCore11RenderMedia11removeChildEPNS_12RenderObjectE
-__ZN7WebCore16HTMLMediaElement11setControlsEb
-__ZNK7WebCore16HTMLMediaElement7seekingEv
-__ZN7WebCore25mainThreadSetNeedsDisplayEP11objc_objectP13objc_selector
--[WebCoreMovieObserver repaint]
-__ZN7WebCore18MediaPlayerPrivate7repaintEv
-__ZN7WebCore11MediaPlayer7repaintEv
-__ZThn68_N7WebCore16HTMLMediaElement18mediaPlayerRepaintEPNS_11MediaPlayerE
-__ZN7WebCore16HTMLMediaElement18mediaPlayerRepaintEPNS_11MediaPlayerE
-__ZN7WebCore18MediaPlayerPrivate11rateChangedEv
-__ZN7WebCore18MediaPlayerPrivate11timeChangedEv
-__ZN7WebCore11MediaPlayer5pauseEv
-__ZN7WebCore18MediaPlayerPrivate5pauseEv
-__ZN7WebCore5TimerINS_18MediaPlayerPrivateEE5firedEv
-__ZN7WebCore18MediaPlayerPrivate18endPointTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore5TimerINS_11RenderMediaEE5firedEv
-__ZN7WebCore11RenderMedia26opacityAnimationTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore11RenderMedia13changeOpacityEPNS_11HTMLElementEf
-__ZN7WebCore11RenderMedia20timeUpdateTimerFiredEPNS_5TimerIS0_EE
-__ZN7WebCore23WebKitCSSTransformValueD1Ev
-__ZN7WebCore14RenderReplaced13paintReplacedERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore28JSHTMLSourceElementPrototypeD0Ev
-__ZN7WebCore14ResourceHandle22scheduleBlockedFailureEv
-__ZN7WebCore5TimerINS_14ResourceHandleEE5firedEv
-__ZN7WebCore14ResourceHandle18fireBlockedFailureEPNS_5TimerIS0_EE
-__ZN7WebCore14ResourceLoader10wasBlockedEPNS_14ResourceHandleE
-__ZN7WebCore14ResourceLoader10wasBlockedEv
-__ZN7WebCore14ResourceLoader12blockedErrorEv
-__ZNK7WebCore11FrameLoader12blockedErrorERKNS_15ResourceRequestE
-__ZN7WebCore5TimerINS_14ResourceHandleEED1Ev
-__ZN7WebCore40jsDOMWindowPrototypeFunctionOpenDatabaseEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9DOMWindow12openDatabaseERKNS_6StringES3_S3_mRi
-__ZN7WebCore8Database12openDatabaseEPNS_8DocumentERKNS_6StringES5_S5_mRi
-__ZN7WebCore15DatabaseTracker20canEstablishDatabaseEPNS_8DocumentERKNS_6StringES5_m
-__ZN7WebCore15DatabaseTracker14usageForOriginEPNS_14SecurityOriginE
-__ZN7WebCore15DatabaseTracker18originQuotaManagerEv
-__ZN7WebCore18OriginQuotaManager4lockEv
-__ZNK7WebCore18OriginQuotaManager12tracksOriginEPNS_14SecurityOriginE
-__ZNK3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_iENS_18PairFirstExtractorIS6_EENS2_18SecurityOriginHashENS_14PairHashTraitsINS2_20SecurityOriginTraitsENS_10HashTraitsIiEEEESB_E8containsIS4_NS_22IdentityHashTranslatorIS4_S6_S9_EEEEbRKT_
-__ZN7WebCore18OriginQuotaManager11trackOriginEN3WTF10PassRefPtrINS_14SecurityOriginEEE
-__ZN7WebCore17OriginUsageRecordC1Ev
-__ZN7WebCore17OriginUsageRecord16unknownDiskUsageEv
-__ZN7WebCore18SecurityOriginHash4hashEN3WTF6RefPtrINS_14SecurityOriginEEE
-__ZN7WebCore15DatabaseTracker22databaseNamesForOriginEPNS_14SecurityOriginERN3WTF6VectorINS_6StringELm0EEE
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_iENS_18PairFirstExtractorIS6_EENS2_18SecurityOriginHashENS_14PairHashTraitsINS2_20SecurityOriginTraitsENS_10HashTraitsIiEEEESB_E6lookupIS4_NS_22IdentityHashTranslatorIS4_S6_S9_EEEEPS6_RKT_
-__ZNK7WebCore18OriginQuotaManager9diskUsageEPNS_14SecurityOriginE
-__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEPNS2_17OriginUsageRecordENS2_18SecurityOriginHashENS2_20SecurityOriginTraitsENS_10HashTraitsIS6_EEE3getERKS4_
-__ZN7WebCore17OriginUsageRecord9diskUsageEv
-__ZN7WebCore18OriginQuotaManager6unlockEv
-__ZN7WebCore15DatabaseTracker19hasEntryForDatabaseEPNS_14SecurityOriginERKNS_6StringE
-__ZN7WebCore15DatabaseTracker14quotaForOriginEPNS_14SecurityOriginE
-__ZN3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEyNS2_18SecurityOriginHashENS2_20SecurityOriginTraitsENS_10HashTraitsIyEEE3setEPS3_RKy
-__ZN7WebCore15DatabaseTracker23detailsForNameAndOriginERKNS_6StringEPNS_14SecurityOriginE
-__ZN7WebCore15DatabaseTracker8setQuotaEPNS_14SecurityOriginEy
-__ZN7WebCore7CString11mutableDataEv
-__ZN7WebCore7CString18copyBufferIfNeededEv
-__ZNK3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_xENS_18PairFirstExtractorIS6_EENS2_18SecurityOriginHashENS_14PairHashTraitsINS2_20SecurityOriginTraitsENS_10HashTraitsIxEEEESB_E8containsIS4_NS_22IdentityHashTranslatorIS4_S6_S9_EEEEbRKT_
-__ZNK7WebCore14SecurityOrigin16stringIdentifierEv
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_xENS_18PairFirstExtractorIS6_EENS2_18SecurityOriginHashENS_14PairHashTraitsINS2_20SecurityOriginTraitsENS_10HashTraitsIxEEEESB_E3addIS4_S6_NS_22IdentityHashTranslatorIS4_S6_S9_EEEES5_INS_17HashTableIteratorIS4_S6_S8_S9_SE_SB_EEbERKT_RKT0_
-__ZN7WebCore8DatabaseC1EPNS_8DocumentERKNS_6StringES5_
-__ZNK7WebCore14SecurityOrigin8toStringEv
-__ZN7WebCore8Database20guidForOriginAndNameERKNS_6StringES3_
-__ZNK3WTF7HashMapIN7WebCore6StringEiNS1_10StringHashENS_10HashTraitsIS2_EENS4_IiEEE3getERKS2_
-__ZN3WTF7HashMapIN7WebCore6StringEiNS1_10StringHashENS_10HashTraitsIS2_EENS4_IiEEE3setERKS2_RKi
-__ZN7WebCore8Database9guidMutexEv
-__ZN7WebCore8Database17guidToDatabaseMapEv
-__ZN3WTF7HashMapIiPNS_7HashSetIPN7WebCore8DatabaseENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEEENS_7IntHashIjEENS7_IiEENS7_ISA_EEE3setERKiRKSA_
-__ZN3WTF7HashSetIPN7WebCore8DatabaseENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore8Document14databaseThreadEv
-__ZN7WebCore14DatabaseThreadC1EPNS_8DocumentE
-__ZN7WebCore14DatabaseThread5startEv
-__ZN7WebCore15DatabaseTracker19fullPathForDatabaseEPNS_14SecurityOriginERKNS_6StringEb
-__ZN7WebCore14DatabaseThread19databaseThreadStartEPv
-__ZNK7WebCore15DatabaseTracker10originPathEPNS_14SecurityOriginE
-__ZN7WebCore14DatabaseThread14databaseThreadEv
-__ZN7WebCore14DatabaseThread26dispatchNextTaskIdentifierEv
-__ZN7WebCore15DatabaseTracker11addDatabaseEPNS_14SecurityOriginERKNS_6StringES5_
-__ZN7WebCore18OriginQuotaManager11addDatabaseEPNS_14SecurityOriginERKNS_6StringES5_
-__ZN7WebCore17OriginUsageRecord11addDatabaseERKNS_6StringES3_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_17OriginUsageRecord13DatabaseEntryEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E3addINS1_6StringES6_NS_17HashMapTranslatorILb0ES4_ISI_S6_ENS_18PairBaseHashTraitsINSC_ISI_EESE_EESF_SA_EEEES4_INS_17HashTableIteratorIS3_S7_S9_SA_SF_SD_EEbERKT_RKT0_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_17OriginUsageRecord13DatabaseEntryEENS_18PairFirstExtractorIS7_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSC_IS6_EEEESD_E47removeAndInvalidateWithoutEntryConsistencyCheckEPS7_
-__ZN7WebCore15DatabaseTracker15addOpenDatabaseEPNS_8DatabaseE
-__ZNK7WebCore8Database18securityOriginCopyEv
-__ZN7WebCore14SecurityOrigin4copyEv
-__ZNK7WebCore8Database16stringIdentifierEv
-__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEPNS0_INS2_6StringEPNS_7HashSetIPNS2_8DatabaseENS_7PtrHashIS8_EENS_10HashTraitsIS8_EEEENS2_10StringHashENSB_IS5_EENSB_ISE_EEEENS2_18SecurityOriginHashENS2_20SecurityOriginTraitsENSB_ISJ_EEE3getEPS3_
-__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_iENS_18PairFirstExtractorIS6_EENS2_18SecurityOriginHashENS_14PairHashTraitsINS2_20SecurityOriginTraitsENS_10HashTraitsIiEEEESB_E3addIS4_PNS2_17OriginUsageRecordENS_17HashMapTranslatorILb1ES5_IS4_SI_ENS_18PairBaseHashTraitsISB_NSC_ISI_EEEESE_S9_EEEES5_INS_17HashTableIteratorIS4_S6_S8_S9_SE_SB_EEbERKT_RKT0_
-__ZN3WTF7HashMapIN7WebCore6StringEPNS_7HashSetIPNS1_8DatabaseENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEENS1_10StringHashENS8_IS2_EENS8_ISB_EEE3setERKS2_RKSB_
-__ZN7WebCore8Database20openAndVerifyVersionERi
-__ZN7WebCore18DatabaseAuthorizerC1Ev
-__ZN7WebCore18DatabaseAuthorizer5resetEv
-__ZN7WebCore16DatabaseOpenTaskC1Ev
-__ZN7WebCore12DatabaseTaskC2Ev
-__ZN7WebCore12DatabaseTask28lockForSynchronousSchedulingEv
-__ZN7WebCore14DatabaseThread21scheduleImmediateTaskEPNS_8DatabaseEPNS_12DatabaseTaskE
-__ZN3WTF7HashSetINS_6RefPtrIN7WebCore8DatabaseEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZNK3WTF7HashMapIPN7WebCore8DatabaseEPNS_5DequeINS_6RefPtrINS1_12DatabaseTaskEEEEENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENSC_IS9_EEE3getERKS3_
-__ZN7WebCore14DatabaseThread14wakeWorkThreadEv
-__ZN7WebCore12DatabaseTask28waitForSynchronousCompletionEv
-__ZN7WebCore8Database15resetAuthorizerEv
-__ZN7WebCore12DatabaseTask11performTaskEPNS_8DatabaseE
-__ZN7WebCore16DatabaseOpenTask13doPerformTaskEPNS_8DatabaseE
-__ZN7WebCore8Database20performOpenAndVerifyERi
-__ZN7WebCore14SQLiteDatabase13setAuthorizerEN3WTF10PassRefPtrINS_16SQLiteAuthorizerEEE
-__ZN7WebCore14SQLiteDatabase16enableAuthorizerEb
-_sqlite3_set_authorizer
-__ZN7WebCore8Database21databaseInfoTableNameEv
-__ZN7WebCore14SQLiteDatabase18authorizerFunctionEPviPKcS3_S3_S3_
-__ZN7WebCore16SQLiteAuthorizer11allowSelectEv
-__ZN7WebCore18DatabaseAuthorizer9allowReadERKNS_6StringES3_
-__ZN7WebCore18DatabaseAuthorizer20denyBasedOnTableNameERKNS_6StringE
-__ZN7WebCore18DatabaseAuthorizer11allowInsertERKNS_6StringE
-__ZN7WebCore18DatabaseAuthorizer11createTableERKNS_6StringE
-__ZN7WebCore18DatabaseAuthorizer11createIndexERKNS_6StringES3_
-__ZN7WebCore18DatabaseAuthorizer11allowUpdateERKNS_6StringES3_
-__ZN7WebCore8Database16guidToVersionMapEv
-__ZNK3WTF7HashMapIiN7WebCore6StringENS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3getERKi
-__ZN7WebCore8Database22getVersionFromDatabaseERNS_6StringE
-__ZN7WebCore18databaseVersionKeyEv
-__ZN7WebCore18DatabaseAuthorizer7disableEv
-__ZN7WebCore18DatabaseAuthorizer6enableEv
-__ZN7WebCore8Database20setVersionInDatabaseERKNS_6StringE
-__ZN3WTF7HashMapIiN7WebCore6StringENS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3setERKiRKS2_
-__ZN7WebCore8Database19performPolicyChecksEv
-__ZN7WebCore16DatabaseOpenTaskD1Ev
-__ZN7WebCore12DatabaseTaskD0Ev
-__ZN7WebCore15ThreadConditionD1Ev
-__ZN7WebCore15DatabaseTracker18setDatabaseDetailsEPNS_14SecurityOriginERKNS_6StringES5_m
-__ZN7WebCore19InspectorController15didOpenDatabaseEPNS_8DatabaseERKNS_6StringES5_S5_
-__ZN3WTF7HashSetINS_6RefPtrIN7WebCore25InspectorDatabaseResourceEEENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_8DatabaseE
-__ZN7WebCore19JSDatabasePrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore10JSDatabaseC1EPN3KJS8JSObjectEPNS_8DatabaseE
-__ZN7WebCore10JSDatabase18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19JSDatabasePrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore38jsDatabasePrototypeFunctionTransactionEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore10JSDatabase9classInfoEv
-__ZN7WebCore10JSDatabase11transactionEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore30JSCustomSQLTransactionCallbackC1EPN3KJS8JSObjectEPNS_5FrameE
-__ZN7WebCore8Database11transactionEN3WTF10PassRefPtrINS_22SQLTransactionCallbackEEENS2_INS_27SQLTransactionErrorCallbackEEENS2_INS_12VoidCallbackEEE
-__ZN7WebCore14SQLTransactionC1EPNS_8DatabaseEN3WTF10PassRefPtrINS_22SQLTransactionCallbackEEENS4_INS_27SQLTransactionErrorCallbackEEENS4_INS_21SQLTransactionWrapperEEE
-__ZN7WebCore8Database19scheduleTransactionEN3WTF10PassRefPtrINS_14SQLTransactionEEE
-__ZN7WebCore16ThreadSafeSharedINS_14SQLTransactionEE5derefEv
-__ZN7WebCore23DatabaseTransactionTaskC1Ev
-__ZN7WebCore14DatabaseThread12scheduleTaskEPNS_8DatabaseEPNS_12DatabaseTaskE
-__ZN7WebCore23DatabaseTransactionTask13doPerformTaskEPNS_8DatabaseE
-__ZN7WebCore8Database22performTransactionStepEv
-__ZN7WebCore8Database19globalCallbackMutexEv
-__ZN7WebCore14SQLTransaction15performNextStepEv
-__ZN7WebCore14SQLTransaction27openTransactionAndPreflightEv
-__ZNK7WebCore8Database11maximumSizeEv
-__ZN3WTF7HashMapIN7WebCore6StringENS1_17OriginUsageRecord13DatabaseEntryENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
-__ZN7WebCore11getFileSizeERKNS_6StringERx
-__ZNK7WebCore8Database12databaseSizeEv
-__ZN7WebCore14SQLiteDatabase14setMaximumSizeEx
-__ZN7WebCore14SQLiteDatabase8pageSizeEv
-_returnSingleInt
-__ZN7WebCore6String6numberEx
-__ZN7WebCore18DatabaseAuthorizer16allowTransactionEv
-__ZN7WebCore8Database27scheduleTransactionCallbackEPNS_14SQLTransactionE
-__ZN7WebCore8Database17globalCallbackSetEv
-__ZN7WebCore23DatabaseTransactionTaskD1Ev
-__ZN7WebCore8Database26deliverAllPendingCallbacksEPv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore8DatabaseEEELm0EE6resizeEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore8DatabaseEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore8DatabaseEEELm0EE15reserveCapacityEm
-__ZN7WebCore8Database22deliverPendingCallbackEv
-__ZN7WebCore14SQLTransaction22performPendingCallbackEv
-__ZN7WebCore14SQLTransaction26deliverTransactionCallbackEv
-__ZN7WebCore30JSCustomSQLTransactionCallback11handleEventEPNS_14SQLTransactionERb
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_14SQLTransactionE
-__ZN7WebCore25JSSQLTransactionPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSSQLTransactionC1EPN3KJS8JSObjectEPNS_14SQLTransactionE
-__ZN7WebCore25JSSQLTransactionPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore43jsSQLTransactionPrototypeFunctionExecuteSqlEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore16JSSQLTransaction9classInfoEv
-__ZN7WebCore16JSSQLTransaction10executeSqlEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore14SQLTransaction10executeSQLERKNS_6StringERKN3WTF6VectorINS_8SQLValueELm0EEENS4_10PassRefPtrINS_20SQLStatementCallbackEEENSA_INS_25SQLStatementErrorCallbackEEERi
-__ZN7WebCore12SQLStatementC1ERKNS_6StringERKN3WTF6VectorINS_8SQLValueELm0EEENS4_10PassRefPtrINS_20SQLStatementCallbackEEENSA_INS_25SQLStatementErrorCallbackEEE
-__ZN3WTF6VectorIN7WebCore8SQLValueELm0EEC1ERKS3_
-__ZNK7WebCore8Database22versionMatchesExpectedEv
-__ZN7WebCore14SQLTransaction16enqueueStatementEN3WTF10PassRefPtrINS_12SQLStatementEEE
-__ZN3WTF6VectorIN7WebCore8SQLValueELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore8SQLValueELm0EE15reserveCapacityEm
-__ZN7WebCore8SQLValueC1ERKS0_
-__ZN3WTF6VectorIN7WebCore8SQLValueELm0EE6shrinkEm
-__ZN7WebCore28JSCustomSQLStatementCallbackC1EPN3KJS8JSObjectEPNS_5FrameE
-__ZN7WebCore33JSCustomSQLStatementErrorCallbackC1EPN3KJS8JSObjectEPNS_5FrameE
-__ZN7WebCore14SQLTransaction23scheduleToRunStatementsEv
-__ZN7WebCore8Database23scheduleTransactionStepEv
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore8DatabaseEEELm0EE6shrinkEm
-__ZN7WebCore14SQLTransaction13runStatementsEv
-__ZN7WebCore14SQLTransaction16getNextStatementEv
-__ZN7WebCore14SQLTransaction19runCurrentStatementEv
-__ZN7WebCore12SQLStatement7executeEPNS_8DatabaseE
-__ZN7WebCore12SQLStatement22clearFailureDueToQuotaEv
-__ZNK7WebCore12SQLStatement29lastExecutionFailedDueToQuotaEv
-_sqlite3ErrorMsg
-__ZN7WebCore14SQLiteDatabase12lastErrorMsgEv
-_sqlite3_errmsg
-__ZN7WebCore14SQLTransaction27handleCurrentStatementErrorEv
-__ZN7WebCore14SQLTransaction22handleTransactionErrorEb
-__ZN7WebCore14SQLTransaction36cleanupAfterTransactionErrorCallbackEv
-__ZN7WebCore17SQLiteTransaction8rollbackEv
-_sqlite3RollbackTransaction
-_sqlite3RollbackAll
-__ZN7WebCore28JSCustomSQLStatementCallbackD1Ev
-__ZN7WebCore33JSCustomSQLStatementErrorCallbackD1Ev
-__ZN7WebCore30JSCustomSQLTransactionCallbackD1Ev
-__ZN7WebCore30JSCustomSQLTransactionCallback10deleteDataEPv
-__ZN7WebCore10JSDatabaseD0Ev
-__ZN7WebCore16JSSQLTransactionD0Ev
-__ZN7WebCore14DatabaseThread17documentGoingAwayEv
-__ZN7WebCore8Database23databaseThreadGoingAwayEv
-__ZN7WebCore8DatabaseD1Ev
-__ZN7WebCore15DatabaseTracker18removeOpenDatabaseEPNS_8DatabaseE
-_sqlite3_close
-__ZN7WebCore18DatabaseAuthorizerD1Ev
-__ZN7WebCore12detachThreadEj
-__ZN7WebCore26pthreadHandleForIdentifierEj
-__ZN7WebCore31clearPthreadHandleForIdentifierEj
-__ZN3WTF9HashTableIjSt4pairIjiENS_18PairFirstExtractorIS2_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsIjEENS8_IiEEEES9_E4findIjNS_22IdentityHashTranslatorIjS2_S6_EEEENS_17HashTableIteratorIjS2_S4_S6_SB_S9_EERKT_
-__ZN7WebCore14DatabaseThreadD1Ev
-__ZN7WebCore23JSNodeFilterConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore23JSNodeFilterConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore23JSNodeFilterConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore45jsDocumentPrototypeFunctionCreateNodeIteratorEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12toNodeFilterEPN3KJS7JSValueE
-__ZN7WebCore8Document18createNodeIteratorEPNS_4NodeEjN3WTF10PassRefPtrINS_10NodeFilterEEEbRi
-__ZN7WebCore12NodeIteratorC1EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
-__ZN7WebCore9TraversalC2EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
-__ZN7WebCore12NodeIterator11NodePointerC1EN3WTF10PassRefPtrINS_4NodeEEEb
-__ZN7WebCore12NodeIterator11NodePointerC1Ev
-__ZN7WebCore8Document18attachNodeIteratorEPNS_12NodeIteratorE
-__ZN3WTF7HashSetIPN7WebCore12NodeIteratorENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_12NodeIteratorE
-__ZN7WebCore23JSNodeIteratorPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore14JSNodeIteratorC1EPN3KJS8JSObjectEPNS_12NodeIteratorE
-__ZN7WebCore14JSNodeIterator18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSNodeIteratorPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore39jsNodeIteratorPrototypeFunctionNextNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore14JSNodeIterator9classInfoEv
-__ZN7WebCore14JSNodeIterator8nextNodeEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore12NodeIterator8nextNodeERiRPN3KJS7JSValueE
-__ZN7WebCore12NodeIterator11NodePointer10moveToNextEPNS_4NodeE
-__ZNK7WebCore9Traversal10acceptNodeEPNS_4NodeERPN3KJS7JSValueE
-__ZN7WebCore12NodeIterator11NodePointer5clearEv
-__ZN7WebCore43jsNodeIteratorPrototypeFunctionPreviousNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore14JSNodeIterator12previousNodeEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore12NodeIterator12previousNodeERiRPN3KJS7JSValueE
-__ZN7WebCore12NodeIterator11NodePointer14moveToPreviousEPNS_4NodeE
-__ZN7WebCore43jsDocumentPrototypeFunctionCreateTreeWalkerEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document16createTreeWalkerEPNS_4NodeEjN3WTF10PassRefPtrINS_10NodeFilterEEEbRi
-__ZN7WebCore10TreeWalkerC1EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_10TreeWalkerE
-__ZN7WebCore21JSTreeWalkerPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore12JSTreeWalkerC1EPN3KJS8JSObjectEPNS_10TreeWalkerE
-__ZN7WebCore12JSTreeWalker18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSTreeWalkerPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore37jsTreeWalkerPrototypeFunctionNextNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore12JSTreeWalker9classInfoEv
-__ZN7WebCore12JSTreeWalker8nextNodeEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore10TreeWalker8nextNodeERPN3KJS7JSValueE
-__ZN7WebCore41jsTreeWalkerPrototypeFunctionPreviousNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12JSTreeWalker12previousNodeEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore10TreeWalker12previousNodeERPN3KJS7JSValueE
-__ZN7WebCore32jsTextPrototypeFunctionSplitTextEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore21JSNodeFilterConditionC1EPN3KJS8JSObjectE
-__ZN7WebCore39jsTreeWalkerPrototypeFunctionFirstChildEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12JSTreeWalker10firstChildEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore10TreeWalker10firstChildERPN3KJS7JSValueE
-__ZNK7WebCore10NodeFilter10acceptNodeEPNS_4NodeERPN3KJS7JSValueE
-__ZNK7WebCore21JSNodeFilterCondition10acceptNodeEPNS_4NodeERPN3KJS7JSValueE
-__ZN7WebCore12JSTreeWalker3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore12JSTreeWalker16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore10TreeWalker14setCurrentNodeEN3WTF10PassRefPtrINS_4NodeEEERi
-__ZN3KJS17staticValueGetterIN7WebCore12JSTreeWalkerEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore12JSTreeWalker16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore40jsTreeWalkerPrototypeFunctionNextSiblingEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12JSTreeWalker11nextSiblingEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore10TreeWalker11nextSiblingERPN3KJS7JSValueE
-__ZN7WebCore44jsTreeWalkerPrototypeFunctionPreviousSiblingEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12JSTreeWalker15previousSiblingEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore10TreeWalker15previousSiblingERPN3KJS7JSValueE
-__ZN7WebCore39jsTreeWalkerPrototypeFunctionParentNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12JSTreeWalker10parentNodeEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore10TreeWalker10parentNodeERPN3KJS7JSValueE
-__ZN7WebCore13takeExceptionEPN3KJS9ExecStateE
-__ZN7WebCore12NodeIterator23notifyBeforeNodeRemovalEPNS_4NodeE
-__ZNK7WebCore12NodeIterator20updateForNodeRemovalEPNS_4NodeERNS0_11NodePointerE
-__ZN7WebCore38jsTreeWalkerPrototypeFunctionLastChildEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12JSTreeWalker9lastChildEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore10TreeWalker9lastChildERPN3KJS7JSValueE
-__ZN3KJS17staticValueGetterIN7WebCore14JSNodeIteratorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore14JSNodeIterator16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore14JSNodeIterator4markEv
-__ZN7WebCore21JSNodeFilterCondition4markEv
-__ZN7WebCore12JSTreeWalker4markEv
-__ZN7WebCore12JSTreeWalkerD0Ev
-__ZN7WebCore10TreeWalkerD1Ev
-__ZN7WebCore21JSNodeFilterConditionD1Ev
-__ZN7WebCore14JSNodeIteratorD0Ev
-__ZN7WebCore8Document18detachNodeIteratorEPNS_12NodeIteratorE
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS1_12IconSnapshotEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSB_IS5_EEEESC_E4findIS3_NS_22IdentityHashTranslatorIS3_S6_S9_EEEENS_17HashTableIteratorIS3_S6_S8_S9_SE_SC_EERKT_
-__ZN7WebCore10toGeorgianEi
-__ZN7WebCore11SVGDocumentC1EPNS_17DOMImplementationEPNS_5FrameE
-__ZN7WebCore9SVGLength20PercentageOfViewportEfPKNS_16SVGStyledElementENS_13SVGLengthModeE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HTMLElementEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HTMLElementEEELm0EE15reserveCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HTMLElementEEELm0EE6shrinkEm
+-[DOMRange text]
+__ZN7WebCore23SetNodeAttributeCommand9doUnapplyEv
+__ZN7WebCore8SVGImageC1EPNS_13ImageObserverE
+__ZN7WebCore8SVGImageC2EPNS_13ImageObserverE
+__ZN7WebCore8SVGImage11dataChangedEb
+__ZN7WebCore22EmptyFrameLoaderClient20createDocumentLoaderERKNS_15ResourceRequestERKNS_14SubstituteDataE
+__ZN7WebCore14DocumentLoaderC1ERKNS_15ResourceRequestERKNS_14SubstituteDataE
+__ZN7WebCore22EmptyFrameLoaderClient22provisionalLoadStartedEv
+__ZN7WebCore22EmptyFrameLoaderClient25setMainFrameDocumentReadyEb
+__ZN7WebCore22EmptyFrameLoaderClient17setCopiesOnScrollEv
+__ZN7WebCore22EmptyFrameLoaderClient31prepareForDataSourceReplacementEv
+__ZN7WebCore22EmptyFrameLoaderClient31transitionToCommittedForNewPageEv
+__ZN7WebCore17EmptyEditorClient23clearUndoRedoOperationsEv
+__ZN7WebCore22EmptyFrameLoaderClient15finishedLoadingEPNS_14DocumentLoaderE
+__ZNK7WebCore17FrameLoaderClient23shouldUsePluginDocumentERKNS_6StringE
+__ZNK7WebCore22EmptyFrameLoaderClient17overrideMediaTypeEv
+__ZN7WebCore17EmptyChromeClient22createHTMLParserQuirksEv
+__ZNK7WebCore17EmptyChromeClient19contentsSizeChangedEPNS_5FrameERKNS_7IntSizeE
+__ZN7WebCore22EmptyFrameLoaderClient24documentElementAvailableEv
+__ZN7WebCore22EmptyFrameLoaderClient18frameLoadCompletedEv
+__ZN7WebCore22EmptyFrameLoaderClient21forceLayoutForNonHTMLEv
+__ZN7WebCore22EmptyFrameLoaderClient9userAgentERKNS_4KURLE
+__ZN7WebCore22EmptyFrameLoaderClient17cancelPolicyCheckEv
+__ZN7WebCore16NavigationActionC1ERKNS_4KURLENS_14NavigationTypeE
+__ZN7WebCore16NavigationActionC2ERKNS_4KURLENS_14NavigationTypeE
+__ZN7WebCore17EmptyChromeClient30canRunBeforeUnloadConfirmPanelEv
+__ZN7WebCore22EmptyFrameLoaderClient27willChangeEstimatedProgressEv
+__ZN7WebCore22EmptyFrameLoaderClient31postProgressStartedNotificationEv
+__ZN7WebCore22EmptyFrameLoaderClient26didChangeEstimatedProgressEv
+__ZN7WebCore22EmptyFrameLoaderClient31dispatchDidStartProvisionalLoadEv
+__ZN7WebCore22EmptyFrameLoaderClient32assignIdentifierToInitialRequestEmPNS_14DocumentLoaderERKNS_15ResourceRequestE
+__ZN7WebCore22EmptyFrameLoaderClient23dispatchWillSendRequestEPNS_14DocumentLoaderEmRNS_15ResourceRequestERKNS_16ResourceRespon
+__ZN7WebCore22EmptyFrameLoaderClient31dispatchDecidePolicyForMIMETypeEMNS_11FrameLoaderEFvNS_12PolicyActionEERKNS_6StringERKNS_
+__ZN7WebCore11FrameLoader24cancelContentPolicyCheckEv
+__ZN7WebCore22EmptyFrameLoaderClient17dispatchWillCloseEv
+__ZN7WebCore22EmptyFrameLoaderClient18makeRepresentationEPNS_14DocumentLoaderE
+__ZN7WebCore14DocumentLoaderD0Ev
+__ZNK7WebCore17FrameLoaderClient11hasHTMLViewEv
+__ZN7WebCore17EmptyChromeClient16setStatusbarTextERKNS_6StringE
+__ZN7WebCore11FrameLoader19setResponseMIMETypeERKNS_6StringE
+__ZN7WebCore9SVGLength20PercentageOfViewportEfPKNS_10SVGElementENS_13SVGLengthModeE
 __ZNK7WebCore10SVGElement15viewportElementEv
+__ZN7WebCoreL21updateCSSForAttributeEPNS_13SVGSVGElementERKNS_13QualifiedNameE13CSSPropertyIDRKNS_9SVGLengthE
+__ZNK7WebCore9SVGLength13valueAsStringEv
 __ZN7WebCore15SVGFitToViewBox12parseViewBoxERPKtS2_RfS4_S4_S4_b
-__ZThn108_NK7WebCore13SVGSVGElement14contextElementEv
+__ZThn344_NK7WebCore13SVGSVGElement14contextElementEv
 __ZNK7WebCore13SVGSVGElement14contextElementEv
-__ZN7WebCore15SVGFitToViewBox19setViewBoxBaseValueENS_9FloatRectE
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapINS_9FloatRectEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS4_IPNS_10StringImplET_NS_10StringHashENS3_10HashTraitsIS9_EENSC_ISA_EEEENS3_7PtrHashIS7_EENSC_IS7_EENSC_ISG_EEEEvE14s_baseValueMap
-__ZN7WebCore15SVGFitToViewBox10setViewBoxENS_9FloatRectE
-__ZN7WebCore16titleConstructorEPNS_8DocumentEb
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplENS1_9FloatRectENS1_10StringHashENS_10HashTraitsIS6_EENS9_IS7_
+__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS_7HashSetIPNS1_16SVGStyledElementENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEEEN
+__ZN7WebCoreL16titleConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore15SVGTitleElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGTitleElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore15SVGTitleElement20insertedIntoDocumentEv
 __ZNK7WebCore10SVGElement7isValidEv
 __ZN7WebCore15SVGTitleElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore15SVGTitleElement15childrenChangedEb
-__ZN7WebCore15descConstructorEPNS_8DocumentEb
+__ZN7WebCore15SVGTitleElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore22EmptyFrameLoaderClient15willChangeTitleEPNS_14DocumentLoaderE
+__ZN7WebCore22EmptyFrameLoaderClient14didChangeTitleEPNS_14DocumentLoaderE
+__ZN7WebCoreL15descConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore14SVGDescElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGDescElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore14SVGDescElement16rendererIsNeededEPNS_11RenderStyleE
-__ZNK7WebCore13StyleFillDataeqERKS0_
+__ZN7WebCoreL12gConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore11SVGGElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore11SVGGElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore11SVGGElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore11SVGGElement7isValidEv
+__ZN7WebCore11SVGGElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore31RenderSVGTransformableContainerC1EPNS_29SVGStyledTransformableElementE
+__ZN7WebCore31RenderSVGTransformableContainerC2EPNS_29SVGStyledTransformableElementE
+__ZN7WebCore18RenderSVGContainerC2EPNS_16SVGStyledElementE
+__ZNK7WebCore18RenderSVGContainer15virtualChildrenEv
+__ZN7WebCore11SVGGElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore12SVGLangSpace11setXmlspaceERKNS_12AtomicStringE
+__ZN7WebCore15StyleStrokeDataC1ERKS0_
+__ZN7WebCore15StyleStrokeDataC2ERKS0_
+__ZN7WebCore18RenderSVGContainer15virtualChildrenEv
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEPNS1_16SVGTransformListENS1_10StringHashENS_10HashTraitsIS6_E
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE14shrinkCapacityEm
+__ZN7WebCore16SVGTransformable23parseTransformAttributeEPNS_16SVGTransformListERKNS_12AtomicStringE
+__ZN7WebCore16SVGTransformable23parseTransformAttributeEPNS_16SVGTransformListERPKtS4_
+__ZN7WebCore16SVGTransformable19parseTransformValueEjRPKtS2_RNS_12SVGTransformE
+__ZN7WebCore12SVGTransform12setTranslateEff
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE14expandCapacityEmPKS6_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE15reserveCapacityEm
+__ZNK7WebCore15StyleStrokeDataeqERKS0_
 __ZN7WebCore14SVGRenderStyle11inheritFromEPKS0_
-__ZN7WebCore15lineConstructorEPNS_8DocumentEb
+__ZN7WebCore21SVGTextContentElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCoreL15lineConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore14SVGLineElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore14SVGLineElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore14SVGLineElement14setX1BaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGLineElement5setX1ENS_9SVGLengthE
 __ZN7WebCore14SVGLineElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore14SVGLineElement14setY1BaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGLineElement5setY1ENS_9SVGLengthE
-__ZN7WebCore14SVGLineElement14setX2BaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGLineElement5setX2ENS_9SVGLengthE
-__ZN7WebCore14SVGLineElement14setY2BaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGLineElement5setY2ENS_9SVGLengthE
 __ZNK7WebCore14SVGLineElement7isValidEv
-__ZNK7WebCore15StyleStrokeDataeqERKS0_
-__ZNK7WebCore29SVGStyledTransformableElement18transformBaseValueEv
-__ZN7WebCore12SVGTransform12setTranslateEff
-__ZN7WebCore29SVGStyledTransformableElement21setTransformBaseValueEPNS_16SVGTransformListE
-__ZN7WebCore29SVGStyledTransformableElement12setTransformEPNS_16SVGTransformListE
-__ZN7WebCore21SVGTextContentElement22setTextLengthBaseValueENS_9SVGLengthE
-__ZN7WebCore21SVGTextContentElement13setTextLengthENS_9SVGLengthE
-__ZN7WebCore21SVGTextContentElement24setLengthAdjustBaseValueEi
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapIiEEPN3WTF7HashMapIPKNS_10SVGElementEPNS3_IPNS_10StringImplET_NS_10StringHashENS2_10HashTraitsIS8_EENSB_IS9_EEEENS2_7PtrHashIS6_EENSB_IS6_EENSB_ISF_EEEEvE14s_baseValueMap
-__ZN7WebCore21SVGTextContentElement15setLengthAdjustEi
-__ZNK7WebCore13SVGSVGElement19preserveAspectRatioEv
-__ZNK7WebCore15SVGFitToViewBox19preserveAspectRatioEv
+__ZN7WebCore7DataRefINS_15StyleStrokeDataEE6accessEv
+__ZN7WebCoreL18animateConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore17SVGAnimateElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17SVGAnimateElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19SVGAnimationElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGSMILElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19SVGAnimationElement16attributeChangedEPNS_9AttributeEb
+__ZN7WebCore14SVGSMILElement16attributeChangedEPNS_9AttributeEb
+__ZN7WebCore19SVGAnimationElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore14SVGSMILElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore10SVGElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCoreL13parseKeyTimesERKNS_6StringERN3WTF6VectorIfLm0EEEb
+__ZN7WebCore14SVGSMILElement15parseBeginOrEndERKNS_6StringENS0_10BeginOrEndE
+__ZN7WebCore14SVGSMILElement15parseClockValueERKNS_6StringE
+__ZN7WebCore14SVGSMILElement16parseOffsetValueERKNS_6StringE
+__ZNK3WTF9HashTableIddNS_17IdentityExtractorIdEENS_9FloatHashIdEENS_10HashTraitsIdEES6_E8containsIdNS_22IdentityHashTranslatorI
+__ZN3WTF6VectorIN7WebCore8SMILTimeELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore8SMILTimeELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore8SMILTimeELm0EE15reserveCapacityEm
+__ZN7WebCoreL12sortTimeListERN3WTF6VectorINS_8SMILTimeELm0EEE
+__ZSt16__introsort_loopIPN7WebCore8SMILTimeElEvT_S3_T0_
+__ZSt22__final_insertion_sortIPN7WebCore8SMILTimeEEvT_S3_
+__ZSt16__insertion_sortIPN7WebCore8SMILTimeEEvT_S3_
+__ZN3WTF9HashTableIddNS_17IdentityExtractorIdEENS_9FloatHashIdEENS_10HashTraitsIdEES6_E15deallocateTableEPdi
+__ZN7WebCore14SVGSMILElement20insertedIntoDocumentEv
+__ZNK7WebCore10SVGElement15ownerSVGElementEv
+__ZN7WebCore14SVGSMILElement10rescheduleEv
+__ZN7WebCore17SMILTimeContainer8scheduleEPNS_14SVGSMILElementE
+__ZNK7WebCore14SVGSMILElement16nextProgressTimeEv
+__ZN3WTF7HashSetIPN7WebCore14SVGSMILElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandE
+__ZN3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashE
+__ZN3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13alloca
+__ZN7WebCore14SVGSMILElement21finishParsingChildrenEv
+__ZN7WebCore14SVGSMILElement20resolveFirstIntervalEv
+__ZNK7WebCore14SVGSMILElement15resolveIntervalEbRNS_8SMILTimeES2_
+__ZNK7WebCore14SVGSMILElement16findInstanceTimeENS0_10BeginOrEndENS_8SMILTimeEb
+__ZNK7WebCore14SVGSMILElement16resolveActiveEndENS_8SMILTimeES1_
+__ZNK7WebCore14SVGSMILElement3durEv
+__ZNK7WebCore14SVGSMILElement17repeatingDurationEv
+__ZNK7WebCore14SVGSMILElement11repeatCountEv
+__ZNK7WebCore14SVGSMILElement9repeatDurEv
+__ZNK7WebCore14SVGSMILElement14simpleDurationEv
+__ZNK7WebCore14SVGSMILElement8minValueEv
+__ZNK7WebCore14SVGSMILElement8maxValueEv
+__ZN7WebCoreplERKNS_8SMILTimeES2_
+__ZN7WebCore14SVGSMILElement31notifyDependentsIntervalChangedENS0_21NewOrExistingIntervalE
+__ZNK3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8contai
+__ZN3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3
+__ZN3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47remove
+__ZN3WTF9HashTableIPN7WebCore14SVGSMILElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeE
+__ZN7WebCore22EmptyFrameLoaderClient29dispatchDidFinishDocumentLoadEv
+__ZN7WebCore22EmptyFrameLoaderClient29dispatchDidHandleOnloadEventsEv
+__ZN7WebCore10ScrollView16updateScrollbarsERKNS_7IntSizeE
+__ZN7WebCore10ScrollView34platformHandleHorizontalAdjustmentERKNS_7IntSizeE
+__ZN7WebCore10ScrollView32platformHandleVerticalAdjustmentERKNS_7IntSizeE
+__ZN7WebCore18RenderSVGContainer6layoutEv
+__ZN7WebCore18RenderSVGContainer12calcViewportEv
+__ZNK7WebCore18RenderSVGContainer13selfWillPaintEv
+__ZN7WebCore31RenderSVGTransformableContainer23calculateLocalTransformEv
+__ZN7WebCore12SVGTransformC1ERKNS_20TransformationMatrixE
+__ZN7WebCore12SVGTransformC2ERKNS_20TransformationMatrixE
+__ZNK7WebCore14SVGLineElement10toPathDataEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGLineElementENS_9SVGLengthEXadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12y2AttrStri
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGLineElementENS_9SVGLengthEXadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12y1AttrStri
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGLineElementENS_9SVGLengthEXadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12x1AttrStri
+__ZN7WebCore4Path10createLineERKNS_10FloatPointES3_
 __ZN7WebCore22SVGPreserveAspectRatio6getCTMEdddddddd
 __ZNK7WebCore22SVGPreserveAspectRatio5alignEv
+__ZN7WebCore22EmptyFrameLoaderClient22dispatchDidFirstLayoutEv
+__ZN7WebCore22EmptyFrameLoaderClient38dispatchDidFirstVisuallyNonEmptyLayoutEv
+__ZN3WTF6VectorIPN7WebCore14SVGSMILElementELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore14SVGSMILElementELm0EE15reserveCapacityEm
+__ZN7WebCore17SMILTimeContainer26updateDocumentOrderIndexesEv
+__ZN7WebCore14SVGSMILElement13isSMILElementEPNS_4NodeE
+__ZSt16__introsort_loopIPPN7WebCore14SVGSMILElementElNS0_15PriorityCompareEEvT_S5_T0_T1_
+__ZSt22__final_insertion_sortIPPN7WebCore14SVGSMILElementENS0_15PriorityCompareEEvT_S5_T0_
+__ZSt16__insertion_sortIPPN7WebCore14SVGSMILElementENS0_15PriorityCompareEEvT_S5_T0_
+__ZNK7WebCore14SVGSMILElement13targetElementEv
+__ZNK7WebCore14SVGSMILElement9xlinkHrefEv
+__ZNK7WebCore14SVGSMILElement13attributeNameEv
+__ZNK3WTF7HashMapISt4pairIPN7WebCore10SVGElementENS2_6StringEEPNS2_14SVGSMILElementENS_8PairHashIS4_S5_EENS_10HashTraitsIS6_EEN
+__ZN7WebCore17SMILTimeContainer12baseValueForESt4pairIPNS_10SVGElementENS_6StringEE
+__ZN7WebCore19SVGAnimationElement14attributeIsCSSERKNS_6StringE
+__ZN3WTF7HashMapISt4pairIPN7WebCore10SVGElementENS2_6StringEES5_NS_8PairHashIS4_S5_EENS_10HashTraitsIS6_EENS9_IS5_EEE3addERKS6_
+__ZN3WTF9HashTableISt4pairIPN7WebCore10SVGElementENS2_6StringEES1_IS6_S5_ENS_18PairFirstExtractorIS7_EENS_8PairHashIS4_S5_EENS_
+__ZN7WebCore17SVGAnimateElement16resetToBaseValueERKNS_6StringE
+__ZNK7WebCore17SVGAnimateElement21determinePropertyTypeERKNS_6StringE
+__ZN7WebCoreL23parseNumberValueAndUnitERKNS_6StringERdRS0_
+__ZN3WTF7HashMapISt4pairIPN7WebCore10SVGElementENS2_6StringEEPNS2_14SVGSMILElementENS_8PairHashIS4_S5_EENS_10HashTraitsIS6_EENS
+__ZN3WTF9HashTableISt4pairIPN7WebCore10SVGElementENS2_6StringEES1_IS6_PNS2_14SVGSMILElementEENS_18PairFirstExtractorIS9_EENS_8P
+__ZN7WebCore14SVGSMILElement8progressENS_8SMILTimeEPS0_
+__ZN7WebCore14SVGSMILElement17connectConditionsEv
+__ZN7WebCore19SVGAnimationElement21startedActiveIntervalEv
+__ZNK7WebCore19SVGAnimationElement14hasValidTargetEv
+__ZNK7WebCore19SVGAnimationElement13animationModeEv
+__ZNK7WebCore19SVGAnimationElement13animationPathEv
+__ZNK7WebCore19SVGAnimationElement8calcModeEv
+__ZNK7WebCore14SVGSMILElement34calculateAnimationPercentAndRepeatENS_8SMILTimeERj
+__ZN7WebCoremiERKNS_8SMILTimeES2_
+__ZN7WebCore14SVGSMILElement12checkRestartENS_8SMILTimeE
+__ZNK7WebCore14SVGSMILElement7restartEv
+__ZNK7WebCore14SVGSMILElement20determineActiveStateENS_8SMILTimeE
+__ZNK7WebCore14SVGSMILElement14isContributingENS_8SMILTimeE
+__ZNK7WebCore14SVGSMILElement4fillEv
+__ZN7WebCore19SVGAnimationElement15updateAnimationEfjPNS_14SVGSMILElementE
+__ZNK7WebCore19SVGAnimationElement31currentValuesForValuesAnimationEfRfRNS_6StringES3_
+__ZN7WebCore17SVGAnimateElement24calculateFromAndToValuesERKNS_6StringES3_
+__ZN7WebCore17SVGAnimateElement22calculateAnimatedValueEfjPNS_14SVGSMILElementE
+__ZNK7WebCore19SVGAnimationElement13isAccumulatedEv
+__ZNK7WebCore19SVGAnimationElement10isAdditiveEv
+__ZNK7WebCore14SVGSMILElement25calculateNextProgressTimeENS_8SMILTimeE
+__ZN3WTF6VectorIPN7WebCore14SVGSMILElementELm0EE14expandCapacityEmPKS3_
+__ZSt16__introsort_loopIPPN7WebCore14SVGSMILElementElPFbS2_S2_EEvT_S6_T0_T1_
+__ZSt22__final_insertion_sortIPPN7WebCore14SVGSMILElementEPFbS2_S2_EEvT_S6_T0_
+__ZSt16__insertion_sortIPPN7WebCore14SVGSMILElementEPFbS2_S2_EEvT_S6_T0_
+__ZN7WebCore17SVGAnimateElement20applyResultsToTargetEv
+__ZN7WebCore19SVGAnimationElement31setTargetAttributeAnimatedValueERKNS_6StringE
+__ZN7WebCore16SVGStyledElement25setInstanceUpdatesBlockedEb
+__ZN3WTF7HashSetIPKN7WebCore16SVGStyledElementENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableIPKN7WebCore16SVGStyledElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6expa
+__ZN3WTF9HashTableIPKN7WebCore16SVGStyledElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6reha
+__ZN3WTF9HashTableIPKN7WebCore16SVGStyledElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E13all
+__ZN3WTF9HashTableIPKN7WebCore16SVGStyledElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E15dea
+__ZNK7WebCore19SVGAnimationElement20targetAttributeIsCSSEv
+__ZNK7WebCore19SVGAnimationElement13attributeTypeEv
+__ZN3WTF9HashTableIPKN7WebCore16SVGStyledElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E4find
+__ZN3WTF9HashTableIPKN7WebCore16SVGStyledElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E47rem
+__ZN3WTF9HashTableIPKN7WebCore16SVGStyledElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6remo
+__ZNK7WebCore17SMILTimeContainer7elapsedEv
+__ZN3WTF6VectorIPN7WebCore14SVGSMILElementELm0EE6shrinkEm
+__ZNK7WebCore8SVGImage4sizeEv
+__ZNK7WebCore11SVGDocument11rootElementEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_15widthAttrStr
+__ZNK7WebCore19SVGAnimatedPropertyINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_16heightAttrSt
+__ZNK7WebCore9SVGLength8unitTypeEv
+__ZNK7WebCore13SVGSVGElement18relativeWidthValueEv
+__ZNK7WebCore9SVGLength17valueAsPercentageEv
+__ZNK7WebCore9SVGLength21valueInSpecifiedUnitsEv
+__ZNK7WebCore13SVGSVGElement19relativeHeightValueEv
+__ZN7WebCore8SVGImage16setContainerSizeERKNS_7IntSizeE
+__ZNK7WebCore8SVGImage16hasRelativeWidthEv
+__ZNK7WebCore8SVGImage17hasRelativeHeightEv
+__ZN7WebCore8SVGImage4drawEPNS_15GraphicsContextERKNS_9FloatRectES5_NS_17CompositeOperatorE
+__ZN7WebCore9FrameView15contentsResizedEv
+__ZN7WebCore10ScrollView17frameRectsChangedEv
+__ZNK7WebCore13SVGSVGElement17hasRelativeValuesEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_11xAttrStringE
 __ZNK7WebCore22SVGPreserveAspectRatio11meetOrSliceEv
-__ZNK7WebCore14SVGLineElement10toPathDataEv
-__ZNK7WebCore14SVGLineElement2y2Ev
-__ZNK7WebCore14SVGLineElement2x2Ev
-__ZNK7WebCore14SVGLineElement2y1Ev
-__ZNK7WebCore14SVGLineElement2x1Ev
-__ZN7WebCore4Path10createLineERKNS_10FloatPointES3_
-__ZN7WebCore27cummulatedHeightOfTextChunkERNS_12SVGTextChunkE
-__ZN7WebCore41cummulatedHeightOfInlineBoxCharacterRangeERNS_26SVGInlineBoxCharacterRangeE
-__ZNK7WebCore11SVGDocument13isSVGDocumentEv
-__ZN7WebCore21SVGPathSegListBuilder12svgClosePathEv
-__ZN7WebCore14SVGPathElement25createSVGPathSegClosePathEv
-__ZN7WebCore19SVGPathSegClosePathC1Ev
-__ZN7WebCore10SVGElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZNK7WebCore19SVGPathSegClosePath11pathSegTypeEv
-__ZN7WebCore15fontConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGFontElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore14SVGFontElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore20font_faceConstructorEPNS_8DocumentEb
-__ZN7WebCore18SVGFontFaceElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore8Document18mappedElementSheetEv
-__ZN7WebCore18SVGFontFaceElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore32cssPropertyIdForSVGAttributeNameERKNS_13QualifiedNameE
-__ZN7WebCore18SVGFontFaceElement15rebuildFontFaceEv
-__ZN7WebCore18SVGFontFaceElement20insertedIntoDocumentEv
-__ZNK7WebCore18SVGFontFaceElement10fontFamilyEv
-__ZN7WebCore16glyphConstructorEPNS_8DocumentEb
-__ZN7WebCore15SVGGlyphElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore15SVGGlyphElement20insertedIntoDocumentEv
-__ZN7WebCore14SVGFontElement15addGlyphToCacheEPNS_15SVGGlyphElementE
-__ZNK7WebCore15SVGGlyphElement20buildGlyphIdentifierEv
-__ZN7WebCore15SVGGlyphElement27buildGenericGlyphIdentifierEPKNS_10SVGElementE
-__ZN7WebCore15pathFromSVGDataERNS_4PathERKNS_6StringE
-__ZN7WebCore11PathBuilder9svgMoveToEddbb
-__ZN7WebCore11PathBuilder9svgLineToEddb
-__ZN7WebCore11PathBuilder12svgClosePathEv
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS_6VectorINS1_18SVGGlyphIdentifierELm0EEEENS_18PairFirstExtractorIS8_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E4findIS3_NS_22IdentityHashTranslatorIS3_S8_SB_EEEENS_17HashTableIteratorIS3_S8_SA_SB_SG_SE_EERKT_
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE15reserveCapacityEm
-__ZN3WTF7HashMapIN7WebCore6StringENS_6VectorINS1_18SVGGlyphIdentifierELm0EEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3addERKS2_RKS5_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS_6VectorINS1_18SVGGlyphIdentifierELm0EEEENS_18PairFirstExtractorIS8_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E3addINS1_6StringES7_NS_17HashMapTranslatorILb0ES4_ISJ_S7_ENS_18PairBaseHashTraitsINSD_ISJ_EESF_EESG_SB_EEEES4_INS_17HashTableIteratorIS3_S8_SA_SB_SG_SE_EEbERKT_RKT0_
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EEC1ERKS3_
-__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS_6VectorINS1_18SVGGlyphIdentifierELm0EEEENS_18PairFirstExtractorIS8_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E47removeAndInvalidateWithoutEntryConsistencyCheckEPS8_
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EEaSERKS3_
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE6shrinkEm
-__ZN3WTF7HashMapIiPN7WebCore14SimpleFontDataENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3setERKiRKS3_
-__ZNK7WebCore17CSSFontFaceSource8isLoadedEv
-__ZN7WebCore11SVGFontDataC1EPNS_18SVGFontFaceElementE
-__ZNK7WebCore18SVGFontFaceElement17horizontalOriginXEv
-__ZNK7WebCore18SVGFontFaceElement17horizontalOriginYEv
-__ZNK7WebCore18SVGFontFaceElement18horizontalAdvanceXEv
-__ZNK7WebCore6String7toFloatEPb
-__ZN7WebCore10StringImpl7toFloatEPb
-__ZNK7WebCore18SVGFontFaceElement15verticalOriginXEv
-__ZNK7WebCore18SVGFontFaceElement15verticalOriginYEv
-__ZNK7WebCore18SVGFontFaceElement6ascentEv
-__ZNK7WebCore18SVGFontFaceElement10unitsPerEmEv
-__ZNK7WebCore18SVGFontFaceElement16verticalAdvanceYEv
-__ZNK7WebCore18SVGFontFaceElement7descentEv
-__ZNK7WebCore18SVGFontFaceElement7xHeightEv
-__ZNK7WebCore4Font22floatWidthUsingSVGFontERKNS_7TextRunE
-__ZN7WebCore33floatWidthOfSubStringUsingSVGFontEPKNS_4FontERKNS_7TextRunEii
-__ZNK7WebCore18SVGFontFaceElement21associatedFontElementEv
-__ZN7WebCore16SVGTextRunWalkerINS_34SVGTextRunWalkerMeasuredLengthDataEE4walkERKNS_7TextRunEbRKNS_6StringEii
-__ZN7WebCore24charactersWithArabicFormERKNS_6StringEb
-__ZNK7WebCore14SVGFontElement25glyphIdentifiersForStringERKNS_6StringE
-__ZNK3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_NS_6VectorINS1_18SVGGlyphIdentifierELm0EEEENS_18PairFirstExtractorIS8_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTraitsIS3_EENSD_IS7_EEEESE_E4findIS3_NS_22IdentityHashTranslatorIS3_S8_SB_EEEENS_22HashTableConstIteratorIS3_S8_SA_SB_SG_SE_EERKT_
-__ZN7WebCore15SVGGlyphElement28inheritUnspecifiedAttributesERNS_18SVGGlyphIdentifierEPKNS_11SVGFontDataE
-__ZN7WebCore30floatWidthUsingSVGFontCallbackERKNS_18SVGGlyphIdentifierERNS_34SVGTextRunWalkerMeasuredLengthDataE
-__ZNK7WebCore14SVGFontElement24firstMissingGlyphElementEv
-__ZN7WebCore30floatWidthMissingGlyphCallbackERKNS_7TextRunERNS_34SVGTextRunWalkerMeasuredLengthDataE
-__ZNK7WebCore4Font12fontSelectorEv
-__ZN7WebCore18ellipseConstructorEPNS_8DocumentEb
-__ZN7WebCore17SVGEllipseElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore17SVGEllipseElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore17SVGEllipseElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore17SVGEllipseElement14setCxBaseValueENS_9SVGLengthE
-__ZN7WebCore17SVGEllipseElement5setCxENS_9SVGLengthE
-__ZN7WebCore17SVGEllipseElement14setCyBaseValueENS_9SVGLengthE
-__ZN7WebCore17SVGEllipseElement5setCyENS_9SVGLengthE
-__ZN7WebCore17SVGEllipseElement14setRxBaseValueENS_9SVGLengthE
-__ZN7WebCore17SVGEllipseElement5setRxENS_9SVGLengthE
-__ZNK7WebCore17SVGEllipseElement2rxEv
-__ZN7WebCore17SVGEllipseElement14setRyBaseValueENS_9SVGLengthE
-__ZN7WebCore17SVGEllipseElement5setRyENS_9SVGLengthE
-__ZNK7WebCore17SVGEllipseElement2ryEv
-__ZNK7WebCore17SVGEllipseElement7isValidEv
-__ZNK7WebCore17SVGEllipseElement10toPathDataEv
-__ZNK7WebCore17SVGEllipseElement2cyEv
-__ZNK7WebCore17SVGEllipseElement2cxEv
-__ZN7WebCore4Path13createEllipseERKNS_10FloatPointEff
-__ZN7WebCore12aConstructorEPNS_8DocumentEb
-__ZN7WebCore11SVGAElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore20SVGImageChromeClient7repaintERKNS_7IntRectEbbb
+__ZThn392_N7WebCore11CachedImage13changedInRectEPKNS_5ImageERKNS_7IntRectE
+__ZN7WebCore11CachedImage13changedInRectEPKNS_5ImageERKNS_7IntRectE
+__ZNK7WebCore18RenderSVGContainer29repaintRectInLocalCoordinatesEv
+__ZN7WebCore30BoundingRectStrokeStyleApplier11strokeStyleEPNS_15GraphicsContextE
+__ZN7WebCore25applyStrokeStyleToContextEPNS_15GraphicsContextEPNS_11RenderStyleEPKNS_12RenderObjectE
+__ZN7WebCore14SVGRenderStyle20cssPrimitiveToLengthEPKNS_12RenderObjectEPNS_8CSSValueEf
+__ZN7WebCore27dashArrayFromRenderingStyleEPKNS_11RenderStyleE
+__ZN7WebCore15GraphicsContext11setLineDashERKN3WTF6VectorIdLm0EEEf
+__ZNK7WebCore31RenderSVGTransformableContainer22localToParentTransformEv
+__ZN7WebCore18RenderSVGContainer5paintERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore18RenderSVGContainer13drawsContentsEv
+__ZN7WebCore18RenderSVGContainer17applyViewportClipERNS_12RenderObject9PaintInfoE
+__ZNK7WebCore14SVGLineElement15supportsMarkersEv
+__ZNK7WebCore10RenderPath19drawMarkersIfNeededEPNS_15GraphicsContextERKNS_9FloatRectERKNS_4PathE
+__ZN7WebCore13getMarkerByIdEPNS_8DocumentERKNS_12AtomicStringE
+__ZN7WebCore5TimerINS_17SMILTimeContainerEE5firedEv
+__ZN7WebCore17SMILTimeContainer10timerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore14SVGSMILElement19resolveNextIntervalEv
+__ZN7WebCore19SVGAnimationElement19endedActiveIntervalEv
+__ZN7WebCore20RenderSVGModelObject29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore13SVGRenderBase29clippedOverflowRectForRepaintEPNS_12RenderObjectEPNS_20RenderBoxModelObjectE
+__ZN7WebCore20RenderSVGModelObject21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZN7WebCore13SVGRenderBase21computeRectForRepaintEPNS_12RenderObjectEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZNK7WebCore20RenderSVGModelObject23outlineBoundsForRepaintEPNS_20RenderBoxModelObjectE
+__ZNK7WebCore20RenderSVGModelObject19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore13SVGRenderBase19mapLocalToContainerEPKNS_12RenderObjectEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore16CSSStyleSelector11mapFillClipEPNS_9FillLayerEPNS_8CSSValueE
+__ZN7WebCore15GraphicsContext17clipToImageBufferERKNS_9FloatRectEPKNS_11ImageBufferE
+__ZN7WebCore11BitmapImage13getCGImageRefEv
+__ZN7WebCore5Image14resetAnimationEv
+__ZN7WebCore16CSSStyleSelector16mapFillCompositeEPNS_9FillLayerEPNS_8CSSValueE
+__ZN7WebCore9FillLayer7setNextEPS0_
+__ZN7WebCore16CSSStyleSelector13mapFillOriginEPNS_9FillLayerEPNS_8CSSValueE
+__ZN7WebCore9FillLayer15cullEmptyLayersEv
+__ZN7WebCore9FillLayer19fillUnsetPropertiesEv
+__ZN7WebCore13SVGZoomAndPan15parseZoomAndPanERPKtS2_
+__ZN7WebCore13SVGZoomAndPan13setZoomAndPanEt
+__ZN7WebCoreL17scriptConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore16SVGScriptElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore16SVGScriptElementC2ERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore15SVGURIReferenceC2Ev
-__ZN7WebCore11SVGAElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore15SVGURIReference20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore11SVGAElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCore16SVGScriptElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore16SVGScriptElement7setTypeERKNS_6StringE
+__ZN7WebCore16SVGScriptElement19svgAttributeChangedERKNS_13QualifiedNameE
 __ZN7WebCore15SVGURIReference16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore15SVGURIReference16setHrefBaseValueENS_6StringE
-__ZNK7WebCore11SVGAElement14contextElementEv
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapINS_6StringEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS4_IPNS_10StringImplET_NS_10StringHashENS3_10HashTraitsIS9_EENSC_ISA_EEEENS3_7PtrHashIS7_EENSC_IS7_EENSC_ISG_EEEEvE14s_baseValueMap
-__ZN7WebCore15SVGURIReference7setHrefENS_6StringE
-__ZNK7WebCore11SVGAElement4hrefEv
-__ZNK7WebCore15SVGURIReference4hrefEv
-__ZN7WebCore11SVGAElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZNK7WebCore21SVGTextContentElement13isTextContentEv
-__ZN7WebCore15RenderSVGInlineC1EPNS_4NodeE
-__ZN7WebCore15RenderSVGInline13requiresLayerEv
-__ZNK7WebCore11SVGAElement25childShouldCreateRendererEPNS_4NodeE
-__ZN7WebCore11SVGAElement19defaultEventHandlerEPNS_5EventE
-__ZN7WebCore15RenderSVGInline15createInlineBoxEbbb
-__ZN7WebCore22SVGCharacterLayoutInfo14processedChunkEff
-__ZN7WebCore16styleConstructorEPNS_8DocumentEb
-__ZN7WebCore15SVGStyleElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore15SVGStyleElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore15SVGStyleElement20insertedIntoDocumentEv
+__ZN7WebCore16SVGScriptElement20insertedIntoDocumentEv
+__ZNK7WebCore16SVGScriptElement20sourceAttributeValueEv
 __ZN7WebCore10SVGElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore15SVGStyleElement15childrenChangedEb
-__ZThn72_NK7WebCore15SVGStyleElement4typeEv
-__ZNK7WebCore15SVGStyleElement4typeEv
-__ZThn72_NK7WebCore15SVGStyleElement5mediaEv
-__ZNK7WebCore15SVGStyleElement5mediaEv
-__ZN7WebCore12StyleElement10setLoadingEb
-__ZNK7WebCore15SVGStyleElement5titleEv
-__ZN7WebCore15SVGStyleElement11sheetLoadedEv
-__ZN7WebCore15SVGStyleElement5sheetEv
-__ZN7WebCore15SVGStyleElement21finishParsingChildrenEv
-__ZN7WebCore9CSSParser23parseSVGStrokeDasharrayEv
-__ZN7WebCore14SVGRectElement14setRxBaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGRectElement5setRxENS_9SVGLengthE
-__ZNK7WebCore14SVGRectElement2rxEv
+__ZN7WebCore16SVGScriptElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore16SVGScriptElement21finishParsingChildrenEv
+__ZN7WebCore16SVGScriptElement27haveLoadedRequiredResourcesEv
+__ZThn240_NK7WebCore16SVGScriptElement14contextElementEv
+__ZNK7WebCore16SVGScriptElement14contextElementEv
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEbNS1_10StringHashENS_10HashTraitsIS6_EENS8_IbEEEENS_7PtrHashI
+__ZThn288_NK7WebCore16SVGScriptElement20sourceAttributeValueEv
+__ZThn288_NK7WebCore16SVGScriptElement13scriptContentEv
+__ZNK7WebCore16SVGScriptElement13scriptContentEv
+__ZN7WebCoreL17circleConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore16SVGCircleElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19SVGAnimatedPropertyINS_16SVGCircleElementENS_9SVGLengthEXadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_11rAttrSt
+__ZN7WebCore16SVGCircleElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore16SVGCircleElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore16SVGCircleElement7isValidEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_12rxAttrStri
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_12ryAttrStri
 __ZN7WebCore4Path22createRoundedRectangleERKNS_9FloatRectERKNS_9FloatSizeE
-__ZN7WebCore25linearGradientConstructorEPNS_8DocumentEb
+__ZNK7WebCore16SVGCircleElement10toPathDataEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGCircleElementENS_9SVGLengthEXadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_11rAttrS
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGCircleElementENS_9SVGLengthEXadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_12cyAttr
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGCircleElementENS_9SVGLengthEXadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_12cxAttr
+__ZN7WebCore4Path12createCircleERKNS_10FloatPointEf
+__ZN7WebCore4Path13createEllipseERKNS_10FloatPointEff
+__ZN7WebCoreL36calculateTextAnchorShiftForTextChunkERNS_12SVGTextChunkENS_11ETextAnchorE
+__ZN7WebCoreL26cummulatedWidthOfTextChunkERNS_12SVGTextChunkE
+__ZN7WebCoreL34cummulatedWidthOrHeightOfTextChunkERNS_12SVGTextChunkEb
+__ZN7WebCore40cummulatedWidthOfInlineBoxCharacterRangeERNS_26SVGInlineBoxCharacterRangeE
+__ZNK7WebCore19SVGAnimatedPropertyINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_11yAttrStringE
+__ZN7WebCore10SVGElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL15pathConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGPathElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19SVGAnimatedPathDataC2Ev
+__ZN7WebCore14SVGPathElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore14SVGPathElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCoreL25lineargradientConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore24SVGLinearGradientElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore24SVGLinearGradientElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore18SVGGradientElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore24SVGLinearGradientElement14setX2BaseValueENS_9SVGLengthE
-__ZN7WebCore24SVGLinearGradientElement5setX2ENS_9SVGLengthE
+__ZN7WebCore19SVGAnimatedPropertyINS_24SVGLinearGradientElementENS_9SVGLengthEXadL_ZNS_8SVGNames23linearGradientTagStringEEEXad
 __ZN7WebCore24SVGLinearGradientElement20parseMappedAttributeEPNS_15MappedAttributeE
 __ZN7WebCore18SVGGradientElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15SVGURIReference20parseMappedAttributeEPNS_15MappedAttributeE
 __ZN7WebCore24SVGLinearGradientElement19svgAttributeChangedERKNS_13QualifiedNameE
 __ZN7WebCore18SVGGradientElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore18SVGGradientElement25setGradientUnitsBaseValueEi
-__ZN7WebCore18SVGGradientElement16setGradientUnitsEi
-__ZN7WebCore24SVGLinearGradientElement14setX1BaseValueENS_9SVGLengthE
-__ZN7WebCore24SVGLinearGradientElement5setX1ENS_9SVGLengthE
-__ZN7WebCore24SVGLinearGradientElement14setY1BaseValueENS_9SVGLengthE
-__ZN7WebCore24SVGLinearGradientElement5setY1ENS_9SVGLengthE
-__ZN7WebCore24SVGLinearGradientElement14setY2BaseValueENS_9SVGLengthE
-__ZN7WebCore24SVGLinearGradientElement5setY2ENS_9SVGLengthE
-__ZN7WebCore18SVGGradientElement24setSpreadMethodBaseValueEi
-__ZN7WebCore18SVGGradientElement15setSpreadMethodEi
-__ZN7WebCore18SVGGradientElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore18SVGGradientElement15childrenChangedEb
-__ZN7WebCore15stopConstructorEPNS_8DocumentEb
+__ZN7WebCore18SVGGradientElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCoreL15stopConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore14SVGStopElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGStopElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19SVGAnimatedPropertyINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEEEC1If
+__ZN7WebCore19SVGAnimatedPropertyINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEEEC2If
 __ZN7WebCore14SVGStopElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore8SVGColorC1ERKNS_6StringE
+__ZN7WebCore19SVGAnimatedPropertyINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEEE12se
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEEE12o
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEfNS1_10StringHashENS_10HashTraitsIS6_EENS8_IfEEEENS_7PtrHashI
+__ZN7WebCore9CSSParser13parseSVGColorEv
+__ZN7WebCore8SVGColorC1ERKNS_5ColorE
+__ZN7WebCoreL25radialgradientConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore24SVGRadialGradientElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore24SVGRadialGradientElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19SVGAnimatedPropertyINS_24SVGRadialGradientElementENS_9SVGLengthEXadL_ZNS_8SVGNames23radialGradientTagStringEEEXad
+__ZN7WebCore24SVGRadialGradientElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore24SVGRadialGradientElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEiNS1_10StringHashENS_10HashTraitsIS6_EENS8_IiEEEENS_7PtrHashI
+__ZN7WebCore8SVGPaintC1ENS0_12SVGPaintTypeERKNS_6StringES4_S4_
+__ZN7WebCore8SVGPaintC2ENS0_12SVGPaintTypeERKNS_6StringES4_S4_
+__ZN7WebCore8SVGColorC2ERKNS_6StringE
 __ZN7WebCore8SVGColor11setRGBColorERKNS_6StringERi
 __ZN7WebCore8SVGColor23colorFromRGBColorStringERKNS_6StringE
-__ZN7WebCore14SVGStopElement18setOffsetBaseValueEf
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapIfEEPN3WTF7HashMapIPKNS_10SVGElementEPNS3_IPNS_10StringImplET_NS_10StringHashENS2_10HashTraitsIS8_EENSB_IS9_EEEENS2_7PtrHashIS6_EENSB_IS6_EENSB_ISF_EEEEvE14s_baseValueMap
-__ZN7WebCore14SVGStopElement9setOffsetEf
-__ZNK7WebCore8SVGColor9colorTypeEv
-__ZN7WebCore13StyleStopDataC1ERKS0_
-__ZN7WebCore14SVGStopElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore21RenderSVGGradientStopC1EPNS_14SVGStopElementE
-__ZN7WebCore21RenderSVGGradientStop8setStyleEPNS_11RenderStyleE
-__ZNK7WebCore21RenderSVGGradientStop15gradientElementEv
-__ZN7WebCore18SVGGradientElement14canvasResourceEv
-__ZNK7WebCore24SVGLinearGradientElement12gradientTypeEv
-__ZN7WebCore28SVGPaintServerLinearGradientC1EPKNS_18SVGGradientElementE
-__ZN7WebCore22SVGPaintServerGradientC2EPKNS_18SVGGradientElementE
-__ZN7WebCore22SVGPaintServerGradient10invalidateEv
-__ZN7WebCore11SVGResource10invalidateEv
-__ZN7WebCore8SVGPaintC1ENS0_12SVGPaintTypeERKNS_6StringES4_S4_
 __ZN7WebCore8SVGPaint6setUriERKNS_6StringE
-__ZNK7WebCore13StyleStopDataeqERKS0_
+__ZNK7WebCore14SVGPathElement11pathSegListEv
+__ZN7WebCore14SVGPathSegListC1ERKNS_13QualifiedNameE
+__ZN7WebCore14SVGPathSegListC2ERKNS_13QualifiedNameE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE14shrinkCapacityEm
+__ZN7WebCore22pathSegListFromSVGDataEPNS_14SVGPathSegListERKNS_6StringEb
+__ZN7WebCore13SVGPathParser8parseSVGERKNS_6StringEb
+__ZN7WebCoreL11parseNumberERPKtS1_Rdb
+__ZN7WebCore21SVGPathSegListBuilder9svgMoveToEddbb
+__ZN7WebCore14SVGPathElement25createSVGPathSegMovetoAbsEff
+__ZN7WebCore19SVGPathSegMovetoAbsC1Eff
+__ZN7WebCore19SVGPathSegMovetoAbsC2Eff
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE15reserveCapacityEm
+__ZN7WebCore21SVGPathSegListBuilder9svgLineToEddb
+__ZN7WebCore14SVGPathElement25createSVGPathSegLinetoAbsEff
+__ZN7WebCore19SVGPathSegLinetoAbsC1Eff
+__ZN7WebCore19SVGPathSegLinetoAbsC2Eff
+__ZN7WebCore21SVGPathSegListBuilder12svgClosePathEv
+__ZN7WebCore14SVGPathElement25createSVGPathSegClosePathEv
+__ZN7WebCore19SVGPathSegClosePathC1Ev
+__ZN7WebCore19SVGPathSegClosePathC2Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10SVGPathSegEEELm0EE6shrinkEm
+__ZNK7WebCore14SVGPathElement7isValidEv
 __ZNK7WebCore8SVGPaint3uriEv
-__ZN7WebCore21RenderSVGGradientStop6layoutEv
-__ZN7WebCore24missing_glyphConstructorEPNS_8DocumentEb
-__ZN7WebCore22SVGMissingGlyphElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore16SVGCircleElement7isValidEv
-__ZNK7WebCore16SVGCircleElement10toPathDataEv
-__ZNK7WebCore16SVGCircleElement2cyEv
-__ZNK7WebCore16SVGCircleElement2cxEv
-__ZN7WebCore4Path12createCircleERKNS_10FloatPointEf
-__ZN7WebCore11PathBuilder15svgCurveToCubicEddddddb
-__ZN7WebCore12SVGTransform8setScaleEff
-__ZN7WebCore16imageConstructorEPNS_8DocumentEb
-__ZN7WebCore15SVGImageElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore14SVGImageLoaderC1EPNS_15SVGImageElementE
-__ZN7WebCore15SVGImageElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore15SVGImageElement13setXBaseValueENS_9SVGLengthE
-__ZN7WebCore15SVGImageElement4setXENS_9SVGLengthE
-__ZN7WebCore15SVGImageElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore15SVGImageElement13setYBaseValueENS_9SVGLengthE
-__ZN7WebCore15SVGImageElement4setYENS_9SVGLengthE
-__ZN7WebCore15SVGImageElement17setWidthBaseValueENS_9SVGLengthE
-__ZN7WebCore15SVGImageElement8setWidthENS_9SVGLengthE
-__ZNK7WebCore15SVGImageElement5widthEv
-__ZN7WebCore15SVGImageElement18setHeightBaseValueENS_9SVGLengthE
-__ZN7WebCore15SVGImageElement9setHeightENS_9SVGLengthE
-__ZNK7WebCore15SVGImageElement6heightEv
-__ZThn116_NK7WebCore15SVGImageElement14contextElementEv
-__ZNK7WebCore15SVGImageElement14contextElementEv
-__ZN7WebCore15SVGImageElement6attachEv
-__ZNK7WebCore15SVGImageElement7isValidEv
-__ZN7WebCore15SVGImageElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore14RenderSVGImageC1EPNS_15SVGImageElementE
-__ZN7WebCore14RenderSVGImage13requiresLayerEv
-__ZN7WebCore14SVGImageLoader17updateFromElementEv
-__ZNK7WebCore15SVGImageElement4hrefEv
-__ZN7WebCore15SVGImageElement27haveLoadedRequiredResourcesEv
-__ZNK7WebCore15SVGImageElement34externalResourcesRequiredBaseValueEv
-__ZNK7WebCore28SVGExternalResourcesRequired34externalResourcesRequiredBaseValueEv
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapIbEEPN3WTF7HashMapIPKNS_10SVGElementEPNS3_IPNS_10StringImplET_NS_10StringHashENS2_10HashTraitsIS8_EENSB_IS9_EEEENS2_7PtrHashIS6_EENSB_IS6_EENSB_ISF_EEEEvE14s_baseValueMap
-__ZNK7WebCore28SVGExternalResourcesRequired25externalResourcesRequiredEv
-__ZN7WebCore14setConstructorEPNS_8DocumentEb
-__ZN7WebCore13SVGSetElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore19SVGAnimationElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore19SVGAnimationElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore19SVGAnimationElement20parseBeginOrEndValueERdRKNS_6StringE
-__ZN7WebCore13SVGStringListC1ERKNS_13QualifiedNameE
-__ZN7WebCore13SVGStringList5parseERKNS_6StringEt
-__ZN7WebCore19SVGAnimationElement15parseClockValueERKNS_6StringE
-__ZN7WebCore19SVGAnimationElement12isIndefiniteEd
-__ZN7WebCore13SVGStringListD1Ev
-__ZN7WebCore19SVGAnimationElement21finishParsingChildrenEv
-__ZNK7WebCore10SVGElement15ownerSVGElementEv
-__ZNK7WebCore19SVGAnimationElement12getStartTimeEv
-__ZN7WebCore13TimeScheduler8addTimerEPNS_19SVGAnimationElementEj
-__ZNK7WebCore24RenderSVGHiddenContainer17absoluteTransformEv
-__ZN7WebCore14useConstructorEPNS_8DocumentEb
-__ZN7WebCore13SVGUseElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore13SVGUseElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZThn116_NK7WebCore13SVGUseElement14contextElementEv
-__ZNK7WebCore13SVGUseElement14contextElementEv
-__ZN7WebCore13SVGUseElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore13SVGUseElement20insertedIntoDocumentEv
-__ZN7WebCore13SVGUseElement20buildPendingResourceEv
-__ZNK7WebCore13SVGUseElement4hrefEv
-__ZN7WebCore18SVGElementInstanceC1EPNS_13SVGUseElementEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore21SVGDocumentExtensions20mapInstanceToElementEPNS_18SVGElementInstanceEPNS_10SVGElementE
-__ZN3WTF7HashSetIPN7WebCore18SVGElementInstanceENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore18SVGElementInstance14refEventTargetEv
-__ZN7WebCore13SVGUseElement17buildInstanceTreeEPNS_10SVGElementEPNS_18SVGElementInstanceERb
-__ZNK7WebCore13SVGUseElement1xEv
-__ZNK7WebCore13SVGUseElement1yEv
-__ZN7WebCore13SVGUseElement15buildShadowTreeEPNS_10SVGElementEPNS_18SVGElementInstanceE
-__ZN7WebCore19isDisallowedElementEPNS_4NodeE
-__ZNK7WebCore18SVGElementInstance20correspondingElementEv
-__ZN7WebCore32subtreeContainsDisallowedElementEPNS_4NodeE
-__ZN7WebCore13SVGUseElement29expandUseElementsInShadowTreeEPNS_4NodeE
-__ZN7WebCore13SVGUseElement32expandSymbolElementsInShadowTreeEPNS_4NodeE
-__ZN7WebCore13SVGUseElement40associateInstancesWithShadowTreeElementsEPNS_4NodeEPNS_18SVGElementInstanceE
-__ZN7WebCore18SVGElementInstance20setShadowTreeElementEPNS_10SVGElementE
-__ZNK7WebCore18SVGElementInstance10firstChildEv
-__ZN7WebCore13SVGUseElement16attachShadowTreeEv
-__ZN7WebCore13SVGUseElement6attachEv
-__ZNK7WebCore13SVGUseElement7isValidEv
-__ZN7WebCore13SVGUseElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore10SVGElement16shadowParentNodeEv
-__ZN7WebCore13SVGUseElement13setYBaseValueENS_9SVGLengthE
-__ZN7WebCore13SVGUseElement4setYENS_9SVGLengthE
-__ZN7WebCore18polygonConstructorEPNS_8DocumentEb
-__ZN7WebCore17SVGPolygonElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore14SVGPolyElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore17SVGAnimatedPointsC2Ev
-__ZN7WebCore14SVGPolyElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore14SVGPolyElement6pointsEv
-__ZN7WebCore12SVGPointListC1ERKNS_13QualifiedNameE
-__ZN7WebCore21pointsListFromSVGDataEPNS_12SVGPointListERKNS_6StringE
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE14expandCapacityEmPKS6_
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE14expandCapacityEm
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE15reserveCapacityEm
-__ZN7WebCore14SVGPolyElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZNK7WebCore14SVGPolyElement7isValidEv
-__ZN7WebCore14SVGPolyElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore19polylineConstructorEPNS_8DocumentEb
-__ZN7WebCore18SVGPolylineElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore13SVGUseElement11recalcStyleENS_4Node11StyleChangeE
-__ZNK7WebCore17SVGPolygonElement10toPathDataEv
-__ZNK7WebCore18SVGPolylineElement10toPathDataEv
-__ZN7WebCore20parseDelimitedStringERKNS_6StringEc
-__ZN7WebCore12SVGLangSpace10setXmllangERKNS_12AtomicStringE
-__ZN7WebCore13SVGUseElement13setXBaseValueENS_9SVGLengthE
-__ZN7WebCore13SVGUseElement4setXENS_9SVGLengthE
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifier10ArabicFormELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifier10ArabicFormELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifier10ArabicFormELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifier10ArabicFormELm0EE6shrinkEm
-__ZNK7WebCore11SVGAElement7isValidEv
-__ZNK7WebCore10SVGElement13isTextContentEv
-__ZN7WebCore17scriptConstructorEPNS_8DocumentEb
-__ZN7WebCore16SVGScriptElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore22JSSVGLazyEventListener18eventParameterNameEv
-__ZNK7WebCore17JSEventTargetNode21pushEventHandlerScopeEPN3KJS9ExecStateERNS1_10ScopeChainE
-__ZN7WebCore22JSSVGDocumentPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore13JSSVGDocumentC1EPN3KJS8JSObjectEPNS_11SVGDocumentE
-__ZN7WebCore13JSSVGDocument18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore22JSSVGDocumentPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore13JSSVGDocument9classInfoEv
-__ZN7WebCore55jsSVGTextContentElementPrototypeFunctionSelectSubStringEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore12JSSVGElement4implEv
-__ZNK7WebCore21SVGTextContentElement15selectSubStringEllRi
-__ZNK7WebCore21SVGTextContentElement16getNumberOfCharsEv
-__ZNK7WebCore13RenderSVGText9isSVGTextEv
-__ZNK7WebCore16SVGRootInlineBox13svgTextChunksEv
-__ZN7WebCore29findInlineTextBoxInTextChunksEPKNS_21SVGTextContentElementERKN3WTF6VectorINS_12SVGTextChunkELm0EEE
-__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE15reserveCapacityEm
-__ZN7WebCore18SVGTextChunkWalkerINS_27SVGInlineTextBoxQueryWalkerEEclEPNS_16SVGInlineTextBoxEiRKNS_15AffineTransformERKPNS_7SVGCharESB_
-__ZN7WebCore27SVGInlineTextBoxQueryWalker20chunkPortionCallbackEPNS_16SVGInlineTextBoxEiRKNS_15AffineTransformERKPNS_7SVGCharES9_
-__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE6shrinkEm
-__ZN7WebCore19RenderSVGInlineText13selectionRectEb
-__ZNK7WebCore12RenderObject20isSVGHiddenContainerEv
-__ZN7WebCore19RenderSVGInlineText27computeAbsoluteRectForRangeEii
-__ZN7WebCore17findSVGRootObjectEPNS_12RenderObjectE
-__ZN7WebCore16tspanConstructorEPNS_8DocumentEb
-__ZN7WebCore15SVGTSpanElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore15SVGTSpanElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore14RenderSVGTSpanC1EPNS_4NodeE
-__ZNK7WebCore15SVGTSpanElement25childShouldCreateRendererEPNS_4NodeE
-__ZN7WebCore25radialGradientConstructorEPNS_8DocumentEb
-__ZN7WebCore24SVGRadialGradientElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore24SVGRadialGradientElement14setCxBaseValueENS_9SVGLengthE
-__ZN7WebCore24SVGRadialGradientElement5setCxENS_9SVGLengthE
-__ZN7WebCore24SVGRadialGradientElement14setCyBaseValueENS_9SVGLengthE
-__ZN7WebCore24SVGRadialGradientElement5setCyENS_9SVGLengthE
-__ZN7WebCore24SVGRadialGradientElement13setRBaseValueENS_9SVGLengthE
-__ZN7WebCore24SVGRadialGradientElement4setRENS_9SVGLengthE
-__ZN7WebCore24SVGRadialGradientElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore24SVGRadialGradientElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore24SVGRadialGradientElement14setFxBaseValueENS_9SVGLengthE
-__ZN7WebCore24SVGRadialGradientElement5setFxENS_9SVGLengthE
-__ZN7WebCore24SVGRadialGradientElement14setFyBaseValueENS_9SVGLengthE
-__ZN7WebCore24SVGRadialGradientElement5setFyENS_9SVGLengthE
-__ZNK7WebCore24SVGRadialGradientElement1rEv
-__ZNK7WebCore24SVGRadialGradientElement12gradientTypeEv
-__ZN7WebCore28SVGPaintServerRadialGradientC1EPKNS_18SVGGradientElementE
-__ZN7WebCore9CSSParser13parseSVGColorEv
-__ZN7WebCore8SVGColorC2ERKNS_5ColorE
-__ZNK7WebCore24SVGRadialGradientElement14contextElementEv
-__ZNK7WebCore4Font10unitsPerEmEv
-__ZN7WebCore23angleToGlyphOrientationEf
-__ZN7WebCore8SVGColorC1Et
-__ZN7WebCore13StyleMiscDataC1ERKS0_
-__ZNK7WebCore13StyleMiscDataeqERKS0_
-__ZNK7WebCore16DeprecatedString8toDoubleEPb
-__ZN7WebCore12SVGLangSpace11setXmlspaceERKNS_12AtomicStringE
-__ZNK7WebCore19SVGAnimationElement7isValidEv
-__ZN7WebCore18SVGElementInstance11appendChildEN3WTF10PassRefPtrIS0_EE
-__ZN7WebCore18SVGElementInstance16derefEventTargetEv
-__ZNK7WebCore18SVGElementInstance11nextSiblingEv
-__ZN7WebCore13SVGUseElement15childrenChangedEb
-__ZN7WebCore21SVGDocumentExtensions21removeInstanceMappingEPNS_18SVGElementInstanceEPNS_10SVGElementE
-__ZN7WebCore12SVGPointListD1Ev
-__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE6shrinkEm
-__ZN7WebCore14SVGImageLoaderD0Ev
-__ZN7WebCore15SVGURIReferenceD0Ev
-__ZN7WebCore14RenderSVGImage27absoluteClippedOverflowRectEv
-__ZNK7WebCore25SVGTextPositioningElement15rotateBaseValueEv
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapIPNS_13SVGNumberListEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS5_IPNS_10StringImplET_NS_10StringHashENS4_10HashTraitsISA_EENSD_ISB_EEEENS4_7PtrHashIS8_EENSD_IS8_EENSD_ISH_EEEEvE14s_baseValueMap
-__ZN7WebCore13SVGNumberList5parseERKNS_6StringE
-__ZNK7WebCore22SVGCharacterLayoutInfo14angleValueNextEv
-__ZNK7WebCore15SVGImageElement28preserveAspectRatioBaseValueEv
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapIPNS_22SVGPreserveAspectRatioEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS5_IPNS_10StringImplET_NS_10StringHashENS4_10HashTraitsISA_EENSD_ISB_EEEENS4_7PtrHashIS8_EENSD_IS8_EENSD_ISH_EEEEvE14s_baseValueMap
-__ZNK7WebCore15SVGImageElement19preserveAspectRatioEv
-__ZN7WebCore22SVGPreserveAspectRatio24parsePreserveAspectRatioERPKtS2_b
-__ZNK7WebCore15SVGFitToViewBox28preserveAspectRatioBaseValueEv
-__ZN7WebCore13SVGZoomAndPan15parseZoomAndPanERPKtS2_
-__ZN7WebCore13SVGZoomAndPan13setZoomAndPanEt
-__ZN7WebCore13SVGPathParser12calculateArcEbRdS1_dddddbb
-__ZN7WebCore18patternConstructorEPNS_8DocumentEb
-__ZN7WebCore17SVGPatternElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore17SVGPatternElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore17SVGPatternElement24setPatternUnitsBaseValueEi
-__ZN7WebCore17SVGPatternElement15setPatternUnitsEi
-__ZN7WebCore17SVGPatternElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore17SVGPatternElement13setXBaseValueENS_9SVGLengthE
-__ZN7WebCore17SVGPatternElement4setXENS_9SVGLengthE
-__ZN7WebCore17SVGPatternElement13setYBaseValueENS_9SVGLengthE
-__ZN7WebCore17SVGPatternElement4setYENS_9SVGLengthE
-__ZN7WebCore17SVGPatternElement17setWidthBaseValueENS_9SVGLengthE
-__ZN7WebCore17SVGPatternElement8setWidthENS_9SVGLengthE
-__ZNK7WebCore17SVGPatternElement5widthEv
-__ZN7WebCore17SVGPatternElement18setHeightBaseValueENS_9SVGLengthE
-__ZN7WebCore17SVGPatternElement9setHeightENS_9SVGLengthE
-__ZNK7WebCore17SVGPatternElement7isValidEv
-__ZN7WebCore17SVGPatternElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore18RenderSVGContainer16setDrawsContentsEb
-__ZN7WebCore17SVGPatternElement15childrenChangedEb
-__ZN7WebCore18RenderSVGContainer23calculateLocalTransformEv
-__ZNK7WebCore22SVGCharacterLayoutInfo22baselineShiftValueNextEv
-__ZN7WebCore16SVGScriptElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore16SVGScriptElement7setTypeERKNS_6StringE
-__ZN7WebCore13SVGSVGElement13setXBaseValueENS_9SVGLengthE
-__ZN7WebCore13SVGSVGElement4setXENS_9SVGLengthE
-__ZN7WebCore13SVGSVGElement13setYBaseValueENS_9SVGLengthE
-__ZN7WebCore13SVGSVGElement4setYENS_9SVGLengthE
-__ZNK7WebCore13SVGSVGElement7isValidEv
-__ZN7WebCore26RenderSVGViewportContainerC1EPNS_16SVGStyledElementE
-__ZN7WebCore19createCircleWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore27JSSVGCircleElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore18JSSVGCircleElementC1EPN3KJS8JSObjectEPNS_16SVGCircleElementE
-__ZN7WebCore45jsSVGTextElementPrototypeFunctionGetScreenCTMEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore14SVGTextElement12getScreenCTMEv
-__ZNK7WebCore16SVGTransformable12getScreenCTMEPKNS_10SVGElementE
-__ZN7WebCore12SVGLocatable12getScreenCTMEPKNS_10SVGElementE
-__ZNK7WebCore25SVGStyledLocatableElement17isStyledLocatableEv
-__ZNK7WebCore29SVGStyledTransformableElement12getScreenCTMEv
-__ZNK7WebCore13SVGSVGElement12getScreenCTMEv
-__ZNK7WebCore26RenderSVGViewportContainer17absoluteTransformEv
-__ZNK7WebCore26RenderSVGViewportContainer8viewportEv
-__ZNK7WebCore26RenderSVGViewportContainer17viewportTransformEv
-__ZN7WebCore26RenderSVGViewportContainer6layoutEv
-__ZN7WebCore26RenderSVGViewportContainer12calcViewportEv
-__ZNK7WebCore25SVGStyledLocatableElement12getScreenCTMEv
-__ZThn80_NK7WebCore29SVGStyledTransformableElement22animatedLocalTransformEv
-__ZThn152_NK7WebCore14SVGTextElement22animatedLocalTransformEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_19JSSVGPODTypeWrapperINS_15AffineTransformEEEPNS_10SVGElementE
-__ZN7WebCore20JSSVGMatrixPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore11JSSVGMatrixC1EPN3KJS8JSObjectEPNS_19JSSVGPODTypeWrapperINS_15AffineTransformEEEPNS_10SVGElementE
-__ZN7WebCore11JSSVGMatrix18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore11JSSVGMatrixEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore11JSSVGMatrix16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore34JSSVGPODTypeWrapperCreatorReadOnlyINS_15AffineTransformEEcvS1_Ev
-__ZNK7WebCore15AffineTransform1bEv
-__ZNK7WebCore15AffineTransform1cEv
-__ZN7WebCore39jsSVGTextElementPrototypeFunctionGetCTMEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore14SVGTextElement6getCTMEv
-__ZNK7WebCore16SVGTransformable6getCTMEPKNS_10SVGElementE
-__ZN7WebCore12SVGLocatable6getCTMEPKNS_10SVGElementE
-__ZNK7WebCore29SVGStyledTransformableElement6getCTMEv
-__ZNK7WebCore13SVGSVGElement6getCTMEv
-__ZN7WebCore54jsSVGTextElementPrototypeFunctionGetTransformToElementEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12toSVGElementEPN3KJS7JSValueE
-__ZNK7WebCore12SVGLocatable21getTransformToElementEPNS_10SVGElementERi
-__ZTv0_n28_NK7WebCore14SVGTextElement6getCTMEv
-__ZN7WebCore15AffineTransformmLERKS0_
-__ZN7WebCore18JSSVGCircleElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSSVGCircleElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore42jsSVGCircleElementPrototypeFunctionGetBBoxEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore18JSSVGCircleElement9classInfoEv
-__ZNK7WebCore29SVGStyledTransformableElement7getBBoxEv
-__ZN7WebCore12SVGLocatable7getBBoxEPKNS_16SVGStyledElementE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_19JSSVGPODTypeWrapperINS_9FloatRectEEEPNS_10SVGElementE
-__ZN7WebCore18JSSVGRectPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore9JSSVGRectC1EPN3KJS8JSObjectEPNS_19JSSVGPODTypeWrapperINS_9FloatRectEEEPNS_10SVGElementE
-__ZN7WebCore9JSSVGRect18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore9JSSVGRectEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore9JSSVGRect16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore34JSSVGPODTypeWrapperCreatorReadOnlyINS_9FloatRectEEcvS1_Ev
-__ZN3KJS17staticValueGetterIN7WebCore18JSSVGCircleElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSSVGCircleElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore29SVGStyledTransformableElement23farthestViewportElementEv
-__ZN7WebCore12SVGLocatable23farthestViewportElementEPKNS_16SVGStyledElementE
-__ZNK7WebCore29SVGStyledTransformableElement22nearestViewportElementEv
-__ZNK7WebCore18RenderSVGContainer6heightEv
-__ZNK7WebCore18RenderSVGContainer5widthEv
-__ZN7WebCore9DocLoader11requestFontERKNS_6StringE
-__ZN7WebCore10CachedFontC1EPNS_9DocLoaderERKNS_6StringE
-__ZN7WebCore10CachedFont3refEPNS_20CachedResourceClientE
-__ZNK7WebCore15CSSFontSelector9docLoaderEv
-__ZN7WebCore10CachedFont17beginLoadIfNeededEPNS_9DocLoaderE
-__ZN7WebCore9FontCache25getLastResortFallbackFontERKNS_15FontDescriptionE
-__ZN7WebCore14SVGRectElement14setRyBaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGRectElement5setRyENS_9SVGLengthE
-__ZNK7WebCore14SVGRectElement2ryEv
-__ZN7WebCore12SVGTransform8setSkewXEf
-__ZN7WebCore15AffineTransform5skewXEd
-__ZN7WebCore17switchConstructorEPNS_8DocumentEb
-__ZN7WebCore16SVGSwitchElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore16SVGSwitchElement7isValidEv
-__ZN7WebCore16SVGSwitchElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZNK7WebCore16SVGSwitchElement25childShouldCreateRendererEPNS_4NodeE
-__ZNK7WebCore8SVGTests14systemLanguageEv
-__ZN7WebCore13SVGStringList5resetERKNS_6StringE
-__ZNK7WebCore26RenderSVGViewportContainer14isSVGContainerEv
-__ZNK7WebCore25SVGTextPositioningElement11dxBaseValueEv
-__ZNK7WebCore25SVGTextPositioningElement11dyBaseValueEv
-__ZNK7WebCore22SVGCharacterLayoutInfo11dxValueNextEv
-__ZNK7WebCore22SVGCharacterLayoutInfo11dyValueNextEv
 __ZNK7WebCore13SVGSVGElement5isSVGEv
-__ZN7WebCore17cursorConstructorEPNS_8DocumentEb
-__ZN7WebCore16SVGCursorElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore16SVGCursorElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZThn88_NK7WebCore16SVGCursorElement14contextElementEv
-__ZNK7WebCore16SVGCursorElement14contextElementEv
-__ZNK7WebCore16SVGCursorElement4hrefEv
-__ZN7WebCore16SVGCursorElement13setXBaseValueENS_9SVGLengthE
-__ZN7WebCore16SVGCursorElement4setXENS_9SVGLengthE
-__ZN7WebCore16SVGCursorElement13setYBaseValueENS_9SVGLengthE
-__ZN7WebCore16SVGCursorElement4setYENS_9SVGLengthE
-__ZNK7WebCore16SVGCursorElement7isValidEv
-__ZN7WebCore11RenderStyle12addSVGCursorERKNS_6StringE
-__ZN7WebCore15maskConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGMaskElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore14SVGMaskElement13setXBaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGMaskElement4setXENS_9SVGLengthE
-__ZN7WebCore14SVGMaskElement13setYBaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGMaskElement4setYENS_9SVGLengthE
-__ZN7WebCore14SVGMaskElement17setWidthBaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGMaskElement8setWidthENS_9SVGLengthE
-__ZN7WebCore14SVGMaskElement18setHeightBaseValueENS_9SVGLengthE
-__ZN7WebCore14SVGMaskElement9setHeightENS_9SVGLengthE
-__ZN7WebCore14SVGMaskElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore14SVGMaskElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore14SVGMaskElement21setMaskUnitsBaseValueEi
-__ZN7WebCore14SVGMaskElement12setMaskUnitsEi
-__ZNK7WebCore14SVGMaskElement7isValidEv
-__ZN7WebCore14SVGMaskElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore14SVGMaskElement15childrenChangedEb
-__ZN7WebCore13StyleMaskDataC1ERKS0_
-__ZNK7WebCore13StyleMaskDataeqERKS0_
-__ZNK7WebCore8SVGTests18requiredExtensionsEv
-__ZN7WebCore19SVGPathSegClosePathD1Ev
-__ZN7WebCore13SVGUseElement24handleDeepUseReferencingEPNS_10SVGElementEPNS_18SVGElementInstanceERb
-__ZNK7WebCore18SVGElementInstance10parentNodeEv
-__ZNK7WebCore13SVGUseElement38transferUseAttributesToReplacedElementEPNS_10SVGElementES2_
-__ZN7WebCore13SVGUseElement19removedFromDocumentEv
-__ZN7WebCore14RenderSVGImage6layoutEv
-__ZN7WebCore14RenderSVGImage23calculateLocalTransformEv
-__ZNK7WebCore15SVGImageElement1yEv
-__ZNK7WebCore15SVGImageElement1xEv
-__ZN7WebCore14RenderSVGImage23calculateAbsoluteBoundsEv
-__ZNK7WebCore14RenderSVGImage12relativeBBoxEb
-__ZNK7WebCore14RenderSVGImage14localTransformEv
-__ZN7WebCore17symbolConstructorEPNS_8DocumentEb
-__ZN7WebCore16SVGSymbolElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore16SVGSymbolElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZThn92_NK7WebCore16SVGSymbolElement14contextElementEv
-__ZNK7WebCore16SVGSymbolElement14contextElementEv
-__ZN7WebCore16SVGSymbolElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore13SVGUseElement17setWidthBaseValueENS_9SVGLengthE
-__ZN7WebCore13SVGUseElement8setWidthENS_9SVGLengthE
-__ZNK7WebCore13SVGUseElement5widthEv
-__ZN7WebCore13SVGUseElement18setHeightBaseValueENS_9SVGLengthE
-__ZN7WebCore13SVGUseElement9setHeightENS_9SVGLengthE
-__ZNK7WebCore13SVGUseElement6heightEv
-__ZN7WebCore16mpathConstructorEPNS_8DocumentEb
-__ZN7WebCore15SVGMPathElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore15SVGMPathElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZNK7WebCore15SVGMPathElement14contextElementEv
-__ZN7WebCore21SVGDocumentExtensions18addPendingResourceERKNS_12AtomicStringEPNS_16SVGStyledElementE
-__ZN3WTF7HashSetIPN7WebCore16SVGStyledElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZN7WebCore17markerConstructorEPNS_8DocumentEb
-__ZN7WebCore16SVGMarkerElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore8SVGAngleC1Ev
-__ZN7WebCore16SVGMarkerElement23setMarkerWidthBaseValueENS_9SVGLengthE
-__ZN7WebCore16SVGMarkerElement14setMarkerWidthENS_9SVGLengthE
-__ZN7WebCore16SVGMarkerElement24setMarkerHeightBaseValueENS_9SVGLengthE
-__ZN7WebCore16SVGMarkerElement15setMarkerHeightENS_9SVGLengthE
-__ZN7WebCore16SVGMarkerElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore16SVGMarkerElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZThn92_NK7WebCore16SVGMarkerElement14contextElementEv
-__ZNK7WebCore16SVGMarkerElement14contextElementEv
-__ZN7WebCore16SVGMarkerElement16setRefXBaseValueENS_9SVGLengthE
-__ZN7WebCore16SVGMarkerElement7setRefXENS_9SVGLengthE
-__ZN7WebCore16SVGMarkerElement16setRefYBaseValueENS_9SVGLengthE
-__ZN7WebCore16SVGMarkerElement7setRefYENS_9SVGLengthE
-__ZN7WebCore16SVGMarkerElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore16SVGMarkerElement15childrenChangedEb
-__ZN7WebCore16SVGMarkerElement15setOrientToAutoEv
-__ZN7WebCore16SVGMarkerElement22setOrientTypeBaseValueEi
-__ZN7WebCore16SVGMarkerElement13setOrientTypeEi
-__ZN7WebCore15StyleMarkerDataC1ERKS0_
-__ZNK7WebCore15StyleMarkerDataeqERKS0_
-__ZNK7WebCore15SVGFitToViewBox22viewBoxToViewTransformEff
-__ZNK7WebCore16SVGMarkerElement11markerWidthEv
-__ZNK7WebCore16SVGMarkerElement12markerHeightEv
-__ZN7WebCore19clipPathConstructorEPNS_8DocumentEb
-__ZN7WebCore18SVGClipPathElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore18SVGClipPathElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore18SVGClipPathElement19svgAttributeChangedERKNS_13QualifiedNameE
-__ZN7WebCore18SVGClipPathElement25setClipPathUnitsBaseValueEi
-__ZN7WebCore18SVGClipPathElement16setClipPathUnitsEi
-__ZNK7WebCore18SVGClipPathElement7isValidEv
-__ZN7WebCore18SVGClipPathElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore18SVGClipPathElement15childrenChangedEb
-__ZN7WebCore13StyleClipDataC1ERKS0_
-__ZN7WebCore14SVGMaskElement28setMaskContentUnitsBaseValueEi
-__ZN7WebCore14SVGMaskElement19setMaskContentUnitsEi
-__ZNK7WebCore13StyleClipDataeqERKS0_
-__ZN7WebCore12SVGTransform8setSkewYEf
-__ZN7WebCore15AffineTransform5skewYEd
-__ZN7WebCore19textPathConstructorEPNS_8DocumentEb
-__ZN7WebCore18SVGTextPathElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore18SVGTextPathElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZThn108_NK7WebCore18SVGTextPathElement14contextElementEv
-__ZNK7WebCore18SVGTextPathElement14contextElementEv
-__ZN7WebCore18SVGTextPathElement20insertedIntoDocumentEv
-__ZNK7WebCore18SVGTextPathElement4hrefEv
-__ZN7WebCore18SVGTextPathElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore18SVGTextPathElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore17RenderSVGTextPathC1EPNS_4NodeE
-__ZNK7WebCore18SVGTextPathElement25childShouldCreateRendererEPNS_4NodeE
-__ZN7WebCore18SVGTextPathElement23setStartOffsetBaseValueENS_9SVGLengthE
-__ZN7WebCore18SVGTextPathElement14setStartOffsetENS_9SVGLengthE
-__ZN7WebCore22SVGCharacterLayoutInfo15setInPathLayoutEb
-__ZN7WebCore22SVGCharacterLayoutInfo20addLayoutInformationEPNS_13InlineFlowBoxEf
-__ZNK7WebCore17RenderSVGTextPath10layoutPathEv
-__ZN7WebCore4Path6lengthEv
-__ZN7WebCore18PathTraversalStateC1ENS0_19PathTraversalActionE
-__ZNK7WebCore4Path5applyEPvPFvS1_PKNS_11PathElementEE
-__ZN7WebCore26CGPathApplierToPathApplierEPvPK13CGPathElement
-__ZN7WebCore25pathLengthApplierFunctionEPvPKNS_11PathElementE
-__ZN7WebCore18PathTraversalState6moveToERKNS_10FloatPointE
-__ZN7WebCore18PathTraversalState13cubicBezierToERKNS_10FloatPointES3_S3_
-__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE6shrinkEm
-__ZNK7WebCore17RenderSVGTextPath11startOffsetEv
-__ZNK7WebCore18SVGTextPathElement11startOffsetEv
-__ZNK7WebCore9SVGLength17valueAsPercentageEv
-__ZNK7WebCore9SVGLength21valueInSpecifiedUnitsEv
-__ZN7WebCore22SVGCharacterLayoutInfo27nextPathLayoutPointAndAngleEfff
-__ZN7WebCore4Path13pointAtLengthEfRb
-__ZN7WebCore4Path19normalAngleAtLengthEfRb
-__ZN7WebCore18PathTraversalState6lineToERKNS_10FloatPointE
-__ZN7WebCore15trefConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGTRefElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore14SVGTRefElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZThn108_NK7WebCore14SVGTRefElement14contextElementEv
-__ZNK7WebCore14SVGTRefElement14contextElementEv
-__ZN7WebCore14SVGTRefElement20updateReferencedTextEv
-__ZNK7WebCore14SVGTRefElement4hrefEv
-__ZN7WebCore14SVGTRefElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZNK7WebCore14SVGTRefElement25childShouldCreateRendererEPNS_4NodeE
-__ZN7WebCore17SVGPatternElement31setPatternContentUnitsBaseValueEi
-__ZN7WebCore17SVGPatternElement22setPatternContentUnitsEi
-__ZN7WebCore11SVGAElement18setTargetBaseValueENS_6StringE
-__ZN7WebCore11SVGAElement9setTargetENS_6StringE
-__ZN7WebCore18SVGFontFaceElement15childrenChangedEb
-__ZN7WebCore24font_face_srcConstructorEPNS_8DocumentEb
-__ZN7WebCore21SVGFontFaceSrcElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore21SVGFontFaceSrcElement8srcValueEv
-__ZN7WebCore21SVGFontFaceSrcElement15childrenChangedEb
-__ZN7WebCore24font_face_uriConstructorEPNS_8DocumentEb
-__ZN7WebCore21SVGFontFaceUriElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore21SVGFontFaceUriElement8srcValueEv
-__ZN7WebCore19metadataConstructorEPNS_8DocumentEb
-__ZN7WebCore18SVGMetadataElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZNK7WebCore8SVGTests16requiredFeaturesEv
-__ZN7WebCore14isSVG11FeatureERKNS_6StringE
-__ZN7WebCore9addStringERN3WTF7HashSetINS_6StringENS_15CaseFoldingHashENS0_10HashTraitsIS2_EEEEPKc
-__ZN7WebCore8SVGTests16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore12SVGLangSpace16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore28SVGExternalResourcesRequired16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore29SVGStyledTransformableElement16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore16SVGTransformable16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore16SVGStyledElement16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore26ignorableWhitespaceHandlerEPvPKhi
-__ZNK7WebCore24SVGLinearGradientElement14contextElementEv
-__ZNK7WebCore17SVGPatternElement14contextElementEv
-__ZN3KJS17staticValueGetterIN7WebCore12JSSVGElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore12JSSVGElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore16JSSVGRectElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSSVGRectElement16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore14SVGRectElement9xAnimatedEv
-__ZN7WebCore21lookupOrCreateWrapperINS_14SVGRectElement20SVGAnimatedTemplateXES1_EEPT_PKT0_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore14SVGRectElement20SVGAnimatedTemplateXC1EPKS0_RKNS_13QualifiedNameE
-__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateINS1_9SVGLengthEEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35SVGAnimatedTypeWrapperKeyHashTraitsENS_10HashTraitsIS6_EEE3getERKS2_
-__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_29SVGAnimatedTypeWrapperKeyHashENS_14PairHashTraitsINS1_35SVGAnimatedTypeWrapperKeyHashTraitsENS_10HashTraitsIiEEEES9_E6expandEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_19SVGAnimatedTemplateINS_9SVGLengthEEEPNS_10SVGElementE
-__ZN7WebCore28JSSVGAnimatedLengthPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore19JSSVGAnimatedLengthC1EPN3KJS8JSObjectEPNS_19SVGAnimatedTemplateINS_9SVGLengthEEEPNS_10SVGElementE
-__ZN7WebCore19JSSVGAnimatedLength18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore19JSSVGAnimatedLengthEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSSVGAnimatedLength16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK3WTF9HashTableIN7WebCore24PODTypeReadWriteHashInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEESt4pairIS6_iENS_18PairFirstExtractorIS8_EENS1_28PODTypeReadWriteHashInfoHashIS3_S5_EENS_14PairHashTraitsINS1_30PODTypeReadWriteHashInfoTraitsIS3_S5_EENS_10HashTraitsIiEEEESF_E8containsIS6_NS_22IdentityHashTranslatorIS6_S8_SC_EEEEbRKT_
-__ZNK3WTF7HashMapIN7WebCore24PODTypeReadWriteHashInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEEPNS1_35JSSVGPODTypeWrapperCreatorReadWriteIS3_S5_EENS1_28PODTypeReadWriteHashInfoHashIS3_S5_EENS1_30PODTypeReadWriteHashInfoTraitsIS3_S5_EENS_10HashTraitsIS9_EEE3getERKS6_
-__ZN3WTF9HashTableIN7WebCore24PODTypeReadWriteHashInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEESt4pairIS6_iENS_18PairFirstExtractorIS8_EENS1_28PODTypeReadWriteHashInfoHashIS3_S5_EENS_14PairHashTraitsINS1_30PODTypeReadWriteHashInfoTraitsIS3_S5_EENS_10HashTraitsIiEEEESF_E3addIS6_PNS1_35JSSVGPODTypeWrapperCreatorReadWriteIS3_S5_EENS_17HashMapTranslatorILb1ES7_IS6_SN_ENS_18PairBaseHashTraitsISF_NSG_ISN_EEEESI_SC_EEEES7_INS_17HashTableIteratorIS6_S8_SA_SC_SI_SF_EEbERKT_RKT0_
-__ZN3WTF9HashTableIN7WebCore24PODTypeReadWriteHashInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEESt4pairIS6_iENS_18PairFirstExtractorIS8_EENS1_28PODTypeReadWriteHashInfoHashIS3_S5_EENS_14PairHashTraitsINS1_30PODTypeReadWriteHashInfoTraitsIS3_S5_EENS_10HashTraitsIiEEEESF_E47removeAndInvalidateWithoutEntryConsistencyCheckEPS8_
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_19JSSVGPODTypeWrapperINS_9SVGLengthEEEPNS_10SVGElementE
-__ZN7WebCore11JSSVGLengthC1EPN3KJS8JSObjectEPNS_19JSSVGPODTypeWrapperINS_9SVGLengthEEEPNS_10SVGElementE
-__ZN7WebCore11JSSVGLength18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore11JSSVGLengthEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore11JSSVGLength16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore35JSSVGPODTypeWrapperCreatorReadWriteINS_9SVGLengthENS_19SVGAnimatedTemplateIS1_EEEcvS1_Ev
-__ZNK7WebCore14SVGRectElement20SVGAnimatedTemplateX7baseValEv
-__ZNK7WebCore14SVGRectElement10xBaseValueEv
-__ZNK7WebCore14SVGRectElement9yAnimatedEv
-__ZN7WebCore21lookupOrCreateWrapperINS_14SVGRectElement20SVGAnimatedTemplateYES1_EEPT_PKT0_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore14SVGRectElement20SVGAnimatedTemplateYC1EPKS0_RKNS_13QualifiedNameE
-__ZNK7WebCore14SVGRectElement20SVGAnimatedTemplateY7baseValEv
-__ZNK7WebCore14SVGRectElement10yBaseValueEv
-__ZNK7WebCore14SVGRectElement13widthAnimatedEv
-__ZN7WebCore21lookupOrCreateWrapperINS_14SVGRectElement24SVGAnimatedTemplateWidthES1_EEPT_PKT0_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore14SVGRectElement24SVGAnimatedTemplateWidthC1EPKS0_RKNS_13QualifiedNameE
-__ZNK7WebCore14SVGRectElement24SVGAnimatedTemplateWidth7baseValEv
-__ZNK7WebCore14SVGRectElement14widthBaseValueEv
-__ZNK7WebCore14SVGRectElement14heightAnimatedEv
-__ZN7WebCore21lookupOrCreateWrapperINS_14SVGRectElement25SVGAnimatedTemplateHeightES1_EEPT_PKT0_RKNS_13QualifiedNameERKNS_12AtomicStringE
-__ZN7WebCore14SVGRectElement25SVGAnimatedTemplateHeightC1EPKS0_RKNS_13QualifiedNameE
-__ZNK7WebCore14SVGRectElement25SVGAnimatedTemplateHeight7baseValEv
-__ZNK7WebCore14SVGRectElement15heightBaseValueEv
-__ZN7WebCore11JSSVGLength3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore11JSSVGLength16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore9SVGLength8setValueEf
-__ZN7WebCore35JSSVGPODTypeWrapperCreatorReadWriteINS_9SVGLengthENS_19SVGAnimatedTemplateIS1_EEE12commitChangeES1_PNS_10SVGElementE
-__ZN7WebCore14SVGRectElement20SVGAnimatedTemplateX10setBaseValENS_9SVGLengthE
-__ZN7WebCore14SVGRectElement20SVGAnimatedTemplateY10setBaseValENS_9SVGLengthE
-__ZN3WTF7HashMapIN7WebCore6StringEPNS_7HashSetIPNS1_16SVGStyledElementENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEENS1_10StringHashENS8_IS2_EENS8_ISB_EEE3addERKS2_RKSB_
-__ZN7WebCore21SVGDocumentExtensions21removePendingResourceERKNS_12AtomicStringE
-__ZN7WebCore11SVGResource17invalidateClientsEN3WTF7HashSetIPNS_16SVGStyledElementENS1_7PtrHashIS4_EENS1_10HashTraitsIS4_EEEE
-__ZNK7WebCore18SVGGradientElement26gradientTransformBaseValueEv
-__ZNK7WebCore18SVGGradientElement17gradientTransformEv
-__ZNK7WebCore17SVGPatternElement25patternTransformBaseValueEv
-__ZNK7WebCore17SVGPatternElement16patternTransformEv
-__ZN7WebCore13SVGUseElement24alterShadowTreeForSVGTagEPNS_10SVGElementE
-__ZN7WebCore15viewConstructorEPNS_8DocumentEb
-__ZN7WebCore14SVGViewElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
-__ZN7WebCore14SVGViewElement20parseMappedAttributeEPNS_15MappedAttributeE
-__ZN7WebCore14SVGViewElement16rendererIsNeededEPNS_11RenderStyleE
-__ZThn80_NK7WebCore14SVGViewElement14contextElementEv
-__ZNK7WebCore14SVGViewElement14contextElementEv
-__ZNK7WebCore14SVGViewElement10viewTargetEv
-__ZN7WebCore26RenderSVGViewportContainer5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore26RenderSVGViewportContainer22applyContentTransformsERNS_12RenderObject9PaintInfoE
-__ZN7WebCore26RenderSVGViewportContainer25applyAdditionalTransformsERNS_12RenderObject9PaintInfoE
-__ZN7WebCore26RenderSVGViewportContainer11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore14RenderSVGImage12imageChangedEPNS_11CachedImageE
-__ZN7WebCore14SVGImageLoader17dispatchLoadEventEv
-__ZN7WebCore8SVGImageC1EPNS_13ImageObserverE
-__ZN7WebCore8SVGImage11dataChangedEb
-__ZN7WebCore25SVGEmptyFrameLoaderClient20createDocumentLoaderERKNS_15ResourceRequestERKNS_14SubstituteDataE
-__ZN7WebCore25SVGEmptyFrameLoaderClient22provisionalLoadStartedEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient25setMainFrameDocumentReadyEb
-__ZN7WebCore25SVGEmptyFrameLoaderClient17setCopiesOnScrollEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient31prepareForDataSourceReplacementEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient31transitionToCommittedForNewPageEv
-__ZN7WebCore20SVGEmptyEditorClient23clearUndoRedoOperationsEv
-__ZN7WebCore20SVGEmptyChromeClient16setStatusbarTextERKNS_6StringE
-__ZN7WebCore25SVGEmptyFrameLoaderClient15finishedLoadingEPNS_14DocumentLoaderE
-__ZN7WebCore25SVGEmptyFrameLoaderClient18frameLoadCompletedEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient21forceLayoutForNonHTMLEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient9userAgentERKNS_4KURLE
-__ZN7WebCore25SVGEmptyFrameLoaderClient17cancelPolicyCheckEv
-__ZN7WebCore20SVGEmptyChromeClient30canRunBeforeUnloadConfirmPanelEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient22clearArchivedResourcesEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient27willChangeEstimatedProgressEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient31postProgressStartedNotificationEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient26didChangeEstimatedProgressEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient31dispatchDidStartProvisionalLoadEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient32assignIdentifierToInitialRequestEmPNS_14DocumentLoaderERKNS_15ResourceRequestE
-__ZN7WebCore25SVGEmptyFrameLoaderClient23dispatchWillSendRequestEPNS_14DocumentLoaderEmRNS_15ResourceRequestERKNS_16ResourceResponseE
-__ZN7WebCore25SVGEmptyFrameLoaderClient31dispatchDecidePolicyForMIMETypeEMNS_11FrameLoaderEFvNS_12PolicyActionEERKNS_6StringERKNS_15ResourceRequestE
-__ZN7WebCore11FrameLoader24cancelContentPolicyCheckEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient17dispatchWillCloseEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient18makeRepresentationEPNS_14DocumentLoaderE
-__ZN7WebCore14DocumentLoaderD2Ev
-__ZNK7WebCore17FrameLoaderClient11hasHTMLViewEv
-__ZNK7WebCore25SVGEmptyFrameLoaderClient17overrideMediaTypeEv
-__ZN7WebCore6Widget6resizeEii
-__ZN7WebCore25SVGEmptyFrameLoaderClient29dispatchDidHandleOnloadEventsEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient22dispatchDidFirstLayoutEv
-__ZN7WebCore25SVGEmptyFrameLoaderClient29dispatchDidFinishDocumentLoadEv
-__ZNK7WebCore8SVGImage4sizeEv
-__ZNK7WebCore11SVGDocument11rootElementEv
-__ZNK7WebCore8SVGImage16hasRelativeWidthEv
-__ZN7WebCore10CachedFont4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
-__ZN7WebCore10CachedFont11checkNotifyEv
-__ZN7WebCore17CSSFontFaceSource10fontLoadedEPNS_10CachedFontE
-__ZN7WebCore11CSSFontFace10fontLoadedEPNS_17CSSFontFaceSourceE
-__ZNK7WebCore11CSSFontFace8isLoadedEv
-__ZN7WebCore20CSSSegmentedFontFace10fontLoadedEPNS_11CSSFontFaceE
-__ZNK7WebCore20CSSSegmentedFontFace8isLoadedEv
-__ZN7WebCore15CSSFontSelector10fontLoadedEPNS_20CSSSegmentedFontFaceE
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore14SimpleFontDataEKNS_7HashMapIiS3_NS_7IntHashIjEENS_10HashTraitsIiEENS7_IS3_EEEEEEvRT0_
-__ZN7WebCore14SimpleFontDataD1Ev
-__ZN7WebCore14SimpleFontData15platformDestroyEv
-__ZN3WTF20deleteAllPairSecondsIPN7WebCore13GlyphWidthMap14GlyphWidthPageEKNS_7HashMapIiS4_NS_7IntHashIjEENS_10HashTraitsIiEENS8_IS4_EEEEEEvRT0_
-__ZN7WebCore10SVGElement13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERib
-__ZN7WebCore10CachedFont17ensureSVGFontDataEv
-__ZNK7WebCore10CachedFont14getSVGFontByIdERKNS_6StringE
-__ZN7WebCore10CachedFont26platformDataFromCustomDataEfbb
-__ZN7WebCore15SVGTitleElement19removedFromDocumentEv
-__ZN7WebCore16SVGScriptElementD1Ev
-__ZN7WebCore24JSSVGPODTypeWrapperCacheINS_9FloatRectENS_19SVGAnimatedTemplateIS1_EEE13forgetWrapperEPNS_19JSSVGPODTypeWrapperIS1_EE
-__ZN7WebCore18JSSVGRectPrototypeD0Ev
-__ZN7WebCore11JSSVGMatrixD0Ev
-__ZN7WebCore24JSSVGPODTypeWrapperCacheINS_9SVGLengthENS_19SVGAnimatedTemplateIS1_EEE13forgetWrapperEPNS_19JSSVGPODTypeWrapperIS1_EE
-__ZN3WTF9HashTableIN7WebCore24PODTypeReadWriteHashInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEESt4pairIS6_iENS_18PairFirstExtractorIS8_EENS1_28PODTypeReadWriteHashInfoHashIS3_S5_EENS_14PairHashTraitsINS1_30PODTypeReadWriteHashInfoTraitsIS3_S5_EENS_10HashTraitsIiEEEESF_E4findIS6_NS_22IdentityHashTranslatorIS6_S8_SC_EEEENS_17HashTableIteratorIS6_S8_SA_SC_SI_SF_EERKT_
-__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_29SVGAnimatedTypeWrapperKeyHashENS_14PairHashTraitsINS1_35SVGAnimatedTypeWrapperKeyHashTraitsENS_10HashTraitsIiEEEES9_E4findIS2_NS_22IdentityHashTranslatorIS2_S4_S7_EEEENS_17HashTableIteratorIS2_S4_S6_S7_SC_S9_EERKT_
-__ZN7WebCore16SVGInlineFlowBoxD1Ev
-__ZN7WebCore14RenderSVGTSpanD1Ev
-__ZN7WebCore16SVGInlineTextBox14paintSelectionEiRKNS_7SVGCharEPKtiPNS_15GraphicsContextEPNS_11RenderStyleEPKNS_4FontE
-__ZNK7WebCore14SVGLineElement15supportsMarkersEv
-__ZNK7WebCore4Font20drawTextUsingSVGFontEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
-__ZN7WebCore16SVGTextRunWalkerINS_28SVGTextRunWalkerDrawTextDataEE4walkERKNS_7TextRunEbRKNS_6StringEii
-__ZN7WebCore28drawTextUsingSVGFontCallbackERKNS_18SVGGlyphIdentifierERNS_28SVGTextRunWalkerDrawTextDataE
-__ZN7WebCore13SVGUseElement6detachEv
-__ZN7WebCore15SVGGlyphElement19removedFromDocumentEv
-__ZN7WebCore14SVGFontElement20removeGlyphFromCacheEPNS_15SVGGlyphElementE
-__ZN7WebCore16SVGRootInlineBox37retrievePaintServersForTextDecorationEPNS_12RenderObjectE
-__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE14expandCapacityEmPKS3_
-__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE14expandCapacityEm
-__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE15reserveCapacityEm
-__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE6shrinkEm
-__ZN7WebCore16SVGInlineTextBox15paintDecorationENS_15ETextDecorationEPNS_15GraphicsContextEiiiRKNS_7SVGCharERKNS_21SVGTextDecorationInfoE
-__ZN3WTF7HashMapIiPN7WebCore12RenderObjectENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3setERKiRKS3_
-__ZN7WebCore17RenderSVGTextPathD1Ev
+__ZNK7WebCore14SVGPathElement10toPathDataEv
+__ZN7WebCore14SVGPathSegList10toPathDataEv
+__ZNK7WebCore19SVGPathSegMovetoAbs11pathSegTypeEv
+__ZNK7WebCore19SVGPathSegLinetoAbs11pathSegTypeEv
+__ZNK7WebCore19SVGPathSegClosePath11pathSegTypeEv
 __ZN7WebCore18getPaintServerByIdEPNS_8DocumentERKNS_12AtomicStringE
+__ZN7WebCore18SVGGradientElement14canvasResourceEv
+__ZNK7WebCore24SVGLinearGradientElement12gradientTypeEv
+__ZN7WebCore28SVGPaintServerLinearGradientC1EPKNS_18SVGGradientElementE
+__ZN7WebCore28SVGPaintServerLinearGradientC2EPKNS_18SVGGradientElementE
+__ZN7WebCore22SVGPaintServerGradientC2EPKNS_18SVGGradientElementE
 __ZNK7WebCore14SVGPaintServer12resourceTypeEv
 __ZNK7WebCore10RenderPath12isRenderPathEv
 __ZN7WebCore11SVGResource9addClientEPNS_16SVGStyledElementE
-__ZN3WTF7HashMapIPN7WebCore16SVGStyledElementEPNS1_11ResourceSetENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS5_
+__ZNK3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8cont
+__ZN3WTF7HashSetIPN7WebCore16SVGStyledElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expan
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehas
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allo
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deal
+__ZNK3WTF7HashMapIPN7WebCore16SVGStyledElementEPNS1_11ResourceSetENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
+__ZN3WTF7HashMapIPN7WebCore16SVGStyledElementEPNS1_11ResourceSetENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS
 __ZNK7WebCore22SVGPaintServerGradient5setupERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
-__ZNK7WebCore24SVGRadialGradientElement13buildGradientEv
-__ZNK7WebCore24SVGRadialGradientElement25collectGradientPropertiesEv
+__ZNK7WebCore24SVGLinearGradientElement13buildGradientEv
+__ZNK7WebCore24SVGLinearGradientElement25collectGradientPropertiesEv
 __ZNK7WebCore18SVGGradientElement10buildStopsEv
 __ZNK7WebCore14SVGStopElement14isGradientStopEv
-__ZNK7WebCore14SVGStopElement6offsetEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEEE5va
+__ZN7WebCore16SVGStyledElement12resolveStyleEPNS_11RenderStyleE
+__ZN7WebCoreL25colorFromSVGColorCSSValueEPNS_8CSSValueEPNS_11RenderStyleE
+__ZNK7WebCore8SVGColor9colorTypeEv
+__ZN7WebCore13StyleStopDataC1ERKS0_
+__ZN7WebCore13StyleStopDataC2ERKS0_
 __ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EE14expandCapacityEmPKS4_
 __ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EE14expandCapacityEm
 __ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EE15reserveCapacityEm
 __ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EEaSERKS5_
+__ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EE14shrinkCapacityEm
 __ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EE6shrinkEm
+__ZNK7WebCore19SVGAnimatedPropertyINS_24SVGLinearGradientElementENS_9SVGLengthEXadL_ZNS_8SVGNames23linearGradientTagStringEEEXa
 __ZN3WTF7HashSetIPKN7WebCore18SVGGradientElementENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZNK7WebCore18SVGGradientElement4hrefEv
+__ZN3WTF9HashTableIPKN7WebCore18SVGGradientElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6ex
+__ZN3WTF9HashTableIPKN7WebCore18SVGGradientElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6re
+__ZN3WTF9HashTableIPKN7WebCore18SVGGradientElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E13a
+__ZN3WTF9HashTableIPKN7WebCore18SVGGradientElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E15d
 __ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EEC1ERKS5_
-__ZN7WebCore22SVGPaintServerGradient16setGradientStopsERKN3WTF6VectorISt4pairIfNS_5ColorEELm0EEE
+__ZN3WTF6VectorISt4pairIfN7WebCore5ColorEELm0EEC2ERKS5_
+__ZN7WebCore10FloatPoint15narrowPrecisionEdd
+__ZN7WebCore8Gradient15setSpreadMethodENS_20GradientSpreadMethodE
+__ZN7WebCore22SVGPaintServerGradient11setGradientEN3WTF10PassRefPtrINS_8GradientEEE
 __ZN7WebCore22SVGPaintServerGradient18setBoundingBoxModeEb
-__ZN7WebCore22SVGPaintServerGradient23setGradientSpreadMethodERKNS_23SVGGradientSpreadMethodE
-__ZN7WebCore22SVGPaintServerGradient20setGradientTransformERKNS_15AffineTransformE
-__ZN7WebCore28SVGPaintServerRadialGradient17setGradientCenterERKNS_10FloatPointE
-__ZN7WebCore28SVGPaintServerRadialGradient16setGradientFocalERKNS_10FloatPointE
-__ZN7WebCore28SVGPaintServerRadialGradient17setGradientRadiusEf
-__ZN7WebCore22SVGPaintServerGradient25updateQuartzGradientCacheEPKS0_
-__ZNK7WebCore22SVGPaintServerGradient13gradientStopsEv
-__ZN7WebCore22SVGPaintServerGradient30updateQuartzGradientStopsCacheERKN3WTF6VectorISt4pairIfNS_5ColorEELm0EEE
-__ZN3WTF6VectorIN7WebCore22SVGPaintServerGradient18QuartzGradientStopELm0EE6resizeEm
-__ZN3WTF6VectorIN7WebCore22SVGPaintServerGradient18QuartzGradientStopELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore22SVGPaintServerGradient18QuartzGradientStopELm0EE15reserveCapacityEm
-__ZNK7WebCore28SVGPaintServerRadialGradient4typeEv
-__ZNK7WebCore28SVGPaintServerRadialGradient14gradientCenterEv
-__ZNK7WebCore28SVGPaintServerRadialGradient13gradientFocalEv
-__ZNK7WebCore28SVGPaintServerRadialGradient14gradientRadiusEv
-__ZNK7WebCore22SVGPaintServerGradient10renderPathERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeE
+__ZN7WebCore22SVGPaintServerGradient20setGradientTransformERKNS_20TransformationMatrixE
+__ZN7WebCore28SVGPaintServerLinearGradient16setGradientStartERKNS_10FloatPointE
+__ZN7WebCore28SVGPaintServerLinearGradient14setGradientEndERKNS_10FloatPointE
 __ZNK7WebCore22SVGPaintServerGradient15boundingBoxModeEv
-__ZNK7WebCore14SVGPaintServer14clipToFillPathEP9CGContextPKNS_12RenderObjectE
-__ZNK7WebCore22SVGPaintServerGradient46handleBoundingBoxModeAndGradientTransformationEPNS_15GraphicsContextERKNS_9FloatRectE
-__ZN7WebCore36CGAffineTransformMakeMapBetweenRectsE6CGRectS0_
 __ZNK7WebCore22SVGPaintServerGradient17gradientTransformEv
 __ZNK7WebCore22SVGPaintServerGradient8teardownERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
-__ZN7WebCore18cgGradientCallbackEPvPKfPf
-__ZN7WebCore18SVGGradientElementD0Ev
-__ZN7WebCore28SVGPaintServerRadialGradientD1Ev
-__ZN7WebCore22SVGPaintServerGradientD0Ev
-__ZN7WebCore18releaseCachedStopsEPv
-__ZN3WTF6VectorIN7WebCore22SVGPaintServerGradient18QuartzGradientStopELm0EE6shrinkEm
-__ZN7WebCore14SVGPaintServerD0Ev
-__ZN7WebCore11SVGResourceD0Ev
-__ZN7WebCore15SVGStyleElementD1Ev
-__ZN7WebCore11SVGAElementD1Ev
-__ZNK7WebCore14SVGPolyElement15supportsMarkersEv
-__ZN7WebCore28SVGPaintServerLinearGradientD1Ev
-__ZN7WebCore8SVGColorD1Ev
-__ZN7WebCore14RenderSVGImage5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore14RenderSVGImage25adjustRectsForAspectRatioERNS_9FloatRectES2_PNS_22SVGPreserveAspectRatioE
-__ZN7WebCore8SVGImage4drawEPNS_15GraphicsContextERKNS_9FloatRectES5_NS_17CompositeOperatorE
-__ZN7WebCore5Image14resetAnimationEv
-__ZN7WebCore28JSSVGAnimatedLengthPrototypeD0Ev
-__ZN7WebCore17SVGPatternElement14canvasResourceEv
-__ZN7WebCore21SVGPaintServerPatternC1EPKNS_17SVGPatternElementE
-__ZNK7WebCore21SVGPaintServerPattern5setupERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
-__ZNK7WebCore17SVGPatternElement12buildPatternERKNS_9FloatRectE
-__ZNK7WebCore17SVGPatternElement24collectPatternPropertiesEv
-__ZNK7WebCore17SVGPatternElement1xEv
-__ZNK7WebCore17SVGPatternElement1yEv
-__ZNK7WebCore17SVGPatternElement6heightEv
-__ZN3WTF7HashSetIPKN7WebCore17SVGPatternElementENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
-__ZNK7WebCore17SVGPatternElement4hrefEv
-__ZN7WebCore30clampImageBufferSizeToViewportEPNS_12RenderObjectERNS_7IntSizeE
-__ZN7WebCore11ImageBuffer6createERKNS_7IntSizeEb
-__ZN7WebCore11ImageBufferC1EPvRKNS_7IntSizeESt8auto_ptrINS_15GraphicsContextEE
-__ZNK7WebCore11ImageBuffer7contextEv
-__ZN7WebCore20renderSubtreeToImageEPNS_11ImageBufferEPNS_12RenderObjectE
-__ZN7WebCore21SVGPaintServerPattern19setPatternTransformERKNS_15AffineTransformE
-__ZN7WebCore21SVGPaintServerPattern20setPatternBoundariesERKNS_9FloatRectE
-__ZN7WebCore21SVGPaintServerPattern7setTileESt8auto_ptrINS_11ImageBufferEE
-__ZNK7WebCore21SVGPaintServerPattern4tileEv
-__ZNK7WebCore21SVGPaintServerPattern16patternTransformEv
-__ZNK7WebCore21SVGPaintServerPattern17patternBoundariesEv
-__ZNK7WebCore11ImageBuffer7cgImageEv
-__ZNK7WebCore21SVGPaintServerPattern8teardownERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
-__ZNK7WebCore12RenderObject12isRenderPathEv
-__ZN7WebCore13RenderSVGText13absoluteRectsERN3WTF6VectorINS_7IntRectELm0EEEiib
-__ZN7WebCore11ImageBufferD1Ev
-__ZNK7WebCore24SVGLinearGradientElement13buildGradientEv
-__ZNK7WebCore24SVGLinearGradientElement25collectGradientPropertiesEv
-__ZN7WebCore16SVGStyledElement12resolveStyleEPNS_11RenderStyleE
-__ZN7WebCore28SVGPaintServerLinearGradient16setGradientStartERKNS_10FloatPointE
-__ZN7WebCore28SVGPaintServerLinearGradient14setGradientEndERKNS_10FloatPointE
-__ZNK7WebCore28SVGPaintServerLinearGradient4typeEv
-__ZNK7WebCore28SVGPaintServerLinearGradient13gradientStartEv
-__ZNK7WebCore28SVGPaintServerLinearGradient11gradientEndEv
-__ZNK7WebCore14SVGPaintServer16clipToStrokePathEP9CGContextPKNS_12RenderObjectE
-__ZNK7WebCore24SVGLinearGradientElement2x1Ev
-__ZNK7WebCore24SVGLinearGradientElement2y1Ev
-__ZNK7WebCore24SVGLinearGradientElement2x2Ev
-__ZNK7WebCore24SVGLinearGradientElement2y2Ev
-__ZNK7WebCore18SVGGradientElement12spreadMethodEv
-__ZNK7WebCore24SVGRadialGradientElement2cxEv
-__ZNK7WebCore24SVGRadialGradientElement2cyEv
-__ZNK7WebCore24SVGRadialGradientElement2fxEv
-__ZNK7WebCore24SVGRadialGradientElement2fyEv
-__ZN7WebCore16SVGTransformList11consolidateEv
-__ZN7WebCore15GraphicsContext18setUseAntialiasingEb
-__ZN7WebCore18SVGClipPathElement14canvasResourceEv
-__ZN7WebCore18SVGResourceClipperC1Ev
-__ZNK7WebCore18SVGClipPathElement13clipPathUnitsEv
-__ZNK7WebCore29SVGStyledTransformableElement21isStyledTransformableEv
-__ZNK7WebCore29SVGStyledTransformableElement10toClipPathEv
-__ZN7WebCore18SVGResourceClipper11addClipDataERKNS_4PathENS_8WindRuleEb
-__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE14expandCapacityEmPKS2_
-__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE14expandCapacityEm
-__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE15reserveCapacityEm
-__ZNK7WebCore18SVGResourceClipper8clipDataEv
-__ZNK7WebCore18SVGResourceClipper12resourceTypeEv
-__ZNK7WebCore18SVGResourceClipper9applyClipEPNS_15GraphicsContextERKNS_9FloatRectE
+__ZNK7WebCore14SVGPathElement15supportsMarkersEv
+__ZN7WebCore18SVGGradientElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore24RenderSVGHiddenContainerC1EPNS_16SVGStyledElementE
+__ZN7WebCore24RenderSVGHiddenContainerC2EPNS_16SVGStyledElementE
+__ZN7WebCore14SVGStopElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore21RenderSVGGradientStopC1EPNS_14SVGStopElementE
+__ZN7WebCore21RenderSVGGradientStopC2EPNS_14SVGStopElementE
+__ZN7WebCore21RenderSVGGradientStop14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore21RenderSVGGradientStop15gradientElementEv
+__ZNK7WebCore24SVGRadialGradientElement12gradientTypeEv
+__ZN7WebCore28SVGPaintServerRadialGradientC1EPKNS_18SVGGradientElementE
+__ZN7WebCore28SVGPaintServerRadialGradientC2EPKNS_18SVGGradientElementE
+__ZN7WebCore11SVGResource10invalidateEv
+__ZN7WebCore12SVGTransform8setScaleEff
+__ZN7WebCoreL18ellipseConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore17SVGEllipseElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17SVGEllipseElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore12SVGTransform9setRotateEfff
+__ZN7WebCore17SVGEllipseElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore17SVGEllipseElement7isValidEv
+__ZNK7WebCore13StyleStopDataeqERKS0_
+__ZN7WebCore24RenderSVGHiddenContainer6layoutEv
+__ZN7WebCore21RenderSVGGradientStop6layoutEv
+__ZNK7WebCore17SVGEllipseElement10toPathDataEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGEllipseElementENS_9SVGLengthEXadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12rxAt
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGEllipseElementENS_9SVGLengthEXadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12cyAt
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGEllipseElementENS_9SVGLengthEXadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12cxAt
+__ZNK7WebCore24RenderSVGHiddenContainer29repaintRectInLocalCoordinatesEv
+__ZNK7WebCore12RenderObject22localToParentTransformEv
+__ZNK7WebCore12RenderObject14localTransformEv
+__ZN7WebCore24RenderSVGHiddenContainer5paintERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore24SVGRadialGradientElement13buildGradientEv
+__ZNK7WebCore24SVGRadialGradientElement25collectGradientPropertiesEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_24SVGRadialGradientElementENS_9SVGLengthEXadL_ZNS_8SVGNames23radialGradientTagStringEEEXa
+__ZN7WebCore28SVGPaintServerRadialGradient17setGradientCenterERKNS_10FloatPointE
+__ZN7WebCore28SVGPaintServerRadialGradient16setGradientFocalERKNS_10FloatPointE
+__ZN7WebCore28SVGPaintServerRadialGradient17setGradientRadiusEf
+__ZN7WebCore13SVGPathParser12calculateArcEbRdS1_dddddbb
+__ZN7WebCore21SVGPathSegListBuilder15svgCurveToCubicEddddddb
+__ZN7WebCore14SVGPathElement31createSVGPathSegCurvetoCubicAbsEffffff
+__ZN7WebCore25SVGPathSegCurvetoCubicAbsC1Effffff
+__ZN7WebCore25SVGPathSegCurvetoCubicAbsC2Effffff
+__ZNK7WebCore25SVGPathSegCurvetoCubicAbs11pathSegTypeEv
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEPNS1_22SVGPreserveAspectRatioENS1_10StringHashENS_10HashTrait
+__ZN7WebCore22SVGPreserveAspectRatio24parsePreserveAspectRatioERPKtS2_b
+__ZN7WebCore19SVGAnimatedPropertyINS_15SVGURIReferenceENS_6StringEXadL_ZNS_25SVGURIReferenceIdentifierEEEXadL_ZNS_10XLinkNames1
+__ZThn184_NK7WebCore16SVGScriptElement14contextElementEv
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplENS1_6StringENS1_10StringHashENS_10HashTraitsIS6_EENS9_IS7_EEE
+__ZThn288_NK7WebCore16SVGScriptElement13scriptCharsetEv
+__ZNK7WebCore16SVGScriptElement13scriptCharsetEv
+__ZThn288_NK7WebCore16SVGScriptElement21charsetAttributeValueEv
+__ZNK7WebCore16SVGScriptElement21charsetAttributeValueEv
+__ZN7WebCore12SVGTransform9setMatrixENS_20TransformationMatrixE
+__ZN7WebCoreL16tspanConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGTSpanElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGTSpanElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGTSpanElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore14RenderSVGTSpanC1EPNS_4NodeE
+__ZN7WebCore14RenderSVGTSpanC2EPNS_4NodeE
+__ZN7WebCore15RenderSVGInlineC2EPNS_4NodeE
+__ZNK7WebCore15RenderSVGInline13requiresLayerEv
+__ZNK7WebCore15SVGTSpanElement25childShouldCreateRendererEPNS_4NodeE
+__ZN7WebCore15RenderSVGInline13createFlowBoxEv
+__ZN7WebCore22SVGCharacterLayoutInfo14processedChunkEff
+__ZN3WTF6VectorIN7WebCore26SVGInlineBoxCharacterRangeELm0EE14shrinkCapacityEm
+__ZN7WebCore9InlineBox18isSVGRootInlineBoxEv
+__ZNK7WebCore16SVGInlineFlowBox12svgBoxHeightEv
+__ZN7WebCore30jsHTMLScriptElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLScriptElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLScriptElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCoreL15defsConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGDefsElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore14SVGDefsElement7isValidEv
+__ZN7WebCore14SVGDefsElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore8SVGColorC1ERKNS_6StringE
+__ZN7WebCoreL15maskConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGMaskElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore19SVGAnimatedPropertyINS_14SVGMaskElementEiXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS2_19maskUnitsAttrStringEEEEC
+__ZN7WebCore14SVGMaskElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore14SVGMaskElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore14SVGMaskElement7isValidEv
+__ZN7WebCore14SVGMaskElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore18RenderSVGContainerC1EPNS_16SVGStyledElementE
+__ZN7WebCore18RenderSVGContainer16setDrawsContentsEb
+__ZN7WebCore14SVGMaskElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore13StyleMaskDataC1ERKS0_
+__ZN7WebCore13StyleMaskDataC2ERKS0_
+__ZNK7WebCore13StyleMaskDataeqERKS0_
+__ZN7WebCore18RenderSVGContainer23calculateLocalTransformEv
 __ZN7WebCore14SVGMaskElement14canvasResourceEv
 __ZN7WebCore17SVGResourceMaskerC1EPKNS_14SVGMaskElementE
+__ZN7WebCore17SVGResourceMaskerC2EPKNS_14SVGMaskElementE
 __ZNK7WebCore17SVGResourceMasker12resourceTypeEv
 __ZN7WebCore17SVGResourceMasker9applyMaskEPNS_15GraphicsContextERKNS_9FloatRectE
 __ZNK7WebCore14SVGMaskElement17drawMaskerContentERKNS_9FloatRectERS1_
-__ZNK7WebCore14SVGMaskElement9maskUnitsEv
-__ZNK7WebCore14SVGMaskElement1xEv
-__ZNK7WebCore14SVGMaskElement1yEv
-__ZNK7WebCore14SVGMaskElement5widthEv
-__ZNK7WebCore14SVGMaskElement6heightEv
-__ZNK7WebCore14SVGMaskElement16maskContentUnitsEv
-__ZN7WebCore33applyExpandAlphatoGrayscaleFilterEP7CIImage
-__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE6shrinkEm
-__ZN7WebCore24RenderSVGHiddenContainer11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore16SVGMarkerElement14canvasResourceEv
-__ZN7WebCore17SVGResourceMarkerC1Ev
-__ZN7WebCore17SVGResourceMarker9setMarkerEPNS_26RenderSVGViewportContainerE
-__ZN7WebCore13SVGSVGElement14createSVGAngleEv
-__ZN7WebCore16SVGMarkerElement16setOrientToAngleEPNS_8SVGAngleE
-__ZN7WebCore16SVGMarkerElement23setOrientAngleBaseValueEPNS_8SVGAngleE
-__ZZNK7WebCore21SVGDocumentExtensions12baseValueMapIPNS_8SVGAngleEEEPN3WTF7HashMapIPKNS_10SVGElementEPNS5_IPNS_10StringImplET_NS_10StringHashENS4_10HashTraitsISA_EENSD_ISB_EEEENS4_7PtrHashIS8_EENSD_IS8_EENSD_ISH_EEEEvE14s_baseValueMap
-__ZN7WebCore16SVGMarkerElement14setOrientAngleEPNS_8SVGAngleE
-__ZNK7WebCore16SVGMarkerElement10orientTypeEv
-__ZNK7WebCore16SVGMarkerElement11orientAngleEv
-__ZNK7WebCore8SVGAngle5valueEv
-__ZNK7WebCore16SVGMarkerElement4refYEv
-__ZNK7WebCore16SVGMarkerElement4refXEv
-__ZN7WebCore17SVGResourceMarker6setRefEdd
-__ZNK7WebCore16SVGMarkerElement11markerUnitsEv
-__ZNK7WebCore17SVGResourceMarker12resourceTypeEv
-__ZN7WebCore15DrawMarkersDataC1EPNS_15GraphicsContextEPNS_17SVGResourceMarkerES4_d
-__ZN7WebCore22drawStartAndMidMarkersEPvPKNS_11PathElementE
-__ZN7WebCore18drawMarkerWithDataEPNS_15GraphicsContextERNS_10MarkerDataE
-__ZN7WebCore17SVGResourceMarker4drawEPNS_15GraphicsContextERKNS_9FloatRectEdddd
-__ZN3WTF7HashSetIPN7WebCore17SVGResourceMarkerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
-__ZNK7WebCore17SVGResourceMarker12cachedBoundsEv
-__ZN7WebCore17SVGResourceMarkerD1Ev
-__ZN7WebCore18SVGResourceClipper13resetClipDataEv
-__ZNK7WebCore10SVGElement21isStyledTransformableEv
-__ZN7WebCore11SVGFontDataD1Ev
-__ZN7WebCore10CachedFont20allReferencesRemovedEv
-__ZN7WebCore16SVGCursorElementD1Ev
-__ZNK7WebCore4Path11debugStringEv
-__ZN7WebCore31CGPathToCFStringApplierFunctionEPvPK13CGPathElement
-__ZN3WTFeqIN7WebCore6StringELm0EEEbRKNS_6VectorIT_XT0_EEES7_
-__ZNK7WebCore11SVGDocument17zoomAndPanEnabledEv
-__ZNK7WebCore13SVGZoomAndPan10zoomAndPanEv
-__ZNK7WebCore12RenderObject4yPosEv
-__ZNK7WebCore12RenderObject4xPosEv
-__ZN7WebCore12RenderObject22positionForCoordinatesEii
-__ZN7WebCore21SVGDocumentExtensions15pauseAnimationsEv
-__ZN7WebCore13SVGSVGElement15pauseAnimationsEv
-__ZNK7WebCore13TimeScheduler16animationsPausedEv
-__ZN7WebCore9CSSParser18parseHSLParametersEPNS_5ValueEPdb
-__ZN7WebCore16makeRGBAFromHSLAEdddd
-__ZN7WebCore10CachedFont20ensureCustomFontDataEv
-__ZN7WebCore28createFontCustomPlatformDataEPNS_12SharedBufferE
-__ZN7WebCore22FontCustomPlatformData16fontPlatformDataEibb
-__ZN3KJS17staticValueGetterIN7WebCore16JSRangePrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSRangePrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore45jsRangePrototypeFunctionCompareBoundaryPointsEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore35jsRangePrototypeFunctionSetEndAfterEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore36jsRangePrototypeFunctionSetEndBeforeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore5Range12setEndBeforeEPNS_4NodeERi
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_14RangeExceptionE
-__ZN7WebCore16JSRangeExceptionC1EPN3KJS8JSObjectEPNS_14RangeExceptionE
-__ZN7WebCore16JSRangeException18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSRangeExceptionPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore25JSRangeExceptionPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore25JSRangeExceptionPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore16JSRangeExceptionEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSRangeException16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore40jsRangePrototypeFunctionSurroundContentsEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore5Range16surroundContentsEN3WTF10PassRefPtrINS_4NodeEEERi
-__ZNK7WebCore5Range14maxStartOffsetEv
-__ZN7WebCore17HTMLObjectElement7setDataERKNS_6StringE
-__ZN3KJS17staticValueGetterIN7WebCore27JSDOMCoreExceptionPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore27JSDOMCoreExceptionPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore37jsUIEventPrototypeFunctionInitUIEventEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9JSUIEvent9classInfoEv
-__ZN7WebCore39jsTextPrototypeFunctionReplaceWholeTextEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4Text16replaceWholeTextERKNS_6StringERi
-__ZN7WebCore33earliestLogicallyAdjacentTextNodeEPKNS_4TextE
-__ZN7WebCore31latestLogicallyAdjacentTextNodeEPKNS_4TextE
-__ZN7WebCore25min_colorMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore21colorMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore23screenDepthPerComponentEPNS_6WidgetE
-__ZN7WebCore11numberValueEPNS_8CSSValueERf
-__ZN7WebCore30min_monochromeMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore26monochromeMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore18screenIsMonochromeEPNS_6WidgetE
-__ZN7WebCore26min_heightMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore22heightMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore26max_heightMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZNK7WebCore16HTMLTableElement7captionEv
-__ZN7WebCore48jsHTMLTableElementPrototypeFunctionCreateCaptionEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16HTMLTableElement13createCaptionEv
-__ZN7WebCore16HTMLTableElement10setCaptionEN3WTF10PassRefPtrINS_23HTMLTableCaptionElementEEERi
-__ZN7WebCore16HTMLTableElement13deleteCaptionEv
-__ZN7WebCore46jsHTMLTableElementPrototypeFunctionCreateTHeadEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16HTMLTableElement11createTHeadEv
-__ZN7WebCore16HTMLTableElement8setTHeadEN3WTF10PassRefPtrINS_23HTMLTableSectionElementEEERi
-__ZN7WebCore16HTMLTableElement11deleteTHeadEv
-__ZN7WebCore46jsHTMLTableElementPrototypeFunctionCreateTFootEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16HTMLTableElement11createTFootEv
-__ZN7WebCore16HTMLTableElement8setTFootEN3WTF10PassRefPtrINS_23HTMLTableSectionElementEEERi
-__ZN7WebCore16HTMLTableElement11deleteTFootEv
-__ZN7WebCore25toHTMLTableCaptionElementEPN3KJS7JSValueE
-__ZNK7WebCore25JSHTMLTableCaptionElement9classInfoEv
-__ZNK7WebCore25JSHTMLTableCaptionElement4implEv
-__ZN7WebCore25toHTMLTableSectionElementEPN3KJS7JSValueE
-__ZN7WebCore48jsHTMLTableElementPrototypeFunctionDeleteCaptionEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore46jsHTMLTableElementPrototypeFunctionDeleteTHeadEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore46jsHTMLTableElementPrototypeFunctionDeleteTFootEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore19HTMLTableRowElement15sectionRowIndexEv
-__ZN7WebCore6JSAttr16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore6JSAttr8setValueEPN3KJS9ExecStateEPNS1_7JSValueE
-__ZN7WebCore45jsElementPrototypeFunctionRemoveAttributeNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Element19removeAttributeNodeEPNS_4AttrERi
-__ZN7WebCore15HTMLMetaElement12setHttpEquivERKNS_6StringE
-__ZN7WebCore48jsNamedNodeMapPrototypeFunctionRemoveNamedItemNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12NamedAttrMap17removeNamedItemNSERKNS_6StringES3_Ri
-__ZN7WebCore21createFontFaceWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore29JSSVGFontFaceElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore20JSSVGFontFaceElementC1EPN3KJS8JSObjectEPNS_18SVGFontFaceElementE
-__ZNK7WebCore20JSSVGFontFaceElement9classInfoEv
-__ZN7WebCore25createMissingGlyphWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore33JSSVGMissingGlyphElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore24JSSVGMissingGlyphElementC1EPN3KJS8JSObjectEPNS_22SVGMissingGlyphElementE
-__ZNK7WebCore24JSSVGMissingGlyphElement9classInfoEv
-__ZN7WebCore18createGlyphWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore26JSSVGGlyphElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSSVGGlyphElementC1EPN3KJS8JSObjectEPNS_15SVGGlyphElementE
-__ZNK7WebCore17JSSVGGlyphElement9classInfoEv
-__ZNK7WebCore12JSSVGElement9classInfoEv
-__ZN7WebCore17createFontWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore25JSSVGFontElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore16JSSVGFontElementC1EPN3KJS8JSObjectEPNS_14SVGFontElementE
-__ZNK7WebCore16JSSVGFontElement9classInfoEv
-__ZN7WebCore18createTSpanWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore26JSSVGTSpanElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore17JSSVGTSpanElementC1EPN3KJS8JSObjectEPNS_15SVGTSpanElementE
-__ZNK7WebCore17JSSVGTSpanElement9classInfoEv
-__ZN7WebCore56jsSVGTextContentElementPrototypeFunctionGetNumberOfCharsEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore41jsHTMLButtonElementPrototypeFunctionClickEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore50jsHTMLIFrameElementPrototypeFunctionGetSVGDocumentEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore21HTMLFrameOwnerElement14getSVGDocumentERi
-__ZN7WebCore50jsHTMLObjectElementPrototypeFunctionGetSVGDocumentEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16createSetWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore24JSSVGSetElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore30JSSVGAnimationElementPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSSVGSetElementC1EPN3KJS8JSObjectEPNS_13SVGSetElementE
-__ZN7WebCore21JSSVGAnimationElementC2EPN3KJS8JSObjectEPNS_19SVGAnimationElementE
-__ZN7WebCore21JSSVGAnimationElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore30JSSVGAnimationElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore15JSSVGSetElement9classInfoEv
-__ZN7WebCore22JSSVGLengthConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore22JSSVGLengthConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore22JSSVGLengthConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore14SVGRectElement24SVGAnimatedTemplateWidth7animValEv
-__ZN7WebCore61jsSVGTextContentElementPrototypeFunctionGetComputedTextLengthEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore21SVGTextContentElement21getComputedTextLengthEv
-__ZN7WebCore21createTextPathWrapperEPN3KJS9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
-__ZN7WebCore20JSSVGTextPathElementC1EPN3KJS8JSObjectEPNS_18SVGTextPathElementE
-__ZN7WebCore20JSSVGTextPathElement18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore29JSSVGTextPathElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore20JSSVGTextPathElement9classInfoEv
-__ZN7WebCore57jsSVGTextContentElementPrototypeFunctionGetRotationOfCharEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore21SVGTextContentElement17getRotationOfCharElRi
-__ZN7WebCore16JSSVGFontElementD0Ev
-__ZN7WebCore17JSSVGGlyphElementD0Ev
-__ZN7WebCore24JSSVGMissingGlyphElementD0Ev
-__ZN7WebCore20JSSVGFontFaceElementD0Ev
-__ZN7WebCore15JSSVGSetElementD0Ev
-__ZN7WebCore17JSSVGTSpanElementD0Ev
-__ZN7WebCore25JSSVGFontElementPrototypeD0Ev
-__ZN7WebCore26JSSVGGlyphElementPrototypeD0Ev
-__ZN7WebCore33JSSVGMissingGlyphElementPrototypeD0Ev
-__ZN7WebCore29JSSVGFontFaceElementPrototypeD0Ev
-__ZN7WebCore24JSSVGSetElementPrototypeD0Ev
-__ZN7WebCore26JSSVGTSpanElementPrototypeD0Ev
-__ZN7WebCore58jsSVGTextContentElementPrototypeFunctionGetSubStringLengthEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore21SVGTextContentElement18getSubStringLengthElmRi
-__ZN3WTF9HashTableIN7WebCore24PODTypeReadWriteHashInfoINS1_9FloatRectENS1_19SVGAnimatedTemplateIS3_EEEESt4pairIS6_iENS_18PairFirstExtractorIS8_EENS1_28PODTypeReadWriteHashInfoHashIS3_S5_EENS_14PairHashTraitsINS1_30PODTypeReadWriteHashInfoTraitsIS3_S5_EENS_10HashTraitsIiEEEESF_E47removeAndInvalidateWithoutEntryConsistencyCheckEPS8_
-__ZN7WebCore10JSLocation16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore21allowsAccessFromFrameEPN3KJS9ExecStateEPNS_5FrameE
-__ZNK7WebCore23JSDOMSelectionPrototype9classInfoEv
-__ZN7WebCore9JSHistory3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore9JSHistory9customPutEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore46jsHTMLOptionsCollectionPrototypeFunctionRemoveEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore23JSHTMLOptionsCollection9classInfoEv
-__ZN7WebCore23JSHTMLOptionsCollection6removeEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore13MutationEventC1Ev
-__ZN7WebCore15JSMutationEvent18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore15JSMutationEventEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore15JSMutationEvent16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore26JSMutationEventConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore24JSMutationEventPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore43jsHTMLOptionsCollectionPrototypeFunctionAddEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore23JSHTMLOptionsCollection3addEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore21HTMLOptionsCollection3addEN3WTF10PassRefPtrINS_17HTMLOptionElementEEERi
-__ZN7WebCore21HTMLOptionsCollection3addEN3WTF10PassRefPtrINS_17HTMLOptionElementEEEiRi
-__ZNK7WebCore15JSTextPrototype9classInfoEv
-__ZNK7WebCore24JSCharacterDataPrototype9classInfoEv
-__ZNK7WebCore17JSTextConstructor9classInfoEv
-__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionTransformEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGMaskElementENS_9SVGLengthEXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_11xAttrStrin
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGMaskElementENS_9SVGLengthEXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_11yAttrStrin
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGMaskElementENS_9SVGLengthEXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_16heightAttr
+__ZN7WebCore30clampImageBufferSizeToViewportEPNS_9FrameViewERNS_7IntSizeE
+__ZN7WebCore20renderSubtreeToImageEPNS_11ImageBufferEPNS_12RenderObjectE
+__ZNK7WebCore11ImageBuffer12getImageDataERKNS_7IntRectE
+__ZN7WebCore9ImageData6createEjj
+__ZN7WebCore9ImageDataC1Ejj
+__ZN7WebCore9ImageDataC2Ejj
+__ZN7WebCore16CanvasPixelArray6createEj
+__ZN7WebCore16CanvasPixelArrayC1Ej
+__ZN7WebCore16CanvasPixelArrayC2Ej
+__ZN7WebCore11ImageBuffer12putImageDataEPNS_9ImageDataERKNS_7IntRectERKNS_8IntPointE
+__ZN7WebCore30JSHTMLScriptElementConstructorD1Ev
+__ZNK7WebCore21HTMLFrameOwnerElement13scrollingModeEv
+__ZN7WebCore6Widget11handleEventEPNS_5EventE
+__ZNK7WebCore14RenderFieldset10renderNameEv
+__ZN7WebCore8Document17setSecurityOriginEPNS_14SecurityOriginE
+__ZN7WebCore11FrameLoader5writeERKNS_6StringE
+__ZNK7WebCore15CSSInitialValue22isImplicitInitialValueEv
+__ZN7WebCore10CachedFont5errorEv
+__ZNK7WebCore15HTMLLinkElement14isURLAttributeEPNS_9AttributeE
+__ZN7WebCore9TextCodec25getUnencodableReplacementEjNS_19UnencodableHandlingEPc
+__ZN7WebCore21setJSDOMWindowOnclickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow10setOnclickEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZNK7WebCore17RenderFlexibleBox10renderNameEv
+__ZN7WebCore17RenderFlexibleBoxD0Ev
+__ZN7WebCore24setJSHTMLFormElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLFormElement7setNameERKNS_6StringE
+__ZNK7WebCore16StyleCachedImage8isLoadedEv
+__ZNK7WebCore11RenderBlock18adjustForBorderFitEiRiS1_
+__ZN7WebCore5Image9drawTiledEPNS_15GraphicsContextERKNS_9FloatRectES5_NS0_8TileRuleES6_NS_17CompositeOperatorE
+__ZN7WebCore13InlineFlowBox9paintMaskERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore8SVGImage26nativeImageForCurrentFrameEv
+__ZN7WebCore5Image14startAnimationEb
+__ZN7WebCore13InlineFlowBox14paintBoxShadowEPNS_15GraphicsContextEPNS_11RenderStyleEiiii
+__ZN7WebCore15GraphicsContext18clipOutRoundedRectERKNS_7IntRectERKNS_7IntSizeES6_S6_S6_
+__ZN7WebCore15GraphicsContext7clipOutERKNS_4PathE
+__ZN7WebCore55jsCanvasRenderingContext2DPrototypeFunctionGetImageDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZNK7WebCore24CanvasRenderingContext2D12getImageDataEffffRi
+__ZNK7WebCore17HTMLCanvasElement22convertLogicalToDeviceERKNS_9FloatRectE
+__ZNK7WebCore17HTMLCanvasElement22convertLogicalToDeviceERKNS_10FloatPointE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9ImageDataE
+__ZN7WebCore11JSImageData15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSImageDataC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9ImageDataEEE
+__ZN7WebCore11JSImageDataC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9ImageDataEEE
+__ZN7WebCore11JSImageData18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsImageDataWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17jsImageDataHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore55jsCanvasRenderingContext2DPrototypeFunctionPutImageDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore26JSCanvasRenderingContext2D12putImageDataEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore11toImageDataEN3JSC7JSValueE
+__ZNK7WebCore11JSImageData9classInfoEv
+__ZN7WebCore24CanvasRenderingContext2D12putImageDataEPNS_9ImageDataEffRi
+__ZN7WebCore24CanvasRenderingContext2D12putImageDataEPNS_9ImageDataEffffffRi
+__ZN7WebCore11JSImageDataD1Ev
+__ZN7WebCore11JSImageDataD2Ev
+__ZN7WebCore20JSImageDataPrototypeD1Ev
+__ZN7WebCore9CSSParser11parseCanvasERN3WTF6RefPtrINS_8CSSValueEEE
+__ZNK7WebCore14CSSCanvasValue11isFixedSizeEv
+__ZNK7WebCore10StyleImage13isCachedImageEv
+__ZN7WebCore46jsDocumentPrototypeFunctionGetCSSCanvasContextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document19getCSSCanvasContextERKNS_6StringES3_ii
+__ZN7WebCore8Document19getCSSCanvasElementERKNS_6StringE
+__ZNK3WTF7HashMapIN7WebCore6StringENS_6RefPtrINS1_17HTMLCanvasElementEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3getER
+__ZN3WTF7HashMapIN7WebCore6StringENS_6RefPtrINS1_17HTMLCanvasElementEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERK
+__ZNK7WebCore10StyleImage13errorOccurredEv
+__ZNK7WebCore19StyleGeneratedImage21imageHasRelativeWidthEv
+__ZN7WebCore14CSSCanvasValue5imageEPNS_12RenderObjectERKNS_7IntSizeE
+__ZN7WebCore14CSSCanvasValue7elementEPNS_8DocumentE
+__ZThn104_N7WebCore14CSSCanvasValue13canvasChangedEPNS_17HTMLCanvasElementERKNS_9FloatRectE
+__ZN7WebCore14CSSCanvasValue13canvasChangedEPNS_17HTMLCanvasElementERKNS_9FloatRectE
+__ZNK7WebCore19StyleGeneratedImage4dataEv
+__ZN7WebCore14CSSCanvasValue9fixedSizeEPKNS_12RenderObjectE
+__ZThn104_N7WebCore14CSSCanvasValue15canvasDestroyedEPNS_17HTMLCanvasElementE
+__ZN7WebCore14CSSCanvasValue15canvasDestroyedEPNS_17HTMLCanvasElementE
+__ZN7WebCore14CSSCanvasValueD0Ev
+__ZNK7WebCore16RenderHTMLCanvas10renderNameEv
+__ZN7WebCore53setJSCanvasRenderingContext2DGlobalCompositeOperationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D27setGlobalCompositeOperationERKNS_6StringE
+__ZN7WebCore22parseCompositeOperatorERKNS_6StringERNS_17CompositeOperatorE
+__ZN7WebCore55jsCanvasRenderingContext2DPrototypeFunctionSetFillColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore26JSCanvasRenderingContext2D12setFillColorEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D12setFillColorEffff
+__ZN7WebCore11CanvasStyleC1Effff
+__ZN7WebCore11CanvasStyleC2Effff
+__ZN7WebCore20makeRGBA32FromFloatsEffff
+__ZN7WebCoreL20colorFloatToRGBAByteEf
+__ZN7WebCore55jsCanvasRenderingContext2DPrototypeFunctionSetTransformEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore24CanvasRenderingContext2D12setTransformEffffff
+__ZNK7WebCore15GraphicsContext6getCTMEv
+__ZNK7WebCore17HTMLCanvasElement13baseTransformEv
 __ZN7WebCore24CanvasRenderingContext2D9transformEffffff
+__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionTransformEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore16RenderHTMLCanvas17canvasSizeChangedEv
-__ZN7WebCore63jsCanvasRenderingContext2DPrototypeFunctionCreateRadialGradientEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D20createRadialGradientEffffff
-__ZN7WebCore14CanvasGradientC1ERKNS_10FloatPointEfS3_f
-__ZN7WebCore48jsCanvasRenderingContext2DPrototypeFunctionArcToEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D5arcToEfffffRi
-__ZN7WebCore4Path8addArcToERKNS_10FloatPointES3_f
-__ZN7WebCore56jsCanvasRenderingContext2DPrototypeFunctionBezierCurveToEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore48jsCanvasRenderingContext2DPrototypeFunctionScaleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D5scaleEff
+__ZN7WebCore42setJSCanvasRenderingContext2DShadowOffsetXEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D16setShadowOffsetXEf
+__ZN7WebCore24CanvasRenderingContext2D11applyShadowEv
+__ZN7WebCore42setJSCanvasRenderingContext2DShadowOffsetYEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D16setShadowOffsetYEf
+__ZN7WebCore39setJSCanvasRenderingContext2DShadowBlurEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D13setShadowBlurEf
+__ZN7WebCore40setJSCanvasRenderingContext2DShadowColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D14setShadowColorERKNS_6StringE
+__ZN7WebCore56jsCanvasRenderingContext2DPrototypeFunctionBezierCurveToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
 __ZN7WebCore24CanvasRenderingContext2D13bezierCurveToEffffff
-__ZN7WebCore56jsCanvasRenderingContext2DPrototypeFunctionCreatePatternEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore26JSCanvasRenderingContext2D13createPatternEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore24CanvasRenderingContext2D13createPatternEPNS_17HTMLCanvasElementERKNS_6StringERi
-__ZN7WebCore13CanvasPattern19parseRepetitionTypeERKNS_6StringERbS4_Ri
-__ZN7WebCore13CanvasPatternC1EP7CGImagebb
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_13CanvasPatternE
-__ZN7WebCore24JSCanvasPatternPrototype4selfEPN3KJS9ExecStateE
-__ZN7WebCore15JSCanvasPatternC1EPN3KJS8JSObjectEPNS_13CanvasPatternE
-__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_16HTMLImageElementEff
-__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionRotateEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore49jsCanvasRenderingContext2DPrototypeFunctionRotateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore24CanvasRenderingContext2D6rotateEf
 __ZN7WebCore15GraphicsContext6rotateEf
-__ZN7WebCore56jsCanvasRenderingContext2DPrototypeFunctionIsPointInPathEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24CanvasRenderingContext2D13isPointInPathEff
-__ZNK7WebCore15AffineTransform8mapPointERKNS_10FloatPointE
-__ZN7WebCore24CanvasRenderingContext2D13createPatternEPNS_16HTMLImageElementERKNS_6StringERi
-__ZN7WebCore13CanvasPatternC1EPNS_11CachedImageEbb
+__ZN7WebCore33setJSCanvasRenderingContext2DFontEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D7setFontERKNS_6StringE
+__ZN7WebCore16CSSStyleSelector20applyPropertyToStyleEiPNS_8CSSValueEPNS_11RenderStyleE
+__ZN7WebCore53jsCanvasRenderingContext2DPrototypeFunctionStrokeTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore26JSCanvasRenderingContext2D10strokeTextEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D10strokeTextERKNS_6StringEff
+__ZN7WebCore24CanvasRenderingContext2D16drawTextInternalERKNS_6StringEffbfb
+__ZN7WebCore24CanvasRenderingContext2D10accessFontEv
+__ZN7WebCore51jsCanvasRenderingContext2DPrototypeFunctionFillTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26JSCanvasRenderingContext2D8fillTextEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D8fillTextERKNS_6StringEff
+__ZN7WebCore56jsCanvasRenderingContext2DPrototypeFunctionCreatePatternEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
+__ZN7WebCore26JSCanvasRenderingContext2D13createPatternEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D13createPatternEPNS_17HTMLCanvasElementERKNS_6StringERi
+__ZN7WebCore13CanvasPattern19parseRepetitionTypeERKNS_6StringERbS4_Ri
+__ZN7WebCore13CanvasPatternC1EPNS_5ImageEbbb
+__ZN7WebCore13CanvasPatternC2EPNS_5ImageEbbb
+__ZN7WebCore7PatternC1EPNS_5ImageEbb
+__ZN7WebCore7PatternC2EPNS_5ImageEbb
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_13CanvasPatternE
+__ZN7WebCore15JSCanvasPattern15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSCanvasPatternC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CanvasPatternEEE
+__ZN7WebCore15JSCanvasPatternC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CanvasPatternEEE
 __ZNK7WebCore15JSCanvasPattern9classInfoEv
 __ZN7WebCore11CanvasStyleC1EN3WTF10PassRefPtrINS_13CanvasPatternEEE
-__ZN7WebCore24CanvasRenderingContext2D16applyFillPatternEv
-__ZN7WebCore13CanvasPattern13createPatternERK17CGAffineTransform
-__ZN7WebCore15patternCallbackEPvP9CGContext
-__ZN7WebCore11BitmapImage13getCGImageRefEv
-__ZN7WebCore22patternReleaseCallbackEPv
-__ZN7WebCore60jsCanvasRenderingContext2DPrototypeFunctionDrawImageFromRectEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore26JSCanvasRenderingContext2D17drawImageFromRectEPN3KJS9ExecStateERKNS1_4ListE
+__ZN7WebCore11CanvasStyleC2EN3WTF10PassRefPtrINS_13CanvasPatternEEE
+__ZN7WebCore15GraphicsContext14setFillPatternEN3WTF10PassRefPtrINS_7PatternEEE
+__ZN7WebCore15GraphicsContext16applyFillPatternEv
+__ZNK7WebCore7Pattern21createPlatformPatternERKNS_20TransformationMatrixE
+__ZN7WebCoreL15patternCallbackEPvP9CGContext
+__ZN7WebCoreL22patternReleaseCallbackEPv
+__ZN7WebCore15JSCanvasPatternD1Ev
+__ZN7WebCore15JSCanvasPatternD2Ev
+__ZN7WebCore7PatternD0Ev
+__ZN7WebCore24JSCanvasPatternPrototypeD1Ev
+__ZN7WebCore58jsCanvasRenderingContext2DPrototypeFunctionCreateImageDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZNK7WebCore24CanvasRenderingContext2D15createImageDataEff
+__ZN7WebCoreL20createEmptyImageDataERKNS_7IntSizeE
+__ZN7WebCore24CanvasRenderingContext2D5resetEv
+__ZN7WebCore35jsCanvasRenderingContext2DFillStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore26JSCanvasRenderingContext2D9fillStyleEPN3JSC9ExecStateE
+__ZNK7WebCore24CanvasRenderingContext2D9fillStyleEv
+__ZN7WebCoreL4toJSEPN3JSC9ExecStateEPNS_11CanvasStyleE
+__ZN7WebCore37jsCanvasRenderingContext2DStrokeStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore26JSCanvasRenderingContext2D11strokeStyleEPN3JSC9ExecStateE
+__ZNK7WebCore24CanvasRenderingContext2D11strokeStyleEv
+__ZN7WebCore38setJSCanvasRenderingContext2DTextAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D12setTextAlignERKNS_6StringE
+__ZN7WebCore14parseTextAlignERKNS_6StringERNS_9TextAlignE
+__ZN7WebCore54jsCanvasRenderingContext2DPrototypeFunctionMeasureTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore24CanvasRenderingContext2D11measureTextERKNS_6StringE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_11TextMetricsE
+__ZN7WebCore13JSTextMetrics15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSTextMetricsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11TextMetricsEEE
+__ZN7WebCore13JSTextMetricsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11TextMetricsEEE
+__ZN7WebCore13JSTextMetrics18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18jsTextMetricsWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41setJSCanvasRenderingContext2DTextBaselineEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D15setTextBaselineERKNS_6StringE
+__ZN7WebCore17parseTextBaselineERKNS_6StringERNS_12TextBaselineE
+__ZN7WebCore13JSTextMetricsD1Ev
+__ZN7WebCore13JSTextMetricsD2Ev
+__ZN7WebCore22JSTextMetricsPrototypeD1Ev
+__ZN7WebCore48jsCanvasRenderingContext2DPrototypeFunctionArcToEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D5arcToEfffffRi
+__ZN7WebCore4Path8addArcToERKNS_10FloatPointES3_f
+__ZN7WebCore22jsHTMLEmbedElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLEmbedElement4typeEv
+__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_17HTMLCanvasElementERKNS_9FloatRectES5_Ri
+__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_16HTMLImageElementEff
+__ZN7WebCore60jsCanvasRenderingContext2DPrototypeFunctionDrawImageFromRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7
+__ZN7WebCore26JSCanvasRenderingContext2D17drawImageFromRectEPN3JSC9ExecStateERKNS1_7ArgListE
 __ZN7WebCore24CanvasRenderingContext2D17drawImageFromRectEPNS_16HTMLImageElementEffffffffRKNS_6StringE
-__ZN7WebCore13CanvasPatternD1Ev
-__ZN7WebCore24JSCanvasPatternPrototypeD0Ev
-__ZN7WebCore42jsCharacterDataPrototypeFunctionDeleteDataEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore48jsDocumentPrototypeFunctionCreateEntityReferenceEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document21createEntityReferenceERKNS_6StringERi
-__ZN7WebCore45jsDocumentPrototypeFunctionCreateCDATASectionEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document18createCDATASectionERKNS_6StringERi
-__ZNK7WebCore16DocumentFragment8nodeNameEv
-__ZN7WebCore8Document9cloneNodeEb
-__ZN7WebCore45jsCharacterDataPrototypeFunctionSubstringDataEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore42jsCharacterDataPrototypeFunctionInsertDataEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4Node12setNodeValueERKNS_6StringERi
-__ZN7WebCore42jsCharacterDataPrototypeFunctionAppendDataEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore54jsDocumentPrototypeFunctionCreateProcessingInstructionEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4Attr9cloneNodeEb
-__ZN7WebCore44jsDocumentPrototypeFunctionCreateAttributeNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore15JSMutationEvent9classInfoEv
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_14EventExceptionE
-__ZN7WebCore16JSEventExceptionC1EPN3KJS8JSObjectEPNS_14EventExceptionE
-__ZN7WebCore16JSEventException18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore25JSEventExceptionPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore16JSEventExceptionEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSEventException16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore17HTMLObjectElement18containsJavaAppletEv
-__ZNK7WebCore15HTMLBaseElement6targetEv
-__ZNK7WebCore16HTMLTableElement7summaryEv
-__ZN7WebCore48jsHTMLTableRowElementPrototypeFunctionDeleteCellEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore19HTMLTableRowElement10deleteCellEiRi
-__ZNK7WebCore14HTMLModElement4citeEv
-__ZNK7WebCore15HTMLMenuElement7compactEv
-__ZNK7WebCore20HTMLTableCellElement7bgColorEv
-__ZNK7WebCore23HTMLTableSectionElement6vAlignEv
-__ZNK7WebCore15HTMLLinkElement8hreflangEv
-__ZNK7WebCore15HTMLAreaElement6noHrefEv
-__ZNK7WebCore20HTMLTableCellElement5alignEv
-__ZN7WebCore51jsHTMLTableSectionElementPrototypeFunctionDeleteRowEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore23HTMLTableSectionElement9deleteRowEiRi
-__ZN7WebCore34jsNodePrototypeFunctionIsSupportedEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4Node11isSupportedERKNS_6StringES3_
-__ZNK7WebCore16HTMLInputElement6useMapEv
-__ZNK7WebCore20HTMLParagraphElement5alignEv
-__ZNK7WebCore20HTMLTableCellElement5chOffEv
-__ZNK7WebCore19HTMLTableColElement5widthEv
-__ZNK7WebCore20HTMLTableCellElement5scopeEv
-__ZNK7WebCore16HTMLImageElement6borderEv
-__ZNK7WebCore16HTMLTableElement5frameEv
-__ZNK7WebCore16HTMLTableElement5alignEv
-__ZNK7WebCore17HTMLOptionElement15defaultSelectedEv
-__ZNK7WebCore23HTMLTableSectionElement5alignEv
-__ZNK7WebCore19HTMLTableColElement2chEv
-__ZNK7WebCore16HTMLTableElement5widthEv
-__ZNK7WebCore16HTMLOListElement7compactEv
-__ZNK7WebCore15HTMLLinkElement6targetEv
-__ZNK7WebCore15HTMLLinkElement7charsetEv
-__ZNK7WebCore23HTMLTableSectionElement5chOffEv
-__ZNK7WebCore20HTMLTableCellElement2chEv
-__ZNK7WebCore15HTMLLinkElement5mediaEv
-__ZNK7WebCore16HTMLDListElement7compactEv
-__ZNK7WebCore19HTMLTableRowElement5alignEv
-__ZNK7WebCore23HTMLTableCaptionElement5alignEv
-__ZNK7WebCore16HTMLTableElement7bgColorEv
-__ZNK7WebCore19HTMLOptGroupElement5labelEv
-__ZNK7WebCore17HTMLAppletElement6objectEv
-__ZNK7WebCore20HTMLFrameElementBase9scrollingEv
-__ZNK7WebCore17HTMLAppletElement4codeEv
-__ZNK7WebCore20HTMLTableCellElement6vAlignEv
-__ZNK7WebCore19HTMLTableColElement5alignEv
-__ZNK7WebCore20HTMLTableCellElement4abbrEv
-__ZNK7WebCore17HTMLAppletElement6vspaceEv
-__ZNK7WebCore15HTMLMetaElement6schemeEv
-__ZNK7WebCore13HTMLHRElement5alignEv
-__ZNK7WebCore19HTMLTableRowElement5chOffEv
-__ZNK7WebCore15HTMLFormElement13acceptCharsetEv
-__ZNK7WebCore19HTMLTableColElement5chOffEv
-__ZNK7WebCore19HTMLTableRowElement6vAlignEv
-__ZNK7WebCore15HTMLFontElement4sizeEv
-__ZNK7WebCore16HTMLTableElement5rulesEv
-__ZNK7WebCore20HTMLTableCellElement7headersEv
-__ZNK7WebCore20HTMLTableCellElement6noWrapEv
-__ZNK7WebCore13HTMLHRElement7noShadeEv
-__ZNK7WebCore13HTMLBRElement5clearEv
-__ZNK7WebCore16HTMLImageElement5isMapEv
-__ZNK7WebCore15HTMLAreaElement9accessKeyEv
-__ZNK7WebCore19HTMLBaseFontElement5colorEv
-__ZNK7WebCore15HTMLAreaElement3altEv
-__ZNK7WebCore14HTMLDivElement5alignEv
-__ZNK7WebCore17HTMLAppletElement7archiveEv
-__ZN7WebCore14HTMLMapElement5areasEv
-__ZNK7WebCore20HTMLDirectoryElement7compactEv
-__ZNK7WebCore15HTMLHeadElement7profileEv
-__ZNK7WebCore17HTMLAppletElement8codeBaseEv
-__ZNK7WebCore16HTMLImageElement8longDescEv
-__ZNK7WebCore23HTMLTableSectionElement2chEv
-__ZNK7WebCore18HTMLIsIndexElement6promptEv
-__ZNK7WebCore16HTMLQuoteElement4citeEv
-__ZNK7WebCore19HTMLTableRowElement2chEv
-__ZNK7WebCore16HTMLInputElement6acceptEv
-__ZNK7WebCore15HTMLFontElement4faceEv
-__ZNK7WebCore21HTMLBlockquoteElement4citeEv
-__ZNK7WebCore19HTMLTextAreaElement9accessKeyEv
-__ZNK7WebCore17HTMLButtonElement9accessKeyEv
-__ZNK7WebCore14HTMLModElement8dateTimeEv
-__ZNK7WebCore19HTMLTableColElement6vAlignEv
-__ZNK7WebCore19HTMLBaseFontElement4sizeEv
-__ZNK7WebCore15HTMLHtmlElement7versionEv
-__ZNK7WebCore19HTMLTableRowElement7bgColorEv
-__ZNK7WebCore17HTMLAppletElement6hspaceEv
-__ZNK7WebCore15HTMLAreaElement5shapeEv
-__ZNK7WebCore17HTMLLegendElement5alignEv
-__ZNK7WebCore16HTMLUListElement7compactEv
-__ZNK7WebCore15HTMLFormElement6targetEv
-__ZNK7WebCore16HTMLParamElement4typeEv
-__ZNK7WebCore20HTMLTableCellElement4axisEv
-__ZNK7WebCore16HTMLImageElement6vspaceEv
-__ZNK7WebCore16HTMLImageElement6hspaceEv
-__ZNK7WebCore14HTMLPreElement5widthEv
-__ZN7WebCore17HTMLSelectElement26listBoxDefaultEventHandlerEPNS_5EventE
-__ZNK7WebCore15HTMLBodyElement5aLinkEv
-__ZNK7WebCore19HTMLBaseFontElement4faceEv
-__ZNK7WebCore16HTMLOListElement4typeEv
-__ZNK7WebCore17HTMLAppletElement3altEv
-__ZNK7WebCore17HTMLOptionElement5labelEv
-__ZNK7WebCore13HTMLHRElement4sizeEv
-__ZNK7WebCore15HTMLFontElement5colorEv
-__ZNK7WebCore15HTMLLinkElement3revEv
-__ZNK7WebCore17HTMLLegendElement9accessKeyEv
-__ZNK7WebCore16HTMLLabelElement9accessKeyEv
-__ZNK7WebCore16HTMLParamElement9valueTypeEv
-__ZNK7WebCore13HTMLHRElement5widthEv
-__ZNK7WebCore17HTMLScriptElement7htmlForEv
-__ZNK7WebCore17HTMLScriptElement5deferEv
-__ZNK7WebCore17HTMLScriptElement5eventEv
-__ZNK7WebCore17HTMLScriptElement7charsetEv
-__ZNK7WebCore17HTMLIFrameElement5alignEv
-__ZNK7WebCore20HTMLFrameElementBase8longDescEv
-__ZNK7WebCore20HTMLFrameElementBase11marginWidthEv
-__ZNK7WebCore20HTMLFrameElementBase12marginHeightEv
-__ZNK7WebCore19HTMLFrameSetElement4rowsEv
-__ZNK7WebCore19HTMLFrameSetElement4colsEv
-__ZN3KJS17staticValueGetterIN7WebCore23JSProcessingInstructionEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore23JSProcessingInstruction16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore15EntityReferenceC1EPNS_8DocumentERKNS_6StringE
-__ZNK7WebCore15EntityReference8nodeTypeEv
-__ZN7WebCore17JSEntityReferenceC1EPN3KJS8JSObjectEPNS_15EntityReferenceE
-__ZNK7WebCore17JSEntityReference9classInfoEv
-__ZN7WebCore17JSEntityReference18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore15EntityReferenceD1Ev
-__ZNK7WebCore21JSHTMLFrameSetElement9classInfoEv
-__ZN7WebCore19CachedXSLStyleSheetD1Ev
-__ZN7WebCore34jsNodePrototypeFunctionIsEqualNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore4Node11isEqualNodeEPS0_
-__ZNK7WebCore4Node6prefixEv
-__ZN7WebCore16PendingCallbacks36PendingProcessingInstructionCallback4callEPNS_12XMLTokenizerE
-__ZN7WebCore41jsNodePrototypeFunctionIsDefaultNamespaceEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore4Node18isDefaultNamespaceERKNS_6StringE
-__ZNK7WebCore4Node15ancestorElementEv
-__ZN7WebCore44jsElementPrototypeFunctionSetAttributeNodeNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9JSElement18setAttributeNodeNSEPN3KJS9ExecStateERKNS1_4ListE
-__ZN7WebCore7Element18setAttributeNodeNSEPNS_4AttrERi
-__ZN7WebCore41jsNodePrototypeFunctionLookupNamespaceURIEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document15canReplaceChildEPNS_4NodeES2_
-__ZN7WebCore36jsDocumentPrototypeFunctionAdoptNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore8Document9adoptNodeEN3WTF10PassRefPtrINS_4NodeEEERi
-__ZNK7WebCore15EntityReference8nodeNameEv
-__ZN7WebCore4Node12insertBeforeEN3WTF10PassRefPtrIS0_EEPS0_Ri
-__ZNK7WebCore12NamedAttrMap14mapsEquivalentEPKS0_
-__ZN7WebCore35jsNodePrototypeFunctionLookupPrefixEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore4Node12lookupPrefixERKNS_6StringE
-__ZNK7WebCore4Node21lookupNamespacePrefixERKNS_6StringEPKNS_7ElementE
-__ZN7WebCore8Document14setDocumentURIERKNS_6StringE
-__ZN7WebCore4Node11removeChildEPS0_Ri
-__ZN7WebCore44jsElementPrototypeFunctionGetAttributeNodeNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore33jsNodePrototypeFunctionIsSameNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore12DocumentType7baseURIEv
-__ZNK7WebCore4Text9wholeTextEv
-__ZN7WebCore23JSProcessingInstruction3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore21ProcessingInstruction12setNodeValueERKNS_6StringERi
-__ZN7WebCore21ProcessingInstruction7setDataERKNS_6StringERi
-__ZNK7WebCore12DocumentType8nodeNameEv
-__ZNK7WebCore4Node17isEventTargetNodeEv
-__ZN7WebCore17JSHTMLFontElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore15HTMLFontElement7setSizeERKNS_6StringE
-__ZN7WebCore16HTMLTableElement10setSummaryERKNS_6StringE
-__ZN7WebCore21JSHTMLTableColElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore19HTMLTableColElement8setWidthERKNS_6StringE
-__ZN7WebCore14RenderTableCol12imageChangedEPNS_11CachedImageE
-__ZN7WebCore18RenderTableSection12imageChangedEPNS_11CachedImageE
-__ZN7WebCore14RenderTableRow5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore16CSSStyleSelector19mapBackgroundOriginEPNS_15BackgroundLayerEPNS_8CSSValueE
-__ZN7WebCore16CSSStyleSelector22mapBackgroundCompositeEPNS_15BackgroundLayerEPNS_8CSSValueE
-__ZN7WebCore9CSSParser20parseTransformOriginEiRiS1_RN3WTF6RefPtrINS_8CSSValueEEES6_
-__ZNK7WebCore27TranslateTransformOperation20isTranslateOperationEv
-__ZN7WebCore27TranslateTransformOperation5applyERNS_15AffineTransformERKNS_7IntSizeE
-__ZN7WebCore8SVGImage16setContainerSizeERKNS_7IntSizeE
-__ZN7WebCore25SVGEmptyFrameLoaderClient15willChangeTitleEPNS_14DocumentLoaderE
-__ZN7WebCore25SVGEmptyFrameLoaderClient14didChangeTitleEPNS_14DocumentLoaderE
-__ZNK7WebCore13SVGSVGElement18relativeWidthValueEv
-__ZNK7WebCore13SVGSVGElement19relativeHeightValueEv
-__ZNK7WebCore16SVGScriptElement14contextElementEv
-__ZN7WebCore12SVGTransform9setMatrixERKNS_15AffineTransformE
-__ZN7WebCore8SVGImage26nativeImageForCurrentFrameEv
-__ZNK7WebCore5Image21mayFillWithSolidColorEv
-__ZNK7WebCore8SVGImage17hasRelativeHeightEv
-__ZN7WebCore13InlineFlowBox14paintBoxShadowEPNS_15GraphicsContextEPNS_11RenderStyleEiiii
-__ZN7WebCore5Image9drawTiledEPNS_15GraphicsContextERKNS_9FloatRectES5_NS0_8TileRuleES6_NS_17CompositeOperatorE
-__ZN7WebCore5Image14startAnimationEv
-__ZNK7WebCore11RenderBlock18adjustForBorderFitEiRiS1_
-__ZN7WebCore7calcHueEddd
-__ZN7WebCore57jsCSSStyleDeclarationPrototypeFunctionGetPropertyCSSValueEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_8CSSValueE
-__ZN7WebCore14JSCSSValueListC1EPN3KJS8JSObjectEPNS_12CSSValueListE
-__ZN7WebCore10JSCSSValueC1EPN3KJS8JSObjectEPNS_8CSSValueE
-__ZN7WebCore14JSCSSValueList18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore10JSCSSValue18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSCSSValueListPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore19JSCSSValuePrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore14JSCSSValueList9classInfoEv
-__ZNK7WebCore9StyleBase10isSVGPaintEv
-__ZNK7WebCore9StyleBase10isSVGColorEv
-__ZN7WebCore19JSCSSPrimitiveValueC1EPN3KJS8JSObjectEPNS_17CSSPrimitiveValueE
-__ZN7WebCore19JSCSSPrimitiveValue18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore28JSCSSPrimitiveValuePrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSCSSPrimitiveValue9classInfoEv
-__ZN7WebCore9CSSParser24parseTimingFunctionValueERPNS_9ValueListERd
-__ZN7WebCore22CSSTimingFunctionValue31isTransitionTimingFunctionValueEv
-__ZN7WebCore30jsHistoryPrototypeFunctionBackEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7History4backEv
-__ZN7WebCore11FrameLoader25scheduleHistoryNavigationEi
-__ZN7WebCore11FrameLoader10historyURLEi
-__ZN7WebCore11FrameLoader15goBackOrForwardEi
-__ZN7WebCore43jsDocumentPrototypeFunctionElementFromPointEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore22CSSTimingFunctionValue7cssTextEv
-__ZN7WebCore22CSSTimingFunctionValueD1Ev
-__ZN7WebCore9CSSParser21parseDashboardRegionsEib
-__ZN7WebCore15DashboardRegionD1Ev
+__ZN7WebCore24CanvasRenderingContext2D13createPatternEPNS_16HTMLImageElementERKNS_6StringERi
+__ZN7WebCore56jsCanvasRenderingContext2DPrototypeFunctionIsPointInPathEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
+__ZN7WebCore24CanvasRenderingContext2D13isPointInPathEff
+__ZN7WebCore52jsCanvasRenderingContext2DPrototypeFunctionSetShadowEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26JSCanvasRenderingContext2D9setShadowEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D9setShadowEfffRKNS_6StringE
+__ZN7WebCore24CanvasRenderingContext2D9setShadowEffff
+__ZN7WebCore24CanvasRenderingContext2D9setShadowEfffRKNS_6StringEf
+__ZN7WebCore22colorWithOverrideAlphaEjf
+__ZN7WebCore24CanvasRenderingContext2D9setShadowEfffffff
+__ZN7WebCore24CanvasRenderingContext2D9setShadowEfffff
+__ZN7WebCore24CanvasRenderingContext2D9setShadowEffffffff
+__ZN7WebCore45jsHTMLCanvasElementPrototypeFunctionToDataURLEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore17HTMLCanvasElement9toDataURLERKNS_6StringERi
+__ZN7WebCore16MIMETypeRegistry35isSupportedImageMIMETypeForEncodingERKNS_6StringE
+__ZN7WebCoreL44initializeSupportedImageMIMETypesForEncodingEv
+__ZNK7WebCore11ImageBuffer9toDataURLERKNS_6StringE
+__ZN7WebCore12base64EncodeERKN3WTF6VectorIcLm0EEERS2_b
+__ZNK7WebCore18JSHTMLQuoteElement9classInfoEv
+__ZNK7WebCore11RenderLayer16enclosingElementEv
+__ZN7WebCore11RenderStyle12clearContentEv
+__ZNK7WebCore15RenderWordBreak10renderNameEv
+__ZN7WebCore30jsCSSPrimitiveValueCSS_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsCSSPrimitiveValueCSS_STRINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsCSSPrimitiveValuePrimitiveTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsCSSPrimitiveValueCSS_RECTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsCSSPrimitiveValueCSS_PXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore50jsCSSPrimitiveValuePrototypeFunctionGetStringValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore51jsCSSPrimitiveValuePrototypeFunctionGetCounterValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore17CSSPrimitiveValue15getCounterValueERi
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_7CounterE
+__ZN7WebCore52jsCSSPrimitiveValuePrototypeFunctionGetRGBColorValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13getJSRGBColorEPN3JSC9ExecStateEj
+__ZN7WebCore10JSRGBColorC1EPN3JSC9ExecStateEj
+__ZN7WebCore10JSRGBColorC2EPN3JSC9ExecStateEj
+__ZN7WebCore31jsCSSPrimitiveValueCSS_RGBCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore48jsCSSPrimitiveValuePrototypeFunctionGetRectValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore17CSSPrimitiveValue12getRectValueERi
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_4RectE
+__ZN7WebCore10JSRGBColorD1Ev
+__ZN7WebCore19mimeTypeFromDataURLERKNS_6StringE
+__ZNK7WebCore12RenderObject12isRenderPartEv
 __ZN7WebCore11RenderBlock18heightForLineCountEi
-__ZN7WebCore21getHeightForLineCountEPNS_11RenderBlockEibRi
+__ZN7WebCoreL21getHeightForLineCountEPNS_11RenderBlockEibRi
 __ZN7WebCore11RenderBlock11lineAtIndexEi
-__ZN7WebCore14getLineAtIndexEPNS_11RenderBlockEiRi
-__ZNK7WebCore17ImplicitAnimation8progressEv
-__ZNK7WebCore12CSSStyleRule7cssTextEv
-__ZN7WebCore26skipCommaInDashboardRegionEPNS_9ValueListE
-__ZN7WebCore6String6appendEc
-__ZN7WebCore5TimerINS_26AnimationControllerPrivateEE5firedEv
-__ZN7WebCore26AnimationControllerPrivate10timerFiredEPNS_5TimerIS0_EE
+__ZN7WebCoreL14getLineAtIndexEPNS_11RenderBlockEiRi
+__ZN7WebCore20jsCommentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSComment14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSCommentConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore18JSCommentPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSCommentConstructorD1Ev
+__ZN7WebCore11CSSSelector8parseNthEv
+__ZN7WebCore11CSSSelector8RareData8parseNthEv
+__ZN7WebCore11CSSSelector8matchNthEi
+__ZN7WebCore11CSSSelector8RareData8matchNthEi
+__ZN7WebCore52jsCSSStyleDeclarationPrototypeFunctionRemovePropertyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13CSSStyleSheet18determineNamespaceERKNS_12AtomicStringE
+__ZN7WebCore9CSSParser21parseDashboardRegionsEib
+__ZN3WTF10RefCountedIN7WebCore15DashboardRegionEE5derefEv
+__ZN7WebCoreL35device_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL16parseAspectRatioEPNS_8CSSValueERiS2_
+__ZN7WebCore46jsDOMWindowPrototypeFunctionGetMatchedCSSRulesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow18getMatchedCSSRulesEPNS_7ElementERKNS_6StringEb
+__ZNK7WebCore15CSSFontFaceRule4typeEv
+__ZN7WebCore17JSCSSFontFaceRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSCSSFontFaceRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15CSSFontFaceRuleEEE
+__ZN7WebCore17JSCSSFontFaceRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15CSSFontFaceRuleEEE
+__ZN7WebCore17JSCSSFontFaceRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsCSSFontFaceRuleStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSCSSValueList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSCSSValueListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CSSValueListEEE
+__ZN7WebCore14JSCSSValueListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CSSValueListEEE
+__ZN7WebCore14JSCSSValueList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17jsCSSValueCssTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSCSSValueListD1Ev
+__ZN7WebCore17JSCSSFontFaceRuleD1Ev
+__ZN7WebCore23JSCSSValueListPrototypeD1Ev
+__ZN7WebCore26JSCSSFontFaceRulePrototypeD1Ev
+__ZSt21__inplace_stable_sortIPPN7WebCore11CSSFontFaceEPFbS2_S2_EEvT_S6_T0_
+__ZN7WebCore21JSCSSStyleDeclaration18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore21JSCSSStyleDeclaration11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore57jsCSSStyleDeclarationPrototypeFunctionGetPropertyPriorityEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZN7WebCore19CSSStyleDeclaration19getPropertyPriorityERKNS_6StringE
+__ZN7WebCoreL24scaleFactorForConversionEt
+__ZN7WebCore9CSSParser18parseHSLParametersEPNS_14CSSParserValueEPdb
+__ZN7WebCore16makeRGBAFromHSLAEdddd
+__ZN7WebCoreL7calcHueEddd
+__ZNK7WebCore9FrameView14didFirstLayoutEv
+__ZNK7WebCore13CSSImportRule4typeEv
+__ZN7WebCore15JSCSSImportRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSCSSImportRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CSSImportRuleEEE
+__ZN7WebCore15JSCSSImportRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13CSSImportRuleEEE
+__ZN7WebCore15JSCSSImportRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25jsCSSImportRuleStyleSheetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSCSSImportRuleD1Ev
+__ZN7WebCore24JSCSSImportRulePrototypeD1Ev
+__ZNK7WebCore15CSSFontFaceRule7cssTextEv
 __ZNK7WebCore12CSSMediaRule4typeEv
-__ZN7WebCore14JSCSSMediaRuleC1EPN3KJS8JSObjectEPNS_12CSSMediaRuleE
-__ZN7WebCore14JSCSSMediaRule18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore23JSCSSMediaRulePrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore41jsCSSMediaRulePrototypeFunctionInsertRuleEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore14JSCSSMediaRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSCSSMediaRuleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CSSMediaRuleEEE
+__ZN7WebCore14JSCSSMediaRuleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12CSSMediaRuleEEE
+__ZN7WebCore14JSCSSMediaRule18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore12CSSMediaRule7cssTextEv
+__ZNK7WebCore9MediaList9mediaTextEv
+__ZNK7WebCore10MediaQuery7cssTextEv
+__ZN7WebCore14JSCSSMediaRuleD1Ev
+__ZN7WebCore23JSCSSMediaRulePrototypeD1Ev
+__ZN7WebCore18jsDOMWindowScrollXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL39max_device_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore23JSCSSMediaRulePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore41jsCSSMediaRulePrototypeFunctionInsertRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZNK7WebCore14JSCSSMediaRule9classInfoEv
 __ZN7WebCore12CSSMediaRule10insertRuleERKNS_6StringEjRi
-__ZN3KJS17staticValueGetterIN7WebCore14JSCSSMediaRuleEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore14JSCSSMediaRule16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore41jsCSSMediaRulePrototypeFunctionDeleteRuleEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore11CSSRuleList10insertRuleEPNS_7CSSRuleEj
+__ZN7WebCore22jsCSSMediaRuleCssRulesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsCSSMediaRulePrototypeFunctionDeleteRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore12CSSMediaRule10deleteRuleEjRi
-__ZN7WebCore11CSSRuleList10deleteRuleEj
-__ZN7WebCore42jsCSSStyleDeclarationPrototypeFunctionItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore49jsCSSPrimitiveValuePrototypeFunctionGetFloatValueEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore24scaleFactorForConversionEt
-__ZN7WebCore11RenderStyle12clearContentEv
-__ZN3KJS17staticValueGetterIN7WebCore15JSCSSImportRuleEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore15JSCSSImportRule16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore30JSCSSPrimitiveValueConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore30JSCSSPrimitiveValueConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore30JSCSSPrimitiveValueConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore19JSCSSPrimitiveValueEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSCSSPrimitiveValue16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore50jsCSSPrimitiveValuePrototypeFunctionGetStringValueEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore51jsCSSPrimitiveValuePrototypeFunctionGetCounterValueEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore17CSSPrimitiveValue15getCounterValueERi
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_7CounterE
-__ZN7WebCore52jsCSSPrimitiveValuePrototypeFunctionGetRGBColorValueEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore13getJSRGBColorEPN3KJS9ExecStateEj
-__ZN7WebCore10JSRGBColorC1EPN3KJS8JSObjectEj
-__ZN7WebCore48jsCSSPrimitiveValuePrototypeFunctionGetRectValueEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore17CSSPrimitiveValue12getRectValueERi
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_4RectE
-__ZN7WebCore39min_device_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore35device_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore39max_device_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore22FontCustomPlatformDataD1Ev
+__ZN7WebCoreL39min_device_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore14RenderTableRow5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore25jsCSSRuleParentStyleSheetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore58jsCSSStyleDeclarationPrototypeFunctionGetPropertyShorthandEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZN7WebCore19CSSStyleDeclaration20getPropertyShorthandERKNS_6StringE
+__ZNK7WebCore26CSSMutableStyleDeclaration20getPropertyShorthandEi
+__ZN7WebCore9CSSParser24parseTimingFunctionValueERPNS_18CSSParserValueListERd
+__ZNK7WebCore22CSSTimingFunctionValue21isTimingFunctionValueEv
+__ZNK7WebCore16HTMLInputElement17isTextFormControlEv
+__ZNK7WebCore22HTMLFormControlElement17isTextFormControlEv
+__ZNK7WebCore19HTMLTextAreaElement17isTextFormControlEv
+__ZNK7WebCore11RenderLayer18absoluteToContentsERKNS_8IntPointE
+__ZNK7WebCore11RenderLayer22offsetFromResizeCornerERKNS_8IntPointE
+__ZN7WebCore11RenderLayer6resizeERKNS_18PlatformMouseEventERKNS_7IntSizeE
+__ZNK7WebCore7Element22minimumSizeForResizingEv
+__ZN7WebCore7Element25setMinimumSizeForResizingERKNS_7IntSizeE
+__ZN7WebCore26RenderTextControlMultiLine11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZNK7WebCore5Image13isBitmapImageEv
+__ZN7WebCore8SVGImage18destroyDecodedDataEb
+__ZN7WebCore8SVGImageD0Ev
+__ZN7WebCore22EmptyFrameLoaderClient14cancelledErrorERKNS_15ResourceRequestE
+__ZN7WebCore22EmptyFrameLoaderClient14shouldFallBackERKNS_13ResourceErrorE
+__ZN7WebCore22EmptyFrameLoaderClient20setMainDocumentErrorEPNS_14DocumentLoaderERKNS_13ResourceErrorE
+__ZN7WebCore22EmptyFrameLoaderClient27dispatchDidLoadMainResourceEPNS_14DocumentLoaderE
+__ZN7WebCore22EmptyFrameLoaderClient19dispatchDidFailLoadERKNS_13ResourceErrorE
+__ZN7WebCore22EmptyFrameLoaderClient39postProgressEstimateChangedNotificationEv
+__ZN7WebCore22EmptyFrameLoaderClient32postProgressFinishedNotificationEv
+__ZN7WebCore22EmptyFrameLoaderClient22dispatchDidFailLoadingEPNS_14DocumentLoaderEmRKNS_13ResourceErrorE
+__ZN7WebCore22EmptyFrameLoaderClient19detachedFromParent2Ev
+__ZN7WebCore22EmptyFrameLoaderClient19detachedFromParent3Ev
+__ZN7WebCore31RenderSVGTransformableContainerD0Ev
+__ZN7WebCore18RenderSVGContainerD2Ev
+__ZN7WebCore16SVGInlineFlowBoxD0Ev
+__ZN7WebCore14RenderSVGTSpanD0Ev
+__ZN7WebCore12RenderInlineD2Ev
+__ZN7WebCore17EmptyEditorClient13pageDestroyedEv
+__ZN7WebCore20EmptyInspectorClient18inspectorDestroyedEv
+__ZN7WebCore16SVGScriptElementD0Ev
+__ZN7WebCore15SVGURIReferenceD2Ev
+__ZN7WebCore11SVGGElementD0Ev
+__ZN7WebCore14SVGPathElementD0Ev
+__ZN7WebCore14SVGPathSegListD0Ev
+__ZN7WebCore19SVGPathSegMovetoAbsD0Ev
+__ZN7WebCore19SVGPathSegLinetoAbsD0Ev
+__ZN7WebCore19SVGPathSegClosePathD0Ev
+__ZN7WebCore19SVGAnimatedPathDataD2Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_12SVGTransformEEEEELm0EE6shrinkEm
+__ZN7WebCore25SVGPathSegCurvetoCubicAbsD0Ev
+__ZN7WebCore15SVGTSpanElementD0Ev
+__ZN7WebCore22EmptyFrameLoaderClient20frameLoaderDestroyedEv
+__ZN7WebCore22EmptyContextMenuClient20contextMenuDestroyedEv
+__ZN7WebCore15EmptyDragClient23dragControllerDestroyedEv
+__ZN7WebCore20SVGImageChromeClient15chromeDestroyedEv
+__ZN7WebCore20SVGImageChromeClientD0Ev
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findI
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47remo
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6remov
+__ZN7WebCore10SVGElementD0Ev
+__ZN7WebCore24SVGLinearGradientElementD0Ev
+__ZN7WebCore18SVGGradientElementD2Ev
+__ZN7WebCore24SVGRadialGradientElementD0Ev
+__ZN7WebCore28SVGPaintServerLinearGradientD0Ev
+__ZN7WebCore22SVGPaintServerGradientD2Ev
+__ZN7WebCore14SVGPaintServerD2Ev
+__ZN7WebCore11SVGResourceD2Ev
+__ZN7WebCore14SVGStopElementD0Ev
+__ZN7WebCore8SVGColorD0Ev
+__ZN7WebCore21RenderSVGGradientStopD0Ev
+__ZN7WebCore24RenderSVGHiddenContainerD0Ev
+__ZN7WebCore18RenderSVGContainerD0Ev
+__ZN7WebCore15SVGTitleElementD0Ev
+__ZN7WebCore14SVGDescElementD0Ev
+__ZN7WebCore16SVGCircleElementD0Ev
+__ZN7WebCore14SVGLineElementD0Ev
+__ZN7WebCore14SVGDefsElementD0Ev
+__ZN7WebCore28SVGPaintServerRadialGradientD0Ev
+__ZN7WebCore14SVGMaskElementD0Ev
+__ZN7WebCore17SVGResourceMaskerD0Ev
+__ZN7WebCore17SVGEllipseElementD0Ev
+__ZN7WebCore17SVGAnimateElementD0Ev
+__ZN7WebCore19SVGAnimationElementD2Ev
+__ZN7WebCore14SVGSMILElementD2Ev
+__ZN7WebCore14SVGSMILElement20disconnectConditionsEv
+__ZN7WebCore17SMILTimeContainer10unscheduleEPNS_14SVGSMILElementE
+__ZN3WTF6VectorIN7WebCore8SMILTimeELm0EE6shrinkEm
+__ZN7WebCore30setJSDOMWindowRangeConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSHTMLInputElementPlaceholderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement14setPlaceholderERKNS_6StringE
+__ZN7WebCore29jsHTMLInputElementPlaceholderEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8Document18setVisuallyOrderedEv
+__ZN7WebCore10TextStreamlsEf
+__ZN7WebCore10ShadowDataD2Ev
+__ZN7WebCore30jsHistoryPrototypeFunctionBackEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9JSHistory9classInfoEv
+__ZN7WebCore7History4backEv
+__ZN7WebCore11FrameLoader25scheduleHistoryNavigationEi
+__ZN7WebCore11FrameLoader15goBackOrForwardEi
+__ZN7WebCore9CSSParser23parseAnimationShorthandEb
+__ZNK7WebCore15PropertyWrapperIRKNS_5ColorEE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS8_SB_d
+__ZNK7WebCore11RenderStyle15backgroundColorEv
+__ZN7WebCore11RenderStyle18setBackgroundColorERKNS_5ColorE
+__ZN7WebCore13AnimationBase18getPropertyAtIndexEiRb
+__ZNK7WebCore19PropertyWrapperBase18isShorthandWrapperEv
+__ZNK7WebCore11RenderStyle5rightEv
+__ZNK7WebCore11RenderStyle6bottomEv
+__ZNK7WebCore21PropertyWrapperGetterItE6equalsEPKNS_11RenderStyleES4_
+__ZNK7WebCore11RenderStyle15borderLeftWidthEv
+__ZNK7WebCore11RenderStyle16borderRightWidthEv
+__ZNK7WebCore11RenderStyle14borderTopWidthEv
+__ZNK7WebCore11RenderStyle17borderBottomWidthEv
+__ZNK7WebCore11RenderStyle10marginLeftEv
+__ZNK7WebCore11RenderStyle11marginRightEv
+__ZNK7WebCore11RenderStyle9marginTopEv
+__ZNK7WebCore11RenderStyle12marginBottomEv
+__ZNK7WebCore11RenderStyle11paddingLeftEv
+__ZNK7WebCore11RenderStyle12paddingRightEv
+__ZNK7WebCore11RenderStyle10paddingTopEv
+__ZNK7WebCore11RenderStyle13paddingBottomEv
+__ZNK7WebCore21PropertyWrapperGetterIRKNS_5ColorEE6equalsEPKNS_11RenderStyleES7_
+__ZNK7WebCore11RenderStyle5colorEv
+__ZNK7WebCore11RenderStyle19backgroundXPositionEv
+__ZNK7WebCore11RenderStyle19backgroundYPositionEv
+__ZNK7WebCore21PropertyWrapperGetterINS_10LengthSizeEE6equalsEPKNS_11RenderStyleES5_
+__ZNK7WebCore11RenderStyle14backgroundSizeEv
+__ZNK7WebCore11RenderStyle13maskXPositionEv
+__ZNK7WebCore11RenderStyle13maskYPositionEv
+__ZNK7WebCore11RenderStyle8maskSizeEv
+__ZNK7WebCore21PropertyWrapperGetterIiE6equalsEPKNS_11RenderStyleES4_
+__ZNK7WebCore11RenderStyle8fontSizeEv
+__ZNK7WebCore11RenderStyle15columnRuleWidthEv
+__ZNK7WebCore21PropertyWrapperGetterIfE6equalsEPKNS_11RenderStyleES4_
+__ZNK7WebCore11RenderStyle9columnGapEv
+__ZNK7WebCore11RenderStyle11columnCountEv
+__ZNK7WebCore11RenderStyle11columnWidthEv
+__ZNK7WebCore21PropertyWrapperGetterIsE6equalsEPKNS_11RenderStyleES4_
+__ZNK7WebCore11RenderStyle23horizontalBorderSpacingEv
+__ZNK7WebCore11RenderStyle21verticalBorderSpacingEv
+__ZNK7WebCore11RenderStyle6zIndexEv
+__ZNK7WebCore11RenderStyle13outlineOffsetEv
+__ZNK7WebCore11RenderStyle12outlineWidthEv
+__ZNK7WebCore11RenderStyle13letterSpacingEv
+__ZNK7WebCore11RenderStyle11wordSpacingEv
+__ZNK7WebCore11RenderStyle11perspectiveEv
+__ZNK7WebCore11RenderStyle18perspectiveOriginXEv
+__ZNK7WebCore11RenderStyle18perspectiveOriginYEv
+__ZNK7WebCore11RenderStyle16transformOriginXEv
+__ZNK7WebCore11RenderStyle16transformOriginYEv
+__ZNK7WebCore11RenderStyle16transformOriginZEv
+__ZNK7WebCore21PropertyWrapperGetterIRKNS_7IntSizeEE6equalsEPKNS_11RenderStyleES7_
+__ZNK7WebCore11RenderStyle19borderTopLeftRadiusEv
+__ZNK7WebCore11RenderStyle20borderTopRightRadiusEv
+__ZNK7WebCore11RenderStyle22borderBottomLeftRadiusEv
+__ZNK7WebCore11RenderStyle23borderBottomRightRadiusEv
+__ZNK7WebCore21PropertyWrapperGetterINS_11EVisibilityEE6equalsEPKNS_11RenderStyleES5_
+__ZNK7WebCore11RenderStyle10visibilityEv
+__ZNK7WebCore11RenderStyle4zoomEv
+__ZNK7WebCore32PropertyWrapperMaybeInvalidColor6equalsEPKNS_11RenderStyleES3_
+__ZNK7WebCore11RenderStyle15columnRuleColorEv
+__ZNK7WebCore11RenderStyle15textStrokeColorEv
+__ZNK7WebCore11RenderStyle13textFillColorEv
+__ZNK7WebCore11RenderStyle15borderLeftColorEv
+__ZNK7WebCore11RenderStyle16borderRightColorEv
+__ZNK7WebCore11RenderStyle14borderTopColorEv
+__ZNK7WebCore11RenderStyle17borderBottomColorEv
+__ZNK7WebCore11RenderStyle12outlineColorEv
+__ZNK7WebCore21PropertyWrapperShadow6equalsEPKNS_11RenderStyleES3_
+__ZNK7WebCore11RenderStyle9boxShadowEv
+__ZNK7WebCore11RenderStyle10textShadowEv
+__ZNK7WebCore11RenderStyle11fillOpacityEv
+__ZNK7WebCore11RenderStyle12floodOpacityEv
+__ZNK7WebCore11RenderStyle13strokeOpacityEv
+__ZNK7WebCore24ShorthandPropertyWrapper18isShorthandWrapperEv
+__ZNK7WebCore32PropertyWrapperMaybeInvalidColor5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS4_S7_d
+__ZN7WebCore11RenderStyle18setBorderLeftColorERKNS_5ColorE
+__ZN7WebCore11RenderStyle20setBorderBottomColorERKNS_5ColorE
+__ZN7WebCore11RenderStyle19setBorderRightColorERKNS_5ColorE
+__ZN7WebCore11RenderStyle17setBorderTopColorERKNS_5ColorE
+__ZN7WebCore17ImplicitAnimation14onAnimationEndEd
+__ZN7WebCore17ImplicitAnimation19sendTransitionEventERKNS_12AtomicStringEd
+__ZNK7WebCore17ImplicitAnimation26shouldSendEventForListenerENS_8Document12ListenerTypeE
+__ZN7WebCore13AnimationBase26resumeOverriddenAnimationsEv
+__ZN3WTF9HashTableIiSt4pairIiNS_6RefPtrIN7WebCore17ImplicitAnimationEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIjEENS_14PairHa
+__ZN7WebCore23JSCSSValueListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore35jsCSSValueListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14JSCSSValueList9classInfoEv
+__ZN7WebCore12CSSValueList4itemEj
+__ZN7WebCore20JSHTMLMarqueeElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZThn88_N7WebCore21ProcessingInstruction16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore21ProcessingInstruction16setCSSStyleSheetERKNS_6StringES3_PKNS_19CachedCSSStyleSheetE
+__ZN7WebCore28jsProcessingInstructionSheetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsStyleSheetDisabledEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15HTMLBodyElement13setScrollLeftEi
+__ZN7WebCore15HTMLBodyElement12setScrollTopEi
+__ZNK7WebCore27CSSComputedStyleDeclaration6lengthEv
+__ZN7WebCore42jsCSSStyleDeclarationPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore27CSSComputedStyleDeclaration4itemEj
+__ZN7WebCoreL26getBorderRadiusCornerValueENS_7IntSizeE
+__ZN7WebCoreL22valueForNinePieceImageERKNS_14NinePieceImageE
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EEC1ERKS3_
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EEC2ERKS3_
+__ZN7WebCore17CSSPrimitiveValue4initEN3WTF10PassRefPtrINS_15DashboardRegionEEE
+__ZNK7WebCore27CSSComputedStyleDeclaration22getSVGPropertyCSSValueEiNS_13EUpdateLayoutE
+__ZNK7WebCore8SVGPaint7cssTextEv
+__ZNK7WebCore8SVGColor7cssTextEv
+__ZN7WebCoreL35glyphOrientationToCSSPrimitiveValueENS_17EGlyphOrientationE
+__ZN7WebCore19JSCSSValuePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19StyleGeneratedImage8cssValueEv
+__ZN7WebCoreL18valueForRepeatRuleEi
+__ZN7WebCore10JSCSSValueC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8CSSValueEEE
+__ZNK7WebCore10JSCSSValue9classInfoEv
+__ZN7WebCore14GeneratedImage11drawPatternEPNS_15GraphicsContextERKNS_9FloatRectERKNS_20TransformationMatrixERKNS_10FloatPointEN
+__ZN7WebCore10JSCSSValueD1Ev
+__ZNK7WebCore22SkewTransformOperation16getOperationTypeEv
+__ZNK7WebCore22SkewTransformOperation5applyERNS_20TransformationMatrixERKNS_7IntSizeE
+__ZN7WebCore20TransformationMatrix4skewEdd
+__ZNK7WebCore22SkewTransformOperationeqERKNS_18TransformOperationE
+__ZNK7WebCore22SkewTransformOperation10isSameTypeERKNS_18TransformOperationE
+__ZN7WebCore22SkewTransformOperationD0Ev
+__ZN7WebCore25setJSHTMLElementOuterHTMLEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement12setOuterHTMLERKNS_6StringERi
 __ZN7WebCore12CSSNamespace18namespaceForPrefixERKNS_12AtomicStringE
 __ZN7WebCore12CSSNamespaceD2Ev
-__ZN7WebCore23JSProcessingInstruction16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore12JSSVGElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore9CSSParser21addUnresolvedPropertyEib
+__ZN7WebCore12CSSValueListC1EPNS_18CSSParserValueListE
+__ZN7WebCore12CSSValueListC2EPNS_18CSSParserValueListE
+__ZN7WebCore14CSSParserValue14createCSSValueEv
+__ZN7WebCore25CSSVariableDependentValueC1EN3WTF10PassRefPtrINS_12CSSValueListEEE
+__ZN7WebCore25CSSVariableDependentValueC2EN3WTF10PassRefPtrINS_12CSSValueListEEE
+__ZN7WebCore9CSSParser27addVariableDeclarationBlockERKNS_15CSSParserStringE
+__ZN7WebCore9CSSParser19createVariablesRuleEPNS_9MediaListEb
+__ZNK7WebCore25CSSVariableDependentValue24isVariableDependentValueEv
+__ZNK3WTF7HashMapIPN7WebCore26CSSMutableStyleDeclarationENS_6RefPtrIS2_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getE
+__ZNK7WebCore19CSSStyleDeclaration10parentRuleEv
+__ZN7WebCore26CSSMutableStyleDeclarationC1EPNS_7CSSRuleE
+__ZN3WTF7HashMapIPN7WebCore26CSSMutableStyleDeclarationENS_6RefPtrIS2_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setER
+__ZN3WTF9HashTableIPN7WebCore26CSSMutableStyleDeclarationESt4pairIS3_NS_6RefPtrIS2_EEENS_18PairFirstExtractorIS7_EENS_7PtrHashI
+__ZN7WebCore16CSSStyleSelector30resolveVariablesForDeclarationEPNS_26CSSMutableStyleDeclarationES2_RN3WTF7HashSetINS_6StringENS
+__ZNK3WTF7HashMapIN7WebCore6StringEPNS1_16CSSVariablesRuleENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3getERKS2_
+__ZNK7WebCore14XMLHttpRequest38usesDashboardBackwardCompatibilityModeEv
+__ZN7WebCore9CSSParser11addVariableERKNS_15CSSParserStringEPNS_18CSSParserValueListE
+__ZN7WebCore25CSSVariableDependentValueD0Ev
+__ZNK7WebCore17CSSPrimitiveValue11parserValueEv
+__ZN7WebCore9StyleBase6isRuleEv
+__ZN7WebCore26JSXMLSerializerConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26JSXMLSerializerConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCore26JSXMLSerializerConstructor9constructEPN3JSC9ExecStateEPNS1_8JSObjectERKNS1_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_13XMLSerializerE
+__ZN7WebCore15JSXMLSerializerC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13XMLSerializerEEE
+__ZN7WebCore15JSXMLSerializerC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13XMLSerializerEEE
+__ZN7WebCore15JSXMLSerializer18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24JSXMLSerializerPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore49jsXMLSerializerPrototypeFunctionSerializeToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15JSXMLSerializer9classInfoEv
+__ZN7WebCore13XMLSerializer17serializeToStringEPNS_4NodeERi
+__ZN7WebCore15JSXMLSerializerD1Ev
+__ZN7WebCore15JSXMLSerializerD2Ev
+__ZN7WebCoreL22shouldAddNamespaceElemEPKNS_7ElementE
+__ZN7WebCoreL15appendNamespaceERN3WTF6VectorItLm0EEERKNS_12AtomicStringES6_RNS0_7HashMapIPNS_16AtomicStringImplES9_NS0_7PtrHash
+__ZN7WebCoreL22shouldAddNamespaceAttrEPKNS_9AttributeERN3WTF7HashMapIPNS_16AtomicStringImplES6_NS3_7PtrHashIS6_EENS3_10HashTrai
+__ZN7WebCore23jsHTMLAnchorElementTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement4textEv
+__ZN7WebCore40jsHTMLSelectElementPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14jsSVGElementIdEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSSVGSVGElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore12JSSVGElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore17setJSSVGElementIdEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore10SVGElement5setIdERKNS_6StringERi
-__ZN7WebCore42jsCSSStyleSheetPrototypeFunctionRemoveRuleEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore12JSStyleSheet3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore12JSStyleSheet16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore54jsDOMImplementationPrototypeFunctionCreateHTMLDocumentEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCoreL17isViewportElementEPNS_4NodeE
+__ZN7WebCore13SVGSVGElement19removedFromDocumentEv
+__ZThn8_N7WebCore13SVGSVGElementD0Ev
+__ZN7WebCore9Attribute17isMappedAttributeEv
+__ZN7WebCore22JSNamedNodesCollectionC1EPN3JSC9ExecStateERKN3WTF6VectorINS4_6RefPtrINS_4NodeEEELm0EEE
+__ZN7WebCore22JSNamedNodesCollectionC2EPN3JSC9ExecStateERKN3WTF6VectorINS4_6RefPtrINS_4NodeEEELm0EEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EEC1ERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4NodeEEELm0EEC2ERKS5_
+__ZN7WebCore22JSNamedNodesCollection18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22JSNamedNodesCollection11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore22JSNamedNodesCollectionD1Ev
+__ZN7WebCore50jsCanvasRenderingContext2DGlobalCompositeOperationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore24CanvasRenderingContext2D24globalCompositeOperationEv
+__ZN7WebCore21compositeOperatorNameENS_17CompositeOperatorE
+__ZN7WebCore33jsCanvasRenderingContext2DLineCapEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore24CanvasRenderingContext2D7lineCapEv
+__ZN7WebCore11lineCapNameENS_7LineCapE
+__ZN7WebCore34jsCanvasRenderingContext2DLineJoinEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore24CanvasRenderingContext2D8lineJoinEv
+__ZN7WebCore12lineJoinNameENS_8LineJoinE
+__ZN7WebCore37jsCanvasRenderingContext2DShadowColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore24CanvasRenderingContext2D11shadowColorEv
+__ZNK7WebCore19JSHTMLLegendElement9classInfoEv
+__ZN7WebCore28setJSHTMLLinkElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLLinkElement11setDisabledEb
+__ZN7WebCore15HTMLLinkElement16setDisabledStateEb
+__ZN7WebCore37jsRangePrototypeFunctionCloneContentsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore5Range13cloneContentsERi
+__ZN7WebCoreL18callHTMLCollectionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore31jsCSSStyleDeclarationParentRuleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27CSSComputedStyleDeclaration11setPropertyEiRKNS_6StringEbRi
+__ZN7WebCore21jsCSSRuleUNKNOWN_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsCSSRuleSTYLE_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsCSSRuleCHARSET_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsCSSRuleIMPORT_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsCSSRuleMEDIA_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsCSSRuleFONT_FACE_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsCSSRulePAGE_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsCSSValueCSS_INHERITEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsCSSValueCSS_PRIMITIVE_VALUEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsCSSValueCSS_VALUE_LISTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsCSSValueCSS_CUSTOMEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsDOMWindowCSSValueConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSCSSValue14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSCSSValueConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore32jsDOMWindowNodeFilterConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSNodeFilter14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSNodeFilterConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore21JSNodeFilterPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSNodeFilter15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSNodeFilterConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24jsNodeFilterSHOW_ELEMENTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore45jsDocumentPrototypeFunctionCreateNodeIteratorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12toNodeFilterEN3JSC7JSValueE
+__ZN7WebCore21JSNodeFilterConditionC1EN3JSC7JSValueE
+__ZN7WebCore21JSNodeFilterConditionC2EN3JSC7JSValueE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12NodeIteratorE
+__ZN7WebCore14JSNodeIterator15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSNodeIteratorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12NodeIteratorEEE
+__ZN7WebCore14JSNodeIteratorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12NodeIteratorEEE
+__ZN7WebCore14JSNodeIterator18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20jsNodeIteratorFilterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10NodeFilterE
+__ZN7WebCore12JSNodeFilterC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10NodeFilterEEE
+__ZN7WebCore12JSNodeFilterC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10NodeFilterEEE
+__ZN7WebCore12JSNodeFilter18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21JSNodeFilterPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25jsNodeFilterFILTER_ACCEPTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsNodeFilterFILTER_REJECTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsNodeFilterFILTER_SKIPEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsNodeFilterSHOW_ALLEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsNodeFilterSHOW_ATTRIBUTEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsNodeFilterSHOW_TEXTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsNodeFilterSHOW_CDATA_SECTIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsNodeFilterSHOW_ENTITY_REFERENCEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsNodeFilterSHOW_ENTITYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsNodeFilterSHOW_PROCESSING_INSTRUCTIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsNodeFilterSHOW_COMMENTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsNodeFilterSHOW_DOCUMENTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsNodeFilterSHOW_DOCUMENT_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsNodeFilterSHOW_DOCUMENT_FRAGMENTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsNodeFilterSHOW_NOTATIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSNodeFilter4markEv
+__ZN7WebCore21JSNodeFilterCondition4markEv
+__ZN7WebCore14JSNodeIterator4markEv
+__ZN7WebCore27jsDOMWindowAudioConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow5audioEPN3JSC9ExecStateE
+__ZN7WebCore18JSAudioConstructorC1EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore18JSAudioConstructorC2EPN3JSC9ExecStateEPNS_17JSDOMGlobalObjectE
+__ZN7WebCore27JSHTMLAudioElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSAudioConstructor4markEv
+__ZN7WebCore12JSNodeFilterD1Ev
+__ZN7WebCore12JSNodeFilterD2Ev
+__ZN7WebCore14JSNodeIteratorD1Ev
+__ZN7WebCore14JSNodeIteratorD2Ev
+__ZN7WebCore21JSNodeFilterConditionD0Ev
+__ZN7WebCore23JSNodeIteratorPrototypeD1Ev
+__ZN7WebCore21JSNodeFilterPrototypeD1Ev
+__ZN7WebCore23JSNodeFilterConstructorD1Ev
+__ZN7WebCore21JSCSSValueConstructorD1Ev
+__ZN7WebCore18JSAudioConstructorD1Ev
+__ZN7WebCore30setJSDOMWindowImageConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore31setJSDOMWindowOptionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowXMLHttpRequestConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowXMLSerializerConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore34setJSDOMWindowDOMParserConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowXSLTProcessorConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore30setJSProcessingInstructionDataEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSRGBColor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZL13jsRGBColorRedPN3JSC9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZL15jsRGBColorGreenPN3JSC9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZL14jsRGBColorBluePN3JSC9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN7WebCore19jsCSSImportRuleHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsCSSImportRuleMediaEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_9MediaListE
+__ZN7WebCore11JSMediaList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSMediaListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9MediaListEEE
+__ZN7WebCore11JSMediaListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9MediaListEEE
+__ZN7WebCore11JSMediaList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20jsMediaListMediaTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsCSSMediaRuleMediaEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13CSSImportRule7cssTextEv
+__ZN7WebCore11JSMediaListD1Ev
+__ZN7WebCore11JSMediaListD2Ev
+__ZN7WebCore20JSMediaListPrototypeD1Ev
+__ZN7WebCore14JSCSSStyleRule3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore9JSCSSRule3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19setJSCSSRuleCssTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore7CSSRule10setCssTextERKNS_6StringERi
+__ZN7WebCore29setJSCSSStyleRuleSelectorTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore12CSSStyleRule15setSelectorTextERKNS_6StringERi
+__ZN7WebCore10JSCSSValue3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore20setJSCSSValueCssTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11JSMediaList3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore23setJSMediaListMediaTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39jsCSSStyleSheetPrototypeFunctionAddRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13CSSStyleSheet7addRuleERKNS_6StringES3_Ri
+__ZN7WebCore13CSSStyleSheet7addRuleERKNS_6StringES3_iRi
+__ZN7WebCore42jsCSSStyleSheetPrototypeFunctionRemoveRuleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSStyleSheet3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore23setJSStyleSheetDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38jsRangePrototypeFunctionDeleteContentsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore54jsDOMImplementationPrototypeFunctionCreateHTMLDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
 __ZN7WebCore17DOMImplementation18createHTMLDocumentERKNS_6StringE
+__ZN7WebCore20setJSHTMLDocumentDirEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore12HTMLDocument6setDirERKNS_6StringE
+__ZN7WebCore17setJSDocumentBodyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore8Document7setBodyEN3WTF10PassRefPtrINS_11HTMLElementEEERi
+__ZN7WebCore20setJSDocumentCharsetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore8Document10setCharsetERKNS_6StringE
+__ZN7WebCore34setJSDocumentSelectedStylesheetSetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore8Document24setSelectedStylesheetSetERKNS_6StringE
+__ZN7WebCore31jsDocumentSelectedStylesheetSetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore8Document21selectedStylesheetSetEv
+__ZN7WebCore21jsHTMLDocumentFgColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12HTMLDocument7fgColorEv
+__ZN7WebCore27setJSHTMLDocumentAlinkColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore12HTMLDocument13setAlinkColorERKNS_6StringE
+__ZN7WebCore24jsHTMLDocumentAlinkColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore12HTMLDocument10alinkColorEv
+__ZN7WebCore23jsHTMLDocumentLinkColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12HTMLDocument9linkColorEv
+__ZN7WebCore24jsHTMLDocumentVlinkColorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore12HTMLDocument10vlinkColorEv
-__ZN7WebCore25JSStyleSheetListPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore37jsStyleSheetListPrototypeFunctionItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore16JSStyleSheetList9classInfoEv
-__ZN7WebCore34jsCSSRuleListPrototypeFunctionItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore13JSCSSRuleList9classInfoEv
-__ZN7WebCore20JSCSSRuleConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore20JSCSSRuleConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore20JSCSSRuleConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore15HTMLAreaElement11setTabIndexEi
-__ZNK7WebCore27JSHTMLEmbedElementPrototype9classInfoEv
-__ZNK7WebCore28JSHTMLAppletElementPrototype9classInfoEv
-__ZN7WebCore10JSCSSValue3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore26JSXPathNSResolverPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore26JSHTMLFormElementPrototype9classInfoEv
-__ZN7WebCore13KeyboardEventC1Ev
-__ZN7WebCore6JSRectC1EPN3KJS8JSObjectEPNS_4RectE
-__ZN7WebCore40jsHTMLSelectElementPrototypeFunctionItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_9MediaListE
-__ZN7WebCore11JSMediaListC1EPN3KJS8JSObjectEPNS_9MediaListE
-__ZN7WebCore9JSCSSRule16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore7CSSRule10setCssTextENS_6StringERi
-__ZN7WebCore14JSCSSStyleRule16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore12CSSStyleRule15setSelectorTextERKNS_6StringERi
-__ZN7WebCore10JSCSSValue16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN3KJS17staticValueGetterIN7WebCore10JSCSSValueEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore10JSCSSValue16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore11JSMediaList3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore11JSMediaList16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore11JSMediaList18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore11JSMediaListEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore11JSMediaList16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore9MediaList9mediaTextEv
-__ZN7WebCore33jsHistoryPrototypeFunctionForwardEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7History7forwardEv
-__ZN7WebCore13RenderListBox32scrollToRevealElementAtListIndexEi
-__ZN7WebCore18JSHTMLTitleElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore22JSDOMParserConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore26JSXMLSerializerConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore18JSRangeConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore21JSCSSValueConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore27JSXPathEvaluatorConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore4toJSEPN3KJS9ExecStateEPNS_10NodeFilterE
-__ZN7WebCore12JSNodeFilterC1EPN3KJS8JSObjectEPNS_10NodeFilterE
-__ZN7WebCore21JSNodeFilterPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore11HTMLElement6setDirERKNS_6StringE
+__ZNK7WebCore17HTMLObjectElement14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore16HTMLParamElement14isURLAttributeEPNS_9AttributeE
+__ZN7WebCore26jsDOMWindowAttrConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore6JSAttr14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore15JSAttrPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSAttrConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSAttrConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowCharacterDataConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSCharacterData14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSCharacterDataConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSCharacterDataConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowCDATASectionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSCDATASection14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSCDATASectionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSCDATASectionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSCDATASectionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSCDATASectionConstructor9classInfoEv
+__ZN7WebCore29jsDOMWindowCommentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSCommentConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSCommentConstructor9classInfoEv
+__ZNK7WebCore21JSDocumentConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowDocumentFragmentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSDocumentFragment14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore29JSDocumentFragmentConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore27JSDocumentFragmentPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSDocumentFragmentConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSDocumentFragmentConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowDocumentTypeConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSDocumentType14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSDocumentTypeConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSDocumentTypePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSDocumentTypeConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSDocumentTypeConstructor9classInfoEv
+__ZN7WebCore28jsDOMWindowEntityConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8JSEntity14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore19JSEntityConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore17JSEntityPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore8JSEntity15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSEntityConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSEntityConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowEntityReferenceConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSEntityReference14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSEntityReferenceConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore26JSEntityReferencePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSEntityReferenceConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSEntityReferenceConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowHTMLDocumentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSHTMLDocumentConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSHTMLDocumentConstructor9classInfoEv
 __ZNK7WebCore17JSNodeConstructor9classInfoEv
-__ZNK7WebCore12CDATASection8toStringEv
-__ZNK3KJS40StringInstanceThatMasqueradesAsUndefined9toBooleanEPNS_9ExecStateE
-__ZNK7WebCore19CSSStyleDeclaration10parentRuleEv
-__ZN7WebCore27CSSComputedStyleDeclaration11setPropertyEiRKNS_6StringEbRi
-__ZNK7WebCore20JSElementConstructor21implementsHasInstanceEv
-__ZN7WebCore11HTMLElement12setOuterTextERKNS_6StringERi
-__ZNK7WebCore24CanvasRenderingContext2D24globalCompositeOperationEv
-__ZN7WebCore21compositeOperatorNameENS_17CompositeOperatorE
-__ZN7WebCore24CanvasRenderingContext2D10setLineCapERKNS_6StringE
-__ZN7WebCore12parseLineCapERKNS_6StringERNS_7LineCapE
-__ZNK7WebCore24CanvasRenderingContext2D7lineCapEv
-__ZN7WebCore11lineCapNameENS_7LineCapE
-__ZNK7WebCore24CanvasRenderingContext2D8lineJoinEv
-__ZN7WebCore12lineJoinNameENS_8LineJoinE
-__ZNK7WebCore24CanvasRenderingContext2D11shadowColorEv
-__ZN7WebCore12JSNodeFilter4markEv
-__ZN7WebCore17HTMLAnchorElement10setCharsetERKNS_6StringE
-__ZN7WebCore17HTMLAnchorElement9setCoordsERKNS_6StringE
-__ZN7WebCore17HTMLAnchorElement11setHreflangERKNS_6StringE
-__ZN7WebCore17HTMLAnchorElement6setRevERKNS_6StringE
-__ZN7WebCore17HTMLAnchorElement8setShapeERKNS_6StringE
-__ZN7WebCore17HTMLAnchorElement7setTypeERKNS_6StringE
-__ZN7WebCore19JSHTMLAppletElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore19JSHTMLAppletElement9customPutEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore19JSHTMLAppletElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore30jsDOMWindowNotationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSNotation14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSNotationConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore19JSNotationPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSNotation15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSNotationConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSNotationConstructor9classInfoEv
+__ZN7WebCore43jsDOMWindowProcessingInstructionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSProcessingInstruction14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore32JSProcessingInstructionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore34JSProcessingInstructionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore34JSProcessingInstructionConstructor9classInfoEv
+__ZNK7WebCore17JSTextConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLAnchorElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30JSHTMLAnchorElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLAnchorElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLAppletElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLAppletElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLAppletElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSHTMLAppletElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLAppletElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLAreaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLAreaElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLAreaElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLAreaElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLAreaElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLBaseElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLBaseElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLBaseElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLBaseElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLBaseElementConstructor9classInfoEv
+__ZN7WebCore41jsDOMWindowHTMLBaseFontElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLBaseFontElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLBaseFontElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSHTMLBaseFontElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore32JSHTMLBaseFontElementConstructor9classInfoEv
+__ZN7WebCore43jsDOMWindowHTMLBlockquoteElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSHTMLBlockquoteElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore32JSHTMLBlockquoteElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore34JSHTMLBlockquoteElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore34JSHTMLBlockquoteElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLBodyElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28JSHTMLBodyElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLBodyElementConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowHTMLBRElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSHTMLBRElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore24JSHTMLBRElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSHTMLBRElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSHTMLBRElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLButtonElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30JSHTMLButtonElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLButtonElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLCanvasElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLCanvasElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLCanvasElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSHTMLCanvasElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLCanvasElementConstructor9classInfoEv
+__ZN7WebCore42jsDOMWindowHTMLDirectoryElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22JSHTMLDirectoryElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSHTMLDirectoryElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore33JSHTMLDirectoryElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore33JSHTMLDirectoryElementConstructor9classInfoEv
+__ZN7WebCore27JSHTMLDivElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSHTMLDivElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLDListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLDListElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLDListElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLDListElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLDListElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLEmbedElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLEmbedElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLEmbedElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLEmbedElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLEmbedElementConstructor9classInfoEv
+__ZN7WebCore41jsDOMWindowHTMLFieldSetElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLFieldSetElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore32JSHTMLFieldSetElementConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLFieldSetElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSHTMLFieldSetElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore32JSHTMLFieldSetElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLFontElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLFontElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLFontElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLFontElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLFontElementConstructor9classInfoEv
+__ZNK7WebCore28JSHTMLFormElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLFrameElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLFrameElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLFrameElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLFrameElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLFrameElementConstructor9classInfoEv
+__ZN7WebCore41jsDOMWindowHTMLFrameSetElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLFrameSetElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLFrameSetElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSHTMLFrameSetElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore32JSHTMLFrameSetElementConstructor9classInfoEv
+__ZN7WebCore40jsDOMWindowHTMLHeadingElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31JSHTMLHeadingElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore31JSHTMLHeadingElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLHeadElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLHeadElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLHeadElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLHeadElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLHeadElementConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowHTMLHRElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSHTMLHRElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore24JSHTMLHRElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSHTMLHRElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSHTMLHRElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLHtmlElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28JSHTMLHtmlElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLHtmlElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLIFrameElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30JSHTMLIFrameElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLIFrameElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLImageElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSHTMLImageElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLImageElementConstructor9classInfoEv
+__ZNK7WebCore29JSHTMLInputElementConstructor9classInfoEv
+__ZN7WebCore40jsDOMWindowHTMLIsIndexElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSHTMLIsIndexElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore29JSHTMLIsIndexElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSHTMLIsIndexElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore31JSHTMLIsIndexElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLLabelElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLLabelElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLLabelElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLLabelElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLLabelElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLLegendElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLLegendElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLLegendElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSHTMLLegendElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLLegendElementConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowHTMLLIElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26JSHTMLLIElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSHTMLLIElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLLinkElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLLinkElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLLinkElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLLinkElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLLinkElementConstructor9classInfoEv
+__ZN7WebCore36jsDOMWindowHTMLMapElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSHTMLMapElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSHTMLMapElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSHTMLMapElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSHTMLMapElementConstructor9classInfoEv
+__ZN7WebCore40jsDOMWindowHTMLMarqueeElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSHTMLMarqueeElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSHTMLMarqueeElementConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore29JSHTMLMarqueeElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSHTMLMarqueeElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore31JSHTMLMarqueeElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLMenuElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLMenuElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLMenuElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLMenuElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLMenuElementConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowHTMLMetaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSHTMLMetaElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSHTMLMetaElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSHTMLMetaElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSHTMLMetaElementConstructor9classInfoEv
+__ZN7WebCore36jsDOMWindowHTMLModElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27JSHTMLModElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSHTMLModElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLObjectElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLObjectElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSHTMLObjectElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSHTMLObjectElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLObjectElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLOListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSHTMLOListElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLOListElementConstructor9classInfoEv
+__ZN7WebCore41jsDOMWindowHTMLOptGroupElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLOptGroupElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLOptGroupElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSHTMLOptGroupElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore32JSHTMLOptGroupElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLOptionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLOptionElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLOptionElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLOptionElementConstructor9classInfoEv
+__ZN7WebCore42jsDOMWindowHTMLParagraphElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33JSHTMLParagraphElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore33JSHTMLParagraphElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLParamElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLParamElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLParamElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLParamElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLParamElementConstructor9classInfoEv
+__ZN7WebCore36jsDOMWindowHTMLPreElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSHTMLPreElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSHTMLPreElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSHTMLPreElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSHTMLPreElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLQuoteElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLQuoteElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLQuoteElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLQuoteElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLQuoteElementConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowHTMLScriptElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30JSHTMLScriptElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSHTMLScriptElementConstructor9classInfoEv
+__ZNK7WebCore30JSHTMLSelectElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLStyleElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLStyleElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLStyleElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLStyleElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLStyleElementConstructor9classInfoEv
+__ZN7WebCore45jsDOMWindowHTMLTableCaptionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSHTMLTableCaptionElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore34JSHTMLTableCaptionElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore36JSHTMLTableCaptionElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore36JSHTMLTableCaptionElementConstructor9classInfoEv
+__ZN7WebCore41jsDOMWindowHTMLTableColElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLTableColElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLTableColElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSHTMLTableColElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore32JSHTMLTableColElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLTableElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSHTMLTableElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLTableElementConstructor9classInfoEv
+__ZN7WebCore45jsDOMWindowHTMLTableSectionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSHTMLTableSectionElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore34JSHTMLTableSectionElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore36JSHTMLTableSectionElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore36JSHTMLTableSectionElementConstructor9classInfoEv
+__ZN7WebCore42jsDOMWindowHTMLTableCellElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22JSHTMLTableCellElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSHTMLTableCellElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore33JSHTMLTableCellElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore33JSHTMLTableCellElementConstructor9classInfoEv
+__ZN7WebCore41jsDOMWindowHTMLTableRowElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSHTMLTableRowElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSHTMLTableRowElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSHTMLTableRowElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore32JSHTMLTableRowElementConstructor9classInfoEv
+__ZNK7WebCore32JSHTMLTextAreaElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLTitleElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLTitleElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLTitleElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLTitleElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLTitleElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLUListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSHTMLUListElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSHTMLUListElementConstructor9classInfoEv
+__ZNK7WebCore24JSHTMLElementConstructor9classInfoEv
+__ZN7WebCore46jsDOMWindowCanvasRenderingContext2DConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26JSCanvasRenderingContext2D14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore35JSCanvasRenderingContext2DPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore37JSCanvasRenderingContext2DConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlot
+__ZNK7WebCore37JSCanvasRenderingContext2DConstructor9classInfoEv
+__ZN7WebCore31jsDOMWindowClipboardConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11JSClipboard14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSClipboardPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSClipboardConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore22JSClipboardConstructor9classInfoEv
+__ZN7WebCore29jsDOMWindowCounterConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSCounter14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSCounterConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore18JSCounterPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSCounter15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSCounterConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSCounterConstructor9classInfoEv
+__ZN7WebCore36jsDOMWindowCSSCharsetRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSCSSCharsetRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSCSSCharsetRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSCSSCharsetRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSCSSCharsetRuleConstructor9classInfoEv
+__ZN7WebCore37jsDOMWindowCSSFontFaceRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSCSSFontFaceRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSCSSFontFaceRuleConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore26JSCSSFontFaceRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore28JSCSSFontFaceRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore28JSCSSFontFaceRuleConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowCSSImportRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSCSSImportRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSCSSImportRuleConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSCSSImportRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSCSSImportRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSCSSImportRuleConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowCSSMediaRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSCSSMediaRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSCSSMediaRuleConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSCSSMediaRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSCSSMediaRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSCSSMediaRuleConstructor9classInfoEv
+__ZN7WebCore33jsDOMWindowCSSPageRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13JSCSSPageRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore22JSCSSPageRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSCSSPageRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSCSSPageRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore24JSCSSPageRuleConstructor9classInfoEv
+__ZNK7WebCore30JSCSSPrimitiveValueConstructor9classInfoEv
+__ZNK7WebCore20JSCSSRuleConstructor9classInfoEv
+__ZN7WebCore33jsDOMWindowCSSRuleListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13JSCSSRuleList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore24JSCSSRuleListConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore22JSCSSRuleListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSCSSRuleListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore24JSCSSRuleListConstructor9classInfoEv
+__ZN7WebCore32JSCSSStyleDeclarationConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore32JSCSSStyleDeclarationConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowCSSStyleRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSCSSStyleRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSCSSStyleRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSCSSStyleRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSCSSStyleRuleConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowCSSStyleSheetConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSCSSStyleSheet14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSCSSStyleSheetConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSCSSStyleSheetPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSCSSStyleSheetConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSCSSStyleSheetConstructor9classInfoEv
+__ZNK7WebCore21JSCSSValueConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowCSSValueListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSCSSValueList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSCSSValueListConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSCSSValueListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSCSSValueListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSCSSValueListConstructor9classInfoEv
+__ZN7WebCore39jsDOMWindowDOMImplementationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSDOMImplementation14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore30JSDOMImplementationConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore28JSDOMImplementationPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSDOMImplementationConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore30JSDOMImplementationConstructor9classInfoEv
+__ZNK7WebCore18JSEventConstructor9classInfoEv
+__ZN7WebCore36jsDOMWindowHTMLCollectionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSHTMLCollection14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLCollectionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLCollectionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSHTMLCollectionConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowKeyboardEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSKeyboardEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSKeyboardEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSKeyboardEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSKeyboardEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSKeyboardEventConstructor9classInfoEv
+__ZN7WebCore31jsDOMWindowMediaListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11JSMediaList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSMediaListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSMediaListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore22JSMediaListConstructor9classInfoEv
+__ZN7WebCore30jsDOMWindowMimeTypeConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSMimeType14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSMimeTypeConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore19JSMimeTypePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSMimeTypeConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSMimeTypeConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowMimeTypeArrayConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSMimeTypeArray14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSMimeTypeArrayConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSMimeTypeArrayPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSMimeTypeArrayConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSMimeTypeArrayConstructor9classInfoEv
+__ZN7WebCore32jsDOMWindowMouseEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSMouseEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSMouseEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore21JSMouseEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSMouseEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore23JSMouseEventConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowMutationEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSMutationEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSMutationEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSMutationEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSMutationEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSMutationEventConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowNamedNodeMapConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSNamedNodeMap14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSNamedNodeMapConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSNamedNodeMapPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSNamedNodeMapConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSNamedNodeMapConstructor9classInfoEv
+__ZNK7WebCore23JSNodeFilterConstructor9classInfoEv
+__ZN7WebCore30jsDOMWindowNodeListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSNodeListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSNodeListConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowOverflowEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSOverflowEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSOverflowEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSOverflowEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSOverflowEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSOverflowEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSOverflowEventConstructor9classInfoEv
+__ZN7WebCore28jsDOMWindowPluginConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore8JSPlugin14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore19JSPluginConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore17JSPluginPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSPluginConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSPluginConstructor9classInfoEv
+__ZN7WebCore33jsDOMWindowPluginArrayConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13JSPluginArray14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore24JSPluginArrayConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore22JSPluginArrayPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSPluginArrayConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore24JSPluginArrayConstructor9classInfoEv
+__ZN7WebCore27jsDOMWindowRangeConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7JSRange14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore18JSRangeConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore16JSRangePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSRangeConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSRangeConstructor9classInfoEv
+__ZN7WebCore26jsDOMWindowRectConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore6JSRect14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore17JSRectConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore15JSRectPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore6JSRect15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSRectConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSRectConstructor9classInfoEv
+__ZN7WebCore32jsDOMWindowStyleSheetConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSStyleSheet14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSStyleSheetConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore23JSStyleSheetConstructor9classInfoEv
+__ZN7WebCore36jsDOMWindowStyleSheetListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSStyleSheetList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSStyleSheetListConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore25JSStyleSheetListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSStyleSheetListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSStyleSheetListConstructor9classInfoEv
+__ZN7WebCore31jsDOMWindowTextEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11JSTextEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore22JSTextEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore20JSTextEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSTextEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSTextEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore22JSTextEventConstructor9classInfoEv
+__ZN7WebCore29jsDOMWindowUIEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSUIEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSUIEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore20JSUIEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSUIEventConstructor9classInfoEv
+__ZN7WebCore32jsDOMWindowWheelEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSWheelEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSWheelEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore21JSWheelEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSWheelEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore23JSWheelEventConstructor9classInfoEv
+__ZNK7WebCore24JSXPathResultConstructor9classInfoEv
+__ZN7WebCore28jsDOMWindowWorkerConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow6workerEPN3JSC9ExecStateE
+__ZN7WebCore19JSWorkerConstructorC1EPN3JSC9ExecStateE
+__ZN7WebCore19JSWorkerConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore17JSWorkerPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore8JSWorker15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSWorkerConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCoreL15constructWorkerEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZN7WebCore36jsDOMWindowXPathEvaluatorConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSXPathEvaluator14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSXPathEvaluatorConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore25JSXPathEvaluatorPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSXPathEvaluator15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSXPathEvaluatorConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSXPathEvaluatorConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCore27JSXPathEvaluatorConstructor9constructEPN3JSC9ExecStateEPNS1_8JSObjectERKNS1_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14XPathEvaluatorE
+__ZN7WebCore16JSXPathEvaluatorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14XPathEvaluatorEEE
+__ZN7WebCore16JSXPathEvaluatorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14XPathEvaluatorEEE
+__ZN7WebCore16JSXPathEvaluator18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSXPathEvaluatorPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSXPathEvaluator9classInfoEv
+__ZN7WebCore24JSXSLTProcessorPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore15JSXSLTProcessor9classInfoEv
+__ZN7WebCore18JSAudioConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCoreL14constructAudioEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZNK7WebCore18JSAudioConstructor8documentEv
+__ZN7WebCore16JSXPathEvaluatorD1Ev
+__ZN7WebCore16JSXPathEvaluatorD2Ev
+__ZThn8_N7WebCore16HTMLAudioElementD0Ev
+__ZN7WebCore28JSEntityReferenceConstructorD1Ev
+__ZN7WebCore17JSEntityPrototypeD1Ev
+__ZN7WebCore19JSEntityConstructorD1Ev
+__ZN7WebCore25JSDocumentTypeConstructorD1Ev
+__ZN7WebCore29JSDocumentFragmentConstructorD1Ev
+__ZN7WebCore25JSCDATASectionConstructorD1Ev
+__ZN7WebCore26JSCharacterDataConstructorD1Ev
+__ZN7WebCore17JSAttrConstructorD1Ev
+__ZN7WebCore26JSHTMLHRElementConstructorD1Ev
+__ZN7WebCore28JSHTMLHeadElementConstructorD1Ev
+__ZN7WebCore32JSHTMLFrameSetElementConstructorD1Ev
+__ZN7WebCore29JSHTMLFrameElementConstructorD1Ev
+__ZN7WebCore28JSHTMLFontElementConstructorD1Ev
+__ZN7WebCore32JSHTMLFieldSetElementConstructorD1Ev
+__ZN7WebCore29JSHTMLEmbedElementConstructorD1Ev
+__ZN7WebCore29JSHTMLDListElementConstructorD1Ev
+__ZN7WebCore30JSHTMLCanvasElementConstructorD1Ev
+__ZN7WebCore26JSHTMLBRElementConstructorD1Ev
+__ZN7WebCore34JSHTMLBlockquoteElementConstructorD1Ev
+__ZN7WebCore32JSHTMLBaseFontElementConstructorD1Ev
+__ZN7WebCore28JSHTMLBaseElementConstructorD1Ev
+__ZN7WebCore28JSHTMLAreaElementConstructorD1Ev
+__ZN7WebCore30JSHTMLAppletElementConstructorD1Ev
+__ZN7WebCore19JSNotationPrototypeD1Ev
+__ZN7WebCore33JSHTMLDirectoryElementConstructorD1Ev
+__ZN7WebCore21JSNotationConstructorD1Ev
+__ZN7WebCore34JSProcessingInstructionConstructorD1Ev
+__ZN7WebCore31JSHTMLIsIndexElementConstructorD1Ev
+__ZN7WebCore29JSHTMLLabelElementConstructorD1Ev
+__ZN7WebCore30JSHTMLLegendElementConstructorD1Ev
+__ZN7WebCore28JSHTMLLinkElementConstructorD1Ev
+__ZN7WebCore27JSHTMLMapElementConstructorD1Ev
+__ZN7WebCore31JSHTMLMarqueeElementConstructorD1Ev
+__ZN7WebCore28JSHTMLMenuElementConstructorD1Ev
+__ZN7WebCore28JSHTMLMetaElementConstructorD1Ev
+__ZN7WebCore30JSHTMLObjectElementConstructorD1Ev
+__ZN7WebCore29JSHTMLOListElementConstructorD1Ev
+__ZN7WebCore32JSHTMLOptGroupElementConstructorD1Ev
+__ZN7WebCore30JSHTMLOptionElementConstructorD1Ev
+__ZN7WebCore29JSHTMLParamElementConstructorD1Ev
+__ZN7WebCore27JSHTMLPreElementConstructorD1Ev
+__ZN7WebCore29JSHTMLQuoteElementConstructorD1Ev
+__ZN7WebCore29JSHTMLStyleElementConstructorD1Ev
+__ZN7WebCore36JSHTMLTableCaptionElementConstructorD1Ev
+__ZN7WebCore32JSHTMLTableColElementConstructorD1Ev
+__ZN7WebCore36JSHTMLTableSectionElementConstructorD1Ev
+__ZN7WebCore33JSHTMLTableCellElementConstructorD1Ev
+__ZN7WebCore32JSHTMLTableRowElementConstructorD1Ev
+__ZN7WebCore29JSHTMLTitleElementConstructorD1Ev
+__ZN7WebCore37JSCanvasRenderingContext2DConstructorD1Ev
+__ZN7WebCore22JSClipboardConstructorD1Ev
+__ZN7WebCore20JSCounterConstructorD1Ev
+__ZN7WebCore18JSCounterPrototypeD1Ev
+__ZN7WebCore27JSCSSCharsetRuleConstructorD1Ev
+__ZN7WebCore28JSCSSFontFaceRuleConstructorD1Ev
+__ZN7WebCore26JSCSSImportRuleConstructorD1Ev
+__ZN7WebCore25JSCSSMediaRuleConstructorD1Ev
+__ZN7WebCore24JSCSSPageRuleConstructorD1Ev
+__ZN7WebCore22JSCSSPageRulePrototypeD1Ev
+__ZN7WebCore24JSCSSRuleListConstructorD1Ev
+__ZN7WebCore25JSCSSStyleRuleConstructorD1Ev
+__ZN7WebCore26JSCSSStyleSheetConstructorD1Ev
+__ZN7WebCore25JSCSSValueListConstructorD1Ev
+__ZN7WebCore30JSDOMImplementationConstructorD1Ev
+__ZN7WebCore27JSHTMLCollectionConstructorD1Ev
+__ZN7WebCore26JSKeyboardEventConstructorD1Ev
+__ZN7WebCore22JSMediaListConstructorD1Ev
+__ZN7WebCore21JSMimeTypeConstructorD1Ev
+__ZN7WebCore26JSMimeTypeArrayConstructorD1Ev
+__ZN7WebCore23JSMouseEventConstructorD1Ev
+__ZN7WebCore26JSMutationEventConstructorD1Ev
+__ZN7WebCore25JSNamedNodeMapConstructorD1Ev
+__ZN7WebCore26JSOverflowEventConstructorD1Ev
+__ZN7WebCore24JSOverflowEventPrototypeD1Ev
+__ZN7WebCore19JSPluginConstructorD1Ev
+__ZN7WebCore24JSPluginArrayConstructorD1Ev
+__ZN7WebCore18JSRangeConstructorD1Ev
+__ZN7WebCore17JSRectConstructorD1Ev
+__ZN7WebCore15JSRectPrototypeD1Ev
+__ZN7WebCore23JSStyleSheetConstructorD1Ev
+__ZN7WebCore27JSStyleSheetListConstructorD1Ev
+__ZN7WebCore22JSTextEventConstructorD1Ev
+__ZN7WebCore20JSTextEventPrototypeD1Ev
+__ZN7WebCore20JSUIEventConstructorD1Ev
+__ZN7WebCore23JSWheelEventConstructorD1Ev
+__ZN7WebCore21JSWheelEventPrototypeD1Ev
+__ZN7WebCore19JSWorkerConstructorD1Ev
+__ZN7WebCore17JSWorkerPrototypeD1Ev
+__ZN7WebCore27JSXPathEvaluatorConstructorD1Ev
+__ZN7WebCore25JSXPathEvaluatorPrototypeD1Ev
+__ZN7WebCoreL14warningHandlerEPvPKcz
+__ZN3WTF7HashMapIPN7WebCore16AtomicStringImplES3_NS_7PtrHashIS3_EENS_10HashTraitsIS3_EES7_E3setERKS3_SA_
+__ZN7WebCore48jsRangePrototypeFunctionCreateContextualFragmentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore5Range24createContextualFragmentERKNS_6StringERi
+__ZN7WebCore16JSHTMLCollection16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore25JSHTMLCollectionPrototype9classInfoEv
+__ZN7WebCore14JSNamedNodeMap16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore23JSNamedNodeMapPrototype9classInfoEv
+__ZN7WebCore17JSHTMLFormElement16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore26JSHTMLFormElementPrototype9classInfoEv
+__ZNK7WebCore22JSHTMLElementPrototype9classInfoEv
+__ZNK7WebCore18JSElementPrototype9classInfoEv
+__ZNK7WebCore15JSNodePrototype9classInfoEv
+__ZN7WebCore17JSHTMLFormElement11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore15HTMLFormElement4itemEj
+__ZN7WebCore36jsNodeDOCUMENT_POSITION_CONTAINED_BYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsNodeDOCUMENT_POSITION_CONTAINSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsNodeDOCUMENT_POSITION_DISCONNECTEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsNodeDOCUMENT_POSITION_FOLLOWINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore47jsNodeDOCUMENT_POSITION_IMPLEMENTATION_SPECIFICEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsNodeDOCUMENT_POSITION_PRECEDINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsNodeDOCUMENT_TYPE_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17jsNodeENTITY_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsNodeENTITY_REFERENCE_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsNodeNOTATION_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsNodePROCESSING_INSTRUCTION_NODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsElementChildElementCountEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element17childElementCountEv
+__ZN7WebCore28jsHTMLElementContentEditableEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11HTMLElement15contentEditableEv
+__ZN7WebCore25jsHTMLFormElementEncodingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsElementFirstElementChildEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLElementIsContentEditableEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsElementLastElementChildEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element16lastElementChildEv
+__ZN7WebCore27jsElementNextElementSiblingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element18nextElementSiblingEv
+__ZN7WebCore22jsHTMLElementOuterTextEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element9outerTextEv
+__ZN7WebCore31jsElementPreviousElementSiblingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7Element22previousElementSiblingEv
+__ZN7WebCore19JSHTMLSelectElement16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore28JSHTMLSelectElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLSelectElementAutofocusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsHTMLSelectElementWillValidateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore22HTMLFormControlElement12willValidateEv
+__ZN7WebCore16JSStyleSheetList16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore25JSStyleSheetListPrototype9classInfoEv
+__ZN7WebCore13JSCSSRuleList16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore22JSCSSRuleListPrototype9classInfoEv
+__ZN7WebCore21JSCSSStyleDeclaration16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore30JSCSSStyleDeclarationPrototype9classInfoEv
+__ZN7WebCore14JSCSSValueList16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore23JSCSSValueListPrototype9classInfoEv
+__ZNK7WebCore19JSCSSValuePrototype9classInfoEv
+__ZN7WebCore14JSCSSValueList11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore22jsCSSValueCssValueTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsCSSValueListLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSMediaList9classInfoEv
+__ZN7WebCore11JSMediaList16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore20JSMediaListPrototype9classInfoEv
+__ZN7WebCore20JSMediaListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore11JSMediaList11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZNK7WebCore9MediaList4itemEj
+__ZN7WebCore17jsMediaListLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsMediaListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15setJSNodePrefixEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore7Element9setPrefixERKNS_12AtomicStringERi
+__ZN7WebCore4Node14checkSetPrefixERKNS_12AtomicStringERi
+__ZN7WebCore20setJSHTMLElementLangEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement7setLangERKNS_6StringE
+__ZN7WebCore19setJSHTMLElementDirEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore29setJSHTMLAnchorElementCharsetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement10setCharsetERKNS_12AtomicStringE
+__ZN7WebCore28setJSHTMLAnchorElementCoordsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement9setCoordsERKNS_12AtomicStringE
+__ZN7WebCore30setJSHTMLAnchorElementHreflangEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement11setHreflangERKNS_12AtomicStringE
+__ZN7WebCore25setJSHTMLAnchorElementRevEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement6setRevERKNS_12AtomicStringE
+__ZN7WebCore27setJSHTMLAnchorElementShapeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement8setShapeERKNS_12AtomicStringE
+__ZN7WebCore26setJSHTMLAnchorElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLAnchorElement7setTypeERKNS_12AtomicStringE
+__ZN7WebCore27setJSHTMLAppletElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLPlugInElement8setAlignERKNS_6StringE
+__ZN7WebCore25setJSHTMLAppletElementAltEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLAppletElement6setAltERKNS_6StringE
+__ZN7WebCore29setJSHTMLAppletElementArchiveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLAppletElement10setArchiveERKNS_6StringE
+__ZN7WebCore26setJSHTMLAppletElementCodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLAppletElement7setCodeERKNS_6StringE
+__ZN7WebCore30setJSHTMLAppletElementCodeBaseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLAppletElement11setCodeBaseERKNS_6StringE
+__ZN7WebCore28setJSHTMLAppletElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore28setJSHTMLAppletElementHspaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLAppletElement9setHspaceERKNS_6StringE
+__ZN7WebCore26setJSHTMLAppletElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLPlugInElement7setNameERKNS_6StringE
+__ZN7WebCore28setJSHTMLAppletElementObjectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLAppletElement9setObjectERKNS_6StringE
+__ZN7WebCore28setJSHTMLAppletElementVspaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLAppletElement9setVspaceERKNS_6StringE
-__ZN7WebCore15HTMLAreaElement12setAccessKeyERKNS_6StringE
-__ZN7WebCore15HTMLAreaElement6setAltERKNS_6StringE
-__ZN7WebCore15HTMLAreaElement7setHrefERKNS_6StringE
-__ZN7WebCore15HTMLAreaElement9setTargetERKNS_6StringE
-__ZN7WebCore17JSHTMLBaseElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore17JSHTMLBaseElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore27setJSHTMLAppletElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore29setJSHTMLAreaElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLAreaElement12setAccessKeyERKNS_12AtomicStringE
+__ZN7WebCore23setJSHTMLAreaElementAltEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLAreaElement6setAltERKNS_12AtomicStringE
+__ZN7WebCore25setJSHTMLAreaElementShapeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLAreaElement8setShapeERKNS_12AtomicStringE
+__ZN7WebCore26setJSHTMLAreaElementTargetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLAreaElement9setTargetERKNS_12AtomicStringE
+__ZN7WebCore24setJSHTMLBaseElementHrefEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLBaseElement7setHrefERKNS_6StringE
+__ZN7WebCore26setJSHTMLBaseElementTargetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLBaseElement9setTargetERKNS_6StringE
-__ZN7WebCore21JSHTMLBaseFontElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore21JSHTMLBaseFontElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore21JSHTMLBaseFontElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore29setJSHTMLBaseFontElementColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLBaseFontElement8setColorERKNS_6StringE
+__ZN7WebCore28setJSHTMLBaseFontElementFaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLBaseFontElement7setFaceERKNS_6StringE
-__ZN7WebCore23JSHTMLBlockquoteElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore30setJSHTMLBlockquoteElementCiteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore21HTMLBlockquoteElement7setCiteERKNS_6StringE
+__ZN7WebCore25setJSHTMLBodyElementALinkEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLBodyElement8setALinkERKNS_6StringE
-__ZN7WebCore15JSHTMLBRElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore30setJSHTMLBodyElementBackgroundEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLBodyElement13setBackgroundERKNS_6StringE
+__ZN7WebCore27setJSHTMLBodyElementBgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSHTMLBodyElementLinkEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSHTMLBodyElementTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSHTMLBodyElementVLinkEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23setJSHTMLBRElementClearEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore13HTMLBRElement8setClearERKNS_6StringE
+__ZN7WebCore31setJSHTMLButtonElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLButtonElement12setAccessKeyERKNS_6StringE
+__ZN7WebCore27setJSHTMLButtonElementValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLButtonElement8setValueERKNS_6StringE
+__ZN7WebCore24setJSHTMLDivElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore14HTMLDivElement8setAlignERKNS_6StringE
+__ZN7WebCore26setJSHTMLEmbedElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23jsHTMLEmbedElementAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25setJSHTMLEmbedElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSHTMLEmbedElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLEmbedElement6setSrcERKNS_6StringE
+__ZN7WebCore25setJSHTMLEmbedElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLEmbedElement7setTypeERKNS_6StringE
+__ZN7WebCore25setJSHTMLFontElementColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLFontElement8setColorERKNS_6StringE
+__ZN7WebCore24setJSHTMLFontElementFaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLFontElement7setFaceERKNS_6StringE
+__ZN7WebCore24setJSHTMLFontElementSizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLFontElement7setSizeERKNS_6StringE
+__ZN7WebCore28setJSHTMLFormElementEncodingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLFormElement10setEnctypeERKNS_6StringE
-__ZN7WebCore18JSHTMLFrameElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore18JSHTMLFrameElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore27setJSHTMLFormElementEnctypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18JSHTMLFrameElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore32setJSHTMLFrameElementFrameBorderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore29setJSHTMLFrameElementLongDescEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore20HTMLFrameElementBase11setLongDescERKNS_6StringE
-__ZN7WebCore18JSHTMLFrameElement6setSrcEPN3KJS9ExecStateEPNS1_7JSValueE
-__ZN7WebCore18JSHTMLFrameElement11setLocationEPN3KJS9ExecStateEPNS1_7JSValueE
+__ZN7WebCore33setJSHTMLFrameElementMarginHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSHTMLFrameElementMarginWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSHTMLFrameElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore30setJSHTMLFrameElementScrollingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSHTMLFrameElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18JSHTMLFrameElement6setSrcEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore29setJSHTMLFrameElementLocationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18JSHTMLFrameElement11setLocationEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore26jsHTMLFrameElementLocationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore20HTMLFrameElementBase8locationEv
-__ZN7WebCore21JSHTMLFrameSetElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore21JSHTMLFrameSetElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore21JSHTMLFrameSetElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore28setJSHTMLFrameSetElementColsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLFrameSetElement7setColsERKNS_6StringE
+__ZN7WebCore28setJSHTMLFrameSetElementRowsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLFrameSetElement7setRowsERKNS_6StringE
-__ZN7WebCore17JSHTMLHeadElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore27setJSHTMLHeadElementProfileEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLHeadElement10setProfileERKNS_6StringE
-__ZN7WebCore20JSHTMLHeadingElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore28setJSHTMLHeadingElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore18HTMLHeadingElement8setAlignERKNS_6StringE
-__ZN7WebCore15JSHTMLHRElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore23setJSHTMLHRElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore13HTMLHRElement8setAlignERKNS_6StringE
+__ZN7WebCore22setJSHTMLHRElementSizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore13HTMLHRElement7setSizeERKNS_6StringE
+__ZN7WebCore23setJSHTMLHRElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore13HTMLHRElement8setWidthERKNS_6StringE
-__ZN7WebCore17JSHTMLHtmlElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore27setJSHTMLHtmlElementVersionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLHtmlElement10setVersionERKNS_6StringE
+__ZN7WebCore27setJSHTMLIFrameElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLIFrameElement8setAlignERKNS_6StringE
+__ZN7WebCore30setJSHTMLIFrameElementLongDescEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSHTMLImageElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement7setNameERKNS_6StringE
+__ZN7WebCore29setJSHTMLImageElementLongDescEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLImageElement11setLongDescERKNS_6StringE
+__ZN7WebCore27setJSHTMLImageElementLowsrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLImageElement9setLowsrcERKNS_6StringE
+__ZN7WebCore24jsHTMLImageElementLowsrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore16HTMLImageElement6lowsrcEv
+__ZN7WebCore27setJSHTMLInputElementAcceptEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLInputElement9setAcceptERKNS_6StringE
+__ZN7WebCore30setJSHTMLInputElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLInputElement12setAccessKeyERKNS_6StringE
+__ZN7WebCore26setJSHTMLInputElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLInputElement8setAlignERKNS_6StringE
+__ZN7WebCore24setJSHTMLInputElementAltEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLInputElement6setAltERKNS_6StringE
+__ZN7WebCore33setJSHTMLInputElementDefaultValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLInputElement15setDefaultValueERKNS_6StringE
+__ZN7WebCore24setJSHTMLInputElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement6setSrcERKNS_6StringE
+__ZN7WebCore7Element15removeAttributeERKNS_13QualifiedNameERi
+__ZN7WebCore27setJSHTMLInputElementUseMapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLInputElement9setUseMapERKNS_6StringE
-__ZN7WebCore20JSHTMLIsIndexElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore20JSHTMLIsIndexElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore29setJSHTMLIsIndexElementPromptEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore18HTMLIsIndexElement9setPromptERKNS_6StringE
+__ZN7WebCore30setJSHTMLLabelElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLLabelElement12setAccessKeyERKNS_6StringE
-__ZN7WebCore19JSHTMLLegendElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore31setJSHTMLLegendElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLLegendElement12setAccessKeyERKNS_6StringE
+__ZN7WebCore27setJSHTMLLegendElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLLegendElement8setAlignERKNS_6StringE
+__ZN7WebCore22setJSHTMLLIElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore13HTMLLIElement7setTypeERKNS_6StringE
+__ZN7WebCore27setJSHTMLLinkElementCharsetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLLinkElement10setCharsetERKNS_6StringE
+__ZN7WebCore28setJSHTMLLinkElementHreflangEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLLinkElement11setHreflangERKNS_6StringE
+__ZN7WebCore23setJSHTMLLinkElementRevEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLLinkElement6setRevERKNS_6StringE
+__ZN7WebCore26setJSHTMLLinkElementTargetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLLinkElement9setTargetERKNS_6StringE
+__ZN7WebCore23setJSHTMLMapElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore14HTMLMapElement7setNameERKNS_6StringE
+__ZN7WebCore29setJSHTMLMetaElementHttpEquivEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore15HTMLMetaElement12setHttpEquivERKNS_6StringE
+__ZN7WebCore26setJSHTMLMetaElementSchemeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore15HTMLMetaElement9setSchemeERKNS_6StringE
-__ZN7WebCore16JSHTMLModElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore23setJSHTMLModElementCiteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore14HTMLModElement7setCiteERKNS_6StringE
+__ZN7WebCore27setJSHTMLModElementDateTimeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore14HTMLModElement11setDateTimeERKNS_6StringE
+__ZN7WebCore26setJSHTMLObjectElementCodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLObjectElement7setCodeERKNS_6StringE
+__ZN7WebCore27setJSHTMLObjectElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore29setJSHTMLObjectElementArchiveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLObjectElement10setArchiveERKNS_6StringE
+__ZN7WebCore28setJSHTMLObjectElementBorderEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLObjectElement9setBorderERKNS_6StringE
+__ZN7WebCore30setJSHTMLObjectElementCodeBaseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLObjectElement11setCodeBaseERKNS_6StringE
+__ZN7WebCore30setJSHTMLObjectElementCodeTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLObjectElement11setCodeTypeERKNS_6StringE
+__ZN7WebCore28setJSHTMLObjectElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26setJSHTMLObjectElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore29setJSHTMLObjectElementStandbyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLObjectElement10setStandbyERKNS_6StringE
-__ZN7WebCore17HTMLObjectElement7setTypeERKNS_6StringE
+__ZN7WebCore28setJSHTMLObjectElementUseMapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLObjectElement9setUseMapERKNS_6StringE
+__ZN7WebCore27setJSHTMLObjectElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSHTMLOListElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLOListElement7setTypeERKNS_6StringE
-__ZN7WebCore21JSHTMLOptGroupElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore21JSHTMLOptGroupElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore29setJSHTMLOptGroupElementLabelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLOptGroupElement8setLabelERKNS_6StringE
+__ZN7WebCore27setJSHTMLOptionElementLabelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLOptionElement8setLabelERKNS_6StringE
-__ZN7WebCore22JSHTMLParagraphElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore30setJSHTMLParagraphElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore20HTMLParagraphElement8setAlignERKNS_6StringE
-__ZN7WebCore18JSHTMLParamElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
-__ZN7WebCore16HTMLParamElement7setNameERKNS_6StringE
+__ZN7WebCore25setJSHTMLParamElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLParamElement7setTypeERKNS_6StringE
-__ZN7WebCore16HTMLParamElement8setValueERKNS_6StringE
+__ZN7WebCore30setJSHTMLParamElementValueTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLParamElement12setValueTypeERKNS_6StringE
-__ZN7WebCore18JSHTMLQuoteElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore18JSHTMLQuoteElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore18JSHTMLQuoteElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25setJSHTMLQuoteElementCiteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLQuoteElement7setCiteERKNS_6StringE
+__ZN7WebCore29setJSHTMLScriptElementHtmlForEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLScriptElement10setHtmlForERKNS_6StringE
+__ZN7WebCore27setJSHTMLScriptElementEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore17HTMLScriptElement8setEventERKNS_6StringE
-__ZN7WebCore25JSHTMLTableCaptionElement3putEPN3KJS9ExecStateERKNS1_10IdentifierEPNS1_7JSValueEi
-__ZN7WebCore25JSHTMLTableCaptionElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore26setJSHTMLSelectElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore26setJSHTMLStyleElementMediaEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLStyleElement8setMediaERKNS_12AtomicStringE
+__ZN7WebCore25JSHTMLTableCaptionElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore33setJSHTMLTableCaptionElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore23HTMLTableCaptionElement8setAlignERKNS_6StringE
+__ZN7WebCore29setJSHTMLTableCellElementAbbrEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore20HTMLTableCellElement7setAbbrERKNS_6StringE
+__ZN7WebCore30setJSHTMLTableCellElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement8setAlignERKNS_6StringE
+__ZN7WebCore29setJSHTMLTableCellElementAxisEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore20HTMLTableCellElement7setAxisERKNS_6StringE
+__ZN7WebCore32setJSHTMLTableCellElementBgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore20HTMLTableCellElement10setBgColorERKNS_6StringE
+__ZN7WebCore27setJSHTMLTableCellElementChEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore20HTMLTableCellElement5setChERKNS_6StringE
+__ZN7WebCore30setJSHTMLTableCellElementChOffEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore20HTMLTableCellElement8setChOffERKNS_6StringE
+__ZN7WebCore32setJSHTMLTableCellElementHeadersEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore20HTMLTableCellElement10setHeadersERKNS_6StringE
+__ZN7WebCore31setJSHTMLTableCellElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement9setHeightERKNS_6StringE
+__ZN7WebCore30setJSHTMLTableCellElementScopeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore20HTMLTableCellElement8setScopeERKNS_6StringE
+__ZN7WebCore31setJSHTMLTableCellElementVAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement9setVAlignERKNS_6StringE
+__ZN7WebCore30setJSHTMLTableCellElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement8setWidthERKNS_6StringE
+__ZN7WebCore29setJSHTMLTableColElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLTableColElement8setAlignERKNS_6StringE
+__ZN7WebCore26setJSHTMLTableColElementChEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLTableColElement5setChERKNS_6StringE
+__ZN7WebCore29setJSHTMLTableColElementChOffEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLTableColElement8setChOffERKNS_6StringE
+__ZN7WebCore30setJSHTMLTableColElementVAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLTableColElement9setVAlignERKNS_6StringE
+__ZN7WebCore29setJSHTMLTableColElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTableColElement8setWidthERKNS_6StringE
+__ZN7WebCore28setJSHTMLTableElementBgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLTableElement10setBgColorERKNS_6StringE
+__ZN7WebCore26setJSHTMLTableElementFrameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLTableElement8setFrameERKNS_6StringE
+__ZN7WebCore26setJSHTMLTableElementRulesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLTableElement8setRulesERKNS_6StringE
+__ZN7WebCore28setJSHTMLTableElementSummaryEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLTableElement10setSummaryERKNS_6StringE
+__ZN7WebCore29setJSHTMLTableRowElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTableRowElement8setAlignERKNS_6StringE
+__ZN7WebCore31setJSHTMLTableRowElementBgColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTableRowElement10setBgColorERKNS_6StringE
+__ZN7WebCore26setJSHTMLTableRowElementChEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLTableRowElement5setChERKNS_6StringE
+__ZN7WebCore29setJSHTMLTableRowElementChOffEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLTableRowElement8setChOffERKNS_6StringE
-__ZN7WebCore25JSHTMLTableSectionElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore30setJSHTMLTableRowElementVAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTableRowElement9setVAlignERKNS_6StringE
+__ZN7WebCore33setJSHTMLTableSectionElementAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore23HTMLTableSectionElement8setAlignERKNS_6StringE
+__ZN7WebCore30setJSHTMLTableSectionElementChEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore23HTMLTableSectionElement5setChERKNS_6StringE
+__ZN7WebCore33setJSHTMLTableSectionElementChOffEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore23HTMLTableSectionElement8setChOffERKNS_6StringE
+__ZN7WebCore34setJSHTMLTableSectionElementVAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore23HTMLTableSectionElement9setVAlignERKNS_6StringE
+__ZN7WebCore36setJSHTMLTextAreaElementDefaultValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTextAreaElement15setDefaultValueERKNS_6StringE
+__ZN7WebCore33setJSHTMLTextAreaElementAccessKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLTextAreaElement12setAccessKeyERKNS_6StringE
-__ZN7WebCore18JSHTMLUListElement16putValuePropertyEPN3KJS9ExecStateEiPNS1_7JSValueEi
+__ZN7WebCore28setJSHTMLTextAreaElementNameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSHTMLTitleElementTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSHTMLUListElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore16HTMLUListElement7setTypeERKNS_6StringE
-__ZN7WebCore28JSHTMLBaseElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore28JSHTMLBaseElementConstructor9classInfoEv
-__ZN7WebCore32JSHTMLBaseFontElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore32JSHTMLBaseFontElementConstructor9classInfoEv
-__ZN7WebCore30JSHTMLIFrameElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore30JSHTMLIFrameElementConstructor9classInfoEv
-__ZN7WebCore34JSHTMLBlockquoteElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore34JSHTMLBlockquoteElementConstructor9classInfoEv
+__ZThn8_N7WebCore16HTMLEmbedElementD0Ev
+__ZNK3JSC8Bindings12ObjcInstance12defaultValueEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
+__ZNK3JSC8Bindings12ObjcInstance7valueOfEPNS_9ExecStateE
+__ZNK3JSC8Bindings12ObjcInstance11stringValueEPNS_9ExecStateE
+__ZN7WebCore19jsDOMWindowOnsubmitEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow8onsubmitEv
+__ZN7WebCore38jsDOMWindowHTMLAudioElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLAudioElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore29JSHTMLAudioElementConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore29JSHTMLAudioElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore29JSHTMLAudioElementConstructor9classInfoEv
-__ZN7WebCore35JSSVGPreserveAspectRatioConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore44jsDOMWindowSVGPreserveAspectRatioConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24JSSVGPreserveAspectRatio14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore33JSSVGPreserveAspectRatioPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSSVGPreserveAspectRatio15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore35JSSVGPreserveAspectRatioConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore35JSSVGPreserveAspectRatioConstructor9classInfoEv
-__ZN7WebCore9JSBarInfo18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18jsDOMWindowMenubarEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7menubarEv
 __ZNK7WebCore9JSBarInfo9classInfoEv
-__ZN7WebCore21JSSVGAngleConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30jsDOMWindowSVGAngleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSSVGAngle14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore19JSSVGAnglePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSSVGAngle15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGAngleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore21JSSVGAngleConstructor9classInfoEv
-__ZNK7WebCore30JSCSSPrimitiveValueConstructor9classInfoEv
-__ZN7WebCore21JSSVGPaintConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore21jsDOMWindowScrollbarsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow10scrollbarsEv
+__ZN7WebCore30jsDOMWindowSVGPaintConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSSVGPaint14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSSVGPaintConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore19JSSVGPaintPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSSVGPaint15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSSVGColorPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSSVGColor15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGPaintConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore21JSSVGPaintConstructor9classInfoEv
-__ZN7WebCore19JSEntityConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore19JSEntityConstructor9classInfoEv
-__ZN7WebCore28JSHTMLMenuElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore28JSHTMLMenuElementConstructor9classInfoEv
-__ZN7WebCore27JSHTMLModElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore27JSHTMLModElementConstructor9classInfoEv
-__ZNK7WebCore28JSHTMLFormElementConstructor9classInfoEv
-__ZN7WebCore23JSMouseEventConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore23JSMouseEventConstructor9classInfoEv
-__ZN7WebCore22JSTextEventConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore22JSTextEventConstructor9classInfoEv
-__ZN7WebCore29JSHTMLQuoteElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLQuoteElementConstructor9classInfoEv
-__ZN7WebCore28JSHTMLHeadElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore28JSHTMLHeadElementConstructor9classInfoEv
-__ZN7WebCore31JSHTMLIsIndexElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore31JSHTMLIsIndexElementConstructor9classInfoEv
-__ZNK7WebCore25JSCDATASectionConstructor9classInfoEv
-__ZN7WebCore27JSCSSCharsetRuleConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore27JSCSSCharsetRuleConstructor9classInfoEv
-__ZN7WebCore30JSHTMLAppletElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore30JSHTMLAppletElementConstructor9classInfoEv
-__ZNK7WebCore21JSCSSValueConstructor9classInfoEv
+__ZN7WebCore35jsDOMWindowDOMStringListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSDOMStringList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSDOMStringListConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore24JSDOMStringListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSDOMStringList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSDOMStringListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSDOMStringListConstructor9classInfoEv
+__ZN7WebCore18jsDOMWindowOnfocusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7onfocusEv
+__ZN7WebCore21jsDOMWindowOuterWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow10outerWidthEv
+__ZN7WebCore18jsDOMWindowOnresetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7onresetEv
+__ZN7WebCore37jsDOMWindowOnwebkitanimationiterationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow26onwebkitanimationiterationEv
+__ZNK7WebCore28JSWebKitCSSMatrixConstructor9classInfoEv
+__ZN7WebCore33jsDOMWindowWebKitPointConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow11webKitPointEPN3JSC9ExecStateE
+__ZN7WebCore24JSWebKitPointConstructorC1EPN3JSC9ExecStateE
+__ZN7WebCore24JSWebKitPointConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore22JSWebKitPointPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSWebKitPoint15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZNK7WebCore24JSWebKitPointConstructor9classInfoEv
+__ZN7WebCore42jsDOMWindowXMLHttpRequestUploadConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22JSXMLHttpRequestUpload14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSXMLHttpRequestUploadPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSXMLHttpRequestUpload15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore33JSXMLHttpRequestUploadConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore33JSXMLHttpRequestUploadConstructor9classInfoEv
 __ZNK7WebCore22JSDOMParserConstructor9classInfoEv
-__ZN7WebCore25JSCSSValueListConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore25JSCSSValueListConstructor9classInfoEv
 __ZNK7WebCore8JSScreen9classInfoEv
-__ZN7WebCore36JSXMLHttpRequestExceptionConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore36JSXMLHttpRequestExceptionConstructor9classInfoEv
-__ZN7WebCore29JSHTMLStyleElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLStyleElementConstructor9classInfoEv
-__ZN7WebCore34JSProcessingInstructionConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore34JSProcessingInstructionConstructor9classInfoEv
+__ZN7WebCore25jsDOMWindowSessionStorageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow14sessionStorageEv
+__ZN7WebCore14SessionStorage6createEPNS_4PageE
+__ZN7WebCore14SessionStorageC1EPNS_4PageE
+__ZN7WebCore14SessionStorageC2EPNS_4PageE
+__ZN7WebCore14SessionStorage11storageAreaEPNS_14SecurityOriginE
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEENS1_INS2_18SessionStorageAreaEEENS2_18SecurityOriginHashENS_10HashTrai
+__ZN7WebCore18SessionStorageAreaC1EPNS_14SecurityOriginEPNS_4PageE
+__ZN7WebCore18SessionStorageAreaC2EPNS_14SecurityOriginEPNS_4PageE
+__ZN7WebCore11StorageAreaC2EPNS_14SecurityOriginE
+__ZN7WebCore10StorageMap6createEv
+__ZN7WebCore10StorageMapC1Ev
+__ZN7WebCore10StorageMapC2Ev
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEENS1_INS2_18SessionStorageAreaEEENS2_18SecurityOriginHashENS_10HashTrait
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_NS1_INS2_18SessionStorageAreaEEEENS_18PairFirstExtractorIS
+__ZN7WebCore19InspectorController16didUseDOMStorageEPNS_11StorageAreaEbPNS_5FrameE
+__ZN7WebCore7Storage6createEPNS_5FrameEN3WTF10PassRefPtrINS_11StorageAreaEEE
+__ZN7WebCore7StorageC1EPNS_5FrameEN3WTF10PassRefPtrINS_11StorageAreaEEE
+__ZN7WebCore7StorageC2EPNS_5FrameEN3WTF10PassRefPtrINS_11StorageAreaEEE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_7StorageE
+__ZN7WebCore9JSStorage15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSStorageC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7StorageEEE
+__ZN7WebCore9JSStorageC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7StorageEEE
+__ZN7WebCore9JSStorage18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore9JSStorage18canGetItemsForNameEPN3JSC9ExecStateEPNS_7StorageERKNS1_10IdentifierE
+__ZNK7WebCore7Storage8containsERKNS_6StringE
+__ZNK7WebCore11StorageArea8containsERKNS_6StringE
+__ZNK7WebCore11StorageArea16internalContainsERKNS_6StringE
+__ZNK7WebCore10StorageMap8containsERKNS_6StringE
+__ZN7WebCore18JSStoragePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore9JSStorage9classInfoEv
 __ZNK7WebCore29JSDOMCoreExceptionConstructor9classInfoEv
-__ZN7WebCore32JSHTMLFrameSetElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore32JSHTMLFrameSetElementConstructor9classInfoEv
-__ZN7WebCore27JSRangeExceptionConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28jsDOMWindowClientInformationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsDOMWindowRangeExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSRangeException14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSRangeExceptionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore25JSRangeExceptionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSRangeException15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSRangeExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore27JSRangeExceptionConstructor9classInfoEv
-__ZN7WebCore30JSDOMImplementationConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore30JSDOMImplementationConstructor9classInfoEv
-__ZN7WebCore23JSWheelEventConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore23JSWheelEventConstructor9classInfoEv
-__ZN7WebCore26JSCharacterDataConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore26JSCharacterDataConstructor9classInfoEv
-__ZN7WebCore30JSHTMLLegendElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore30JSHTMLLegendElementConstructor9classInfoEv
-__ZNK7WebCore24JSXPathResultConstructor9classInfoEv
-__ZN7WebCore17JSRectConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore17JSRectConstructor9classInfoEv
-__ZN7WebCore27JSHTMLPreElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore27JSHTMLPreElementConstructor9classInfoEv
-__ZN7WebCore25JSMessageEventConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23jsDOMWindowLocalStorageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow12localStorageEv
+__ZN7WebCore12LocalStorage11storageAreaEPNS_14SecurityOriginE
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEENS1_INS2_16LocalStorageAreaEEENS2_18SecurityOriginHashENS_10HashTraits
+__ZN7WebCore16LocalStorageAreaC1EPNS_14SecurityOriginEPNS_12LocalStorageE
+__ZN7WebCore16LocalStorageAreaC2EPNS_14SecurityOriginEPNS_12LocalStorageE
+__ZN7WebCore12LocalStorage14scheduleImportEN3WTF10PassRefPtrINS_16LocalStorageAreaEEE
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEENS1_INS2_16LocalStorageAreaEEENS2_18SecurityOriginHashENS_10HashTraitsI
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_NS1_INS2_16LocalStorageAreaEEEENS_18PairFirstExtractorIS8_
+__ZNK7WebCore16LocalStorageArea8containsERKNS_6StringE
+__ZN7WebCore29jsDOMWindowStorageConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSStorage14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSStorageConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore18JSStoragePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSStorageConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSStorageConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowMessageEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSMessageEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSMessageEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSMessageEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSMessageEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore25JSMessageEventConstructor9classInfoEv
-__ZN7WebCore20JSCounterConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore20JSCounterConstructor9classInfoEv
-__ZN7WebCore25JSNamedNodeMapConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore25JSNamedNodeMapConstructor9classInfoEv
-__ZN7WebCore32JSHTMLOptGroupElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore32JSHTMLOptGroupElementConstructor9classInfoEv
-__ZN7WebCore31JSHTMLHeadingElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore31JSHTMLHeadingElementConstructor9classInfoEv
-__ZN7WebCore24JSCSSRuleListConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore24JSCSSRuleListConstructor9classInfoEv
-__ZNK7WebCore25JSHTMLDocumentConstructor9classInfoEv
-__ZN7WebCore33JSHTMLParagraphElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore33JSHTMLParagraphElementConstructor9classInfoEv
-__ZN7WebCore32JSHTMLFieldSetElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore32JSHTMLFieldSetElementConstructor9classInfoEv
-__ZN7WebCore23JSStyleSheetConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore23JSStyleSheetConstructor9classInfoEv
-__ZN7WebCore30JSHTMLButtonElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore30JSHTMLButtonElementConstructor9classInfoEv
-__ZN7WebCore27JSHTMLMapElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore27JSHTMLMapElementConstructor9classInfoEv
-__ZN7WebCore26JSOverflowEventConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore26JSOverflowEventConstructor9classInfoEv
-__ZN7WebCore27JSXPathExceptionConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore27JSXPathExceptionConstructor9classInfoEv
-__ZN7WebCore31JSSVGGradientElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34jsDOMWindowStorageEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSStorageEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSStorageEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSStorageEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSStorageEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSStorageEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSStorageEventConstructor9classInfoEv
+__ZN7WebCore33jsDOMWindowOnwebkitanimationstartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow22onwebkitanimationstartEv
+__ZN7WebCore19jsDOMWindowOnsearchEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow8onsearchEv
+__ZN7WebCore21jsDOMWindowOndblclickEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow10ondblclickEv
+__ZNK7WebCore26JSXSLTProcessorConstructor9classInfoEv
+__ZNK7WebCore19JSWorkerConstructor9classInfoEv
+__ZN7WebCore22jsDOMWindowOnmousemoveEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow11onmousemoveEv
+__ZN7WebCore43jsDOMWindowWebKitTransitionEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSWebKitTransitionEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore34JSWebKitTransitionEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore32JSWebKitTransitionEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSWebKitTransitionEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore34JSWebKitTransitionEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore34JSWebKitTransitionEventConstructor9classInfoEv
+__ZN7WebCore22jsDOMWindowOuterHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow11outerHeightEv
+__ZN7WebCore45jsDOMWindowCSSVariablesDeclarationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSCSSVariablesDeclaration14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore34JSCSSVariablesDeclarationPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSCSSVariablesDeclaration15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore36JSCSSVariablesDeclarationConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore36JSCSSVariablesDeclarationConstructor9classInfoEv
+__ZN7WebCore33jsDOMWindowTextMetricsConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13JSTextMetrics14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore24JSTextMetricsConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore22JSTextMetricsPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSTextMetricsConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore24JSTextMetricsConstructor9classInfoEv
+__ZN7WebCore22jsDOMWindowPersonalbarEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow11personalbarEv
+__ZN7WebCore36jsDOMWindowClientRectListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSClientRectList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSClientRectListConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore25JSClientRectListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSClientRectList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSClientRectListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSClientRectListConstructor9classInfoEv
+__ZN7WebCore40jsDOMWindowSVGGradientElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSSVGGradientElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSSVGGradientElementConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore29JSSVGGradientElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGGradientElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSSVGGradientElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore31JSSVGGradientElementConstructor9classInfoEv
-__ZN7WebCore26JSProgressEventConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore35jsDOMWindowProgressEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSProgressEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore26JSProgressEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore26JSProgressEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore26JSProgressEventConstructor9classInfoEv
+__ZN7WebCore19jsDOMWindowOnselectEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow8onselectEv
+__ZN7WebCore32jsDOMWindowMediaErrorConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSMediaError14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSMediaErrorConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore21JSMediaErrorPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSMediaError15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSMediaErrorConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore23JSMediaErrorConstructor9classInfoEv
-__ZN7WebCore17JSAttrConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore17JSAttrConstructor9classInfoEv
-__ZN7WebCore28JSEntityReferenceConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore28JSEntityReferenceConstructor9classInfoEv
-__ZN7WebCore36JSHTMLTableCaptionElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore36JSHTMLTableCaptionElementConstructor9classInfoEv
-__ZN7WebCore30JSHTMLObjectElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore30JSHTMLObjectElementConstructor9classInfoEv
-__ZN7WebCore29JSHTMLFrameElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLFrameElementConstructor9classInfoEv
-__ZNK7WebCore20JSCSSRuleConstructor9classInfoEv
-__ZNK7WebCore32JSCSSStyleDeclarationConstructor9classInfoEv
-__ZNK7WebCore26JSMutationEventConstructor9classInfoEv
-__ZNK7WebCore29JSHTMLInputElementConstructor9classInfoEv
-__ZN7WebCore33JSHTMLDirectoryElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore33JSHTMLDirectoryElementConstructor9classInfoEv
-__ZN7WebCore30JSHTMLScriptElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore30JSHTMLScriptElementConstructor9classInfoEv
-__ZN7WebCore34JSSVGTextContentElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27jsDOMWindowDevicePixelRatioEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow16devicePixelRatioEv
+__ZN7WebCore21jsDOMWindowScreenLeftEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7screenXEv
+__ZN7WebCore18jsDOMWindowOnkeyupEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7onkeyupEv
+__ZNK7WebCore19JSOptionConstructor9classInfoEv
+__ZN7WebCore23jsDOMWindowOnmousewheelEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow12onmousewheelEv
+__ZN7WebCore35JSWebKitCSSKeyframesRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore35JSWebKitCSSKeyframesRuleConstructor9classInfoEv
+__ZN7WebCore32jsDOMWindowOnwebkittransitionendEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow21onwebkittransitionendEv
+__ZN7WebCore18jsDOMWindowScreenYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7screenYEv
+__ZN7WebCore21jsDOMWindowOnkeypressEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow10onkeypressEv
+__ZN7WebCore18jsDOMWindowToolbarEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7toolbarEv
+__ZN7WebCore43jsDOMWindowSVGTextContentElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSSVGTextContentElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore34JSSVGTextContentElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore34JSSVGTextContentElementConstructor9classInfoEv
-__ZN7WebCore28JSHTMLAreaElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore28JSHTMLAreaElementConstructor9classInfoEv
-__ZNK7WebCore18JSEventConstructor9classInfoEv
-__ZN7WebCore29JSHTMLOListElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLOListElementConstructor9classInfoEv
-__ZN7WebCore30JSHTMLCanvasElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore30JSHTMLCanvasElementConstructor9classInfoEv
-__ZN7WebCore28JSCSSFontFaceRuleConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore28JSCSSFontFaceRuleConstructor9classInfoEv
-__ZNK7WebCore21JSDocumentConstructor9classInfoEv
-__ZN7WebCore26JSHTMLBRElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore26JSHTMLBRElementConstructor9classInfoEv
-__ZN7WebCore25JSCSSStyleRuleConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore25JSCSSStyleRuleConstructor9classInfoEv
-__ZN7WebCore28JSHTMLFontElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore28JSHTMLFontElementConstructor9classInfoEv
-__ZN7WebCore29JSHTMLTitleElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLTitleElementConstructor9classInfoEv
-__ZN7WebCore36JSHTMLTableSectionElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore36JSHTMLTableSectionElementConstructor9classInfoEv
-__ZN7WebCore25JSDocumentTypeConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore25JSDocumentTypeConstructor9classInfoEv
-__ZN7WebCore20JSUIEventConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore20JSUIEventConstructor9classInfoEv
-__ZN7WebCore27JSEventExceptionConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20jsDOMWindowScreenTopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsDOMWindowOnclickEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7onclickEv
+__ZN7WebCore26jsDOMWindowFileConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore6JSFile14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore17JSFileConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore15JSFilePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore6JSFile15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSFileConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSFileConstructor9classInfoEv
+__ZNK7WebCore18JSAudioConstructor9classInfoEv
+__ZN7WebCore17jsDOMWindowCryptoEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSDOMWindow6cryptoEPN3JSC9ExecStateE
+__ZN7WebCore36jsDOMWindowEventExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSEventException14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSEventExceptionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore25JSEventExceptionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSEventExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore27JSEventExceptionConstructor9classInfoEv
-__ZN7WebCore27JSStyleSheetListConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore27JSStyleSheetListConstructor9classInfoEv
-__ZNK7WebCore18JSRangeConstructor9classInfoEv
-__ZN7WebCore25JSCSSMediaRuleConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore25JSCSSMediaRuleConstructor9classInfoEv
-__ZN7WebCore29JSHTMLEmbedElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLEmbedElementConstructor9classInfoEv
-__ZN7WebCore29JSSVGMarkerElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24jsDOMWindowDefaultStatusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow13defaultStatusEv
+__ZNK7WebCore5Frame22jsDefaultStatusBarTextEv
+__ZN7WebCore31jsDOMWindowOnwebkitanimationendEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow20onwebkitanimationendEv
+__ZN7WebCore18jsDOMWindowScreenXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsDOMWindowOnmouseoverEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow11onmouseoverEv
+__ZN7WebCore38jsDOMWindowSVGMarkerElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSSVGMarkerElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSSVGMarkerElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGMarkerElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSSVGMarkerElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore29JSSVGMarkerElementConstructor9classInfoEv
-__ZN7WebCore26JSHTMLHRElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore26JSHTMLHRElementConstructor9classInfoEv
-__ZN7WebCore26JSCSSImportRuleConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore26JSCSSImportRuleConstructor9classInfoEv
-__ZN7WebCore21JSSVGColorConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20jsDOMWindowOnmouseupEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow9onmouseupEv
+__ZN7WebCore24jsDOMWindowDefaultstatusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore42jsDOMWindowWebKitAnimationEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22JSWebKitAnimationEvent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore33JSWebKitAnimationEventConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore31JSWebKitAnimationEventPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore33JSWebKitAnimationEventConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore33JSWebKitAnimationEventConstructor9classInfoEv
+__ZN7WebCore30jsDOMWindowSVGColorConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSSVGColor14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSSVGColorConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore21JSSVGColorConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore21JSSVGColorConstructor9classInfoEv
-__ZN7WebCore29JSHTMLParamElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLParamElementConstructor9classInfoEv
-__ZNK7WebCore29JSDocumentFragmentConstructor9classInfoEv
-__ZNK7WebCore32JSHTMLTextAreaElementConstructor9classInfoEv
-__ZN7WebCore24JSCSSPageRuleConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore24JSCSSPageRuleConstructor9classInfoEv
+__ZN7WebCore29jsDOMWindowOffscreenBufferingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow18offscreenBufferingEv
+__ZN7WebCore27jsDOMWindowApplicationCacheEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow16applicationCacheEv
+__ZN7WebCore19DOMApplicationCacheC1EPNS_5FrameE
+__ZN7WebCore19DOMApplicationCacheC2EPNS_5FrameE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19DOMApplicationCacheE
+__ZN7WebCore21JSDOMApplicationCache15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSDOMApplicationCacheC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19DOMApplicationCacheEEE
+__ZN7WebCore21JSDOMApplicationCacheC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19DOMApplicationCacheEEE
+__ZN7WebCore21JSDOMApplicationCache18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30JSDOMApplicationCachePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSDOMApplicationCache9classInfoEv
+__ZN7WebCore32jsDOMWindowClientRectConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSClientRect14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSClientRectConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore21JSClientRectPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSClientRectConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore23JSClientRectConstructor9classInfoEv
+__ZN7WebCore22jsDOMWindowLocationbarEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow11locationbarEv
+__ZN7WebCore31jsDOMWindowSVGLengthConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11JSSVGLength14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore20JSSVGLengthPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSSVGLength15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore22JSSVGLengthConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore22JSSVGLengthConstructor9classInfoEv
 __ZNK7WebCore27JSXPathEvaluatorConstructor9classInfoEv
-__ZN7WebCore26JSKeyboardEventConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore26JSKeyboardEventConstructor9classInfoEv
-__ZN7WebCore22JSMediaListConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore22JSMediaListConstructor9classInfoEv
-__ZNK7WebCore20JSCommentConstructor9classInfoEv
-__ZN7WebCore21JSNotationConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore21JSNotationConstructor9classInfoEv
-__ZN7WebCore29JSHTMLDListElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLDListElementConstructor9classInfoEv
-__ZNK7WebCore28JSHTMLHtmlElementConstructor9classInfoEv
-__ZN7WebCore29JSHTMLLabelElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore29JSHTMLLabelElementConstructor9classInfoEv
-__ZN7WebCore28JSHTMLLinkElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore28JSHTMLLinkElementConstructor9classInfoEv
-__ZN7WebCore31JSHTMLMarqueeElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore31JSHTMLMarqueeElementConstructor9classInfoEv
-__ZN7WebCore28JSHTMLMetaElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore28JSHTMLMetaElementConstructor9classInfoEv
-__ZNK7WebCore30JSHTMLSelectElementConstructor9classInfoEv
-__ZN7WebCore32JSHTMLTableColElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK7WebCore32JSHTMLTableColElementConstructor9classInfoEv
-__ZNK7WebCore23JSNodeFilterConstructor9classInfoEv
+__ZN7WebCore19jsDOMWindowOnchangeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow8onchangeEv
+__ZN7WebCore18jsDOMWindowOnabortEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow7onabortEv
+__ZN7WebCore22jsDOMWindowOnmousedownEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow11onmousedownEv
+__ZN7WebCore21jsDOMWindowOnmouseoutEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9DOMWindow10onmouseoutEv
+__ZN7WebCore45jsDOMWindowWebKitCSSTransformValueConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSWebKitCSSTransformValue14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore36JSWebKitCSSTransformValueConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore34JSWebKitCSSTransformValuePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSWebKitCSSTransformValue15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore36JSWebKitCSSTransformValueConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore36JSWebKitCSSTransformValueConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowCSSVariablesRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSCSSVariablesRule14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore29JSCSSVariablesRuleConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore27JSCSSVariablesRulePrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSCSSVariablesRule15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSCSSVariablesRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29JSCSSVariablesRuleConstructor9classInfoEv
+__ZNK7WebCore18JSImageConstructor9classInfoEv
+__ZN7WebCore34JSWebKitCSSKeyframeRuleConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore34JSWebKitCSSKeyframeRuleConstructor9classInfoEv
+__ZN7WebCore30jsDOMWindowFileListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore10JSFileList14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSFileListConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore19JSFileListPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSFileList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSFileListConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore21JSFileListConstructor9classInfoEv
 __ZNK7WebCore26JSXMLSerializerConstructor9classInfoEv
+__ZNK7WebCore27JSXMLHttpRequestConstructor9classInfoEv
+__ZN7WebCore45jsDOMWindowXMLHttpRequestExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSXMLHttpRequestException14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore36JSXMLHttpRequestExceptionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore34JSXMLHttpRequestExceptionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSXMLHttpRequestException15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore36JSXMLHttpRequestExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore36JSXMLHttpRequestExceptionConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLMediaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLMediaElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore29JSHTMLMediaElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore29JSHTMLMediaElementConstructor9classInfoEv
+__ZN7WebCore38jsDOMWindowHTMLVideoElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSHTMLVideoElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSHTMLVideoElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSHTMLVideoElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore29JSHTMLVideoElementConstructor9classInfoEv
-__ZN7WebCore25JSSVGExceptionConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore36jsDOMWindowXPathExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSXPathException14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSXPathExceptionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore25JSXPathExceptionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSXPathExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSXPathExceptionConstructor9classInfoEv
+__ZN7WebCore34jsDOMWindowSVGExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSSVGException14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSSVGExceptionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSSVGExceptionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSSVGException15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSSVGExceptionConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore25JSSVGExceptionConstructor9classInfoEv
-__ZN7WebCore23JSSVGPathSegConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore32jsDOMWindowSVGPathSegConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSSVGPathSeg14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore23JSSVGPathSegConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore21JSSVGPathSegPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSSVGPathSeg15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSSVGPathSegConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore23JSSVGPathSegConstructor9classInfoEv
-__ZN7WebCore31JSSVGRenderingIntentConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore40jsDOMWindowSVGRenderingIntentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSSVGRenderingIntent14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSSVGRenderingIntentConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore29JSSVGRenderingIntentPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGRenderingIntent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSSVGRenderingIntentConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore31JSSVGRenderingIntentConstructor9classInfoEv
-__ZN7WebCore31JSSVGTextPathElementConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore40jsDOMWindowSVGTextPathElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSSVGTextPathElement14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore31JSSVGTextPathElementConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore29JSSVGTextPathElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGTextPathElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSSVGTextPathElementConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore31JSSVGTextPathElementConstructor9classInfoEv
-__ZN7WebCore25JSSVGTransformConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34jsDOMWindowSVGTransformConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSSVGTransform14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSSVGTransformConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSSVGTransformPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSSVGTransform15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSSVGTransformConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore25JSSVGTransformConstructor9classInfoEv
-__ZN7WebCore25JSSVGUnitTypesConstructor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34jsDOMWindowSVGUnitTypesConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSSVGUnitTypes14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSSVGUnitTypesConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSSVGUnitTypesPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSSVGUnitTypes15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSSVGUnitTypesConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore25JSSVGUnitTypesConstructor9classInfoEv
-__ZN7WebCore8Document7pluginsEv
+__ZNK7WebCore23JSHTMLDocumentPrototype9classInfoEv
+__ZNK7WebCore19JSDocumentPrototype9classInfoEv
+__ZN7WebCore27jsHTMLDocumentActiveElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12HTMLDocument13activeElementEv
+__ZN7WebCore32jsDocumentPreferredStylesheetSetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore8Document22preferredStylesheetSetEv
-__ZN7WebCore49jsCSSPrimitiveValuePrototypeFunctionSetFloatValueEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore21JSDOMApplicationCache4markEv
+__ZN7WebCore19DOMApplicationCache15disconnectFrameEv
+__ZN7WebCore24JSTextMetricsConstructorD1Ev
+__ZN7WebCore34JSCSSVariablesDeclarationPrototypeD1Ev
+__ZN7WebCore36JSCSSVariablesDeclarationConstructorD1Ev
+__ZN7WebCore32JSWebKitTransitionEventPrototypeD1Ev
+__ZN7WebCore34JSWebKitTransitionEventConstructorD1Ev
+__ZN7WebCore23JSStorageEventPrototypeD1Ev
+__ZN7WebCore25JSStorageEventConstructorD1Ev
+__ZN7WebCore25JSMessageEventConstructorD1Ev
+__ZN7WebCore20JSStorageConstructorD1Ev
+__ZN7WebCore9JSStorageD1Ev
+__ZN7WebCore9JSStorageD2Ev
+__ZN7WebCore25JSRangeExceptionPrototypeD1Ev
+__ZN7WebCore27JSRangeExceptionConstructorD1Ev
+__ZN7WebCore18JSStoragePrototypeD1Ev
+__ZN7WebCore31JSXMLHttpRequestUploadPrototypeD1Ev
+__ZN7WebCore33JSXMLHttpRequestUploadConstructorD1Ev
+__ZN7WebCore22JSWebKitPointPrototypeD1Ev
+__ZN7WebCore24JSWebKitPointConstructorD1Ev
+__ZN7WebCore24JSDOMStringListPrototypeD1Ev
+__ZN7WebCore26JSDOMStringListConstructorD1Ev
+__ZN7WebCore19JSSVGPaintPrototypeD1Ev
+__ZN7WebCore19JSSVGColorPrototypeD1Ev
+__ZN7WebCore21JSSVGPaintConstructorD1Ev
+__ZN7WebCore19JSSVGAnglePrototypeD1Ev
+__ZN7WebCore21JSSVGAngleConstructorD1Ev
+__ZN7WebCore33JSSVGPreserveAspectRatioPrototypeD1Ev
+__ZN7WebCore35JSSVGPreserveAspectRatioConstructorD1Ev
+__ZN7WebCore29JSHTMLAudioElementConstructorD1Ev
+__ZN7WebCore20JSSVGLengthPrototypeD1Ev
+__ZN7WebCore22JSSVGLengthConstructorD1Ev
+__ZN7WebCore23JSClientRectConstructorD1Ev
+__ZN7WebCore21JSDOMApplicationCacheD1Ev
+__ZN7WebCore21JSDOMApplicationCacheD2Ev
+__ZN7WebCore19DOMApplicationCacheD0Ev
+__ZN7WebCore30JSDOMApplicationCachePrototypeD1Ev
+__ZN7WebCore21JSSVGColorConstructorD1Ev
+__ZN7WebCore33JSWebKitAnimationEventConstructorD1Ev
+__ZN7WebCore27JSSVGMarkerElementPrototypeD1Ev
+__ZN7WebCore29JSSVGMarkerElementConstructorD1Ev
+__ZN7WebCore23JSSVGUnitTypesPrototypeD1Ev
+__ZN7WebCore25JSSVGUnitTypesConstructorD1Ev
+__ZN7WebCore23JSSVGTransformPrototypeD1Ev
+__ZN7WebCore27JSEventExceptionConstructorD1Ev
+__ZN7WebCore25JSSVGTransformConstructorD1Ev
+__ZN7WebCore29JSSVGTextPathElementPrototypeD1Ev
+__ZN7WebCore31JSSVGTextPathElementConstructorD1Ev
+__ZN7WebCore29JSSVGRenderingIntentPrototypeD1Ev
+__ZN7WebCore31JSSVGRenderingIntentConstructorD1Ev
+__ZN7WebCore21JSSVGPathSegPrototypeD1Ev
+__ZN7WebCore23JSSVGPathSegConstructorD1Ev
+__ZN7WebCore23JSSVGExceptionPrototypeD1Ev
+__ZN7WebCore25JSSVGExceptionConstructorD1Ev
+__ZN7WebCore27JSXPathExceptionConstructorD1Ev
+__ZN7WebCore29JSHTMLVideoElementConstructorD1Ev
+__ZN7WebCore29JSHTMLMediaElementConstructorD1Ev
+__ZN7WebCore34JSXMLHttpRequestExceptionPrototypeD1Ev
+__ZN7WebCore36JSXMLHttpRequestExceptionConstructorD1Ev
+__ZN7WebCore19JSFileListPrototypeD1Ev
+__ZN7WebCore21JSFileListConstructorD1Ev
+__ZN7WebCore15JSFilePrototypeD1Ev
+__ZN7WebCore17JSFileConstructorD1Ev
+__ZN7WebCore27JSCSSVariablesRulePrototypeD1Ev
+__ZN7WebCore29JSCSSVariablesRuleConstructorD1Ev
+__ZN7WebCore34JSWebKitCSSTransformValuePrototypeD1Ev
+__ZN7WebCore36JSWebKitCSSTransformValueConstructorD1Ev
+__ZN7WebCore34JSSVGTextContentElementConstructorD1Ev
+__ZN7WebCore21JSMediaErrorPrototypeD1Ev
+__ZN7WebCore23JSMediaErrorConstructorD1Ev
+__ZN7WebCore26JSProgressEventConstructorD1Ev
+__ZN7WebCore29JSSVGGradientElementPrototypeD1Ev
+__ZN7WebCore31JSSVGGradientElementConstructorD1Ev
+__ZN7WebCore25JSClientRectListPrototypeD1Ev
+__ZN7WebCore27JSClientRectListConstructorD1Ev
+__ZN7WebCore31jsHTMLFrameElementContentWindowEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore5Image9nullImageEv
+__ZN7WebCore41jsXPathEvaluatorPrototypeFunctionEvaluateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore33jsLocationPrototypeFunctionReloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore10JSLocation6reloadEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore11FrameLoader15scheduleRefreshEb
+__ZN7WebCore40jsElementPrototypeFunctionGetClientRectsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore7Element14getClientRectsEv
+__ZN7WebCore14ClientRectListC1ERKN3WTF6VectorINS_9FloatQuadELm0EEE
+__ZN7WebCore14ClientRectListC2ERKN3WTF6VectorINS_9FloatQuadELm0EEE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14ClientRectListE
+__ZN7WebCore16JSClientRectListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14ClientRectListEEE
+__ZN7WebCore16JSClientRectListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14ClientRectListEEE
+__ZN7WebCore36jsDOMWindowPrototypeFunctionScrollByEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow8scrollByEii
+__ZN7WebCore16JSClientRectList18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZNK7WebCore14ClientRectList6lengthEv
+__ZN7WebCore16JSClientRectList11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore14ClientRectList4itemEj
+__ZN7WebCore7DataRefINS_17StyleMultiColDataEE6accessEv
+__ZN7WebCore17StyleMultiColDataC1ERKS0_
+__ZN7WebCore17StyleMultiColDataC2ERKS0_
+__ZNK7WebCore11RenderBlock9columnGapEv
+__ZN3WTF7HashMapIPKN7WebCore9RenderBoxEPNS1_10ColumnInfoENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3addERKS4_RKS6_
+__ZN3WTF9HashTableIPKN7WebCore9RenderBoxESt4pairIS4_PNS1_10ColumnInfoEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS4_EENS_14PairH
+__ZNK3WTF7HashMapIPKN7WebCore9RenderBoxEPNS1_10ColumnInfoENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE3getERKS4_
+__ZN7WebCore10RenderView18setBestTruncatedAtEiPNS_20RenderBoxModelObjectEb
+__ZNK7WebCore11RenderBlock11columnRectsEv
+__ZN7WebCore17jsClientRectWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsClientRectHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN3WTF7HashMapIPKN7WebCore9RenderBoxEPNS1_10ColumnInfoENS_7PtrHashIS4_EENS_10HashTraitsIS4_EENS9_IS6_EEE4takeERKS4_
+__ZN7WebCore16JSClientRectListD1Ev
+__ZN7WebCore16JSClientRectListD2Ev
+__ZN7WebCore14ClientRectListD1Ev
+__ZN7WebCore14ClientRectListD2Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore10ClientRectEEELm0EE6shrinkEm
+__ZN7WebCore16JSClientRectList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsClientRectListLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSDOMWindowShell12defineGetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectE
+__ZN7WebCore11JSDOMWindow12defineGetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectE
+__ZN7WebCore16JSDOMWindowShell12lookupGetterEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore11JSDOMWindow12lookupGetterEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore16JSDOMWindowShell12defineSetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectE
+__ZN7WebCore11JSDOMWindow12defineSetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectE
+__ZN7WebCore29setJSDOMWindowNodeConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore13StringBuilder6appendEc
+__ZNK7WebCore21JSHTMLTableColElement9classInfoEv
+__ZN7WebCore33jsLocationPrototypeFunctionAssignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore10JSLocation6assignEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore33jsHistoryPrototypeFunctionForwardEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7History7forwardEv
+__ZN7WebCore14SessionStorage4copyEPNS_4PageE
+__ZN7WebCore18SessionStorageArea4copyEPNS_14SecurityOriginEPNS_4PageE
+__ZN7WebCore18SessionStorageAreaC1EPNS_14SecurityOriginEPNS_4PageEPS0_
+__ZN7WebCore18SessionStorageAreaC2EPNS_14SecurityOriginEPNS_4PageEPS0_
+__ZN7WebCore11StorageAreaC2EPNS_14SecurityOriginEPS0_
+__ZN7WebCore4Page17setSessionStorageEN3WTF10PassRefPtrINS_14SessionStorageEEE
+__ZN7WebCore21setJSLocationProtocolEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation11setProtocolEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore17setJSLocationHostEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation7setHostEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore4KURL14setHostAndPortERKNS_6StringE
+__ZN7WebCore21setJSLocationHostnameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation11setHostnameEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore17setJSLocationPortEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation7setPortEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore21setJSLocationPathnameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation11setPathnameEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore19setJSLocationSearchEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10JSLocation9setSearchEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore18SessionStorageAreaD0Ev
+__ZN7WebCore11StorageAreaD2Ev
+__ZNK7WebCore20JSNavigatorPrototype9classInfoEv
+__ZN7WebCore17jsNavigatorOnLineEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13NavigatorBase6onLineEv
+__ZN7WebCore43jsDocumentPrototypeFunctionCreateTreeWalkerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8Document16createTreeWalkerEPNS_4NodeEjN3WTF10PassRefPtrINS_10NodeFilterEEEbRi
+__ZN7WebCore10TreeWalkerC1EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
+__ZN7WebCore10TreeWalkerC2EN3WTF10PassRefPtrINS_4NodeEEEjNS2_INS_10NodeFilterEEEb
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10TreeWalkerE
+__ZN7WebCore12JSTreeWalker15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSTreeWalkerC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10TreeWalkerEEE
+__ZN7WebCore12JSTreeWalkerC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10TreeWalkerEEE
+__ZN7WebCore12JSTreeWalker4markEv
+__ZN7WebCore12JSTreeWalkerD1Ev
+__ZN7WebCore12JSTreeWalkerD2Ev
+__ZN7WebCore21JSTreeWalkerPrototypeD1Ev
+__ZN7WebCore39jsElementPrototypeFunctionScrollByLinesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element13scrollByLinesEi
+__ZN7WebCore7Element13scrollByUnitsEiNS_17ScrollGranularityE
+__ZN7WebCore39jsElementPrototypeFunctionScrollByPagesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element13scrollByPagesEi
+__ZN7WebCore43jsHTMLOptionsCollectionPrototypeFunctionAddEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore23JSHTMLOptionsCollection3addEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore21HTMLOptionsCollection3addEN3WTF10PassRefPtrINS_17HTMLOptionElementEEERi
+__ZN7WebCore21HTMLOptionsCollection3addEN3WTF10PassRefPtrINS_17HTMLOptionElementEEEiRi
+__ZN7WebCore46jsHTMLOptionsCollectionPrototypeFunctionRemoveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore23JSHTMLOptionsCollection6removeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13KeyboardEventC1Ev
+__ZN7WebCore13KeyboardEventC2Ev
+__ZN7WebCore24JSKeyboardEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore49jsKeyboardEventPrototypeFunctionInitKeyboardEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15JSKeyboardEvent9classInfoEv
+__ZN7WebCore11toDOMWindowEN3JSC7JSValueE
+__ZN7WebCore13KeyboardEvent17initKeyboardEventERKNS_12AtomicStringEbbPNS_9DOMWindowERKNS_6StringEjbbbbb
+__ZN7WebCore7UIEvent11initUIEventERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEi
+__ZN7WebCore43jsMouseEventPrototypeFunctionInitMouseEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13toEventTargetEN3JSC7JSValueE
+__ZN7WebCore10MouseEvent14initMouseEventERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEEiiiiibbbbtNS5_INS_11EventTarge
+__ZN7WebCore17MouseRelatedEvent15initCoordinatesEii
+__ZN7WebCore12NodeIterator17nodeWillBeRemovedEPNS_4NodeE
+__ZNK7WebCore12NodeIterator20updateForNodeRemovalEPNS_4NodeERNS0_11NodePointerE
+__ZN7WebCore13ProgressEventC1Ev
+__ZN7WebCore13ProgressEventC2Ev
+__ZN7WebCore15JSProgressEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24JSProgressEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore49jsProgressEventPrototypeFunctionInitProgressEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15JSProgressEvent9classInfoEv
+__ZN7WebCore13ProgressEvent17initProgressEventERKNS_12AtomicStringEbbbjj
+__ZN7WebCore36jsRangePrototypeFunctionComparePointEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore38jsRangePrototypeFunctionIsPointInRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore5Range14isPointInRangeEPNS_4NodeEiRi
+__ZN7WebCore37jsUIEventPrototypeFunctionInitUIEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore34jsDOMWindowPrototypeFunctionMoveByEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow6moveByEff
+__ZN7WebCore36jsDOMWindowPrototypeFunctionResizeByEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore9DOMWindow8resizeByEff
+__ZN7WebCore30setJSHTMLOptionElementSelectedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore36jsHTMLOptionsCollectionSelectedIndexEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21HTMLOptionsCollection13selectedIndexEv
+__ZN7WebCore25setJSHTMLElementOuterTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore11HTMLElement12setOuterTextERKNS_6StringERi
+__ZNK7WebCore28JSHTMLObjectElementPrototype9classInfoEv
+__ZN7WebCore18JSHTMLEmbedElement11getCallDataERN3JSC8CallDataE
+__ZN7WebCore24runtimeObjectGetCallDataEPNS_11HTMLElementERN3JSC8CallDataE
+__ZNK7WebCore27JSHTMLEmbedElementPrototype9classInfoEv
+__ZN7WebCore24jsHTMLEmbedElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLEmbedElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSHTMLAppletElement11getCallDataERN3JSC8CallDataE
+__ZN7WebCore19JSHTMLObjectElement11getCallDataERN3JSC8CallDataE
+__ZNK7WebCore28JSHTMLAppletElementPrototype9classInfoEv
+__ZNK7WebCore25JSHTMLDivElementPrototype9classInfoEv
+__ZNK7WebCore24JSKeyboardEventPrototype9classInfoEv
+__ZN7WebCore6JSRectC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4RectEEE
+__ZN7WebCore6JSRectC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_4RectEEE
+__ZN7WebCore6JSRectD1Ev
+__ZN7WebCore6JSRectD2Ev
+__ZN7WebCore18setJSDOMWindowSelfEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore28setJSHTMLSelectElementLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZNK3WTF7HashMapIPN7WebCore16AtomicStringImplES3_NS_7PtrHashIS3_EENS_10HashTraitsIS3_EES7_E3getERKS3_
+__ZN7WebCore49jsCSSPrimitiveValuePrototypeFunctionSetFloatValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore17CSSPrimitiveValue13setFloatValueEtdRi
-__ZN7WebCore50jsCSSPrimitiveValuePrototypeFunctionSetStringValueEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore50jsCSSPrimitiveValuePrototypeFunctionSetStringValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore17CSSPrimitiveValue14setStringValueEtRKNS_6StringERi
+__ZN7WebCore26setJSHTMLTableElementTHeadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25toHTMLTableSectionElementEN3JSC7JSValueE
+__ZN7WebCore20setJSHTMLDocumentAllEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore14JSHTMLDocument6setAllEPN3JSC9ExecStateENS1_7JSValueE
+__ZNK3JSC38StringObjectThatMasqueradesAsUndefined9toBooleanEPNS_9ExecStateE
+__ZN3JSC38StringObjectThatMasqueradesAsUndefinedD1Ev
 __ZNK7WebCore15JSAttrPrototype9classInfoEv
+__ZN7WebCore17jsAttrConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore18JSCommentPrototype9classInfoEv
 __ZNK7WebCore27JSDocumentFragmentPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore18JSDocumentFragmentEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSDocumentFragment16getValuePropertyEPN3KJS9ExecStateEi
+__ZN7WebCore29jsDocumentFragmentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore28JSDOMImplementationPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore19JSDOMImplementationEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSDOMImplementation16getValuePropertyEPN3KJS9ExecStateEi
+__ZN7WebCore30jsDOMImplementationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14JSNodeIterator9classInfoEv
 __ZNK7WebCore23JSNodeIteratorPrototype9classInfoEv
+__ZN7WebCore25jsNodeIteratorConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14JSNodeIterator14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore25JSNodeIteratorConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore23JSNodeIteratorPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZNK7WebCore25JSNodeIteratorConstructor9classInfoEv
 __ZNK7WebCore16JSRangePrototype9classInfoEv
+__ZN7WebCore18jsRangeConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15JSTextPrototype9classInfoEv
+__ZNK7WebCore12JSTreeWalker9classInfoEv
+__ZN7WebCore12JSTreeWalker18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore21JSTreeWalkerPrototype9classInfoEv
+__ZN7WebCore23jsTreeWalkerConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSTreeWalker14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore21JSTreeWalkerPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZNK7WebCore23JSTreeWalkerConstructor9classInfoEv
+__ZN7WebCore21jsDocumentConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore23JSCDATASectionPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore14JSCDATASectionEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore14JSCDATASection16getValuePropertyEPN3KJS9ExecStateEi
+__ZN7WebCore25jsCDATASectionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore26JSEntityReferencePrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore17JSEntityReferenceEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore17JSEntityReference16getValuePropertyEPN3KJS9ExecStateEi
+__ZN7WebCore28jsEntityReferenceConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore32JSProcessingInstructionPrototype9classInfoEv
+__ZN7WebCore34jsProcessingInstructionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsKeyboardEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsMouseEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore24JSMutationEventPrototype9classInfoEv
+__ZN7WebCore26jsMutationEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore13OverflowEventC1Ev
+__ZN7WebCore13OverflowEventC2Ev
 __ZNK7WebCore13OverflowEvent15isOverflowEventEv
-__ZN7WebCore15JSOverflowEventC1EPN3KJS8JSObjectEPNS_13OverflowEventE
+__ZN7WebCore15getDOMStructureINS_15JSOverflowEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore15JSOverflowEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13OverflowEventEEE
+__ZN7WebCore15JSOverflowEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13OverflowEventEEE
 __ZNK7WebCore15JSOverflowEvent9classInfoEv
-__ZN7WebCore15JSOverflowEvent18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore15JSOverflowEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore24JSOverflowEventPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore15JSOverflowEventEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore15JSOverflowEvent16getValuePropertyEPN3KJS9ExecStateEi
+__ZN7WebCore26jsOverflowEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore9TextEventC1Ev
-__ZN7WebCore11JSTextEventC1EPN3KJS8JSObjectEPNS_9TextEventE
+__ZN7WebCore9TextEventC2Ev
+__ZN7WebCore15getDOMStructureINS_11JSTextEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore11JSTextEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9TextEventEEE
+__ZN7WebCore11JSTextEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_9TextEventEEE
 __ZNK7WebCore11JSTextEvent9classInfoEv
-__ZN7WebCore11JSTextEvent18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore11JSTextEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore20JSTextEventPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore11JSTextEventEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore11JSTextEvent16getValuePropertyEPN3KJS9ExecStateEi
+__ZN7WebCore22jsTextEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsUIEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZN7WebCore10WheelEventC1Ev
+__ZN7WebCore10WheelEventC2Ev
+__ZNK7WebCore12JSWheelEvent9classInfoEv
 __ZNK7WebCore21JSWheelEventPrototype9classInfoEv
-__ZNK7WebCore25JSStyleSheetListPrototype9classInfoEv
+__ZN7WebCore23jsWheelEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsStyleSheetListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore24JSCSSStyleSheetPrototype9classInfoEv
-__ZNK7WebCore22JSCSSRuleListPrototype9classInfoEv
-__ZNK7WebCore18JSCSSRulePrototype9classInfoEv
-__ZNK7WebCore30JSCSSStyleDeclarationPrototype9classInfoEv
+__ZN7WebCore26jsCSSStyleSheetConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsCSSRuleListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14JSCSSStyleRule9classInfoEv
+__ZNK7WebCore23JSCSSStyleRulePrototype9classInfoEv
+__ZN7WebCore25jsCSSStyleRuleConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsCSSStyleDeclarationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore28JSCSSPrimitiveValuePrototype9classInfoEv
+__ZN7WebCore30jsCSSPrimitiveValueConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore10JSRGBColor9classInfoEv
-__ZN7WebCore10JSRGBColor18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore6JSRect9classInfoEv
-__ZN7WebCore6JSRect18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore6JSRect18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore15JSRectPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore6JSRectEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore6JSRect16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore23JSCSSValueListPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore14JSCSSValueListEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore14JSCSSValueList16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore35jsCSSValueListPrototypeFunctionItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9JSCounterC1EPN3KJS8JSObjectEPNS_7CounterE
+__ZN7WebCore17jsRectConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsCSSValueListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSCounterC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7CounterEEE
+__ZN7WebCore9JSCounterC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_7CounterEEE
 __ZNK7WebCore9JSCounter9classInfoEv
-__ZN7WebCore9JSCounter18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore9JSCounter18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore18JSCounterPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore9JSCounterEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore9JSCounter16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore11JSMediaList9classInfoEv
-__ZNK7WebCore20JSMediaListPrototype9classInfoEv
+__ZN7WebCore20jsCounterConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17jsStyleSheetMediaEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsMediaListConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore26JSXPathExpressionPrototype9classInfoEv
+__ZN7WebCore28jsXPathExpressionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17JSXPathExpression14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore28JSXPathExpressionConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore26JSXPathExpressionPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZNK7WebCore28JSXPathExpressionConstructor9classInfoEv
 __ZNK7WebCore22JSXPathResultPrototype9classInfoEv
-__ZNK7WebCore25JSHTMLCollectionPrototype9classInfoEv
+__ZN7WebCore24jsXPathResultConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore28JSHTMLAnchorElementPrototype9classInfoEv
+__ZN7WebCore30jsHTMLAppletElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore26JSHTMLAreaElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLAreaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore17JSHTMLBaseElement9classInfoEv
 __ZNK7WebCore26JSHTMLBaseElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLBaseElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore21JSHTMLBaseFontElement9classInfoEv
 __ZNK7WebCore30JSHTMLBaseFontElementPrototype9classInfoEv
+__ZN7WebCore32jsHTMLBaseFontElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore32JSHTMLBlockquoteElementPrototype9classInfoEv
+__ZN7WebCore34jsHTMLBlockquoteElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore26JSHTMLBodyElementPrototype9classInfoEv
 __ZNK7WebCore24JSHTMLBRElementPrototype9classInfoEv
+__ZN7WebCore26jsHTMLBRElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore28JSHTMLButtonElementPrototype9classInfoEv
 __ZNK7WebCore28JSHTMLCanvasElementPrototype9classInfoEv
+__ZN7WebCore30jsHTMLCanvasElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore25JSHTMLTableCaptionElement9classInfoEv
 __ZNK7WebCore34JSHTMLTableCaptionElementPrototype9classInfoEv
+__ZN7WebCore36jsHTMLTableCaptionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore30JSHTMLTableColElementPrototype9classInfoEv
+__ZN7WebCore32jsHTMLTableColElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore25JSHTMLModElementPrototype9classInfoEv
 __ZNK7WebCore22JSHTMLDirectoryElement9classInfoEv
 __ZNK7WebCore31JSHTMLDirectoryElementPrototype9classInfoEv
+__ZN7WebCore33jsHTMLDirectoryElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore27JSHTMLDListElementPrototype9classInfoEv
+__ZN7WebCore29jsHTMLDListElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsHTMLEmbedElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore30JSHTMLFieldSetElementPrototype9classInfoEv
+__ZN7WebCore32jsHTMLFieldSetElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSCounterD1Ev
+__ZN7WebCore9JSCounterD2Ev
+__ZN7WebCore12JSWheelEventD1Ev
+__ZN7WebCore11JSTextEventD1Ev
+__ZN7WebCore15JSOverflowEventD1Ev
+__ZN7WebCore13OverflowEventD0Ev
 __ZNK7WebCore26JSHTMLFontElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLFontElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsHTMLFormElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore18JSHTMLFrameElement9classInfoEv
 __ZNK7WebCore27JSHTMLFrameElementPrototype9classInfoEv
+__ZN7WebCore29jsHTMLFrameElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore30JSHTMLFrameSetElementPrototype9classInfoEv
+__ZN7WebCore32jsHTMLFrameSetElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore26JSHTMLHeadElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLHeadElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore29JSHTMLHeadingElementPrototype9classInfoEv
 __ZNK7WebCore24JSHTMLHRElementPrototype9classInfoEv
+__ZN7WebCore26jsHTMLHRElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore26JSHTMLHtmlElementPrototype9classInfoEv
 __ZNK7WebCore28JSHTMLIFrameElementPrototype9classInfoEv
+__ZNK7WebCore27JSHTMLImageElementPrototype9classInfoEv
 __ZNK7WebCore27JSHTMLInputElementPrototype9classInfoEv
 __ZNK7WebCore20JSHTMLIsIndexElement9classInfoEv
 __ZNK7WebCore29JSHTMLIsIndexElementPrototype9classInfoEv
-__ZN7WebCore17keygenConstructorERKNS_12AtomicStringEPNS_8DocumentEPNS_15HTMLFormElementEb
-__ZN7WebCore17HTMLKeygenElementC1EPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore17HTMLSelectElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
-__ZN7WebCore17supportedKeySizesEv
-__ZNK7WebCore28JSHTMLSelectElementPrototype9classInfoEv
+__ZN7WebCore31jsHTMLIsIndexElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL17keygenConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLKeygenElementC1ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore17HTMLKeygenElementC2ERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementE
+__ZN7WebCore20getSupportedKeySizesERN3WTF6VectorINS_6StringELm0EEE
 __ZNK7WebCore27JSHTMLLabelElementPrototype9classInfoEv
+__ZN7WebCore29jsHTMLLabelElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore28JSHTMLLegendElementPrototype9classInfoEv
+__ZN7WebCore30jsHTMLLegendElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore24JSHTMLLIElementPrototype9classInfoEv
 __ZNK7WebCore26JSHTMLLinkElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLLinkElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore25JSHTMLPreElementPrototype9classInfoEv
+__ZN7WebCore27jsHTMLPreElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore25JSHTMLMapElementPrototype9classInfoEv
+__ZN7WebCore27jsHTMLMapElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore20JSHTMLMarqueeElement9classInfoEv
 __ZNK7WebCore29JSHTMLMarqueeElementPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore20JSHTMLMarqueeElementEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore20JSHTMLMarqueeElement16getValuePropertyEPN3KJS9ExecStateEi
+__ZN7WebCore31jsHTMLMarqueeElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17JSHTMLMenuElement9classInfoEv
 __ZNK7WebCore26JSHTMLMenuElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLMenuElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore26JSHTMLMetaElementPrototype9classInfoEv
+__ZN7WebCore28jsHTMLMetaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLObjectElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore27JSHTMLOListElementPrototype9classInfoEv
+__ZNK7WebCore21JSHTMLOptGroupElement9classInfoEv
 __ZNK7WebCore30JSHTMLOptGroupElementPrototype9classInfoEv
+__ZN7WebCore32jsHTMLOptGroupElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore28JSHTMLOptionElementPrototype9classInfoEv
+__ZN7WebCore30jsHTMLOptionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore31JSHTMLParagraphElementPrototype9classInfoEv
 __ZNK7WebCore27JSHTMLParamElementPrototype9classInfoEv
-__ZNK7WebCore18JSHTMLQuoteElement9classInfoEv
+__ZN7WebCore29jsHTMLParamElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore27JSHTMLQuoteElementPrototype9classInfoEv
+__ZN7WebCore29jsHTMLQuoteElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore28JSHTMLScriptElementPrototype9classInfoEv
 __ZNK7WebCore27JSHTMLStyleElementPrototype9classInfoEv
+__ZN7WebCore29jsHTMLStyleElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore27JSHTMLTableElementPrototype9classInfoEv
 __ZNK7WebCore34JSHTMLTableSectionElementPrototype9classInfoEv
+__ZN7WebCore36jsHTMLTableSectionElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore31JSHTMLTableCellElementPrototype9classInfoEv
+__ZN7WebCore33jsHTMLTableCellElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore30JSHTMLTextAreaElementPrototype9classInfoEv
+__ZN7WebCore32jsHTMLTextAreaElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore27JSHTMLTitleElementPrototype9classInfoEv
+__ZN7WebCore29jsHTMLTitleElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore30JSHTMLTableRowElementPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore18JSCSSRulePrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSCSSRulePrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore19JSCSSValuePrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSCSSValuePrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore21JSCSSValueConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSCSSValueConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore12JSNodeFilter18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore21JSNodeFilterPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSNodeFilterPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore10MediaQuery7cssTextEv
-__ZNK7WebCore13CSSImportRule7cssTextEv
-__ZNK7WebCore12CSSMediaRule7cssTextEv
-__ZN7WebCore13OverflowEventD1Ev
-__ZN7WebCore17HTMLKeygenElementD1Ev
-__ZN7WebCore39jsElementPrototypeFunctionScrollByLinesEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Element13scrollByLinesEi
-__ZN7WebCore7Element13scrollByUnitsEiNS_17ScrollGranularityE
-__ZN7WebCore39jsElementPrototypeFunctionScrollByPagesEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Element13scrollByPagesEi
-__ZN7WebCore15HTMLBodyElement13setScrollLeftEi
-__ZN7WebCore49jsKeyboardEventPrototypeFunctionInitKeyboardEventEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore13KeyboardEvent17initKeyboardEventERKNS_12AtomicStringEbbPNS_9DOMWindowERKNS_6StringEjbbbbb
-__ZN7WebCore20JSMediaListPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore32jsMediaListPrototypeFunctionItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9MediaList4itemEj
-__ZN7WebCore13ProgressEventC1Ev
-__ZN7WebCore24JSProgressEventPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore49jsProgressEventPrototypeFunctionInitProgressEventEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore15JSProgressEvent9classInfoEv
-__ZN7WebCore13ProgressEvent17initProgressEventERKNS_12AtomicStringEbbbjj
-__ZN7WebCore36jsRangePrototypeFunctionComparePointEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore38jsRangePrototypeFunctionIsPointInRangeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore5Range14isPointInRangeEPNS_4NodeEiRi
-__ZN7WebCore34jsDOMWindowPrototypeFunctionMoveByEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9DOMWindow6moveByEff
-__ZN7WebCore36jsDOMWindowPrototypeFunctionResizeByEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore9DOMWindow8resizeByEff
-__ZN7WebCore16JSHTMLCollection16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore17JSHTMLFormElement16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore19JSHTMLSelectElement16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore16JSStyleSheetList16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore13JSCSSRuleList16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore21JSCSSStyleDeclaration16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore14JSCSSValueList16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZNK7WebCore19JSCSSValuePrototype9classInfoEv
-__ZN7WebCore14JSCSSValueList11indexGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN7WebCore11JSMediaList16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore11JSMediaList11indexGetterEPN3KJS9ExecStateEPNS1_8JSObjectERKNS1_10IdentifierERKNS1_12PropertySlotE
-__ZN3KJS19windowProtoFuncAToBEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore12base64DecodeERKN3WTF6VectorIcLm0EEERS2_
-__ZN7WebCore12base64DecodeEPKcjRN3WTF6VectorIcLm0EEE
-__ZN3KJS19windowProtoFuncBToAEPNS_9ExecStateEPNS_8JSObjectERKNS_4ListE
-__ZN7WebCore12base64EncodeERKN3WTF6VectorIcLm0EEERS2_b
-__ZN7WebCore35jsDOMWindowPrototypeFunctionConfirmEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore32jsHTMLTableRowElementConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore27JSHTMLUListElementPrototype9classInfoEv
+__ZThn8_N7WebCore18HTMLMarqueeElementD0Ev
+__ZThn8_N7WebCore17HTMLKeygenElementD0Ev
+__ZN7WebCore17HTMLKeygenElementD0Ev
+__ZN7WebCore23JSTreeWalkerConstructorD1Ev
+__ZN7WebCore25JSNodeIteratorConstructorD1Ev
+__ZN7WebCore28JSXPathExpressionConstructorD1Ev
+__ZN7WebCore14XMLHttpRequest12networkErrorEv
+__ZN7WebCore14XMLHttpRequest18dispatchErrorEventEv
+__ZN7WebCore41jsEventExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSEventException9classInfoEv
+__ZNK7WebCore25JSEventExceptionPrototype9classInfoEv
+__ZN7WebCore27jsEventExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore42jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsRangePrototypeFunctionSetStartAfterEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14RangeExceptionE
+__ZN7WebCore16JSRangeExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14RangeExceptionEEE
+__ZN7WebCore16JSRangeExceptionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14RangeExceptionEEE
+__ZN7WebCore16JSRangeException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSRangeExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore41jsRangeExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSRangeException9classInfoEv
+__ZNK7WebCore25JSRangeExceptionPrototype9classInfoEv
+__ZN7WebCore27jsRangeExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsRangeExceptionINVALID_NODE_TYPE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsRangeExceptionBAD_BOUNDARYPOINTS_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore49jsXPathEvaluatorPrototypeFunctionCreateNSResolverEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore41jsXPathExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSXPathException9classInfoEv
+__ZNK7WebCore25JSXPathExceptionPrototype9classInfoEv
+__ZN7WebCore27jsXPathExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsXPathExceptionTYPE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsXPathExceptionINVALID_EXPRESSION_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSRangeExceptionD1Ev
+__ZN7WebCore16JSRangeExceptionD2Ev
+__ZNK7WebCore27JSDOMCoreExceptionPrototype9classInfoEv
+__ZN7WebCore29jsDOMCoreExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsDOMCoreExceptionHIERARCHY_REQUEST_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsDOMCoreExceptionINVALID_CHARACTER_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsDOMCoreExceptionNAMESPACE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsElementPrototypeFunctionHasAttributeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore45jsNamedNodeMapPrototypeFunctionGetNamedItemNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore12NamedNodeMap14getNamedItemNSERKNS_6StringES3_
+__ZN7WebCore43jsElementPrototypeFunctionRemoveAttributeNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element17removeAttributeNSERKNS_6StringES3_Ri
+__ZN7WebCore48jsNamedNodeMapPrototypeFunctionRemoveNamedItemNSEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12NamedNodeMap17removeNamedItemNSERKNS_6StringES3_Ri
+__ZN7WebCore4Node9setPrefixERKNS_12AtomicStringERi
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_5FrameE
+__ZNK7WebCore14RenderFrameSet10renderNameEv
+__ZNK7WebCore11RenderFrame10renderNameEv
+__ZN7WebCore39jsHTMLDocumentPrototypeFunctionHasFocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12HTMLDocument8hasFocusEv
+__ZN7WebCore33jsHTMLTextAreaElementSelectionEndEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19HTMLTextAreaElement12selectionEndEv
+__ZN7WebCore15HTMLFormElement26willMoveToNewOwnerDocumentEv
+__ZN7WebCore15HTMLFormElement25didMoveToNewOwnerDocumentEv
+__ZN7WebCore31jsHTMLImageElementNaturalHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLImageElement13naturalHeightEv
+__ZN7WebCore22JSNamedNodesCollection12lengthGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore23resetButtonDefaultLabelEv
+__ZN7WebCore41jsHTMLButtonElementPrototypeFunctionClickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCoreL14isSVG10FeatureERKNS_6StringE
+__ZN7WebCore19jsNodeOncontextmenuEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node13oncontextmenuEv
+__ZNK7WebCore22JSNamedNodesCollection9classInfoEv
+__ZN7WebCore17HTMLSelectElement17saveLastSelectionEv
+__ZN7WebCore17HTMLSelectElement16menuListOnChangeEv
+__ZN7WebCore32setJSHTMLTableCellElementColSpanEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement10setColSpanEi
+__ZN7WebCore33setJSDOMWindowNodeListConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40jsRangePrototypeFunctionSurroundContentsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore5Range16surroundContentsEN3WTF10PassRefPtrINS_4NodeEEERi
+__ZNK7WebCore13CharacterData19isCharacterDataNodeEv
+__ZN7WebCore20jsRangeExceptionCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsDOMCoreExceptionWRONG_DOCUMENT_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsRangePrototypeFunctionDetachEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore5Range6detachERi
+__ZN7WebCore35jsDOMCoreExceptionINVALID_STATE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsRangeSTART_TO_STARTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore45jsRangePrototypeFunctionCompareBoundaryPointsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19jsRangeSTART_TO_ENDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsRangeEND_TO_STARTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17jsRangeEND_TO_ENDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore5Range15textNodesMergedERNS_13NodeWithIndexEj
+__ZN7WebCore35jsRangePrototypeFunctionCompareNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore31jsDOMCoreExceptionNOT_FOUND_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore7Comment16childTypeAllowedENS_4Node8NodeTypeE
+__ZN7WebCore16jsRangeCollapsedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsRangeCommonAncestorContainerEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsRangePrototypeFunctionIntersectsNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore21ProcessingInstruction18offsetInCharactersEv
+__ZN7WebCore21ProcessingInstruction9cloneNodeEb
+__ZN7WebCore51jsDocumentFragmentPrototypeFunctionQuerySelectorAllEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore48jsDocumentFragmentPrototypeFunctionQuerySelectorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore17decodeNamedEntityEPKc
+__ZN7WebCoreL17sharedXHTMLEntityEv
+__ZN7WebCore28jsDOMCoreExceptionSYNTAX_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL27createSVGDescElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGDescElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGDescElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGDescElementEEE
+__ZN7WebCore16JSSVGDescElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGDescElementEEE
+__ZN7WebCore16JSSVGDescElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL29createSVGCircleElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore18JSSVGCircleElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGCircleElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGCircleElementEEE
+__ZN7WebCore18JSSVGCircleElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGCircleElementEEE
+__ZN7WebCore18JSSVGCircleElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25jsDOMCoreExceptionMessageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18JSSVGCircleElementD1Ev
+__ZN7WebCore16JSSVGDescElementD1Ev
+__ZN7WebCore27JSSVGCircleElementPrototypeD1Ev
+__ZN7WebCore25JSSVGDescElementPrototypeD1Ev
+__ZN7WebCore22jsHTMLLinkElementSheetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsStyleSheetOwnerNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsTreeWalkerCurrentNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSTreeWalkerPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsTreeWalkerPrototypeFunctionParentNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSTreeWalker10parentNodeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10TreeWalker10parentNodeEPN3JSC9ExecStateE
+__ZN7WebCore12JSTreeWalker3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore26setJSTreeWalkerCurrentNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10TreeWalker14setCurrentNodeEN3WTF10PassRefPtrINS_4NodeEEERi
+__ZN7WebCore37jsTreeWalkerPrototypeFunctionNextNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSTreeWalker8nextNodeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10TreeWalker8nextNodeEPN3JSC9ExecStateE
+__ZNK7WebCore10NodeFilter10acceptNodeEPN3JSC9ExecStateEPNS_4NodeE
+__ZNK7WebCore21JSNodeFilterCondition10acceptNodeEPN3JSC9ExecStateEPNS_4NodeE
+__ZN7WebCore41jsTreeWalkerPrototypeFunctionPreviousNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSTreeWalker12previousNodeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10TreeWalker12previousNodeEPN3JSC9ExecStateE
+__ZN7WebCore39jsTreeWalkerPrototypeFunctionFirstChildEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSTreeWalker10firstChildEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10TreeWalker10firstChildEPN3JSC9ExecStateE
+__ZN7WebCore38jsTreeWalkerPrototypeFunctionLastChildEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSTreeWalker9lastChildEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10TreeWalker9lastChildEPN3JSC9ExecStateE
+__ZN7WebCore40jsTreeWalkerPrototypeFunctionNextSiblingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSTreeWalker11nextSiblingEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10TreeWalker11nextSiblingEPN3JSC9ExecStateE
+__ZN7WebCore44jsTreeWalkerPrototypeFunctionPreviousSiblingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12JSTreeWalker15previousSiblingEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10TreeWalker15previousSiblingEPN3JSC9ExecStateE
+__ZN7WebCore35jsDOMWindowPrototypeFunctionConfirmEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore9DOMWindow7confirmERKNS_6StringE
 __ZN7WebCore6Chrome20runJavaScriptConfirmEPNS_5FrameERKNS_6StringE
-__ZNK7WebCore6Screen9availLeftEv
-__ZNK7WebCore6Screen8availTopEv
-__ZN7WebCore30jsConsolePrototypeFunctionWarnEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Console4warnERKNS_6StringE
-__ZNK7WebCore14StaticNodeList12itemWithNameERKNS_12AtomicStringE
-__ZNK7WebCore14StaticNodeList4itemEj
-__ZN7WebCore42jsElementPrototypeFunctionQuerySelectorAllEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore40jsDocumentPrototypeFunctionQuerySelectorEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore4Node13querySelectorERKNS_6StringERi
-__ZN7WebCore39jsElementPrototypeFunctionQuerySelectorEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZN7WebCore34jsDOMWindowPrototypeFunctionPromptEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow6promptERKNS_6StringES3_
+__ZN7WebCore6Chrome19runJavaScriptPromptEPNS_5FrameERKNS_6StringES5_RS3_
+__ZN7WebCore32jsDOMWindowPrototypeFunctionAtobEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSDOMWindow4atobEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore32jsDOMWindowPrototypeFunctionBtoaEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSDOMWindow4btoaEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore30jsConsolePrototypeFunctionInfoEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console4infoEPNS_15ScriptCallStackE
+__ZN7WebCore30jsConsolePrototypeFunctionWarnEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console4warnEPNS_15ScriptCallStackE
+__ZN7WebCore31jsConsolePrototypeFunctionErrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console5errorEPNS_15ScriptCallStackE
+__ZN7WebCore31jsConsolePrototypeFunctionTraceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console5traceEPNS_15ScriptCallStackE
+__ZN7WebCore24JSWebKitPointConstructor16getConstructDataERN3JSC13ConstructDataE
+__ZN7WebCoreL20constructWebKitPointEPN3JSC9ExecStateEPNS0_8JSObjectERKNS0_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_11WebKitPointE
+__ZN7WebCore13JSWebKitPointC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11WebKitPointEEE
+__ZN7WebCore13JSWebKitPointC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11WebKitPointEEE
+__ZNK7WebCore13JSWebKitPoint9classInfoEv
+__ZN7WebCore26JSWebKitCSSMatrixPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsWebKitCSSMatrixPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore17JSWebKitCSSMatrix9classInfoEv
+__ZNK7WebCore15WebKitCSSMatrix8toStringEv
+__ZN7WebCore13JSWebKitPointD1Ev
+__ZN7WebCore13JSWebKitPointD2Ev
+__ZN7WebCore41jsDOMWindowPrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore29setJSDOMWindowAttrConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowCDATASectionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowCSSPrimitiveValueConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSDOMWindowCSSRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowCSSStyleDeclarationConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore33setJSDOMWindowCSSValueConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowCharacterDataConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSDOMWindowCommentConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowDOMExceptionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowDOMImplementationConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowDocumentFragmentConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowDocumentTypeConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore31setJSDOMWindowEntityConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowEntityReferenceConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLAnchorElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLAppletElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLAreaElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowHTMLBRElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLBaseElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowHTMLBaseFontElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLBodyElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLButtonElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLCanvasElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLDListElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore45setJSDOMWindowHTMLDirectoryElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowHTMLDivElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowHTMLDocumentConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore36setJSDOMWindowHTMLElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowHTMLFieldSetElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLFontElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLFormElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLFrameElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowHTMLFrameSetElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowHTMLHRElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLHeadElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore43setJSDOMWindowHTMLHeadingElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLHtmlElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLIFrameElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLImageElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLInputElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore43setJSDOMWindowHTMLIsIndexElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowHTMLLIElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLLabelElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLLegendElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLLinkElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowHTMLMapElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore43setJSDOMWindowHTMLMarqueeElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLMenuElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowHTMLMetaElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowHTMLModElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLOListElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowHTMLOptGroupElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLOptionElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore45setJSDOMWindowHTMLParagraphElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLParamElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowHTMLPreElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLQuoteElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLScriptElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLSelectElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLStyleElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore48setJSDOMWindowHTMLTableCaptionElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore45setJSDOMWindowHTMLTableCellElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowHTMLTableColElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLTableElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowHTMLTableRowElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore48setJSDOMWindowHTMLTableSectionElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44setJSDOMWindowHTMLTextAreaElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLTitleElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLUListElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowMutationEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore35setJSDOMWindowNodeFilterConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore33setJSDOMWindowNotationConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore46setJSDOMWindowProcessingInstructionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowRangeExceptionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore36setJSDOMWindowXMLDocumentConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowXPathEvaluatorConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore36setJSDOMWindowXPathResultConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore31setJSDOMWindowClientInformationEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore30setJSDOMWindowDevicePixelRatioEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20setJSDOMWindowFramesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSDOMWindowInnerHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSDOMWindowInnerWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20setJSDOMWindowLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSDOMWindowLocationbarEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21setJSDOMWindowMenubarEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23setJSDOMWindowNavigatorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSDOMWindowOffscreenBufferingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20setJSDOMWindowOpenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSDOMWindowOuterHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSDOMWindowOuterWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25setJSDOMWindowPersonalbarEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSDOMWindowScreenLeftEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23setJSDOMWindowScreenTopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21setJSDOMWindowScreenXEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21setJSDOMWindowScreenYEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21setJSDOMWindowScrollYEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24setJSDOMWindowScrollbarsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore23setJSDOMWindowStatusbarEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21setJSDOMWindowToolbarEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore27setJSDOMWindowDefaultStatusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow16setDefaultStatusERKNS_6StringE
+__ZN7WebCore27setJSDOMWindowDefaultstatusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21setJSDOMWindowOnabortEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow10setOnabortEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore22setJSDOMWindowOnchangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow11setOnchangeEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore24setJSDOMWindowOndblclickEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow13setOndblclickEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore21setJSDOMWindowOnfocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow10setOnfocusEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore24setJSDOMWindowOnkeypressEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow13setOnkeypressEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore21setJSDOMWindowOnkeyupEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow10setOnkeyupEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore25setJSDOMWindowOnmousedownEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow14setOnmousedownEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore25setJSDOMWindowOnmousemoveEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow14setOnmousemoveEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore24setJSDOMWindowOnmouseoutEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow13setOnmouseoutEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore25setJSDOMWindowOnmouseoverEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow14setOnmouseoverEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore23setJSDOMWindowOnmouseupEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow12setOnmouseupEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore21setJSDOMWindowOnresetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow10setOnresetEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore22setJSDOMWindowOnsearchEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow11setOnsearchEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore22setJSDOMWindowOnselectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow11setOnselectEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore22setJSDOMWindowOnsubmitEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow11setOnsubmitEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZNK7WebCore6Chrome17scrollbarsVisibleEv
+__ZNK7WebCore6Chrome15toolbarsVisibleEv
+__ZNK7WebCore6Chrome14menubarVisibleEv
+__ZN7WebCore60jsDOMWindowPrototypeFunctionWebkitConvertPointFromNodeToPageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7
+__ZN7WebCore13toWebKitPointEN3JSC7JSValueE
+__ZNK7WebCore9DOMWindow32webkitConvertPointFromNodeToPageEPNS_4NodeEPKNS_11WebKitPointE
+__ZNK7WebCore4Node13convertToPageERKNS_10FloatPointE
+__ZN7WebCore13JSWebKitPoint18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore14jsWebKitPointXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14jsWebKitPointYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore60jsDOMWindowPrototypeFunctionWebkitConvertPointFromPageToNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7
+__ZNK7WebCore9DOMWindow32webkitConvertPointFromPageToNodeEPNS_4NodeEPKNS_11WebKitPointE
+__ZNK7WebCore4Node15convertFromPageERKNS_10FloatPointE
+__ZN7WebCore9JSHistory16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZN7WebCore9JSHistory22customGetPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore18JSHistoryPrototype9classInfoEv
+__ZNK7WebCore18JSBarInfoPrototype9classInfoEv
+__ZNK7WebCore17JSScreenPrototype9classInfoEv
+__ZN7WebCoreL32min_device_widthMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore39setJSDOMWindowCSSCharsetRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore40setJSDOMWindowCSSFontFaceRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowCSSImportRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowCSSMediaRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore36setJSDOMWindowCSSPageRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore36setJSDOMWindowCSSRuleListConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowCSSStyleRuleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowCSSStyleSheetConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowCSSValueListConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSDOMWindowCounterConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowEventExceptionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore46setJSDOMWindowHTMLBlockquoteElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowHTMLEmbedElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42setJSDOMWindowHTMLObjectElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowKeyboardEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore34setJSDOMWindowMediaListConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore35setJSDOMWindowMouseEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowNamedNodeMapConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowOverflowEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore38setJSDOMWindowProgressEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore29setJSDOMWindowRectConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore33setJSDOMWindowSVGAngleConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore33setJSDOMWindowSVGColorConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowSVGExceptionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore43setJSDOMWindowSVGGradientElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore34setJSDOMWindowSVGLengthConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore41setJSDOMWindowSVGMarkerElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore33setJSDOMWindowSVGPaintConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore35setJSDOMWindowSVGPathSegConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore47setJSDOMWindowSVGPreserveAspectRatioConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore43setJSDOMWindowSVGRenderingIntentConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore46setJSDOMWindowSVGTextContentElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore43setJSDOMWindowSVGTextPathElementConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowSVGTransformConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMWindowSVGUnitTypesConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore35setJSDOMWindowStyleSheetConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowStyleSheetListConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore34setJSDOMWindowTextEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSDOMWindowUIEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore35setJSDOMWindowWheelEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore48setJSDOMWindowXMLHttpRequestExceptionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore39setJSDOMWindowXPathExceptionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore13toMessagePortEN3JSC7JSValueE
+__ZNK7WebCore27JSHTMLAudioElementPrototype9classInfoEv
+__ZNK7WebCore27JSHTMLMediaElementPrototype9classInfoEv
+__ZN7WebCore35jsHTMLMediaElementHAVE_CURRENT_DATAEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsHTMLMediaElementHAVE_ENOUGH_DATAEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsHTMLMediaElementHAVE_FUTURE_DATAEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsHTMLMediaElementHAVE_METADATAEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLMediaElementHAVE_NOTHINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsHTMLMediaElementNETWORK_EMPTYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsHTMLMediaElementNETWORK_IDLEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsHTMLMediaElementNETWORK_LOADEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsHTMLMediaElementNETWORK_LOADINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsHTMLMediaElementNETWORK_NO_SOURCEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore24JSCharacterDataPrototype9classInfoEv
 __ZNK7WebCore25JSCSSCharsetRulePrototype9classInfoEv
+__ZNK7WebCore18JSCSSRulePrototype9classInfoEv
+__ZN7WebCore23jsCSSRuleVARIABLES_RULEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore26JSCSSFontFaceRulePrototype9classInfoEv
 __ZNK7WebCore24JSCSSImportRulePrototype9classInfoEv
 __ZNK7WebCore23JSCSSMediaRulePrototype9classInfoEv
 __ZNK7WebCore22JSCSSPageRulePrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore28JSCSSPrimitiveValuePrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore28JSCSSPrimitiveValuePrototype16getValuePropertyEPN3KJS9ExecStateEi
+__ZN7WebCore27jsCSSPrimitiveValueCSS_ATTREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsCSSPrimitiveValueCSS_CMEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsCSSPrimitiveValueCSS_COUNTEREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsCSSPrimitiveValueCSS_DEGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsCSSPrimitiveValueCSS_DIMENSIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsCSSPrimitiveValueCSS_EMSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsCSSPrimitiveValueCSS_EXSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsCSSPrimitiveValueCSS_GRADEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsCSSPrimitiveValueCSS_HZEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsCSSPrimitiveValueCSS_IDENTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsCSSPrimitiveValueCSS_INEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsCSSPrimitiveValueCSS_KHZEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsCSSPrimitiveValueCSS_MMEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsCSSPrimitiveValueCSS_MSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsCSSPrimitiveValueCSS_PCEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsCSSPrimitiveValueCSS_PERCENTAGEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsCSSPrimitiveValueCSS_PTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsCSSPrimitiveValueCSS_RADEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsCSSPrimitiveValueCSS_SEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsCSSPrimitiveValueCSS_URIEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore21JSStyleSheetPrototype9classInfoEv
-__ZNK7WebCore27JSDOMCoreExceptionPrototype9classInfoEv
+__ZN7WebCore34JSCSSVariablesDeclarationPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore34JSCSSVariablesDeclarationPrototype9classInfoEv
+__ZNK7WebCore35JSCanvasRenderingContext2DPrototype9classInfoEv
+__ZNK7WebCore21JSClientRectPrototype9classInfoEv
+__ZN7WebCore25JSClientRectListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSClientRectListPrototype9classInfoEv
+__ZNK7WebCore20JSClipboardPrototype9classInfoEv
+__ZN7WebCore27jsDOMCoreExceptionABORT_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsDOMCoreExceptionDOMSTRING_SIZE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsDOMCoreExceptionINUSE_ATTRIBUTE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsDOMCoreExceptionINVALID_ACCESS_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore42jsDOMCoreExceptionINVALID_MODIFICATION_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsDOMCoreExceptionNETWORK_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsDOMCoreExceptionNOT_SUPPORTED_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsDOMCoreExceptionNO_DATA_ALLOWED_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore45jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsDOMCoreExceptionQUOTA_EXCEEDED_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsDOMCoreExceptionSECURITY_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsDOMCoreExceptionTYPE_MISMATCH_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsDOMCoreExceptionURL_MISMATCH_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsDOMCoreExceptionVALIDATION_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore20JSDOMParserPrototype9classInfoEv
+__ZN7WebCore24JSDOMStringListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore24JSDOMStringListPrototype9classInfoEv
 __ZNK7WebCore23JSDocumentTypePrototype9classInfoEv
 __ZNK7WebCore17JSEntityPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore27JSEventExceptionConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore27JSEventExceptionConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore25JSEventExceptionPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore25JSEventExceptionPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore25JSEventExceptionPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore21JSMediaErrorPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore15JSFilePrototype9classInfoEv
+__ZN7WebCore19JSFileListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSFileListPrototype9classInfoEv
+__ZN7WebCore27JSHTMLFrameElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29JSHTMLMarqueeElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29jsMediaErrorMEDIA_ERR_ABORTEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsMediaErrorMEDIA_ERR_DECODEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsMediaErrorMEDIA_ERR_NETWORKEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsMediaErrorMEDIA_ERR_SRC_NOT_SUPPORTEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSMediaErrorPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore21JSMediaErrorPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore21JSMediaErrorPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSMediaErrorPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore23JSMessageEventPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore26JSMutationEventConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore26JSMutationEventConstructor16getValuePropertyEPN3KJS9ExecStateEi
+__ZNK7WebCore19JSMimeTypePrototype9classInfoEv
+__ZNK7WebCore24JSMimeTypeArrayPrototype9classInfoEv
+__ZN7WebCore23jsMutationEventADDITIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsMutationEventMODIFICATIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsMutationEventREMOVALEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore21JSNodeFilterPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore26JSOverflowEventConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore26JSOverflowEventConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore24JSOverflowEventPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore18JSRangeConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore18JSRangeConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore27JSRangeExceptionConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore27JSRangeExceptionConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore25JSRangeExceptionPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore21JSSVGAngleConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSSVGAngleConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore19JSSVGAnglePrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19jsOverflowEventBOTHEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsOverflowEventHORIZONTALEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsOverflowEventVERTICALEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24JSOverflowEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17JSPluginPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSPluginPrototype9classInfoEv
+__ZNK7WebCore22JSPluginArrayPrototype9classInfoEv
+__ZN7WebCore17jsRangeNODE_AFTEREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsRangeNODE_BEFOREEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsRangeNODE_BEFORE_AND_AFTEREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18jsRangeNODE_INSIDEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGAngleSVG_ANGLETYPE_DEGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGAngleSVG_ANGLETYPE_GRADEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGAngleSVG_ANGLETYPE_RADEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsSVGAngleSVG_ANGLETYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGAngleSVG_ANGLETYPE_UNSPECIFIEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSSVGAnglePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore19JSSVGAnglePrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore19JSSVGAnglePrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore19JSSVGAnglePrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore21JSSVGColorConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSSVGColorConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore19JSSVGColorPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore25JSSVGExceptionConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore25JSSVGExceptionConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore23JSSVGExceptionPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore36jsSVGColorSVG_COLORTYPE_CURRENTCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsSVGColorSVG_COLORTYPE_RGBCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGColorSVG_COLORTYPE_RGBCOLOR_ICCCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsSVGColorSVG_COLORTYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSSVGColorPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore35jsSVGExceptionSVG_INVALID_VALUE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsSVGExceptionSVG_MATRIX_NOT_INVERTABLEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsSVGExceptionSVG_WRONG_TYPE_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSSVGExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore23JSSVGExceptionPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore23JSSVGExceptionPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore23JSSVGExceptionPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore31JSSVGGradientElementConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore31JSSVGGradientElementConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore29JSSVGGradientElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN7WebCore20JSSVGLengthPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore40jsSVGGradientElementSVG_SPREADMETHOD_PADEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore44jsSVGGradientElementSVG_SPREADMETHOD_REFLECTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore43jsSVGGradientElementSVG_SPREADMETHOD_REPEATEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore44jsSVGGradientElementSVG_SPREADMETHOD_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSSVGGradientElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_CMEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGLengthSVG_LENGTHTYPE_EMSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGLengthSVG_LENGTHTYPE_EXSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_INEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_MMEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsSVGLengthSVG_LENGTHTYPE_NUMBEREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_PCEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsSVGLengthSVG_LENGTHTYPE_PERCENTAGEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_PTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGLengthSVG_LENGTHTYPE_PXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGLengthSVG_LENGTHTYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSSVGLengthPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore20JSSVGLengthPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore20JSSVGLengthPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore20JSSVGLengthPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore29JSSVGMarkerElementConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore29JSSVGMarkerElementConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore27JSSVGMarkerElementPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore21JSSVGPaintConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSSVGPaintConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore19JSSVGPaintPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZN3KJS17staticValueGetterIN7WebCore23JSSVGPathSegConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore23JSSVGPathSegConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore21JSSVGPathSegPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore45jsSVGMarkerElementSVG_MARKERUNITS_STROKEWIDTHEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGMarkerElementSVG_MARKERUNITS_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore48jsSVGMarkerElementSVG_MARKERUNITS_USERSPACEONUSEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGMarkerElementSVG_MARKER_ORIENT_ANGLEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsSVGMarkerElementSVG_MARKER_ORIENT_AUTOEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore43jsSVGMarkerElementSVG_MARKER_ORIENT_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27JSSVGMarkerElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore36jsSVGPaintSVG_PAINTTYPE_CURRENTCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGPaintSVG_PAINTTYPE_NONEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsSVGPaintSVG_PAINTTYPE_RGBCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGPaintSVG_PAINTTYPE_RGBCOLOR_ICCCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsSVGPaintSVG_PAINTTYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGPaintSVG_PAINTTYPE_URIEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsSVGPaintSVG_PAINTTYPE_URI_CURRENTCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsSVGPaintSVG_PAINTTYPE_URI_NONEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore45jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19JSSVGPaintPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27jsSVGPathSegPATHSEG_ARC_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGPathSegPATHSEG_ARC_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegPATHSEG_CLOSEPATHEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGPathSegPATHSEG_CURVETO_CUBIC_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGPathSegPATHSEG_CURVETO_CUBIC_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore44jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore44jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore48jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore48jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsSVGPathSegPATHSEG_LINETO_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsSVGPathSegPATHSEG_LINETO_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsSVGPathSegPATHSEG_LINETO_VERTICAL_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsSVGPathSegPATHSEG_LINETO_VERTICAL_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsSVGPathSegPATHSEG_MOVETO_ABSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsSVGPathSegPATHSEG_MOVETO_RELEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGPathSegPATHSEG_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSSVGPathSegPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore21JSSVGPathSegPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore21JSSVGPathSegPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore21JSSVGPathSegPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore35JSSVGPreserveAspectRatioConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore35JSSVGPreserveAspectRatioConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore33JSSVGPreserveAspectRatioPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore44jsSVGPreserveAspectRatioSVG_MEETORSLICE_MEETEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore45jsSVGPreserveAspectRatioSVG_MEETORSLICE_SLICEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore47jsSVGPreserveAspectRatioSVG_MEETORSLICE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore52jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_NONEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore55jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMAXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMIDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMINEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMAXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMIDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMINEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMAXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMIDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore56jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMINEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlot
+__ZN7WebCore33JSSVGPreserveAspectRatioPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore33JSSVGPreserveAspectRatioPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore33JSSVGPreserveAspectRatioPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore33JSSVGPreserveAspectRatioPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore31JSSVGRenderingIntentConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore31JSSVGRenderingIntentConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore29JSSVGRenderingIntentPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore58jsSVGRenderingIntentRENDERING_INTENT_ABSOLUTE_COLORIMETRICEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySl
+__ZN7WebCore41jsSVGRenderingIntentRENDERING_INTENT_AUTOEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore47jsSVGRenderingIntentRENDERING_INTENT_PERCEPTUALEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore58jsSVGRenderingIntentRENDERING_INTENT_RELATIVE_COLORIMETRICEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySl
+__ZN7WebCore47jsSVGRenderingIntentRENDERING_INTENT_SATURATIONEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore44jsSVGRenderingIntentRENDERING_INTENT_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSSVGRenderingIntentPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore29JSSVGRenderingIntentPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore29JSSVGRenderingIntentPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore29JSSVGRenderingIntentPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore34JSSVGTextContentElementConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore34JSSVGTextContentElementConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore31JSSVGTextPathElementConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore31JSSVGTextPathElementConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore25JSSVGTransformConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore25JSSVGTransformConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore23JSSVGTransformPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore43jsSVGTextContentElementLENGTHADJUST_SPACINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore52jsSVGTextContentElementLENGTHADJUST_SPACINGANDGLYPHSEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore43jsSVGTextContentElementLENGTHADJUST_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore45jsSVGTextPathElementTEXTPATH_METHODTYPE_ALIGNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore47jsSVGTextPathElementTEXTPATH_METHODTYPE_STRETCHEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore47jsSVGTextPathElementTEXTPATH_METHODTYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore45jsSVGTextPathElementTEXTPATH_SPACINGTYPE_AUTOEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore46jsSVGTextPathElementTEXTPATH_SPACINGTYPE_EXACTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore48jsSVGTextPathElementTEXTPATH_SPACINGTYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSSVGTextPathElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34jsSVGTransformSVG_TRANSFORM_MATRIXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsSVGTransformSVG_TRANSFORM_ROTATEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGTransformSVG_TRANSFORM_SCALEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGTransformSVG_TRANSFORM_SKEWXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGTransformSVG_TRANSFORM_SKEWYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGTransformSVG_TRANSFORM_TRANSLATEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGTransformSVG_TRANSFORM_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSSVGTransformPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore23JSSVGTransformPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore23JSSVGTransformPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore23JSSVGTransformPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore25JSSVGUnitTypesConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore25JSSVGUnitTypesConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore23JSSVGUnitTypesPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore45jsSVGUnitTypesSVG_UNIT_TYPE_OBJECTBOUNDINGBOXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGUnitTypesSVG_UNIT_TYPE_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore42jsSVGUnitTypesSVG_UNIT_TYPE_USERSPACEONUSEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSSVGUnitTypesPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
 __ZNK7WebCore23JSSVGUnitTypesPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore23JSSVGUnitTypesPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore23JSSVGUnitTypesPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore20JSTextEventPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
-__ZNK3KJS25JSXMLHttpRequestPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore36JSXMLHttpRequestExceptionConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore36JSXMLHttpRequestExceptionConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore34JSXMLHttpRequestExceptionPrototype18getOwnPropertySlotEPN3KJS9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSStoragePrototype9classInfoEv
+__ZN7WebCore23JSStorageEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20JSTextEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore22JSTextMetricsPrototype9classInfoEv
+__ZN7WebCore31JSWebKitAnimationEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSWebKitCSSMatrixPrototype9classInfoEv
+__ZN7WebCore35jsWebKitCSSTransformValueCSS_MATRIXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsWebKitCSSTransformValueCSS_MATRIX3DEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsWebKitCSSTransformValueCSS_PERSPECTIVEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsWebKitCSSTransformValueCSS_ROTATEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsWebKitCSSTransformValueCSS_ROTATE3DEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsWebKitCSSTransformValueCSS_ROTATEXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsWebKitCSSTransformValueCSS_ROTATEYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsWebKitCSSTransformValueCSS_ROTATEZEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsWebKitCSSTransformValueCSS_SCALEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsWebKitCSSTransformValueCSS_SCALE3DEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsWebKitCSSTransformValueCSS_SCALEXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsWebKitCSSTransformValueCSS_SCALEYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsWebKitCSSTransformValueCSS_SCALEZEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsWebKitCSSTransformValueCSS_SKEWEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsWebKitCSSTransformValueCSS_SKEWXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsWebKitCSSTransformValueCSS_SKEWYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsWebKitCSSTransformValueCSS_TRANSLATEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsWebKitCSSTransformValueCSS_TRANSLATE3DEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsWebKitCSSTransformValueCSS_TRANSLATEXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsWebKitCSSTransformValueCSS_TRANSLATEYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsWebKitCSSTransformValueCSS_TRANSLATEZEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34JSWebKitCSSTransformValuePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore22JSWebKitPointPrototype9classInfoEv
+__ZN7WebCore32JSWebKitTransitionEventPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17JSWorkerPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSWorkerPrototype9classInfoEv
+__ZNK7WebCore25JSXMLHttpRequestPrototype9classInfoEv
+__ZN7WebCore20jsXMLHttpRequestDONEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsXMLHttpRequestHEADERS_RECEIVEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsXMLHttpRequestLOADINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsXMLHttpRequestOPENEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsXMLHttpRequestUNSENTEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsXMLHttpRequestExceptionABORT_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsXMLHttpRequestExceptionNETWORK_ERREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34JSXMLHttpRequestExceptionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL42getJSXMLHttpRequestExceptionPrototypeTableEPN3JSC9ExecStateE
 __ZNK7WebCore34JSXMLHttpRequestExceptionPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore34JSXMLHttpRequestExceptionPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore34JSXMLHttpRequestExceptionPrototype16getValuePropertyEPN3KJS9ExecStateEi
+__ZN7WebCore31JSXMLHttpRequestUploadPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL39getJSXMLHttpRequestUploadPrototypeTableEPN3JSC9ExecStateE
+__ZNK7WebCore31JSXMLHttpRequestUploadPrototype9classInfoEv
 __ZNK7WebCore24JSXMLSerializerPrototype9classInfoEv
 __ZNK7WebCore25JSXPathEvaluatorPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore27JSXPathExceptionConstructorEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore27JSXPathExceptionConstructor16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore25JSXPathExceptionPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore25JSXPathExceptionPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore25JSXPathExceptionPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZN3KJS17staticValueGetterIN7WebCore22JSXPathResultPrototypeEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore22JSXPathResultPrototype16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK3KJS22XSLTProcessorPrototype9classInfoEv
-__ZNK3KJS9MimeTypes9classInfoEv
-__ZN7WebCore9JSHistory16getPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZN7WebCore9JSHistory22customGetPropertyNamesEPN3KJS9ExecStateERNS1_17PropertyNameArrayE
-__ZNK7WebCore18JSHistoryPrototype9classInfoEv
-__ZNK7WebCore18JSBarInfoPrototype9classInfoEv
-__ZN3KJS17staticValueGetterIN7WebCore9JSBarInfoEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore9JSBarInfo16getValuePropertyEPN3KJS9ExecStateEi
-__ZNK7WebCore7BarInfo7visibleEv
-__ZNK7WebCore6Chrome15toolbarsVisibleEv
-__ZNK7WebCore6Chrome14menubarVisibleEv
-__ZNK7WebCore6Chrome17scrollbarsVisibleEv
-__ZNK7WebCore6Chrome16statusbarVisibleEv
-__ZN7WebCore35jsRangePrototypeFunctionCompareNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore30jsRangePrototypeFunctionDetachEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore5Range6detachERi
-__ZN7WebCore21ProcessingInstruction9cloneNodeEb
-__ZN7WebCore41jsRangeExceptionPrototypeFunctionToStringEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore16JSRangeException9classInfoEv
-__ZN7WebCore7Comment16childTypeAllowedENS_4Node8NodeTypeE
-__ZN7WebCore38jsRangePrototypeFunctionIntersectsNodeEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore5Range14intersectsNodeEPNS_4NodeERi
-__ZNK7WebCore16HTMLImageElement13naturalHeightEv
-__ZN7WebCore16PendingCallbacks20PendingErrorCallback4callEPNS_12XMLTokenizerE
-__ZN7WebCore4Node9setPrefixERKNS_12AtomicStringERi
-__ZN7WebCore40jsElementPrototypeFunctionHasAttributeNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore45jsNamedNodeMapPrototypeFunctionGetNamedItemNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore43jsElementPrototypeFunctionRemoveAttributeNSEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Element17removeAttributeNSERKNS_6StringES3_Ri
-__ZN7WebCore49jsXPathEvaluatorPrototypeFunctionCreateNSResolverEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN3KJS17staticValueGetterIN7WebCore16JSXPathExceptionEEEPNS_7JSValueEPNS_9ExecStateEPNS_8JSObjectERKNS_10IdentifierERKNS_12PropertySlotE
-__ZNK7WebCore16JSXPathException16getValuePropertyEPN3KJS9ExecStateEi
-__ZN7WebCore41jsEventExceptionPrototypeFunctionToStringEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZNK7WebCore16JSEventException9classInfoEv
-__ZN7WebCore47jsElementPrototypeFunctionInsertAdjacentElementEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore7Element21insertAdjacentElementERKNS_6StringEPNS_4NodeERi
+__ZN7WebCore21jsXPathResultANY_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsXPathResultANY_UNORDERED_NODE_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsXPathResultBOOLEAN_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsXPathResultFIRST_ORDERED_NODE_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsXPathResultNUMBER_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsXPathResultORDERED_NODE_ITERATOR_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsXPathResultSTRING_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsXPathResultUNORDERED_NODE_ITERATOR_TYPEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore24JSXSLTProcessorPrototype9classInfoEv
+__ZN7WebCore21JSDOMApplicationCache3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZNK7WebCore30JSDOMApplicationCachePrototype9classInfoEv
+__ZN7WebCore29jsDOMApplicationCacheCHECKINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsDOMApplicationCacheDOWNLOADINGEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsDOMApplicationCacheIDLEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsDOMApplicationCacheOBSOLETEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsDOMApplicationCacheUNCACHEDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsDOMApplicationCacheUPDATEREADYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsDOMApplicationCacheOncachedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsDOMApplicationCacheOncheckingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsDOMApplicationCacheOndownloadingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsDOMApplicationCacheOnerrorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsDOMApplicationCacheOnnoupdateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsDOMApplicationCacheOnobsoleteEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsDOMApplicationCacheOnprogressEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsDOMApplicationCacheOnupdatereadyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsDOMApplicationCacheStatusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19DOMApplicationCache6statusEv
+__ZNK7WebCore19DOMApplicationCache15associatedCacheEv
+__ZNK7WebCore18JSConsolePrototype9classInfoEv
+__ZN7WebCore17jsConsoleProfilesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore9JSConsole8profilesEPN3JSC9ExecStateE
+__ZNK7WebCore14SecurityOrigin5equalEPKS0_
+__ZNK7WebCore23JSDOMSelectionPrototype9classInfoEv
+__ZN7WebCore19JSLocationPrototype12defineGetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectE
+__ZN7WebCore19JSLocationPrototype3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19JSLocationPrototype9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore10JSLocation12defineGetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectE
+__ZN7WebCore12JSSVGElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10SVGElementEEE
+__ZN7WebCore12JSSVGElementD1Ev
+__ZN7WebCoreL20setTableCellsChangedEPNS_4NodeE
+__ZN7WebCore28setJSHTMLTextAreaElementRowsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore19HTMLTextAreaElement7setRowsEi
+__ZN7WebCore23JSCustomXPathNSResolver18lookupNamespaceURIERKNS_6StringE
+__ZN7WebCore51jsHTMLElementPrototypeFunctionInsertAdjacentElementEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11HTMLElement21insertAdjacentElementERKNS_6StringEPNS_7ElementERi
+__ZN7WebCore16HTMLMediaElement19removedFromDocumentEv
+__ZN7WebCoreL17sourceConstructorERKNS_13QualifiedNameEPNS_8DocumentEPNS_15HTMLFormElementEb
+__ZN7WebCore17HTMLSourceElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17HTMLSourceElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL30createHTMLSourceElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_11HTMLElementEEE
+__ZN7WebCore19JSHTMLSourceElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSHTMLSourceElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLSourceElementEEE
+__ZN7WebCore19JSHTMLSourceElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17HTMLSourceElementEEE
+__ZNK7WebCore19JSHTMLSourceElement9classInfoEv
+__ZN7WebCore17HTMLSourceElement20insertedIntoDocumentEv
+__ZN7WebCore19JSHTMLSourceElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZThn8_N7WebCore16HTMLVideoElementD0Ev
+__ZN7WebCore19JSHTMLSourceElementD1Ev
+__ZThn8_N7WebCore17HTMLSourceElementD0Ev
+__ZN7WebCore17HTMLSourceElementD0Ev
+__ZN7WebCore28JSHTMLSourceElementPrototypeD1Ev
+__ZN7WebCore48jsHTMLElementPrototypeFunctionInsertAdjacentTextEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11HTMLElement18insertAdjacentTextERKNS_6StringES3_Ri
 __ZN7WebCore11RenderLayer20updateOverflowStatusEbb
 __ZN7WebCore9FrameView20updateOverflowStatusEbb
 __ZN7WebCore13OverflowEventC1Ebbbb
-__ZN7WebCore22UTF32BigEndianEncodingEv
-__ZN7WebCore25UTF32LittleEndianEncodingEv
+__ZN7WebCore13OverflowEventC2Ebbbb
+__ZNK7WebCore5XPath13FunStartsWith8evaluateEv
+__ZN7WebCoreL17gbkCallbackEscapeEPKvP25UConverterFromUnicodeArgsPKtii24UConverterCallbackReasonP10UErrorCode
+__ZN7WebCoreL12getGbkEscapeEi
+__ZNK7WebCore14CSSCharsetRule7cssTextEv
+__ZN7WebCore24jsCSSCharsetRuleEncodingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSCSSCharsetRule3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore27setJSCSSCharsetRuleEncodingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
 __ZN7WebCore14CSSCharsetRule13isCharsetRuleEv
-__ZN7WebCore17gbkCallbackEscapeEPKvP25UConverterFromUnicodeArgsPKtii24UConverterCallbackReasonP10UErrorCode
-__ZN7WebCore40jsHTMLLabelElementPrototypeFunctionFocusEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore16HTMLLabelElement5focusEb
-__ZN7WebCore49jsMutationEventPrototypeFunctionInitMutationEventEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore13MutationEvent17initMutationEventERKNS_12AtomicStringEbbPNS_4NodeERKNS_6StringES8_S8_t
-__ZNK7WebCore18JSEventConstructor21implementsHasInstanceEv
-__ZNK7WebCore20JSUIEventConstructor21implementsHasInstanceEv
-__ZNK7WebCore26JSKeyboardEventConstructor21implementsHasInstanceEv
-__ZNK7WebCore23JSMouseEventConstructor21implementsHasInstanceEv
-__ZNK7WebCore23JSWheelEventConstructor21implementsHasInstanceEv
-__ZNK7WebCore26JSMutationEventConstructor21implementsHasInstanceEv
-__ZNK7WebCore26JSOverflowEventConstructor21implementsHasInstanceEv
-__ZNK7WebCore26JSProgressEventConstructor21implementsHasInstanceEv
-__ZNK7WebCore22JSTextEventConstructor21implementsHasInstanceEv
+__ZN7WebCore26setJSHTMLImageElementIsMapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement8setIsMapEb
+__ZN7WebCoreL15newTextCodecMacERKNS_12TextEncodingEPKv
+__ZN7WebCore12TextCodecMacC1Ej
+__ZN7WebCore12TextCodecMacC2Ej
+__ZN7WebCore12TextCodecMac6decodeEPKcmbbRb
+__ZNK7WebCore12TextCodecMac18createTECConverterEv
+__ZN7WebCoreL18cachedConverterTECEv
+__ZN7WebCore12TextCodecMac6decodeEPKhiRiPviS3_
+__ZN7WebCore12TextCodecMacD0Ev
+__ZNK7WebCore12TextCodecMac19releaseTECConverterEv
+__ZN7WebCoreL26gbkUrlEscapedEntityCallackEPKvP25UConverterFromUnicodeArgsPKtii24UConverterCallbackReasonP10UErrorCode
+__ZNK7WebCore8Document21getElementByAccessKeyERKNS_6StringE
+__ZN3WTF7HashMapIPN7WebCore10StringImplEPNS1_7ElementENS1_15CaseFoldingHashENS_10HashTraitsIS3_EENS7_IS5_EEE3setERKS3_RKS5_
+__ZN3WTF9HashTableIPN7WebCore10StringImplESt4pairIS3_PNS1_7ElementEENS_18PairFirstExtractorIS7_EENS1_15CaseFoldingHashENS_14Pai
+__ZNK3WTF7HashMapIPN7WebCore10StringImplEPNS1_7ElementENS1_15CaseFoldingHashENS_10HashTraitsIS3_EENS7_IS5_EEE3getERKS3_
+__ZN7WebCore17HTMLAnchorElement15accessKeyActionEb
+__ZN7WebCore22jsKeyboardEventCtrlKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsKeyboardEventAltKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsKeyboardEventMetaKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsKeyboardEventKeyIdentifierEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsKeyboardEventKeyLocationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12EventHandler14scrollOverflowENS_15ScrollDirectionENS_17ScrollGranularityE
+__ZNK7WebCore27RenderTextControlSingleLine10scrollLeftEv
+__ZN7WebCore35setJSHTMLInputElementSelectionStartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18JSHTMLInputElement17setSelectionStartEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore16HTMLInputElement17setSelectionStartEi
+__ZN7WebCore33setJSHTMLInputElementSelectionEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18JSHTMLInputElement15setSelectionEndEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore16HTMLInputElement15setSelectionEndEi
+__ZNK7WebCore11RenderBlock24containsNonZeroBidiLevelEv
+__ZN7WebCore22jsXMLHttpRequestUploadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14XMLHttpRequest6uploadEv
+__ZN7WebCore20XMLHttpRequestUploadC1EPNS_14XMLHttpRequestE
+__ZN7WebCore20XMLHttpRequestUploadC2EPNS_14XMLHttpRequestE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_20XMLHttpRequestUploadE
+__ZN7WebCore22JSXMLHttpRequestUploadC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20XMLHttpRequestUploadEEE
+__ZN7WebCore22JSXMLHttpRequestUploadC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_20XMLHttpRequestUploadEEE
+__ZN7WebCore6WorkerC1ERKNS_6StringEPNS_22ScriptExecutionContextERi
+__ZN7WebCore6WorkerC2ERKNS_6StringEPNS_22ScriptExecutionContextERi
+__ZN7WebCore18WorkerContextProxy6createEPNS_6WorkerE
+__ZN7WebCore20WorkerMessagingProxyC1EPNS_6WorkerE
+__ZN7WebCore20WorkerMessagingProxyC2EPNS_6WorkerE
+__ZNK7WebCore6Worker22scriptExecutionContextEv
+__ZThn88_N7WebCore8Document25refScriptExecutionContextEv
+__ZN7WebCore8Document25refScriptExecutionContextEv
+__ZThn24_N7WebCore6Worker14notifyFinishedEPNS_14CachedResourceE
+__ZN7WebCore6Worker14notifyFinishedEPNS_14CachedResourceE
+__ZThn88_NK7WebCore8Document9userAgentERKNS_4KURLE
+__ZNK7WebCore8Document9userAgentERKNS_4KURLE
+__ZN7WebCore20WorkerMessagingProxy18startWorkerContextERKNS_4KURLERKNS_6StringES6_
+__ZN7WebCore12WorkerThread6createERKNS_4KURLERKNS_6StringES6_PNS_17WorkerObjectProxyE
+__ZN7WebCore12WorkerThreadC1ERKNS_4KURLERKNS_6StringES6_PNS_17WorkerObjectProxyE
+__ZN7WebCore12WorkerThreadC2ERKNS_4KURLERKNS_6StringES6_PNS_17WorkerObjectProxyE
+__ZN7WebCore13WorkerRunLoopC1Ev
+__ZN7WebCore13WorkerRunLoopC2Ev
+__ZN7WebCore23WorkerThreadStartupDataC1ERKNS_4KURLERKNS_6StringES6_
+__ZN7WebCore23WorkerThreadStartupDataC2ERKNS_4KURLERKNS_6StringES6_
+__ZNK7WebCore4KURL4copyEv
+__ZN7WebCore20WorkerMessagingProxy19workerThreadCreatedEN3WTF10PassRefPtrINS_12WorkerThreadEEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore22ScriptExecutionContext4TaskEEELm0EE14shrinkCapacityEm
+__ZN7WebCore12WorkerThread5startEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_6WorkerE
+__ZN7WebCore8JSWorkerC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_6WorkerEEE
+__ZN7WebCore8JSWorkerC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_6WorkerEEE
+__ZN7WebCore46jsXMLHttpRequestPrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore22JSXMLHttpRequestUpload18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL30getJSXMLHttpRequestUploadTableEPN3JSC9ExecStateE
+__ZN7WebCore52jsXMLHttpRequestUploadPrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore22JSXMLHttpRequestUpload9classInfoEv
+__ZN7WebCore20XMLHttpRequestUpload13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
+__ZN7WebCore51jsDOMApplicationCachePrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19DOMApplicationCache13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
+__ZN7WebCore8JSWorker18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore38jsWorkerPrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore8JSWorker9classInfoEv
+__ZN7WebCore6Worker13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
+__ZN7WebCore12WorkerThread17workerThreadStartEPv
+__ZN7WebCore12WorkerThread12workerThreadEv
+__ZN7WebCore13WorkerContextC1ERKNS_4KURLERKNS_6StringEPNS_12WorkerThreadE
+__ZN7WebCore13WorkerContextC2ERKNS_4KURLERKNS_6StringEPNS_12WorkerThreadE
+__ZN7WebCore22WorkerScriptControllerC1EPNS_13WorkerContextE
+__ZN7WebCore22WorkerScriptControllerC2EPNS_13WorkerContextE
+__ZN7WebCore22WorkerScriptController8evaluateERKNS_16ScriptSourceCodeE
+__ZN7WebCore22WorkerScriptController8evaluateERKNS_16ScriptSourceCodeEPNS_11ScriptValueE
+__ZN7WebCore22WorkerScriptController10initScriptEv
+__ZN7WebCore24JSWorkerContextPrototypenwEmPN3JSC12JSGlobalDataE
+__ZN7WebCore15JSWorkerContextC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13WorkerContextEEE
+__ZN7WebCore15JSWorkerContextC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13WorkerContextEEE
+__ZN7WebCore19JSWorkerContextBaseC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13WorkerContextEEE
+__ZN7WebCore17JSDOMGlobalObject21JSDOMGlobalObjectDataC1Ev
+__ZNK3JSC14JSGlobalObject17supportsProfilingEv
+__ZNK7WebCore13WorkerContext18hasPendingActivityEv
+__ZThn8_N7WebCore20WorkerMessagingProxy21reportPendingActivityEb
+__ZN7WebCore20WorkerMessagingProxy21reportPendingActivityEb
+__ZThn88_N7WebCore8Document8postTaskEN3WTF10PassRefPtrINS_22ScriptExecutionContext4TaskEEE
+__ZN7WebCore8Document8postTaskEN3WTF10PassRefPtrINS_22ScriptExecutionContext4TaskEEE
+__ZN7WebCore13WorkerRunLoop3runEPNS_13WorkerContextE
+__ZN7WebCore17WorkerSharedTimer16setFiredFunctionEPFvvE
+__ZN7WebCore17WorkerSharedTimer4stopEv
+__ZN7WebCore13WorkerRunLoop11defaultModeEv
+__ZN7WebCore13WorkerRunLoop9runInModeEPNS_13WorkerContextERKNS_13ModePredicateE
+__ZN7WebCoreL11performTaskEPv
+__ZN7WebCore30WorkerThreadActivityReportTask11performTaskEPNS_22ScriptExecutionContextE
+__ZN7WebCore20WorkerMessagingProxy29reportPendingActivityInternalEbb
+__ZN7WebCore30WorkerThreadActivityReportTaskD0Ev
+__ZN7WebCore22ScriptExecutionContext4TaskD2Ev
+__ZNK7WebCore6Worker18hasPendingActivityEv
+__ZNK7WebCore20WorkerMessagingProxy18hasPendingActivityEv
+__ZN7WebCore22JSXMLHttpRequestUpload4markEv
+__ZN7WebCore8JSWorker4markEv
+__ZNK7WebCore6Worker10canSuspendEv
+__ZN7WebCore6Worker4stopEv
+__ZN7WebCore6Worker9terminateEv
+__ZN7WebCore20WorkerMessagingProxy22terminateWorkerContextEv
+__ZN7WebCore12WorkerThread4stopEv
+__ZN7WebCore22WorkerScriptController15forbidExecutionEv
+__ZN7WebCore13WorkerRunLoop9terminateEv
+__ZN7WebCore22WorkerScriptControllerD1Ev
+__ZN7WebCore22WorkerScriptControllerD2Ev
+__ZN7WebCore24JSWorkerContextPrototypeD1Ev
+__ZN7WebCore15JSWorkerContextD1Ev
+__ZN7WebCore19JSWorkerContextBaseD2Ev
+__ZN7WebCore17JSDOMGlobalObject21JSDOMGlobalObjectDataD0Ev
+__ZN7WebCore13WorkerContextD0Ev
+__ZThn8_N7WebCore20WorkerMessagingProxy22workerContextDestroyedEv
+__ZN7WebCore20WorkerMessagingProxy22workerContextDestroyedEv
+__ZN3WTF14ThreadSpecificIN7WebCore16ThreadGlobalDataEE7destroyEPv
+__ZN7WebCore16ThreadGlobalDataD1Ev
+__ZN7WebCore16ThreadGlobalDataD2Ev
+__ZN7WebCore19ICUConverterWrapperD1Ev
+__ZN7WebCore19ICUConverterWrapperD2Ev
+__ZN7WebCore10EventNamesD2Ev
+__ZN7WebCore26WorkerContextDestroyedTask11performTaskEPNS_22ScriptExecutionContextE
+__ZN7WebCore20WorkerMessagingProxy30workerContextDestroyedInternalEv
+__ZN7WebCore12WorkerThreadD1Ev
+__ZN7WebCore12WorkerThreadD2Ev
+__ZN7WebCore13WorkerRunLoopD1Ev
+__ZN7WebCore13WorkerRunLoopD2Ev
+__ZN7WebCore17WorkerSharedTimerD0Ev
+__ZN7WebCore26WorkerContextDestroyedTaskD0Ev
+__ZN7WebCore8JSWorkerD1Ev
+__ZN7WebCore8JSWorkerD2Ev
+__ZN7WebCore6WorkerD0Ev
+__ZN7WebCore20WorkerMessagingProxy21workerObjectDestroyedEv
+__ZN7WebCore20WorkerMessagingProxyD0Ev
+__ZThn88_N7WebCore8Document27derefScriptExecutionContextEv
+__ZN7WebCore8Document27derefScriptExecutionContextEv
+__ZN7WebCore22JSXMLHttpRequestUploadD1Ev
+__ZN7WebCore22JSXMLHttpRequestUploadD2Ev
+__ZN7WebCore20XMLHttpRequestUploadD0Ev
+__ZN7WebCore49jsMutationEventPrototypeFunctionInitMutationEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13MutationEvent17initMutationEventERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_4NodeEEERKNS_6StringESA_SA_t
+__ZN7WebCoreL27createSVGPathElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGPathElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGPathElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGPathElementEEE
+__ZN7WebCore16JSSVGPathElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGPathElementEEE
+__ZN7WebCore16JSSVGPathElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGPathElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSSVGPathElement9classInfoEv
+__ZNK7WebCore6JSNode21pushEventHandlerScopeEPN3JSC9ExecStateERNS1_10ScopeChainE
+__ZN7WebCore26jsProgressEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12MessageEventC1Ev
+__ZN7WebCore12MessageEventC2Ev
+__ZN7WebCore25jsMessageEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsWebKitAnimationEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21WebKitTransitionEventC1Ev
+__ZN7WebCore21WebKitTransitionEventC2Ev
+__ZNK7WebCore21WebKitTransitionEvent23isWebKitTransitionEventEv
+__ZN7WebCore23JSWebKitTransitionEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21WebKitTransitionEventEEE
+__ZN7WebCore23JSWebKitTransitionEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21WebKitTransitionEventEEE
+__ZN7WebCore23JSWebKitTransitionEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34jsWebKitTransitionEventConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSSVGPathElementD1Ev
+__ZThn8_N7WebCore14SVGPathElementD0Ev
+__ZN7WebCore25JSSVGPathElementPrototypeD1Ev
+__ZN7WebCore23JSWebKitTransitionEventD1Ev
+__ZN7WebCore21WebKitTransitionEventD0Ev
+__ZNK7WebCore21HTMLFrameOwnerElement19isKeyboardFocusableEPNS_13KeyboardEventE
+__ZNK7WebCore21HTMLFrameOwnerElement19isFrameOwnerElementEv
+__ZNK7WebCore17HTMLAnchorElement19isKeyboardFocusableEPNS_13KeyboardEventE
+__ZNK7WebCore12EventHandler11tabsToLinksEPNS_13KeyboardEventE
+__ZNK7WebCore12EventHandler24invertSenseOfTabsToLinksEPNS_13KeyboardEventE
+__ZNK7WebCore12RenderInline17borderBoundingBoxEv
+__ZNK7WebCore4Node19isFrameOwnerElementEv
+__ZNK7WebCore16HTMLInputElement19isKeyboardFocusableEPNS_13KeyboardEventE
 __ZN7WebCore8Document21previousFocusableNodeEPNS_4NodeEPNS_13KeyboardEventE
+__ZN7WebCore26jsKeyboardEventAltGraphKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7UIEvent6layerXEv
+__ZNK7WebCore7UIEvent6layerYEv
+__ZNK7WebCore7UIEvent5pageXEv
+__ZNK7WebCore7UIEvent5pageYEv
+__ZNK7WebCore13KeyboardEvent5whichEv
+__ZN7WebCore47jsMessageEventPrototypeFunctionInitMessageEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14JSMessageEvent9classInfoEv
+__ZN7WebCore12MessageEvent16initMessageEventERKNS_12AtomicStringEbbRKNS_6StringES6_S6_PNS_9DOMWindowEPNS_11MessagePortE
+__ZN7WebCore25jsMessageEventLastEventIdEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsMutationEventRelatedNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24jsMutationEventPrevValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsMutationEventNewValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsMutationEventAttrNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsMutationEventAttrChangeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore49jsOverflowEventPrototypeFunctionInitOverflowEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13OverflowEvent17initOverflowEventEtbb
+__ZN7WebCore21jsOverflowEventOrientEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsOverflowEventHorizontalOverflowEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsOverflowEventVerticalOverflowEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsProgressEventLengthComputableEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsProgressEventLoadedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsProgressEventTotalEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12StorageEvent14isStorageEventEv
+__ZN7WebCore14JSStorageEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12StorageEventEEE
+__ZN7WebCore14JSStorageEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12StorageEventEEE
+__ZN7WebCore14JSStorageEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore47jsStorageEventPrototypeFunctionInitStorageEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14JSStorageEvent9classInfoEv
+__ZN7WebCore12StorageEvent16initStorageEventERKNS_12AtomicStringEbbRKNS_6StringES6_S6_S6_N3WTF10PassRefPtrINS_9DOMWindowEEE
+__ZN7WebCore17jsStorageEventKeyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsStorageEventOldValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsStorageEventNewValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17jsStorageEventUriEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsStorageEventSourceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsTextEventPrototypeFunctionInitTextEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9TextEvent13initTextEventERKNS_12AtomicStringEbbN3WTF10PassRefPtrINS_9DOMWindowEEERKNS_6StringE
+__ZN7WebCore15jsTextEventDataEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore7UIEvent5whichEv
+__ZN7WebCore63jsWebKitAnimationEventPrototypeFunctionInitWebKitAnimationEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS
+__ZNK7WebCore22JSWebKitAnimationEvent9classInfoEv
+__ZN7WebCore20WebKitAnimationEvent24initWebKitAnimationEventERKNS_12AtomicStringEbbRKNS_6StringEd
+__ZN7WebCore65jsWebKitTransitionEventPrototypeFunctionInitWebKitTransitionEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERK
+__ZNK7WebCore23JSWebKitTransitionEvent9classInfoEv
+__ZN7WebCore21WebKitTransitionEvent25initWebKitTransitionEventERKNS_12AtomicStringEbbRKNS_6StringEd
+__ZN7WebCore35jsWebKitTransitionEventPropertyNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21WebKitTransitionEvent12propertyNameEv
+__ZN7WebCore34jsWebKitTransitionEventElapsedTimeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21WebKitTransitionEvent11elapsedTimeEv
+__ZN7WebCore14JSStorageEventD1Ev
+__ZN7WebCore12StorageEventD0Ev
+__ZN7WebCore16HTMLLabelElement5focusEb
+__ZN7WebCore11RenderBlock16paintColumnRulesERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore11RenderBlock19paintColumnContentsERNS_12RenderObject9PaintInfoEiib
+__ZN7WebCore16HTMLInputElement15addSearchResultEv
+__ZN7WebCore27RenderTextControlSingleLine15addSearchResultEv
+__ZN7WebCore16HTMLInputElement8onSearchEv
+__ZN7WebCore27RenderTextControlSingleLine20stopSearchEventTimerEv
+__ZN7WebCore17HTMLSelectElement13typeAheadFindEPNS_13KeyboardEventE
+__ZNK7WebCore17HTMLSelectElement17listToOptionIndexEi
+__ZN7WebCore24submitButtonDefaultLabelEv
+__ZN7WebCore17setJSNodeOnunloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node11setOnunloadEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZNK7WebCore6Chrome12canTakeFocusENS_14FocusDirectionE
+__ZNK7WebCore6Chrome9takeFocusENS_14FocusDirectionE
+__ZN7WebCore17setJSNodeOnscrollEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node11setOnscrollEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore9Scrollbar6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
+__ZN7WebCore12EventHandler30passMousePressEventToScrollbarERNS_28MouseEventWithHitTestResultsEPNS_9ScrollbarE
+__ZN7WebCore9Scrollbar9mouseDownERKNS_18PlatformMouseEventE
+__ZN7WebCore9Scrollbar14setPressedPartENS_13ScrollbarPartE
+__ZN7WebCore17ScrollbarThemeMac19shouldCenterOnThumbEPNS_9ScrollbarERKNS_18PlatformMouseEventE
+__ZN7WebCore17ScrollbarThemeMac27initialAutoscrollTimerDelayEv
+__ZN7WebCore9Scrollbar21autoscrollPressedPartEd
+__ZN7WebCoreL15thumbUnderMouseEPNS_9ScrollbarE
+__ZN7WebCore23ScrollbarThemeComposite13trackPositionEPNS_9ScrollbarE
+__ZN7WebCore9Scrollbar28pressedPartScrollGranularityEv
+__ZN7WebCore9Scrollbar26pressedPartScrollDirectionEv
+__ZN7WebCore9Scrollbar18startTimerIfNeededEd
+__ZN7WebCore17ScrollbarThemeMac20autoscrollTimerDelayEv
+__ZN7WebCore9Scrollbar7mouseUpEv
+__ZN3WTF6VectorIN7WebCore15AttributeChangeELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore15AttributeChangeELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore15AttributeChangeELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore15AttributeChangeELm0EE6shrinkEm
+__ZN7WebCore32jsDOMWindowPrototypeFunctionStopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow4stopEv
+__ZN7WebCore11FrameLoader25scheduleCheckLoadCompleteEv
+__ZNK7WebCore15HTMLAreaElement11isFocusableEv
+__ZN7WebCore16HTMLMediaElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore11RenderMediaC1EPNS_16HTMLMediaElementE
+__ZN7WebCore11RenderMedia24createControlsShadowRootEv
+__ZN7WebCore29MediaControlShadowRootElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZN7WebCore29MediaControlShadowRootElementC2EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZNK7WebCore29MediaControlShadowRootElement12isShadowNodeEv
+__ZN7WebCore29MediaControlShadowRootElement16shadowParentNodeEv
+__ZN7WebCore11RenderMedia11createPanelEv
+__ZN7WebCore11RenderMedia16createMuteButtonEv
+__ZN7WebCore29MediaControlMuteButtonElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZN7WebCore29MediaControlMuteButtonElementC2EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZNK7WebCore16HTMLMediaElement5mutedEv
+__ZN7WebCore24MediaControlInputElementC2EPNS_8DocumentENS_8PseudoIdERKNS_6StringEPNS_16HTMLMediaElementENS_23MediaControlElemen
+__ZN7WebCore24MediaControlInputElement14attachToParentEPNS_7ElementE
+__ZN7WebCore11RenderMedia16createPlayButtonEv
+__ZN7WebCore29MediaControlPlayButtonElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZN7WebCore29MediaControlPlayButtonElementC2EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZNK7WebCore16HTMLMediaElement7canPlayEv
+__ZN7WebCore11RenderMedia23createTimelineContainerEv
+__ZN7WebCore11RenderMedia14createTimelineEv
+__ZN7WebCore27MediaControlTimelineElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZN7WebCore27MediaControlTimelineElementC2EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZN7WebCore11RenderMedia20createSeekBackButtonEv
+__ZN7WebCore29MediaControlSeekButtonElementC1EPNS_8DocumentEPNS_16HTMLMediaElementEb
+__ZN7WebCore29MediaControlSeekButtonElementC2EPNS_8DocumentEPNS_16HTMLMediaElementEb
+__ZN7WebCore11RenderMedia23createSeekForwardButtonEv
+__ZN7WebCore11RenderMedia24createCurrentTimeDisplayEv
+__ZN7WebCore23MediaTimeDisplayElementC1EPNS_8DocumentEPNS_16HTMLMediaElementEb
+__ZN7WebCore23MediaTimeDisplayElementC2EPNS_8DocumentEPNS_16HTMLMediaElementEb
+__ZN7WebCore23MediaTextDisplayElementC2EPNS_8DocumentENS_8PseudoIdEPNS_16HTMLMediaElementE
+__ZN7WebCore23MediaTextDisplayElement14attachToParentEPNS_7ElementE
+__ZN7WebCore11RenderMedia26createTimeRemainingDisplayEv
+__ZN7WebCore11RenderMedia22createFullscreenButtonEv
+__ZN7WebCore35MediaControlFullscreenButtonElementC1EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZN7WebCore35MediaControlFullscreenButtonElementC2EPNS_8DocumentEPNS_16HTMLMediaElementE
+__ZN7WebCore24MediaControlInputElement6updateEv
+__ZN7WebCore29MediaControlMuteButtonElement17updateDisplayTypeEv
+__ZN7WebCore24MediaControlInputElement14setDisplayTypeENS_23MediaControlElementTypeE
+__ZN7WebCore29MediaControlPlayButtonElement17updateDisplayTypeEv
+__ZN7WebCore27MediaControlTimelineElement6updateEb
+__ZN7WebCore24MediaControlInputElement17updateDisplayTypeEv
+__ZN7WebCore11RenderMedia17updateTimeDisplayEv
+__ZN7WebCore11RenderMedia23updateControlVisibilityEv
+__ZNK7WebCore16HTMLMediaElement8hasVideoEv
+__ZNK7WebCore16HTMLVideoElement8hasVideoEv
+__ZNK7WebCore17HTMLSourceElement17endTagRequirementEv
+__ZNK7WebCore17HTMLSourceElement11tagPriorityEv
+__ZNK7WebCore16HTMLMediaElement12networkStateEv
+__ZNK7WebCore22NullMediaPlayerPrivate11currentTimeEv
+__ZN7WebCore17HTMLSourceElement23cancelPendingErrorEventEv
+__ZN7WebCore16HTMLMediaElement24havePotentialSourceChildEv
+__ZN7WebCore16HTMLMediaElement21selectNextSourceChildEPNS_11ContentTypeENS0_19InvalidSourceActionE
+__ZNK7WebCore17HTMLSourceElement4typeEv
+__ZNK7WebCore17HTMLSourceElement3srcEv
+__ZN7WebCore16HTMLMediaElement19loadNextSourceChildEv
+__ZN7WebCore11MediaPlayer8hasVideoEv
+__ZNK7WebCore22NullMediaPlayerPrivate8hasVideoEv
+__ZNK7WebCore18MediaPlayerPrivate8hasVideoEv
+__ZNK7WebCore11RenderVideo20calcAspectRatioWidthEv
+__ZNK7WebCore11RenderVideo21calcAspectRatioHeightEv
+__ZN7WebCore24MediaControlInputElement11updateStyleEv
+__ZN7WebCore23MediaTextDisplayElement11updateStyleEv
+__ZNK7WebCore19HTMLFieldSetElement11isFocusableEv
+__ZN7WebCore17HTMLLegendElement5focusEb
+__ZNK7WebCore17HTMLLegendElement11isFocusableEv
+__ZN7WebCore17HTMLLegendElement11formElementEv
+__ZNK7WebCore19HTMLOptGroupElement11isFocusableEv
+__ZNK7WebCore17HTMLOptionElement11isFocusableEv
+__ZN7WebCore12RenderSliderD0Ev
+__ZThn8_N7WebCore18SliderThumbElementD0Ev
+__ZN7WebCore18SliderThumbElementD0Ev
+__ZN7WebCore28RenderMediaControlShadowRootD0Ev
+__ZThn8_N7WebCore29MediaControlShadowRootElementD0Ev
+__ZN7WebCore29MediaControlShadowRootElementD0Ev
+__ZN7WebCore29MediaControlMuteButtonElementD0Ev
+__ZN7WebCore29MediaControlPlayButtonElementD0Ev
+__ZN7WebCore29MediaControlSeekButtonElementD0Ev
+__ZN7WebCore35MediaControlFullscreenButtonElementD0Ev
+__ZN7WebCore27MediaControlTimelineElementD0Ev
+__ZN7WebCore23MediaTimeDisplayElementD0Ev
+__ZN7WebCore11RenderMediaD0Ev
+__ZN7WebCore11FrameLoader21reportLocalLoadFailedEPNS_5FrameERKNS_6StringE
+__ZN7WebCore16HTMLMediaElement13noneSupportedEv
+__ZN7WebCore16HTMLMediaElement5pauseEv
+__ZN7WebCore16HTMLMediaElement13pauseInternalEv
+__ZN7WebCore19CachedXSLStyleSheet4dataEN3WTF10PassRefPtrINS_12SharedBufferEEEb
+__ZN7WebCore13XSLStyleSheet17compileStyleSheetEv
+__ZL26initxsltParseStylesheetDocP7_xmlDoc
+__ZL14libxsltLibraryv
+__ZN7WebCore13XSLStyleSheet14clearDocumentsEv
+__ZL27initxsltNewTransformContextP15_xsltStylesheetP7_xmlDoc
+__ZN7WebCore22registerXSLTExtensionsEP21_xsltTransformContext
+__ZL27initxsltRegisterExtFunctionP21_xsltTransformContextPKhS2_PFvP22_xmlXPathParserContextiE
+__ZL23initxsltSetCtxtSortFuncP21_xsltTransformContextPFvS0_PP8_xmlNodeiE
+__ZL23initxsltQuoteUserParamsP21_xsltTransformContextPPKc
+__ZL27initxsltApplyStylesheetUserP15_xsltStylesheetP7_xmlDocPPKcS4_P7__sFILEP21_xsltTransformContext
+__ZL28initxsltFreeTransformContextP21_xsltTransformContext
+__ZL20initxsltSaveResultToP16_xmlOutputBufferP7_xmlDocP15_xsltStylesheet
+__ZN7WebCoreL13writeToVectorEPvPKci
+__ZL22initxsltFreeStylesheetP15_xsltStylesheet
+__ZN7WebCore13XSLTProcessor24createDocumentFromSourceERKNS_6StringES3_S3_PNS_4NodeEPNS_5FrameE
 __ZNK7WebCore9RenderBox14overrideHeightEv
 __ZN7WebCore17RenderFlexibleBox22calcVerticalPrefWidthsEv
-__ZN7WebCore13RenderListBox17listIndexAtOffsetEii
-__ZN7WebCore16HTMLInputElement16setIndeterminateEb
-__ZNK7WebCore4Font27selectionRectForComplexTextERKNS_7TextRunERKNS_8IntPointEiii
-__ZN7WebCore45jsHTMLSelectElementPrototypeFunctionNamedItemEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore17HTMLSelectElement9namedItemERKNS_6StringEb
-__ZN7WebCore17RenderTextControl22textWithHardLineBreaksEv
-__ZN7WebCore16getNextSoftBreakERPNS_13RootInlineBoxERPNS_4NodeERj
-__ZN7WebCore17HTMLSelectElement7setSizeEi
-__ZN7WebCore19HTMLOptGroupElement11removeChildEPNS_4NodeERi
-__ZN7WebCore31HTMLFormControlElementWithState26willMoveToNewOwnerDocumentEv
-__ZN7WebCore31HTMLFormControlElementWithState25didMoveToNewOwnerDocumentEv
-__ZN7WebCore16HTMLInputElement26willMoveToNewOwnerDocumentEv
-__ZN7WebCore16HTMLInputElement25didMoveToNewOwnerDocumentEv
+__ZNK7WebCore13RenderListBox10renderNameEv
+__ZN7WebCore17HTMLButtonElement15accessKeyActionEb
+__ZN7WebCore16HTMLInputElement15accessKeyActionEb
+__ZN7WebCore17HTMLLegendElement15accessKeyActionEb
+__ZN7WebCore16HTMLLabelElement15accessKeyActionEb
+__ZN7WebCore27jsHTMLInputElementAutofocusEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30setJSHTMLInputElementAutofocusEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore22HTMLFormControlElement12setAutofocusEb
+__ZN7WebCore32setJSHTMLTextAreaElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore28setJSHTMLTextAreaElementColsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTextAreaElement7setColsEi
+__ZNK7WebCore12RenderSlider10renderNameEv
+__ZNK7WebCore23RenderFileUploadControl10renderNameEv
 __ZNK7WebCore12RenderButton23createsAnonymousWrapperEv
-__ZN3WTF6VectorItLm0EE4growEm
-__ZN7WebCore17HTMLSelectElement11setMultipleEb
-__ZN7WebCore17HTMLSelectElement22updateListBoxSelectionEb
-__ZThn132_N7WebCore13RenderListBox12valueChangedEPNS_9ScrollbarE
-__ZN7WebCore13RenderListBox12valueChangedEPNS_9ScrollbarE
-__ZN7WebCore19enabledAnySelectionEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceE
+__ZN7WebCore14FormElementKeyC1EPNS_16AtomicStringImplES2_
+__ZN7WebCore14FormElementKeyC2EPNS_16AtomicStringImplES2_
+__ZNK7WebCore14FormElementKey3refEv
+__ZN3WTF9HashTableIN7WebCore14FormElementKeyESt4pairIS2_NS_6VectorINS1_6StringELm0EEEENS_18PairFirstExtractorIS7_EENS1_18FormEl
+__ZN3WTF7HashMapIN7WebCore14FormElementKeyENS_6VectorINS1_6StringELm0EEENS1_18FormElementKeyHashENS1_24FormElementKeyHashTraits
+__ZN7WebCore14FormElementKeyC1ERKS0_
+__ZN7WebCore14FormElementKeyC2ERKS0_
+__ZN7WebCore14FormElementKeyD1Ev
+__ZN7WebCore14FormElementKeyD2Ev
+__ZNK7WebCore14FormElementKey5derefEv
+__ZN7WebCore18FormElementKeyHash4hashERKNS_14FormElementKeyE
+__ZN7WebCore14FormElementKeyaSERKS0_
+__ZN7WebCore8Document23takeStateForFormElementEPNS_16AtomicStringImplES2_RNS_6StringE
+__ZN7WebCore16HTMLInputElement23restoreFormControlStateERKNS_6StringE
+__ZN7WebCore14jsNodeOnselectEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node8onselectEv
+__ZNK7WebCore8DragData11asFilenamesERN3WTF6VectorINS_6StringELm0EEE
+__ZN7WebCore23RenderFileUploadControl19receiveDroppedFilesERKN3WTF6VectorINS_6StringELm0EEE
+__ZN7WebCore23RenderFileUploadControl19allowsMultipleFilesEv
+__ZN7WebCore11FileChooser10chooseFileERKNS_6StringE
+__ZThn200_N7WebCore23RenderFileUploadControl12valueChangedEv
+__ZN7WebCore23RenderFileUploadControl12valueChangedEv
+__ZN7WebCore16HTMLInputElement23setFileListFromRendererERKN3WTF6VectorINS_6StringELm0EEE
+__ZN7WebCore4FileC1ERKNS_6StringE
+__ZN7WebCore4FileC2ERKNS_6StringE
+__ZN7WebCore15pathGetFileNameERKNS_6StringE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4FileEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4FileEEELm0EE15reserveCapacityEm
+__ZNK7WebCore8FileList4itemEj
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore4FileEEELm0EE6shrinkEm
+__ZNK7WebCore22HTMLFormControlElement19isKeyboardFocusableEPNS_13KeyboardEventE
+__ZNK7WebCore12EventHandler17tabsToAllControlsEPNS_13KeyboardEventE
+__ZNK7WebCore19HTMLTextAreaElement19isKeyboardFocusableEPNS_13KeyboardEventE
+__ZN7WebCore19HTMLTextAreaElement15accessKeyActionEb
+__ZN7WebCore39setJSDOMWindowHTMLCollectionConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZNK7WebCore14RenderTableCol10renderNameEv
+__ZN7WebCore34setJSHTMLInputElementIndeterminateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement16setIndeterminateEb
+__ZThn128_N7WebCore16HTMLInputElement8setValueERKNS_6StringE
+__ZN7WebCore26jsHTMLInputElementMultipleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement8multipleEv
+__ZN7WebCore29setJSHTMLInputElementMultipleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement11setMultipleEb
+__ZNK7WebCore17RenderTextControl28canBeProgramaticallyScrolledEb
+__ZN7WebCore27RenderTextControlSingleLine10autoscrollEv
+__ZN7WebCore30setJSHTMLInputElementMaxLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLInputElement12setMaxLengthEi
 __ZNK7WebCore17HTMLSelectElement12canSelectAllEv
 __ZN7WebCore17HTMLSelectElement9selectAllEv
 __ZN7WebCore17HTMLSelectElement23nextSelectableListIndexEi
 __ZN7WebCore17HTMLSelectElement27previousSelectableListIndexEi
+__ZN7WebCore17HTMLSelectElement22updateListBoxSelectionEb
+__ZN7WebCore13RenderListBox32scrollToRevealElementAtListIndexEi
 __ZN7WebCore17HTMLSelectElement15listBoxOnChangeEv
 __ZN7WebCore13RenderListBox12setScrollTopEi
-__ZNK7WebCore31JSHTMLInputElementBasePrototype9classInfoEv
+__ZThn200_N7WebCore13RenderListBox12valueChangedEPNS_9ScrollbarE
+__ZN7WebCore13RenderListBox12valueChangedEPNS_9ScrollbarE
+__ZN7WebCore13RenderListBox17listIndexAtOffsetEii
+__ZNK7WebCore11RenderTheme37activeListBoxSelectionBackgroundColorEv
+__ZNK7WebCore14RenderThemeMac45platformActiveListBoxSelectionBackgroundColorEv
+__ZNK7WebCore11RenderTheme37activeListBoxSelectionForegroundColorEv
+__ZNK7WebCore14RenderThemeMac45platformActiveListBoxSelectionForegroundColorEv
+__ZNK7WebCore13RenderListBox9scrollTopEv
+__ZN7WebCore30setJSHTMLSelectElementMultipleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLSelectElement11setMultipleEb
+__ZN7WebCore26setJSHTMLSelectElementSizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLSelectElement7setSizeEi
+__ZThn128_NK7WebCore19HTMLOptGroupElement14groupLabelTextEv
+__ZNK7WebCore19HTMLOptGroupElement14groupLabelTextEv
+__ZN7WebCore19HTMLOptGroupElement11appendChildEN3WTF10PassRefPtrINS_4NodeEEERib
+__ZN7WebCore19HTMLOptGroupElement11removeChildEPNS_4NodeERi
+__ZN7WebCore19HTMLOptGroupElement12replaceChildEN3WTF10PassRefPtrINS_4NodeEEEPS3_Rib
+__ZN7WebCore19HTMLOptGroupElement12insertBeforeEN3WTF10PassRefPtrINS_4NodeEEEPS3_Rib
 __ZN7WebCore19HTMLOptGroupElement14removeChildrenEv
+__ZN7WebCore13RenderListBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore13RenderListBox24isPointInOverflowControlERNS_13HitTestResultEiiii
+__ZNK7WebCore17HTMLSelectElement16isMouseFocusableEv
+__ZNK7WebCore17HTMLSelectElement17canStartSelectionEv
+__ZNK7WebCore13RenderListBox28canBeProgramaticallyScrolledEb
+__ZN7WebCore31HTMLFormControlElementWithState26willMoveToNewOwnerDocumentEv
+__ZN7WebCore31HTMLFormControlElementWithState25didMoveToNewOwnerDocumentEv
+__ZN7WebCore16HTMLInputElement26willMoveToNewOwnerDocumentEv
+__ZN7WebCore16HTMLInputElement25didMoveToNewOwnerDocumentEv
+__ZN7WebCore30SearchFieldCancelButtonElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore12EventHandler27setCapturingMouseEventsNodeEN3WTF10PassRefPtrINS_4NodeEEE
+__ZThn8_N7WebCore30SearchFieldCancelButtonElementD0Ev
+__ZN7WebCore27RenderTextControlSingleLine21startSearchEventTimerEv
+__ZN7WebCore5TimerINS_27RenderTextControlSingleLineEE5firedEv
+__ZN7WebCore27RenderTextControlSingleLine21searchEventTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore24HitTestingTransformState9translateEiiNS0_21TransformAccumulationE
+__ZN7WebCore17HTMLSelectElement15accessKeyActionEb
+__ZNK7WebCore17HTMLSelectElement21lastSelectedListIndexEv
+__ZN7WebCore19JSHTMLSelectElement3putEPN3JSC9ExecStateEjNS1_7JSValueE
+__ZN7WebCore19JSHTMLSelectElement11indexSetterEPN3JSC9ExecStateEjNS1_7JSValueE
+__ZN7WebCore45jsHTMLSelectElementPrototypeFunctionNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore17HTMLSelectElement9namedItemERKNS_12AtomicStringE
+__ZN7WebCore17HTMLSelectElement14appendFormDataERNS_12FormDataListEb
+__ZN7WebCore12RenderSlider12forwardEventEPNS_5EventE
+__ZN7WebCore18SliderThumbElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore12RenderSlider19mouseEventIsInThumbEPNS_10MouseEventE
+__ZN7WebCore12RenderSlider15currentPositionEv
+__ZN7WebCore12RenderSlider17positionForOffsetERKNS_8IntPointE
+__ZN7WebCore12RenderSlider9trackSizeEv
+__ZN7WebCore12RenderSlider19setValueForPositionEi
+__ZN7WebCore12TextDocumentC1EPNS_5FrameE
+__ZN7WebCore12TextDocumentC2EPNS_5FrameE
+__ZN7WebCore12TextDocument15createTokenizerEv
+__ZN7WebCore13TextTokenizerC1EPNS_8DocumentE
+__ZN7WebCore13TextTokenizerC2EPNS_8DocumentE
+__ZN7WebCore13TextTokenizer5writeERKNS_15SegmentedStringEb
+__ZN7WebCore13TextTokenizer6finishEv
+__ZN7WebCore13TextTokenizerD0Ev
+__ZN7WebCore12TextDocumentD0Ev
+__ZN7WebCore17RenderTextControl22textWithHardLineBreaksEv
+__ZN7WebCoreL16getNextSoftBreakERPNS_13RootInlineBoxERPNS_4NodeERj
+__ZN7WebCore15RenderScrollbar21createCustomScrollbarEPNS_15ScrollbarClientENS_20ScrollbarOrientationEPNS_9RenderBoxE
+__ZN7WebCore15RenderScrollbarC1EPNS_15ScrollbarClientENS_20ScrollbarOrientationEPNS_9RenderBoxE
+__ZN7WebCore15RenderScrollbarC2EPNS_15ScrollbarClientENS_20ScrollbarOrientationEPNS_9RenderBoxE
+__ZN7WebCore20RenderScrollbarTheme20renderScrollbarThemeEv
+__ZN7WebCore20RenderScrollbarTheme17registerScrollbarEPNS_9ScrollbarE
+__ZN7WebCore20RenderScrollbarTheme18scrollbarThicknessENS_20ScrollbarControlSizeE
+__ZN7WebCore15RenderScrollbar9setParentEPNS_10ScrollViewE
+__ZN7WebCore15RenderScrollbar12styleChangedEv
+__ZN7WebCore15RenderScrollbar20updateScrollbarPartsEb
+__ZN7WebCore15RenderScrollbar19updateScrollbarPartENS_13ScrollbarPartEb
+__ZN7WebCore15RenderScrollbar23getScrollbarPseudoStyleENS_13ScrollbarPartENS_8PseudoIdE
+__ZNK7WebCore20RenderScrollbarTheme16buttonsPlacementEv
+__ZNK3WTF7HashMapIjPN7WebCore19RenderScrollbarPartENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE3getERKj
+__ZN7WebCore19RenderScrollbarPartC1EPNS_4NodeEPNS_15RenderScrollbarENS_13ScrollbarPartE
+__ZN7WebCore19RenderScrollbarPartC2EPNS_4NodeEPNS_15RenderScrollbarENS_13ScrollbarPartE
+__ZN3WTF7HashMapIjPN7WebCore19RenderScrollbarPartENS_7IntHashIjEENS_10HashTraitsIjEENS6_IS3_EEE3setERKjRKS3_
+__ZN3WTF9HashTableIjSt4pairIjPN7WebCore19RenderScrollbarPartEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsIN
+__ZN7WebCore19RenderScrollbarPart15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore19RenderScrollbarPart14styleDidChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZNK7WebCore19RenderScrollbarPart13requiresLayerEv
+__ZN7WebCore19RenderScrollbarPart6layoutEv
+__ZN7WebCore19RenderScrollbarPart18layoutVerticalPartEv
+__ZN7WebCore19RenderScrollbarPart21computeScrollbarWidthEv
+__ZN7WebCoreL27calcScrollbarThicknessUsingERKNS_6LengthEi
+__ZN7WebCore15RenderScrollbar10setEnabledEb
+__ZN7WebCore20RenderScrollbarTheme9trackRectEPNS_9ScrollbarEb
+__ZN7WebCore20RenderScrollbarTheme10hasButtonsEPNS_9ScrollbarE
+__ZN7WebCore20RenderScrollbarTheme25buttonSizesAlongTrackAxisEPNS_9ScrollbarERiS3_
+__ZN7WebCore20RenderScrollbarTheme14backButtonRectEPNS_9ScrollbarENS_13ScrollbarPartEb
+__ZN7WebCore15RenderScrollbar10buttonRectENS_13ScrollbarPartE
+__ZN7WebCore20RenderScrollbarTheme17forwardButtonRectEPNS_9ScrollbarENS_13ScrollbarPartEb
+__ZN7WebCore15RenderScrollbar9trackRectEii
+__ZN7WebCore20RenderScrollbarTheme31constrainTrackRectToTrackPiecesEPNS_9ScrollbarERKNS_7IntRectE
+__ZN7WebCore15RenderScrollbar25trackPieceRectWithMarginsENS_13ScrollbarPartERKNS_7IntRectE
+__ZN7WebCore20RenderScrollbarTheme18minimumThumbLengthEPNS_9ScrollbarE
+__ZN7WebCore15RenderScrollbar18minimumThumbLengthEv
+__ZN7WebCore19RenderScrollbarPartD0Ev
+__ZN7WebCore15RenderScrollbarD0Ev
+__ZN7WebCore9ScrollbarD2Ev
+__ZN7WebCore20RenderScrollbarTheme19unregisterScrollbarEPNS_9ScrollbarE
+__ZNK7WebCore12RenderObject8isSliderEv
+__ZN7WebCore30jsHTMLInputElementWillValidateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLInputElement12willValidateEv
+__ZN7WebCore33jsHTMLTextAreaElementWillValidateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsHTMLFieldSetElementWillValidateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19HTMLFieldSetElement12willValidateEv
+__ZN7WebCore31jsHTMLButtonElementWillValidateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLButtonElement12willValidateEv
+__ZN7WebCoreL31transferMailtoPostFormDataToURLERN3WTF6RefPtrINS_8FormDataEEERNS_4KURLERKNS_6StringE
+__ZN7WebCore14RenderFrameSet13startResizingERNS0_8GridAxisEi
+__ZNK7WebCore14RenderFrameSet12hitTestSplitERKNS0_8GridAxisEi
+__ZNK7WebCore14RenderFrameSet13splitPositionERKNS0_8GridAxisEi
+__ZN7WebCore14RenderFrameSet13setIsResizingEb
+__ZN7WebCore12EventHandler19setResizingFrameSetEPNS_19HTMLFrameSetElementE
+__ZN7WebCore14RenderFrameSet16continueResizingERNS0_8GridAxisEi
+__ZNK7WebCore14RenderFrameSet12canResizeRowERKNS_8IntPointE
+__ZNK7WebCore14RenderFrameSet15canResizeColumnERKNS_8IntPointE
+__ZN7WebCore18columnResizeCursorEv
+__ZN7WebCore15rowResizeCursorEv
+__ZN7WebCore23jsHTMLFrameElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore20HTMLFrameElementBase5widthEv
+__ZN7WebCore24jsHTMLFrameElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
 __ZNK7WebCore20HTMLFrameElementBase6heightEv
-__ZNK7WebCore17RenderTextControl11scrollWidthEv
-__ZNK7WebCore12RenderObject8isSliderEv
-__ZN7WebCore19JSHTMLSelectElement11indexSetterEPN3KJS9ExecStateEjPNS1_7JSValueEi
-__ZNK7WebCore13RenderListBox9scrollTopEv
-__ZNK7WebCore14RenderThemeMac37activeListBoxSelectionBackgroundColorEv
-__ZNK7WebCore11RenderTheme37activeListBoxSelectionForegroundColorEv
-__ZN7WebCore41jsHTMLLegendElementPrototypeFunctionFocusEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore17HTMLLegendElement5focusEb
-__ZN7WebCore17HTMLLegendElement11formElementEv
-__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE11reverseRunsEii
-__ZN7WebCore16CSSStyleSelector17mapBackgroundClipEPNS_15BackgroundLayerEPNS_8CSSValueE
+__ZNK7WebCore11FrameLoader20childFramesMatchItemEPNS_11HistoryItemE
+__ZNK7WebCore11HistoryItem19childItemWithTargetERKNS_6StringE
+__ZN7WebCore26setJSXMLHttpRequestOnabortEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17HTMLOptionElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore22HTMLViewSourceDocumentC1EPNS_5FrameERKNS_6StringE
+__ZN7WebCore22HTMLViewSourceDocumentC2EPNS_5FrameERKNS_6StringE
+__ZN7WebCore22HTMLViewSourceDocument15createTokenizerEv
+__ZN7WebCore13HTMLTokenizerC1EPNS_22HTMLViewSourceDocumentE
+__ZN7WebCore13HTMLTokenizerC2EPNS_22HTMLViewSourceDocumentE
+__ZN7WebCore22HTMLViewSourceDocument18addViewSourceTokenEPNS_5TokenE
+__ZN7WebCore22HTMLViewSourceDocument21createContainingTableEv
+__ZN7WebCore22HTMLViewSourceDocument20addSpanWithClassNameERKNS_6StringE
+__ZN7WebCore22HTMLViewSourceDocument7addLineERKNS_6StringE
+__ZN7WebCore22HTMLViewSourceDocument7addTextERKNS_6StringES3_
+__ZN7WebCore22HTMLViewSourceDocumentD0Ev
+__ZN7WebCore22HTMLViewSourceDocument25addViewSourceDoctypeTokenEPNS_12DoctypeTokenE
+__ZN7WebCore16CSSGradientValue13resolveRadiusEPNS_17CSSPrimitiveValueEf
+__ZNK7WebCore27RenderImageGeneratedContent21setImageContainerSizeERKNS_7IntSizeE
+__ZNK7WebCore19StyleGeneratedImage22usesImageContainerSizeEv
+__ZN7WebCore28jsHistoryPrototypeFunctionGoEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7History2goEi
+__ZNK7WebCore17HTMLButtonElement17canStartSelectionEv
+__ZN7WebCore17HTMLKeygenElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore17HTMLKeygenElement11tagPriorityEv
+__ZNK7WebCore17HTMLKeygenElement15formControlTypeEv
+__ZN7WebCore7DataRefINS_16StyleMarqueeDataEE6accessEv
+__ZNK7WebCore11RenderImage21setImageContainerSizeERKNS_7IntSizeE
+__ZNK7WebCore16HTMLEmbedElement24imageSourceAttributeNameEv
 __ZN7WebCore16PDFDocumentImageC1Ev
+__ZN7WebCore16PDFDocumentImageC2Ev
 __ZN7WebCore16PDFDocumentImage11dataChangedEb
 __ZN7WebCore16PDFDocumentImage14setCurrentPageEi
 __ZNK7WebCore16PDFDocumentImage9pageCountEv
 __ZNK7WebCore16PDFDocumentImage4sizeEv
-__ZNK7WebCore8SVGImage17usesContainerSizeEv
 __ZN7WebCore16PDFDocumentImage4drawEPNS_15GraphicsContextERKNS_9FloatRectES5_NS_17CompositeOperatorE
 __ZNK7WebCore16PDFDocumentImage9adjustCTMEPNS_15GraphicsContextE
 __ZN7WebCore5Image26nativeImageForCurrentFrameEv
-__ZN7WebCore11RenderBlock26addContinuationWithOutlineEPNS_10RenderFlowE
-__ZNK3WTF7HashMapIPN7WebCore11RenderBlockEPNS_7HashSetIPNS1_10RenderFlowENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEENS7_IS3_EENS9_IS3_EENS9_ISC_EEE3getERKS3_
-__ZNK7WebCore17HTMLKeygenElement11tagPriorityEv
-__ZNK7WebCore17HTMLKeygenElement4typeEv
-__ZN7WebCore8toHebrewEi
-__ZN7WebCore17toHebrewUnder1000EiPt
-__ZN7WebCore11RenderBlock12paintColumnsERNS_12RenderObject9PaintInfoEiib
-__ZN7WebCore11RenderBlock14hitTestColumnsERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
-__ZN7WebCore40jsMediaListPrototypeFunctionAppendMediumEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
-__ZN7WebCore9MediaList12appendMediumERKNS_6StringERi
-__ZN7WebCore40jsMediaListPrototypeFunctionDeleteMediumEPN3KJS9ExecStateEPNS0_8JSObjectERKNS0_4ListE
+__ZNK7WebCore8SVGImage17usesContainerSizeEv
+__ZNK7WebCore13RenderSVGRoot13selfWillPaintEv
+__ZN7WebCore11RenderBlock25rectWithOutlineForRepaintEPNS_20RenderBoxModelObjectEi
+__ZN7WebCore12RenderInline19paintOutlineForLineEPNS_15GraphicsContextEiiRKNS_7IntRectES5_S5_
+__ZN7WebCore13RenderSVGRoot14calcPrefWidthsEv
+__ZNK7WebCore13RenderSVGRoot10lineHeightEbb
+__ZNK7WebCore13RenderSVGRoot16baselinePositionEbb
+__ZN7WebCore56jsCSSStyleDeclarationPrototypeFunctionIsPropertyImplicitEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
+__ZN7WebCore19CSSStyleDeclaration18isPropertyImplicitERKNS_6StringE
+__ZN7WebCore17setJSNodeOnresizeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node11setOnresizeEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore40jsDOMWindowPrototypeFunctionOpenDatabaseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9DOMWindow12openDatabaseERKNS_6StringES3_S3_mRi
+__ZN7WebCore8Database12openDatabaseEPNS_8DocumentERKNS_6StringES5_S5_mRi
+__ZN7WebCore15DatabaseTracker20canEstablishDatabaseEPNS_8DocumentERKNS_6StringES5_m
+__ZN7WebCore15DatabaseTracker15populateOriginsEv
+__ZN7WebCore18OriginQuotaManagerC1Ev
+__ZN7WebCore18OriginQuotaManagerC2Ev
+__ZN7WebCore15DatabaseTracker19openTrackerDatabaseEb
+__ZNK7WebCore15DatabaseTracker19trackerDatabasePathEv
+__ZN7WebCore15DatabaseTracker14usageForOriginEPNS_14SecurityOriginE
+__ZN7WebCore15DatabaseTracker18originQuotaManagerEv
+__ZN7WebCore18OriginQuotaManager4lockEv
+__ZNK7WebCore18OriginQuotaManager12tracksOriginEPNS_14SecurityOriginE
+__ZNK3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_PNS2_17OriginUsageRecordEENS_18PairFirstExtractorIS8_EENS
+__ZN7WebCore18OriginQuotaManager11trackOriginEN3WTF10PassRefPtrINS_14SecurityOriginEEE
+__ZN7WebCore17OriginUsageRecordC1Ev
+__ZN7WebCore17OriginUsageRecordC2Ev
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEPNS2_17OriginUsageRecordENS2_18SecurityOriginHashENS_10HashTraitsIS4_EE
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_PNS2_17OriginUsageRecordEENS_18PairFirstExtractorIS8_EENS2
+__ZN7WebCore15DatabaseTracker22databaseNamesForOriginEPNS_14SecurityOriginERN3WTF6VectorINS_6StringELm0EEE
+__ZNK7WebCore18OriginQuotaManager9diskUsageEPNS_14SecurityOriginE
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEPNS2_17OriginUsageRecordENS2_18SecurityOriginHashENS_10HashTraitsIS4_E
+__ZN7WebCore17OriginUsageRecord9diskUsageEv
+__ZN7WebCore18OriginQuotaManager6unlockEv
+__ZN7WebCore15DatabaseTracker19hasEntryForDatabaseEPNS_14SecurityOriginERKNS_6StringE
+__ZN7WebCore15DatabaseTracker14quotaForOriginEPNS_14SecurityOriginE
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEyNS2_18SecurityOriginHashENS_10HashTraitsIS4_EENS6_IyEEE3getEPS3_
+__ZN7WebCore18SecurityOriginHash4hashEPNS_14SecurityOriginE
+__ZN7WebCore15DatabaseTracker8setQuotaEPNS_14SecurityOriginEy
+__ZN7WebCore7CString11mutableDataEv
+__ZN7WebCore7CString18copyBufferIfNeededEv
+__ZNK3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_yENS_18PairFirstExtractorIS6_EENS2_18SecurityOriginHashEN
+__ZNK7WebCore14SecurityOrigin18databaseIdentifierEv
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEyNS2_18SecurityOriginHashENS_10HashTraitsIS4_EENS6_IyEEE3setEPS3_RKy
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_yENS_18PairFirstExtractorIS6_EENS2_18SecurityOriginHashENS
+__ZN7WebCore8DatabaseC1EPNS_8DocumentERKNS_6StringES5_
+__ZN7WebCore8DatabaseC2EPNS_8DocumentERKNS_6StringES5_
+__ZN7WebCoreL20guidForOriginAndNameERKNS_6StringES2_
+__ZNK3WTF7HashMapIN7WebCore6StringEiNS1_10StringHashENS_10HashTraitsIS2_EENS4_IiEEE3getERKS2_
+__ZN3WTF7HashMapIN7WebCore6StringEiNS1_10StringHashENS_10HashTraitsIS2_EENS4_IiEEE3setERKS2_RKi
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_iENS_18PairFirstExtractorIS4_EENS1_10StringHashENS_14PairHashTraitsINS_10HashTra
+__ZN7WebCoreL9guidMutexEv
+__ZN7WebCoreL17guidToDatabaseMapEv
+__ZNK3WTF7HashMapIiPNS_7HashSetIPN7WebCore8DatabaseENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEEENS_7IntHashIjEENS7_IiEENS7_ISA_EEE3
+__ZN3WTF7HashMapIiPNS_7HashSetIPN7WebCore8DatabaseENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEEENS_7IntHashIjEENS7_IiEENS7_ISA_EEE3s
+__ZN3WTF9HashTableIiSt4pairIiPNS_7HashSetIPN7WebCore8DatabaseENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEEENS_18PairFirstExtractorI
+__ZN3WTF7HashSetIPN7WebCore8DatabaseENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore8DatabaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore8DatabaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore8DatabaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTable
+__ZN3WTF9HashTableIPN7WebCore8DatabaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallocateTab
+__ZN7WebCore15DatabaseTracker19fullPathForDatabaseEPNS_14SecurityOriginERKNS_6StringEb
+__ZNK7WebCore15DatabaseTracker10originPathEPNS_14SecurityOriginE
+__ZN7WebCore15DatabaseTracker11addDatabaseEPNS_14SecurityOriginERKNS_6StringES5_
+__ZN7WebCore18OriginQuotaManager11addDatabaseEPNS_14SecurityOriginERKNS_6StringES5_
+__ZN7WebCore17OriginUsageRecord11addDatabaseERKNS_6StringES3_
+__ZN3WTF7HashMapIN7WebCore6StringENS1_17OriginUsageRecord13DatabaseEntryENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setE
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS1_17OriginUsageRecord13DatabaseEntryEENS_18PairFirstExtractorIS6_EENS1_10Strin
+__ZN7WebCore15DatabaseTracker15addOpenDatabaseEPNS_8DatabaseE
+__ZNK7WebCore8Database18securityOriginCopyEv
+__ZN7WebCore14SecurityOrigin4copyEv
+__ZN7WebCore14SecurityOriginC1EPKS0_
+__ZN7WebCore14SecurityOriginC2EPKS0_
+__ZNK7WebCore8Database16stringIdentifierEv
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEPNS0_INS2_6StringEPNS_7HashSetIPNS2_8DatabaseENS_7PtrHashIS8_EENS_10Ha
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore14SecurityOriginEEEPNS0_INS2_6StringEPNS_7HashSetIPNS2_8DatabaseENS_7PtrHashIS8_EENS_10Has
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore14SecurityOriginEEESt4pairIS4_PNS_7HashMapINS2_6StringEPNS_7HashSetIPNS2_8DatabaseENS_7P
+__ZNK3WTF7HashMapIN7WebCore6StringEPNS_7HashSetIPNS1_8DatabaseENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEENS1_10StringHashENS8_IS2
+__ZN3WTF7HashMapIN7WebCore6StringEPNS_7HashSetIPNS1_8DatabaseENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEENS1_10StringHashENS8_IS2_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS_7HashSetIPNS1_8DatabaseENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEEENS_18PairFi
+__ZN7WebCore8Document15addOpenDatabaseEPNS_8DatabaseE
+__ZN7WebCore8Database20openAndVerifyVersionERi
+__ZN7WebCore8Document14databaseThreadEv
+__ZN7WebCore14DatabaseThreadC1Ev
+__ZN7WebCore14DatabaseThreadC2Ev
+__ZN7WebCore14DatabaseThread5startEv
+__ZN7WebCore18DatabaseAuthorizerC1Ev
+__ZN7WebCore18DatabaseAuthorizerC2Ev
+__ZN7WebCore18DatabaseAuthorizer5resetEv
+__ZN7WebCore16DatabaseOpenTaskC1EPNS_8DatabaseE
+__ZN7WebCore16DatabaseOpenTaskC2EPNS_8DatabaseE
+__ZN7WebCore12DatabaseTaskC2EPNS_8DatabaseE
+__ZN7WebCore12DatabaseTask28lockForSynchronousSchedulingEv
+__ZN7WebCore14DatabaseThread21scheduleImmediateTaskEN3WTF10PassRefPtrINS_12DatabaseTaskEEE
+__ZN3WTF5DequeINS_6RefPtrIN7WebCore12DatabaseTaskEEEE14expandCapacityEv
+__ZN7WebCore12DatabaseTask28waitForSynchronousCompletionEv
+__ZN7WebCore14DatabaseThread19databaseThreadStartEPv
+__ZN7WebCore14DatabaseThread14databaseThreadEv
+__ZN3WTF12MessageQueueINS_6RefPtrIN7WebCore12DatabaseTaskEEEE19alwaysTruePredicateERS4_
+__ZN7WebCore12DatabaseTask11performTaskEv
+__ZN7WebCore8Database15resetAuthorizerEv
+__ZN7WebCore16DatabaseOpenTask13doPerformTaskEv
+__ZN7WebCore8Database20performOpenAndVerifyERi
+__ZN7WebCore14SQLiteDatabase13setAuthorizerEN3WTF10PassRefPtrINS_18DatabaseAuthorizerEEE
+__ZN7WebCore14SQLiteDatabase16enableAuthorizerEb
+__ZN7WebCore8Database21databaseInfoTableNameEv
+__ZN7WebCore14SQLiteDatabase18authorizerFunctionEPviPKcS3_S3_S3_
+__ZN7WebCore18DatabaseAuthorizer9allowReadERKNS_6StringES3_
+__ZN7WebCore18DatabaseAuthorizer20denyBasedOnTableNameERKNS_6StringE
+__ZN7WebCore18DatabaseAuthorizer11allowInsertERKNS_6StringE
+__ZN7WebCore18DatabaseAuthorizer11createTableERKNS_6StringE
+__ZN7WebCore18DatabaseAuthorizer11createIndexERKNS_6StringES3_
+__ZN7WebCore18DatabaseAuthorizer11allowUpdateERKNS_6StringES3_
+__ZN7WebCoreL16guidToVersionMapEv
+__ZN7WebCore8Database22getVersionFromDatabaseERNS_6StringE
+__ZN7WebCoreL18databaseVersionKeyEv
+__ZN7WebCore18DatabaseAuthorizer7disableEv
+__ZN7WebCore18DatabaseAuthorizer6enableEv
+__ZN7WebCore8Database20setVersionInDatabaseERKNS_6StringE
+__ZN3WTF7HashMapIiN7WebCore6StringENS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3setERKiRKS2_
+__ZN3WTF9HashTableIiSt4pairIiN7WebCore6StringEENS_18PairFirstExtractorIS4_EENS_7IntHashIjEENS_14PairHashTraitsINS_10HashTraitsI
+__ZN7WebCore8Database19performPolicyChecksEv
+__ZN7WebCore16DatabaseOpenTaskD0Ev
+__ZN7WebCore12DatabaseTaskD2Ev
+__ZN7WebCore15DatabaseTracker18setDatabaseDetailsEPNS_14SecurityOriginERKNS_6StringES5_m
+__ZN7WebCore19InspectorController15didOpenDatabaseEPNS_8DatabaseERKNS_6StringES5_S5_
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8DatabaseE
+__ZN7WebCore10JSDatabase15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSDatabaseC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8DatabaseEEE
+__ZN7WebCore10JSDatabaseC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8DatabaseEEE
+__ZN7WebCore10JSDatabase18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19JSDatabasePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore38jsDatabasePrototypeFunctionTransactionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore10JSDatabase9classInfoEv
+__ZN7WebCore10JSDatabase11transactionEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore30JSCustomSQLTransactionCallbackC1EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore30JSCustomSQLTransactionCallbackC2EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore8Database11transactionEN3WTF10PassRefPtrINS_22SQLTransactionCallbackEEENS2_INS_27SQLTransactionErrorCallbackEEENS2_
+__ZN7WebCore14SQLTransaction6createEPNS_8DatabaseEN3WTF10PassRefPtrINS_22SQLTransactionCallbackEEENS4_INS_27SQLTransactionError
+__ZN7WebCore14SQLTransactionC1EPNS_8DatabaseEN3WTF10PassRefPtrINS_22SQLTransactionCallbackEEENS4_INS_27SQLTransactionErrorCallb
+__ZN7WebCore14SQLTransactionC2EPNS_8DatabaseEN3WTF10PassRefPtrINS_22SQLTransactionCallbackEEENS4_INS_27SQLTransactionErrorCallb
+__ZN3WTF5DequeINS_6RefPtrIN7WebCore14SQLTransactionEEEE14expandCapacityEv
+__ZN7WebCore8Database19scheduleTransactionEv
+__ZN7WebCore23DatabaseTransactionTaskC1EN3WTF10PassRefPtrINS_14SQLTransactionEEE
+__ZN7WebCore23DatabaseTransactionTaskC2EN3WTF10PassRefPtrINS_14SQLTransactionEEE
+__ZN7WebCore14DatabaseThread12scheduleTaskEN3WTF10PassRefPtrINS_12DatabaseTaskEEE
+__ZN7WebCore23DatabaseTransactionTask13doPerformTaskEv
+__ZN7WebCore14SQLTransaction15performNextStepEv
+__ZN7WebCore14SQLTransaction28checkAndHandleClosedDatabaseEv
+__ZN7WebCore14SQLTransaction27openTransactionAndPreflightEv
+__ZNK7WebCore8Database11maximumSizeEv
+__ZNK3WTF7HashMapIN7WebCore6StringENS1_17OriginUsageRecord13DatabaseEntryENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3get
+__ZN7WebCore11getFileSizeERKNS_6StringERx
+__ZNK7WebCore8Database12databaseSizeEv
+__ZN7WebCore14SQLiteDatabase14setMaximumSizeEx
+__ZN7WebCore14SQLiteDatabase8pageSizeEv
+__ZN7WebCore6String6numberEx
+__ZN7WebCore18DatabaseAuthorizer16allowTransactionEv
+__ZN7WebCore8Database27scheduleTransactionCallbackEPNS_14SQLTransactionE
+__ZN7WebCore23DatabaseTransactionTaskD0Ev
+__ZN7WebCore8Database22deliverPendingCallbackEPv
+__ZN7WebCore14SQLTransaction22performPendingCallbackEv
+__ZN7WebCore14SQLTransaction26deliverTransactionCallbackEv
+__ZN7WebCore30JSCustomSQLTransactionCallback11handleEventEPNS_14SQLTransactionERb
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14SQLTransactionE
+__ZN7WebCore16JSSQLTransaction15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSQLTransactionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SQLTransactionEEE
+__ZN7WebCore16JSSQLTransactionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SQLTransactionEEE
+__ZN7WebCore14SQLTransaction31deliverTransactionErrorCallbackEv
+__ZN7WebCore8Database23scheduleTransactionStepEPNS_14SQLTransactionE
+__ZN7WebCore14SQLTransaction36cleanupAfterTransactionErrorCallbackEv
+__ZN7WebCore17SQLiteTransaction8rollbackEv
+__ZN7WebCore30JSCustomSQLTransactionCallbackD0Ev
+__ZN7WebCore30JSCustomSQLTransactionCallback10deleteDataEPv
+__ZN7WebCore25JSSQLTransactionPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore43jsSQLTransactionPrototypeFunctionExecuteSqlEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSSQLTransaction9classInfoEv
+__ZN7WebCore16JSSQLTransaction10executeSqlEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore28JSCustomSQLStatementCallbackC1EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore28JSCustomSQLStatementCallbackC2EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore33JSCustomSQLStatementErrorCallbackC1EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore33JSCustomSQLStatementErrorCallbackC2EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore14SQLTransaction10executeSQLERKNS_6StringERKN3WTF6VectorINS_8SQLValueELm0EEENS4_10PassRefPtrINS_20SQLStatementCallb
+__ZN7WebCore12SQLStatement6createERKNS_6StringERKN3WTF6VectorINS_8SQLValueELm0EEENS4_10PassRefPtrINS_20SQLStatementCallbackEEEN
+__ZN7WebCore12SQLStatementC1ERKNS_6StringERKN3WTF6VectorINS_8SQLValueELm0EEENS4_10PassRefPtrINS_20SQLStatementCallbackEEENSA_IN
+__ZN7WebCore12SQLStatementC2ERKNS_6StringERKN3WTF6VectorINS_8SQLValueELm0EEENS4_10PassRefPtrINS_20SQLStatementCallbackEEENSA_IN
+__ZN3WTF6VectorIN7WebCore8SQLValueELm0EEC1ERKS3_
+__ZN3WTF6VectorIN7WebCore8SQLValueELm0EEC2ERKS3_
+__ZNK7WebCore8Database22versionMatchesExpectedEv
+__ZNK3WTF7HashMapIiN7WebCore6StringENS_7IntHashIjEENS_10HashTraitsIiEENS5_IS2_EEE3getERKi
+__ZN7WebCore14SQLTransaction16enqueueStatementEN3WTF10PassRefPtrINS_12SQLStatementEEE
+__ZN3WTF5DequeINS_6RefPtrIN7WebCore12SQLStatementEEEE14expandCapacityEv
+__ZN3WTF16ThreadSafeSharedIN7WebCore12SQLStatementEE5derefEv
+__ZN7WebCore14SQLTransaction23scheduleToRunStatementsEv
+__ZN7WebCore14SQLTransaction13runStatementsEv
+__ZN7WebCore14SQLTransaction16getNextStatementEv
+__ZN7WebCore14SQLTransaction19runCurrentStatementEv
+__ZN7WebCore12SQLStatement7executeEPNS_8DatabaseE
+__ZN7WebCore12SQLStatement22clearFailureDueToQuotaEv
+__ZNK7WebCore12SQLStatement29lastExecutionFailedDueToQuotaEv
+__ZN7WebCore14SQLiteDatabase12lastErrorMsgEv
+__ZN7WebCore14SQLTransaction27handleCurrentStatementErrorEv
+__ZN7WebCore14SQLTransaction24deliverStatementCallbackEv
+__ZN7WebCore12SQLStatement15performCallbackEPNS_14SQLTransactionE
+__ZN7WebCore33JSCustomSQLStatementErrorCallback11handleEventEPNS_14SQLTransactionEPNS_8SQLErrorE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8SQLErrorE
+__ZN7WebCore10JSSQLError15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSSQLErrorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SQLErrorEEE
+__ZN7WebCore10JSSQLErrorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SQLErrorEEE
+__ZN7WebCore28JSCustomSQLStatementCallbackD0Ev
+__ZN7WebCore33JSCustomSQLStatementErrorCallbackD0Ev
+__ZN7WebCore14SQLTransaction22handleTransactionErrorEb
+__ZN7WebCore10JSSQLErrorD1Ev
+__ZN7WebCore10JSSQLErrorD2Ev
+__ZN7WebCore16JSSQLTransactionD1Ev
+__ZN7WebCore16JSSQLTransactionD2Ev
+__ZN7WebCore14SQLTransactionD1Ev
+__ZN7WebCore14SQLTransactionD2Ev
+__ZN7WebCore8Database4stopEv
+__ZN7WebCore14DatabaseThread23unscheduleDatabaseTasksEPNS_8DatabaseE
+__ZN7WebCore14DatabaseThread18requestTerminationEv
+__ZN7WebCore19JSSQLErrorPrototypeD1Ev
+__ZN7WebCore25JSSQLTransactionPrototypeD1Ev
+__ZN7WebCore10JSDatabaseD1Ev
+__ZN7WebCore10JSDatabaseD2Ev
+__ZN7WebCore8DatabaseD1Ev
+__ZN7WebCore8DatabaseD2Ev
+__ZN3WTF9HashTableIPN7WebCore8DatabaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_22I
+__ZN3WTF9HashTableIPN7WebCore8DatabaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndInva
+__ZN3WTF9HashTableIPN7WebCore8DatabaseES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore15DatabaseTracker18removeOpenDatabaseEPNS_8DatabaseE
+__ZN7WebCore8Document18removeOpenDatabaseEPNS_8DatabaseE
+__ZN7WebCore14SQLiteDatabaseD1Ev
+__ZN7WebCore14SQLiteDatabaseD2Ev
+__ZN7WebCore19JSDatabasePrototypeD1Ev
+__ZN7WebCore14DatabaseThreadD1Ev
+__ZN7WebCore14DatabaseThreadD2Ev
+__ZN7WebCore15JSMimeTypeArray18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore15JSMimeTypeArray11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore13MimeTypeArray4itemEj
+__ZN7WebCore14jsMimeTypeTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8MimeType4typeEv
+__ZNK7WebCore16JSDOMWindowShell21getPropertyAttributesEPN3JSC9ExecStateERKNS1_10IdentifierERj
+__ZNK7WebCore11JSDOMWindow21getPropertyAttributesEPN3JSC9ExecStateERKNS1_10IdentifierERj
+__ZNK7WebCore9RenderBox20firstLineBoxBaselineEv
+__ZN7WebCore10ClientRectC1Ev
+__ZN7WebCore10ClientRectC2Ev
+__ZN7WebCoreL14isSVG11FeatureERKNS_6StringE
+__ZN7WebCoreL9addStringERN3WTF7HashSetINS_6StringENS_15CaseFoldingHashENS0_10HashTraitsIS2_EEEEPKc
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E4findIS2_NS_2
+__ZN7WebCore40setJSCanvasRenderingContext2DGlobalAlphaEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D14setGlobalAlphaEf
+__ZN7WebCore12RenderInline20childBecameNonInlineEPNS_12RenderObjectE
+__ZN7WebCore12EventHandler20resizeLayerDestroyedEv
+__ZN7WebCore14RenderThemeMac20paintMediaMuteButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac20paintMediaPlayButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac21paintMediaSliderTrackEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac21paintMediaSliderThumbEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac24paintMediaSeekBackButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZN7WebCore14RenderThemeMac27paintMediaSeekForwardButtonEPNS_12RenderObjectERKNS1_9PaintInfoERKNS_7IntRectE
+__ZNK7WebCore11RenderVideo10renderNameEv
+__ZN7WebCoreL19metadataConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore18SVGMetadataElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore18SVGMetadataElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZThn240_NK7WebCore18SVGGradientElement14contextElementEv
+__ZNK7WebCore18SVGGradientElement14contextElementEv
+__ZNK3WTF9HashTableIPKN7WebCore18SVGGradientElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E8c
+__ZN7WebCore18SVGMetadataElementD0Ev
+__ZN7WebCoreL8toHebrewEi
+__ZN7WebCoreL17toHebrewUnder1000EiPt
+__ZN7WebCore14ResourceHandle15scheduleFailureENS0_11FailureTypeE
+__ZN7WebCore11FrameLoader27checkLoadCompleteTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore9CSSParser24createFloatingMediaQueryEPN3WTF6VectorIPNS_13MediaQueryExpELm0EEE
+__ZN7WebCoreL21colorMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore23screenDepthPerComponentEPNS_6WidgetE
+__ZN7WebCoreL20parseMediaDescriptorERKNS_6StringE
+__ZN7WebCoreL30min_monochromeMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL26monochromeMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore18screenIsMonochromeEPNS_6WidgetE
+__ZN7WebCoreL11numberValueEPNS_8CSSValueERf
+__ZN7WebCoreL25animationMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL28aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL32min_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL32max_aspect_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL20gridMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL26max_heightMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL22heightMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore40jsMediaListPrototypeFunctionDeleteMediumEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore9MediaList12deleteMediumERKNS_6StringERi
+__ZN7WebCore40jsMediaListPrototypeFunctionAppendMediumEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9MediaList12appendMediumERKNS_6StringERi
 __ZNK7WebCore10MediaQueryeqERKS0_
-__ZN7WebCore38max_device_pixel_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZN7WebCore20gridMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_4PageENS_18MediaFeaturePrefixE
-__ZNK7WebCore27TranslateTransformOperationeqERKNS_18TransformOperationE
-__ZNK7WebCore23WebKitCSSTransformValue7cssTextEv
-__ZNK7WebCore12RenderApplet13intrinsicSizeEv
-__ZN7WebCore12RenderInline6layoutEv
-__ZN7WebCore17HTMLOptionElement16rendererIsNeededEPNS_11RenderStyleE
-__ZN7WebCore17CSSPrimitiveValueD2Ev
-__ZN7WebCore22addDirectionalOverrideERKNS_7TextRunEb
+__ZN7WebCoreL38max_device_pixel_ratioMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL27orientationMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore32setJSHTMLTextAreaElementReadOnlyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCoreL26min_heightMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL28transform_2dMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL28transform_3dMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL26transitionMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore27MediaControlTimelineElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore16PDFDocumentImage18destroyDecodedDataEb
+__ZN7WebCore16PDFDocumentImageD0Ev
+__ZNK7WebCore17StyleMultiColDataeqERKS0_
+__ZN7WebCoreL26ignorableWhitespaceHandlerEPvPKhi
+__ZL18initxsltNextImportP15_xsltStylesheet
+__ZN3WTF6VectorIN3JSC16ProtectedJSValueELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN3JSC16ProtectedJSValueELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN3JSC16ProtectedJSValueELm0EE6shrinkEm
+__ZN7WebCore13HTMLTokenizer9parseTextERNS_15SegmentedStringENS0_5StateE
+__ZN7WebCore19InspectorController14enableProfilerEb
+__ZN7WebCore21JavaScriptDebugServer27recompileAllJSFunctionsSoonEv
+__ZN7WebCore33jsConsolePrototypeFunctionProfileEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console7profileERKN3JSC7UStringEPNS_15ScriptCallStackE
+__ZN7WebCore36jsConsolePrototypeFunctionProfileEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console10profileEndERKN3JSC7UStringEPNS_15ScriptCallStackE
+__ZN3WTF6VectorINS_6RefPtrIN3JSC7ProfileEEELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorINS_6RefPtrIN3JSC7ProfileEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN3JSC7ProfileEEELm0EE15reserveCapacityEm
+__ZN7WebCore19InspectorController10addProfileEN3WTF10PassRefPtrIN3JSC7ProfileEEEjRKNS3_7UStringE
+__ZN7WebCore19InspectorController26addProfileMessageToConsoleEN3WTF10PassRefPtrIN3JSC7ProfileEEEjRKNS3_7UStringE
+__ZN7WebCore14ConsoleMessageC1ENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS5_j
+__ZN7WebCore14ConsoleMessageC2ENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS5_j
+__ZN7WebCore19InspectorController17addConsoleMessageEPN3JSC9ExecStateEPNS_14ConsoleMessageE
+__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE15reserveCapacityEm
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS0_7ProfileE
+__ZN7WebCoreL12profileCacheEv
+__ZNK3WTF7HashMapIPN3JSC7ProfileEPNS1_8JSObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
+__ZN7WebCoreL12ProfileClassEv
+__ZN3WTF7HashMapIPN3JSC7ProfileEPNS1_8JSObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS5_
+__ZN3WTF9HashTableIPN3JSC7ProfileESt4pairIS3_PNS1_8JSObjectEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTraitsI
+__ZN7WebCoreL16getTitleCallbackEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL15getHeadCallbackEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS0_11ProfileNodeE
+__ZN7WebCoreL16profileNodeCacheEv
+__ZNK3WTF7HashMapIPN3JSC11ProfileNodeEPNS1_8JSObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3getERKS3_
+__ZN7WebCore16ProfileNodeClassEv
+__ZN3WTF7HashMapIPN3JSC11ProfileNodeEPNS1_8JSObjectENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3setERKS3_RKS5_
+__ZN3WTF9HashTableIPN3JSC11ProfileNodeESt4pairIS3_PNS1_8JSObjectEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHashTr
+__ZN7WebCoreL15getFunctionNameEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL10getVisibleEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL6getURLEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL13getLineNumberEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL11getChildrenEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZNK3WTF7HashMapIxNS_6RefPtrIN7WebCore17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS7_IS4_EEE3getERKx
+__ZN7WebCore5TimerINS_21JavaScriptDebugServerEE5firedEv
+__ZN7WebCore21JavaScriptDebugServer23recompileAllJSFunctionsEPNS_5TimerIS0_EE
+__ZNK3JSC21CollectorHeapIteratorILNS_8HeapTypeE0EEdeEv
+__ZN3JSC21CollectorHeapIteratorILNS_8HeapTypeE0EEppEv
+__ZN3WTF6VectorIN3JSC12ProtectedPtrINS1_10JSFunctionEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN3JSC12ProtectedPtrINS1_10JSFunctionEEELm0EE15reserveCapacityEm
+__ZN3WTF7HashMapINS_6RefPtrIN3JSC16FunctionBodyNodeEEES4_NS_7PtrHashIS4_EENS_10HashTraitsIS4_EES8_E3addEPS3_RKS4_
+__ZN3WTF9HashTableINS_6RefPtrIN3JSC16FunctionBodyNodeEEESt4pairIS4_S4_ENS_18PairFirstExtractorIS6_EENS_7PtrHashIS4_EENS_14PairH
+__ZN3JSC6Parser5parseINS_16FunctionBodyNodeEEEN3WTF10PassRefPtrIT_EEPNS_9ExecStateEPNS_8DebuggerERKNS_10SourceCodeEPiPNS_7UStri
+__ZN3WTF6VectorIN3JSC12ProtectedPtrINS1_10JSFunctionEEELm0EE6shrinkEm
+__ZN7WebCoreL8finalizeEP13OpaqueJSValue
+__ZNK7WebCore14ConsoleMessage7isEqualEPN3JSC9ExecStateEPS0_
+__ZN3WTF6VectorINS_6RefPtrIN3JSC7ProfileEEELm0EE6shrinkEm
+__ZN7WebCoreL12callNodeListEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore17InspectorResourceC1ExPNS_14DocumentLoaderE
+__ZN7WebCore17InspectorResourceC2ExPNS_14DocumentLoaderE
+__ZN7WebCore17InspectorResource13updateRequestERKNS_15ResourceRequestE
+__ZN7WebCore19InspectorController11addResourceEPNS_17InspectorResourceE
+__ZN3WTF7HashMapIxNS_6RefPtrIN7WebCore17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS7_IS4_EEE3setERKxRKS4_
+__ZNK3WTF7HashMapINS_6RefPtrIN7WebCore5FrameEEEPNS0_IxNS1_INS2_17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS9_IS6_
+__ZN3WTF7HashMapINS_6RefPtrIN7WebCore5FrameEEEPNS0_IxNS1_INS2_17InspectorResourceEEENS_7IntHashIyEENS_10HashTraitsIxEENS9_IS6_E
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore5FrameEEESt4pairIS4_PNS_7HashMapIxNS1_INS2_17InspectorResourceEEENS_7IntHashIyEENS_10Has
+__ZN7WebCore17InspectorResource11startTimingEv
+__ZN7WebCore17InspectorResource14updateResponseERKNS_16ResourceResponseE
+__ZN7WebCore17InspectorResource24markResponseReceivedTimeEv
+__ZN7WebCore19InspectorController14pruneResourcesEPN3WTF7HashMapIxNS1_6RefPtrINS_17InspectorResourceEEENS1_7IntHashIyEENS1_10Ha
+__ZN3WTF9HashTableIxSt4pairIxNS_6RefPtrIN7WebCore17InspectorResourceEEEENS_18PairFirstExtractorIS6_EENS_7IntHashIyEENS_14PairHa
+__ZN7WebCore17InspectorResource9addLengthEi
+__ZN7WebCore19InspectorController14removeResourceEPNS_17InspectorResourceE
+__ZN7WebCore17InspectorResource9endTimingEv
+__ZN7WebCore19InspectorController27startUserInitiatedProfilingEPNS_5TimerIS0_EE
+__ZN7WebCore19InspectorController18toggleRecordButtonEb
+__ZN7WebCore22CSSQuirkPrimitiveValueD0Ev
+__ZN7WebCore16jsStyleSheetHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18RenderTableSection16leftmostPositionEbb
+__ZNK7WebCore4Font31offsetForPositionForComplexTextERKNS_7TextRunEib
+__ZN7WebCore18CoreTextController17offsetForPositionEib
+__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE11reverseRunsEjj
 __ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE5embedEN3WTF7Unicode9DirectionE
-__ZNK7WebCore24MatrixTransformOperationeqERKNS_18TransformOperationE
-__ZNK7WebCore24MatrixTransformOperation17isMatrixOperationEv
-__ZN7WebCore24MatrixTransformOperationD1Ev
-__ZN7WebCore24MatrixTransformOperation5applyERNS_15AffineTransformERKNS_7IntSizeE
-__ZNK7WebCore15AffineTransform8mapPointERKNS_8IntPointE
-__ZN7WebCore10ShadowDataD2Ev
-__ZN7WebCore19HTMLTextAreaElement7setColsEi
-__ZN7WebCore13RenderListBox24isPointInOverflowControlERNS_13HitTestResultEiiii
-__ZN7WebCore4Path10addEllipseERKNS_9FloatRectE
-__ZSt21__unguarded_partitionIPPN7WebCore13InlineTextBoxES2_PFbPKS1_S5_EET_S8_S8_T0_T1_
-__ZN7WebCore24CanvasRenderingContext2D14setGlobalAlphaEf
-__ZN7WebCore15GraphicsContext8setAlphaEf
-__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_17HTMLCanvasElementEff
-__ZN7WebCore16PDFDocumentImageD1Ev
-__ZNK7WebCore16DeprecatedString5rightEj
+__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE23commitExplicitEmbeddingEv
+__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE27raiseExplicitEmbeddingLevelEN3WTF7Unicode9DirectionES6
+__ZN7WebCore12BidiResolverINS_15TextRunIteratorENS_16BidiCharacterRunEE27lowerExplicitEmbeddingLevelEN3WTF7Unicode9DirectionE
+__ZN7WebCore36jsRangePrototypeFunctionSetEndBeforeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore5Range12setEndBeforeEPNS_4NodeERi
+__ZN3WTF6VectorI6CGSizeLm256EE14expandCapacityEmPKS1_
+__ZN3WTF6VectorI6CGSizeLm256EE14expandCapacityEm
+__ZN3WTF6VectorI6CGSizeLm256EE15reserveCapacityEm
+__ZN3WTF6VectorItLm256EE14expandCapacityEmPKt
+__ZN3WTF6VectorItLm256EE14expandCapacityEm
+__ZN3WTF6VectorItLm256EE15reserveCapacityEm
+__ZN7WebCore32setJSHTMLTableCellElementRowSpanEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20HTMLTableCellElement10setRowSpanEi
+__ZN7WebCore8JSWorker3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore20setJSWorkerOnmessageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17jsWorkerOnmessageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSWorkerContext18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore15JSWorkerContext24customGetOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL23getJSWorkerContextTableEPN3JSC9ExecStateE
+__ZN7WebCore24JSWorkerContextPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL32getJSWorkerContextPrototypeTableEPN3JSC9ExecStateE
+__ZNK7WebCore15JSWorkerContext9classInfoEv
+__ZN7WebCore15JSWorkerContext4markEv
+__ZNK7WebCore19JSWorkerContextBase22scriptExecutionContextEv
+__ZN7WebCore43jsWorkerContextPrototypeFunctionPostMessageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13WorkerContext11postMessageERKNS_6StringE
+__ZThn8_N7WebCore20WorkerMessagingProxy25postMessageToWorkerObjectERKNS_6StringE
+__ZN7WebCore20WorkerMessagingProxy25postMessageToWorkerObjectERKNS_6StringE
+__ZN7WebCore17MessageWorkerTask11performTaskEPNS_22ScriptExecutionContextE
+__ZN7WebCore6Worker15dispatchMessageERKNS_6StringE
+__ZThn32_N7WebCore6Worker14refEventTargetEv
+__ZN7WebCore6Worker14refEventTargetEv
+__ZN7WebCore11EventTarget16toXMLHttpRequestEv
+__ZN7WebCore11EventTarget22toXMLHttpRequestUploadEv
+__ZN7WebCore11EventTarget21toDOMApplicationCacheEv
+__ZN7WebCore11EventTarget13toMessagePortEv
+__ZThn32_N7WebCore6Worker8toWorkerEv
+__ZN7WebCore6Worker8toWorkerEv
+__ZN7WebCore17MessageWorkerTaskD0Ev
+__ZNK3JSC14JSGlobalObject21shouldInterruptScriptEv
+__ZN7WebCore19WebCoreJSClientDataD0Ev
+__ZThn32_N7WebCore6Worker16derefEventTargetEv
+__ZN7WebCore6Worker16derefEventTargetEv
+__ZN7WebCore18setJSWorkerOnerrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore6Worker18dispatchErrorEventEv
+__ZN7WebCore36jsWorkerPrototypeFunctionPostMessageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore6Worker11postMessageERKNS_6StringE
+__ZN7WebCore20WorkerMessagingProxy26postMessageToWorkerContextERKNS_6StringE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore22ScriptExecutionContext4TaskEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore22ScriptExecutionContext4TaskEEELm0EE15reserveCapacityEm
+__ZN7WebCore13WorkerRunLoop8postTaskEN3WTF10PassRefPtrINS_22ScriptExecutionContext4TaskEEE
+__ZN7WebCore13WorkerRunLoop15postTaskForModeEN3WTF10PassRefPtrINS_22ScriptExecutionContext4TaskEEERKNS_6StringE
+__ZN3WTF5DequeINS_6RefPtrIN7WebCore13WorkerRunLoop4TaskEEEE14expandCapacityEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore22ScriptExecutionContext4TaskEEELm0EE6shrinkEm
+__ZN7WebCore15JSWorkerContext3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore27setJSWorkerContextOnmessageEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24MessageWorkerContextTask11performTaskEPNS_22ScriptExecutionContextE
+__ZN7WebCore13WorkerContext15dispatchMessageERKNS_6StringE
+__ZThn96_N7WebCore13WorkerContext14refEventTargetEv
+__ZN7WebCore13WorkerContext14refEventTargetEv
+__ZNK7WebCore22ScriptExecutionContext10isDocumentEv
+__ZN7WebCore11EventTarget8toWorkerEv
+__ZThn96_N7WebCore13WorkerContext15toWorkerContextEv
+__ZN7WebCore13WorkerContext15toWorkerContextEv
+__ZNK7WebCore13WorkerContext15isWorkerContextEv
+__ZN7WebCore24jsWorkerContextNavigatorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13WorkerContext9navigatorEv
+__ZN7WebCore15WorkerNavigatorC1ERKNS_6StringE
+__ZN7WebCore15WorkerNavigatorC2ERKNS_6StringE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_15WorkerNavigatorE
+__ZN7WebCore17JSWorkerNavigator15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSWorkerNavigatorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15WorkerNavigatorEEE
+__ZN7WebCore17JSWorkerNavigatorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15WorkerNavigatorEEE
+__ZN7WebCore17JSWorkerNavigator18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL25getJSWorkerNavigatorTableEPN3JSC9ExecStateE
+__ZN7WebCore13WorkerContext13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
+__ZThn8_N7WebCore20WorkerMessagingProxy30confirmMessageFromWorkerObjectEb
+__ZN7WebCore20WorkerMessagingProxy30confirmMessageFromWorkerObjectEb
+__ZN7WebCore24MessageWorkerContextTaskD0Ev
+__ZThn96_N7WebCore13WorkerContext16derefEventTargetEv
+__ZN7WebCore13WorkerContext16derefEventTargetEv
+__ZN7WebCore23jsWorkerContextLocationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13WorkerContext8locationEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14WorkerLocationE
+__ZN7WebCore16JSWorkerLocation15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSWorkerLocationC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14WorkerLocationEEE
+__ZN7WebCore16JSWorkerLocationC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14WorkerLocationEEE
+__ZN7WebCore16JSWorkerLocation18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL24getJSWorkerLocationTableEPN3JSC9ExecStateE
+__ZN7WebCore17JSWorkerNavigatorD1Ev
+__ZN7WebCore17JSWorkerNavigatorD2Ev
+__ZN7WebCore26JSWorkerNavigatorPrototypeD1Ev
+__ZN7WebCore16JSWorkerLocationD1Ev
+__ZN7WebCore16JSWorkerLocationD2Ev
+__ZN7WebCore25JSWorkerLocationPrototypeD1Ev
+__ZN7WebCore15WorkerNavigatorD0Ev
+__ZN7WebCore48jsWorkerContextPrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSWorkerContext16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13WorkerContext16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EE15reserveCapacityEm
+__ZN3WTF7HashMapIN7WebCore12AtomicStringENS_6VectorINS_6RefPtrINS1_13EventListenerEEELm0EEENS1_16AtomicStringHashENS_10HashTrai
+__ZN3WTF9HashTableIN7WebCore12AtomicStringESt4pairIS2_NS_6VectorINS_6RefPtrINS1_13EventListenerEEELm0EEEENS_18PairFirstExtracto
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EEC1ERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EEC2ERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EEaSERKS5_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore13EventListenerEEELm0EE6shrinkEm
+__ZN7WebCore51jsWorkerContextPrototypeFunctionRemoveEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSWorkerContext19removeEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13WorkerContext19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
+__ZN7WebCore45jsWorkerContextPrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore40jsWorkerContextWorkerLocationConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSWorkerLocation14getConstructorEPN3JSC9ExecStateE
+__ZN7WebCore27JSWorkerLocationConstructorC2EPN3JSC9ExecStateE
+__ZN7WebCore25JSWorkerLocationPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSWorkerLocationConstructor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27JSWorkerLocationConstructor9classInfoEv
+__ZN7WebCore25JSWorkerLocationPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL33getJSWorkerLocationPrototypeTableEPN3JSC9ExecStateE
+__ZN7WebCore41jsWorkerLocationPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSWorkerLocation9classInfoEv
+__ZNK7WebCore14WorkerLocation8toStringEv
+__ZN7WebCore20jsWorkerLocationHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14WorkerLocation4hrefEv
+__ZN7WebCore24jsWorkerLocationProtocolEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14WorkerLocation8protocolEv
+__ZN7WebCore20jsWorkerLocationHostEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14WorkerLocation4hostEv
+__ZN7WebCore24jsWorkerLocationHostnameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14WorkerLocation8hostnameEv
+__ZN7WebCore20jsWorkerLocationPortEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14WorkerLocation4portEv
+__ZN7WebCore24jsWorkerLocationPathnameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14WorkerLocation8pathnameEv
+__ZN7WebCore22jsWorkerLocationSearchEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14WorkerLocation6searchEv
+__ZN7WebCore20jsWorkerLocationHashEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore14WorkerLocation4hashEv
+__ZN7WebCore27JSWorkerLocationConstructorD1Ev
+__ZNK7WebCore17JSWorkerNavigator9classInfoEv
+__ZN7WebCore24jsWorkerNavigatorAppNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsWorkerNavigatorAppVersionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15WorkerNavigator9userAgentEv
+__ZN7WebCore25jsWorkerNavigatorPlatformEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsWorkerNavigatorUserAgentEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsWorkerNavigatorOnLineEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsWorkerContextSelfEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_13WorkerContextE
+__ZN7WebCore41setJSWorkerContextMessageEventConstructorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore22setJSWorkerContextSelfEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore34jsWorkerPrototypeFunctionTerminateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore42jsWorkerContextPrototypeFunctionSetTimeoutEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSWorkerContext10setTimeoutEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13WorkerContext10setTimeoutEPNS_15ScheduledActionEi
+__ZNK7WebCore13WorkerContext22scriptExecutionContextEv
+__ZN7WebCore44jsWorkerContextPrototypeFunctionClearTimeoutEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13WorkerContext12clearTimeoutEi
+__ZN7WebCore43jsWorkerContextPrototypeFunctionSetIntervalEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSWorkerContext11setIntervalEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13WorkerContext11setIntervalEPNS_15ScheduledActionEi
+__ZN7WebCore17WorkerSharedTimer11setFireTimeEd
+__ZN7WebCore15ScheduledAction7executeEPNS_13WorkerContextE
+__ZN7WebCore45jsWorkerContextPrototypeFunctionClearIntervalEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13WorkerContext13clearIntervalEi
+__ZN7WebCore23jsXMLHttpRequestOnabortEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsXMLHttpRequestOnerrorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsXMLHttpRequestOnloadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsXMLHttpRequestOnloadstartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsXMLHttpRequestOnprogressEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsXMLHttpRequestOnreadystatechangeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsXMLHttpRequestUploadOnabortEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsXMLHttpRequestUploadOnerrorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsXMLHttpRequestUploadOnloadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsXMLHttpRequestUploadOnloadstartEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsXMLHttpRequestUploadOnprogressEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore29JSXMLHttpRequestProgressEvent9classInfoEv
+__ZN7WebCoreL37getJSXMLHttpRequestProgressEventTableEPN3JSC9ExecStateE
+__ZNK7WebCore38JSXMLHttpRequestProgressEventPrototype9classInfoEv
+__ZN7WebCoreL46getJSXMLHttpRequestProgressEventPrototypeTableEPN3JSC9ExecStateE
+__ZNK7WebCore24JSProgressEventPrototype9classInfoEv
+__ZN7WebCore29JSXMLHttpRequestProgressEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore37jsXMLHttpRequestProgressEventPositionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsXMLHttpRequestProgressEventTotalSizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsRangePrototypeFunctionCollapseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore5XPath5Union8evaluateEv
+__ZNK7WebCore5XPath12FunSubstring8evaluateEv
+__ZN7WebCore5XPath8FunRound5roundEd
+__ZN7WebCore5XPath4PathC1EPNS0_6FilterEPNS0_12LocationPathE
+__ZN7WebCore5XPath4PathC2EPNS0_6FilterEPNS0_12LocationPathE
+__ZNK7WebCore5XPath4Path8evaluateEv
+__ZN7WebCore5XPath4PathD0Ev
+__ZNK7WebCore5XPath9FunNumber8evaluateEv
+__ZNK7WebCore5XPath15FunStringLength8evaluateEv
+__ZNK7WebCore5XPath17FunNormalizeSpace8evaluateEv
+__ZNK7WebCore5XPath7FunName8evaluateEv
+__ZN7WebCoreL24createSVGGElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore13JSSVGGElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSSVGGElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11SVGGElementEEE
+__ZN7WebCore13JSSVGGElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11SVGGElementEEE
+__ZN7WebCore13JSSVGGElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore13JSSVGGElement9classInfoEv
+__ZNK7WebCore5XPath17FunSubstringAfter8evaluateEv
+__ZNK7WebCore5XPath8FunFalse8evaluateEv
+__ZN7WebCore13JSSVGGElementD1Ev
+__ZN7WebCore22JSSVGGElementPrototypeD1Ev
+__ZThn8_N7WebCore11SVGGElementD0Ev
+__ZN3WTF6VectorItLm1024EE14expandCapacityEmPKt
+__ZN3WTF6VectorItLm1024EE14expandCapacityEm
+__ZN3WTF6VectorItLm1024EE15reserveCapacityEm
+__ZNK7WebCore5XPath12FunTranslate8evaluateEv
+__ZNK7WebCore5XPath10FunBoolean8evaluateEv
+__ZNK7WebCore5XPath7FunTrue8evaluateEv
+__ZNK7WebCore5XPath7FunLang8evaluateEv
+__ZN7WebCore5XPathL12createFunSumEv
+__ZNK7WebCore5XPath6FunSum8evaluateEv
+__ZN7WebCore5XPath6FunSumD0Ev
+__ZNK7WebCore5XPath8FunFloor8evaluateEv
+__ZNK7WebCore5XPath10FunCeiling8evaluateEv
+__ZNK7WebCore5XPath8FunRound8evaluateEv
+__ZNK7WebCore5XPath8Negative8evaluateEv
+__ZNK7WebCore5XPath8FunCount8evaluateEv
+__ZNK7WebCore5XPath15FunNamespaceURI8evaluateEv
+__ZN7WebCore48jsXSLTProcessorPrototypeFunctionImportStylesheetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSXSLTProcessor16importStylesheetEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore51jsXSLTProcessorPrototypeFunctionTransformToFragmentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSXSLTProcessor19transformToFragmentEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13XSLTProcessor19transformToFragmentEPNS_4NodeEPNS_8DocumentE
+__ZN7WebCoreL13docLoaderFuncEPKhP8_xmlDictiPv12xsltLoadType
+__ZN7WebCoreL20exsltNodeSetFunctionEP22_xmlXPathParserContexti
+__ZL23initxsltFunctionNodeSetP22_xmlXPathParserContexti
+__ZN7WebCore44jsXSLTProcessorPrototypeFunctionSetParameterEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSXSLTProcessor12setParameterEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13XSLTProcessor12setParameterERKNS_6StringES3_S3_
+__ZN7WebCore44jsXSLTProcessorPrototypeFunctionGetParameterEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSXSLTProcessor12getParameterEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore13XSLTProcessor12getParameterERKNS_6StringES3_
+__ZL17initxsltGetNsPropP8_xmlNodePKhS2_
+__ZN7WebCore13XSLStyleSheet14loadChildSheetERKNS_6StringE
+__ZN7WebCore13XSLImportRuleC1EPNS_13XSLStyleSheetERKNS_6StringE
+__ZN7WebCore13XSLImportRuleC2EPNS_13XSLStyleSheetERKNS_6StringE
+__ZN7WebCore13XSLImportRule9loadSheetEv
+__ZNK7WebCore13XSLStyleSheet15isXSLStyleSheetEv
+__ZNK7WebCore13XSLImportRule16parentStyleSheetEv
+__ZN7WebCore13XSLImportRule12isImportRuleEv
+__ZN7WebCore13XSLImportRule9isLoadingEv
+__ZThn24_N7WebCore13XSLImportRule16setXSLStyleSheetERKNS_6StringES3_
+__ZN7WebCore13XSLImportRule16setXSLStyleSheetERKNS_6StringES3_
+__ZN7WebCore13XSLStyleSheetC1EPNS_13XSLImportRuleERKNS_6StringE
+__ZN7WebCore13XSLStyleSheetC2EPNS_13XSLImportRuleERKNS_6StringE
+__ZN7WebCore13XSLStyleSheet19setParentStyleSheetEPS0_
+__ZN7WebCore13XSLStyleSheet27locateStylesheetSubResourceEP7_xmlDocPKh
+__ZN7WebCore13XSLStyleSheet15markAsProcessedEv
+__ZN7WebCore13XSLImportRuleD0Ev
+__ZN7WebCore51jsXSLTProcessorPrototypeFunctionTransformToDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSXSLTProcessor19transformToDocumentEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13XSLTProcessor19transformToDocumentEPNS_4NodeE
+__ZN7WebCore23xsltUnicodeSortFunctionEP21_xsltTransformContextPP8_xmlNodei
+__ZL25initxsltComputeSortResultP21_xsltTransformContextP8_xmlNode
+__ZNK7WebCore9DocLoader24printAccessDeniedMessageERKNS_4KURLE
+__ZNK7WebCore9StyleBase15isXSLStyleSheetEv
+__ZN7WebCore13XSLTProcessor14parseErrorFuncEPvP9_xmlError
+__ZN7WebCore37jsXSLTProcessorPrototypeFunctionResetEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore47jsXSLTProcessorPrototypeFunctionRemoveParameterEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSXSLTProcessor15removeParameterEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13XSLTProcessor15removeParameterERKNS_6StringES3_
+__ZN7WebCore47jsXSLTProcessorPrototypeFunctionClearParametersEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZL24initxsltLoadStylesheetPIP7_xmlDoc
+__ZN7WebCore21ApplicationCacheGroup11selectCacheEPNS_5FrameERKNS_4KURLE
+__ZN7WebCore23ApplicationCacheStorage22findOrCreateCacheGroupERKNS_4KURLE
+__ZN3WTF7HashMapIN7WebCore6StringEPNS1_21ApplicationCacheGroupENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3addERKS2_RKS4_
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_21ApplicationCacheGroupEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_1
+__ZN7WebCore23ApplicationCacheStorage14loadCacheGroupERKNS_4KURLE
+__ZN7WebCore21ApplicationCacheGroupC1ERKNS_4KURLEb
+__ZN7WebCore21ApplicationCacheGroupC2ERKNS_4KURLEb
+__ZN3WTF7HashMapIjjN7WebCore13AlreadyHashedENS_10HashTraitsIjEES4_E3addERKjS7_
+__ZN3WTF9HashTableIjSt4pairIjjENS_18PairFirstExtractorIS2_EEN7WebCore13AlreadyHashedENS_14PairHashTraitsINS_10HashTraitsIjEES9_
+__ZN7WebCore14DocumentLoader33setCandidateApplicationCacheGroupEPNS_21ApplicationCacheGroupE
+__ZN3WTF7HashSetIPN7WebCore14DocumentLoaderENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore14DocumentLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandE
+__ZN3WTF9HashTableIPN7WebCore14DocumentLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashE
+__ZN3WTF9HashTableIPN7WebCore14DocumentLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13alloca
+__ZN3WTF9HashTableIPN7WebCore14DocumentLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deallo
+__ZN7WebCore21ApplicationCacheGroup6updateEPNS_5FrameENS_28ApplicationCacheUpdateOptionE
+__ZN7WebCore21ApplicationCacheGroup16postListenerTaskEMNS_19DOMApplicationCacheEFvvERKN3WTF7HashSetIPNS_14DocumentLoaderENS4_7P
+__ZN7WebCore21ApplicationCacheGroup16postListenerTaskEMNS_19DOMApplicationCacheEFvvEPNS_14DocumentLoaderE
+__ZN7WebCore21ApplicationCacheGroup20createResourceHandleERKNS_4KURLEPNS_24ApplicationCacheResourceE
+__ZN7WebCore54jsDOMApplicationCachePrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore21JSDOMApplicationCache16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore19DOMApplicationCache22scriptExecutionContextEv
+__ZN7WebCore19DOMApplicationCache16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZN7WebCore21ApplicationCacheGroup27finishedLoadingMainResourceEPNS_14DocumentLoaderE
+__ZN7WebCore20ResourceHandleClient26shouldUseCredentialStorageEPNS_14ResourceHandleE
+__ZN7WebCore31ScriptExecutionContextTaskTimer5firedEv
+__ZN7WebCore21CallCacheListenerTask11performTaskEPNS_22ScriptExecutionContextE
+__ZN7WebCore19DOMApplicationCache20callCheckingListenerEv
+__ZN7WebCore19DOMApplicationCache12callListenerERKNS_12AtomicStringEPNS_13EventListenerE
+__ZN7WebCore19DOMApplicationCache14refEventTargetEv
+__ZN7WebCore19DOMApplicationCache21toDOMApplicationCacheEv
+__ZN7WebCore31ScriptExecutionContextTaskTimerD0Ev
+__ZN7WebCore21CallCacheListenerTaskD0Ev
+__ZN7WebCore20ResourceHandleClient17willCacheResponseEPNS_14ResourceHandleEP19NSCachedURLResponse
+__ZN7WebCore20ResourceHandleClient17willCacheResponseEPNS_14ResourceHandleERNS_18CacheStoragePolicyE
+__ZN7WebCore21ApplicationCacheGroup18didReceiveResponseEPNS_14ResourceHandleERKNS_16ResourceResponseE
+__ZN7WebCore21ApplicationCacheGroup26didReceiveManifestResponseERKNS_16ResourceResponseE
+__ZN7WebCore21ApplicationCacheGroup16manifestNotFoundEv
+__ZN7WebCore21ApplicationCacheGroup12makeObsoleteEv
+__ZN7WebCore23ApplicationCacheStorage22cacheGroupMadeObsoleteEPNS_21ApplicationCacheGroupE
+__ZN7WebCore21ApplicationCacheGroup11stopLoadingEv
+__ZN3WTF9HashTableIPN7WebCore14DocumentLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47remove
+__ZN3WTF9HashTableIPN7WebCore14DocumentLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeE
+__ZN7WebCore21ApplicationCacheGroupD0Ev
+__ZN7WebCore23ApplicationCacheStorage19cacheGroupDestroyedEPNS_21ApplicationCacheGroupE
+__ZN3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15deal
+__ZN7WebCore19DOMApplicationCache17callErrorListenerEv
+__ZN7WebCore19DOMApplicationCache16derefEventTargetEv
+__ZN7WebCore24ApplicationCacheResourceC1ERKNS_4KURLERKNS_16ResourceResponseEjN3WTF10PassRefPtrINS_12SharedBufferEEE
+__ZN7WebCore24ApplicationCacheResourceC2ERKNS_4KURLERKNS_16ResourceResponseEjN3WTF10PassRefPtrINS_12SharedBufferEEE
+__ZN7WebCore21ApplicationCacheGroup14didReceiveDataEPNS_14ResourceHandleEPKcii
+__ZN7WebCore21ApplicationCacheGroup22didReceiveManifestDataEPKci
+__ZN7WebCore21ApplicationCacheGroup16didFinishLoadingEPNS_14ResourceHandleE
+__ZN7WebCore21ApplicationCacheGroup24didFinishLoadingManifestEv
+__ZN7WebCore13parseManifestERKNS_4KURLEPKciRNS_8ManifestE
+__ZN7WebCore16ApplicationCacheC1Ev
+__ZN7WebCore16ApplicationCacheC2Ev
+__ZN7WebCore16ApplicationCache8setGroupEPNS_21ApplicationCacheGroupE
+__ZN7WebCore21ApplicationCacheGroup32associateDocumentLoaderWithCacheEPNS_14DocumentLoaderEPNS_16ApplicationCacheE
+__ZN7WebCore14DocumentLoader19setApplicationCacheEN3WTF10PassRefPtrINS_16ApplicationCacheEEE
+__ZN7WebCore21ApplicationCacheGroup8addEntryERKNS_6StringEj
+__ZN7WebCore16ApplicationCache14resourceForURLERKNS_6StringE
+__ZNK3WTF7HashMapIN7WebCore6StringENS_6RefPtrINS1_24ApplicationCacheResourceEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EE
+__ZN3WTF7HashMapIN7WebCore6StringEjNS1_10StringHashENS_10HashTraitsIS2_EENS4_IjEEE3addERKS2_RKj
+__ZN7WebCore16ApplicationCache18setOnlineWhitelistERKN3WTF6VectorINS_4KURLELm0EEE
+__ZN3WTF6VectorIN7WebCore4KURLELm0EEaSERKS3_
+__ZN7WebCore16ApplicationCache15setFallbackURLsERKN3WTF6VectorISt4pairINS_4KURLES4_ELm0EEE
+__ZN3WTF6VectorISt4pairIN7WebCore4KURLES3_ELm0EEaSERKS5_
+__ZN7WebCore21ApplicationCacheGroup17startLoadingEntryEv
+__ZN7WebCore19DOMApplicationCache23callDownloadingListenerEv
+__ZN7WebCore19DOMApplicationCache20callProgressListenerEv
+__ZN7WebCore21ApplicationCacheGroup17cacheUpdateFailedEv
+__ZN7WebCore24ApplicationCacheResourceD0Ev
+__ZN7WebCore21ApplicationCacheGroup27deliverDelayedMainResourcesEv
+__ZN3WTF6VectorIPN7WebCore14DocumentLoaderELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore14DocumentLoaderELm0EE15reserveCapacityEm
+__ZN7WebCore16ApplicationCacheD1Ev
+__ZN7WebCore16ApplicationCacheD2Ev
+__ZN7WebCore21ApplicationCacheGroup14cacheDestroyedEPNS_16ApplicationCacheE
+__ZNK3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8cont
+__ZN3WTF9HashTableIPN7WebCore14DocumentLoaderES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3
+__ZN7WebCore21ApplicationCacheGroup21checkIfLoadIsCompleteEv
+__ZN3WTF6VectorIPN7WebCore14DocumentLoaderELm0EE6shrinkEm
+__ZN7WebCore16ApplicationCache11addResourceEN3WTF10PassRefPtrINS_24ApplicationCacheResourceEEE
+__ZN3WTF7HashMapIN7WebCore6StringENS_6RefPtrINS1_24ApplicationCacheResourceEEENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS_6RefPtrINS1_24ApplicationCacheResourceEEEENS_18PairFirstExtractorIS7_EENS1_10
+__ZN7WebCore16ApplicationCache19setManifestResourceEN3WTF10PassRefPtrINS_24ApplicationCacheResourceEEE
+__ZN7WebCore21ApplicationCacheGroup14setNewestCacheEN3WTF10PassRefPtrINS_16ApplicationCacheEEE
+__ZN3WTF7HashSetIPN7WebCore16ApplicationCacheENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expan
+__ZN3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehas
+__ZN3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allo
+__ZN7WebCore23ApplicationCacheStorage16storeNewestCacheEPNS_21ApplicationCacheGroupE
+__ZN7WebCore23ApplicationCacheStorage19verifySchemaVersionEv
+__ZN7WebCore23ApplicationCacheStorage16executeStatementERNS_15SQLiteStatementE
+__ZN7WebCore23ApplicationCacheStorage17executeSQLCommandERKNS_6StringE
+__ZN7WebCore23ApplicationCacheStorage5storeEPNS_21ApplicationCacheGroupE
+__ZN7WebCore23ApplicationCacheStorage5storeEPNS_16ApplicationCacheE
+__ZN7WebCore23ApplicationCacheStorage5storeEPNS_24ApplicationCacheResourceEj
+__ZN7WebCore19DOMApplicationCache18callCachedListenerEv
+__ZNK7WebCore16ApplicationCache10isCompleteEv
+__ZN7WebCore16ApplicationCache27urlMatchesFallbackNamespaceERKNS_4KURLEPS1_
+__ZN7WebCore16ApplicationCache22isURLInOnlineWhitelistERKNS_4KURLE
+__ZNK7WebCore11FrameLoader18cannotShowURLErrorERKNS_15ResourceRequestE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_23XMLHttpRequestExceptionE
+__ZN7WebCore25JSXMLHttpRequestExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23XMLHttpRequestExceptionEEE
+__ZN7WebCore25JSXMLHttpRequestExceptionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23XMLHttpRequestExceptionEEE
+__ZN7WebCore25JSXMLHttpRequestException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL33getJSXMLHttpRequestExceptionTableEPN3JSC9ExecStateE
+__ZNK3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS1_21ApplicationCacheGroupEENS_18PairFirstExtractorIS6_EENS1_10StringHashENS_
+__ZN7WebCore25JSXMLHttpRequestExceptionD1Ev
+__ZN7WebCore25JSXMLHttpRequestExceptionD2Ev
+__ZN7WebCore21ApplicationCacheGroup26disassociateDocumentLoaderEPNS_14DocumentLoaderE
+__ZN3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findI
+__ZN3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47remo
+__ZN3WTF9HashTableIPN7WebCore16ApplicationCacheES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6remov
+__ZN7WebCore23ApplicationCacheStorage9loadCacheEj
+__ZN7WebCore20ResourceResponseBase18setHTTPHeaderFieldERKNS_12AtomicStringERKNS_6StringE
+__ZN7WebCore24ApplicationCacheResource7addTypeEj
+__ZN3WTF7HashMapIN7WebCore6StringEPNS1_21ApplicationCacheGroupENS1_10StringHashENS_10HashTraitsIS2_EENS6_IS4_EEE3setERKS2_RKS4_
+__ZN7WebCore16ApplicationCache18resourceForRequestERKNS_15ResourceRequestE
+__ZN7WebCore19DOMApplicationCache20callNoUpdateListenerEv
+__ZN7WebCore12jsNodeOnloadEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node6onloadEv
+__ZN7WebCore34setJSDOMApplicationCacheOnnoupdateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore32setJSDOMApplicationCacheOncachedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMApplicationCacheOnupdatereadyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore31setJSDOMApplicationCacheOnerrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN3WTF6VectorIN7WebCore4KURLELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore4KURLELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore4KURLELm0EE15reserveCapacityEm
+__ZN3WTF6VectorISt4pairIN7WebCore4KURLES3_ELm0EE14expandCapacityEmPKS4_
+__ZN3WTF6VectorISt4pairIN7WebCore4KURLES3_ELm0EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIN7WebCore4KURLES3_ELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore4KURLELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorISt4pairIN7WebCore4KURLES3_ELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorISt4pairIN7WebCore4KURLES3_ELm0EE6shrinkEm
+__ZN3WTF6VectorIN7WebCore4KURLELm0EE6shrinkEm
+__ZN7WebCore23ApplicationCacheStorage5storeEPNS_24ApplicationCacheResourceEPNS_16ApplicationCacheE
+__ZN7WebCore34setJSDOMApplicationCacheOncheckingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSDOMApplicationCacheOndownloadingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore34setJSDOMApplicationCacheOnprogressEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore34setJSDOMApplicationCacheOnobsoleteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore44jsDOMApplicationCachePrototypeFunctionUpdateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19DOMApplicationCache6updateERi
+__ZN7WebCore20ResourceHandleClient15willSendRequestEPNS_14ResourceHandleERNS_15ResourceRequestERKNS_16ResourceResponseE
+__ZN7WebCore21ApplicationCacheGroup7didFailEPNS_14ResourceHandleERKNS_13ResourceErrorE
+__ZN7WebCore57jsDOMApplicationCachePrototypeFunctionRemoveEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZN7WebCore21JSDOMApplicationCache19removeEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore19DOMApplicationCache19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
+__ZN7WebCore29jsXMLHttpRequestExceptionCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23ApplicationCacheStorage6removeEPNS_16ApplicationCacheE
+__ZN7WebCore16ApplicationCache14clearStorageIDEv
+__ZN7WebCore21ApplicationCacheGroup14clearStorageIDEv
+__ZN7WebCore19DOMApplicationCache20callObsoleteListenerEv
+__ZN7WebCore19DOMApplicationCache23callUpdateReadyListenerEv
+__ZN7WebCore47jsDOMApplicationCachePrototypeFunctionSwapCacheEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19DOMApplicationCache9swapCacheERi
+__ZN7WebCore19DOMApplicationCache9swapCacheEv
+__ZN7WebCore23ApplicationCacheStorage16storeUpdatedTypeEPNS_24ApplicationCacheResourceEPNS_16ApplicationCacheE
+__ZNK7WebCore11HistoryItem15formContentTypeEv
+__ZN7WebCore14ResourceHandle17willLoadFromCacheERNS_15ResourceRequestE
+__ZN3WTF6VectorIcLm512EE14expandCapacityEmPKc
+__ZN7WebCore18MainResourceLoader26stopLoadingForPolicyChangeEv
+__ZNK7WebCore18MainResourceLoader32interruptionForPolicyChangeErrorEv
+__ZN7WebCore11FrameLoader32interruptionForPolicyChangeErrorERKNS_15ResourceRequestE
+__ZN7WebCore18JSHTMLVideoElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore18JSHTMLMediaElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore24setJSHTMLMediaElementSrcEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement6setSrcERKNS_6StringE
+-[WebCoreMovieObserver sizeChanged:]
+__ZN7WebCore18MediaPlayerPrivate11sizeChangedEv
+__ZN7WebCore11MediaPlayer11sizeChangedEv
+__ZThn112_N7WebCore16HTMLMediaElement22mediaPlayerSizeChangedEPNS_11MediaPlayerE
+__ZN7WebCore16HTMLMediaElement22mediaPlayerSizeChangedEPNS_11MediaPlayerE
+__ZNK7WebCore16HTMLMediaElement5endedEv
+__ZL28initQTMovieHasVideoAttributev
+__ZL32QTMovieHasVideoAttributeFunctionv
+__ZN7WebCore5TimerINS_11RenderMediaEE5firedEv
+__ZN7WebCore11RenderMedia26opacityAnimationTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore11RenderMedia13changeOpacityEPNS_11HTMLElementEf
+__ZN7WebCore11RenderMedia20timeUpdateTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore28jsHTMLMediaElementReadyStateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement10readyStateEv
+__ZN7WebCore32setJSHTMLMediaElementCurrentTimeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement14setCurrentTimeEfRi
+__ZN7WebCore16HTMLMediaElement4seekEfRi
+__ZNK7WebCore16HTMLMediaElement8seekableEv
+__ZN7WebCore11MediaPlayer15maxTimeSeekableEv
+__ZNK7WebCore18MediaPlayerPrivate15maxTimeSeekableEv
+__ZN7WebCore10TimeRangesC1Eff
+__ZN7WebCore10TimeRangesC2Eff
+__ZNK7WebCore10TimeRanges7containEf
+__ZNK7WebCore10TimeRanges5startEjRi
+__ZNK7WebCore10TimeRanges3endEjRi
+__ZN7WebCore30jsHTMLMediaElementNetworkStateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsHTMLMediaElementSeekableEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10TimeRangesE
+__ZN7WebCore12JSTimeRanges15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore12JSTimeRangesC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10TimeRangesEEE
+__ZN7WebCore12JSTimeRangesC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10TimeRangesEEE
+__ZN7WebCore12JSTimeRanges18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18jsTimeRangesLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSTimeRangesPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34jsTimeRangesPrototypeFunctionStartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore12JSTimeRanges9classInfoEv
+__ZN7WebCore32jsTimeRangesPrototypeFunctionEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26jsHTMLMediaElementDurationEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12JSTimeRangesD1Ev
+__ZN7WebCore12JSTimeRangesD2Ev
+__ZN7WebCore21JSTimeRangesPrototypeD1Ev
+__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE6shrinkEm
+__ZN7WebCore17InspectorResourceD1Ev
+__ZN7WebCore17InspectorResourceD2Ev
+__ZN7WebCoreL19fontfaceConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore18SVGFontFaceElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore18SVGFontFaceElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore8Document18mappedElementSheetEv
+__ZN7WebCore18SVGFontFaceElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCoreL32cssPropertyIdForSVGAttributeNameERKNS_13QualifiedNameE
+__ZN7WebCoreL25mapAttributeToCSSPropertyEPN3WTF7HashMapIPNS_16AtomicStringImplEiNS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EENS6_IiE
+__ZN7WebCore18SVGFontFaceElement20insertedIntoDocumentEv
+__ZN7WebCore18SVGFontFaceElement15rebuildFontFaceEv
+__ZN7WebCore18SVGFontFaceElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCoreL22fontfacesrcConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore21SVGFontFaceSrcElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore21SVGFontFaceSrcElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore21SVGFontFaceSrcElement8srcValueEv
+__ZN7WebCore21SVGFontFaceSrcElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCoreL22fontfaceuriConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore21SVGFontFaceUriElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore21SVGFontFaceUriElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore21SVGFontFaceUriElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore21SVGFontFaceUriElement20insertedIntoDocumentEv
+__ZN7WebCore21SVGFontFaceUriElement8loadFontEv
+__ZNK7WebCore21SVGFontFaceUriElement8srcValueEv
+__ZN7WebCore18SVGFontFaceElementD0Ev
+__ZN7WebCore18SVGFontFaceElement28removeFromMappedElementSheetEv
+__ZN7WebCore21SVGFontFaceSrcElementD0Ev
+__ZN7WebCore21SVGFontFaceUriElementD0Ev
+__ZN7WebCore23JSNodeIteratorPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsNodeIteratorPrototypeFunctionNextNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSNodeIterator8nextNodeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore43jsNodeIteratorPrototypeFunctionPreviousNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSNodeIterator12previousNodeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore12NodeIterator12previousNodeEPN3JSC9ExecStateERi
+__ZN7WebCore12NodeIterator11NodePointer14moveToPreviousEPNS_4NodeE
+__ZN7WebCore34jsRangePrototypeFunctionCloneRangeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCoreL25min_colorMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCoreL25max_colorMediaFeatureEvalEPNS_8CSSValueEPNS_11RenderStyleEPNS_5FrameENS_18MediaFeaturePrefixE
+__ZN7WebCore28setJSHTMLTableElementCaptionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25toHTMLTableCaptionElementEN3JSC7JSValueE
+__ZN7WebCore26setJSHTMLTableElementTFootEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore37setJSHTMLOptionElementDefaultSelectedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20CachedResourceClient10fontLoadedEPNS_10CachedFontE
+__ZN7WebCore13RenderSVGText29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore13RenderSVGText21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZNK7WebCore13RenderSVGText19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore10CachedFont17ensureSVGFontDataEv
+__ZN7WebCoreL15fontConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGFontElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGFontElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore18SVGFontFaceElement10fontFamilyEv
+__ZN7WebCoreL23missingglyphConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore22SVGMissingGlyphElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore22SVGMissingGlyphElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL16glyphConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGGlyphElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGGlyphElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGGlyphElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15SVGGlyphElement20insertedIntoDocumentEv
+__ZN7WebCore15SVGGlyphElement20invalidateGlyphCacheEv
+__ZN7WebCore14SVGFontElement20invalidateGlyphCacheEv
+__ZNK7WebCore10CachedFont14getSVGFontByIdERKNS_6StringE
+__ZN7WebCore11SVGFontDataC1EPNS_18SVGFontFaceElementE
+__ZN7WebCore11SVGFontDataC2EPNS_18SVGFontFaceElementE
+__ZNK7WebCore18SVGFontFaceElement17horizontalOriginXEv
+__ZNK7WebCore18SVGFontFaceElement17horizontalOriginYEv
+__ZNK7WebCore18SVGFontFaceElement18horizontalAdvanceXEv
+__ZNK7WebCore18SVGFontFaceElement15verticalOriginXEv
+__ZNK7WebCore18SVGFontFaceElement15verticalOriginYEv
+__ZNK7WebCore18SVGFontFaceElement6ascentEv
+__ZNK7WebCore18SVGFontFaceElement16verticalAdvanceYEv
+__ZNK7WebCore18SVGFontFaceElement10unitsPerEmEv
+__ZNK7WebCore18SVGFontFaceElement7descentEv
+__ZNK7WebCore18SVGFontFaceElement7xHeightEv
+__ZNK7WebCore14SVGFontElement28getGlyphIdentifiersForStringERKNS_6StringERN3WTF6VectorINS_18SVGGlyphIdentifierELm0EEE
+__ZNK7WebCore14SVGFontElement16ensureGlyphCacheEv
+__ZNK7WebCore15SVGGlyphElement20buildGlyphIdentifierEv
+__ZN7WebCore15SVGGlyphElement27buildGenericGlyphIdentifierEPKNS_10SVGElementE
+__ZN7WebCore15pathFromSVGDataERNS_4PathERKNS_6StringE
+__ZNK3WTF7HashMapItNS_6RefPtrIN7WebCore12GlyphMapNodeEEENS_7IntHashIjEENS_10HashTraitsItEENS7_IS4_EEE3getERKt
+__ZN3WTF7HashMapItNS_6RefPtrIN7WebCore12GlyphMapNodeEEENS_7IntHashIjEENS_10HashTraitsItEENS7_IS4_EEE3setERKtRKS4_
+__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE15reserveCapacityEm
+__ZNK7WebCore4Font22floatWidthUsingSVGFontERKNS_7TextRunE
+__ZN7WebCoreL33floatWidthOfSubStringUsingSVGFontEPKNS_4FontERKNS_7TextRunEiiiRiRNS_6StringE
+__ZN7WebCore16SVGTextRunWalkerINS_34SVGTextRunWalkerMeasuredLengthDataEE4walkERKNS_7TextRunEbRKNS_6StringEii
+__ZN7WebCoreL24charactersWithArabicFormERKNS_6StringEb
+__ZNK7WebCore14SVGFontElement24firstMissingGlyphElementEv
+__ZN7WebCore11PathBuilder9svgMoveToEddbb
+__ZN7WebCore11PathBuilder9svgLineToEddb
+__ZN7WebCore15SVGGlyphElement28inheritUnspecifiedAttributesERNS_18SVGGlyphIdentifierEPKNS_11SVGFontDataE
+__ZN7WebCoreL30floatWidthUsingSVGFontCallbackERKNS_18SVGGlyphIdentifierERNS_34SVGTextRunWalkerMeasuredLengthDataE
+__ZNK7WebCore4Font22floatWidthUsingSVGFontERKNS_7TextRunEiRiRNS_6StringE
+__ZNK7WebCore4Font7svgFontEv
+__ZN7WebCore28jsDocumentTypeInternalSubsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore50jsHTMLIFrameElementPrototypeFunctionGetSVGDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore21HTMLFrameOwnerElement14getSVGDocumentERi
+__ZN7WebCore50jsHTMLObjectElementPrototypeFunctionGetSVGDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCoreL14setConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore13SVGSetElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore13SVGSetElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL26createSVGSetElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore15JSSVGSetElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore30JSSVGAnimationElementPrototype4selfEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGAnimationElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSSVGSetElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGSetElementEEE
+__ZN7WebCore15JSSVGSetElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGSetElementEEE
+__ZN7WebCore21JSSVGAnimationElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimationElementEEE
+__ZN7WebCore21JSSVGAnimationElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30JSSVGAnimationElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore15JSSVGSetElement9classInfoEv
+__ZN7WebCore21jsSVGRectElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_15widthAttr
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateINS1_9SVGLengthEEENS1_29SVGAnimatedTypeWrapper
+__ZN3WTF7HashMapIN7WebCore6StringEPKNS1_23SVGAnimatedPropertyBaseENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3setERKS2_RK
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PKNS1_23SVGAnimatedPropertyBaseEENS_18PairFirstExtractorIS7_EENS1_10StringHashEN
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateINS1_9SVGLengthEEENS1_29SVGAnimatedTypeWrapperK
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateINS1_9SVGLengthEEEENS_18PairFirstE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateINS_9SVGLengthEEEPNS_10SVGElementE
+__ZN7WebCore19JSSVGAnimatedLength15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSSVGAnimatedLengthC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateINS_9SVGLengthEEEEEPNS_10S
+__ZN7WebCore19JSSVGAnimatedLengthC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateINS_9SVGLengthEEEEEPNS_10S
+__ZN7WebCore19JSSVGAnimatedLength18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26jsSVGAnimatedLengthBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK3WTF9HashTableIN7WebCore23PODTypeWrapperCacheInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEESt4pairIS6_PNS1_26JSSVGD
+__ZN3WTF7HashMapIN7WebCore23PODTypeWrapperCacheInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEEPNS1_26JSSVGDynamicPODTypeW
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperINS_9SVGLengthEEEPNS_10SVGElementE
+__ZN7WebCore11JSSVGLengthC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_9SVGLengthEEEEEPNS_10SVGElemen
+__ZN7WebCore11JSSVGLengthC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_9SVGLengthEEEEEPNS_10SVGElemen
+__ZN7WebCore26jsSVGAnimatedLengthAnimValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK3WTF7HashMapIN7WebCore23PODTypeWrapperCacheInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEEPNS1_26JSSVGDynamicPODType
+__ZN7WebCore11JSSVGLength18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore19jsSVGLengthUnitTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26JSSVGDynamicPODTypeWrapperINS_9SVGLengthENS_19SVGAnimatedTemplateIS1_EEEcvS1_Ev
+__ZN7WebCore32jsSVGLengthValueInSpecifiedUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsSVGLengthValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore11JSSVGLength5valueEPN3JSC9ExecStateE
+__ZN7WebCore50jsSVGAnimationElementPrototypeFunctionBeginElementEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19SVGAnimationElement12beginElementERi
+__ZN7WebCore19SVGAnimationElement14beginElementAtEfRi
+__ZNK7WebCore14SVGSMILElement7elapsedEv
+__ZN7WebCore14SVGSMILElement12addBeginTimeENS_8SMILTimeE
+__ZN7WebCore14SVGSMILElement16beginListChangedEv
+__ZN7WebCore46jsSVGSVGElementPrototypeFunctionSetCurrentTimeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement14setCurrentTimeEf
+__ZNK7WebCore19SVGAnimationElement7toValueEv
+__ZN7WebCore19synchronizePropertyINS_14SVGRectElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCore56jsSVGTextContentElementPrototypeFunctionGetNumberOfCharsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
+__ZNK7WebCore21SVGTextContentElement16getNumberOfCharsEv
+__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE6appendIS2_EEvPKT_m
+__ZSt16__introsort_loopIPN7WebCore18SVGGlyphIdentifierElPFbRKS1_S4_EEvT_S7_T0_T1_
+__ZSt22__final_insertion_sortIPN7WebCore18SVGGlyphIdentifierEPFbRKS1_S4_EEvT_S7_T0_
+__ZSt16__insertion_sortIPN7WebCore18SVGGlyphIdentifierEPFbRKS1_S4_EEvT_S7_T0_
+__ZN3WTF6VectorIN7WebCore18SVGGlyphIdentifierELm0EE6shrinkEm
+__ZNK7WebCore14SVGFontElement43getHorizontalKerningPairForStringsAndGlyphsERKNS_6StringES3_S3_S3_RNS_24SVGHorizontalKerningPair
+__ZNK7WebCore13RenderSVGText9isSVGTextEv
+__ZNK7WebCore16SVGRootInlineBox13svgTextChunksEv
+__ZN7WebCoreL29findInlineTextBoxInTextChunksEPKNS_21SVGTextContentElementERKN3WTF6VectorINS_12SVGTextChunkELm0EEE
+__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE15reserveCapacityEm
+__ZN7WebCore18SVGTextChunkWalkerINS_27SVGInlineTextBoxQueryWalkerEEclEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatrixERKPNS
+__ZN7WebCore27SVGInlineTextBoxQueryWalker20chunkPortionCallbackEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatrixERKPNS_7SVGC
+__ZN3WTF6VectorIPN7WebCore16SVGInlineTextBoxELm0EE6shrinkEm
+__ZN7WebCore61jsSVGTextContentElementPrototypeFunctionGetComputedTextLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_
+__ZNK7WebCore21SVGTextContentElement21getComputedTextLengthEv
+__ZN7WebCore58jsSVGTextContentElementPrototypeFunctionGetSubStringLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZNK7WebCore21SVGTextContentElement18getSubStringLengthEjjRi
+__ZN7WebCore62jsSVGTextContentElementPrototypeFunctionGetStartPositionOfCharEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0
+__ZNK7WebCore21SVGTextContentElement22getStartPositionOfCharEjRi
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperINS_10FloatPointEEEPNS_10SVGElementE
+__ZN7WebCore10JSSVGPoint15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore10JSSVGPointC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_10FloatPointEEEEEPNS_10SVGEleme
+__ZN7WebCore10JSSVGPointC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_10FloatPointEEEEEPNS_10SVGEleme
+__ZN7WebCore10JSSVGPoint18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore11jsSVGPointXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_10FloatPointEEcvS1_Ev
+__ZN7WebCore11jsSVGPointYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore60jsSVGTextContentElementPrototypeFunctionGetEndPositionOfCharEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7
+__ZNK7WebCore21SVGTextContentElement20getEndPositionOfCharEjRi
+__ZN7WebCoreL19textpathConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore18SVGTextPathElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore18SVGTextPathElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL31createSVGTextPathElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore20JSSVGTextPathElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGTextPathElementEEE
+__ZN7WebCore20JSSVGTextPathElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGTextPathElementEEE
+__ZN7WebCore20JSSVGTextPathElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSSVGTextPathElement9classInfoEv
+__ZN7WebCore18SVGTextPathElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZThn432_NK7WebCore18SVGTextPathElement14contextElementEv
+__ZNK7WebCore18SVGTextPathElement14contextElementEv
+__ZN7WebCore18SVGTextPathElement20insertedIntoDocumentEv
+__ZN7WebCore57jsSVGTextContentElementPrototypeFunctionGetRotationOfCharEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZNK7WebCore21SVGTextContentElement17getRotationOfCharEjRi
+__ZN7WebCore18SVGTextPathElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore18SVGTextPathElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore17RenderSVGTextPathC1EPNS_4NodeE
+__ZN7WebCore17RenderSVGTextPathC2EPNS_4NodeE
+__ZNK7WebCore18SVGTextPathElement25childShouldCreateRendererEPNS_4NodeE
+__ZN7WebCore22SVGCharacterLayoutInfo15setInPathLayoutEb
+__ZN7WebCore22SVGCharacterLayoutInfo20addLayoutInformationEPNS_13InlineFlowBoxEf
+__ZNK7WebCore17RenderSVGTextPath10layoutPathEv
+__ZN7WebCore4Path6lengthEv
+__ZN7WebCore18PathTraversalStateC1ENS0_19PathTraversalActionE
+__ZN7WebCore18PathTraversalStateC2ENS0_19PathTraversalActionE
+__ZNK7WebCore4Path5applyEPvPFvS1_PKNS_11PathElementEE
+__ZN7WebCoreL26CGPathApplierToPathApplierEPvPK13CGPathElement
+__ZN7WebCoreL25pathLengthApplierFunctionEPvPKNS_11PathElementE
+__ZN7WebCore18PathTraversalState6moveToERKNS_10FloatPointE
+__ZN7WebCore18PathTraversalState6lineToERKNS_10FloatPointE
+__ZNK7WebCore17RenderSVGTextPath11startOffsetEv
+__ZN7WebCore22SVGCharacterLayoutInfo27nextPathLayoutPointAndAngleEfff
+__ZN7WebCore4Path13pointAtLengthEfRb
+__ZN7WebCore4Path19normalAngleAtLengthEfRb
+__ZN7WebCore24RenderSVGHiddenContainer29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZN7WebCore18SVGFontFaceElement19removedFromDocumentEv
+__ZN7WebCore11SVGFontDataD0Ev
+__ZN7WebCoreL31createSVGFontFaceElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore20JSSVGFontFaceElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGFontFaceElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGFontFaceElementEEE
+__ZN7WebCore20JSSVGFontFaceElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGFontFaceElementEEE
+__ZNK7WebCore20JSSVGFontFaceElement9classInfoEv
+__ZN7WebCoreL35createSVGMissingGlyphElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore24JSSVGMissingGlyphElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSSVGMissingGlyphElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22SVGMissingGlyphElementEEE
+__ZN7WebCore24JSSVGMissingGlyphElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22SVGMissingGlyphElementEEE
+__ZNK7WebCore24JSSVGMissingGlyphElement9classInfoEv
+__ZN7WebCoreL28createSVGGlyphElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore17JSSVGGlyphElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSSVGGlyphElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGGlyphElementEEE
+__ZN7WebCore17JSSVGGlyphElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGGlyphElementEEE
+__ZNK7WebCore17JSSVGGlyphElement9classInfoEv
+__ZN7WebCoreL16hkernConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGHKernElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGHKernElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore12JSSVGElement9classInfoEv
+__ZN7WebCoreL27createSVGFontElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGFontElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGFontElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGFontElementEEE
+__ZN7WebCore16JSSVGFontElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGFontElementEEE
+__ZNK7WebCore16JSSVGFontElement9classInfoEv
+__ZN7WebCore14SVGFontElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore15SVGHKernElement20insertedIntoDocumentEv
+__ZN7WebCoreL28createSVGTSpanElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore17JSSVGTSpanElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSSVGTSpanElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGTSpanElementEEE
+__ZN7WebCore17JSSVGTSpanElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGTSpanElementEEE
+__ZNK7WebCore17JSSVGTSpanElement9classInfoEv
+__ZN7WebCore12SVGLangSpace10setXmllangERKNS_12AtomicStringE
+__ZN7WebCoreL19altglyphConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore18SVGAltGlyphElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore18SVGAltGlyphElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL31createSVGAltGlyphElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore20JSSVGAltGlyphElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGAltGlyphElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGAltGlyphElementEEE
+__ZN7WebCore20JSSVGAltGlyphElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGAltGlyphElementEEE
+__ZN7WebCore20JSSVGAltGlyphElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSSVGAltGlyphElement9classInfoEv
+__ZN7WebCore18SVGAltGlyphElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZNK7WebCore18SVGAltGlyphElement25childShouldCreateRendererEPNS_4NodeE
+__ZN7WebCore11PathBuilder12svgClosePathEv
+__ZN7WebCore20parseDelimitedStringERKNS_6StringEc
+__ZNK7WebCore15SVGHKernElement26buildHorizontalKerningPairEv
+__ZN3WTF6VectorIN7WebCore24SVGHorizontalKerningPairELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore24SVGHorizontalKerningPairELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore24SVGHorizontalKerningPairELm0EE15reserveCapacityEm
+__ZN7WebCore11SVGGlyphMap20compareGlyphPriorityERKNS_18SVGGlyphIdentifierES3_
+__ZSt25__unguarded_linear_insertIPN7WebCore18SVGGlyphIdentifierES1_PFbRKS1_S4_EEvT_T0_T1_
+__ZN7WebCoreL25stringMatchesUnicodeRangeERKNS_6StringES2_
+__ZN3WTF6VectorISt4pairIjjELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorISt4pairIjjELm0EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIjjELm0EE15reserveCapacityEm
+__ZN3WTF6VectorISt4pairIjjELm0EE6shrinkEm
+__ZN3WTF6VectorISt4pairIjjELm0EE14expandCapacityEmPKS2_
+__ZNK7WebCore18SVGAltGlyphElement12glyphElementEv
+__ZN7WebCore17RenderSVGTextPathD0Ev
+__ZN7WebCore17JSSVGTSpanElementD1Ev
+__ZN7WebCore16JSSVGFontElementD1Ev
+__ZN7WebCore17JSSVGGlyphElementD1Ev
+__ZN7WebCore24JSSVGMissingGlyphElementD1Ev
+__ZN7WebCore20JSSVGFontFaceElementD1Ev
+__ZN7WebCore20JSSVGTextPathElementD1Ev
+__ZN7WebCore10JSSVGPointD1Ev
+__ZN7WebCore10JSSVGPointD2Ev
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_10FloatPointEED0Ev
+__ZN7WebCore11JSSVGLengthD1Ev
+__ZN7WebCore11JSSVGLengthD2Ev
+__ZN3WTF9HashTableIN7WebCore23PODTypeWrapperCacheInfoINS1_9SVGLengthENS1_19SVGAnimatedTemplateIS3_EEEESt4pairIS6_PNS1_26JSSVGDy
+__ZN7WebCore26JSSVGDynamicPODTypeWrapperINS_9SVGLengthENS_19SVGAnimatedTemplateIS1_EEED0Ev
+__ZN7WebCore19JSSVGAnimatedLengthD1Ev
+__ZN7WebCore19JSSVGAnimatedLengthD2Ev
+__ZN7WebCore15JSSVGSetElementD1Ev
+__ZN7WebCore14SVGFontElementD0Ev
+__ZN3WTF6VectorIN7WebCore24SVGHorizontalKerningPairELm0EE6shrinkEm
+__ZN7WebCore22SVGMissingGlyphElementD0Ev
+__ZN7WebCore15SVGGlyphElementD0Ev
+__ZN7WebCore15SVGHKernElementD0Ev
+__ZN7WebCore13SVGSetElementD0Ev
+__ZN7WebCore17SVGAnimateElementD2Ev
+__ZN7WebCore18SVGTextPathElementD0Ev
+__ZN7WebCore20JSSVGAltGlyphElementD1Ev
+__ZThn8_N7WebCore14SVGTextElementD0Ev
+__ZN7WebCore18SVGAltGlyphElementD0Ev
+__ZN7WebCore26JSSVGTSpanElementPrototypeD1Ev
+__ZN7WebCore25JSSVGFontElementPrototypeD1Ev
+__ZN7WebCore26JSSVGGlyphElementPrototypeD1Ev
+__ZN7WebCore33JSSVGMissingGlyphElementPrototypeD1Ev
+__ZN7WebCore29JSSVGFontFaceElementPrototypeD1Ev
+__ZN7WebCore19JSSVGPointPrototypeD1Ev
+__ZN7WebCore28JSSVGAnimatedLengthPrototypeD1Ev
+__ZN7WebCore24JSSVGSetElementPrototypeD1Ev
+__ZN7WebCore30JSSVGAnimationElementPrototypeD1Ev
+__ZN7WebCore29JSSVGAltGlyphElementPrototypeD1Ev
+__ZN7WebCore8Document29parseDNSPrefetchControlHeaderERKNS_6StringE
+__ZN7WebCore15FormDataBuilder28generateUniqueBoundaryStringEv
+__ZN7WebCore15FormDataBuilder20beginMultiPartHeaderERN3WTF6VectorIcLm0EEERKNS_7CStringES7_
+__ZN7WebCore15FormDataBuilder28addBoundaryToMultiPartHeaderERN3WTF6VectorIcLm0EEERKNS_7CStringEb
+__ZN7WebCore15FormDataBuilder28addFilenameToMultiPartHeaderERN3WTF6VectorIcLm0EEERKNS_12TextEncodingERKNS_6StringE
+__ZN7WebCore15FormDataBuilder21finishMultiPartHeaderERN3WTF6VectorIcLm0EEE
+__ZN7WebCoreL37nonCachingStaticReplaceFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11FrameLoader27handleUnimplementablePolicyERKNS_13ResourceErrorE
+__ZN7WebCore11FrameLoader25setupForReplaceByMIMETypeERKNS_6StringE
+__ZN7WebCore14DocumentLoader25setupForReplaceByMIMETypeERKNS_6StringE
+__ZN7WebCore14ResourceLoader17clearResourceDataEv
+__ZN7WebCore11FrameLoader12setReplacingEv
+__ZN7WebCore12SharedBuffer5clearEv
+__ZN7WebCore12SharedBuffer17clearPlatformDataEv
+__ZNK7WebCore11CachedImage7isImageEv
+__ZN7WebCore14DocumentLoader39subresourceLoaderFinishedLoadingOnePartEPNS_14ResourceLoaderE
+__ZN7WebCore17HTMLSelectElement23restoreFormControlStateERKNS_6StringE
+__ZN7WebCore19HTMLTextAreaElement23restoreFormControlStateERKNS_6StringE
+__ZN7WebCore14jsNodeOnresizeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node8onresizeEv
+__ZN7WebCore24CanvasRenderingContext2D9drawImageEPNS_17HTMLCanvasElementEffffRi
+__ZN7WebCoreL16imageConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGImageElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGImageLoaderC1EPNS_15SVGImageElementE
+__ZN7WebCore14SVGImageLoaderC2EPNS_15SVGImageElementE
+__ZN7WebCore15SVGImageElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZThn408_NK7WebCore15SVGImageElement14contextElementEv
+__ZNK7WebCore15SVGImageElement14contextElementEv
+__ZN7WebCore15SVGImageElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCore15SVGImageElement20insertedIntoDocumentEv
+__ZNK7WebCore15SVGImageElement24imageSourceAttributeNameEv
+__ZNK7WebCore14SVGImageLoader9sourceURIERKNS_12AtomicStringE
+__ZN7WebCore22EmptyFrameLoaderClient38dispatchDidLoadResourceFromMemoryCacheEPNS_14DocumentLoaderERKNS_15ResourceRequestERKNS_1
+__ZN7WebCore22EmptyFrameLoaderClient26dispatchDidReceiveResponseEPNS_14DocumentLoaderEmRKNS_16ResourceResponseE
+__ZN7WebCore22EmptyFrameLoaderClient31dispatchDidReceiveContentLengthEPNS_14DocumentLoaderEmi
+__ZN7WebCore22EmptyFrameLoaderClient24dispatchDidFinishLoadingEPNS_14DocumentLoaderEm
+__ZN7WebCore15SVGImageElement6attachEv
+__ZNK7WebCore15SVGImageElement7isValidEv
+__ZN7WebCore15SVGImageElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore14RenderSVGImageC1EPNS_15SVGImageElementE
+__ZN7WebCore14RenderSVGImageC2EPNS_15SVGImageElementE
+__ZNK7WebCore14RenderSVGImage13requiresLayerEv
+__ZN7WebCore14RenderSVGImage12imageChangedEPvPKNS_7IntRectE
+__ZN7WebCore14RenderSVGImage29clippedOverflowRectForRepaintEPNS_20RenderBoxModelObjectE
+__ZNK7WebCore14RenderSVGImage29repaintRectInLocalCoordinatesEv
+__ZN7WebCore14RenderSVGImage21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZNK7WebCore14RenderSVGImage22localToParentTransformEv
+__ZN7WebCore15SVGImageElement27haveLoadedRequiredResourcesEv
+__ZThn360_NK7WebCore15SVGImageElement14contextElementEv
+__ZN7WebCore14SVGImageLoader17dispatchLoadEventEv
+__ZN7WebCore14RenderSVGImage6layoutEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_16heightAt
+__ZNK7WebCore19SVGAnimatedPropertyINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_11yAttrStr
+__ZNK7WebCore19SVGAnimatedPropertyINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_11xAttrStr
+__ZNK7WebCore5Image23hasSingleSecurityOriginEv
+__ZN7WebCore14RenderSVGImage5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore14RenderSVGImage25adjustRectsForAspectRatioERNS_9FloatRectES2_PNS_22SVGPreserveAspectRatioE
+-[WebCoreResourceHandleAsDelegate connection:didReceiveAuthenticationChallenge:]
+__ZN7WebCore4coreEP28NSURLAuthenticationChallenge
+__ZN7WebCore23AuthenticationChallengeC1EP28NSURLAuthenticationChallenge
+__ZN7WebCore23AuthenticationChallengeC2EP28NSURLAuthenticationChallenge
+__ZN7WebCore4coreEP15NSURLCredential
+__ZN7WebCore10CredentialC1ERKNS_6StringES3_NS_21CredentialPersistenceE
+__ZN7WebCore10CredentialC2ERKNS_6StringES3_NS_21CredentialPersistenceE
+__ZN7WebCore4coreEP20NSURLProtectionSpace
+__ZN7WebCore15ProtectionSpaceC1ERKNS_6StringEiNS_25ProtectionSpaceServerTypeES3_NS_35ProtectionSpaceAuthenticationSchemeE
+__ZN7WebCore15ProtectionSpaceC2ERKNS_6StringEiNS_25ProtectionSpaceServerTypeES3_NS_35ProtectionSpaceAuthenticationSchemeE
+__ZN7WebCore27AuthenticationChallengeBaseC2ERKNS_15ProtectionSpaceERKNS_10CredentialEjRKNS_16ResourceResponseERKNS_13ResourceEr
+__ZN7WebCore14ResourceHandle33didReceiveAuthenticationChallengeERKNS_23AuthenticationChallengeE
+__ZN7WebCore14ResourceHandle18receivedCredentialERKNS_23AuthenticationChallengeERKNS_10CredentialE
+__ZN7WebCore27AuthenticationChallengeBase7compareERKNS_23AuthenticationChallengeES3_
+__ZNK7WebCore27AuthenticationChallengeBase6isNullEv
+__ZNK7WebCore27AuthenticationChallengeBase15protectionSpaceEv
+__ZN7WebCoreeqERKNS_15ProtectionSpaceES2_
+__ZNK7WebCore15ProtectionSpace4hostEv
+__ZNK7WebCore15ProtectionSpace4portEv
+__ZNK7WebCore15ProtectionSpace10serverTypeEv
+__ZNK7WebCore15ProtectionSpace5realmEv
+__ZNK7WebCore15ProtectionSpace20authenticationSchemeEv
+__ZNK7WebCore27AuthenticationChallengeBase18proposedCredentialEv
+__ZN7WebCoreeqERKNS_10CredentialES2_
+__ZNK7WebCore10Credential4userEv
+__ZNK7WebCore10Credential8passwordEv
+__ZNK7WebCore10Credential11persistenceEv
+__ZNK7WebCore27AuthenticationChallengeBase20previousFailureCountEv
+__ZNK7WebCore27AuthenticationChallengeBase15failureResponseEv
+__ZN7WebCore20ResourceResponseBase7compareERKNS_16ResourceResponseES3_
+__ZN3WTFeqIN7WebCore12AtomicStringENS1_6StringENS1_15CaseFoldingHashENS_10HashTraitsIS2_EENS5_IS3_EEEEbRKNS_7HashMapIT_T0_T1_T2
+__ZN7WebCore16ResourceResponse15platformCompareERKS0_S2_
+__ZNK7WebCore27AuthenticationChallengeBase5errorEv
+__ZN7WebCore17ResourceErrorBase7compareERKNS_13ResourceErrorES3_
+__ZN7WebCore23AuthenticationChallenge15platformCompareERKS0_S2_
+__ZN7WebCore3macERKNS_10CredentialE
+__ZN7WebCore23AuthenticationChallengeD2Ev
+__ZN7WebCore33jsDOMWindowPrototypeFunctionPrintEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore28objectToStringFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore9JSHistory14deletePropertyEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore10JSLocation14deletePropertyEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore30nonCachingStaticFunctionGetterIXadL_ZNS_33jsDOMWindowPrototypeFunctionFocusEPN3JSC9ExecStateEPNS1_8JSObjectENS1_7
+__ZN7WebCore30nonCachingStaticFunctionGetterIXadL_ZNS_32jsDOMWindowPrototypeFunctionBlurEPN3JSC9ExecStateEPNS1_8JSObjectENS1_7J
+__ZN7WebCore30nonCachingStaticFunctionGetterIXadL_ZNS_33jsDOMWindowPrototypeFunctionCloseEPN3JSC9ExecStateEPNS1_8JSObjectENS1_7
+__ZN7WebCore17jsDOMWindowWindowEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16setJSNodeOnpasteEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node10setOnpasteEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore15setJSNodeOndropEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node9setOndropEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCoreL34nonCachingStaticBackFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL37nonCachingStaticForwardFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL32nonCachingStaticGoFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL36nonCachingStaticAssignFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCoreL36nonCachingStaticReloadFunctionGetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSDOMWindowShell12lookupSetterEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore11JSDOMWindow12lookupSetterEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore27setJSHTMLVideoElementPosterEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLVideoElement9setPosterERKNS_6StringE
+__ZNK7WebCore16HTMLVideoElement24imageSourceAttributeNameEv
+__ZN7WebCore17HTMLSourceElement18scheduleErrorEventEv
+__ZN7WebCore5TimerINS_17HTMLSourceElementEE5firedEv
+__ZN7WebCore17HTMLSourceElement20errorEventTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore28jsHTMLMediaElementCurrentSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement10currentSrcEv
+__ZN7WebCore11FrameLoader35shouldInterruptLoadForXFrameOptionsERKNS_6StringERKNS_4KURLE
+__ZN7WebCore49jsXMLHttpRequestPrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSXMLHttpRequest16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore14XMLHttpRequest16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZNK7WebCore15HTMLLinkElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK7WebCore17HTMLScriptElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore40jsWorkerContextXMLHttpRequestConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore15JSWorkerContext14xmlHttpRequestEPN3JSC9ExecStateE
+__ZNK7WebCore13WorkerContext18virtualCompleteURLERKNS_6StringE
+__ZNK7WebCore13WorkerContext11completeURLERKNS_6StringE
+__ZN7WebCore22WorkerThreadableLoader25loadResourceSynchronouslyEPNS_13WorkerContextERKNS_15ResourceRequestERNS_22ThreadableLoad
+__ZN7WebCore6String6numberEm
+__ZN7WebCore22WorkerThreadableLoaderC1EPNS_13WorkerContextEPNS_22ThreadableLoaderClientERKNS_6StringERKNS_15ResourceRequestENS_
+__ZN7WebCore22WorkerThreadableLoaderC2EPNS_13WorkerContextEPNS_22ThreadableLoaderClientERKNS_6StringERKNS_15ResourceRequestENS_
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridgeC1EN3WTF10PassRefPtrINS_29ThreadableLoaderClientWrapperEEERNS_20WorkerMes
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridgeC2EN3WTF10PassRefPtrINS_29ThreadableLoaderClientWrapperEEERNS_20WorkerMes
+__ZN7WebCore18createCallbackTaskIPNS_22WorkerThreadableLoader16MainThreadBridgeES3_NS_15ResourceRequestESt8auto_ptrINS_30CrossT
+__ZN7WebCore21CrossThreadCopierBaseILb0ENS_15ResourceRequestEE4copyERKS1_
+__ZNK7WebCore19ResourceRequestBase8copyDataEv
+__ZNK7WebCore13HTTPHeaderMap8copyDataEv
+__ZN7WebCore20WorkerMessagingProxy22postTaskToWorkerObjectEN3WTF10PassRefPtrINS_22ScriptExecutionContext4TaskEEE
+__ZN7WebCore13WorkerRunLoop9runInModeEPNS_13WorkerContextERKNS_6StringE
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge22mainThreadCreateLoaderEPNS_22ScriptExecutionContextEPS1_St8auto_ptrINS_
+__ZN7WebCore19ResourceRequestBase5adoptESt8auto_ptrINS_30CrossThreadResourceRequestDataEE
+__ZN7WebCore13HTTPHeaderMap5adoptESt8auto_ptrIN3WTF6VectorISt4pairINS_6StringES5_ELm0EEEE
+__ZN7WebCore19ResourceRequestBase19setAllowHTTPCookiesEb
+__ZN7WebCore18GenericWorkerTask5IPNS_22WorkerThreadableLoader16MainThreadBridgeES3_St8auto_ptrINS_30CrossThreadResourceRequestD
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge18didReceiveResponseERKNS_16ResourceResponseE
+__ZN7WebCore18createCallbackTaskIN3WTF6RefPtrINS1_16ThreadSafeSharedINS_29ThreadableLoaderClientWrapperEEEEENS2_IS4_EENS_16Reso
+__ZN7WebCore21CrossThreadCopierBaseILb0ENS_16ResourceResponseEE4copyERKS1_
+__ZNK7WebCore20ResourceResponseBase8copyDataEv
+__ZNK7WebCore20ResourceResponseBase16lastModifiedDateEv
+__ZN7WebCore20WorkerMessagingProxy30postTaskForModeToWorkerContextEN3WTF10PassRefPtrINS_22ScriptExecutionContext4TaskEEERKNS_6S
+__ZN7WebCore18GenericWorkerTask2IN3WTF10PassRefPtrINS_29ThreadableLoaderClientWrapperEEENS1_6RefPtrIS3_EESt8auto_ptrINS_31Cross
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge14didReceiveDataEPKci
+__ZN7WebCore18createCallbackTaskIN3WTF6RefPtrINS1_16ThreadSafeSharedINS_29ThreadableLoaderClientWrapperEEEEENS2_IS4_EESt8auto_p
+__ZN7WebCoreL31workerContextDidReceiveResponseEPNS_22ScriptExecutionContextEN3WTF6RefPtrINS_29ThreadableLoaderClientWrapperEEES
+__ZN7WebCore20ResourceResponseBase5adoptESt8auto_ptrINS_31CrossThreadResourceResponseDataEE
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge16didFinishLoadingEm
+__ZN7WebCore20ResourceResponseBase6setURLERKNS_4KURLE
+__ZN7WebCore18createCallbackTaskIN3WTF6RefPtrINS1_16ThreadSafeSharedINS_29ThreadableLoaderClientWrapperEEEEENS2_IS4_EEmmEENS1_1
+__ZN7WebCore20ResourceResponseBase11setMimeTypeERKNS_6StringE
+__ZN7WebCore20ResourceResponseBase24setExpectedContentLengthEx
+__ZN7WebCore20ResourceResponseBase19setTextEncodingNameERKNS_6StringE
+__ZN7WebCore20ResourceResponseBase20setSuggestedFilenameERKNS_6StringE
+__ZN7WebCore20ResourceResponseBase17setHTTPStatusTextERKNS_6StringE
+__ZN7WebCore20ResourceResponseBase17setExpirationDateEl
+__ZN7WebCore20ResourceResponseBase19setLastModifiedDateEl
+__ZN7WebCoreL27workerContextDidReceiveDataEPNS_22ScriptExecutionContextEN3WTF6RefPtrINS_29ThreadableLoaderClientWrapperEEESt8au
+__ZN7WebCore18GenericWorkerTask2IN3WTF10PassRefPtrINS_29ThreadableLoaderClientWrapperEEENS1_6RefPtrIS3_EESt8auto_ptrINS1_6Vecto
+__ZN7WebCore18GenericWorkerTask2IN3WTF10PassRefPtrINS_29ThreadableLoaderClientWrapperEEENS1_6RefPtrIS3_EEmmE11performTaskEPNS_2
+__ZN7WebCoreL29workerContextDidFinishLoadingEPNS_22ScriptExecutionContextEN3WTF6RefPtrINS_29ThreadableLoaderClientWrapperEEEm
+__ZN7WebCore13WorkerContext33resourceRetrievedByXMLHttpRequestEmRKNS_12ScriptStringE
+__ZN7WebCore13WorkerContext10addMessageENS_18MessageDestinationENS_13MessageSourceENS_12MessageLevelERKNS_6StringEjS6_
+__ZThn8_N7WebCore20WorkerMessagingProxy32postConsoleMessageToWorkerObjectENS_18MessageDestinationENS_13MessageSourceENS_12Messa
+__ZN7WebCore20WorkerMessagingProxy32postConsoleMessageToWorkerObjectENS_18MessageDestinationENS_13MessageSourceENS_12MessageLev
+__ZN7WebCore18createCallbackTaskIPNS_20WorkerMessagingProxyES2_NS_18MessageDestinationES3_NS_13MessageSourceES4_NS_12MessageLev
+__ZN7WebCore21CrossThreadCopierBaseILb0ENS_6StringEE4copyERKS1_
+__ZN7WebCore18GenericWorkerTask2IN3WTF10PassRefPtrINS_29ThreadableLoaderClientWrapperEEENS1_6RefPtrIS3_EEmmED0Ev
+__ZN7WebCore18GenericWorkerTask7IPNS_20WorkerMessagingProxyES2_NS_18MessageDestinationES3_NS_13MessageSourceES4_NS_12MessageLev
+__ZN7WebCoreL22postConsoleMessageTaskEPNS_22ScriptExecutionContextEPNS_20WorkerMessagingProxyENS_18MessageDestinationENS_13Mess
+__ZN7WebCore22WorkerThreadableLoaderD0Ev
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge7destroyEv
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge18clearClientWrapperEv
+__ZN7WebCore18createCallbackTaskIPNS_22WorkerThreadableLoader16MainThreadBridgeES3_EEN3WTF10PassRefPtrINS_22ScriptExecutionCont
+__ZN7WebCore18GenericWorkerTask1IPNS_22WorkerThreadableLoader16MainThreadBridgeES3_E11performTaskEPNS_22ScriptExecutionContextE
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge17mainThreadDestroyEPNS_22ScriptExecutionContextEPS1_
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridgeD0Ev
+__ZN7WebCore18GenericWorkerTask1IPNS_22WorkerThreadableLoader16MainThreadBridgeES3_ED0Ev
+__ZN7WebCore45jsWorkerContextPrototypeFunctionImportScriptsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore15JSWorkerContext13importScriptsEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore13WorkerContext13importScriptsERKN3WTF6VectorINS_6StringELm0EEERKS3_iRi
+__ZN7WebCore25WorkerImportScriptsClient18didReceiveResponseERKNS_16ResourceResponseE
+__ZN7WebCore25WorkerImportScriptsClient14didReceiveDataEPKci
+__ZN7WebCore25WorkerImportScriptsClient16didFinishLoadingEm
+__ZN7WebCore13WorkerContext14scriptImportedEmRKNS_6StringE
+__ZN7WebCore50jsXMLHttpRequestExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore25JSXMLHttpRequestException9classInfoEv
+__ZN7WebCore22WorkerScriptController12setExceptionENS_11ScriptValueE
+__ZN7WebCore36jsXMLHttpRequestExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14XMLHttpRequest28makeCrossOriginAccessRequestERi
+__ZN7WebCore32isSimpleCrossOriginAccessRequestERKNS_6StringERKNS_13HTTPHeaderMapE
+__ZN7WebCore45isOnAccessControlSimpleRequestMethodWhitelistERKNS_6StringE
+__ZN7WebCore14XMLHttpRequest34makeSimpleCrossOriginAccessRequestERi
+__ZN7WebCore24passesAccessControlCheckERKNS_16ResourceResponseEbPNS_14SecurityOriginE
+__ZN7WebCore14XMLHttpRequest41makeCrossOriginAccessRequestWithPreflightERi
+__ZN7WebCore31CrossOriginPreflightResultCache16canSkipPreflightERKNS_6StringERKNS_4KURLEbS3_RKNS_13HTTPHeaderMapE
+__ZN7WebCore14XMLHttpRequest27didReceiveResponsePreflightERKNS_16ResourceResponseE
+__ZN7WebCore35CrossOriginPreflightResultCacheItem5parseERKNS_16ResourceResponseE
+__ZN7WebCoreL27addToAccessControlAllowListINS_10StringHashEEEvRKNS_6StringEjjRN3WTF7HashSetIS2_T_NS5_10HashTraitsIS2_EEEE
+__ZNK7WebCore6String13substringCopyEjj
+__ZN7WebCore10StringImpl13substringCopyEjj
+__ZN3WTF9HashTableIN7WebCore6StringES2_NS_17IdentityExtractorIS2_EENS1_15CaseFoldingHashENS_10HashTraitsIS2_EES7_E5clearEv
+__ZNK7WebCore6String12toUIntStrictEPbi
+__ZN7WebCore10StringImpl12toUIntStrictEPbi
+__ZN7WebCore22charactersToUIntStrictEPKtmPbi
+__ZNK7WebCore35CrossOriginPreflightResultCacheItem23allowsCrossOriginMethodERKNS_6StringE
+__ZNK7WebCore35CrossOriginPreflightResultCacheItem24allowsCrossOriginHeadersERKNS_13HTTPHeaderMapE
+__ZN7WebCore31CrossOriginPreflightResultCache11appendEntryERKNS_6StringERKNS_4KURLEPNS_35CrossOriginPreflightResultCacheItemE
+__ZN3WTF7HashMapISt4pairIN7WebCore6StringENS2_4KURLEEPNS2_35CrossOriginPreflightResultCacheItemENS_8PairHashIS3_S4_EENS_10HashT
+__ZN3WTF9HashTableISt4pairIN7WebCore6StringENS2_4KURLEES1_IS5_PNS2_35CrossOriginPreflightResultCacheItemEENS_18PairFirstExtract
+__ZN7WebCore14XMLHttpRequest25didFinishLoadingPreflightEv
+__ZN7WebCore14XMLHttpRequest33handleAsynchronousPreflightResultEv
+__ZNK7WebCore35CrossOriginPreflightResultCacheItem13allowsRequestEbRKNS_6StringERKNS_13HTTPHeaderMapE
+__ZN7WebCore45isOnAccessControlSimpleRequestHeaderWhitelistERKNS_6StringES2_
+__ZN7WebCoreL27addToAccessControlAllowListINS_15CaseFoldingHashEEEvRKNS_6StringEjjRN3WTF7HashSetIS2_T_NS5_10HashTraitsIS2_EEEE
+__ZN7WebCore32jsXMLHttpRequestExceptionMessageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40isOnAccessControlResponseHeaderWhitelistERKNS_6StringE
+__ZN7WebCore14XMLHttpRequest4openERKNS_6StringERKNS_4KURLEbS3_S3_Ri
+-[WebCoreSynchronousLoader connection:didReceiveAuthenticationChallenge:]
+__ZN7WebCoreL34newStreamingTextDecoderUserDefinedERKNS_12TextEncodingEPKv
+__ZN7WebCore20TextCodecUserDefined6decodeEPKcmbbRb
+__ZN7WebCore20TextCodecUserDefinedD0Ev
+__ZN7WebCore29jsXMLHttpRequestExceptionNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore52jsXMLHttpRequestPrototypeFunctionRemoveEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSXMLHttpRequest19removeEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore14XMLHttpRequest19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
+__ZN7WebCore29setJSXMLHttpRequestOnprogressEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore30setJSXMLHttpRequestOnloadstartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZThn16_N7WebCore24DocumentThreadableLoader15willSendRequestEPNS_17SubresourceLoaderERNS_15ResourceRequestERKNS_16ResourceResp
+__ZN7WebCore24DocumentThreadableLoader15willSendRequestEPNS_17SubresourceLoaderERNS_15ResourceRequestERKNS_16ResourceResponseE
+__ZThn16_N7WebCore14XMLHttpRequest20didFailRedirectCheckEv
+__ZN7WebCore14XMLHttpRequest20didFailRedirectCheckEv
+__ZN7WebCore22JSXMLHttpRequestUpload3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore32setJSXMLHttpRequestUploadOnabortEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZNK7WebCore20XMLHttpRequestUpload22scriptExecutionContextEv
+__ZN7WebCore32setJSXMLHttpRequestUploadOnerrorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore31setJSXMLHttpRequestUploadOnloadEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore36setJSXMLHttpRequestUploadOnloadstartEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore35setJSXMLHttpRequestUploadOnprogressEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCoreL10formCreateEP14__CFReadStreamPv
+__ZN7WebCoreL20getStreamFormDataMapEv
+__ZN3WTF7HashMapIP14__CFReadStreamNS_6RefPtrIN7WebCore8FormDataEEENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS9_IS6_EEE3setERKS2_RK
+__ZN3WTF9HashTableIP14__CFReadStreamSt4pairIS2_NS_6RefPtrIN7WebCore8FormDataEEEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS2_EEN
+__ZN7WebCore18httpBodyFromStreamEP13NSInputStream
+__ZNK3WTF7HashMapIP14__CFReadStreamNS_6RefPtrIN7WebCore8FormDataEEENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS9_IS6_EEE3getERKS2_
+__ZN7WebCoreL12formScheduleEP14__CFReadStreamP11__CFRunLoopPK10__CFStringPv
+__ZN7WebCore12SchedulePairC1EP11__CFRunLoopPK10__CFString
+__ZN7WebCore12SchedulePairC2EP11__CFRunLoopPK10__CFString
+__ZN7WebCoreL8formOpenEP14__CFReadStreamP13CFStreamErrorPhPv
+__ZN7WebCoreL14openNextStreamEPNS_16FormStreamFieldsE
+__ZN7WebCoreL20advanceCurrentStreamEPNS_16FormStreamFieldsE
+__ZN7WebCoreL18closeCurrentStreamEPNS_16FormStreamFieldsE
+__ZN7WebCoreL17formEventCallbackEP14__CFReadStreammPv
+__ZN7WebCoreL8formReadEP14__CFReadStreamPhlP13CFStreamErrorS2_Pv
+__ZN7WebCoreL11formCanReadEP14__CFReadStreamPv
+__ZN7WebCoreL9formCloseEP14__CFReadStreamPv
+__ZN7WebCore20XMLHttpRequestUpload18dispatchErrorEventEv
+__ZN7WebCore20XMLHttpRequestUpload35dispatchXMLHttpRequestProgressEventEPNS_13EventListenerERKNS_12AtomicStringEbjj
+__ZN7WebCore20XMLHttpRequestUpload14refEventTargetEv
+__ZN7WebCore20XMLHttpRequestUpload22toXMLHttpRequestUploadEv
+__ZN7WebCore20XMLHttpRequestUpload16derefEventTargetEv
+__ZNK7WebCore20XMLHttpRequestUpload12hasListenersEv
+__ZN7WebCore20XMLHttpRequestUpload22dispatchLoadStartEventEv
+__ZN7WebCoreL12formFinalizeEP14__CFReadStreamPv
+__ZN7WebCore20XMLHttpRequestUpload21dispatchProgressEventExx
+__ZN7WebCore20XMLHttpRequestUpload17dispatchLoadEventEv
+__ZN7WebCore10toDocumentEN3JSC7JSValueE
+__ZN7WebCore14XMLHttpRequest4sendEPNS_8DocumentERi
+__ZN3WTF6VectorIN7WebCore6StringELm16EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore6StringELm16EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore6StringELm16EE15reserveCapacityEm
+__ZN7WebCore5TimerINS_14ResourceHandleEE5firedEv
+__ZN7WebCore14ResourceHandle11fireFailureEPNS_5TimerIS0_EE
+__ZN7WebCore14ResourceLoader10wasBlockedEPNS_14ResourceHandleE
+__ZN7WebCore14ResourceLoader12blockedErrorEv
+__ZNK7WebCore11FrameLoader12blockedErrorERKNS_15ResourceRequestE
+__ZNK7WebCore18JSSVGCircleElement9classInfoEv
+__ZN7WebCoreL12aConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore11SVGAElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore11SVGAElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore11SVGAElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCore11SVGAElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore15RenderSVGInlineC1EPNS_4NodeE
+__ZNK7WebCore11SVGAElement25childShouldCreateRendererEPNS_4NodeE
+__ZNK7WebCore10SVGElement13isTextContentEv
+__ZN7WebCore22JSSVGGElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCoreL28createSVGImageElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore17JSSVGImageElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSSVGImageElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGImageElementEEE
+__ZN7WebCore17JSSVGImageElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGImageElementEEE
+__ZN7WebCore17JSSVGImageElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23jsSVGImageElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_16heightA
+__ZN7WebCore22jsSVGImageElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_15widthAt
+__ZNK7WebCore14RenderSVGImage19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbRNS_14TransformStateE
+__ZN7WebCore15RenderSVGInlineD0Ev
+__ZN7WebCore14RenderSVGImageD0Ev
+__ZN7WebCore17JSSVGImageElementD1Ev
+__ZN7WebCore26JSSVGImageElementPrototypeD1Ev
+__ZN7WebCore11SVGAElementD0Ev
+__ZN7WebCore15SVGImageElementD0Ev
+__ZN7WebCore14SVGImageLoaderD1Ev
+__ZN7WebCore14SVGImageLoaderD2Ev
+__ZN7WebCore22WorkerThreadableLoader6cancelEv
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge6cancelEv
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge7didFailERKNS_13ResourceErrorE
+__ZN7WebCore18createCallbackTaskIN3WTF6RefPtrINS1_16ThreadSafeSharedINS_29ThreadableLoaderClientWrapperEEEEENS2_IS4_EENS_13Reso
+__ZN7WebCore21CrossThreadCopierBaseILb0ENS_13ResourceErrorEE4copyERKS1_
+__ZNK7WebCore17ResourceErrorBase4copyEv
+__ZN7WebCore22WorkerThreadableLoader16MainThreadBridge16mainThreadCancelEPNS_22ScriptExecutionContextEPS1_
+__ZN7WebCore22WorkerThreadableLoader21derefThreadableLoaderEv
+__ZNK7WebCore8FormData8deepCopyEv
+__ZN7WebCore18GenericWorkerTask2IN3WTF10PassRefPtrINS_29ThreadableLoaderClientWrapperEEENS1_6RefPtrIS3_EENS_13ResourceErrorERKS
+__ZN7WebCoreL20workerContextDidFailEPNS_22ScriptExecutionContextEN3WTF6RefPtrINS_29ThreadableLoaderClientWrapperEEERKNS_13Resou
+__ZN7WebCore13WorkerContext15reportExceptionERKNS_6StringEiS3_
+__ZThn8_N7WebCore20WorkerMessagingProxy27postExceptionToWorkerObjectERKNS_6StringEiS3_
+__ZN7WebCore20WorkerMessagingProxy27postExceptionToWorkerObjectERKNS_6StringEiS3_
+__ZN7WebCore19WorkerExceptionTask11performTaskEPNS_22ScriptExecutionContextE
+__ZN7WebCore19WorkerExceptionTaskD0Ev
+__ZN7WebCore14RenderReplaced13paintReplacedERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore11RenderMedia10renderNameEv
+__ZN7WebCore29jsHTMLMediaElementCurrentTimeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLMediaElementErrorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement5errorEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10MediaErrorE
+__ZN7WebCore12JSMediaErrorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10MediaErrorEEE
+__ZN7WebCore12JSMediaErrorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10MediaErrorEEE
+__ZN7WebCore12JSMediaError18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore12JSMediaError9classInfoEv
+__ZN7WebCore12JSMediaErrorD1Ev
+__ZN7WebCore12JSMediaErrorD2Ev
+__ZN7WebCore27jsHTMLMediaElementStartTimeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement9startTimeEv
+__ZNK7WebCore11MediaPlayer9startTimeEv
+__ZNK7WebCore27MediaPlayerPrivateInterface9startTimeEv
+__ZN7WebCore24jsHTMLMediaElementPausedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16jsMediaErrorCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsHTMLMediaElementAutoplayEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsHTMLMediaElementBufferedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement8bufferedEv
+__ZN7WebCore11MediaPlayer15maxTimeBufferedEv
+__ZNK7WebCore18MediaPlayerPrivate15maxTimeBufferedEv
+__ZN7WebCore46jsHTMLMediaElementPrototypeFunctionCanPlayTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16HTMLMediaElement11canPlayTypeERKNS_6StringE
+__ZN7WebCore13MediaDocumentC1EPNS_5FrameE
+__ZN7WebCore13MediaDocumentC2EPNS_5FrameE
+__ZN7WebCore13MediaDocument15createTokenizerEv
+__ZNK7WebCore14MediaTokenizer12wantsRawDataEv
+__ZN7WebCore14MediaTokenizer12writeRawDataEPKci
+__ZN7WebCore14MediaTokenizer23createDocumentStructureEv
+__ZNK7WebCore13MediaDocument15isMediaDocumentEv
+__ZN7WebCore14MediaTokenizer6finishEv
+__ZN7WebCore13MediaDocument19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore14MediaTokenizerD0Ev
+__ZN7WebCore14DocumentLoader22cancelMainResourceLoadERKNS_13ResourceErrorE
+__ZN7WebCore18MediaPlayerPrivate17createQTMovieViewEv
+__ZN7WebCore18MediaPlayerPrivate17detachQTMovieViewEv
+__ZL15initQTMovieViewv
+-[WebCoreMovieObserver setView:]
+__ZN7WebCore24MediaControlInputElement7hitTestERKNS_8IntPointE
+__ZN7WebCore14RenderThemeMac23hitTestMediaControlPartEPNS_12RenderObjectERKNS_8IntPointE
+__ZN7WebCore11RenderTheme23hitTestMediaControlPartEPNS_12RenderObjectERKNS_8IntPointE
+__ZN7WebCore13MediaDocumentD0Ev
+__ZN7WebCore26jsHTMLMediaElementControlsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29MediaControlPlayButtonElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore16HTMLMediaElement15togglePlayStateEv
+__ZThn8_N7WebCore29MediaControlPlayButtonElementD0Ev
+__ZN7WebCore11RenderVideo20intrinsicSizeChangedEv
+__ZN7WebCore29setJSHTMLMediaElementControlsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement11setControlsEb
+__ZN7WebCore7Element19setBooleanAttributeERKNS_13QualifiedNameEb
+__ZN7WebCore40jsHTMLMediaElementPrototypeFunctionPauseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore28jsHTMLMediaElementAutobufferEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement10autobufferEv
+__ZN7WebCore31setJSHTMLMediaElementAutobufferEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement13setAutobufferEb
+__ZN7WebCore29setJSHTMLMediaElementAutoplayEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement11setAutoplayEb
+__ZN7WebCore22jsHTMLMediaElementLoopEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25setJSHTMLMediaElementLoopEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement7setLoopEb
+__ZN7WebCore23jsHTMLMediaElementEndedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLMediaElementMutedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26setJSHTMLMediaElementMutedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement8setMutedEb
+__ZN7WebCore18MediaPlayerPrivate9setVolumeEf
+__ZN7WebCore24jsHTMLMediaElementPlayedEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement6playedEv
+__ZN7WebCore10TimeRanges4copyEv
+__ZN7WebCore24jsHTMLVideoElementPosterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsHTMLMediaElementSeekingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement7seekingEv
+__ZN7WebCore28jsHTMLVideoElementVideoWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLVideoElement10videoWidthEv
+__ZN7WebCore29jsHTMLVideoElementVideoHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLVideoElement11videoHeightEv
+__ZNK7WebCore17HTMLSourceElement5mediaEv
+__ZN7WebCore22jsHTMLSourceElementSrcEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore22NullMediaPlayerPrivate8durationEv
+__ZN7WebCore24jsHTMLMediaElementVolumeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLMediaElement6volumeEv
+__ZN7WebCore27setJSHTMLMediaElementVolumeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLMediaElement9setVolumeEfRi
+__ZN7WebCore23jsHTMLVideoElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLVideoElement5widthEv
+__ZNK7WebCore6String6toUIntEPb
+__ZN7WebCore10StringImpl6toUIntEPb
+__ZN7WebCore16charactersToUIntEPKtmPb
+__ZN7WebCore24jsHTMLVideoElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16HTMLVideoElement6heightEv
+__ZN7WebCore26setJSHTMLVideoElementWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLVideoElement8setWidthEj
+__ZN7WebCore27setJSHTMLVideoElementHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLVideoElement9setHeightEj
+__ZNK7WebCore25AccessibilityRenderObject13valueForRangeEv
+__ZNK7WebCore25AccessibilityRenderObject16minValueForRangeEv
+__ZNK7WebCore25AccessibilityRenderObject16maxValueForRangeEv
+__ZNK7WebCore25AccessibilityRenderObject16activeDescendantEv
+-[AccessibilityObjectWrapper accessibilityParameterizedAttributeNames]
+__ZNK7WebCore25AccessibilityRenderObject13isMenuRelatedEv
+__ZNK7WebCore25AccessibilityRenderObject29boundsForVisiblePositionRangeERKNS_20VisiblePositionRangeE
+__ZNK7WebCore10ScrollView16contentsToScreenERKNS_7IntRectE
+__ZNK7WebCore10ScrollView24platformContentsToScreenERKNS_7IntRectE
+__ZN7WebCore9makeRangeERKNS_15VisiblePositionES2_
+__ZN7WebCore5Range11boundingBoxEv
+-[AccessibilityObjectWrapper accessibilityIsAttributeSettable:]
+__ZNK7WebCore25AccessibilityRenderObject20canSetValueAttributeEv
+__ZNK7WebCore25AccessibilityRenderObject10isReadOnlyEv
+__ZNK7WebCore25AccessibilityRenderObject30accessibilityParentForImageMapEPNS_14HTMLMapElementE
+-[AccessibilityObjectWrapper accessibilityHitTest:]
+__ZNK7WebCore25AccessibilityRenderObject22doAccessibilityHitTestERKNS_8IntPointE
+__ZNK7WebCore25AccessibilityRenderObject28accessibilityImageMapHitTestEPNS_15HTMLAreaElementERKNS_8IntPointE
+__ZNK7WebCore25AccessibilityImageMapLink22accessibilityIsIgnoredEv
+__ZN7WebCoreL16styleConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGStyleElementC1ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGStyleElementC2ERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGStyleElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore15SVGStyleElement20insertedIntoDocumentEv
+__ZN7WebCore15SVGStyleElement15childrenChangedEbPNS_4NodeES2_i
+__ZThn184_NK7WebCore15SVGStyleElement4typeEv
+__ZNK7WebCore15SVGStyleElement4typeEv
+__ZThn184_NK7WebCore15SVGStyleElement5mediaEv
+__ZNK7WebCore15SVGStyleElement5mediaEv
+__ZN7WebCore12StyleElement10setLoadingEb
+__ZNK7WebCore15SVGStyleElement5titleEv
+__ZN7WebCore15SVGStyleElement11sheetLoadedEv
+__ZN7WebCore15SVGStyleElement5sheetEv
+__ZN7WebCore15SVGStyleElement21finishParsingChildrenEv
+__ZN7WebCore19SVGAnimatedPropertyINS_16SVGStyledElementENS_6StringEXadL_ZNS_26SVGStyledElementIdentifierEEEXadL_ZNS_9HTMLNames1
+__ZN7WebCore6Editor14setCompositionERKNS_6StringERKN3WTF6VectorINS_20CompositionUnderlineELm0EEEjj
+__ZN7WebCore6Editor35setIgnoreCompositionSelectionChangeEb
+__ZN7WebCore6Editor17selectCompositionEv
+__ZNK7WebCore6Editor16compositionRangeEv
+__ZN3WTF6VectorIN7WebCore20CompositionUnderlineELm0EEaSERKS3_
+__ZN3WTF6VectorIN7WebCore20CompositionUnderlineELm0EE15reserveCapacityEm
+__ZN7WebCore19SelectionController16setSelectedRangeEPNS_5RangeENS_9EAffinityEb
+__ZN7WebCore13TypingCommand15deleteSelectionEPNS_8DocumentEb
+__ZN7WebCore13TypingCommand15deleteSelectionEb
+__ZN3WTF6VectorIN7WebCore20CompositionUnderlineELm0EE6shrinkEm
+__ZN3JSC12RuntimeArray18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZNK3JSC12RuntimeArray9classInfoEv
+__ZN3JSC12RuntimeArray12lengthGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN7WebCore15SVGStyleElementD0Ev
+__ZN7WebCore13InlineTextBox26paintCompositionBackgroundEPNS_15GraphicsContextEiiPNS_11RenderStyleERKNS_4FontEii
+__ZNK7WebCore6Editor23getCompositionSelectionERjS1_
+__ZN7WebCore6Editor44confirmCompositionWithoutDisturbingSelectionEv
+__ZN7WebCore6Editor18confirmCompositionERKNS_6StringEb
+-[WebScriptObject evaluateWebScript:]
+__ZN7WebCore6Editor18confirmCompositionERKNS_6StringE
+__ZN7WebCore6Editor13performDeleteEv
+__ZN7WebCore6Editor18confirmCompositionEv
+__ZN7WebCoreL26skipCommaInDashboardRegionEPNS_18CSSParserValueListE
+__Z3kitPN7WebCore5EventE
+__Z8kitClassPN7WebCore5EventE
+-[DOMEvent dealloc]
+__ZN7WebCore19implementationFrontEPNS_19JSDOMImplementationE
+__Z3kitPN7WebCore22DOMImplementationFrontE
+__ZN7WebCore22DOMImplementationFront3refEv
+-[DOMImplementation dealloc]
+__ZN7WebCore22DOMImplementationFront5derefEv
+__Z3kitPN7WebCore10TreeWalkerE
+-[DOMTreeWalker dealloc]
+__Z3kitPN7WebCore4RectE
+-[DOMRect dealloc]
+__Z3kitPN7WebCore7CounterE
+-[DOMCounter dealloc]
+__Z3kitPN7WebCore9MediaListE
+-[DOMMediaList dealloc]
+-[DOMXPathExpression dealloc]
+-[DOMXPathResult dealloc]
+-[DOMHTMLOptionsCollection dealloc]
+-[WebScriptObject removeWebScriptKey:]
+-[WebScriptObject setWebScriptValueAtIndex:value:]
+-[WebScriptObject stringRepresentation]
+-[DOMNode addEventListener:listener:useCapture:]
+__ZN7WebCore17ObjCEventListener4wrapEP11objc_object
+__ZN7WebCore17ObjCEventListener4findEP11objc_object
+__ZN7WebCore17ObjCEventListenerC1EP11objc_object
+__ZN7WebCore17ObjCEventListenerC2EP11objc_object
+__ZN3WTF7HashMapIP11objc_objectPN7WebCore17ObjCEventListenerENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS8_IS5_EEE3setERKS2_RKS5_
+__ZNK3WTF7HashMapIP11objc_objectPN7WebCore17ObjCEventListenerENS_7PtrHashIS2_EENS_10HashTraitsIS2_EENS8_IS5_EEE3getERKS2_
+__ZN7WebCore17ObjCEventListener11handleEventEPNS_5EventEb
+-[DOMEvent target]
+__Z3kitPN7WebCore11EventTargetE
+-[DOMEvent type]
+-[DOMEvent eventPhase]
+-[DOMEvent bubbles]
+-[DOMEvent cancelable]
+-[DOMUIEvent detail]
+-[DOMUIEvent view]
+-[DOMAbstractView document]
+-[DOMMouseEvent button]
+-[DOMMouseEvent clientX]
+-[DOMMouseEvent clientY]
+-[DOMMouseEvent screenX]
+-[DOMMouseEvent screenY]
+-[DOMMouseEvent metaKey]
+-[DOMMouseEvent altKey]
+-[DOMMouseEvent shiftKey]
+-[DOMMouseEvent ctrlKey]
+-[DOMMouseEvent relatedTarget]
+-[DOMKeyboardEvent keyIdentifier]
+-[DOMKeyboardEvent keyLocation]
+-[DOMKeyboardEvent metaKey]
+-[DOMKeyboardEvent altKey]
+-[DOMKeyboardEvent shiftKey]
+-[DOMKeyboardEvent ctrlKey]
+-[DOMKeyboardEvent keyCode]
+-[DOMKeyboardEvent charCode]
+__ZN7WebCore17ObjCEventListenerD0Ev
+__ZN3WTF9HashTableIP11objc_objectSt4pairIS2_PN7WebCore17ObjCEventListenerEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS2_EENS_14P
+-[DOMDocument createEvent:]
+-[DOMDocument defaultView]
+-[DOMKeyboardEvent initKeyboardEvent:canBubble:cancelable:view:keyIdentifier:keyLocation:ctrlKey:altKey:shiftKey:metaKey:]
+__Z4coreP15DOMAbstractView
+-[DOMNode dispatchEvent:]
+__Z4coreP8DOMEvent
++[WebScriptObject throwException:]
+__ZN3JSC8Bindings10throwErrorEPNS_9ExecStateENS_9ErrorTypeEP8NSString
+__ZN7WebCoreL10callPluginEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN3JSC13RuntimeMethod18getOwnPropertySlotEPNS_9ExecStateERKNS_10IdentifierERNS_12PropertySlotE
+__ZN3JSC16RuntimeObjectImp11fieldGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZN7WebCore13IdentifierRep3getEi
+__ZN7WebCoreL16intIdentifierMapEv
+__ZN3WTF7HashMapIiPN7WebCore13IdentifierRepENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3addERKiRKS3_
+__ZN3JSC16RuntimeObjectImp16getConstructDataERNS_13ConstructDataE
+__ZN3JSCL22callRuntimeConstructorEPNS_9ExecStateEPNS_8JSObjectERKNS_7ArgListE
+__ZN3JSC16RuntimeObjectImp23throwInvalidAccessErrorEPNS_9ExecStateE
+__ZN3JSC16RuntimeObjectImp16getPropertyNamesEPNS_9ExecStateERNS_17PropertyNameArrayE
+__ZN7WebCore16jsPluginFilenameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Plugin8filenameEv
+__ZN7WebCore14jsPluginLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore6Plugin6lengthEv
+__ZN7WebCore8JSPlugin18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore8JSPlugin11indexGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore6Plugin4itemEj
+__ZN7WebCore21jsMimeTypeDescriptionEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8MimeType11descriptionEv
+__ZN7WebCore18jsMimeTypeSuffixesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8MimeType8suffixesEv
+__ZN7WebCore8JSPlugin18canGetItemsForNameEPN3JSC9ExecStateEPNS_6PluginERKNS1_10IdentifierE
+__ZN7WebCore6Plugin18canGetItemsForNameERKNS_12AtomicStringE
+__ZN7WebCore29jsPluginPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore8JSPlugin9classInfoEv
+__ZN7WebCore34jsPluginPrototypeFunctionNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore6Plugin9namedItemERKNS_12AtomicStringE
+__ZN7WebCore34jsPluginArrayPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore39jsPluginArrayPrototypeFunctionNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore36jsMimeTypeArrayPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15JSMimeTypeArray9classInfoEv
+__ZN7WebCore41jsMimeTypeArrayPrototypeFunctionNamedItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14PluginDocumentC1EPNS_5FrameE
+__ZN7WebCore14PluginDocumentC2EPNS_5FrameE
+__ZN7WebCore14PluginDocument15createTokenizerEv
+__ZNK7WebCore15PluginTokenizer12wantsRawDataEv
+__ZN7WebCore15PluginTokenizer12writeRawDataEPKci
+__ZN7WebCore15PluginTokenizer23createDocumentStructureEv
+__ZNK7WebCore14PluginDocument16isPluginDocumentEv
+__ZN7WebCore15PluginTokenizer6finishEv
+__ZN7WebCore15PluginTokenizerD0Ev
+__ZN7WebCore14PluginDocumentD0Ev
+-[DOMNode(WebCoreInternal) _rootObject]
+-[WebScriptObject setException:]
+__ZN3JSC8Bindings9ObjcClass14fallbackObjectEPNS_9ExecStateEPNS0_8InstanceERKNS_10IdentifierE
+__ZN3JSC8Bindings21ObjcFallbackObjectImpC1EPNS_9ExecStateEPNS0_12ObjcInstanceERKNS_10IdentifierE
+__ZN3JSC8Bindings21ObjcFallbackObjectImpC2EPNS_9ExecStateEPNS0_12ObjcInstanceERKNS_10IdentifierE
+__ZN3JSC16RuntimeObjectImp20fallbackObjectGetterEPNS_9ExecStateERKNS_10IdentifierERKNS_12PropertySlotE
+__ZNK3JSC8Bindings21ObjcFallbackObjectImp9toBooleanEPNS_9ExecStateE
+__ZN3JSC8Bindings21ObjcFallbackObjectImpD1Ev
+__ZN7WebCore19RenderScrollbarPart22computeScrollbarHeightEv
+__ZN7WebCore15RenderScrollbar5paintEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore23ScrollbarThemeComposite5paintEPNS_9ScrollbarEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore20RenderScrollbarTheme8hasThumbEPNS_9ScrollbarE
+__ZN7WebCore20RenderScrollbarTheme24paintScrollbarBackgroundEPNS_15GraphicsContextEPNS_9ScrollbarE
+__ZN7WebCore15RenderScrollbar9paintPartEPNS_15GraphicsContextENS_13ScrollbarPartERKNS_7IntRectE
+__ZN7WebCore19RenderScrollbarPart13paintIntoRectEPNS_15GraphicsContextEiiRKNS_7IntRectE
+__ZN7WebCore20RenderScrollbarTheme11paintButtonEPNS_15GraphicsContextEPNS_9ScrollbarERKNS_7IntRectENS_13ScrollbarPartE
+__ZN7WebCore20RenderScrollbarTheme20paintTrackBackgroundEPNS_15GraphicsContextEPNS_9ScrollbarERKNS_7IntRectE
+__ZN7WebCore20RenderScrollbarTheme15paintTrackPieceEPNS_15GraphicsContextEPNS_9ScrollbarERKNS_7IntRectENS_13ScrollbarPartE
+__ZN7WebCore23ScrollbarThemeComposite14paintTickmarksEPNS_15GraphicsContextEPNS_9ScrollbarERKNS_7IntRectE
+__ZN7WebCore20RenderScrollbarTheme10paintThumbEPNS_15GraphicsContextEPNS_9ScrollbarERKNS_7IntRectE
+__ZNK7WebCore16CSSStyleSelector15SelectorChecker25checkScrollbarPseudoClassEPNS_11CSSSelectorERNS_8PseudoIdE
+__ZN7WebCore15RenderScrollbar19partForStyleResolveEv
+__ZN7WebCore19RenderScrollbarPart20layoutHorizontalPartEv
+__ZThn200_NK7WebCore13RenderListBox22scrollbarCornerPresentEv
+__ZNK7WebCore13RenderListBox22scrollbarCornerPresentEv
+__ZN7WebCore19RenderScrollbarPart12imageChangedEPvPKNS_7IntRectE
+__ZNK7WebCore11RenderLayer22scrollbarCornerPresentEv
+__ZNK7WebCore9FillLayer13hasFixedImageEv
+__ZN7WebCore33jsStoragePrototypeFunctionSetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Storage7setItemERKNS_6StringES3_Ri
+__ZN7WebCore11StorageArea7setItemERKNS_6StringES3_RiPNS_5FrameE
+__ZN7WebCore11StorageArea15internalSetItemERKNS_6StringES3_RiPNS_5FrameE
+__ZN7WebCore10StorageMap7setItemERKNS_6StringES3_RS1_
+__ZN3WTF7HashMapIN7WebCore6StringES2_NS1_10StringHashENS_10HashTraitsIS2_EES5_E3addERKS2_S8_
+__ZN7WebCore10StorageMap18invalidateIteratorEv
+__ZN7WebCore18SessionStorageArea11itemChangedERKNS_6StringES3_S3_PNS_5FrameE
+__ZN7WebCore18SessionStorageArea20dispatchStorageEventERKNS_6StringES3_S3_PNS_5FrameE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm0EE15reserveCapacityEm
+__ZN7WebCore4Node20dispatchStorageEventERKNS_12AtomicStringERKNS_6StringES6_S6_PNS_5FrameE
+__ZN7WebCore12StorageEventC1ERKNS_12AtomicStringERKNS_6StringES6_S6_S6_N3WTF10PassRefPtrINS_9DOMWindowEEE
+__ZN7WebCore12StorageEventC2ERKNS_12AtomicStringERKNS_6StringES6_S6_S6_N3WTF10PassRefPtrINS_9DOMWindowEEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore5FrameEEELm0EE6shrinkEm
+__ZN7WebCore9JSStorage10nameGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZNK7WebCore7Storage7getItemERKNS_6StringE
+__ZNK7WebCore11StorageArea7getItemERKNS_6StringE
+__ZNK7WebCore11StorageArea15internalGetItemERKNS_6StringE
+__ZNK7WebCore10StorageMap7getItemERKNS_6StringE
+__ZN7WebCore36jsStoragePrototypeFunctionRemoveItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Storage10removeItemERKNS_6StringE
+__ZN7WebCore11StorageArea10removeItemERKNS_6StringEPNS_5FrameE
+__ZN7WebCore11StorageArea18internalRemoveItemERKNS_6StringEPNS_5FrameE
+__ZN7WebCore10StorageMap10removeItemERKNS_6StringERS1_
+__ZN3WTF7HashMapIN7WebCore6StringES2_NS1_10StringHashENS_10HashTraitsIS2_EES5_E4takeERKS2_
+__ZN7WebCore18SessionStorageArea11itemRemovedERKNS_6StringES3_PNS_5FrameE
+__ZN7WebCore14SecurityOrigin28createFromDatabaseIdentifierERKNS_6StringE
+__ZNK7WebCore15SQLiteStatement18bindParameterCountEv
+__ZN7WebCore12SQLResultSetC1Ev
+__ZN7WebCore12SQLResultSetC2Ev
+__ZN7WebCore12SQLResultSet11setInsertIdEx
+__ZN7WebCore14SQLiteDatabase11lastChangesEv
+__ZN7WebCore12SQLResultSet15setRowsAffectedEi
+__ZN7WebCore18OriginQuotaManager12markDatabaseEPNS_8DatabaseE
+__ZN7WebCore17OriginUsageRecord12markDatabaseERKNS_6StringE
+__ZN7WebCore28JSCustomSQLStatementCallback11handleEventEPNS_14SQLTransactionEPNS_12SQLResultSetERb
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12SQLResultSetE
+__ZN7WebCore14JSSQLResultSet15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSSQLResultSetC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SQLResultSetEEE
+__ZN7WebCore14JSSQLResultSetC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SQLResultSetEEE
+__ZN3WTF6VectorIN7WebCore8SQLValueELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore8SQLValueELm0EE15reserveCapacityEm
+__ZN7WebCore8SQLValueC1ERKS0_
+__ZN7WebCore8SQLValueC2ERKS0_
+__ZN3WTF6VectorIN7WebCore8SQLValueELm0EE6shrinkEm
+__ZN7WebCore15SQLiteStatement9bindValueEiRKNS_8SQLValueE
+__ZNK7WebCore8SQLValue6numberEv
+__ZN7WebCore15SQLiteStatement10bindDoubleEid
+__ZNK7WebCore8SQLValue6stringEv
+__ZN7WebCore14SQLTransaction19postflightAndCommitEv
+__ZN7WebCore15DatabaseTracker29scheduleNotifyDatabaseChangedEPNS_14SecurityOriginERKNS_6StringE
+__ZN7WebCoreL17notificationMutexEv
+__ZN7WebCoreL17notificationQueueEv
+__ZN3WTF6VectorISt4pairIPN7WebCore14SecurityOriginENS2_6StringEELm0EE14expandCapacityEmPKS6_
+__ZN3WTF6VectorISt4pairIPN7WebCore14SecurityOriginENS2_6StringEELm0EE14expandCapacityEm
+__ZN3WTF6VectorISt4pairIPN7WebCore14SecurityOriginENS2_6StringEELm0EE15reserveCapacityEm
+__ZN7WebCore15DatabaseTracker23scheduleForNotificationEv
+__ZN7WebCore15DatabaseTracker22notifyDatabasesChangedEPv
+__ZN3WTF6VectorISt4pairIPN7WebCore14SecurityOriginENS2_6StringEELm0EE6shrinkEm
+__ZN7WebCore14SQLTransaction27cleanupAfterSuccessCallbackEv
+__ZNK7WebCore12SQLResultSet4rowsEv
+__ZN7WebCore15SQLiteStatement13getColumnNameEi
+__ZN7WebCore15SQLiteStatement14getColumnValueEi
+__ZN3WTF6VectorIN7WebCore8SQLValueELm0EE14expandCapacityEmPKS2_
+__ZN7WebCore17SQLiteTransaction4stopEv
+__ZN7WebCore14JSSQLResultSetD1Ev
+__ZN7WebCore14JSSQLResultSetD2Ev
+__ZN7WebCore23JSSQLResultSetPrototypeD1Ev
+__ZN7WebCore35JSCustomSQLTransactionErrorCallbackC1EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore35JSCustomSQLTransactionErrorCallbackC2EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore14toVoidCallbackEPN3JSC9ExecStateENS0_7JSValueE
+__ZN7WebCore20JSCustomVoidCallbackC1EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore20JSCustomVoidCallbackC2EPN3JSC8JSObjectEPNS_5FrameE
+__ZN7WebCore35JSCustomSQLTransactionErrorCallbackD0Ev
+__ZN7WebCore14SQLTransaction22deliverSuccessCallbackEv
+__ZN7WebCore20JSCustomVoidCallback11handleEventEv
+__ZN7WebCore20JSCustomVoidCallbackD0Ev
+__ZN7WebCore8Database21setAuthorizerReadOnlyEv
+__ZN7WebCore18DatabaseAuthorizer11setReadOnlyEv
+__ZN7WebCore10JSSQLError18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore17jsSQLErrorMessageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18DatabaseAuthorizer11allowDeleteERKNS_6StringE
+__ZN7WebCore15DatabaseTracker18deleteAllDatabasesEv
+__ZN7WebCore15DatabaseTracker7originsERN3WTF6VectorINS1_6RefPtrINS_14SecurityOriginEEELm0EEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SecurityOriginEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SecurityOriginEEELm0EE15reserveCapacityEm
+__ZN7WebCore15DatabaseTracker12deleteOriginEPNS_14SecurityOriginE
+__ZN7WebCore15DatabaseTracker18deleteDatabaseFileEPNS_14SecurityOriginERKNS_6StringE
+__ZN7WebCore10deleteFileERKNS_6StringE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore8DatabaseEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore8DatabaseEEELm0EE15reserveCapacityEm
+__ZN7WebCore8Database21markAsDeletedAndCloseEv
+__ZNK7WebCore14DatabaseThread20terminationRequestedEv
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore8DatabaseEEELm0EE6shrinkEm
+__ZN7WebCore20deleteEmptyDirectoryERKNS_6StringE
+__ZN7WebCore18OriginQuotaManager12removeOriginEPNS_14SecurityOriginE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SecurityOriginEEELm0EE6shrinkEm
+__ZN7WebCore18DatabaseAuthorizer13allowFunctionERKNS_6StringE
+__ZN7WebCore12SQLStatement20setFailureDueToQuotaEv
+__ZN7WebCore14SQLTransaction28deliverQuotaIncreaseCallbackEv
+__ZN7WebCore14JSSQLResultSet18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore18jsSQLResultSetRowsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SQLResultSetRowListE
+__ZN7WebCore21JSSQLResultSetRowList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSQLResultSetRowListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SQLResultSetRowListEEE
+__ZN7WebCore21JSSQLResultSetRowListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SQLResultSetRowListEEE
+__ZN7WebCore21JSSQLResultSetRowList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30JSSQLResultSetRowListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsSQLResultSetRowListPrototypeFunctionItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore21JSSQLResultSetRowList9classInfoEv
+__ZN7WebCore21JSSQLResultSetRowList4itemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore19SQLResultSetRowList6lengthEv
+__ZN7WebCore18DatabaseAuthorizer9dropTableERKNS_6StringE
+__ZN7WebCore21JSSQLResultSetRowListD1Ev
+__ZN7WebCore21JSSQLResultSetRowListD2Ev
+__ZN7WebCore30JSSQLResultSetRowListPrototypeD1Ev
+__ZN7WebCore9JSStorage16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZN7WebCore9JSStorage22customGetPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZNK7WebCore7Storage6lengthEv
+__ZNK7WebCore16LocalStorageArea6lengthEv
+__ZNK7WebCore11StorageArea14internalLengthEv
+__ZNK7WebCore10StorageMap6lengthEv
+__ZN7WebCore15jsStorageLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsStoragePrototypeFunctionClearEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Storage5clearEv
+__ZN7WebCore11StorageArea5clearEPNS_5FrameE
+__ZN7WebCore11StorageArea13internalClearEPNS_5FrameE
+__ZN7WebCore16LocalStorageArea11areaClearedEPNS_5FrameE
+__ZN7WebCore16LocalStorageArea13scheduleClearEv
+__ZN7WebCore16LocalStorageArea20dispatchStorageEventERKNS_6StringES3_S3_PNS_5FrameE
+__ZN7WebCore9JSStorage3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore9JSStorage9customPutEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore16LocalStorageArea7setItemERKNS_6StringES3_RiPNS_5FrameE
+__ZN7WebCore16LocalStorageArea11itemChangedERKNS_6StringES3_S3_PNS_5FrameE
+__ZN7WebCore16LocalStorageArea19scheduleItemForSyncERKNS_6StringES3_
+__ZNK7WebCore16LocalStorageArea7getItemERKNS_6StringE
+__ZN7WebCore9JSStorage14deletePropertyEPN3JSC9ExecStateERKNS1_10IdentifierE
+__ZN7WebCore16LocalStorageArea10removeItemERKNS_6StringEPNS_5FrameE
+__ZN7WebCore16LocalStorageArea11itemRemovedERKNS_6StringES3_PNS_5FrameE
+__ZN7WebCore5TimerINS_16LocalStorageAreaEE5firedEv
+__ZN7WebCore16LocalStorageArea14syncTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore12LocalStorage12scheduleSyncEN3WTF10PassRefPtrINS_16LocalStorageAreaEEE
+__ZNK7WebCore7Storage3keyEjRi
+__ZNK7WebCore16LocalStorageArea3keyEjRi
+__ZNK7WebCore11StorageArea11internalKeyEjRi
+__ZNK7WebCore10StorageMap3keyEjRNS_6StringE
+__ZNK7WebCore10StorageMap18setIteratorToIndexEj
+__ZN7WebCore33jsStoragePrototypeFunctionGetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore29jsStoragePrototypeFunctionKeyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore11StorageArea6lengthEv
+__ZN7WebCore18SessionStorageArea11areaClearedEPNS_5FrameE
+__ZNK7WebCore11StorageArea3keyEjRi
+__ZN7WebCore10StorageMap4copyEv
+__ZN7WebCoremlERKNS_8SMILTimeES2_
+__ZNK7WebCore14SVGSMILElement8isFrozenEv
+__ZSt25__unguarded_linear_insertIPPN7WebCore14SVGSMILElementES2_NS0_15PriorityCompareEEvT_T0_T1_
+__ZNK7WebCore19SVGAnimationElement9fromValueEv
+__ZN7WebCoreL22applyOrderSortFunctionEPNS_14SVGSMILElementES1_
+__ZSt25__unguarded_linear_insertIPPN7WebCore14SVGSMILElementES2_PFbS2_S2_EEvT_T0_T1_
+__ZNK7WebCore10SVGElement8isStyledEv
+__ZN7WebCore5writeERNS_10TextStreamERKNS_13RenderSVGRootEi
+__ZN7WebCoreL19writeStandardPrefixERNS_10TextStreamERKNS_12RenderObjectEi
+__ZNK7WebCore13RenderSVGRoot10renderNameEv
+__ZN7WebCoreL21writePositionAndStyleERNS_10TextStreamERKNS_12RenderObjectE
+__ZNK7WebCore13RenderSVGRoot17absoluteTransformEv
+__ZNK7WebCore12RenderObject17absoluteTransformEv
+__ZNK7WebCore9RenderBox14localTransformEv
+__ZNK7WebCore13RenderSVGRoot14localTransformEv
+__ZN7WebCorelsERNS_10TextStreamERKNS_9FloatRectE
+__ZN7WebCoreL12hasFractionsEd
+__ZN7WebCoreL17writeIfNotDefaultIfEEvRNS_10TextStreamEPKcT_S5_
+__ZN7WebCoreL15writeIfNotEmptyERNS_10TextStreamEPKcRKNS_6StringE
+__ZN7WebCoreL13writeChildrenERNS_10TextStreamERKNS_12RenderObjectEi
+__ZNK7WebCore18RenderSVGContainer14isSVGContainerEv
+__ZN7WebCore5writeERNS_10TextStreamERKNS_18RenderSVGContainerEi
+__ZNK7WebCore18RenderSVGContainer10renderNameEv
+__ZNK7WebCore31RenderSVGTransformableContainer14localTransformEv
+__ZN7WebCore5writeERNS_10TextStreamERKNS_10RenderPathEi
+__ZNK7WebCore10RenderPath10renderNameEv
+__ZNK7WebCore10RenderPath14localTransformEv
+__ZN7WebCorelsERNS_10TextStreamERNS_19TextStreamSeparatorE
+__ZN7WebCorelsERNS_10TextStreamERKNS_14SVGPaintServerE
+__ZNK7WebCore19SVGPaintServerSolid22externalRepresentationERNS_10TextStreamE
+__ZN7WebCorelsERNS_10TextStreamERKNS_5ColorE
+__ZN7WebCoreL17writeIfNotDefaultIdEEvRNS_10TextStreamEPKcT_S5_
+__ZN7WebCore10TextStreamlsEd
+__ZNK7WebCore10RenderPath4pathEv
+__ZNK7WebCore4Path11debugStringEv
+__ZN7WebCoreL31CGPathToCFStringApplierFunctionEPvPK13CGPathElement
+__ZN7WebCoreL23writeNameAndQuotedValueINS_6StringEEEvRNS_10TextStreamEPKcT_
+__ZN7WebCore5writeERNS_10TextStreamERKNS_13RenderSVGTextEi
+__ZNK7WebCore13RenderSVGText10renderNameEv
+__ZN7WebCore10TextStreamlsEm
+__ZN7WebCore5writeERNS_10TextStreamERKNS_19RenderSVGInlineTextEi
+__ZNK7WebCore19RenderSVGInlineText10renderNameEv
+__ZNK7WebCore10RenderText14firstRunOriginEv
+__ZNK7WebCore16SVGInlineTextBox16svgRootInlineBoxEv
+__ZN7WebCore10TextStreamlsEj
+__ZN7WebCorelsERNS_10TextStreamERKNS_20TransformationMatrixE
+__ZN7WebCore11PathBuilder15svgCurveToCubicEddddddb
+__ZN7WebCore13ColorDistanceC1ERKNS_5ColorES3_
+__ZN7WebCore13ColorDistanceC2ERKNS_5ColorES3_
+__ZNK7WebCore13ColorDistance14scaledDistanceEf
+__ZN7WebCore13ColorDistanceC1Eiii
+__ZN7WebCore13ColorDistanceC2Eiii
+__ZNK7WebCore13ColorDistance18addToColorAndClampERKNS_5ColorE
+__ZN7WebCore16SVGStyledElement5styleEv
+__ZNK7WebCore4Font20drawTextUsingSVGFontEPNS_15GraphicsContextERKNS_7TextRunERKNS_10FloatPointEii
+__ZN7WebCore16SVGTextRunWalkerINS_28SVGTextRunWalkerDrawTextDataEE4walkERKNS_7TextRunEbRKNS_6StringEii
+__ZN7WebCoreL28drawTextUsingSVGFontCallbackERKNS_18SVGGlyphIdentifierERNS_28SVGTextRunWalkerDrawTextDataE
+__ZNK7WebCore24RenderSVGHiddenContainer14isSVGContainerEv
+__ZNK7WebCore24RenderSVGHiddenContainer10renderNameEv
+__ZNK7WebCore24RenderSVGHiddenContainer17absoluteTransformEv
+__ZN7WebCoreL24animatemotionConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore23SVGAnimateMotionElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore23SVGAnimateMotionElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore23SVGAnimateMotionElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore23SVGAnimateMotionElement16resetToBaseValueERKNS_6StringE
+__ZNK7WebCore23SVGAnimateMotionElement14hasValidTargetEv
+__ZNK7WebCore29SVGStyledTransformableElement21isStyledTransformableEv
+__ZN7WebCore29SVGStyledTransformableElement21supplementalTransformEv
+__ZNK7WebCore23SVGAnimateMotionElement13animationPathEv
+__ZN7WebCore23SVGAnimateMotionElement24calculateFromAndToValuesERKNS_6StringES3_
+__ZN7WebCoreL10parsePointERKNS_6StringERNS_10FloatPointE
+__ZN7WebCore23SVGAnimateMotionElement22calculateAnimatedValueEfjPNS_14SVGSMILElementE
+__ZN7WebCore23SVGAnimateMotionElement20applyResultsToTargetEv
+__ZN7WebCore23SVGAnimateMotionElementD0Ev
+__ZN7WebCore18PathTraversalState13cubicBezierToERKNS_10FloatPointES3_S3_
+__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore11CubicBezierELm0EE6shrinkEm
+__ZNK7WebCore23SVGAnimateMotionElement10rotateModeEv
+__ZN7WebCoreL16mpathConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore15SVGMPathElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGMPathElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore15SVGMPathElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZThn184_NK7WebCore15SVGMPathElement14contextElementEv
+__ZNK7WebCore15SVGMPathElement14contextElementEv
+__ZN7WebCore15SVGMPathElement11pathElementEv
+__ZN7WebCore15SVGMPathElementD0Ev
+__ZN7WebCore19SVGAnimationElement33calculateKeyTimesForCalcModePacedEv
+__ZN7WebCore17SVGAnimateElement17calculateDistanceERKNS_6StringES3_
+__ZN7WebCore23SVGAnimateMotionElement17calculateDistanceERKNS_6StringES3_
+__ZN3WTF6VectorIN7WebCore10UnitBezierELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore10UnitBezierELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore10UnitBezierELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore10UnitBezierELm0EE15reserveCapacityEm
+__ZNK7WebCore19SVGAnimationElement25calculatePercentForSplineEfj
+__ZN3WTF6VectorIN7WebCore10UnitBezierELm0EE6shrinkEm
+__ZThn304_NK7WebCore11SVGAElement14contextElementEv
+__ZNK7WebCore11SVGAElement14contextElementEv
+__ZNK7WebCore11SVGAElement7isValidEv
+__ZN7WebCore14SVGSMILElement14parseConditionERKNS_6StringENS0_10BeginOrEndE
+__ZN7WebCore14SVGSMILElement9ConditionC1ENS1_4TypeENS0_10BeginOrEndERKNS_6StringES6_NS_8SMILTimeEi
+__ZN7WebCore14SVGSMILElement9ConditionC2ENS1_4TypeENS0_10BeginOrEndERKNS_6StringES6_NS_8SMILTimeEi
+__ZN3WTF6VectorIN7WebCore14SVGSMILElement9ConditionELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIN7WebCore14SVGSMILElement9ConditionELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore14SVGSMILElement9ConditionELm0EE15reserveCapacityEm
+__ZN7WebCore14SVGSMILElement16addTimeDependentEPS0_
+__ZN7WebCore14SVGSMILElement19removedFromDocumentEv
+__ZN7WebCore14SVGSMILElement19removeTimeDependentEPS0_
+__ZN3WTF6VectorIN7WebCore14SVGSMILElement9ConditionELm0EE6shrinkEm
+__ZThn8_N7WebCore17SVGAnimateElementD0Ev
+__ZN7WebCoreL23animatecolorConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore22SVGAnimateColorElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore22SVGAnimateColorElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL27animatetransformConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore26SVGAnimateTransformElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore26SVGAnimateTransformElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore26SVGAnimateTransformElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore10SVGElement21isStyledTransformableEv
+__ZN7WebCore14SVGTextElement21supplementalTransformEv
+__ZN7WebCore26SVGAnimateTransformElement16resetToBaseValueERKNS_6StringE
+__ZNK7WebCore26SVGAnimateTransformElement14hasValidTargetEv
+__ZN7WebCore25SVGTextPositioningElement16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore21SVGTextContentElement16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore26SVGAnimateTransformElement20applyResultsToTargetEv
+__ZN7WebCoreL16transformListForEPNS_10SVGElementE
+__ZN7WebCore22SVGAnimateColorElementD0Ev
+__ZN7WebCore26SVGAnimateTransformElementD0Ev
+__ZN7WebCoreL19polylineConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore18SVGPolylineElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGPolyElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17SVGAnimatedPointsC2Ev
+__ZN7WebCore14SVGPolyElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCore14SVGPolyElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZNK7WebCore14SVGPolyElement6pointsEv
+__ZN7WebCore12SVGPointListC1ERKNS_13QualifiedNameE
+__ZN7WebCore12SVGPointListC2ERKNS_13QualifiedNameE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE14shrinkCapacityEm
+__ZN7WebCore21pointsListFromSVGDataEPNS_12SVGPointListERKNS_6StringE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE14expandCapacityEmPKS6_
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE15reserveCapacityEm
+__ZNK7WebCore14SVGPolyElement7isValidEv
+__ZN7WebCore14SVGPolyElement16rendererIsNeededEPNS_11RenderStyleE
+__ZNK7WebCore14SVGPolyElement26updateAnimatedSVGAttributeERKNS_6StringE
+__ZN7WebCoreL18polygonConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore17SVGPolygonElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL14useConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore13SVGUseElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore13SVGUseElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZThn408_NK7WebCore13SVGUseElement14contextElementEv
+__ZNK7WebCore13SVGUseElement14contextElementEv
+__ZN7WebCore13SVGUseElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZN7WebCore13SVGUseElement20insertedIntoDocumentEv
+__ZN7WebCore13SVGUseElement20buildPendingResourceEv
+__ZN7WebCore18SVGElementInstanceC1EPNS_13SVGUseElementEPNS_10SVGElementE
+__ZN7WebCore18SVGElementInstanceC2EPNS_13SVGUseElementEPNS_10SVGElementE
+__ZN7WebCore10SVGElement20mapInstanceToElementEPNS_18SVGElementInstanceE
+__ZN3WTF7HashSetIPN7WebCore18SVGElementInstanceENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6exp
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6reh
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13al
+__ZN7WebCore13SVGUseElement17buildInstanceTreeEPNS_10SVGElementEPNS_18SVGElementInstanceERb
+__ZN7WebCoreL19isDisallowedElementEPNS_4NodeE
+__ZNK7WebCore19SVGAnimatedPropertyINS_13SVGUseElementENS_9SVGLengthEXadL_ZNS_8SVGNames12useTagStringEEEXadL_ZNS3_11xAttrStringE
+__ZNK7WebCore19SVGAnimatedPropertyINS_13SVGUseElementENS_9SVGLengthEXadL_ZNS_8SVGNames12useTagStringEEEXadL_ZNS3_11yAttrStringE
+__ZN7WebCore13SVGUseElement15buildShadowTreeEPNS_10SVGElementEPNS_18SVGElementInstanceE
+__ZN7WebCoreL32subtreeContainsDisallowedElementEPNS_4NodeE
+__ZN7WebCore13SVGUseElement35removeDisallowedElementsFromSubtreeEPNS_4NodeE
+__ZN7WebCore13SVGUseElement29expandUseElementsInShadowTreeEPNS_4NodeE
+__ZN7WebCore13SVGUseElement32expandSymbolElementsInShadowTreeEPNS_4NodeE
+__ZN7WebCore13SVGUseElement40associateInstancesWithShadowTreeElementsEPNS_4NodeEPNS_18SVGElementInstanceE
+__ZN7WebCore18SVGElementInstance20setShadowTreeElementEPNS_10SVGElementE
+__ZN7WebCore13SVGUseElement34transferEventListenersToShadowTreeEPNS_18SVGElementInstanceE
+__ZN7WebCore13SVGUseElement16attachShadowTreeEv
+__ZN7WebCore13SVGUseElement6attachEv
+__ZNK7WebCore13SVGUseElement7isValidEv
+__ZN7WebCore13SVGUseElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore10SVGElement16shadowParentNodeEv
+__ZN7WebCore13SVGUseElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore18SVGElementInstance13forgetWrapperEv
+__ZN7WebCore10TreeSharedINS_18SVGElementInstanceEE14removedLastRefEv
+__ZN7WebCore18SVGElementInstanceD0Ev
+__ZN7WebCore10SVGElement21removeInstanceMappingEPNS_18SVGElementInstanceE
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4fin
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47re
+__ZN3WTF9HashTableIPN7WebCore18SVGElementInstanceES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rem
+__ZN7WebCore28removeAllChildrenInContainerINS_18SVGElementInstanceES1_EEvPT0_
+__ZN7WebCore7Private28addChildNodesToDeletionQueueINS_18SVGElementInstanceES2_EEvRPT_S5_PT0_
+__ZThn8_N7WebCore22SVGAnimateColorElementD0Ev
+__ZThn8_N7WebCore26SVGAnimateTransformElementD0Ev
+__ZThn8_N7WebCore23SVGAnimateMotionElementD0Ev
+__ZN7WebCore18SVGPolylineElementD0Ev
+__ZN7WebCore14SVGPolyElementD2Ev
+__ZN7WebCore12SVGPointListD0Ev
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore14SVGPODListItemINS2_10FloatPointEEEEELm0EE6shrinkEm
+__ZN7WebCore17SVGAnimatedPointsD2Ev
+__ZN7WebCore17SVGPolygonElementD0Ev
+__ZN7WebCore13SVGUseElement11recalcStyleENS_4Node11StyleChangeE
+__ZNK7WebCore18SVGPolylineElement10toPathDataEv
+__ZNK7WebCore17SVGPolygonElement10toPathDataEv
+__ZSt21__unguarded_partitionIPPN7WebCore14SVGSMILElementES2_NS0_15PriorityCompareEET_S5_S5_T0_T1_
+__ZN7WebCore26SVGAnimateTransformElement24calculateFromAndToValuesERKNS_6StringES3_
+__ZNK7WebCore26SVGAnimateTransformElement19parseTransformValueERKNS_6StringE
+__ZN7WebCore12SVGTransform7isValidEv
+__ZN7WebCore26SVGAnimateTransformElement22calculateAnimatedValueEfjPNS_14SVGSMILElementE
+__ZN7WebCore20SVGTransformDistanceC1ERKNS_12SVGTransformES3_
+__ZN7WebCore20SVGTransformDistanceC2ERKNS_12SVGTransformES3_
+__ZNK7WebCore12SVGTransform4typeEv
+__ZNK7WebCore12SVGTransform5scaleEv
+__ZN7WebCore9FloatSize15narrowPrecisionEdd
+__ZNK7WebCore20SVGTransformDistance14scaledDistanceEf
+__ZN7WebCore20SVGTransformDistanceC1ENS_12SVGTransform16SVGTransformTypeEfffRKNS_20TransformationMatrixE
+__ZN7WebCore20SVGTransformDistanceC2ENS_12SVGTransform16SVGTransformTypeEfffRKNS_20TransformationMatrixE
+__ZNK7WebCore20SVGTransformDistance17addToSVGTransformERKNS_12SVGTransformE
+__ZNK7WebCore12SVGTransform9translateEv
+__ZNK7WebCore12SVGTransform14rotationCenterEv
+__ZNK7WebCore12SVGTransform5angleEv
+__ZN7WebCore18SVGElementInstance14setNeedsUpdateEb
+__ZN7WebCoreL30shadowTreeContainsChangedNodesEPNS_18SVGElementInstanceE
+__ZN7WebCore19SVGAnimatedPropertyINS_29SVGStyledTransformableElementENS_16SVGTransformListEXadL_ZNS_39SVGStyledTransformableEle
+__ZNK7WebCore14SVGPolyElement15supportsMarkersEv
+__ZNK7WebCore14RenderSVGImage10isSVGImageEv
+__ZN7WebCore5writeERNS_10TextStreamERKNS_14RenderSVGImageEi
+__ZNK7WebCore14RenderSVGImage10renderNameEv
+__ZNK7WebCore14RenderSVGImage14localTransformEv
+__ZN7WebCore13SVGUseElement6detachEv
+__ZN7WebCore13SVGUseElementD0Ev
+__ZThn8_N7WebCore14SVGLineElementD0Ev
+__ZThn8_N7WebCore14SVGRectElementD0Ev
+__ZThn8_N7WebCore16SVGCircleElementD0Ev
+__ZThn8_N7WebCore18SVGPolylineElementD0Ev
+__ZThn8_N7WebCore17SVGPolygonElementD0Ev
+__ZThn8_N7WebCore15SVGImageElementD0Ev
+__ZN7WebCore9CSSParser23parseSVGStrokeDasharrayEv
+__ZNK7WebCore19SVGAnimationElement26currentValuesFromKeyPointsEfRfRNS_6StringES3_
+__ZNK7WebCore19SVGAnimationElement29calculatePercentFromKeyPointsEf
+__ZN3WTF6VectorIdLm0EE14expandCapacityEm
+__ZN3WTF6VectorIdLm0EE15reserveCapacityEm
+__ZN3WTF6VectorIdLm0EE6shrinkEm
+__ZN3WTF6VectorIdLm0EEC1ERKS1_
+__ZN3WTF6VectorIdLm0EEC2ERKS1_
+__ZN7WebCorelsERNS_10TextStreamENS_8WindRuleE
+__ZN7WebCore14SVGSMILElement31createInstanceTimesFromSyncbaseEPS0_NS0_21NewOrExistingIntervalE
+__ZSt25__unguarded_linear_insertIPN7WebCore8SMILTimeES1_EvT_T0_
+__ZThn8_N7WebCore13SVGSetElementD0Ev
+__ZN7WebCore18SVGElementInstance11appendChildEN3WTF10PassRefPtrIS0_EE
+__ZN7WebCore22appendChildToContainerINS_18SVGElementInstanceES1_EEvPT_PT0_
+__ZN7WebCore13SVGUseElement24handleDeepUseReferencingEPS0_PNS_18SVGElementInstanceERb
+__ZNK7WebCore13SVGUseElement38transferUseAttributesToReplacedElementEPNS_10SVGElementES2_
+__ZN7WebCore13SVGUseElement19removedFromDocumentEv
+__ZThn8_N7WebCore13SVGUseElementD0Ev
+__ZSt21__unguarded_partitionIPPN7WebCore14SVGSMILElementES2_PFbS2_S2_EET_S6_S6_T0_T1_
+__ZN7WebCore22ConditionEventListenerD0Ev
+__ZN7WebCore14SVGSMILElement10addEndTimeENS_8SMILTimeE
+__ZN7WebCore14SVGSMILElement14endListChangedEv
+__ZN7WebCore8SVGColorC1ENS0_12SVGColorTypeE
+__ZN7WebCore8SVGColorC2ENS0_12SVGColorTypeE
+__ZNK7WebCore28SVGPaintServerLinearGradient22externalRepresentationERNS_10TextStreamE
+__ZNK7WebCore22SVGPaintServerGradient22externalRepresentationERNS_10TextStreamE
+__ZNK7WebCore28SVGPaintServerLinearGradient11gradientEndEv
+__ZNK7WebCore28SVGPaintServerLinearGradient13gradientStartEv
+__ZN7WebCorelsERNS_10TextStreamERKNS_10FloatPointE
+__ZNK7WebCore21RenderSVGGradientStop10renderNameEv
+__ZN7WebCore12SVGTransform8setSkewXEf
+__ZN7WebCore12SVGTransform8setSkewYEf
+__ZN7WebCoreL18patternConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore17SVGPatternElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17SVGPatternElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore17SVGPatternElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore17SVGPatternElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore17SVGPatternElement7isValidEv
+__ZN7WebCore17SVGPatternElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore17SVGPatternElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore17SVGPatternElement14canvasResourceEv
+__ZN7WebCore21SVGPaintServerPatternC1EPKNS_17SVGPatternElementE
+__ZN7WebCore21SVGPaintServerPatternC2EPKNS_17SVGPatternElementE
+__ZNK7WebCore21SVGPaintServerPattern5setupERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
+__ZNK7WebCore17SVGPatternElement12buildPatternERKNS_9FloatRectE
+__ZNK7WebCore17SVGPatternElement24collectPatternPropertiesEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_11xAtt
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_11yAtt
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_16heig
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGPatternElementEiXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS2_29patternContentUni
+__ZN3WTF7HashSetIPKN7WebCore17SVGPatternElementENS_7PtrHashIS4_EENS_10HashTraitsIS4_EEE3addERKS4_
+__ZN3WTF9HashTableIPKN7WebCore17SVGPatternElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6exp
+__ZN3WTF9HashTableIPKN7WebCore17SVGPatternElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E6reh
+__ZN3WTF9HashTableIPKN7WebCore17SVGPatternElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E13al
+__ZN3WTF9HashTableIPKN7WebCore17SVGPatternElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E15de
+__ZNK7WebCore15SVGFitToViewBox22viewBoxToViewTransformEff
+__ZN7WebCore21SVGPaintServerPattern19setPatternTransformERKNS_20TransformationMatrixE
+__ZN7WebCore21SVGPaintServerPattern20setPatternBoundariesERKNS_9FloatRectE
+__ZN7WebCore21SVGPaintServerPattern7setTileESt8auto_ptrINS_11ImageBufferEE
+__ZNK7WebCore21SVGPaintServerPattern4tileEv
+__ZNK7WebCore21SVGPaintServerPattern17patternBoundariesEv
+__ZNK7WebCore21SVGPaintServerPattern16patternTransformEv
+__ZNK7WebCore21SVGPaintServerPattern8teardownERPNS_15GraphicsContextEPKNS_12RenderObjectENS_18SVGPaintTargetTypeEb
+__ZN7WebCore10TextStreamlsEb
+__ZNK7WebCore28SVGPaintServerRadialGradient22externalRepresentationERNS_10TextStreamE
+__ZNK7WebCore28SVGPaintServerRadialGradient14gradientRadiusEv
+__ZNK7WebCore28SVGPaintServerRadialGradient13gradientFocalEv
+__ZNK7WebCore28SVGPaintServerRadialGradient14gradientCenterEv
+__ZNK7WebCore21SVGPaintServerPattern22externalRepresentationERNS_10TextStreamE
+__ZN7WebCore17SVGPatternElementD0Ev
+__ZN7WebCore21SVGPaintServerPatternD0Ev
+__ZNK7WebCore13SVGSVGElement7isValidEv
+__ZN7WebCore26RenderSVGViewportContainerC1EPNS_16SVGStyledElementE
+__ZN7WebCore26RenderSVGViewportContainerC2EPNS_16SVGStyledElementE
+__ZN7WebCore26RenderSVGViewportContainer12calcViewportEv
+__ZNK7WebCore26RenderSVGViewportContainer22localToParentTransformEv
+__ZNK7WebCore26RenderSVGViewportContainer8viewportEv
+__ZNK7WebCore26RenderSVGViewportContainer17viewportTransformEv
+__ZN7WebCore26RenderSVGViewportContainer5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore26RenderSVGViewportContainer17applyViewportClipERNS_12RenderObject9PaintInfoE
+__ZNK7WebCore26RenderSVGViewportContainer14isSVGContainerEv
+__ZNK7WebCore26RenderSVGViewportContainer10renderNameEv
+__ZNK7WebCore26RenderSVGViewportContainer17absoluteTransformEv
+__ZN7WebCore26RenderSVGViewportContainerD0Ev
+__ZN7WebCore7DataRefINS_13StyleMiscDataEE6accessEv
+__ZN7WebCore13StyleMiscDataC1ERKS0_
+__ZN7WebCore13StyleMiscDataC2ERKS0_
+__ZNK7WebCore13StyleMiscDataeqERKS0_
+__ZN7WebCoreL18writeNameValuePairINS_6StringEEEvRNS_10TextStreamEPKcT_
+__ZN7WebCore15GraphicsContext18setShouldAntialiasEb
+__ZN7WebCore15GraphicsContext26setPlatformShouldAntialiasEb
+__ZNK7WebCore14RenderSVGTSpan10renderNameEv
+__ZN7WebCoreL30floatWidthMissingGlyphCallbackERKNS_7TextRunERNS_34SVGTextRunWalkerMeasuredLengthDataE
+__ZNK7WebCore4Font12fontSelectorEv
+__ZN7WebCoreL28drawTextMissingGlyphCallbackERKNS_7TextRunERNS_28SVGTextRunWalkerDrawTextDataE
+__ZN7WebCoreL17cursorConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore16SVGCursorElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16SVGCursorElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16SVGCursorElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore16SVGCursorElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZThn264_NK7WebCore16SVGCursorElement14contextElementEv
+__ZNK7WebCore16SVGCursorElement14contextElementEv
+__ZNK7WebCore16SVGCursorElement7isValidEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGCursorElementENS_9SVGLengthEXadL_ZNS_8SVGNames15cursorTagStringEEEXadL_ZNS3_11xAttrS
+__ZN7WebCore13CSSImageValue14cachedImageURLEv
+__ZN7WebCore13CSSImageValue16clearCachedImageEv
+__ZN3WTF7HashSetIPN7WebCore10SVGElementENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore10SVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expandEv
+__ZN3WTF9HashTableIPN7WebCore10SVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6rehashEi
+__ZN3WTF9HashTableIPN7WebCore10SVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13allocateTa
+__ZN7WebCore16SVGCursorElement9addClientEPNS_10SVGElementE
+__ZNK7WebCore15RenderSVGInline10renderNameEv
+__ZN7WebCore16SVGCursorElement12removeClientEPNS_10SVGElementE
+__ZN3WTF9HashTableIPN7WebCore10SVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4findIS3_NS_
+__ZN3WTF9HashTableIPN7WebCore10SVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47removeAndI
+__ZN3WTF9HashTableIPN7WebCore10SVGElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6removeEPS3_
+__ZN7WebCore19CSSCursorImageValue23removeReferencedElementEPNS_10SVGElementE
+__ZN7WebCore16SVGCursorElementD0Ev
+__ZN7WebCore19SVGAnimatedPropertyINS_11SVGAElementENS_6StringEXadL_ZNS_8SVGNames10aTagStringEEEXadL_ZNS3_16targetAttrStringEEEE
+__ZN7WebCoreL15viewConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGViewElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGViewElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGViewElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore14SVGViewElement16rendererIsNeededEPNS_11RenderStyleE
+__ZThn288_NK7WebCore14SVGViewElement14contextElementEv
+__ZNK7WebCore14SVGViewElement14contextElementEv
+__ZNK7WebCore14SVGViewElement10viewTargetEv
+__ZN7WebCore13SVGStringListC1ERKNS_13QualifiedNameE
+__ZN7WebCore13SVGStringListC2ERKNS_13QualifiedNameE
+__ZN7WebCore13SVGStringList5resetERKNS_6StringE
+__ZN7WebCore13SVGStringList5parseERKNS_6StringEt
+__ZN7WebCore14SVGViewElementD0Ev
+__ZN7WebCore13SVGStringListD0Ev
+__ZN7WebCoreL19clippathConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore18SVGClipPathElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore18SVGClipPathElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore18SVGClipPathElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore18SVGClipPathElement7isValidEv
+__ZN7WebCore18SVGClipPathElement16rendererIsNeededEPNS_11RenderStyleE
+__ZN7WebCore18SVGClipPathElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore13StyleClipDataC1ERKS0_
+__ZN7WebCore13StyleClipDataC2ERKS0_
+__ZN7WebCore19SVGAnimatedPropertyINS_14SVGMaskElementEiXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS2_19maskUnitsAttrStringEEEE1
+__ZNK7WebCore13StyleClipDataeqERKS0_
+__ZN7WebCore18SVGClipPathElement14canvasResourceEv
+__ZN7WebCore18SVGResourceClipperC1Ev
+__ZN7WebCore18SVGResourceClipperC2Ev
+__ZNK7WebCore29SVGStyledTransformableElement10toClipPathEv
+__ZN7WebCore18SVGResourceClipper11addClipDataERKNS_4PathENS_8WindRuleEb
+__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE15reserveCapacityEm
+__ZNK7WebCore18SVGResourceClipper8clipDataEv
+__ZNK7WebCore18SVGResourceClipper12resourceTypeEv
+__ZNK7WebCore18SVGResourceClipper9applyClipEPNS_15GraphicsContextERKNS_9FloatRectE
+__ZN7WebCore15GraphicsContext8clipPathENS_8WindRuleE
+__ZN7WebCore18SVGResourceClipper13resetClipDataEv
+__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore8ClipDataELm0EE6shrinkEm
+__ZN7WebCorelsERNS_10TextStreamERKNS_11SVGResourceE
+__ZNK7WebCore18SVGResourceClipper22externalRepresentationERNS_10TextStreamE
+__ZN7WebCorelsINS_8ClipDataEEERNS_10TextStreamES3_RKN3WTF6VectorIT_Lm0EEE
+__ZN7WebCorelsERNS_10TextStreamERKNS_8ClipDataE
+__ZNK7WebCore17SVGResourceMasker22externalRepresentationERNS_10TextStreamE
+__ZN7WebCore18SVGClipPathElementD0Ev
+__ZN7WebCore18SVGResourceClipperD0Ev
+__ZN7WebCoreL17markerConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore16SVGMarkerElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16SVGMarkerElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore8SVGAngleC1Ev
+__ZN7WebCore8SVGAngleC2Ev
+__ZN7WebCore16SVGMarkerElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore16SVGMarkerElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZThn312_NK7WebCore16SVGMarkerElement14contextElementEv
+__ZNK7WebCore16SVGMarkerElement14contextElementEv
+__ZN7WebCore16SVGMarkerElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore16SVGMarkerElement15childrenChangedEbPNS_4NodeES2_i
+__ZN7WebCore15StyleMarkerDataC1ERKS0_
+__ZN7WebCore15StyleMarkerDataC2ERKS0_
+__ZN7WebCore7DataRefINS_15StyleMarkerDataEE6accessEv
+__ZNK7WebCore15StyleMarkerDataeqERKS0_
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGMarkerElementENS_9SVGLengthEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_22marker
+__ZN7WebCore16SVGMarkerElement14canvasResourceEv
+__ZN7WebCore17SVGResourceMarkerC1Ev
+__ZN7WebCore17SVGResourceMarkerC2Ev
+__ZN7WebCore17SVGResourceMarker9setMarkerEPNS_26RenderSVGViewportContainerE
+__ZNK7WebCore8SVGAngle5valueEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGMarkerElementENS_9SVGLengthEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_14refYAt
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGMarkerElementENS_9SVGLengthEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_14refXAt
+__ZN7WebCore17SVGResourceMarker6setRefEdd
+__ZNK7WebCore17SVGResourceMarker12resourceTypeEv
+__ZN7WebCore15DrawMarkersDataC1EPNS_15GraphicsContextEPNS_17SVGResourceMarkerES4_d
+__ZN7WebCore15DrawMarkersDataC2EPNS_15GraphicsContextEPNS_17SVGResourceMarkerES4_d
+__ZN7WebCoreL22drawStartAndMidMarkersEPvPKNS_11PathElementE
+__ZN7WebCoreL18drawMarkerWithDataEPNS_15GraphicsContextERNS_10MarkerDataE
+__ZN7WebCore17SVGResourceMarker4drawEPNS_15GraphicsContextERKNS_9FloatRectEdddd
+__ZNK3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E8con
+__ZN3WTF7HashSetIPN7WebCore17SVGResourceMarkerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6expa
+__ZN3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6reha
+__ZN3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E13all
+__ZN3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E15dea
+__ZN3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E4find
+__ZN3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E47rem
+__ZN3WTF9HashTableIPN7WebCore17SVGResourceMarkerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_E6remo
+__ZNK7WebCore17SVGResourceMarker12cachedBoundsEv
+__ZNK7WebCore17SVGResourceMarker22externalRepresentationERNS_10TextStreamE
+__ZN7WebCore16SVGMarkerElementD0Ev
+__ZN7WebCore17SVGResourceMarkerD0Ev
+__ZN7WebCore8SVGAngleD0Ev
+__ZThn240_NK7WebCore17SVGPatternElement14contextElementEv
+__ZNK7WebCore17SVGPatternElement14contextElementEv
+__ZNK3WTF9HashTableIPKN7WebCore17SVGPatternElementES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA_E8co
+__ZN7WebCore16SVGTransformList11consolidateEv
+__ZNK7WebCore13RenderSVGText14localTransformEv
+__ZN7WebCore15GraphicsContext16setStrokePatternEN3WTF10PassRefPtrINS_7PatternEEE
+__ZN7WebCore15GraphicsContext18applyStrokePatternEv
+__ZN7WebCoreL17switchConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore16SVGSwitchElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore16SVGSwitchElement7isValidEv
+__ZN7WebCore16SVGSwitchElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZNK7WebCore16SVGSwitchElement25childShouldCreateRendererEPNS_4NodeE
+__ZNK7WebCore8SVGTests18requiredExtensionsEv
+__ZNK7WebCore8SVGTests14systemLanguageEv
+__ZN7WebCore16SVGSwitchElementD0Ev
+__ZNK7WebCore8SVGTests16requiredFeaturesEv
+__ZN7WebCore27jsSVGElementOwnerSVGElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore17jsSVGRectElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_11xAttrStri
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_14SVGRectElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_
+__ZN7WebCore17jsSVGRectElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_11yAttrStri
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_14SVGRectElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3
+__ZN7WebCore22jsSVGRectElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_16heightAtt
+__ZN7WebCore11JSSVGLength3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19setJSSVGLengthValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9SVGLength8setValueEf
+__ZN7WebCore26JSSVGDynamicPODTypeWrapperINS_9SVGLengthENS_19SVGAnimatedTemplateIS1_EEE12commitChangeES1_PNS_10SVGElementE
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGRectElementENS_9SVGLengthEXadL_ZNS_8SVGNames13rectTagStringEEEXadL_ZNS3_11yAttrStrin
+__ZN7WebCore15SVGTitleElement19removedFromDocumentEv
+__ZN7WebCore16SVGScriptElement19removedFromDocumentEv
+__ZN7WebCore13SVGUseElement24alterShadowTreeForSVGTagEPNS_10SVGElementE
+__ZNK7WebCore19SVGAnimatedPropertyINS_13SVGUseElementENS_9SVGLengthEXadL_ZNS_8SVGNames12useTagStringEEEXadL_ZNS3_15widthAttrStr
+__ZN7WebCoreL17symbolConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore16SVGSymbolElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16SVGSymbolElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore16SVGSymbolElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZThn312_NK7WebCore16SVGSymbolElement14contextElementEv
+__ZNK7WebCore16SVGSymbolElement14contextElementEv
+__ZN7WebCore16SVGSymbolElement16rendererIsNeededEPNS_11RenderStyleE
+__ZThn8_N7WebCore16SVGSymbolElementD0Ev
+__ZN7WebCore16SVGSymbolElementD0Ev
+__ZThn8_N7WebCore17SVGEllipseElementD0Ev
+__ZN7WebCore21SVGDocumentExtensions18addPendingResourceERKNS_12AtomicStringEPNS_16SVGStyledElementE
+__ZN3WTF7HashMapIN7WebCore6StringEPNS_7HashSetIPNS1_16SVGStyledElementENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEENS1_10StringHash
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_PNS_7HashSetIPNS1_16SVGStyledElementENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEEENS
+__ZNK7WebCore22SVGCharacterLayoutInfo22baselineShiftValueNextEv
+__ZN7WebCoreL15trefConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore14SVGTRefElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGTRefElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore14SVGTRefElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZThn672_NK7WebCore14SVGTRefElement14contextElementEv
+__ZNK7WebCore14SVGTRefElement14contextElementEv
+__ZN7WebCore14SVGTRefElement20updateReferencedTextEv
+__ZN7WebCore14SVGTRefElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZNK7WebCore14SVGTRefElement25childShouldCreateRendererEPNS_4NodeE
+__ZNK7WebCore17RenderSVGTextPath10renderNameEv
+__ZN7WebCoreL23angleToGlyphOrientationEf
+__ZN7WebCoreL27cummulatedHeightOfTextChunkERNS_12SVGTextChunkE
+__ZN7WebCore41cummulatedHeightOfInlineBoxCharacterRangeERNS_26SVGInlineBoxCharacterRangeE
+__ZN7WebCore14SVGTRefElementD0Ev
+__ZN7WebCore16SVGRootInlineBox37retrievePaintServersForTextDecorationEPNS_12RenderObjectE
+__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE15reserveCapacityEm
+__ZN3WTF7HashMapIiPN7WebCore12RenderObjectENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3setERKiRKS3_
+__ZN3WTF6VectorIPN7WebCore12RenderObjectELm0EE6shrinkEm
+__ZN3WTF9HashTableIiSt4pairIiPN7WebCore12RenderObjectEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_10Has
+__ZN7WebCore16SVGInlineTextBox15paintDecorationENS_15ETextDecorationEPNS_15GraphicsContextEiiiRKNS_7SVGCharERKNS_21SVGTextDecor
+__ZNK3WTF9HashTableIiSt4pairIiPN7WebCore12RenderObjectEENS_18PairFirstExtractorIS5_EENS_7IntHashIjEENS_14PairHashTraitsINS_10Ha
+__ZNK3WTF7HashMapIiPN7WebCore12RenderObjectENS_7IntHashIjEENS_10HashTraitsIiEENS6_IS3_EEE3getERKi
+__ZNK7WebCore22SVGCharacterLayoutInfo11dyValueNextEv
+__ZNK3WTF7HashMapIN7WebCore6StringEPNS_7HashSetIPNS1_16SVGStyledElementENS_7PtrHashIS5_EENS_10HashTraitsIS5_EEEENS1_10StringHas
+__ZN7WebCore21SVGDocumentExtensions21removePendingResourceERKNS_12AtomicStringE
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_EC1ERKS
+__ZN3WTF9HashTableIPN7WebCore16SVGStyledElementES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_EC2ERKS
+__ZN7WebCore11SVGResource17invalidateClientsEN3WTF7HashSetIPNS_16SVGStyledElementENS1_7PtrHashIS4_EENS1_10HashTraitsIS4_EEEE
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEPNS1_13SVGNumberListENS1_10StringHashENS_10HashTraitsIS6_EENS
+__ZN7WebCore13SVGNumberList5parseERKNS_6StringE
+__ZNK7WebCore22SVGCharacterLayoutInfo14angleValueNextEv
+__ZN7WebCore55jsSVGTextContentElementPrototypeFunctionSelectSubStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZNK7WebCore21SVGTextContentElement15selectSubStringEjjRi
+__ZN7WebCore19RenderSVGInlineText23selectionRectForRepaintEPNS_20RenderBoxModelObjectEb
+__ZNK7WebCore12RenderObject20isSVGHiddenContainerEv
+__ZN7WebCore19RenderSVGInlineText26computeRepaintRectForRangeEPNS_20RenderBoxModelObjectEii
+__ZN7WebCore19RenderSVGInlineText26computeRepaintQuadForRangeEPNS_20RenderBoxModelObjectEii
+__ZN7WebCore17findSVGRootObjectEPNS_12RenderObjectE
+__ZN7WebCore16SVGInlineTextBox13selectionRectEiiii
+__ZN7WebCore18SVGTextChunkWalkerINS_35SVGInlineTextBoxSelectionRectWalkerEEclEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatr
+__ZN7WebCore35SVGInlineTextBoxSelectionRectWalker20chunkPortionCallbackEPNS_16SVGInlineTextBoxEiRKNS_20TransformationMatrixERKP
+__ZN7WebCore16SVGInlineTextBox14paintSelectionEiRKNS_7SVGCharEPKtiPNS_15GraphicsContextEPNS_11RenderStyleERKNS_4FontE
+__ZNK7WebCore22SVGCharacterLayoutInfo11dxValueNextEv
+__ZN7WebCore45jsSVGTextElementPrototypeFunctionGetScreenCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14SVGTextElement12getScreenCTMEv
+__ZNK7WebCore16SVGTransformable12getScreenCTMEPKNS_10SVGElementE
+__ZN7WebCore12SVGLocatable12getScreenCTMEPKNS_10SVGElementE
+__ZNK7WebCore25SVGStyledLocatableElement17isStyledLocatableEv
+__ZNK7WebCore29SVGStyledTransformableElement12getScreenCTMEv
+__ZNK7WebCore13SVGSVGElement12getScreenCTMEv
+__ZNK7WebCore25SVGStyledLocatableElement12getScreenCTMEv
+__ZThn240_NK7WebCore29SVGStyledTransformableElement22animatedLocalTransformEv
+__ZThn672_NK7WebCore14SVGTextElement22animatedLocalTransformEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperINS_20TransformationMatrixEEEPNS_10SVGElementE
+__ZN7WebCore11JSSVGMatrix15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSSVGMatrixC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_20TransformationMatrixEEEEEPNS
+__ZN7WebCore11JSSVGMatrixC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_20TransformationMatrixEEEEEPNS
+__ZN7WebCore11JSSVGMatrix18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore12jsSVGMatrixAEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_20TransformationMatrixEEcvS1_Ev
+__ZN7WebCore12jsSVGMatrixBEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsSVGMatrixCEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsSVGMatrixDEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsSVGMatrixEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore12jsSVGMatrixFEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39jsSVGTextElementPrototypeFunctionGetCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14SVGTextElement6getCTMEv
+__ZNK7WebCore16SVGTransformable6getCTMEPKNS_10SVGElementE
+__ZN7WebCore12SVGLocatable6getCTMEPKNS_10SVGElementE
+__ZNK7WebCore29SVGStyledTransformableElement6getCTMEv
+__ZNK7WebCore13SVGSVGElement6getCTMEv
+__ZN7WebCore54jsSVGTextElementPrototypeFunctionGetTransformToElementEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore12toSVGElementEN3JSC7JSValueE
+__ZNK7WebCore12SVGLocatable21getTransformToElementEPNS_10SVGElementERi
+__ZTv0_n56_NK7WebCore14SVGTextElement6getCTMEv
+__ZN7WebCore27JSSVGCircleElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore42jsSVGCircleElementPrototypeFunctionGetBBoxEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore29SVGStyledTransformableElement7getBBoxEv
+__ZN7WebCore12SVGLocatable7getBBoxEPKNS_10SVGElementE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperINS_9FloatRectEEEPNS_10SVGElementE
+__ZN7WebCore9JSSVGRect15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore9JSSVGRectC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_9FloatRectEEEEEPNS_10SVGElementE
+__ZN7WebCore9JSSVGRectC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_9FloatRectEEEEEPNS_10SVGElementE
+__ZN7WebCore9JSSVGRect18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore10jsSVGRectXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9FloatRectEEcvS1_Ev
+__ZN7WebCore10jsSVGRectYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14jsSVGRectWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsSVGRectHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGCircleElementFarthestViewportElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore29SVGStyledTransformableElement23farthestViewportElementEv
+__ZN7WebCore12SVGLocatable23farthestViewportElementEPKNS_10SVGElementE
+__ZN7WebCore40jsSVGCircleElementNearestViewportElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore29SVGStyledTransformableElement22nearestViewportElementEv
+__ZN7WebCore9JSSVGRectD1Ev
+__ZN7WebCore9JSSVGRectD2Ev
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9FloatRectEED0Ev
+__ZN7WebCore11JSSVGMatrixD1Ev
+__ZN7WebCore11JSSVGMatrixD2Ev
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_20TransformationMatrixEED0Ev
+__ZN7WebCore18JSSVGRectPrototypeD1Ev
+__ZN7WebCore20JSSVGMatrixPrototypeD1Ev
+__ZThn400_NK7WebCore17SVGPatternElement14contextElementEv
+__ZNK7WebCore14RenderSVGTSpan17objectBoundingBoxEv
+__ZN7WebCore13StyleTextDataC1ERKS0_
+__ZN7WebCore13StyleTextDataC2ERKS0_
+__ZNK7WebCore13StyleTextDataeqERKS0_
+__ZN7WebCore20findCharUnicodeRangeEi
+__ZThn288_N7WebCore16SVGScriptElement17dispatchLoadEventEv
+__ZN7WebCore16SVGScriptElement17dispatchLoadEventEv
+__ZN7WebCoreL26createSVGUseElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore15JSSVGUseElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSSVGUseElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGUseElementEEE
+__ZN7WebCore15JSSVGUseElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGUseElementEEE
+__ZN7WebCore15JSSVGUseElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore24JSSVGUseElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore15JSSVGUseElement9classInfoEv
+__ZN7WebCoreL30createSVGEllipseElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore19JSSVGEllipseElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSSVGEllipseElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17SVGEllipseElementEEE
+__ZN7WebCore19JSSVGEllipseElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17SVGEllipseElementEEE
+__ZN7WebCore19JSSVGEllipseElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28JSSVGEllipseElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSSVGEllipseElement9classInfoEv
+__ZN7WebCoreL27createSVGDefsElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGDefsElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGDefsElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGDefsElementEEE
+__ZN7WebCore16JSSVGDefsElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGDefsElementEEE
+__ZN7WebCoreL37createSVGLinearGradientElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore26JSSVGLinearGradientElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSSVGLinearGradientElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24SVGLinearGradientElementEEE
+__ZN7WebCore26JSSVGLinearGradientElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24SVGLinearGradientElementEEE
+__ZN7WebCore20JSSVGGradientElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGGradientElementEEE
+__ZN7WebCore26JSSVGLinearGradientElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20JSSVGGradientElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSSVGLinearGradientElement9classInfoEv
+__ZN7WebCoreL27createSVGStopElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGStopElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGStopElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGStopElementEEE
+__ZN7WebCore16JSSVGStopElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGStopElementEEE
+__ZN7WebCore16JSSVGStopElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGStopElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSSVGStopElement9classInfoEv
+__ZN7WebCore16JSSVGDefsElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGDefsElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSSVGDefsElement9classInfoEv
+__ZN7WebCoreL27createSVGLineElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGLineElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGLineElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGLineElementEEE
+__ZN7WebCore16JSSVGLineElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGLineElementEEE
+__ZN7WebCore16JSSVGLineElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGLineElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSSVGLineElement9classInfoEv
+__ZN7WebCore16JSSVGStopElementD1Ev
+__ZN7WebCore26JSSVGLinearGradientElementD1Ev
+__ZN7WebCore19JSSVGEllipseElementD1Ev
+__ZN7WebCore15JSSVGUseElementD1Ev
+__ZN7WebCore28JSSVGEllipseElementPrototypeD1Ev
+__ZN7WebCore24JSSVGUseElementPrototypeD1Ev
+__ZN7WebCore16JSSVGLineElementD1Ev
+__ZN7WebCore25JSSVGLineElementPrototypeD1Ev
+__ZN7WebCore25JSSVGStopElementPrototypeD1Ev
+__ZN7WebCore35JSSVGLinearGradientElementPrototypeD1Ev
+__ZN7WebCore16JSSVGDefsElementD1Ev
+__ZThn8_N7WebCore14SVGDefsElementD0Ev
+__ZN7WebCore25JSSVGDefsElementPrototypeD1Ev
+__ZN7WebCore21SVGDocumentExtensions11reportErrorERKNS_6StringE
+__ZThn8_N7WebCore15SVGTSpanElementD0Ev
+__ZN7WebCoreL29createSVGSymbolElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore18JSSVGSymbolElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGSymbolElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGSymbolElementEEE
+__ZN7WebCore18JSSVGSymbolElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGSymbolElementEEE
+__ZN7WebCore18JSSVGSymbolElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSSVGSymbolElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSSVGSymbolElement9classInfoEv
+__ZN7WebCore18JSSVGSymbolElementD1Ev
+__ZN7WebCore27JSSVGSymbolElementPrototypeD1Ev
+__ZN7WebCore10JSSVGPaintC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SVGPaintEEE
+__ZN7WebCore10JSSVGPaintC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SVGPaintEEE
+__ZN7WebCore10JSSVGColorC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SVGColorEEE
+__ZN7WebCore10JSSVGPaint18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore10JSSVGColor18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore10JSSVGPaint9classInfoEv
+__ZN7WebCore10JSSVGPaintD1Ev
+__ZN7WebCore47jsSVGSVGElementPrototypeFunctionCreateSVGMatrixEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement15createSVGMatrixEv
+__ZN7WebCore20JSSVGMatrixPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore44jsSVGMatrixPrototypeFunctionRotateFromVectorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore11JSSVGMatrix9classInfoEv
+__ZN7WebCore11JSSVGMatrix16rotateFromVectorEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore20TransformationMatrix16rotateFromVectorEdd
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12SVGExceptionEPNS_10SVGElementE
+__ZN7WebCore14JSSVGExceptionC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SVGExceptionEEEPNS_10SVGElementE
+__ZN7WebCore14JSSVGExceptionC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SVGExceptionEEEPNS_10SVGElementE
+__ZN7WebCore14JSSVGException18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsSVGExceptionPrototypeFunctionToStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14JSSVGException9classInfoEv
+__ZN7WebCore25jsSVGExceptionConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGMatrixPrototypeFunctionTranslateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSSVGExceptionD1Ev
+__ZN7WebCore14JSSVGExceptionD2Ev
+__ZN7WebCore24jsSVGDocumentRootElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore47jsSVGSVGElementPrototypeFunctionCreateSVGNumberEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement15createSVGNumberEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperIfEEPNS_10SVGElementE
+__ZN7WebCore11JSSVGNumber15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore11JSSVGNumberC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperIfEEEEPNS_10SVGElementE
+__ZN7WebCore11JSSVGNumberC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperIfEEEEPNS_10SVGElementE
+__ZN7WebCore11JSSVGNumber18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore16jsSVGNumberValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperIfEcvfEv
+__ZN7WebCore11JSSVGNumber3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19setJSSVGNumberValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperIfE12commitChangeEfPNS_10SVGElementE
+__ZN7WebCore11JSSVGNumberD1Ev
+__ZN7WebCore11JSSVGNumberD2Ev
+__ZN7WebCore25JSSVGStaticPODTypeWrapperIfED0Ev
+__ZN7WebCore46jsSVGSVGElementPrototypeFunctionCreateSVGPointEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement14createSVGPointEv
+__ZN7WebCore10JSSVGPoint3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore14setJSSVGPointXEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_10FloatPointEE12commitChangeES1_PNS_10SVGElementE
+__ZN7WebCore14setJSSVGPointYEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore20JSSVGNumberPrototypeD1Ev
+__ZN7WebCore19JSSVGPointPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore35jsSVGMatrixPrototypeFunctionInverseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore11JSSVGMatrix7inverseEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore42jsSVGPointPrototypeFunctionMatrixTransformEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore10JSSVGPoint9classInfoEv
+__ZN7WebCore11toSVGMatrixEN3JSC7JSValueE
+__ZNK7WebCore10FloatPoint15matrixTransformERKNS_20TransformationMatrixE
+__ZN7WebCore23JSSVGTextContentElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore45jsSVGSVGElementPrototypeFunctionCreateSVGRectEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement13createSVGRectEv
+__ZN7WebCore9JSSVGRect3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore13setJSSVGRectXEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9FloatRectEE12commitChangeES1_PNS_10SVGElementE
+__ZN7WebCore13setJSSVGRectYEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore17setJSSVGRectWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18setJSSVGRectHeightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCoreL23dominantBaselineToShiftEbPKNS_12RenderObjectERKNS_4FontE
+__ZNK7WebCore21SVGPathSegSingleCoord8toStringEv
+__ZNK7WebCore19SVGPathSegMovetoAbs19pathSegTypeAsLetterEv
+__ZN7WebCore14SVGPathSegList14createAnimatedEPKS0_S2_f
+__ZNK7WebCore19SVGPathSegLinetoAbs19pathSegTypeAsLetterEv
+__ZNK7WebCore22SVGPathSegCurvetoCubic8toStringEv
+__ZNK7WebCore25SVGPathSegCurvetoCubicAbs19pathSegTypeAsLetterEv
+__ZN7WebCoreL24foreignobjectConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore23SVGForeignObjectElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore23SVGForeignObjectElement7isValidEv
+__ZN7WebCore23SVGForeignObjectElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
+__ZN7WebCore19RenderForeignObjectC1EPNS_23SVGForeignObjectElementE
+__ZN7WebCore19RenderForeignObjectC2EPNS_23SVGForeignObjectElementE
+__ZNK7WebCore19RenderForeignObject13requiresLayerEv
+__ZNK7WebCore23SVGForeignObjectElement25childShouldCreateRendererEPNS_4NodeE
+__ZN7WebCore16jsSVGSVGElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_11xAttrString
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_13SVGSVGElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_11
+__ZN7WebCore19SVGAnimatedPropertyINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_11xAttrStringEE
+__ZN7WebCore19RenderForeignObject21computeRectForRepaintEPNS_20RenderBoxModelObjectERNS_7IntRectEb
+__ZNK7WebCore19RenderForeignObject22localToParentTransformEv
+__ZNK7WebCore19RenderForeignObject24translationForAttributesEv
+__ZNK7WebCore19RenderForeignObject14localTransformEv
+__ZN7WebCore19RenderForeignObject6layoutEv
+__ZNK7WebCore19RenderForeignObject29repaintRectInLocalCoordinatesEv
+__ZN7WebCore19RenderForeignObject5paintERNS_12RenderObject9PaintInfoEii
+__ZNK7WebCore19RenderForeignObject10renderNameEv
+__ZN7WebCore19RenderForeignObjectD0Ev
+__ZN7WebCore13RenderSVGRoot11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
+__ZN7WebCore10RenderPath16nodeAtFloatPointERKNS_14HitTestRequestERNS_13HitTestResultERKNS_10FloatPointENS_13HitTestActionE
+__ZN7WebCore21PointerEventsHitRulesC1ENS0_11EHitTestingENS_14EPointerEventsE
+__ZN7WebCore21PointerEventsHitRulesC2ENS0_11EHitTestingENS_14EPointerEventsE
+__ZNK7WebCore10RenderPath12fillContainsERKNS_10FloatPointEb
+__ZNK7WebCore11SVGDocument17zoomAndPanEnabledEv
+__ZN7WebCore23SVGForeignObjectElementD0Ev
+__ZN7WebCore25jsSVGRectElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGStyledElementENS_6StringEXadL_ZNS_26SVGStyledElementIdentifierEEEXadL_ZNS_9HTMLName
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateINS1_6StringEEENS1_29SVGAnimatedTypeWrapperKey
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateINS1_6StringEEENS1_29SVGAnimatedTypeWrapperKeyH
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateINS1_6StringEEEENS_18PairFirstExtr
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateINS_6StringEEEPNS_10SVGElementE
+__ZN7WebCore19JSSVGAnimatedString15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSSVGAnimatedStringC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateINS_6StringEEEEEPNS_10SVGE
+__ZN7WebCore19JSSVGAnimatedStringC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateINS_6StringEEEEEPNS_10SVGE
+__ZN7WebCore19JSSVGAnimatedString3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore29setJSSVGAnimatedStringBaseValEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZNK7WebCore19SVGAnimatedPropertyINS_16SVGStyledElementENS_6StringEXadL_ZNS_26SVGStyledElementIdentifierEEEXadL_ZNS_9HTMLNames
+__ZN7WebCore19synchronizePropertyINS_16SVGStyledElementENS_6StringEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCore19JSSVGAnimatedStringD1Ev
+__ZN7WebCore19JSSVGAnimatedStringD2Ev
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_16SVGStyledElementES1_NS_6StringES2_XadL_ZNS_26SVGStyledElementIdentifierEEEXadL_ZN
+__ZN7WebCore28JSSVGAnimatedStringPrototypeD1Ev
+__ZN7WebCore18RenderSVGContainer16nodeAtFloatPointERKNS_14HitTestRequestERNS_13HitTestResultERKNS_10FloatPointENS_13HitTestActi
+__ZN7WebCore18RenderSVGContainer25pointIsInsideViewportClipERKNS_10FloatPointE
+__ZNK7WebCore7Element5titleEv
+__ZNK7WebCore13SVGZoomAndPan10zoomAndPanEv
+__ZN7WebCore12RenderObject16positionForPointERKNS_8IntPointE
+__ZN7WebCoreL31createSVGClipPathElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore20JSSVGClipPathElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGClipPathElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGClipPathElementEEE
+__ZN7WebCore20JSSVGClipPathElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGClipPathElementEEE
+__ZN7WebCore20JSSVGClipPathElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore20JSSVGClipPathElementD1Ev
+__ZN7WebCore29JSSVGClipPathElementPrototypeD1Ev
+__ZNK7WebCore13SVGUseElement10toClipPathEv
+__ZN7WebCore33jsSVGClipPathElementClipPathUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_18SVGClipPathElementEiXadL_ZNS_8SVGNames17clipPathTagStringEEEXadL_ZNS2_23clipPathUnitsA
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIiEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIiEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35S
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIiEEENS_18PairFirstExtractorIS7_EE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIiEEPNS_10SVGElementE
+__ZN7WebCore24JSSVGAnimatedEnumeration15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSSVGAnimatedEnumerationC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIiEEEEPNS_10SVGElemen
+__ZN7WebCore24JSSVGAnimatedEnumerationC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIiEEEEPNS_10SVGElemen
+__ZN7WebCore24JSSVGAnimatedEnumeration3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore34setJSSVGAnimatedEnumerationBaseValEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24JSSVGAnimatedEnumerationD1Ev
+__ZN7WebCore24JSSVGAnimatedEnumerationD2Ev
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_18SVGClipPathElementES1_iiXadL_ZNS_8SVGNames17clipPathTagStringEEEXadL_ZNS2_23clipP
+__ZN7WebCore33JSSVGAnimatedEnumerationPrototypeD1Ev
+__ZN7WebCoreL31createSVGMetadataElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore20JSSVGMetadataElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGMetadataElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGMetadataElementEEE
+__ZN7WebCore20JSSVGMetadataElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGMetadataElementEEE
+__ZNK7WebCore20JSSVGMetadataElement9classInfoEv
+__ZN7WebCore20JSSVGMetadataElementD1Ev
+__ZThn8_N7WebCore18SVGMetadataElementD0Ev
+__ZN7WebCore29JSSVGMetadataElementPrototypeD1Ev
+__ZN7WebCore26RenderSVGViewportContainer25pointIsInsideViewportClipERKNS_10FloatPointE
+__ZNK7WebCore10RenderPath14strokeContainsERKNS_10FloatPointEb
+__ZNK7WebCore4Path14strokeContainsEPNS_18StrokeStyleApplierERKNS_10FloatPointE
+__ZNK7WebCore13SVGUseElement28instanceForShadowTreeElementEPNS_4NodeE
+__ZNK7WebCore13SVGUseElement28instanceForShadowTreeElementEPNS_4NodeEPNS_18SVGElementInstanceE
+__ZThn24_N7WebCore18SVGElementInstance14refEventTargetEv
+__ZN7WebCore18SVGElementInstance14refEventTargetEv
+__ZThn24_N7WebCore18SVGElementInstance6toNodeEv
+__ZN7WebCore18SVGElementInstance6toNodeEv
+__ZThn24_N7WebCore18SVGElementInstance16derefEventTargetEv
+__ZN7WebCore18SVGElementInstance16derefEventTargetEv
+__ZN7WebCore22jsSVGStopElementOffsetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEEE15a
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEENS_
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIfEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_14SVGStopElementES1_ffXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStr
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIfEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35S
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIfEEENS_18PairFirstExtractorIS7_EE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIfEEPNS_10SVGElementE
+__ZN7WebCore19JSSVGAnimatedNumber15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSSVGAnimatedNumberC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIfEEEEPNS_10SVGElementE
+__ZN7WebCore19JSSVGAnimatedNumberC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIfEEEEPNS_10SVGElementE
+__ZN7WebCore19JSSVGAnimatedNumber18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26jsSVGAnimatedNumberBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19SVGAnimatedPropertyINS_14SVGStopElementEfXadL_ZNS_8SVGNames13stopTagStringEEEXadL_ZNS2_16offsetAttrStringEEEE9ba
+__ZN7WebCore19JSSVGAnimatedNumber3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore29setJSSVGAnimatedNumberBaseValEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19JSSVGAnimatedNumberD1Ev
+__ZN7WebCore19JSSVGAnimatedNumberD2Ev
+__ZNK7WebCore24JSSVGSVGElementPrototype9classInfoEv
+__ZNK7WebCore21JSSVGElementPrototype9classInfoEv
+__ZN7WebCore29jsSVGSVGElementSystemLanguageEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_13SVGStringListEPNS_10SVGElementE
+__ZN7WebCore15JSSVGStringList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSSVGStringListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGStringListEEEPNS_10SVGElementE
+__ZN7WebCore15JSSVGStringListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGStringListEEEPNS_10SVGElementE
+__ZN7WebCore40jsSVGSVGElementExternalResourcesRequiredEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZThn296_NK7WebCore13SVGSVGElement14contextElementEv
+__ZN7WebCore21lookupOrCreateWrapperINS_28SVGExternalResourcesRequiredEbXadL_ZNS_38SVGExternalResourcesRequiredIdentifierEEEXadL
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIbEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIbEENS1_29SVGAnimatedTypeWrapperKeyHashENS1_35S
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIbEEENS_18PairFirstExtractorIS7_EE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIbEEPNS_10SVGElementE
+__ZN7WebCore20JSSVGAnimatedBoolean15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGAnimatedBooleanC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIbEEEEPNS_10SVGElementE
+__ZN7WebCore20JSSVGAnimatedBooleanC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIbEEEEPNS_10SVGElementE
+__ZN7WebCore31jsSVGSVGElementCurrentTranslateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsSVGSVGElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_15widthAttrSt
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_13SVGSVGElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_15
+__ZN7WebCore22jsSVGSVGElementViewBoxEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGFitToViewBoxENS_9FloatRectEXadL_ZNS_25SVGFitToViewBoxIdentifierEEEXadL_ZNS_8SVGName
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateINS1_9FloatRectEEENS1_29SVGAnimatedTypeWrapper
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_15SVGFitToViewBoxENS_10SVGElementENS_9FloatRectES3_XadL_ZNS_25SVGFitToViewBoxIdenti
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateINS1_9FloatRectEEENS1_29SVGAnimatedTypeWrapperK
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateINS1_9FloatRectEEEENS_18PairFirstE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateINS_9FloatRectEEEPNS_10SVGElementE
+__ZN7WebCore17JSSVGAnimatedRect15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSSVGAnimatedRectC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateINS_9FloatRectEEEEEPNS_10SVG
+__ZN7WebCore17JSSVGAnimatedRectC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateINS_9FloatRectEEEEEPNS_10SVG
+__ZN7WebCore37jsSVGSVGElementPixelUnitToMillimeterXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGSVGElement22pixelUnitToMillimeterXEv
+__ZN7WebCore16jsSVGSVGElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_11yAttrString
+__ZN7WebCore39jsSVGSVGElementScreenPixelToMillimeterXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGSVGElement24screenPixelToMillimeterXEv
+__ZN7WebCore27jsSVGSVGElementCurrentScaleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsSVGSVGElementViewportEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGSVGElement8viewportEv
+__ZN7WebCore9FloatRect15narrowPrecisionEdddd
+__ZN7WebCore29jsSVGSVGElementUseCurrentViewEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsSVGSVGElementXmllangEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12SVGLangSpace7xmllangEv
+__ZN7WebCore37jsSVGSVGElementPixelUnitToMillimeterYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGSVGElement22pixelUnitToMillimeterYEv
+__ZN7WebCore24jsSVGSVGElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsSVGSVGElementFarthestViewportElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore25SVGStyledLocatableElement23farthestViewportElementEv
+__ZN7WebCore21jsSVGSVGElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_13SVGSVGElementENS_9SVGLengthEXadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_16heightAttrS
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_13SVGSVGElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_16
+__ZN7WebCore39jsSVGSVGElementScreenPixelToMillimeterYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGSVGElement24screenPixelToMillimeterYEv
+__ZN7WebCore33jsSVGSVGElementRequiredExtensionsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsSVGSVGElementContentStyleTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGSVGElement16contentStyleTypeEv
+__ZN7WebCore32jsSVGSVGElementContentScriptTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGSVGElement17contentScriptTypeEv
+__ZN7WebCore31jsSVGSVGElementRequiredFeaturesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsSVGSVGElementXmlspaceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12SVGLangSpace8xmlspaceEv
+__ZN7WebCore20jsSVGSVGElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGSVGElementNearestViewportElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsSVGSVGElementPreserveAspectRatioEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGFitToViewBoxENS_22SVGPreserveAspectRatioEXadL_ZNS_25SVGFitToViewBoxIdentifierEEEXad
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_22SVGPreserveAspectRatioEEENS1_29SVGAnim
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_15SVGFitToViewBoxENS_10SVGElementENS_22SVGPreserveAspectRatioEPS3_XadL_ZNS_25SVGFit
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_22SVGPreserveAspectRatioEEENS1_29SVGAnima
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIPNS1_22SVGPreserveAspectRatioEEEE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIPNS_22SVGPreserveAspectRatioEEEPNS_10SVGElementE
+__ZN7WebCore32JSSVGAnimatedPreserveAspectRatio15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore32JSSVGAnimatedPreserveAspectRatioC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_22SVGPre
+__ZN7WebCore32JSSVGAnimatedPreserveAspectRatioC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_22SVGPre
+__ZN7WebCore25jsSVGSVGElementZoomAndPanEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsSVGElementXmlbaseEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore10SVGElement7xmlbaseEv
+__ZN7WebCore27jsSVGElementViewportElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGSVGElementSVG_ZOOMANDPAN_UNKNOWNEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGSVGElementSVG_ZOOMANDPAN_MAGNIFYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGSVGElementSVG_ZOOMANDPAN_DISABLEEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32JSSVGAnimatedPreserveAspectRatioD1Ev
+__ZN7WebCore32JSSVGAnimatedPreserveAspectRatioD2Ev
+__ZN7WebCore15JSSVGStringListD1Ev
+__ZN7WebCore15JSSVGStringListD2Ev
+__ZN7WebCore17JSSVGAnimatedRectD1Ev
+__ZN7WebCore17JSSVGAnimatedRectD2Ev
+__ZN7WebCore35JSSVGStaticPODTypeWrapperWithParentINS_10FloatPointENS_13SVGSVGElementEED0Ev
+__ZN7WebCore20JSSVGAnimatedBooleanD1Ev
+__ZN7WebCore20JSSVGAnimatedBooleanD2Ev
+__ZN7WebCore28JSSVGAnimatedNumberPrototypeD1Ev
+__ZN7WebCore41JSSVGAnimatedPreserveAspectRatioPrototypeD1Ev
+__ZN7WebCore26JSSVGAnimatedRectPrototypeD1Ev
+__ZN7WebCore29JSSVGAnimatedBooleanPrototypeD1Ev
+__ZN7WebCore24JSSVGStringListPrototypeD1Ev
+__ZN7WebCore23SVGForeignObjectElement20parseMappedAttributeEPNS_15MappedAttributeE
+__ZN7WebCore23SVGForeignObjectElement19svgAttributeChangedERKNS_13QualifiedNameE
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_13SVGSVGElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames12svgTagStringEEEXadL_ZNS3_1
+__ZN7WebCore15SVGFitToViewBox16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore57jsSVGRectElementPrototypeFunctionGetPresentationAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZN7WebCore16SVGStyledElement24getPresentationAttributeERKNS_6StringE
+__ZNK7WebCore15MappedAttribute5styleEv
+__ZN7WebCore38jsSVGColorPrototypeFunctionSetRGBColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore8SVGPaintC1ERKNS_6StringERKNS_5ColorE
+__ZN7WebCore8SVGPaintC2ERKNS_6StringERKNS_5ColorE
+__ZN7WebCore10RenderPath17addFocusRingRectsEPNS_15GraphicsContextEii
+__ZN7WebCore18RenderSVGContainer17addFocusRingRectsEPNS_15GraphicsContextEii
+__ZN7WebCore14RenderSVGImage17addFocusRingRectsEPNS_15GraphicsContextEii
+__ZN7WebCoreL23fontfacenameConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore22SVGFontFaceNameElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore22SVGFontFaceNameElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZNK7WebCore22SVGFontFaceNameElement8srcValueEv
+__ZN7WebCore15SVGGlyphElement19removedFromDocumentEv
+__ZN7WebCore22SVGFontFaceNameElementD0Ev
+__ZThn8_N7WebCore14SVGFontElementD0Ev
+__ZN7WebCoreL28createSVGStyleElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore17JSSVGStyleElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSSVGStyleElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGStyleElementEEE
+__ZN7WebCore17JSSVGStyleElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGStyleElementEEE
+__ZN7WebCore17JSSVGStyleElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSSVGStyleElement9classInfoEv
+__ZN7WebCore15SVGStyleElement19removedFromDocumentEv
+__ZN7WebCore17JSSVGStyleElementD1Ev
+__ZN7WebCore26JSSVGStyleElementPrototypeD1Ev
+__ZN7WebCore19RenderForeignObject16nodeAtFloatPointERKNS_14HitTestRequestERNS_13HitTestResultERKNS_10FloatPointENS_13HitTestAct
+__ZN7WebCore49jsHTMLFrameElementPrototypeFunctionGetSVGDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore49jsHTMLEmbedElementPrototypeFunctionGetSVGDocumentEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore37jsSVGGElementPrototypeFunctionGetBBoxEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore18RenderSVGContainer17objectBoundingBoxEv
+__ZN7WebCore40jsSVGTextElementPrototypeFunctionGetBBoxEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14SVGTextElement7getBBoxEv
+__ZN7WebCore26JSSVGImageElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSSVGImageElement9classInfoEv
+__ZN7WebCore41jsSVGImageElementPrototypeFunctionGetBBoxEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14RenderSVGImage17objectBoundingBoxEv
+__ZN7WebCore40jsSVGRectElementPrototypeFunctionGetBBoxEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore28jsSVGTextContentElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore45jsSVGRectElementPrototypeFunctionGetScreenCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore21jsSVGRectElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21jsSVGStopElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore13RenderSVGText16nodeAtFloatPointERKNS_14HitTestRequestERNS_13HitTestResultERKNS_10FloatPointENS_13HitTestActionE
+__ZN7WebCore11SVGAElement19defaultEventHandlerEPNS_5EventE
+__ZNK7WebCore11SVGAElement5titleEv
+__ZNK7WebCore11SVGAElement11isFocusableEv
+__ZNK7WebCore11SVGAElement16isMouseFocusableEv
+__ZN7WebCore19RenderSVGInlineText14localCaretRectEPNS_9InlineBoxEiPi
+__ZNK7WebCore11SVGAElement6targetEv
+__ZNK7WebCore19SVGAnimatedPropertyINS_11SVGAElementENS_6StringEXadL_ZNS_8SVGNames10aTagStringEEEXadL_ZNS3_16targetAttrStringEEE
+__ZN7WebCore21jsSVGPathElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14RenderSVGImage16nodeAtFloatPointERKNS_14HitTestRequestERNS_13HitTestResultERKNS_10FloatPointENS_13HitTestActionE
+__ZNK7WebCore16SVGScriptElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK7WebCore15SVGImageElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore41jsSVGDocumentPrototypeFunctionCreateEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore12SVGZoomEventC1Ev
+__ZN7WebCore12SVGZoomEventC2Ev
+__ZNK7WebCore12SVGZoomEvent14isSVGZoomEventEv
+__ZN7WebCore15getDOMStructureINS_14JSSVGZoomEventEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore14JSSVGZoomEvent15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSSVGZoomEventC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SVGZoomEventEEEPNS_10SVGElementE
+__ZN7WebCore14JSSVGZoomEventC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SVGZoomEventEEEPNS_10SVGElementE
+__ZN7WebCore14JSSVGZoomEvent18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28jsSVGZoomEventZoomRectScreenEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12SVGZoomEvent14zoomRectScreenEv
+__ZN7WebCore27jsSVGZoomEventPreviousScaleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12SVGZoomEvent13previousScaleEv
+__ZN7WebCore31jsSVGZoomEventPreviousTranslateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12SVGZoomEvent17previousTranslateEv
+__ZN7WebCore22jsSVGZoomEventNewScaleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12SVGZoomEvent8newScaleEv
+__ZN7WebCore26jsSVGZoomEventNewTranslateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12SVGZoomEvent12newTranslateEv
+__ZN7WebCore14JSSVGZoomEventD1Ev
+__ZN7WebCore12SVGZoomEventD0Ev
+__ZN7WebCore23JSSVGZoomEventPrototypeD1Ev
+__ZN7WebCore8SVGPaintC1Ev
+__ZN7WebCore8SVGPaintC2Ev
+__ZN7WebCore28jsSVGTextPositioningElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_13SVGLengthListEEENS1_29SVGAnimatedTypeW
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_13SVGLengthListEEENS1_29SVGAnimatedTypeWr
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIPNS_13SVGLengthListEEEPNS_10SVGElementE
+__ZN7WebCore23JSSVGAnimatedLengthList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSSVGAnimatedLengthListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_13SVGLengthListEE
+__ZN7WebCore23JSSVGAnimatedLengthListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_13SVGLengthListEE
+__ZN7WebCore23JSSVGAnimatedLengthList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30jsSVGAnimatedLengthListBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_13SVGLengthListEPNS_10SVGElementE
+__ZN7WebCore15JSSVGLengthList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore15JSSVGLengthListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGLengthListEEEPNS_10SVGElementE
+__ZN7WebCore15JSSVGLengthListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_13SVGLengthListEEEPNS_10SVGElementE
+__ZN7WebCore15JSSVGLengthList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28jsSVGLengthListNumberOfItemsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15JSSVGLengthListD1Ev
+__ZN7WebCore15JSSVGLengthListD2Ev
+__ZN7WebCore23JSSVGAnimatedLengthListD1Ev
+__ZN7WebCore23JSSVGAnimatedLengthListD2Ev
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIPNS1_13SVGLengthListEEEENS_18Pair
+__ZN7WebCore24JSSVGLengthListPrototypeD1Ev
+__ZN7WebCore32JSSVGAnimatedLengthListPrototypeD1Ev
+__ZN7WebCore29JSSVGClipPathElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSSVGClipPathElement9classInfoEv
+__ZThn8_N7WebCore14SVGStopElementD0Ev
+__ZN7WebCoreL29createSVGMarkerElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore18JSSVGMarkerElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGMarkerElementEEE
+__ZN7WebCore18JSSVGMarkerElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGMarkerElementEEE
+__ZN7WebCore18JSSVGMarkerElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSSVGMarkerElement9classInfoEv
+__ZN7WebCore18JSSVGMarkerElementD1Ev
+__ZN7WebCoreL27createSVGMaskElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGMaskElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGMaskElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGMaskElementEEE
+__ZN7WebCore16JSSVGMaskElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGMaskElementEEE
+__ZN7WebCore16JSSVGMaskElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGMaskElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSSVGMaskElement9classInfoEv
+__ZN7WebCore16JSSVGMaskElementD1Ev
+__ZN7WebCore25JSSVGMaskElementPrototypeD1Ev
+__ZN7WebCoreL30createSVGPatternElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore19JSSVGPatternElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSSVGPatternElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17SVGPatternElementEEE
+__ZN7WebCore19JSSVGPatternElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17SVGPatternElementEEE
+__ZN7WebCore19JSSVGPatternElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore28JSSVGPatternElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSSVGPatternElement9classInfoEv
+__ZN7WebCore19JSSVGPatternElementD1Ev
+__ZN7WebCore28JSSVGPatternElementPrototypeD1Ev
+__ZN7WebCore28jsSVGLinearGradientElementX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_24SVGLinearGradientElementENS_9SVGLengthEXadL_ZNS_8SVGNames23linearGradientTagStringEEEX
+__ZN7WebCore19synchronizePropertyINS_24SVGLinearGradientElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCore27jsSVGPathElementPathSegListEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_14SVGPathSegListEPNS_10SVGElementE
+__ZN7WebCore16JSSVGPathSegList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGPathSegListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGPathSegListEEEPNS_10SVGElementE
+__ZN7WebCore16JSSVGPathSegListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGPathSegListEEEPNS_10SVGElementE
+__ZN7WebCore16JSSVGPathSegList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25JSSVGPathSegListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore40jsSVGPathSegListPrototypeFunctionGetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore16JSSVGPathSegList9classInfoEv
+__ZN7WebCore16JSSVGPathSegList7getItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_10SVGPathSegEPNS_10SVGElementE
+__ZN7WebCore15getDOMStructureINS_21JSSVGPathSegMovetoAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore21JSSVGPathSegMovetoAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGPathSegMovetoAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegMovetoAbsEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegMovetoAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegMovetoAbsEEEPNS_10SVGElementE
+__ZN7WebCore12JSSVGPathSegC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_10SVGPathSegEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegMovetoAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsSVGPathSegMovetoAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21JSSVGPathSegMovetoAbs3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25setJSSVGPathSegMovetoAbsXEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21JSSVGPathSegMovetoAbsD1Ev
+__ZN7WebCore12JSSVGPathSegD2Ev
+__ZN7WebCore16JSSVGPathSegListD1Ev
+__ZN7WebCore16JSSVGPathSegListD2Ev
+__ZN7WebCore29jsSVGPathSegListNumberOfItemsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore43jsSVGPathSegListPrototypeFunctionRemoveItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSSVGPathSegList10removeItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore15getDOMStructureINS_27JSSVGPathSegCurvetoCubicAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore27JSSVGPathSegCurvetoCubicAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSSVGPathSegCurvetoCubicAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_25SVGPathSegCurvetoCubicAbsEEEPNS_10SVG
+__ZN7WebCore27JSSVGPathSegCurvetoCubicAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_25SVGPathSegCurvetoCubicAbsEEEPNS_10SVG
+__ZN7WebCore30JSSVGPathSegMovetoAbsPrototypeD1Ev
+__ZN7WebCore25JSSVGPathSegListPrototypeD1Ev
+__ZN7WebCore27JSSVGPathSegCurvetoCubicAbsD1Ev
+__ZN7WebCore36JSSVGPathSegCurvetoCubicAbsPrototypeD1Ev
+__ZN7WebCore24jsSVGPatternElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_15wid
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_15widt
+__ZN7WebCore19synchronizePropertyINS_17SVGPatternElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCoreL30createSVGPolygonElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore19JSSVGPolygonElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore19JSSVGPolygonElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17SVGPolygonElementEEE
+__ZN7WebCore19JSSVGPolygonElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_17SVGPolygonElementEEE
+__ZN7WebCore19JSSVGPolygonElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25jsSVGPolygonElementPointsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_12SVGPointListEPNS_10SVGElementE
+__ZN7WebCore14JSSVGPointList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore14JSSVGPointListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SVGPointListEEEPNS_10SVGElementE
+__ZN7WebCore14JSSVGPointListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_12SVGPointListEEEPNS_10SVGElementE
+__ZN7WebCore14JSSVGPointList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27jsSVGPointListNumberOfItemsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23JSSVGPointListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore38jsSVGPointListPrototypeFunctionGetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14JSSVGPointList9classInfoEv
+__ZN7WebCore14JSSVGPointList7getItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore33JSSVGPODTypeWrapperCreatorForListINS_10FloatPointEEcvS1_Ev
+__ZNK7WebCore14SVGPODListItemINS_10FloatPointEE5valueEv
+__ZN7WebCore33JSSVGPODTypeWrapperCreatorForListINS_10FloatPointEE12commitChangeES1_PNS_10SVGElementE
+__ZN7WebCore14SVGPODListItemINS_10FloatPointEE8setValueES1_
+__ZN7WebCore33JSSVGPODTypeWrapperCreatorForListINS_10FloatPointEED0Ev
+__ZN7WebCore14JSSVGPointListD1Ev
+__ZN7WebCore14JSSVGPointListD2Ev
+__ZN7WebCore41jsSVGPointListPrototypeFunctionRemoveItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSSVGPointList10removeItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore23JSSVGPointListPrototypeD1Ev
+__ZN7WebCore19JSSVGPolygonElementD1Ev
+__ZN7WebCore28JSSVGPolygonElementPrototypeD1Ev
+__ZN7WebCore28jsSVGPolygonElementTransformEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_29SVGStyledTransformableElementENS_16SVGTransformListEXadL_ZNS_39SVGStyledTransformableE
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_16SVGTransformListEEENS1_29SVGAnimatedTy
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_16SVGTransformListEEENS1_29SVGAnimatedTyp
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIPNS1_16SVGTransformListEEEENS_18P
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIPNS_16SVGTransformListEEEPNS_10SVGElementE
+__ZN7WebCore26JSSVGAnimatedTransformList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSSVGAnimatedTransformListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_16SVGTransform
+__ZN7WebCore26JSSVGAnimatedTransformListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_16SVGTransform
+__ZN7WebCore26JSSVGAnimatedTransformList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore33jsSVGAnimatedTransformListBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_16SVGTransformListEPNS_10SVGElementE
+__ZN7WebCore18JSSVGTransformList15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGTransformListC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGTransformListEEEPNS_10SVGElementE
+__ZN7WebCore18JSSVGTransformListC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGTransformListEEEPNS_10SVGElementE
+__ZN7WebCore50jsSVGSVGElementPrototypeFunctionCreateSVGTransformEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement18createSVGTransformEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19JSSVGPODTypeWrapperINS_12SVGTransformEEEPNS_10SVGElementE
+__ZN7WebCore14JSSVGTransformC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_12SVGTransformEEEEEPNS_10SV
+__ZN7WebCore14JSSVGTransformC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19JSSVGPODTypeWrapperINS_12SVGTransformEEEEEPNS_10SV
+__ZN7WebCore14JSSVGTransform18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore43jsSVGTransformPrototypeFunctionSetTranslateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore14JSSVGTransform9classInfoEv
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_12SVGTransformEEcvS1_Ev
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_12SVGTransformEE12commitChangeES1_PNS_10SVGElementE
+__ZN7WebCore18JSSVGTransformList18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSSVGTransformListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore45jsSVGTransformListPrototypeFunctionAppendItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore18JSSVGTransformList9classInfoEv
+__ZN7WebCore18JSSVGTransformList10appendItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore14toSVGTransformEN3JSC7JSValueE
+__ZN7WebCoreL12finishSetterEPN3JSC9ExecStateERiPNS_10SVGElementEPNS_16SVGTransformListEN3WTF10PassRefPtrINS_14SVGPODListItemINS
+__ZN7WebCore14JSSVGTransformD1Ev
+__ZN7WebCore14JSSVGTransformD2Ev
+__ZN7WebCore33JSSVGPODTypeWrapperCreatorForListINS_12SVGTransformEED0Ev
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_12SVGTransformEED0Ev
+__ZN7WebCore18JSSVGTransformListD1Ev
+__ZN7WebCore18JSSVGTransformListD2Ev
+__ZN7WebCore26JSSVGAnimatedTransformListD1Ev
+__ZN7WebCore26JSSVGAnimatedTransformListD2Ev
+__ZN7WebCore42jsSVGTransformListPrototypeFunctionGetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore18JSSVGTransformList7getItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore33JSSVGPODTypeWrapperCreatorForListINS_12SVGTransformEEcvS1_Ev
+__ZNK7WebCore14SVGPODListItemINS_12SVGTransformEE5valueEv
+__ZN7WebCore33JSSVGPODTypeWrapperCreatorForListINS_12SVGTransformEE12commitChangeES1_PNS_10SVGElementE
+__ZN7WebCore14SVGPODListItemINS_12SVGTransformEE8setValueES1_
+__ZN7WebCore27JSSVGTransformListPrototypeD1Ev
+__ZN7WebCore35JSSVGAnimatedTransformListPrototypeD1Ev
+__ZNK7WebCore13SVGSVGElement11currentViewEv
+__ZN7WebCore11SVGViewSpecC1EPKNS_13SVGSVGElementE
+__ZN7WebCore11SVGViewSpecC2EPKNS_13SVGSVGElementE
+__ZN7WebCore11SVGViewSpec13parseViewSpecERKNS_6StringE
+__ZNK7WebCore11SVGViewSpec14contextElementEv
+__ZN7WebCore11SVGViewSpec19setViewTargetStringERKNS_6StringE
+__ZN7WebCore13SVGSVGElement17setUseCurrentViewEb
+__ZN7WebCore11SVGViewSpecD0Ev
+__ZNK3WTF7HashMapIPKN7WebCore10SVGElementEPNS0_IPNS1_10StringImplEPNS1_8SVGAngleENS1_10StringHashENS_10HashTraitsIS6_EENSA_IS8_
+__ZN7WebCore17SVGResourceMasker10invalidateEv
+__ZN7WebCoreL28createSVGTitleElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore17JSSVGTitleElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore17JSSVGTitleElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGTitleElementEEE
+__ZN7WebCore17JSSVGTitleElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_15SVGTitleElementEEE
+__ZN7WebCore17JSSVGTitleElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore26JSSVGTitleElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore17JSSVGTitleElement9classInfoEv
+__ZN7WebCore17JSSVGTitleElementD1Ev
+__ZN7WebCore26JSSVGTitleElementPrototypeD1Ev
+__ZN7WebCore57jsSVGPathElementPrototypeFunctionGetPresentationAttributeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZN7WebCore47jsSVGPathElementPrototypeFunctionGetTotalLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14SVGPathElement14getTotalLengthEv
+__ZN7WebCore18PathTraversalState12closeSubpathEv
+__ZN7WebCore49jsSVGPathElementPrototypeFunctionGetPointAtLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14SVGPathElement16getPointAtLengthEf
+__ZN7WebCore16SVGInlineTextBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
+__ZN7WebCore19RenderSVGInlineText16positionForPointERKNS_8IntPointE
+__ZNK7WebCore16SVGInlineTextBox24svgCharacterHitsPositionEiiRi
+__ZNK7WebCore16SVGInlineTextBox26closestCharacterToPositionEiiRi
+__ZN7WebCore18SVGTextChunkWalkerINS_48SVGInlineTextBoxClosestCharacterToPositionWalkerEEclEPNS_16SVGInlineTextBoxEiRKNS_20Trans
+__ZN7WebCore48SVGInlineTextBoxClosestCharacterToPositionWalker20chunkPortionCallbackEPNS_16SVGInlineTextBoxEiRKNS_20Transformat
+__ZN7WebCoreL31createSVGPolylineElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore20JSSVGPolylineElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGPolylineElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGPolylineElementEEE
+__ZN7WebCore20JSSVGPolylineElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGPolylineElementEEE
+__ZN7WebCore20JSSVGPolylineElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29JSSVGPolylineElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSSVGPolylineElement9classInfoEv
+__ZN7WebCore28JSSVGPolygonElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19JSSVGPolygonElement9classInfoEv
+__ZN7WebCore20JSSVGPolylineElementD1Ev
+__ZN7WebCore26jsSVGPolylineElementPointsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore41jsSVGPointListPrototypeFunctionAppendItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore14JSSVGPointList10appendItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore10toSVGPointEN3JSC7JSValueE
+__ZN7WebCoreL12finishSetterEPN3JSC9ExecStateERiPNS_10SVGElementEPNS_12SVGPointListEN3WTF10PassRefPtrINS_14SVGPODListItemINS_10F
+__ZN7WebCore19synchronizePropertyINS_14SVGPolyElementEPNS_12SVGPointListEEEvPKT_RKNS_13QualifiedNameET0_
+__ZNK7WebCore12SVGPointList13valueAsStringEv
+__ZN7WebCore29JSSVGPolylineElementPrototypeD1Ev
+__ZN7WebCore18jsSVGExceptionCodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore21RenderSVGGradientStop29repaintRectInLocalCoordinatesEv
+__ZN7WebCore12RenderObject5paintERNS0_9PaintInfoEii
+__ZN7WebCore16jsNodeOndblclickEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node10ondblclickEv
+__ZN7WebCore35JSSVGStaticPODTypeWrapperWithParentINS_10FloatPointENS_13SVGSVGElementEEcvS1_Ev
+__ZN7WebCore35JSSVGStaticPODTypeWrapperWithParentINS_10FloatPointENS_13SVGSVGElementEE12commitChangeES1_PNS_10SVGElementE
+__ZN7WebCore13SVGSVGElement19setCurrentTranslateERKNS_10FloatPointE
+__ZNK3WTF7HashMapIN7WebCore6StringEPKNS1_23SVGAnimatedPropertyBaseENS1_10StringHashENS_10HashTraitsIS2_EENS7_IS5_EEE3getERKS2_
+__ZN7WebCore38jsSVGSVGElementPrototypeFunctionGetCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore44jsSVGSVGElementPrototypeFunctionGetScreenCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore36jsSVGGElementPrototypeFunctionGetCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore42jsSVGGElementPrototypeFunctionGetScreenCTMEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore20jsSVGTransformMatrixEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11JSSVGMatrix3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore15setJSSVGMatrixAEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore42JSSVGStaticPODTypeWrapperWithPODTypeParentINS_20TransformationMatrixENS_12SVGTransformEE12commitChangeES1_PNS_10S
+__ZN7WebCore42JSSVGStaticPODTypeWrapperWithPODTypeParentINS_20TransformationMatrixENS_12SVGTransformEED0Ev
+__ZN7WebCore60jsSVGTextContentElementPrototypeFunctionGetCharNumAtPositionEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7
+__ZNK7WebCore21SVGTextContentElement20getCharNumAtPositionERKNS_10FloatPointE
+__ZN7WebCore55jsSVGTextContentElementPrototypeFunctionGetExtentOfCharEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZNK7WebCore21SVGTextContentElement15getExtentOfCharEjRi
+__ZN7WebCore33jsSVGTextContentElementTextLengthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_21SVGTextContentElementENS_9SVGLengthEXadL_ZNS_31SVGTextContentElementIdentifierEEEXadL_
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_21SVGTextContentElementES1_NS_9SVGLengthES2_XadL_ZNS_31SVGTextContentElementIdenti
+__ZN7WebCore35jsSVGTextContentElementLengthAdjustEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_21SVGTextContentElementEiXadL_ZNS_31SVGTextContentElementIdentifierEEEXadL_ZNS_8SVGNames
+__ZN7WebCore24JSSVGAnimatedEnumeration18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore31jsSVGAnimatedEnumerationBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsSVGAnimatedEnumerationAnimValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_21SVGTextContentElementES1_iiXadL_ZNS_31SVGTextContentElementIdentifierEEEXadL_ZNS
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_21SVGTextContentElementES1_iiXadL_ZNS_31SVGTextContentElementIdentifierEEEXadL_ZNS_
+__ZN7WebCoreL27createSVGTRefElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore16JSSVGTRefElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore16JSSVGTRefElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGTRefElementEEE
+__ZN7WebCore16JSSVGTRefElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_14SVGTRefElementEEE
+__ZN7WebCore16JSSVGTRefElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16JSSVGTRefElement9classInfoEv
+__ZN7WebCore16JSSVGTRefElementD1Ev
+__ZN7WebCore24RenderSVGHiddenContainer16nodeAtFloatPointERKNS_14HitTestRequestERNS_13HitTestResultERKNS_10FloatPointENS_13HitTe
+__ZN7WebCore25JSSVGTRefElementPrototypeD1Ev
+__ZThn24_N7WebCore18SVGElementInstance20toSVGElementInstanceEv
+__ZN7WebCore18SVGElementInstance20toSVGElementInstanceEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_18SVGElementInstanceE
+__ZN7WebCore20JSSVGElementInstance15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore20JSSVGElementInstanceC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGElementInstanceEEE
+__ZN7WebCore20JSSVGElementInstanceC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_18SVGElementInstanceEEE
+__ZN7WebCore20JSSVGElementInstance18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore43jsSVGElementInstanceCorrespondingUseElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsSVGElementInstanceCorrespondingElementEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSSVGElementInstanceD1Ev
+__ZN7WebCore20JSSVGElementInstanceD2Ev
+__ZN7WebCore30jsSVGElementInstanceParentNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsSVGElementInstanceNextSiblingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsSVGElementInstanceFirstChildEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGElementInstanceLastChildEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGElementInstancePreviousSiblingEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29JSSVGElementInstancePrototypeD1Ev
+__ZNK7WebCore19JSLazyEventListener20wasCreatedFromMarkupEv
+__ZN7WebCore27jsSVGUseElementInstanceRootEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore13SVGUseElement12instanceRootEv
+__ZN7WebCore29JSSVGElementInstancePrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore20JSSVGElementInstance9classInfoEv
+__ZN7WebCore53jsSVGElementInstancePrototypeFunctionAddEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore20JSSVGElementInstance16addEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore18SVGElementInstance22scriptExecutionContextEv
+__ZN7WebCore18SVGElementInstance16addEventListenerERKNS_12AtomicStringEN3WTF10PassRefPtrINS_13EventListenerEEEb
+__ZNK7WebCore13EventListener20wasCreatedFromMarkupEv
+__ZN7WebCore56jsSVGElementInstancePrototypeFunctionRemoveEventListenerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
+__ZN7WebCore20JSSVGElementInstance19removeEventListenerEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore18SVGElementInstance19removeEventListenerERKNS_12AtomicStringEPNS_13EventListenerEb
+__ZN7WebCore20JSSVGElementInstance4markEv
+__ZN7WebCore50jsSVGElementInstancePrototypeFunctionDispatchEventEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore18SVGElementInstance13dispatchEventEN3WTF10PassRefPtrINS_5EventEEERi
+__ZN7WebCore13JSSVGGElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore16JSSVGRectElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore15JSSVGUseElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore19jsSVGUseElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGURIReferenceENS_6StringEXadL_ZNS_25SVGURIReferenceIdentifierEEEXadL_ZNS_10XLinkName
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_15SVGURIReferenceENS_10SVGElementENS_6StringES3_XadL_ZNS_25SVGURIReferenceIdentifie
+__ZNK7WebCore19SVGAnimatedPropertyINS_15SVGURIReferenceENS_6StringEXadL_ZNS_25SVGURIReferenceIdentifierEEEXadL_ZNS_10XLinkNames
+__ZN7WebCore19synchronizePropertyINS_10SVGElementENS_6StringEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCore21SVGDocumentExtensions13reportWarningERKNS_6StringE
+__ZThn8_N7WebCore23SVGForeignObjectElementD0Ev
+__ZN7WebCore16jsSVGUseElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_13SVGUseElementENS_9SVGLengthEXadL_ZNS_8SVGNames12useTagStringEEEXadL_ZNS3_11xAttrString
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_13SVGUseElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames12useTagStringEEEXadL_ZNS3_11
+__ZN7WebCore16jsSVGUseElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_13SVGUseElementENS_9SVGLengthEXadL_ZNS_8SVGNames12useTagStringEEEXadL_ZNS3_11yAttrString
+__ZN7WebCore13SVGZoomAndPan16isKnownAttributeERKNS_13QualifiedNameE
+__ZN7WebCore19synchronizePropertyINS_13SVGSVGElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCore26jsSVGAltGlyphElementFormatEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18SVGAltGlyphElement6formatEv
+__ZN7WebCore20JSSVGAltGlyphElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore29setJSSVGAltGlyphElementFormatEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18SVGAltGlyphElement9setFormatERKNS_12AtomicStringERi
+__ZNK7WebCore19JSSVGAnimatedLength9classInfoEv
+__ZNK7WebCore11JSSVGLength9classInfoEv
+__ZN7WebCoreL35createSVGFontFaceNameElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore24JSSVGFontFaceNameElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore24JSSVGFontFaceNameElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22SVGFontFaceNameElementEEE
+__ZN7WebCore24JSSVGFontFaceNameElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22SVGFontFaceNameElementEEE
+__ZNK7WebCore24JSSVGFontFaceNameElement9classInfoEv
+__ZN7WebCoreL25fontfaceformatConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore24SVGFontFaceFormatElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore24SVGFontFaceFormatElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL37createSVGFontFaceFormatElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore26JSSVGFontFaceFormatElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSSVGFontFaceFormatElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24SVGFontFaceFormatElementEEE
+__ZN7WebCore26JSSVGFontFaceFormatElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24SVGFontFaceFormatElementEEE
+__ZNK7WebCore26JSSVGFontFaceFormatElement9classInfoEv
+__ZN7WebCoreL34createSVGFontFaceSrcElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore23JSSVGFontFaceSrcElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSSVGFontFaceSrcElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21SVGFontFaceSrcElementEEE
+__ZN7WebCore23JSSVGFontFaceSrcElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21SVGFontFaceSrcElementEEE
+__ZNK7WebCore23JSSVGFontFaceSrcElement9classInfoEv
+__ZN7WebCoreL34createSVGFontFaceUriElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore23JSSVGFontFaceUriElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore23JSSVGFontFaceUriElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21SVGFontFaceUriElementEEE
+__ZN7WebCore23JSSVGFontFaceUriElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_21SVGFontFaceUriElementEEE
+__ZNK7WebCore23JSSVGFontFaceUriElement9classInfoEv
+__ZN7WebCoreL24definitionsrcConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
+__ZN7WebCore23SVGDefinitionSrcElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCore23SVGDefinitionSrcElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
+__ZN7WebCoreL36createSVGDefinitionSrcElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore25JSSVGDefinitionSrcElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSSVGDefinitionSrcElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23SVGDefinitionSrcElementEEE
+__ZN7WebCore25JSSVGDefinitionSrcElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23SVGDefinitionSrcElementEEE
+__ZNK7WebCore25JSSVGDefinitionSrcElement9classInfoEv
+__ZN7WebCore25JSSVGDefinitionSrcElementD1Ev
+__ZThn8_N7WebCore23SVGDefinitionSrcElementD0Ev
+__ZN7WebCore23SVGDefinitionSrcElementD0Ev
+__ZN7WebCore23JSSVGFontFaceUriElementD1Ev
+__ZThn8_N7WebCore21SVGFontFaceUriElementD0Ev
+__ZN7WebCore23JSSVGFontFaceSrcElementD1Ev
+__ZThn8_N7WebCore21SVGFontFaceSrcElementD0Ev
+__ZN7WebCore26JSSVGFontFaceFormatElementD1Ev
+__ZThn8_N7WebCore24SVGFontFaceFormatElementD0Ev
+__ZN7WebCore24SVGFontFaceFormatElementD0Ev
+__ZN7WebCore24JSSVGFontFaceNameElementD1Ev
+__ZThn8_N7WebCore22SVGFontFaceNameElementD0Ev
+__ZThn8_N7WebCore18SVGFontFaceElementD0Ev
+__ZNK7WebCore13HTMLTokenizer10lineNumberEv
+__ZN7WebCore12JSSVGPathSeg18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore31jsSVGPathSegPathSegTypeAsLetterEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27JSSVGPathSegCurvetoCubicAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore15getDOMStructureINS_21JSSVGPathSegClosePathEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore21JSSVGPathSegClosePath15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGPathSegClosePathC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegClosePathEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegClosePathC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegClosePathEEEPNS_10SVGElementE
+__ZNK7WebCore19SVGPathSegClosePath19pathSegTypeAsLetterEv
+__ZN7WebCore15getDOMStructureINS_21JSSVGPathSegLinetoAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore21JSSVGPathSegLinetoAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGPathSegLinetoAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegLinetoAbsEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegLinetoAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegLinetoAbsEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegLinetoAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34JSSVGDefinitionSrcElementPrototypeD1Ev
+__ZN7WebCore32JSSVGFontFaceUriElementPrototypeD1Ev
+__ZN7WebCore32JSSVGFontFaceSrcElementPrototypeD1Ev
+__ZN7WebCore35JSSVGFontFaceFormatElementPrototypeD1Ev
+__ZN7WebCore33JSSVGFontFaceNameElementPrototypeD1Ev
+__ZN7WebCore21JSSVGPathSegClosePathD1Ev
+__ZN7WebCore21JSSVGPathSegLinetoAbsD1Ev
+__ZN7WebCore24JSSVGLengthListPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsSVGLengthListPrototypeFunctionGetItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15JSSVGLengthList9classInfoEv
+__ZN7WebCore24jsSVGLengthValueAsStringEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9SVGLengthEEcvS1_Ev
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9SVGLengthEED0Ev
+__ZN7WebCore30JSSVGPathSegClosePathPrototypeD1Ev
+__ZN7WebCore30JSSVGPathSegLinetoAbsPrototypeD1Ev
+__ZN7WebCore22jsSVGPathSegMovetoAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsSVGPathSegLinetoAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsSVGPathSegLinetoAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicAbsX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicAbsY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicAbsX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicAbsY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGPathSegCurvetoCubicAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGPathSegCurvetoCubicAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore58jsSVGPathElementPrototypeFunctionCreateSVGPathSegClosePathEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZN7WebCore23jsSVGPathSegPathSegTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore58jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZN7WebCore58jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZN7WebCore14SVGPathElement25createSVGPathSegMovetoRelEff
+__ZN7WebCore19SVGPathSegMovetoRelC1Eff
+__ZN7WebCore19SVGPathSegMovetoRelC2Eff
+__ZNK7WebCore19SVGPathSegMovetoRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_21JSSVGPathSegMovetoRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore21JSSVGPathSegMovetoRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGPathSegMovetoRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegMovetoRelEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegMovetoRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegMovetoRelEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegMovetoRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19SVGPathSegMovetoRel19pathSegTypeAsLetterEv
+__ZN7WebCore22jsSVGPathSegMovetoRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsSVGPathSegMovetoRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore58jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZN7WebCore58jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZN7WebCore14SVGPathElement25createSVGPathSegLinetoRelEff
+__ZN7WebCore19SVGPathSegLinetoRelC1Eff
+__ZN7WebCore19SVGPathSegLinetoRelC2Eff
+__ZNK7WebCore19SVGPathSegLinetoRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_21JSSVGPathSegLinetoRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore21JSSVGPathSegLinetoRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSSVGPathSegLinetoRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegLinetoRelEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegLinetoRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGPathSegLinetoRelEEEPNS_10SVGElementE
+__ZN7WebCore21JSSVGPathSegLinetoRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore19SVGPathSegLinetoRel19pathSegTypeAsLetterEv
+__ZN7WebCore22jsSVGPathSegLinetoRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsSVGPathSegLinetoRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore64jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKN
+__ZN7WebCore64jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKN
+__ZN7WebCore14SVGPathElement31createSVGPathSegCurvetoCubicRelEffffff
+__ZN7WebCore25SVGPathSegCurvetoCubicRelC1Effffff
+__ZN7WebCore25SVGPathSegCurvetoCubicRelC2Effffff
+__ZNK7WebCore25SVGPathSegCurvetoCubicRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_27JSSVGPathSegCurvetoCubicRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore27JSSVGPathSegCurvetoCubicRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore27JSSVGPathSegCurvetoCubicRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_25SVGPathSegCurvetoCubicRelEEEPNS_10SVG
+__ZN7WebCore27JSSVGPathSegCurvetoCubicRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_25SVGPathSegCurvetoCubicRelEEEPNS_10SVG
+__ZN7WebCore27JSSVGPathSegCurvetoCubicRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25SVGPathSegCurvetoCubicRel19pathSegTypeAsLetterEv
+__ZN7WebCore28jsSVGPathSegCurvetoCubicRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGPathSegCurvetoCubicRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicRelX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicRelY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicRelX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGPathSegCurvetoCubicRelY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore68jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValue
+__ZN7WebCore14SVGPathElement35createSVGPathSegCurvetoQuadraticAbsEffff
+__ZN7WebCore29SVGPathSegCurvetoQuadraticAbsC1Effff
+__ZN7WebCore29SVGPathSegCurvetoQuadraticAbsC2Effff
+__ZNK7WebCore29SVGPathSegCurvetoQuadraticAbs11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_31JSSVGPathSegCurvetoQuadraticAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegCurvetoQuadraticAbsEEEP
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegCurvetoQuadraticAbsEEEP
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29SVGPathSegCurvetoQuadraticAbs19pathSegTypeAsLetterEv
+__ZN7WebCore32jsSVGPathSegCurvetoQuadraticAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsSVGPathSegCurvetoQuadraticAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGPathSegCurvetoQuadraticAbsX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGPathSegCurvetoQuadraticAbsY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore68jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValue
+__ZN7WebCore14SVGPathElement35createSVGPathSegCurvetoQuadraticRelEffff
+__ZN7WebCore29SVGPathSegCurvetoQuadraticRelC1Effff
+__ZN7WebCore29SVGPathSegCurvetoQuadraticRelC2Effff
+__ZNK7WebCore29SVGPathSegCurvetoQuadraticRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_31JSSVGPathSegCurvetoQuadraticRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegCurvetoQuadraticRelEEEP
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegCurvetoQuadraticRelEEEP
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29SVGPathSegCurvetoQuadraticRel19pathSegTypeAsLetterEv
+__ZN7WebCore32jsSVGPathSegCurvetoQuadraticRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore32jsSVGPathSegCurvetoQuadraticRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGPathSegCurvetoQuadraticRelX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33jsSVGPathSegCurvetoQuadraticRelY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore55jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore14SVGPathElement22createSVGPathSegArcAbsEfffffbb
+__ZN7WebCore16SVGPathSegArcAbsC1Efffffbb
+__ZN7WebCore16SVGPathSegArcAbsC2Efffffbb
+__ZNK7WebCore16SVGPathSegArcAbs11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_18JSSVGPathSegArcAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore18JSSVGPathSegArcAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGPathSegArcAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGPathSegArcAbsEEEPNS_10SVGElementE
+__ZN7WebCore18JSSVGPathSegArcAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGPathSegArcAbsEEEPNS_10SVGElementE
+__ZN7WebCore18JSSVGPathSegArcAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16SVGPathSegArcAbs19pathSegTypeAsLetterEv
+__ZN7WebCore19jsSVGPathSegArcAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsSVGPathSegArcAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsSVGPathSegArcAbsR1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsSVGPathSegArcAbsR2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsSVGPathSegArcAbsAngleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsSVGPathSegArcAbsLargeArcFlagEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGPathSegArcAbsSweepFlagEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore55jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore14SVGPathElement22createSVGPathSegArcRelEfffffbb
+__ZN7WebCore16SVGPathSegArcRelC1Efffffbb
+__ZN7WebCore16SVGPathSegArcRelC2Efffffbb
+__ZNK7WebCore16SVGPathSegArcRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_18JSSVGPathSegArcRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore18JSSVGPathSegArcRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGPathSegArcRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGPathSegArcRelEEEPNS_10SVGElementE
+__ZN7WebCore18JSSVGPathSegArcRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGPathSegArcRelEEEPNS_10SVGElementE
+__ZN7WebCore18JSSVGPathSegArcRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore16SVGPathSegArcRel19pathSegTypeAsLetterEv
+__ZN7WebCore19jsSVGPathSegArcRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsSVGPathSegArcRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsSVGPathSegArcRelR1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20jsSVGPathSegArcRelR2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsSVGPathSegArcRelAngleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore30jsSVGPathSegArcRelLargeArcFlagEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGPathSegArcRelSweepFlagEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore68jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValue
+__ZN7WebCore14SVGPathElement35createSVGPathSegLinetoHorizontalAbsEf
+__ZN7WebCore29SVGPathSegLinetoHorizontalAbsC1Ef
+__ZN7WebCore29SVGPathSegLinetoHorizontalAbsC2Ef
+__ZNK7WebCore29SVGPathSegLinetoHorizontalAbs11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_31JSSVGPathSegLinetoHorizontalAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegLinetoHorizontalAbsEEEP
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegLinetoHorizontalAbsEEEP
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29SVGPathSegLinetoHorizontalAbs19pathSegTypeAsLetterEv
+__ZN7WebCore32jsSVGPathSegLinetoHorizontalAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore68jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValue
+__ZN7WebCore14SVGPathElement35createSVGPathSegLinetoHorizontalRelEf
+__ZN7WebCore29SVGPathSegLinetoHorizontalRelC1Ef
+__ZN7WebCore29SVGPathSegLinetoHorizontalRelC2Ef
+__ZNK7WebCore29SVGPathSegLinetoHorizontalRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_31JSSVGPathSegLinetoHorizontalRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegLinetoHorizontalRelEEEP
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_29SVGPathSegLinetoHorizontalRelEEEP
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore29SVGPathSegLinetoHorizontalRel19pathSegTypeAsLetterEv
+__ZN7WebCore32jsSVGPathSegLinetoHorizontalRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore66jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueER
+__ZN7WebCore14SVGPathElement33createSVGPathSegLinetoVerticalAbsEf
+__ZN7WebCore27SVGPathSegLinetoVerticalAbsC1Ef
+__ZN7WebCore27SVGPathSegLinetoVerticalAbsC2Ef
+__ZNK7WebCore27SVGPathSegLinetoVerticalAbs11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_29JSSVGPathSegLinetoVerticalAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore29JSSVGPathSegLinetoVerticalAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSSVGPathSegLinetoVerticalAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_27SVGPathSegLinetoVerticalAbsEEEPNS_1
+__ZN7WebCore29JSSVGPathSegLinetoVerticalAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_27SVGPathSegLinetoVerticalAbsEEEPNS_1
+__ZN7WebCore29JSSVGPathSegLinetoVerticalAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27SVGPathSegLinetoVerticalAbs19pathSegTypeAsLetterEv
+__ZN7WebCore30jsSVGPathSegLinetoVerticalAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore66jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueER
+__ZN7WebCore14SVGPathElement33createSVGPathSegLinetoVerticalRelEf
+__ZN7WebCore27SVGPathSegLinetoVerticalRelC1Ef
+__ZN7WebCore27SVGPathSegLinetoVerticalRelC2Ef
+__ZNK7WebCore27SVGPathSegLinetoVerticalRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_29JSSVGPathSegLinetoVerticalRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore29JSSVGPathSegLinetoVerticalRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore29JSSVGPathSegLinetoVerticalRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_27SVGPathSegLinetoVerticalRelEEEPNS_1
+__ZN7WebCore29JSSVGPathSegLinetoVerticalRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_27SVGPathSegLinetoVerticalRelEEEPNS_1
+__ZN7WebCore29JSSVGPathSegLinetoVerticalRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore27SVGPathSegLinetoVerticalRel19pathSegTypeAsLetterEv
+__ZN7WebCore30jsSVGPathSegLinetoVerticalRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore70jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSVal
+__ZN7WebCore14SVGPathElement37createSVGPathSegCurvetoCubicSmoothAbsEffff
+__ZN7WebCore31SVGPathSegCurvetoCubicSmoothAbsC1Effff
+__ZN7WebCore31SVGPathSegCurvetoCubicSmoothAbsC2Effff
+__ZNK7WebCore31SVGPathSegCurvetoCubicSmoothAbs11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_33JSSVGPathSegCurvetoCubicSmoothAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_31SVGPathSegCurvetoCubicSmoothAbs
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_31SVGPathSegCurvetoCubicSmoothAbs
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore31SVGPathSegCurvetoCubicSmoothAbs19pathSegTypeAsLetterEv
+__ZN7WebCore34jsSVGPathSegCurvetoCubicSmoothAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsSVGPathSegCurvetoCubicSmoothAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGPathSegCurvetoCubicSmoothAbsX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGPathSegCurvetoCubicSmoothAbsY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore70jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSVal
+__ZN7WebCore14SVGPathElement37createSVGPathSegCurvetoCubicSmoothRelEffff
+__ZN7WebCore31SVGPathSegCurvetoCubicSmoothRelC1Effff
+__ZN7WebCore31SVGPathSegCurvetoCubicSmoothRelC2Effff
+__ZNK7WebCore31SVGPathSegCurvetoCubicSmoothRel11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_33JSSVGPathSegCurvetoCubicSmoothRelEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_31SVGPathSegCurvetoCubicSmoothRel
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_31SVGPathSegCurvetoCubicSmoothRel
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore31SVGPathSegCurvetoCubicSmoothRel19pathSegTypeAsLetterEv
+__ZN7WebCore34jsSVGPathSegCurvetoCubicSmoothRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore34jsSVGPathSegCurvetoCubicSmoothRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGPathSegCurvetoCubicSmoothRelX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGPathSegCurvetoCubicSmoothRelY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore74jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothAbsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7J
+__ZN7WebCore14SVGPathElement41createSVGPathSegCurvetoQuadraticSmoothAbsEff
+__ZN7WebCore35SVGPathSegCurvetoQuadraticSmoothAbsC1Eff
+__ZN7WebCore35SVGPathSegCurvetoQuadraticSmoothAbsC2Eff
+__ZNK7WebCore35SVGPathSegCurvetoQuadraticSmoothAbs11pathSegTypeEv
+__ZN7WebCore15getDOMStructureINS_37JSSVGPathSegCurvetoQuadraticSmoothAbsEEEPN3JSC9StructureEPNS2_9ExecStateE
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothAbs15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothAbsC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_35SVGPathSegCurvetoQuadraticS
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothAbsC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_35SVGPathSegCurvetoQuadraticS
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothAbs18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlot
+__ZNK7WebCore35SVGPathSegCurvetoQuadraticSmoothAbs19pathSegTypeAsLetterEv
+__ZN7WebCore38jsSVGPathSegCurvetoQuadraticSmoothAbsXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsSVGPathSegCurvetoQuadraticSmoothAbsYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore74jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothRelEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7J
+__ZN7WebCore14SVGPathElement41createSVGPathSegCurvetoQuadraticSmoothRelEff
+__ZN7WebCore35SVGPathSegCurvetoQuadraticSmoothRelC1Eff
+__ZN7WebCore35SVGPathSegCurvetoQuadraticSmoothRelC2Eff
+__ZNK7WebCore35SVGPathSegCurvetoQuadraticSmoothRel11pathSegTypeEv
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothRel15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothRelC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_35SVGPathSegCurvetoQuadraticS
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothRelC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_35SVGPathSegCurvetoQuadraticS
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothRel18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlot
+__ZNK7WebCore35SVGPathSegCurvetoQuadraticSmoothRel19pathSegTypeAsLetterEv
+__ZN7WebCore38jsSVGPathSegCurvetoQuadraticSmoothRelXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsSVGPathSegCurvetoQuadraticSmoothRelYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothRelD1Ev
+__ZN7WebCore31SVGPathSegCurvetoCubicSmoothRelD0Ev
+__ZN7WebCore33JSSVGPathSegCurvetoCubicSmoothAbsD1Ev
+__ZN7WebCore31SVGPathSegCurvetoCubicSmoothAbsD0Ev
+__ZN7WebCore29JSSVGPathSegLinetoVerticalRelD1Ev
+__ZN7WebCore27SVGPathSegLinetoVerticalRelD0Ev
+__ZN7WebCore29JSSVGPathSegLinetoVerticalAbsD1Ev
+__ZN7WebCore27SVGPathSegLinetoVerticalAbsD0Ev
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalRelD1Ev
+__ZN7WebCore29SVGPathSegLinetoHorizontalRelD0Ev
+__ZN7WebCore31JSSVGPathSegLinetoHorizontalAbsD1Ev
+__ZN7WebCore29SVGPathSegLinetoHorizontalAbsD0Ev
+__ZN7WebCore18JSSVGPathSegArcRelD1Ev
+__ZN7WebCore16SVGPathSegArcRelD0Ev
+__ZN7WebCore18JSSVGPathSegArcAbsD1Ev
+__ZN7WebCore16SVGPathSegArcAbsD0Ev
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticRelD1Ev
+__ZN7WebCore29SVGPathSegCurvetoQuadraticRelD0Ev
+__ZN7WebCore31JSSVGPathSegCurvetoQuadraticAbsD1Ev
+__ZN7WebCore29SVGPathSegCurvetoQuadraticAbsD0Ev
+__ZN7WebCore27JSSVGPathSegCurvetoCubicRelD1Ev
+__ZN7WebCore25SVGPathSegCurvetoCubicRelD0Ev
+__ZN7WebCore21JSSVGPathSegLinetoRelD1Ev
+__ZN7WebCore19SVGPathSegLinetoRelD0Ev
+__ZN7WebCore21JSSVGPathSegMovetoRelD1Ev
+__ZN7WebCore19SVGPathSegMovetoRelD0Ev
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothRelD1Ev
+__ZN7WebCore35SVGPathSegCurvetoQuadraticSmoothRelD0Ev
+__ZN7WebCore37JSSVGPathSegCurvetoQuadraticSmoothAbsD1Ev
+__ZN7WebCore35SVGPathSegCurvetoQuadraticSmoothAbsD0Ev
+__ZN7WebCore42JSSVGPathSegCurvetoCubicSmoothRelPrototypeD1Ev
+__ZN7WebCore42JSSVGPathSegCurvetoCubicSmoothAbsPrototypeD1Ev
+__ZN7WebCore38JSSVGPathSegLinetoVerticalRelPrototypeD1Ev
+__ZN7WebCore38JSSVGPathSegLinetoVerticalAbsPrototypeD1Ev
+__ZN7WebCore40JSSVGPathSegLinetoHorizontalRelPrototypeD1Ev
+__ZN7WebCore40JSSVGPathSegLinetoHorizontalAbsPrototypeD1Ev
+__ZN7WebCore27JSSVGPathSegArcRelPrototypeD1Ev
+__ZN7WebCore27JSSVGPathSegArcAbsPrototypeD1Ev
+__ZN7WebCore40JSSVGPathSegCurvetoQuadraticRelPrototypeD1Ev
+__ZN7WebCore40JSSVGPathSegCurvetoQuadraticAbsPrototypeD1Ev
+__ZN7WebCore36JSSVGPathSegCurvetoCubicRelPrototypeD1Ev
+__ZN7WebCore30JSSVGPathSegLinetoRelPrototypeD1Ev
+__ZN7WebCore30JSSVGPathSegMovetoRelPrototypeD1Ev
+__ZN7WebCore46JSSVGPathSegCurvetoQuadraticSmoothRelPrototypeD1Ev
+__ZN7WebCore46JSSVGPathSegCurvetoQuadraticSmoothAbsPrototypeD1Ev
+__ZN7WebCore36jsSVGImageElementPreserveAspectRatioEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGImageElementENS_22SVGPreserveAspectRatioEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_
+__ZN7WebCore32JSSVGAnimatedPreserveAspectRatio18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore39jsSVGAnimatedPreserveAspectRatioBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_22SVGPreserveAspectRatioEPNS_10SVGElementE
+__ZN7WebCore24JSSVGPreserveAspectRatioC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22SVGPreserveAspectRatioEEEPNS_10SVGElemen
+__ZN7WebCore24JSSVGPreserveAspectRatioC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_22SVGPreserveAspectRatioEEEPNS_10SVGElemen
+__ZN7WebCore24JSSVGPreserveAspectRatio18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore29jsSVGPreserveAspectRatioAlignEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore35jsSVGPreserveAspectRatioMeetOrSliceEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore24JSSVGPreserveAspectRatioD1Ev
+__ZN7WebCore24JSSVGPreserveAspectRatioD2Ev
+__ZNK7WebCore8SVGColor10isSVGColorEv
+__ZN7WebCore10JSSVGColorC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SVGColorEEE
+__ZNK7WebCore10JSSVGColor9classInfoEv
+__ZN7WebCore10JSSVGColorD1Ev
+__ZN3WTF7HashSetIdNS_9FloatHashIdEENS_10HashTraitsIdEEE3addERKd
+__ZN3WTF9HashTableIddNS_17IdentityExtractorIdEENS_9FloatHashIdEENS_10HashTraitsIdEES6_E6expandEv
+__ZN3WTF9HashTableIddNS_17IdentityExtractorIdEENS_9FloatHashIdEENS_10HashTraitsIdEES6_E6rehashEi
+__ZN3WTF9HashTableIddNS_17IdentityExtractorIdEENS_9FloatHashIdEENS_10HashTraitsIdEES6_E13allocateTableEi
+__ZN3WTF6VectorIN7WebCore14SVGSMILElement9ConditionELm0EE14shrinkCapacityEm
+__ZSt21__unguarded_partitionIPN7WebCore8SMILTimeES1_ET_S3_S3_T0_
+__ZN3WTF9HashTableIddNS_17IdentityExtractorIdEENS_9FloatHashIdEENS_10HashTraitsIdEES6_E4findIdNS_22IdentityHashTranslatorIddS4_
+__ZSt13__heap_selectIPN7WebCore8SMILTimeEEvT_S3_S3_
+__ZSt9make_heapIPN7WebCore8SMILTimeEEvT_S3_
+__ZSt13__adjust_heapIPN7WebCore8SMILTimeElS1_EvT_T0_S4_T1_
+__ZSt11__push_heapIPN7WebCore8SMILTimeElS1_EvT_T0_S4_T1_
+__ZSt9sort_heapIPN7WebCore8SMILTimeEEvT_S3_
+__ZN7WebCore46jsSVGSVGElementPrototypeFunctionCreateSVGAngleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement14createSVGAngleEv
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8SVGAngleEPNS_10SVGElementE
+__ZN7WebCore10JSSVGAngleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SVGAngleEEEPNS_10SVGElementE
+__ZN7WebCore10JSSVGAngleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_8SVGAngleEEEPNS_10SVGElementE
+__ZN7WebCore47jsSVGSVGElementPrototypeFunctionCreateSVGLengthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore13SVGSVGElement15createSVGLengthEv
+__ZN7WebCoreL29createSVGScriptElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore18JSSVGScriptElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGScriptElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGScriptElementEEE
+__ZN7WebCore18JSSVGScriptElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGScriptElementEEE
+__ZN7WebCore22setJSSVGElementXmlbaseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore10SVGElement10setXmlbaseERKNS_6StringERi
+__ZN7WebCore10JSSVGAngle3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore26setJSSVGAngleValueAsStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore8SVGAngle16setValueAsStringERKNS_6StringE
+__ZN7WebCore8SVGAngle9calculateEv
+__ZN7WebCore10JSSVGAngle18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore23jsSVGAngleValueAsStringEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore8SVGAngle13valueAsStringEv
+__ZN7WebCore27setJSSVGLengthValueAsStringEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore25JSSVGStaticPODTypeWrapperINS_9SVGLengthEE12commitChangeES1_PNS_10SVGElementE
+__ZN7WebCore18JSSVGScriptElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore25setJSSVGScriptElementTypeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18JSSVGScriptElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22jsSVGScriptElementTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore16SVGScriptElement4typeEv
+__ZN7WebCore18JSSVGScriptElementD1Ev
+__ZThn8_N7WebCore16SVGScriptElementD0Ev
+__ZN7WebCore10JSSVGAngleD1Ev
+__ZN7WebCore10JSSVGAngleD2Ev
+__ZN7WebCore49jsSVGPathSegListPrototypeFunctionInsertItemBeforeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSSVGPathSegList16insertItemBeforeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore12toSVGPathSegEN3JSC7JSValueE
+__ZN7WebCore44jsSVGPathSegListPrototypeFunctionReplaceItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSSVGPathSegList11replaceItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore27JSSVGScriptElementPrototypeD1Ev
+__ZN7WebCore43jsSVGPathSegListPrototypeFunctionAppendItemEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16JSSVGPathSegList10appendItemEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore21JSSVGPathSegMovetoAbs9classInfoEv
+__ZN7WebCore22jsSVGGElementTransformEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore31jsSVGTransformListNumberOfItemsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore19SVGAnimatedPropertyINS_29SVGStyledTransformableElementENS_16SVGTransformListEXadL_ZNS_39SVGStyledTransformableEl
+__ZN7WebCore19synchronizePropertyINS_29SVGStyledTransformableElementEPNS_16SVGTransformListEEEvPKT_RKNS_13QualifiedNameET0_
+__ZNK7WebCore16SVGTransformList13valueAsStringEv
+__ZN7WebCore22jsSVGScriptElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore18JSSVGScriptElement9classInfoEv
+__ZN7WebCore43jsSVGScriptElementExternalResourcesRequiredEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore20JSSVGAnimatedBoolean3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore30setJSSVGAnimatedBooleanBaseValEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZThn288_NK7WebCore16SVGScriptElement18typeAttributeValueEv
+__ZNK7WebCore16SVGScriptElement18typeAttributeValueEv
+__ZThn288_NK7WebCore16SVGScriptElement22languageAttributeValueEv
+__ZNK7WebCore16SVGScriptElement22languageAttributeValueEv
+__ZThn288_NK7WebCore16SVGScriptElement17forAttributeValueEv
+__ZNK7WebCore16SVGScriptElement17forAttributeValueEv
+__ZThn288_N7WebCore16SVGScriptElement18dispatchErrorEventEv
+__ZN7WebCore16SVGScriptElement18dispatchErrorEventEv
+__ZN7WebCoreL24createSVGAElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore13JSSVGAElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore13JSSVGAElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11SVGAElementEEE
+__ZN7WebCore13JSSVGAElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_11SVGAElementEEE
+__ZN7WebCore13JSSVGAElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore22JSSVGAElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore13JSSVGAElement9classInfoEv
+__ZN7WebCore22JSSVGAElementPrototypeD1Ev
+__ZN7WebCore13JSSVGAElementD1Ev
+__ZN7WebCore17jsSVGAElementHrefEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsSVGAElementTargetEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_11SVGAElementENS_6StringEXadL_ZNS_8SVGNames10aTagStringEEEXadL_ZNS3_16targetAttrStringEE
+__ZN7WebCore20jsSVGCircleElementCxEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGCircleElementENS_9SVGLengthEXadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_12cxAtt
+__ZN7WebCore20jsSVGCircleElementCyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGCircleElementENS_9SVGLengthEXadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_12cyAtt
+__ZN7WebCore19jsSVGCircleElementREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGCircleElementENS_9SVGLengthEXadL_ZNS_8SVGNames15circleTagStringEEEXadL_ZNS3_11rAttr
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_16SVGCircleElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames15circleTagStringEEEXadL_Z
+__ZN7WebCoreL29createSVGCursorElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore18JSSVGCursorElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGCursorElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGCursorElementEEE
+__ZN7WebCore18JSSVGCursorElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_16SVGCursorElementEEE
+__ZN7WebCore18JSSVGCursorElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore27JSSVGCursorElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore18JSSVGCursorElement9classInfoEv
+__ZN7WebCore6CursorC1EPNS_5ImageERKNS_8IntPointE
+__ZN7WebCore6CursorC2EPNS_5ImageERKNS_8IntPointE
+__ZN7WebCore18JSSVGCursorElementD1Ev
+__ZN7WebCore27JSSVGCursorElementPrototypeD1Ev
+__ZN7WebCore19jsSVGCursorElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGCursorElementENS_9SVGLengthEXadL_ZNS_8SVGNames15cursorTagStringEEEXadL_ZNS3_11xAttr
+__ZN7WebCore19jsSVGCursorElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGCursorElementENS_9SVGLengthEXadL_ZNS_8SVGNames15cursorTagStringEEEXadL_ZNS3_11yAttr
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_16SVGCursorElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames15cursorTagStringEEEXadL_Z
+__ZN7WebCore21jsSVGEllipseElementCxEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGEllipseElementENS_9SVGLengthEXadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12cxA
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_17SVGEllipseElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames16ellipseTagStringEEEXadL
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_17SVGEllipseElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames16ellipseTagStringEEEXad
+__ZN7WebCore21jsSVGEllipseElementCyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGEllipseElementENS_9SVGLengthEXadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12cyA
+__ZN7WebCore21jsSVGEllipseElementRxEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGEllipseElementENS_9SVGLengthEXadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12rxA
+__ZN7WebCore21jsSVGEllipseElementRyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGEllipseElementENS_9SVGLengthEXadL_ZNS_8SVGNames16ellipseTagStringEEEXadL_ZNS3_12ryA
+__ZN7WebCoreL36createSVGForeignObjectElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore25JSSVGForeignObjectElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore25JSSVGForeignObjectElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23SVGForeignObjectElementEEE
+__ZN7WebCore25JSSVGForeignObjectElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23SVGForeignObjectElementEEE
+__ZN7WebCore25JSSVGForeignObjectElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore34JSSVGForeignObjectElementPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore25JSSVGForeignObjectElement9classInfoEv
+__ZN7WebCore25JSSVGForeignObjectElementD1Ev
+__ZN7WebCore34JSSVGForeignObjectElementPrototypeD1Ev
+__ZN7WebCore31jsSVGForeignObjectElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19synchronizePropertyINS_23SVGForeignObjectElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCore30jsSVGForeignObjectElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26jsSVGForeignObjectElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_23SVGForeignObjectElementENS_9SVGLengthEXadL_ZNS_8SVGNames22foreignObjectTagStringEEEXad
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_23SVGForeignObjectElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames22foreignObjectTagS
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_23SVGForeignObjectElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames22foreignObjectTag
+__ZNK7WebCore19SVGAnimatedPropertyINS_23SVGForeignObjectElementENS_9SVGLengthEXadL_ZNS_8SVGNames22foreignObjectTagStringEEEXadL
+__ZN7WebCore26jsSVGForeignObjectElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19synchronizePropertyINS_15SVGImageElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
+__ZNK7WebCore19SVGAnimatedPropertyINS_15SVGImageElementENS_22SVGPreserveAspectRatioEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_Z
+__ZN7WebCore24JSSVGPreserveAspectRatio3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore32setJSSVGPreserveAspectRatioAlignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore22SVGPreserveAspectRatio8setAlignEt
+__ZNK7WebCore19SVGAnimatedPropertyINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_15widthAtt
+__ZN7WebCore18jsSVGImageElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_11xAttrSt
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_15SVGImageElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_15SVGImageElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZN
+__ZN7WebCore18jsSVGImageElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_15SVGImageElementENS_9SVGLengthEXadL_ZNS_8SVGNames14imageTagStringEEEXadL_ZNS3_11yAttrSt
+__ZN7WebCore18jsSVGLineElementX1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGLineElementENS_9SVGLengthEXadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12x1AttrStr
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_14SVGLineElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_14SVGLineElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3
+__ZN7WebCore18jsSVGLineElementX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGLineElementENS_9SVGLengthEXadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12x2AttrStr
+__ZN7WebCore18jsSVGLineElementY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGLineElementENS_9SVGLengthEXadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12y1AttrStr
+__ZN7WebCore18jsSVGLineElementY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGLineElementENS_9SVGLengthEXadL_ZNS_8SVGNames13lineTagStringEEEXadL_ZNS3_12y2AttrStr
+__ZN7WebCore15setJSSVGMatrixEEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore18jsSVGTransformTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19jsSVGTransformAngleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore37jsSVGGradientElementGradientTransformEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_18SVGGradientElementENS_16SVGTransformListEXadL_ZNS_28SVGGradientElementIdentifierEEEXad
+__ZN7WebCore33jsSVGGradientElementGradientUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_18SVGGradientElementEiXadL_ZNS_28SVGGradientElementIdentifierEEEXadL_ZNS_8SVGNames23grad
+__ZN7WebCore28jsSVGLinearGradientElementX2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGLinearGradientElementY1EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_24SVGLinearGradientElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames23linearGradientTa
+__ZN7WebCore28jsSVGLinearGradientElementY2EPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore19SVGAnimatedTemplateINS_9SVGLengthEED2Ev
+__ZN7WebCore30jsSVGMarkerElementMarkerHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementENS_9SVGLengthEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_22marke
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_16SVGMarkerElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames15markerTagStringEEEXadL_
+__ZN7WebCore29jsSVGMarkerElementMarkerUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementEiXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS2_21markerUnitsAttrStr
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_16SVGMarkerElementES1_iiXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS2_21markerUni
+__ZN7WebCore29jsSVGMarkerElementMarkerWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementENS_9SVGLengthEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_21marke
+__ZN7WebCore28jsSVGMarkerElementOrientTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementEiXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS_27SVGOrientTypeAttrId
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_16SVGMarkerElementES1_iiXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS_27SVGOrientT
+__ZN7WebCore29jsSVGMarkerElementOrientAngleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementENS_8SVGAngleEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS_28SVGOrie
+__ZNK3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_8SVGAngleEEENS1_29SVGAnimatedTypeWrapper
+__ZN3WTF7HashMapIN7WebCore25SVGAnimatedTypeWrapperKeyEPNS1_19SVGAnimatedTemplateIPNS1_8SVGAngleEEENS1_29SVGAnimatedTypeWrapperK
+__ZN3WTF9HashTableIN7WebCore25SVGAnimatedTypeWrapperKeyESt4pairIS2_PNS1_19SVGAnimatedTemplateIPNS1_8SVGAngleEEEENS_18PairFirstE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19SVGAnimatedTemplateIPNS_8SVGAngleEEEPNS_10SVGElementE
+__ZN7WebCore18JSSVGAnimatedAngle15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore18JSSVGAnimatedAngleC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_8SVGAngleEEEEEPNS_10SV
+__ZN7WebCore18JSSVGAnimatedAngleC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19SVGAnimatedTemplateIPNS_8SVGAngleEEEEEPNS_10SV
+__ZN7WebCore18JSSVGAnimatedAngle18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25jsSVGAnimatedAngleBaseValEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15jsSVGAngleValueEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18setJSSVGAngleValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore8SVGAngle8setValueEf
+__ZN7WebCore18JSSVGAnimatedAngleD1Ev
+__ZN7WebCore18JSSVGAnimatedAngleD2Ev
+__ZN7WebCore27JSSVGAnimatedAnglePrototypeD1Ev
+__ZN7WebCore22jsSVGMarkerElementRefXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementENS_9SVGLengthEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_14refXA
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_16SVGMarkerElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames15markerTagStringEEEXadL_Z
+__ZN7WebCore22jsSVGMarkerElementRefYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_16SVGMarkerElementENS_9SVGLengthEXadL_ZNS_8SVGNames15markerTagStringEEEXadL_ZNS3_14refYA
+__ZN7WebCore51jsSVGMarkerElementPrototypeFunctionSetOrientToAngleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore10toSVGAngleEN3JSC7JSValueE
+__ZNK7WebCore10JSSVGAngle9classInfoEv
+__ZN7WebCore16SVGMarkerElement16setOrientToAngleEN3WTF10PassRefPtrINS_8SVGAngleEEE
+__ZN7WebCore50jsSVGMarkerElementPrototypeFunctionSetOrientToAutoEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore16SVGMarkerElement15setOrientToAutoEv
+__ZN7WebCore22jsSVGMaskElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGMaskElementENS_9SVGLengthEXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_16heightAtt
+__ZN7WebCore32jsSVGMaskElementMaskContentUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGMaskElementEiXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS2_26maskContentUnitsAttrSt
+__ZN7WebCore25jsSVGMaskElementMaskUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGMaskElementEiXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS2_19maskUnitsAttrStringEEE
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_14SVGMaskElementES1_iiXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS2_19maskUnitsAttr
+__ZN7WebCore21jsSVGMaskElementWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGMaskElementENS_9SVGLengthEXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_15widthAttr
+__ZN7WebCore17jsSVGMaskElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGMaskElementENS_9SVGLengthEXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_11xAttrStri
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_14SVGMaskElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_14SVGMaskElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3
+__ZN7WebCore17jsSVGMaskElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_14SVGMaskElementENS_9SVGLengthEXadL_ZNS_8SVGNames13maskTagStringEEEXadL_ZNS3_11yAttrStri
+__ZN7WebCore25jsSVGPatternElementHeightEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_16hei
+__ZNK7WebCore26SVGAnimatedPropertyTearOffINS_17SVGPatternElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames16patternTagStringEEEXad
+__ZN7WebCore38jsSVGPatternElementPatternContentUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementEiXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS2_29patternContentUn
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_17SVGPatternElementES1_iiXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS2_29pattern
+__ZN7WebCore35jsSVGPatternElementPatternTransformEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementENS_16SVGTransformListEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZN
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_17SVGPatternElementES1_NS_16SVGTransformListEPS2_XadL_ZNS_8SVGNames16patternTagStri
+__ZN7WebCore31jsSVGPatternElementPatternUnitsEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementEiXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS2_22patternUnitsAttr
+__ZNK7WebCore19SVGAnimatedPropertyINS_17SVGPatternElementEiXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS2_22patternUnitsAttrS
+__ZN7WebCore20jsSVGPatternElementXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_11xAt
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_17SVGPatternElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames16patternTagStringEEEXadL
+__ZN7WebCore20jsSVGPatternElementYEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_17SVGPatternElementENS_9SVGLengthEXadL_ZNS_8SVGNames16patternTagStringEEEXadL_ZNS3_11yAt
+__ZN7WebCoreL37createSVGRadialGradientElementWrapperEPN3JSC9ExecStateEN3WTF10PassRefPtrINS_10SVGElementEEE
+__ZN7WebCore26JSSVGRadialGradientElement15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore26JSSVGRadialGradientElementC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24SVGRadialGradientElementEEE
+__ZN7WebCore26JSSVGRadialGradientElementC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_24SVGRadialGradientElementEEE
+__ZN7WebCore26JSSVGRadialGradientElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore26JSSVGRadialGradientElement9classInfoEv
+__ZN7WebCore26JSSVGRadialGradientElementD1Ev
+__ZN7WebCore35JSSVGRadialGradientElementPrototypeD1Ev
+__ZN7WebCore28jsSVGRadialGradientElementCxEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore21lookupOrCreateWrapperINS_24SVGRadialGradientElementENS_9SVGLengthEXadL_ZNS_8SVGNames23radialGradientTagStringEEEX
+__ZN7WebCore19synchronizePropertyINS_24SVGRadialGradientElementENS_9SVGLengthEEEvPKT_RKNS_13QualifiedNameET0_
+__ZN7WebCore28jsSVGRadialGradientElementCyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGRadialGradientElementFxEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore28jsSVGRadialGradientElementFyEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGRadialGradientElementREPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore26SVGAnimatedPropertyTearOffINS_24SVGRadialGradientElementES1_NS_9SVGLengthES2_XadL_ZNS_8SVGNames23radialGradientTa
+__ZN7WebCore50jsSVGLengthPrototypeFunctionNewValueSpecifiedUnitsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore9SVGLength22newValueSpecifiedUnitsEtf
+__ZNK7WebCore24RenderSVGHiddenContainer20isSVGHiddenContainerEv
+__ZNK7WebCore4Font32selectionRectForTextUsingSVGFontERKNS_7TextRunERKNS_8IntPointEiii
+__ZNK7WebCore16SVGCursorElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZNK7WebCore16SVGScriptElement14isURLAttributeEPNS_9AttributeE
+__ZN7WebCore8CSSValue23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEEPKNS_13CSSStyleSheetE
+__ZN7WebCore25jsHTMLAreaElementHostnameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN3WTF6VectorIN7WebCore6LengthELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIlLm16EE14expandCapacityEm
+__ZN3WTF6VectorIlLm16EE15reserveCapacityEm
+__ZN3WTF6VectorIPN7WebCore17SubresourceLoaderELm256EE14expandCapacityEmPKS3_
+__ZN3WTF6VectorIPN7WebCore17SubresourceLoaderELm256EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore17SubresourceLoaderELm256EE15reserveCapacityEm
+__ZN7WebCore14RenderTableCol12imageChangedEPvPKNS_7IntRectE
+__ZN7WebCore18RenderTableSection12imageChangedEPvPKNS_7IntRectE
+__ZN7WebCore48jsWebKitCSSMatrixPrototypeFunctionSetMatrixValueEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore42jsWebKitCSSMatrixPrototypeFunctionMultiplyEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore17toWebKitCSSMatrixEN3JSC7JSValueE
+__ZNK7WebCore15WebKitCSSMatrix8multiplyEPS0_
+__ZN7WebCore15WebKitCSSMatrixC1ERKNS_20TransformationMatrixE
+__ZN7WebCore15WebKitCSSMatrixC2ERKNS_20TransformationMatrixE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_15WebKitCSSMatrixE
+__ZN7WebCore41jsWebKitCSSMatrixPrototypeFunctionInverseEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15WebKitCSSMatrix7inverseERi
+__ZN7WebCore43jsWebKitCSSMatrixPrototypeFunctionTranslateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15WebKitCSSMatrix9translateEddd
+__ZN7WebCore39jsWebKitCSSMatrixPrototypeFunctionScaleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15WebKitCSSMatrix5scaleEddd
+__ZN7WebCore40jsWebKitCSSMatrixPrototypeFunctionRotateEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore15WebKitCSSMatrix6rotateEddd
+__ZN7WebCore14JSCSSValueList18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZNK7WebCore23WebKitCSSTransformValue25isWebKitCSSTransformValueEv
+__ZN7WebCore25JSWebKitCSSTransformValueC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23WebKitCSSTransformValueEEE
+__ZN7WebCore25JSWebKitCSSTransformValueC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_23WebKitCSSTransformValueEEE
+__ZNK7WebCore25JSWebKitCSSTransformValue9classInfoEv
+__ZN7WebCore25JSWebKitCSSTransformValue18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore34JSWebKitCSSTransformValuePrototype9classInfoEv
+__ZN7WebCore36jsWebKitCSSTransformValueConstructorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore38jsWebKitCSSTransformValueOperationTypeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25JSWebKitCSSTransformValueD1Ev
+__ZNK7WebCore24ShorthandPropertyWrapper6equalsEPKNS_11RenderStyleES3_
+__ZNK7WebCore24ShorthandPropertyWrapper5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS4_S7_d
+__ZN7WebCore11RenderStyle22setBackgroundXPositionENS_6LengthE
+__ZN7WebCore11RenderStyle22setBackgroundYPositionENS_6LengthE
+__ZNK7WebCore15PropertyWrapperINS_10LengthSizeEE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS6_S9_d
+__ZN7WebCore11RenderStyle17setBackgroundSizeENS_10LengthSizeE
+__ZN7WebCore19AnimationController21pauseTransitionAtTimeEPNS_12RenderObjectERKNS_6StringEd
+__ZN7WebCore26AnimationControllerPrivate21pauseTransitionAtTimeEPNS_12RenderObjectERKNS_6StringEd
+__ZN7WebCore18CompositeAnimation21pauseTransitionAtTimeEid
+__ZN7WebCore4Node29dispatchWebKitTransitionEventERKNS_12AtomicStringERKNS_6StringEd
+__ZN7WebCore21WebKitTransitionEventC1ERKNS_12AtomicStringERKNS_6StringEd
+__ZN7WebCore21WebKitTransitionEventC2ERKNS_12AtomicStringERKNS_6StringEd
+__ZN7WebCore11RenderStyle16setMaskXPositionENS_6LengthE
+__ZN7WebCore11RenderStyle16setMaskYPositionENS_6LengthE
+__ZN7WebCore11RenderStyle11setMaskSizeENS_10LengthSizeE
+__ZNK7WebCore21PropertyWrapperShadow5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS4_S7_d
+__ZNK7WebCore15PropertyWrapperItE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS5_S8_d
+__ZN7WebCore11RenderStyle17setBorderTopWidthEt
+__ZN7WebCore11RenderStyle19setBorderRightWidthEt
+__ZN7WebCore11RenderStyle20setBorderBottomWidthEt
+__ZN7WebCore11RenderStyle18setBorderLeftWidthEt
+__ZN7WebCore11RenderStyle19setTransformOriginXENS_6LengthE
+__ZN7WebCore11RenderStyle19setTransformOriginYENS_6LengthE
+__ZN7WebCore11RenderStyle12setMarginTopENS_6LengthE
+__ZN7WebCore11RenderStyle14setMarginRightENS_6LengthE
+__ZN7WebCore11RenderStyle15setMarginBottomENS_6LengthE
+__ZN7WebCore11RenderStyle13setMarginLeftENS_6LengthE
+__ZNK7WebCore15PropertyWrapperIRKNS_7IntSizeEE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS8_SB_d
+__ZN7WebCore11RenderStyle23setBorderTopRightRadiusERKNS_7IntSizeE
+__ZN7WebCore11RenderStyle22setBorderTopLeftRadiusERKNS_7IntSizeE
+__ZN7WebCore11RenderStyle25setBorderBottomLeftRadiusERKNS_7IntSizeE
+__ZN7WebCore11RenderStyle26setBorderBottomRightRadiusERKNS_7IntSizeE
+__ZN7WebCore11RenderStyle15setOutlineColorERKNS_5ColorE
+__ZNK7WebCore15PropertyWrapperIiE5blendEPKNS_13AnimationBaseEPNS_11RenderStyleEPKS5_S8_d
+__ZN7WebCore11RenderStyle16setOutlineOffsetEi
+__ZN7WebCore11RenderStyle15setOutlineWidthEt
+__ZN7WebCore11RenderStyle13setPaddingTopENS_6LengthE
+__ZN7WebCore11RenderStyle15setPaddingRightENS_6LengthE
+__ZN7WebCore11RenderStyle16setPaddingBottomENS_6LengthE
+__ZN7WebCore11RenderStyle14setPaddingLeftENS_6LengthE
+__ZN7WebCore35setJSDOMWindowOnwebkittransitionendEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore9DOMWindow24setOnwebkittransitionendEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore27jsNodeIteratorReferenceNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore40jsNodeIteratorPointerBeforeReferenceNodeEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore15HTMLBodyElement25didMoveToNewOwnerDocumentEv
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore16LegacyWebArchiveEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore16LegacyWebArchiveEEELm0EE15reserveCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore7ArchiveEEELm0EE14expandCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore7ArchiveEEELm0EE15reserveCapacityEm
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore16LegacyWebArchiveEEELm0EE6shrinkEm
+__ZN7WebCore16LegacyWebArchive6createEPNS_5FrameE
+__ZNK7WebCore14DocumentLoader15getSubresourcesERN3WTF6VectorINS1_10PassRefPtrINS_15ArchiveResourceEEELm0EEE
+__ZNK7WebCore14DocumentLoader12mainResourceEv
+__ZN3WTF6VectorINS_10PassRefPtrIN7WebCore16LegacyWebArchiveEEELm0EE14expandCapacityEmPKS4_
+__ZN7WebCore13CSSImportRule23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore15CSSFontFaceRule23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore19CSSFontFaceSrcValue23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEEPKNS_13CSSStyleSheetE
+__ZN7WebCore19CSSBorderImageValue23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEEPKNS_13CSSStyleSheetE
+__ZN7WebCore15CSSReflectValue23addSubresourceStyleURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEEPKNS_13CSSStyleSheetE
+__ZNK7WebCore20HTMLFrameElementBase14isURLAttributeEPNS_9AttributeE
+__ZNK7WebCore17HTMLObjectElement27addSubresourceAttributeURLsERN3WTF11ListHashSetINS_4KURLENS_8KURLHashEEE
+__ZN7WebCore14ArchiveFactory6createEPNS_12SharedBufferERKNS_6StringE
+__ZNK3WTF7HashMapIN7WebCore6StringEPFNS_10PassRefPtrINS1_7ArchiveEEEPNS1_12SharedBufferEENS1_15CaseFoldingHashENS_10HashTraitsI
+__ZN7WebCoreL20archiveFactoryCreateINS_16LegacyWebArchiveEEEN3WTF10PassRefPtrINS_7ArchiveEEEPNS_12SharedBufferE
+__ZN7WebCore14DocumentLoader20setParsedArchiveDataEN3WTF10PassRefPtrINS_12SharedBufferEEE
+-[DOMElement(WebPrivate) isFocused]
+__ZN7WebCore11RenderStyle13setCursorListEN3WTF10PassRefPtrINS_10CursorListEEE
+__ZNK7WebCore9Tokenizer15isHTMLTokenizerEv
+__ZN7WebCore11HistoryItem12setViewStateEP11objc_object
+__ZN7WebCore9InlineBox16placeEllipsisBoxEbiiiRb
+__ZN7WebCore9InlineBox15clearTruncationEv
+__ZN7WebCoreL9stateBoldEPNS_5FrameEPNS_5EventE
+__ZN7WebCoreL11stateItalicEPNS_5FrameEPNS_5EventE
+__ZN7WebCoreL18stateStrikethroughEPNS_5FrameEPNS_5EventE
+__ZNK7WebCore21ProcessingInstruction18maxCharacterOffsetEv
+__ZN7WebCore15setJSNodeOndragEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore4Node9setOndragEN3WTF10PassRefPtrINS_13EventListenerEEE
+__ZN7WebCore39setJSHTMLOptionsCollectionSelectedIndexEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore21HTMLOptionsCollection16setSelectedIndexEi
+__ZN7WebCore35jsCanvasRenderingContext2DLineWidthEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore36jsCanvasRenderingContext2DMiterLimitEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore39setJSCanvasRenderingContext2DMiterLimitEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore24CanvasRenderingContext2D13setMiterLimitEf
+__ZN7WebCore14jsNodeOnscrollEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node8onscrollEv
+__ZN7WebCore19JSSVGAnimatedString18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore25jsSVGDefsElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore29jsSVGGradientElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore25jsSVGStopElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore22jsSVGGElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore27jsSVGCircleElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore27RenderTextControlSingleLine9scrollTopEv
+__ZN7WebCore32jsCanvasRenderingContext2DCanvasEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore18LocalStorageThread14scheduleImportEN3WTF10PassRefPtrINS_16LocalStorageAreaEEE
+__ZN7WebCore16LocalStorageTaskC1ENS0_4TypeEN3WTF10PassRefPtrINS_16LocalStorageAreaEEE
+__ZN7WebCore16LocalStorageTaskC2ENS0_4TypeEN3WTF10PassRefPtrINS_16LocalStorageAreaEEE
+__ZN7WebCore16LocalStorageArea13performImportEv
+__ZN7WebCore12LocalStorage20fullDatabaseFilenameEPNS_14SecurityOriginE
+__ZN7WebCore10HTMLParser15popInlineBlocksEv
+__ZN7WebCore26NetscapePlugInStreamLoader7didFailERKNS_13ResourceErrorE
+__ZN7WebCore18LocalStorageThread12scheduleSyncEN3WTF10PassRefPtrINS_16LocalStorageAreaEEE
+__ZN7WebCore16LocalStorageArea11performSyncEv
+__ZN7WebCore16LocalStorageArea4syncEbRKN3WTF7HashMapINS_6StringES3_NS_10StringHashENS1_10HashTraitsIS3_EES6_EE
+__ZN7WebCore12IconDatabase27checkIntegrityBeforeOpeningEv
+__ZN7WebCore12IconDatabase14checkIntegrityEv
+__ZNK7WebCore32HTMLFileUploadInnerButtonElement12isShadowNodeEv
+__ZN7WebCore32HTMLFileUploadInnerButtonElement16shadowParentNodeEv
+__ZN7WebCore16JSSVGLineElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZN7WebCore21jsSVGLineElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14ResourceHandle12releaseProxyEv
+__ZNK7WebCore14ResourceHandle10connectionEv
+__ZN7WebCore31jsConsolePrototypeFunctionDebugEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console5debugEPNS_15ScriptCallStackE
+__ZNK7WebCore11RenderBlock20adjustRectForColumnsERNS_7IntRectE
+__ZN7WebCore13jsNodeOnerrorEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node7onerrorEv
+__ZNK7WebCore13ChildNodeList11nodeMatchesEPNS_7ElementE
+__ZN7WebCore29setJSHTMLStyleElementDisabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLStyleElement11setDisabledEb
+__ZN7WebCore4Node11appendChildEN3WTF10PassRefPtrIS0_EERib
+__ZN7WebCore27setJSHTMLImageElementHspaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement9setHspaceEi
+__ZN7WebCore27setJSHTMLImageElementVspaceEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore16HTMLImageElement9setVspaceEi
+__ZN7WebCore14ResourceLoader13cannotShowURLEPNS_14ResourceHandleE
+__ZN7WebCore14ResourceLoader18cannotShowURLErrorEv
+__ZN3WTF6VectorItLm16EE14expandCapacityEmPKt
+__ZN3WTF6VectorItLm16EE14expandCapacityEm
+__ZN3WTF6VectorItLm16EE15reserveCapacityEm
+__ZN7WebCore31SearchFieldResultsButtonElement19defaultEventHandlerEPNS_5EventE
+__ZN7WebCore11RenderStyle8setColorERKNS_5ColorE
+__ZN7WebCore18jsSVGGElementStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore16JSSVGPathElement3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZNK7WebCore19JSSVGAnimatedString9classInfoEv
+__ZN7WebCore25jsSVGPathElementClassNameEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore11HistoryItem20setTransientPropertyERKNS_6StringEP11objc_object
+__ZN3WTF7HashMapIN7WebCore6StringENS_9RetainPtrIP11objc_objectEENS1_10StringHashENS_10HashTraitsIS2_EENS8_IS6_EEE3setERKS2_RKS6
+__ZN3WTF9HashTableIN7WebCore6StringESt4pairIS2_NS_9RetainPtrIP11objc_objectEEENS_18PairFirstExtractorIS8_EENS1_10StringHashENS_
+__ZNK3WTF7HashMapIN7WebCore6StringENS_9RetainPtrIP11objc_objectEENS1_10StringHashENS_10HashTraitsIS2_EENS8_IS6_EEE3getERKS2_
+__ZN7WebCore5TimerINS_12RenderButtonEE5firedEv
+__ZN7WebCore12RenderButton10timerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore5TimerINS_12RenderButtonEED0Ev
+__ZN7WebCore11RenderStyle9setBottomENS_6LengthE
+__ZN7WebCore23jsHTMLAnchorElementPortEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore17HTMLAnchorElement4portEv
+__ZN7WebCore16LocalStorageArea17scheduleFinalSyncEv
+__ZN7WebCore10moveCursorEv
+__ZN7WebCore19jsWheelEventOffsetXEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore12EventHandler17eventMayStartDragERKNS_18PlatformMouseEventE
+__ZN7WebCore12zoomInCursorEv
+__ZN7WebCore18ImageEventListener11handleEventEPNS_5EventEb
+__ZN7WebCore13ImageDocument12imageClickedEii
+__ZN7WebCore13ImageDocument16restoreImageSizeEv
+__ZN7WebCore13zoomOutCursorEv
+-[WebCoreMenuTarget validateMenuItem:]
+__ZN7WebCore15ContextMenuItemC1EP10NSMenuItem
+__ZN7WebCore15ContextMenuItemC2EP10NSMenuItem
+__ZNK7WebCore15ContextMenuItem7enabledEv
+__ZThn8_N7WebCore20ImageDocumentElementD0Ev
+__ZThn32_N7WebCore8DOMTimer6resumeEv
+__ZN7WebCore16HTMLInputElement23documentDidBecomeActiveEv
+__ZN7WebCore5Frame24searchForLabelsAboveCellEPNS_17RegularExpressionEPNS_20HTMLTableCellElementE
+__ZN7WebCore15BackForwardList17backListWithLimitEiRN3WTF6VectorINS1_6RefPtrINS_11HistoryItemEEELm0EEE
+__ZN3WTF6VectorINS_6RefPtrIN7WebCore11HistoryItemEEELm0EE14expandCapacityEmPKS4_
+__ZN7WebCore11HistoryItem10targetItemEv
+__ZN7WebCore11HistoryItem14findTargetItemEv
+__ZN7WebCore27RenderTextControlSingleLine6scrollENS_15ScrollDirectionENS_17ScrollGranularityEf
+__ZN7WebCore11EllipsisBox11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiii
+__ZN7WebCoreL15executeMoveDownEPNS_5FrameEPNS_5EventENS_19EditorCommandSourceERKNS_6StringE
+__ZN7WebCore25jsHTMLAreaElementProtocolEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore14RenderMenuList9showPopupEv
+__ZN7WebCore9PopupMenuC1EPNS_15PopupMenuClientE
+__ZN7WebCore9PopupMenuC2EPNS_15PopupMenuClientE
+__ZN7WebCore9PopupMenu4showERKNS_7IntRectEPNS_9FrameViewEi
+__ZN7WebCore9PopupMenu8populateEv
+__ZThn200_NK7WebCore14RenderMenuList13shouldPopOverEv
+__ZNK7WebCore14RenderMenuList13shouldPopOverEv
+__ZThn200_NK7WebCore14RenderMenuList8listSizeEv
+__ZNK7WebCore14RenderMenuList8listSizeEv
+__ZThn200_NK7WebCore14RenderMenuList15itemIsSeparatorEj
+__ZNK7WebCore14RenderMenuList15itemIsSeparatorEj
+__ZThn200_NK7WebCore14RenderMenuList9itemStyleEj
+__ZNK7WebCore14RenderMenuList9itemStyleEj
+__ZNK7WebCore14RenderMenuList19itemBackgroundColorEj
+__ZNK7WebCore5Color5blendERKS0_
+__ZThn200_NK7WebCore14RenderMenuList8itemTextEj
+__ZNK7WebCore14RenderMenuList8itemTextEj
+__ZThn200_NK7WebCore14RenderMenuList13itemIsEnabledEj
+__ZNK7WebCore14RenderMenuList13itemIsEnabledEj
+__ZThn200_NK7WebCore14RenderMenuList9menuStyleEv
+__ZNK7WebCore14RenderMenuList9menuStyleEv
+__ZThn200_N7WebCore14RenderMenuList9hidePopupEv
+__ZN7WebCore14RenderMenuList9hidePopupEv
+__ZN7WebCore9PopupMenu4hideEv
+__ZN7WebCore12EventHandler33sendFakeEventsAfterWidgetTrackingEP7NSEvent
+__ZN7WebCore9PopupMenuD1Ev
+__ZN7WebCore9PopupMenuD2Ev
+__ZN7WebCore10waitCursorEv
+__ZN7WebCore14ScrollbarTheme26shouldSnapBackToDragOriginEPNS_9ScrollbarERKNS_18PlatformMouseEventE
+__ZN7WebCore9Scrollbar9moveThumbEi
+__ZThn200_N7WebCore14RenderMenuList12valueChangedEjb
+__ZN7WebCore14RenderMenuList12valueChangedEjb
+__ZN7WebCore9PopupMenu5clearEv
+-[DOMHTMLInputElement(FormAutoFillTransition) _rectOnScreen]
+__ZN7WebCore11RenderImage20intrinsicSizeChangedEv
+__ZNK7WebCore27RenderTextControlSingleLine12scrollHeightEv
+__ZNK7WebCore17HTMLSelectElement19isKeyboardFocusableEPNS_13KeyboardEventE
+__ZN7WebCore31jsHTMLInputElementIndeterminateEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore23jsHTMLInputElementFilesEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_8FileListE
+__ZN7WebCore12jsNodeOndragEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node6ondragEv
+__ZN7WebCore16HTMLInputElement18setActivatedSubmitEb
+__ZN7WebCore23SubresourceLoaderClient11didSendDataEPNS_17SubresourceLoaderEyy
+-[DOMHTMLInputElement(FormAutoFillTransition) _selectedRange]
+-[DOMHTMLInputElement(FormAutoFillTransition) _replaceCharactersInRange:withString:selectingFromIndex:]
+__ZNK7WebCore16VisibleSelection5isAllENS_21StayInEditableContentE
+__ZNK7WebCore12RenderObject24shouldPaintSelectionGapsEv
+__ZN7WebCore11FrameLoader16canHandleRequestERKNS_15ResourceRequestE
+__ZN7WebCore14scaleDragImageEN3WTF9RetainPtrI7NSImageEENS_9FloatSizeE
+-[WebCoreMenuTarget forwardContextMenuAction:]
+__ZN7WebCore21ContextMenuController23contextMenuItemSelectedEPNS_15ContextMenuItemE
+__ZN7WebCore6Editor7copyURLERKNS_4KURLERKNS_6StringE
+__ZN7WebCore10Pasteboard8writeURLERKNS_4KURLERKNS_6StringEPNS_5FrameE
+__ZN7WebCore13JSPluginArray16getPropertyNamesEPN3JSC9ExecStateERNS1_17PropertyNameArrayE
+__ZN7WebCore5Cache13getStatisticsEv
+__ZN7WebCore5Cache13TypeStatistic11addResourceEPNS_14CachedResourceE
+__ZNK7WebCore14CachedResource11isPurgeableEv
+__ZN7WebCore12IconDatabase19pageURLMappingCountEv
+__ZN7WebCore12IconDatabase20retainedPageURLCountEv
+__ZN7WebCore12IconDatabase15iconRecordCountEv
+__ZN7WebCore12IconDatabase23iconRecordCountWithDataEv
+__ZN7WebCore9FontCache13fontDataCountEv
+__ZN7WebCore9FontCache21inactiveFontDataCountEv
+__ZN7WebCore17GlyphPageTreeNode18treeGlyphPageCountEv
+__ZNK7WebCore17GlyphPageTreeNode9pageCountEv
+__ZN7WebCore13jsNodeOnabortEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore4Node7onabortEv
+__ZN7WebCore34jsConsolePrototypeFunctionGroupEndEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console8groupEndEv
+__ZN7WebCore19InspectorController8endGroupENS_13MessageSourceEjRKNS_6StringE
+__ZN7WebCore15StringTruncator13rightTruncateERKNS_6StringEfRKNS_4FontEb
+__ZN7WebCore17ScrollbarThemeMac14backButtonRectEPNS_9ScrollbarENS_13ScrollbarPartEb
+__ZN7WebCoreL17buttonRepaintRectERKNS_7IntRectENS_20ScrollbarOrientationENS_20ScrollbarControlSizeEb
+__ZN7WebCore9FrameView29forceLayoutWithPageWidthRangeEffb
+__ZN7WebCore9FrameView16adjustPageHeightEPffff
+__ZN7WebCore18correctedTextColorENS_5ColorES0_
+__ZN7WebCore15GraphicsContext21focusRingBoundingRectEv
+__ZN7WebCore12RenderObject13addPDFURLRectEPNS_15GraphicsContextERKNS_7IntRectE
+__ZN7WebCore15GraphicsContext13setURLForRectERKNS_4KURLERKNS_7IntRectE
+-[DOMHTMLInputElement readOnly]
+__ZN7WebCore8Document23renderedRectsForMarkersENS_14DocumentMarker10MarkerTypeE
+__ZNK7WebCore5Frame18selectionTextRectsERN3WTF6VectorINS_9FloatRectELm0EEEb
+__ZN3WTF6VectorIN7WebCore9FloatRectELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore9FloatRectELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore9FloatRectELm0EE15reserveCapacityEm
+__ZNK7WebCore9FrameTree24traversePreviousWithWrapEb
+__ZNK7WebCore9FrameTree13deepLastChildEv
+__ZNK7WebCore5Frame12selectedTextEv
+__ZN7WebCore14RenderReplaced20intrinsicSizeChangedEv
+__ZN7WebCore11FrameLoader26reloadWithOverrideEncodingERKNS_6StringE
+__ZN7WebCore15BackForwardList12containsItemEPNS_11HistoryItemE
+__ZNK3WTF9HashTableINS_6RefPtrIN7WebCore11HistoryItemEEES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashTraitsIS4_EESA
+_WebCoreSetAlwaysUsesComplexTextCodePath
+__ZN7WebCore4Font11setCodePathENS0_8CodePathE
+__ZN7WebCore20NetworkStateNotifier20dynamicStoreCallbackEPK16__SCDynamicStorePK9__CFArrayPv
+__ZN7WebCore5TimerINS_20NetworkStateNotifierEE5firedEv
+__ZN7WebCore20NetworkStateNotifier28networkStateChangeTimerFiredEPNS_5TimerIS0_EE
+__ZN7WebCore11FrameLoader26saveDocumentAndScrollStateEv
+__ZNK7WebCore11HistoryItem4copyEv
+__ZN3WTF6VectorIiLm0EEC1ERKS1_
+__ZN3WTF6VectorIiLm0EEC2ERKS1_
+__ZN7WebCore19InspectorController4showEv
+__ZN7WebCore19InspectorController20clearConsoleMessagesEv
+__ZN3WTF6VectorIPN7WebCore14ConsoleMessageELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorINS_6RefPtrIN3JSC7ProfileEEELm0EE14shrinkCapacityEm
+__ZN3WTF9HashTableINS_6RefPtrIN7WebCore25InspectorDatabaseResourceEEES4_NS_17IdentityExtractorIS4_EENS_7PtrHashIS4_EENS_10HashT
+__ZN7WebCore19InspectorController27windowScriptObjectAvailableEv
+__ZN7WebCore19scriptStateFromPageEPNS_4PageE
+__ZN7WebCore18ScriptGlobalObject3setEPN3JSC9ExecStateEPKcPNS_19InspectorControllerE
+__ZN7WebCore4toJSEPN3JSC9ExecStateEPNS_19InspectorControllerE
+__ZN7WebCore21JSInspectorController15createPrototypeEPN3JSC9ExecStateEPNS1_14JSGlobalObjectE
+__ZN7WebCore21JSInspectorControllerC1EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19InspectorControllerEEE
+__ZN7WebCore21JSInspectorControllerC2EN3WTF10PassRefPtrIN3JSC9StructureEEENS2_INS_19InspectorControllerEEE
+__ZN7WebCoreL15handleExceptionEPN3JSC9ExecStateE
+__ZN7WebCore21JSInspectorController18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore30JSInspectorControllerPrototype18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZN7WebCore57jsInspectorControllerPrototypeFunctionLocalizedStringsURLEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZNK7WebCore21JSInspectorController9classInfoEv
+__ZN7WebCore19InspectorController19localizedStringsURLEv
+__ZN7WebCore46jsInspectorControllerPrototypeFunctionPlatformEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore19InspectorController8platformEv
+__ZN7WebCore50jsInspectorControllerPrototypeFunctionHiddenPanelsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19InspectorController12hiddenPanelsEv
+__ZN7WebCore50jsInspectorControllerPrototypeFunctionWrapCallbackEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore21JSInspectorController12wrapCallbackEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore26JSInspectorCallbackWrapper4wrapEPN3JSC9ExecStateENS1_7JSValueE
+__ZNK3WTF7HashMapIPN3JSC8JSObjectEPN7WebCore26JSInspectorCallbackWrapperENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3getE
+__ZN7WebCore26JSInspectorCallbackWrapperC1EPN3JSC9ExecStateEPNS1_8JSObjectEN3WTF10PassRefPtrINS1_9StructureEEE
+__ZN7WebCore26JSInspectorCallbackWrapperC2EPN3JSC9ExecStateEPNS1_8JSObjectEN3WTF10PassRefPtrINS1_9StructureEEE
+__ZN7WebCore26JSQuarantinedObjectWrapperC2EPN3JSC9ExecStateEPNS1_8JSObjectEN3WTF10PassRefPtrINS1_9StructureEEE
+__ZN3WTF7HashMapIPN3JSC8JSObjectEPN7WebCore26JSInspectorCallbackWrapperENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3setER
+__ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_PN7WebCore26JSInspectorCallbackWrapperEENS_18PairFirstExtractorIS8_EENS_7PtrHashI
+__ZN7WebCore58jsInspectorControllerPrototypeFunctionHideDOMNodeHighlightEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Ar
+__ZN7WebCore19InspectorController13hideHighlightEv
+__ZN7WebCore54jsInspectorControllerPrototypeFunctionSearchingForNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore53jsInspectorControllerPrototypeFunctionInspectedWindowEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore21JSInspectorController15inspectedWindowEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24JSInspectedObjectWrapper4wrapEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCoreL8wrappersEv
+__ZNK3WTF7HashMapIPN3JSC14JSGlobalObjectEPNS0_IPNS1_8JSObjectEPN7WebCore24JSInspectedObjectWrapperENS_7PtrHashIS5_EENS_10HashTr
+__ZN7WebCore24JSInspectedObjectWrapperC1EPN3JSC9ExecStateEPNS1_8JSObjectEN3WTF10PassRefPtrINS1_9StructureEEE
+__ZN7WebCore24JSInspectedObjectWrapperC2EPN3JSC9ExecStateEPNS1_8JSObjectEN3WTF10PassRefPtrINS1_9StructureEEE
+__ZN3WTF7HashMapIPN3JSC14JSGlobalObjectEPNS0_IPNS1_8JSObjectEPN7WebCore24JSInspectedObjectWrapperENS_7PtrHashIS5_EENS_10HashTra
+__ZN3WTF9HashTableIPN3JSC14JSGlobalObjectESt4pairIS3_PNS_7HashMapIPNS1_8JSObjectEPN7WebCore24JSInspectedObjectWrapperENS_7PtrHa
+__ZN3WTF7HashMapIPN3JSC8JSObjectEPN7WebCore24JSInspectedObjectWrapperENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3setERKS
+__ZN3WTF9HashTableIPN3JSC8JSObjectESt4pairIS3_PN7WebCore24JSInspectedObjectWrapperEENS_18PairFirstExtractorIS8_EENS_7PtrHashIS3
+__ZN7WebCore26JSQuarantinedObjectWrapper18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_10IdentifierERNS1_12PropertySlotE
+__ZNK7WebCore24JSInspectedObjectWrapper17allowsGetPropertyEv
+__ZNK7WebCore26JSQuarantinedObjectWrapper18unwrappedExecStateEv
+__ZNK7WebCore24JSInspectedObjectWrapper17wrapOutgoingValueEPN3JSC9ExecStateENS1_7JSValueE
+__ZNK3WTF7HashMapIPN3JSC8JSObjectEPN7WebCore24JSInspectedObjectWrapperENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS9_IS6_EEE3getERK
+__ZNK7WebCore26JSQuarantinedObjectWrapper28transferExceptionToExecStateEPN3JSC9ExecStateE
+__ZN7WebCore26JSQuarantinedObjectWrapper17cachedValueGetterEPN3JSC9ExecStateERKNS1_10IdentifierERKNS1_12PropertySlotE
+__ZN7WebCore53jsInspectorControllerPrototypeFunctionIsWindowVisibleEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore53jsInspectorControllerPrototypeFunctionDebuggerEnabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore55jsInspectorControllerPrototypeFunctionPauseOnExceptionsEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore19InspectorController17pauseOnExceptionsEv
+__ZN7WebCore53jsInspectorControllerPrototypeFunctionProfilerEnabledEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore44jsInspectorControllerPrototypeFunctionLoadedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19InspectorController17scriptObjectReadyEv
+__ZN7WebCore18ScriptGlobalObject3getEPN3JSC9ExecStateEPKcRNS_12ScriptObjectE
+__ZN7WebCore12ScriptObjectC1EPN3JSC8JSObjectE
+__ZN7WebCore12ScriptObjectC2EPN3JSC8JSObjectE
+__ZN7WebCore19InspectorController10showWindowEv
+__ZN7WebCore19InspectorController16setWindowVisibleEbb
+__ZN7WebCore19InspectorController17setAttachedWindowEb
+__ZN7WebCore18ScriptFunctionCallC1EPN3JSC9ExecStateERKNS_12ScriptObjectERKNS_6StringE
+__ZN7WebCore18ScriptFunctionCallC2EPN3JSC9ExecStateERKNS_12ScriptObjectERKNS_6StringE
+__ZN7WebCore18ScriptFunctionCall14appendArgumentEb
+__ZN7WebCore18ScriptFunctionCall4callEv
+__ZN7WebCore18ScriptFunctionCall4callERbb
+__ZN7WebCore44jsInspectorControllerPrototypeFunctionAttachEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19InspectorController12attachWindowEv
+__ZN7WebCore19InspectorController21populateScriptObjectsEv
+__ZN7WebCoreL18callSimpleFunctionEPN3JSC9ExecStateERKNS_12ScriptObjectEPKc
+__ZN7WebCore19InspectorController9showPanelENS0_13SpecialPanelsE
+__ZN7WebCore17InspectorResource18updateScriptObjectEPN3JSC9ExecStateE
+__ZN7WebCore19InspectorController18resetScriptObjectsEv
+__ZN7WebCore17InspectorResource19releaseScriptObjectEPN3JSC9ExecStateERKNS_12ScriptObjectEb
+__ZN7WebCore26JSQuarantinedObjectWrapper11getCallDataERN3JSC8CallDataE
+__ZNK7WebCore24JSInspectedObjectWrapper20allowsCallAsFunctionEv
+__ZN7WebCore26JSQuarantinedObjectWrapper4callEPN3JSC9ExecStateEPNS1_8JSObjectENS1_7JSValueERKNS1_7ArgListE
+__ZNK7WebCore24JSInspectedObjectWrapper20prepareIncomingValueEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore26JSQuarantinedObjectWrapper9asWrapperEN3JSC7JSValueE
+__ZNK7WebCore24JSInspectedObjectWrapper9classInfoEv
+__ZNK7WebCore26JSQuarantinedObjectWrapper25allowsUnwrappedAccessFromEPN3JSC9ExecStateE
+__ZN7WebCore26JSQuarantinedObjectWrapper15unwrappedObjectEv
+__ZNK7WebCore26JSInspectorCallbackWrapper9classInfoEv
+__ZN7WebCore17InspectorResource18createScriptObjectEPN3JSC9ExecStateERKNS_12ScriptObjectE
+__ZN7WebCoreL19createHeadersObjectEPN3JSC9ExecStateERKNS_13HTTPHeaderMapEb
+__ZN7WebCore12ScriptObject9createNewEPN3JSC9ExecStateE
+__ZN7WebCore12ScriptObject3setEPN3JSC9ExecStateERKNS_6StringES6_
+__ZN7WebCore18ScriptFunctionCall14appendArgumentERKNS_12ScriptObjectE
+__ZN7WebCore18ScriptFunctionCall14appendArgumentERKNS_6StringE
+__ZN7WebCore18ScriptFunctionCall14appendArgumentEx
+__ZN7WebCore18ScriptFunctionCall9constructERbb
+__ZN7WebCore12ScriptObject3setEPN3JSC9ExecStateEPKcRKNS_6StringE
+__ZN7WebCore12ScriptObject3setEPN3JSC9ExecStateEPKcx
+__ZN7WebCore12ScriptObject3setEPN3JSC9ExecStateEPKci
+__ZN7WebCore12ScriptObject3setEPN3JSC9ExecStateEPKcRKS0_
+__ZNK7WebCore17InspectorResource4typeEv
+__ZN7WebCore12ScriptObject3setEPN3JSC9ExecStateEPKcd
+__ZN7WebCore26getQuarantinedScriptObjectEPNS_9DOMWindowERNS_12ScriptObjectE
+__ZN7WebCore12ScriptObject3setEPN3JSC9ExecStateEPKcb
+__ZN7WebCore26JSQuarantinedObjectWrapper4markEv
+__ZN7WebCore24JSInspectedObjectWrapperD1Ev
+__ZN7WebCore24JSInspectedObjectWrapperD2Ev
+__ZN7WebCore26JSQuarantinedObjectWrapperD2Ev
+__ZNK7WebCore26JSQuarantinedObjectWrapper17allowsGetPropertyEv
+__ZNK7WebCore26JSInspectorCallbackWrapper20allowsCallAsFunctionEv
+__ZNK7WebCore26JSInspectorCallbackWrapper20prepareIncomingValueEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore26JSQuarantinedObjectWrapper3putEPN3JSC9ExecStateERKNS1_10IdentifierENS1_7JSValueERNS1_15PutPropertySlotE
+__ZNK7WebCore24JSInspectedObjectWrapper17allowsSetPropertyEv
+__ZN7WebCore36jsNodePrototypeFunctionHasAttributesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore26JSQuarantinedObjectWrapper18getOwnPropertySlotEPN3JSC9ExecStateEjRNS1_12PropertySlotE
+__ZN7WebCore48jsElementPrototypeFunctionScrollIntoViewIfNeededEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Element22scrollIntoViewIfNeededEb
+__ZN7WebCore11jsAttrStyleEPN3JSC9ExecStateERKNS0_10IdentifierERKNS0_12PropertySlotE
+__ZNK7WebCore26JSInspectorCallbackWrapper17wrapOutgoingValueEPN3JSC9ExecStateENS1_7JSValueE
+__ZN7WebCore26JSInspectorCallbackWrapperD1Ev
+__ZN7WebCore26JSInspectorCallbackWrapperD2Ev
+__ZN7WebCore17InspectorResource12createCachedExPNS_14DocumentLoaderEPKNS_14CachedResourceE
+__ZN7WebCore14ConsoleMessage12addToConsoleEPN3JSC9ExecStateERKNS_12ScriptObjectE
+__ZN7WebCore18ScriptFunctionCall14appendArgumentEj
+__ZN7WebCore17InspectorResource22setXMLHttpResponseTextERKNS_12ScriptStringE
+__ZN7WebCore54jsInspectorControllerPrototypeFunctionHighlightDOMNodeEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore21JSInspectorController16highlightDOMNodeEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore19InspectorController9highlightEPNS_4NodeE
+__ZNK7WebCore19InspectorController17drawNodeHighlightERNS_15GraphicsContextE
+__ZN7WebCoreL19drawHighlightForBoxERNS_15GraphicsContextERKNS_9FloatQuadES4_S4_S4_
+__ZN7WebCoreL16drawOutlinedQuadERNS_15GraphicsContextERKNS_9FloatQuadERKNS_5ColorE
+__ZN7WebCoreL10quadToPathERKNS_9FloatQuadE
+__ZN7WebCore44jsInspectorControllerPrototypeFunctionDetachEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19InspectorController12detachWindowEv
+__ZN7WebCore56jsInspectorControllerPrototypeFunctionMoveByUnrestrictedEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgL
+__ZNK7WebCore19InspectorController12moveWindowByEff
+__ZN7WebCoreL24drawOutlinedQuadWithClipERNS_15GraphicsContextERKNS_9FloatQuadES4_RKNS_5ColorE
+__ZN7WebCore62jsInspectorControllerPrototypeFunctionAddResourceSourceToFrameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0
+__ZN7WebCore21JSInspectorController24addResourceSourceToFrameEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZNK7WebCore17InspectorResource12sourceStringEv
+__ZN7WebCore19InspectorController16addSourceToFrameERKNS_6StringES3_PNS_4NodeE
+__ZN7WebCore11FrameLoader5beginEv
+__ZN7WebCore22HTMLViewSourceDocument7addLinkERKNS_6StringEb
+__ZN7WebCore19createTextTokenizerEPNS_22HTMLViewSourceDocumentE
+__ZN7WebCore13TextTokenizerC1EPNS_22HTMLViewSourceDocumentE
+__ZN7WebCore13TextTokenizerC2EPNS_22HTMLViewSourceDocumentE
+__ZN7WebCore22HTMLViewSourceDocument17addViewSourceTextERKNS_6StringE
+__ZN7WebCore52jsInspectorControllerPrototypeFunctionEnableDebuggerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19InspectorController14enableDebuggerEv
+__ZN7WebCore21JavaScriptDebugServer11addListenerEPNS_23JavaScriptDebugListenerEPNS_4PageE
+__ZN3WTF7HashMapIPN7WebCore4PageEPNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEENS7_IS3_EE
+__ZN3WTF7HashSetIPN7WebCore23JavaScriptDebugListenerENS_7PtrHashIS3_EENS_10HashTraitsIS3_EEE3addERKS3_
+__ZN3WTF9HashTableIPN7WebCore23JavaScriptDebugListenerES3_NS_17IdentityExtractorIS3_EENS_7PtrHashIS3_EENS_10HashTraitsIS3_EES9_
+__ZN7WebCore21JavaScriptDebugServer14didAddListenerEPNS_4PageE
+__ZN7WebCore4Page11setDebuggerEPN3JSC8DebuggerE
+__ZN7WebCore21JavaScriptDebugServer16clearBreakpointsEv
+__ZN3WTF20deleteAllPairSecondsIPNS_7HashSetIjNS_7IntHashIjEENS_10HashTraitsIjEEEEKNS_7HashMapIlS7_NS2_ImEENS4_IlEENS4_IS7_EEEEE
+__ZNK7WebCore25JSCanvasGradientPrototype9classInfoEv
+__ZNK7WebCore30JSInspectorControllerPrototype9classInfoEv
+__ZN3WTF7HashMapIPN3JSC14SourceProviderEPNS1_9ExecStateENS_7PtrHashIS3_EENS_10HashTraitsIS3_EENS8_IS5_EEE3addERKS3_RKS5_
+__ZN3WTF9HashTableIPN3JSC14SourceProviderESt4pairIS3_PNS1_9ExecStateEENS_18PairFirstExtractorIS7_EENS_7PtrHashIS3_EENS_14PairHa
+__ZN7WebCore21JavaScriptDebugServer12sourceParsedEPN3JSC9ExecStateERKNS1_10SourceCodeEiRKNS1_7UStringE
+__ZN7WebCoreL6toPageEPN3JSC14JSGlobalObjectE
+__ZNK3WTF7HashMapIPN7WebCore4PageEPNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS6_EENS_10HashTraitsIS6_EEEENS7_IS3_E
+__ZN7WebCoreL22dispatchDidParseSourceERKN3WTF7HashSetIPNS_23JavaScriptDebugListenerENS0_7PtrHashIS3_EENS0_10HashTraitsIS3_EEEEP
+__ZN3WTF6VectorIPN7WebCore23JavaScriptDebugListenerELm0EE14expandCapacityEm
+__ZN3WTF6VectorIPN7WebCore23JavaScriptDebugListenerELm0EE15reserveCapacityEm
+__ZN7WebCore19InspectorController14didParseSourceEPN3JSC9ExecStateERKNS1_10SourceCodeE
+__ZN7WebCore18ScriptFunctionCall14appendArgumentERKN3JSC7UStringE
+__ZN7WebCore18ScriptFunctionCall14appendArgumentEi
+__ZN7WebCore54jsInspectorControllerPrototypeFunctionAddSourceToFrameEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLis
+__ZN7WebCore21JSInspectorController16addSourceToFrameEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore32jsConsolePrototypeFunctionAssertEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore7Console15assertConditionEbPNS_15ScriptCallStackE
+__ZN3WTF6VectorIPN7WebCore23JavaScriptDebugListenerELm0EE6shrinkEm
+__ZN7WebCore21JavaScriptDebugServer9callEventERKN3JSC17DebuggerCallFrameEli
+__ZN7WebCore19JavaScriptCallFrameC1ERKN3JSC17DebuggerCallFrameEN3WTF10PassRefPtrIS0_EEli
+__ZN7WebCore19JavaScriptCallFrameC2ERKN3JSC17DebuggerCallFrameEN3WTF10PassRefPtrIS0_EEli
+__ZN7WebCore21JavaScriptDebugServer13pauseIfNeededEPNS_4PageE
+__ZNK7WebCore21JavaScriptDebugServer13hasBreakpointElj
+__ZNK3WTF7HashMapIlPNS_7HashSetIjNS_7IntHashIjEENS_10HashTraitsIjEEEENS2_ImEENS4_IlEENS4_IS7_EEE3getERKl
+__ZN7WebCore21JavaScriptDebugServer11atStatementERKN3JSC17DebuggerCallFrameEli
+__ZN7WebCore21JavaScriptDebugServer11returnEventERKN3JSC17DebuggerCallFrameEli
+__ZN7WebCore19JavaScriptCallFrame6callerEv
+__ZN3WTF10RefCountedIN7WebCore19JavaScriptCallFrameEE5derefEv
+__ZN7WebCore21JavaScriptDebugServer18willExecuteProgramERKN3JSC17DebuggerCallFrameEli
+__ZN7WebCore21JavaScriptDebugServer17didExecuteProgramERKN3JSC17DebuggerCallFrameEli
+__ZN7WebCore46jsInspectorControllerPrototypeFunctionProfilesEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore21JSInspectorController8profilesEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore52jsInspectorControllerPrototypeFunctionEnableProfilerEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZNK7WebCore32JSHTMLOptionsCollectionPrototype9classInfoEv
+__ZN7WebCore21JavaScriptDebugServer15continueProgramEv
+__ZN7WebCore21JavaScriptDebugServer9exceptionERKN3JSC17DebuggerCallFrameEli
+__ZN7WebCore52jsInspectorControllerPrototypeFunctionStartProfilingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore51jsInspectorControllerPrototypeFunctionStopProfilingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
+__ZN7WebCore19InspectorController26stopUserInitiatedProfilingEv
+__ZN7WebCore19InspectorController15disableDebuggerEv
+__ZN7WebCore21JavaScriptDebugServer14removeListenerEPNS_23JavaScriptDebugListenerEPNS_4PageE
+__ZN3WTF9HashTableIPN7WebCore4PageESt4pairIS3_PNS_7HashSetIPNS1_23JavaScriptDebugListenerENS_7PtrHashIS7_EENS_10HashTraitsIS7_E
+__ZN7WebCore21JavaScriptDebugServer17didRemoveListenerEPNS_4PageE
+__ZN7WebCore21JavaScriptDebugServer21didRemoveLastListenerEv
+__ZN7WebCore5Frame17setIsDisconnectedEb
+__ZN7WebCore19InspectorController11closeWindowEv
+__ZN7WebCoreL19getUniqueIdCallbackEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCore28setJSHTMLTableColElementSpanEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueE
+__ZN7WebCore19HTMLTableColElement7setSpanEi
+__ZN7WebCoreL12getTotalTimeEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL7getHeadEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL10getCallUIDEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL9getParentEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL11getSelfTimeEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCoreL16getNumberOfCallsEPK15OpaqueJSContextP13OpaqueJSValueP14OpaqueJSStringPPKS3_
+__ZN7WebCore53jsInspectorControllerPrototypeFunctionWindowUnloadingEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
+__ZN7WebCore11HistoryItem11setReferrerERKNS_6StringE
+-[DOMHTMLTextAreaElement form]
+-[DOMHTMLTextAreaElement(FormPromptAdditions) _isEdited]
+__Z4coreP22DOMHTMLTextAreaElement
+__ZN7WebCore4Page9goForwardEv
+__ZN7WebCoreL11scanForFormEPNS_4NodeE
+__ZN7WebCore3macERKNS_23AuthenticationChallengeE
+__ZN7WebCore14ResourceLoader33didReceiveAuthenticationChallengeEPNS_14ResourceHandleERKNS_23AuthenticationChallengeE
+__ZN7WebCore14ResourceLoader33didReceiveAuthenticationChallengeERKNS_23AuthenticationChallengeE
+__ZN7WebCore11FrameLoader33didReceiveAuthenticationChallengeEPNS_14ResourceLoaderERKNS_23AuthenticationChallengeE
+-[WebCoreResourceHandleAsDelegate useCredential:forAuthenticationChallenge:]
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EE14shrinkCapacityEm
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EE15reserveCapacityEm
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EE6shrinkEm
+__ZNK3JSC8Bindings9ObjcField17valueFromInstanceEPNS_9ExecStateEPKNS0_8InstanceE
+__ZN7WebCore12RenderObject23collectDashboardRegionsERN3WTF6VectorINS_20DashboardRegionValueELm0EEE
+__ZN7WebCore12RenderObject19addDashboardRegionsERN3WTF6VectorINS_20DashboardRegionValueELm0EEE
+__ZN3WTF6VectorIN7WebCore20DashboardRegionValueELm0EE14expandCapacityEmPKS2_
+__ZN3WTF6VectorIN7WebCore20DashboardRegionValueELm0EE14expandCapacityEm
+__ZN3WTF6VectorIN7WebCore20DashboardRegionValueELm0EE15reserveCapacityEm
+__ZNK7WebCore8Document16dashboardRegionsEv
+__ZN3WTFeqIN7WebCore20DashboardRegionValueELm0EEEbRKNS_6VectorIT_XT0_EEES7_
+__ZN7WebCore8Document19setDashboardRegionsERKN3WTF6VectorINS_20DashboardRegionValueELm0EEE
+__ZN3WTF6VectorIN7WebCore20DashboardRegionValueELm0EEaSERKS3_
+__ZN3WTF6VectorIN7WebCore20DashboardRegionValueELm0EE14shrinkCapacityEm
+__ZN7WebCore5Frame26dashboardRegionsDictionaryEv
+-[WebDashboardRegion initWithRect:clip:type:]
+-[WebDashboardRegion dashboardRegionType]
+-[WebDashboardRegion dashboardRegionClip]
+-[WebDashboardRegion dashboardRegionRect]
+__ZN3WTF6VectorIN7WebCore20DashboardRegionValueELm0EE6shrinkEm
+__ZNK7WebCore16PDFDocumentImage23hasSingleSecurityOriginEv
+__ZN7WebCore11RenderStyle20noneDashboardRegionsEv
+__ZN3WTF6VectorIN7WebCore20StyleDashboardRegionELm0EEaSERKS3_
+__ZN7WebCore12RenderInline19addDashboardRegionsERN3WTF6VectorINS_20DashboardRegionValueELm0EEE
+__ZN3JSC8Bindings12ObjcInstance24setValueOfUndefinedFieldEPNS_9ExecStateERKNS_10IdentifierENS_7JSValueE
+__ZN7WebCore10RenderView13absoluteRectsERN3WTF6VectorINS_7IntRectELm0EEEii
+__ZN7WebCoreL21printSourceURLAndLineERKNS_6StringEj
+__ZN7WebCoreL32printMessageSourceAndLevelPrefixENS_13MessageSourceENS_12MessageLevelE
+-[AccessibilityObjectWrapper position]
+__ZN7WebCore17SubresourceLoader33didReceiveAuthenticationChallengeERKNS_23AuthenticationChallengeE
+__ZThn16_N7WebCore24DocumentThreadableLoader33didReceiveAuthenticationChallengeEPNS_17SubresourceLoaderERKNS_23AuthenticationCh
+__ZN7WebCore24DocumentThreadableLoader33didReceiveAuthenticationChallengeEPNS_17SubresourceLoaderERKNS_23AuthenticationChalleng
+__ZN7WebCore57jsCanvasRenderingContext2DPrototypeFunctionSetStrokeColorEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7Arg
+__ZN7WebCore26JSCanvasRenderingContext2D14setStrokeColorEPN3JSC9ExecStateERKNS1_7ArgListE
+__ZN7WebCore24CanvasRenderingContext2D14setStrokeColorERKNS_6StringEf
+__ZN7WebCore11CanvasStyleC1ERKNS_6StringEf
+__ZN7WebCore11CanvasStyleC2ERKNS_6StringEf
+__ZN7WebCore55jsCanvasRenderingContext2DPrototypeFunctionSetLineWidthEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgLi
+__ZN7WebCore53jsCanvasRenderingContext2DPrototypeFunctionSetLineCapEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgList
diff --git a/src/3rdparty/webkit/WebCore/WebCore.pro b/src/3rdparty/webkit/WebCore/WebCore.pro
index 8559ebc..486c9d0 100644
--- a/src/3rdparty/webkit/WebCore/WebCore.pro
+++ b/src/3rdparty/webkit/WebCore/WebCore.pro
@@ -13,22 +13,39 @@ CONFIG(QTDIR_build) {
     include($$QT_SOURCE_TREE/src/qbase.pri)
     PRECOMPILED_HEADER = $$PWD/../WebKit/qt/WebKit_pch.h
     DEFINES *= NDEBUG
+} else {
+    !static: DEFINES += QT_MAKEDLL
+
+    CONFIG(debug, debug|release) {
+        isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}debug
+        OBJECTS_DIR = obj/debug
+    } else { # Release
+        isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = generated$${QMAKE_DIR_SEP}release
+        OBJECTS_DIR = obj/release
+    }
+
+    DESTDIR = $$OUTPUT_DIR/lib
 }
 
-isEmpty(GENERATED_SOURCES_DIR):GENERATED_SOURCES_DIR = tmp
-GENERATED_SOURCES_DIR_SLASH = $$GENERATED_SOURCES_DIR/
-win32-*|wince*: GENERATED_SOURCES_DIR_SLASH ~= s|/|\|
-unix:QMAKE_PKGCONFIG_REQUIRES = QtCore QtDBus QtGui QtNetwork QtXml
+GENERATED_SOURCES_DIR_SLASH = $$GENERATED_SOURCES_DIR${QMAKE_DIR_SEP}
 
-!CONFIG(QTDIR_build) {
-     OBJECTS_DIR = tmp
-     DESTDIR = $$OUTPUT_DIR/lib
+unix {
+    QMAKE_PKGCONFIG_REQUIRES = QtCore QtGui QtNetwork
+    lessThan(QT_MINOR_VERSION, 4): QMAKE_PKGCONFIG_REQUIRES += QtXml
 }
 
 include($$OUTPUT_DIR/config.pri)
 
 CONFIG -= warn_on
 *-g++*:QMAKE_CXXFLAGS += -Wreturn-type -fno-strict-aliasing
+
+# Disable a few warnings on Windows. The warnings are also
+# disabled in WebKitLibraries/win/tools/vsprops/common.vsprops
+win32-*: QMAKE_CXXFLAGS += -wd4291 -wd4344
+
+unix:!mac:*-g++*:QMAKE_CXXFLAGS += -ffunction-sections -fdata-sections 
+unix:!mac:*-g++*:QMAKE_LFLAGS += -Wl,--gc-sections
+
 #QMAKE_CXXFLAGS += -Wall -Wno-undef -Wno-unused-parameter
 
 CONFIG(release):!CONFIG(QTDIR_build) {
@@ -39,13 +56,6 @@ CONFIG(release):!CONFIG(QTDIR_build) {
 linux-*: DEFINES += HAVE_STDINT_H
 freebsd-*: DEFINES += HAVE_PTHREAD_NP_H
 
-# PRE-BUILD: make the required config.h file
-#config_h.target = config.h
-#config_h.commands = cp config.h.qmake config.h
-#config_h.depends = config.h.qmake
-#QMAKE_EXTRA_TARGETS += config_h
-#PRE_TARGETDEPS += config.h
-
 DEFINES += BUILD_WEBKIT
 
 win32-*: DEFINES += _HAS_TR1=0
@@ -78,58 +88,74 @@ CONFIG(QTDIR_build) {
 
 # Optional components (look for defs in config.h and included files!)
 
-# turn off database support if we do not have sqlite3 support 
-!CONFIG(QTDIR_build):win32-*:!exists( $${SQLITE3SRCDIR}/sqlite3.c ): DEFINES += ENABLE_DATABASE=0 ENABLE_ICONDATABASE=0 ENABLE_OFFLINE_WEB_APPLICATIONS=0 ENABLE_DOM_STORAGE=0
+contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
+    DEFINES+=ENABLE_DATABASE=0 ENABLE_DOM_STORAGE=0 ENABLE_ICONDATABASE=0 ENABLE_WORKERS=0
+}
 
+# turn off SQLITE support if we do not have sqlite3 available
+!CONFIG(QTDIR_build):win32-*:!exists( $${SQLITE3SRCDIR}/sqlite3.c ): DEFINES += ENABLE_SQLITE=0 ENABLE_DATABASE=0 ENABLE_ICONDATABASE=0 ENABLE_OFFLINE_WEB_APPLICATIONS=0 ENABLE_DOM_STORAGE=0
+
+!contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=.): DEFINES += ENABLE_JAVASCRIPT_DEBUGGER=1
+!contains(DEFINES, ENABLE_DATABASE=.): DEFINES += ENABLE_DATABASE=1
 !contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=.): DEFINES += ENABLE_OFFLINE_WEB_APPLICATIONS=1
 !contains(DEFINES, ENABLE_DOM_STORAGE=.): DEFINES += ENABLE_DOM_STORAGE=1
 !contains(DEFINES, ENABLE_ICONDATABASE=.): DEFINES += ENABLE_ICONDATABASE=1
 
-# turn on database support if any of the dependent features are turned on
-!contains(DEFINES, ENABLE_DATABASE=1) {
-  contains(DEFINES, ENABLE_ICONDATABASE=1)|contains(DEFINES, ENABLE_DOM_STORAGE=1)|contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1) {
-    DEFINES += ENABLE_DATABASE=1
+# turn on SQLITE support if any of the dependent features are turned on
+!contains(DEFINES, ENABLE_SQLITE=.) {
+  contains(DEFINES, ENABLE_DATABASE=1)|contains(DEFINES, ENABLE_ICONDATABASE=1)|contains(DEFINES, ENABLE_DOM_STORAGE=1)|contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1) {
+    DEFINES += ENABLE_SQLITE=1
+  } else {
+    DEFINES += ENABLE_SQLITE=0
   }
 }
 
-# if database support is not on by now, turn it off 
-!contains(DEFINES, ENABLE_DATABASE=.): DEFINES += ENABLE_DATABASE=0
-
 !contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=.): DEFINES += ENABLE_DASHBOARD_SUPPORT=0
+!contains(DEFINES, ENABLE_FILTERS=.): DEFINES += ENABLE_FILTERS=0
 !contains(DEFINES, ENABLE_XPATH=.): DEFINES += ENABLE_XPATH=1
+!contains(DEFINES, ENABLE_XSLT=.): DEFINES += ENABLE_XSLT=0
 #!contains(DEFINES, ENABLE_XBL=.): DEFINES += ENABLE_XBL=1
 !contains(DEFINES, ENABLE_WML=.): DEFINES += ENABLE_WML=0
-!contains(DEFINES, ENABLE_SVG=.): DEFINES += ENABLE_SVG=1
-!contains(DEFINES, ENABLE_SVG_FONTS=.): DEFINES += ENABLE_SVG_FONTS=1
-!contains(DEFINES, ENABLE_SVG_FILTERS=.): DEFINES += ENABLE_SVG_FILTERS=1
-!contains(DEFINES, ENABLE_SVG_FOREIGN_OBJECT=.): DEFINES += ENABLE_SVG_FOREIGN_OBJECT=1
-!contains(DEFINES, ENABLE_SVG_ANIMATION=.): DEFINES += ENABLE_SVG_ANIMATION=1
-!contains(DEFINES, ENABLE_SVG_AS_IMAGE=.): DEFINES += ENABLE_SVG_AS_IMAGE=1
-!contains(DEFINES, ENABLE_SVG_USE=.): DEFINES += ENABLE_SVG_USE=1
+!contains(DEFINES, ENABLE_WORKERS=.): DEFINES += ENABLE_WORKERS=1
+!contains(DEFINES, ENABLE_XHTMLMP=.): DEFINES += ENABLE_XHTMLMP=0
+
+# SVG support
+!contains(DEFINES, ENABLE_SVG=0) {
+    !contains(DEFINES, ENABLE_SVG=.): DEFINES += ENABLE_SVG=1
+    !contains(DEFINES, ENABLE_SVG_FONTS=.): DEFINES += ENABLE_SVG_FONTS=1
+    !contains(DEFINES, ENABLE_SVG_FOREIGN_OBJECT=.): DEFINES += ENABLE_SVG_FOREIGN_OBJECT=1
+    !contains(DEFINES, ENABLE_SVG_ANIMATION=.): DEFINES += ENABLE_SVG_ANIMATION=1
+    !contains(DEFINES, ENABLE_SVG_AS_IMAGE=.): DEFINES += ENABLE_SVG_AS_IMAGE=1
+    !contains(DEFINES, ENABLE_SVG_USE=.): DEFINES += ENABLE_SVG_USE=1
+} else {
+    DEFINES += ENABLE_SVG_FONTS=0 ENABLE_SVG_FOREIGN_OBJECT=0 ENABLE_SVG_ANIMATION=0 ENABLE_SVG_AS_IMAGE=0 ENABLE_SVG_USE=0
+}
 
 # HTML5 media support
-contains(QT_CONFIG, phonon):DEFINES += ENABLE_VIDEO=1
-else:DEFINES += ENABLE_VIDEO=0
+!contains(DEFINES, ENABLE_VIDEO=.) {
+    contains(QT_CONFIG, phonon):DEFINES += ENABLE_VIDEO=1
+    else:DEFINES += ENABLE_VIDEO=0
+}
 
 # Nescape plugins support (NPAPI)
-unix|win32-*:!embedded:!wince*:!symbian {
-    DEFINES += ENABLE_NETSCAPE_PLUGIN_API=1
-} else {
-    DEFINES += ENABLE_NETSCAPE_PLUGIN_API=0
+!contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=.) {
+    unix|win32-*:!embedded:!wince*:!symbian {
+        DEFINES += ENABLE_NETSCAPE_PLUGIN_API=1
+    } else {
+        DEFINES += ENABLE_NETSCAPE_PLUGIN_API=0
+    }
 }
 
 DEFINES += WTF_USE_JAVASCRIPTCORE_BINDINGS=1 WTF_CHANGES=1
 
-INCLUDEPATH += $$PWD $$PWD/../JavaScriptCore $$PWD/../JavaScriptCore/ForwardingHeaders \
-               $$PWD/../JavaScriptCore/interpreter \
-               $$PWD/../JavaScriptCore/bytecode \
-               $$PWD/../JavaScriptCore/debugger \
-               $$PWD/../JavaScriptCore/parser \
-               $$PWD/../JavaScriptCore/runtime \
-               $$PWD/../JavaScriptCore/bindings \
-               $$PWD/../JavaScriptCore/wrec \
-               $$PWD/../JavaScriptCore/jit \
-               $$PWD/../JavaScriptCore/wtf \
+# Used to compute defaults for the build-webkit script
+CONFIG(compute_defaults) {
+    message($$DEFINES)
+    error("Done computing defaults")
+}
+
+# Ensure that we pick up WebCore's config.h over JavaScriptCore's
+INCLUDEPATH = $$PWD $$INCLUDEPATH
 
 include($$PWD/../JavaScriptCore/JavaScriptCore.pri)
 
@@ -142,21 +168,16 @@ INCLUDEPATH += \
     $$PWD/platform/graphics/filters \
     $$PWD/platform/graphics/transforms \
     $$PWD/platform/graphics/qt \
-    $$PWD/svg/graphics/qt \
-    $$PWD/loader \
     $$PWD/page/qt \
     $$PWD/../WebKit/qt/WebCoreSupport \
-    $$PWD/../WebKit/qt/Api \
-    $$PWD/bridge/qt
 
 # Make sure storage/ appears before JavaScriptCore/. Both provide LocalStorage.h
 # but the header from the former include path is included across directories while
 # LocalStorage.h is included only from files within the same directory
 INCLUDEPATH = $$PWD/storage $$INCLUDEPATH
 
-INCLUDEPATH +=  $$PWD \
+INCLUDEPATH +=  $$PWD/accessibility \
                 $$PWD/ForwardingHeaders \
-                $$PWD/.. \
                 $$PWD/platform \
                 $$PWD/platform/animation \
                 $$PWD/platform/network \
@@ -172,9 +193,9 @@ INCLUDEPATH +=  $$PWD \
                 $$PWD/loader/icon \
                 $$PWD/css \
                 $$PWD/dom \
+                $$PWD/dom/default \
                 $$PWD/page \
                 $$PWD/page/animation \
-                $$PWD/bridge \
                 $$PWD/editing \
                 $$PWD/rendering \
                 $$PWD/rendering/style \
@@ -183,14 +204,15 @@ INCLUDEPATH +=  $$PWD \
                 $$PWD/xml \
                 $$PWD/html \
                 $$PWD/wml \
+                $$PWD/workers \
                 $$PWD/bindings/js \
                 $$PWD/svg \
                 $$PWD/platform/image-decoders \
                 $$PWD/plugins \
                 $$PWD/bridge \
                 $$PWD/bridge/c \
-                $$PWD/bridge/qt \
-                $$GENERATED_SOURCES_DIR
+                $$PWD/bridge/qt
+INCLUDEPATH *=  $$GENERATED_SOURCES_DIR
 
 QT += network
 lessThan(QT_MINOR_VERSION, 4): QT += xml
@@ -259,9 +281,12 @@ IDL_BINDINGS += \
     css/StyleSheetList.idl \
     css/WebKitCSSKeyframeRule.idl \
     css/WebKitCSSKeyframesRule.idl \
+    css/WebKitCSSMatrix.idl \
     css/WebKitCSSTransformValue.idl \
     dom/Attr.idl \
     dom/CharacterData.idl \
+    dom/ClientRect.idl \
+    dom/ClientRectList.idl \
     dom/Clipboard.idl \
     dom/CDATASection.idl \
     dom/Comment.idl \
@@ -270,7 +295,6 @@ IDL_BINDINGS += \
     dom/DocumentType.idl \
     dom/DOMCoreException.idl \
     dom/DOMImplementation.idl \
-    dom/DOMStringList.idl \
     dom/Element.idl \
     dom/Entity.idl \
     dom/EntityReference.idl \
@@ -278,7 +302,6 @@ IDL_BINDINGS += \
     dom/EventException.idl \
 #    dom/EventListener.idl \
 #    dom/EventTarget.idl \
-    dom/EventTargetNode.idl \
     dom/KeyboardEvent.idl \
     dom/MouseEvent.idl \
     dom/MessageChannel.idl \
@@ -303,14 +326,14 @@ IDL_BINDINGS += \
     dom/WebKitAnimationEvent.idl \
     dom/WebKitTransitionEvent.idl \
     dom/WheelEvent.idl \
-    dom/Worker.idl \
-    dom/WorkerContext.idl \
-    dom/WorkerLocation.idl \
     html/CanvasGradient.idl \
     html/CanvasPattern.idl \
     html/CanvasRenderingContext2D.idl \
+    html/DataGridColumn.idl \
+    html/DataGridColumnList.idl \
     html/File.idl \
     html/FileList.idl \
+    html/HTMLAudioElement.idl \
     html/HTMLAnchorElement.idl \
     html/HTMLAppletElement.idl \
     html/HTMLAreaElement.idl \
@@ -322,6 +345,10 @@ IDL_BINDINGS += \
     html/HTMLButtonElement.idl \
     html/HTMLCanvasElement.idl \
     html/HTMLCollection.idl \
+    html/HTMLDataGridElement.idl \
+    html/HTMLDataGridCellElement.idl \
+    html/HTMLDataGridColElement.idl \
+    html/HTMLDataGridRowElement.idl \
     html/HTMLDirectoryElement.idl \
     html/HTMLDivElement.idl \
     html/HTMLDListElement.idl \
@@ -347,6 +374,7 @@ IDL_BINDINGS += \
     html/HTMLLinkElement.idl \
     html/HTMLMapElement.idl \
     html/HTMLMarqueeElement.idl \
+    html/HTMLMediaElement.idl \
     html/HTMLMenuElement.idl \
     html/HTMLMetaElement.idl \
     html/HTMLModElement.idl \
@@ -361,6 +389,7 @@ IDL_BINDINGS += \
     html/HTMLQuoteElement.idl \
     html/HTMLScriptElement.idl \
     html/HTMLSelectElement.idl \
+    html/HTMLSourceElement.idl \
     html/HTMLStyleElement.idl \
     html/HTMLTableCaptionElement.idl \
     html/HTMLTableCellElement.idl \
@@ -371,11 +400,15 @@ IDL_BINDINGS += \
     html/HTMLTextAreaElement.idl \
     html/HTMLTitleElement.idl \
     html/HTMLUListElement.idl \
+    html/HTMLVideoElement.idl \
     html/ImageData.idl \
+    html/MediaError.idl \
     html/TextMetrics.idl \
-    inspector/JavaScriptCallFrame.idl \
+    html/VoidCallback.idl \
+    inspector/InspectorController.idl \
     page/BarInfo.idl \
     page/Console.idl \
+    page/Coordinates.idl \
     page/DOMSelection.idl \
     page/DOMWindow.idl \
     page/Geolocation.idl \
@@ -385,7 +418,7 @@ IDL_BINDINGS += \
     page/Navigator.idl \
     page/PositionError.idl \
     page/Screen.idl \
-    page/WorkerNavigator.idl \
+    page/WebKitPoint.idl \
     plugins/Plugin.idl \
     plugins/MimeType.idl \
     plugins/PluginArray.idl \
@@ -395,41 +428,56 @@ IDL_BINDINGS += \
     xml/XMLHttpRequestException.idl \
     xml/XMLHttpRequestProgressEvent.idl \
     xml/XMLHttpRequestUpload.idl \
-    xml/XMLSerializer.idl \
-    xml/XSLTProcessor.idl
+    xml/XMLSerializer.idl
 
 
 SOURCES += \
-    bindings/js/DOMTimer.cpp \
+    accessibility/AccessibilityImageMapLink.cpp \
+    accessibility/AccessibilityObject.cpp \    
+    accessibility/AccessibilityList.cpp \    
+    accessibility/AccessibilityListBox.cpp \    
+    accessibility/AccessibilityListBoxOption.cpp \    
+    accessibility/AccessibilityRenderObject.cpp \    
+    accessibility/AccessibilityARIAGrid.cpp \    
+    accessibility/AccessibilityARIAGridCell.cpp \    
+    accessibility/AccessibilityARIAGridRow.cpp \    
+    accessibility/AccessibilityTable.cpp \    
+    accessibility/AccessibilityTableCell.cpp \    
+    accessibility/AccessibilityTableColumn.cpp \    
+    accessibility/AccessibilityTableHeaderContainer.cpp \    
+    accessibility/AccessibilityTableRow.cpp \    
+    accessibility/AXObjectCache.cpp \
     bindings/js/GCController.cpp \
     bindings/js/JSAttrCustom.cpp \
+    bindings/js/JSCDATASectionCustom.cpp \
     bindings/js/JSCanvasRenderingContext2DCustom.cpp \
     bindings/js/JSClipboardCustom.cpp \
     bindings/js/JSConsoleCustom.cpp \
     bindings/js/JSCSSRuleCustom.cpp \
     bindings/js/JSCSSStyleDeclarationCustom.cpp \
     bindings/js/JSCSSValueCustom.cpp \
+    bindings/js/JSCoordinatesCustom.cpp \
     bindings/js/JSCustomPositionCallback.cpp \
     bindings/js/JSCustomPositionErrorCallback.cpp \
     bindings/js/JSCustomVoidCallback.cpp \
     bindings/js/JSCustomXPathNSResolver.cpp \
+    bindings/js/JSDataGridColumnListCustom.cpp \
+    bindings/js/JSDataGridDataSource.cpp \
     bindings/js/JSDocumentCustom.cpp \
     bindings/js/JSDocumentFragmentCustom.cpp \
     bindings/js/JSDOMGlobalObject.cpp \
-    bindings/js/JSDOMStringListCustom.cpp \
     bindings/js/JSDOMWindowBase.cpp \
     bindings/js/JSDOMWindowCustom.cpp \
     bindings/js/JSDOMWindowShell.cpp \
     bindings/js/JSElementCustom.cpp \
     bindings/js/JSEventCustom.cpp \
     bindings/js/JSEventTarget.cpp \
-    bindings/js/JSEventTargetNodeCustom.cpp \
     bindings/js/JSGeolocationCustom.cpp \
     bindings/js/JSHTMLAllCollection.cpp \
     bindings/js/JSHistoryCustom.cpp \
-    bindings/js/JSJavaScriptCallFrameCustom.cpp \
     bindings/js/JSHTMLAppletElementCustom.cpp \
     bindings/js/JSHTMLCollectionCustom.cpp \
+    bindings/js/JSHTMLDataGridElementCustom.cpp \
     bindings/js/JSHTMLDocumentCustom.cpp \
     bindings/js/JSHTMLElementCustom.cpp \
     bindings/js/JSHTMLEmbedElementCustom.cpp \
@@ -445,6 +493,7 @@ SOURCES += \
     bindings/js/JSImageDataCustom.cpp \
     bindings/js/JSInspectedObjectWrapper.cpp \
     bindings/js/JSInspectorCallbackWrapper.cpp \
+    bindings/js/JSInspectorControllerCustom.cpp \
     bindings/js/JSLocationCustom.cpp \
     bindings/js/JSNamedNodeMapCustom.cpp \
     bindings/js/JSNamedNodesCollection.cpp  \
@@ -459,12 +508,13 @@ SOURCES += \
     bindings/js/JSRGBColor.cpp \
     bindings/js/JSStyleSheetCustom.cpp \
     bindings/js/JSStyleSheetListCustom.cpp \
+    bindings/js/JSTextCustom.cpp \
     bindings/js/JSTreeWalkerCustom.cpp \
+    bindings/js/JSWebKitCSSMatrixConstructor.cpp \
+    bindings/js/JSWebKitPointConstructor.cpp \
     bindings/js/JSXMLHttpRequestConstructor.cpp \
     bindings/js/JSXMLHttpRequestCustom.cpp \
     bindings/js/JSXMLHttpRequestUploadCustom.cpp \
-    bindings/js/JSXSLTProcessorConstructor.cpp \
-    bindings/js/JSXSLTProcessorCustom.cpp \
     bindings/js/JSPluginCustom.cpp \
     bindings/js/JSPluginArrayCustom.cpp \
     bindings/js/JSMessageChannelConstructor.cpp \
@@ -473,13 +523,20 @@ SOURCES += \
     bindings/js/JSMimeTypeArrayCustom.cpp \
     bindings/js/JSDOMBinding.cpp \
     bindings/js/JSEventListener.cpp \
+    bindings/js/JSLazyEventListener.cpp \
     bindings/js/JSPluginElementFunctions.cpp \
-    bindings/js/ScriptCachedPageData.cpp \
+    bindings/js/ScriptCachedFrameData.cpp \
     bindings/js/ScriptCallFrame.cpp \
     bindings/js/ScriptCallStack.cpp \
     bindings/js/ScriptController.cpp \
+    bindings/js/ScriptEventListener.cpp \
+    bindings/js/ScriptFunctionCall.cpp \
+    bindings/js/ScriptObject.cpp \
+    bindings/js/ScriptObjectQuarantine.cpp \
+    bindings/js/ScriptState.cpp \
     bindings/js/ScriptValue.cpp \
     bindings/js/ScheduledAction.cpp \
+    bridge/IdentifierRep.cpp \
     bridge/NP_jsobject.cpp \
     bridge/npruntime.cpp \
     bridge/runtime_array.cpp \
@@ -516,6 +573,7 @@ SOURCES += \
     css/CSSParserValues.cpp \
     css/CSSPrimitiveValue.cpp \
     css/CSSProperty.cpp \
+    css/CSSPropertyLonghand.cpp \
     css/CSSReflectValue.cpp \
     css/CSSRule.cpp \
     css/CSSRuleList.cpp \
@@ -546,6 +604,7 @@ SOURCES += \
     css/StyleSheetList.cpp \
     css/WebKitCSSKeyframeRule.cpp \
     css/WebKitCSSKeyframesRule.cpp \
+    css/WebKitCSSMatrix.cpp \
     css/WebKitCSSTransformValue.cpp \
     dom/ActiveDOMObject.cpp \
     dom/Attr.cpp \
@@ -554,9 +613,12 @@ SOURCES += \
     dom/BeforeUnloadEvent.cpp \
     dom/CDATASection.cpp \
     dom/CharacterData.cpp \
+    dom/CheckedRadioButtons.cpp \
     dom/ChildNodeList.cpp \
     dom/ClassNames.cpp \
     dom/ClassNodeList.cpp \
+    dom/ClientRect.cpp \
+    dom/ClientRectList.cpp \
     dom/Clipboard.cpp \
     dom/ClipboardEvent.cpp \
     dom/Comment.cpp \
@@ -566,7 +628,6 @@ SOURCES += \
     dom/DocumentFragment.cpp \
     dom/DocumentType.cpp \
     dom/DOMImplementation.cpp \
-    dom/DOMStringList.cpp \
     dom/DynamicNodeList.cpp \
     dom/EditingText.cpp \
     dom/Element.cpp \
@@ -575,14 +636,15 @@ SOURCES += \
     dom/Event.cpp \
     dom/EventNames.cpp \
     dom/EventTarget.cpp \
-    dom/EventTargetNode.cpp \
     dom/ExceptionBase.cpp \
     dom/ExceptionCode.cpp \
+    dom/InputElement.cpp \
     dom/KeyboardEvent.cpp \
     dom/MappedAttribute.cpp \
     dom/MessageChannel.cpp \
     dom/MessageEvent.cpp \
     dom/MessagePort.cpp \
+    dom/MessagePortChannel.cpp \
     dom/MouseEvent.cpp \
     dom/MouseRelatedEvent.cpp \
     dom/MutationEvent.cpp \
@@ -594,6 +656,8 @@ SOURCES += \
     dom/NodeFilter.cpp \
     dom/NodeIterator.cpp \
     dom/Notation.cpp \
+    dom/OptionGroupElement.cpp \
+    dom/OptionElement.cpp \
     dom/OverflowEvent.cpp \
     dom/Position.cpp \
     dom/PositionIterator.cpp \
@@ -604,9 +668,9 @@ SOURCES += \
     dom/RegisteredEventListener.cpp \
     dom/ScriptElement.cpp \
     dom/ScriptExecutionContext.cpp \
+    dom/SelectElement.cpp \
     dom/SelectorNodeList.cpp \
     dom/StaticNodeList.cpp \
-    dom/StaticStringList.cpp \
     dom/StyledElement.cpp \
     dom/StyleElement.cpp \
     dom/TagNodeList.cpp \
@@ -621,6 +685,8 @@ SOURCES += \
     dom/WheelEvent.cpp \
     dom/XMLTokenizer.cpp \
     dom/XMLTokenizerQt.cpp \
+    dom/XMLTokenizerScope.cpp \
+    dom/default/PlatformMessagePortChannel.cpp \
     editing/AppendNodeCommand.cpp \
     editing/ApplyStyleCommand.cpp \
     editing/BreakBlockquoteCommand.cpp \
@@ -650,12 +716,11 @@ SOURCES += \
     editing/MoveSelectionCommand.cpp \
     editing/RemoveCSSPropertyCommand.cpp \
     editing/RemoveFormatCommand.cpp \
-    editing/RemoveNodeAttributeCommand.cpp \
     editing/RemoveNodeCommand.cpp \
     editing/RemoveNodePreservingChildrenCommand.cpp \
+    editing/ReplaceNodeWithSpanCommand.cpp \
     editing/ReplaceSelectionCommand.cpp \
     editing/SelectionController.cpp \
-    editing/Selection.cpp \
     editing/SetNodeAttributeCommand.cpp \
     editing/SmartReplace.cpp \
     editing/SmartReplaceICU.cpp \
@@ -666,16 +731,23 @@ SOURCES += \
     editing/TypingCommand.cpp \
     editing/UnlinkCommand.cpp \
     editing/VisiblePosition.cpp \
+    editing/VisibleSelection.cpp \
     editing/visible_units.cpp \
     editing/WrapContentsInDummySpanCommand.cpp \
     history/BackForwardList.cpp \
+    history/CachedFrame.cpp \
     history/CachedPage.cpp \
     history/HistoryItem.cpp \
+    history/qt/HistoryItemQt.cpp \
     history/PageCache.cpp \
     html/CanvasGradient.cpp \
     html/CanvasPattern.cpp \
+    html/CanvasPixelArray.cpp \
     html/CanvasRenderingContext2D.cpp \
     html/CanvasStyle.cpp \
+    html/CollectionCache.cpp \
+    html/DataGridColumn.cpp \
+    html/DataGridColumnList.cpp \
     html/File.cpp \
     html/FileList.cpp \
     html/FormDataList.cpp \
@@ -690,12 +762,15 @@ SOURCES += \
     html/HTMLButtonElement.cpp \
     html/HTMLCanvasElement.cpp \
     html/HTMLCollection.cpp \
+    html/HTMLDataGridElement.cpp \
+    html/HTMLDataGridCellElement.cpp \
+    html/HTMLDataGridColElement.cpp \
+    html/HTMLDataGridRowElement.cpp \
     html/HTMLDirectoryElement.cpp \
     html/HTMLDivElement.cpp \
     html/HTMLDListElement.cpp \
     html/HTMLDocument.cpp \
     html/HTMLElement.cpp \
-    html/HTMLElementFactory.cpp \
     html/HTMLEmbedElement.cpp \
     html/HTMLFieldSetElement.cpp \
     html/HTMLFontElement.cpp \
@@ -740,6 +815,7 @@ SOURCES += \
     html/HTMLPreElement.cpp \
     html/HTMLQuoteElement.cpp \
     html/HTMLScriptElement.cpp \
+    html/HTMLNoScriptElement.cpp \
     html/HTMLSelectElement.cpp \
     html/HTMLStyleElement.cpp \
     html/HTMLTableCaptionElement.cpp \
@@ -757,11 +833,13 @@ SOURCES += \
     html/HTMLViewSourceDocument.cpp \
     html/ImageData.cpp \
     html/PreloadScanner.cpp \
+    inspector/ConsoleMessage.cpp \
+    inspector/InspectorDatabaseResource.cpp \
+    inspector/InspectorDOMStorageResource.cpp \
     inspector/InspectorController.cpp \
-    inspector/JavaScriptCallFrame.cpp \
-    inspector/JavaScriptDebugServer.cpp \
-    inspector/JavaScriptProfile.cpp \
-    inspector/JavaScriptProfileNode.cpp \
+    inspector/InspectorFrontend.cpp \
+    inspector/InspectorResource.cpp \
+    inspector/InspectorJSONObject.cpp \
     loader/archive/ArchiveFactory.cpp \
     loader/archive/ArchiveResource.cpp \
     loader/archive/ArchiveResourceCollection.cpp \
@@ -775,11 +853,13 @@ SOURCES += \
     loader/CachedResource.cpp \
     loader/CachedScript.cpp \
     loader/CachedXSLStyleSheet.cpp \
+    loader/CrossOriginAccessControl.cpp \
+    loader/CrossOriginPreflightResultCache.cpp \
     loader/DocLoader.cpp \
     loader/DocumentLoader.cpp \
+    loader/DocumentThreadableLoader.cpp \
     loader/FormState.cpp \
     loader/FrameLoader.cpp \
-    loader/FrameLoaderClient.cpp \
     loader/FTPDirectoryDocument.cpp \
     loader/FTPDirectoryParser.cpp \
     loader/icon/IconLoader.cpp \
@@ -797,28 +877,19 @@ SOURCES += \
     loader/SubresourceLoader.cpp \
     loader/TextDocument.cpp \
     loader/TextResourceDecoder.cpp \
-    page/AccessibilityImageMapLink.cpp \
-    page/AccessibilityObject.cpp \    
-    page/AccessibilityList.cpp \    
-    page/AccessibilityListBox.cpp \    
-    page/AccessibilityListBoxOption.cpp \    
-    page/AccessibilityRenderObject.cpp \    
-    page/AccessibilityTable.cpp \    
-    page/AccessibilityTableCell.cpp \    
-    page/AccessibilityTableColumn.cpp \    
-    page/AccessibilityTableHeaderContainer.cpp \    
-    page/AccessibilityTableRow.cpp \    
+    loader/ThreadableLoader.cpp \
     page/animation/AnimationBase.cpp \
     page/animation/AnimationController.cpp \
     page/animation/CompositeAnimation.cpp \
     page/animation/ImplicitAnimation.cpp \
     page/animation/KeyframeAnimation.cpp \
-    page/AXObjectCache.cpp \
     page/BarInfo.cpp \
     page/Chrome.cpp \
     page/Console.cpp \
     page/ContextMenuController.cpp \
+    page/Coordinates.cpp \
     page/DOMSelection.cpp \
+    page/DOMTimer.cpp \
     page/DOMWindow.cpp \
     page/Navigator.cpp \
     page/NavigatorBase.cpp \
@@ -835,11 +906,13 @@ SOURCES += \
     page/MouseEventWithHitTestResults.cpp \
     page/Page.cpp \
     page/PageGroup.cpp \
+    page/PageGroupLoadDeferrer.cpp \
     page/PrintContext.cpp \
     page/SecurityOrigin.cpp \
     page/Screen.cpp \
     page/Settings.cpp \
     page/WindowFeatures.cpp \
+    page/XSSAuditor.cpp \
     plugins/PluginData.cpp \
     plugins/PluginArray.cpp \
     plugins/Plugin.cpp \
@@ -852,7 +925,9 @@ SOURCES += \
     platform/text/AtomicString.cpp \
     platform/text/Base64.cpp \
     platform/text/BidiContext.cpp \
+    platform/ContentType.cpp \
     platform/ContextMenu.cpp \
+    platform/CrossThreadCopier.cpp \
     platform/text/CString.cpp \
     platform/DeprecatedPtrListImpl.cpp \
     platform/DragData.cpp \
@@ -884,6 +959,8 @@ SOURCES += \
     platform/graphics/SimpleFontData.cpp \
     platform/graphics/transforms/TransformationMatrix.cpp \
     platform/graphics/transforms/MatrixTransformOperation.cpp \
+    platform/graphics/transforms/Matrix3DTransformOperation.cpp \
+    platform/graphics/transforms/PerspectiveTransformOperation.cpp \
     platform/graphics/transforms/RotateTransformOperation.cpp \
     platform/graphics/transforms/ScaleTransformOperation.cpp \
     platform/graphics/transforms/SkewTransformOperation.cpp \
@@ -898,6 +975,7 @@ SOURCES += \
     platform/network/Credential.cpp \
     platform/network/FormData.cpp \
     platform/network/FormDataBuilder.cpp \
+    platform/network/HTTPHeaderMap.cpp \
     platform/network/HTTPParsers.cpp \
     platform/network/NetworkStateNotifier.cpp \
     platform/network/ProtectionSpace.cpp \
@@ -919,11 +997,12 @@ SOURCES += \
     platform/text/TextCodecLatin1.cpp \
     platform/text/TextCodecUserDefined.cpp \
     platform/text/TextCodecUTF16.cpp \
-    platform/text/TextDecoder.cpp \
     platform/text/TextEncoding.cpp \
+    platform/text/TextEncodingDetectorNone.cpp \
     platform/text/TextEncodingRegistry.cpp \
     platform/text/TextStream.cpp \
     platform/ThreadGlobalData.cpp \
+    platform/ThreadTimers.cpp \
     platform/Timer.cpp \
     platform/text/UnicodeRange.cpp \
     platform/Widget.cpp \
@@ -943,19 +1022,18 @@ SOURCES += \
     rendering/InlineFlowBox.cpp \
     rendering/InlineTextBox.cpp \
     rendering/LayoutState.cpp \
-    rendering/ListMarkerBox.cpp \
     rendering/RenderApplet.cpp \
     rendering/RenderArena.cpp \
     rendering/RenderBlock.cpp \
     rendering/RenderBox.cpp \
+    rendering/RenderBoxModelObject.cpp \
     rendering/RenderBR.cpp \
     rendering/RenderButton.cpp \
-    rendering/RenderContainer.cpp \
     rendering/RenderCounter.cpp \
+    rendering/RenderDataGrid.cpp \
     rendering/RenderFieldset.cpp \
     rendering/RenderFileUploadControl.cpp \
     rendering/RenderFlexibleBox.cpp \
-    rendering/RenderFlow.cpp \
     rendering/RenderFrame.cpp \
     rendering/RenderFrameSet.cpp \
     rendering/RenderHTMLCanvas.cpp \
@@ -963,13 +1041,14 @@ SOURCES += \
     rendering/RenderImageGeneratedContent.cpp \
     rendering/RenderInline.cpp \
     rendering/RenderLayer.cpp \
-    rendering/RenderLegend.cpp \
+    rendering/RenderLineBoxList.cpp \
     rendering/RenderListBox.cpp \
     rendering/RenderListItem.cpp \
     rendering/RenderListMarker.cpp \
     rendering/RenderMarquee.cpp \
     rendering/RenderMenuList.cpp \
     rendering/RenderObject.cpp \
+    rendering/RenderObjectChildList.cpp \
     rendering/RenderPart.cpp \
     rendering/RenderPartObject.cpp \
     rendering/RenderReplaced.cpp \
@@ -978,15 +1057,15 @@ SOURCES += \
     rendering/RenderScrollbarPart.cpp \
     rendering/RenderScrollbarTheme.cpp \
     rendering/RenderSlider.cpp \
+    rendering/RenderTable.cpp \
     rendering/RenderTableCell.cpp \
     rendering/RenderTableCol.cpp \
-    rendering/RenderTable.cpp \
     rendering/RenderTableRow.cpp \
     rendering/RenderTableSection.cpp \
+    rendering/RenderText.cpp \
     rendering/RenderTextControl.cpp \
     rendering/RenderTextControlMultiLine.cpp \
     rendering/RenderTextControlSingleLine.cpp \
-    rendering/RenderText.cpp \
     rendering/RenderTextFragment.cpp \
     rendering/RenderTheme.cpp \
     rendering/RenderTreeAsText.cpp \
@@ -995,7 +1074,9 @@ SOURCES += \
     rendering/RenderWordBreak.cpp \
     rendering/RootInlineBox.cpp \
     rendering/SVGRenderTreeAsText.cpp \
+    rendering/ScrollBehavior.cpp \
     rendering/TextControlInnerElements.cpp \
+    rendering/TransformState.cpp \
     rendering/style/BindingURI.cpp \
     rendering/style/ContentData.cpp \
     rendering/style/CounterDirectives.cpp \
@@ -1018,35 +1099,13 @@ SOURCES += \
     rendering/style/StyleTransformData.cpp \
     rendering/style/StyleVisualData.cpp \
     xml/DOMParser.cpp \
-    xml/NativeXPathNSResolver.cpp \
     xml/XMLHttpRequest.cpp \
     xml/XMLHttpRequestUpload.cpp \
-    xml/XMLSerializer.cpp \
-    xml/XPathEvaluator.cpp \
-    xml/XPathExpression.cpp \
-    xml/XPathExpressionNode.cpp \
-    xml/XPathFunctions.cpp \
-    xml/XPathNamespace.cpp \
-    xml/XPathNodeSet.cpp \
-    xml/XPathNSResolver.cpp \
-    xml/XPathParser.cpp \
-    xml/XPathPath.cpp \
-    xml/XPathPredicate.cpp \
-    xml/XPathResult.cpp \
-    xml/XPathStep.cpp \
-    xml/XPathUtil.cpp \
-    xml/XPathValue.cpp \
-    xml/XPathVariableReference.cpp \
-    xml/XSLImportRule.cpp \
-    xml/XSLStyleSheet.cpp \
-    xml/XSLTExtensions.cpp \
-    xml/XSLTUnicodeSort.cpp \
-    xml/XSLTProcessor.cpp
+    xml/XMLSerializer.cpp 
 
 HEADERS += \
     $$PWD/platform/graphics/qt/StillImageQt.h \
     $$PWD/platform/qt/QWebPopup.h \
-    $$PWD/platform/qt/MenuEventProxy.h \
     $$PWD/../WebKit/qt/Api/qwebpluginfactory.h \
     $$PWD/../WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h \
     $$PWD/platform/network/qt/QNetworkReplyHandler.h \
@@ -1061,11 +1120,11 @@ HEADERS += \
 
 
 SOURCES += \
+    accessibility/qt/AccessibilityObjectQt.cpp \
     bindings/js/ScriptControllerQt.cpp \
     bridge/qt/qt_class.cpp \
     bridge/qt/qt_instance.cpp \
     bridge/qt/qt_runtime.cpp \
-    page/qt/AccessibilityObjectQt.cpp \
     page/qt/DragControllerQt.cpp \
     page/qt/EventHandlerQt.cpp \
     page/qt/FrameQt.cpp \
@@ -1144,6 +1203,7 @@ SOURCES += \
     ../WebKit/qt/Api/qwebframe.cpp \
     ../WebKit/qt/Api/qwebpage.cpp \
     ../WebKit/qt/Api/qwebview.cpp \
+    ../WebKit/qt/Api/qwebelement.cpp \
     ../WebKit/qt/Api/qwebhistory.cpp \
     ../WebKit/qt/Api/qwebsettings.cpp \
     ../WebKit/qt/Api/qwebhistoryinterface.cpp \
@@ -1153,7 +1213,6 @@ SOURCES += \
 
 
     win32-*|wince*: SOURCES += platform/win/SystemTimeWin.cpp
-    else: SOURCES += platform/qt/SystemTimeQt.cpp
 
     mac {
         SOURCES += \
@@ -1187,6 +1246,8 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
     SOURCES += plugins/npapi.cpp
 
     unix {
+        DEFINES += ENABLE_PLUGIN_PACKAGE_SIMPLE_HASH=1
+
         mac {
             SOURCES += \
                 plugins/mac/PluginPackageMac.cpp \
@@ -1199,8 +1260,11 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
         } else {
             !embedded: CONFIG += x11
             SOURCES += \
+                plugins/qt/PluginContainerQt.cpp \
                 plugins/qt/PluginPackageQt.cpp \
                 plugins/qt/PluginViewQt.cpp
+            HEADERS += \
+                plugins/qt/PluginContainerQt.h
             DEFINES += XP_UNIX
         }
     }
@@ -1223,15 +1287,17 @@ contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
             -lversion
     }
 
+} else {
+    SOURCES += \
+        plugins/PluginPackageNone.cpp \
+        plugins/PluginViewNone.cpp
 }
 
 contains(DEFINES, ENABLE_DASHBOARD_SUPPORT=0) {
     DASHBOARDSUPPORTCSSPROPERTIES -= $$PWD/css/DashboardSupportCSSPropertyNames.in
 }
 
-contains(DEFINES, ENABLE_DATABASE=1) {
-    FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATABASE=1
-
+contains(DEFINES, ENABLE_SQLITE=1) {
     # somewhat copied from src/plugins/sqldrivers/sqlite/sqlite.pro
     CONFIG(QTDIR_build):system-sqlite {
         LIBS *= $$QT_LFLAGS_SQLITE
@@ -1241,6 +1307,9 @@ contains(DEFINES, ENABLE_DATABASE=1) {
             # we have source - use it
             CONFIG(release, debug|release):DEFINES *= NDEBUG
             DEFINES += SQLITE_CORE SQLITE_OMIT_LOAD_EXTENSION SQLITE_OMIT_COMPLETE 
+            contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
+                DEFINES+=SQLITE_THREADSAFE=0
+            }
             INCLUDEPATH += $${SQLITE3SRCDIR}
             SOURCES += $${SQLITE3SRCDIR}/sqlite3.c
         } else {
@@ -1256,20 +1325,21 @@ contains(DEFINES, ENABLE_DATABASE=1) {
         platform/sql/SQLiteStatement.cpp \
         platform/sql/SQLiteTransaction.cpp \
         platform/sql/SQLValue.cpp \
-        storage/ChangeVersionWrapper.cpp \
-        storage/DatabaseAuthorizer.cpp \
         storage/Database.cpp \
+        storage/DatabaseAuthorizer.cpp
+}
+
+
+contains(DEFINES, ENABLE_DATABASE=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_DATABASE=1
+
+    SOURCES += \
+        storage/ChangeVersionWrapper.cpp \
         storage/DatabaseTask.cpp \
         storage/DatabaseThread.cpp \
         storage/DatabaseTracker.cpp \
-        storage/LocalStorage.cpp \
-        storage/LocalStorageArea.cpp \
-        storage/LocalStorageTask.cpp \
-        storage/LocalStorageThread.cpp \
         storage/OriginQuotaManager.cpp \
         storage/OriginUsageRecord.cpp \
-        storage/StorageArea.cpp \
-        storage/StorageMap.cpp \
         storage/SQLResultSet.cpp \
         storage/SQLResultSetRowList.cpp \
         storage/SQLStatement.cpp \
@@ -1294,17 +1364,27 @@ contains(DEFINES, ENABLE_DOM_STORAGE=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_DOM_STORAGE=1
 
     HEADERS += \
+        storage/LocalStorageTask.h \
+        storage/LocalStorageThread.h \
         storage/Storage.h \
+        storage/StorageArea.h \
+        storage/StorageAreaSync.h \
         storage/StorageEvent.h \
-        storage/SessionStorage.h \
-        storage/SessionStorageArea.h
+        storage/StorageMap.h \
+        storage/StorageNamespace.h \
+        storage/StorageSyncManager.h
 
     SOURCES += \
+        bindings/js/JSStorageCustom.cpp \
+        storage/LocalStorageTask.cpp \
+        storage/LocalStorageThread.cpp \
         storage/Storage.cpp \
+        storage/StorageArea.cpp \
+        storage/StorageAreaSync.cpp \
         storage/StorageEvent.cpp \
-        storage/SessionStorage.cpp \
-        storage/SessionStorageArea.cpp \
-        bindings/js/JSStorageCustom.cpp
+        storage/StorageMap.cpp \
+        storage/StorageNamespace.cpp \
+        storage/StorageSyncManager.cpp
 
     IDL_BINDINGS += \
         storage/Storage.idl \
@@ -1321,17 +1401,37 @@ contains(DEFINES, ENABLE_ICONDATABASE=1) {
         loader/icon/IconDatabaseNone.cpp
 }
 
+contains(DEFINES, ENABLE_WORKERS=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_WORKERS=1
+
+    IDL_BINDINGS += \
+        page/WorkerNavigator.idl \
+        workers/Worker.idl \
+        workers/WorkerContext.idl \
+        workers/WorkerLocation.idl
+
+    SOURCES += \
+        bindings/js/JSWorkerConstructor.cpp \
+        bindings/js/JSWorkerContextBase.cpp \
+        bindings/js/JSWorkerContextCustom.cpp \
+        bindings/js/JSWorkerCustom.cpp \
+        bindings/js/WorkerScriptController.cpp \
+        loader/WorkerThreadableLoader.cpp \
+        page/WorkerNavigator.cpp \
+        workers/Worker.cpp \
+        workers/WorkerContext.cpp \
+        workers/WorkerLocation.cpp \
+        workers/WorkerMessagingProxy.cpp \
+        workers/WorkerRunLoop.cpp \
+        workers/WorkerThread.cpp \
+        workers/WorkerScriptLoader.cpp
+}
+
 contains(DEFINES, ENABLE_VIDEO=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_VIDEO=1
 
     IDL_BINDINGS += \
-        html/HTMLAudioElement.idl \
-        html/HTMLMediaElement.idl \
-        html/HTMLSourceElement.idl \
-        html/HTMLVideoElement.idl \
-        html/MediaError.idl \
-        html/TimeRanges.idl \
-        html/VoidCallback.idl 
+        html/TimeRanges.idl
 
     SOURCES += \
         html/HTMLAudioElement.cpp \
@@ -1375,6 +1475,24 @@ contains(DEFINES, ENABLE_XPATH=1) {
         xml/XPathExpression.idl \
         xml/XPathResult.idl \
         xml/XPathEvaluator.idl
+
+    SOURCES += \
+        xml/NativeXPathNSResolver.cpp \
+        xml/XPathEvaluator.cpp \
+        xml/XPathExpression.cpp \
+        xml/XPathExpressionNode.cpp \
+        xml/XPathFunctions.cpp \
+        xml/XPathNamespace.cpp \
+        xml/XPathNodeSet.cpp \
+        xml/XPathNSResolver.cpp \
+        xml/XPathParser.cpp \
+        xml/XPathPath.cpp \
+        xml/XPathPredicate.cpp \
+        xml/XPathResult.cpp \
+        xml/XPathStep.cpp \
+        xml/XPathUtil.cpp \
+        xml/XPathValue.cpp \
+        xml/XPathVariableReference.cpp
 }
 
 unix:!mac:CONFIG += link_pkgconfig
@@ -1391,12 +1509,37 @@ contains(DEFINES, ENABLE_XSLT=1) {
     win32-msvc* {
         LIBS += -llibxml2 -llibxslt
     }
+
+    IDL_BINDINGS += \
+        xml/XSLTProcessor.idl
+
+    SOURCES += \
+        bindings/js/JSXSLTProcessorConstructor.cpp \
+        bindings/js/JSXSLTProcessorCustom.cpp \
+        xml/XSLImportRule.cpp \
+        xml/XSLStyleSheet.cpp \
+        xml/XSLTExtensions.cpp \
+        xml/XSLTProcessor.cpp \
+        xml/XSLTUnicodeSort.cpp
 }
 
 contains(DEFINES, ENABLE_XBL=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_XBL=1
 }
 
+contains(DEFINES, ENABLE_FILTERS=1) {
+    SOURCES += \
+        platform/graphics/filters/FEBlend.cpp \
+        platform/graphics/filters/FEColorMatrix.cpp \
+        platform/graphics/filters/FEComponentTransfer.cpp \
+        platform/graphics/filters/FEComposite.cpp \
+        platform/graphics/filters/FilterEffect.cpp \
+        platform/graphics/filters/SourceAlpha.cpp \
+        platform/graphics/filters/SourceGraphic.cpp
+
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_FILTERS=1
+}
+
 contains(DEFINES, ENABLE_WML=1) {
     SOURCES += \
         wml/WMLAElement.cpp \
@@ -1409,10 +1552,12 @@ contains(DEFINES, ENABLE_WML=1) {
         wml/WMLElement.cpp \
         wml/WMLErrorHandling.cpp \
         wml/WMLEventHandlingElement.cpp \
+        wml/WMLFormControlElement.cpp \
         wml/WMLFieldSetElement.cpp \
         wml/WMLGoElement.cpp \
         wml/WMLImageElement.cpp \
         wml/WMLImageLoader.cpp \
+        wml/WMLInputElement.cpp \
         wml/WMLInsertedLegendElement.cpp \
         wml/WMLIntrinsicEvent.cpp \
         wml/WMLIntrinsicEventHandler.cpp \
@@ -1420,10 +1565,13 @@ contains(DEFINES, ENABLE_WML=1) {
         wml/WMLNoopElement.cpp \
         wml/WMLOnEventElement.cpp \
         wml/WMLPElement.cpp \
+        wml/WMLOptGroupElement.cpp \
+        wml/WMLOptionElement.cpp \
         wml/WMLPageState.cpp \
         wml/WMLPostfieldElement.cpp \
         wml/WMLPrevElement.cpp \
         wml/WMLRefreshElement.cpp \
+        wml/WMLSelectElement.cpp \
         wml/WMLSetvarElement.cpp \
         wml/WMLTableElement.cpp \
         wml/WMLTaskElement.cpp \
@@ -1435,22 +1583,26 @@ contains(DEFINES, ENABLE_WML=1) {
 
     WML_NAMES = $$PWD/wml/WMLTagNames.in
 
-    wmlnames_a.output = $$GENERATED_SOURCES_DIR/WMLNames.cpp
+    wmlnames_a.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}WMLNames.cpp
     wmlnames_a.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --tags $$PWD/wml/WMLTagNames.in --attrs $$PWD/wml/WMLAttributeNames.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\" --factory --wrapperFactory --outputDir $$GENERATED_SOURCES_DIR
     wmlnames_a.input = WML_NAMES
     wmlnames_a.dependency_type = TYPE_C
     wmlnames_a.CONFIG = target_predeps
     wmlnames_a.variable_out = GENERATED_SOURCES
     addExtraCompilerWithHeader(wmlnames_a)
-    wmlnames_b.output = $$GENERATED_SOURCES_DIR/WMLElementFactory.cpp
+    wmlnames_b.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}WMLElementFactory.cpp
     wmlnames_b.commands = @echo -n ''
     wmlnames_b.input = SVG_NAMES
-    wmlnames_b.depends = $$GENERATED_SOURCES_DIR/WMLNames.cpp
+    wmlnames_b.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}WMLNames.cpp
     wmlnames_b.CONFIG = target_predeps
     wmlnames_b.variable_out = GENERATED_SOURCES
     addExtraCompilerWithHeader(wmlnames_b)
 }
 
+contains(DEFINES, ENABLE_XHTMLMP=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_XHTMLMP=1
+}
+
 contains(DEFINES, ENABLE_SVG=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_SVG=1
 
@@ -1609,7 +1761,6 @@ contains(DEFINES, ENABLE_SVG=1) {
         rendering/style/SVGRenderStyleDefs.cpp \
         svg/SVGZoomEvent.cpp \
         rendering/PointerEventsHitRules.cpp \
-        svg/FilterEffect.cpp \
         svg/SVGDocumentExtensions.cpp \
         svg/SVGImageLoader.cpp \
         svg/ColorDistance.cpp \
@@ -1743,10 +1894,6 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/animation/SMILTime.cpp \
         svg/animation/SMILTimeContainer.cpp \
         svg/animation/SVGSMILElement.cpp \
-        platform/graphics/filters/FEBlend.cpp \
-        platform/graphics/filters/FEColorMatrix.cpp \
-        platform/graphics/filters/FEComponentTransfer.cpp \
-        platform/graphics/filters/FEComposite.cpp \
         svg/graphics/filters/SVGFEConvolveMatrix.cpp \
         svg/graphics/filters/SVGFEDiffuseLighting.cpp \
         svg/graphics/filters/SVGFEDisplacementMap.cpp \
@@ -1759,7 +1906,8 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/graphics/filters/SVGFESpecularLighting.cpp \
         svg/graphics/filters/SVGFETile.cpp \
         svg/graphics/filters/SVGFETurbulence.cpp \
-        svg/graphics/filters/SVGFilterEffect.cpp \
+        svg/graphics/filters/SVGFilter.cpp \
+        svg/graphics/filters/SVGFilterBuilder.cpp \
         svg/graphics/filters/SVGLightSource.cpp \
         svg/graphics/SVGImage.cpp \
         svg/graphics/SVGPaintServer.cpp \
@@ -1782,6 +1930,7 @@ contains(DEFINES, ENABLE_SVG=1) {
         rendering/RenderSVGImage.cpp \
         rendering/RenderSVGInline.cpp \
         rendering/RenderSVGInlineText.cpp \
+        rendering/RenderSVGModelObject.cpp \
         rendering/RenderSVGRoot.cpp \
         rendering/RenderSVGText.cpp \
         rendering/RenderSVGTextPath.cpp \
@@ -1794,46 +1943,39 @@ contains(DEFINES, ENABLE_SVG=1) {
         rendering/SVGRenderSupport.cpp \
         rendering/SVGRootInlineBox.cpp
 
-SOURCES += \
-        svg/graphics/qt/RenderPathQt.cpp \
-        svg/graphics/qt/SVGPaintServerPatternQt.cpp \
-        svg/graphics/qt/SVGPaintServerQt.cpp \
-        svg/graphics/qt/SVGResourceFilterQt.cpp \
-        svg/graphics/qt/SVGResourceMaskerQt.cpp
-
 
         # GENERATOR 5-C:
-        svgnames_a.output = $$GENERATED_SOURCES_DIR/SVGNames.cpp
+        svgnames_a.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
         svgnames_a.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --tags $$PWD/svg/svgtags.in --attrs $$PWD/svg/svgattrs.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\" --factory --wrapperFactory --outputDir $$GENERATED_SOURCES_DIR
         svgnames_a.input = SVG_NAMES
         svgnames_a.dependency_type = TYPE_C
         svgnames_a.CONFIG = target_predeps
         svgnames_a.variable_out = GENERATED_SOURCES
         addExtraCompilerWithHeader(svgnames_a)
-        svgnames_b.output = $$GENERATED_SOURCES_DIR/SVGElementFactory.cpp
+        svgnames_b.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGElementFactory.cpp
         svgnames_b.commands = @echo -n ''
         svgnames_b.input = SVG_NAMES
-        svgnames_b.depends = $$GENERATED_SOURCES_DIR/SVGNames.cpp
+        svgnames_b.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
         svgnames_b.CONFIG = target_predeps
         svgnames_b.variable_out = GENERATED_SOURCES
         addExtraCompilerWithHeader(svgnames_b)
-        svgelementwrapper.output = $$GENERATED_SOURCES_DIR/JSSVGElementWrapperFactory.cpp
+        svgelementwrapper.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JSSVGElementWrapperFactory.cpp
         svgelementwrapper.commands = @echo -n ''
         svgelementwrapper.input = SVG_NAMES
-        svgelementwrapper.depends = $$GENERATED_SOURCES_DIR/SVGNames.cpp
+        svgelementwrapper.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
         svgelementwrapper.CONFIG = target_predeps
         svgelementwrapper.variable_out = GENERATED_SOURCES
         addExtraCompiler(svgelementwrapper)
-        svgelementwrapper_header.output = $$GENERATED_SOURCES_DIR/JSSVGElementWrapperFactory.h
+        svgelementwrapper_header.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JSSVGElementWrapperFactory.h
         svgelementwrapper_header.commands = @echo -n ''
         svgelementwrapper_header.input = SVG_NAMES
-        svgelementwrapper_header.depends = $$GENERATED_SOURCES_DIR/SVGNames.cpp
+        svgelementwrapper_header.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}SVGNames.cpp
         svgelementwrapper_header.CONFIG = target_predeps
         svgelementwrapper_header.variable_out = GENERATED_FILES
         addExtraCompiler(svgelementwrapper_header)
 
         # GENERATOR 5-D:
-        xlinknames.output = $$GENERATED_SOURCES_DIR/XLinkNames.cpp
+        xlinknames.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}XLinkNames.cpp
         xlinknames.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --attrs $$PWD/svg/xlinkattrs.in --preprocessor \"$${QMAKE_MOC} -E\" --outputDir $$GENERATED_SOURCES_DIR
         xlinknames.input = XLINK_NAMES
         xlinknames.dependency_type = TYPE_C
@@ -1842,38 +1984,52 @@ SOURCES += \
         addExtraCompilerWithHeader(xlinknames)
 
     # GENERATOR 6-A:
-    cssprops.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp
+    cssprops.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
     cssprops.input = WALDOCSSPROPS
-    cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES $$SVGCSSPROPERTIES > $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
+    cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES $$SVGCSSPROPERTIES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
     cssprops.CONFIG = target_predeps no_link
     cssprops.depend = ${QMAKE_FILE_NAME} DASHBOARDSUPPORTCSSPROPERTIES SVGCSSPROPERTIES
     addExtraCompilerWithHeader(cssprops)
 
     # GENERATOR 6-B:
-    cssvalues.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.c
+    cssvalues.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.c
     cssvalues.input = WALDOCSSVALUES
-    cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$SVGCSSVALUES > $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
+    cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$SVGCSSVALUES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
     cssvalues.CONFIG = target_predeps no_link
     cssvalues.depend = ${QMAKE_FILE_NAME} SVGCSSVALUES
     addExtraCompilerWithHeader(cssvalues)
 } else {
     # GENERATOR 6-A:
-    cssprops.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp
+    cssprops.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
     cssprops.input = WALDOCSSPROPS
-    cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES > $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
+    cssprops.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} $$DASHBOARDSUPPORTCSSPROPERTIES > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makeprop.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.gperf
     cssprops.CONFIG = target_predeps no_link
     cssprops.depend = ${QMAKE_FILE_NAME} DASHBOARDSUPPORTCSSPROPERTIES
     addExtraCompilerWithHeader(cssprops)
 
     # GENERATOR 6-B:
-    cssvalues.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.c
+    cssvalues.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.c
     cssvalues.input = WALDOCSSVALUES
-    cssvalues.commands = $(COPY_FILE) ${QMAKE_FILE_NAME} $$GENERATED_SOURCES_DIR && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
+    cssvalues.commands = perl -ne \"print lc\" ${QMAKE_FILE_NAME} > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.in && cd $$GENERATED_SOURCES_DIR && perl $$PWD/css/makevalues.pl && $(DEL_FILE) ${QMAKE_FILE_BASE}.in ${QMAKE_FILE_BASE}.strip ${QMAKE_FILE_BASE}.gperf
     cssvalues.CONFIG = target_predeps no_link
     cssvalues.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}${QMAKE_FILE_BASE}.h
     addExtraCompiler(cssvalues)
 }
 
+contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=1) {
+    FEATURE_DEFINES_JAVASCRIPT += ENABLE_JAVASCRIPT_DEBUGGER=1
+
+    IDL_BINDINGS += \
+        inspector/JavaScriptCallFrame.idl
+
+    SOURCES += \
+        bindings/js/JSJavaScriptCallFrameCustom.cpp \
+        inspector/JavaScriptCallFrame.cpp \
+        inspector/JavaScriptDebugServer.cpp \
+        inspector/JavaScriptProfile.cpp \
+        inspector/JavaScriptProfileNode.cpp
+}
+
 contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1) {
     FEATURE_DEFINES_JAVASCRIPT += ENABLE_OFFLINE_WEB_APPLICATIONS=1
 
@@ -1891,7 +2047,7 @@ SOURCES += \
 }
 
 # GENERATOR 1: IDL compiler
-idl.output = $$GENERATED_SOURCES_DIR/JS${QMAKE_FILE_BASE}.cpp
+idl.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JS${QMAKE_FILE_BASE}.cpp
 idl.variable_out = GENERATED_SOURCES
 idl.input = IDL_BINDINGS
 idl.commands = perl -I$$PWD/bindings/scripts $$PWD/bindings/scripts/generate-bindings.pl --defines \"$${FEATURE_DEFINES_JAVASCRIPT}\" --generator JS --include $$PWD/dom --include $$PWD/html --include $$PWD/xml --include $$PWD/svg --outputDir $$GENERATED_SOURCES_DIR --preprocessor \"$${QMAKE_MOC} -E\" ${QMAKE_FILE_NAME}
@@ -1899,7 +2055,7 @@ idl.CONFIG += target_predeps
 addExtraCompilerWithHeader(idl)
 
 # GENERATOR 2-A: LUT creator
-domlut.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.lut.h
+domlut.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.lut.h
 domlut.commands = perl $$PWD/../JavaScriptCore/create_hash_table ${QMAKE_FILE_NAME} -n WebCore > ${QMAKE_FILE_OUT}
 domlut.depend = ${QMAKE_FILE_NAME}
 domlut.input = DOMLUT_FILES
@@ -1907,7 +2063,7 @@ domlut.CONFIG += no_link
 addExtraCompiler(domlut)
 
 # GENERATOR 3: tokenizer (flex)
-tokenizer.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp
+tokenizer.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
 tokenizer.commands = flex -t < ${QMAKE_FILE_NAME} | perl $$PWD/css/maketokenizer > ${QMAKE_FILE_OUT}
 tokenizer.dependency_type = TYPE_C
 tokenizer.input = TOKENIZER
@@ -1915,8 +2071,8 @@ tokenizer.CONFIG += target_predeps no_link
 addExtraCompiler(tokenizer)
 
 # GENERATOR 4: CSS grammar
-cssbison.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp
-cssbison.commands = perl $$PWD/css/makegrammar.pl ${QMAKE_FILE_NAME} $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}
+cssbison.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
+cssbison.commands = perl $$PWD/css/makegrammar.pl ${QMAKE_FILE_NAME} $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}
 cssbison.depend = ${QMAKE_FILE_NAME}
 cssbison.input = CSSBISON
 cssbison.CONFIG = target_predeps
@@ -1925,25 +2081,34 @@ cssbison.variable_out = GENERATED_SOURCES
 addExtraCompilerWithHeader(cssbison)
 
 # GENERATOR 5-A:
-htmlnames.output = $$GENERATED_SOURCES_DIR/HTMLNames.cpp
-htmlnames.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --tags $$PWD/html/HTMLTagNames.in --attrs $$PWD/html/HTMLAttributeNames.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\"  --wrapperFactory --outputDir $$GENERATED_SOURCES_DIR
+htmlnames.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLNames.cpp
+htmlnames.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --tags $$PWD/html/HTMLTagNames.in --attrs $$PWD/html/HTMLAttributeNames.in --extraDefines \"$${DEFINES}\" --preprocessor \"$${QMAKE_MOC} -E\"  --factory --wrapperFactory --outputDir $$GENERATED_SOURCES_DIR
 htmlnames.input = HTML_NAMES
 htmlnames.dependency_type = TYPE_C
 htmlnames.CONFIG = target_predeps
 htmlnames.variable_out = GENERATED_SOURCES
 addExtraCompilerWithHeader(htmlnames)
 
-elementwrapperfactory.output = $$GENERATED_SOURCES_DIR/JSHTMLElementWrapperFactory.cpp
+htmlelementfactory.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLElementFactory.cpp
+htmlelementfactory.commands = @echo -n ''
+htmlelementfactory.input = HTML_NAMES
+htmlelementfactory.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLNames.cpp
+htmlelementfactory.CONFIG = target_predeps
+htmlelementfactory.variable_out = GENERATED_SOURCES
+htmlelementfactory.clean += ${QMAKE_FILE_OUT}
+addExtraCompilerWithHeader(htmlelementfactory)
+
+elementwrapperfactory.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}JSHTMLElementWrapperFactory.cpp
 elementwrapperfactory.commands = @echo -n ''
 elementwrapperfactory.input = HTML_NAMES
-elementwrapperfactory.depends = $$GENERATED_SOURCES_DIR/HTMLNames.cpp
+elementwrapperfactory.depends = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLNames.cpp
 elementwrapperfactory.CONFIG = target_predeps
 elementwrapperfactory.variable_out = GENERATED_SOURCES
 elementwrapperfactory.clean += ${QMAKE_FILE_OUT}
 addExtraCompilerWithHeader(elementwrapperfactory)
 
 # GENERATOR 5-B:
-xmlnames.output = $$GENERATED_SOURCES_DIR/XMLNames.cpp
+xmlnames.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}XMLNames.cpp
 xmlnames.commands = perl -I$$PWD/bindings/scripts $$PWD/dom/make_names.pl --attrs $$PWD/xml/xmlattrs.in --preprocessor \"$${QMAKE_MOC} -E\" --outputDir $$GENERATED_SOURCES_DIR
 xmlnames.input = XML_NAMES
 xmlnames.dependency_type = TYPE_C
@@ -1952,8 +2117,8 @@ xmlnames.variable_out = GENERATED_SOURCES
 addExtraCompilerWithHeader(xmlnames)
 
 # GENERATOR 8-A:
-entities.output = $$GENERATED_SOURCES_DIR/HTMLEntityNames.c
-entities.commands = gperf -a -L ANSI-C -C -G -c -o -t --key-positions="*" -N findEntity -D -s 2 < $$PWD/html/HTMLEntityNames.gperf > $$GENERATED_SOURCES_DIR/HTMLEntityNames.c
+entities.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLEntityNames.c
+entities.commands = gperf -a -L ANSI-C -C -G -c -o -t --key-positions="*" -N findEntity -D -s 2 < $$PWD/html/HTMLEntityNames.gperf > $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}HTMLEntityNames.c
 entities.input = ENTITIES_GPERF
 entities.dependency_type = TYPE_C
 entities.CONFIG = target_predeps no_link
@@ -1961,7 +2126,7 @@ entities.clean = ${QMAKE_FILE_OUT}
 addExtraCompiler(entities)
 
 # GENERATOR 8-B:
-doctypestrings.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp
+doctypestrings.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
 doctypestrings.input = DOCTYPESTRINGS
 doctypestrings.commands = perl -e \"print \'$${LITERAL_HASH}include <string.h>\';\" > ${QMAKE_FILE_OUT} && echo // bogus >> ${QMAKE_FILE_OUT} && gperf -CEot -L ANSI-C --key-positions="*" -N findDoctypeEntry -F ,PubIDInfo::eAlmostStandards,PubIDInfo::eAlmostStandards < ${QMAKE_FILE_NAME} >> ${QMAKE_FILE_OUT}
 doctypestrings.dependency_type = TYPE_C
@@ -1970,14 +2135,14 @@ doctypestrings.clean = ${QMAKE_FILE_OUT}
 addExtraCompiler(doctypestrings)
 
 # GENERATOR 8-C:
-colordata.output = $$GENERATED_SOURCES_DIR/ColorData.c
+colordata.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}ColorData.c
 colordata.commands = perl -e \"print \'$${LITERAL_HASH}include <string.h>\';\" > ${QMAKE_FILE_OUT} && echo // bogus >> ${QMAKE_FILE_OUT} && gperf -CDEot -L ANSI-C --key-positions="*" -N findColor -D -s 2 < ${QMAKE_FILE_NAME} >> ${QMAKE_FILE_OUT}
 colordata.input = COLORDAT_GPERF
 colordata.CONFIG = target_predeps no_link
 addExtraCompiler(colordata)
 
 # GENERATOR 9:
-stylesheets.output = $$GENERATED_SOURCES_DIR/UserAgentStyleSheetsData.cpp
+stylesheets.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}UserAgentStyleSheetsData.cpp
 stylesheets.commands = perl $$PWD/css/make-css-file-arrays.pl --preprocessor \"$${QMAKE_MOC} -E\" ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}UserAgentStyleSheets.h ${QMAKE_FILE_OUT} $$STYLESHEETS_EMBED
 STYLESHEETS_EMBED_GENERATOR_SCRIPT = $$PWD/css/make-css-file-arrays.pl
 stylesheets.input = STYLESHEETS_EMBED_GENERATOR_SCRIPT
@@ -1985,11 +2150,11 @@ stylesheets.depends = $$STYLESHEETS_EMBED
 stylesheets.CONFIG = target_predeps
 stylesheets.variable_out = GENERATED_SOURCES
 stylesheets.clean = ${QMAKE_FILE_OUT} ${QMAKE_VAR_GENERATED_SOURCES_DIR_SLASH}UserAgentStyleSheets.h
-addExtraCompilerWithHeader(stylesheets, $$GENERATED_SOURCES_DIR/UserAgentStyleSheets.h)
+addExtraCompilerWithHeader(stylesheets, $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}UserAgentStyleSheets.h)
 
 # GENERATOR 10: XPATH grammar
-xpathbison.output = $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp
-xpathbison.commands = bison -d -p xpathyy ${QMAKE_FILE_NAME} -o ${QMAKE_FILE_BASE}.tab.c && $(MOVE) ${QMAKE_FILE_BASE}.tab.c $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.cpp && $(MOVE) ${QMAKE_FILE_BASE}.tab.h $$GENERATED_SOURCES_DIR/${QMAKE_FILE_BASE}.h
+xpathbison.output = $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
+xpathbison.commands = bison -d -p xpathyy ${QMAKE_FILE_NAME} -o $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp && $(MOVE) $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.h $${GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.h
 xpathbison.depend = ${QMAKE_FILE_NAME}
 xpathbison.input = XPATHBISON
 xpathbison.CONFIG = target_predeps
@@ -2028,10 +2193,32 @@ HEADERS += $$WEBKIT_API_HEADERS
         lib_replace.replace = $$[QT_INSTALL_LIBS]
         QMAKE_PKGCONFIG_INSTALL_REPLACE += lib_replace
     }
+
+    mac {
+        !static:contains(QT_CONFIG, qt_framework):!CONFIG(webkit_no_framework) {
+            !build_pass {
+                message("Building QtWebKit as a framework, as that's how Qt was built. You can")
+                message("override this by passing CONFIG+=webkit_no_framework to build-webkit.")
+            } else {
+                debug_and_release:CONFIG(debug, debug|release) {
+                    TARGET = $$qtLibraryTarget($$TARGET)
+                }
+            }
+
+            CONFIG += lib_bundle qt_no_framework_direct_includes qt_framework
+            FRAMEWORK_HEADERS.version = Versions
+            FRAMEWORK_HEADERS.files = $$WEBKIT_API_HEADERS
+            FRAMEWORK_HEADERS.path = Headers
+            QMAKE_BUNDLE_DATA += FRAMEWORK_HEADERS
+        }
+
+        QMAKE_LFLAGS_SONAME = "$${QMAKE_LFLAGS_SONAME}$${DESTDIR}$${QMAKE_DIR_SEP}"
+    }
 }
 
 CONFIG(QTDIR_build):isEqual(QT_MAJOR_VERSION, 4):greaterThan(QT_MINOR_VERSION, 4) {
     # start with 4.5
+    # Remove the following 2 lines if you want debug information in WebCore
     CONFIG -= separate_debug_info
     CONFIG += no_debug_info
 }
diff --git a/src/3rdparty/webkit/WebCore/WebCorePrefix.h b/src/3rdparty/webkit/WebCore/WebCorePrefix.h
index aaa6a0f..e857ecc 100644
--- a/src/3rdparty/webkit/WebCore/WebCorePrefix.h
+++ b/src/3rdparty/webkit/WebCore/WebCorePrefix.h
@@ -100,16 +100,6 @@
 #include <CoreFoundation/CoreFoundation.h>
 #include <CoreServices/CoreServices.h>
 
-#include <AvailabilityMacros.h>
-
-#if defined(__APPLE__)
-#if MAC_OS_X_VERSION_MAX_ALLOWED <= MAC_OS_X_VERSION_10_4
-#define BUILDING_ON_TIGER 1
-#elif MAC_OS_X_VERSION_MAX_ALLOWED <= MAC_OS_X_VERSION_10_5
-#define BUILDING_ON_LEOPARD 1
-#endif
-#endif
-
 #ifdef __OBJC__
 #import <Cocoa/Cocoa.h>
 #endif
diff --git a/src/3rdparty/webkit/WebCore/page/AXObjectCache.cpp b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.cpp
index d9c4c9a..ec250ed 100644
--- a/src/3rdparty/webkit/WebCore/page/AXObjectCache.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.cpp
@@ -29,6 +29,9 @@
 #include "config.h"
 #include "AXObjectCache.h"
 
+#include "AccessibilityARIAGrid.h"
+#include "AccessibilityARIAGridRow.h"
+#include "AccessibilityARIAGridCell.h"
 #include "AccessibilityList.h"
 #include "AccessibilityListBox.h"
 #include "AccessibilityListBoxOption.h"
@@ -41,6 +44,7 @@
 #include "AccessibilityTableRow.h"
 #include "HTMLNames.h"
 #include "RenderObject.h"
+#include "RenderView.h"
 
 #include <wtf/PassRefPtr.h>
 
@@ -51,6 +55,11 @@ using namespace HTMLNames;
 bool AXObjectCache::gAccessibilityEnabled = false;
 bool AXObjectCache::gAccessibilityEnhancedUserInterfaceEnabled = false;
 
+AXObjectCache::AXObjectCache()
+    : m_notificationPostTimer(this, &AXObjectCache::notificationPostTimerFired)
+{
+}
+
 AXObjectCache::~AXObjectCache()
 {
     HashMap<AXID, RefPtr<AccessibilityObject> >::iterator end = m_objects.end();
@@ -58,6 +67,7 @@ AXObjectCache::~AXObjectCache()
         AccessibilityObject* obj = (*it).second.get();
         detachWrapper(obj);
         obj->detach();
+        removeAXID(obj);
     }
 }
 
@@ -66,39 +76,71 @@ AccessibilityObject* AXObjectCache::get(RenderObject* renderer)
     if (!renderer)
         return 0;
     
-    RefPtr<AccessibilityObject> obj = 0;
+    AccessibilityObject* obj = 0;
     AXID axID = m_renderObjectMapping.get(renderer);
     ASSERT(!HashTraits<AXID>::isDeletedValue(axID));
 
     if (axID)
         obj = m_objects.get(axID).get();
+    
+    return obj;
+}
+    
+bool AXObjectCache::nodeIsAriaType(Node* node, String role)
+{
+    if (!node || !node->isElementNode())
+        return false;
+    
+    return equalIgnoringCase(static_cast<Element*>(node)->getAttribute(roleAttr), role);
+}
+
+AccessibilityObject* AXObjectCache::getOrCreate(RenderObject* renderer)
+{
+    if (!renderer)
+        return 0;
+    
+    AccessibilityObject* obj = get(renderer);
 
-    Node* element = renderer->element();
     if (!obj) {
+        Node* node = renderer->node();
+        RefPtr<AccessibilityObject> newObj = 0;
         if (renderer->isListBox())
-            obj = AccessibilityListBox::create(renderer);
-        else if (element && (element->hasTagName(ulTag) || element->hasTagName(olTag) || element->hasTagName(dlTag)))
-            obj = AccessibilityList::create(renderer);
+            newObj = AccessibilityListBox::create(renderer);
+        else if (node && (node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(dlTag)))
+            newObj = AccessibilityList::create(renderer);
+        
+        // aria tables
+        else if (nodeIsAriaType(node, "grid"))
+            newObj = AccessibilityARIAGrid::create(renderer);
+        else if (nodeIsAriaType(node, "row"))
+            newObj = AccessibilityARIAGridRow::create(renderer);
+        else if (nodeIsAriaType(node, "gridcell") || nodeIsAriaType(node, "columnheader") || nodeIsAriaType(node, "rowheader"))
+            newObj = AccessibilityARIAGridCell::create(renderer);
+
+        // standard tables
         else if (renderer->isTable())
-            obj = AccessibilityTable::create(renderer);
+            newObj = AccessibilityTable::create(renderer);
         else if (renderer->isTableRow())
-            obj = AccessibilityTableRow::create(renderer);
+            newObj = AccessibilityTableRow::create(renderer);
         else if (renderer->isTableCell())
-            obj = AccessibilityTableCell::create(renderer);
+            newObj = AccessibilityTableCell::create(renderer);
+
         else
-            obj = AccessibilityRenderObject::create(renderer);
+            newObj = AccessibilityRenderObject::create(renderer);
         
-        getAXID(obj.get());
+        obj = newObj.get();
         
-        m_renderObjectMapping.set(renderer, obj.get()->axObjectID());
-        m_objects.set(obj.get()->axObjectID(), obj);    
-        attachWrapper(obj.get());
+        getAXID(obj);
+        
+        m_renderObjectMapping.set(renderer, obj->axObjectID());
+        m_objects.set(obj->axObjectID(), obj);    
+        attachWrapper(obj);
     }
     
-    return obj.get();
+    return obj;
 }
 
-AccessibilityObject* AXObjectCache::get(AccessibilityRole role)
+AccessibilityObject* AXObjectCache::getOrCreate(AccessibilityRole role)
 {
     RefPtr<AccessibilityObject> obj = 0;
     
@@ -186,6 +228,9 @@ AXID AXObjectCache::getAXID(AccessibilityObject* obj)
 
 void AXObjectCache::removeAXID(AccessibilityObject* obj)
 {
+    if (!obj)
+        return;
+    
     AXID objID = obj->axObjectID();
     if (objID == 0)
         return;
@@ -208,11 +253,68 @@ void AXObjectCache::childrenChanged(RenderObject* renderer)
     if (obj)
         obj->childrenChanged();
 }
+    
+void AXObjectCache::notificationPostTimerFired(Timer<AXObjectCache>*)
+{
+    m_notificationPostTimer.stop();
 
+    unsigned i = 0, count = m_notificationsToPost.size();
+    for (i = 0; i < count; ++i) {
+        AccessibilityObject* obj = m_notificationsToPost[i].first;
+#ifndef NDEBUG
+        // Make sure none of the render views are in the process of being layed out.
+        // Notifications should only be sent after the renderer has finished
+        if (obj->isAccessibilityRenderObject()) {
+            AccessibilityRenderObject* renderObj = static_cast<AccessibilityRenderObject*>(obj);
+            RenderObject* renderer = renderObj->renderer();
+            if (renderer && renderer->view())
+                ASSERT(!renderer->view()->layoutState());
+        }
+#endif
+        
+        postPlatformNotification(obj, m_notificationsToPost[i].second);
+    }
+    
+    m_notificationsToPost.clear();
+}
+    
 #if HAVE(ACCESSIBILITY)
+void AXObjectCache::postNotification(RenderObject* renderer, const String& message, bool postToElement)
+{
+    // Notifications for text input objects are sent to that object.
+    // All others are sent to the top WebArea.
+    if (!renderer)
+        return;
+    
+    // Get an accessibility object that already exists. One should not be created here
+    // because a render update may be in progress and creating an AX object can re-trigger a layout
+    RefPtr<AccessibilityObject> obj = get(renderer);
+    while (!obj && renderer) {
+        renderer = renderer->parent();
+        obj = get(renderer); 
+    }
+    
+    if (!renderer)
+        return;
+
+    if (obj && !postToElement)
+        obj = obj->observableObject();
+    
+    Document* document = renderer->document();
+    if (!obj && document)
+        obj = get(document->renderer());
+    
+    if (!obj)
+        return;
+
+    m_notificationsToPost.append(make_pair(obj.get(), message));
+    if (!m_notificationPostTimer.isActive())
+        m_notificationPostTimer.startOneShot(0);
+}
+
 void AXObjectCache::selectedChildrenChanged(RenderObject* renderer)
 {
-    postNotificationToElement(renderer, "AXSelectedChildrenChanged");
+    postNotification(renderer, "AXSelectedChildrenChanged", true);
 }
 #endif
 
@@ -221,7 +323,7 @@ void AXObjectCache::handleActiveDescendantChanged(RenderObject* renderer)
 {
     if (!renderer)
         return;
-    AccessibilityObject* obj = get(renderer);
+    AccessibilityObject* obj = getOrCreate(renderer);
     if (obj)
         obj->handleActiveDescendantChanged();
 }
@@ -230,7 +332,7 @@ void AXObjectCache::handleAriaRoleChanged(RenderObject* renderer)
 {
     if (!renderer)
         return;
-    AccessibilityObject* obj = get(renderer);
+    AccessibilityObject* obj = getOrCreate(renderer);
     if (obj && obj->isAccessibilityRenderObject())
         static_cast<AccessibilityRenderObject*>(obj)->setAriaRole();
 }
diff --git a/src/3rdparty/webkit/WebCore/page/AXObjectCache.h b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.h
index 5e95f74..904283c 100644
--- a/src/3rdparty/webkit/WebCore/page/AXObjectCache.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AXObjectCache.h
@@ -27,6 +27,8 @@
 #define AXObjectCache_h
 
 #include "AccessibilityObject.h"
+#include "EventHandler.h"
+#include "Timer.h"
 #include <limits.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
@@ -57,26 +59,33 @@ namespace WebCore {
 
     class AXObjectCache {
     public:
+        AXObjectCache();
         ~AXObjectCache();
         
         // to be used with render objects
-        AccessibilityObject* get(RenderObject*);
+        AccessibilityObject* getOrCreate(RenderObject*);
         
         // used for objects without backing elements
-        AccessibilityObject* get(AccessibilityRole);
+        AccessibilityObject* getOrCreate(AccessibilityRole);
+        
+        // will only return the AccessibilityObject if it already exists
+        AccessibilityObject* get(RenderObject*);
         
         void remove(RenderObject*);
         void remove(AXID);
 
         void detachWrapper(AccessibilityObject*);
         void attachWrapper(AccessibilityObject*);
-        void postNotification(RenderObject*, const String&);
-        void postNotificationToElement(RenderObject*, const String&);
+        void postNotification(RenderObject*, const String&, bool postToElement);
+        void postPlatformNotification(AccessibilityObject*, const String&);
         void childrenChanged(RenderObject*);
         void selectedChildrenChanged(RenderObject*);
         void handleActiveDescendantChanged(RenderObject*);
         void handleAriaRoleChanged(RenderObject*);
         void handleFocusedUIElementChanged();
+#if PLATFORM(GTK)
+        void handleFocusedUIElementChangedWithRenderers(RenderObject*, RenderObject*);
+#endif
         static void enableAccessibility() { gAccessibilityEnabled = true; }
         static void enableEnhancedUserInterfaceAccessibility() { gAccessibilityEnhancedUserInterfaceEnabled = true; }
         
@@ -94,7 +103,12 @@ namespace WebCore {
         
         HashSet<AXID> m_idsInUse;
         
+        Timer<AXObjectCache> m_notificationPostTimer;
+        Vector<pair<AccessibilityObject*, const String> > m_notificationsToPost;
+        void notificationPostTimerFired(Timer<AXObjectCache>*);
+        
         AXID getAXID(AccessibilityObject*);
+        bool nodeIsAriaType(Node* node, String role);
     };
 
 #if !HAVE(ACCESSIBILITY)
@@ -104,8 +118,11 @@ namespace WebCore {
     inline void AXObjectCache::detachWrapper(AccessibilityObject*) { }
     inline void AXObjectCache::attachWrapper(AccessibilityObject*) { }
     inline void AXObjectCache::selectedChildrenChanged(RenderObject*) { }
-    inline void AXObjectCache::postNotification(RenderObject*, const String&) { }
-    inline void AXObjectCache::postNotificationToElement(RenderObject*, const String&) { }
+    inline void AXObjectCache::postNotification(RenderObject*, const String&, bool postToElement) { }
+    inline void AXObjectCache::postPlatformNotification(AccessibilityObject*, const String&) { }
+#if PLATFORM(GTK)
+    inline void AXObjectCache::handleFocusedUIElementChangedWithRenderers(RenderObject*, RenderObject*) { }
+#endif
 #endif
 
 }
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.cpp
new file mode 100644
index 0000000..69c4512
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.cpp
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AccessibilityARIAGrid.h"
+
+#include "AccessibilityTableCell.h"
+#include "AccessibilityTableColumn.h"
+#include "AccessibilityTableHeaderContainer.h"
+#include "AccessibilityTableRow.h"
+#include "AXObjectCache.h"
+#include "RenderObject.h"
+
+using namespace std;
+
+namespace WebCore {
+
+AccessibilityARIAGrid::AccessibilityARIAGrid(RenderObject* renderer)
+    : AccessibilityTable(renderer)
+{
+#if ACCESSIBILITY_TABLES
+    m_isAccessibilityTable = true;
+#else
+    m_isAccessibilityTable = false;
+#endif
+}
+
+AccessibilityARIAGrid::~AccessibilityARIAGrid()
+{
+}
+
+PassRefPtr<AccessibilityARIAGrid> AccessibilityARIAGrid::create(RenderObject* renderer)
+{
+    return adoptRef(new AccessibilityARIAGrid(renderer));
+}
+
+void AccessibilityARIAGrid::addChild(AccessibilityObject* child, HashSet<AccessibilityObject*>& appendedRows, unsigned& columnCount)
+{
+    if (!child || !child->isTableRow() || child->ariaRoleAttribute() != RowRole)
+        return;
+        
+    AccessibilityTableRow* row = static_cast<AccessibilityTableRow*>(child);
+    if (appendedRows.contains(row))
+        return;
+        
+    // store the maximum number of columns
+    unsigned rowCellCount = row->children().size();
+    if (rowCellCount > columnCount)
+        columnCount = rowCellCount;
+    
+    row->setRowIndex((int)m_rows.size());        
+    m_rows.append(row);
+    m_children.append(row);
+    appendedRows.add(row);
+}
+    
+void AccessibilityARIAGrid::addChildren()
+{
+    ASSERT(!m_haveChildren); 
+    
+    if (!isDataTable()) {
+        AccessibilityRenderObject::addChildren();
+        return;
+    }
+    
+    m_haveChildren = true;
+    if (!m_renderer)
+        return;
+    
+    AXObjectCache* axCache = m_renderer->document()->axObjectCache();
+    
+    // add only rows that are labeled as aria rows
+    HashSet<AccessibilityObject*> appendedRows;
+    unsigned columnCount = 0;
+    for (RefPtr<AccessibilityObject> child = firstChild(); child; child = child->nextSibling()) {
+
+        // in case the render tree doesn't match the expected ARIA hierarchy, look at the children
+        if (child->accessibilityIsIgnored()) {
+            if (!child->hasChildren())
+                child->addChildren();
+            
+            AccessibilityChildrenVector children = child->children();
+            unsigned length = children.size();
+            for (unsigned i = 0; i < length; ++i)
+                addChild(children[i].get(), appendedRows, columnCount);
+        } else
+            addChild(child.get(), appendedRows, columnCount);            
+    }
+    
+    // make the columns based on the number of columns in the first body
+    for (unsigned i = 0; i < columnCount; ++i) {
+        AccessibilityTableColumn* column = static_cast<AccessibilityTableColumn*>(axCache->getOrCreate(ColumnRole));
+        column->setColumnIndex((int)i);
+        column->setParentTable(this);
+        m_columns.append(column);
+        m_children.append(column);
+    }
+    
+    AccessibilityObject* headerContainerObject = headerContainer();
+    if (headerContainerObject)
+        m_children.append(headerContainerObject);
+}
+    
+AccessibilityTableCell* AccessibilityARIAGrid::cellForColumnAndRow(unsigned column, unsigned row)
+{
+    if (!m_renderer)
+        return 0;
+    
+    if (!hasChildren())
+        addChildren();
+    
+    if (column >= columnCount() || row >= rowCount())
+        return 0;
+    
+    AccessibilityObject *tableRow = m_rows[row].get();
+    if (!tableRow)
+        return 0;
+    
+    AccessibilityChildrenVector children = tableRow->children();
+    // in case this row had fewer columns than other rows
+    AccessibilityObject* tableCell = 0;
+    if (column >= children.size())
+        return 0;
+
+    tableCell = children[column].get();
+    return static_cast<AccessibilityTableCell*>(tableCell);
+}
+    
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.h
new file mode 100644
index 0000000..32c8ce9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGrid.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AccessibilityARIAGrid_h
+#define AccessibilityARIAGrid_h
+
+#include "AccessibilityTable.h"
+
+namespace WebCore {
+    
+class String;
+class AccessibilityTableCell;
+class AccessibilityTableHeaderContainer;
+
+class AccessibilityARIAGrid : public AccessibilityTable {
+    
+private:
+    AccessibilityARIAGrid(RenderObject*);
+public:
+    static PassRefPtr<AccessibilityARIAGrid> create(RenderObject*);
+    virtual ~AccessibilityARIAGrid();
+    
+    virtual bool isAriaTable() const { return true; }    
+    
+    virtual void addChildren();
+    
+    virtual AccessibilityTableCell* cellForColumnAndRow(unsigned column, unsigned row);
+
+private:
+    void addChild(AccessibilityObject* object, HashSet<AccessibilityObject*>& appendedRows, unsigned& columnCount);
+};
+
+} // namespace WebCore 
+
+#endif // AccessibilityARIAGrid_h
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridCell.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridCell.cpp
new file mode 100644
index 0000000..1771bb8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridCell.cpp
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AccessibilityARIAGridCell.h"
+
+#include "AccessibilityObject.h"
+#include "AccessibilityTableRow.h"
+
+using namespace std;
+
+namespace WebCore {
+    
+AccessibilityARIAGridCell::AccessibilityARIAGridCell(RenderObject* renderer)
+    : AccessibilityTableCell(renderer)
+{
+}
+
+AccessibilityARIAGridCell::~AccessibilityARIAGridCell()
+{
+}
+
+PassRefPtr<AccessibilityARIAGridCell> AccessibilityARIAGridCell::create(RenderObject* renderer)
+{
+    return adoptRef(new AccessibilityARIAGridCell(renderer));
+}
+
+AccessibilityObject* AccessibilityARIAGridCell::parentTable() const
+{
+    AccessibilityObject* parent = parentObjectUnignored();
+    if (!parent || !parent->isTableRow())
+        return 0;
+    
+    parent = parent->parentObjectUnignored();
+    if (!parent || !parent->isDataTable())
+        return 0;
+    
+    return parent;
+}
+    
+void AccessibilityARIAGridCell::rowIndexRange(pair<int, int>& rowRange)
+{
+    AccessibilityObject* parent = parentObjectUnignored();
+    if (!parent || !parent->isTableRow())
+        return;
+
+    // as far as I can tell, grid cells cannot span rows
+    rowRange.first = static_cast<AccessibilityTableRow*>(parent)->rowIndex();
+    rowRange.second = 1;    
+}
+
+void AccessibilityARIAGridCell::columnIndexRange(pair<int, int>& columnRange)
+{
+    AccessibilityObject* parent = parentObjectUnignored();
+    if (!parent || !parent->isTableRow())
+        return;
+    
+    AccessibilityChildrenVector siblings = parent->children();
+    unsigned childrenSize = siblings.size();
+    for (unsigned k = 0; k < childrenSize; ++k) {
+        if (siblings[k].get() == this) {
+            columnRange.first = k;
+            break;
+        }
+    }
+    
+    // as far as I can tell, grid cells cannot span columns
+    columnRange.second = 1;    
+}
+  
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridCell.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridCell.h
new file mode 100644
index 0000000..2923de8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridCell.h
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AccessibilityARIAGridCell_h
+#define AccessibilityARIAGridCell_h
+
+#include "AccessibilityTableCell.h"
+
+namespace WebCore {
+    
+class AccessibilityARIAGridCell : public AccessibilityTableCell {
+    
+private:
+    AccessibilityARIAGridCell(RenderObject*);
+public:
+    static PassRefPtr<AccessibilityARIAGridCell> create(RenderObject*);
+    virtual ~AccessibilityARIAGridCell();
+    
+    // fills in the start location and row span of cell
+    virtual void rowIndexRange(pair<int, int>& rowRange);
+    // fills in the start location and column span of cell
+    virtual void columnIndexRange(pair<int, int>& columnRange);
+    
+protected:
+    virtual AccessibilityObject* parentTable() const;
+}; 
+    
+} // namespace WebCore 
+
+#endif // AccessibilityARIAGridCell_h
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.cpp
new file mode 100644
index 0000000..6e1f1c8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.cpp
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "AccessibilityARIAGridRow.h"
+
+#include "AccessibilityObject.h"
+#include "RenderObject.h"
+
+using namespace std;
+
+namespace WebCore {
+    
+AccessibilityARIAGridRow::AccessibilityARIAGridRow(RenderObject* renderer)
+    : AccessibilityTableRow(renderer)
+{
+}
+
+AccessibilityARIAGridRow::~AccessibilityARIAGridRow()
+{
+}
+
+PassRefPtr<AccessibilityARIAGridRow> AccessibilityARIAGridRow::create(RenderObject* renderer)
+{
+    return adoptRef(new AccessibilityARIAGridRow(renderer));
+}
+
+AccessibilityObject* AccessibilityARIAGridRow::parentTable() const
+{
+    AccessibilityObject* parent = parentObjectUnignored();
+    if (!parent->isDataTable())
+        return 0;
+    
+    return parent;
+}
+
+AccessibilityObject* AccessibilityARIAGridRow::headerObject()
+{
+    AccessibilityChildrenVector rowChildren = children();
+    unsigned childrenCount = rowChildren.size();
+    for (unsigned i = 0; i < childrenCount; ++i) {
+        AccessibilityObject* cell = rowChildren[i].get();
+        if (cell->ariaRoleAttribute() == RowHeaderRole)
+            return cell;
+    }
+    
+    return 0;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.h
new file mode 100644
index 0000000..c2ca8b8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityARIAGridRow.h
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AccessibilityARIAGridRow_h
+#define AccessibilityARIAGridRow_h
+
+#include "AccessibilityTableRow.h"
+
+namespace WebCore {
+    
+class AccessibilityARIAGridRow : public AccessibilityTableRow {
+    
+private:
+    AccessibilityARIAGridRow(RenderObject*);
+public:
+    static PassRefPtr<AccessibilityARIAGridRow> create(RenderObject*);
+    virtual ~AccessibilityARIAGridRow();
+    
+    virtual AccessibilityObject* headerObject();
+    virtual AccessibilityObject* parentTable() const;    
+}; 
+    
+} // namespace WebCore 
+
+#endif // AccessibilityARIAGridRow_h
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityImageMapLink.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.cpp
index 5557446..943122e 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityImageMapLink.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.cpp
@@ -65,7 +65,7 @@ AccessibilityObject* AccessibilityImageMapLink::parentObject() const
     if (!m_mapElement || !m_mapElement->renderer())
         return 0;
     
-    return m_mapElement->document()->axObjectCache()->get(m_mapElement->renderer());
+    return m_mapElement->document()->axObjectCache()->getOrCreate(m_mapElement->renderer());
 }
     
 Element* AccessibilityImageMapLink::actionElement() const
@@ -78,6 +78,14 @@ Element* AccessibilityImageMapLink::anchorElement() const
     return m_areaElement;
 }
 
+KURL AccessibilityImageMapLink::url() const
+{
+    if (!m_areaElement)
+        return KURL();
+    
+    return m_areaElement->href();
+}
+    
 String AccessibilityImageMapLink::accessibilityDescription() const
 {
     if (!m_areaElement)
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityImageMapLink.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.h
index 7fc8d3c..2c27e46 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityImageMapLink.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityImageMapLink.h
@@ -49,11 +49,12 @@ public:
         
     virtual AccessibilityRole roleValue() const { return WebCoreLinkRole; }
     virtual bool accessibilityIsIgnored() const { return false; }
+    virtual bool isEnabled() const { return true; }
 
     virtual AccessibilityObject* parentObject() const;
     virtual Element* anchorElement() const;
     virtual Element* actionElement() const;
-    
+    virtual KURL url() const;
     virtual bool isLink() const { return true; } 
     virtual String title() const;
     virtual String accessibilityDescription() const;
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityList.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.cpp
index ad71ff4..3b7c7a4 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityList.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.cpp
@@ -56,10 +56,10 @@ PassRefPtr<AccessibilityList> AccessibilityList::create(RenderObject* renderer)
 bool AccessibilityList::accessibilityIsIgnored() const
 {
     // lists don't appear on tiger/leopard on the mac
-#if PLATFORM(MAC) && (defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD))
-    return true;
-#else
+#if ACCESSIBILITY_LISTS
     return false;
+#else
+    return true;
 #endif
 }    
     
@@ -68,8 +68,8 @@ bool AccessibilityList::isUnorderedList() const
     if (!m_renderer)
         return false;
     
-    Node* element = m_renderer->element();
-    return element && element->hasTagName(ulTag);
+    Node* node = m_renderer->node();
+    return node && node->hasTagName(ulTag);
 }
 
 bool AccessibilityList::isOrderedList() const
@@ -77,8 +77,8 @@ bool AccessibilityList::isOrderedList() const
     if (!m_renderer)
         return false;
     
-    Node* element = m_renderer->element();
-    return element && element->hasTagName(olTag);    
+    Node* node = m_renderer->node();
+    return node && node->hasTagName(olTag);    
 }
 
 bool AccessibilityList::isDefinitionList() const
@@ -86,8 +86,8 @@ bool AccessibilityList::isDefinitionList() const
     if (!m_renderer)
         return false;
     
-    Node* element = m_renderer->element();
-    return element && element->hasTagName(dlTag);    
+    Node* node = m_renderer->node();
+    return node && node->hasTagName(dlTag);    
 }
     
     
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityList.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.h
index 315ccac..89befb2 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityList.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityList.h
@@ -29,6 +29,12 @@
 #ifndef AccessibilityList_h
 #define AccessibilityList_h
 
+#if PLATFORM(MAC) && (defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD))
+#define ACCESSIBILITY_LISTS 0
+#else
+#define ACCESSIBILITY_LISTS 1
+#endif
+
 #include "AccessibilityRenderObject.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityListBox.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.cpp
index b94ccef..e38aff5 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityListBox.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.cpp
@@ -74,10 +74,12 @@ void AccessibilityListBox::addChildren()
     
     m_haveChildren = true;
     
-    const Vector<HTMLElement*>& listItems = static_cast<HTMLSelectElement*>(selectNode)->listItems();
+    const Vector<Element*>& listItems = static_cast<HTMLSelectElement*>(selectNode)->listItems();
     unsigned length = listItems.size();
     for (unsigned i = 0; i < length; i++) {
-        AccessibilityObject* listOption = listBoxOptionAccessibilityObject(listItems[i]);
+        // The cast to HTMLElement below is safe because the only other possible listItem type
+        // would be a WMLElement, but WML builds don't use accessbility features at all.
+        AccessibilityObject* listOption = listBoxOptionAccessibilityObject(static_cast<HTMLElement*>(listItems[i]));
         if (listOption)
             m_children.append(listOption);
     }
@@ -144,7 +146,7 @@ AccessibilityObject* AccessibilityListBox::listBoxOptionAccessibilityObject(HTML
     if (!element || element->hasTagName(hrTag))
         return 0;
     
-    AccessibilityObject* listBoxObject = m_renderer->document()->axObjectCache()->get(ListBoxOptionRole);
+    AccessibilityObject* listBoxObject = m_renderer->document()->axObjectCache()->getOrCreate(ListBoxOptionRole);
     static_cast<AccessibilityListBoxOption*>(listBoxObject)->setHTMLElement(element);
     
     return listBoxObject;
@@ -157,21 +159,23 @@ AccessibilityObject* AccessibilityListBox::doAccessibilityHitTest(const IntPoint
     if (!m_renderer)
         return 0;
     
-    Node* element = m_renderer->element();
-    if (!element)
+    Node* node = m_renderer->node();
+    if (!node)
         return 0;
     
     IntRect parentRect = boundingBoxRect();
     
-    const Vector<HTMLElement*>& listItems = static_cast<HTMLSelectElement*>(element)->listItems();
+    const Vector<Element*>& listItems = static_cast<HTMLSelectElement*>(node)->listItems();
     unsigned length = listItems.size();
     for (unsigned i = 0; i < length; i++) {
         IntRect rect = static_cast<RenderListBox*>(m_renderer)->itemBoundingBoxRect(parentRect.x(), parentRect.y(), i);
+        // The cast to HTMLElement below is safe because the only other possible listItem type
+        // would be a WMLElement, but WML builds don't use accessbility features at all.
         if (rect.contains(point))
-            return listBoxOptionAccessibilityObject(listItems[i]);
+            return listBoxOptionAccessibilityObject(static_cast<HTMLElement*>(listItems[i]));
     }
     
-    return axObjectCache()->get(m_renderer);
+    return axObjectCache()->getOrCreate(m_renderer);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityListBox.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.h
index 3f3352d..3f3352d 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityListBox.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBox.h
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityListBoxOption.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.cpp
index fedfe91..a5cd5da 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityListBoxOption.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.cpp
@@ -97,7 +97,7 @@ IntRect AccessibilityListBoxOption::elementRect() const
     if (!listBoxRenderer)
         return rect;
     
-    IntRect parentRect = listBoxRenderer->document()->axObjectCache()->get(listBoxRenderer)->boundingBoxRect();
+    IntRect parentRect = listBoxRenderer->document()->axObjectCache()->getOrCreate(listBoxRenderer)->boundingBoxRect();
     int index = listBoxOptionIndex();
     if (index != -1)
         rect = static_cast<RenderListBox*>(listBoxRenderer)->itemBoundingBoxRect(parentRect.x(), parentRect.y(), index);
@@ -153,7 +153,7 @@ AccessibilityObject* AccessibilityListBoxOption::parentObject() const
     if (!parentNode)
         return 0;
     
-    return m_optionElement->document()->axObjectCache()->get(parentNode->renderer());
+    return m_optionElement->document()->axObjectCache()->getOrCreate(parentNode->renderer());
 }
 
 void AccessibilityListBoxOption::setSelected(bool selected)
@@ -195,7 +195,7 @@ int AccessibilityListBoxOption::listBoxOptionIndex() const
     if (!selectElement) 
         return -1;
     
-    const Vector<HTMLElement*>& listItems = selectElement->listItems();
+    const Vector<Element*>& listItems = selectElement->listItems();
     unsigned length = listItems.size();
     for (unsigned i = 0; i < length; i++)
         if (listItems[i] == m_optionElement)
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityListBoxOption.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.h
index 1b588cd..1b588cd 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityListBoxOption.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityListBoxOption.h
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityObject.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp
index 0b072cf..a6cd62d 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityObject.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.cpp
@@ -75,7 +75,6 @@ AccessibilityObject::~AccessibilityObject()
 
 void AccessibilityObject::detach()
 {
-    removeAXObjectID();
 #if HAVE(ACCESSIBILITY)
     setWrapper(0);
 #endif    
@@ -114,6 +113,11 @@ AccessibilityObject* AccessibilityObject::parentObjectUnignored() const
     return parent;
 }
 
+AccessibilityObject* AccessibilityObject::parentObjectIfExists() const
+{
+    return 0;
+}
+    
 int AccessibilityObject::layoutCount() const
 {
     return 0;
@@ -231,9 +235,9 @@ const AtomicString& AccessibilityObject::accessKey() const
     return nullAtom;
 }
 
-Selection AccessibilityObject::selection() const
+VisibleSelection AccessibilityObject::selection() const
 {
-    return Selection();
+    return VisibleSelection();
 }
 
 PlainTextRange AccessibilityObject::selectedTextRange() const
@@ -294,7 +298,22 @@ bool AccessibilityObject::press() const
     actionElem->accessKeyAction(true);
     return true;
 }
-
+    
+String AccessibilityObject::language() const
+{
+    AccessibilityObject* parent = parentObject();
+    
+    // as a last resort, fall back to the content language specified in the meta tag
+    if (!parent) {
+        Document* doc = document();
+        if (doc)
+            return doc->contentLanguage();
+        return String();
+    }
+    
+    return parent->language();
+}
+    
 AXObjectCache* AccessibilityObject::axObjectCache() const
 {
     return 0;
@@ -357,7 +376,7 @@ VisiblePositionRange AccessibilityObject::visiblePositionRangeForUnorderedPositi
 
     // use selection order to see if the positions are in order
     else
-        alreadyInOrder = Selection(visiblePos1, visiblePos2).isBaseFirst();
+        alreadyInOrder = VisibleSelection(visiblePos1, visiblePos2).isBaseFirst();
 
     if (alreadyInOrder) {
         startPos = visiblePos1;
@@ -400,7 +419,7 @@ static VisiblePosition updateAXLineStartForVisiblePosition(const VisiblePosition
         if (!p.node())
             break;
         renderer = p.node()->renderer();
-        if (!renderer || renderer->isRenderBlock() && !p.offset())
+        if (!renderer || (renderer->isRenderBlock() && !p.deprecatedEditingOffset()))
             break;
         InlineBox* box;
         int ignoredCaretOffset;
@@ -514,7 +533,7 @@ static VisiblePosition startOfStyleRange(const VisiblePosition visiblePos)
     return VisiblePosition(startRenderer->node(), 0, VP_DEFAULT_AFFINITY);
 }
 
-static VisiblePosition endOfStyleRange(const VisiblePosition visiblePos)
+static VisiblePosition endOfStyleRange(const VisiblePosition& visiblePos)
 {
     RenderObject* renderer = visiblePos.deepEquivalent().node()->renderer();
     RenderObject* endRenderer = renderer;
@@ -534,7 +553,7 @@ static VisiblePosition endOfStyleRange(const VisiblePosition visiblePos)
         endRenderer = r;
     }
 
-    return VisiblePosition(endRenderer->node(), maxDeepOffset(endRenderer->node()), VP_DEFAULT_AFFINITY);
+    return lastDeepEditingPositionForNode(endRenderer->node());
 }
 
 VisiblePositionRange AccessibilityObject::styleRangeForPosition(const VisiblePosition& visiblePos) const
@@ -566,7 +585,7 @@ static bool replacedNodeNeedsCharacter(Node* replacedNode)
     }
 
     // create an AX object, but skip it if it is not supposed to be seen
-    AccessibilityObject* object = replacedNode->renderer()->document()->axObjectCache()->get(replacedNode->renderer());
+    AccessibilityObject* object = replacedNode->renderer()->document()->axObjectCache()->getOrCreate(replacedNode->renderer());
     if (object->accessibilityIsIgnored())
         return false;
 
@@ -739,7 +758,8 @@ VisiblePosition AccessibilityObject::nextSentenceEndPosition(const VisiblePositi
     // an empty line is considered a sentence. If it's skipped, then the sentence parser will not
     // see this empty line.  Instead, return the end position of the empty line.
     VisiblePosition endPosition;
-    String lineString = plainText(makeRange(startOfLine(visiblePos), endOfLine(visiblePos)).get());
+    
+    String lineString = plainText(makeRange(startOfLine(nextVisiblePos), endOfLine(nextVisiblePos)).get());
     if (lineString.isEmpty())
         endPosition = nextVisiblePos;
     else
@@ -762,6 +782,7 @@ VisiblePosition AccessibilityObject::previousSentenceStartPosition(const Visible
 
     // treat empty line as a separate sentence.
     VisiblePosition startPosition;
+    
     String lineString = plainText(makeRange(startOfLine(previousVisiblePos), endOfLine(previousVisiblePos)).get());
     if (lineString.isEmpty())
         startPosition = previousVisiblePos;
@@ -812,7 +833,7 @@ AccessibilityObject* AccessibilityObject::accessibilityObjectForPosition(const V
     if (!obj)
         return 0;
 
-    return obj->document()->axObjectCache()->get(obj);
+    return obj->document()->axObjectCache()->getOrCreate(obj);
 }
 
 int AccessibilityObject::lineForPosition(const VisiblePosition& visiblePos) const
@@ -994,11 +1015,6 @@ void AccessibilityObject::setAXObjectID(unsigned axObjectID)
     m_id = axObjectID;
 }
 
-void AccessibilityObject::removeAXObjectID()
-{
-    return;
-}
-
 const String& AccessibilityObject::actionVerb() const
 {
     // FIXME: Need to add verbs for select elements.
@@ -1028,4 +1044,8 @@ const String& AccessibilityObject::actionVerb() const
     }
 }
 
+void AccessibilityObject::updateBackingStore()
+{
+}
+    
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityObject.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
index e177ee7..8939092 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityObject.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityObject.h
@@ -83,7 +83,7 @@ class IntPoint;
 class IntSize;
 class Node;
 class RenderObject;
-class Selection;
+class VisibleSelection;
 class String;
 class Widget;
 
@@ -136,6 +136,8 @@ enum AccessibilityRole {
     DisclosureTriangleRole,
     GridRole,
     CellRole, 
+    ColumnHeaderRole,
+    RowHeaderRole,
     // AppKit includes SortButtonRole but it is misnamed and really a subrole of ButtonRole so we do not include it here.
 
     // WebCore-specific roles
@@ -213,6 +215,7 @@ public:
     virtual bool isMenuButton() const { return false; }
     virtual bool isMenuItem() const { return false; }
     virtual bool isFileUploadButton() const { return false; };
+    virtual bool isInputImage() const { return false; }
     virtual bool isProgressIndicator() const { return false; };
     virtual bool isSlider() const { return false; };
     virtual bool isControl() const { return false; };
@@ -251,7 +254,7 @@ public:
     virtual int intValue() const;
     virtual float valueForRange() const { return 0.0f; }
     virtual float maxValueForRange() const { return 0.0f; }
-    virtual float minValueForRange() const {return 0.0f; }
+    virtual float minValueForRange() const { return 0.0f; }
     virtual int layoutCount() const;
     static bool isARIAControl(AccessibilityRole);
     static bool isARIAInput(AccessibilityRole);
@@ -265,9 +268,11 @@ public:
     virtual AccessibilityObject* nextSibling() const;
     virtual AccessibilityObject* parentObject() const;
     virtual AccessibilityObject* parentObjectUnignored() const;
+    virtual AccessibilityObject* parentObjectIfExists() const;
     virtual AccessibilityObject* observableObject() const;
     virtual void linkedUIElements(AccessibilityChildrenVector&) const;
     virtual AccessibilityObject* titleUIElement() const;
+    virtual bool exposesTitleUIElement() const { return true; }
     virtual AccessibilityRole ariaRoleAttribute() const;
     virtual bool isPresentationalChildOfAriaRole() const;
     virtual bool ariaRoleHasPresentationalChildren() const;
@@ -284,7 +289,7 @@ public:
     
     virtual KURL url() const;
     virtual PlainTextRange selectedTextRange() const;
-    virtual Selection selection() const;
+    virtual VisibleSelection selection() const;
     unsigned selectionStart() const;
     unsigned selectionEnd() const;
     virtual String stringValue() const;
@@ -306,7 +311,8 @@ public:
     virtual Document* document() const { return 0; }
     virtual FrameView* topDocumentFrameView() const { return 0; }
     virtual FrameView* documentFrameView() const;
-
+    virtual String language() const;
+    
     void setAXObjectID(unsigned);
     virtual void setFocused(bool);
     virtual void setSelectedText(const String&);
@@ -399,13 +405,16 @@ public:
     bool accessibilityIgnoreAttachment() const { return true; }
 #endif
 
+    // allows for an AccessibilityObject to update its render tree or perform
+    // other operations update type operations
+    virtual void updateBackingStore();
+    
 protected:
     unsigned m_id;
     AccessibilityChildrenVector m_children;
     mutable bool m_haveChildren;
     
     virtual void clearChildren();
-    virtual void removeAXObjectID();
     virtual bool isDetached() const { return true; }
 
 #if PLATFORM(MAC)
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityRenderObject.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
index dee7eea..9c10267 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityRenderObject.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -39,6 +39,7 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLAreaElement.h"
+#include "HTMLFormElement.h"
 #include "HTMLFrameElementBase.h"
 #include "HTMLImageElement.h"
 #include "HTMLInputElement.h"
@@ -53,14 +54,16 @@
 #include "HitTestResult.h"
 #include "LocalizedStrings.h"
 #include "NodeList.h"
-#include "NotImplemented.h"
 #include "Page.h"
 #include "RenderFieldset.h"
 #include "RenderFileUploadControl.h"
+#include "RenderHTMLCanvas.h"
 #include "RenderImage.h"
+#include "RenderInline.h"
 #include "RenderListBox.h"
 #include "RenderListMarker.h"
 #include "RenderMenuList.h"
+#include "RenderText.h"
 #include "RenderTextControl.h"
 #include "RenderTheme.h"
 #include "RenderView.h"
@@ -119,7 +122,7 @@ AccessibilityObject* AccessibilityRenderObject::firstChild() const
     if (!firstChild)
         return 0;
     
-    return m_renderer->document()->axObjectCache()->get(firstChild);
+    return m_renderer->document()->axObjectCache()->getOrCreate(firstChild);
 }
 
 AccessibilityObject* AccessibilityRenderObject::lastChild() const
@@ -131,7 +134,7 @@ AccessibilityObject* AccessibilityRenderObject::lastChild() const
     if (!lastChild)
         return 0;
     
-    return m_renderer->document()->axObjectCache()->get(lastChild);
+    return m_renderer->document()->axObjectCache()->getOrCreate(lastChild);
 }
 
 AccessibilityObject* AccessibilityRenderObject::previousSibling() const
@@ -143,7 +146,7 @@ AccessibilityObject* AccessibilityRenderObject::previousSibling() const
     if (!previousSibling)
         return 0;
     
-    return m_renderer->document()->axObjectCache()->get(previousSibling);
+    return m_renderer->document()->axObjectCache()->getOrCreate(previousSibling);
 }
 
 AccessibilityObject* AccessibilityRenderObject::nextSibling() const
@@ -155,9 +158,21 @@ AccessibilityObject* AccessibilityRenderObject::nextSibling() const
     if (!nextSibling)
         return 0;
     
-    return m_renderer->document()->axObjectCache()->get(nextSibling);
+    return m_renderer->document()->axObjectCache()->getOrCreate(nextSibling);
 }
 
+AccessibilityObject* AccessibilityRenderObject::parentObjectIfExists() const
+{
+    if (!m_renderer)
+        return 0;
+    
+    RenderObject *parent = m_renderer->parent();
+    if (!parent)
+        return 0;
+
+    return m_renderer->document()->axObjectCache()->get(parent);
+}
+    
 AccessibilityObject* AccessibilityRenderObject::parentObject() const
 {
     if (!m_renderer)
@@ -168,7 +183,7 @@ AccessibilityObject* AccessibilityRenderObject::parentObject() const
         return 0;
     
     if (ariaRoleAttribute() == MenuBarRole)
-        return m_renderer->document()->axObjectCache()->get(parent);
+        return m_renderer->document()->axObjectCache()->getOrCreate(parent);
 
     // menuButton and its corresponding menu are DOM siblings, but Accessibility needs them to be parent/child
     if (ariaRoleAttribute() == MenuRole) {
@@ -177,7 +192,7 @@ AccessibilityObject* AccessibilityRenderObject::parentObject() const
             return parent;
     }
     
-    return m_renderer->document()->axObjectCache()->get(parent);
+    return m_renderer->document()->axObjectCache()->getOrCreate(parent);
 }
 
 bool AccessibilityRenderObject::isWebArea() const
@@ -197,7 +212,7 @@ bool AccessibilityRenderObject::isAnchor() const
 
 bool AccessibilityRenderObject::isNativeTextControl() const
 {
-    return m_renderer->isTextField() || m_renderer->isTextArea();
+    return m_renderer->isTextControl();
 }
     
 bool AccessibilityRenderObject::isTextControl() const
@@ -218,6 +233,9 @@ bool AccessibilityRenderObject::isImage() const
 
 bool AccessibilityRenderObject::isAttachment() const
 {
+    if (!m_renderer)
+        return false;
+    
     // Widgets are the replaced elements that we represent to AX as attachments
     bool isWidget = m_renderer && m_renderer->isWidget();
     ASSERT(!isWidget || (m_renderer->isReplaced() && !isImage()));
@@ -227,9 +245,16 @@ bool AccessibilityRenderObject::isAttachment() const
 bool AccessibilityRenderObject::isPasswordField() const
 {
     ASSERT(m_renderer);
-    if (!m_renderer->element() || !m_renderer->element()->isHTMLElement())
+    if (!m_renderer->node() || !m_renderer->node()->isHTMLElement())
+        return false;
+    if (ariaRoleAttribute() != UnknownRole)
         return false;
-    return static_cast<HTMLElement*>(m_renderer->element())->isPasswordField() && ariaRoleAttribute() == UnknownRole;
+
+    InputElement* inputElement = toInputElement(static_cast<Element*>(m_renderer->node()));
+    if (!inputElement)
+        return false;
+
+    return inputElement->isPasswordField();
 }
 
 bool AccessibilityRenderObject::isCheckboxOrRadio() const
@@ -240,13 +265,23 @@ bool AccessibilityRenderObject::isCheckboxOrRadio() const
     
 bool AccessibilityRenderObject::isFileUploadButton() const
 {
-    if (m_renderer && m_renderer->element() && m_renderer->element()->hasTagName(inputTag)) {
-        HTMLInputElement* input = static_cast<HTMLInputElement*>(m_renderer->element());
+    if (m_renderer && m_renderer->node() && m_renderer->node()->hasTagName(inputTag)) {
+        HTMLInputElement* input = static_cast<HTMLInputElement*>(m_renderer->node());
         return input->inputType() == HTMLInputElement::FILE;
     }
     
     return false;
 }
+    
+bool AccessibilityRenderObject::isInputImage() const
+{
+    if (m_renderer && m_renderer->node() && m_renderer->node()->hasTagName(inputTag)) {
+        HTMLInputElement* input = static_cast<HTMLInputElement*>(m_renderer->node());
+        return input->inputType() == HTMLInputElement::IMAGE;
+    }
+    
+    return false;
+}
 
 bool AccessibilityRenderObject::isProgressIndicator() const
 {
@@ -310,13 +345,27 @@ bool AccessibilityRenderObject::isPressed() const
 bool AccessibilityRenderObject::isIndeterminate() const
 {
     ASSERT(m_renderer);
-    return m_renderer->node() && m_renderer->node()->isIndeterminate();
+    if (!m_renderer->node() || !m_renderer->node()->isElementNode())
+        return false;
+
+    InputElement* inputElement = toInputElement(static_cast<Element*>(m_renderer->node()));
+    if (!inputElement)
+        return false;
+
+    return inputElement->isIndeterminate();
 }
 
 bool AccessibilityRenderObject::isChecked() const
 {
     ASSERT(m_renderer);
-    return m_renderer->node() && m_renderer->node()->isChecked();
+    if (!m_renderer->node() || !m_renderer->node()->isElementNode())
+        return false;
+
+    InputElement* inputElement = toInputElement(static_cast<Element*>(m_renderer->node()));
+    if (!inputElement)
+        return false;
+
+    return inputElement->isChecked();
 }
 
 bool AccessibilityRenderObject::isHovered() const
@@ -330,7 +379,7 @@ bool AccessibilityRenderObject::isMultiSelect() const
     ASSERT(m_renderer);
     if (!m_renderer->isListBox())
         return false;
-    return m_renderer->element() && static_cast<HTMLSelectElement*>(m_renderer->element())->multiple();
+    return m_renderer->node() && static_cast<HTMLSelectElement*>(m_renderer->node())->multiple();
 }
     
 bool AccessibilityRenderObject::isReadOnly() const
@@ -373,7 +422,7 @@ int AccessibilityRenderObject::headingLevel(Node* node)
         return 0;
 
     if (RenderObject* renderer = node->renderer()) {
-        AccessibilityObject* axObjectForNode = node->document()->axObjectCache()->get(renderer);
+        AccessibilityObject* axObjectForNode = node->document()->axObjectCache()->getOrCreate(renderer);
         if (axObjectForNode->ariaRoleAttribute() == HeadingRole) {
             if (!node->isElementNode())
                 return 0;
@@ -419,8 +468,9 @@ bool AccessibilityRenderObject::isControl() const
     if (!m_renderer)
         return false;
     
-    Node* node = m_renderer->element();
-    return node && (node->isControl() || AccessibilityObject::isARIAControl(ariaRoleAttribute()));
+    Node* node = m_renderer->node();
+    return node && ((node->isElementNode() && static_cast<Element*>(node)->isFormControlElement())
+                    || AccessibilityObject::isARIAControl(ariaRoleAttribute()));
 }
 
 bool AccessibilityRenderObject::isFieldset() const
@@ -438,7 +488,7 @@ bool AccessibilityRenderObject::isGroup() const
     
 const AtomicString& AccessibilityRenderObject::getAttribute(const QualifiedName& attribute) const
 {
-    Node* node = m_renderer->element();
+    Node* node = m_renderer->node();
     if (!node)
         return nullAtom;
 
@@ -458,9 +508,12 @@ Element* AccessibilityRenderObject::anchorElement() const
     RenderObject* currRenderer;
     
     // Search up the render tree for a RenderObject with a DOM node.  Defer to an earlier continuation, though.
-    for (currRenderer = m_renderer; currRenderer && !currRenderer->element(); currRenderer = currRenderer->parent()) {
-        if (currRenderer->continuation())
-            return cache->get(currRenderer->continuation())->anchorElement();
+    for (currRenderer = m_renderer; currRenderer && !currRenderer->node(); currRenderer = currRenderer->parent()) {
+        if (currRenderer->isRenderBlock()) {
+            RenderInline* continuation = toRenderBlock(currRenderer)->inlineContinuation();
+            if (continuation)
+                return cache->getOrCreate(continuation)->anchorElement();
+        }
     }
     
     // bail if none found
@@ -471,7 +524,7 @@ Element* AccessibilityRenderObject::anchorElement() const
     // NOTE: this assumes that any non-image with an anchor is an HTMLAnchorElement
     Node* node = currRenderer->node();
     for ( ; node; node = node->parentNode()) {
-        if (node->hasTagName(aTag) || (node->renderer() && cache->get(node->renderer())->isAnchor()))
+        if (node->hasTagName(aTag) || (node->renderer() && cache->getOrCreate(node->renderer())->isAnchor()))
             return static_cast<Element*>(node);
     }
     
@@ -480,24 +533,31 @@ Element* AccessibilityRenderObject::anchorElement() const
 
 Element* AccessibilityRenderObject::actionElement() const
 {
-    if (m_renderer->element() && m_renderer->element()->hasTagName(inputTag)) {
-        HTMLInputElement* input = static_cast<HTMLInputElement*>(m_renderer->element());
-        if (!input->disabled() && (isCheckboxOrRadio() || input->isTextButton()))
-            return input;
+    if (!m_renderer)
+        return 0;
+    
+    Node* node = m_renderer->node();
+    if (node) {
+        if (node->hasTagName(inputTag)) {
+            HTMLInputElement* input = static_cast<HTMLInputElement*>(node);
+            if (!input->disabled() && (isCheckboxOrRadio() || input->isTextButton()))
+                return input;
+        } else if (node->hasTagName(buttonTag))
+            return static_cast<Element*>(node);
     }
             
     if (isFileUploadButton())
-        return static_cast<Element*>(m_renderer->element());
+        return static_cast<Element*>(m_renderer->node());
             
     if (AccessibilityObject::isARIAInput(ariaRoleAttribute()))
-        return static_cast<Element*>(m_renderer->element());
+        return static_cast<Element*>(m_renderer->node());
 
     if (isImageButton())
-        return static_cast<Element*>(m_renderer->element());
+        return static_cast<Element*>(m_renderer->node());
     
     if (m_renderer->isMenuList())
-        return static_cast<RenderMenuList*>(m_renderer)->selectElement();
-    
+        return static_cast<Element*>(m_renderer->node());
+
     Element* elt = anchorElement();
     if (!elt)
         elt = mouseButtonListener();
@@ -506,18 +566,23 @@ Element* AccessibilityRenderObject::actionElement() const
 
 Element* AccessibilityRenderObject::mouseButtonListener() const
 {
-    Node* node = m_renderer->element();
+    Node* node = m_renderer->node();
     if (!node)
         return 0;
-    if (!node->isEventTargetNode())
-        return 0;
     
+    // check if our parent is a mouse button listener
+    while (node && !node->isElementNode())
+        node = node->parent();
+
+    if (!node)
+        return 0;
+
     // FIXME: Do the continuation search like anchorElement does
-    for (EventTargetNode* elt = static_cast<EventTargetNode*>(node); elt; elt = static_cast<EventTargetNode*>(elt->parentNode())) {
-        if (elt->inlineEventListenerForType(eventNames().clickEvent) || elt->inlineEventListenerForType(eventNames().mousedownEvent) || elt->inlineEventListenerForType(eventNames().mouseupEvent))
-            return static_cast<Element*>(elt);
+    for (Element* element = static_cast<Element*>(node); element; element = element->parentElement()) {
+        if (element->getAttributeEventListener(eventNames().clickEvent) || element->getAttributeEventListener(eventNames().mousedownEvent) || element->getAttributeEventListener(eventNames().mouseupEvent))
+            return element;
     }
-    
+
     return 0;
 }
 
@@ -548,7 +613,7 @@ AccessibilityObject* AccessibilityRenderObject::menuForMenuButton() const
 {
     Element* menu = menuElementForMenuButton();
     if (menu && menu->renderer())
-        return m_renderer->document()->axObjectCache()->get(menu->renderer());
+        return m_renderer->document()->axObjectCache()->getOrCreate(menu->renderer());
     return 0;
 }
 
@@ -566,7 +631,7 @@ AccessibilityObject* AccessibilityRenderObject::menuButtonForMenu() const
 
     if (menuItem && menuItem->renderer()) {
         // ARIA just has generic menu items.  AppKit needs to know if this is a top level items like MenuBarButton or MenuBarItem
-        AccessibilityObject* menuItemAX = m_renderer->document()->axObjectCache()->get(menuItem->renderer());
+        AccessibilityObject* menuItemAX = m_renderer->document()->axObjectCache()->getOrCreate(menuItem->renderer());
         if (menuItemAX->isMenuButton())
             return menuItemAX;
     }
@@ -579,11 +644,11 @@ String AccessibilityRenderObject::helpText() const
         return String();
     
     for (RenderObject* curr = m_renderer; curr; curr = curr->parent()) {
-        if (curr->element() && curr->element()->isHTMLElement()) {
-            const AtomicString& summary = static_cast<Element*>(curr->element())->getAttribute(summaryAttr);
+        if (curr->node() && curr->node()->isHTMLElement()) {
+            const AtomicString& summary = static_cast<Element*>(curr->node())->getAttribute(summaryAttr);
             if (!summary.isEmpty())
                 return summary;
-            const AtomicString& title = static_cast<Element*>(curr->element())->getAttribute(titleAttr);
+            const AtomicString& title = static_cast<Element*>(curr->node())->getAttribute(titleAttr);
             if (!title.isEmpty())
                 return title;
         }
@@ -591,6 +656,25 @@ String AccessibilityRenderObject::helpText() const
     
     return String();
 }
+    
+String AccessibilityRenderObject::language() const
+{
+    if (!m_renderer)
+        return String();
+    
+    // Defer to parent if this element doesn't have a language set
+    Node* node = m_renderer->node();
+    if (!node)
+        return AccessibilityObject::language();
+    
+    if (!node->isElementNode())
+        return AccessibilityObject::language();
+    
+    String language = static_cast<Element*>(node)->getAttribute(langAttr);
+    if (language.isEmpty())
+        return AccessibilityObject::language();
+    return language;
+}
 
 String AccessibilityRenderObject::textUnderElement() const
 {
@@ -602,7 +686,7 @@ String AccessibilityRenderObject::textUnderElement() const
         return uploadControl->buttonValue();
     }
     
-    Node* node = m_renderer->element();
+    Node* node = m_renderer->node();
     if (node) {
         if (Frame* frame = node->document()->frame()) {
             // catch stale WebCoreAXObject (see <rdar://problem/3960196>)
@@ -622,7 +706,7 @@ bool AccessibilityRenderObject::hasIntValue() const
     if (isHeading())
         return true;
     
-    if (m_renderer->element() && isCheckboxOrRadio())
+    if (m_renderer->node() && isCheckboxOrRadio())
         return true;
     
     return false;
@@ -634,9 +718,9 @@ int AccessibilityRenderObject::intValue() const
         return 0;
     
     if (isHeading())
-        return headingLevel(m_renderer->element());
+        return headingLevel(m_renderer->node());
     
-    Node* node = m_renderer->element();
+    Node* node = m_renderer->node();
     if (!node || !isCheckboxOrRadio())
         return 0;
 
@@ -755,7 +839,7 @@ String AccessibilityRenderObject::ariaAccessiblityName(const String& s) const
         if (idElement) {
             String nameFragment = accessibleNameForNode(idElement);
             ariaLabel.append(nameFragment.characters(), nameFragment.length());
-            for (Node* n = idElement->firstChild(); n; n = n->traverseNextNode(idElement->nextSibling())) {
+            for (Node* n = idElement->firstChild(); n; n = n->traverseNextNode(idElement)) {
                 nameFragment = accessibleNameForNode(n);
                 ariaLabel.append(nameFragment.characters(), nameFragment.length());
             }
@@ -811,7 +895,7 @@ HTMLLabelElement* AccessibilityRenderObject::labelElementContainer() const
         return false;
     
     // find if this has a parent that is a label
-    for (Node* parentNode = m_renderer->element(); parentNode; parentNode = parentNode->parentNode()) {
+    for (Node* parentNode = m_renderer->node(); parentNode; parentNode = parentNode->parentNode()) {
         if (parentNode->hasTagName(labelTag))
             return static_cast<HTMLLabelElement*>(parentNode);
     }
@@ -826,7 +910,7 @@ String AccessibilityRenderObject::title() const
     if (!m_renderer)
         return String();
 
-    Node* node = m_renderer->element();
+    Node* node = m_renderer->node();
     if (!node)
         return String();
     
@@ -847,8 +931,12 @@ String AccessibilityRenderObject::title() const
     
     if (isInputTag || AccessibilityObject::isARIAInput(ariaRole) || isControl()) {
         HTMLLabelElement* label = labelForElement(static_cast<Element*>(node));
-        if (label)
+        if (label && !titleUIElement())
             return label->innerText();
+        
+        const AtomicString& placeholder = getAttribute(placeholderAttr);
+        if (!placeholder.isEmpty())
+            return placeholder;
     }
     
     if (roleValue() == ButtonRole
@@ -882,9 +970,10 @@ String AccessibilityRenderObject::accessibilityDescription() const
     if (!ariaDescription.isEmpty())
         return ariaDescription;
     
-    if (isImage()) {
-        if (m_renderer->element() && m_renderer->element()->isHTMLElement()) {
-            const AtomicString& alt = static_cast<HTMLElement*>(m_renderer->element())->getAttribute(altAttr);
+    if (isImage() || isInputImage() || isNativeImage()) {
+        Node* node = m_renderer->node();
+        if (node && node->isHTMLElement()) {
+            const AtomicString& alt = static_cast<HTMLElement*>(node)->getAttribute(altAttr);
             if (alt.isEmpty())
                 return String();
             return alt;
@@ -919,29 +1008,30 @@ String AccessibilityRenderObject::accessibilityDescription() const
 
 IntRect AccessibilityRenderObject::boundingBoxRect() const
 {
-    IntRect rect;
     RenderObject* obj = m_renderer;
     
     if (!obj)
         return IntRect();
     
-    if (obj->isInlineContinuation())
-        obj = obj->element()->renderer();
+    if (obj->node()) // If we are a continuation, we want to make sure to use the primary renderer.
+        obj = obj->node()->renderer();
     
-    // FIXME: This doesn't work correctly with transforms.
-    Vector<IntRect> rects;
-    FloatPoint absPos = obj->localToAbsolute();
-    obj->absoluteRects(rects, absPos.x(), absPos.y());
-    const size_t n = rects.size();
+    Vector<FloatQuad> quads;
+    obj->absoluteQuads(quads);
+    const size_t n = quads.size();
+    if (!n)
+        return IntRect();
+
+    IntRect result;
     for (size_t i = 0; i < n; ++i) {
-        IntRect r = rects[i];
+        IntRect r = quads[i].enclosingBoundingBox();
         if (!r.isEmpty()) {
             if (obj->style()->hasAppearance())
-                theme()->adjustRepaintRect(obj, r);
-            rect.unite(r);
+                obj->theme()->adjustRepaintRect(obj, r);
+            result.unite(r);
         }
     }
-    return rect;
+    return result;
 }
     
 IntRect AccessibilityRenderObject::checkboxOrRadioRect() const
@@ -949,11 +1039,11 @@ IntRect AccessibilityRenderObject::checkboxOrRadioRect() const
     if (!m_renderer)
         return IntRect();
     
-    HTMLLabelElement* label = labelForElement(static_cast<Element*>(m_renderer->element()));
+    HTMLLabelElement* label = labelForElement(static_cast<Element*>(m_renderer->node()));
     if (!label || !label->renderer())
         return boundingBoxRect();
     
-    IntRect labelRect = axObjectCache()->get(label->renderer())->elementRect();
+    IntRect labelRect = axObjectCache()->getOrCreate(label->renderer())->elementRect();
     labelRect.unite(boundingBoxRect());
     return labelRect;
 }
@@ -999,7 +1089,7 @@ AccessibilityObject* AccessibilityRenderObject::internalLinkElement() const
         return 0;
     
     // the element we find may not be accessible, keep searching until we find a good one
-    AccessibilityObject* linkedAXElement = m_renderer->document()->axObjectCache()->get(linkedNode->renderer());
+    AccessibilityObject* linkedAXElement = m_renderer->document()->axObjectCache()->getOrCreate(linkedNode->renderer());
     while (linkedAXElement && linkedAXElement->accessibilityIsIgnored()) {
         linkedNode = linkedNode->traverseNextNode();
         
@@ -1008,7 +1098,7 @@ AccessibilityObject* AccessibilityRenderObject::internalLinkElement() const
         
         if (!linkedNode)
             return 0;
-        linkedAXElement = m_renderer->document()->axObjectCache()->get(linkedNode->renderer());
+        linkedAXElement = m_renderer->document()->axObjectCache()->getOrCreate(linkedNode->renderer());
     }
     
     return linkedAXElement;
@@ -1032,7 +1122,7 @@ void AccessibilityRenderObject::addRadioButtonGroupMembers(AccessibilityChildren
         unsigned len = formElements.size();
         for (unsigned i = 0; i < len; ++i) {
             Node* associateElement = formElements[i].get();
-            if (AccessibilityObject* object = m_renderer->document()->axObjectCache()->get(associateElement->renderer()))
+            if (AccessibilityObject* object = m_renderer->document()->axObjectCache()->getOrCreate(associateElement->renderer()))
                 linkedUIElements.append(object);        
         } 
     } else {
@@ -1042,7 +1132,7 @@ void AccessibilityRenderObject::addRadioButtonGroupMembers(AccessibilityChildren
             if (list->item(i)->hasTagName(inputTag)) {
                 HTMLInputElement* associateElement = static_cast<HTMLInputElement*>(list->item(i));
                 if (associateElement->isRadioButton() && associateElement->name() == input->name()) {
-                    if (AccessibilityObject* object = m_renderer->document()->axObjectCache()->get(associateElement->renderer()))
+                    if (AccessibilityObject* object = m_renderer->document()->axObjectCache()->getOrCreate(associateElement->renderer()))
                         linkedUIElements.append(object);
                 }
             }
@@ -1064,6 +1154,18 @@ void AccessibilityRenderObject::linkedUIElements(AccessibilityChildrenVector& li
         addRadioButtonGroupMembers(linkedUIElements);
 }
 
+bool AccessibilityRenderObject::exposesTitleUIElement() const
+{
+    if (!isControl())
+        return false;
+
+    // checkbox or radio buttons don't expose the title ui element unless it has a title already
+    if (isCheckboxOrRadio() && getAttribute(titleAttr).isEmpty())
+        return false;
+    
+    return true;
+}
+    
 AccessibilityObject* AccessibilityRenderObject::titleUIElement() const
 {
     if (!m_renderer)
@@ -1071,26 +1173,44 @@ AccessibilityObject* AccessibilityRenderObject::titleUIElement() const
     
     // if isFieldset is true, the renderer is guaranteed to be a RenderFieldset
     if (isFieldset())
-        return axObjectCache()->get(static_cast<RenderFieldset*>(m_renderer)->findLegend());
+        return axObjectCache()->getOrCreate(static_cast<RenderFieldset*>(m_renderer)->findLegend());
     
-    // checkbox and radio hide their labels. Only controls get titleUIElements for now
-    if (isCheckboxOrRadio() || !isControl())
+    if (!exposesTitleUIElement())
         return 0;
     
-    Node* element = m_renderer->element();
+    Node* element = m_renderer->node();
     HTMLLabelElement* label = labelForElement(static_cast<Element*>(element));
     if (label && label->renderer())
-        return axObjectCache()->get(label->renderer());
+        return axObjectCache()->getOrCreate(label->renderer());
 
     return 0;   
 }
     
+bool AccessibilityRenderObject::ariaIsHidden() const
+{
+    if (equalIgnoringCase(getAttribute(aria_hiddenAttr).string(), "true"))
+        return true;
+    
+    // aria-hidden hides this object and any children
+    AccessibilityObject* object = parentObject();
+    while (object) {
+        if (object->isAccessibilityRenderObject() && equalIgnoringCase(static_cast<AccessibilityRenderObject*>(object)->getAttribute(aria_hiddenAttr).string(), "true"))
+            return true;
+        object = object->parentObject();
+    }
+
+    return false;
+}
+
 bool AccessibilityRenderObject::accessibilityIsIgnored() const
 {
     // ignore invisible element
     if (!m_renderer || m_renderer->style()->visibility() != VISIBLE)
         return true;
 
+    if (ariaIsHidden())
+        return true;
+    
     if (isPresentationalChildOfAriaRole())
         return true;
         
@@ -1106,8 +1226,8 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
     if (labelElement) {
         HTMLElement* correspondingControl = labelElement->correspondingControl();
         if (correspondingControl && correspondingControl->renderer()) {
-            AccessibilityObject* controlObject = axObjectCache()->get(correspondingControl->renderer());
-            if (controlObject->isCheckboxOrRadio())
+            AccessibilityObject* controlObject = axObjectCache()->getOrCreate(correspondingControl->renderer());
+            if (!controlObject->exposesTitleUIElement())
                 return true;
         }
     }
@@ -1124,7 +1244,12 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
         if (parentObjectUnignored()->ariaRoleAttribute() == MenuItemRole ||
             parentObjectUnignored()->ariaRoleAttribute() == MenuButtonRole)
             return true;
-         return m_renderer->isBR() || !static_cast<RenderText*>(m_renderer)->firstTextBox();
+        RenderText* renderText = toRenderText(m_renderer);
+        if (m_renderer->isBR() || !renderText->firstTextBox())
+            return true;
+        
+        // text elements that are just empty whitespace should not be returned
+        return renderText->text()->containsOnlyWhitespace();
     }
     
     if (isHeading())
@@ -1138,12 +1263,12 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
         return false;
     
     // don't ignore labels, because they serve as TitleUIElements
-    Node* node = m_renderer->element();
+    Node* node = m_renderer->node();
     if (node && node->hasTagName(labelTag))
         return false;
     
     if (m_renderer->isBlockFlow() && m_renderer->childrenInline())
-        return !static_cast<RenderBlock*>(m_renderer)->firstLineBox() && !mouseButtonListener();
+        return !toRenderBlock(m_renderer)->firstLineBox() && !mouseButtonListener();
     
     // ignore images seemingly used as spacers
     if (isImage()) {
@@ -1158,13 +1283,20 @@ bool AccessibilityRenderObject::accessibilityIsIgnored() const
                 return true;
         }
         
+        if (node && node->hasTagName(canvasTag)) {
+            RenderHTMLCanvas* canvas = static_cast<RenderHTMLCanvas*>(m_renderer);
+            if (canvas->height() <= 1 || canvas->width() <= 1)
+                return true;
+            return false;
+        }
+        
         // check for one-dimensional image
-        if (m_renderer->height() <= 1 || m_renderer->width() <= 1)
+        RenderImage* image = toRenderImage(m_renderer);
+        if (image->height() <= 1 || image->width() <= 1)
             return true;
         
         // check whether rendered image was stretched from one-dimensional file image
         if (isNativeImage()) {
-            RenderImage* image = static_cast<RenderImage*>(m_renderer);
             if (image->cachedImage()) {
                 IntSize imageSize = image->cachedImage()->imageSize(image->view()->zoomFactor());
                 return imageSize.height() <= 1 || imageSize.width() <= 1;
@@ -1192,7 +1324,7 @@ int AccessibilityRenderObject::layoutCount() const
 {
     if (!m_renderer->isRenderView())
         return 0;
-    return static_cast<RenderView*>(m_renderer)->frameView()->layoutCount();
+    return toRenderView(m_renderer)->frameView()->layoutCount();
 }
 
 String AccessibilityRenderObject::text() const
@@ -1201,9 +1333,9 @@ String AccessibilityRenderObject::text() const
         return String();
     
     if (isNativeTextControl())
-        return static_cast<RenderTextControl*>(m_renderer)->text();
+        return toRenderTextControl(m_renderer)->text();
     
-    Node* node = m_renderer->element();
+    Node* node = m_renderer->node();
     if (!node)
         return String();
     if (!node->isElementNode())
@@ -1224,11 +1356,11 @@ int AccessibilityRenderObject::textLength() const
 
 PassRefPtr<Range> AccessibilityRenderObject::ariaSelectedTextDOMRange() const
 {
-    Node* node = m_renderer->element();
+    Node* node = m_renderer->node();
     if (!node)
         return 0;
     
-    RefPtr<Range> currentSelectionRange = selection().toRange();
+    RefPtr<Range> currentSelectionRange = selection().toNormalizedRange();
     if (!currentSelectionRange)
         return 0;
     
@@ -1261,7 +1393,7 @@ String AccessibilityRenderObject::selectedText() const
         return String(); // need to return something distinct from empty string
     
     if (isNativeTextControl()) {
-        RenderTextControl* textControl = static_cast<RenderTextControl*>(m_renderer);
+        RenderTextControl* textControl = toRenderTextControl(m_renderer);
         return textControl->text().substring(textControl->selectionStart(), textControl->selectionEnd() - textControl->selectionStart());
     }
     
@@ -1276,7 +1408,7 @@ String AccessibilityRenderObject::selectedText() const
 
 const AtomicString& AccessibilityRenderObject::accessKey() const
 {
-    Node* node = m_renderer->element();
+    Node* node = m_renderer->node();
     if (!node)
         return nullAtom;
     if (!node->isElementNode())
@@ -1284,7 +1416,7 @@ const AtomicString& AccessibilityRenderObject::accessKey() const
     return static_cast<Element*>(node)->getAttribute(accesskeyAttr);
 }
 
-Selection AccessibilityRenderObject::selection() const
+VisibleSelection AccessibilityRenderObject::selection() const
 {
     return m_renderer->document()->frame()->selection()->selection();
 }
@@ -1298,7 +1430,7 @@ PlainTextRange AccessibilityRenderObject::selectedTextRange() const
     
     AccessibilityRole ariaRole = ariaRoleAttribute();
     if (isNativeTextControl() && ariaRole == UnknownRole) {
-        RenderTextControl* textControl = static_cast<RenderTextControl*>(m_renderer);
+        RenderTextControl* textControl = toRenderTextControl(m_renderer);
         return PlainTextRange(textControl->selectionStart(), textControl->selectionEnd() - textControl->selectionStart());
     }
     
@@ -1314,7 +1446,7 @@ PlainTextRange AccessibilityRenderObject::selectedTextRange() const
 void AccessibilityRenderObject::setSelectedTextRange(const PlainTextRange& range)
 {
     if (isNativeTextControl()) {
-        RenderTextControl* textControl = static_cast<RenderTextControl*>(m_renderer);
+        RenderTextControl* textControl = toRenderTextControl(m_renderer);
         textControl->setSelectionRange(range.start, range.start + range.length);
         return;
     }
@@ -1325,14 +1457,14 @@ void AccessibilityRenderObject::setSelectedTextRange(const PlainTextRange& range
     Frame* frame = document->frame();
     if (!frame)
         return;
-    Node* node = m_renderer->element();
-    frame->selection()->setSelection(Selection(Position(node, range.start),
+    Node* node = m_renderer->node();
+    frame->selection()->setSelection(VisibleSelection(Position(node, range.start),
         Position(node, range.start + range.length), DOWNSTREAM));
 }
 
 KURL AccessibilityRenderObject::url() const
 {
-    if (isAnchor() && m_renderer->element()->hasTagName(aTag)) {
+    if (isAnchor() && m_renderer->node()->hasTagName(aTag)) {
         if (HTMLAnchorElement* anchor = static_cast<HTMLAnchorElement*>(anchorElement()))
             return anchor->href();
     }
@@ -1340,8 +1472,11 @@ KURL AccessibilityRenderObject::url() const
     if (isWebArea())
         return m_renderer->document()->url();
     
-    if (isImage() && m_renderer->element() && m_renderer->element()->hasTagName(imgTag))
-        return static_cast<HTMLImageElement*>(m_renderer->element())->src();
+    if (isImage() && m_renderer->node() && m_renderer->node()->hasTagName(imgTag))
+        return static_cast<HTMLImageElement*>(m_renderer->node())->src();
+    
+    if (isInputImage())
+        return static_cast<HTMLInputElement*>(m_renderer->node())->src();
     
     return KURL();
 }
@@ -1378,7 +1513,7 @@ bool AccessibilityRenderObject::isFocused() const
     
     // A web area is represented by the Document node in the DOM tree, which isn't focusable.
     // Check instead if the frame's selection controller is focused
-    if (focusedNode == m_renderer->element() || 
+    if (focusedNode == m_renderer->node() || 
         (roleValue() == WebAreaRole && document->frame()->selection()->isFocusedAndActive()))
         return true;
     
@@ -1393,10 +1528,10 @@ void AccessibilityRenderObject::setFocused(bool on)
     if (!on)
         m_renderer->document()->setFocusedNode(0);
     else {
-        if (m_renderer->element()->isElementNode())
-            static_cast<Element*>(m_renderer->element())->focus();
+        if (m_renderer->node()->isElementNode())
+            static_cast<Element*>(m_renderer->node())->focus();
         else
-            m_renderer->document()->setFocusedNode(m_renderer->element());
+            m_renderer->document()->setFocusedNode(m_renderer->node());
     }
 }
 
@@ -1404,22 +1539,31 @@ void AccessibilityRenderObject::setValue(const String& string)
 {
     // FIXME: Do we want to do anything here for ARIA textboxes?
     if (m_renderer->isTextField()) {
-        HTMLInputElement* input = static_cast<HTMLInputElement*>(m_renderer->element());
+        HTMLInputElement* input = static_cast<HTMLInputElement*>(m_renderer->node());
         input->setValue(string);
     } else if (m_renderer->isTextArea()) {
-        HTMLTextAreaElement* textArea = static_cast<HTMLTextAreaElement*>(m_renderer->element());
+        HTMLTextAreaElement* textArea = static_cast<HTMLTextAreaElement*>(m_renderer->node());
         textArea->setValue(string);
     }
 }
 
 bool AccessibilityRenderObject::isEnabled() const
 {
-    return m_renderer->element() ? m_renderer->element()->isEnabled() : true;
+    ASSERT(m_renderer);
+    
+    if (equalIgnoringCase(getAttribute(aria_disabledAttr).string(), "true"))
+        return false;
+    
+    Node* node = m_renderer->node();
+    if (!node || !node->isElementNode())
+        return true;
+
+    return static_cast<Element*>(node)->isEnabledFormControl();
 }
 
-RenderObject* AccessibilityRenderObject::topRenderer() const
+RenderView* AccessibilityRenderObject::topRenderer() const
 {
-    return m_renderer->document()->topDocument()->renderer();
+    return m_renderer->document()->topDocument()->renderView();
 }
 
 Document* AccessibilityRenderObject::document() const
@@ -1451,6 +1595,7 @@ AccessibilityObject* AccessibilityRenderObject::accessibilityParentForImageMap(H
     if (!m_renderer || !map)
         return 0;
 
+    String mapName = map->getName().string().lower();
     RefPtr<HTMLCollection> coll = m_renderer->document()->images();
     for (Node* curr = coll->firstItem(); curr; curr = coll->nextItem()) {
         RenderObject* obj = curr->renderer();
@@ -1459,8 +1604,9 @@ AccessibilityObject* AccessibilityRenderObject::accessibilityParentForImageMap(H
         
         // The HTMLImageElement's useMap() value includes the '#' symbol at the beginning,
         // which has to be stripped off
-        if (static_cast<HTMLImageElement*>(curr)->useMap().substring(1) == map->getName())
-            return axObjectCache()->get(obj);
+        String useMapName = static_cast<HTMLImageElement*>(curr)->useMap().substring(1).lower();
+        if (useMapName == mapName)
+            return axObjectCache()->getOrCreate(obj);
     }
     
     return 0;
@@ -1474,15 +1620,14 @@ void AccessibilityRenderObject::getDocumentLinks(AccessibilityChildrenVector& re
     while (curr) {
         RenderObject* obj = curr->renderer();
         if (obj) {
-            RefPtr<AccessibilityObject> axobj = document->axObjectCache()->get(obj);
+            RefPtr<AccessibilityObject> axobj = document->axObjectCache()->getOrCreate(obj);
             ASSERT(axobj);
-            ASSERT(axobj->roleValue() == WebCoreLinkRole);
-            if (!axobj->accessibilityIsIgnored())
+            if (!axobj->accessibilityIsIgnored() && axobj->isLink())
                 result.append(axobj);
         } else {
             Node* parent = curr->parent();
             if (parent && curr->hasTagName(areaTag) && parent->hasTagName(mapTag)) {
-                AccessibilityImageMapLink* areaObject = static_cast<AccessibilityImageMapLink*>(axObjectCache()->get(ImageMapLinkRole));
+                AccessibilityImageMapLink* areaObject = static_cast<AccessibilityImageMapLink*>(axObjectCache()->getOrCreate(ImageMapLinkRole));
                 areaObject->setHTMLAreaElement(static_cast<HTMLAreaElement*>(curr));
                 areaObject->setHTMLMapElement(static_cast<HTMLMapElement*>(parent));
                 areaObject->setParent(accessibilityParentForImageMap(static_cast<HTMLMapElement*>(parent)));
@@ -1526,20 +1671,23 @@ VisiblePositionRange AccessibilityRenderObject::visiblePositionRange() const
         return VisiblePositionRange();
     
     // construct VisiblePositions for start and end
-    Node* node = m_renderer->element();
+    Node* node = m_renderer->node();
     if (!node)
         return VisiblePositionRange();
-    
-    VisiblePosition startPos = VisiblePosition(node, 0, VP_DEFAULT_AFFINITY);
-    VisiblePosition endPos = VisiblePosition(node, maxDeepOffset(node), VP_DEFAULT_AFFINITY);
-    
+
+    VisiblePosition startPos = firstDeepEditingPositionForNode(node);
+    VisiblePosition endPos = lastDeepEditingPositionForNode(node);
+
     // the VisiblePositions are equal for nodes like buttons, so adjust for that
+    // FIXME: Really?  [button, 0] and [button, 1] are distinct (before and after the button)
+    // I expect this code is only hit for things like empty divs?  In which case I don't think
+    // the behavior is correct here -- eseidel
     if (startPos == endPos) {
         endPos = endPos.next();
         if (endPos.isNull())
             endPos = startPos;
     }
-    
+
     return VisiblePositionRange(startPos, endPos);
 }
 
@@ -1565,7 +1713,7 @@ VisiblePositionRange AccessibilityRenderObject::visiblePositionRangeForLine(unsi
     // starting at an empty line.  The resulting selection in that case
     // will be a caret at visiblePos.
     SelectionController selection;
-    selection.setSelection(Selection(visiblePos));
+    selection.setSelection(VisibleSelection(visiblePos));
     selection.modify(SelectionController::EXTEND, SelectionController::RIGHT, LineBoundary);
     
     return VisiblePositionRange(selection.selection().visibleStart(), selection.selection().visibleEnd());
@@ -1577,7 +1725,7 @@ VisiblePosition AccessibilityRenderObject::visiblePositionForIndex(int index) co
         return VisiblePosition();
     
     if (isNativeTextControl())
-        return static_cast<RenderTextControl*>(m_renderer)->visiblePositionForIndex(index);
+        return toRenderTextControl(m_renderer)->visiblePositionForIndex(index);
     
     if (!isTextControl() && !m_renderer->isText())
         return VisiblePosition();
@@ -1600,7 +1748,7 @@ VisiblePosition AccessibilityRenderObject::visiblePositionForIndex(int index) co
 int AccessibilityRenderObject::indexForVisiblePosition(const VisiblePosition& pos) const
 {
     if (isNativeTextControl())
-        return static_cast<RenderTextControl*>(m_renderer)->indexForVisiblePosition(pos);
+        return toRenderTextControl(m_renderer)->indexForVisiblePosition(pos);
     
     if (!isTextControl())
         return 0;
@@ -1616,7 +1764,7 @@ int AccessibilityRenderObject::indexForVisiblePosition(const VisiblePosition& po
     ExceptionCode ec = 0;
     RefPtr<Range> range = Range::create(m_renderer->document());
     range->setStart(node, 0, ec);
-    range->setEnd(indexPosition.node(), indexPosition.offset(), ec);
+    range->setEnd(indexPosition.node(), indexPosition.deprecatedEditingOffset(), ec);
     return TextIterator::rangeLength(range.get());
 }
 
@@ -1672,7 +1820,7 @@ void AccessibilityRenderObject::setSelectedVisiblePositionRange(const VisiblePos
         m_renderer->document()->frame()->selection()->moveTo(range.start, true);
     }
     else {
-        Selection newSelection = Selection(range.start, range.end);
+        VisibleSelection newSelection = VisibleSelection(range.start, range.end);
         m_renderer->document()->frame()->selection()->setSelection(newSelection);
     }    
 }
@@ -1681,7 +1829,7 @@ VisiblePosition AccessibilityRenderObject::visiblePositionForPoint(const IntPoin
 {
     // convert absolute point to view coordinates
     FrameView* frameView = m_renderer->document()->topDocument()->renderer()->view()->frameView();
-    RenderObject* renderer = topRenderer();
+    RenderView* renderView = topRenderer();
     Node* innerNode = 0;
     
     // locate the node containing the point
@@ -1693,9 +1841,10 @@ VisiblePosition AccessibilityRenderObject::visiblePositionForPoint(const IntPoin
 #else
         ourpoint = point;
 #endif
-        HitTestRequest request(true, true);
+        HitTestRequest request(HitTestRequest::ReadOnly |
+                               HitTestRequest::Active);
         HitTestResult result(ourpoint);
-        renderer->layer()->hitTest(request, result);
+        renderView->layer()->hitTest(request, result);
         innerNode = result.innerNode();
         if (!innerNode || !innerNode->renderer())
             return VisiblePosition();
@@ -1703,7 +1852,7 @@ VisiblePosition AccessibilityRenderObject::visiblePositionForPoint(const IntPoin
         pointResult = result.localPoint();
         
         // done if hit something other than a widget
-        renderer = innerNode->renderer();
+        RenderObject* renderer = innerNode->renderer();
         if (!renderer->isWidget())
             break;
         
@@ -1714,10 +1863,7 @@ VisiblePosition AccessibilityRenderObject::visiblePositionForPoint(const IntPoin
         Frame* frame = static_cast<FrameView*>(widget)->frame();
         if (!frame)
             break;
-        Document* document = frame->document();
-        if (!document)
-            break;
-        renderer = document->renderer();
+        renderView = frame->document()->renderView();
         frameView = static_cast<FrameView*>(widget);
     }
     
@@ -1750,7 +1896,7 @@ int AccessibilityRenderObject::index(const VisiblePosition& position) const
     if (!node)
         return -1;
     
-    for (RenderObject* renderer = node->renderer(); renderer && renderer->element(); renderer = renderer->parent()) {
+    for (RenderObject* renderer = node->renderer(); renderer && renderer->node(); renderer = renderer->parent()) {
         if (renderer == m_renderer)
             return indexForVisiblePosition(position);
     }
@@ -1780,7 +1926,7 @@ PlainTextRange AccessibilityRenderObject::doAXRangeForLine(unsigned lineNumber)
     // starting at an empty line.  The resulting selection in that case
     // will be a caret at visiblePos.
     SelectionController selection;
-    selection.setSelection(Selection(visiblePos));
+    selection.setSelection(VisibleSelection(visiblePos));
     selection.modify(SelectionController::EXTEND, SelectionController::LEFT, LineBoundary);
     selection.modify(SelectionController::EXTEND, SelectionController::RIGHT, LineBoundary);
     
@@ -1846,26 +1992,50 @@ IntRect AccessibilityRenderObject::doAXBoundsForRange(const PlainTextRange& rang
     return IntRect();
 }
 
-AccessibilityObject* AccessibilityRenderObject::doAccessibilityHitTest(const IntPoint& point) const
+AccessibilityObject* AccessibilityRenderObject::accessibilityImageMapHitTest(HTMLAreaElement* area, const IntPoint& point) const
 {
-    if (!m_renderer)
+    if (!area)
         return 0;
     
-    RenderLayer* layer = m_renderer->layer();
-    if (!layer)
+    HTMLMapElement *map = static_cast<HTMLMapElement*>(area->parent());
+    AccessibilityObject* parent = accessibilityParentForImageMap(map);
+    if (!parent)
+        return 0;
+    
+    AccessibilityObject::AccessibilityChildrenVector children = parent->children();
+    
+    unsigned count = children.size();
+    for (unsigned k = 0; k < count; ++k) {
+        if (children[k]->elementRect().contains(point))
+            return children[k].get();
+    }
+    
+    return 0;
+}
+    
+AccessibilityObject* AccessibilityRenderObject::doAccessibilityHitTest(const IntPoint& point) const
+{
+    if (!m_renderer || !m_renderer->hasLayer())
         return 0;
     
-    HitTestRequest request(true, true);
+    RenderLayer* layer = toRenderBox(m_renderer)->layer();
+     
+    HitTestRequest request(HitTestRequest::ReadOnly |
+                           HitTestRequest::Active);
     HitTestResult hitTestResult = HitTestResult(point);
     layer->hitTest(request, hitTestResult);
     if (!hitTestResult.innerNode())
         return 0;
     Node* node = hitTestResult.innerNode()->shadowAncestorNode();
+
+    if (node->hasTagName(areaTag)) 
+        return accessibilityImageMapHitTest(static_cast<HTMLAreaElement*>(node), point);
+    
     RenderObject* obj = node->renderer();
     if (!obj)
         return 0;
     
-    AccessibilityObject *result = obj->document()->axObjectCache()->get(obj);
+    AccessibilityObject* result = obj->document()->axObjectCache()->getOrCreate(obj);
 
     if (obj->isListBox())
         return static_cast<AccessibilityListBox*>(result)->doAccessibilityHitTest(point);
@@ -1892,7 +2062,7 @@ AccessibilityObject* AccessibilityRenderObject::focusedUIElement() const
     if (!focusedNodeRenderer)
         return 0;
     
-    AccessibilityObject* obj = focusedNodeRenderer->document()->axObjectCache()->get(focusedNodeRenderer);
+    AccessibilityObject* obj = focusedNodeRenderer->document()->axObjectCache()->getOrCreate(focusedNodeRenderer);
     
     if (obj->shouldFocusActiveDescendant()) {
         if (AccessibilityObject* descendant = obj->activeDescendant())
@@ -1937,9 +2107,9 @@ bool AccessibilityRenderObject::shouldFocusActiveDescendant() const
 
 AccessibilityObject* AccessibilityRenderObject::activeDescendant() const
 {
-    if (renderer()->element() && !renderer()->element()->isElementNode())
+    if (renderer()->node() && !renderer()->node()->isElementNode())
         return 0;
-    Element* element = static_cast<Element*>(renderer()->element());
+    Element* element = static_cast<Element*>(renderer()->node());
         
     String activeDescendantAttrStr = element->getAttribute(aria_activedescendantAttr).string();
     if (activeDescendantAttrStr.isNull() || activeDescendantAttrStr.isEmpty())
@@ -1949,7 +2119,7 @@ AccessibilityObject* AccessibilityRenderObject::activeDescendant() const
     if (!target)
         return 0;
     
-    AccessibilityObject* obj = renderer()->document()->axObjectCache()->get(target->renderer());
+    AccessibilityObject* obj = renderer()->document()->axObjectCache()->getOrCreate(target->renderer());
     if (obj->isAccessibilityRenderObject())
     // an activedescendant is only useful if it has a renderer, because that's what's needed to post the notification
         return obj;
@@ -1959,7 +2129,7 @@ AccessibilityObject* AccessibilityRenderObject::activeDescendant() const
 
 void AccessibilityRenderObject::handleActiveDescendantChanged()
 {
-    Element* element = static_cast<Element*>(renderer()->element());
+    Element* element = static_cast<Element*>(renderer()->node());
     if (!element)
         return;
     Document* doc = renderer()->document();
@@ -1968,15 +2138,15 @@ void AccessibilityRenderObject::handleActiveDescendantChanged()
     AccessibilityRenderObject* activedescendant = static_cast<AccessibilityRenderObject*>(activeDescendant());
     
     if (activedescendant && shouldFocusActiveDescendant())
-        doc->axObjectCache()->postNotificationToElement(activedescendant->renderer(), "AXFocusedUIElementChanged");
+        doc->axObjectCache()->postNotification(activedescendant->renderer(), "AXFocusedUIElementChanged", true);
 }
 
 
 AccessibilityObject* AccessibilityRenderObject::observableObject() const
 {
-    for (RenderObject* renderer = m_renderer; renderer && renderer->element(); renderer = renderer->parent()) {
-        if (renderer->isTextField() || renderer->isTextArea())
-            return renderer->document()->axObjectCache()->get(renderer);
+    for (RenderObject* renderer = m_renderer; renderer && renderer->node(); renderer = renderer->parent()) {
+        if (renderer->isTextControl())
+            return renderer->document()->axObjectCache()->getOrCreate(renderer);
     }
     
     return 0;
@@ -1984,16 +2154,19 @@ AccessibilityObject* AccessibilityRenderObject::observableObject() const
     
 typedef HashMap<String, AccessibilityRole, CaseFoldingHash> ARIARoleMap;
 
+struct RoleEntry {
+    String ariaRole;
+    AccessibilityRole webcoreRole;
+};
 static const ARIARoleMap& createARIARoleMap()
 {
-    struct RoleEntry {
-        String ariaRole;
-        AccessibilityRole webcoreRole;
-    };
-
     const RoleEntry roles[] = {
         { "button", ButtonRole },
         { "checkbox", CheckBoxRole },
+        { "grid", TableRole },
+        { "gridcell", CellRole },
+        { "columnheader", ColumnHeaderRole },
+        { "rowheader", RowHeaderRole },
         { "group", GroupRole },
         { "heading", HeadingRole },
         { "img", ImageRole },
@@ -2007,6 +2180,7 @@ static const ARIARoleMap& createARIARoleMap()
         { "menuitemradio", MenuItemRole },
         { "progressbar", ProgressIndicatorRole },
         { "radio", RadioButtonRole },
+        { "row", RowRole },
         { "range", SliderRole },
         { "slider", SliderRole },
         { "spinbutton", ProgressIndicatorRole },
@@ -2069,7 +2243,7 @@ AccessibilityRole AccessibilityRenderObject::roleValue() const
     if (!m_renderer)
         return UnknownRole;
     
-    Node* node = m_renderer->element();
+    Node* node = m_renderer->node();
     AccessibilityRole ariaRole = ariaRoleAttribute();
     if (ariaRole != UnknownRole)
         return ariaRole;
@@ -2090,6 +2264,9 @@ AccessibilityRole AccessibilityRenderObject::roleValue() const
             return ButtonRole;
         return ImageRole;
     }
+    if (node && node->hasTagName(canvasTag))
+        return ImageRole;
+    
     if (m_renderer->isRenderView())
         return WebAreaRole;
     
@@ -2118,7 +2295,7 @@ AccessibilityRole AccessibilityRenderObject::roleValue() const
     if (m_renderer->isMenuList())
         return PopUpButtonRole;
     
-    if (headingLevel(m_renderer->element()) != 0)
+    if (headingLevel(m_renderer->node()) != 0)
         return HeadingRole;
     
     if (node && node->hasTagName(ddTag))
@@ -2158,12 +2335,18 @@ bool AccessibilityRenderObject::ariaRoleHasPresentationalChildren() const
 
 bool AccessibilityRenderObject::canSetFocusAttribute() const
 {
+    ASSERT(m_renderer);
+    Node* node = m_renderer->node();
+
     // NOTE: It would be more accurate to ask the document whether setFocusedNode() would
     // do anything.  For example, it setFocusedNode() will do nothing if the current focused
     // node will not relinquish the focus.
-    if (!m_renderer->element() || !m_renderer->element()->isEnabled())
+    if (!node || !node->isElementNode())
         return false;
-    
+
+    if (!static_cast<Element*>(node)->isEnabledFormControl())
+        return false;
+
     switch (roleValue()) {
         case WebCoreLinkRole:
         case ImageMapLinkRole:
@@ -2181,6 +2364,9 @@ bool AccessibilityRenderObject::canSetFocusAttribute() const
 
 bool AccessibilityRenderObject::canSetValueAttribute() const
 {
+    if (equalIgnoringCase(getAttribute(aria_readonlyAttr).string(), "true"))
+        return false;
+
     if (isWebArea()) 
         return !isReadOnly();
 
@@ -2194,12 +2380,20 @@ bool AccessibilityRenderObject::canSetTextRangeAttributes() const
 
 void AccessibilityRenderObject::childrenChanged()
 {
-    clearChildren();
+    // this method is meant as a quick way of marking dirty
+    // a portion of the accessibility tree
     
-    if (accessibilityIsIgnored()) {
-        AccessibilityObject* parent = parentObject();
-        if (parent)
-            parent->childrenChanged();
+    markChildrenDirty();
+    
+    if (!m_renderer)
+        return;
+    
+    // Go up the render parent chain, marking children as dirty.
+    // We can't rely on the accessibilityParent() because it may not exist and we must not create an AX object here either
+    for (RenderObject* renderParent = m_renderer->parent(); renderParent; renderParent = renderParent->parent()) {
+        AccessibilityObject* parent = m_renderer->document()->axObjectCache()->get(renderParent);
+        if (parent && parent->isAccessibilityRenderObject())
+            static_cast<AccessibilityRenderObject *>(parent)->markChildrenDirty();
     }
 }
     
@@ -2223,6 +2417,11 @@ bool AccessibilityRenderObject::canHaveChildren() const
 
 const AccessibilityObject::AccessibilityChildrenVector& AccessibilityRenderObject::children()
 {
+    if (m_childrenDirty) {
+        clearChildren();        
+        m_childrenDirty = false;
+    }
+    
     if (!m_haveChildren)
         addChildren();
     return m_children;
@@ -2258,13 +2457,13 @@ void AccessibilityRenderObject::addChildren()
     
     // for a RenderImage, add the <area> elements as individual accessibility objects
     if (m_renderer->isRenderImage()) {
-        HTMLMapElement* map = static_cast<RenderImage*>(m_renderer)->imageMap();
+        HTMLMapElement* map = toRenderImage(m_renderer)->imageMap();
         if (map) {
             for (Node* current = map->firstChild(); current; current = current->traverseNextNode(map)) {
 
                 // add an <area> element for this child if it has a link
                 if (current->isLink()) {
-                    AccessibilityImageMapLink* areaObject = static_cast<AccessibilityImageMapLink*>(m_renderer->document()->axObjectCache()->get(ImageMapLinkRole));
+                    AccessibilityImageMapLink* areaObject = static_cast<AccessibilityImageMapLink*>(m_renderer->document()->axObjectCache()->getOrCreate(ImageMapLinkRole));
                     areaObject->setHTMLAreaElement(static_cast<HTMLAreaElement*>(current));
                     areaObject->setHTMLMapElement(map);
                     areaObject->setParent(this);
@@ -2281,7 +2480,7 @@ void AccessibilityRenderObject::ariaListboxSelectedChildren(AccessibilityChildre
     AccessibilityObject* child = firstChild();
     bool isMultiselectable = false;
     
-    Element* element = static_cast<Element*>(renderer()->element());        
+    Element* element = static_cast<Element*>(renderer()->node());        
     if (!element || !element->isElementNode()) // do this check to ensure safety of static_cast above
         return;
 
@@ -2295,7 +2494,7 @@ void AccessibilityRenderObject::ariaListboxSelectedChildren(AccessibilityChildre
         if (child->isAccessibilityRenderObject())
             childRenderer = static_cast<AccessibilityRenderObject*>(child)->renderer();
         if (childRenderer && ariaRole == ListBoxOptionRole) {
-            Element* childElement = static_cast<Element*>(childRenderer->element());
+            Element* childElement = static_cast<Element*>(childRenderer->node());
             if (childElement && childElement->isElementNode()) { // do this check to ensure safety of static_cast above
                 String selectedAttrString = childElement->getAttribute("aria-selected").string();
                 if (equalIgnoringCase(selectedAttrString, "true")) {
@@ -2345,15 +2544,6 @@ void AccessibilityRenderObject::visibleChildren(AccessibilityChildrenVector& res
     return ariaListboxVisibleChildren(result);
 }
  
-void AccessibilityRenderObject::removeAXObjectID()
-{
-    if (!m_id)
-        return;
-#if PLATFORM(MAC)
-    m_renderer->document()->axObjectCache()->removeAXID(this);
-#endif
-}   
-    
 const String& AccessibilityRenderObject::actionVerb() const
 {
     // FIXME: Need to add verbs for select elements.
@@ -2383,5 +2573,11 @@ const String& AccessibilityRenderObject::actionVerb() const
     }
 }
      
+void AccessibilityRenderObject::updateBackingStore()
+{
+    if (!m_renderer)
+        return;
+    m_renderer->view()->layoutIfNeeded();
+}    
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityRenderObject.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
index 9d43ad8..4fa325f 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityRenderObject.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityRenderObject.h
@@ -50,7 +50,8 @@ class Node;
 class RenderObject;
 class RenderListBox;
 class RenderTextControl;
-class Selection;
+class RenderView;
+class VisibleSelection;
 class String;
 class Widget;
     
@@ -76,6 +77,7 @@ public:
     virtual bool isWebArea() const;
     virtual bool isCheckboxOrRadio() const;
     virtual bool isFileUploadButton() const;
+    virtual bool isInputImage() const;
     virtual bool isProgressIndicator() const;
     virtual bool isSlider() const;
     virtual bool isMenuRelated() const;
@@ -123,8 +125,10 @@ public:
     virtual AccessibilityObject* previousSibling() const;
     virtual AccessibilityObject* nextSibling() const;
     virtual AccessibilityObject* parentObject() const;
+    virtual AccessibilityObject* parentObjectIfExists() const;
     virtual AccessibilityObject* observableObject() const;
     virtual void linkedUIElements(AccessibilityChildrenVector&) const;
+    virtual bool exposesTitleUIElement() const;
     virtual AccessibilityObject* titleUIElement() const;
     virtual AccessibilityRole ariaRoleAttribute() const;
     virtual bool isPresentationalChildOfAriaRole() const;
@@ -146,7 +150,7 @@ public:
     
     void setRenderer(RenderObject* renderer) { m_renderer = renderer; }
     RenderObject* renderer() const { return m_renderer; }
-    RenderObject* topRenderer() const;
+    RenderView* topRenderer() const;
     RenderTextControl* textControl() const;
     Document* document() const;
     FrameView* topDocumentFrameView() const;  
@@ -154,7 +158,7 @@ public:
     
     virtual KURL url() const;
     virtual PlainTextRange selectedTextRange() const;
-    virtual Selection selection() const;
+    virtual VisibleSelection selection() const;
     virtual String stringValue() const;
     virtual String ariaAccessiblityName(const String&) const;
     virtual String ariaLabeledByAttribute() const;
@@ -173,6 +177,7 @@ public:
     virtual Widget* widgetForAttachmentView() const;
     virtual void getDocumentLinks(AccessibilityChildrenVector&);
     virtual FrameView* documentFrameView() const;
+    virtual String language() const;
     
     virtual const AccessibilityChildrenVector& children();
     
@@ -208,18 +213,21 @@ public:
     virtual String doAXStringForRange(const PlainTextRange&) const;
     virtual IntRect doAXBoundsForRange(const PlainTextRange&) const;
     
+    virtual void updateBackingStore();
+    
 protected:
     RenderObject* m_renderer;
     AccessibilityRole m_ariaRole;
+    mutable bool m_childrenDirty;
     
     void setRenderObject(RenderObject* renderer) { m_renderer = renderer; }
-    virtual void removeAXObjectID();
     
     virtual bool isDetached() const { return !m_renderer; }
 
 private:
     void ariaListboxSelectedChildren(AccessibilityChildrenVector&);
     void ariaListboxVisibleChildren(AccessibilityChildrenVector&);
+    bool ariaIsHidden() const;
 
     Element* menuElementForMenuButton() const;
     Element* menuItemElementForMenu() const; 
@@ -228,8 +236,10 @@ private:
     IntRect checkboxOrRadioRect() const;
     void addRadioButtonGroupMembers(AccessibilityChildrenVector& linkedUIElements) const;
     AccessibilityObject* internalLinkElement() const;
+    AccessibilityObject* accessibilityImageMapHitTest(HTMLAreaElement*, const IntPoint&) const;
     AccessibilityObject* accessibilityParentForImageMap(HTMLMapElement* map) const;
 
+    void markChildrenDirty() const { m_childrenDirty = true; }
 };
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityTable.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.cpp
index ee54496..6d7dbe2 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityTable.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.cpp
@@ -53,13 +53,11 @@ AccessibilityTable::AccessibilityTable(RenderObject* renderer)
     : AccessibilityRenderObject(renderer),
     m_headerContainer(0)
 {
-    // FIXME: We need to disable Accessibility Tables entirely on the Mac until <rdar://problem/6372481> is resolved.
-#if PLATFORM(MAC)
-    m_isAccessibilityTable = false;
-#else    
+#if ACCESSIBILITY_TABLES
     m_isAccessibilityTable = isTableExposableThroughAccessibility();
+#else
+    m_isAccessibilityTable = false;
 #endif
-
 }
 
 AccessibilityTable::~AccessibilityTable()
@@ -83,8 +81,6 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
     // if the developer assigned an aria role to this, then we shouldn't 
     // expose it as a table, unless, of course, the aria role is a table
     AccessibilityRole ariaRole = ariaRoleAttribute();
-    if (ariaRole == TableRole)
-        return true;
     if (ariaRole != UnknownRole)
         return false;
     
@@ -95,7 +91,7 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
     // Unfortunately, there is no good way to determine the difference
     // between a "layout" table and a "data" table
     
-    Node* tableNode = table->element();
+    Node* tableNode = table->node();
     if (!tableNode || !tableNode->hasTagName(tableTag))
         return false;
     
@@ -141,7 +137,7 @@ bool AccessibilityTable::isTableExposableThroughAccessibility()
             RenderTableCell* cell = firstBody->cellAt(row, col).cell;
             if (!cell)
                 continue;
-            Node* cellNode = cell->element();
+            Node* cellNode = cell->node();
             if (!cellNode)
                 continue;
             
@@ -213,7 +209,7 @@ void AccessibilityTable::addChildren()
     ASSERT(!m_haveChildren); 
     
     m_haveChildren = true;
-    if (!m_renderer)
+    if (!m_renderer || !m_renderer->isTable())
         return;
     
     RenderTable* table = static_cast<RenderTable*>(m_renderer);
@@ -243,7 +239,7 @@ void AccessibilityTable::addChildren()
                 if (!cell)
                     continue;
                 
-                AccessibilityObject* rowObject = axCache->get(cell->parent());
+                AccessibilityObject* rowObject = axCache->getOrCreate(cell->parent());
                 if (!rowObject->isTableRow())
                     continue;
                 
@@ -266,7 +262,7 @@ void AccessibilityTable::addChildren()
     // make the columns based on the number of columns in the first body
     unsigned length = initialTableSection->numColumns();
     for (unsigned i = 0; i < length; ++i) {
-        AccessibilityTableColumn* column = static_cast<AccessibilityTableColumn*>(axCache->get(ColumnRole));
+        AccessibilityTableColumn* column = static_cast<AccessibilityTableColumn*>(axCache->getOrCreate(ColumnRole));
         column->setColumnIndex((int)i);
         column->setParentTable(this);
         m_columns.append(column);
@@ -283,7 +279,7 @@ AccessibilityObject* AccessibilityTable::headerContainer()
     if (m_headerContainer)
         return m_headerContainer;
     
-    m_headerContainer = static_cast<AccessibilityTableHeaderContainer*>(axObjectCache()->get(TableHeaderContainerRole));
+    m_headerContainer = static_cast<AccessibilityTableHeaderContainer*>(axObjectCache()->getOrCreate(TableHeaderContainerRole));
     m_headerContainer->setParentTable(this);
     
     return m_headerContainer;
@@ -354,7 +350,7 @@ void AccessibilityTable::cells(AccessibilityObject::AccessibilityChildrenVector&
     }
 }
     
-const unsigned AccessibilityTable::columnCount()
+unsigned AccessibilityTable::columnCount()
 {
     if (!hasChildren())
         addChildren();
@@ -362,7 +358,7 @@ const unsigned AccessibilityTable::columnCount()
     return m_columns.size();    
 }
     
-const unsigned AccessibilityTable::rowCount()
+unsigned AccessibilityTable::rowCount()
 {
     if (!hasChildren())
         addChildren();
@@ -372,7 +368,7 @@ const unsigned AccessibilityTable::rowCount()
     
 AccessibilityTableCell* AccessibilityTable::cellForColumnAndRow(unsigned column, unsigned row)
 {
-    if (!m_renderer)
+    if (!m_renderer || !m_renderer->isTable())
         return 0;
     
     if (!hasChildren())
@@ -388,11 +384,13 @@ AccessibilityTableCell* AccessibilityTable::cellForColumnAndRow(unsigned column,
     unsigned rowOffset = 0;
     while (tableSection) {
         
-        rowCount += tableSection->numRows();
+        unsigned numRows = tableSection->numRows();
         unsigned numCols = tableSection->numColumns();
         
-        if (row < rowCount && column < numCols) {
-            int sectionSpecificRow = row - rowOffset;
+        rowCount += numRows;
+        
+        unsigned sectionSpecificRow = row - rowOffset;            
+        if (row < rowCount && column < numCols && sectionSpecificRow < numRows) {
             cell = tableSection->cellAt(sectionSpecificRow, column).cell;
             
             // we didn't find the cell, which means there's spanning happening
@@ -424,9 +422,9 @@ AccessibilityTableCell* AccessibilityTable::cellForColumnAndRow(unsigned column,
         if (cell)
             break;
         
-        rowOffset += rowCount;
+        rowOffset += numRows;
         // we didn't find anything between the rows we should have
-        if (row < rowOffset)
+        if (row < rowCount)
             break;
         tableSection = table->sectionBelow(tableSection, true);        
     }
@@ -434,7 +432,7 @@ AccessibilityTableCell* AccessibilityTable::cellForColumnAndRow(unsigned column,
     if (!cell)
         return 0;
     
-    AccessibilityObject* cellObject = axObjectCache()->get(cell);
+    AccessibilityObject* cellObject = axObjectCache()->getOrCreate(cell);
     ASSERT(cellObject->isTableCell());
     
     return static_cast<AccessibilityTableCell*>(cellObject);
@@ -466,8 +464,8 @@ String AccessibilityTable::title() const
         return title;
     
     // see if there is a caption
-    Node *tableElement = m_renderer->element();
-    if (tableElement) {
+    Node* tableElement = m_renderer->node();
+    if (tableElement && tableElement->hasTagName(tableTag)) {
         HTMLTableCaptionElement* caption = static_cast<HTMLTableElement*>(tableElement)->caption();
         if (caption)
             title = caption->innerText();
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityTable.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.h
index b98b6b7..b6aa3ca 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityTable.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTable.h
@@ -31,6 +31,12 @@
 
 #include "AccessibilityRenderObject.h"
 
+#if PLATFORM(MAC) && (defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD))
+#define ACCESSIBILITY_TABLES 0
+#else
+#define ACCESSIBILITY_TABLES 1
+#endif
+
 namespace WebCore {
 
 class String;
@@ -39,7 +45,7 @@ class AccessibilityTableHeaderContainer;
     
 class AccessibilityTable : public AccessibilityRenderObject {
 
-private:
+protected:
     AccessibilityTable(RenderObject*);
 public:
     static PassRefPtr<AccessibilityTable> create(RenderObject*);
@@ -47,6 +53,7 @@ public:
     
     virtual bool isDataTable() const;
     virtual AccessibilityRole roleValue() const;
+    virtual bool isAriaTable() const { return false; }
     
     virtual bool accessibilityIsIgnored() const;
     
@@ -56,14 +63,14 @@ public:
     AccessibilityChildrenVector& columns();
     AccessibilityChildrenVector& rows();
     
-    const unsigned columnCount();
-    const unsigned rowCount();
+    unsigned columnCount();
+    unsigned rowCount();
     
     virtual String title() const;
     
     // all the cells in the table
     void cells(AccessibilityChildrenVector&);
-    AccessibilityTableCell* cellForColumnAndRow(unsigned column, unsigned row);
+    virtual AccessibilityTableCell* cellForColumnAndRow(unsigned column, unsigned row);
     
     void columnHeaders(AccessibilityChildrenVector&);
     void rowHeaders(AccessibilityChildrenVector&);
@@ -71,7 +78,7 @@ public:
     // an object that contains, as children, all the objects that act as headers
     AccessibilityObject* headerContainer();
     
-private:    
+protected:    
     AccessibilityChildrenVector m_rows;
     AccessibilityChildrenVector m_columns;
     
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityTableCell.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.cpp
index ff82811..7ac3937 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityTableCell.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.cpp
@@ -61,14 +61,19 @@ bool AccessibilityTableCell::accessibilityIsIgnored() const
     
     return false;
 }
-    
-bool AccessibilityTableCell::isTableCell() const
+   
+AccessibilityObject* AccessibilityTableCell::parentTable() const
 {
-    if (!m_renderer)
+    if (!m_renderer || !m_renderer->isTableCell())
         return false;
     
-    AccessibilityObject* renderTable = axObjectCache()->get(static_cast<RenderTableCell*>(m_renderer)->table());
-    if (!renderTable->isDataTable())
+    return axObjectCache()->getOrCreate(static_cast<RenderTableCell*>(m_renderer)->table());
+}
+    
+bool AccessibilityTableCell::isTableCell() const
+{
+    AccessibilityObject* table = parentTable();
+    if (!table || !table->isDataTable())
         return false;
     
     return true;
@@ -84,7 +89,7 @@ AccessibilityRole AccessibilityTableCell::roleValue() const
     
 void AccessibilityTableCell::rowIndexRange(pair<int, int>& rowRange)
 {
-    if (!m_renderer)
+    if (!m_renderer || !m_renderer->isTableCell())
         return;
     
     RenderTableCell* renderCell = static_cast<RenderTableCell*>(m_renderer);
@@ -114,7 +119,7 @@ void AccessibilityTableCell::rowIndexRange(pair<int, int>& rowRange)
     
 void AccessibilityTableCell::columnIndexRange(pair<int, int>& columnRange)
 {
-    if (!m_renderer)
+    if (!m_renderer || !m_renderer->isTableCell())
         return;
     
     RenderTableCell* renderCell = static_cast<RenderTableCell*>(m_renderer);
@@ -127,7 +132,13 @@ AccessibilityObject* AccessibilityTableCell::titleUIElement() const
     // Try to find if the first cell in this row is a <th>. If it is,
     // then it can act as the title ui element. (This is only in the
     // case when the table is not appearing as an AXTable.)
-    if (!m_renderer || isTableCell())
+    if (isTableCell() || !m_renderer || !m_renderer->isTableCell())
+        return 0;
+
+    // Table cells that are th cannot have title ui elements, since by definition
+    // they are title ui elements
+    Node* node = m_renderer->node();
+    if (node && node->hasTagName(thTag))
         return 0;
     
     RenderTableCell* renderCell = static_cast<RenderTableCell*>(m_renderer);
@@ -147,11 +158,11 @@ AccessibilityObject* AccessibilityTableCell::titleUIElement() const
     if (!headerCell || headerCell == renderCell)
         return 0;
 
-    Node* cellElement = headerCell->element();
+    Node* cellElement = headerCell->node();
     if (!cellElement || !cellElement->hasTagName(thTag))
         return 0;
     
-    return axObjectCache()->get(headerCell);
+    return axObjectCache()->getOrCreate(headerCell);
 }
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityTableCell.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.h
index 8f8dd77..dabbce2 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityTableCell.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableCell.h
@@ -35,7 +35,7 @@ namespace WebCore {
     
 class AccessibilityTableCell : public AccessibilityRenderObject {
     
-private:
+protected:
     AccessibilityTableCell(RenderObject*);
 public:
     static PassRefPtr<AccessibilityTableCell> create(RenderObject*);
@@ -47,17 +47,17 @@ public:
     virtual bool accessibilityIsIgnored() const;
 
     // fills in the start location and row span of cell
-    void rowIndexRange(pair<int, int>& rowRange);
+    virtual void rowIndexRange(pair<int, int>& rowRange);
     // fills in the start location and column span of cell
-    void columnIndexRange(pair<int, int>& columnRange);
+    virtual void columnIndexRange(pair<int, int>& columnRange);
     
     // if a table cell is not exposed as a table cell, a TH element can
     // serve as its title ui element
     AccessibilityObject* titleUIElement() const;
     
-private:
+protected:
+    virtual AccessibilityObject* parentTable() const;
     int m_rowIndex;
-    
 }; 
     
 } // namespace WebCore 
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityTableColumn.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.cpp
index 6e03af9..ee79444 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityTableColumn.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.cpp
@@ -61,7 +61,6 @@ void AccessibilityTableColumn::setParentTable(AccessibilityTable* table)
     m_parentTable = table;
     
     clearChildren();
-    addChildren();
 }
     
 IntRect AccessibilityTableColumn::elementRect() const
@@ -87,7 +86,26 @@ AccessibilityObject* AccessibilityTableColumn::headerObject()
     if (!m_parentTable)
         return 0;
     
-    RenderTable* table = static_cast<RenderTable*>(m_parentTable->renderer());
+    RenderObject* renderer = m_parentTable->renderer();
+    if (!renderer)
+        return 0;
+    
+    if (m_parentTable->isAriaTable()) {
+        AccessibilityChildrenVector rowChildren = children();
+        unsigned childrenCount = rowChildren.size();
+        for (unsigned i = 0; i < childrenCount; ++i) {
+            AccessibilityObject* cell = rowChildren[i].get();
+            if (cell->ariaRoleAttribute() == ColumnHeaderRole)
+                return cell;
+        }
+        
+        return 0;
+    }
+
+    if (!renderer->isTable())
+        return 0;
+    
+    RenderTable* table = static_cast<RenderTable*>(renderer);
     
     AccessibilityObject* headerObject = 0;
     
@@ -124,7 +142,7 @@ AccessibilityObject* AccessibilityTableColumn::headerObjectForSection(RenderTabl
         if ((testCell->col() + (testCell->colSpan()-1)) < m_columnIndex)
             break;
         
-        Node* node = testCell->element();
+        Node* node = testCell->node();
         if (!node)
             continue;
         
@@ -137,7 +155,7 @@ AccessibilityObject* AccessibilityTableColumn::headerObjectForSection(RenderTabl
     if (!cell)
         return 0;
 
-    return m_parentTable->axObjectCache()->get(cell);
+    return m_parentTable->axObjectCache()->getOrCreate(cell);
 }
     
 void AccessibilityTableColumn::addChildren()
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityTableColumn.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.h
index 6270398..6270398 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityTableColumn.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableColumn.h
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityTableHeaderContainer.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp
index af9de39..af9de39 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityTableHeaderContainer.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.cpp
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityTableHeaderContainer.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.h
index 8a9448a..8a9448a 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityTableHeaderContainer.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableHeaderContainer.h
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityTableRow.cpp b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.cpp
index caccff5..9f5f972 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityTableRow.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.cpp
@@ -67,11 +67,8 @@ AccessibilityRole AccessibilityTableRow::roleValue() const
 
 bool AccessibilityTableRow::isTableRow() const
 {
-    if (!m_renderer)
-        return true;
-    
-    AccessibilityObject* renderTable = axObjectCache()->get(static_cast<RenderTableRow*>(m_renderer)->table());
-    if (!renderTable->isDataTable())
+    AccessibilityObject* table = parentTable();
+    if (!table || !table->isDataTable())
         return false;
     
     return true;
@@ -85,8 +82,19 @@ bool AccessibilityTableRow::accessibilityIsIgnored() const
     return false;
 }
     
+AccessibilityObject* AccessibilityTableRow::parentTable() const
+{
+    if (!m_renderer || !m_renderer->isTableRow())
+        return 0;
+    
+    return axObjectCache()->getOrCreate(static_cast<RenderTableRow*>(m_renderer)->table());
+}
+    
 AccessibilityObject* AccessibilityTableRow::headerObject()
 {
+    if (!m_renderer || !m_renderer->isTableRow())
+        return 0;
+    
     AccessibilityChildrenVector rowChildren = children();
     if (!rowChildren.size())
         return 0;
@@ -100,7 +108,7 @@ AccessibilityObject* AccessibilityTableRow::headerObject()
     if (!cellRenderer)
         return 0;
     
-    Node* cellNode = cellRenderer->element();
+    Node* cellNode = cellRenderer->node();
     if (!cellNode || !cellNode->hasTagName(thTag))
         return 0;
     
diff --git a/src/3rdparty/webkit/WebCore/page/AccessibilityTableRow.h b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.h
index 0ec7f04..29ac935 100644
--- a/src/3rdparty/webkit/WebCore/page/AccessibilityTableRow.h
+++ b/src/3rdparty/webkit/WebCore/accessibility/AccessibilityTableRow.h
@@ -35,7 +35,7 @@ namespace WebCore {
     
 class AccessibilityTableRow : public AccessibilityRenderObject {
     
-private:
+protected:
     AccessibilityTableRow(RenderObject*);
 public:
     static PassRefPtr<AccessibilityTableRow> create(RenderObject*);
@@ -43,11 +43,11 @@ public:
     
     virtual bool isTableRow() const;
     virtual AccessibilityRole roleValue() const;
+    virtual bool accessibilityIsIgnored() const;
 
     // retrieves the "row" header (a th tag in the rightmost column)
-    AccessibilityObject* headerObject();
-
-    virtual bool accessibilityIsIgnored() const;
+    virtual AccessibilityObject* headerObject();
+    virtual AccessibilityObject* parentTable() const;
     
     void setRowIndex(int rowIndex) { m_rowIndex = rowIndex; }
     int rowIndex() const { return m_rowIndex; }
diff --git a/src/3rdparty/webkit/WebCore/page/qt/AccessibilityObjectQt.cpp b/src/3rdparty/webkit/WebCore/accessibility/qt/AccessibilityObjectQt.cpp
index 1710027..1710027 100644
--- a/src/3rdparty/webkit/WebCore/page/qt/AccessibilityObjectQt.cpp
+++ b/src/3rdparty/webkit/WebCore/accessibility/qt/AccessibilityObjectQt.cpp
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp
index ceb7928..db295c2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/GCController.cpp
@@ -65,7 +65,7 @@ GCController::GCController()
 void GCController::garbageCollectSoon()
 {
     if (!m_GCTimer.isActive())
-        m_GCTimer.startOneShot(0);
+        m_GCTimer.startOneShot(0.5);
 }
 
 void GCController::gcTimerFired(Timer<GCController>*)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
index a97d039..4f3c8ee 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAttrCustom.cpp
@@ -40,14 +40,14 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-void JSAttr::setValue(ExecState* exec, JSValuePtr value)
+void JSAttr::setValue(ExecState* exec, JSValue value)
 {
     Attr* imp = static_cast<Attr*>(impl());
     String attrValue = valueToStringWithNullCheck(exec, value);
 
     Element* ownerElement = imp->ownerElement();
     if (ownerElement && (ownerElement->hasTagName(iframeTag) || ownerElement->hasTagName(frameTag))) {
-        if (equalIgnoringCase(imp->name(), "src") && protocolIs(parseURL(attrValue), "javascript")) {
+        if (equalIgnoringCase(imp->name(), "src") && protocolIsJavaScript(parseURL(attrValue))) {
             if (!checkNodeSecurity(exec, static_cast<HTMLFrameElementBase*>(ownerElement)->contentDocument()))
                 return;
         }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
index eed5b2e..74bcad5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.cpp
@@ -41,22 +41,33 @@ namespace WebCore {
 
 const ClassInfo JSAudioConstructor::s_info = { "AudioConstructor", 0, 0, 0 };
 
-JSAudioConstructor::JSAudioConstructor(ExecState* exec, ScriptExecutionContext* context)
+JSAudioConstructor::JSAudioConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
     : DOMObject(JSAudioConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    , m_globalObject(globalObject)
 {
-    ASSERT(context->isDocument());
-    m_document = static_cast<JSDocument*>(asObject(toJS(exec, static_cast<Document*>(context))));
+    ASSERT(globalObject->scriptExecutionContext());
+    ASSERT(globalObject->scriptExecutionContext()->isDocument());
 
+    putDirect(exec->propertyNames().prototype, JSHTMLAudioElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
 }
 
+Document* JSAudioConstructor::document() const
+{
+    return static_cast<Document*>(m_globalObject->scriptExecutionContext());
+}
+
 static JSObject* constructAudio(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
     // FIXME: Why doesn't this need the call toJS on the document like JSImageConstructor?
 
-    RefPtr<HTMLAudioElement> audio = new HTMLAudioElement(HTMLNames::audioTag, static_cast<JSAudioConstructor*>(constructor)->document());
+    Document* document = static_cast<JSAudioConstructor*>(constructor)->document();
+    if (!document)
+        return throwError(exec, ReferenceError, "Audio constructor associated document is unavailable");
+
+    RefPtr<HTMLAudioElement> audio = new HTMLAudioElement(HTMLNames::audioTag, document);
     if (args.size() > 0) {
-        audio->setSrc(args.at(exec, 0)->toString(exec));
+        audio->setSrc(args.at(0).toString(exec));
         audio->scheduleLoad();
     }
     return asObject(toJS(exec, audio.release()));
@@ -71,8 +82,8 @@ ConstructType JSAudioConstructor::getConstructData(ConstructData& constructData)
 void JSAudioConstructor::mark()
 {
     DOMObject::mark();
-    if (!m_document->marked())
-        m_document->mark();
+    if (!m_globalObject->marked())
+        m_globalObject->mark();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.h
index cdff10f..0a3a7ea 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSAudioConstructor.h
@@ -36,9 +36,9 @@ namespace WebCore {
 
     class JSAudioConstructor : public DOMObject {
     public:
-        JSAudioConstructor(JSC::ExecState*, ScriptExecutionContext*);
+        JSAudioConstructor(JSC::ExecState*, JSDOMGlobalObject*);
 
-        Document* document() const { return m_document->impl(); }
+        Document* document() const;
 
         static const JSC::ClassInfo s_info;
 
@@ -48,7 +48,7 @@ namespace WebCore {
 
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 
-        JSDocument* m_document;
+        JSDOMGlobalObject* m_globalObject;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCDATASectionCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCDATASectionCustom.cpp
new file mode 100644
index 0000000..44a8957
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCDATASectionCustom.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSCDATASection.h"
+
+#include "CDATASection.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue toJSNewlyCreated(ExecState* exec, CDATASection* section)
+{
+    if (!section)
+        return jsNull();
+    
+    return CREATE_DOM_NODE_WRAPPER(exec, CDATASection, section);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp
index 32462fa..2c20431 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSRuleCustom.cpp
@@ -49,7 +49,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, CSSRule* rule)
+JSValue toJS(ExecState* exec, CSSRule* rule)
 {
     if (!rule)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
index 6c46ae4..280ec93 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSStyleDeclarationCustom.cpp
@@ -77,7 +77,7 @@ static String cssPropertyName(const Identifier& propertyName, bool* hadPixelOrPo
         return String();
 
     Vector<UChar> name;
-    name.reserveCapacity(length);
+    name.reserveInitialCapacity(length);
 
     unsigned i = 0;
 
@@ -125,9 +125,9 @@ bool JSCSSStyleDeclaration::canGetItemsForName(ExecState*, CSSStyleDeclaration*,
     return isCSSPropertyName(propertyName);
 }
 
-// FIXME: You can get these properties, and set them (see customPut below),
+// FIXME: You can get these properties, and set them (see putDelegate below),
 // but you should also be able to enumerate them.
-JSValuePtr JSCSSStyleDeclaration::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCSSStyleDeclaration::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSCSSStyleDeclaration* thisObj = static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()));
 
@@ -156,7 +156,7 @@ JSValuePtr JSCSSStyleDeclaration::nameGetter(ExecState* exec, const Identifier&
 }
 
 
-bool JSCSSStyleDeclaration::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot&)
+bool JSCSSStyleDeclaration::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
 {
     if (!isCSSPropertyName(propertyName))
         return false;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp
index 9e31304..ad0cee1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCSSValueCustom.cpp
@@ -44,7 +44,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, CSSValue* value)
+JSValue toJS(ExecState* exec, CSSValue* value)
 {
     if (!value)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
index 6eb4fc5..398a679 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -28,11 +28,13 @@
 #include "FloatRect.h"
 #include "HTMLCanvasElement.h"
 #include "HTMLImageElement.h"
+#include "HTMLVideoElement.h"
 #include "ImageData.h"
 #include "JSCanvasGradient.h"
 #include "JSCanvasPattern.h"
 #include "JSHTMLCanvasElement.h"
 #include "JSHTMLImageElement.h"
+#include "JSHTMLVideoElement.h"
 #include "JSImageData.h"
 #include <runtime/Error.h>
 
@@ -40,7 +42,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-static JSValuePtr toJS(ExecState* exec, CanvasStyle* style)
+static JSValue toJS(ExecState* exec, CanvasStyle* style)
 {
     if (style->canvasGradient())
         return toJS(exec, style->canvasGradient());
@@ -49,11 +51,11 @@ static JSValuePtr toJS(ExecState* exec, CanvasStyle* style)
     return jsString(exec, style->color());
 }
 
-static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState*, JSValuePtr value)
+static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState*, JSValue value)
 {
-    if (value->isString())
+    if (value.isString())
         return CanvasStyle::create(asString(value)->value());
-    if (!value->isObject())
+    if (!value.isObject())
         return 0;
     JSObject* object = asObject(value);
     if (object->inherits(&JSCanvasGradient::s_info))
@@ -63,27 +65,27 @@ static PassRefPtr<CanvasStyle> toHTMLCanvasStyle(ExecState*, JSValuePtr value)
     return 0;
 }
 
-JSValuePtr JSCanvasRenderingContext2D::strokeStyle(ExecState* exec) const
+JSValue JSCanvasRenderingContext2D::strokeStyle(ExecState* exec) const
 {
     return toJS(exec, impl()->strokeStyle());        
 }
 
-void JSCanvasRenderingContext2D::setStrokeStyle(ExecState* exec, JSValuePtr value)
+void JSCanvasRenderingContext2D::setStrokeStyle(ExecState* exec, JSValue value)
 {
     impl()->setStrokeStyle(toHTMLCanvasStyle(exec, value));
 }
 
-JSValuePtr JSCanvasRenderingContext2D::fillStyle(ExecState* exec) const
+JSValue JSCanvasRenderingContext2D::fillStyle(ExecState* exec) const
 {
     return toJS(exec, impl()->fillStyle());
 }
 
-void JSCanvasRenderingContext2D::setFillStyle(ExecState* exec, JSValuePtr value)
+void JSCanvasRenderingContext2D::setFillStyle(ExecState* exec, JSValue value)
 {
     impl()->setFillStyle(toHTMLCanvasStyle(exec, value));
 }
 
-JSValuePtr JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgList& args)
 {
     CanvasRenderingContext2D* context = impl();
 
@@ -95,24 +97,24 @@ JSValuePtr JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgLi
     // 5 args = c, m, y, k, a
     switch (args.size()) {
         case 1:
-            if (args.at(exec, 0)->isString())
-                context->setFillColor(asString(args.at(exec, 0))->value());
+            if (args.at(0).isString())
+                context->setFillColor(asString(args.at(0))->value());
             else
-                context->setFillColor(args.at(exec, 0)->toFloat(exec));
+                context->setFillColor(args.at(0).toFloat(exec));
             break;
         case 2:
-            if (args.at(exec, 0)->isString())
-                context->setFillColor(asString(args.at(exec, 0))->value(), args.at(exec, 1)->toFloat(exec));
+            if (args.at(0).isString())
+                context->setFillColor(asString(args.at(0))->value(), args.at(1).toFloat(exec));
             else
-                context->setFillColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec));
+                context->setFillColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec));
             break;
         case 4:
-            context->setFillColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                  args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+            context->setFillColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                  args.at(2).toFloat(exec), args.at(3).toFloat(exec));
             break;
         case 5:
-            context->setFillColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                  args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec));
+            context->setFillColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                  args.at(2).toFloat(exec), args.at(3).toFloat(exec), args.at(4).toFloat(exec));
             break;
         default:
             return throwError(exec, SyntaxError);
@@ -120,7 +122,7 @@ JSValuePtr JSCanvasRenderingContext2D::setFillColor(ExecState* exec, const ArgLi
     return jsUndefined();
 }    
 
-JSValuePtr JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
@@ -132,24 +134,24 @@ JSValuePtr JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const Arg
     // 5 args = c, m, y, k, a
     switch (args.size()) {
         case 1:
-            if (args.at(exec, 0)->isString())
-                context->setStrokeColor(asString(args.at(exec, 0))->value());
+            if (args.at(0).isString())
+                context->setStrokeColor(asString(args.at(0))->value());
             else
-                context->setStrokeColor(args.at(exec, 0)->toFloat(exec));
+                context->setStrokeColor(args.at(0).toFloat(exec));
             break;
         case 2:
-            if (args.at(exec, 0)->isString())
-                context->setStrokeColor(asString(args.at(exec, 0))->value(), args.at(exec, 1)->toFloat(exec));
+            if (args.at(0).isString())
+                context->setStrokeColor(asString(args.at(0))->value(), args.at(1).toFloat(exec));
             else
-                context->setStrokeColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec));
+                context->setStrokeColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec));
             break;
         case 4:
-            context->setStrokeColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                    args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+            context->setStrokeColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                    args.at(2).toFloat(exec), args.at(3).toFloat(exec));
             break;
         case 5:
-            context->setStrokeColor(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                    args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec));
+            context->setStrokeColor(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                    args.at(2).toFloat(exec), args.at(3).toFloat(exec), args.at(4).toFloat(exec));
             break;
         default:
             return throwError(exec, SyntaxError);
@@ -158,21 +160,21 @@ JSValuePtr JSCanvasRenderingContext2D::setStrokeColor(ExecState* exec, const Arg
     return jsUndefined();
 }
 
-JSValuePtr JSCanvasRenderingContext2D::strokeRect(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::strokeRect(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
     
     if (args.size() <= 4)
-        context->strokeRect(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                            args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+        context->strokeRect(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                            args.at(2).toFloat(exec), args.at(3).toFloat(exec));
     else
-        context->strokeRect(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                            args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec));
+        context->strokeRect(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                            args.at(2).toFloat(exec), args.at(3).toFloat(exec), args.at(4).toFloat(exec));
 
     return jsUndefined();    
 }
 
-JSValuePtr JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
@@ -182,8 +184,8 @@ JSValuePtr JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList&
     //     drawImage(img, sx, sy, sw, sh, dx, dy, dw, dh)
     // Composite operation is specified with globalCompositeOperation.
     // The img parameter can be a <img> or <canvas> element.
-    JSValuePtr value = args.at(exec, 0);
-    if (!value->isObject())
+    JSValue value = args.at(0);
+    if (!value.isObject())
         return throwError(exec, TypeError);
     JSObject* o = asObject(value);
     
@@ -192,18 +194,18 @@ JSValuePtr JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList&
         HTMLImageElement* imgElt = static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl());
         switch (args.size()) {
             case 3:
-                context->drawImage(imgElt, args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec));
+                context->drawImage(imgElt, args.at(1).toFloat(exec), args.at(2).toFloat(exec));
                 break;
             case 5:
-                context->drawImage(imgElt, args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec),
-                                   args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec), ec);
+                context->drawImage(imgElt, args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                                   args.at(3).toFloat(exec), args.at(4).toFloat(exec), ec);
                 setDOMException(exec, ec);
                 break;
             case 9:
-                context->drawImage(imgElt, FloatRect(args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec),
-                                   args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec)),
-                                   FloatRect(args.at(exec, 5)->toFloat(exec), args.at(exec, 6)->toFloat(exec),
-                                   args.at(exec, 7)->toFloat(exec), args.at(exec, 8)->toFloat(exec)), ec);
+                context->drawImage(imgElt, FloatRect(args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                                   args.at(3).toFloat(exec), args.at(4).toFloat(exec)),
+                                   FloatRect(args.at(5).toFloat(exec), args.at(6).toFloat(exec),
+                                   args.at(7).toFloat(exec), args.at(8).toFloat(exec)), ec);
                 setDOMException(exec, ec);
                 break;
             default:
@@ -213,23 +215,46 @@ JSValuePtr JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList&
         HTMLCanvasElement* canvas = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl());
         switch (args.size()) {
             case 3:
-                context->drawImage(canvas, args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec));
+                context->drawImage(canvas, args.at(1).toFloat(exec), args.at(2).toFloat(exec));
                 break;
             case 5:
-                context->drawImage(canvas, args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec),
-                                   args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec), ec);
+                context->drawImage(canvas, args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                                   args.at(3).toFloat(exec), args.at(4).toFloat(exec), ec);
                 setDOMException(exec, ec);
                 break;
             case 9:
-                context->drawImage(canvas, FloatRect(args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec),
-                                   args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec)),
-                                   FloatRect(args.at(exec, 5)->toFloat(exec), args.at(exec, 6)->toFloat(exec),
-                                   args.at(exec, 7)->toFloat(exec), args.at(exec, 8)->toFloat(exec)), ec);
+                context->drawImage(canvas, FloatRect(args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                                   args.at(3).toFloat(exec), args.at(4).toFloat(exec)),
+                                   FloatRect(args.at(5).toFloat(exec), args.at(6).toFloat(exec),
+                                   args.at(7).toFloat(exec), args.at(8).toFloat(exec)), ec);
                 setDOMException(exec, ec);
                 break;
             default:
                 return throwError(exec, SyntaxError);
         }
+#if ENABLE(VIDEO)
+    } else if (o->inherits(&JSHTMLVideoElement::s_info)) {
+            HTMLVideoElement* video = static_cast<HTMLVideoElement*>(static_cast<JSHTMLElement*>(o)->impl());
+            switch (args.size()) {
+                case 3:
+                    context->drawImage(video, args.at(1).toFloat(exec), args.at(2).toFloat(exec));
+                    break;
+                case 5:
+                    context->drawImage(video, args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                                       args.at(3).toFloat(exec), args.at(4).toFloat(exec), ec);
+                    setDOMException(exec, ec);
+                    break;
+                case 9:
+                    context->drawImage(video, FloatRect(args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                                       args.at(3).toFloat(exec), args.at(4).toFloat(exec)),
+                                       FloatRect(args.at(5).toFloat(exec), args.at(6).toFloat(exec),
+                                       args.at(7).toFloat(exec), args.at(8).toFloat(exec)), ec);
+                    setDOMException(exec, ec);
+                    break;
+                default:
+                    return throwError(exec, SyntaxError);
+        }
+#endif
     } else {
         setDOMException(exec, TYPE_MISMATCH_ERR);
     }
@@ -237,64 +262,64 @@ JSValuePtr JSCanvasRenderingContext2D::drawImage(ExecState* exec, const ArgList&
     return jsUndefined();    
 }
 
-JSValuePtr JSCanvasRenderingContext2D::drawImageFromRect(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::drawImageFromRect(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
     
-    JSValuePtr value = args.at(exec, 0);
-    if (!value->isObject())
+    JSValue value = args.at(0);
+    if (!value.isObject())
         return throwError(exec, TypeError);
     JSObject* o = asObject(value);
     
     if (!o->inherits(&JSHTMLImageElement::s_info))
         return throwError(exec, TypeError);
     context->drawImageFromRect(static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl()),
-                               args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec),
-                               args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec),
-                               args.at(exec, 5)->toFloat(exec), args.at(exec, 6)->toFloat(exec),
-                               args.at(exec, 7)->toFloat(exec), args.at(exec, 8)->toFloat(exec),
-                               args.at(exec, 9)->toString(exec));    
+                               args.at(1).toFloat(exec), args.at(2).toFloat(exec),
+                               args.at(3).toFloat(exec), args.at(4).toFloat(exec),
+                               args.at(5).toFloat(exec), args.at(6).toFloat(exec),
+                               args.at(7).toFloat(exec), args.at(8).toFloat(exec),
+                               args.at(9).toString(exec));    
     return jsUndefined();    
 }
 
-JSValuePtr JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
     switch (args.size()) {
         case 3:
-            context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                               args.at(exec, 2)->toFloat(exec));
+            context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                               args.at(2).toFloat(exec));
             break;
         case 4:
-            if (args.at(exec, 3)->isString())
-                context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                   args.at(exec, 2)->toFloat(exec), asString(args.at(exec, 3))->value());
+            if (args.at(3).isString())
+                context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                   args.at(2).toFloat(exec), asString(args.at(3))->value());
             else
-                context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                   args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+                context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                   args.at(2).toFloat(exec), args.at(3).toFloat(exec));
             break;
         case 5:
-            if (args.at(exec, 3)->isString())
-                context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                   args.at(exec, 2)->toFloat(exec), asString(args.at(exec, 3))->value(),
-                                   args.at(exec, 4)->toFloat(exec));
+            if (args.at(3).isString())
+                context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                   args.at(2).toFloat(exec), asString(args.at(3))->value(),
+                                   args.at(4).toFloat(exec));
             else
-                context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                                   args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec),
-                                   args.at(exec, 4)->toFloat(exec));
+                context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                                   args.at(2).toFloat(exec), args.at(3).toFloat(exec),
+                                   args.at(4).toFloat(exec));
             break;
         case 7:
-            context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                               args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec),
-                               args.at(exec, 4)->toFloat(exec), args.at(exec, 5)->toFloat(exec),
-                               args.at(exec, 6)->toFloat(exec));
+            context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                               args.at(2).toFloat(exec), args.at(3).toFloat(exec),
+                               args.at(4).toFloat(exec), args.at(5).toFloat(exec),
+                               args.at(6).toFloat(exec));
             break;
         case 8:
-            context->setShadow(args.at(exec, 0)->toFloat(exec), args.at(exec, 1)->toFloat(exec),
-                               args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec),
-                               args.at(exec, 4)->toFloat(exec), args.at(exec, 5)->toFloat(exec),
-                               args.at(exec, 6)->toFloat(exec), args.at(exec, 7)->toFloat(exec));
+            context->setShadow(args.at(0).toFloat(exec), args.at(1).toFloat(exec),
+                               args.at(2).toFloat(exec), args.at(3).toFloat(exec),
+                               args.at(4).toFloat(exec), args.at(5).toFloat(exec),
+                               args.at(6).toFloat(exec), args.at(7).toFloat(exec));
             break;
         default:
             return throwError(exec, SyntaxError);
@@ -303,28 +328,28 @@ JSValuePtr JSCanvasRenderingContext2D::setShadow(ExecState* exec, const ArgList&
     return jsUndefined();    
 }
 
-JSValuePtr JSCanvasRenderingContext2D::createPattern(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::createPattern(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
-    JSValuePtr value = args.at(exec, 0);
-    if (!value->isObject())
+    JSValue value = args.at(0);
+    if (!value.isObject())
         return throwError(exec, TypeError);
     JSObject* o = asObject(value);
 
     if (o->inherits(&JSHTMLImageElement::s_info)) {
         ExceptionCode ec;
-        JSValuePtr pattern = toJS(exec,
+        JSValue pattern = toJS(exec,
             context->createPattern(static_cast<HTMLImageElement*>(static_cast<JSHTMLElement*>(o)->impl()),
-                                   valueToStringWithNullCheck(exec, args.at(exec, 1)), ec).get());
+                                   valueToStringWithNullCheck(exec, args.at(1)), ec).get());
         setDOMException(exec, ec);
         return pattern;
     }
     if (o->inherits(&JSHTMLCanvasElement::s_info)) {
         ExceptionCode ec;
-        JSValuePtr pattern = toJS(exec,
+        JSValue pattern = toJS(exec,
             context->createPattern(static_cast<HTMLCanvasElement*>(static_cast<JSHTMLElement*>(o)->impl()),
-                valueToStringWithNullCheck(exec, args.at(exec, 1)), ec).get());
+                valueToStringWithNullCheck(exec, args.at(1)), ec).get());
         setDOMException(exec, ec);
         return pattern;
     }
@@ -332,7 +357,7 @@ JSValuePtr JSCanvasRenderingContext2D::createPattern(ExecState* exec, const ArgL
     return jsUndefined();
 }
 
-JSValuePtr JSCanvasRenderingContext2D::putImageData(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::putImageData(ExecState* exec, const ArgList& args)
 {
     // putImageData has two variants
     // putImageData(ImageData, x, y)
@@ -341,16 +366,16 @@ JSValuePtr JSCanvasRenderingContext2D::putImageData(ExecState* exec, const ArgLi
 
     ExceptionCode ec = 0;
     if (args.size() >= 7)
-        context->putImageData(toImageData(args.at(exec, 0)), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec), 
-                              args.at(exec, 3)->toFloat(exec), args.at(exec, 4)->toFloat(exec), args.at(exec, 5)->toFloat(exec), args.at(exec, 6)->toFloat(exec), ec);
+        context->putImageData(toImageData(args.at(0)), args.at(1).toFloat(exec), args.at(2).toFloat(exec), 
+                              args.at(3).toFloat(exec), args.at(4).toFloat(exec), args.at(5).toFloat(exec), args.at(6).toFloat(exec), ec);
     else
-        context->putImageData(toImageData(args.at(exec, 0)), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec), ec);
+        context->putImageData(toImageData(args.at(0)), args.at(1).toFloat(exec), args.at(2).toFloat(exec), ec);
 
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr JSCanvasRenderingContext2D::fillText(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::fillText(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
@@ -362,13 +387,13 @@ JSValuePtr JSCanvasRenderingContext2D::fillText(ExecState* exec, const ArgList&
         return throwError(exec, SyntaxError);
     
     if (args.size() == 4)
-        context->fillText(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+        context->fillText(args.at(0).toString(exec), args.at(1).toFloat(exec), args.at(2).toFloat(exec), args.at(3).toFloat(exec));
     else
-        context->fillText(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec));
+        context->fillText(args.at(0).toString(exec), args.at(1).toFloat(exec), args.at(2).toFloat(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSCanvasRenderingContext2D::strokeText(ExecState* exec, const ArgList& args)
+JSValue JSCanvasRenderingContext2D::strokeText(ExecState* exec, const ArgList& args)
 { 
     CanvasRenderingContext2D* context = impl();
 
@@ -380,9 +405,9 @@ JSValuePtr JSCanvasRenderingContext2D::strokeText(ExecState* exec, const ArgList
         return throwError(exec, SyntaxError);
     
     if (args.size() == 4)
-        context->strokeText(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec), args.at(exec, 3)->toFloat(exec));
+        context->strokeText(args.at(0).toString(exec), args.at(1).toFloat(exec), args.at(2).toFloat(exec), args.at(3).toFloat(exec));
     else
-        context->strokeText(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toFloat(exec), args.at(exec, 2)->toFloat(exec));
+        context->strokeText(args.at(0).toString(exec), args.at(1).toFloat(exec), args.at(2).toFloat(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSClipboardCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSClipboardCustom.cpp
index 8ffb49e..78dca49 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSClipboardCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSClipboardCustom.cpp
@@ -48,7 +48,7 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-JSValuePtr JSClipboard::types(ExecState* exec) const
+JSValue JSClipboard::types(ExecState* exec) const
 {
     Clipboard* clipboard = impl();
 
@@ -56,14 +56,14 @@ JSValuePtr JSClipboard::types(ExecState* exec) const
     if (types.isEmpty())
         return jsNull();
 
-    ArgList list;
+    MarkedArgumentBuffer list;
     HashSet<String>::const_iterator end = types.end();
     for (HashSet<String>::const_iterator it = types.begin(); it != end; ++it)
         list.append(jsString(exec, UString(*it)));
     return constructArray(exec, list);
 }
 
-JSValuePtr JSClipboard::clearData(ExecState* exec, const ArgList& args)
+JSValue JSClipboard::clearData(ExecState* exec, const ArgList& args)
 {
     Clipboard* clipboard = impl();
 
@@ -73,7 +73,7 @@ JSValuePtr JSClipboard::clearData(ExecState* exec, const ArgList& args)
     }
 
     if (args.size() == 1) {
-        clipboard->clearData(args.at(exec, 0)->toString(exec));
+        clipboard->clearData(args.at(0).toString(exec));
         return jsUndefined();
     }
 
@@ -81,7 +81,7 @@ JSValuePtr JSClipboard::clearData(ExecState* exec, const ArgList& args)
     return throwError(exec, SyntaxError, "clearData: Invalid number of arguments");
 }
 
-JSValuePtr JSClipboard::getData(ExecState* exec, const ArgList& args)
+JSValue JSClipboard::getData(ExecState* exec, const ArgList& args)
 {
     // FIXME: It does not match the rest of the JS bindings to throw on invalid number of arguments.
     if (args.size() != 1)
@@ -90,14 +90,14 @@ JSValuePtr JSClipboard::getData(ExecState* exec, const ArgList& args)
     Clipboard* clipboard = impl();
 
     bool success;
-    String result = clipboard->getData(args.at(exec, 0)->toString(exec), success);
+    String result = clipboard->getData(args.at(0).toString(exec), success);
     if (!success)
         return jsUndefined();
 
     return jsString(exec, result);
 }
 
-JSValuePtr JSClipboard::setData(ExecState* exec, const ArgList& args)
+JSValue JSClipboard::setData(ExecState* exec, const ArgList& args)
 {
     Clipboard* clipboard = impl();
 
@@ -105,10 +105,10 @@ JSValuePtr JSClipboard::setData(ExecState* exec, const ArgList& args)
     if (args.size() != 2)
         return throwError(exec, SyntaxError, "setData: Invalid number of arguments");
 
-    return jsBoolean(clipboard->setData(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toString(exec)));
+    return jsBoolean(clipboard->setData(args.at(0).toString(exec), args.at(1).toString(exec)));
 }
 
-JSValuePtr JSClipboard::setDragImage(ExecState* exec, const ArgList& args)
+JSValue JSClipboard::setDragImage(ExecState* exec, const ArgList& args)
 {
     Clipboard* clipboard = impl();
 
@@ -119,11 +119,11 @@ JSValuePtr JSClipboard::setDragImage(ExecState* exec, const ArgList& args)
     if (args.size() != 3)
         return throwError(exec, SyntaxError, "setDragImage: Invalid number of arguments");
 
-    int x = args.at(exec, 1)->toInt32(exec);
-    int y = args.at(exec, 2)->toInt32(exec);
+    int x = args.at(1).toInt32(exec);
+    int y = args.at(2).toInt32(exec);
 
     // See if they passed us a node
-    Node* node = toNode(args.at(exec, 0));
+    Node* node = toNode(args.at(0));
     if (!node)
         return throwError(exec, TypeError);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp
index ddfe4f7..9c48467 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSConsoleCustom.cpp
@@ -34,12 +34,14 @@ using namespace JSC;
 
 namespace WebCore {
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 typedef Vector<RefPtr<JSC::Profile> > ProfilesArray;
 
-JSValuePtr JSConsole::profiles(ExecState* exec) const
+JSValue JSConsole::profiles(ExecState* exec) const
 {
     const ProfilesArray& profiles = impl()->profiles();
-    ArgList list;
+    MarkedArgumentBuffer list;
 
     ProfilesArray::const_iterator end = profiles.end();
     for (ProfilesArray::const_iterator iter = profiles.begin(); iter != end; ++iter)
@@ -48,4 +50,6 @@ JSValuePtr JSConsole::profiles(ExecState* exec) const
     return constructArray(exec, list);
 }
 
+#endif
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCoordinatesCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCoordinatesCustom.cpp
new file mode 100644
index 0000000..720bb9b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCoordinatesCustom.cpp
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSCoordinates.h"
+
+#include "Coordinates.h"
+
+using namespace JSC;
+
+namespace WebCore {
+    
+JSValue JSCoordinates::altitude(ExecState* exec) const
+{
+    Coordinates* imp = impl();
+    if (!imp->canProvideAltitude())
+        return jsNull();
+    return jsNumber(exec, imp->altitude());
+}
+
+JSValue JSCoordinates::altitudeAccuracy(ExecState* exec) const
+{
+    Coordinates* imp = impl();
+    if (!imp->canProvideAltitudeAccuracy())
+        return jsNull();
+    return jsNumber(exec, imp->altitudeAccuracy());
+}
+
+JSValue JSCoordinates::heading(ExecState* exec) const
+{
+    Coordinates* imp = impl();
+    if (!imp->canProvideHeading())
+        return jsNull();
+    return jsNumber(exec, imp->heading());
+}
+
+JSValue JSCoordinates::speed(ExecState* exec) const
+{
+    Coordinates* imp = impl();
+    if (!imp->canProvideSpeed())
+        return jsNull();
+    return jsNumber(exec, imp->speed());
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
index 836ffb9..6f9efd9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionCallback.cpp
@@ -26,10 +26,8 @@
 #include "config.h"
 #include "JSCustomPositionCallback.h"
 
-#include "CString.h"
 #include "Frame.h"
 #include "JSGeoposition.h"
-#include "Page.h"
 #include "ScriptController.h"
 #include <runtime/JSLock.h>
 
@@ -56,9 +54,9 @@ void JSCustomPositionCallback::handleEvent(Geoposition* geoposition, bool& raise
     
     JSC::JSLock lock(false);
     
-    JSValuePtr function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
         callType = m_callback->getCallData(callData);
         if (callType == CallTypeNone) {
@@ -70,17 +68,19 @@ void JSCustomPositionCallback::handleEvent(Geoposition* geoposition, bool& raise
     
     RefPtr<JSCustomPositionCallback> protect(this);
     
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, geoposition));
     
-    globalObject->startTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
-    globalObject->stopTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.stop();
     
     if (exec->hadException()) {
         reportCurrentException(exec);
         raisedException = true;
     }
+    
+    Document::updateStyleForAllDocuments();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
index b4e9535..cc6cd55 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomPositionErrorCallback.cpp
@@ -26,10 +26,8 @@
 #include "config.h"
 #include "JSCustomPositionErrorCallback.h"
 
-#include "CString.h"
 #include "Frame.h"
 #include "JSPositionError.h"
-#include "Page.h"
 #include "ScriptController.h"
 #include <runtime/JSLock.h>
 
@@ -56,9 +54,9 @@ void JSCustomPositionErrorCallback::handleEvent(PositionError* positionError)
     
     JSC::JSLock lock(false);
     
-    JSValuePtr function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
         callType = m_callback->getCallData(callData);
         if (callType == CallTypeNone) {
@@ -70,15 +68,17 @@ void JSCustomPositionErrorCallback::handleEvent(PositionError* positionError)
     
     RefPtr<JSCustomPositionErrorCallback> protect(this);
     
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, positionError));
     
-    globalObject->startTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
-    globalObject->stopTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.stop();
     
     if (exec->hadException())
         reportCurrentException(exec);
+    
+    Document::updateStyleForAllDocuments();
 }
     
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
index 2243564..107a491 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.cpp
@@ -28,9 +28,8 @@
 
 #include "config.h"
 #include "JSCustomSQLStatementCallback.h"
+#if ENABLE(DATABASE)
 
-#include "CString.h"
-#include "DOMWindow.h"
 #include "Frame.h"
 #include "ScriptController.h"
 #include "JSSQLResultSet.h"
@@ -60,9 +59,9 @@ void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLR
         
     JSC::JSLock lock(false);
 
-    JSValuePtr function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
         callType = m_callback->getCallData(callData);
         if (callType == CallTypeNone) {
@@ -74,13 +73,13 @@ void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLR
 
     RefPtr<JSCustomSQLStatementCallback> protect(this);
 
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, transaction));
     args.append(toJS(exec, resultSet));
         
-    globalObject->startTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
-    globalObject->stopTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.stop();
 
     if (exec->hadException()) {
         reportCurrentException(exec);
@@ -88,7 +87,9 @@ void JSCustomSQLStatementCallback::handleEvent(SQLTransaction* transaction, SQLR
         raisedException = true;
     }
 
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 }
 
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h
index 3a3ae21..c380670 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementCallback.h
@@ -29,6 +29,8 @@
 #ifndef JSCustomSQLStatementCallback_h
 #define JSCustomSQLStatementCallback_h
 
+#if ENABLE(DATABASE)
+
 #include "SQLStatementCallback.h"
 
 #include <runtime/JSObject.h>
@@ -59,4 +61,6 @@ private:
 
 }
 
+#endif // ENABLE(DATABASE)
+
 #endif // JSCustomSQLStatementCallback_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
index 14080ea..018dabd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "JSCustomSQLStatementErrorCallback.h"
 
-#include "CString.h"
-#include "DOMWindow.h"
+#if ENABLE(DATABASE)
+
 #include "Frame.h"
 #include "ScriptController.h"
 #include "JSSQLError.h"
@@ -60,9 +60,9 @@ bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction,
         
     JSC::JSLock lock(false);
         
-    JSValuePtr handleEventFunction = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    JSValue handleEventFunction = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData handleEventCallData;
-    CallType handleEventCallType = handleEventFunction->getCallData(handleEventCallData);
+    CallType handleEventCallType = handleEventFunction.getCallData(handleEventCallData);
     CallData callbackCallData;
     CallType callbackCallType = CallTypeNone;
 
@@ -76,17 +76,17 @@ bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction,
         
     RefPtr<JSCustomSQLStatementErrorCallback> protect(this);
         
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, transaction));
     args.append(toJS(exec, error));
         
-    JSValuePtr result;
-    globalObject->startTimeoutCheck();
+    JSValue result;
+    globalObject->globalData()->timeoutChecker.start();
     if (handleEventCallType != CallTypeNone)
         result = call(exec, handleEventFunction, handleEventCallType, handleEventCallData, m_callback, args);
     else
         result = call(exec, m_callback, callbackCallType, callbackCallData, m_callback, args);
-    globalObject->stopTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.stop();
         
     if (exec->hadException()) {
         reportCurrentException(exec);
@@ -98,9 +98,11 @@ bool JSCustomSQLStatementErrorCallback::handleEvent(SQLTransaction* transaction,
         return true;
     }
         
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 
-    return result->toBoolean(exec);
+    return result.toBoolean(exec);
 }
 
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
index 2847114..e563393 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLStatementErrorCallback.h
@@ -29,6 +29,8 @@
 #ifndef JSCustomSQLStatementErrorCallback_h
 #define JSCustomSQLStatementErrorCallback_h
 
+#if ENABLE(DATABASE)
+
 #include "SQLStatementErrorCallback.h"
 
 #include <runtime/JSObject.h>
@@ -59,5 +61,7 @@ private:
     
 }
 
+#endif // ENABLE(DATABASE)
+
 #endif // JSCustomSQLStatementErrorCallback_h
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
index 7910a88..a41ac78 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.cpp
@@ -29,10 +29,9 @@
 #include "config.h"
 #include "JSCustomSQLTransactionCallback.h"
 
-#include "CString.h"
-#include "DOMWindow.h"
+#if ENABLE(DATABASE)
+
 #include "Frame.h"
-#include "Logging.h"
 #include "ScriptController.h"
 #include "JSSQLTransaction.h"
 #include "Page.h"
@@ -101,9 +100,9 @@ void JSCustomSQLTransactionCallback::handleEvent(SQLTransaction* transaction, bo
         
     JSC::JSLock lock(false);
         
-    JSValuePtr handleEventFunction = m_data->callback()->get(exec, Identifier(exec, "handleEvent"));
+    JSValue handleEventFunction = m_data->callback()->get(exec, Identifier(exec, "handleEvent"));
     CallData handleEventCallData;
-    CallType handleEventCallType = handleEventFunction->getCallData(handleEventCallData);
+    CallType handleEventCallType = handleEventFunction.getCallData(handleEventCallData);
     CallData callbackCallData;
     CallType callbackCallType = CallTypeNone;
 
@@ -117,15 +116,15 @@ void JSCustomSQLTransactionCallback::handleEvent(SQLTransaction* transaction, bo
         
     RefPtr<JSCustomSQLTransactionCallback> protect(this);
         
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, transaction));
 
-    globalObject->startTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.start();
     if (handleEventCallType != CallTypeNone)
         call(exec, handleEventFunction, handleEventCallType, handleEventCallData, m_data->callback(), args);
     else
         call(exec, m_data->callback(), callbackCallType, callbackCallData, m_data->callback(), args);
-    globalObject->stopTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.stop();
         
     if (exec->hadException()) {
         reportCurrentException(exec);
@@ -133,7 +132,9 @@ void JSCustomSQLTransactionCallback::handleEvent(SQLTransaction* transaction, bo
         raisedException = true;
     }
         
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 }
     
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
index 0a21c1a..22c367c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionCallback.h
@@ -29,6 +29,8 @@
 #ifndef JSCustomSQLTransactionCallback_h
 #define JSCustomSQLTransactionCallback_h
 
+#if ENABLE(DATABASE)
+
 #include "SQLTransactionCallback.h"
 
 #include <wtf/PassRefPtr.h>
@@ -60,4 +62,6 @@ private:
 
 }
 
+#endif // ENABLE(DATABASE)
+
 #endif // JSCustomSQLTransactionCallback_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
index 7f95d4c..324e2bb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.cpp
@@ -29,8 +29,8 @@
 #include "config.h"
 #include "JSCustomSQLTransactionErrorCallback.h"
 
-#include "CString.h"
-#include "DOMWindow.h"
+#if ENABLE(DATABASE)
+
 #include "Frame.h"
 #include "ScriptController.h"
 #include "JSSQLError.h"
@@ -46,47 +46,46 @@ JSCustomSQLTransactionErrorCallback::JSCustomSQLTransactionErrorCallback(JSObjec
 {
 }
     
-bool JSCustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
+void JSCustomSQLTransactionErrorCallback::handleEvent(SQLError* error)
 {
     ASSERT(m_callback);
     ASSERT(m_frame);
-        
+
     if (!m_frame->script()->isEnabled())
-        return true;
-        
+        return;
+
     JSGlobalObject* globalObject = m_frame->script()->globalObject();
     ExecState* exec = globalObject->globalExec();
-        
+
     JSC::JSLock lock(false);
-        
-    JSValuePtr function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+
+    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
         callType = m_callback->getCallData(callData);
         if (callType == CallTypeNone) {
             // FIXME: Should an exception be thrown here?
-            return true;
+            return;
         }
         function = m_callback;
     }
 
     RefPtr<JSCustomSQLTransactionErrorCallback> protect(this);
-        
-    ArgList args;
+
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, error));
 
-    JSValuePtr result;
-    globalObject->startTimeoutCheck();
-    result = call(exec, function, callType, callData, m_callback, args);
-    globalObject->stopTimeoutCheck();
-        
+    globalObject->globalData()->timeoutChecker.start();
+    call(exec, function, callType, callData, m_callback, args);
+    globalObject->globalData()->timeoutChecker.stop();
+
     if (exec->hadException())
         reportCurrentException(exec);
-        
-    Document::updateDocumentsRendering();
-    
-    return result->toBoolean(exec);
+
+    Document::updateStyleForAllDocuments();
 }
-    
+
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
index 122224f..be3df29 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomSQLTransactionErrorCallback.h
@@ -29,6 +29,8 @@
 #ifndef JSCustomSQLTransactionErrorCallback_h
 #define JSCustomSQLTransactionErrorCallback_h
 
+#if ENABLE(DATABASE)
+
 #include "SQLTransactionErrorCallback.h"
 
 #include <runtime/JSObject.h>
@@ -48,7 +50,7 @@ class JSCustomSQLTransactionErrorCallback : public SQLTransactionErrorCallback {
 public:
     static PassRefPtr<JSCustomSQLTransactionErrorCallback> create(JSC::JSObject* callback, Frame* frame) { return adoptRef(new JSCustomSQLTransactionErrorCallback(callback, frame)); }
     
-    virtual bool handleEvent(SQLError*);
+    virtual void handleEvent(SQLError*);
 
 private:
     JSCustomSQLTransactionErrorCallback(JSC::JSObject* callback, Frame*);
@@ -58,5 +60,6 @@ private:
 };
 
 }
+#endif // ENABLE(DATABASE)
 
 #endif // JSCustomSQLTransactionErrorCallback_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp
index 527fa41..f3f76c4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.cpp
@@ -29,11 +29,8 @@
 #include "config.h"
 #include "JSCustomVoidCallback.h"
 
-#include "CString.h"
-#include "DOMWindow.h"
 #include "Frame.h"
 #include "JSDOMWindowCustom.h"
-#include "JSDOMBinding.h"
 #include "ScriptController.h"
 #include <runtime/JSLock.h>
 
@@ -60,9 +57,9 @@ void JSCustomVoidCallback::handleEvent()
         
     JSC::JSLock lock(false);
         
-    JSValuePtr function = m_callback->get(exec, Identifier(exec, "handleEvent"));
+    JSValue function = m_callback->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
         callType = m_callback->getCallData(callData);
         if (callType == CallTypeNone) {
@@ -74,21 +71,21 @@ void JSCustomVoidCallback::handleEvent()
         
     RefPtr<JSCustomVoidCallback> protect(this);
         
-    ArgList args;
+    MarkedArgumentBuffer args;
     
-    globalObject->startTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.start();
     call(exec, function, callType, callData, m_callback, args);
-    globalObject->stopTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.stop();
         
     if (exec->hadException())
         reportCurrentException(exec);
         
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 }
  
-PassRefPtr<VoidCallback> toVoidCallback(ExecState* exec, JSValuePtr value)
+PassRefPtr<VoidCallback> toVoidCallback(ExecState* exec, JSValue value)
 {
-    JSObject* object = value->getObject();
+    JSObject* object = value.getObject();
     if (!object)
         return 0;
     
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h
index f54ddb6..9cd7c34 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomVoidCallback.h
@@ -55,7 +55,7 @@ namespace WebCore {
         RefPtr<Frame> m_frame;
     };
 
-    PassRefPtr<VoidCallback> toVoidCallback(JSC::ExecState*, JSC::JSValuePtr);
+    PassRefPtr<VoidCallback> toVoidCallback(JSC::ExecState*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
index 8451dd0..6361e70 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.cpp
@@ -28,14 +28,10 @@
 
 #if ENABLE(XPATH)
 
-#include "CString.h"
-#include "Console.h"
-#include "DOMWindow.h"
 #include "Document.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "JSDOMWindowCustom.h"
-#include "JSDOMBinding.h"
 #include "ScriptController.h"
 #include <runtime/JSLock.h>
 
@@ -43,12 +39,12 @@ namespace WebCore {
 
 using namespace JSC;
 
-PassRefPtr<JSCustomXPathNSResolver> JSCustomXPathNSResolver::create(JSC::ExecState* exec, JSC::JSValuePtr value)
+PassRefPtr<JSCustomXPathNSResolver> JSCustomXPathNSResolver::create(JSC::ExecState* exec, JSC::JSValue value)
 {
-    if (value->isUndefinedOrNull())
+    if (value.isUndefinedOrNull())
         return 0;
 
-    JSObject* resolverObject = value->getObject();
+    JSObject* resolverObject = value.getObject();
     if (!resolverObject) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return 0;
@@ -81,9 +77,9 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
     JSGlobalObject* globalObject = m_frame->script()->globalObject();
     ExecState* exec = globalObject->globalExec();
         
-    JSValuePtr function = m_customResolver->get(exec, Identifier(exec, "lookupNamespaceURI"));
+    JSValue function = m_customResolver->get(exec, Identifier(exec, "lookupNamespaceURI"));
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone) {
         callType = m_customResolver->getCallData(callData);
         if (callType == CallTypeNone) {
@@ -96,22 +92,22 @@ String JSCustomXPathNSResolver::lookupNamespaceURI(const String& prefix)
 
     RefPtr<JSCustomXPathNSResolver> selfProtector(this);
 
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(jsString(exec, prefix));
 
-    globalObject->startTimeoutCheck();
-    JSValuePtr retval = call(exec, function, callType, callData, m_customResolver, args);
-    globalObject->stopTimeoutCheck();
+    globalObject->globalData()->timeoutChecker.start();
+    JSValue retval = call(exec, function, callType, callData, m_customResolver, args);
+    globalObject->globalData()->timeoutChecker.stop();
 
     String result;
     if (exec->hadException())
         reportCurrentException(exec);
     else {
-        if (!retval->isUndefinedOrNull())
-            result = retval->toString(exec);
+        if (!retval.isUndefinedOrNull())
+            result = retval.toString(exec);
     }
 
-    Document::updateDocumentsRendering();
+    Document::updateStyleForAllDocuments();
 
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.h b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.h
index fecbb61..44c44f9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSCustomXPathNSResolver.h
@@ -44,7 +44,7 @@ namespace WebCore {
 
     class JSCustomXPathNSResolver : public XPathNSResolver {
     public:
-        static PassRefPtr<JSCustomXPathNSResolver> create(JSC::ExecState*, JSC::JSValuePtr);
+        static PassRefPtr<JSCustomXPathNSResolver> create(JSC::ExecState*, JSC::JSValue);
         
         virtual ~JSCustomXPathNSResolver();
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
index 5e867a1..7e8d9ce 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -46,44 +46,32 @@ void JSDOMApplicationCache::mark()
 {
     DOMObject::mark();
 
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onchecking()))
-        listener->mark();
-
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onerror()))
-        listener->mark();
-
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onnoupdate()))
-        listener->mark();
-
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->ondownloading()))
-        listener->mark();
-
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onprogress()))
-        listener->mark();
-
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onupdateready()))
-        listener->mark();
-
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->oncached()))
-        listener->mark();
+    markIfNotNull(m_impl->onchecking());
+    markIfNotNull(m_impl->onerror());
+    markIfNotNull(m_impl->onnoupdate());
+    markIfNotNull(m_impl->ondownloading());
+    markIfNotNull(m_impl->onprogress());
+    markIfNotNull(m_impl->onupdateready());
+    markIfNotNull(m_impl->oncached());
+    markIfNotNull(m_impl->onobsolete());
 
     typedef DOMApplicationCache::EventListenersMap EventListenersMap;
     typedef DOMApplicationCache::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) {
-            JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(vecIter->get());
-            listener->mark();
-        }
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
+            (*vecIter)->markJSFunction();
     }
 }
 
-JSValuePtr JSDOMApplicationCache::hasItem(ExecState* exec, const ArgList& args)
+#if ENABLE(APPLICATION_CACHE_DYNAMIC_ENTRIES)
+
+JSValue JSDOMApplicationCache::hasItem(ExecState* exec, const ArgList& args)
 {
     Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
     if (!frame)
         return jsUndefined();
-    const KURL& url = frame->loader()->completeURL(args.at(exec, 0)->toString(exec));
+    const KURL& url = frame->loader()->completeURL(args.at(0).toString(exec));
 
     ExceptionCode ec = 0;
     bool result = impl()->hasItem(url, ec);
@@ -91,12 +79,12 @@ JSValuePtr JSDOMApplicationCache::hasItem(ExecState* exec, const ArgList& args)
     return jsBoolean(result);
 }
 
-JSValuePtr JSDOMApplicationCache::add(ExecState* exec, const ArgList& args)
+JSValue JSDOMApplicationCache::add(ExecState* exec, const ArgList& args)
 {
     Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
     if (!frame)
         return jsUndefined();
-    const KURL& url = frame->loader()->completeURL(args.at(exec, 0)->toString(exec));
+    const KURL& url = frame->loader()->completeURL(args.at(0).toString(exec));
     
     ExceptionCode ec = 0;
     impl()->add(url, ec);
@@ -104,12 +92,12 @@ JSValuePtr JSDOMApplicationCache::add(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSDOMApplicationCache::remove(ExecState* exec, const ArgList& args)
+JSValue JSDOMApplicationCache::remove(ExecState* exec, const ArgList& args)
 {
     Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
     if (!frame)
         return jsUndefined();
-    const KURL& url = frame->loader()->completeURL(args.at(exec, 0)->toString(exec));
+    const KURL& url = frame->loader()->completeURL(args.at(0).toString(exec));
     
     ExceptionCode ec = 0;
     impl()->remove(url, ec);
@@ -117,27 +105,29 @@ JSValuePtr JSDOMApplicationCache::remove(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSDOMApplicationCache::addEventListener(ExecState* exec, const ArgList& args)
+#endif // ENABLE(APPLICATION_CACHE_DYNAMIC_ENTRIES)
+
+JSValue JSDOMApplicationCache::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSUnprotectedEventListener> listener = globalObject->findOrCreateJSUnprotectedEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSDOMApplicationCache::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSDOMApplicationCache::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSUnprotectedEventListener* listener = globalObject->findJSUnprotectedEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
index 4cf083a..55f0e91 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 1999-2001 Harri Porten (porten@kde.org)
- *  Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *  Copyright (C) 2007 Samuel Weinig <sam@webkit.org>
  *
  *  This library is free software; you can redistribute it and/or
@@ -33,6 +33,7 @@
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "HTMLImageElement.h"
+#include "HTMLScriptElement.h"
 #include "HTMLNames.h"
 #include "JSDOMCoreException.h"
 #include "JSDOMWindowCustom.h"
@@ -259,32 +260,47 @@ void forgetAllDOMNodesForDocument(Document* document)
     removeWrappers(document->wrapperCache());
 }
 
+static inline bool isObservableThroughDOM(JSNode* jsNode)
+{
+    // Certain conditions implicitly make a JS DOM node wrapper observable
+    // through the DOM, even if no explicit reference to it remains.
+
+    Node* node = jsNode->impl();
+
+    if (node->inDocument()) {
+        // 1. If a node is in the document, and its wrapper has custom properties,
+        // the wrapper is observable because future access to the node through the
+        // DOM must reflect those properties.
+        if (jsNode->hasCustomProperties())
+            return true;
+
+        // 2. If a node is in the document, and has event listeners, its wrapper is
+        // observable because its wrapper is responsible for marking those event listeners.
+        if (node->eventListeners().size())
+            return true; // Technically, we may overzealously mark a wrapper for a node that has only non-JS event listeners. Oh well.
+    } else {
+        // 3. If a wrapper is the last reference to an image or script element
+        // that is loading but not in the document, the wrapper is observable
+        // because it is the only thing keeping the image element alive, and if
+        // the image element is destroyed, its load event will not fire.
+        // FIXME: The DOM should manage this issue without the help of JavaScript wrappers.
+        if (node->hasTagName(imgTag) && !static_cast<HTMLImageElement*>(node)->haveFiredLoadEvent())
+            return true;
+        if (node->hasTagName(scriptTag) && !static_cast<HTMLScriptElement*>(node)->haveFiredLoadEvent())
+            return true;
+    }
+
+    return false;
+}
+
 void markDOMNodesForDocument(Document* doc)
 {
-    // If a node's JS wrapper holds custom properties, those properties must
-    // persist every time the node is fetched from the DOM. So, we keep JS
-    // wrappers like that from being garbage collected.
-
     JSWrapperCache& nodeDict = doc->wrapperCache();
     JSWrapperCache::iterator nodeEnd = nodeDict.end();
     for (JSWrapperCache::iterator nodeIt = nodeDict.begin(); nodeIt != nodeEnd; ++nodeIt) {
         JSNode* jsNode = nodeIt->second;
-        Node* node = jsNode->impl();
-
-        if (jsNode->marked())
-            continue;
-
-        // No need to preserve a wrapper that has no custom properties or is no
-        // longer fetchable through the DOM.
-        if (!jsNode->hasCustomProperties() || !node->inDocument()) {
-            //... unless the wrapper wraps a loading image, since the "new Image"
-            // syntax allows an orphan image wrapper to be the last reference
-            // to a loading image, whose load event might have important side-effects.
-            if (!node->hasTagName(imgTag) || static_cast<HTMLImageElement*>(node)->haveFiredLoadEvent())
-                continue;
-        }
-
-        jsNode->mark();
+        if (!jsNode->marked() && isObservableThroughDOM(jsNode))
+            jsNode->mark();
     }
 }
 
@@ -309,10 +325,10 @@ void markActiveObjectsForContext(JSGlobalData& globalData, ScriptExecutionContex
     const HashSet<MessagePort*>& messagePorts = scriptExecutionContext->messagePorts();
     HashSet<MessagePort*>::const_iterator portsEnd = messagePorts.end();
     for (HashSet<MessagePort*>::const_iterator iter = messagePorts.begin(); iter != portsEnd; ++iter) {
-        if ((*iter)->hasPendingActivity()) {
+        // If the message port is remotely entangled, then always mark it as in-use because we can't determine reachability across threads.
+        if (!(*iter)->locallyEntangledPort() || (*iter)->hasPendingActivity()) {
             DOMObject* wrapper = getCachedDOMObjectWrapper(globalData, *iter);
-            // A port with pending activity must have a wrapper to mark its listeners, so no null check.
-            if (!wrapper->marked())
+            if (wrapper && !wrapper->marked())
                 wrapper->mark();
         }
     }
@@ -340,84 +356,91 @@ void markDOMObjectWrapper(JSGlobalData& globalData, void* object)
     wrapper->mark();
 }
 
-JSValuePtr jsStringOrNull(ExecState* exec, const String& s)
+JSValue jsStringOrNull(ExecState* exec, const String& s)
 {
     if (s.isNull())
         return jsNull();
     return jsString(exec, s);
 }
 
-JSValuePtr jsOwnedStringOrNull(ExecState* exec, const UString& s)
+JSValue jsOwnedStringOrNull(ExecState* exec, const UString& s)
 {
     if (s.isNull())
         return jsNull();
     return jsOwnedString(exec, s);
 }
 
-JSValuePtr jsStringOrUndefined(ExecState* exec, const String& s)
+JSValue jsStringOrUndefined(ExecState* exec, const String& s)
 {
     if (s.isNull())
         return jsUndefined();
     return jsString(exec, s);
 }
 
-JSValuePtr jsStringOrFalse(ExecState* exec, const String& s)
+JSValue jsStringOrFalse(ExecState* exec, const String& s)
 {
     if (s.isNull())
         return jsBoolean(false);
     return jsString(exec, s);
 }
 
-JSValuePtr jsStringOrNull(ExecState* exec, const KURL& url)
+JSValue jsStringOrNull(ExecState* exec, const KURL& url)
 {
     if (url.isNull())
         return jsNull();
     return jsString(exec, url.string());
 }
 
-JSValuePtr jsStringOrUndefined(ExecState* exec, const KURL& url)
+JSValue jsStringOrUndefined(ExecState* exec, const KURL& url)
 {
     if (url.isNull())
         return jsUndefined();
     return jsString(exec, url.string());
 }
 
-JSValuePtr jsStringOrFalse(ExecState* exec, const KURL& url)
+JSValue jsStringOrFalse(ExecState* exec, const KURL& url)
 {
     if (url.isNull())
         return jsBoolean(false);
     return jsString(exec, url.string());
 }
 
-UString valueToStringWithNullCheck(ExecState* exec, JSValuePtr value)
+UString valueToStringWithNullCheck(ExecState* exec, JSValue value)
 {
-    if (value->isNull())
+    if (value.isNull())
         return UString();
-    return value->toString(exec);
+    return value.toString(exec);
 }
 
-UString valueToStringWithUndefinedOrNullCheck(ExecState* exec, JSValuePtr value)
+UString valueToStringWithUndefinedOrNullCheck(ExecState* exec, JSValue value)
 {
-    if (value->isUndefinedOrNull())
+    if (value.isUndefinedOrNull())
         return UString();
-    return value->toString(exec);
+    return value.toString(exec);
 }
 
-void reportException(JSC::ExecState* exec, JSValuePtr exception)
+void reportException(ExecState* exec, JSValue exception)
 {
-    UString errorMessage = exception->toString(exec);
-    JSObject* exceptionObject = exception->toObject(exec);
-    int lineNumber = exceptionObject->get(exec, Identifier(exec, "line"))->toInt32(exec);
-    UString exceptionSourceURL = exceptionObject->get(exec, Identifier(exec, "sourceURL"))->toString(exec);
+    UString errorMessage = exception.toString(exec);
+    JSObject* exceptionObject = exception.toObject(exec);
+    int lineNumber = exceptionObject->get(exec, Identifier(exec, "line")).toInt32(exec);
+    UString exceptionSourceURL = exceptionObject->get(exec, Identifier(exec, "sourceURL")).toString(exec);
     exec->clearException();
 
     ScriptExecutionContext* scriptExecutionContext = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->scriptExecutionContext();
+    ASSERT(scriptExecutionContext);
+
+    // Crash data indicates null-dereference crashes at this point in the Safari 4 Public Beta.
+    // It's harmless to return here without reporting the exception to the log and the debugger in this case.
+    if (!scriptExecutionContext)
+        return;
+
     scriptExecutionContext->reportException(errorMessage, lineNumber, exceptionSourceURL);
 }
 
-void reportCurrentException(JSC::ExecState* exec)
+void reportCurrentException(ExecState* exec)
 {
-    JSValuePtr exception = exec->exception();
+    JSValue exception = exec->exception();
     exec->clearException();
     reportException(exec, exception);
 }
@@ -430,7 +453,7 @@ void setDOMException(ExecState* exec, ExceptionCode ec)
     ExceptionCodeDescription description;
     getExceptionCodeDescription(ec, description);
 
-    JSValuePtr errorObject = noValue();
+    JSValue errorObject;
     switch (description.type) {
         case DOMExceptionType:
             errorObject = toJS(exec, DOMCoreException::create(description));
@@ -481,6 +504,12 @@ bool allowsAccessFromFrame(ExecState* exec, Frame* frame, String& message)
     return window && window->allowsAccessFrom(exec, message);
 }
 
+bool shouldAllowNavigation(ExecState* exec, Frame* frame)
+{
+    Frame* lexicalFrame = toLexicalFrame(exec);
+    return lexicalFrame && lexicalFrame->loader()->shouldAllowNavigation(frame);
+}
+
 void printErrorMessageForFrame(Frame* frame, const String& message)
 {
     if (!frame)
@@ -489,39 +518,59 @@ void printErrorMessageForFrame(Frame* frame, const String& message)
         window->printErrorMessage(message);
 }
 
-JSValuePtr objectToStringFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+Frame* toLexicalFrame(ExecState* exec)
 {
-    return new (exec) PrototypeFunction(exec, 0, propertyName, objectProtoFuncToString);
+    return asJSDOMWindow(exec->lexicalGlobalObject())->impl()->frame();
 }
 
-ScriptState* scriptStateFromNode(Node* node)
+Frame* toDynamicFrame(ExecState* exec)
 {
-    if (!node)
-        return 0;
-    Document* document = node->document();
-    if (!document)
-        return 0;
-    Frame* frame = document->frame();
+    return asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
+}
+
+bool processingUserGesture(ExecState* exec)
+{
+    Frame* frame = toDynamicFrame(exec);
+    return frame && frame->script()->processingUserGesture();
+}
+
+KURL completeURL(ExecState* exec, const String& relativeURL)
+{
+    // For histoical reasons, we need to complete the URL using the dynamic frame.
+    Frame* frame = toDynamicFrame(exec);
     if (!frame)
-        return 0;
-    if (!frame->script()->isEnabled())
-        return 0;
-    return frame->script()->globalObject()->globalExec();
+        return KURL();
+    return frame->loader()->completeURL(relativeURL);
 }
 
-Structure* getCachedDOMStructure(ExecState* exec, const ClassInfo* classInfo)
+JSValue objectToStringFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
-    JSDOMStructureMap& structures = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->structures();
+    return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 0, propertyName, objectProtoFuncToString);
+}
+
+Structure* getCachedDOMStructure(JSDOMGlobalObject* globalObject, const ClassInfo* classInfo)
+{
+    JSDOMStructureMap& structures = globalObject->structures();
     return structures.get(classInfo).get();
 }
 
-Structure* cacheDOMStructure(ExecState* exec, PassRefPtr<Structure> structure, const ClassInfo* classInfo)
+Structure* cacheDOMStructure(JSDOMGlobalObject* globalObject, PassRefPtr<Structure> structure, const ClassInfo* classInfo)
 {
-    JSDOMStructureMap& structures = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->structures();
+    JSDOMStructureMap& structures = globalObject->structures();
     ASSERT(!structures.contains(classInfo));
     return structures.set(classInfo, structure).first->second.get();
 }
 
+Structure* getCachedDOMStructure(ExecState* exec, const ClassInfo* classInfo)
+{
+    return getCachedDOMStructure(static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), classInfo);
+}
+
+Structure* cacheDOMStructure(ExecState* exec, PassRefPtr<Structure> structure, const ClassInfo* classInfo)
+{
+    return cacheDOMStructure(static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()), structure, classInfo);
+}
+
 JSObject* getCachedDOMConstructor(ExecState* exec, const ClassInfo* classInfo)
 {
     JSDOMConstructorMap& constructors = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject())->constructors();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
index 71da21b..1378c91 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMBinding.h
@@ -25,7 +25,6 @@
 #include <runtime/Completion.h>
 #include <runtime/Lookup.h>
 #include <runtime/JSFunction.h>
-#include "ScriptState.h"
 #include <wtf/Noncopyable.h>
 
 namespace JSC {
@@ -73,21 +72,27 @@ namespace WebCore {
     void markActiveObjectsForContext(JSC::JSGlobalData&, ScriptExecutionContext*);
     void markDOMObjectWrapper(JSC::JSGlobalData& globalData, void* object);
 
+    JSC::Structure* getCachedDOMStructure(JSDOMGlobalObject*, const JSC::ClassInfo*);
+    JSC::Structure* cacheDOMStructure(JSDOMGlobalObject*, PassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
     JSC::Structure* getCachedDOMStructure(JSC::ExecState*, const JSC::ClassInfo*);
     JSC::Structure* cacheDOMStructure(JSC::ExecState*, PassRefPtr<JSC::Structure>, const JSC::ClassInfo*);
 
     JSC::JSObject* getCachedDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*);
     void cacheDOMConstructor(JSC::ExecState*, const JSC::ClassInfo*, JSC::JSObject* constructor);
 
-    template<class WrapperClass> inline JSC::Structure* getDOMStructure(JSC::ExecState* exec)
+    template<class WrapperClass> inline JSC::Structure* getDOMStructure(JSC::ExecState* exec, JSDOMGlobalObject* globalObject)
     {
-        if (JSC::Structure* structure = getCachedDOMStructure(exec, &WrapperClass::s_info))
+        if (JSC::Structure* structure = getCachedDOMStructure(globalObject, &WrapperClass::s_info))
             return structure;
-        return cacheDOMStructure(exec, WrapperClass::createStructure(WrapperClass::createPrototype(exec)), &WrapperClass::s_info);
+        return cacheDOMStructure(globalObject, WrapperClass::createStructure(WrapperClass::createPrototype(exec, globalObject)), &WrapperClass::s_info);
+    }
+    template<class WrapperClass> inline JSC::Structure* getDOMStructure(JSC::ExecState* exec)
+    {
+        return getDOMStructure<WrapperClass>(exec, static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject()));
     }
-    template<class WrapperClass> inline JSC::JSObject* getDOMPrototype(JSC::ExecState* exec)
+    template<class WrapperClass> inline JSC::JSObject* getDOMPrototype(JSC::ExecState* exec, JSC::JSGlobalObject* globalObject)
     {
-        return static_cast<JSC::JSObject*>(asObject(getDOMStructure<WrapperClass>(exec)->storedPrototype()));
+        return static_cast<JSC::JSObject*>(asObject(getDOMStructure<WrapperClass>(exec, static_cast<JSDOMGlobalObject*>(globalObject))->storedPrototype()));
     }
     #define CREATE_DOM_OBJECT_WRAPPER(exec, className, object) createDOMObjectWrapper<JS##className>(exec, static_cast<className*>(object))
     template<class WrapperClass, class DOMClass> inline DOMObject* createDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object)
@@ -98,7 +103,7 @@ namespace WebCore {
         cacheDOMObjectWrapper(exec->globalData(), object, wrapper);
         return wrapper;
     }
-    template<class WrapperClass, class DOMClass> inline JSC::JSValuePtr getDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object)
+    template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object)
     {
         if (!object)
             return JSC::jsNull();
@@ -117,7 +122,7 @@ namespace WebCore {
         cacheDOMObjectWrapper(exec->globalData(), object, wrapper);
         return wrapper;
     }
-    template<class WrapperClass, class DOMClass> inline JSC::JSValuePtr getDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object, SVGElement* context)
+    template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMObjectWrapper(JSC::ExecState* exec, DOMClass* object, SVGElement* context)
     {
         if (!object)
             return JSC::jsNull();
@@ -136,7 +141,7 @@ namespace WebCore {
         cacheDOMNodeWrapper(node->document(), node, wrapper);
         return wrapper;
     }
-    template<class WrapperClass, class DOMClass> inline JSC::JSValuePtr getDOMNodeWrapper(JSC::ExecState* exec, DOMClass* node)
+    template<class WrapperClass, class DOMClass> inline JSC::JSValue getDOMNodeWrapper(JSC::ExecState* exec, DOMClass* node)
     {
         if (!node)
             return JSC::jsNull();
@@ -147,29 +152,29 @@ namespace WebCore {
 
     const JSC::HashTable* getHashTableForGlobalData(JSC::JSGlobalData&, const JSC::HashTable* staticTable);
 
-    void reportException(JSC::ExecState*, JSC::JSValuePtr exception);
+    void reportException(JSC::ExecState*, JSC::JSValue exception);
     void reportCurrentException(JSC::ExecState*);
 
     // Convert a DOM implementation exception code into a JavaScript exception in the execution state.
     void setDOMException(JSC::ExecState*, ExceptionCode);
 
-    JSC::JSValuePtr jsStringOrNull(JSC::ExecState*, const String&); // null if the string is null
-    JSC::JSValuePtr jsStringOrNull(JSC::ExecState*, const KURL&); // null if the URL is null
+    JSC::JSValue jsStringOrNull(JSC::ExecState*, const String&); // null if the string is null
+    JSC::JSValue jsStringOrNull(JSC::ExecState*, const KURL&); // null if the URL is null
 
-    JSC::JSValuePtr jsStringOrUndefined(JSC::ExecState*, const String&); // undefined if the string is null
-    JSC::JSValuePtr jsStringOrUndefined(JSC::ExecState*, const KURL&); // undefined if the URL is null
+    JSC::JSValue jsStringOrUndefined(JSC::ExecState*, const String&); // undefined if the string is null
+    JSC::JSValue jsStringOrUndefined(JSC::ExecState*, const KURL&); // undefined if the URL is null
 
-    JSC::JSValuePtr jsStringOrFalse(JSC::ExecState*, const String&); // boolean false if the string is null
-    JSC::JSValuePtr jsStringOrFalse(JSC::ExecState*, const KURL&); // boolean false if the URL is null
+    JSC::JSValue jsStringOrFalse(JSC::ExecState*, const String&); // boolean false if the string is null
+    JSC::JSValue jsStringOrFalse(JSC::ExecState*, const KURL&); // boolean false if the URL is null
 
     // See JavaScriptCore for explanation: Should be used for any UString that is already owned by another
     // object, to let the engine know that collecting the JSString wrapper is unlikely to save memory.
-    JSC::JSValuePtr jsOwnedStringOrNull(JSC::ExecState*, const JSC::UString&); 
+    JSC::JSValue jsOwnedStringOrNull(JSC::ExecState*, const JSC::UString&); 
 
-    JSC::UString valueToStringWithNullCheck(JSC::ExecState*, JSC::JSValuePtr); // null if the value is null
-    JSC::UString valueToStringWithUndefinedOrNullCheck(JSC::ExecState*, JSC::JSValuePtr); // null if the value is null or undefined
+    JSC::UString valueToStringWithNullCheck(JSC::ExecState*, JSC::JSValue); // null if the value is null
+    JSC::UString valueToStringWithUndefinedOrNullCheck(JSC::ExecState*, JSC::JSValue); // null if the value is null or undefined
 
-    template <typename T> inline JSC::JSValuePtr toJS(JSC::ExecState* exec, PassRefPtr<T> ptr) { return toJS(exec, ptr.get()); }
+    template <typename T> inline JSC::JSValue toJS(JSC::ExecState* exec, PassRefPtr<T> ptr) { return toJS(exec, ptr.get()); }
 
     bool checkNodeSecurity(JSC::ExecState*, Node*);
 
@@ -178,10 +183,14 @@ namespace WebCore {
     // because we do not want current property values involved at all.
     bool allowsAccessFromFrame(JSC::ExecState*, Frame*);
     bool allowsAccessFromFrame(JSC::ExecState*, Frame*, String& message);
+    bool shouldAllowNavigation(JSC::ExecState*, Frame*);
     void printErrorMessageForFrame(Frame*, const String& message);
-    JSC::JSValuePtr objectToStringFunctionGetter(JSC::ExecState*, const JSC::Identifier& propertyName, const JSC::PropertySlot&);
+    JSC::JSValue objectToStringFunctionGetter(JSC::ExecState*, const JSC::Identifier& propertyName, const JSC::PropertySlot&);
 
-    ScriptState* scriptStateFromNode(Node*);
+    Frame* toLexicalFrame(JSC::ExecState*);
+    Frame* toDynamicFrame(JSC::ExecState*);
+    bool processingUserGesture(JSC::ExecState*);
+    KURL completeURL(JSC::ExecState*, const String& relativeURL);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
index ae339ed..a7f7b21 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.cpp
@@ -30,8 +30,11 @@
 #include "Document.h"
 #include "JSDOMWindow.h"
 #include "JSEventListener.h"
+
+#if ENABLE(WORKERS)
 #include "JSWorkerContext.h"
 #include "WorkerContext.h"
+#endif
 
 using namespace JSC;
 
@@ -49,26 +52,10 @@ JSDOMGlobalObject::JSDOMGlobalObject(PassRefPtr<Structure> structure, JSDOMGloba
 
 JSDOMGlobalObject::~JSDOMGlobalObject()
 {
-    // Clear any backpointers to the window
-    ListenersMap::iterator i1 = d()->jsEventListeners.begin();
-    ListenersMap::iterator e1 = d()->jsEventListeners.end();
-    for (; i1 != e1; ++i1)
-        i1->second->clearGlobalObject();
-
-    i1 = d()->jsInlineEventListeners.begin();
-    e1 = d()->jsInlineEventListeners.end();
-    for (; i1 != e1; ++i1)
-        i1->second->clearGlobalObject();
-
-    UnprotectedListenersMap::iterator i2 = d()->jsUnprotectedEventListeners.begin();
-    UnprotectedListenersMap::iterator e2 = d()->jsUnprotectedEventListeners.end();
-    for (; i2 != e2; ++i2)
-        i2->second->clearGlobalObject();
-
-    i2 = d()->jsUnprotectedInlineEventListeners.begin();
-    e2 = d()->jsUnprotectedInlineEventListeners.end();
-    for (; i2 != e2; ++i2)
-        i2->second->clearGlobalObject();
+    JSListenersMap::iterator it = d()->jsEventListeners.begin();
+    JSListenersMap::iterator end = d()->jsEventListeners.end();
+    for (; it != end; ++it)
+        it->second->clearGlobalObject();
 }
 
 void JSDOMGlobalObject::mark()
@@ -86,74 +73,45 @@ void JSDOMGlobalObject::mark()
     }
 }
 
-JSEventListener* JSDOMGlobalObject::findJSEventListener(JSValuePtr val, bool isInline)
+JSEventListener* JSDOMGlobalObject::findJSEventListener(JSValue val)
 {
-    if (!val->isObject())
+    if (!val.isObject())
         return 0;
-    JSObject* object = asObject(val);
-    ListenersMap& listeners = isInline ? d()->jsInlineEventListeners : d()->jsEventListeners;
-    return listeners.get(object);
+
+    return d()->jsEventListeners.get(asObject(val));
 }
 
-PassRefPtr<JSEventListener> JSDOMGlobalObject::findOrCreateJSEventListener(ExecState*, JSValuePtr val, bool isInline)
+PassRefPtr<JSEventListener> JSDOMGlobalObject::findOrCreateJSEventListener(JSValue val)
 {
-    if (JSEventListener* listener = findJSEventListener(val, isInline))
+    if (JSEventListener* listener = findJSEventListener(val))
         return listener;
 
-    if (!val->isObject())
+    if (!val.isObject())
         return 0;
 
     // The JSEventListener constructor adds it to our jsEventListeners map.
-    return JSEventListener::create(asObject(val), this, isInline).get();
-}
-
-JSUnprotectedEventListener* JSDOMGlobalObject::findJSUnprotectedEventListener(ExecState*, JSValuePtr val, bool isInline)
-{
-    if (!val->isObject())
-        return 0;
-
-    UnprotectedListenersMap& listeners = isInline ? d()->jsUnprotectedInlineEventListeners : d()->jsUnprotectedEventListeners;
-    return listeners.get(asObject(val));
+    return JSEventListener::create(asObject(val), this, false).get();
 }
 
-PassRefPtr<JSUnprotectedEventListener> JSDOMGlobalObject::findOrCreateJSUnprotectedEventListener(ExecState* exec, JSValuePtr val, bool isInline)
+PassRefPtr<JSEventListener> JSDOMGlobalObject::createJSAttributeEventListener(JSValue val)
 {
-    if (JSUnprotectedEventListener* listener = findJSUnprotectedEventListener(exec, val, isInline))
-        return listener;
-
-    if (!val->isObject())
+    if (!val.isObject())
         return 0;
 
-    // The JSUnprotectedEventListener constructor adds it to our jsUnprotectedEventListeners map.
-    return JSUnprotectedEventListener::create(asObject(val), this, isInline).get();
+    return JSEventListener::create(asObject(val), this, true).get();
 }
 
-JSDOMGlobalObject::ListenersMap& JSDOMGlobalObject::jsEventListeners()
+JSDOMGlobalObject::JSListenersMap& JSDOMGlobalObject::jsEventListeners()
 {
     return d()->jsEventListeners;
 }
 
-JSDOMGlobalObject::ListenersMap& JSDOMGlobalObject::jsInlineEventListeners()
-{
-    return d()->jsInlineEventListeners;
-}
-
-JSDOMGlobalObject::UnprotectedListenersMap& JSDOMGlobalObject::jsUnprotectedEventListeners()
-{
-    return d()->jsUnprotectedEventListeners;
-}
-
-JSDOMGlobalObject::UnprotectedListenersMap& JSDOMGlobalObject::jsUnprotectedInlineEventListeners()
-{
-    return d()->jsUnprotectedInlineEventListeners;
-}
-
 void JSDOMGlobalObject::setCurrentEvent(Event* evt)
 {
     d()->evt = evt;
 }
 
-Event* JSDOMGlobalObject::currentEvent()
+Event* JSDOMGlobalObject::currentEvent() const
 {
     return d()->evt;
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
index fbb3eb9..8e4e820 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMGlobalObject.h
@@ -32,8 +32,8 @@
 namespace WebCore {
 
     class Event;
+    class JSLazyEventListener;
     class JSEventListener;
-    class JSUnprotectedEventListener;
     class ScriptExecutionContext;
 
     typedef HashMap<const JSC::ClassInfo*, RefPtr<JSC::Structure> > JSDOMStructureMap;
@@ -53,28 +53,22 @@ namespace WebCore {
 
         virtual ScriptExecutionContext* scriptExecutionContext() const = 0;
 
-        // Finds a wrapper of a JS EventListener, returns 0 if no existing one.
-        JSEventListener* findJSEventListener(JSC::JSValuePtr, bool isInline = false);
-
-        // Finds or creates a wrapper of a JS EventListener. JS EventListener object is GC-protected.
-        PassRefPtr<JSEventListener> findOrCreateJSEventListener(JSC::ExecState*, JSC::JSValuePtr, bool isInline = false);
-
         // Finds a wrapper of a GC-unprotected JS EventListener, returns 0 if no existing one.
-        JSUnprotectedEventListener* findJSUnprotectedEventListener(JSC::ExecState*, JSC::JSValuePtr, bool isInline = false);
+        JSEventListener* findJSEventListener(JSC::JSValue);
 
         // Finds or creates a wrapper of a JS EventListener. JS EventListener object is *NOT* GC-protected.
-        PassRefPtr<JSUnprotectedEventListener> findOrCreateJSUnprotectedEventListener(JSC::ExecState*, JSC::JSValuePtr, bool isInline = false);
+        PassRefPtr<JSEventListener> findOrCreateJSEventListener(JSC::JSValue);
+
+        // Creates a GC-protected JS EventListener for an "onXXX" event attribute.
+        // These listeners cannot be removed through the removeEventListener API.
+        PassRefPtr<JSEventListener> createJSAttributeEventListener(JSC::JSValue);
 
-        typedef HashMap<JSC::JSObject*, JSEventListener*> ListenersMap;
-        typedef HashMap<JSC::JSObject*, JSUnprotectedEventListener*> UnprotectedListenersMap;
+        typedef HashMap<JSC::JSObject*, JSEventListener*> JSListenersMap;
 
-        ListenersMap& jsEventListeners();
-        ListenersMap& jsInlineEventListeners();
-        UnprotectedListenersMap& jsUnprotectedEventListeners();
-        UnprotectedListenersMap& jsUnprotectedInlineEventListeners();
+        JSListenersMap& jsEventListeners();
 
         void setCurrentEvent(Event*);
-        Event* currentEvent();
+        Event* currentEvent() const;
 
         virtual void mark();
 
@@ -85,10 +79,7 @@ namespace WebCore {
             JSDOMStructureMap structures;
             JSDOMConstructorMap constructors;
 
-            JSDOMGlobalObject::ListenersMap jsEventListeners;
-            JSDOMGlobalObject::ListenersMap jsInlineEventListeners;
-            JSDOMGlobalObject::UnprotectedListenersMap jsUnprotectedEventListeners;
-            JSDOMGlobalObject::UnprotectedListenersMap jsUnprotectedInlineEventListeners;
+            JSDOMGlobalObject::JSListenersMap jsEventListeners;
 
             Event* evt;
         };
@@ -108,11 +99,11 @@ namespace WebCore {
     }
 
     template<class ConstructorClass>
-    inline JSC::JSObject* getDOMConstructor(JSC::ExecState* exec, JSDOMGlobalObject* globalObject)
+    inline JSC::JSObject* getDOMConstructor(JSC::ExecState* exec, const JSDOMGlobalObject* globalObject)
     {
         if (JSC::JSObject* constructor = globalObject->constructors().get(&ConstructorClass::s_info))
             return constructor;
-        JSC::JSObject* constructor = new (exec) ConstructorClass(exec, globalObject->scriptExecutionContext());
+        JSC::JSObject* constructor = new (exec) ConstructorClass(exec, const_cast<JSDOMGlobalObject*>(globalObject));
         ASSERT(!globalObject->constructors().contains(&ConstructorClass::s_info));
         globalObject->constructors().set(&ConstructorClass::s_info, constructor);
         return constructor;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
index 10fc022..0eefebe 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -1,7 +1,7 @@
 /*
  *  Copyright (C) 2000 Harri Porten (porten@kde.org)
  *  Copyright (C) 2006 Jon Shier (jshier@iastate.edu)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reseved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reseved.
  *  Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  *
  *  This library is free software; you can redistribute it and/or
@@ -25,107 +25,25 @@
 
 #include "CString.h"
 #include "Console.h"
-#include "DOMTimer.h"
 #include "DOMWindow.h"
-#include "Element.h"
-#include "EventListener.h"
-#include "ExceptionCode.h"
-#include "FloatRect.h"
 #include "Frame.h"
-#include "FrameLoadRequest.h"
-#include "FrameLoader.h"
-#include "FrameTree.h"
-#include "GCController.h"
-#include "HTMLDocument.h"
 #include "InspectorController.h"
-#include "JSAudioConstructor.h"
 #include "JSDOMWindowCustom.h"
-#include "JSEvent.h"
-#include "JSEventListener.h"
-#include "JSHTMLCollection.h"
-#include "JSImageConstructor.h"
-#include "JSMessageChannelConstructor.h"
 #include "JSNode.h"
-#include "JSOptionConstructor.h"
-#include "JSWorkerConstructor.h"
-#include "JSXMLHttpRequestConstructor.h"
-#include "JSXSLTProcessorConstructor.h"
 #include "Logging.h"
-#include "MediaPlayer.h"
 #include "Page.h"
-#include "PlatformScreen.h"
-#include "PluginInfoStore.h"
-#include "RenderView.h"
-#include "ScheduledAction.h"
 #include "ScriptController.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
-#include "WindowFeatures.h"
-#include "htmlediting.h"
-#include <runtime/Error.h>
-#include <runtime/JSLock.h>
-#include <wtf/AlwaysInline.h>
-#include <wtf/MathExtras.h>
 
 using namespace JSC;
 
-static JSValuePtr windowProtoFuncOpen(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr windowProtoFuncShowModalDialog(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-static JSValuePtr windowProtoFuncNotImplemented(ExecState*, JSObject*, JSValuePtr, const ArgList&);
-
-static JSValuePtr jsDOMWindowBaseCrypto(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr jsDOMWindowBaseEvent(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseEvent(ExecState*, JSObject*, JSValuePtr);
-
-// Constructors
-static JSValuePtr jsDOMWindowBaseAudio(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseAudio(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseImage(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseImage(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseMessageChannel(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseMessageChannel(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseWorker(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseWorker(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseOption(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseOption(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseXMLHttpRequest(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseXMLHttpRequest(ExecState*, JSObject*, JSValuePtr);
-static JSValuePtr jsDOMWindowBaseXSLTProcessor(ExecState*, const Identifier&, const PropertySlot&);
-static void setJSDOMWindowBaseXSLTProcessor(ExecState*, JSObject*, JSValuePtr);
-
-#include "JSDOMWindowBase.lut.h"
-
 namespace WebCore {
 
-////////////////////// JSDOMWindowBase Object ////////////////////////
-
-const ClassInfo JSDOMWindowBase::s_info = { "Window", 0, &JSDOMWindowBaseTable, 0 };
-
-/*
-@begin JSDOMWindowBaseTable
-# -- Functions --
-  open                          windowProtoFuncOpen                         DontDelete|Function 3
-  showModalDialog               windowProtoFuncShowModalDialog              DontDelete|Function 1
-# Not implemented
-  captureEvents                 windowProtoFuncNotImplemented               DontDelete|Function 0
-  releaseEvents                 windowProtoFuncNotImplemented               DontDelete|Function 0
-# -- Attributes --
-  crypto                        jsDOMWindowBaseCrypto                       DontDelete|ReadOnly
-  event                         jsDOMWindowBaseEvent                        DontDelete
-# -- Constructors --
-  Audio                         jsDOMWindowBaseAudio                        DontDelete
-  Image                         jsDOMWindowBaseImage                        DontDelete
-  MessageChannel                jsDOMWindowBaseMessageChannel               DontDelete
-  Option                        jsDOMWindowBaseOption                       DontDelete
-  Worker                        jsDOMWindowBaseWorker                       DontDelete
-  XMLHttpRequest                jsDOMWindowBaseXMLHttpRequest               DontDelete
-  XSLTProcessor                 jsDOMWindowBaseXSLTProcessor                DontDelete
-@end
-*/
+const ClassInfo JSDOMWindowBase::s_info = { "Window", 0, 0, 0 };
 
 JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData(PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
     : impl(window)
-    , returnValueSlot(0)
     , shell(shell)
 {
 }
@@ -133,9 +51,6 @@ JSDOMWindowBase::JSDOMWindowBaseData::JSDOMWindowBaseData(PassRefPtr<DOMWindow>
 JSDOMWindowBase::JSDOMWindowBase(PassRefPtr<Structure> structure, PassRefPtr<DOMWindow> window, JSDOMWindowShell* shell)
     : JSDOMGlobalObject(structure, new JSDOMWindowBaseData(window, shell), shell)
 {
-    // Time in milliseconds before the script timeout handler kicks in.
-    setTimeoutTime(10000);
-
     GlobalPropertyInfo staticGlobals[] = {
         GlobalPropertyInfo(Identifier(globalExec(), "document"), jsNull(), DontDelete | ReadOnly),
         GlobalPropertyInfo(Identifier(globalExec(), "window"), d()->shell, DontDelete | ReadOnly)
@@ -151,466 +66,11 @@ void JSDOMWindowBase::updateDocument()
     symbolTablePutWithAttributes(Identifier(exec, "document"), toJS(exec, d()->impl->document()), DontDelete | ReadOnly);
 }
 
-JSDOMWindowBase::~JSDOMWindowBase()
-{
-    if (d()->impl->frame())
-        d()->impl->frame()->script()->clearFormerWindow(asJSDOMWindow(this));
-}
-
 ScriptExecutionContext* JSDOMWindowBase::scriptExecutionContext() const
 {
     return d()->impl->document();
 }
 
-static bool allowPopUp(ExecState* exec)
-{
-    Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-
-    ASSERT(frame);
-    if (frame->script()->processingUserGesture())
-        return true;
-    Settings* settings = frame->settings();
-    return settings && settings->JavaScriptCanOpenWindowsAutomatically();
-}
-
-static HashMap<String, String> parseModalDialogFeatures(const String& featuresArg)
-{
-    HashMap<String, String> map;
-
-    Vector<String> features;
-    featuresArg.split(';', features);
-    Vector<String>::const_iterator end = features.end();
-    for (Vector<String>::const_iterator it = features.begin(); it != end; ++it) {
-        String s = *it;
-        int pos = s.find('=');
-        int colonPos = s.find(':');
-        if (pos >= 0 && colonPos >= 0)
-            continue; // ignore any strings that have both = and :
-        if (pos < 0)
-            pos = colonPos;
-        if (pos < 0) {
-            // null string for value means key without value
-            map.set(s.stripWhiteSpace().lower(), String());
-        } else {
-            String key = s.left(pos).stripWhiteSpace().lower();
-            String val = s.substring(pos + 1).stripWhiteSpace().lower();
-            int spacePos = val.find(' ');
-            if (spacePos != -1)
-                val = val.left(spacePos);
-            map.set(key, val);
-        }
-    }
-
-    return map;
-}
-
-static Frame* createWindow(ExecState* exec, Frame* openerFrame, const String& url,
-    const String& frameName, const WindowFeatures& windowFeatures, JSValuePtr dialogArgs)
-{
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    ASSERT(activeFrame);
-
-    ResourceRequest request;
-
-    request.setHTTPReferrer(activeFrame->loader()->outgoingReferrer());
-    FrameLoader::addHTTPOriginIfNeeded(request, activeFrame->loader()->outgoingOrigin());
-    FrameLoadRequest frameRequest(request, frameName);
-
-    // FIXME: It's much better for client API if a new window starts with a URL, here where we
-    // know what URL we are going to open. Unfortunately, this code passes the empty string
-    // for the URL, but there's a reason for that. Before loading we have to set up the opener,
-    // openedByDOM, and dialogArguments values. Also, to decide whether to use the URL we currently
-    // do an allowsAccessFrom call using the window we create, which can't be done before creating it.
-    // We'd have to resolve all those issues to pass the URL instead of "".
-
-    bool created;
-    // We pass in the opener frame here so it can be used for looking up the frame name, in case the active frame
-    // is different from the opener frame, and the name references a frame relative to the opener frame, for example
-    // "_self" or "_parent".
-    Frame* newFrame = activeFrame->loader()->createWindow(openerFrame->loader(), frameRequest, windowFeatures, created);
-    if (!newFrame)
-        return 0;
-
-    newFrame->loader()->setOpener(openerFrame);
-    newFrame->loader()->setOpenedByDOM();
-
-    JSDOMWindow* newWindow = toJSDOMWindow(newFrame);
-
-    if (dialogArgs)
-        newWindow->putDirect(Identifier(exec, "dialogArguments"), dialogArgs);
-
-    if (!protocolIs(url, "javascript") || newWindow->allowsAccessFrom(exec)) {
-        KURL completedURL = url.isEmpty() ? KURL("") : activeFrame->document()->completeURL(url);
-        bool userGesture = activeFrame->script()->processingUserGesture();
-
-        if (created)
-            newFrame->loader()->changeLocation(completedURL, activeFrame->loader()->outgoingReferrer(), false, userGesture);
-        else if (!url.isEmpty())
-            newFrame->loader()->scheduleLocationChange(completedURL.string(), activeFrame->loader()->outgoingReferrer(), false, userGesture);
-    }
-
-    return newFrame;
-}
-
-static bool canShowModalDialog(const Frame* frame)
-{
-    if (!frame)
-        return false;
-
-    Page* page = frame->page();
-    if (!page)
-        return false;
-
-    return page->chrome()->canRunModal();
-}
-
-static bool canShowModalDialogNow(const Frame* frame)
-{
-    if (!frame)
-        return false;
-
-    Page* page = frame->page();
-    if (!page)
-        return false;
-
-    return page->chrome()->canRunModalNow();
-}
-
-static JSValuePtr showModalDialog(ExecState* exec, Frame* frame, const String& url, JSValuePtr dialogArgs, const String& featureArgs)
-{
-    if (!canShowModalDialogNow(frame) || !allowPopUp(exec))
-        return jsUndefined();
-
-    const HashMap<String, String> features = parseModalDialogFeatures(featureArgs);
-
-    const bool trusted = false;
-
-    // The following features from Microsoft's documentation are not implemented:
-    // - default font settings
-    // - width, height, left, and top specified in units other than "px"
-    // - edge (sunken or raised, default is raised)
-    // - dialogHide: trusted && boolFeature(features, "dialoghide"), makes dialog hide when you print
-    // - help: boolFeature(features, "help", true), makes help icon appear in dialog (what does it do on Windows?)
-    // - unadorned: trusted && boolFeature(features, "unadorned");
-
-    if (!frame)
-        return jsUndefined();
-
-    FloatRect screenRect = screenAvailableRect(frame->view());
-
-    WindowFeatures wargs;
-    wargs.width = WindowFeatures::floatFeature(features, "dialogwidth", 100, screenRect.width(), 620); // default here came from frame size of dialog in MacIE
-    wargs.widthSet = true;
-    wargs.height = WindowFeatures::floatFeature(features, "dialogheight", 100, screenRect.height(), 450); // default here came from frame size of dialog in MacIE
-    wargs.heightSet = true;
-
-    wargs.x = WindowFeatures::floatFeature(features, "dialogleft", screenRect.x(), screenRect.right() - wargs.width, -1);
-    wargs.xSet = wargs.x > 0;
-    wargs.y = WindowFeatures::floatFeature(features, "dialogtop", screenRect.y(), screenRect.bottom() - wargs.height, -1);
-    wargs.ySet = wargs.y > 0;
-
-    if (WindowFeatures::boolFeature(features, "center", true)) {
-        if (!wargs.xSet) {
-            wargs.x = screenRect.x() + (screenRect.width() - wargs.width) / 2;
-            wargs.xSet = true;
-        }
-        if (!wargs.ySet) {
-            wargs.y = screenRect.y() + (screenRect.height() - wargs.height) / 2;
-            wargs.ySet = true;
-        }
-    }
-
-    wargs.dialog = true;
-    wargs.resizable = WindowFeatures::boolFeature(features, "resizable");
-    wargs.scrollbarsVisible = WindowFeatures::boolFeature(features, "scroll", true);
-    wargs.statusBarVisible = WindowFeatures::boolFeature(features, "status", !trusted);
-    wargs.menuBarVisible = false;
-    wargs.toolBarVisible = false;
-    wargs.locationBarVisible = false;
-    wargs.fullscreen = false;
-
-    Frame* dialogFrame = createWindow(exec, frame, url, "", wargs, dialogArgs);
-    if (!dialogFrame)
-        return jsUndefined();
-
-    JSDOMWindow* dialogWindow = toJSDOMWindow(dialogFrame);
-
-    // Get the return value either just before clearing the dialog window's
-    // properties (in JSDOMWindowBase::clear), or when on return from runModal.
-    JSValuePtr returnValue = noValue();
-    dialogWindow->setReturnValueSlot(&returnValue);
-    dialogFrame->page()->chrome()->runModal();
-    dialogWindow->setReturnValueSlot(0);
-
-    // If we don't have a return value, get it now.
-    // Either JSDOMWindowBase::clear was not called yet, or there was no return value,
-    // and in that case, there's no harm in trying again (no benefit either).
-    if (!returnValue)
-        returnValue = dialogWindow->getDirect(Identifier(exec, "returnValue"));
-
-    return returnValue ? returnValue : jsUndefined();
-}
-
-} // namespace WebCore
-
-using namespace WebCore;
-
-JSValuePtr jsDOMWindowBaseCrypto(ExecState*, const Identifier&, const PropertySlot&)
-{
-    return jsUndefined(); // FIXME: implement this
-}
-
-JSValuePtr jsDOMWindowBaseEvent(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->currentEvent())
-        return jsUndefined();
-    return toJS(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->currentEvent());
-}
-
-JSValuePtr jsDOMWindowBaseImage(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSImageConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
-}
-
-JSValuePtr jsDOMWindowBaseMessageChannel(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-#if ENABLE(CHANNEL_MESSAGING)
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSMessageChannelConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
-#else
-    return jsUndefined();
-#endif
-}
-
-JSValuePtr jsDOMWindowBaseOption(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSOptionConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
-}
-
-JSValuePtr jsDOMWindowBaseXMLHttpRequest(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
-}
-
-JSValuePtr jsDOMWindowBaseAudio(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-#if ENABLE(VIDEO)
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    if (!MediaPlayer::isAvailable())
-        return jsUndefined();
-    return getDOMConstructor<JSAudioConstructor>(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase())));
-#else
-    return jsUndefined();
-#endif
-}
-
-JSValuePtr jsDOMWindowBaseWorker(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-#if ENABLE(WORKERS)
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSWorkerConstructor>(exec);
-#else
-    return jsUndefined();
-#endif
-}
-
-JSValuePtr jsDOMWindowBaseXSLTProcessor(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-#if ENABLE(XSLT)
-    if (!static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return getDOMConstructor<JSXSLTProcessorConstructor>(exec);
-#else
-    return jsUndefined();
-#endif
-}
-
-void setJSDOMWindowBaseEvent(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "Event"), value);
-}
-
-void setJSDOMWindowBaseAudio(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "Audio"), value);
-}
-
-void setJSDOMWindowBaseImage(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "Image"), value);
-}
-
-void setJSDOMWindowBaseMessageChannel(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "MessageChannel"), value);
-}
-
-void setJSDOMWindowBaseOption(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "Option"), value);
-}
-
-void setJSDOMWindowBaseWorker(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "Worker"), value);
-}
-
-void setJSDOMWindowBaseXMLHttpRequest(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "XMLHttpRequest"), value);
-}
-
-void setJSDOMWindowBaseXSLTProcessor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindowBase*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindowBase*>(thisObject)->putDirect(Identifier(exec, "XSLTProcessor"), value);
-}
-
-namespace WebCore {
-
-JSValuePtr JSDOMWindowBase::childFrameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
-{
-    return toJS(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->impl()->frame()->tree()->child(AtomicString(propertyName))->domWindow());
-}
-
-JSValuePtr JSDOMWindowBase::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    return toJS(exec, static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()))->impl()->frame()->tree()->child(slot.index())->domWindow());
-}
-
-JSValuePtr JSDOMWindowBase::namedItemGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
-{
-    JSDOMWindowBase* thisObj = static_cast<JSDOMWindowBase*>(asObject(slot.slotBase()));
-    Document* doc = thisObj->impl()->frame()->document();
-    ASSERT(thisObj->allowsAccessFrom(exec));
-    ASSERT(doc);
-    ASSERT(doc->isHTMLDocument());
-
-    RefPtr<HTMLCollection> collection = doc->windowNamedItems(propertyName);
-    if (collection->length() == 1)
-        return toJS(exec, collection->firstItem());
-    return toJS(exec, collection.get());
-}
-
-bool JSDOMWindowBase::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    // Check for child frames by name before built-in properties to
-    // match Mozilla. This does not match IE, but some sites end up
-    // naming frames things that conflict with window properties that
-    // are in Moz but not IE. Since we have some of these, we have to do
-    // it the Moz way.
-    if (impl()->frame()->tree()->child(propertyName)) {
-        slot.setCustom(this, childFrameGetter);
-        return true;
-    }
-
-    const HashEntry* entry = JSDOMWindowBaseTable.entry(exec, propertyName);
-    if (entry) {
-        if (entry->attributes() & Function) {
-            if (entry->function() == windowProtoFuncShowModalDialog) {
-                if (!canShowModalDialog(impl()->frame()))
-                    return false;
-            }
-            if (allowsAccessFrom(exec))
-                setUpStaticFunctionSlot(exec, entry, this, propertyName, slot);
-            else
-                slot.setUndefined();
-        } else
-            slot.setCustom(this, entry->propertyGetter());
-        return true;
-    }
-
-    // Do prototype lookup early so that functions and attributes in the prototype can have
-    // precedence over the index and name getters.  
-    JSValuePtr proto = prototype();
-    if (proto->isObject()) {
-        if (asObject(proto)->getPropertySlot(exec, propertyName, slot)) {
-            if (!allowsAccessFrom(exec))
-                slot.setUndefined();
-            return true;
-        }
-    }
-
-    // FIXME: Search the whole frame hierachy somewhere around here.
-    // We need to test the correct priority order.
-
-    // allow window[1] or parent[1] etc. (#56983)
-    bool ok;
-    unsigned i = propertyName.toArrayIndex(&ok);
-    if (ok && i < impl()->frame()->tree()->childCount()) {
-        slot.setCustomIndex(this, i, indexGetter);
-        return true;
-    }
-
-    if (!allowsAccessFrom(exec)) {
-        slot.setUndefined();
-        return true;
-    }
-
-    // Allow shortcuts like 'Image1' instead of document.images.Image1
-    Document* document = impl()->frame()->document();
-    if (document && document->isHTMLDocument()) {
-        AtomicStringImpl* atomicPropertyName = AtomicString::find(propertyName);
-        if (atomicPropertyName && (static_cast<HTMLDocument*>(document)->hasNamedItem(atomicPropertyName) || document->hasElementWithId(atomicPropertyName))) {
-            slot.setCustom(this, namedItemGetter);
-            return true;
-        }
-    }
-
-    return Base::getOwnPropertySlot(exec, propertyName, slot);
-}
-
-void JSDOMWindowBase::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
-{
-    const HashEntry* entry = JSDOMWindowBaseTable.entry(exec, propertyName);
-    if (entry) {
-        if (entry->attributes() & Function) {
-            if (allowsAccessFrom(exec))
-                Base::put(exec, propertyName, value, slot);
-            return;
-        }
-        if (entry->attributes() & ReadOnly)
-            return;
-    }
-
-    if (allowsAccessFrom(exec))
-        Base::put(exec, propertyName, value, slot);
-}
-
 String JSDOMWindowBase::crossDomainAccessErrorMessage(const JSGlobalObject* other) const
 {
     KURL originURL = asJSDOMWindow(other)->impl()->url();
@@ -653,6 +113,9 @@ ExecState* JSDOMWindowBase::globalExec()
 
 bool JSDOMWindowBase::supportsProfiling() const
 {
+#if !ENABLE(JAVASCRIPT_DEBUGGER)
+    return false;
+#else
     Frame* frame = impl()->frame();
     if (!frame)
         return false;
@@ -662,6 +125,7 @@ bool JSDOMWindowBase::supportsProfiling() const
         return false;
 
     return page->inspectorController()->profilerEnabled();
+#endif
 }
 
 bool JSDOMWindowBase::shouldInterruptScript() const
@@ -682,21 +146,11 @@ bool JSDOMWindowBase::shouldInterruptScript() const
     return page->chrome()->shouldInterruptJavaScript();
 }
 
-void JSDOMWindowBase::clearHelperObjectProperties()
+void JSDOMWindowBase::willRemoveFromWindowShell()
 {
     setCurrentEvent(0);
 }
 
-void JSDOMWindowBase::clear()
-{
-    JSLock lock(false);
-
-    if (d()->returnValueSlot && !*d()->returnValueSlot)
-        *d()->returnValueSlot = getDirect(Identifier(globalExec(), "returnValue"));
-
-    clearHelperObjectProperties();
-}
-
 JSObject* JSDOMWindowBase::toThisObject(ExecState*) const
 {
     return shell();
@@ -709,141 +163,16 @@ JSDOMWindowShell* JSDOMWindowBase::shell() const
 
 JSGlobalData* JSDOMWindowBase::commonJSGlobalData()
 {
-    static JSGlobalData* globalData = JSGlobalData::createLeaked().releaseRef();
-    return globalData;
-}
-
-} // namespace WebCore
-
-using namespace WebCore;
-
-JSValuePtr windowProtoFuncOpen(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    JSDOMWindow* window = toJSDOMWindow(thisValue);
-    if (!window)
-        return throwError(exec, TypeError);
-    if (!window->allowsAccessFrom(exec))
-        return jsUndefined();
-
-    Frame* frame = window->impl()->frame();
-    if (!frame)
-        return jsUndefined();
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!activeFrame)
-        return  jsUndefined();
-
-    Page* page = frame->page();
-
-    String urlString = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
-    AtomicString frameName = args.at(exec, 1)->isUndefinedOrNull() ? "_blank" : AtomicString(args.at(exec, 1)->toString(exec));
-
-    // Because FrameTree::find() returns true for empty strings, we must check for empty framenames.
-    // Otherwise, illegitimate window.open() calls with no name will pass right through the popup blocker.
-    if (!allowPopUp(exec) && (frameName.isEmpty() || !frame->tree()->find(frameName)))
-        return jsUndefined();
-
-    // Get the target frame for the special cases of _top and _parent.  In those
-    // cases, we can schedule a location change right now and return early.
-    bool topOrParent = false;
-    if (frameName == "_top") {
-        frame = frame->tree()->top();
-        topOrParent = true;
-    } else if (frameName == "_parent") {
-        if (Frame* parent = frame->tree()->parent())
-            frame = parent;
-        topOrParent = true;
+    static JSGlobalData* globalData;
+    if (!globalData) {
+        globalData = JSGlobalData::createLeaked().releaseRef();
+        globalData->timeoutChecker.setTimeoutInterval(10000); // 10 seconds
     }
-    if (topOrParent) {
-        if (!activeFrame->loader()->shouldAllowNavigation(frame))
-            return jsUndefined();
 
-        String completedURL;
-        if (!urlString.isEmpty())
-            completedURL = activeFrame->document()->completeURL(urlString).string();
-
-        const JSDOMWindow* targetedWindow = toJSDOMWindow(frame);
-        if (!completedURL.isEmpty() && (!protocolIs(completedURL, "javascript") || (targetedWindow && targetedWindow->allowsAccessFrom(exec)))) {
-            bool userGesture = activeFrame->script()->processingUserGesture();
-            frame->loader()->scheduleLocationChange(completedURL, activeFrame->loader()->outgoingReferrer(), false, userGesture);
-        }
-        return toJS(exec, frame->domWindow());
-    }
-
-    // In the case of a named frame or a new window, we'll use the createWindow() helper
-    WindowFeatures windowFeatures(valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 2)));
-    FloatRect windowRect(windowFeatures.xSet ? windowFeatures.x : 0, windowFeatures.ySet ? windowFeatures.y : 0,
-                         windowFeatures.widthSet ? windowFeatures.width : 0, windowFeatures.heightSet ? windowFeatures.height : 0);
-    DOMWindow::adjustWindowRect(screenAvailableRect(page ? page->mainFrame()->view() : 0), windowRect, windowRect);
-
-    windowFeatures.x = windowRect.x();
-    windowFeatures.y = windowRect.y();
-    windowFeatures.height = windowRect.height();
-    windowFeatures.width = windowRect.width();
-
-    frame = createWindow(exec, frame, urlString, frameName, windowFeatures, noValue());
-
-    if (!frame)
-        return jsUndefined();
-
-    return toJS(exec, frame->domWindow()); // global object
-}
-
-JSValuePtr windowProtoFuncShowModalDialog(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    JSDOMWindow* window = toJSDOMWindow(thisValue);
-    if (!window)
-        return throwError(exec, TypeError);
-    if (!window->allowsAccessFrom(exec))
-        return jsUndefined();
-
-    Frame* frame = window->impl()->frame();
-    if (!frame)
-        return jsUndefined();
-
-    return showModalDialog(exec, frame, valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0)), args.at(exec, 1), valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 2)));
-}
-
-JSValuePtr windowProtoFuncNotImplemented(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList&)
-{
-    if (!toJSDOMWindow(thisValue))
-        return throwError(exec, TypeError);
-    return jsUndefined();
-}
-
-namespace WebCore {
-
-void JSDOMWindowBase::setReturnValueSlot(JSValuePtr* slot)
-{
-    d()->returnValueSlot = slot;
-}
-
-////////////////////// timeouts ////////////////////////
-
-int JSDOMWindowBase::installTimeout(ScheduledAction* a, int t, bool singleShot)
-{
-    return DOMTimer::install(scriptExecutionContext(), a, t, singleShot);
-}
-
-int JSDOMWindowBase::installTimeout(const UString& handler, int t, bool singleShot)
-{
-    return installTimeout(new ScheduledAction(handler), t, singleShot);
-}
-
-int JSDOMWindowBase::installTimeout(ExecState* exec, JSValuePtr func, const ArgList& args, int t, bool singleShot)
-{
-    return installTimeout(new ScheduledAction(exec, func, args), t, singleShot);
-}
-
-void JSDOMWindowBase::removeTimeout(int timeoutId)
-{
-    DOMTimer::removeById(scriptExecutionContext(), timeoutId);
-}
-
-void JSDOMWindowBase::disconnectFrame()
-{
+    return globalData;
 }
 
-JSValuePtr toJS(ExecState*, DOMWindow* domWindow)
+JSValue toJS(ExecState*, DOMWindow* domWindow)
 {
     if (!domWindow)
         return jsNull();
@@ -860,9 +189,9 @@ JSDOMWindow* toJSDOMWindow(Frame* frame)
     return frame->script()->windowShell()->window();
 }
 
-JSDOMWindow* toJSDOMWindow(JSValuePtr value)
+JSDOMWindow* toJSDOMWindow(JSValue value)
 {
-    if (!value->isObject())
+    if (!value.isObject())
         return 0;
     const ClassInfo* classInfo = asObject(value)->classInfo();
     if (classInfo == &JSDOMWindow::s_info)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
index 2398172..113344f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowBase.h
@@ -34,57 +34,36 @@ namespace WebCore {
     class Frame;
     class JSDOMWindow;
     class JSDOMWindowShell;
-    class JSEventListener;
     class JSLocation;
-    class JSUnprotectedEventListener;
-    class ScheduledAction;
+    class JSEventListener;
     class SecurityOrigin;
 
     class JSDOMWindowBasePrivate;
 
-    // This is the only WebCore JS binding which does not inherit from DOMObject
     class JSDOMWindowBase : public JSDOMGlobalObject {
         typedef JSDOMGlobalObject Base;
-
-        friend class ScheduledAction;
     protected:
         JSDOMWindowBase(PassRefPtr<JSC::Structure>, PassRefPtr<DOMWindow>, JSDOMWindowShell*);
 
     public:
-        virtual ~JSDOMWindowBase();
-
         void updateDocument();
 
         DOMWindow* impl() const { return d()->impl.get(); }
         virtual ScriptExecutionContext* scriptExecutionContext() const;
 
-        void disconnectFrame();
-
-        virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-
-        int installTimeout(const JSC::UString& handler, int t, bool singleShot);
-        int installTimeout(JSC::ExecState*, JSC::JSValuePtr function, const JSC::ArgList& args, int t, bool singleShot);
-        void removeTimeout(int timeoutId);
-
-        void clear();
-
-        // Set a place to put a dialog return value when the window is cleared.
-        void setReturnValueSlot(JSC::JSValuePtr* slot);
+        // Called just before removing this window from the JSDOMWindowShell.
+        void willRemoveFromWindowShell();
 
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
         static const JSC::ClassInfo s_info;
 
         virtual JSC::ExecState* globalExec();
-        
         virtual bool supportsProfiling() const;
-
         virtual bool shouldInterruptScript() const;
 
         bool allowsAccessFrom(JSC::ExecState*) const;
         bool allowsAccessFromNoErrorMessage(JSC::ExecState*) const;
         bool allowsAccessFrom(JSC::ExecState*, String& message) const;
-
         void printErrorMessage(const String&) const;
 
         // Don't call this version of allowsAccessFrom -- it's a slightly incorrect implementation used only by WebScriptObject
@@ -100,18 +79,9 @@ namespace WebCore {
             JSDOMWindowBaseData(PassRefPtr<DOMWindow>, JSDOMWindowShell*);
 
             RefPtr<DOMWindow> impl;
-
-            JSC::JSValuePtr* returnValueSlot;
             JSDOMWindowShell* shell;
         };
 
-        static JSC::JSValuePtr childFrameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-        static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-        static JSC::JSValuePtr namedItemGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-
-        void clearHelperObjectProperties();
-        int installTimeout(ScheduledAction*, int interval, bool singleShot);
-
         bool allowsAccessFromPrivate(const JSC::JSGlobalObject*) const;
         String crossDomainAccessErrorMessage(const JSC::JSGlobalObject*) const;
         
@@ -119,11 +89,11 @@ namespace WebCore {
     };
 
     // Returns a JSDOMWindow or jsNull()
-    JSC::JSValuePtr toJS(JSC::ExecState*, DOMWindow*);
+    JSC::JSValue toJS(JSC::ExecState*, DOMWindow*);
 
     // Returns JSDOMWindow or 0
     JSDOMWindow* toJSDOMWindow(Frame*);
-    JSDOMWindow* toJSDOMWindow(JSC::JSValuePtr);
+    JSDOMWindow* toJSDOMWindow(JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 2c5f882..22013eb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,15 +25,41 @@
 #include "DOMWindow.h"
 #include "Document.h"
 #include "ExceptionCode.h"
+#include "FloatRect.h"
 #include "Frame.h"
+#include "FrameLoadRequest.h"
 #include "FrameLoader.h"
 #include "FrameTree.h"
+#include "FrameView.h"
+#include "HTMLCollection.h"
+#include "HTMLDocument.h"
+#include "History.h"
+#include "JSAudioConstructor.h"
 #include "JSDOMWindowShell.h"
+#include "JSEvent.h"
 #include "JSEventListener.h"
+#include "JSHTMLCollection.h"
+#include "JSHistory.h"
+#include "JSImageConstructor.h"
+#include "JSLocation.h"
+#include "JSMessageChannelConstructor.h"
 #include "JSMessagePort.h"
+#include "JSOptionConstructor.h"
+#include "JSWebKitCSSMatrixConstructor.h"
+#include "JSWebKitPointConstructor.h"
+#include "JSWorkerConstructor.h"
+#include "JSXMLHttpRequestConstructor.h"
+#include "JSXSLTProcessorConstructor.h"
+#include "Location.h"
+#include "MediaPlayer.h"
 #include "MessagePort.h"
+#include "Page.h"
+#include "PlatformScreen.h"
+#include "RegisteredEventListener.h"
+#include "ScheduledAction.h"
 #include "ScriptController.h"
 #include "Settings.h"
+#include "WindowFeatures.h"
 #include <runtime/JSObject.h>
 #include <runtime/PrototypeFunction.h>
 
@@ -45,6 +71,8 @@ void JSDOMWindow::mark()
 {
     Base::mark();
 
+    markEventListeners(impl()->eventListeners());
+
     JSGlobalData& globalData = *Heap::heap(this)->globalData();
 
     markDOMObjectWrapper(globalData, impl()->optionalConsole());
@@ -68,6 +96,199 @@ void JSDOMWindow::mark()
 #endif
 }
 
+template<NativeFunction nativeFunction, int length>
+JSValue nonCachingStaticFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+{
+    return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), length, propertyName, nativeFunction);
+}
+
+static JSValue childFrameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl()->frame()->tree()->child(AtomicString(propertyName))->domWindow());
+}
+
+static JSValue indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return toJS(exec, static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl()->frame()->tree()->child(slot.index())->domWindow());
+}
+
+static JSValue namedItemGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    JSDOMWindowBase* thisObj = static_cast<JSDOMWindow*>(asObject(slot.slotBase()));
+    Document* document = thisObj->impl()->frame()->document();
+
+    ASSERT(thisObj->allowsAccessFrom(exec));
+    ASSERT(document);
+    ASSERT(document->isHTMLDocument());
+
+    RefPtr<HTMLCollection> collection = document->windowNamedItems(propertyName);
+    if (collection->length() == 1)
+        return toJS(exec, collection->firstItem());
+    return toJS(exec, collection.get());
+}
+
+bool JSDOMWindow::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    // When accessing a Window cross-domain, functions are always the native built-in ones, and they
+    // are not affected by properties changed on the Window or anything in its prototype chain.
+    // This is consistent with the behavior of Firefox.
+
+    const HashEntry* entry;
+
+    // We don't want any properties other than "close" and "closed" on a closed window.
+    if (!impl()->frame()) {
+        // The following code is safe for cross-domain and same domain use.
+        // It ignores any custom properties that might be set on the DOMWindow (including a custom prototype).
+        entry = s_info.propHashTable(exec)->entry(exec, propertyName);
+        if (entry && !(entry->attributes() & Function) && entry->propertyGetter() == jsDOMWindowClosed) {
+            slot.setCustom(this, entry->propertyGetter());
+            return true;
+        }
+        entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+        if (entry && (entry->attributes() & Function) && entry->function() == jsDOMWindowPrototypeFunctionClose) {
+            slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
+            return true;
+        }
+
+        // FIXME: We should have a message here that explains why the property access/function call was
+        // not allowed. 
+        slot.setUndefined();
+        return true;
+    }
+
+    // We need to check for cross-domain access here without printing the generic warning message
+    // because we always allow access to some function, just different ones depending whether access
+    // is allowed.
+    String errorMessage;
+    bool allowsAccess = allowsAccessFrom(exec, errorMessage);
+
+    // Look for overrides before looking at any of our own properties, but ignore overrides completely
+    // if this is cross-domain access.
+    if (allowsAccess && JSGlobalObject::getOwnPropertySlot(exec, propertyName, slot))
+        return true;
+
+    // We need this code here because otherwise JSDOMWindowBase will stop the search before we even get to the
+    // prototype due to the blanket same origin (allowsAccessFrom) check at the end of getOwnPropertySlot.
+    // Also, it's important to get the implementation straight out of the DOMWindow prototype regardless of
+    // what prototype is actually set on this object.
+    entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (entry) {
+        if (entry->attributes() & Function) {
+            if (entry->function() == jsDOMWindowPrototypeFunctionBlur) {
+                if (!allowsAccess) {
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionBlur, 0>);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionClose) {
+                if (!allowsAccess) {
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionClose, 0>);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionFocus) {
+                if (!allowsAccess) {
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionFocus, 0>);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionPostMessage) {
+                if (!allowsAccess) {
+                    slot.setCustom(this, nonCachingStaticFunctionGetter<jsDOMWindowPrototypeFunctionPostMessage, 2>);
+                    return true;
+                }
+            } else if (entry->function() == jsDOMWindowPrototypeFunctionShowModalDialog) {
+                if (!DOMWindow::canShowModalDialog(impl()->frame())) {
+                    slot.setUndefined();
+                    return true;
+                }
+            }
+        }
+    } else {
+        // Allow access to toString() cross-domain, but always Object.prototype.toString.
+        if (propertyName == exec->propertyNames().toString) {
+            if (!allowsAccess) {
+                slot.setCustom(this, objectToStringFunctionGetter);
+                return true;
+            }
+        }
+    }
+
+    entry = JSDOMWindow::s_info.propHashTable(exec)->entry(exec, propertyName);
+    if (entry) {
+        slot.setCustom(this, entry->propertyGetter());
+        return true;
+    }
+
+    // Check for child frames by name before built-in properties to
+    // match Mozilla. This does not match IE, but some sites end up
+    // naming frames things that conflict with window properties that
+    // are in Moz but not IE. Since we have some of these, we have to do
+    // it the Moz way.
+    if (impl()->frame()->tree()->child(propertyName)) {
+        slot.setCustom(this, childFrameGetter);
+        return true;
+    }
+
+    // Do prototype lookup early so that functions and attributes in the prototype can have
+    // precedence over the index and name getters.  
+    JSValue proto = prototype();
+    if (proto.isObject()) {
+        if (asObject(proto)->getPropertySlot(exec, propertyName, slot)) {
+            if (!allowsAccess) {
+                printErrorMessage(errorMessage);
+                slot.setUndefined();
+            }
+            return true;
+        }
+    }
+
+    // FIXME: Search the whole frame hierachy somewhere around here.
+    // We need to test the correct priority order.
+
+    // allow window[1] or parent[1] etc. (#56983)
+    bool ok;
+    unsigned i = propertyName.toArrayIndex(&ok);
+    if (ok && i < impl()->frame()->tree()->childCount()) {
+        slot.setCustomIndex(this, i, indexGetter);
+        return true;
+    }
+
+    if (!allowsAccess) {
+        printErrorMessage(errorMessage);
+        slot.setUndefined();
+        return true;
+    }
+
+    // Allow shortcuts like 'Image1' instead of document.images.Image1
+    Document* document = impl()->frame()->document();
+    if (document->isHTMLDocument()) {
+        AtomicStringImpl* atomicPropertyName = AtomicString::find(propertyName);
+        if (atomicPropertyName && (static_cast<HTMLDocument*>(document)->hasNamedItem(atomicPropertyName) || document->hasElementWithId(atomicPropertyName))) {
+            slot.setCustom(this, namedItemGetter);
+            return true;
+        }
+    }
+
+    return Base::getOwnPropertySlot(exec, propertyName, slot);
+}
+
+void JSDOMWindow::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    if (!impl()->frame())
+        return;
+
+    // Optimization: access JavaScript global variables directly before involving the DOM.
+    if (JSGlobalObject::hasOwnPropertyForWrite(exec, propertyName)) {
+        if (allowsAccessFrom(exec))
+            JSGlobalObject::put(exec, propertyName, value, slot);
+        return;
+    }
+
+    if (lookupPut<JSDOMWindow>(exec, propertyName, value, s_info.propHashTable(exec), this))
+        return;
+
+    if (allowsAccessFrom(exec))
+        Base::put(exec, propertyName, value, slot);
+}
+
 bool JSDOMWindow::deleteProperty(ExecState* exec, const Identifier& propertyName)
 {
     // Only allow deleting properties by frames in the same origin.
@@ -76,15 +297,15 @@ bool JSDOMWindow::deleteProperty(ExecState* exec, const Identifier& propertyName
     return Base::deleteProperty(exec, propertyName);
 }
 
-bool JSDOMWindow::customGetPropertyNames(ExecState* exec, PropertyNameArray&)
+void JSDOMWindow::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     // Only allow the window to enumerated by frames in the same origin.
     if (!allowsAccessFrom(exec))
-        return true;
-    return false;
+        return;
+    Base::getPropertyNames(exec, propertyNames);
 }
 
-bool JSDOMWindow::getPropertyAttributes(JSC::ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
+bool JSDOMWindow::getPropertyAttributes(ExecState* exec, const Identifier& propertyName, unsigned& attributes) const
 {
     // Only allow getting property attributes properties by frames in the same origin.
     if (!allowsAccessFrom(exec))
@@ -97,6 +318,11 @@ void JSDOMWindow::defineGetter(ExecState* exec, const Identifier& propertyName,
     // Only allow defining getters by frames in the same origin.
     if (!allowsAccessFrom(exec))
         return;
+
+    // Don't allow shadowing location using defineGetter.
+    if (propertyName == "location")
+        return;
+
     Base::defineGetter(exec, propertyName, getterFunction);
 }
 
@@ -108,7 +334,7 @@ void JSDOMWindow::defineSetter(ExecState* exec, const Identifier& propertyName,
     Base::defineSetter(exec, propertyName, setterFunction);
 }
 
-JSValuePtr JSDOMWindow::lookupGetter(ExecState* exec, const Identifier& propertyName)
+JSValue JSDOMWindow::lookupGetter(ExecState* exec, const Identifier& propertyName)
 {
     // Only allow looking-up getters by frames in the same origin.
     if (!allowsAccessFrom(exec))
@@ -116,7 +342,7 @@ JSValuePtr JSDOMWindow::lookupGetter(ExecState* exec, const Identifier& property
     return Base::lookupGetter(exec, propertyName);
 }
 
-JSValuePtr JSDOMWindow::lookupSetter(ExecState* exec, const Identifier& propertyName)
+JSValue JSDOMWindow::lookupSetter(ExecState* exec, const Identifier& propertyName)
 {
     // Only allow looking-up setters by frames in the same origin.
     if (!allowsAccessFrom(exec))
@@ -124,17 +350,41 @@ JSValuePtr JSDOMWindow::lookupSetter(ExecState* exec, const Identifier& property
     return Base::lookupSetter(exec, propertyName);
 }
 
-void JSDOMWindow::setLocation(ExecState* exec, JSValuePtr value)
+// Custom Attributes
+
+JSValue JSDOMWindow::history(ExecState* exec) const
 {
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!activeFrame)
+    History* history = impl()->history();
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), history))
+        return wrapper;
+
+    JSHistory* jsHistory = new (exec) JSHistory(getDOMStructure<JSHistory>(exec, const_cast<JSDOMWindow*>(this)), history);
+    cacheDOMObjectWrapper(exec->globalData(), history, jsHistory);
+    return jsHistory;
+}
+
+JSValue JSDOMWindow::location(ExecState* exec) const
+{
+    Location* location = impl()->location();
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), location))
+        return wrapper;
+
+    JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, const_cast<JSDOMWindow*>(this)), location);
+    cacheDOMObjectWrapper(exec->globalData(), location, jsLocation);
+    return jsLocation;
+}
+
+void JSDOMWindow::setLocation(ExecState* exec, JSValue value)
+{
+    Frame* lexicalFrame = toLexicalFrame(exec);
+    if (!lexicalFrame)
         return;
 
 #if ENABLE(DASHBOARD_SUPPORT)
     // To avoid breaking old widgets, make "var location =" in a top-level frame create
     // a property named "location" instead of performing a navigation (<rdar://problem/5688039>).
-    if (Settings* settings = activeFrame->settings()) {
-        if (settings->usesDashboardBackwardCompatibilityMode() && !activeFrame->tree()->parent()) {
+    if (Settings* settings = lexicalFrame->settings()) {
+        if (settings->usesDashboardBackwardCompatibilityMode() && !lexicalFrame->tree()->parent()) {
             if (allowsAccessFrom(exec))
                 putDirect(Identifier(exec, "location"), value);
             return;
@@ -142,85 +392,345 @@ void JSDOMWindow::setLocation(ExecState* exec, JSValuePtr value)
     }
 #endif
 
-    if (!activeFrame->loader()->shouldAllowNavigation(impl()->frame()))
+    Frame* frame = impl()->frame();
+    ASSERT(frame);
+
+    if (!shouldAllowNavigation(exec, frame))
+        return;
+
+    KURL url = completeURL(exec, value.toString(exec));
+    if (url.isNull())
         return;
-    String dstUrl = activeFrame->loader()->completeURL(value->toString(exec)).string();
-    if (!protocolIs(dstUrl, "javascript") || allowsAccessFrom(exec)) {
-        bool userGesture = activeFrame->script()->processingUserGesture();
+
+    if (!protocolIsJavaScript(url) || allowsAccessFrom(exec)) {
         // We want a new history item if this JS was called via a user gesture
-        impl()->frame()->loader()->scheduleLocationChange(dstUrl, activeFrame->loader()->outgoingReferrer(), false, userGesture);
+        frame->loader()->scheduleLocationChange(url, lexicalFrame->loader()->outgoingReferrer(), !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, processingUserGesture(exec));
     }
 }
 
-JSValuePtr JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::crypto(ExecState*) const
 {
-    DOMWindow* window = impl();
-
-    DOMWindow* source = asJSDOMWindow(exec->dynamicGlobalObject())->impl();
-    String message = args.at(exec, 0)->toString(exec);
+    return jsUndefined();
+}
 
-    if (exec->hadException())
+JSValue JSDOMWindow::event(ExecState* exec) const
+{
+    Event* event = currentEvent();
+    if (!event)
         return jsUndefined();
+    return toJS(exec, event);
+}
 
-    MessagePort* messagePort = (args.size() == 2) ? 0 : toMessagePort(args.at(exec, 1));
+JSValue JSDOMWindow::image(ExecState* exec) const
+{
+    return getDOMConstructor<JSImageConstructor>(exec, this);
+}
 
-    String targetOrigin = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, (args.size() == 2) ? 1 : 2));
-    if (exec->hadException())
+JSValue JSDOMWindow::option(ExecState* exec) const
+{
+    return getDOMConstructor<JSOptionConstructor>(exec, this);
+}
+
+#if ENABLE(VIDEO)
+JSValue JSDOMWindow::audio(ExecState* exec) const
+{
+    if (!MediaPlayer::isAvailable())
         return jsUndefined();
+    return getDOMConstructor<JSAudioConstructor>(exec, this);
+}
+#endif
 
-    ExceptionCode ec = 0;
-    window->postMessage(message, messagePort, targetOrigin, source, ec);
-    setDOMException(exec, ec);
+JSValue JSDOMWindow::webKitPoint(ExecState* exec) const
+{
+    return getDOMConstructor<JSWebKitPointConstructor>(exec);
+}
 
-    return jsUndefined();
+JSValue JSDOMWindow::webKitCSSMatrix(ExecState* exec) const
+{
+    return getDOMConstructor<JSWebKitCSSMatrixConstructor>(exec);
+}
+ 
+JSValue JSDOMWindow::xmlHttpRequest(ExecState* exec) const
+{
+    return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, this);
+}
+
+#if ENABLE(XSLT)
+JSValue JSDOMWindow::xsltProcessor(ExecState* exec) const
+{
+    return getDOMConstructor<JSXSLTProcessorConstructor>(exec);
+}
+#endif
+
+#if ENABLE(CHANNEL_MESSAGING)
+JSValue JSDOMWindow::messageChannel(ExecState* exec) const
+{
+    return getDOMConstructor<JSMessageChannelConstructor>(exec, this);
+}
+#endif
+
+#if ENABLE(WORKERS)
+JSValue JSDOMWindow::worker(ExecState* exec) const
+{
+    return getDOMConstructor<JSWorkerConstructor>(exec);
+}
+#endif
+
+// Custom functions
+
+// Helper for window.open() and window.showModalDialog()
+static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicFrame,
+                           Frame* openerFrame, const String& url, const String& frameName, 
+                           const WindowFeatures& windowFeatures, JSValue dialogArgs)
+{
+    ASSERT(lexicalFrame);
+    ASSERT(dynamicFrame);
+
+    ResourceRequest request;
+
+    // For whatever reason, Firefox uses the dynamicGlobalObject to determine
+    // the outgoingReferrer.  We replicate that behavior here.
+    String referrer = dynamicFrame->loader()->outgoingReferrer();
+    request.setHTTPReferrer(referrer);
+    FrameLoader::addHTTPOriginIfNeeded(request, dynamicFrame->loader()->outgoingOrigin());
+    FrameLoadRequest frameRequest(request, frameName);
+
+    // FIXME: It's much better for client API if a new window starts with a URL, here where we
+    // know what URL we are going to open. Unfortunately, this code passes the empty string
+    // for the URL, but there's a reason for that. Before loading we have to set up the opener,
+    // openedByDOM, and dialogArguments values. Also, to decide whether to use the URL we currently
+    // do an allowsAccessFrom call using the window we create, which can't be done before creating it.
+    // We'd have to resolve all those issues to pass the URL instead of "".
+
+    bool created;
+    // We pass in the opener frame here so it can be used for looking up the frame name, in case the active frame
+    // is different from the opener frame, and the name references a frame relative to the opener frame, for example
+    // "_self" or "_parent".
+    Frame* newFrame = lexicalFrame->loader()->createWindow(openerFrame->loader(), frameRequest, windowFeatures, created);
+    if (!newFrame)
+        return 0;
+
+    newFrame->loader()->setOpener(openerFrame);
+    newFrame->loader()->setOpenedByDOM();
+
+    JSDOMWindow* newWindow = toJSDOMWindow(newFrame);
+
+    if (dialogArgs)
+        newWindow->putDirect(Identifier(exec, "dialogArguments"), dialogArgs);
+
+    if (!protocolIsJavaScript(url) || newWindow->allowsAccessFrom(exec)) {
+        KURL completedURL = url.isEmpty() ? KURL("") : completeURL(exec, url);
+        bool userGesture = processingUserGesture(exec);
+
+        if (created)
+            newFrame->loader()->changeLocation(completedURL, referrer, false, false, userGesture);
+        else if (!url.isEmpty())
+            newFrame->loader()->scheduleLocationChange(completedURL.string(), referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+    }
+
+    return newFrame;
 }
 
-static JSValuePtr setTimeoutOrInterval(ExecState* exec, JSDOMWindow* window, const ArgList& args, bool timeout)
+JSValue JSDOMWindow::open(ExecState* exec, const ArgList& args)
 {
-    JSValuePtr v = args.at(exec, 0);
-    int delay = args.at(exec, 1)->toInt32(exec);
-    if (v->isString())
-        return jsNumber(exec, window->installTimeout(asString(v)->value(), delay, timeout));
-    CallData callData;
-    if (v->getCallData(callData) == CallTypeNone)
+    Frame* frame = impl()->frame();
+    if (!frame)
+        return jsUndefined();
+    Frame* lexicalFrame = toLexicalFrame(exec);
+    if (!lexicalFrame)
+        return jsUndefined();
+    Frame* dynamicFrame = toDynamicFrame(exec);
+    if (!dynamicFrame)
+        return jsUndefined();
+
+    Page* page = frame->page();
+
+    String urlString = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+    AtomicString frameName = args.at(1).isUndefinedOrNull() ? "_blank" : AtomicString(args.at(1).toString(exec));
+
+    // Because FrameTree::find() returns true for empty strings, we must check for empty framenames.
+    // Otherwise, illegitimate window.open() calls with no name will pass right through the popup blocker.
+    if (!DOMWindow::allowPopUp(dynamicFrame) && (frameName.isEmpty() || !frame->tree()->find(frameName)))
+        return jsUndefined();
+
+    // Get the target frame for the special cases of _top and _parent.  In those
+    // cases, we can schedule a location change right now and return early.
+    bool topOrParent = false;
+    if (frameName == "_top") {
+        frame = frame->tree()->top();
+        topOrParent = true;
+    } else if (frameName == "_parent") {
+        if (Frame* parent = frame->tree()->parent())
+            frame = parent;
+        topOrParent = true;
+    }
+    if (topOrParent) {
+        if (!shouldAllowNavigation(exec, frame))
+            return jsUndefined();
+
+        String completedURL;
+        if (!urlString.isEmpty())
+            completedURL = completeURL(exec, urlString).string();
+
+        const JSDOMWindow* targetedWindow = toJSDOMWindow(frame);
+        if (!completedURL.isEmpty() && (!protocolIsJavaScript(completedURL) || (targetedWindow && targetedWindow->allowsAccessFrom(exec)))) {
+            bool userGesture = processingUserGesture(exec);
+
+            // For whatever reason, Firefox uses the dynamicGlobalObject to
+            // determine the outgoingReferrer.  We replicate that behavior
+            // here.
+            String referrer = dynamicFrame->loader()->outgoingReferrer();
+
+            frame->loader()->scheduleLocationChange(completedURL, referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+        }
+        return toJS(exec, frame->domWindow());
+    }
+
+    // In the case of a named frame or a new window, we'll use the createWindow() helper
+    WindowFeatures windowFeatures(valueToStringWithUndefinedOrNullCheck(exec, args.at(2)));
+    FloatRect windowRect(windowFeatures.xSet ? windowFeatures.x : 0, windowFeatures.ySet ? windowFeatures.y : 0,
+                         windowFeatures.widthSet ? windowFeatures.width : 0, windowFeatures.heightSet ? windowFeatures.height : 0);
+    DOMWindow::adjustWindowRect(screenAvailableRect(page ? page->mainFrame()->view() : 0), windowRect, windowRect);
+
+    windowFeatures.x = windowRect.x();
+    windowFeatures.y = windowRect.y();
+    windowFeatures.height = windowRect.height();
+    windowFeatures.width = windowRect.width();
+
+    frame = createWindow(exec, lexicalFrame, dynamicFrame, frame, urlString, frameName, windowFeatures, JSValue());
+
+    if (!frame)
         return jsUndefined();
-    ArgList argsTail;
-    args.getSlice(2, argsTail);
-    return jsNumber(exec, window->installTimeout(exec, v, argsTail, delay, timeout));
+
+    return toJS(exec, frame->domWindow());
 }
 
-JSValuePtr JSDOMWindow::setTimeout(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::showModalDialog(ExecState* exec, const ArgList& args)
 {
-    return setTimeoutOrInterval(exec, this, args, true);
+    Frame* frame = impl()->frame();
+    if (!frame)
+        return jsUndefined();
+    Frame* lexicalFrame = toLexicalFrame(exec);
+    if (!lexicalFrame)
+        return jsUndefined();
+    Frame* dynamicFrame = toDynamicFrame(exec);
+    if (!dynamicFrame)
+        return jsUndefined();
+
+    if (!DOMWindow::canShowModalDialogNow(frame) || !DOMWindow::allowPopUp(dynamicFrame))
+        return jsUndefined();
+
+    String url = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+    JSValue dialogArgs = args.at(1);
+    String featureArgs = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
+
+    HashMap<String, String> features;
+    DOMWindow::parseModalDialogFeatures(featureArgs, features);
+
+    const bool trusted = false;
+
+    // The following features from Microsoft's documentation are not implemented:
+    // - default font settings
+    // - width, height, left, and top specified in units other than "px"
+    // - edge (sunken or raised, default is raised)
+    // - dialogHide: trusted && boolFeature(features, "dialoghide"), makes dialog hide when you print
+    // - help: boolFeature(features, "help", true), makes help icon appear in dialog (what does it do on Windows?)
+    // - unadorned: trusted && boolFeature(features, "unadorned");
+
+    FloatRect screenRect = screenAvailableRect(frame->view());
+
+    WindowFeatures wargs;
+    wargs.width = WindowFeatures::floatFeature(features, "dialogwidth", 100, screenRect.width(), 620); // default here came from frame size of dialog in MacIE
+    wargs.widthSet = true;
+    wargs.height = WindowFeatures::floatFeature(features, "dialogheight", 100, screenRect.height(), 450); // default here came from frame size of dialog in MacIE
+    wargs.heightSet = true;
+
+    wargs.x = WindowFeatures::floatFeature(features, "dialogleft", screenRect.x(), screenRect.right() - wargs.width, -1);
+    wargs.xSet = wargs.x > 0;
+    wargs.y = WindowFeatures::floatFeature(features, "dialogtop", screenRect.y(), screenRect.bottom() - wargs.height, -1);
+    wargs.ySet = wargs.y > 0;
+
+    if (WindowFeatures::boolFeature(features, "center", true)) {
+        if (!wargs.xSet) {
+            wargs.x = screenRect.x() + (screenRect.width() - wargs.width) / 2;
+            wargs.xSet = true;
+        }
+        if (!wargs.ySet) {
+            wargs.y = screenRect.y() + (screenRect.height() - wargs.height) / 2;
+            wargs.ySet = true;
+        }
+    }
+
+    wargs.dialog = true;
+    wargs.resizable = WindowFeatures::boolFeature(features, "resizable");
+    wargs.scrollbarsVisible = WindowFeatures::boolFeature(features, "scroll", true);
+    wargs.statusBarVisible = WindowFeatures::boolFeature(features, "status", !trusted);
+    wargs.menuBarVisible = false;
+    wargs.toolBarVisible = false;
+    wargs.locationBarVisible = false;
+    wargs.fullscreen = false;
+
+    Frame* dialogFrame = createWindow(exec, lexicalFrame, dynamicFrame, frame, url, "", wargs, dialogArgs);
+    if (!dialogFrame)
+        return jsUndefined();
+
+    JSDOMWindow* dialogWindow = toJSDOMWindow(dialogFrame);
+    dialogFrame->page()->chrome()->runModal();
+
+    return dialogWindow->getDirect(Identifier(exec, "returnValue"));
 }
 
-JSValuePtr JSDOMWindow::clearTimeout(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::postMessage(ExecState* exec, const ArgList& args)
 {
-    removeTimeout(args.at(exec, 0)->toInt32(exec));
+    DOMWindow* window = impl();
+
+    DOMWindow* source = asJSDOMWindow(exec->lexicalGlobalObject())->impl();
+    String message = args.at(0).toString(exec);
+
+    if (exec->hadException())
+        return jsUndefined();
+
+    MessagePort* messagePort = (args.size() == 2) ? 0 : toMessagePort(args.at(1));
+
+    String targetOrigin = valueToStringWithUndefinedOrNullCheck(exec, args.at((args.size() == 2) ? 1 : 2));
+    if (exec->hadException())
+        return jsUndefined();
+
+    ExceptionCode ec = 0;
+    window->postMessage(message, messagePort, targetOrigin, source, ec);
+    setDOMException(exec, ec);
+
     return jsUndefined();
 }
 
-JSValuePtr JSDOMWindow::setInterval(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::setTimeout(ExecState* exec, const ArgList& args)
 {
-    return setTimeoutOrInterval(exec, this, args, false);
+    ScheduledAction* action = ScheduledAction::create(exec, args);
+    if (exec->hadException())
+        return jsUndefined();
+    int delay = args.at(1).toInt32(exec);
+    return jsNumber(exec, impl()->setTimeout(action, delay));
 }
 
-JSValuePtr JSDOMWindow::clearInterval(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::setInterval(ExecState* exec, const ArgList& args)
 {
-    removeTimeout(args.at(exec, 0)->toInt32(exec));
-    return jsUndefined();
+    ScheduledAction* action = ScheduledAction::create(exec, args);
+    if (exec->hadException())
+        return jsUndefined();
+    int delay = args.at(1).toInt32(exec);
+    return jsNumber(exec, impl()->setInterval(action, delay));
 }
 
-JSValuePtr JSDOMWindow::atob(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::atob(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
-    JSValuePtr v = args.at(exec, 0);
-    if (v->isNull())
+    JSValue v = args.at(0);
+    if (v.isNull())
         return jsEmptyString(exec);
 
-    UString s = v->toString(exec);
+    UString s = v.toString(exec);
     if (!s.is8Bit()) {
         setDOMException(exec, INVALID_CHARACTER_ERR);
         return jsUndefined();
@@ -237,16 +747,16 @@ JSValuePtr JSDOMWindow::atob(ExecState* exec, const ArgList& args)
     return jsString(exec, String(out.data(), out.size()));
 }
 
-JSValuePtr JSDOMWindow::btoa(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::btoa(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
-    JSValuePtr v = args.at(exec, 0);
-    if (v->isNull())
+    JSValue v = args.at(0);
+    if (v.isNull())
         return jsEmptyString(exec);
 
-    UString s = v->toString(exec);
+    UString s = v.toString(exec);
     if (!s.is8Bit()) {
         setDOMException(exec, INVALID_CHARACTER_ERR);
         return jsUndefined();
@@ -262,37 +772,33 @@ JSValuePtr JSDOMWindow::btoa(ExecState* exec, const ArgList& args)
     return jsString(exec, String(out.data(), out.size()));
 }
 
-JSValuePtr JSDOMWindow::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::addEventListener(ExecState* exec, const ArgList& args)
 {
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
 
-    if (RefPtr<JSEventListener> listener = findOrCreateJSEventListener(exec, args.at(exec, 1))) {
-        if (Document* doc = frame->document())
-            doc->addWindowEventListener(AtomicString(args.at(exec, 0)->toString(exec)), listener.release(), args.at(exec, 2)->toBoolean(exec));
-    }
+    if (RefPtr<JSEventListener> listener = findOrCreateJSEventListener(args.at(1)))
+        impl()->addEventListener(AtomicString(args.at(0).toString(exec)), listener.release(), args.at(2).toBoolean(exec));
 
     return jsUndefined();
 }
 
-JSValuePtr JSDOMWindow::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSDOMWindow::removeEventListener(ExecState* exec, const ArgList& args)
 {
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
 
-    if (JSEventListener* listener = findJSEventListener(args.at(exec, 1))) {
-        if (Document* doc = frame->document())
-            doc->removeWindowEventListener(AtomicString(args.at(exec, 0)->toString(exec)), listener, args.at(exec, 2)->toBoolean(exec));
-    }
+    if (JSEventListener* listener = findJSEventListener(args.at(1)))
+        impl()->removeEventListener(AtomicString(args.at(0).toString(exec)), listener, args.at(2).toBoolean(exec));
 
     return jsUndefined();
 }
 
-DOMWindow* toDOMWindow(JSValuePtr value)
+DOMWindow* toDOMWindow(JSValue value)
 {
-    if (!value->isObject())
+    if (!value.isObject())
         return 0;
     JSObject* object = asObject(value);
     if (object->inherits(&JSDOMWindow::s_info))
@@ -302,24 +808,4 @@ DOMWindow* toDOMWindow(JSValuePtr value)
     return 0;
 }
 
-JSValuePtr nonCachingStaticCloseFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
-{
-    return new (exec) PrototypeFunction(exec, 0, propertyName, jsDOMWindowPrototypeFunctionClose);
-}
-
-JSValuePtr nonCachingStaticBlurFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
-{
-    return new (exec) PrototypeFunction(exec, 0, propertyName, jsDOMWindowPrototypeFunctionBlur);
-}
-
-JSValuePtr nonCachingStaticFocusFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
-{
-    return new (exec) PrototypeFunction(exec, 0, propertyName, jsDOMWindowPrototypeFunctionFocus);
-}
-
-JSValuePtr nonCachingStaticPostMessageFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
-{
-    return new (exec) PrototypeFunction(exec, 2, propertyName, jsDOMWindowPrototypeFunctionPostMessage);
-}
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.h
index 838abab..a0e1b8f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowCustom.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2008 Apple Inc. All rights reseved.
+ *  Copyright (C) 2008, 2009 Apple Inc. All rights reseved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -35,119 +35,6 @@ inline const JSDOMWindow* asJSDOMWindow(const JSC::JSGlobalObject* globalObject)
     return static_cast<const JSDOMWindow*>(globalObject);
 }
 
-JSC::JSValuePtr nonCachingStaticCloseFunctionGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr nonCachingStaticBlurFunctionGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr nonCachingStaticFocusFunctionGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr nonCachingStaticPostMessageFunctionGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-
-ALWAYS_INLINE bool JSDOMWindow::customGetOwnPropertySlot(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertySlot& slot)
-{
-    // When accessing a Window cross-domain, functions are always the native built-in ones, and they
-    // are not affected by properties changed on the Window or anything in its prototype chain.
-    // This is consistent with the behavior of Firefox.
-
-    const JSC::HashEntry* entry;
-
-    // We don't want any properties other than "close" and "closed" on a closed window.
-    if (!impl()->frame()) {
-        // The following code is safe for cross-domain and same domain use.
-        // It ignores any custom properties that might be set on the DOMWindow (including a custom prototype).
-        entry = s_info.propHashTable(exec)->entry(exec, propertyName);
-        if (entry && !(entry->attributes() & JSC::Function) && entry->propertyGetter() == jsDOMWindowClosed) {
-            slot.setCustom(this, entry->propertyGetter());
-            return true;
-        }
-        entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
-        if (entry && (entry->attributes() & JSC::Function) && entry->function() == jsDOMWindowPrototypeFunctionClose) {
-            slot.setCustom(this, nonCachingStaticCloseFunctionGetter);
-            return true;
-        }
-
-        // FIXME: We should have a message here that explains why the property access/function call was
-        // not allowed. 
-        slot.setUndefined();
-        return true;
-    }
-
-    // We need to check for cross-domain access here without printing the generic warning message
-    // because we always allow access to some function, just different ones depending whether access
-    // is allowed.
-    bool allowsAccess = allowsAccessFromNoErrorMessage(exec);
-
-    // Look for overrides before looking at any of our own properties.
-    if (JSGlobalObject::getOwnPropertySlot(exec, propertyName, slot)) {
-        // But ignore overrides completely if this is cross-domain access.
-        if (allowsAccess)
-            return true;
-    }
-
-    // We need this code here because otherwise JSC::Window will stop the search before we even get to the
-    // prototype due to the blanket same origin (allowsAccessFrom) check at the end of getOwnPropertySlot.
-    // Also, it's important to get the implementation straight out of the DOMWindow prototype regardless of
-    // what prototype is actually set on this object.
-    entry = JSDOMWindowPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
-    if (entry) {
-        if (entry->attributes() & JSC::Function) {
-            if (entry->function() == jsDOMWindowPrototypeFunctionBlur) {
-                if (!allowsAccess) {
-                    slot.setCustom(this, nonCachingStaticBlurFunctionGetter);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionClose) {
-                if (!allowsAccess) {
-                    slot.setCustom(this, nonCachingStaticCloseFunctionGetter);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionFocus) {
-                if (!allowsAccess) {
-                    slot.setCustom(this, nonCachingStaticFocusFunctionGetter);
-                    return true;
-                }
-            } else if (entry->function() == jsDOMWindowPrototypeFunctionPostMessage) {
-                if (!allowsAccess) {
-                    slot.setCustom(this, nonCachingStaticPostMessageFunctionGetter);
-                    return true;
-                }
-            }
-        }
-    } else {
-        // Allow access to toString() cross-domain, but always Object.prototype.toString.
-        if (propertyName == exec->propertyNames().toString) {
-            if (!allowsAccess) {
-                slot.setCustom(this, objectToStringFunctionGetter);
-                return true;
-            }
-        }
-    }
-
-    return false;
-}
-
-inline bool JSDOMWindow::customPut(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::JSValuePtr value, JSC::PutPropertySlot& slot)
-{
-    if (!impl()->frame())
-        return true;
-
-    // We have a local override (e.g. "var location"), save time and jump directly to JSGlobalObject.
-    JSC::PropertySlot getSlot;
-    bool slotIsWriteable;
-    if (JSGlobalObject::getOwnPropertySlot(exec, propertyName, getSlot, slotIsWriteable)) {
-        if (allowsAccessFrom(exec)) {
-            if (slotIsWriteable) {
-                getSlot.putValue(value);
-                if (getSlot.isCacheable())
-                    slot.setExistingProperty(this, getSlot.cachedOffset());
-            } else
-                JSGlobalObject::put(exec, propertyName, value, slot);
-        }
-        return true;
-    }
-
-    return false;
-}
-
-
-
 inline bool JSDOMWindowBase::allowsAccessFrom(const JSGlobalObject* other) const
 {
     if (allowsAccessFromPrivate(other))
@@ -156,7 +43,7 @@ inline bool JSDOMWindowBase::allowsAccessFrom(const JSGlobalObject* other) const
     return false;
 }
 
-    inline bool JSDOMWindowBase::allowsAccessFrom(JSC::ExecState* exec) const
+inline bool JSDOMWindowBase::allowsAccessFrom(JSC::ExecState* exec) const
 {
     if (allowsAccessFromPrivate(exec->lexicalGlobalObject()))
         return true;
@@ -185,12 +72,6 @@ ALWAYS_INLINE bool JSDOMWindowBase::allowsAccessFromPrivate(const JSGlobalObject
     if (originWindow == targetWindow)
         return true;
 
-    // JS may be attempting to access the "window" object, which should be valid,
-    // even if the document hasn't been constructed yet.  If the document doesn't
-    // exist yet allow JS to access the window object.
-    if (!originWindow->impl()->document())
-        return true;
-
     const SecurityOrigin* originSecurityOrigin = originWindow->impl()->securityOrigin();
     const SecurityOrigin* targetSecurityOrigin = targetWindow->impl()->securityOrigin();
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
index d54611e..1bf478b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.cpp
@@ -39,7 +39,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDOMWindowShell)
+ASSERT_CLASS_FITS_IN_CELL(JSDOMWindowShell);
 
 const ClassInfo JSDOMWindowShell::s_info = { "JSDOMWindowShell", 0, 0, 0 };
 
@@ -54,11 +54,17 @@ JSDOMWindowShell::~JSDOMWindowShell()
 {
 }
 
-void JSDOMWindowShell::setWindow(PassRefPtr<DOMWindow> window)
+void JSDOMWindowShell::setWindow(PassRefPtr<DOMWindow> domWindow)
 {
+    // Explicitly protect the global object's prototype so it isn't collected
+    // when we allocate the global object. (Once the global object is fully
+    // constructed, it can mark its own prototype.)
     RefPtr<Structure> prototypeStructure = JSDOMWindowPrototype::createStructure(jsNull());
-    RefPtr<Structure> structure = JSDOMWindow::createStructure(new JSDOMWindowPrototype(prototypeStructure.release()));
-    setWindow(new (JSDOMWindow::commonJSGlobalData()) JSDOMWindow(structure.release(), window, this));
+    ProtectedPtr<JSDOMWindowPrototype> prototype = new JSDOMWindowPrototype(prototypeStructure.release());
+
+    RefPtr<Structure> structure = JSDOMWindow::createStructure(prototype);
+    JSDOMWindow* jsDOMWindow = new (JSDOMWindow::commonJSGlobalData()) JSDOMWindow(structure.release(), domWindow, this);
+    setWindow(jsDOMWindow);
 }
 
 // ----
@@ -82,12 +88,12 @@ bool JSDOMWindowShell::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return m_window->getOwnPropertySlot(exec, propertyName, slot);
 }
 
-void JSDOMWindowShell::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSDOMWindowShell::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     m_window->put(exec, propertyName, value, slot);
 }
 
-void JSDOMWindowShell::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValuePtr value, unsigned attributes)
+void JSDOMWindowShell::putWithAttributes(ExecState* exec, const Identifier& propertyName, JSValue value, unsigned attributes)
 {
     m_window->putWithAttributes(exec, propertyName, value, attributes);
 }
@@ -117,12 +123,12 @@ void JSDOMWindowShell::defineSetter(ExecState* exec, const Identifier& propertyN
     m_window->defineSetter(exec, propertyName, setterFunction);
 }
 
-JSValuePtr JSDOMWindowShell::lookupGetter(ExecState* exec, const Identifier& propertyName)
+JSValue JSDOMWindowShell::lookupGetter(ExecState* exec, const Identifier& propertyName)
 {
     return m_window->lookupGetter(exec, propertyName);
 }
 
-JSValuePtr JSDOMWindowShell::lookupSetter(ExecState* exec, const Identifier& propertyName)
+JSValue JSDOMWindowShell::lookupSetter(ExecState* exec, const Identifier& propertyName)
 {
     return m_window->lookupSetter(exec, propertyName);
 }
@@ -141,16 +147,6 @@ DOMWindow* JSDOMWindowShell::impl() const
     return m_window->impl();
 }
 
-void JSDOMWindowShell::disconnectFrame()
-{
-    m_window->disconnectFrame();
-}
-
-void JSDOMWindowShell::clear()
-{
-    m_window->clear();
-}
-
 void* JSDOMWindowShell::operator new(size_t size)
 {
     return JSDOMWindow::commonJSGlobalData()->heap.allocate(size);
@@ -160,7 +156,7 @@ void* JSDOMWindowShell::operator new(size_t size)
 // Conversion methods
 // ----
 
-JSValuePtr toJS(ExecState*, Frame* frame)
+JSValue toJS(ExecState*, Frame* frame)
 {
     if (!frame)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
index 931a256..6f21892 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDOMWindowShell.h
@@ -55,12 +55,10 @@ namespace WebCore {
         static const JSC::ClassInfo s_info;
 
         DOMWindow* impl() const;
-        void disconnectFrame();
-        void clear();
 
         void* operator new(size_t);
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype) 
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype) 
         {
             return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType)); 
         }
@@ -69,22 +67,22 @@ namespace WebCore {
         virtual void mark();
         virtual JSC::UString className() const;
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-        virtual void putWithAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, unsigned attributes);
+        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+        virtual void putWithAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, unsigned attributes);
         virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier& propertyName);
         virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
         virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier& propertyName, unsigned& attributes) const;
         virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);
         virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction);
-        virtual JSC::JSValuePtr lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);
-        virtual JSC::JSValuePtr lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);
+        virtual JSC::JSValue lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);
+        virtual JSC::JSValue lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);
         virtual JSC::JSObject* unwrappedObject();
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 
         JSDOMWindow* m_window;
     };
 
-    JSC::JSValuePtr toJS(JSC::ExecState*, Frame*);
+    JSC::JSValue toJS(JSC::ExecState*, Frame*);
     JSDOMWindowShell* toJSDOMWindowShell(Frame*);
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridColumnListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridColumnListCustom.cpp
new file mode 100644
index 0000000..af49df4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridColumnListCustom.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSDataGridColumnList.h"
+
+#include "AtomicString.h"
+#include "DataGridColumn.h"
+#include "DataGridColumnList.h"
+#include "JSDataGridColumn.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+bool JSDataGridColumnList::canGetItemsForName(ExecState*, DataGridColumnList* impl, const Identifier& propertyName)
+{
+    return impl->itemWithName(propertyName);
+}
+
+JSValue JSDataGridColumnList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+{
+    JSDataGridColumnList* thisObj = static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()));
+    return toJS(exec, thisObj->impl()->itemWithName(propertyName));
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridDataSource.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridDataSource.cpp
new file mode 100644
index 0000000..e75b10b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridDataSource.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSDataGridDataSource.h"
+
+#include "Document.h"
+#include "Frame.h"
+#include "HTMLDataGridElement.h"
+#include "JSHTMLDataGridElement.h"
+#include "JSDOMWindowBase.h"
+#include <runtime/JSLock.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSDataGridDataSource::JSDataGridDataSource(JSC::JSValue dataSource, Frame* frame)
+    : m_dataSource(dataSource)
+    , m_frame(frame)
+{
+}
+
+JSDataGridDataSource::~JSDataGridDataSource()
+{
+}
+
+void JSDataGridDataSource::initialize(HTMLDataGridElement* datagrid)
+{
+    if (!m_frame->script()->isEnabled())
+        return;
+
+    JSLock lock(false);
+    RefPtr<JSDataGridDataSource> protect(this);
+
+    ExecState* exec = m_frame->script()->globalObject()->globalExec();
+
+    if (!jsDataSource().isObject())
+        return;
+
+    JSValue initializeFunction = jsDataSource().get(exec, Identifier(exec, "initialize"));
+    CallData callData;
+    CallType callType = initializeFunction.getCallData(callData);
+    if (callType == CallTypeNone)
+        return;
+
+    MarkedArgumentBuffer args;
+    args.append(toJS(exec, datagrid));
+
+    JSDOMWindowBase::commonJSGlobalData()->timeoutChecker.start();
+    call(exec, initializeFunction, callType, callData, m_dataSource, args);
+    JSDOMWindowBase::commonJSGlobalData()->timeoutChecker.stop();
+
+    if (exec->hadException())
+        reportCurrentException(exec);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridDataSource.h b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridDataSource.h
new file mode 100644
index 0000000..2537b00
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDataGridDataSource.h
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSDataGridDataSource_h
+#define JSDataGridDataSource_h
+
+#include "DataGridDataSource.h"
+#include <runtime/JSValue.h>
+#include <runtime/Protect.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class Frame;
+class HTMLDataGridElement;
+
+class JSDataGridDataSource : public DataGridDataSource {
+public:
+    static PassRefPtr<JSDataGridDataSource> create(JSC::JSValue dataSource, Frame* frame)
+    {
+        return adoptRef(new JSDataGridDataSource(dataSource, frame));
+    }
+
+    virtual ~JSDataGridDataSource();
+
+    virtual bool isJSDataGridDataSource() const { return true; }
+    JSC::JSValue jsDataSource() const { return m_dataSource.get(); }
+
+    virtual void initialize(HTMLDataGridElement*);
+
+private:
+    JSDataGridDataSource(JSC::JSValue, Frame*);
+
+    JSC::ProtectedJSValue m_dataSource;
+    RefPtr<Frame> m_frame;
+};
+
+inline JSDataGridDataSource* asJSDataGridDataSource(DataGridDataSource* dataSource)
+{
+    ASSERT(dataSource->isJSDataGridDataSource());
+    return static_cast<JSDataGridDataSource*>(dataSource);
+}
+
+inline const JSDataGridDataSource* asJSDataGridDataSource(const DataGridDataSource* dataSource)
+{
+    ASSERT(dataSource->isJSDataGridDataSource());
+    return static_cast<const JSDataGridDataSource*>(dataSource);
+}
+
+} // namespace WebCore
+
+#endif // JSDataGridDataSource_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCustom.cpp
index 68639d5..af3b066 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDatabaseCustom.cpp
@@ -29,6 +29,8 @@
 #include "config.h"
 #include "JSDatabase.h"
 
+#if ENABLE(DATABASE)
+
 #include "DOMWindow.h"
 #include "Database.h"
 #include "Document.h"
@@ -45,17 +47,17 @@ namespace WebCore {
 
 using namespace JSC;
 
-JSValuePtr JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
+JSValue JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
 {
-    String oldVersion = args.at(exec, 0)->toString(exec);
-    String newVersion = args.at(exec, 1)->toString(exec);
+    String oldVersion = args.at(0).toString(exec);
+    String newVersion = args.at(1).toString(exec);
 
     Frame* frame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
     if (!frame)
         return jsUndefined();
     
-    JSObject *object;
-    if (!(object = args.at(exec, 2)->getObject())) {
+    JSObject* object;
+    if (!(object = args.at(2).getObject())) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
     }
@@ -63,8 +65,8 @@ JSValuePtr JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
     RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, frame));
     
     RefPtr<SQLTransactionErrorCallback> errorCallback;
-    if (!args.at(exec, 3)->isNull()) {
-        if (!(object = args.at(exec, 3)->getObject())) {
+    if (!args.at(3).isNull()) {
+        if (!(object = args.at(3).getObject())) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
         }
@@ -73,8 +75,8 @@ JSValuePtr JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
     }
     
     RefPtr<VoidCallback> successCallback;
-    if (!args.at(exec, 4)->isNull()) {
-        successCallback = toVoidCallback(exec, args.at(exec, 4));
+    if (!args.at(4).isNull()) {
+        successCallback = toVoidCallback(exec, args.at(4));
         if (!successCallback) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
@@ -86,11 +88,11 @@ JSValuePtr JSDatabase::changeVersion(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSDatabase::transaction(ExecState* exec, const ArgList& args)
+JSValue JSDatabase::transaction(ExecState* exec, const ArgList& args)
 {
     JSObject* object;
     
-    if (!(object = args.at(exec, 0)->getObject())) {
+    if (!(object = args.at(0).getObject())) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
     }        
@@ -102,8 +104,8 @@ JSValuePtr JSDatabase::transaction(ExecState* exec, const ArgList& args)
     RefPtr<SQLTransactionCallback> callback(JSCustomSQLTransactionCallback::create(object, frame));
     RefPtr<SQLTransactionErrorCallback> errorCallback;
     
-    if (args.size() > 1 && !args.at(exec, 1)->isNull()) {
-        if (!(object = args.at(exec, 1)->getObject())) {
+    if (args.size() > 1 && !args.at(1).isNull()) {
+        if (!(object = args.at(1).getObject())) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
         }
@@ -112,8 +114,8 @@ JSValuePtr JSDatabase::transaction(ExecState* exec, const ArgList& args)
     }
 
     RefPtr<VoidCallback> successCallback;
-    if (args.size() > 2 && !args.at(exec, 2)->isNull()) {
-        successCallback = toVoidCallback(exec, args.at(exec, 2));
+    if (args.size() > 2 && !args.at(2).isNull()) {
+        successCallback = toVoidCallback(exec, args.at(2));
         if (!successCallback) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
@@ -126,3 +128,4 @@ JSValuePtr JSDatabase::transaction(ExecState* exec, const ArgList& args)
 }
     
 }
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
index f292b38..956327a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -20,7 +20,6 @@
 #include "config.h"
 #include "JSDocument.h"
 
-#include "DOMWindow.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
@@ -28,9 +27,7 @@
 #include "JSDOMWindowCustom.h"
 #include "JSHTMLDocument.h"
 #include "JSLocation.h"
-#include "JSNodeList.h"
 #include "Location.h"
-#include "NodeList.h"
 #include "ScriptController.h"
 
 #if ENABLE(SVG)
@@ -44,27 +41,34 @@ namespace WebCore {
 
 void JSDocument::mark()
 {
-    JSEventTargetNode::mark();
+    JSNode::mark();
     markDOMNodesForDocument(impl());
     markActiveObjectsForContext(*Heap::heap(this)->globalData(), impl());
 }
 
-JSValuePtr JSDocument::location(ExecState* exec) const
+JSValue JSDocument::location(ExecState* exec) const
 {
     Frame* frame = static_cast<Document*>(impl())->frame();
     if (!frame)
         return jsNull();
 
-    return toJS(exec, frame->domWindow()->location());
+    Location* location = frame->domWindow()->location();
+    if (DOMObject* wrapper = getCachedDOMObjectWrapper(exec->globalData(), location))
+        return wrapper;
+
+    JSDOMWindow* window = static_cast<JSDOMWindow*>(exec->lexicalGlobalObject());
+    JSLocation* jsLocation = new (exec) JSLocation(getDOMStructure<JSLocation>(exec, window), location);
+    cacheDOMObjectWrapper(exec->globalData(), location, jsLocation);
+    return jsLocation;
 }
 
-void JSDocument::setLocation(ExecState* exec, JSValuePtr value)
+void JSDocument::setLocation(ExecState* exec, JSValue value)
 {
     Frame* frame = static_cast<Document*>(impl())->frame();
     if (!frame)
         return;
 
-    String str = value->toString(exec);
+    String str = value.toString(exec);
 
     // IE and Mozilla both resolve the URL relative to the source frame,
     // not the target frame.
@@ -73,10 +77,10 @@ void JSDocument::setLocation(ExecState* exec, JSValuePtr value)
         str = activeFrame->document()->completeURL(str).string();
 
     bool userGesture = activeFrame->script()->processingUserGesture();
-    frame->loader()->scheduleLocationChange(str, activeFrame->loader()->outgoingReferrer(), false, userGesture);
+    frame->loader()->scheduleLocationChange(str, activeFrame->loader()->outgoingReferrer(), !activeFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
 }
 
-JSValuePtr toJS(ExecState* exec, Document* document)
+JSValue toJS(ExecState* exec, Document* document)
 {
     if (!document)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
index 3effe85..b12c185 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSElementCustom.cpp
@@ -53,7 +53,7 @@ using namespace HTMLNames;
 
 static inline bool allowSettingSrcToJavascriptURL(ExecState* exec, Element* element, const String& name, const String& value)
 {
-    if ((element->hasTagName(iframeTag) || element->hasTagName(frameTag)) && equalIgnoringCase(name, "src") && protocolIs(parseURL(value), "javascript")) {
+    if ((element->hasTagName(iframeTag) || element->hasTagName(frameTag)) && equalIgnoringCase(name, "src") && protocolIsJavaScript(parseURL(value))) {
         HTMLFrameElementBase* frame = static_cast<HTMLFrameElementBase*>(element);
         if (!checkNodeSecurity(exec, frame->contentDocument()))
             return false;
@@ -61,11 +61,11 @@ static inline bool allowSettingSrcToJavascriptURL(ExecState* exec, Element* elem
     return true;
 } 
 
-JSValuePtr JSElement::setAttribute(ExecState* exec, const ArgList& args)
+JSValue JSElement::setAttribute(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    AtomicString name = args.at(exec, 0)->toString(exec);
-    AtomicString value = args.at(exec, 1)->toString(exec);
+    AtomicString name = args.at(0).toString(exec);
+    AtomicString value = args.at(1).toString(exec);
 
     Element* imp = impl();
     if (!allowSettingSrcToJavascriptURL(exec, imp, name, value))
@@ -76,10 +76,10 @@ JSValuePtr JSElement::setAttribute(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSElement::setAttributeNode(ExecState* exec, const ArgList& args)
+JSValue JSElement::setAttributeNode(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    Attr* newAttr = toAttr(args.at(exec, 0));
+    Attr* newAttr = toAttr(args.at(0));
     if (!newAttr) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -89,17 +89,17 @@ JSValuePtr JSElement::setAttributeNode(ExecState* exec, const ArgList& args)
     if (!allowSettingSrcToJavascriptURL(exec, imp, newAttr->name(), newAttr->value()))
         return jsUndefined();
 
-    JSValuePtr result = toJS(exec, WTF::getPtr(imp->setAttributeNode(newAttr, ec)));
+    JSValue result = toJS(exec, WTF::getPtr(imp->setAttributeNode(newAttr, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr JSElement::setAttributeNS(ExecState* exec, const ArgList& args)
+JSValue JSElement::setAttributeNS(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    AtomicString namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    AtomicString qualifiedName = args.at(exec, 1)->toString(exec);
-    AtomicString value = args.at(exec, 2)->toString(exec);
+    AtomicString namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    AtomicString qualifiedName = args.at(1).toString(exec);
+    AtomicString value = args.at(2).toString(exec);
 
     Element* imp = impl();
     if (!allowSettingSrcToJavascriptURL(exec, imp, qualifiedName, value))
@@ -110,10 +110,10 @@ JSValuePtr JSElement::setAttributeNS(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSElement::setAttributeNodeNS(ExecState* exec, const ArgList& args)
+JSValue JSElement::setAttributeNodeNS(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    Attr* newAttr = toAttr(args.at(exec, 0));
+    Attr* newAttr = toAttr(args.at(0));
     if (!newAttr) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -123,12 +123,12 @@ JSValuePtr JSElement::setAttributeNodeNS(ExecState* exec, const ArgList& args)
     if (!allowSettingSrcToJavascriptURL(exec, imp, newAttr->name(), newAttr->value()))
         return jsUndefined();
 
-    JSValuePtr result = toJS(exec, WTF::getPtr(imp->setAttributeNodeNS(newAttr, ec)));
+    JSValue result = toJS(exec, WTF::getPtr(imp->setAttributeNodeNS(newAttr, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr toJSNewlyCreated(ExecState* exec, Element* element)
+JSValue toJSNewlyCreated(ExecState* exec, Element* element)
 {
     if (!element)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
index 1c59f9d..03b97d8 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventCustom.cpp
@@ -72,12 +72,12 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSEvent::clipboardData(ExecState* exec) const
+JSValue JSEvent::clipboardData(ExecState* exec) const
 {
     return impl()->isClipboardEvent() ? toJS(exec, impl()->clipboardData()) : jsUndefined();
 }
 
-JSValuePtr toJS(ExecState* exec, Event* event)
+JSValue toJS(ExecState* exec, Event* event)
 {
     JSLock lock(false);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
index f84e537..b9ed685 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.cpp
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All Rights Reserved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All Rights Reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -20,19 +20,10 @@
 #include "config.h"
 #include "JSEventListener.h"
 
-#include "CString.h"
-#include "Console.h"
-#include "DOMWindow.h"
-#include "Document.h"
 #include "Event.h"
 #include "Frame.h"
-#include "FrameLoader.h"
-#include "JSDOMWindow.h"
 #include "JSEvent.h"
 #include "JSEventTarget.h"
-#include "JSEventTargetNode.h"
-#include "ScriptController.h"
-#include <runtime/FunctionConstructor.h>
 #include <runtime/JSLock.h>
 #include <wtf/RefCountedLeakCounter.h>
 
@@ -40,17 +31,43 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSAbstractEventListener)
+JSEventListener::JSEventListener(JSObject* function, JSDOMGlobalObject* globalObject, bool isAttribute)
+    : m_jsFunction(function)
+    , m_globalObject(globalObject)
+    , m_isAttribute(isAttribute)
+{
+    if (!m_isAttribute && m_jsFunction)
+        globalObject->jsEventListeners().set(m_jsFunction, this);
+}
+
+JSEventListener::~JSEventListener()
+{
+    if (!m_isAttribute && m_jsFunction && m_globalObject)
+        m_globalObject->jsEventListeners().remove(m_jsFunction);
+}
+
+JSObject* JSEventListener::jsFunction() const
+{
+    return m_jsFunction;
+}
+
+void JSEventListener::markJSFunction()
+{
+    if (m_jsFunction && !m_jsFunction->marked())
+        m_jsFunction->mark();
+    if (m_globalObject && !m_globalObject->marked())
+        m_globalObject->mark();
+}
 
-void JSAbstractEventListener::handleEvent(Event* event, bool isWindowEvent)
+void JSEventListener::handleEvent(Event* event, bool isWindowEvent)
 {
     JSLock lock(false);
 
-    JSObject* listener = listenerObj();
-    if (!listener)
+    JSObject* jsFunction = this->jsFunction();
+    if (!jsFunction)
         return;
 
-    JSDOMGlobalObject* globalObject = this->globalObject();
+    JSDOMGlobalObject* globalObject = m_globalObject;
     // Null check as clearGlobalObject() can clear this and we still get called back by
     // xmlhttprequest objects. See http://bugs.webkit.org/show_bug.cgi?id=13275
     // FIXME: Is this check still necessary? Requests are supposed to be stopped before clearGlobalObject() is called.
@@ -78,18 +95,18 @@ void JSAbstractEventListener::handleEvent(Event* event, bool isWindowEvent)
 
     ExecState* exec = globalObject->globalExec();
 
-    JSValuePtr handleEventFunction = listener->get(exec, Identifier(exec, "handleEvent"));
+    JSValue handleEventFunction = jsFunction->get(exec, Identifier(exec, "handleEvent"));
     CallData callData;
-    CallType callType = handleEventFunction->getCallData(callData);
+    CallType callType = handleEventFunction.getCallData(callData);
     if (callType == CallTypeNone) {
-        handleEventFunction = noValue();
-        callType = listener->getCallData(callData);
+        handleEventFunction = JSValue();
+        callType = jsFunction->getCallData(callData);
     }
 
     if (callType != CallTypeNone) {
         ref();
 
-        ArgList args;
+        MarkedArgumentBuffer args;
         args.append(toJS(exec, event));
 
         Event* savedEvent = globalObject->currentEvent();
@@ -101,240 +118,44 @@ void JSAbstractEventListener::handleEvent(Event* event, bool isWindowEvent)
         JSGlobalData* globalData = globalObject->globalData();
         DynamicGlobalObjectScope globalObjectScope(exec, globalData->dynamicGlobalObject ? globalData->dynamicGlobalObject : globalObject);
 
-        JSValuePtr retval;
+        JSValue retval;
         if (handleEventFunction) {
-            globalObject->startTimeoutCheck();
-            retval = call(exec, handleEventFunction, callType, callData, listener, args);
+            globalObject->globalData()->timeoutChecker.start();
+            retval = call(exec, handleEventFunction, callType, callData, jsFunction, args);
         } else {
-            JSValuePtr thisValue;
+            JSValue thisValue;
             if (isWindowEvent)
                 thisValue = globalObject->toThisObject(exec);
             else
                 thisValue = toJS(exec, event->currentTarget());
-            globalObject->startTimeoutCheck();
-            retval = call(exec, listener, callType, callData, thisValue, args);
+            globalObject->globalData()->timeoutChecker.start();
+            retval = call(exec, jsFunction, callType, callData, thisValue, args);
         }
-        globalObject->stopTimeoutCheck();
+        globalObject->globalData()->timeoutChecker.stop();
 
         globalObject->setCurrentEvent(savedEvent);
 
         if (exec->hadException())
             reportCurrentException(exec);
         else {
-            if (!retval->isUndefinedOrNull() && event->storesResultAsString())
-                event->storeResult(retval->toString(exec));
-            if (m_isInline) {
+            if (!retval.isUndefinedOrNull() && event->storesResultAsString())
+                event->storeResult(retval.toString(exec));
+            if (m_isAttribute) {
                 bool retvalbool;
-                if (retval->getBoolean(retvalbool) && !retvalbool)
+                if (retval.getBoolean(retvalbool) && !retvalbool)
                     event->preventDefault();
             }
         }
 
         if (scriptExecutionContext->isDocument())
-            Document::updateDocumentsRendering();
+            Document::updateStyleForAllDocuments();
         deref();
     }
 }
 
-bool JSAbstractEventListener::isInline() const
-{
-    return m_isInline;
-}
-
-// -------------------------------------------------------------------------
-
-JSUnprotectedEventListener::JSUnprotectedEventListener(JSObject* listener, JSDOMGlobalObject* globalObject, bool isInline)
-    : JSAbstractEventListener(isInline)
-    , m_listener(listener)
-    , m_globalObject(globalObject)
-{
-    if (m_listener) {
-        JSDOMWindow::UnprotectedListenersMap& listeners = isInline
-            ? globalObject->jsUnprotectedInlineEventListeners() : globalObject->jsUnprotectedEventListeners();
-        listeners.set(m_listener, this);
-    }
-}
-
-JSUnprotectedEventListener::~JSUnprotectedEventListener()
+bool JSEventListener::virtualisAttribute() const
 {
-    if (m_listener && m_globalObject) {
-        JSDOMWindow::UnprotectedListenersMap& listeners = isInline()
-            ? m_globalObject->jsUnprotectedInlineEventListeners() : m_globalObject->jsUnprotectedEventListeners();
-        listeners.remove(m_listener);
-    }
-}
-
-JSObject* JSUnprotectedEventListener::listenerObj() const
-{
-    return m_listener;
-}
-
-JSDOMGlobalObject* JSUnprotectedEventListener::globalObject() const
-{
-    return m_globalObject;
-}
-
-void JSUnprotectedEventListener::clearGlobalObject()
-{
-    m_globalObject = 0;
-}
-
-void JSUnprotectedEventListener::mark()
-{
-    if (m_listener && !m_listener->marked())
-        m_listener->mark();
-}
-
-#ifndef NDEBUG
-static WTF::RefCountedLeakCounter eventListenerCounter("EventListener");
-#endif
-
-// -------------------------------------------------------------------------
-
-JSEventListener::JSEventListener(JSObject* listener, JSDOMGlobalObject* globalObject, bool isInline)
-    : JSAbstractEventListener(isInline)
-    , m_listener(listener)
-    , m_globalObject(globalObject)
-{
-    if (m_listener) {
-        JSDOMWindow::ListenersMap& listeners = isInline
-            ? m_globalObject->jsInlineEventListeners() : m_globalObject->jsEventListeners();
-        listeners.set(m_listener, this);
-    }
-#ifndef NDEBUG
-    eventListenerCounter.increment();
-#endif
-}
-
-JSEventListener::~JSEventListener()
-{
-    if (m_listener && m_globalObject) {
-        JSDOMWindow::ListenersMap& listeners = isInline()
-            ? m_globalObject->jsInlineEventListeners() : m_globalObject->jsEventListeners();
-        listeners.remove(m_listener);
-    }
-#ifndef NDEBUG
-    eventListenerCounter.decrement();
-#endif
-}
-
-JSObject* JSEventListener::listenerObj() const
-{
-    return m_listener;
-}
-
-JSDOMGlobalObject* JSEventListener::globalObject() const
-{
-    return m_globalObject;
-}
-
-void JSEventListener::clearGlobalObject()
-{
-    m_globalObject = 0;
-}
-
-// -------------------------------------------------------------------------
-
-JSLazyEventListener::JSLazyEventListener(LazyEventListenerType type, const String& functionName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
-    : JSEventListener(0, globalObject, true)
-    , m_functionName(functionName)
-    , m_code(code)
-    , m_parsed(false)
-    , m_lineNumber(lineNumber)
-    , m_originalNode(node)
-    , m_type(type)
-{
-    // We don't retain the original node because we assume it
-    // will stay alive as long as this handler object is around
-    // and we need to avoid a reference cycle. If JS transfers
-    // this handler to another node, parseCode will be called and
-    // then originalNode is no longer needed.
-
-    // A JSLazyEventListener can be created with a line number of zero when it is created with
-    // a setAttribute call from JavaScript, so make the line number 1 in that case.
-    if (m_lineNumber == 0)
-        m_lineNumber = 1;
-}
-
-JSObject* JSLazyEventListener::listenerObj() const
-{
-    parseCode();
-    return m_listener;
-}
-
-// Helper function
-inline JSValuePtr eventParameterName(JSLazyEventListener::LazyEventListenerType type, ExecState* exec)
-{
-    switch (type) {
-    case JSLazyEventListener::HTMLLazyEventListener:
-        return jsNontrivialString(exec, "event");
-#if ENABLE(SVG)
-    case JSLazyEventListener::SVGLazyEventListener:
-        return jsNontrivialString(exec, "evt");
-#endif
-    default:
-        ASSERT_NOT_REACHED();
-        return jsUndefined();
-    }
-}
-
-void JSLazyEventListener::parseCode() const
-{
-    if (m_parsed)
-        return;
-
-    if (globalObject()->scriptExecutionContext()->isDocument()) {
-        JSDOMWindow* window = static_cast<JSDOMWindow*>(globalObject());
-        Frame* frame = window->impl()->frame();
-        if (!frame)
-            return;
-        // FIXME: Is this check needed for non-Document contexts?
-        ScriptController* script = frame->script();
-        if (!script->isEnabled() || script->isPaused())
-            return;
-    }
-
-    m_parsed = true;
-
-    ExecState* exec = globalObject()->globalExec();
-
-    ArgList args;
-    UString sourceURL(globalObject()->scriptExecutionContext()->url().string());
-    args.append(eventParameterName(m_type, exec));
-    args.append(jsString(exec, m_code));
-
-    // FIXME: Passing the document's URL to construct is not always correct, since this event listener might
-    // have been added with setAttribute from a script, and we should pass String() in that case.
-    m_listener = constructFunction(exec, args, Identifier(exec, m_functionName), sourceURL, m_lineNumber); // FIXME: is globalExec ok?
-
-    JSFunction* listenerAsFunction = static_cast<JSFunction*>(m_listener.get());
-
-    if (exec->hadException()) {
-        exec->clearException();
-
-        // failed to parse, so let's just make this listener a no-op
-        m_listener = 0;
-    } else if (m_originalNode) {
-        // Add the event's home element to the scope
-        // (and the document, and the form - see JSHTMLElement::eventHandlerScope)
-        ScopeChain scope = listenerAsFunction->scope();
-
-        JSValuePtr thisObj = toJS(exec, m_originalNode);
-        if (thisObj->isObject()) {
-            static_cast<JSEventTargetNode*>(asObject(thisObj))->pushEventHandlerScope(exec, scope);
-            listenerAsFunction->setScope(scope);
-        }
-    }
-
-    // no more need to keep the unparsed code around
-    m_functionName = String();
-    m_code = String();
-
-    if (m_listener) {
-        ASSERT(isInline());
-        JSDOMWindow::ListenersMap& listeners = globalObject()->jsInlineEventListeners();
-        listeners.set(m_listener, const_cast<JSLazyEventListener*>(this));
-    }
+    return m_isAttribute;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
index 859d5d4..ce34832 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventListener.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
- *  Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -21,103 +21,39 @@
 #define JSEventListener_h
 
 #include "EventListener.h"
-#include "PlatformString.h"
+#include "JSDOMWindow.h"
 #include <runtime/Protect.h>
 
 namespace WebCore {
 
-    class Event;
     class JSDOMGlobalObject;
-    class Node;
 
-    class JSAbstractEventListener : public EventListener {
+    class JSEventListener : public EventListener {
     public:
-        virtual void handleEvent(Event*, bool isWindowEvent);
-        virtual bool isInline() const;
-        virtual JSC::JSObject* listenerObj() const = 0;
-        virtual JSDOMGlobalObject* globalObject() const = 0;
-
-    protected:
-        JSAbstractEventListener(bool isInline)
-            : m_isInline(isInline)
-        {
-        }
-
-    private:
-        bool m_isInline;
-    };
-
-    class JSUnprotectedEventListener : public JSAbstractEventListener {
-    public:
-        static PassRefPtr<JSUnprotectedEventListener> create(JSC::JSObject* listener, JSDOMGlobalObject* globalObject, bool isInline)
-        {
-            return adoptRef(new JSUnprotectedEventListener(listener, globalObject, isInline));
-        }
-        virtual ~JSUnprotectedEventListener();
-
-        virtual JSC::JSObject* listenerObj() const;
-        virtual JSDOMGlobalObject* globalObject() const;
-        void clearGlobalObject();
-        void mark();
-
-    private:
-        JSUnprotectedEventListener(JSC::JSObject* listener, JSDOMGlobalObject*, bool isInline);
-
-        JSC::JSObject* m_listener;
-        JSDOMGlobalObject* m_globalObject;
-    };
-
-    class JSEventListener : public JSAbstractEventListener {
-    public:
-        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, JSDOMGlobalObject* globalObject, bool isInline)
+        static PassRefPtr<JSEventListener> create(JSC::JSObject* listener, JSDOMGlobalObject* globalObject, bool isAttribute)
         {
-            return adoptRef(new JSEventListener(listener, globalObject, isInline));
+            return adoptRef(new JSEventListener(listener, globalObject, isAttribute));
         }
         virtual ~JSEventListener();
+        void clearGlobalObject() { m_globalObject = 0; }
 
-        virtual JSC::JSObject* listenerObj() const;
-        virtual JSDOMGlobalObject* globalObject() const;
-        void clearGlobalObject();
-
-    protected:
-        JSEventListener(JSC::JSObject* listener, JSDOMGlobalObject*, bool isInline);
+        // Returns true if this event listener was created for an event handler attribute, like "onload" or "onclick".
+        bool isAttribute() const { return m_isAttribute; }
 
-        mutable JSC::ProtectedPtr<JSC::JSObject> m_listener;
+        virtual JSC::JSObject* jsFunction() const;
 
     private:
-        JSC::ProtectedPtr<JSDOMGlobalObject> m_globalObject;
-    };
-
-    class JSLazyEventListener : public JSEventListener {
-    public:
-        enum LazyEventListenerType {
-            HTMLLazyEventListener
-#if ENABLE(SVG)
-            , SVGLazyEventListener
-#endif
-        };
-
-        virtual bool wasCreatedFromMarkup() const { return true; }
-
-        static PassRefPtr<JSLazyEventListener> create(LazyEventListenerType type, const String& functionName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
-        {
-            return adoptRef(new JSLazyEventListener(type, functionName, code, globalObject, node, lineNumber));
-        }
-        virtual JSC::JSObject* listenerObj() const;
+        virtual void markJSFunction();
+        virtual void handleEvent(Event*, bool isWindowEvent);
+        virtual bool virtualisAttribute() const;
+        void clearJSFunctionInline();
 
     protected:
-        JSLazyEventListener(LazyEventListenerType type, const String& functionName, const String& code, JSDOMGlobalObject*, Node*, int lineNumber);
+        JSEventListener(JSC::JSObject* function, JSDOMGlobalObject*, bool isAttribute);
 
-    private:
-        void parseCode() const;
-
-        mutable String m_functionName;
-        mutable String m_code;
-        mutable bool m_parsed;
-        int m_lineNumber;
-        Node* m_originalNode;
-
-        LazyEventListenerType m_type;
+        mutable JSC::JSObject* m_jsFunction;
+        JSDOMGlobalObject* m_globalObject;
+        bool m_isAttribute;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp
index 8239897..2058098 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.cpp
@@ -26,26 +26,41 @@
 #include "config.h"
 #include "JSEventTarget.h"
 
+#include "DOMWindow.h"
 #include "Document.h"
+#include "JSDOMWindow.h"
+#include "JSDOMWindowShell.h"
 #include "JSEventListener.h"
-#include "JSEventTargetNode.h"
 #include "JSMessagePort.h"
-#include "JSWorker.h"
-#include "JSWorkerContext.h"
+#include "JSNode.h"
+#include "JSXMLHttpRequest.h"
 #include "JSXMLHttpRequestUpload.h"
-#include "Worker.h"
-#include "WorkerContext.h"
+#include "MessagePort.h"
+#include "XMLHttpRequest.h"
+#include "XMLHttpRequestUpload.h"
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+#include "DOMApplicationCache.h"
+#include "JSDOMApplicationCache.h"
+#endif
 
 #if ENABLE(SVG)
 #include "SVGElementInstance.h"
 #include "JSSVGElementInstance.h"
 #endif
 
+#if ENABLE(WORKERS)
+#include "JSWorker.h"
+#include "JSWorkerContext.h"
+#include "Worker.h"
+#include "WorkerContext.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, EventTarget* target)
+JSValue toJS(ExecState* exec, EventTarget* target)
 {
     if (!target)
         return jsNull();
@@ -59,6 +74,9 @@ JSValuePtr toJS(ExecState* exec, EventTarget* target)
     if (Node* node = target->toNode())
         return toJS(exec, node);
 
+    if (DOMWindow* domWindow = target->toDOMWindow())
+        return toJS(exec, domWindow);
+
     if (XMLHttpRequest* xhr = target->toXMLHttpRequest())
         // XMLHttpRequest is always created via JS, so we don't need to use cacheDOMObject() here.
         return getCachedDOMObjectWrapper(exec->globalData(), xhr);
@@ -87,4 +105,34 @@ JSValuePtr toJS(ExecState* exec, EventTarget* target)
     return jsNull();
 }
 
+EventTarget* toEventTarget(JSC::JSValue value)
+{
+    #define CONVERT_TO_EVENT_TARGET(type) \
+        if (value.isObject(&JS##type::s_info)) \
+            return static_cast<JS##type*>(asObject(value))->impl();
+
+    CONVERT_TO_EVENT_TARGET(Node)
+    CONVERT_TO_EVENT_TARGET(XMLHttpRequest)
+    CONVERT_TO_EVENT_TARGET(XMLHttpRequestUpload)
+    CONVERT_TO_EVENT_TARGET(MessagePort)
+
+    if (value.isObject(&JSDOMWindowShell::s_info))
+        return static_cast<JSDOMWindowShell*>(asObject(value))->impl();
+
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    CONVERT_TO_EVENT_TARGET(DOMApplicationCache)
+#endif
+
+#if ENABLE(SVG)
+    CONVERT_TO_EVENT_TARGET(SVGElementInstance)
+#endif
+
+#if ENABLE(WORKERS)
+    CONVERT_TO_EVENT_TARGET(Worker)
+    CONVERT_TO_EVENT_TARGET(WorkerContext)
+#endif
+
+    return 0;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.h b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.h
index 00dd848..05df056 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTarget.h
@@ -36,7 +36,8 @@ namespace WebCore {
 
     class EventTarget;
 
-    JSC::JSValuePtr toJS(JSC::ExecState*, EventTarget*);
+    JSC::JSValue toJS(JSC::ExecState*, EventTarget*);
+    EventTarget* toEventTarget(JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTargetBase.h b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTargetBase.h
deleted file mode 100644
index 2aa2bf2..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTargetBase.h
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
- *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef JSEventTargetBase_h
-#define JSEventTargetBase_h
-
-#include "Event.h"
-#include "EventNames.h"
-#include "JSEvent.h"
-
-#define JS_EVENT_LISTENER_FOR_EACH_LISTENER(specificEventTarget, macro) \
-    macro(specificEventTarget, OnAbort, abortEvent) \
-    macro(specificEventTarget, OnBlur, blurEvent) \
-    macro(specificEventTarget, OnChange, changeEvent) \
-    macro(specificEventTarget, OnClick, clickEvent) \
-    macro(specificEventTarget, OnContextMenu, contextmenuEvent) \
-    macro(specificEventTarget, OnDblClick, dblclickEvent) \
-    macro(specificEventTarget, OnError, errorEvent) \
-    macro(specificEventTarget, OnFocus, focusEvent) \
-    macro(specificEventTarget, OnInput, inputEvent) \
-    macro(specificEventTarget, OnKeyDown, keydownEvent) \
-    macro(specificEventTarget, OnKeyPress, keypressEvent) \
-    macro(specificEventTarget, OnKeyUp, keyupEvent) \
-    macro(specificEventTarget, OnLoad, loadEvent) \
-    macro(specificEventTarget, OnMouseDown, mousedownEvent) \
-    macro(specificEventTarget, OnMouseMove, mousemoveEvent) \
-    macro(specificEventTarget, OnMouseOut, mouseoutEvent) \
-    macro(specificEventTarget, OnMouseOver, mouseoverEvent) \
-    macro(specificEventTarget, OnMouseUp, mouseupEvent) \
-    macro(specificEventTarget, OnMouseWheel, mousewheelEvent) \
-    macro(specificEventTarget, OnBeforeCut, beforecutEvent) \
-    macro(specificEventTarget, OnCut, cutEvent) \
-    macro(specificEventTarget, OnBeforeCopy, beforecopyEvent) \
-    macro(specificEventTarget, OnCopy, copyEvent) \
-    macro(specificEventTarget, OnBeforePaste, beforepasteEvent) \
-    macro(specificEventTarget, OnPaste, pasteEvent) \
-    macro(specificEventTarget, OnDragEnter, dragenterEvent) \
-    macro(specificEventTarget, OnDragOver, dragoverEvent) \
-    macro(specificEventTarget, OnDragLeave, dragleaveEvent) \
-    macro(specificEventTarget, OnDrop, dropEvent) \
-    macro(specificEventTarget, OnDragStart, dragstartEvent) \
-    macro(specificEventTarget, OnDrag, dragEvent) \
-    macro(specificEventTarget, OnDragEnd, dragendEvent) \
-    macro(specificEventTarget, OnReset, resetEvent) \
-    macro(specificEventTarget, OnResize, resizeEvent) \
-    macro(specificEventTarget, OnScroll, scrollEvent) \
-    macro(specificEventTarget, OnSearch, searchEvent) \
-    macro(specificEventTarget, OnSelect, selectEvent) \
-    macro(specificEventTarget, OnSelectStart, selectstartEvent) \
-    macro(specificEventTarget, OnSubmit, submitEvent) \
-    macro(specificEventTarget, OnUnload, unloadEvent) \
-
-#define EVENT_LISTENER_GETTER(specificEventTarget, name, event) \
-JSC::JSValuePtr js##specificEventTarget##name(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot& slot) \
-{ \
-    return static_cast<JS##specificEventTarget*>(slot.slotBase())->getListener(event); \
-} \
-
-#define EVENT_LISTENER_SETTER(specificEventTarget, name, event) \
-void setJS##specificEventTarget##name(JSC::ExecState* exec, JSC::JSObject* baseObject, JSC::JSValuePtr value) \
-{ \
-    static_cast<JS##specificEventTarget*>(baseObject)->setListener(exec, event, value); \
-} \
-
-#define DECLARE_JS_EVENT_LISTENERS(specificEventTarget) \
-    JS_EVENT_LISTENER_FOR_EACH_LISTENER(specificEventTarget, EVENT_LISTENER_GETTER) \
-    JS_EVENT_LISTENER_FOR_EACH_LISTENER(specificEventTarget, EVENT_LISTENER_SETTER) \
-
-#endif // JSEventTargetBase_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTargetNodeCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSEventTargetNodeCustom.cpp
deleted file mode 100644
index 12fd98b..0000000
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSEventTargetNodeCustom.cpp
+++ /dev/null
@@ -1,71 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "JSEventTargetNode.h"
-
-#include "AtomicString.h"
-#include "Document.h"
-#include "Event.h"
-#include "EventTargetNode.h"
-#include "ExceptionCode.h"
-#include "Frame.h"
-#include "JSDOMWindow.h"
-#include "JSEvent.h"
-#include "JSEventListener.h"
-
-using namespace JSC;
-
-namespace WebCore {
-
-JSValuePtr JSEventTargetNode::addEventListener(ExecState* exec, const ArgList& args)
-{
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
-    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(exec, args.at(exec, 1)))
-        impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
-
-    return jsUndefined();
-}
-
-JSValuePtr JSEventTargetNode::removeEventListener(ExecState* exec, const ArgList& args)
-{
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
-    if (!globalObject)
-        return jsUndefined();
-
-    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(exec, 1)))
-        impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
-
-    return jsUndefined();
-}
-
-void JSEventTargetNode::pushEventHandlerScope(ExecState*, ScopeChain&) const
-{
-}
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
index 2b6fb20..493166c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSGeolocationCustom.cpp
@@ -39,35 +39,42 @@ using namespace JSC;
 
 namespace WebCore {
 
-static PassRefPtr<PositionOptions> createPositionOptions(ExecState* exec, JSValuePtr value)
+static PassRefPtr<PositionOptions> createPositionOptions(ExecState* exec, JSValue value)
 {
-    if (!value->isObject())
+    if (!value.isObject())
         return 0;
 
     JSObject* object = asObject(value);
 
-    JSValuePtr enableHighAccuracyValue = object->get(exec, Identifier(exec, "enableHighAccuracy"));
+    JSValue enableHighAccuracyValue = object->get(exec, Identifier(exec, "enableHighAccuracy"));
     if (exec->hadException())
         return 0;
-    bool enableHighAccuracy = enableHighAccuracyValue->toBoolean(exec);
+    bool enableHighAccuracy = enableHighAccuracyValue.toBoolean(exec);
     if (exec->hadException())
         return 0;
 
-    JSValuePtr timeoutValue = object->get(exec, Identifier(exec, "timeout"));
+    JSValue timeoutValue = object->get(exec, Identifier(exec, "timeout"));
     if (exec->hadException())
         return 0;
-    unsigned timeout = timeoutValue->toUInt32(exec);
+    unsigned timeout = timeoutValue.toUInt32(exec);
     if (exec->hadException())
         return 0;
 
-    return PositionOptions::create(enableHighAccuracy, timeout);
+    JSValue maximumAgeValue = object->get(exec, Identifier(exec, "maximumAge"));
+    if (exec->hadException())
+        return 0;
+    unsigned maximumAge = maximumAgeValue.toUInt32(exec);
+    if (exec->hadException())
+        return 0;
+
+    return PositionOptions::create(enableHighAccuracy, timeout, maximumAge);
 }
 
-JSValuePtr JSGeolocation::getCurrentPosition(ExecState* exec, const ArgList& args)
+JSValue JSGeolocation::getCurrentPosition(ExecState* exec, const ArgList& args)
 {
     // Arguments: PositionCallback, (optional)PositionErrorCallback, (optional)PositionOptions
     RefPtr<PositionCallback> positionCallback;
-    JSObject* object = args.at(exec, 0)->getObject();
+    JSObject* object = args.at(0).getObject();
     if (exec->hadException())
         return jsUndefined();
     if (!object) {
@@ -79,8 +86,8 @@ JSValuePtr JSGeolocation::getCurrentPosition(ExecState* exec, const ArgList& arg
         positionCallback = JSCustomPositionCallback::create(object, frame);
     
     RefPtr<PositionErrorCallback> positionErrorCallback;
-    if (!args.at(exec, 1)->isUndefinedOrNull()) {
-        JSObject* object = args.at(exec, 1)->getObject();
+    if (!args.at(1).isUndefinedOrNull()) {
+        JSObject* object = args.at(1).getObject();
         if (!object) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
@@ -91,22 +98,22 @@ JSValuePtr JSGeolocation::getCurrentPosition(ExecState* exec, const ArgList& arg
     }
     
     RefPtr<PositionOptions> positionOptions;
-    if (!args.at(exec, 2)->isUndefinedOrNull()) {
-        positionOptions = createPositionOptions(exec, args.at(exec, 2));
+    if (!args.at(2).isUndefinedOrNull()) {
+        positionOptions = createPositionOptions(exec, args.at(2));
         if (exec->hadException())
             return jsUndefined();
     }
 
-    m_impl->getCurrentPosition(positionCallback.release(), positionErrorCallback.release(), positionOptions.get());
+    m_impl->getCurrentPosition(positionCallback.release(), positionErrorCallback.release(), positionOptions.release());
     
     return jsUndefined();
 }
 
-JSValuePtr JSGeolocation::watchPosition(ExecState* exec, const ArgList& args)
+JSValue JSGeolocation::watchPosition(ExecState* exec, const ArgList& args)
 {
     // Arguments: PositionCallback, (optional)PositionErrorCallback, (optional)PositionOptions
     RefPtr<PositionCallback> positionCallback;
-    JSObject* object = args.at(exec, 0)->getObject();
+    JSObject* object = args.at(0).getObject();
     if (exec->hadException())
         return jsUndefined();
     if (!object) {
@@ -118,8 +125,8 @@ JSValuePtr JSGeolocation::watchPosition(ExecState* exec, const ArgList& args)
         positionCallback = JSCustomPositionCallback::create(object, frame);
     
     RefPtr<PositionErrorCallback> positionErrorCallback;
-    if (!args.at(exec, 1)->isUndefinedOrNull()) {
-        JSObject* object = args.at(exec, 1)->getObject();
+    if (!args.at(1).isUndefinedOrNull()) {
+        JSObject* object = args.at(1).getObject();
         if (!object) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
@@ -130,13 +137,13 @@ JSValuePtr JSGeolocation::watchPosition(ExecState* exec, const ArgList& args)
     }
     
     RefPtr<PositionOptions> positionOptions;
-    if (!args.at(exec, 2)->isUndefinedOrNull()) {
-        positionOptions = createPositionOptions(exec, args.at(exec, 2));
+    if (!args.at(2).isUndefinedOrNull()) {
+        positionOptions = createPositionOptions(exec, args.at(2));
         if (exec->hadException())
             return jsUndefined();
     }
 
-    int watchID = m_impl->watchPosition(positionCallback.release(), positionErrorCallback.release(), positionOptions.get());
+    int watchID = m_impl->watchPosition(positionCallback.release(), positionErrorCallback.release(), positionOptions.release());
     return jsNumber(exec, watchID);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.h b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.h
index 511c9d7..d559d3b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAllCollection.h
@@ -40,7 +40,7 @@ namespace WebCore {
         {
         }
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr proto) 
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue proto) 
         { 
             return JSC::Structure::create(proto, JSC::TypeInfo(JSC::ObjectType, JSC::MasqueradesAsUndefined)); 
         }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
index a99a36d..37561af 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLAppletElementCustom.cpp
@@ -33,12 +33,12 @@ namespace WebCore {
 
 using namespace JSC;
 
-bool JSHTMLAppletElement::customGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSHTMLAppletElement::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
-bool JSHTMLAppletElement::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+bool JSHTMLAppletElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
 }
@@ -53,7 +53,7 @@ bool JSHTMLAppletElement::canGetItemsForName(ExecState*, HTMLAppletElement*, con
     return propertyName == "__apple_runtime_object";
 }
 
-JSValuePtr JSHTMLAppletElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLAppletElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     return runtimeObjectGetter(exec, propertyName, slot);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
index 7ff5392..4100468 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLCollectionCustom.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-static JSValuePtr getNamedItems(ExecState* exec, HTMLCollection* impl, const Identifier& propertyName)
+static JSValue getNamedItems(ExecState* exec, HTMLCollection* impl, const Identifier& propertyName)
 {
     Vector<RefPtr<Node> > namedItems;
     impl->namedItems(propertyName, namedItems);
@@ -51,7 +51,7 @@ static JSValuePtr getNamedItems(ExecState* exec, HTMLCollection* impl, const Ide
 
 // HTMLCollections are strange objects, they support both get and call,
 // so that document.forms.item(0) and document.forms(0) both work.
-static JSValuePtr callHTMLCollection(ExecState* exec, JSObject* function, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callHTMLCollection(ExecState* exec, JSObject* function, JSValue, const ArgList& args)
 {
     if (args.size() < 1)
         return jsUndefined();
@@ -64,7 +64,7 @@ static JSValuePtr callHTMLCollection(ExecState* exec, JSObject* function, JSValu
     if (args.size() == 1) {
         // Support for document.all(<index>) etc.
         bool ok;
-        UString string = args.at(exec, 0)->toString(exec);
+        UString string = args.at(0).toString(exec);
         unsigned index = string.toUInt32(&ok, false);
         if (ok)
             return toJS(exec, collection->item(index));
@@ -75,8 +75,8 @@ static JSValuePtr callHTMLCollection(ExecState* exec, JSObject* function, JSValu
 
     // The second arg, if set, is the index of the item we want
     bool ok;
-    UString string = args.at(exec, 0)->toString(exec);
-    unsigned index = args.at(exec, 1)->toString(exec).toUInt32(&ok, false);
+    UString string = args.at(0).toString(exec);
+    unsigned index = args.at(1).toString(exec).toUInt32(&ok, false);
     if (ok) {
         String pstr = string;
         Node* node = collection->namedItem(pstr);
@@ -99,30 +99,30 @@ CallType JSHTMLCollection::getCallData(CallData& callData)
 
 bool JSHTMLCollection::canGetItemsForName(ExecState* exec, HTMLCollection* thisObj, const Identifier& propertyName)
 {
-    return !getNamedItems(exec, thisObj, propertyName)->isUndefined();
+    return !getNamedItems(exec, thisObj, propertyName).isUndefined();
 }
 
-JSValuePtr JSHTMLCollection::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLCollection::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSHTMLCollection* thisObj = static_cast<JSHTMLCollection*>(asObject(slot.slotBase()));
     return getNamedItems(exec, thisObj->impl(), propertyName);
 }
 
-JSValuePtr JSHTMLCollection::item(ExecState* exec, const ArgList& args)
+JSValue JSHTMLCollection::item(ExecState* exec, const ArgList& args)
 {
     bool ok;
-    uint32_t index = args.at(exec, 0)->toString(exec).toUInt32(&ok, false);
+    uint32_t index = args.at(0).toString(exec).toUInt32(&ok, false);
     if (ok)
         return toJS(exec, impl()->item(index));
-    return getNamedItems(exec, impl(), Identifier(exec, args.at(exec, 0)->toString(exec)));
+    return getNamedItems(exec, impl(), Identifier(exec, args.at(0).toString(exec)));
 }
 
-JSValuePtr JSHTMLCollection::namedItem(ExecState* exec, const ArgList& args)
+JSValue JSHTMLCollection::namedItem(ExecState* exec, const ArgList& args)
 {
-    return getNamedItems(exec, impl(), Identifier(exec, args.at(exec, 0)->toString(exec)));
+    return getNamedItems(exec, impl(), Identifier(exec, args.at(0).toString(exec)));
 }
 
-JSValuePtr toJS(ExecState* exec, HTMLCollection* collection)
+JSValue toJS(ExecState* exec, HTMLCollection* collection)
 {
     if (!collection)
         return jsNull();
@@ -133,10 +133,10 @@ JSValuePtr toJS(ExecState* exec, HTMLCollection* collection)
         return wrapper;
 
     switch (collection->type()) {
-        case HTMLCollection::SelectOptions:
+        case SelectOptions:
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, HTMLOptionsCollection, collection);
             break;
-        case HTMLCollection::DocAll:
+        case DocAll:
             typedef HTMLCollection HTMLAllCollection;
             wrapper = CREATE_DOM_OBJECT_WRAPPER(exec, HTMLAllCollection, collection);
             break;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDataGridElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDataGridElementCustom.cpp
new file mode 100644
index 0000000..5aa0904
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDataGridElementCustom.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSHTMLDataGridElement.h"
+
+#include "Document.h"
+#include "HTMLDataGridElement.h"
+#include "JSDataGridDataSource.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSHTMLDataGridElement::dataSource(ExecState*) const
+{
+    DataGridDataSource* dataSource = static_cast<HTMLDataGridElement*>(impl())->dataSource();
+    if (dataSource && dataSource->isJSDataGridDataSource())
+        return asJSDataGridDataSource(dataSource)->jsDataSource();
+    return jsNull();
+}
+
+void JSHTMLDataGridElement::setDataSource(ExecState*, JSValue value)
+{
+    static_cast<HTMLDataGridElement*>(impl())->setDataSource(JSDataGridDataSource::create(value, impl()->document()->frame()));
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
index e6abd29..c113ec7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLDocumentCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "JSHTMLDocument.h"
 
+#include "CharacterNames.h"
 #include "Frame.h"
 #include "HTMLBodyElement.h"
 #include "HTMLCollection.h"
@@ -37,6 +38,8 @@
 #include "JSDOMWindowCustom.h"
 #include "JSDOMWindowShell.h"
 #include "JSHTMLCollection.h"
+#include "SegmentedString.h"
+#include "Tokenizer.h"
 #include <runtime/Error.h>
 
 using namespace JSC;
@@ -51,7 +54,7 @@ bool JSHTMLDocument::canGetItemsForName(ExecState*, HTMLDocument* document, cons
     return atomicPropertyName && (document->hasNamedItem(atomicPropertyName) || document->hasExtraNamedItem(atomicPropertyName));
 }
 
-JSValuePtr JSHTMLDocument::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLDocument::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSHTMLDocument* thisObj = static_cast<JSHTMLDocument*>(asObject(slot.slotBase()));
     HTMLDocument* document = static_cast<HTMLDocument*>(thisObj->impl());
@@ -78,17 +81,17 @@ JSValuePtr JSHTMLDocument::nameGetter(ExecState* exec, const Identifier& propert
 
 // Custom attributes
 
-JSValuePtr JSHTMLDocument::all(ExecState* exec) const
+JSValue JSHTMLDocument::all(ExecState* exec) const
 {
     // If "all" has been overwritten, return the overwritten value
-    JSValuePtr v = getDirect(Identifier(exec, "all"));
+    JSValue v = getDirect(Identifier(exec, "all"));
     if (v)
         return v;
 
     return toJS(exec, static_cast<HTMLDocument*>(impl())->all().get());
 }
 
-void JSHTMLDocument::setAll(ExecState* exec, JSValuePtr value)
+void JSHTMLDocument::setAll(ExecState* exec, JSValue value)
 {
     // Add "all" to the property map.
     putDirect(Identifier(exec, "all"), value);
@@ -96,7 +99,7 @@ void JSHTMLDocument::setAll(ExecState* exec, JSValuePtr value)
 
 // Custom functions
 
-JSValuePtr JSHTMLDocument::open(ExecState* exec, const ArgList& args)
+JSValue JSHTMLDocument::open(ExecState* exec, const ArgList& args)
 {
     // For compatibility with other browsers, pass open calls with more than 2 parameters to the window.
     if (args.size() > 2) {
@@ -104,9 +107,9 @@ JSValuePtr JSHTMLDocument::open(ExecState* exec, const ArgList& args)
         if (frame) {
             JSDOMWindowShell* wrapper = toJSDOMWindowShell(frame);
             if (wrapper) {
-                JSValuePtr function = wrapper->get(exec, Identifier(exec, "open"));
+                JSValue function = wrapper->get(exec, Identifier(exec, "open"));
                 CallData callData;
-                CallType callType = function->getCallData(callData);
+                CallType callType = function.getCallData(callData);
                 if (callType == CallTypeNone)
                     return throwError(exec, TypeError);
                 return call(exec, function, callType, callData, wrapper, args);
@@ -124,32 +127,42 @@ JSValuePtr JSHTMLDocument::open(ExecState* exec, const ArgList& args)
     return this;
 }
 
-static String writeHelper(ExecState* exec, const ArgList& args)
-{
-    // DOM only specifies single string argument, but NS & IE allow multiple
-    // or no arguments.
+enum NewlineRequirement { DoNotAddNewline, DoAddNewline };
 
-    unsigned size = args.size();
-    if (size == 1)
-        return args.at(exec, 0)->toString(exec);
+static inline void documentWrite(ExecState* exec, const ArgList& args, HTMLDocument* document, NewlineRequirement addNewline)
+{
+    // DOM only specifies single string argument, but browsers allow multiple or no arguments.
+
+    size_t size = args.size();
+
+    UString firstString = args.at(0).toString(exec);
+    SegmentedString segmentedString = String(firstString);
+    if (size != 1) {
+        if (!size)
+            segmentedString.clear();
+        else {
+            for (size_t i = 1; i < size; ++i) {
+                UString subsequentString = args.at(i).toString(exec);
+                segmentedString.append(SegmentedString(String(subsequentString)));
+            }
+        }
+    }
+    if (addNewline)
+        segmentedString.append(SegmentedString(&newlineCharacter, 1));
 
-    Vector<UChar> result;
-    for (unsigned i = 0; i < size; ++i)
-        append(result, args.at(exec, i)->toString(exec));
-    return String::adopt(result);
+    Document* activeDocument = asJSDOMWindow(exec->lexicalGlobalObject())->impl()->document();
+    document->write(segmentedString, activeDocument);
 }
 
-JSValuePtr JSHTMLDocument::write(ExecState* exec, const ArgList& args)
+JSValue JSHTMLDocument::write(ExecState* exec, const ArgList& args)
 {
-    Document* activeDocument = asJSDOMWindow(exec->lexicalGlobalObject())->impl()->document();
-    static_cast<HTMLDocument*>(impl())->write(writeHelper(exec, args), activeDocument);
+    documentWrite(exec, args, static_cast<HTMLDocument*>(impl()), DoNotAddNewline);
     return jsUndefined();
 }
 
-JSValuePtr JSHTMLDocument::writeln(ExecState* exec, const ArgList& args)
+JSValue JSHTMLDocument::writeln(ExecState* exec, const ArgList& args)
 {
-    Document* activeDocument = asJSDOMWindow(exec->lexicalGlobalObject())->impl()->document();
-    static_cast<HTMLDocument*>(impl())->write(writeHelper(exec, args) + "\n", activeDocument);
+    documentWrite(exec, args, static_cast<HTMLDocument*>(impl()), DoAddNewline);
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
index 2856393..2570bc6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLEmbedElementCustom.cpp
@@ -33,12 +33,12 @@ namespace WebCore {
 
 using namespace JSC;
 
-bool JSHTMLEmbedElement::customGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSHTMLEmbedElement::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
-bool JSHTMLEmbedElement::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+bool JSHTMLEmbedElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
 }
@@ -53,7 +53,7 @@ bool JSHTMLEmbedElement::canGetItemsForName(ExecState*, HTMLEmbedElement*, const
     return propertyName == "__apple_runtime_object";
 }
 
-JSValuePtr JSHTMLEmbedElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLEmbedElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     return runtimeObjectGetter(exec, propertyName, slot);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
index 4e16cc5..8bf543c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFormElementCustom.cpp
@@ -26,8 +26,10 @@
 #include "config.h"
 #include "JSHTMLFormElement.h"
 
+#include "Frame.h"
 #include "HTMLCollection.h"
 #include "HTMLFormElement.h"
+#include "JSDOMWindowCustom.h"
 #include "JSNamedNodesCollection.h"
 
 using namespace JSC;
@@ -41,7 +43,7 @@ bool JSHTMLFormElement::canGetItemsForName(ExecState*, HTMLFormElement* form, co
     return namedItems.size();
 }
 
-JSValuePtr JSHTMLFormElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLFormElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     HTMLFormElement* form = static_cast<HTMLFormElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     
@@ -55,4 +57,13 @@ JSValuePtr JSHTMLFormElement::nameGetter(ExecState* exec, const Identifier& prop
     return jsUndefined();
 }
 
+JSValue JSHTMLFormElement::submit(ExecState* exec, const ArgList&)
+{
+    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
+    if (!activeFrame)
+        return jsUndefined();
+    static_cast<HTMLFormElement*>(impl())->submit(0, false, !activeFrame->script()->anyPageIsProcessingUserGesture(), false);
+    return jsUndefined();
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
index a97a72a..0a5d1f1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
@@ -40,14 +40,14 @@ namespace WebCore {
 
 static inline bool allowSettingJavascriptURL(ExecState* exec, HTMLFrameElement* imp, const String& value)
 {
-    if (protocolIs(parseURL(value), "javascript")) {
+    if (protocolIsJavaScript(parseURL(value))) {
         if (!checkNodeSecurity(exec, imp->contentDocument()))
             return false;
     }
     return true;
 }
 
-void JSHTMLFrameElement::setSrc(ExecState* exec, JSValuePtr value)
+void JSHTMLFrameElement::setSrc(ExecState* exec, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(impl());
     String srcValue = valueToStringWithNullCheck(exec, value);
@@ -59,7 +59,7 @@ void JSHTMLFrameElement::setSrc(ExecState* exec, JSValuePtr value)
     return;
 }
 
-void JSHTMLFrameElement::setLocation(ExecState* exec, JSValuePtr value)
+void JSHTMLFrameElement::setLocation(ExecState* exec, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(impl());
     String locationValue = valueToStringWithNullCheck(exec, value);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
index f17cb89..05972e6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp
@@ -27,6 +27,7 @@
 #include "JSHTMLFrameSetElement.h"
 
 #include "Document.h"
+#include "HTMLCollection.h"
 #include "HTMLFrameElement.h"
 #include "HTMLFrameSetElement.h"
 #include "HTMLNames.h"
@@ -46,7 +47,7 @@ bool JSHTMLFrameSetElement::canGetItemsForName(ExecState*, HTMLFrameSetElement*
     return frame && frame->hasTagName(frameTag);
 }
 
-JSValuePtr JSHTMLFrameSetElement::nameGetter(ExecState*, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLFrameSetElement::nameGetter(ExecState*, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
     HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
index 1a0fc1c..afff977 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
@@ -38,13 +38,13 @@ using namespace JSC;
 
 namespace WebCore {
 
-void JSHTMLIFrameElement::setSrc(ExecState* exec, JSValuePtr value)
+void JSHTMLIFrameElement::setSrc(ExecState* exec, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(impl());
 
     String srcValue = valueToStringWithNullCheck(exec, value);
 
-    if (protocolIs(parseURL(srcValue), "javascript")) {
+    if (protocolIsJavaScript(parseURL(srcValue))) {
         if (!checkNodeSecurity(exec, imp->contentDocument()))
             return;
     }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLInputElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
index d59ef92..6b47622 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
@@ -26,47 +26,93 @@
 #include "config.h"
 #include "JSHTMLInputElement.h"
 
+#include "Document.h"
 #include "HTMLInputElement.h"
+#include "Settings.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-bool JSHTMLInputElement::customGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+static bool needsGmailQuirk(HTMLInputElement* input)
 {
-    HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
-    if (input->canHaveSelection())
+    Document* document = input->document();
+
+    const KURL& url = document->url();
+    if (url.host() != "mail.google.com")
+        return false;
+
+    // As with other site-specific quirks, allow website developers to turn this off.
+    // In theory, this allows website developers to check if their fixes are effective.
+    Settings* settings = document->settings();
+    if (!settings)
+        return false;
+    if (!settings->needsSiteSpecificQuirks())
         return false;
 
-    const HashEntry* entry = JSHTMLInputElementPrototype::s_info.propHashTable(exec)->entry(exec, propertyName);
-    if (entry) {
-        if (entry->attributes() & Function) {
-            if (entry->function() == jsHTMLInputElementPrototypeFunctionSetSelectionRange) {
-                slot.setUndefined();
-                return true;
-            }
-        }
-    }
-
-    return false;
+    return true;
 }
 
-JSValuePtr JSHTMLInputElement::selectionStart(ExecState* exec) const
+JSValue JSHTMLInputElement::type(ExecState* exec) const
+{
+    HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
+    const AtomicString& type = input->type();
+
+    DEFINE_STATIC_LOCAL(const AtomicString, url, ("url"));
+    DEFINE_STATIC_LOCAL(const AtomicString, text, ("text"));
+
+    if (type == url && needsGmailQuirk(input))
+        return jsString(exec, text);
+    return jsString(exec, type);
+}
+
+JSValue JSHTMLInputElement::selectionStart(ExecState* exec) const
 {
     HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
     if (!input->canHaveSelection())
-        return jsUndefined();
+        return throwError(exec, TypeError);
 
     return jsNumber(exec, input->selectionStart());
 }
 
-JSValuePtr JSHTMLInputElement::selectionEnd(ExecState* exec) const
+void JSHTMLInputElement::setSelectionStart(ExecState* exec, JSValue value)
+{
+    HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
+    if (!input->canHaveSelection())
+        throwError(exec, TypeError);
+
+    input->setSelectionStart(value.toInt32(exec));
+}
+
+JSValue JSHTMLInputElement::selectionEnd(ExecState* exec) const
 {
     HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
     if (!input->canHaveSelection())
-        return jsUndefined();
+        return throwError(exec, TypeError);
 
     return jsNumber(exec, input->selectionEnd());
 }
 
+void JSHTMLInputElement::setSelectionEnd(ExecState* exec, JSValue value)
+{
+    HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
+    if (!input->canHaveSelection())
+        throwError(exec, TypeError);
+
+    input->setSelectionEnd(value.toInt32(exec));
+}
+
+JSValue JSHTMLInputElement::setSelectionRange(ExecState* exec, const ArgList& args)
+{
+    HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
+    if (!input->canHaveSelection())
+        return throwError(exec, TypeError);
+
+    int start = args.at(0).toInt32(exec);
+    int end = args.at(1).toInt32(exec);
+
+    input->setSelectionRange(start, end);
+    return jsUndefined();
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
index 5ad3454..a99e46c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLObjectElementCustom.cpp
@@ -33,12 +33,12 @@ namespace WebCore {
 
 using namespace JSC;
 
-bool JSHTMLObjectElement::customGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSHTMLObjectElement::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
     return runtimeObjectCustomGetOwnPropertySlot(exec, propertyName, slot, this);
 }
 
-bool JSHTMLObjectElement::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+bool JSHTMLObjectElement::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     return runtimeObjectCustomPut(exec, propertyName, value, impl(), slot);
 }
@@ -53,7 +53,7 @@ bool JSHTMLObjectElement::canGetItemsForName(ExecState*, HTMLObjectElement*, con
     return propertyName == "__apple_runtime_object";
 }
 
-JSValuePtr JSHTMLObjectElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLObjectElement::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     return runtimeObjectGetter(exec, propertyName, slot);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp
index d60483d..460ba08 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLOptionsCollectionCustom.cpp
@@ -35,18 +35,18 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSHTMLOptionsCollection::length(ExecState* exec) const
+JSValue JSHTMLOptionsCollection::length(ExecState* exec) const
 {
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
     return jsNumber(exec, imp->length());
 }
 
-void JSHTMLOptionsCollection::setLength(ExecState* exec, JSValuePtr value)
+void JSHTMLOptionsCollection::setLength(ExecState* exec, JSValue value)
 {
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
     ExceptionCode ec = 0;
     unsigned newLength = 0;
-    double lengthValue = value->toNumber(exec);
+    double lengthValue = value.toNumber(exec);
     if (!isnan(lengthValue) && !isinf(lengthValue)) {
         if (lengthValue < 0.0)
             ec = INDEX_SIZE_ERR;
@@ -60,23 +60,23 @@ void JSHTMLOptionsCollection::setLength(ExecState* exec, JSValuePtr value)
     setDOMException(exec, ec);
 }
 
-void JSHTMLOptionsCollection::indexSetter(ExecState* exec, unsigned index, JSValuePtr value)
+void JSHTMLOptionsCollection::indexSetter(ExecState* exec, unsigned index, JSValue value)
 {
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
     HTMLSelectElement* base = static_cast<HTMLSelectElement*>(imp->base());
     selectIndexSetter(base, exec, index, value);
 }
 
-JSValuePtr JSHTMLOptionsCollection::add(ExecState* exec, const ArgList& args)
+JSValue JSHTMLOptionsCollection::add(ExecState* exec, const ArgList& args)
 {
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
-    HTMLOptionElement* option = toHTMLOptionElement(args.at(exec, 0));
+    HTMLOptionElement* option = toHTMLOptionElement(args.at(0));
     ExceptionCode ec = 0;
     if (args.size() < 2)
         imp->add(option, ec);
     else {
         bool ok;
-        int index = args.at(exec, 1)->toInt32(exec, ok);
+        int index = args.at(1).toInt32(exec, ok);
         if (exec->hadException())
             return jsUndefined();
         if (!ok)
@@ -88,7 +88,7 @@ JSValuePtr JSHTMLOptionsCollection::add(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSHTMLOptionsCollection::remove(ExecState* exec, const ArgList& args)
+JSValue JSHTMLOptionsCollection::remove(ExecState* exec, const ArgList& args)
 {
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(impl());
     JSHTMLSelectElement* base = static_cast<JSHTMLSelectElement*>(asObject(toJS(exec, imp->base())));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.cpp
index 4094418..9bb6b75 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.cpp
@@ -32,23 +32,23 @@ namespace WebCore {
 using namespace JSC;
 using namespace HTMLNames;
 
-JSValuePtr JSHTMLSelectElement::remove(ExecState* exec, const ArgList& args)
+JSValue JSHTMLSelectElement::remove(ExecState* exec, const ArgList& args)
 {
     HTMLSelectElement& select = *static_cast<HTMLSelectElement*>(impl());
 
     // we support both options index and options objects
-    HTMLElement* element = toHTMLElement(args.at(exec, 0));
+    HTMLElement* element = toHTMLElement(args.at(0));
     if (element && element->hasTagName(optionTag))
         select.remove(static_cast<HTMLOptionElement*>(element)->index());
     else
-        select.remove(args.at(exec, 0)->toInt32(exec));
+        select.remove(args.at(0).toInt32(exec));
 
     return jsUndefined();
 }
 
-void selectIndexSetter(HTMLSelectElement* select, JSC::ExecState* exec, unsigned index, JSC::JSValuePtr value)
+void selectIndexSetter(HTMLSelectElement* select, JSC::ExecState* exec, unsigned index, JSC::JSValue value)
 {
-    if (value->isUndefinedOrNull())
+    if (value.isUndefinedOrNull())
         select->remove(index);
     else {
         ExceptionCode ec = 0;
@@ -61,7 +61,7 @@ void selectIndexSetter(HTMLSelectElement* select, JSC::ExecState* exec, unsigned
     }
 }
 
-void JSHTMLSelectElement::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValuePtr value)
+void JSHTMLSelectElement::indexSetter(JSC::ExecState* exec, unsigned index, JSC::JSValue value)
 {
     selectIndexSetter(static_cast<HTMLSelectElement*>(impl()), exec, index, value);
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.h b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.h
index 87344b5..a449038 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHTMLSelectElementCustom.h
@@ -33,7 +33,7 @@
 
 namespace WebCore {
 
-void selectIndexSetter(HTMLSelectElement*, JSC::ExecState*, unsigned index, JSC::JSValuePtr);
+void selectIndexSetter(HTMLSelectElement*, JSC::ExecState*, unsigned index, JSC::JSValue);
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
index 1baa6d4..a3b15e1 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSHistoryCustom.cpp
@@ -37,25 +37,25 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr nonCachingStaticBackFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticBackFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
-    return new (exec) PrototypeFunction(exec, 0, propertyName, jsHistoryPrototypeFunctionBack);
+    return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 0, propertyName, jsHistoryPrototypeFunctionBack);
 }
 
-JSValuePtr nonCachingStaticForwardFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticForwardFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
-    return new (exec) PrototypeFunction(exec, 0, propertyName, jsHistoryPrototypeFunctionForward);
+    return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 0, propertyName, jsHistoryPrototypeFunctionForward);
 }
 
-JSValuePtr nonCachingStaticGoFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticGoFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
-    return new (exec) PrototypeFunction(exec, 1, propertyName, jsHistoryPrototypeFunctionGo);
+    return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 1, propertyName, jsHistoryPrototypeFunctionGo);
 }
 
-bool JSHistory::customGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSHistory::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
     // When accessing History cross-domain, functions are always the native built-in ones.
-    // See JSDOMWindow::customGetOwnPropertySlot for additional details.
+    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
 
     // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
     // allowed, return false so the normal lookup will take place.
@@ -92,7 +92,7 @@ bool JSHistory::customGetOwnPropertySlot(ExecState* exec, const Identifier& prop
     return true;
 }
 
-bool JSHistory::customPut(ExecState* exec, const Identifier&, JSValuePtr, PutPropertySlot&)
+bool JSHistory::putDelegate(ExecState* exec, const Identifier&, JSValue, PutPropertySlot&)
 {
     // Only allow putting by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
@@ -108,12 +108,12 @@ bool JSHistory::deleteProperty(ExecState* exec, const Identifier& propertyName)
     return Base::deleteProperty(exec, propertyName);
 }
 
-bool JSHistory::customGetPropertyNames(ExecState* exec, PropertyNameArray&)
+void JSHistory::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     // Only allow the history object to enumerated by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
-        return true;
-    return false;
+        return;
+    Base::getPropertyNames(exec, propertyNames);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
index 2237c7a..4a27bb4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.cpp
@@ -22,6 +22,7 @@
 
 #include "HTMLImageElement.h"
 #include "HTMLNames.h"
+#include "JSHTMLImageElement.h"
 #include "JSNode.h"
 #include "ScriptExecutionContext.h"
 
@@ -29,15 +30,23 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSImageConstructor)
+ASSERT_CLASS_FITS_IN_CELL(JSImageConstructor);
 
 const ClassInfo JSImageConstructor::s_info = { "ImageConstructor", 0, 0, 0 };
 
-JSImageConstructor::JSImageConstructor(ExecState* exec, ScriptExecutionContext* context)
+JSImageConstructor::JSImageConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
     : DOMObject(JSImageConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    , m_globalObject(globalObject)
 {
-    ASSERT(context->isDocument());
-    m_document = static_cast<JSDocument*>(asObject(toJS(exec, static_cast<Document*>(context))));
+    ASSERT(globalObject->scriptExecutionContext());
+    ASSERT(globalObject->scriptExecutionContext()->isDocument());
+
+    putDirect(exec->propertyNames().prototype, JSHTMLImageElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
+}
+
+Document* JSImageConstructor::document() const
+{
+    return static_cast<Document*>(m_globalObject->scriptExecutionContext());
 }
 
 static JSObject* constructImage(ExecState* exec, JSObject* constructor, const ArgList& args)
@@ -48,14 +57,16 @@ static JSObject* constructImage(ExecState* exec, JSObject* constructor, const Ar
     int height = 0;
     if (args.size() > 0) {
         widthSet = true;
-        width = args.at(exec, 0)->toInt32(exec);
+        width = args.at(0).toInt32(exec);
     }
     if (args.size() > 1) {
         heightSet = true;
-        height = args.at(exec, 1)->toInt32(exec);
+        height = args.at(1).toInt32(exec);
     }
 
     Document* document = static_cast<JSImageConstructor*>(constructor)->document();
+    if (!document)
+        return throwError(exec, ReferenceError, "Image constructor associated document is unavailable");
 
     // Calling toJS on the document causes the JS document wrapper to be
     // added to the window object. This is done to ensure that JSDocument::mark
@@ -79,8 +90,8 @@ ConstructType JSImageConstructor::getConstructData(ConstructData& constructData)
 void JSImageConstructor::mark()
 {
     DOMObject::mark();
-    if (!m_document->marked())
-        m_document->mark();
+    if (!m_globalObject->marked())
+        m_globalObject->mark();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.h
index 13cce26..8dc7add 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSImageConstructor.h
@@ -27,8 +27,8 @@ namespace WebCore {
 
     class JSImageConstructor : public DOMObject {
     public:
-        JSImageConstructor(JSC::ExecState*, ScriptExecutionContext*);
-        Document* document() const { return m_document->impl(); }
+        JSImageConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        Document* document() const;
 
         static const JSC::ClassInfo s_info;
         
@@ -37,7 +37,7 @@ namespace WebCore {
         virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 
-        JSDocument* m_document;
+        JSDOMGlobalObject* m_globalObject;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp
index 920121e..32fe58b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSImageDataCustom.cpp
@@ -36,7 +36,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, ImageData* imageData)
+JSValue toJS(ExecState* exec, ImageData* imageData)
 {
     if (!imageData)
         return jsNull();
@@ -49,7 +49,7 @@ JSValuePtr toJS(ExecState* exec, ImageData* imageData)
     Identifier dataName(exec, "data");
     DEFINE_STATIC_LOCAL(RefPtr<Structure>, cpaStructure, (JSByteArray::createStructure(jsNull())));
     static const ClassInfo cpaClassInfo = { "CanvasPixelArray", 0, 0, 0 };
-    wrapper->putDirect(dataName, new (exec) JSByteArray(exec, cpaStructure, imageData->data(), &cpaClassInfo), DontDelete | ReadOnly);
+    wrapper->putDirect(dataName, new (exec) JSByteArray(exec, cpaStructure, imageData->data()->data(), &cpaClassInfo), DontDelete | ReadOnly);
     exec->heap()->reportExtraMemoryCost(imageData->data()->length());
     
     return wrapper;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
index 80c35df..fff7aee 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.cpp
@@ -34,7 +34,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSInspectedObjectWrapper)
+ASSERT_CLASS_FITS_IN_CELL(JSInspectedObjectWrapper);
 
 typedef HashMap<JSObject*, JSInspectedObjectWrapper*> WrapperMap;
 typedef HashMap<JSGlobalObject*, WrapperMap*> GlobalObjectWrapperMap;
@@ -47,9 +47,9 @@ static GlobalObjectWrapperMap& wrappers()
 
 const ClassInfo JSInspectedObjectWrapper::s_info = { "JSInspectedObjectWrapper", &JSQuarantinedObjectWrapper::s_info, 0, 0 };
 
-JSValuePtr JSInspectedObjectWrapper::wrap(ExecState* unwrappedExec, JSValuePtr unwrappedValue)
+JSValue JSInspectedObjectWrapper::wrap(ExecState* unwrappedExec, JSValue unwrappedValue)
 {
-    if (!unwrappedValue->isObject())
+    if (!unwrappedValue.isObject())
         return unwrappedValue;
 
     JSObject* unwrappedObject = asObject(unwrappedValue);
@@ -57,14 +57,14 @@ JSValuePtr JSInspectedObjectWrapper::wrap(ExecState* unwrappedExec, JSValuePtr u
     if (unwrappedObject->inherits(&JSInspectedObjectWrapper::s_info))
         return unwrappedObject;
 
-    if (WrapperMap* wrapperMap = wrappers().get(unwrappedExec->dynamicGlobalObject()))
+    if (WrapperMap* wrapperMap = wrappers().get(unwrappedExec->lexicalGlobalObject()))
         if (JSInspectedObjectWrapper* wrapper = wrapperMap->get(unwrappedObject))
             return wrapper;
 
-    JSValuePtr prototype = unwrappedObject->prototype();
-    ASSERT(prototype->isNull() || prototype->isObject());
+    JSValue prototype = unwrappedObject->prototype();
+    ASSERT(prototype.isNull() || prototype.isObject());
 
-    if (prototype->isNull())
+    if (prototype.isNull())
         return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(jsNull()));
     return new (unwrappedExec) JSInspectedObjectWrapper(unwrappedExec, unwrappedObject, JSQuarantinedObjectWrapper::createStructure(asObject(wrap(unwrappedExec, prototype))));
 }
@@ -96,11 +96,11 @@ JSInspectedObjectWrapper::~JSInspectedObjectWrapper()
     }
 }
 
-JSValuePtr JSInspectedObjectWrapper::prepareIncomingValue(ExecState*, JSValuePtr value) const
+JSValue JSInspectedObjectWrapper::prepareIncomingValue(ExecState*, JSValue value) const
 {
     // The Inspector is only allowed to pass primitive values and wrapped objects to objects from the inspected page.
 
-    if (!value->isObject())
+    if (!value.isObject())
         return value;
 
     JSQuarantinedObjectWrapper* wrapper = asWrapper(value);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.h
index 273c0b0..201feb6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectedObjectWrapper.h
@@ -32,7 +32,7 @@ namespace WebCore {
 
     class JSInspectedObjectWrapper : public JSQuarantinedObjectWrapper {
     public:
-        static JSC::JSValuePtr wrap(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue);
+        static JSC::JSValue wrap(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue);
         virtual ~JSInspectedObjectWrapper();
 
         static const JSC::ClassInfo s_info;
@@ -48,8 +48,8 @@ namespace WebCore {
         virtual bool allowsCallAsFunction() const { return true; }
         virtual bool allowsGetPropertyNames() const { return true; }
 
-        virtual JSC::JSValuePtr prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const;
-        virtual JSC::JSValuePtr wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
+        virtual JSC::JSValue prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const;
+        virtual JSC::JSValue wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
 
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     };
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
index 8e13e42..0e14109 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.cpp
@@ -33,7 +33,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSInspectorCallbackWrapper)
+ASSERT_CLASS_FITS_IN_CELL(JSInspectorCallbackWrapper);
 
 typedef HashMap<JSObject*, JSInspectorCallbackWrapper*> WrapperMap;
 
@@ -53,9 +53,9 @@ static Structure* leakInspectorCallbackWrapperStructure()
     return structure;
 }
 
-JSValuePtr JSInspectorCallbackWrapper::wrap(ExecState* unwrappedExec, JSValuePtr unwrappedValue)
+JSValue JSInspectorCallbackWrapper::wrap(ExecState* unwrappedExec, JSValue unwrappedValue)
 {
-    if (!unwrappedValue->isObject())
+    if (!unwrappedValue.isObject())
         return unwrappedValue;
 
     JSObject* unwrappedObject = asObject(unwrappedValue);
@@ -66,10 +66,10 @@ JSValuePtr JSInspectorCallbackWrapper::wrap(ExecState* unwrappedExec, JSValuePtr
     if (JSInspectorCallbackWrapper* wrapper = wrappers().get(unwrappedObject))
         return wrapper;
 
-    JSValuePtr prototype = unwrappedObject->prototype();
-    ASSERT(prototype->isNull() || prototype->isObject());
+    JSValue prototype = unwrappedObject->prototype();
+    ASSERT(prototype.isNull() || prototype.isObject());
 
-    if (prototype->isNull()) {
+    if (prototype.isNull()) {
         static Structure* structure = leakInspectorCallbackWrapperStructure();
         return new (unwrappedExec) JSInspectorCallbackWrapper(unwrappedExec, unwrappedObject, structure);
     }
@@ -88,7 +88,7 @@ JSInspectorCallbackWrapper::~JSInspectorCallbackWrapper()
     wrappers().remove(unwrappedObject());
 }
 
-JSValuePtr JSInspectorCallbackWrapper::prepareIncomingValue(ExecState* unwrappedExec, JSValuePtr unwrappedValue) const
+JSValue JSInspectorCallbackWrapper::prepareIncomingValue(ExecState* unwrappedExec, JSValue unwrappedValue) const
 {
     if (JSQuarantinedObjectWrapper* wrapper = asWrapper(unwrappedValue)) {
         // The only time a wrapper should be passed into a JSInspectorCallbackWrapper is when a client-side storage callback
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.h
index 49157c0..cfc2fb6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorCallbackWrapper.h
@@ -32,7 +32,7 @@ namespace WebCore {
 
     class JSInspectorCallbackWrapper : public JSQuarantinedObjectWrapper {
     public:
-        static JSC::JSValuePtr wrap(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue);
+        static JSC::JSValue wrap(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue);
 
         virtual ~JSInspectorCallbackWrapper();
 
@@ -44,8 +44,8 @@ namespace WebCore {
 
         virtual bool allowsCallAsFunction() const { return true; }
 
-        virtual JSC::JSValuePtr prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const;
-        virtual JSC::JSValuePtr wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
+        virtual JSC::JSValue prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const;
+        virtual JSC::JSValue wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const { return wrap(unwrappedExec, unwrappedValue); }
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorControllerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorControllerCustom.cpp
new file mode 100644
index 0000000..b06c9e9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSInspectorControllerCustom.cpp
@@ -0,0 +1,298 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSInspectorController.h"
+
+#include "Console.h"
+#if ENABLE(DATABASE)
+#include "Database.h"
+#include "JSDatabase.h"
+#endif
+#include "ExceptionCode.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "InspectorController.h"
+#include "InspectorResource.h"
+#include "JSDOMWindow.h"
+#include "JSInspectedObjectWrapper.h"
+#include "JSInspectorCallbackWrapper.h"
+#include "JSNode.h"
+#include "JSRange.h"
+#include "Node.h"
+#include "Page.h"
+#include "TextIterator.h"
+#include "VisiblePosition.h"
+#include <runtime/JSArray.h>
+#include <runtime/JSLock.h>
+#include <wtf/Vector.h>
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+#include "JavaScriptCallFrame.h"
+#include "JavaScriptDebugServer.h"
+#include "JavaScriptProfile.h"
+#include "JSJavaScriptCallFrame.h"
+#include <profiler/Profile.h>
+#include <profiler/Profiler.h>
+#endif
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue JSInspectorController::highlightDOMNode(JSC::ExecState*, const JSC::ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
+    if (!wrapper)
+        return jsUndefined();
+
+    Node* node = toNode(wrapper->unwrappedObject());
+    if (!node)
+        return jsUndefined();
+
+    impl()->highlight(node);
+
+    return jsUndefined();
+}
+
+JSValue JSInspectorController::getResourceDocumentNode(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    bool ok = false;
+    unsigned identifier = args.at(0).toUInt32(exec, ok);
+    if (!ok)
+        return jsUndefined();
+
+    RefPtr<InspectorResource> resource = impl()->resources().get(identifier);
+    ASSERT(resource);
+    if (!resource)
+        return jsUndefined();
+
+    Frame* frame = resource->frame();
+    Document* document = frame->document();
+
+    if (document->isPluginDocument() || document->isImageDocument() || document->isMediaDocument())
+        return jsUndefined();
+
+    ExecState* resourceExec = toJSDOMWindowShell(frame)->window()->globalExec();
+
+    JSLock lock(false);
+    return JSInspectedObjectWrapper::wrap(resourceExec, toJS(resourceExec, document));
+}
+
+JSValue JSInspectorController::search(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 2)
+        return jsUndefined();
+
+    Node* node = toNode(args.at(0));
+    if (!node)
+        return jsUndefined();
+
+    String target = args.at(1).toString(exec);
+    if (exec->hadException())
+        return jsUndefined();
+
+    MarkedArgumentBuffer result;
+    RefPtr<Range> searchRange(rangeOfContents(node));
+
+    ExceptionCode ec = 0;
+    do {
+        RefPtr<Range> resultRange(findPlainText(searchRange.get(), target, true, false));
+        if (resultRange->collapsed(ec))
+            break;
+
+        // A non-collapsed result range can in some funky whitespace cases still not
+        // advance the range's start position (4509328). Break to avoid infinite loop.
+        VisiblePosition newStart = endVisiblePosition(resultRange.get(), DOWNSTREAM);
+        if (newStart == startVisiblePosition(searchRange.get(), DOWNSTREAM))
+            break;
+
+        result.append(toJS(exec, resultRange.get()));
+
+        setStart(searchRange.get(), newStart);
+    } while (true);
+
+    return constructArray(exec, result);
+}
+
+#if ENABLE(DATABASE)
+JSValue JSInspectorController::databaseTableNames(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(args.at(0));
+    if (!wrapper)
+        return jsUndefined();
+
+    Database* database = toDatabase(wrapper->unwrappedObject());
+    if (!database)
+        return jsUndefined();
+
+    MarkedArgumentBuffer result;
+
+    Vector<String> tableNames = database->tableNames();
+    unsigned length = tableNames.size();
+    for (unsigned i = 0; i < length; ++i)
+        result.append(jsString(exec, tableNames[i]));
+
+    return constructArray(exec, result);
+}
+#endif
+
+JSValue JSInspectorController::inspectedWindow(ExecState*, const ArgList&)
+{
+    JSDOMWindow* inspectedWindow = toJSDOMWindow(impl()->inspectedPage()->mainFrame());
+    return JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), inspectedWindow);
+}
+
+JSValue JSInspectorController::setting(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    String key = args.at(0).toString(exec);
+    if (exec->hadException())
+        return jsUndefined();
+
+    const InspectorController::Setting& setting = impl()->setting(key);
+
+    switch (setting.type()) {
+        default:
+        case InspectorController::Setting::NoType:
+            return jsUndefined();
+        case InspectorController::Setting::StringType:
+            return jsString(exec, setting.string());
+        case InspectorController::Setting::DoubleType:
+            return jsNumber(exec, setting.doubleValue());
+        case InspectorController::Setting::IntegerType:
+            return jsNumber(exec, setting.integerValue());
+        case InspectorController::Setting::BooleanType:
+            return jsBoolean(setting.booleanValue());
+        case InspectorController::Setting::StringVectorType: {
+            MarkedArgumentBuffer stringsArray;
+            const Vector<String>& strings = setting.stringVector();
+            const unsigned length = strings.size();
+            for (unsigned i = 0; i < length; ++i)
+                stringsArray.append(jsString(exec, strings[i]));
+            return constructArray(exec, stringsArray);
+        }
+    }
+}
+
+JSValue JSInspectorController::setSetting(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 2)
+        return jsUndefined();
+
+    String key = args.at(0).toString(exec);
+    if (exec->hadException())
+        return jsUndefined();
+
+    InspectorController::Setting setting;
+
+    JSValue value = args.at(1);
+    if (value.isUndefined() || value.isNull()) {
+        // Do nothing. The setting is already NoType.
+        ASSERT(setting.type() == InspectorController::Setting::NoType);
+    } else if (value.isString())
+        setting.set(value.toString(exec));
+    else if (value.isNumber())
+        setting.set(value.toNumber(exec));
+    else if (value.isBoolean())
+        setting.set(value.toBoolean(exec));
+    else {
+        JSArray* jsArray = asArray(value);
+        if (!jsArray)
+            return jsUndefined();
+        Vector<String> strings;
+        for (unsigned i = 0; i < jsArray->length(); ++i) {
+            String item = jsArray->get(exec, i).toString(exec);
+            if (exec->hadException())
+                return jsUndefined();
+            strings.append(item);
+        }
+        setting.set(strings);
+    }
+
+    if (exec->hadException())
+        return jsUndefined();
+
+    impl()->setSetting(key, setting);
+
+    return jsUndefined();
+}
+
+JSValue JSInspectorController::wrapCallback(ExecState* exec, const ArgList& args)
+{
+    if (args.size() < 1)
+        return jsUndefined();
+
+    return JSInspectorCallbackWrapper::wrap(exec, args.at(0));
+}
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
+JSValue JSInspectorController::currentCallFrame(ExecState* exec, const ArgList&)
+{
+    JavaScriptCallFrame* callFrame = impl()->currentCallFrame();
+    if (!callFrame || !callFrame->isValid())
+        return jsUndefined();
+
+    // FIXME: I am not sure if this is actually needed. Can we just use exec?
+    ExecState* globalExec = callFrame->scopeChain()->globalObject()->globalExec();
+
+    JSLock lock(false);
+    return JSInspectedObjectWrapper::wrap(globalExec, toJS(exec, callFrame));
+}
+
+JSValue JSInspectorController::profiles(JSC::ExecState* exec, const JSC::ArgList&)
+{
+    JSLock lock(false);
+    MarkedArgumentBuffer result;
+    const Vector<RefPtr<Profile> >& profiles = impl()->profiles();
+
+    for (size_t i = 0; i < profiles.size(); ++i)
+        result.append(toJS(exec, profiles[i].get()));
+
+    return constructArray(exec, result);
+}
+
+#endif
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
index c3f89c3..08ecf2b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSJavaScriptCallFrameCustom.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JSJavaScriptCallFrame.h"
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include "JavaScriptCallFrame.h"
 #include <runtime/ArrayPrototype.h>
 
@@ -33,10 +35,10 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSJavaScriptCallFrame::evaluate(ExecState* exec, const ArgList& args)
+JSValue JSJavaScriptCallFrame::evaluate(ExecState* exec, const ArgList& args)
 {
-    JSValuePtr exception = noValue();
-    JSValuePtr result = impl()->evaluate(args.at(exec, 0)->toString(exec), exception);
+    JSValue exception;
+    JSValue result = impl()->evaluate(args.at(0).toString(exec), exception);
 
     if (exception)
         exec->setException(exception);
@@ -44,12 +46,12 @@ JSValuePtr JSJavaScriptCallFrame::evaluate(ExecState* exec, const ArgList& args)
     return result;
 }
 
-JSValuePtr JSJavaScriptCallFrame::thisObject(ExecState*) const
+JSValue JSJavaScriptCallFrame::thisObject(ExecState*) const
 {
     return impl()->thisObject() ? impl()->thisObject() : jsNull();
 }
 
-JSValuePtr JSJavaScriptCallFrame::type(ExecState* exec) const
+JSValue JSJavaScriptCallFrame::type(ExecState* exec) const
 {
     switch (impl()->type()) {
         case DebuggerCallFrame::FunctionType:
@@ -62,7 +64,7 @@ JSValuePtr JSJavaScriptCallFrame::type(ExecState* exec) const
     return jsNull();
 }
 
-JSValuePtr JSJavaScriptCallFrame::scopeChain(ExecState* exec) const
+JSValue JSJavaScriptCallFrame::scopeChain(ExecState* exec) const
 {
     if (!impl()->scopeChain())
         return jsNull();
@@ -74,7 +76,7 @@ JSValuePtr JSJavaScriptCallFrame::scopeChain(ExecState* exec) const
     // we must always have something in the scope chain
     ASSERT(iter != end);
 
-    ArgList list;
+    MarkedArgumentBuffer list;
     do {
         list.append(*iter);
         ++iter;
@@ -84,3 +86,5 @@ JSValuePtr JSJavaScriptCallFrame::scopeChain(ExecState* exec) const
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
new file mode 100644
index 0000000..f7c74ae
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.cpp
@@ -0,0 +1,129 @@
+/*
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All Rights Reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#include "config.h"
+#include "JSLazyEventListener.h"
+
+#include "Frame.h"
+#include "JSNode.h"
+#include <runtime/FunctionConstructor.h>
+#include <runtime/JSLock.h>
+#include <wtf/RefCountedLeakCounter.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+#ifndef NDEBUG
+static WTF::RefCountedLeakCounter eventListenerCounter("JSLazyEventListener");
+#endif
+
+JSLazyEventListener::JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
+    : JSEventListener(0, globalObject, true)
+    , m_functionName(functionName)
+    , m_eventParameterName(eventParameterName)
+    , m_code(code)
+    , m_parsed(false)
+    , m_lineNumber(lineNumber)
+    , m_originalNode(node)
+{
+    // We don't retain the original node because we assume it
+    // will stay alive as long as this handler object is around
+    // and we need to avoid a reference cycle. If JS transfers
+    // this handler to another node, parseCode will be called and
+    // then originalNode is no longer needed.
+
+    // A JSLazyEventListener can be created with a line number of zero when it is created with
+    // a setAttribute call from JavaScript, so make the line number 1 in that case.
+    if (m_lineNumber == 0)
+        m_lineNumber = 1;
+
+#ifndef NDEBUG
+    eventListenerCounter.increment();
+#endif
+}
+
+JSLazyEventListener::~JSLazyEventListener()
+{
+#ifndef NDEBUG
+    eventListenerCounter.decrement();
+#endif
+}
+
+JSObject* JSLazyEventListener::jsFunction() const
+{
+    parseCode();
+    return m_jsFunction;
+}
+
+void JSLazyEventListener::parseCode() const
+{
+    if (m_parsed)
+        return;
+
+    if (m_globalObject->scriptExecutionContext()->isDocument()) {
+        JSDOMWindow* window = static_cast<JSDOMWindow*>(m_globalObject);
+        Frame* frame = window->impl()->frame();
+        if (!frame)
+            return;
+        // FIXME: Is this check needed for non-Document contexts?
+        ScriptController* script = frame->script();
+        if (!script->isEnabled() || script->isPaused())
+            return;
+    }
+
+    m_parsed = true;
+
+    ExecState* exec = m_globalObject->globalExec();
+
+    MarkedArgumentBuffer args;
+    UString sourceURL(m_globalObject->scriptExecutionContext()->url().string());
+    args.append(jsNontrivialString(exec, m_eventParameterName));
+    args.append(jsString(exec, m_code));
+
+    // FIXME: Passing the document's URL to construct is not always correct, since this event listener might
+    // have been added with setAttribute from a script, and we should pass String() in that case.
+    m_jsFunction = constructFunction(exec, args, Identifier(exec, m_functionName), sourceURL, m_lineNumber); // FIXME: is globalExec ok?
+
+    JSFunction* listenerAsFunction = static_cast<JSFunction*>(m_jsFunction);
+
+    if (exec->hadException()) {
+        exec->clearException();
+
+        // failed to parse, so let's just make this listener a no-op
+        m_jsFunction = 0;
+    } else if (m_originalNode) {
+        // Add the event's home element to the scope
+        // (and the document, and the form - see JSHTMLElement::eventHandlerScope)
+        ScopeChain scope = listenerAsFunction->scope();
+
+        JSValue thisObj = toJS(exec, m_originalNode);
+        if (thisObj.isObject()) {
+            static_cast<JSNode*>(asObject(thisObj))->pushEventHandlerScope(exec, scope);
+            listenerAsFunction->setScope(scope);
+        }
+    }
+
+    // Since we only parse once, there's no need to keep data used for parsing around anymore.
+    m_functionName = String();
+    m_code = String();
+    m_eventParameterName = String();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h
new file mode 100644
index 0000000..a5304cf
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLazyEventListener.h
@@ -0,0 +1,56 @@
+/*
+ *  Copyright (C) 2001 Peter Kelly (pmk@post.com)
+ *  Copyright (C) 2003, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Lesser General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Lesser General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Lesser General Public
+ *  License along with this library; if not, write to the Free Software
+ *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
+ */
+
+#ifndef JSLazyEventListener_h
+#define JSLazyEventListener_h
+
+#include "JSEventListener.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+    class Node;
+
+    class JSLazyEventListener : public JSEventListener {
+    public:
+        static PassRefPtr<JSLazyEventListener> create(const String& functionName, const String& eventParameterName, const String& code, JSDOMGlobalObject* globalObject, Node* node, int lineNumber)
+        {
+            return adoptRef(new JSLazyEventListener(functionName, eventParameterName, code, globalObject, node, lineNumber));
+        }
+        virtual ~JSLazyEventListener();
+
+    private:
+        JSLazyEventListener(const String& functionName, const String& eventParameterName, const String& code, JSDOMGlobalObject*, Node*, int lineNumber);
+
+        virtual JSC::JSObject* jsFunction() const;
+        virtual bool wasCreatedFromMarkup() const { return true; }
+
+        void parseCode() const;
+
+        mutable String m_functionName;
+        mutable String m_eventParameterName;
+        mutable String m_code;
+        mutable bool m_parsed;
+        int m_lineNumber;
+        Node* m_originalNode;
+    };
+
+} // namespace WebCore
+
+#endif // JSEventListener_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
index b24a62c..e4f1653 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSLocationCustom.cpp
@@ -37,22 +37,22 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr nonCachingStaticReplaceFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticReplaceFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
-    return new (exec) PrototypeFunction(exec, 1, propertyName, jsLocationPrototypeFunctionReplace);
+    return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 1, propertyName, jsLocationPrototypeFunctionReplace);
 }
 
-JSValuePtr nonCachingStaticReloadFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticReloadFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
-    return new (exec) PrototypeFunction(exec, 0, propertyName, jsLocationPrototypeFunctionReload);
+    return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 0, propertyName, jsLocationPrototypeFunctionReload);
 }
 
-JSValuePtr nonCachingStaticAssignFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
+static JSValue nonCachingStaticAssignFunctionGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot&)
 {
-    return new (exec) PrototypeFunction(exec, 1, propertyName, jsLocationPrototypeFunctionAssign);
+    return new (exec) NativeFunctionWrapper(exec, exec->lexicalGlobalObject()->prototypeFunctionStructure(), 1, propertyName, jsLocationPrototypeFunctionAssign);
 }
 
-bool JSLocation::customGetOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+bool JSLocation::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
     Frame* frame = impl()->frame();
     if (!frame) {
@@ -61,7 +61,7 @@ bool JSLocation::customGetOwnPropertySlot(ExecState* exec, const Identifier& pro
     }
 
     // When accessing Location cross-domain, functions are always the native built-in ones.
-    // See JSDOMWindow::customGetOwnPropertySlot for additional details.
+    // See JSDOMWindow::getOwnPropertySlotDelegate for additional details.
 
     // Our custom code is only needed to implement the Window cross-domain scheme, so if access is
     // allowed, return false so the normal lookup will take place.
@@ -76,7 +76,7 @@ bool JSLocation::customGetOwnPropertySlot(ExecState* exec, const Identifier& pro
             slot.setCustom(this, nonCachingStaticReplaceFunctionGetter);
             return true;
         } else if (entry->function() == jsLocationPrototypeFunctionReload) {
-            slot.setCustom(this, nonCachingStaticReplaceFunctionGetter);
+            slot.setCustom(this, nonCachingStaticReloadFunctionGetter);
             return true;
         } else if (entry->function() == jsLocationPrototypeFunctionAssign) {
             slot.setCustom(this, nonCachingStaticAssignFunctionGetter);
@@ -93,12 +93,15 @@ bool JSLocation::customGetOwnPropertySlot(ExecState* exec, const Identifier& pro
     return true;
 }
 
-bool JSLocation::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+bool JSLocation::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     Frame* frame = impl()->frame();
     if (!frame)
         return true;
 
+    if (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf)
+        return true;
+
     bool sameDomainAccess = allowsAccessFromFrame(exec, frame);
 
     const HashEntry* entry = JSLocation::s_info.propHashTable(exec)->entry(exec, propertyName);
@@ -125,185 +128,199 @@ bool JSLocation::deleteProperty(ExecState* exec, const Identifier& propertyName)
     return Base::deleteProperty(exec, propertyName);
 }
 
-bool JSLocation::customGetPropertyNames(ExecState* exec, PropertyNameArray&)
+void JSLocation::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     // Only allow the location object to enumerated by frames in the same origin.
     if (!allowsAccessFromFrame(exec, impl()->frame()))
-        return true;
-    return false;
+        return;
+    Base::getPropertyNames(exec, propertyNames);
 }
 
-static void navigateIfAllowed(ExecState* exec, Frame* frame, const KURL& url, bool lockHistory)
+void JSLocation::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
 {
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!url.protocolIs("javascript") || allowsAccessFromFrame(exec, frame)) {
-        bool userGesture = activeFrame->script()->processingUserGesture();
-        frame->loader()->scheduleLocationChange(url.string(), activeFrame->loader()->outgoingReferrer(), lockHistory, userGesture);
-    }
+    if (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf)
+        return;
+    Base::defineGetter(exec, propertyName, getterFunction);
 }
 
-void JSLocation::setHref(ExecState* exec, JSValuePtr value)
+static void navigateIfAllowed(ExecState* exec, Frame* frame, const KURL& url, bool lockHistory, bool lockBackForwardList)
+{
+    Frame* lexicalFrame = toLexicalFrame(exec);
+    if (!lexicalFrame)
+        return;
+
+    if (!protocolIsJavaScript(url) || allowsAccessFromFrame(exec, frame))
+        frame->loader()->scheduleLocationChange(url.string(), lexicalFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, processingUserGesture(exec));
+}
+
+void JSLocation::setHref(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!activeFrame)
+    if (!shouldAllowNavigation(exec, frame))
         return;
-    if (!activeFrame->loader()->shouldAllowNavigation(frame))
+
+    KURL url = completeURL(exec, value.toString(exec));
+    if (url.isNull())
         return;
 
-    KURL url = activeFrame->loader()->completeURL(value->toString(exec));
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setProtocol(ExecState* exec, JSValuePtr value)
+void JSLocation::setProtocol(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
-    url.setProtocol(value->toString(exec));
+    url.setProtocol(value.toString(exec));
 
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setHost(ExecState* exec, JSValuePtr value)
+void JSLocation::setHost(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
-    url.setHostAndPort(value->toString(exec));
+    url.setHostAndPort(value.toString(exec));
 
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setHostname(ExecState* exec, JSValuePtr value)
+void JSLocation::setHostname(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
-    url.setHost(value->toString(exec));
+    url.setHost(value.toString(exec));
 
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setPort(ExecState* exec, JSValuePtr value)
+void JSLocation::setPort(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
     // FIXME: Could make this a little less ugly if String provided a toUnsignedShort function.
-    const UString& portString = value->toString(exec);
+    const UString& portString = value.toString(exec);
     int port = charactersToInt(portString.data(), portString.size());
     if (port < 0 || port > 0xFFFF)
         port = 0;
     url.setPort(port);
 
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setPathname(ExecState* exec, JSValuePtr value)
+void JSLocation::setPathname(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
-    url.setPath(value->toString(exec));
+    url.setPath(value.toString(exec));
 
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setSearch(ExecState* exec, JSValuePtr value)
+void JSLocation::setSearch(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
-    url.setQuery(value->toString(exec));
+    url.setQuery(value.toString(exec));
 
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-void JSLocation::setHash(ExecState* exec, JSValuePtr value)
+void JSLocation::setHash(ExecState* exec, JSValue value)
 {
     Frame* frame = impl()->frame();
     ASSERT(frame);
 
     KURL url = frame->loader()->url();
     String oldRef = url.ref();
-    String str = value->toString(exec);
+    String str = value.toString(exec);
     if (str.startsWith("#"))
         str = str.substring(1);
     if (oldRef == str || (oldRef.isNull() && str.isEmpty()))
         return;
     url.setRef(str);
 
-    navigateIfAllowed(exec, frame, url, false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
-JSValuePtr JSLocation::replace(ExecState* exec, const ArgList& args)
+JSValue JSLocation::replace(ExecState* exec, const ArgList& args)
 {
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
 
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!activeFrame) 
+    if (!shouldAllowNavigation(exec, frame))
         return jsUndefined();
-    if (!activeFrame->loader()->shouldAllowNavigation(frame))
+
+    KURL url = completeURL(exec, args.at(0).toString(exec));
+    if (url.isNull())
         return jsUndefined();
 
-    navigateIfAllowed(exec, frame, activeFrame->loader()->completeURL(args.at(exec, 0)->toString(exec)), true);
+    navigateIfAllowed(exec, frame, url, true, true);
     return jsUndefined();
 }
 
-JSValuePtr JSLocation::reload(ExecState* exec, const ArgList&)
+JSValue JSLocation::reload(ExecState* exec, const ArgList&)
 {
     Frame* frame = impl()->frame();
-    if (!frame)
-        return jsUndefined();
-
-    JSDOMWindow* window = toJSDOMWindow(frame);
-    if (!window->allowsAccessFrom(exec))
+    if (!frame || !allowsAccessFromFrame(exec, frame))
         return jsUndefined();
 
-    if (!frame->loader()->url().protocolIs("javascript") || (window && window->allowsAccessFrom(exec))) {
-        bool userGesture = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame()->script()->processingUserGesture();
-        frame->loader()->scheduleRefresh(userGesture);
-    }
+    if (!protocolIsJavaScript(frame->loader()->url()))
+        frame->loader()->scheduleRefresh(processingUserGesture(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSLocation::assign(ExecState* exec, const ArgList& args)
+JSValue JSLocation::assign(ExecState* exec, const ArgList& args)
 {
     Frame* frame = impl()->frame();
     if (!frame)
         return jsUndefined();
 
-    Frame* activeFrame = asJSDOMWindow(exec->dynamicGlobalObject())->impl()->frame();
-    if (!activeFrame)
+    if (!shouldAllowNavigation(exec, frame))
         return jsUndefined();
-    if (!activeFrame->loader()->shouldAllowNavigation(frame))
+
+    KURL url = completeURL(exec, args.at(0).toString(exec));
+    if (url.isNull())
         return jsUndefined();
 
     // We want a new history item if this JS was called via a user gesture
-    navigateIfAllowed(exec, frame, activeFrame->loader()->completeURL(args.at(exec, 0)->toString(exec)), false);
+    navigateIfAllowed(exec, frame, url, !frame->script()->anyPageIsProcessingUserGesture(), false);
     return jsUndefined();
 }
 
-JSValuePtr JSLocation::toString(ExecState* exec, const ArgList&)
+JSValue JSLocation::toString(ExecState* exec, const ArgList&)
 {
     Frame* frame = impl()->frame();
-    if (!frame)
-        return jsUndefined();
-    if (!allowsAccessFromFrame(exec, frame))
+    if (!frame || !allowsAccessFromFrame(exec, frame))
         return jsUndefined();
 
     return jsString(exec, impl()->toString());
 }
 
+bool JSLocationPrototype::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue, PutPropertySlot&)
+{
+    return (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf);
+}
+
+void JSLocationPrototype::defineGetter(ExecState* exec, const Identifier& propertyName, JSObject* getterFunction)
+{
+    if (propertyName == exec->propertyNames().toString || propertyName == exec->propertyNames().valueOf)
+        return;
+    Base::defineGetter(exec, propertyName, getterFunction);
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp
index 6c11bea..495bd53 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.cpp
@@ -29,7 +29,6 @@
 #include "Document.h"
 #include "JSDocument.h"
 #include "JSMessageChannel.h"
-#include "JSWorkerContext.h"
 #include "MessageChannel.h"
 
 using namespace JSC;
@@ -38,26 +37,22 @@ namespace WebCore {
 
 const ClassInfo JSMessageChannelConstructor::s_info = { "MessageChannelConstructor", 0, 0, 0 };
 
-JSMessageChannelConstructor::JSMessageChannelConstructor(ExecState* exec, ScriptExecutionContext* scriptExecutionContext)
+JSMessageChannelConstructor::JSMessageChannelConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
     : DOMObject(JSMessageChannelConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
-    , m_scriptExecutionContext(scriptExecutionContext)
+    , m_globalObject(globalObject)
 {
-    if (m_scriptExecutionContext->isDocument())
-        m_contextWrapper = toJS(exec, static_cast<Document*>(scriptExecutionContext));
-#if ENABLE(WORKERS)
-    else if (m_scriptExecutionContext->isWorkerContext())
-        m_contextWrapper = toJSDOMGlobalObject(scriptExecutionContext);
-#endif
-    else
-        ASSERT_NOT_REACHED();
-
-    putDirect(exec->propertyNames().prototype, JSMessageChannelPrototype::self(exec), None);
+    putDirect(exec->propertyNames().prototype, JSMessageChannelPrototype::self(exec, exec->lexicalGlobalObject()), None);
 }
 
 JSMessageChannelConstructor::~JSMessageChannelConstructor()
 {
 }
 
+ScriptExecutionContext* JSMessageChannelConstructor::scriptExecutionContext() const
+{
+    return m_globalObject->scriptExecutionContext();
+}
+
 ConstructType JSMessageChannelConstructor::getConstructData(ConstructData& constructData)
 {
     constructData.native.function = construct;
@@ -66,14 +61,18 @@ ConstructType JSMessageChannelConstructor::getConstructData(ConstructData& const
 
 JSObject* JSMessageChannelConstructor::construct(ExecState* exec, JSObject* constructor, const ArgList&)
 {
-    return asObject(toJS(exec, MessageChannel::create(static_cast<JSMessageChannelConstructor*>(constructor)->scriptExecutionContext())));
+    ScriptExecutionContext* context = static_cast<JSMessageChannelConstructor*>(constructor)->scriptExecutionContext();
+    if (!context)
+        return throwError(exec, ReferenceError, "MessageChannel constructor associated document is unavailable");
+
+    return asObject(toJS(exec, MessageChannel::create(context)));
 }
 
 void JSMessageChannelConstructor::mark()
 {
     DOMObject::mark();
-    if (!m_contextWrapper->marked())
-        m_contextWrapper->mark();
+    if (!m_globalObject->marked())
+        m_globalObject->mark();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.h
index 614f6ae..90c29a3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessageChannelConstructor.h
@@ -32,12 +32,12 @@ namespace WebCore {
 
     class JSMessageChannelConstructor : public DOMObject {
     public:
-        JSMessageChannelConstructor(JSC::ExecState*, ScriptExecutionContext*);
+        JSMessageChannelConstructor(JSC::ExecState*, JSDOMGlobalObject*);
         virtual ~JSMessageChannelConstructor();
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
         static const JSC::ClassInfo s_info;
 
-        ScriptExecutionContext* scriptExecutionContext() const { return m_scriptExecutionContext; }
+        ScriptExecutionContext* scriptExecutionContext() const;
 
         virtual bool implementsHasInstance() const { return true; }
         static JSC::JSObject* construct(JSC::ExecState*, JSC::JSObject*, const JSC::ArgList&);
@@ -46,8 +46,7 @@ namespace WebCore {
         virtual void mark();
 
     private:
-        ScriptExecutionContext* m_scriptExecutionContext;
-        JSC::JSValuePtr m_contextWrapper;
+        JSDOMGlobalObject* m_globalObject;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
index d0615de..bfac375 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMessagePortCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,13 +42,10 @@ void JSMessagePort::mark()
 {
     DOMObject::mark();
 
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onmessage()))
-        listener->mark();
+    markIfNotNull(m_impl->onmessage());
 
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onclose()))
-        listener->mark();
-
-    if (MessagePort* entangledPort = m_impl->entangledPort()) {
+    // If we have a locally entangled port, we can directly mark it as reachable. Ports that are remotely entangled are marked in-use by markActiveObjectsForContext().
+    if (MessagePort* entangledPort = m_impl->locallyEntangledPort()) {
         DOMObject* wrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), entangledPort);
         if (wrapper && !wrapper->marked())
             wrapper->mark();
@@ -58,42 +55,32 @@ void JSMessagePort::mark()
     typedef MessagePort::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) {
-            JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(vecIter->get());
-            listener->mark();
-        }
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) 
+            (*vecIter)->markJSFunction();
     }
 }
 
-JSValuePtr JSMessagePort::startConversation(ExecState* exec, const ArgList& args)
-{
-    JSDOMGlobalObject* globalObject = static_cast<JSDOMGlobalObject*>(exec->lexicalGlobalObject());
-    const UString& message = args.at(exec, 0)->toString(exec);
-
-    return toJS(exec, impl()->startConversation(globalObject->scriptExecutionContext(), message).get());
-}
-
-JSValuePtr JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSMessagePort::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSUnprotectedEventListener> listener = globalObject->findOrCreateJSUnprotectedEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSMessagePort::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSMessagePort::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSUnprotectedEventListener* listener = globalObject->findJSUnprotectedEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp
index 5338d5b..c90dadd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSMimeTypeArrayCustom.cpp
@@ -33,7 +33,7 @@ bool JSMimeTypeArray::canGetItemsForName(ExecState*, MimeTypeArray* mimeTypeArra
     return mimeTypeArray->canGetItemsForName(propertyName);
 }
 
-JSValuePtr JSMimeTypeArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSMimeTypeArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSMimeTypeArray* thisObj = static_cast<JSMimeTypeArray*>(asObject(slot.slotBase()));
     return toJS(exec, thisObj->impl()->namedItem(propertyName));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
index e7b0764..7bd95b4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodeMapCustom.cpp
@@ -41,7 +41,7 @@ bool JSNamedNodeMap::canGetItemsForName(ExecState*, NamedNodeMap* impl, const Id
     return impl->getNamedItem(propertyName);
 }
 
-JSValuePtr JSNamedNodeMap::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSNamedNodeMap::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSNamedNodeMap* thisObj = static_cast<JSNamedNodeMap*>(asObject(slot.slotBase()));
     return toJS(exec, thisObj->impl()->getNamedItem(propertyName));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp
index 8a7ee0e..93a8937 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.cpp
@@ -29,13 +29,13 @@
 #include "AtomicString.h"
 #include "Element.h"
 #include "JSNode.h"
-#include "NamedAttrMap.h"
+#include "NamedNodeMap.h"
 
 namespace WebCore {
 
 using namespace JSC;
 
-ASSERT_CLASS_FITS_IN_CELL(JSNamedNodesCollection)
+ASSERT_CLASS_FITS_IN_CELL(JSNamedNodesCollection);
 
 const ClassInfo JSNamedNodesCollection::s_info = { "Collection", 0, 0, 0 };
 
@@ -48,13 +48,13 @@ JSNamedNodesCollection::JSNamedNodesCollection(ExecState* exec, const Vector<Ref
 {
 }
 
-JSValuePtr JSNamedNodesCollection::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSNamedNodesCollection::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSNamedNodesCollection* thisObj = static_cast<JSNamedNodesCollection*>(asObject(slot.slotBase()));
     return jsNumber(exec, thisObj->m_nodes->size());
 }
 
-JSValuePtr JSNamedNodesCollection::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue JSNamedNodesCollection::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSNamedNodesCollection *thisObj = static_cast<JSNamedNodesCollection*>(asObject(slot.slotBase()));
     return toJS(exec, (*thisObj->m_nodes)[slot.index()].get());
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h
index 19f194b..3bbc102 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNamedNodesCollection.h
@@ -44,19 +44,19 @@ namespace WebCore {
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
         static const JSC::ClassInfo s_info;
 
-        static JSC::ObjectPrototype* createPrototype(JSC::ExecState* exec)
+        static JSC::ObjectPrototype* createPrototype(JSC::ExecState*, JSC::JSGlobalObject* globalObject)
         {
-            return exec->lexicalGlobalObject()->objectPrototype();
+            return globalObject->objectPrototype();
         }
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
         {
             return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
         }
 
     private:
-        static JSC::JSValuePtr lengthGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-        static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+        static JSC::JSValue lengthGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+        static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
         OwnPtr<Vector<RefPtr<Node> > > m_nodes;
     };
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNavigatorCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNavigatorCustom.cpp
index 2287426..ea6cceb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNavigatorCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNavigatorCustom.cpp
@@ -2,7 +2,7 @@
  *  Copyright (C) 2000 Harri Porten (porten@kde.org)
  *  Copyright (c) 2000 Daniel Molkentin (molkentin@kde.org)
  *  Copyright (c) 2000 Stefan Schimanski (schimmi@kde.org)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All Rights Reserved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All Rights Reserved.
  *  Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  *  This library is free software; you can redistribute it and/or
@@ -23,96 +23,12 @@
 #include "config.h"
 #include "JSNavigator.h"
 
-#include "Frame.h"
-#include "FrameLoader.h"
-#include "KURL.h"
 #include "Navigator.h"
-#include "Settings.h"
 
 namespace WebCore {
 
 using namespace JSC;
 
-static bool needsYouTubeQuirk(ExecState*, Frame*);
-
-#if 1
-
-static inline bool needsYouTubeQuirk(ExecState*, Frame*)
-{
-    return false;
-}
-
-#else
-
-static bool needsYouTubeQuirk(ExecState* exec, Frame* frame)
-{
-    // This quirk works around a mistaken check in an ad at youtube.com.
-    // There's a function called isSafari that returns false if the function
-    // called isWindows returns true; thus the site malfunctions with Windows Safari.
-
-    // Do the quirk only if the function's name is "isWindows".
-    JSFunction* function = exec->function();
-    if (!function)
-        return false;
-    DEFINE_STATIC_LOCAL(const Identifier, isWindowsFunctionName, (exec, "isWindows"));
-    if (function->functionName() != isWindowsFunctionName)
-        return false;
-
-    // Do the quirk only if the function is called by an "isSafari" function.
-    // However, that function is not itself named -- it is stored in the isSafari
-    // property, though, so that's how we recognize it.
-    ExecState* callingExec = exec->callingExecState();
-    if (!callingExec)
-        return false;
-    JSFunction* callingFunction = callingExec->function();
-    if (!callingFunction)
-        return false;
-    JSObject* thisObject = callingExec->thisValue();
-    if (!thisObject)
-        return false;
-    DEFINE_STATIC_LOCAL(const Identifier, isSafariFunction, (exec, "isSafari"));
-    JSValuePtr isSafariFunction = thisObject->getDirect(isSafariFunctionName);
-    if (isSafariFunction != callingFunction)
-        return false;
-
-    Document* document = frame->document();
-    // FIXME: The document is never null, so we should remove this check along with the
-    // other similar ones in this file when we are absolutely sure it's safe.
-    if (!document)
-        return false;
-
-    // Do the quirk only on the front page of the global version of YouTube.
-    const KURL& url = document->url();
-    if (url.host() != "youtube.com" && url.host() != "www.youtube.com")
-        return false;
-    if (url.path() != "/")
-        return false;
-
-    // As with other site-specific quirks, allow website developers to turn this off.
-    // In theory, this allows website developers to check if their fixes are effective.
-    Settings* settings = frame->settings();
-    if (!settings)
-        return false;
-    if (!settings->needsSiteSpecificQuirks())
-        return false;
-
-    return true;
-}
-
-#endif
-
-JSValuePtr JSNavigator::appVersion(ExecState* exec) const
-{
-    Navigator* imp = static_cast<Navigator*>(impl());
-    Frame* frame = imp->frame();
-    if (!frame)
-        return jsString(exec, "");
-
-    if (needsYouTubeQuirk(exec, frame))
-        return jsString(exec, "");
-    return jsString(exec, imp->appVersion());
-}
-
 void JSNavigator::mark()
 {
     Base::mark();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
index 2b4d6d4..79ac6b7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeCustom.cpp
@@ -43,6 +43,7 @@
 #include "JSDocumentType.h"
 #include "JSEntity.h"
 #include "JSEntityReference.h"
+#include "JSEventListener.h"
 #include "JSHTMLElement.h"
 #include "JSHTMLElementWrapperFactory.h"
 #include "JSNotation.h"
@@ -51,6 +52,7 @@
 #include "Node.h"
 #include "Notation.h"
 #include "ProcessingInstruction.h"
+#include "RegisteredEventListener.h"
 #include "Text.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
@@ -66,62 +68,90 @@ namespace WebCore {
 
 typedef int ExpectionCode;
 
-JSValuePtr JSNode::insertBefore(ExecState* exec, const ArgList& args)
+JSValue JSNode::insertBefore(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    bool ok = impl()->insertBefore(toNode(args.at(exec, 0)), toNode(args.at(exec, 1)), ec, true);
+    bool ok = impl()->insertBefore(toNode(args.at(0)), toNode(args.at(1)), ec, true);
     setDOMException(exec, ec);
     if (ok)
-        return args.at(exec, 0);
+        return args.at(0);
     return jsNull();
 }
 
-JSValuePtr JSNode::replaceChild(ExecState* exec, const ArgList& args)
+JSValue JSNode::replaceChild(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    bool ok = impl()->replaceChild(toNode(args.at(exec, 0)), toNode(args.at(exec, 1)), ec, true);
+    bool ok = impl()->replaceChild(toNode(args.at(0)), toNode(args.at(1)), ec, true);
     setDOMException(exec, ec);
     if (ok)
-        return args.at(exec, 1);
+        return args.at(1);
     return jsNull();
 }
 
-JSValuePtr JSNode::removeChild(ExecState* exec, const ArgList& args)
+JSValue JSNode::removeChild(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    bool ok = impl()->removeChild(toNode(args.at(exec, 0)), ec);
+    bool ok = impl()->removeChild(toNode(args.at(0)), ec);
     setDOMException(exec, ec);
     if (ok)
-        return args.at(exec, 0);
+        return args.at(0);
     return jsNull();
 }
 
-JSValuePtr JSNode::appendChild(ExecState* exec, const ArgList& args)
+JSValue JSNode::appendChild(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    bool ok = impl()->appendChild(toNode(args.at(exec, 0)), ec, true);
+    bool ok = impl()->appendChild(toNode(args.at(0)), ec, true);
     setDOMException(exec, ec);
     if (ok)
-        return args.at(exec, 0);
+        return args.at(0);
     return jsNull();
 }
 
+JSValue JSNode::addEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1)))
+        impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
+
+    return jsUndefined();
+}
+
+JSValue JSNode::removeEventListener(ExecState* exec, const ArgList& args)
+{
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
+    if (!globalObject)
+        return jsUndefined();
+
+    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(1)))
+        impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
+
+    return jsUndefined();
+}
+
+void JSNode::pushEventHandlerScope(ExecState*, ScopeChain&) const
+{
+}
+
 void JSNode::mark()
 {
     ASSERT(!marked());
 
     Node* node = m_impl.get();
 
-    // Nodes in the document are kept alive by JSDocument::mark,
-    // so we have no special responsibilities and can just call the base class here.
+    // Nodes in the document are kept alive by JSDocument::mark, so, if we're in
+    // the document, we need to mark the document, but we don't need to explicitly
+    // mark any other nodes.
     if (node->inDocument()) {
-        // But if the document isn't marked we have to mark it to ensure that
-        // nodes reachable from this one are also marked
+        DOMObject::mark();
+        markEventListeners(node->eventListeners());
         if (Document* doc = node->ownerDocument())
             if (DOMObject* docWrapper = getCachedDOMObjectWrapper(*Heap::heap(this)->globalData(), doc))
                 if (!docWrapper->marked())
                     docWrapper->mark();
-        DOMObject::mark();
         return;
     }
 
@@ -131,14 +161,15 @@ void JSNode::mark()
     for (Node* current = m_impl.get(); current; current = current->parentNode())
         root = current;
 
-    // If we're already marking this tree, then we can simply mark this wrapper
-    // by calling the base class; our caller is iterating the tree.
+    // Nodes in a subtree are marked by the tree's root, so, if the root is already
+    // marking the tree, we don't need to explicitly mark any other nodes.
     if (root->inSubtreeMark()) {
         DOMObject::mark();
+        markEventListeners(node->eventListeners());
         return;
     }
 
-    // Mark the whole tree; use the global set of roots to avoid reentering.
+    // Mark the whole tree subtree.
     root->setInSubtreeMark(true);
     for (Node* nodeToMark = root; nodeToMark; nodeToMark = nodeToMark->traverseNextNode()) {
         JSNode* wrapper = getCachedDOMNodeWrapper(m_impl->document(), nodeToMark);
@@ -161,7 +192,7 @@ void JSNode::mark()
     ASSERT(marked());
 }
 
-static ALWAYS_INLINE JSValuePtr createWrapper(ExecState* exec, Node* node)
+static ALWAYS_INLINE JSValue createWrapper(ExecState* exec, Node* node)
 {
     ASSERT(node);
     ASSERT(!getCachedDOMNodeWrapper(node->document(), node));
@@ -218,7 +249,7 @@ static ALWAYS_INLINE JSValuePtr createWrapper(ExecState* exec, Node* node)
     return wrapper;    
 }
     
-JSValuePtr toJSNewlyCreated(ExecState* exec, Node* node)
+JSValue toJSNewlyCreated(ExecState* exec, Node* node)
 {
     if (!node)
         return jsNull();
@@ -226,7 +257,7 @@ JSValuePtr toJSNewlyCreated(ExecState* exec, Node* node)
     return createWrapper(exec, node);
 }
     
-JSValuePtr toJS(ExecState* exec, Node* node)
+JSValue toJS(ExecState* exec, Node* node)
 {
     if (!node)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
index 55a282e..f5d4d5c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.cpp
@@ -29,17 +29,17 @@ namespace WebCore {
 
 using namespace JSC;
 
-ASSERT_CLASS_FITS_IN_CELL(JSNodeFilterCondition)
+ASSERT_CLASS_FITS_IN_CELL(JSNodeFilterCondition);
 
-JSNodeFilterCondition::JSNodeFilterCondition(JSValuePtr filter)
+JSNodeFilterCondition::JSNodeFilterCondition(JSValue filter)
     : m_filter(filter)
 {
 }
 
 void JSNodeFilterCondition::mark()
 {
-    if (!m_filter->marked())
-        m_filter->mark();
+    if (!m_filter.marked())
+        m_filter.mark();
 }
 
 short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode) const
@@ -47,7 +47,7 @@ short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode)
     JSLock lock(false);
 
     CallData callData;
-    CallType callType = m_filter->getCallData(callData);
+    CallType callType = m_filter.getCallData(callData);
     if (callType == CallTypeNone)
         return NodeFilter::FILTER_ACCEPT;
 
@@ -60,16 +60,16 @@ short JSNodeFilterCondition::acceptNode(JSC::ExecState* exec, Node* filterNode)
     if (!exec)
         return NodeFilter::FILTER_REJECT;
 
-    ArgList args;
+    MarkedArgumentBuffer args;
     args.append(toJS(exec, filterNode));
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
-    JSValuePtr result = call(exec, m_filter, callType, callData, m_filter, args);
+    JSValue result = call(exec, m_filter, callType, callData, m_filter, args);
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
-    int intResult = result->toInt32(exec);
+    int intResult = result.toInt32(exec);
     if (exec->hadException())
         return NodeFilter::FILTER_REJECT;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.h b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.h
index 2600d90..3d591c6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCondition.h
@@ -30,18 +30,18 @@ namespace WebCore {
 
     class JSNodeFilterCondition : public NodeFilterCondition {
     public:
-        static PassRefPtr<JSNodeFilterCondition> create(JSC::JSValuePtr filter)
+        static PassRefPtr<JSNodeFilterCondition> create(JSC::JSValue filter)
         {
             return adoptRef(new JSNodeFilterCondition(filter));
         }
 
     private:
-        JSNodeFilterCondition(JSC::JSValuePtr filter);
+        JSNodeFilterCondition(JSC::JSValue filter);
 
         virtual short acceptNode(ScriptState*, Node*) const;
         virtual void mark();
 
-        JSC::JSValuePtr m_filter;
+        mutable JSC::JSValue m_filter;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCustom.cpp
index bca6e3a..ecc12d5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeFilterCustom.cpp
@@ -41,14 +41,14 @@ void JSNodeFilter::mark()
     DOMObject::mark();
 }
 
-JSValuePtr JSNodeFilter::acceptNode(ExecState* exec, const ArgList& args)
+JSValue JSNodeFilter::acceptNode(ExecState* exec, const ArgList& args)
 {
-    return jsNumber(exec, impl()->acceptNode(exec, toNode(args.at(exec, 0))));
+    return jsNumber(exec, impl()->acceptNode(exec, toNode(args.at(0))));
 }
 
-PassRefPtr<NodeFilter> toNodeFilter(JSValuePtr value)
+PassRefPtr<NodeFilter> toNodeFilter(JSValue value)
 {
-    if (value->isObject(&JSNodeFilter::s_info))
+    if (value.isObject(&JSNodeFilter::s_info))
         return static_cast<JSNodeFilter*>(asObject(value))->impl();
 
     return NodeFilter::create(JSNodeFilterCondition::create(value));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeIteratorCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeIteratorCustom.cpp
index 6498a7c..8fff82e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeIteratorCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeIteratorCustom.cpp
@@ -37,7 +37,7 @@ void JSNodeIterator::mark()
     DOMObject::mark();
 }
 
-JSValuePtr JSNodeIterator::nextNode(ExecState* exec, const ArgList&)
+JSValue JSNodeIterator::nextNode(ExecState* exec, const ArgList&)
 {
     ExceptionCode ec = 0;
     RefPtr<Node> node = impl()->nextNode(exec, ec);
@@ -52,7 +52,7 @@ JSValuePtr JSNodeIterator::nextNode(ExecState* exec, const ArgList&)
     return toJS(exec, node.get());
 }
 
-JSValuePtr JSNodeIterator::previousNode(ExecState* exec, const ArgList&)
+JSValue JSNodeIterator::previousNode(ExecState* exec, const ArgList&)
 {
     ExceptionCode ec = 0;
     RefPtr<Node> node = impl()->previousNode(exec, ec);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp
index a67887e..2821d01 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSNodeListCustom.cpp
@@ -36,10 +36,10 @@ using namespace JSC;
 namespace WebCore {
 
 // Need to support call so that list(0) works.
-static JSValuePtr callNodeList(ExecState* exec, JSObject* function, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callNodeList(ExecState* exec, JSObject* function, JSValue, const ArgList& args)
 {
     bool ok;
-    unsigned index = args.at(exec, 0)->toString(exec).toUInt32(&ok);
+    unsigned index = args.at(0).toString(exec).toUInt32(&ok);
     if (!ok)
         return jsUndefined();
     return toJS(exec, static_cast<JSNodeList*>(function)->impl()->item(index));
@@ -56,7 +56,7 @@ bool JSNodeList::canGetItemsForName(ExecState*, NodeList* impl, const Identifier
     return impl->itemWithName(propertyName);
 }
 
-JSValuePtr JSNodeList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSNodeList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSNodeList* thisObj = static_cast<JSNodeList*>(asObject(slot.slotBase()));
     return toJS(exec, thisObj->impl()->itemWithName(propertyName));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
index 42136e5..9e818ff 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.cpp
@@ -20,6 +20,7 @@
 #include "config.h"
 #include "JSOptionConstructor.h"
 
+#include "HTMLNames.h"
 #include "HTMLOptionElement.h"
 #include "JSHTMLOptionElement.h"
 #include "ScriptExecutionContext.h"
@@ -29,39 +30,46 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSOptionConstructor)
+ASSERT_CLASS_FITS_IN_CELL(JSOptionConstructor);
 
 const ClassInfo JSOptionConstructor::s_info = { "OptionConstructor", 0, 0, 0 };
 
-JSOptionConstructor::JSOptionConstructor(ExecState* exec, ScriptExecutionContext* context)
+JSOptionConstructor::JSOptionConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
     : DOMObject(JSOptionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    , m_globalObject(globalObject)
 {
-    ASSERT(context->isDocument());
-    m_document = static_cast<JSDocument*>(asObject(toJS(exec, static_cast<Document*>(context))));
+    ASSERT(globalObject->scriptExecutionContext());
+    ASSERT(globalObject->scriptExecutionContext()->isDocument());
 
+    putDirect(exec->propertyNames().prototype, JSHTMLOptionElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 4), ReadOnly|DontDelete|DontEnum);
 }
 
+Document* JSOptionConstructor::document() const
+{
+    return static_cast<Document*>(m_globalObject->scriptExecutionContext());
+}
+
 static JSObject* constructHTMLOptionElement(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
     Document* document = static_cast<JSOptionConstructor*>(constructor)->document();
+    if (!document)
+        return throwError(exec, ReferenceError, "Option constructor associated document is unavailable");
 
-    ExceptionCode ec = 0;
+    RefPtr<HTMLOptionElement> element = static_pointer_cast<HTMLOptionElement>(document->createElement(HTMLNames::optionTag, false));
 
-    RefPtr<HTMLOptionElement> element = static_pointer_cast<HTMLOptionElement>(document->createElement("option", ec));
-    RefPtr<Text> text;
-    if (ec == 0)
-        text = document->createTextNode("");
-    if (ec == 0 && !args.at(exec, 0)->isUndefined())
-        text->setData(args.at(exec, 0)->toString(exec), ec);
+    ExceptionCode ec = 0;
+    RefPtr<Text> text = document->createTextNode("");
+    if (!args.at(0).isUndefined())
+        text->setData(args.at(0).toString(exec), ec);
     if (ec == 0)
         element->appendChild(text.release(), ec);
-    if (ec == 0 && !args.at(exec, 1)->isUndefined())
-        element->setValue(args.at(exec, 1)->toString(exec));
+    if (ec == 0 && !args.at(1).isUndefined())
+        element->setValue(args.at(1).toString(exec));
     if (ec == 0)
-        element->setDefaultSelected(args.at(exec, 2)->toBoolean(exec));
+        element->setDefaultSelected(args.at(2).toBoolean(exec));
     if (ec == 0)
-        element->setSelected(args.at(exec, 3)->toBoolean(exec));
+        element->setSelected(args.at(3).toBoolean(exec));
 
     if (ec) {
         setDOMException(exec, ec);
@@ -80,8 +88,8 @@ ConstructType JSOptionConstructor::getConstructData(ConstructData& constructData
 void JSOptionConstructor::mark()
 {
     DOMObject::mark();
-    if (!m_document->marked())
-        m_document->mark();
+    if (!m_globalObject->marked())
+        m_globalObject->mark();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.h
index 5234c49..3c87c28 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSOptionConstructor.h
@@ -28,8 +28,8 @@ namespace WebCore {
 
     class JSOptionConstructor : public DOMObject {
     public:
-        JSOptionConstructor(JSC::ExecState*, ScriptExecutionContext*);
-        Document* document() const { return m_document->impl(); }
+        JSOptionConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+        Document* document() const;
 
         static const JSC::ClassInfo s_info;
         
@@ -38,7 +38,7 @@ namespace WebCore {
         virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 
-        JSDocument* m_document;
+        JSDOMGlobalObject* m_globalObject;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp
index 5e82942..81d4295 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginArrayCustom.cpp
@@ -33,7 +33,7 @@ bool JSPluginArray::canGetItemsForName(ExecState*, PluginArray* pluginArray, con
     return pluginArray->canGetItemsForName(propertyName);
 }
 
-JSValuePtr JSPluginArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSPluginArray::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSPluginArray* thisObj = static_cast<JSPluginArray*>(asObject(slot.slotBase()));
     return toJS(exec, thisObj->impl()->namedItem(propertyName));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp
index 2cc3bae..555dd9e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginCustom.cpp
@@ -32,7 +32,7 @@ bool JSPlugin::canGetItemsForName(ExecState*, Plugin* plugin, const Identifier&
     return plugin->canGetItemsForName(propertyName);
 }
 
-JSValuePtr JSPlugin::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSPlugin::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSPlugin* thisObj = static_cast<JSPlugin*>(asObject(slot.slotBase()));
     return toJS(exec, thisObj->impl()->namedItem(propertyName));
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
index 4d1b8fb..56b0eca 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.cpp
@@ -20,13 +20,9 @@
 #include "config.h"
 #include "JSPluginElementFunctions.h"
 
-#include "Frame.h"
-#include "FrameLoader.h"
-#include "HTMLDocument.h"
 #include "HTMLNames.h"
 #include "HTMLPlugInElement.h"
 #include "JSHTMLElement.h"
-#include "ScriptController.h"
 #include "runtime.h"
 #include "runtime_object.h"
 
@@ -58,10 +54,10 @@ static RuntimeObjectImp* getRuntimeObject(ExecState* exec, Node* node)
     Instance* instance = pluginInstance(node);
     if (!instance)
         return 0;
-    return JSC::Bindings::Instance::createRuntimeObject(exec, instance);
+    return instance->createRuntimeObject(exec);
 }
 
-JSValuePtr runtimeObjectGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue runtimeObjectGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
     HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
@@ -69,7 +65,7 @@ JSValuePtr runtimeObjectGetter(ExecState* exec, const Identifier&, const Propert
     return runtimeObject ? runtimeObject : jsUndefined();
 }
 
-JSValuePtr runtimeObjectPropertyGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue runtimeObjectPropertyGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSHTMLElement* thisObj = static_cast<JSHTMLElement*>(asObject(slot.slotBase()));
     HTMLElement* element = static_cast<HTMLElement*>(thisObj->impl());
@@ -90,7 +86,7 @@ bool runtimeObjectCustomGetOwnPropertySlot(ExecState* exec, const Identifier& pr
     return true;
 }
 
-bool runtimeObjectCustomPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, HTMLElement* element, PutPropertySlot& slot)
+bool runtimeObjectCustomPut(ExecState* exec, const Identifier& propertyName, JSValue value, HTMLElement* element, PutPropertySlot& slot)
 {
     RuntimeObjectImp* runtimeObject = getRuntimeObject(exec, element);
     if (!runtimeObject)
@@ -101,11 +97,11 @@ bool runtimeObjectCustomPut(ExecState* exec, const Identifier& propertyName, JSV
     return true;
 }
 
-static JSValuePtr callPlugin(ExecState* exec, JSObject* function, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callPlugin(ExecState* exec, JSObject* function, JSValue, const ArgList& args)
 {
     Instance* instance = pluginInstance(static_cast<JSHTMLElement*>(function)->impl());
     instance->begin();
-    JSValuePtr result = instance->invokeDefaultMethod(exec, args);
+    JSValue result = instance->invokeDefaultMethod(exec, args);
     instance->end();
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
index a1a86c0..8c9dfa7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSPluginElementFunctions.h
@@ -30,10 +30,10 @@ namespace WebCore {
 
     // Runtime object support code for JSHTMLAppletElement, JSHTMLEmbedElement and JSHTMLObjectElement.
 
-    JSC::JSValuePtr runtimeObjectGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-    JSC::JSValuePtr runtimeObjectPropertyGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    JSC::JSValue runtimeObjectGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    JSC::JSValue runtimeObjectPropertyGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
     bool runtimeObjectCustomGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&, JSHTMLElement*);
-    bool runtimeObjectCustomPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, HTMLElement*, JSC::PutPropertySlot&);
+    bool runtimeObjectCustomPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, HTMLElement*, JSC::PutPropertySlot&);
     JSC::CallType runtimeObjectGetCallData(HTMLElement*, JSC::CallData&);
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
index cec0dab..ad1e556 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.cpp
@@ -32,13 +32,13 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSQuarantinedObjectWrapper)
+ASSERT_CLASS_FITS_IN_CELL(JSQuarantinedObjectWrapper);
 
 const ClassInfo JSQuarantinedObjectWrapper::s_info = { "JSQuarantinedObjectWrapper", 0, 0, 0 };
 
-JSQuarantinedObjectWrapper* JSQuarantinedObjectWrapper::asWrapper(JSValuePtr value)
+JSQuarantinedObjectWrapper* JSQuarantinedObjectWrapper::asWrapper(JSValue value)
 {
-    if (!value->isObject())
+    if (!value.isObject())
         return 0;
 
     JSObject* object = asObject(value);
@@ -49,16 +49,16 @@ JSQuarantinedObjectWrapper* JSQuarantinedObjectWrapper::asWrapper(JSValuePtr val
     return static_cast<JSQuarantinedObjectWrapper*>(object);
 }
 
-JSValuePtr JSQuarantinedObjectWrapper::cachedValueGetter(ExecState*, const Identifier&, const PropertySlot& slot)
+JSValue JSQuarantinedObjectWrapper::cachedValueGetter(ExecState*, const Identifier&, const PropertySlot& slot)
 {
-    JSValuePtr v = slot.slotBase();
+    JSValue v = slot.slotBase();
     ASSERT(v);
     return v;
 }
 
 JSQuarantinedObjectWrapper::JSQuarantinedObjectWrapper(ExecState* unwrappedExec, JSObject* unwrappedObject, PassRefPtr<Structure> structure)
     : JSObject(structure)
-    , m_unwrappedGlobalObject(unwrappedExec->dynamicGlobalObject())
+    , m_unwrappedGlobalObject(unwrappedExec->lexicalGlobalObject())
     , m_unwrappedObject(unwrappedObject)
 {
     ASSERT_ARG(unwrappedExec, unwrappedExec);
@@ -72,7 +72,7 @@ JSQuarantinedObjectWrapper::~JSQuarantinedObjectWrapper()
 
 bool JSQuarantinedObjectWrapper::allowsUnwrappedAccessFrom(ExecState* exec) const
 {
-    return m_unwrappedGlobalObject->profileGroup() == exec->dynamicGlobalObject()->profileGroup();
+    return m_unwrappedGlobalObject->profileGroup() == exec->lexicalGlobalObject()->profileGroup();
 }
 
 ExecState* JSQuarantinedObjectWrapper::unwrappedExecState() const
@@ -87,8 +87,9 @@ void JSQuarantinedObjectWrapper::transferExceptionToExecState(ExecState* exec) c
     if (!unwrappedExecState()->hadException())
         return;
 
-    exec->setException(wrapOutgoingValue(unwrappedExecState(), unwrappedExecState()->exception()));
+    JSValue exception = unwrappedExecState()->exception();
     unwrappedExecState()->clearException();
+    exec->setException(wrapOutgoingValue(unwrappedExecState(), exception));
 }
 
 void JSQuarantinedObjectWrapper::mark()
@@ -111,7 +112,7 @@ bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, const Ident
     PropertySlot unwrappedSlot(m_unwrappedObject);
     bool result = m_unwrappedObject->getOwnPropertySlot(unwrappedExecState(), identifier, unwrappedSlot);
     if (result) {
-        JSValuePtr unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
+        JSValue unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
         slot.setCustom(wrapOutgoingValue(unwrappedExecState(), unwrappedValue), cachedValueGetter);
     }
 
@@ -130,7 +131,7 @@ bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, unsigned id
     PropertySlot unwrappedSlot(m_unwrappedObject);
     bool result = m_unwrappedObject->getOwnPropertySlot(unwrappedExecState(), identifier, unwrappedSlot);
     if (result) {
-        JSValuePtr unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
+        JSValue unwrappedValue = unwrappedSlot.getValue(unwrappedExecState(), identifier);
         slot.setCustom(wrapOutgoingValue(unwrappedExecState(), unwrappedValue), cachedValueGetter);
     }
 
@@ -139,7 +140,7 @@ bool JSQuarantinedObjectWrapper::getOwnPropertySlot(ExecState* exec, unsigned id
     return result;
 }
 
-void JSQuarantinedObjectWrapper::put(ExecState* exec, const Identifier& identifier, JSValuePtr value, PutPropertySlot& slot)
+void JSQuarantinedObjectWrapper::put(ExecState* exec, const Identifier& identifier, JSValue value, PutPropertySlot& slot)
 {
     if (!allowsSetProperty())
         return;
@@ -149,7 +150,7 @@ void JSQuarantinedObjectWrapper::put(ExecState* exec, const Identifier& identifi
     transferExceptionToExecState(exec);
 }
 
-void JSQuarantinedObjectWrapper::put(ExecState* exec, unsigned identifier, JSValuePtr value)
+void JSQuarantinedObjectWrapper::put(ExecState* exec, unsigned identifier, JSValue value)
 {
     if (!allowsSetProperty())
         return;
@@ -187,9 +188,9 @@ JSObject* JSQuarantinedObjectWrapper::construct(ExecState* exec, JSObject* const
 {
     JSQuarantinedObjectWrapper* wrapper = static_cast<JSQuarantinedObjectWrapper*>(constructor);
 
-    ArgList preparedArgs;
+    MarkedArgumentBuffer preparedArgs;
     for (size_t i = 0; i < args.size(); ++i)
-        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(exec, i)));
+        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(i)));
 
     // FIXME: Would be nice to find a way to reuse the result of m_unwrappedObject->getConstructData
     // from when we called it in JSQuarantinedObjectWrapper::getConstructData.
@@ -197,10 +198,10 @@ JSObject* JSQuarantinedObjectWrapper::construct(ExecState* exec, JSObject* const
     ConstructType unwrappedConstructType = wrapper->m_unwrappedObject->getConstructData(unwrappedConstructData);
     ASSERT(unwrappedConstructType != ConstructTypeNone);
 
-    JSValuePtr unwrappedResult = JSC::construct(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedConstructType, unwrappedConstructData, preparedArgs);
+    JSValue unwrappedResult = JSC::construct(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedConstructType, unwrappedConstructData, preparedArgs);
 
-    JSValuePtr resultValue = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
-    ASSERT(resultValue->isObject());
+    JSValue resultValue = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
+    ASSERT(resultValue.isObject());
     JSObject* result = asObject(resultValue);
 
     wrapper->transferExceptionToExecState(exec);
@@ -219,7 +220,7 @@ ConstructType JSQuarantinedObjectWrapper::getConstructData(ConstructData& constr
     return ConstructTypeHost;
 }
 
-bool JSQuarantinedObjectWrapper::hasInstance(ExecState* exec, JSValuePtr value, JSValuePtr proto)
+bool JSQuarantinedObjectWrapper::hasInstance(ExecState* exec, JSValue value, JSValue proto)
 {
     if (!allowsHasInstance())
         return false;
@@ -231,15 +232,15 @@ bool JSQuarantinedObjectWrapper::hasInstance(ExecState* exec, JSValuePtr value,
     return result;
 }
 
-JSValuePtr JSQuarantinedObjectWrapper::call(ExecState* exec, JSObject* function, JSValuePtr thisValue, const ArgList& args)
+JSValue JSQuarantinedObjectWrapper::call(ExecState* exec, JSObject* function, JSValue thisValue, const ArgList& args)
 {
     JSQuarantinedObjectWrapper* wrapper = static_cast<JSQuarantinedObjectWrapper*>(function);
 
-    JSValuePtr preparedThisValue = wrapper->prepareIncomingValue(exec, thisValue);
+    JSValue preparedThisValue = wrapper->prepareIncomingValue(exec, thisValue);
 
-    ArgList preparedArgs;
+    MarkedArgumentBuffer preparedArgs;
     for (size_t i = 0; i < args.size(); ++i)
-        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(exec, i)));
+        preparedArgs.append(wrapper->prepareIncomingValue(exec, args.at(i)));
 
     // FIXME: Would be nice to find a way to reuse the result of m_unwrappedObject->getCallData
     // from when we called it in JSQuarantinedObjectWrapper::getCallData.
@@ -247,9 +248,9 @@ JSValuePtr JSQuarantinedObjectWrapper::call(ExecState* exec, JSObject* function,
     CallType unwrappedCallType = wrapper->m_unwrappedObject->getCallData(unwrappedCallData);
     ASSERT(unwrappedCallType != CallTypeNone);
 
-    JSValuePtr unwrappedResult = JSC::call(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedCallType, unwrappedCallData, preparedThisValue, preparedArgs);
+    JSValue unwrappedResult = JSC::call(wrapper->unwrappedExecState(), wrapper->m_unwrappedObject, unwrappedCallType, unwrappedCallData, preparedThisValue, preparedArgs);
 
-    JSValuePtr result = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
+    JSValue result = wrapper->wrapOutgoingValue(wrapper->unwrappedExecState(), unwrappedResult);
 
     wrapper->transferExceptionToExecState(exec);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
index d66dc46..bf8fddb 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSQuarantinedObjectWrapper.h
@@ -32,7 +32,7 @@ namespace WebCore {
 
     class JSQuarantinedObjectWrapper : public JSC::JSObject {
     public:
-        static JSQuarantinedObjectWrapper* asWrapper(JSC::JSValuePtr);
+        static JSQuarantinedObjectWrapper* asWrapper(JSC::JSValue);
 
         virtual ~JSQuarantinedObjectWrapper();
 
@@ -45,7 +45,7 @@ namespace WebCore {
 
         static const JSC::ClassInfo s_info;
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr proto) 
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue proto) 
         { 
             return JSC::Structure::create(proto, JSC::TypeInfo(JSC::ObjectType, JSC::ImplementsHasInstance | JSC::OverridesHasInstance)); 
         }
@@ -59,8 +59,8 @@ namespace WebCore {
         virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
         virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned, JSC::PropertySlot&);
 
-        virtual void put(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, JSC::PutPropertySlot&);
-        virtual void put(JSC::ExecState*, unsigned, JSC::JSValuePtr);
+        virtual void put(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
+        virtual void put(JSC::ExecState*, unsigned, JSC::JSValue);
 
         virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
         virtual bool deleteProperty(JSC::ExecState*, unsigned);
@@ -68,7 +68,7 @@ namespace WebCore {
         virtual JSC::CallType getCallData(JSC::CallData&);
         virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
 
-        virtual bool hasInstance(JSC::ExecState*, JSC::JSValuePtr, JSC::JSValuePtr proto);
+        virtual bool hasInstance(JSC::ExecState*, JSC::JSValue, JSC::JSValue proto);
 
         virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
 
@@ -82,14 +82,14 @@ namespace WebCore {
         virtual bool allowsCallAsFunction() const { return false; }
         virtual bool allowsGetPropertyNames() const { return false; }
 
-        virtual JSC::JSValuePtr prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const = 0;
-        virtual JSC::JSValuePtr wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValuePtr unwrappedValue) const = 0;
+        virtual JSC::JSValue prepareIncomingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const = 0;
+        virtual JSC::JSValue wrapOutgoingValue(JSC::ExecState* unwrappedExec, JSC::JSValue unwrappedValue) const = 0;
 
-        static JSC::JSValuePtr cachedValueGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+        static JSC::JSValue cachedValueGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
         void transferExceptionToExecState(JSC::ExecState*) const;
 
-        static JSC::JSValuePtr call(JSC::ExecState*, JSC::JSObject* function, JSC::JSValuePtr thisValue, const JSC::ArgList&);
+        static JSC::JSValue JSC_HOST_CALL call(JSC::ExecState*, JSC::JSObject* function, JSC::JSValue thisValue, const JSC::ArgList&);
         static JSC::JSObject* construct(JSC::ExecState*, JSC::JSObject*, const JSC::ArgList&);
 
         JSC::JSGlobalObject* m_unwrappedGlobalObject;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.cpp
index 91fe4b3..f7c87e2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.cpp
@@ -28,9 +28,9 @@
 
 using namespace JSC;
 
-static JSValuePtr jsRGBColorRed(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr jsRGBColorGreen(ExecState*, const Identifier&, const PropertySlot&);
-static JSValuePtr jsRGBColorBlue(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue jsRGBColorRed(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue jsRGBColorGreen(ExecState*, const Identifier&, const PropertySlot&);
+static JSValue jsRGBColorBlue(ExecState*, const Identifier&, const PropertySlot&);
 
 /*
 @begin JSRGBColorTable
@@ -44,7 +44,7 @@ static JSValuePtr jsRGBColorBlue(ExecState*, const Identifier&, const PropertySl
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSRGBColor)
+ASSERT_CLASS_FITS_IN_CELL(JSRGBColor);
 
 const ClassInfo JSRGBColor::s_info = { "RGBColor", 0, &JSRGBColorTable, 0 };
 
@@ -59,7 +59,7 @@ bool JSRGBColor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSRGBColor, DOMObject>(exec, &JSRGBColorTable, this, propertyName, slot);
 }
 
-JSValuePtr getJSRGBColor(ExecState* exec, unsigned color)
+JSValue getJSRGBColor(ExecState* exec, unsigned color)
 {
     return new (exec) JSRGBColor(exec, color);
 }
@@ -68,17 +68,17 @@ JSValuePtr getJSRGBColor(ExecState* exec, unsigned color)
 
 using namespace WebCore;
 
-JSValuePtr jsRGBColorRed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRGBColorRed(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return toJS(exec, CSSPrimitiveValue::create((static_cast<JSRGBColor*>(asObject(slot.slotBase()))->impl() >> 16) & 0xFF, CSSPrimitiveValue::CSS_NUMBER));
 }
 
-JSValuePtr jsRGBColorGreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRGBColorGreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return toJS(exec, CSSPrimitiveValue::create((static_cast<JSRGBColor*>(asObject(slot.slotBase()))->impl() >> 8) & 0xFF, CSSPrimitiveValue::CSS_NUMBER));
 }
 
-JSValuePtr jsRGBColorBlue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRGBColorBlue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return toJS(exec, CSSPrimitiveValue::create(static_cast<JSRGBColor*>(asObject(slot.slotBase()))->impl() & 0xFF, CSSPrimitiveValue::CSS_NUMBER));
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.h
index d5acff3..cc2870f 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSRGBColor.h
@@ -38,12 +38,12 @@ namespace WebCore {
 
         unsigned impl() const { return m_color; }
 
-        static JSC::ObjectPrototype* createPrototype(JSC::ExecState* exec)
+        static JSC::ObjectPrototype* createPrototype(JSC::ExecState*, JSC::JSGlobalObject* globalObject)
         {
-            return exec->lexicalGlobalObject()->objectPrototype();
+            return globalObject->objectPrototype();
         }
 
-        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+        static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
         {
             return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
         }
@@ -52,7 +52,7 @@ namespace WebCore {
         unsigned m_color;
     };
 
-    JSC::JSValuePtr getJSRGBColor(JSC::ExecState*, unsigned color);
+    JSC::JSValue getJSRGBColor(JSC::ExecState*, unsigned color);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp
index 8c01d0c..f40956e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSQLResultSetRowListCustom.cpp
@@ -29,6 +29,8 @@
 #include "config.h"
 #include "JSSQLResultSetRowList.h"
 
+#if ENABLE(DATABASE)
+
 #include "ExceptionCode.h"
 #include "SQLValue.h"
 #include "SQLResultSetRowList.h"
@@ -37,10 +39,10 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSSQLResultSetRowList::item(ExecState* exec, const ArgList& args)
+JSValue JSSQLResultSetRowList::item(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    int index = args.at(exec, 0)->toInt32(exec, indexOk);
+    int index = args.at(0).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -56,7 +58,7 @@ JSValuePtr JSSQLResultSetRowList::item(ExecState* exec, const ArgList& args)
     unsigned valuesIndex = index * numColumns;
     for (unsigned i = 0; i < numColumns; i++) {
         const SQLValue& value = m_impl->values()[valuesIndex + i];
-        JSValuePtr jsValue = noValue();
+        JSValue jsValue;
 
         switch (value.type()) {
             case SQLValue::StringValue:
@@ -79,3 +81,5 @@ JSValuePtr JSSQLResultSetRowList::item(ExecState* exec, const ArgList& args)
 }
 
 }
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSQLTransactionCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSQLTransactionCustom.cpp
index 3cab8c4..30d59aa 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSQLTransactionCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSQLTransactionCustom.cpp
@@ -29,6 +29,8 @@
 #include "config.h"
 #include "JSSQLTransaction.h"
 
+#if ENABLE(DATABASE)
+
 #include "DOMWindow.h"
 #include "ExceptionCode.h"
 #include "JSCustomSQLStatementCallback.h"
@@ -40,40 +42,40 @@ using namespace JSC;
 
 namespace WebCore {
     
-JSValuePtr JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
+JSValue JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
 {
-    String sqlStatement = args.at(exec, 0)->toString(exec);
+    String sqlStatement = args.at(0).toString(exec);
     if (exec->hadException())
         return jsUndefined();
 
     // Now assemble the list of SQL arguments
     Vector<SQLValue> sqlValues;
-    if (!args.at(exec, 1)->isUndefinedOrNull()) {
-        JSObject* object = args.at(exec, 1)->getObject();
+    if (!args.at(1).isUndefinedOrNull()) {
+        JSObject* object = args.at(1).getObject();
         if (!object) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
         }
 
-        JSValuePtr lengthValue = object->get(exec, exec->propertyNames().length);
+        JSValue lengthValue = object->get(exec, exec->propertyNames().length);
         if (exec->hadException())
             return jsUndefined();
-        unsigned length = lengthValue->toUInt32(exec);
+        unsigned length = lengthValue.toUInt32(exec);
         if (exec->hadException())
             return jsUndefined();
         
         for (unsigned i = 0 ; i < length; ++i) {
-            JSValuePtr value = object->get(exec, i);
+            JSValue value = object->get(exec, i);
             if (exec->hadException())
                 return jsUndefined();
             
-            if (value->isNull())
+            if (value.isNull())
                 sqlValues.append(SQLValue());
-            else if (value->isNumber())
-                sqlValues.append(value->getNumber());
+            else if (value.isNumber())
+                sqlValues.append(value.uncheckedGetNumber());
             else {
                 // Convert the argument to a string and append it
-                sqlValues.append(value->toString(exec));
+                sqlValues.append(value.toString(exec));
                 if (exec->hadException())
                     return jsUndefined();
             }
@@ -81,8 +83,8 @@ JSValuePtr JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
     }
 
     RefPtr<SQLStatementCallback> callback;
-    if (!args.at(exec, 2)->isUndefinedOrNull()) {
-        JSObject* object = args.at(exec, 2)->getObject();
+    if (!args.at(2).isUndefinedOrNull()) {
+        JSObject* object = args.at(2).getObject();
         if (!object) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
@@ -93,8 +95,8 @@ JSValuePtr JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
     }
     
     RefPtr<SQLStatementErrorCallback> errorCallback;
-    if (!args.at(exec, 3)->isUndefinedOrNull()) {
-        JSObject* object = args.at(exec, 3)->getObject();
+    if (!args.at(3).isUndefinedOrNull()) {
+        JSObject* object = args.at(3).getObject();
         if (!object) {
             setDOMException(exec, TYPE_MISMATCH_ERR);
             return jsUndefined();
@@ -112,3 +114,5 @@ JSValuePtr JSSQLTransaction::executeSql(ExecState* exec, const ArgList& args)
 }
 
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
index ea2471e..2922740 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGElementInstanceCustom.cpp
@@ -26,36 +26,47 @@
 #include "config.h"
 
 #if ENABLE(SVG)
-#include "SVGElementInstance.h"
 #include "JSSVGElementInstance.h"
 
-#include "JSEventListener.h"
 #include "JSDOMWindow.h"
+#include "JSEventListener.h"
+#include "JSSVGElement.h"
+#include "SVGElementInstance.h"
 
 using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& args)
+void JSSVGElementInstance::mark()
+{
+    DOMObject::mark();
+
+    // Mark the wrapper for our corresponding element, so it can mark its event handlers.
+    JSNode* correspondingWrapper = getCachedDOMNodeWrapper(impl()->correspondingElement()->document(), impl()->correspondingElement());
+    if (correspondingWrapper && !correspondingWrapper->marked())
+        correspondingWrapper->mark();
+}
+
+JSValue JSSVGElementInstance::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
 
-    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(exec, args.at(exec, 1)))
-        impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    if (RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1)))
+        impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
 
     return jsUndefined();
 }
 
-JSValuePtr JSSVGElementInstance::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSSVGElementInstance::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
 
-    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(exec, 1)))
-        impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    if (JSEventListener* listener = globalObject->findJSEventListener(args.at(1)))
+        impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
 
     return jsUndefined();
 }
@@ -64,6 +75,17 @@ void JSSVGElementInstance::pushEventHandlerScope(ExecState*, ScopeChain&) const
 {
 }
 
+JSC::JSValue toJS(JSC::ExecState* exec, SVGElementInstance* object)
+{
+    JSValue result = getDOMObjectWrapper<JSSVGElementInstance>(exec, object);
+
+    // Ensure that our corresponding element has a JavaScript wrapper to keep its event handlers alive.
+    if (object)
+        toJS(exec, object->correspondingElement());
+
+    return result;
 }
 
-#endif
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp
index 6dd8507..bad52ae 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGLengthCustom.cpp
@@ -26,18 +26,18 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSSVGLength::value(ExecState* exec) const
+JSValue JSSVGLength::value(ExecState* exec) const
 {
     SVGLength imp(*impl());
     return jsNumber(exec, imp.value(context()));
 }
 
-JSValuePtr JSSVGLength::convertToSpecifiedUnits(ExecState* exec, const ArgList& args)
+JSValue JSSVGLength::convertToSpecifiedUnits(ExecState* exec, const ArgList& args)
 {
     JSSVGPODTypeWrapper<SVGLength>* wrapper = impl();
 
     SVGLength imp(*wrapper);
-    imp.convertToSpecifiedUnits(args.at(exec, 0)->toInt32(exec), context());
+    imp.convertToSpecifiedUnits(args.at(0).toInt32(exec), context());
 
     wrapper->commitChange(imp, context());
     return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp
index fdf9d5e..fc1e266 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGMatrixCustom.cpp
@@ -29,18 +29,10 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSSVGMatrix::multiply(ExecState* exec, const ArgList& args)
+JSValue JSSVGMatrix::inverse(ExecState* exec, const ArgList&)
 {
     TransformationMatrix imp(*impl());
-
-    TransformationMatrix secondMatrix = toSVGMatrix(args.at(exec, 0));    
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.multiply(secondMatrix)).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::inverse(ExecState* exec, const ArgList&)
-{
-    TransformationMatrix imp(*impl());
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.inverse()).get(), m_context.get());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.inverse()).get(), m_context.get());
 
     if (!imp.isInvertible())
         setDOMException(exec, SVGException::SVG_MATRIX_NOT_INVERTABLE);
@@ -48,50 +40,14 @@ JSValuePtr JSSVGMatrix::inverse(ExecState* exec, const ArgList&)
     return result;
 }
 
-JSValuePtr JSSVGMatrix::translate(ExecState* exec, const ArgList& args)
-{
-    TransformationMatrix imp(*impl());
-
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.translate(x, y)).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::scale(ExecState* exec, const ArgList& args)
-{
-    TransformationMatrix imp(*impl());
-
-    float scaleFactor = args.at(exec, 0)->toFloat(exec);
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.scale(scaleFactor)).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::scaleNonUniform(ExecState* exec, const ArgList& args)
-{
-    TransformationMatrix imp(*impl());
-
-    float scaleFactorX = args.at(exec, 0)->toFloat(exec);
-    float scaleFactorY = args.at(exec, 1)->toFloat(exec);
-
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.scaleNonUniform(scaleFactorX, scaleFactorY)).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::rotate(ExecState* exec, const ArgList& args)
-{
-    TransformationMatrix imp(*impl());
-
-    float angle = args.at(exec, 0)->toFloat(exec);
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.rotate(angle)).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::rotateFromVector(ExecState* exec, const ArgList& args)
+JSValue JSSVGMatrix::rotateFromVector(ExecState* exec, const ArgList& args)
 {
     TransformationMatrix imp(*impl());
  
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.rotateFromVector(x, y)).get(), m_context.get());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.rotateFromVector(x, y)).get(), m_context.get());
 
     if (x == 0.0 || y == 0.0)
         setDOMException(exec, SVGException::SVG_INVALID_VALUE_ERR);
@@ -99,34 +55,6 @@ JSValuePtr JSSVGMatrix::rotateFromVector(ExecState* exec, const ArgList& args)
     return result;
 }
 
-JSValuePtr JSSVGMatrix::flipX(ExecState* exec, const ArgList&)
-{
-    TransformationMatrix imp(*impl());
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.flipX()).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::flipY(ExecState* exec, const ArgList&)
-{
-    TransformationMatrix imp(*impl());
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.flipY()).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::skewX(ExecState* exec, const ArgList& args)
-{
-    TransformationMatrix imp(*impl());
-
-    float angle = args.at(exec, 0)->toFloat(exec);
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.skewX(angle)).get(), m_context.get());
-}
-
-JSValuePtr JSSVGMatrix::skewY(ExecState* exec, const ArgList& args)
-{
-    TransformationMatrix imp(*impl());
-
-    float angle = args.at(exec, 0)->toFloat(exec);
-    return toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.skewY(angle)).get(), m_context.get());
-}
-
 }
 
 #endif // ENABLE(SVG)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h
index c30f97f..51e4e9e 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPODTypeWrapper.h
@@ -28,7 +28,6 @@
 #define JSSVGPODTypeWrapper_h
 
 #if ENABLE(SVG)
-#include "Frame.h"
 #include "SVGElement.h"
 #include <wtf/StdLibExtras.h>
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp
index b7490e7..cb4687c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegCustom.cpp
@@ -59,7 +59,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, SVGPathSeg* object, SVGElement* context)
+JSValue toJS(ExecState* exec, SVGPathSeg* object, SVGElement* context)
 {
     if (!object)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp
index 6197b48..b6fc116 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPathSegListCustom.cpp
@@ -35,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSSVGPathSegList::clear(ExecState* exec, const ArgList&)
+JSValue JSSVGPathSegList::clear(ExecState* exec, const ArgList&)
 {
     ExceptionCode ec = 0;
 
@@ -48,28 +48,28 @@ JSValuePtr JSSVGPathSegList::clear(ExecState* exec, const ArgList&)
     return jsUndefined();
 }
 
-JSValuePtr JSSVGPathSegList::initialize(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::initialize(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    SVGPathSeg* newItem = toSVGPathSeg(args.at(exec, 0));
+    SVGPathSeg* newItem = toSVGPathSeg(args.at(0));
 
     SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
 
     SVGPathSeg* obj = WTF::getPtr(imp->initialize(newItem, ec));
 
-    JSC::JSValuePtr result = toJS(exec, obj, m_context.get());
+    JSC::JSValue result = toJS(exec, obj, m_context.get());
     setDOMException(exec, ec);
 
     m_context->svgAttributeChanged(imp->associatedAttributeName());    
     return result;
 }
 
-JSValuePtr JSSVGPathSegList::getItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::getItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
 
     bool indexOk;
-    unsigned index = args.at(exec, 0)->toInt32(exec, indexOk);
+    unsigned index = args.at(0).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -78,18 +78,18 @@ JSValuePtr JSSVGPathSegList::getItem(ExecState* exec, const ArgList& args)
     SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
     SVGPathSeg* obj = WTF::getPtr(imp->getItem(index, ec));
 
-    JSC::JSValuePtr result = toJS(exec, obj, m_context.get());
+    JSC::JSValue result = toJS(exec, obj, m_context.get());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr JSSVGPathSegList::insertItemBefore(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::insertItemBefore(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    SVGPathSeg* newItem = toSVGPathSeg(args.at(exec, 0));
+    SVGPathSeg* newItem = toSVGPathSeg(args.at(0));
 
     bool indexOk;
-    unsigned index = args.at(exec, 1)->toInt32(exec, indexOk);
+    unsigned index = args.at(1).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -97,20 +97,20 @@ JSValuePtr JSSVGPathSegList::insertItemBefore(ExecState* exec, const ArgList& ar
 
     SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->insertItemBefore(newItem, index, ec)), m_context.get());
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->insertItemBefore(newItem, index, ec)), m_context.get());
     setDOMException(exec, ec);
 
     m_context->svgAttributeChanged(imp->associatedAttributeName());    
     return result;
 }
 
-JSValuePtr JSSVGPathSegList::replaceItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::replaceItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    SVGPathSeg* newItem = toSVGPathSeg(args.at(exec, 0));
+    SVGPathSeg* newItem = toSVGPathSeg(args.at(0));
     
     bool indexOk;
-    unsigned index = args.at(exec, 1)->toInt32(exec, indexOk);
+    unsigned index = args.at(1).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -118,19 +118,19 @@ JSValuePtr JSSVGPathSegList::replaceItem(ExecState* exec, const ArgList& args)
 
     SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->replaceItem(newItem, index, ec)), m_context.get());
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->replaceItem(newItem, index, ec)), m_context.get());
     setDOMException(exec, ec);
 
     m_context->svgAttributeChanged(imp->associatedAttributeName());    
     return result;
 }
 
-JSValuePtr JSSVGPathSegList::removeItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::removeItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     
     bool indexOk;
-    unsigned index = args.at(exec, 0)->toInt32(exec, indexOk);
+    unsigned index = args.at(0).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -140,21 +140,21 @@ JSValuePtr JSSVGPathSegList::removeItem(ExecState* exec, const ArgList& args)
 
     RefPtr<SVGPathSeg> obj(imp->removeItem(index, ec));
 
-    JSC::JSValuePtr result = toJS(exec, obj.get(), m_context.get());
+    JSC::JSValue result = toJS(exec, obj.get(), m_context.get());
     setDOMException(exec, ec);
 
     m_context->svgAttributeChanged(imp->associatedAttributeName());    
     return result;
 }
 
-JSValuePtr JSSVGPathSegList::appendItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPathSegList::appendItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
-    SVGPathSeg* newItem = toSVGPathSeg(args.at(exec, 0));
+    SVGPathSeg* newItem = toSVGPathSeg(args.at(0));
 
     SVGPathSegList* imp = static_cast<SVGPathSegList*>(impl());
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->appendItem(newItem, ec)), m_context.get());
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->appendItem(newItem, ec)), m_context.get());
     setDOMException(exec, ec);
 
     m_context->svgAttributeChanged(imp->associatedAttributeName());    
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPointListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPointListCustom.cpp
index a2e74ae..a18c2a2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPointListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGPointListCustom.cpp
@@ -33,7 +33,7 @@ namespace WebCore {
 typedef SVGPODListItem<FloatPoint> PODListItem;
 typedef SVGList<RefPtr<PODListItem> > SVGPointListBase;
 
-static JSValuePtr finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
+static JSValue finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -42,7 +42,7 @@ static JSValuePtr finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* c
     return toJS(exec, JSSVGPODTypeWrapperCreatorForList<FloatPoint>::create(item.get(), list->associatedAttributeName()).get(), context);
 }
 
-static JSValuePtr finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
+static JSValue finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem > item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -53,7 +53,7 @@ static JSValuePtr finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* c
     return toJS(exec, JSSVGPODTypeWrapperCreatorForList<FloatPoint>::create(item.get(), attributeName).get(), context);
 }
 
-static JSValuePtr finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem> item)
+static JSValue finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGPointList* list, PassRefPtr<PODListItem> item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -63,7 +63,7 @@ static JSValuePtr finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec,
     return toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(*item).get(), context);
 }
 
-JSValuePtr JSSVGPointList::clear(ExecState* exec, const ArgList&)
+JSValue JSSVGPointList::clear(ExecState* exec, const ArgList&)
 {
     ExceptionCode ec = 0;
     impl()->clear(ec);
@@ -72,18 +72,18 @@ JSValuePtr JSSVGPointList::clear(ExecState* exec, const ArgList&)
     return jsUndefined();
 }
 
-JSValuePtr JSSVGPointList::initialize(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::initialize(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     SVGPointListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->initialize(PODListItem::copy(toSVGPoint(args.at(exec, 0))), ec));
+        listImp->initialize(PODListItem::copy(toSVGPoint(args.at(0))), ec));
 }
 
-JSValuePtr JSSVGPointList::getItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::getItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 0)->toUInt32(exec, indexOk);
+    unsigned index = args.at(0).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -95,10 +95,10 @@ JSValuePtr JSSVGPointList::getItem(ExecState* exec, const ArgList& args)
         listImp->getItem(index, ec));
 }
 
-JSValuePtr JSSVGPointList::insertItemBefore(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::insertItemBefore(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 1)->toUInt32(exec, indexOk);
+    unsigned index = args.at(1).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -107,13 +107,13 @@ JSValuePtr JSSVGPointList::insertItemBefore(ExecState* exec, const ArgList& args
     ExceptionCode ec = 0;
     SVGPointListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->insertItemBefore(PODListItem::copy(toSVGPoint(args.at(exec, 0))), index, ec));
+        listImp->insertItemBefore(PODListItem::copy(toSVGPoint(args.at(0))), index, ec));
 }
 
-JSValuePtr JSSVGPointList::replaceItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::replaceItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 1)->toInt32(exec, indexOk);
+    unsigned index = args.at(1).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -122,13 +122,13 @@ JSValuePtr JSSVGPointList::replaceItem(ExecState* exec, const ArgList& args)
     ExceptionCode ec = 0;
     SVGPointListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->replaceItem(PODListItem::copy(toSVGPoint(args.at(exec, 0))), index, ec));
+        listImp->replaceItem(PODListItem::copy(toSVGPoint(args.at(0))), index, ec));
 }
 
-JSValuePtr JSSVGPointList::removeItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::removeItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 0)->toInt32(exec, indexOk);
+    unsigned index = args.at(0).toInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -140,12 +140,12 @@ JSValuePtr JSSVGPointList::removeItem(ExecState* exec, const ArgList& args)
         listImp->removeItem(index, ec));
 }
 
-JSValuePtr JSSVGPointList::appendItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGPointList::appendItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     SVGPointListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->appendItem(PODListItem::copy(toSVGPoint(args.at(exec, 0))), ec));
+        listImp->appendItem(PODListItem::copy(toSVGPoint(args.at(0))), ec));
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGTransformListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGTransformListCustom.cpp
index b29b259..58b25ad 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSSVGTransformListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSSVGTransformListCustom.cpp
@@ -33,7 +33,7 @@ namespace WebCore {
 typedef SVGPODListItem<SVGTransform> PODListItem;
 typedef SVGList<RefPtr<PODListItem> > SVGTransformListBase;
 
-static JSValuePtr finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
+static JSValue finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -42,7 +42,7 @@ static JSValuePtr finishGetter(ExecState* exec, ExceptionCode& ec, SVGElement* c
     return toJS(exec, JSSVGPODTypeWrapperCreatorForList<SVGTransform>::create(item.get(), list->associatedAttributeName()).get(), context);
 }
 
-static JSValuePtr finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
+static JSValue finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -53,7 +53,7 @@ static JSValuePtr finishSetter(ExecState* exec, ExceptionCode& ec, SVGElement* c
     return toJS(exec, JSSVGPODTypeWrapperCreatorForList<SVGTransform>::create(item.get(), attributeName).get(), context);
 }
 
-static JSValuePtr finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
+static JSValue finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec, SVGElement* context, SVGTransformList* list, PassRefPtr<PODListItem> item)
 {
     if (ec) {
         setDOMException(exec, ec);
@@ -63,7 +63,7 @@ static JSValuePtr finishSetterReadOnlyResult(ExecState* exec, ExceptionCode& ec,
     return toJS(exec, JSSVGStaticPODTypeWrapper<SVGTransform>::create(*item).get(), context);
 }
 
-JSValuePtr JSSVGTransformList::clear(ExecState* exec, const ArgList&)
+JSValue JSSVGTransformList::clear(ExecState* exec, const ArgList&)
 {
     ExceptionCode ec = 0;
     impl()->clear(ec);
@@ -72,18 +72,18 @@ JSValuePtr JSSVGTransformList::clear(ExecState* exec, const ArgList&)
     return jsUndefined();
 }
 
-JSValuePtr JSSVGTransformList::initialize(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::initialize(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     SVGTransformListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->initialize(PODListItem::copy(toSVGTransform(args.at(exec, 0))), ec));
+        listImp->initialize(PODListItem::copy(toSVGTransform(args.at(0))), ec));
 }
 
-JSValuePtr JSSVGTransformList::getItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::getItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 0)->toUInt32(exec, indexOk);
+    unsigned index = args.at(0).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -95,10 +95,10 @@ JSValuePtr JSSVGTransformList::getItem(ExecState* exec, const ArgList& args)
         listImp->getItem(index, ec));
 }
 
-JSValuePtr JSSVGTransformList::insertItemBefore(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::insertItemBefore(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 1)->toUInt32(exec, indexOk);
+    unsigned index = args.at(1).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -107,13 +107,13 @@ JSValuePtr JSSVGTransformList::insertItemBefore(ExecState* exec, const ArgList&
     ExceptionCode ec = 0;
     SVGTransformListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->insertItemBefore(PODListItem::copy(toSVGTransform(args.at(exec, 0))), index, ec));
+        listImp->insertItemBefore(PODListItem::copy(toSVGTransform(args.at(0))), index, ec));
 }
 
-JSValuePtr JSSVGTransformList::replaceItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::replaceItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 1)->toUInt32(exec, indexOk);
+    unsigned index = args.at(1).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -122,13 +122,13 @@ JSValuePtr JSSVGTransformList::replaceItem(ExecState* exec, const ArgList& args)
     ExceptionCode ec = 0;
     SVGTransformListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->replaceItem(PODListItem::copy(toSVGTransform(args.at(exec, 0))), index, ec));
+        listImp->replaceItem(PODListItem::copy(toSVGTransform(args.at(0))), index, ec));
 }
 
-JSValuePtr JSSVGTransformList::removeItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::removeItem(ExecState* exec, const ArgList& args)
 {
     bool indexOk;
-    unsigned index = args.at(exec, 0)->toUInt32(exec, indexOk);
+    unsigned index = args.at(0).toUInt32(exec, indexOk);
     if (!indexOk) {
         setDOMException(exec, TYPE_MISMATCH_ERR);
         return jsUndefined();
@@ -140,12 +140,12 @@ JSValuePtr JSSVGTransformList::removeItem(ExecState* exec, const ArgList& args)
         listImp->removeItem(index, ec));
 }
 
-JSValuePtr JSSVGTransformList::appendItem(ExecState* exec, const ArgList& args)
+JSValue JSSVGTransformList::appendItem(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     SVGTransformListBase* listImp = impl();
     return finishSetter(exec, ec, context(), impl(),
-        listImp->appendItem(PODListItem::copy(toSVGTransform(args.at(exec, 0))), ec));
+        listImp->appendItem(PODListItem::copy(toSVGTransform(args.at(0))), ec));
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
index a92da25..2d2d0f8 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStorageCustom.cpp
@@ -41,7 +41,7 @@ bool JSStorage::canGetItemsForName(ExecState*, Storage* impl, const Identifier&
     return impl->contains(propertyName);
 }
 
-JSValuePtr JSStorage::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSStorage::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSStorage* thisObj = static_cast<JSStorage*>(asObject(slot.slotBase()));
     return jsStringOrNull(exec, thisObj->impl()->getItem(propertyName));
@@ -56,25 +56,25 @@ bool JSStorage::deleteProperty(ExecState* exec, const Identifier& propertyName)
     if (getStaticValueSlot<JSStorage, Base>(exec, s_info.propHashTable(exec), this, propertyName, slot))
         return false;
         
-    JSValuePtr prototype = this->prototype();
-    if (prototype->isObject() && asObject(prototype)->hasProperty(exec, propertyName))
+    JSValue prototype = this->prototype();
+    if (prototype.isObject() && asObject(prototype)->hasProperty(exec, propertyName))
         return false;
 
     m_impl->removeItem(propertyName);
     return true;
 }
 
-bool JSStorage::customGetPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+void JSStorage::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
 {
     ExceptionCode ec;
     unsigned length = m_impl->length();
     for (unsigned i = 0; i < length; ++i)
         propertyNames.add(Identifier(exec, m_impl->key(i, ec)));
         
-    return false;
+    Base::getPropertyNames(exec, propertyNames);
 }
 
-bool JSStorage::customPut(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot&)
+bool JSStorage::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
 {
     // Only perform the custom put if the object doesn't have a native property by this name.
     // Since hasProperty() would end up calling canGetItemsForName() and be fooled, we need to check
@@ -83,11 +83,11 @@ bool JSStorage::customPut(ExecState* exec, const Identifier& propertyName, JSVal
     if (getStaticValueSlot<JSStorage, Base>(exec, s_info.propHashTable(exec), this, propertyName, slot))
         return false;
         
-    JSValuePtr prototype = this->prototype();
-    if (prototype->isObject() && asObject(prototype)->hasProperty(exec, propertyName))
+    JSValue prototype = this->prototype();
+    if (prototype.isObject() && asObject(prototype)->hasProperty(exec, propertyName))
         return false;
     
-    String stringValue = valueToStringWithNullCheck(exec, value);
+    String stringValue = value.toString(exec);
     if (exec->hadException())
         return true;
     
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
index 04dabf0..f8146bd 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetCustom.cpp
@@ -27,6 +27,7 @@
 #include "JSStyleSheet.h"
 
 #include "CSSStyleSheet.h"
+#include "Node.h"
 #include "JSCSSStyleSheet.h"
 #include "JSNode.h"
 
@@ -34,7 +35,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr toJS(ExecState* exec, StyleSheet* styleSheet)
+JSValue toJS(ExecState* exec, StyleSheet* styleSheet)
 {
     if (!styleSheet)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
index ea41687..1da6418 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSStyleSheetListCustom.cpp
@@ -40,7 +40,7 @@ bool JSStyleSheetList::canGetItemsForName(ExecState*, StyleSheetList* styleSheet
     return styleSheetList->getNamedItem(propertyName);
 }
 
-JSValuePtr JSStyleSheetList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSStyleSheetList::nameGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     JSStyleSheetList* thisObj = static_cast<JSStyleSheetList*>(asObject(slot.slotBase()));
     HTMLStyleElement* element = thisObj->impl()->getNamedItem(propertyName);
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSTextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSTextCustom.cpp
index 8118aef..9e66826 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSTextCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSTextCustom.cpp
@@ -32,7 +32,7 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr toJSNewlyCreated(ExecState* exec, Text* text)
+JSValue toJSNewlyCreated(ExecState* exec, Text* text)
 {
     if (!text)
         return jsNull();
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSTreeWalkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSTreeWalkerCustom.cpp
index aca0f93..6369017 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSTreeWalkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSTreeWalkerCustom.cpp
@@ -37,7 +37,7 @@ void JSTreeWalker::mark()
     DOMObject::mark();
 }
     
-JSValuePtr JSTreeWalker::parentNode(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::parentNode(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->parentNode(exec);
     if (exec->hadException())
@@ -45,7 +45,7 @@ JSValuePtr JSTreeWalker::parentNode(ExecState* exec, const ArgList&)
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::firstChild(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::firstChild(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->firstChild(exec);
     if (exec->hadException())
@@ -53,7 +53,7 @@ JSValuePtr JSTreeWalker::firstChild(ExecState* exec, const ArgList&)
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::lastChild(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::lastChild(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->lastChild(exec);
     if (exec->hadException())
@@ -61,7 +61,7 @@ JSValuePtr JSTreeWalker::lastChild(ExecState* exec, const ArgList&)
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::nextSibling(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::nextSibling(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->nextSibling(exec);
     if (exec->hadException())
@@ -69,7 +69,7 @@ JSValuePtr JSTreeWalker::nextSibling(ExecState* exec, const ArgList&)
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::previousSibling(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::previousSibling(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->previousSibling(exec);
     if (exec->hadException())
@@ -77,7 +77,7 @@ JSValuePtr JSTreeWalker::previousSibling(ExecState* exec, const ArgList&)
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::previousNode(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::previousNode(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->previousNode(exec);
     if (exec->hadException())
@@ -85,7 +85,7 @@ JSValuePtr JSTreeWalker::previousNode(ExecState* exec, const ArgList&)
     return toJS(exec, node);
 }
     
-JSValuePtr JSTreeWalker::nextNode(ExecState* exec, const ArgList&)
+JSValue JSTreeWalker::nextNode(ExecState* exec, const ArgList&)
 {
     Node* node = impl()->nextNode(exec);
     if (exec->hadException())
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.cpp
new file mode 100644
index 0000000..c7fe4a5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSWebKitCSSMatrixConstructor.h"
+
+#include "WebKitCSSMatrix.h"
+#include "JSWebKitCSSMatrix.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+const ClassInfo JSWebKitCSSMatrixConstructor::s_info = { "WebKitCSSMatrixConstructor", 0, 0, 0 };
+
+JSWebKitCSSMatrixConstructor::JSWebKitCSSMatrixConstructor(ExecState* exec)
+    : DOMObject(JSWebKitCSSMatrixConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+{
+    putDirect(exec->propertyNames().prototype, JSWebKitCSSMatrixPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructWebKitCSSMatrix(ExecState* exec, JSObject*, const ArgList& args)
+{
+    String s;
+    if (args.size() >= 1)
+        s = args.at(0).toString(exec);
+    
+    ExceptionCode ec = 0;
+    RefPtr<WebKitCSSMatrix> matrix = WebKitCSSMatrix::create(s, ec);
+    setDOMException(exec, ec);
+    return CREATE_DOM_OBJECT_WRAPPER(exec, WebKitCSSMatrix, matrix.get());
+}
+
+ConstructType JSWebKitCSSMatrixConstructor::getConstructData(ConstructData& constructData)
+{
+    constructData.native.function = constructWebKitCSSMatrix;
+    return ConstructTypeHost;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.h
new file mode 100644
index 0000000..d0e0bd1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitCSSMatrixConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWebKitCSSMatrixConstructor_h
+#define JSWebKitCSSMatrixConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+class JSWebKitCSSMatrixConstructor : public DOMObject {
+public:
+    JSWebKitCSSMatrixConstructor(JSC::ExecState*);
+    static const JSC::ClassInfo s_info;
+
+private:
+    virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+};
+
+}
+
+#endif // JSWebKitCSSMatrixConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitPointConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitPointConstructor.cpp
new file mode 100644
index 0000000..c7d4e36
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitPointConstructor.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "JSWebKitPointConstructor.h"
+
+#include "Document.h"
+#include "WebKitPoint.h"
+#include "JSWebKitPoint.h"
+
+namespace WebCore {
+
+using namespace JSC;
+
+const ClassInfo JSWebKitPointConstructor::s_info = { "WebKitPointConstructor", 0, 0, 0 };
+
+JSWebKitPointConstructor::JSWebKitPointConstructor(ExecState* exec)
+    : DOMObject(JSWebKitPointConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+{
+    putDirect(exec->propertyNames().prototype, JSWebKitPointPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    putDirect(exec->propertyNames().length, jsNumber(exec, 2), ReadOnly|DontDelete|DontEnum);
+}
+
+static JSObject* constructWebKitPoint(ExecState* exec, JSObject*, const ArgList& args)
+{
+    float x = 0;
+    float y = 0;
+    if (args.size() >= 2) {
+        x = (float)args.at(0).toNumber(exec);
+        y = (float)args.at(1).toNumber(exec);
+        if (isnan(x))
+            x = 0;
+        if (isnan(y))
+            y = 0;
+    }
+    return asObject(toJS(exec, WebKitPoint::create(x, y)));
+}
+
+JSC::ConstructType JSWebKitPointConstructor::getConstructData(JSC::ConstructData& constructData)
+{
+    constructData.native.function = constructWebKitPoint;
+    return ConstructTypeHost;
+}
+
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitPointConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitPointConstructor.h
new file mode 100644
index 0000000..a5bb5c1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWebKitPointConstructor.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef JSWebKitPointConstructor_h
+#define JSWebKitPointConstructor_h
+
+#include "JSDOMBinding.h"
+#include "JSDocument.h"
+
+namespace WebCore {
+
+class JSWebKitPointConstructor : public DOMObject {
+public:
+    JSWebKitPointConstructor(JSC::ExecState*);
+    static const JSC::ClassInfo s_info;
+
+private:
+    virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+};
+
+}
+
+#endif // JSWebKitPointConstructor_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerConstructor.cpp
index 2c964c3..8ea6718 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerConstructor.cpp
@@ -44,6 +44,7 @@ const ClassInfo JSWorkerConstructor::s_info = { "WorkerConstructor", 0, 0, 0 };
 JSWorkerConstructor::JSWorkerConstructor(ExecState* exec)
     : DOMObject(JSWorkerConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
 {
+    putDirect(exec->propertyNames().prototype, JSWorkerPrototype::self(exec, exec->lexicalGlobalObject()), None);
     putDirect(exec->propertyNames().length, jsNumber(exec, 1), ReadOnly|DontDelete|DontEnum);
 }
 
@@ -52,7 +53,7 @@ static JSObject* constructWorker(ExecState* exec, JSObject*, const ArgList& args
     if (args.size() == 0)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
-    UString scriptURL = args.at(exec, 0)->toString(exec);
+    UString scriptURL = args.at(0).toString(exec);
     if (exec->hadException())
         return 0;
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
index 24dd50f..c71f45b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.cpp
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,29 +31,16 @@
 
 #include "JSWorkerContextBase.h"
 
-#include "Event.h"
-#include "JSDOMBinding.h"
-#include "JSEventListener.h"
-#include "JSMessageChannelConstructor.h"
-#include "JSMessageEvent.h"
-#include "JSMessagePort.h"
-#include "JSWorkerLocation.h"
-#include "JSWorkerNavigator.h"
+#include "JSWorkerContext.h"
 #include "WorkerContext.h"
-#include "WorkerLocation.h"
 
 using namespace JSC;
 
-/*
-@begin JSWorkerContextBaseTable
-@end
-*/
-
-#include "JSWorkerContextBase.lut.h"
-
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSWorkerContextBase)
+ASSERT_CLASS_FITS_IN_CELL(JSWorkerContextBase);
+
+const ClassInfo JSWorkerContextBase::s_info = { "WorkerContext", 0, 0, 0 };
 
 JSWorkerContextBase::JSWorkerContextBase(PassRefPtr<JSC::Structure> structure, PassRefPtr<WorkerContext> impl)
     : JSDOMGlobalObject(structure, new JSDOMGlobalObjectData, this)
@@ -69,16 +57,14 @@ ScriptExecutionContext* JSWorkerContextBase::scriptExecutionContext() const
     return m_impl.get();
 }
 
-static const HashTable* getJSWorkerContextBaseTable(ExecState* exec)
-{
-    return getHashTableForGlobalData(exec->globalData(), &JSWorkerContextBaseTable);
-}
-
-const ClassInfo JSWorkerContextBase::s_info = { "WorkerContext", 0, 0, getJSWorkerContextBaseTable };
-
-void JSWorkerContextBase::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+JSValue toJS(ExecState*, WorkerContext* workerContext)
 {
-    lookupPut<JSWorkerContextBase, Base>(exec, propertyName, value, getJSWorkerContextBaseTable(exec), this, slot);
+    if (!workerContext)
+        return jsNull();
+    WorkerScriptController* script = workerContext->script();
+    if (!script)
+        return jsNull();
+    return script->workerContextWrapper();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.h b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.h
index d2d5bd2..dcbc5c3 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextBase.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -41,7 +41,6 @@ namespace WebCore {
         JSWorkerContextBase(PassRefPtr<JSC::Structure>, PassRefPtr<WorkerContext>);
         virtual ~JSWorkerContextBase();
 
-        virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
         virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
         static const JSC::ClassInfo s_info;
 
@@ -52,6 +51,9 @@ namespace WebCore {
         RefPtr<WorkerContext> m_impl;
     };
 
+    // Returns a JSWorkerContext or jsNull()
+    JSC::JSValue toJS(JSC::ExecState*, WorkerContext*);
+
 } // namespace WebCore
 
 #endif // ENABLE(WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
index 2bf4dbc..14bbe19 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerContextCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,68 +31,113 @@
 
 #include "JSDOMBinding.h"
 #include "JSEventListener.h"
+#include "JSWorkerLocation.h"
+#include "JSWorkerNavigator.h"
+#include "JSXMLHttpRequestConstructor.h"
+#include "ScheduledAction.h"
 #include "WorkerContext.h"
+#include "WorkerLocation.h"
+#include "WorkerNavigator.h"
+#include <interpreter/Interpreter.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-bool JSWorkerContext::customGetOwnPropertySlot(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertySlot& slot)
-{
-    // Look for overrides before looking at any of our own properties.
-    if (JSGlobalObject::getOwnPropertySlot(exec, propertyName, slot))
-        return true;
-    return false;
-}
-
 void JSWorkerContext::mark()
 {
     Base::mark();
 
-    markActiveObjectsForContext(*globalData(), scriptExecutionContext());
+    JSGlobalData& globalData = *this->globalData();
 
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(impl()->onmessage()))
-        listener->mark();
+    markActiveObjectsForContext(globalData, scriptExecutionContext());
+
+    markDOMObjectWrapper(globalData, impl()->optionalLocation());
+    markDOMObjectWrapper(globalData, impl()->optionalNavigator());
+
+    markIfNotNull(impl()->onmessage());
 
     typedef WorkerContext::EventListenersMap EventListenersMap;
     typedef WorkerContext::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = impl()->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) {
-            JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(vecIter->get());
-            listener->mark();
-        }
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
+            (*vecIter)->markJSFunction();
     }
 }
 
-JSValuePtr JSWorkerContext::self(ExecState*) const
+bool JSWorkerContext::getOwnPropertySlotDelegate(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    // Look for overrides before looking at any of our own properties.
+    if (JSGlobalObject::getOwnPropertySlot(exec, propertyName, slot))
+        return true;
+    return false;
+}
+
+JSValue JSWorkerContext::xmlHttpRequest(ExecState* exec) const
 {
-    return asValue();
+    return getDOMConstructor<JSXMLHttpRequestConstructor>(exec, this);
 }
 
-void JSWorkerContext::setSelf(ExecState* exec, JSValuePtr value)
+JSValue JSWorkerContext::importScripts(ExecState* exec, const ArgList& args)
 {
-    putDirect(Identifier(exec, "self"), value);
+    if (!args.size())
+        return jsUndefined();
+
+    Vector<String> urls;
+    for (unsigned i = 0; i < args.size(); i++) {
+        urls.append(args.at(i).toString(exec));
+        if (exec->hadException())
+            return jsUndefined();
+    }
+    ExceptionCode ec = 0;
+    int signedLineNumber;
+    intptr_t sourceID;
+    UString sourceURL;
+    JSValue function;
+    exec->interpreter()->retrieveLastCaller(exec, signedLineNumber, sourceID, sourceURL, function);
+
+    impl()->importScripts(urls, sourceURL, signedLineNumber >= 0 ? signedLineNumber : 0, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
 }
 
-JSValuePtr JSWorkerContext::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSWorkerContext::addEventListener(ExecState* exec, const ArgList& args)
 {
-    RefPtr<JSUnprotectedEventListener> listener = findOrCreateJSUnprotectedEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSWorkerContext::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSWorkerContext::removeEventListener(ExecState* exec, const ArgList& args)
 {
-    JSUnprotectedEventListener* listener = findJSUnprotectedEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
+JSValue JSWorkerContext::setTimeout(ExecState* exec, const ArgList& args)
+{
+    ScheduledAction* action = ScheduledAction::create(exec, args);
+    if (exec->hadException())
+        return jsUndefined();
+    int delay = args.at(1).toInt32(exec);
+    return jsNumber(exec, impl()->setTimeout(action, delay));
+}
+
+JSValue JSWorkerContext::setInterval(ExecState* exec, const ArgList& args)
+{
+    ScheduledAction* action = ScheduledAction::create(exec, args);
+    if (exec->hadException())
+        return jsUndefined();
+    int delay = args.at(1).toInt32(exec);
+    return jsNumber(exec, impl()->setInterval(action, delay));
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp
index bb40705..f4d3033 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSWorkerCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -41,44 +41,39 @@ void JSWorker::mark()
 {
     DOMObject::mark();
 
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onmessage()))
-        listener->mark();
-
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(m_impl->onerror()))
-        listener->mark();
+    markIfNotNull(m_impl->onmessage());
+    markIfNotNull(m_impl->onerror());
 
     typedef Worker::EventListenersMap EventListenersMap;
     typedef Worker::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) {
-            JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(vecIter->get());
-            listener->mark();
-        }
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
+            (*vecIter)->markJSFunction();
     }
 }
 
-JSValuePtr JSWorker::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSWorker::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSUnprotectedEventListener> listener = globalObject->findOrCreateJSUnprotectedEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSWorker::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSWorker::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSUnprotectedEventListener* listener = globalObject->findJSUnprotectedEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
index d7f54de..65cdfc2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.cpp
@@ -28,22 +28,29 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequestConstructor)
+ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequestConstructor);
 
 const ClassInfo JSXMLHttpRequestConstructor::s_info = { "XMLHttpRequestConstructor", 0, 0, 0 };
 
-JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor(ExecState* exec, ScriptExecutionContext* context)
+JSXMLHttpRequestConstructor::JSXMLHttpRequestConstructor(ExecState* exec, JSDOMGlobalObject* globalObject)
     : DOMObject(JSXMLHttpRequestConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    , m_globalObject(globalObject)
 {
-    ASSERT(context->isDocument());
-    m_document = static_cast<JSDocument*>(asObject(toJS(exec, static_cast<Document*>(context))));
+    putDirect(exec->propertyNames().prototype, JSXMLHttpRequestPrototype::self(exec, exec->lexicalGlobalObject()), None);
+}
 
-    putDirect(exec->propertyNames().prototype, JSXMLHttpRequestPrototype::self(exec), None);
+ScriptExecutionContext* JSXMLHttpRequestConstructor::scriptExecutionContext() const
+{
+    return m_globalObject->scriptExecutionContext();
 }
 
 static JSObject* constructXMLHttpRequest(ExecState* exec, JSObject* constructor, const ArgList&)
 {
-    RefPtr<XMLHttpRequest> xmlHttpRequest = XMLHttpRequest::create(static_cast<JSXMLHttpRequestConstructor*>(constructor)->document());
+    ScriptExecutionContext* context = static_cast<JSXMLHttpRequestConstructor*>(constructor)->scriptExecutionContext();
+    if (!context)
+        return throwError(exec, ReferenceError, "XMLHttpRequest constructor associated document is unavailable");
+
+    RefPtr<XMLHttpRequest> xmlHttpRequest = XMLHttpRequest::create(context);
     return CREATE_DOM_OBJECT_WRAPPER(exec, XMLHttpRequest, xmlHttpRequest.get());
 }
 
@@ -56,8 +63,8 @@ ConstructType JSXMLHttpRequestConstructor::getConstructData(ConstructData& const
 void JSXMLHttpRequestConstructor::mark()
 {
     DOMObject::mark();
-    if (!m_document->marked())
-        m_document->mark();
+    if (!m_globalObject->marked())
+        m_globalObject->mark();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.h b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.h
index f235af6..978a9f0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestConstructor.h
@@ -21,14 +21,13 @@
 #define JSXMLHttpRequestConstructor_h
 
 #include "JSDOMBinding.h"
-#include "JSDocument.h"
 
 namespace WebCore {
 
 class JSXMLHttpRequestConstructor : public DOMObject {
 public:
-    JSXMLHttpRequestConstructor(JSC::ExecState*, ScriptExecutionContext*);
-    Document* document() const { return m_document->impl(); }
+    JSXMLHttpRequestConstructor(JSC::ExecState*, JSDOMGlobalObject*);
+    ScriptExecutionContext* scriptExecutionContext() const;
     static const JSC::ClassInfo s_info;
 
     virtual void mark();
@@ -36,7 +35,7 @@ private:
     virtual JSC::ConstructType getConstructData(JSC::ConstructData&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
 
-    JSDocument* m_document;
+    JSDOMGlobalObject* m_globalObject;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
index 49813c4..06a5817 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -59,53 +59,40 @@ void JSXMLHttpRequest::mark()
             wrapper->mark();
     }
 
-    if (JSUnprotectedEventListener* onReadyStateChangeListener = static_cast<JSUnprotectedEventListener*>(m_impl->onreadystatechange()))
-        onReadyStateChangeListener->mark();
-
-    if (JSUnprotectedEventListener* onAbortListener = static_cast<JSUnprotectedEventListener*>(m_impl->onabort()))
-        onAbortListener->mark();
-
-    if (JSUnprotectedEventListener* onErrorListener = static_cast<JSUnprotectedEventListener*>(m_impl->onerror()))
-        onErrorListener->mark();
-
-    if (JSUnprotectedEventListener* onLoadListener = static_cast<JSUnprotectedEventListener*>(m_impl->onload()))
-        onLoadListener->mark();
-
-    if (JSUnprotectedEventListener* onLoadStartListener = static_cast<JSUnprotectedEventListener*>(m_impl->onloadstart()))
-        onLoadStartListener->mark();
-    
-    if (JSUnprotectedEventListener* onProgressListener = static_cast<JSUnprotectedEventListener*>(m_impl->onprogress()))
-        onProgressListener->mark();
+    markIfNotNull(m_impl->onreadystatechange());
+    markIfNotNull(m_impl->onabort());
+    markIfNotNull(m_impl->onerror());
+    markIfNotNull(m_impl->onload());
+    markIfNotNull(m_impl->onloadstart());
+    markIfNotNull(m_impl->onprogress());
     
     typedef XMLHttpRequest::EventListenersMap EventListenersMap;
     typedef XMLHttpRequest::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) {
-            JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(vecIter->get());
-            listener->mark();
-        }
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
+            (*vecIter)->markJSFunction();
     }
 }
 
 // Custom functions
-JSValuePtr JSXMLHttpRequest::open(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::open(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 2)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
-    const KURL& url = impl()->scriptExecutionContext()->completeURL(args.at(exec, 1)->toString(exec));
-    String method = args.at(exec, 0)->toString(exec);
+    const KURL& url = impl()->scriptExecutionContext()->completeURL(args.at(1).toString(exec));
+    String method = args.at(0).toString(exec);
     bool async = true;
     if (args.size() >= 3)
-        async = args.at(exec, 2)->toBoolean(exec);
+        async = args.at(2).toBoolean(exec);
 
     ExceptionCode ec = 0;
-    if (args.size() >= 4 && !args.at(exec, 3)->isUndefined()) {
-        String user = valueToStringWithNullCheck(exec, args.at(exec, 3));
+    if (args.size() >= 4 && !args.at(3).isUndefined()) {
+        String user = valueToStringWithNullCheck(exec, args.at(3));
 
-        if (args.size() >= 5 && !args.at(exec, 4)->isUndefined()) {
-            String password = valueToStringWithNullCheck(exec, args.at(exec, 4));
+        if (args.size() >= 5 && !args.at(4).isUndefined()) {
+            String password = valueToStringWithNullCheck(exec, args.at(4));
             impl()->open(method, url, async, user, password, ec);
         } else
             impl()->open(method, url, async, user, ec);
@@ -116,38 +103,38 @@ JSValuePtr JSXMLHttpRequest::open(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::setRequestHeader(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::setRequestHeader(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 2)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
     ExceptionCode ec = 0;
-    impl()->setRequestHeader(args.at(exec, 0)->toString(exec), args.at(exec, 1)->toString(exec), ec);
+    impl()->setRequestHeader(args.at(0).toString(exec), args.at(1).toString(exec), ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::send(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::send(ExecState* exec, const ArgList& args)
 {
     ExceptionCode ec = 0;
     if (args.isEmpty())
         impl()->send(ec);
     else {
-        JSValuePtr val = args.at(exec, 0);
-        if (val->isUndefinedOrNull())
+        JSValue val = args.at(0);
+        if (val.isUndefinedOrNull())
             impl()->send(ec);
-        else if (val->isObject(&JSDocument::s_info))
+        else if (val.isObject(&JSDocument::s_info))
             impl()->send(toDocument(val), ec);
-        else if (val->isObject(&JSFile::s_info))
+        else if (val.isObject(&JSFile::s_info))
             impl()->send(toFile(val), ec);
         else
-            impl()->send(val->toString(exec), ec);
+            impl()->send(val.toString(exec), ec);
     }
 
     int signedLineNumber;
     intptr_t sourceID;
     UString sourceURL;
-    JSValuePtr function;
+    JSValue function;
     exec->interpreter()->retrieveLastCaller(exec, signedLineNumber, sourceID, sourceURL, function);
     impl()->setLastSendLineNumber(signedLineNumber >= 0 ? signedLineNumber : 0);
     impl()->setLastSendURL(sourceURL);
@@ -156,51 +143,51 @@ JSValuePtr JSXMLHttpRequest::send(ExecState* exec, const ArgList& args)
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::getResponseHeader(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::getResponseHeader(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
     ExceptionCode ec = 0;
-    JSValuePtr header = jsStringOrNull(exec, impl()->getResponseHeader(args.at(exec, 0)->toString(exec), ec));
+    JSValue header = jsStringOrNull(exec, impl()->getResponseHeader(args.at(0).toString(exec), ec));
     setDOMException(exec, ec);
     return header;
 }
 
-JSValuePtr JSXMLHttpRequest::overrideMimeType(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::overrideMimeType(ExecState* exec, const ArgList& args)
 {
     if (args.size() < 1)
         return throwError(exec, SyntaxError, "Not enough arguments");
 
-    impl()->overrideMimeType(args.at(exec, 0)->toString(exec));
+    impl()->overrideMimeType(args.at(0).toString(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSUnprotectedEventListener> listener = globalObject->findOrCreateJSUnprotectedEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequest::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSUnprotectedEventListener* listener = globalObject->findJSUnprotectedEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequest::responseText(ExecState* exec) const
+JSValue JSXMLHttpRequest::responseText(ExecState* exec) const
 {
     return jsOwnedStringOrNull(exec, impl()->responseText());
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
index 5d094db..597010c 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXMLHttpRequestUploadCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -51,53 +51,42 @@ void JSXMLHttpRequestUpload::mark()
             wrapper->mark();
     }
 
-    if (JSUnprotectedEventListener* onAbortListener = static_cast<JSUnprotectedEventListener*>(m_impl->onabort()))
-        onAbortListener->mark();
-
-    if (JSUnprotectedEventListener* onErrorListener = static_cast<JSUnprotectedEventListener*>(m_impl->onerror()))
-        onErrorListener->mark();
-
-    if (JSUnprotectedEventListener* onLoadListener = static_cast<JSUnprotectedEventListener*>(m_impl->onload()))
-        onLoadListener->mark();
-
-    if (JSUnprotectedEventListener* onLoadStartListener = static_cast<JSUnprotectedEventListener*>(m_impl->onloadstart()))
-        onLoadStartListener->mark();
-    
-    if (JSUnprotectedEventListener* onProgressListener = static_cast<JSUnprotectedEventListener*>(m_impl->onprogress()))
-        onProgressListener->mark();
+    markIfNotNull(m_impl->onabort());
+    markIfNotNull(m_impl->onerror());
+    markIfNotNull(m_impl->onload());
+    markIfNotNull(m_impl->onloadstart());
+    markIfNotNull(m_impl->onprogress());
     
     typedef XMLHttpRequestUpload::EventListenersMap EventListenersMap;
     typedef XMLHttpRequestUpload::ListenerVector ListenerVector;
     EventListenersMap& eventListeners = m_impl->eventListeners();
     for (EventListenersMap::iterator mapIter = eventListeners.begin(); mapIter != eventListeners.end(); ++mapIter) {
-        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter) {
-            JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(vecIter->get());
-            listener->mark();
-        }
+        for (ListenerVector::iterator vecIter = mapIter->second.begin(); vecIter != mapIter->second.end(); ++vecIter)
+            (*vecIter)->markJSFunction();
     }
 }
 
-JSValuePtr JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequestUpload::addEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    RefPtr<JSUnprotectedEventListener> listener = globalObject->findOrCreateJSUnprotectedEventListener(exec, args.at(exec, 1));
+    RefPtr<JSEventListener> listener = globalObject->findOrCreateJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->addEventListener(args.at(exec, 0)->toString(exec), listener.release(), args.at(exec, 2)->toBoolean(exec));
+    impl()->addEventListener(args.at(0).toString(exec), listener.release(), args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
-JSValuePtr JSXMLHttpRequestUpload::removeEventListener(ExecState* exec, const ArgList& args)
+JSValue JSXMLHttpRequestUpload::removeEventListener(ExecState* exec, const ArgList& args)
 {
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(impl()->scriptExecutionContext());
     if (!globalObject)
         return jsUndefined();
-    JSUnprotectedEventListener* listener = globalObject->findJSUnprotectedEventListener(exec, args.at(exec, 1));
+    JSEventListener* listener = globalObject->findJSEventListener(args.at(1));
     if (!listener)
         return jsUndefined();
-    impl()->removeEventListener(args.at(exec, 0)->toString(exec), listener, args.at(exec, 2)->toBoolean(exec));
+    impl()->removeEventListener(args.at(0).toString(exec), listener, args.at(2).toBoolean(exec));
     return jsUndefined();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp
index ed456e1..807b017 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorConstructor.cpp
@@ -37,14 +37,14 @@ using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXSLTProcessorConstructor)
+ASSERT_CLASS_FITS_IN_CELL(JSXSLTProcessorConstructor);
 
 const ClassInfo JSXSLTProcessorConstructor::s_info = { "XSLTProcessorConsructor", 0, 0, 0 };
 
 JSXSLTProcessorConstructor::JSXSLTProcessorConstructor(ExecState* exec)
     : DOMObject(JSXSLTProcessorConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
 {
-    putDirect(exec->propertyNames().prototype, JSXSLTProcessorPrototype::self(exec), None);
+    putDirect(exec->propertyNames().prototype, JSXSLTProcessorPrototype::self(exec, exec->lexicalGlobalObject()), None);
 }
 
 static JSObject* constructXSLTProcessor(ExecState* exec, JSObject*, const ArgList&)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorCustom.cpp b/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
index cdd5d1f..01e53a6 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/JSXSLTProcessorCustom.cpp
@@ -46,10 +46,10 @@ using namespace JSC;
 
 namespace WebCore {
 
-JSValuePtr JSXSLTProcessor::importStylesheet(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::importStylesheet(ExecState*, const ArgList& args)
 {
-    JSValuePtr nodeVal = args.at(exec, 0);
-    if (nodeVal->isObject(&JSNode::s_info)) {
+    JSValue nodeVal = args.at(0);
+    if (nodeVal.isObject(&JSNode::s_info)) {
         JSNode* node = static_cast<JSNode*>(asObject(nodeVal));
         impl()->importStylesheet(node->impl());
         return jsUndefined();
@@ -58,11 +58,11 @@ JSValuePtr JSXSLTProcessor::importStylesheet(ExecState* exec, const ArgList& arg
     return jsUndefined();
 }
 
-JSValuePtr JSXSLTProcessor::transformToFragment(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::transformToFragment(ExecState* exec, const ArgList& args)
 {
-    JSValuePtr nodeVal = args.at(exec, 0);
-    JSValuePtr docVal = args.at(exec, 1);
-    if (nodeVal->isObject(&JSNode::s_info) && docVal->isObject(&JSDocument::s_info)) {
+    JSValue nodeVal = args.at(0);
+    JSValue docVal = args.at(1);
+    if (nodeVal.isObject(&JSNode::s_info) && docVal.isObject(&JSDocument::s_info)) {
         WebCore::Node* node = static_cast<JSNode*>(asObject(nodeVal))->impl();
         Document* doc = static_cast<Document*>(static_cast<JSDocument*>(asObject(docVal))->impl());
         return toJS(exec, impl()->transformToFragment(node, doc).get());
@@ -71,10 +71,10 @@ JSValuePtr JSXSLTProcessor::transformToFragment(ExecState* exec, const ArgList&
     return jsUndefined();
 }
 
-JSValuePtr JSXSLTProcessor::transformToDocument(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::transformToDocument(ExecState* exec, const ArgList& args)
 {
-    JSValuePtr nodeVal = args.at(exec, 0);
-    if (nodeVal->isObject(&JSNode::s_info)) {
+    JSValue nodeVal = args.at(0);
+    if (nodeVal.isObject(&JSNode::s_info)) {
         JSNode* node = static_cast<JSNode*>(asObject(nodeVal));
         RefPtr<Document> resultDocument = impl()->transformToDocument(node->impl());
         if (resultDocument)
@@ -85,33 +85,33 @@ JSValuePtr JSXSLTProcessor::transformToDocument(ExecState* exec, const ArgList&
     return jsUndefined();
 }
 
-JSValuePtr JSXSLTProcessor::setParameter(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::setParameter(ExecState* exec, const ArgList& args)
 {
-    if (args.at(exec, 1)->isUndefinedOrNull() || args.at(exec, 2)->isUndefinedOrNull())
+    if (args.at(1).isUndefinedOrNull() || args.at(2).isUndefinedOrNull())
         return jsUndefined(); // Throw exception?
-    String namespaceURI = args.at(exec, 0)->toString(exec);
-    String localName = args.at(exec, 1)->toString(exec);
-    String value = args.at(exec, 2)->toString(exec);
+    String namespaceURI = args.at(0).toString(exec);
+    String localName = args.at(1).toString(exec);
+    String value = args.at(2).toString(exec);
     impl()->setParameter(namespaceURI, localName, value);
     return jsUndefined();
 }
 
-JSValuePtr JSXSLTProcessor::getParameter(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::getParameter(ExecState* exec, const ArgList& args)
 {
-    if (args.at(exec, 1)->isUndefinedOrNull())
+    if (args.at(1).isUndefinedOrNull())
         return jsUndefined();
-    String namespaceURI = args.at(exec, 0)->toString(exec);
-    String localName = args.at(exec, 1)->toString(exec);
+    String namespaceURI = args.at(0).toString(exec);
+    String localName = args.at(1).toString(exec);
     String value = impl()->getParameter(namespaceURI, localName);
     return jsStringOrUndefined(exec, value);
 }
 
-JSValuePtr JSXSLTProcessor::removeParameter(ExecState* exec, const ArgList& args)
+JSValue JSXSLTProcessor::removeParameter(ExecState* exec, const ArgList& args)
 {
-    if (args.at(exec, 1)->isUndefinedOrNull())
+    if (args.at(1).isUndefinedOrNull())
         return jsUndefined();
-    String namespaceURI = args.at(exec, 0)->toString(exec);
-    String localName = args.at(exec, 1)->toString(exec);
+    String namespaceURI = args.at(0).toString(exec);
+    String localName = args.at(1).toString(exec);
     impl()->removeParameter(namespaceURI, localName);
     return jsUndefined();
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
index d247194..91bece7 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.cpp
@@ -1,8 +1,9 @@
 /*
  *  Copyright (C) 2000 Harri Porten (porten@kde.org)
  *  Copyright (C) 2006 Jon Shier (jshier@iastate.edu)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reseved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reseved.
  *  Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
+ *  Copyright (C) 2009 Google Inc. All rights reseved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -32,74 +33,119 @@
 #include "JSDOMWindow.h"
 #include "ScriptController.h"
 #include "ScriptExecutionContext.h"
+#include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include <runtime/JSLock.h>
 
+#if ENABLE(WORKERS)
+#include "JSWorkerContext.h"
+#include "WorkerContext.h"
+#include "WorkerThread.h"
+#endif
+
 using namespace JSC;
 
 namespace WebCore {
 
-ScheduledAction::ScheduledAction(ExecState* exec, JSValuePtr function, const ArgList& args)
+ScheduledAction* ScheduledAction::create(ExecState* exec, const ArgList& args)
+{
+    JSValue v = args.at(0);
+    CallData callData;
+    if (v.getCallData(callData) == CallTypeNone) {
+        UString string = v.toString(exec);
+        if (exec->hadException())
+            return 0;
+        return new ScheduledAction(string);
+    }
+    ArgList argsTail;
+    args.getSlice(2, argsTail);
+    return new ScheduledAction(v, argsTail);
+}
+
+ScheduledAction::ScheduledAction(JSValue function, const ArgList& args)
     : m_function(function)
 {
     ArgList::const_iterator end = args.end();
-    for (ArgList::const_iterator it = args.begin(); it != end; ++it) {
-        m_args.append((*it).jsValue(exec));
-    }
+    for (ArgList::const_iterator it = args.begin(); it != end; ++it)
+        m_args.append(*it);
 }
 
 void ScheduledAction::execute(ScriptExecutionContext* context)
 {
-    // FIXME: make it work with Workers SEC too.
+    if (context->isDocument())
+        execute(static_cast<Document*>(context));
+#if ENABLE(WORKERS)
+    else {
+        ASSERT(context->isWorkerContext());
+        execute(static_cast<WorkerContext*>(context));
+    }
+#else
     ASSERT(context->isDocument());
-    Document* document = static_cast<Document*>(context);
-    if (JSDOMWindow* window = toJSDOMWindow(document->frame()))
-        execute(window->shell());
+#endif
 }
 
-void ScheduledAction::execute(JSDOMWindowShell* windowShell)
+void ScheduledAction::executeFunctionInContext(JSGlobalObject* globalObject, JSValue thisValue)
 {
-    RefPtr<Frame> frame = windowShell->window()->impl()->frame();
-    if (!frame)
+    ASSERT(m_function);
+    JSLock lock(false);
+
+    CallData callData;
+    CallType callType = m_function.get().getCallData(callData);
+    if (callType == CallTypeNone)
         return;
 
-    if (!frame->script()->isEnabled())
+    ExecState* exec = globalObject->globalExec();
+
+    MarkedArgumentBuffer args;
+    size_t size = m_args.size();
+    for (size_t i = 0; i < size; ++i)
+        args.append(m_args[i]);
+
+    globalObject->globalData()->timeoutChecker.start();
+    call(exec, m_function, callType, callData, thisValue, args);
+    globalObject->globalData()->timeoutChecker.stop();
+
+    if (exec->hadException())
+        reportCurrentException(exec);
+}
+
+void ScheduledAction::execute(Document* document)
+{
+    JSDOMWindow* window = toJSDOMWindow(document->frame());
+    if (!window)
         return;
 
-    frame->script()->setProcessingTimerCallback(true);
+    RefPtr<Frame> frame = window->impl()->frame();
+    if (!frame || !frame->script()->isEnabled())
+        return;
 
-    JSLock lock(false);
+    frame->script()->setProcessingTimerCallback(true);
 
     if (m_function) {
-        CallData callData;
-        CallType callType = m_function->getCallData(callData);
-        if (callType != CallTypeNone) {
-            JSDOMWindow* window = windowShell->window();
-            ExecState* exec = window->globalExec();
-
-            ArgList args;
-            size_t size = m_args.size();
-            for (size_t i = 0; i < size; ++i)
-                args.append(m_args[i]);
-
-            window->startTimeoutCheck();
-            call(exec, m_function, callType, callData, windowShell, args);
-            window->stopTimeoutCheck();
-            if (exec->hadException())
-                reportCurrentException(exec);
-        }
+        executeFunctionInContext(window, window->shell());
+        Document::updateStyleForAllDocuments();
     } else
         frame->loader()->executeScript(m_code);
 
-    // Update our document's rendering following the execution of the timeout callback.
-    // FIXME: Why not use updateDocumentsRendering to update rendering of all documents?
-    // FIXME: Is this really the right point to do the update? We need a place that works
-    // for all possible entry points that might possibly execute script, but this seems
-    // to be a bit too low-level.
-    if (Document* document = frame->document())
-        document->updateRendering();
-
     frame->script()->setProcessingTimerCallback(false);
 }
 
+#if ENABLE(WORKERS)
+void ScheduledAction::execute(WorkerContext* workerContext)
+{
+    // In a Worker, the execution should always happen on a worker thread.
+    ASSERT(workerContext->thread()->threadID() == currentThread());
+
+    WorkerScriptController* scriptController = workerContext->script();
+
+    if (m_function) {
+        JSWorkerContext* contextWrapper = scriptController->workerContextWrapper();
+        executeFunctionInContext(contextWrapper, contextWrapper);
+    } else {
+        ScriptSourceCode code(m_code, workerContext->url());
+        scriptController->evaluate(code);
+    }
+}
+#endif // ENABLE(WORKERS)
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
index 9bf83ad..e7d0b75 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScheduledAction.h
@@ -1,6 +1,6 @@
 /*
  *  Copyright (C) 2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reseved.
+ *  Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reseved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -24,10 +24,15 @@
 #include <runtime/Protect.h>
 #include <wtf/Vector.h>
 
+namespace JSC {
+    class JSGlobalObject;
+}
+
 namespace WebCore {
 
-    class JSDOMWindowShell;
+    class Document;
     class ScriptExecutionContext;
+    class WorkerContext;
 
    /* An action (either function or string) to be executed after a specified
     * time interval, either once or repeatedly. Used for window.setTimeout()
@@ -35,19 +40,25 @@ namespace WebCore {
     */
     class ScheduledAction {
     public:
-        ScheduledAction(JSC::ExecState* exec, JSC::JSValuePtr function, const JSC::ArgList&);
+        static ScheduledAction* create(JSC::ExecState*, const JSC::ArgList&);
+
+        void execute(ScriptExecutionContext*);
+
+    private:
+        ScheduledAction(JSC::JSValue function, const JSC::ArgList&);
         ScheduledAction(const String& code)
             : m_code(code)
         {
         }
-         
-        void execute(ScriptExecutionContext*);
 
-    private:
-        void execute(JSDOMWindowShell*);
+        void executeFunctionInContext(JSC::JSGlobalObject*, JSC::JSValue thisValue);
+        void execute(Document*);
+#if ENABLE(WORKERS)        
+        void execute(WorkerContext*);
+#endif
 
-        JSC::ProtectedJSValuePtr m_function;
-        Vector<JSC::ProtectedJSValuePtr> m_args;
+        JSC::ProtectedJSValue m_function;
+        Vector<JSC::ProtectedJSValue> m_args;
         String m_code;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedPageData.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
index eeccf43..213c708 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedPageData.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2008, Google Inc. All rights reserved.
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -29,7 +30,7 @@
  */
 
 #include "config.h"
-#include "ScriptCachedPageData.h"
+#include "ScriptCachedFrameData.h"
 
 #include "Frame.h"
 #include "GCController.h"
@@ -42,45 +43,46 @@ using namespace JSC;
 
 namespace WebCore {
 
-ScriptCachedPageData::ScriptCachedPageData(Page* page)
+ScriptCachedFrameData::ScriptCachedFrameData(Frame* frame)
 {
     JSLock lock(false);
 
-    ScriptController* scriptController = page->mainFrame()->script();
+    ScriptController* scriptController = frame->script();
     if (scriptController->haveWindowShell()) {
         m_window = scriptController->windowShell()->window();
+        scriptController->attachDebugger(0);
     }
 }
 
-DOMWindow* ScriptCachedPageData::domWindow() const {
+DOMWindow* ScriptCachedFrameData::domWindow() const {
     return m_window ? m_window->impl() : 0;
 }
 
-ScriptCachedPageData::~ScriptCachedPageData()
+ScriptCachedFrameData::~ScriptCachedFrameData()
 {
     clear();
 }
 
-void ScriptCachedPageData::restore(Page* page)
+void ScriptCachedFrameData::restore(Frame* frame)
 {
-    Frame* mainFrame = page->mainFrame();
+    Page* page = frame->page();
 
     JSLock lock(false);
 
-    ScriptController* scriptController = mainFrame->script();
+    ScriptController* scriptController = frame->script();
     if (scriptController->haveWindowShell()) {
         JSDOMWindowShell* windowShell = scriptController->windowShell();
         if (m_window) {
             windowShell->setWindow(m_window.get());
         } else {
-            windowShell->setWindow(mainFrame->domWindow());
+            windowShell->setWindow(frame->domWindow());
             scriptController->attachDebugger(page->debugger());
             windowShell->window()->setProfileGroup(page->group().identifier());
         }
     }
 }
 
-void ScriptCachedPageData::clear()
+void ScriptCachedFrameData::clear()
 {
     JSLock lock(false);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedPageData.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.h
index 91e47d0..c661f28 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedPageData.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCachedFrameData.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2008, Google Inc. All rights reserved.
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,22 +29,22 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ScriptCachedPageData_h
-#define ScriptCachedPageData_h
+#ifndef ScriptCachedFrameData_h
+#define ScriptCachedFrameData_h
 
 #include <runtime/Protect.h>
 
 namespace WebCore {
+    class Frame;
     class JSDOMWindow;
-    class Page;
     class DOMWindow;
 
-    class ScriptCachedPageData  {
+    class ScriptCachedFrameData  {
     public:
-        ScriptCachedPageData(Page*);
-        ~ScriptCachedPageData();
+        ScriptCachedFrameData(Frame*);
+        ~ScriptCachedFrameData();
 
-        void restore(Page*);
+        void restore(Frame*);
         void clear();
         DOMWindow* domWindow() const;
 
@@ -53,4 +54,4 @@ namespace WebCore {
 
 } // namespace WebCore
 
-#endif // ScriptCachedPageData_h
+#endif // ScriptCachedFrameData_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.cpp
index 29f380a..58168d0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.cpp
@@ -38,14 +38,14 @@ using namespace JSC;
 
 namespace WebCore {
 
-ScriptCallFrame::ScriptCallFrame(const UString& functionName, const UString& urlString, int lineNumber, ExecState* exec, const ArgList& args, unsigned skipArgumentCount)
+ScriptCallFrame::ScriptCallFrame(const UString& functionName, const UString& urlString, int lineNumber, const ArgList& args, unsigned skipArgumentCount)
     : m_functionName(functionName)
     , m_sourceURL(urlString)
     , m_lineNumber(lineNumber)
 {
     size_t argumentCount = args.size();
     for (size_t i = skipArgumentCount; i < argumentCount; ++i)
-        m_arguments.append(ScriptValue(args.at(exec, i)));
+        m_arguments.append(ScriptValue(args.at(i)));
 }
 
 ScriptCallFrame::~ScriptCallFrame()
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.h
index 64a1a08..b8c0aba 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallFrame.h
@@ -50,7 +50,7 @@ namespace WebCore {
     // <https://bugs.webkit.org/show_bug.cgi?id=21180>
     class ScriptCallFrame  {
     public:
-        ScriptCallFrame(const JSC::UString& functionName, const JSC::UString& urlString, int lineNumber, JSC::ExecState*, const JSC::ArgList&, unsigned skipArgumentCount);
+        ScriptCallFrame(const JSC::UString& functionName, const JSC::UString& urlString, int lineNumber, const JSC::ArgList&, unsigned skipArgumentCount);
         ~ScriptCallFrame();
 
         const ScriptString& functionName() const { return m_functionName; }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp
index 88acadb..021ede5 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptCallStack.cpp
@@ -50,18 +50,18 @@ ScriptCallStack::ScriptCallStack(ExecState* exec, const ArgList& args, unsigned
     int signedLineNumber;
     intptr_t sourceID;
     UString urlString;
-    JSValuePtr function;
+    JSValue function;
 
     exec->interpreter()->retrieveLastCaller(exec, signedLineNumber, sourceID, urlString, function);
 
     if (function) {
         m_caller = asInternalFunction(function);
         unsigned lineNumber = signedLineNumber >= 0 ? signedLineNumber : 0;
-        m_frames.append(ScriptCallFrame(m_caller->name(&m_exec->globalData()), urlString, lineNumber, exec, args, skipArgumentCount));
+        m_frames.append(ScriptCallFrame(m_caller->name(&m_exec->globalData()), urlString, lineNumber, args, skipArgumentCount));
     } else {
         // Caller is unknown, but we should still add the frame, because
         // something called us, and gave us arguments.
-        m_frames.append(ScriptCallFrame(UString(), UString(), 0, exec, args, skipArgumentCount));
+        m_frames.append(ScriptCallFrame(UString(), UString(), 0, args, skipArgumentCount));
     }
 }
 
@@ -90,11 +90,11 @@ void ScriptCallStack::initialize()
     if (!m_caller || m_initialized)
         return;
 
-    JSValuePtr func = m_exec->interpreter()->retrieveCaller(m_exec, m_caller);
-    while (!func->isNull()) {
+    JSValue func = m_exec->interpreter()->retrieveCaller(m_exec, m_caller);
+    while (!func.isNull()) {
         InternalFunction* internalFunction = asInternalFunction(func);
         ArgList emptyArgList;
-        m_frames.append(ScriptCallFrame(internalFunction->name(&m_exec->globalData()), UString(), 0, 0, emptyArgList, 0));
+        m_frames.append(ScriptCallFrame(internalFunction->name(&m_exec->globalData()), UString(), 0, emptyArgList, 0));
         func = m_exec->interpreter()->retrieveCaller(m_exec, internalFunction);
     }
     m_initialized = true;
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
index ebed71d..3e59df9 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.cpp
@@ -21,50 +21,42 @@
 #include "config.h"
 #include "ScriptController.h"
 
-#include "Console.h"
-#include "DOMWindow.h"
-#include "Document.h"
 #include "Event.h"
 #include "EventNames.h"
 #include "Frame.h"
-#include "FrameLoader.h"
 #include "GCController.h"
-#include "JSDOMWindow.h"
+#include "HTMLPlugInElement.h"
 #include "JSDocument.h"
-#include "JSEventListener.h"
-#include "npruntime_impl.h"
 #include "NP_jsobject.h"
 #include "Page.h"
 #include "PageGroup.h"
-#include "runtime_root.h"
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "Settings.h"
-
-#include <runtime/Completion.h>
+#include "XSSAuditor.h"
+#include "npruntime_impl.h"
+#include "runtime_root.h"
 #include <debugger/Debugger.h>
 #include <runtime/JSLock.h>
 
-#if ENABLE(NETSCAPE_PLUGIN_API)
-#include "HTMLPlugInElement.h"
-#endif
-
 using namespace JSC;
 
 namespace WebCore {
 
 ScriptController::ScriptController(Frame* frame)
     : m_frame(frame)
-    , m_handlerLineno(0)
+    , m_handlerLineNumber(0)
     , m_sourceURL(0)
     , m_processingTimerCallback(false)
     , m_paused(false)
+    , m_allowPopupsFromPlugin(false)
 #if ENABLE(NETSCAPE_PLUGIN_API)
     , m_windowScriptNPObject(0)
 #endif
 #if PLATFORM(MAC)
     , m_windowScriptObject(0)
 #endif
+    , m_XSSAuditor(new XSSAuditor(frame))
 {
 #if PLATFORM(MAC) && ENABLE(MAC_JAVA_BRIDGE)
     static bool initializedJavaJSBindings;
@@ -89,9 +81,14 @@ ScriptController::~ScriptController()
 
 ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode) 
 {
+    if (!m_XSSAuditor->canEvaluate(sourceCode.source())) {
+        // This script is not safe to be evaluated.
+        return JSValue();
+    }
+
     // evaluate code. Returns the JS return value or 0
     // if there was none, an error occured or the type couldn't be converted.
-    
+
     const SourceCode& jsSourceCode = sourceCode.jsSourceCode();
 
     initScriptIfNeeded();
@@ -106,24 +103,26 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode)
 
     JSLock lock(false);
 
+    RefPtr<Frame> protect = m_frame;
+
+    m_windowShell->window()->globalData()->timeoutChecker.start();
+    Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, m_windowShell);
+    m_windowShell->window()->globalData()->timeoutChecker.stop();
+
     // Evaluating the JavaScript could cause the frame to be deallocated
     // so we start the keep alive timer here.
     m_frame->keepAlive();
 
-    m_windowShell->window()->startTimeoutCheck();
-    Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, m_windowShell);
-    m_windowShell->window()->stopTimeoutCheck();
-
     if (comp.complType() == Normal || comp.complType() == ReturnValue) {
         m_sourceURL = savedSourceURL;
         return comp.value();
     }
 
-    if (comp.complType() == Throw)
+    if (comp.complType() == Throw || comp.complType() == Interrupted)
         reportException(exec, comp.value());
 
     m_sourceURL = savedSourceURL;
-    return noValue();
+    return JSValue();
 }
 
 void ScriptController::clearWindowShell()
@@ -132,9 +131,13 @@ void ScriptController::clearWindowShell()
         return;
 
     JSLock lock(false);
-    m_windowShell->window()->clear();
-    m_liveFormerWindows.add(m_windowShell->window());
+
+    // Clear the debugger from the current window before setting the new window.
+    attachDebugger(0);
+
+    m_windowShell->window()->willRemoveFromWindowShell();
     m_windowShell->setWindow(m_frame->domWindow());
+
     if (Page* page = m_frame->page()) {
         attachDebugger(page->debugger());
         m_windowShell->window()->setProfileGroup(page->group().identifier());
@@ -144,22 +147,6 @@ void ScriptController::clearWindowShell()
     gcController().garbageCollectSoon();
 }
 
-PassRefPtr<EventListener> ScriptController::createInlineEventListener(const String& functionName, const String& code, Node* node)
-{
-    initScriptIfNeeded();
-    JSLock lock(false);
-    return JSLazyEventListener::create(JSLazyEventListener::HTMLLazyEventListener, functionName, code, m_windowShell->window(), node, m_handlerLineno);
-}
-
-#if ENABLE(SVG)
-PassRefPtr<EventListener> ScriptController::createSVGEventHandler(const String& functionName, const String& code, Node* node)
-{
-    initScriptIfNeeded();
-    JSLock lock(false);
-    return JSLazyEventListener::create(JSLazyEventListener::SVGLazyEventListener, functionName, code, m_windowShell->window(), node, m_handlerLineno);
-}
-#endif
-
 void ScriptController::initScript()
 {
     if (m_windowShell)
@@ -168,7 +155,7 @@ void ScriptController::initScript()
     JSLock lock(false);
 
     m_windowShell = new JSDOMWindowShell(m_frame->domWindow());
-    updateDocument();
+    m_windowShell->window()->updateDocument();
 
     if (Page* page = m_frame->page()) {
         attachDebugger(page->debugger());
@@ -180,6 +167,11 @@ void ScriptController::initScript()
 
 bool ScriptController::processingUserGesture() const
 {
+    return m_allowPopupsFromPlugin || processingUserGestureEvent() || isJavaScriptAnchorNavigation();
+}
+
+bool ScriptController::processingUserGestureEvent() const
+{
     if (!m_windowShell)
         return false;
 
@@ -196,13 +188,37 @@ bool ScriptController::processingUserGesture() const
             type == eventNames().focusEvent || type == eventNames().blurEvent ||
             type == eventNames().submitEvent)
             return true;
-    } else { // no event
-        if (m_sourceURL && m_sourceURL->isNull() && !m_processingTimerCallback) {
-            // This is the <a href="javascript:window.open('...')> case -> we let it through
-            return true;
+    }
+    
+    return false;
+}
+
+// FIXME: This seems like an insufficient check to verify a click on a javascript: anchor.
+bool ScriptController::isJavaScriptAnchorNavigation() const
+{
+    // This is the <a href="javascript:window.open('...')> case -> we let it through
+    if (m_sourceURL && m_sourceURL->isNull() && !m_processingTimerCallback)
+        return true;
+
+    // This is the <script>window.open(...)</script> case or a timer callback -> block it
+    return false;
+}
+
+bool ScriptController::anyPageIsProcessingUserGesture() const
+{
+    Page* page = m_frame->page();
+    if (!page)
+        return false;
+
+    const HashSet<Page*>& pages = page->group().pages();
+    HashSet<Page*>::const_iterator end = pages.end();
+    for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
+        for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
+            if (frame->script()->processingUserGesture())
+                return true;
         }
-        // This is the <script>window.open(...)</script> case or a timer callback -> block it
     }
+
     return false;
 }
 
@@ -231,9 +247,6 @@ void ScriptController::updateDocument()
     JSLock lock(false);
     if (m_windowShell)
         m_windowShell->window()->updateDocument();
-    HashSet<JSDOMWindow*>::iterator end = m_liveFormerWindows.end();
-    for (HashSet<JSDOMWindow*>::iterator it = m_liveFormerWindows.begin(); it != end; ++it)
-        (*it)->updateDocument();
 }
 
 void ScriptController::updateSecurityOrigin()
@@ -266,6 +279,7 @@ PassRefPtr<Bindings::RootObject> ScriptController::createRootObject(void* native
 }
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
+
 NPObject* ScriptController::windowScriptNPObject()
 {
     if (!m_windowScriptNPObject) {
@@ -289,23 +303,34 @@ NPObject* ScriptController::windowScriptNPObject()
 
 NPObject* ScriptController::createScriptObjectForPluginElement(HTMLPlugInElement* plugin)
 {
-    // Can't create NPObjects when JavaScript is disabled
-    if (!isEnabled())
+    JSObject* object = jsObjectForPluginElement(plugin);
+    if (!object)
         return _NPN_CreateNoScriptObject();
 
+    // Wrap the JSObject in an NPObject
+    return _NPN_CreateScriptObject(0, object, bindingRootObject());
+}
+
+#endif
+
+JSObject* ScriptController::jsObjectForPluginElement(HTMLPlugInElement* plugin)
+{
+    // Can't create JSObjects when JavaScript is disabled
+    if (!isEnabled())
+        return 0;
+
     // Create a JSObject bound to this element
     JSLock lock(false);
     ExecState* exec = globalObject()->globalExec();
-    JSValuePtr jsElementValue = toJS(exec, plugin);
-    if (!jsElementValue || !jsElementValue->isObject())
-        return _NPN_CreateNoScriptObject();
-
-    // Wrap the JSObject in an NPObject
-    return _NPN_CreateScriptObject(0, jsElementValue->getObject(), bindingRootObject());
+    JSValue jsElementValue = toJS(exec, plugin);
+    if (!jsElementValue || !jsElementValue.isObject())
+        return 0;
+    
+    return jsElementValue.getObject();
 }
-#endif
 
 #if !PLATFORM(MAC)
+
 void ScriptController::updatePlatformScriptObjects()
 {
 }
@@ -313,6 +338,7 @@ void ScriptController::updatePlatformScriptObjects()
 void ScriptController::disconnectPlatformScriptObjects()
 {
 }
+
 #endif
 
 void ScriptController::cleanupScriptObjectsForPlugin(void* nativeHandle)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
index c952cc2..4528495 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptController.h
@@ -58,6 +58,7 @@ class ScriptSourceCode;
 class ScriptValue;
 class String;
 class Widget;
+class XSSAuditor;
 
 typedef HashMap<void*, RefPtr<JSC::Bindings::RootObject> > RootObjectMap;
 
@@ -81,14 +82,12 @@ public:
 
     ScriptValue evaluate(const ScriptSourceCode&);
 
-    PassRefPtr<EventListener> createInlineEventListener(const String& functionName, const String& code, Node*);
-#if ENABLE(SVG)
-    PassRefPtr<EventListener> createSVGEventHandler(const String& functionName, const String& code, Node*);
-#endif
-    void setEventHandlerLineno(int lineno) { m_handlerLineno = lineno; }
+    void setEventHandlerLineNumber(int lineno) { m_handlerLineNumber = lineno; }
+    int eventHandlerLineNumber() { return m_handlerLineNumber; }
 
     void setProcessingTimerCallback(bool b) { m_processingTimerCallback = b; }
     bool processingUserGesture() const;
+    bool anyPageIsProcessingUserGesture() const;
 
     bool isEnabled();
 
@@ -97,10 +96,12 @@ public:
     void setPaused(bool b) { m_paused = b; }
     bool isPaused() const { return m_paused; }
 
+    void setAllowPopupsFromPlugin(bool allowPopupsFromPlugin) { m_allowPopupsFromPlugin = allowPopupsFromPlugin; }
+    bool allowPopupsFromPlugin() const { return m_allowPopupsFromPlugin; }
+    
     const String* sourceURL() const { return m_sourceURL; } // 0 if we are not evaluating any script
 
     void clearWindowShell();
-    void clearFormerWindow(JSDOMWindow* window) { m_liveFormerWindows.remove(window); }
     void updateDocument();
 
     // Notifies the ScriptController that the securityOrigin of the current
@@ -126,10 +127,14 @@ public:
     WebScriptObject* windowScriptObject();
 #endif
 
+    JSC::JSObject* jsObjectForPluginElement(HTMLPlugInElement*);
+    
 #if ENABLE(NETSCAPE_PLUGIN_API)
     NPObject* createScriptObjectForPluginElement(HTMLPlugInElement*);
     NPObject* windowScriptNPObject();
 #endif
+    
+    XSSAuditor* xssAuditor() { return m_XSSAuditor.get(); }
 
 private:
     void initScriptIfNeeded()
@@ -141,14 +146,17 @@ private:
 
     void disconnectPlatformScriptObjects();
 
+    bool processingUserGestureEvent() const;
+    bool isJavaScriptAnchorNavigation() const;
+
     JSC::ProtectedPtr<JSDOMWindowShell> m_windowShell;
-    HashSet<JSDOMWindow*> m_liveFormerWindows;
     Frame* m_frame;
-    int m_handlerLineno;
+    int m_handlerLineNumber;
     const String* m_sourceURL;
 
     bool m_processingTimerCallback;
     bool m_paused;
+    bool m_allowPopupsFromPlugin;
 
     // The root object used for objects bound outside the context of a plugin.
     RefPtr<JSC::Bindings::RootObject> m_bindingRootObject;
@@ -159,6 +167,9 @@ private:
 #if PLATFORM(MAC)
     RetainPtr<WebScriptObject> m_windowScriptObject;
 #endif
+    
+    // The XSSAuditor associated with this ScriptController.
+    OwnPtr<XSSAuditor> m_XSSAuditor;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm
index 39fcc67..502a504 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptControllerMac.mm
@@ -57,6 +57,7 @@
 @interface NSObject (WebPlugin)
 - (id)objectForWebScript;
 - (NPObject *)createPluginScriptableObject;
+- (PassRefPtr<JSC::Bindings::Instance>)createPluginBindingsInstance:(PassRefPtr<JSC::Bindings::RootObject>)rootObject;
 @end
 
 using namespace JSC::Bindings;
@@ -71,6 +72,9 @@ PassScriptInstance ScriptController::createScriptInstanceForWidget(Widget* widge
 
     RefPtr<RootObject> rootObject = createRootObject(widgetView);
 
+    if ([widgetView respondsToSelector:@selector(createPluginBindingsInstance:)])
+        return [widgetView createPluginBindingsInstance:rootObject.release()];
+        
     if ([widgetView respondsToSelector:@selector(objectForWebScript)]) {
         id objectForWebScript = [widgetView objectForWebScript];
         if (!objectForWebScript)
@@ -137,7 +141,7 @@ void ScriptController::disconnectPlatformScriptObjects()
 
 static pthread_t mainThread;
 
-static void updateRenderingForBindings(JSC::ExecState*, JSC::JSObject* rootObject)
+static void updateStyleIfNeededForBindings(JSC::ExecState*, JSC::JSObject* rootObject)
 {
     if (pthread_self() != mainThread)
         return;
@@ -153,18 +157,14 @@ static void updateRenderingForBindings(JSC::ExecState*, JSC::JSObject* rootObjec
     if (!frame)
         return;
 
-    Document* document = frame->document();
-    if (!document)
-        return;
-
-    document->updateRendering();
+    frame->document()->updateStyleIfNeeded();
 }
 
 void ScriptController::initJavaJSBindings()
 {
     mainThread = pthread_self();
     JSC::Bindings::JavaJSObject::initializeJNIThreading();
-    JSC::Bindings::Instance::setDidExecuteFunction(updateRenderingForBindings);
+    JSC::Bindings::Instance::setDidExecuteFunction(updateStyleIfNeededForBindings);
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
new file mode 100644
index 0000000..e5be1d6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.cpp
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptEventListener.h"
+
+#include "Attribute.h"
+#include "Document.h"
+#include "JSNode.h"
+#include "Frame.h"
+#include "XSSAuditor.h"
+
+#include <runtime/JSLock.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+static const String& eventParameterName(bool isSVGEvent)
+{
+    DEFINE_STATIC_LOCAL(const String, eventString, ("event"));
+    DEFINE_STATIC_LOCAL(const String, evtString, ("evt"));
+    return isSVGEvent ? evtString : eventString;
+}
+
+PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node* node, Attribute* attr)
+{
+    ASSERT(node);
+
+    Frame* frame = node->document()->frame();
+    if (!frame)
+        return 0;
+
+    ScriptController* scriptController = frame->script();
+    if (!scriptController->isEnabled())
+        return 0;
+
+    if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
+        // This script is not safe to execute.
+        return 0;
+    }
+    
+    JSDOMWindow* globalObject = scriptController->globalObject();
+
+    // Ensure that 'node' has a JavaScript wrapper to mark the event listener we're creating.
+    {
+        JSLock lock(false);
+        toJS(globalObject->globalExec(), node);
+    }
+
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(node->isSVGElement()), attr->value(), globalObject, node, scriptController->eventHandlerLineNumber());
+}
+
+PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame* frame, Attribute* attr)
+{
+    if (!frame)
+        return 0;
+
+    ScriptController* scriptController = frame->script();
+    if (!scriptController->isEnabled())
+        return 0;
+    
+    if (!scriptController->xssAuditor()->canCreateInlineEventListener(attr->localName().string(), attr->value())) {
+        // This script is not safe to execute.
+        return 0;
+    }
+
+    // 'globalObject' is the JavaScript wrapper that will mark the event listener we're creating.
+    JSDOMWindow* globalObject = scriptController->globalObject();
+
+    return JSLazyEventListener::create(attr->localName().string(), eventParameterName(frame->document()->isSVGDocument()), attr->value(), globalObject, 0, scriptController->eventHandlerLineNumber());
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.h
new file mode 100644
index 0000000..8299d29
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptEventListener.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptEventListener_h
+#define ScriptEventListener_h
+
+#include "JSLazyEventListener.h"
+
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+    class Attribute;
+    class Frame;
+    class Node;
+
+    PassRefPtr<JSLazyEventListener> createAttributeEventListener(Node*, Attribute*);
+    PassRefPtr<JSLazyEventListener> createAttributeEventListener(Frame*, Attribute*);
+
+} // namespace WebCore
+
+#endif // ScriptEventListener_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
new file mode 100644
index 0000000..1122931
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.cpp
@@ -0,0 +1,176 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptFunctionCall.h"
+
+#include "JSDOMBinding.h"
+#include "ScriptString.h"
+#include "ScriptValue.h"
+
+#include <runtime/JSLock.h>
+#include <runtime/UString.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ScriptFunctionCall::ScriptFunctionCall(ScriptState* exec, const ScriptObject& thisObject, const String& name)
+    : m_exec(exec)
+    , m_thisObject(thisObject)
+    , m_name(name)
+{
+}
+
+void ScriptFunctionCall::appendArgument(const ScriptObject& argument)
+{
+    m_arguments.append(argument.jsObject());
+}
+
+void ScriptFunctionCall::appendArgument(const ScriptString& argument)
+{
+    m_arguments.append(jsString(m_exec, argument));
+}
+
+void ScriptFunctionCall::appendArgument(const ScriptValue& argument)
+{
+    m_arguments.append(argument.jsValue());
+}
+
+void ScriptFunctionCall::appendArgument(const String& argument)
+{
+    JSLock lock(false);
+    m_arguments.append(jsString(m_exec, argument));
+}
+
+void ScriptFunctionCall::appendArgument(const JSC::UString& argument)
+{
+    m_arguments.append(jsString(m_exec, argument));
+}
+
+void ScriptFunctionCall::appendArgument(JSC::JSValue argument)
+{
+    m_arguments.append(argument);
+}
+
+void ScriptFunctionCall::appendArgument(long long argument)
+{
+    JSLock lock(false);
+    m_arguments.append(jsNumber(m_exec, argument));
+}
+
+void ScriptFunctionCall::appendArgument(unsigned int argument)
+{
+    JSLock lock(false);
+    m_arguments.append(jsNumber(m_exec, argument));
+}
+
+void ScriptFunctionCall::appendArgument(int argument)
+{
+    JSLock lock(false);
+    m_arguments.append(jsNumber(m_exec, argument));
+}
+
+void ScriptFunctionCall::appendArgument(bool argument)
+{
+    m_arguments.append(jsBoolean(argument));
+}
+
+ScriptValue ScriptFunctionCall::call(bool& hadException, bool reportExceptions)
+{
+    JSObject* thisObject = m_thisObject.jsObject();
+
+    JSLock lock(false);
+
+    JSValue function = thisObject->get(m_exec, Identifier(m_exec, m_name));
+    if (m_exec->hadException()) {
+        if (reportExceptions)
+            reportException(m_exec, m_exec->exception());
+
+        hadException = true;
+        return ScriptValue();
+    }
+
+    CallData callData;
+    CallType callType = function.getCallData(callData);
+    if (callType == CallTypeNone)
+        return ScriptValue();
+
+    JSValue result = JSC::call(m_exec, function, callType, callData, thisObject, m_arguments);
+    if (m_exec->hadException()) {
+        if (reportExceptions)
+            reportException(m_exec, m_exec->exception());
+
+        hadException = true;
+        return ScriptValue();
+    }
+
+    return ScriptValue(result);
+}
+
+ScriptValue ScriptFunctionCall::call()
+{
+    bool hadException = false;
+    return call(hadException);
+}
+
+ScriptObject ScriptFunctionCall::construct(bool& hadException, bool reportExceptions)
+{
+    JSObject* thisObject = m_thisObject.jsObject();
+
+    JSLock lock(false);
+
+    JSObject* constructor = asObject(thisObject->get(m_exec, Identifier(m_exec, m_name)));
+    if (m_exec->hadException()) {
+        if (reportExceptions)
+            reportException(m_exec, m_exec->exception());
+
+        hadException = true;
+        return ScriptObject();
+    }
+
+    ConstructData constructData;
+    ConstructType constructType = constructor->getConstructData(constructData);
+    if (constructType == ConstructTypeNone)
+        return ScriptObject();
+
+    JSValue result = JSC::construct(m_exec, constructor, constructType, constructData, m_arguments);
+    if (m_exec->hadException()) {
+        if (reportExceptions)
+            reportException(m_exec, m_exec->exception());
+
+        hadException = true;
+        return ScriptObject();
+    }
+
+    return ScriptObject(asObject(result));
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.h
new file mode 100644
index 0000000..079ac21
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptFunctionCall.h
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptFunctionCall_h
+#define ScriptFunctionCall_h
+
+#include "PlatformString.h"
+#include "ScriptObject.h"
+#include "ScriptState.h"
+
+#include <runtime/ArgList.h>
+
+namespace JSC {
+    class UString;
+    class JSValue;
+}
+
+namespace WebCore {
+    class ScriptValue;
+    class ScriptString;
+
+    class ScriptFunctionCall {
+    public:
+        ScriptFunctionCall(ScriptState* exec, const ScriptObject& thisObject, const String& name);
+        virtual ~ScriptFunctionCall() {};
+
+        void appendArgument(const ScriptObject&);
+        void appendArgument(const ScriptString&);
+        void appendArgument(const ScriptValue&);
+        void appendArgument(const String&);
+        void appendArgument(const JSC::UString&);
+        void appendArgument(JSC::JSValue);
+        void appendArgument(long long);
+        void appendArgument(unsigned int);
+        void appendArgument(int);
+        void appendArgument(bool);
+        ScriptValue call(bool& hadException, bool reportExceptions = true);
+        ScriptValue call();
+        ScriptObject construct(bool& hadException, bool reportExceptions = true);
+
+    protected:
+        ScriptState* m_exec;
+        ScriptObject m_thisObject;
+        String m_name;
+        JSC::MarkedArgumentBuffer m_arguments;
+    };
+
+} // namespace WebCore
+
+#endif // ScriptFunctionCall
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
new file mode 100644
index 0000000..7f6391d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.cpp
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptObject.h"
+
+#include "JSDOMBinding.h"
+#include "JSInspectorController.h"
+
+#include <runtime/JSLock.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ScriptObject::ScriptObject(JSObject* object)
+    : ScriptValue(object)
+{
+}
+
+static bool handleException(ScriptState* scriptState)
+{
+    if (!scriptState->hadException())
+        return true;
+
+    reportException(scriptState, scriptState->exception());
+    return false;
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const String& name, const String& value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsString(scriptState, value), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, const ScriptObject& value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), value.jsObject(), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, const String& value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsString(scriptState, value), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, double value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsNumber(scriptState, value), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, long long value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsNumber(scriptState, value), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, int value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsNumber(scriptState, value), slot);
+    return handleException(scriptState);
+}
+
+bool ScriptObject::set(ScriptState* scriptState, const char* name, bool value)
+{
+    JSLock lock(false);
+    PutPropertySlot slot;
+    jsObject()->put(scriptState, Identifier(scriptState, name), jsBoolean(value), slot);
+    return handleException(scriptState);
+}
+
+ScriptObject ScriptObject::createNew(ScriptState* scriptState)
+{
+    JSLock lock(false);
+    return ScriptObject(constructEmptyObject(scriptState));
+}
+
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, const ScriptObject& value)
+{
+    JSLock lock(false);
+    scriptState->lexicalGlobalObject()->putDirect(Identifier(scriptState, name), value.jsObject());
+    return handleException(scriptState);
+}
+
+bool ScriptGlobalObject::set(ScriptState* scriptState, const char* name, InspectorController* value)
+{
+    JSLock lock(false);
+    scriptState->lexicalGlobalObject()->putDirect(Identifier(scriptState, name), toJS(scriptState, value));
+    return handleException(scriptState);
+}
+
+bool ScriptGlobalObject::get(ScriptState* scriptState, const char* name, ScriptObject& value)
+{
+    JSLock lock(false);
+    JSValue jsValue = scriptState->lexicalGlobalObject()->get(scriptState, Identifier(scriptState, name));
+    if (!jsValue)
+        return false;
+
+    if (!jsValue.isObject())
+        return false;
+
+    value = ScriptObject(asObject(jsValue));
+    return true;
+}
+
+bool ScriptGlobalObject::remove(ScriptState* scriptState, const char* name)
+{
+    JSLock lock(false);
+    scriptState->lexicalGlobalObject()->deleteProperty(scriptState, Identifier(scriptState, name));
+    return handleException(scriptState);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
new file mode 100644
index 0000000..ed86659
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObject.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptObject_h
+#define ScriptObject_h
+
+#include "ScriptState.h"
+#include "ScriptValue.h"
+
+#include <runtime/JSObject.h>
+#include <runtime/Protect.h>
+
+namespace WebCore {
+    class InspectorController;
+
+    class ScriptObject : public ScriptValue {
+    public:
+        ScriptObject(JSC::JSObject*);
+        ScriptObject() {}
+        JSC::JSObject* jsObject() const { return asObject(jsValue()); }
+
+        bool set(ScriptState*, const String& name, const String&);
+        bool set(ScriptState*, const char* name, const ScriptObject&);
+        bool set(ScriptState*, const char* name, const String&);
+        bool set(ScriptState*, const char* name, double);
+        bool set(ScriptState*, const char* name, long long);
+        bool set(ScriptState*, const char* name, int);
+        bool set(ScriptState*, const char* name, bool);
+
+        static ScriptObject createNew(ScriptState*);
+    };
+
+    class ScriptGlobalObject {
+    public:
+        static bool set(ScriptState*, const char* name, const ScriptObject&);
+        static bool set(ScriptState*, const char* name, InspectorController*);
+        static bool get(ScriptState*, const char* name, ScriptObject&);
+        static bool remove(ScriptState*, const char* name);
+    private:
+        ScriptGlobalObject() { }
+    };
+
+}
+
+#endif // ScriptObject_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
new file mode 100644
index 0000000..13e180a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.cpp
@@ -0,0 +1,122 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptObjectQuarantine.h"
+
+#include "Database.h"
+#include "Document.h"
+#include "Frame.h"
+#include "JSDOMBinding.h"
+#include "JSInspectedObjectWrapper.h"
+#include "JSNode.h"
+#include "ScriptObject.h"
+#include "ScriptValue.h"
+
+#include <runtime/JSLock.h>
+
+#if ENABLE(DATABASE)
+#include "JSDatabase.h"
+#endif
+
+#if ENABLE(DOM_STORAGE)
+#include "JSStorage.h"
+#endif
+
+using namespace JSC;
+
+namespace WebCore {
+
+ScriptValue quarantineValue(ScriptState* scriptState, const ScriptValue& value)
+{
+    JSLock lock(false);
+    return ScriptValue(JSInspectedObjectWrapper::wrap(scriptState, value.jsValue()));
+}
+
+#if ENABLE(DATABASE)
+bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject)
+{
+    ASSERT(database);
+
+    Frame* frame = database->document()->frame();
+    if (!frame)
+        return false;
+
+    ExecState* exec = toJSDOMWindow(frame)->globalExec();
+
+    JSLock lock(false);
+    quarantinedObject = ScriptObject(asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, database))));
+
+    return true;
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject)
+{
+    ASSERT(frame);
+    ASSERT(storage);
+
+    ExecState* exec = toJSDOMWindow(frame)->globalExec();
+
+    JSLock lock(false);
+    quarantinedObject = ScriptObject(asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, storage))));
+
+    return true;
+}
+#endif
+
+bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject)
+{
+    ExecState* exec = scriptStateFromNode(node);
+    if (!exec)
+        return false;
+
+    JSLock lock(false);
+    quarantinedObject = ScriptObject(asObject(JSInspectedObjectWrapper::wrap(exec, toJS(exec, node))));
+
+    return true;
+}
+
+bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject)
+{
+    ASSERT(domWindow);
+
+    JSDOMWindow* window = toJSDOMWindow(domWindow->frame());
+    ExecState* exec = window->globalExec();
+
+    JSLock lock(false);
+    quarantinedObject = ScriptObject(asObject(JSInspectedObjectWrapper::wrap(exec, window)));
+
+    return true;
+}
+
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h
new file mode 100644
index 0000000..d70acd7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptObjectQuarantine.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ScriptObjectQuarantine_h
+#define ScriptObjectQuarantine_h
+
+#include "ScriptState.h"
+
+namespace WebCore {
+
+    class Database;
+    class DOMWindow;
+    class Frame;
+    class Node;
+    class ScriptObject;
+    class ScriptValue;
+    class Storage;
+
+    ScriptValue quarantineValue(ScriptState*, const ScriptValue&);
+
+#if ENABLE(DATABASE)
+    bool getQuarantinedScriptObject(Database* database, ScriptObject& quarantinedObject);
+#endif
+#if ENABLE(DOM_STORAGE)
+    bool getQuarantinedScriptObject(Frame* frame, Storage* storage, ScriptObject& quarantinedObject);
+#endif
+    bool getQuarantinedScriptObject(Node* node, ScriptObject& quarantinedObject);
+    bool getQuarantinedScriptObject(DOMWindow* domWindow, ScriptObject& quarantinedObject);
+
+}
+
+#endif // ScriptObjectQuarantine_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptSourceCode.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptSourceCode.h
index 4a2403d..0a16265 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptSourceCode.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptSourceCode.h
@@ -53,6 +53,8 @@ public:
 
     const JSC::SourceCode& jsSourceCode() const { return m_code; }
 
+    const String& source() const { return static_cast<StringSourceProvider*>(m_code.provider())->source(); }
+
 private:
     JSC::SourceCode m_code;
 };
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp
new file mode 100644
index 0000000..8bfa33d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptState.h"
+
+#include "Frame.h"
+#include "Node.h"
+#include "Page.h"
+
+namespace WebCore {
+
+ScriptState* scriptStateFromNode(Node* node)
+{
+    if (!node)
+        return 0;
+    Document* document = node->document();
+    if (!document)
+        return 0;
+    Frame* frame = document->frame();
+    if (!frame)
+        return 0;
+    if (!frame->script()->isEnabled())
+        return 0;
+    return frame->script()->globalObject()->globalExec();
+}
+
+ScriptState* scriptStateFromPage(Page* page)
+{
+    return page->mainFrame()->script()->globalObject()->globalExec();
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h
index 3cce093..fa5c4a8 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptState.h
@@ -32,11 +32,11 @@
 #ifndef ScriptState_h
 #define ScriptState_h
 
-namespace JSC {
-    class ExecState;
-}
+#include "JSDOMBinding.h"
 
 namespace WebCore {
+    class Node;
+    class Page;
 
     // The idea is to expose "state-like" methods (hadException, and any other
     // methods where ExecState just dips into globalData) of JSC::ExecState as a
@@ -44,6 +44,9 @@ namespace WebCore {
     // For now, the separation is purely by convention.
     typedef JSC::ExecState ScriptState;
 
+    ScriptState* scriptStateFromNode(Node*);
+    ScriptState* scriptStateFromPage(Page*);
+
 } // namespace WebCore
 
 #endif // ScriptState_h
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h
index 3efa160..6dab9a0 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptString.h
@@ -32,7 +32,6 @@
 #define ScriptString_h
 
 #include "PlatformString.h"
-#include <runtime/JSLock.h>
 #include <runtime/UString.h>
 
 namespace WebCore {
@@ -52,27 +51,23 @@ public:
 
     ScriptString& operator=(const char* s)
     {
-        JSC::JSLock lock(false);
         m_str = s;
         return *this;
     }
 
     ScriptString& operator+=(const String& s)
     {
-        JSC::JSLock lock(false);
         m_str += s;
         return *this;
     }
 
     bool operator==(const ScriptString& s) const
     {
-        JSC::JSLock lock(false);
         return m_str == s.m_str;
     }
 
     bool operator!=(const ScriptString& s) const
     {
-        JSC::JSLock lock(false);
         // Avoid exporting an extra symbol by re-using "==" operator.
         return !(m_str == s.m_str);
     }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
index f462e21..dfb46da 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.cpp
@@ -29,7 +29,9 @@
 #include "config.h"
 #include "ScriptValue.h"
 
-#include "PlatformString.h"
+#include <JavaScriptCore/APICast.h>
+#include <JavaScriptCore/JSValueRef.h>
+
 #include <runtime/JSLock.h>
 #include <runtime/Protect.h>
 #include <runtime/UString.h>
@@ -44,24 +46,32 @@ bool ScriptValue::getString(String& result) const
         return false;
     JSLock lock(false);
     UString ustring;
-    if (!m_value->getString(ustring))
+    if (!m_value.get().getString(ustring))
         return false;
     result = ustring;
     return true;
 }
 
+bool ScriptValue::isEqual(ScriptState* scriptState, const ScriptValue& anotherValue) const
+{
+    if (hasNoValue())
+        return anotherValue.hasNoValue();
+
+    return JSValueIsEqual(toRef(scriptState), toRef(scriptState, jsValue()), toRef(scriptState, anotherValue.jsValue()), 0);
+}
+
 bool ScriptValue::isNull() const
 {
     if (!m_value)
         return false;
-    return m_value->isNull();
+    return m_value.get().isNull();
 }
 
 bool ScriptValue::isUndefined() const
 {
     if (!m_value)
         return false;
-    return m_value->isUndefined();
+    return m_value.get().isUndefined();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
index 855509a..209ce06 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/ScriptValue.h
@@ -31,6 +31,8 @@
 #ifndef ScriptValue_h
 #define ScriptValue_h
 
+#include "PlatformString.h"
+#include "ScriptState.h"
 #include <runtime/Protect.h>
 
 namespace WebCore {
@@ -39,15 +41,19 @@ class String;
 
 class ScriptValue {
 public:
-    ScriptValue(JSC::JSValuePtr value = JSC::noValue()) : m_value(value) {}
+    ScriptValue(JSC::JSValue value = JSC::JSValue()) : m_value(value) {}
+    virtual ~ScriptValue() {}
 
-    JSC::JSValuePtr jsValue() const { return m_value.get(); }
+    JSC::JSValue jsValue() const { return m_value.get(); }
     bool getString(String& result) const;
+    String toString(ScriptState* scriptState) const { return m_value.get().toString(scriptState); }
+    bool isEqual(ScriptState*, const ScriptValue&) const;
     bool isNull() const;
     bool isUndefined() const;
+    bool hasNoValue() const { return m_value == JSC::JSValue(); }
 
 private:
-    JSC::ProtectedJSValuePtr m_value;
+    JSC::ProtectedJSValue m_value;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/StringSourceProvider.h b/src/3rdparty/webkit/WebCore/bindings/js/StringSourceProvider.h
index ab37a56..89dfa67 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/StringSourceProvider.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/StringSourceProvider.h
@@ -40,6 +40,7 @@ namespace WebCore {
         JSC::UString getRange(int start, int end) const { return JSC::UString(m_source.characters() + start, end - start); }
         const UChar* data() const { return m_source.characters(); }
         int length() const { return m_source.length(); }
+        const String& source() const { return m_source; }
 
     private:
         StringSourceProvider(const String& source, const String& url)
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
index 0727510..bcf107b 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
+++ b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.cpp
@@ -35,7 +35,7 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "WorkerContext.h"
-#include "WorkerMessagingProxy.h"
+#include "WorkerObjectProxy.h"
 #include "WorkerThread.h"
 #include <interpreter/Interpreter.h>
 #include <runtime/Completion.h>
@@ -68,8 +68,13 @@ void WorkerScriptController::initScript()
 
     JSLock lock(false);
 
+    // Explicitly protect the global object's prototype so it isn't collected
+    // when we allocate the global object. (Once the global object is fully
+    // constructed, it can mark its own prototype.)
     RefPtr<Structure> prototypeStructure = JSWorkerContextPrototype::createStructure(jsNull());
-    RefPtr<Structure> structure = JSWorkerContext::createStructure(new (m_globalData.get()) JSWorkerContextPrototype(prototypeStructure.release()));
+    ProtectedPtr<JSWorkerContextPrototype> prototype = new (m_globalData.get()) JSWorkerContextPrototype(prototypeStructure.release());
+
+    RefPtr<Structure> structure = JSWorkerContext::createStructure(prototype);
     m_workerContextWrapper = new (m_globalData.get()) JSWorkerContext(structure.release(), m_workerContext);
 }
 
@@ -78,25 +83,46 @@ ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode)
     {
         MutexLocker lock(m_sharedDataMutex);
         if (m_executionForbidden)
-            return noValue();
+            return JSValue();
+    }
+    ScriptValue exception;
+    ScriptValue result = evaluate(sourceCode, &exception);
+    if (exception.jsValue()) {
+        JSLock lock(false);
+        reportException(m_workerContextWrapper->globalExec(), exception.jsValue());
+    }
+    return result;
+}
+
+ScriptValue WorkerScriptController::evaluate(const ScriptSourceCode& sourceCode, ScriptValue* exception)
+{
+    {
+        MutexLocker lock(m_sharedDataMutex);
+        if (m_executionForbidden)
+            return JSValue();
     }
 
     initScriptIfNeeded();
     JSLock lock(false);
 
     ExecState* exec = m_workerContextWrapper->globalExec();
-    m_workerContextWrapper->startTimeoutCheck();
+    m_workerContextWrapper->globalData()->timeoutChecker.start();
     Completion comp = JSC::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), sourceCode.jsSourceCode(), m_workerContextWrapper);
-    m_workerContextWrapper->stopTimeoutCheck();
+    m_workerContextWrapper->globalData()->timeoutChecker.stop();
 
-    m_workerContext->thread()->messagingProxy()->reportWorkerThreadActivity(m_workerContext->hasPendingActivity());
+    m_workerContext->thread()->workerObjectProxy().reportPendingActivity(m_workerContext->hasPendingActivity());
 
     if (comp.complType() == Normal || comp.complType() == ReturnValue)
         return comp.value();
 
     if (comp.complType() == Throw)
-        reportException(exec, comp.value());
-    return noValue();
+        *exception = comp.value();
+    return JSValue();
+}
+
+void WorkerScriptController::setException(ScriptValue exception)
+{
+    m_workerContextWrapper->globalExec()->setException(exception.jsValue());
 }
 
 void WorkerScriptController::forbidExecution()
@@ -107,7 +133,7 @@ void WorkerScriptController::forbidExecution()
     // It is not critical for Interpreter::m_timeoutTime to be synchronized, we just rely on it reaching the worker thread's processor sooner or later.
     MutexLocker lock(m_sharedDataMutex);
     m_executionForbidden = true;
-    m_globalData->interpreter->setTimeoutTime(1); // 1 ms is the smallest timeout that can be set.
+    m_globalData->timeoutChecker.setTimeoutInterval(1); // 1ms is the smallest timeout that can be set.
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.h b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.h
index 1dda5da..0454721 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.h
+++ b/src/3rdparty/webkit/WebCore/bindings/js/WorkerScriptController.h
@@ -57,9 +57,11 @@ namespace WebCore {
         }
 
         ScriptValue evaluate(const ScriptSourceCode&);
+        ScriptValue evaluate(const ScriptSourceCode&, ScriptValue* exception);
 
-        void forbidExecution();
+        void setException(ScriptValue);
 
+        void forbidExecution();
     private:
         void initScriptIfNeeded()
         {
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm
index 7a4d095..fe145f4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGenerator.pm
@@ -116,6 +116,41 @@ sub ProcessDocument
     $codeGenerator->finish();
 }
 
+# Necessary for V8 bindings to determine whether an interface is descendant from Node.
+# Node descendants are treated differently by DOMMap and this allows inferring the
+# type statically. See more at the original change: http://codereview.chromium.org/3195.
+# FIXME: Figure out a way to eliminate this JS bindings dichotomy.
+sub FindParentsRecursively
+{
+    my $object = shift;
+    my $dataNode = shift;
+    my @parents = ($dataNode->name);
+    foreach (@{$dataNode->parents}) {
+        my $interface = $object->StripModule($_);
+
+        $endCondition = 0;
+        $foundFilename = "";
+        foreach (@{$useDirectories}) {
+            $object->ScanDirectory("$interface.idl", $_, $_, 0) if ($foundFilename eq "");
+        }
+
+        if ($foundFilename ne "") {
+            print "  |  |>  Parsing parent IDL \"$foundFilename\" for interface \"$interface\"\n" if $verbose;
+
+           # Step #2: Parse the found IDL file (in quiet mode).
+            my $parser = IDLParser->new(1);
+            my $document = $parser->Parse($foundFilename, $defines, $preprocessor, 1);
+
+            foreach my $class (@{$document->classes}) {
+                @parents = (@parents, FindParentsRecursively($object, $class));
+            }
+        } else {
+            die("Could NOT find specified parent interface \"$interface\"!\n")
+        }
+    }
+    return @parents;
+}
+
 sub AddMethodsConstantsAndAttributesFromParentClasses
 {
     # For the passed interface, recursively parse all parent
@@ -131,9 +166,6 @@ sub AddMethodsConstantsAndAttributesFromParentClasses
     my $functionsRef = $dataNode->functions;
     my $attributesRef = $dataNode->attributes;
 
-    # Exception: For the DOM 'Node' is our topmost baseclass, not EventTargetNode.
-    return if $parentsMax eq 1 and $parents[0] eq "EventTargetNode";
-
     foreach (@{$dataNode->parents}) {
         if ($ignoreParent) {
             # Ignore first parent class, already handled by the generation itself.
@@ -196,9 +228,6 @@ sub GetMethodsAndAttributesFromParentClasses
 
     foreach (@{$dataNode->parents}) {
         my $interface = $object->StripModule($_);
-        if ($interface eq "EventTargetNode") {
-            $interface = "Node";
-        }
 
         # Step #1: Find the IDL file associated with 'interface'
         $endCondition = 0;
@@ -387,6 +416,8 @@ sub WK_lcfirst
     my $ret = lcfirst($param);
     $ret =~ s/uRL/url/ if $ret =~ /^uRL/;
     $ret =~ s/jS/js/ if $ret =~ /^jS/;
+    $ret =~ s/xML/xml/ if $ret =~ /^xML/;
+    $ret =~ s/xSLT/xslt/ if $ret =~ /^xSLT/;
     return $ret;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorCOM.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorCOM.pm
index 0c86ef2..7e80a17 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorCOM.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorCOM.pm
@@ -236,7 +236,6 @@ sub GetParentInterface
 {
     my ($dataNode) = @_;
     return "I" . $TEMP_PREFIX . "DOMObject" if (@{$dataNode->parents} == 0);
-    return "I" . $TEMP_PREFIX . "DOMNode" if $codeGenerator->StripModule($dataNode->parents(0)) eq "EventTargetNode";
     return GetInterfaceName($codeGenerator->StripModule($dataNode->parents(0)));
 }
 
@@ -244,7 +243,6 @@ sub GetParentClass
 {
     my ($dataNode) = @_;
     return $TEMP_PREFIX . "DOMObject" if (@{$dataNode->parents} == 0);
-    return $TEMP_PREFIX . "DOMNode" if $codeGenerator->StripModule($dataNode->parents(0)) eq "EventTargetNode";
     return GetClassName($codeGenerator->StripModule($dataNode->parents(0)));
 }
 
@@ -316,7 +314,6 @@ sub AddIncludesForTypeInCPPImplementation
     }
 
     # Special casing
-    $CPPImplementationWebCoreIncludes{"EventTargetNode.h"} = 1 if $type eq "Node";
     $CPPImplementationWebCoreIncludes{"NameNodeList.h"} = 1 if $type eq "NodeList";
     $CPPImplementationWebCoreIncludes{"CSSMutableStyleDeclaration.h"} = 1 if $type eq "CSSStyleDeclaration";
 
@@ -706,7 +703,6 @@ sub GenerateCPPFunction
     my $functionName = $function->signature->name;
     my $returnIDLType = $function->signature->type;
     my $noReturn = ($returnIDLType eq "void");
-    my $requiresEventTargetNodeCast = $function->signature->extendedAttributes->{"EventTargetNodeCast"};
     my $raisesExceptions = @{$function->raisesExceptions};
 
     AddIncludesForTypeInCPPImplementation($returnIDLType);
@@ -756,9 +752,6 @@ sub GenerateCPPFunction
     push(@parameterList, "ec") if $raisesExceptions;
 
     my $implementationGetter = "impl${implementationClassWithoutNamespace}()";
-    if ($requiresEventTargetNodeCast) {
-        $implementationGetter = "WebCore::EventTargetNodeCast(${implementationGetter})";
-    }
 
     my $callSigBegin = "    ";
     my $callSigMiddle = "${implementationGetter}->" . $codeGenerator->WK_lcfirst($functionName) . "(" . join(", ", @parameterList) . ")";
@@ -801,10 +794,6 @@ sub GenerateCPPFunction
     }
     push(@functionImplementation, "    WebCore::ExceptionCode ec = 0;\n") if $raisesExceptions; # FIXME: CHECK EXCEPTION AND DO SOMETHING WITH IT
     push(@functionImplementation, join("\n", @parameterInitialization) . (@parameterInitialization > 0 ? "\n" : ""));
-    if ($requiresEventTargetNodeCast) {
-        push(@functionImplementation, "    if (!impl${implementationClassWithoutNamespace}()->isEventTargetNode())\n");
-        push(@functionImplementation, "        return E_FAIL;\n");
-    }
     push(@functionImplementation, $callSigBegin . $callSigMiddle . $callSigEnd . "\n");
     push(@functionImplementation, "    return S_OK;\n");
     push(@functionImplementation, "}\n\n");
@@ -911,7 +900,7 @@ sub GenerateCPPHeader
                                                                                          "Forwarder" => $parentClassName });
                 push(@CPPHeaderContent, values(%attributes));
             }
-            
+
             # Add attribute names to attribute names set in case other ancestors 
             # also define them.
             $attributeNameSet{$_->signature->name} = 1 foreach @attributeList;
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
index f1061df..4f9aa1a 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -3,7 +3,7 @@
 # Copyright (C) 2006 Anders Carlsson <andersca@mac.com>
 # Copyright (C) 2006, 2007 Samuel Weinig <sam@webkit.org>
 # Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
-# Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+# Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 # 
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
@@ -34,7 +34,6 @@ my %headerIncludes = ();
 my @implContentHeader = ();
 my @implContent = ();
 my %implIncludes = ();
-my %implKJSIncludes = ();
 
 # Default .h template
 my $headerTemplate = << "EOF";
@@ -145,7 +144,7 @@ sub UsesManualToJSImplementation
 {
     my $type = shift;
 
-    return 1 if $type eq "Node" or $type eq "Document" or $type eq "HTMLCollection" or $type eq "SVGPathSeg" or $type eq "StyleSheet" or $type eq "CSSRule" or $type eq "CSSValue" or $type eq "Event" or $type eq "ImageData" or $type eq "Element" or $type eq "Text";
+    return 1 if $type eq "Node" or $type eq "Document" or $type eq "HTMLCollection" or $type eq "SVGPathSeg" or $type eq "StyleSheet" or $type eq "CSSRule" or $type eq "CSSValue" or $type eq "Event" or $type eq "ImageData" or $type eq "Element" or $type eq "Text" or $type eq "SVGElementInstance";
     return 0;
 }
 
@@ -174,7 +173,7 @@ sub AddIncludesForType
     # When we're finished with the one-file-per-class
     # reorganization, we won't need these special cases.
     if ($codeGenerator->IsPrimitiveType($type) or AvoidInclusionOfType($type)
-        or $type eq "DOMString" or $type eq "DOMObject" or $type eq "RGBColor") {
+        or $type eq "DOMString" or $type eq "DOMObject" or $type eq "RGBColor" or $type eq "Array") {
     } elsif ($type =~ /SVGPathSeg/) {
         $joinedName = $type;
         $joinedName =~ s/Abs|Rel//;
@@ -220,7 +219,7 @@ sub AddClassForwardIfNeeded
 {
     my $implClassName = shift;
 
-    # SVGAnimatedLength/Number/etc.. are typedefs to SVGAnimtatedTemplate, so don't use class forwards for them!
+    # SVGAnimatedLength/Number/etc. are typedefs to SVGAnimatedTemplate, so don't use class forwards for them!
     push(@headerContent, "class $implClassName;\n\n") unless $codeGenerator->IsSVGAnimatedType($implClassName);
 }
 
@@ -279,34 +278,24 @@ sub GenerateGetOwnPropertySlotBody
     my @getOwnPropertySlotImpl = ();
 
     if ($interfaceName eq "NamedNodeMap" or $interfaceName eq "HTMLCollection") {
-        push(@getOwnPropertySlotImpl, "    ${namespaceMaybe}JSValuePtr proto = prototype();\n");
-        push(@getOwnPropertySlotImpl, "    if (proto->isObject() && static_cast<${namespaceMaybe}JSObject*>(asObject(proto))->hasProperty(exec, propertyName))\n");
+        push(@getOwnPropertySlotImpl, "    ${namespaceMaybe}JSValue proto = prototype();\n");
+        push(@getOwnPropertySlotImpl, "    if (proto.isObject() && static_cast<${namespaceMaybe}JSObject*>(asObject(proto))->hasProperty(exec, propertyName))\n");
         push(@getOwnPropertySlotImpl, "        return false;\n\n");
     }
 
-    my $hasNameGetterGeneration = sub {
-        push(@getOwnPropertySlotImpl, "    if (canGetItemsForName(exec, static_cast<$implClassName*>(impl()), propertyName)) {\n");
-        push(@getOwnPropertySlotImpl, "        slot.setCustom(this, nameGetter);\n");
-        push(@getOwnPropertySlotImpl, "        return true;\n");
-        push(@getOwnPropertySlotImpl, "    }\n");
-        if ($inlined) {
-            $headerIncludes{"AtomicString.h"} = 1;
-        } else {
-            $implIncludes{"AtomicString.h"} = 1;
+    my $manualLookupGetterGeneration = sub {
+        my $requiresManualLookup = $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasNameGetter"};
+        if ($requiresManualLookup) {
+            push(@getOwnPropertySlotImpl, "    const ${namespaceMaybe}HashEntry* entry = ${className}Table.entry(exec, propertyName);\n");
+            push(@getOwnPropertySlotImpl, "    if (entry) {\n");
+            push(@getOwnPropertySlotImpl, "        slot.setCustom(this, entry->propertyGetter());\n");
+            push(@getOwnPropertySlotImpl, "        return true;\n");
+            push(@getOwnPropertySlotImpl, "    }\n");
         }
     };
 
-    if ($dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
-        &$hasNameGetterGeneration();
-    }
-
-    my $requiresManualLookup = $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasNameGetter"};
-    if ($requiresManualLookup) {
-        push(@getOwnPropertySlotImpl, "    const ${namespaceMaybe}HashEntry* entry = ${className}Table.entry(exec, propertyName);\n");
-        push(@getOwnPropertySlotImpl, "    if (entry) {\n");
-        push(@getOwnPropertySlotImpl, "        slot.setCustom(this, entry->propertyGetter());\n");
-        push(@getOwnPropertySlotImpl, "        return true;\n");
-        push(@getOwnPropertySlotImpl, "    }\n");
+    if (!$dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
+        &$manualLookupGetterGeneration();
     }
 
     if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}) {
@@ -322,12 +311,24 @@ sub GenerateGetOwnPropertySlotBody
         push(@getOwnPropertySlotImpl, "    }\n");
     }
 
-    if ($dataNode->extendedAttributes->{"HasNameGetter"}) {
-        &$hasNameGetterGeneration();
+    if ($dataNode->extendedAttributes->{"HasNameGetter"} || $dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
+        push(@getOwnPropertySlotImpl, "    if (canGetItemsForName(exec, static_cast<$implClassName*>(impl()), propertyName)) {\n");
+        push(@getOwnPropertySlotImpl, "        slot.setCustom(this, nameGetter);\n");
+        push(@getOwnPropertySlotImpl, "        return true;\n");
+        push(@getOwnPropertySlotImpl, "    }\n");
+        if ($inlined) {
+            $headerIncludes{"AtomicString.h"} = 1;
+        } else {
+            $implIncludes{"AtomicString.h"} = 1;
+        }
+    }
+
+    if ($dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
+        &$manualLookupGetterGeneration();
     }
 
-    if ($dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"}) {
-        push(@getOwnPropertySlotImpl, "    if (customGetOwnPropertySlot(exec, propertyName, slot))\n");
+    if ($dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"}) {
+        push(@getOwnPropertySlotImpl, "    if (getOwnPropertySlotDelegate(exec, propertyName, slot))\n");
         push(@getOwnPropertySlotImpl, "        return true;\n");
     }
 
@@ -376,39 +377,38 @@ sub GenerateHeader
     my $conditionalString;
     if ($conditional) {
         $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
-        push(@headerContentHeader, "\n#if ${conditionalString}\n\n");
+        push(@headerContentHeader, "#if ${conditionalString}\n\n");
     }
 
     if ($hasParent) {
-        push(@headerContentHeader, "#include \"$parentClassName.h\"\n");
+        $headerIncludes{"$parentClassName.h"} = 1;
     } else {
-        push(@headerContentHeader, "#include \"JSDOMBinding.h\"\n");
-        push(@headerContentHeader, "#include <runtime/JSGlobalObject.h>\n");
-        push(@headerContentHeader, "#include <runtime/ObjectPrototype.h>\n");
-    }
-    if ($interfaceName eq "Node") {
-        push(@headerContentHeader, "#include \"EventTargetNode.h\"\n");
+        $headerIncludes{"JSDOMBinding.h"} = 1;
+        $headerIncludes{"<runtime/JSGlobalObject.h>"} = 1;
+        $headerIncludes{"<runtime/ObjectPrototype.h>"} = 1;
     }
 
     if ($dataNode->extendedAttributes->{"CustomCall"}) {
-        push(@headerContentHeader, "#include <runtime/CallData.h>\n");
+        $headerIncludes{"<runtime/CallData.h>"} = 1;
     }
 
     if ($dataNode->extendedAttributes->{"InlineGetOwnPropertySlot"}) {
-        push(@headerContentHeader, "#include <runtime/Lookup.h>\n");
-        push(@headerContentHeader, "#include <wtf/AlwaysInline.h>\n");
+        $headerIncludes{"<runtime/Lookup.h>"} = 1;
+        $headerIncludes{"<wtf/AlwaysInline.h>"} = 1;
     }
 
     if ($hasParent && $dataNode->extendedAttributes->{"GenerateNativeConverter"}) {
-        push(@headerContentHeader, "#include \"${implClassName}.h\"");
+        $headerIncludes{"$implClassName.h"} = 1;
     }
 
+    $headerIncludes{"SVGElement.h"} = 1 if $className =~ /^JSSVG/;
+
     # Get correct pass/store types respecting PODType flag
     my $podType = $dataNode->extendedAttributes->{"PODType"};
     my $implType = $podType ? "JSSVGPODTypeWrapper<$podType> " : $implClassName;
-    push(@headerContentHeader, "#include \"$podType.h\"\n") if $podType and $podType ne "float";
+    $headerIncludes{"$podType.h"} = 1 if $podType and $podType ne "float";
 
-    push(@headerContentHeader, "#include \"JSSVGPODTypeWrapper.h\"\n") if $podType;
+    $headerIncludes{"JSSVGPODTypeWrapper.h"} = 1 if $podType;
 
     my $numConstants = @{$dataNode->constants};
     my $numAttributes = @{$dataNode->attributes};
@@ -435,18 +435,19 @@ sub GenerateHeader
     }
 
     # Destructor
-    push(@headerContent, "    virtual ~$className();\n") if (!$hasParent or $interfaceName eq "Document");
+    push(@headerContent, "    virtual ~$className();\n") if (!$hasParent or $interfaceName eq "Document" or $interfaceName eq "DOMWindow");
 
     # Prototype
-    push(@headerContent, "    static JSC::JSObject* createPrototype(JSC::ExecState*);\n") unless ($dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"});
+    push(@headerContent, "    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);\n") unless ($dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"});
 
-    $implIncludes{"${className}Custom.h"} = 1 if $dataNode->extendedAttributes->{"CustomHeader"} || $dataNode->extendedAttributes->{"CustomPutFunction"};
+    $implIncludes{"${className}Custom.h"} = 1 if $dataNode->extendedAttributes->{"CustomHeader"} || $dataNode->extendedAttributes->{"CustomPutFunction"} || $dataNode->extendedAttributes->{"DelegatingPutFunction"};
 
     my $hasGetter = $numAttributes > 0 
                  || $dataNode->extendedAttributes->{"GenerateConstructor"} 
                  || $dataNode->extendedAttributes->{"HasIndexGetter"}
                  || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}
                  || $dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"}
+                 || $dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"}
                  || $dataNode->extendedAttributes->{"HasNameGetter"}
                  || $dataNode->extendedAttributes->{"HasOverridingNameGetter"};
 
@@ -454,7 +455,7 @@ sub GenerateHeader
     if ($hasGetter) {
         push(@headerContent, "    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);\n");
         push(@headerContent, "    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);\n") if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}) && !$dataNode->extendedAttributes->{"HasOverridingNameGetter"};
-        push(@headerContent, "    bool customGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n") if $dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"};
+        push(@headerContent, "    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n") if $dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"};
     }
 
     # Check if we have any writable properties
@@ -467,13 +468,14 @@ sub GenerateHeader
 
     my $hasSetter = $hasReadWriteProperties
                  || $dataNode->extendedAttributes->{"CustomPutFunction"}
+                 || $dataNode->extendedAttributes->{"DelegatingPutFunction"}
                  || $dataNode->extendedAttributes->{"HasCustomIndexSetter"};
 
     # Getters
     if ($hasSetter) {
-        push(@headerContent, "    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);\n");
-        push(@headerContent, "    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValuePtr);\n") if $dataNode->extendedAttributes->{"HasCustomIndexSetter"};
-        push(@headerContent, "    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, JSC::PutPropertySlot&);\n") if $dataNode->extendedAttributes->{"CustomPutFunction"};
+        push(@headerContent, "    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);\n");
+        push(@headerContent, "    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);\n") if $dataNode->extendedAttributes->{"HasCustomIndexSetter"};
+        push(@headerContent, "    bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);\n") if $dataNode->extendedAttributes->{"DelegatingPutFunction"};
     }
 
     # Class info
@@ -483,13 +485,13 @@ sub GenerateHeader
     # Structure ID
     if ($interfaceName eq "DOMWindow") {
         push(@headerContent,
-            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)\n" .
+            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
             "    {\n" .
             "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::ImplementsHasInstance | JSC::NeedsThisConversion));\n" .
             "    }\n\n");
     } elsif ($hasGetter) {
         push(@headerContent,
-            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)\n" .
+            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
             "    {\n" .
             "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));\n" .
             "    }\n\n");
@@ -509,7 +511,6 @@ sub GenerateHeader
 
     # Custom getPropertyNames function
     push(@headerContent, "    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n") if ($dataNode->extendedAttributes->{"CustomGetPropertyNames"} || $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"});
-    push(@headerContent, "    bool customGetPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);\n") if $dataNode->extendedAttributes->{"CustomGetPropertyNames"};
 
     # Custom getPropertyAttributes function
     push(@headerContent, "    virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier&, unsigned& attributes) const;\n") if $dataNode->extendedAttributes->{"CustomGetPropertyAttributes"};
@@ -521,13 +522,13 @@ sub GenerateHeader
     push(@headerContent, "    virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction);\n") if $dataNode->extendedAttributes->{"CustomDefineSetter"};
 
     # Custom lookupGetter function
-    push(@headerContent, "    virtual JSC::JSValuePtr lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);\n") if $dataNode->extendedAttributes->{"CustomLookupGetter"};
+    push(@headerContent, "    virtual JSC::JSValue lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);\n") if $dataNode->extendedAttributes->{"CustomLookupGetter"};
 
     # Custom lookupSetter function
-    push(@headerContent, "    virtual JSC::JSValuePtr lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);\n") if $dataNode->extendedAttributes->{"CustomLookupSetter"};
+    push(@headerContent, "    virtual JSC::JSValue lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);\n") if $dataNode->extendedAttributes->{"CustomLookupSetter"};
 
     # Constructor object getter
-    push(@headerContent, "    static JSC::JSValuePtr getConstructor(JSC::ExecState*);\n") if $dataNode->extendedAttributes->{"GenerateConstructor"};
+    push(@headerContent, "    static JSC::JSValue getConstructor(JSC::ExecState*);\n") if $dataNode->extendedAttributes->{"GenerateConstructor"};
 
     my $numCustomFunctions = 0;
     my $numCustomAttributes = 0;
@@ -536,9 +537,9 @@ sub GenerateHeader
     if ($numAttributes > 0) {
         foreach (@{$dataNode->attributes}) {
             my $attribute = $_;
-            $numCustomAttributes++ if $attribute->signature->extendedAttributes->{"Custom"};
-            $numCustomAttributes++ if $attribute->signature->extendedAttributes->{"CustomGetter"};
-            $numCustomAttributes++ if $attribute->signature->extendedAttributes->{"CustomSetter"};
+            $numCustomAttributes++ if $attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCCustom"};
+            $numCustomAttributes++ if $attribute->signature->extendedAttributes->{"CustomGetter"} || $attribute->signature->extendedAttributes->{"JSCCustomGetter"};
+            $numCustomAttributes++ if $attribute->signature->extendedAttributes->{"CustomSetter"} || $attribute->signature->extendedAttributes->{"JSCCustomSetter"};
         }
     }
 
@@ -546,31 +547,31 @@ sub GenerateHeader
         push(@headerContent, "\n    // Custom attributes\n");
 
         foreach my $attribute (@{$dataNode->attributes}) {
-            if ($attribute->signature->extendedAttributes->{"Custom"}) {
-                push(@headerContent, "    JSC::JSValuePtr " . $codeGenerator->WK_lcfirst($attribute->signature->name) . "(JSC::ExecState*) const;\n");
+            if ($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCCustom"}) {
+                push(@headerContent, "    JSC::JSValue " . $codeGenerator->WK_lcfirst($attribute->signature->name) . "(JSC::ExecState*) const;\n");
                 if ($attribute->type !~ /^readonly/) {
-                    push(@headerContent, "    void set" . $codeGenerator->WK_ucfirst($attribute->signature->name) . "(JSC::ExecState*, JSC::JSValuePtr);\n");
+                    push(@headerContent, "    void set" . $codeGenerator->WK_ucfirst($attribute->signature->name) . "(JSC::ExecState*, JSC::JSValue);\n");
                 }
-            } elsif ($attribute->signature->extendedAttributes->{"CustomGetter"}) {
-                push(@headerContent, "    JSC::JSValuePtr " . $codeGenerator->WK_lcfirst($attribute->signature->name) . "(JSC::ExecState*) const;\n");
-            } elsif ($attribute->signature->extendedAttributes->{"CustomSetter"}) {
+            } elsif ($attribute->signature->extendedAttributes->{"CustomGetter"} || $attribute->signature->extendedAttributes->{"JSCCustomGetter"}) {
+                push(@headerContent, "    JSC::JSValue " . $codeGenerator->WK_lcfirst($attribute->signature->name) . "(JSC::ExecState*) const;\n");
+            } elsif ($attribute->signature->extendedAttributes->{"CustomSetter"} || $attribute->signature->extendedAttributes->{"JSCCustomSetter"}) {
                 if ($attribute->type !~ /^readonly/) {
-                    push(@headerContent, "    void set" . $codeGenerator->WK_ucfirst($attribute->signature->name) . "(JSC::ExecState*, JSC::JSValuePtr);\n");
+                    push(@headerContent, "    void set" . $codeGenerator->WK_ucfirst($attribute->signature->name) . "(JSC::ExecState*, JSC::JSValue);\n");
                 }
             }
         }
     }
 
     foreach my $function (@{$dataNode->functions}) {
-        $numCustomFunctions++ if $function->signature->extendedAttributes->{"Custom"};
+        $numCustomFunctions++ if $function->signature->extendedAttributes->{"Custom"} || $function->signature->extendedAttributes->{"JSCCustom"};
     }
 
     if ($numCustomFunctions > 0) {
         push(@headerContent, "\n    // Custom functions\n");
         foreach my $function (@{$dataNode->functions}) {
-            if ($function->signature->extendedAttributes->{"Custom"}) {
+            if ($function->signature->extendedAttributes->{"Custom"} || $function->signature->extendedAttributes->{"JSCCustom"}) {
                 my $functionImplementationName = $function->signature->extendedAttributes->{"ImplementationFunction"} || $codeGenerator->WK_lcfirst($function->signature->name);
-                push(@headerContent, "    JSC::JSValuePtr " . $functionImplementationName . "(JSC::ExecState*, const JSC::ArgList&);\n");
+                push(@headerContent, "    JSC::JSValue " . $functionImplementationName . "(JSC::ExecState*, const JSC::ArgList&);\n");
             }
         }
     }
@@ -602,26 +603,26 @@ sub GenerateHeader
 
     # Index getter
     if ($dataNode->extendedAttributes->{"HasIndexGetter"}) {
-        push(@headerContent, "    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+        push(@headerContent, "    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
     }
     if ($dataNode->extendedAttributes->{"HasCustomIndexGetter"}) {
-        push(@headerContent, "    JSC::JSValuePtr getByIndex(JSC::ExecState*, unsigned index);\n");
+        push(@headerContent, "    JSC::JSValue getByIndex(JSC::ExecState*, unsigned index);\n");
     }
     
     # Index setter
     if ($dataNode->extendedAttributes->{"HasCustomIndexSetter"}) {
-        push(@headerContent, "    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValuePtr);\n");
+        push(@headerContent, "    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);\n");
     }
     # Name getter
     if ($dataNode->extendedAttributes->{"HasNameGetter"} || $dataNode->extendedAttributes->{"HasOverridingNameGetter"}) {
         push(@headerContent, "private:\n");
         push(@headerContent, "    static bool canGetItemsForName(JSC::ExecState*, $implClassName*, const JSC::Identifier&);\n");
-        push(@headerContent, "    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+        push(@headerContent, "    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
     }
 
     push(@headerContent, "};\n\n");
 
-    if ($dataNode->extendedAttributes->{"InlineGetOwnPropertySlot"}) {
+    if ($dataNode->extendedAttributes->{"InlineGetOwnPropertySlot"} && !$dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"}) {
         push(@headerContent, "ALWAYS_INLINE bool ${className}::getOwnPropertySlot(JSC::ExecState* exec, const JSC::Identifier& propertyName, JSC::PropertySlot& slot)\n");
         push(@headerContent, "{\n");
         push(@headerContent, GenerateGetOwnPropertySlotBody($dataNode, $interfaceName, $className, $implClassName, $numAttributes > 0, 1));
@@ -630,52 +631,59 @@ sub GenerateHeader
 
     if (!$hasParent || $dataNode->extendedAttributes->{"GenerateToJS"}) {
         if ($podType) {
-            push(@headerContent, "JSC::JSValuePtr toJS(JSC::ExecState*, JSSVGPODTypeWrapper<$podType>*, SVGElement* context);\n");
+            push(@headerContent, "JSC::JSValue toJS(JSC::ExecState*, JSSVGPODTypeWrapper<$podType>*, SVGElement* context);\n");
         } elsif (IsSVGTypeNeedingContextParameter($implClassName)) {
-            push(@headerContent, "JSC::JSValuePtr toJS(JSC::ExecState*, $implType*, SVGElement* context);\n");
+            push(@headerContent, "JSC::JSValue toJS(JSC::ExecState*, $implType*, SVGElement* context);\n");
         } else {
-            push(@headerContent, "JSC::JSValuePtr toJS(JSC::ExecState*, $implType*);\n");
-        }
-
-        # Resolve ambiguity with EventTarget that otherwise exists.
-        if ($interfaceName eq "Node") {
-            push(@headerContent, "inline JSC::JSValuePtr toJS(JSC::ExecState* exec, EventTargetNode* node) { return toJS(exec, static_cast<Node*>(node)); }\n");
+            push(@headerContent, "JSC::JSValue toJS(JSC::ExecState*, $implType*);\n");
         }
     }
     if (!$hasParent || $dataNode->extendedAttributes->{"GenerateNativeConverter"}) {
         if ($podType) {
-            push(@headerContent, "$podType to${interfaceName}(JSC::JSValuePtr);\n");
+            push(@headerContent, "$podType to${interfaceName}(JSC::JSValue);\n");
         } elsif ($interfaceName eq "NodeFilter") {
-            push(@headerContent, "PassRefPtr<NodeFilter> toNodeFilter(JSC::JSValuePtr);\n");
+            push(@headerContent, "PassRefPtr<NodeFilter> toNodeFilter(JSC::JSValue);\n");
         } else {
-            push(@headerContent, "$implClassName* to${interfaceName}(JSC::JSValuePtr);\n");
-        }
-        if ($interfaceName eq "Node" or $interfaceName eq "Element" or $interfaceName eq "Text") {
-            push(@headerContent, "JSC::JSValuePtr toJSNewlyCreated(JSC::ExecState*, $interfaceName*);\n");
+            push(@headerContent, "$implClassName* to${interfaceName}(JSC::JSValue);\n");
         }
     }
+    if ($interfaceName eq "Node" or $interfaceName eq "Element" or $interfaceName eq "Text" or $interfaceName eq "CDATASection") {
+        push(@headerContent, "JSC::JSValue toJSNewlyCreated(JSC::ExecState*, $interfaceName*);\n");
+    }
+    
     push(@headerContent, "\n");
 
     # Add prototype declaration.
     push(@headerContent, "class ${className}Prototype : public JSC::JSObject {\n");
+    push(@headerContent, "    typedef JSC::JSObject Base;\n");
     push(@headerContent, "public:\n");
     if ($interfaceName eq "DOMWindow") {
         push(@headerContent, "    void* operator new(size_t);\n");
     } elsif ($interfaceName eq "WorkerContext") {
         push(@headerContent, "    void* operator new(size_t, JSC::JSGlobalData*);\n");
     } else {
-        push(@headerContent, "    static JSC::JSObject* self(JSC::ExecState*);\n");
+        push(@headerContent, "    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);\n");
     }
     push(@headerContent, "    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }\n");
     push(@headerContent, "    static const JSC::ClassInfo s_info;\n");
-    if ($numFunctions > 0 || $numConstants > 0) {
+    if ($numFunctions > 0 || $numConstants > 0 || $dataNode->extendedAttributes->{"DelegatingPrototypeGetOwnPropertySlot"}) {
         push(@headerContent, "    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n");
+        push(@headerContent, "    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);\n") if $dataNode->extendedAttributes->{"DelegatingPrototypeGetOwnPropertySlot"};
+
         push(@headerContent,
-            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)\n" .
+            "    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)\n" .
             "    {\n" .
             "        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));\n" .
             "    }\n");
     }
+    if ($dataNode->extendedAttributes->{"DelegatingPrototypePutFunction"}) {
+        push(@headerContent, "    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);\n");
+        push(@headerContent, "    bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);\n");
+    }
+
+    # Custom defineGetter function
+    push(@headerContent, "    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);\n") if $dataNode->extendedAttributes->{"CustomPrototypeDefineGetter"};
+
     push(@headerContent, "    ${className}Prototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }\n");
 
     push(@headerContent, "};\n\n");
@@ -684,7 +692,7 @@ sub GenerateHeader
         push(@headerContent,"// Functions\n\n");
         foreach my $function (@{$dataNode->functions}) {
             my $functionName = $codeGenerator->WK_lcfirst($className) . "PrototypeFunction" . $codeGenerator->WK_ucfirst($function->signature->name);
-            push(@headerContent, "JSC::JSValuePtr ${functionName}(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);\n");
+            push(@headerContent, "JSC::JSValue JSC_HOST_CALL ${functionName}(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);\n");
         }
     }
 
@@ -692,16 +700,16 @@ sub GenerateHeader
         push(@headerContent,"// Attributes\n\n");
         foreach my $attribute (@{$dataNode->attributes}) {
             my $getter = "js" . $interfaceName . $codeGenerator->WK_ucfirst($attribute->signature->name) . ($attribute->signature->type =~ /Constructor$/ ? "Constructor" : "");
-            push(@headerContent, "JSC::JSValuePtr ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
             unless ($attribute->type =~ /readonly/) {
                 my $setter = "setJS" . $interfaceName . $codeGenerator->WK_ucfirst($attribute->signature->name) . ($attribute->signature->type =~ /Constructor$/ ? "Constructor" : "");
-                push(@headerContent, "void ${setter}(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);\n");
+                push(@headerContent, "void ${setter}(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);\n");
             }
         }
         
         if ($dataNode->extendedAttributes->{"GenerateConstructor"}) {
             my $getter = "js" . $interfaceName . "Constructor";
-            push(@headerContent, "JSC::JSValuePtr ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
         }
     }
 
@@ -709,7 +717,7 @@ sub GenerateHeader
         push(@headerContent,"// Constants\n\n");
         foreach my $constant (@{$dataNode->constants}) {
             my $getter = "js" . $interfaceName . $codeGenerator->WK_ucfirst($constant->name);
-            push(@headerContent, "JSC::JSValuePtr ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
+            push(@headerContent, "JSC::JSValue ${getter}(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);\n");
         }
     }
 
@@ -735,25 +743,19 @@ sub GenerateImplementation
 
     # - Add default header template
     @implContentHeader = split("\r", $headerTemplate);
-    push(@implContentHeader, "\n#include \"config.h\"\n\n");
+
+    push(@implContentHeader, "\n#include \"config.h\"\n");
     my $conditionalString;
     if ($conditional) {
         $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
         push(@implContentHeader, "\n#if ${conditionalString}\n\n");
     }
-
-    if ($className =~ /^JSSVG/) {
-        push(@implContentHeader, "#include \"SVGElement.h\"\n");
-
-        if ($className =~ /^JSSVGAnimated/) {
-            AddIncludesForSVGAnimatedType($interfaceName);
-        }
-    }
-
     push(@implContentHeader, "#include \"$className.h\"\n\n");
-    push(@implContentHeader, "#include <wtf/GetPtr.h>\n\n");
 
-    push(@implContentHeader, "#include <runtime/PropertyNameArray.h>\n") if $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"};
+    AddIncludesForSVGAnimatedType($interfaceName) if $className =~ /^JSSVGAnimated/;
+
+    $implIncludes{"<wtf/GetPtr.h>"} = 1;
+    $implIncludes{"<runtime/PropertyNameArray.h>"} = 1 if $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"};
 
     AddIncludesForType($interfaceName);
 
@@ -762,7 +764,7 @@ sub GenerateImplementation
     push(@implContent, "\nusing namespace JSC;\n\n");
     push(@implContent, "namespace WebCore {\n\n");
 
-    push(@implContent, "ASSERT_CLASS_FITS_IN_CELL($className)\n\n");
+    push(@implContent, "ASSERT_CLASS_FITS_IN_CELL($className);\n\n");
 
     # - Add all attributes in a hashtable definition
     my $numAttributes = @{$dataNode->attributes};
@@ -884,7 +886,7 @@ sub GenerateImplementation
         my @specials = ();
         push(@specials, "DontDelete") unless $function->signature->extendedAttributes->{"Deletable"};
         push(@specials, "DontEnum") if $function->signature->extendedAttributes->{"DontEnum"};
-        push(@specials, "Function");        
+        push(@specials, "Function");
         my $special = (@specials > 0) ? join("|", @specials) : "0";
         push(@hashSpecials, $special);
     }
@@ -913,15 +915,23 @@ sub GenerateImplementation
         push(@implContent, "    return globalData->heap.allocate(size);\n");
         push(@implContent, "}\n\n");
     } else {
-        push(@implContent, "JSObject* ${className}Prototype::self(ExecState* exec)\n");
+        push(@implContent, "JSObject* ${className}Prototype::self(ExecState* exec, JSGlobalObject* globalObject)\n");
         push(@implContent, "{\n");
-        push(@implContent, "    return getDOMPrototype<${className}>(exec);\n");
+        push(@implContent, "    return getDOMPrototype<${className}>(exec, globalObject);\n");
         push(@implContent, "}\n\n");
     }
-    if ($numConstants > 0 || $numFunctions > 0) {
+    if ($numConstants > 0 || $numFunctions > 0 || $dataNode->extendedAttributes->{"DelegatingPrototypeGetOwnPropertySlot"}) {
         push(@implContent, "bool ${className}Prototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)\n");
         push(@implContent, "{\n");
-        if ($numConstants eq 0) {
+
+        if ($dataNode->extendedAttributes->{"DelegatingPrototypeGetOwnPropertySlot"}) {
+            push(@implContent, "    if (getOwnPropertySlotDelegate(exec, propertyName, slot))\n");
+            push(@implContent, "        return true;\n");
+        }
+
+        if ($numConstants eq 0 && $numFunctions eq 0) {
+            push(@implContent, "    return Base::getOwnPropertySlot(exec, propertyName, slot);\n");        
+        } elsif ($numConstants eq 0) {
             push(@implContent, "    return getStaticFunctionSlot<JSObject>(exec, " . prototypeHashTableAccessor($dataNode->extendedAttributes->{"NoStaticTables"}, $className) . ", this, propertyName, slot);\n");
         } elsif ($numFunctions eq 0) {
             push(@implContent, "    return getStaticValueSlot<${className}Prototype, JSObject>(exec, " . prototypeHashTableAccessor($dataNode->extendedAttributes->{"NoStaticTables"}, $className) . ", this, propertyName, slot);\n");
@@ -931,6 +941,15 @@ sub GenerateImplementation
         push(@implContent, "}\n\n");
     }
 
+    if ($dataNode->extendedAttributes->{"DelegatingPrototypePutFunction"}) {
+        push(@implContent, "void ${className}Prototype::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)\n");
+        push(@implContent, "{\n");
+        push(@implContent, "    if (putDelegate(exec, propertyName, value, slot))\n");
+        push(@implContent, "        return;\n");
+        push(@implContent, "    Base::put(exec, propertyName, value, slot);\n");
+        push(@implContent, "}\n\n");
+    }
+
     # - Initialize static ClassInfo object
     if ($numAttributes > 0 && $dataNode->extendedAttributes->{"NoStaticTables"}) {
         push(@implContent, "static const HashTable* get${className}Table(ExecState* exec)\n");
@@ -970,7 +989,15 @@ sub GenerateImplementation
         push(@implContent, "${className}::$className(PassRefPtr<Structure> structure, PassRefPtr<$implType> impl, JSDOMWindowShell* shell)\n");
         push(@implContent, "    : $parentClassName(structure, impl, shell)\n");
     } else {
-        push(@implContent, "${className}::$className(PassRefPtr<Structure> structure, PassRefPtr<$implType> impl" . ($needsSVGContext ? ", SVGElement* context" : "") . ")\n");
+        my $contextArg = "";
+        if ($needsSVGContext) {
+            if ($hasParent && !$parentNeedsSVGContext) {
+                $contextArg = ", SVGElement*";
+            } else {
+                $contextArg = ", SVGElement* context";
+            }
+        }
+        push(@implContent, "${className}::$className(PassRefPtr<Structure> structure, PassRefPtr<$implType> impl$contextArg)\n");
         if ($hasParent) {
             push(@implContent, "    : $parentClassName(structure, impl" . ($parentNeedsSVGContext ? ", context" : "") . ")\n");
         } else {
@@ -983,12 +1010,17 @@ sub GenerateImplementation
     push(@implContent, "}\n\n");
 
     # Destructor
-    if (!$hasParent) {
+    if (!$hasParent || $interfaceName eq "DOMWindow") {
         push(@implContent, "${className}::~$className()\n");
         push(@implContent, "{\n");
 
         if ($interfaceName eq "Node") {
-            push(@implContent, "    forgetDOMNode(m_impl->document(), m_impl.get());\n");
+             $implIncludes{"RegisteredEventListener.h"} = 1;
+             push(@implContent, "    invalidateEventListeners(m_impl->eventListeners());\n");
+             push(@implContent, "    forgetDOMNode(m_impl->document(), m_impl.get());\n");
+        } elsif ($interfaceName eq "DOMWindow") {
+             $implIncludes{"RegisteredEventListener.h"} = 1;
+             push(@implContent, "    invalidateEventListeners(impl()->eventListeners());\n");
         } else {
             if ($podType) {
                 my $animatedType = $implClassName;
@@ -1002,7 +1034,7 @@ sub GenerateImplementation
             push(@implContent, "    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());\n");
         }
 
-        push(@implContent, "\n}\n\n");
+        push(@implContent, "}\n\n");
     }
 
     # Document needs a special destructor because it's a special case for caching. It needs
@@ -1013,12 +1045,12 @@ sub GenerateImplementation
     }
 
     if (!$dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"}) {
-        push(@implContent, "JSObject* ${className}::createPrototype(ExecState* exec)\n");
+        push(@implContent, "JSObject* ${className}::createPrototype(ExecState* exec, JSGlobalObject* globalObject)\n");
         push(@implContent, "{\n");
         if ($hasParent && $parentClassName ne "JSC::DOMNodeFilter") {
-            push(@implContent, "    return new (exec) ${className}Prototype(${className}Prototype::createStructure(${parentClassName}Prototype::self(exec)));\n");
+            push(@implContent, "    return new (exec) ${className}Prototype(${className}Prototype::createStructure(${parentClassName}Prototype::self(exec, globalObject)));\n");
         } else {
-            push(@implContent, "    return new (exec) ${className}Prototype(${className}Prototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));\n");
+            push(@implContent, "    return new (exec) ${className}Prototype(${className}Prototype::createStructure(globalObject->objectPrototype()));\n");
         }
         push(@implContent, "}\n\n");
     }
@@ -1027,13 +1059,14 @@ sub GenerateImplementation
                  || $dataNode->extendedAttributes->{"GenerateConstructor"} 
                  || $dataNode->extendedAttributes->{"HasIndexGetter"}
                  || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}
+                 || $dataNode->extendedAttributes->{"DelegatingGetOwnPropertySlot"}
                  || $dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"}
                  || $dataNode->extendedAttributes->{"HasNameGetter"}
                  || $dataNode->extendedAttributes->{"HasOverridingNameGetter"};
 
     # Attributes
     if ($hasGetter) {
-        if (!$dataNode->extendedAttributes->{"InlineGetOwnPropertySlot"}) {
+        if (!$dataNode->extendedAttributes->{"InlineGetOwnPropertySlot"} && !$dataNode->extendedAttributes->{"CustomGetOwnPropertySlot"}) {
             push(@implContent, "bool ${className}::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)\n");
             push(@implContent, "{\n");
             push(@implContent, GenerateGetOwnPropertySlotBody($dataNode, $interfaceName, $className, $implClassName, $numAttributes > 0, 0));
@@ -1069,7 +1102,7 @@ sub GenerateImplementation
                     push(@implContent, "#if ${conditionalString}\n");
                 }
 
-                push(@implContent, "JSValuePtr ${getFunctionName}(ExecState* exec, const Identifier&, const PropertySlot& slot)\n");
+                push(@implContent, "JSValue ${getFunctionName}(ExecState* exec, const Identifier&, const PropertySlot& slot)\n");
                 push(@implContent, "{\n");
 
                 my $implClassNameForValueConversion = "";
@@ -1084,7 +1117,7 @@ sub GenerateImplementation
                     push(@implContent, "        return jsUndefined();\n");
                 }
 
-                if ($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"CustomGetter"}) {
+                if ($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCCustom"} || $attribute->signature->extendedAttributes->{"CustomGetter"} || $attribute->signature->extendedAttributes->{"JSCCustomGetter"}) {
                     push(@implContent, "    return static_cast<$className*>(asObject(slot.slotBase()))->$implGetterFunctionName(exec);\n");
                 } elsif ($attribute->signature->extendedAttributes->{"CheckNodeSecurity"}) {
                     $implIncludes{"JSDOMBinding.h"} = 1;
@@ -1096,25 +1129,21 @@ sub GenerateImplementation
                     push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(static_cast<$className*>(asObject(slot.slotBase()))->impl());\n");
                     push(@implContent, "    return checkNodeSecurity(exec, imp->contentDocument()) ? " . NativeToJSValue($attribute->signature,  0, $implClassName, $implClassNameForValueConversion, "imp->$implGetterFunctionName()", "static_cast<$className*>(asObject(slot.slotBase()))") . " : jsUndefined();\n");
                 } elsif ($type eq "EventListener") {
-                    $implIncludes{"JSEventListener.h"} = 1;
                     $implIncludes{"EventListener.h"} = 1;
-                    my $listenerType;
-                    if ($attribute->signature->extendedAttributes->{"ProtectedListener"}) {
-                        $listenerType = "JSEventListener";
-                    } else {
-                        $listenerType = "JSUnprotectedEventListener";
-                    }
+                    push(@implContent, "    UNUSED_PARAM(exec);\n");
                     push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(static_cast<$className*>(asObject(slot.slotBase()))->impl());\n");
-                    push(@implContent, "    if (${listenerType}* listener = static_cast<${listenerType}*>(imp->$implGetterFunctionName())) {\n");
-                    push(@implContent, "        if (JSObject* listenerObj = listener->listenerObj())\n");
-                    push(@implContent, "            return listenerObj;\n");
+                    push(@implContent, "    if (EventListener* listener = imp->$implGetterFunctionName()) {\n");
+                    push(@implContent, "        if (JSObject* jsFunction = listener->jsFunction())\n");
+                    push(@implContent, "            return jsFunction;\n");
                     push(@implContent, "    }\n");
                     push(@implContent, "    return jsNull();\n");
                 } elsif ($attribute->signature->type =~ /Constructor$/) {
                     my $constructorType = $codeGenerator->StripModule($attribute->signature->type);
                     $constructorType =~ s/Constructor$//;
+                    push(@implContent, "    UNUSED_PARAM(slot);\n");
                     push(@implContent, "    return JS" . $constructorType . "::getConstructor(exec);\n");
                 } elsif (!@{$attribute->getterExceptions}) {
+                    push(@implContent, "    UNUSED_PARAM(exec);\n");
                     if ($podType) {
                         push(@implContent, "    $podType imp(*static_cast<$className*>(asObject(slot.slotBase()))->impl());\n");
                         if ($podType eq "float") { # Special case for JSSVGNumber
@@ -1124,7 +1153,18 @@ sub GenerateImplementation
                         }
                     } else {
                         push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(static_cast<$className*>(asObject(slot.slotBase()))->impl());\n");
-                        my $jsType = NativeToJSValue($attribute->signature, 0, $implClassName, $implClassNameForValueConversion, "imp->$implGetterFunctionName()", "static_cast<$className*>(asObject(slot.slotBase()))");
+                        my $value;
+                        my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
+                        my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
+                        if ($reflect || $reflectURL) {
+                            $implIncludes{"HTMLNames.h"} = 1;
+                            my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $name : ($reflect || $reflectURL);
+                            my $getAttributeFunctionName = $reflectURL ? "getURLAttribute" : "getAttribute";
+                            $value = "imp->$getAttributeFunctionName(HTMLNames::${contentAttributeName}Attr)"
+                        } else {
+                            $value = "imp->$implGetterFunctionName()";
+                        }
+                        my $jsType = NativeToJSValue($attribute->signature, 0, $implClassName, $implClassNameForValueConversion, $value, "static_cast<$className*>(asObject(slot.slotBase()))");
                         if ($codeGenerator->IsSVGAnimatedType($type)) {
                             push(@implContent, "    RefPtr<$type> obj = $jsType;\n");
                             push(@implContent, "    return toJS(exec, obj.get(), imp);\n");
@@ -1137,10 +1177,10 @@ sub GenerateImplementation
 
                     if ($podType) {
                         push(@implContent, "    $podType imp(*static_cast<$className*>(asObject(slot.slotBase()))->impl());\n");
-                        push(@implContent, "    JSC::JSValuePtr result = " . NativeToJSValue($attribute->signature, 0, $implClassName, "", "imp.$implGetterFunctionName(ec)", "static_cast<$className*>(asObject(slot.slotBase()))") . ";\n");
+                        push(@implContent, "    JSC::JSValue result = " . NativeToJSValue($attribute->signature, 0, $implClassName, "", "imp.$implGetterFunctionName(ec)", "static_cast<$className*>(asObject(slot.slotBase()))") . ";\n");
                     } else {
                         push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(static_cast<$className*>(asObject(slot.slotBase()))->impl());\n");
-                        push(@implContent, "    JSC::JSValuePtr result = " . NativeToJSValue($attribute->signature, 0, $implClassName, $implClassNameForValueConversion, "imp->$implGetterFunctionName(ec)", "static_cast<$className*>(asObject(slot.slotBase()))") . ";\n");
+                        push(@implContent, "    JSC::JSValue result = " . NativeToJSValue($attribute->signature, 0, $implClassName, $implClassNameForValueConversion, "imp->$implGetterFunctionName(ec)", "static_cast<$className*>(asObject(slot.slotBase()))") . ";\n");
                     }
 
                     push(@implContent, "    setDOMException(exec, ec);\n");
@@ -1159,7 +1199,7 @@ sub GenerateImplementation
             if ($dataNode->extendedAttributes->{"GenerateConstructor"}) {
                 my $constructorFunctionName = "js" . $interfaceName . "Constructor";
 
-                push(@implContent, "JSValuePtr ${constructorFunctionName}(ExecState* exec, const Identifier&, const PropertySlot& slot)\n");
+                push(@implContent, "JSValue ${constructorFunctionName}(ExecState* exec, const Identifier&, const PropertySlot& slot)\n");
                 push(@implContent, "{\n");
                 push(@implContent, "    return static_cast<$className*>(asObject(slot.slotBase()))->getConstructor(exec);\n");
                 push(@implContent, "}\n");
@@ -1173,34 +1213,36 @@ sub GenerateImplementation
         }
 
         my $hasSetter = $hasReadWriteProperties
-                     || $dataNode->extendedAttributes->{"CustomPutFunction"}
+                     || $dataNode->extendedAttributes->{"DelegatingPutFunction"}
                      || $dataNode->extendedAttributes->{"HasCustomIndexSetter"};
 
         if ($hasSetter) {
-            push(@implContent, "void ${className}::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)\n");
-            push(@implContent, "{\n");
-            if ($dataNode->extendedAttributes->{"HasCustomIndexSetter"}) {
-                push(@implContent, "    bool ok;\n");
-                push(@implContent, "    unsigned index = propertyName.toUInt32(&ok, false);\n");
-                push(@implContent, "    if (ok) {\n");
-                push(@implContent, "        indexSetter(exec, index, value);\n");
-                push(@implContent, "        return;\n");
-                push(@implContent, "    }\n");
-            }
-            if ($dataNode->extendedAttributes->{"CustomPutFunction"}) {
-                push(@implContent, "    if (customPut(exec, propertyName, value, slot))\n");
-                push(@implContent, "        return;\n");
-            }
+            if (!$dataNode->extendedAttributes->{"CustomPutFunction"}) {
+                push(@implContent, "void ${className}::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)\n");
+                push(@implContent, "{\n");
+                if ($dataNode->extendedAttributes->{"HasCustomIndexSetter"}) {
+                    push(@implContent, "    bool ok;\n");
+                    push(@implContent, "    unsigned index = propertyName.toUInt32(&ok, false);\n");
+                    push(@implContent, "    if (ok) {\n");
+                    push(@implContent, "        indexSetter(exec, index, value);\n");
+                    push(@implContent, "        return;\n");
+                    push(@implContent, "    }\n");
+                }
+                if ($dataNode->extendedAttributes->{"DelegatingPutFunction"}) {
+                    push(@implContent, "    if (putDelegate(exec, propertyName, value, slot))\n");
+                    push(@implContent, "        return;\n");
+                }
 
-            if ($hasReadWriteProperties) {
-                push(@implContent, "    lookupPut<$className, Base>(exec, propertyName, value, " . hashTableAccessor($dataNode->extendedAttributes->{"NoStaticTables"}, $className) . ", this, slot);\n");
-            } else {
-                push(@implContent, "    Base::put(exec, propertyName, value, slot);\n");
+                if ($hasReadWriteProperties) {
+                    push(@implContent, "    lookupPut<$className, Base>(exec, propertyName, value, " . hashTableAccessor($dataNode->extendedAttributes->{"NoStaticTables"}, $className) . ", this, slot);\n");
+                } else {
+                    push(@implContent, "    Base::put(exec, propertyName, value, slot);\n");
+                }
+                push(@implContent, "}\n\n");
             }
-            push(@implContent, "}\n\n");
 
             if ($dataNode->extendedAttributes->{"HasCustomIndexSetter"}) {
-                push(@implContent, "void ${className}::put(ExecState* exec, unsigned propertyName, JSValuePtr value)\n");
+                push(@implContent, "void ${className}::put(ExecState* exec, unsigned propertyName, JSValue value)\n");
                 push(@implContent, "{\n");
                 push(@implContent, "    indexSetter(exec, propertyName, value);\n");
                 push(@implContent, "    return;\n");
@@ -1215,7 +1257,7 @@ sub GenerateImplementation
                         my $putFunctionName = "setJS" . $interfaceName .  $codeGenerator->WK_ucfirst($name) . ($attribute->signature->type =~ /Constructor$/ ? "Constructor" : "");
                         my $implSetterFunctionName = $codeGenerator->WK_ucfirst($name);
 
-                        push(@implContent, "void ${putFunctionName}(ExecState* exec, JSObject* thisObject, JSValuePtr value)\n");
+                        push(@implContent, "void ${putFunctionName}(ExecState* exec, JSObject* thisObject, JSValue value)\n");
                         push(@implContent, "{\n");
 
                         if ($dataNode->extendedAttributes->{"CheckDomainSecurity"} && !$attribute->signature->extendedAttributes->{"DoNotCheckDomainSecurity"}) {
@@ -1227,17 +1269,12 @@ sub GenerateImplementation
                             push(@implContent, "        return;\n");
                         }
 
-                        if ($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"CustomSetter"}) {
+                        if ($attribute->signature->extendedAttributes->{"Custom"} || $attribute->signature->extendedAttributes->{"JSCCustom"} || $attribute->signature->extendedAttributes->{"CustomSetter"} || $attribute->signature->extendedAttributes->{"JSCCustomSetter"}) {
                             push(@implContent, "    static_cast<$className*>(thisObject)->set$implSetterFunctionName(exec, value);\n");
                         } elsif ($type eq "EventListener") {
                             $implIncludes{"JSEventListener.h"} = 1;
+                            push(@implContent, "    UNUSED_PARAM(exec);\n");
                             push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(static_cast<$className*>(thisObject)->impl());\n");
-                            my $listenerType;
-                            if ($attribute->signature->extendedAttributes->{"ProtectedListener"}) {
-                                $listenerType = "JSEventListener";
-                            } else {
-                                $listenerType = "JSUnprotectedEventListener";
-                            }
                             if ($dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"}) {
                                 push(@implContent, "    JSDOMGlobalObject* globalObject = static_cast<$className*>(thisObject);\n");
                             } else {
@@ -1247,7 +1284,7 @@ sub GenerateImplementation
                                 push(@implContent, "    if (!globalObject)\n");
                                 push(@implContent, "        return;\n");
                             }
-                            push(@implContent, "    imp->set$implSetterFunctionName(globalObject->findOrCreate${listenerType}(exec, value, true));\n");
+                            push(@implContent, "    imp->set$implSetterFunctionName(globalObject->createJSAttributeEventListener(value));\n");
                         } elsif ($attribute->signature->type =~ /Constructor$/) {
                             my $constructorType = $attribute->signature->type;
                             $constructorType =~ s/Constructor$//;
@@ -1255,6 +1292,7 @@ sub GenerateImplementation
                             push(@implContent, "    // Shadowing a built-in constructor\n");
                             push(@implContent, "    static_cast<$className*>(thisObject)->putDirect(Identifier(exec, \"$name\"), value);\n");
                         } elsif ($attribute->signature->extendedAttributes->{"Replaceable"}) {
+                            push(@implContent, "    // Shadowing a built-in object\n");
                             push(@implContent, "    static_cast<$className*>(thisObject)->putDirect(Identifier(exec, \"$name\"), value);\n");
                         } else {
                             if ($podType) {
@@ -1267,8 +1305,17 @@ sub GenerateImplementation
                                 push(@implContent, "        static_cast<$className*>(thisObject)->impl()->commitChange(imp, static_cast<$className*>(thisObject)->context());\n");
                             } else {
                                 push(@implContent, "    $implClassName* imp = static_cast<$implClassName*>(static_cast<$className*>(thisObject)->impl());\n");
+                                my $nativeValue = JSValueToNative($attribute->signature, "value");
                                 push(@implContent, "    ExceptionCode ec = 0;\n") if @{$attribute->setterExceptions};
-                                push(@implContent, "    imp->set$implSetterFunctionName(" . JSValueToNative($attribute->signature, "value"));
+                                my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
+                                my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
+                                if ($reflect || $reflectURL) {
+                                    $implIncludes{"HTMLNames.h"} = 1;
+                                    my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $name : ($reflect || $reflectURL);
+                                    push(@implContent, "    imp->setAttribute(HTMLNames::${contentAttributeName}Attr, $nativeValue");
+                                } else {
+                                    push(@implContent, "    imp->set$implSetterFunctionName($nativeValue");
+                                }
                                 push(@implContent, ", ec") if @{$attribute->setterExceptions};
                                 push(@implContent, ");\n");
                                 push(@implContent, "    setDOMException(exec, ec);\n") if @{$attribute->setterExceptions};
@@ -1287,13 +1334,9 @@ sub GenerateImplementation
         }
     }
 
-    if ($dataNode->extendedAttributes->{"CustomGetPropertyNames"} || $dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}) {
+    if (($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}) && !$dataNode->extendedAttributes->{"CustomGetPropertyNames"}) {
         push(@implContent, "void ${className}::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)\n");
         push(@implContent, "{\n");
-        if ($dataNode->extendedAttributes->{"CustomGetPropertyNames"}) {
-            push(@implContent, "    if (customGetPropertyNames(exec, propertyNames))\n");
-            push(@implContent, "        return;\n");
-        }
         if ($dataNode->extendedAttributes->{"HasIndexGetter"} || $dataNode->extendedAttributes->{"HasCustomIndexGetter"}) {
             push(@implContent, "    for (unsigned i = 0; i < static_cast<${implClassName}*>(impl())->length(); ++i)\n");
             push(@implContent, "        propertyNames.add(Identifier::from(exec, i));\n");
@@ -1303,7 +1346,7 @@ sub GenerateImplementation
     }
 
     if ($dataNode->extendedAttributes->{"GenerateConstructor"}) {
-        push(@implContent, "JSValuePtr ${className}::getConstructor(ExecState* exec)\n{\n");
+        push(@implContent, "JSValue ${className}::getConstructor(ExecState* exec)\n{\n");
         push(@implContent, "    return getDOMConstructor<${className}Constructor>(exec);\n");
         push(@implContent, "}\n\n");
     }
@@ -1316,17 +1359,18 @@ sub GenerateImplementation
             my $functionName = $codeGenerator->WK_lcfirst($className) . "PrototypeFunction" . $codeGenerator->WK_ucfirst($function->signature->name);
             my $functionImplementationName = $function->signature->extendedAttributes->{"ImplementationFunction"} || $codeGenerator->WK_lcfirst($function->signature->name);
 
-            push(@implContent, "JSValuePtr ${functionName}(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)\n");
+            push(@implContent, "JSValue JSC_HOST_CALL ${functionName}(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)\n");
             push(@implContent, "{\n");
+            push(@implContent, "    UNUSED_PARAM(args);\n");
 
-            $implKJSInclude{"Error.h"} = 1;
+            $implIncludes{"<runtime/Error.h>"} = 1;
 
             if ($interfaceName eq "DOMWindow") {
-                push(@implContent, "    $className* castedThisObj = toJSDOMWindow(thisValue);\n");
+                push(@implContent, "    $className* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));\n");
                 push(@implContent, "    if (!castedThisObj)\n");
                 push(@implContent, "        return throwError(exec, TypeError);\n");
             } else {
-                push(@implContent, "    if (!thisValue->isObject(&${className}::s_info))\n");
+                push(@implContent, "    if (!thisValue.isObject(&${className}::s_info))\n");
                 push(@implContent, "        return throwError(exec, TypeError);\n");
                 push(@implContent, "    $className* castedThisObj = static_cast<$className*>(asObject(thisValue));\n");
             }
@@ -1337,7 +1381,7 @@ sub GenerateImplementation
                 push(@implContent, "        return jsUndefined();\n");
             }
 
-            if ($function->signature->extendedAttributes->{"Custom"}) {
+            if ($function->signature->extendedAttributes->{"Custom"} || $function->signature->extendedAttributes->{"JSCCustom"}) {
                 push(@implContent, "    return castedThisObj->" . $functionImplementationName . "(exec, args);\n");
             } else {
                 if ($podType) {
@@ -1390,15 +1434,15 @@ sub GenerateImplementation
                     
                     if ($parameter->type eq "XPathNSResolver") {
                         push(@implContent, "    RefPtr<XPathNSResolver> customResolver;\n");
-                        push(@implContent, "    XPathNSResolver* resolver = toXPathNSResolver(args.at(exec, $paramIndex));\n");
+                        push(@implContent, "    XPathNSResolver* resolver = toXPathNSResolver(args.at($paramIndex));\n");
                         push(@implContent, "    if (!resolver) {\n");
-                        push(@implContent, "        customResolver = JSCustomXPathNSResolver::create(exec, args.at(exec, $paramIndex));\n");
+                        push(@implContent, "        customResolver = JSCustomXPathNSResolver::create(exec, args.at($paramIndex));\n");
                         push(@implContent, "        if (exec->hadException())\n");
                         push(@implContent, "            return jsUndefined();\n");
                         push(@implContent, "        resolver = customResolver.get();\n");
                         push(@implContent, "    }\n");
                     } else {
-                        push(@implContent, "    " . GetNativeTypeFromSignature($parameter) . " $name = " . JSValueToNative($parameter, "args.at(exec, $paramIndex)") . ";\n");
+                        push(@implContent, "    " . GetNativeTypeFromSignature($parameter) . " $name = " . JSValueToNative($parameter, "args.at($paramIndex)") . ";\n");
 
                         # If a parameter is "an index" and it's negative it should throw an INDEX_SIZE_ERR exception.
                         # But this needs to be done in the bindings, because the type is unsigned and the fact that it
@@ -1437,7 +1481,7 @@ sub GenerateImplementation
             my $getter = "js" . $interfaceName . $codeGenerator->WK_ucfirst($constant->name);
 
             # FIXME: this casts into int to match our previous behavior which turned 0xFFFFFFFF in -1 for NodeFilter.SHOW_ALL
-            push(@implContent, "JSValuePtr ${getter}(ExecState* exec, const Identifier&, const PropertySlot&)\n");
+            push(@implContent, "JSValue ${getter}(ExecState* exec, const Identifier&, const PropertySlot&)\n");
             push(@implContent, "{\n");
             push(@implContent, "    return jsNumber(exec, static_cast<int>(" . $constant->value . "));\n");
             push(@implContent, "}\n\n");
@@ -1445,7 +1489,7 @@ sub GenerateImplementation
     }
 
     if ($dataNode->extendedAttributes->{"HasIndexGetter"}) {
-        push(@implContent, "\nJSValuePtr ${className}::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)\n");
+        push(@implContent, "\nJSValue ${className}::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)\n");
         push(@implContent, "{\n");
         push(@implContent, "    ${className}* thisObj = static_cast<$className*>(asObject(slot.slotBase()));\n");
         if (IndexGetterReturnsStrings($implClassName)) {
@@ -1463,11 +1507,11 @@ sub GenerateImplementation
 
     if ((!$hasParent or $dataNode->extendedAttributes->{"GenerateToJS"}) and !UsesManualToJSImplementation($implClassName)) {
         if ($podType) {
-            push(@implContent, "JSC::JSValuePtr toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<$podType>* object, SVGElement* context)\n");
+            push(@implContent, "JSC::JSValue toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<$podType>* object, SVGElement* context)\n");
         } elsif (IsSVGTypeNeedingContextParameter($implClassName)) {
-             push(@implContent, "JSC::JSValuePtr toJS(JSC::ExecState* exec, $implType* object, SVGElement* context)\n");
+             push(@implContent, "JSC::JSValue toJS(JSC::ExecState* exec, $implType* object, SVGElement* context)\n");
         } else {
-            push(@implContent, "JSC::JSValuePtr toJS(JSC::ExecState* exec, $implType* object)\n");
+            push(@implContent, "JSC::JSValue toJS(JSC::ExecState* exec, $implType* object)\n");
         }
 
         push(@implContent, "{\n");
@@ -1483,14 +1527,14 @@ sub GenerateImplementation
 
     if ((!$hasParent or $dataNode->extendedAttributes->{"GenerateNativeConverter"}) and !$dataNode->extendedAttributes->{"CustomNativeConverter"}) {
         if ($podType) {
-            push(@implContent, "$podType to${interfaceName}(JSC::JSValuePtr value)\n");
+            push(@implContent, "$podType to${interfaceName}(JSC::JSValue value)\n");
         } else {
-            push(@implContent, "$implClassName* to${interfaceName}(JSC::JSValuePtr value)\n");
+            push(@implContent, "$implClassName* to${interfaceName}(JSC::JSValue value)\n");
         }
 
         push(@implContent, "{\n");
 
-        push(@implContent, "    return value->isObject(&${className}::s_info) ? " . ($podType ? "($podType) *" : "") . "static_cast<$className*>(asObject(value))->impl() : ");
+        push(@implContent, "    return value.isObject(&${className}::s_info) ? " . ($podType ? "($podType) *" : "") . "static_cast<$className*>(asObject(value))->impl() : ");
         if ($podType and $podType ne "float") {
             push(@implContent, "$podType();\n}\n");
         } else {
@@ -1534,10 +1578,12 @@ sub GenerateImplementationFunctionCall()
 
         push(@implContent, $indent . "return jsUndefined();\n");
     } else {
-        push(@implContent, "\n" . $indent . "JSC::JSValuePtr result = " . NativeToJSValue($function->signature, 1, $implClassName, "", $functionString, "castedThisObj") . ";\n");
+        push(@implContent, "\n" . $indent . "JSC::JSValue result = " . NativeToJSValue($function->signature, 1, $implClassName, "", $functionString, "castedThisObj") . ";\n");
         push(@implContent, $indent . "setDOMException(exec, ec);\n") if @{$function->raisesExceptions};
 
-        if ($podType) {
+        if ($podType and not $function->signature->extendedAttributes->{"Immutable"}) {
+            # Immutable methods do not commit changes back to the instance, thus producing
+            # a new instance rather than mutating existing one.
             push(@implContent, $indent . "wrapper->commitChange(imp, castedThisObj->context());\n");
         }
 
@@ -1561,7 +1607,6 @@ sub GetNativeTypeFromSignature
 my %nativeType = (
     "CompareHow" => "Range::CompareHow",
     "DOMString" => "const UString&",
-    "EventTarget" => "EventTargetNode*",
     "NodeFilter" => "RefPtr<NodeFilter>",
     "SVGLength" => "SVGLength",
     "SVGMatrix" => "TransformationMatrix",
@@ -1595,23 +1640,18 @@ sub JSValueToNative
 
     my $type = $codeGenerator->StripModule($signature->type);
 
-    return "$value->toBoolean(exec)" if $type eq "boolean";
-    return "$value->toNumber(exec)" if $type eq "double";
-    return "$value->toFloat(exec)" if $type eq "float" or $type eq "SVGNumber";
-    return "$value->toInt32(exec)" if $type eq "unsigned long" or $type eq "long" or $type eq "unsigned short";
+    return "$value.toBoolean(exec)" if $type eq "boolean";
+    return "$value.toNumber(exec)" if $type eq "double";
+    return "$value.toFloat(exec)" if $type eq "float" or $type eq "SVGNumber";
+    return "$value.toInt32(exec)" if $type eq "unsigned long" or $type eq "long" or $type eq "unsigned short";
 
-    return "static_cast<Range::CompareHow>($value->toInt32(exec))" if $type eq "CompareHow";
-    return "static_cast<SVGPaint::SVGPaintType>($value->toInt32(exec))" if $type eq "SVGPaintType";
+    return "static_cast<Range::CompareHow>($value.toInt32(exec))" if $type eq "CompareHow";
+    return "static_cast<SVGPaint::SVGPaintType>($value.toInt32(exec))" if $type eq "SVGPaintType";
 
     if ($type eq "DOMString") {
         return "valueToStringWithNullCheck(exec, $value)" if $signature->extendedAttributes->{"ConvertNullToNullString"};
         return "valueToStringWithUndefinedOrNullCheck(exec, $value)" if $signature->extendedAttributes->{"ConvertUndefinedOrNullToNullString"};
-        return "$value->toString(exec)";
-    }
-
-    if ($type eq "EventTarget") {
-        $implIncludes{"JSEventTargetNode.h"} = 1;
-        return "toEventTargetNode($value)";
+        return "$value.toString(exec)";
     }
 
     $implIncludes{"FloatPoint.h"} = 1 if $type eq "SVGPoint";
@@ -1639,7 +1679,7 @@ sub NativeToJSValue
     return "jsBoolean($value)" if $type eq "boolean";
     
     if ($codeGenerator->IsPrimitiveType($type) or $type eq "SVGPaintType" or $type eq "DOMTimeStamp") {
-        $implKJSInclude{"JSNumberCell.h"} = 1;
+        $implIncludes{"<runtime/JSNumberCell.h>"} = 1;
         return "jsNumber(exec, $value)";
     }
 
@@ -1653,7 +1693,7 @@ sub NativeToJSValue
 
             die "Unknown value for ConvertNullStringTo extended attribute";
         }
-        $implKJSInclude{"JSString.h"} = 1;
+        $implIncludes{"<runtime/JSString.h>"} = 1;
         return "jsString(exec, $value)";
     }
 
@@ -1709,10 +1749,6 @@ sub NativeToJSValue
         $implIncludes{"CSSMutableStyleDeclaration.h"} = 1;
     }
 
-    if ($type eq "NamedNodeMap") {
-        $implIncludes{"NamedAttrMap.h"} = 1;
-    }
-
     if ($type eq "NodeList") {
         $implIncludes{"NameNodeList.h"} = 1;
     }
@@ -1943,17 +1979,17 @@ sub WriteData
         # Write content to file.
         print $IMPL @implContentHeader;
 
-        foreach my $implInclude (sort keys(%implIncludes)) {
-            my $checkType = $implInclude;
+        my @includes = ();
+        foreach my $include (keys %implIncludes) {
+            my $checkType = $include;
             $checkType =~ s/\.h//;
+            next if $codeGenerator->IsSVGAnimatedType($checkType);
 
-            print $IMPL "#include \"$implInclude\"\n" unless $codeGenerator->IsSVGAnimatedType($checkType);
+            $include = "\"$include\"" unless $include =~ /^["<]/; # "
+            push @includes, $include;
         }
-        
-        print $IMPL "\n";
-
-        foreach my $implKJSInclude (sort keys(%implKJSInclude)) {
-            print $IMPL "#include <runtime/$implKJSInclude>\n";
+        foreach my $include (sort @includes) {
+            print $IMPL "#include $include\n";
         }
 
         print $IMPL @implContent;
@@ -1963,15 +1999,19 @@ sub WriteData
         @implContentHeader = ();
         @implContent = ();
         %implIncludes = ();
-        %implKJSIncludes = ();
     }
 
     if (defined($HEADER)) {
         # Write content to file.
         print $HEADER @headerContentHeader;
 
-        foreach my $headerInclude (sort keys(%headerIncludes)) {
-            print $HEADER "#include \"$headerInclude\"\n";
+        my @includes = ();
+        foreach my $include (keys %headerIncludes) {
+            $include = "\"$include\"" unless $include =~ /^["<]/; # "
+            push @includes, $include;
+        }
+        foreach my $include (sort @includes) {
+            print $HEADER "#include $include\n";
         }
 
         print $HEADER @headerContent;
@@ -1998,13 +2038,13 @@ public:
     ${className}Constructor(ExecState* exec)
         : DOMObject(${className}Constructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, ${protoClassName}::self(exec), None);
+        putDirect(exec->propertyNames().prototype, ${protoClassName}::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -2036,7 +2076,7 @@ bool ${className}Constructor::getOwnPropertySlot(ExecState* exec, const Identifi
 
 EOF
 
-    $implKJSInclude{"JSNumberCell.h"} = 1;
+    $implJSCInclude{"JSNumberCell.h"} = 1;
 
     return $implContent;
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm
index 68fce3d..10628b4 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorObjC.pm
@@ -3,7 +3,7 @@
 # Copyright (C) 2006 Anders Carlsson <andersca@mac.com> 
 # Copyright (C) 2006, 2007 Samuel Weinig <sam@webkit.org>
 # Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
-# Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+# Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 #
 # This library is free software; you can redistribute it and/or
 # modify it under the terms of the GNU Library General Public
@@ -33,7 +33,6 @@ my $newPublicClass = 0;
 my $interfaceAvailabilityVersion = "";
 my $isProtocol = 0;
 my $noImpl = 0;
-my @ivars = ();
 
 my @headerContentHeader = ();
 my @headerContent = ();
@@ -79,7 +78,7 @@ my $buildingForTigerOrEarlier = 1 if $ENV{"MACOSX_DEPLOYMENT_TARGET"} and $ENV{"
 my $buildingForLeopardOrLater = 1 if $ENV{"MACOSX_DEPLOYMENT_TARGET"} and $ENV{"MACOSX_DEPLOYMENT_TARGET"} >= 10.5;
 my $exceptionInit = "WebCore::ExceptionCode ec = 0;";
 my $exceptionRaiseOnError = "WebCore::raiseOnDOMError(ec);";
-my $assertMainThread = "{ DOM_ASSERT_MAIN_THREAD(); WebCoreThreadViolationCheck(); }";
+my $assertMainThread = "{ DOM_ASSERT_MAIN_THREAD(); WebCoreThreadViolationCheckRoundOne(); }";
 
 my %conflictMethod = (
     # FIXME: Add C language keywords?
@@ -130,10 +129,10 @@ my %conflictMethod = (
 
 my $fatalError = 0;
 
-# Default Licence Templates
-my $headerLicenceTemplate = << "EOF";
+# Default License Templates
+my $headerLicenseTemplate = << "EOF";
 /*
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig\@gmail.com>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -159,7 +158,7 @@ my $headerLicenceTemplate = << "EOF";
  */
 EOF
 
-my $implementationLicenceTemplate = << "EOF";
+my $implementationLicenseTemplate = << "EOF";
 /*
  * This file is part of the WebKit open source project.
  * This file has been generated by generate-bindings.pl. DO NOT MODIFY!
@@ -218,7 +217,7 @@ sub ReadPublicInterfaces
 
     my $fileName = "WebCore/bindings/objc/PublicDOMInterfaces.h";
     open FILE, "-|", "/usr/bin/gcc", "-E", "-P", "-x", "objective-c", 
-        (map { "-D$_" } split(/ /, $defines)), "-DOBJC_CODE_GENERATION", $fileName or die "Could not open $fileName";
+        (map { "-D$_" } split(/ +/, $defines)), "-DOBJC_CODE_GENERATION", $fileName or die "Could not open $fileName";
     my @documentContent = <FILE>;
     close FILE;
 
@@ -345,7 +344,6 @@ sub GetParentImplClassName
     my $parent = $codeGenerator->StripModule($dataNode->parents(0));
 
     # special cases
-    return "Node" if $parent eq "EventTargetNode";
     return "Object" if $parent eq "HTMLCollection";
 
     return $parent;
@@ -373,8 +371,6 @@ sub GetParentAndProtocols
         } else {
             if (IsProtocolType($parentName)) {
                 push(@protocols, "DOM" . $parentName);
-            } elsif ($parentName eq "EventTargetNode") {
-                $parent = "DOMNode";
             } elsif ($parentName eq "HTMLCollection") {
                 $parent = "DOMObject";
             } else {
@@ -458,47 +454,24 @@ sub GetPropertyAttributes
 
     push(@attributes, "readonly") if $readOnly;
 
-#    FIXME: uncomment these lines once <rdar://problem/4996504> is fixed.
-#    unless ($readOnly) {
-        if ($codeGenerator->IsStringType($type) || IsNativeObjCType($type)) {
-            push(@attributes, "copy");
-        } elsif ($codeGenerator->IsPodType($type) || $codeGenerator->IsSVGAnimatedType($type)) {
-            push(@attributes, "retain");
-        } elsif (!$codeGenerator->IsStringType($type) && !$codeGenerator->IsPrimitiveType($type) && $type ne "DOMTimeStamp" && $type ne "CompareHow" && $type ne "SVGPaintType") {
-            push(@attributes, "retain");
-        }
-#    }
+    # FIXME: <rdar://problem/5049934> Consider using 'nonatomic' on the DOM @property declarations.
+    if ($codeGenerator->IsStringType($type) || IsNativeObjCType($type)) {
+        push(@attributes, "copy");
+    } elsif ($codeGenerator->IsPodType($type) || $codeGenerator->IsSVGAnimatedType($type)) {
+        push(@attributes, "retain");
+    } elsif (!$codeGenerator->IsStringType($type) && !$codeGenerator->IsPrimitiveType($type) && $type ne "DOMTimeStamp" && $type ne "CompareHow" && $type ne "SVGPaintType") {
+        push(@attributes, "retain");
+    }
 
     return "" unless @attributes > 0;
     return "(" . join(", ", @attributes) . ")";
 }
 
-sub GetObjCTypeMaker
-{
-    my $type = $codeGenerator->StripModule(shift);
-
-    return "" if $codeGenerator->IsNonPointerType($type) or $codeGenerator->IsStringType($type) or IsNativeObjCType($type);
-    return "_wrapAbstractView" if $type eq "DOMWindow";
-    return "_wrap$type";
-}
-
-sub GetObjCTypeGetterName
+sub ConversionNeeded
 {
     my $type = $codeGenerator->StripModule(shift);
 
-    my $typeGetter = "";
-    if ($type =~ /^(HTML|CSS|SVG)/ or $type eq "DOMImplementation" or $type eq "CDATASection" or $type eq "RGBColor") {
-        $typeGetter = $type;
-    } elsif ($type =~ /^XPath(.+)/) {
-        $typeGetter = "xpath" . $1;
-    } elsif ($type eq "DOMWindow") {
-        $typeGetter = "abstractView";
-    } else {
-        $typeGetter = lcfirst($type);
-    }
-
-    # put into the form "_fooBar" for type FooBar.
-    return "_" . $typeGetter;
+    return !$codeGenerator->IsNonPointerType($type) && !$codeGenerator->IsStringType($type) && !IsNativeObjCType($type);
 }
 
 sub GetObjCTypeGetter
@@ -507,68 +480,13 @@ sub GetObjCTypeGetter
     my $type = $codeGenerator->StripModule(shift);
 
     return $argName if $codeGenerator->IsPrimitiveType($type) or $codeGenerator->IsStringType($type) or IsNativeObjCType($type);
-    return $argName . "EventTarget" if $type eq "EventTarget";
+    return $argName . "Node" if $type eq "EventTarget";
     return "static_cast<WebCore::Range::CompareHow>($argName)" if $type eq "CompareHow";
     return "static_cast<WebCore::SVGPaint::SVGPaintType>($argName)" if $type eq "SVGPaintType";
-
-    my $typeGetterMethodName = GetObjCTypeGetterName($type);
-
     return "WTF::getPtr(nativeEventListener)" if $type eq "EventListener";
     return "WTF::getPtr(nativeNodeFilter)" if $type eq "NodeFilter";
     return "WTF::getPtr(nativeResolver)" if $type eq "XPathNSResolver";
-    return "[$argName $typeGetterMethodName]";
-}
-
-sub GetInternalTypeGetterSignature
-{
-    my ($interfaceName, $podType) = @_;
-
-    my $implClassNameWithNamespace = "WebCore::" . GetImplClassName($interfaceName);
-    my $podTypeWithNamespace;
-    if ($podType) {
-        $podTypeWithNamespace = ($podType eq "float") ? "$podType" : "WebCore::$podType";
-    }
-
-    # - Type-Getter
-    # - (WebCore::FooBar *)_fooBar for implementation class FooBar
-    my $typeGetterName = GetObjCTypeGetterName($interfaceName);
-    return "- " . ($podType ? "($podTypeWithNamespace)" : "($implClassNameWithNamespace *)") . $typeGetterName;
-}
-
-sub GetInternalTypeMakerSignature
-{
-    my ($interfaceName, $podType) = @_;
-
-    my $className = GetClassName($interfaceName);
-    my $implClassNameWithNamespace = "WebCore::" . GetImplClassName($interfaceName);
-    my $podTypeWithNamespace;
-    if ($podType) {
-        $podTypeWithNamespace = ($podType eq "float") ? "$podType" : "WebCore::$podType";
-    }
- 
-    my @ivarsToRetain = ();
-    my $ivarsToInit = "";
-    my $typeMakerSigAddition = "";
-    if (@ivars > 0) {
-        my @ivarsInitSig = ();
-        my @ivarsInitCall = ();
-        foreach $attribute (@ivars) {
-            my $name = $attribute->signature->name;
-            my $memberName = "m_" . $name;
-            my $varName = "in" . $name;
-            my $type = GetObjCType($attribute->signature->type);
-            push(@ivarsInitSig, "$name:($type)$varName");
-            push(@ivarsInitCall, "$name:$varName");
-            push(@ivarsToRetain, "    $memberName = [$varName retain];\n");
-        }
-        $ivarsToInit = " " . join(" ", @ivarsInitCall);
-        $typeMakerSigAddition = " " . join(" ", @ivarsInitSig);
-    }
-
-    my $typeMakerName = GetObjCTypeMaker($interfaceName);
-    return ("+ ($className *)$typeMakerName:(" . ($podType ? "$podTypeWithNamespace" : "$implClassNameWithNamespace *") . ")impl" . $typeMakerSigAddition,
-            $typeMakerSigAddition,
-            $ivarsToInit);
+    return "core($argName)";
 }
 
 sub AddForwardDeclarationsForType
@@ -605,77 +523,89 @@ sub AddIncludesForType
     }
 
     if ($type eq "RGBColor") {
-        $implIncludes{"Color.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"DOMRGBColorInternal.h"} = 1;
         return;
     }
 
     if ($type eq "DOMWindow") {
-        $implIncludes{"DOMAbstractView.h"} = 1;
-        $implIncludes{"$type.h"} = 1;
+        $implIncludes{"DOMAbstractViewInternal.h"} = 1;
+        $implIncludes{"DOMWindow.h"} = 1;
         return;
     }
 
     if ($type eq "DOMImplementation") {
+        $implIncludes{"DOMDOMImplementationInternal.h"} = 1;
         $implIncludes{"DOMImplementationFront.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
         return;
     }
 
     if ($type eq "EventTarget") {
-        $implIncludes{"EventTargetNode.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"Node.h"} = 1;
+        $implIncludes{"DOMEventTarget.h"} = 1;
         return;
     }
 
     if ($codeGenerator->IsSVGAnimatedType($type)) {
         $implIncludes{"SVGAnimatedTemplate.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"DOM${type}Internal.h"} = 1;
         return;
     }
 
     if ($type eq "SVGRect") {
         $implIncludes{"FloatRect.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"DOMSVGRectInternal.h"} = 1;
         return;
     }
 
     if ($type eq "SVGPoint") {
         $implIncludes{"FloatPoint.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"DOMSVGPointInternal.h"} = 1;
         return;
     }
 
     if ($type eq "SVGMatrix") {
         $implIncludes{"TransformationMatrix.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"DOMSVGMatrixInternal.h"} = 1;
         $implIncludes{"SVGException.h"} = 1;
         return;
     }
 
     if ($type eq "SVGNumber") {
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"DOMSVGNumberInternal.h"} = 1;
         return;
     }
 
     if ($type =~ /(\w+)(Abs|Rel)$/) {
         $implIncludes{"$1.h"} = 1;
-        $implIncludes{"DOM$type.h"} = 1;
+        $implIncludes{"DOM${type}Internal.h"} = 1;
+        return;
+    }
+
+    if ($type eq "NodeFilter") {
+        $implIncludes{"NodeFilter.h"} = 1;
+        $implIncludes{"ObjCNodeFilterCondition.h"} = 1;
         return;
     }
 
-    $implIncludes{"ObjCEventListener.h"} = 1 if $type eq "EventListener";
-    $implIncludes{"ObjCNodeFilterCondition.h"} = 1 if $type eq "NodeFilter";
-    $implIncludes{"DOMCustomXPathNSResolver.h"} = 1 if $type eq "XPathNSResolver";
+    if ($type eq "EventListener") {
+        $implIncludes{"EventListener.h"} = 1;
+        $implIncludes{"ObjCEventListener.h"} = 1;
+        return;
+    }
+
+    if ($type eq "XPathNSResolver") {
+        $implIncludes{"DOMCustomXPathNSResolver.h"} = 1;
+        $implIncludes{"XPathNSResolver.h"} = 1;
+        return;
+    }
 
     # FIXME: won't compile without these
     $implIncludes{"CSSMutableStyleDeclaration.h"} = 1 if $type eq "CSSStyleDeclaration";
-    $implIncludes{"NamedAttrMap.h"} = 1 if $type eq "NamedNodeMap";
     $implIncludes{"NameNodeList.h"} = 1 if $type eq "NodeList";
 
     # Default, include the same named file (the implementation) and the same name prefixed with "DOM". 
     $implIncludes{"$type.h"} = 1;
-    $implIncludes{"DOM$type.h"} = 1;
+    $implIncludes{"DOM${type}Internal.h"} = 1;
 }
 
 sub GenerateHeader
@@ -695,7 +625,7 @@ sub GenerateHeader
     my $numFunctions = @{$dataNode->functions};
 
     # - Add default header template
-    @headerContentHeader = split("\r", $headerLicenceTemplate);
+    @headerContentHeader = split("\r", $headerLicenseTemplate);
     push(@headerContentHeader, "\n");
 
     # - INCLUDES -
@@ -762,23 +692,6 @@ sub GenerateHeader
 
     # - Add attribute getters/setters.
     if ($numAttributes > 0) {
-        # Add ivars, if any, first
-        @ivars = ();
-        foreach my $attribute (@{$dataNode->attributes}) {
-            push(@ivars, $attribute) if $attribute->signature->extendedAttributes->{"ObjCIvar"};
-        }
-
-        if (@ivars > 0) {
-            push(@headerContent, "{\n");
-            foreach my $attribute (@ivars) {
-                my $type = GetObjCType($attribute->signature->type);
-                my $name = "m_" . $attribute->signature->name;
-                my $ivarDeclaration = "$type $name";
-                push(@headerContent, "    $ivarDeclaration;\n");
-            }
-            push(@headerContent, "}\n");
-        }
-
         foreach my $attribute (@{$dataNode->attributes}) {
             my $attributeName = $attribute->signature->name;
 
@@ -974,7 +887,7 @@ sub GenerateHeader
 
     if (@privateHeaderAttributes > 0 or @privateHeaderFunctions > 0 or exists $alwaysGenerateForNoSVGBuild{$className}) {
         # - Private category @interface
-        @privateHeaderContentHeader = split("\r", $headerLicenceTemplate);
+        @privateHeaderContentHeader = split("\r", $headerLicenseTemplate);
         push(@privateHeaderContentHeader, "\n");
 
         my $classHeaderName = GetClassHeaderName($className);
@@ -994,45 +907,66 @@ sub GenerateHeader
     unless ($isProtocol) {
         # Generate internal interfaces
         my $podType = $dataNode->extendedAttributes->{"PODType"};
-        my $typeGetterSig = GetInternalTypeGetterSignature($interfaceName, $podType);
-        my ($typeMakerSig, $typeMakerSigAddition, $ivarsToInit) = GetInternalTypeMakerSignature($interfaceName, $podType);
 
         # Generate interface definitions. 
-        @internalHeaderContent = split("\r", $implementationLicenceTemplate);
+        @internalHeaderContent = split("\r", $implementationLicenseTemplate);
 
         push(@internalHeaderContent, "\n#import <WebCore/$className.h>\n\n");
         push(@internalHeaderContent, $interfaceAvailabilityVersionCheck) if length $interfaceAvailabilityVersion;
 
-        if ($interfaceName eq "Node" or $interfaceName eq "SVGElementInstance") {
+        if ($interfaceName eq "Node") {
             push(@internalHeaderContent, "\@protocol DOMEventTarget;\n\n");
         }
 
+        my $startedNamespace = 0;
+
+        my $implClassName = GetImplClassName($interfaceName);
+
         if ($codeGenerator->IsSVGAnimatedType($interfaceName)) {
             push(@internalHeaderContent, "#import <WebCore/SVGAnimatedTemplate.h>\n\n");
         } elsif ($interfaceName eq "RGBColor") {
             push(@internalHeaderContent, "#import <WebCore/Color.h>\n\n");
         } else {
+            push(@internalHeaderContent, "namespace WebCore {\n");
+            $startedNamespace = 1;
             if ($podType and $podType ne "float") {
-                push(@internalHeaderContent, "namespace WebCore { class $podType; }\n\n");
+                push(@internalHeaderContent, "    class $podType;\n");
             } elsif ($interfaceName eq "Node") {
-                push(@internalHeaderContent, "namespace WebCore { class Node; class EventTarget; }\n\n");
-            } elsif ($interfaceName eq "SVGElementInstance") {
-                push(@internalHeaderContent, "namespace WebCore { class SVGElementInstance; class EventTarget; }\n\n");
+                push(@internalHeaderContent, "    class EventTarget;\n    class Node;\n");
+            } else {
+                push(@internalHeaderContent, "    class $implClassName;\n");
+            }
+            push(@internalHeaderContent, "}\n\n");
+        }
+
+        if ($podType) {
+            if ($podType eq "float") {
+                push(@internalHeaderContent, "float core($className *);\n");
             } else {
-                my $implClassName = GetImplClassName($interfaceName);
-                push(@internalHeaderContent, "namespace WebCore { class $implClassName; }\n\n");
+                push(@internalHeaderContent, "WebCore::$podType core($className *);\n");
             }
+        } else {
+            push(@internalHeaderContent, "WebCore::$implClassName* core($className *);\n");
+        }
+
+        if ($podType) {
+            if ($podType eq "float") {
+                push(@internalHeaderContent, "$className *kit($podType);\n");
+            } else {
+                push(@internalHeaderContent, "$className *kit(WebCore::$podType);\n");
+            }
+        } else {
+            push(@internalHeaderContent, "$className *kit(WebCore::$implClassName*);\n");
         }
 
-        push(@internalHeaderContent, "\@interface $className (WebCoreInternal)\n");
-        push(@internalHeaderContent, $typeGetterSig . ";\n");
-        push(@internalHeaderContent, $typeMakerSig . ";\n");
+        if ($dataNode->extendedAttributes->{Polymorphic}) {
+            push(@internalHeaderContent, "Class kitClass(WebCore::$implClassName*);\n");
+        }
 
-        if ($interfaceName eq "Node" or $interfaceName eq "SVGElementInstance") {
-            push(@internalHeaderContent, "+ (id <DOMEventTarget>)_wrapEventTarget:(WebCore::EventTarget *)eventTarget;\n");
+        if ($interfaceName eq "Node") {
+            push(@internalHeaderContent, "id <DOMEventTarget> kit(WebCore::EventTarget*);\n");
         }
 
-        push(@internalHeaderContent, "\@end\n");
         push(@internalHeaderContent, "\n#endif\n") if length $interfaceAvailabilityVersion;
     }
 }
@@ -1066,7 +1000,7 @@ sub GenerateImplementation
     }
 
     # - Add default header template.
-    @implContentHeader = split("\r", $implementationLicenceTemplate);
+    @implContentHeader = split("\r", $implementationLicenseTemplate);
 
     # - INCLUDES -
     push(@implContentHeader, "\n#import \"config.h\"\n");
@@ -1074,13 +1008,25 @@ sub GenerateImplementation
     my $conditionalString;
     if ($conditional) {
         $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
-        push(@implContentHeader, "\n#if ${conditionalString}\n");
+        push(@implContentHeader, "\n#if ${conditionalString}\n\n");
     }
 
-    push(@implContentHeader, "\n#import \"$classHeaderName.h\"\n\n");
+    push(@implContentHeader, "#import \"DOMInternal.h\"\n\n");
+    push(@implContentHeader, "#import \"$classHeaderName.h\"\n\n");
+
+    $implIncludes{"ExceptionHandlers.h"} = 1;
+    $implIncludes{"ThreadCheck.h"} = 1;
+    $implIncludes{"WebScriptObjectPrivate.h"} = 1;
+    $implIncludes{$classHeaderName . "Internal.h"} = 1;
+
+    # FIXME: These includes are only needed when the class is a subclass of one of these polymorphic classes.
+    $implIncludes{"DOMCSSRuleInternal.h"} = 1;
+    $implIncludes{"DOMCSSValueInternal.h"} = 1;
+    $implIncludes{"DOMEventInternal.h"} = 1;
+    $implIncludes{"DOMNodeInternal.h"} = 1;
+    $implIncludes{"DOMStyleSheetInternal.h"} = 1;
 
-    push(@implContentHeader, "#import \"ThreadCheck.h\"\n");
-    push(@implContentHeader, "#import <wtf/GetPtr.h>\n\n");
+    $implIncludes{"DOMSVGPathSegInternal.h"} = 1 if $interfaceName =~ /^SVGPathSeg.+/;
 
     if ($codeGenerator->IsSVGAnimatedType($interfaceName)) {
         $implIncludes{"SVGAnimatedTemplate.h"} = 1;
@@ -1094,11 +1040,10 @@ sub GenerateImplementation
         }
     } 
 
-    $implIncludes{"DOMInternal.h"} = 1;
-    $implIncludes{"ExceptionHandlers.h"} = 1;
-
     @implContent = ();
 
+    push(@implContent, "#import <wtf/GetPtr.h>\n\n");
+
     # add implementation accessor
     if ($podType) {
         push(@implContent, "#define IMPL reinterpret_cast<$podTypeWithNamespace*>(_internal)\n\n");
@@ -1114,18 +1059,9 @@ sub GenerateImplementation
 
     # Only generate 'dealloc' and 'finalize' methods for direct subclasses of DOMObject.
     if ($parentImplClassName eq "Object") {
-        my @ivarsToRelease = ();
-        if (@ivars > 0) {
-            foreach $attribute (@ivars) {
-                my $name = "m_" . $attribute->signature->name;
-                push(@ivarsToRelease, "    [$name release];\n");
-            }
-        }
-
         push(@implContent, "- (void)dealloc\n");
         push(@implContent, "{\n");
         push(@implContent, "    $assertMainThread\n");
-        push(@implContent, @ivarsToRelease);
         if ($interfaceName eq "NodeIterator") {
             push(@implContent, "    if (_internal) {\n");
             push(@implContent, "        [self detach];\n");
@@ -1193,7 +1129,17 @@ sub GenerateImplementation
             # - GETTER
             my $getterSig = "- ($attributeType)$attributeInterfaceName\n";
             my $hasGetterException = @{$attribute->getterExceptions};
-            my $getterContentHead = "IMPL->" . $codeGenerator->WK_lcfirst($attributeName) . "(";
+            my $getterContentHead;
+            my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
+            my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
+            if ($reflect || $reflectURL) {
+                $implIncludes{"HTMLNames.h"} = 1;
+                my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $attributeName : ($reflect || $reflectURL);
+                my $getAttributeFunctionName = $reflectURL ? "getURLAttribute" : "getAttribute";
+                $getterContentHead = "IMPL->${getAttributeFunctionName}(WebCore::HTMLNames::${contentAttributeName}Attr";
+            } else {
+                $getterContentHead = "IMPL->" . $codeGenerator->WK_lcfirst($attributeName) . "(";
+            }
             my $getterContentTail = ")";
 
             # Special case for DOMSVGNumber
@@ -1213,17 +1159,16 @@ sub GenerateImplementation
             # special case for EventTarget protocol
             $attributeTypeSansPtr = "DOMNode" if $idlType eq "EventTarget";
 
-            my $typeMaker = GetObjCTypeMaker($attribute->signature->type);
-
             # Special cases
             my @customGetterContent = (); 
             if ($attributeTypeSansPtr eq "DOMImplementation") {
                 # FIXME: We have to special case DOMImplementation until DOMImplementationFront is removed
-                $getterContentHead = "[$attributeTypeSansPtr $typeMaker:implementationFront(IMPL";
-                $getterContentTail .= "]";
+                $getterContentHead = "kit(implementationFront(IMPL";
+                $getterContentTail .= ")";
             } elsif ($attributeName =~ /(\w+)DisplayString$/) {
                 my $attributeToDisplay = $1;
-                $getterContentHead = "WebCore::displayString(IMPL->$attributeToDisplay(), [self _element]";
+                $getterContentHead = "WebCore::displayString(IMPL->$attributeToDisplay(), core(self)";
+                $implIncludes{"HitTestResult.h"} = 1;
             } elsif ($attributeName =~ /^absolute(\w+)URL$/) {
                 my $typeOfURL = $1;
                 $getterContentHead = "[self _getURLAttribute:";
@@ -1248,15 +1193,14 @@ sub GenerateImplementation
             } elsif ($attribute->signature->extendedAttributes->{"ConvertFromString"}) {
                 $getterContentTail .= ".toInt()";
             } elsif ($codeGenerator->IsPodType($idlType)) {
-                $getterContentHead = "[$attributeTypeSansPtr $typeMaker:" . $getterContentHead;
-                $getterContentTail .= "]";
+                $getterContentHead = "kit($getterContentHead";
+                $getterContentTail .= ")";
             } elsif (IsProtocolType($idlType) and $idlType ne "EventTarget") {
-                $getterContentHead = "[$attributeClassName $typeMaker:WTF::getPtr(" . $getterContentHead;
-                $getterContentTail .= ")]";
-            } elsif ($typeMaker ne "") {
-                # Surround getter with TypeMaker
-                $getterContentHead = "[$attributeTypeSansPtr $typeMaker:WTF::getPtr(" . $getterContentHead;
-                $getterContentTail .= ")]";
+                $getterContentHead = "kit($getterContentHead";
+                $getterContentTail .= ")";
+            } elsif (ConversionNeeded($attribute->signature->type)) {
+                $getterContentHead = "kit(WTF::getPtr($getterContentHead";
+                $getterContentTail .= "))";
             }
 
             my $getterContent;
@@ -1292,7 +1236,7 @@ sub GenerateImplementation
                 # Exception handling
                 my $hasSetterException = @{$attribute->setterExceptions};
 
-                $attributeName = "set" . $codeGenerator->WK_ucfirst($attributeName);
+                my $coreSetterName = "set" . $codeGenerator->WK_ucfirst($attributeName);
                 my $setterName = "set" . ucfirst($attributeInterfaceName);
                 my $argName = "new" . ucfirst($attributeInterfaceName);
                 my $arg = GetObjCTypeGetter($argName, $idlType);
@@ -1318,14 +1262,22 @@ sub GenerateImplementation
                     if ($podType eq "float") {
                         push(@implContent, "    *IMPL = $arg;\n");
                     } else {
-                        push(@implContent, "    IMPL->$attributeName($arg);\n");
+                        push(@implContent, "    IMPL->$coreSetterName($arg);\n");
                     }
                 } elsif ($hasSetterException) {
                     push(@implContent, "    $exceptionInit\n");
-                    push(@implContent, "    IMPL->$attributeName($arg, ec);\n");
+                    push(@implContent, "    IMPL->$coreSetterName($arg, ec);\n");
                     push(@implContent, "    $exceptionRaiseOnError\n");
                 } else {
-                    push(@implContent, "    IMPL->$attributeName($arg);\n");
+                    my $reflect = $attribute->signature->extendedAttributes->{"Reflect"};
+                    my $reflectURL = $attribute->signature->extendedAttributes->{"ReflectURL"};
+                    if ($reflect || $reflectURL) {
+                        $implIncludes{"HTMLNames.h"} = 1;
+                        my $contentAttributeName = (($reflect || $reflectURL) eq "1") ? $attributeName : ($reflect || $reflectURL);
+                        push(@implContent, "    IMPL->setAttribute(WebCore::HTMLNames::${contentAttributeName}Attr, $arg);\n");
+                    } else {
+                        push(@implContent, "    IMPL->$coreSetterName($arg);\n");
+                    }
                 }
 
                 push(@implContent, "}\n\n");
@@ -1393,7 +1345,7 @@ sub GenerateImplementation
                 push(@functionContent, "    RefPtr<WebCore::XPathNSResolver> customResolver;\n");
                 push(@functionContent, "    if ($paramName) {\n");
                 push(@functionContent, "        if ([$paramName isMemberOfClass:[DOMNativeXPathNSResolver class]])\n");
-                push(@functionContent, "            nativeResolver = [(DOMNativeXPathNSResolver *)$paramName _xpathNSResolver];\n");
+                push(@functionContent, "            nativeResolver = core(static_cast<DOMNativeXPathNSResolver *>($paramName));\n");
                 push(@functionContent, "        else {\n");
                 push(@functionContent, "            customResolver = WebCore::DOMCustomXPathNSResolver::create($paramName);\n");
                 push(@functionContent, "            nativeResolver = WTF::getPtr(customResolver);\n");
@@ -1405,8 +1357,7 @@ sub GenerateImplementation
             if (defined $needsCustom{"EventTarget"}) {
                 my $paramName = $needsCustom{"EventTarget"};
                 push(@functionContent, "    DOMNode* ${paramName}ObjC = $paramName;\n");
-                push(@functionContent, "    WebCore::Node* ${paramName}Node = [${paramName}ObjC _node];\n");
-                push(@functionContent, "    WebCore::EventTargetNode* ${paramName}EventTarget = (${paramName}Node && ${paramName}Node->isEventTargetNode()) ? static_cast<WebCore::EventTargetNode*>(${paramName}Node) : 0;\n\n");
+                push(@functionContent, "    WebCore::Node* ${paramName}Node = core(${paramName}ObjC);\n");
                 $implIncludes{"DOMNode.h"} = 1;
                 $implIncludes{"Node.h"} = 1;
             }
@@ -1419,16 +1370,6 @@ sub GenerateImplementation
                 $caller = "dv";
             }
 
-            if ($function->signature->extendedAttributes->{"EventTargetNodeCast"}) {
-                if ($dataNode->name =~ /^SVG/) {
-                    $caller = "static_cast<WebCore::SVGElementInstance*>($caller)";
-                } else {
-                    push(@functionContent, "    if (!$caller->isEventTargetNode())\n");
-                    $caller = "WebCore::EventTargetNodeCast($caller)";
-                    push(@functionContent, "        WebCore::raiseDOMException(DOM_NOT_SUPPORTED_ERR);\n");
-                }
-            }
-
             # special case the EventListener
             if (defined $needsCustom{"EventListener"}) {
                 my $paramName = $needsCustom{"EventListener"};
@@ -1457,14 +1398,14 @@ sub GenerateImplementation
                 push(@functionContent, "    if (x == 0.0 || y == 0.0)\n");
                 push(@functionContent, "        ec = WebCore::SVGException::SVG_INVALID_VALUE_ERR;\n");
                 push(@functionContent, "    $exceptionRaiseOnError\n");
-                push(@functionContent, "    return [DOMSVGMatrix _wrapSVGMatrix:$content];\n");
+                push(@functionContent, "    return kit($content);\n");
             } elsif ($svgMatrixInverse) {
                 # Special case with inverse & SVGMatrix
                 push(@functionContent, "    $exceptionInit\n");
                 push(@functionContent, "    if (!$caller->isInvertible())\n");
                 push(@functionContent, "        ec = WebCore::SVGException::SVG_MATRIX_NOT_INVERTABLE;\n");
                 push(@functionContent, "    $exceptionRaiseOnError\n");
-                push(@functionContent, "    return [DOMSVGMatrix _wrapSVGMatrix:$content];\n");
+                push(@functionContent, "    return kit($content);\n");
             } elsif ($svgLengthConvertToSpecifiedUnits) {
                 push(@functionContent, "    IMPL->convertToSpecifiedUnits(inUnitType, 0 /* FIXME */);\n");
             } elsif ($returnType eq "void") {
@@ -1492,26 +1433,11 @@ sub GenerateImplementation
                     push(@functionContent, "    return nil;\n");
                 }
             } else {
-                my $typeMaker = GetObjCTypeMaker($function->signature->type);
-                unless ($typeMaker eq "") {
-                    my $returnTypeClass = "";
-                    if ($function->signature->type eq "XPathNSResolver") {
-                        # Special case XPathNSResolver
-                        $returnTypeClass = "DOMNativeXPathNSResolver";
+                if (ConversionNeeded($function->signature->type)) {
+                    if ($codeGenerator->IsPodType($function->signature->type)) {
+                        $content = "kit($content)";
                     } else {
-                        # Remove trailing " *" from pointer types.
-                        $returnTypeClass = $returnType;
-                        $returnTypeClass =~ s/ \*$//;
-                    }
-
-                    # Surround getter with TypeMaker
-                    my $idlType = $returnTypeClass;
-                    $idlType =~ s/^DOM//;
-
-                    if ($codeGenerator->IsPodType($idlType)) {
-                        $content = "[$returnTypeClass $typeMaker:" . $content . "]";
-                    } else {
-                        $content = "[$returnTypeClass $typeMaker:WTF::getPtr(" . $content . ")]";
+                        $content = "kit(WTF::getPtr($content))";
                     }
                 }
 
@@ -1558,87 +1484,55 @@ sub GenerateImplementation
     push(@implContent, "\@end\n");
 
     # Generate internal interfaces
-    unless ($dataNode->extendedAttributes->{ObjCCustomInternalImpl}) {
-        # - BEGIN WebCoreInternal category @implementation
-        push(@implContent, "\n\@implementation $className (WebCoreInternal)\n\n");
-
-        my $typeGetterSig = GetInternalTypeGetterSignature($interfaceName, $podType);
-        push(@implContent, "$typeGetterSig\n");
+    if ($podType) {
+        my $prefixedPodType = $podType eq "float" ? $podType : "WebCore::$podType";
+        push(@implContent, "\n$prefixedPodType core($className *wrapper)\n");
         push(@implContent, "{\n");
-
-        if ($podType) {
-            push(@implContent, "    return *IMPL;\n");
-        } else {
-            push(@implContent, "    return IMPL;\n");
-        }
-
+        push(@implContent, "    return wrapper ? *reinterpret_cast<$prefixedPodType*>(wrapper->_internal) : $prefixedPodType();\n");
         push(@implContent, "}\n\n");
+    } else {
+        push(@implContent, "\nWebCore::$implClassName* core($className *wrapper)\n");
+        push(@implContent, "{\n");
+        push(@implContent, "    return wrapper ? reinterpret_cast<WebCore::$implClassName*>(wrapper->_internal) : 0;\n");
+        push(@implContent, "}\n\n");
+    }
 
-        my ($typeMakerSig, $typeMakerSigAddition, $ivarsToInit) = GetInternalTypeMakerSignature($interfaceName, $podType);
-
-        if ($podType) {
-            # - (id)_initWithFooBar:(WebCore::FooBar)impl for implementation class FooBar
-            my $initWithImplName = "_initWith" . $implClassName;
-            my $initWithSig = "- (id)$initWithImplName:($podTypeWithNamespace)impl" . $typeMakerSigAddition;
-
-            # FIXME: Implement Caching
-            push(@implContent, "$initWithSig\n");
-            push(@implContent, "{\n");
-            push(@implContent, "    $assertMainThread;\n");
-            push(@implContent, "    [super _init];\n");
-            push(@implContent, "    $podTypeWithNamespace* _impl = new $podTypeWithNamespace(impl);\n");
-            push(@implContent, "    _internal = reinterpret_cast<DOMObjectInternal*>(_impl);\n");
-            push(@implContent, "    return self;\n");
-            push(@implContent, "}\n\n");
-
-            # - (DOMFooBar)_wrapFooBar:(WebCore::FooBar)impl for implementation class FooBar
-            push(@implContent, "$typeMakerSig\n");
-            push(@implContent, "{\n");
-            push(@implContent, "    $assertMainThread;\n");
-            push(@implContent, "    return [[[self alloc] $initWithImplName:impl] autorelease];\n");
-            push(@implContent, "}\n\n");
-        } elsif ($parentImplClassName eq "Object") {        
-            # - (id)_initWithFooBar:(WebCore::FooBar *)impl for implementation class FooBar
-            my $initWithImplName = "_initWith" . $implClassName;
-            my $initWithSig = "- (id)$initWithImplName:($implClassNameWithNamespace *)impl" . $typeMakerSigAddition;
-
-            push(@implContent, "$initWithSig\n");
-            push(@implContent, "{\n");
-            push(@implContent, "    $assertMainThread;\n");
-            push(@implContent, "    [super _init];\n");
-            push(@implContent, "    _internal = reinterpret_cast<DOMObjectInternal*>(impl);\n");
-            push(@implContent, "    impl->ref();\n");
-            push(@implContent, "    WebCore::addDOMWrapper(self, impl);\n");
-            push(@implContent, @ivarsToRetain);
-            push(@implContent, "    return self;\n");
-            push(@implContent, "}\n\n");
-
-            # - (DOMFooBar)_wrapFooBar:(WebCore::FooBar *)impl for implementation class FooBar
-            push(@implContent, "$typeMakerSig\n");
-            push(@implContent, "{\n");
-            push(@implContent, "    $assertMainThread;\n");
-            push(@implContent, "    if (!impl)\n");
+    if ($podType) {
+        # FIXME: Implement caching.
+        my $prefixedPodType = $podType eq "float" ? $podType : "WebCore::$podType";
+        push(@implContent, "$className *kit($prefixedPodType value)\n");
+        push(@implContent, "{\n");
+        push(@implContent, "    $assertMainThread;\n");
+        push(@implContent, "    $className *wrapper = [[$className alloc] _init];\n");
+        push(@implContent, "    wrapper->_internal = reinterpret_cast<DOMObjectInternal*>(new $prefixedPodType(value));\n");
+        push(@implContent, "    return [wrapper autorelease];\n");
+        push(@implContent, "}\n");
+    } elsif ($parentImplClassName eq "Object") {        
+        push(@implContent, "$className *kit(WebCore::$implClassName* value)\n");
+        push(@implContent, "{\n");
+        push(@implContent, "    $assertMainThread;\n");
+        push(@implContent, "    if (!value)\n");
+        push(@implContent, "        return nil;\n");
+        push(@implContent, "    if ($className *wrapper = getDOMWrapper(value))\n");
+        push(@implContent, "        return [[wrapper retain] autorelease];\n");
+        if ($dataNode->extendedAttributes->{Polymorphic}) {
+            push(@implContent, "    $className *wrapper = [[kitClass(value) alloc] _init];\n");
+            push(@implContent, "    if (!wrapper)\n");
             push(@implContent, "        return nil;\n");
-            push(@implContent, "    id cachedInstance;\n");
-            push(@implContent, "    cachedInstance = WebCore::getDOMWrapper(impl);\n");
-            push(@implContent, "    if (cachedInstance)\n");
-            push(@implContent, "        return [[cachedInstance retain] autorelease];\n");
-            push(@implContent, "    return [[[self alloc] $initWithImplName:impl" . $ivarsToInit . "] autorelease];\n");
-            push(@implContent, "}\n\n");
         } else {
-            my $internalBaseType = "DOM$baseClass";
-            my $internalBaseTypeMaker = GetObjCTypeMaker($baseClass);
-
-            # - (DOMFooBar)_wrapFooBar:(WebCore::FooBar *)impl for implementation class FooBar
-            push(@implContent, "$typeMakerSig\n");
-            push(@implContent, "{\n");
-            push(@implContent, "    $assertMainThread;\n");
-            push(@implContent, "    return static_cast<$className*>([$internalBaseType $internalBaseTypeMaker:impl]);\n");
-            push(@implContent, "}\n\n");
+            push(@implContent, "    $className *wrapper = [[$className alloc] _init];\n");
         }
-
-        # END WebCoreInternal category
-        push(@implContent, "\@end\n");
+        push(@implContent, "    wrapper->_internal = reinterpret_cast<DOMObjectInternal*>(value);\n");
+        push(@implContent, "    value->ref();\n");
+        push(@implContent, "    addDOMWrapper(wrapper, value);\n");
+        push(@implContent, "    return [wrapper autorelease];\n");
+        push(@implContent, "}\n");
+    } else {
+        push(@implContent, "$className *kit(WebCore::$implClassName* value)\n");
+        push(@implContent, "{\n");
+        push(@implContent, "    $assertMainThread;\n");
+        push(@implContent, "    return static_cast<$className*>(kit(static_cast<WebCore::$baseClass*>(value)));\n");
+        push(@implContent, "}\n");
     }
 
     # - End the ifdef conditional if necessary
@@ -1706,8 +1600,6 @@ sub WriteData
 
         print IMPL @implContentHeader;
         print IMPL map { "#import \"$_\"\n" } sort keys(%implIncludes);
-
-        print IMPL "\n" if keys(%implIncludes);
         print IMPL @implContent;
 
         close(IMPL);
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
new file mode 100644
index 0000000..088668e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -0,0 +1,2191 @@
+
+# Copyright (C) 2005, 2006 Nikolas Zimmermann <zimmermann@kde.org>
+# Copyright (C) 2006 Anders Carlsson <andersca@mac.com>
+# Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
+# Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
+# Copyright (C) 2006 Apple Computer, Inc.
+# Copyright (C) 2007, 2008, 2009 Google Inc.
+#
+# This file is part of the KDE project
+#
+# This library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Library General Public
+# License as published by the Free Software Foundation; either
+# version 2 of the License, or (at your option) any later version.
+#
+# This library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Library General Public License for more details.
+#
+# You should have received a copy of the GNU Library General Public License
+# aint with this library; see the file COPYING.LIB.  If not, write to
+# the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+# Boston, MA 02111-1307, USA.
+#
+
+package CodeGeneratorV8;
+
+use File::stat;
+
+my $module = "";
+my $outputDir = "";
+
+my @headerContent = ();
+my @implContentHeader = ();
+my @implFixedHeader = ();
+my @implContent = ();
+my @implContentDecls = ();
+my %implIncludes = ();
+
+my @allParents = ();
+
+# Default .h template
+my $headerTemplate = << "EOF";
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+    Boston, MA 02111-1307, USA.
+*/
+EOF
+
+# Default constructor
+sub new
+{
+    my $object = shift;
+    my $reference = { };
+
+    $codeGenerator = shift;
+    $outputDir = shift;
+
+    bless($reference, $object);
+    return $reference;
+}
+
+sub finish
+{
+    my $object = shift;
+
+    # Commit changes!
+    $object->WriteData();
+}
+
+sub leftShift($$) {
+    my ($value, $distance) = @_;
+    return (($value << $distance) & 0xFFFFFFFF);
+}
+
+# Uppercase the first letter, while respecting WebKit style guidelines.
+# E.g., xmlEncoding becomes XMLEncoding, but xmlllang becomes Xmllang.
+sub WK_ucfirst
+{
+    my $param = shift;
+    my $ret = ucfirst($param);
+    $ret =~ s/Xml/XML/ if $ret =~ /^Xml[^a-z]/;
+    return $ret;
+}
+
+# Lowercase the first letter while respecting WebKit style guidelines.
+# URL becomes url, but SetURL becomes setURL.
+sub WK_lcfirst
+{
+    my $param = shift;
+    my $ret = lcfirst($param);
+    $ret =~ s/uRL/url/;
+    return $ret;
+}
+
+# Workaround for V8 bindings difference where RGBColor is not a POD type.
+sub IsPodType
+{
+    my $type = shift;
+    return 0 if $type eq "RGBColor";
+    return $codeGenerator->IsPodType($type);
+}
+
+# Params: 'domClass' struct
+sub GenerateInterface
+{
+    my $object = shift;
+    my $dataNode = shift;
+    my $defines = shift;
+
+    # Start actual generation
+    $object->GenerateHeader($dataNode);
+    $object->GenerateImplementation($dataNode);
+
+    my $name = $dataNode->name;
+
+    # Open files for writing
+    my $headerFileName = "$outputDir/V8$name.h";
+    my $implFileName = "$outputDir/V8$name.cpp";
+
+    open($IMPL, ">$implFileName") || die "Couldn't open file $implFileName";
+    open($HEADER, ">$headerFileName") || die "Couldn't open file $headerFileName";
+}
+
+# Params: 'idlDocument' struct
+sub GenerateModule
+{
+    my $object = shift;
+    my $dataNode = shift;
+
+    $module = $dataNode->module;
+}
+
+sub GetLegacyHeaderIncludes
+{
+    my $legacyParent = shift;
+
+    die "Don't know what headers to include for module $module";
+}
+
+sub AvoidInclusionOfType
+{
+    my $type = shift;
+
+    # Special case: SVGRect.h / SVGPoint.h / SVGNumber.h / SVGMatrix.h do not exist.
+    return 1 if $type eq "SVGRect" or $type eq "SVGPoint" or $type eq "SVGNumber" or $type eq "SVGMatrix";
+    return 0;
+}
+
+sub UsesManualToJSImplementation
+{
+    my $type = shift;
+
+    return 1 if $type eq "SVGPathSeg";
+    return 0;
+}
+
+sub AddIncludesForType
+{
+    my $type = $codeGenerator->StripModule(shift);
+
+    # When we're finished with the one-file-per-class
+    # reorganization, we won't need these special cases.
+    if ($codeGenerator->IsPrimitiveType($type) or AvoidInclusionOfType($type)) {
+    } elsif ($type =~ /SVGPathSeg/) {
+        $joinedName = $type;
+        $joinedName =~ s/Abs|Rel//;
+        $implIncludes{"${joinedName}.h"} = 1;
+    } else {
+        # default, include the same named file
+        $implIncludes{GetImplementationFileName(${type})} = 1;
+    }
+
+    # additional includes (things needed to compile the bindings but not the header)
+
+    if ($type eq "CanvasRenderingContext2D") {
+        $implIncludes{"CanvasGradient.h"} = 1;
+        $implIncludes{"CanvasPattern.h"} = 1;
+        $implIncludes{"CanvasStyle.h"} = 1;
+    }
+
+    if ($type eq "CanvasGradient" or $type eq "XPathNSResolver") {
+        $implIncludes{"PlatformString.h"} = 1;
+    }
+
+    if ($type eq "CSSStyleDeclaration") {
+        $implIncludes{"CSSMutableStyleDeclaration.h"} = 1;
+    }
+
+    if ($type eq "Plugin" or $type eq "PluginArray" or $type eq "MimeTypeArray") {
+        # So we can get String -> AtomicString conversion for namedItem().
+        $implIncludes{"AtomicString.h"} = 1;
+    }
+}
+
+sub AddIncludesForSVGAnimatedType
+{
+    my $type = shift;
+    $type =~ s/SVGAnimated//;
+
+    if ($type eq "Point" or $type eq "Rect") {
+        $implIncludes{"Float$type.h"} = 1;
+    } elsif ($type eq "String") {
+        $implIncludes{"PlatformString.h"} = 1;
+    }
+
+    $implIncludes{"SVGAnimatedTemplate.h"} = 1;
+}
+
+sub AddClassForwardIfNeeded
+{
+    my $implClassName = shift;
+
+    # SVGAnimatedLength/Number/etc.. are typedefs to SVGAnimtatedTemplate, so don't use class forwards for them!
+    push(@headerContent, "class $implClassName;\n\n") unless $codeGenerator->IsSVGAnimatedType($implClassName);
+}
+
+sub GetImplementationFileName
+{
+    my $iface = shift;
+    return "HTMLCollection.h" if $iface eq "UndetectableHTMLCollection";
+    return "Event.h" if $iface eq "DOMTimeStamp";
+    return "NamedAttrMap.h" if $iface eq "NamedNodeMap";
+    return "NameNodeList.h" if $iface eq "NodeList";
+    return "XMLHttpRequest.h" if $iface eq "XMLHttpRequest";
+
+    return "${iface}.h";
+}
+
+sub GenerateHeader
+{
+    my $object = shift;
+    my $dataNode = shift;
+
+    my $interfaceName = $dataNode->name;
+    my $className = "V8$interfaceName";
+    my $implClassName = $interfaceName;
+
+    # Copy contents of parent classes except the first parent or if it is
+    # EventTarget.
+    $codeGenerator->AddMethodsConstantsAndAttributesFromParentClasses($dataNode);
+
+    my $hasLegacyParent = $dataNode->extendedAttributes->{"LegacyParent"};
+    my $conditional = $dataNode->extendedAttributes->{"Conditional"};
+
+    # - Add default header template
+    @headerContent = split("\r", $headerTemplate);
+
+    my $conditionalString;
+    if ($conditional) {
+        $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
+        push(@headerContent, "\n#if ${conditionalString}\n\n");
+    }
+
+    push(@headerContent, "\n#ifndef $className" . "_H");
+    push(@headerContent, "\n#define $className" . "_H\n\n");
+
+    # Get correct pass/store types respecting PODType flag
+    my $podType = $dataNode->extendedAttributes->{"PODType"};
+    my $passType = $podType ? "JSSVGPODTypeWrapper<$podType>*" : "$implClassName*";
+
+    push(@headerContent, "#include \"$podType.h\"\n") if $podType and ($podType ne "double" and $podType ne "float" and $podType ne "RGBA32");
+
+    push(@headerContent, "#include <v8.h>\n");
+    push(@headerContent, "#include <wtf/HashMap.h>\n");
+    push(@headerContent, "#include \"StringHash.h\"\n");
+
+    push(@headerContent, "\nnamespace WebCore {\n\n");
+    push(@headerContent, "class V8ClassIndex;\n");
+    push(@headerContent, "\nclass $className {\n");
+    push(@headerContent, <<END);
+
+ public:
+  static bool HasInstance(v8::Handle<v8::Value> value);
+  static v8::Persistent<v8::FunctionTemplate> GetRawTemplate();
+END
+
+    if ($implClassName eq "DOMWindow") {
+      push(@headerContent, <<END);
+  static v8::Persistent<v8::ObjectTemplate> GetShadowObjectTemplate();
+END
+    }
+
+    push(@headerContent, <<END);
+
+ private:
+  static v8::Persistent<v8::FunctionTemplate> GetTemplate();
+
+  friend class V8ClassIndex;
+};
+
+END
+
+    push(@headerContent, "}\n\n");
+    push(@headerContent, "#endif // $className" . "_H\n");
+
+    push(@headerContent, "#endif // ${conditionalString}\n\n") if $conditional;
+}
+
+
+sub GenerateSetDOMException
+{
+    my $indent = shift;
+    my $result = "";
+
+    $result .= $indent . "if (ec) {\n";
+    $result .= $indent . "    V8Proxy::setDOMException(ec);\n";
+    $result .= $indent . "    return v8::Handle<v8::Value>();\n";
+    $result .= $indent . "}\n";
+
+    return $result;
+}
+
+sub IsNodeSubType
+{
+    my $dataNode = shift;
+    return 1 if ($dataNode->name eq "Node");
+    foreach (@allParents) {
+        my $parent = $codeGenerator->StripModule($_);
+        return 1 if $parent eq "Node";
+    }
+    return 0;
+}
+
+sub HolderToNative
+{
+    my $dataNode = shift;
+    my $implClassName = shift;
+    my $classIndex = shift;
+
+    if (IsNodeSubType($dataNode)) {
+        push(@implContentDecls, <<END);
+    $implClassName* imp = V8Proxy::convertDOMWrapperToNode<$implClassName>(holder);
+END
+
+    } else {
+        push(@implContentDecls, <<END);
+    $implClassName* imp = V8Proxy::convertToNativeObject<$implClassName>(V8ClassIndex::$classIndex, holder);
+END
+
+  }
+}
+
+sub GenerateDomainSafeFunctionGetter
+{
+    my $function = shift;
+    my $dataNode = shift;
+    my $classIndex = shift;
+    my $implClassName = shift;
+
+    my $className = "V8" . $dataNode->name;
+    my $funcName = $function->signature->name;
+
+    my $signature = "v8::Signature::New(" . $className . "::GetRawTemplate())";
+    if ($function->signature->extendedAttributes->{"V8DoNotCheckSignature"}) {
+        $signature = "v8::Local<v8::Signature>()";
+    }
+
+    my $newTemplateString = GenerateNewFunctionTemplate($function, $dataNode, $signature);
+
+    $implIncludes{"V8Proxy.h"} = 1;
+
+    push(@implContentDecls, <<END);
+  static v8::Handle<v8::Value> ${funcName}AttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info) {
+    INC_STATS(\"DOM.$implClassName.$funcName._get\");
+    static v8::Persistent<v8::FunctionTemplate> private_template =
+        v8::Persistent<v8::FunctionTemplate>::New($newTemplateString);
+    v8::Handle<v8::Object> holder = V8Proxy::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
+    if (holder.IsEmpty()) {
+      // can only reach here by 'object.__proto__.func', and it should passed
+      // domain security check already
+
+      return private_template->GetFunction();
+    }
+END
+
+  HolderToNative($dataNode, $implClassName, $classIndex);
+
+    push(@implContentDecls, <<END);
+    if (!V8Proxy::canAccessFrame(imp->frame(), false)) {
+      static v8::Persistent<v8::FunctionTemplate> shared_template =
+        v8::Persistent<v8::FunctionTemplate>::New($newTemplateString);
+      return shared_template->GetFunction();
+
+    } else {
+      return private_template->GetFunction();
+    }
+  }
+
+END
+}
+
+sub GenerateConstructorGetter
+{
+    my $implClassName = shift;
+    my $classIndex = shift;
+
+    push(@implContentDecls, <<END);
+  static v8::Handle<v8::Value> ${implClassName}ConstructorGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info) {
+    INC_STATS(\"DOM.$implClassName.constructors._get\");
+    v8::Handle<v8::Value> data = info.Data();
+    ASSERT(data->IsNumber());
+    V8ClassIndex::V8WrapperType type = V8ClassIndex::FromInt(data->Int32Value());
+END
+
+    if ($classIndex eq "DOMWINDOW") {
+        push(@implContentDecls, <<END);
+    DOMWindow* window = V8Proxy::convertToNativeObject<DOMWindow>(V8ClassIndex::DOMWINDOW, info.Holder());
+    Frame* frame = window->frame();
+    if (frame) {
+      // Get the proxy corresponding to the DOMWindow if possible to
+      // make sure that the constructor function is constructed in the
+      // context of the DOMWindow and not in the context of the caller.
+      return V8Proxy::retrieve(frame)->getConstructor(type);
+    }
+END
+  }
+
+    if ($classIndex eq "WORKERCONTEXT") {
+        $implIncludes{"WorkerContextExecutionProxy.h"} = 1;
+        push(@implContentDecls, <<END);
+    return WorkerContextExecutionProxy::retrieve()->GetConstructor(type);
+END
+    } else {
+        push(@implContentDecls, "    return v8::Undefined();");
+    }
+
+    push(@implContentDecls, <<END);
+
+    }
+
+END
+}
+
+sub GenerateNormalAttrGetter
+{
+    my $attribute = shift;
+    my $dataNode = shift;
+    my $classIndex = shift;
+    my $implClassName = shift;
+
+    my $attrExt = $attribute->signature->extendedAttributes;
+
+    my $attrName = $attribute->signature->name;
+    $implIncludes{"V8Proxy.h"} = 1;
+
+    my $attrType = $codeGenerator->StripModule($attribute->signature->type);
+    my $attrIsPodType = IsPodType($attrType);
+
+    my $nativeType = GetNativeTypeFromSignature($attribute->signature, 0);
+    my $isPodType = IsPodType($implClassName);
+    my $skipContext = 0;
+
+
+    if ($isPodType) {
+        $implClassName = GetNativeType($implClassName);
+        $implIncludes{"V8SVGPODTypeWrapper.h"} = 1;
+    }
+
+    # Special case: SVGZoomEvent's attributes are all read-only
+    if ($implClassName eq "SVGZoomEvent") {
+        $attrIsPodType = 0;
+        $skipContext = 1;
+    }
+
+    # Special case: SVGSVGEelement::viewport is read-only
+    if (($implClassName eq "SVGSVGElement") and ($attrName eq "viewport")) {
+        $attrIsPodType = 0;
+        $skipContext = 1;
+    }
+
+    # Special case for SVGColor
+    if (($implClassName eq "SVGColor") and ($attrName eq "rgbColor")) {
+        $attrIsPodType = 0;
+    }
+
+    my $getterStringUsesImp = $implClassName ne "double";
+
+  # Getter
+    push(@implContentDecls, <<END);
+  static v8::Handle<v8::Value> ${attrName}AttrGetter(v8::Local<v8::String> name, const v8::AccessorInfo& info) {
+    INC_STATS(\"DOM.$implClassName.$attrName._get\");
+END
+
+    if ($isPodType) {
+        push(@implContentDecls, <<END);
+    V8SVGPODTypeWrapper<$implClassName>* imp_wrapper = V8Proxy::convertToNativeObject<V8SVGPODTypeWrapper<$implClassName> >(V8ClassIndex::$classIndex, info.Holder());
+    $implClassName imp_instance = *imp_wrapper;
+END
+        if ($getterStringUsesImp) {
+            push(@implContentDecls, <<END);
+    $implClassName* imp = &imp_instance;
+END
+        }
+
+    } elsif ($attrExt->{"v8OnProto"} || $attrExt->{"V8DisallowShadowing"}) {
+        # perform lookup first
+        push(@implContentDecls, <<END);
+    v8::Handle<v8::Object> holder = V8Proxy::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
+    if (holder.IsEmpty()) return v8::Undefined();
+END
+        HolderToNative($dataNode, $implClassName, $classIndex);
+    } else {
+        push(@implContentDecls, <<END);
+    v8::Handle<v8::Object> holder = info.Holder();
+END
+        HolderToNative($dataNode, $implClassName, $classIndex);
+    }
+
+    # Generate security checks if necessary
+    if ($attribute->signature->extendedAttributes->{"CheckNodeSecurity"}) {
+        push(@implContentDecls, "    if (!V8Proxy::checkNodeSecurity(imp->$attrName())) return v8::Undefined();\n\n");
+    } elsif ($attribute->signature->extendedAttributes->{"CheckFrameSecurity"}) {
+        push(@implContentDecls, "    if (!V8Proxy::checkNodeSecurity(imp->contentDocument())) return v8::Undefined();\n\n");
+    }
+
+    my $useExceptions = 1 if @{$attribute->getterExceptions} and !($isPodType);
+    if ($useExceptions) {
+        $implIncludes{"ExceptionCode.h"} = 1;
+        push(@implContentDecls, "    ExceptionCode ec = 0;\n");
+    }
+
+    if ($attribute->signature->extendedAttributes->{"v8referenceattr"}) {
+        $attrName = $attribute->signature->extendedAttributes->{"v8referenceattr"};
+    }
+
+    my $getterFunc = WK_lcfirst($attrName);
+    $getterFunc .= "Animated" if $codeGenerator->IsSVGAnimatedType($attribute->signature->type);
+
+    my $returnType = $codeGenerator->StripModule($attribute->signature->type);
+
+    my $getterString;
+    if ($getterStringUsesImp) {
+        $getterString = "imp->$getterFunc(";
+        $getterString .= "ec" if $useExceptions;
+        $getterString .= ")";
+        if (IsRefPtrType($returnType)) {
+            $implIncludes{"wtf/GetPtr.h"} = 1;
+            $getterString = "WTF::getPtr(" . $getterString . ")";
+        }
+        if ($nativeType eq "int" and
+            $attribute->signature->extendedAttributes->{"ConvertFromString"}) {
+                $getterString .= ".toInt()";
+            }
+        } else {
+            $getterString = "imp_instance";
+        }
+        if ($nativeType eq "String") {
+            $getterString = "ToString($getterString)";
+        }
+
+        my $result;
+        my $wrapper;
+
+        if ($attrIsPodType) {
+            $implIncludes{"V8SVGPODTypeWrapper.h"} = 1;
+
+            my $getter = $getterString;
+            $getter =~ s/imp->//;
+            $getter =~ s/\(\)//;
+            my $setter = "set" . WK_ucfirst($getter);
+
+            my $implClassIsAnimatedType = $codeGenerator->IsSVGAnimatedType($implClassName);
+            if (not $implClassIsAnimatedType
+                and $codeGenerator->IsPodTypeWithWriteableProperties($attrType)
+                and not defined $attribute->signature->extendedAttributes->{"Immutable"}) {
+            if (IsPodType($implClassName)) {
+                $wrapper = "new V8SVGStaticPODTypeWrapperWithPODTypeParent<$nativeType, $implClassName>($getterString, imp_wrapper)";
+            } else {
+                $wrapper = "new V8SVGStaticPODTypeWrapperWithParent<$nativeType, $implClassName>(imp, &${implClassName}::$getter, &${implClassName}::$setter)";
+            }
+        } else {
+            if ($implClassIsAnimatedType) {
+                $wrapper = "V8SVGDynamicPODTypeWrapperCache<$nativeType, $implClassName>::lookupOrCreateWrapper(imp, &${implClassName}::$getter, &${implClassName}::$setter)";
+            } else {
+                $wrapper = GenerateSVGStaticPodTypeWrapper($returnType, $getterString);
+            }
+        }
+
+        push(@implContentDecls, "    void* wrapper = $wrapper;\n");
+    } elsif ($nativeType ne "RGBColor") {
+        push(@implContentDecls, "    $nativeType v = ");
+
+        push(@implContentDecls, "$getterString;\n");
+
+        if ($useExceptions) {
+            push(@implContentDecls, GenerateSetDOMException("    "));
+        }
+
+        $result = "v";
+        if (IsRefPtrType($returnType)) {
+            $result = "WTF::getPtr(" . $result . ")";
+        }
+    } else {
+        # Special case: RGBColor is noncopyable
+        $result = $getterString;
+    }
+
+
+    if (IsSVGTypeNeedingContextParameter($attrType) && !$skipContext) {
+        my $resultObject = $result;
+        if ($attrIsPodType) {
+            $resultObject = "wrapper";
+        }
+
+        push(@implContentDecls, GenerateSVGContextAssignment($implClassName, $resultObject, "    "));
+    }
+
+    if ($attrIsPodType) {
+        my $classIndex = uc($attrType);
+        push(@implContentDecls, "    return V8Proxy::convertToV8Object(V8ClassIndex::$classIndex, wrapper);\n");
+    } else {
+        push(@implContentDecls, "    return ".NativeToJSValue($attribute->signature, $result).";\n");
+    }
+
+    push(@implContentDecls, "  }\n\n");  # end of getter
+}
+
+
+sub GenerateReplaceableAttrSetter
+{
+    my $implClassName = shift;
+
+    $implIncludes{"V8Proxy.h"} = 1;
+
+    push(@implContentDecls,
+       "  static void ${attrName}AttrSetter(v8::Local<v8::String> name," .
+       " v8::Local<v8::Value> value, const v8::AccessorInfo& info) {\n");
+
+    push(@implContentDecls, "    INC_STATS(\"DOM.$implClassName.$attrName._set\");\n");
+
+    push(@implContentDecls, "    v8::Local<v8::String> ${attrName}_string = v8::String::New(\"${attrName}\");\n");
+    push(@implContentDecls, "    info.Holder()->Delete(${attrName}_string);\n");
+    push(@implContentDecls, "    info.This()->Set(${attrName}_string, value);\n");
+    push(@implContentDecls, "  }\n\n");
+}
+
+
+sub GenerateNormalAttrSetter
+{
+    my $attribute = shift;
+    my $dataNode = shift;
+    my $classIndex = shift;
+    my $implClassName = shift;
+
+    my $attrExt = $attribute->signature->extendedAttributes;
+
+    $implIncludes{"V8Proxy.h"} = 1;
+
+    push(@implContentDecls,
+       "  static void ${attrName}AttrSetter(v8::Local<v8::String> name," .
+       " v8::Local<v8::Value> value, const v8::AccessorInfo& info) {\n");
+
+    push(@implContentDecls, "    INC_STATS(\"DOM.$implClassName.$attrName._set\");\n");
+
+    my $isPodType = IsPodType($implClassName);
+
+    if ($isPodType) {
+        $implClassName = GetNativeType($implClassName);
+        $implIncludes{"V8SVGPODTypeWrapper.h"} = 1;
+        push(@implContentDecls, "    V8SVGPODTypeWrapper<$implClassName>* wrapper = V8Proxy::convertToNativeObject<V8SVGPODTypeWrapper<$implClassName> >(V8ClassIndex::$classIndex, info.Holder());\n");
+        push(@implContentDecls, "    $implClassName imp_instance = *wrapper;\n");
+        push(@implContentDecls, "    $implClassName* imp = &imp_instance;\n");
+
+    } elsif ($attrExt->{"v8OnProto"}) {
+        # perform lookup first
+        push(@implContentDecls, <<END);
+    v8::Handle<v8::Object> holder = V8Proxy::lookupDOMWrapper(V8ClassIndex::$classIndex, info.This());
+    if (holder.IsEmpty()) return v8::Undefined();
+END
+        HolderToNative($dataNode, $implClassName, $classIndex);
+    } else {
+        push(@implContentDecls, <<END);
+    v8::Handle<v8::Object> holder = info.Holder();
+END
+        HolderToNative($dataNode, $implClassName, $classIndex);
+    }
+
+    my $nativeType = GetNativeTypeFromSignature($attribute->signature, 0);
+    push(@implContentDecls, "    $nativeType v = " . JSValueToNative($attribute->signature, "value") . ";\n");
+
+    my $result = "";
+    if ($nativeType eq "int" and $attribute->signature->extendedAttributes->{"ConvertFromString"}) {
+        $result .= "WebCore::String::number(";
+    }
+    $result .= "v";
+    if ($nativeType eq "int" and $attribute->signature->extendedAttributes->{"ConvertFromString"}) {
+        $result .= ")";
+    }
+    my $returnType = $codeGenerator->StripModule($attribute->signature->type);
+    if (IsRefPtrType($returnType)) {
+        $result = "WTF::getPtr(" . $result . ")";
+    }
+
+    my $useExceptions = 1 if @{$attribute->setterExceptions} and !($isPodType);
+
+    if ($useExceptions) {
+        $implIncludes{"ExceptionCode.h"} = 1;
+        push(@implContentDecls, "    ExceptionCode ec = 0;\n");
+    }
+
+    if ($implClassName eq "double") {
+        push(@implContentDecls, "    *imp = $result;\n");
+    } else {
+        push(@implContentDecls, "    imp->set" . WK_ucfirst($attrName) . "(" . $result);
+        push(@implContentDecls, ", ec") if $useExceptions;
+        push(@implContentDecls, ");\n");
+    }
+
+    if ($useExceptions) {
+        push(@implContentDecls, "    V8Proxy::setDOMException(ec);\n");
+    }
+
+    if ($isPodType) {
+        push(@implContentDecls, "    wrapper->commitChange(*imp, V8Proxy::svgContext(wrapper));\n");
+    } elsif (IsSVGTypeNeedingContextParameter($implClassName)) {
+        $implIncludes{"SVGElement.h"} = 1;
+
+        my $currentObject = "imp";
+        if ($isPodType) {
+            $currentObject = "wrapper";
+        }
+
+        push(@implContentDecls, "    if (SVGElement* context = V8Proxy::svgContext($currentObject)) {\n");
+        push(@implContentDecls, "        context->svgAttributeChanged(imp->associatedAttributeName());\n");
+        push(@implContentDecls, "    }\n");
+    }
+
+    push(@implContentDecls, "    return;\n");
+    push(@implContentDecls, "  }\n\n");  # end of setter
+}
+
+sub GenerateNewFunctionTemplate
+{
+    $function = shift;
+    $dataNode = shift;
+    $signature = shift;
+
+    my $interfaceName = $dataNode->name;
+    my $name = $function->signature->name;
+
+    if ($function->signature->extendedAttributes->{"Custom"} ||
+        $function->signature->extendedAttributes->{"V8Custom"}) {
+        if ($function->signature->extendedAttributes->{"Custom"} &&
+            $function->signature->extendedAttributes->{"V8Custom"}) {
+            die "Custom and V8Custom should be mutually exclusive!"
+        }
+        my $customFunc = $function->signature->extendedAttributes->{"Custom"} ||
+                         $function->signature->extendedAttributes->{"V8Custom"};
+        if ($customFunc eq 1) {
+            $customFunc = $interfaceName . WK_ucfirst($name);
+        }
+        return "v8::FunctionTemplate::New(V8Custom::v8${customFunc}Callback, v8::Handle<v8::Value>(), $signature)";
+    } else {
+        return "v8::FunctionTemplate::New(${interfaceName}Internal::${name}Callback, v8::Handle<v8::Value>(), $signature)";
+    }
+}
+
+sub GenerateFunctionCallback
+{
+    my $function = shift;
+    my $dataNode = shift;
+    my $classIndex = shift;
+    my $implClassName = shift;
+
+    my $interfaceName = $dataNode->name;
+    my $name = $function->signature->name;
+
+    push(@implContentDecls,
+"  static v8::Handle<v8::Value> ${name}Callback(const v8::Arguments& args) {\n" .
+"    INC_STATS(\"DOM.$implClassName.$name\");\n");
+
+    my $numParameters = @{$function->parameters};
+
+    if ($function->signature->extendedAttributes->{"RequiresAllArguments"}) {
+        push(@implContentDecls,
+            "    if (args.Length() < $numParameters) return v8::Undefined();\n");
+    }
+
+    if (IsPodType($implClassName)) {
+        my $nativeClassName = GetNativeType($implClassName);
+        push(@implContentDecls, "    V8SVGPODTypeWrapper<$nativeClassName>* imp_wrapper = V8Proxy::convertToNativeObject<V8SVGPODTypeWrapper<$nativeClassName> >(V8ClassIndex::$classIndex, args.Holder());\n");
+        push(@implContentDecls, "    $nativeClassName imp_instance = *imp_wrapper;\n");
+        push(@implContentDecls, "    $nativeClassName* imp = &imp_instance;\n");
+    } else {
+        push(@implContentDecls, <<END);
+    v8::Handle<v8::Value> holder = args.Holder();
+END
+        HolderToNative($dataNode, $implClassName, $classIndex);
+    }
+
+  # Check domain security if needed
+    if (($dataNode->extendedAttributes->{"CheckDomainSecurity"}
+       || $interfaceName eq "DOMWindow")
+       && !$function->signature->extendedAttributes->{"DoNotCheckDomainSecurity"}) {
+    # We have not find real use cases yet.
+    push(@implContentDecls,
+"    if (!V8Proxy::canAccessFrame(imp->frame(), true)) {\n".
+"      return v8::Undefined();\n" .
+"    }\n");
+    }
+
+
+    if (@{$function->raisesExceptions}) {
+        $implIncludes{"ExceptionCode.h"} = 1;
+        push(@implContentDecls, "    ExceptionCode ec = 0;\n");
+    }
+
+    if ($function->signature->extendedAttributes->{"CustomArgumentHandling"}) {
+        push(@implContentDecls, "    ScriptCallStack callStack(args, $numParameters);\n");
+        $implIncludes{"ScriptCallStack.h"} = 1;
+    }
+
+    my $paramIndex = 0;
+    foreach my $parameter (@{$function->parameters}) {
+        TranslateParameter($parameter);
+
+        my $parameterName = $parameter->name;
+
+        if ($parameter->extendedAttributes->{"Optional"}) {
+            # Generate early call if there are not enough parameters.
+            push(@implContentDecls, "    if (args.Length() <= $paramIndex) {\n");
+            my $functionCall = GenerateFunctionCallString($function, $paramIndex, "    " x 2, $implClassName);
+            push(@implContentDecls, $functionCall);
+            push(@implContentDecls, "    }\n");
+        }
+
+        if (BasicTypeCanFailConversion($parameter)) {
+            push(@implContentDecls, "    bool ${parameterName}Ok;\n");
+        }
+
+        push(@implContentDecls, "    " . GetNativeTypeFromSignature($parameter, 1) . " $parameterName = ");
+        push(@implContentDecls, JSValueToNative($parameter, "args[$paramIndex]",
+           BasicTypeCanFailConversion($parameter) ?  "${parameterName}Ok" : undef) . ";\n");
+
+        if (TypeCanFailConversion($parameter)) {
+            $implIncludes{"ExceptionCode.h"} = 1;
+            push(@implContentDecls,
+"    if (!$parameterName" . (BasicTypeCanFailConversion($parameter) ? "Ok" : "") . ") {\n" .
+"      V8Proxy::setDOMException(TYPE_MISMATCH_ERR);\n" .
+"      return v8::Handle<v8::Value>();\n" .
+"    }\n");
+        }
+
+        if ($parameter->extendedAttributes->{"IsIndex"}) {
+            $implIncludes{"ExceptionCode.h"} = 1;
+            push(@implContentDecls,
+"    if ($parameterName < 0) {\n" .
+"      V8Proxy::setDOMException(INDEX_SIZE_ERR);\n" .
+"      return v8::Handle<v8::Value>();\n" .
+"    }\n");
+        }
+
+        $paramIndex++;
+    }
+
+    # Build the function call string.
+    my $callString = GenerateFunctionCallString($function, $paramIndex, "    ", $implClassName);
+    push(@implContentDecls, "$callString");
+    push(@implContentDecls, "  }\n\n");
+}
+
+sub GenerateBatchedAttributeData
+{
+    my $interfaceName = shift;
+    my $attributes = shift;
+
+    foreach my $attribute (@$attributes) {
+        my $attrName = $attribute->signature->name;
+        my $attrExt = $attribute->signature->extendedAttributes;
+
+        my $accessControl = "v8::DEFAULT";
+        if ($attrExt->{"DoNotCheckDomainSecurityOnGet"}) {
+            $accessControl = "v8::ALL_CAN_READ";
+        } elsif ($attrExt->{"DoNotCheckDomainSecurityOnSet"}) {
+            $accessControl = "v8::ALL_CAN_WRITE";
+        } elsif ($attrExt->{"DoNotCheckDomainSecurity"}) {
+            $accessControl = "v8::ALL_CAN_READ";
+        if (!($attribute->type =~ /^readonly/) && !($attrExt->{"V8ReadOnly"})) {
+            $accessControl .= "|v8::ALL_CAN_WRITE";
+        }
+    }
+    if ($attrExt->{"V8DisallowShadowing"}) {
+        $accessControl .= "|v8::PROHIBITS_OVERWRITING";
+    }
+    $accessControl = "static_cast<v8::AccessControl>(" . $accessControl . ")";
+
+    my $customAccessor =
+        $attrExt->{"Custom"} ||
+        $attrExt->{"CustomSetter"} ||
+        $attrExt->{"CustomGetter"} ||
+        $attrExt->{"V8Custom"} ||
+        $attrExt->{"V8CustomSetter"} ||
+        $attrExt->{"V8CustomGetter"} ||
+        "";
+    if ($customAccessor eq 1) {
+        # use the naming convension, interface + (capitalize) attr name
+        $customAccessor = $interfaceName . WK_ucfirst($attrName);
+    }
+
+    my $getter;
+    my $setter;
+    my $propAttr = "v8::None";
+    my $hasCustomSetter = 0;
+
+    # Check attributes.
+    if ($attrExt->{"DontEnum"}) {
+        $propAttr .= "|v8::DontEnum";
+    }
+    if ($attrExt->{"V8DisallowShadowing"}) {
+        $propAttr .= "|v8::DontDelete";
+    }
+
+    my $on_proto = "0 /* on instance */";
+    my $data = "V8ClassIndex::INVALID_CLASS_INDEX /* no data */";
+
+    # Constructor
+    if ($attribute->signature->type =~ /Constructor$/) {
+        my $constructorType = $codeGenerator->StripModule($attribute->signature->type);
+        $constructorType =~ s/Constructor$//;
+        my $constructorIndex = uc($constructorType);
+        $data = "V8ClassIndex::${constructorIndex}";
+        $getter = "${interfaceName}Internal::${interfaceName}ConstructorGetter";
+        $setter = "0";
+        $propAttr = "v8::ReadOnly";
+
+    # EventListeners
+    } elsif ($attribute->signature->type eq "EventListener") {
+        if ($interfaceName eq "DOMWindow") {
+            $getter = "V8Custom::v8DOMWindowEventHandlerAccessorGetter";
+            $setter = "V8Custom::v8DOMWindowEventHandlerAccessorSetter";
+        } elsif ($interfaceName eq "Element" || $interfaceName eq "Document" || $interfaceName eq "HTMLBodyElement" || $interfaceName eq "SVGElementInstance" || $interfaceName eq "HTMLFrameSetElement") {
+            $getter = "V8Custom::v8ElementEventHandlerAccessorGetter";
+            $setter = "V8Custom::v8ElementEventHandlerAccessorSetter";
+        } else {
+            $getter = "V8Custom::v8${customAccessor}AccessorGetter";
+            if ($interfaceName eq "WorkerContext" and $attrName eq "self") {
+                $setter = "0";
+                $propAttr = "v8::ReadOnly";
+            } else {
+                $setter = "V8Custom::v8${customAccessor}AccessorSetter";
+            }
+        }
+
+    # Custom Getter and Setter
+    } elsif ($attrExt->{"Custom"} || $attrExt->{"V8Custom"}) {
+        $getter = "V8Custom::v8${customAccessor}AccessorGetter";
+        if ($interfaceName eq "WorkerContext" and $attrName eq "self") {
+            $setter = "0";
+            $propAttr = "v8::ReadOnly";
+        } else {
+            $hasCustomSetter = 1;
+            $setter = "V8Custom::v8${customAccessor}AccessorSetter";
+        }
+
+    # Custom Setter
+    } elsif ($attrExt->{"CustomSetter"} || $attrExt->{"V8CustomSetter"}) {
+        $hasCustomSetter = 1;
+        $getter = "${interfaceName}Internal::${attrName}AttrGetter";
+        $setter = "V8Custom::v8${customAccessor}AccessorSetter";
+
+    # Custom Getter
+    } elsif ($attrExt->{"CustomGetter"}) {
+        $getter = "V8Custom::v8${customAccessor}AccessorGetter";
+        $setter = "${interfaceName}Internal::${attrName}AttrSetter";
+
+    # Replaceable
+    } elsif ($attrExt->{"Replaceable"}) {
+        # Replaceable accessor is put on instance template with ReadOnly attribute.
+        $getter = "${interfaceName}Internal::${attrName}AttrGetter";
+        $setter = "0";
+
+        # Mark to avoid duplicate v8::ReadOnly flags in output.
+        $hasCustomSetter = 1;
+
+        # Handle the special case of window.top being marked upstream as Replaceable.
+        # FIXME: Investigate why [Replaceable] is not marked as ReadOnly
+        # upstream and reach parity.
+        if (!($interfaceName eq "DOMWindow" and $attrName eq "top")) {
+            $propAttr .= "|v8::ReadOnly";
+        }
+
+    # Normal
+    } else {
+        $getter = "${interfaceName}Internal::${attrName}AttrGetter";
+        $setter = "${interfaceName}Internal::${attrName}AttrSetter";
+    }
+
+    if ($attrExt->{"Replaceable"} && !$hasCustomSetter) {
+        $setter = "0";
+        $propAttr .= "|v8::ReadOnly";
+    }
+
+    # Read only attributes
+    if ($attribute->type =~ /^readonly/ || $attrExt->{"V8ReadOnly"}) {
+        $setter = "0";
+    }
+
+    # An accessor can be installed on the proto
+    if ($attrExt->{"v8OnProto"}) {
+        $on_proto = "1 /* on proto */";
+    }
+
+    my $commentInfo = "Attribute '$attrName' (Type: '" . $attribute->type .
+                      "' ExtAttr: '" . join(' ', keys(%{$attrExt})) . "')";
+    push(@implContent, <<END);
+  // $commentInfo
+  { "$attrName",
+    $getter,
+    $setter,
+    $data,
+    $accessControl,
+    static_cast<v8::PropertyAttribute>($propAttr),
+    $on_proto },
+END
+    }
+}
+
+
+sub GenerateImplementation
+{
+    my $object = shift;
+    my $dataNode = shift;
+    my $interfaceName = $dataNode->name;
+    my $className = "V8$interfaceName";
+    my $implClassName = $interfaceName;
+    my $classIndex = uc($codeGenerator->StripModule($interfaceName));
+
+    my $hasLegacyParent = $dataNode->extendedAttributes->{"LegacyParent"};
+    my $conditional = $dataNode->extendedAttributes->{"Conditional"};
+
+    @allParents = $codeGenerator->FindParentsRecursively($dataNode);
+
+    # - Add default header template
+    @implContentHeader = split("\r", $headerTemplate);
+
+    push(@implFixedHeader,
+         "#include \"config.h\"\n" .
+         "#include \"V8Proxy.h\"\n" .
+         "#include \"v8_binding.h\"\n\n" .
+         "#undef LOG\n\n");
+
+    my $conditionalString;
+    if ($conditional) {
+        $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
+        push(@implFixedHeader, "\n#if ${conditionalString}\n\n");
+    }
+
+    if ($className =~ /^V8SVGAnimated/) {
+        AddIncludesForSVGAnimatedType($interfaceName);
+    }
+
+    $implIncludes{"${className}.h"} = 1;
+
+    AddIncludesForType($interfaceName);
+    $implIncludes{"V8Proxy.h"} = 1;
+
+    push(@implContentDecls, "namespace WebCore {\n");
+    push(@implContentDecls, "namespace ${interfaceName}Internal {\n\n");
+    push(@implContentDecls, "template <typename T> void V8_USE(T) { }\n\n");
+
+    my $hasConstructors = 0;
+
+    # Generate property accessors for attributes.
+    for ($index = 0; $index < @{$dataNode->attributes}; $index++) {
+        $attribute = @{$dataNode->attributes}[$index];
+        $attrName = $attribute->signature->name;
+        $attrType = $attribute->signature->type;
+
+        # Generate special code for the constructor attributes.
+        if ($attrType =~ /Constructor$/) {
+            $hasConstructors = 1;
+            next;
+        }
+
+        # Make EventListeners always custom.
+        # FIXME: make the perl code capable of generating the
+        #   event setters/getters.  For now, WebKit has started removing the
+        #   [Custom] attribute, so just automatically insert it to avoid forking
+        #   other files.  This should be okay because we can't generate stubs
+        #   for any event getter/setters anyway.
+        if ($attrType eq "EventListener") {
+            $attribute->signature->extendedAttributes->{"Custom"} = 1;
+            $implIncludes{"V8CustomBinding.h"} = 1;
+            next;
+        }
+
+        # Do not generate accessor if this is a custom attribute.  The
+        # call will be forwarded to a hand-written accessor
+        # implementation.
+        if ($attribute->signature->extendedAttributes->{"Custom"} ||
+            $attribute->signature->extendedAttributes->{"V8Custom"}) {
+            $implIncludes{"V8CustomBinding.h"} = 1;
+            next;
+        }
+
+        # Generate the accessor.
+        if ($attribute->signature->extendedAttributes->{"CustomGetter"}) {
+            $implIncludes{"V8CustomBinding.h"} = 1;
+        } else {
+            GenerateNormalAttrGetter($attribute, $dataNode, $classIndex, $implClassName);
+        }
+        if ($attribute->signature->extendedAttributes->{"CustomSetter"} ||
+            $attribute->signature->extendedAttributes->{"V8CustomSetter"}) {
+            $implIncludes{"V8CustomBinding.h"} = 1;
+        } elsif ($attribute->signature->extendedAttributes->{"Replaceable"}) {
+            $dataNode->extendedAttributes->{"ExtendsDOMGlobalObject"} || die "Replaceable attribute can only be used in interface that defines ExtendsDOMGlobalObject attribute!";
+            # GenerateReplaceableAttrSetter($implClassName);
+        } elsif ($attribute->type !~ /^readonly/ && !$attribute->signature->extendedAttributes->{"V8ReadOnly"}) {
+            GenerateNormalAttrSetter($attribute, $dataNode, $classIndex, $implClassName);
+        }
+    }
+
+    if ($hasConstructors) {
+        GenerateConstructorGetter($implClassName, $classIndex);
+    }
+
+    # Generate methods for functions.
+    foreach my $function (@{$dataNode->functions}) {
+        # hack for addEventListener/RemoveEventListener
+        # FIXME: avoid naming conflict
+        if ($function->signature->extendedAttributes->{"Custom"} || $function->signature->extendedAttributes->{"V8Custom"}) {
+                $implIncludes{"V8CustomBinding.h"} = 1;
+        } else {
+            GenerateFunctionCallback($function, $dataNode, $classIndex, $implClassName);
+        }
+
+        # If the function does not need domain security check, we need to
+        # generate an access getter that returns different function objects
+        # for different calling context.
+        if (($dataNode->extendedAttributes->{"CheckDomainSecurity"} || ($interfaceName eq "DOMWindow")) && $function->signature->extendedAttributes->{"DoNotCheckDomainSecurity"}) {
+            GenerateDomainSafeFunctionGetter($function, $dataNode, $classIndex, $implClassName);
+        }
+    }
+
+    # Attributes
+    my $attributes = $dataNode->attributes;
+
+    # For the DOMWindow interface we partition the attributes into the
+    # ones that disallows shadowing and the rest.
+    my @disallows_shadowing;
+    my @normal;
+    if ($interfaceName eq "DOMWindow") {
+        foreach my $attribute (@$attributes) {
+            if ($attribute->signature->extendedAttributes->{"V8DisallowShadowing"}) {
+                push(@disallows_shadowing, $attribute);
+            } else {
+                push(@normal, $attribute);
+            }
+        }
+        # Put the attributes that disallow shadowing on the shadow object.
+        $attributes = \@normal;
+        push(@implContent, "static const BatchedAttribute shadow_attrs[] = {\n");
+        GenerateBatchedAttributeData($interfaceName, \@disallows_shadowing);
+        push(@implContent, "};\n");
+    }
+
+    my $has_attributes = 0;
+    if (@$attributes) {
+        $has_attributes = 1;
+        push(@implContent, "static const BatchedAttribute attrs[] = {\n");
+        GenerateBatchedAttributeData($interfaceName, $attributes);
+        push(@implContent, "};\n");
+    }
+
+    # Setup constants
+    my $has_constants = 0;
+    if (@{$dataNode->constants}) {
+        $has_constants = 1;
+        push(@implContent, "static const BatchedConstant consts[] = {\n");
+    }
+    foreach my $constant (@{$dataNode->constants}) {
+        my $name = $constant->name;
+        my $value = $constant->value;
+        # FIXME: we need the static_cast here only because of one constant, NodeFilter.idl
+        # defines "const unsigned long SHOW_ALL = 0xFFFFFFFF".  It would be better if we
+        # handled this here, and converted it to a -1 constant in the c++ output.
+        push(@implContent, <<END);
+  { "${name}", static_cast<signed int>($value) },
+END
+    }
+    if ($has_constants) {
+        push(@implContent, "};\n");
+    }
+
+    push(@implContentDecls, "} // namespace ${interfaceName}Internal\n\n");
+
+    my $access_check = "/* no access check */";
+    if ($dataNode->extendedAttributes->{"CheckDomainSecurity"} && !($interfaceName eq "DOMWindow")) {
+        $access_check = "instance->SetAccessCheckCallbacks(V8Custom::v8${interfaceName}NamedSecurityCheck, V8Custom::v8${interfaceName}IndexedSecurityCheck, v8::Integer::New(V8ClassIndex::ToInt(V8ClassIndex::${classIndex})));";
+    }
+
+    # For the DOMWindow interface, generate the shadow object template
+    # configuration method.
+    if ($implClassName eq "DOMWindow") {
+        push(@implContent, <<END);
+static v8::Persistent<v8::ObjectTemplate> ConfigureShadowObjectTemplate(v8::Persistent<v8::ObjectTemplate> templ) {
+  batchConfigureAttributes(templ,
+                           v8::Handle<v8::ObjectTemplate>(),
+                           shadow_attrs,
+                           sizeof(shadow_attrs)/sizeof(*shadow_attrs));
+  return templ;
+}
+END
+    }
+
+    # Generate the template configuration method
+    push(@implContent,  <<END);
+static v8::Persistent<v8::FunctionTemplate> Configure${className}Template(v8::Persistent<v8::FunctionTemplate> desc) {
+  v8::Local<v8::ObjectTemplate> instance = desc->InstanceTemplate();
+  instance->SetInternalFieldCount(2);
+  v8::Local<v8::Signature> default_signature = v8::Signature::New(desc);
+  v8::Local<v8::ObjectTemplate> proto = desc->PrototypeTemplate();
+  $access_check
+END
+
+
+    # Set up our attributes if we have them
+    if ($has_attributes) {
+        push(@implContent, <<END);
+  batchConfigureAttributes(instance, proto, attrs, sizeof(attrs)/sizeof(*attrs));
+END
+    }
+
+    # Define our functions with Set() or SetAccessor()
+    foreach my $function (@{$dataNode->functions}) {
+        my $attrExt = $function->signature->extendedAttributes;
+        my $name = $function->signature->name;
+
+        my $property_attributes = "v8::DontDelete";
+        if ($attrExt->{"DontEnum"}) {
+            $property_attributes .= "|v8::DontEnum";
+        }
+        if ($attrExt->{"V8ReadOnly"}) {
+            $property_attributes .= "|v8::ReadOnly";
+        }
+
+        my $commentInfo = "Function '$name' (ExtAttr: '" . join(' ', keys(%{$attrExt})) . "')";
+
+        my $template = "proto";
+        if ($attrExt->{"V8OnInstance"}) {
+            $template = "instance";
+        }
+
+        if ($attrExt->{"DoNotCheckDomainSecurity"} &&
+            ($dataNode->extendedAttributes->{"CheckDomainSecurity"} || $interfaceName eq "DOMWindow")) {
+            # Mark the accessor as ReadOnly and set it on the proto object so
+            # it can be shadowed. This is really a hack to make it work.
+            # There are several sceneria to call into the accessor:
+            #   1) from the same domain: "window.open":
+            #      the accessor finds the DOM wrapper in the proto chain;
+            #   2) from the same domain: "window.__proto__.open":
+            #      the accessor will NOT find a DOM wrapper in the prototype chain
+            #   3) from another domain: "window.open":
+            #      the access find the DOM wrapper in the prototype chain
+            #   "window.__proto__.open" from another domain will fail when
+            #   accessing '__proto__'
+            #
+            # The solution is very hacky and fragile, it really needs to be replaced
+            # by a better solution.
+            $property_attributes .= "|v8::ReadOnly";
+            push(@implContent, <<END);
+
+  // $commentInfo
+  $template->SetAccessor(
+      v8::String::New("$name"),
+      ${interfaceName}Internal::${name}AttrGetter,
+      0,
+      v8::Handle<v8::Value>(),
+      v8::ALL_CAN_READ,
+      static_cast<v8::PropertyAttribute>($property_attributes));
+END
+          next;
+      }
+
+      my $signature = "default_signature";
+      if ($attrExt->{"V8DoNotCheckSignature"}){
+          $signature = "v8::Local<v8::Signature>()";
+      }
+
+      if (RequiresCustomSignature($function)) {
+          $signature = "${name}_signature";
+          push(@implContent, "\n  // Custom Signature '$name'\n", CreateCustomSignature($function));
+      }
+
+      # Normal function call is a template
+      my $templateFunction = GenerateNewFunctionTemplate($function, $dataNode, $signature);
+
+
+      push(@implContent, <<END);
+
+  // $commentInfo
+  ${template}->Set(
+      v8::String::New("$name"),
+      $templateFunction,
+      static_cast<v8::PropertyAttribute>($property_attributes));
+END
+    }
+
+    # set the super descriptor
+    foreach (@{$dataNode->parents}) {
+        my $parent = $codeGenerator->StripModule($_);
+        if ($parent eq "EventTarget") { next; }
+        $implIncludes{"V8${parent}.h"} = 1;
+        my $parentClassIndex = uc($codeGenerator->StripModule($parent));
+        push(@implContent, "  desc->Inherit(V8Proxy::getTemplate(V8ClassIndex::${parentClassIndex}));\n");
+        last;
+    }
+
+    # Set the class name.  This is used when printing objects.
+    push(@implContent, "  desc->SetClassName(v8::String::New(\"" . GetClassName(${interfaceName}) . "\"));\n");
+
+    if ($has_constants) {
+        push(@implContent, <<END);
+  batchConfigureConstants(desc, proto, consts, sizeof(consts)/sizeof(*consts));
+END
+    }
+
+    push(@implContent, <<END);
+  return desc;
+}
+
+v8::Persistent<v8::FunctionTemplate> ${className}::GetRawTemplate() {
+  static v8::Persistent<v8::FunctionTemplate> ${className}_raw_cache_;
+  if (${className}_raw_cache_.IsEmpty()) {
+    v8::HandleScope scope;
+    v8::Local<v8::FunctionTemplate> result = v8::FunctionTemplate::New(V8Proxy::checkNewLegal);
+    ${className}_raw_cache_ = v8::Persistent<v8::FunctionTemplate>::New(result);
+  }
+  return ${className}_raw_cache_;
+}
+
+v8::Persistent<v8::FunctionTemplate> ${className}::GetTemplate() {
+  static v8::Persistent<v8::FunctionTemplate> ${className}_cache_;
+  if (${className}_cache_.IsEmpty())
+    ${className}_cache_ = Configure${className}Template(GetRawTemplate());
+  return ${className}_cache_;
+}
+
+bool ${className}::HasInstance(v8::Handle<v8::Value> value) {
+  return GetRawTemplate()->HasInstance(value);
+}
+
+END
+
+    if ($implClassName eq "DOMWindow") {
+        push(@implContent, <<END);
+v8::Persistent<v8::ObjectTemplate> V8DOMWindow::GetShadowObjectTemplate() {
+  static v8::Persistent<v8::ObjectTemplate> V8DOMWindowShadowObject_cache_;
+  if (V8DOMWindowShadowObject_cache_.IsEmpty()) {
+    V8DOMWindowShadowObject_cache_ = v8::Persistent<v8::ObjectTemplate>::New(v8::ObjectTemplate::New());
+    ConfigureShadowObjectTemplate(V8DOMWindowShadowObject_cache_);
+  }
+  return V8DOMWindowShadowObject_cache_;
+}
+END
+    }
+
+    push(@implContent, <<END);
+} // namespace WebCore
+END
+
+    push(@implContent, "\n#endif // ${conditionalString}\n") if $conditional;
+}
+
+
+sub GenerateFunctionCallString()
+{
+    my $function = shift;
+    my $numberOfParameters = shift;
+    my $indent = shift;
+    my $implClassName = shift;
+
+    my $name = $function->signature->name;
+    my $isPodType = IsPodType($implClassName);
+    my $returnType = $codeGenerator->StripModule($function->signature->type);
+    my $returnsPodType = IsPodType($returnType);
+    my $nativeReturnType = GetNativeType($returnType, 0);
+    my $result = "";
+
+    # Special case: SVG matrix transform methods should not mutate
+    # the matrix but return a copy
+    my $copyFirst = 0;
+    if ($implClassName eq "SVGMatrix" && $function->signature->type eq "SVGMatrix") {
+        $copyFirst = 1;
+    }
+
+    if ($function->signature->extendedAttributes->{"v8implname"}) {
+        $name = $function->signature->extendedAttributes->{"v8implname"};
+    }
+
+    if ($function->signature->extendedAttributes->{"ImplementationFunction"}) {
+        $name = $function->signature->extendedAttributes->{"ImplementationFunction"};
+    }
+
+    my $functionString = "imp->${name}(";
+
+    if ($copyFirst) {
+        $functionString = "result.${name}(";
+    }
+
+    my $returnsListItemPodType = 0;
+    # SVG lists functions that return POD types require special handling
+    if (IsSVGListTypeNeedingSpecialHandling($implClassName) && IsSVGListMethod($name) && $returnsPodType) {
+        $returnsListItemPodType = 1;
+        $result .= $indent . "SVGList<RefPtr<SVGPODListItem<$nativeReturnType> > >* listImp = imp;\n";
+        $functionString = "listImp->${name}(";
+    }
+
+    my $first = 1;
+    my $index = 0;
+    my $nodeToReturn = 0;
+
+    foreach my $parameter (@{$function->parameters}) {
+        if ($index eq $numberOfParameters) {
+            last;
+        }
+        if ($first) { $first = 0; }
+        else { $functionString .= ", "; }
+        my $paramName = $parameter->name;
+        my $paramType = $parameter->type;
+
+        # This is a bit of a hack... we need to convert parameters to methods on SVG lists
+        # of POD types which are items in the list to appropriate SVGList<> instances
+        if ($returnsListItemPodType && $paramType . "List" eq $implClassName) {
+            $paramName = "SVGPODListItem<" . GetNativeType($paramType, 1) . ">::copy($paramName)";
+        }
+
+        if ($parameter->type eq "NodeFilter") {
+            $functionString .= "$paramName.get()";
+        } else {
+            $functionString .= $paramName;
+        }
+
+        if ($parameter->extendedAttributes->{"Return"}) {
+            $nodeToReturn = $parameter->name;
+        }
+        $index++;
+    }
+
+    if ($function->signature->extendedAttributes->{"CustomArgumentHandling"}) {
+        $functionString .= ", " if not $first;
+        $functionString .= "&callStack";
+        if ($first) { $first = 0; }
+    }
+
+    if (@{$function->raisesExceptions}) {
+        $functionString .= ", " if not $first;
+        $functionString .= "ec";
+    }
+    $functionString .= ")";
+
+    if ((IsRefPtrType($returnType) || $returnsListItemPodType) && !$nodeToReturn) {
+        # We don't use getPtr when $nodeToReturn because that situation is
+        # special-cased below to return a bool.
+        $implIncludes{"wtf/GetPtr.h"} = 1;
+        $functionString = "WTF::getPtr(" . $functionString . ")";
+    }
+
+    if ($nodeToReturn) {
+        # Special case for insertBefore, replaceChild, removeChild and
+        # appendChild functions from Node.
+        $result .= $indent . "bool success = $functionString;\n";
+        if (@{$function->raisesExceptions}) {
+            $result .= GenerateSetDOMException($indent);
+        }
+        $result .= $indent . "if (success)\n";
+        $result .= $indent . "    " .
+            "return V8Proxy::convertNodeToV8Object($nodeToReturn);\n";
+        $result .= $indent . "return v8::Null();\n";
+        return $result;
+    } elsif ($returnType eq "void") {
+        $result .= $indent . "$functionString;\n";
+    } elsif ($copyFirst) {
+        $result .=
+            $indent . GetNativeType($returnType, 0) . " result = *imp;\n" .
+            $indent . "$functionString;\n";
+    } elsif ($returnsListItemPodType) {
+        $result .= $indent . "RefPtr<SVGPODListItem<$nativeReturnType> > result = $functionString;\n";
+    } else {
+        $result .= $indent . $nativeReturnType . " result = $functionString;\n";
+    }
+
+    if (@{$function->raisesExceptions}) {
+        $result .= GenerateSetDOMException($indent);
+    }
+
+    my $return = "result";
+    if (IsRefPtrType($returnType) || $returnsListItemPodType) {
+        $implIncludes{"wtf/GetPtr.h"} = 1;
+        $return = "WTF::getPtr(" . $return . ")";
+    }
+
+    # If the return type is a POD type, separate out the wrapper generation
+    if ($returnsListItemPodType) {
+        $result .= $indent . "V8SVGPODTypeWrapper<" . $nativeReturnType . ">* wrapper = new ";
+        $result .= "V8SVGPODTypeWrapperCreatorForList<" . $nativeReturnType . ">($return, imp->associatedAttributeName());\n";
+        $return = "wrapper";
+    } elsif ($returnsPodType) {
+        $result .= $indent . "V8SVGPODTypeWrapper<" . $nativeReturnType . ">* wrapper = ";
+        $result .= GenerateSVGStaticPodTypeWrapper($returnType, $return) . ";\n";
+        $return = "wrapper";
+    }
+
+    my $generatedSVGContextRetrieval = 0;
+    # If the return type needs an SVG context, output it
+    if (IsSVGTypeNeedingContextParameter($returnType)) {
+        $result .= GenerateSVGContextAssignment($implClassName, $return, $indent);
+        $generatedSVGContextRetrieval = 1;
+    }
+
+    if (IsSVGTypeNeedingContextParameter($implClassName) && $implClassName =~ /List$/ && IsSVGListMutator($name)) {
+        if (!$generatedSVGContextRetrieval) {
+            $result .= GenerateSVGContextRetrieval($implClassName, $indent);
+            $generatedSVGContextRetrieval = 1;
+        }
+
+        $result .= $indent . "context->svgAttributeChanged(imp->associatedAttributeName());\n";
+        $implIncludes{"SVGElement.h"} = 1;
+    }
+
+    # If the implementing class is a POD type, commit changes
+    if ($isPodType) {
+        if (!$generatedSVGContextRetrieval) {
+            $result .= GenerateSVGContextRetrieval($implClassName, $indent);
+            $generatedSVGContextRetrieval = 1;
+        }
+
+        $result .= $indent . "imp_wrapper->commitChange(imp_instance, context);\n";
+    }
+
+    if ($returnsPodType) {
+        my $classIndex = uc($returnType);
+        $result .= $indent . "return V8Proxy::convertToV8Object(V8ClassIndex::$classIndex, wrapper);\n";
+    } else {
+        $result .= $indent . "return " . NativeToJSValue($function->signature, $return) . ";\n";
+    }
+
+    return $result;
+}
+
+
+# Get the class name used for printing javascript DOM-object wrappers.
+sub GetClassName
+{
+    my $type = shift;
+    return "HTMLCollection" if $type eq "UndetectableHTMLCollection";
+    return $type;
+}
+
+
+sub GetNativeTypeFromSignature
+{
+    my $signature = shift;
+    my $isParameter = shift;
+
+    my $type = $codeGenerator->StripModule($signature->type);
+
+    return GetNativeType($type, $isParameter);
+}
+
+sub IsRefPtrType
+{
+    my $type = shift;
+    return 1 if $type eq "Attr";
+    return 1 if $type eq "CanvasGradient";
+    return 1 if $type eq "ClientRect";
+    return 1 if $type eq "ClientRectList";
+    return 1 if $type eq "CDATASection";
+    return 1 if $type eq "Comment";
+    return 1 if $type eq "CSSRule";
+    return 1 if $type eq "CSSStyleRule";
+    return 1 if $type eq "CSSCharsetRule";
+    return 1 if $type eq "CSSImportRule";
+    return 1 if $type eq "CSSMediaRule";
+    return 1 if $type eq "CSSFontFaceRule";
+    return 1 if $type eq "CSSPageRule";
+    return 1 if $type eq "CSSPrimitiveValue";
+    return 1 if $type eq "CSSStyleSheet";
+    return 1 if $type eq "CSSStyleDeclaration";
+    return 1 if $type eq "CSSValue";
+    return 1 if $type eq "CSSRuleList";
+    return 1 if $type eq "Database";
+    return 1 if $type eq "Document";
+    return 1 if $type eq "DocumentFragment";
+    return 1 if $type eq "DocumentType";
+    return 1 if $type eq "Element";
+    return 1 if $type eq "EntityReference";
+    return 1 if $type eq "Event";
+    return 1 if $type eq "FileList";
+    return 1 if $type eq "HTMLCollection";
+    return 1 if $type eq "HTMLDocument";
+    return 1 if $type eq "HTMLElement";
+    return 1 if $type eq "HTMLOptionsCollection";
+    return 1 if $type eq "ImageData";
+    return 1 if $type eq "MediaError";
+    return 1 if $type eq "MimeType";
+    return 1 if $type eq "Node";
+    return 1 if $type eq "NodeList";
+    return 1 if $type eq "NodeFilter";
+    return 1 if $type eq "NodeIterator";
+    return 1 if $type eq "NSResolver";
+    return 1 if $type eq "Plugin";
+    return 1 if $type eq "ProcessingInstruction";
+    return 1 if $type eq "Range";
+    return 1 if $type eq "Text";
+    return 1 if $type eq "TextMetrics";
+    return 1 if $type eq "TimeRanges";
+    return 1 if $type eq "TreeWalker";
+    return 1 if $type eq "WebKitCSSMatrix";
+    return 1 if $type eq "WebKitPoint";
+    return 1 if $type eq "XPathExpression";
+    return 1 if $type eq "XPathNSResolver";
+    return 1 if $type eq "XPathResult";
+
+    return 1 if $type eq "SVGAngle";
+    return 1 if $type eq "SVGElementInstance";
+    return 1 if $type eq "SVGElementInstanceList";
+    return 1 if $type =~ /^SVGPathSeg/;
+
+    return 1 if $type =~ /^SVGAnimated/;
+
+    return 0;
+}
+
+sub IsVideoClassName
+{
+    my $class = shift;
+    return 1 if $class eq "V8HTMLAudioElement";
+    return 1 if $class eq "V8HTMLMediaElement";
+    return 1 if $class eq "V8HTMLSourceElement";
+    return 1 if $class eq "V8HTMLVideoElement";
+    return 1 if $class eq "V8MediaError";
+    return 1 if $class eq "V8TimeRanges";
+
+    return 0;
+}
+
+sub IsWorkerClassName
+{
+    my $class = shift;
+    return 1 if $class eq "V8Worker";
+    return 1 if $class eq "V8WorkerContext";
+    return 1 if $class eq "V8WorkerLocation";
+    return 1 if $class eq "V8WorkerNavigator";
+
+    return 0;
+}
+
+sub GetNativeType
+{
+    my $type = shift;
+    my $isParameter = shift;
+
+    if ($type eq "float" or $type eq "AtomicString" or $type eq "double") {
+        return $type;
+    }
+
+    return "int" if $type eq "int";
+    return "int" if $type eq "short" or $type eq "unsigned short";
+    return "int" if $type eq "long" or $type eq "unsigned long";
+    return "unsigned long long" if $type eq "unsigned long long";
+    return "bool" if $type eq "boolean";
+    return "String" if $type eq "DOMString";
+    return "Range::CompareHow" if $type eq "CompareHow";
+    return "FloatRect" if $type eq "SVGRect";
+    return "FloatPoint" if $type eq "SVGPoint";
+    return "TransformationMatrix" if $type eq "SVGMatrix";
+    return "SVGTransform" if $type eq "SVGTransform";
+    return "SVGLength" if $type eq "SVGLength";
+    return "double" if $type eq "SVGNumber";
+    return "SVGPaint::SVGPaintType" if $type eq "SVGPaintType";
+    return "DOMTimeStamp" if $type eq "DOMTimeStamp";
+    return "unsigned" if $type eq "unsigned int";
+    return "unsigned" if $type eq "RGBColor";
+    return "Node*" if $type eq "EventTarget" and $isParameter;
+
+    return "String" if $type eq "DOMUserData";  # FIXME: Temporary hack?
+
+    # temporary hack
+    return "RefPtr<NodeFilter>" if $type eq "NodeFilter";
+
+    return "RefPtr<${type}>" if IsRefPtrType($type) and not $isParameter;
+
+    # Default, assume native type is a pointer with same type name as idl type
+    return "${type}*";
+}
+
+
+my %typeCanFailConversion = (
+    "AtomicString" => 0,
+    "Attr" => 1,
+    "CompareHow" => 0,
+    "DataGridColumn" => 0,
+    "DOMString" => 0,
+    "DOMWindow" => 0,
+    "DocumentType" => 0,
+    "Element" => 0,
+    "Event" => 0,
+    "EventListener" => 0,
+    "EventTarget" => 0,
+    "HTMLElement" => 0,
+    "HTMLOptionElement" => 0,
+    "Node" => 0,
+    "NodeFilter" => 0,
+    "MessagePort" => 0,
+    "NSResolver" => 0,
+    "Range" => 0,
+    "SQLResultSet" => 0,
+    "Storage" => 0,
+    "SVGAngle" => 0,
+    "SVGElement" => 0,
+    "SVGLength" => 1,
+    "SVGMatrix" => 1,
+    "SVGNumber" => 0,
+    "SVGPaintType" => 0,
+    "SVGPathSeg" => 0,
+    "SVGPoint" => 1,
+    "SVGRect" => 1,
+    "SVGTransform" => 1,
+    "VoidCallback" => 1,
+    "WebKitCSSMatrix" => 0,
+    "WebKitPoint" => 0,
+    "XPathEvaluator" => 0,
+    "XPathNSResolver" => 0,
+    "XPathResult" => 0,
+    "boolean" => 0,
+    "double" => 0,
+    "float" => 0,
+    "long" => 0,
+    "unsigned long" => 0,
+    "unsigned short" => 0,
+);
+
+
+sub TranslateParameter
+{
+    my $signature = shift;
+
+    # The IDL uses some pseudo-types which don't really exist.
+    if ($signature->type eq "TimeoutHandler") {
+      $signature->type("DOMString");
+    }
+}
+
+sub BasicTypeCanFailConversion
+{
+    my $signature = shift;
+    my $type = $codeGenerator->StripModule($signature->type);
+
+    return 1 if $type eq "SVGLength";
+    return 1 if $type eq "SVGMatrix";
+    return 1 if $type eq "SVGPoint";
+    return 1 if $type eq "SVGRect";
+    return 1 if $type eq "SVGTransform";
+    return 0;
+}
+
+sub TypeCanFailConversion
+{
+    my $signature = shift;
+
+    my $type = $codeGenerator->StripModule($signature->type);
+
+    $implIncludes{"ExceptionCode.h"} = 1 if $type eq "Attr";
+
+    return $typeCanFailConversion{$type} if exists $typeCanFailConversion{$type};
+
+    die "Don't know whether a JS value can fail conversion to type $type.";
+}
+
+sub JSValueToNative
+{
+    my $signature = shift;
+    my $value = shift;
+    my $okParam = shift;
+    my $maybeOkParam = $okParam ? ", ${okParam}" : "";
+
+    my $type = $codeGenerator->StripModule($signature->type);
+
+    return "$value" if $type eq "JSObject";
+    return "$value->BooleanValue()" if $type eq "boolean";
+    return "static_cast<$type>($value->NumberValue())" if $type eq "float" or $type eq "double";
+    return "$value->NumberValue()" if $type eq "SVGNumber";
+
+    return "ToInt32($value${maybeOkParam})" if $type eq "unsigned long" or $type eq "unsigned short" or $type eq "long";
+    return "static_cast<Range::CompareHow>($value->Int32Value())" if $type eq "CompareHow";
+    return "static_cast<SVGPaint::SVGPaintType>($value->ToInt32()->Int32Value())" if $type eq "SVGPaintType";
+
+    return "ToWebCoreString($value)" if $type eq "AtomicString" or $type eq "DOMUserData";
+    if ($type eq "DOMString") {
+        return "valueToStringWithNullCheck($value)" if $signature->extendedAttributes->{"ConvertNullToNullString"};
+        return "valueToStringWithNullOrUndefinedCheck($value)" if $signature->extendedAttributes->{"ConvertUndefinedOrNullToNullString"};
+        return "ToWebCoreString($value)";
+    }
+
+    if ($type eq "NodeFilter") {
+        return "V8Proxy::wrapNativeNodeFilter($value)";
+    }
+
+    if ($type eq "SVGRect") {
+        $implIncludes{"FloatRect.h"} = 1;
+    }
+
+    if ($type eq "SVGPoint") {
+        $implIncludes{"FloatPoint.h"} = 1;
+    }
+
+    # Default, assume autogenerated type conversion routines
+    $implIncludes{"V8Proxy.h"} = 1;
+    if ($type eq "EventTarget") {
+        $implIncludes{"V8Node.h"} = 1;
+
+        # EventTarget is not in DOM hierarchy, but all Nodes are EventTarget.
+        return "V8Node::HasInstance($value) ? V8Proxy::convertDOMWrapperToNode<Node>($value) : 0";
+    }
+
+    AddIncludesForType($type);
+    # $implIncludes{"$type.h"} = 1 unless AvoidInclusionOfType($type);
+
+    if (IsDOMNodeType($type)) {
+        $implIncludes{"V8${type}.h"} = 1;
+
+        # Perform type checks on the parameter, if it is expected Node type,
+        # return NULL.
+        return "V8${type}::HasInstance($value) ? V8Proxy::convertDOMWrapperToNode<${type}>($value) : 0";
+    } else {
+        # TODO: Temporary to avoid Window name conflict.
+        my $classIndex = uc($type);
+        my $implClassName = ${type};
+
+        $implIncludes{"V8$type.h"} = 1;
+
+        if (IsPodType($type)) {
+            my $nativeType = GetNativeType($type);
+            $implIncludes{"V8SVGPODTypeWrapper.h"} = 1;
+
+            return "V8SVGPODTypeUtil::ToSVGPODType<${nativeType}>(V8ClassIndex::${classIndex}, $value${maybeOkParam})"
+        }
+
+        $implIncludes{"V8${type}.h"} = 1;
+
+        # Perform type checks on the parameter, if it is expected Node type,
+        # return NULL.
+        return "V8${type}::HasInstance($value) ? V8Proxy::convertToNativeObject<${implClassName}>(V8ClassIndex::${classIndex}, $value) : 0";
+    }
+}
+
+
+sub GetV8HeaderName
+{
+    my $type = shift;
+    return "V8" . GetImplementationFileName($type);
+}
+
+
+sub CreateCustomSignature
+{
+    my $function = shift;
+    my $count = @{$function->parameters};
+    my $name = $function->signature->name;
+    my $result = "  const int ${name}_argc = ${count};\n" .
+      "  v8::Handle<v8::FunctionTemplate> ${name}_argv[${name}_argc] = { ";
+    my $first = 1;
+    foreach my $parameter (@{$function->parameters}) {
+        if ($first) { $first = 0; }
+        else { $result .= ", "; }
+        if (IsWrapperType($parameter->type)) {
+            my $type = $parameter->type;
+            my $header = GetV8HeaderName($type);
+            $implIncludes{$header} = 1;
+            $result .= "V8${type}::GetRawTemplate()";
+        } else {
+            $result .= "v8::Handle<v8::FunctionTemplate>()";
+        }
+    }
+    $result .= " };\n";
+    $result .= "  v8::Handle<v8::Signature> ${name}_signature = v8::Signature::New(desc, ${name}_argc, ${name}_argv);\n";
+    return $result;
+}
+
+
+sub RequiresCustomSignature
+{
+    my $function = shift;
+    # No signature needed for Custom function
+    if ($function->signature->extendedAttributes->{"Custom"} ||
+        $function->signature->extendedAttributes->{"V8Custom"}) {
+        return 0;
+    }
+
+    foreach my $parameter (@{$function->parameters}) {
+      if (IsWrapperType($parameter->type)) {
+          return 1;
+      }
+    }
+    return 0;
+}
+
+
+my %non_wrapper_types = (
+    'float' => 1,
+    'AtomicString' => 1,
+    'double' => 1,
+    'short' => 1,
+    'unsigned short' => 1,
+    'long' => 1,
+    'unsigned long' => 1,
+    'boolean' => 1,
+    'DOMString' => 1,
+    'CompareHow' => 1,
+    'SVGRect' => 1,
+    'SVGPoint' => 1,
+    'SVGMatrix' => 1,
+    'SVGTransform' => 1,
+    'SVGLength' => 1,
+    'SVGNumber' => 1,
+    'SVGPaintType' => 1,
+    'DOMTimeStamp' => 1,
+    'JSObject' => 1,
+    'EventTarget' => 1,
+    'NodeFilter' => 1,
+    'EventListener' => 1
+);
+
+
+sub IsWrapperType
+{
+    my $type = $codeGenerator->StripModule(shift);
+    return !($non_wrapper_types{$type});
+}
+
+sub IsDOMNodeType
+{
+    my $type = shift;
+
+    return 1 if $type eq 'Attr';
+    return 1 if $type eq 'CDATASection';
+    return 1 if $type eq 'Comment';
+    return 1 if $type eq 'Document';
+    return 1 if $type eq 'DocumentFragment';
+    return 1 if $type eq 'DocumentType';
+    return 1 if $type eq 'Element';
+    return 1 if $type eq 'EntityReference';
+    return 1 if $type eq 'HTMLCanvasElement';
+    return 1 if $type eq 'HTMLDocument';
+    return 1 if $type eq 'HTMLElement';
+    return 1 if $type eq 'HTMLFormElement';
+    return 1 if $type eq 'HTMLTableCaptionElement';
+    return 1 if $type eq 'HTMLTableSectionElement';
+    return 1 if $type eq 'Node';
+    return 1 if $type eq 'ProcessingInstruction';
+    return 1 if $type eq 'SVGElement';
+    return 1 if $type eq 'SVGDocument';
+    return 1 if $type eq 'SVGSVGElement';
+    return 1 if $type eq 'SVGUseElement';
+    return 1 if $type eq 'Text';
+
+    return 0;
+}
+
+
+sub NativeToJSValue
+{
+    my $signature = shift;
+    my $value = shift;
+    my $type = $codeGenerator->StripModule($signature->type);
+    my $className= "V8$type";
+
+    return "v8::Date::New(static_cast<double>($value))" if $type eq "DOMTimeStamp";
+    return "$value ? v8::True() : v8::False()" if $type eq "boolean";
+    return "v8::Undefined()" if $type eq "void";
+
+    # For all the types where we use 'int' as the representation type,
+    # we use Integer::New which has a fast Smi conversion check.
+    return "v8::Integer::New($value)" if GetNativeType($type) eq "int";
+
+    return "v8::Number::New($value)" if $codeGenerator->IsPrimitiveType($type) or $type eq "SVGPaintType";
+
+    if ($codeGenerator->IsStringType($type)) {
+        my $conv = $signature->extendedAttributes->{"ConvertNullStringTo"};
+        if (defined $conv) {
+            return "v8StringOrNull($value)" if $conv eq "Null";
+            return "v8StringOrUndefined($value)" if $conv eq "Undefined";
+            return "v8StringOrFalse($value)" if $conv eq "False";
+
+            die "Unknown value for ConvertNullStringTo extended attribute";
+        }
+        return "v8String($value)";
+    }
+
+    # V8 specific.
+    my $implClassName = $type;
+    AddIncludesForType($type);
+    # $implIncludes{GetImplementationFileName($type)} = 1 unless AvoidInclusionOfType($type);
+
+    # special case for non-DOM node interfaces
+    if (IsDOMNodeType($type)) {
+        return "V8Proxy::convertNodeToV8Object($value)";
+    }
+
+    if ($type eq "EventTarget" or $type eq "SVGElementInstance") {
+        return "V8Proxy::convertEventTargetToV8Object($value)";
+    }
+
+    if ($type eq "Event") {
+        return "V8Proxy::convertEventToV8Object($value)";
+    }
+
+    if ($type eq "EventListener") {
+        return "V8Proxy::convertEventListenerToV8Object($value)";
+    }
+
+    if ($type eq "RGBColor") {
+        return "V8Proxy::convertToV8Object(V8ClassIndex::RGBCOLOR, new RGBColor($value))";
+    }
+
+    if ($type eq "WorkerContext" or $type eq "WorkerLocation" or $type eq "WorkerNavigator") {
+        $implIncludes{"WorkerContextExecutionProxy.h"} = 1;
+        my $classIndex = uc($type);
+
+        return "WorkerContextExecutionProxy::ToV8Object(V8ClassIndex::$classIndex, $value)";
+    }
+
+    else {
+        $implIncludes{"wtf/RefCounted.h"} = 1;
+        $implIncludes{"wtf/RefPtr.h"} = 1;
+        my $classIndex = uc($type);
+
+        if (IsPodType($type)) {
+            $value = GenerateSVGStaticPodTypeWrapper($type, $value);
+        }
+
+        return "V8Proxy::convertToV8Object(V8ClassIndex::$classIndex, $value)";
+    }
+}
+
+sub GenerateSVGStaticPodTypeWrapper {
+    my $type = shift;
+    my $value = shift;
+
+    $implIncludes{"V8$type.h"}=1;
+    $implIncludes{"V8SVGPODTypeWrapper.h"} = 1;
+
+    my $nativeType = GetNativeType($type);
+    return "new V8SVGStaticPODTypeWrapper<$nativeType>($value)";
+}
+
+# Internal helper
+sub WriteData
+{
+    if (defined($IMPL)) {
+        # Write content to file.
+        print $IMPL @implContentHeader;
+
+        print $IMPL @implFixedHeader;
+
+        foreach my $implInclude (sort keys(%implIncludes)) {
+            my $checkType = $implInclude;
+            $checkType =~ s/\.h//;
+
+            print $IMPL "#include \"$implInclude\"\n" unless $codeGenerator->IsSVGAnimatedType($checkType);
+        }
+
+        print $IMPL "\n";
+        print $IMPL @implContentDecls;
+        print $IMPL @implContent;
+        close($IMPL);
+        undef($IMPL);
+
+        %implIncludes = ();
+        @implFixedHeader = ();
+        @implHeaderContent = ();
+        @implContentDecls = ();
+        @implContent = ();
+    }
+
+    if (defined($HEADER)) {
+        # Write content to file.
+        print $HEADER @headerContent;
+        close($HEADER);
+        undef($HEADER);
+
+        @headerContent = ();
+    }
+}
+
+sub IsSVGTypeNeedingContextParameter
+{
+    my $implClassName = shift;
+
+    if ($implClassName =~ /SVG/ and not $implClassName =~ /Element/) {
+        return 1 unless $implClassName =~ /SVGPaint/ or $implClassName =~ /SVGColor/ or $implClassName =~ /SVGDocument/;
+    }
+
+    return 0;
+}
+
+sub GenerateSVGContextAssignment
+{
+    my $srcType = shift;
+    my $value = shift;
+    my $indent = shift;
+
+    $result = GenerateSVGContextRetrieval($srcType, $indent);
+    $result .=   $indent . "V8Proxy::setSVGContext($value, context);\n";
+
+    return $result;
+}
+
+sub GenerateSVGContextRetrieval
+{
+    my $srcType = shift;
+    my $indent = shift;
+
+    my $srcIsPodType = IsPodType($srcType);
+
+    my $srcObject = "imp";
+    if ($srcIsPodType) {
+        $srcObject = "imp_wrapper";
+    }
+
+    my $contextDecl;
+
+    if (IsSVGTypeNeedingContextParameter($srcType)) {
+        $contextDecl = "V8Proxy::svgContext($srcObject)";
+    } else {
+        $contextDecl = $srcObject;
+    }
+
+    return $indent . "SVGElement* context = $contextDecl;\n";
+}
+
+sub IsSVGListMutator
+{
+    my $functionName = shift;
+
+    return 1 if $functionName eq "clear";
+    return 1 if $functionName eq "initialize";
+    return 1 if $functionName eq "insertItemBefore";
+    return 1 if $functionName eq "replaceItem";
+    return 1 if $functionName eq "removeItem";
+    return 1 if $functionName eq "appendItem";
+
+    return 0;
+}
+
+sub IsSVGListMethod
+{
+    my $functionName = shift;
+
+    return 1 if $functionName eq "getFirst";
+    return 1 if $functionName eq "getLast";
+    return 1 if $functionName eq "getItem";
+
+    return IsSVGListMutator($functionName);
+}
+
+sub IsSVGListTypeNeedingSpecialHandling
+{
+    my $className = shift;
+
+    return 1 if $className eq "SVGPointList";
+    return 1 if $className eq "SVGTransformList";
+
+    return 0;
+}
+
+sub DebugPrint
+{
+    my $output = shift;
+
+    print $output;
+    print "\n";
+}
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/IDLParser.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/IDLParser.pm
index de7cf9c..c4cb041 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/IDLParser.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/IDLParser.pm
@@ -41,6 +41,7 @@ my $preservedParseMode = MODE_UNDEF;
 
 my $beQuiet; # Should not display anything on STDOUT?
 my $document = 0; # Will hold the resulting 'idlDocument'
+my $parentsOnly = 0; # If 1, parse only enough to populate parents list
 
 # Default Constructor
 sub new
@@ -62,6 +63,7 @@ sub Parse
     my $fileName = shift;
     my $defines = shift;
     my $preprocessor = shift;
+    $parentsOnly = shift;
 
     if (!$preprocessor) {
         $preprocessor = "/usr/bin/gcc -E -P -x c++";
@@ -240,6 +242,8 @@ sub ParseInterface
             push(@$arrayRef, $line);
         }
 
+        return if $parentsOnly;
+
         $interfaceData =~ s/[\n\r]/ /g;
         my @interfaceMethods = split(/;/, $interfaceData);
 
diff --git a/src/3rdparty/webkit/WebCore/bindings/scripts/InFilesParser.pm b/src/3rdparty/webkit/WebCore/bindings/scripts/InFilesParser.pm
index 89664ed..c6b3644 100644
--- a/src/3rdparty/webkit/WebCore/bindings/scripts/InFilesParser.pm
+++ b/src/3rdparty/webkit/WebCore/bindings/scripts/InFilesParser.pm
@@ -109,7 +109,12 @@ sub parse($)
             my ($name, $value) = split '=', $_;
 
             $name = trimWS($name);
-            $value = trimQuoteAndWS($value);
+            if (defined($value)) {
+                $value = trimQuoteAndWS($value);
+            } else {
+                # We default to 1 as it eases the syntax.
+                $value = "1";
+            }
 
             &$commonParameterHandler($name, $value);
         } else {
@@ -125,7 +130,12 @@ sub parse($)
                 for (my $i = 0; $i < @options; ++$i) {
                     ($option, $value) = split "=", $options[$i];
                     $option = trimWS($option);
-                    $value = trimQuoteAndWS($value);
+                    if (defined($value)) {
+                        $value = trimQuoteAndWS($value);
+                    } else {
+                        # We default to 1 as it eases the syntax.
+                        $value = "1";
+                    }
 
                     &$perTagHandler($elementName, $option, $value);
                 }
diff --git a/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.cpp b/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.cpp
new file mode 100644
index 0000000..11560e3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.cpp
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "IdentifierRep.h"
+
+#include "PlatformString.h"
+#include <runtime/UString.h>
+#include <wtf/HashMap.h>
+#include <wtf/StdLibExtras.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+typedef HashSet<IdentifierRep*> IdentifierSet;
+
+static IdentifierSet& identifierSet()
+{
+    DEFINE_STATIC_LOCAL(IdentifierSet, identifierSet, ());
+    return identifierSet;
+}
+    
+typedef HashMap<int, IdentifierRep*> IntIdentifierMap;
+
+static IntIdentifierMap& intIdentifierMap()
+{
+    DEFINE_STATIC_LOCAL(IntIdentifierMap, intIdentifierMap, ());
+    return intIdentifierMap;
+}
+
+IdentifierRep* IdentifierRep::get(int intID)
+{
+    if (intID == 0 || intID == -1) {
+        static IdentifierRep* negativeOneAndZeroIdentifiers[2];
+
+        IdentifierRep* identifier = negativeOneAndZeroIdentifiers[intID + 1];
+        if (!identifier) {
+            identifier = new IdentifierRep(intID);
+
+            negativeOneAndZeroIdentifiers[intID + 1] = identifier;
+        }
+        
+        return identifier;
+    }
+    
+    pair<IntIdentifierMap::iterator, bool> result = intIdentifierMap().add(intID, 0); 
+    if (result.second) {
+        ASSERT(!result.first->second);
+        result.first->second = new IdentifierRep(intID);
+        
+        identifierSet().add(result.first->second);
+    }
+    
+    return result.first->second;
+}
+
+typedef HashMap<RefPtr<JSC::UString::Rep>, IdentifierRep*> StringIdentifierMap;
+
+static StringIdentifierMap& stringIdentifierMap()
+{
+    DEFINE_STATIC_LOCAL(StringIdentifierMap, stringIdentifierMap, ());
+    return stringIdentifierMap;
+}
+
+IdentifierRep* IdentifierRep::get(const char* name)
+{
+    ASSERT(name);
+    if (!name)
+        return 0;
+  
+    UString string = String::fromUTF8WithLatin1Fallback(name, strlen(name));
+    pair<StringIdentifierMap::iterator, bool> result = stringIdentifierMap().add(string.rep(), 0);
+    if (result.second) {
+        ASSERT(!result.first->second);
+        result.first->second = new IdentifierRep(name);
+        
+        identifierSet().add(result.first->second);
+    }
+    
+    return result.first->second;
+}
+
+bool IdentifierRep::isValid(IdentifierRep* identifier)
+{
+    return identifierSet().contains(identifier);
+}
+    
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.h b/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.h
new file mode 100644
index 0000000..8e0e0d9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/bridge/IdentifierRep.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef IdentifierRep_h
+#define IdentifierRep_h
+
+#include <wtf/Assertions.h>
+#include <string.h>
+
+namespace WebCore {
+    
+class IdentifierRep {
+public:
+    static IdentifierRep* get(int);
+    static IdentifierRep* get(const char*);
+
+    static bool isValid(IdentifierRep*);
+    
+    bool isString() const { return m_isString; }
+
+    int number() const { return m_isString ? 0 : m_value.m_number; }
+    const char* string() const { return m_isString ? m_value.m_string : 0; }
+
+private:
+    IdentifierRep(int number) 
+        : m_isString(false)
+    {
+        m_value.m_number = number;
+    }
+    
+    IdentifierRep(const char* name)
+        : m_isString(true)
+    {
+        m_value.m_string = strdup(name);
+    }
+    
+    ~IdentifierRep()
+    {
+        // IdentifierReps should never be deleted.
+        ASSERT_NOT_REACHED();
+    }
+    
+    union {
+        const char* m_string;
+        int m_number;
+    } m_value;
+    bool m_isString;
+};
+
+} // namespace WebCore
+
+#endif // IdentifierRep_h
diff --git a/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp b/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp
index 743414a..3258c54 100644
--- a/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/NP_jsobject.cpp
@@ -32,6 +32,8 @@
 #include "PlatformString.h"
 #include "StringSourceProvider.h"
 #include "c_utility.h"
+#include "c_instance.h"
+#include "IdentifierRep.h"
 #include "npruntime_impl.h"
 #include "npruntime_priv.h"
 #include "runtime_root.h"
@@ -43,12 +45,11 @@
 #include <runtime/Completion.h>
 #include <runtime/Completion.h>
 
-using WebCore::String;
-using WebCore::StringSourceProvider;
 using namespace JSC;
 using namespace JSC::Bindings;
+using namespace WebCore;
 
-static void getListFromVariantArgs(ExecState* exec, const NPVariant* args, unsigned argCount, RootObject* rootObject, ArgList& aList)
+static void getListFromVariantArgs(ExecState* exec, const NPVariant* args, unsigned argCount, RootObject* rootObject, MarkedArgumentBuffer& aList)
 {
     for (unsigned i = 0; i < argCount; ++i)
         aList.append(convertNPVariantToValue(exec, &args[i], rootObject));
@@ -112,18 +113,18 @@ bool _NPN_InvokeDefault(NPP, NPObject* o, const NPVariant* args, uint32_t argCou
         JSLock lock(false);
         
         // Call the function object.
-        JSValuePtr function = obj->imp;
+        JSValue function = obj->imp;
         CallData callData;
-        CallType callType = function->getCallData(callData);
+        CallType callType = function.getCallData(callData);
         if (callType == CallTypeNone)
             return false;
         
-        ArgList argList;
+        MarkedArgumentBuffer argList;
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
-        globalObject->startTimeoutCheck();
-        JSValuePtr resultV = call(exec, function, callType, callData, function, argList);
-        globalObject->stopTimeoutCheck();
+        globalObject->globalData()->timeoutChecker.start();
+        JSValue resultV = call(exec, function, callType, callData, function, argList);
+        globalObject->globalData()->timeoutChecker.stop();
 
         // Convert and return the result of the function call.
         convertValueToNPVariant(exec, resultV, result);
@@ -142,8 +143,8 @@ bool _NPN_Invoke(NPP npp, NPObject* o, NPIdentifier methodName, const NPVariant*
     if (o->_class == NPScriptObjectClass) {
         JavaScriptObject* obj = reinterpret_cast<JavaScriptObject*>(o); 
 
-        PrivateIdentifier* i = static_cast<PrivateIdentifier*>(methodName);
-        if (!i->isString)
+        IdentifierRep* i = static_cast<IdentifierRep*>(methodName);
+        if (!i->isString())
             return false;
 
         // Special case the "eval" method.
@@ -161,19 +162,19 @@ bool _NPN_Invoke(NPP npp, NPObject* o, NPIdentifier methodName, const NPVariant*
             return false;
         ExecState* exec = rootObject->globalObject()->globalExec();
         JSLock lock(false);
-        JSValuePtr function = obj->imp->get(exec, identifierFromNPIdentifier(i->value.string));
+        JSValue function = obj->imp->get(exec, identifierFromNPIdentifier(i->string()));
         CallData callData;
-        CallType callType = function->getCallData(callData);
+        CallType callType = function.getCallData(callData);
         if (callType == CallTypeNone)
             return false;
 
         // Call the function object.
-        ArgList argList;
+        MarkedArgumentBuffer argList;
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
-        globalObject->startTimeoutCheck();
-        JSValuePtr resultV = call(exec, function, callType, callData, obj->imp, argList);
-        globalObject->stopTimeoutCheck();
+        globalObject->globalData()->timeoutChecker.start();
+        JSValue resultV = call(exec, function, callType, callData, obj->imp, argList);
+        globalObject->globalData()->timeoutChecker.stop();
 
         // Convert and return the result of the function call.
         convertValueToNPVariant(exec, resultV, result);
@@ -201,12 +202,12 @@ bool _NPN_Evaluate(NPP, NPObject* o, NPString* s, NPVariant* variant)
         JSLock lock(false);
         String scriptString = convertNPStringToUTF16(s);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
-        globalObject->startTimeoutCheck();
+        globalObject->globalData()->timeoutChecker.start();
         Completion completion = JSC::evaluate(globalObject->globalExec(), globalObject->globalScopeChain(), makeSource(scriptString));
-        globalObject->stopTimeoutCheck();
+        globalObject->globalData()->timeoutChecker.stop();
         ComplType type = completion.complType();
         
-        JSValuePtr result;
+        JSValue result;
         if (type == Normal) {
             result = completion.value();
             if (!result)
@@ -233,14 +234,14 @@ bool _NPN_GetProperty(NPP, NPObject* o, NPIdentifier propertyName, NPVariant* va
             return false;
 
         ExecState* exec = rootObject->globalObject()->globalExec();
-        PrivateIdentifier* i = static_cast<PrivateIdentifier*>(propertyName);
+        IdentifierRep* i = static_cast<IdentifierRep*>(propertyName);
         
         JSLock lock(false);
-        JSValuePtr result;
-        if (i->isString)
-            result = obj->imp->get(exec, identifierFromNPIdentifier(i->value.string));
+        JSValue result;
+        if (i->isString())
+            result = obj->imp->get(exec, identifierFromNPIdentifier(i->string()));
         else
-            result = obj->imp->get(exec, i->value.number);
+            result = obj->imp->get(exec, i->number());
 
         convertValueToNPVariant(exec, result, variant);
         exec->clearException();
@@ -268,13 +269,13 @@ bool _NPN_SetProperty(NPP, NPObject* o, NPIdentifier propertyName, const NPVaria
 
         ExecState* exec = rootObject->globalObject()->globalExec();
         JSLock lock(false);
-        PrivateIdentifier* i = static_cast<PrivateIdentifier*>(propertyName);
+        IdentifierRep* i = static_cast<IdentifierRep*>(propertyName);
 
-        if (i->isString) {
+        if (i->isString()) {
             PutPropertySlot slot;
-            obj->imp->put(exec, identifierFromNPIdentifier(i->value.string), convertNPVariantToValue(exec, variant, rootObject), slot);
+            obj->imp->put(exec, identifierFromNPIdentifier(i->string()), convertNPVariantToValue(exec, variant, rootObject), slot);
         } else
-            obj->imp->put(exec, i->value.number, convertNPVariantToValue(exec, variant, rootObject));
+            obj->imp->put(exec, i->number(), convertNPVariantToValue(exec, variant, rootObject));
         exec->clearException();
         return true;
     }
@@ -295,24 +296,24 @@ bool _NPN_RemoveProperty(NPP, NPObject* o, NPIdentifier propertyName)
             return false;
 
         ExecState* exec = rootObject->globalObject()->globalExec();
-        PrivateIdentifier* i = static_cast<PrivateIdentifier*>(propertyName);
-        if (i->isString) {
-            if (!obj->imp->hasProperty(exec, identifierFromNPIdentifier(i->value.string))) {
+        IdentifierRep* i = static_cast<IdentifierRep*>(propertyName);
+        if (i->isString()) {
+            if (!obj->imp->hasProperty(exec, identifierFromNPIdentifier(i->string()))) {
                 exec->clearException();
                 return false;
             }
         } else {
-            if (!obj->imp->hasProperty(exec, i->value.number)) {
+            if (!obj->imp->hasProperty(exec, i->number())) {
                 exec->clearException();
                 return false;
             }
         }
 
         JSLock lock(false);
-        if (i->isString)
-            obj->imp->deleteProperty(exec, identifierFromNPIdentifier(i->value.string));
+        if (i->isString())
+            obj->imp->deleteProperty(exec, identifierFromNPIdentifier(i->string()));
         else
-            obj->imp->deleteProperty(exec, i->value.number);
+            obj->imp->deleteProperty(exec, i->number());
 
         exec->clearException();
         return true;
@@ -330,15 +331,15 @@ bool _NPN_HasProperty(NPP, NPObject* o, NPIdentifier propertyName)
             return false;
 
         ExecState* exec = rootObject->globalObject()->globalExec();
-        PrivateIdentifier* i = static_cast<PrivateIdentifier*>(propertyName);
+        IdentifierRep* i = static_cast<IdentifierRep*>(propertyName);
         JSLock lock(false);
-        if (i->isString) {
-            bool result = obj->imp->hasProperty(exec, identifierFromNPIdentifier(i->value.string));
+        if (i->isString()) {
+            bool result = obj->imp->hasProperty(exec, identifierFromNPIdentifier(i->string()));
             exec->clearException();
             return result;
         }
 
-        bool result = obj->imp->hasProperty(exec, i->value.number);
+        bool result = obj->imp->hasProperty(exec, i->number());
         exec->clearException();
         return result;
     }
@@ -354,8 +355,8 @@ bool _NPN_HasMethod(NPP, NPObject* o, NPIdentifier methodName)
     if (o->_class == NPScriptObjectClass) {
         JavaScriptObject* obj = reinterpret_cast<JavaScriptObject*>(o); 
 
-        PrivateIdentifier* i = static_cast<PrivateIdentifier*>(methodName);
-        if (!i->isString)
+        IdentifierRep* i = static_cast<IdentifierRep*>(methodName);
+        if (!i->isString())
             return false;
 
         RootObject* rootObject = obj->rootObject;
@@ -364,9 +365,9 @@ bool _NPN_HasMethod(NPP, NPObject* o, NPIdentifier methodName)
 
         ExecState* exec = rootObject->globalObject()->globalExec();
         JSLock lock(false);
-        JSValuePtr func = obj->imp->get(exec, identifierFromNPIdentifier(i->value.string));
+        JSValue func = obj->imp->get(exec, identifierFromNPIdentifier(i->string()));
         exec->clearException();
-        return !func->isUndefined();
+        return !func.isUndefined();
     }
     
     if (o->_class->hasMethod)
@@ -375,11 +376,11 @@ bool _NPN_HasMethod(NPP, NPObject* o, NPIdentifier methodName)
     return false;
 }
 
-void _NPN_SetException(NPObject*, const NPUTF8*)
+void _NPN_SetException(NPObject*, const NPUTF8* message)
 {
-    // FIXME:
-    // Bug 19888: Implement _NPN_SetException() correctly
-    // <https://bugs.webkit.org/show_bug.cgi?id=19888>
+    // Ignorning the NPObject param is consistent with the Mozilla implementation.
+    UString exception(message);
+    CInstance::setGlobalException(exception);
 }
 
 bool _NPN_Enumerate(NPP, NPObject* o, NPIdentifier** identifier, uint32_t* count)
@@ -432,18 +433,18 @@ bool _NPN_Construct(NPP, NPObject* o, const NPVariant* args, uint32_t argCount,
         JSLock lock(false);
         
         // Call the constructor object.
-        JSValuePtr constructor = obj->imp;
+        JSValue constructor = obj->imp;
         ConstructData constructData;
-        ConstructType constructType = constructor->getConstructData(constructData);
+        ConstructType constructType = constructor.getConstructData(constructData);
         if (constructType == ConstructTypeNone)
             return false;
         
-        ArgList argList;
+        MarkedArgumentBuffer argList;
         getListFromVariantArgs(exec, args, argCount, rootObject, argList);
         ProtectedPtr<JSGlobalObject> globalObject = rootObject->globalObject();
-        globalObject->startTimeoutCheck();
-        JSValuePtr resultV = construct(exec, constructor, constructType, constructData, argList);
-        globalObject->stopTimeoutCheck();
+        globalObject->globalData()->timeoutChecker.start();
+        JSValue resultV = construct(exec, constructor, constructType, constructData, argList);
+        globalObject->globalData()->timeoutChecker.stop();
         
         // Convert and return the result.
         convertValueToNPVariant(exec, resultV, result);
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_class.cpp b/src/3rdparty/webkit/WebCore/bridge/c/c_class.cpp
index f81feda..7ce9927 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_class.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_class.cpp
@@ -70,11 +70,6 @@ CClass* CClass::classForIsA(NPClass* isa)
     return aClass;
 }
 
-const char* CClass::name() const
-{
-    return "";
-}
-
 MethodList CClass::methodsNamed(const Identifier& identifier, Instance* instance) const
 {
     MethodList methodList;
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_class.h b/src/3rdparty/webkit/WebCore/bridge/c/c_class.h
index 9a08605..7f20af4 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_class.h
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_class.h
@@ -43,7 +43,6 @@ public:
     static CClass* classForIsA(NPClass*);
     virtual ~CClass();
 
-    virtual const char* name() const;    
     virtual MethodList methodsNamed(const Identifier&, Instance*) const;
     virtual Field* fieldNamed(const Identifier&, Instance*) const;
 
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp
index 37c3dd8..71f6c2f 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.cpp
@@ -32,20 +32,51 @@
 #include "c_class.h"
 #include "c_runtime.h"
 #include "c_utility.h"
+#include "IdentifierRep.h"
 #include "npruntime_impl.h"
 #include "runtime_root.h"
 #include <runtime/ArgList.h>
+#include <runtime/Error.h>
 #include <interpreter/CallFrame.h>
 #include <runtime/JSLock.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/PropertyNameArray.h>
 #include <wtf/Assertions.h>
+#include <wtf/StdLibExtras.h>
 #include <wtf/StringExtras.h>
 #include <wtf/Vector.h>
 
+using namespace WebCore;
+
 namespace JSC {
 namespace Bindings {
 
+using JSC::UString;
+
+static JSC::UString& globalExceptionString()
+{
+    DEFINE_STATIC_LOCAL(JSC::UString, exceptionStr, ());
+    return exceptionStr;
+}
+
+void CInstance::setGlobalException(UString exception)
+{
+    globalExceptionString() = exception;
+}
+
+void CInstance::moveGlobalExceptionToExecState(ExecState* exec)
+{
+    if (globalExceptionString().isNull())
+        return;
+
+    {
+        JSLock lock(false);
+        throwError(exec, GeneralError, globalExceptionString());
+    }
+
+    globalExceptionString() = UString();
+}
+
 CInstance::CInstance(NPObject* o, PassRefPtr<RootObject> rootObject)
     : Instance(rootObject)
 {
@@ -70,7 +101,7 @@ bool CInstance::supportsInvokeDefaultMethod() const
     return _object->_class->invokeDefault;
 }
 
-JSValuePtr CInstance::invokeMethod(ExecState* exec, const MethodList& methodList, const ArgList& args)
+JSValue CInstance::invokeMethod(ExecState* exec, const MethodList& methodList, const ArgList& args)
 {
     // Overloading methods are not allowed by NPObjects.  Should only be one
     // name match for a particular method.
@@ -78,7 +109,7 @@ JSValuePtr CInstance::invokeMethod(ExecState* exec, const MethodList& methodList
 
     CMethod* method = static_cast<CMethod*>(methodList[0]);
 
-    NPIdentifier ident = _NPN_GetStringIdentifier(method->name());
+    NPIdentifier ident = method->identifier();
     if (!_object->_class->hasMethod(_object, ident))
         return jsUndefined();
 
@@ -87,7 +118,7 @@ JSValuePtr CInstance::invokeMethod(ExecState* exec, const MethodList& methodList
 
     unsigned i;
     for (i = 0; i < count; i++)
-        convertValueToNPVariant(exec, args.at(exec, i), &cArgs[i]);
+        convertValueToNPVariant(exec, args.at(i), &cArgs[i]);
 
     // Invoke the 'C' method.
     NPVariant resultVariant;
@@ -95,19 +126,21 @@ JSValuePtr CInstance::invokeMethod(ExecState* exec, const MethodList& methodList
 
     {
         JSLock::DropAllLocks dropAllLocks(false);
+        ASSERT(globalExceptionString().isNull());
         _object->_class->invoke(_object, ident, cArgs.data(), count, &resultVariant);
+        moveGlobalExceptionToExecState(exec);
     }
 
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
 
-    JSValuePtr resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
+    JSValue resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
     _NPN_ReleaseVariantValue(&resultVariant);
     return resultValue;
 }
 
 
-JSValuePtr CInstance::invokeDefaultMethod(ExecState* exec, const ArgList& args)
+JSValue CInstance::invokeDefaultMethod(ExecState* exec, const ArgList& args)
 {
     if (!_object->_class->invokeDefault)
         return jsUndefined();
@@ -117,20 +150,22 @@ JSValuePtr CInstance::invokeDefaultMethod(ExecState* exec, const ArgList& args)
 
     unsigned i;
     for (i = 0; i < count; i++)
-        convertValueToNPVariant(exec, args.at(exec, i), &cArgs[i]);
+        convertValueToNPVariant(exec, args.at(i), &cArgs[i]);
 
     // Invoke the 'C' method.
     NPVariant resultVariant;
     VOID_TO_NPVARIANT(resultVariant);
     {
         JSLock::DropAllLocks dropAllLocks(false);
+        ASSERT(globalExceptionString().isNull());
         _object->_class->invokeDefault(_object, cArgs.data(), count, &resultVariant);
+        moveGlobalExceptionToExecState(exec);
     }
-    
+
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
 
-    JSValuePtr resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
+    JSValue resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
     _NPN_ReleaseVariantValue(&resultVariant);
     return resultValue;
 }
@@ -140,7 +175,7 @@ bool CInstance::supportsConstruct() const
     return _object->_class->construct;
 }
     
-JSValuePtr CInstance::invokeConstruct(ExecState* exec, const ArgList& args)
+JSValue CInstance::invokeConstruct(ExecState* exec, const ArgList& args)
 {
     if (!_object->_class->construct)
         return jsUndefined();
@@ -150,25 +185,27 @@ JSValuePtr CInstance::invokeConstruct(ExecState* exec, const ArgList& args)
 
     unsigned i;
     for (i = 0; i < count; i++)
-        convertValueToNPVariant(exec, args.at(exec, i), &cArgs[i]);
+        convertValueToNPVariant(exec, args.at(i), &cArgs[i]);
 
     // Invoke the 'C' method.
     NPVariant resultVariant;
     VOID_TO_NPVARIANT(resultVariant);
     {
         JSLock::DropAllLocks dropAllLocks(false);
+        ASSERT(globalExceptionString().isNull());
         _object->_class->construct(_object, cArgs.data(), count, &resultVariant);
+        moveGlobalExceptionToExecState(exec);
     }
-    
+
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
 
-    JSValuePtr resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
+    JSValue resultValue = convertNPVariantToValue(exec, &resultVariant, _rootObject.get());
     _NPN_ReleaseVariantValue(&resultVariant);
     return resultValue;
 }
 
-JSValuePtr CInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
+JSValue CInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
     if (hint == PreferString)
         return stringValue(exec);
@@ -177,26 +214,26 @@ JSValuePtr CInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint)
     return valueOf(exec);
 }
 
-JSValuePtr CInstance::stringValue(ExecState* exec) const
+JSValue CInstance::stringValue(ExecState* exec) const
 {
     char buf[1024];
     snprintf(buf, sizeof(buf), "NPObject %p, NPClass %p", _object, _object->_class);
     return jsString(exec, buf);
 }
 
-JSValuePtr CInstance::numberValue(ExecState* exec) const
+JSValue CInstance::numberValue(ExecState* exec) const
 {
     // FIXME: Implement something sensible.
     return jsNumber(exec, 0);
 }
 
-JSValuePtr CInstance::booleanValue() const
+JSValue CInstance::booleanValue() const
 {
     // FIXME: Implement something sensible.
     return jsBoolean(false);
 }
 
-JSValuePtr CInstance::valueOf(ExecState* exec) const 
+JSValue CInstance::valueOf(ExecState* exec) const 
 {
     return stringValue(exec);
 }
@@ -211,17 +248,20 @@ void CInstance::getPropertyNames(ExecState* exec, PropertyNameArray& nameArray)
 
     {
         JSLock::DropAllLocks dropAllLocks(false);
-        if (!_object->_class->enumerate(_object, &identifiers, &count))
+        ASSERT(globalExceptionString().isNull());
+        bool ok = _object->_class->enumerate(_object, &identifiers, &count);
+        moveGlobalExceptionToExecState(exec);
+        if (!ok)
             return;
     }
 
     for (uint32_t i = 0; i < count; i++) {
-        PrivateIdentifier* identifier = static_cast<PrivateIdentifier*>(identifiers[i]);
+        IdentifierRep* identifier = static_cast<IdentifierRep*>(identifiers[i]);
 
-        if (identifier->isString)
-            nameArray.add(identifierFromNPIdentifier(identifier->value.string));
+        if (identifier->isString())
+            nameArray.add(identifierFromNPIdentifier(identifier->string()));
         else
-            nameArray.add(Identifier::from(exec, identifier->value.number));
+            nameArray.add(Identifier::from(exec, identifier->number()));
     }
 
     // FIXME: This should really call NPN_MemFree but that's in WebKit
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.h b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.h
index b16943a..f9e9de3 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_instance.h
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_instance.h
@@ -36,6 +36,8 @@ typedef struct NPObject NPObject;
 
 namespace JSC {
 
+class UString;
+
 namespace Bindings {
 
 class CClass;
@@ -46,33 +48,35 @@ public:
     {
         return adoptRef(new CInstance(object, rootObject));
     }
+
+    static void setGlobalException(JSC::UString exception);
+
     ~CInstance ();
-    
+
     virtual Class *getClass() const;
 
-    virtual JSValuePtr valueOf(ExecState*) const;
-    virtual JSValuePtr defaultValue(ExecState*, PreferredPrimitiveType) const;
-    
-    virtual JSValuePtr invokeMethod(ExecState*, const MethodList&, const ArgList&);
+    virtual JSValue valueOf(ExecState*) const;
+    virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
+
+    virtual JSValue invokeMethod(ExecState*, const MethodList&, const ArgList&);
     virtual bool supportsInvokeDefaultMethod() const;
-    virtual JSValuePtr invokeDefaultMethod(ExecState*, const ArgList&);
-    
+    virtual JSValue invokeDefaultMethod(ExecState*, const ArgList&);
+
     virtual bool supportsConstruct() const;
-    virtual JSValuePtr invokeConstruct(ExecState*, const ArgList&);
+    virtual JSValue invokeConstruct(ExecState*, const ArgList&);
 
     virtual void getPropertyNames(ExecState*, PropertyNameArray&);
 
-    JSValuePtr stringValue(ExecState*) const;
-    JSValuePtr numberValue(ExecState*) const;
-    JSValuePtr booleanValue() const;
-    
-    NPObject *getObject() const { return _object; }
+    JSValue stringValue(ExecState*) const;
+    JSValue numberValue(ExecState*) const;
+    JSValue booleanValue() const;
 
-    virtual BindingLanguage getBindingLanguage() const { return CLanguage; }
+    NPObject *getObject() const { return _object; }
 
 private:
+    static void moveGlobalExceptionToExecState(ExecState* exec);
     CInstance(NPObject*, PassRefPtr<RootObject>);
-    
+
     mutable CClass *_class;
     NPObject *_object;
 };
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.cpp b/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.cpp
index 0b854f8..6beb86c 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.cpp
@@ -37,23 +37,7 @@
 namespace JSC {
 namespace Bindings {
 
-// ---------------------- CMethod ----------------------
-
-const char* CMethod::name() const
-{
-    PrivateIdentifier *i = (PrivateIdentifier *)_methodIdentifier;
-    return i->isString ? i->value.string : 0;
-}
-
-// ---------------------- CField ----------------------
-
-const char* CField::name() const
-{
-    PrivateIdentifier *i = (PrivateIdentifier *)_fieldIdentifier;
-    return i->isString ? i->value.string : 0;
-}
-
-JSValuePtr CField::valueFromInstance(ExecState* exec, const Instance* inst) const
+JSValue CField::valueFromInstance(ExecState* exec, const Instance* inst) const
 {
     const CInstance* instance = static_cast<const CInstance*>(inst);
     NPObject* obj = instance->getObject();
@@ -67,7 +51,7 @@ JSValuePtr CField::valueFromInstance(ExecState* exec, const Instance* inst) cons
             result = obj->_class->getProperty(obj, _fieldIdentifier, &property);
         }
         if (result) {
-            JSValuePtr result = convertNPVariantToValue(exec, &property, instance->rootObject());
+            JSValue result = convertNPVariantToValue(exec, &property, instance->rootObject());
             _NPN_ReleaseVariantValue(&property);
             return result;
         }
@@ -75,7 +59,7 @@ JSValuePtr CField::valueFromInstance(ExecState* exec, const Instance* inst) cons
     return jsUndefined();
 }
 
-void CField::setValueToInstance(ExecState *exec, const Instance *inst, JSValuePtr aValue) const
+void CField::setValueToInstance(ExecState *exec, const Instance *inst, JSValue aValue) const
 {
     const CInstance* instance = static_cast<const CInstance*>(inst);
     NPObject* obj = instance->getObject();
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.h b/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.h
index eaac894..e797342 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.h
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_runtime.h
@@ -38,9 +38,10 @@ class CField : public Field {
 public:
     CField(NPIdentifier ident) : _fieldIdentifier(ident) { }
 
-    virtual JSValuePtr valueFromInstance(ExecState*, const Instance*) const;
-    virtual void setValueToInstance(ExecState*, const Instance*, JSValuePtr) const;
-    virtual const char* name() const;
+    virtual JSValue valueFromInstance(ExecState*, const Instance*) const;
+    virtual void setValueToInstance(ExecState*, const Instance*, JSValue) const;
+
+    NPIdentifier identifier() const { return _fieldIdentifier; }
 
 private:
     NPIdentifier _fieldIdentifier;
@@ -52,7 +53,7 @@ class CMethod : public Method
 public:
     CMethod(NPIdentifier ident) : _methodIdentifier(ident) { }
 
-    virtual const char* name() const;
+    NPIdentifier identifier() const { return _methodIdentifier; }
     virtual int numParameters() const { return 0; }
 
 private:
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_utility.cpp b/src/3rdparty/webkit/WebCore/bridge/c/c_utility.cpp
index 227c1d9..77b5de2 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_utility.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_utility.cpp
@@ -66,24 +66,24 @@ static String convertUTF8ToUTF16WithLatin1Fallback(const NPUTF8* UTF8Chars, int
 }
 
 // Variant value must be released with NPReleaseVariantValue()
-void convertValueToNPVariant(ExecState* exec, JSValuePtr value, NPVariant* result)
+void convertValueToNPVariant(ExecState* exec, JSValue value, NPVariant* result)
 {
     JSLock lock(false);
 
     VOID_TO_NPVARIANT(*result);
 
-    if (value->isString()) {
-        UString ustring = value->toString(exec);
+    if (value.isString()) {
+        UString ustring = value.toString(exec);
         CString cstring = ustring.UTF8String();
         NPString string = { (const NPUTF8*)cstring.c_str(), static_cast<uint32_t>(cstring.size()) };
         NPN_InitializeVariantWithStringCopy(result, &string);
-    } else if (value->isNumber()) {
-        DOUBLE_TO_NPVARIANT(value->toNumber(exec), *result);
-    } else if (value->isBoolean()) {
-        BOOLEAN_TO_NPVARIANT(value->toBoolean(exec), *result);
-    } else if (value->isNull()) {
+    } else if (value.isNumber()) {
+        DOUBLE_TO_NPVARIANT(value.toNumber(exec), *result);
+    } else if (value.isBoolean()) {
+        BOOLEAN_TO_NPVARIANT(value.toBoolean(exec), *result);
+    } else if (value.isNull()) {
         NULL_TO_NPVARIANT(*result);
-    } else if (value->isObject()) {
+    } else if (value.isObject()) {
         JSObject* object = asObject(value);
         if (object->classInfo() == &RuntimeObjectImp::s_info) {
             RuntimeObjectImp* imp = static_cast<RuntimeObjectImp*>(object);
@@ -105,7 +105,7 @@ void convertValueToNPVariant(ExecState* exec, JSValuePtr value, NPVariant* resul
     }
 }
 
-JSValuePtr convertNPVariantToValue(ExecState* exec, const NPVariant* variant, RootObject* rootObject)
+JSValue convertNPVariantToValue(ExecState* exec, const NPVariant* variant, RootObject* rootObject)
 {
     JSLock lock(false);
     
@@ -131,7 +131,7 @@ JSValuePtr convertNPVariantToValue(ExecState* exec, const NPVariant* variant, Ro
             return ((JavaScriptObject*)obj)->imp;
 
         // Wrap NPObject in a CInstance.
-        return Instance::createRuntimeObject(exec, CInstance::create(obj, rootObject));
+        return CInstance::create(obj, rootObject)->createRuntimeObject(exec);
     }
     
     return jsUndefined();
@@ -139,7 +139,7 @@ JSValuePtr convertNPVariantToValue(ExecState* exec, const NPVariant* variant, Ro
 
 String convertNPStringToUTF16(const NPString* string)
 {
-    return convertUTF8ToUTF16WithLatin1Fallback(string->UTF8Characters, string->UTF8Length);
+    return String::fromUTF8WithLatin1Fallback(string->UTF8Characters, string->UTF8Length);
 }
 
 Identifier identifierFromNPIdentifier(const NPUTF8* name)
diff --git a/src/3rdparty/webkit/WebCore/bridge/c/c_utility.h b/src/3rdparty/webkit/WebCore/bridge/c/c_utility.h
index 2efc66c..f69bba6 100644
--- a/src/3rdparty/webkit/WebCore/bridge/c/c_utility.h
+++ b/src/3rdparty/webkit/WebCore/bridge/c/c_utility.h
@@ -46,29 +46,11 @@ class RootObject;
     
 typedef uint16_t NPUTF16;
 
-enum NP_ValueType {
-    NP_NumberValueType,
-    NP_StringValueType,
-    NP_BooleanValueType,
-    NP_NullValueType,
-    NP_UndefinedValueType,
-    NP_ObjectValueType,
-    NP_InvalidValueType
-};
-
 WebCore::String convertNPStringToUTF16(const NPString *string);
-void convertValueToNPVariant(ExecState*, JSValuePtr, NPVariant* result);
-JSValuePtr convertNPVariantToValue(ExecState*, const NPVariant*, RootObject*);
+void convertValueToNPVariant(ExecState*, JSValue, NPVariant* result);
+JSValue convertNPVariantToValue(ExecState*, const NPVariant*, RootObject*);
 Identifier identifierFromNPIdentifier(const NPUTF8* name);
 
-struct PrivateIdentifier {
-    union {
-        const NPUTF8* string;
-        int32_t number;
-    } value;
-    bool isString;
-};
-
 } }
 
 #endif // ENABLE(NETSCAPE_PLUGIN_API)
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.cpp
index 069089c..87750aa 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.cpp
@@ -53,17 +53,15 @@ JavaClass::JavaClass(jobject anInstance)
     int i;
     JNIEnv *env = getJNIEnv();
 
-    JSGlobalData* globalData = WebCore::JSDOMWindow::commonJSGlobalData();
-    
     // Get the fields
     jarray fields = (jarray)callJNIMethod<jobject>(aClass, "getFields", "()[Ljava/lang/reflect/Field;");
     int numFields = env->GetArrayLength(fields);    
     for (i = 0; i < numFields; i++) {
         jobject aJField = env->GetObjectArrayElement((jobjectArray)fields, i);
-        Field *aField = new JavaField(env, aJField); // deleted in the JavaClass destructor
+        JavaField *aField = new JavaField(env, aJField); // deleted in the JavaClass destructor
         {
             JSLock lock(false);
-            _fields.set(Identifier(globalData, UString(aField->name())).ustring().rep(), aField);
+            _fields.set(aField->name(), aField);
         }
         env->DeleteLocalRef(aJField);
     }
@@ -73,15 +71,15 @@ JavaClass::JavaClass(jobject anInstance)
     int numMethods = env->GetArrayLength(methods);
     for (i = 0; i < numMethods; i++) {
         jobject aJMethod = env->GetObjectArrayElement((jobjectArray)methods, i);
-        Method *aMethod = new JavaMethod(env, aJMethod); // deleted in the JavaClass destructor
+        JavaMethod *aMethod = new JavaMethod(env, aJMethod); // deleted in the JavaClass destructor
         MethodList* methodList;
         {
             JSLock lock(false);
 
-            methodList = _methods.get(Identifier(globalData, UString(aMethod->name())).ustring().rep());
+            methodList = _methods.get(aMethod->name());
             if (!methodList) {
                 methodList = new MethodList();
-                _methods.set(Identifier(globalData, UString(aMethod->name())).ustring().rep(), methodList);
+                _methods.set(aMethod->name(), methodList);
             }
         }
         methodList->append(aMethod);
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.h b/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.h
index 75cfd89..890b4d3 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.h
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_class.h
@@ -40,8 +40,6 @@ public:
     JavaClass (jobject anInstance);
     ~JavaClass ();
 
-    virtual const char *name() const { return _name; };
-    
     virtual MethodList methodsNamed(const Identifier&, Instance* instance) const;    
     virtual Field *fieldNamed(const Identifier&, Instance* instance) const;
     
@@ -50,8 +48,6 @@ public:
     bool isStringClass() const;
     
 private:
-    JavaClass ();                                 // prevent default construction
-    
     const char *_name;
     FieldMap _fields;
     MethodListMap _methods;
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.cpp
index 6508cb3..88d79ef 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.cpp
@@ -80,7 +80,7 @@ Class *JavaInstance::getClass() const
     return _class;
 }
 
-JSValuePtr JavaInstance::stringValue(ExecState* exec) const
+JSValue JavaInstance::stringValue(ExecState* exec) const
 {
     JSLock lock(false);
     
@@ -92,23 +92,23 @@ JSValuePtr JavaInstance::stringValue(ExecState* exec) const
     return jsString(exec, u);
 }
 
-JSValuePtr JavaInstance::numberValue(ExecState* exec) const
+JSValue JavaInstance::numberValue(ExecState* exec) const
 {
     jdouble doubleValue = callJNIMethod<jdouble>(_instance->_instance, "doubleValue", "()D");
     return jsNumber(exec, doubleValue);
 }
 
-JSValuePtr JavaInstance::booleanValue() const
+JSValue JavaInstance::booleanValue() const
 {
     jboolean booleanValue = callJNIMethod<jboolean>(_instance->_instance, "booleanValue", "()Z");
     return jsBoolean(booleanValue);
 }
 
-JSValuePtr JavaInstance::invokeMethod (ExecState *exec, const MethodList &methodList, const ArgList &args)
+JSValue JavaInstance::invokeMethod (ExecState *exec, const MethodList &methodList, const ArgList &args)
 {
     int i, count = args.size();
     jvalue *jArgs;
-    JSValuePtr resultValue;
+    JSValue resultValue;
     Method *method = 0;
     size_t numMethods = methodList.size();
     
@@ -131,7 +131,7 @@ JSValuePtr JavaInstance::invokeMethod (ExecState *exec, const MethodList &method
     }
     
     const JavaMethod *jMethod = static_cast<const JavaMethod*>(method);
-    JS_LOG ("call %s %s on %p\n", method->name(), jMethod->signature(), _instance->_instance);
+    JS_LOG ("call %s %s on %p\n", UString(jMethod->name()).UTF8String().c_str(), jMethod->signature(), _instance->_instance);
     
     if (count > 0) {
         jArgs = (jvalue *)malloc (count * sizeof(jvalue));
@@ -141,8 +141,8 @@ JSValuePtr JavaInstance::invokeMethod (ExecState *exec, const MethodList &method
         
     for (i = 0; i < count; i++) {
         JavaParameter* aParameter = jMethod->parameterAt(i);
-        jArgs[i] = convertValueToJValue(exec, args.at(exec, i), aParameter->getJNIType(), aParameter->type());
-        JS_LOG("arg[%d] = %s\n", i, args.at(exec, i)->toString(exec).ascii());
+        jArgs[i] = convertValueToJValue(exec, args.at(i), aParameter->getJNIType(), aParameter->type());
+        JS_LOG("arg[%d] = %s\n", i, args.at(i).toString(exec).ascii());
     }
         
     jvalue result;
@@ -157,11 +157,11 @@ JSValuePtr JavaInstance::invokeMethod (ExecState *exec, const MethodList &method
     bool handled = false;
     if (rootObject->nativeHandle()) {
         jobject obj = _instance->_instance;
-        JSValuePtr exceptionDescription = noValue();
+        JSValue exceptionDescription;
         const char *callingURL = 0;  // FIXME, need to propagate calling URL to Java
         handled = dispatchJNICall(exec, rootObject->nativeHandle(), obj, jMethod->isStatic(), jMethod->JNIReturnType(), jMethod->methodID(obj), jArgs, result, callingURL, exceptionDescription);
         if (exceptionDescription) {
-            throwError(exec, GeneralError, exceptionDescription->toString(exec));
+            throwError(exec, GeneralError, exceptionDescription.toString(exec));
             free (jArgs);
             return jsUndefined();
         }
@@ -222,7 +222,7 @@ JSValuePtr JavaInstance::invokeMethod (ExecState *exec, const MethodList &method
                     resultValue = JavaArray::convertJObjectToArray(exec, result.l, arrayType, rootObject);
                 }
                 else {
-                    resultValue = Instance::createRuntimeObject(exec, JavaInstance::create(result.l, rootObject));
+                    resultValue = JavaInstance::create(result.l, rootObject)->createRuntimeObject(exec);
                 }
             }
             else {
@@ -283,7 +283,7 @@ JSValuePtr JavaInstance::invokeMethod (ExecState *exec, const MethodList &method
     return resultValue;
 }
 
-JSValuePtr JavaInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
+JSValue JavaInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
     if (hint == PreferString)
         return stringValue(exec);
@@ -299,7 +299,7 @@ JSValuePtr JavaInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hi
     return valueOf(exec);
 }
 
-JSValuePtr JavaInstance::valueOf(ExecState* exec) const 
+JSValue JavaInstance::valueOf(ExecState* exec) const 
 {
     return stringValue(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.h b/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.h
index 4e166f7..0dcab3e 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.h
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_instance.h
@@ -77,18 +77,16 @@ public:
     
     virtual Class *getClass() const;
     
-    virtual JSValuePtr valueOf(ExecState*) const;
-    virtual JSValuePtr defaultValue(ExecState*, PreferredPrimitiveType) const;
+    virtual JSValue valueOf(ExecState*) const;
+    virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
 
-    virtual JSValuePtr invokeMethod(ExecState* exec, const MethodList& method, const ArgList& args);
+    virtual JSValue invokeMethod(ExecState* exec, const MethodList& method, const ArgList& args);
 
     jobject javaInstance() const { return _instance->_instance; }
     
-    JSValuePtr stringValue(ExecState*) const;
-    JSValuePtr numberValue(ExecState*) const;
-    JSValuePtr booleanValue() const;
-
-    virtual BindingLanguage getBindingLanguage() const { return JavaLanguage; }
+    JSValue stringValue(ExecState*) const;
+    JSValue numberValue(ExecState*) const;
+    JSValue booleanValue() const;
 
 protected:
     virtual void virtualBegin();
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.h b/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.h
index 4125565..b4f5719 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.h
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.h
@@ -42,6 +42,7 @@ namespace JSC {
 class ArgList;
 class ExecState;
 class JSObject;
+class MarkedArgumentBuffer;
 
 namespace Bindings {
 
@@ -90,9 +91,9 @@ public:
     
     static jvalue invoke(JSObjectCallContext*);
 
-    jobject convertValueToJObject(JSValuePtr) const;
-    JSValuePtr convertJObjectToValue(ExecState*, jobject) const;
-    void getListFromJArray(ExecState*, jobjectArray, ArgList&) const;
+    jobject convertValueToJObject(JSValue) const;
+    JSValue convertJObjectToValue(ExecState*, jobject) const;
+    void getListFromJArray(ExecState*, jobjectArray, MarkedArgumentBuffer&) const;
     
     RootObject* rootObject() const;
     
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm b/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm
index 271acf1..32d7b0d 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_jsobject.mm
@@ -293,18 +293,18 @@ jobject JavaJSObject::call(jstring methodName, jobjectArray args) const
     JSLock lock(false);
     
     Identifier identifier(exec, JavaString(methodName));
-    JSValuePtr function = _imp->get(exec, identifier);
+    JSValue function = _imp->get(exec, identifier);
     CallData callData;
-    CallType callType = function->getCallData(callData);
+    CallType callType = function.getCallData(callData);
     if (callType == CallTypeNone)
         return 0;
 
     // Call the function object.
-    ArgList argList;
+    MarkedArgumentBuffer argList;
     getListFromJArray(exec, args, argList);
-    rootObject->globalObject()->startTimeoutCheck();
-    JSValuePtr result = JSC::call(exec, function, callType, callData, _imp, argList);
-    rootObject->globalObject()->stopTimeoutCheck();
+    rootObject->globalObject()->globalData()->timeoutChecker.start();
+    JSValue result = JSC::call(exec, function, callType, callData, _imp, argList);
+    rootObject->globalObject()->globalData()->timeoutChecker.stop();
 
     return convertValueToJObject(result);
 }
@@ -313,7 +313,7 @@ jobject JavaJSObject::eval(jstring script) const
 {
     JS_LOG ("script = %s\n", JavaString(script).UTF8String());
     
-    JSValuePtr result;
+    JSValue result;
 
     JSLock lock(false);
     
@@ -321,9 +321,9 @@ jobject JavaJSObject::eval(jstring script) const
     if (!rootObject)
         return 0;
 
-    rootObject->globalObject()->startTimeoutCheck();
+    rootObject->globalObject()->globalData()->timeoutChecker.start();
     Completion completion = JSC::evaluate(rootObject->globalObject()->globalExec(), rootObject->globalObject()->globalScopeChain(), makeSource(JavaString(script)));
-    rootObject->globalObject()->stopTimeoutCheck();
+    rootObject->globalObject()->globalData()->timeoutChecker.stop();
     ComplType type = completion.complType();
     
     if (type == Normal) {
@@ -347,7 +347,7 @@ jobject JavaJSObject::getMember(jstring memberName) const
     ExecState* exec = rootObject->globalObject()->globalExec();
     
     JSLock lock(false);
-    JSValuePtr result = _imp->get(exec, Identifier(exec, JavaString(memberName)));
+    JSValue result = _imp->get(exec, Identifier(exec, JavaString(memberName)));
 
     return convertValueToJObject(result);
 }
@@ -397,7 +397,7 @@ jobject JavaJSObject::getSlot(jint index) const
     ExecState* exec = rootObject->globalObject()->globalExec();
 
     JSLock lock(false);
-    JSValuePtr result = _imp->get(exec, index);
+    JSValue result = _imp->get(exec, index);
 
     return convertValueToJObject(result);
 }
@@ -485,7 +485,7 @@ jlong JavaJSObject::createNative(jlong nativeHandle)
     return nativeHandle;
 }
 
-jobject JavaJSObject::convertValueToJObject(JSValuePtr value) const
+jobject JavaJSObject::convertValueToJObject(JSValue value) const
 {
     JSLock lock(false);
     
@@ -505,28 +505,28 @@ jobject JavaJSObject::convertValueToJObject(JSValuePtr value) const
     // Java instance -> Java instance
     // Everything else -> JavaJSObject
     
-    if (value->isNumber()) {
+    if (value.isNumber()) {
         jclass JSObjectClass = env->FindClass ("java/lang/Double");
         jmethodID constructorID = env->GetMethodID (JSObjectClass, "<init>", "(D)V");
         if (constructorID != NULL) {
-            result = env->NewObject (JSObjectClass, constructorID, (jdouble)value->toNumber(exec));
+            result = env->NewObject (JSObjectClass, constructorID, (jdouble)value.toNumber(exec));
         }
-    } else if (value->isString()) {
-        UString stringValue = value->toString(exec);
+    } else if (value.isString()) {
+        UString stringValue = value.toString(exec);
         JNIEnv *env = getJNIEnv();
         result = env->NewString ((const jchar *)stringValue.data(), stringValue.size());
-    } else if (value->isBoolean()) {
+    } else if (value.isBoolean()) {
         jclass JSObjectClass = env->FindClass ("java/lang/Boolean");
         jmethodID constructorID = env->GetMethodID (JSObjectClass, "<init>", "(Z)V");
         if (constructorID != NULL) {
-            result = env->NewObject (JSObjectClass, constructorID, (jboolean)value->toBoolean(exec));
+            result = env->NewObject (JSObjectClass, constructorID, (jboolean)value.toBoolean(exec));
         }
     }
     else {
         // Create a JavaJSObject.
         jlong nativeHandle;
         
-        if (value->isObject()) {
+        if (value.isObject()) {
             JSObject* imp = asObject(value);
             
             // We either have a wrapper around a Java instance or a JavaScript
@@ -571,7 +571,7 @@ jobject JavaJSObject::convertValueToJObject(JSValuePtr value) const
     return result;
 }
 
-JSValuePtr JavaJSObject::convertJObjectToValue(ExecState* exec, jobject theObject) const
+JSValue JavaJSObject::convertJObjectToValue(ExecState* exec, jobject theObject) const
 {
     // Instances of netscape.javascript.JSObject get converted back to
     // JavaScript objects.  All other objects are wrapped.  It's not
@@ -602,10 +602,10 @@ JSValuePtr JavaJSObject::convertJObjectToValue(ExecState* exec, jobject theObjec
 
     JSLock lock(false);
 
-    return JSC::Bindings::Instance::createRuntimeObject(exec, JavaInstance::create(theObject, _rootObject));
+    return JavaInstance::create(theObject, _rootObject)->createRuntimeObject(exec);
 }
 
-void JavaJSObject::getListFromJArray(ExecState* exec, jobjectArray jArray, ArgList& list) const
+void JavaJSObject::getListFromJArray(ExecState* exec, jobjectArray jArray, MarkedArgumentBuffer& list) const
 {
     JNIEnv *env = getJNIEnv();
     int numObjects = jArray ? env->GetArrayLength(jArray) : 0;
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_objc.mm b/src/3rdparty/webkit/WebCore/bridge/jni/jni_objc.mm
index 232d9e9..7c19442 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_objc.mm
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_objc.mm
@@ -45,7 +45,7 @@ using namespace JSC::Bindings;
        exceptionDescription:(NSString **)exceptionString;
 @end
 
-bool JSC::Bindings::dispatchJNICall(ExecState* exec, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, jmethodID methodID, jvalue* args, jvalue &result, const char*, JSValuePtr& exceptionDescription)
+bool JSC::Bindings::dispatchJNICall(ExecState* exec, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, jmethodID methodID, jvalue* args, jvalue &result, const char*, JSValue& exceptionDescription)
 {
     id view = (id)targetAppletView;
     
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.cpp
index a67d0ec..3cbe8cf 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.cpp
@@ -70,7 +70,7 @@ JavaField::JavaField (JNIEnv *env, jobject aField)
     _field = new JObjectWrapper(aField);
 }
 
-JSValuePtr JavaArray::convertJObjectToArray(ExecState* exec, jobject anObject, const char* type, PassRefPtr<RootObject> rootObject)
+JSValue JavaArray::convertJObjectToArray(ExecState* exec, jobject anObject, const char* type, PassRefPtr<RootObject> rootObject)
 {
     if (type[0] != '[')
         return jsUndefined();
@@ -93,24 +93,24 @@ jvalue JavaField::dispatchValueFromInstance(ExecState *exec, const JavaInstance
         {
             RootObject* rootObject = instance->rootObject();
             if (rootObject && rootObject->nativeHandle()) {
-                JSValuePtr exceptionDescription = noValue();
+                JSValue exceptionDescription;
                 jvalue args[1];
                 
                 args[0].l = jinstance;
                 dispatchJNICall(exec, rootObject->nativeHandle(), fieldJInstance, false, returnType, mid, args, result, 0, exceptionDescription);
                 if (exceptionDescription)
-                    throwError(exec, GeneralError, exceptionDescription->toString(exec));
+                    throwError(exec, GeneralError, exceptionDescription.toString(exec));
             }
         }
     }
     return result;
 }
 
-JSValuePtr JavaField::valueFromInstance(ExecState* exec, const Instance* i) const 
+JSValue JavaField::valueFromInstance(ExecState* exec, const Instance* i) const 
 {
     const JavaInstance *instance = static_cast<const JavaInstance *>(i);
 
-    JSValuePtr jsresult = jsUndefined();
+    JSValue jsresult = jsUndefined();
     
     switch (_JNIType) {
         case array_type:
@@ -123,7 +123,7 @@ JSValuePtr JavaField::valueFromInstance(ExecState* exec, const Instance* i) cons
                 jsresult = JavaArray::convertJObjectToArray(exec, anObject, arrayType, instance->rootObject());
             }
             else if (anObject != 0){
-                jsresult = Instance::createRuntimeObject(exec, JavaInstance::create(anObject, instance->rootObject()));
+                jsresult = JavaInstance::create(anObject, instance->rootObject())->createRuntimeObject(exec);
             }
         }
         break;
@@ -157,7 +157,7 @@ JSValuePtr JavaField::valueFromInstance(ExecState* exec, const Instance* i) cons
         break;
     }
 
-    JS_LOG ("getting %s = %s\n", name(), jsresult->toString(exec).ascii());
+    JS_LOG ("getting %s = %s\n", UString(name()).UTF8String().c_str(), jsresult.toString(exec).ascii());
     
     return jsresult;
 }
@@ -175,7 +175,7 @@ void JavaField::dispatchSetValueToInstance(ExecState *exec, const JavaInstance *
         {
             RootObject* rootObject = instance->rootObject();
             if (rootObject && rootObject->nativeHandle()) {
-                JSValuePtr exceptionDescription = noValue();
+                JSValue exceptionDescription;
                 jvalue args[2];
                 jvalue result;
                 
@@ -183,18 +183,18 @@ void JavaField::dispatchSetValueToInstance(ExecState *exec, const JavaInstance *
                 args[1] = javaValue;
                 dispatchJNICall(exec, rootObject->nativeHandle(), fieldJInstance, false, void_type, mid, args, result, 0, exceptionDescription);
                 if (exceptionDescription)
-                    throwError(exec, GeneralError, exceptionDescription->toString(exec));
+                    throwError(exec, GeneralError, exceptionDescription.toString(exec));
             }
         }
     }
 }
 
-void JavaField::setValueToInstance(ExecState* exec, const Instance* i, JSValuePtr aValue) const
+void JavaField::setValueToInstance(ExecState* exec, const Instance* i, JSValue aValue) const
 {
     const JavaInstance *instance = static_cast<const JavaInstance *>(i);
     jvalue javaValue = convertValueToJValue (exec, aValue, _JNIType, type());
 
-    JS_LOG ("setting value %s to %s\n", name(), aValue->toString(exec).ascii());
+    JS_LOG ("setting value %s to %s\n", UString(name()).UTF8String().c_str(), aValue.toString(exec).ascii());
 
     switch (_JNIType) {
         case array_type:
@@ -359,7 +359,7 @@ JNIType JavaMethod::JNIReturnType() const
 jmethodID JavaMethod::methodID (jobject obj) const
 {
     if (_methodID == 0) {
-        _methodID = getMethodID (obj, name(), signature());
+        _methodID = getMethodID (obj, _name.UTF8String(), signature());
     }
     return _methodID;
 }
@@ -386,7 +386,7 @@ RootObject* JavaArray::rootObject() const
     return _rootObject && _rootObject->isValid() ? _rootObject.get() : 0;
 }
 
-void JavaArray::setValueAt(ExecState* exec, unsigned index, JSValuePtr aValue) const
+void JavaArray::setValueAt(ExecState* exec, unsigned index, JSValue aValue) const
 {
     JNIEnv *env = getJNIEnv();
     char *javaClassName = 0;
@@ -454,7 +454,7 @@ void JavaArray::setValueAt(ExecState* exec, unsigned index, JSValuePtr aValue) c
 }
 
 
-JSValuePtr JavaArray::valueAt(ExecState* exec, unsigned index) const
+JSValue JavaArray::valueAt(ExecState* exec, unsigned index) const
 {
     JNIEnv *env = getJNIEnv();
     JNIType arrayType = JNITypeFromPrimitiveType(_type[1]);
@@ -474,7 +474,7 @@ JSValuePtr JavaArray::valueAt(ExecState* exec, unsigned index) const
                 return JavaArray::convertJObjectToArray(exec, anObject, _type+1, rootObject());
             }
             // or array of other object type?
-            return Instance::createRuntimeObject(exec, JavaInstance::create(anObject, rootObject()));
+            return JavaInstance::create(anObject, rootObject())->createRuntimeObject(exec);
         }
             
         case boolean_type: {
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.h b/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.h
index ac771b4..f3cbf2b 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.h
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_runtime.h
@@ -56,7 +56,7 @@ public:
         const jchar *uc = getUCharactersFromJStringInEnv (e, s);
         {
             JSLock lock(false);
-            _rep = UString((UChar *)uc,_size).rep();
+            _rep = UString(reinterpret_cast<const UChar*>(uc), _size).rep();
         }
         releaseUCharactersForJStringInEnv (e, s, uc);
     }
@@ -112,10 +112,10 @@ class JavaField : public Field
 public:
     JavaField (JNIEnv *env, jobject aField);
 
-    virtual JSValuePtr valueFromInstance(ExecState *exec, const Instance *instance) const;
-    virtual void setValueToInstance(ExecState *exec, const Instance *instance, JSValuePtr aValue) const;
+    virtual JSValue valueFromInstance(ExecState *exec, const Instance *instance) const;
+    virtual void setValueToInstance(ExecState *exec, const Instance *instance, JSValue aValue) const;
     
-    virtual const char *name() const { return _name.UTF8String(); }
+    UString::Rep* name() const { return ((UString)_name).rep(); }
     virtual RuntimeType type() const { return _type.UTF8String(); }
 
     JNIType getJNIType() const { return _JNIType; }
@@ -137,7 +137,7 @@ public:
     JavaMethod(JNIEnv* env, jobject aMethod);
     ~JavaMethod();
 
-    virtual const char *name() const { return _name.UTF8String(); };
+    UString::Rep* name() const { return ((UString)_name).rep(); }
     RuntimeType returnType() const { return _returnType.UTF8String(); };
     JavaParameter* parameterAt(int i) const { return &_parameters[i]; };
     int numParameters() const { return _numParameters; };
@@ -168,13 +168,13 @@ public:
 
     RootObject* rootObject() const;
 
-    virtual void setValueAt(ExecState *exec, unsigned int index, JSValuePtr aValue) const;
-    virtual JSValuePtr valueAt(ExecState *exec, unsigned int index) const;
+    virtual void setValueAt(ExecState *exec, unsigned int index, JSValue aValue) const;
+    virtual JSValue valueAt(ExecState *exec, unsigned int index) const;
     virtual unsigned int getLength() const;
     
     jobject javaArray() const { return _array->_instance; }
 
-    static JSValuePtr convertJObjectToArray (ExecState* exec, jobject anObject, const char* type, PassRefPtr<RootObject>);
+    static JSValue convertJObjectToArray (ExecState* exec, jobject anObject, const char* type, PassRefPtr<RootObject>);
 
 private:
     RefPtr<JObjectWrapper> _array;
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.cpp b/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.cpp
index 14dd8ea..f8a2789 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.cpp
@@ -365,8 +365,8 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
                 env->FindClass("java/lang/String"),
                 env->NewStringUTF(""));
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
-                UString stringValue = item->toString(exec);
+                JSValue item = jsArray->get(exec, i);
+                UString stringValue = item.toString(exec);
                 env->SetObjectArrayElement(jarray,i,
                     env->functions->NewString(env, (const jchar *)stringValue.data(), stringValue.size()));
                 }
@@ -377,8 +377,8 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
         case boolean_type: {
             jarray = (jobjectArray)env->NewBooleanArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
-                jboolean value = (jboolean)item->toNumber(exec);
+                JSValue item = jsArray->get(exec, i);
+                jboolean value = (jboolean)item.toNumber(exec);
                 env->SetBooleanArrayRegion((jbooleanArray)jarray, (jsize)i, (jsize)1, &value);
             }
             break;
@@ -387,8 +387,8 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
         case byte_type: {
             jarray = (jobjectArray)env->NewByteArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
-                jbyte value = (jbyte)item->toNumber(exec);
+                JSValue item = jsArray->get(exec, i);
+                jbyte value = (jbyte)item.toNumber(exec);
                 env->SetByteArrayRegion((jbyteArray)jarray, (jsize)i, (jsize)1, &value);
             }
             break;
@@ -397,8 +397,8 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
         case char_type: {
             jarray = (jobjectArray)env->NewCharArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
-                UString stringValue = item->toString(exec);
+                JSValue item = jsArray->get(exec, i);
+                UString stringValue = item.toString(exec);
                 jchar value = 0;
                 if (stringValue.size() > 0)
                     value = ((const jchar*)stringValue.data())[0];
@@ -410,8 +410,8 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
         case short_type: {
             jarray = (jobjectArray)env->NewShortArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
-                jshort value = (jshort)item->toNumber(exec);
+                JSValue item = jsArray->get(exec, i);
+                jshort value = (jshort)item.toNumber(exec);
                 env->SetShortArrayRegion((jshortArray)jarray, (jsize)i, (jsize)1, &value);
             }
             break;
@@ -420,8 +420,8 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
         case int_type: {
             jarray = (jobjectArray)env->NewIntArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
-                jint value = (jint)item->toNumber(exec);
+                JSValue item = jsArray->get(exec, i);
+                jint value = (jint)item.toNumber(exec);
                 env->SetIntArrayRegion((jintArray)jarray, (jsize)i, (jsize)1, &value);
             }
             break;
@@ -430,8 +430,8 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
         case long_type: {
             jarray = (jobjectArray)env->NewLongArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
-                jlong value = (jlong)item->toNumber(exec);
+                JSValue item = jsArray->get(exec, i);
+                jlong value = (jlong)item.toNumber(exec);
                 env->SetLongArrayRegion((jlongArray)jarray, (jsize)i, (jsize)1, &value);
             }
             break;
@@ -440,8 +440,8 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
         case float_type: {
             jarray = (jobjectArray)env->NewFloatArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
-                jfloat value = (jfloat)item->toNumber(exec);
+                JSValue item = jsArray->get(exec, i);
+                jfloat value = (jfloat)item.toNumber(exec);
                 env->SetFloatArrayRegion((jfloatArray)jarray, (jsize)i, (jsize)1, &value);
             }
             break;
@@ -450,8 +450,8 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
         case double_type: {
             jarray = (jobjectArray)env->NewDoubleArray(length);
             for(unsigned i = 0; i < length; i++) {
-                JSValuePtr item = jsArray->get(exec, i);
-                jdouble value = (jdouble)item->toNumber(exec);
+                JSValue item = jsArray->get(exec, i);
+                jdouble value = (jdouble)item.toNumber(exec);
                 env->SetDoubleArrayRegion((jdoubleArray)jarray, (jsize)i, (jsize)1, &value);
             }
             break;
@@ -468,7 +468,7 @@ static jobject convertArrayInstanceToJavaArray(ExecState* exec, JSArray* jsArray
 }
 
 
-jvalue convertValueToJValue(ExecState* exec, JSValuePtr value, JNIType _JNIType, const char* javaClassName)
+jvalue convertValueToJValue(ExecState* exec, JSValue value, JNIType _JNIType, const char* javaClassName)
 {
     JSLock lock(false);
     
@@ -480,7 +480,7 @@ jvalue convertValueToJValue(ExecState* exec, JSValuePtr value, JNIType _JNIType,
             result.l = (jobject)0;
             
             // First see if we have a Java instance.
-            if (value->isObject()){
+            if (value.isObject()){
                 JSObject* objectImp = asObject(value);
                 if (objectImp->classInfo() == &RuntimeObjectImp::s_info) {
                     RuntimeObjectImp* imp = static_cast<RuntimeObjectImp*>(objectImp);
@@ -512,10 +512,10 @@ jvalue convertValueToJValue(ExecState* exec, JSValuePtr value, JNIType _JNIType,
                 }
                 else 
 #else
-                if (!value->isNull())
+                if (!value.isNull())
 #endif
                 {
-                    UString stringValue = value->toString(exec);
+                    UString stringValue = value.toString(exec);
                     JNIEnv *env = getJNIEnv();
                     jobject javaString = env->functions->NewString (env, (const jchar *)stringValue.data(), stringValue.size());
                     result.l = javaString;
@@ -526,42 +526,42 @@ jvalue convertValueToJValue(ExecState* exec, JSValuePtr value, JNIType _JNIType,
         break;
         
         case boolean_type: {
-            result.z = (jboolean)value->toNumber(exec);
+            result.z = (jboolean)value.toNumber(exec);
         }
         break;
             
         case byte_type: {
-            result.b = (jbyte)value->toNumber(exec);
+            result.b = (jbyte)value.toNumber(exec);
         }
         break;
         
         case char_type: {
-            result.c = (jchar)value->toNumber(exec);
+            result.c = (jchar)value.toNumber(exec);
         }
         break;
 
         case short_type: {
-            result.s = (jshort)value->toNumber(exec);
+            result.s = (jshort)value.toNumber(exec);
         }
         break;
 
         case int_type: {
-            result.i = (jint)value->toNumber(exec);
+            result.i = (jint)value.toNumber(exec);
         }
         break;
 
         case long_type: {
-            result.j = (jlong)value->toNumber(exec);
+            result.j = (jlong)value.toNumber(exec);
         }
         break;
 
         case float_type: {
-            result.f = (jfloat)value->toNumber(exec);
+            result.f = (jfloat)value.toNumber(exec);
         }
         break;
 
         case double_type: {
-            result.d = (jdouble)value->toNumber(exec);
+            result.d = (jdouble)value.toNumber(exec);
         }
         break;
             
diff --git a/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.h b/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.h
index a08cc5d..c315b1f 100644
--- a/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.h
+++ b/src/3rdparty/webkit/WebCore/bridge/jni/jni_utility.h
@@ -72,7 +72,7 @@ JNIType JNITypeFromClassName(const char *name);
 JNIType JNITypeFromPrimitiveType(char type);
 const char *signatureFromPrimitiveType(JNIType type);
 
-jvalue convertValueToJValue(ExecState*, JSValuePtr, JNIType, const char* javaClassName);
+jvalue convertValueToJValue(ExecState*, JSValue, JNIType, const char* javaClassName);
 
 jvalue getJNIField(jobject obj, JNIType type, const char *name, const char *signature);
 
@@ -277,7 +277,7 @@ T callJNIStaticMethod(jclass cls, const char* methodName, const char* methodSign
     return result;
 }
     
-bool dispatchJNICall(ExecState*, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, jmethodID methodID, jvalue* args, jvalue& result, const char* callingURL, JSValuePtr& exceptionDescription);
+bool dispatchJNICall(ExecState*, const void* targetAppletView, jobject obj, bool isStatic, JNIType returnType, jmethodID methodID, jvalue* args, jvalue& result, const char* callingURL, JSValue& exceptionDescription);
 
 } // namespace Bindings
 
diff --git a/src/3rdparty/webkit/WebCore/bridge/npapi.h b/src/3rdparty/webkit/WebCore/bridge/npapi.h
index 33535f7..1904a87 100644
--- a/src/3rdparty/webkit/WebCore/bridge/npapi.h
+++ b/src/3rdparty/webkit/WebCore/bridge/npapi.h
@@ -108,9 +108,7 @@
 /*----------------------------------------------------------------------*/
 
 #define NP_VERSION_MAJOR 0
-#define NP_VERSION_MINOR 20
-
-
+#define NP_VERSION_MINOR 24
 
 /*----------------------------------------------------------------------*/
 /*             Definition of Basic Types                                */
@@ -343,13 +341,16 @@ typedef enum {
      */
     NPPVpluginWantsAllNetworkStreams = 18,
 
+    NPPVpluginPrivateModeBool = 19,
+    
+    /* Checks to see if the plug-in would like the browser to load the "src" attribute. */
+    NPPVpluginCancelSrcStream = 20,
+
 #ifdef XP_MACOSX
     /* Used for negotiating drawing models */
     NPPVpluginDrawingModel = 1000,
     /* Used for negotiating event models */
     NPPVpluginEventModel = 1001,
-    /* The plug-in text input vtable */
-    NPPVpluginTextInputFuncs = 1002,
     /* In the NPDrawingModelCoreAnimation drawing model, the browser asks the plug-in for a Core Animation layer. */
     NPPVpluginCoreAnimationLayer = 1003
 #endif
@@ -379,7 +380,9 @@ typedef enum {
     /* Get the NPObject wrapper for the plugins DOM element. */
     NPNVPluginElementNPObject = 16,
 
-    NPNVSupportsWindowless = 17
+    NPNVSupportsWindowless = 17,
+    
+    NPNVprivateModeBool = 18
 
 #ifdef XP_MACOSX
     , NPNVpluginDrawingModel = 1000 /* The NPDrawingModel specified by the plugin */
@@ -396,10 +399,14 @@ typedef enum {
 #endif
     , NPNVsupportsCocoaBool = 3001 /* TRUE if the browser supports the Cocoa event model */
     
-    , NPNVbrowserTextInputFuncs = 1002 /* The browser text input vtable */
 #endif /* XP_MACOSX */
 } NPNVariable;
 
+typedef enum {
+   NPNURLVCookie = 501,
+   NPNURLVProxy
+} NPNURLVariable;
+
 /*
  * The type of a NPWindow - it specifies the type of the data structure
  * returned in the window field.
@@ -449,6 +456,7 @@ typedef enum {
     NPCocoaEventFocusChanged,
     NPCocoaEventWindowFocusChanged,
     NPCocoaEventScrollWheel,
+    NPCocoaEventTextInput
 } NPCocoaEventType;
 
 typedef struct _NPNSString NPNSString;
@@ -478,6 +486,8 @@ typedef struct _NPCocoaEvent {
             uint16 keyCode;
         } key;
         struct {
+            CGContextRef context;
+
             double x;
             double y;
             double width;
@@ -485,7 +495,10 @@ typedef struct _NPCocoaEvent {
         } draw;
         struct {
             NPBool hasFocus;
-        } focus;        
+        } focus;
+        struct {
+            NPNSString *text;
+        } text;
     } data;
 } NPCocoaEvent;
 
@@ -538,6 +551,14 @@ typedef NPNSMenu NPMenu;
 typedef void * NPMenu;
 #endif
 
+typedef enum {
+    NPCoordinateSpacePlugin = 1,
+    NPCoordinateSpaceWindow,
+    NPCoordinateSpaceFlippedWindow,
+    NPCoordinateSpaceScreen,
+    NPCoordinateSpaceFlippedScreen
+} NPCoordinateSpace;
+
 #if defined(XP_MAC) || defined(XP_MACOSX)
 
 #ifndef NP_NO_CARBON
@@ -726,7 +747,11 @@ typedef struct NP_Port
 #define NPVERS_HAS_RESPONSE_HEADERS       17
 #define NPVERS_HAS_NPOBJECT_ENUM          18
 #define NPVERS_HAS_PLUGIN_THREAD_ASYNC_CALL 19
-#define NPVERS_MACOSX_HAS_EVENT_MODELS    20
+#define NPVERS_HAS_ALL_NETWORK_STREAMS    20
+#define NPVERS_HAS_URL_AND_AUTH_INFO      21
+#define NPVERS_HAS_PRIVATE_MODE           22
+#define NPVERS_MACOSX_HAS_EVENT_MODELS    23
+#define NPVERS_HAS_CANCEL_SRC_STREAM      24
 
 /*----------------------------------------------------------------------*/
 /*             Function Prototypes                */
@@ -819,10 +844,14 @@ void        NPN_ForceRedraw(NPP instance);
 void        NPN_PushPopupsEnabledState(NPP instance, NPBool enabled);
 void        NPN_PopPopupsEnabledState(NPP instance);
 void        NPN_PluginThreadAsyncCall(NPP instance, void (*func) (void *), void *userData);
+NPError     NPN_GetValueForURL(NPP instance, NPNURLVariable variable, const char* url, char** value, uint32* len);
+NPError     NPN_SetValueForURL(NPP instance, NPNURLVariable variable, const char* url, const char* value, uint32 len);
+NPError     NPN_GetAuthenticationInfo(NPP instance, const char* protocol, const char* host, int32 port, const char* scheme, const char *realm, char** username, uint32* ulen, char** password, uint32* plen);
 uint32      NPN_ScheduleTimer(NPP instance, uint32 interval, NPBool repeat, void (*timerFunc)(NPP npp, uint32 timerID));
 void        NPN_UnscheduleTimer(NPP instance, uint32 timerID);
 NPError     NPN_PopUpContextMenu(NPP instance, NPMenu* menu);
-
+NPBool      NPN_ConvertPoint(NPP instance, double sourceX, double sourceY, NPCoordinateSpace sourceSpace, double *destX, double *destY, NPCoordinateSpace destSpace);
+    
 #ifdef __cplusplus
 }  /* end extern "C" */
 #endif
diff --git a/src/3rdparty/webkit/WebCore/bridge/npruntime.cpp b/src/3rdparty/webkit/WebCore/bridge/npruntime.cpp
index 789114e..ab67076 100644
--- a/src/3rdparty/webkit/WebCore/bridge/npruntime.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/npruntime.cpp
@@ -27,6 +27,7 @@
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
 
+#include "IdentifierRep.h"
 #include "npruntime_internal.h"
 #include "npruntime_impl.h"
 #include "npruntime_priv.h"
@@ -38,50 +39,11 @@
 #include <wtf/HashMap.h>
 
 using namespace JSC::Bindings;
-
-typedef HashMap<RefPtr<JSC::UString::Rep>, PrivateIdentifier*> StringIdentifierMap;
-
-static StringIdentifierMap* getStringIdentifierMap()
-{
-    static StringIdentifierMap* stringIdentifierMap = 0;
-    if (!stringIdentifierMap)
-        stringIdentifierMap = new StringIdentifierMap;
-    return stringIdentifierMap;
-}
-
-typedef HashMap<int, PrivateIdentifier*> IntIdentifierMap;
-
-static IntIdentifierMap* getIntIdentifierMap()
-{
-    static IntIdentifierMap* intIdentifierMap = 0;
-    if (!intIdentifierMap)
-        intIdentifierMap = new IntIdentifierMap;
-    return intIdentifierMap;
-}
+using namespace WebCore;
 
 NPIdentifier _NPN_GetStringIdentifier(const NPUTF8* name)
 {
-    ASSERT(name);
-    
-    if (name) {
-        PrivateIdentifier* identifier = 0;
-        
-        JSC::JSLock lock(false);
-        
-        identifier = getStringIdentifierMap()->get(identifierFromNPIdentifier(name).ustring().rep());
-        if (identifier == 0) {
-            identifier = (PrivateIdentifier*)malloc(sizeof(PrivateIdentifier));
-            // We never release identifier names, so this dictionary will grow, as will
-            // the memory for the identifier name strings.
-            identifier->isString = true;
-            identifier->value.string = strdup(name);
-
-            getStringIdentifierMap()->set(identifierFromNPIdentifier(name).ustring().rep(), identifier);
-        }
-        return (NPIdentifier)identifier;
-    }
-    
-    return 0;
+    return static_cast<NPIdentifier>(IdentifierRep::get(name));
 }
 
 void _NPN_GetStringIdentifiers(const NPUTF8** names, int32_t nameCount, NPIdentifier* identifiers)
@@ -89,61 +51,34 @@ void _NPN_GetStringIdentifiers(const NPUTF8** names, int32_t nameCount, NPIdenti
     ASSERT(names);
     ASSERT(identifiers);
     
-    if (names && identifiers)
+    if (names && identifiers) {
         for (int i = 0; i < nameCount; i++)
             identifiers[i] = _NPN_GetStringIdentifier(names[i]);
+    }
 }
 
 NPIdentifier _NPN_GetIntIdentifier(int32_t intid)
 {
-    PrivateIdentifier* identifier;
-
-    if (intid == 0 || intid == -1) {
-        static PrivateIdentifier* negativeOneAndZeroIdentifiers[2];
-
-        identifier = negativeOneAndZeroIdentifiers[intid + 1];
-        if (!identifier) {
-            identifier = (PrivateIdentifier*)malloc(sizeof(PrivateIdentifier));
-            identifier->isString = false;
-            identifier->value.number = intid;
-
-            negativeOneAndZeroIdentifiers[intid + 1] = identifier;
-        }
-    } else {
-        identifier = getIntIdentifierMap()->get(intid);
-        if (!identifier) {
-            identifier = (PrivateIdentifier*)malloc(sizeof(PrivateIdentifier));
-            // We never release identifier names, so this dictionary will grow.
-            identifier->isString = false;
-            identifier->value.number = intid;
-
-            getIntIdentifierMap()->set(intid, identifier);
-        }
-    }
-    return (NPIdentifier)identifier;
+    return static_cast<NPIdentifier>(IdentifierRep::get(intid));
 }
 
 bool _NPN_IdentifierIsString(NPIdentifier identifier)
 {
-    PrivateIdentifier* i = (PrivateIdentifier*)identifier;
-    return i->isString;
+    return static_cast<IdentifierRep*>(identifier)->isString();
 }
 
 NPUTF8 *_NPN_UTF8FromIdentifier(NPIdentifier identifier)
 {
-    PrivateIdentifier* i = (PrivateIdentifier*)identifier;
-    if (!i->isString || !i->value.string)
-        return NULL;
-        
-    return (NPUTF8 *)strdup(i->value.string);
+    const char* string = static_cast<IdentifierRep*>(identifier)->string();
+    if (!string)
+        return 0;
+    
+    return strdup(string);
 }
 
 int32_t _NPN_IntFromIdentifier(NPIdentifier identifier)
 {
-    PrivateIdentifier* i = (PrivateIdentifier*)identifier;
-    if (i->isString)
-        return 0;
-    return i->value.number;
+    return static_cast<IdentifierRep*>(identifier)->number();
 }
 
 void NPN_InitializeVariantWithStringCopy(NPVariant* variant, const NPString* value)
@@ -151,6 +86,8 @@ void NPN_InitializeVariantWithStringCopy(NPVariant* variant, const NPString* val
     variant->type = NPVariantType_String;
     variant->value.stringValue.UTF8Length = value->UTF8Length;
     variant->value.stringValue.UTF8Characters = (NPUTF8 *)malloc(sizeof(NPUTF8) * value->UTF8Length);
+    if (!variant->value.stringValue.UTF8Characters)
+        CRASH();
     memcpy((void*)variant->value.stringValue.UTF8Characters, value->UTF8Characters, sizeof(NPUTF8) * value->UTF8Length);
 }
 
@@ -180,7 +117,8 @@ NPObject *_NPN_CreateObject(NPP npp, NPClass* aClass)
             obj = aClass->allocate(npp, aClass);
         else
             obj = (NPObject*)malloc(sizeof(NPObject));
-
+        if (!obj)
+            CRASH();
         obj->_class = aClass;
         obj->referenceCount = 1;
 
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.cpp b/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.cpp
index 3aa218c..c39b3af 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.cpp
@@ -66,7 +66,7 @@ const char* QtClass::name() const
 // and not get wrapped in RuntimeMethod). Also, use this for methods,
 // so we can cache the object and return the same object for the same
 // identifier.
-JSValuePtr QtClass::fallbackObject(ExecState* exec, Instance* inst, const Identifier& identifier)
+JSValue QtClass::fallbackObject(ExecState* exec, Instance* inst, const Identifier& identifier)
 {
     QtInstance* qtinst = static_cast<QtInstance*>(inst);
 
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.h b/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.h
index c83bb0f..19d4207 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.h
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_class.h
@@ -45,7 +45,7 @@ public:
     virtual MethodList methodsNamed(const Identifier&, Instance*) const;
     virtual Field* fieldNamed(const Identifier&, Instance*) const;
 
-    virtual JSValuePtr fallbackObject(ExecState*, Instance*, const Identifier&);
+    virtual JSValue fallbackObject(ExecState*, Instance*, const Identifier&);
 
 private:
     QtClass(const QtClass&); // prohibit copying
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp
index 26323e8..60cf16f 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.cpp
@@ -49,22 +49,30 @@ static InstanceJSObjectMap cachedObjects;
 
 // Derived RuntimeObject
 class QtRuntimeObjectImp : public RuntimeObjectImp {
-    public:
-        QtRuntimeObjectImp(ExecState*, PassRefPtr<Instance>);
-        ~QtRuntimeObjectImp();
-        virtual void invalidate();
-
-        virtual void mark() {
-            QtInstance* instance = static_cast<QtInstance*>(getInternalInstance());
-            if (instance)
-                instance->mark();
-            RuntimeObjectImp::mark();
-        }
+public:
+    QtRuntimeObjectImp(ExecState*, PassRefPtr<Instance>);
+    ~QtRuntimeObjectImp();
+    virtual void invalidate();
+
+    static const ClassInfo s_info;
+
+    virtual void mark()
+    {
+        QtInstance* instance = static_cast<QtInstance*>(getInternalInstance());
+        if (instance)
+            instance->mark();
+        RuntimeObjectImp::mark();
+    }
 
-    protected:
-        void removeFromCache();
+protected:
+    void removeFromCache();
+        
+private:
+    virtual const ClassInfo* classInfo() const { return &s_info; }
 };
 
+const ClassInfo QtRuntimeObjectImp::s_info = { "QtRuntimeObject", &RuntimeObjectImp::s_info, 0, 0 };
+
 QtRuntimeObjectImp::QtRuntimeObjectImp(ExecState* exec, PassRefPtr<Instance> instance)
     : RuntimeObjectImp(exec, WebCore::getDOMStructure<QtRuntimeObjectImp>(exec), instance)
 {
@@ -145,17 +153,23 @@ PassRefPtr<QtInstance> QtInstance::getQtInstance(QObject* o, PassRefPtr<RootObje
     return ret.release();
 }
 
-RuntimeObjectImp* QtInstance::getRuntimeObject(ExecState* exec, PassRefPtr<QtInstance> instance)
+bool QtInstance::getOwnPropertySlot(JSObject* object, ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    JSLock lock(false);
-    QtInstance* qtInstance = instance.get();
-    RuntimeObjectImp* ret = static_cast<RuntimeObjectImp*>(cachedObjects.value(qtInstance));
-    if (!ret) {
-        ret = new (exec) QtRuntimeObjectImp(exec, instance);
-        cachedObjects.insert(qtInstance, ret);
-        ret = static_cast<RuntimeObjectImp*>(cachedObjects.value(qtInstance));
-    }
-    return ret;
+    return object->JSObject::getOwnPropertySlot(exec, propertyName, slot);
+}
+
+void QtInstance::put(JSObject* object, ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    object->JSObject::put(exec, propertyName, value, slot);
+}
+
+QtInstance* QtInstance::getInstance(JSObject* object)
+{
+    if (!object)
+        return 0;
+    if (!object->inherits(&QtRuntimeObjectImp::s_info))
+        return 0;
+    return static_cast<QtInstance*>(static_cast<RuntimeObjectImp*>(object)->getInternalInstance());
 }
 
 Class* QtInstance::getClass() const
@@ -165,6 +179,18 @@ Class* QtInstance::getClass() const
     return m_class;
 }
 
+RuntimeObjectImp* QtInstance::createRuntimeObject(ExecState* exec)
+{
+    JSLock lock(false);
+    RuntimeObjectImp* ret = static_cast<RuntimeObjectImp*>(cachedObjects.value(this));
+    if (!ret) {
+        ret = new (exec) QtRuntimeObjectImp(exec, this);
+        cachedObjects.insert(this, ret);
+        ret = static_cast<RuntimeObjectImp*>(cachedObjects.value(this));
+    }
+    return ret;
+}
+
 void QtInstance::mark()
 {
     if (m_defaultMethod)
@@ -173,9 +199,9 @@ void QtInstance::mark()
         if (val && !val->marked())
             val->mark();
     }
-    foreach(JSValuePtr val, m_children.values()) {
-        if (val && !val->marked())
-            val->mark();
+    foreach(JSValue val, m_children.values()) {
+        if (val && !val.marked())
+            val.mark();
     }
 }
 
@@ -221,14 +247,14 @@ void QtInstance::getPropertyNames(ExecState* exec, PropertyNameArray& array)
     }
 }
 
-JSValuePtr QtInstance::invokeMethod(ExecState*, const MethodList&, const ArgList&)
+JSValue QtInstance::invokeMethod(ExecState*, const MethodList&, const ArgList&)
 {
     // Implemented via fallbackMethod & QtRuntimeMetaMethod::callAsFunction
     return jsUndefined();
 }
 
 
-JSValuePtr QtInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
+JSValue QtInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
     if (hint == PreferString)
         return stringValue(exec);
@@ -237,7 +263,7 @@ JSValuePtr QtInstance::defaultValue(ExecState* exec, PreferredPrimitiveType hint
     return valueOf(exec);
 }
 
-JSValuePtr QtInstance::stringValue(ExecState* exec) const
+JSValue QtInstance::stringValue(ExecState* exec) const
 {
     // Hmm.. see if there is a toString defined
     QByteArray buf;
@@ -281,25 +307,25 @@ JSValuePtr QtInstance::stringValue(ExecState* exec) const
     return jsString(exec, buf.constData());
 }
 
-JSValuePtr QtInstance::numberValue(ExecState* exec) const
+JSValue QtInstance::numberValue(ExecState* exec) const
 {
     return jsNumber(exec, 0);
 }
 
-JSValuePtr QtInstance::booleanValue() const
+JSValue QtInstance::booleanValue() const
 {
     // ECMA 9.2
     return jsBoolean(true);
 }
 
-JSValuePtr QtInstance::valueOf(ExecState* exec) const
+JSValue QtInstance::valueOf(ExecState* exec) const
 {
     return stringValue(exec);
 }
 
 // In qt_runtime.cpp
-JSValuePtr convertQVariantToValue(ExecState*, PassRefPtr<RootObject> root, const QVariant& variant);
-QVariant convertValueToQVariant(ExecState*, JSValuePtr, QMetaType::Type hint, int *distance);
+JSValue convertQVariantToValue(ExecState*, PassRefPtr<RootObject> root, const QVariant& variant);
+QVariant convertValueToQVariant(ExecState*, JSValue, QMetaType::Type hint, int *distance);
 
 const char* QtField::name() const
 {
@@ -312,7 +338,7 @@ const char* QtField::name() const
     return ""; // deleted child object
 }
 
-JSValuePtr QtField::valueFromInstance(ExecState* exec, const Instance* inst) const
+JSValue QtField::valueFromInstance(ExecState* exec, const Instance* inst) const
 {
     const QtInstance* instance = static_cast<const QtInstance*>(inst);
     QObject* obj = instance->getObject();
@@ -329,7 +355,7 @@ JSValuePtr QtField::valueFromInstance(ExecState* exec, const Instance* inst) con
         else if (m_type == DynamicProperty)
             val = obj->property(m_dynamicProperty);
 
-        JSValuePtr ret = convertQVariantToValue(exec, inst->rootObject(), val);
+        JSValue ret = convertQVariantToValue(exec, inst->rootObject(), val);
 
         // Need to save children so we can mark them
         if (m_type == ChildObject)
@@ -337,12 +363,12 @@ JSValuePtr QtField::valueFromInstance(ExecState* exec, const Instance* inst) con
 
         return ret;
     } else {
-        QString msg = QString::fromLatin1("cannot access member `%1' of deleted QObject").arg(QLatin1String(name()));
+        QString msg = QString(QLatin1String("cannot access member `%1' of deleted QObject")).arg(QLatin1String(name()));
         return throwError(exec, GeneralError, msg.toLatin1().constData());
     }
 }
 
-void QtField::setValueToInstance(ExecState* exec, const Instance* inst, JSValuePtr aValue) const
+void QtField::setValueToInstance(ExecState* exec, const Instance* inst, JSValue aValue) const
 {
     if (m_type == ChildObject) // QtScript doesn't allow setting to a named child
         return;
@@ -362,7 +388,7 @@ void QtField::setValueToInstance(ExecState* exec, const Instance* inst, JSValueP
         } else if (m_type == DynamicProperty)
             obj->setProperty(m_dynamicProperty.constData(), val);
     } else {
-        QString msg = QString::fromLatin1("cannot access member `%1' of deleted QObject").arg(QLatin1String(name()));
+        QString msg = QString(QLatin1String("cannot access member `%1' of deleted QObject")).arg(QLatin1String(name()));
         throwError(exec, GeneralError, msg.toLatin1().constData());
     }
 }
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h
index 50d4cf1..590fadf 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_instance.h
@@ -40,29 +40,32 @@ public:
     ~QtInstance();
 
     virtual Class* getClass() const;
+    virtual RuntimeObjectImp* createRuntimeObject(ExecState*);
 
     virtual void begin();
     virtual void end();
 
-    virtual JSValuePtr valueOf(ExecState*) const;
-    virtual JSValuePtr defaultValue(ExecState*, PreferredPrimitiveType) const;
+    virtual JSValue valueOf(ExecState*) const;
+    virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
 
     virtual void mark(); // This isn't inherited
 
-    virtual JSValuePtr invokeMethod(ExecState*, const MethodList&, const ArgList&);
+    virtual JSValue invokeMethod(ExecState*, const MethodList&, const ArgList&);
 
     virtual void getPropertyNames(ExecState*, PropertyNameArray&);
 
-    virtual BindingLanguage getBindingLanguage() const { return QtLanguage; }
-
-    JSValuePtr stringValue(ExecState* exec) const;
-    JSValuePtr numberValue(ExecState* exec) const;
-    JSValuePtr booleanValue() const;
+    JSValue stringValue(ExecState* exec) const;
+    JSValue numberValue(ExecState* exec) const;
+    JSValue booleanValue() const;
 
     QObject* getObject() const { return m_object; }
 
     static PassRefPtr<QtInstance> getQtInstance(QObject*, PassRefPtr<RootObject>, QScriptEngine::ValueOwnership ownership);
-    static RuntimeObjectImp* getRuntimeObject(ExecState* exec, PassRefPtr<QtInstance>);
+
+    virtual bool getOwnPropertySlot(JSObject*, ExecState*, const Identifier&, PropertySlot&);
+    virtual void put(JSObject*, ExecState*, const Identifier&, JSValue, PutPropertySlot&);
+
+    static QtInstance* getInstance(JSObject*);
 
 private:
     static PassRefPtr<QtInstance> create(QObject *instance, PassRefPtr<RootObject> rootObject, QScriptEngine::ValueOwnership ownership)
@@ -78,7 +81,7 @@ private:
     QObject* m_hashkey;
     mutable QHash<QByteArray, JSObject*> m_methods;
     mutable QHash<QString, QtField*> m_fields;
-    mutable QSet<JSValuePtr> m_children;
+    mutable QSet<JSValue> m_children;
     mutable QtRuntimeMetaMethod* m_defaultMethod;
     QScriptEngine::ValueOwnership m_ownership;
 };
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp
index 5a73dc7..161e570 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.cpp
@@ -113,20 +113,20 @@ QDebug operator<<(QDebug dbg, const JSRealType &c)
 }
 #endif
 
-static JSRealType valueRealType(ExecState* exec, JSValuePtr val)
+static JSRealType valueRealType(ExecState* exec, JSValue val)
 {
-    if (val->isNumber())
+    if (val.isNumber())
         return Number;
-    else if (val->isString())
+    else if (val.isString())
         return String;
-    else if (val->isBoolean())
+    else if (val.isBoolean())
         return Boolean;
-    else if (val->isNull())
+    else if (val.isNull())
         return Null;
-    else if (exec->interpreter()->isJSByteArray(val))
+    else if (isJSByteArray(&exec->globalData(), val))
         return JSByteArray;
-    else if (val->isObject()) {
-        JSObject *object = val->toObject(exec);
+    else if (val.isObject()) {
+        JSObject *object = val.toObject(exec);
         if (object->inherits(&RuntimeArray::s_info))  // RuntimeArray 'inherits' from Array, but not in C++
             return RTArray;
         else if (object->inherits(&JSArray::info))
@@ -143,11 +143,14 @@ static JSRealType valueRealType(ExecState* exec, JSValuePtr val)
     return String; // I don't know.
 }
 
-QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Type hint, int *distance, HashSet<JSObject*>* visitedObjects)
+QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type hint, int *distance, HashSet<JSObject*>* visitedObjects)
 {
+    if (!value)
+        return QVariant();
+
     JSObject* object = 0;
-    if (value->isObject()) {
-        object = value->toObject(exec);
+    if (value.isObject()) {
+        object = value.toObject(exec);
         if (visitedObjects->contains(object))
             return QVariant();
 
@@ -222,9 +225,9 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
     switch (hint) {
         case QMetaType::Bool:
             if (type == Object && object->inherits(&BooleanObject::info))
-                ret = QVariant(asBooleanObject(value)->internalValue()->toBoolean(exec));
+                ret = QVariant(asBooleanObject(value)->internalValue().toBoolean(exec));
             else
-                ret = QVariant(value->toBoolean(exec));
+                ret = QVariant(value.toBoolean(exec));
             if (type == Boolean)
                 dist = 0;
             else
@@ -241,7 +244,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
         case QMetaType::UShort:
         case QMetaType::Float:
         case QMetaType::Double:
-            ret = QVariant(value->toNumber(exec));
+            ret = QVariant(value.toNumber(exec));
             ret.convert((QVariant::Type)hint);
             if (type == Number) {
                 switch (hint) {
@@ -279,13 +282,13 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
 
         case QMetaType::QChar:
             if (type == Number || type == Boolean) {
-                ret = QVariant(QChar((ushort)value->toNumber(exec)));
+                ret = QVariant(QChar((ushort)value.toNumber(exec)));
                 if (type == Boolean)
                     dist = 3;
                 else
                     dist = 6;
             } else {
-                UString str = value->toString(exec);
+                UString str = value.toString(exec);
                 ret = QVariant(QChar(str.size() ? *(const ushort*)str.rep()->data() : 0));
                 if (type == String)
                     dist = 3;
@@ -295,12 +298,12 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
             break;
 
         case QMetaType::QString: {
-            if (value->isUndefinedOrNull()) {
+            if (value.isUndefinedOrNull()) {
                 if (distance)
                     *distance = 1;
                 return QString();
             } else {
-                UString ustring = value->toString(exec);
+                UString ustring = value.toString(exec);
                 ret = QVariant(QString::fromUtf16((const ushort*)ustring.rep()->data(),ustring.size()));
                 if (type == String)
                     dist = 0;
@@ -321,7 +324,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                 int objdist = 0;
                 while(it != properties.end()) {
                     if (object->propertyIsEnumerable(exec, *it)) {
-                        JSValuePtr val = object->get(exec, *it);
+                        JSValue val = object->get(exec, *it);
                         QVariant v = convertValueToQVariant(exec, val, QMetaType::Void, &objdist, visitedObjects);
                         if (objdist >= 0) {
                             UString ustring = (*it).ustring();
@@ -345,7 +348,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                 int objdist = 0;
                 qConvDebug() << "converting a " << len << " length Array";
                 for (int i = 0; i < len; ++i) {
-                    JSValuePtr val = rtarray->getConcreteArray()->valueAt(exec, i);
+                    JSValue val = rtarray->getConcreteArray()->valueAt(exec, i);
                     result.append(convertValueToQVariant(exec, val, QMetaType::Void, &objdist, visitedObjects));
                     if (objdist == -1) {
                         qConvDebug() << "Failed converting element at index " << i;
@@ -364,7 +367,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                 int objdist = 0;
                 qConvDebug() << "converting a " << len << " length Array";
                 for (int i = 0; i < len; ++i) {
-                    JSValuePtr val = array->get(exec, i);
+                    JSValue val = array->get(exec, i);
                     result.append(convertValueToQVariant(exec, val, QMetaType::Void, &objdist, visitedObjects));
                     if (objdist == -1) {
                         qConvDebug() << "Failed converting element at index " << i;
@@ -398,8 +401,8 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                 QStringList result;
                 int len = rtarray->getLength();
                 for (int i = 0; i < len; ++i) {
-                    JSValuePtr val = rtarray->getConcreteArray()->valueAt(exec, i);
-                    UString ustring = val->toString(exec);
+                    JSValue val = rtarray->getConcreteArray()->valueAt(exec, i);
+                    UString ustring = val.toString(exec);
                     QString qstring = QString::fromUtf16((const ushort*)ustring.rep()->data(),ustring.size());
 
                     result.append(qstring);
@@ -412,8 +415,8 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                 QStringList result;
                 int len = array->length();
                 for (int i = 0; i < len; ++i) {
-                    JSValuePtr val = array->get(exec, i);
-                    UString ustring = val->toString(exec);
+                    JSValue val = array->get(exec, i);
+                    UString ustring = val.toString(exec);
                     QString qstring = QString::fromUtf16((const ushort*)ustring.rep()->data(),ustring.size());
 
                     result.append(qstring);
@@ -422,7 +425,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                 ret = QVariant(result);
             } else {
                 // Make a single length array
-                UString ustring = value->toString(exec);
+                UString ustring = value.toString(exec);
                 QString qstring = QString::fromUtf16((const ushort*)ustring.rep()->data(),ustring.size());
                 QStringList result;
                 result.append(qstring);
@@ -434,11 +437,11 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
 
         case QMetaType::QByteArray: {
             if (type == JSByteArray) {
-                ByteArray* arr = asByteArray(value)->storage();
+                WTF::ByteArray* arr = asByteArray(value)->storage();
                 ret = QVariant(QByteArray(reinterpret_cast<const char*>(arr->data()), arr->length()));
                 dist = 0;
             } else {
-                UString ustring = value->toString(exec);
+                UString ustring = value.toString(exec);
                 ret = QVariant(QString::fromUtf16((const ushort*)ustring.rep()->data(),ustring.size()).toLatin1());
                 if (type == String)
                     dist = 5;
@@ -453,7 +456,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
         case QMetaType::QTime:
             if (type == Date) {
                 DateInstance* date = static_cast<DateInstance*>(object);
-                GregorianDateTime gdt;
+                WTF::GregorianDateTime gdt;
                 date->getUTCTime(gdt);
                 if (hint == QMetaType::QDateTime) {
                     ret = QDateTime(QDate(gdt.year + 1900, gdt.month + 1, gdt.monthDay), QTime(gdt.hour, gdt.minute, gdt.second), Qt::UTC);
@@ -466,8 +469,8 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                     dist = 2;
                 }
             } else if (type == Number) {
-                double b = value->toNumber(exec);
-                GregorianDateTime gdt;
+                double b = value.toNumber(exec);
+                WTF::GregorianDateTime gdt;
                 msToGregorianDateTime(b, true, gdt);
                 if (hint == QMetaType::QDateTime) {
                     ret = QDateTime(QDate(gdt.year + 1900, gdt.month + 1, gdt.monthDay), QTime(gdt.hour, gdt.minute, gdt.second), Qt::UTC);
@@ -480,7 +483,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                     dist = 10;
                 }
             } else if (type == String) {
-                UString ustring = value->toString(exec);
+                UString ustring = value.toString(exec);
                 QString qstring = QString::fromUtf16((const ushort*)ustring.rep()->data(),ustring.size());
 
                 if (hint == QMetaType::QDateTime) {
@@ -529,7 +532,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                 RegExpObject *re = static_cast<RegExpObject*>(object);
 */
                 // Attempt to convert.. a bit risky
-                UString ustring = value->toString(exec);
+                UString ustring = value.toString(exec);
                 QString qstring = QString::fromUtf16((const ushort*)ustring.rep()->data(),ustring.size());
 
                 // this is of the form '/xxxxxx/i'
@@ -549,7 +552,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                     qConvDebug() << "couldn't parse a JS regexp";
                 }
             } else if (type == String) {
-                UString ustring = value->toString(exec);
+                UString ustring = value.toString(exec);
                 QString qstring = QString::fromUtf16((const ushort*)ustring.rep()->data(),ustring.size());
 
                 QRegExp re(qstring);
@@ -562,7 +565,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
 
         case QMetaType::QObjectStar:
             if (type == QObj) {
-                QtInstance* qtinst = static_cast<QtInstance*>(Instance::getInstance(object, Instance::QtLanguage));
+                QtInstance* qtinst = QtInstance::getInstance(object);
                 if (qtinst) {
                     if (qtinst->getObject()) {
                         qConvDebug() << "found instance, with object:" << (void*) qtinst->getObject();
@@ -586,7 +589,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
 
         case QMetaType::VoidStar:
             if (type == QObj) {
-                QtInstance* qtinst = static_cast<QtInstance*>(Instance::getInstance(object, Instance::QtLanguage));
+                QtInstance* qtinst = QtInstance::getInstance(object);
                 if (qtinst) {
                     if (qtinst->getObject()) {
                         qConvDebug() << "found instance, with object:" << (void*) qtinst->getObject();
@@ -605,7 +608,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
             } else if (type == Number) {
                 // I don't think that converting a double to a pointer is a wise
                 // move.  Except maybe 0.
-                qConvDebug() << "got number for void * - not converting, seems unsafe:" << value->toNumber(exec);
+                qConvDebug() << "got number for void * - not converting, seems unsafe:" << value.toNumber(exec);
             } else {
                 qConvDebug() << "void* - unhandled type" << type;
             }
@@ -621,7 +624,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                     QObjectList result;
                     int len = rtarray->getLength();
                     for (int i = 0; i < len; ++i) {
-                        JSValuePtr val = rtarray->getConcreteArray()->valueAt(exec, i);
+                        JSValue val = rtarray->getConcreteArray()->valueAt(exec, i);
                         int itemdist = -1;
                         QVariant item = convertValueToQVariant(exec, val, QMetaType::QObjectStar, &itemdist, visitedObjects);
                         if (itemdist >= 0)
@@ -635,12 +638,12 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                         ret = QVariant::fromValue(result);
                     }
                 } else if (type == Array) {
-                    JSObject* object = value->toObject(exec);
+                    JSObject* object = value.toObject(exec);
                     JSArray* array = static_cast<JSArray *>(object);
                     QObjectList result;
                     int len = array->length();
                     for (int i = 0; i < len; ++i) {
-                        JSValuePtr val = array->get(exec, i);
+                        JSValue val = array->get(exec, i);
                         int itemdist = -1;
                         QVariant item = convertValueToQVariant(exec, val, QMetaType::QObjectStar, &itemdist, visitedObjects);
                         if (itemdist >= 0)
@@ -672,7 +675,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                     QList<int> result;
                     int len = rtarray->getLength();
                     for (int i = 0; i < len; ++i) {
-                        JSValuePtr val = rtarray->getConcreteArray()->valueAt(exec, i);
+                        JSValue val = rtarray->getConcreteArray()->valueAt(exec, i);
                         int itemdist = -1;
                         QVariant item = convertValueToQVariant(exec, val, QMetaType::Int, &itemdist, visitedObjects);
                         if (itemdist >= 0)
@@ -691,7 +694,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                     QList<int> result;
                     int len = array->length();
                     for (int i = 0; i < len; ++i) {
-                        JSValuePtr val = array->get(exec, i);
+                        JSValue val = array->get(exec, i);
                         int itemdist = -1;
                         QVariant item = convertValueToQVariant(exec, val, QMetaType::Int, &itemdist, visitedObjects);
                         if (itemdist >= 0)
@@ -717,7 +720,7 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
                 }
                 break;
             } else if (hint == (QMetaType::Type) qMetaTypeId<QVariant>()) {
-                if (value->isUndefinedOrNull()) {
+                if (value.isUndefinedOrNull()) {
                     if (distance)
                         *distance = 1;
                     return QVariant();
@@ -746,13 +749,13 @@ QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Ty
     return ret;
 }
 
-QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Type hint, int *distance)
+QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type hint, int *distance)
 {
     HashSet<JSObject*> visitedObjects;
     return convertValueToQVariant(exec, value, hint, distance, &visitedObjects);
 }
 
-JSValuePtr convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, const QVariant& variant)
+JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, const QVariant& variant)
 {
     // Variants with QObject * can be isNull but not a null pointer
     // An empty QString variant is also null
@@ -820,7 +823,7 @@ JSValuePtr convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root,
         }
 
         // Dates specified this way are in local time (we convert DateTimes above)
-        GregorianDateTime dt;
+        WTF::GregorianDateTime dt;
         dt.year = date.year() - 1900;
         dt.month = date.month() - 1;
         dt.monthDay = date.day();
@@ -828,7 +831,7 @@ JSValuePtr convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root,
         dt.minute = time.minute();
         dt.second = time.second();
         dt.isDST = -1;
-        double ms = JSC::gregorianDateTimeToMS(dt, time.msec(), /*inputIsUTC*/ false);
+        double ms = WTF::gregorianDateTimeToMS(dt, time.msec(), /*inputIsUTC*/ false);
 
         DateInstance* instance = new (exec) DateInstance(exec->lexicalGlobalObject()->dateStructure());
         instance->setInternalValue(jsNumber(exec, trunc(ms)));
@@ -837,14 +840,14 @@ JSValuePtr convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root,
 
     if (type == QMetaType::QByteArray) {
         QByteArray qtByteArray = variant.value<QByteArray>();
-        WTF::RefPtr<ByteArray> wtfByteArray = ByteArray::create(qtByteArray.length());
+        WTF::RefPtr<WTF::ByteArray> wtfByteArray = WTF::ByteArray::create(qtByteArray.length());
         qMemCopy(wtfByteArray->data(), qtByteArray.constData(), qtByteArray.length());
         return new (exec) JSC::JSByteArray(exec, JSC::JSByteArray::createStructure(jsNull()), wtfByteArray.get());
     }
 
     if (type == QMetaType::QObjectStar || type == QMetaType::QWidgetStar) {
         QObject* obj = variant.value<QObject*>();
-        return Instance::createRuntimeObject(exec, QtInstance::getQtInstance(obj, root, QScriptEngine::QtOwnership));
+        return QtInstance::getQtInstance(obj, root, QScriptEngine::QtOwnership)->createRuntimeObject(exec);
     }
 
     if (type == QMetaType::QVariantMap) {
@@ -854,7 +857,7 @@ JSValuePtr convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root,
         QVariantMap::const_iterator i = map.constBegin();
         while (i != map.constEnd()) {
             QString s = i.key();
-            JSValuePtr val = convertQVariantToValue(exec, root, i.value());
+            JSValue val = convertQVariantToValue(exec, root, i.value());
             if (val) {
                 PutPropertySlot slot;
                 ret->put(exec, Identifier(exec, (const UChar *)s.constData(), s.length()), val, slot);
@@ -1181,7 +1184,7 @@ static int findMethodIndex(ExecState* exec,
         bool converted = true;
         int matchDistance = 0;
         for (int i = 0; converted && i < types.count() - 1; ++i) {
-            JSValuePtr arg = i < jsArgs.size() ? jsArgs.at(exec, i) : jsUndefined();
+            JSValue arg = i < jsArgs.size() ? jsArgs.at(i) : jsUndefined();
 
             int argdistance = -1;
             QVariant v = convertValueToQVariant(exec, arg, types.at(i+1).typeId(), &argdistance);
@@ -1333,7 +1336,7 @@ void QtRuntimeMetaMethod::mark()
         d->m_disconnect->mark();
 }
 
-JSValuePtr QtRuntimeMetaMethod::call(ExecState* exec, JSObject* functionObject, JSValuePtr thisValue, const ArgList& args)
+JSValue QtRuntimeMetaMethod::call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args)
 {
     QtRuntimeMetaMethodData* d = static_cast<QtRuntimeMetaMethod *>(functionObject)->d_func();
 
@@ -1391,13 +1394,13 @@ bool QtRuntimeMetaMethod::getOwnPropertySlot(ExecState* exec, const Identifier&
     return QtRuntimeMethod::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-JSValuePtr QtRuntimeMetaMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue QtRuntimeMetaMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     // QtScript always returns 0
     return jsNumber(exec, 0);
 }
 
-JSValuePtr QtRuntimeMetaMethod::connectGetter(ExecState* exec, const Identifier& ident, const PropertySlot& slot)
+JSValue QtRuntimeMetaMethod::connectGetter(ExecState* exec, const Identifier& ident, const PropertySlot& slot)
 {
     QtRuntimeMetaMethod* thisObj = static_cast<QtRuntimeMetaMethod*>(asObject(slot.slotBase()));
     QW_DS(QtRuntimeMetaMethod, thisObj);
@@ -1407,7 +1410,7 @@ JSValuePtr QtRuntimeMetaMethod::connectGetter(ExecState* exec, const Identifier&
     return d->m_connect;
 }
 
-JSValuePtr QtRuntimeMetaMethod::disconnectGetter(ExecState* exec, const Identifier& ident, const PropertySlot& slot)
+JSValue QtRuntimeMetaMethod::disconnectGetter(ExecState* exec, const Identifier& ident, const PropertySlot& slot)
 {
     QtRuntimeMetaMethod* thisObj = static_cast<QtRuntimeMetaMethod*>(asObject(slot.slotBase()));
     QW_DS(QtRuntimeMetaMethod, thisObj);
@@ -1431,7 +1434,7 @@ QtRuntimeConnectionMethod::QtRuntimeConnectionMethod(ExecState* exec, const Iden
     d->m_isConnect = isConnect;
 }
 
-JSValuePtr QtRuntimeConnectionMethod::call(ExecState* exec, JSObject* functionObject, JSValuePtr thisValue, const ArgList& args)
+JSValue QtRuntimeConnectionMethod::call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args)
 {
     QtRuntimeConnectionMethodData* d = static_cast<QtRuntimeConnectionMethod *>(functionObject)->d_func();
 
@@ -1454,7 +1457,7 @@ JSValuePtr QtRuntimeConnectionMethod::call(ExecState* exec, JSObject* functionOb
 
         if (signalIndex != -1) {
             if (args.size() == 1) {
-                funcObject = args.at(exec, 0)->toObject(exec);
+                funcObject = args.at(0).toObject(exec);
                 CallData callData;
                 if (funcObject->getCallData(callData) == CallTypeNone) {
                     if (d->m_isConnect)
@@ -1463,24 +1466,24 @@ JSValuePtr QtRuntimeConnectionMethod::call(ExecState* exec, JSObject* functionOb
                         return throwError(exec, TypeError, "QtMetaMethod.disconnect: target is not a function");
                 }
             } else if (args.size() >= 2) {
-                if (args.at(exec, 0)->isObject()) {
-                    thisObject = args.at(exec, 0)->toObject(exec);
+                if (args.at(0).isObject()) {
+                    thisObject = args.at(0).toObject(exec);
 
                     // Get the actual function to call
-                    JSObject *asObj = args.at(exec, 1)->toObject(exec);
+                    JSObject *asObj = args.at(1).toObject(exec);
                     CallData callData;
                     if (asObj->getCallData(callData) != CallTypeNone) {
                         // Function version
                         funcObject = asObj;
                     } else {
                         // Convert it to a string
-                        UString funcName = args.at(exec, 1)->toString(exec);
+                        UString funcName = args.at(1).toString(exec);
                         Identifier funcIdent(exec, funcName);
 
                         // ### DropAllLocks
                         // This is resolved at this point in QtScript
-                        JSValuePtr val = thisObject->get(exec, funcIdent);
-                        JSObject* asFuncObj = val->toObject(exec);
+                        JSValue val = thisObject->get(exec, funcIdent);
+                        JSObject* asFuncObj = val.toObject(exec);
 
                         if (asFuncObj->getCallData(callData) != CallTypeNone) {
                             funcObject = asFuncObj;
@@ -1515,7 +1518,7 @@ JSValuePtr QtRuntimeConnectionMethod::call(ExecState* exec, JSObject* functionOb
                 bool ok = QMetaObject::connect(sender, signalIndex, conn, conn->metaObject()->methodOffset());
                 if (!ok) {
                     delete conn;
-                    QString msg = QString::fromLatin1("QtMetaMethod.connect: failed to connect to %1::%2()")
+                    QString msg = QString(QLatin1String("QtMetaMethod.connect: failed to connect to %1::%2()"))
                             .arg(QLatin1String(sender->metaObject()->className()))
                             .arg(QLatin1String(d->m_signature));
                     return throwError(exec, GeneralError, msg.toLatin1().constData());
@@ -1541,14 +1544,14 @@ JSValuePtr QtRuntimeConnectionMethod::call(ExecState* exec, JSObject* functionOb
                 }
 
                 if (!ret) {
-                    QString msg = QString::fromLatin1("QtMetaMethod.disconnect: failed to disconnect from %1::%2()")
+                    QString msg = QString(QLatin1String("QtMetaMethod.disconnect: failed to disconnect from %1::%2()"))
                             .arg(QLatin1String(sender->metaObject()->className()))
                             .arg(QLatin1String(d->m_signature));
                     return throwError(exec, GeneralError, msg.toLatin1().constData());
                 }
             }
         } else {
-            QString msg = QString::fromLatin1("QtMetaMethod.%1: %2::%3() is not a signal")
+            QString msg = QString(QLatin1String("QtMetaMethod.%1: %2::%3() is not a signal"))
                     .arg(QLatin1String(d->m_isConnect ? "connect": "disconnect"))
                     .arg(QLatin1String(sender->metaObject()->className()))
                     .arg(QLatin1String(d->m_signature));
@@ -1577,7 +1580,7 @@ bool QtRuntimeConnectionMethod::getOwnPropertySlot(ExecState* exec, const Identi
     return QtRuntimeMethod::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-JSValuePtr QtRuntimeConnectionMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue QtRuntimeConnectionMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     // we have one formal argument, and one optional
     return jsNumber(exec, 1);
@@ -1675,9 +1678,9 @@ void QtConnectionObject::execute(void **argv)
                 ExecState* exec = globalobj->globalExec();
                 if (exec) {
                     // Build the argument list (up to the formal argument length of the slot)
-                    ArgList l;
+                    MarkedArgumentBuffer l;
                     // ### DropAllLocks?
-                    int funcArgC = m_funcObject->get(exec, exec->propertyNames().length)->toInt32(exec);
+                    int funcArgC = m_funcObject->get(exec, exec->propertyNames().length).toInt32(exec);
                     int argTotal = qMax(funcArgC, argc);
                     for(int i=0; i < argTotal; i++) {
                         if (i < argc) {
@@ -1693,7 +1696,7 @@ void QtConnectionObject::execute(void **argv)
                     if (m_funcObject->inherits(&JSFunction::info)) {
                         JSFunction* fimp = static_cast<JSFunction*>(m_funcObject.get());
 
-                        JSObject* qt_sender = Instance::createRuntimeObject(exec, QtInstance::getQtInstance(sender(), ro, QScriptEngine::QtOwnership));
+                        JSObject* qt_sender = QtInstance::getQtInstance(sender(), ro, QScriptEngine::QtOwnership)->createRuntimeObject(exec);
                         JSObject* wrapper = new (exec) JSObject(JSObject::createStructure(jsNull()));
                         PutPropertySlot slot;
                         wrapper->put(exec, Identifier(exec, "__qt_sender__"), qt_sender, slot);
@@ -1743,7 +1746,7 @@ template <typename T> RootObject* QtArray<T>::rootObject() const
     return _rootObject && _rootObject->isValid() ? _rootObject.get() : 0;
 }
 
-template <typename T> void QtArray<T>::setValueAt(ExecState* exec, unsigned index, JSValuePtr aValue) const
+template <typename T> void QtArray<T>::setValueAt(ExecState* exec, unsigned index, JSValue aValue) const
 {
     // QtScript sets the value, but doesn't forward it to the original source
     // (e.g. if you do 'object.intList[5] = 6', the object is not updated, but the
@@ -1757,7 +1760,7 @@ template <typename T> void QtArray<T>::setValueAt(ExecState* exec, unsigned inde
 }
 
 
-template <typename T> JSValuePtr QtArray<T>::valueAt(ExecState *exec, unsigned int index) const
+template <typename T> JSValue QtArray<T>::valueAt(ExecState *exec, unsigned int index) const
 {
     if (index < m_length) {
         T val = m_list.at(index);
diff --git a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
index 7912a2b9..72d93eb 100644
--- a/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
+++ b/src/3rdparty/webkit/WebCore/bridge/qt/qt_runtime.h
@@ -56,8 +56,8 @@ public:
         : m_type(ChildObject), m_childObject(child)
         {}
 
-    virtual JSValuePtr valueFromInstance(ExecState*, const Instance*) const;
-    virtual void setValueToInstance(ExecState*, const Instance*, JSValuePtr) const;
+    virtual JSValue valueFromInstance(ExecState*, const Instance*) const;
+    virtual void setValueToInstance(ExecState*, const Instance*, JSValue) const;
     virtual const char* name() const;
     QtFieldType fieldType() const {return m_type;}
 private:
@@ -98,8 +98,8 @@ public:
 
     RootObject* rootObject() const;
 
-    virtual void setValueAt(ExecState*, unsigned index, JSValuePtr) const;
-    virtual JSValuePtr valueAt(ExecState*, unsigned index) const;
+    virtual void setValueAt(ExecState*, unsigned index, JSValue) const;
+    virtual JSValue valueAt(ExecState*, unsigned index) const;
     virtual unsigned int getLength() const {return m_length;}
 
 private:
@@ -144,12 +144,12 @@ public:
 
     static const ClassInfo s_info;
 
-    static FunctionPrototype* createPrototype(ExecState* exec)
+    static FunctionPrototype* createPrototype(ExecState*, JSGlobalObject* globalObject)
     {
-        return exec->lexicalGlobalObject()->functionPrototype();
+        return globalObject->functionPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+    static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
         return Structure::create(prototype, TypeInfo(ObjectType));
     }
@@ -174,10 +174,10 @@ protected:
 
 private:
     virtual CallType getCallData(CallData&);
-    static JSValuePtr call(ExecState* exec, JSObject* functionObject, JSValuePtr thisValue, const ArgList& args);
-    static JSValuePtr lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValuePtr connectGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValuePtr disconnectGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue JSC_HOST_CALL call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args);
+    static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue connectGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue disconnectGetter(ExecState*, const Identifier&, const PropertySlot&);
 };
 
 class QtConnectionObject;
@@ -193,8 +193,8 @@ protected:
 
 private:
     virtual CallType getCallData(CallData&);
-    static JSValuePtr call(ExecState* exec, JSObject* functionObject, JSValuePtr thisValue, const ArgList& args);
-    static JSValuePtr lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue JSC_HOST_CALL call(ExecState* exec, JSObject* functionObject, JSValue thisValue, const ArgList& args);
+    static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
     static QMultiMap<QObject *, QtConnectionObject *> connections;
     friend class QtConnectionObject;
 };
@@ -223,7 +223,8 @@ private:
     ProtectedPtr<JSObject> m_funcObject;
 };
 
-QVariant convertValueToQVariant(ExecState* exec, JSValuePtr value, QMetaType::Type hint, int *distance);
+QVariant convertValueToQVariant(ExecState* exec, JSValue value, QMetaType::Type hint, int *distance);
+JSValue convertQVariantToValue(ExecState* exec, PassRefPtr<RootObject> root, const QVariant& variant);
 
 } // namespace Bindings
 } // namespace JSC
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime.cpp b/src/3rdparty/webkit/WebCore/bridge/runtime.cpp
index 3b40825..d6b6962 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime.cpp
@@ -78,39 +78,11 @@ void Instance::end()
     virtualEnd();
 }
 
-JSValuePtr Instance::getValueOfField(ExecState* exec, const Field* aField) const
+RuntimeObjectImp* Instance::createRuntimeObject(ExecState* exec)
 {
-    return aField->valueFromInstance(exec, this);
-}
-
-void Instance::setValueOfField(ExecState* exec, const Field* aField, JSValuePtr aValue) const
-{
-    aField->setValueToInstance(exec, this, aValue);
-}
-
-RuntimeObjectImp* Instance::createRuntimeObject(ExecState* exec, PassRefPtr<Instance> instance)
-{
-#if PLATFORM(QT)
-    if (instance->getBindingLanguage() == QtLanguage)
-        return QtInstance::getRuntimeObject(exec, static_cast<QtInstance*>(instance.get()));
-#endif
     JSLock lock(false);
-
-    return new (exec) RuntimeObjectImp(exec, instance);
-}
-
-Instance* Instance::getInstance(JSObject* object, BindingLanguage language)
-{
-    if (!object)
-        return 0;
-    if (!object->inherits(&RuntimeObjectImp::s_info))
-        return 0;
-    Instance* instance = static_cast<RuntimeObjectImp*>(object)->getInternalInstance();
-    if (!instance)
-        return 0;
-    if (instance->getBindingLanguage() != language)
-        return 0;
-    return instance;
+    
+    return new (exec) RuntimeObjectImp(exec, this);
 }
 
 RootObject* Instance::rootObject() const 
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime.h b/src/3rdparty/webkit/WebCore/bridge/runtime.h
index 3346c74..72736d4 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime.h
@@ -49,16 +49,14 @@ typedef Vector<Method*> MethodList;
 
 class Field {
 public:
-    virtual const char* name() const = 0;
-    virtual JSValuePtr valueFromInstance(ExecState*, const Instance*) const = 0;
-    virtual void setValueToInstance(ExecState*, const Instance*, JSValuePtr) const = 0;
+    virtual JSValue valueFromInstance(ExecState*, const Instance*) const = 0;
+    virtual void setValueToInstance(ExecState*, const Instance*, JSValue) const = 0;
 
     virtual ~Field() { }
 };
 
 class Method : Noncopyable {
 public:
-    virtual const char *name() const = 0;
     virtual int numParameters() const = 0;
         
     virtual ~Method() { }
@@ -66,10 +64,9 @@ public:
 
 class Class : Noncopyable {
 public:
-    virtual const char* name() const = 0;
     virtual MethodList methodsNamed(const Identifier&, Instance*) const = 0;
     virtual Field* fieldNamed(const Identifier&, Instance*) const = 0;
-    virtual JSValuePtr fallbackObject(ExecState*, Instance*, const Identifier&) { return jsUndefined(); }
+    virtual JSValue fallbackObject(ExecState*, Instance*, const Identifier&) { return jsUndefined(); }
 
     virtual ~Class() { }
 };
@@ -78,27 +75,11 @@ typedef void (*KJSDidExecuteFunctionPtr)(ExecState*, JSObject* rootObject);
 
 class Instance : public RefCounted<Instance> {
 public:
-    typedef enum {
-#if ENABLE(MAC_JAVA_BRIDGE)
-        JavaLanguage,
-#endif
-#if PLATFORM(MAC)
-        ObjectiveCLanguage,
-#endif
-        CLanguage
-#if PLATFORM(QT)
-        , QtLanguage
-#endif
-    } BindingLanguage;
-
     Instance(PassRefPtr<RootObject>);
 
     static void setDidExecuteFunction(KJSDidExecuteFunctionPtr func);
     static KJSDidExecuteFunctionPtr didExecuteFunction();
 
-    static RuntimeObjectImp* createRuntimeObject(ExecState*, PassRefPtr<Instance>);
-    static Instance* getInstance(JSObject*, BindingLanguage);
-
     // These functions are called before and after the main entry points into
     // the native implementations.  They can be used to establish and cleanup
     // any needed state.
@@ -106,32 +87,31 @@ public:
     void end();
     
     virtual Class *getClass() const = 0;
+    virtual RuntimeObjectImp* createRuntimeObject(ExecState*);
     
-    virtual JSValuePtr getValueOfField(ExecState*, const Field*) const;
-    virtual JSValuePtr getValueOfUndefinedField(ExecState*, const Identifier&) const { return jsUndefined(); }
-    virtual void setValueOfField(ExecState*, const Field*, JSValuePtr) const;
-    virtual bool supportsSetValueOfUndefinedField() { return false; }
-    virtual void setValueOfUndefinedField(ExecState*, const Identifier&, JSValuePtr) {}
+    // Returns false if the value was not set successfully.
+    virtual bool setValueOfUndefinedField(ExecState*, const Identifier&, JSValue) { return false; }
 
-    virtual JSValuePtr invokeMethod(ExecState*, const MethodList&, const ArgList& args) = 0;
+    virtual JSValue invokeMethod(ExecState*, const MethodList&, const ArgList& args) = 0;
 
     virtual bool supportsInvokeDefaultMethod() const { return false; }
-    virtual JSValuePtr invokeDefaultMethod(ExecState*, const ArgList&) { return jsUndefined(); }
+    virtual JSValue invokeDefaultMethod(ExecState*, const ArgList&) { return jsUndefined(); }
     
     virtual bool supportsConstruct() const { return false; }
-    virtual JSValuePtr invokeConstruct(ExecState*, const ArgList&) { return noValue(); }
+    virtual JSValue invokeConstruct(ExecState*, const ArgList&) { return JSValue(); }
     
     virtual void getPropertyNames(ExecState*, PropertyNameArray&) { }
 
-    virtual JSValuePtr defaultValue(ExecState*, PreferredPrimitiveType) const = 0;
+    virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const = 0;
     
-    virtual JSValuePtr valueOf(ExecState* exec) const { return jsString(exec, getClass()->name()); }
+    virtual JSValue valueOf(ExecState* exec) const = 0;
     
     RootObject* rootObject() const;
     
     virtual ~Instance();
 
-    virtual BindingLanguage getBindingLanguage() const = 0;
+    virtual bool getOwnPropertySlot(JSObject*, ExecState*, const Identifier&, PropertySlot&) { return false; }
+    virtual void put(JSObject*, ExecState*, const Identifier&, JSValue, PutPropertySlot&) { }
 
 protected:
     virtual void virtualBegin() { }
@@ -145,8 +125,8 @@ public:
     Array(PassRefPtr<RootObject>);
     virtual ~Array();
     
-    virtual void setValueAt(ExecState *, unsigned index, JSValuePtr) const = 0;
-    virtual JSValuePtr valueAt(ExecState *, unsigned index) const = 0;
+    virtual void setValueAt(ExecState *, unsigned index, JSValue) const = 0;
+    virtual JSValue valueAt(ExecState *, unsigned index) const = 0;
     virtual unsigned int getLength() const = 0;
 
 protected:
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_array.cpp b/src/3rdparty/webkit/WebCore/bridge/runtime_array.cpp
index 1979432..fead83a 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_array.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_array.cpp
@@ -42,13 +42,13 @@ RuntimeArray::RuntimeArray(ExecState* exec, Bindings::Array* a)
 {
 }
 
-JSValuePtr RuntimeArray::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue RuntimeArray::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     RuntimeArray* thisObj = static_cast<RuntimeArray*>(asObject(slot.slotBase()));
     return jsNumber(exec, thisObj->getLength());
 }
 
-JSValuePtr RuntimeArray::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue RuntimeArray::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     RuntimeArray* thisObj = static_cast<RuntimeArray*>(asObject(slot.slotBase()));
     return thisObj->getConcreteArray()->valueAt(exec, slot.index());
@@ -83,7 +83,7 @@ bool RuntimeArray::getOwnPropertySlot(ExecState *exec, unsigned index, PropertyS
     return JSObject::getOwnPropertySlot(exec, index, slot);
 }
 
-void RuntimeArray::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void RuntimeArray::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (propertyName == exec->propertyNames().length) {
         throwError(exec, RangeError);
@@ -100,7 +100,7 @@ void RuntimeArray::put(ExecState* exec, const Identifier& propertyName, JSValueP
     JSObject::put(exec, propertyName, value, slot);
 }
 
-void RuntimeArray::put(ExecState* exec, unsigned index, JSValuePtr value)
+void RuntimeArray::put(ExecState* exec, unsigned index, JSValue value)
 {
     if (index >= getLength()) {
         throwError(exec, RangeError);
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_array.h b/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
index 1ea47a4..5a86e9d 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_array.h
@@ -37,8 +37,8 @@ public:
     
     virtual bool getOwnPropertySlot(ExecState *, const Identifier&, PropertySlot&);
     virtual bool getOwnPropertySlot(ExecState *, unsigned, PropertySlot&);
-    virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
-    virtual void put(ExecState*, unsigned propertyName, JSValuePtr);
+    virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
+    virtual void put(ExecState*, unsigned propertyName, JSValue);
     
     virtual bool deleteProperty(ExecState *exec, const Identifier &propertyName);
     virtual bool deleteProperty(ExecState *exec, unsigned propertyName);
@@ -51,19 +51,19 @@ public:
 
     static const ClassInfo s_info;
 
-    static ArrayPrototype* createPrototype(ExecState* exec)
+    static ArrayPrototype* createPrototype(ExecState*, JSGlobalObject* globalObject)
     {
-        return exec->lexicalGlobalObject()->arrayPrototype();
+        return globalObject->arrayPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+    static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
         return Structure::create(prototype, TypeInfo(ObjectType));
     }
 
 private:
-    static JSValuePtr lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValuePtr indexGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue indexGetter(ExecState*, const Identifier&, const PropertySlot&);
 
     OwnPtr<Bindings::Array> _array;
 };
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_method.cpp b/src/3rdparty/webkit/WebCore/bridge/runtime_method.cpp
index 014541d..30a3581 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_method.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_method.cpp
@@ -47,7 +47,7 @@ RuntimeMethod::RuntimeMethod(ExecState* exec, const Identifier& ident, Bindings:
 {
 }
 
-JSValuePtr RuntimeMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue RuntimeMethod::lengthGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     RuntimeMethod* thisObj = static_cast<RuntimeMethod*>(asObject(slot.slotBase()));
 
@@ -70,7 +70,7 @@ bool RuntimeMethod::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return InternalFunction::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-static JSValuePtr callRuntimeMethod(ExecState* exec, JSObject* function, JSValuePtr thisValue, const ArgList& args)
+static JSValue JSC_HOST_CALL callRuntimeMethod(ExecState* exec, JSObject* function, JSValue thisValue, const ArgList& args)
 {
     RuntimeMethod* method = static_cast<RuntimeMethod*>(function);
 
@@ -79,13 +79,13 @@ static JSValuePtr callRuntimeMethod(ExecState* exec, JSObject* function, JSValue
     
     RuntimeObjectImp* imp;
 
-    if (thisValue->isObject(&RuntimeObjectImp::s_info)) {
+    if (thisValue.isObject(&RuntimeObjectImp::s_info)) {
         imp = static_cast<RuntimeObjectImp*>(asObject(thisValue));
     } else {
         // If thisObj is the DOM object for a plugin, get the corresponding
         // runtime object from the DOM object.
-        JSValuePtr value = thisValue->get(exec, Identifier(exec, "__apple_runtime_object"));
-        if (value->isObject(&RuntimeObjectImp::s_info))    
+        JSValue value = thisValue.get(exec, Identifier(exec, "__apple_runtime_object"));
+        if (value.isObject(&RuntimeObjectImp::s_info))    
             imp = static_cast<RuntimeObjectImp*>(asObject(value));
         else
             return throwError(exec, TypeError);
@@ -96,7 +96,7 @@ static JSValuePtr callRuntimeMethod(ExecState* exec, JSObject* function, JSValue
         return RuntimeObjectImp::throwInvalidAccessError(exec);
         
     instance->begin();
-    JSValuePtr result = instance->invokeMethod(exec, *method->methods(), args);
+    JSValue result = instance->invokeMethod(exec, *method->methods(), args);
     instance->end();
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_method.h b/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
index bb983f9..5333c14 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_method.h
@@ -40,18 +40,18 @@ public:
 
     static const ClassInfo s_info;
 
-    static FunctionPrototype* createPrototype(ExecState* exec)
+    static FunctionPrototype* createPrototype(ExecState*, JSGlobalObject* globalObject)
     {
-        return exec->lexicalGlobalObject()->functionPrototype();
+        return globalObject->functionPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+    static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
         return Structure::create(prototype, TypeInfo(ObjectType, ImplementsHasInstance));
     }
 
 private:
-    static JSValuePtr lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue lengthGetter(ExecState*, const Identifier&, const PropertySlot&);
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual CallType getCallData(CallData&);
 
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp b/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp
index 3a2a93a..79afd3f 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_object.cpp
@@ -66,7 +66,7 @@ void RuntimeObjectImp::invalidate()
     instance = 0;
 }
 
-JSValuePtr RuntimeObjectImp::fallbackObjectGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue RuntimeObjectImp::fallbackObjectGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
     RefPtr<Instance> instance = thisObj->instance;
@@ -77,14 +77,14 @@ JSValuePtr RuntimeObjectImp::fallbackObjectGetter(ExecState* exec, const Identif
     instance->begin();
 
     Class *aClass = instance->getClass();
-    JSValuePtr result = aClass->fallbackObject(exec, instance.get(), propertyName);
+    JSValue result = aClass->fallbackObject(exec, instance.get(), propertyName);
 
     instance->end();
             
     return result;
 }
 
-JSValuePtr RuntimeObjectImp::fieldGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue RuntimeObjectImp::fieldGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {    
     RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
     RefPtr<Instance> instance = thisObj->instance;
@@ -96,14 +96,14 @@ JSValuePtr RuntimeObjectImp::fieldGetter(ExecState* exec, const Identifier& prop
 
     Class *aClass = instance->getClass();
     Field* aField = aClass->fieldNamed(propertyName, instance.get());
-    JSValuePtr result = instance->getValueOfField(exec, aField); 
+    JSValue result = aField->valueFromInstance(exec, instance.get());
     
     instance->end();
             
     return result;
 }
 
-JSValuePtr RuntimeObjectImp::methodGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue RuntimeObjectImp::methodGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
 {
     RuntimeObjectImp* thisObj = static_cast<RuntimeObjectImp*>(asObject(slot.slotBase()));
     RefPtr<Instance> instance = thisObj->instance;
@@ -115,7 +115,7 @@ JSValuePtr RuntimeObjectImp::methodGetter(ExecState* exec, const Identifier& pro
 
     Class *aClass = instance->getClass();
     MethodList methodList = aClass->methodsNamed(propertyName, instance.get());
-    JSValuePtr result = new (exec) RuntimeMethod(exec, propertyName, methodList);
+    JSValue result = new (exec) RuntimeMethod(exec, propertyName, methodList);
 
     instance->end();
             
@@ -153,7 +153,7 @@ bool RuntimeObjectImp::getOwnPropertySlot(ExecState *exec, const Identifier& pro
         }
 
         // Try a fallback object.
-        if (!aClass->fallbackObject(exec, instance.get(), propertyName)->isUndefined()) {
+        if (!aClass->fallbackObject(exec, instance.get(), propertyName).isUndefined()) {
             slot.setCustom(this, fallbackObjectGetter);
             instance->end();
             return true;
@@ -161,18 +161,11 @@ bool RuntimeObjectImp::getOwnPropertySlot(ExecState *exec, const Identifier& pro
     }
         
     instance->end();
-#if PLATFORM(QT)
-    // For Qt instances we call the baseclass implementation to allow
-    // runtime objects to have custom properties or a prototype
-    if (instance->getBindingLanguage() == Instance::QtLanguage)
-        return JSObject::getOwnPropertySlot(exec, propertyName, slot);
-#endif
-    // For other platforms and/or binding languages we don't allow
-    // runtime properties/prototypes
-    return false;
+    
+    return instance->getOwnPropertySlot(this, exec, propertyName, slot);
 }
 
-void RuntimeObjectImp::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void RuntimeObjectImp::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     if (!instance) {
         throwInvalidAccessError(exec);
@@ -185,13 +178,9 @@ void RuntimeObjectImp::put(ExecState* exec, const Identifier& propertyName, JSVa
     // Set the value of the property.
     Field *aField = instance->getClass()->fieldNamed(propertyName, instance.get());
     if (aField)
-        instance->setValueOfField(exec, aField, value);
-    else if (instance->supportsSetValueOfUndefinedField())
-        instance->setValueOfUndefinedField(exec, propertyName, value);
-#if PLATFORM(QT)
-    else if (instance->getBindingLanguage() == Instance::QtLanguage)
-        JSObject::put(exec, propertyName, value, slot);
-#endif
+        aField->setValueToInstance(exec, instance.get(), value);
+    else if (!instance->setValueOfUndefinedField(exec, propertyName, value))
+        instance->put(this, exec, propertyName, value, slot);
 
     instance->end();
 }
@@ -202,23 +191,23 @@ bool RuntimeObjectImp::deleteProperty(ExecState*, const Identifier&)
     return false;
 }
 
-JSValuePtr RuntimeObjectImp::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
+JSValue RuntimeObjectImp::defaultValue(ExecState* exec, PreferredPrimitiveType hint) const
 {
     if (!instance)
         return throwInvalidAccessError(exec);
     
     RefPtr<Instance> protector(instance);
     instance->begin();
-    JSValuePtr result = instance->defaultValue(exec, hint);
+    JSValue result = instance->defaultValue(exec, hint);
     instance->end();
     return result;
 }
 
-static JSValuePtr callRuntimeObject(ExecState* exec, JSObject* function, JSValuePtr, const ArgList& args)
+static JSValue JSC_HOST_CALL callRuntimeObject(ExecState* exec, JSObject* function, JSValue, const ArgList& args)
 {
     RefPtr<Instance> instance(static_cast<RuntimeObjectImp*>(function)->getInternalInstance());
     instance->begin();
-    JSValuePtr result = instance->invokeDefaultMethod(exec, args);
+    JSValue result = instance->invokeDefaultMethod(exec, args);
     instance->end();
     return result;
 }
@@ -231,15 +220,15 @@ CallType RuntimeObjectImp::getCallData(CallData& callData)
     return CallTypeHost;
 }
 
-JSObject* callRuntimeConstructor(ExecState* exec, JSObject* constructor, const ArgList& args)
+static JSObject* callRuntimeConstructor(ExecState* exec, JSObject* constructor, const ArgList& args)
 {
     RefPtr<Instance> instance(static_cast<RuntimeObjectImp*>(constructor)->getInternalInstance());
     instance->begin();
-    JSValuePtr result = instance->invokeConstruct(exec, args);
+    JSValue result = instance->invokeConstruct(exec, args);
     instance->end();
     
     ASSERT(result);
-    return result->isObject() ? static_cast<JSObject*>(result->asCell()) : constructor;
+    return result.isObject() ? static_cast<JSObject*>(result.asCell()) : constructor;
 }
 
 ConstructType RuntimeObjectImp::getConstructData(ConstructData& constructData)
diff --git a/src/3rdparty/webkit/WebCore/bridge/runtime_object.h b/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
index 0e8ea77..f01fe1e 100644
--- a/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
+++ b/src/3rdparty/webkit/WebCore/bridge/runtime_object.h
@@ -33,12 +33,14 @@ namespace JSC {
 
 class RuntimeObjectImp : public JSObject {
 public:
+    RuntimeObjectImp(ExecState*, PassRefPtr<Bindings::Instance>);
+
     virtual ~RuntimeObjectImp();
 
     virtual bool getOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
-    virtual void put(ExecState*, const Identifier& propertyName, JSValuePtr, PutPropertySlot&);
+    virtual void put(ExecState*, const Identifier& propertyName, JSValue, PutPropertySlot&);
     virtual bool deleteProperty(ExecState* , const Identifier& propertyName);
-    virtual JSValuePtr defaultValue(ExecState*, PreferredPrimitiveType) const;
+    virtual JSValue defaultValue(ExecState*, PreferredPrimitiveType) const;
     virtual CallType getCallData(CallData&);
     virtual ConstructType getConstructData(ConstructData&);
     
@@ -51,12 +53,12 @@ public:
 
     static const ClassInfo s_info;
 
-    static ObjectPrototype* createPrototype(ExecState* exec)
+    static ObjectPrototype* createPrototype(ExecState*, JSGlobalObject* globalObject)
     {
-        return exec->lexicalGlobalObject()->objectPrototype();
+        return globalObject->objectPrototype();
     }
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr prototype)
+    static PassRefPtr<Structure> createStructure(JSValue prototype)
     {
         return Structure::create(prototype, TypeInfo(ObjectType));
     }
@@ -65,14 +67,11 @@ protected:
     RuntimeObjectImp(ExecState*, PassRefPtr<Structure>, PassRefPtr<Bindings::Instance>);
 
 private:
-    friend class Bindings::Instance;
-    RuntimeObjectImp(ExecState*, PassRefPtr<Bindings::Instance>);
-
     virtual const ClassInfo* classInfo() const { return &s_info; }
     
-    static JSValuePtr fallbackObjectGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValuePtr fieldGetter(ExecState*, const Identifier&, const PropertySlot&);
-    static JSValuePtr methodGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue fallbackObjectGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue fieldGetter(ExecState*, const Identifier&, const PropertySlot&);
+    static JSValue methodGetter(ExecState*, const Identifier&, const PropertySlot&);
 
     RefPtr<Bindings::Instance> instance;
 };
diff --git a/src/3rdparty/webkit/WebCore/bridge/testbindings.mm b/src/3rdparty/webkit/WebCore/bridge/testbindings.mm
index 9215c48..ca70e17 100644
--- a/src/3rdparty/webkit/WebCore/bridge/testbindings.mm
+++ b/src/3rdparty/webkit/WebCore/bridge/testbindings.mm
@@ -103,7 +103,7 @@
 }
 
 /*
-- (id)invokeUndefinedMethodFromWebScript:(NSString *)name withArguments:(NSArray *)args;
+- (id)invokeUndefinedMethodFromWebScript:(NSString *)name withArguments:(NSArray *)args
 {
     NSLog (@"Call to undefined method %@", name);
     NSLog (@"%d args\n", [args count]);
diff --git a/src/3rdparty/webkit/WebCore/config.h b/src/3rdparty/webkit/WebCore/config.h
index 9e3dcdf..0700adf 100644
--- a/src/3rdparty/webkit/WebCore/config.h
+++ b/src/3rdparty/webkit/WebCore/config.h
@@ -24,6 +24,22 @@
 
 #include <wtf/Platform.h>
 
+#if PLATFORM(WIN_OS) && !defined(BUILDING_WX__) && !COMPILER(GCC)
+#if defined(BUILDING_JavaScriptCore) || defined(BUILDING_WTF)
+#define JS_EXPORTDATA __declspec(dllexport)
+#else
+#define JS_EXPORTDATA __declspec(dllimport)
+#endif
+#if defined(BUILDING_WebCore) || defined(BUILDING_WebKit)
+#define WEBKIT_EXPORTDATA __declspec(dllexport)
+#else
+#define WEBKIT_EXPORTDATA __declspec(dllimport)
+#endif
+#else
+#define JS_EXPORTDATA
+#define WEBKIT_EXPORTDATA
+#endif
+
 #define MOBILE 0
 
 #ifdef __APPLE__
@@ -100,6 +116,7 @@
 #endif
 
 #if PLATFORM(MAC)
+// ATSUI vs. CoreText
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
 #define WTF_USE_ATSUI 0
 #define WTF_USE_CORE_TEXT 1
@@ -107,8 +124,10 @@
 #define WTF_USE_ATSUI 1
 #define WTF_USE_CORE_TEXT 0
 #endif
+
+// New theme
 #define WTF_USE_NEW_THEME 1
-#endif
+#endif // PLATFORM(MAC)
 
 #if PLATFORM(SYMBIAN)
 #undef WIN32
diff --git a/src/3rdparty/webkit/WebCore/css/CSSCanvasValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSCanvasValue.cpp
index 4fd5210..cf8cb42 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSCanvasValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSCanvasValue.cpp
@@ -59,6 +59,13 @@ void CSSCanvasValue::canvasResized(HTMLCanvasElement*)
         curr->first->imageChanged(static_cast<WrappedImagePtr>(this));
 }
 
+void CSSCanvasValue::canvasDestroyed(HTMLCanvasElement* element)
+{
+    ASSERT(element == m_element);
+    if (element == m_element)
+        m_element = 0;
+}
+
 IntSize CSSCanvasValue::fixedSize(const RenderObject* renderer)
 {
     if (HTMLCanvasElement* elt = element(renderer->document()))
diff --git a/src/3rdparty/webkit/WebCore/css/CSSCanvasValue.h b/src/3rdparty/webkit/WebCore/css/CSSCanvasValue.h
index a698f31..4cd4280 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSCanvasValue.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSCanvasValue.h
@@ -52,8 +52,9 @@ private:
     {
     }
 
-    virtual void canvasChanged(HTMLCanvasElement* element, const FloatRect& changedRect);
-    virtual void canvasResized(HTMLCanvasElement* element);
+    virtual void canvasChanged(HTMLCanvasElement*, const FloatRect& changedRect);
+    virtual void canvasResized(HTMLCanvasElement*);
+    virtual void canvasDestroyed(HTMLCanvasElement*);
 
     HTMLCanvasElement* element(Document*);
      
diff --git a/src/3rdparty/webkit/WebCore/css/CSSCharsetRule.idl b/src/3rdparty/webkit/WebCore/css/CSSCharsetRule.idl
index ebe659c..db0333a 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSCharsetRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSCharsetRule.idl
@@ -26,7 +26,7 @@ module css {
         InterfaceUUID=94180bad-a74e-4df9-adbc-6ce4e5b96155,
         ImplementationUUID=354aa39e-ad53-4e9a-a927-80c3966c47f2
     ] CSSCharsetRule : CSSRule {
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute [ConvertNullStringTo=Null] DOMString encoding;
 #else
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString encoding
diff --git a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
index d84fa31..b721f70 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2004 Zack Rusin <zack@kde.org>
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007 Nicholas Shanks <webkit@nickshanks.com>
  *
@@ -23,10 +23,12 @@
 #include "config.h"
 #include "CSSComputedStyleDeclaration.h"
 
+#include "AnimationController.h"
 #include "CSSBorderImageValue.h"
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSPrimitiveValue.h"
 #include "CSSPrimitiveValueMappings.h"
+#include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CSSReflectValue.h"
 #include "CSSTimingFunctionValue.h"
@@ -36,7 +38,8 @@
 #include "ExceptionCode.h"
 #include "Pair.h"
 #include "Rect.h"
-#include "RenderObject.h"
+#include "RenderBox.h"
+#include "RenderLayer.h"
 #include "ShadowValue.h"
 #include "WebKitCSSTransformValue.h"
 
@@ -51,8 +54,7 @@ static const int computedProperties[] = {
     CSSPropertyBackgroundAttachment,
     CSSPropertyBackgroundColor,
     CSSPropertyBackgroundImage,
-    // more specific background-position-x/y are non-standard
-    CSSPropertyBackgroundPosition,
+    CSSPropertyBackgroundPosition, // more-specific background-position-x/y are non-standard
     CSSPropertyBackgroundRepeat,
     CSSPropertyBorderBottomColor,
     CSSPropertyBorderBottomStyle,
@@ -70,6 +72,7 @@ static const int computedProperties[] = {
     CSSPropertyBottom,
     CSSPropertyCaptionSide,
     CSSPropertyClear,
+    CSSPropertyClip,
     CSSPropertyColor,
     CSSPropertyCursor,
     CSSPropertyDirection,
@@ -127,6 +130,7 @@ static const int computedProperties[] = {
     CSSPropertyWhiteSpace,
     CSSPropertyWidows,
     CSSPropertyWidth,
+    CSSPropertyWordBreak,
     CSSPropertyWordSpacing,
     CSSPropertyWordWrap,
     CSSPropertyZIndex,
@@ -137,16 +141,20 @@ static const int computedProperties[] = {
     CSSPropertyWebkitAnimationDuration,
     CSSPropertyWebkitAnimationIterationCount,
     CSSPropertyWebkitAnimationName,
-    CSSPropertyWebkitAnimationPlayState,
     CSSPropertyWebkitAnimationTimingFunction,
     CSSPropertyWebkitAppearance,
+    CSSPropertyWebkitBackfaceVisibility,
     CSSPropertyWebkitBackgroundClip,
     CSSPropertyWebkitBackgroundComposite,
     CSSPropertyWebkitBackgroundOrigin,
     CSSPropertyWebkitBackgroundSize,
+    CSSPropertyWebkitBorderBottomLeftRadius,
+    CSSPropertyWebkitBorderBottomRightRadius,
     CSSPropertyWebkitBorderFit,
-    CSSPropertyWebkitBorderImage,
     CSSPropertyWebkitBorderHorizontalSpacing,
+    CSSPropertyWebkitBorderImage,
+    CSSPropertyWebkitBorderTopLeftRadius,
+    CSSPropertyWebkitBorderTopRightRadius,
     CSSPropertyWebkitBorderVerticalSpacing,
     CSSPropertyWebkitBoxAlign,
     CSSPropertyWebkitBoxDirection,
@@ -168,6 +176,9 @@ static const int computedProperties[] = {
     CSSPropertyWebkitColumnRuleStyle,
     CSSPropertyWebkitColumnRuleWidth,
     CSSPropertyWebkitColumnWidth,
+#if ENABLE(DASHBOARD_SUPPORT)
+    CSSPropertyWebkitDashboardRegion,
+#endif
     CSSPropertyWebkitHighlight,
     CSSPropertyWebkitLineBreak,
     CSSPropertyWebkitLineClamp,
@@ -179,14 +190,16 @@ static const int computedProperties[] = {
     CSSPropertyWebkitMarqueeStyle,
     CSSPropertyWebkitMaskAttachment,
     CSSPropertyWebkitMaskBoxImage,
-    CSSPropertyWebkitMaskImage,
-    CSSPropertyWebkitMaskPosition,
-    CSSPropertyWebkitMaskRepeat,
     CSSPropertyWebkitMaskClip,
     CSSPropertyWebkitMaskComposite,
+    CSSPropertyWebkitMaskImage,
     CSSPropertyWebkitMaskOrigin,
+    CSSPropertyWebkitMaskPosition,
+    CSSPropertyWebkitMaskRepeat,
     CSSPropertyWebkitMaskSize,
     CSSPropertyWebkitNbspMode,
+    CSSPropertyWebkitPerspective,
+    CSSPropertyWebkitPerspectiveOrigin,
     CSSPropertyWebkitRtlOrdering,
     CSSPropertyWebkitTextDecorationsInEffect,
     CSSPropertyWebkitTextFillColor,
@@ -195,21 +208,15 @@ static const int computedProperties[] = {
     CSSPropertyWebkitTextStrokeWidth,
     CSSPropertyWebkitTransform,
     CSSPropertyWebkitTransformOrigin,
+    CSSPropertyWebkitTransformStyle,
     CSSPropertyWebkitTransitionDelay,
     CSSPropertyWebkitTransitionDuration,
     CSSPropertyWebkitTransitionProperty,
     CSSPropertyWebkitTransitionTimingFunction,
     CSSPropertyWebkitUserDrag,
     CSSPropertyWebkitUserModify,
-    CSSPropertyWebkitUserSelect,
-#if ENABLE(DASHBOARD_SUPPORT)
-    CSSPropertyWebkitDashboardRegion,
-#endif
-    CSSPropertyWebkitBorderBottomLeftRadius,
-    CSSPropertyWebkitBorderBottomRightRadius,
-    CSSPropertyWebkitBorderTopLeftRadius,
-    CSSPropertyWebkitBorderTopRightRadius
-    
+    CSSPropertyWebkitUserSelect
+
 #if ENABLE(SVG)
     ,
     CSSPropertyClipPath,
@@ -395,27 +402,64 @@ static PassRefPtr<CSSValue> getBorderRadiusCornerValue(IntSize radius)
 
 static IntRect sizingBox(RenderObject* renderer)
 {
-    return renderer->style()->boxSizing() == CONTENT_BOX ? renderer->contentBox() : renderer->borderBox();
+    if (!renderer->isBox())
+        return IntRect();
+    
+    RenderBox* box = toRenderBox(renderer);
+    return box->style()->boxSizing() == CONTENT_BOX ? box->contentBoxRect() : box->borderBoxRect();
+}
+
+static inline bool hasCompositedLayer(RenderObject* renderer)
+{
+    return renderer && renderer->hasLayer() && toRenderBoxModelObject(renderer)->layer()->isComposited();
 }
 
-static PassRefPtr<CSSValue> computedTransform(RenderObject* renderer)
+static PassRefPtr<CSSValue> computedTransform(RenderObject* renderer, const RenderStyle* style)
 {
-    if (!renderer || renderer->style()->transform().operations().isEmpty())
+    if (!renderer || style->transform().operations().isEmpty())
         return CSSPrimitiveValue::createIdentifier(CSSValueNone);
     
     IntRect box = sizingBox(renderer);
 
     TransformationMatrix transform;
-    renderer->style()->applyTransform(transform, box.size(), false);
+    style->applyTransform(transform, box.size(), RenderStyle::ExcludeTransformOrigin);
+    // Note that this does not flatten to an affine transform if ENABLE(3D_RENDERING) is off, by design.
 
-    RefPtr<WebKitCSSTransformValue> transformVal = WebKitCSSTransformValue::create(WebKitCSSTransformValue::MatrixTransformOperation);
+    RefPtr<WebKitCSSTransformValue> transformVal;
 
-    transformVal->append(CSSPrimitiveValue::create(transform.a(), CSSPrimitiveValue::CSS_NUMBER));
-    transformVal->append(CSSPrimitiveValue::create(transform.b(), CSSPrimitiveValue::CSS_NUMBER));
-    transformVal->append(CSSPrimitiveValue::create(transform.c(), CSSPrimitiveValue::CSS_NUMBER));
-    transformVal->append(CSSPrimitiveValue::create(transform.d(), CSSPrimitiveValue::CSS_NUMBER));
-    transformVal->append(CSSPrimitiveValue::create(transform.e(), CSSPrimitiveValue::CSS_NUMBER));
-    transformVal->append(CSSPrimitiveValue::create(transform.f(), CSSPrimitiveValue::CSS_NUMBER));
+    // FIXME: Need to print out individual functions (https://bugs.webkit.org/show_bug.cgi?id=23924)
+    if (transform.isAffine()) {
+        transformVal = WebKitCSSTransformValue::create(WebKitCSSTransformValue::MatrixTransformOperation);
+
+        transformVal->append(CSSPrimitiveValue::create(transform.a(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.b(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.c(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.d(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.e(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.f(), CSSPrimitiveValue::CSS_NUMBER));
+    } else {
+        transformVal = WebKitCSSTransformValue::create(WebKitCSSTransformValue::Matrix3DTransformOperation);
+
+        transformVal->append(CSSPrimitiveValue::create(transform.m11(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m12(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m13(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m14(), CSSPrimitiveValue::CSS_NUMBER));
+
+        transformVal->append(CSSPrimitiveValue::create(transform.m21(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m22(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m23(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m24(), CSSPrimitiveValue::CSS_NUMBER));
+
+        transformVal->append(CSSPrimitiveValue::create(transform.m31(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m32(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m33(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m34(), CSSPrimitiveValue::CSS_NUMBER));
+
+        transformVal->append(CSSPrimitiveValue::create(transform.m41(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m42(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m43(), CSSPrimitiveValue::CSS_NUMBER));
+        transformVal->append(CSSPrimitiveValue::create(transform.m44(), CSSPrimitiveValue::CSS_NUMBER));
+    }
 
     RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
     list->append(transformVal);
@@ -495,11 +539,63 @@ void CSSComputedStyleDeclaration::setCssText(const String&, ExceptionCode& ec)
     ec = NO_MODIFICATION_ALLOWED_ERR;
 }
 
+static int cssIdentifierForFontSizeKeyword(int keywordSize)
+{
+    ASSERT_ARG(keywordSize, keywordSize);
+    ASSERT_ARG(keywordSize, keywordSize <= 8);
+    return CSSValueXxSmall + keywordSize - 1;
+}
+
+PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getFontSizeCSSValuePreferringKeyword() const
+{
+    Node* node = m_node.get();
+    if (!node)
+        return 0;
+
+    node->document()->updateLayoutIgnorePendingStylesheets();
+
+    RefPtr<RenderStyle> style = node->computedStyle();
+    if (!style)
+        return 0;
+
+    if (int keywordSize = style->fontDescription().keywordSize())
+        return CSSPrimitiveValue::createIdentifier(cssIdentifierForFontSizeKeyword(keywordSize));
+
+    return CSSPrimitiveValue::create(style->fontDescription().computedPixelSize(), CSSPrimitiveValue::CSS_PX);
+}
+
 PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int propertyID) const
 {
     return getPropertyCSSValue(propertyID, UpdateLayout);
 }
 
+static int identifierForFamily(const AtomicString& family)
+{
+    DEFINE_STATIC_LOCAL(AtomicString, cursiveFamily, ("-webkit-cursive")); 
+    DEFINE_STATIC_LOCAL(AtomicString, fantasyFamily, ("-webkit-fantasy")); 
+    DEFINE_STATIC_LOCAL(AtomicString, monospaceFamily, ("-webkit-monospace")); 
+    DEFINE_STATIC_LOCAL(AtomicString, sansSerifFamily, ("-webkit-sans-serif")); 
+    DEFINE_STATIC_LOCAL(AtomicString, serifFamily, ("-webkit-serif")); 
+    if (family == cursiveFamily)
+        return CSSValueCursive;
+    if (family == fantasyFamily)
+        return CSSValueFantasy;
+    if (family == monospaceFamily)
+        return CSSValueMonospace;
+    if (family == sansSerifFamily)
+        return CSSValueSansSerif;
+    if (family == serifFamily)
+        return CSSValueSerif;
+    return 0;
+}
+
+static PassRefPtr<CSSPrimitiveValue> valueForFamily(const AtomicString& family)
+{
+    if (int familyIdentifier = identifierForFamily(family))
+        return CSSPrimitiveValue::createIdentifier(familyIdentifier);
+    return CSSPrimitiveValue::create(family.string(), CSSPrimitiveValue::CSS_STRING);
+}
+
 PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int propertyID, EUpdateLayout updateLayout) const
 {
     Node* node = m_node.get();
@@ -512,7 +608,11 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
 
     RenderObject* renderer = node->renderer();
 
-    RenderStyle* style = node->computedStyle();
+    RefPtr<RenderStyle> style;
+    if (renderer && hasCompositedLayer(renderer) && AnimationController::supportsAcceleratedAnimationOfProperty(static_cast<CSSPropertyID>(propertyID)))
+        style = renderer->animation()->getAnimatedStyleForRenderer(renderer);
+    else
+       style = node->computedStyle();
     if (!style)
         return 0;
 
@@ -572,13 +672,13 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyWebkitBorderVerticalSpacing:
             return CSSPrimitiveValue::create(style->verticalBorderSpacing(), CSSPrimitiveValue::CSS_PX);
         case CSSPropertyBorderTopColor:
-            return currentColorOrValidColor(style, style->borderTopColor());
+            return currentColorOrValidColor(style.get(), style->borderTopColor());
         case CSSPropertyBorderRightColor:
-            return currentColorOrValidColor(style, style->borderRightColor());
+            return currentColorOrValidColor(style.get(), style->borderRightColor());
         case CSSPropertyBorderBottomColor:
-            return currentColorOrValidColor(style, style->borderBottomColor());
+            return currentColorOrValidColor(style.get(), style->borderBottomColor());
         case CSSPropertyBorderLeftColor:
-            return currentColorOrValidColor(style, style->borderLeftColor());
+            return currentColorOrValidColor(style.get(), style->borderLeftColor());
         case CSSPropertyBorderTopStyle:
             return CSSPrimitiveValue::create(style->borderTopStyle());
         case CSSPropertyBorderRightStyle:
@@ -596,7 +696,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyBorderLeftWidth:
             return CSSPrimitiveValue::create(style->borderLeftWidth(), CSSPrimitiveValue::CSS_PX);
         case CSSPropertyBottom:
-            return getPositionOffsetValue(style, CSSPropertyBottom);
+            return getPositionOffsetValue(style.get(), CSSPropertyBottom);
         case CSSPropertyWebkitBoxAlign:
             return CSSPrimitiveValue::create(style->boxAlign());
         case CSSPropertyWebkitBoxDirection:
@@ -638,7 +738,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
                 return CSSPrimitiveValue::createIdentifier(CSSValueNormal);
             return CSSPrimitiveValue::create(style->columnGap(), CSSPrimitiveValue::CSS_NUMBER);
         case CSSPropertyWebkitColumnRuleColor:
-            return currentColorOrValidColor(style, style->columnRuleColor());
+            return currentColorOrValidColor(style.get(), style->columnRuleColor());
         case CSSPropertyWebkitColumnRuleStyle:
             return CSSPrimitiveValue::create(style->columnRuleStyle());
         case CSSPropertyWebkitColumnRuleWidth:
@@ -676,9 +776,15 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return CSSPrimitiveValue::create(style->emptyCells());
         case CSSPropertyFloat:
             return CSSPrimitiveValue::create(style->floating());
-        case CSSPropertyFontFamily:
-            // FIXME: This only returns the first family.
-            return CSSPrimitiveValue::create(style->fontDescription().family().family().string(), CSSPrimitiveValue::CSS_STRING);
+        case CSSPropertyFontFamily: {
+            const FontFamily& firstFamily = style->fontDescription().family();
+            if (!firstFamily.next())
+                return valueForFamily(firstFamily.family());
+            RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
+            for (const FontFamily* family = &firstFamily; family; family = family->next())
+                list->append(valueForFamily(family->family()));
+            return list.release();
+        }
         case CSSPropertyFontSize:
             return CSSPrimitiveValue::create(style->fontDescription().computedPixelSize(), CSSPrimitiveValue::CSS_PX);
         case CSSPropertyWebkitBinding:
@@ -727,7 +833,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
                 return CSSPrimitiveValue::createIdentifier(CSSValueBorder);
             return CSSPrimitiveValue::createIdentifier(CSSValueLines);
         case CSSPropertyLeft:
-            return getPositionOffsetValue(style, CSSPropertyLeft);
+            return getPositionOffsetValue(style.get(), CSSPropertyLeft);
         case CSSPropertyLetterSpacing:
             if (!style->letterSpacing())
                 return CSSPrimitiveValue::createIdentifier(CSSValueNormal);
@@ -757,24 +863,24 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyListStyleType:
             return CSSPrimitiveValue::create(style->listStyleType());
         case CSSPropertyMarginTop:
-            if (renderer)
+            if (renderer && renderer->isBox())
                 // FIXME: Supposed to return the percentage if percentage was specified.
-                return CSSPrimitiveValue::create(renderer->marginTop(), CSSPrimitiveValue::CSS_PX);
+                return CSSPrimitiveValue::create(toRenderBox(renderer)->marginTop(), CSSPrimitiveValue::CSS_PX);
             return CSSPrimitiveValue::create(style->marginTop());
         case CSSPropertyMarginRight:
-            if (renderer)
+            if (renderer && renderer->isBox())
                 // FIXME: Supposed to return the percentage if percentage was specified.
-                return CSSPrimitiveValue::create(renderer->marginRight(), CSSPrimitiveValue::CSS_PX);
+                return CSSPrimitiveValue::create(toRenderBox(renderer)->marginRight(), CSSPrimitiveValue::CSS_PX);
             return CSSPrimitiveValue::create(style->marginRight());
         case CSSPropertyMarginBottom:
-            if (renderer)
+            if (renderer && renderer->isBox())
                 // FIXME: Supposed to return the percentage if percentage was specified.
-                return CSSPrimitiveValue::create(renderer->marginBottom(), CSSPrimitiveValue::CSS_PX);
+                return CSSPrimitiveValue::create(toRenderBox(renderer)->marginBottom(), CSSPrimitiveValue::CSS_PX);
             return CSSPrimitiveValue::create(style->marginBottom());
         case CSSPropertyMarginLeft:
-            if (renderer)
+            if (renderer && renderer->isBox())
                 // FIXME: Supposed to return the percentage if percentage was specified.
-                return CSSPrimitiveValue::create(renderer->marginLeft(), CSSPrimitiveValue::CSS_PX);
+                return CSSPrimitiveValue::create(toRenderBox(renderer)->marginLeft(), CSSPrimitiveValue::CSS_PX);
             return CSSPrimitiveValue::create(style->marginLeft());
         case CSSPropertyWebkitMarqueeDirection:
             return CSSPrimitiveValue::create(style->marqueeDirection());
@@ -844,7 +950,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyOrphans:
             return CSSPrimitiveValue::create(style->orphans(), CSSPrimitiveValue::CSS_NUMBER);
         case CSSPropertyOutlineColor:
-            return currentColorOrValidColor(style, style->outlineColor());
+            return currentColorOrValidColor(style.get(), style->outlineColor());
         case CSSPropertyOutlineStyle:
             if (style->outlineStyleIsAuto())
                 return CSSPrimitiveValue::createIdentifier(CSSValueAuto);
@@ -858,20 +964,20 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyOverflowY:
             return CSSPrimitiveValue::create(style->overflowY());
         case CSSPropertyPaddingTop:
-            if (renderer)
-                return CSSPrimitiveValue::create(renderer->paddingTop(), CSSPrimitiveValue::CSS_PX);
+            if (renderer && renderer->isBox())
+                return CSSPrimitiveValue::create(toRenderBox(renderer)->paddingTop(false), CSSPrimitiveValue::CSS_PX);
             return CSSPrimitiveValue::create(style->paddingTop());
         case CSSPropertyPaddingRight:
-            if (renderer)
-                return CSSPrimitiveValue::create(renderer->paddingRight(), CSSPrimitiveValue::CSS_PX);
+            if (renderer && renderer->isBox())
+                return CSSPrimitiveValue::create(toRenderBox(renderer)->paddingRight(false), CSSPrimitiveValue::CSS_PX);
             return CSSPrimitiveValue::create(style->paddingRight());
         case CSSPropertyPaddingBottom:
-            if (renderer)
-                return CSSPrimitiveValue::create(renderer->paddingBottom(), CSSPrimitiveValue::CSS_PX);
+            if (renderer && renderer->isBox())
+                return CSSPrimitiveValue::create(toRenderBox(renderer)->paddingBottom(false), CSSPrimitiveValue::CSS_PX);
             return CSSPrimitiveValue::create(style->paddingBottom());
         case CSSPropertyPaddingLeft:
-            if (renderer)
-                return CSSPrimitiveValue::create(renderer->paddingLeft(), CSSPrimitiveValue::CSS_PX);
+            if (renderer && renderer->isBox())
+                return CSSPrimitiveValue::create(toRenderBox(renderer)->paddingLeft(false), CSSPrimitiveValue::CSS_PX);
             return CSSPrimitiveValue::create(style->paddingLeft());
         case CSSPropertyPageBreakAfter:
             return CSSPrimitiveValue::create(style->pageBreakAfter());
@@ -887,7 +993,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyPosition:
             return CSSPrimitiveValue::create(style->position());
         case CSSPropertyRight:
-            return getPositionOffsetValue(style, CSSPropertyRight);
+            return getPositionOffsetValue(style.get(), CSSPropertyRight);
         case CSSPropertyTableLayout:
             return CSSPrimitiveValue::create(style->tableLayout());
         case CSSPropertyTextAlign:
@@ -939,7 +1045,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return CSSPrimitiveValue::create(string, CSSPrimitiveValue::CSS_STRING);
         }
         case CSSPropertyWebkitTextFillColor:
-            return currentColorOrValidColor(style, style->textFillColor());
+            return currentColorOrValidColor(style.get(), style->textFillColor());
         case CSSPropertyTextIndent:
             return CSSPrimitiveValue::create(style->textIndent());
         case CSSPropertyTextShadow:
@@ -951,13 +1057,13 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
                 return CSSPrimitiveValue::createIdentifier(CSSValueAuto);
             return CSSPrimitiveValue::createIdentifier(CSSValueNone);
         case CSSPropertyWebkitTextStrokeColor:
-            return currentColorOrValidColor(style, style->textStrokeColor());
+            return currentColorOrValidColor(style.get(), style->textStrokeColor());
         case CSSPropertyWebkitTextStrokeWidth:
             return CSSPrimitiveValue::create(style->textStrokeWidth(), CSSPrimitiveValue::CSS_PX);
         case CSSPropertyTextTransform:
             return CSSPrimitiveValue::create(style->textTransform());
         case CSSPropertyTop:
-            return getPositionOffsetValue(style, CSSPropertyTop);
+            return getPositionOffsetValue(style.get(), CSSPropertyTop);
         case CSSPropertyUnicodeBidi:
             return CSSPrimitiveValue::create(style->unicodeBidi());
         case CSSPropertyVerticalAlign:
@@ -1075,7 +1181,7 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             if (t) {
                 for (size_t i = 0; i < t->size(); ++i) {
                     int iterationCount = t->animation(i)->iterationCount();
-                    if (iterationCount < 0)
+                    if (iterationCount == Animation::IterationCountInfinite)
                         list->append(CSSPrimitiveValue::createIdentifier(CSSValueInfinite));
                     else
                         list->append(CSSPrimitiveValue::create(iterationCount, CSSPrimitiveValue::CSS_NUMBER));
@@ -1095,25 +1201,12 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
                 list->append(CSSPrimitiveValue::createIdentifier(CSSValueNone));
             return list.release();
         }
-        case CSSPropertyWebkitAnimationPlayState: {
-            RefPtr<CSSValueList> list = CSSValueList::createCommaSeparated();
-            const AnimationList* t = style->animations();
-            if (t) {
-                for (size_t i = 0; i < t->size(); ++i) {
-                    int prop = t->animation(i)->playState();
-                    if (prop == AnimPlayStatePlaying)
-                        list->append(CSSPrimitiveValue::createIdentifier(CSSValueRunning));
-                    else
-                        list->append(CSSPrimitiveValue::createIdentifier(CSSValuePaused));
-                }
-            } else
-                list->append(CSSPrimitiveValue::createIdentifier(CSSValueRunning));
-            return list.release();
-        }
         case CSSPropertyWebkitAnimationTimingFunction:
             return getTimingFunctionValue(style->animations());
         case CSSPropertyWebkitAppearance:
             return CSSPrimitiveValue::create(style->appearance());
+        case CSSPropertyWebkitBackfaceVisibility:
+            return CSSPrimitiveValue::createIdentifier((style->backfaceVisibility() == BackfaceVisibilityHidden) ? CSSValueHidden : CSSValueVisible);
         case CSSPropertyWebkitBorderImage:
             return valueForNinePieceImage(style->borderImage());
         case CSSPropertyWebkitMaskBoxImage:
@@ -1125,6 +1218,23 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return CSSPrimitiveValue::create(style->marginBottomCollapse());
         case CSSPropertyWebkitMarginTopCollapse:
             return CSSPrimitiveValue::create(style->marginTopCollapse());
+        case CSSPropertyWebkitPerspective:
+            if (!style->hasPerspective())
+                return CSSPrimitiveValue::createIdentifier(CSSValueNone);
+            return CSSPrimitiveValue::create(style->perspective(), CSSPrimitiveValue::CSS_NUMBER);
+        case CSSPropertyWebkitPerspectiveOrigin: {
+            RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
+            if (renderer) {
+                IntRect box = sizingBox(renderer);
+                list->append(CSSPrimitiveValue::create(style->perspectiveOriginX().calcMinValue(box.width()), CSSPrimitiveValue::CSS_PX));
+                list->append(CSSPrimitiveValue::create(style->perspectiveOriginY().calcMinValue(box.height()), CSSPrimitiveValue::CSS_PX));
+            }
+            else {
+                list->append(CSSPrimitiveValue::create(style->perspectiveOriginX()));
+                list->append(CSSPrimitiveValue::create(style->perspectiveOriginY()));
+            }
+            return list.release();
+        }
         case CSSPropertyWebkitRtlOrdering:
             if (style->visuallyOrdered())
                 return CSSPrimitiveValue::createIdentifier(CSSValueVisual);
@@ -1141,32 +1251,36 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return getBorderRadiusCornerValue(style->borderTopLeftRadius());
         case CSSPropertyWebkitBorderTopRightRadius:
             return getBorderRadiusCornerValue(style->borderTopRightRadius());
-        case CSSPropertyClip:
-        {
-            if (style->hasClip()) {
-                RefPtr<Rect> rect = Rect::create();
-                rect->setTop(CSSPrimitiveValue::create(style->clip().top().value(), CSSPrimitiveValue::CSS_PX));
-                rect->setRight(CSSPrimitiveValue::create(style->clip().right().value(), CSSPrimitiveValue::CSS_PX));
-                rect->setBottom(CSSPrimitiveValue::create(style->clip().bottom().value(), CSSPrimitiveValue::CSS_PX));
-                rect->setLeft(CSSPrimitiveValue::create(style->clip().left().value(), CSSPrimitiveValue::CSS_PX));
-                return CSSPrimitiveValue::create(rect.release());
-            }
-            return 0;
+        case CSSPropertyClip: {
+            if (!style->hasClip())
+                return CSSPrimitiveValue::createIdentifier(CSSValueAuto);
+            RefPtr<Rect> rect = Rect::create();
+            rect->setTop(CSSPrimitiveValue::create(style->clip().top().value(), CSSPrimitiveValue::CSS_PX));
+            rect->setRight(CSSPrimitiveValue::create(style->clip().right().value(), CSSPrimitiveValue::CSS_PX));
+            rect->setBottom(CSSPrimitiveValue::create(style->clip().bottom().value(), CSSPrimitiveValue::CSS_PX));
+            rect->setLeft(CSSPrimitiveValue::create(style->clip().left().value(), CSSPrimitiveValue::CSS_PX));
+            return CSSPrimitiveValue::create(rect.release());
         }
         case CSSPropertyWebkitTransform:
-            return computedTransform(renderer);
+            return computedTransform(renderer, style.get());
         case CSSPropertyWebkitTransformOrigin: {
             RefPtr<CSSValueList> list = CSSValueList::createSpaceSeparated();
             if (renderer) {
                 IntRect box = sizingBox(renderer);
                 list->append(CSSPrimitiveValue::create(style->transformOriginX().calcMinValue(box.width()), CSSPrimitiveValue::CSS_PX));
                 list->append(CSSPrimitiveValue::create(style->transformOriginY().calcMinValue(box.height()), CSSPrimitiveValue::CSS_PX));
+                if (style->transformOriginZ() != 0)
+                    list->append(CSSPrimitiveValue::create(style->transformOriginZ(), CSSPrimitiveValue::CSS_PX));
             } else {
                 list->append(CSSPrimitiveValue::create(style->transformOriginX()));
                 list->append(CSSPrimitiveValue::create(style->transformOriginY()));
+                if (style->transformOriginZ() != 0)
+                    list->append(CSSPrimitiveValue::create(style->transformOriginZ(), CSSPrimitiveValue::CSS_PX));
             }
             return list.release();
         }
+        case CSSPropertyWebkitTransformStyle:
+            return CSSPrimitiveValue::createIdentifier((style->transformStyle3D() == TransformStyle3DPreserve3D) ? CSSValuePreserve3d : CSSValueFlat);
         case CSSPropertyWebkitTransitionDelay:
             return getDelayValue(style->transitions());
         case CSSPropertyWebkitTransitionDuration:
@@ -1194,6 +1308,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return getTimingFunctionValue(style->transitions());
         case CSSPropertyPointerEvents:
             return CSSPrimitiveValue::create(style->pointerEvents());
+
+        /* Shorthand properties, currently not supported see bug 13658*/
         case CSSPropertyBackground:
         case CSSPropertyBorder:
         case CSSPropertyBorderBottom:
@@ -1203,27 +1319,13 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyBorderStyle:
         case CSSPropertyBorderTop:
         case CSSPropertyBorderWidth:
-        case CSSPropertyContent:
-        case CSSPropertyCounterIncrement:
-        case CSSPropertyCounterReset:
         case CSSPropertyFont:
-        case CSSPropertyFontStretch:
         case CSSPropertyListStyle:
         case CSSPropertyMargin:
-        case CSSPropertyOutline:
-        case CSSPropertyOutlineOffset:
         case CSSPropertyPadding:
-        case CSSPropertyPage:
-        case CSSPropertyQuotes:
-        case CSSPropertyScrollbar3dlightColor:
-        case CSSPropertyScrollbarArrowColor:
-        case CSSPropertyScrollbarDarkshadowColor:
-        case CSSPropertyScrollbarFaceColor:
-        case CSSPropertyScrollbarHighlightColor:
-        case CSSPropertyScrollbarShadowColor:
-        case CSSPropertyScrollbarTrackColor:
-        case CSSPropertySrc: // Only used in @font-face rules.
-        case CSSPropertySize:
+            break;
+
+        /* Unimplemented CSS 3 properties (including CSS3 shorthand properties) */
         case CSSPropertyTextLineThrough:
         case CSSPropertyTextLineThroughColor:
         case CSSPropertyTextLineThroughMode:
@@ -1240,7 +1342,26 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyTextUnderlineMode:
         case CSSPropertyTextUnderlineStyle:
         case CSSPropertyTextUnderlineWidth:
-        case CSSPropertyUnicodeRange: // Only used in @font-face rules.
+            break;
+
+        /* Unimplemented @font-face properties */
+        case CSSPropertyFontStretch:
+        case CSSPropertySrc:
+        case CSSPropertyUnicodeRange:
+            break;
+
+        /* Other unimplemented properties */
+        case CSSPropertyContent: // FIXME: needs implementation, bug 23668
+        case CSSPropertyCounterIncrement:
+        case CSSPropertyCounterReset:
+        case CSSPropertyOutline: // FIXME: needs implementation
+        case CSSPropertyOutlineOffset: // FIXME: needs implementation
+        case CSSPropertyPage: // for @page
+        case CSSPropertyQuotes: // FIXME: needs implementation
+        case CSSPropertySize: // for @page
+            break;
+
+        /* Unimplemented -webkit- properties */
         case CSSPropertyWebkitAnimation:
         case CSSPropertyWebkitBorderRadius:
         case CSSPropertyWebkitColumns:
@@ -1251,10 +1372,14 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyWebkitMarqueeSpeed:
         case CSSPropertyWebkitMask:
         case CSSPropertyWebkitPaddingStart:
+        case CSSPropertyWebkitPerspectiveOriginX:
+        case CSSPropertyWebkitPerspectiveOriginY:
         case CSSPropertyWebkitTextStroke:
+        case CSSPropertyWebkitTransformOriginX:
+        case CSSPropertyWebkitTransformOriginY:
+        case CSSPropertyWebkitTransformOriginZ:
         case CSSPropertyWebkitTransition:
         case CSSPropertyWebkitVariableDeclarationBlock:
-            // FIXME: The above are unimplemented.
             break;
 #if ENABLE(SVG)
         // FIXME: This default case ruins the point of using an enum for
@@ -1318,7 +1443,7 @@ String CSSComputedStyleDeclaration::item(unsigned i) const
 // This is the list of properties we want to copy in the copyInheritableProperties() function.
 // It is the intersection of the list of inherited CSS properties and the
 // properties for which we have a computed implementation in this file.
-const int inheritableProperties[] = {
+static const int inheritableProperties[] = {
     CSSPropertyBorderCollapse,
     CSSPropertyColor,
     CSSPropertyFontFamily,
@@ -1344,13 +1469,29 @@ const int inheritableProperties[] = {
     CSSPropertyWebkitTextStrokeWidth,
 };
 
-const unsigned numInheritableProperties = sizeof(inheritableProperties) / sizeof(inheritableProperties[0]);
+static const unsigned numInheritableProperties = sizeof(inheritableProperties) / sizeof(inheritableProperties[0]);
 
 void CSSComputedStyleDeclaration::removeComputedInheritablePropertiesFrom(CSSMutableStyleDeclaration* declaration)
 {
     declaration->removePropertiesInSet(inheritableProperties, numInheritableProperties);
 }
 
+bool CSSComputedStyleDeclaration::cssPropertyMatches(const CSSProperty* property) const
+{
+    if (property->id() == CSSPropertyFontSize && property->value()->isPrimitiveValue() && m_node) {
+        m_node->document()->updateLayoutIgnorePendingStylesheets();
+        RenderStyle* style = m_node->computedStyle();
+        if (style && style->fontDescription().keywordSize()) {
+            int sizeValue = cssIdentifierForFontSizeKeyword(style->fontDescription().keywordSize());
+            CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(property->value());
+            if (primitiveValue->primitiveType() == CSSPrimitiveValue::CSS_IDENT && primitiveValue->getIdent() == sizeValue)
+                return true;
+        }
+    }
+
+    return CSSStyleDeclaration::cssPropertyMatches(property);
+}
+
 PassRefPtr<CSSMutableStyleDeclaration> CSSComputedStyleDeclaration::copyInheritableProperties() const
 {
     RefPtr<CSSMutableStyleDeclaration> style = copyPropertiesInSet(inheritableProperties, numInheritableProperties);
@@ -1364,6 +1505,8 @@ PassRefPtr<CSSMutableStyleDeclaration> CSSComputedStyleDeclaration::copyInherita
         if (!m_node->computedStyle()->textStrokeColor().isValid())
             style->removeProperty(CSSPropertyWebkitTextStrokeColor, ec);
         ASSERT(ec == 0);
+        if (int keywordSize = m_node->computedStyle()->fontDescription().keywordSize())
+            style->setProperty(CSSPropertyFontSize, cssIdentifierForFontSizeKeyword(keywordSize));
     }
     return style.release();
 }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.h b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.h
index 487c02b..6f81b0e 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSComputedStyleDeclaration.h
@@ -50,6 +50,7 @@ public:
     virtual PassRefPtr<CSSMutableStyleDeclaration> makeMutable();
 
     PassRefPtr<CSSValue> getPropertyCSSValue(int propertyID, EUpdateLayout) const;
+    PassRefPtr<CSSValue> getFontSizeCSSValuePreferringKeyword() const;
 #if ENABLE(SVG)
     PassRefPtr<CSSValue> getSVGPropertyCSSValue(int propertyID, EUpdateLayout) const;
 #endif
@@ -58,6 +59,9 @@ public:
 
     static void removeComputedInheritablePropertiesFrom(CSSMutableStyleDeclaration*);
 
+protected:
+    virtual bool cssPropertyMatches(const CSSProperty*) const;
+
 private:
     CSSComputedStyleDeclaration(PassRefPtr<Node>);
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSCursorImageValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSCursorImageValue.cpp
index ddd3e6b..84ac565 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSCursorImageValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSCursorImageValue.cpp
@@ -27,6 +27,7 @@
 #include "PlatformString.h"
 #include "RenderStyle.h"
 #include <wtf/MathExtras.h>
+#include <wtf/UnusedParam.h>
 
 #if ENABLE(SVG)
 #include "SVGCursorElement.h"
@@ -79,7 +80,9 @@ CSSCursorImageValue::~CSSCursorImageValue()
 
 bool CSSCursorImageValue::updateIfSVGCursorIsUsed(Element* element)
 {
-#if ENABLE(SVG)
+#if !ENABLE(SVG)
+    UNUSED_PARAM(element);
+#else
     if (!element || !element->isSVGElement())
         return false;
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSFontFaceSource.cpp b/src/3rdparty/webkit/WebCore/css/CSSFontFaceSource.cpp
index 5e4b69c..111cea2 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSFontFaceSource.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSFontFaceSource.cpp
@@ -107,8 +107,8 @@ SimpleFontData* CSSFontFaceSource::getFontData(const FontDescription& fontDescri
 #else
     if (!m_font) {
 #endif
-        FontPlatformData* data = FontCache::getCachedFontPlatformData(fontDescription, m_string);
-        SimpleFontData* fontData = FontCache::getCachedFontData(data);
+        FontPlatformData* data = fontCache()->getCachedFontPlatformData(fontDescription, m_string);
+        SimpleFontData* fontData = fontCache()->getCachedFontData(data);
 
         // We're local. Just return a SimpleFontData from the normal cache.
         return fontData;
@@ -179,9 +179,9 @@ SimpleFontData* CSSFontFaceSource::getFontData(const FontDescription& fontDescri
         if (DocLoader* docLoader = fontSelector->docLoader())
             m_font->beginLoadIfNeeded(docLoader);
         // FIXME: m_string is a URL so it makes no sense to pass it as a family name.
-        FontPlatformData* tempData = FontCache::getCachedFontPlatformData(fontDescription, m_string);
+        FontPlatformData* tempData = fontCache()->getCachedFontPlatformData(fontDescription, m_string);
         if (!tempData)
-            tempData = FontCache::getLastResortFallbackFont(fontDescription);
+            tempData = fontCache()->getLastResortFallbackFont(fontDescription);
         fontData.set(new SimpleFontData(*tempData, true, true));
     }
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSFontSelector.cpp b/src/3rdparty/webkit/WebCore/css/CSSFontSelector.cpp
index 714be47..35bc876 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSFontSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSFontSelector.cpp
@@ -65,12 +65,12 @@ CSSFontSelector::CSSFontSelector(Document* document)
     // seem to be any such guarantee.
 
     ASSERT(m_document);
-    FontCache::addClient(this);
+    fontCache()->addClient(this);
 }
 
 CSSFontSelector::~CSSFontSelector()
 {
-    FontCache::removeClient(this);
+    fontCache()->removeClient(this);
     deleteAllValues(m_fontFaces);
     deleteAllValues(m_locallyInstalledFontFaces);
     deleteAllValues(m_fonts);
@@ -93,7 +93,7 @@ void CSSFontSelector::addFontFaceRule(const CSSFontFaceRule* fontFaceRule)
     RefPtr<CSSValue> fontFamily = style->getPropertyCSSValue(CSSPropertyFontFamily);
     RefPtr<CSSValue> src = style->getPropertyCSSValue(CSSPropertySrc);
     RefPtr<CSSValue> unicodeRange = style->getPropertyCSSValue(CSSPropertyUnicodeRange);
-    if (!fontFamily || !src || !fontFamily->isValueList() || !src->isValueList() || unicodeRange && !unicodeRange->isValueList())
+    if (!fontFamily || !src || !fontFamily->isValueList() || !src->isValueList() || (unicodeRange && !unicodeRange->isValueList()))
         return;
 
     CSSValueList* familyList = static_cast<CSSValueList*>(fontFamily.get());
@@ -233,10 +233,7 @@ void CSSFontSelector::addFontFaceRule(const CSSFontFaceRule* fontFaceRule)
     int srcLength = srcList->length();
 
     bool foundLocal = false;
-
-#if ENABLE(SVG_FONTS)
     bool foundSVGFont = false;
-#endif
 
     for (int i = 0; i < srcLength; i++) {
         // An item in the list either specifies a string (local font name) or a URL (remote font to download).
@@ -246,9 +243,10 @@ void CSSFontSelector::addFontFaceRule(const CSSFontFaceRule* fontFaceRule)
 #if ENABLE(SVG_FONTS)
         foundSVGFont = item->isSVGFontFaceSrc() || item->svgFontFaceElement();
 #endif
-
         if (!item->isLocal()) {
-            if (item->isSupportedFormat() && m_document) {
+            Settings* settings = m_document ? m_document->frame() ? m_document->frame()->settings() : 0 : 0;
+            bool allowDownloading = foundSVGFont || (settings && settings->downloadableBinaryFontsEnabled());
+            if (allowDownloading && item->isSupportedFormat() && m_document) {
                 CachedFont* cachedFont = m_document->docLoader()->requestFont(item->resource());
                 if (cachedFont) {
 #if ENABLE(SVG_FONTS)
@@ -338,7 +336,7 @@ void CSSFontSelector::addFontFaceRule(const CSSFontFaceRule* fontFaceRule)
             Vector<RefPtr<CSSFontFace> >* familyLocallyInstalledFaces;
 
             Vector<unsigned> locallyInstalledFontsTraitsMasks;
-            FontCache::getTraitsInFamily(familyName, locallyInstalledFontsTraitsMasks);
+            fontCache()->getTraitsInFamily(familyName, locallyInstalledFontsTraitsMasks);
             unsigned numLocallyInstalledFaces = locallyInstalledFontsTraitsMasks.size();
             if (numLocallyInstalledFaces) {
                 familyLocallyInstalledFaces = new Vector<RefPtr<CSSFontFace> >;
@@ -397,7 +395,7 @@ static FontData* fontDataForGenericFamily(Document* document, const FontDescript
         genericFamily = settings->standardFontFamily();
 
     if (!genericFamily.isEmpty())
-        return FontCache::getCachedFontData(FontCache::getCachedFontPlatformData(fontDescription, genericFamily));
+        return fontCache()->getCachedFontData(fontCache()->getCachedFontPlatformData(fontDescription, genericFamily));
 
     return 0;
 }
@@ -433,7 +431,9 @@ static inline bool compareFontFaces(CSSFontFace* first, CSSFontFace* second)
     // or the next darker otherwise."
     // For '400', we made up our own rule (which then '500' follows).
 
-    static const FontTraitsMask weightFallbackRules[9][8] = {
+    static const unsigned fallbackRuleSets = 9;
+    static const unsigned rulesPerSet = 8;
+    static const FontTraitsMask weightFallbackRuleSets[fallbackRuleSets][rulesPerSet] = {
         { FontWeight200Mask, FontWeight300Mask, FontWeight400Mask, FontWeight500Mask, FontWeight600Mask, FontWeight700Mask, FontWeight800Mask, FontWeight900Mask },
         { FontWeight100Mask, FontWeight300Mask, FontWeight400Mask, FontWeight500Mask, FontWeight600Mask, FontWeight700Mask, FontWeight800Mask, FontWeight900Mask },
         { FontWeight200Mask, FontWeight100Mask, FontWeight400Mask, FontWeight500Mask, FontWeight600Mask, FontWeight700Mask, FontWeight800Mask, FontWeight900Mask },
@@ -445,14 +445,16 @@ static inline bool compareFontFaces(CSSFontFace* first, CSSFontFace* second)
         { FontWeight800Mask, FontWeight700Mask, FontWeight600Mask, FontWeight500Mask, FontWeight400Mask, FontWeight300Mask, FontWeight200Mask, FontWeight100Mask }
     };
 
-    const FontTraitsMask* weightFallbackRule = weightFallbackRules[0];
+    unsigned ruleSetIndex = 0;
     unsigned w = FontWeight100Bit;
     while (!(desiredTraitsMaskForComparison & (1 << w))) {
         w++;
-        weightFallbackRule += 8;
+        ruleSetIndex++;
     }
 
-    for (unsigned i = 0; i < 8; ++i) {
+    ASSERT(ruleSetIndex < fallbackRuleSets);
+    const FontTraitsMask* weightFallbackRule = weightFallbackRuleSets[ruleSetIndex];
+    for (unsigned i = 0; i < rulesPerSet; ++i) {
         if (secondTraitsMask & weightFallbackRule[i])
             return false;
         if (firstTraitsMask & weightFallbackRule[i])
diff --git a/src/3rdparty/webkit/WebCore/css/CSSGrammar.y b/src/3rdparty/webkit/WebCore/css/CSSGrammar.y
index 9ee9c93..4706521 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSGrammar.y
+++ b/src/3rdparty/webkit/WebCore/css/CSSGrammar.y
@@ -26,6 +26,7 @@
 
 #include "CSSMediaRule.h"
 #include "CSSParser.h"
+#include "CSSPrimitiveValue.h"
 #include "CSSPropertyNames.h"
 #include "CSSRuleList.h"
 #include "CSSSelector.h"
@@ -94,6 +95,8 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 %expect 49
 
+%nonassoc LOWEST_PREC
+
 %left UNIMPORTANT_TOK
 
 %token WHITESPACE SGML_CD
@@ -349,7 +352,7 @@ maybe_charset:
 
 closing_brace:
     '}'
-  | %prec maybe_sgml TOKEN_EOF
+  | %prec LOWEST_PREC TOKEN_EOF
   ;
 
 charset:
@@ -1095,6 +1098,11 @@ pseudo:
             CSSParser* p = static_cast<CSSParser*>(parser);
             if (Document* doc = p->document())
                 doc->setUsesFirstLineRules(true);
+        } else if (type == CSSSelector::PseudoBefore ||
+                   type == CSSSelector::PseudoAfter) {
+            CSSParser* p = static_cast<CSSParser*>(parser);
+            if (Document* doc = p->document())
+                doc->setUsesBeforeAfterRules(true);
         }
     }
     | ':' ':' IDENT {
@@ -1109,6 +1117,11 @@ pseudo:
             CSSParser* p = static_cast<CSSParser*>(parser);
             if (Document* doc = p->document())
                 doc->setUsesFirstLineRules(true);
+        } else if (type == CSSSelector::PseudoBefore ||
+                   type == CSSSelector::PseudoAfter) {
+            CSSParser* p = static_cast<CSSParser*>(parser);
+            if (Document* doc = p->document())
+                doc->setUsesBeforeAfterRules(true);
         }
     }
     // used by :nth-*(ax+b)
@@ -1168,7 +1181,7 @@ pseudo:
     }
     // used by :not
     | ':' NOTFUNCTION maybe_space simple_selector maybe_space ')' {
-        if (!$4)
+        if (!$4 || $4->simpleSelector() || $4->tagHistory())
             $$ = 0;
         else {
             CSSParser* p = static_cast<CSSParser*>(parser);
@@ -1355,10 +1368,10 @@ term:
       $$.string = $1;
   }
   /* We might need to actually parse the number from a dimension, but we can't just put something that uses $$.string into unary_term. */
-  | DIMEN maybe_space { $$.id = 0; $$.string = $1; $$.unit = CSSPrimitiveValue::CSS_DIMENSION }
-  | unary_operator DIMEN maybe_space { $$.id = 0; $$.string = $2; $$.unit = CSSPrimitiveValue::CSS_DIMENSION }
+  | DIMEN maybe_space { $$.id = 0; $$.string = $1; $$.unit = CSSPrimitiveValue::CSS_DIMENSION; }
+  | unary_operator DIMEN maybe_space { $$.id = 0; $$.string = $2; $$.unit = CSSPrimitiveValue::CSS_DIMENSION; }
   | URI maybe_space { $$.id = 0; $$.string = $1; $$.unit = CSSPrimitiveValue::CSS_URI; }
-  | UNICODERANGE maybe_space { $$.id = 0; $$.string = $1; $$.unit = CSSPrimitiveValue::CSS_UNICODE_RANGE }
+  | UNICODERANGE maybe_space { $$.id = 0; $$.string = $1; $$.unit = CSSPrimitiveValue::CSS_UNICODE_RANGE; }
   | hexcolor { $$.id = 0; $$.string = $1; $$.unit = CSSPrimitiveValue::CSS_PARSER_HEXCOLOR; }
   | '#' maybe_space { $$.id = 0; $$.string = CSSParserString(); $$.unit = CSSPrimitiveValue::CSS_PARSER_HEXCOLOR; } /* Handle error case: "color: #;" */
   /* FIXME: according to the specs a function can have a unary_operator in front. I know no case where this makes sense */
@@ -1368,7 +1381,9 @@ term:
   | variable_reference maybe_space {
       $$ = $1;
   }
-  | '%' maybe_space {} /* Handle width: %; */
+  | '%' maybe_space { /* Handle width: %; */
+      $$.id = 0; $$.unit = 0;
+  }
   ;
 
 unary_term:
diff --git a/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.cpp
index 6b12ced..67b7da1 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.cpp
@@ -24,6 +24,7 @@
 #include "CSSImageValue.h"
 #include "CSSParser.h"
 #include "CSSProperty.h"
+#include "CSSPropertyLonghand.h"
 #include "CSSPropertyNames.h"
 #include "CSSRule.h"
 #include "CSSStyleSheet.h"
@@ -31,7 +32,6 @@
 #include "Document.h"
 #include "ExceptionCode.h"
 #include "StyledElement.h"
-#include <wtf/StdLibExtras.h>
 
 using namespace std;
 
@@ -81,7 +81,7 @@ CSSMutableStyleDeclaration::CSSMutableStyleDeclaration(CSSRule* parent, const CS
     , m_iteratorCount(0)
 #endif
 {
-    m_properties.reserveCapacity(numProperties);
+    m_properties.reserveInitialCapacity(numProperties);
     for (int i = 0; i < numProperties; ++i) {
         ASSERT(properties[i]);
         m_properties.append(*properties[i]);
@@ -217,9 +217,10 @@ String CSSMutableStyleDeclaration::getPropertyValue(int propertyID) const
             return getLayeredShorthandValue(properties, 6);
         }
         case CSSPropertyWebkitTransformOrigin: {
-            const int properties[2] = { CSSPropertyWebkitTransformOriginX,
-                                        CSSPropertyWebkitTransformOriginY };
-            return getShorthandValue(properties, 2);
+            const int properties[3] = { CSSPropertyWebkitTransformOriginX,
+                                        CSSPropertyWebkitTransformOriginY,
+                                        CSSPropertyWebkitTransformOriginZ };
+            return getShorthandValue(properties, 3);
         }
         case CSSPropertyWebkitTransition: {
             const int properties[4] = { CSSPropertyWebkitTransitionProperty, CSSPropertyWebkitTransitionDuration,
@@ -363,207 +364,9 @@ PassRefPtr<CSSValue> CSSMutableStyleDeclaration::getPropertyCSSValue(int propert
     return property ? property->value() : 0;
 }
 
-struct PropertyLonghand {
-    PropertyLonghand()
-        : m_properties(0)
-        , m_length(0)
-    {
-    }
-
-    PropertyLonghand(const int* firstProperty, unsigned numProperties)
-        : m_properties(firstProperty)
-        , m_length(numProperties)
-    {
-    }
-
-    const int* properties() const { return m_properties; }
-    unsigned length() const { return m_length; }
-
-private:
-    const int* m_properties;
-    unsigned m_length;
-};
-    
-typedef HashMap<int, PropertyLonghand> ShorthandMap;
-
-static void initShorthandMap(ShorthandMap& shorthandMap)
-{
-    #define SET_SHORTHAND_MAP_ENTRY(map, propID, array) \
-        map.set(propID, PropertyLonghand(array, sizeof(array) / sizeof(array[0])))
-
-    // FIXME: The 'font' property has "shorthand nature" but is not parsed as a shorthand.
-
-    // Do not change the order of the following four shorthands, and keep them together.
-    static const int borderProperties[4][3] = {
-        { CSSPropertyBorderTopColor, CSSPropertyBorderTopStyle, CSSPropertyBorderTopWidth },
-        { CSSPropertyBorderRightColor, CSSPropertyBorderRightStyle, CSSPropertyBorderRightWidth },
-        { CSSPropertyBorderBottomColor, CSSPropertyBorderBottomStyle, CSSPropertyBorderBottomWidth },
-        { CSSPropertyBorderLeftColor, CSSPropertyBorderLeftStyle, CSSPropertyBorderLeftWidth }
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderTop, borderProperties[0]);
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderRight, borderProperties[1]);
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderBottom, borderProperties[2]);
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderLeft, borderProperties[3]);
-
-    shorthandMap.set(CSSPropertyBorder, PropertyLonghand(borderProperties[0], sizeof(borderProperties) / sizeof(borderProperties[0][0])));
-
-    static const int borderColorProperties[] = {
-        CSSPropertyBorderTopColor,
-        CSSPropertyBorderRightColor,
-        CSSPropertyBorderBottomColor,
-        CSSPropertyBorderLeftColor
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderColor, borderColorProperties);
-
-    static const int borderStyleProperties[] = {
-        CSSPropertyBorderTopStyle,
-        CSSPropertyBorderRightStyle,
-        CSSPropertyBorderBottomStyle,
-        CSSPropertyBorderLeftStyle
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderStyle, borderStyleProperties);
-
-    static const int borderWidthProperties[] = {
-        CSSPropertyBorderTopWidth,
-        CSSPropertyBorderRightWidth,
-        CSSPropertyBorderBottomWidth,
-        CSSPropertyBorderLeftWidth
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderWidth, borderWidthProperties);
-
-    static const int backgroundPositionProperties[] = { CSSPropertyBackgroundPositionX, CSSPropertyBackgroundPositionY };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBackgroundPosition, backgroundPositionProperties);
-
-    static const int borderSpacingProperties[] = { CSSPropertyWebkitBorderHorizontalSpacing, CSSPropertyWebkitBorderVerticalSpacing };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderSpacing, borderSpacingProperties);
-
-    static const int listStyleProperties[] = {
-        CSSPropertyListStyleImage,
-        CSSPropertyListStylePosition,
-        CSSPropertyListStyleType
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyListStyle, listStyleProperties);
-
-    static const int marginProperties[] = {
-        CSSPropertyMarginTop,
-        CSSPropertyMarginRight,
-        CSSPropertyMarginBottom,
-        CSSPropertyMarginLeft
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyMargin, marginProperties);
-
-    static const int marginCollapseProperties[] = { CSSPropertyWebkitMarginTopCollapse, CSSPropertyWebkitMarginBottomCollapse };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMarginCollapse, marginCollapseProperties);
-
-    static const int marqueeProperties[] = {
-        CSSPropertyWebkitMarqueeDirection,
-        CSSPropertyWebkitMarqueeIncrement,
-        CSSPropertyWebkitMarqueeRepetition,
-        CSSPropertyWebkitMarqueeStyle,
-        CSSPropertyWebkitMarqueeSpeed
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMarquee, marqueeProperties);
-
-    static const int outlineProperties[] = {
-        CSSPropertyOutlineColor,
-        CSSPropertyOutlineOffset,
-        CSSPropertyOutlineStyle,
-        CSSPropertyOutlineWidth
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyOutline, outlineProperties);
-
-    static const int paddingProperties[] = {
-        CSSPropertyPaddingTop,
-        CSSPropertyPaddingRight,
-        CSSPropertyPaddingBottom,
-        CSSPropertyPaddingLeft
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyPadding, paddingProperties);
-
-    static const int textStrokeProperties[] = { CSSPropertyWebkitTextStrokeColor, CSSPropertyWebkitTextStrokeWidth };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitTextStroke, textStrokeProperties);
-
-    static const int backgroundProperties[] = {
-        CSSPropertyBackgroundAttachment,
-        CSSPropertyWebkitBackgroundClip,
-        CSSPropertyBackgroundColor,
-        CSSPropertyBackgroundImage,
-        CSSPropertyWebkitBackgroundOrigin,
-        CSSPropertyBackgroundPositionX,
-        CSSPropertyBackgroundPositionY,
-        CSSPropertyBackgroundRepeat,
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBackground, backgroundProperties);
-
-    static const int columnsProperties[] = { CSSPropertyWebkitColumnWidth, CSSPropertyWebkitColumnCount };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitColumns, columnsProperties);
-
-    static const int columnRuleProperties[] = {
-        CSSPropertyWebkitColumnRuleColor,
-        CSSPropertyWebkitColumnRuleStyle,
-        CSSPropertyWebkitColumnRuleWidth
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitColumnRule, columnRuleProperties);
-
-    static const int overflowProperties[] = { CSSPropertyOverflowX, CSSPropertyOverflowY };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyOverflow, overflowProperties);
-
-    static const int borderRadiusProperties[] = {
-        CSSPropertyWebkitBorderTopRightRadius,
-        CSSPropertyWebkitBorderTopLeftRadius,
-        CSSPropertyWebkitBorderBottomLeftRadius,
-        CSSPropertyWebkitBorderBottomRightRadius
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitBorderRadius, borderRadiusProperties);
-
-    static const int maskPositionProperties[] = { CSSPropertyWebkitMaskPositionX, CSSPropertyWebkitMaskPositionY };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMaskPosition, maskPositionProperties);
-
-    static const int maskProperties[] = {
-        CSSPropertyWebkitMaskAttachment,
-        CSSPropertyWebkitMaskClip,
-        CSSPropertyWebkitMaskImage,
-        CSSPropertyWebkitMaskOrigin,
-        CSSPropertyWebkitMaskPositionX,
-        CSSPropertyWebkitMaskPositionY,
-        CSSPropertyWebkitMaskRepeat,
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMask, maskProperties);
-
-    static const int animationProperties[] = {
-        CSSPropertyWebkitAnimationName,
-        CSSPropertyWebkitAnimationDuration,
-        CSSPropertyWebkitAnimationTimingFunction,
-        CSSPropertyWebkitAnimationDelay,
-        CSSPropertyWebkitAnimationIterationCount,
-        CSSPropertyWebkitAnimationDirection
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitAnimation, animationProperties);
-
-    static const int transitionProperties[] = {
-        CSSPropertyWebkitTransitionProperty,
-        CSSPropertyWebkitTransitionDuration,
-        CSSPropertyWebkitTransitionTimingFunction,
-        CSSPropertyWebkitTransitionDelay
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitTransition, transitionProperties);
-
-    static const int transformOriginProperties[] = {
-        CSSPropertyWebkitTransformOriginX,
-        CSSPropertyWebkitTransformOriginY
-    };
-    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitTransformOrigin, transformOriginProperties);
-    
-    #undef SET_SHORTHAND_MAP_ENTRY
-}
-
 bool CSSMutableStyleDeclaration::removeShorthandProperty(int propertyID, bool notifyChanged) 
 {
-    DEFINE_STATIC_LOCAL(ShorthandMap, shorthandMap, ());
-    if (shorthandMap.isEmpty())
-        initShorthandMap(shorthandMap);
-
-    PropertyLonghand longhand = shorthandMap.get(propertyID);
+    CSSPropertyLonghand longhand = longhandForProperty(propertyID);
     if (longhand.length()) {
         removePropertiesInSet(longhand.properties(), longhand.length(), notifyChanged);
         return true;
@@ -594,12 +397,12 @@ String CSSMutableStyleDeclaration::removeProperty(int propertyID, bool notifyCha
     m_properties.remove(foundProperty - m_properties.data());
 
     if (notifyChanged)
-        setChanged();
+        setNeedsStyleRecalc();
 
     return value;
 }
 
-void CSSMutableStyleDeclaration::setChanged()
+void CSSMutableStyleDeclaration::setNeedsStyleRecalc()
 {
     if (m_node) {
         // FIXME: Ideally, this should be factored better and there
@@ -607,10 +410,10 @@ void CSSMutableStyleDeclaration::setChanged()
         // for inline style declarations that handles this
         bool isInlineStyleDeclaration = m_node->isStyledElement() && this == static_cast<StyledElement*>(m_node)->inlineStyleDecl();
         if (isInlineStyleDeclaration) {
-            m_node->setChanged(InlineStyleChange);
+            m_node->setNeedsStyleRecalc(InlineStyleChange);
             static_cast<StyledElement*>(m_node)->invalidateStyleAttribute();
         } else
-            m_node->setChanged(FullStyleChange);
+            m_node->setNeedsStyleRecalc(FullStyleChange);
         return;
     }
 
@@ -671,7 +474,7 @@ bool CSSMutableStyleDeclaration::setProperty(int propertyID, const String& value
         // CSS DOM requires raising SYNTAX_ERR here, but this is too dangerous for compatibility,
         // see <http://bugs.webkit.org/show_bug.cgi?id=7296>.
     } else if (notifyChanged)
-        setChanged();
+        setNeedsStyleRecalc();
 
     return success;
 }
@@ -695,7 +498,7 @@ bool CSSMutableStyleDeclaration::setProperty(int propertyID, int value, bool imp
     CSSProperty property(propertyID, CSSPrimitiveValue::createIdentifier(value), important);
     setPropertyInternal(property);
     if (notifyChanged)
-        setChanged();
+        setNeedsStyleRecalc();
     return true;
 }
 
@@ -704,7 +507,7 @@ void CSSMutableStyleDeclaration::setStringProperty(int propertyId, const String
     ASSERT(!m_iteratorCount);
 
     setPropertyInternal(CSSProperty(propertyId, CSSPrimitiveValue::create(value, type), important));
-    setChanged();
+    setNeedsStyleRecalc();
 }
 
 void CSSMutableStyleDeclaration::setImageProperty(int propertyId, const String& url, bool important)
@@ -712,7 +515,7 @@ void CSSMutableStyleDeclaration::setImageProperty(int propertyId, const String&
     ASSERT(!m_iteratorCount);
 
     setPropertyInternal(CSSProperty(propertyId, CSSImageValue::create(url), important));
-    setChanged();
+    setNeedsStyleRecalc();
 }
 
 void CSSMutableStyleDeclaration::parseDeclaration(const String& styleDeclaration)
@@ -722,7 +525,7 @@ void CSSMutableStyleDeclaration::parseDeclaration(const String& styleDeclaration
     m_properties.clear();
     CSSParser parser(useStrictParsing());
     parser.parseDeclaration(this, styleDeclaration);
-    setChanged();
+    setNeedsStyleRecalc();
 }
 
 void CSSMutableStyleDeclaration::addParsedProperties(const CSSProperty* const* properties, int numProperties)
@@ -741,7 +544,7 @@ void CSSMutableStyleDeclaration::addParsedProperties(const CSSProperty* const* p
                 m_variableDependentValueCount++;
         }
     }
-    // FIXME: This probably should have a call to setChanged() if something changed. We may also wish to add
+    // FIXME: This probably should have a call to setNeedsStyleRecalc() if something changed. We may also wish to add
     // a notifyChanged argument to this function to follow the model of other functions in this class.
 }
 
@@ -823,7 +626,7 @@ void CSSMutableStyleDeclaration::setCssText(const String& text, ExceptionCode& e
     CSSParser parser(useStrictParsing());
     parser.parseDeclaration(this, text);
     // FIXME: Detect syntax errors and set ec.
-    setChanged();
+    setNeedsStyleRecalc();
 }
 
 void CSSMutableStyleDeclaration::merge(CSSMutableStyleDeclaration* other, bool argOverridesOnConflict)
@@ -841,7 +644,7 @@ void CSSMutableStyleDeclaration::merge(CSSMutableStyleDeclaration* other, bool a
         } else
             m_properties.append(toMerge);
     }
-    // FIXME: This probably should have a call to setChanged() if something changed. We may also wish to add
+    // FIXME: This probably should have a call to setNeedsStyleRecalc() if something changed. We may also wish to add
     // a notifyChanged argument to this function to follow the model of other functions in this class.
 }
 
@@ -899,8 +702,8 @@ void CSSMutableStyleDeclaration::removePropertiesInSet(const int* set, unsigned
     for (unsigned i = 0; i < length; ++i)
         toRemove.add(set[i]);
     
-    Vector<CSSProperty> newProperties;
-    newProperties.reserveCapacity(m_properties.size());
+    Vector<CSSProperty, 4> newProperties;
+    newProperties.reserveInitialCapacity(m_properties.size());
     
     unsigned size = m_properties.size();
     for (unsigned n = 0; n < size; ++n) {
@@ -917,7 +720,7 @@ void CSSMutableStyleDeclaration::removePropertiesInSet(const int* set, unsigned
     m_properties = newProperties;
     
     if (changed && notifyChanged)
-        setChanged();
+        setNeedsStyleRecalc();
 }
 
 PassRefPtr<CSSMutableStyleDeclaration> CSSMutableStyleDeclaration::makeMutable()
diff --git a/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.h b/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.h
index 9c84916..5eb8a27 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSMutableStyleDeclaration.h
@@ -144,7 +144,7 @@ private:
 
     virtual PassRefPtr<CSSMutableStyleDeclaration> makeMutable();
 
-    void setChanged();
+    void setNeedsStyleRecalc();
 
     String getShorthandValue(const int* properties, int number) const;
     String getCommonValue(const int* properties, int number) const;
@@ -157,7 +157,7 @@ private:
     Vector<CSSProperty>::const_iterator findPropertyWithId(int propertyId) const;
     Vector<CSSProperty>::iterator findPropertyWithId(int propertyId);
 
-    Vector<CSSProperty> m_properties;
+    Vector<CSSProperty, 4> m_properties;
 
     Node* m_node;
     unsigned m_variableDependentValueCount : 24;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
index 36b86a4..2e8f3bb 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSParser.cpp
@@ -363,19 +363,21 @@ bool CSSParser::parseMediaQuery(MediaList* queries, const String& string)
 
 void CSSParser::addProperty(int propId, PassRefPtr<CSSValue> value, bool important)
 {
-    CSSProperty* prop = new CSSProperty(propId, value, important, m_currentShorthand, m_implicitShorthand);
+    auto_ptr<CSSProperty> prop(new CSSProperty(propId, value, important, m_currentShorthand, m_implicitShorthand));
     if (m_numParsedProperties >= m_maxParsedProperties) {
         m_maxParsedProperties += 32;
+        if (m_maxParsedProperties > UINT_MAX / sizeof(CSSProperty*))
+            return;
         m_parsedProperties = static_cast<CSSProperty**>(fastRealloc(m_parsedProperties,
                                                        m_maxParsedProperties * sizeof(CSSProperty*)));
     }
-    m_parsedProperties[m_numParsedProperties++] = prop;
+    m_parsedProperties[m_numParsedProperties++] = prop.release();
 }
 
 void CSSParser::rollbackLastProperties(int num)
 {
     ASSERT(num >= 0);
-    ASSERT(m_numParsedProperties >= num);
+    ASSERT(m_numParsedProperties >= static_cast<unsigned>(num));
 
     for (int i = 0; i < num; ++i)
         delete m_parsedProperties[--m_numParsedProperties];
@@ -383,7 +385,7 @@ void CSSParser::rollbackLastProperties(int num)
 
 void CSSParser::clearProperties()
 {
-    for (int i = 0; i < m_numParsedProperties; i++)
+    for (unsigned i = 0; i < m_numParsedProperties; i++)
         delete m_parsedProperties[i];
     m_numParsedProperties = 0;
     m_hasFontFaceOnlyValues = false;
@@ -621,7 +623,6 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyContent:              // [ <string> | <uri> | <counter> | attr(X) | open-quote |
         // close-quote | no-open-quote | no-close-quote ]+ | inherit
         return parseContent(propId, important);
-        break;
 
     case CSSPropertyWhiteSpace:          // normal | pre | nowrap | inherit
         if (id == CSSValueNormal ||
@@ -764,16 +765,6 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitBorderVerticalSpacing:
         valid_primitive = validUnit(value, FLength|FNonNeg, m_strict);
         break;
-    case CSSPropertyScrollbarFaceColor:         // IE5.5
-    case CSSPropertyScrollbarShadowColor:       // IE5.5
-    case CSSPropertyScrollbarHighlightColor:    // IE5.5
-    case CSSPropertyScrollbar3dlightColor:      // IE5.5
-    case CSSPropertyScrollbarDarkshadowColor:   // IE5.5
-    case CSSPropertyScrollbarTrackColor:        // IE5.5
-    case CSSPropertyScrollbarArrowColor:        // IE5.5
-        if (m_strict)
-            break;
-        /* nobreak */
     case CSSPropertyOutlineColor:        // <color> | invert | inherit
         // Outline color has "invert" as additional keyword.
         // Also, we want to allow the special focus color even in strict parsing mode.
@@ -799,7 +790,7 @@ bool CSSParser::parseValue(int propId, bool important)
                                     // since we use this in our UA sheets.
         else if (id == CSSValueCurrentcolor)
             valid_primitive = true;
-        else if (id >= CSSValueAqua && id <= CSSValueWindowtext || id == CSSValueMenu ||
+        else if ((id >= CSSValueAqua && id <= CSSValueWindowtext) || id == CSSValueMenu ||
              (id >= CSSValueWebkitFocusRingColor && id < CSSValueWebkitText && !m_strict)) {
             valid_primitive = true;
         } else {
@@ -834,7 +825,7 @@ bool CSSParser::parseValue(int propId, bool important)
             } else if (m_strict && nrcoords == 2)
                 hotspot = IntPoint(coords[0], coords[1]);
             if (m_strict || coords.size() == 0) {
-                if (!uri.isNull())
+                if (!uri.isNull() && m_styleSheet)
                     list->append(CSSCursorImageValue::create(m_styleSheet->completeURL(uri), hotspot));
             }
             if ((m_strict && !value) || (value && !(value->unit == CSSParserValue::Operator && value->iValue == ',')))
@@ -900,7 +891,7 @@ bool CSSParser::parseValue(int propId, bool important)
         } else if (value->unit == CSSPrimitiveValue::CSS_URI) {
             // ### allow string in non strict mode?
             String uri = parseURL(value->string);
-            if (!uri.isNull()) {
+            if (!uri.isNull() && m_styleSheet) {
                 parsedValue = CSSImageValue::create(m_styleSheet->completeURL(uri));
                 m_valueList->next();
             }
@@ -1112,7 +1103,7 @@ bool CSSParser::parseValue(int propId, bool important)
             CSSParserValue* val;
             RefPtr<CSSValue> parsedValue;
             while ((val = m_valueList->current())) {
-                if (val->unit == CSSPrimitiveValue::CSS_URI) {
+                if (val->unit == CSSPrimitiveValue::CSS_URI && m_styleSheet) {
                     String value = parseURL(val->string);
                     parsedValue = CSSPrimitiveValue::create(m_styleSheet->completeURL(value), CSSPrimitiveValue::CSS_URI);
                 }
@@ -1298,11 +1289,51 @@ bool CSSParser::parseValue(int propId, bool important)
         break;
     case CSSPropertyWebkitTransformOrigin:
     case CSSPropertyWebkitTransformOriginX:
-    case CSSPropertyWebkitTransformOriginY: {
+    case CSSPropertyWebkitTransformOriginY:
+    case CSSPropertyWebkitTransformOriginZ: {
+        RefPtr<CSSValue> val1;
+        RefPtr<CSSValue> val2;
+        RefPtr<CSSValue> val3;
+        int propId1, propId2, propId3;
+        if (parseTransformOrigin(propId, propId1, propId2, propId3, val1, val2, val3)) {
+            addProperty(propId1, val1.release(), important);
+            if (val2)
+                addProperty(propId2, val2.release(), important);
+            if (val3)
+                addProperty(propId3, val3.release(), important);
+            return true;
+        }
+        return false;
+    }
+    case CSSPropertyWebkitTransformStyle:
+        if (value->id == CSSValueFlat || value->id == CSSValuePreserve3d)
+            valid_primitive = true;
+        break;
+    case CSSPropertyWebkitBackfaceVisibility:
+        if (value->id == CSSValueVisible || value->id == CSSValueHidden)
+            valid_primitive = true;
+        break;
+    case CSSPropertyWebkitPerspective:
+        if (id == CSSValueNone)
+            valid_primitive = true;
+        else {
+            if (validUnit(value, FNumber|FNonNeg, m_strict)) {
+                RefPtr<CSSValue> val = CSSPrimitiveValue::create(value->fValue, (CSSPrimitiveValue::UnitTypes)value->unit);
+                if (val) {
+                    addProperty(propId, val.release(), important);
+                    return true;
+                }
+                return false;
+            }
+        }
+        break;
+    case CSSPropertyWebkitPerspectiveOrigin:
+    case CSSPropertyWebkitPerspectiveOriginX:
+    case CSSPropertyWebkitPerspectiveOriginY: {
         RefPtr<CSSValue> val1;
         RefPtr<CSSValue> val2;
         int propId1, propId2;
-        if (parseTransformOrigin(propId, propId1, propId2, val1, val2)) {
+        if (parsePerspectiveOrigin(propId, propId1, propId2, val1, val2)) {
             addProperty(propId1, val1.release(), important);
             if (val2)
                 addProperty(propId2, val2.release(), important);
@@ -1314,7 +1345,6 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyWebkitAnimationDirection:
     case CSSPropertyWebkitAnimationDuration:
     case CSSPropertyWebkitAnimationName:
-    case CSSPropertyWebkitAnimationPlayState:
     case CSSPropertyWebkitAnimationIterationCount:
     case CSSPropertyWebkitAnimationTimingFunction:
     case CSSPropertyWebkitTransitionDelay:
@@ -1595,6 +1625,7 @@ bool CSSParser::parseValue(int propId, bool important)
     case CSSPropertyTextLineThrough:
     case CSSPropertyTextOverline:
     case CSSPropertyTextUnderline:
+    case CSSPropertyWebkitVariableDeclarationBlock:
         return false;
 #if ENABLE(SVG)
     default:
@@ -1966,7 +1997,7 @@ bool CSSParser::parseContent(int propId, bool important)
 
     while (CSSParserValue* val = m_valueList->current()) {
         RefPtr<CSSValue> parsedValue;
-        if (val->unit == CSSPrimitiveValue::CSS_URI) {
+        if (val->unit == CSSPrimitiveValue::CSS_URI && m_styleSheet) {
             // url
             String value = parseURL(val->string);
             parsedValue = CSSImageValue::create(m_styleSheet->completeURL(value));
@@ -1976,16 +2007,13 @@ bool CSSParser::parseContent(int propId, bool important)
             if (!args)
                 return false;
             if (equalIgnoringCase(val->function->name, "attr(")) {
-                if (args->size() != 1)
+                parsedValue = parseAttr(args);
+                if (!parsedValue)
                     return false;
-                CSSParserValue* a = args->current();
-                String attrName = a->string;
-                if (document()->isHTMLDocument())
-                    attrName = attrName.lower();
-                parsedValue = CSSPrimitiveValue::create(attrName, CSSPrimitiveValue::CSS_ATTR);
             } else if (equalIgnoringCase(val->function->name, "counter(")) {
                 parsedValue = parseCounterContent(args, false);
-                if (!parsedValue) return false;
+                if (!parsedValue)
+                    return false;
             } else if (equalIgnoringCase(val->function->name, "counters(")) {
                 parsedValue = parseCounterContent(args, true);
                 if (!parsedValue)
@@ -2022,6 +2050,29 @@ bool CSSParser::parseContent(int propId, bool important)
     return false;
 }
 
+PassRefPtr<CSSValue> CSSParser::parseAttr(CSSParserValueList* args)
+{
+    if (args->size() != 1)
+        return 0;
+
+    CSSParserValue* a = args->current();
+
+    if (a->unit != CSSPrimitiveValue::CSS_IDENT)
+        return 0;
+
+    String attrName = a->string;
+    // CSS allows identifiers with "-" at the start, like "-webkit-mask-image".
+    // But HTML attribute names can't have those characters, and we should not
+    // even parse them inside attr().
+    if (attrName[0] == '-')
+        return 0;
+
+    if (document()->isHTMLDocument())
+        attrName = attrName.lower();
+    
+    return CSSPrimitiveValue::create(attrName, CSSPrimitiveValue::CSS_ATTR);
+}
+
 PassRefPtr<CSSValue> CSSParser::parseBackgroundColor()
 {
     int id = m_valueList->current()->id;
@@ -2039,7 +2090,7 @@ bool CSSParser::parseFillImage(RefPtr<CSSValue>& value)
     }
     if (m_valueList->current()->unit == CSSPrimitiveValue::CSS_URI) {
         String uri = parseURL(m_valueList->current()->string);
-        if (!uri.isNull())
+        if (!uri.isNull() && m_styleSheet)
             value = CSSImageValue::create(m_styleSheet->completeURL(uri));
         return true;
     }
@@ -2208,7 +2259,10 @@ bool CSSParser::parseFillProperty(int propId, int& propId1, int& propId2,
                 case CSSPropertyWebkitBackgroundOrigin:
                 case CSSPropertyWebkitMaskClip:
                 case CSSPropertyWebkitMaskOrigin:
-                    if (val->id == CSSValueBorder || val->id == CSSValuePadding || val->id == CSSValueContent || val->id == CSSValueText) {
+                    // The first three values here are deprecated and should not be allowed to apply when we drop the -webkit-
+                    // from the property names.
+                    if (val->id == CSSValueBorder || val->id == CSSValuePadding || val->id == CSSValueContent ||
+                        val->id == CSSValueBorderBox || val->id == CSSValuePaddingBox || val->id == CSSValueContentBox || val->id == CSSValueText) {
                         currValue = CSSPrimitiveValue::createIdentifier(val->id);
                         m_valueList->next();
                     }
@@ -2216,7 +2270,7 @@ bool CSSParser::parseFillProperty(int propId, int& propId1, int& propId2,
                 case CSSPropertyBackgroundPosition:
                 case CSSPropertyWebkitMaskPosition:
                     parseFillPosition(currValue, currValue2);
-                    // unlike the other functions, parseFillPosition advances the m_valueList pointer
+                    // parseFillPosition advances the m_valueList pointer
                     break;
                 case CSSPropertyBackgroundPositionX:
                 case CSSPropertyWebkitMaskPositionX: {
@@ -2348,14 +2402,6 @@ PassRefPtr<CSSValue> CSSParser::parseAnimationName()
     return 0;
 }
 
-PassRefPtr<CSSValue> CSSParser::parseAnimationPlayState()
-{
-    CSSParserValue* value = m_valueList->current();
-    if (value->id == CSSValueRunning || value->id == CSSValuePaused)
-        return CSSPrimitiveValue::createIdentifier(value->id);
-    return 0;
-}
-
 PassRefPtr<CSSValue> CSSParser::parseAnimationProperty()
 {
     CSSParserValue* value = m_valueList->current();
@@ -2371,6 +2417,18 @@ PassRefPtr<CSSValue> CSSParser::parseAnimationProperty()
     return 0;
 }
 
+void CSSParser::parseTransformOriginShorthand(RefPtr<CSSValue>& value1, RefPtr<CSSValue>& value2, RefPtr<CSSValue>& value3)
+{
+    parseFillPosition(value1, value2);
+
+    // now get z
+    if (m_valueList->current() && validUnit(m_valueList->current(), FLength, m_strict))
+        value3 = CSSPrimitiveValue::create(m_valueList->current()->fValue,
+                                         (CSSPrimitiveValue::UnitTypes)m_valueList->current()->unit);
+    if (value3)
+        m_valueList->next();
+}
+
 bool CSSParser::parseTimingFunctionValue(CSSParserValueList*& args, double& result)
 {
     CSSParserValue* v = args->current();
@@ -2465,11 +2523,6 @@ bool CSSParser::parseAnimationProperty(int propId, RefPtr<CSSValue>& result)
                     if (currValue)
                         m_valueList->next();
                     break;
-                case CSSPropertyWebkitAnimationPlayState:
-                    currValue = parseAnimationPlayState();
-                    if (currValue)
-                        m_valueList->next();
-                    break;
                 case CSSPropertyWebkitTransitionProperty:
                     currValue = parseAnimationProperty();
                     if (currValue)
@@ -3088,7 +3141,7 @@ bool CSSParser::parseFontFaceSrc()
     RefPtr<CSSFontFaceSrcValue> uriValue;
     while ((val = m_valueList->current())) {
         RefPtr<CSSFontFaceSrcValue> parsedValue;
-        if (val->unit == CSSPrimitiveValue::CSS_URI && !expectComma) {
+        if (val->unit == CSSPrimitiveValue::CSS_URI && !expectComma && m_styleSheet) {
             String value = parseURL(val->string);
             parsedValue = CSSFontFaceSrcValue::create(m_styleSheet->completeURL(value));
             uriValue = parsedValue;
@@ -3467,7 +3520,7 @@ bool CSSParser::parseShadow(int propId, bool important)
         else {
             // The only other type of value that's ok is a color value.
             RefPtr<CSSPrimitiveValue> parsedColor;
-            bool isColor = (val->id >= CSSValueAqua && val->id <= CSSValueWindowtext || val->id == CSSValueMenu ||
+            bool isColor = ((val->id >= CSSValueAqua && val->id <= CSSValueWindowtext) || val->id == CSSValueMenu ||
                             (val->id >= CSSValueWebkitFocusRingColor && val->id <= CSSValueWebkitText && !m_strict));
             if (isColor) {
                 if (!context.allowColor)
@@ -3689,7 +3742,7 @@ bool CSSParser::parseBorderImage(int propId, bool important, RefPtr<CSSValue>& r
     // Look for an image initially.  If the first value is not a URI, then we're done.
     BorderImageParseContext context;
     CSSParserValue* val = m_valueList->current();
-    if (val->unit == CSSPrimitiveValue::CSS_URI) {        
+    if (val->unit == CSSPrimitiveValue::CSS_URI && m_styleSheet) {        
         String uri = parseURL(val->string);
         if (uri.isNull())
             return false;
@@ -3795,7 +3848,7 @@ static PassRefPtr<CSSPrimitiveValue> parseGradientPoint(CSSParserValue* a, bool
     return result;
 }
 
-bool parseGradientColorStop(CSSParser* p, CSSParserValue* a, CSSGradientColorStop& stop)
+static bool parseGradientColorStop(CSSParser* p, CSSParserValue* a, CSSGradientColorStop& stop)
 {
     if (a->unit != CSSParserValue::Function)
         return false;
@@ -4006,17 +4059,37 @@ public:
     , m_allowSingleArgument(false)
     , m_unit(CSSParser::FUnknown)
     {
-        if (equalIgnoringCase(name, "scale(") || equalIgnoringCase(name, "scalex(") || equalIgnoringCase(name, "scaley(")) {
+        if (equalIgnoringCase(name, "scale(") || equalIgnoringCase(name, "scalex(") || equalIgnoringCase(name, "scaley(") || equalIgnoringCase(name, "scalez(")) {
             m_unit = CSSParser::FNumber;
             if (equalIgnoringCase(name, "scale("))
                 m_type = WebKitCSSTransformValue::ScaleTransformOperation;
             else if (equalIgnoringCase(name, "scalex("))
                 m_type = WebKitCSSTransformValue::ScaleXTransformOperation;
-            else
+            else if (equalIgnoringCase(name, "scaley("))
                 m_type = WebKitCSSTransformValue::ScaleYTransformOperation;
+            else
+                m_type = WebKitCSSTransformValue::ScaleZTransformOperation;
+        } else if (equalIgnoringCase(name, "scale3d(")) {
+            m_type = WebKitCSSTransformValue::Scale3DTransformOperation;
+            m_argCount = 5;
+            m_unit = CSSParser::FNumber;
         } else if (equalIgnoringCase(name, "rotate(")) {
             m_type = WebKitCSSTransformValue::RotateTransformOperation;
             m_unit = CSSParser::FAngle;
+        } else if (equalIgnoringCase(name, "rotatex(") ||
+                   equalIgnoringCase(name, "rotatey(") ||
+                   equalIgnoringCase(name, "rotatez(")) {
+            m_unit = CSSParser::FAngle;
+            if (equalIgnoringCase(name, "rotatex("))
+                m_type = WebKitCSSTransformValue::RotateXTransformOperation;
+            else if (equalIgnoringCase(name, "rotatey("))
+                m_type = WebKitCSSTransformValue::RotateYTransformOperation;
+            else
+                m_type = WebKitCSSTransformValue::RotateZTransformOperation;
+        } else if (equalIgnoringCase(name, "rotate3d(")) {
+            m_type = WebKitCSSTransformValue::Rotate3DTransformOperation;
+            m_argCount = 7;
+            m_unit = CSSParser::FNumber;
         } else if (equalIgnoringCase(name, "skew(") || equalIgnoringCase(name, "skewx(") || equalIgnoringCase(name, "skewy(")) {
             m_unit = CSSParser::FAngle;
             if (equalIgnoringCase(name, "skew("))
@@ -4025,20 +4098,33 @@ public:
                 m_type = WebKitCSSTransformValue::SkewXTransformOperation;
             else
                 m_type = WebKitCSSTransformValue::SkewYTransformOperation;
-        } else if (equalIgnoringCase(name, "translate(") || equalIgnoringCase(name, "translatex(") || equalIgnoringCase(name, "translatey(")) {
+        } else if (equalIgnoringCase(name, "translate(") || equalIgnoringCase(name, "translatex(") || equalIgnoringCase(name, "translatey(") || equalIgnoringCase(name, "translatez(")) {
             m_unit = CSSParser::FLength | CSSParser::FPercent;
             if (equalIgnoringCase(name, "translate("))
                 m_type = WebKitCSSTransformValue::TranslateTransformOperation;
             else if (equalIgnoringCase(name, "translatex("))
                 m_type = WebKitCSSTransformValue::TranslateXTransformOperation;
-            else
+            else if (equalIgnoringCase(name, "translatey("))
                 m_type = WebKitCSSTransformValue::TranslateYTransformOperation;
+            else
+                m_type = WebKitCSSTransformValue::TranslateZTransformOperation;
+        } else if (equalIgnoringCase(name, "translate3d(")) {
+            m_type = WebKitCSSTransformValue::Translate3DTransformOperation;
+            m_argCount = 5;
+            m_unit = CSSParser::FLength | CSSParser::FPercent;
         } else if (equalIgnoringCase(name, "matrix(")) {
             m_type = WebKitCSSTransformValue::MatrixTransformOperation;
             m_argCount = 11;
             m_unit = CSSParser::FNumber;
+        } else if (equalIgnoringCase(name, "matrix3d(")) {
+            m_type = WebKitCSSTransformValue::Matrix3DTransformOperation;
+            m_argCount = 31;
+            m_unit = CSSParser::FNumber;
+        } else if (equalIgnoringCase(name, "perspective(")) {
+            m_type = WebKitCSSTransformValue::PerspectiveTransformOperation;
+            m_unit = CSSParser::FNumber;
         }
-        
+
         if (equalIgnoringCase(name, "scale(") || equalIgnoringCase(name, "skew(") || equalIgnoringCase(name, "translate(")) {
             m_allowSingleArgument = true;
             m_argCount = 3;
@@ -4094,7 +4180,11 @@ PassRefPtr<CSSValueList> CSSParser::parseTransform()
         while (a) {
             CSSParser::Units unit = info.unit();
 
-            if (!validUnit(a, unit, true))
+            // 4th param of rotate3d() is an angle rather than a bare number, validate it as such
+            if (info.type() == WebKitCSSTransformValue::Rotate3DTransformOperation && argNumber == 3) {
+                if (!validUnit(a, FAngle, true))
+                    return 0;
+            } else if (!validUnit(a, unit, true))
                 return 0;
             
             // Add the value to the current transform operation.
@@ -4114,19 +4204,21 @@ PassRefPtr<CSSValueList> CSSParser::parseTransform()
     return list.release();
 }
 
-bool CSSParser::parseTransformOrigin(int propId, int& propId1, int& propId2, RefPtr<CSSValue>& value, RefPtr<CSSValue>& value2)
+bool CSSParser::parseTransformOrigin(int propId, int& propId1, int& propId2, int& propId3, RefPtr<CSSValue>& value, RefPtr<CSSValue>& value2, RefPtr<CSSValue>& value3)
 {
     propId1 = propId;
     propId2 = propId;
+    propId3 = propId;
     if (propId == CSSPropertyWebkitTransformOrigin) {
         propId1 = CSSPropertyWebkitTransformOriginX;
         propId2 = CSSPropertyWebkitTransformOriginY;
+        propId3 = CSSPropertyWebkitTransformOriginZ;
     }
 
     switch (propId) {
         case CSSPropertyWebkitTransformOrigin:
-            parseFillPosition(value, value2);
-            // Unlike the other functions, parseFillPosition advances the m_valueList pointer
+            parseTransformOriginShorthand(value, value2, value3);
+            // parseTransformOriginShorthand advances the m_valueList pointer
             break;
         case CSSPropertyWebkitTransformOriginX: {
             bool xFound = false, yFound = true;
@@ -4142,6 +4234,45 @@ bool CSSParser::parseTransformOrigin(int propId, int& propId1, int& propId2, Ref
                 m_valueList->next();
             break;
         }
+        case CSSPropertyWebkitTransformOriginZ: {
+            if (validUnit(m_valueList->current(), FLength, m_strict))
+            value = CSSPrimitiveValue::create(m_valueList->current()->fValue, (CSSPrimitiveValue::UnitTypes)m_valueList->current()->unit);
+            if (value)
+                m_valueList->next();
+            break;
+        }
+    }
+    
+    return value;
+}
+
+bool CSSParser::parsePerspectiveOrigin(int propId, int& propId1, int& propId2, RefPtr<CSSValue>& value, RefPtr<CSSValue>& value2)
+{
+    propId1 = propId;
+    propId2 = propId;
+    if (propId == CSSPropertyWebkitPerspectiveOrigin) {
+        propId1 = CSSPropertyWebkitPerspectiveOriginX;
+        propId2 = CSSPropertyWebkitPerspectiveOriginY;
+    }
+
+    switch (propId) {
+        case CSSPropertyWebkitPerspectiveOrigin:
+            parseFillPosition(value, value2);
+            break;
+        case CSSPropertyWebkitPerspectiveOriginX: {
+            bool xFound = false, yFound = true;
+            value = parseFillPositionXY(xFound, yFound);
+            if (value)
+                m_valueList->next();
+            break;
+        }
+        case CSSPropertyWebkitPerspectiveOriginY: {
+            bool xFound = true, yFound = false;
+            value = parseFillPositionXY(xFound, yFound);
+            if (value)
+                m_valueList->next();
+            break;
+        }
     }
     
     return value;
@@ -4558,7 +4689,7 @@ CSSRule* CSSParser::createStyleRule(Vector<CSSSelector*>* selectors)
 CSSRule* CSSParser::createFontFaceRule()
 {
     RefPtr<CSSFontFaceRule> rule = CSSFontFaceRule::create(m_styleSheet);
-    for (int i = 0; i < m_numParsedProperties; ++i) {
+    for (unsigned i = 0; i < m_numParsedProperties; ++i) {
         CSSProperty* property = m_parsedProperties[i];
         int id = property->id();
         if ((id == CSSPropertyFontWeight || id == CSSPropertyFontStyle || id == CSSPropertyFontVariant) && property->value()->isPrimitiveValue()) {
@@ -4699,7 +4830,7 @@ void CSSParser::deleteFontFaceOnlyValues()
     ASSERT(m_hasFontFaceOnlyValues);
     int deletedProperties = 0;
 
-    for (int i = 0; i < m_numParsedProperties; ++i) {
+    for (unsigned i = 0; i < m_numParsedProperties; ++i) {
         CSSProperty* property = m_parsedProperties[i];
         int id = property->id();
         if ((id == CSSPropertyFontWeight || id == CSSPropertyFontStyle || id == CSSPropertyFontVariant) && property->value()->isValueList()) {
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParser.h b/src/3rdparty/webkit/WebCore/css/CSSParser.h
index 83aafa4..d47720f 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParser.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSParser.h
@@ -75,6 +75,8 @@ namespace WebCore {
         bool parse4Values(int propId, const int* properties, bool important);
         bool parseContent(int propId, bool important);
 
+        PassRefPtr<CSSValue> parseAttr(CSSParserValueList* args);
+
         PassRefPtr<CSSValue> parseBackgroundColor();
 
         bool parseFillImage(RefPtr<CSSValue>&);
@@ -94,10 +96,10 @@ namespace WebCore {
         PassRefPtr<CSSValue> parseAnimationDuration();
         PassRefPtr<CSSValue> parseAnimationIterationCount();
         PassRefPtr<CSSValue> parseAnimationName();
-        PassRefPtr<CSSValue> parseAnimationPlayState();
         PassRefPtr<CSSValue> parseAnimationProperty();
         PassRefPtr<CSSValue> parseAnimationTimingFunction();
 
+        void parseTransformOriginShorthand(RefPtr<CSSValue>&, RefPtr<CSSValue>&, RefPtr<CSSValue>&);
         bool parseTimingFunctionValue(CSSParserValueList*& args, double& result);
         bool parseAnimationProperty(int propId, RefPtr<CSSValue>&);
         bool parseTransitionShorthand(bool important);
@@ -145,8 +147,8 @@ namespace WebCore {
         bool parseGradient(RefPtr<CSSValue>&);
 
         PassRefPtr<CSSValueList> parseTransform();
-        bool parseTransformOrigin(int propId, int& propId1, int& propId2, RefPtr<CSSValue>&, RefPtr<CSSValue>&);
-
+        bool parseTransformOrigin(int propId, int& propId1, int& propId2, int& propId3, RefPtr<CSSValue>&, RefPtr<CSSValue>&, RefPtr<CSSValue>&);
+        bool parsePerspectiveOrigin(int propId, int& propId1, int& propId2,  RefPtr<CSSValue>&, RefPtr<CSSValue>&);
         bool parseVariable(CSSVariablesDeclaration*, const String& variableName, const String& variableValue);
         void parsePropertyWithResolvedVariables(int propId, bool important, CSSMutableStyleDeclaration*, CSSParserValueList*);
 
@@ -200,8 +202,8 @@ namespace WebCore {
         CSSParserValueList* m_valueList;
         CSSProperty** m_parsedProperties;
         CSSSelectorList* m_selectorListForParseSelector;
-        int m_numParsedProperties;
-        int m_maxParsedProperties;
+        unsigned m_numParsedProperties;
+        unsigned m_maxParsedProperties;
 
         int m_inParseShorthand;
         int m_currentShorthand;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParserValues.cpp b/src/3rdparty/webkit/WebCore/css/CSSParserValues.cpp
index 6baa5b0..dbfae78 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParserValues.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSParserValues.cpp
@@ -42,7 +42,7 @@ CSSParserValueList::~CSSParserValueList()
 
 void CSSParserValueList::addValue(const CSSParserValue& v)
 {
-    if (v.isVariable())
+    if (v.unit == CSSPrimitiveValue::CSS_PARSER_VARIABLE_FUNCTION_SYNTAX) // isVariable() is not inlined. This is hot.
         m_variablesCount++;
     m_values.append(v);
 }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSParserValues.h b/src/3rdparty/webkit/WebCore/css/CSSParserValues.h
index 4e0a280..24bd9b7 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSParserValues.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSParserValues.h
@@ -83,7 +83,7 @@ public:
     bool containsVariables() const { return m_variablesCount; }
 
 private:
-    Vector<CSSParserValue, 16> m_values;
+    Vector<CSSParserValue, 4> m_values;
     unsigned m_current;
     unsigned m_variablesCount;
 };
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
index a160454..15c5a01 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.cpp
@@ -485,7 +485,7 @@ void CSSPrimitiveValue::setFloatValue(unsigned short unitType, double floatValue
     m_type = unitType;
 }
 
-double scaleFactorForConversion(unsigned short unitType)
+static double scaleFactorForConversion(unsigned short unitType)
 {
     double factor = 1.0;
     switch (unitType) {
@@ -754,9 +754,18 @@ String CSSPrimitiveValue::cssText() const
         case CSS_IDENT:
             text = valueOrPropertyName(m_value.ident);
             break;
-        case CSS_ATTR:
-            // FIXME
-            break;
+        case CSS_ATTR: {
+            DEFINE_STATIC_LOCAL(const String, attrParen, ("attr("));
+
+            Vector<UChar> result;
+            result.reserveInitialCapacity(6 + m_value.string->length());
+
+            append(result, attrParen);
+            append(result, m_value.string);
+            result.uncheckedAppend(')');
+
+            return String::adopt(result);
+        }
         case CSS_COUNTER:
             text = "counter(";
             text += String::number(m_value.num);
@@ -768,7 +777,7 @@ String CSSPrimitiveValue::cssText() const
 
             Rect* rectVal = getRectValue();
             Vector<UChar> result;
-            result.reserveCapacity(32);
+            result.reserveInitialCapacity(32);
             append(result, rectParen);
 
             append(result, rectVal->top()->cssText());
@@ -797,7 +806,7 @@ String CSSPrimitiveValue::cssText() const
             Color color(rgbColor);
 
             Vector<UChar> result;
-            result.reserveCapacity(32);
+            result.reserveInitialCapacity(32);
             if (color.hasAlpha())
                 append(result, rgbaParen);
             else
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.h b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.h
index d552ca0..8abeb4d 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.h
@@ -81,6 +81,8 @@ public:
         // This unit is in CSS 3, but that isn't a finished standard yet
         CSS_TURN = 108
     };
+    
+    static bool isUnitTypeLength(int type) { return type > CSSPrimitiveValue::CSS_PERCENTAGE && type < CSSPrimitiveValue::CSS_DEG; }
 
     static PassRefPtr<CSSPrimitiveValue> createIdentifier(int ident);
     static PassRefPtr<CSSPrimitiveValue> createColor(unsigned rgbValue);
@@ -155,7 +157,7 @@ public:
     DashboardRegion* getDashboardRegionValue() const { return m_type != CSS_DASHBOARD_REGION ? 0 : m_value.region; }
 
     int getIdent();
-    template<typename T> operator T() const; // Defined in CSSPrimitiveValueMappings.h
+    template<typename T> inline operator T() const; // Defined in CSSPrimitiveValueMappings.h
 
     virtual bool parseString(const String&, bool = false);
     virtual String cssText() const;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.idl b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.idl
index b049c29..befe5ac 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValue.idl
@@ -69,7 +69,7 @@ module css {
             raises(DOMException);
         Rect getRectValue()
             raises(DOMException);
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         RGBColor getRGBColorValue()
             raises(DOMException);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
index fcbf06a..fd1d203 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSPrimitiveValueMappings.h
@@ -29,7 +29,12 @@
 
 #include "CSSPrimitiveValue.h"
 #include "CSSValueKeywords.h"
-#include "RenderStyle.h"
+#include "GraphicsTypes.h"
+#include "Path.h"
+#include "RenderStyleConstants.h"
+#include "SVGRenderStyleDefs.h"
+#include "TextDirection.h"
+#include "ThemeTypes.h"
 
 namespace WebCore {
 
@@ -216,6 +221,15 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ControlPart e)
         case MediaSliderThumbPart:
             m_value.ident = CSSValueMediaSliderthumb;
             break;
+        case MediaTimelineContainerPart:
+            m_value.ident = CSSValueMediaTimelineContainer;
+            break;
+        case MediaCurrentTimePart:
+            m_value.ident = CSSValueMediaCurrentTimeDisplay;
+            break;
+        case MediaTimeRemainingPart:
+            m_value.ident = CSSValueMediaTimeRemainingDisplay;
+            break;
         case MenulistPart:
             m_value.ident = CSSValueMenulist;
             break;
@@ -283,13 +297,13 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EFillBox e)
 {
     switch (e) {
         case BorderFillBox:
-            m_value.ident = CSSValueBorder;
+            m_value.ident = CSSValueBorderBox;
             break;
         case PaddingFillBox:
-            m_value.ident = CSSValuePadding;
+            m_value.ident = CSSValuePaddingBox;
             break;
         case ContentFillBox:
-            m_value.ident = CSSValueContent;
+            m_value.ident = CSSValueContentBox;
             break;
         case TextFillBox:
             m_value.ident = CSSValueText;
@@ -301,10 +315,13 @@ template<> inline CSSPrimitiveValue::operator EFillBox() const
 {
     switch (m_value.ident) {
         case CSSValueBorder:
+        case CSSValueBorderBox:
             return BorderFillBox;
         case CSSValuePadding:
+        case CSSValuePaddingBox:
             return PaddingFillBox;
         case CSSValueContent:
+        case CSSValueContentBox:
             return ContentFillBox;
         case CSSValueText:
             return TextFillBox;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPropertyLonghand.cpp b/src/3rdparty/webkit/WebCore/css/CSSPropertyLonghand.cpp
new file mode 100644
index 0000000..310f90e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/CSSPropertyLonghand.cpp
@@ -0,0 +1,213 @@
+/*
+ * (C) 1999-2003 Lars Knoll (knoll@kde.org)
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "CSSPropertyLonghand.h"
+
+#include "CSSPropertyNames.h"
+#include <wtf/HashMap.h>
+#include <wtf/StdLibExtras.h>
+
+namespace WebCore {
+
+typedef HashMap<int, CSSPropertyLonghand> ShorthandMap;
+
+static void initShorthandMap(ShorthandMap& shorthandMap)
+{
+    #define SET_SHORTHAND_MAP_ENTRY(map, propID, array) \
+        map.set(propID, CSSPropertyLonghand(array, sizeof(array) / sizeof(array[0])))
+
+    // FIXME: The 'font' property has "shorthand nature" but is not parsed as a shorthand.
+
+    // Do not change the order of the following four shorthands, and keep them together.
+    static const int borderProperties[4][3] = {
+        { CSSPropertyBorderTopColor, CSSPropertyBorderTopStyle, CSSPropertyBorderTopWidth },
+        { CSSPropertyBorderRightColor, CSSPropertyBorderRightStyle, CSSPropertyBorderRightWidth },
+        { CSSPropertyBorderBottomColor, CSSPropertyBorderBottomStyle, CSSPropertyBorderBottomWidth },
+        { CSSPropertyBorderLeftColor, CSSPropertyBorderLeftStyle, CSSPropertyBorderLeftWidth }
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderTop, borderProperties[0]);
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderRight, borderProperties[1]);
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderBottom, borderProperties[2]);
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderLeft, borderProperties[3]);
+
+    shorthandMap.set(CSSPropertyBorder, CSSPropertyLonghand(borderProperties[0], sizeof(borderProperties) / sizeof(borderProperties[0][0])));
+
+    static const int borderColorProperties[] = {
+        CSSPropertyBorderTopColor,
+        CSSPropertyBorderRightColor,
+        CSSPropertyBorderBottomColor,
+        CSSPropertyBorderLeftColor
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderColor, borderColorProperties);
+
+    static const int borderStyleProperties[] = {
+        CSSPropertyBorderTopStyle,
+        CSSPropertyBorderRightStyle,
+        CSSPropertyBorderBottomStyle,
+        CSSPropertyBorderLeftStyle
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderStyle, borderStyleProperties);
+
+    static const int borderWidthProperties[] = {
+        CSSPropertyBorderTopWidth,
+        CSSPropertyBorderRightWidth,
+        CSSPropertyBorderBottomWidth,
+        CSSPropertyBorderLeftWidth
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderWidth, borderWidthProperties);
+
+    static const int backgroundPositionProperties[] = { CSSPropertyBackgroundPositionX, CSSPropertyBackgroundPositionY };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBackgroundPosition, backgroundPositionProperties);
+
+    static const int borderSpacingProperties[] = { CSSPropertyWebkitBorderHorizontalSpacing, CSSPropertyWebkitBorderVerticalSpacing };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBorderSpacing, borderSpacingProperties);
+
+    static const int listStyleProperties[] = {
+        CSSPropertyListStyleImage,
+        CSSPropertyListStylePosition,
+        CSSPropertyListStyleType
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyListStyle, listStyleProperties);
+
+    static const int marginProperties[] = {
+        CSSPropertyMarginTop,
+        CSSPropertyMarginRight,
+        CSSPropertyMarginBottom,
+        CSSPropertyMarginLeft
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyMargin, marginProperties);
+
+    static const int marginCollapseProperties[] = { CSSPropertyWebkitMarginTopCollapse, CSSPropertyWebkitMarginBottomCollapse };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMarginCollapse, marginCollapseProperties);
+
+    static const int marqueeProperties[] = {
+        CSSPropertyWebkitMarqueeDirection,
+        CSSPropertyWebkitMarqueeIncrement,
+        CSSPropertyWebkitMarqueeRepetition,
+        CSSPropertyWebkitMarqueeStyle,
+        CSSPropertyWebkitMarqueeSpeed
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMarquee, marqueeProperties);
+
+    static const int outlineProperties[] = {
+        CSSPropertyOutlineColor,
+        CSSPropertyOutlineOffset,
+        CSSPropertyOutlineStyle,
+        CSSPropertyOutlineWidth
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyOutline, outlineProperties);
+
+    static const int paddingProperties[] = {
+        CSSPropertyPaddingTop,
+        CSSPropertyPaddingRight,
+        CSSPropertyPaddingBottom,
+        CSSPropertyPaddingLeft
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyPadding, paddingProperties);
+
+    static const int textStrokeProperties[] = { CSSPropertyWebkitTextStrokeColor, CSSPropertyWebkitTextStrokeWidth };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitTextStroke, textStrokeProperties);
+
+    static const int backgroundProperties[] = {
+        CSSPropertyBackgroundAttachment,
+        CSSPropertyWebkitBackgroundClip,
+        CSSPropertyBackgroundColor,
+        CSSPropertyBackgroundImage,
+        CSSPropertyWebkitBackgroundOrigin,
+        CSSPropertyBackgroundPositionX,
+        CSSPropertyBackgroundPositionY,
+        CSSPropertyBackgroundRepeat,
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyBackground, backgroundProperties);
+
+    static const int columnsProperties[] = { CSSPropertyWebkitColumnWidth, CSSPropertyWebkitColumnCount };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitColumns, columnsProperties);
+
+    static const int columnRuleProperties[] = {
+        CSSPropertyWebkitColumnRuleColor,
+        CSSPropertyWebkitColumnRuleStyle,
+        CSSPropertyWebkitColumnRuleWidth
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitColumnRule, columnRuleProperties);
+
+    static const int overflowProperties[] = { CSSPropertyOverflowX, CSSPropertyOverflowY };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyOverflow, overflowProperties);
+
+    static const int borderRadiusProperties[] = {
+        CSSPropertyWebkitBorderTopRightRadius,
+        CSSPropertyWebkitBorderTopLeftRadius,
+        CSSPropertyWebkitBorderBottomLeftRadius,
+        CSSPropertyWebkitBorderBottomRightRadius
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitBorderRadius, borderRadiusProperties);
+
+    static const int maskPositionProperties[] = { CSSPropertyWebkitMaskPositionX, CSSPropertyWebkitMaskPositionY };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMaskPosition, maskPositionProperties);
+
+    static const int maskProperties[] = {
+        CSSPropertyWebkitMaskAttachment,
+        CSSPropertyWebkitMaskClip,
+        CSSPropertyWebkitMaskImage,
+        CSSPropertyWebkitMaskOrigin,
+        CSSPropertyWebkitMaskPositionX,
+        CSSPropertyWebkitMaskPositionY,
+        CSSPropertyWebkitMaskRepeat,
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitMask, maskProperties);
+
+    static const int animationProperties[] = {
+        CSSPropertyWebkitAnimationName,
+        CSSPropertyWebkitAnimationDuration,
+        CSSPropertyWebkitAnimationTimingFunction,
+        CSSPropertyWebkitAnimationDelay,
+        CSSPropertyWebkitAnimationIterationCount,
+        CSSPropertyWebkitAnimationDirection
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitAnimation, animationProperties);
+
+    static const int transitionProperties[] = {
+        CSSPropertyWebkitTransitionProperty,
+        CSSPropertyWebkitTransitionDuration,
+        CSSPropertyWebkitTransitionTimingFunction,
+        CSSPropertyWebkitTransitionDelay
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitTransition, transitionProperties);
+
+    static const int transformOriginProperties[] = {
+        CSSPropertyWebkitTransformOriginX,
+        CSSPropertyWebkitTransformOriginY
+    };
+    SET_SHORTHAND_MAP_ENTRY(shorthandMap, CSSPropertyWebkitTransformOrigin, transformOriginProperties);
+    
+    #undef SET_SHORTHAND_MAP_ENTRY
+}
+
+CSSPropertyLonghand longhandForProperty(int propertyID)
+{
+    DEFINE_STATIC_LOCAL(ShorthandMap, shorthandMap, ());
+    if (shorthandMap.isEmpty())
+        initShorthandMap(shorthandMap);
+
+    return shorthandMap.get(propertyID);
+}
+
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPropertyLonghand.h b/src/3rdparty/webkit/WebCore/css/CSSPropertyLonghand.h
new file mode 100644
index 0000000..9633c02
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/CSSPropertyLonghand.h
@@ -0,0 +1,53 @@
+/*
+ * (C) 1999-2003 Lars Knoll (knoll@kde.org)
+ * Copyright (C) 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef CSSPropertyLonghand_h
+#define CSSPropertyLonghand_h
+
+namespace WebCore {
+
+class CSSPropertyLonghand {
+public:
+    CSSPropertyLonghand()
+        : m_properties(0)
+        , m_length(0)
+    {
+    }
+
+    CSSPropertyLonghand(const int* firstProperty, unsigned numProperties)
+        : m_properties(firstProperty)
+        , m_length(numProperties)
+    {
+    }
+
+    const int* properties() const { return m_properties; }
+    unsigned length() const { return m_length; }
+
+private:
+    const int* m_properties;
+    unsigned m_length;
+};
+
+// Returns an empty list if the property is not a shorthand
+CSSPropertyLonghand longhandForProperty(int);
+
+} // namespace WebCore
+
+#endif // CSSPropertyLonghand_h
diff --git a/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in b/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
index 3ca14bc..df17d97 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
+++ b/src/3rdparty/webkit/WebCore/css/CSSPropertyNames.in
@@ -99,13 +99,6 @@ position
 quotes
 resize
 right
-scrollbar-3dlight-color
-scrollbar-arrow-color
-scrollbar-darkshadow-color
-scrollbar-face-color
-scrollbar-highlight-color
-scrollbar-shadow-color
-scrollbar-track-color
 size
 src
 table-layout
@@ -149,9 +142,9 @@ zoom
 -webkit-animation-duration
 -webkit-animation-iteration-count
 -webkit-animation-name
--webkit-animation-play-state
 -webkit-animation-timing-function
 -webkit-appearance
+-webkit-backface-visibility
 -webkit-background-clip
 -webkit-background-composite
 -webkit-background-origin
@@ -217,6 +210,10 @@ zoom
 -webkit-match-nearest-mail-blockquote-color
 -webkit-nbsp-mode
 -webkit-padding-start
+-webkit-perspective
+-webkit-perspective-origin
+-webkit-perspective-origin-x
+-webkit-perspective-origin-y
 -webkit-rtl-ordering
 -webkit-text-decorations-in-effect
 -webkit-text-fill-color
@@ -229,6 +226,8 @@ zoom
 -webkit-transform-origin
 -webkit-transform-origin-x
 -webkit-transform-origin-y
+-webkit-transform-origin-z
+-webkit-transform-style
 -webkit-transition
 -webkit-transition-delay
 -webkit-transition-duration
diff --git a/src/3rdparty/webkit/WebCore/css/CSSRule.idl b/src/3rdparty/webkit/WebCore/css/CSSRule.idl
index 4d9e568..f13f293 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSRule.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSRule.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -23,7 +23,7 @@ module css {
     // Introduced in DOM Level 2:
     interface [
         GenerateConstructor,
-        ObjCCustomInternalImpl,
+        Polymorphic,
         InterfaceUUID=548139b4-31ab-4978-b1d5-cfcfdfbaea0e,
         ImplementationUUID=0268e673-2489-4743-9a3a-197dae4b4d9c
     ] CSSRule {
diff --git a/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp b/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp
index cc296d9..17fbd64 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSSelector.cpp
@@ -104,11 +104,13 @@ void CSSSelector::extractPseudoType() const
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsPanel, ("-webkit-media-controls-panel"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsMuteButton, ("-webkit-media-controls-mute-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsPlayButton, ("-webkit-media-controls-play-button"));
-    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimeDisplay, ("-webkit-media-controls-time-display"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimeline, ("-webkit-media-controls-timeline"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsSeekBackButton, ("-webkit-media-controls-seek-back-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsSeekForwardButton, ("-webkit-media-controls-seek-forward-button"));
     DEFINE_STATIC_LOCAL(AtomicString, mediaControlsFullscreenButton, ("-webkit-media-controls-fullscreen-button"));
+    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimelineContainer, ("-webkit-media-controls-timeline-container"));
+    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsCurrentTimeDisplay, ("-webkit-media-controls-current-time-display"));
+    DEFINE_STATIC_LOCAL(AtomicString, mediaControlsTimeRemainingDisplay, ("-webkit-media-controls-time-remaining-display"));
     DEFINE_STATIC_LOCAL(AtomicString, notStr, ("not("));
     DEFINE_STATIC_LOCAL(AtomicString, onlyChild, ("only-child"));
     DEFINE_STATIC_LOCAL(AtomicString, onlyOfType, ("only-of-type"));
@@ -219,8 +221,11 @@ void CSSSelector::extractPseudoType() const
     } else if (m_value == mediaControlsPlayButton) {
         m_pseudoType = PseudoMediaControlsPlayButton;
         element = true;
-    } else if (m_value == mediaControlsTimeDisplay) {
-        m_pseudoType = PseudoMediaControlsTimeDisplay;
+    } else if (m_value == mediaControlsCurrentTimeDisplay) {
+        m_pseudoType = PseudoMediaControlsCurrentTimeDisplay;
+        element = true;
+    } else if (m_value == mediaControlsTimeRemainingDisplay) {
+        m_pseudoType = PseudoMediaControlsTimeRemainingDisplay;
         element = true;
     } else if (m_value == mediaControlsTimeline) {
         m_pseudoType = PseudoMediaControlsTimeline;
@@ -234,6 +239,9 @@ void CSSSelector::extractPseudoType() const
     } else if (m_value == mediaControlsFullscreenButton) {
         m_pseudoType = PseudoMediaControlsFullscreenButton;
         element = true;
+    } else if (m_value == mediaControlsTimelineContainer) {
+        m_pseudoType = PseudoMediaControlsTimelineContainer;
+        element = true;
     } else if (m_value == notStr)
         m_pseudoType = PseudoNot;
     else if (m_value == nthChild)
@@ -374,7 +382,11 @@ String CSSSelector::selectorText() const
                 if (CSSSelector* subSel = cs->simpleSelector())
                     str += subSel->selectorText();
                 str += ")";
-            } else if (cs->pseudoType() == PseudoLang) {
+            } else if (cs->pseudoType() == PseudoLang
+                    || cs->pseudoType() == PseudoNthChild
+                    || cs->pseudoType() == PseudoNthLastChild
+                    || cs->pseudoType() == PseudoNthOfType
+                    || cs->pseudoType() == PseudoNthLastOfType) {
                 str += cs->argument();
                 str += ")";
             }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSSelector.h b/src/3rdparty/webkit/WebCore/css/CSSSelector.h
index 8da11d7..728c34d 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSSelector.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSSelector.h
@@ -167,7 +167,9 @@ namespace WebCore {
             PseudoMediaControlsPanel,
             PseudoMediaControlsMuteButton,
             PseudoMediaControlsPlayButton,
-            PseudoMediaControlsTimeDisplay,
+            PseudoMediaControlsTimelineContainer,
+            PseudoMediaControlsCurrentTimeDisplay,
+            PseudoMediaControlsTimeRemainingDisplay,
             PseudoMediaControlsTimeline,
             PseudoMediaControlsSeekBackButton,
             PseudoMediaControlsSeekForwardButton,
diff --git a/src/3rdparty/webkit/WebCore/css/CSSSelectorList.cpp b/src/3rdparty/webkit/WebCore/css/CSSSelectorList.cpp
index 7276141..5ad3809 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSSelectorList.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSSelectorList.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -54,7 +55,11 @@ void CSSSelectorList::adoptSelectorVector(Vector<CSSSelector*>& selectorVector)
     m_selectorArray = reinterpret_cast<CSSSelector*>(fastMalloc(sizeof(CSSSelector) * selectorVector.size()));
     for (size_t i = 0; i < size; ++i) {
         memcpy(&m_selectorArray[i], selectorVector[i], sizeof(CSSSelector));
-        fastFree(selectorVector[i]);
+        // We want to free the memory (which was allocated with new), but we
+        // don't want the destructor to run since it will affect the copy
+        // we've just made. In theory this is undefined, but operator delete
+        // is only defined taking a void*, so in practice it should be ok.
+        delete reinterpret_cast<char*>(selectorVector[i]);
         ASSERT(!m_selectorArray[i].isLastInSelectorList());
     }
     m_selectorArray[size - 1].setLastInSelectorList();
@@ -65,15 +70,25 @@ void CSSSelectorList::deleteSelectors()
 {
     if (!m_selectorArray)
         return;
+
+    // We had two cases in adoptSelectVector. The fast case of a 1 element
+    // vector took the CSSSelector directly, which was allocated with new.
+    // The second case we allocated a new fastMalloc buffer, which should be
+    // freed with fastFree, and the destructors called manually.
     CSSSelector* s = m_selectorArray;
-    while (1) {
-        bool done = s->isLastInSelectorList();
-        s->~CSSSelector();
-        if (done)
-            break;
-        ++s;
+    bool done = s->isLastInSelectorList();
+    if (done)
+        delete s;
+    else {
+        while (1) {
+            s->~CSSSelector();
+            if (done)
+                break;
+            ++s;
+            done = s->isLastInSelectorList();
+        }
+        fastFree(m_selectorArray);
     }
-    fastFree(m_selectorArray); 
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.cpp
index b840e07..404a978 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.cpp
@@ -118,6 +118,12 @@ CSSRule* CSSStyleDeclaration::parentRule() const
     return (parent() && parent()->isRule()) ? static_cast<CSSRule*>(parent()) : 0;
 }
 
+bool CSSStyleDeclaration::cssPropertyMatches(const CSSProperty* property) const
+{
+    RefPtr<CSSValue> value = getPropertyCSSValue(property->id());
+    return value && value->cssText() == property->value()->cssText();
+}
+
 void CSSStyleDeclaration::diff(CSSMutableStyleDeclaration* style) const
 {
     if (!style)
@@ -128,8 +134,7 @@ void CSSStyleDeclaration::diff(CSSMutableStyleDeclaration* style) const
         CSSMutableStyleDeclaration::const_iterator end = style->end();
         for (CSSMutableStyleDeclaration::const_iterator it = style->begin(); it != end; ++it) {
             const CSSProperty& property = *it;
-            RefPtr<CSSValue> value = getPropertyCSSValue(property.id());
-            if (value && (value->cssText() == property.value()->cssText()))
+            if (cssPropertyMatches(&property))
                 propertiesToRemove.append(property.id());
         }
     }
@@ -142,7 +147,7 @@ void CSSStyleDeclaration::diff(CSSMutableStyleDeclaration* style) const
 PassRefPtr<CSSMutableStyleDeclaration> CSSStyleDeclaration::copyPropertiesInSet(const int* set, unsigned length) const
 {
     Vector<CSSProperty> list;
-    list.reserveCapacity(length);
+    list.reserveInitialCapacity(length);
     unsigned variableDependentValueCount = 0;
     for (unsigned i = 0; i < length; i++) {
         RefPtr<CSSValue> value = getPropertyCSSValue(set[i]);
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.h b/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.h
index e6fede6..18493df 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.h
@@ -27,6 +27,7 @@
 namespace WebCore {
 
 class CSSMutableStyleDeclaration;
+class CSSProperty;
 class CSSRule;
 class CSSValue;
 
@@ -42,6 +43,7 @@ public:
     virtual void setCssText(const String&, ExceptionCode&) = 0;
 
     virtual unsigned length() const = 0;
+    bool isEmpty() const { return !length(); }
     virtual String item(unsigned index) const = 0;
 
     PassRefPtr<CSSValue> getPropertyCSSValue(const String& propertyName);
@@ -71,6 +73,9 @@ public:
 
 protected:
     CSSStyleDeclaration(CSSRule* parentRule = 0);
+
+    virtual bool cssPropertyMatches(const CSSProperty*) const;
+
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.idl b/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.idl
index 60020d9..f7ce37f 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleDeclaration.idl
@@ -23,7 +23,7 @@ module css {
     // Introduced in DOM Level 2:
     interface [
         GenerateConstructor,
-        CustomPutFunction,
+        DelegatingPutFunction,
         HasNameGetter,
         HasIndexGetter,
         InterfaceUUID=9989b2c3-a2b6-449b-abf9-c60d2260b1d7,
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
index 3b70cf4..ce4c343 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.cpp
@@ -5,7 +5,7 @@
  * Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alexey Proskuryakov <ap@webkit.org>
  * Copyright (C) 2007, 2008 Eric Seidel <eric@webkit.org>
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -62,16 +62,20 @@
 #include "HTMLNames.h"
 #include "HTMLTextAreaElement.h"
 #include "LinkHash.h"
+#include "MappedAttribute.h"
 #include "MatrixTransformOperation.h"
+#include "Matrix3DTransformOperation.h"
 #include "MediaList.h"
 #include "MediaQueryEvaluator.h"
 #include "NodeRenderStyle.h"
 #include "Page.h"
 #include "PageGroup.h"
 #include "Pair.h"
+#include "PerspectiveTransformOperation.h"
 #include "Rect.h"
 #include "RenderScrollbar.h"
 #include "RenderScrollbarTheme.h"
+#include "RenderStyleConstants.h"
 #include "RenderTheme.h"
 #include "RotateTransformOperation.h"
 #include "ScaleTransformOperation.h"
@@ -83,6 +87,7 @@
 #include "StyleGeneratedImage.h"
 #include "StyleSheetList.h"
 #include "Text.h"
+#include "TransformationMatrix.h"
 #include "TranslateTransformOperation.h"
 #include "UserAgentStyleSheets.h"
 #include "WebKitCSSKeyframeRule.h"
@@ -138,6 +143,16 @@ if (isInitial) { \
     return;\
 }
 
+#define HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(prop, Prop) \
+HANDLE_INHERIT_AND_INITIAL(prop, Prop) \
+if (primitiveValue) \
+    m_style->set##Prop(*primitiveValue);
+
+#define HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(prop, Prop, Value) \
+HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(prop, Prop, Value) \
+if (primitiveValue) \
+    m_style->set##Prop(*primitiveValue);
+
 #define HANDLE_FILL_LAYER_INHERIT_AND_INITIAL(layerType, LayerType, prop, Prop) \
 if (isInherit) { \
     FillLayer* currChild = m_style->access##LayerType##Layers(); \
@@ -374,11 +389,11 @@ static PseudoState pseudoState;
 static void loadFullDefaultStyle();
 static void loadSimpleDefaultStyle();
 // FIXME: It would be nice to use some mechanism that guarantees this is in sync with the real UA stylesheet.
-static const char* simpleUserAgentStyleSheet = "html,body,div{display:block}body{margin:8px}div:focus,span:focus{outline:auto 5px -webkit-focus-ring-color}";
+static const char* simpleUserAgentStyleSheet = "html,body,div{display:block}body{margin:8px}div:focus,span:focus{outline:auto 5px -webkit-focus-ring-color}a:-webkit-any-link{color:-webkit-link;text-decoration:underline}a:-webkit-any-link:active{color:-webkit-activelink}";
 
 static bool elementCanUseSimpleDefaultStyle(Element* e)
 {
-    return e->hasTagName(htmlTag) || e->hasTagName(bodyTag) || e->hasTagName(divTag) || e->hasTagName(spanTag) || e->hasTagName(brTag);
+    return e->hasTagName(htmlTag) || e->hasTagName(bodyTag) || e->hasTagName(divTag) || e->hasTagName(spanTag) || e->hasTagName(brTag) || e->hasTagName(aTag);
 }
 
 static const MediaQueryEvaluator& screenEval()
@@ -511,13 +526,13 @@ static void loadFullDefaultStyle()
     }
 
     // Strict-mode rules.
-    String defaultRules = String(html4UserAgentStyleSheet, sizeof(html4UserAgentStyleSheet)) + theme()->extraDefaultStyleSheet();
+    String defaultRules = String(html4UserAgentStyleSheet, sizeof(html4UserAgentStyleSheet)) + RenderTheme::defaultTheme()->extraDefaultStyleSheet();
     CSSStyleSheet* defaultSheet = parseUASheet(defaultRules);
     defaultStyle->addRulesFromSheet(defaultSheet, screenEval());
     defaultPrintStyle->addRulesFromSheet(defaultSheet, printEval());
 
     // Quirks-mode rules.
-    String quirksRules = String(quirksUserAgentStyleSheet, sizeof(quirksUserAgentStyleSheet)) + theme()->extraQuirksStyleSheet();
+    String quirksRules = String(quirksUserAgentStyleSheet, sizeof(quirksUserAgentStyleSheet)) + RenderTheme::defaultTheme()->extraQuirksStyleSheet();
     CSSStyleSheet* quirksSheet = parseUASheet(quirksRules);
     defaultQuirksStyle->addRulesFromSheet(quirksSheet, screenEval());
 }
@@ -687,10 +702,10 @@ void CSSStyleSelector::matchRulesForList(CSSRuleDataList* rules, int& firstRuleI
             
             // If we're matching normal rules, set a pseudo bit if 
             // we really just matched a pseudo-element.
-            if (m_dynamicPseudo != RenderStyle::NOPSEUDO && m_checker.m_pseudoStyle == RenderStyle::NOPSEUDO) {
+            if (m_dynamicPseudo != NOPSEUDO && m_checker.m_pseudoStyle == NOPSEUDO) {
                 if (m_checker.m_collectRulesOnly)
                     return;
-                if (m_dynamicPseudo < RenderStyle::FIRST_INTERNAL_PSEUDOID)
+                if (m_dynamicPseudo < FIRST_INTERNAL_PSEUDOID)
                     m_style->setHasPseudoStyle(m_dynamicPseudo);
             } else {
                 // Update our first/last rule indices in the matched rules array.
@@ -705,13 +720,14 @@ void CSSStyleSelector::matchRulesForList(CSSRuleDataList* rules, int& firstRuleI
     }
 }
 
-bool operator >(CSSRuleData& r1, CSSRuleData& r2)
+static bool operator >(CSSRuleData& r1, CSSRuleData& r2)
 {
     int spec1 = r1.selector()->specificity();
     int spec2 = r2.selector()->specificity();
     return (spec1 == spec2) ? r1.position() > r2.position() : spec1 > spec2; 
 }
-bool operator <=(CSSRuleData& r1, CSSRuleData& r2)
+    
+static bool operator <=(CSSRuleData& r1, CSSRuleData& r2)
 {
     return !(r1 > r2);
 }
@@ -756,7 +772,7 @@ void CSSStyleSelector::sortMatchedRules(unsigned start, unsigned end)
     // We have to merge sort.  Ensure our merge buffer is big enough to hold
     // all the items.
     Vector<CSSRuleData*> rulesMergeBuffer;
-    rulesMergeBuffer.reserveCapacity(end - start); 
+    rulesMergeBuffer.reserveInitialCapacity(end - start); 
 
     unsigned i1 = start;
     unsigned i2 = mid;
@@ -790,7 +806,7 @@ void CSSStyleSelector::initElementAndPseudoState(Element* e)
     pseudoState = PseudoUnknown;
 }
 
-void CSSStyleSelector::initForStyleResolve(Element* e, RenderStyle* parentStyle, RenderStyle::PseudoId pseudoID)
+void CSSStyleSelector::initForStyleResolve(Element* e, RenderStyle* parentStyle, PseudoId pseudoID)
 {
     m_checker.m_pseudoStyle = pseudoID;
 
@@ -848,7 +864,7 @@ CSSStyleSelector::SelectorChecker::SelectorChecker(Document* document, bool stri
     : m_document(document)
     , m_strictParsing(strictParsing)
     , m_collectRulesOnly(false)
-    , m_pseudoStyle(RenderStyle::NOPSEUDO)
+    , m_pseudoStyle(NOPSEUDO)
     , m_documentIsHTML(document->isHTMLDocument())
 {
 }
@@ -862,30 +878,35 @@ PseudoState CSSStyleSelector::SelectorChecker::checkPseudoState(Element* element
     if (!checkVisited)
         return PseudoAnyLink;
 
-    Frame* frame = m_document->frame();
-    if (!frame)
-        return PseudoLink;
-
-    Page* page = frame->page();
-    if (!page)
-        return PseudoLink;
-
+#if PLATFORM(QT)
     Vector<UChar, 512> url;
     visitedURL(m_document->baseURL(), *attr, url);
     if (url.isEmpty())
         return PseudoLink;
 
-#if PLATFORM(QT)
     // If the Qt4.4 interface for the history is used, we will have to fallback
     // to the old global history.
     QWebHistoryInterface* iface = QWebHistoryInterface::defaultInterface();
     if (iface)
         return iface->historyContains(QString(reinterpret_cast<QChar*>(url.data()), url.size())) ? PseudoVisited : PseudoLink;
-#endif
 
     LinkHash hash = visitedLinkHash(url.data(), url.size());
     if (!hash)
         return PseudoLink;
+#else
+    LinkHash hash = visitedLinkHash(m_document->baseURL(), *attr);
+    if (!hash)
+        return PseudoLink;
+#endif
+
+    Frame* frame = m_document->frame();
+    if (!frame)
+        return PseudoLink;
+
+    Page* page = frame->page();
+    if (!page)
+        return PseudoLink;
+
     m_linksCheckedForVisitedState.add(hash);
     return page->group().isLinkVisited(hash) ? PseudoVisited : PseudoLink;
 }
@@ -893,7 +914,7 @@ PseudoState CSSStyleSelector::SelectorChecker::checkPseudoState(Element* element
 bool CSSStyleSelector::SelectorChecker::checkSelector(CSSSelector* sel, Element* element) const
 {
     pseudoState = PseudoUnknown;
-    RenderStyle::PseudoId dynamicPseudo = RenderStyle::NOPSEUDO;
+    PseudoId dynamicPseudo = NOPSEUDO;
 
     return checkSelector(sel, element, 0, dynamicPseudo, true, false) == SelectorMatches;
 }
@@ -948,21 +969,30 @@ bool CSSStyleSelector::canShareStyleWithElement(Node* n)
             (s->hovered() == m_element->hovered()) &&
             (s->active() == m_element->active()) &&
             (s->focused() == m_element->focused()) &&
-            (s != s->document()->getCSSTarget() && m_element != m_element->document()->getCSSTarget()) &&
+            (s != s->document()->cssTarget() && m_element != m_element->document()->cssTarget()) &&
             (s->getAttribute(typeAttr) == m_element->getAttribute(typeAttr)) &&
             (s->getAttribute(XMLNames::langAttr) == m_element->getAttribute(XMLNames::langAttr)) &&
             (s->getAttribute(langAttr) == m_element->getAttribute(langAttr)) &&
             (s->getAttribute(readonlyAttr) == m_element->getAttribute(readonlyAttr)) &&
             (s->getAttribute(cellpaddingAttr) == m_element->getAttribute(cellpaddingAttr))) {
-            bool isControl = s->isControl();
-            if (isControl != m_element->isControl())
+            bool isControl = s->isFormControlElement();
+            if (isControl != m_element->isFormControlElement())
                 return false;
-            if (isControl && (s->isEnabled() != m_element->isEnabled()) ||
-                             (s->isIndeterminate() != m_element->isIndeterminate()) ||
-                             (s->isChecked() != m_element->isChecked()) ||
-                             (s->isAutofilled() != m_element->isAutofilled()))
-                return false;
-            
+            if (isControl) {
+                InputElement* thisInputElement = toInputElement(s);
+                InputElement* otherInputElement = toInputElement(m_element);
+                if (thisInputElement && otherInputElement) {
+                    if ((thisInputElement->isAutofilled() != otherInputElement->isAutofilled()) ||
+                        (thisInputElement->isChecked() != otherInputElement->isChecked()) ||
+                        (thisInputElement->isIndeterminate() != otherInputElement->isIndeterminate()))
+                    return false;
+                } else
+                    return false;
+
+                if (s->isEnabledFormControl() != m_element->isEnabledFormControl())
+                    return false;
+            }
+
             if (style->transitions() || style->animations())
                 return false;
 
@@ -1108,7 +1138,7 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForElement(Element* e, RenderStyl
     static bool loadedMediaStyleSheet;
     if (!loadedMediaStyleSheet && (e->hasTagName(videoTag) || e->hasTagName(audioTag))) {
         loadedMediaStyleSheet = true;
-        String mediaRules = String(mediaControlsUserAgentStyleSheet, sizeof(mediaControlsUserAgentStyleSheet)) + theme()->extraMediaControlsStyleSheet();
+        String mediaRules = String(mediaControlsUserAgentStyleSheet, sizeof(mediaControlsUserAgentStyleSheet)) + RenderTheme::defaultTheme()->extraMediaControlsStyleSheet();
         CSSStyleSheet* mediaControlsSheet = parseUASheet(mediaRules);
         defaultStyle->addRulesFromSheet(mediaControlsSheet, screenEval());
         defaultPrintStyle->addRulesFromSheet(mediaControlsSheet, printEval());
@@ -1226,7 +1256,7 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForElement(Element* e, RenderStyl
         m_style->setPseudoState(pseudoState);
 
     // If we have first-letter pseudo style, do not share this style
-    if (m_style->hasPseudoStyle(RenderStyle::FIRST_LETTER))
+    if (m_style->hasPseudoStyle(FIRST_LETTER))
         m_style->setUnique();
 
     // Now return the style.
@@ -1308,7 +1338,7 @@ void CSSStyleSelector::keyframeStylesForAnimation(Element* e, const RenderStyle*
         list.clear();
 }
 
-PassRefPtr<RenderStyle> CSSStyleSelector::pseudoStyleForElement(RenderStyle::PseudoId pseudo, Element* e, RenderStyle* parentStyle)
+PassRefPtr<RenderStyle> CSSStyleSelector::pseudoStyleForElement(PseudoId pseudo, Element* e, RenderStyle* parentStyle)
 {
     if (!e)
         return 0;
@@ -1442,7 +1472,10 @@ void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, Element *e)
         // Table headers with a text-align of auto will change the text-align to center.
         if (e && e->hasTagName(thTag) && style->textAlign() == TAAUTO)
             style->setTextAlign(CENTER);
-        
+
+        if (e && e->hasTagName(legendTag))
+            style->setDisplay(BLOCK);
+
         // Mutate the display to BLOCK or TABLE for certain cases, e.g., if someone attempts to
         // position or float an inline, compact, or run-in.  Cache the original display, since it
         // may be needed for positioned elements that have to compute their static normal flow
@@ -1481,19 +1514,26 @@ void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, Element *e)
     // cases where objects that should be blended as a single unit end up with a non-transparent
     // object wedged in between them.  Auto z-index also becomes 0 for objects that specify transforms/masks/reflections.
     if (style->hasAutoZIndex() && ((e && e->document()->documentElement() == e) || style->opacity() < 1.0f || 
-        style->hasTransform() || style->hasMask() || style->boxReflect()))
+        style->hasTransformRelatedProperty() || style->hasMask() || style->boxReflect()))
         style->setZIndex(0);
     
     // Button, legend, input, select and textarea all consider width values of 'auto' to be 'intrinsic'.
     // This will be important when we use block flows for all form controls.
     if (e && (e->hasTagName(legendTag) || e->hasTagName(buttonTag) || e->hasTagName(inputTag) ||
-              e->hasTagName(selectTag) || e->hasTagName(textareaTag)
+              e->hasTagName(selectTag) || e->hasTagName(textareaTag) || e->hasTagName(datagridTag)
 #if ENABLE(WML)
               || e->hasTagName(WMLNames::insertedLegendTag)
+              || e->hasTagName(WMLNames::inputTag)
 #endif
        )) {
         if (style->width().isAuto())
             style->setWidth(Length(Intrinsic));
+
+        // Textarea considers overflow visible as auto.
+        if (e && e->hasTagName(textareaTag)) {
+            style->setOverflowX(style->overflowX() == OVISIBLE ? OAUTO : style->overflowX());
+            style->setOverflowY(style->overflowY() == OVISIBLE ? OAUTO : style->overflowY());
+        }
     }
 
     // Finally update our text decorations in effect, but don't allow text-decoration to percolate through
@@ -1540,7 +1580,7 @@ void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, Element *e)
 
     // Important: Intrinsic margins get added to controls before the theme has adjusted the style, since the theme will
     // alter fonts and heights/widths.
-    if (e && e->isControl() && style->fontSize() >= 11) {
+    if (e && e->isFormControlElement() && style->fontSize() >= 11) {
         // Don't apply intrinsic margins to image buttons.  The designer knows how big the images are,
         // so we have to treat all image buttons as though they were explicitly sized.
         if (!e->hasTagName(inputTag) || static_cast<HTMLInputElement*>(e)->inputType() != HTMLInputElement::IMAGE)
@@ -1549,7 +1589,7 @@ void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, Element *e)
 
     // Let the theme also have a crack at adjusting the style.
     if (style->hasAppearance())
-        theme()->adjustStyle(this, style, e, m_hasUAAppearance, m_borderData, m_backgroundData, m_backgroundColor);
+        RenderTheme::defaultTheme()->adjustStyle(this, style, e, m_hasUAAppearance, m_borderData, m_backgroundData, m_backgroundColor);
 
 #if ENABLE(SVG)
     if (e && e->isSVGElement()) {
@@ -1631,14 +1671,14 @@ PassRefPtr<CSSRuleList> CSSStyleSelector::pseudoStyleRulesForElement(Element*, c
 
 bool CSSStyleSelector::checkSelector(CSSSelector* sel)
 {
-    m_dynamicPseudo = RenderStyle::NOPSEUDO;
+    m_dynamicPseudo = NOPSEUDO;
 
     // Check the selector
     SelectorMatch match = m_checker.checkSelector(sel, m_element, &m_selectorAttrs, m_dynamicPseudo, true, false, style(), m_parentStyle);
     if (match != SelectorMatches)
         return false;
 
-    if (m_checker.m_pseudoStyle != RenderStyle::NOPSEUDO && m_checker.m_pseudoStyle != m_dynamicPseudo)
+    if (m_checker.m_pseudoStyle != NOPSEUDO && m_checker.m_pseudoStyle != m_dynamicPseudo)
         return false;
 
     return true;
@@ -1649,7 +1689,7 @@ bool CSSStyleSelector::checkSelector(CSSSelector* sel)
 // * SelectorMatches         - the selector matches the element e
 // * SelectorFailsLocally    - the selector fails for the element e
 // * SelectorFailsCompletely - the selector fails for e and any sibling or ancestor of e
-CSSStyleSelector::SelectorMatch CSSStyleSelector::SelectorChecker::checkSelector(CSSSelector* sel, Element* e, HashSet<AtomicStringImpl*>* selectorAttrs, RenderStyle::PseudoId& dynamicPseudo, bool isAncestor, bool isSubSelector, RenderStyle* elementStyle, RenderStyle* elementParentStyle) const
+CSSStyleSelector::SelectorMatch CSSStyleSelector::SelectorChecker::checkSelector(CSSSelector* sel, Element* e, HashSet<AtomicStringImpl*>* selectorAttrs, PseudoId& dynamicPseudo, bool isAncestor, bool isSubSelector, RenderStyle* elementStyle, RenderStyle* elementParentStyle) const
 {
 #if ENABLE(SVG)
     // Spec: CSS2 selectors cannot be applied to the (conceptually) cloned DOM tree
@@ -1672,7 +1712,7 @@ CSSStyleSelector::SelectorMatch CSSStyleSelector::SelectorChecker::checkSelector
 
     if (relation != CSSSelector::SubSelector)
         // Bail-out if this selector is irrelevant for the pseudoStyle
-        if (m_pseudoStyle != RenderStyle::NOPSEUDO && m_pseudoStyle != dynamicPseudo)
+        if (m_pseudoStyle != NOPSEUDO && m_pseudoStyle != dynamicPseudo)
             return SelectorFailsCompletely;
 
     switch (relation) {
@@ -1732,8 +1772,8 @@ CSSStyleSelector::SelectorMatch CSSStyleSelector::SelectorChecker::checkSelector
             // a selector is invalid if something follows a pseudo-element
             // We make an exception for scrollbar pseudo elements and allow a set of pseudo classes (but nothing else)
             // to follow the pseudo elements.
-            if (elementStyle && dynamicPseudo != RenderStyle::NOPSEUDO && 
-                !((RenderScrollbar::scrollbarForStyleResolve() || dynamicPseudo == RenderStyle::SCROLLBAR_CORNER || dynamicPseudo == RenderStyle::RESIZER) && sel->m_match == CSSSelector::PseudoClass))
+            if (elementStyle && dynamicPseudo != NOPSEUDO && dynamicPseudo != SELECTION &&
+                !((RenderScrollbar::scrollbarForStyleResolve() || dynamicPseudo == SCROLLBAR_CORNER || dynamicPseudo == RESIZER) && sel->m_match == CSSSelector::PseudoClass))
                 return SelectorFailsCompletely;
             return checkSelector(sel, e, selectorAttrs, dynamicPseudo, isAncestor, true, elementStyle, elementParentStyle);
     }
@@ -1808,7 +1848,7 @@ static bool htmlAttributeHasCaseInsensitiveValue(const QualifiedName& attr)
     return isPossibleHTMLAttr && htmlCaseInsensitiveAttributesSet->contains(attr.localName().impl());
 }
 
-bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Element* e, HashSet<AtomicStringImpl*>* selectorAttrs, RenderStyle::PseudoId& dynamicPseudo, bool isAncestor, bool isSubSelector, RenderStyle* elementStyle, RenderStyle* elementParentStyle) const
+bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Element* e, HashSet<AtomicStringImpl*>* selectorAttrs, PseudoId& dynamicPseudo, bool isAncestor, bool isSubSelector, RenderStyle* elementStyle, RenderStyle* elementParentStyle) const
 {
     if (!e)
         return false;
@@ -1906,15 +1946,19 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
             for (CSSSelector* subSel = sel->simpleSelector(); subSel; subSel = subSel->tagHistory()) {
                 // :not cannot nest. I don't really know why this is a
                 // restriction in CSS3, but it is, so let's honor it.
-                if (subSel->simpleSelector())
-                    break;
+                // the parser enforces that this never occurs
+                ASSERT(!subSel->simpleSelector());
+
                 if (!checkOneSelector(subSel, e, selectorAttrs, dynamicPseudo, isAncestor, true, elementStyle, elementParentStyle))
                     return true;
             }
-        } else if (dynamicPseudo != RenderStyle::NOPSEUDO && (RenderScrollbar::scrollbarForStyleResolve() || dynamicPseudo == RenderStyle::SCROLLBAR_CORNER || dynamicPseudo == RenderStyle::RESIZER)) {
+        } else if (dynamicPseudo != NOPSEUDO && (RenderScrollbar::scrollbarForStyleResolve() || dynamicPseudo == SCROLLBAR_CORNER || dynamicPseudo == RESIZER)) {
             // CSS scrollbars match a specific subset of pseudo classes, and they have specialized rules for each
             // (since there are no elements involved).
             return checkScrollbarPseudoClass(sel, dynamicPseudo);
+        } else if (dynamicPseudo == SELECTION) {
+            if (sel->pseudoType() == CSSSelector::PseudoWindowInactive)
+                return !m_document->page()->focusController()->isActive();
         }
         
         // Normal element pseudo class checking.
@@ -2209,7 +2253,7 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
                 break;
             }
             case CSSSelector::PseudoTarget:
-                if (e == e->document()->getCSSTarget())
+                if (e == e->document()->cssTarget())
                     return true;
                 break;
             case CSSSelector::PseudoAnyLink:
@@ -2218,10 +2262,13 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
                 if (pseudoState == PseudoAnyLink || pseudoState == PseudoLink || pseudoState == PseudoVisited)
                     return true;
                 break;
-            case CSSSelector::PseudoAutofill:
-                if (e)
-                    return e->isAutofilled();
+            case CSSSelector::PseudoAutofill: {
+                if (!e || !e->isFormControlElement())
+                    break;
+                if (InputElement* inputElement = toInputElement(e))
+                    return inputElement->isAutofilled();
                 break;
+            }
             case CSSSelector::PseudoLink:
                 if (pseudoState == PseudoUnknown || pseudoState == PseudoAnyLink)
                     pseudoState = checkPseudoState(e);
@@ -2273,37 +2320,60 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
                 }
                 break;
             case CSSSelector::PseudoEnabled:
-                if (e && e->isControl() && !e->isInputTypeHidden())
+                if (e && e->isFormControlElement()) {
+                    InputElement* inputElement = toInputElement(e);
+                    if (inputElement && inputElement->isInputTypeHidden())
+                        break;
                     // The UI spec states that you can't match :enabled unless you are an object that can
                     // "receive focus and be activated."  We will limit matching of this pseudo-class to elements
                     // that are non-"hidden" controls.
-                    return e->isEnabled();                    
+                    return e->isEnabledFormControl();
+                }
                 break;
             case CSSSelector::PseudoFullPageMedia:
                 return e && e->document() && e->document()->isMediaDocument();
                 break;
             case CSSSelector::PseudoDisabled:
-                if (e && e->isControl() && !e->isInputTypeHidden())
+                if (e && e->isFormControlElement()) {
+                    InputElement* inputElement = toInputElement(e);
+                    if (inputElement && inputElement->isInputTypeHidden())
+                        break;
+
                     // The UI spec states that you can't match :enabled unless you are an object that can
                     // "receive focus and be activated."  We will limit matching of this pseudo-class to elements
                     // that are non-"hidden" controls.
-                    return !e->isEnabled();                    
+                    return !e->isEnabledFormControl();
+                }
                 break;
-            case CSSSelector::PseudoReadOnly:
-                return e && e->isTextControl() && e->isReadOnlyControl();
-            case CSSSelector::PseudoReadWrite:
-                return e && e->isTextControl() && !e->isReadOnlyControl();
-            case CSSSelector::PseudoChecked:
+            case CSSSelector::PseudoReadOnly: {
+                if (!e || !e->isFormControlElement())
+                    return false;
+                return e->isTextFormControl() && e->isReadOnlyFormControl();
+            }
+            case CSSSelector::PseudoReadWrite: {
+                if (!e || !e->isFormControlElement())
+                    return false;
+                return e->isTextFormControl() && !e->isReadOnlyFormControl();
+            }
+            case CSSSelector::PseudoChecked: {
+                if (!e || !e->isFormControlElement())
+                    break;
                 // Even though WinIE allows checked and indeterminate to co-exist, the CSS selector spec says that
                 // you can't be both checked and indeterminate.  We will behave like WinIE behind the scenes and just
                 // obey the CSS spec here in the test for matching the pseudo.
-                if (e && e->isChecked() && !e->isIndeterminate())
+                InputElement* inputElement = toInputElement(e);
+                if (inputElement && inputElement->isChecked() && !inputElement->isIndeterminate())
                     return true;
                 break;
-            case CSSSelector::PseudoIndeterminate:
-                if (e && e->isIndeterminate())
+            }
+            case CSSSelector::PseudoIndeterminate: {
+                if (!e || !e->isFormControlElement())
+                    break;
+                InputElement* inputElement = toInputElement(e);
+                if (inputElement && inputElement->isIndeterminate())
                     return true;
                 break;
+            }
             case CSSSelector::PseudoRoot:
                 if (e == e->document()->documentElement())
                     return true;
@@ -2347,87 +2417,93 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
         switch (sel->pseudoType()) {
             // Pseudo-elements:
             case CSSSelector::PseudoFirstLine:
-                dynamicPseudo = RenderStyle::FIRST_LINE;
+                dynamicPseudo = FIRST_LINE;
                 return true;
             case CSSSelector::PseudoFirstLetter:
-                dynamicPseudo = RenderStyle::FIRST_LETTER;
+                dynamicPseudo = FIRST_LETTER;
                 if (Document* doc = e->document())
                     doc->setUsesFirstLetterRules(true);
                 return true;
             case CSSSelector::PseudoSelection:
-                dynamicPseudo = RenderStyle::SELECTION;
+                dynamicPseudo = SELECTION;
                 return true;
             case CSSSelector::PseudoBefore:
-                dynamicPseudo = RenderStyle::BEFORE;
+                dynamicPseudo = BEFORE;
                 return true;
             case CSSSelector::PseudoAfter:
-                dynamicPseudo = RenderStyle::AFTER;
+                dynamicPseudo = AFTER;
                 return true;
             case CSSSelector::PseudoFileUploadButton:
-                dynamicPseudo = RenderStyle::FILE_UPLOAD_BUTTON;
+                dynamicPseudo = FILE_UPLOAD_BUTTON;
                 return true;
             case CSSSelector::PseudoInputPlaceholder:
-                dynamicPseudo = RenderStyle::INPUT_PLACEHOLDER;
+                dynamicPseudo = INPUT_PLACEHOLDER;
                 return true;
             case CSSSelector::PseudoSliderThumb:
-                dynamicPseudo = RenderStyle::SLIDER_THUMB;
+                dynamicPseudo = SLIDER_THUMB;
                 return true; 
             case CSSSelector::PseudoSearchCancelButton:
-                dynamicPseudo = RenderStyle::SEARCH_CANCEL_BUTTON;
+                dynamicPseudo = SEARCH_CANCEL_BUTTON;
                 return true; 
             case CSSSelector::PseudoSearchDecoration:
-                dynamicPseudo = RenderStyle::SEARCH_DECORATION;
+                dynamicPseudo = SEARCH_DECORATION;
                 return true;
             case CSSSelector::PseudoSearchResultsDecoration:
-                dynamicPseudo = RenderStyle::SEARCH_RESULTS_DECORATION;
+                dynamicPseudo = SEARCH_RESULTS_DECORATION;
                 return true;
             case CSSSelector::PseudoSearchResultsButton:
-                dynamicPseudo = RenderStyle::SEARCH_RESULTS_BUTTON;
+                dynamicPseudo = SEARCH_RESULTS_BUTTON;
                 return true;
             case CSSSelector::PseudoMediaControlsPanel:
-                dynamicPseudo = RenderStyle::MEDIA_CONTROLS_PANEL;
+                dynamicPseudo = MEDIA_CONTROLS_PANEL;
                 return true;
             case CSSSelector::PseudoMediaControlsMuteButton:
-                dynamicPseudo = RenderStyle::MEDIA_CONTROLS_MUTE_BUTTON;
+                dynamicPseudo = MEDIA_CONTROLS_MUTE_BUTTON;
                 return true;
             case CSSSelector::PseudoMediaControlsPlayButton:
-                dynamicPseudo = RenderStyle::MEDIA_CONTROLS_PLAY_BUTTON;
+                dynamicPseudo = MEDIA_CONTROLS_PLAY_BUTTON;
                 return true;
-            case CSSSelector::PseudoMediaControlsTimeDisplay:
-                dynamicPseudo = RenderStyle::MEDIA_CONTROLS_TIME_DISPLAY;
+            case CSSSelector::PseudoMediaControlsTimelineContainer:
+                dynamicPseudo = MEDIA_CONTROLS_TIMELINE_CONTAINER;
+                 return true;
+            case CSSSelector::PseudoMediaControlsCurrentTimeDisplay:
+                dynamicPseudo = MEDIA_CONTROLS_CURRENT_TIME_DISPLAY;
+                return true;
+            case CSSSelector::PseudoMediaControlsTimeRemainingDisplay:
+                dynamicPseudo = MEDIA_CONTROLS_TIME_REMAINING_DISPLAY;
                 return true;
             case CSSSelector::PseudoMediaControlsTimeline:
-                dynamicPseudo = RenderStyle::MEDIA_CONTROLS_TIMELINE;
+                dynamicPseudo = MEDIA_CONTROLS_TIMELINE;
                 return true;
             case CSSSelector::PseudoMediaControlsSeekBackButton:
-                dynamicPseudo = RenderStyle::MEDIA_CONTROLS_SEEK_BACK_BUTTON;
+                dynamicPseudo = MEDIA_CONTROLS_SEEK_BACK_BUTTON;
                 return true;
             case CSSSelector::PseudoMediaControlsSeekForwardButton:
-                dynamicPseudo = RenderStyle::MEDIA_CONTROLS_SEEK_FORWARD_BUTTON;
+                dynamicPseudo = MEDIA_CONTROLS_SEEK_FORWARD_BUTTON;
                 return true;
             case CSSSelector::PseudoMediaControlsFullscreenButton:
-                dynamicPseudo = RenderStyle::MEDIA_CONTROLS_FULLSCREEN_BUTTON;
+                dynamicPseudo = MEDIA_CONTROLS_FULLSCREEN_BUTTON;
                 return true;
             case CSSSelector::PseudoScrollbar:
-                dynamicPseudo = RenderStyle::SCROLLBAR;
+                dynamicPseudo = SCROLLBAR;
                 return true;
             case CSSSelector::PseudoScrollbarButton:
-                dynamicPseudo = RenderStyle::SCROLLBAR_BUTTON;
+                dynamicPseudo = SCROLLBAR_BUTTON;
                 return true;
             case CSSSelector::PseudoScrollbarCorner:
-                dynamicPseudo = RenderStyle::SCROLLBAR_CORNER;
+                dynamicPseudo = SCROLLBAR_CORNER;
                 return true;
             case CSSSelector::PseudoScrollbarThumb:
-                dynamicPseudo = RenderStyle::SCROLLBAR_THUMB;
+                dynamicPseudo = SCROLLBAR_THUMB;
                 return true;
             case CSSSelector::PseudoScrollbarTrack:
-                dynamicPseudo = RenderStyle::SCROLLBAR_TRACK;
+                dynamicPseudo = SCROLLBAR_TRACK;
                 return true;
             case CSSSelector::PseudoScrollbarTrackPiece:
-                dynamicPseudo = RenderStyle::SCROLLBAR_TRACK_PIECE;
+                dynamicPseudo = SCROLLBAR_TRACK_PIECE;
                 return true;
             case CSSSelector::PseudoResizer:
-                dynamicPseudo = RenderStyle::RESIZER;
+                dynamicPseudo = RESIZER;
                 return true;
             case CSSSelector::PseudoUnknown:
             case CSSSelector::PseudoNotParsed:
@@ -2441,7 +2517,7 @@ bool CSSStyleSelector::SelectorChecker::checkOneSelector(CSSSelector* sel, Eleme
     return true;
 }
 
-bool CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass(CSSSelector* sel, RenderStyle::PseudoId&) const
+bool CSSStyleSelector::SelectorChecker::checkScrollbarPseudoClass(CSSSelector* sel, PseudoId&) const
 {
     RenderScrollbar* scrollbar = RenderScrollbar::scrollbarForStyleResolve();
     ScrollbarPart part = RenderScrollbar::partForStyleResolve();
@@ -2652,16 +2728,23 @@ void CSSRuleSet::addRulesFromSheet(CSSStyleSheet* sheet, const MediaQueryEvaluat
 // -------------------------------------------------------------------------------------
 // this is mostly boring stuff on how to apply a certain rule to the renderstyle...
 
-static Length convertToLength(CSSPrimitiveValue *primitiveValue, RenderStyle *style, bool *ok = 0)
+static Length convertToLength(CSSPrimitiveValue *primitiveValue, RenderStyle *style, double multiplier = 1, bool *ok = 0)
 {
+    // This function is tolerant of a null style value. The only place style is used is in
+    // length measurements, like 'ems' and 'px'. And in those cases style is only used
+    // when the units are EMS or EXS. So we will just fail in those cases.
     Length l;
     if (!primitiveValue) {
         if (ok)
             *ok = false;
     } else {
         int type = primitiveValue->primitiveType();
-        if (type > CSSPrimitiveValue::CSS_PERCENTAGE && type < CSSPrimitiveValue::CSS_DEG)
-            l = Length(primitiveValue->computeLengthIntForLength(style), Fixed);
+        
+        if (!style && (type == CSSPrimitiveValue::CSS_EMS || type == CSSPrimitiveValue::CSS_EXS)) {
+            if (ok)
+                *ok = false;
+        } else if (CSSPrimitiveValue::isUnitTypeLength(type))
+            l = Length(primitiveValue->computeLengthIntForLength(style, multiplier), Fixed);
         else if (type == CSSPrimitiveValue::CSS_PERCENTAGE)
             l = Length(primitiveValue->getDoubleValue(), Percent);
         else if (type == CSSPrimitiveValue::CSS_NUMBER)
@@ -2836,26 +2919,17 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                 return;
         }
         return;
-        
     case CSSPropertyBorderTopStyle:
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(borderTopStyle, BorderTopStyle, BorderStyle)
-        if (primitiveValue)
-            m_style->setBorderTopStyle(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(borderTopStyle, BorderTopStyle, BorderStyle)
         return;
     case CSSPropertyBorderRightStyle:
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(borderRightStyle, BorderRightStyle, BorderStyle)
-        if (primitiveValue)
-            m_style->setBorderRightStyle(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(borderRightStyle, BorderRightStyle, BorderStyle)
         return;
     case CSSPropertyBorderBottomStyle:
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(borderBottomStyle, BorderBottomStyle, BorderStyle)
-        if (primitiveValue)
-            m_style->setBorderBottomStyle(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(borderBottomStyle, BorderBottomStyle, BorderStyle)
         return;
     case CSSPropertyBorderLeftStyle:
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(borderLeftStyle, BorderLeftStyle, BorderStyle)
-        if (primitiveValue)
-            m_style->setBorderLeftStyle(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(borderLeftStyle, BorderLeftStyle, BorderStyle)
         return;
     case CSSPropertyOutlineStyle:
         HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(outlineStyle, OutlineStyle, BorderStyle)
@@ -2867,49 +2941,23 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         }
         return;
     case CSSPropertyCaptionSide:
-    {
-        HANDLE_INHERIT_AND_INITIAL(captionSide, CaptionSide)
-        if (primitiveValue)
-            m_style->setCaptionSide(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(captionSide, CaptionSide)
         return;
-    }
     case CSSPropertyClear:
-    {
-        HANDLE_INHERIT_AND_INITIAL(clear, Clear)
-        if (primitiveValue)
-            m_style->setClear(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(clear, Clear)
         return;
-    }
     case CSSPropertyDirection:
-    {
-        HANDLE_INHERIT_AND_INITIAL(direction, Direction)
-        if (primitiveValue)
-            m_style->setDirection(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(direction, Direction)
         return;
-    }
     case CSSPropertyDisplay:
-    {
-        HANDLE_INHERIT_AND_INITIAL(display, Display)
-        if (primitiveValue)
-            m_style->setDisplay(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(display, Display)
         return;
-    }
-
     case CSSPropertyEmptyCells:
-    {
-        HANDLE_INHERIT_AND_INITIAL(emptyCells, EmptyCells)
-        if (primitiveValue)
-            m_style->setEmptyCells(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(emptyCells, EmptyCells)
         return;
-    }
     case CSSPropertyFloat:
-    {
-        HANDLE_INHERIT_AND_INITIAL(floating, Floating)
-        if (primitiveValue)
-            m_style->setFloating(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(floating, Floating)
         return;
-    }
-
     case CSSPropertyFontStyle:
     {
         FontDescription fontDescription = m_style->fontDescription();
@@ -2958,7 +3006,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         }
         if (m_style->setFontDescription(fontDescription))
             m_fontDirty = true;
-        return;        
+        return;
     }
 
     case CSSPropertyFontWeight:
@@ -3020,21 +3068,11 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     }
         
     case CSSPropertyListStylePosition:
-    {
-        HANDLE_INHERIT_AND_INITIAL(listStylePosition, ListStylePosition)
-        if (primitiveValue)
-            m_style->setListStylePosition(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(listStylePosition, ListStylePosition)
         return;
-    }
-
     case CSSPropertyListStyleType:
-    {
-        HANDLE_INHERIT_AND_INITIAL(listStyleType, ListStyleType)
-        if (primitiveValue)
-            m_style->setListStyleType(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(listStyleType, ListStyleType)
         return;
-    }
-
     case CSSPropertyOverflow:
     {
         if (isInherit) {
@@ -3057,35 +3095,17 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     }
 
     case CSSPropertyOverflowX:
-    {
-        HANDLE_INHERIT_AND_INITIAL(overflowX, OverflowX)
-        m_style->setOverflowX(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(overflowX, OverflowX)
         return;
-    }
-
     case CSSPropertyOverflowY:
-    {
-        HANDLE_INHERIT_AND_INITIAL(overflowY, OverflowY)
-        m_style->setOverflowY(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(overflowY, OverflowY)
         return;
-    }
-
     case CSSPropertyPageBreakBefore:
-    {
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(pageBreakBefore, PageBreakBefore, PageBreak)
-        if (primitiveValue)
-            m_style->setPageBreakBefore(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(pageBreakBefore, PageBreakBefore, PageBreak)
         return;
-    }
-
     case CSSPropertyPageBreakAfter:
-    {
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(pageBreakAfter, PageBreakAfter, PageBreak)
-        if (primitiveValue)
-            m_style->setPageBreakAfter(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(pageBreakAfter, PageBreakAfter, PageBreak)
         return;
-    }
-
     case CSSPropertyPageBreakInside: {
         HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(pageBreakInside, PageBreakInside, PageBreak)
         if (!primitiveValue)
@@ -3097,13 +3117,8 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     }
         
     case CSSPropertyPosition:
-    {
-        HANDLE_INHERIT_AND_INITIAL(position, Position)
-        if (primitiveValue)
-            m_style->setPosition(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(position, Position)
         return;
-    }
-
     case CSSPropertyTableLayout: {
         HANDLE_INHERIT_AND_INITIAL(tableLayout, TableLayout)
 
@@ -3115,26 +3130,17 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     }
         
-    case CSSPropertyUnicodeBidi: {
-        HANDLE_INHERIT_AND_INITIAL(unicodeBidi, UnicodeBidi)
-        m_style->setUnicodeBidi(*primitiveValue);
+    case CSSPropertyUnicodeBidi: 
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(unicodeBidi, UnicodeBidi)
         return;
-    }
-    case CSSPropertyTextTransform: {
-        HANDLE_INHERIT_AND_INITIAL(textTransform, TextTransform)
-        m_style->setTextTransform(*primitiveValue);
+    case CSSPropertyTextTransform: 
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(textTransform, TextTransform)
         return;
-    }
-
     case CSSPropertyVisibility:
-    {
-        HANDLE_INHERIT_AND_INITIAL(visibility, Visibility)
-        m_style->setVisibility(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(visibility, Visibility)
         return;
-    }
     case CSSPropertyWhiteSpace:
-        HANDLE_INHERIT_AND_INITIAL(whiteSpace, WhiteSpace)
-        m_style->setWhiteSpace(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(whiteSpace, WhiteSpace)
         return;
 
     case CSSPropertyBackgroundPosition:
@@ -3176,7 +3182,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         HANDLE_INHERIT_AND_INITIAL(horizontalBorderSpacing, HorizontalBorderSpacing)
         if (!primitiveValue)
             return;
-        short spacing =  primitiveValue->computeLengthShort(style(), zoomFactor);
+        short spacing = primitiveValue->computeLengthShort(style(), zoomFactor);
         m_style->setHorizontalBorderSpacing(spacing);
         return;
     }
@@ -3184,7 +3190,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         HANDLE_INHERIT_AND_INITIAL(verticalBorderSpacing, VerticalBorderSpacing)
         if (!primitiveValue)
             return;
-        short spacing =  primitiveValue->computeLengthShort(style(), zoomFactor);
+        short spacing = primitiveValue->computeLengthShort(style(), zoomFactor);
         m_style->setVerticalBorderSpacing(spacing);
         return;
     }
@@ -3223,7 +3229,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             }
         } else if (primitiveValue) {
             int type = primitiveValue->primitiveType();
-            if (type == CSSPrimitiveValue::CSS_IDENT)
+            if (type == CSSPrimitiveValue::CSS_IDENT && m_style->cursor() != ECursor(*primitiveValue))
                 m_style->setCursor(*primitiveValue);
         }
         return;
@@ -3427,38 +3433,21 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     }
 
-    case CSSPropertyWordBreak: {
-        HANDLE_INHERIT_AND_INITIAL(wordBreak, WordBreak)
-        m_style->setWordBreak(*primitiveValue);
+    case CSSPropertyWordBreak:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(wordBreak, WordBreak)
         return;
-    }
-
-    case CSSPropertyWordWrap: {
-        HANDLE_INHERIT_AND_INITIAL(wordWrap, WordWrap)
-        m_style->setWordWrap(*primitiveValue);
+    case CSSPropertyWordWrap:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(wordWrap, WordWrap)
         return;
-    }
-
     case CSSPropertyWebkitNbspMode:
-    {
-        HANDLE_INHERIT_AND_INITIAL(nbspMode, NBSPMode)
-        m_style->setNBSPMode(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(nbspMode, NBSPMode)
         return;
-    }
-
     case CSSPropertyWebkitLineBreak:
-    {
-        HANDLE_INHERIT_AND_INITIAL(khtmlLineBreak, KHTMLLineBreak)
-        m_style->setKHTMLLineBreak(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(khtmlLineBreak, KHTMLLineBreak)
         return;
-    }
-
     case CSSPropertyWebkitMatchNearestMailBlockquoteColor:
-    {
-        HANDLE_INHERIT_AND_INITIAL(matchNearestMailBlockquoteColor, MatchNearestMailBlockquoteColor)
-        m_style->setMatchNearestMailBlockquoteColor(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(matchNearestMailBlockquoteColor, MatchNearestMailBlockquoteColor)
         return;
-    }
 
     case CSSPropertyResize:
     {
@@ -3554,7 +3543,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
 
         if (primitiveValue && !apply) {
             int type = primitiveValue->primitiveType();
-            if (type > CSSPrimitiveValue::CSS_PERCENTAGE && type < CSSPrimitiveValue::CSS_DEG)
+            if (CSSPrimitiveValue::isUnitTypeLength(type))
                 // Handle our quirky margin units if we have them.
                 l = Length(primitiveValue->computeLengthIntForLength(style(), zoomFactor), Fixed, 
                            primitiveValue->isQuirkValue());
@@ -3655,7 +3644,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
 
         if (primitiveValue && !apply) {
             unsigned short type = primitiveValue->primitiveType();
-            if (type > CSSPrimitiveValue::CSS_PERCENTAGE && type < CSSPrimitiveValue::CSS_DEG)
+            if (CSSPrimitiveValue::isUnitTypeLength(type))
                 l = Length(primitiveValue->computeLengthIntForLength(style(), zoomFactor), Fixed);
             else if (type == CSSPrimitiveValue::CSS_PERCENTAGE)
                 l = Length(primitiveValue->getDoubleValue(), Percent);
@@ -3711,7 +3700,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         } else {
           int type = primitiveValue->primitiveType();
           Length l;
-          if (type > CSSPrimitiveValue::CSS_PERCENTAGE && type < CSSPrimitiveValue::CSS_DEG)
+          if (CSSPrimitiveValue::isUnitTypeLength(type))
             l = Length(primitiveValue->computeLengthIntForLength(style(), zoomFactor), Fixed);
           else if (type == CSSPrimitiveValue::CSS_PERCENTAGE)
             l = Length(primitiveValue->getDoubleValue(), Percent);
@@ -3775,7 +3764,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                                               (type != CSSPrimitiveValue::CSS_PERCENTAGE &&
                                                type != CSSPrimitiveValue::CSS_EMS && 
                                                type != CSSPrimitiveValue::CSS_EXS));
-            if (type > CSSPrimitiveValue::CSS_PERCENTAGE && type < CSSPrimitiveValue::CSS_DEG)
+            if (CSSPrimitiveValue::isUnitTypeLength(type))
                 size = primitiveValue->computeLengthFloat(m_parentStyle, true);
             else if (type == CSSPrimitiveValue::CSS_PERCENTAGE)
                 size = (primitiveValue->getFloatValue() * oldSize) / 100.0f;
@@ -3838,7 +3827,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         int type = primitiveValue->primitiveType();
         if (primitiveValue->getIdent() == CSSValueNormal)
             lineHeight = Length(-100.0, Percent);
-        else if (type > CSSPrimitiveValue::CSS_PERCENTAGE && type < CSSPrimitiveValue::CSS_DEG) {
+        else if (CSSPrimitiveValue::isUnitTypeLength(type)) {
             double multiplier = m_style->effectiveZoom();
             if (m_style->textSizeAdjust() && m_checker.m_document->frame() && m_checker.m_document->frame()->shouldApplyTextZoom())
                 multiplier *= m_checker.m_document->frame()->textZoomFactor();
@@ -3883,8 +3872,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                 right = m_parentStyle->clipRight();
                 bottom = m_parentStyle->clipBottom();
                 left = m_parentStyle->clipLeft();
-            }
-            else {
+            } else {
                 hasClip = false;
                 top = right = bottom = left = Length();
             }
@@ -3897,11 +3885,10 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             Rect* rect = primitiveValue->getRectValue();
             if (!rect)
                 return;
-            top = convertToLength(rect->top(), style());
-            right = convertToLength(rect->right(), style());
-            bottom = convertToLength(rect->bottom(), style());
-            left = convertToLength(rect->left(), style());
-
+            top = convertToLength(rect->top(), style(), zoomFactor);
+            right = convertToLength(rect->right(), style(), zoomFactor);
+            bottom = convertToLength(rect->bottom(), style(), zoomFactor);
+            left = convertToLength(rect->left(), style(), zoomFactor);
         } else if (primitiveValue->getIdent() != CSSValueAuto) {
             return;
         }
@@ -3949,7 +3936,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                     break;
                 case CSSPrimitiveValue::CSS_ATTR: {
                     // FIXME: Can a namespace be specified for an attr(foo)?
-                    if (m_style->styleType() == RenderStyle::NOPSEUDO)
+                    if (m_style->styleType() == NOPSEUDO)
                         m_style->setUnique();
                     else
                         m_parentStyle->setUnique();
@@ -4282,6 +4269,9 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
                 m_fontDirty = true;
         } else if (isInitial) {
             Settings* settings = m_checker.m_document->settings();
+            ASSERT(settings); // If we're doing style resolution, this document should always be in a frame and thus have settings
+            if (!settings)
+                return;
             FontDescription fontDescription;
             fontDescription.setGenericFamily(FontDescription::StandardFamily);
             fontDescription.setRenderingMode(settings->fontRenderingMode());
@@ -4302,12 +4292,15 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             m_lineHeightValue = 0;
             
             FontDescription fontDescription;
-            theme()->systemFont(primitiveValue->getIdent(), fontDescription);
+            RenderTheme::defaultTheme()->systemFont(primitiveValue->getIdent(), fontDescription);
  
             // Double-check and see if the theme did anything.  If not, don't bother updating the font.
             if (fontDescription.isAbsoluteSize()) {
                 // Make sure the rendering mode and printer font settings are updated.
                 Settings* settings = m_checker.m_document->settings();
+                ASSERT(settings); // If we're doing style resolution, this document should always be in a frame and thus have settings
+                if (!settings)
+                    return;
                 fontDescription.setRenderingMode(settings->fontRenderingMode());
                 fontDescription.setUsePrinterFont(m_checker.m_document->printing());
            
@@ -4567,21 +4560,20 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     case CSSPropertyUnicodeRange: // Only used in @font-face rules.
         return;
-    case CSSPropertyWebkitBoxDirection:
-        HANDLE_INHERIT_AND_INITIAL(boxDirection, BoxDirection)
+    case CSSPropertyWebkitBackfaceVisibility:
+        HANDLE_INHERIT_AND_INITIAL(backfaceVisibility, BackfaceVisibility)
         if (primitiveValue)
-            m_style->setBoxDirection(*primitiveValue);
-        return;        
+            m_style->setBackfaceVisibility((primitiveValue->getIdent() == CSSValueVisible) ? BackfaceVisibilityVisible : BackfaceVisibilityHidden);
+        return;
+    case CSSPropertyWebkitBoxDirection:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxDirection, BoxDirection)
+        return;
     case CSSPropertyWebkitBoxLines:
-        HANDLE_INHERIT_AND_INITIAL(boxLines, BoxLines)
-        if (primitiveValue)
-            m_style->setBoxLines(*primitiveValue);
-        return;     
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxLines, BoxLines)
+        return;
     case CSSPropertyWebkitBoxOrient:
-        HANDLE_INHERIT_AND_INITIAL(boxOrient, BoxOrient)
-        if (primitiveValue)
-            m_style->setBoxOrient(*primitiveValue);
-        return;     
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(boxOrient, BoxOrient)
+        return;
     case CSSPropertyWebkitBoxPack:
     {
         HANDLE_INHERIT_AND_INITIAL(boxPack, BoxPack)
@@ -4603,7 +4595,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         if (!primitiveValue || primitiveValue->primitiveType() != CSSPrimitiveValue::CSS_NUMBER)
             return; // Error case.
         m_style->setBoxFlexGroup((unsigned int)(primitiveValue->getDoubleValue()));
-        return;        
+        return;
     case CSSPropertyWebkitBoxOrdinalGroup:
         HANDLE_INHERIT_AND_INITIAL(boxOrdinalGroup, BoxOrdinalGroup)
         if (!primitiveValue || primitiveValue->primitiveType() != CSSPrimitiveValue::CSS_NUMBER)
@@ -4662,19 +4654,14 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     }
     case CSSPropertyWebkitColumnRuleStyle:
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(columnRuleStyle, ColumnRuleStyle, BorderStyle)
-        m_style->setColumnRuleStyle(*primitiveValue);
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(columnRuleStyle, ColumnRuleStyle, BorderStyle)
         return;
-    case CSSPropertyWebkitColumnBreakBefore: {
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(columnBreakBefore, ColumnBreakBefore, PageBreak)
-        m_style->setColumnBreakBefore(*primitiveValue);
+    case CSSPropertyWebkitColumnBreakBefore:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(columnBreakBefore, ColumnBreakBefore, PageBreak)
         return;
-    }
-    case CSSPropertyWebkitColumnBreakAfter: {
-        HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(columnBreakAfter, ColumnBreakAfter, PageBreak)
-        m_style->setColumnBreakAfter(*primitiveValue);
+    case CSSPropertyWebkitColumnBreakAfter:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE_WITH_VALUE(columnBreakAfter, ColumnBreakAfter, PageBreak)
         return;
-    }
     case CSSPropertyWebkitColumnBreakInside: {
         HANDLE_INHERIT_AND_INITIAL_WITH_VALUE(columnBreakInside, ColumnBreakInside, PageBreak)
         EPageBreak pb = *primitiveValue;
@@ -4765,42 +4752,28 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         }
         else {
             bool ok = true;
-            Length l = convertToLength(primitiveValue, style(), &ok);
+            Length l = convertToLength(primitiveValue, style(), 1, &ok);
             if (ok)
                 m_style->setMarqueeIncrement(l);
         }
         return;
     }
-    case CSSPropertyWebkitMarqueeStyle: {
-        HANDLE_INHERIT_AND_INITIAL(marqueeBehavior, MarqueeBehavior)      
-        if (primitiveValue)
-            m_style->setMarqueeBehavior(*primitiveValue);
+    case CSSPropertyWebkitMarqueeStyle:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marqueeBehavior, MarqueeBehavior)      
         return;
-    }
-    case CSSPropertyWebkitMarqueeDirection: {
-        HANDLE_INHERIT_AND_INITIAL(marqueeDirection, MarqueeDirection)
-        if (primitiveValue)
-            m_style->setMarqueeDirection(*primitiveValue);
+    case CSSPropertyWebkitMarqueeDirection:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marqueeDirection, MarqueeDirection)
         return;
-    }
-    case CSSPropertyWebkitUserDrag: {
-        HANDLE_INHERIT_AND_INITIAL(userDrag, UserDrag)      
-        if (primitiveValue)
-            m_style->setUserDrag(*primitiveValue);
+    case CSSPropertyWebkitUserDrag:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(userDrag, UserDrag)      
         return;
-    }
-    case CSSPropertyWebkitUserModify: {
-        HANDLE_INHERIT_AND_INITIAL(userModify, UserModify)      
-        if (primitiveValue)
-            m_style->setUserModify(*primitiveValue);
+    case CSSPropertyWebkitUserModify:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(userModify, UserModify)      
         return;
-    }
-    case CSSPropertyWebkitUserSelect: {
-        HANDLE_INHERIT_AND_INITIAL(userSelect, UserSelect)      
-        if (primitiveValue)
-            m_style->setUserSelect(*primitiveValue);
+    case CSSPropertyWebkitUserSelect:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(userSelect, UserSelect)      
         return;
-    }
+
     case CSSPropertyTextOverflow: {
         // This property is supported by WinIE, and so we leave off the "-webkit-" in order to
         // work with WinIE-specific pages that use the property.
@@ -4821,18 +4794,13 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         }
         return;
     }
-    case CSSPropertyWebkitMarginTopCollapse: {
-        HANDLE_INHERIT_AND_INITIAL(marginTopCollapse, MarginTopCollapse)
-        if (primitiveValue)
-            m_style->setMarginTopCollapse(*primitiveValue);
+
+    case CSSPropertyWebkitMarginTopCollapse:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marginTopCollapse, MarginTopCollapse)
         return;
-    }
-    case CSSPropertyWebkitMarginBottomCollapse: {
-        HANDLE_INHERIT_AND_INITIAL(marginBottomCollapse, MarginBottomCollapse)
-        if (primitiveValue)
-            m_style->setMarginBottomCollapse(*primitiveValue);
+    case CSSPropertyWebkitMarginBottomCollapse:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(marginBottomCollapse, MarginBottomCollapse)
         return;
-    }
 
     // Apple-specific changes.  Do not merge these properties into KHTML.
     case CSSPropertyWebkitLineClamp: {
@@ -4865,12 +4833,10 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         m_fontDirty = true;
         return;
     }
-    case CSSPropertyWebkitTextSecurity: {
-        HANDLE_INHERIT_AND_INITIAL(textSecurity, TextSecurity)
-        if (primitiveValue)
-            m_style->setTextSecurity(*primitiveValue);
+    case CSSPropertyWebkitTextSecurity:
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(textSecurity, TextSecurity)
         return;
-    }
+
 #if ENABLE(DASHBOARD_SUPPORT)
     case CSSPropertyWebkitDashboardRegion: {
         HANDLE_INHERIT_AND_INITIAL(dashboardRegions, DashboardRegions)
@@ -4942,13 +4908,14 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitTransformOrigin:
         HANDLE_INHERIT_AND_INITIAL(transformOriginX, TransformOriginX)
         HANDLE_INHERIT_AND_INITIAL(transformOriginY, TransformOriginY)
+        HANDLE_INHERIT_AND_INITIAL(transformOriginZ, TransformOriginZ)
         return;
     case CSSPropertyWebkitTransformOriginX: {
         HANDLE_INHERIT_AND_INITIAL(transformOriginX, TransformOriginX)
         CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
         Length l;
         int type = primitiveValue->primitiveType();
-        if (type > CSSPrimitiveValue::CSS_PERCENTAGE && type < CSSPrimitiveValue::CSS_DEG)
+        if (CSSPrimitiveValue::isUnitTypeLength(type))
             l = Length(primitiveValue->computeLengthIntForLength(style(), zoomFactor), Fixed);
         else if (type == CSSPrimitiveValue::CSS_PERCENTAGE)
             l = Length(primitiveValue->getDoubleValue(), Percent);
@@ -4962,7 +4929,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
         Length l;
         int type = primitiveValue->primitiveType();
-        if (type > CSSPrimitiveValue::CSS_PERCENTAGE && type < CSSPrimitiveValue::CSS_DEG)
+        if (CSSPrimitiveValue::isUnitTypeLength(type))
             l = Length(primitiveValue->computeLengthIntForLength(style(), zoomFactor), Fixed);
         else if(type == CSSPrimitiveValue::CSS_PERCENTAGE)
             l = Length(primitiveValue->getDoubleValue(), Percent);
@@ -4971,6 +4938,69 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         m_style->setTransformOriginY(l);
         break;
     }
+    case CSSPropertyWebkitTransformOriginZ: {
+        HANDLE_INHERIT_AND_INITIAL(transformOriginZ, TransformOriginZ)
+        CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+        float f;
+        int type = primitiveValue->primitiveType();
+        if (CSSPrimitiveValue::isUnitTypeLength(type))
+            f = static_cast<float>(primitiveValue->computeLengthIntForLength(style()));
+        else
+            return;
+        m_style->setTransformOriginZ(f);
+        break;
+    }
+    case CSSPropertyWebkitTransformStyle:
+        HANDLE_INHERIT_AND_INITIAL(transformStyle3D, TransformStyle3D)
+        if (primitiveValue)
+            m_style->setTransformStyle3D((primitiveValue->getIdent() == CSSValuePreserve3d) ? TransformStyle3DPreserve3D : TransformStyle3DFlat);
+        return;
+    case CSSPropertyWebkitPerspective: {
+        HANDLE_INHERIT_AND_INITIAL(perspective, Perspective)
+        if (primitiveValue && primitiveValue->getIdent() == CSSValueNone) {
+            m_style->setPerspective(0);
+            return;
+        }
+
+        if (primitiveValue->primitiveType() != CSSPrimitiveValue::CSS_NUMBER)
+            return;
+        float perspectiveValue = static_cast<float>(primitiveValue->getDoubleValue());
+        if (perspectiveValue >= 0.0f)
+            m_style->setPerspective(perspectiveValue);
+        return;
+    }
+    case CSSPropertyWebkitPerspectiveOrigin:
+        HANDLE_INHERIT_AND_INITIAL(perspectiveOriginX, PerspectiveOriginX)
+        HANDLE_INHERIT_AND_INITIAL(perspectiveOriginY, PerspectiveOriginY)
+        return;
+    case CSSPropertyWebkitPerspectiveOriginX: {
+        HANDLE_INHERIT_AND_INITIAL(perspectiveOriginX, PerspectiveOriginX)
+        CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+        Length l;
+        int type = primitiveValue->primitiveType();
+        if (CSSPrimitiveValue::isUnitTypeLength(type))
+            l = Length(primitiveValue->computeLengthIntForLength(style(), zoomFactor), Fixed);
+        else if (type == CSSPrimitiveValue::CSS_PERCENTAGE)
+            l = Length(primitiveValue->getDoubleValue(), Percent);
+        else
+            return;
+        m_style->setPerspectiveOriginX(l);
+        return;
+    }
+    case CSSPropertyWebkitPerspectiveOriginY: {
+        HANDLE_INHERIT_AND_INITIAL(perspectiveOriginY, PerspectiveOriginY)
+        CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
+        Length l;
+        int type = primitiveValue->primitiveType();
+        if (CSSPrimitiveValue::isUnitTypeLength(type))
+            l = Length(primitiveValue->computeLengthIntForLength(style(), zoomFactor), Fixed);
+        else if(type == CSSPrimitiveValue::CSS_PERCENTAGE)
+            l = Length(primitiveValue->getDoubleValue(), Percent);
+        else
+            return;
+        m_style->setPerspectiveOriginY(l);
+        return;
+    }
     case CSSPropertyWebkitAnimation:
         if (isInitial)
             m_style->clearAnimations();
@@ -4992,9 +5022,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitAnimationName:
         HANDLE_ANIMATION_VALUE(name, Name, value)
         return;
-    case CSSPropertyWebkitAnimationPlayState:
-        HANDLE_ANIMATION_VALUE(playState, PlayState, value)
-        return;
     case CSSPropertyWebkitAnimationTimingFunction:
         HANDLE_ANIMATION_VALUE(timingFunction, TimingFunction, value)
         return;
@@ -5018,6 +5045,13 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         return;
     case CSSPropertyPointerEvents:
     {
+#if ENABLE(DASHBOARD_SUPPORT)
+        // <rdar://problem/6561077> Work around the Stocks widget's misuse of the
+        // pointer-events property by not applying it in Dashboard.
+        Settings* settings = m_checker.m_document->settings();
+        if (settings && settings->usesDashboardBackwardCompatibilityMode())
+            return;
+#endif
         HANDLE_INHERIT_AND_INITIAL(pointerEvents, PointerEvents)
         if (!primitiveValue)
             return;
@@ -5029,13 +5063,6 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyFontStretch:
     case CSSPropertyPage:
     case CSSPropertyQuotes:
-    case CSSPropertyScrollbar3dlightColor:
-    case CSSPropertyScrollbarArrowColor:
-    case CSSPropertyScrollbarDarkshadowColor:
-    case CSSPropertyScrollbarFaceColor:
-    case CSSPropertyScrollbarHighlightColor:
-    case CSSPropertyScrollbarShadowColor:
-    case CSSPropertyScrollbarTrackColor:
     case CSSPropertySize:
     case CSSPropertyTextLineThrough:
     case CSSPropertyTextLineThroughColor:
@@ -5057,6 +5084,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertyWebkitPaddingStart:
     case CSSPropertyWebkitTextDecorationsInEffect:
     case CSSPropertyWebkitTextStroke:
+    case CSSPropertyWebkitVariableDeclarationBlock:
         return;
 #if ENABLE(SVG)
     default:
@@ -5195,7 +5223,7 @@ void CSSStyleSelector::mapFillSize(FillLayer* layer, CSSValue* value)
 
     if (firstType == CSSPrimitiveValue::CSS_UNKNOWN)
         firstLength = Length(Auto);
-    else if (firstType > CSSPrimitiveValue::CSS_PERCENTAGE && firstType < CSSPrimitiveValue::CSS_DEG)
+    else if (CSSPrimitiveValue::isUnitTypeLength(firstType))
         firstLength = Length(first->computeLengthIntForLength(style(), zoomFactor), Fixed);
     else if (firstType == CSSPrimitiveValue::CSS_PERCENTAGE)
         firstLength = Length(first->getDoubleValue(), Percent);
@@ -5204,7 +5232,7 @@ void CSSStyleSelector::mapFillSize(FillLayer* layer, CSSValue* value)
 
     if (secondType == CSSPrimitiveValue::CSS_UNKNOWN)
         secondLength = Length(Auto);
-    else if (secondType > CSSPrimitiveValue::CSS_PERCENTAGE && secondType < CSSPrimitiveValue::CSS_DEG)
+    else if (CSSPrimitiveValue::isUnitTypeLength(secondType))
         secondLength = Length(second->computeLengthIntForLength(style(), zoomFactor), Fixed);
     else if (secondType == CSSPrimitiveValue::CSS_PERCENTAGE)
         secondLength = Length(second->getDoubleValue(), Percent);
@@ -5231,7 +5259,7 @@ void CSSStyleSelector::mapFillXPosition(FillLayer* layer, CSSValue* value)
     CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
     Length l;
     int type = primitiveValue->primitiveType();
-    if (type > CSSPrimitiveValue::CSS_PERCENTAGE && type < CSSPrimitiveValue::CSS_DEG)
+    if (CSSPrimitiveValue::isUnitTypeLength(type))
         l = Length(primitiveValue->computeLengthIntForLength(style(), zoomFactor), Fixed);
     else if (type == CSSPrimitiveValue::CSS_PERCENTAGE)
         l = Length(primitiveValue->getDoubleValue(), Percent);
@@ -5255,7 +5283,7 @@ void CSSStyleSelector::mapFillYPosition(FillLayer* layer, CSSValue* value)
     CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
     Length l;
     int type = primitiveValue->primitiveType();
-    if (type > CSSPrimitiveValue::CSS_PERCENTAGE && type < CSSPrimitiveValue::CSS_DEG)
+    if (CSSPrimitiveValue::isUnitTypeLength(type))
         l = Length(primitiveValue->computeLengthIntForLength(style(), zoomFactor), Fixed);
     else if (type == CSSPrimitiveValue::CSS_PERCENTAGE)
         l = Length(primitiveValue->getDoubleValue(), Percent);
@@ -5286,7 +5314,7 @@ void CSSStyleSelector::mapAnimationDirection(Animation* layer, CSSValue* value)
     }
 
     CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
-    layer->setDirection(primitiveValue->getIdent() == CSSValueAlternate);
+    layer->setDirection(primitiveValue->getIdent() == CSSValueAlternate ? Animation::AnimationDirectionAlternate : Animation::AnimationDirectionNormal);
 }
 
 void CSSStyleSelector::mapAnimationDuration(Animation* animation, CSSValue* value)
@@ -5338,17 +5366,6 @@ void CSSStyleSelector::mapAnimationName(Animation* layer, CSSValue* value)
         layer->setName(primitiveValue->getStringValue());
 }
 
-void CSSStyleSelector::mapAnimationPlayState(Animation* layer, CSSValue* value)
-{
-    if (value->cssValueType() == CSSValue::CSS_INITIAL) {
-        layer->setPlayState(Animation::initialAnimationPlayState());
-        return;
-    }
-
-    CSSPrimitiveValue* primitiveValue = static_cast<CSSPrimitiveValue*>(value);
-    layer->setPlayState((primitiveValue->getIdent() == CSSValuePaused) ? AnimPlayStatePaused : AnimPlayStatePlaying);
-}
-
 void CSSStyleSelector::mapAnimationProperty(Animation* animation, CSSValue* value)
 {
     if (value->cssValueType() == CSSValue::CSS_INITIAL) {
@@ -5678,7 +5695,7 @@ static Color colorForCSSValue(int cssValueId)
         if (col->cssValueId == cssValueId)
             return col->color;
     }
-    return theme()->systemColor(cssValueId);
+    return RenderTheme::defaultTheme()->systemColor(cssValueId);
 }
 
 Color CSSStyleSelector::getColorFromPrimitiveValue(CSSPrimitiveValue* primitiveValue)
@@ -5701,7 +5718,7 @@ Color CSSStyleSelector::getColorFromPrimitiveValue(CSSPrimitiveValue* primitiveV
         } else if (ident == CSSValueWebkitActivelink)
             col = m_element->document()->activeLinkColor();
         else if (ident == CSSValueWebkitFocusRingColor)
-            col = focusRingColor();
+            col = RenderTheme::defaultTheme()->focusRingColor();
         else if (ident == CSSValueCurrentcolor)
             col = m_style->color();
         else
@@ -5737,7 +5754,7 @@ void CSSStyleSelector::SelectorChecker::allVisitedStateChanged()
         return;
     for (Node* node = m_document; node; node = node->traverseNextNode()) {
         if (node->isLink())
-            node->setChanged();
+            node->setNeedsStyleRecalc();
     }
 }
 
@@ -5748,31 +5765,43 @@ void CSSStyleSelector::SelectorChecker::visitedStateChanged(LinkHash visitedHash
     for (Node* node = m_document; node; node = node->traverseNextNode()) {
         const AtomicString* attr = linkAttribute(node);
         if (attr && visitedLinkHash(m_document->baseURL(), *attr) == visitedHash)
-            node->setChanged();
+            node->setNeedsStyleRecalc();
     }
 }
 
-TransformOperation::OperationType getTransformOperationType(WebKitCSSTransformValue::TransformOperationType type)
+static TransformOperation::OperationType getTransformOperationType(WebKitCSSTransformValue::TransformOperationType type)
 {
     switch (type) {
         case WebKitCSSTransformValue::ScaleTransformOperation:          return TransformOperation::SCALE;
         case WebKitCSSTransformValue::ScaleXTransformOperation:         return TransformOperation::SCALE_X;
         case WebKitCSSTransformValue::ScaleYTransformOperation:         return TransformOperation::SCALE_Y;
+        case WebKitCSSTransformValue::ScaleZTransformOperation:         return TransformOperation::SCALE_Z;
+        case WebKitCSSTransformValue::Scale3DTransformOperation:        return TransformOperation::SCALE_3D;
         case WebKitCSSTransformValue::TranslateTransformOperation:      return TransformOperation::TRANSLATE;
         case WebKitCSSTransformValue::TranslateXTransformOperation:     return TransformOperation::TRANSLATE_X;
         case WebKitCSSTransformValue::TranslateYTransformOperation:     return TransformOperation::TRANSLATE_Y;
+        case WebKitCSSTransformValue::TranslateZTransformOperation:     return TransformOperation::TRANSLATE_Z;
+        case WebKitCSSTransformValue::Translate3DTransformOperation:    return TransformOperation::TRANSLATE_3D;
         case WebKitCSSTransformValue::RotateTransformOperation:         return TransformOperation::ROTATE;
+        case WebKitCSSTransformValue::RotateXTransformOperation:        return TransformOperation::ROTATE_X;
+        case WebKitCSSTransformValue::RotateYTransformOperation:        return TransformOperation::ROTATE_Y;
+        case WebKitCSSTransformValue::RotateZTransformOperation:        return TransformOperation::ROTATE_Z;
+        case WebKitCSSTransformValue::Rotate3DTransformOperation:       return TransformOperation::ROTATE_3D;
         case WebKitCSSTransformValue::SkewTransformOperation:           return TransformOperation::SKEW;
         case WebKitCSSTransformValue::SkewXTransformOperation:          return TransformOperation::SKEW_X;
         case WebKitCSSTransformValue::SkewYTransformOperation:          return TransformOperation::SKEW_Y;
         case WebKitCSSTransformValue::MatrixTransformOperation:         return TransformOperation::MATRIX;
+        case WebKitCSSTransformValue::Matrix3DTransformOperation:       return TransformOperation::MATRIX_3D;
+        case WebKitCSSTransformValue::PerspectiveTransformOperation:    return TransformOperation::PERSPECTIVE;
         case WebKitCSSTransformValue::UnknownTransformOperation:        return TransformOperation::NONE;
     }
     return TransformOperation::NONE;
 }
 
-bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle* inStyle, TransformOperations& outOperations)
+bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle* style, TransformOperations& outOperations)
 {
+    float zoomFactor = style ? style->effectiveZoom() : 1;
+
     TransformOperations operations;
     if (inValue && !inValue->isPrimitiveValue()) {
         CSSValueList* list = static_cast<CSSValueList*>(inValue);
@@ -5800,7 +5829,33 @@ bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle*
                                 sy = sx;
                         }
                     }
-                    operations.operations().append(ScaleTransformOperation::create(sx, sy, getTransformOperationType(val->operationType())));
+                    operations.operations().append(ScaleTransformOperation::create(sx, sy, 1.0, getTransformOperationType(val->operationType())));
+                    break;
+                }
+                case WebKitCSSTransformValue::ScaleZTransformOperation:
+                case WebKitCSSTransformValue::Scale3DTransformOperation: {
+                    double sx = 1.0;
+                    double sy = 1.0;
+                    double sz = 1.0;
+                    if (val->operationType() == WebKitCSSTransformValue::ScaleZTransformOperation)
+                        sz = firstValue->getDoubleValue();
+                    else if (val->operationType() == WebKitCSSTransformValue::ScaleYTransformOperation)
+                        sy = firstValue->getDoubleValue();
+                    else { 
+                        sx = firstValue->getDoubleValue();
+                        if (val->operationType() != WebKitCSSTransformValue::ScaleXTransformOperation) {
+                            if (val->length() > 2) {
+                                CSSPrimitiveValue* thirdValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(2));
+                                sz = thirdValue->getDoubleValue();
+                            }
+                            if (val->length() > 1) {
+                                CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(1));
+                                sy = secondValue->getDoubleValue();
+                            } else 
+                                sy = sx;
+                        }
+                    }
+                    operations.operations().append(ScaleTransformOperation::create(sx, sy, sz, getTransformOperationType(val->operationType())));
                     break;
                 }
                 case WebKitCSSTransformValue::TranslateTransformOperation:
@@ -5810,13 +5865,43 @@ bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle*
                     Length tx = Length(0, Fixed);
                     Length ty = Length(0, Fixed);
                     if (val->operationType() == WebKitCSSTransformValue::TranslateYTransformOperation)
-                        ty = convertToLength(firstValue, inStyle, &ok);
+                        ty = convertToLength(firstValue, style, zoomFactor, &ok);
+                    else { 
+                        tx = convertToLength(firstValue, style, zoomFactor, &ok);
+                        if (val->operationType() != WebKitCSSTransformValue::TranslateXTransformOperation) {
+                            if (val->length() > 1) {
+                                CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(1));
+                                ty = convertToLength(secondValue, style, zoomFactor, &ok);
+                            }
+                        }
+                    }
+
+                    if (!ok)
+                        return false;
+
+                    operations.operations().append(TranslateTransformOperation::create(tx, ty, Length(0, Fixed), getTransformOperationType(val->operationType())));
+                    break;
+                }
+                case WebKitCSSTransformValue::TranslateZTransformOperation:
+                case WebKitCSSTransformValue::Translate3DTransformOperation: {
+                    bool ok = true;
+                    Length tx = Length(0, Fixed);
+                    Length ty = Length(0, Fixed);
+                    Length tz = Length(0, Fixed);
+                    if (val->operationType() == WebKitCSSTransformValue::TranslateZTransformOperation)
+                        tz = convertToLength(firstValue, style, zoomFactor, &ok);
+                    else if (val->operationType() == WebKitCSSTransformValue::TranslateYTransformOperation)
+                        ty = convertToLength(firstValue, style, zoomFactor, &ok);
                     else { 
-                        tx = convertToLength(firstValue, inStyle, &ok);
+                        tx = convertToLength(firstValue, style, zoomFactor, &ok);
                         if (val->operationType() != WebKitCSSTransformValue::TranslateXTransformOperation) {
+                            if (val->length() > 2) {
+                                CSSPrimitiveValue* thirdValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(2));
+                                tz = convertToLength(thirdValue, style, zoomFactor, &ok);
+                            }
                             if (val->length() > 1) {
                                 CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(1));
-                                ty = convertToLength(secondValue, inStyle, &ok);
+                                ty = convertToLength(secondValue, style, zoomFactor, &ok);
                             }
                         }
                     }
@@ -5824,7 +5909,7 @@ bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle*
                     if (!ok)
                         return false;
 
-                    operations.operations().append(TranslateTransformOperation::create(tx, ty, getTransformOperationType(val->operationType())));
+                    operations.operations().append(TranslateTransformOperation::create(tx, ty, tz, getTransformOperationType(val->operationType())));
                     break;
                 }
                 case WebKitCSSTransformValue::RotateTransformOperation: {
@@ -5836,7 +5921,43 @@ bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle*
                     else if (firstValue->primitiveType() == CSSPrimitiveValue::CSS_TURN)
                         angle = turn2deg(angle);
                     
-                    operations.operations().append(RotateTransformOperation::create(angle, getTransformOperationType(val->operationType())));
+                    operations.operations().append(RotateTransformOperation::create(0, 0, 1, angle, getTransformOperationType(val->operationType())));
+                    break;
+                }
+                case WebKitCSSTransformValue::RotateXTransformOperation:
+                case WebKitCSSTransformValue::RotateYTransformOperation:
+                case WebKitCSSTransformValue::RotateZTransformOperation: {
+                    double x = 0;
+                    double y = 0;
+                    double z = 0;
+                    double angle = firstValue->getDoubleValue();
+                    if (firstValue->primitiveType() == CSSPrimitiveValue::CSS_RAD)
+                        angle = rad2deg(angle);
+                    else if (firstValue->primitiveType() == CSSPrimitiveValue::CSS_GRAD)
+                        angle = grad2deg(angle);
+                    
+                    if (val->operationType() == WebKitCSSTransformValue::RotateXTransformOperation)
+                        x = 1;
+                    else if (val->operationType() == WebKitCSSTransformValue::RotateYTransformOperation)
+                        y = 1;
+                    else
+                        z = 1;
+                    operations.operations().append(RotateTransformOperation::create(x, y, z, angle, getTransformOperationType(val->operationType())));
+                    break;
+                }
+                case WebKitCSSTransformValue::Rotate3DTransformOperation: {
+                    CSSPrimitiveValue* secondValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(1));
+                    CSSPrimitiveValue* thirdValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(2));
+                    CSSPrimitiveValue* fourthValue = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(3));
+                    double x = firstValue->getDoubleValue();
+                    double y = secondValue->getDoubleValue();
+                    double z = thirdValue->getDoubleValue();
+                    double angle = fourthValue->getDoubleValue();
+                    if (fourthValue->primitiveType() == CSSPrimitiveValue::CSS_RAD)
+                        angle = rad2deg(angle);
+                    else if (fourthValue->primitiveType() == CSSPrimitiveValue::CSS_GRAD)
+                        angle = grad2deg(angle);
+                    operations.operations().append(RotateTransformOperation::create(x, y, z, angle, getTransformOperationType(val->operationType())));
                     break;
                 }
                 case WebKitCSSTransformValue::SkewTransformOperation:
@@ -5872,15 +5993,42 @@ bool CSSStyleSelector::createTransformOperations(CSSValue* inValue, RenderStyle*
                     break;
                 }
                 case WebKitCSSTransformValue::MatrixTransformOperation: {
-                    float a = firstValue->getFloatValue();
-                    float b = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(1))->getFloatValue();
-                    float c = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(2))->getFloatValue();
-                    float d = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(3))->getFloatValue();
-                    float e = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(4))->getFloatValue();
-                    float f = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(5))->getFloatValue();
+                    double a = firstValue->getDoubleValue();
+                    double b = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(1))->getDoubleValue();
+                    double c = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(2))->getDoubleValue();
+                    double d = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(3))->getDoubleValue();
+                    double e = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(4))->getDoubleValue();
+                    double f = static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(5))->getDoubleValue();
                     operations.operations().append(MatrixTransformOperation::create(a, b, c, d, e, f));
                     break;
                 }
+                case WebKitCSSTransformValue::Matrix3DTransformOperation: {
+                    TransformationMatrix matrix(static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(0))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(1))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(2))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(3))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(4))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(5))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(6))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(7))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(8))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(9))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(10))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(11))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(12))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(13))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(14))->getDoubleValue(),
+                                       static_cast<CSSPrimitiveValue*>(val->itemWithoutBoundsCheck(15))->getDoubleValue());
+                    operations.operations().append(Matrix3DTransformOperation::create(matrix));
+                    break;
+                }   
+                case WebKitCSSTransformValue::PerspectiveTransformOperation: {
+                    double p = firstValue->getDoubleValue();
+                    if (p < 0.0)
+                        return false;
+                    operations.operations().append(PerspectiveTransformOperation::create(p));
+                    break;
+                }
                 case WebKitCSSTransformValue::UnknownTransformOperation:
                     ASSERT_NOT_REACHED();
                     break;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.h b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.h
index 74f9dd7..8dd36d7 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSelector.h
@@ -83,11 +83,11 @@ public:
         ~CSSStyleSelector();
 
         void initElementAndPseudoState(Element*);
-        void initForStyleResolve(Element*, RenderStyle* parentStyle = 0, RenderStyle::PseudoId = RenderStyle::NOPSEUDO);
+        void initForStyleResolve(Element*, RenderStyle* parentStyle = 0, PseudoId = NOPSEUDO);
         PassRefPtr<RenderStyle> styleForElement(Element*, RenderStyle* parentStyle = 0, bool allowSharing = true, bool resolveForRootDefault = false);
         void keyframeStylesForAnimation(Element*, const RenderStyle*, KeyframeList& list);
 
-        PassRefPtr<RenderStyle> pseudoStyleForElement(RenderStyle::PseudoId, Element*, RenderStyle* parentStyle = 0);
+        PassRefPtr<RenderStyle> pseudoStyleForElement(PseudoId, Element*, RenderStyle* parentStyle = 0);
 
     private:
         RenderStyle* locateSharedStyle();
@@ -186,10 +186,10 @@ public:
             SelectorChecker(Document*, bool strictParsing);
 
             bool checkSelector(CSSSelector*, Element*) const;
-            SelectorMatch checkSelector(CSSSelector*, Element*, HashSet<AtomicStringImpl*>* selectorAttrs, RenderStyle::PseudoId& dynamicPseudo, bool isAncestor, bool isSubSelector, RenderStyle* = 0, RenderStyle* elementParentStyle = 0) const;
-            bool checkOneSelector(CSSSelector*, Element*, HashSet<AtomicStringImpl*>* selectorAttrs, RenderStyle::PseudoId& dynamicPseudo, bool isAncestor, bool isSubSelector, RenderStyle*, RenderStyle* elementParentStyle) const;
+            SelectorMatch checkSelector(CSSSelector*, Element*, HashSet<AtomicStringImpl*>* selectorAttrs, PseudoId& dynamicPseudo, bool isAncestor, bool isSubSelector, RenderStyle* = 0, RenderStyle* elementParentStyle = 0) const;
+            bool checkOneSelector(CSSSelector*, Element*, HashSet<AtomicStringImpl*>* selectorAttrs, PseudoId& dynamicPseudo, bool isAncestor, bool isSubSelector, RenderStyle*, RenderStyle* elementParentStyle) const;
             PseudoState checkPseudoState(Element*, bool checkVisited = true) const;
-            bool checkScrollbarPseudoClass(CSSSelector*, RenderStyle::PseudoId& dynamicPseudo) const;
+            bool checkScrollbarPseudoClass(CSSSelector*, PseudoId& dynamicPseudo) const;
 
             void allVisitedStateChanged();
             void visitedStateChanged(LinkHash visitedHash);
@@ -197,7 +197,7 @@ public:
             Document* m_document;
             bool m_strictParsing;
             bool m_collectRulesOnly;
-            RenderStyle::PseudoId m_pseudoStyle;
+            PseudoId m_pseudoStyle;
             bool m_documentIsHTML;
             mutable HashSet<LinkHash, LinkHashHash> m_linksCheckedForVisitedState;
         };
@@ -226,7 +226,6 @@ public:
         void mapAnimationDuration(Animation*, CSSValue*);
         void mapAnimationIterationCount(Animation*, CSSValue*);
         void mapAnimationName(Animation*, CSSValue*);
-        void mapAnimationPlayState(Animation*, CSSValue*);
         void mapAnimationProperty(Animation*, CSSValue*);
         void mapAnimationTimingFunction(Animation*, CSSValue*);
 
@@ -243,18 +242,18 @@ public:
         // set of matched decls four times, once for those properties that others depend on (like font-size),
         // and then a second time for all the remaining properties.  We then do the same two passes
         // for any !important rules.
-        Vector<CSSMutableStyleDeclaration*> m_matchedDecls;
+        Vector<CSSMutableStyleDeclaration*, 64> m_matchedDecls;
 
         // A buffer used to hold the set of matched rules for an element, and a temporary buffer used for
         // merge sorting.
-        Vector<CSSRuleData*> m_matchedRules;
+        Vector<CSSRuleData*, 32> m_matchedRules;
 
         RefPtr<CSSRuleList> m_ruleList;
 
         MediaQueryEvaluator* m_medium;
         RefPtr<RenderStyle> m_rootDefaultStyle;
 
-        RenderStyle::PseudoId m_dynamicPseudo;
+        PseudoId m_dynamicPseudo;
 
         SelectorChecker m_checker;
 
diff --git a/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp b/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp
index 47b2c81..ce50af6 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSStyleSheet.cpp
@@ -182,6 +182,10 @@ void CSSStyleSheet::checkLoaded()
         return;
     if (parent())
         parent()->checkLoaded();
+
+    // Avoid |this| being deleted by scripts that run via HTMLTokenizer::executeScriptsWaitingForStylesheets().
+    // See <rdar://problem/6622300>.
+    RefPtr<CSSStyleSheet> protector(this);
     m_loadCompleted = ownerNode() ? ownerNode()->sheetLoaded() : true;
 }
 
@@ -190,7 +194,7 @@ void CSSStyleSheet::styleSheetChanged()
     StyleBase* root = this;
     while (StyleBase* parent = root->parent())
         root = parent;
-    Document* documentToUpdate = (root && root->isCSSStyleSheet()) ? static_cast<CSSStyleSheet*>(root)->doc() : 0;
+    Document* documentToUpdate = root->isCSSStyleSheet() ? static_cast<CSSStyleSheet*>(root)->doc() : 0;
     
     /* FIXME: We don't need to do everything updateStyleSelector does,
      * basically we just need to recreate the document's selector with the
diff --git a/src/3rdparty/webkit/WebCore/css/CSSValue.idl b/src/3rdparty/webkit/WebCore/css/CSSValue.idl
index 8979b61..875d12e 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSValue.idl
+++ b/src/3rdparty/webkit/WebCore/css/CSSValue.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -22,7 +22,7 @@ module css {
 
     interface [
         GenerateConstructor,
-        ObjCCustomInternalImpl,
+        Polymorphic,
         InterfaceUUID=9fd62a7b-539d-4500-bd6c-ec075abbc404,
         ImplementationUUID=e10a2860-f98e-4bd3-96b4-1493ad941dfe
     ] CSSValue {
diff --git a/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in b/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in
index 3271166..698dffe 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in
+++ b/src/3rdparty/webkit/WebCore/css/CSSValueKeywords.in
@@ -506,6 +506,9 @@ media-seek-back-button
 media-seek-forward-button
 media-slider
 media-sliderthumb
+media-timeline-container
+media-current-time-display
+media-time-remaining-display
 menulist
 menulist-button
 menulist-text
@@ -534,9 +537,13 @@ round
 #
 # CSS_PROP_BACKGROUND_CLIP/ORIGIN
 #
+# border/content/padding are deprecated and ultimately will only apply to the -webkit- form of these properties.
+# border-box/content-box/padding-box should be used instead.
+#
 border
 content
 padding
+padding-box
 
 #
 # CSS_PROP_BOX_SIZING
@@ -572,6 +579,12 @@ running
 paused
 
 #
+# CSS_PROP__WEBKIT_TRANSFORM_STYLE
+#
+flat
+preserve-3d
+
+#
 # CSS_PROP__WEBKIT_TRANSITION_TIMING_FUNCTION
 # CSS_PROP__WEBKIT_ANIMATION_TIMING_FUNCTION
 #
@@ -598,4 +611,4 @@ painted
 fill
 stroke
 #all
-#none
\ No newline at end of file
+#none
diff --git a/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.cpp
index 5f8d601..cb852cb 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.cpp
@@ -72,7 +72,7 @@ String CSSVariablesDeclaration::removeVariable(const String& variableName, Excep
             }
         }
         
-        setChanged();
+        setNeedsStyleRecalc();
     }
     
     // FIXME: Communicate this change so that the document will update.
@@ -86,7 +86,7 @@ void CSSVariablesDeclaration::setVariable(const String& variableName, const Stri
     if (!parser.parseVariable(this, variableName, variableValue)) // If the parse succeeds, it will call addParsedVariable (our internal method for doing the add) with the parsed Value*.
         excCode = SYNTAX_ERR;
     else
-        setChanged();
+        setNeedsStyleRecalc();
 }
 
 void CSSVariablesDeclaration::addParsedVariable(const String& variableName, PassRefPtr<CSSValue> variableValue, bool updateNamesList)
@@ -162,7 +162,7 @@ void CSSVariablesDeclaration::setCssText(const String&)
     // FIXME: It's not clear if this is actually settable.
 }
 
-void CSSVariablesDeclaration::setChanged()
+void CSSVariablesDeclaration::setNeedsStyleRecalc()
 {
     // FIXME: Make this much better (it has the same problem CSSMutableStyleDeclaration does).
     StyleBase* root = this;
diff --git a/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.h b/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.h
index aa98158..f16b011 100644
--- a/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/css/CSSVariablesDeclaration.h
@@ -70,7 +70,7 @@ public:
 private:
     CSSVariablesDeclaration(StyleBase* owningRule, const Vector<String>& names, const Vector<RefPtr<CSSValue> >& values);
 
-    void setChanged();
+    void setNeedsStyleRecalc();
 
 protected:
     Vector<String> m_variableNames;
diff --git a/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.h b/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.h
index bea2b8a..5196586 100644
--- a/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.h
+++ b/src/3rdparty/webkit/WebCore/css/MediaFeatureNames.h
@@ -33,11 +33,14 @@ namespace WebCore {
     macro(monochrome, "monochrome") \
     macro(height, "height") \
     macro(width, "width") \
+    macro(orientation, "orientation") \
+    macro(aspect_ratio, "aspect-ratio") \
     macro(device_aspect_ratio, "device-aspect-ratio") \
     macro(device_pixel_ratio, "-webkit-device-pixel-ratio") \
     macro(device_height, "device-height") \
     macro(device_width, "device-width") \
     macro(max_color, "max-color") \
+    macro(max_aspect_ratio, "max-aspect-ratio") \
     macro(max_device_aspect_ratio, "max-device-aspect-ratio") \
     macro(max_device_pixel_ratio, "-webkit-max-device-pixel-ratio") \
     macro(max_device_height, "max-device-height") \
@@ -46,6 +49,7 @@ namespace WebCore {
     macro(max_monochrome, "max-monochrome") \
     macro(max_width, "max-width") \
     macro(min_color, "min-color") \
+    macro(min_aspect_ratio, "min-aspect-ratio") \
     macro(min_device_aspect_ratio, "min-device-aspect-ratio") \
     macro(min_device_pixel_ratio, "-webkit-min-device-pixel-ratio") \
     macro(min_device_height, "min-device-height") \
diff --git a/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.cpp b/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.cpp
index 211178c..c641dfd 100644
--- a/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.cpp
+++ b/src/3rdparty/webkit/WebCore/css/MediaQueryEvaluator.cpp
@@ -230,6 +230,38 @@ static bool monochromeMediaFeatureEval(CSSValue* value, RenderStyle* style, Fram
     return colorMediaFeatureEval(value, style, frame, op);
 }
 
+static bool orientationMediaFeatureEval(CSSValue* value, RenderStyle*, Frame* frame, MediaFeaturePrefix)
+{
+    // A missing parameter should fail
+    if (!value)
+        return false;
+
+    FrameView* view = frame->view();
+    int width = view->layoutWidth();
+    int height = view->layoutHeight();
+    if (width > height) // Square viewport is portrait
+        return "landscape" == static_cast<CSSPrimitiveValue*>(value)->getStringValue();
+    return "portrait" == static_cast<CSSPrimitiveValue*>(value)->getStringValue();
+}
+
+static bool aspect_ratioMediaFeatureEval(CSSValue* value, RenderStyle*, Frame* frame, MediaFeaturePrefix op)
+{
+    if (value) {
+        FrameView* view = frame->view();
+        int width = view->layoutWidth();
+        int height = view->layoutHeight();
+        int h = 0;
+        int v = 0;
+        if (parseAspectRatio(value, h, v))
+            return v != 0 && compareValue(width * v, height * h, op);
+        return false;
+    }
+
+    // ({,min-,max-}aspect-ratio)
+    // assume if we have a device, its aspect ratio is non-zero
+    return true;
+}
+
 static bool device_aspect_ratioMediaFeatureEval(CSSValue* value, RenderStyle*, Frame* frame, MediaFeaturePrefix op)
 {
     if (value) {
@@ -328,6 +360,16 @@ static bool max_monochromeMediaFeatureEval(CSSValue* value, RenderStyle* style,
     return monochromeMediaFeatureEval(value, style, frame, MaxPrefix);
 }
 
+static bool min_aspect_ratioMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame* frame, MediaFeaturePrefix)
+{
+    return aspect_ratioMediaFeatureEval(value, style, frame, MinPrefix);
+}
+
+static bool max_aspect_ratioMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame* frame, MediaFeaturePrefix)
+{
+    return aspect_ratioMediaFeatureEval(value, style, frame, MaxPrefix);
+}
+
 static bool min_device_aspect_ratioMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame* frame, MediaFeaturePrefix)
 {
     return device_aspect_ratioMediaFeatureEval(value, style, frame, MinPrefix);
@@ -388,7 +430,7 @@ static bool max_device_widthMediaFeatureEval(CSSValue* value, RenderStyle* style
     return device_widthMediaFeatureEval(value, style, frame, MaxPrefix);
 }
 
-static bool animationMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame* frame,  MediaFeaturePrefix op)
+static bool animationMediaFeatureEval(CSSValue* value, RenderStyle*, Frame*, MediaFeaturePrefix op)
 {
     if (value) {
         float number;
@@ -397,7 +439,7 @@ static bool animationMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame
     return true;
 }
 
-static bool transitionMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame* frame,  MediaFeaturePrefix op)
+static bool transitionMediaFeatureEval(CSSValue* value, RenderStyle*, Frame*, MediaFeaturePrefix op)
 {
     if (value) {
         float number;
@@ -406,7 +448,7 @@ static bool transitionMediaFeatureEval(CSSValue* value, RenderStyle* style, Fram
     return true;
 }
 
-static bool transform_2dMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame* frame,  MediaFeaturePrefix op)
+static bool transform_2dMediaFeatureEval(CSSValue* value, RenderStyle*, Frame*, MediaFeaturePrefix op)
 {
     if (value) {
         float number;
@@ -415,13 +457,24 @@ static bool transform_2dMediaFeatureEval(CSSValue* value, RenderStyle* style, Fr
     return true;
 }
 
-static bool transform_3dMediaFeatureEval(CSSValue* value, RenderStyle* style, Frame* frame,  MediaFeaturePrefix op)
+static bool transform_3dMediaFeatureEval(CSSValue* value, RenderStyle*, Frame*, MediaFeaturePrefix op)
 {
+    bool returnValueIfNoParameter;
+    int have3dRendering;
+
+#if ENABLE(3D_RENDERING)
+    returnValueIfNoParameter = true;
+    have3dRendering = 1;
+#else
+    returnValueIfNoParameter = false;
+    have3dRendering = 0;
+#endif
+
     if (value) {
         float number;
-        return numberValue(value, number) && compareValue(0, static_cast<int>(number), op);
+        return numberValue(value, number) && compareValue(have3dRendering, static_cast<int>(number), op);
     }
-    return false;
+    return returnValueIfNoParameter;
 }
 
 static void createFunctionMap()
diff --git a/src/3rdparty/webkit/WebCore/css/MediaQueryExp.h b/src/3rdparty/webkit/WebCore/css/MediaQueryExp.h
index daae232..3036d04 100644
--- a/src/3rdparty/webkit/WebCore/css/MediaQueryExp.h
+++ b/src/3rdparty/webkit/WebCore/css/MediaQueryExp.h
@@ -57,7 +57,11 @@ public:
                                               m_mediaFeature == MediaFeatureNames::min_widthMediaFeature ||
                                               m_mediaFeature == MediaFeatureNames::min_heightMediaFeature ||
                                               m_mediaFeature == MediaFeatureNames::max_widthMediaFeature ||
-                                              m_mediaFeature == MediaFeatureNames::max_heightMediaFeature; }
+                                              m_mediaFeature == MediaFeatureNames::max_heightMediaFeature ||
+                                              m_mediaFeature == MediaFeatureNames::orientationMediaFeature ||
+                                              m_mediaFeature == MediaFeatureNames::aspect_ratioMediaFeature ||
+                                              m_mediaFeature == MediaFeatureNames::min_aspect_ratioMediaFeature ||
+                                              m_mediaFeature == MediaFeatureNames::max_aspect_ratioMediaFeature;  }
 private:
     AtomicString m_mediaFeature;
     RefPtr<CSSValue> m_value;
diff --git a/src/3rdparty/webkit/WebCore/css/RGBColor.idl b/src/3rdparty/webkit/WebCore/css/RGBColor.idl
index cb14319..f76b6a25 100644
--- a/src/3rdparty/webkit/WebCore/css/RGBColor.idl
+++ b/src/3rdparty/webkit/WebCore/css/RGBColor.idl
@@ -33,10 +33,10 @@ module css {
         readonly attribute CSSPrimitiveValue  blue;
 
         // WebKit extensions
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         readonly attribute CSSPrimitiveValue  alpha;
 #endif
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute Color              color;
 #endif
     };
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
index 1375fc2..2cd90a9 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSComputedStyleDeclaration.cpp
@@ -26,6 +26,7 @@
 #include "CSSPrimitiveValueMappings.h"
 #include "CSSPropertyNames.h"
 #include "Document.h"
+#include "RenderStyle.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp b/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp
index a6d7fbc..04ba185 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSParser.cpp
@@ -160,14 +160,6 @@ bool CSSParser::parseSVGValue(int propId, bool important)
      * correctly and allows optimization in applyRule(..)
      */
 
-    case CSSPropertyPointerEvents:
-    // none | visiblePainted | visibleFill | visibleStroke | visible |
-    // painted | fill | stroke | none | all | inherit
-        if (id == CSSValueVisible || id == CSSValueNone || id == CSSValueAll ||
-          (id >= CSSValueVisiblepainted && id <= CSSValueStroke))
-            valid_primitive = true;
-        break;
-
     case CSSPropertyTextAnchor:    // start | middle | end | inherit
         if (id == CSSValueStart || id == CSSValueMiddle || id == CSSValueEnd)
             valid_primitive = true;
diff --git a/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp b/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp
index 34d981c..d326dde 100644
--- a/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp
+++ b/src/3rdparty/webkit/WebCore/css/SVGCSSStyleSelector.cpp
@@ -59,25 +59,6 @@ HANDLE_INHERIT(prop, Prop) \
 else if (isInitial) \
     svgstyle->set##Prop(SVGRenderStyle::initial##Prop());
 
-#define HANDLE_INHERIT_COND(propID, prop, Prop) \
-if (id == propID) \
-{\
-    svgstyle->set##Prop(m_parentStyle->svgStyle()->prop());\
-    return;\
-}
-
-#define HANDLE_INITIAL_COND(propID, Prop) \
-if (id == propID) \
-{\
-    svgstyle->set##Prop(SVGRenderStyle::initial##Prop());\
-    return;\
-}
-
-#define HANDLE_INITIAL_COND_WITH_VALUE(propID, Prop, Value) \
-if (id == propID) { \
-    svgstyle->set##Prop(SVGRenderStyle::initial##Value()); \
-    return; \
-}
 
 namespace WebCore {
 
@@ -111,8 +92,21 @@ static int angleToGlyphOrientation(float angle)
     return -1;
 }
 
+static Color colorFromSVGColorCSSValue(CSSValue* value, RenderStyle* style)
+{
+    ASSERT(value->isSVGColor());
+    SVGColor* c = static_cast<SVGColor*>(value);
+    Color color;
+    if (c->colorType() == SVGColor::SVG_COLORTYPE_CURRENTCOLOR)
+        color = style->color();
+    else
+        color = c->color();
+    return color;
+}
+
 void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
 {
+    ASSERT(value);
     CSSPrimitiveValue* primitiveValue = 0;
     if (value->isPrimitiveValue())
         primitiveValue = static_cast<CSSPrimitiveValue*>(value);
@@ -168,15 +162,7 @@ void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
         }
         case CSSPropertyKerning:
         {
-            if (isInherit) {
-                HANDLE_INHERIT_COND(CSSPropertyKerning, kerning, Kerning)
-                return;
-            }
-            else if (isInitial) {
-                HANDLE_INITIAL_COND_WITH_VALUE(CSSPropertyKerning, Kerning, Kerning)
-                return;
-            }
-
+            HANDLE_INHERIT_AND_INITIAL(kerning, Kerning);
             svgstyle->setKerning(primitiveValue);
             break;
         }
@@ -254,52 +240,37 @@ void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
         case CSSPropertyFill:
         {
             HANDLE_INHERIT_AND_INITIAL(fillPaint, FillPaint)
-            if (!primitiveValue && value) {
-                SVGPaint *paint = static_cast<SVGPaint*>(value);
-                if (paint)
-                    svgstyle->setFillPaint(paint);
-            }
-            
+            if (value->isSVGPaint())
+                svgstyle->setFillPaint(static_cast<SVGPaint*>(value));
             break;
         }
         case CSSPropertyStroke:
         {
             HANDLE_INHERIT_AND_INITIAL(strokePaint, StrokePaint)
-            if (!primitiveValue && value) {
-                SVGPaint *paint = static_cast<SVGPaint*>(value);
-                if (paint)
-                    svgstyle->setStrokePaint(paint);
-            }
+            if (value->isSVGPaint())
+                svgstyle->setStrokePaint(static_cast<SVGPaint*>(value));
             
             break;
         }
         case CSSPropertyStrokeWidth:
         {
             HANDLE_INHERIT_AND_INITIAL(strokeWidth, StrokeWidth)
-            if (!primitiveValue)
-                return;
-        
-            svgstyle->setStrokeWidth(primitiveValue);
+            if (primitiveValue)
+                svgstyle->setStrokeWidth(primitiveValue);
             break;
         }
         case CSSPropertyStrokeDasharray:
         {
             HANDLE_INHERIT_AND_INITIAL(strokeDashArray, StrokeDashArray)
-            if (!primitiveValue && value) {
-                CSSValueList* dashes = static_cast<CSSValueList*>(value);
-                if (dashes)
-                    svgstyle->setStrokeDashArray(dashes);
-            }
-        
+            if (value->isValueList())
+                svgstyle->setStrokeDashArray(static_cast<CSSValueList*>(value));
             break;
         }
         case CSSPropertyStrokeDashoffset:
         {
             HANDLE_INHERIT_AND_INITIAL(strokeDashOffset, StrokeDashOffset)
-            if (!primitiveValue)
-                return;
-
-            svgstyle->setStrokeDashOffset(primitiveValue);
+            if (primitiveValue)
+                svgstyle->setStrokeDashOffset(primitiveValue);
             break;
         }
         case CSSPropertyFillOpacity:
@@ -491,35 +462,13 @@ void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
         case CSSPropertyStopColor:
         {
             HANDLE_INHERIT_AND_INITIAL(stopColor, StopColor);
-
-            SVGColor* c = static_cast<SVGColor*>(value);
-            if (!c)
-                return CSSStyleSelector::applyProperty(id, value);
-
-            Color col;
-            if (c->colorType() == SVGColor::SVG_COLORTYPE_CURRENTCOLOR)
-                col = m_style->color();
-            else
-                col = c->color();
-
-            svgstyle->setStopColor(col);
+            svgstyle->setStopColor(colorFromSVGColorCSSValue(value, m_style.get()));
             break;
         }
        case CSSPropertyLightingColor:
         {
             HANDLE_INHERIT_AND_INITIAL(lightingColor, LightingColor);
-
-            SVGColor* c = static_cast<SVGColor*>(value);
-            if (!c)
-                return CSSStyleSelector::applyProperty(id, value);
-
-            Color col;
-            if (c->colorType() == SVGColor::SVG_COLORTYPE_CURRENTCOLOR)
-                col = m_style->color();
-            else
-                col = c->color();
-
-            svgstyle->setLightingColor(col);
+            svgstyle->setLightingColor(colorFromSVGColorCSSValue(value, m_style.get()));
             break;
         }
         case CSSPropertyFloodOpacity:
@@ -542,21 +491,11 @@ void CSSStyleSelector::applySVGProperty(int id, CSSValue* value)
         }
         case CSSPropertyFloodColor:
         {
-            Color col;
-            if (isInitial)
-                col = SVGRenderStyle::initialFloodColor();
-            else {
-                SVGColor *c = static_cast<SVGColor*>(value);
-                if (!c)
-                    return CSSStyleSelector::applyProperty(id, value);
-
-                if (c->colorType() == SVGColor::SVG_COLORTYPE_CURRENTCOLOR)
-                    col = m_style->color();
-                else
-                    col = c->color();
+            if (isInitial) {
+                svgstyle->setFloodColor(SVGRenderStyle::initialFloodColor());
+                return;
             }
-
-            svgstyle->setFloodColor(col);
+            svgstyle->setFloodColor(colorFromSVGColorCSSValue(value, m_style.get()));
             break;
         }
         case CSSPropertyGlyphOrientationHorizontal:
diff --git a/src/3rdparty/webkit/WebCore/css/StyleSheet.idl b/src/3rdparty/webkit/WebCore/css/StyleSheet.idl
index 81bbe34..3a26f20 100644
--- a/src/3rdparty/webkit/WebCore/css/StyleSheet.idl
+++ b/src/3rdparty/webkit/WebCore/css/StyleSheet.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -24,7 +24,7 @@ module stylesheets {
     interface [
         CustomMarkFunction,
         GenerateConstructor,
-        ObjCCustomInternalImpl,
+        Polymorphic,
         InterfaceUUID=2bd2db5f-aaab-4422-96a0-e05455313f35,
         ImplementationUUID=a8ca694d-71f2-4479-8c76-ee9c1c729b49
     ] StyleSheet {
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.cpp b/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.cpp
new file mode 100644
index 0000000..574a01a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.cpp
@@ -0,0 +1,186 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "WebKitCSSMatrix.h"
+
+#include "CSSParser.h"
+#include "CSSStyleSelector.h"
+#include "CSSMutableStyleDeclaration.h"
+#include "CSSPropertyNames.h"
+#include "ExceptionCode.h"
+#include "RenderStyle.h"
+#include <wtf/MathExtras.h>
+
+namespace WebCore {
+
+WebKitCSSMatrix::WebKitCSSMatrix()
+    : StyleBase(0)
+{
+}
+
+WebKitCSSMatrix::WebKitCSSMatrix(const WebKitCSSMatrix& m)
+    : StyleBase(0)
+    , m_matrix(m.m_matrix)
+{
+}
+
+WebKitCSSMatrix::WebKitCSSMatrix(const TransformationMatrix& m)
+    : StyleBase(0)
+    , m_matrix(m)
+{
+}
+
+WebKitCSSMatrix::WebKitCSSMatrix(const String& s, ExceptionCode& ec) 
+    : StyleBase(0)
+{
+    setMatrixValue(s, ec);
+}
+
+WebKitCSSMatrix::~WebKitCSSMatrix()
+{
+}
+
+void WebKitCSSMatrix::setMatrixValue(const String& string, ExceptionCode& ec)
+{
+    CSSParser p(useStrictParsing());
+    RefPtr<CSSMutableStyleDeclaration> styleDeclaration = CSSMutableStyleDeclaration::create();
+    if (p.parseValue(styleDeclaration.get(), CSSPropertyWebkitTransform, string, true)) {
+        // Convert to TransformOperations. This can fail if a property 
+        // requires style (i.e., param uses 'ems' or 'exs')
+        PassRefPtr<CSSValue> val =  styleDeclaration->getPropertyCSSValue(CSSPropertyWebkitTransform);
+        TransformOperations operations;
+        if (!CSSStyleSelector::createTransformOperations(val.get(), 0, operations)) {
+            ec = SYNTAX_ERR;
+            return;
+        }
+        
+        // Convert transform operations to a TransformationMatrix. This can fail
+        // if a param has a percentage ('%')
+        TransformationMatrix t;
+        for (unsigned i = 0; i < operations.operations().size(); ++i) {
+            if (operations.operations()[i].get()->apply(t, IntSize(0, 0))) {
+                ec = SYNTAX_ERR;
+                return;
+            }
+        }
+        
+        // set the matrix
+        m_matrix = t;
+    } else if (!string.isEmpty()) // There is something there but parsing failed
+        ec = SYNTAX_ERR;
+}
+
+// This is a multRight (this = this * secondMatrix)
+PassRefPtr<WebKitCSSMatrix> WebKitCSSMatrix::multiply(WebKitCSSMatrix* secondMatrix) const
+{
+    if (!secondMatrix)
+        return 0;
+
+    TransformationMatrix tmp(m_matrix);
+    tmp.multiply(secondMatrix->m_matrix);
+    return WebKitCSSMatrix::create(tmp);
+}
+
+PassRefPtr<WebKitCSSMatrix> WebKitCSSMatrix::inverse(ExceptionCode& ec) const
+{
+    if (!m_matrix.isInvertible()) {
+        ec = NOT_SUPPORTED_ERR;
+        return 0;
+    }
+    
+    return WebKitCSSMatrix::create(m_matrix.inverse());
+}
+
+PassRefPtr<WebKitCSSMatrix> WebKitCSSMatrix::translate(double x, double y, double z) const
+{
+    if (isnan(x))
+        x = 0;
+    if (isnan(y))
+        y = 0;
+    if (isnan(z))
+        z = 0;
+    return WebKitCSSMatrix::create(TransformationMatrix(m_matrix).translate3d(x, y, z));
+}
+
+PassRefPtr<WebKitCSSMatrix> WebKitCSSMatrix::scale(double scaleX, double scaleY, double scaleZ) const
+{
+    if (isnan(scaleX))
+        scaleX = 1;
+    if (isnan(scaleY))
+        scaleY = scaleX;
+    if (isnan(scaleZ))
+        scaleZ = 1;
+    return WebKitCSSMatrix::create(TransformationMatrix(m_matrix).scale3d(scaleX, scaleY, scaleZ));
+}
+
+PassRefPtr<WebKitCSSMatrix> WebKitCSSMatrix::rotate(double rotX, double rotY, double rotZ) const
+{
+    if (isnan(rotX))
+        rotX = 0;
+        
+    if (isnan(rotY) && isnan(rotZ)) {
+        rotZ = rotX;
+        rotX = 0;
+        rotY = 0;
+    }
+
+    if (isnan(rotY))
+        rotY = 0;
+    if (isnan(rotZ))
+        rotZ = 0;
+    return WebKitCSSMatrix::create(TransformationMatrix(m_matrix).rotate3d(rotX, rotY, rotZ));
+}
+
+PassRefPtr<WebKitCSSMatrix> WebKitCSSMatrix::rotateAxisAngle(double x, double y, double z, double angle) const
+{
+    if (isnan(x))
+        x = 0;
+    if (isnan(y))
+        y = 0;
+    if (isnan(z))
+        z = 0;
+    if (isnan(angle))
+        angle = 0;
+    if (x == 0 && y == 0 && z == 0)
+        z = 1;
+    return WebKitCSSMatrix::create(TransformationMatrix(m_matrix).rotate3d(x, y, z, angle));
+}
+
+
+String WebKitCSSMatrix::toString() const
+{
+    // FIXME - Need to ensure valid CSS floating point values (https://bugs.webkit.org/show_bug.cgi?id=20674)
+    if (m_matrix.isAffine())
+        return String::format("matrix(%f, %f, %f, %f, %f, %f)",
+                                m_matrix.a(), m_matrix.b(), m_matrix.c(), m_matrix.d(), m_matrix.e(), m_matrix.f());
+    return String::format("matrix3d(%f, %f, %f, %f, %f, %f, %f, %f, %f, %f, %f, %f, %f, %f, %f, %f)",
+                            m_matrix.m11(), m_matrix.m12(), m_matrix.m13(), m_matrix.m14(),
+                            m_matrix.m21(), m_matrix.m22(), m_matrix.m23(), m_matrix.m24(),
+                            m_matrix.m31(), m_matrix.m32(), m_matrix.m33(), m_matrix.m34(),
+                            m_matrix.m41(), m_matrix.m42(), m_matrix.m43(), m_matrix.m44());
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.h b/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.h
new file mode 100644
index 0000000..67ba113
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.h
@@ -0,0 +1,159 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef WebKitCSSMatrix_h
+#define WebKitCSSMatrix_h
+
+#include "ExceptionCode.h"
+#include "PlatformString.h"
+#include "StyleBase.h"
+#include "TransformationMatrix.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class WebKitCSSMatrix : public StyleBase {
+public:
+    static PassRefPtr<WebKitCSSMatrix> create()
+    {
+        return adoptRef(new WebKitCSSMatrix());
+    }
+    static PassRefPtr<WebKitCSSMatrix> create(const WebKitCSSMatrix& m)
+    {
+        return adoptRef(new WebKitCSSMatrix(m));
+    }
+    static PassRefPtr<WebKitCSSMatrix> create(const TransformationMatrix& m)
+    {
+        return adoptRef(new WebKitCSSMatrix(m));
+    }
+    static PassRefPtr<WebKitCSSMatrix> create(const String& s, ExceptionCode& ec)
+    {
+        return adoptRef(new WebKitCSSMatrix(s, ec));
+    }
+    
+    virtual ~WebKitCSSMatrix();
+
+    double a() const { return m_matrix.a(); }
+    double b() const { return m_matrix.b(); }
+    double c() const { return m_matrix.c(); }
+    double d() const { return m_matrix.d(); }
+    double e() const { return m_matrix.e(); }
+    double f() const { return m_matrix.f(); }
+    
+    void setA(double f) { m_matrix.setA(f); }
+    void setB(double f) { m_matrix.setB(f); }
+    void setC(double f) { m_matrix.setC(f); }
+    void setD(double f) { m_matrix.setD(f); }
+    void setE(double f) { m_matrix.setE(f); }
+    void setF(double f) { m_matrix.setF(f); }
+ 
+    double m11() const { return m_matrix.m11(); }
+    double m12() const { return m_matrix.m12(); }
+    double m13() const { return m_matrix.m13(); }
+    double m14() const { return m_matrix.m14(); }
+    double m21() const { return m_matrix.m21(); }
+    double m22() const { return m_matrix.m22(); }
+    double m23() const { return m_matrix.m23(); }
+    double m24() const { return m_matrix.m24(); }
+    double m31() const { return m_matrix.m31(); }
+    double m32() const { return m_matrix.m32(); }
+    double m33() const { return m_matrix.m33(); }
+    double m34() const { return m_matrix.m34(); }
+    double m41() const { return m_matrix.m41(); }
+    double m42() const { return m_matrix.m42(); }
+    double m43() const { return m_matrix.m43(); }
+    double m44() const { return m_matrix.m44(); }
+    
+    void setM11(double f) { m_matrix.setM11(f); }
+    void setM12(double f) { m_matrix.setM12(f); }
+    void setM13(double f) { m_matrix.setM13(f); }
+    void setM14(double f) { m_matrix.setM14(f); }
+    void setM21(double f) { m_matrix.setM21(f); }
+    void setM22(double f) { m_matrix.setM22(f); }
+    void setM23(double f) { m_matrix.setM23(f); }
+    void setM24(double f) { m_matrix.setM24(f); }
+    void setM31(double f) { m_matrix.setM31(f); }
+    void setM32(double f) { m_matrix.setM32(f); }
+    void setM33(double f) { m_matrix.setM33(f); }
+    void setM34(double f) { m_matrix.setM34(f); }
+    void setM41(double f) { m_matrix.setM41(f); }
+    void setM42(double f) { m_matrix.setM42(f); }
+    void setM43(double f) { m_matrix.setM43(f); }
+    void setM44(double f) { m_matrix.setM44(f); }
+ 
+    void setMatrixValue(const String& string, ExceptionCode&);
+    
+    // The following math function return a new matrix with the 
+    // specified operation applied. The this value is not modified.
+    
+    // Multiply this matrix by secondMatrix, on the right (result = this * secondMatrix)
+    PassRefPtr<WebKitCSSMatrix> multiply(WebKitCSSMatrix* secondMatrix) const;
+    
+    // Return the inverse of this matrix. Throw an exception if the matrix is not invertible
+    PassRefPtr<WebKitCSSMatrix> inverse(ExceptionCode&) const;
+    
+    // Return this matrix translated by the passed values.
+    // Passing a NaN will use a value of 0. This allows the 3D form to used for 2D operations
+    // Operation is performed as though the this matrix is multiplied by a matrix with
+    // the translation values on the left (result = translation(x,y,z) * this)
+    PassRefPtr<WebKitCSSMatrix> translate(double x, double y, double z) const;
+    
+    // Returns this matrix scaled by the passed values.
+    // Passing scaleX or scaleZ as NaN uses a value of 1, but passing scaleY of NaN 
+    // makes it the same as scaleX. This allows the 3D form to used for 2D operations
+    // Operation is performed as though the this matrix is multiplied by a matrix with
+    // the scale values on the left (result = scale(x,y,z) * this)
+    PassRefPtr<WebKitCSSMatrix> scale(double scaleX, double scaleY, double scaleZ) const;
+
+    // Returns this matrix rotated by the passed values.
+    // If rotY and rotZ are NaN, rotate about Z (rotX=0, rotateY=0, rotateZ=rotX).
+    // Otherwise use a rotation value of 0 for any passed NaN.    
+    // Operation is performed as though the this matrix is multiplied by a matrix with
+    // the rotation values on the left (result = rotation(x,y,z) * this)
+    PassRefPtr<WebKitCSSMatrix> rotate(double rotX, double rotY, double rotZ) const;
+    
+    // Returns this matrix rotated about the passed axis by the passed angle.
+    // Passing a NaN will use a value of 0. If the axis is (0,0,0) use a value
+    // Operation is performed as though the this matrix is multiplied by a matrix with
+    // the rotation values on the left (result = rotation(x,y,z,angle) * this)
+    PassRefPtr<WebKitCSSMatrix> rotateAxisAngle(double x, double y, double z, double angle) const;
+    
+    const TransformationMatrix& transform() const { return m_matrix; }
+    
+    String toString() const;
+    
+protected:
+    WebKitCSSMatrix();
+    WebKitCSSMatrix(const WebKitCSSMatrix&);
+    WebKitCSSMatrix(const TransformationMatrix&);
+    WebKitCSSMatrix(const String&, ExceptionCode& );
+
+    TransformationMatrix m_matrix;
+};
+
+} // namespace WebCore
+
+#endif // WebKitCSSMatrix_h
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.idl b/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.idl
new file mode 100644
index 0000000..6b22da1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSMatrix.idl
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module css {
+
+    // Introduced in DOM Level ?:
+    interface WebKitCSSMatrix {
+
+        // These attributes are simple aliases for certain elements of the 4x4 matrix
+        attribute double a; // alias for m11
+        attribute double b; // alias for m12
+        attribute double c; // alias for m21
+        attribute double d; // alias for m22
+        attribute double e; // alias for m41
+        attribute double f; // alias for m42
+
+        attribute double m11;
+        attribute double m12;
+        attribute double m13;
+        attribute double m14;
+        attribute double m21;
+        attribute double m22;
+        attribute double m23;
+        attribute double m24;
+        attribute double m31;
+        attribute double m32;
+        attribute double m33;
+        attribute double m34;
+        attribute double m41;
+        attribute double m42;
+        attribute double m43;
+        attribute double m44;
+
+        void setMatrixValue(in DOMString string) raises (DOMException);
+        
+        // Multiply this matrix by secondMatrix, on the right (result = this * secondMatrix)
+        [Immutable] WebKitCSSMatrix multiply(in WebKitCSSMatrix secondMatrix);
+        
+        // Return the inverse of this matrix. Throw an exception if the matrix is not invertible
+        [Immutable] WebKitCSSMatrix inverse() raises (DOMException);
+        
+        // Return this matrix translated by the passed values.
+        // Passing a NaN will use a value of 0. This allows the 3D form to used for 2D operations    
+        [Immutable] WebKitCSSMatrix translate(in double x, in double y, in double z);
+        
+        // Returns this matrix scaled by the passed values.
+        // Passing scaleX or scaleZ as NaN uses a value of 1, but passing scaleY of NaN 
+        // makes it the same as scaleX. This allows the 3D form to used for 2D operations
+        [Immutable] WebKitCSSMatrix scale(in double scaleX, in double scaleY, in double scaleZ);
+        
+        // Returns this matrix rotated by the passed values.
+        // If rotY and rotZ are NaN, rotate about Z (rotX=0, rotateY=0, rotateZ=rotX).
+        // Otherwise use a rotation value of 0 for any passed NaN.    
+        [Immutable] WebKitCSSMatrix rotate(in double rotX, in double rotY, in double rotZ);
+        
+        // Returns this matrix rotated about the passed axis by the passed angle.
+        // Passing a NaN will use a value of 0. If the axis is (0,0,0) use a value
+        // of (0,0,1).
+        [Immutable] WebKitCSSMatrix rotateAxisAngle(in double x, in double y, in double z, in double angle);
+        
+        [DontEnum] DOMString toString();
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.cpp b/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.cpp
index e6af840..3b4286e 100644
--- a/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.cpp
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.cpp
@@ -79,6 +79,36 @@ String WebKitCSSTransformValue::cssText() const
         case MatrixTransformOperation:
             result += "matrix(";
             break;
+        case TranslateZTransformOperation:
+            result += "translateZ(";
+            break;
+        case Translate3DTransformOperation:
+            result += "translate3d(";
+            break;
+        case RotateXTransformOperation:
+            result += "rotateX(";
+            break;
+        case RotateYTransformOperation:
+            result += "rotateY(";
+            break;
+        case RotateZTransformOperation:
+            result += "rotateZ(";
+            break;
+        case Rotate3DTransformOperation:
+            result += "rotate3d(";
+            break;
+        case ScaleZTransformOperation:
+            result += "scaleZ(";
+            break;
+        case Scale3DTransformOperation:
+            result += "scale3d(";
+            break;
+        case PerspectiveTransformOperation:
+            result += "perspective(";
+            break;
+        case Matrix3DTransformOperation:
+            result += "matrix3d(";
+            break;
         default:
             break;
     }
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.h b/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.h
index 2bb2631..0c3c038 100644
--- a/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.h
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.h
@@ -47,7 +47,17 @@ public:
         SkewTransformOperation,
         SkewXTransformOperation,
         SkewYTransformOperation,
-        MatrixTransformOperation
+        MatrixTransformOperation,
+        TranslateZTransformOperation,
+        Translate3DTransformOperation,
+        RotateXTransformOperation,
+        RotateYTransformOperation,
+        RotateZTransformOperation,
+        Rotate3DTransformOperation,
+        ScaleZTransformOperation,
+        Scale3DTransformOperation,
+        PerspectiveTransformOperation,
+        Matrix3DTransformOperation
     };
 
     static PassRefPtr<WebKitCSSTransformValue> create(TransformOperationType type)
diff --git a/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.idl b/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.idl
index 39e97a3..14a373f 100644
--- a/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.idl
+++ b/src/3rdparty/webkit/WebCore/css/WebKitCSSTransformValue.idl
@@ -48,6 +48,16 @@ module css {
         const unsigned short CSS_SKEWX       = 9;
         const unsigned short CSS_SKEWY       = 10;
         const unsigned short CSS_MATRIX      = 11;
+        const unsigned short CSS_TRANSLATEZ  = 12;
+        const unsigned short CSS_TRANSLATE3D = 13;
+        const unsigned short CSS_ROTATEX     = 14;
+        const unsigned short CSS_ROTATEY     = 15;
+        const unsigned short CSS_ROTATEZ     = 16;
+        const unsigned short CSS_ROTATE3D    = 17;
+        const unsigned short CSS_SCALEZ      = 18;
+        const unsigned short CSS_SCALE3D     = 19;
+        const unsigned short CSS_PERSPECTIVE = 20;
+        const unsigned short CSS_MATRIX3D    = 21;
 
         readonly attribute unsigned short operationType;
     };
diff --git a/src/3rdparty/webkit/WebCore/css/html4.css b/src/3rdparty/webkit/WebCore/css/html4.css
index 4709a37..dc1f608 100644
--- a/src/3rdparty/webkit/WebCore/css/html4.css
+++ b/src/3rdparty/webkit/WebCore/css/html4.css
@@ -297,7 +297,7 @@ button {
     -webkit-appearance: button;
 }
 
-input, textarea, keygen, select, button, isindex {
+input, textarea, keygen, select, button, isindex, datagrid {
     margin: 0__qem;
     font: -webkit-small-control;
     color: initial;
@@ -359,9 +359,10 @@ textarea {
     -webkit-box-orient: vertical;
     resize: auto;
     cursor: auto;
+    padding: 2px;
 }
 
-input::-webkit-input-placeholder {
+input::-webkit-input-placeholder, isindex::-webkit-input-placeholder {
     color: darkGray;
 }
 
@@ -420,7 +421,9 @@ input[type="range"]::-webkit-slider-thumb {
     -webkit-appearance: sliderthumb-horizontal;
 }
 
-input[type="button"]:disabled, input[type="submit"]:disabled, input[type="reset"]:disabled, input[type="file"]:disabled::-webkit-file-upload-button, button:disabled, select:disabled, keygen:disabled, optgroup:disabled, option:disabled {
+input[type="button"]:disabled, input[type="submit"]:disabled, input[type="reset"]:disabled,
+input[type="file"]:disabled::-webkit-file-upload-button, button:disabled,
+select:disabled, keygen:disabled, optgroup:disabled, option:disabled, datagrid:disabled {
     color: GrayText
 }
 
@@ -486,6 +489,20 @@ option {
     font-weight: normal;
 }
 
+/* datagrid */
+
+datagrid {
+    height: 150px; /* We don't use width:300px in CSS, since we want width:intrinsic and width:min-intrinsic to reset to 300 properly. */
+    -webkit-appearance: datagrid;
+    -webkit-box-sizing: border-box;
+    -webkit-rtl-ordering: logical;
+    color: black;
+    background-color: white;
+    cursor: default;
+    border: 1px inset gray;
+    white-space: initial;
+}
+
 /* inline elements */
 
 u, ins {
@@ -593,4 +610,8 @@ iframe {
     border: 2px inset
 }
 
+img, input[type=image], video, iframe, object, embed, applet {
+    overflow: hidden;   /* Default to overflow:hidden so that border-radius clipping works on the foreground of these elements. */
+}
+
 /* noscript is handled internally, as it depends on settings */
diff --git a/src/3rdparty/webkit/WebCore/css/maketokenizer b/src/3rdparty/webkit/WebCore/css/maketokenizer
index 4f65d17..d14b37a 100644
--- a/src/3rdparty/webkit/WebCore/css/maketokenizer
+++ b/src/3rdparty/webkit/WebCore/css/maketokenizer
@@ -126,3 +126,10 @@ while (<>) {
     print;
     last if /end of yylex/;
 }
+
+# We don't want the remainder of flex's output.
+# However, flex may choke with "flex: error writing output file <stdout>"
+# if its stdout is unexpectedly closed on it.
+# Consume the remaining output.
+while (<>) {
+}
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControls.css b/src/3rdparty/webkit/WebCore/css/mediaControls.css
index 1dbb2c3..668458c 100644
--- a/src/3rdparty/webkit/WebCore/css/mediaControls.css
+++ b/src/3rdparty/webkit/WebCore/css/mediaControls.css
@@ -30,11 +30,16 @@ audio {
 }
 
 audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
+    display: -webkit-box;
+    -webkit-box-orient: horizontal;
+    -webkit-user-select: none;
     position: absolute;
     bottom: 0;
     width: 100%;
-    height: 100%;
-    -webkit-user-select: none;
+    z-index: 0;
+    overflow: hidden;
+    height: 16px;
+    text-align: right;
 }
 
 video:-webkit-full-page-media::-webkit-media-controls-panel {
@@ -43,60 +48,60 @@ video:-webkit-full-page-media::-webkit-media-controls-panel {
 
 audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
     -webkit-appearance: media-mute-button;
-    position: absolute;
-    top: auto;
-    bottom: 0;
-    left: 0;
-    width: 17px;
+    display: -webkit-box;
+    width: 16px;
     height: 16px;
 }
 
 audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
     -webkit-appearance: media-play-button;
-    position: absolute;
-    top: auto;
-    bottom: 0;
-    left: 16px;
-    width: 17px;
+    display: -webkit-box;
+    width: 16px;
+    height: 16px;
+}
+
+audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container {
+    -webkit-appearance: media-timeline-container;
+    display: -webkit-box;
+    -webkit-box-orient: horizontal;
+    -webkit-box-align: center;
+    -webkit-box-pack: end;
+    -webkit-box-flex: 1;
+    -webkit-user-select: none;
     height: 16px;
 }
 
-audio::-webkit-media-controls-time-display, video::-webkit-media-controls-time-display {
+audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
+    display: none;
+}
+
+audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display {
     display: none;
 }
 
 audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
     -webkit-appearance: media-slider;
-    position: absolute;
-    top: auto;
-    bottom: 0;
-    left: 32px;
-    right: 32px;
+    display: -webkit-box;
+    -webkit-box-flex: 1;
     height: 16px;
     padding: 0px 2px;
 }
 
 audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
     -webkit-appearance: media-seek-back-button;
-    position: absolute;
-    top: auto;
-    bottom: 0;
-    right: 16px;
-    width: 17px;
+    display: -webkit-box;
+    width: 16px;
     height: 16px;
 }
 
-
 audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button {
     -webkit-appearance: media-seek-forward-button;
-    position: absolute;
-    top: auto;
-    bottom: 0;
-    right: 0;
-    width: 17px;
+    display: -webkit-box;
+    width: 16px;
     height: 16px;
 }
 
 audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button {
     display: none;
 }
+
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControlsChromium.css b/src/3rdparty/webkit/WebCore/css/mediaControlsChromium.css
new file mode 100644
index 0000000..63eca4b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/mediaControlsChromium.css
@@ -0,0 +1,165 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Google Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+/* Chromium default media controls */
+
+audio {
+    width: 200px;
+    height: 32px;
+}
+
+audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
+    -webkit-user-select: none;
+    position: absolute;
+    bottom: 0;
+    width: 100%;
+    height: 100%;
+    z-index: 0;
+}
+
+video:-webkit-full-page-media::-webkit-media-controls-panel {
+    bottom: -16px;
+}
+
+audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
+    -webkit-appearance: media-mute-button;
+
+    position: absolute;
+    top: auto;
+    bottom: 0;
+    right: 0;
+    left: auto;
+
+    width: 34px;
+    height: 32px;
+
+    background: rgba(123, 0, 0, 0.6);
+}
+
+audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
+    -webkit-appearance: media-play-button;
+
+    position: absolute;
+    top: auto;
+    bottom: 0;
+    left: 0px;
+    right: auto;
+
+    width: 30px;
+    height: 32px;
+
+    background: rgba(0, 221, 0, 0.6);
+}
+
+audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container {
+    -webkit-appearance: media-timeline-container;
+    -webkit-user-select: none;
+
+    position: absolute;
+    top: auto;
+    bottom: 0;
+    left: 30px;
+    right: 34px;
+
+    width: auto;
+    height: 32px;
+
+    background: rgba(0, 0, 0, 0.6);
+}
+
+audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
+    -webkit-appearance: media-current-time-display;
+    -webkit-user-select: none;
+    display: inline-block;
+
+    overflow: hidden;
+    cursor: default;
+
+    position: absolute;
+    line-height: 21px;
+    top: auto;
+    bottom: 6px;
+    left: auto;
+    right: 0px;
+
+    height: 20px;
+    width: 48px;
+
+    text-align: center;
+    font-family: Arial;
+    font-weight: bold;
+    color: white;
+}
+
+audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display {
+    -webkit-appearance: media-time-remaining-display;
+    -webkit-user-select: none;
+    display: none;
+
+    overflow: hidden;
+    cursor: default;
+
+    position: absolute;
+    line-height: 21px;
+    top: auto;
+    bottom: 6px;
+    left: auto;
+    right: 0px;
+
+    height: 20px;
+    width: 48px;
+
+    text-align: center;
+    font-family: Arial;
+    font-weight: bold;
+    color: white;
+}
+
+audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
+    -webkit-appearance: slider-horizontal;
+    position: absolute;
+    top: auto;
+    bottom: 9px;
+    left: 0px;
+    right: 50px;
+    height: 13px;
+
+    background: rgba(0, 0, 0, 0.6);
+}
+
+audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
+    -webkit-appearance: media-seek-back-button;
+    display: none;
+}
+
+audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button {
+    -webkit-appearance: media-seek-forward-button;
+    display: none;
+}
+
+audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button {
+    -webkit-appearance: media-fullscreen-button;
+    display: none;
+}
diff --git a/src/3rdparty/webkit/WebCore/css/mediaControlsQT.css b/src/3rdparty/webkit/WebCore/css/mediaControlsQT.css
new file mode 100644
index 0000000..900dcf2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/mediaControlsQT.css
@@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+/* alternate media controls - Extend mediaControls.css */
+
+audio {
+    width: 200px;
+    height: 25px;
+}
+
+audio::-webkit-media-controls-panel, video::-webkit-media-controls-panel {
+    /* In mediaControls.css */
+    height: 25px;
+}
+
+video:-webkit-full-page-media::-webkit-media-controls-panel {
+    bottom: -25px;
+}
+
+audio::-webkit-media-controls-mute-button, video::-webkit-media-controls-mute-button {
+    -webkit-box-ordinal-group: 2; /* At the end of the controller bar */
+    width: 30px;
+    height: 25px;
+}
+
+audio::-webkit-media-controls-play-button, video::-webkit-media-controls-play-button {
+    width: 30px;
+    height: 25px;
+}
+
+audio::-webkit-media-controls-timeline-container, video::-webkit-media-controls-timeline-container {
+    height: 25px;
+}
+
+audio::-webkit-media-controls-current-time-display, video::-webkit-media-controls-current-time-display {
+    -webkit-appearance: media-current-time-display;
+    -webkit-user-select: none;
+    display: inline-block;
+    cursor: default;
+    font: -webkit-small-control;
+    font-size: .09em;
+    text-align: center;
+    overflow: hidden;
+    line-height: 13px;
+    height: 14px;
+    width: 45px;
+}
+
+audio::-webkit-media-controls-time-remaining-display, video::-webkit-media-controls-time-remaining-display {
+    -webkit-appearance: media-time-remaining-display;
+    -webkit-user-select: none;
+    display: inline-block;
+    cursor: default;
+    font: -webkit-small-control;
+    font-size: .09em;
+    text-align: center;
+    overflow: hidden;
+    line-height: 13px;
+    height: 14px;
+    width: 45px;
+}
+
+audio::-webkit-media-controls-timeline, video::-webkit-media-controls-timeline {
+    height: 13px;
+}
+
+audio::-webkit-media-controls-seek-back-button, video::-webkit-media-controls-seek-back-button {
+    display: none;
+    width: 0px;
+}
+
+audio::-webkit-media-controls-seek-forward-button, video::-webkit-media-controls-seek-forward-button {
+    display: none;
+    width: 0px;
+}
+
+audio::-webkit-media-controls-fullscreen-button, video::-webkit-media-controls-fullscreen-button {
+    display: none;
+}
diff --git a/src/3rdparty/webkit/WebCore/css/themeChromiumLinux.css b/src/3rdparty/webkit/WebCore/css/themeChromiumLinux.css
new file mode 100644
index 0000000..f8210c3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/css/themeChromiumLinux.css
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/* These styles override other user-agent styles for Chromium on Linux. */
+
+select {
+    background-color: #dddddd;
+    border: 0px;
+}
diff --git a/src/3rdparty/webkit/WebCore/css/themeWin.css b/src/3rdparty/webkit/WebCore/css/themeWin.css
index 42962c4..421fed0 100644
--- a/src/3rdparty/webkit/WebCore/css/themeWin.css
+++ b/src/3rdparty/webkit/WebCore/css/themeWin.css
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008, Google Inc. All rights reserved.
+ * Copyright (C) 2008 Google Inc. All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -34,12 +34,14 @@
 
 input:not([type]), 
 input[type="text"],
-input[type="password"],
-input[type="search"] {
-    margin:0;
+input[type="password"] {
     padding:1px 0;
 }
 
+input[type="search"] {
+    padding:1px;
+}
+
 input[type="checkbox"] {
     margin:3px 3px 3px 4px;
 }
@@ -63,17 +65,21 @@ input[type="search"]:disabled {
     background-color: #EBEBE4; 
 }
 
-/* Windows should render input[type="search"] the same as input with no type.
-   This search thing is an Apple-ism to get mac style search inputs. */
-input[type="search"] {
-    -webkit-appearance: textfield;
-    -webkit-box-sizing: content-box;
+input[type="search"]::-webkit-search-cancel-button {
+   margin-right: 3px; 
+}
+
+input[type="search"]::-webkit-search-results-decoration {
+    margin: 0 3px 0 2px;
+}
+
+input[type="search"]::-webkit-search-results-button {
+    margin: 0 3px 0 2px;
 }
 
 input[type="button"], input[type="submit"], input[type="reset"], input[type="file"]::-webkit-file-upload-button, button {
     /* Matches Firefox */
     padding: 0 6px;
-    margin: 0;
 }
 
 /* Windows selects are not rounded. Custom borders for them shouldn't be either. */
@@ -82,13 +88,15 @@ select,
 select[size="0"],
 select[size="1"] {
     -webkit-border-radius: 0;
-    margin: 0;
+}
+
+/* Option font must be inherited because we depend on computing the size of the
+   <select> based on the size of the options, and they must use the same font
+   for that computation to be correct */
+option {
+    font: inherit !important;
 }
 
 textarea {
   font-family: monospace;
-  margin: 1px 0;
-
-  /* Matches IE */
-  padding: 2px;
 }
diff --git a/src/3rdparty/webkit/WebCore/css/themeWinQuirks.css b/src/3rdparty/webkit/WebCore/css/themeWinQuirks.css
index 688eabc..c69b74c 100644
--- a/src/3rdparty/webkit/WebCore/css/themeWinQuirks.css
+++ b/src/3rdparty/webkit/WebCore/css/themeWinQuirks.css
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008, Google Inc. All rights reserved.
+ * Copyright (C) 2008 Google Inc. All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
diff --git a/src/3rdparty/webkit/WebCore/css/view-source.css b/src/3rdparty/webkit/WebCore/css/view-source.css
index 20722ee..f898565 100644
--- a/src/3rdparty/webkit/WebCore/css/view-source.css
+++ b/src/3rdparty/webkit/WebCore/css/view-source.css
@@ -33,8 +33,8 @@ table {
     white-space: pre-wrap !important;
     margin: 0;
     word-break: break-word;
-    font-size: 10px;
-    font-family: Monaco, Lucida Console, monospace;
+    font-size: initial;
+    font-family: monospace;
 }
 
 td {
diff --git a/src/3rdparty/webkit/WebCore/dom/Attr.h b/src/3rdparty/webkit/WebCore/dom/Attr.h
index 9525251..ed4dc07 100644
--- a/src/3rdparty/webkit/WebCore/dom/Attr.h
+++ b/src/3rdparty/webkit/WebCore/dom/Attr.h
@@ -37,7 +37,7 @@ namespace WebCore {
 // destruction. however, this is not yet implemented.
 
 class Attr : public ContainerNode {
-    friend class NamedAttrMap;
+    friend class NamedNodeMap;
 public:
     Attr(Element*, Document*, PassRefPtr<Attribute>);
     ~Attr();
diff --git a/src/3rdparty/webkit/WebCore/dom/Attr.idl b/src/3rdparty/webkit/WebCore/dom/Attr.idl
index 42ac04c..29f4be1 100644
--- a/src/3rdparty/webkit/WebCore/dom/Attr.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Attr.idl
@@ -25,7 +25,7 @@ module core {
         GenerateNativeConverter,
         InterfaceUUID=EEE8E22B-22C3-4e50-95F4-5E0B8AAD8231,
         ImplementationUUID=41B16348-D8E7-4d21-BFDB-125705B7E91F
-    ] Attr : EventTargetNode {
+    ] Attr : Node {
 
         // DOM Level 1
 
@@ -39,7 +39,7 @@ module core {
         readonly attribute Element ownerElement;
         
         // extensions
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute CSSStyleDeclaration style;
 #endif
     };
diff --git a/src/3rdparty/webkit/WebCore/dom/Attribute.h b/src/3rdparty/webkit/WebCore/dom/Attribute.h
index 2b2863f..b06d120 100644
--- a/src/3rdparty/webkit/WebCore/dom/Attribute.h
+++ b/src/3rdparty/webkit/WebCore/dom/Attribute.h
@@ -32,14 +32,14 @@ namespace WebCore {
 class Attr;
 class CSSStyleDeclaration;
 class Element;
-class NamedAttrMap;
+class NamedNodeMap;
 
 // This has no counterpart in DOM.
 // It is an internal representation of the node value of an Attr.
 // The actual Attr with its value as a Text child is allocated only if needed.
 class Attribute : public RefCounted<Attribute> {
     friend class Attr;
-    friend class NamedAttrMap;
+    friend class NamedNodeMap;
 public:
     static PassRefPtr<Attribute> create(const QualifiedName& name, const AtomicString& value)
     {
diff --git a/src/3rdparty/webkit/WebCore/dom/CharacterData.cpp b/src/3rdparty/webkit/WebCore/dom/CharacterData.cpp
index 247a5b6..9a72de9 100644
--- a/src/3rdparty/webkit/WebCore/dom/CharacterData.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/CharacterData.cpp
@@ -23,7 +23,6 @@
 #include "CharacterData.h"
 
 #include "CString.h"
-#include "Document.h"
 #include "EventNames.h"
 #include "ExceptionCode.h"
 #include "MutationEvent.h"
@@ -31,14 +30,14 @@
 
 namespace WebCore {
 
-CharacterData::CharacterData(Document *doc)
-    : EventTargetNode(doc)
+CharacterData::CharacterData(Document *doc, bool isText)
+    : Node(doc, false, false, isText)
     , m_data(StringImpl::empty())
 {
 }
 
-CharacterData::CharacterData(Document* document, const String& text)
-    : EventTargetNode(document)
+CharacterData::CharacterData(Document* document, const String& text, bool isText)
+    : Node(document, false, false, isText)
 {
     m_data = text.impl() ? text.impl() : StringImpl::empty();
 }
@@ -61,7 +60,7 @@ void CharacterData::setData(const String& data, ExceptionCode&)
         detach();
         attach();
     } else if (renderer())
-        static_cast<RenderText*>(renderer())->setText(m_data);
+        toRenderText(renderer())->setText(m_data);
     
     dispatchModifiedEvent(oldStr.get());
     
@@ -89,7 +88,7 @@ void CharacterData::appendData(const String& arg, ExceptionCode&)
         detach();
         attach();
     } else if (renderer())
-        static_cast<RenderText*>(renderer())->setTextWithOffset(m_data, oldStr->length(), 0);
+        toRenderText(renderer())->setTextWithOffset(m_data, oldStr->length(), 0);
     
     dispatchModifiedEvent(oldStr.get());
 }
@@ -110,7 +109,7 @@ void CharacterData::insertData(unsigned offset, const String& arg, ExceptionCode
         detach();
         attach();
     } else if (renderer())
-        static_cast<RenderText*>(renderer())->setTextWithOffset(m_data, offset, 0);
+        toRenderText(renderer())->setTextWithOffset(m_data, offset, 0);
 
     dispatchModifiedEvent(oldStr.get());
     
@@ -139,7 +138,7 @@ void CharacterData::deleteData(unsigned offset, unsigned count, ExceptionCode& e
         detach();
         attach();
     } else if (renderer())
-        static_cast<RenderText*>(renderer())->setTextWithOffset(m_data, offset, count);
+        toRenderText(renderer())->setTextWithOffset(m_data, offset, count);
 
     dispatchModifiedEvent(oldStr.get());
 
@@ -169,7 +168,7 @@ void CharacterData::replaceData(unsigned offset, unsigned count, const String& a
         detach();
         attach();
     } else if (renderer())
-        static_cast<RenderText*>(renderer())->setTextWithOffset(m_data, offset, count);
+        toRenderText(renderer())->setTextWithOffset(m_data, offset, count);
     
     dispatchModifiedEvent(oldStr.get());
     
@@ -199,7 +198,7 @@ void CharacterData::dispatchModifiedEvent(StringImpl* prevValue)
         parentNode()->childrenChanged();
     if (document()->hasListenerType(Document::DOMCHARACTERDATAMODIFIED_LISTENER)) {
         ExceptionCode ec;
-        dispatchEvent(MutationEvent::create(eventNames().DOMCharacterDataModifiedEvent, true, false, 0, prevValue, m_data, String(), 0), ec);
+        dispatchMutationEvent(eventNames().DOMCharacterDataModifiedEvent, true, 0, prevValue, m_data, ec); 
     }
     dispatchSubtreeModifiedEvent();
 }
@@ -225,7 +224,7 @@ bool CharacterData::rendererIsNeeded(RenderStyle *style)
 {
     if (!m_data || !length())
         return false;
-    return EventTargetNode::rendererIsNeeded(style);
+    return Node::rendererIsNeeded(style);
 }
 
 bool CharacterData::offsetInCharacters() const
diff --git a/src/3rdparty/webkit/WebCore/dom/CharacterData.h b/src/3rdparty/webkit/WebCore/dom/CharacterData.h
index 48ddc36..d9e55c0 100644
--- a/src/3rdparty/webkit/WebCore/dom/CharacterData.h
+++ b/src/3rdparty/webkit/WebCore/dom/CharacterData.h
@@ -23,14 +23,14 @@
 #ifndef CharacterData_h
 #define CharacterData_h
 
-#include "EventTargetNode.h"
+#include "Node.h"
 
 namespace WebCore {
 
-class CharacterData : public EventTargetNode {
+class CharacterData : public Node {
 public:
-    CharacterData(Document*, const String& text);
-    CharacterData(Document*);
+    CharacterData(Document*, const String& text, bool isText = false);
+    CharacterData(Document*, bool isText = false);
     virtual ~CharacterData();
 
     // DOM methods & attributes for CharacterData
diff --git a/src/3rdparty/webkit/WebCore/dom/CharacterData.idl b/src/3rdparty/webkit/WebCore/dom/CharacterData.idl
index 74dc483..7c8c7ac 100644
--- a/src/3rdparty/webkit/WebCore/dom/CharacterData.idl
+++ b/src/3rdparty/webkit/WebCore/dom/CharacterData.idl
@@ -23,7 +23,7 @@ module core {
         GenerateConstructor,
         InterfaceUUID=149159F4-D2BA-4040-8137-6BF6424C972A,
         ImplementationUUID=E2095280-B9BD-446a-8C03-79F78417CDFF
-    ] CharacterData : EventTargetNode {
+    ] CharacterData : Node {
 
         attribute [ConvertNullToNullString] DOMString data
             setter raises(DOMException);
diff --git a/src/3rdparty/webkit/WebCore/dom/CheckedRadioButtons.cpp b/src/3rdparty/webkit/WebCore/dom/CheckedRadioButtons.cpp
new file mode 100644
index 0000000..9883f58
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/CheckedRadioButtons.cpp
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "CheckedRadioButtons.h"
+
+#include "HTMLInputElement.h"
+
+namespace WebCore {
+
+void CheckedRadioButtons::addButton(HTMLFormControlElement* element)
+{
+    // We only want to add radio buttons.
+    if (!element->isRadioButton())
+        return;
+
+    // Without a name, there is no group.
+    if (element->name().isEmpty())
+        return;
+
+    HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(element);
+
+    // We only track checked buttons.
+    if (!inputElement->checked())
+        return;
+
+    if (!m_nameToCheckedRadioButtonMap)
+        m_nameToCheckedRadioButtonMap.set(new NameToInputMap);
+
+    pair<NameToInputMap::iterator, bool> result = m_nameToCheckedRadioButtonMap->add(element->name().impl(), inputElement);
+    if (result.second)
+        return;
+    
+    HTMLInputElement* oldCheckedButton = result.first->second;
+    if (oldCheckedButton == inputElement)
+        return;
+
+    result.first->second = inputElement;
+    oldCheckedButton->setChecked(false);
+}
+
+HTMLInputElement* CheckedRadioButtons::checkedButtonForGroup(const AtomicString& name) const
+{
+    if (!m_nameToCheckedRadioButtonMap)
+        return 0;
+    
+    return m_nameToCheckedRadioButtonMap->get(name.impl());
+}
+
+void CheckedRadioButtons::removeButton(HTMLFormControlElement* element)
+{
+    if (element->name().isEmpty() || !m_nameToCheckedRadioButtonMap)
+        return;
+    
+    NameToInputMap::iterator it = m_nameToCheckedRadioButtonMap->find(element->name().impl());
+    if (it == m_nameToCheckedRadioButtonMap->end() || it->second != element)
+        return;
+    
+    InputElement* inputElement = toInputElement(element);
+    ASSERT_UNUSED(inputElement, inputElement);
+    ASSERT(inputElement->isChecked());
+    ASSERT(element->isRadioButton());
+
+    m_nameToCheckedRadioButtonMap->remove(it);
+    if (m_nameToCheckedRadioButtonMap->isEmpty())
+        m_nameToCheckedRadioButtonMap.clear();
+}
+
+} // namespace
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLegend.cpp b/src/3rdparty/webkit/WebCore/dom/CheckedRadioButtons.h
index 1fac53f..5a57955 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLegend.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/CheckedRadioButtons.h
@@ -1,10 +1,5 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- *           (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -23,14 +18,30 @@
  *
  */
 
-#include "config.h"
-#include "RenderLegend.h"
+#ifndef CheckedRadioButtons_h
+#define CheckedRadioButtons_h
+
+#include <wtf/HashMap.h>
+#include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
-RenderLegend::RenderLegend(Node* element)
-    : RenderBlock(element)
-{
-}
+class AtomicString;
+class AtomicStringImpl;
+class HTMLInputElement;
+class HTMLFormControlElement;
+
+class CheckedRadioButtons {
+public:
+    void addButton(HTMLFormControlElement*);
+    void removeButton(HTMLFormControlElement*);
+    HTMLInputElement* checkedButtonForGroup(const AtomicString& groupName) const;
+
+private:
+    typedef HashMap<AtomicStringImpl*, HTMLInputElement*> NameToInputMap;
+    OwnPtr<NameToInputMap> m_nameToCheckedRadioButtonMap;
+};
 
 } // namespace WebCore
+
+#endif // CheckedRadioButtons_h
diff --git a/src/3rdparty/webkit/WebCore/dom/ClassNames.h b/src/3rdparty/webkit/WebCore/dom/ClassNames.h
index 7992d54..8f4852f 100644
--- a/src/3rdparty/webkit/WebCore/dom/ClassNames.h
+++ b/src/3rdparty/webkit/WebCore/dom/ClassNames.h
@@ -56,8 +56,8 @@ namespace WebCore {
 
         typedef Vector<AtomicString, 8> ClassNameVector;
         String m_string;
-        bool m_shouldFoldCase;
         ClassNameVector m_vector;
+        bool m_shouldFoldCase;
         bool m_createdVector;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/dom/DOMStringList.cpp b/src/3rdparty/webkit/WebCore/dom/ClientRect.cpp
index f89702b..c69a2ab 100644
--- a/src/3rdparty/webkit/WebCore/dom/DOMStringList.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ClientRect.cpp
@@ -23,12 +23,18 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  *
  */
+
 #include "config.h"
-#include "DOMStringList.h"
+#include "ClientRect.h"
 
 namespace WebCore {
 
-DOMStringList::~DOMStringList()
+ClientRect::ClientRect()
+{
+}
+
+ClientRect::ClientRect(const IntRect& rect)
+    : m_rect(rect)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/dom/StaticStringList.h b/src/3rdparty/webkit/WebCore/dom/ClientRect.h
index 5b13e87..349ea85 100644
--- a/src/3rdparty/webkit/WebCore/dom/StaticStringList.h
+++ b/src/3rdparty/webkit/WebCore/dom/ClientRect.h
@@ -24,38 +24,36 @@
  *
  */
 
-#ifndef StaticStringList_h
-#define StaticStringList_h
+#ifndef ClientRect_h
+#define ClientRect_h
 
-#include "DOMStringList.h"
+#include "FloatRect.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
-    class StaticStringList : public DOMStringList {
+    class IntRect; 
+
+    class ClientRect : public RefCounted<ClientRect> {
     public:
-        static PassRefPtr<StaticStringList> create(const Vector<String>& strings)
-        {
-            return adoptRef(new StaticStringList(strings));
-        }
-        static PassRefPtr<StaticStringList> adopt(Vector<String>& strings)
-        {
-            StaticStringList* newList = new StaticStringList;
-            newList->m_strings.swap(strings);
-            return adoptRef(newList);
-        }
-        virtual ~StaticStringList();
-
-        virtual unsigned length() const;
-        virtual String item(unsigned) const;
-        virtual bool contains(const String&) const;
+        static PassRefPtr<ClientRect> create() { return adoptRef(new ClientRect); }
+        static PassRefPtr<ClientRect> create(const IntRect& rect) { return adoptRef(new ClientRect(rect)); }
+
+        float top() const { return m_rect.y(); }
+        float right() const { return m_rect.right(); }
+        float bottom() const { return m_rect.bottom(); }
+        float left() const { return m_rect.x(); }
+        float width() const { return m_rect.width(); }
+        float height() const { return m_rect.height(); }
 
     private:
-        StaticStringList(const Vector<String>&);
-        StaticStringList();
+        ClientRect();
+        ClientRect(const IntRect&);
 
-        Vector<String> m_strings;
-    };
+        FloatRect m_rect;
+    }; 
 
 } // namespace WebCore
 
-#endif // StaticStringList
+#endif // ClientRect_h
diff --git a/src/3rdparty/webkit/WebCore/dom/ClientRect.idl b/src/3rdparty/webkit/WebCore/dom/ClientRect.idl
new file mode 100644
index 0000000..6f0598f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/ClientRect.idl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+module view {
+
+    interface [
+        GenerateConstructor
+    ] ClientRect {
+        readonly attribute float top;
+        readonly attribute float right;
+        readonly attribute float bottom;
+        readonly attribute float left;
+        readonly attribute float width;
+        readonly attribute float height;
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/dom/StaticStringList.cpp b/src/3rdparty/webkit/WebCore/dom/ClientRectList.cpp
index a6de92a..95ec758 100644
--- a/src/3rdparty/webkit/WebCore/dom/StaticStringList.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ClientRectList.cpp
@@ -25,43 +25,42 @@
  */
 
 #include "config.h"
-#include "StaticStringList.h"
+#include "ClientRectList.h"
 
-namespace WebCore {
+#include "ExceptionCode.h"
+#include "ClientRect.h"
 
-StaticStringList::StaticStringList(const Vector<String>& strings)
-    : m_strings(strings)
-{
-}
+namespace WebCore {
 
-StaticStringList::StaticStringList()
+ClientRectList::ClientRectList()
 {
 }
 
-StaticStringList::~StaticStringList()
+ClientRectList::ClientRectList(const Vector<FloatQuad>& quads)
 {
+    m_list.reserveInitialCapacity(quads.size());
+    for (size_t i = 0; i < quads.size(); ++i)
+        m_list.append(ClientRect::create(quads[i].enclosingBoundingBox()));
 }
 
-unsigned StaticStringList::length() const
+ClientRectList::~ClientRectList()
 {
-    return m_strings.size();
 }
 
-String StaticStringList::item(unsigned index) const
+unsigned ClientRectList::length() const
 {
-    if (index >= m_strings.size())
-        return "";
-    return m_strings[index];
+    return m_list.size();
 }
 
-bool StaticStringList::contains(const String& str) const
+ClientRect* ClientRectList::item(unsigned index)
 {
-    size_t count = m_strings.size();
-    for (size_t i = 0; i < count; ++i) {
-        if (m_strings[i] == str)
-            return true;
+    if (index >= m_list.size()) {
+        // FIXME: this should throw an exception.
+        // ec = INDEX_SIZE_ERR;
+        return 0;
     }
-    return false;
+
+    return m_list[index].get();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/ClientRectList.h b/src/3rdparty/webkit/WebCore/dom/ClientRectList.h
new file mode 100644
index 0000000..03915b1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/ClientRectList.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#ifndef ClientRectList_h
+#define ClientRectList_h
+
+#include "FloatQuad.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+    class ClientRect;
+
+    class ClientRectList : public RefCounted<ClientRectList> {
+    public:
+        static PassRefPtr<ClientRectList> create() { return adoptRef(new ClientRectList); }
+        static PassRefPtr<ClientRectList> create(const Vector<FloatQuad>& quads) { return adoptRef(new ClientRectList(quads)); }
+        ~ClientRectList();
+
+        unsigned length() const;
+        ClientRect* item(unsigned index);
+
+    private:
+        ClientRectList();
+        ClientRectList(const Vector<FloatQuad>&);
+
+        Vector<RefPtr<ClientRect> > m_list;
+    }; 
+
+} // namespace WebCore
+
+#endif // ClientRectList_h
diff --git a/src/3rdparty/webkit/WebCore/dom/DOMStringList.idl b/src/3rdparty/webkit/WebCore/dom/ClientRectList.idl
index 16d4e12..8230f6c 100644
--- a/src/3rdparty/webkit/WebCore/dom/DOMStringList.idl
+++ b/src/3rdparty/webkit/WebCore/dom/ClientRectList.idl
@@ -24,18 +24,15 @@
  *
  */
 
-module core {
+module view {
 
     interface [
         GenerateConstructor,
-        HasCustomIndexGetter
-    ] DOMStringList {
-
-        // Unlike the index getter, item() never raises exceptions, and returns null for out of bounds indices.
-        [Custom] DOMString item(in unsigned long index);
-
+        HasIndexGetter
+    ] ClientRectList {
         readonly attribute unsigned long length;
-        boolean contains(in DOMString str);
+        ClientRect item(in [IsIndex] unsigned long index);
+        // FIXME: Fix list behavior to allow custom exceptions to be thrown.
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/Clipboard.cpp b/src/3rdparty/webkit/WebCore/dom/Clipboard.cpp
index f7a52ef..6d1bc15 100644
--- a/src/3rdparty/webkit/WebCore/dom/Clipboard.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Clipboard.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "Clipboard.h"
 
+#include "CachedImage.h"
 #include "DOMImplementation.h"
 #include "Frame.h"
 #include "FrameLoader.h"
diff --git a/src/3rdparty/webkit/WebCore/dom/Clipboard.h b/src/3rdparty/webkit/WebCore/dom/Clipboard.h
index 59ae026..0fea604 100644
--- a/src/3rdparty/webkit/WebCore/dom/Clipboard.h
+++ b/src/3rdparty/webkit/WebCore/dom/Clipboard.h
@@ -33,6 +33,8 @@
 
 namespace WebCore {
 
+    class FileList;
+
     // State available during IE's events for drag and drop and copy/paste
     class Clipboard : public RefCounted<Clipboard> {
     public:
@@ -53,11 +55,12 @@ namespace WebCore {
     
         // extensions beyond IE's API
         virtual HashSet<String> types() const = 0;
-    
+        virtual PassRefPtr<FileList> files() const = 0;
+
         IntPoint dragLocation() const { return m_dragLoc; }
         CachedImage* dragImage() const { return m_dragImage.get(); }
         virtual void setDragImage(CachedImage*, const IntPoint&) = 0;
-        Node* dragImageElement() { return m_dragImageElement.get(); }
+        Node* dragImageElement() const { return m_dragImageElement.get(); }
         virtual void setDragImageElement(Node*, const IntPoint&) = 0;
         
         virtual DragImageRef createDragImage(IntPoint& dragLocation) const = 0;
diff --git a/src/3rdparty/webkit/WebCore/dom/Clipboard.idl b/src/3rdparty/webkit/WebCore/dom/Clipboard.idl
index 6fe83f7..dc8677e 100644
--- a/src/3rdparty/webkit/WebCore/dom/Clipboard.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Clipboard.idl
@@ -34,6 +34,7 @@ module core {
                  attribute [ConvertNullStringTo=Undefined] DOMString dropEffect;
                  attribute [ConvertNullStringTo=Undefined] DOMString effectAllowed;
         readonly attribute [CustomGetter] Array types;
+        readonly attribute FileList files;
 
         [Custom] void clearData(in [Optional] DOMString type)
             raises(DOMException);
diff --git a/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp b/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
index 0f46ae6..20cc7a3 100644
--- a/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ContainerNode.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -23,10 +23,9 @@
 #include "config.h"
 #include "ContainerNode.h"
 
+#include "Cache.h"
 #include "ContainerNodeAlgorithms.h"
 #include "DeleteButtonController.h"
-#include "Document.h"
-#include "Editor.h"
 #include "EventNames.h"
 #include "ExceptionCode.h"
 #include "FloatRect.h"
@@ -34,10 +33,11 @@
 #include "FrameView.h"
 #include "InlineTextBox.h"
 #include "MutationEvent.h"
+#include "Page.h"
 #include "RenderTheme.h"
 #include "RootInlineBox.h"
-#include "SystemTime.h"
-#include <wtf/Vector.h>
+#include "loader.h"
+#include <wtf/CurrentTime.h>
 
 namespace WebCore {
 
@@ -45,16 +45,10 @@ static void dispatchChildInsertionEvents(Node*, ExceptionCode&);
 static void dispatchChildRemovalEvents(Node*, ExceptionCode&);
 
 typedef Vector<std::pair<NodeCallback, RefPtr<Node> > > NodeCallbackQueue;
-static NodeCallbackQueue* s_postAttachCallbackQueue = 0;
+static NodeCallbackQueue* s_postAttachCallbackQueue;
 
-static size_t s_attachDepth = 0;
-
-ContainerNode::ContainerNode(Document* doc, bool isElement)
-    : EventTargetNode(doc, isElement, true)
-    , m_firstChild(0)
-    , m_lastChild(0)
-{
-}
+static size_t s_attachDepth;
+static bool s_shouldReEnableMemoryCacheCallsAfterAttach;
 
 void ContainerNode::removeAllChildren()
 {
@@ -101,9 +95,8 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
         return true;
 
     RefPtr<Node> next = refChild;
-    RefPtr<Node> prev = refChild->previousSibling();
+    RefPtr<Node> refChildPreviousSibling = refChild->previousSibling();
 
-    int childCountDelta = 0;
     RefPtr<Node> child = isFragment ? newChild->firstChild() : newChild;
     while (child) {
         RefPtr<Node> nextChild = isFragment ? child->nextSibling() : 0;
@@ -131,8 +124,6 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
         ASSERT(!child->nextSibling());
         ASSERT(!child->previousSibling());
 
-        childCountDelta++;
-
         // Add child before "next".
         forbidEventDispatch();
         Node* prev = next->previousSibling();
@@ -152,6 +143,7 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
         allowEventDispatch();
 
         // Dispatch the mutation events.
+        childrenChanged(false, refChildPreviousSibling.get(), next.get(), 1);
         dispatchChildInsertionEvents(child.get(), ec);
                 
         // Add child to the rendering tree.
@@ -165,9 +157,6 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
         child = nextChild.release();
     }
 
-    document()->setDocumentChanged(true);
-    if (childCountDelta)
-        childrenChanged(false, prev.get(), next.get(), childCountDelta);
     dispatchSubtreeModifiedEvent();
     return true;
 }
@@ -225,7 +214,7 @@ bool ContainerNode::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, Exce
         if (Node* oldParent = child->parentNode())
             oldParent->removeChild(child.get(), ec);
         if (ec)
-            return 0;
+            return false;
 
         // Due to arbitrary code running in response to a DOM mutation event it's
         // possible that "prev" is no longer a child of "this".
@@ -280,7 +269,6 @@ bool ContainerNode::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, Exce
         child = nextChild.release();
     }
 
-    document()->setDocumentChanged(true);
     if (childCountDelta)
         childrenChanged(false, prev.get(), next.get(), childCountDelta);
     dispatchSubtreeModifiedEvent();
@@ -291,7 +279,7 @@ void ContainerNode::willRemove()
 {
     for (Node *n = m_firstChild; n != 0; n = n->nextSibling())
         n->willRemove();
-    EventTargetNode::willRemove();
+    Node::willRemove();
 }
 
 static ExceptionCode willRemoveChild(Node *child)
@@ -374,8 +362,6 @@ bool ContainerNode::removeChild(Node* oldChild, ExceptionCode& ec)
 
     allowEventDispatch();
 
-    document()->setDocumentChanged(true);
-
     // Dispatch post-removal mutation events
     childrenChanged(false, prev, next, -1);
     dispatchSubtreeModifiedEvent();
@@ -395,25 +381,25 @@ bool ContainerNode::removeChildren()
     if (!m_firstChild)
         return false;
 
-    Node* n;
+    // The container node can be removed from event handlers.
+    RefPtr<Node> protect(this);
     
-    // do any prep work needed before actually starting to detach
-    // and remove... e.g. stop loading frames, fire unload events
-    for (n = m_firstChild; n; n = n->nextSibling())
-        willRemoveChild(n);
+    // Do any prep work needed before actually starting to detach
+    // and remove... e.g. stop loading frames, fire unload events.
+    // FIXME: Adding new children from event handlers can cause an infinite loop here.
+    for (RefPtr<Node> n = m_firstChild; n; n = n->nextSibling())
+        willRemoveChild(n.get());
     
     // exclude this node when looking for removed focusedNode since only children will be removed
     document()->removeFocusedNodeOfSubtree(this, true);
 
     forbidEventDispatch();
     int childCountDelta = 0;
-    while ((n = m_firstChild) != 0) {
+    while (RefPtr<Node> n = m_firstChild) {
         childCountDelta--;
 
-        Node *next = n->nextSibling();
+        Node* next = n->nextSibling();
         
-        n->ref();
-
         // Remove the node from the tree before calling detach or removedFromDocument (4427024, 4129744)
         n->setPreviousSibling(0);
         n->setNextSibling(0);
@@ -428,8 +414,6 @@ bool ContainerNode::removeChildren()
         
         if (n->inDocument())
             n->removedFromDocument();
-
-        n->deref();
     }
     allowEventDispatch();
 
@@ -464,7 +448,6 @@ bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bo
         return true;
 
     // Now actually add the child(ren)
-    int childCountDelta = 0;
     RefPtr<Node> prev = lastChild();
     RefPtr<Node> child = isFragment ? newChild->firstChild() : newChild;
     while (child) {
@@ -485,7 +468,6 @@ bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bo
         }
 
         // Append child to the end of the list
-        childCountDelta++;
         forbidEventDispatch();
         child->setParent(this);
         if (m_lastChild) {
@@ -497,6 +479,7 @@ bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bo
         allowEventDispatch();
 
         // Dispatch the mutation events
+        childrenChanged(false, prev.get(), 0, 1);
         dispatchChildInsertionEvents(child.get(), ec);
 
         // Add child to the rendering tree
@@ -510,14 +493,13 @@ bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bo
         child = nextChild.release();
     }
 
-    document()->setDocumentChanged(true);
-    childrenChanged(false, prev.get(), 0, childCountDelta);
     dispatchSubtreeModifiedEvent();
     return true;
 }
 
 ContainerNode* ContainerNode::addChild(PassRefPtr<Node> newChild)
 {
+    ASSERT(newChild);
     // This function is only used during parsing.
     // It does not send any DOM mutation events.
 
@@ -542,13 +524,31 @@ ContainerNode* ContainerNode::addChild(PassRefPtr<Node> newChild)
 
 void ContainerNode::suspendPostAttachCallbacks()
 {
+    if (!s_attachDepth) {
+        ASSERT(!s_shouldReEnableMemoryCacheCallsAfterAttach);
+        if (Page* page = document()->page()) {
+            if (page->areMemoryCacheClientCallsEnabled()) {
+                page->setMemoryCacheClientCallsEnabled(false);
+                s_shouldReEnableMemoryCacheCallsAfterAttach = true;
+            }
+        }
+        cache()->loader()->suspendPendingRequests();
+    }
     ++s_attachDepth;
 }
 
 void ContainerNode::resumePostAttachCallbacks()
 {
-    if (s_attachDepth == 1 && s_postAttachCallbackQueue)
-        dispatchPostAttachCallbacks();
+    if (s_attachDepth == 1) {
+        if (s_postAttachCallbackQueue)
+            dispatchPostAttachCallbacks();
+        if (s_shouldReEnableMemoryCacheCallsAfterAttach) {
+            s_shouldReEnableMemoryCacheCallsAfterAttach = false;
+            if (Page* page = document()->page())
+                page->setMemoryCacheClientCallsEnabled(true);
+        }
+        cache()->loader()->resumePendingRequests();
+    }
     --s_attachDepth;
 }
 
@@ -576,55 +576,50 @@ void ContainerNode::dispatchPostAttachCallbacks()
 
 void ContainerNode::attach()
 {
-    ++s_attachDepth;
-
     for (Node* child = m_firstChild; child; child = child->nextSibling())
         child->attach();
-    EventTargetNode::attach();
-
-    if (s_attachDepth == 1 && s_postAttachCallbackQueue)
-        dispatchPostAttachCallbacks();
-    --s_attachDepth;
+    Node::attach();
 }
 
 void ContainerNode::detach()
 {
     for (Node* child = m_firstChild; child; child = child->nextSibling())
         child->detach();
-    setHasChangedChild(false);
-    EventTargetNode::detach();
+    setChildNeedsStyleRecalc(false);
+    Node::detach();
 }
 
 void ContainerNode::insertedIntoDocument()
 {
-    EventTargetNode::insertedIntoDocument();
-    for (Node *child = m_firstChild; child; child = child->nextSibling())
+    Node::insertedIntoDocument();
+    insertedIntoTree(false);
+    for (Node* child = m_firstChild; child; child = child->nextSibling())
         child->insertedIntoDocument();
 }
 
 void ContainerNode::removedFromDocument()
 {
-    EventTargetNode::removedFromDocument();
-    for (Node *child = m_firstChild; child; child = child->nextSibling())
+    Node::removedFromDocument();
+    setInDocument(false);
+    removedFromTree(false);
+    for (Node* child = m_firstChild; child; child = child->nextSibling())
         child->removedFromDocument();
 }
 
 void ContainerNode::insertedIntoTree(bool deep)
 {
-    EventTargetNode::insertedIntoTree(deep);
-    if (deep) {
-        for (Node *child = m_firstChild; child; child = child->nextSibling())
-            child->insertedIntoTree(deep);
-    }
+    if (!deep)
+        return;
+    for (Node* child = m_firstChild; child; child = child->nextSibling())
+        child->insertedIntoTree(true);
 }
 
 void ContainerNode::removedFromTree(bool deep)
 {
-    EventTargetNode::removedFromTree(deep);
-    if (deep) {
-        for (Node *child = m_firstChild; child; child = child->nextSibling())
-            child->removedFromTree(deep);
-    }
+    if (!deep)
+        return;
+    for (Node* child = m_firstChild; child; child = child->nextSibling())
+        child->removedFromTree(true);
 }
 
 void ContainerNode::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
@@ -680,21 +675,24 @@ bool ContainerNode::getUpperLeftCorner(FloatPoint& point) const
             if (!o)
                 break;
         }
+        ASSERT(o);
 
         if (!o->isInline() || o->isReplaced()) {
             point = o->localToAbsolute();
             return true;
         }
 
-        if (p->element() && p->element() == this && o->isText() && !o->isBR() && !static_cast<RenderText*>(o)->firstTextBox()) {
+        if (p->node() && p->node() == this && o->isText() && !o->isBR() && !toRenderText(o)->firstTextBox()) {
                 // do nothing - skip unrendered whitespace that is a child or next sibling of the anchor
         } else if ((o->isText() && !o->isBR()) || o->isReplaced()) {
             point = o->container()->localToAbsolute();
-            if (o->isText() && static_cast<RenderText *>(o)->firstTextBox()) {
-                point.move(static_cast<RenderText *>(o)->minXPos(),
-                           static_cast<RenderText *>(o)->firstTextBox()->root()->topOverflow());
-            } else
-                point.move(o->xPos(), o->yPos());
+            if (o->isText() && toRenderText(o)->firstTextBox()) {
+                point.move(toRenderText(o)->linesBoundingBox().x(),
+                           toRenderText(o)->firstTextBox()->root()->topOverflow());
+            } else if (o->isBox()) {
+                RenderBox* box = toRenderBox(o);
+                point.move(box->x(), box->y());
+            }
             return true;
         }
     }
@@ -714,12 +712,11 @@ bool ContainerNode::getLowerRightCorner(FloatPoint& point) const
     if (!renderer())
         return false;
 
-    RenderObject *o = renderer();
-    if (!o->isInline() || o->isReplaced())
-    {
+    RenderObject* o = renderer();
+    if (!o->isInline() || o->isReplaced()) {
+        RenderBox* box = toRenderBox(o);
         point = o->localToAbsolute();
-        point.move(o->width(),
-                   o->height() + o->borderTopExtra() + o->borderBottomExtra());
+        point.move(box->width(), box->height());
         return true;
     }
 
@@ -730,8 +727,8 @@ bool ContainerNode::getLowerRightCorner(FloatPoint& point) const
         else if (o->previousSibling())
             o = o->previousSibling();
         else {
-            RenderObject *prev = 0;
-            while(!prev) {
+            RenderObject* prev = 0;
+            while (!prev) {
                 o = o->parent();
                 if (!o)
                     return false;
@@ -739,15 +736,17 @@ bool ContainerNode::getLowerRightCorner(FloatPoint& point) const
             }
             o = prev;
         }
+        ASSERT(o);
         if (o->isText() || o->isReplaced()) {
             point = o->container()->localToAbsolute();
-            int xOffset;
-            if (o->isText())
-                xOffset = static_cast<RenderText *>(o)->minXPos() + o->width();
-            else
-                xOffset = o->xPos() + o->width();
-            
-            point.move(xOffset, o->yPos() + o->height());
+            if (o->isText()) {
+                RenderText* text = toRenderText(o);
+                IntRect linesBox = text->linesBoundingBox();
+                point.move(linesBox.x() + linesBox.width(), linesBox.y() + linesBox.height());
+            } else {
+                RenderBox* box = toRenderBox(o);
+                point.move(box->x() + box->width(), box->y() + box->height());
+            }
             return true;
         }
     }
@@ -762,8 +761,7 @@ IntRect ContainerNode::getRect() const
     
     // If we've found one corner, but not the other,
     // then we should just return a point at the corner that we did find.
-    if (foundUpperLeft != foundLowerRight)
-    {
+    if (foundUpperLeft != foundLowerRight) {
         if (foundUpperLeft)
             lowerRight = upperLeft;
         else
@@ -781,26 +779,26 @@ void ContainerNode::setFocus(bool received)
     if (focused() == received)
         return;
 
-    EventTargetNode::setFocus(received);
+    Node::setFocus(received);
 
     // note that we need to recalc the style
-    setChanged();
+    setNeedsStyleRecalc();
 }
 
 void ContainerNode::setActive(bool down, bool pause)
 {
     if (down == active()) return;
 
-    EventTargetNode::setActive(down);
+    Node::setActive(down);
 
     // note that we need to recalc the style
     // FIXME: Move to Element
     if (renderer()) {
         bool reactsToPress = renderer()->style()->affectedByActiveRules();
         if (reactsToPress)
-            setChanged();
+            setNeedsStyleRecalc();
         if (renderer() && renderer()->style()->hasAppearance()) {
-            if (theme()->stateChanged(renderer(), PressedState))
+            if (renderer()->theme()->stateChanged(renderer(), PressedState))
                 reactsToPress = true;
         }
         if (reactsToPress && pause) {
@@ -813,7 +811,7 @@ void ContainerNode::setActive(bool down, bool pause)
 #endif
 
             // Ensure there are no pending changes
-            Document::updateDocumentsRendering();
+            Document::updateStyleForAllDocuments();
             // Do an immediate repaint.
             if (renderer())
                 renderer()->repaint(true);
@@ -834,15 +832,15 @@ void ContainerNode::setHovered(bool over)
 {
     if (over == hovered()) return;
 
-    EventTargetNode::setHovered(over);
+    Node::setHovered(over);
 
     // note that we need to recalc the style
     // FIXME: Move to Element
     if (renderer()) {
         if (renderer()->style()->affectedByHoverRules())
-            setChanged();
+            setNeedsStyleRecalc();
         if (renderer() && renderer()->style()->hasAppearance())
-            theme()->stateChanged(renderer(), HoverState);
+            renderer()->theme()->stateChanged(renderer(), HoverState);
     }
 }
 
@@ -876,12 +874,11 @@ static void dispatchChildInsertionEvents(Node* child, ExceptionCode& ec)
     else
         c->insertedIntoTree(true);
 
-    if (c->parentNode() && 
-        doc->hasListenerType(Document::DOMNODEINSERTED_LISTENER) &&
-        c->isEventTargetNode()) {
+    doc->incDOMTreeVersion();
+
+    if (c->parentNode() && doc->hasListenerType(Document::DOMNODEINSERTED_LISTENER)) {
         ec = 0;
-        EventTargetNodeCast(c.get())->dispatchEvent(MutationEvent::create(eventNames().DOMNodeInsertedEvent, true, false,
-            c->parentNode(), String(), String(), String(), 0), ec);
+        c->dispatchMutationEvent(eventNames().DOMNodeInsertedEvent, true, c->parentNode(), String(), String(), ec); 
         if (ec)
             return;
     }
@@ -889,12 +886,8 @@ static void dispatchChildInsertionEvents(Node* child, ExceptionCode& ec)
     // dispatch the DOMNodeInsertedIntoDocument event to all descendants
     if (c->inDocument() && doc->hasListenerType(Document::DOMNODEINSERTEDINTODOCUMENT_LISTENER))
         for (; c; c = c->traverseNextNode(child)) {
-            if (!c->isEventTargetNode())
-                continue;
-          
             ec = 0;
-            EventTargetNodeCast(c.get())->dispatchEvent(MutationEvent::create(eventNames().DOMNodeInsertedIntoDocumentEvent, false, false,
-                0, String(), String(), String(), 0), ec);
+            c->dispatchMutationEvent(eventNames().DOMNodeInsertedIntoDocumentEvent, false, 0, String(), String(), ec); 
             if (ec)
                 return;
         }
@@ -908,13 +901,12 @@ static void dispatchChildRemovalEvents(Node* child, ExceptionCode& ec)
     // update auxiliary doc info (e.g. iterators) to note that node is being removed
     doc->nodeWillBeRemoved(child);
 
+    doc->incDOMTreeVersion();
+
     // dispatch pre-removal mutation events
-    if (c->parentNode() && 
-        doc->hasListenerType(Document::DOMNODEREMOVED_LISTENER) &&
-        c->isEventTargetNode()) {
+    if (c->parentNode() && doc->hasListenerType(Document::DOMNODEREMOVED_LISTENER)) {
         ec = 0;
-        EventTargetNodeCast(c.get())->dispatchEvent(MutationEvent::create(eventNames().DOMNodeRemovedEvent, true, false,
-            c->parentNode(), String(), String(), String(), 0), ec);
+        c->dispatchMutationEvent(eventNames().DOMNodeRemovedEvent, true, c->parentNode(), String(), String(), ec); 
         if (ec)
             return;
     }
@@ -922,11 +914,8 @@ static void dispatchChildRemovalEvents(Node* child, ExceptionCode& ec)
     // dispatch the DOMNodeRemovedFromDocument event to all descendants
     if (c->inDocument() && doc->hasListenerType(Document::DOMNODEREMOVEDFROMDOCUMENT_LISTENER))
         for (; c; c = c->traverseNextNode(child)) {
-            if (!c->isEventTargetNode())
-                continue;
             ec = 0;
-            EventTargetNodeCast(c.get())->dispatchEvent(MutationEvent::create(eventNames().DOMNodeRemovedFromDocumentEvent, false, false,
-                0, String(), String(), String(), 0), ec);
+            c->dispatchMutationEvent(eventNames().DOMNodeRemovedFromDocumentEvent, false, 0, String(), String(), ec); 
             if (ec)
                 return;
         }
diff --git a/src/3rdparty/webkit/WebCore/dom/ContainerNode.h b/src/3rdparty/webkit/WebCore/dom/ContainerNode.h
index 91ca49a..3ad932c 100644
--- a/src/3rdparty/webkit/WebCore/dom/ContainerNode.h
+++ b/src/3rdparty/webkit/WebCore/dom/ContainerNode.h
@@ -24,7 +24,7 @@
 #ifndef ContainerNode_h
 #define ContainerNode_h
 
-#include "EventTargetNode.h"
+#include "Node.h"
 #include "FloatPoint.h"
 
 namespace WebCore {
@@ -36,7 +36,7 @@ namespace Private {
     void addChildNodesToDeletionQueue(GenericNode*& head, GenericNode*& tail, GenericNodeContainer* container);
 };
 
-class ContainerNode : public EventTargetNode {
+class ContainerNode : public Node {
 public:
     ContainerNode(Document*, bool isElement = false);
     virtual ~ContainerNode();
@@ -75,8 +75,8 @@ public:
 
 protected:
     static void queuePostAttachCallback(NodeCallback, Node*);
-    static void suspendPostAttachCallbacks();
-    static void resumePostAttachCallbacks();
+    void suspendPostAttachCallbacks();
+    void resumePostAttachCallbacks();
 
     template<class GenericNode, class GenericNodeContainer>
     friend void appendChildToContainer(GenericNode* child, GenericNodeContainer* container);
@@ -96,7 +96,14 @@ private:
     Node* m_firstChild;
     Node* m_lastChild;
 };
-    
+
+inline ContainerNode::ContainerNode(Document* document, bool isElement)
+    : Node(document, isElement, true)
+    , m_firstChild(0)
+    , m_lastChild(0)
+{
+}
+
 inline unsigned Node::containerChildNodeCount() const
 {
     ASSERT(isContainerNode());
diff --git a/src/3rdparty/webkit/WebCore/dom/DOMCoreException.idl b/src/3rdparty/webkit/WebCore/dom/DOMCoreException.idl
index c9ac356..3001995 100644
--- a/src/3rdparty/webkit/WebCore/dom/DOMCoreException.idl
+++ b/src/3rdparty/webkit/WebCore/dom/DOMCoreException.idl
@@ -36,7 +36,7 @@ module core {
         readonly attribute DOMString        name;
         readonly attribute DOMString        message;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // Override in a Mozilla compatible format
         [DontEnum] DOMString toString();
 #endif
@@ -66,6 +66,13 @@ module core {
         const unsigned short      VALIDATION_ERR                 = 16;
         // Introduced in DOM Level 3:
         const unsigned short      TYPE_MISMATCH_ERR              = 17;
+        // Introduced as an XHR extension:
+        const unsigned short      SECURITY_ERR                   = 18;
+        // Introduced in HTML5:
+        const unsigned short      NETWORK_ERR                    = 19;
+        const unsigned short      ABORT_ERR                      = 20;
+        const unsigned short      URL_MISMATCH_ERR               = 21;
+        const unsigned short      QUOTA_EXCEEDED_ERR             = 22;
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp
index 3a60c5b..065f708 100644
--- a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.cpp
@@ -4,7 +4,7 @@
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig (sam@webkit.org)
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,6 +25,7 @@
 #include "config.h"
 #include "DOMImplementation.h"
 
+#include "ContentType.h"
 #include "CSSStyleSheet.h"
 #include "DocumentType.h"
 #include "Element.h"
@@ -75,7 +76,7 @@ static bool isSVG10Feature(const String &feature)
     static bool initialized = false;
     DEFINE_STATIC_LOCAL(FeatureSet, svgFeatures, ());
     if (!initialized) {
-#if ENABLE(SVG_USE) && ENABLE(SVG_FOREIGN_OBJECT) && ENABLE(SVG_FILTER) && ENABLE(SVG_FONTS)
+#if ENABLE(SVG_USE) && ENABLE(SVG_FOREIGN_OBJECT) && ENABLE(FILTERS) && ENABLE(SVG_FONTS)
         addString(svgFeatures, "svg");
         addString(svgFeatures, "svg.static");
 #endif
@@ -83,7 +84,7 @@ static bool isSVG10Feature(const String &feature)
 //      addString(svgFeatures, "svg.dynamic");
 //      addString(svgFeatures, "svg.dom.animation");
 //      addString(svgFeatures, "svg.dom.dynamic");
-#if ENABLE(SVG_USE) && ENABLE(SVG_FOREIGN_OBJECT) && ENABLE(SVG_FILTER) && ENABLE(SVG_FONTS)
+#if ENABLE(SVG_USE) && ENABLE(SVG_FOREIGN_OBJECT) && ENABLE(FILTERS) && ENABLE(SVG_FONTS)
         addString(svgFeatures, "dom");
         addString(svgFeatures, "dom.svg");
         addString(svgFeatures, "dom.svg.static");
@@ -103,7 +104,7 @@ static bool isSVG11Feature(const String &feature)
         // Sadly, we cannot claim to implement any of the SVG 1.1 generic feature sets
         // lack of Font and Filter support.
         // http://bugs.webkit.org/show_bug.cgi?id=15480
-#if ENABLE(SVG_USE) && ENABLE(SVG_FOREIGN_OBJECT) && ENABLE(SVG_FILTER) && ENABLE(SVG_FONTS)
+#if ENABLE(SVG_USE) && ENABLE(SVG_FOREIGN_OBJECT) && ENABLE(FILTERS) && ENABLE(SVG_FONTS)
         addString(svgFeatures, "SVG");
         addString(svgFeatures, "SVGDOM");
         addString(svgFeatures, "SVG-static");
@@ -140,7 +141,7 @@ static bool isSVG11Feature(const String &feature)
         addString(svgFeatures, "Clip");
         addString(svgFeatures, "BasicClip");
         addString(svgFeatures, "Mask");
-#if ENABLE(SVG_FILTER)
+#if ENABLE(FILTERS)
 //      addString(svgFeatures, "Filter");
         addString(svgFeatures, "BasicFilter");
 #endif
@@ -249,9 +250,10 @@ PassRefPtr<Document> DOMImplementation::createDocument(const String& namespaceUR
         doc->addChild(doctype);
 
     if (!qualifiedName.isEmpty()) {
-        doc->addChild(doc->createElementNS(namespaceURI, qualifiedName, ec));
-        if (ec != 0)
+        RefPtr<Node> documentElement = doc->createElementNS(namespaceURI, qualifiedName, ec);
+        if (ec)
             return 0;
+        doc->addChild(documentElement.release());
     }
 
     // Hixie's interpretation of the DOM Core spec suggests we should prefer
@@ -287,8 +289,8 @@ bool DOMImplementation::isXMLMIMEType(const String& mimeType)
 {
     if (mimeType == "text/xml" || mimeType == "application/xml" || mimeType == "text/xsl")
         return true;
-    static const char* validChars = "[0-9a-zA-Z_\\-+~!$\\^{}|.%'`#&*]"; // per RFCs: 3023, 2045
-    DEFINE_STATIC_LOCAL(RegularExpression, xmlTypeRegExp, (String("^") + validChars + "+/" + validChars + "+\\+xml$"));
+    static const char* const validChars = "[0-9a-zA-Z_\\-+~!$\\^{}|.%'`#&*]"; // per RFCs: 3023, 2045
+    DEFINE_STATIC_LOCAL(RegularExpression, xmlTypeRegExp, (String("^") + validChars + "+/" + validChars + "+\\+xml$", TextCaseSensitive));
     return xmlTypeRegExp.match(mimeType) > -1;
 }
 
@@ -312,15 +314,17 @@ PassRefPtr<HTMLDocument> DOMImplementation::createHTMLDocument(const String& tit
 
 PassRefPtr<Document> DOMImplementation::createDocument(const String& type, Frame* frame, bool inViewSourceMode)
 {
-    if (inViewSourceMode) {
-        if (type == "text/html" || type == "application/xhtml+xml" || type == "image/svg+xml" || isTextMIMEType(type) || isXMLMIMEType(type))
-            return HTMLViewSourceDocument::create(frame, type);
-    }
+    if (inViewSourceMode)
+        return HTMLViewSourceDocument::create(frame, type);
 
     // Plugins cannot take HTML and XHTML from us, and we don't even need to initialize the plugin database for those.
     if (type == "text/html")
         return HTMLDocument::create(frame);
-    if (type == "application/xhtml+xml")
+    if (type == "application/xhtml+xml"
+#if ENABLE(XHTMLMP)
+        || type == "application/vnd.wap.xhtml+xml"
+#endif
+        )
         return Document::createXHTML(frame);
 
 #if ENABLE(WML)
@@ -347,7 +351,7 @@ PassRefPtr<Document> DOMImplementation::createDocument(const String& type, Frame
 
 #if ENABLE(VIDEO)
      // Check to see if the type can be played by our MediaPlayer, if so create a MediaDocument
-     if (MediaPlayer::supportsType(type))
+     if (MediaPlayer::supportsType(ContentType(type)))
          return MediaDocument::create(frame);
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.idl b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.idl
index 94d75fb..6f4df80 100644
--- a/src/3rdparty/webkit/WebCore/dom/DOMImplementation.idl
+++ b/src/3rdparty/webkit/WebCore/dom/DOMImplementation.idl
@@ -44,7 +44,7 @@ module core {
 
         // DOMImplementationCSS interface from DOM Level 2 CSS
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         [OldStyleObjC] CSSStyleSheet createCSSStyleSheet(in DOMString title,
                                                          in DOMString media)
             raises(DOMException);
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.cpp b/src/3rdparty/webkit/WebCore/dom/Document.cpp
index a51d1ab..3d01c80 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Document.cpp
@@ -3,9 +3,9 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
- * Copyright (C) 2008 David Levin (levin@chromium.org)
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -26,8 +26,9 @@
 #include "config.h"
 #include "Document.h"
 
-#include "AnimationController.h"
 #include "AXObjectCache.h"
+#include "AnimationController.h"
+#include "Attr.h"
 #include "CDATASection.h"
 #include "CSSHelper.h"
 #include "CSSStyleSelector.h"
@@ -39,7 +40,6 @@
 #include "Console.h"
 #include "CookieJar.h"
 #include "DOMImplementation.h"
-#include "DOMTimer.h"
 #include "DOMWindow.h"
 #include "DocLoader.h"
 #include "DocumentFragment.h"
@@ -61,6 +61,7 @@
 #include "HTMLAnchorElement.h"
 #include "HTMLBodyElement.h"
 #include "HTMLCanvasElement.h"
+#include "HTMLCollection.h"
 #include "HTMLDocument.h"
 #include "HTMLElementFactory.h"
 #include "HTMLFrameOwnerElement.h"
@@ -70,6 +71,7 @@
 #include "HTMLMapElement.h"
 #include "HTMLNameCollection.h"
 #include "HTMLNames.h"
+#include "HTMLParser.h"
 #include "HTMLStyleElement.h"
 #include "HTMLTitleElement.h"
 #include "HTTPParsers.h"
@@ -77,8 +79,11 @@
 #include "HitTestRequest.h"
 #include "HitTestResult.h"
 #include "ImageLoader.h"
+#include "InspectorController.h"
+#include "ScriptEventListener.h"
 #include "KeyboardEvent.h"
 #include "Logging.h"
+#include "MappedAttribute.h"
 #include "MessageEvent.h"
 #include "MouseEvent.h"
 #include "MouseEventWithHitTestResults.h"
@@ -93,22 +98,22 @@
 #include "ProcessingInstruction.h"
 #include "ProgressEvent.h"
 #include "RegisteredEventListener.h"
-#include "RegularExpression.h"
 #include "RenderArena.h"
+#include "RenderTextControl.h"
 #include "RenderView.h"
 #include "RenderWidget.h"
 #include "ScriptController.h"
+#include "ScriptElement.h"
 #include "SecurityOrigin.h"
 #include "SegmentedString.h"
 #include "SelectionController.h"
 #include "Settings.h"
 #include "StyleSheetList.h"
-#include "SystemTime.h"
 #include "TextEvent.h"
 #include "TextIterator.h"
 #include "TextResourceDecoder.h"
-#include "TreeWalker.h"
 #include "Timer.h"
+#include "TreeWalker.h"
 #include "UIEvent.h"
 #include "WebKitAnimationEvent.h"
 #include "WebKitTransitionEvent.h"
@@ -116,12 +121,11 @@
 #include "XMLHttpRequest.h"
 #include "XMLNames.h"
 #include "XMLTokenizer.h"
-#include "JSDOMBinding.h"
-#include "ScriptController.h"
+#include <wtf/CurrentTime.h>
 #include <wtf/HashFunctions.h>
 #include <wtf/MainThread.h>
-#include <wtf/StdLibExtras.h>
 #include <wtf/PassRefPtr.h>
+#include <wtf/StdLibExtras.h>
 
 #if ENABLE(DATABASE)
 #include "Database.h"
@@ -161,6 +165,10 @@
 #include "WMLNames.h"
 #endif
 
+#if ENABLE(XHTMLMP)
+#include "HTMLNoScriptElement.h"
+#endif
+
 using namespace std;
 using namespace WTF;
 using namespace Unicode;
@@ -275,17 +283,29 @@ static bool acceptsEditingFocus(Node *node)
     return frame->editor()->shouldBeginEditing(rangeOfContents(root).get());
 }
 
-static HashSet<Document*>* changedDocuments = 0;
+static bool disableRangeMutation(Page* page)
+{
+#if PLATFORM(MAC)
+    // Disable Range mutation on document modifications in Tiger and Leopard Mail
+    // See <rdar://problem/5865171>
+    return page && (page->settings()->needsLeopardMailQuirks() || page->settings()->needsTigerMailQuirks());
+#else
+    return false;
+#endif
+}
+
+static HashSet<Document*>* documentsThatNeedStyleRecalc = 0;
 
 Document::Document(Frame* frame, bool isXHTML)
     : ContainerNode(0)
     , m_domtree_version(0)
     , m_styleSheets(StyleSheetList::create(this))
+    , m_styleRecalcTimer(this, &Document::styleRecalcTimerFired)
     , m_frameElementsShouldIgnoreScrolling(false)
     , m_title("")
     , m_titleSetExplicitly(false)
-    , m_imageLoadEventTimer(this, &Document::imageLoadEventTimerFired)
     , m_updateFocusAppearanceTimer(this, &Document::updateFocusAppearanceTimerFired)
+    , m_executeScriptSoonTimer(this, &Document::executeScriptSoonTimerFired)
 #if ENABLE(XSLT)
     , m_transformSource(0)
 #endif
@@ -315,9 +335,6 @@ Document::Document(Frame* frame, bool isXHTML)
     , m_hasOpenDatabases(false)
 #endif
     , m_usingGeolocation(false)
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    , m_inLowBandwidthDisplay(false)
-#endif
 {
     m_document.resetSkippingRef(this);
 
@@ -334,7 +351,6 @@ Document::Document(Frame* frame, bool isXHTML)
 
     visuallyOrdered = false;
     m_bParsing = false;
-    m_docChanged = false;
     m_tokenizer = 0;
     m_wellFormed = false;
 
@@ -349,6 +365,7 @@ Document::Document(Frame* frame, bool isXHTML)
     m_usesSiblingRules = false;
     m_usesFirstLineRules = false;
     m_usesFirstLetterRules = false;
+    m_usesBeforeAfterRules = false;
     m_gotoAnchorNeededAfterStylesheetsLoad = false;
  
     m_styleSelector = 0;
@@ -373,6 +390,9 @@ Document::Document(Frame* frame, bool isXHTML)
 
     static int docID = 0;
     m_docID = docID++;
+#if ENABLE(XHTMLMP)
+    m_shouldProcessNoScriptElement = settings() && !settings()->isJavaScriptEnabled();
+#endif
 }
 
 void Document::removedLastRef()
@@ -422,13 +442,17 @@ Document::~Document()
     ASSERT(!m_inPageCache);
     ASSERT(!m_savedRenderer);
     ASSERT(m_ranges.isEmpty());
+    ASSERT(!m_styleRecalcTimer.isActive());
+
+    for (size_t i = 0; i < m_scriptsToExecuteSoon.size(); ++i)
+        m_scriptsToExecuteSoon[i].first->element()->deref(); // Balances ref() in executeScriptSoon().
 
     removeAllEventListeners();
 
+#if USE(JSC)
     forgetAllDOMNodesForDocument(this);
+#endif
 
-    if (m_docChanged && changedDocuments)
-        changedDocuments->remove(this);
     delete m_tokenizer;
     m_document.resetSkippingRef(0);
     delete m_styleSelector;
@@ -513,16 +537,13 @@ void Document::childrenChanged(bool changedByParser, Node* beforeChange, Node* a
     m_documentElement = 0;
 }
 
-Element* Document::documentElement() const
+void Document::cacheDocumentElement() const
 {
-    if (!m_documentElement) {
-        Node* n = firstChild();
-        while (n && !n->isElementNode())
-            n = n->nextSibling();
-        m_documentElement = static_cast<Element*>(n);
-    }
-
-    return m_documentElement.get();
+    ASSERT(!m_documentElement);
+    Node* n = firstChild();
+    while (n && !n->isElementNode())
+        n = n->nextSibling();
+    m_documentElement = static_cast<Element*>(n);
 }
 
 PassRefPtr<Element> Document::createElement(const AtomicString& name, ExceptionCode& ec)
@@ -535,7 +556,7 @@ PassRefPtr<Element> Document::createElement(const AtomicString& name, ExceptionC
     if (m_isXHTML)
         return HTMLElementFactory::createHTMLElement(QualifiedName(nullAtom, name, xhtmlNamespaceURI), this, 0, false);
 
-    return createElement(QualifiedName(nullAtom, name, nullAtom), false, ec);
+    return createElement(QualifiedName(nullAtom, name, nullAtom), false);
 }
 
 PassRefPtr<DocumentFragment> Document::createDocumentFragment()
@@ -629,7 +650,7 @@ PassRefPtr<Node> Document::importNode(Node* importedNode, bool deep, ExceptionCo
             if (ec)
                 return 0;
 
-            NamedAttrMap* attrs = oldElement->attributes(true);
+            NamedNodeMap* attrs = oldElement->attributes(true);
             if (attrs) {
                 unsigned length = attrs->length();
                 for (unsigned i = 0; i < length; i++) {
@@ -752,7 +773,7 @@ bool Document::hasPrefixNamespaceMismatch(const QualifiedName& qName)
 }
 
 // FIXME: This should really be in a possible ElementFactory class
-PassRefPtr<Element> Document::createElement(const QualifiedName& qName, bool createdByParser, ExceptionCode& ec)
+PassRefPtr<Element> Document::createElement(const QualifiedName& qName, bool createdByParser)
 {
     RefPtr<Element> e;
 
@@ -764,25 +785,21 @@ PassRefPtr<Element> Document::createElement(const QualifiedName& qName, bool cre
         e = SVGElementFactory::createSVGElement(qName, this, createdByParser);
 #endif
 #if ENABLE(WML)
-    else if (qName.namespaceURI() == WMLNames::wmlNamespaceURI || isWMLDocument())
+    else if (qName.namespaceURI() == WMLNames::wmlNamespaceURI)
         e = WMLElementFactory::createWMLElement(qName, this, createdByParser);
+    else if (isWMLDocument())
+        e = WMLElementFactory::createWMLElement(QualifiedName(nullAtom, qName.localName(), WMLNames::wmlNamespaceURI), this, createdByParser);
 #endif
     
     if (!e)
         e = new Element(qName, document());
-    
-    // FIXME: The element factories should be fixed to not ignore qName.prefix()
-    // Instead they should pass the entire qName into element creation so we don't
-    // need to manually set the prefix after creation.
-    // Then this code can become ASSERT(qName == e.qname());
-    // and Document::createElement can stop taking ExceptionCode& as well.
-    if (e && !qName.prefix().isNull()) {
-        ec = 0;
-        e->setPrefix(qName.prefix(), ec);
-        if (ec)
-            return 0;
-    }
-    
+
+    // <image> uses imgTag so we need a special rule.
+#if ENABLE(WML)
+    if (!isWMLDocument())
+#endif
+    ASSERT((qName.matches(imageTag) && e->tagQName().matches(imgTag) && e->tagQName().prefix() == qName.prefix()) || qName == e->tagQName());
+
     return e.release();
 }
 
@@ -798,7 +815,7 @@ PassRefPtr<Element> Document::createElementNS(const String& namespaceURI, const
         return 0;
     }
 
-    return createElement(qName, false, ec);
+    return createElement(qName, false);
 }
 
 Element* Document::getElementById(const AtomicString& elementId) const
@@ -841,10 +858,10 @@ String Document::readyState() const
     return String();
 }
 
-String Document::inputEncoding() const
+String Document::encoding() const
 {
     if (TextResourceDecoder* d = decoder())
-        return d->encoding().name();
+        return d->encoding().domName();
     return String();
 }
 
@@ -900,9 +917,13 @@ Element* Document::elementFromPoint(int x, int y) const
     if (!renderer())
         return 0;
 
-    HitTestRequest request(true, true);
-    HitTestResult result(IntPoint(x, y));
-    renderer()->layer()->hitTest(request, result); 
+    HitTestRequest request(HitTestRequest::ReadOnly |
+                           HitTestRequest::Active);
+
+    float zoomFactor = frame() ? frame()->pageZoomFactor() : 1.0f;
+
+    HitTestResult result(roundedIntPoint(FloatPoint(x * zoomFactor, y * zoomFactor)));
+    renderView()->layer()->hitTest(request, result); 
 
     Node* n = result.innerNode();
     while (n && !n->isElementNode())
@@ -979,9 +1000,8 @@ void Document::setTitle(const String& title, Element* titleElement)
             m_titleElement = 0;
         else if (!m_titleElement) {
             if (HTMLElement* headElement = head()) {
+                m_titleElement = createElement(titleTag, false);
                 ExceptionCode ec = 0;
-                m_titleElement = createElement("title", ec);
-                ASSERT(!ec);
                 headElement->appendChild(m_titleElement, ec);
                 ASSERT(!ec);
             }
@@ -1077,42 +1097,56 @@ PassRefPtr<TreeWalker> Document::createTreeWalker(Node *root, unsigned whatToSho
     return TreeWalker::create(root, whatToShow, filter, expandEntityReferences);
 }
 
-void Document::setDocumentChanged(bool b)
+void Document::scheduleStyleRecalc()
 {
-    if (b) {
-        if (!m_docChanged) {
-            if (!changedDocuments)
-                changedDocuments = new HashSet<Document*>;
-            changedDocuments->add(this);
-        }
-        if (m_accessKeyMapValid) {
-            m_accessKeyMapValid = false;
-            m_elementsByAccessKey.clear();
-        }
-    } else {
-        if (m_docChanged && changedDocuments)
-            changedDocuments->remove(this);
+    if (m_styleRecalcTimer.isActive() || inPageCache())
+        return;
+
+    ASSERT(childNeedsStyleRecalc());
+
+    if (!documentsThatNeedStyleRecalc)
+        documentsThatNeedStyleRecalc = new HashSet<Document*>;
+    documentsThatNeedStyleRecalc->add(this);
+    
+    // FIXME: Why on earth is this here? This is clearly misplaced.
+    if (m_accessKeyMapValid) {
+        m_accessKeyMapValid = false;
+        m_elementsByAccessKey.clear();
     }
+    
+    m_styleRecalcTimer.startOneShot(0);
+}
 
-    m_docChanged = b;
+void Document::unscheduleStyleRecalc()
+{
+    ASSERT(!childNeedsStyleRecalc());
+
+    if (documentsThatNeedStyleRecalc)
+        documentsThatNeedStyleRecalc->remove(this);
+
+    m_styleRecalcTimer.stop();
+}
+
+void Document::styleRecalcTimerFired(Timer<Document>*)
+{
+    updateStyleIfNeeded();
 }
 
 void Document::recalcStyle(StyleChange change)
 {
     // we should not enter style recalc while painting
-    if (frame() && frame()->view() && frame()->view()->isPainting()) {
-        ASSERT(!frame()->view()->isPainting());
+    if (view() && view()->isPainting()) {
+        ASSERT(!view()->isPainting());
         return;
     }
     
     if (m_inStyleRecalc)
         return; // Guard against re-entrancy. -dwh
 
-    if (m_frame)
-        m_frame->animation()->beginAnimationUpdate();
-
     m_inStyleRecalc = true;
     suspendPostAttachCallbacks();
+    if (view())
+        view()->pauseScheduledEvents();
     
     ASSERT(!renderer() || renderArena());
     if (!renderer() || !renderArena())
@@ -1151,57 +1185,64 @@ void Document::recalcStyle(StyleChange change)
         StyleChange ch = diff(documentStyle.get(), renderer()->style());
         if (renderer() && ch != NoChange)
             renderer()->setStyle(documentStyle.release());
-        if (change != Force)
-            change = ch;
     }
 
     for (Node* n = firstChild(); n; n = n->nextSibling())
-        if (change >= Inherit || n->hasChangedChild() || n->changed())
+        if (change >= Inherit || n->childNeedsStyleRecalc() || n->needsStyleRecalc())
             n->recalcStyle(change);
 
-    if (changed() && view())
-        view()->layout();
+#if USE(ACCELERATED_COMPOSITING)
+    if (view()) {
+        bool layoutPending = view()->layoutPending() || renderer()->needsLayout();
+        // If we didn't update compositing layers because of layout(), we need to do so here.
+        if (!layoutPending)
+            view()->updateCompositingLayers();
+    }
+#endif
 
 bail_out:
-    setChanged(NoStyleChange);
-    setHasChangedChild(false);
-    setDocumentChanged(false);
-    
+    setNeedsStyleRecalc(NoStyleChange);
+    setChildNeedsStyleRecalc(false);
+    unscheduleStyleRecalc();
+
+    if (view())
+        view()->resumeScheduledEvents();
     resumePostAttachCallbacks();
     m_inStyleRecalc = false;
-    
+
     // If we wanted to call implicitClose() during recalcStyle, do so now that we're finished.
     if (m_closeAfterStyleRecalc) {
         m_closeAfterStyleRecalc = false;
         implicitClose();
     }
-
-    if (m_frame)
-        m_frame->animation()->endAnimationUpdate();
 }
 
-void Document::updateRendering()
+void Document::updateStyleIfNeeded()
 {
-    if (hasChangedChild() && !inPageCache())
-        recalcStyle(NoChange);
+    if (!childNeedsStyleRecalc() || inPageCache())
+        return;
+        
+    if (m_frame)
+        m_frame->animation()->beginAnimationUpdate();
+        
+    recalcStyle(NoChange);
     
-    // Tell the animation controller that the style is available and it can start animations
+    // Tell the animation controller that updateStyleIfNeeded is finished and it can do any post-processing
     if (m_frame)
-        m_frame->animation()->styleAvailable();
+        m_frame->animation()->endAnimationUpdate();
 }
 
-void Document::updateDocumentsRendering()
+void Document::updateStyleForAllDocuments()
 {
-    if (!changedDocuments)
+    if (!documentsThatNeedStyleRecalc)
         return;
 
-    while (changedDocuments->size()) {
-        HashSet<Document*>::iterator it = changedDocuments->begin();
+    while (documentsThatNeedStyleRecalc->size()) {
+        HashSet<Document*>::iterator it = documentsThatNeedStyleRecalc->begin();
         Document* doc = *it;
-        changedDocuments->remove(it);
-        
-        doc->m_docChanged = false;
-        doc->updateRendering();
+        documentsThatNeedStyleRecalc->remove(doc);
+        ASSERT(doc->childNeedsStyleRecalc() && !doc->inPageCache());
+        doc->updateStyleIfNeeded();
     }
 }
 
@@ -1210,8 +1251,7 @@ void Document::updateLayout()
     if (Element* oe = ownerElement())
         oe->document()->updateLayout();
 
-    // FIXME: Dave Hyatt's pretty sure we can remove this because layout calls recalcStyle as needed.
-    updateRendering();
+    updateStyleIfNeeded();
 
     // Only do a layout if changes have occurred that make it necessary.      
     FrameView* v = view();
@@ -1263,6 +1303,9 @@ void Document::attach()
     
     // Create the rendering tree
     setRenderer(new (m_renderArena) RenderView(this, view()));
+#if USE(ACCELERATED_COMPOSITING)
+    renderView()->didMoveOnscreen();
+#endif
 
     if (!m_styleSelector) {
         bool matchAuthorAndUserStyles = true;
@@ -1291,29 +1334,36 @@ void Document::detach()
     
     RenderObject* render = renderer();
 
+    // Send out documentWillBecomeInactive() notifications to registered elements,
+    // in order to stop media elements
+    documentWillBecomeInactive();
+    
+    if (m_frame) {
+        FrameView* view = m_frame->view();
+        if (view)
+            view->detachCustomScrollbars();
+    }
+
     // indicate destruction mode,  i.e. attached() but renderer == 0
     setRenderer(0);
-    
-    // Empty out these lists as a performance optimization, since detaching
-    // all the individual render objects will cause all the RenderImage
-    // objects to remove themselves from the lists.
-    m_imageLoadEventDispatchSoonList.clear();
-    m_imageLoadEventDispatchingList.clear();
-    
+
     m_hoverNode = 0;
     m_focusedNode = 0;
     m_activeNode = 0;
 
     ContainerNode::detach();
 
+    unscheduleStyleRecalc();
+
     if (render)
         render->destroy();
     
     // This is required, as our Frame might delete itself as soon as it detaches
-    // us.  However, this violates Node::detach() symantics, as it's never
-    // possible to re-attach.  Eventually Document::detach() should be renamed
-    // or this call made explicit in each of the callers of Document::detach().
-    clearFramePointer();
+    // us. However, this violates Node::detach() symantics, as it's never
+    // possible to re-attach. Eventually Document::detach() should be renamed,
+    // or this setting of the frame to 0 could be made explicit in each of the
+    // callers of Document::detach().
+    m_frame = 0;
     
     if (m_renderArena) {
         delete m_renderArena;
@@ -1321,23 +1371,13 @@ void Document::detach()
     }
 }
 
-void Document::clearFramePointer()
-{
-    m_frame = 0;
-}
-
-void Document::removeAllEventListenersFromAllNodes()
+void Document::removeAllEventListeners()
 {
-    size_t size = m_windowEventListeners.size();
-    for (size_t i = 0; i < size; ++i)
-        m_windowEventListeners[i]->setRemoved(true);
-    m_windowEventListeners.clear();
+    if (DOMWindow* domWindow = this->domWindow())
+        domWindow->removeAllEventListeners();
     removeAllDisconnectedNodeEventListeners();
-    for (Node *n = this; n; n = n->traverseNextNode()) {
-        if (!n->isEventTargetNode())
-            continue;
-        EventTargetNodeCast(n)->removeAllEventListeners();
-    }
+    for (Node* node = this; node; node = node->traverseNextNode())
+        node->removeAllEventListeners();
 }
 
 void Document::registerDisconnectedNodeWithEventListeners(Node* node)
@@ -1354,10 +1394,15 @@ void Document::removeAllDisconnectedNodeEventListeners()
 {
     HashSet<Node*>::iterator end = m_disconnectedNodesWithEventListeners.end();
     for (HashSet<Node*>::iterator i = m_disconnectedNodesWithEventListeners.begin(); i != end; ++i)
-        EventTargetNodeCast(*i)->removeAllEventListeners();
+        (*i)->removeAllEventListeners();
     m_disconnectedNodesWithEventListeners.clear();
 }
 
+RenderView* Document::renderView() const
+{
+    return toRenderView(renderer());
+}
+
 void Document::clearAXObjectCache()
 {
     // clear cache in top document
@@ -1438,7 +1483,7 @@ void Document::open(Document* ownerDocument)
         if (m_frame->loader()->state() == FrameStateProvisional)
             m_frame->loader()->stopAllLoaders();
     }
-    
+
     implicitOpen();
 
     if (m_frame)
@@ -1465,9 +1510,17 @@ void Document::implicitOpen()
     clear();
     m_tokenizer = createTokenizer();
     setParsing(true);
+
+    if (m_frame)
+        m_tokenizer->setXSSAuditor(m_frame->script()->xssAuditor());
+
+    // If we reload, the animation controller sticks around and has
+    // a stale animation time. We need to update it here.
+    if (m_frame && m_frame->animation())
+        m_frame->animation()->beginAnimationUpdate();
 }
 
-HTMLElement* Document::body()
+HTMLElement* Document::body() const
 {
     Node* de = documentElement();
     if (!de)
@@ -1554,10 +1607,16 @@ void Document::implicitClose()
     // Parser should have picked up all preloads by now
     m_docLoader->clearPreloads();
 
-    // Create a body element if we don't already have one. See Radar 3758785.
+    // Create a head and a body if we don't have those yet (e.g. for about:blank).
     if (!this->body() && isHTMLDocument()) {
         if (Node* documentElement = this->documentElement()) {
             ExceptionCode ec = 0;
+            
+            // The implicit <head> isn't expected in older versions of Mail - <rdar://problem/6863795>
+            if (!head() && shouldCreateImplicitHead(this)) {
+                documentElement->appendChild(new HTMLHeadElement(headTag, this), ec);
+                ASSERT(!ec);
+            }
             documentElement->appendChild(new HTMLBodyElement(bodyTag, this), ec);
             ASSERT(!ec);
         }
@@ -1577,8 +1636,8 @@ void Document::implicitClose()
     if (f)
         f->animation()->resumeAnimations(this);
 
-    dispatchImageLoadEventsNow();
-    this->dispatchWindowEvent(eventNames().loadEvent, false, false);
+    ImageLoader::dispatchPendingLoadEvents();
+    dispatchLoadEvent();
     if (f)
         f->loader()->handledOnloadEvents();
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
@@ -1605,30 +1664,21 @@ void Document::implicitClose()
 
     frame()->loader()->checkCallImplicitClose();
 
-    // Now do our painting/layout, but only if we aren't in a subframe or if we're in a subframe
-    // that has been sized already.  Otherwise, our view size would be incorrect, so doing any 
-    // layout/painting now would be pointless.
+    // We used to force a synchronous display and flush here.  This really isn't
+    // necessary and can in fact be actively harmful if pages are loading at a rate of > 60fps
+    // (if your platform is syncing flushes and limiting them to 60fps).
+    m_overMinimumLayoutThreshold = true;
     if (!ownerElement() || (ownerElement()->renderer() && !ownerElement()->renderer()->needsLayout())) {
-        updateRendering();
+        updateStyleIfNeeded();
         
         // Always do a layout after loading if needed.
         if (view() && renderer() && (!renderer()->firstChild() || renderer()->needsLayout()))
             view()->layout();
-            
-        // Paint immediately after the document is ready.  We do this to ensure that any timers set by the
-        // onload don't have a chance to fire before we would have painted.  To avoid over-flushing we only
-        // worry about this for the top-level document.  For platforms that use native widgets for ScrollViews, this
-        // call does nothing (Mac, wx).
-        // FIXME: This causes a timing issue with the dispatchDidFinishLoad delegate callback on Mac, so think
-        // before enabling it, even if Mac becomes viewless later.
-        // See <rdar://problem/5092361>
-        if (view() && !ownerElement())
-            view()->hostWindow()->paint();
     }
 
 #if PLATFORM(MAC)
     if (f && renderer() && this == topDocument() && AXObjectCache::accessibilityEnabled())
-        axObjectCache()->postNotificationToElement(renderer(), "AXLoadComplete");
+        axObjectCache()->postNotification(renderer(), "AXLoadComplete", true);
 #endif
 
 #if ENABLE(SVG)
@@ -1660,8 +1710,8 @@ bool Document::shouldScheduleLayout()
     //    (a) Only schedule a layout once the stylesheets are loaded.
     //    (b) Only schedule layout once we have a body element.
 
-    return haveStylesheetsLoaded()
-        && body() || (documentElement() && !documentElement()->hasTagName(htmlTag));
+    return (haveStylesheetsLoaded() && body()) ||
+        (documentElement() && !documentElement()->hasTagName(htmlTag));
 }
 
 int Document::minimumLayoutDelay()
@@ -1681,28 +1731,30 @@ int Document::elapsedTime() const
     return static_cast<int>((currentTime() - m_startTime) * 1000);
 }
 
-void Document::write(const String& text, Document* ownerDocument)
+void Document::write(const SegmentedString& text, Document* ownerDocument)
 {
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
     if (!ownerElement())
         printf("Beginning a document.write at %d\n", elapsedTime());
 #endif
-    
-    if (!m_tokenizer) {
+
+    if (!m_tokenizer)
         open(ownerDocument);
-        ASSERT(m_tokenizer);
-        if (!m_tokenizer)
-            return;
-        write("<html>", ownerDocument);
-    }
+
+    ASSERT(m_tokenizer);
     m_tokenizer->write(text, false);
-    
+
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
     if (!ownerElement())
         printf("Ending a document.write at %d\n", elapsedTime());
 #endif    
 }
 
+void Document::write(const String& text, Document* ownerDocument)
+{
+    write(SegmentedString(text), ownerDocument);
+}
+
 void Document::writeln(const String& text, Document* ownerDocument)
 {
     write(text, ownerDocument);
@@ -1731,11 +1783,8 @@ void Document::clear()
     m_tokenizer = 0;
 
     removeChildren();
-
-    size_t size = m_windowEventListeners.size();
-    for (size_t i = 0; i < size; ++i)
-        m_windowEventListeners[i]->setRemoved(true);
-    m_windowEventListeners.clear();
+    if (DOMWindow* domWindow = this->domWindow())
+        domWindow->removeAllEventListeners();
 }
 
 const KURL& Document::virtualURL() const
@@ -1767,7 +1816,15 @@ void Document::setBaseElementURL(const KURL& baseElementURL)
 
 void Document::updateBaseURL()
 {
-    m_baseURL = m_baseElementURL.isEmpty() ? KURL(documentURI()) : m_baseElementURL;
+    // DOM 3 Core: When the Document supports the feature "HTML" [DOM Level 2 HTML], the base URI is computed using
+    // first the value of the href attribute of the HTML BASE element if any, and the value of the documentURI attribute
+    // from the Document interface otherwise.
+    if (m_baseElementURL.isEmpty()) {
+        // The documentURI attribute is an arbitrary string. DOM 3 Core does not specify how it should be resolved,
+        // so we use a null base URL.
+        m_baseURL = KURL(KURL(), documentURI());
+    } else
+        m_baseURL = m_baseElementURL;
     if (!m_baseURL.isValid())
         m_baseURL = KURL();
 
@@ -1777,6 +1834,11 @@ void Document::updateBaseURL()
         m_mappedElementSheet->setHref(m_baseURL.string());
 }
 
+String Document::userAgent(const KURL& url) const
+{
+    return frame() ? frame()->loader()->userAgent(url) : String();
+}
+
 void Document::setCSSStyleSheet(const String& url, const String& charset, const CachedCSSStyleSheet* sheet)
 {
     m_sheet = CSSStyleSheet::create(this, url, charset);
@@ -1953,11 +2015,11 @@ Node *Document::nodeWithAbsIndex(int absIndex)
     return n;
 }
 
-void Document::processHttpEquiv(const String &equiv, const String &content)
+void Document::processHttpEquiv(const String& equiv, const String& content)
 {
     ASSERT(!equiv.isNull() && !content.isNull());
 
-    Frame *frame = this->frame();
+    Frame* frame = this->frame();
 
     if (equalIgnoringCase(equiv, "default-style")) {
         // The preferred style set has been overridden as per section 
@@ -1987,6 +2049,13 @@ void Document::processHttpEquiv(const String &equiv, const String &content)
         setContentLanguage(content);
     else if (equalIgnoringCase(equiv, "x-dns-prefetch-control"))
         parseDNSPrefetchControlHeader(content);
+    else if (equalIgnoringCase(equiv, "x-frame-options")) {
+        FrameLoader* frameLoader = frame->loader();
+        if (frameLoader->shouldInterruptLoadForXFrameOptions(content, url())) {
+            frameLoader->stopAllLoaders();
+            frameLoader->scheduleHTTPRedirection(0, blankURL());
+        }
+    }
 }
 
 MouseEventWithHitTestResults Document::prepareMouseEvent(const HitTestRequest& request, const IntPoint& documentPoint, const PlatformMouseEvent& event)
@@ -1997,10 +2066,10 @@ MouseEventWithHitTestResults Document::prepareMouseEvent(const HitTestRequest& r
         return MouseEventWithHitTestResults(event, HitTestResult(IntPoint()));
 
     HitTestResult result(documentPoint);
-    renderer()->layer()->hitTest(request, result);
+    renderView()->layer()->hitTest(request, result);
 
-    if (!request.readonly)
-        updateRendering();
+    if (!request.readOnly())
+        updateStyleIfNeeded();
 
     return MouseEventWithHitTestResults(event, result);
 }
@@ -2455,21 +2524,23 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
                 
         // Dispatch a change event for text fields or textareas that have been edited
         RenderObject* r = static_cast<RenderObject*>(oldFocusedNode.get()->renderer());
-        if (r && (r->isTextArea() || r->isTextField()) && r->isEdited()) {
-            EventTargetNodeCast(oldFocusedNode.get())->dispatchEventForType(eventNames().changeEvent, true, false);
-            if ((r = static_cast<RenderObject*>(oldFocusedNode.get()->renderer())))
-                r->setEdited(false);
+        if (r && r->isTextControl() && toRenderTextControl(r)->isEdited()) {
+            oldFocusedNode->dispatchEvent(eventNames().changeEvent, true, false);
+            if ((r = static_cast<RenderObject*>(oldFocusedNode.get()->renderer()))) {
+                if (r->isTextControl())
+                    toRenderTextControl(r)->setEdited(false);
+            }
         }
 
         // Dispatch the blur event and let the node do any other blur related activities (important for text fields)
-        EventTargetNodeCast(oldFocusedNode.get())->dispatchBlurEvent();
+        oldFocusedNode->dispatchBlurEvent();
 
         if (m_focusedNode) {
             // handler shifted focus
             focusChangeBlocked = true;
             newFocusedNode = 0;
         }
-        EventTargetNodeCast(oldFocusedNode.get())->dispatchUIEvent(eventNames().DOMFocusOutEvent);
+        oldFocusedNode->dispatchUIEvent(eventNames().DOMFocusOutEvent, 0, 0);
         if (m_focusedNode) {
             // handler shifted focus
             focusChangeBlocked = true;
@@ -2492,14 +2563,14 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
         m_focusedNode = newFocusedNode.get();
 
         // Dispatch the focus event and let the node do any other focus related activities (important for text fields)
-        EventTargetNodeCast(m_focusedNode.get())->dispatchFocusEvent();
+        m_focusedNode->dispatchFocusEvent();
 
         if (m_focusedNode != newFocusedNode) {
             // handler shifted focus
             focusChangeBlocked = true;
             goto SetFocusedNodeDone;
         }
-        EventTargetNodeCast(m_focusedNode.get())->dispatchUIEvent(eventNames().DOMFocusInEvent);
+        m_focusedNode->dispatchUIEvent(eventNames().DOMFocusInEvent, 0, 0);
         if (m_focusedNode != newFocusedNode) { 
             // handler shifted focus
             focusChangeBlocked = true;
@@ -2529,28 +2600,45 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
         }
    }
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) && !PLATFORM(CHROMIUM)
     if (!focusChangeBlocked && m_focusedNode && AXObjectCache::accessibilityEnabled())
         axObjectCache()->handleFocusedUIElementChanged();
+#elif PLATFORM(GTK)
+    if (!focusChangeBlocked && m_focusedNode && AXObjectCache::accessibilityEnabled()) {
+        RenderObject* oldFocusedRenderer = 0;
+        RenderObject* newFocusedRenderer = 0;
+
+        if (oldFocusedNode)
+            oldFocusedRenderer = oldFocusedNode.get()->renderer();
+        if (newFocusedNode)
+            newFocusedRenderer = newFocusedNode.get()->renderer();
+
+        axObjectCache()->handleFocusedUIElementChangedWithRenderers(oldFocusedRenderer, newFocusedRenderer);
+    }
 #endif
 
 SetFocusedNodeDone:
-    updateRendering();
+    updateStyleIfNeeded();
     return !focusChangeBlocked;
-  }
+}
+    
+void Document::getFocusableNodes(Vector<RefPtr<Node> >& nodes)
+{
+    updateLayout();
+
+    for (Node* node = firstChild(); node; node = node->traverseNextNode()) {
+        if (node->isFocusable())
+            nodes.append(node);
+    }
+}
   
-void Document::setCSSTarget(Node* n)
+void Document::setCSSTarget(Element* n)
 {
     if (m_cssTarget)
-        m_cssTarget->setChanged();
+        m_cssTarget->setNeedsStyleRecalc();
     m_cssTarget = n;
     if (n)
-        n->setChanged();
-}
-
-Node* Document::getCSSTarget() const
-{
-    return m_cssTarget;
+        n->setNeedsStyleRecalc();
 }
 
 void Document::attachNodeIterator(NodeIterator *ni)
@@ -2565,7 +2653,7 @@ void Document::detachNodeIterator(NodeIterator *ni)
 
 void Document::nodeChildrenChanged(ContainerNode* container)
 {
-    if (!page() || !page()->settings()->rangeMutationDisabledForOldAppleMail()) {
+    if (!disableRangeMutation(page())) {
         HashSet<Range*>::const_iterator end = m_ranges.end();
         for (HashSet<Range*>::const_iterator it = m_ranges.begin(); it != end; ++it)
             (*it)->nodeChildrenChanged(container);
@@ -2578,7 +2666,7 @@ void Document::nodeWillBeRemoved(Node* n)
     for (HashSet<NodeIterator*>::const_iterator it = m_nodeIterators.begin(); it != nodeIteratorsEnd; ++it)
         (*it)->nodeWillBeRemoved(n);
 
-    if (!page() || !page()->settings()->rangeMutationDisabledForOldAppleMail()) {
+    if (!disableRangeMutation(page())) {
         HashSet<Range*>::const_iterator rangesEnd = m_ranges.end();
         for (HashSet<Range*>::const_iterator it = m_ranges.begin(); it != rangesEnd; ++it)
             (*it)->nodeWillBeRemoved(n);
@@ -2592,7 +2680,7 @@ void Document::nodeWillBeRemoved(Node* n)
 
 void Document::textInserted(Node* text, unsigned offset, unsigned length)
 {
-    if (!page() || !page()->settings()->rangeMutationDisabledForOldAppleMail()) {
+    if (!disableRangeMutation(page())) {
         HashSet<Range*>::const_iterator end = m_ranges.end();
         for (HashSet<Range*>::const_iterator it = m_ranges.begin(); it != end; ++it)
             (*it)->textInserted(text, offset, length);
@@ -2604,7 +2692,7 @@ void Document::textInserted(Node* text, unsigned offset, unsigned length)
 
 void Document::textRemoved(Node* text, unsigned offset, unsigned length)
 {
-    if (!page() || !page()->settings()->rangeMutationDisabledForOldAppleMail()) {
+    if (!disableRangeMutation(page())) {
         HashSet<Range*>::const_iterator end = m_ranges.end();
         for (HashSet<Range*>::const_iterator it = m_ranges.begin(); it != end; ++it)
             (*it)->textRemoved(text, offset, length);
@@ -2617,7 +2705,7 @@ void Document::textRemoved(Node* text, unsigned offset, unsigned length)
 
 void Document::textNodesMerged(Text* oldNode, unsigned offset)
 {
-    if (!page() || !page()->settings()->rangeMutationDisabledForOldAppleMail()) {
+    if (!disableRangeMutation(page())) {
         NodeWithIndex oldNodeWithIndex(oldNode);
         HashSet<Range*>::const_iterator end = m_ranges.end();
         for (HashSet<Range*>::const_iterator it = m_ranges.begin(); it != end; ++it)
@@ -2629,7 +2717,7 @@ void Document::textNodesMerged(Text* oldNode, unsigned offset)
 
 void Document::textNodeSplit(Text* oldNode)
 {
-    if (!page() || !page()->settings()->rangeMutationDisabledForOldAppleMail()) {
+    if (!disableRangeMutation(page())) {
         HashSet<Range*>::const_iterator end = m_ranges.end();
         for (HashSet<Range*>::const_iterator it = m_ranges.begin(); it != end; ++it)
             (*it)->textNodeSplit(oldNode);
@@ -2643,9 +2731,59 @@ DOMWindow* Document::domWindow() const
 {
     if (!frame())
         return 0;
+
+    // The m_frame pointer is not (not always?) zeroed out when the document is put into b/f cache, so the frame can hold an unrelated document/window pair.
+    // FIXME: We should always zero out the frame pointer on navigation to avoid accidentally accessing the new frame content.
+    if (m_frame->document() != this)
+        return 0;
+
     return frame()->domWindow();
 }
 
+void Document::setWindowAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener)
+{
+    DOMWindow* domWindow = this->domWindow();
+    if (!domWindow)
+        return;
+    domWindow->setAttributeEventListener(eventType, listener);
+}
+
+EventListener* Document::getWindowAttributeEventListener(const AtomicString& eventType)
+{
+    DOMWindow* domWindow = this->domWindow();
+    if (!domWindow)
+        return 0;
+    return domWindow->getAttributeEventListener(eventType);
+}
+
+void Document::dispatchWindowEvent(PassRefPtr<Event> event)
+{
+    ASSERT(!eventDispatchForbidden());
+    DOMWindow* domWindow = this->domWindow();
+    if (!domWindow)
+        return;
+    ExceptionCode ec;
+    domWindow->dispatchEvent(event, ec);
+}
+
+void Document::dispatchWindowEvent(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg)
+{
+    ASSERT(!eventDispatchForbidden());
+    DOMWindow* domWindow = this->domWindow();
+    if (!domWindow)
+        return;
+    domWindow->dispatchEvent(eventType, canBubbleArg, cancelableArg);
+}
+
+void Document::dispatchLoadEvent()
+{
+    ASSERT(!eventDispatchForbidden());
+    DOMWindow* domWindow = this->domWindow();
+    if (!domWindow)
+        return;
+    domWindow->dispatchLoadEvent();
+}
+
 PassRefPtr<Event> Document::createEvent(const String& eventType, ExceptionCode& ec)
 {
     if (eventType == "Event" || eventType == "Events" || eventType == "HTMLEvents")
@@ -2719,191 +2857,6 @@ CSSStyleDeclaration* Document::getOverrideStyle(Element*, const String&)
     return 0;
 }
 
-void Document::handleWindowEvent(Event* event, bool useCapture)
-{
-    if (m_windowEventListeners.isEmpty())
-        return;
-        
-    // If any HTML event listeners are registered on the window, dispatch them here.
-    RegisteredEventListenerVector listenersCopy = m_windowEventListeners;
-    size_t size = listenersCopy.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *listenersCopy[i];
-        if (r.eventType() == event->type() && r.useCapture() == useCapture && !r.removed())
-            r.listener()->handleEvent(event, true);
-    }
-}
-
-void Document::setWindowInlineEventListenerForType(const AtomicString& eventType, PassRefPtr<EventListener> listener)
-{
-    // If we already have it we don't want removeWindowEventListener to delete it
-    removeWindowInlineEventListenerForType(eventType);
-    if (listener)
-        addWindowEventListener(eventType, listener, false);
-}
-
-EventListener* Document::windowInlineEventListenerForType(const AtomicString& eventType)
-{
-    size_t size = m_windowEventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *m_windowEventListeners[i];
-        if (r.eventType() == eventType && r.listener()->isInline())
-            return r.listener();
-    }
-    return 0;
-}
-
-void Document::removeWindowInlineEventListenerForType(const AtomicString& eventType)
-{
-    size_t size = m_windowEventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *m_windowEventListeners[i];
-        if (r.eventType() == eventType && r.listener()->isInline()) {
-            if (eventType == eventNames().unloadEvent)
-                removePendingFrameUnloadEventCount();
-            else if (eventType == eventNames().beforeunloadEvent)
-                removePendingFrameBeforeUnloadEventCount();
-            r.setRemoved(true);
-            m_windowEventListeners.remove(i);
-            return;
-        }
-    }
-}
-
-void Document::addWindowEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
-{
-    if (eventType == eventNames().unloadEvent)
-        addPendingFrameUnloadEventCount();
-    else if (eventType == eventNames().beforeunloadEvent)
-        addPendingFrameBeforeUnloadEventCount();
-    // Remove existing identical listener set with identical arguments.
-    // The DOM 2 spec says that "duplicate instances are discarded" in this case.
-    removeWindowEventListener(eventType, listener.get(), useCapture);
-    addListenerTypeIfNeeded(eventType);
-    m_windowEventListeners.append(RegisteredEventListener::create(eventType, listener, useCapture));
-}
-
-void Document::removeWindowEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
-{
-    size_t size = m_windowEventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *m_windowEventListeners[i];
-        if (r.eventType() == eventType && r.listener() == listener && r.useCapture() == useCapture) {
-            if (eventType == eventNames().unloadEvent)
-                removePendingFrameUnloadEventCount();
-            else if (eventType == eventNames().beforeunloadEvent)
-                removePendingFrameBeforeUnloadEventCount();
-            r.setRemoved(true);
-            m_windowEventListeners.remove(i);
-            return;
-        }
-    }
-}
-
-bool Document::hasWindowEventListener(const AtomicString& eventType)
-{
-    size_t size = m_windowEventListeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        if (m_windowEventListeners[i]->eventType() == eventType)
-            return true;
-    }
-    return false;
-}
-
-void Document::addPendingFrameUnloadEventCount() 
-{
-    if (m_frame)
-         m_frame->eventHandler()->addPendingFrameUnloadEventCount();
-}
-
-void Document::removePendingFrameUnloadEventCount() 
-{
-    if (m_frame)
-        m_frame->eventHandler()->removePendingFrameUnloadEventCount();
-}
-
-void Document::addPendingFrameBeforeUnloadEventCount() 
-{
-    if (m_frame)
-         m_frame->eventHandler()->addPendingFrameBeforeUnloadEventCount();
-}
-
-void Document::removePendingFrameBeforeUnloadEventCount() 
-{
-    if (m_frame)
-        m_frame->eventHandler()->removePendingFrameBeforeUnloadEventCount();
-}
-
-PassRefPtr<EventListener> Document::createEventListener(const String& functionName, const String& code, Node* node)
-{
-    Frame* frm = frame();
-    if (!frm || !frm->script()->isEnabled())
-        return 0;
-
-#if ENABLE(SVG)
-    if (node ? node->isSVGElement() : isSVGDocument())
-        return frm->script()->createSVGEventHandler(functionName, code, node);
-#endif
-
-    // We may want to treat compound document event handlers in a different way, in future.
-    return frm->script()->createInlineEventListener(functionName, code, node);
-}
-
-void Document::setWindowInlineEventListenerForTypeAndAttribute(const AtomicString& eventType, Attribute* attr)
-{
-    setWindowInlineEventListenerForType(eventType, createEventListener(attr->localName().string(), attr->value(), 0));
-}
-
-void Document::dispatchImageLoadEventSoon(ImageLoader* image)
-{
-    m_imageLoadEventDispatchSoonList.append(image);
-    if (!m_imageLoadEventTimer.isActive())
-        m_imageLoadEventTimer.startOneShot(0);
-}
-
-void Document::removeImage(ImageLoader* image)
-{
-    // Remove instances of this image from both lists.
-    // Use loops because we allow multiple instances to get into the lists.
-    size_t size = m_imageLoadEventDispatchSoonList.size();
-    for (size_t i = 0; i < size; ++i) {
-        if (m_imageLoadEventDispatchSoonList[i] == image)
-            m_imageLoadEventDispatchSoonList[i] = 0;
-    }
-    size = m_imageLoadEventDispatchingList.size();
-    for (size_t i = 0; i < size; ++i) {
-        if (m_imageLoadEventDispatchingList[i] == image)
-            m_imageLoadEventDispatchingList[i] = 0;
-    }
-    if (m_imageLoadEventDispatchSoonList.isEmpty())
-        m_imageLoadEventTimer.stop();
-}
-
-void Document::dispatchImageLoadEventsNow()
-{
-    // Need to avoid re-entering this function; if new dispatches are
-    // scheduled before the parent finishes processing the list, they
-    // will set a timer and eventually be processed.
-    if (!m_imageLoadEventDispatchingList.isEmpty())
-        return;
-
-    m_imageLoadEventTimer.stop();
-
-    m_imageLoadEventDispatchingList = m_imageLoadEventDispatchSoonList;
-    m_imageLoadEventDispatchSoonList.clear();
-    size_t size = m_imageLoadEventDispatchingList.size();
-    for (size_t i = 0; i < size; ++i) {
-        if (ImageLoader* image = m_imageLoadEventDispatchingList[i])
-            image->dispatchLoadEvent();
-    }
-    m_imageLoadEventDispatchingList.clear();
-}
-
-void Document::imageLoadEventTimerFired(Timer<Document>*)
-{
-    dispatchImageLoadEventsNow();
-}
-
 Element* Document::ownerElement() const
 {
     if (!frame())
@@ -2932,7 +2885,7 @@ void Document::setCookie(const String& value)
     if (cookieURL.isEmpty())
         return;
 
-    setCookies(this, cookieURL, policyBaseURL(), value);
+    setCookies(this, cookieURL, value);
 }
 
 String Document::referrer() const
@@ -3143,13 +3096,6 @@ void Document::setDecoder(PassRefPtr<TextResourceDecoder> decoder)
     m_decoder = decoder;
 }
 
-UChar Document::backslashAsCurrencySymbol() const
-{
-    if (!m_decoder)
-        return '\\';
-    return m_decoder->encoding().backslashAsCurrencySymbol();
-}
-
 KURL Document::completeURL(const String& url) const
 {
     // Always return a null URL when passed a null string.
@@ -3157,14 +3103,10 @@ KURL Document::completeURL(const String& url) const
     // See also [CSS]StyleSheet::completeURL(const String&)
     if (url.isNull())
         return KURL();
+    const KURL& baseURL = ((m_baseURL.isEmpty() || m_baseURL == blankURL()) && parentDocument()) ? parentDocument()->baseURL() : m_baseURL;
     if (!m_decoder)
-        return KURL(m_baseURL, url);
-    return KURL(m_baseURL, url, m_decoder->encoding());
-}
-
-bool Document::inPageCache()
-{
-    return m_inPageCache;
+        return KURL(baseURL, url);
+    return KURL(baseURL, url, m_decoder->encoding());
 }
 
 void Document::setInPageCache(bool flag)
@@ -3178,16 +3120,24 @@ void Document::setInPageCache(bool flag)
         m_savedRenderer = renderer();
         if (FrameView* v = view())
             v->resetScrollbars();
+        unscheduleStyleRecalc();
     } else {
         ASSERT(renderer() == 0 || renderer() == m_savedRenderer);
         ASSERT(m_renderArena);
         setRenderer(m_savedRenderer);
         m_savedRenderer = 0;
+        if (childNeedsStyleRecalc())
+            scheduleStyleRecalc();
     }
 }
 
 void Document::documentWillBecomeInactive() 
 {
+#if USE(ACCELERATED_COMPOSITING)
+    if (renderer())
+        renderView()->willMoveOffscreen();
+#endif
+
     HashSet<Element*>::iterator end = m_documentActivationCallbackElements.end();
     for (HashSet<Element*>::iterator i = m_documentActivationCallbackElements.begin(); i != end; ++i)
         (*i)->documentWillBecomeInactive();
@@ -3198,6 +3148,11 @@ void Document::documentDidBecomeActive()
     HashSet<Element*>::iterator end = m_documentActivationCallbackElements.end();
     for (HashSet<Element*>::iterator i = m_documentActivationCallbackElements.begin(); i != end; ++i)
         (*i)->documentDidBecomeActive();
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (renderer())
+        renderView()->didMoveOnscreen();
+#endif
 }
 
 void Document::registerForDocumentActivationCallbacks(Element* e)
@@ -3289,7 +3244,7 @@ void Document::addMarker(Range *range, DocumentMarker::MarkerType type, String d
     for (TextIterator markedText(range); !markedText.atEnd(); markedText.advance()) {
         RefPtr<Range> textPiece = markedText.range();
         int exception = 0;
-        DocumentMarker marker = {type, textPiece->startOffset(exception), textPiece->endOffset(exception), description};
+        DocumentMarker marker = {type, textPiece->startOffset(exception), textPiece->endOffset(exception), description, false};
         addMarker(textPiece->startContainer(exception), marker);
     }
 }
@@ -3714,6 +3669,53 @@ void Document::shiftMarkers(Node *node, unsigned startOffset, int delta, Documen
         node->renderer()->repaint();
 }
 
+void Document::setMarkersActive(Range* range, bool active)
+{
+    if (m_markers.isEmpty())
+        return;
+
+    ExceptionCode ec = 0;
+    Node* startContainer = range->startContainer(ec);
+    Node* endContainer = range->endContainer(ec);
+
+    Node* pastLastNode = range->pastLastNode();
+    for (Node* node = range->firstNode(); node != pastLastNode; node = node->traverseNextNode()) {
+        int startOffset = node == startContainer ? range->startOffset(ec) : 0;
+        int endOffset = node == endContainer ? range->endOffset(ec) : INT_MAX;
+        setMarkersActive(node, startOffset, endOffset, active);
+    }
+}
+
+void Document::setMarkersActive(Node* node, unsigned startOffset, unsigned endOffset, bool active)
+{
+    MarkerMapVectorPair* vectorPair = m_markers.get(node);
+    if (!vectorPair)
+        return;
+
+    Vector<DocumentMarker>& markers = vectorPair->first;
+    ASSERT(markers.size() == vectorPair->second.size());
+
+    bool docDirty = false;
+    for (size_t i = 0; i != markers.size(); ++i) {
+        DocumentMarker &marker = markers[i];
+
+        // Markers are returned in order, so stop if we are now past the specified range.
+        if (marker.startOffset >= endOffset)
+            break;
+
+        // Skip marker that is wrong type or before target.
+        if (marker.endOffset < startOffset || marker.type != DocumentMarker::TextMatch)
+            continue;
+
+        marker.activeMatch = active;
+        docDirty = true;
+    }
+
+    // repaint the affected node
+    if (docDirty && node->renderer())
+        node->renderer()->repaint();
+}
+
 #if ENABLE(XSLT)
 
 void Document::applyXSLTransform(ProcessingInstruction* pi)
@@ -3780,6 +3782,11 @@ Document *Document::topDocument() const
     return doc;
 }
 
+PassRefPtr<Attr> Document::createAttribute(const String& name, ExceptionCode& ec)
+{
+    return createAttributeNS(String(), name, ec, true);
+}
+
 PassRefPtr<Attr> Document::createAttributeNS(const String& namespaceURI, const String& qualifiedName, ExceptionCode& ec, bool shouldIgnoreNamespaceChecks)
 {
     String prefix, localName;
@@ -3819,75 +3826,75 @@ SVGDocumentExtensions* Document::accessSVGExtensions()
 
 PassRefPtr<HTMLCollection> Document::images()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocImages);
+    return HTMLCollection::create(this, DocImages);
 }
 
 PassRefPtr<HTMLCollection> Document::applets()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocApplets);
+    return HTMLCollection::create(this, DocApplets);
 }
 
 PassRefPtr<HTMLCollection> Document::embeds()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocEmbeds);
+    return HTMLCollection::create(this, DocEmbeds);
 }
 
 PassRefPtr<HTMLCollection> Document::plugins()
 {
     // This is an alias for embeds() required for the JS DOM bindings.
-    return HTMLCollection::create(this, HTMLCollection::DocEmbeds);
+    return HTMLCollection::create(this, DocEmbeds);
 }
 
 PassRefPtr<HTMLCollection> Document::objects()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocObjects);
+    return HTMLCollection::create(this, DocObjects);
 }
 
 PassRefPtr<HTMLCollection> Document::scripts()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocScripts);
+    return HTMLCollection::create(this, DocScripts);
 }
 
 PassRefPtr<HTMLCollection> Document::links()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocLinks);
+    return HTMLCollection::create(this, DocLinks);
 }
 
 PassRefPtr<HTMLCollection> Document::forms()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocForms);
+    return HTMLCollection::create(this, DocForms);
 }
 
 PassRefPtr<HTMLCollection> Document::anchors()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocAnchors);
+    return HTMLCollection::create(this, DocAnchors);
 }
 
 PassRefPtr<HTMLCollection> Document::all()
 {
-    return HTMLCollection::create(this, HTMLCollection::DocAll);
+    return HTMLCollection::create(this, DocAll);
 }
 
 PassRefPtr<HTMLCollection> Document::windowNamedItems(const String &name)
 {
-    return HTMLNameCollection::create(this, HTMLCollection::WindowNamedItems, name);
+    return HTMLNameCollection::create(this, WindowNamedItems, name);
 }
 
 PassRefPtr<HTMLCollection> Document::documentNamedItems(const String &name)
 {
-    return HTMLNameCollection::create(this, HTMLCollection::DocumentNamedItems, name);
+    return HTMLNameCollection::create(this, DocumentNamedItems, name);
 }
 
-HTMLCollection::CollectionInfo* Document::nameCollectionInfo(HTMLCollection::Type type, const AtomicString& name)
+CollectionCache* Document::nameCollectionInfo(CollectionType type, const AtomicString& name)
 {
-    ASSERT(type >= HTMLCollection::FirstNamedDocumentCachedType);
-    unsigned index = type - HTMLCollection::FirstNamedDocumentCachedType;
-    ASSERT(index < HTMLCollection::NumNamedDocumentCachedTypes);
+    ASSERT(type >= FirstNamedDocumentCachedType);
+    unsigned index = type - FirstNamedDocumentCachedType;
+    ASSERT(index < NumNamedDocumentCachedTypes);
 
     NamedCollectionMap& map = m_nameCollectionInfo[index];
     NamedCollectionMap::iterator iter = map.find(name.impl());
     if (iter == map.end())
-        iter = map.add(name.impl(), new HTMLCollection::CollectionInfo).first;
+        iter = map.add(name.impl(), new CollectionCache).first;
     return iter->second;
 }
 
@@ -3905,15 +3912,15 @@ void Document::finishedParsing()
 Vector<String> Document::formElementsState() const
 {
     Vector<String> stateVector;
-    stateVector.reserveCapacity(m_formElementsWithState.size() * 3);
-    typedef ListHashSet<HTMLFormControlElementWithState*>::const_iterator Iterator;
+    stateVector.reserveInitialCapacity(m_formElementsWithState.size() * 3);
+    typedef ListHashSet<Element*>::const_iterator Iterator;
     Iterator end = m_formElementsWithState.end();
     for (Iterator it = m_formElementsWithState.begin(); it != end; ++it) {
-        HTMLFormControlElementWithState* e = *it;
+        Element* e = *it;
         String value;
-        if (e->saveState(value)) {
-            stateVector.append(e->name().string());
-            stateVector.append(e->type().string());
+        if (e->saveFormControlState(value)) {
+            stateVector.append(e->formControlName().string());
+            stateVector.append(e->formControlType().string());
             stateVector.append(value);
         }
     }
@@ -4122,6 +4129,20 @@ void Document::initSecurityContext()
             securityOrigin()->grantLoadLocalResources();
     }
 
+    if (Settings* settings = this->settings()) {
+        if (!settings->isWebSecurityEnabled()) {
+          // Web security is turned off.  We should let this document access every
+          // other document.  This is used primary by testing harnesses for web
+          // sites.
+          securityOrigin()->grantUniversalAccess();
+
+        } else if (settings->allowUniversalAccessFromFileURLs() && securityOrigin()->isLocal()) {
+          // Some clients want file:// URLs to have universal access, but that
+          // setting is dangerous for other clients.
+          securityOrigin()->grantUniversalAccess();
+        }
+    }
+
     if (!securityOrigin()->isEmpty())
         return;
 
@@ -4132,7 +4153,7 @@ void Document::initSecurityContext()
     if (!ownerFrame)
         ownerFrame = m_frame->loader()->opener();
 
-    if (ownerFrame && ownerFrame->document()) {
+    if (ownerFrame) {
         m_cookieURL = ownerFrame->document()->cookieURL();
         // We alias the SecurityOrigins to match Firefox, see Bug 15313
         // https://bugs.webkit.org/show_bug.cgi?id=15313
@@ -4174,6 +4195,34 @@ void Document::updateFocusAppearanceTimerFired(Timer<Document>*)
         element->updateFocusAppearance(false);
 }
 
+void Document::executeScriptSoonTimerFired(Timer<Document>* timer)
+{
+    ASSERT_UNUSED(timer, timer == &m_executeScriptSoonTimer);
+
+    Vector<pair<ScriptElementData*, CachedResourceHandle<CachedScript> > > scripts;
+    scripts.swap(m_scriptsToExecuteSoon);
+    size_t size = scripts.size();
+    for (size_t i = 0; i < size; ++i) {
+        scripts[i].first->execute(scripts[i].second.get());
+        scripts[i].first->element()->deref(); // Balances ref() in executeScriptSoon().
+    }
+}
+
+void Document::executeScriptSoon(ScriptElementData* data, CachedResourceHandle<CachedScript> cachedScript)
+{
+    ASSERT_ARG(data, data);
+
+    Element* element = data->element();
+    ASSERT(element);
+    ASSERT(element->document() == this);
+    ASSERT(element->inDocument());
+
+    m_scriptsToExecuteSoon.append(make_pair(data, cachedScript));
+    element->ref(); // Balanced by deref()s in executeScriptSoonTimerFired() and ~Document().
+    if (!m_executeScriptSoonTimer.isActive())
+        m_executeScriptSoonTimer.startOneShot(0);
+}
+
 // FF method for accessing the selection added for compatability.
 DOMSelection* Document::getSelection() const
 {
@@ -4205,7 +4254,7 @@ DatabaseThread* Document::databaseThread()
     if (!m_databaseThread && !m_hasOpenDatabases) {
         // Create the database thread on first request - but not if at least one database was already opened,
         // because in that case we already had a database thread and terminated it and should not create another.
-        m_databaseThread = DatabaseThread::create(this);
+        m_databaseThread = DatabaseThread::create();
         if (!m_databaseThread->start())
             m_databaseThread = 0;
     }
@@ -4237,6 +4286,14 @@ void Document::resetWMLPageState()
     if (WMLPageState* pageState = wmlPageStateForDocument(this))
         pageState->reset();
 }
+
+void Document::initializeWMLPageState()
+{
+    if (!isWMLDocument())
+        return;
+
+    static_cast<WMLDocument*>(this)->initialize();
+}
 #endif
 
 void Document::attachRange(Range* range)
@@ -4247,7 +4304,8 @@ void Document::attachRange(Range* range)
 
 void Document::detachRange(Range* range)
 {
-    ASSERT(m_ranges.contains(range));
+    // We don't ASSERT m_ranges.contains(range) to allow us to call this
+    // unconditionally to fix: https://bugs.webkit.org/show_bug.cgi?id=26044
     m_ranges.remove(range);
 }
 
@@ -4293,26 +4351,42 @@ void Document::parseDNSPrefetchControlHeader(const String& dnsPrefetchControl)
     m_haveExplicitlyDisabledDNSPrefetch = true;
 }
 
-void Document::addTimeout(int timeoutId, DOMTimer* timer)
+void Document::reportException(const String& errorMessage, int lineNumber, const String& sourceURL)
 {
-    ASSERT(!m_timeouts.contains(timeoutId));
-    m_timeouts.set(timeoutId, timer);
+    if (DOMWindow* window = domWindow())
+        window->console()->addMessage(JSMessageSource, ErrorMessageLevel, errorMessage, lineNumber, sourceURL);
 }
 
-void Document::removeTimeout(int timeoutId)
+void Document::addMessage(MessageDestination destination, MessageSource source, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceURL)
 {
-    m_timeouts.remove(timeoutId);
+    switch (destination) {
+    case InspectorControllerDestination:
+        if (page())
+            page()->inspectorController()->addMessageToConsole(source, level, message, lineNumber, sourceURL);
+        return;
+    case ConsoleDestination:
+        if (DOMWindow* window = domWindow())
+            window->console()->addMessage(source, level, message, lineNumber, sourceURL);
+        return;
+    }
+    ASSERT_NOT_REACHED();
 }
 
-DOMTimer* Document::findTimeout(int timeoutId)
+void Document::resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString)
 {
-    return m_timeouts.get(timeoutId);
+    if (page())
+        page()->inspectorController()->resourceRetrievedByXMLHttpRequest(identifier, sourceString);
+    Frame* frame = this->frame();
+    if (frame) {
+        FrameLoader* frameLoader = frame->loader();
+        frameLoader->didLoadResourceByXMLHttpRequest(identifier, sourceString);
+    }
 }
 
-void Document::reportException(const String& errorMessage, int lineNumber, const String& sourceURL)
+void Document::scriptImported(unsigned long identifier, const String& sourceString)
 {
-    if (DOMWindow* window = domWindow())
-        window->console()->addMessage(JSMessageSource, ErrorMessageLevel, errorMessage, lineNumber, sourceURL);
+    if (page())
+        page()->inspectorController()->scriptImported(identifier, sourceString);
 }
 
 class ScriptExecutionContextTaskTimer : public TimerBase {
@@ -4385,4 +4459,36 @@ Element* Document::findAnchor(const String& name)
     return 0;
 }
 
+String Document::displayStringModifiedByEncoding(const String& str) const
+{
+    if (m_decoder)
+        return m_decoder->encoding().displayString(str.impl());
+    return str;
+}
+
+PassRefPtr<StringImpl> Document::displayStringModifiedByEncoding(PassRefPtr<StringImpl> str) const
+{
+    if (m_decoder)
+        return m_decoder->encoding().displayString(str);
+    return str;
+}
+
+void Document::displayBufferModifiedByEncoding(UChar* buffer, unsigned len) const
+{
+    if (m_decoder)
+        m_decoder->encoding().displayBuffer(buffer, len);
+}
+
+#if ENABLE(XHTMLMP)
+bool Document::isXHTMLMPDocument() const
+{
+    if (!frame() || !frame()->loader())
+        return false;
+    // As per section 7.2 of OMA-WAP-XHTMLMP-V1_1-20061020-A.pdf, a conforming user agent
+    // MUST accept XHTMLMP document identified as "application/vnd.wap.xhtml+xml"
+    // and SHOULD accept it identified as "application/xhtml+xml"
+    return frame()->loader()->responseMIMEType() == "application/vnd.wap.xhtml+xml" || frame()->loader()->responseMIMEType() == "application/xhtml+xml";
+}
+#endif
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.h b/src/3rdparty/webkit/WebCore/dom/Document.h
index 2fdc860..92865f4 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.h
+++ b/src/3rdparty/webkit/WebCore/dom/Document.h
@@ -3,8 +3,8 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2006 Alexey Proskuryakov (ap@webkit.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -26,16 +26,16 @@
 #ifndef Document_h
 #define Document_h
 
-#include "Attr.h"
+#include "CachedResourceHandle.h"
+#include "CheckedRadioButtons.h"
+#include "ContainerNode.h"
+#include "CollectionCache.h"
+#include "CollectionType.h"
 #include "Color.h"
 #include "DocumentMarker.h"
-#include "HTMLCollection.h"
-#include "HTMLFormElement.h"
 #include "ScriptExecutionContext.h"
-#include "StringHash.h"
 #include "Timer.h"
 #include <wtf/HashCountedSet.h>
-#include <wtf/ListHashSet.h>
 
 // FIXME: We should move Mac off of the old Frame-based user stylesheet loading
 // code and onto the new code in Page. We can't do that until the code in Page
@@ -48,11 +48,11 @@
 
 namespace WebCore {
 
-    class AXObjectCache;
     class Attr;
-    class Attribute;
+    class AXObjectCache;
     class CDATASection;
     class CachedCSSStyleSheet;
+    class CachedScript;
     class CanvasRenderingContext2D;
     class CharacterData;
     class CSSStyleDeclaration;
@@ -62,7 +62,6 @@ namespace WebCore {
     class Database;
     class DOMImplementation;
     class DOMSelection;
-    class DOMTimer;
     class DOMWindow;
     class DatabaseThread;
     class DocLoader;
@@ -75,15 +74,15 @@ namespace WebCore {
     class EventListener;
     class Frame;
     class FrameView;
+    class HitTestRequest;
     class HTMLCanvasElement;
+    class HTMLCollection;
     class HTMLDocument;
     class HTMLElement;
-    class HTMLFormControlElementWithState;
     class HTMLFormElement;
     class HTMLHeadElement;
     class HTMLInputElement;
     class HTMLMapElement;
-    class ImageLoader;
     class IntPoint;
     class JSNode;
     class MouseEventWithHitTestResults;
@@ -95,7 +94,10 @@ namespace WebCore {
     class Range;
     class RegisteredEventListener;
     class RenderArena;
+    class RenderView;
+    class ScriptElementData;
     class SecurityOrigin;
+    class SegmentedString;
     class Settings;
     class StyleSheet;
     class StyleSheetList;
@@ -123,7 +125,6 @@ namespace WebCore {
 #if ENABLE(DASHBOARD_SUPPORT)
     struct DashboardRegionValue;
 #endif
-    struct HitTestRequest;
 
     typedef int ExceptionCode;
 
@@ -214,30 +215,39 @@ public:
 
     DOMImplementation* implementation() const;
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
-    Element* documentElement() const;
+    
+    Element* documentElement() const
+    {
+        if (!m_documentElement)
+            cacheDocumentElement();
+        return m_documentElement.get();
+    }
+    
     virtual PassRefPtr<Element> createElement(const AtomicString& tagName, ExceptionCode&);
     PassRefPtr<DocumentFragment> createDocumentFragment ();
     PassRefPtr<Text> createTextNode(const String& data);
     PassRefPtr<Comment> createComment(const String& data);
     PassRefPtr<CDATASection> createCDATASection(const String& data, ExceptionCode&);
     PassRefPtr<ProcessingInstruction> createProcessingInstruction(const String& target, const String& data, ExceptionCode&);
-    PassRefPtr<Attr> createAttribute(const String& name, ExceptionCode& ec) { return createAttributeNS(String(), name, ec, true); }
+    PassRefPtr<Attr> createAttribute(const String& name, ExceptionCode&);
     PassRefPtr<Attr> createAttributeNS(const String& namespaceURI, const String& qualifiedName, ExceptionCode&, bool shouldIgnoreNamespaceChecks = false);
     PassRefPtr<EntityReference> createEntityReference(const String& name, ExceptionCode&);
     PassRefPtr<Node> importNode(Node* importedNode, bool deep, ExceptionCode&);
     virtual PassRefPtr<Element> createElementNS(const String& namespaceURI, const String& qualifiedName, ExceptionCode&);
-    PassRefPtr<Element> createElement(const QualifiedName&, bool createdByParser, ExceptionCode& ec);
+    PassRefPtr<Element> createElement(const QualifiedName&, bool createdByParser);
     Element* getElementById(const AtomicString&) const;
     bool hasElementWithId(AtomicStringImpl* id) const;
     bool containsMultipleElementsWithId(const AtomicString& elementId) { return m_duplicateIds.contains(elementId.impl()); }
 
     Element* elementFromPoint(int x, int y) const;
     String readyState() const;
-    String inputEncoding() const;
-    String defaultCharset() const;
 
-    String charset() const { return inputEncoding(); }
-    String characterSet() const { return inputEncoding(); }
+    String defaultCharset() const;
+    
+    // Synonyms backing similar DOM attributes. Use Document::encoding() to avoid virtual dispatch.
+    String inputEncoding() const { return Document::encoding(); }
+    String charset() const { return Document::encoding(); }
+    String characterSet() const { return Document::encoding(); }
 
     void setCharset(const String&);
 
@@ -279,15 +289,15 @@ public:
     // quirks mode for historical compatibility reasons.
     Element* findAnchor(const String& name);
 
-    HTMLCollection::CollectionInfo* collectionInfo(HTMLCollection::Type type)
+    CollectionCache* collectionInfo(CollectionType type)
     {
-        ASSERT(type >= HTMLCollection::FirstUnnamedDocumentCachedType);
-        unsigned index = type - HTMLCollection::FirstUnnamedDocumentCachedType;
-        ASSERT(index < HTMLCollection::NumUnnamedDocumentCachedTypes);
+        ASSERT(type >= FirstUnnamedDocumentCachedType);
+        unsigned index = type - FirstUnnamedDocumentCachedType;
+        ASSERT(index < NumUnnamedDocumentCachedTypes);
         return &m_collectionInfo[index]; 
     }
 
-    HTMLCollection::CollectionInfo* nameCollectionInfo(HTMLCollection::Type, const AtomicString& name);
+    CollectionCache* nameCollectionInfo(CollectionType, const AtomicString& name);
 
     // DOM methods overridden from  parent classes
 
@@ -299,12 +309,20 @@ public:
     virtual bool isImageDocument() const { return false; }
 #if ENABLE(SVG)
     virtual bool isSVGDocument() const { return false; }
+#else
+    static bool isSVGDocument() { return false; }
 #endif
     virtual bool isPluginDocument() const { return false; }
     virtual bool isMediaDocument() const { return false; }
 #if ENABLE(WML)
     virtual bool isWMLDocument() const { return false; }
 #endif
+#if ENABLE(XHTMLMP)
+    bool isXHTMLMPDocument() const; 
+    bool shouldProcessNoscriptElement() const { return m_shouldProcessNoScriptElement; }
+    void setShouldProcessNoscriptElement(bool shouldDo) { m_shouldProcessNoScriptElement = shouldDo; }
+#endif
+    virtual bool isFrameSet() const { return false; }
     
     CSSStyleSelector* styleSelector() const { return m_styleSelector; }
 
@@ -321,11 +339,7 @@ public:
      */
     bool haveStylesheetsLoaded() const
     {
-        return m_pendingStylesheets <= 0 || m_ignorePendingStylesheets
-#if USE(LOW_BANDWIDTH_DISPLAY)
-            || m_inLowBandwidthDisplay
-#endif
-            ;
+        return m_pendingStylesheets <= 0 || m_ignorePendingStylesheets;
     }
 
     /**
@@ -361,10 +375,12 @@ public:
     void setUsesFirstLineRules(bool b) { m_usesFirstLineRules = b; }
     bool usesFirstLetterRules() const { return m_usesFirstLetterRules; }
     void setUsesFirstLetterRules(bool b) { m_usesFirstLetterRules = b; }
+    bool usesBeforeAfterRules() const { return m_usesBeforeAfterRules; }
+    void setUsesBeforeAfterRules(bool b) { m_usesBeforeAfterRules = b; }
 
     // Machinery for saving and restoring state when you leave and then go back to a page.
-    void registerFormElementWithState(HTMLFormControlElementWithState* e) { m_formElementsWithState.add(e); }
-    void unregisterFormElementWithState(HTMLFormControlElementWithState* e) { m_formElementsWithState.remove(e); }
+    void registerFormElementWithState(Element* e) { m_formElementsWithState.add(e); }
+    void unregisterFormElementWithState(Element* e) { m_formElementsWithState.remove(e); }
     Vector<String> formElementsState() const;
     void setStateForNewFormElements(const Vector<String>&);
     bool hasStateForNewFormElements() const;
@@ -388,19 +404,19 @@ public:
     PassRefPtr<EditingText> createEditingTextNode(const String&);
 
     virtual void recalcStyle( StyleChange = NoChange );
-    virtual void updateRendering();
+    virtual void updateStyleIfNeeded();
     void updateLayout();
     void updateLayoutIgnorePendingStylesheets();
-    static void updateDocumentsRendering();
+    static void updateStyleForAllDocuments(); // FIXME: Try to reduce the # of calls to this function.
     DocLoader* docLoader() { return m_docLoader; }
 
     virtual void attach();
     virtual void detach();
 
-    void clearFramePointer();
-
     RenderArena* renderArena() { return m_renderArena; }
 
+    RenderView* renderView() const;
+
     void clearAXObjectCache();
     AXObjectCache* axObjectCache() const;
     
@@ -413,6 +429,7 @@ public:
     void implicitClose();
     void cancelParsing();
 
+    void write(const SegmentedString& text, Document* ownerDocument = 0);
     void write(const String& text, Document* ownerDocument = 0);
     void writeln(const String& text, Document* ownerDocument = 0);
     void finishParsing();
@@ -433,6 +450,8 @@ public:
 
     KURL completeURL(const String&) const;
 
+    virtual String userAgent(const KURL&) const;
+
     // from cachedObjectClient
     virtual void setCSSStyleSheet(const String& url, const String& charset, const CachedCSSStyleSheet*);
 
@@ -502,6 +521,8 @@ public:
     bool setFocusedNode(PassRefPtr<Node>);
     Node* focusedNode() const { return m_focusedNode.get(); }
 
+    void getFocusableNodes(Vector<RefPtr<Node> >&);
+    
     // The m_ignoreAutofocus flag specifies whether or not the document has been changed by the user enough 
     // for WebCore to ignore the autofocus attribute on any form controls
     bool ignoreAutofocus() const { return m_ignoreAutofocus; };
@@ -519,10 +540,12 @@ public:
     void activeChainNodeDetached(Node*);
 
     // Updates for :target (CSS3 selector).
-    void setCSSTarget(Node*);
-    Node* getCSSTarget() const;
+    void setCSSTarget(Element*);
+    Element* cssTarget() const { return m_cssTarget; }
     
-    void setDocumentChanged(bool);
+    void scheduleStyleRecalc();
+    void unscheduleStyleRecalc();
+    void styleRecalcTimerFired(Timer<Document>*);
 
     void attachNodeIterator(NodeIterator*);
     void detachNodeIterator(NodeIterator*);
@@ -541,6 +564,13 @@ public:
     DOMWindow* defaultView() const { return domWindow(); } 
     DOMWindow* domWindow() const;
 
+    // Helper functions for forwarding DOMWindow event related tasks to the DOMWindow if it exists.
+    void setWindowAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
+    EventListener* getWindowAttributeEventListener(const AtomicString& eventType);
+    void dispatchWindowEvent(PassRefPtr<Event>);
+    void dispatchWindowEvent(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg);
+    void dispatchLoadEvent();
+
     PassRefPtr<Event> createEvent(const String& eventType, ExceptionCode&);
 
     // keep track of what types of event listeners are registered, so we don't
@@ -566,24 +596,6 @@ public:
 
     CSSStyleDeclaration* getOverrideStyle(Element*, const String& pseudoElt);
 
-    void handleWindowEvent(Event*, bool useCapture);
-    void setWindowInlineEventListenerForType(const AtomicString& eventType, PassRefPtr<EventListener>);
-    EventListener* windowInlineEventListenerForType(const AtomicString& eventType);
-    void removeWindowInlineEventListenerForType(const AtomicString& eventType);
-
-    void setWindowInlineEventListenerForTypeAndAttribute(const AtomicString& eventType, Attribute*);
-
-    void addWindowEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-    void removeWindowEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-    bool hasWindowEventListener(const AtomicString& eventType);
-    
-    void addPendingFrameUnloadEventCount();
-    void removePendingFrameUnloadEventCount();
-    void addPendingFrameBeforeUnloadEventCount();
-    void removePendingFrameBeforeUnloadEventCount();
-
-    PassRefPtr<EventListener> createEventListener(const String& functionName, const String& code, Node*);
-
     /**
      * Searches through the document, starting from fromNode, for the next selectable element that comes after fromNode.
      * The order followed is as specified in section 17.11.1 of the HTML4 spec, which is elements with tab indexes
@@ -624,10 +636,6 @@ public:
      */
     void processHttpEquiv(const String& equiv, const String& content);
     
-    void dispatchImageLoadEventSoon(ImageLoader*);
-    void dispatchImageLoadEventsNow();
-    void removeImage(ImageLoader*);
-    
     // Returns the owning element in the parent document.
     // Returns 0 if this is the top level document.
     Element* ownerElement() const;
@@ -648,8 +656,8 @@ public:
 
     const KURL& cookieURL() const { return m_cookieURL; }
 
-    const KURL& policyBaseURL() const { return m_policyBaseURL; }
-    void setPolicyBaseURL(const KURL& url) { m_policyBaseURL = url; }
+    const KURL& firstPartyForCookies() const { return m_firstPartyForCookies; }
+    void setFirstPartyForCookies(const KURL& url) { m_firstPartyForCookies = url; }
     
     // The following implements the rule from HTML 4 for what valid names are.
     // To get this right for all the XML cases, we probably have to improve this or move it
@@ -671,7 +679,7 @@ public:
     void removeImageMap(HTMLMapElement*);
     HTMLMapElement* getImageMap(const String& url) const;
 
-    HTMLElement* body();
+    HTMLElement* body() const;
     void setBody(PassRefPtr<HTMLElement>, ExceptionCode&);
 
     HTMLHeadElement* head();
@@ -694,6 +702,8 @@ public:
     void setRenderedRectForMarker(Node*, DocumentMarker, const IntRect&);
     void invalidateRenderedRectsForMarkersInRect(const IntRect&);
     void shiftMarkers(Node*, unsigned startOffset, int delta, DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
+    void setMarkersActive(Range*, bool);
+    void setMarkersActive(Node*, unsigned startOffset, unsigned endOffset, bool);
 
     DocumentMarker* markerContainingPoint(const IntPoint&, DocumentMarker::MarkerType = DocumentMarker::AllMarkers);
     Vector<DocumentMarker> markersForNode(Node*);
@@ -710,6 +720,8 @@ public:
 
     int docID() const { return m_docID; }
 
+    void executeScriptSoon(ScriptElementData*, CachedResourceHandle<CachedScript>);
+
 #if ENABLE(XSLT)
     void applyXSLTransform(ProcessingInstruction* pi);
     void setTransformSource(void* doc);
@@ -755,13 +767,7 @@ public:
 
     void setUseSecureKeyboardEntryWhenActive(bool);
     bool useSecureKeyboardEntryWhenActive() const;
-    
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    void setDocLoader(DocLoader* loader) { m_docLoader = loader; }
-    bool inLowBandwidthDisplay() const { return m_inLowBandwidthDisplay; }
-    void setLowBandwidthDisplay(bool lowBandWidth) { m_inLowBandwidthDisplay = lowBandWidth; }
-#endif
-    
+
     void addNodeListCache() { ++m_numNodeListCaches; }
     void removeNodeListCache() { ASSERT(m_numNodeListCaches > 0); --m_numNodeListCaches; }
     bool hasNodeListCaches() const { return m_numNodeListCaches; }
@@ -781,12 +787,11 @@ public:
     void parseDNSPrefetchControlHeader(const String&);
 
     virtual void reportException(const String& errorMessage, int lineNumber, const String& sourceURL);
+    virtual void addMessage(MessageDestination, MessageSource, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL);
+    virtual void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
+    virtual void scriptImported(unsigned long, const String&);
     virtual void postTask(PassRefPtr<Task>); // Executes the task on context's thread asynchronously.
 
-    void addTimeout(int timeoutId, DOMTimer*);
-    void removeTimeout(int timeoutId);
-    DOMTimer* findTimeout(int timeoutId);
-    
 protected:
     Document(Frame*, bool isXHTML);
 
@@ -797,6 +802,10 @@ private:
     virtual const KURL& virtualURL() const; // Same as url(), but needed for ScriptExecutionContext to implement it without a performance loss for direct calls.
     virtual KURL virtualCompleteURL(const String&) const; // Same as completeURL() for the same reason as above.
 
+    String encoding() const;
+
+    void executeScriptSoonTimerFired(Timer<Document>*);
+
     CSSStyleSelector* m_styleSelector;
     bool m_didCalculateStyleSelector;
 
@@ -810,7 +819,7 @@ private:
     KURL m_baseURL;  // Node.baseURI: The URL to use when resolving relative URLs.
     KURL m_baseElementURL;  // The URL set by the <base> element.
     KURL m_cookieURL;  // The URL to use for cookie access.
-    KURL m_policyBaseURL;  // The policy URL for third-party cookie blocking.
+    KURL m_firstPartyForCookies; // The policy URL for third-party cookie blocking.
 
     // Document.documentURI:
     // Although URL-like, Document.documentURI can actually be set to any
@@ -872,10 +881,8 @@ private:
     RefPtr<StyleSheetList> m_styleSheets; // All of the stylesheets that are currently in effect for our media type and stylesheet set.
     ListHashSet<Node*> m_styleSheetCandidateNodes; // All of the nodes that could potentially provide stylesheets to the document (<link>, <style>, <?xml-stylesheet>)
 
-    RegisteredEventListenerVector m_windowEventListeners;
-
     typedef HashMap<FormElementKey, Vector<String>, FormElementKeyHash, FormElementKeyHashTraits> FormElementStateMap;
-    ListHashSet<HTMLFormControlElementWithState*> m_formElementsWithState;
+    ListHashSet<Element*> m_formElementsWithState;
     FormElementStateMap m_stateForNewFormElements;
     
     Color m_linkColor;
@@ -888,13 +895,14 @@ private:
     bool m_loadingSheet;
     bool visuallyOrdered;
     bool m_bParsing;
-    bool m_docChanged;
+    Timer<Document> m_styleRecalcTimer;
     bool m_inStyleRecalc;
     bool m_closeAfterStyleRecalc;
     bool m_usesDescendantRules;
     bool m_usesSiblingRules;
     bool m_usesFirstLineRules;
     bool m_usesFirstLetterRules;
+    bool m_usesBeforeAfterRules;
     bool m_gotoAnchorNeededAfterStylesheetsLoad;
     bool m_isDNSPrefetchEnabled;
     bool m_haveExplicitlyDisabledDNSPrefetch;
@@ -912,17 +920,16 @@ private:
 
     mutable AXObjectCache* m_axObjectCache;
     
-    Vector<ImageLoader*> m_imageLoadEventDispatchSoonList;
-    Vector<ImageLoader*> m_imageLoadEventDispatchingList;
-    Timer<Document> m_imageLoadEventTimer;
-
     Timer<Document> m_updateFocusAppearanceTimer;
 
-    Node* m_cssTarget;
+    Element* m_cssTarget;
     
     bool m_processingLoadEvent;
     double m_startTime;
     bool m_overMinimumLayoutThreshold;
+
+    Vector<std::pair<ScriptElementData*, CachedResourceHandle<CachedScript> > > m_scriptsToExecuteSoon;
+    Timer<Document> m_executeScriptSoonTimer;
     
 #if ENABLE(XSLT)
     void* m_transformSource;
@@ -946,8 +953,12 @@ private:
 
     String m_contentLanguage;
 
+#if ENABLE(XHTMLMP)
+    bool m_shouldProcessNoScriptElement;
+#endif
+
 public:
-    bool inPageCache();
+    bool inPageCache() const { return m_inPageCache; }
     void setInPageCache(bool flag);
     
     // Elements can register themselves for the "documentWillBecomeInactive()" and  
@@ -967,7 +978,9 @@ public:
     void setDecoder(PassRefPtr<TextResourceDecoder>);
     TextResourceDecoder* decoder() const { return m_decoder.get(); }
 
-    UChar backslashAsCurrencySymbol() const;
+    String displayStringModifiedByEncoding(const String&) const;
+    PassRefPtr<StringImpl> displayStringModifiedByEncoding(PassRefPtr<StringImpl>) const;
+    void displayBufferModifiedByEncoding(UChar* buffer, unsigned len) const;
 
     // Quirk for the benefit of Apple's Dictionary application.
     void setFrameElementsShouldIgnoreScrolling(bool ignore) { m_frameElementsShouldIgnoreScrolling = ignore; }
@@ -982,12 +995,12 @@ public:
     void setDashboardRegions(const Vector<DashboardRegionValue>&);
 #endif
 
-    void removeAllEventListenersFromAllNodes();
+    void removeAllEventListeners();
 
     void registerDisconnectedNodeWithEventListeners(Node*);
     void unregisterDisconnectedNodeWithEventListeners(Node*);
     
-    HTMLFormElement::CheckedRadioButtons& checkedRadioButtons() { return m_checkedRadioButtons; }
+    CheckedRadioButtons& checkedRadioButtons() { return m_checkedRadioButtons; }
     
 #if ENABLE(SVG)
     const SVGDocumentExtensions* svgExtensions();
@@ -1017,6 +1030,7 @@ public:
 
 #if ENABLE(WML)
     void resetWMLPageState();
+    void initializeWMLPageState();
 #endif
 
 protected:
@@ -1025,10 +1039,11 @@ protected:
 private:
     void updateTitle();
     void removeAllDisconnectedNodeEventListeners();
-    void imageLoadEventTimerFired(Timer<Document>*);
     void updateFocusAppearanceTimerFired(Timer<Document>*);
     void updateBaseURL();
 
+    void cacheDocumentElement() const;
+
     RenderObject* m_savedRenderer;
     int m_secureForms;
     
@@ -1046,11 +1061,11 @@ private:
     
     int m_selfOnlyRefCount;
 
-    HTMLFormElement::CheckedRadioButtons m_checkedRadioButtons;
+    CheckedRadioButtons m_checkedRadioButtons;
 
-    typedef HashMap<AtomicStringImpl*, HTMLCollection::CollectionInfo*> NamedCollectionMap;
-    HTMLCollection::CollectionInfo m_collectionInfo[HTMLCollection::NumUnnamedDocumentCachedTypes];
-    NamedCollectionMap m_nameCollectionInfo[HTMLCollection::NumNamedDocumentCachedTypes];
+    typedef HashMap<AtomicStringImpl*, CollectionCache*> NamedCollectionMap;
+    CollectionCache m_collectionInfo[NumUnnamedDocumentCachedTypes];
+    NamedCollectionMap m_nameCollectionInfo[NumNamedDocumentCachedTypes];
 
 #if ENABLE(XPATH)
     RefPtr<XPathEvaluator> m_xpathEvaluator;
@@ -1096,13 +1111,6 @@ private:
 #endif
     
     bool m_usingGeolocation;
-
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    bool m_inLowBandwidthDisplay;
-#endif
-
-    typedef HashMap<int, DOMTimer*> TimeoutsMap;
-    TimeoutsMap m_timeouts;
 };
 
 inline bool Document::hasElementWithId(AtomicStringImpl* id) const
diff --git a/src/3rdparty/webkit/WebCore/dom/Document.idl b/src/3rdparty/webkit/WebCore/dom/Document.idl
index dfdfe46..ac6dd0e 100644
--- a/src/3rdparty/webkit/WebCore/dom/Document.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Document.idl
@@ -28,11 +28,11 @@ module core {
         InlineGetOwnPropertySlot,
         InterfaceUUID=48BB95FC-2D08-4c54-BE65-7558736A4CAE,
         ImplementationUUID=FF5CBE81-F817-429c-A6C2-0CCCD2328062
-    ] Document : EventTargetNode {
+    ] Document : Node {
 
         // DOM Level 1 Core
         readonly attribute DocumentType doctype;
-        readonly attribute DOMImplementation implementation;
+        readonly attribute [V8Custom] DOMImplementation implementation;
         readonly attribute Element documentElement;
 
         [ReturnsNew] Element createElement(in [ConvertNullToNullString] DOMString tagName)
@@ -81,7 +81,7 @@ module core {
 
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString documentURI;
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // DOM Level 2 Events (DocumentEvents interface)
 
         Event              createEvent(in DOMString eventType)
@@ -116,17 +116,17 @@ module core {
 
         [OldStyleObjC] CSSStyleDeclaration getOverrideStyle(in Element element,
                                                             in DOMString pseudoElement);
-#if ENABLE_XPATH
+#if defined(ENABLE_XPATH) && ENABLE_XPATH
         // DOM Level 3 XPath (XPathEvaluator interface)
         [OldStyleObjC] XPathExpression createExpression(in DOMString expression,
                                                         in XPathNSResolver resolver)
             raises(DOMException);
         XPathNSResolver    createNSResolver(in Node nodeResolver);
-        [OldStyleObjC] XPathResult evaluate(in DOMString expression,
-                                            in Node contextNode,
-                                            in XPathNSResolver resolver,
-                                            in unsigned short type,
-                                            in XPathResult inResult)
+        [OldStyleObjC, V8Custom] XPathResult evaluate(in DOMString expression,
+                                                      in Node contextNode,
+                                                      in XPathNSResolver resolver,
+                                                      in unsigned short type,
+                                                      in XPathResult inResult)
             raises(DOMException);
 #endif // ENABLE_XPATH
 #endif // !defined(LANGUAGE_COM)
@@ -137,7 +137,7 @@ module core {
                                        in boolean userInterface,
                                        in [ConvertUndefinedOrNullToNullString] DOMString value);
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // FIXME: remove the these two versions once [Optional] is implemented for Objective-C.
         boolean            execCommand(in DOMString command,
                                        in boolean userInterface);
@@ -154,7 +154,7 @@ module core {
 
                  attribute [ConvertNullToNullString] DOMString title;
         readonly attribute DOMString referrer;
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
                  attribute [ConvertNullToNullString] DOMString domain;
 #else
         readonly attribute DOMString domain;
@@ -180,7 +180,7 @@ module core {
 
         NodeList getElementsByName(in DOMString elementName);
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
                  attribute [Custom] Location location;
 #endif
 
@@ -193,7 +193,7 @@ module core {
         Element            elementFromPoint(in long x, in long y);
 
         // Mozilla extensions
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         DOMSelection       getSelection();
 #endif
         readonly attribute [ConvertNullStringTo=Null] DOMString characterSet;
@@ -203,13 +203,13 @@ module core {
         readonly attribute [ConvertNullStringTo=Null] DOMString preferredStylesheetSet;
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString selectedStylesheetSet;
 
-#if !defined(LANGUAGE_COM)
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         CSSStyleDeclaration createCSSStyleDeclaration();
 #endif
 #endif
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // DOM Level 2 Style Interface
         [OldStyleObjC, UsesView] CSSStyleDeclaration getComputedStyle(in Element element,
                                                                       in DOMString pseudoElement);
@@ -224,9 +224,9 @@ module core {
                                                   
 #endif
 
-#if !defined(LANGUAGE_COM)
-#if !defined(LANGUAGE_OBJECTIVE_C)
-        DOMObject getCSSCanvasContext(in DOMString contextId, in DOMString name, in long width, in long height);
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
+        [V8Custom] DOMObject getCSSCanvasContext(in DOMString contextId, in DOMString name, in long width, in long height);
 #endif
 #endif
 
@@ -234,14 +234,87 @@ module core {
         NodeList getElementsByClassName(in DOMString tagname);
 
         // NodeSelector - Selector API
-        Element querySelector(in [ConvertUndefinedOrNullToNullString] DOMString selectors)
+        Element querySelector(in DOMString selectors)
             raises(DOMException);
-        NodeList querySelectorAll(in [ConvertUndefinedOrNullToNullString] DOMString selectors)
+        NodeList querySelectorAll(in DOMString selectors)
             raises(DOMException);
 
-#if ENABLE_WML
+#if defined(ENABLE_WML) && ENABLE_WML
         // Only used from within WML layout tests, WML doesn't have JS support at all.
         void resetWMLPageState();
+        void initializeWMLPageState();
+#endif
+
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+        // Event handler DOM attributes
+        attribute [DontEnum] EventListener onabort;
+        attribute [DontEnum] EventListener onblur;
+        attribute [DontEnum] EventListener onchange;
+        attribute [DontEnum] EventListener onclick;
+        attribute [DontEnum] EventListener oncontextmenu;
+        attribute [DontEnum] EventListener ondblclick;
+        attribute [DontEnum] EventListener ondrag;
+        attribute [DontEnum] EventListener ondragend;
+        attribute [DontEnum] EventListener ondragenter;
+        attribute [DontEnum] EventListener ondragleave;
+        attribute [DontEnum] EventListener ondragover;
+        attribute [DontEnum] EventListener ondragstart;
+        attribute [DontEnum] EventListener ondrop;
+        attribute [DontEnum] EventListener onerror;
+        attribute [DontEnum] EventListener onfocus;
+        attribute [DontEnum] EventListener oninput;
+        attribute [DontEnum] EventListener onkeydown;
+        attribute [DontEnum] EventListener onkeypress;
+        attribute [DontEnum] EventListener onkeyup;
+        attribute [DontEnum] EventListener onload;
+        attribute [DontEnum] EventListener onmousedown;
+        attribute [DontEnum] EventListener onmousemove;
+        attribute [DontEnum] EventListener onmouseout;
+        attribute [DontEnum] EventListener onmouseover;
+        attribute [DontEnum] EventListener onmouseup;
+        attribute [DontEnum] EventListener onmousewheel;
+        attribute [DontEnum] EventListener onscroll;
+        attribute [DontEnum] EventListener onselect;
+        attribute [DontEnum] EventListener onsubmit;
+
+        // attribute [DontEnum] EventListener oncanplay;
+        // attribute [DontEnum] EventListener oncanplaythrough;
+        // attribute [DontEnum] EventListener ondurationchange;
+        // attribute [DontEnum] EventListener onemptied;
+        // attribute [DontEnum] EventListener onended;
+        // attribute [DontEnum] EventListener onformchange;
+        // attribute [DontEnum] EventListener onforminput;
+        // attribute [DontEnum] EventListener oninvalid;
+        // attribute [DontEnum] EventListener onloadeddata;
+        // attribute [DontEnum] EventListener onloadedmetadata;
+        // attribute [DontEnum] EventListener onloadstart;
+        // attribute [DontEnum] EventListener onpause;
+        // attribute [DontEnum] EventListener onplay;
+        // attribute [DontEnum] EventListener onplaying;
+        // attribute [DontEnum] EventListener onprogress;
+        // attribute [DontEnum] EventListener onratechange;
+        // attribute [DontEnum] EventListener onreadystatechange;
+        // attribute [DontEnum] EventListener onseeked;
+        // attribute [DontEnum] EventListener onseeking;
+        // attribute [DontEnum] EventListener onshow;
+        // attribute [DontEnum] EventListener onstalled;
+        // attribute [DontEnum] EventListener onsuspend;
+        // attribute [DontEnum] EventListener ontimeupdate;
+        // attribute [DontEnum] EventListener onvolumechange;
+        // attribute [DontEnum] EventListener onwaiting;
+
+        // WebKit extensions
+        attribute [DontEnum] EventListener onbeforecut;
+        attribute [DontEnum] EventListener oncut;
+        attribute [DontEnum] EventListener onbeforecopy;
+        attribute [DontEnum] EventListener oncopy;
+        attribute [DontEnum] EventListener onbeforepaste;
+        attribute [DontEnum] EventListener onpaste;
+        attribute [DontEnum] EventListener onreset;
+        attribute [DontEnum] EventListener onsearch;
+        attribute [DontEnum] EventListener onselectstart;
+#endif
 #endif
     };
 
diff --git a/src/3rdparty/webkit/WebCore/dom/DocumentFragment.idl b/src/3rdparty/webkit/WebCore/dom/DocumentFragment.idl
index 2cdcdf8..ff6232f 100644
--- a/src/3rdparty/webkit/WebCore/dom/DocumentFragment.idl
+++ b/src/3rdparty/webkit/WebCore/dom/DocumentFragment.idl
@@ -23,12 +23,11 @@ module core {
         GenerateConstructor,
         InterfaceUUID=F5C8DAF0-D728-4b2b-9D9C-630621B07D35,
         ImplementationUUID=E57BF71F-3FAA-495c-A307-E288F8E5B2EC
-    ] DocumentFragment : EventTargetNode {
+    ] DocumentFragment : Node {
         // NodeSelector - Selector API
-        // FIXME: add support for NSResolver in languages other than JS
-        Element querySelector(in [ConvertUndefinedOrNullToNullString] DOMString selectors)
+        Element querySelector(in DOMString selectors)
             raises(DOMException);
-        NodeList querySelectorAll(in [ConvertUndefinedOrNullToNullString] DOMString selectors)
+        NodeList querySelectorAll(in DOMString selectors)
             raises(DOMException);
     };
 
diff --git a/src/3rdparty/webkit/WebCore/dom/DocumentMarker.h b/src/3rdparty/webkit/WebCore/dom/DocumentMarker.h
index 2ba9b47..8945eb0 100644
--- a/src/3rdparty/webkit/WebCore/dom/DocumentMarker.h
+++ b/src/3rdparty/webkit/WebCore/dom/DocumentMarker.h
@@ -30,19 +30,23 @@ namespace WebCore {
 
 // A range of a node within a document that is "marked", such as the range of a misspelled word.
 // It optionally includes a description that could be displayed in the user interface.
+// It also optionally includes a flag specifying whether the match is active, which is ignored
+// for all types other than type TextMatch.
 struct DocumentMarker {
 
     enum MarkerType {
         AllMarkers  = -1,
         Spelling,
         Grammar,
-        TextMatch
+        TextMatch,
+        Replacement
     };
 
     MarkerType type;
     unsigned startOffset;
     unsigned endOffset;
     String description;
+    bool activeMatch;
 
     bool operator==(const DocumentMarker& o) const
     {
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.cpp b/src/3rdparty/webkit/WebCore/dom/Element.cpp
index 5faeea2..d858888 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Element.cpp
@@ -4,7 +4,7 @@
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *           (C) 2007 Eric Seidel (eric@webkit.org)
  *
  * This library is free software; you can redistribute it and/or
@@ -27,8 +27,11 @@
 #include "Element.h"
 
 #include "AXObjectCache.h"
+#include "Attr.h"
 #include "CSSStyleSelector.h"
 #include "CString.h"
+#include "ClientRect.h"
+#include "ClientRectList.h"
 #include "Document.h"
 #include "Editor.h"
 #include "ElementRareData.h"
@@ -38,7 +41,7 @@
 #include "FrameView.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
-#include "NamedAttrMap.h"
+#include "NamedNodeMap.h"
 #include "NodeList.h"
 #include "NodeRenderStyle.h"
 #include "Page.h"
@@ -48,6 +51,10 @@
 #include "TextIterator.h"
 #include "XMLNames.h"
 
+#if ENABLE(SVG)
+#include "SVGNames.h"
+#endif
+
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -78,30 +85,35 @@ inline ElementRareData* Element::ensureRareData()
     
 NodeRareData* Element::createRareData()
 {
-    return new ElementRareData(this);
+    return new ElementRareData;
 }
     
 PassRefPtr<Node> Element::cloneNode(bool deep)
 {
-    ExceptionCode ec = 0;
-    RefPtr<Element> clone = document()->createElementNS(namespaceURI(), nodeName(), ec);
-    ASSERT(!ec);
-    
-    // clone attributes
-    if (namedAttrMap)
-        clone->attributes()->setAttributes(*namedAttrMap);
-
-    clone->copyNonAttributeProperties(this);
-    
-    if (deep)
-        cloneChildNodes(clone.get());
+    return deep ? cloneElementWithChildren() : cloneElementWithoutChildren();
+}
 
+PassRefPtr<Element> Element::cloneElementWithChildren()
+{
+    RefPtr<Element> clone = cloneElementWithoutChildren();
+    cloneChildNodes(clone.get());
     return clone.release();
 }
 
-PassRefPtr<Element> Element::cloneElement()
+PassRefPtr<Element> Element::cloneElementWithoutChildren()
 {
-    return static_pointer_cast<Element>(cloneNode(false));
+    RefPtr<Element> clone = document()->createElement(tagQName(), false);
+    // This will catch HTML elements in the wrong namespace that are not correctly copied.
+    // This is a sanity check as HTML overloads some of the DOM methods.
+    ASSERT(isHTMLElement() == clone->isHTMLElement());
+
+    // Clone attributes.
+    if (namedAttrMap)
+        clone->attributes()->setAttributes(*attributes(true)); // Call attributes(true) to force attribute synchronization to occur (for svg and style) before cloning happens.
+
+    clone->copyNonAttributeProperties(this);
+    
+    return clone.release();
 }
 
 void Element::removeAttribute(const QualifiedName& name, ExceptionCode& ec)
@@ -130,12 +142,12 @@ void Element::setBooleanAttribute(const QualifiedName& name, bool b)
 }
 
 // Virtual function, defined in base class.
-NamedAttrMap* Element::attributes() const
+NamedNodeMap* Element::attributes() const
 {
     return attributes(false);
 }
 
-NamedAttrMap* Element::attributes(bool readonly) const
+NamedNodeMap* Element::attributes(bool readonly) const
 {
     if (!m_isStyleAttributeValid)
         updateStyleAttribute();
@@ -189,9 +201,9 @@ void Element::scrollIntoView(bool alignToTop)
     if (renderer()) {
         // Align to the top / bottom and to the closest edge.
         if (alignToTop)
-            renderer()->enclosingLayer()->scrollRectToVisible(bounds, false, RenderLayer::gAlignToEdgeIfNeeded, RenderLayer::gAlignTopAlways);
+            renderer()->enclosingLayer()->scrollRectToVisible(bounds, false, ScrollAlignment::alignToEdgeIfNeeded, ScrollAlignment::alignTopAlways);
         else
-            renderer()->enclosingLayer()->scrollRectToVisible(bounds, false, RenderLayer::gAlignToEdgeIfNeeded, RenderLayer::gAlignBottomAlways);
+            renderer()->enclosingLayer()->scrollRectToVisible(bounds, false, ScrollAlignment::alignToEdgeIfNeeded, ScrollAlignment::alignBottomAlways);
     }
 }
 
@@ -201,9 +213,9 @@ void Element::scrollIntoViewIfNeeded(bool centerIfNeeded)
     IntRect bounds = getRect();    
     if (renderer()) {
         if (centerIfNeeded)
-            renderer()->enclosingLayer()->scrollRectToVisible(bounds, false, RenderLayer::gAlignCenterIfNeeded, RenderLayer::gAlignCenterIfNeeded);
+            renderer()->enclosingLayer()->scrollRectToVisible(bounds, false, ScrollAlignment::alignCenterIfNeeded, ScrollAlignment::alignCenterIfNeeded);
         else
-            renderer()->enclosingLayer()->scrollRectToVisible(bounds, false, RenderLayer::gAlignToEdgeIfNeeded, RenderLayer::gAlignToEdgeIfNeeded);
+            renderer()->enclosingLayer()->scrollRectToVisible(bounds, false, ScrollAlignment::alignToEdgeIfNeeded, ScrollAlignment::alignToEdgeIfNeeded);
     }
 }
 
@@ -217,7 +229,7 @@ void Element::scrollByUnits(int units, ScrollGranularity granularity)
                 direction = ScrollUp;
                 units = -units;
             }
-            rend->layer()->scroll(direction, granularity, units);
+            toRenderBox(rend)->layer()->scroll(direction, granularity, units);
         }
     }
 }
@@ -258,23 +270,54 @@ static float localZoomForRenderer(RenderObject* renderer)
 static int adjustForLocalZoom(int value, RenderObject* renderer)
 {
     float zoomFactor = localZoomForRenderer(renderer);
-    if (zoomFactor == 1.0f)
+    if (zoomFactor == 1)
         return value;
+    // Needed because computeLengthInt truncates (rather than rounds) when scaling up.
+    if (zoomFactor > 1)
+        value++;
     return static_cast<int>(value / zoomFactor);
 }
 
 static int adjustForAbsoluteZoom(int value, RenderObject* renderer)
 {
     float zoomFactor = renderer->style()->effectiveZoom();
-    if (zoomFactor == 1.0f)
+    if (zoomFactor == 1)
         return value;
+    // Needed because computeLengthInt truncates (rather than rounds) when scaling up.
+    if (zoomFactor > 1)
+        value++;
     return static_cast<int>(value / zoomFactor);
 }
 
+static FloatPoint adjustFloatPointForAbsoluteZoom(const FloatPoint& point, RenderObject* renderer)
+{
+    // The result here is in floats, so we don't need the truncation hack from the integer version above.
+    float zoomFactor = renderer->style()->effectiveZoom();
+    if (zoomFactor == 1)
+        return point;
+    return FloatPoint(point.x() / zoomFactor, point.y() / zoomFactor);
+}
+
+static void adjustFloatQuadForAbsoluteZoom(FloatQuad& quad, RenderObject* renderer)
+{
+    quad.setP1(adjustFloatPointForAbsoluteZoom(quad.p1(), renderer));
+    quad.setP2(adjustFloatPointForAbsoluteZoom(quad.p2(), renderer));
+    quad.setP3(adjustFloatPointForAbsoluteZoom(quad.p3(), renderer));
+    quad.setP4(adjustFloatPointForAbsoluteZoom(quad.p4(), renderer));
+}
+
+static void adjustIntRectForAbsoluteZoom(IntRect& rect, RenderObject* renderer)
+{
+    rect.setX(adjustForAbsoluteZoom(rect.x(), renderer));
+    rect.setY(adjustForAbsoluteZoom(rect.y(), renderer));
+    rect.setWidth(adjustForAbsoluteZoom(rect.width(), renderer));
+    rect.setHeight(adjustForAbsoluteZoom(rect.height(), renderer));
+}
+
 int Element::offsetLeft()
 {
     document()->updateLayoutIgnorePendingStylesheets();
-    if (RenderObject* rend = renderer())
+    if (RenderBoxModelObject* rend = renderBoxModelObject())
         return adjustForLocalZoom(rend->offsetLeft(), rend);
     return 0;
 }
@@ -282,7 +325,7 @@ int Element::offsetLeft()
 int Element::offsetTop()
 {
     document()->updateLayoutIgnorePendingStylesheets();
-    if (RenderObject* rend = renderer())
+    if (RenderBoxModelObject* rend = renderBoxModelObject())
         return adjustForLocalZoom(rend->offsetTop(), rend);
     return 0;
 }
@@ -290,7 +333,7 @@ int Element::offsetTop()
 int Element::offsetWidth()
 {
     document()->updateLayoutIgnorePendingStylesheets();
-    if (RenderObject* rend = renderer())
+    if (RenderBoxModelObject* rend = renderBoxModelObject())
         return adjustForAbsoluteZoom(rend->offsetWidth(), rend);
     return 0;
 }
@@ -298,7 +341,7 @@ int Element::offsetWidth()
 int Element::offsetHeight()
 {
     document()->updateLayoutIgnorePendingStylesheets();
-    if (RenderObject* rend = renderer())
+    if (RenderBoxModelObject* rend = renderBoxModelObject())
         return adjustForAbsoluteZoom(rend->offsetHeight(), rend);
     return 0;
 }
@@ -308,7 +351,7 @@ Element* Element::offsetParent()
     document()->updateLayoutIgnorePendingStylesheets();
     if (RenderObject* rend = renderer())
         if (RenderObject* offsetParent = rend->offsetParent())
-            return static_cast<Element*>(offsetParent->element());
+            return static_cast<Element*>(offsetParent->node());
     return 0;
 }
 
@@ -316,7 +359,7 @@ int Element::clientLeft()
 {
     document()->updateLayoutIgnorePendingStylesheets();
 
-    if (RenderObject* rend = renderer())
+    if (RenderBox* rend = renderBox())
         return adjustForAbsoluteZoom(rend->clientLeft(), rend);
     return 0;
 }
@@ -325,7 +368,7 @@ int Element::clientTop()
 {
     document()->updateLayoutIgnorePendingStylesheets();
 
-    if (RenderObject* rend = renderer())
+    if (RenderBox* rend = renderBox())
         return adjustForAbsoluteZoom(rend->clientTop(), rend);
     return 0;
 }
@@ -340,11 +383,10 @@ int Element::clientWidth()
     if ((!inCompatMode && document()->documentElement() == this) ||
         (inCompatMode && isHTMLElement() && document()->body() == this)) {
         if (FrameView* view = document()->view())
-            return view->layoutWidth();
+            return adjustForAbsoluteZoom(view->layoutWidth(), document()->renderer());
     }
     
-
-    if (RenderObject* rend = renderer())
+    if (RenderBox* rend = renderBox())
         return adjustForAbsoluteZoom(rend->clientWidth(), rend);
     return 0;
 }
@@ -360,26 +402,26 @@ int Element::clientHeight()
     if ((!inCompatMode && document()->documentElement() == this) ||
         (inCompatMode && isHTMLElement() && document()->body() == this)) {
         if (FrameView* view = document()->view())
-            return view->layoutHeight();
+            return adjustForAbsoluteZoom(view->layoutHeight(), document()->renderer());
     }
     
-    if (RenderObject* rend = renderer())
+    if (RenderBox* rend = renderBox())
         return adjustForAbsoluteZoom(rend->clientHeight(), rend);
     return 0;
 }
 
-int Element::scrollLeft()
+int Element::scrollLeft() const
 {
     document()->updateLayoutIgnorePendingStylesheets();
-    if (RenderObject* rend = renderer())
+    if (RenderBox* rend = renderBox())
         return adjustForAbsoluteZoom(rend->scrollLeft(), rend);
     return 0;
 }
 
-int Element::scrollTop()
+int Element::scrollTop() const
 {
     document()->updateLayoutIgnorePendingStylesheets();
-    if (RenderObject* rend = renderer())
+    if (RenderBox* rend = renderBox())
         return adjustForAbsoluteZoom(rend->scrollTop(), rend);
     return 0;
 }
@@ -387,33 +429,85 @@ int Element::scrollTop()
 void Element::setScrollLeft(int newLeft)
 {
     document()->updateLayoutIgnorePendingStylesheets();
-    if (RenderObject* rend = renderer())
+    if (RenderBox* rend = renderBox())
         rend->setScrollLeft(static_cast<int>(newLeft * rend->style()->effectiveZoom()));
 }
 
 void Element::setScrollTop(int newTop)
 {
     document()->updateLayoutIgnorePendingStylesheets();
-    if (RenderObject* rend = renderer())
+    if (RenderBox* rend = renderBox())
         rend->setScrollTop(static_cast<int>(newTop * rend->style()->effectiveZoom()));
 }
 
-int Element::scrollWidth()
+int Element::scrollWidth() const
 {
     document()->updateLayoutIgnorePendingStylesheets();
-    if (RenderObject* rend = renderer())
+    if (RenderBox* rend = renderBox())
         return adjustForAbsoluteZoom(rend->scrollWidth(), rend);
     return 0;
 }
 
-int Element::scrollHeight()
+int Element::scrollHeight() const
 {
     document()->updateLayoutIgnorePendingStylesheets();
-    if (RenderObject* rend = renderer())
+    if (RenderBox* rend = renderBox())
         return adjustForAbsoluteZoom(rend->scrollHeight(), rend);
     return 0;
 }
 
+PassRefPtr<ClientRectList> Element::getClientRects() const
+{
+    document()->updateLayoutIgnorePendingStylesheets();
+
+    RenderBoxModelObject* renderBoxModelObject = this->renderBoxModelObject();
+    if (!renderBoxModelObject)
+        return ClientRectList::create();
+
+    // FIXME: Handle SVG elements.
+    // FIXME: Handle table/inline-table with a caption.
+
+    Vector<FloatQuad> quads;
+    renderBoxModelObject->absoluteQuads(quads);
+
+    if (FrameView* view = document()->view()) {
+        IntRect visibleContentRect = view->visibleContentRect();
+        for (size_t i = 0; i < quads.size(); ++i) {
+            quads[i].move(-visibleContentRect.x(), -visibleContentRect.y());
+            adjustFloatQuadForAbsoluteZoom(quads[i], renderBoxModelObject);
+        }
+    }
+
+    return ClientRectList::create(quads);
+}
+
+PassRefPtr<ClientRect> Element::getBoundingClientRect() const
+{
+    document()->updateLayoutIgnorePendingStylesheets();
+    RenderBoxModelObject* renderBoxModelObject = this->renderBoxModelObject();
+    if (!renderBoxModelObject)
+        return ClientRect::create();
+
+    Vector<FloatQuad> quads;
+    renderBoxModelObject->absoluteQuads(quads);
+
+    if (quads.isEmpty())
+        return ClientRect::create();
+
+    IntRect result = quads[0].enclosingBoundingBox();
+    for (size_t i = 1; i < quads.size(); ++i)
+        result.unite(quads[i].enclosingBoundingBox());
+
+    if (FrameView* view = document()->view()) {
+        IntRect visibleContentRect = view->visibleContentRect();
+        result.move(-visibleContentRect.x(), -visibleContentRect.y());
+    }
+
+    adjustIntRectForAbsoluteZoom(result, renderBoxModelObject);
+
+    return ClientRect::create(result);
+}
+
 static inline bool shouldIgnoreAttributeCase(const Element* e)
 {
     return e && e->document()->isHTMLDocument() && e->isHTMLElement();
@@ -496,20 +590,20 @@ PassRefPtr<Attribute> Element::createAttribute(const QualifiedName& name, const
 
 void Element::attributeChanged(Attribute* attr, bool)
 {
+    if (!document()->axObjectCache()->accessibilityEnabled())
+        return;
+
     const QualifiedName& attrName = attr->name();
     if (attrName == aria_activedescendantAttr) {
         // any change to aria-activedescendant attribute triggers accessibility focus change, but document focus remains intact
-        if (document()->axObjectCache()->accessibilityEnabled())
-            document()->axObjectCache()->handleActiveDescendantChanged(renderer());
-    }
-    if (attrName == roleAttr) {
+        document()->axObjectCache()->handleActiveDescendantChanged(renderer());
+    } else if (attrName == roleAttr) {
         // the role attribute can change at any time, and the AccessibilityObject must pick up these changes
-        if (document()->axObjectCache()->accessibilityEnabled())
-            document()->axObjectCache()->handleAriaRoleChanged(renderer());
+        document()->axObjectCache()->handleAriaRoleChanged(renderer());
     }
 }
 
-void Element::setAttributeMap(PassRefPtr<NamedAttrMap> list)
+void Element::setAttributeMap(PassRefPtr<NamedNodeMap> list)
 {
     document()->incDOMTreeVersion();
 
@@ -587,7 +681,7 @@ KURL Element::baseURI() const
 
 void Element::createAttributeMap() const
 {
-    namedAttrMap = NamedAttrMap::create(const_cast<Element*>(this));
+    namedAttrMap = NamedNodeMap::create(const_cast<Element*>(this));
 }
 
 bool Element::isURLAttribute(Attribute*) const
@@ -620,7 +714,7 @@ void Element::insertedIntoDocument()
     ContainerNode::insertedIntoDocument();
 
     if (hasID()) {
-        if (NamedAttrMap* attrs = namedAttrMap.get()) {
+        if (NamedNodeMap* attrs = namedAttrMap.get()) {
             Attribute* idItem = attrs->getAttributeItem(idAttr);
             if (idItem && !idItem->isNull())
                 updateId(nullAtom, idItem->value());
@@ -631,7 +725,7 @@ void Element::insertedIntoDocument()
 void Element::removedFromDocument()
 {
     if (hasID()) {
-        if (NamedAttrMap* attrs = namedAttrMap.get()) {
+        if (NamedNodeMap* attrs = namedAttrMap.get()) {
             Attribute* idItem = attrs->getAttributeItem(idAttr);
             if (idItem && !idItem->isNull())
                 updateId(idItem->value(), nullAtom);
@@ -643,6 +737,8 @@ void Element::removedFromDocument()
 
 void Element::attach()
 {
+    suspendPostAttachCallbacks();
+
     createRendererIfNeeded();
     ContainerNode::attach();
     if (hasRareData()) {   
@@ -653,13 +749,15 @@ void Element::attach()
             data->setNeedsFocusAppearanceUpdateSoonAfterAttach(false);
         }
     }
+
+    resumePostAttachCallbacks();
 }
 
 void Element::detach()
 {
     cancelFocusAppearanceUpdate();
     if (hasRareData())
-        rareData()->resetComputedStyle(this);
+        rareData()->resetComputedStyle();
     ContainerNode::detach();
 }
 
@@ -667,7 +765,7 @@ void Element::recalcStyle(StyleChange change)
 {
     RenderStyle* currentStyle = renderStyle();
     bool hasParentStyle = parentNode() ? parentNode()->renderStyle() : false;
-    bool hasPositionalRules = changed() && currentStyle && currentStyle->childrenAffectedByPositionalRules();
+    bool hasPositionalRules = needsStyleRecalc() && currentStyle && currentStyle->childrenAffectedByPositionalRules();
     bool hasDirectAdjacentRules = currentStyle && currentStyle->childrenAffectedByDirectAdjacentRules();
 
 #if ENABLE(SVG)
@@ -675,11 +773,11 @@ void Element::recalcStyle(StyleChange change)
         hasParentStyle = true;
 #endif
 
-    if ((change > NoChange || changed())) {
+    if ((change > NoChange || needsStyleRecalc())) {
         if (hasRareData())
-            rareData()->resetComputedStyle(this);
+            rareData()->resetComputedStyle();
     }
-    if (hasParentStyle && (change >= Inherit || changed())) {
+    if (hasParentStyle && (change >= Inherit || needsStyleRecalc())) {
         RefPtr<RenderStyle> newStyle = document()->styleSelector()->styleForElement(this);
         StyleChange ch = diff(currentStyle, newStyle.get());
         if (ch == Detach || !currentStyle) {
@@ -687,8 +785,8 @@ void Element::recalcStyle(StyleChange change)
                 detach();
             attach(); // FIXME: The style gets computed twice by calling attach. We could do better if we passed the style along.
             // attach recalulates the style for all children. No need to do it twice.
-            setChanged(NoStyleChange);
-            setHasChangedChild(false);
+            setNeedsStyleRecalc(NoStyleChange);
+            setChildNeedsStyleRecalc(false);
             return;
         }
 
@@ -715,7 +813,7 @@ void Element::recalcStyle(StyleChange change)
 
         if (ch != NoChange) {
             setRenderStyle(newStyle);
-        } else if (changed() && (styleChangeType() != AnimationStyleChange) && (document()->usesSiblingRules() || document()->usesDescendantRules())) {
+        } else if (needsStyleRecalc() && (styleChangeType() != AnimationStyleChange) && (document()->usesSiblingRules() || document()->usesDescendantRules())) {
             // Although no change occurred, we use the new style so that the cousin style sharing code won't get
             // fooled into believing this style is the same.  This is only necessary if the document actually uses
             // sibling/descendant rules, since otherwise it isn't possible for ancestor styles to affect sharing of
@@ -740,17 +838,17 @@ void Element::recalcStyle(StyleChange change)
     // without doing way too much re-resolution.
     bool forceCheckOfNextElementSibling = false;
     for (Node *n = firstChild(); n; n = n->nextSibling()) {
-        bool childRulesChanged = n->changed() && n->styleChangeType() == FullStyleChange;
+        bool childRulesChanged = n->needsStyleRecalc() && n->styleChangeType() == FullStyleChange;
         if (forceCheckOfNextElementSibling && n->isElementNode())
-            n->setChanged();
-        if (change >= Inherit || n->isTextNode() || n->hasChangedChild() || n->changed())
+            n->setNeedsStyleRecalc();
+        if (change >= Inherit || n->isTextNode() || n->childNeedsStyleRecalc() || n->needsStyleRecalc())
             n->recalcStyle(change);
         if (n->isElementNode())
             forceCheckOfNextElementSibling = childRulesChanged && hasDirectAdjacentRules;
     }
 
-    setChanged(NoStyleChange);
-    setHasChangedChild(false);
+    setNeedsStyleRecalc(NoStyleChange);
+    setChildNeedsStyleRecalc(false);
 }
 
 bool Element::childTypeAllowed(NodeType type)
@@ -772,7 +870,7 @@ bool Element::childTypeAllowed(NodeType type)
 static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool finishedParsingCallback,
                                         Node* beforeChange, Node* afterChange, int childCountDelta)
 {
-    if (!style || (e->changed() && style->childrenAffectedByPositionalRules()))
+    if (!style || (e->needsStyleRecalc() && style->childrenAffectedByPositionalRules()))
         return;
 
     // :first-child.  In the parser callback case, we don't have to check anything, since we were right the first time.
@@ -792,11 +890,11 @@ static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool fin
         // This is the insert/append case.
         if (newFirstChild != firstElementAfterInsertion && firstElementAfterInsertion && firstElementAfterInsertion->attached() &&
             firstElementAfterInsertion->renderStyle() && firstElementAfterInsertion->renderStyle()->firstChildState())
-            firstElementAfterInsertion->setChanged();
+            firstElementAfterInsertion->setNeedsStyleRecalc();
             
         // We also have to handle node removal.
         if (childCountDelta < 0 && newFirstChild == firstElementAfterInsertion && newFirstChild && newFirstChild->renderStyle() && !newFirstChild->renderStyle()->firstChildState())
-            newFirstChild->setChanged();
+            newFirstChild->setNeedsStyleRecalc();
     }
 
     // :last-child.  In the parser callback case, we don't have to check anything, since we were right the first time.
@@ -814,12 +912,12 @@ static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool fin
         
         if (newLastChild != lastElementBeforeInsertion && lastElementBeforeInsertion && lastElementBeforeInsertion->attached() &&
             lastElementBeforeInsertion->renderStyle() && lastElementBeforeInsertion->renderStyle()->lastChildState())
-            lastElementBeforeInsertion->setChanged();
+            lastElementBeforeInsertion->setNeedsStyleRecalc();
             
         // We also have to handle node removal.  The parser callback case is similar to node removal as well in that we need to change the last child
         // to match now.
         if ((childCountDelta < 0 || finishedParsingCallback) && newLastChild == lastElementBeforeInsertion && newLastChild && newLastChild->renderStyle() && !newLastChild->renderStyle()->lastChildState())
-            newLastChild->setChanged();
+            newLastChild->setNeedsStyleRecalc();
     }
 
     // The + selector.  We need to invalidate the first element following the insertion point.  It is the only possible element
@@ -830,7 +928,7 @@ static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool fin
              firstElementAfterInsertion && !firstElementAfterInsertion->isElementNode();
              firstElementAfterInsertion = firstElementAfterInsertion->nextSibling()) {};
         if (firstElementAfterInsertion && firstElementAfterInsertion->attached())
-            firstElementAfterInsertion->setChanged();
+            firstElementAfterInsertion->setNeedsStyleRecalc();
     }
 
     // Forward positional selectors include the ~ selector, nth-child, nth-of-type, first-of-type and only-of-type.
@@ -842,11 +940,11 @@ static void checkForSiblingStyleChanges(Element* e, RenderStyle* style, bool fin
     // here.  recalcStyle will then force a walk of the children when it sees that this has happened.
     if ((style->childrenAffectedByForwardPositionalRules() && afterChange) ||
         (style->childrenAffectedByBackwardPositionalRules() && beforeChange))
-        e->setChanged();
+        e->setNeedsStyleRecalc();
     
     // :empty selector.
     if (style->affectedByEmpty() && (!style->emptyState() || e->hasChildNodes()))
-        e->setChanged();
+        e->setNeedsStyleRecalc();
 }
 
 void Element::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
@@ -891,7 +989,7 @@ String Element::openTagStartToString() const
 {
     String result = "<" + nodeName();
 
-    NamedAttrMap *attrMap = attributes(true);
+    NamedNodeMap* attrMap = attributes(true);
 
     if (attrMap) {
         unsigned numAttrs = attrMap->length();
@@ -991,7 +1089,7 @@ PassRefPtr<Attr> Element::removeAttributeNode(Attr* attr, ExceptionCode& ec)
         return 0;
     }
 
-    NamedAttrMap *attrs = attributes(true);
+    NamedNodeMap* attrs = attributes(true);
     if (!attrs)
         return 0;
 
@@ -1026,7 +1124,7 @@ void Element::removeAttributeNS(const String& namespaceURI, const String& localN
 
 PassRefPtr<Attr> Element::getAttributeNode(const String& name)
 {
-    NamedAttrMap* attrs = attributes(true);
+    NamedNodeMap* attrs = attributes(true);
     if (!attrs)
         return 0;
     String localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
@@ -1035,7 +1133,7 @@ PassRefPtr<Attr> Element::getAttributeNode(const String& name)
 
 PassRefPtr<Attr> Element::getAttributeNodeNS(const String& namespaceURI, const String& localName)
 {
-    NamedAttrMap* attrs = attributes(true);
+    NamedNodeMap* attrs = attributes(true);
     if (!attrs)
         return 0;
     return static_pointer_cast<Attr>(attrs->getNamedItem(QualifiedName(nullAtom, localName, namespaceURI)));
@@ -1043,7 +1141,7 @@ PassRefPtr<Attr> Element::getAttributeNodeNS(const String& namespaceURI, const S
 
 bool Element::hasAttribute(const String& name) const
 {
-    NamedAttrMap* attrs = attributes(true);
+    NamedNodeMap* attrs = attributes(true);
     if (!attrs)
         return false;
 
@@ -1055,7 +1153,7 @@ bool Element::hasAttribute(const String& name) const
 
 bool Element::hasAttributeNS(const String& namespaceURI, const String& localName) const
 {
-    NamedAttrMap* attrs = attributes(true);
+    NamedNodeMap* attrs = attributes(true);
     if (!attrs)
         return false;
     return attrs->getAttributeItem(QualifiedName(nullAtom, localName, namespaceURI));
@@ -1097,14 +1195,19 @@ void Element::updateFocusAppearance(bool /*restorePreviousSelection*/)
             return;
 
         // FIXME: We should restore the previous selection if there is one.
-        Selection newSelection = hasTagName(htmlTag) || hasTagName(bodyTag) ? Selection(Position(this, 0), DOWNSTREAM) : Selection::selectionFromContentsOfNode(this);
+        VisibleSelection newSelection = hasTagName(htmlTag) || hasTagName(bodyTag) ? VisibleSelection(Position(this, 0), DOWNSTREAM) : VisibleSelection::selectionFromContentsOfNode(this);
         
         if (frame->shouldChangeSelection(newSelection)) {
             frame->selection()->setSelection(newSelection);
             frame->revealSelection();
         }
-    } else if (renderer() && !renderer()->isWidget())
+    }
+    // FIXME: I'm not sure all devices will want this off, but this is
+    // currently turned off for Andriod.
+#if !ENABLE(DIRECTIONAL_PAD_NAVIGATION)
+    else if (renderer() && !renderer()->isWidget())
         renderer()->enclosingLayer()->scrollRectToVisible(getRect());
+#endif
 }
 
 void Element::blur()
@@ -1184,7 +1287,7 @@ void Element::cancelFocusAppearanceUpdate()
 void Element::normalizeAttributes()
 {
     // Normalize attributes.
-    NamedAttrMap* attrs = attributes(true);
+    NamedNodeMap* attrs = attributes(true);
     if (!attrs)
         return;
     unsigned numAttrs = attrs->length();
@@ -1238,4 +1341,15 @@ unsigned Element::childElementCount() const
     return count;
 }
 
+KURL Element::getURLAttribute(const QualifiedName& name) const
+{
+#ifndef NDEBUG
+    if (namedAttrMap) {
+        if (Attribute* attribute = namedAttrMap->getAttributeItem(name))
+            ASSERT(isURLAttribute(attribute));
+    }
+#endif
+    return document()->completeURL(getAttribute(name));
 }
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.h b/src/3rdparty/webkit/WebCore/dom/Element.h
index b48424f..dfa2c0e 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.h
+++ b/src/3rdparty/webkit/WebCore/dom/Element.h
@@ -34,6 +34,8 @@ namespace WebCore {
 class Attr;
 class Attribute;
 class CSSStyleDeclaration;
+class ClientRect;
+class ClientRectList;
 class ElementRareData;
 class IntSize;
 
@@ -59,7 +61,7 @@ public:
     void setAttribute(const AtomicString& name, const AtomicString& value, ExceptionCode&);
     void setAttributeNS(const AtomicString& namespaceURI, const AtomicString& qualifiedName, const AtomicString& value, ExceptionCode&);
 
-    void scrollIntoView (bool alignToTop = true);
+    void scrollIntoView(bool alignToTop = true);
     void scrollIntoViewIfNeeded(bool centerIfNeeded = true);
 
     void scrollByUnits(int units, ScrollGranularity);
@@ -75,12 +77,15 @@ public:
     int clientTop();
     int clientWidth();
     int clientHeight();
-    int scrollLeft();
-    int scrollTop();
-    void setScrollLeft(int);
-    void setScrollTop(int);
-    int scrollWidth();
-    int scrollHeight();
+    virtual int scrollLeft() const;
+    virtual int scrollTop() const;
+    virtual void setScrollLeft(int);
+    virtual void setScrollTop(int);
+    virtual int scrollWidth() const;
+    virtual int scrollHeight() const;
+
+    PassRefPtr<ClientRectList> getClientRects() const;
+    PassRefPtr<ClientRect> getBoundingClientRect() const;
 
     void removeAttribute(const String& name, ExceptionCode&);
     void removeAttributeNS(const String& namespaceURI, const String& localName, ExceptionCode&);
@@ -110,33 +115,29 @@ public:
 
     // DOM methods overridden from parent classes
     virtual NodeType nodeType() const;
-    virtual PassRefPtr<Node> cloneNode(bool deep);
     virtual String nodeName() const;
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
-    PassRefPtr<Element> cloneElement();
+    PassRefPtr<Element> cloneElementWithChildren();
+    PassRefPtr<Element> cloneElementWithoutChildren();
 
     void normalizeAttributes();
-
-    virtual bool isInputTypeHidden() const { return false; }
-    virtual bool isPasswordField() const { return false; }
-
     String nodeNamePreservingCase() const;
 
     // convenience methods which ignore exceptions
     void setAttribute(const QualifiedName&, const AtomicString& value);
     void setBooleanAttribute(const QualifiedName& name, bool);
 
-    virtual NamedAttrMap* attributes() const;
-    NamedAttrMap* attributes(bool readonly) const;
+    virtual NamedNodeMap* attributes() const;
+    NamedNodeMap* attributes(bool readonly) const;
 
     // This method is called whenever an attribute is added, changed or removed.
     virtual void attributeChanged(Attribute*, bool preserveDecls = false);
 
     // not part of the DOM
-    void setAttributeMap(PassRefPtr<NamedAttrMap>);
+    void setAttributeMap(PassRefPtr<NamedNodeMap>);
 
     virtual void copyNonAttributeProperties(const Element* /*source*/) { }
 
@@ -157,6 +158,7 @@ public:
     virtual void accessKeyAction(bool /*sendToAnyEvent*/) { }
 
     virtual bool isURLAttribute(Attribute*) const;
+    KURL getURLAttribute(const QualifiedName&) const;
     virtual const QualifiedName& imageSourceAttributeName() const;
     virtual String target() const { return String(); }
 
@@ -198,6 +200,23 @@ public:
     Element* nextElementSibling() const;
     unsigned childElementCount() const;
 
+    // FormControlElement API
+    virtual bool isFormControlElement() const { return false; }
+    virtual bool isEnabledFormControl() const { return true; }
+    virtual bool isReadOnlyFormControl() const { return false; }
+    virtual bool isTextFormControl() const { return false; }
+
+    virtual bool formControlValueMatchesRenderer() const { return false; }
+    virtual void setFormControlValueMatchesRenderer(bool) { }
+
+    virtual const AtomicString& formControlName() const { return nullAtom; }
+    virtual const AtomicString& formControlType() const { return nullAtom; }
+
+    virtual bool saveFormControlState(String&) const { return false; }
+    virtual void restoreFormControlState(const String&) { }
+
+    virtual void dispatchFormControlChangeEvent() { }
+
 private:
     virtual void createAttributeMap() const;
 
@@ -214,6 +233,10 @@ private:
     virtual const AtomicString& virtualLocalName() const { return localName(); }
     virtual const AtomicString& virtualNamespaceURI() const { return namespaceURI(); }
     
+    // cloneNode is private so that non-virtual cloneElementWithChildren and cloneElementWithoutChildren
+    // are used instead.
+    virtual PassRefPtr<Node> cloneNode(bool deep);
+
     QualifiedName m_tagName;
     virtual NodeRareData* createRareData();
 
@@ -221,7 +244,7 @@ protected:
     ElementRareData* rareData() const;
     ElementRareData* ensureRareData();
     
-    mutable RefPtr<NamedAttrMap> namedAttrMap;
+    mutable RefPtr<NamedNodeMap> namedAttrMap;
 };
     
 inline bool Node::hasTagName(const QualifiedName& name) const
@@ -234,7 +257,7 @@ inline bool Node::hasAttributes() const
     return isElementNode() && static_cast<const Element*>(this)->hasAttributes();
 }
 
-inline NamedAttrMap* Node::attributes() const
+inline NamedNodeMap* Node::attributes() const
 {
     return isElementNode() ? static_cast<const Element*>(this)->attributes() : 0;
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/Element.idl b/src/3rdparty/webkit/WebCore/dom/Element.idl
index ae2c1b8..53711e9 100644
--- a/src/3rdparty/webkit/WebCore/dom/Element.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Element.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -26,7 +26,7 @@ module core {
         InlineGetOwnPropertySlot,
         InterfaceUUID=FEFE9C21-E58C-4b5b-821A-61A514613763,
         ImplementationUUID=12E5B08E-A680-4baf-9D1E-108AEF7ABBFB
-    ] Element : EventTargetNode {
+    ] Element : Node {
 
         // DOM Level 1 Core
 
@@ -66,7 +66,7 @@ module core {
         [OldStyleObjC] boolean hasAttributeNS(in [ConvertNullToNullString] DOMString namespaceURI,
                                               in DOMString localName);
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute CSSStyleDeclaration style;
 #endif
 
@@ -104,13 +104,13 @@ module core {
         NodeList getElementsByClassName(in DOMString name);
 
         // NodeSelector - Selector API
-        Element querySelector(in [ConvertUndefinedOrNullToNullString] DOMString selectors)
+        Element querySelector(in DOMString selectors)
             raises(DOMException);
-        NodeList querySelectorAll(in [ConvertUndefinedOrNullToNullString] DOMString selectors)
+        NodeList querySelectorAll(in DOMString selectors)
             raises(DOMException);
 
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // ElementTraversal API
-#if !defined(LANGUAGE_COM)
         readonly attribute Element firstElementChild;
         readonly attribute Element lastElementChild;
         readonly attribute Element previousElementSibling;
@@ -118,11 +118,88 @@ module core {
         readonly attribute unsigned long childElementCount;
 #endif
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+        // CSSOM View Module API
+        ClientRectList getClientRects();
+        ClientRect getBoundingClientRect();
+#endif
+
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extensions
         readonly attribute DOMString innerText;
 #endif
 
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+        // Event handler DOM attributes
+        attribute [DontEnum] EventListener onabort;
+        attribute [DontEnum] EventListener onblur;
+        attribute [DontEnum] EventListener onchange;
+        attribute [DontEnum] EventListener onclick;
+        attribute [DontEnum] EventListener oncontextmenu;
+        attribute [DontEnum] EventListener ondblclick;
+        attribute [DontEnum] EventListener ondrag;
+        attribute [DontEnum] EventListener ondragend;
+        attribute [DontEnum] EventListener ondragenter;
+        attribute [DontEnum] EventListener ondragleave;
+        attribute [DontEnum] EventListener ondragover;
+        attribute [DontEnum] EventListener ondragstart;
+        attribute [DontEnum] EventListener ondrop;
+        attribute [DontEnum] EventListener onerror;
+        attribute [DontEnum] EventListener onfocus;
+        attribute [DontEnum] EventListener oninput;
+        attribute [DontEnum] EventListener onkeydown;
+        attribute [DontEnum] EventListener onkeypress;
+        attribute [DontEnum] EventListener onkeyup;
+        attribute [DontEnum] EventListener onload;
+        attribute [DontEnum] EventListener onmousedown;
+        attribute [DontEnum] EventListener onmousemove;
+        attribute [DontEnum] EventListener onmouseout;
+        attribute [DontEnum] EventListener onmouseover;
+        attribute [DontEnum] EventListener onmouseup;
+        attribute [DontEnum] EventListener onmousewheel;
+        attribute [DontEnum] EventListener onscroll;
+        attribute [DontEnum] EventListener onselect;
+        attribute [DontEnum] EventListener onsubmit;
+
+        // attribute [DontEnum] EventListener oncanplay;
+        // attribute [DontEnum] EventListener oncanplaythrough;
+        // attribute [DontEnum] EventListener ondurationchange;
+        // attribute [DontEnum] EventListener onemptied;
+        // attribute [DontEnum] EventListener onended;
+        // attribute [DontEnum] EventListener onformchange;
+        // attribute [DontEnum] EventListener onforminput;
+        // attribute [DontEnum] EventListener oninvalid;
+        // attribute [DontEnum] EventListener onloadeddata;
+        // attribute [DontEnum] EventListener onloadedmetadata;
+        // attribute [DontEnum] EventListener onloadstart;
+        // attribute [DontEnum] EventListener onpause;
+        // attribute [DontEnum] EventListener onplay;
+        // attribute [DontEnum] EventListener onplaying;
+        // attribute [DontEnum] EventListener onprogress;
+        // attribute [DontEnum] EventListener onratechange;
+        // attribute [DontEnum] EventListener onreadystatechange;
+        // attribute [DontEnum] EventListener onseeked;
+        // attribute [DontEnum] EventListener onseeking;
+        // attribute [DontEnum] EventListener onshow;
+        // attribute [DontEnum] EventListener onstalled;
+        // attribute [DontEnum] EventListener onsuspend;
+        // attribute [DontEnum] EventListener ontimeupdate;
+        // attribute [DontEnum] EventListener onvolumechange;
+        // attribute [DontEnum] EventListener onwaiting;
+
+        // WebKit extensions
+        attribute [DontEnum] EventListener onbeforecut;
+        attribute [DontEnum] EventListener oncut;
+        attribute [DontEnum] EventListener onbeforecopy;
+        attribute [DontEnum] EventListener oncopy;
+        attribute [DontEnum] EventListener onbeforepaste;
+        attribute [DontEnum] EventListener onpaste;
+        attribute [DontEnum] EventListener onreset;
+        attribute [DontEnum] EventListener onsearch;
+        attribute [DontEnum] EventListener onselectstart;
+#endif
+#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/ElementRareData.h b/src/3rdparty/webkit/WebCore/dom/ElementRareData.h
index 096f846..94e0499 100644
--- a/src/3rdparty/webkit/WebCore/dom/ElementRareData.h
+++ b/src/3rdparty/webkit/WebCore/dom/ElementRareData.h
@@ -1,6 +1,5 @@
-/**
- *
- * Copyright (C) 2008 Apple Computer, Inc.
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 David Smith <catfish.man@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -30,9 +29,9 @@ namespace WebCore {
 
 class ElementRareData : public NodeRareData {
 public:
-    ElementRareData(Element*);
+    ElementRareData();
 
-    void resetComputedStyle(Element*);
+    void resetComputedStyle();
 
     using NodeRareData::needsFocusAppearanceUpdateSoonAfterAttach;
     using NodeRareData::setNeedsFocusAppearanceUpdateSoonAfterAttach;
@@ -46,12 +45,12 @@ inline IntSize defaultMinimumSizeForResizing()
     return IntSize(INT_MAX, INT_MAX);
 }
 
-inline ElementRareData::ElementRareData(Element* e)
+inline ElementRareData::ElementRareData()
     : m_minimumSizeForResizing(defaultMinimumSizeForResizing())
 {
 }
 
-inline void ElementRareData::resetComputedStyle(Element* element)
+inline void ElementRareData::resetComputedStyle()
 {
     m_computedStyle.clear();
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/Event.cpp b/src/3rdparty/webkit/WebCore/dom/Event.cpp
index 67ae492..b4b87ed 100644
--- a/src/3rdparty/webkit/WebCore/dom/Event.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Event.cpp
@@ -24,7 +24,7 @@
 #include "Event.h"
 
 #include "AtomicString.h"
-#include "SystemTime.h"
+#include <wtf/CurrentTime.h>
 
 namespace WebCore {
 
@@ -35,8 +35,8 @@ Event::Event()
     , m_defaultPrevented(false)
     , m_defaultHandled(false)
     , m_cancelBubble(false)
-    , m_currentTarget(0)
     , m_eventPhase(0)
+    , m_currentTarget(0)
     , m_createTime(static_cast<DOMTimeStamp>(currentTime() * 1000.0))
 {
 }
@@ -49,8 +49,8 @@ Event::Event(const AtomicString& eventType, bool canBubbleArg, bool cancelableAr
     , m_defaultPrevented(false)
     , m_defaultHandled(false)
     , m_cancelBubble(false)
-    , m_currentTarget(0)
     , m_eventPhase(0)
+    , m_currentTarget(0)
     , m_createTime(static_cast<DOMTimeStamp>(currentTime() * 1000.0))
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/Event.h b/src/3rdparty/webkit/WebCore/dom/Event.h
index a30dd39..6984215 100644
--- a/src/3rdparty/webkit/WebCore/dom/Event.h
+++ b/src/3rdparty/webkit/WebCore/dom/Event.h
@@ -157,8 +157,8 @@ namespace WebCore {
         bool m_defaultHandled;
         bool m_cancelBubble;
 
-        EventTarget* m_currentTarget;
         unsigned short m_eventPhase;
+        EventTarget* m_currentTarget;
         RefPtr<EventTarget> m_target;
         DOMTimeStamp m_createTime;
 
diff --git a/src/3rdparty/webkit/WebCore/dom/Event.idl b/src/3rdparty/webkit/WebCore/dom/Event.idl
index 99b0bd1..5ac9e0c 100644
--- a/src/3rdparty/webkit/WebCore/dom/Event.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Event.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -24,7 +24,7 @@ module events {
     interface [
         GenerateConstructor,
         NoStaticTables,
-        ObjCCustomInternalImpl,
+        Polymorphic,
         InterfaceUUID=D17495FA-ACAD-4d27-9362-E19E057B189D,
         ImplementationUUID=CFDCDDB2-5B3F-412d-BDA4-80B23C721549
     ] Event {
@@ -34,7 +34,7 @@ module events {
         const unsigned short AT_TARGET           = 2;
         const unsigned short BUBBLING_PHASE      = 3;
 
-#if !defined(LANGUAGE_OBJECTIVE_C)
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
         // Reverse-engineered from Netscape
         const unsigned short MOUSEDOWN           = 1;
         const unsigned short MOUSEUP             = 2;
@@ -60,7 +60,7 @@ module events {
         readonly attribute unsigned short   eventPhase;
         readonly attribute boolean          bubbles;
         readonly attribute boolean          cancelable;
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         readonly attribute DOMTimeStamp     timeStamp;
 #endif
         void               stopPropagation();
@@ -74,7 +74,7 @@ module events {
                  attribute boolean          returnValue;
                  attribute boolean          cancelBubble;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         readonly attribute [Custom] Clipboard        clipboardData;
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/dom/EventException.idl b/src/3rdparty/webkit/WebCore/dom/EventException.idl
index 61cfd65..3d82f85 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventException.idl
+++ b/src/3rdparty/webkit/WebCore/dom/EventException.idl
@@ -30,14 +30,15 @@ module events {
 
     // Introduced in DOM Level 2:
     interface [
-        GenerateConstructor
+        GenerateConstructor,
+        NoStaticTables
     ] EventException {
 
         readonly attribute unsigned short   code;
         readonly attribute DOMString        name;
         readonly attribute DOMString        message;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // Override in a Mozilla compatible format
         [DontEnum] DOMString toString();
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/EventListener.h b/src/3rdparty/webkit/WebCore/dom/EventListener.h
index 24fce86..dbc41b2 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventListener.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventListener.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -23,6 +23,10 @@
 
 #include <wtf/RefCounted.h>
 
+namespace JSC {
+    class JSObject;
+}
+
 namespace WebCore {
 
     class Event;
@@ -31,10 +35,23 @@ namespace WebCore {
     public:
         virtual ~EventListener() { }
         virtual void handleEvent(Event*, bool isWindowEvent = false) = 0;
-        virtual bool isInline() const { return false; }
         virtual bool wasCreatedFromMarkup() const { return false; }
+
+#if USE(JSC)
+        virtual JSC::JSObject* jsFunction() const { return 0; }
+        virtual void markJSFunction() { }
+#endif
+
+        bool isAttribute() const { return virtualisAttribute(); }
+
+    private:
+        virtual bool virtualisAttribute() const { return false; }
     };
 
+#if USE(JSC)
+    inline void markIfNotNull(EventListener* listener) { if (listener) listener->markJSFunction(); }
+#endif
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/EventListener.idl b/src/3rdparty/webkit/WebCore/dom/EventListener.idl
index 9d28703..9dc2e0a 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventListener.idl
+++ b/src/3rdparty/webkit/WebCore/dom/EventListener.idl
@@ -22,6 +22,7 @@ module events {
 
     // Introduced in DOM Level 2:
     interface [
+        NoStaticTables,
         ObjCProtocol,
         InterfaceUUID=B04F2AE3-71E2-4ebe-ABFE-EF4938354082,
         ImplementationUUID=DDFDD342-A78B-4f19-8F32-A5DF51B56E08
diff --git a/src/3rdparty/webkit/WebCore/dom/EventNames.h b/src/3rdparty/webkit/WebCore/dom/EventNames.h
index 35c7571..9272ba4 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventNames.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventNames.h
@@ -68,6 +68,7 @@ namespace WebCore {
     macro(mouseup) \
     macro(mousewheel) \
     macro(noupdate) \
+    macro(obsolete) \
     macro(offline) \
     macro(online) \
     macro(overflowchanged) \
@@ -101,24 +102,26 @@ namespace WebCore {
     macro(webkitBeforeTextInserted) \
     macro(webkitEditableContentChanged) \
     \
-    macro(canshowcurrentframe) \
     macro(canplay) \
     macro(canplaythrough) \
-    macro(dataunavailable) \
     macro(durationchange) \
     macro(emptied) \
     macro(ended) \
-    macro(loadedfirstframe) \
+    macro(loadeddata) \
     macro(loadedmetadata) \
     macro(pause) \
     macro(play) \
+    macro(playing) \
     macro(ratechange) \
+    macro(seeked) \
+    macro(seeking) \
     macro(timeupdate) \
     macro(volumechange) \
     macro(waiting) \
     \
     macro(progress) \
     macro(stalled) \
+    macro(suspend) \
     \
     macro(webkitAnimationEnd) \
     macro(webkitAnimationStart) \
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp b/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
index dcebd64..06cea07 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/EventTarget.cpp
@@ -44,7 +44,12 @@ EventTarget::~EventTarget()
 {
 }
 
-EventTargetNode* EventTarget::toNode()
+Node* EventTarget::toNode()
+{
+    return 0;
+}
+
+DOMWindow* EventTarget::toDOMWindow()
 {
     return 0;
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTarget.h b/src/3rdparty/webkit/WebCore/dom/EventTarget.h
index 3a3ec84..662902e 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventTarget.h
+++ b/src/3rdparty/webkit/WebCore/dom/EventTarget.h
@@ -38,12 +38,13 @@ namespace WebCore {
 
     class AtomicString;
     class DOMApplicationCache;
+    class DOMWindow;
     class Event;
     class EventListener;
-    class EventTargetNode;
     class MessagePort;
-    class ScriptExecutionContext;
+    class Node;
     class SVGElementInstance;
+    class ScriptExecutionContext;
     class Worker;
     class WorkerContext;
     class XMLHttpRequest;
@@ -54,7 +55,8 @@ namespace WebCore {
     class EventTarget {
     public:
         virtual MessagePort* toMessagePort();
-        virtual EventTargetNode* toNode();
+        virtual Node* toNode();
+        virtual DOMWindow* toDOMWindow();
         virtual XMLHttpRequest* toXMLHttpRequest();
         virtual XMLHttpRequestUpload* toXMLHttpRequestUpload();
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTarget.idl b/src/3rdparty/webkit/WebCore/dom/EventTarget.idl
index d3f46f7..844dc32 100644
--- a/src/3rdparty/webkit/WebCore/dom/EventTarget.idl
+++ b/src/3rdparty/webkit/WebCore/dom/EventTarget.idl
@@ -26,13 +26,13 @@ module events {
         PureInterface,
         InterfaceUUID=1D71C7EC-0BA0-4044-BDFD-56B3E8F5F9D4
     ] EventTarget {
-        [OldStyleObjC, EventTargetNodeCast] void addEventListener(in DOMString type, 
+        [OldStyleObjC] void addEventListener(in DOMString type, 
                                              in EventListener listener, 
                                              in boolean useCapture);
-        [OldStyleObjC, EventTargetNodeCast] void removeEventListener(in DOMString type, 
+        [OldStyleObjC] void removeEventListener(in DOMString type, 
                                                 in EventListener listener, 
                                                 in boolean useCapture);
-        [EventTargetNodeCast] boolean dispatchEvent(in Event event)
+        boolean dispatchEvent(in Event event)
             raises(EventException);
     };
 
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTargetNode.cpp b/src/3rdparty/webkit/WebCore/dom/EventTargetNode.cpp
deleted file mode 100644
index 8553da7..0000000
--- a/src/3rdparty/webkit/WebCore/dom/EventTargetNode.cpp
+++ /dev/null
@@ -1,1166 +0,0 @@
-/*
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
- *           (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "EventTargetNode.h"
-
-#include "Document.h"
-#include "EventException.h"
-#include "EventHandler.h"
-#include "EventListener.h"
-#include "EventNames.h"
-#include "Frame.h"
-#include "FrameView.h"
-#include "KeyboardEvent.h"
-#include "MouseEvent.h"
-#include "MutationEvent.h"
-#include "NodeRareData.h"
-#include "Page.h"
-#include "PlatformMouseEvent.h"
-#include "PlatformWheelEvent.h"
-#include "ProgressEvent.h"
-#include "RegisteredEventListener.h"
-#include "ScriptController.h"
-#include "TextEvent.h"
-#include "WebKitAnimationEvent.h"
-#include "WebKitTransitionEvent.h"
-#include "WheelEvent.h"
-#include <wtf/HashSet.h>
-
-#if ENABLE(DOM_STORAGE)
-#include "StorageEvent.h"
-#endif
-
-#if ENABLE(SVG)
-#include "SVGElementInstance.h"
-#include "SVGUseElement.h"
-#endif
-
-namespace WebCore {
-    
-static HashSet<EventTargetNode*>* gNodesDispatchingSimulatedClicks = 0; 
-
-EventTargetNode::EventTargetNode(Document* doc, bool isElement, bool isContainer)
-    : Node(doc, isElement, isContainer)
-{
-}
-
-EventTargetNode::~EventTargetNode()
-{
-    if (!eventListeners().isEmpty() && !inDocument())
-        document()->unregisterDisconnectedNodeWithEventListeners(this);
-}
-
-ScriptExecutionContext* EventTargetNode::scriptExecutionContext() const
-{
-    return document();
-}
-
-const RegisteredEventListenerVector& EventTargetNode::eventListeners() const
-{
-    if (hasRareData()) {
-        if (RegisteredEventListenerVector* listeners = rareData()->listeners())
-            return *listeners;
-    }
-    static const RegisteredEventListenerVector* emptyListenersVector = new RegisteredEventListenerVector;
-    return *emptyListenersVector;
-}
-
-void EventTargetNode::insertedIntoDocument()
-{
-    if (!eventListeners().isEmpty())
-        document()->unregisterDisconnectedNodeWithEventListeners(this);
-
-    Node::insertedIntoDocument();
-}
-
-void EventTargetNode::removedFromDocument()
-{
-    if (!eventListeners().isEmpty())
-        document()->registerDisconnectedNodeWithEventListeners(this);
-
-    Node::removedFromDocument();
-}
-
-void EventTargetNode::willMoveToNewOwnerDocument()
-{
-    if (!eventListeners().isEmpty())
-        document()->unregisterDisconnectedNodeWithEventListeners(this);
-
-    Node::willMoveToNewOwnerDocument();
-}
-
-void EventTargetNode::didMoveToNewOwnerDocument()
-{
-    if (!eventListeners().isEmpty())
-        document()->registerDisconnectedNodeWithEventListeners(this);
-
-    Node::didMoveToNewOwnerDocument();
-}
-
-static inline void updateSVGElementInstancesAfterEventListenerChange(EventTargetNode* referenceNode)
-{
-    ASSERT(referenceNode);
-
-#if ENABLE(SVG)
-    if (!referenceNode->isSVGElement())
-        return;
-
-    // Elements living inside a <use> shadow tree, never cause any updates!
-    if (referenceNode->shadowTreeRootNode())
-        return;
-
-    // We're possibly (a child of) an element that is referenced by a <use> client
-    // If an event listeners changes on a referenced element, update all instances.
-    for (Node* node = referenceNode; node; node = node->parentNode()) {
-        if (!node->hasID() || !node->isSVGElement())
-            continue;
-
-        SVGElementInstance::invalidateAllInstancesOfElement(static_cast<SVGElement*>(node));
-        break;
-    }
-#endif
-}
-
-void EventTargetNode::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
-{
-    Document* document = this->document();
-    if (!document->attached())
-        return;
-
-    document->addListenerTypeIfNeeded(eventType);
-
-    RegisteredEventListenerVector& listeners = ensureRareData()->ensureListeners();
-
-    // Remove existing identical listener set with identical arguments.
-    // The DOM2 spec says that "duplicate instances are discarded" in this case.
-    removeEventListener(eventType, listener.get(), useCapture);
-
-    // adding the first one
-    if (listeners.isEmpty() && !inDocument())
-        document->registerDisconnectedNodeWithEventListeners(this);
-
-    listeners.append(RegisteredEventListener::create(eventType, listener, useCapture));
-    updateSVGElementInstancesAfterEventListenerChange(this);
-}
-
-void EventTargetNode::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
-{
-    if (!hasRareData())
-        return;
-
-    RegisteredEventListenerVector* listeners = rareData()->listeners();
-    if (!listeners)
-        return;
-
-    size_t size = listeners->size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *listeners->at(i);
-        if (r.eventType() == eventType && r.listener() == listener && r.useCapture() == useCapture) {
-            r.setRemoved(true);
-            listeners->remove(i);
-
-            // removed last
-            if (listeners->isEmpty() && !inDocument())
-                document()->unregisterDisconnectedNodeWithEventListeners(this);
-
-            updateSVGElementInstancesAfterEventListenerChange(this);
-            return;
-        }
-    }
-}
-
-void EventTargetNode::removeAllEventListeners()
-{
-    if (!hasRareData())
-        return;
-
-    RegisteredEventListenerVector* listeners = rareData()->listeners();
-    if (!listeners)
-        return;
-
-    size_t size = listeners->size();
-    for (size_t i = 0; i < size; ++i)
-        listeners->at(i)->setRemoved(true);
-    listeners->clear();
-}
-
-void EventTargetNode::handleLocalEvents(Event* event, bool useCapture)
-{
-    if (disabled() && event->isMouseEvent())
-        return;
-
-    RegisteredEventListenerVector listenersCopy = eventListeners();
-    size_t size = listenersCopy.size();
-    for (size_t i = 0; i < size; ++i) {
-        const RegisteredEventListener& r = *listenersCopy[i];
-        if (r.eventType() == event->type() && r.useCapture() == useCapture && !r.removed())
-            r.listener()->handleEvent(event, false);
-    }
-}
-
-#if ENABLE(SVG)
-static inline SVGElementInstance* eventTargetAsSVGElementInstance(EventTargetNode* referenceNode)
-{
-    ASSERT(referenceNode);
-    if (!referenceNode->isSVGElement())
-        return 0;
-
-    // Spec: The event handling for the non-exposed tree works as if the referenced element had been textually included
-    // as a deeply cloned child of the 'use' element, except that events are dispatched to the SVGElementInstance objects
-    for (Node* n = referenceNode; n; n = n->parentNode()) {
-        if (!n->isShadowNode() || !n->isSVGElement())
-            continue;
-
-        Node* shadowTreeParentElement = n->shadowParentNode();
-        ASSERT(shadowTreeParentElement->hasTagName(SVGNames::useTag));
-
-        if (SVGElementInstance* instance = static_cast<SVGUseElement*>(shadowTreeParentElement)->instanceForShadowTreeElement(referenceNode))
-            return instance;
-    }
-
-    return 0;
-}
-#endif
-
-static inline EventTarget* eventTargetRespectingSVGTargetRules(EventTargetNode* referenceNode)
-{
-    ASSERT(referenceNode);
-
-#if ENABLE(SVG)
-    if (SVGElementInstance* instance = eventTargetAsSVGElementInstance(referenceNode)) {
-        ASSERT(instance->shadowTreeElement() == referenceNode);
-        return instance;
-    }
-#endif
-
-    return referenceNode;
-}
-
-bool EventTargetNode::dispatchEvent(PassRefPtr<Event> e, ExceptionCode& ec)
-{
-    RefPtr<Event> evt(e);
-    ASSERT(!eventDispatchForbidden());
-    if (!evt || evt->type().isEmpty()) { 
-        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
-        return false;
-    }
-
-    evt->setTarget(eventTargetRespectingSVGTargetRules(this));
-
-    RefPtr<FrameView> view = document()->view();
-    return dispatchGenericEvent(evt.release(), ec);
-}
-
-bool EventTargetNode::dispatchGenericEvent(PassRefPtr<Event> prpEvent, ExceptionCode& ec)
-{
-    RefPtr<Event> event(prpEvent);
-
-    ASSERT(!eventDispatchForbidden());
-    ASSERT(event->target());
-    ASSERT(!event->type().isNull()); // JavaScript code can create an event with an empty name, but not null.
-
-    // Make a vector of ancestors to send the event to.
-    // If the node is not in a document just send the event to it.
-    // Be sure to ref all of nodes since event handlers could result in the last reference going away.
-    RefPtr<EventTargetNode> thisNode(this);
-    Vector<RefPtr<ContainerNode> > ancestors;
-    if (inDocument()) {
-        for (ContainerNode* ancestor = eventParentNode(); ancestor; ancestor = ancestor->eventParentNode()) {
-#if ENABLE(SVG)
-            // Skip <use> shadow tree elements.
-            if (ancestor->isSVGElement() && ancestor->isShadowNode())
-                continue;
-#endif
-            ancestors.append(ancestor);
-        }
-    }
-
-    // Set up a pointer to indicate whether to dispatch window events.
-    // We don't dispatch load events to the window. That quirk was originally
-    // added because Mozilla doesn't propagate load events to the window object.
-    Document* documentForWindowEvents = 0;
-    if (event->type() != eventNames().loadEvent) {
-        EventTargetNode* topLevelContainer = ancestors.isEmpty() ? this : ancestors.last().get();
-        if (topLevelContainer->isDocumentNode())
-            documentForWindowEvents = static_cast<Document*>(topLevelContainer);
-    }
-
-    // Give the target node a chance to do some work before DOM event handlers get a crack.
-    void* data = preDispatchEventHandler(event.get());
-    if (event->propagationStopped())
-        goto doneDispatching;
-
-    // Trigger capturing event handlers, starting at the top and working our way down.
-    event->setEventPhase(Event::CAPTURING_PHASE);
-
-    if (documentForWindowEvents) {
-        event->setCurrentTarget(documentForWindowEvents);
-        documentForWindowEvents->handleWindowEvent(event.get(), true);
-        if (event->propagationStopped())
-            goto doneDispatching;
-    }
-    for (size_t i = ancestors.size(); i; --i) {
-        ContainerNode* ancestor = ancestors[i - 1].get();
-        event->setCurrentTarget(eventTargetRespectingSVGTargetRules(ancestor));
-        ancestor->handleLocalEvents(event.get(), true);
-        if (event->propagationStopped())
-            goto doneDispatching;
-    }
-
-    event->setEventPhase(Event::AT_TARGET);
-
-    // We do want capturing event listeners to be invoked here, even though
-    // that violates some versions of the DOM specification; Mozilla does it.
-    event->setCurrentTarget(eventTargetRespectingSVGTargetRules(this));
-    handleLocalEvents(event.get(), true);
-    if (event->propagationStopped())
-        goto doneDispatching;
-    handleLocalEvents(event.get(), false);
-    if (event->propagationStopped())
-        goto doneDispatching;
-
-    if (event->bubbles() && !event->cancelBubble()) {
-        // Trigger bubbling event handlers, starting at the bottom and working our way up.
-        event->setEventPhase(Event::BUBBLING_PHASE);
-
-        size_t size = ancestors.size();
-        for (size_t i = 0; i < size; ++i) {
-            ContainerNode* ancestor = ancestors[i].get();
-            event->setCurrentTarget(eventTargetRespectingSVGTargetRules(ancestor));
-            ancestor->handleLocalEvents(event.get(), false);
-            if (event->propagationStopped() || event->cancelBubble())
-                goto doneDispatching;
-        }
-        if (documentForWindowEvents) {
-            event->setCurrentTarget(documentForWindowEvents);
-            documentForWindowEvents->handleWindowEvent(event.get(), false);
-            if (event->propagationStopped() || event->cancelBubble())
-                goto doneDispatching;
-        }
-    }
-
-doneDispatching:
-    event->setCurrentTarget(0);
-    event->setEventPhase(0);
-
-    // Pass the data from the preDispatchEventHandler to the postDispatchEventHandler.
-    postDispatchEventHandler(event.get(), data);
-
-    // Call default event handlers. While the DOM does have a concept of preventing
-    // default handling, the detail of which handlers are called is an internal
-    // implementation detail and not part of the DOM.
-    if (!event->defaultPrevented() && !event->defaultHandled()) {
-        // Non-bubbling events call only one default event handler, the one for the target.
-        defaultEventHandler(event.get());
-        ASSERT(!event->defaultPrevented());
-        if (event->defaultHandled())
-            goto doneWithDefault;
-        // For bubbling events, call default event handlers on the same targets in the
-        // same order as the bubbling phase.
-        if (event->bubbles()) {
-            size_t size = ancestors.size();
-            for (size_t i = 0; i < size; ++i) {
-                ContainerNode* ancestor = ancestors[i].get();
-                ancestor->defaultEventHandler(event.get());
-                ASSERT(!event->defaultPrevented());
-                if (event->defaultHandled())
-                    goto doneWithDefault;
-            }
-        }
-    }
-
-doneWithDefault:
-    Document::updateDocumentsRendering();
-
-    return !event->defaultPrevented();
-}
-
-bool EventTargetNode::dispatchSubtreeModifiedEvent()
-{
-    ASSERT(!eventDispatchForbidden());
-    
-    document()->incDOMTreeVersion();
-
-    notifyNodeListsAttributeChanged(); // FIXME: Can do better some day. Really only care about the name attribute changing.
-    
-    if (!document()->hasListenerType(Document::DOMSUBTREEMODIFIED_LISTENER))
-        return false;
-    ExceptionCode ec = 0;
-    return dispatchEvent(MutationEvent::create(eventNames().DOMSubtreeModifiedEvent, true, false, 0, String(), String(), String(), 0), ec);
-}
-
-void EventTargetNode::dispatchWindowEvent(PassRefPtr<Event> e)
-{
-    ASSERT(!eventDispatchForbidden());
-    RefPtr<Event> evt(e);
-    RefPtr<Document> doc = document();
-    evt->setTarget(doc);
-    doc->handleWindowEvent(evt.get(), true);
-    doc->handleWindowEvent(evt.get(), false);
-}
-
-void EventTargetNode::dispatchWindowEvent(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg)
-{
-    ASSERT(!eventDispatchForbidden());
-    RefPtr<Document> doc = document();
-    dispatchWindowEvent(Event::create(eventType, canBubbleArg, cancelableArg));
-    
-    if (eventType == eventNames().loadEvent) {
-        // For onload events, send a separate load event to the enclosing frame only.
-        // This is a DOM extension and is independent of bubbling/capturing rules of
-        // the DOM.
-        Element* ownerElement = doc->ownerElement();
-        if (ownerElement) {
-            RefPtr<Event> ownerEvent = Event::create(eventType, false, cancelableArg);
-            ownerEvent->setTarget(ownerElement);
-            ExceptionCode ec = 0;
-            ownerElement->dispatchGenericEvent(ownerEvent.release(), ec);
-        }
-    }
-}
-
-bool EventTargetNode::dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr<Event> underlyingEvent)
-{
-    ASSERT(!eventDispatchForbidden());
-    ASSERT(eventType == eventNames().DOMFocusInEvent || eventType == eventNames().DOMFocusOutEvent || eventType == eventNames().DOMActivateEvent);
-    
-    bool cancelable = eventType == eventNames().DOMActivateEvent;
-    
-    ExceptionCode ec = 0;
-    RefPtr<UIEvent> evt = UIEvent::create(eventType, true, cancelable, document()->defaultView(), detail);
-    evt->setUnderlyingEvent(underlyingEvent);
-    return dispatchEvent(evt.release(), ec);
-}
-
-bool EventTargetNode::dispatchKeyEvent(const PlatformKeyboardEvent& key)
-{
-    ASSERT(!eventDispatchForbidden());
-    ExceptionCode ec = 0;
-    RefPtr<KeyboardEvent> keyboardEvent = KeyboardEvent::create(key, document()->defaultView());
-    bool r = dispatchEvent(keyboardEvent, ec);
-    
-    // we want to return false if default is prevented (already taken care of)
-    // or if the element is default-handled by the DOM. Otherwise we let it just
-    // let it get handled by AppKit 
-    if (keyboardEvent->defaultHandled())
-        r = false;
-    
-    return r;
-}
-
-bool EventTargetNode::dispatchMouseEvent(const PlatformMouseEvent& event, const AtomicString& eventType,
-    int detail, Node* relatedTarget)
-{
-    ASSERT(!eventDispatchForbidden());
-    
-    IntPoint contentsPos;
-    if (FrameView* view = document()->view())
-        contentsPos = view->windowToContents(event.pos());
-
-    short button = event.button();
-
-    ASSERT(event.eventType() == MouseEventMoved || button != NoButton);
-    
-    return dispatchMouseEvent(eventType, button, detail,
-        contentsPos.x(), contentsPos.y(), event.globalX(), event.globalY(),
-        event.ctrlKey(), event.altKey(), event.shiftKey(), event.metaKey(),
-        false, relatedTarget);
-}
-
-void EventTargetNode::dispatchSimulatedMouseEvent(const AtomicString& eventType,
-    PassRefPtr<Event> underlyingEvent)
-{
-    ASSERT(!eventDispatchForbidden());
-
-    bool ctrlKey = false;
-    bool altKey = false;
-    bool shiftKey = false;
-    bool metaKey = false;
-    if (UIEventWithKeyState* keyStateEvent = findEventWithKeyState(underlyingEvent.get())) {
-        ctrlKey = keyStateEvent->ctrlKey();
-        altKey = keyStateEvent->altKey();
-        shiftKey = keyStateEvent->shiftKey();
-        metaKey = keyStateEvent->metaKey();
-    }
-
-    // Like Gecko, we just pass 0 for everything when we make a fake mouse event.
-    // Internet Explorer instead gives the current mouse position and state.
-    dispatchMouseEvent(eventType, 0, 0, 0, 0, 0, 0,
-        ctrlKey, altKey, shiftKey, metaKey, true, 0, underlyingEvent);
-}
-
-void EventTargetNode::dispatchSimulatedClick(PassRefPtr<Event> event, bool sendMouseEvents, bool showPressedLook)
-{
-    if (!gNodesDispatchingSimulatedClicks)
-        gNodesDispatchingSimulatedClicks = new HashSet<EventTargetNode*>;
-    else if (gNodesDispatchingSimulatedClicks->contains(this))
-        return;
-    
-    gNodesDispatchingSimulatedClicks->add(this);
-    
-    // send mousedown and mouseup before the click, if requested
-    if (sendMouseEvents)
-        dispatchSimulatedMouseEvent(eventNames().mousedownEvent, event.get());
-    setActive(true, showPressedLook);
-    if (sendMouseEvents)
-        dispatchSimulatedMouseEvent(eventNames().mouseupEvent, event.get());
-    setActive(false);
-
-    // always send click
-    dispatchSimulatedMouseEvent(eventNames().clickEvent, event);
-    
-    gNodesDispatchingSimulatedClicks->remove(this);
-}
-
-bool EventTargetNode::dispatchMouseEvent(const AtomicString& eventType, int button, int detail,
-    int pageX, int pageY, int screenX, int screenY,
-    bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, 
-    bool isSimulated, Node* relatedTargetArg, PassRefPtr<Event> underlyingEvent)
-{
-    ASSERT(!eventDispatchForbidden());
-    if (disabled()) // Don't even send DOM events for disabled controls..
-        return true;
-    
-    if (eventType.isEmpty())
-        return false; // Shouldn't happen.
-    
-    // Dispatching the first event can easily result in this node being destroyed.
-    // Since we dispatch up to three events here, we need to make sure we're referenced
-    // so the pointer will be good for the two subsequent ones.
-    RefPtr<Node> protect(this);
-    
-    bool cancelable = eventType != eventNames().mousemoveEvent;
-    
-    ExceptionCode ec = 0;
-    
-    bool swallowEvent = false;
-    
-    // Attempting to dispatch with a non-EventTarget relatedTarget causes the relatedTarget to be silently ignored.
-    RefPtr<EventTargetNode> relatedTarget = (relatedTargetArg && relatedTargetArg->isEventTargetNode())
-        ? static_cast<EventTargetNode*>(relatedTargetArg) : 0;
-
-    if (Frame* frame = document()->frame()) {
-        float pageZoom = frame->pageZoomFactor();
-        if (pageZoom != 1.0f) {
-            // Adjust our pageX and pageY to account for the page zoom.
-            pageX = lroundf(pageX / pageZoom);
-            pageY = lroundf(pageY / pageZoom);
-        }
-    }
-
-    RefPtr<Event> mouseEvent = MouseEvent::create(eventType,
-        true, cancelable, document()->defaultView(),
-        detail, screenX, screenY, pageX, pageY,
-        ctrlKey, altKey, shiftKey, metaKey, button,
-        relatedTarget, 0, isSimulated);
-    mouseEvent->setUnderlyingEvent(underlyingEvent.get());
-    
-    dispatchEvent(mouseEvent, ec);
-    bool defaultHandled = mouseEvent->defaultHandled();
-    bool defaultPrevented = mouseEvent->defaultPrevented();
-    if (defaultHandled || defaultPrevented)
-        swallowEvent = true;
-    
-    // Special case: If it's a double click event, we also send the dblclick event. This is not part
-    // of the DOM specs, but is used for compatibility with the ondblclick="" attribute.  This is treated
-    // as a separate event in other DOM-compliant browsers like Firefox, and so we do the same.
-    if (eventType == eventNames().clickEvent && detail == 2) {
-        RefPtr<Event> doubleClickEvent = MouseEvent::create(eventNames().dblclickEvent,
-            true, cancelable, document()->defaultView(),
-            detail, screenX, screenY, pageX, pageY,
-            ctrlKey, altKey, shiftKey, metaKey, button,
-            relatedTarget, 0, isSimulated);
-        doubleClickEvent->setUnderlyingEvent(underlyingEvent.get());
-        if (defaultHandled)
-            doubleClickEvent->setDefaultHandled();
-        dispatchEvent(doubleClickEvent, ec);
-        if (doubleClickEvent->defaultHandled() || doubleClickEvent->defaultPrevented())
-            swallowEvent = true;
-    }
-
-    return swallowEvent;
-}
-
-void EventTargetNode::dispatchWheelEvent(PlatformWheelEvent& e)
-{
-    ASSERT(!eventDispatchForbidden());
-    if (e.deltaX() == 0 && e.deltaY() == 0)
-        return;
-    
-    FrameView* view = document()->view();
-    if (!view)
-        return;
-    
-    IntPoint pos = view->windowToContents(e.pos());
-    
-    // Convert the deltas from pixels to lines if we have a pixel scroll event.
-    float deltaX = e.deltaX();
-    float deltaY = e.deltaY();
-    
-    // FIXME: Should we do anything with a ScrollByPageWheelEvent here?
-    // It will be treated like a line scroll of 1 right now.
-    if (e.granularity() == ScrollByPixelWheelEvent) {
-        deltaX /= cMouseWheelPixelsPerLineStep;
-        deltaY /= cMouseWheelPixelsPerLineStep;
-    }
-
-    RefPtr<WheelEvent> we = WheelEvent::create(e.deltaX(), e.deltaY(),
-        document()->defaultView(), e.globalX(), e.globalY(), pos.x(), pos.y(),
-        e.ctrlKey(), e.altKey(), e.shiftKey(), e.metaKey());
-    ExceptionCode ec = 0;
-    if (!dispatchEvent(we.release(), ec))
-        e.accept();
-}
-
-bool EventTargetNode::dispatchWebKitAnimationEvent(const AtomicString& eventType, const String& animationName, double elapsedTime)
-{
-    ASSERT(!eventDispatchForbidden());
-    
-    ExceptionCode ec = 0;
-    return dispatchEvent(WebKitAnimationEvent::create(eventType, animationName, elapsedTime), ec);
-}
-
-bool EventTargetNode::dispatchWebKitTransitionEvent(const AtomicString& eventType, const String& propertyName, double elapsedTime)
-{
-    ASSERT(!eventDispatchForbidden());
-    
-    ExceptionCode ec = 0;
-    return dispatchEvent(WebKitTransitionEvent::create(eventType, propertyName, elapsedTime), ec);
-}
-
-void EventTargetNode::dispatchFocusEvent()
-{
-    dispatchEventForType(eventNames().focusEvent, false, false);
-}
-
-void EventTargetNode::dispatchBlurEvent()
-{
-    dispatchEventForType(eventNames().blurEvent, false, false);
-}
-
-bool EventTargetNode::dispatchEventForType(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg)
-{
-    ASSERT(!eventDispatchForbidden());
-    ExceptionCode ec = 0;
-    return dispatchEvent(Event::create(eventType, canBubbleArg, cancelableArg), ec);
-}
-
-bool EventTargetNode::dispatchProgressEvent(const AtomicString &eventType, bool lengthComputableArg, unsigned loadedArg, unsigned totalArg)
-{
-    ASSERT(!eventDispatchForbidden());
-    ExceptionCode ec = 0;
-    return dispatchEvent(ProgressEvent::create(eventType, lengthComputableArg, loadedArg, totalArg), ec);
-}
-
-void EventTargetNode::dispatchStorageEvent(const AtomicString &eventType, const String& key, const String& oldValue, const String& newValue, Frame* source)
-{
-#if ENABLE(DOM_STORAGE)
-    ASSERT(!eventDispatchForbidden());
-    ExceptionCode ec = 0;
-    dispatchEvent(StorageEvent::create(eventType, key, oldValue, newValue, source->document()->documentURI(), source->domWindow()), ec);
-#endif
-}
-
-void EventTargetNode::removeInlineEventListenerForType(const AtomicString& eventType)
-{
-    if (!hasRareData())
-        return;
-
-    RegisteredEventListenerVector* listeners = rareData()->listeners();
-    if (!listeners)
-        return;
-
-    size_t size = listeners->size();
-    for (size_t i = 0; i < size; ++i) {
-        RegisteredEventListener& r = *listeners->at(i);
-        if (r.eventType() != eventType || !r.listener()->isInline())
-            continue;
-
-        r.setRemoved(true);
-        listeners->remove(i);
-
-        // removed last
-        if (listeners->isEmpty() && !inDocument())
-            document()->unregisterDisconnectedNodeWithEventListeners(this);
-
-        updateSVGElementInstancesAfterEventListenerChange(this);
-        return;
-    }
-}
-
-void EventTargetNode::setInlineEventListenerForType(const AtomicString& eventType, PassRefPtr<EventListener> listener)
-{
-    // In case we are the only one holding a reference to it, we don't want removeInlineEventListenerForType to destroy it.
-    removeInlineEventListenerForType(eventType);
-    if (listener)
-        addEventListener(eventType, listener, false);
-}
-
-void EventTargetNode::setInlineEventListenerForTypeAndAttribute(const AtomicString& eventType, Attribute* attr)
-{
-    setInlineEventListenerForType(eventType, document()->createEventListener(attr->localName().string(), attr->value(), this));
-}
-
-EventListener* EventTargetNode::inlineEventListenerForType(const AtomicString& eventType) const
-{
-    const RegisteredEventListenerVector& listeners = eventListeners();
-    size_t size = listeners.size();
-    for (size_t i = 0; i < size; ++i) {
-        const RegisteredEventListener& r = *listeners[i];
-        if (r.eventType() == eventType && r.listener()->isInline())
-            return r.listener();
-    }
-    return 0;
-}
-
-bool EventTargetNode::disabled() const
-{
-    return false;
-}
-
-void EventTargetNode::defaultEventHandler(Event* event)
-{
-    if (event->target() != this)
-        return;
-    const AtomicString& eventType = event->type();
-    if (eventType == eventNames().keydownEvent || eventType == eventNames().keypressEvent) {
-        if (event->isKeyboardEvent())
-            if (Frame* frame = document()->frame())
-                frame->eventHandler()->defaultKeyboardEventHandler(static_cast<KeyboardEvent*>(event));
-    } else if (eventType == eventNames().clickEvent) {
-        int detail = event->isUIEvent() ? static_cast<UIEvent*>(event)->detail() : 0;
-        dispatchUIEvent(eventNames().DOMActivateEvent, detail, event);
-    } else if (eventType == eventNames().contextmenuEvent) {
-        if (Frame* frame = document()->frame())
-            if (Page* page = frame->page())
-                page->contextMenuController()->handleContextMenuEvent(event);
-    } else if (eventType == eventNames().textInputEvent) {
-        if (event->isTextEvent())
-            if (Frame* frame = document()->frame())
-                frame->eventHandler()->defaultTextInputEventHandler(static_cast<TextEvent*>(event));
-    }
-}
-
-EventListener* EventTargetNode::onabort() const
-{
-    return inlineEventListenerForType(eventNames().abortEvent);
-}
-
-void EventTargetNode::setOnabort(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().abortEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onblur() const
-{
-    return inlineEventListenerForType(eventNames().blurEvent);
-}
-
-void EventTargetNode::setOnblur(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().blurEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onchange() const
-{
-    return inlineEventListenerForType(eventNames().changeEvent);
-}
-
-void EventTargetNode::setOnchange(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().changeEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onclick() const
-{
-    return inlineEventListenerForType(eventNames().clickEvent);
-}
-
-void EventTargetNode::setOnclick(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().clickEvent, eventListener);
-}
-
-EventListener* EventTargetNode::oncontextmenu() const
-{
-    return inlineEventListenerForType(eventNames().contextmenuEvent);
-}
-
-void EventTargetNode::setOncontextmenu(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().contextmenuEvent, eventListener);
-}
-
-EventListener* EventTargetNode::ondblclick() const
-{
-    return inlineEventListenerForType(eventNames().dblclickEvent);
-}
-
-void EventTargetNode::setOndblclick(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().dblclickEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onerror() const
-{
-    return inlineEventListenerForType(eventNames().errorEvent);
-}
-
-void EventTargetNode::setOnerror(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().errorEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onfocus() const
-{
-    return inlineEventListenerForType(eventNames().focusEvent);
-}
-
-void EventTargetNode::setOnfocus(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().focusEvent, eventListener);
-}
-
-EventListener* EventTargetNode::oninput() const
-{
-    return inlineEventListenerForType(eventNames().inputEvent);
-}
-
-void EventTargetNode::setOninput(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().inputEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onkeydown() const
-{
-    return inlineEventListenerForType(eventNames().keydownEvent);
-}
-
-void EventTargetNode::setOnkeydown(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().keydownEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onkeypress() const
-{
-    return inlineEventListenerForType(eventNames().keypressEvent);
-}
-
-void EventTargetNode::setOnkeypress(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().keypressEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onkeyup() const
-{
-    return inlineEventListenerForType(eventNames().keyupEvent);
-}
-
-void EventTargetNode::setOnkeyup(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().keyupEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onload() const
-{
-    return inlineEventListenerForType(eventNames().loadEvent);
-}
-
-void EventTargetNode::setOnload(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().loadEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onmousedown() const
-{
-    return inlineEventListenerForType(eventNames().mousedownEvent);
-}
-
-void EventTargetNode::setOnmousedown(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().mousedownEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onmousemove() const
-{
-    return inlineEventListenerForType(eventNames().mousemoveEvent);
-}
-
-void EventTargetNode::setOnmousemove(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().mousemoveEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onmouseout() const
-{
-    return inlineEventListenerForType(eventNames().mouseoutEvent);
-}
-
-void EventTargetNode::setOnmouseout(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().mouseoutEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onmouseover() const
-{
-    return inlineEventListenerForType(eventNames().mouseoverEvent);
-}
-
-void EventTargetNode::setOnmouseover(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().mouseoverEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onmouseup() const
-{
-    return inlineEventListenerForType(eventNames().mouseupEvent);
-}
-
-void EventTargetNode::setOnmouseup(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().mouseupEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onmousewheel() const
-{
-    return inlineEventListenerForType(eventNames().mousewheelEvent);
-}
-
-void EventTargetNode::setOnmousewheel(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().mousewheelEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onbeforecut() const
-{
-    return inlineEventListenerForType(eventNames().beforecutEvent);
-}
-
-void EventTargetNode::setOnbeforecut(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().beforecutEvent, eventListener);
-}
-
-EventListener* EventTargetNode::oncut() const
-{
-    return inlineEventListenerForType(eventNames().cutEvent);
-}
-
-void EventTargetNode::setOncut(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().cutEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onbeforecopy() const
-{
-    return inlineEventListenerForType(eventNames().beforecopyEvent);
-}
-
-void EventTargetNode::setOnbeforecopy(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().beforecopyEvent, eventListener);
-}
-
-EventListener* EventTargetNode::oncopy() const
-{
-    return inlineEventListenerForType(eventNames().copyEvent);
-}
-
-void EventTargetNode::setOncopy(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().copyEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onbeforepaste() const
-{
-    return inlineEventListenerForType(eventNames().beforepasteEvent);
-}
-
-void EventTargetNode::setOnbeforepaste(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().beforepasteEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onpaste() const
-{
-    return inlineEventListenerForType(eventNames().pasteEvent);
-}
-
-void EventTargetNode::setOnpaste(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().pasteEvent, eventListener);
-}
-
-EventListener* EventTargetNode::ondragenter() const
-{
-    return inlineEventListenerForType(eventNames().dragenterEvent);
-}
-
-void EventTargetNode::setOndragenter(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().dragenterEvent, eventListener);
-}
-
-EventListener* EventTargetNode::ondragover() const
-{
-    return inlineEventListenerForType(eventNames().dragoverEvent);
-}
-
-void EventTargetNode::setOndragover(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().dragoverEvent, eventListener);
-}
-
-EventListener* EventTargetNode::ondragleave() const
-{
-    return inlineEventListenerForType(eventNames().dragleaveEvent);
-}
-
-void EventTargetNode::setOndragleave(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().dragleaveEvent, eventListener);
-}
-
-EventListener* EventTargetNode::ondrop() const
-{
-    return inlineEventListenerForType(eventNames().dropEvent);
-}
-
-void EventTargetNode::setOndrop(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().dropEvent, eventListener);
-}
-
-EventListener* EventTargetNode::ondragstart() const
-{
-    return inlineEventListenerForType(eventNames().dragstartEvent);
-}
-
-void EventTargetNode::setOndragstart(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().dragstartEvent, eventListener);
-}
-
-EventListener* EventTargetNode::ondrag() const
-{
-    return inlineEventListenerForType(eventNames().dragEvent);
-}
-
-void EventTargetNode::setOndrag(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().dragEvent, eventListener);
-}
-
-EventListener* EventTargetNode::ondragend() const
-{
-    return inlineEventListenerForType(eventNames().dragendEvent);
-}
-
-void EventTargetNode::setOndragend(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().dragendEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onreset() const
-{
-    return inlineEventListenerForType(eventNames().resetEvent);
-}
-
-void EventTargetNode::setOnreset(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().resetEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onresize() const
-{
-    return inlineEventListenerForType(eventNames().resizeEvent);
-}
-
-void EventTargetNode::setOnresize(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().resizeEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onscroll() const
-{
-    return inlineEventListenerForType(eventNames().scrollEvent);
-}
-
-void EventTargetNode::setOnscroll(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().scrollEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onsearch() const
-{
-    return inlineEventListenerForType(eventNames().searchEvent);
-}
-
-void EventTargetNode::setOnsearch(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().searchEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onselect() const
-{
-    return inlineEventListenerForType(eventNames().selectEvent);
-}
-
-void EventTargetNode::setOnselect(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().selectEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onselectstart() const
-{
-    return inlineEventListenerForType(eventNames().selectstartEvent);
-}
-
-void EventTargetNode::setOnselectstart(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().selectstartEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onsubmit() const
-{
-    return inlineEventListenerForType(eventNames().submitEvent);
-}
-
-void EventTargetNode::setOnsubmit(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().submitEvent, eventListener);
-}
-
-EventListener* EventTargetNode::onunload() const
-{
-    return inlineEventListenerForType(eventNames().unloadEvent);
-}
-
-void EventTargetNode::setOnunload(PassRefPtr<EventListener> eventListener)
-{
-    setInlineEventListenerForType(eventNames().unloadEvent, eventListener);
-}
-
-} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTargetNode.h b/src/3rdparty/webkit/WebCore/dom/EventTargetNode.h
deleted file mode 100644
index 201b108..0000000
--- a/src/3rdparty/webkit/WebCore/dom/EventTargetNode.h
+++ /dev/null
@@ -1,206 +0,0 @@
-/*
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
- *           (C) 2007, 2008 Nikolas Zimmermann <zimmermann@kde.org>
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef EventTargetNode_h
-#define EventTargetNode_h
-
-#include "EventTarget.h"
-#include "Node.h"
-
-namespace WebCore {
-
-class Attribute;
-class Frame;
-class RegisteredEventListener;
-
-typedef Vector<RefPtr<RegisteredEventListener> > RegisteredEventListenerVector;
-
-class EventTargetNode : public Node, public EventTarget {
-public:
-    EventTargetNode(Document*, bool isElement = false, bool isContainer = false);
-    virtual ~EventTargetNode();
-
-    virtual bool isEventTargetNode() const { return true; }
-    virtual EventTargetNode* toNode() { return this; }
-
-    virtual ScriptExecutionContext* scriptExecutionContext() const;
-
-    virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
-    virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
-    virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
-    void removeAllEventListeners();
-
-    void setInlineEventListenerForType(const AtomicString& eventType, PassRefPtr<EventListener>);
-    void setInlineEventListenerForTypeAndAttribute(const AtomicString& eventType, Attribute*);
-    void removeInlineEventListenerForType(const AtomicString& eventType);
-    bool dispatchEventForType(const AtomicString& eventType, bool canBubble, bool cancelable);
-    EventListener* inlineEventListenerForType(const AtomicString& eventType) const;
-
-    bool dispatchSubtreeModifiedEvent();
-    void dispatchWindowEvent(PassRefPtr<Event>);
-    void dispatchWindowEvent(const AtomicString& eventType, bool canBubble, bool cancelable);
-    bool dispatchUIEvent(const AtomicString& eventType, int detail = 0, PassRefPtr<Event> underlyingEvent = 0);
-    bool dispatchKeyEvent(const PlatformKeyboardEvent&);
-    void dispatchWheelEvent(PlatformWheelEvent&);
-    bool dispatchMouseEvent(const PlatformMouseEvent&, const AtomicString& eventType,
-        int clickCount = 0, Node* relatedTarget = 0);
-    bool dispatchMouseEvent(const AtomicString& eventType, int button, int clickCount,
-        int pageX, int pageY, int screenX, int screenY,
-        bool ctrlKey, bool altKey, bool shiftKey, bool metaKey,
-        bool isSimulated = false, Node* relatedTarget = 0, PassRefPtr<Event> underlyingEvent = 0);
-    void dispatchSimulatedMouseEvent(const AtomicString& eventType, PassRefPtr<Event> underlyingEvent = 0);
-    void dispatchSimulatedClick(PassRefPtr<Event> underlyingEvent, bool sendMouseEvents = false, bool showPressedLook = true);
-    bool dispatchProgressEvent(const AtomicString &eventType, bool lengthComputableArg, unsigned loadedArg, unsigned totalArg);
-    void dispatchStorageEvent(const AtomicString &eventType, const String& key, const String& oldValue, const String& newValue, Frame* source);
-    bool dispatchWebKitAnimationEvent(const AtomicString& eventType, const String& animationName, double elapsedTime);
-    bool dispatchWebKitTransitionEvent(const AtomicString& eventType, const String& propertyName, double elapsedTime);
-    bool dispatchGenericEvent(PassRefPtr<Event>, ExceptionCode&);
-
-    virtual void handleLocalEvents(Event*, bool useCapture);
-
-    virtual void dispatchFocusEvent();
-    virtual void dispatchBlurEvent();
-
-    virtual void insertedIntoDocument();
-    virtual void removedFromDocument();
-    virtual void willMoveToNewOwnerDocument();
-    virtual void didMoveToNewOwnerDocument();
-
-    /**
-     * Perform the default action for an event e.g. submitting a form
-     */
-    virtual void defaultEventHandler(Event*);
-
-    /**
-     * Used for disabled form elements; if true, prevents mouse events from being dispatched
-     * to event listeners, and prevents DOMActivate events from being sent at all.
-     */
-    virtual bool disabled() const;
-
-    const RegisteredEventListenerVector& eventListeners() const;
-
-    EventListener* onabort() const;
-    void setOnabort(PassRefPtr<EventListener>);
-    EventListener* onblur() const;
-    void setOnblur(PassRefPtr<EventListener>);
-    EventListener* onchange() const;
-    void setOnchange(PassRefPtr<EventListener>);
-    EventListener* onclick() const;
-    void setOnclick(PassRefPtr<EventListener>);
-    EventListener* oncontextmenu() const;
-    void setOncontextmenu(PassRefPtr<EventListener>);
-    EventListener* ondblclick() const;
-    void setOndblclick(PassRefPtr<EventListener>);
-    EventListener* onerror() const;
-    void setOnerror(PassRefPtr<EventListener>);
-    EventListener* onfocus() const;
-    void setOnfocus(PassRefPtr<EventListener>);
-    EventListener* oninput() const;
-    void setOninput(PassRefPtr<EventListener>);
-    EventListener* onkeydown() const;
-    void setOnkeydown(PassRefPtr<EventListener>);
-    EventListener* onkeypress() const;
-    void setOnkeypress(PassRefPtr<EventListener>);
-    EventListener* onkeyup() const;
-    void setOnkeyup(PassRefPtr<EventListener>);
-    EventListener* onload() const;
-    void setOnload(PassRefPtr<EventListener>);
-    EventListener* onmousedown() const;
-    void setOnmousedown(PassRefPtr<EventListener>);
-    EventListener* onmousemove() const;
-    void setOnmousemove(PassRefPtr<EventListener>);
-    EventListener* onmouseout() const;
-    void setOnmouseout(PassRefPtr<EventListener>);
-    EventListener* onmouseover() const;
-    void setOnmouseover(PassRefPtr<EventListener>);
-    EventListener* onmouseup() const;
-    void setOnmouseup(PassRefPtr<EventListener>);
-    EventListener* onmousewheel() const;
-    void setOnmousewheel(PassRefPtr<EventListener>);
-    EventListener* onbeforecut() const;
-    void setOnbeforecut(PassRefPtr<EventListener>);
-    EventListener* oncut() const;
-    void setOncut(PassRefPtr<EventListener>);
-    EventListener* onbeforecopy() const;
-    void setOnbeforecopy(PassRefPtr<EventListener>);
-    EventListener* oncopy() const;
-    void setOncopy(PassRefPtr<EventListener>);
-    EventListener* onbeforepaste() const;
-    void setOnbeforepaste(PassRefPtr<EventListener>);
-    EventListener* onpaste() const;
-    void setOnpaste(PassRefPtr<EventListener>);
-    EventListener* ondragenter() const;
-    void setOndragenter(PassRefPtr<EventListener>);
-    EventListener* ondragover() const;
-    void setOndragover(PassRefPtr<EventListener>);
-    EventListener* ondragleave() const;
-    void setOndragleave(PassRefPtr<EventListener>);
-    EventListener* ondrop() const;
-    void setOndrop(PassRefPtr<EventListener>);
-    EventListener* ondragstart() const;
-    void setOndragstart(PassRefPtr<EventListener>);
-    EventListener* ondrag() const;
-    void setOndrag(PassRefPtr<EventListener>);
-    EventListener* ondragend() const;
-    void setOndragend(PassRefPtr<EventListener>);
-    EventListener* onreset() const;
-    void setOnreset(PassRefPtr<EventListener>);
-    EventListener* onresize() const;
-    void setOnresize(PassRefPtr<EventListener>);
-    EventListener* onscroll() const;
-    void setOnscroll(PassRefPtr<EventListener>);
-    EventListener* onsearch() const;
-    void setOnsearch(PassRefPtr<EventListener>);
-    EventListener* onselect() const;
-    void setOnselect(PassRefPtr<EventListener>);
-    EventListener* onselectstart() const;
-    void setOnselectstart(PassRefPtr<EventListener>);
-    EventListener* onsubmit() const;
-    void setOnsubmit(PassRefPtr<EventListener>);
-    EventListener* onunload() const;
-    void setOnunload(PassRefPtr<EventListener>);
-
-    using Node::ref;
-    using Node::deref;
- 
-private:
-    virtual void refEventTarget() { ref(); }
-    virtual void derefEventTarget() { deref(); }
-};
-
-inline EventTargetNode* EventTargetNodeCast(Node* n) 
-{ 
-    ASSERT(n->isEventTargetNode());
-    return static_cast<EventTargetNode*>(n); 
-}
-
-inline const EventTargetNode* EventTargetNodeCast(const Node* n) 
-{ 
-    ASSERT(n->isEventTargetNode());
-    return static_cast<const EventTargetNode*>(n); 
-}
-
-} // namespace WebCore
-
-#endif // EventTargetNode_h
diff --git a/src/3rdparty/webkit/WebCore/dom/EventTargetNode.idl b/src/3rdparty/webkit/WebCore/dom/EventTargetNode.idl
deleted file mode 100644
index 0049593..0000000
--- a/src/3rdparty/webkit/WebCore/dom/EventTargetNode.idl
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-module core {
-
-    interface [
-        CustomPushEventHandlerScope,
-        GenerateNativeConverter
-    ] EventTargetNode : Node {
-        // EventTarget
-        attribute [DontEnum, ProtectedListener] EventListener onabort;
-        attribute [DontEnum, ProtectedListener] EventListener onblur;
-        attribute [DontEnum, ProtectedListener] EventListener onchange;
-        attribute [DontEnum, ProtectedListener] EventListener onclick;
-        attribute [DontEnum, ProtectedListener] EventListener oncontextmenu;
-        attribute [DontEnum, ProtectedListener] EventListener ondblclick;
-        attribute [DontEnum, ProtectedListener] EventListener onerror;
-        attribute [DontEnum, ProtectedListener] EventListener onfocus;
-        attribute [DontEnum, ProtectedListener] EventListener oninput;
-        attribute [DontEnum, ProtectedListener] EventListener onkeydown;
-        attribute [DontEnum, ProtectedListener] EventListener onkeypress;
-        attribute [DontEnum, ProtectedListener] EventListener onkeyup;
-        attribute [DontEnum, ProtectedListener] EventListener onload;
-        attribute [DontEnum, ProtectedListener] EventListener onmousedown;
-        attribute [DontEnum, ProtectedListener] EventListener onmousemove;
-        attribute [DontEnum, ProtectedListener] EventListener onmouseout;
-        attribute [DontEnum, ProtectedListener] EventListener onmouseover;
-        attribute [DontEnum, ProtectedListener] EventListener onmouseup;
-        attribute [DontEnum, ProtectedListener] EventListener onmousewheel;
-        attribute [DontEnum, ProtectedListener] EventListener onbeforecut;
-        attribute [DontEnum, ProtectedListener] EventListener oncut;
-        attribute [DontEnum, ProtectedListener] EventListener onbeforecopy;
-        attribute [DontEnum, ProtectedListener] EventListener oncopy;
-        attribute [DontEnum, ProtectedListener] EventListener onbeforepaste;
-        attribute [DontEnum, ProtectedListener] EventListener onpaste;
-        attribute [DontEnum, ProtectedListener] EventListener ondragenter;
-        attribute [DontEnum, ProtectedListener] EventListener ondragover;
-        attribute [DontEnum, ProtectedListener] EventListener ondragleave;
-        attribute [DontEnum, ProtectedListener] EventListener ondrop;
-        attribute [DontEnum, ProtectedListener] EventListener ondragstart;
-        attribute [DontEnum, ProtectedListener] EventListener ondrag;
-        attribute [DontEnum, ProtectedListener] EventListener ondragend;
-        attribute [DontEnum, ProtectedListener] EventListener onreset;
-        attribute [DontEnum, ProtectedListener] EventListener onresize;
-        attribute [DontEnum, ProtectedListener] EventListener onscroll;
-        attribute [DontEnum, ProtectedListener] EventListener onsearch;
-        attribute [DontEnum, ProtectedListener] EventListener onselect;
-        attribute [DontEnum, ProtectedListener] EventListener onselectstart;
-        attribute [DontEnum, ProtectedListener] EventListener onsubmit;
-        attribute [DontEnum, ProtectedListener] EventListener onunload;
-
-        [Custom] void addEventListener(in DOMString type, 
-                                       in EventListener listener, 
-                                       in boolean useCapture);
-        [Custom] void removeEventListener(in DOMString type, 
-                                          in EventListener listener, 
-                                          in boolean useCapture);
-        boolean dispatchEvent(in Event event)
-            raises(EventException);
-    };
-
-}
diff --git a/src/3rdparty/webkit/WebCore/dom/ExceptionCode.cpp b/src/3rdparty/webkit/WebCore/dom/ExceptionCode.cpp
index fa0a7a7..0291a21 100644
--- a/src/3rdparty/webkit/WebCore/dom/ExceptionCode.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ExceptionCode.cpp
@@ -58,7 +58,11 @@ static const char* const exceptionNames[] = {
     "INVALID_ACCESS_ERR",
     "VALIDATION_ERR",
     "TYPE_MISMATCH_ERR",
-    "SECURITY_ERR"
+    "SECURITY_ERR",
+    "NETWORK_ERR",
+    "ABORT_ERR",
+    "URL_MISMATCH_ERR",
+    "QUOTA_EXCEEDED_ERR"
 };
 
 static const char* const rangeExceptionNames[] = {
@@ -71,7 +75,8 @@ static const char* const eventExceptionNames[] = {
 };
 
 static const char* const xmlHttpRequestExceptionNames[] = {
-    "NETWORK_ERR"
+    "NETWORK_ERR",
+    "ABORT_ERR"
 };
 
 #if ENABLE(XPATH)
diff --git a/src/3rdparty/webkit/WebCore/dom/ExceptionCode.h b/src/3rdparty/webkit/WebCore/dom/ExceptionCode.h
index 9e34ae0..58b18e2 100644
--- a/src/3rdparty/webkit/WebCore/dom/ExceptionCode.h
+++ b/src/3rdparty/webkit/WebCore/dom/ExceptionCode.h
@@ -51,7 +51,13 @@ namespace WebCore {
         TYPE_MISMATCH_ERR = 17,
 
         // XMLHttpRequest extension:
-        SECURITY_ERR = 18
+        SECURITY_ERR = 18,
+
+        // Others introduced in HTML5:
+        NETWORK_ERR = 19,
+        ABORT_ERR = 20,
+        URL_MISMATCH_ERR = 21,
+        QUOTA_EXCEEDED_ERR = 22,
     };
 
     enum ExceptionType {
diff --git a/src/3rdparty/webkit/WebCore/dom/InputElement.cpp b/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
new file mode 100644
index 0000000..108d17e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/InputElement.cpp
@@ -0,0 +1,304 @@
+/*
+ * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "InputElement.h"
+
+#include "BeforeTextInsertedEvent.h"
+#include "ChromeClient.h"
+#include "Document.h"
+#include "Event.h"
+#include "EventNames.h"
+#include "Frame.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "MappedAttribute.h"
+#include "Page.h"
+#include "RenderTextControlSingleLine.h"
+#include "SelectionController.h"
+#include "TextIterator.h"
+#include "TextBreakIterator.h"
+
+#if ENABLE(WML)
+#include "WMLInputElement.h"
+#include "WMLNames.h"
+#endif
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+// FIXME: According to HTML4, the length attribute's value can be arbitrarily
+// large. However, due to http://bugs.webkit.org/show_bugs.cgi?id=14536 things
+// get rather sluggish when a text field has a larger number of characters than
+// this, even when just clicking in the text field.
+const int InputElement::s_maximumLength = 524288;
+const int InputElement::s_defaultSize = 20;
+
+void InputElement::dispatchFocusEvent(InputElementData& data, InputElement* inputElement, Element* element)
+{
+    if (!inputElement->isTextField())
+        return;
+
+    updatePlaceholderVisibility(data, inputElement, element);
+
+    Document* document = element->document();
+    if (inputElement->isPasswordField() && document->frame())
+        document->setUseSecureKeyboardEntryWhenActive(true);
+}
+
+void InputElement::dispatchBlurEvent(InputElementData& data, InputElement* inputElement, Element* element)
+{
+    if (!inputElement->isTextField())
+        return;
+
+    Document* document = element->document();
+    Frame* frame = document->frame();
+    if (!frame)
+        return;
+
+    updatePlaceholderVisibility(data, inputElement, element);
+
+    if (inputElement->isPasswordField())
+        document->setUseSecureKeyboardEntryWhenActive(false);
+
+    frame->textFieldDidEndEditing(element);
+}
+
+void InputElement::updatePlaceholderVisibility(InputElementData& data, InputElement* inputElement, Element* element, bool placeholderValueChanged)
+{
+    ASSERT(inputElement->isTextField());
+    Document* document = element->document();
+
+    bool oldPlaceholderShouldBeVisible = data.placeholderShouldBeVisible();
+    data.setPlaceholderShouldBeVisible(inputElement->value().isEmpty() 
+                                       && document->focusedNode() != element
+                                       && !inputElement->placeholder().isEmpty());
+
+    if ((oldPlaceholderShouldBeVisible != data.placeholderShouldBeVisible() || placeholderValueChanged) && element->renderer())
+        static_cast<RenderTextControlSingleLine*>(element->renderer())->updatePlaceholderVisibility();
+}
+
+void InputElement::updateFocusAppearance(InputElementData& data, InputElement* inputElement, Element* element, bool restorePreviousSelection)
+{
+    ASSERT(inputElement->isTextField());
+
+    if (!restorePreviousSelection || data.cachedSelectionStart() == -1)
+        inputElement->select();
+    else
+        // Restore the cached selection.
+        updateSelectionRange(inputElement, element, data.cachedSelectionStart(), data.cachedSelectionEnd());
+
+    Document* document = element->document();
+    if (document && document->frame())
+        document->frame()->revealSelection();
+}
+
+void InputElement::updateSelectionRange(InputElement* inputElement, Element* element, int start, int end)
+{
+    if (!inputElement->isTextField())
+        return;
+
+    if (RenderTextControl* renderer = toRenderTextControl(element->renderer()))
+        renderer->setSelectionRange(start, end);
+}
+
+void InputElement::aboutToUnload(InputElement* inputElement, Element* element)
+{
+    if (!inputElement->isTextField() || !element->focused())
+        return;
+
+    Document* document = element->document();
+    Frame* frame = document->frame();
+    if (!frame)
+        return;
+
+    frame->textFieldDidEndEditing(element);
+}
+
+void InputElement::setValueFromRenderer(InputElementData& data, InputElement* inputElement, Element* element, const String& value)
+{
+    // Renderer and our event handler are responsible for constraining values.
+    ASSERT(value == inputElement->constrainValue(value) || inputElement->constrainValue(value).isEmpty());
+
+    if (inputElement->isTextField())
+        updatePlaceholderVisibility(data, inputElement, element);
+
+    // Workaround for bug where trailing \n is included in the result of textContent.
+    // The assert macro above may also be simplified to:  value == constrainValue(value)
+    // http://bugs.webkit.org/show_bug.cgi?id=9661
+    if (value == "\n")
+        data.setValue("");
+    else
+        data.setValue(value);
+
+    element->setFormControlValueMatchesRenderer(true);
+
+    // Fire the "input" DOM event
+    element->dispatchEvent(eventNames().inputEvent, true, false);
+    notifyFormStateChanged(element);
+}
+
+static int numCharactersInGraphemeClusters(StringImpl* s, int numGraphemeClusters)
+{
+    if (!s)
+        return 0;
+
+    TextBreakIterator* it = characterBreakIterator(s->characters(), s->length());
+    if (!it)
+        return 0;
+
+    for (int i = 0; i < numGraphemeClusters; ++i) {
+        if (textBreakNext(it) == TextBreakDone)
+            return s->length();
+    }
+
+    return textBreakCurrent(it);
+}
+
+String InputElement::constrainValue(const InputElement* inputElement, const String& proposedValue, int maxLength)
+{
+    String string = proposedValue;
+    if (!inputElement->isTextField())
+        return string;
+
+    string.replace("\r\n", " ");
+    string.replace('\r', ' ');
+    string.replace('\n', ' ');
+    
+    StringImpl* s = string.impl();
+    int newLength = numCharactersInGraphemeClusters(s, maxLength);
+    for (int i = 0; i < newLength; ++i) {
+        const UChar& current = (*s)[i];
+        if (current < ' ' && current != '\t') {
+            newLength = i;
+            break;
+        }
+    }
+
+    if (newLength < static_cast<int>(string.length()))
+        return string.left(newLength);
+
+    return string;
+}
+
+static int numGraphemeClusters(StringImpl* s)
+{
+    if (!s)
+        return 0;
+
+    TextBreakIterator* it = characterBreakIterator(s->characters(), s->length());
+    if (!it)
+        return 0;
+
+    int num = 0;
+    while (textBreakNext(it) != TextBreakDone)
+        ++num;
+
+    return num;
+}
+
+void InputElement::handleBeforeTextInsertedEvent(InputElementData& data, InputElement* inputElement, Document* document, Event* event)
+{
+    ASSERT(event->isBeforeTextInsertedEvent());
+
+    // Make sure that the text to be inserted will not violate the maxLength.
+    int oldLength = numGraphemeClusters(inputElement->value().impl());
+    ASSERT(oldLength <= data.maxLength());
+    int selectionLength = numGraphemeClusters(plainText(document->frame()->selection()->selection().toNormalizedRange().get()).impl());
+    ASSERT(oldLength >= selectionLength);
+    int maxNewLength = data.maxLength() - (oldLength - selectionLength);
+
+    // Truncate the inserted text to avoid violating the maxLength and other constraints.
+    BeforeTextInsertedEvent* textEvent = static_cast<BeforeTextInsertedEvent*>(event);
+    textEvent->setText(constrainValue(inputElement, textEvent->text(), maxNewLength));
+}
+
+void InputElement::parseSizeAttribute(InputElementData& data, Element* element, MappedAttribute* attribute)
+{
+    data.setSize(attribute->isNull() ? InputElement::s_defaultSize : attribute->value().toInt());
+
+    if (RenderObject* renderer = element->renderer())
+        renderer->setNeedsLayoutAndPrefWidthsRecalc();
+}
+
+void InputElement::parseMaxLengthAttribute(InputElementData& data, InputElement* inputElement, Element* element, MappedAttribute* attribute)
+{
+    int maxLength = attribute->isNull() ? InputElement::s_maximumLength : attribute->value().toInt();
+    if (maxLength <= 0 || maxLength > InputElement::s_maximumLength)
+        maxLength = InputElement::s_maximumLength;
+
+    int oldMaxLength = data.maxLength();
+    data.setMaxLength(maxLength);
+
+    if (oldMaxLength != maxLength)
+        updateValueIfNeeded(data, inputElement);
+
+    element->setNeedsStyleRecalc();
+}
+
+void InputElement::updateValueIfNeeded(InputElementData& data, InputElement* inputElement)
+{
+    String oldValue = data.value();
+    String newValue = inputElement->constrainValue(oldValue);
+    if (newValue != oldValue)
+        inputElement->setValue(newValue);
+}
+
+void InputElement::notifyFormStateChanged(Element* element)
+{
+    Document* document = element->document();
+    Frame* frame = document->frame();
+    if (!frame)
+        return;
+
+    if (Page* page = frame->page())
+        page->chrome()->client()->formStateDidChange(element);
+}
+
+// InputElementData
+InputElementData::InputElementData()
+    : m_placeholderShouldBeVisible(false)
+    , m_size(InputElement::s_defaultSize)
+    , m_maxLength(InputElement::s_maximumLength)
+    , m_cachedSelectionStart(-1)
+    , m_cachedSelectionEnd(-1)
+{
+}
+
+const AtomicString& InputElementData::name() const
+{
+    return m_name.isNull() ? emptyAtom : m_name;
+}
+
+InputElement* toInputElement(Element* element)
+{
+    if (element->isHTMLElement() && (element->hasTagName(inputTag) || element->hasTagName(isindexTag)))
+        return static_cast<HTMLInputElement*>(element);
+
+#if ENABLE(WML)
+    if (element->isWMLElement() && element->hasTagName(WMLNames::inputTag))
+        return static_cast<WMLInputElement*>(element);
+#endif
+
+    return 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/dom/InputElement.h b/src/3rdparty/webkit/WebCore/dom/InputElement.h
new file mode 100644
index 0000000..7ad3cbd
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/InputElement.h
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef InputElement_h
+#define InputElement_h
+
+#include "AtomicString.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+class Document;
+class Element;
+class Event;
+class InputElementData;
+class MappedAttribute;
+
+class InputElement {
+public:
+    virtual ~InputElement() { }
+
+    virtual bool isAutofilled() const = 0;
+    virtual bool isChecked() const = 0;
+    virtual bool isIndeterminate() const = 0;
+    virtual bool isInputTypeHidden() const = 0;
+    virtual bool isPasswordField() const = 0;
+    virtual bool isSearchField() const = 0;
+    virtual bool isTextField() const = 0;
+
+    virtual bool placeholderShouldBeVisible() const = 0;
+    virtual bool searchEventsShouldBeDispatched() const = 0;
+
+    virtual int size() const = 0;
+    virtual String value() const = 0;
+    virtual void setValue(const String&) = 0;
+
+    virtual String placeholder() const = 0;
+    virtual void setPlaceholder(const String&) = 0;
+
+    virtual String constrainValue(const String&) const = 0;
+    virtual void setValueFromRenderer(const String&) = 0;
+
+    virtual void cacheSelection(int start, int end) = 0;
+    virtual void select() = 0;
+
+    static const int s_maximumLength;
+    static const int s_defaultSize;
+
+protected:
+    static void dispatchFocusEvent(InputElementData&, InputElement*, Element*);
+    static void dispatchBlurEvent(InputElementData&, InputElement*, Element*);
+    static void updatePlaceholderVisibility(InputElementData&, InputElement*, Element*, bool placeholderValueChanged = false);
+    static void updateFocusAppearance(InputElementData&, InputElement*, Element*, bool restorePreviousSelection);
+    static void updateSelectionRange(InputElement*, Element*, int start, int end);
+    static void aboutToUnload(InputElement*, Element*);
+    static void setValueFromRenderer(InputElementData&, InputElement*, Element*, const String&);
+    static String constrainValue(const InputElement*, const String& proposedValue, int maxLength);
+    static void handleBeforeTextInsertedEvent(InputElementData&, InputElement*, Document*, Event*);
+    static void parseSizeAttribute(InputElementData&, Element*, MappedAttribute*);
+    static void parseMaxLengthAttribute(InputElementData&, InputElement*, Element*, MappedAttribute*);
+    static void updateValueIfNeeded(InputElementData&, InputElement*);
+    static void notifyFormStateChanged(Element*);
+};
+
+// HTML/WMLInputElement hold this struct as member variable
+// and pass it to the static helper functions in InputElement
+class InputElementData {
+public:
+    InputElementData();
+
+    bool placeholderShouldBeVisible() const { return m_placeholderShouldBeVisible; }
+    void setPlaceholderShouldBeVisible(bool visible) { m_placeholderShouldBeVisible = visible; }
+
+    const AtomicString& name() const;
+    void setName(const AtomicString& value) { m_name = value; }
+
+    String value() const { return m_value; }
+    void setValue(const String& value) { m_value = value; }
+
+    int size() const { return m_size; }
+    void setSize(int value) { m_size = value; }
+
+    int maxLength() const { return m_maxLength; }
+    void setMaxLength(int value) { m_maxLength = value; }
+
+    int cachedSelectionStart() const { return m_cachedSelectionStart; }
+    void setCachedSelectionStart(int value) { m_cachedSelectionStart = value; }
+
+    int cachedSelectionEnd() const { return m_cachedSelectionEnd; }
+    void setCachedSelectionEnd(int value) { m_cachedSelectionEnd = value; }
+
+private:
+    bool m_placeholderShouldBeVisible;
+    AtomicString m_name;
+    String m_value;
+    int m_size;
+    int m_maxLength;
+    int m_cachedSelectionStart;
+    int m_cachedSelectionEnd;
+};
+
+InputElement* toInputElement(Element*);
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.idl b/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.idl
index 808319f..58e5da7 100644
--- a/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/KeyboardEvent.idl
@@ -25,7 +25,7 @@ module events {
         GenerateConstructor
     ] KeyboardEvent : UIEvent {
 
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         // KeyLocationCode
         const unsigned long       KEY_LOCATION_STANDARD      = 0x00;
         const unsigned long       KEY_LOCATION_LEFT          = 0x01;
@@ -41,7 +41,7 @@ module events {
         readonly attribute boolean          metaKey;
         readonly attribute boolean          altGraphKey;
 
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         boolean getModifierState(in DOMString keyIdentifierArg);
 #endif
 
@@ -59,7 +59,7 @@ module events {
                                in boolean altGraphKey);
 
         // WebKit Extensions
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         readonly attribute long             keyCode;
         readonly attribute long             charCode;
         
diff --git a/src/3rdparty/webkit/WebCore/dom/MessageChannel.cpp b/src/3rdparty/webkit/WebCore/dom/MessageChannel.cpp
index 3a90913..ac0a4ab 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessageChannel.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/MessageChannel.cpp
@@ -28,14 +28,15 @@
 #include "MessageChannel.h"
 
 #include "MessagePort.h"
+#include "PlatformMessagePortChannel.h"
 
 namespace WebCore {
 
 MessageChannel::MessageChannel(ScriptExecutionContext* context)
-    : m_port1(MessagePort::create(context))
-    , m_port2(MessagePort::create(context))
+    : m_port1(MessagePort::create(*context))
+    , m_port2(MessagePort::create(*context))
 {
-    MessagePort::entangle(m_port1.get(), m_port2.get());
+    PlatformMessagePortChannel::createChannel(m_port1.get(), m_port2.get());
 }
 
 MessageChannel::~MessageChannel()
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp b/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
index 75f5a1e..9f3e4d2 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePort.cpp
@@ -38,89 +38,23 @@
 
 namespace WebCore {
 
-class MessagePortCloseEventTask : public ScriptExecutionContext::Task {
-public:
-    static PassRefPtr<MessagePortCloseEventTask> create(PassRefPtr<MessagePort> port)
-    {
-        return adoptRef(new MessagePortCloseEventTask(port));
-    }
-
-private:
-    MessagePortCloseEventTask(PassRefPtr<MessagePort> port)
-        : m_port(port)
-    {
-        ASSERT(m_port);
-    }
-
-    virtual void performTask(ScriptExecutionContext* context)
-    {
-        ASSERT(!m_port->active());
-        ASSERT(context == m_port->scriptExecutionContext());
-
-        // Closing may destroy the port, dispatch any remaining messages now.
-        if (m_port->queueIsOpen())
-            m_port->dispatchMessages();
-
-        m_port->dispatchCloseEvent();
-    }
-
-    RefPtr<MessagePort> m_port;
-};
-
-PassRefPtr<MessagePort::EventData> MessagePort::EventData::create(const String& message, PassRefPtr<MessagePort> port)
-{
-    return adoptRef(new EventData(message, port));
-}
-
-MessagePort::EventData::EventData(const String& message, PassRefPtr<MessagePort> messagePort)
-    : message(message.copy())
-    , messagePort(messagePort)
-{
-}
-
-MessagePort::EventData::~EventData()
+MessagePort::MessagePort(ScriptExecutionContext& scriptExecutionContext)
+    : m_entangledChannel(0)
+    , m_started(false)
+    , m_scriptExecutionContext(&scriptExecutionContext)
 {
-}
+    m_scriptExecutionContext->createdMessagePort(this);
 
-MessagePort::MessagePort(ScriptExecutionContext* scriptExecutionContext)
-    : m_entangledPort(0)
-    , m_queueIsOpen(false)
-    , m_scriptExecutionContext(scriptExecutionContext)
-    , m_pendingCloseEvent(false)
-{
-    if (scriptExecutionContext)
-        scriptExecutionContext->createdMessagePort(this);
+    // Don't need to call processMessagePortMessagesSoon() here, because the port will not be opened until start() is invoked.
 }
 
 MessagePort::~MessagePort()
 {
-    if (m_entangledPort)
-        unentangle();
-
+    close();
     if (m_scriptExecutionContext)
         m_scriptExecutionContext->destroyedMessagePort(this);
 }
 
-PassRefPtr<MessagePort> MessagePort::clone(ExceptionCode& ec)
-{
-    if (!m_entangledPort) {
-        ec = INVALID_STATE_ERR;
-        return 0;
-    }
-
-    RefPtr<MessagePort> remotePort = m_entangledPort;
-    RefPtr<MessagePort> newPort = MessagePort::create(0);
-
-    // Move all the events in the port message queue of original port to the port message queue of new port, if any, leaving the new port's port message queue in its initial closed state.
-    // If events are posted (e.g. from a worker thread) while this code is executing, there is no guarantee whether they end up in the original or new port's message queue.
-    RefPtr<EventData> eventData;
-    while (m_messageQueue.tryGetMessage(eventData))
-        newPort->m_messageQueue.append(eventData);
-
-    entangle(remotePort.get(), newPort.get()); // The port object will be unentangled.
-    return newPort;
-}
-
 void MessagePort::postMessage(const String& message, ExceptionCode& ec)
 {
     postMessage(message, 0, ec);
@@ -128,106 +62,86 @@ void MessagePort::postMessage(const String& message, ExceptionCode& ec)
 
 void MessagePort::postMessage(const String& message, MessagePort* dataPort, ExceptionCode& ec)
 {
-    if (!m_entangledPort || !m_scriptExecutionContext)
+    if (!m_entangledChannel)
         return;
+    ASSERT(m_scriptExecutionContext);
 
-    RefPtr<MessagePort> newMessagePort;
+    OwnPtr<MessagePortChannel> channel;
     if (dataPort) {
-        if (dataPort == this || dataPort == m_entangledPort) {
-            ec = INVALID_ACCESS_ERR;
+        if (dataPort == this || m_entangledChannel->isConnectedTo(dataPort)) {
+            ec = INVALID_STATE_ERR;
             return;
         }
-        newMessagePort = dataPort->clone(ec);
+        channel = dataPort->disentangle(ec);
         if (ec)
             return;
     }
-
-    m_entangledPort->m_messageQueue.append(EventData::create(message, newMessagePort));
-    if (m_entangledPort->m_queueIsOpen && m_entangledPort->m_scriptExecutionContext)
-        m_entangledPort->m_scriptExecutionContext->processMessagePortMessagesSoon();
+    m_entangledChannel->postMessageToRemote(MessagePortChannel::EventData::create(message, channel.release()));
 }
 
-PassRefPtr<MessagePort> MessagePort::startConversation(ScriptExecutionContext* scriptExecutionContext, const String& message)
+PassOwnPtr<MessagePortChannel> MessagePort::disentangle(ExceptionCode& ec)
 {
-    RefPtr<MessagePort> port1 = MessagePort::create(scriptExecutionContext);
-    if (!m_entangledPort || !m_scriptExecutionContext)
-        return port1;
-    RefPtr<MessagePort> port2 = MessagePort::create(0);
-
-    entangle(port1.get(), port2.get());
+    if (!m_entangledChannel)
+        ec = INVALID_STATE_ERR;
+    else {
+        m_entangledChannel->disentangle();
 
-    m_entangledPort->m_messageQueue.append(EventData::create(message, port2));
-    if (m_entangledPort->m_queueIsOpen && m_entangledPort->m_scriptExecutionContext)
-        m_entangledPort->m_scriptExecutionContext->processMessagePortMessagesSoon();
-    return port1;
+        // We can't receive any messages or generate any events, so remove ourselves from the list of active ports.
+        ASSERT(m_scriptExecutionContext);
+        m_scriptExecutionContext->destroyedMessagePort(this);
+        m_scriptExecutionContext = 0;
+    }
+    return m_entangledChannel.release();
 }
 
-void MessagePort::start()
+// Invoked to notify us that there are messages available for this port.
+// This code may be called from another thread, and so should not call any non-threadsafe APIs (i.e. should not call into the entangled channel or access mutable variables).
+void MessagePort::messageAvailable()
 {
-    if (m_queueIsOpen || !m_scriptExecutionContext)
-        return;
-
-    m_queueIsOpen = true;
+    ASSERT(m_scriptExecutionContext);
     m_scriptExecutionContext->processMessagePortMessagesSoon();
 }
 
-void MessagePort::close()
+void MessagePort::start()
 {
-    if (!m_entangledPort)
+    // Do nothing if we've been cloned
+    if (!m_entangledChannel)
         return;
 
-    MessagePort* otherPort = m_entangledPort;
-    unentangle();
+    ASSERT(m_scriptExecutionContext);
+    if (m_started)
+        return;
 
-    queueCloseEvent();
-    otherPort->queueCloseEvent();
+    m_started = true;
+    m_scriptExecutionContext->processMessagePortMessagesSoon();
 }
 
-void MessagePort::entangle(MessagePort* port1, MessagePort* port2)
+void MessagePort::close()
 {
-    if (port1->m_entangledPort) {
-        ASSERT(port1->m_entangledPort != port2);
-        port1->unentangle();
-    }
-
-    if (port2->m_entangledPort) {
-        ASSERT(port2->m_entangledPort != port1);
-        port2->unentangle();
-    }
-
-    port1->m_entangledPort = port2;
-    port2->m_entangledPort = port1;
+    if (!m_entangledChannel)
+        return;
+    m_entangledChannel->close();
 }
 
-void MessagePort::unentangle()
+void MessagePort::entangle(PassOwnPtr<MessagePortChannel> remote)
 {
-    ASSERT(this == m_entangledPort->m_entangledPort);
+    // Only invoked to set our initial entanglement.
+    ASSERT(!m_entangledChannel);
+    ASSERT(m_scriptExecutionContext);
 
-    m_entangledPort->m_entangledPort = 0;
-    m_entangledPort = 0;
+    // Don't entangle the ports if the channel is closed.
+    if (remote->entangleIfOpen(this))
+        m_entangledChannel = remote;
 }
 
 void MessagePort::contextDestroyed()
 {
     ASSERT(m_scriptExecutionContext);
-
-    if (m_entangledPort)
-        unentangle();
-
+    // Must close port before blowing away the cached context, to ensure that we get no more calls to messageAvailable().
+    close();
     m_scriptExecutionContext = 0;
 }
 
-void MessagePort::attachToContext(ScriptExecutionContext* scriptExecutionContext)
-{
-    ASSERT(!m_scriptExecutionContext);
-    ASSERT(!m_queueIsOpen);
-
-    m_scriptExecutionContext = scriptExecutionContext;
-    m_scriptExecutionContext->createdMessagePort(this);
-    
-    // FIXME: Need to call processMessagePortMessagesSoon()?
-}
-
 ScriptExecutionContext* MessagePort::scriptExecutionContext() const
 {
     return m_scriptExecutionContext;
@@ -236,17 +150,19 @@ ScriptExecutionContext* MessagePort::scriptExecutionContext() const
 void MessagePort::dispatchMessages()
 {
     // Messages for contexts that are not fully active get dispatched too, but JSAbstractEventListener::handleEvent() doesn't call handlers for these.
-    // FIXME: Such messages should be dispatched if the document returns from page cache. They are only allowed to be lost if the document is discarded.
-    ASSERT(queueIsOpen());
-
-    RefPtr<EventData> eventData;
-    while (m_messageQueue.tryGetMessage(eventData)) {
-
-        ASSERT(!eventData->messagePort || !eventData->messagePort->m_scriptExecutionContext);
-        if (eventData->messagePort)
-            eventData->messagePort->attachToContext(m_scriptExecutionContext);
-
-        RefPtr<Event> evt = MessageEvent::create(eventData->message, "", "", 0, eventData->messagePort);
+    // The HTML5 spec specifies that any messages sent to a document that is not fully active should be dropped, so this behavior is OK.
+    ASSERT(started());
+
+    OwnPtr<MessagePortChannel::EventData> eventData;
+    while (m_entangledChannel && m_entangledChannel->tryGetMessageFromRemote(eventData)) {
+        RefPtr<MessagePort> port;
+        OwnPtr<MessagePortChannel> channel = eventData->channel();
+        if (channel) {
+            // The remote side sent over a MessagePortChannel, so create a MessagePort to wrap it.
+            port = MessagePort::create(*m_scriptExecutionContext);
+            port->entangle(channel.release());
+        }
+        RefPtr<Event> evt = MessageEvent::create(eventData->message(), "", "", 0, port.release());
 
         if (m_onMessageListener) {
             evt->setTarget(this);
@@ -260,31 +176,6 @@ void MessagePort::dispatchMessages()
     }
 }
 
-void MessagePort::queueCloseEvent()
-{
-    ASSERT(!m_pendingCloseEvent);
-    m_pendingCloseEvent = true;
-
-    m_scriptExecutionContext->postTask(MessagePortCloseEventTask::create(this));
-}
-
-void MessagePort::dispatchCloseEvent()
-{
-    ASSERT(m_pendingCloseEvent);
-    m_pendingCloseEvent = false;
-
-    RefPtr<Event> evt = Event::create(eventNames().closeEvent, false, true);
-    if (m_onCloseListener) {
-        evt->setTarget(this);
-        evt->setCurrentTarget(this);
-        m_onCloseListener->handleEvent(evt.get(), false);
-    }
-
-    ExceptionCode ec = 0;
-    dispatchEvent(evt.release(), ec);
-    ASSERT(!ec);
-}
-
 void MessagePort::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> eventListener, bool)
 {
     EventListenersMap::iterator iter = m_eventListeners.find(eventType);
@@ -336,9 +227,22 @@ bool MessagePort::dispatchEvent(PassRefPtr<Event> event, ExceptionCode& ec)
     return !event->defaultPrevented();
 }
 
+void MessagePort::setOnmessage(PassRefPtr<EventListener> eventListener)
+{
+    m_onMessageListener = eventListener;
+    start();
+}
+
 bool MessagePort::hasPendingActivity()
 {
-    return m_pendingCloseEvent || (m_queueIsOpen && !m_messageQueue.isEmpty());
+    // The spec says that entangled message ports should always be treated as if they have a strong reference.
+    // We'll also stipulate that the queue needs to be open (if the app drops its reference to the port before start()-ing it, then it's not really entangled as it's unreachable).
+    return m_started && m_entangledChannel && m_entangledChannel->hasPendingActivity();
+}
+
+MessagePort* MessagePort::locallyEntangledPort()
+{
+    return m_entangledChannel ? m_entangledChannel->locallyEntangledPort(m_scriptExecutionContext) : 0;
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePort.h b/src/3rdparty/webkit/WebCore/dom/MessagePort.h
index 19252a7..f416b9b 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePort.h
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePort.h
@@ -30,9 +30,11 @@
 #include "AtomicStringHash.h"
 #include "EventListener.h"
 #include "EventTarget.h"
+#include "MessagePortChannel.h"
 
 #include <wtf/HashMap.h>
-#include <wtf/MessageQueue.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
@@ -44,35 +46,29 @@ namespace WebCore {
     class Frame;
     class ScriptExecutionContext;
     class String;
-    class WorkerContext;
 
     class MessagePort : public RefCounted<MessagePort>, public EventTarget {
     public:
-        static PassRefPtr<MessagePort> create(ScriptExecutionContext* scriptExecutionContext) { return adoptRef(new MessagePort(scriptExecutionContext)); }
+        static PassRefPtr<MessagePort> create(ScriptExecutionContext& scriptExecutionContext) { return adoptRef(new MessagePort(scriptExecutionContext)); }
         ~MessagePort();
 
-        PassRefPtr<MessagePort> clone(ExceptionCode&); // Returns a port that isn't attached to any context.
-
-        bool active() const { return m_entangledPort; }
         void postMessage(const String& message, ExceptionCode&);
         void postMessage(const String& message, MessagePort*, ExceptionCode&);
-        PassRefPtr<MessagePort> startConversation(ScriptExecutionContext*, const String& message);
         void start();
         void close();
 
-        bool queueIsOpen() const { return m_queueIsOpen; }
+        void entangle(PassOwnPtr<MessagePortChannel>);
+        PassOwnPtr<MessagePortChannel> disentangle(ExceptionCode&);
 
-        MessagePort* entangledPort() { return m_entangledPort; }
-        static void entangle(MessagePort*, MessagePort*);
-        void unentangle();
+        void messageAvailable();
+        bool started() const { return m_started; }
 
         void contextDestroyed();
-        void attachToContext(ScriptExecutionContext*);
+
         virtual ScriptExecutionContext* scriptExecutionContext() const;
 
         virtual MessagePort* toMessagePort() { return this; }
 
-        void queueCloseEvent();
         void dispatchMessages();
 
         virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
@@ -88,47 +84,30 @@ namespace WebCore {
 
         bool hasPendingActivity();
 
-        // FIXME: Per current spec, setting onmessage should automagically start the port (unlike addEventListener("message", ...)).
-        void setOnmessage(PassRefPtr<EventListener> eventListener) { m_onMessageListener = eventListener; }
+        void setOnmessage(PassRefPtr<EventListener>);
         EventListener* onmessage() const { return m_onMessageListener.get(); }
 
-        void setOnclose(PassRefPtr<EventListener> eventListener) { m_onCloseListener = eventListener; }
-        EventListener* onclose() const { return m_onCloseListener.get(); }
+        // Returns null if there is no entangled port, or if the entangled port is run by a different thread.
+        // Returns null otherwise.
+        // NOTE: This is used solely to enable a GC optimization. Some platforms may not be able to determine ownership of the remote port (since it may live cross-process) - those platforms may always return null.
+        MessagePort* locallyEntangledPort();
+        bool isEntangled() { return m_entangledChannel; }
 
     private:
-        friend class MessagePortCloseEventTask;
-
-        MessagePort(ScriptExecutionContext*);
+        MessagePort(ScriptExecutionContext&);
 
         virtual void refEventTarget() { ref(); }
         virtual void derefEventTarget() { deref(); }
 
-        void dispatchCloseEvent();
-
-        MessagePort* m_entangledPort;
+        OwnPtr<MessagePortChannel> m_entangledChannel;
 
-        // FIXME: EventData is necessary to pass messages to other threads. In single threaded case, we can just queue a created event.
-        struct EventData : public RefCounted<EventData> {
-            static PassRefPtr<EventData> create(const String& message, PassRefPtr<MessagePort>);
-            ~EventData();
-
-            String message;
-            RefPtr<MessagePort> messagePort;
-
-        private:
-            EventData(const String& message, PassRefPtr<MessagePort>);
-        };
-        MessageQueue<RefPtr<EventData> > m_messageQueue; // FIXME: No need to use MessageQueue in single threaded case.
-        bool m_queueIsOpen;
+        bool m_started;
 
         ScriptExecutionContext* m_scriptExecutionContext;
 
         RefPtr<EventListener> m_onMessageListener;
-        RefPtr<EventListener> m_onCloseListener;
 
         EventListenersMap m_eventListeners;
-
-        bool m_pendingCloseEvent; // The port is GC protected while waiting for a close event to be dispatched.
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePort.idl b/src/3rdparty/webkit/WebCore/dom/MessagePort.idl
index 2596c0f..e5f9ad1 100644
--- a/src/3rdparty/webkit/WebCore/dom/MessagePort.idl
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePort.idl
@@ -33,17 +33,14 @@ module events {
     ] MessagePort {
 // We need to have something as an ObjC binding, because MessagePort is used in MessageEvent, which already has one,
 // but we don't want to actually expose the API while it is in flux.
-#if defined(LANGUAGE_JAVASCRIPT)
-        readonly attribute boolean active;
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         void postMessage(in DOMString message, in [Optional] MessagePort messagePort)
             raises(DOMException);
-        [Custom] MessagePort startConversation(in DOMString message);
         void start();
         void close();
 
         // event handler attributes
         attribute EventListener onmessage;
-        attribute EventListener onclose;
 
         // EventTarget interface
         [Custom] void addEventListener(in DOMString type, 
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.cpp b/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.cpp
new file mode 100644
index 0000000..768d4f4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.cpp
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include "config.h"
+#include "MessagePortChannel.h"
+
+#include "PlatformMessagePortChannel.h"
+
+namespace WebCore {
+
+PassOwnPtr<MessagePortChannel> MessagePortChannel::create(PassRefPtr<PlatformMessagePortChannel> channel)
+{
+    return new MessagePortChannel(channel);
+}
+
+PassOwnPtr<MessagePortChannel::EventData> MessagePortChannel::EventData::create(const String& message, PassOwnPtr<MessagePortChannel> channel)
+{
+    return new EventData(message, channel);
+}
+
+MessagePortChannel::EventData::EventData(const String& message, PassOwnPtr<MessagePortChannel> channel)
+    : m_message(message.copy())
+    , m_channel(channel)
+{
+}
+
+MessagePortChannel::MessagePortChannel(PassRefPtr<PlatformMessagePortChannel> channel)
+    : m_channel(channel)
+{
+}
+
+MessagePortChannel::~MessagePortChannel()
+{
+    // Make sure we close our platform channel when the base is freed, to keep the channel objects from leaking.
+    m_channel->close();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h b/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h
new file mode 100644
index 0000000..15b3d16
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/MessagePortChannel.h
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef MessagePortChannel_h
+#define MessagePortChannel_h
+
+#include "PlatformString.h"
+
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+    class MessagePort;
+    class PlatformMessagePortChannel;
+    class ScriptExecutionContext;
+    class String;
+
+    // MessagePortChannel is a platform-independent interface to the remote side of a message channel.
+    // It acts as a wrapper around the platform-dependent PlatformMessagePortChannel implementation which ensures that the platform-dependent close() method is invoked before destruction.
+    class MessagePortChannel : Noncopyable {
+    public:
+        // Creates a new wrapper for the passed channel.
+        static PassOwnPtr<MessagePortChannel> create(PassRefPtr<PlatformMessagePortChannel>);
+
+        // Entangles the channel with a port (called when a port has been cloned, after the clone has been marshalled to its new owning thread and is ready to receive messages).
+        // Returns false if the entanglement failed because the port was closed.
+        bool entangleIfOpen(MessagePort*);
+
+        // Disentangles the channel from a given port so it no longer forwards messages to the port. Called when the port is being cloned and no new owning thread has yet been established.
+        void disentangle();
+
+        // Closes the port (ensures that no further messages can be added to either queue).
+        void close();
+
+        // Used by MessagePort.postMessage() to prevent callers from passing a port's own entangled port.
+        bool isConnectedTo(MessagePort*);
+
+        // Returns true if the proxy currently contains messages for this port.
+        bool hasPendingActivity();
+
+        class EventData {
+        public:
+            static PassOwnPtr<EventData> create(const String&, PassOwnPtr<MessagePortChannel>);
+
+            const String& message() { return m_message; }
+            PassOwnPtr<MessagePortChannel> channel() { return m_channel.release(); }
+
+        private:
+            EventData(const String& message, PassOwnPtr<MessagePortChannel>);
+            String m_message;
+            OwnPtr<MessagePortChannel> m_channel;
+        };
+
+        // Sends a message and optional cloned port to the remote port.
+        void postMessageToRemote(PassOwnPtr<EventData>);
+
+        // Extracts a message from the message queue for this port.
+        bool tryGetMessageFromRemote(OwnPtr<EventData>&);
+
+        // Returns the entangled port if run by the same thread (see MessagePort::locallyEntangledPort() for more details).
+        MessagePort* locallyEntangledPort(const ScriptExecutionContext*);
+
+        ~MessagePortChannel();
+
+    private:
+        MessagePortChannel(PassRefPtr<PlatformMessagePortChannel>);
+        RefPtr<PlatformMessagePortChannel> m_channel;
+    };
+
+} // namespace WebCore
+
+#endif // MessagePortChannel_h
diff --git a/src/3rdparty/webkit/WebCore/dom/MouseEvent.cpp b/src/3rdparty/webkit/WebCore/dom/MouseEvent.cpp
index 1c97522..bdd39d3 100644
--- a/src/3rdparty/webkit/WebCore/dom/MouseEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/MouseEvent.cpp
@@ -36,7 +36,7 @@ MouseEvent::MouseEvent()
 MouseEvent::MouseEvent(const AtomicString& eventType, bool canBubble, bool cancelable, PassRefPtr<AbstractView> view,
                        int detail, int screenX, int screenY, int pageX, int pageY,
                        bool ctrlKey, bool altKey, bool shiftKey, bool metaKey,
-                       unsigned short button, PassRefPtr<EventTargetNode> relatedTarget,
+                       unsigned short button, PassRefPtr<EventTarget> relatedTarget,
                        PassRefPtr<Clipboard> clipboard, bool isSimulated)
     : MouseRelatedEvent(eventType, canBubble, cancelable, view, detail, screenX, screenY,
                         pageX, pageY, ctrlKey, altKey, shiftKey, metaKey, isSimulated)
@@ -54,7 +54,7 @@ MouseEvent::~MouseEvent()
 void MouseEvent::initMouseEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<AbstractView> view,
                                 int detail, int screenX, int screenY, int clientX, int clientY,
                                 bool ctrlKey, bool altKey, bool shiftKey, bool metaKey,
-                                unsigned short button, PassRefPtr<EventTargetNode> relatedTarget)
+                                unsigned short button, PassRefPtr<EventTarget> relatedTarget)
 {
     if (dispatched())
         return;
@@ -101,7 +101,7 @@ Node* MouseEvent::toElement() const
 {
     // MSIE extension - "the object toward which the user is moving the mouse pointer"
     if (type() == eventNames().mouseoutEvent) 
-        return relatedTarget();
+        return relatedTarget() ? relatedTarget()->toNode() : 0;
     
     return target() ? target()->toNode() : 0;
 }
@@ -110,7 +110,7 @@ Node* MouseEvent::fromElement() const
 {
     // MSIE extension - "object from which activation or the mouse pointer is exiting during the event" (huh?)
     if (type() != eventNames().mouseoutEvent)
-        return relatedTarget();
+        return relatedTarget() ? relatedTarget()->toNode() : 0;
     
     return target() ? target()->toNode() : 0;
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/MouseEvent.h b/src/3rdparty/webkit/WebCore/dom/MouseEvent.h
index aa3eee5..7454b04 100644
--- a/src/3rdparty/webkit/WebCore/dom/MouseEvent.h
+++ b/src/3rdparty/webkit/WebCore/dom/MouseEvent.h
@@ -25,7 +25,6 @@
 #define MouseEvent_h
 
 #include "Clipboard.h"
-#include "EventTargetNode.h"
 #include "MouseRelatedEvent.h"
 
 namespace WebCore {
@@ -40,7 +39,7 @@ namespace WebCore {
         static PassRefPtr<MouseEvent> create(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<AbstractView> view,
             int detail, int screenX, int screenY, int pageX, int pageY,
             bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, unsigned short button,
-            PassRefPtr<EventTargetNode> relatedTarget, PassRefPtr<Clipboard> clipboard = 0, bool isSimulated = false)
+            PassRefPtr<EventTarget> relatedTarget, PassRefPtr<Clipboard> clipboard = 0, bool isSimulated = false)
         {
             return adoptRef(new MouseEvent(type, canBubble, cancelable, view, detail, screenX, screenY, pageX, pageY,
                 ctrlKey, altKey, shiftKey, metaKey, button, relatedTarget, clipboard, isSimulated));
@@ -50,13 +49,13 @@ namespace WebCore {
         void initMouseEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<AbstractView>,
                             int detail, int screenX, int screenY, int clientX, int clientY,
                             bool ctrlKey, bool altKey, bool shiftKey, bool metaKey,
-                            unsigned short button, PassRefPtr<EventTargetNode> relatedTarget);
+                            unsigned short button, PassRefPtr<EventTarget> relatedTarget);
 
         // WinIE uses 1,4,2 for left/middle/right but not for click (just for mousedown/up, maybe others),
         // but we will match the standard DOM.
         unsigned short button() const { return m_button; }
         bool buttonDown() const { return m_buttonDown; }
-        EventTargetNode* relatedTarget() const { return m_relatedTarget.get(); }
+        EventTarget* relatedTarget() const { return m_relatedTarget.get(); }
 
         Clipboard* clipboard() const { return m_clipboard.get(); }
 
@@ -74,11 +73,11 @@ namespace WebCore {
         MouseEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<AbstractView>,
                    int detail, int screenX, int screenY, int pageX, int pageY,
                    bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, unsigned short button,
-                   PassRefPtr<EventTargetNode> relatedTarget, PassRefPtr<Clipboard> clipboard, bool isSimulated);
+                   PassRefPtr<EventTarget> relatedTarget, PassRefPtr<Clipboard> clipboard, bool isSimulated);
 
         unsigned short m_button;
         bool m_buttonDown;
-        RefPtr<EventTargetNode> m_relatedTarget;
+        RefPtr<EventTarget> m_relatedTarget;
         RefPtr<Clipboard> m_clipboard;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/dom/MouseEvent.idl b/src/3rdparty/webkit/WebCore/dom/MouseEvent.idl
index 3195a7a..c509459 100644
--- a/src/3rdparty/webkit/WebCore/dom/MouseEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/MouseEvent.idl
@@ -58,7 +58,7 @@ module events {
         readonly attribute Node             fromElement;
         readonly attribute Node             toElement;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         readonly attribute Clipboard        dataTransfer;
 #endif
     };
diff --git a/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp b/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp
index a69c8a7..4ed85ce 100644
--- a/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.cpp
@@ -97,6 +97,8 @@ void MouseRelatedEvent::initCoordinates()
     m_layerY = m_pageY;
     m_offsetX = m_pageX;
     m_offsetY = m_pageY;
+
+    computePageLocation();
 }
 
 void MouseRelatedEvent::initCoordinates(int clientX, int clientY)
@@ -112,6 +114,14 @@ void MouseRelatedEvent::initCoordinates(int clientX, int clientY)
     m_layerY = m_pageY;
     m_offsetX = m_pageX;
     m_offsetY = m_pageY;
+
+    computePageLocation();
+}
+
+void MouseRelatedEvent::computePageLocation()
+{
+    float zoomFactor = (view() && view()->frame()) ? view()->frame()->pageZoomFactor() : 1.0f;
+    setAbsoluteLocation(roundedIntPoint(FloatPoint(pageX() * zoomFactor, pageY() * zoomFactor)));
 }
 
 void MouseRelatedEvent::receivedTarget()
@@ -128,14 +138,15 @@ void MouseRelatedEvent::receivedTarget()
     m_offsetY = m_pageY;
 
     // Must have an updated render tree for this math to work correctly.
-    targ->document()->updateRendering();
+    targ->document()->updateStyleIfNeeded();
 
     // Adjust offsetX/Y to be relative to the target's position.
     if (!isSimulated()) {
         if (RenderObject* r = targ->renderer()) {
-            FloatPoint absPos = r->absoluteToLocal(FloatPoint(m_pageX, m_pageY), false, true);
-            m_offsetX = absPos.x();
-            m_offsetY = absPos.y();
+            FloatPoint localPos = r->absoluteToLocal(absoluteLocation(), false, true);
+            float zoomFactor = (view() && view()->frame()) ? view()->frame()->pageZoomFactor() : 1.0f;
+            m_offsetX = lroundf(localPos.x() / zoomFactor);
+            m_offsetY = lroundf(localPos.y() / zoomFactor);
         }
     }
 
@@ -151,8 +162,8 @@ void MouseRelatedEvent::receivedTarget()
         RenderLayer* layer = n->renderer()->enclosingLayer();
         layer->updateLayerPosition();
         for (; layer; layer = layer->parent()) {
-            m_layerX -= layer->xPos();
-            m_layerY -= layer->yPos();
+            m_layerX -= layer->x();
+            m_layerY -= layer->y();
         }
     }
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.h b/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.h
index 35c65dd..7649aa9 100644
--- a/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.h
+++ b/src/3rdparty/webkit/WebCore/dom/MouseRelatedEvent.h
@@ -26,6 +26,7 @@
 #ifndef MouseRelatedEvent_h
 #define MouseRelatedEvent_h
 
+#include "IntPoint.h"
 #include "UIEventWithKeyState.h"
 
 namespace WebCore {
@@ -33,6 +34,8 @@ namespace WebCore {
     // Internal only: Helper class for what's common between mouse and wheel events.
     class MouseRelatedEvent : public UIEventWithKeyState {
     public:
+        // Note that these values are adjusted to counter the effects of zoom, so that values
+        // exposed via DOM APIs are invariant under zooming.
         int screenX() const { return m_screenX; }
         int screenY() const { return m_screenY; }
         int clientX() const { return m_clientX; }
@@ -46,6 +49,11 @@ namespace WebCore {
         virtual int pageY() const;
         int x() const;
         int y() const;
+
+        // Page point in "absolute" coordinates (i.e. post-zoomed, page-relative coords,
+        // usable with RenderObject::absoluteToLocal).
+        IntPoint absoluteLocation() const { return m_absoluteLocation; }
+        void setAbsoluteLocation(const IntPoint& p) { m_absoluteLocation = p; }
     
     protected:
         MouseRelatedEvent();
@@ -56,6 +64,8 @@ namespace WebCore {
         void initCoordinates();
         void initCoordinates(int clientX, int clientY);
         virtual void receivedTarget();
+
+        void computePageLocation();
         
         // Expose these so MouseEvent::initMouseEvent can set them.
         int m_screenX;
@@ -70,6 +80,7 @@ namespace WebCore {
         int m_layerY;
         int m_offsetX;
         int m_offsetY;
+        IntPoint m_absoluteLocation;
         bool m_isSimulated;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp
index 8944b79..f3e9bb2 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.cpp
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *           (C) 2007 Eric Seidel (eric@webkit.org)
  *
  * This library is free software; you can redistribute it and/or
@@ -23,8 +23,9 @@
  */
 
 #include "config.h"
-#include "NamedAttrMap.h"
+#include "NamedNodeMap.h"
 
+#include "Attr.h"
 #include "Document.h"
 #include "Element.h"
 #include "ExceptionCode.h"
@@ -39,17 +40,26 @@ static inline bool shouldIgnoreAttributeCase(const Element* e)
     return e && e->document()->isHTMLDocument() && e->isHTMLElement();
 }
 
-NamedAttrMap::~NamedAttrMap()
+inline void NamedNodeMap::detachAttributesFromElement()
 {
-    NamedAttrMap::clearAttributes(); // virtual function, qualify to be explicit and slightly faster
+    size_t size = m_attributes.size();
+    for (size_t i = 0; i < size; i++) {
+        if (Attr* attr = m_attributes[i]->attr())
+            attr->m_element = 0;
+    }
+}
+
+NamedNodeMap::~NamedNodeMap()
+{
+    detachAttributesFromElement();
 }
 
-bool NamedAttrMap::isMappedAttributeMap() const
+bool NamedNodeMap::isMappedAttributeMap() const
 {
     return false;
 }
 
-PassRefPtr<Node> NamedAttrMap::getNamedItem(const String& name) const
+PassRefPtr<Node> NamedNodeMap::getNamedItem(const String& name) const
 {
     Attribute* a = getAttributeItem(name, shouldIgnoreAttributeCase(m_element));
     if (!a)
@@ -58,12 +68,12 @@ PassRefPtr<Node> NamedAttrMap::getNamedItem(const String& name) const
     return a->createAttrIfNeeded(m_element);
 }
 
-PassRefPtr<Node> NamedAttrMap::getNamedItemNS(const String& namespaceURI, const String& localName) const
+PassRefPtr<Node> NamedNodeMap::getNamedItemNS(const String& namespaceURI, const String& localName) const
 {
     return getNamedItem(QualifiedName(nullAtom, localName, namespaceURI));
 }
 
-PassRefPtr<Node> NamedAttrMap::removeNamedItem(const String& name, ExceptionCode& ec)
+PassRefPtr<Node> NamedNodeMap::removeNamedItem(const String& name, ExceptionCode& ec)
 {
     Attribute* a = getAttributeItem(name, shouldIgnoreAttributeCase(m_element));
     if (!a) {
@@ -74,12 +84,12 @@ PassRefPtr<Node> NamedAttrMap::removeNamedItem(const String& name, ExceptionCode
     return removeNamedItem(a->name(), ec);
 }
 
-PassRefPtr<Node> NamedAttrMap::removeNamedItemNS(const String& namespaceURI, const String& localName, ExceptionCode& ec)
+PassRefPtr<Node> NamedNodeMap::removeNamedItemNS(const String& namespaceURI, const String& localName, ExceptionCode& ec)
 {
     return removeNamedItem(QualifiedName(nullAtom, localName, namespaceURI), ec);
 }
 
-PassRefPtr<Node> NamedAttrMap::getNamedItem(const QualifiedName& name) const
+PassRefPtr<Node> NamedNodeMap::getNamedItem(const QualifiedName& name) const
 {
     Attribute* a = getAttributeItem(name);
     if (!a)
@@ -88,7 +98,7 @@ PassRefPtr<Node> NamedAttrMap::getNamedItem(const QualifiedName& name) const
     return a->createAttrIfNeeded(m_element);
 }
 
-PassRefPtr<Node> NamedAttrMap::setNamedItem(Node* arg, ExceptionCode& ec)
+PassRefPtr<Node> NamedNodeMap::setNamedItem(Node* arg, ExceptionCode& ec)
 {
     if (!m_element || !arg) {
         ec = NOT_FOUND_ERR;
@@ -137,7 +147,7 @@ PassRefPtr<Node> NamedAttrMap::setNamedItem(Node* arg, ExceptionCode& ec)
 // The DOM2 spec doesn't say that removeAttribute[NS] throws NOT_FOUND_ERR
 // if the attribute is not found, but at this level we have to throw NOT_FOUND_ERR
 // because of removeNamedItem, removeNamedItemNS, and removeAttributeNode.
-PassRefPtr<Node> NamedAttrMap::removeNamedItem(const QualifiedName& name, ExceptionCode& ec)
+PassRefPtr<Node> NamedNodeMap::removeNamedItem(const QualifiedName& name, ExceptionCode& ec)
 {
     Attribute* a = getAttributeItem(name);
     if (!a) {
@@ -154,7 +164,7 @@ PassRefPtr<Node> NamedAttrMap::removeNamedItem(const QualifiedName& name, Except
     return r.release();
 }
 
-PassRefPtr<Node> NamedAttrMap::item (unsigned index) const
+PassRefPtr<Node> NamedNodeMap::item (unsigned index) const
 {
     if (index >= length())
         return 0;
@@ -164,7 +174,7 @@ PassRefPtr<Node> NamedAttrMap::item (unsigned index) const
 
 // We use a boolean parameter instead of calling shouldIgnoreAttributeCase so that the caller
 // can tune the behaviour (hasAttribute is case sensitive whereas getAttribute is not).
-Attribute* NamedAttrMap::getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const
+Attribute* NamedNodeMap::getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const
 {
     unsigned len = length();
     for (unsigned i = 0; i < len; ++i) {
@@ -178,7 +188,7 @@ Attribute* NamedAttrMap::getAttributeItem(const String& name, bool shouldIgnoreA
     return 0;
 }
 
-Attribute* NamedAttrMap::getAttributeItem(const QualifiedName& name) const
+Attribute* NamedNodeMap::getAttributeItem(const QualifiedName& name) const
 {
     unsigned len = length();
     for (unsigned i = 0; i < len; ++i) {
@@ -188,25 +198,21 @@ Attribute* NamedAttrMap::getAttributeItem(const QualifiedName& name) const
     return 0;
 }
 
-void NamedAttrMap::clearAttributes()
+void NamedNodeMap::clearAttributes()
 {
-    unsigned len = length();
-    for (unsigned i = 0; i < len; i++)
-        if (Attr* attr = m_attributes[i]->attr())
-            attr->m_element = 0;
-
+    detachAttributesFromElement();
     m_attributes.clear();
 }
 
-void NamedAttrMap::detachFromElement()
+void NamedNodeMap::detachFromElement()
 {
-    // we allow a NamedAttrMap w/o an element in case someone still has a reference
+    // we allow a NamedNodeMap w/o an element in case someone still has a reference
     // to if after the element gets deleted - but the map is now invalid
     m_element = 0;
-    clearAttributes();
+    detachAttributesFromElement();
 }
 
-void NamedAttrMap::setAttributes(const NamedAttrMap& other)
+void NamedNodeMap::setAttributes(const NamedNodeMap& other)
 {
     // clone all attributes in the other map, but attach to our element
     if (!m_element)
@@ -228,13 +234,13 @@ void NamedAttrMap::setAttributes(const NamedAttrMap& other)
 
     // FIXME: This is wasteful.  The class list could be preserved on a copy, and we
     // wouldn't have to waste time reparsing the attribute.
-    // The derived class, HTMLNamedAttrMap, which manages a parsed class list for the CLASS attribute,
+    // The derived class, HTMLNamedNodeMap, which manages a parsed class list for the CLASS attribute,
     // will update its member variable when parse attribute is called.
     for (unsigned i = 0; i < newLength; i++)
         m_element->attributeChanged(m_attributes[i].get(), true);
 }
 
-void NamedAttrMap::addAttribute(PassRefPtr<Attribute> prpAttribute)
+void NamedNodeMap::addAttribute(PassRefPtr<Attribute> prpAttribute)
 {
     RefPtr<Attribute> attribute = prpAttribute;
     
@@ -256,7 +262,7 @@ void NamedAttrMap::addAttribute(PassRefPtr<Attribute> prpAttribute)
     }
 }
 
-void NamedAttrMap::removeAttribute(const QualifiedName& name)
+void NamedNodeMap::removeAttribute(const QualifiedName& name)
 {
     unsigned len = length();
     unsigned index = len + 1;
@@ -290,7 +296,7 @@ void NamedAttrMap::removeAttribute(const QualifiedName& name)
     }
 }
 
-bool NamedAttrMap::mapsEquivalent(const NamedAttrMap* otherMap) const
+bool NamedNodeMap::mapsEquivalent(const NamedNodeMap* otherMap) const
 {
     if (!otherMap)
         return false;
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h
index 693a9e5..4fb96de 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h
+++ b/src/3rdparty/webkit/WebCore/dom/NamedAttrMap.h
@@ -1,11 +1,9 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -28,9 +26,6 @@
 #define NamedAttrMap_h
 
 #include "Attribute.h"
-#include "NamedNodeMap.h"
-#include <wtf/RefPtr.h>
-#include <wtf/Vector.h>
 
 #ifdef __OBJC__
 #define id id_AVOID_KEYWORD
@@ -38,43 +33,49 @@
 
 namespace WebCore {
 
-// the map of attributes of an element
-class NamedAttrMap : public NamedNodeMap {
+class Node;
+
+typedef int ExceptionCode;
+
+class NamedNodeMap : public RefCounted<NamedNodeMap> {
     friend class Element;
+
 protected:
-    NamedAttrMap(Element* element) : m_element(element) { }
-public:
-    static PassRefPtr<NamedAttrMap> create(Element* element) { return adoptRef(new NamedAttrMap(element)); }
+    NamedNodeMap(Element* element) : m_element(element) { }
 
-    virtual ~NamedAttrMap();
+public:
+    static PassRefPtr<NamedNodeMap> create(Element* element) { return adoptRef(new NamedNodeMap(element)); }
 
-    void setAttributes(const NamedAttrMap&);
+    virtual ~NamedNodeMap();
 
-    // DOM methods & attributes for NamedNodeMap
+    // Public DOM interface.
 
-    virtual PassRefPtr<Node> getNamedItem(const String& name) const;
-    virtual PassRefPtr<Node> removeNamedItem(const String& name, ExceptionCode&);
+    PassRefPtr<Node> getNamedItem(const String& name) const;
+    PassRefPtr<Node> removeNamedItem(const String& name, ExceptionCode&);
 
-    virtual PassRefPtr<Node> getNamedItemNS(const String& namespaceURI, const String& localName) const;
-    virtual PassRefPtr<Node> removeNamedItemNS(const String& namespaceURI, const String& localName, ExceptionCode&);
+    PassRefPtr<Node> getNamedItemNS(const String& namespaceURI, const String& localName) const;
+    PassRefPtr<Node> removeNamedItemNS(const String& namespaceURI, const String& localName, ExceptionCode&);
 
-    virtual PassRefPtr<Node> getNamedItem(const QualifiedName& name) const;
-    virtual PassRefPtr<Node> removeNamedItem(const QualifiedName& name, ExceptionCode&);
-    virtual PassRefPtr<Node> setNamedItem(Node* arg, ExceptionCode&);
+    PassRefPtr<Node> getNamedItem(const QualifiedName& name) const;
+    PassRefPtr<Node> removeNamedItem(const QualifiedName& name, ExceptionCode&);
+    PassRefPtr<Node> setNamedItem(Node*, ExceptionCode&);
+    PassRefPtr<Node> setNamedItemNS(Node* node, ExceptionCode& ec) { return setNamedItem(node, ec); }
 
-    virtual PassRefPtr<Node> item(unsigned index) const;
+    PassRefPtr<Node> item(unsigned index) const;
     size_t length() const { return m_attributes.size(); }
+    bool isEmpty() const { return !length(); }
+
+    // Internal interface.
+
+    void setAttributes(const NamedNodeMap&);
 
-    // Other methods (not part of DOM)
     Attribute* attributeItem(unsigned index) const { return m_attributes[index].get(); }
-    Attribute* getAttributeItem(const QualifiedName& name) const;
-    Attribute* getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const;
-    
+    Attribute* getAttributeItem(const QualifiedName&) const;
+
     void shrinkToLength() { m_attributes.shrinkCapacity(length()); }
-    void reserveCapacity(unsigned capacity) { m_attributes.reserveCapacity(capacity); }
+    void reserveInitialCapacity(unsigned capacity) { m_attributes.reserveInitialCapacity(capacity); }
 
-    // used during parsing: only inserts if not already there
-    // no error checking!
+    // Used during parsing: only inserts if not already there. No error checking!
     void insertAttribute(PassRefPtr<Attribute> newAttribute, bool allowDuplicates)
     {
         ASSERT(!m_element);
@@ -85,18 +86,23 @@ public:
     virtual bool isMappedAttributeMap() const;
 
     const AtomicString& id() const { return m_id; }
-    void setID(const AtomicString& _id) { m_id = _id; }
-    
-    bool mapsEquivalent(const NamedAttrMap* otherMap) const;
+    void setID(const AtomicString& newId) { m_id = newId; }
 
-    // These functions are internal, and do no error checking.
+    bool mapsEquivalent(const NamedNodeMap* otherMap) const;
+
+    // These functions do no error checking.
     void addAttribute(PassRefPtr<Attribute>);
-    void removeAttribute(const QualifiedName& name);
+    void removeAttribute(const QualifiedName&);
 
 protected:
     virtual void clearAttributes();
 
+    Element* element() const { return m_element; }
+
+private:
+    void detachAttributesFromElement();
     void detachFromElement();
+    Attribute* getAttributeItem(const String& name, bool shouldIgnoreAttributeCase) const;
 
     Element* m_element;
     Vector<RefPtr<Attribute> > m_attributes;
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.cpp b/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.cpp
index bc2d999..d8e3c80 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.cpp
@@ -27,6 +27,7 @@
 
 #include "Document.h"
 #include "Element.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
@@ -34,7 +35,7 @@ void NamedMappedAttrMap::clearAttributes()
 {
     m_classNames.clear();
     m_mappedAttributeCount = 0;
-    NamedAttrMap::clearAttributes();
+    NamedNodeMap::clearAttributes();
 }
 
 bool NamedMappedAttrMap::isMappedAttributeMap() const
@@ -75,12 +76,12 @@ bool NamedMappedAttrMap::mapsEquivalent(const NamedMappedAttrMap* otherMap) cons
 
 void NamedMappedAttrMap::setClass(const String& classStr) 
 { 
-    if (!m_element->hasClass()) { 
+    if (!element()->hasClass()) { 
         m_classNames.clear(); 
         return;
     }
 
-    m_classNames.set(classStr, m_element->document()->inCompatMode()); 
+    m_classNames.set(classStr, element()->document()->inCompatMode()); 
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.h b/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.h
index c4deddc..0afa278 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.h
+++ b/src/3rdparty/webkit/WebCore/dom/NamedMappedAttrMap.h
@@ -4,7 +4,7 @@
  *           (C) 2001 Peter Kelly (pmk@post.com)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  *           (C) 2007 David Smith (catfish.man@gmail.com)
- * Copyright (C) 2003, 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -27,32 +27,32 @@
 #define NamedMappedAttrMap_h
 
 #include "ClassNames.h"
-#include "MappedAttribute.h"
-#include "NamedAttrMap.h"
+#include "NamedNodeMap.h"
 
 namespace WebCore {
 
-class NamedMappedAttrMap : public NamedAttrMap {
-private:
-    NamedMappedAttrMap(Element* element) : NamedAttrMap(element), m_mappedAttributeCount(0) { }
+class NamedMappedAttrMap : public NamedNodeMap {
 public:
     static PassRefPtr<NamedMappedAttrMap> create(Element* element = 0) { return adoptRef(new NamedMappedAttrMap(element)); }
 
-    virtual void clearAttributes();
-    virtual bool isMappedAttributeMap() const;
-
     void clearClass() { m_classNames.clear(); }
     void setClass(const String&);
     const ClassNames& classNames() const { return m_classNames; }
 
-    virtual bool hasMappedAttributes() const { return m_mappedAttributeCount > 0; }
+    bool hasMappedAttributes() const { return m_mappedAttributeCount > 0; }
     void declRemoved() { m_mappedAttributeCount--; }
     void declAdded() { m_mappedAttributeCount++; }
-    
+
     bool mapsEquivalent(const NamedMappedAttrMap*) const;
-    int declCount() const;
 
 private:
+    NamedMappedAttrMap(Element* element) : NamedNodeMap(element), m_mappedAttributeCount(0) { }
+
+    virtual void clearAttributes();
+    virtual bool isMappedAttributeMap() const;
+
+    int declCount() const;
+
     ClassNames m_classNames;
     int m_mappedAttributeCount;
 };
diff --git a/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.h b/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.h
index 504af69..37ef870 100644
--- a/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.h
+++ b/src/3rdparty/webkit/WebCore/dom/NamedNodeMap.h
@@ -1,64 +1 @@
-/*
- * This file is part of the DOM implementation for KDE.
- *
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2006 Apple Computer, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef NamedNodeMap_h
-#define NamedNodeMap_h
-
-#include <wtf/RefCounted.h>
-#include <wtf/PassRefPtr.h>
-
-namespace WebCore {
-
-class Node;
-class QualifiedName;
-class String;
-
-typedef int ExceptionCode;
-
-// Generic NamedNodeMap interface
-// Other classes implement this for more specific situations e.g. attributes of an element.
-class NamedNodeMap : public RefCounted<NamedNodeMap> {
-public:
-    virtual ~NamedNodeMap() { }
-
-    virtual PassRefPtr<Node> getNamedItem(const String& name) const = 0;
-    virtual PassRefPtr<Node> removeNamedItem(const String& name, ExceptionCode&) = 0;
-
-    virtual PassRefPtr<Node> getNamedItemNS(const String& namespaceURI, const String& localName) const = 0;
-    PassRefPtr<Node> setNamedItemNS(Node* arg, ExceptionCode& ec) { return setNamedItem(arg, ec); }
-    virtual PassRefPtr<Node> removeNamedItemNS(const String& namespaceURI, const String& localName, ExceptionCode&) = 0;
-
-    // DOM methods & attributes for NamedNodeMap
-    virtual PassRefPtr<Node> getNamedItem(const QualifiedName& attrName) const = 0;
-    virtual PassRefPtr<Node> removeNamedItem(const QualifiedName& attrName, ExceptionCode&) = 0;
-    virtual PassRefPtr<Node> setNamedItem(Node*, ExceptionCode&) = 0;
-
-    virtual PassRefPtr<Node> item(unsigned index) const = 0;
-    virtual size_t length() const = 0;
-};
-
-} //namespace
-
-#endif
+#include "NamedAttrMap.h"
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.cpp b/src/3rdparty/webkit/WebCore/dom/Node.cpp
index 6c1254f..3ddf4c0 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Node.cpp
@@ -2,8 +2,9 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,6 +25,7 @@
 #include "config.h"
 #include "Node.h"
 
+#include "Attr.h"
 #include "CSSParser.h"
 #include "CSSRule.h"
 #include "CSSRuleList.h"
@@ -39,24 +41,59 @@
 #include "Document.h"
 #include "DynamicNodeList.h"
 #include "Element.h"
+#include "Event.h"
+#include "EventException.h"
+#include "EventHandler.h"
+#include "EventListener.h"
+#include "EventNames.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
+#include "FrameView.h"
 #include "HTMLNames.h"
-#include "JSDOMBinding.h"
+#include "KeyboardEvent.h"
 #include "Logging.h"
+#include "MouseEvent.h"
+#include "MutationEvent.h"
 #include "NameNodeList.h"
-#include "NamedAttrMap.h"
+#include "NamedNodeMap.h"
 #include "NodeRareData.h"
+#include "Page.h"
+#include "PlatformMouseEvent.h"
+#include "PlatformWheelEvent.h"
 #include "ProcessingInstruction.h"
+#include "ProgressEvent.h"
+#include "RegisteredEventListener.h"
 #include "RenderObject.h"
 #include "ScriptController.h"
 #include "SelectorNodeList.h"
 #include "StringBuilder.h"
 #include "TagNodeList.h"
 #include "Text.h"
+#include "TextEvent.h"
+#include "UIEvent.h"
+#include "UIEventWithKeyState.h"
+#include "WebKitAnimationEvent.h"
+#include "WebKitTransitionEvent.h"
+#include "WheelEvent.h"
 #include "XMLNames.h"
 #include "htmlediting.h"
+#include <wtf/HashSet.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/RefCountedLeakCounter.h>
+#include <wtf/UnusedParam.h>
+
+#if ENABLE(DOM_STORAGE)
+#include "StorageEvent.h"
+#endif
+
+#if ENABLE(SVG)
+#include "SVGElementInstance.h"
+#include "SVGUseElement.h"
+#endif
+
+#if ENABLE(XHTMLMP)
+#include "HTMLNoScriptElement.h"
+#endif
 
 #define DUMP_NODE_STATISTICS 0
 
@@ -66,6 +103,8 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+static HashSet<Node*>* gNodesDispatchingSimulatedClicks = 0;
+
 bool Node::isSupported(const String& feature, const String& version)
 {
     return DOMImplementation::hasFeature(feature, version);
@@ -120,7 +159,7 @@ void Node::dumpStatistics()
                     result.first->second++;
 
                 // AttributeMap stats
-                if (NamedAttrMap* attrMap = element->attributes(true)) {
+                if (NamedNodeMap* attrMap = element->attributes(true)) {
                     attributes += attrMap->length();
                     ++attrMaps;
                     if (attrMap->isMappedAttributeMap())
@@ -217,7 +256,7 @@ void Node::dumpStatistics()
     printf("  Number of MappedAttributes: %zu [%zu]\n", mappedAttributes, sizeof(MappedAttribute));
     printf("  Number of MappedAttributes with a StyleDeclaration: %zu\n", mappedAttributesWithStyleDecl);
     printf("  Number of Attributes with an Attr: %zu\n", attributesWithAttr);
-    printf("  Number of NamedAttrMaps: %zu\n", attrMaps);
+    printf("  Number of NamedNodeMaps: %zu\n", attrMaps);
     printf("  Number of NamedMappedAttrMap: %zu\n", mappedAttrMaps);
 #endif
 }
@@ -243,16 +282,16 @@ void Node::stopIgnoringLeaks()
 #endif
 }
 
-Node::StyleChange Node::diff( RenderStyle *s1, RenderStyle *s2 )
+Node::StyleChange Node::diff(const RenderStyle* s1, const RenderStyle* s2)
 {
     // FIXME: The behavior of this function is just totally wrong.  It doesn't handle
     // explicit inheritance of non-inherited properties and so you end up not re-resolving
     // style in cases where you need to.
     StyleChange ch = NoInherit;
     EDisplay display1 = s1 ? s1->display() : NONE;
-    bool fl1 = s1 && s1->hasPseudoStyle(RenderStyle::FIRST_LETTER);
+    bool fl1 = s1 && s1->hasPseudoStyle(FIRST_LETTER);
     EDisplay display2 = s2 ? s2->display() : NONE;
-    bool fl2 = s2 && s2->hasPseudoStyle(RenderStyle::FIRST_LETTER);
+    bool fl2 = s2 && s2->hasPseudoStyle(FIRST_LETTER);
         
     if (display1 != display2 || fl1 != fl2 || (s1 && s2 && !s1->contentDataEquivalent(s2)))
         ch = Detach;
@@ -263,23 +302,29 @@ Node::StyleChange Node::diff( RenderStyle *s1, RenderStyle *s2 )
     else if (s1->inheritedNotEqual(s2))
         ch = Inherit;
     
+    // For nth-child and other positional rules, treat styles as different if they have
+    // changed positionally in the DOM. This way subsequent sibling resolutions won't be confused
+    // by the wrong child index and evaluate to incorrect results.
+    if (ch == NoChange && s1->childIndex() != s2->childIndex())
+        ch = NoInherit;
+
     // If the pseudoStyles have changed, we want any StyleChange that is not NoChange
     // because setStyle will do the right thing with anything else.
-    if (ch == NoChange && s1->hasPseudoStyle(RenderStyle::BEFORE)) {
-        RenderStyle* ps2 = s2->getCachedPseudoStyle(RenderStyle::BEFORE);
+    if (ch == NoChange && s1->hasPseudoStyle(BEFORE)) {
+        RenderStyle* ps2 = s2->getCachedPseudoStyle(BEFORE);
         if (!ps2)
             ch = NoInherit;
         else {
-            RenderStyle* ps1 = s1->getCachedPseudoStyle(RenderStyle::BEFORE);
+            RenderStyle* ps1 = s1->getCachedPseudoStyle(BEFORE);
             ch = ps1 && *ps1 == *ps2 ? NoChange : NoInherit;
         }
     }
-    if (ch == NoChange && s1->hasPseudoStyle(RenderStyle::AFTER)) {
-        RenderStyle* ps2 = s2->getCachedPseudoStyle(RenderStyle::AFTER);
+    if (ch == NoChange && s1->hasPseudoStyle(AFTER)) {
+        RenderStyle* ps2 = s2->getCachedPseudoStyle(AFTER);
         if (!ps2)
             ch = NoInherit;
         else {
-            RenderStyle* ps1 = s1->getCachedPseudoStyle(RenderStyle::AFTER);
+            RenderStyle* ps1 = s1->getCachedPseudoStyle(AFTER);
             ch = ps2 && *ps1 == *ps2 ? NoChange : NoInherit;
         }
     }
@@ -287,7 +332,7 @@ Node::StyleChange Node::diff( RenderStyle *s1, RenderStyle *s2 )
     return ch;
 }
 
-Node::Node(Document* doc, bool isElement, bool isContainer)
+Node::Node(Document* doc, bool isElement, bool isContainer, bool isText)
     : m_document(doc)
     , m_previous(0)
     , m_next(0)
@@ -296,7 +341,7 @@ Node::Node(Document* doc, bool isElement, bool isContainer)
     , m_hasId(false)
     , m_hasClass(false)
     , m_attached(false)
-    , m_hasChangedChild(false)
+    , m_childNeedsStyleRecalc(false)
     , m_inDocument(false)
     , m_isLink(false)
     , m_active(false)
@@ -307,6 +352,7 @@ Node::Node(Document* doc, bool isElement, bool isContainer)
     , m_hasRareData(false)
     , m_isElement(isElement)
     , m_isContainer(isContainer)
+    , m_isText(isText)
     , m_parsingChildrenFinished(true)
 #if ENABLE(SVG)
     , m_areSVGAttributesValid(true)
@@ -342,6 +388,9 @@ Node::~Node()
     liveNodeSet.remove(this);
 #endif
 
+    if (!eventListeners().isEmpty() && !inDocument())
+        document()->unregisterDisconnectedNodeWithEventListeners(this);
+
     if (!hasRareData())
         ASSERT(!NodeRareData::rareDataMap().contains(this));
     else {
@@ -364,18 +413,51 @@ Node::~Node()
         m_next->setPreviousSibling(0);
 }
 
-void Node::setDocument(Document* doc)
+#ifdef NDEBUG
+
+static inline void setWillMoveToNewOwnerDocumentWasCalled(bool)
+{
+}
+
+static inline void setDidMoveToNewOwnerDocumentWasCalled(bool)
 {
-    if (inDocument() || m_document == doc)
+}
+
+#else
+    
+static bool willMoveToNewOwnerDocumentWasCalled;
+static bool didMoveToNewOwnerDocumentWasCalled;
+
+static void setWillMoveToNewOwnerDocumentWasCalled(bool wasCalled)
+{
+    willMoveToNewOwnerDocumentWasCalled = wasCalled;
+}
+
+static void setDidMoveToNewOwnerDocumentWasCalled(bool wasCalled)
+{
+    didMoveToNewOwnerDocumentWasCalled = wasCalled;
+}
+    
+#endif
+    
+void Node::setDocument(Document* document)
+{
+    if (inDocument() || m_document == document)
         return;
 
+    setWillMoveToNewOwnerDocumentWasCalled(false);
     willMoveToNewOwnerDocument();
+    ASSERT(willMoveToNewOwnerDocumentWasCalled);
 
-    updateDOMNodeDocument(this, m_document.get(), doc);
+#if USE(JSC)
+    updateDOMNodeDocument(this, m_document.get(), document);
+#endif
 
-    m_document = doc;
+    m_document = document;
 
+    setDidMoveToNewOwnerDocumentWasCalled(false);
     didMoveToNewOwnerDocument();
+    ASSERT(didMoveToNewOwnerDocumentWasCalled);
 }
 
 NodeRareData* Node::rareData() const
@@ -431,7 +513,7 @@ PassRefPtr<NodeList> Node::childNodes()
 {
     NodeRareData* data = ensureRareData();
     if (!data->nodeLists()) {
-        data->setNodeLists(auto_ptr<NodeListsNodeData>(new NodeListsNodeData));
+        data->setNodeLists(NodeListsNodeData::create());
         document()->addNodeListCache();
     }
 
@@ -491,43 +573,57 @@ void Node::remove(ExceptionCode& ec)
 void Node::normalize()
 {
     // Go through the subtree beneath us, normalizing all nodes. This means that
-    // any two adjacent text nodes are merged together.
+    // any two adjacent text nodes are merged and any empty text nodes are removed.
 
     RefPtr<Node> node = this;
     while (Node* firstChild = node->firstChild())
         node = firstChild;
-    for (; node; node = node->traverseNextNodePostOrder()) {
+    while (node) {
         NodeType type = node->nodeType();
         if (type == ELEMENT_NODE)
             static_cast<Element*>(node.get())->normalizeAttributes();
 
-        Node* firstChild = node->firstChild();
-        if (firstChild && !firstChild->nextSibling() && firstChild->isTextNode()) {
-            Text* text = static_cast<Text*>(firstChild);
-            if (!text->length()) {
-                ExceptionCode ec;
-                text->remove(ec);
-            }
-        }
-
         if (node == this)
             break;
 
-        if (type == TEXT_NODE) {
-            while (1) {
-                Node* nextSibling = node->nextSibling();
-                if (!nextSibling || !nextSibling->isTextNode())
-                    break;
-                // Current child and the next one are both text nodes. Merge them.
-                Text* text = static_cast<Text*>(node.get());
-                RefPtr<Text> nextText = static_cast<Text*>(nextSibling);
-                unsigned offset = text->length();
+        if (type != TEXT_NODE) {
+            node = node->traverseNextNodePostOrder();
+            continue;
+        }
+
+        Text* text = static_cast<Text*>(node.get());
+
+        // Remove empty text nodes.
+        if (!text->length()) {
+            // Care must be taken to get the next node before removing the current node.
+            node = node->traverseNextNodePostOrder();
+            ExceptionCode ec;
+            text->remove(ec);
+            continue;
+        }
+
+        // Merge text nodes.
+        while (Node* nextSibling = node->nextSibling()) {
+            if (!nextSibling->isTextNode())
+                break;
+            RefPtr<Text> nextText = static_cast<Text*>(nextSibling);
+
+            // Remove empty text nodes.
+            if (!nextText->length()) {
                 ExceptionCode ec;
-                text->appendData(nextText->data(), ec);
-                document()->textNodesMerged(nextText.get(), offset);
                 nextText->remove(ec);
+                continue;
             }
+
+            // Both non-empty text nodes. Merge them.
+            unsigned offset = text->length();
+            ExceptionCode ec;
+            text->appendData(nextText->data(), ec);
+            document()->textNodesMerged(nextText.get(), offset);
+            nextText->remove(ec);
         }
+
+        node = node->traverseNextNodePostOrder();
     }
 }
 
@@ -575,18 +671,25 @@ bool Node::shouldUseInputMethod() const
     return isContentEditable();
 }
 
+RenderBox* Node::renderBox() const
+{
+    return m_renderer && m_renderer->isBox() ? toRenderBox(m_renderer) : 0;
+}
+
+RenderBoxModelObject* Node::renderBoxModelObject() const
+{
+    return m_renderer && m_renderer->isBoxModelObject() ? toRenderBoxModelObject(m_renderer) : 0;
+}
+
 IntRect Node::getRect() const
 {
     // FIXME: broken with transforms
-    if (renderer()) {
-        FloatPoint absPos = renderer()->localToAbsolute();
-        return IntRect(roundedIntPoint(absPos),
-                       IntSize(renderer()->width(), renderer()->height() + renderer()->borderTopExtra() + renderer()->borderBottomExtra()));
-    }
+    if (renderer())
+        return renderer()->absoluteBoundingBoxRect();
     return IntRect();
 }
 
-void Node::setChanged(StyleChangeType changeType)
+void Node::setNeedsStyleRecalc(StyleChangeType changeType)
 {
     if ((changeType != NoStyleChange) && !attached()) // changed compared to what?
         return;
@@ -595,9 +698,10 @@ void Node::setChanged(StyleChangeType changeType)
         m_styleChange = changeType;
 
     if (m_styleChange != NoStyleChange) {
-        for (Node* p = parentNode(); p && !p->hasChangedChild(); p = p->parentNode())
-            p->setHasChangedChild(true);
-        document()->setDocumentChanged(true);
+        for (Node* p = parentNode(); p && !p->childNeedsStyleRecalc(); p = p->parentNode())
+            p->setChildNeedsStyleRecalc(true);
+        if (document()->childNeedsStyleRecalc())
+            document()->scheduleStyleRecalc();
     }
 }
 
@@ -619,7 +723,7 @@ void Node::lazyAttach()
         }
 
         if (n->firstChild())
-            n->setHasChangedChild(true);
+            n->setChildNeedsStyleRecalc(true);
         n->m_styleChange = FullStyleChange;
         n->m_attached = true;
     }
@@ -630,9 +734,10 @@ void Node::lazyAttach()
             lazyAttachedAncestor->detach();
         lazyAttachedAncestor->attach();
     } else {
-        for (Node* p = parentNode(); p && !p->hasChangedChild(); p = p->parentNode())
-            p->setHasChangedChild(true);
-        document()->setDocumentChanged(true);
+        for (Node* p = parentNode(); p && !p->childNeedsStyleRecalc(); p = p->parentNode())
+            p->setChildNeedsStyleRecalc(true);
+        if (document()->childNeedsStyleRecalc())
+            document()->scheduleStyleRecalc();
     }
 }
 
@@ -681,7 +786,7 @@ void Node::registerDynamicNodeList(DynamicNodeList* list)
 {
     NodeRareData* data = ensureRareData();
     if (!data->nodeLists()) {
-        data->setNodeLists(auto_ptr<NodeListsNodeData>(new NodeListsNodeData));
+        data->setNodeLists(NodeListsNodeData::create());
         document()->addNodeListCache();
     } else if (!m_document->hasNodeListCaches()) {
         // We haven't been receiving notifications while there were no registered lists, so the cache is invalid now.
@@ -1073,21 +1178,6 @@ void Node::detach()
     m_inDetach = false;
 }
 
-void Node::insertedIntoDocument()
-{
-    setInDocument(true);
-    insertedIntoTree(false);
-}
-
-void Node::removedFromDocument()
-{
-    if (m_document && m_document->getCSSTarget() == this)
-        m_document->setCSSTarget(0);
-
-    setInDocument(false);
-    removedFromTree(false);
-}
-
 Node *Node::previousEditable() const
 {
     Node *node = previousLeafNode();
@@ -1198,7 +1288,7 @@ void Node::createRendererIfNeeded()
     
     RenderObject* parentRenderer = parent->renderer();
     if (parentRenderer && parentRenderer->canHaveChildren()
-#if ENABLE(SVG)
+#if ENABLE(SVG) || ENABLE(XHTMLMP)
         && parent->childShouldCreateRenderer(this)
 #endif
         ) {
@@ -1219,8 +1309,14 @@ void Node::createRendererIfNeeded()
 
 PassRefPtr<RenderStyle> Node::styleForRenderer()
 {
-    if (isElementNode())
-        return document()->styleSelector()->styleForElement(static_cast<Element*>(this));
+    if (isElementNode()) {
+        bool allowSharing = true;
+#if ENABLE(XHTMLMP)
+        // noscript needs the display property protected - it's a special case
+        allowSharing = localName() != HTMLNames::noscriptTag.localName();
+#endif
+        return document()->styleSelector()->styleForElement(static_cast<Element*>(this), 0, allowSharing);
+    }
     return parentNode() && parentNode()->renderer() ? parentNode()->renderer()->style() : 0;
 }
 
@@ -1263,6 +1359,14 @@ bool Node::canStartSelection() const
 {
     if (isContentEditable())
         return true;
+
+    if (renderer()) {
+        RenderStyle* style = renderer()->style();
+        // We allow selections to begin within an element that has -webkit-user-select: none set,
+        // but if the element is draggable then dragging should take priority over selection.
+        if (style->userDrag() == DRAG_ELEMENT && style->userSelect() == SELECT_NONE)
+            return false;
+    }
     return parent() ? parent()->canStartSelection() : true;
 }
 
@@ -1309,7 +1413,7 @@ bool Node::isBlockFlow() const
 
 bool Node::isBlockFlowOrBlockTable() const
 {
-    return renderer() && (renderer()->isBlockFlow() || renderer()->isTable() && !renderer()->isInline());
+    return renderer() && (renderer()->isBlockFlow() || (renderer()->isTable() && !renderer()->isInline()));
 }
 
 bool Node::isEditableBlock() const
@@ -1384,7 +1488,7 @@ PassRefPtr<NodeList> Node::getElementsByTagNameNS(const AtomicString& namespaceU
     
     NodeRareData* data = ensureRareData();
     if (!data->nodeLists()) {
-        data->setNodeLists(auto_ptr<NodeListsNodeData>(new NodeListsNodeData));
+        data->setNodeLists(NodeListsNodeData::create());
         document()->addNodeListCache();
     }
 
@@ -1405,7 +1509,7 @@ PassRefPtr<NodeList> Node::getElementsByName(const String& elementName)
 {
     NodeRareData* data = ensureRareData();
     if (!data->nodeLists()) {
-        data->setNodeLists(auto_ptr<NodeListsNodeData>(new NodeListsNodeData));
+        data->setNodeLists(NodeListsNodeData::create());
         document()->addNodeListCache();
     }
 
@@ -1420,7 +1524,7 @@ PassRefPtr<NodeList> Node::getElementsByClassName(const String& classNames)
 {
     NodeRareData* data = ensureRareData();
     if (!data->nodeLists()) {
-        data->setNodeLists(auto_ptr<NodeListsNodeData>(new NodeListsNodeData));
+        data->setNodeLists(NodeListsNodeData::create());
         document()->addNodeListCache();
     }
 
@@ -1585,8 +1689,8 @@ bool Node::isEqualNode(Node *other) const
     if (nodeValue() != other->nodeValue())
         return false;
     
-    NamedAttrMap *attrs = attributes();
-    NamedAttrMap *otherAttrs = other->attributes();
+    NamedNodeMap *attrs = attributes();
+    NamedNodeMap *otherAttrs = other->attributes();
     
     if (!attrs && otherAttrs)
         return false;
@@ -1627,7 +1731,7 @@ bool Node::isDefaultNamespace(const AtomicString &namespaceURI) const
                 return elem->namespaceURI() == namespaceURI;
 
             if (elem->hasAttributes()) {
-                NamedAttrMap *attrs = elem->attributes();
+                NamedNodeMap *attrs = elem->attributes();
                 
                 for (unsigned i = 0; i < attrs->length(); i++) {
                     Attribute *attr = attrs->attributeItem(i);
@@ -1713,7 +1817,7 @@ String Node::lookupNamespaceURI(const String &prefix) const
                 return elem->namespaceURI();
             
             if (elem->hasAttributes()) {
-                NamedAttrMap *attrs = elem->attributes();
+                NamedNodeMap *attrs = elem->attributes();
                 
                 for (unsigned i = 0; i < attrs->length(); i++) {
                     Attribute *attr = attrs->attributeItem(i);
@@ -1768,7 +1872,7 @@ String Node::lookupNamespacePrefix(const AtomicString &_namespaceURI, const Elem
         return prefix();
     
     if (hasAttributes()) {
-        NamedAttrMap *attrs = attributes();
+        NamedNodeMap *attrs = attributes();
         
         for (unsigned i = 0; i < attrs->length(); i++) {
             Attribute *attr = attrs->attributeItem(i);
@@ -1909,7 +2013,7 @@ unsigned short Node::compareDocumentPosition(Node* otherNode)
     if (attr1 && attr2 && start1 == start2 && start1) {
         // We are comparing two attributes on the same node.  Crawl our attribute map
         // and see which one we hit first.
-        NamedAttrMap* map = attr1->ownerElement()->attributes(true);
+        NamedNodeMap* map = attr1->ownerElement()->attributes(true);
         unsigned length = map->length();
         for (unsigned i = 0; i < length; ++i) {
             // If neither of the two determining nodes is a child node and nodeType is the same for both determining nodes, then an 
@@ -1976,6 +2080,36 @@ unsigned short Node::compareDocumentPosition(Node* otherNode)
                DOCUMENT_POSITION_PRECEDING | DOCUMENT_POSITION_CONTAINS;
 }
 
+FloatPoint Node::convertToPage(const FloatPoint& p) const
+{
+    // If there is a renderer, just ask it to do the conversion
+    if (renderer())
+        return renderer()->localToAbsolute(p, false, true);
+    
+    // Otherwise go up the tree looking for a renderer
+    Element *parent = ancestorElement();
+    if (parent)
+        return parent->convertToPage(p);
+
+    // No parent - no conversion needed
+    return p;
+}
+
+FloatPoint Node::convertFromPage(const FloatPoint& p) const
+{
+    // If there is a renderer, just ask it to do the conversion
+    if (renderer())
+        return renderer()->absoluteToLocal(p, false, true);
+
+    // Otherwise go up the tree looking for a renderer
+    Element *parent = ancestorElement();
+    if (parent)
+        return parent->convertFromPage(p);
+
+    // No parent - no conversion needed
+    return p;
+}
+
 #ifndef NDEBUG
 
 static void appendAttributeDesc(const Node* node, String& string, const QualifiedName& name, const char* attrDesc)
@@ -2112,6 +2246,1047 @@ ContainerNode* Node::eventParentNode()
 
 // --------
 
+ScriptExecutionContext* Node::scriptExecutionContext() const
+{
+    return document();
+}
+
+const RegisteredEventListenerVector& Node::eventListeners() const
+{
+    if (hasRareData()) {
+        if (RegisteredEventListenerVector* listeners = rareData()->listeners())
+            return *listeners;
+    }
+    static const RegisteredEventListenerVector* emptyListenersVector = new RegisteredEventListenerVector;
+    return *emptyListenersVector;
+}
+
+void Node::insertedIntoDocument()
+{
+    if (!eventListeners().isEmpty())
+        document()->unregisterDisconnectedNodeWithEventListeners(this);
+
+    setInDocument(true);
+}
+
+void Node::removedFromDocument()
+{
+    if (!eventListeners().isEmpty())
+        document()->registerDisconnectedNodeWithEventListeners(this);
+
+    setInDocument(false);
+}
+
+void Node::willMoveToNewOwnerDocument()
+{
+    if (!eventListeners().isEmpty())
+        document()->unregisterDisconnectedNodeWithEventListeners(this);
+
+    ASSERT(!willMoveToNewOwnerDocumentWasCalled);
+    setWillMoveToNewOwnerDocumentWasCalled(true);
+}
+
+void Node::didMoveToNewOwnerDocument()
+{
+    if (!eventListeners().isEmpty())
+        document()->registerDisconnectedNodeWithEventListeners(this);
+
+    ASSERT(!didMoveToNewOwnerDocumentWasCalled);
+    setDidMoveToNewOwnerDocumentWasCalled(true);
+}
+
+static inline void updateSVGElementInstancesAfterEventListenerChange(Node* referenceNode)
+{
+#if !ENABLE(SVG)
+    UNUSED_PARAM(referenceNode);
+#else
+    ASSERT(referenceNode);
+    if (!referenceNode->isSVGElement())
+        return;
+
+    // Elements living inside a <use> shadow tree, never cause any updates!
+    if (referenceNode->shadowTreeRootNode())
+        return;
+
+    // We're possibly (a child of) an element that is referenced by a <use> client
+    // If an event listeners changes on a referenced element, update all instances.
+    for (Node* node = referenceNode; node; node = node->parentNode()) {
+        if (!node->hasID() || !node->isSVGElement())
+            continue;
+
+        SVGElementInstance::invalidateAllInstancesOfElement(static_cast<SVGElement*>(node));
+        break;
+    }
+#endif
+}
+
+void Node::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
+{
+    Document* document = this->document();
+    if (!document->attached())
+        return;
+
+    document->addListenerTypeIfNeeded(eventType);
+
+    RegisteredEventListenerVector& listeners = ensureRareData()->ensureListeners();
+
+    // Remove existing identical listener set with identical arguments.
+    // The DOM2 spec says that "duplicate instances are discarded" in this case.
+    removeEventListener(eventType, listener.get(), useCapture);
+
+    // adding the first one
+    if (listeners.isEmpty() && !inDocument())
+        document->registerDisconnectedNodeWithEventListeners(this);
+
+    listeners.append(RegisteredEventListener::create(eventType, listener, useCapture));
+    updateSVGElementInstancesAfterEventListenerChange(this);
+}
+
+void Node::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
+{
+    if (!hasRareData())
+        return;
+
+    RegisteredEventListenerVector* listeners = rareData()->listeners();
+    if (!listeners)
+        return;
+
+    size_t size = listeners->size();
+    for (size_t i = 0; i < size; ++i) {
+        RegisteredEventListener& r = *listeners->at(i);
+        if (r.eventType() == eventType && r.listener() == listener && r.useCapture() == useCapture) {
+            r.setRemoved(true);
+            listeners->remove(i);
+
+            // removed last
+            if (listeners->isEmpty() && !inDocument())
+                document()->unregisterDisconnectedNodeWithEventListeners(this);
+
+            updateSVGElementInstancesAfterEventListenerChange(this);
+            return;
+        }
+    }
+}
+
+void Node::removeAllEventListenersSlowCase()
+{
+    ASSERT(hasRareData());
+
+    RegisteredEventListenerVector* listeners = rareData()->listeners();
+    if (!listeners)
+        return;
+
+    size_t size = listeners->size();
+    for (size_t i = 0; i < size; ++i)
+        listeners->at(i)->setRemoved(true);
+    listeners->clear();
+}
+
+void Node::handleLocalEvents(Event* event, bool useCapture)
+{
+    if (disabled() && event->isMouseEvent())
+        return;
+
+    RegisteredEventListenerVector listenersCopy = eventListeners();
+    size_t size = listenersCopy.size();
+    for (size_t i = 0; i < size; ++i) {
+        const RegisteredEventListener& r = *listenersCopy[i];
+        if (r.eventType() == event->type() && r.useCapture() == useCapture && !r.removed())
+            r.listener()->handleEvent(event, false);
+    }
+}
+
+#if ENABLE(SVG)
+static inline SVGElementInstance* eventTargetAsSVGElementInstance(Node* referenceNode)
+{
+    ASSERT(referenceNode);
+    if (!referenceNode->isSVGElement())
+        return 0;
+
+    // Spec: The event handling for the non-exposed tree works as if the referenced element had been textually included
+    // as a deeply cloned child of the 'use' element, except that events are dispatched to the SVGElementInstance objects
+    for (Node* n = referenceNode; n; n = n->parentNode()) {
+        if (!n->isShadowNode() || !n->isSVGElement())
+            continue;
+
+        Node* shadowTreeParentElement = n->shadowParentNode();
+        ASSERT(shadowTreeParentElement->hasTagName(SVGNames::useTag));
+
+        if (SVGElementInstance* instance = static_cast<SVGUseElement*>(shadowTreeParentElement)->instanceForShadowTreeElement(referenceNode))
+            return instance;
+    }
+
+    return 0;
+}
+#endif
+
+static inline EventTarget* eventTargetRespectingSVGTargetRules(Node* referenceNode)
+{
+    ASSERT(referenceNode);
+
+#if ENABLE(SVG)
+    if (SVGElementInstance* instance = eventTargetAsSVGElementInstance(referenceNode)) {
+        ASSERT(instance->shadowTreeElement() == referenceNode);
+        return instance;
+    }
+#endif
+
+    return referenceNode;
+}
+
+bool Node::dispatchEvent(PassRefPtr<Event> e, ExceptionCode& ec)
+{
+    RefPtr<Event> evt(e);
+    ASSERT(!eventDispatchForbidden());
+    if (!evt || evt->type().isEmpty()) { 
+        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
+        return false;
+    }
+
+    evt->setTarget(eventTargetRespectingSVGTargetRules(this));
+
+    RefPtr<FrameView> view = document()->view();
+    return dispatchGenericEvent(evt.release());
+}
+
+bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
+{
+    RefPtr<Event> event(prpEvent);
+
+    ASSERT(!eventDispatchForbidden());
+    ASSERT(event->target());
+    ASSERT(!event->type().isNull()); // JavaScript code can create an event with an empty name, but not null.
+
+    // Make a vector of ancestors to send the event to.
+    // If the node is not in a document just send the event to it.
+    // Be sure to ref all of nodes since event handlers could result in the last reference going away.
+    RefPtr<Node> thisNode(this);
+    Vector<RefPtr<ContainerNode> > ancestors;
+    if (inDocument()) {
+        for (ContainerNode* ancestor = eventParentNode(); ancestor; ancestor = ancestor->eventParentNode()) {
+#if ENABLE(SVG)
+            // Skip <use> shadow tree elements.
+            if (ancestor->isSVGElement() && ancestor->isShadowNode())
+                continue;
+#endif
+            ancestors.append(ancestor);
+        }
+    }
+
+    // Set up a pointer to indicate whether / where to dispatch window events.
+    // We don't dispatch load events to the window. That quirk was originally
+    // added because Mozilla doesn't propagate load events to the window object.
+    DOMWindow* targetForWindowEvents = 0;
+    if (event->type() != eventNames().loadEvent) {
+        Node* topLevelContainer = ancestors.isEmpty() ? this : ancestors.last().get();
+        if (topLevelContainer->isDocumentNode())
+            targetForWindowEvents = static_cast<Document*>(topLevelContainer)->domWindow();
+    }
+
+    // Give the target node a chance to do some work before DOM event handlers get a crack.
+    void* data = preDispatchEventHandler(event.get());
+    if (event->propagationStopped())
+        goto doneDispatching;
+
+    // Trigger capturing event handlers, starting at the top and working our way down.
+    event->setEventPhase(Event::CAPTURING_PHASE);
+
+    if (targetForWindowEvents) {
+        event->setCurrentTarget(targetForWindowEvents);
+        targetForWindowEvents->handleEvent(event.get(), true);
+        if (event->propagationStopped())
+            goto doneDispatching;
+    }
+    for (size_t i = ancestors.size(); i; --i) {
+        ContainerNode* ancestor = ancestors[i - 1].get();
+        event->setCurrentTarget(eventTargetRespectingSVGTargetRules(ancestor));
+        ancestor->handleLocalEvents(event.get(), true);
+        if (event->propagationStopped())
+            goto doneDispatching;
+    }
+
+    event->setEventPhase(Event::AT_TARGET);
+
+    // We do want capturing event listeners to be invoked here, even though
+    // that violates some versions of the DOM specification; Mozilla does it.
+    event->setCurrentTarget(eventTargetRespectingSVGTargetRules(this));
+    handleLocalEvents(event.get(), true);
+    if (event->propagationStopped())
+        goto doneDispatching;
+    handleLocalEvents(event.get(), false);
+    if (event->propagationStopped())
+        goto doneDispatching;
+
+    if (event->bubbles() && !event->cancelBubble()) {
+        // Trigger bubbling event handlers, starting at the bottom and working our way up.
+        event->setEventPhase(Event::BUBBLING_PHASE);
+
+        size_t size = ancestors.size();
+        for (size_t i = 0; i < size; ++i) {
+            ContainerNode* ancestor = ancestors[i].get();
+            event->setCurrentTarget(eventTargetRespectingSVGTargetRules(ancestor));
+            ancestor->handleLocalEvents(event.get(), false);
+            if (event->propagationStopped() || event->cancelBubble())
+                goto doneDispatching;
+        }
+        if (targetForWindowEvents) {
+            event->setCurrentTarget(targetForWindowEvents);
+            targetForWindowEvents->handleEvent(event.get(), false);
+            if (event->propagationStopped() || event->cancelBubble())
+                goto doneDispatching;
+        }
+    }
+
+doneDispatching:
+    event->setCurrentTarget(0);
+    event->setEventPhase(0);
+
+    // Pass the data from the preDispatchEventHandler to the postDispatchEventHandler.
+    postDispatchEventHandler(event.get(), data);
+
+    // Call default event handlers. While the DOM does have a concept of preventing
+    // default handling, the detail of which handlers are called is an internal
+    // implementation detail and not part of the DOM.
+    if (!event->defaultPrevented() && !event->defaultHandled()) {
+        // Non-bubbling events call only one default event handler, the one for the target.
+        defaultEventHandler(event.get());
+        ASSERT(!event->defaultPrevented());
+        if (event->defaultHandled())
+            goto doneWithDefault;
+        // For bubbling events, call default event handlers on the same targets in the
+        // same order as the bubbling phase.
+        if (event->bubbles()) {
+            size_t size = ancestors.size();
+            for (size_t i = 0; i < size; ++i) {
+                ContainerNode* ancestor = ancestors[i].get();
+                ancestor->defaultEventHandler(event.get());
+                ASSERT(!event->defaultPrevented());
+                if (event->defaultHandled())
+                    goto doneWithDefault;
+            }
+        }
+    }
+
+doneWithDefault:
+    Document::updateStyleForAllDocuments();
+
+    return !event->defaultPrevented();
+}
+
+void Node::dispatchSubtreeModifiedEvent()
+{
+    ASSERT(!eventDispatchForbidden());
+    
+    document()->incDOMTreeVersion();
+
+    notifyNodeListsAttributeChanged(); // FIXME: Can do better some day. Really only care about the name attribute changing.
+    
+    if (!document()->hasListenerType(Document::DOMSUBTREEMODIFIED_LISTENER))
+        return;
+
+    ExceptionCode ec = 0;
+    dispatchMutationEvent(eventNames().DOMSubtreeModifiedEvent, true, 0, String(), String(), ec); 
+}
+
+void Node::dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr<Event> underlyingEvent)
+{
+    ASSERT(!eventDispatchForbidden());
+    ASSERT(eventType == eventNames().DOMFocusInEvent || eventType == eventNames().DOMFocusOutEvent || eventType == eventNames().DOMActivateEvent);
+    
+    bool cancelable = eventType == eventNames().DOMActivateEvent;
+    
+    ExceptionCode ec = 0;
+    RefPtr<UIEvent> evt = UIEvent::create(eventType, true, cancelable, document()->defaultView(), detail);
+    evt->setUnderlyingEvent(underlyingEvent);
+    dispatchEvent(evt.release(), ec);
+}
+
+bool Node::dispatchKeyEvent(const PlatformKeyboardEvent& key)
+{
+    ASSERT(!eventDispatchForbidden());
+    ExceptionCode ec = 0;
+    RefPtr<KeyboardEvent> keyboardEvent = KeyboardEvent::create(key, document()->defaultView());
+    bool r = dispatchEvent(keyboardEvent, ec);
+    
+    // we want to return false if default is prevented (already taken care of)
+    // or if the element is default-handled by the DOM. Otherwise we let it just
+    // let it get handled by AppKit 
+    if (keyboardEvent->defaultHandled())
+        r = false;
+    
+    return r;
+}
+
+bool Node::dispatchMouseEvent(const PlatformMouseEvent& event, const AtomicString& eventType,
+    int detail, Node* relatedTarget)
+{
+    ASSERT(!eventDispatchForbidden());
+    
+    IntPoint contentsPos;
+    if (FrameView* view = document()->view())
+        contentsPos = view->windowToContents(event.pos());
+
+    short button = event.button();
+
+    ASSERT(event.eventType() == MouseEventMoved || button != NoButton);
+    
+    return dispatchMouseEvent(eventType, button, detail,
+        contentsPos.x(), contentsPos.y(), event.globalX(), event.globalY(),
+        event.ctrlKey(), event.altKey(), event.shiftKey(), event.metaKey(),
+        false, relatedTarget, 0);
+}
+
+void Node::dispatchSimulatedMouseEvent(const AtomicString& eventType,
+    PassRefPtr<Event> underlyingEvent)
+{
+    ASSERT(!eventDispatchForbidden());
+
+    bool ctrlKey = false;
+    bool altKey = false;
+    bool shiftKey = false;
+    bool metaKey = false;
+    if (UIEventWithKeyState* keyStateEvent = findEventWithKeyState(underlyingEvent.get())) {
+        ctrlKey = keyStateEvent->ctrlKey();
+        altKey = keyStateEvent->altKey();
+        shiftKey = keyStateEvent->shiftKey();
+        metaKey = keyStateEvent->metaKey();
+    }
+
+    // Like Gecko, we just pass 0 for everything when we make a fake mouse event.
+    // Internet Explorer instead gives the current mouse position and state.
+    dispatchMouseEvent(eventType, 0, 0, 0, 0, 0, 0,
+        ctrlKey, altKey, shiftKey, metaKey, true, 0, underlyingEvent);
+}
+
+void Node::dispatchSimulatedClick(PassRefPtr<Event> event, bool sendMouseEvents, bool showPressedLook)
+{
+    if (!gNodesDispatchingSimulatedClicks)
+        gNodesDispatchingSimulatedClicks = new HashSet<Node*>;
+    else if (gNodesDispatchingSimulatedClicks->contains(this))
+        return;
+    
+    gNodesDispatchingSimulatedClicks->add(this);
+    
+    // send mousedown and mouseup before the click, if requested
+    if (sendMouseEvents)
+        dispatchSimulatedMouseEvent(eventNames().mousedownEvent, event.get());
+    setActive(true, showPressedLook);
+    if (sendMouseEvents)
+        dispatchSimulatedMouseEvent(eventNames().mouseupEvent, event.get());
+    setActive(false);
+
+    // always send click
+    dispatchSimulatedMouseEvent(eventNames().clickEvent, event);
+    
+    gNodesDispatchingSimulatedClicks->remove(this);
+}
+
+bool Node::dispatchMouseEvent(const AtomicString& eventType, int button, int detail,
+    int pageX, int pageY, int screenX, int screenY,
+    bool ctrlKey, bool altKey, bool shiftKey, bool metaKey, 
+    bool isSimulated, Node* relatedTargetArg, PassRefPtr<Event> underlyingEvent)
+{
+    ASSERT(!eventDispatchForbidden());
+    if (disabled()) // Don't even send DOM events for disabled controls..
+        return true;
+    
+    if (eventType.isEmpty())
+        return false; // Shouldn't happen.
+    
+    // Dispatching the first event can easily result in this node being destroyed.
+    // Since we dispatch up to three events here, we need to make sure we're referenced
+    // so the pointer will be good for the two subsequent ones.
+    RefPtr<Node> protect(this);
+    
+    bool cancelable = eventType != eventNames().mousemoveEvent;
+    
+    ExceptionCode ec = 0;
+    
+    bool swallowEvent = false;
+    
+    // Attempting to dispatch with a non-EventTarget relatedTarget causes the relatedTarget to be silently ignored.
+    RefPtr<Node> relatedTarget = relatedTargetArg;
+
+    int adjustedPageX = pageX;
+    int adjustedPageY = pageY;
+    if (Frame* frame = document()->frame()) {
+        float pageZoom = frame->pageZoomFactor();
+        if (pageZoom != 1.0f) {
+            // Adjust our pageX and pageY to account for the page zoom.
+            adjustedPageX = lroundf(pageX / pageZoom);
+            adjustedPageY = lroundf(pageY / pageZoom);
+        }
+    }
+
+    RefPtr<MouseEvent> mouseEvent = MouseEvent::create(eventType,
+        true, cancelable, document()->defaultView(),
+        detail, screenX, screenY, adjustedPageX, adjustedPageY,
+        ctrlKey, altKey, shiftKey, metaKey, button,
+        relatedTarget, 0, isSimulated);
+    mouseEvent->setUnderlyingEvent(underlyingEvent.get());
+    mouseEvent->setAbsoluteLocation(IntPoint(pageX, pageY));
+    
+    dispatchEvent(mouseEvent, ec);
+    bool defaultHandled = mouseEvent->defaultHandled();
+    bool defaultPrevented = mouseEvent->defaultPrevented();
+    if (defaultHandled || defaultPrevented)
+        swallowEvent = true;
+    
+    // Special case: If it's a double click event, we also send the dblclick event. This is not part
+    // of the DOM specs, but is used for compatibility with the ondblclick="" attribute.  This is treated
+    // as a separate event in other DOM-compliant browsers like Firefox, and so we do the same.
+    if (eventType == eventNames().clickEvent && detail == 2) {
+        RefPtr<Event> doubleClickEvent = MouseEvent::create(eventNames().dblclickEvent,
+            true, cancelable, document()->defaultView(),
+            detail, screenX, screenY, pageX, pageY,
+            ctrlKey, altKey, shiftKey, metaKey, button,
+            relatedTarget, 0, isSimulated);
+        doubleClickEvent->setUnderlyingEvent(underlyingEvent.get());
+        if (defaultHandled)
+            doubleClickEvent->setDefaultHandled();
+        dispatchEvent(doubleClickEvent, ec);
+        if (doubleClickEvent->defaultHandled() || doubleClickEvent->defaultPrevented())
+            swallowEvent = true;
+    }
+
+    return swallowEvent;
+}
+
+void Node::dispatchWheelEvent(PlatformWheelEvent& e)
+{
+    ASSERT(!eventDispatchForbidden());
+    if (e.deltaX() == 0 && e.deltaY() == 0)
+        return;
+    
+    FrameView* view = document()->view();
+    if (!view)
+        return;
+    
+    IntPoint pos = view->windowToContents(e.pos());
+
+    int adjustedPageX = pos.x();
+    int adjustedPageY = pos.y();
+    if (Frame* frame = document()->frame()) {
+        float pageZoom = frame->pageZoomFactor();
+        if (pageZoom != 1.0f) {
+            // Adjust our pageX and pageY to account for the page zoom.
+            adjustedPageX = lroundf(pos.x() / pageZoom);
+            adjustedPageY = lroundf(pos.y() / pageZoom);
+        }
+    }
+    
+    RefPtr<WheelEvent> we = WheelEvent::create(e.wheelTicksX(), e.wheelTicksY(),
+        document()->defaultView(), e.globalX(), e.globalY(), adjustedPageX, adjustedPageY,
+        e.ctrlKey(), e.altKey(), e.shiftKey(), e.metaKey());
+
+    we->setAbsoluteLocation(IntPoint(pos.x(), pos.y()));
+
+    ExceptionCode ec = 0;
+    if (!dispatchEvent(we.release(), ec))
+        e.accept();
+}
+
+void Node::dispatchWebKitAnimationEvent(const AtomicString& eventType, const String& animationName, double elapsedTime)
+{
+    ASSERT(!eventDispatchForbidden());
+    
+    ExceptionCode ec = 0;
+    dispatchEvent(WebKitAnimationEvent::create(eventType, animationName, elapsedTime), ec);
+}
+
+void Node::dispatchWebKitTransitionEvent(const AtomicString& eventType, const String& propertyName, double elapsedTime)
+{
+    ASSERT(!eventDispatchForbidden());
+    
+    ExceptionCode ec = 0;
+    dispatchEvent(WebKitTransitionEvent::create(eventType, propertyName, elapsedTime), ec);
+}
+
+void Node::dispatchMutationEvent(const AtomicString& eventType, bool canBubble, PassRefPtr<Node> relatedNode, const String& prevValue, const String& newValue, ExceptionCode& ec)
+{
+    ASSERT(!eventDispatchForbidden());
+
+    dispatchEvent(MutationEvent::create(eventType, canBubble, false, relatedNode, prevValue, newValue, String(), 0), ec);
+}
+
+void Node::dispatchFocusEvent()
+{
+    dispatchEvent(eventNames().focusEvent, false, false);
+}
+
+void Node::dispatchBlurEvent()
+{
+    dispatchEvent(eventNames().blurEvent, false, false);
+}
+
+bool Node::dispatchEvent(const AtomicString& eventType, bool canBubbleArg, bool cancelableArg)
+{
+    ASSERT(!eventDispatchForbidden());
+    ExceptionCode ec = 0;
+    return dispatchEvent(Event::create(eventType, canBubbleArg, cancelableArg), ec);
+}
+
+void Node::dispatchProgressEvent(const AtomicString &eventType, bool lengthComputableArg, unsigned loadedArg, unsigned totalArg)
+{
+    ASSERT(!eventDispatchForbidden());
+    ExceptionCode ec = 0;
+    dispatchEvent(ProgressEvent::create(eventType, lengthComputableArg, loadedArg, totalArg), ec);
+}
+
+void Node::clearAttributeEventListener(const AtomicString& eventType)
+{
+    if (!hasRareData())
+        return;
+
+    RegisteredEventListenerVector* listeners = rareData()->listeners();
+    if (!listeners)
+        return;
+
+    size_t size = listeners->size();
+    for (size_t i = 0; i < size; ++i) {
+        RegisteredEventListener& r = *listeners->at(i);
+        if (r.eventType() != eventType || !r.listener()->isAttribute())
+            continue;
+
+        r.setRemoved(true);
+        listeners->remove(i);
+
+        // removed last
+        if (listeners->isEmpty() && !inDocument())
+            document()->unregisterDisconnectedNodeWithEventListeners(this);
+
+        updateSVGElementInstancesAfterEventListenerChange(this);
+        return;
+    }
+}
+
+void Node::setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener)
+{
+    clearAttributeEventListener(eventType);
+    if (listener)
+        addEventListener(eventType, listener, false);
+}
+
+EventListener* Node::getAttributeEventListener(const AtomicString& eventType) const
+{
+    const RegisteredEventListenerVector& listeners = eventListeners();
+    size_t size = listeners.size();
+    for (size_t i = 0; i < size; ++i) {
+        const RegisteredEventListener& r = *listeners[i];
+        if (r.eventType() == eventType && r.listener()->isAttribute())
+            return r.listener();
+    }
+    return 0;
+}
+
+bool Node::disabled() const
+{
+    return false;
+}
+
+void Node::defaultEventHandler(Event* event)
+{
+    if (event->target() != this)
+        return;
+    const AtomicString& eventType = event->type();
+    if (eventType == eventNames().keydownEvent || eventType == eventNames().keypressEvent) {
+        if (event->isKeyboardEvent())
+            if (Frame* frame = document()->frame())
+                frame->eventHandler()->defaultKeyboardEventHandler(static_cast<KeyboardEvent*>(event));
+    } else if (eventType == eventNames().clickEvent) {
+        int detail = event->isUIEvent() ? static_cast<UIEvent*>(event)->detail() : 0;
+        dispatchUIEvent(eventNames().DOMActivateEvent, detail, event);
+    } else if (eventType == eventNames().contextmenuEvent) {
+        if (Frame* frame = document()->frame())
+            if (Page* page = frame->page())
+                page->contextMenuController()->handleContextMenuEvent(event);
+    } else if (eventType == eventNames().textInputEvent) {
+        if (event->isTextEvent())
+            if (Frame* frame = document()->frame())
+                frame->eventHandler()->defaultTextInputEventHandler(static_cast<TextEvent*>(event));
+    }
+}
+
+EventListener* Node::onabort() const
+{
+    return getAttributeEventListener(eventNames().abortEvent);
+}
+
+void Node::setOnabort(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().abortEvent, eventListener);
+}
+
+EventListener* Node::onblur() const
+{
+    return getAttributeEventListener(eventNames().blurEvent);
+}
+
+void Node::setOnblur(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().blurEvent, eventListener);
+}
+
+EventListener* Node::onchange() const
+{
+    return getAttributeEventListener(eventNames().changeEvent);
+}
+
+void Node::setOnchange(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().changeEvent, eventListener);
+}
+
+EventListener* Node::onclick() const
+{
+    return getAttributeEventListener(eventNames().clickEvent);
+}
+
+void Node::setOnclick(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().clickEvent, eventListener);
+}
+
+EventListener* Node::oncontextmenu() const
+{
+    return getAttributeEventListener(eventNames().contextmenuEvent);
+}
+
+void Node::setOncontextmenu(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().contextmenuEvent, eventListener);
+}
+
+EventListener* Node::ondblclick() const
+{
+    return getAttributeEventListener(eventNames().dblclickEvent);
+}
+
+void Node::setOndblclick(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dblclickEvent, eventListener);
+}
+
+EventListener* Node::onerror() const
+{
+    return getAttributeEventListener(eventNames().errorEvent);
+}
+
+void Node::setOnerror(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().errorEvent, eventListener);
+}
+
+EventListener* Node::onfocus() const
+{
+    return getAttributeEventListener(eventNames().focusEvent);
+}
+
+void Node::setOnfocus(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().focusEvent, eventListener);
+}
+
+EventListener* Node::oninput() const
+{
+    return getAttributeEventListener(eventNames().inputEvent);
+}
+
+void Node::setOninput(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().inputEvent, eventListener);
+}
+
+EventListener* Node::onkeydown() const
+{
+    return getAttributeEventListener(eventNames().keydownEvent);
+}
+
+void Node::setOnkeydown(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().keydownEvent, eventListener);
+}
+
+EventListener* Node::onkeypress() const
+{
+    return getAttributeEventListener(eventNames().keypressEvent);
+}
+
+void Node::setOnkeypress(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().keypressEvent, eventListener);
+}
+
+EventListener* Node::onkeyup() const
+{
+    return getAttributeEventListener(eventNames().keyupEvent);
+}
+
+void Node::setOnkeyup(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().keyupEvent, eventListener);
+}
+
+EventListener* Node::onload() const
+{
+    return getAttributeEventListener(eventNames().loadEvent);
+}
+
+void Node::setOnload(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().loadEvent, eventListener);
+}
+
+EventListener* Node::onmousedown() const
+{
+    return getAttributeEventListener(eventNames().mousedownEvent);
+}
+
+void Node::setOnmousedown(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().mousedownEvent, eventListener);
+}
+
+EventListener* Node::onmousemove() const
+{
+    return getAttributeEventListener(eventNames().mousemoveEvent);
+}
+
+void Node::setOnmousemove(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().mousemoveEvent, eventListener);
+}
+
+EventListener* Node::onmouseout() const
+{
+    return getAttributeEventListener(eventNames().mouseoutEvent);
+}
+
+void Node::setOnmouseout(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().mouseoutEvent, eventListener);
+}
+
+EventListener* Node::onmouseover() const
+{
+    return getAttributeEventListener(eventNames().mouseoverEvent);
+}
+
+void Node::setOnmouseover(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().mouseoverEvent, eventListener);
+}
+
+EventListener* Node::onmouseup() const
+{
+    return getAttributeEventListener(eventNames().mouseupEvent);
+}
+
+void Node::setOnmouseup(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().mouseupEvent, eventListener);
+}
+
+EventListener* Node::onmousewheel() const
+{
+    return getAttributeEventListener(eventNames().mousewheelEvent);
+}
+
+void Node::setOnmousewheel(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().mousewheelEvent, eventListener);
+}
+
+EventListener* Node::ondragenter() const
+{
+    return getAttributeEventListener(eventNames().dragenterEvent);
+}
+
+void Node::setOndragenter(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragenterEvent, eventListener);
+}
+
+EventListener* Node::ondragover() const
+{
+    return getAttributeEventListener(eventNames().dragoverEvent);
+}
+
+void Node::setOndragover(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragoverEvent, eventListener);
+}
+
+EventListener* Node::ondragleave() const
+{
+    return getAttributeEventListener(eventNames().dragleaveEvent);
+}
+
+void Node::setOndragleave(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragleaveEvent, eventListener);
+}
+
+EventListener* Node::ondrop() const
+{
+    return getAttributeEventListener(eventNames().dropEvent);
+}
+
+void Node::setOndrop(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dropEvent, eventListener);
+}
+
+EventListener* Node::ondragstart() const
+{
+    return getAttributeEventListener(eventNames().dragstartEvent);
+}
+
+void Node::setOndragstart(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragstartEvent, eventListener);
+}
+
+EventListener* Node::ondrag() const
+{
+    return getAttributeEventListener(eventNames().dragEvent);
+}
+
+void Node::setOndrag(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragEvent, eventListener);
+}
+
+EventListener* Node::ondragend() const
+{
+    return getAttributeEventListener(eventNames().dragendEvent);
+}
+
+void Node::setOndragend(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragendEvent, eventListener);
+}
+
+EventListener* Node::onscroll() const
+{
+    return getAttributeEventListener(eventNames().scrollEvent);
+}
+
+void Node::setOnscroll(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().scrollEvent, eventListener);
+}
+
+EventListener* Node::onselect() const
+{
+    return getAttributeEventListener(eventNames().selectEvent);
+}
+
+void Node::setOnselect(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().selectEvent, eventListener);
+}
+
+EventListener* Node::onsubmit() const
+{
+    return getAttributeEventListener(eventNames().submitEvent);
+}
+
+void Node::setOnsubmit(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().submitEvent, eventListener);
+}
+
+EventListener* Node::onbeforecut() const
+{
+    return getAttributeEventListener(eventNames().beforecutEvent);
+}
+
+void Node::setOnbeforecut(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().beforecutEvent, eventListener);
+}
+
+EventListener* Node::oncut() const
+{
+    return getAttributeEventListener(eventNames().cutEvent);
+}
+
+void Node::setOncut(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().cutEvent, eventListener);
+}
+
+EventListener* Node::onbeforecopy() const
+{
+    return getAttributeEventListener(eventNames().beforecopyEvent);
+}
+
+void Node::setOnbeforecopy(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().beforecopyEvent, eventListener);
+}
+
+EventListener* Node::oncopy() const
+{
+    return getAttributeEventListener(eventNames().copyEvent);
+}
+
+void Node::setOncopy(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().copyEvent, eventListener);
+}
+
+EventListener* Node::onbeforepaste() const
+{
+    return getAttributeEventListener(eventNames().beforepasteEvent);
+}
+
+void Node::setOnbeforepaste(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().beforepasteEvent, eventListener);
+}
+
+EventListener* Node::onpaste() const
+{
+    return getAttributeEventListener(eventNames().pasteEvent);
+}
+
+void Node::setOnpaste(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().pasteEvent, eventListener);
+}
+
+EventListener* Node::onreset() const
+{
+    return getAttributeEventListener(eventNames().resetEvent);
+}
+
+void Node::setOnreset(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().resetEvent, eventListener);
+}
+
+EventListener* Node::onsearch() const
+{
+    return getAttributeEventListener(eventNames().searchEvent);
+}
+
+void Node::setOnsearch(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().searchEvent, eventListener);
+}
+
+EventListener* Node::onselectstart() const
+{
+    return getAttributeEventListener(eventNames().selectstartEvent);
+}
+
+void Node::setOnselectstart(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().selectstartEvent, eventListener);
+}
+
 } // namespace WebCore
 
 #ifndef NDEBUG
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.h b/src/3rdparty/webkit/WebCore/dom/Node.h
index 5478b86..ab743f4 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.h
+++ b/src/3rdparty/webkit/WebCore/dom/Node.h
@@ -2,7 +2,8 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,9 +26,12 @@
 #define Node_h
 
 #include "DocPtr.h"
+#include "EventTarget.h"
 #include "KURLHash.h"
 #include "PlatformString.h"
+#include "RegisteredEventListener.h"
 #include "TreeShared.h"
+#include "FloatPoint.h"
 #include <wtf/Assertions.h>
 #include <wtf/ListHashSet.h>
 #include <wtf/OwnPtr.h>
@@ -36,26 +40,31 @@
 namespace WebCore {
 
 class AtomicString;
+class Attribute;
 class ContainerNode;
 class Document;
 class DynamicNodeList;
 class Element;
 class Event;
 class EventListener;
+class Frame;
 class IntRect;
 class KeyboardEvent;
 class NSResolver;
-class NamedAttrMap;
+class NamedNodeMap;
 class NodeList;
+class NodeRareData;
 class PlatformKeyboardEvent;
 class PlatformMouseEvent;
 class PlatformWheelEvent;
 class QualifiedName;
+class RegisteredEventListener;
 class RenderArena;
+class RenderBox;
+class RenderBoxModelObject;
 class RenderObject;
 class RenderStyle;
 class StringBuilder;
-class NodeRareData;
 
 typedef int ExceptionCode;
 
@@ -70,7 +79,7 @@ const unsigned short DOCUMENT_POSITION_CONTAINED_BY = 0x10;
 const unsigned short DOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC = 0x20;
 
 // this class implements nodes, which can have a parent but no children:
-class Node : public TreeShared<Node> {
+class Node : public EventTarget, public TreeShared<Node> {
     friend class Document;
 public:
     enum NodeType {
@@ -97,9 +106,9 @@ public:
     static void dumpStatistics();
 
     enum StyleChange { NoChange, NoInherit, Inherit, Detach, Force };    
-    static StyleChange diff(RenderStyle*, RenderStyle*);
+    static StyleChange diff(const RenderStyle*, const RenderStyle*);
 
-    Node(Document*, bool isElement = false, bool isContainer = false);
+    Node(Document*, bool isElement = false, bool isContainer = false, bool isText = false);
     virtual ~Node();
 
     // DOM methods & attributes for Node
@@ -117,7 +126,7 @@ public:
     Node* firstChild() const { return isContainerNode() ? containerFirstChild() : 0; }
     Node* lastChild() const { return isContainerNode() ? containerLastChild() : 0; }
     bool hasAttributes() const;
-    NamedAttrMap* attributes() const;
+    NamedNodeMap* attributes() const;
 
     virtual KURL baseURI() const;
     
@@ -157,6 +166,8 @@ public:
 
     bool isElementNode() const { return m_isElement; }
     bool isContainerNode() const { return m_isContainer; }
+    bool isTextNode() const { return m_isText; }
+
     virtual bool isHTMLElement() const { return false; }
 
 #if ENABLE(SVG)
@@ -174,11 +185,9 @@ public:
     virtual bool isStyledElement() const { return false; }
     virtual bool isFrameOwnerElement() const { return false; }
     virtual bool isAttributeNode() const { return false; }
-    virtual bool isTextNode() const { return false; }
     virtual bool isCommentNode() const { return false; }
     virtual bool isCharacterDataNode() const { return false; }
     bool isDocumentNode() const;
-    virtual bool isEventTargetNode() const { return false; }
     virtual bool isShadowNode() const { return false; }
     virtual Node* shadowParentNode() { return 0; }
     Node* shadowAncestorNode();
@@ -256,16 +265,16 @@ public:
     bool focused() const { return hasRareData() ? rareDataFocused() : false; }
     bool attached() const { return m_attached; }
     void setAttached(bool b = true) { m_attached = b; }
-    bool changed() const { return m_styleChange != NoStyleChange; }
+    bool needsStyleRecalc() const { return m_styleChange != NoStyleChange; }
     StyleChangeType styleChangeType() const { return static_cast<StyleChangeType>(m_styleChange); }
-    bool hasChangedChild() const { return m_hasChangedChild; }
+    bool childNeedsStyleRecalc() const { return m_childNeedsStyleRecalc; }
     bool isLink() const { return m_isLink; }
     void setHasID(bool b = true) { m_hasId = b; }
     void setHasClass(bool b = true) { m_hasClass = b; }
-    void setHasChangedChild( bool b = true ) { m_hasChangedChild = b; }
+    void setChildNeedsStyleRecalc(bool b = true) { m_childNeedsStyleRecalc = b; }
     void setInDocument(bool b = true) { m_inDocument = b; }
     void setInActiveChain(bool b = true) { m_inActiveChain = b; }
-    void setChanged(StyleChangeType changeType = FullStyleChange);
+    void setNeedsStyleRecalc(StyleChangeType changeType = FullStyleChange);
     void setIsLink(bool b = true) { m_isLink = b; }
 
     bool inSubtreeMark() const { return m_inSubtreeMark; }
@@ -288,14 +297,6 @@ public:
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual bool isMouseFocusable() const;
 
-    virtual bool isAutofilled() const { return false; }
-    virtual bool isControl() const { return false; } // Eventually the notion of what is a control will be extensible.
-    virtual bool isEnabled() const { return true; }
-    virtual bool isChecked() const { return false; }
-    virtual bool isIndeterminate() const { return false; }
-    virtual bool isReadOnlyControl() const { return false; }
-    virtual bool isTextControl() const { return false; }
-
     virtual bool isContentEditable() const;
     virtual bool isContentRichlyEditable() const;
     virtual bool shouldUseInputMethod() const;
@@ -314,7 +315,7 @@ public:
     Document* document() const
     {
         ASSERT(this);
-        ASSERT(m_document || nodeType() == DOCUMENT_TYPE_NODE && !inDocument());
+        ASSERT(m_document || (nodeType() == DOCUMENT_TYPE_NODE && !inDocument()));
         return m_document.get();
     }
     void setDocument(Document*);
@@ -373,6 +374,10 @@ public:
     RenderObject* previousRenderer();
     void setRenderer(RenderObject* renderer) { m_renderer = renderer; }
     
+    // Use these two methods with caution.
+    RenderBox* renderBox() const;
+    RenderBoxModelObject* renderBoxModelObject() const;
+
     void checkSetPrefix(const AtomicString& prefix, ExceptionCode&);
     bool isDescendantOf(const Node*) const;
     bool contains(const Node*) const;
@@ -399,6 +404,10 @@ public:
     // Whether or not a selection can be started in this object
     virtual bool canStartSelection() const;
 
+    // Getting points into and out of screen space
+    FloatPoint convertToPage(const FloatPoint& p) const;
+    FloatPoint convertFromPage(const FloatPoint& p) const;
+
     // -----------------------------------------------------------------------------
     // Integration with rendering tree
 
@@ -419,7 +428,7 @@ public:
     void createRendererIfNeeded();
     PassRefPtr<RenderStyle> styleForRenderer();
     virtual bool rendererIsNeeded(RenderStyle*);
-#if ENABLE(SVG)
+#if ENABLE(SVG) || ENABLE(XHTMLMP)
     virtual bool childShouldCreateRenderer(Node*) const { return true; }
 #endif
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
@@ -491,8 +500,8 @@ public:
     unsigned short compareDocumentPosition(Node*);
 
 protected:
-    virtual void willMoveToNewOwnerDocument() { }
-    virtual void didMoveToNewOwnerDocument() { }
+    virtual void willMoveToNewOwnerDocument();
+    virtual void didMoveToNewOwnerDocument();
     
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const { }
     void setTabIndexExplicitly(short);
@@ -502,6 +511,153 @@ protected:
     NodeRareData* rareData() const;
     NodeRareData* ensureRareData();
 
+public:
+    virtual Node* toNode() { return this; }
+
+    virtual ScriptExecutionContext* scriptExecutionContext() const;
+
+    // Used for standard DOM addEventListener / removeEventListener APIs.
+    virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
+    virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
+
+    // Used for legacy "onEvent" property APIs.
+    void setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
+    void clearAttributeEventListener(const AtomicString& eventType);
+    EventListener* getAttributeEventListener(const AtomicString& eventType) const;
+
+    virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
+    bool dispatchEvent(const AtomicString& eventType, bool canBubble, bool cancelable);
+
+    void removeAllEventListeners() { if (hasRareData()) removeAllEventListenersSlowCase(); }
+
+    void dispatchSubtreeModifiedEvent();
+    void dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr<Event> underlyingEvent);
+    bool dispatchKeyEvent(const PlatformKeyboardEvent&);
+    void dispatchWheelEvent(PlatformWheelEvent&);
+    bool dispatchMouseEvent(const PlatformMouseEvent&, const AtomicString& eventType,
+        int clickCount = 0, Node* relatedTarget = 0);
+    bool dispatchMouseEvent(const AtomicString& eventType, int button, int clickCount,
+        int pageX, int pageY, int screenX, int screenY,
+        bool ctrlKey, bool altKey, bool shiftKey, bool metaKey,
+        bool isSimulated, Node* relatedTarget, PassRefPtr<Event> underlyingEvent);
+    void dispatchSimulatedMouseEvent(const AtomicString& eventType, PassRefPtr<Event> underlyingEvent);
+    void dispatchSimulatedClick(PassRefPtr<Event> underlyingEvent, bool sendMouseEvents = false, bool showPressedLook = true);
+    void dispatchProgressEvent(const AtomicString& eventType, bool lengthComputableArg, unsigned loadedArg, unsigned totalArg);
+    void dispatchWebKitAnimationEvent(const AtomicString& eventType, const String& animationName, double elapsedTime);
+    void dispatchWebKitTransitionEvent(const AtomicString& eventType, const String& propertyName, double elapsedTime);
+    void dispatchMutationEvent(const AtomicString& type, bool canBubble, PassRefPtr<Node> relatedNode, const String& prevValue, const String& newValue, ExceptionCode&);
+
+    bool dispatchGenericEvent(PassRefPtr<Event>);
+
+    virtual void handleLocalEvents(Event*, bool useCapture);
+
+    virtual void dispatchFocusEvent();
+    virtual void dispatchBlurEvent();
+
+    /**
+     * Perform the default action for an event e.g. submitting a form
+     */
+    virtual void defaultEventHandler(Event*);
+
+    /**
+     * Used for disabled form elements; if true, prevents mouse events from being dispatched
+     * to event listeners, and prevents DOMActivate events from being sent at all.
+     */
+    virtual bool disabled() const;
+
+    const RegisteredEventListenerVector& eventListeners() const;
+
+    // These 4 attribute event handler attributes are overrided by HTMLBodyElement
+    // and HTMLFrameSetElement to forward to the DOMWindow.
+    virtual EventListener* onblur() const;
+    virtual void setOnblur(PassRefPtr<EventListener>);
+    virtual EventListener* onerror() const;
+    virtual void setOnerror(PassRefPtr<EventListener>);
+    virtual EventListener* onfocus() const;
+    virtual void setOnfocus(PassRefPtr<EventListener>);
+    virtual EventListener* onload() const;
+    virtual void setOnload(PassRefPtr<EventListener>);
+
+    EventListener* onabort() const;
+    void setOnabort(PassRefPtr<EventListener>);
+    EventListener* onchange() const;
+    void setOnchange(PassRefPtr<EventListener>);
+    EventListener* onclick() const;
+    void setOnclick(PassRefPtr<EventListener>);
+    EventListener* oncontextmenu() const;
+    void setOncontextmenu(PassRefPtr<EventListener>);
+    EventListener* ondblclick() const;
+    void setOndblclick(PassRefPtr<EventListener>);
+    EventListener* oninput() const;
+    void setOninput(PassRefPtr<EventListener>);
+    EventListener* onkeydown() const;
+    void setOnkeydown(PassRefPtr<EventListener>);
+    EventListener* onkeypress() const;
+    void setOnkeypress(PassRefPtr<EventListener>);
+    EventListener* onkeyup() const;
+    void setOnkeyup(PassRefPtr<EventListener>);
+    EventListener* onmousedown() const;
+    void setOnmousedown(PassRefPtr<EventListener>);
+    EventListener* onmousemove() const;
+    void setOnmousemove(PassRefPtr<EventListener>);
+    EventListener* onmouseout() const;
+    void setOnmouseout(PassRefPtr<EventListener>);
+    EventListener* onmouseover() const;
+    void setOnmouseover(PassRefPtr<EventListener>);
+    EventListener* onmouseup() const;
+    void setOnmouseup(PassRefPtr<EventListener>);
+    EventListener* onmousewheel() const;
+    void setOnmousewheel(PassRefPtr<EventListener>);
+    EventListener* ondragenter() const;
+    void setOndragenter(PassRefPtr<EventListener>);
+    EventListener* ondragover() const;
+    void setOndragover(PassRefPtr<EventListener>);
+    EventListener* ondragleave() const;
+    void setOndragleave(PassRefPtr<EventListener>);
+    EventListener* ondrop() const;
+    void setOndrop(PassRefPtr<EventListener>);
+    EventListener* ondragstart() const;
+    void setOndragstart(PassRefPtr<EventListener>);
+    EventListener* ondrag() const;
+    void setOndrag(PassRefPtr<EventListener>);
+    EventListener* ondragend() const;
+    void setOndragend(PassRefPtr<EventListener>);
+    EventListener* onscroll() const;
+    void setOnscroll(PassRefPtr<EventListener>);
+    EventListener* onselect() const;
+    void setOnselect(PassRefPtr<EventListener>);
+    EventListener* onsubmit() const;
+    void setOnsubmit(PassRefPtr<EventListener>);
+
+    // WebKit extensions
+    EventListener* onbeforecut() const;
+    void setOnbeforecut(PassRefPtr<EventListener>);
+    EventListener* oncut() const;
+    void setOncut(PassRefPtr<EventListener>);
+    EventListener* onbeforecopy() const;
+    void setOnbeforecopy(PassRefPtr<EventListener>);
+    EventListener* oncopy() const;
+    void setOncopy(PassRefPtr<EventListener>);
+    EventListener* onbeforepaste() const;
+    void setOnbeforepaste(PassRefPtr<EventListener>);
+    EventListener* onpaste() const;
+    void setOnpaste(PassRefPtr<EventListener>);
+    EventListener* onreset() const;
+    void setOnreset(PassRefPtr<EventListener>);
+    EventListener* onsearch() const;
+    void setOnsearch(PassRefPtr<EventListener>);
+    EventListener* onselectstart() const;
+    void setOnselectstart(PassRefPtr<EventListener>);
+
+    using TreeShared<Node>::ref;
+    using TreeShared<Node>::deref;
+ 
+private:
+    virtual void refEventTarget() { ref(); }
+    virtual void derefEventTarget() { deref(); }
+
+    void removeAllEventListenersSlowCase();
+
 private:
     virtual NodeRareData* createRareData();
     Node* containerChildNode(unsigned index) const;
@@ -529,7 +685,7 @@ private:
     bool m_hasId : 1;
     bool m_hasClass : 1;
     bool m_attached : 1;
-    bool m_hasChangedChild : 1;
+    bool m_childNeedsStyleRecalc : 1;
     bool m_inDocument : 1;
     bool m_isLink : 1;
     bool m_active : 1;
@@ -540,6 +696,7 @@ private:
     bool m_hasRareData : 1;
     const bool m_isElement : 1;
     const bool m_isContainer : 1;
+    const bool m_isText : 1;
 
 protected:
     // These bits are used by the Element derived class, pulled up here so they can
diff --git a/src/3rdparty/webkit/WebCore/dom/Node.idl b/src/3rdparty/webkit/WebCore/dom/Node.idl
index f45eaa6..bcfb226 100644
--- a/src/3rdparty/webkit/WebCore/dom/Node.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Node.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -22,15 +22,16 @@ module core {
 
     interface [
         CustomMarkFunction,
+        CustomPushEventHandlerScope,
         GenerateConstructor,
         GenerateNativeConverter,
         GenerateToJS,
         InlineGetOwnPropertySlot,
-        ObjCCustomInternalImpl,
+        Polymorphic,
         InterfaceUUID=84BA0D7A-7E3E-4a7b-B6FB-7653E8FB54ED,
         ImplementationUUID=81B47FDB-94B0-40fd-8E0C-FB2A6E53CC04
     ] Node
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         : Object, EventTarget
 #endif /* defined(LANGUAGE_OBJECTIVE_C) */
      {
@@ -64,12 +65,12 @@ module core {
         readonly attribute NamedNodeMap     attributes;
         readonly attribute Document         ownerDocument;
 
-        [OldStyleObjC, Custom] Node insertBefore(in [Return] Node newChild, 
+        [OldStyleObjC, Custom] Node insertBefore(in [Return] Node newChild,
                                                  in Node refChild)
             raises(DOMException);
-        [OldStyleObjC, Custom] Node replaceChild(in Node newChild, 
+        [OldStyleObjC, Custom] Node replaceChild(in Node newChild,
                                                  in [Return] Node oldChild)
-            raises(DOMException);
+            raises(DOMExceptionJSC);
         [Custom] Node               removeChild(in [Return] Node oldChild)
             raises(DOMException);
         [Custom] Node               appendChild(in [Return] Node newChild)
@@ -124,13 +125,26 @@ module core {
         DOMUserData        getUserData(in DOMString key);
 #endif /* 0 */
 
-        // IE extentions
-        readonly attribute Node             parentElement;
+        // IE extensions
+        readonly attribute Element          parentElement;
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extensions
         readonly attribute boolean          isContentEditable;
 #endif /* defined(LANGUAGE_OBJECTIVE_C) */
+
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+        [Custom] void addEventListener(in DOMString type, 
+                                       in EventListener listener, 
+                                       in boolean useCapture);
+        [Custom] void removeEventListener(in DOMString type, 
+                                          in EventListener listener, 
+                                          in boolean useCapture);
+        boolean dispatchEvent(in Event event)
+            raises(EventException);
+#endif
+#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/NodeFilter.h b/src/3rdparty/webkit/WebCore/dom/NodeFilter.h
index 4356357..94c87e3 100644
--- a/src/3rdparty/webkit/WebCore/dom/NodeFilter.h
+++ b/src/3rdparty/webkit/WebCore/dom/NodeFilter.h
@@ -25,7 +25,6 @@
 #ifndef NodeFilter_h
 #define NodeFilter_h
 
-#include "JSDOMBinding.h"
 #include "NodeFilterCondition.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
diff --git a/src/3rdparty/webkit/WebCore/dom/NodeIterator.h b/src/3rdparty/webkit/WebCore/dom/NodeIterator.h
index d7eee36..2a992d3 100644
--- a/src/3rdparty/webkit/WebCore/dom/NodeIterator.h
+++ b/src/3rdparty/webkit/WebCore/dom/NodeIterator.h
@@ -25,7 +25,6 @@
 #ifndef NodeIterator_h
 #define NodeIterator_h
 
-#include "JSDOMBinding.h"
 #include "NodeFilter.h"
 #include "Traversal.h"
 #include <wtf/PassRefPtr.h>
diff --git a/src/3rdparty/webkit/WebCore/dom/NodeRareData.h b/src/3rdparty/webkit/WebCore/dom/NodeRareData.h
index bbcfca8..ae0e516 100644
--- a/src/3rdparty/webkit/WebCore/dom/NodeRareData.h
+++ b/src/3rdparty/webkit/WebCore/dom/NodeRareData.h
@@ -28,6 +28,7 @@
 #include "StringHash.h"
 #include "QualifiedName.h"
 #include <wtf/HashSet.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
@@ -44,7 +45,11 @@ struct NodeListsNodeData {
     
     typedef HashMap<QualifiedName, DynamicNodeList::Caches*> TagCacheMap;
     TagCacheMap m_tagNodeListCaches;
-    
+
+    static PassOwnPtr<NodeListsNodeData> create() {
+        return new NodeListsNodeData;
+    }
+
     ~NodeListsNodeData()
     {
         deleteAllValues(m_classNodeListCaches);
@@ -55,6 +60,9 @@ struct NodeListsNodeData {
     void invalidateCaches();
     void invalidateCachesThatDependOnAttributes();
     bool isEmpty() const;
+
+private:
+    NodeListsNodeData() { }
 };
     
 class NodeRareData {
@@ -81,7 +89,7 @@ public:
     }
     
     void clearNodeLists() { m_nodeLists.clear(); }
-    void setNodeLists(std::auto_ptr<NodeListsNodeData> lists) { m_nodeLists.set(lists.release()); }
+    void setNodeLists(PassOwnPtr<NodeListsNodeData> lists) { m_nodeLists = lists; }
     NodeListsNodeData* nodeLists() const { return m_nodeLists.get(); }
     
     short tabIndex() const { return m_tabIndex; }
diff --git a/src/3rdparty/webkit/WebCore/dom/OptionElement.cpp b/src/3rdparty/webkit/WebCore/dom/OptionElement.cpp
new file mode 100644
index 0000000..581c070
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/OptionElement.cpp
@@ -0,0 +1,150 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "OptionElement.h"
+
+#include "Document.h"
+#include "Element.h"
+#include "HTMLNames.h"
+#include "HTMLOptionElement.h"
+#include "OptionGroupElement.h"
+#include "ScriptElement.h"
+#include "SelectElement.h"
+#include <wtf/Assertions.h>
+
+#if ENABLE(WML)
+#include "WMLOptionElement.h"
+#include "WMLNames.h"
+#endif
+
+namespace WebCore {
+
+void OptionElement::setSelectedState(OptionElementData& data, Element* element, bool selected)
+{
+    if (data.selected() == selected)
+        return;
+
+    data.setSelected(selected);
+    element->setNeedsStyleRecalc();
+}
+
+int OptionElement::optionIndex(SelectElement* selectElement, const Element* element)
+{
+    if (!selectElement)
+        return 0;
+
+    // Let's do this dynamically. Might be a bit slow, but we're sure
+    // we won't forget to update a member variable in some cases...
+    const Vector<Element*>& items = selectElement->listItems();
+    int length = items.size();
+    int optionIndex = 0;
+    for (int i = 0; i < length; ++i) {
+        if (!isOptionElement(items[i]))
+            continue;
+        if (items[i] == element)
+            return optionIndex;
+        ++optionIndex;
+    }
+
+    return 0;
+}
+
+String OptionElement::collectOptionText(const OptionElementData& data, const Element* element)
+{
+    Document* document = element->document();
+    String text;
+
+    // WinIE does not use the label attribute, so as a quirk, we ignore it.
+    if (!document->inCompatMode())
+        text = data.label();
+
+    if (text.isEmpty()) {
+        Node* n = element->firstChild();
+        while (n) {
+            if (n->nodeType() == Node::TEXT_NODE || n->nodeType() == Node::CDATA_SECTION_NODE)
+                text += n->nodeValue();
+
+            // skip script content
+            if (n->isElementNode() && toScriptElement(static_cast<Element*>(n)))
+                n = n->traverseNextSibling(element);
+            else
+                n = n->traverseNextNode(element);
+        }
+    }
+
+    text = document->displayStringModifiedByEncoding(text);
+
+    // In WinIE, leading and trailing whitespace is ignored in options and optgroups. We match this behavior.
+    text = text.stripWhiteSpace();
+
+    // We want to collapse our whitespace too.  This will match other browsers.
+    text = text.simplifyWhiteSpace();
+    return text;
+}
+
+String OptionElement::collectOptionTextRespectingGroupLabel(const OptionElementData& data, const Element* element)
+{
+    Element* parentElement = static_cast<Element*>(element->parentNode());
+    if (parentElement && toOptionGroupElement(parentElement))
+        return "    " + collectOptionText(data, element);
+
+    return collectOptionText(data, element);
+}
+
+String OptionElement::collectOptionValue(const OptionElementData& data, const Element* element)
+{
+    String value = data.value();
+    if (!value.isNull())
+        return value;
+
+    // Use the text if the value wasn't set.
+    return collectOptionText(data, element).stripWhiteSpace();
+}
+
+// OptionElementData
+OptionElementData::OptionElementData()
+    : m_selected(false)
+{
+}
+
+OptionElement* toOptionElement(Element* element)
+{
+    if (element->isHTMLElement() && element->hasTagName(HTMLNames::optionTag))
+        return static_cast<HTMLOptionElement*>(element);
+
+#if ENABLE(WML)
+    if (element->isWMLElement() && element->hasTagName(WMLNames::optionTag))
+        return static_cast<WMLOptionElement*>(element);
+#endif
+
+    return 0;
+}
+
+bool isOptionElement(Element* element)
+{
+    return element->hasLocalName(HTMLNames::optionTag)
+#if ENABLE(WML)
+        || element->hasLocalName(WMLNames::optionTag)
+#endif
+        ;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/dom/OptionElement.h b/src/3rdparty/webkit/WebCore/dom/OptionElement.h
new file mode 100644
index 0000000..c6b9778
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/OptionElement.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef OptionElement_h
+#define OptionElement_h
+
+#include "PlatformString.h"
+
+namespace WebCore {
+
+class Element;
+class Document;
+class OptionElementData;
+class SelectElement;
+
+class OptionElement {
+public:
+    virtual ~OptionElement() { }
+
+    virtual bool selected() const = 0;
+    virtual void setSelectedState(bool) = 0;
+
+    virtual String text() const = 0;
+    virtual String textIndentedToRespectGroupLabel() const = 0;
+    virtual String value() const = 0;
+
+protected:
+    static void setSelectedState(OptionElementData&, Element*, bool selected);
+    static int optionIndex(SelectElement*, const Element*);
+    static String collectOptionText(const OptionElementData&, const Element*);
+    static String collectOptionTextRespectingGroupLabel(const OptionElementData&, const Element*);
+    static String collectOptionValue(const OptionElementData&, const Element*);
+};
+
+// HTML/WMLOptionElement hold this struct as member variable
+// and pass it to the static helper functions in OptionElement
+class OptionElementData {
+public:
+    OptionElementData();
+
+    String value() const { return m_value; }
+    void setValue(const String& value) { m_value = value; }
+
+    String label() const { return m_label; }
+    void setLabel(const String& label) { m_label = label; }
+
+    bool selected() const { return m_selected; }
+    void setSelected(bool selected) { m_selected = selected; }
+
+private:
+    String m_value;
+    String m_label;
+    bool m_selected;
+};
+
+OptionElement* toOptionElement(Element*);
+bool isOptionElement(Element*);
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/dom/OptionGroupElement.cpp b/src/3rdparty/webkit/WebCore/dom/OptionGroupElement.cpp
new file mode 100644
index 0000000..8a001bc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/OptionGroupElement.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "OptionGroupElement.h"
+
+#include "Element.h"
+#include "HTMLNames.h"
+#include "HTMLOptGroupElement.h"
+#include <wtf/Assertions.h>
+
+#if ENABLE(WML)
+#include "WMLOptGroupElement.h"
+#include "WMLNames.h"
+#endif
+
+namespace WebCore {
+
+OptionGroupElement* toOptionGroupElement(Element* element)
+{
+    if (element->isHTMLElement() && element->hasTagName(HTMLNames::optgroupTag))
+        return static_cast<HTMLOptGroupElement*>(element);
+
+#if ENABLE(WML)
+    if (element->isWMLElement() && element->hasTagName(WMLNames::optgroupTag))
+        return static_cast<WMLOptGroupElement*>(element);
+#endif
+
+    return 0;
+}
+
+bool isOptionGroupElement(Element* element)
+{
+    return element->hasLocalName(HTMLNames::optgroupTag)
+#if ENABLE(WML)
+        || element->hasLocalName(WMLNames::optgroupTag)
+#endif
+        ;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/dom/FormControlElement.h b/src/3rdparty/webkit/WebCore/dom/OptionGroupElement.h
index a22b835..e4b1566 100644
--- a/src/3rdparty/webkit/WebCore/dom/FormControlElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/OptionGroupElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -18,22 +18,24 @@
  *
  */
 
-#ifndef FormControlElement_h
-#define FormControlElement_h
+#ifndef OptionGroupElement_h
+#define OptionGroupElement_h
 
 namespace WebCore {
 
-class FormControlElement {
-public:
-    virtual ~FormControlElement() { }
+class Element;
+class String;
 
-    virtual bool valueMatchesRenderer() const = 0;
-    virtual void setValueMatchesRenderer(bool value = true) = 0;
+class OptionGroupElement {
+public:
+    virtual ~OptionGroupElement() { }
 
-protected:
-    FormControlElement() { }
+    virtual String groupLabelText() const = 0;
 };
 
+OptionGroupElement* toOptionGroupElement(Element*);
+bool isOptionGroupElement(Element*);
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/Position.cpp b/src/3rdparty/webkit/WebCore/dom/Position.cpp
index 8613d55..3b4c3e8 100644
--- a/src/3rdparty/webkit/WebCore/dom/Position.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Position.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,14 +29,12 @@
 #include "CSSComputedStyleDeclaration.h"
 #include "CString.h"
 #include "CharacterNames.h"
-#include "Document.h"
-#include "Element.h"
-#include "HTMLNames.h"
 #include "Logging.h"
 #include "PositionIterator.h"
 #include "RenderBlock.h"
 #include "Text.h"
 #include "TextIterator.h"
+#include "VisiblePosition.h"
 #include "htmlediting.h"
 #include "visible_units.h"
 #include <stdio.h>
@@ -45,7 +43,7 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-static Node *nextRenderedEditable(Node *node)
+static Node* nextRenderedEditable(Node* node)
 {
     while (1) {
         node = node->nextEditable();
@@ -54,13 +52,13 @@ static Node *nextRenderedEditable(Node *node)
         RenderObject* renderer = node->renderer();
         if (!renderer)
             continue;
-        if (renderer->inlineBoxWrapper() || renderer->isText() && static_cast<RenderText*>(renderer)->firstTextBox())
+        if ((renderer->isBox() && toRenderBox(renderer)->inlineBoxWrapper()) || (renderer->isText() && toRenderText(renderer)->firstTextBox()))
             return node;
     }
     return 0;
 }
 
-static Node *previousRenderedEditable(Node *node)
+static Node* previousRenderedEditable(Node* node)
 {
     while (1) {
         node = node->previousEditable();
@@ -69,26 +67,141 @@ static Node *previousRenderedEditable(Node *node)
         RenderObject* renderer = node->renderer();
         if (!renderer)
             continue;
-        if (renderer->inlineBoxWrapper() || renderer->isText() && static_cast<RenderText*>(renderer)->firstTextBox())
+        if ((renderer->isBox() && toRenderBox(renderer)->inlineBoxWrapper()) || (renderer->isText() && toRenderText(renderer)->firstTextBox()))
             return node;
     }
     return 0;
 }
 
-Element* Position::documentElement() const
+Position::Position(PassRefPtr<Node> anchorNode, int offset)
+    : m_anchorNode(anchorNode)
+    , m_offset(offset)
+    , m_anchorType(anchorTypeForLegacyEditingPosition(m_anchorNode.get(), m_offset))
+    , m_isLegacyEditingPosition(true)
 {
-    if (Node* n = node())
-        if (Element* e = n->document()->documentElement())
-            return e;
+}
+
+Position::Position(PassRefPtr<Node> anchorNode, AnchorType anchorType)
+    : m_anchorNode(anchorNode)
+    , m_offset(0)
+    , m_anchorType(anchorType)
+    , m_isLegacyEditingPosition(false)
+{
+    ASSERT(anchorType != PositionIsOffsetInAnchor);
+}
+
+Position::Position(PassRefPtr<Node> anchorNode, int offset, AnchorType anchorType)
+    : m_anchorNode(anchorNode)
+    , m_offset(offset)
+    , m_anchorType(anchorType)
+    , m_isLegacyEditingPosition(false)
+{
+    ASSERT(anchorType == PositionIsOffsetInAnchor);
+}
+
+void Position::moveToPosition(PassRefPtr<Node> node, int offset)
+{
+    ASSERT(anchorType() == PositionIsOffsetInAnchor || m_isLegacyEditingPosition);
+    m_anchorNode = node;
+    m_offset = offset;
+    if (m_isLegacyEditingPosition)
+        m_anchorType = anchorTypeForLegacyEditingPosition(m_anchorNode.get(), m_offset);
+}
+void Position::moveToOffset(int offset)
+{
+    ASSERT(anchorType() == PositionIsOffsetInAnchor || m_isLegacyEditingPosition);
+    m_offset = offset;
+    if (m_isLegacyEditingPosition)
+        m_anchorType = anchorTypeForLegacyEditingPosition(m_anchorNode.get(), m_offset);
+}
+
+Node* Position::containerNode() const
+{
+    if (!m_anchorNode)
+        return 0;
+
+    switch (anchorType()) {
+    case PositionIsOffsetInAnchor:
+        return m_anchorNode.get();
+    case PositionIsBeforeAnchor:
+    case PositionIsAfterAnchor:
+        return m_anchorNode->parentNode();
+    }
+    ASSERT_NOT_REACHED();
     return 0;
 }
 
-Element *Position::element() const
+int Position::computeOffsetInContainerNode() const
 {
-    Node *n;
-    for (n = node(); n && !n->isElementNode(); n = n->parentNode())
-        ; // empty loop body
-    return static_cast<Element *>(n);
+    if (!m_anchorNode)
+        return 0;
+
+    switch (anchorType()) {
+    case PositionIsOffsetInAnchor:
+    {
+        int maximumValidOffset = m_anchorNode->offsetInCharacters() ? m_anchorNode->maxCharacterOffset() : m_anchorNode->childNodeCount();
+        return std::min(maximumValidOffset, m_offset);
+    }
+    case PositionIsBeforeAnchor:
+        return m_anchorNode->nodeIndex();
+    case PositionIsAfterAnchor:
+        return m_anchorNode->nodeIndex() + 1;
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+Node* Position::computeNodeBeforePosition() const
+{
+    if (!m_anchorNode)
+        return 0;
+
+    switch (anchorType()) {
+    case PositionIsOffsetInAnchor:
+        return m_anchorNode->childNode(m_offset - 1); // -1 converts to childNode((unsigned)-1) and returns null.
+    case PositionIsBeforeAnchor:
+        return m_anchorNode->previousSibling();
+    case PositionIsAfterAnchor:
+        return m_anchorNode.get();
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+Node* Position::computeNodeAfterPosition() const
+{
+    if (!m_anchorNode)
+        return 0;
+
+    switch (anchorType()) {
+    case PositionIsOffsetInAnchor:
+        return m_anchorNode->childNode(m_offset);
+    case PositionIsBeforeAnchor:
+        return m_anchorNode.get();
+    case PositionIsAfterAnchor:
+        return m_anchorNode->nextSibling();
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+Position::AnchorType Position::anchorTypeForLegacyEditingPosition(Node* anchorNode, int offset)
+{
+    if (anchorNode && editingIgnoresContent(anchorNode)) {
+        if (offset == 0)
+            return Position::PositionIsBeforeAnchor;
+        return Position::PositionIsAfterAnchor;
+    }
+    return Position::PositionIsOffsetInAnchor;
+}
+
+// FIXME: This method is confusing (does it return anchorNode() or containerNode()?) and should be renamed or removed
+Element* Position::element() const
+{
+    Node* n = anchorNode();
+    while (n && !n->isElementNode())
+        n = n->parentNode();
+    return static_cast<Element*>(n);
 }
 
 PassRefPtr<CSSComputedStyleDeclaration> Position::computedStyle() const
@@ -99,60 +212,69 @@ PassRefPtr<CSSComputedStyleDeclaration> Position::computedStyle() const
     return WebCore::computedStyle(elem);
 }
 
-Position Position::previous(EUsingComposedCharacters usingComposedCharacters) const
+Position Position::previous(PositionMoveType moveType) const
 {
-    Node *n = node();
+    Node* n = node();
     if (!n)
         return *this;
     
-    int o = offset();
+    int o = m_offset;
     // FIXME: Negative offsets shouldn't be allowed. We should catch this earlier.
     ASSERT(o >= 0);
 
     if (o > 0) {
-        Node *child = n->childNode(o - 1);
-        if (child) {
-            return Position(child, maxDeepOffset(child));
-        }
+        Node* child = n->childNode(o - 1);
+        if (child)
+            return lastDeepEditingPositionForNode(child);
+
         // There are two reasons child might be 0:
         //   1) The node is node like a text node that is not an element, and therefore has no children.
         //      Going backward one character at a time is correct.
         //   2) The old offset was a bogus offset like (<br>, 1), and there is no child.
         //      Going from 1 to 0 is correct.
-        return Position(n, usingComposedCharacters ? uncheckedPreviousOffset(n, o) : o - 1);
+        switch (moveType) {
+        case CodePoint:
+            return Position(n, o - 1);
+        case Character:
+            return Position(n, uncheckedPreviousOffset(n, o));
+        case BackwardDeletion:
+            return Position(n, uncheckedPreviousOffsetForBackwardDeletion(n, o));
+        }
     }
 
-    Node *parent = n->parentNode();
+    Node* parent = n->parentNode();
     if (!parent)
         return *this;
 
     return Position(parent, n->nodeIndex());
 }
 
-Position Position::next(EUsingComposedCharacters usingComposedCharacters) const
+Position Position::next(PositionMoveType moveType) const
 {
-    Node *n = node();
+    ASSERT(moveType != BackwardDeletion);
+
+    Node* n = node();
     if (!n)
         return *this;
     
-    int o = offset();
+    int o = m_offset;
     // FIXME: Negative offsets shouldn't be allowed. We should catch this earlier.
     ASSERT(o >= 0);
 
     Node* child = n->childNode(o);
-    if (child || !n->hasChildNodes() && o < maxDeepOffset(n)) {
+    if (child || (!n->hasChildNodes() && o < lastOffsetForEditing(n))) {
         if (child)
-            return Position(child, 0);
-            
+            return firstDeepEditingPositionForNode(child);
+
         // There are two reasons child might be 0:
         //   1) The node is node like a text node that is not an element, and therefore has no children.
         //      Going forward one character at a time is correct.
         //   2) The new offset is a bogus offset like (<br>, 1), and there is no child.
         //      Going from 0 to 1 is correct.
-        return Position(n, usingComposedCharacters ? uncheckedNextOffset(n, o) : o + 1);
+        return Position(n, (moveType == Character) ? uncheckedNextOffset(n, o) : o + 1);
     }
 
-    Node *parent = n->parentNode();
+    Node* parent = n->parentNode();
     if (!parent)
         return *this;
 
@@ -164,49 +286,64 @@ int Position::uncheckedPreviousOffset(const Node* n, int current)
     return n->renderer() ? n->renderer()->previousOffset(current) : current - 1;
 }
 
+int Position::uncheckedPreviousOffsetForBackwardDeletion(const Node* n, int current)
+{
+    return n->renderer() ? n->renderer()->previousOffsetForBackwardDeletion(current) : current - 1;
+}
+
 int Position::uncheckedNextOffset(const Node* n, int current)
 {
     return n->renderer() ? n->renderer()->nextOffset(current) : current + 1;
 }
 
-bool Position::atStart() const
+bool Position::atFirstEditingPositionForNode() const
 {
-    Node *n = node();
-    if (!n)
+    if (isNull())
         return true;
-    
-    return offset() <= 0 && n->parent() == 0;
+    return m_offset <= 0;
 }
 
-bool Position::atEnd() const
+bool Position::atLastEditingPositionForNode() const
 {
-    Node *n = node();
-    if (!n)
+    if (isNull())
         return true;
-    
-    return n->parent() == 0 && offset() >= maxDeepOffset(n);
+    return m_offset >= lastOffsetForEditing(node());
+}
+
+bool Position::atStartOfTree() const
+{
+    if (isNull())
+        return true;
+    return !node()->parentNode() && m_offset <= 0;
+}
+
+bool Position::atEndOfTree() const
+{
+    if (isNull())
+        return true;
+    return !node()->parentNode() && m_offset >= lastOffsetForEditing(node());
 }
 
 int Position::renderedOffset() const
 {
     if (!node()->isTextNode())
-        return offset();
+        return m_offset;
    
     if (!node()->renderer())
-        return offset();
+        return m_offset;
                     
     int result = 0;
-    RenderText *textRenderer = static_cast<RenderText *>(node()->renderer());
+    RenderText *textRenderer = toRenderText(node()->renderer());
     for (InlineTextBox *box = textRenderer->firstTextBox(); box; box = box->nextTextBox()) {
-        int start = box->m_start;
-        int end = box->m_start + box->m_len;
-        if (offset() < start)
+        int start = box->start();
+        int end = box->start() + box->len();
+        if (m_offset < start)
             return result;
-        if (offset() <= end) {
-            result += offset() - start;
+        if (m_offset <= end) {
+            result += m_offset - start;
             return result;
         }
-        result += box->m_len;
+        result += box->len();
     }
     return result;
 }
@@ -223,7 +360,7 @@ Position Position::previousCharacterPosition(EAffinity affinity) const
     bool rendered = isCandidate();
     
     Position currentPos = *this;
-    while (!currentPos.atStart()) {
+    while (!currentPos.atStartOfTree()) {
         currentPos = currentPos.previous();
 
         if (currentPos.node()->rootEditableElement() != fromRootEditableElement)
@@ -251,7 +388,7 @@ Position Position::nextCharacterPosition(EAffinity affinity) const
     bool rendered = isCandidate();
     
     Position currentPos = *this;
-    while (!currentPos.atEnd()) {
+    while (!currentPos.atEndOfTree()) {
         currentPos = currentPos.next();
 
         if (currentPos.node()->rootEditableElement() != fromRootEditableElement)
@@ -267,7 +404,7 @@ Position Position::nextCharacterPosition(EAffinity affinity) const
     return *this;
 }
 
-// Whether or not [node, 0] and [node, maxDeepOffset(node)] are their own VisiblePositions.
+// Whether or not [node, 0] and [node, lastOffsetForEditing(node)] are their own VisiblePositions.
 // If true, adjacent candidates are visually distinct.
 // FIXME: Disregard nodes with renderers that have no height, as we do in isCandidate.
 // FIXME: Share code with isCandidate, if possible.
@@ -284,7 +421,7 @@ static bool endsOfNodeAreVisuallyDistinctPositions(Node* node)
         return false;
     
     // There is a VisiblePosition inside an empty inline-block container.
-    return node->renderer()->isReplaced() && canHaveChildrenForEditing(node) && node->renderer()->height() != 0 && !node->firstChild();
+    return node->renderer()->isReplaced() && canHaveChildrenForEditing(node) && toRenderBox(node->renderer())->height() != 0 && !node->firstChild();
 }
 
 static Node* enclosingVisualBoundary(Node* node)
@@ -361,12 +498,12 @@ Position Position::upstream() const
         // Return position after tables and nodes which have content that can be ignored.
         if (editingIgnoresContent(currentNode) || isTableElement(currentNode)) {
             if (currentPos.atEndOfNode())
-                return Position(currentNode, maxDeepOffset(currentNode));
+                return lastDeepEditingPositionForNode(currentNode);
             continue;
         }
 
         // return current position if it is in rendered text
-        if (renderer->isText() && static_cast<RenderText*>(renderer)->firstTextBox()) {
+        if (renderer->isText() && toRenderText(renderer)->firstTextBox()) {
             if (currentNode != startNode) {
                 // This assertion fires in layout tests in the case-transform.html test because
                 // of a mix-up between offsets in the text in the DOM tree with text in the
@@ -377,7 +514,7 @@ Position Position::upstream() const
             }
 
             unsigned textOffset = currentPos.offsetInLeafNode();
-            RenderText* textRenderer = static_cast<RenderText*>(renderer);
+            RenderText* textRenderer = toRenderText(renderer);
             InlineTextBox* lastTextBox = textRenderer->lastTextBox();
             for (InlineTextBox* box = textRenderer->firstTextBox(); box; box = box->nextTextBox()) {
                 if (textOffset <= box->start() + box->len()) {
@@ -398,7 +535,7 @@ Position Position::upstream() const
                     otherBox = otherBox->nextLeafChild();
                     if (!otherBox)
                         break;
-                    if (otherBox == lastTextBox || otherBox->object() == textRenderer && static_cast<InlineTextBox*>(otherBox)->start() > textOffset)
+                    if (otherBox == lastTextBox || (otherBox->renderer() == textRenderer && static_cast<InlineTextBox*>(otherBox)->start() > textOffset))
                         continuesOnNextLine = false;
                 }
 
@@ -407,7 +544,7 @@ Position Position::upstream() const
                     otherBox = otherBox->prevLeafChild();
                     if (!otherBox)
                         break;
-                    if (otherBox == lastTextBox || otherBox->object() == textRenderer && static_cast<InlineTextBox*>(otherBox)->start() > textOffset)
+                    if (otherBox == lastTextBox || (otherBox->renderer() == textRenderer && static_cast<InlineTextBox*>(otherBox)->start() > textOffset))
                         continuesOnNextLine = false;
                 }
 
@@ -482,14 +619,14 @@ Position Position::downstream() const
         }
 
         // return current position if it is in rendered text
-        if (renderer->isText() && static_cast<RenderText*>(renderer)->firstTextBox()) {
+        if (renderer->isText() && toRenderText(renderer)->firstTextBox()) {
             if (currentNode != startNode) {
                 ASSERT(currentPos.atStartOfNode());
                 return Position(currentNode, renderer->caretMinOffset());
             }
 
             unsigned textOffset = currentPos.offsetInLeafNode();
-            RenderText* textRenderer = static_cast<RenderText*>(renderer);
+            RenderText* textRenderer = toRenderText(renderer);
             InlineTextBox* lastTextBox = textRenderer->lastTextBox();
             for (InlineTextBox* box = textRenderer->firstTextBox(); box; box = box->nextTextBox()) {
                 if (textOffset <= box->end()) {
@@ -510,7 +647,7 @@ Position Position::downstream() const
                     otherBox = otherBox->nextLeafChild();
                     if (!otherBox)
                         break;
-                    if (otherBox == lastTextBox || otherBox->object() == textRenderer && static_cast<InlineTextBox*>(otherBox)->start() >= textOffset)
+                    if (otherBox == lastTextBox || (otherBox->renderer() == textRenderer && static_cast<InlineTextBox*>(otherBox)->start() >= textOffset))
                         continuesOnNextLine = false;
                 }
 
@@ -519,7 +656,7 @@ Position Position::downstream() const
                     otherBox = otherBox->prevLeafChild();
                     if (!otherBox)
                         break;
-                    if (otherBox == lastTextBox || otherBox->object() == textRenderer && static_cast<InlineTextBox*>(otherBox)->start() >= textOffset)
+                    if (otherBox == lastTextBox || (otherBox->renderer() == textRenderer && static_cast<InlineTextBox*>(otherBox)->start() >= textOffset))
                         continuesOnNextLine = false;
                 }
 
@@ -536,9 +673,11 @@ bool Position::hasRenderedNonAnonymousDescendantsWithHeight(RenderObject* render
 {
     RenderObject* stop = renderer->nextInPreOrderAfterChildren();
     for (RenderObject *o = renderer->firstChild(); o && o != stop; o = o->nextInPreOrder())
-        if (o->element() && o->height())
-            return true;
-            
+        if (o->node()) {
+            if ((o->isText() && toRenderText(o)->linesBoundingBox().height()) ||
+                (o->isBox() && toRenderBox(o)->borderBoundingBox().height()))
+                return true;
+        }
     return false;
 }
 
@@ -560,17 +699,17 @@ bool Position::isCandidate() const
         return false;
 
     if (renderer->isBR())
-        return offset() == 0 && !nodeIsUserSelectNone(node()->parent());
+        return m_offset == 0 && !nodeIsUserSelectNone(node()->parent());
 
     if (renderer->isText())
         return inRenderedText() && !nodeIsUserSelectNone(node());
 
     if (isTableElement(node()) || editingIgnoresContent(node()))
-        return (offset() == 0 || offset() == maxDeepOffset(node())) && !nodeIsUserSelectNone(node()->parent());
+        return (atFirstEditingPositionForNode() || atLastEditingPositionForNode()) && !nodeIsUserSelectNone(node()->parent());
 
     if (!node()->hasTagName(htmlTag) && renderer->isBlockFlow() && !hasRenderedNonAnonymousDescendantsWithHeight(renderer) &&
-       (renderer->height() || node()->hasTagName(bodyTag)))
-        return offset() == 0 && !nodeIsUserSelectNone(node());
+       (toRenderBox(renderer)->height() || node()->hasTagName(bodyTag)))
+        return atFirstEditingPositionForNode() && !nodeIsUserSelectNone(node());
     
     return false;
 }
@@ -584,17 +723,17 @@ bool Position::inRenderedText() const
     if (!renderer)
         return false;
     
-    RenderText *textRenderer = static_cast<RenderText *>(renderer);
+    RenderText *textRenderer = toRenderText(renderer);
     for (InlineTextBox *box = textRenderer->firstTextBox(); box; box = box->nextTextBox()) {
-        if (offset() < box->m_start && !textRenderer->containsReversedText()) {
+        if (m_offset < static_cast<int>(box->start()) && !textRenderer->containsReversedText()) {
             // The offset we're looking for is before this node
             // this means the offset must be in content that is
             // not rendered. Return false.
             return false;
         }
-        if (box->containsCaretOffset(offset()))
+        if (box->containsCaretOffset(m_offset))
             // Return false for offsets inside composed characters.
-            return offset() == 0 || offset() == textRenderer->nextOffset(textRenderer->previousOffset(offset()));
+            return m_offset == 0 || m_offset == textRenderer->nextOffset(textRenderer->previousOffset(m_offset));
     }
     
     return false;
@@ -616,19 +755,19 @@ bool Position::isRenderedCharacter() const
     if (isNull() || !node()->isTextNode())
         return false;
         
-    RenderObject *renderer = node()->renderer();
+    RenderObject* renderer = node()->renderer();
     if (!renderer)
         return false;
     
-    RenderText *textRenderer = static_cast<RenderText *>(renderer);
-    for (InlineTextBox *box = textRenderer->firstTextBox(); box; box = box->nextTextBox()) {
-        if (offset() < box->m_start && !textRenderer->containsReversedText()) {
+    RenderText* textRenderer = toRenderText(renderer);
+    for (InlineTextBox* box = textRenderer->firstTextBox(); box; box = box->nextTextBox()) {
+        if (m_offset < static_cast<int>(box->start()) && !textRenderer->containsReversedText()) {
             // The offset we're looking for is before this node
             // this means the offset must be in content that is
             // not rendered. Return false.
             return false;
         }
-        if (offset() >= box->m_start && offset() < box->m_start + box->m_len)
+        if (m_offset >= static_cast<int>(box->start()) && m_offset < static_cast<int>(box->start() + box->len()))
             return true;
     }
     
@@ -656,11 +795,11 @@ bool Position::rendersInDifferentPosition(const Position &pos) const
         if (node()->hasTagName(brTag))
             return false;
 
-        if (offset() == pos.offset())
+        if (m_offset == pos.deprecatedEditingOffset())
             return false;
             
         if (!node()->isTextNode() && !pos.node()->isTextNode()) {
-            if (offset() != pos.offset())
+            if (m_offset != pos.deprecatedEditingOffset())
                 return true;
         }
     }
@@ -734,7 +873,7 @@ Position Position::leadingWhitespacePosition(EAffinity affinity, bool considerNo
     Position prev = previousCharacterPosition(affinity);
     if (prev != *this && prev.node()->inSameContainingBlockFlowElement(node()) && prev.node()->isTextNode()) {
         String string = static_cast<Text *>(prev.node())->data();
-        UChar c = string[prev.offset()];
+        UChar c = string[prev.deprecatedEditingOffset()];
         if (considerNonCollapsibleWhitespace ? (isSpaceOrNewline(c) || c == noBreakSpace) : isCollapsibleWhitespace(c))
             if (isEditablePosition(prev))
                 return prev;
@@ -783,40 +922,42 @@ static bool isNonTextLeafChild(RenderObject* object)
 
 static InlineTextBox* searchAheadForBetterMatch(RenderObject* renderer)
 {
-    InlineTextBox* match = 0;
-    int minOffset = INT_MAX;
     RenderBlock* container = renderer->containingBlock();
     RenderObject* next = renderer;
     while ((next = next->nextInPreOrder(container))) {
         if (next->isRenderBlock())
-            break;
+            return 0;
         if (next->isBR())
-            break;
+            return 0;
         if (isNonTextLeafChild(next))
-            break;
+            return 0;
         if (next->isText()) {
-            for (InlineTextBox* box = static_cast<RenderText*>(next)->firstTextBox(); box; box = box->nextTextBox()) {
+            InlineTextBox* match = 0;
+            int minOffset = INT_MAX;
+            for (InlineTextBox* box = toRenderText(next)->firstTextBox(); box; box = box->nextTextBox()) {
                 int caretMinOffset = box->caretMinOffset();
                 if (caretMinOffset < minOffset) {
                     match = box;
                     minOffset = caretMinOffset;
                 }
             }
+            if (match)
+                return match;
         }
     }
-    return match;
+    return 0;
 }
 
 void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDirection, InlineBox*& inlineBox, int& caretOffset) const
 {
-    caretOffset = offset();
+    caretOffset = m_offset;
     RenderObject* renderer = node()->renderer();
     if (!renderer->isText()) {
-        inlineBox = renderer->inlineBoxWrapper();
-        if (!inlineBox || caretOffset > inlineBox->caretMinOffset() && caretOffset < inlineBox->caretMaxOffset())
+        inlineBox = renderer->isBox() ? toRenderBox(renderer)->inlineBoxWrapper() : 0;
+        if (!inlineBox || (caretOffset > inlineBox->caretMinOffset() && caretOffset < inlineBox->caretMaxOffset()))
             return;
     } else {
-        RenderText* textRenderer = static_cast<RenderText*>(renderer);
+        RenderText* textRenderer = toRenderText(renderer);
 
         InlineTextBox* box;
         InlineTextBox* candidate = 0;
@@ -825,7 +966,7 @@ void Position::getInlineBoxAndOffset(EAffinity affinity, TextDirection primaryDi
             int caretMinOffset = box->caretMinOffset();
             int caretMaxOffset = box->caretMaxOffset();
 
-            if (caretOffset < caretMinOffset || caretOffset > caretMaxOffset || caretOffset == caretMaxOffset && box->isLineBreak())
+            if (caretOffset < caretMinOffset || caretOffset > caretMaxOffset || (caretOffset == caretMaxOffset && box->isLineBreak()))
                 continue;
 
             if (caretOffset > caretMinOffset && caretOffset < caretMaxOffset) {
@@ -943,7 +1084,7 @@ void Position::debugPosition(const char* msg) const
     if (isNull())
         fprintf(stderr, "Position [%s]: null\n", msg);
     else
-        fprintf(stderr, "Position [%s]: %s [%p] at %d\n", msg, node()->nodeName().utf8().data(), node(), offset());
+        fprintf(stderr, "Position [%s]: %s [%p] at %d\n", msg, node()->nodeName().utf8().data(), node(), m_offset);
 }
 
 #ifndef NDEBUG
@@ -957,7 +1098,7 @@ void Position::formatForDebugger(char* buffer, unsigned length) const
     else {
         char s[1024];
         result += "offset ";
-        result += String::number(offset());
+        result += String::number(m_offset);
         result += " of ";
         node()->formatForDebugger(s, sizeof(s));
         result += s;
@@ -984,6 +1125,19 @@ Position endPosition(const Range* r)
     return r ? r->endPosition() : Position();
 }
 
+// NOTE: first/lastDeepEditingPositionForNode can return "editing positions" (like [img, 0])
+// for elements which editing "ignores".  the rest of the editing code will treat [img, 0]
+// as "the last position before the img"
+Position firstDeepEditingPositionForNode(Node* node)
+{
+    return Position(node, 0);
+}
+
+Position lastDeepEditingPositionForNode(Node* node)
+{
+    return Position(node, lastOffsetForEditing(node));
+}
+
 } // namespace WebCore
 
 #ifndef NDEBUG
diff --git a/src/3rdparty/webkit/WebCore/dom/Position.h b/src/3rdparty/webkit/WebCore/dom/Position.h
index 2624238..57f73ec 100644
--- a/src/3rdparty/webkit/WebCore/dom/Position.h
+++ b/src/3rdparty/webkit/WebCore/dom/Position.h
@@ -28,6 +28,7 @@
 
 #include "TextAffinity.h"
 #include "TextDirection.h"
+#include <wtf/Assertions.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 
@@ -40,28 +41,76 @@ class Node;
 class Range;
 class RenderObject;
 
-enum EUsingComposedCharacters { NotUsingComposedCharacters = false, UsingComposedCharacters = true };
-
-// FIXME: Reduce the number of operations we have on a Position.
-// This should be more like a humble struct, without so many different
-// member functions. We should find better homes for these functions.
+enum PositionMoveType {
+    CodePoint,       // Move by a single code point.
+    Character,       // Move to the next Unicode character break.
+    BackwardDeletion // Subject to platform conventions.
+};
 
 class Position {
 public:
-    RefPtr<Node> container;
-    int posOffset; // to be renamed to offset when we get rid of offset()
-
-    Position() : posOffset(0) { }
-    Position(PassRefPtr<Node> c, int o) : container(c), posOffset(o) { }
-
-    void clear() { container.clear(); posOffset = 0; }
-
-    Node* node() const { return container.get(); }
-    int offset() const { return posOffset; }
-    Element* documentElement() const;
-
-    bool isNull() const { return !container; }
-    bool isNotNull() const { return container; }
+    enum AnchorType {
+        PositionIsOffsetInAnchor,
+        PositionIsAfterAnchor,
+        PositionIsBeforeAnchor
+    };
+
+    Position()
+        : m_offset(0)
+        , m_anchorType(PositionIsOffsetInAnchor)
+        , m_isLegacyEditingPosition(false)
+    {
+    }
+
+    // For creating legacy editing positions: (Anchor type will be determined from editingIgnoresContent(node))
+    Position(PassRefPtr<Node> anchorNode, int offset);
+
+    // For creating before/after positions:
+    Position(PassRefPtr<Node> anchorNode, AnchorType);
+    // For creating offset positions:
+    Position(PassRefPtr<Node> anchorNode, int offset, AnchorType);
+
+    AnchorType anchorType() const { return m_anchorType; }
+
+    void clear() { m_anchorNode.clear(); m_offset = 0; m_anchorType = PositionIsOffsetInAnchor; m_isLegacyEditingPosition = false; }
+
+    // These are always DOM compliant values.  Editing positions like [img, 0] (aka [img, before])
+    // will return img->parentNode() and img->nodeIndex() from these functions.
+    Node* containerNode() const; // NULL for a before/after position anchored to a node with no parent
+    int computeOffsetInContainerNode() const;  // O(n) for before/after-anchored positions, O(1) for parent-anchored positions
+
+    // Inline O(1) access for Positions which callers know to be parent-anchored
+    int offsetInContainerNode() const
+    {
+        ASSERT(anchorType() == PositionIsOffsetInAnchor);
+        return m_offset;
+    }
+
+    // New code should not use this function.
+    int deprecatedEditingOffset() const
+    {
+        // This should probably ASSERT(m_isLegacyEditingPosition);
+        return m_offset;
+    }
+
+    // These are convenience methods which are smart about whether the position is neighbor anchored or parent anchored
+    Node* computeNodeBeforePosition() const;
+    Node* computeNodeAfterPosition() const;
+
+    Node* anchorNode() const { return m_anchorNode.get(); }
+
+    // FIXME: Callers should be moved off of node(), node() is not always the container for this position.
+    // For nodes which editingIgnoresContent(node()) returns true, positions like [ignoredNode, 0]
+    // will be treated as before ignoredNode (thus node() is really after the position, not containing it).
+    Node* node() const { return m_anchorNode.get(); }
+
+    // These should only be used for PositionIsOffsetInAnchor positions, unless
+    // the position is a legacy editing position.
+    void moveToPosition(PassRefPtr<Node> anchorNode, int offset);
+    void moveToOffset(int offset);
+
+    bool isNull() const { return !m_anchorNode; }
+    bool isNotNull() const { return m_anchorNode; }
 
     Element* element() const;
     PassRefPtr<CSSComputedStyleDeclaration> computedStyle() const;
@@ -69,13 +118,19 @@ public:
     // Move up or down the DOM by one position.
     // Offsets are computed using render text for nodes that have renderers - but note that even when
     // using composed characters, the result may be inside a single user-visible character if a ligature is formed.
-    Position previous(EUsingComposedCharacters usingComposedCharacters=NotUsingComposedCharacters) const;
-    Position next(EUsingComposedCharacters usingComposedCharacters=NotUsingComposedCharacters) const;
+    Position previous(PositionMoveType = CodePoint) const;
+    Position next(PositionMoveType = CodePoint) const;
     static int uncheckedPreviousOffset(const Node*, int current);
+    static int uncheckedPreviousOffsetForBackwardDeletion(const Node*, int current);
     static int uncheckedNextOffset(const Node*, int current);
 
-    bool atStart() const;
-    bool atEnd() const;
+    // These can be either inside or just before/after the node, depending on
+    // if the node is ignored by editing or not.
+    bool atFirstEditingPositionForNode() const;
+    bool atLastEditingPositionForNode() const;
+
+    bool atStartOfTree() const;
+    bool atEndOfTree() const;
 
     // FIXME: Make these non-member functions and put them somewhere in the editing directory.
     // These aren't really basic "position" operations. More high level editing helper functions.
@@ -109,11 +164,23 @@ private:
 
     Position previousCharacterPosition(EAffinity) const;
     Position nextCharacterPosition(EAffinity) const;
+
+    static AnchorType anchorTypeForLegacyEditingPosition(Node* anchorNode, int offset);
+
+    RefPtr<Node> m_anchorNode;
+    // m_offset can be the offset inside m_anchorNode, or if editingIgnoresContent(m_anchorNode)
+    // returns true, then other places in editing will treat m_offset == 0 as "before the anchor"
+    // and m_offset > 0 as "after the anchor node".  See rangeCompliantEquivalent for more info.
+    int m_offset;
+    AnchorType m_anchorType : 2;
+    bool m_isLegacyEditingPosition : 1;
 };
 
 inline bool operator==(const Position& a, const Position& b)
 {
-    return a.container == b.container && a.posOffset == b.posOffset;
+    // FIXME: In <div><img></div> [div, 0] != [img, 0] even though most of the
+    // editing code will treat them as identical.
+    return a.anchorNode() == b.anchorNode() && a.deprecatedEditingOffset() == b.deprecatedEditingOffset();
 }
 
 inline bool operator!=(const Position& a, const Position& b)
@@ -124,6 +191,12 @@ inline bool operator!=(const Position& a, const Position& b)
 Position startPosition(const Range*);
 Position endPosition(const Range*);
 
+// NOTE: first/lastDeepEditingPositionForNode can return "editing positions" (like [img, 0])
+// for elements which editing "ignores".  the rest of the editing code will treat [img, 0]
+// as "the last position before the img"
+Position firstDeepEditingPositionForNode(Node*);
+Position lastDeepEditingPositionForNode(Node*);
+
 } // namespace WebCore
 
 #ifndef NDEBUG
diff --git a/src/3rdparty/webkit/WebCore/dom/PositionIterator.cpp b/src/3rdparty/webkit/WebCore/dom/PositionIterator.cpp
index 218ace1..a029b5e 100644
--- a/src/3rdparty/webkit/WebCore/dom/PositionIterator.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/PositionIterator.cpp
@@ -27,7 +27,7 @@
 #include "PositionIterator.h"
 
 #include "Node.h"
-#include "RenderObject.h"
+#include "RenderBlock.h"
 #include "htmlediting.h"
 
 namespace WebCore {
@@ -36,105 +36,111 @@ using namespace HTMLNames;
 
 PositionIterator::operator Position() const
 {
-    return Position(m_parent, m_child ? m_child->nodeIndex() : (m_parent->hasChildNodes() ? maxDeepOffset(m_parent) : m_offset));
+    if (m_nodeAfterPositionInAnchor) {
+        ASSERT(m_nodeAfterPositionInAnchor->parentNode() == m_anchorNode);
+        return positionBeforeNode(m_nodeAfterPositionInAnchor);
+    }
+    if (m_anchorNode->hasChildNodes())
+        return lastDeepEditingPositionForNode(m_anchorNode);
+    return Position(m_anchorNode, m_offsetInAnchor);
 }
 
 void PositionIterator::increment()
 {
-    if (!m_parent)
+    if (!m_anchorNode)
         return;
 
-    if (m_child) {
-        m_parent = m_child;
-        m_child = m_parent->firstChild();
-        m_offset = 0;
+    if (m_nodeAfterPositionInAnchor) {
+        m_anchorNode = m_nodeAfterPositionInAnchor;
+        m_nodeAfterPositionInAnchor = m_anchorNode->firstChild();
+        m_offsetInAnchor = 0;
         return;
     }
 
-    if (!m_parent->hasChildNodes() && m_offset < maxDeepOffset(m_parent))
-        m_offset = Position::uncheckedNextOffset(m_parent, m_offset);
+    if (!m_anchorNode->hasChildNodes() && m_offsetInAnchor < lastOffsetForEditing(m_anchorNode))
+        m_offsetInAnchor = Position::uncheckedNextOffset(m_anchorNode, m_offsetInAnchor);
     else {
-        m_child = m_parent;
-        m_parent = m_child->parentNode();
-        m_child = m_child->nextSibling();
-        m_offset = 0;
+        m_nodeAfterPositionInAnchor = m_anchorNode;
+        m_anchorNode = m_nodeAfterPositionInAnchor->parentNode();
+        m_nodeAfterPositionInAnchor = m_nodeAfterPositionInAnchor->nextSibling();
+        m_offsetInAnchor = 0;
     }
 }
 
 void PositionIterator::decrement()
 {
-    if (!m_parent)
+    if (!m_anchorNode)
         return;
 
-    if (m_child) {
-        m_parent = m_child->previousSibling();
-        if (m_parent) {
-            m_child = 0;
-            m_offset = m_parent->hasChildNodes() ? 0 : maxDeepOffset(m_parent);
+    if (m_nodeAfterPositionInAnchor) {
+        m_anchorNode = m_nodeAfterPositionInAnchor->previousSibling();
+        if (m_anchorNode) {
+            m_nodeAfterPositionInAnchor = 0;
+            m_offsetInAnchor = m_anchorNode->hasChildNodes() ? 0 : lastOffsetForEditing(m_anchorNode);
         } else {
-            m_child = m_child->parentNode();
-            m_parent = m_child->parentNode();
-            m_offset = 0;
+            m_nodeAfterPositionInAnchor = m_nodeAfterPositionInAnchor->parentNode();
+            m_anchorNode = m_nodeAfterPositionInAnchor->parentNode();
+            m_offsetInAnchor = 0;
         }
         return;
     }
 
-    if (m_offset) {
-        m_offset = Position::uncheckedPreviousOffset(m_parent, m_offset);
+    if (m_offsetInAnchor) {
+        m_offsetInAnchor = Position::uncheckedPreviousOffset(m_anchorNode, m_offsetInAnchor);
     } else {
-        if (m_parent->hasChildNodes()) {
-            m_parent = m_parent->lastChild();
-            if (!m_parent->hasChildNodes())
-                m_offset = maxDeepOffset(m_parent);
+        if (m_anchorNode->hasChildNodes()) {
+            m_anchorNode = m_anchorNode->lastChild();
+            if (!m_anchorNode->hasChildNodes())
+                m_offsetInAnchor = lastOffsetForEditing(m_anchorNode);
         } else {
-            m_child = m_parent;
-            m_parent = m_parent->parentNode();
+            m_nodeAfterPositionInAnchor = m_anchorNode;
+            m_anchorNode = m_anchorNode->parentNode();
         }
     }
 }
 
 bool PositionIterator::atStart() const
 {
-    if (!m_parent)
+    if (!m_anchorNode)
         return true;
-    if (m_parent->parentNode())
+    if (m_anchorNode->parentNode())
         return false;
-    return !m_parent->hasChildNodes() && !m_offset || m_child && !m_child->previousSibling();
+    return (!m_anchorNode->hasChildNodes() && !m_offsetInAnchor) || (m_nodeAfterPositionInAnchor && !m_nodeAfterPositionInAnchor->previousSibling());
 }
 
 bool PositionIterator::atEnd() const
 {
-    if (!m_parent)
+    if (!m_anchorNode)
         return true;
-    if (m_child)
+    if (m_nodeAfterPositionInAnchor)
         return false;
-    return !m_parent->parentNode() && (m_parent->hasChildNodes() || m_offset >= maxDeepOffset(m_parent));
+    return !m_anchorNode->parentNode() && (m_anchorNode->hasChildNodes() || m_offsetInAnchor >= lastOffsetForEditing(m_anchorNode));
 }
 
 bool PositionIterator::atStartOfNode() const
 {
-    if (!m_parent)
+    if (!m_anchorNode)
         return true;
-    if (!m_child)
-        return !m_parent->hasChildNodes() && !m_offset;
-    return !m_child->previousSibling();
+    if (!m_nodeAfterPositionInAnchor)
+        return !m_anchorNode->hasChildNodes() && !m_offsetInAnchor;
+    return !m_nodeAfterPositionInAnchor->previousSibling();
 }
 
 bool PositionIterator::atEndOfNode() const
 {
-    if (!m_parent)
+    if (!m_anchorNode)
         return true;
-    if (m_child)
+    if (m_nodeAfterPositionInAnchor)
         return false;
-    return m_parent->hasChildNodes() || m_offset >= maxDeepOffset(m_parent);
+    return m_anchorNode->hasChildNodes() || m_offsetInAnchor >= lastOffsetForEditing(m_anchorNode);
 }
 
 bool PositionIterator::isCandidate() const
 {
-    if (!m_parent)
+    if (!m_anchorNode)
         return false;
 
-    RenderObject* renderer = m_parent->renderer();
+    RenderObject* renderer = m_anchorNode->renderer();
     if (!renderer)
         return false;
     
@@ -142,17 +148,17 @@ bool PositionIterator::isCandidate() const
         return false;
 
     if (renderer->isBR())
-        return !m_offset && !Position::nodeIsUserSelectNone(m_parent->parent());
+        return !m_offsetInAnchor && !Position::nodeIsUserSelectNone(m_anchorNode->parent());
 
     if (renderer->isText())
-        return Position(*this).inRenderedText() && !Position::nodeIsUserSelectNone(m_parent);
+        return Position(*this).inRenderedText() && !Position::nodeIsUserSelectNone(m_anchorNode);
 
-    if (isTableElement(m_parent) || editingIgnoresContent(m_parent))
-        return (atStartOfNode() || atEndOfNode()) && !Position::nodeIsUserSelectNone(m_parent->parent());
+    if (isTableElement(m_anchorNode) || editingIgnoresContent(m_anchorNode))
+        return (atStartOfNode() || atEndOfNode()) && !Position::nodeIsUserSelectNone(m_anchorNode->parent());
 
-    if (!m_parent->hasTagName(htmlTag) && renderer->isBlockFlow() && !Position::hasRenderedNonAnonymousDescendantsWithHeight(renderer) &&
-       (renderer->height() || m_parent->hasTagName(bodyTag)))
-        return atStartOfNode() && !Position::nodeIsUserSelectNone(m_parent);
+    if (!m_anchorNode->hasTagName(htmlTag) && renderer->isBlockFlow() && !Position::hasRenderedNonAnonymousDescendantsWithHeight(renderer) &&
+       (toRenderBlock(renderer)->height() || m_anchorNode->hasTagName(bodyTag)))
+        return atStartOfNode() && !Position::nodeIsUserSelectNone(m_anchorNode);
     
     return false;
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/PositionIterator.h b/src/3rdparty/webkit/WebCore/dom/PositionIterator.h
index 54f5020..7af8977 100644
--- a/src/3rdparty/webkit/WebCore/dom/PositionIterator.h
+++ b/src/3rdparty/webkit/WebCore/dom/PositionIterator.h
@@ -37,16 +37,16 @@ namespace WebCore {
 class PositionIterator {
 public:
     PositionIterator()
-        : m_parent(0)
-        , m_child(0)
-        , m_offset(0)
+        : m_anchorNode(0)
+        , m_nodeAfterPositionInAnchor(0)
+        , m_offsetInAnchor(0)
     {
     }
 
     PositionIterator(const Position& pos)
-        : m_parent(pos.node())
-        , m_child(m_parent->childNode(pos.offset()))
-        , m_offset(m_child ? 0 : pos.offset())
+        : m_anchorNode(pos.anchorNode())
+        , m_nodeAfterPositionInAnchor(m_anchorNode->childNode(pos.deprecatedEditingOffset()))
+        , m_offsetInAnchor(m_nodeAfterPositionInAnchor ? 0 : pos.deprecatedEditingOffset())
     {
     }
     operator Position() const;
@@ -54,8 +54,8 @@ public:
     void increment();
     void decrement();
 
-    Node* node() const { return m_parent; }
-    int offsetInLeafNode() const { return m_offset; }
+    Node* node() const { return m_anchorNode; }
+    int offsetInLeafNode() const { return m_offsetInAnchor; }
 
     bool atStart() const;
     bool atEnd() const;
@@ -64,9 +64,9 @@ public:
     bool isCandidate() const;
 
 private:
-    Node* m_parent;
-    Node* m_child;
-    int m_offset;
+    Node* m_anchorNode;
+    Node* m_nodeAfterPositionInAnchor; // If this is non-null, m_nodeAfterPositionInAnchor->parentNode() == m_anchorNode;
+    int m_offsetInAnchor;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
index 906902a..879bf62 100644
--- a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.cpp
@@ -258,8 +258,7 @@ void ProcessingInstruction::removedFromDocument()
 {
     ContainerNode::removedFromDocument();
 
-    if (document()->renderer())
-        document()->removeStyleSheetCandidateNode(this);
+    document()->removeStyleSheetCandidateNode(this);
 
     // FIXME: It's terrible to do a synchronous update of the style selector just because a <style> or <link> element got removed.
     if (m_cachedSheet)
diff --git a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.idl b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.idl
index d0923f1..578b22e 100644
--- a/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.idl
+++ b/src/3rdparty/webkit/WebCore/dom/ProcessingInstruction.idl
@@ -32,7 +32,7 @@ module core {
                  attribute [ConvertNullStringTo=Null, ConvertNullToNullString] DOMString data
                      setter raises(DOMException);
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // interface LinkStyle from DOM Level 2 Style Sheets
         readonly attribute StyleSheet sheet;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp b/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp
index f40f398..607c846 100644
--- a/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/QualifiedName.cpp
@@ -1,7 +1,5 @@
-/**
- * This file is part of the DOM implementation for KDE.
- *
- * Copyright (C) 2005, 2006 Apple Computer, Inc.
+/*
+ * Copyright (C) 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -54,39 +52,16 @@ struct QNameComponentsTranslator {
 static QNameSet* gNameCache;
 
 QualifiedName::QualifiedName(const AtomicString& p, const AtomicString& l, const AtomicString& n)
-    : m_impl(0)
 {
     if (!gNameCache)
         gNameCache = new QNameSet;
-    QualifiedNameComponents components = { p.impl(), l.impl(), n.impl() };
+    QualifiedNameComponents components = { p.impl(), l.impl(), n.isEmpty() ? nullAtom.impl() : n.impl() };
     pair<QNameSet::iterator, bool> addResult = gNameCache->add<QualifiedNameComponents, QNameComponentsTranslator>(components);
     m_impl = *addResult.first;    
     if (!addResult.second)
         m_impl->ref();
 }
 
-QualifiedName::~QualifiedName()
-{
-    deref();
-}
-
-QualifiedName::QualifiedName(const QualifiedName& other)
-{
-    m_impl = other.m_impl;
-    ref();
-}
-
-const QualifiedName& QualifiedName::operator=(const QualifiedName& other)
-{
-    if (m_impl != other.m_impl) {
-        deref();
-        m_impl = other.m_impl;
-        ref();
-    }
-    
-    return *this;
-}
-
 void QualifiedName::deref()
 {
 #ifdef QNAME_DEFAULT_CONSTRUCTOR
@@ -99,12 +74,6 @@ void QualifiedName::deref()
     m_impl->deref();
 }
 
-void QualifiedName::setPrefix(const AtomicString& prefix)
-{
-    QualifiedName other(prefix, localName(), namespaceURI());
-    *this = other;
-}
-
 String QualifiedName::toString() const
 {
     String local = localName();
diff --git a/src/3rdparty/webkit/WebCore/dom/QualifiedName.h b/src/3rdparty/webkit/WebCore/dom/QualifiedName.h
index d09cdea..939927b 100644
--- a/src/3rdparty/webkit/WebCore/dom/QualifiedName.h
+++ b/src/3rdparty/webkit/WebCore/dom/QualifiedName.h
@@ -1,7 +1,5 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
- * Copyright (C) 2005 Apple Computer, Inc.
+ * Copyright (C) 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -19,6 +17,7 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #ifndef QualifiedName_h
 #define QualifiedName_h
 
@@ -26,7 +25,7 @@
 #include <wtf/HashFunctions.h>
 
 namespace WebCore {
-    
+
 struct QualifiedNameComponents {
     StringImpl* m_prefix;
     StringImpl* m_localName;
@@ -37,32 +36,33 @@ class QualifiedName {
 public:
     class QualifiedNameImpl : public RefCounted<QualifiedNameImpl> {
     public:
-        static PassRefPtr<QualifiedNameImpl> create(const AtomicString& p, const AtomicString& l, const AtomicString& n)
+        static PassRefPtr<QualifiedNameImpl> create(const AtomicString& prefix, const AtomicString& localName, const AtomicString& namespaceURI)
         {
-            return adoptRef(new QualifiedNameImpl(p, l, n));
+            return adoptRef(new QualifiedNameImpl(prefix, localName, namespaceURI));
         }
-        
+
         AtomicString m_prefix;
         AtomicString m_localName;
         AtomicString m_namespace;
 
     private:
-        QualifiedNameImpl(const AtomicString& p, const AtomicString& l, const AtomicString& n)
-            : m_prefix(p)
-            , m_localName(l)
-            , m_namespace(n)
+        QualifiedNameImpl(const AtomicString& prefix, const AtomicString& localName, const AtomicString& namespaceURI)
+            : m_prefix(prefix)
+            , m_localName(localName)
+            , m_namespace(namespaceURI)
         {
+            ASSERT(!namespaceURI.isEmpty() || namespaceURI.isNull());
         }        
     };
 
     QualifiedName(const AtomicString& prefix, const AtomicString& localName, const AtomicString& namespaceURI);
-    ~QualifiedName();
+    ~QualifiedName() { deref(); }
 #ifdef QNAME_DEFAULT_CONSTRUCTOR
     QualifiedName() : m_impl(0) { }
 #endif
 
-    QualifiedName(const QualifiedName&);
-    const QualifiedName& operator=(const QualifiedName&);
+    QualifiedName(const QualifiedName& other) : m_impl(other.m_impl) { ref(); }
+    const QualifiedName& operator=(const QualifiedName& other) { other.ref(); deref(); m_impl = other.m_impl; return *this; }
 
     bool operator==(const QualifiedName& other) const { return m_impl == other.m_impl; }
     bool operator!=(const QualifiedName& other) const { return !(*this == other); }
@@ -70,7 +70,7 @@ public:
     bool matches(const QualifiedName& other) const { return m_impl == other.m_impl || (localName() == other.localName() && namespaceURI() == other.namespaceURI()); }
 
     bool hasPrefix() const { return m_impl->m_prefix != nullAtom; }
-    void setPrefix(const AtomicString& prefix);
+    void setPrefix(const AtomicString& prefix) { *this = QualifiedName(prefix, localName(), namespaceURI()); }
 
     const AtomicString& prefix() const { return m_impl->m_prefix; }
     const AtomicString& localName() const { return m_impl->m_localName; }
@@ -84,7 +84,7 @@ public:
     static void init();
     
 private:
-    void ref() { m_impl->ref(); }
+    void ref() const { m_impl->ref(); }
     void deref();
     
     QualifiedNameImpl* m_impl;
@@ -100,7 +100,6 @@ inline bool operator!=(const AtomicString& a, const QualifiedName& q) { return a
 inline bool operator==(const QualifiedName& q, const AtomicString& a) { return a == q.localName(); }
 inline bool operator!=(const QualifiedName& q, const AtomicString& a) { return a != q.localName(); }
 
-
 inline unsigned hashComponents(const QualifiedNameComponents& buf)
 {
     ASSERT(sizeof(QualifiedNameComponents) % (sizeof(uint16_t) * 2) == 0);
@@ -154,6 +153,7 @@ struct QualifiedNameHash {
 namespace WTF {
     
     template<typename T> struct DefaultHash;
+
     template<> struct DefaultHash<WebCore::QualifiedName> {
         typedef WebCore::QualifiedNameHash Hash;
     };
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.cpp b/src/3rdparty/webkit/WebCore/dom/Range.cpp
index ab1a42d..4fb1164 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Range.cpp
@@ -26,16 +26,13 @@
 #include "RangeException.h"
 
 #include "CString.h"
-#include "Document.h"
 #include "DocumentFragment.h"
-#include "ExceptionCode.h"
 #include "HTMLElement.h"
-#include "HTMLNames.h"
 #include "NodeWithIndex.h"
 #include "ProcessingInstruction.h"
-#include "RenderBlock.h"
 #include "Text.h"
 #include "TextIterator.h"
+#include "VisiblePosition.h"
 #include "markup.h"
 #include "visible_units.h"
 #include <stdio.h>
@@ -44,7 +41,6 @@
 namespace WebCore {
 
 using namespace std;
-using namespace HTMLNames;
 
 #ifndef NDEBUG
 static WTF::RefCountedLeakCounter rangeCounter("Range");
@@ -94,13 +90,13 @@ PassRefPtr<Range> Range::create(PassRefPtr<Document> ownerDocument, PassRefPtr<N
 
 PassRefPtr<Range> Range::create(PassRefPtr<Document> ownerDocument, const Position& start, const Position& end)
 {
-    return adoptRef(new Range(ownerDocument, start.container.get(), start.posOffset, end.container.get(), end.posOffset));
+    return adoptRef(new Range(ownerDocument, start.node(), start.deprecatedEditingOffset(), end.node(), end.deprecatedEditingOffset()));
 }
 
 Range::~Range()
 {
-    if (m_start.container())
-        m_ownerDocument->detachRange(this);
+    // Always detach (even if we've already detached) to fix https://bugs.webkit.org/show_bug.cgi?id=26044
+    m_ownerDocument->detachRange(this);
 
 #ifndef NDEBUG
     rangeCounter.decrement();
@@ -212,7 +208,7 @@ void Range::setStart(PassRefPtr<Node> refNode, int offset, ExceptionCode& ec)
     if (startRootContainer != endRootContainer)
         collapse(true, ec);
     // check if new start after end
-    else if (compareBoundaryPoints(m_start.container(), m_start.offset(), m_end.container(), m_end.offset()) > 0)
+    else if (compareBoundaryPoints(m_start, m_end) > 0)
         collapse(true, ec);
 }
 
@@ -250,7 +246,7 @@ void Range::setEnd(PassRefPtr<Node> refNode, int offset, ExceptionCode& ec)
     if (startRootContainer != endRootContainer)
         collapse(false, ec);
     // check if new end before start
-    if (compareBoundaryPoints(m_start.container(), m_start.offset(), m_end.container(), m_end.offset()) > 0)
+    if (compareBoundaryPoints(m_start, m_end) > 0)
         collapse(false, ec);
 }
 
@@ -269,17 +265,17 @@ void Range::collapse(bool toStart, ExceptionCode& ec)
 
 bool Range::isPointInRange(Node* refNode, int offset, ExceptionCode& ec)
 {
-    if (!refNode) {
-        ec = NOT_FOUND_ERR;
+    if (!m_start.container()) {
+        ec = INVALID_STATE_ERR;
         return false;
     }
 
-    if (!m_start.container() && refNode->attached()) {
-        ec = INVALID_STATE_ERR;
+    if (!refNode) {
+        ec = HIERARCHY_REQUEST_ERR;
         return false;
     }
 
-    if (m_start.container() && !refNode->attached()) {
+    if (!refNode->attached()) {
         // Firefox doesn't throw an exception for this case; it returns false.
         return false;
     }
@@ -304,22 +300,17 @@ short Range::comparePoint(Node* refNode, int offset, ExceptionCode& ec)
     // This method returns -1, 0 or 1 depending on if the point described by the 
     // refNode node and an offset within the node is before, same as, or after the range respectively.
 
-    if (!refNode) {
-        ec = NOT_FOUND_ERR;
-        return 0;
-    }
-
-    if (!m_start.container() && refNode->attached()) {
+    if (!m_start.container()) {
         ec = INVALID_STATE_ERR;
         return 0;
     }
 
-    if (m_start.container() && !refNode->attached()) {
-        // Firefox doesn't throw an exception for this case; it returns -1.
-        return -1;
+    if (!refNode) {
+        ec = HIERARCHY_REQUEST_ERR;
+        return 0;
     }
 
-    if (refNode->document() != m_ownerDocument) {
+    if (!refNode->attached() || refNode->document() != m_ownerDocument) {
         ec = WRONG_DOCUMENT_ERR;
         return 0;
     }
@@ -388,7 +379,6 @@ Range::CompareResults Range::compareNode(Node* refNode, ExceptionCode& ec)
     }
 }
 
-
 short Range::compareBoundaryPoints(CompareHow how, const Range* sourceRange, ExceptionCode& ec) const
 {
     if (!m_start.container()) {
@@ -427,17 +417,13 @@ short Range::compareBoundaryPoints(CompareHow how, const Range* sourceRange, Exc
 
     switch (how) {
         case START_TO_START:
-            return compareBoundaryPoints(m_start.container(), m_start.offset(),
-                sourceRange->m_start.container(), sourceRange->m_start.offset());
+            return compareBoundaryPoints(m_start, sourceRange->m_start);
         case START_TO_END:
-            return compareBoundaryPoints(m_end.container(), m_end.offset(),
-                sourceRange->m_start.container(), sourceRange->m_start.offset());
+            return compareBoundaryPoints(m_end, sourceRange->m_start);
         case END_TO_END:
-            return compareBoundaryPoints(m_end.container(), m_end.offset(),
-                sourceRange->m_end.container(), sourceRange->m_end.offset());
+            return compareBoundaryPoints(m_end, sourceRange->m_end);
         case END_TO_START:
-            return compareBoundaryPoints(m_start.container(), m_start.offset(),
-                sourceRange->m_end.container(), sourceRange->m_end.offset());
+            return compareBoundaryPoints(m_start, sourceRange->m_end);
     }
 
     ec = SYNTAX_ERR;
@@ -446,11 +432,14 @@ short Range::compareBoundaryPoints(CompareHow how, const Range* sourceRange, Exc
 
 short Range::compareBoundaryPoints(Node* containerA, int offsetA, Node* containerB, int offsetB)
 {
-    ASSERT(containerA && containerB);
+    ASSERT(containerA);
+    ASSERT(containerB);
+
     if (!containerA)
         return -1;
     if (!containerB)
         return 1;
+
     // see DOM2 traversal & range section 2.5
 
     // case 1: both points have the same container
@@ -532,14 +521,14 @@ short Range::compareBoundaryPoints(Node* containerA, int offsetA, Node* containe
     return 0;
 }
 
-short Range::compareBoundaryPoints(const Position& a, const Position& b)
+short Range::compareBoundaryPoints(const RangeBoundaryPoint& boundaryA, const RangeBoundaryPoint& boundaryB)
 {
-    return compareBoundaryPoints(a.container.get(), a.posOffset, b.container.get(), b.posOffset);
+    return compareBoundaryPoints(boundaryA.container(), boundaryA.offset(), boundaryB.container(), boundaryB.offset());
 }
 
 bool Range::boundaryPointsValid() const
 {
-    return m_start.container() && compareBoundaryPoints(m_start.container(), m_start.offset(), m_end.container(), m_end.offset()) <= 0;
+    return m_start.container() && compareBoundaryPoints(m_start, m_end) <= 0;
 }
 
 void Range::deleteContents(ExceptionCode& ec)
@@ -561,8 +550,8 @@ bool Range::intersectsNode(Node* refNode, ExceptionCode& ec)
         return false;
     }
     
-    if (!m_start.container() && refNode->attached()
-            || m_start.container() && !refNode->attached()
+    if ((!m_start.container() && refNode->attached())
+            || (m_start.container() && !refNode->attached())
             || refNode->document() != m_ownerDocument) {
         // Firefox doesn't throw an exception for these cases; it returns false.
         return false;
@@ -847,6 +836,17 @@ PassRefPtr<DocumentFragment> Range::processContents(ActionType action, Exception
             processEnd = processEnd->parentNode();
     }
 
+    // Collapse the range, making sure that the result is not within a node that was partially selected.
+    if (action == EXTRACT_CONTENTS || action == DELETE_CONTENTS) {
+        if (partialStart)
+            setStart(partialStart->parentNode(), partialStart->nodeIndex() + 1, ec);
+        else if (partialEnd)
+            setStart(partialEnd->parentNode(), partialEnd->nodeIndex(), ec);
+        if (ec)
+            return 0;
+        m_end = m_start;
+    }
+
     // Now add leftContents, stuff in between, and rightContents to the fragment
     // (or just delete the stuff in between)
 
@@ -986,7 +986,7 @@ void Range::insertNode(PassRefPtr<Node> prpNewNode, ExceptionCode& ec)
         // This special case doesn't seem to match the DOM specification, but it's currently required
         // to pass Acid3. We might later decide to remove this.
         if (collapsed)
-            m_end.setToChild(newText.get());
+            m_end.setToBeforeChild(newText.get());
     } else {
         RefPtr<Node> lastChild;
         if (collapsed)
@@ -1069,6 +1069,7 @@ PassRefPtr<DocumentFragment> Range::createContextualFragment(const String& marku
 
 void Range::detach(ExceptionCode& ec)
 {
+    // Check first to see if we've already detached:
     if (!m_start.container()) {
         ec = INVALID_STATE_ERR;
         return;
@@ -1350,8 +1351,8 @@ void Range::selectNodeContents(Node* refNode, ExceptionCode& ec)
         }
     }
 
-    m_start.setToStart(refNode);
-    m_end.setToEnd(refNode);
+    m_start.setToStartOfNode(refNode);
+    m_end.setToEndOfNode(refNode);
 }
 
 void Range::surroundContents(PassRefPtr<Node> passNewParent, ExceptionCode& ec)
@@ -1580,31 +1581,30 @@ IntRect Range::boundingBox()
 {
     IntRect result;
     Vector<IntRect> rects;
-    addLineBoxRects(rects);
+    textRects(rects);
     const size_t n = rects.size();
     for (size_t i = 0; i < n; ++i)
         result.unite(rects[i]);
     return result;
 }
 
-void Range::addLineBoxRects(Vector<IntRect>& rects, bool useSelectionHeight)
+void Range::textRects(Vector<IntRect>& rects, bool useSelectionHeight)
 {
     if (!m_start.container() || !m_end.container())
         return;
 
-    RenderObject* start = m_start.container()->renderer();
-    RenderObject* end = m_end.container()->renderer();
-    if (!start || !end)
-        return;
+    Node* startContainer = m_start.container();
+    Node* endContainer = m_end.container();
 
-    RenderObject* stop = end->nextInPreOrderAfterChildren();
-    for (RenderObject* r = start; r && r != stop; r = r->nextInPreOrder()) {
-        // only ask leaf render objects for their line box rects
-        if (!r->firstChild()) {
-            int startOffset = r == start ? m_start.offset() : 0;
-            int endOffset = r == end ? m_end.offset() : INT_MAX;
-            r->addLineBoxRects(rects, startOffset, endOffset, useSelectionHeight);
-        }
+    Node* stopNode = pastLastNode();
+    for (Node* node = firstNode(); node != stopNode; node = node->traverseNextNode()) {
+        RenderObject* r = node->renderer();
+        if (!r || !r->isText())
+            continue;
+        RenderText* renderText = toRenderText(r);
+        int startOffset = node == startContainer ? m_start.offset() : 0;
+        int endOffset = node == endContainer ? m_end.offset() : INT_MAX;
+        renderText->absoluteRectsForRange(rects, startOffset, endOffset, useSelectionHeight);
     }
 }
 
@@ -1700,7 +1700,7 @@ static inline void boundaryNodeWillBeRemoved(RangeBoundaryPoint& boundary, Node*
 
     for (Node* n = boundary.container(); n; n = n->parentNode()) {
         if (n == nodeToBeRemoved) {
-            boundary.setToChild(nodeToBeRemoved);
+            boundary.setToBeforeChild(nodeToBeRemoved);
             return;
         }
     }
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.h b/src/3rdparty/webkit/WebCore/dom/Range.h
index 49dea82..115f442 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.h
+++ b/src/3rdparty/webkit/WebCore/dom/Range.h
@@ -66,7 +66,7 @@ public:
     enum CompareHow { START_TO_START, START_TO_END, END_TO_END, END_TO_START };
     short compareBoundaryPoints(CompareHow, const Range* sourceRange, ExceptionCode&) const;
     static short compareBoundaryPoints(Node* containerA, int offsetA, Node* containerB, int offsetB);
-    static short compareBoundaryPoints(const Position&, const Position&);
+    static short compareBoundaryPoints(const RangeBoundaryPoint& boundaryA, const RangeBoundaryPoint& boundaryB);
     bool boundaryPointsValid() const;
     bool intersectsNode(Node* refNode, ExceptionCode&);
     void deleteContents(ExceptionCode&);
@@ -91,8 +91,8 @@ public:
     void surroundContents(PassRefPtr<Node>, ExceptionCode&);
     void setStartBefore(Node*, ExceptionCode&);
 
-    const Position& startPosition() const { return m_start.position(); }
-    const Position& endPosition() const { return m_end.position(); }
+    const Position startPosition() const { return m_start.toPosition(); }
+    const Position endPosition() const { return m_end.toPosition(); }
 
     Node* firstNode() const;
     Node* pastLastNode() const;
@@ -102,7 +102,7 @@ public:
     Node* shadowTreeRootNode() const;
 
     IntRect boundingBox();
-    void addLineBoxRects(Vector<IntRect>&, bool useSelectionHeight = false);
+    void textRects(Vector<IntRect>&, bool useSelectionHeight = false);
 
     void nodeChildrenChanged(ContainerNode*);
     void nodeWillBeRemoved(Node*);
diff --git a/src/3rdparty/webkit/WebCore/dom/Range.idl b/src/3rdparty/webkit/WebCore/dom/Range.idl
index 4344474..0750c32 100644
--- a/src/3rdparty/webkit/WebCore/dom/Range.idl
+++ b/src/3rdparty/webkit/WebCore/dom/Range.idl
@@ -112,7 +112,7 @@ module ranges {
                                in long offset)
             raises(RangeException, DOMException);
 
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         readonly attribute DOMString text;
 #endif
     };
diff --git a/src/3rdparty/webkit/WebCore/dom/RangeBoundaryPoint.h b/src/3rdparty/webkit/WebCore/dom/RangeBoundaryPoint.h
index 4cb7bf5..1bbbe1a 100644
--- a/src/3rdparty/webkit/WebCore/dom/RangeBoundaryPoint.h
+++ b/src/3rdparty/webkit/WebCore/dom/RangeBoundaryPoint.h
@@ -33,10 +33,10 @@ namespace WebCore {
 
 class RangeBoundaryPoint {
 public:
-    RangeBoundaryPoint();
     explicit RangeBoundaryPoint(PassRefPtr<Node> container);
 
-    const Position& position() const;
+    const Position toPosition() const;
+
     Node* container() const;
     int offset() const;
     Node* childBefore() const;
@@ -45,122 +45,131 @@ public:
 
     void set(PassRefPtr<Node> container, int offset, Node* childBefore);
     void setOffset(int offset);
-    void setToChild(Node* child);
-    void setToStart(PassRefPtr<Node> container);
-    void setToEnd(PassRefPtr<Node> container);
+
+    void setToBeforeChild(Node*);
+    void setToStartOfNode(PassRefPtr<Node>);
+    void setToEndOfNode(PassRefPtr<Node>);
 
     void childBeforeWillBeRemoved();
     void invalidateOffset() const;
+    void ensureOffsetIsValid() const;
 
 private:
     static const int invalidOffset = -1;
-
-    mutable Position m_position;
-    Node* m_childBefore;
+    
+    RefPtr<Node> m_containerNode;
+    mutable int m_offsetInContainer;
+    Node* m_childBeforeBoundary;
 };
 
-inline RangeBoundaryPoint::RangeBoundaryPoint()
-    : m_childBefore(0)
-{
-}
-
 inline RangeBoundaryPoint::RangeBoundaryPoint(PassRefPtr<Node> container)
-    : m_position(container, 0)
-    , m_childBefore(0)
+    : m_containerNode(container)
+    , m_offsetInContainer(0)
+    , m_childBeforeBoundary(0)
 {
+    ASSERT(m_containerNode);
 }
 
 inline Node* RangeBoundaryPoint::container() const
 {
-    return m_position.container.get();
+    return m_containerNode.get();
 }
 
 inline Node* RangeBoundaryPoint::childBefore() const
 {
-    return m_childBefore;
+    return m_childBeforeBoundary;
 }
 
-inline const Position& RangeBoundaryPoint::position() const
+inline void RangeBoundaryPoint::ensureOffsetIsValid() const
 {
-    if (m_position.posOffset >= 0)
-        return m_position;
-    ASSERT(m_childBefore);
-    m_position.posOffset = m_childBefore->nodeIndex() + 1;
-    return m_position;
+    if (m_offsetInContainer >= 0)
+        return;
+
+    ASSERT(m_childBeforeBoundary);
+    m_offsetInContainer = m_childBeforeBoundary->nodeIndex() + 1;
+}
+
+inline const Position RangeBoundaryPoint::toPosition() const
+{
+    ensureOffsetIsValid();
+    return Position(m_containerNode.get(), m_offsetInContainer);
 }
 
 inline int RangeBoundaryPoint::offset() const
 {
-    return position().posOffset;
+    ensureOffsetIsValid();
+    return m_offsetInContainer;
 }
 
 inline void RangeBoundaryPoint::clear()
 {
-    m_position.clear();
-    m_childBefore = 0;
+    m_containerNode.clear();
+    m_offsetInContainer = 0;
+    m_childBeforeBoundary = 0;
 }
 
 inline void RangeBoundaryPoint::set(PassRefPtr<Node> container, int offset, Node* childBefore)
 {
+    ASSERT(container);
     ASSERT(offset >= 0);
     ASSERT(childBefore == (offset ? container->childNode(offset - 1) : 0));
-    m_position.container = container;
-    m_position.posOffset = offset;
-    m_childBefore = childBefore;
+    m_containerNode = container;
+    m_offsetInContainer = offset;
+    m_childBeforeBoundary = childBefore;
 }
 
 inline void RangeBoundaryPoint::setOffset(int offset)
 {
-    ASSERT(m_position.container);
-    ASSERT(m_position.container->offsetInCharacters());
-    ASSERT(m_position.posOffset >= 0);
-    ASSERT(!m_childBefore);
-    m_position.posOffset = offset;
+    ASSERT(m_containerNode);
+    ASSERT(m_containerNode->offsetInCharacters());
+    ASSERT(m_offsetInContainer >= 0);
+    ASSERT(!m_childBeforeBoundary);
+    m_offsetInContainer = offset;
 }
 
-inline void RangeBoundaryPoint::setToChild(Node* child)
+inline void RangeBoundaryPoint::setToBeforeChild(Node* child)
 {
     ASSERT(child);
     ASSERT(child->parentNode());
-    m_position.container = child->parentNode();
-    m_childBefore = child->previousSibling();
-    m_position.posOffset = m_childBefore ? invalidOffset : 0;
+    m_childBeforeBoundary = child->previousSibling();
+    m_containerNode = child->parentNode();
+    m_offsetInContainer = m_childBeforeBoundary ? invalidOffset : 0;
 }
 
-inline void RangeBoundaryPoint::setToStart(PassRefPtr<Node> container)
+inline void RangeBoundaryPoint::setToStartOfNode(PassRefPtr<Node> container)
 {
     ASSERT(container);
-    m_position.container = container;
-    m_position.posOffset = 0;
-    m_childBefore = 0;
+    m_containerNode = container;
+    m_offsetInContainer = 0;
+    m_childBeforeBoundary = 0;
 }
 
-inline void RangeBoundaryPoint::setToEnd(PassRefPtr<Node> container)
+inline void RangeBoundaryPoint::setToEndOfNode(PassRefPtr<Node> container)
 {
     ASSERT(container);
-    m_position.container = container;
-    if (m_position.container->offsetInCharacters()) {
-        m_position.posOffset = m_position.container->maxCharacterOffset();
-        m_childBefore = 0;
+    m_containerNode = container;
+    if (m_containerNode->offsetInCharacters()) {
+        m_offsetInContainer = m_containerNode->maxCharacterOffset();
+        m_childBeforeBoundary = 0;
     } else {
-        m_childBefore = m_position.container->lastChild();
-        m_position.posOffset = m_childBefore ? invalidOffset : 0;
+        m_childBeforeBoundary = m_containerNode->lastChild();
+        m_offsetInContainer = m_childBeforeBoundary ? invalidOffset : 0;
     }
 }
 
 inline void RangeBoundaryPoint::childBeforeWillBeRemoved()
 {
-    ASSERT(m_position.posOffset);
-    m_childBefore = m_childBefore->previousSibling();
-    if (!m_childBefore)
-        m_position.posOffset = 0;
-    else if (m_position.posOffset > 0)
-        --m_position.posOffset;
+    ASSERT(m_offsetInContainer);
+    m_childBeforeBoundary = m_childBeforeBoundary->previousSibling();
+    if (!m_childBeforeBoundary)
+        m_offsetInContainer = 0;
+    else if (m_offsetInContainer > 0)
+        --m_offsetInContainer;
 }
 
 inline void RangeBoundaryPoint::invalidateOffset() const
 {
-    m_position.posOffset = invalidOffset;
+    m_offsetInContainer = invalidOffset;
 }
 
 inline bool operator==(const RangeBoundaryPoint& a, const RangeBoundaryPoint& b)
diff --git a/src/3rdparty/webkit/WebCore/dom/RangeException.idl b/src/3rdparty/webkit/WebCore/dom/RangeException.idl
index 36cde16..d2cf385 100644
--- a/src/3rdparty/webkit/WebCore/dom/RangeException.idl
+++ b/src/3rdparty/webkit/WebCore/dom/RangeException.idl
@@ -27,7 +27,7 @@ module ranges {
         readonly attribute DOMString        name;
         readonly attribute DOMString        message;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         [DontEnum] DOMString toString();
 #endif
 
diff --git a/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h b/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h
index 29b061d..479c2ff 100644
--- a/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h
+++ b/src/3rdparty/webkit/WebCore/dom/RegisteredEventListener.h
@@ -25,11 +25,10 @@
 #define RegisteredEventListener_h
 
 #include "AtomicString.h"
+#include "EventListener.h"
 
 namespace WebCore {
 
-    class EventListener;
-
     class RegisteredEventListener : public RefCounted<RegisteredEventListener> {
     public:
         static PassRefPtr<RegisteredEventListener> create(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
@@ -53,6 +52,25 @@ namespace WebCore {
         bool m_removed;
     };
 
+    typedef Vector<RefPtr<RegisteredEventListener> > RegisteredEventListenerVector;
+
+#if USE(JSC)
+    inline void markEventListeners(const RegisteredEventListenerVector& listeners)
+    {
+        for (size_t i = 0; i < listeners.size(); ++i)
+            listeners[i]->listener()->markJSFunction();
+    }
+
+    inline void invalidateEventListeners(const RegisteredEventListenerVector& listeners)
+    {
+        // For efficiency's sake, we just set the "removed" bit, instead of
+        // actually removing the event listener. The node that owns these
+        // listeners is about to be deleted, anyway.
+        for (size_t i = 0; i < listeners.size(); ++i)
+            listeners[i]->setRemoved(true);
+    }
+#endif
+
 } // namespace WebCore
 
 #endif // RegisteredEventListener_h
diff --git a/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp b/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp
index aeadc41..fe38b46 100644
--- a/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ScriptElement.cpp
@@ -29,6 +29,8 @@
 #include "Document.h"
 #include "Frame.h"
 #include "FrameLoader.h"
+#include "HTMLNames.h"
+#include "HTMLScriptElement.h"
 #include "MIMETypeRegistry.h"
 #include "ScriptController.h"
 #include "ScriptSourceCode.h"
@@ -37,6 +39,11 @@
 #include "Text.h"
 #include <wtf/StdLibExtras.h>
 
+#if ENABLE(SVG)
+#include "SVGNames.h"
+#include "SVGScriptElement.h"
+#endif
+
 namespace WebCore {
 
 void ScriptElement::insertedIntoDocument(ScriptElementData& data, const String& sourceUrl)
@@ -121,6 +128,7 @@ ScriptElementData::ScriptElementData(ScriptElement* scriptElement, Element* elem
     , m_element(element)
     , m_cachedScript(0)
     , m_createdByParser(false)
+    , m_requested(false)
     , m_evaluated(false)
     , m_firedLoad(false)
 {
@@ -145,6 +153,7 @@ void ScriptElementData::requestScript(const String& sourceUrl)
 
     ASSERT(!m_cachedScript);
     m_cachedScript = document->docLoader()->requestScript(sourceUrl, scriptCharset());
+    m_requested = true;
 
     // m_createdByParser is never reset - always resied at the initial value set while parsing.
     // m_evaluated is left untouched as well to avoid script reexecution, if a <script> element
@@ -171,7 +180,7 @@ void ScriptElementData::evaluateScript(const ScriptSourceCode& sourceCode)
         m_evaluated = true;
 
         frame->script()->evaluate(sourceCode);
-        Document::updateDocumentsRendering();
+        Document::updateStyleForAllDocuments();
     }
 }
 
@@ -183,28 +192,28 @@ void ScriptElementData::stopLoadRequest()
     }
 }
 
-void ScriptElementData::notifyFinished(CachedResource* o)
+void ScriptElementData::execute(CachedScript* cachedScript)
 {
-    CachedScript* cs = static_cast<CachedScript*>(o);
-    ASSERT(cs == m_cachedScript);
-
-    // Evaluating the script could lead to a garbage collection which can
-    // delete the script element so we need to protect it and us with it!
-    RefPtr<Element> protector(m_element);
-
-    if (cs->errorOccurred())
+    ASSERT(cachedScript);
+    if (cachedScript->errorOccurred())
         m_scriptElement->dispatchErrorEvent();
     else {
-        evaluateScript(ScriptSourceCode(cs));
+        evaluateScript(ScriptSourceCode(cachedScript));
         m_scriptElement->dispatchLoadEvent();
     }
+    cachedScript->removeClient(this);
+}
 
-    stopLoadRequest();
+void ScriptElementData::notifyFinished(CachedResource* o)
+{
+    ASSERT_UNUSED(o, o == m_cachedScript);
+    m_element->document()->executeScriptSoon(this, m_cachedScript);
+    m_cachedScript = 0;
 }
 
 bool ScriptElementData::ignoresLoadRequest() const
 {
-    return m_evaluated || m_cachedScript || m_createdByParser || !m_element->inDocument();
+    return m_evaluated || m_requested || m_createdByParser || !m_element->inDocument();
 }
 
 bool ScriptElementData::shouldExecuteAsJavaScript() const
@@ -224,8 +233,15 @@ bool ScriptElementData::shouldExecuteAsJavaScript() const
     if (!language.isEmpty())
         return isSupportedJavaScriptLanguage(language);
 
-    // No type or language is specified, so we assume the script to be JavaScript
-    return true;
+    // No type or language is specified, so we assume the script to be JavaScript.
+    // We don't yet support setting event listeners via the 'for' attribute for scripts.
+    // If there is such an attribute it's likely better to not execute the script than to do so
+    // immediately and unconditionally.
+    // FIXME: After <rdar://problem/4471751> / https://bugs.webkit.org/show_bug.cgi?id=16915 are resolved 
+    // and we support the for syntax in script tags, this check can be removed and we should just
+    // return 'true' here.
+    String forAttribute = m_scriptElement->forAttributeValue();
+    return forAttribute.isEmpty();
 }
 
 String ScriptElementData::scriptCharset() const
@@ -269,4 +285,17 @@ String ScriptElementData::scriptContent() const
     return String::adopt(val);
 }
 
+ScriptElement* toScriptElement(Element* element)
+{
+    if (element->isHTMLElement() && element->hasTagName(HTMLNames::scriptTag))
+        return static_cast<HTMLScriptElement*>(element);
+
+#if ENABLE(SVG)
+    if (element->isSVGElement() && element->hasTagName(SVGNames::scriptTag))
+        return static_cast<SVGScriptElement*>(element);
+#endif
+
+    return 0;
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/ScriptElement.h b/src/3rdparty/webkit/WebCore/dom/ScriptElement.h
index 73cd077..0aed5e8 100644
--- a/src/3rdparty/webkit/WebCore/dom/ScriptElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/ScriptElement.h
@@ -42,6 +42,7 @@ public:
     virtual String charsetAttributeValue() const = 0;
     virtual String typeAttributeValue() const = 0;
     virtual String languageAttributeValue() const = 0;
+    virtual String forAttributeValue() const = 0;
 
     virtual void dispatchLoadEvent() = 0;
     virtual void dispatchErrorEvent() = 0;
@@ -49,6 +50,8 @@ public:
     // A charset for loading the script (may be overridden by HTTP headers or a BOM).
     virtual String scriptCharset() const = 0;
 
+    virtual bool shouldExecuteAsJavaScript() const = 0;
+
 protected:
     // Helper functions used by our parent classes.
     static void insertedIntoDocument(ScriptElementData&, const String& sourceUrl);
@@ -81,6 +84,8 @@ public:
     void evaluateScript(const ScriptSourceCode&);
     void stopLoadRequest();
 
+    void execute(CachedScript*);
+
 private:
     virtual void notifyFinished(CachedResource*);
 
@@ -89,10 +94,13 @@ private:
     Element* m_element;
     CachedResourceHandle<CachedScript> m_cachedScript;
     bool m_createdByParser;
+    bool m_requested;
     bool m_evaluated;
     bool m_firedLoad;
 };
 
+ScriptElement* toScriptElement(Element*);
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.cpp b/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.cpp
index 1d1aaec..45d4e23 100644
--- a/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.cpp
@@ -88,7 +88,7 @@ void ScriptExecutionContext::dispatchMessagePortEvents()
         MessagePort* port = ports[i];
         // The port may be destroyed, and another one created at the same address, but this is safe, as the worst that can happen
         // as a result is that dispatchMessages() will be called needlessly.
-        if (m_messagePorts.contains(port) && port->queueIsOpen())
+        if (m_messagePorts.contains(port) && port->started())
             port->dispatchMessages();
     }
 }
@@ -175,6 +175,22 @@ void ScriptExecutionContext::setSecurityOrigin(PassRefPtr<SecurityOrigin> securi
     m_securityOrigin = securityOrigin;
 }
 
+void ScriptExecutionContext::addTimeout(int timeoutId, DOMTimer* timer)
+{
+    ASSERT(!m_timeouts.contains(timeoutId));
+    m_timeouts.set(timeoutId, timer);
+}
+
+void ScriptExecutionContext::removeTimeout(int timeoutId)
+{
+    m_timeouts.remove(timeoutId);
+}
+
+DOMTimer* ScriptExecutionContext::findTimeout(int timeoutId)
+{
+    return m_timeouts.get(timeoutId);
+}
+
 ScriptExecutionContext::Task::~Task()
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h b/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h
index 2e9d56c..7b2f36a 100644
--- a/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h
+++ b/src/3rdparty/webkit/WebCore/dom/ScriptExecutionContext.h
@@ -27,6 +27,7 @@
 #ifndef ScriptExecutionContext_h
 #define ScriptExecutionContext_h
 
+#include "Console.h"
 #include "KURL.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
@@ -36,10 +37,17 @@
 namespace WebCore {
 
     class ActiveDOMObject;
+    class DOMTimer;
     class MessagePort;
     class SecurityOrigin;
+    class ScriptString;
     class String;
 
+    enum MessageDestination {
+        InspectorControllerDestination,
+        ConsoleDestination,
+    };
+
     class ScriptExecutionContext {
     public:
         ScriptExecutionContext();
@@ -51,10 +59,15 @@ namespace WebCore {
         const KURL& url() const { return virtualURL(); }
         KURL completeURL(const String& url) const { return virtualCompleteURL(url); }
 
+        virtual String userAgent(const KURL&) const = 0;
+
         SecurityOrigin* securityOrigin() const { return m_securityOrigin.get(); }
 
         virtual void reportException(const String& errorMessage, int lineNumber, const String& sourceURL) = 0;
-
+        virtual void addMessage(MessageDestination, MessageSource, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL) = 0;
+        virtual void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString) = 0;
+        virtual void scriptImported(unsigned long, const String&) = 0;
+        
         // Active objects are not garbage collected even if inaccessible, e.g. because their activity may result in callbacks being invoked.
         bool canSuspendActiveDOMObjects();
         // Active objects can be asked to suspend even if canSuspendActiveDOMObjects() returns 'false' -
@@ -85,6 +98,10 @@ namespace WebCore {
 
         virtual void postTask(PassRefPtr<Task>) = 0; // Executes the task on context's thread asynchronously.
 
+        void addTimeout(int timeoutId, DOMTimer*);
+        void removeTimeout(int timeoutId);
+        DOMTimer* findTimeout(int timeoutId);
+
     protected:
         // Explicitly override the security origin for this script context.
         // Note: It is dangerous to change the security origin of a script context
@@ -101,6 +118,8 @@ namespace WebCore {
 
         HashMap<ActiveDOMObject*, void*> m_activeDOMObjects;
 
+        HashMap<int, DOMTimer*> m_timeouts;
+
         virtual void refScriptExecutionContext() = 0;
         virtual void derefScriptExecutionContext() = 0;
     };
diff --git a/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp b/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
new file mode 100644
index 0000000..1831f3a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/SelectElement.cpp
@@ -0,0 +1,932 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "SelectElement.h"
+
+#include "CharacterNames.h"
+#include "ChromeClient.h"
+#include "Element.h"
+#include "EventHandler.h"
+#include "EventNames.h"
+#include "FormDataList.h"
+#include "Frame.h"
+#include "HTMLFormElement.h"
+#include "HTMLNames.h"
+#include "HTMLKeygenElement.h"
+#include "HTMLSelectElement.h"
+#include "KeyboardEvent.h"
+#include "MappedAttribute.h"
+#include "MouseEvent.h"
+#include "OptionElement.h"
+#include "OptionGroupElement.h"
+#include "Page.h"
+#include "RenderListBox.h"
+#include "RenderMenuList.h"
+#include <wtf/Assertions.h>
+
+#if ENABLE(WML)
+#include "WMLNames.h"
+#include "WMLSelectElement.h"
+#endif
+
+#if PLATFORM(MAC)
+#define ARROW_KEYS_POP_MENU 1
+#else
+#define ARROW_KEYS_POP_MENU 0
+#endif
+
+using std::min;
+using std::max;
+using namespace WTF;
+using namespace Unicode;
+
+namespace WebCore {
+
+static const DOMTimeStamp typeAheadTimeout = 1000;
+
+void SelectElement::selectAll(SelectElementData& data, Element* element)
+{
+    ASSERT(!data.usesMenuList());
+    if (!element->renderer() || !data.multiple())
+        return;
+
+    // Save the selection so it can be compared to the new selectAll selection when dispatching change events
+    saveLastSelection(data, element);
+
+    data.setActiveSelectionState(true);
+    setActiveSelectionAnchorIndex(data, element, nextSelectableListIndex(data, element, -1));
+    setActiveSelectionEndIndex(data, previousSelectableListIndex(data, element, -1));
+
+    updateListBoxSelection(data, element, false);
+    listBoxOnChange(data, element);
+}
+
+void SelectElement::saveLastSelection(SelectElementData& data, Element* element)
+{
+    if (data.usesMenuList()) {
+        data.setLastOnChangeIndex(selectedIndex(data, element));
+        return;
+    }
+
+    Vector<bool>& lastOnChangeSelection = data.lastOnChangeSelection(); 
+    lastOnChangeSelection.clear();
+
+    const Vector<Element*>& items = data.listItems(element);
+    for (unsigned i = 0; i < items.size(); ++i) {
+        OptionElement* optionElement = toOptionElement(items[i]);
+        lastOnChangeSelection.append(optionElement && optionElement->selected());
+    }
+}
+
+int SelectElement::nextSelectableListIndex(SelectElementData& data, Element* element, int startIndex)
+{
+    const Vector<Element*>& items = data.listItems(element);
+    int index = startIndex + 1;
+    while (index >= 0 && (unsigned) index < items.size() && (!isOptionElement(items[index]) || items[index]->disabled()))
+        ++index;
+    if ((unsigned) index == items.size())
+        return startIndex;
+    return index;
+}
+
+int SelectElement::previousSelectableListIndex(SelectElementData& data, Element* element, int startIndex)
+{
+    const Vector<Element*>& items = data.listItems(element);
+    if (startIndex == -1)
+        startIndex = items.size();
+    int index = startIndex - 1;
+    while (index >= 0 && (unsigned) index < items.size() && (!isOptionElement(items[index]) || items[index]->disabled()))
+        --index;
+    if (index == -1)
+        return startIndex;
+    return index;
+}
+
+void SelectElement::setActiveSelectionAnchorIndex(SelectElementData& data, Element* element, int index)
+{
+    data.setActiveSelectionAnchorIndex(index);
+
+    // Cache the selection state so we can restore the old selection as the new selection pivots around this anchor index
+    Vector<bool>& cachedStateForActiveSelection = data.cachedStateForActiveSelection(); 
+    cachedStateForActiveSelection.clear();
+
+    const Vector<Element*>& items = data.listItems(element);
+    for (unsigned i = 0; i < items.size(); ++i) {
+        OptionElement* optionElement = toOptionElement(items[i]);
+        cachedStateForActiveSelection.append(optionElement && optionElement->selected());
+    }
+}
+
+void SelectElement::setActiveSelectionEndIndex(SelectElementData& data, int index)
+{
+    data.setActiveSelectionEndIndex(index);
+}
+
+void SelectElement::updateListBoxSelection(SelectElementData& data, Element* element, bool deselectOtherOptions)
+{
+    ASSERT(element->renderer() && element->renderer()->isListBox());
+    ASSERT(data.activeSelectionAnchorIndex() >= 0);
+
+    unsigned start = min(data.activeSelectionAnchorIndex(), data.activeSelectionEndIndex());
+    unsigned end = max(data.activeSelectionAnchorIndex(), data.activeSelectionEndIndex());
+    Vector<bool>& cachedStateForActiveSelection = data.cachedStateForActiveSelection();
+
+    const Vector<Element*>& items = data.listItems(element);
+    for (unsigned i = 0; i < items.size(); ++i) {
+        OptionElement* optionElement = toOptionElement(items[i]);
+        if (!optionElement || items[i]->disabled())
+            continue;
+
+        if (i >= start && i <= end)
+            optionElement->setSelectedState(data.activeSelectionState());
+        else if (deselectOtherOptions || i >= cachedStateForActiveSelection.size())
+            optionElement->setSelectedState(false);
+        else
+            optionElement->setSelectedState(cachedStateForActiveSelection[i]);
+    }
+
+    scrollToSelection(data, element);
+}
+
+void SelectElement::listBoxOnChange(SelectElementData& data, Element* element)
+{
+    ASSERT(!data.usesMenuList());
+
+    Vector<bool>& lastOnChangeSelection = data.lastOnChangeSelection(); 
+    const Vector<Element*>& items = data.listItems(element);
+
+    // If the cached selection list is empty, or the size has changed, then fire dispatchFormControlChangeEvent, and return early.
+    if (lastOnChangeSelection.isEmpty() || lastOnChangeSelection.size() != items.size()) {
+        element->dispatchFormControlChangeEvent();
+        return;
+    }
+
+    // Update lastOnChangeSelection and fire dispatchFormControlChangeEvent
+    bool fireOnChange = false;
+    for (unsigned i = 0; i < items.size(); ++i) {
+        OptionElement* optionElement = toOptionElement(items[i]);
+        bool selected = optionElement &&  optionElement->selected();
+        if (selected != lastOnChangeSelection[i])
+            fireOnChange = true;
+        lastOnChangeSelection[i] = selected;
+    }
+
+    if (fireOnChange)
+        element->dispatchFormControlChangeEvent();
+}
+
+void SelectElement::menuListOnChange(SelectElementData& data, Element* element)
+{
+    ASSERT(data.usesMenuList());
+
+    int selected = selectedIndex(data, element);
+    if (data.lastOnChangeIndex() != selected && data.userDrivenChange()) {
+        data.setLastOnChangeIndex(selected);
+        data.setUserDrivenChange(false);
+        element->dispatchFormControlChangeEvent();
+    }
+}
+
+void SelectElement::scrollToSelection(SelectElementData& data, Element* element)
+{
+    if (data.usesMenuList())
+        return;
+
+    if (RenderObject* renderer = element->renderer())
+        static_cast<RenderListBox*>(renderer)->selectionChanged();
+}
+
+void SelectElement::recalcStyle(SelectElementData& data, Element* element)
+{
+    RenderObject* renderer = element->renderer();
+    if (element->childNeedsStyleRecalc() && renderer) {
+        if (data.usesMenuList())
+            static_cast<RenderMenuList*>(renderer)->setOptionsChanged(true);
+        else
+            static_cast<RenderListBox*>(renderer)->setOptionsChanged(true);
+    } else if (data.shouldRecalcListItems())
+        recalcListItems(data, element);
+}
+
+void SelectElement::setRecalcListItems(SelectElementData& data, Element* element)
+{
+    data.setShouldRecalcListItems(true);
+    data.setActiveSelectionAnchorIndex(-1); // Manual selection anchor is reset when manipulating the select programmatically.
+    if (RenderObject* renderer = element->renderer()) {
+        if (data.usesMenuList())
+            static_cast<RenderMenuList*>(renderer)->setOptionsChanged(true);
+        else
+            static_cast<RenderListBox*>(renderer)->setOptionsChanged(true);
+    }
+    element->setNeedsStyleRecalc();
+}
+
+void SelectElement::recalcListItems(SelectElementData& data, const Element* element, bool updateSelectedStates)
+{
+    Vector<Element*>& listItems = data.rawListItems();
+    listItems.clear();
+
+    OptionElement* foundSelected = 0;
+    for (Node* currentNode = element->firstChild(); currentNode;) {
+        if (!currentNode->isElementNode()) {
+            currentNode = currentNode->traverseNextSibling(element);
+            continue;
+        }
+
+        Element* current = static_cast<Element*>(currentNode);
+
+        // optgroup tags may not nest. However, both FireFox and IE will
+        // flatten the tree automatically, so we follow suit.
+        // (http://www.w3.org/TR/html401/interact/forms.html#h-17.6)
+        if (isOptionGroupElement(current)) {
+            listItems.append(current);
+            if (current->firstChild()) {
+                currentNode = current->firstChild();
+                continue;
+            }
+        }
+
+        if (OptionElement* optionElement = toOptionElement(current)) {
+            listItems.append(current);
+
+            if (updateSelectedStates) {
+                if (!foundSelected && (data.usesMenuList() || (!data.multiple() && optionElement->selected()))) {
+                    foundSelected = optionElement;
+                    foundSelected->setSelectedState(true);
+                } else if (foundSelected && !data.multiple() && optionElement->selected()) {
+                    foundSelected->setSelectedState(false);
+                    foundSelected = optionElement;
+                }
+            }
+        }
+
+        if (current->hasTagName(HTMLNames::hrTag))
+            listItems.append(current);
+
+        // In conforming HTML code, only <optgroup> and <option> will be found
+        // within a <select>. We call traverseNextSibling so that we only step
+        // into those tags that we choose to. For web-compat, we should cope
+        // with the case where odd tags like a <div> have been added but we
+        // handle this because such tags have already been removed from the
+        // <select>'s subtree at this point.
+        currentNode = currentNode->traverseNextSibling(element);
+    }
+
+    data.setShouldRecalcListItems(false);
+}
+
+int SelectElement::selectedIndex(const SelectElementData& data, const Element* element)
+{
+    unsigned index = 0;
+
+    // return the number of the first option selected
+    const Vector<Element*>& items = data.listItems(element);
+    for (size_t i = 0; i < items.size(); ++i) {
+        if (OptionElement* optionElement = toOptionElement(items[i])) {
+            if (optionElement->selected())
+                return index;
+            ++index;
+        }
+    }
+
+    return -1;
+}
+
+void SelectElement::setSelectedIndex(SelectElementData& data, Element* element, int optionIndex, bool deselect, bool fireOnChangeNow, bool userDrivenChange)
+{
+    const Vector<Element*>& items = data.listItems(element);
+    int listIndex = optionToListIndex(data, element, optionIndex);
+    if (!data.multiple())
+        deselect = true;
+
+    Element* excludeElement = 0;
+    if (OptionElement* optionElement = (listIndex >= 0 ? toOptionElement(items[listIndex]) : 0)) {
+        excludeElement = items[listIndex];
+        if (data.activeSelectionAnchorIndex() < 0 || deselect)
+            setActiveSelectionAnchorIndex(data, element, listIndex);
+        if (data.activeSelectionEndIndex() < 0 || deselect)
+            setActiveSelectionEndIndex(data, listIndex);
+        optionElement->setSelectedState(true);
+    }
+
+    if (deselect)
+        deselectItems(data, element, excludeElement);
+
+    // For the menu list case, this is what makes the selected element appear.
+    if (RenderObject* renderer = element->renderer())
+        renderer->updateFromElement();
+
+    scrollToSelection(data, element);
+
+    // This only gets called with fireOnChangeNow for menu lists. 
+    if (data.usesMenuList()) {
+        data.setUserDrivenChange(userDrivenChange);
+        if (fireOnChangeNow)
+            menuListOnChange(data, element);
+    }
+
+    if (Frame* frame = element->document()->frame())
+        frame->page()->chrome()->client()->formStateDidChange(element);
+}
+
+int SelectElement::optionToListIndex(const SelectElementData& data, const Element* element, int optionIndex)
+{
+    const Vector<Element*>& items = data.listItems(element);
+    int listSize = (int) items.size();
+    if (optionIndex < 0 || optionIndex >= listSize)
+        return -1;
+
+    int optionIndex2 = -1;
+    for (int listIndex = 0; listIndex < listSize; ++listIndex) {
+        if (isOptionElement(items[listIndex])) {
+            ++optionIndex2;
+            if (optionIndex2 == optionIndex)
+                return listIndex;
+        }
+    }
+
+    return -1;
+}
+
+int SelectElement::listToOptionIndex(const SelectElementData& data, const Element* element, int listIndex)
+{
+    const Vector<Element*>& items = data.listItems(element);
+    if (listIndex < 0 || listIndex >= int(items.size()) ||
+        !isOptionElement(items[listIndex]))
+        return -1;
+
+    int optionIndex = 0; // actual index of option not counting OPTGROUP entries that may be in list
+    for (int i = 0; i < listIndex; ++i)
+        if (isOptionElement(items[i]))
+            ++optionIndex;
+
+    return optionIndex;
+}
+
+void SelectElement::dispatchFocusEvent(SelectElementData& data, Element* element)
+{
+    // Save the selection so it can be compared to the new selection when dispatching change events during blur event dispatchal
+    if (data.usesMenuList())
+        saveLastSelection(data, element);
+}
+
+void SelectElement::dispatchBlurEvent(SelectElementData& data, Element* element)
+{
+    // We only need to fire change events here for menu lists, because we fire change events for list boxes whenever the selection change is actually made.
+    // This matches other browsers' behavior.
+    if (data.usesMenuList())
+        menuListOnChange(data, element);
+}
+
+void SelectElement::deselectItems(SelectElementData& data, Element* element, Element* excludeElement)
+{
+    const Vector<Element*>& items = data.listItems(element);
+    for (unsigned i = 0; i < items.size(); ++i) {
+        if (items[i] == excludeElement)
+            continue;
+
+        if (OptionElement* optionElement = toOptionElement(items[i]))
+            optionElement->setSelectedState(false);
+    }
+}
+
+bool SelectElement::saveFormControlState(const SelectElementData& data, const Element* element, String& value)
+{
+    const Vector<Element*>& items = data.listItems(element);
+    int length = items.size();
+
+    // FIXME: Change this code to use the new StringImpl::createUninitialized code path.
+    Vector<char, 1024> characters(length);
+    for (int i = 0; i < length; ++i) {
+        OptionElement* optionElement = toOptionElement(items[i]);
+        bool selected = optionElement && optionElement->selected();
+        characters[i] = selected ? 'X' : '.';
+    }
+
+    value = String(characters.data(), length);
+    return true;
+}
+
+void SelectElement::restoreFormControlState(SelectElementData& data, Element* element, const String& state)
+{
+    recalcListItems(data, element);
+
+    const Vector<Element*>& items = data.listItems(element);
+    int length = items.size();
+
+    for (int i = 0; i < length; ++i) {
+        if (OptionElement* optionElement = toOptionElement(items[i]))
+            optionElement->setSelectedState(state[i] == 'X');
+    }
+
+    element->setNeedsStyleRecalc();
+}
+
+void SelectElement::parseMultipleAttribute(SelectElementData& data, Element* element, MappedAttribute* attribute)
+{
+    bool oldUsesMenuList = data.usesMenuList();
+    data.setMultiple(!attribute->isNull());
+    if (oldUsesMenuList != data.usesMenuList() && element->attached()) {
+        element->detach();
+        element->attach();
+    }
+}
+
+bool SelectElement::appendFormData(SelectElementData& data, Element* element, FormDataList& list)
+{
+    const AtomicString& name = element->formControlName();
+    if (name.isEmpty())
+        return false;
+
+    bool successful = false;
+    const Vector<Element*>& items = data.listItems(element);
+
+    for (unsigned i = 0; i < items.size(); ++i) {
+        OptionElement* optionElement = toOptionElement(items[i]);
+        if (optionElement && optionElement->selected()) {
+            list.appendData(name, optionElement->value());
+            successful = true;
+        }
+    }
+
+    // FIXME: This case should not happen. Make sure that we select the first option
+    // in any case, otherwise we have no consistency with the DOM interface.
+    // We return the first one if it was a combobox select
+    if (!successful && !data.multiple() && data.size() <= 1 && items.size()) {
+        OptionElement* optionElement = toOptionElement(items[0]);
+        const AtomicString& value = optionElement->value();
+        if (value.isNull())
+            list.appendData(name, optionElement->text().stripWhiteSpace());
+        else
+            list.appendData(name, value);
+        successful = true;
+    }
+
+    return successful;
+} 
+
+void SelectElement::reset(SelectElementData& data, Element* element)
+{
+    bool optionSelected = false;
+    OptionElement* firstOption = 0;
+
+    const Vector<Element*>& items = data.listItems(element);
+    for (unsigned i = 0; i < items.size(); ++i) {
+        OptionElement* optionElement = toOptionElement(items[i]);
+        if (!optionElement)
+            continue;
+
+        if (!items[i]->getAttribute(HTMLNames::selectedAttr).isNull()) {
+            optionElement->setSelectedState(true);
+            optionSelected = true;
+        } else
+            optionElement->setSelectedState(false);
+
+        if (!firstOption)
+            firstOption = optionElement;
+    }
+
+    if (!optionSelected && firstOption && data.usesMenuList())
+        firstOption->setSelectedState(true);
+
+    element->setNeedsStyleRecalc();
+}
+
+void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element* element, Event* event, HTMLFormElement* htmlForm)
+{
+#if !ARROW_KEYS_POP_MENU
+    UNUSED_PARAM(htmlForm);
+#endif
+
+    if (event->type() == eventNames().keydownEvent) {
+        if (!element->renderer() || !event->isKeyboardEvent())
+            return;
+
+        String keyIdentifier = static_cast<KeyboardEvent*>(event)->keyIdentifier();
+        bool handled = false;
+
+#if ARROW_KEYS_POP_MENU
+        if (keyIdentifier == "Down" || keyIdentifier == "Up") {
+            element->focus();
+            // Save the selection so it can be compared to the new selection when dispatching change events during setSelectedIndex,
+            // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
+            saveLastSelection(data, element);
+            if (RenderMenuList* menuList = static_cast<RenderMenuList*>(element->renderer()))
+                menuList->showPopup();
+            handled = true;
+        }
+#else
+        const Vector<Element*>& listItems = data.listItems(element);
+        int size = listItems.size();
+
+        int listIndex = optionToListIndex(data, element, selectedIndex(data, element));
+        if (keyIdentifier == "Down" || keyIdentifier == "Right") {
+            for (listIndex += 1;
+                 listIndex >= 0 && listIndex < size && (listItems[listIndex]->disabled() || !isOptionElement(listItems[listIndex]));
+                 ++listIndex) { }
+            if (listIndex >= 0 && listIndex < size)
+                setSelectedIndex(data, element, listToOptionIndex(data, element, listIndex));
+            handled = true;
+        } else if (keyIdentifier == "Up" || keyIdentifier == "Left") {
+            for (listIndex -= 1;
+                 listIndex >= 0 && listIndex < size && (listItems[listIndex]->disabled() || !isOptionElement(listItems[listIndex]));
+                 --listIndex) { }
+            if (listIndex >= 0 && listIndex < size)
+                setSelectedIndex(data, element, listToOptionIndex(data, element, listIndex));
+            handled = true;
+        }
+#endif
+        if (handled)
+            event->setDefaultHandled();
+    }
+
+    // Use key press event here since sending simulated mouse events
+    // on key down blocks the proper sending of the key press event.
+    if (event->type() == eventNames().keypressEvent) {
+        if (!element->renderer() || !event->isKeyboardEvent())
+            return;
+
+        int keyCode = static_cast<KeyboardEvent*>(event)->keyCode();
+        bool handled = false;
+
+#if ARROW_KEYS_POP_MENU
+        if (keyCode == ' ') {
+            element->focus();
+            // Save the selection so it can be compared to the new selection when dispatching change events during setSelectedIndex,
+            // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
+            saveLastSelection(data, element);
+            if (RenderMenuList* menuList = static_cast<RenderMenuList*>(element->renderer()))
+                menuList->showPopup();
+            handled = true;
+        } else if (keyCode == '\r') {
+            menuListOnChange(data, element);
+            if (htmlForm)
+                htmlForm->submitClick(event);
+            handled = true;
+        }
+#else
+        int listIndex = optionToListIndex(data, element, selectedIndex(data, element));
+        if (keyCode == '\r') {
+            // listIndex should already be selected, but this will fire the onchange handler.
+            setSelectedIndex(data, element, listToOptionIndex(data, element, listIndex), true, true);
+            handled = true;
+        }
+#endif
+        if (handled)
+            event->setDefaultHandled();
+    }
+
+    if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
+        element->focus();
+        if (RenderMenuList* menuList = static_cast<RenderMenuList*>(element->renderer())) {
+            if (menuList->popupIsVisible())
+                menuList->hidePopup();
+            else {
+                // Save the selection so it can be compared to the new selection when we call onChange during setSelectedIndex,
+                // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
+                saveLastSelection(data, element);
+                menuList->showPopup();
+            }
+        }
+        event->setDefaultHandled();
+    }
+}
+
+void SelectElement::listBoxDefaultEventHandler(SelectElementData& data, Element* element, Event* event, HTMLFormElement* htmlForm)
+{
+    const Vector<Element*>& listItems = data.listItems(element);
+
+    if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
+        element->focus();
+
+        // Convert to coords relative to the list box if needed.
+        MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
+        IntPoint localOffset = roundedIntPoint(element->renderer()->absoluteToLocal(mouseEvent->absoluteLocation(), false, true));
+        int listIndex = static_cast<RenderListBox*>(element->renderer())->listIndexAtOffset(localOffset.x(), localOffset.y());
+        if (listIndex >= 0) {
+            // Save the selection so it can be compared to the new selection when dispatching change events during mouseup, or after autoscroll finishes.
+            saveLastSelection(data, element);
+
+            data.setActiveSelectionState(true);
+            
+            bool multiSelectKeyPressed = false;
+#if PLATFORM(MAC)
+            multiSelectKeyPressed = mouseEvent->metaKey();
+#else
+            multiSelectKeyPressed = mouseEvent->ctrlKey();
+#endif
+
+            bool shiftSelect = data.multiple() && mouseEvent->shiftKey();
+            bool multiSelect = data.multiple() && multiSelectKeyPressed && !mouseEvent->shiftKey();
+
+            Element* clickedElement = listItems[listIndex];            
+            OptionElement* option = toOptionElement(clickedElement);
+            if (option) {
+                // Keep track of whether an active selection (like during drag selection), should select or deselect
+                if (option->selected() && multiSelectKeyPressed)
+                    data.setActiveSelectionState(false);
+
+                if (!data.activeSelectionState())
+                    option->setSelectedState(false);
+            }
+            
+            // If we're not in any special multiple selection mode, then deselect all other items, excluding the clicked option.
+            // If no option was clicked, then this will deselect all items in the list.
+            if (!shiftSelect && !multiSelect)
+                deselectItems(data, element, clickedElement);
+
+            // If the anchor hasn't been set, and we're doing a single selection or a shift selection, then initialize the anchor to the first selected index.
+            if (data.activeSelectionAnchorIndex() < 0 && !multiSelect)
+                setActiveSelectionAnchorIndex(data, element, selectedIndex(data, element));
+
+            // Set the selection state of the clicked option
+            if (option && !clickedElement->disabled())
+                option->setSelectedState(true);
+            
+            // If there was no selectedIndex() for the previous initialization, or
+            // If we're doing a single selection, or a multiple selection (using cmd or ctrl), then initialize the anchor index to the listIndex that just got clicked.
+            if (listIndex >= 0 && (data.activeSelectionAnchorIndex() < 0 || !shiftSelect))
+                setActiveSelectionAnchorIndex(data, element, listIndex);
+            
+            setActiveSelectionEndIndex(data, listIndex);
+            updateListBoxSelection(data, element, !multiSelect);
+
+            if (Frame* frame = element->document()->frame())
+                frame->eventHandler()->setMouseDownMayStartAutoscroll();
+
+            event->setDefaultHandled();
+        }
+    } else if (event->type() == eventNames().mouseupEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton && element->document()->frame()->eventHandler()->autoscrollRenderer() != element->renderer())
+        // This makes sure we fire dispatchFormControlChangeEvent for a single click.  For drag selection, onChange will fire when the autoscroll timer stops.
+        listBoxOnChange(data, element);
+    else if (event->type() == eventNames().keydownEvent) {
+        if (!event->isKeyboardEvent())
+            return;
+        String keyIdentifier = static_cast<KeyboardEvent*>(event)->keyIdentifier();
+
+        int endIndex = 0;        
+        if (data.activeSelectionEndIndex() < 0) {
+            // Initialize the end index
+            if (keyIdentifier == "Down")
+                endIndex = nextSelectableListIndex(data, element, lastSelectedListIndex(data, element));
+            else if (keyIdentifier == "Up")
+                endIndex = previousSelectableListIndex(data, element, optionToListIndex(data, element, selectedIndex(data, element)));
+        } else {
+            // Set the end index based on the current end index
+            if (keyIdentifier == "Down")
+                endIndex = nextSelectableListIndex(data, element, data.activeSelectionEndIndex());
+            else if (keyIdentifier == "Up")
+                endIndex = previousSelectableListIndex(data, element, data.activeSelectionEndIndex());    
+        }
+        
+        if (keyIdentifier == "Down" || keyIdentifier == "Up") {
+            // Save the selection so it can be compared to the new selection when dispatching change events immediately after making the new selection.
+            saveLastSelection(data, element);
+
+            ASSERT(endIndex >= 0 && (unsigned) endIndex < listItems.size()); 
+            setActiveSelectionEndIndex(data, endIndex);
+            
+            // If the anchor is unitialized, or if we're going to deselect all other options, then set the anchor index equal to the end index.
+            bool deselectOthers = !data.multiple() || !static_cast<KeyboardEvent*>(event)->shiftKey();
+            if (data.activeSelectionAnchorIndex() < 0 || deselectOthers) {
+                data.setActiveSelectionState(true);
+                if (deselectOthers)
+                    deselectItems(data, element);
+                setActiveSelectionAnchorIndex(data, element, data.activeSelectionEndIndex());
+            }
+
+            static_cast<RenderListBox*>(element->renderer())->scrollToRevealElementAtListIndex(endIndex);
+            updateListBoxSelection(data, element, deselectOthers);
+            listBoxOnChange(data, element);
+            event->setDefaultHandled();
+        }
+    } else if (event->type() == eventNames().keypressEvent) {
+        if (!event->isKeyboardEvent())
+            return;
+        int keyCode = static_cast<KeyboardEvent*>(event)->keyCode();
+
+        if (keyCode == '\r') {
+            if (htmlForm)
+                htmlForm->submitClick(event);
+            event->setDefaultHandled();
+            return;
+        }
+    }
+}
+
+void SelectElement::defaultEventHandler(SelectElementData& data, Element* element, Event* event, HTMLFormElement* htmlForm)
+{
+    if (!element->renderer())
+        return;
+
+    if (data.usesMenuList())
+        menuListDefaultEventHandler(data, element, event, htmlForm);
+    else 
+        listBoxDefaultEventHandler(data, element, event, htmlForm);
+
+    if (event->defaultHandled())
+        return;
+
+    if (event->type() == eventNames().keypressEvent && event->isKeyboardEvent()) {
+        KeyboardEvent* keyboardEvent = static_cast<KeyboardEvent*>(event);
+        if (!keyboardEvent->ctrlKey() && !keyboardEvent->altKey() && !keyboardEvent->metaKey() && isPrintableChar(keyboardEvent->charCode())) {
+            typeAheadFind(data, element, keyboardEvent);
+            event->setDefaultHandled();
+            return;
+        }
+    }
+}
+
+int SelectElement::lastSelectedListIndex(const SelectElementData& data, const Element* element)
+{
+    // return the number of the last option selected
+    unsigned index = 0;
+    bool found = false;
+    const Vector<Element*>& items = data.listItems(element);
+    for (size_t i = 0; i < items.size(); ++i) {
+        if (OptionElement* optionElement = toOptionElement(items[i])) {
+            if (optionElement->selected()) {
+                index = i;
+                found = true;
+            }
+        }
+    }
+
+    return found ? (int) index : -1;
+}
+
+static String stripLeadingWhiteSpace(const String& string)
+{
+    int length = string.length();
+
+    int i;
+    for (i = 0; i < length; ++i) {
+        if (string[i] != noBreakSpace && (string[i] <= 0x7F ? !isASCIISpace(string[i]) : (direction(string[i]) != WhiteSpaceNeutral)))
+            break;
+    }
+
+    return string.substring(i, length - i);
+}
+
+void SelectElement::typeAheadFind(SelectElementData& data, Element* element, KeyboardEvent* event)
+{
+    if (event->timeStamp() < data.lastCharTime())
+        return;
+
+    DOMTimeStamp delta = event->timeStamp() - data.lastCharTime();
+    data.setLastCharTime(event->timeStamp());
+
+    UChar c = event->charCode();
+
+    String prefix;
+    int searchStartOffset = 1;
+    if (delta > typeAheadTimeout) {
+        prefix = String(&c, 1);
+        data.setTypedString(prefix);
+        data.setRepeatingChar(c);
+    } else {
+        data.typedString().append(c);
+
+        if (c == data.repeatingChar())
+            // The user is likely trying to cycle through all the items starting with this character, so just search on the character
+            prefix = String(&c, 1);
+        else {
+            data.setRepeatingChar(0);
+            prefix = data.typedString();
+            searchStartOffset = 0;
+        }
+    }
+
+    const Vector<Element*>& items = data.listItems(element);
+    int itemCount = items.size();
+    if (itemCount < 1)
+        return;
+
+    int selected = selectedIndex(data, element);
+    int index = (optionToListIndex(data, element, selected >= 0 ? selected : 0) + searchStartOffset) % itemCount;
+    ASSERT(index >= 0);
+
+    for (int i = 0; i < itemCount; ++i, index = (index + 1) % itemCount) {
+        OptionElement* optionElement = toOptionElement(items[index]);
+        if (!optionElement || items[index]->disabled())
+            continue;
+
+        String text = optionElement->textIndentedToRespectGroupLabel();
+        if (stripLeadingWhiteSpace(text).startsWith(prefix, false)) {
+            setSelectedIndex(data, element, listToOptionIndex(data, element, index));
+            if (!data.usesMenuList())
+                listBoxOnChange(data, element);
+            element->setNeedsStyleRecalc();
+            return;
+        }
+    }
+}
+
+void SelectElement::insertedIntoTree(SelectElementData& data, Element* element)
+{
+    // When the element is created during document parsing, it won't have any items yet - but for innerHTML
+    // and related methods, this method is called after the whole subtree is constructed.
+    recalcListItems(data, element, true);
+}
+
+void SelectElement::accessKeySetSelectedIndex(SelectElementData& data, Element* element, int index)
+{    
+    // first bring into focus the list box
+    if (!element->focused())
+        element->accessKeyAction(false);
+    
+    // if this index is already selected, unselect. otherwise update the selected index
+    const Vector<Element*>& items = data.listItems(element);
+    int listIndex = optionToListIndex(data, element, index);
+    if (OptionElement* optionElement = (listIndex >= 0 ? toOptionElement(items[listIndex]) : 0)) {
+        if (optionElement->selected())
+            optionElement->setSelectedState(false);
+        else
+            setSelectedIndex(data, element, index, false, true);
+    }
+ 
+    listBoxOnChange(data, element);
+    scrollToSelection(data, element);
+}
+
+// SelectElementData
+SelectElementData::SelectElementData()
+    : m_multiple(false) 
+    , m_size(0)
+    , m_lastOnChangeIndex(-1)
+    , m_activeSelectionState(false)
+    , m_activeSelectionAnchorIndex(-1)
+    , m_activeSelectionEndIndex(-1)
+    , m_recalcListItems(false)
+    , m_repeatingChar(0)
+    , m_lastCharTime(0)
+{
+}
+
+void SelectElementData::checkListItems(const Element* element) const
+{
+#ifndef NDEBUG
+    const Vector<Element*>& items = m_listItems;
+    SelectElement::recalcListItems(*const_cast<SelectElementData*>(this), element, false);
+    ASSERT(items == m_listItems);
+#else
+    UNUSED_PARAM(element);
+#endif
+}
+
+Vector<Element*>& SelectElementData::listItems(const Element* element)
+{
+    if (m_recalcListItems)
+        SelectElement::recalcListItems(*this, element);
+    else
+        checkListItems(element);
+
+    return m_listItems;
+}
+
+const Vector<Element*>& SelectElementData::listItems(const Element* element) const
+{
+    if (m_recalcListItems)
+        SelectElement::recalcListItems(*const_cast<SelectElementData*>(this), element);
+    else
+        checkListItems(element);
+
+    return m_listItems;
+}
+
+SelectElement* toSelectElement(Element* element)
+{
+    if (element->isHTMLElement()) {
+        if (element->hasTagName(HTMLNames::selectTag))
+            return static_cast<HTMLSelectElement*>(element);
+        if (element->hasTagName(HTMLNames::keygenTag))
+            return static_cast<HTMLKeygenElement*>(element);
+    }
+
+#if ENABLE(WML)
+    if (element->isWMLElement() && element->hasTagName(WMLNames::selectTag))
+        return static_cast<WMLSelectElement*>(element);
+#endif
+
+    return 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/dom/SelectElement.h b/src/3rdparty/webkit/WebCore/dom/SelectElement.h
new file mode 100644
index 0000000..29187ae
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/SelectElement.h
@@ -0,0 +1,181 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http//www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef SelectElement_h
+#define SelectElement_h
+
+#include "Event.h"
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class Element;
+class Event;
+class FormDataList;
+class HTMLFormElement;
+class KeyboardEvent;
+class MappedAttribute;
+class SelectElementData;
+class String;
+
+class SelectElement {
+public:
+    virtual bool multiple() const = 0;
+
+    virtual int size() const = 0;
+    virtual const Vector<Element*>& listItems() const = 0;
+
+    virtual void listBoxOnChange() = 0;
+    virtual void updateListBoxSelection(bool deselectOtherOptions) = 0;
+
+    virtual void menuListOnChange() = 0;
+
+    virtual int activeSelectionStartListIndex() const = 0;
+    virtual int activeSelectionEndListIndex() const = 0;
+
+    virtual void setActiveSelectionAnchorIndex(int index) = 0;
+    virtual void setActiveSelectionEndIndex(int index) = 0;
+
+    virtual int listToOptionIndex(int listIndex) const = 0;
+    virtual int optionToListIndex(int optionIndex) const = 0;
+
+    virtual int selectedIndex() const = 0;
+    virtual void setSelectedIndex(int index, bool deselect = true) = 0;
+    virtual void setSelectedIndexByUser(int index, bool deselect = true, bool fireOnChangeNow = false) = 0;
+
+protected:
+    virtual ~SelectElement() { }
+
+    friend class SelectElementData;
+
+    static void selectAll(SelectElementData&, Element*);
+    static void saveLastSelection(SelectElementData&, Element*);
+    static int nextSelectableListIndex(SelectElementData&, Element*, int startIndex);
+    static int previousSelectableListIndex(SelectElementData&, Element*, int startIndex);
+    static void setActiveSelectionAnchorIndex(SelectElementData&, Element*, int index);
+    static void setActiveSelectionEndIndex(SelectElementData&, int index);
+    static void updateListBoxSelection(SelectElementData&, Element*, bool deselectOtherOptions);
+    static void listBoxOnChange(SelectElementData&, Element*);
+    static void menuListOnChange(SelectElementData&, Element*);
+    static void scrollToSelection(SelectElementData&, Element*);
+    static void recalcStyle(SelectElementData&, Element*);
+    static void setRecalcListItems(SelectElementData&, Element*);
+    static void recalcListItems(SelectElementData&, const Element*, bool updateSelectedStates = true);
+    static int selectedIndex(const SelectElementData&, const Element*);
+    static void setSelectedIndex(SelectElementData&, Element*, int optionIndex, bool deselect = true, bool fireOnChangeNow = false, bool userDrivenChange = true);
+    static int optionToListIndex(const SelectElementData&, const Element*, int optionIndex);
+    static int listToOptionIndex(const SelectElementData&, const Element*, int listIndex);
+    static void dispatchFocusEvent(SelectElementData&, Element*);
+    static void dispatchBlurEvent(SelectElementData&, Element*);
+    static void deselectItems(SelectElementData&, Element*, Element* excludeElement = 0);
+    static bool saveFormControlState(const SelectElementData&, const Element*, String& state);
+    static void restoreFormControlState(SelectElementData&, Element*, const String& state);
+    static void parseMultipleAttribute(SelectElementData&, Element*, MappedAttribute*);
+    static bool appendFormData(SelectElementData&, Element*, FormDataList&);
+    static void reset(SelectElementData&, Element*);
+    static void defaultEventHandler(SelectElementData&, Element*, Event*, HTMLFormElement* = 0);
+    static int lastSelectedListIndex(const SelectElementData&, const Element*);
+    static void typeAheadFind(SelectElementData&, Element*, KeyboardEvent*);
+    static void insertedIntoTree(SelectElementData&, Element*);
+    static void accessKeySetSelectedIndex(SelectElementData&, Element*, int index);
+
+private:
+    static void menuListDefaultEventHandler(SelectElementData&, Element*, Event*, HTMLFormElement*);
+    static void listBoxDefaultEventHandler(SelectElementData&, Element*, Event*, HTMLFormElement*);
+};
+
+// HTML/WMLSelectElement hold this struct as member variable
+// and pass it to the static helper functions in SelectElement
+class SelectElementData {
+public:
+    SelectElementData();
+
+    bool multiple() const { return m_multiple; }
+    void setMultiple(bool value) { m_multiple = value; }
+
+    int size() const { return m_size; }
+    void setSize(int value) { m_size = value; }
+
+    bool usesMenuList() const { return !m_multiple && m_size <= 1; }
+
+    int lastOnChangeIndex() const { return m_lastOnChangeIndex; }
+    void setLastOnChangeIndex(int value) { m_lastOnChangeIndex = value; }
+
+    bool userDrivenChange() const { return m_userDrivenChange; }
+    void setUserDrivenChange(bool value) { m_userDrivenChange = value; }
+
+    Vector<bool>& lastOnChangeSelection() { return m_lastOnChangeSelection; }
+
+    bool activeSelectionState() const { return m_activeSelectionState; }
+    void setActiveSelectionState(bool value) { m_activeSelectionState = value; }
+
+    int activeSelectionAnchorIndex() const { return m_activeSelectionAnchorIndex; }
+    void setActiveSelectionAnchorIndex(int value) { m_activeSelectionAnchorIndex = value; }
+
+    int activeSelectionEndIndex() const { return m_activeSelectionEndIndex; }
+    void setActiveSelectionEndIndex(int value) { m_activeSelectionEndIndex = value; }
+
+    Vector<bool>& cachedStateForActiveSelection() { return m_cachedStateForActiveSelection; }
+
+    bool shouldRecalcListItems() const { return m_recalcListItems; }
+    void setShouldRecalcListItems(bool value) { m_recalcListItems = value; }
+
+    Vector<Element*>& rawListItems() { return m_listItems; }
+    Vector<Element*>& listItems(const Element*);
+    const Vector<Element*>& listItems(const Element*) const;
+
+    UChar repeatingChar() const { return m_repeatingChar; }
+    void setRepeatingChar(const UChar& value) { m_repeatingChar = value; }
+
+    DOMTimeStamp lastCharTime() const { return m_lastCharTime; }
+    void setLastCharTime(const DOMTimeStamp& value) { m_lastCharTime = value; }
+
+    String& typedString() { return m_typedString; }
+    void setTypedString(const String& value) { m_typedString = value; }
+
+private:
+    void checkListItems(const Element*) const;
+
+    bool m_multiple;
+    int m_size;
+
+    int m_lastOnChangeIndex;
+    Vector<bool> m_lastOnChangeSelection;
+    bool m_userDrivenChange;
+
+    bool m_activeSelectionState;
+    int m_activeSelectionAnchorIndex;
+    int m_activeSelectionEndIndex;
+    Vector<bool> m_cachedStateForActiveSelection;
+
+    bool m_recalcListItems;
+    Vector<Element*> m_listItems;
+
+    // Instance variables for type-ahead find
+    UChar m_repeatingChar;
+    DOMTimeStamp m_lastCharTime;
+    String m_typedString;
+};
+
+SelectElement* toSelectElement(Element*);
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/dom/StyleElement.cpp b/src/3rdparty/webkit/WebCore/dom/StyleElement.cpp
index 68c3ec7..a21959d 100644
--- a/src/3rdparty/webkit/WebCore/dom/StyleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/StyleElement.cpp
@@ -61,13 +61,28 @@ void StyleElement::process(Element* e)
     if (!e || !e->inDocument())
         return;
 
-    Vector<UChar> text;
-
-    for (Node* c = e->firstChild(); c; c = c->nextSibling())
-        if (c->nodeType() == Node::TEXT_NODE || c->nodeType() == Node::CDATA_SECTION_NODE || c->nodeType() == Node::COMMENT_NODE)
-            append(text, c->nodeValue());
+    unsigned resultLength = 0;
+    for (Node* c = e->firstChild(); c; c = c->nextSibling()) {
+        Node::NodeType nodeType = c->nodeType();
+        if (nodeType == Node::TEXT_NODE || nodeType == Node::CDATA_SECTION_NODE || nodeType == Node::COMMENT_NODE)
+            resultLength += c->nodeValue().length();
+    }
+    UChar* text;
+    String sheetText = String::createUninitialized(resultLength, text);
+
+    UChar* p = text;
+    for (Node* c = e->firstChild(); c; c = c->nextSibling()) {
+        Node::NodeType nodeType = c->nodeType();
+        if (nodeType == Node::TEXT_NODE || nodeType == Node::CDATA_SECTION_NODE || nodeType == Node::COMMENT_NODE) {
+            String nodeValue = c->nodeValue();
+            unsigned nodeLength = nodeValue.length();
+            memcpy(p, nodeValue.characters(), nodeLength * sizeof(UChar));
+            p += nodeLength;
+        }
+    }
+    ASSERT(p == text + resultLength);
 
-    createSheet(e, String::adopt(text));
+    createSheet(e, sheetText);
 }
 
 void StyleElement::createSheet(Element* e, const String& text)
diff --git a/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp b/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
index d5af1b7..8ddfd31 100644
--- a/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/StyledElement.cpp
@@ -29,6 +29,7 @@
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include <wtf/HashFunctions.h>
 
 using namespace std;
@@ -157,7 +158,7 @@ void StyledElement::attributeChanged(Attribute* attr, bool preserveDecls)
     MappedAttribute* mappedAttr = static_cast<MappedAttribute*>(attr);
     if (mappedAttr->decl() && !preserveDecls) {
         mappedAttr->setDecl(0);
-        setChanged();
+        setNeedsStyleRecalc();
         if (namedAttrMap)
             mappedAttributes()->declRemoved();
     }
@@ -167,7 +168,7 @@ void StyledElement::attributeChanged(Attribute* attr, bool preserveDecls)
     bool needToParse = mapToEntry(attr->name(), entry);
     if (preserveDecls) {
         if (mappedAttr->decl()) {
-            setChanged();
+            setNeedsStyleRecalc();
             if (namedAttrMap)
                 mappedAttributes()->declAdded();
             checkDecl = false;
@@ -177,7 +178,7 @@ void StyledElement::attributeChanged(Attribute* attr, bool preserveDecls)
         CSSMappedAttributeDeclaration* decl = getMappedAttributeDecl(entry, attr);
         if (decl) {
             mappedAttr->setDecl(decl);
-            setChanged();
+            setNeedsStyleRecalc();
             if (namedAttrMap)
                 mappedAttributes()->declAdded();
             checkDecl = false;
@@ -185,11 +186,16 @@ void StyledElement::attributeChanged(Attribute* attr, bool preserveDecls)
             needToParse = true;
     }
 
+    // parseMappedAttribute() might create a CSSMappedAttributeDeclaration on the attribute.  
+    // Normally we would be concerned about reseting the parent of those declarations in StyledElement::didMoveToNewOwnerDocument().
+    // But currently we always clear its parent and node below when adding it to the decl table.  
+    // If that changes for some reason moving between documents will be buggy.
+    // webarchive/adopt-attribute-styled-node-webarchive.html should catch any resulting crashes.
     if (needToParse)
         parseMappedAttribute(mappedAttr);
 
     if (entry == eNone && ownerDocument()->attached() && ownerDocument()->styleSelector()->hasSelectorForAttribute(attr->name().localName()))
-        setChanged();
+        setNeedsStyleRecalc();
 
     if (checkDecl && mappedAttr->decl()) {
         // Add the decl to the table in the appropriate spot.
@@ -227,7 +233,7 @@ void StyledElement::classAttributeChanged(const AtomicString& newClassString)
         else
             mappedAttributes()->clearClass();
     }
-    setChanged();
+    setNeedsStyleRecalc();
     dispatchSubtreeModifiedEvent();
 }
 
@@ -244,7 +250,7 @@ void StyledElement::parseMappedAttribute(MappedAttribute *attr)
             else
                 namedAttrMap->setID(attr->value());
         }
-        setChanged();
+        setNeedsStyleRecalc();
     } else if (attr->name() == classAttr)
         classAttributeChanged(attr->value());
     else if (attr->name() == styleAttr) {
@@ -253,7 +259,7 @@ void StyledElement::parseMappedAttribute(MappedAttribute *attr)
         else
             getInlineStyleDecl()->parseDeclaration(attr->value());
         m_isStyleAttributeValid = true;
-        setChanged();
+        setNeedsStyleRecalc();
     }
 }
 
@@ -502,4 +508,13 @@ void StyledElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
         style->addSubresourceStyleURLs(urls);
 }
 
+
+void StyledElement::didMoveToNewOwnerDocument()
+{
+    if (m_inlineStyleDecl)
+        m_inlineStyleDecl->setParent(document()->elementSheet());
+
+    Element::didMoveToNewOwnerDocument();
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/dom/StyledElement.h b/src/3rdparty/webkit/WebCore/dom/StyledElement.h
index 4ca48e9..158992e 100644
--- a/src/3rdparty/webkit/WebCore/dom/StyledElement.h
+++ b/src/3rdparty/webkit/WebCore/dom/StyledElement.h
@@ -25,12 +25,15 @@
 #ifndef StyledElement_h
 #define StyledElement_h
 
+#include "CSSPrimitiveValue.h"
 #include "Element.h"
+#include "MappedAttributeEntry.h"
 #include "NamedMappedAttrMap.h"
 
 namespace WebCore {
 
 class CSSMappedAttributeDeclaration;
+class CSSMutableStyleDeclaration;
 class MappedAttribute;
 
 class StyledElement : public Element {
@@ -87,6 +90,8 @@ protected:
     // parseMappedAttribute (called via setAttribute()) and
     // svgAttributeChanged (called when element.className.baseValue is set)
     void classAttributeChanged(const AtomicString& newClassString);
+    
+    virtual void didMoveToNewOwnerDocument();
 
     RefPtr<CSSMutableStyleDeclaration> m_inlineStyleDecl;
 };
diff --git a/src/3rdparty/webkit/WebCore/dom/Text.cpp b/src/3rdparty/webkit/WebCore/dom/Text.cpp
index 187e39d..04e499a 100644
--- a/src/3rdparty/webkit/WebCore/dom/Text.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/Text.cpp
@@ -23,13 +23,13 @@
 #include "Text.h"
 
 #include "CString.h"
-#include "Document.h"
 #include "ExceptionCode.h"
 #include "RenderText.h"
 #include "TextBreakIterator.h"
 
 #if ENABLE(SVG)
 #include "RenderSVGInlineText.h"
+#include "SVGNames.h"
 #endif
 
 #if ENABLE(WML)
@@ -42,12 +42,12 @@ namespace WebCore {
 // DOM Section 1.1.1
 
 Text::Text(Document* document, const String& text)
-    : CharacterData(document, text)
+    : CharacterData(document, text, true)
 {
 }
 
 Text::Text(Document* document)
-    : CharacterData(document)
+    : CharacterData(document, true)
 {
 }
 
@@ -81,7 +81,7 @@ PassRefPtr<Text> Text::splitText(unsigned offset, ExceptionCode& ec)
         document()->textNodeSplit(this);
 
     if (renderer())
-        static_cast<RenderText*>(renderer())->setText(m_data);
+        toRenderText(renderer())->setText(m_data);
 
     return newText.release();
 }
@@ -125,17 +125,30 @@ String Text::wholeText() const
     const Text* startText = earliestLogicallyAdjacentTextNode(this);
     const Text* endText = latestLogicallyAdjacentTextNode(this);
 
-    Vector<UChar> result;
     Node* onePastEndText = endText->nextSibling();
+    unsigned resultLength = 0;
     for (const Node* n = startText; n != onePastEndText; n = n->nextSibling()) {
         if (!n->isTextNode())
             continue;
         const Text* t = static_cast<const Text*>(n);
         const String& data = t->data();
-        result.append(data.characters(), data.length());
+        resultLength += data.length();
     }
+    UChar* resultData;
+    String result = String::createUninitialized(resultLength, resultData);
+    UChar* p = resultData;
+    for (const Node* n = startText; n != onePastEndText; n = n->nextSibling()) {
+        if (!n->isTextNode())
+            continue;
+        const Text* t = static_cast<const Text*>(n);
+        const String& data = t->data();
+        unsigned dataLength = data.length();
+        memcpy(p, data.characters(), dataLength * sizeof(UChar));
+        p += dataLength;
+    }
+    ASSERT(p == resultData + resultLength);
 
-    return String::adopt(result);
+    return result;
 }
 
 PassRefPtr<Text> Text::replaceWholeText(const String& newText, ExceptionCode&)
@@ -210,7 +223,7 @@ bool Text::rendererIsNeeded(RenderStyle *style)
     if (prev && prev->isBR()) // <span><br/> <br/></span>
         return false;
         
-    if (par->isInlineFlow()) {
+    if (par->isRenderInline()) {
         // <span><div/> <div/></span>
         if (prev && !prev->isInline())
             return false;
@@ -234,7 +247,11 @@ bool Text::rendererIsNeeded(RenderStyle *style)
 RenderObject *Text::createRenderer(RenderArena* arena, RenderStyle*)
 {
 #if ENABLE(SVG)
-    if (parentNode()->isSVGElement())
+    if (parentNode()->isSVGElement()
+#if ENABLE(SVG_FOREIGN_OBJECT)
+        && !parentNode()->hasTagName(SVGNames::foreignObjectTag)
+#endif
+    )
         return new (arena) RenderSVGInlineText(this, m_data);
 #endif
     
@@ -253,17 +270,17 @@ void Text::recalcStyle(StyleChange change)
         if (renderer())
             renderer()->setStyle(parentNode()->renderer()->style());
     }
-    if (changed()) {
+    if (needsStyleRecalc()) {
         if (renderer()) {
             if (renderer()->isText())
-                static_cast<RenderText*>(renderer())->setText(m_data);
+                toRenderText(renderer())->setText(m_data);
         } else {
             if (attached())
                 detach();
             attach();
         }
     }
-    setChanged(NoStyleChange);
+    setNeedsStyleRecalc(NoStyleChange);
 }
 
 // DOM Section 1.1.1
diff --git a/src/3rdparty/webkit/WebCore/dom/Text.h b/src/3rdparty/webkit/WebCore/dom/Text.h
index 27b1945..5e711d0 100644
--- a/src/3rdparty/webkit/WebCore/dom/Text.h
+++ b/src/3rdparty/webkit/WebCore/dom/Text.h
@@ -51,7 +51,6 @@ public:
 
     // Other methods (not part of DOM)
 
-    virtual bool isTextNode() const { return true; }
     virtual void attach();
     virtual bool rendererIsNeeded(RenderStyle*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
diff --git a/src/3rdparty/webkit/WebCore/dom/Tokenizer.h b/src/3rdparty/webkit/WebCore/dom/Tokenizer.h
index 1ed9484..ea303f9 100644
--- a/src/3rdparty/webkit/WebCore/dom/Tokenizer.h
+++ b/src/3rdparty/webkit/WebCore/dom/Tokenizer.h
@@ -28,6 +28,7 @@
 namespace WebCore {
 
     class SegmentedString;
+    class XSSAuditor;
 
     class Tokenizer {
     public:
@@ -37,7 +38,7 @@ namespace WebCore {
         // received during executing a script must be appended, hence the
         // extra bool to be able to distinguish between both cases.
         // document.write() always uses false, while the loader uses true.
-        virtual bool write(const SegmentedString&, bool appendData) = 0;
+        virtual void write(const SegmentedString&, bool appendData) = 0;
         virtual void finish() = 0;
         virtual bool isWaitingForScripts() const = 0;
         virtual void stopParsing() { m_parserStopped = true; }
@@ -58,11 +59,15 @@ namespace WebCore {
         virtual void executeScriptsWaitingForStylesheets() {}
 
         virtual bool isHTMLTokenizer() const { return false; }
+        
+        XSSAuditor* xssAuditor() const { return m_XSSAuditor; }
+        void setXSSAuditor(XSSAuditor* auditor) { m_XSSAuditor = auditor; }
 
     protected:
         Tokenizer(bool viewSourceMode = false) 
             : m_parserStopped(false)
             , m_inViewSourceMode(viewSourceMode)
+            , m_XSSAuditor(0)
         {
         }
 
@@ -71,6 +76,9 @@ namespace WebCore {
         // even when it has buffered data.
         bool m_parserStopped;
         bool m_inViewSourceMode;
+        
+        // The XSSAuditor associated with this tokenizer.
+        XSSAuditor* m_XSSAuditor;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/TreeWalker.h b/src/3rdparty/webkit/WebCore/dom/TreeWalker.h
index d06acb9..4cc8e9a 100644
--- a/src/3rdparty/webkit/WebCore/dom/TreeWalker.h
+++ b/src/3rdparty/webkit/WebCore/dom/TreeWalker.h
@@ -25,7 +25,6 @@
 #ifndef TreeWalker_h
 #define TreeWalker_h
 
-#include "JSDOMBinding.h"
 #include "NodeFilter.h"
 #include "Traversal.h"
 #include <wtf/PassRefPtr.h>
diff --git a/src/3rdparty/webkit/WebCore/dom/WheelEvent.cpp b/src/3rdparty/webkit/WebCore/dom/WheelEvent.cpp
index a3c806e..2039541 100644
--- a/src/3rdparty/webkit/WebCore/dom/WheelEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/WheelEvent.cpp
@@ -34,20 +34,15 @@ WheelEvent::WheelEvent()
 {
 }
 
-WheelEvent::WheelEvent(float wheelDeltaX, float wheelDeltaY, PassRefPtr<AbstractView> view,
+WheelEvent::WheelEvent(float wheelTicksX, float wheelTicksY, PassRefPtr<AbstractView> view,
                        int screenX, int screenY, int pageX, int pageY,
                        bool ctrlKey, bool altKey, bool shiftKey, bool metaKey)
     : MouseRelatedEvent(eventNames().mousewheelEvent,
                         true, true, view, 0, screenX, screenY, pageX, pageY, 
                         ctrlKey, altKey, shiftKey, metaKey)
-    , m_wheelDeltaX(lroundf(wheelDeltaX) * 120)
-    , m_wheelDeltaY(lroundf(wheelDeltaY) * 120) // Normalize to the Windows 120 multiple
+    , m_wheelDeltaX(lroundf(wheelTicksX * 120))
+    , m_wheelDeltaY(lroundf(wheelTicksY * 120)) // Normalize to the Windows 120 multiple
 {
-    // Rounding delta to zero makes no sense and breaks Google Maps, <http://bugs.webkit.org/show_bug.cgi?id=16078>.
-    if (wheelDeltaX && !m_wheelDeltaX)
-        m_wheelDeltaX = (wheelDeltaX > 0) ? 120 : -120;
-    if (wheelDeltaY && !m_wheelDeltaY)
-        m_wheelDeltaY = (wheelDeltaY > 0) ? 120 : -120;
 }
 
 void WheelEvent::initWheelEvent(int wheelDeltaX, int wheelDeltaY, PassRefPtr<AbstractView> view,
diff --git a/src/3rdparty/webkit/WebCore/dom/WheelEvent.h b/src/3rdparty/webkit/WebCore/dom/WheelEvent.h
index 015796e..04d5421 100644
--- a/src/3rdparty/webkit/WebCore/dom/WheelEvent.h
+++ b/src/3rdparty/webkit/WebCore/dom/WheelEvent.h
@@ -35,11 +35,11 @@ namespace WebCore {
         {
             return adoptRef(new WheelEvent);
         }
-        static PassRefPtr<WheelEvent> create(float wheelDeltaX, float wheelDeltaY, PassRefPtr<AbstractView> view,
+        static PassRefPtr<WheelEvent> create(float wheelTicksX, float wheelTicksY, PassRefPtr<AbstractView> view,
             int screenX, int screenY, int pageX, int pageY,
             bool ctrlKey, bool altKey, bool shiftKey, bool metaKey)
         {
-            return adoptRef(new WheelEvent(wheelDeltaX, wheelDeltaY, view, screenX, screenY, pageX, pageY,
+            return adoptRef(new WheelEvent(wheelTicksX, wheelTicksY, view, screenX, screenY, pageX, pageY,
                 ctrlKey, altKey, shiftKey, metaKey));
         }
 
@@ -56,7 +56,7 @@ namespace WebCore {
 
     private:
         WheelEvent();
-        WheelEvent(float wheelDeltaX, float wheelDeltaY, PassRefPtr<AbstractView>,
+        WheelEvent(float wheelTicksX, float wheelTicksY, PassRefPtr<AbstractView>,
                    int screenX, int screenY, int pageX, int pageY,
                    bool ctrlKey, bool altKey, bool shiftKey, bool metaKey);
 
diff --git a/src/3rdparty/webkit/WebCore/dom/WheelEvent.idl b/src/3rdparty/webkit/WebCore/dom/WheelEvent.idl
index 1445509..4cba4ac 100644
--- a/src/3rdparty/webkit/WebCore/dom/WheelEvent.idl
+++ b/src/3rdparty/webkit/WebCore/dom/WheelEvent.idl
@@ -42,11 +42,11 @@ module events {
         readonly attribute long    x;
         readonly attribute long    y;
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute boolean isHorizontal;
 #endif /* defined(LANGUAGE_OBJECTIVE_C) */
 
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         void initWheelEvent(in long wheelDeltaX,
                             in long wheelDeltaY, 
                             in DOMWindow view, 
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
index c411e50..1747c3c 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.cpp
@@ -39,7 +39,6 @@
 #include "FrameView.h"
 #include "HTMLLinkElement.h"
 #include "HTMLNames.h"
-#include "HTMLScriptElement.h"
 #include "HTMLStyleElement.h"
 #include "ProcessingInstruction.h"
 #include "ResourceError.h"
@@ -47,6 +46,7 @@
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
 #include "ScriptController.h"
+#include "ScriptElement.h"
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "TextResourceDecoder.h"
@@ -57,7 +57,6 @@
 
 #if ENABLE(SVG)
 #include "SVGNames.h"
-#include "SVGScriptElement.h"
 #include "SVGStyleElement.h"
 #endif
 
@@ -65,32 +64,9 @@ using namespace std;
 
 namespace WebCore {
 
-const int maxErrors = 25;
+using namespace HTMLNames;
 
-bool isScriptElement(Element* element)
-{
-    return element->hasTagName(HTMLNames::scriptTag)
-#if ENABLE(SVG)
-        || element->hasTagName(SVGNames::scriptTag)
-#endif
-        ;
-}
-
-ScriptElement* castToScriptElement(Element* element)
-{
-    ASSERT(isScriptElement(element));
-
-    if (element->hasTagName(HTMLNames::scriptTag))
-        return static_cast<HTMLScriptElement*>(element);
-
-#if ENABLE(SVG)
-    if (element->hasTagName(SVGNames::scriptTag))
-        return static_cast<SVGScriptElement*>(element);
-#endif
-
-    ASSERT_NOT_REACHED();
-    return 0;
-}
+const int maxErrors = 25;
 
 #if ENABLE(WML)
 bool XMLTokenizer::isWMLDocument() const
@@ -113,7 +89,7 @@ void XMLTokenizer::setCurrentNode(Node* n)
     m_currentNodeIsReferenced = nodeNeedsReference;
 }
 
-bool XMLTokenizer::write(const SegmentedString& s, bool /*appendData*/)
+void XMLTokenizer::write(const SegmentedString& s, bool /*appendData*/)
 {
     String parseString = s.toString();
     
@@ -121,15 +97,14 @@ bool XMLTokenizer::write(const SegmentedString& s, bool /*appendData*/)
         m_originalSourceForTransform += parseString;
 
     if (m_parserStopped || m_sawXSLTransform)
-        return false;
+        return;
     
     if (m_parserPaused) {
         m_pendingSrc.append(s);
-        return false;
+        return;
     }
     
     doWrite(s.toString());
-    return false;
 }
 
 void XMLTokenizer::handleError(ErrorType type, const char* m, int lineNumber, int columnNumber)
@@ -226,20 +201,20 @@ void XMLTokenizer::finish()
 
 static inline RefPtr<Element> createXHTMLParserErrorHeader(Document* doc, const String& errorMessages) 
 {
-    ExceptionCode ec = 0;
-    RefPtr<Element> reportElement = doc->createElementNS(HTMLNames::xhtmlNamespaceURI, "parsererror", ec);
-    reportElement->setAttribute(HTMLNames::styleAttr, "display: block; white-space: pre; border: 2px solid #c77; padding: 0 1em 0 1em; margin: 1em; background-color: #fdd; color: black");
+    RefPtr<Element> reportElement = doc->createElement(QualifiedName(nullAtom, "parsererror", xhtmlNamespaceURI), false);
+    reportElement->setAttribute(styleAttr, "display: block; white-space: pre; border: 2px solid #c77; padding: 0 1em 0 1em; margin: 1em; background-color: #fdd; color: black");
     
-    RefPtr<Element> h3 = doc->createElementNS(HTMLNames::xhtmlNamespaceURI, "h3", ec);
+    ExceptionCode ec = 0;
+    RefPtr<Element> h3 = doc->createElement(h3Tag, false);
     reportElement->appendChild(h3.get(), ec);
     h3->appendChild(doc->createTextNode("This page contains the following errors:"), ec);
-    
-    RefPtr<Element> fixed = doc->createElementNS(HTMLNames::xhtmlNamespaceURI, "div", ec);
+
+    RefPtr<Element> fixed = doc->createElement(divTag, false);
     reportElement->appendChild(fixed.get(), ec);
-    fixed->setAttribute(HTMLNames::styleAttr, "font-family:monospace;font-size:12px");
+    fixed->setAttribute(styleAttr, "font-family:monospace;font-size:12px");
     fixed->appendChild(doc->createTextNode(errorMessages), ec);
-    
-    h3 = doc->createElementNS(HTMLNames::xhtmlNamespaceURI, "h3", ec);
+
+    h3 = doc->createElement(h3Tag, false);
     reportElement->appendChild(h3.get(), ec);
     h3->appendChild(doc->createTextNode("Below is a rendering of the page up to the first error."), ec);
     
@@ -261,16 +236,16 @@ void XMLTokenizer::insertErrorMessageBlock()
     Document* doc = m_doc;
     Node* documentElement = doc->documentElement();
     if (!documentElement) {
-        RefPtr<Node> rootElement = doc->createElementNS(HTMLNames::xhtmlNamespaceURI, "html", ec);
+        RefPtr<Node> rootElement = doc->createElement(htmlTag, false);
         doc->appendChild(rootElement, ec);
-        RefPtr<Node> body = doc->createElementNS(HTMLNames::xhtmlNamespaceURI, "body", ec);
+        RefPtr<Node> body = doc->createElement(bodyTag, false);
         rootElement->appendChild(body, ec);
         documentElement = body.get();
     }
 #if ENABLE(SVG)
     else if (documentElement->namespaceURI() == SVGNames::svgNamespaceURI) {
-        RefPtr<Node> rootElement = doc->createElementNS(HTMLNames::xhtmlNamespaceURI, "html", ec);
-        RefPtr<Node> body = doc->createElementNS(HTMLNames::xhtmlNamespaceURI, "body", ec);
+        RefPtr<Node> rootElement = doc->createElement(htmlTag, false);
+        RefPtr<Node> body = doc->createElement(bodyTag, false);
         rootElement->appendChild(body, ec);
         body->appendChild(documentElement, ec);
         doc->appendChild(rootElement.get(), ec);
@@ -279,8 +254,8 @@ void XMLTokenizer::insertErrorMessageBlock()
 #endif
 #if ENABLE(WML)
     else if (isWMLDocument()) {
-        RefPtr<Node> rootElement = doc->createElementNS(HTMLNames::xhtmlNamespaceURI, "html", ec);
-        RefPtr<Node> body = doc->createElementNS(HTMLNames::xhtmlNamespaceURI, "body", ec);
+        RefPtr<Node> rootElement = doc->createElement(htmlTag, false);
+        RefPtr<Node> body = doc->createElement(bodyTag, false);
         rootElement->appendChild(body, ec);
         body->appendChild(documentElement, ec);
         doc->appendChild(rootElement.get(), ec);
@@ -292,18 +267,18 @@ void XMLTokenizer::insertErrorMessageBlock()
     documentElement->insertBefore(reportElement, documentElement->firstChild(), ec);
 #if ENABLE(XSLT)
     if (doc->transformSourceDocument()) {
-        RefPtr<Element> par = doc->createElementNS(HTMLNames::xhtmlNamespaceURI, "p", ec);
+        RefPtr<Element> par = doc->createElement(pTag, false);
         reportElement->appendChild(par, ec);
-        par->setAttribute(HTMLNames::styleAttr, "white-space: normal");
+        par->setAttribute(styleAttr, "white-space: normal");
         par->appendChild(doc->createTextNode("This document was created as the result of an XSL transformation. The line and column numbers given are from the transformed result."), ec);
     }
 #endif
-    doc->updateRendering();
+    doc->updateStyleIfNeeded();
 }
 
-void XMLTokenizer::notifyFinished(CachedResource* finishedObj)
+void XMLTokenizer::notifyFinished(CachedResource* unusedResource)
 {
-    ASSERT(m_pendingScript == finishedObj);
+    ASSERT_UNUSED(unusedResource, unusedResource == m_pendingScript);
     ASSERT(m_pendingScript->accessCount() > 0);
         
     ScriptSourceCode sourceCode(m_pendingScript.get());
@@ -315,7 +290,7 @@ void XMLTokenizer::notifyFinished(CachedResource* finishedObj)
     RefPtr<Element> e = m_scriptElement;
     m_scriptElement = 0;
 
-    ScriptElement* scriptElement = castToScriptElement(e.get());
+    ScriptElement* scriptElement = toScriptElement(e.get());
     ASSERT(scriptElement);
 
     if (errorOccurred) 
@@ -345,4 +320,3 @@ void XMLTokenizer::pauseParsing()
 }
 
 }
-
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h
index 6d54eeb..019a831 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizer.h
@@ -3,6 +3,7 @@
  * Copyright (C) 2005, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -60,7 +61,7 @@ namespace WebCore {
         enum ErrorType { warning, nonFatal, fatal };
 
         // from Tokenizer
-        virtual bool write(const SegmentedString&, bool appendData);
+        virtual void write(const SegmentedString&, bool appendData);
         virtual void finish();
         virtual bool isWaitingForScripts() const;
         virtual void stopParsing();
@@ -72,6 +73,10 @@ namespace WebCore {
 
         void setIsXHTMLDocument(bool isXHTML) { m_isXHTMLDocument = isXHTML; }
         bool isXHTMLDocument() const { return m_isXHTMLDocument; }
+#if ENABLE(XHTMLMP)
+        void setIsXHTMLMPDocument(bool isXHTML) { m_isXHTMLMPDocument = isXHTML; }
+        bool isXHTMLMPDocument() const { return m_isXHTMLMPDocument; }
+#endif
 #if ENABLE(WML)
         bool isWMLDocument() const;
 #endif
@@ -149,6 +154,10 @@ public:
         bool m_sawXSLTransform;
         bool m_sawFirstElement;
         bool m_isXHTMLDocument;
+#if ENABLE(XHTMLMP)
+        bool m_isXHTMLMPDocument;
+        bool m_hasDocTypeDeclaration;
+#endif
 
         bool m_parserPaused;
         bool m_requestingScript;
@@ -173,15 +182,11 @@ public:
 
 #if ENABLE(XSLT)
 void* xmlDocPtrForString(DocLoader*, const String& source, const String& url);
-void setLoaderForLibXMLCallbacks(DocLoader*);
 #endif
 
 HashMap<String, String> parseAttributes(const String&, bool& attrsOK);
 bool parseXMLDocumentFragment(const String&, DocumentFragment*, Element* parent = 0);
 
-bool isScriptElement(Element*);
-ScriptElement* castToScriptElement(Element*);
-
 } // namespace WebCore
 
 #endif // XMLTokenizer_h
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
index d0eacdc..4098eaa 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerLibxml2.cpp
@@ -5,7 +5,7 @@
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008 Holger Hans Peter Freyther
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -50,17 +50,24 @@
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
 #include "TextResourceDecoder.h"
+#include "XMLTokenizerScope.h"
 #include <libxml/parser.h>
 #include <libxml/parserInternals.h>
 #include <wtf/Platform.h>
 #include <wtf/StringExtras.h>
 #include <wtf/Threading.h>
+#include <wtf/UnusedParam.h>
 #include <wtf/Vector.h>
 
 #if ENABLE(XSLT)
 #include <libxslt/xslt.h>
 #endif
 
+#if ENABLE(XHTMLMP)
+#include "HTMLNames.h"
+#include "HTMLScriptElement.h"
+#endif
+
 using namespace std;
 
 namespace WebCore {
@@ -81,12 +88,12 @@ public:
         callback->xmlPrefix = xmlStrdup(xmlPrefix);
         callback->xmlURI = xmlStrdup(xmlURI);
         callback->nb_namespaces = nb_namespaces;
-        callback->namespaces = reinterpret_cast<xmlChar**>(xmlMalloc(sizeof(xmlChar*) * nb_namespaces * 2));
+        callback->namespaces = static_cast<xmlChar**>(xmlMalloc(sizeof(xmlChar*) * nb_namespaces * 2));
         for (int i = 0; i < nb_namespaces * 2 ; i++)
             callback->namespaces[i] = xmlStrdup(namespaces[i]);
         callback->nb_attributes = nb_attributes;
         callback->nb_defaulted = nb_defaulted;
-        callback->attributes = reinterpret_cast<xmlChar**>(xmlMalloc(sizeof(xmlChar*) * nb_attributes * 5));
+        callback->attributes = static_cast<xmlChar**>(xmlMalloc(sizeof(xmlChar*) * nb_attributes * 5));
         for (int i = 0; i < nb_attributes; i++) {
             // Each attribute has 5 elements in the array:
             // name, prefix, uri, value and an end pointer.
@@ -203,8 +210,8 @@ private:
         
         virtual void call(XMLTokenizer* tokenizer) {
             tokenizer->startElementNs(xmlLocalName, xmlPrefix, xmlURI, 
-                                      nb_namespaces, (const xmlChar**)namespaces,
-                                      nb_attributes, nb_defaulted, (const xmlChar**)(attributes));
+                                      nb_namespaces, const_cast<const xmlChar**>(namespaces),
+                                      nb_attributes, nb_defaulted, const_cast<const xmlChar**>(attributes));
         }
 
         xmlChar* xmlLocalName;
@@ -324,14 +331,13 @@ private:
 // --------------------------------
 
 static int globalDescriptor = 0;
-static DocLoader* globalDocLoader = 0;
 static ThreadIdentifier libxmlLoaderThread = 0;
 
 static int matchFunc(const char*)
 {
     // Only match loads initiated due to uses of libxml2 from within XMLTokenizer to avoid
     // interfering with client applications that also use libxml2.  http://bugs.webkit.org/show_bug.cgi?id=17353
-    return globalDocLoader && currentThread() == libxmlLoaderThread;
+    return XMLTokenizerScope::currentDocLoader && currentThread() == libxmlLoaderThread;
 }
 
 class OffsetBuffer {
@@ -381,8 +387,8 @@ static bool shouldAllowExternalLoad(const KURL& url)
     // retrieved content.  If we had more context, we could potentially allow
     // the parser to load a DTD.  As things stand, we take the conservative
     // route and allow same-origin requests only.
-    if (!globalDocLoader->doc()->securityOrigin()->canRequest(url)) {
-        globalDocLoader->printAccessDeniedMessage(url);
+    if (!XMLTokenizerScope::currentDocLoader->doc()->securityOrigin()->canRequest(url)) {
+        XMLTokenizerScope::currentDocLoader->printAccessDeniedMessage(url);
         return false;
     }
 
@@ -391,10 +397,10 @@ static bool shouldAllowExternalLoad(const KURL& url)
 
 static void* openFunc(const char* uri)
 {
-    ASSERT(globalDocLoader);
+    ASSERT(XMLTokenizerScope::currentDocLoader);
     ASSERT(currentThread() == libxmlLoaderThread);
 
-    KURL url(uri);
+    KURL url(KURL(), uri);
 
     if (!shouldAllowExternalLoad(url))
         return &globalDescriptor;
@@ -402,15 +408,16 @@ static void* openFunc(const char* uri)
     ResourceError error;
     ResourceResponse response;
     Vector<char> data;
-    
-    DocLoader* docLoader = globalDocLoader;
-    globalDocLoader = 0;
-    // FIXME: We should restore the original global error handler as well.
 
-    if (docLoader->frame()) 
-        docLoader->frame()->loader()->loadResourceSynchronously(url, error, response, data);
 
-    globalDocLoader = docLoader;
+    {
+        DocLoader* docLoader = XMLTokenizerScope::currentDocLoader;
+        XMLTokenizerScope scope(0);
+        // FIXME: We should restore the original global error handler as well.
+
+        if (docLoader->frame()) 
+            docLoader->frame()->loader()->loadResourceSynchronously(url, AllowStoredCredentials, error, response, data);
+    }
 
     // We have to check the URL again after the load to catch redirects.
     // See <https://bugs.webkit.org/show_bug.cgi?id=21963>.
@@ -452,11 +459,6 @@ static void errorFunc(void*, const char*, ...)
 }
 #endif
 
-void setLoaderForLibXMLCallbacks(DocLoader* docLoader)
-{
-    globalDocLoader = docLoader;
-}
-
 static bool didInit = false;
 
 static xmlParserCtxtPtr createStringParser(xmlSAXHandlerPtr handlers, void* userData)
@@ -529,6 +531,10 @@ XMLTokenizer::XMLTokenizer(Document* _doc, FrameView* _view)
     , m_sawXSLTransform(false)
     , m_sawFirstElement(false)
     , m_isXHTMLDocument(false)
+#if ENABLE(XHTMLMP)
+    , m_isXHTMLMPDocument(false)
+    , m_hasDocTypeDeclaration(false)
+#endif
     , m_parserPaused(false)
     , m_requestingScript(false)
     , m_finishCalled(false)
@@ -552,6 +558,10 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     , m_sawXSLTransform(false)
     , m_sawFirstElement(false)
     , m_isXHTMLDocument(false)
+#if ENABLE(XHTMLMP)
+    , m_isXHTMLMPDocument(false)
+    , m_hasDocTypeDeclaration(false)
+#endif
     , m_parserPaused(false)
     , m_requestingScript(false)
     , m_finishCalled(false)
@@ -582,7 +592,7 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
         return;
     
     for (Element* element = elemStack.last(); !elemStack.isEmpty(); elemStack.removeLast()) {
-        if (NamedAttrMap* attrs = element->attributes()) {
+        if (NamedNodeMap* attrs = element->attributes()) {
             for (unsigned i = 0; i < attrs->length(); i++) {
                 Attribute* attr = attrs->attributeItem(i);
                 if (attr->localName() == "xmlns")
@@ -624,6 +634,7 @@ void XMLTokenizer::doWrite(const String& parseString)
         const unsigned char BOMHighByte = *reinterpret_cast<const unsigned char*>(&BOM);
         xmlSwitchEncoding(m_context, BOMHighByte == 0xFF ? XML_CHAR_ENCODING_UTF16LE : XML_CHAR_ENCODING_UTF16BE);
 
+        XMLTokenizerScope scope(m_doc->docLoader());
         xmlParseChunk(m_context, reinterpret_cast<const char*>(parseString.characters()), sizeof(UChar) * parseString.length(), 0);
     }
     
@@ -705,8 +716,14 @@ void XMLTokenizer::startElementNs(const xmlChar* xmlLocalName, const xmlChar* xm
                                                          nb_attributes, nb_defaulted, libxmlAttributes);
         return;
     }
-    
-    m_sawFirstElement = true;
+
+#if ENABLE(XHTMLMP) 
+    // check if the DOCTYPE Declaration of XHTMLMP document exists
+    if (!m_hasDocTypeDeclaration && m_doc->isXHTMLMPDocument()) {
+        handleError(fatal, "DOCTYPE declaration lost.", lineNumber(), columnNumber());
+        return;
+    }
+#endif
 
     exitText();
 
@@ -721,14 +738,35 @@ void XMLTokenizer::startElementNs(const xmlChar* xmlLocalName, const xmlChar* xm
             uri = m_defaultNamespaceURI;
     }
 
-    ExceptionCode ec = 0;
+#if ENABLE(XHTMLMP)
+    if (!m_sawFirstElement && isXHTMLMPDocument()) {
+        // As per the section 7.1 of OMA-WAP-XHTMLMP-V1_1-20061020-A.pdf, 
+        // we should make sure that the root element MUST be 'html' and 
+        // ensure the name of the default namespace on the root elment 'html' 
+        // MUST be 'http://www.w3.org/1999/xhtml'
+        if (localName != HTMLNames::htmlTag.localName()) {
+            handleError(fatal, "XHTMLMP document expects 'html' as root element.", lineNumber(), columnNumber());
+            return;
+        }
+
+        if (uri.isNull()) {
+            m_defaultNamespaceURI = HTMLNames::xhtmlNamespaceURI; 
+            uri = m_defaultNamespaceURI;
+        }
+    }
+#endif
+
+    bool isFirstElement = !m_sawFirstElement;
+    m_sawFirstElement = true;
+
     QualifiedName qName(prefix, localName, uri);
-    RefPtr<Element> newElement = m_doc->createElement(qName, true, ec);
+    RefPtr<Element> newElement = m_doc->createElement(qName, true);
     if (!newElement) {
         stopParsing();
         return;
     }
     
+    ExceptionCode ec = 0;
     handleElementNamespaces(newElement.get(), libxmlNamespaces, nb_namespaces, ec);
     if (ec) {
         stopParsing();
@@ -737,7 +775,7 @@ void XMLTokenizer::startElementNs(const xmlChar* xmlLocalName, const xmlChar* xm
 
     ScriptController* jsProxy = m_doc->frame() ? m_doc->frame()->script() : 0;
     if (jsProxy && m_doc->frame()->script()->isEnabled())
-        jsProxy->setEventHandlerLineno(lineNumber());
+        jsProxy->setEventHandlerLineNumber(lineNumber());
 
     handleElementAttributes(newElement.get(), libxmlAttributes, nb_attributes, ec);
     if (ec) {
@@ -746,11 +784,12 @@ void XMLTokenizer::startElementNs(const xmlChar* xmlLocalName, const xmlChar* xm
     }
 
     if (jsProxy)
-        jsProxy->setEventHandlerLineno(0);
+        jsProxy->setEventHandlerLineNumber(0);
 
     newElement->beginParsingChildren();
 
-    if (isScriptElement(newElement.get()))
+    ScriptElement* scriptElement = toScriptElement(newElement.get());
+    if (scriptElement)
         m_scriptStartLine = lineNumber();
 
     if (!m_currentNode->addChild(newElement.get())) {
@@ -761,6 +800,9 @@ void XMLTokenizer::startElementNs(const xmlChar* xmlLocalName, const xmlChar* xm
     setCurrentNode(newElement.get());
     if (m_view && !newElement->attached())
         newElement->attach();
+
+    if (isFirstElement && m_doc->frame())
+        m_doc->frame()->loader()->dispatchDocumentElementAvailable();
 }
 
 void XMLTokenizer::endElementNs()
@@ -778,15 +820,29 @@ void XMLTokenizer::endElementNs()
     Node* n = m_currentNode;
     RefPtr<Node> parent = n->parentNode();
     n->finishParsingChildren();
-    
-    // don't load external scripts for standalone documents (for now)
-    if (n->isElementNode() && m_view && isScriptElement(static_cast<Element*>(n))) {
-        ASSERT(!m_pendingScript);
-        m_requestingScript = true;
 
-        Element* element = static_cast<Element*>(n); 
-        ScriptElement* scriptElement = castToScriptElement(element);
+    if (!n->isElementNode() || !m_view) {
+        setCurrentNode(parent.get());
+        return;
+    }
+
+    Element* element = static_cast<Element*>(n);
+    ScriptElement* scriptElement = toScriptElement(element);
+    if (!scriptElement) {
+        setCurrentNode(parent.get());
+        return;
+    }
 
+    // don't load external scripts for standalone documents (for now)
+    ASSERT(!m_pendingScript);
+    m_requestingScript = true;
+
+#if ENABLE(XHTMLMP)
+    if (!scriptElement->shouldExecuteAsJavaScript())
+        m_doc->setShouldProcessNoscriptElement(true);
+    else 
+#endif
+    {
         String scriptHref = scriptElement->sourceAttributeValue();
         if (!scriptHref.isEmpty()) {
             // we have a src attribute 
@@ -802,10 +858,8 @@ void XMLTokenizer::endElementNs()
                 m_scriptElement = 0;
         } else
             m_view->frame()->loader()->executeScript(ScriptSourceCode(scriptElement->scriptContent(), m_doc->url(), m_scriptStartLine));
-
-        m_requestingScript = false;
     }
-
+    m_requestingScript = false;
     setCurrentNode(parent.get());
 }
 
@@ -833,7 +887,8 @@ void XMLTokenizer::error(ErrorType type, const char* message, va_list args)
     vsnprintf(m, sizeof(m) - 1, message, args);
 #else
     char* m;
-    vasprintf(&m, message, args);
+    if (vasprintf(&m, message, args) == -1)
+        return;
 #endif
     
     if (m_parserPaused)
@@ -932,6 +987,9 @@ void XMLTokenizer::startDocument(const xmlChar* version, const xmlChar* encoding
 void XMLTokenizer::endDocument()
 {
     exitText();
+#if ENABLE(XHTMLMP)
+    m_hasDocTypeDeclaration = false;
+#endif
 }
 
 void XMLTokenizer::internalSubset(const xmlChar* name, const xmlChar* externalID, const xmlChar* systemID)
@@ -945,8 +1003,10 @@ void XMLTokenizer::internalSubset(const xmlChar* name, const xmlChar* externalID
     }
     
     if (m_doc) {
-#if ENABLE(WML)
+#if ENABLE(WML) || ENABLE(XHTMLMP)
         String extId = toString(externalID);
+#endif
+#if ENABLE(WML)
         if (isWMLDocument()
             && extId != "-//WAPFORUM//DTD WML 1.3//EN"
             && extId != "-//WAPFORUM//DTD WML 1.2//EN"
@@ -954,8 +1014,31 @@ void XMLTokenizer::internalSubset(const xmlChar* name, const xmlChar* externalID
             && extId != "-//WAPFORUM//DTD WML 1.0//EN")
             handleError(fatal, "Invalid DTD Public ID", lineNumber(), columnNumber());
 #endif
+#if ENABLE(XHTMLMP)
+        String dtdName = toString(name);
+        if (extId == "-//WAPFORUM//DTD XHTML Mobile 1.0//EN"
+            || extId == "-//WAPFORUM//DTD XHTML Mobile 1.1//EN") {
+            if (dtdName != HTMLNames::htmlTag.localName()) {
+                handleError(fatal, "Invalid DOCTYPE declaration, expected 'html' as root element.", lineNumber(), columnNumber());
+                return;
+            } 
+
+            if (m_doc->isXHTMLMPDocument())
+                setIsXHTMLMPDocument(true);
+            else
+                setIsXHTMLDocument(true);
+
+            m_hasDocTypeDeclaration = true;
+        }
+#endif
 
+#if ENABLE(XHTMLMP)
+        m_doc->addChild(DocumentType::create(m_doc, dtdName, extId, toString(systemID)));
+#elif ENABLE(WML)
+        m_doc->addChild(DocumentType::create(m_doc, toString(name), extId, toString(systemID)));
+#else
         m_doc->addChild(DocumentType::create(m_doc, toString(name), toString(externalID), toString(systemID)));
+#endif
     }
 }
 
@@ -970,6 +1053,8 @@ static inline XMLTokenizer* getTokenizer(void* closure)
 static inline bool hackAroundLibXMLEntityBug(void* closure)
 {
 #if LIBXML_VERSION >= 20627
+    UNUSED_PARAM(closure);
+
     // This bug has been fixed in libxml 2.6.27.
     return false;
 #else
@@ -1052,19 +1137,22 @@ static void normalErrorHandler(void* closure, const char* message, ...)
     va_end(args);
 }
 
-// Using a global variable entity and marking it XML_INTERNAL_PREDEFINED_ENTITY is
+// Using a static entity and marking it XML_INTERNAL_PREDEFINED_ENTITY is
 // a hack to avoid malloc/free. Using a global variable like this could cause trouble
 // if libxml implementation details were to change
-static xmlChar sharedXHTMLEntityResult[5] = {0,0,0,0,0};
-static xmlEntity sharedXHTMLEntity = {
-    0, XML_ENTITY_DECL, 0, 0, 0, 0, 0, 0, 0, 
-    sharedXHTMLEntityResult, sharedXHTMLEntityResult, 0,
-    XML_INTERNAL_PREDEFINED_ENTITY, 0, 0, 0, 0, 0,
-#if LIBXML_VERSION >= 20627
-    // xmlEntity gained an extra member in 2.6.27.
-    1
-#endif
-};
+static xmlChar sharedXHTMLEntityResult[5] = {0, 0, 0, 0, 0};
+
+static xmlEntityPtr sharedXHTMLEntity()
+{
+    static xmlEntity entity;
+    if (!entity.type) {
+        entity.type = XML_ENTITY_DECL;
+        entity.orig = sharedXHTMLEntityResult;
+        entity.content = sharedXHTMLEntityResult;
+        entity.etype = XML_INTERNAL_PREDEFINED_ENTITY;
+    }
+    return &entity;
+}
 
 static xmlEntityPtr getXHTMLEntity(const xmlChar* name)
 {
@@ -1074,11 +1162,12 @@ static xmlEntityPtr getXHTMLEntity(const xmlChar* name)
 
     CString value = String(&c, 1).utf8();
     ASSERT(value.length() < 5);
-    sharedXHTMLEntity.length = value.length();
-    sharedXHTMLEntity.name = name;
-    memcpy(sharedXHTMLEntityResult, value.data(), sharedXHTMLEntity.length + 1);
+    xmlEntityPtr entity = sharedXHTMLEntity();
+    entity->length = value.length();
+    entity->name = name;
+    memcpy(sharedXHTMLEntityResult, value.data(), entity->length + 1);
 
-    return &sharedXHTMLEntity;
+    return entity;
 }
 
 static xmlEntityPtr getEntityHandler(void* closure, const xmlChar* name)
@@ -1092,6 +1181,9 @@ static xmlEntityPtr getEntityHandler(void* closure, const xmlChar* name)
 
     ent = xmlGetDocEntity(ctxt->myDoc, name);
     if (!ent && (getTokenizer(closure)->isXHTMLDocument()
+#if ENABLE(XHTMLMP)
+                 || getTokenizer(closure)->isXHTMLMPDocument()
+#endif
 #if ENABLE(WML)
                  || getTokenizer(closure)->isWMLDocument()
 #endif
@@ -1133,7 +1225,10 @@ static void externalSubsetHandler(void* closure, const xmlChar*, const xmlChar*
         || (extId == "-//W3C//DTD XHTML Basic 1.0//EN")
         || (extId == "-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN")
         || (extId == "-//W3C//DTD XHTML 1.1 plus MathML 2.0 plus SVG 1.1//EN")
-        || (extId == "-//WAPFORUM//DTD XHTML Mobile 1.0//EN"))
+#if !ENABLE(XHTMLMP)
+        || (extId == "-//WAPFORUM//DTD XHTML Mobile 1.0//EN")
+#endif
+       )
         getTokenizer(closure)->setIsXHTMLDocument(true); // controls if we replace entities or not.
 }
 
@@ -1171,6 +1266,7 @@ void XMLTokenizer::initializeParserContext(const char* chunk)
     m_sawXSLTransform = false;
     m_sawFirstElement = false;
 
+    XMLTokenizerScope scope(m_doc->docLoader());
     if (m_parsingFragment)
         m_context = createMemoryParser(&sax, this, chunk);
     else
@@ -1192,8 +1288,11 @@ void XMLTokenizer::doEnd()
 
     if (m_context) {
         // Tell libxml we're done.
-        xmlParseChunk(m_context, 0, 0, 1);
-        
+        {
+            XMLTokenizerScope scope(m_doc->docLoader());
+            xmlParseChunk(m_context, 0, 0, 1);
+        }
+
         if (m_context->myDoc)
             xmlFreeDoc(m_context->myDoc);
         xmlFreeParserCtxt(m_context);
@@ -1213,21 +1312,12 @@ void* xmlDocPtrForString(DocLoader* docLoader, const String& source, const Strin
     const UChar BOM = 0xFEFF;
     const unsigned char BOMHighByte = *reinterpret_cast<const unsigned char*>(&BOM);
 
-    xmlGenericErrorFunc oldErrorFunc = xmlGenericError;
-    void* oldErrorContext = xmlGenericErrorContext;
-    
-    setLoaderForLibXMLCallbacks(docLoader);        
-    xmlSetGenericErrorFunc(0, errorFunc);
-    
+    XMLTokenizerScope scope(docLoader, errorFunc, 0);
     xmlDocPtr sourceDoc = xmlReadMemory(reinterpret_cast<const char*>(source.characters()),
                                         source.length() * sizeof(UChar),
                                         url.latin1().data(),
                                         BOMHighByte == 0xFF ? "UTF-16LE" : "UTF-16BE", 
                                         XSLT_PARSE_OPTIONS);
-    
-    setLoaderForLibXMLCallbacks(0);
-    xmlSetGenericErrorFunc(oldErrorContext, oldErrorFunc);
-    
     return sourceDoc;
 }
 #endif
@@ -1281,7 +1371,8 @@ bool parseXMLDocumentFragment(const String& chunk, DocumentFragment* fragment, E
 
     XMLTokenizer tokenizer(fragment, parent);
     
-    tokenizer.initializeParserContext(chunk.utf8().data());
+    CString chunkAsUtf8 = chunk.utf8();
+    tokenizer.initializeParserContext(chunkAsUtf8.data());
 
     xmlParseContent(tokenizer.m_context);
 
@@ -1289,7 +1380,7 @@ bool parseXMLDocumentFragment(const String& chunk, DocumentFragment* fragment, E
 
     // Check if all the chunk has been processed.
     long bytesProcessed = xmlByteConsumed(tokenizer.m_context);
-    if (bytesProcessed == -1 || ((unsigned long)bytesProcessed) == sizeof(UChar) * chunk.length())
+    if (bytesProcessed == -1 || ((unsigned long)bytesProcessed) != chunkAsUtf8.length())
         return false;
 
     // No error if the chunk is well formed or it is not but we have no error.
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
index 39ccefe..3173708 100644
--- a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerQt.cpp
@@ -5,7 +5,7 @@
  * Copyright (C) 2007 Samuel Weinig (sam@webkit.org)
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008 Holger Hans Peter Freyther
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -56,6 +56,11 @@
 #include <wtf/Threading.h>
 #include <wtf/Vector.h>
 
+#if ENABLE(XHTMLMP)
+#include "HTMLNames.h"
+#include "HTMLScriptElement.h"
+#endif
+
 using namespace std;
 
 namespace WebCore {
@@ -85,6 +90,10 @@ XMLTokenizer::XMLTokenizer(Document* _doc, FrameView* _view)
     , m_sawXSLTransform(false)
     , m_sawFirstElement(false)
     , m_isXHTMLDocument(false)
+#if ENABLE(XHTMLMP)
+    , m_isXHTMLMPDocument(false)
+    , m_hasDocTypeDeclaration(false)
+#endif
     , m_parserPaused(false)
     , m_requestingScript(false)
     , m_finishCalled(false)
@@ -110,6 +119,10 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     , m_sawXSLTransform(false)
     , m_sawFirstElement(false)
     , m_isXHTMLDocument(false)
+#if ENABLE(XHTMLMP)
+    , m_isXHTMLMPDocument(false)
+    , m_hasDocTypeDeclaration(false)
+#endif
     , m_parserPaused(false)
     , m_requestingScript(false)
     , m_finishCalled(false)
@@ -141,7 +154,7 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
     
 #if QT_VERSION < 0x040400
     for (Element* element = elemStack.last(); !elemStack.isEmpty(); elemStack.removeLast()) {
-        if (NamedAttrMap* attrs = element->attributes()) {
+        if (NamedNodeMap* attrs = element->attributes()) {
             for (unsigned i = 0; i < attrs->length(); i++) {
                 Attribute* attr = attrs->attributeItem(i);
                 if (attr->localName() == "xmlns")
@@ -154,7 +167,7 @@ XMLTokenizer::XMLTokenizer(DocumentFragment* fragment, Element* parentElement)
 #else
     QXmlStreamNamespaceDeclarations namespaces;
     for (Element* element = elemStack.last(); !elemStack.isEmpty(); elemStack.removeLast()) {
-        if (NamedAttrMap* attrs = element->attributes()) {
+        if (NamedNodeMap* attrs = element->attributes()) {
             for (unsigned i = 0; i < attrs->length(); i++) {
                 Attribute* attr = attrs->attributeItem(i);
                 if (attr->localName() == "xmlns")
@@ -357,7 +370,7 @@ HashMap<String, String> parseAttributes(const String& string, bool& attrsOK)
     state.gotAttributes = false;
 
     QXmlStreamReader stream;
-    QString dummy = QString::fromLatin1("<?xml version=\"1.0\"?><attrs %1 />").arg(string);
+    QString dummy = QString(QLatin1String("<?xml version=\"1.0\"?><attrs %1 />")).arg(string);
     stream.addData(dummy);
     while (!stream.atEnd()) {
         stream.readNext();
@@ -419,6 +432,12 @@ void XMLTokenizer::parse()
         }
             break;
         case QXmlStreamReader::StartElement: {
+#if ENABLE(XHTMLMP)
+            if (m_doc->isXHTMLMPDocument() && !m_hasDocTypeDeclaration) {
+                handleError(fatal, "DOCTYPE declaration lost.", lineNumber(), columnNumber());
+                break;
+            }
+#endif 
             parseStartElement();
         }
             break;
@@ -443,12 +462,18 @@ void XMLTokenizer::parse()
         case QXmlStreamReader::DTD: {
             //qDebug()<<"------------- DTD";
             parseDtd();
+#if ENABLE(XHTMLMP)
+            m_hasDocTypeDeclaration = true;
+#endif
         }
             break;
         case QXmlStreamReader::EntityReference: {
             //qDebug()<<"---------- ENTITY = "<<m_stream.name().toString()
             //        <<", t = "<<m_stream.text().toString();
             if (isXHTMLDocument()
+#if ENABLE(XHTMLMP)
+                || isXHTMLMPDocument()
+#endif
 #if ENABLE(WML)
                 || isWMLDocument()
 #endif
@@ -507,7 +532,6 @@ void XMLTokenizer::parseStartElement()
         m_sawFirstElement = true;
         return;
     }
-    m_sawFirstElement = true;
 
     exitText();
 
@@ -520,14 +544,36 @@ void XMLTokenizer::parseStartElement()
         uri = m_defaultNamespaceURI;
     }
 
-    ExceptionCode ec = 0;
     QualifiedName qName(prefix, localName, uri);
-    RefPtr<Element> newElement = m_doc->createElement(qName, true, ec);
+    RefPtr<Element> newElement = m_doc->createElement(qName, true);
     if (!newElement) {
         stopParsing();
         return;
     }
 
+#if ENABLE(XHTMLMP)
+    if (!m_sawFirstElement && isXHTMLMPDocument()) {
+        // As per 7.1 section of OMA-WAP-XHTMLMP-V1_1-20061020-A.pdf, 
+        // we should make sure that the root element MUST be 'html' and 
+        // ensure the name of the default namespace on the root elment 'html' 
+        // MUST be 'http://www.w3.org/1999/xhtml'
+        if (localName != HTMLNames::htmlTag.localName()) {
+            handleError(fatal, "XHTMLMP document expects 'html' as root element.", lineNumber(), columnNumber());
+            return;
+        } 
+
+        if (uri.isNull()) {
+            m_defaultNamespaceURI = HTMLNames::xhtmlNamespaceURI; 
+            uri = m_defaultNamespaceURI;
+            m_stream.addExtraNamespaceDeclaration(QXmlStreamNamespaceDeclaration(prefix, HTMLNames::xhtmlNamespaceURI));
+        }
+    }
+#endif
+
+    bool isFirstElement = !m_sawFirstElement;
+    m_sawFirstElement = true;
+
+    ExceptionCode ec = 0;
     handleElementNamespaces(newElement.get(), m_stream.namespaceDeclarations(), ec);
     if (ec) {
         stopParsing();
@@ -540,7 +586,8 @@ void XMLTokenizer::parseStartElement()
         return;
     }
 
-    if (isScriptElement(newElement.get()))
+    ScriptElement* scriptElement = toScriptElement(newElement.get());
+    if (scriptElement)
         m_scriptStartLine = lineNumber();
 
     if (!m_currentNode->addChild(newElement.get())) {
@@ -551,6 +598,9 @@ void XMLTokenizer::parseStartElement()
     setCurrentNode(newElement.get());
     if (m_view && !newElement->attached())
         newElement->attach();
+
+    if (isFirstElement && m_doc->frame())
+        m_doc->frame()->loader()->dispatchDocumentElementAvailable();
 }
 
 void XMLTokenizer::parseEndElement()
@@ -561,17 +611,31 @@ void XMLTokenizer::parseEndElement()
     RefPtr<Node> parent = n->parentNode();
     n->finishParsingChildren();
 
-    // don't load external scripts for standalone documents (for now)
-    if (n->isElementNode() && m_view && isScriptElement(static_cast<Element*>(n))) {
-        ASSERT(!m_pendingScript);
-        m_requestingScript = true;
+    if (!n->isElementNode() || !m_view) {
+        setCurrentNode(parent.get());
+        return;
+    }
 
-        Element* element = static_cast<Element*>(n); 
-        ScriptElement* scriptElement = castToScriptElement(element);
+    Element* element = static_cast<Element*>(n);
+    ScriptElement* scriptElement = toScriptElement(element);
+    if (!scriptElement) {
+        setCurrentNode(parent.get());
+        return;
+    }
+
+    // don't load external scripts for standalone documents (for now)
+    ASSERT(!m_pendingScript);
+    m_requestingScript = true;
 
+#if ENABLE(XHTMLMP)
+    if (!scriptElement->shouldExecuteAsJavaScript())
+        m_doc->setShouldProcessNoscriptElement(true);
+    else
+#endif
+    {
         String scriptHref = scriptElement->sourceAttributeValue();
         if (!scriptHref.isEmpty()) {
-            // we have a src attribute
+            // we have a src attribute 
             String scriptCharset = scriptElement->scriptCharset();
             if ((m_pendingScript = m_doc->docLoader()->requestScript(scriptHref, scriptCharset))) {
                 m_scriptElement = element;
@@ -580,14 +644,12 @@ void XMLTokenizer::parseEndElement()
                 // m_pendingScript will be 0 if script was already loaded and ref() executed it
                 if (m_pendingScript)
                     pauseParsing();
-            } else
+            } else 
                 m_scriptElement = 0;
         } else
             m_view->frame()->loader()->executeScript(ScriptSourceCode(scriptElement->scriptContent(), m_doc->url(), m_scriptStartLine));
-
-        m_requestingScript = false;
     }
-
+    m_requestingScript = false;
     setCurrentNode(parent.get());
 }
 
@@ -622,7 +684,7 @@ void XMLTokenizer::parseProcessingInstruction()
 
 #if ENABLE(XSLT)
     m_sawXSLTransform = !m_sawFirstElement && pi->isXSL();
-    if (m_sawXSLTransform && !m_doc->transformSourceDocument())
+    if (m_sawXSLTransform && !m_doc->transformSourceDocument()))
         stopParsing();
 #endif
 }
@@ -650,6 +712,9 @@ void XMLTokenizer::parseComment()
 
 void XMLTokenizer::endDocument()
 {
+#if ENABLE(XHTMLMP)
+    m_hasDocTypeDeclaration = false;
+#endif
 }
 
 bool XMLTokenizer::hasError() const
@@ -743,9 +808,25 @@ void XMLTokenizer::parseDtd()
         || (publicId == QLatin1String("-//W3C//DTD XHTML Basic 1.0//EN"))
         || (publicId == QLatin1String("-//W3C//DTD XHTML 1.1 plus MathML 2.0//EN"))
         || (publicId == QLatin1String("-//W3C//DTD XHTML 1.1 plus MathML 2.0 plus SVG 1.1//EN"))
-        || (publicId == QLatin1String("-//WAPFORUM//DTD XHTML Mobile 1.0//EN"))) {
+#if !ENABLE(XHTMLMP)
+        || (publicId == QLatin1String("-//WAPFORUM//DTD XHTML Mobile 1.0//EN"))
+#endif
+       )
         setIsXHTMLDocument(true); // controls if we replace entities or not.
+#if ENABLE(XHTMLMP)
+    else if ((publicId == QLatin1String("-//WAPFORUM//DTD XHTML Mobile 1.1//EN"))
+             || (publicId == QLatin1String("-//WAPFORUM//DTD XHTML Mobile 1.0//EN"))) {
+        if (AtomicString(name) != HTMLNames::htmlTag.localName()) {
+            handleError(fatal, "Invalid DOCTYPE declaration, expected 'html' as root element.", lineNumber(), columnNumber());
+            return;
+        } 
+
+        if (m_doc->isXHTMLMPDocument()) // check if the MIME type is correct with this method
+            setIsXHTMLMPDocument(true);
+        else
+            setIsXHTMLDocument(true);
     }
+#endif
 #if ENABLE(WML)
     else if (m_doc->isWMLDocument()
              && publicId != QLatin1String("-//WAPFORUM//DTD WML 1.3//EN")
@@ -760,4 +841,3 @@ void XMLTokenizer::parseDtd()
 }
 }
 
-
diff --git a/src/3rdparty/webkit/WebCore/dom/XMLTokenizerScope.cpp b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerScope.cpp
new file mode 100644
index 0000000..3769f59
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerScope.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "XMLTokenizerScope.h"
+
+namespace WebCore {
+
+DocLoader* XMLTokenizerScope::currentDocLoader = 0;
+
+XMLTokenizerScope::XMLTokenizerScope(DocLoader* docLoader)
+    : m_oldDocLoader(currentDocLoader)
+#if ENABLE(XSLT)
+    , m_oldGenericErrorFunc(xmlGenericError)
+    , m_oldStructuredErrorFunc(xmlStructuredError)
+    , m_oldErrorContext(xmlGenericErrorContext)
+#endif
+{
+    currentDocLoader = docLoader;
+}
+
+#if ENABLE(XSLT)
+XMLTokenizerScope::XMLTokenizerScope(DocLoader* docLoader, xmlGenericErrorFunc genericErrorFunc, xmlStructuredErrorFunc structuredErrorFunc, void* errorContext)
+    : m_oldDocLoader(currentDocLoader)
+    , m_oldGenericErrorFunc(xmlGenericError)
+    , m_oldStructuredErrorFunc(xmlStructuredError)
+    , m_oldErrorContext(xmlGenericErrorContext)
+{
+    currentDocLoader = docLoader;
+    if (genericErrorFunc)
+        xmlSetGenericErrorFunc(errorContext, genericErrorFunc);
+    if (structuredErrorFunc)
+        xmlSetStructuredErrorFunc(errorContext, structuredErrorFunc);
+}
+#endif
+
+XMLTokenizerScope::~XMLTokenizerScope()
+{
+    currentDocLoader = m_oldDocLoader;
+#if ENABLE(XSLT)
+    xmlSetGenericErrorFunc(m_oldErrorContext, m_oldGenericErrorFunc);
+    xmlSetStructuredErrorFunc(m_oldErrorContext, m_oldStructuredErrorFunc);
+#endif
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/page/chromium/AccessibilityObjectWrapper.h b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerScope.h
index 0846d20..a3c1188 100644
--- a/src/3rdparty/webkit/WebCore/page/chromium/AccessibilityObjectWrapper.h
+++ b/src/3rdparty/webkit/WebCore/dom/XMLTokenizerScope.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -20,31 +20,43 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef AccessibilityObjectWrapper_h
-#define AccessibilityObjectWrapper_h
+#ifndef XMLTokenizerScope_h
+#define XMLTokenizerScope_h
+
+#include <wtf/Noncopyable.h>
+
+#if ENABLE(XSLT)
+#include <libxml/tree.h>
+#endif
 
 namespace WebCore {
 
-    class AccessibilityObject;
+    class DocLoader;
 
-    class AccessibilityObjectWrapper : public RefCounted<AccessibilityObjectWrapper> {
+    class XMLTokenizerScope : Noncopyable {
     public:
-        virtual ~AccessibilityObjectWrapper() {}
-        virtual void detach() = 0;
-        bool attached() const { return m_object; }
-        AccessibilityObject* accessibilityObject() const { return m_object; }
+        XMLTokenizerScope(DocLoader* docLoader);
+        ~XMLTokenizerScope();
+
+        static DocLoader* currentDocLoader;
+
+#if ENABLE(XSLT)
+        XMLTokenizerScope(DocLoader* docLoader, xmlGenericErrorFunc genericErrorFunc, xmlStructuredErrorFunc structuredErrorFunc = 0, void* errorContext = 0);
+#endif
 
-    protected:
-        AccessibilityObjectWrapper(AccessibilityObject* obj)
-            : RefCounted<AccessibilityObjectWrapper>(0), m_object(obj) { }
-        AccessibilityObjectWrapper() : m_object(0) { }
+    private:
+        DocLoader* m_oldDocLoader;
 
-        AccessibilityObject* m_object;
+#if ENABLE(XSLT)
+        xmlGenericErrorFunc m_oldGenericErrorFunc;
+        xmlStructuredErrorFunc m_oldStructuredErrorFunc;
+        void* m_oldErrorContext;
+#endif
     };
 
 } // namespace WebCore
 
-#endif // AccessibilityObjectWrapper_h
+#endif // XMLTokenizerScope_h
diff --git a/src/3rdparty/webkit/WebCore/dom/default/PlatformMessagePortChannel.cpp b/src/3rdparty/webkit/WebCore/dom/default/PlatformMessagePortChannel.cpp
new file mode 100644
index 0000000..80ab7c8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/default/PlatformMessagePortChannel.cpp
@@ -0,0 +1,222 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "PlatformMessagePortChannel.h"
+
+#include "MessagePort.h"
+#include "ScriptExecutionContext.h"
+
+namespace WebCore {
+
+// MessagePortChannel implementations - just delegate to the PlatformMessagePortChannel.
+bool MessagePortChannel::entangleIfOpen(MessagePort* port)
+{
+    return m_channel->entangleIfOpen(port);
+}
+
+void MessagePortChannel::disentangle()
+{
+    m_channel->disentangle();
+}
+
+void MessagePortChannel::postMessageToRemote(PassOwnPtr<MessagePortChannel::EventData> message)
+{
+    m_channel->postMessageToRemote(message);
+}
+
+bool MessagePortChannel::tryGetMessageFromRemote(OwnPtr<MessagePortChannel::EventData>& result)
+{
+    return m_channel->tryGetMessageFromRemote(result);
+}
+
+void MessagePortChannel::close()
+{
+    m_channel->close();
+}
+
+bool MessagePortChannel::isConnectedTo(MessagePort* port)
+{
+    return m_channel->isConnectedTo(port);
+}
+
+bool MessagePortChannel::hasPendingActivity()
+{
+    return m_channel->hasPendingActivity();
+}
+
+MessagePort* MessagePortChannel::locallyEntangledPort(const ScriptExecutionContext* context)
+{
+    return m_channel->locallyEntangledPort(context);
+}
+
+PassRefPtr<PlatformMessagePortChannel> PlatformMessagePortChannel::create(PassRefPtr<MessagePortQueue> incoming, PassRefPtr<MessagePortQueue> outgoing)
+{
+    return adoptRef(new PlatformMessagePortChannel(incoming, outgoing));
+}
+
+PlatformMessagePortChannel::PlatformMessagePortChannel(PassRefPtr<MessagePortQueue> incoming, PassRefPtr<MessagePortQueue> outgoing)
+    : m_entangledChannel(0)
+    , m_incomingQueue(incoming)
+    , m_outgoingQueue(outgoing)
+    , m_remotePort(0)
+{
+}
+
+PlatformMessagePortChannel::~PlatformMessagePortChannel()
+{
+}
+
+void PlatformMessagePortChannel::createChannel(PassRefPtr<MessagePort> port1, PassRefPtr<MessagePort> port2)
+{
+    // Create incoming/outgoing queues.
+    RefPtr<PlatformMessagePortChannel::MessagePortQueue> queue1 = PlatformMessagePortChannel::MessagePortQueue::create();
+    RefPtr<PlatformMessagePortChannel::MessagePortQueue> queue2 = PlatformMessagePortChannel::MessagePortQueue::create();
+
+    // Create proxies for each endpoint.
+    RefPtr<PlatformMessagePortChannel> channel1 = PlatformMessagePortChannel::create(queue1, queue2);
+    RefPtr<PlatformMessagePortChannel> channel2 = PlatformMessagePortChannel::create(queue2, queue1);
+
+    // Entangle the two endpoints.
+    channel1->setEntangledChannel(channel2);
+    channel2->setEntangledChannel(channel1);
+
+    // Now entangle the proxies with the appropriate local ports.
+    port1->entangle(MessagePortChannel::create(channel2));
+    port2->entangle(MessagePortChannel::create(channel1));
+}
+
+bool PlatformMessagePortChannel::entangleIfOpen(MessagePort* port)
+{
+    // We can't call member functions on our remote pair while holding our mutex or we'll deadlock, but we need to guard against the remote port getting closed/freed, so create a standalone reference.
+    RefPtr<PlatformMessagePortChannel> remote = entangledChannel();
+    if (!remote)
+        return false;
+    remote->setRemotePort(port);
+    return true;
+}
+
+void PlatformMessagePortChannel::disentangle()
+{
+    RefPtr<PlatformMessagePortChannel> remote = entangledChannel();
+    if (remote)
+        remote->setRemotePort(0);
+}
+
+void PlatformMessagePortChannel::setRemotePort(MessagePort* port)
+{
+    MutexLocker lock(m_mutex);
+    // Should never set port if it is already set.
+    ASSERT(!port || !m_remotePort);
+    m_remotePort = port;
+}
+
+MessagePort* PlatformMessagePortChannel::remotePort()
+{
+    MutexLocker lock(m_mutex);
+    return m_remotePort;
+}
+
+PassRefPtr<PlatformMessagePortChannel> PlatformMessagePortChannel::entangledChannel()
+{
+    MutexLocker lock(m_mutex);
+    return m_entangledChannel;
+}
+
+void PlatformMessagePortChannel::setEntangledChannel(PassRefPtr<PlatformMessagePortChannel> remote)
+{
+    MutexLocker lock(m_mutex);
+    // Should only be set as part of initial creation/entanglement.
+    if (remote)
+        ASSERT(!m_entangledChannel.get());
+    m_entangledChannel = remote;
+}
+
+void PlatformMessagePortChannel::postMessageToRemote(PassOwnPtr<MessagePortChannel::EventData> message)
+{
+    MutexLocker lock(m_mutex);
+    if (!m_outgoingQueue)
+        return;
+    bool wasEmpty = m_outgoingQueue->appendAndCheckEmpty(message);
+    if (wasEmpty && m_remotePort)
+        m_remotePort->messageAvailable();
+}
+
+bool PlatformMessagePortChannel::tryGetMessageFromRemote(OwnPtr<MessagePortChannel::EventData>& result)
+{
+    MutexLocker lock(m_mutex);
+    return m_incomingQueue->tryGetMessage(result);
+}
+
+bool PlatformMessagePortChannel::isConnectedTo(MessagePort* port)
+{
+    MutexLocker lock(m_mutex);
+    return m_remotePort == port;
+}
+
+// Closes the port so no further messages can be sent from either end.
+void PlatformMessagePortChannel::close()
+{
+    RefPtr<PlatformMessagePortChannel> remote = entangledChannel();
+    if (!remote)
+        return;
+    closeInternal();
+    remote->closeInternal();
+}
+
+void PlatformMessagePortChannel::closeInternal()
+{
+    MutexLocker lock(m_mutex);
+    // Disentangle ourselves from the other end. We still maintain a reference to our incoming queue, since previously-existing messages should still be delivered.
+    m_remotePort = 0;
+    m_entangledChannel = 0;
+    m_outgoingQueue = 0;
+}
+
+bool PlatformMessagePortChannel::hasPendingActivity()
+{
+    MutexLocker lock(m_mutex);
+    return !m_incomingQueue->isEmpty();
+}
+
+MessagePort* PlatformMessagePortChannel::locallyEntangledPort(const ScriptExecutionContext* context)
+{
+    MutexLocker lock(m_mutex);
+    // See if both contexts are run by the same thread (are the same context, or are both documents).
+    if (m_remotePort) {
+        // The remote port's ScriptExecutionContext is guaranteed not to change here - MessagePort::contextDestroyed() will close the port before the context goes away, and close() will block because we are holding the mutex.
+        ScriptExecutionContext* remoteContext = m_remotePort->scriptExecutionContext();
+        if (remoteContext == context || (remoteContext && remoteContext->isDocument() && context->isDocument()))
+            return m_remotePort;
+    }
+    return 0;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/dom/default/PlatformMessagePortChannel.h b/src/3rdparty/webkit/WebCore/dom/default/PlatformMessagePortChannel.h
new file mode 100644
index 0000000..0ce2d13
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/dom/default/PlatformMessagePortChannel.h
@@ -0,0 +1,129 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PlatformMessagePortChannel_h
+#define PlatformMessagePortChannel_h
+
+#include "MessagePortChannel.h"
+
+#include <wtf/MessageQueue.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+    class MessagePort;
+
+    // PlatformMessagePortChannel is a platform-dependent interface to the remote side of a message channel.
+    // This default implementation supports multiple threads running within a single process. Implementations for multi-process platforms should define these public APIs in their own platform-specific PlatformMessagePortChannel file.
+    // The goal of this implementation is to eliminate contention except when cloning or closing the port, so each side of the channel has its own separate mutex.
+    class PlatformMessagePortChannel : public ThreadSafeShared<PlatformMessagePortChannel> {
+    public:
+        static void createChannel(PassRefPtr<MessagePort>, PassRefPtr<MessagePort>);
+
+        // APIs delegated from MessagePortChannel.h
+        bool entangleIfOpen(MessagePort*);
+        void disentangle();
+        void postMessageToRemote(PassOwnPtr<MessagePortChannel::EventData>);
+        bool tryGetMessageFromRemote(OwnPtr<MessagePortChannel::EventData>&);
+        void close();
+        bool isConnectedTo(MessagePort*);
+        bool hasPendingActivity();
+        MessagePort* locallyEntangledPort(const ScriptExecutionContext*);
+
+        // Wrapper for MessageQueue that allows us to do thread safe sharing by two proxies.
+        class MessagePortQueue : public ThreadSafeShared<MessagePortQueue> {
+        public:
+            static PassRefPtr<MessagePortQueue> create() { return adoptRef(new MessagePortQueue()); }
+
+            bool tryGetMessage(OwnPtr<MessagePortChannel::EventData>& message)
+            {
+                MessagePortChannel::EventData* holder = 0;
+                bool messageAvailable = m_queue.tryGetMessage(holder);
+                if (messageAvailable)
+                    message.set(holder);
+                return messageAvailable;
+            }
+
+            bool appendAndCheckEmpty(PassOwnPtr<MessagePortChannel::EventData> message)
+            {
+                return m_queue.appendAndCheckEmpty(message.release());
+            }
+
+            bool isEmpty()
+            {
+                return m_queue.isEmpty();
+            }
+
+            ~MessagePortQueue()
+            {
+                // Manually free any items left in the queue, since we can't use OwnPtr internally.
+                MessagePortChannel::EventData* data = 0;
+                while (m_queue.tryGetMessage(data))
+                    delete data;
+            }
+        private:
+            MessagePortQueue() { }
+
+            // OwnPtr is Noncopyable, so we can't use it as the template type in a MessageQueue. So we just store a pointer to EventData and manually free it in the destructor.
+            // FIXME: Use a lock-free queue implementation to completely eliminate contention when sending/receiving messages.
+            MessageQueue<MessagePortChannel::EventData*> m_queue;
+        };
+
+        ~PlatformMessagePortChannel();
+
+    private:
+        static PassRefPtr<PlatformMessagePortChannel> create(PassRefPtr<MessagePortQueue> incoming, PassRefPtr<MessagePortQueue> outgoing);
+        PlatformMessagePortChannel(PassRefPtr<MessagePortQueue> incoming, PassRefPtr<MessagePortQueue> outgoing);
+
+        PassRefPtr<PlatformMessagePortChannel> entangledChannel();
+        void setEntangledChannel(PassRefPtr<PlatformMessagePortChannel>);
+
+        void setRemotePort(MessagePort*);
+        MessagePort* remotePort();
+        void closeInternal();
+
+        // Mutex used to ensure exclusive access to the object internals.
+        Mutex m_mutex;
+
+        // Pointer to our entangled pair - cleared when close() is called.
+        RefPtr<PlatformMessagePortChannel> m_entangledChannel;
+
+        // Reference to the message queue for the (local) entangled port.
+        RefPtr<MessagePortQueue> m_incomingQueue;
+        RefPtr<MessagePortQueue> m_outgoingQueue;
+
+        // The port we are connected to (the remote port) - this is the port that is notified when new messages arrive.
+        MessagePort* m_remotePort;
+    };
+
+} // namespace WebCore
+
+#endif // PlatformMessagePortChannel_h
diff --git a/src/3rdparty/webkit/WebCore/dom/make_names.pl b/src/3rdparty/webkit/WebCore/dom/make_names.pl
index 8541c0b..12f0ec7 100755
--- a/src/3rdparty/webkit/WebCore/dom/make_names.pl
+++ b/src/3rdparty/webkit/WebCore/dom/make_names.pl
@@ -1,6 +1,8 @@
 #!/usr/bin/perl -w
 
-# Copyright (C) 2005, 2006, 2007 Apple Inc. All rights reserved.
+# Copyright (C) 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
+# Copyright (C) 2009, Julien Chaffraix <jchaffraix@webkit.org>
+# Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -87,10 +89,12 @@ if ($printWrapperFactory) {
 sub initializeTagPropertyHash
 {
     return ('constructorNeedsCreatedByParser' => 0,
+            'constructorNeedsFormElement' => 0,
             'exportString' => 0,
             'interfaceName' => defaultInterfaceName($_[0]),
             # By default, the JSInterfaceName is the same as the interfaceName.
             'JSInterfaceName' => defaultInterfaceName($_[0]),
+            'mapToTagName' => '',
             'wrapperOnlyIfMediaIsAvailable' => 0,
             'conditional' => 0);
 }
@@ -216,32 +220,147 @@ sub printMacros
     }
 }
 
+sub usesDefaultWrapper
+{
+    my $tagName = shift;
+    return $tagName eq $parameters{'namespace'} . "Element";
+}
+
+# Build a direct mapping from the tags to the Element to create, excluding
+# Element that have not constructor.
+sub buildConstructorMap
+{
+    my %tagConstructorMap = ();
+    for my $tagName (keys %tags) {
+        my $interfaceName = $tags{$tagName}{'interfaceName'};
+        next if (usesDefaultWrapper($interfaceName));
+
+        if ($tags{$tagName}{'mapToTagName'}) {
+            die "Cannot handle multiple mapToTagName for $tagName\n" if $tags{$tags{$tagName}{'mapToTagName'}}{'mapToTagName'};
+            $interfaceName = $tags{ $tags{$tagName}{'mapToTagName'} }{'interfaceName'};
+        }
+
+        # Chop the string to keep the interesting part.
+        $interfaceName =~ s/$parameters{'namespace'}(.*)Element/$1/;
+        $tagConstructorMap{$tagName} = lc($interfaceName);
+    }
+
+    return %tagConstructorMap;
+}
+
+# Helper method that print the constructor's signature avoiding
+# unneeded arguments.
+sub printConstructorSignature
+{
+    my ($F, $tagName, $constructorName, $constructorTagName) = @_;
+
+    print F "static PassRefPtr<$parameters{'namespace'}Element> ${constructorName}Constructor(const QualifiedName& $constructorTagName, Document* doc";
+    if ($parameters{'namespace'} eq "HTML") {
+        print F ", HTMLFormElement*";
+        if ($tags{$tagName}{'constructorNeedsFormElement'}) {
+            print F " formElement";
+        }
+    }
+    print F ", bool";
+    if ($tags{$tagName}{'constructorNeedsCreatedByParser'}) {
+        print F " createdByParser"; 
+    }
+    print F ")\n{\n";
+}
+
+# Helper method to dump the constructor interior and call the 
+# Element constructor with the right arguments.
+# The variable names should be kept in sync with the previous method.
+sub printConstructorInterior
+{
+    my ($F, $tagName, $interfaceName, $constructorTagName) = @_;
+
+    # Handle media elements.
+    if ($tags{$tagName}{'wrapperOnlyIfMediaIsAvailable'}) {
+        print F <<END
+    if (!MediaPlayer::isAvailable())
+        return new HTMLElement($constructorTagName, doc);
+END
+;
+    }
+
+    # Now call the constructor with the right parameters.
+    print F "    return new ${interfaceName}($constructorTagName, doc";
+    if ($tags{$tagName}{'constructorNeedsFormElement'}) {
+        print F ", formElement";
+    }
+    if ($tags{$tagName}{'constructorNeedsCreatedByParser'}) {
+        print F ", createdByParser";
+    }
+    print F ");\n}\n\n";
+}
+
 sub printConstructors
 {
-    my $F = shift;
+    my ($F, $tagConstructorMapRef) = @_;
+    my %tagConstructorMap = %$tagConstructorMapRef;
 
     print F "#if $parameters{'guardFactoryWith'}\n" if $parameters{'guardFactoryWith'};
-    for my $name (sort keys %tags) {
-        my $ucName = $tags{$name}{'interfaceName'};
 
-        print F "static PassRefPtr<$parameters{'namespace'}Element> ${name}Constructor(Document* doc, bool createdByParser)\n";
-        print F "{\n";
-        if ($tags{$name}{'constructorNeedsCreatedByParser'}) {
-            print F "    return new ${ucName}($parameters{'namespace'}Names::${name}Tag, doc, createdByParser);\n";
-        } else {
-            print F "    return new ${ucName}($parameters{'namespace'}Names::${name}Tag, doc);\n";
+    # This is to avoid generating the same constructor several times.
+    my %uniqueTags = ();
+    for my $tagName (sort keys %tagConstructorMap) {
+        my $interfaceName = $tags{$tagName}{'interfaceName'};
+
+        # Ignore the mapped tag
+        # FIXME: It could be moved inside this loop but was split for readibility.
+        next if (defined($uniqueTags{$interfaceName}) || $tags{$tagName}{'mapToTagName'});
+
+        $uniqueTags{$interfaceName} = '1';
+
+        my $conditional = $tags{$tagName}{"conditional"};
+        if ($conditional) {
+            my $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
+            print F "#if ${conditionalString}\n\n";
+        }
+
+        printConstructorSignature($F, $tagName, $tagConstructorMap{$tagName}, "tagName");
+        printConstructorInterior($F, $tagName, $interfaceName, "tagName");
+
+        if ($conditional) {
+            print F "#endif\n\n";
         }
-        print F "}\n\n";
     }
+
+    # Mapped tag name uses a special wrapper to keep their prefix and namespaceURI while using the mapped localname.
+    for my $tagName (sort keys %tagConstructorMap) {
+        if ($tags{$tagName}{'mapToTagName'}) {
+            my $mappedName = $tags{$tagName}{'mapToTagName'};
+            printConstructorSignature($F, $mappedName, $mappedName . "To" . $tagName, "tagName");
+            printConstructorInterior($F, $mappedName, $tags{$mappedName}{'interfaceName'}, "QualifiedName(tagName.prefix(), ${mappedName}Tag.localName(), tagName.namespaceURI())");
+        }
+    }
+
     print F "#endif\n" if $parameters{'guardFactoryWith'};
 }
 
 sub printFunctionInits
 {
-    my $F = shift;
+    my ($F, $tagConstructorMap) = @_;
+    my %tagConstructorMap = %$tagConstructorMap;
+
+    for my $tagName (sort keys %tagConstructorMap) {
+
+        my $conditional = $tags{$tagName}{"conditional"};
+        if ($conditional) {
+            my $conditionalString = "ENABLE(" . join(") && ENABLE(", split(/&/, $conditional)) . ")";
+            print F "#if ${conditionalString}\n";
+        }
 
-    for my $name (sort keys %tags) {
-        print F "    gFunctionMap->set($parameters{'namespace'}Names::${name}Tag.localName().impl(), ${name}Constructor);\n";
+        if ($tags{$tagName}{'mapToTagName'}) {
+            print F "    addTag(${tagName}Tag, $tags{$tagName}{'mapToTagName'}To${tagName}Constructor);\n";
+        } else {
+            print F "    addTag(${tagName}Tag, $tagConstructorMap{$tagName}Constructor);\n";
+        }
+
+        if ($conditional) {
+            print F "#endif\n\n";
+        }
     }
 }
 
@@ -325,16 +444,23 @@ sub printNamesHeaderFile
     if (keys %tags) {
         print F "// Tags\n";
         printMacros($F, "extern const WebCore::QualifiedName", "Tag", \%tags);
-        print F "\n\nWebCore::QualifiedName** get$parameters{'namespace'}Tags(size_t* size);\n";
     }
     
     if (keys %attrs) {
         print F "// Attributes\n";
         printMacros($F, "extern const WebCore::QualifiedName", "Attr", \%attrs);
-        print F "\n\nWebCore::QualifiedName** get$parameters{'namespace'}Attr(size_t* size);\n";
     }
     print F "#endif\n\n";
-    print F "void init();\n\n";
+    
+    if (keys %tags) {
+        print F "WebCore::QualifiedName** get$parameters{'namespace'}Tags(size_t* size);\n";
+    }
+
+    if (keys %attrs) {
+        print F "WebCore::QualifiedName** get$parameters{'namespace'}Attrs(size_t* size);\n";
+    }
+    
+    print F "\nvoid init();\n\n";
     print F "} }\n\n";
     print F "#endif\n\n";
     
@@ -536,28 +662,49 @@ print F <<END
 END
 ;
 
+if ($parameters{'namespace'} eq "HTML") {
+    print F "#include \"HTMLFormElement.h\"\n";
+}
+
 printElementIncludes($F);
 
 print F <<END
 #include <wtf/HashMap.h>
 
-using namespace WebCore;
+namespace WebCore {
 
-typedef PassRefPtr<$parameters{'namespace'}Element> (*ConstructorFunction)(Document*, bool createdByParser);
-typedef WTF::HashMap<AtomicStringImpl*, ConstructorFunction> FunctionMap;
+using namespace $parameters{'namespace'}Names;
 
-static FunctionMap* gFunctionMap = 0;
+END
+;
 
-namespace WebCore {
+print F "typedef PassRefPtr<$parameters{'namespace'}Element> (*ConstructorFunction)(const QualifiedName&, Document*";
+
+if ($parameters{'namespace'} eq "HTML") {
+    print F ", HTMLFormElement*";
+}
+
+print F ", bool createdByParser);\n";
+print F <<END
+typedef HashMap<AtomicStringImpl*, ConstructorFunction> FunctionMap;
+
+static FunctionMap* gFunctionMap = 0;
 
 END
 ;
 
-printConstructors($F);
+my %tagConstructorMap = buildConstructorMap();
+
+printConstructors($F, \%tagConstructorMap);
 
 print F "#if $parameters{'guardFactoryWith'}\n" if $parameters{'guardFactoryWith'};
 
 print F <<END
+static void addTag(const QualifiedName& tag, ConstructorFunction func)
+{
+    gFunctionMap->set(tag.localName().impl(), func);
+}
+
 static inline void createFunctionMapIfNecessary()
 {
     if (gFunctionMap)
@@ -569,16 +716,18 @@ static inline void createFunctionMapIfNecessary()
 END
 ;
 
-printFunctionInits($F);
+printFunctionInits($F, \%tagConstructorMap);
 
 print F "}\n";
-print F "#endif\n\n" if $parameters{'guardFactoryWith'};
+print F "#endif\n" if $parameters{'guardFactoryWith'};
 
-print F <<END
-PassRefPtr<$parameters{'namespace'}Element> $parameters{'namespace'}ElementFactory::create$parameters{'namespace'}Element(const QualifiedName& qName, Document* doc, bool createdByParser)
-{
-END
-;
+print F "\nPassRefPtr<$parameters{'namespace'}Element> $parameters{'namespace'}ElementFactory::create$parameters{'namespace'}Element(const QualifiedName& qName, Document* doc";
+
+if ($parameters{"namespace"} eq "HTML") {
+    print F ", HTMLFormElement* formElement";
+}
+
+print F ", bool createdByParser)\n{\n";
 
 print F "#if $parameters{'guardFactoryWith'}\n" if $parameters{'guardFactoryWith'};
 
@@ -587,21 +736,36 @@ print F <<END
     if (!doc)
         return 0;
 
+END
+;
+
+if ($parameters{'namespace'} ne "HTML") {
+print F <<END
 #if ENABLE(DASHBOARD_SUPPORT)
     Settings* settings = doc->settings();
     if (settings && settings->usesDashboardBackwardCompatibilityMode())
         return 0;
 #endif
+END
+;
 
+}
+
+print F <<END
     createFunctionMapIfNecessary();
     ConstructorFunction func = gFunctionMap->get(qName.localName().impl());
     if (func)
-        return func(doc, createdByParser);
-
-    return new $parameters{'namespace'}Element(qName, doc);
 END
 ;
 
+if ($parameters{"namespace"} eq "HTML") {
+    print F "        return func(qName, doc, formElement, createdByParser);\n";
+} else {
+    print F "        return func(qName, doc, createdByParser);\n";
+}
+
+print F "    return new $parameters{'namespace'}Element(qName, doc);\n";
+
 if ($parameters{'guardFactoryWith'}) {
 
 print F <<END
@@ -648,13 +812,30 @@ namespace WebCore {
 namespace WebCore {
 
     class $parameters{'namespace'}Element;
+END
+;
+
+if ($parameters{'namespace'} eq "HTML") {
+    print F "     class HTMLFormElement;\n";
+}
 
+print F<<END
     // The idea behind this class is that there will eventually be a mapping from namespace URIs to ElementFactories that can dispense
     // elements. In a compound document world, the generic createElement function (will end up being virtual) will be called.
     class $parameters{'namespace'}ElementFactory {
     public:
         PassRefPtr<Element> createElement(const WebCore::QualifiedName&, WebCore::Document*, bool createdByParser = true);
-        static PassRefPtr<$parameters{'namespace'}Element> create$parameters{'namespace'}Element(const WebCore::QualifiedName&, WebCore::Document*, bool createdByParser = true);
+END
+;
+print F "        static PassRefPtr<$parameters{'namespace'}Element> create$parameters{'namespace'}Element(const WebCore::QualifiedName&, WebCore::Document*";
+
+if ($parameters{'namespace'} eq "HTML") {
+    print F ", HTMLFormElement* = 0";
+}
+
+print F ", bool /*createdByParser*/ = true);\n";
+
+printf F<<END
     };
 }
 
@@ -673,7 +854,7 @@ sub usesDefaultJSWrapper
     my $name = shift;
 
     # A tag reuses the default wrapper if its JSInterfaceName matches the default namespace Element.
-    return $tags{$name}{'JSInterfaceName'} eq $parameters{"namespace"} . "Element";
+    return $tags{$name}{'JSInterfaceName'} eq $parameters{"namespace"} . "Element" || $tags{$name}{'JSInterfaceName'} eq "HTMLNoScriptElement";
 }
 
 sub printWrapperFunctions
diff --git a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
index eecec4d..8d0312b 100644
--- a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,11 +27,14 @@
 #include "ApplyStyleCommand.h"
 
 #include "CSSComputedStyleDeclaration.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSParser.h"
 #include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "Document.h"
+#include "Editor.h"
+#include "Frame.h"
 #include "HTMLElement.h"
 #include "HTMLInterchange.h"
 #include "HTMLNames.h"
@@ -50,16 +53,13 @@ using namespace HTMLNames;
 
 class StyleChange {
 public:
-    enum ELegacyHTMLStyles { DoNotUseLegacyHTMLStyles, UseLegacyHTMLStyles };
-
-    explicit StyleChange(CSSStyleDeclaration *, ELegacyHTMLStyles usesLegacyStyles=UseLegacyHTMLStyles);
-    StyleChange(CSSStyleDeclaration *, const Position &, ELegacyHTMLStyles usesLegacyStyles=UseLegacyHTMLStyles);
-
-    static ELegacyHTMLStyles styleModeForParseMode(bool);
+    explicit StyleChange(CSSStyleDeclaration*, const Position&);
 
     String cssStyle() const { return m_cssStyle; }
     bool applyBold() const { return m_applyBold; }
     bool applyItalic() const { return m_applyItalic; }
+    bool applySubscript() const { return m_applySubscript; }
+    bool applySuperscript() const { return m_applySuperscript; }
     bool applyFontColor() const { return m_applyFontColor.length() > 0; }
     bool applyFontFace() const { return m_applyFontFace.length() > 0; }
     bool applyFontSize() const { return m_applyFontSize.length() > 0; }
@@ -68,38 +68,39 @@ public:
     String fontFace() { return m_applyFontFace; }
     String fontSize() { return m_applyFontSize; }
 
-    bool usesLegacyStyles() const { return m_usesLegacyStyles; }
-
 private:
-    void init(PassRefPtr<CSSStyleDeclaration>, const Position &);
-    bool checkForLegacyHTMLStyleChange(const CSSProperty *);
-    static bool currentlyHasStyle(const Position &, const CSSProperty *);
+    void init(PassRefPtr<CSSStyleDeclaration>, const Position&);
+    bool checkForLegacyHTMLStyleChange(const CSSProperty*);
+    static bool currentlyHasStyle(const Position&, const CSSProperty*);
     
     String m_cssStyle;
     bool m_applyBold;
     bool m_applyItalic;
+    bool m_applySubscript;
+    bool m_applySuperscript;
     String m_applyFontColor;
     String m_applyFontFace;
     String m_applyFontSize;
-    bool m_usesLegacyStyles;
 };
 
 
-
-StyleChange::StyleChange(CSSStyleDeclaration *style, ELegacyHTMLStyles usesLegacyStyles)
-    : m_applyBold(false), m_applyItalic(false), m_usesLegacyStyles(usesLegacyStyles)
-{
-    init(style, Position());
-}
-
-StyleChange::StyleChange(CSSStyleDeclaration *style, const Position &position, ELegacyHTMLStyles usesLegacyStyles)
-    : m_applyBold(false), m_applyItalic(false), m_usesLegacyStyles(usesLegacyStyles)
+StyleChange::StyleChange(CSSStyleDeclaration* style, const Position& position)
+    : m_applyBold(false)
+    , m_applyItalic(false)
+    , m_applySubscript(false)
+    , m_applySuperscript(false)
 {
     init(style, position);
 }
 
-void StyleChange::init(PassRefPtr<CSSStyleDeclaration> style, const Position &position)
+void StyleChange::init(PassRefPtr<CSSStyleDeclaration> style, const Position& position)
 {
+    Document* document = position.node() ? position.node()->document() : 0;
+    if (!document || !document->frame())
+        return;
+        
+    bool useHTMLFormattingTags = !document->frame()->editor()->shouldStyleWithCSS();
+            
     RefPtr<CSSMutableStyleDeclaration> mutableStyle = style->makeMutable();
     
     String styleText("");
@@ -119,7 +120,7 @@ void StyleChange::init(PassRefPtr<CSSStyleDeclaration> style, const Position &po
             continue;
         
         // If needed, figure out if this change is a legacy HTML style change.
-        if (m_usesLegacyStyles && checkForLegacyHTMLStyleChange(property))
+        if (useHTMLFormattingTags && checkForLegacyHTMLStyleChange(property))
             continue;
 
         if (property->id() == CSSPropertyDirection) {
@@ -132,6 +133,7 @@ void StyleChange::init(PassRefPtr<CSSStyleDeclaration> style, const Position &po
 
         if (property->id() == CSSPropertyWebkitTextDecorationsInEffect) {
             // we have to special-case text decorations
+            // FIXME: Why?
             CSSProperty alteredProperty(CSSPropertyTextDecoration, property->value(), property->isImportant());
             styleText += alteredProperty.cssText();
         } else
@@ -147,16 +149,11 @@ void StyleChange::init(PassRefPtr<CSSStyleDeclaration> style, const Position &po
     m_cssStyle = styleText.stripWhiteSpace();
 }
 
-StyleChange::ELegacyHTMLStyles StyleChange::styleModeForParseMode(bool isQuirksMode)
+// This function is the mapping from CSS styles to styling tags (like font-weight: bold to <b>)
+bool StyleChange::checkForLegacyHTMLStyleChange(const CSSProperty* property)
 {
-    return isQuirksMode ? UseLegacyHTMLStyles : DoNotUseLegacyHTMLStyles;
-}
-
-bool StyleChange::checkForLegacyHTMLStyleChange(const CSSProperty *property)
-{
-    if (!property || !property->value()) {
+    if (!property || !property->value())
         return false;
-    }
     
     String valueText(property->value()->cssText());
     switch (property->id()) {
@@ -166,6 +163,16 @@ bool StyleChange::checkForLegacyHTMLStyleChange(const CSSProperty *property)
                 return true;
             }
             break;
+        case CSSPropertyVerticalAlign:
+            if (equalIgnoringCase(valueText, "sub")) {
+                m_applySubscript = true;
+                return true;
+            }
+            if (equalIgnoringCase(valueText, "super")) {
+                m_applySuperscript = true;
+                return true;
+            }
+            break;
         case CSSPropertyFontStyle:
             if (equalIgnoringCase(valueText, "italic") || equalIgnoringCase(valueText, "oblique")) {
                 m_applyItalic = true;
@@ -222,13 +229,17 @@ bool StyleChange::currentlyHasStyle(const Position &pos, const CSSProperty *prop
 {
     ASSERT(pos.isNotNull());
     RefPtr<CSSComputedStyleDeclaration> style = pos.computedStyle();
-    RefPtr<CSSValue> value = style->getPropertyCSSValue(property->id(), DoNotUpdateLayout);
+    RefPtr<CSSValue> value;
+    if (property->id() == CSSPropertyFontSize)
+        value = style->getFontSizeCSSValuePreferringKeyword();
+    else
+        value = style->getPropertyCSSValue(property->id(), DoNotUpdateLayout);
     if (!value)
         return false;
     return equalIgnoringCase(value->cssText(), property->value()->cssText());
 }
 
-static String &styleSpanClassString()
+static String& styleSpanClassString()
 {
     DEFINE_STATIC_LOCAL(String, styleSpanClassString, ((AppleStyleSpanClass)));
     return styleSpanClassString;
@@ -239,18 +250,31 @@ bool isStyleSpan(const Node *node)
     if (!node || !node->isHTMLElement())
         return false;
 
-    const HTMLElement *elem = static_cast<const HTMLElement *>(node);
+    const HTMLElement* elem = static_cast<const HTMLElement*>(node);
     return elem->hasLocalName(spanAttr) && elem->getAttribute(classAttr) == styleSpanClassString();
 }
 
-static bool isUnstyledStyleSpan(const Node *node)
+static bool isUnstyledStyleSpan(const Node* node)
 {
     if (!node || !node->isHTMLElement() || !node->hasTagName(spanTag))
         return false;
 
-    const HTMLElement *elem = static_cast<const HTMLElement *>(node);
-    CSSMutableStyleDeclaration *inlineStyleDecl = elem->inlineStyleDecl();
-    return (!inlineStyleDecl || inlineStyleDecl->length() == 0) && elem->getAttribute(classAttr) == styleSpanClassString();
+    const HTMLElement* elem = static_cast<const HTMLElement*>(node);
+    CSSMutableStyleDeclaration* inlineStyleDecl = elem->inlineStyleDecl();
+    return (!inlineStyleDecl || inlineStyleDecl->isEmpty()) && elem->getAttribute(classAttr) == styleSpanClassString();
+}
+
+static bool isSpanWithoutAttributesOrUnstyleStyleSpan(const Node* node)
+{
+    if (!node || !node->isHTMLElement() || !node->hasTagName(spanTag))
+        return false;
+
+    const HTMLElement* elem = static_cast<const HTMLElement*>(node);
+    NamedNodeMap* attributes = elem->attributes(true); // readonly
+    if (attributes->isEmpty())
+        return true;
+
+    return isUnstyledStyleSpan(node);
 }
 
 static bool isEmptyFontTag(const Node *node)
@@ -259,22 +283,20 @@ static bool isEmptyFontTag(const Node *node)
         return false;
 
     const Element *elem = static_cast<const Element *>(node);
-    NamedAttrMap *map = elem->attributes(true); // true for read-only
+    NamedNodeMap *map = elem->attributes(true); // true for read-only
     return (!map || map->length() == 1) && elem->getAttribute(classAttr) == styleSpanClassString();
 }
 
 static PassRefPtr<Element> createFontElement(Document* document)
 {
-    ExceptionCode ec = 0;
-    RefPtr<Element> fontNode = document->createElementNS(xhtmlNamespaceURI, "font", ec);
-    ASSERT(ec == 0);
+    RefPtr<Element> fontNode = createHTMLElement(document, fontTag);
     fontNode->setAttribute(classAttr, styleSpanClassString());
     return fontNode.release();
 }
 
 PassRefPtr<HTMLElement> createStyleSpanElement(Document* document)
 {
-    RefPtr<HTMLElement> styleElement = new HTMLElement(spanTag, document);
+    RefPtr<HTMLElement> styleElement = createHTMLElement(document, spanTag);
     styleElement->setAttribute(classAttr, styleSpanClassString());
     return styleElement.release();
 }
@@ -320,12 +342,12 @@ ApplyStyleCommand::ApplyStyleCommand(PassRefPtr<Element> element, bool removeOnl
 
 void ApplyStyleCommand::updateStartEnd(const Position& newStart, const Position& newEnd)
 {
-    ASSERT(Range::compareBoundaryPoints(newEnd, newStart) >= 0);
+    ASSERT(comparePositions(newEnd, newStart) >= 0);
 
     if (!m_useEndingSelection && (newStart != m_start || newEnd != m_end))
         m_useEndingSelection = true;
 
-    setEndingSelection(Selection(newStart, newEnd, VP_DEFAULT_AFFINITY));
+    setEndingSelection(VisibleSelection(newStart, newEnd, VP_DEFAULT_AFFINITY));
     m_start = newStart;
     m_end = newEnd;
 }
@@ -386,7 +408,7 @@ void ApplyStyleCommand::applyBlockStyle(CSSMutableStyleDeclaration *style)
     // get positions we want to use for applying style
     Position start = startPosition();
     Position end = endPosition();
-    if (Range::compareBoundaryPoints(end, start) < 0) {
+    if (comparePositions(end, start) < 0) {
         Position swap = start;
         start = end;
         end = swap;
@@ -408,8 +430,8 @@ void ApplyStyleCommand::applyBlockStyle(CSSMutableStyleDeclaration *style)
     VisiblePosition nextParagraphStart(endOfParagraph(paragraphStart).next());
     VisiblePosition beyondEnd(endOfParagraph(visibleEnd).next());
     while (paragraphStart.isNotNull() && paragraphStart != beyondEnd) {
-        StyleChange styleChange(style, paragraphStart.deepEquivalent(), StyleChange::styleModeForParseMode(document()->inCompatMode()));
-        if (styleChange.cssStyle().length() > 0 || m_removeOnly) {
+        StyleChange styleChange(style, paragraphStart.deepEquivalent());
+        if (styleChange.cssStyle().length() || m_removeOnly) {
             RefPtr<Node> block = enclosingBlock(paragraphStart.deepEquivalent().node());
             RefPtr<Node> newBlock = moveParagraphContentsToNewBlockIfNecessary(paragraphStart.deepEquivalent());
             if (newBlock)
@@ -462,7 +484,7 @@ void ApplyStyleCommand::applyRelativeFontStyleChange(CSSMutableStyleDeclaration
     
     Position start = startPosition();
     Position end = endPosition();
-    if (Range::compareBoundaryPoints(end, start) < 0) {
+    if (comparePositions(end, start) < 0) {
         Position swap = start;
         start = end;
         end = swap;
@@ -503,7 +525,7 @@ void ApplyStyleCommand::applyRelativeFontStyleChange(CSSMutableStyleDeclaration
     
     start = start.upstream(); // Move upstream to ensure we do not add redundant spans.
     Node *startNode = start.node();
-    if (startNode->isTextNode() && start.offset() >= caretMaxOffset(startNode)) // Move out of text node if range does not include its characters.
+    if (startNode->isTextNode() && start.deprecatedEditingOffset() >= caretMaxOffset(startNode)) // Move out of text node if range does not include its characters.
         startNode = startNode->traverseNextNode();
 
     // Store away font size before making any changes to the document.
@@ -527,7 +549,6 @@ void ApplyStyleCommand::applyRelativeFontStyleChange(CSSMutableStyleDeclaration
             // Last styled node was not parent node of this text node, but we wish to style this
             // text node. To make this possible, add a style span to surround this text node.
             RefPtr<HTMLElement> span = createStyleSpanElement(document());
-            insertNodeBefore(span.get(), node);
             surroundNodeRangeWithElement(node, node, span.get());
             element = span.release();
         }  else {
@@ -548,8 +569,9 @@ void ApplyStyleCommand::applyRelativeFontStyleChange(CSSMutableStyleDeclaration
             inlineStyleDecl->setProperty(CSSPropertyFontSize, String::number(desiredFontSize) + "px", false, false);
             setNodeAttribute(element.get(), styleAttr, inlineStyleDecl->cssText());
         }
-        if (inlineStyleDecl->length() == 0) {
+        if (inlineStyleDecl->isEmpty()) {
             removeNodeAttribute(element.get(), styleAttr);
+            // FIXME: should this be isSpanWithoutAttributesOrUnstyleStyleSpan?  Need a test.
             if (isUnstyledStyleSpan(element.get()))
                 unstyledSpans.append(element.release());
         }
@@ -674,6 +696,7 @@ void ApplyStyleCommand::removeEmbeddingUpToEnclosingBlock(Node* node, Node* unsp
                     inlineStyle->setProperty(CSSPropertyUnicodeBidi, CSSValueNormal);
                     inlineStyle->removeProperty(CSSPropertyDirection);
                     setNodeAttribute(element, styleAttr, inlineStyle->cssText());
+                    // FIXME: should this be isSpanWithoutAttributesOrUnstyleStyleSpan?  Need a test.
                     if (isUnstyledStyleSpan(element))
                         removeNodePreservingChildren(element);
                 }
@@ -696,7 +719,7 @@ void ApplyStyleCommand::applyInlineStyle(CSSMutableStyleDeclaration *style)
     // adjust to the positions we want to use for applying style
     Position start = startPosition();
     Position end = endPosition();
-    if (Range::compareBoundaryPoints(end, start) < 0) {
+    if (comparePositions(end, start) < 0) {
         Position swap = start;
         start = end;
         end = swap;
@@ -757,7 +780,7 @@ void ApplyStyleCommand::applyInlineStyle(CSSMutableStyleDeclaration *style)
         RefPtr<CSSMutableStyleDeclaration> embeddingStyle = CSSMutableStyleDeclaration::create();
         embeddingStyle->setProperty(CSSPropertyUnicodeBidi, CSSValueEmbed);
         embeddingStyle->setProperty(CSSPropertyDirection, static_cast<CSSPrimitiveValue*>(direction.get())->getIdent());
-        if (Range::compareBoundaryPoints(embeddingRemoveStart, embeddingRemoveEnd) <= 0)
+        if (comparePositions(embeddingRemoveStart, embeddingRemoveEnd) <= 0)
             removeInlineStyle(embeddingStyle, embeddingRemoveStart, embeddingRemoveEnd);
 
         RefPtr<CSSMutableStyleDeclaration> styleWithoutEmbedding = style->copy();
@@ -850,21 +873,24 @@ void ApplyStyleCommand::applyInlineStyleToRange(CSSMutableStyleDeclaration* styl
 
     bool rangeIsEmpty = false;
 
-    if (start.offset() >= caretMaxOffset(start.node())) {
+    if (start.deprecatedEditingOffset() >= caretMaxOffset(start.node())) {
         node = node->traverseNextNode();
         Position newStart = Position(node, 0);
-        if (Range::compareBoundaryPoints(end, newStart) < 0)
+        if (!node || comparePositions(end, newStart) < 0)
             rangeIsEmpty = true;
     }
 
     if (!rangeIsEmpty) {
+        // pastEndNode is the node after the last fully selected node.
+        Node* pastEndNode = end.node();
+        if (end.deprecatedEditingOffset() >= caretMaxOffset(end.node()))
+            pastEndNode = end.node()->traverseNextSibling();
         // FIXME: Callers should perform this operation on a Range that includes the br
         // if they want style applied to the empty line.
         if (start == end && start.node()->hasTagName(brTag))
-            end = positionAfterNode(start.node());
+            pastEndNode = start.node()->traverseNextNode();
         // Add the style to selected inline runs.
-        Node* pastLast = Range::create(document(), rangeCompliantEquivalent(start), rangeCompliantEquivalent(end))->pastLastNode();
-        for (Node* next; node && node != pastLast; node = next) {
+        for (Node* next; node && node != pastEndNode; node = next) {
             
             next = node->traverseNextNode();
             
@@ -873,7 +899,9 @@ void ApplyStyleCommand::applyInlineStyleToRange(CSSMutableStyleDeclaration* styl
             
             if (!node->isContentRichlyEditable() && node->isHTMLElement()) {
                 // This is a plaintext-only region. Only proceed if it's fully selected.
-                if (end.node()->isDescendantOf(node))
+                // pastEndNode is the node after the last fully selected node, so if it's inside node then
+                // node isn't fully selected.
+                if (pastEndNode && pastEndNode->isDescendantOf(node))
                     break;
                 // Add to this element's inline style and skip over its contents.
                 HTMLElement* element = static_cast<HTMLElement*>(node);
@@ -898,7 +926,7 @@ void ApplyStyleCommand::applyInlineStyleToRange(CSSMutableStyleDeclaration* styl
             Node* runStart = node;
             // Find the end of the run.
             Node* sibling = node->nextSibling();
-            while (sibling && sibling != pastLast && (!sibling->isElementNode() || sibling->hasTagName(brTag)) && !isBlock(sibling)) {
+            while (sibling && sibling != pastEndNode && (!sibling->isElementNode() || sibling->hasTagName(brTag)) && !isBlock(sibling)) {
                 node = sibling;
                 sibling = node->nextSibling();
             }
@@ -910,32 +938,57 @@ void ApplyStyleCommand::applyInlineStyleToRange(CSSMutableStyleDeclaration* styl
     }
 }
 
-bool ApplyStyleCommand::isHTMLStyleNode(CSSMutableStyleDeclaration *style, HTMLElement *elem)
+// This function maps from styling tags to CSS styles.  Used for knowing which
+// styling tags should be removed when toggling styles.
+bool ApplyStyleCommand::implicitlyStyledElementShouldBeRemovedWhenApplyingStyle(HTMLElement* elem, CSSMutableStyleDeclaration* style)
 {
     CSSMutableStyleDeclaration::const_iterator end = style->end();
     for (CSSMutableStyleDeclaration::const_iterator it = style->begin(); it != end; ++it) {
-        switch ((*it).id()) {
-            case CSSPropertyFontWeight:
-                if (elem->hasLocalName(bTag))
-                    return true;
-                break;
-            case CSSPropertyFontStyle:
-                if (elem->hasLocalName(iTag))
-                    return true;
+        const CSSProperty& property = *it;
+        // FIXME: This should probably be re-written to lookup the tagname in a
+        // hash and match against an expected property/value pair.
+        switch (property.id()) {
+        case CSSPropertyFontWeight:
+            // IE inserts "strong" tags for execCommand("bold"), so we remove them, even though they're not strictly presentational
+            if (elem->hasLocalName(bTag) || elem->hasLocalName(strongTag))
+                return true;
+            break;
+        case CSSPropertyVerticalAlign:
+            if (elem->hasLocalName(subTag) || elem->hasLocalName(supTag))
+                return true;
+            break;
+        case CSSPropertyFontStyle:
+            // IE inserts "em" tags for execCommand("italic"), so we remove them, even though they're not strictly presentational
+            if (elem->hasLocalName(iTag) || elem->hasLocalName(emTag))
+                return true;
+            break;
         }
     }
-
     return false;
 }
 
-void ApplyStyleCommand::removeHTMLStyleNode(HTMLElement *elem)
+void ApplyStyleCommand::replaceWithSpanOrRemoveIfWithoutAttributes(HTMLElement*& elem)
 {
-    // This node can be removed.
-    // EDIT FIXME: This does not handle the case where the node
-    // has attributes. But how often do people add attributes to <B> tags? 
-    // Not so often I think.
-    ASSERT(elem);
-    removeNodePreservingChildren(elem);
+    bool removeNode = false;
+
+    // Similar to isSpanWithoutAttributesOrUnstyleStyleSpan, but does not look for Apple-style-span.
+    NamedNodeMap* attributes = elem->attributes(true); // readonly
+    if (!attributes || attributes->isEmpty())
+        removeNode = true;
+    else if (attributes->length() == 1 && elem->hasAttribute(styleAttr)) {
+        // Remove the element even if it has just style='' (this might be redundantly checked later too)
+        CSSMutableStyleDeclaration* inlineStyleDecl = elem->inlineStyleDecl();
+        if (!inlineStyleDecl || inlineStyleDecl->isEmpty())
+            removeNode = true;
+    }
+
+    if (removeNode)
+        removeNodePreservingChildren(elem);
+    else {
+        HTMLElement* newSpanElement = replaceNodeWithSpanPreservingChildrenAndAttributes(elem);
+        ASSERT(newSpanElement && newSpanElement->inDocument());
+        elem = newSpanElement;
+    }
 }
 
 void ApplyStyleCommand::removeHTMLFontStyle(CSSMutableStyleDeclaration *style, HTMLElement *elem)
@@ -978,16 +1031,17 @@ void ApplyStyleCommand::removeHTMLBidiEmbeddingStyle(CSSMutableStyleDeclaration
 
     removeNodeAttribute(elem, dirAttr);
 
+    // FIXME: should this be isSpanWithoutAttributesOrUnstyleStyleSpan?  Need a test.
     if (isUnstyledStyleSpan(elem))
         removeNodePreservingChildren(elem);
 }
 
-void ApplyStyleCommand::removeCSSStyle(CSSMutableStyleDeclaration *style, HTMLElement *elem)
+void ApplyStyleCommand::removeCSSStyle(CSSMutableStyleDeclaration* style, HTMLElement* elem)
 {
     ASSERT(style);
     ASSERT(elem);
 
-    CSSMutableStyleDeclaration *decl = elem->inlineStyleDecl();
+    CSSMutableStyleDeclaration* decl = elem->inlineStyleDecl();
     if (!decl)
         return;
 
@@ -1002,18 +1056,12 @@ void ApplyStyleCommand::removeCSSStyle(CSSMutableStyleDeclaration *style, HTMLEl
         }
     }
 
-    if (isUnstyledStyleSpan(elem))
-        removeNodePreservingChildren(elem);
-}
+    // No need to serialize <foo style=""> if we just removed the last css property
+    if (decl->isEmpty())
+        removeNodeAttribute(elem, styleAttr);
 
-void ApplyStyleCommand::removeBlockStyle(CSSMutableStyleDeclaration *style, const Position &start, const Position &end)
-{
-    ASSERT(start.isNotNull());
-    ASSERT(end.isNotNull());
-    ASSERT(start.node()->inDocument());
-    ASSERT(end.node()->inDocument());
-    ASSERT(Range::compareBoundaryPoints(start, end) <= 0);
-    
+    if (isSpanWithoutAttributesOrUnstyleStyleSpan(elem))
+        removeNodePreservingChildren(elem);
 }
 
 static bool hasTextDecorationProperty(Node *node)
@@ -1090,12 +1138,11 @@ void ApplyStyleCommand::applyTextDecorationStyle(Node *node, CSSMutableStyleDecl
 {
     ASSERT(node);
 
-    if (!style || !style->cssText().length())
+    if (!style || style->cssText().isEmpty())
         return;
 
     if (node->isTextNode()) {
         RefPtr<HTMLElement> styleSpan = createStyleSpanElement(document());
-        insertNodeBefore(styleSpan.get(), node);
         surroundNodeRangeWithElement(node, node, styleSpan.get());
         node = styleSpan.get();
     }
@@ -1105,8 +1152,8 @@ void ApplyStyleCommand::applyTextDecorationStyle(Node *node, CSSMutableStyleDecl
 
     HTMLElement *element = static_cast<HTMLElement *>(node);
         
-    StyleChange styleChange(style, Position(element, 0), StyleChange::styleModeForParseMode(document()->inCompatMode()));
-    if (styleChange.cssStyle().length() > 0) {
+    StyleChange styleChange(style, Position(element, 0));
+    if (styleChange.cssStyle().length()) {
         String cssText = styleChange.cssStyle();
         CSSMutableStyleDeclaration *decl = element->inlineStyleDecl();
         if (decl)
@@ -1115,7 +1162,7 @@ void ApplyStyleCommand::applyTextDecorationStyle(Node *node, CSSMutableStyleDecl
     }
 }
 
-void ApplyStyleCommand::pushDownTextDecorationStyleAroundNode(Node *node, const Position &start, const Position &end, bool force)
+void ApplyStyleCommand::pushDownTextDecorationStyleAroundNode(Node* node, bool force)
 {
     Node *highestAncestor = highestAncestorWithTextDecoration(node);
     
@@ -1152,13 +1199,13 @@ void ApplyStyleCommand::pushDownTextDecorationStyleAtBoundaries(const Position &
     // styles (caused by stylesheets) and explicitly negate text
     // decoration while pushing down.
 
-    pushDownTextDecorationStyleAroundNode(start.node(), start, end, false);
+    pushDownTextDecorationStyleAroundNode(start.node(), false);
     updateLayout();
-    pushDownTextDecorationStyleAroundNode(start.node(), start, end, true);
+    pushDownTextDecorationStyleAroundNode(start.node(), true);
 
-    pushDownTextDecorationStyleAroundNode(end.node(), start, end, false);
+    pushDownTextDecorationStyleAroundNode(end.node(), false);
     updateLayout();
-    pushDownTextDecorationStyleAroundNode(end.node(), start, end, true);
+    pushDownTextDecorationStyleAroundNode(end.node(), true);
 }
 
 static int maxRangeOffset(Node *n)
@@ -1178,7 +1225,7 @@ void ApplyStyleCommand::removeInlineStyle(PassRefPtr<CSSMutableStyleDeclaration>
     ASSERT(end.isNotNull());
     ASSERT(start.node()->inDocument());
     ASSERT(end.node()->inDocument());
-    ASSERT(Range::compareBoundaryPoints(start, end) <= 0);
+    ASSERT(comparePositions(start, end) <= 0);
     
     RefPtr<CSSValue> textDecorationSpecialProperty = style->getPropertyCSSValue(CSSPropertyWebkitTextDecorationsInEffect);
 
@@ -1194,18 +1241,22 @@ void ApplyStyleCommand::removeInlineStyle(PassRefPtr<CSSMutableStyleDeclaration>
     Position s = start;
     Position e = end;
 
-    Node *node = start.node();
+    Node* node = start.node();
     while (node) {
-        Node *next = node->traverseNextNode();
+        Node* next = node->traverseNextNode();
         if (node->isHTMLElement() && nodeFullySelected(node, start, end)) {
-            HTMLElement *elem = static_cast<HTMLElement *>(node);
-            Node *prev = elem->traversePreviousNodePostOrder();
-            Node *next = elem->traverseNextNode();
+            HTMLElement* elem = static_cast<HTMLElement*>(node);
+            Node* prev = elem->traversePreviousNodePostOrder();
+            Node* next = elem->traverseNextNode();
             if (m_styledInlineElement && elem->hasTagName(m_styledInlineElement->tagQName()))
                 removeNodePreservingChildren(elem);
-            if (isHTMLStyleNode(style.get(), elem))
-                removeHTMLStyleNode(elem);
-            else {
+
+            if (implicitlyStyledElementShouldBeRemovedWhenApplyingStyle(elem, style.get()))
+                replaceWithSpanOrRemoveIfWithoutAttributes(elem);
+
+            // If the node was converted to a span, the span may still contain relevant
+            // styles which must be removed (e.g. <b style='font-weight: bold'>)
+            if (elem->inDocument()) {
                 removeHTMLFontStyle(style.get(), elem);
                 removeHTMLBidiEmbeddingStyle(style.get(), elem);
                 removeCSSStyle(style.get(), elem);
@@ -1214,14 +1265,14 @@ void ApplyStyleCommand::removeInlineStyle(PassRefPtr<CSSMutableStyleDeclaration>
                 if (s.node() == elem) {
                     // Since elem must have been fully selected, and it is at the start
                     // of the selection, it is clear we can set the new s offset to 0.
-                    ASSERT(s.offset() <= caretMinOffset(s.node()));
+                    ASSERT(s.deprecatedEditingOffset() <= caretMinOffset(s.node()));
                     s = Position(next, 0);
                 }
                 if (e.node() == elem) {
                     // Since elem must have been fully selected, and it is at the end
                     // of the selection, it is clear we can set the new e offset to
                     // the max range offset of prev.
-                    ASSERT(e.offset() >= maxRangeOffset(e.node()));
+                    ASSERT(e.deprecatedEditingOffset() >= maxRangeOffset(e.node()));
                     e = Position(prev, maxRangeOffset(prev));
                 }
             }
@@ -1242,8 +1293,7 @@ bool ApplyStyleCommand::nodeFullySelected(Node *node, const Position &start, con
     ASSERT(node->isElementNode());
 
     Position pos = Position(node, node->childNodeCount()).upstream();
-    return Range::compareBoundaryPoints(node, 0, start.node(), start.offset()) >= 0 &&
-        Range::compareBoundaryPoints(pos, end) <= 0;
+    return comparePositions(Position(node, 0), start) >= 0 && comparePositions(pos, end) <= 0;
 }
 
 bool ApplyStyleCommand::nodeFullyUnselected(Node *node, const Position &start, const Position &end) const
@@ -1252,8 +1302,8 @@ bool ApplyStyleCommand::nodeFullyUnselected(Node *node, const Position &start, c
     ASSERT(node->isElementNode());
 
     Position pos = Position(node, node->childNodeCount()).upstream();
-    bool isFullyBeforeStart = Range::compareBoundaryPoints(pos, start) < 0;
-    bool isFullyAfterEnd = Range::compareBoundaryPoints(node, 0, end.node(), end.offset()) > 0;
+    bool isFullyBeforeStart = comparePositions(pos, start) < 0;
+    bool isFullyAfterEnd = comparePositions(Position(node, 0), end) > 0;
 
     return isFullyBeforeStart || isFullyAfterEnd;
 }
@@ -1261,11 +1311,11 @@ bool ApplyStyleCommand::nodeFullyUnselected(Node *node, const Position &start, c
 
 bool ApplyStyleCommand::splitTextAtStartIfNeeded(const Position &start, const Position &end)
 {
-    if (start.node()->isTextNode() && start.offset() > caretMinOffset(start.node()) && start.offset() < caretMaxOffset(start.node())) {
-        int endOffsetAdjustment = start.node() == end.node() ? start.offset() : 0;
+    if (start.node()->isTextNode() && start.deprecatedEditingOffset() > caretMinOffset(start.node()) && start.deprecatedEditingOffset() < caretMaxOffset(start.node())) {
+        int endOffsetAdjustment = start.node() == end.node() ? start.deprecatedEditingOffset() : 0;
         Text *text = static_cast<Text *>(start.node());
-        splitTextNode(text, start.offset());
-        updateStartEnd(Position(start.node(), 0), Position(end.node(), end.offset() - endOffsetAdjustment));
+        splitTextNode(text, start.deprecatedEditingOffset());
+        updateStartEnd(Position(start.node(), 0), Position(end.node(), end.deprecatedEditingOffset() - endOffsetAdjustment));
         return true;
     }
     return false;
@@ -1273,15 +1323,15 @@ bool ApplyStyleCommand::splitTextAtStartIfNeeded(const Position &start, const Po
 
 bool ApplyStyleCommand::splitTextAtEndIfNeeded(const Position &start, const Position &end)
 {
-    if (end.node()->isTextNode() && end.offset() > caretMinOffset(end.node()) && end.offset() < caretMaxOffset(end.node())) {
+    if (end.node()->isTextNode() && end.deprecatedEditingOffset() > caretMinOffset(end.node()) && end.deprecatedEditingOffset() < caretMaxOffset(end.node())) {
         Text *text = static_cast<Text *>(end.node());
-        splitTextNode(text, end.offset());
+        splitTextNode(text, end.deprecatedEditingOffset());
         
         Node *prevNode = text->previousSibling();
         ASSERT(prevNode);
         Node *startNode = start.node() == end.node() ? prevNode : start.node();
         ASSERT(startNode);
-        updateStartEnd(Position(startNode, start.offset()), Position(prevNode, caretMaxOffset(prevNode)));
+        updateStartEnd(Position(startNode, start.deprecatedEditingOffset()), Position(prevNode, caretMaxOffset(prevNode)));
         return true;
     }
     return false;
@@ -1289,12 +1339,12 @@ bool ApplyStyleCommand::splitTextAtEndIfNeeded(const Position &start, const Posi
 
 bool ApplyStyleCommand::splitTextElementAtStartIfNeeded(const Position &start, const Position &end)
 {
-    if (start.node()->isTextNode() && start.offset() > caretMinOffset(start.node()) && start.offset() < caretMaxOffset(start.node())) {
-        int endOffsetAdjustment = start.node() == end.node() ? start.offset() : 0;
+    if (start.node()->isTextNode() && start.deprecatedEditingOffset() > caretMinOffset(start.node()) && start.deprecatedEditingOffset() < caretMaxOffset(start.node())) {
+        int endOffsetAdjustment = start.node() == end.node() ? start.deprecatedEditingOffset() : 0;
         Text *text = static_cast<Text *>(start.node());
-        splitTextNodeContainingElement(text, start.offset());
+        splitTextNodeContainingElement(text, start.deprecatedEditingOffset());
 
-        updateStartEnd(Position(start.node()->parentNode(), start.node()->nodeIndex()), Position(end.node(), end.offset() - endOffsetAdjustment));
+        updateStartEnd(Position(start.node()->parentNode(), start.node()->nodeIndex()), Position(end.node(), end.deprecatedEditingOffset() - endOffsetAdjustment));
         return true;
     }
     return false;
@@ -1302,15 +1352,15 @@ bool ApplyStyleCommand::splitTextElementAtStartIfNeeded(const Position &start, c
 
 bool ApplyStyleCommand::splitTextElementAtEndIfNeeded(const Position &start, const Position &end)
 {
-    if (end.node()->isTextNode() && end.offset() > caretMinOffset(end.node()) && end.offset() < caretMaxOffset(end.node())) {
+    if (end.node()->isTextNode() && end.deprecatedEditingOffset() > caretMinOffset(end.node()) && end.deprecatedEditingOffset() < caretMaxOffset(end.node())) {
         Text *text = static_cast<Text *>(end.node());
-        splitTextNodeContainingElement(text, end.offset());
+        splitTextNodeContainingElement(text, end.deprecatedEditingOffset());
 
         Node *prevNode = text->parent()->previousSibling()->lastChild();
         ASSERT(prevNode);
         Node *startNode = start.node() == end.node() ? prevNode : start.node();
         ASSERT(startNode);
-        updateStartEnd(Position(startNode, start.offset()), Position(prevNode->parent(), prevNode->nodeIndex() + 1));
+        updateStartEnd(Position(startNode, start.deprecatedEditingOffset()), Position(prevNode->parent(), prevNode->nodeIndex() + 1));
         return true;
     }
     return false;
@@ -1332,8 +1382,8 @@ static bool areIdenticalElements(Node *first, Node *second)
     if (!firstElement->tagQName().matches(secondElement->tagQName()))
         return false;
 
-    NamedAttrMap *firstMap = firstElement->attributes();
-    NamedAttrMap *secondMap = secondElement->attributes();
+    NamedNodeMap *firstMap = firstElement->attributes();
+    NamedNodeMap *secondMap = secondElement->attributes();
 
     unsigned firstLength = firstMap->length();
 
@@ -1354,10 +1404,10 @@ static bool areIdenticalElements(Node *first, Node *second)
 bool ApplyStyleCommand::mergeStartWithPreviousIfIdentical(const Position &start, const Position &end)
 {
     Node *startNode = start.node();
-    int startOffset = start.offset();
+    int startOffset = start.deprecatedEditingOffset();
 
     if (isAtomicNode(start.node())) {
-        if (start.offset() != 0)
+        if (start.deprecatedEditingOffset() != 0)
             return false;
 
         // note: prior siblings could be unrendered elements. it's silly to miss the
@@ -1386,7 +1436,7 @@ bool ApplyStyleCommand::mergeStartWithPreviousIfIdentical(const Position &start,
 
         int startOffsetAdjustment = startChild->nodeIndex();
         int endOffsetAdjustment = startNode == end.node() ? startOffsetAdjustment : 0;
-        updateStartEnd(Position(startNode, startOffsetAdjustment), Position(end.node(), end.offset() + endOffsetAdjustment)); 
+        updateStartEnd(Position(startNode, startOffsetAdjustment), Position(end.node(), end.deprecatedEditingOffset() + endOffsetAdjustment)); 
         return true;
     }
 
@@ -1396,7 +1446,7 @@ bool ApplyStyleCommand::mergeStartWithPreviousIfIdentical(const Position &start,
 bool ApplyStyleCommand::mergeEndWithNextIfIdentical(const Position &start, const Position &end)
 {
     Node *endNode = end.node();
-    int endOffset = end.offset();
+    int endOffset = end.deprecatedEditingOffset();
 
     if (isAtomicNode(endNode)) {
         if (endOffset < caretMaxOffset(endNode))
@@ -1426,22 +1476,25 @@ bool ApplyStyleCommand::mergeEndWithNextIfIdentical(const Position &start, const
         ASSERT(startNode);
 
         int endOffset = nextChild ? nextChild->nodeIndex() : nextElement->childNodes()->length();
-        updateStartEnd(Position(startNode, start.offset()), Position(nextElement, endOffset));
+        updateStartEnd(Position(startNode, start.deprecatedEditingOffset()), Position(nextElement, endOffset));
         return true;
     }
 
     return false;
 }
 
-void ApplyStyleCommand::surroundNodeRangeWithElement(Node *startNode, Node *endNode, Element *element)
+void ApplyStyleCommand::surroundNodeRangeWithElement(Node* startNode, Node* endNode, PassRefPtr<Element> elementToInsert)
 {
     ASSERT(startNode);
     ASSERT(endNode);
-    ASSERT(element);
+    ASSERT(elementToInsert);
+    RefPtr<Element> element = elementToInsert;
+
+    insertNodeBefore(element, startNode);
     
-    Node *node = startNode;
+    Node* node = startNode;
     while (1) {
-        Node *next = node->traverseNextNode();
+        Node* next = node->traverseNextNode();
         if (node->childNodeCount() == 0 && node->renderer() && node->renderer()->isInline()) {
             removeNode(node);
             appendNode(node, element);
@@ -1452,7 +1505,7 @@ void ApplyStyleCommand::surroundNodeRangeWithElement(Node *startNode, Node *endN
     }
     // FIXME: We should probably call updateStartEnd if the start or end was in the node
     // range so that the endingSelection() is canonicalized.  See the comments at the end of
-    // Selection::validate().
+    // VisibleSelection::validate().
 }
 
 void ApplyStyleCommand::addBlockStyle(const StyleChange& styleChange, HTMLElement* block)
@@ -1500,16 +1553,14 @@ void ApplyStyleCommand::addInlineStyleIfNeeded(CSSMutableStyleDeclaration *style
 {
     if (m_removeOnly)
         return;
-        
-    StyleChange styleChange(style, Position(startNode, 0), StyleChange::styleModeForParseMode(document()->inCompatMode()));
-    ExceptionCode ec = 0;
-    
+
+    StyleChange styleChange(style, Position(startNode, 0));
+
     //
     // Font tags need to go outside of CSS so that CSS font sizes override leagcy font sizes.
     //
     if (styleChange.applyFontColor() || styleChange.applyFontFace() || styleChange.applyFontSize()) {
         RefPtr<Element> fontElement = createFontElement(document());
-        ASSERT(ec == 0);
         RenderStyle* computedStyle = startNode->computedStyle();
 
         // We only want to insert a font element if it will end up changing the style of the
@@ -1518,7 +1569,6 @@ void ApplyStyleCommand::addInlineStyleIfNeeded(CSSMutableStyleDeclaration *style
         if (fontColorChangesComputedStyle(computedStyle, styleChange)
                 || fontFaceChangesComputedStyle(computedStyle, styleChange)
                 || fontSizeChangesComputedStyle(computedStyle, styleChange)) {
-            insertNodeBefore(fontElement.get(), startNode);
             if (styleChange.applyFontColor())
                 fontElement->setAttribute(colorAttr, styleChange.fontColor());
             if (styleChange.applyFontFace())
@@ -1529,32 +1579,25 @@ void ApplyStyleCommand::addInlineStyleIfNeeded(CSSMutableStyleDeclaration *style
         }
     }
 
-    if (styleChange.cssStyle().length() > 0) {
+    if (styleChange.cssStyle().length()) {
         RefPtr<Element> styleElement = createStyleSpanElement(document());
         styleElement->setAttribute(styleAttr, styleChange.cssStyle());
-        insertNodeBefore(styleElement.get(), startNode);
-        surroundNodeRangeWithElement(startNode, endNode, styleElement.get());
+        surroundNodeRangeWithElement(startNode, endNode, styleElement.release());
     }
 
-    if (styleChange.applyBold()) {
-        RefPtr<Element> boldElement = document()->createElementNS(xhtmlNamespaceURI, "b", ec);
-        ASSERT(ec == 0);
-        insertNodeBefore(boldElement.get(), startNode);
-        surroundNodeRangeWithElement(startNode, endNode, boldElement.get());
-    }
+    if (styleChange.applyBold())
+        surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), bTag));
 
-    if (styleChange.applyItalic()) {
-        RefPtr<Element> italicElement = document()->createElementNS(xhtmlNamespaceURI, "i", ec);
-        ASSERT(ec == 0);
-        insertNodeBefore(italicElement.get(), startNode);
-        surroundNodeRangeWithElement(startNode, endNode, italicElement.get());
-    }
-    
-    if (m_styledInlineElement) {
-        RefPtr<Element> clonedElement = m_styledInlineElement->cloneElement();
-        insertNodeBefore(clonedElement.get(), startNode);
-        surroundNodeRangeWithElement(startNode, endNode, clonedElement.get());
-    }
+    if (styleChange.applyItalic())
+        surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), iTag));
+
+    if (styleChange.applySubscript())
+        surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), subTag));
+    else if (styleChange.applySuperscript())
+        surroundNodeRangeWithElement(startNode, endNode, createHTMLElement(document(), supTag));
+
+    if (m_styledInlineElement)
+        surroundNodeRangeWithElement(startNode, endNode, m_styledInlineElement->cloneElementWithoutChildren());
 }
 
 float ApplyStyleCommand::computedFontSize(const Node *node)
@@ -1589,9 +1632,9 @@ void ApplyStyleCommand::joinChildTextNodes(Node *node, const Position &start, co
             Text *childText = static_cast<Text *>(child);
             Text *nextText = static_cast<Text *>(next);
             if (next == start.node())
-                newStart = Position(childText, childText->length() + start.offset());
+                newStart = Position(childText, childText->length() + start.deprecatedEditingOffset());
             if (next == end.node())
-                newEnd = Position(childText, childText->length() + end.offset());
+                newEnd = Position(childText, childText->length() + end.deprecatedEditingOffset());
             String textToMove = nextText->data();
             insertTextIntoNode(childText, childText->length(), textToMove);
             removeNode(next);
diff --git a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.h b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.h
index c646233..74fe605 100644
--- a/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/ApplyStyleCommand.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2005, 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2005, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -62,19 +62,18 @@ private:
     CSSMutableStyleDeclaration* style() const { return m_style.get(); }
 
     // style-removal helpers
-    bool isHTMLStyleNode(CSSMutableStyleDeclaration*, HTMLElement*);
-    void removeHTMLStyleNode(HTMLElement*);
+    bool implicitlyStyledElementShouldBeRemovedWhenApplyingStyle(HTMLElement*, CSSMutableStyleDeclaration*);
+    void replaceWithSpanOrRemoveIfWithoutAttributes(HTMLElement*&);
     void removeHTMLFontStyle(CSSMutableStyleDeclaration*, HTMLElement*);
     void removeHTMLBidiEmbeddingStyle(CSSMutableStyleDeclaration*, HTMLElement*);
     void removeCSSStyle(CSSMutableStyleDeclaration*, HTMLElement*);
-    void removeBlockStyle(CSSMutableStyleDeclaration*, const Position& start, const Position& end);
     void removeInlineStyle(PassRefPtr<CSSMutableStyleDeclaration>, const Position& start, const Position& end);
     bool nodeFullySelected(Node*, const Position& start, const Position& end) const;
     bool nodeFullyUnselected(Node*, const Position& start, const Position& end) const;
     PassRefPtr<CSSMutableStyleDeclaration> extractTextDecorationStyle(Node*);
     PassRefPtr<CSSMutableStyleDeclaration> extractAndNegateTextDecorationStyle(Node*);
     void applyTextDecorationStyle(Node*, CSSMutableStyleDeclaration *style);
-    void pushDownTextDecorationStyleAroundNode(Node*, const Position& start, const Position& end, bool force);
+    void pushDownTextDecorationStyleAroundNode(Node*, bool force);
     void pushDownTextDecorationStyleAtBoundaries(const Position& start, const Position& end);
     
     // style-application helpers
@@ -92,7 +91,7 @@ private:
     bool mergeEndWithNextIfIdentical(const Position& start, const Position& end);
     void cleanupUnstyledAppleStyleSpans(Node* dummySpanAncestor);
 
-    void surroundNodeRangeWithElement(Node* start, Node* end, Element* element);
+    void surroundNodeRangeWithElement(Node* start, Node* end, PassRefPtr<Element>);
     float computedFontSize(const Node*);
     void joinChildTextNodes(Node*, const Position& start, const Position& end);
 
diff --git a/src/3rdparty/webkit/WebCore/editing/BreakBlockquoteCommand.cpp b/src/3rdparty/webkit/WebCore/editing/BreakBlockquoteCommand.cpp
index 76a0890..4f3949d 100644
--- a/src/3rdparty/webkit/WebCore/editing/BreakBlockquoteCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/BreakBlockquoteCommand.cpp
@@ -26,12 +26,12 @@
 #include "config.h"
 #include "BreakBlockquoteCommand.h"
 
-#include "Element.h"
+#include "HTMLElement.h"
 #include "HTMLNames.h"
+#include "RenderListItem.h"
 #include "Text.h"
 #include "VisiblePosition.h"
 #include "htmlediting.h"
-#include "RenderListItem.h"
 
 namespace WebCore {
 
@@ -56,48 +56,67 @@ void BreakBlockquoteCommand::doApply()
     // be in the first node that we need to move (there are a few exceptions to this, see below).
     Position pos = endingSelection().start().downstream();
     
-    // startNode is the first node that we need to move to the new blockquote.
-    Node* startNode = pos.node();
     // Find the top-most blockquote from the start.
     Element* topBlockquote = 0;
-    for (Node *node = startNode->parentNode(); node; node = node->parentNode()) {
+    for (Node *node = pos.node()->parentNode(); node; node = node->parentNode()) {
         if (isMailBlockquote(node))
             topBlockquote = static_cast<Element*>(node);
     }
     if (!topBlockquote || !topBlockquote->parentNode())
         return;
     
-    // Insert a break after the top blockquote.
     RefPtr<Element> breakNode = createBreakElement(document());
-    insertNodeAfter(breakNode.get(), topBlockquote);
-    
-    if (isLastVisiblePositionInNode(visiblePos, topBlockquote)) {
-        setEndingSelection(Selection(Position(breakNode.get(), 0), DOWNSTREAM));
+
+    bool isLastVisPosInNode = isLastVisiblePositionInNode(visiblePos, topBlockquote);
+
+    // If the position is at the beginning of the top quoted content, we don't need to break the quote.
+    // Instead, insert the break before the blockquote, unless the position is as the end of the the quoted content.
+    if (isFirstVisiblePositionInNode(visiblePos, topBlockquote) && !isLastVisPosInNode) {
+        insertNodeBefore(breakNode.get(), topBlockquote);
+        setEndingSelection(VisibleSelection(Position(breakNode.get(), 0), DOWNSTREAM));
         rebalanceWhitespace();   
         return;
     }
     
+    // Insert a break after the top blockquote.
+    insertNodeAfter(breakNode.get(), topBlockquote);
+
+    // If we're inserting the break at the end of the quoted content, we don't need to break the quote.
+    if (isLastVisPosInNode) {
+        setEndingSelection(VisibleSelection(Position(breakNode.get(), 0), DOWNSTREAM));
+        rebalanceWhitespace();
+        return;
+    }
+    
     // Don't move a line break just after the caret.  Doing so would create an extra, empty paragraph
     // in the new blockquote.
-    if (lineBreakExistsAtPosition(visiblePos))
+    if (lineBreakExistsAtVisiblePosition(visiblePos))
         pos = pos.next();
         
+    // Adjust the position so we don't split at the beginning of a quote.  
+    while (isFirstVisiblePositionInNode(VisiblePosition(pos), nearestMailBlockquote(pos.node())))
+        pos = pos.previous();
+    
+    // startNode is the first node that we need to move to the new blockquote.
+    Node* startNode = pos.node();
+        
     // Split at pos if in the middle of a text node.
     if (startNode->isTextNode()) {
         Text* textNode = static_cast<Text*>(startNode);
-        if ((unsigned)pos.offset() >= textNode->length()) {
+        if ((unsigned)pos.deprecatedEditingOffset() >= textNode->length()) {
             startNode = startNode->traverseNextNode();
             ASSERT(startNode);
-        } else if (pos.offset() > 0)
-            splitTextNode(textNode, pos.offset());
-    } else if (pos.offset() > 0) {
-        startNode = startNode->traverseNextNode();
+        } else if (pos.deprecatedEditingOffset() > 0)
+            splitTextNode(textNode, pos.deprecatedEditingOffset());
+    } else if (pos.deprecatedEditingOffset() > 0) {
+        Node* childAtOffset = startNode->childNode(pos.deprecatedEditingOffset());
+        startNode = childAtOffset ? childAtOffset : startNode->traverseNextNode();
         ASSERT(startNode);
     }
     
     // If there's nothing inside topBlockquote to move, we're finished.
     if (!startNode->isDescendantOf(topBlockquote)) {
-        setEndingSelection(Selection(VisiblePosition(Position(startNode, 0))));
+        setEndingSelection(VisibleSelection(VisiblePosition(Position(startNode, 0))));
         return;
     }
     
@@ -107,7 +126,7 @@ void BreakBlockquoteCommand::doApply()
         ancestors.append(node);
     
     // Insert a clone of the top blockquote after the break.
-    RefPtr<Element> clonedBlockquote = topBlockquote->cloneElement();
+    RefPtr<Element> clonedBlockquote = topBlockquote->cloneElementWithoutChildren();
     insertNodeAfter(clonedBlockquote.get(), breakNode.get());
     
     // Clone startNode's ancestors into the cloned blockquote.
@@ -116,7 +135,7 @@ void BreakBlockquoteCommand::doApply()
     // or clonedBlockquote if ancestors is empty).
     RefPtr<Element> clonedAncestor = clonedBlockquote;
     for (size_t i = ancestors.size(); i != 0; --i) {
-        RefPtr<Element> clonedChild = ancestors[i - 1]->cloneElement(); // shallow clone
+        RefPtr<Element> clonedChild = ancestors[i - 1]->cloneElementWithoutChildren();
         // Preserve list item numbering in cloned lists.
         if (clonedChild->isElementNode() && clonedChild->hasTagName(olTag)) {
             Node* listChildNode = i > 1 ? ancestors[i - 2] : startNode;
@@ -141,10 +160,7 @@ void BreakBlockquoteCommand::doApply()
         moveNode = next;
     }
 
-    // Hold open startNode's original parent if we emptied it
     if (!ancestors.isEmpty()) {
-        addBlockPlaceholderIfNeeded(ancestors.first());
-
         // Split the tree up the ancestor chain until the topBlockquote
         // Throughout this loop, clonedParent is the clone of ancestor's parent.
         // This is so we can clone ancestor's siblings and place the clones
@@ -162,13 +178,18 @@ void BreakBlockquoteCommand::doApply()
                 moveNode = next;
             }
         }
+        
+        // If the startNode's original parent is now empty, remove it
+        Node* originalParent = ancestors.first();
+        if (!originalParent->hasChildNodes())
+            removeNode(originalParent);
     }
     
     // Make sure the cloned block quote renders.
     addBlockPlaceholderIfNeeded(clonedBlockquote.get());
     
     // Put the selection right before the break.
-    setEndingSelection(Selection(Position(breakNode.get(), 0), DOWNSTREAM));
+    setEndingSelection(VisibleSelection(Position(breakNode.get(), 0), DOWNSTREAM));
     rebalanceWhitespace();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp b/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp
index d75aa82..8e4f950 100644
--- a/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.cpp
@@ -36,7 +36,7 @@
 #include "Document.h"
 #include "DocumentFragment.h"
 #include "EditorInsertAction.h"
-#include "Element.h"
+#include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "InlineTextBox.h"
 #include "InsertIntoTextNodeCommand.h"
@@ -50,7 +50,10 @@
 #include "RemoveCSSPropertyCommand.h"
 #include "RemoveNodeCommand.h"
 #include "RemoveNodePreservingChildrenCommand.h"
+#include "ReplaceNodeWithSpanCommand.h"
 #include "ReplaceSelectionCommand.h"
+#include "RenderBlock.h"
+#include "RenderText.h"
 #include "SetNodeAttributeCommand.h"
 #include "SplitElementCommand.h"
 #include "SplitTextNodeCommand.h"
@@ -155,7 +158,7 @@ void CompositeEditCommand::insertNodeAt(PassRefPtr<Node> insertChild, const Posi
     // likewise for replaced elements, brs, etc.
     Position p = rangeCompliantEquivalent(editingPosition);
     Node* refChild = p.node();
-    int offset = p.offset();
+    int offset = p.deprecatedEditingOffset();
     
     if (canHaveChildrenForEditing(refChild)) {
         Node* child = refChild->firstChild();
@@ -165,14 +168,17 @@ void CompositeEditCommand::insertNodeAt(PassRefPtr<Node> insertChild, const Posi
             insertNodeBefore(insertChild, child);
         else
             appendNode(insertChild, static_cast<Element*>(refChild));
-    } else if (caretMinOffset(refChild) >= offset) {
+    } else if (caretMinOffset(refChild) >= offset)
         insertNodeBefore(insertChild, refChild);
-    } else if (refChild->isTextNode() && caretMaxOffset(refChild) > offset) {
+    else if (refChild->isTextNode() && caretMaxOffset(refChild) > offset) {
         splitTextNode(static_cast<Text *>(refChild), offset);
+
+        // Mutation events (bug 22634) from the text node insertion may have removed the refChild
+        if (!refChild->inDocument())
+            return;
         insertNodeBefore(insertChild, refChild);
-    } else {
+    } else
         insertNodeAfter(insertChild, refChild);
-    }
 }
 
 void CompositeEditCommand::appendNode(PassRefPtr<Node> node, PassRefPtr<Element> parent)
@@ -210,6 +216,20 @@ void CompositeEditCommand::removeNodeAndPruneAncestors(PassRefPtr<Node> node)
     prune(parent.release());
 }
 
+HTMLElement* CompositeEditCommand::replaceNodeWithSpanPreservingChildrenAndAttributes(PassRefPtr<Node> node)
+{
+    // It would also be possible to implement all of ReplaceNodeWithSpanCommand
+    // as a series of existing smaller edit commands.  Someone who wanted to
+    // reduce the number of edit commands could do so here.
+    RefPtr<ReplaceNodeWithSpanCommand> command = ReplaceNodeWithSpanCommand::create(node);
+    applyCommandToComposite(command);
+    // Returning a raw pointer here is OK because the command is retained by
+    // applyCommandToComposite (thus retaining the span), and the span is also
+    // in the DOM tree, and thus alive whie it has a parent.
+    ASSERT(command->spanElement()->inDocument());
+    return command->spanElement();
+}
+
 static bool hasARenderedDescendant(Node* node)
 {
     Node* n = node->firstChild();
@@ -295,7 +315,7 @@ void CompositeEditCommand::inputText(const String& text, bool selectInsertedText
     
     if (selectInsertedText) {
         RefPtr<Range> selectedRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), startIndex, length);
-        setEndingSelection(Selection(selectedRange.get()));
+        setEndingSelection(VisibleSelection(selectedRange.get()));
     }
 }
 
@@ -322,13 +342,13 @@ Position CompositeEditCommand::positionOutsideTabSpan(const Position& pos)
     
     Node* tabSpan = tabSpanNode(pos.node());
     
-    if (pos.offset() <= caretMinOffset(pos.node()))
+    if (pos.deprecatedEditingOffset() <= caretMinOffset(pos.node()))
         return positionBeforeNode(tabSpan);
         
-    if (pos.offset() >= caretMaxOffset(pos.node()))
+    if (pos.deprecatedEditingOffset() >= caretMaxOffset(pos.node()))
         return positionAfterNode(tabSpan);
 
-    splitTextNodeContainingElement(static_cast<Text *>(pos.node()), pos.offset());
+    splitTextNodeContainingElement(static_cast<Text *>(pos.node()), pos.deprecatedEditingOffset());
     return positionBeforeNode(tabSpan);
 }
 
@@ -344,7 +364,7 @@ void CompositeEditCommand::deleteSelection(bool smartDelete, bool mergeBlocksAft
         applyCommandToComposite(DeleteSelectionCommand::create(document(), smartDelete, mergeBlocksAfterDelete, replace, expandForSpecialElements));
 }
 
-void CompositeEditCommand::deleteSelection(const Selection &selection, bool smartDelete, bool mergeBlocksAfterDelete, bool replace, bool expandForSpecialElements)
+void CompositeEditCommand::deleteSelection(const VisibleSelection &selection, bool smartDelete, bool mergeBlocksAfterDelete, bool replace, bool expandForSpecialElements)
 {
     if (selection.isRange())
         applyCommandToComposite(DeleteSelectionCommand::create(selection, smartDelete, mergeBlocksAfterDelete, replace, expandForSpecialElements));
@@ -357,7 +377,7 @@ void CompositeEditCommand::removeCSSProperty(PassRefPtr<CSSMutableStyleDeclarati
 
 void CompositeEditCommand::removeNodeAttribute(PassRefPtr<Element> element, const QualifiedName& attribute)
 {
-    setNodeAttribute(element, attribute, AtomicString());;
+    setNodeAttribute(element, attribute, AtomicString());
 }
 
 void CompositeEditCommand::setNodeAttribute(PassRefPtr<Element> element, const QualifiedName& attribute, const AtomicString& value)
@@ -387,7 +407,7 @@ void CompositeEditCommand::rebalanceWhitespaceAt(const Position& position)
     String text = textNode->data();
     ASSERT(!text.isEmpty());
 
-    int offset = position.offset();
+    int offset = position.deprecatedEditingOffset();
     // If neither text[offset] nor text[offset - 1] are some form of whitespace, do nothing.
     if (!isWhitespace(text[offset])) {
         offset--;
@@ -444,14 +464,14 @@ void CompositeEditCommand::prepareWhitespaceAtPositionForSplit(Position& positio
     Position previous(previousVisiblePos.deepEquivalent());
     
     if (isCollapsibleWhitespace(previousVisiblePos.characterAfter()) && previous.node()->isTextNode() && !previous.node()->hasTagName(brTag))
-        replaceTextInNode(static_cast<Text*>(previous.node()), previous.offset(), 1, nonBreakingSpaceString());
+        replaceTextInNode(static_cast<Text*>(previous.node()), previous.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
     if (isCollapsibleWhitespace(visiblePos.characterAfter()) && position.node()->isTextNode() && !position.node()->hasTagName(brTag))
-        replaceTextInNode(static_cast<Text*>(position.node()), position.offset(), 1, nonBreakingSpaceString());
+        replaceTextInNode(static_cast<Text*>(position.node()), position.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
 }
 
 void CompositeEditCommand::rebalanceWhitespace()
 {
-    Selection selection = endingSelection();
+    VisibleSelection selection = endingSelection();
     if (selection.isNone())
         return;
         
@@ -465,7 +485,7 @@ void CompositeEditCommand::deleteInsignificantText(PassRefPtr<Text> textNode, un
     if (!textNode || start >= end)
         return;
 
-    RenderText* textRenderer = static_cast<RenderText*>(textNode->renderer());
+    RenderText* textRenderer = toRenderText(textNode->renderer());
     if (!textRenderer)
         return;
 
@@ -487,12 +507,12 @@ void CompositeEditCommand::deleteInsignificantText(PassRefPtr<Text> textNode, un
     // This loop structure works to process all gaps preceding a box,
     // and also will look at the gap after the last box.
     while (prevBox || box) {
-        unsigned gapStart = prevBox ? prevBox->m_start + prevBox->m_len : 0;
+        unsigned gapStart = prevBox ? prevBox->start() + prevBox->len() : 0;
         if (end < gapStart)
             // No more chance for any intersections
             break;
 
-        unsigned gapEnd = box ? box->m_start : length;
+        unsigned gapEnd = box ? box->start() : length;
         bool indicesIntersect = start <= gapEnd && end >= gapStart;
         int gapLen = gapEnd - gapStart;
         if (indicesIntersect && gapLen > 0) {
@@ -529,7 +549,7 @@ void CompositeEditCommand::deleteInsignificantText(const Position& start, const
     if (start.isNull() || end.isNull())
         return;
 
-    if (Range::compareBoundaryPoints(start, end) >= 0)
+    if (comparePositions(start, end) >= 0)
         return;
 
     Node* next;
@@ -537,8 +557,8 @@ void CompositeEditCommand::deleteInsignificantText(const Position& start, const
         next = node->traverseNextNode();
         if (node->isTextNode()) {
             Text* textNode = static_cast<Text*>(node);
-            int startOffset = node == start.node() ? start.offset() : 0;
-            int endOffset = node == end.node() ? end.offset() : textNode->length();
+            int startOffset = node == start.node() ? start.deprecatedEditingOffset() : 0;
+            int endOffset = node == end.node() ? end.deprecatedEditingOffset() : textNode->length();
             deleteInsignificantText(textNode, startOffset, endOffset);
         }
         if (node == end.node())
@@ -591,30 +611,25 @@ PassRefPtr<Node> CompositeEditCommand::addBlockPlaceholderIfNeeded(Element* cont
     
     // append the placeholder to make sure it follows
     // any unrendered blocks
-    if (renderer->height() == 0 || (renderer->isListItem() && renderer->isEmpty()))
+    RenderBlock* block = toRenderBlock(renderer);
+    if (block->height() == 0 || (block->isListItem() && block->isEmpty()))
         return appendBlockPlaceholder(container);
 
     return 0;
 }
 
-// Removes '\n's and brs that will collapse when content is inserted just before them.
-// FIXME: We shouldn't really have to remove placeholders, but removing them is a workaround for 9661.
-void CompositeEditCommand::removePlaceholderAt(const VisiblePosition& visiblePosition)
+// Assumes that the position is at a placeholder and does the removal without much checking.
+void CompositeEditCommand::removePlaceholderAt(const Position& p)
 {
-    if (visiblePosition.isNull())
+    ASSERT(lineBreakExistsAtPosition(p));
+    
+    // We are certain that the position is at a line break, but it may be a br or a preserved newline.
+    if (p.anchorNode()->hasTagName(brTag)) {
+        removeNode(p.anchorNode());
         return;
-        
-    Position p = visiblePosition.deepEquivalent().downstream();
-    // If a br or '\n' is at the end of a block and not at the start of a paragraph,
-    // then it is superfluous, so adding content before a br or '\n' that is at
-    // the start of a paragraph will render it superfluous.
-    // FIXME: This doesn't remove placeholders at the end of anonymous blocks.
-    if (isEndOfBlock(visiblePosition) && isStartOfParagraph(visiblePosition)) {
-        if (p.node()->hasTagName(brTag) && p.offset() == 0)
-            removeNode(p.node());
-        else if (lineBreakExistsAtPosition(visiblePosition))
-            deleteTextFromNode(static_cast<Text*>(p.node()), p.offset(), 1);
     }
+    
+    deleteTextFromNode(static_cast<Text*>(p.anchorNode()), p.offsetInContainerNode(), 1);
 }
 
 PassRefPtr<Node> CompositeEditCommand::insertNewDefaultParagraphElementAt(const Position& position)
@@ -648,18 +663,17 @@ PassRefPtr<Node> CompositeEditCommand::moveParagraphContentsToNewBlockIfNecessar
 
     // If there are no VisiblePositions in the same block as pos then 
     // upstreamStart will be outside the paragraph
-    if (Range::compareBoundaryPoints(pos, upstreamStart) < 0)
+    if (comparePositions(pos, upstreamStart) < 0)
         return 0;
 
     // Perform some checks to see if we need to perform work in this function.
     if (isBlock(upstreamStart.node())) {
-        // If the block is the body element, always move content to a new block, so that
-        // we avoid adding styles to the body element, since Mail's Make Plain Text feature
-        // can't handle those.
-        if (upstreamStart.node()->hasTagName(bodyTag)) {
-            // If the block is the body element and there is nothing insde of it, create a new
-            // block but don't try and move content into it, since there's nothing to move.
-            if (upstreamStart == upstreamEnd)
+        // If the block is the root editable element, always move content to a new block,
+        // since it is illegal to modify attributes on the root editable element for editing.
+        if (upstreamStart.node() == editableRootForPosition(upstreamStart)) {
+            // If the block is the root editable element and it contains no visible content, create a new
+            // block but don't try and move content into it, since there's nothing for moveParagraphs to move.
+            if (!Position::hasRenderedNonAnonymousDescendantsWithHeight(upstreamStart.node()->renderer()))
                 return insertNewDefaultParagraphElementAt(upstreamStart);
         } else if (isBlock(upstreamEnd.node())) {
             if (!upstreamEnd.node()->isDescendantOf(upstreamStart.node())) {
@@ -694,7 +708,7 @@ void CompositeEditCommand::pushAnchorElementDown(Node* anchorNode)
     
     ASSERT(anchorNode->isLink());
     
-    setEndingSelection(Selection::selectionFromContentsOfNode(anchorNode));
+    setEndingSelection(VisibleSelection::selectionFromContentsOfNode(anchorNode));
     applyStyledElement(static_cast<Element*>(anchorNode));
     // Clones of anchorNode have been pushed down, now remove it.
     if (anchorNode->inDocument())
@@ -707,7 +721,7 @@ void CompositeEditCommand::pushAnchorElementDown(Node* anchorNode)
 // Anchors cannot be nested.
 void CompositeEditCommand::pushPartiallySelectedAnchorElementsDown()
 {
-    Selection originalSelection = endingSelection();
+    VisibleSelection originalSelection = endingSelection();
     VisiblePosition visibleStart(originalSelection.start());
     VisiblePosition visibleEnd(originalSelection.end());
     
@@ -745,12 +759,12 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
         VisiblePosition visibleStart = endingSelection().visibleStart();
         VisiblePosition visibleEnd = endingSelection().visibleEnd();
         
-        bool startAfterParagraph = Range::compareBoundaryPoints(visibleStart.deepEquivalent(), endOfParagraphToMove.deepEquivalent()) > 0;
-        bool endBeforeParagraph = Range::compareBoundaryPoints(visibleEnd.deepEquivalent(), startOfParagraphToMove.deepEquivalent()) < 0;
+        bool startAfterParagraph = comparePositions(visibleStart, endOfParagraphToMove) > 0;
+        bool endBeforeParagraph = comparePositions(visibleEnd, startOfParagraphToMove) < 0;
         
         if (!startAfterParagraph && !endBeforeParagraph) {
-            bool startInParagraph = Range::compareBoundaryPoints(visibleStart.deepEquivalent(), startOfParagraphToMove.deepEquivalent()) >= 0;
-            bool endInParagraph = Range::compareBoundaryPoints(visibleEnd.deepEquivalent(), endOfParagraphToMove.deepEquivalent()) <= 0;
+            bool startInParagraph = comparePositions(visibleStart, startOfParagraphToMove) >= 0;
+            bool endInParagraph = comparePositions(visibleEnd, endOfParagraphToMove) <= 0;
             
             startIndex = 0;
             if (startInParagraph) {
@@ -777,7 +791,7 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
     // start and end can't be used directly to create a Range; they are "editing positions"
     Position startRangeCompliant = rangeCompliantEquivalent(start);
     Position endRangeCompliant = rangeCompliantEquivalent(end);
-    RefPtr<Range> range = Range::create(document(), startRangeCompliant.node(), startRangeCompliant.offset(), endRangeCompliant.node(), endRangeCompliant.offset());
+    RefPtr<Range> range = Range::create(document(), startRangeCompliant.node(), startRangeCompliant.deprecatedEditingOffset(), endRangeCompliant.node(), endRangeCompliant.deprecatedEditingOffset());
 
     // FIXME: This is an inefficient way to preserve style on nodes in the paragraph to move.  It 
     // shouldn't matter though, since moved paragraphs will usually be quite small.
@@ -795,7 +809,7 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
     
     // FIXME (5098931): We should add a new insert action "WebViewInsertActionMoved" and call shouldInsertFragment here.
     
-    setEndingSelection(Selection(start, end, DOWNSTREAM));
+    setEndingSelection(VisibleSelection(start, end, DOWNSTREAM));
     deleteSelection(false, false, false, false);
 
     ASSERT(destination.deepEquivalent().node()->inDocument());
@@ -820,13 +834,13 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
         // expects this behavior).
         else if (isBlock(node))
             removeNodeAndPruneAncestors(node);
-        else if (lineBreakExistsAtPosition(caretAfterDelete)) {
+        else if (lineBreakExistsAtVisiblePosition(caretAfterDelete)) {
             // There is a preserved '\n' at caretAfterDelete.
             Text* textNode = static_cast<Text*>(node);
             if (textNode->length() == 1)
                 removeNodeAndPruneAncestors(node);
             else 
-                deleteTextFromNode(textNode, position.offset(), 1);
+                deleteTextFromNode(textNode, position.deprecatedEditingOffset(), 1);
         }
     }
 
@@ -851,8 +865,10 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
     
     setEndingSelection(destination);
     applyCommandToComposite(ReplaceSelectionCommand::create(document(), fragment, true, false, !preserveStyle, false, true));
-    // Restore styles from an empty paragraph to the new empty paragraph.
-    if (styleInEmptyParagraph)
+    
+    // If the selection is in an empty paragraph, restore styles from the old empty paragraph to the new empty paragraph.
+    bool selectionIsEmptyParagraph = endingSelection().isCaret() && isStartOfParagraph(endingSelection().visibleStart()) && isEndOfParagraph(endingSelection().visibleStart());
+    if (styleInEmptyParagraph && selectionIsEmptyParagraph)
         applyStyle(styleInEmptyParagraph.get());
     
     if (preserveSelection && startIndex != -1) {
@@ -864,7 +880,7 @@ void CompositeEditCommand::moveParagraphs(const VisiblePosition& startOfParagrap
         RefPtr<Range> start = TextIterator::rangeFromLocationAndLength(document()->documentElement(), destinationIndex + startIndex, 0, true);
         RefPtr<Range> end = TextIterator::rangeFromLocationAndLength(document()->documentElement(), destinationIndex + endIndex, 0, true);
         if (start && end)
-            setEndingSelection(Selection(start->startPosition(), end->startPosition(), DOWNSTREAM));
+            setEndingSelection(VisibleSelection(start->startPosition(), end->startPosition(), DOWNSTREAM));
     }
 }
 
@@ -895,7 +911,7 @@ bool CompositeEditCommand::breakOutOfEmptyListItem()
     }
     
     appendBlockPlaceholder(newBlock);
-    setEndingSelection(Selection(Position(newBlock.get(), 0), DOWNSTREAM));
+    setEndingSelection(VisibleSelection(Position(newBlock.get(), 0), DOWNSTREAM));
     
     computedStyle(endingSelection().start().node())->diff(style.get());
     if (style->length() > 0)
@@ -933,10 +949,10 @@ bool CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph()
     // a second one.
     if (!isStartOfParagraph(atBR))
         insertNodeBefore(createBreakElement(document()), br);
-    setEndingSelection(Selection(atBR));
+    setEndingSelection(VisibleSelection(atBR));
     
     // If this is an empty paragraph there must be a line break here.
-    if (!lineBreakExistsAtPosition(caret))
+    if (!lineBreakExistsAtVisiblePosition(caret))
         return false;
     
     Position caretPos(caret.deepEquivalent());
@@ -948,7 +964,7 @@ bool CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph()
         removeNode(caretPos.node());
         prune(beforeBR.node());
     } else {
-        ASSERT(caretPos.offset() == 0);
+        ASSERT(caretPos.deprecatedEditingOffset() == 0);
         Text* textNode = static_cast<Text*>(caretPos.node());
         Node* parentNode = textNode->parentNode();
         // The preserved newline must be the first thing in the node, since otherwise the previous
@@ -972,10 +988,14 @@ Position CompositeEditCommand::positionAvoidingSpecialElementBoundary(const Posi
     VisiblePosition visiblePos(original);
     Node* enclosingAnchor = enclosingAnchorElement(original);
     Position result = original;
+
+    if (!enclosingAnchor)
+        return result;
+
     // Don't avoid block level anchors, because that would insert content into the wrong paragraph.
     if (enclosingAnchor && !isBlock(enclosingAnchor)) {
-        VisiblePosition firstInAnchor(Position(enclosingAnchor, 0));
-        VisiblePosition lastInAnchor(Position(enclosingAnchor, maxDeepOffset(enclosingAnchor)));
+        VisiblePosition firstInAnchor(firstDeepEditingPositionForNode(enclosingAnchor));
+        VisiblePosition lastInAnchor(lastDeepEditingPositionForNode(enclosingAnchor));
         // If visually just after the anchor, insert *inside* the anchor unless it's the last 
         // VisiblePosition in the document, to match NSTextView.
         if (visiblePos == lastInAnchor) {
@@ -990,7 +1010,7 @@ Position CompositeEditCommand::positionAvoidingSpecialElementBoundary(const Posi
             // Don't insert outside an anchor if doing so would skip over a line break.  It would
             // probably be safe to move the line break so that we could still avoid the anchor here.
             Position downstream(visiblePos.deepEquivalent().downstream());
-            if (lineBreakExistsAtPosition(visiblePos) && downstream.node()->isDescendantOf(enclosingAnchor))
+            if (lineBreakExistsAtVisiblePosition(visiblePos) && downstream.node()->isDescendantOf(enclosingAnchor))
                 return original;
             
             result = positionAfterNode(enclosingAnchor);
@@ -1004,6 +1024,9 @@ Position CompositeEditCommand::positionAvoidingSpecialElementBoundary(const Posi
                 pushAnchorElementDown(enclosingAnchor);
                 enclosingAnchor = enclosingAnchorElement(original);
             }
+            if (!enclosingAnchor)
+                return original;
+
             result = positionBeforeNode(enclosingAnchor);
         }
     }
@@ -1025,16 +1048,16 @@ PassRefPtr<Node> CompositeEditCommand::splitTreeToNode(Node* start, Node* end, b
         if (positionInParent != positionInNode)
             applyCommandToComposite(SplitElementCommand::create(static_cast<Element*>(node->parent()), node));
     }
-    if (splitAncestor)
-        return splitTreeToNode(end, end->parent());
+    if (splitAncestor) {
+        splitElement(static_cast<Element*>(end), node);
+        return node->parent();
+    }
     return node.release();
 }
 
 PassRefPtr<Element> createBlockPlaceholderElement(Document* document)
 {
-    ExceptionCode ec = 0;
-    RefPtr<Element> breakNode = document->createElementNS(xhtmlNamespaceURI, "br", ec);
-    ASSERT(ec == 0);
+    RefPtr<Element> breakNode = document->createElement(brTag, false);
     return breakNode.release();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.h b/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.h
index 6bb142b..2c6403e 100644
--- a/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/CompositeEditCommand.h
@@ -33,6 +33,7 @@
 namespace WebCore {
 
 class CSSStyleDeclaration;
+class HTMLElement;
 class Text;
 
 class CompositeEditCommand : public EditCommand {
@@ -52,7 +53,7 @@ protected:
     void applyStyledElement(PassRefPtr<Element>);
     void removeStyledElement(PassRefPtr<Element>);
     void deleteSelection(bool smartDelete = false, bool mergeBlocksAfterDelete = true, bool replace = false, bool expandForSpecialElements = true);
-    void deleteSelection(const Selection&, bool smartDelete = false, bool mergeBlocksAfterDelete = true, bool replace = false, bool expandForSpecialElements = true);
+    void deleteSelection(const VisibleSelection&, bool smartDelete = false, bool mergeBlocksAfterDelete = true, bool replace = false, bool expandForSpecialElements = true);
     virtual void deleteTextFromNode(PassRefPtr<Text>, unsigned offset, unsigned count);
     void inputText(const String&, bool selectInsertedText = false);
     void insertNodeAfter(PassRefPtr<Node>, PassRefPtr<Node> refChild);
@@ -71,6 +72,7 @@ protected:
     void removeNodeAttribute(PassRefPtr<Element>, const QualifiedName& attribute);
     void removeChildrenInRange(PassRefPtr<Node>, unsigned from, unsigned to);
     virtual void removeNode(PassRefPtr<Node>);
+    HTMLElement* replaceNodeWithSpanPreservingChildrenAndAttributes(PassRefPtr<Node>);
     void removeNodePreservingChildren(PassRefPtr<Node>);
     void removeNodeAndPruneAncestors(PassRefPtr<Node>);
     void prune(PassRefPtr<Node>);
@@ -89,7 +91,7 @@ protected:
     PassRefPtr<Node> appendBlockPlaceholder(PassRefPtr<Element>);
     PassRefPtr<Node> insertBlockPlaceholder(const Position&);
     PassRefPtr<Node> addBlockPlaceholderIfNeeded(Element*);
-    void removePlaceholderAt(const VisiblePosition&);
+    void removePlaceholderAt(const Position&);
 
     PassRefPtr<Node> insertNewDefaultParagraphElementAt(const Position&);
 
diff --git a/src/3rdparty/webkit/WebCore/editing/CreateLinkCommand.cpp b/src/3rdparty/webkit/WebCore/editing/CreateLinkCommand.cpp
index c5d68dd..263feab 100644
--- a/src/3rdparty/webkit/WebCore/editing/CreateLinkCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/CreateLinkCommand.cpp
@@ -53,7 +53,7 @@ void CreateLinkCommand::doApply()
         insertNodeAt(anchorElement.get(), endingSelection().start());
         RefPtr<Text> textNode = new Text(document(), m_url);
         appendNode(textNode.get(), anchorElement.get());
-        setEndingSelection(Selection(positionBeforeNode(anchorElement.get()), positionAfterNode(anchorElement.get()), DOWNSTREAM));
+        setEndingSelection(VisibleSelection(positionBeforeNode(anchorElement.get()), positionAfterNode(anchorElement.get()), DOWNSTREAM));
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.cpp b/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.cpp
index e1832c3..725c01d 100644
--- a/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,7 +42,7 @@
 #include "Node.h"
 #include "Range.h"
 #include "RemoveNodeCommand.h"
-#include "RenderObject.h"
+#include "RenderBox.h"
 #include "SelectionController.h"
 
 namespace WebCore {
@@ -66,42 +66,86 @@ static bool isDeletableElement(const Node* node)
     if (!node || !node->isHTMLElement() || !node->inDocument() || !node->isContentEditable())
         return false;
 
-    const int minimumWidth = 25;
-    const int minimumHeight = 25;
-    const unsigned minimumVisibleBorders = 3;
+    // In general we want to only draw the UI arround object of a certain area, but we still keep the min width/height to
+    // make sure we don't end up with very thin or very short elements getting the UI.
+    const int minimumArea = 2500;
+    const int minimumWidth = 48;
+    const int minimumHeight = 16;
+    const unsigned minimumVisibleBorders = 1;
 
     RenderObject* renderer = node->renderer();
-    if (!renderer || renderer->width() < minimumWidth || renderer->height() < minimumHeight)
+    if (!renderer || !renderer->isBox())
+        return false;
+
+    // Disallow the body element since it isn't practical to delete, and the deletion UI would be clipped.
+    if (node->hasTagName(bodyTag))
+        return false;
+
+    // Disallow elements with any overflow clip, since the deletion UI would be clipped as well. <rdar://problem/6840161>
+    if (renderer->hasOverflowClip())
+        return false;
+
+    // Disallow Mail blockquotes since the deletion UI would get in the way of editing for these.
+    if (isMailBlockquote(node))
+        return false;
+
+    RenderBox* box = toRenderBox(renderer);
+    IntRect borderBoundingBox = box->borderBoundingBox();
+    if (borderBoundingBox.width() < minimumWidth || borderBoundingBox.height() < minimumHeight)
+        return false;
+
+    if ((borderBoundingBox.width() * borderBoundingBox.height()) < minimumArea)
         return false;
 
     if (renderer->isTable())
         return true;
 
-    if (node->hasTagName(ulTag) || node->hasTagName(olTag))
+    if (node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(iframeTag))
         return true;
 
     if (renderer->isPositioned())
         return true;
 
-    // allow block elements (excluding table cells) that have some non-transparent borders
     if (renderer->isRenderBlock() && !renderer->isTableCell()) {
         RenderStyle* style = renderer->style();
-        if (style && style->hasBorder()) {
-            unsigned visibleBorders = style->borderTop().isVisible() + style->borderBottom().isVisible() + style->borderLeft().isVisible() + style->borderRight().isVisible();
-            if (visibleBorders >= minimumVisibleBorders)
-                return true;
-        }
+        if (!style)
+            return false;
+
+        // Allow blocks that have background images
+        if (style->hasBackgroundImage() && style->backgroundImage()->canRender(1.0f))
+            return true;
+
+        // Allow blocks with a minimum number of non-transparent borders
+        unsigned visibleBorders = style->borderTop().isVisible() + style->borderBottom().isVisible() + style->borderLeft().isVisible() + style->borderRight().isVisible();
+        if (visibleBorders >= minimumVisibleBorders)
+            return true;
+
+        // Allow blocks that have a different background from it's parent
+        Node* parentNode = node->parentNode();
+        if (!parentNode)
+            return false;
+
+        RenderObject* parentRenderer = parentNode->renderer();
+        if (!parentRenderer)
+            return false;
+
+        RenderStyle* parentStyle = parentRenderer->style();
+        if (!parentStyle)
+            return false;
+
+        if (style->hasBackground() && (!parentStyle->hasBackground() || style->backgroundColor() != parentStyle->backgroundColor()))
+            return true;
     }
 
     return false;
 }
 
-static HTMLElement* enclosingDeletableElement(const Selection& selection)
+static HTMLElement* enclosingDeletableElement(const VisibleSelection& selection)
 {
     if (!selection.isContentEditable())
         return 0;
 
-    RefPtr<Range> range = selection.toRange();
+    RefPtr<Range> range = selection.toNormalizedRange();
     if (!range)
         return 0;
 
@@ -123,7 +167,7 @@ static HTMLElement* enclosingDeletableElement(const Selection& selection)
     return static_cast<HTMLElement*>(element);
 }
 
-void DeleteButtonController::respondToChangedSelection(const Selection& oldSelection)
+void DeleteButtonController::respondToChangedSelection(const VisibleSelection& oldSelection)
 {
     if (!enabled())
         return;
@@ -149,6 +193,13 @@ void DeleteButtonController::createDeletionUI()
     style->setProperty(CSSPropertyWebkitUserDrag, CSSValueNone);
     style->setProperty(CSSPropertyWebkitUserSelect, CSSValueNone);
     style->setProperty(CSSPropertyWebkitUserModify, CSSValueNone);
+    style->setProperty(CSSPropertyVisibility, CSSValueHidden);
+    style->setProperty(CSSPropertyPosition, CSSValueAbsolute);
+    style->setProperty(CSSPropertyCursor, CSSValueDefault);
+    style->setProperty(CSSPropertyTop, "0");
+    style->setProperty(CSSPropertyRight, "0");
+    style->setProperty(CSSPropertyBottom, "0");
+    style->setProperty(CSSPropertyLeft, "0");
 
     RefPtr<HTMLDivElement> outline = new HTMLDivElement(divTag, m_target->document());
     outline->setId(outlineElementIdentifier);
@@ -158,17 +209,14 @@ void DeleteButtonController::createDeletionUI()
 
     style = outline->getInlineStyleDecl();
     style->setProperty(CSSPropertyPosition, CSSValueAbsolute);
-    style->setProperty(CSSPropertyCursor, CSSValueDefault);
-    style->setProperty(CSSPropertyWebkitUserDrag, CSSValueNone);
-    style->setProperty(CSSPropertyWebkitUserSelect, CSSValueNone);
-    style->setProperty(CSSPropertyWebkitUserModify, CSSValueNone);
     style->setProperty(CSSPropertyZIndex, String::number(-1000000));
-    style->setProperty(CSSPropertyTop, String::number(-borderWidth - m_target->renderer()->borderTop()) + "px");
-    style->setProperty(CSSPropertyRight, String::number(-borderWidth - m_target->renderer()->borderRight()) + "px");
-    style->setProperty(CSSPropertyBottom, String::number(-borderWidth - m_target->renderer()->borderBottom()) + "px");
-    style->setProperty(CSSPropertyLeft, String::number(-borderWidth - m_target->renderer()->borderLeft()) + "px");
+    style->setProperty(CSSPropertyTop, String::number(-borderWidth - m_target->renderBox()->borderTop()) + "px");
+    style->setProperty(CSSPropertyRight, String::number(-borderWidth - m_target->renderBox()->borderRight()) + "px");
+    style->setProperty(CSSPropertyBottom, String::number(-borderWidth - m_target->renderBox()->borderBottom()) + "px");
+    style->setProperty(CSSPropertyLeft, String::number(-borderWidth - m_target->renderBox()->borderLeft()) + "px");
     style->setProperty(CSSPropertyBorder, String::number(borderWidth) + "px solid rgba(0, 0, 0, 0.6)");
     style->setProperty(CSSPropertyWebkitBorderRadius, String::number(borderRadius) + "px");
+    style->setProperty(CSSPropertyVisibility, CSSValueVisible);
 
     ExceptionCode ec = 0;
     container->appendChild(outline.get(), ec);
@@ -185,15 +233,12 @@ void DeleteButtonController::createDeletionUI()
 
     style = button->getInlineStyleDecl();
     style->setProperty(CSSPropertyPosition, CSSValueAbsolute);
-    style->setProperty(CSSPropertyCursor, CSSValueDefault);
-    style->setProperty(CSSPropertyWebkitUserDrag, CSSValueNone);
-    style->setProperty(CSSPropertyWebkitUserSelect, CSSValueNone);
-    style->setProperty(CSSPropertyWebkitUserModify, CSSValueNone);
     style->setProperty(CSSPropertyZIndex, String::number(1000000));
-    style->setProperty(CSSPropertyTop, String::number((-buttonHeight / 2) - m_target->renderer()->borderTop() - (borderWidth / 2) + buttonBottomShadowOffset) + "px");
-    style->setProperty(CSSPropertyLeft, String::number((-buttonWidth / 2) - m_target->renderer()->borderLeft() - (borderWidth / 2)) + "px");
+    style->setProperty(CSSPropertyTop, String::number((-buttonHeight / 2) - m_target->renderBox()->borderTop() - (borderWidth / 2) + buttonBottomShadowOffset) + "px");
+    style->setProperty(CSSPropertyLeft, String::number((-buttonWidth / 2) - m_target->renderBox()->borderLeft() - (borderWidth / 2)) + "px");
     style->setProperty(CSSPropertyWidth, String::number(buttonWidth) + "px");
     style->setProperty(CSSPropertyHeight, String::number(buttonHeight) + "px");
+    style->setProperty(CSSPropertyVisibility, CSSValueVisible);
 
     RefPtr<Image> buttonImage = Image::loadPlatformResource("deleteButton");
     if (buttonImage->isNull())
@@ -278,8 +323,13 @@ void DeleteButtonController::enable()
     ASSERT(m_disableStack > 0);
     if (m_disableStack > 0)
         m_disableStack--;
-    if (enabled())
+    if (enabled()) {
+        // Determining if the element is deletable currently depends on style
+        // because whether something is editable depends on style, so we need
+        // to recalculate style before calling enclosingDeletableElement.
+        m_frame->document()->updateStyleIfNeeded();
         show(enclosingDeletableElement(m_frame->selection()->selection()));
+    }
 }
 
 void DeleteButtonController::disable()
diff --git a/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.h b/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.h
index ab2d0b0..713ae8b 100644
--- a/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.h
+++ b/src/3rdparty/webkit/WebCore/editing/DeleteButtonController.h
@@ -34,7 +34,7 @@ class DeleteButton;
 class Frame;
 class HTMLElement;
 class RenderObject;
-class Selection;
+class VisibleSelection;
 
 class DeleteButtonController {
 public:
@@ -45,7 +45,7 @@ public:
     HTMLElement* target() const { return m_target.get(); }
     HTMLElement* containerElement() const { return m_containerElement.get(); }
 
-    void respondToChangedSelection(const Selection& oldSelection);
+    void respondToChangedSelection(const VisibleSelection& oldSelection);
 
     void show(HTMLElement*);
     void hide();
diff --git a/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.cpp b/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.cpp
index 738ce64..5a0d8fc 100644
--- a/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "DeleteSelectionCommand.h"
 
+#include "CSSMutableStyleDeclaration.h"
 #include "Document.h"
 #include "DocumentFragment.h"
 #include "Editor.h"
@@ -38,6 +39,7 @@
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
 #include "markup.h"
+#include "RenderTableCell.h"
 #include "ReplaceSelectionCommand.h"
 #include "Text.h"
 #include "TextIterator.h"
@@ -55,9 +57,7 @@ static bool isTableRow(const Node* node)
 static bool isTableCellEmpty(Node* cell)
 {
     ASSERT(isTableCell(cell));
-    VisiblePosition firstInCell(Position(cell, 0));
-    VisiblePosition lastInCell(Position(cell, maxDeepOffset(cell)));
-    return firstInCell == lastInCell;
+    return VisiblePosition(firstDeepEditingPositionForNode(cell)) == VisiblePosition(lastDeepEditingPositionForNode(cell));
 }
 
 static bool isTableRowEmpty(Node* row)
@@ -80,6 +80,7 @@ DeleteSelectionCommand::DeleteSelectionCommand(Document *document, bool smartDel
       m_replace(replace),
       m_expandForSpecialElements(expandForSpecialElements),
       m_pruneStartBlockIfNecessary(false),
+      m_startsAtEmptyLine(false),
       m_startBlock(0),
       m_endBlock(0),
       m_typingStyle(0),
@@ -87,7 +88,7 @@ DeleteSelectionCommand::DeleteSelectionCommand(Document *document, bool smartDel
 {
 }
 
-DeleteSelectionCommand::DeleteSelectionCommand(const Selection& selection, bool smartDelete, bool mergeBlocksAfterDelete, bool replace, bool expandForSpecialElements)
+DeleteSelectionCommand::DeleteSelectionCommand(const VisibleSelection& selection, bool smartDelete, bool mergeBlocksAfterDelete, bool replace, bool expandForSpecialElements)
     : CompositeEditCommand(selection.start().node()->document()), 
       m_hasSelectionToDelete(true), 
       m_smartDelete(smartDelete), 
@@ -95,6 +96,7 @@ DeleteSelectionCommand::DeleteSelectionCommand(const Selection& selection, bool
       m_replace(replace),
       m_expandForSpecialElements(expandForSpecialElements),
       m_pruneStartBlockIfNecessary(false),
+      m_startsAtEmptyLine(false),
       m_selectionToDelete(selection),
       m_startBlock(0),
       m_endBlock(0),
@@ -136,11 +138,12 @@ void DeleteSelectionCommand::initializeStartEnd(Position& start, Position& end)
             break;
         
         // If we're going to expand to include the startSpecialContainer, it must be fully selected.
-        if (startSpecialContainer && !endSpecialContainer && Range::compareBoundaryPoints(positionAfterNode(startSpecialContainer), end) > -1)
+
+        if (startSpecialContainer && !endSpecialContainer && comparePositions(positionAfterNode(startSpecialContainer), end) > -1)
             break;
 
-        // If we're going to expand to include the endSpecialContainer, it must be fully selected.         
-        if (endSpecialContainer && !startSpecialContainer && Range::compareBoundaryPoints(start, positionBeforeNode(endSpecialContainer)) > -1)
+        // If we're going to expand to include the endSpecialContainer, it must be fully selected.
+        if (endSpecialContainer && !startSpecialContainer && comparePositions(start, positionBeforeNode(endSpecialContainer)) > -1)
             break;
         
         if (startSpecialContainer && startSpecialContainer->isDescendantOf(endSpecialContainer))
@@ -196,7 +199,11 @@ void DeleteSelectionCommand::initializePositionData()
     // selections that contain a whole number paragraphs plus a line break, since it is unclear to most users 
     // that such a selection actually ends at the start of the next paragraph. This matches TextEdit behavior 
     // for indented paragraphs.
-    if (numEnclosingMailBlockquotes(start) != numEnclosingMailBlockquotes(end) && isStartOfParagraph(visibleEnd) && isStartOfParagraph(VisiblePosition(start))) {
+    // Only apply this rule if the endingSelection is a range selection.  If it is a caret, then other operations have created
+    // the selection we're deleting (like the process of creating a selection to delete during a backspace), and the user isn't in the situation described above.
+    if (numEnclosingMailBlockquotes(start) != numEnclosingMailBlockquotes(end) 
+            && isStartOfParagraph(visibleEnd) && isStartOfParagraph(VisiblePosition(start)) 
+            && endingSelection().isRange()) {
         m_mergeBlocksAfterDelete = false;
         m_pruneStartBlockIfNecessary = true;
     }
@@ -300,7 +307,7 @@ bool DeleteSelectionCommand::handleSpecialCaseBRDelete()
     // Not a special-case delete per se, but we can detect that the merging of content between blocks
     // should not be done.
     if (upstreamStartIsBR && downstreamStartIsBR) {
-        m_mergeBlocksAfterDelete = false;
+        m_startsAtEmptyLine = true;
         m_endingPosition = m_downstreamEnd;
     }
     
@@ -311,8 +318,8 @@ static void updatePositionForNodeRemoval(Node* node, Position& position)
 {
     if (position.isNull())
         return;
-    if (node->parent() == position.node() && node->nodeIndex() < (unsigned)position.offset())
-        position = Position(position.node(), position.offset() - 1);
+    if (node->parent() == position.node() && node->nodeIndex() < (unsigned)position.deprecatedEditingOffset())
+        position = Position(position.node(), position.deprecatedEditingOffset() - 1);
     if (position.node() == node || position.node()->isDescendantOf(node))
         position = positionBeforeNode(node);
 }
@@ -357,14 +364,14 @@ void DeleteSelectionCommand::removeNode(PassRefPtr<Node> node)
         // make sure empty cell has some height
         updateLayout();
         RenderObject *r = node->renderer();
-        if (r && r->isTableCell() && r->contentHeight() <= 0)
+        if (r && r->isTableCell() && static_cast<RenderTableCell*>(r)->contentHeight() <= 0)
             insertBlockPlaceholder(Position(node,0));
         return;
     }
     
-    if (node == m_startBlock && !isEndOfBlock(VisiblePosition(m_startBlock.get(), 0, DOWNSTREAM).previous()))
+    if (node == m_startBlock && !isEndOfBlock(VisiblePosition(firstDeepEditingPositionForNode(m_startBlock.get())).previous()))
         m_needPlaceholder = true;
-    else if (node == m_endBlock && !isStartOfBlock(VisiblePosition(m_endBlock.get(), maxDeepOffset(m_endBlock.get()), DOWNSTREAM).next()))
+    else if (node == m_endBlock && !isStartOfBlock(VisiblePosition(lastDeepEditingPositionForNode(m_startBlock.get())).next()))
         m_needPlaceholder = true;
     
     // FIXME: Update the endpoints of the range being deleted.
@@ -375,13 +382,12 @@ void DeleteSelectionCommand::removeNode(PassRefPtr<Node> node)
     CompositeEditCommand::removeNode(node);
 }
 
-
-void updatePositionForTextRemoval(Node* node, int offset, int count, Position& position)
+static void updatePositionForTextRemoval(Node* node, int offset, int count, Position& position)
 {
     if (position.node() == node) {
-        if (position.offset() > offset + count)
-            position = Position(position.node(), position.offset() - count);
-        else if (position.offset() > offset)
+        if (position.deprecatedEditingOffset() > offset + count)
+            position = Position(position.node(), position.deprecatedEditingOffset() - count);
+        else if (position.deprecatedEditingOffset() > offset)
             position = Position(position.node(), offset);
     }
 }
@@ -392,13 +398,14 @@ void DeleteSelectionCommand::deleteTextFromNode(PassRefPtr<Text> node, unsigned
     updatePositionForTextRemoval(node.get(), offset, count, m_endingPosition);
     updatePositionForTextRemoval(node.get(), offset, count, m_leadingWhitespace);
     updatePositionForTextRemoval(node.get(), offset, count, m_trailingWhitespace);
+    updatePositionForTextRemoval(node.get(), offset, count, m_downstreamEnd);
     
     CompositeEditCommand::deleteTextFromNode(node, offset, count);
 }
 
 void DeleteSelectionCommand::handleGeneralDelete()
 {
-    int startOffset = m_upstreamStart.offset();
+    int startOffset = m_upstreamStart.deprecatedEditingOffset();
     Node* startNode = m_upstreamStart.node();
     
     // Never remove the start block unless it's a table, in which case we won't merge content in.
@@ -413,7 +420,7 @@ void DeleteSelectionCommand::handleGeneralDelete()
             deleteTextFromNode(text, caretMaxOffset(startNode), text->length() - caretMaxOffset(startNode));
     }
 
-    if (startOffset >= maxDeepOffset(startNode)) {
+    if (startOffset >= lastOffsetForEditing(startNode)) {
         startNode = startNode->traverseNextSibling();
         startOffset = 0;
     }
@@ -424,17 +431,16 @@ void DeleteSelectionCommand::handleGeneralDelete()
 
     if (startNode == m_downstreamEnd.node()) {
         // The selection to delete is all in one node.
-        if (!startNode->renderer() || 
-            (startOffset == 0 && m_downstreamEnd.offset() >= maxDeepOffset(startNode))) {
+        if (!startNode->renderer() || (startOffset == 0 && m_downstreamEnd.atLastEditingPositionForNode())) {
             // just delete
             removeNode(startNode);
-        } else if (m_downstreamEnd.offset() - startOffset > 0) {
+        } else if (m_downstreamEnd.deprecatedEditingOffset() - startOffset > 0) {
             if (startNode->isTextNode()) {
                 // in a text node that needs to be trimmed
-                Text *text = static_cast<Text *>(startNode);
-                deleteTextFromNode(text, startOffset, m_downstreamEnd.offset() - startOffset);
+                Text* text = static_cast<Text*>(startNode);
+                deleteTextFromNode(text, startOffset, m_downstreamEnd.deprecatedEditingOffset() - startOffset);
             } else {
-                removeChildrenInRange(startNode, startOffset, m_downstreamEnd.offset());
+                removeChildrenInRange(startNode, startOffset, m_downstreamEnd.deprecatedEditingOffset());
                 m_endingPosition = m_upstreamStart;
             }
         }
@@ -457,7 +463,7 @@ void DeleteSelectionCommand::handleGeneralDelete()
         
         // handle deleting all nodes that are completely selected
         while (node && node != m_downstreamEnd.node()) {
-            if (Range::compareBoundaryPoints(Position(node.get(), 0), m_downstreamEnd) >= 0) {
+            if (comparePositions(Position(node.get(), 0), m_downstreamEnd) >= 0) {
                 // traverseNextSibling just blew past the end position, so stop deleting
                 node = 0;
             } else if (!m_downstreamEnd.node()->isDescendantOf(node.get())) {
@@ -465,14 +471,14 @@ void DeleteSelectionCommand::handleGeneralDelete()
                 // if we just removed a node from the end container, update end position so the
                 // check above will work
                 if (node->parentNode() == m_downstreamEnd.node()) {
-                    ASSERT(node->nodeIndex() < (unsigned)m_downstreamEnd.offset());
-                    m_downstreamEnd = Position(m_downstreamEnd.node(), m_downstreamEnd.offset() - 1);
+                    ASSERT(node->nodeIndex() < (unsigned)m_downstreamEnd.deprecatedEditingOffset());
+                    m_downstreamEnd = Position(m_downstreamEnd.node(), m_downstreamEnd.deprecatedEditingOffset() - 1);
                 }
                 removeNode(node.get());
                 node = nextNode.get();
             } else {
                 Node* n = node->lastDescendant();
-                if (m_downstreamEnd.node() == n && m_downstreamEnd.offset() >= caretMaxOffset(n)) {
+                if (m_downstreamEnd.node() == n && m_downstreamEnd.deprecatedEditingOffset() >= caretMaxOffset(n)) {
                     removeNode(node.get());
                     node = 0;
                 } else
@@ -480,17 +486,16 @@ void DeleteSelectionCommand::handleGeneralDelete()
             }
         }
         
-        if (m_downstreamEnd.node() != startNode && !m_upstreamStart.node()->isDescendantOf(m_downstreamEnd.node()) && m_downstreamEnd.node()->inDocument() && m_downstreamEnd.offset() >= caretMinOffset(m_downstreamEnd.node())) {
-            if (m_downstreamEnd.offset() >= maxDeepOffset(m_downstreamEnd.node()) && !canHaveChildrenForEditing(m_downstreamEnd.node())) {
+        if (m_downstreamEnd.node() != startNode && !m_upstreamStart.node()->isDescendantOf(m_downstreamEnd.node()) && m_downstreamEnd.node()->inDocument() && m_downstreamEnd.deprecatedEditingOffset() >= caretMinOffset(m_downstreamEnd.node())) {
+            if (m_downstreamEnd.atLastEditingPositionForNode() && !canHaveChildrenForEditing(m_downstreamEnd.node())) {
                 // The node itself is fully selected, not just its contents.  Delete it.
                 removeNode(m_downstreamEnd.node());
             } else {
                 if (m_downstreamEnd.node()->isTextNode()) {
                     // in a text node that needs to be trimmed
                     Text *text = static_cast<Text *>(m_downstreamEnd.node());
-                    if (m_downstreamEnd.offset() > 0) {
-                        deleteTextFromNode(text, 0, m_downstreamEnd.offset());
-                        m_downstreamEnd = Position(text, 0);
+                    if (m_downstreamEnd.deprecatedEditingOffset() > 0) {
+                        deleteTextFromNode(text, 0, m_downstreamEnd.deprecatedEditingOffset());
                     }
                 // Remove children of m_downstreamEnd.node() that come after m_upstreamStart.
                 // Don't try to remove children if m_upstreamStart was inside m_downstreamEnd.node()
@@ -507,7 +512,7 @@ void DeleteSelectionCommand::handleGeneralDelete()
                         if (n)
                             offset = n->nodeIndex() + 1;
                     }
-                    removeChildrenInRange(m_downstreamEnd.node(), offset, m_downstreamEnd.offset());
+                    removeChildrenInRange(m_downstreamEnd.node(), offset, m_downstreamEnd.deprecatedEditingOffset());
                     m_downstreamEnd = Position(m_downstreamEnd.node(), offset);
                 }
             }
@@ -522,12 +527,12 @@ void DeleteSelectionCommand::fixupWhitespace()
     if (m_leadingWhitespace.isNotNull() && !m_leadingWhitespace.isRenderedCharacter()) {
         Text* textNode = static_cast<Text*>(m_leadingWhitespace.node());
         ASSERT(!textNode->renderer() || textNode->renderer()->style()->collapseWhiteSpace());
-        replaceTextInNode(textNode, m_leadingWhitespace.offset(), 1, nonBreakingSpaceString());
+        replaceTextInNode(textNode, m_leadingWhitespace.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
     }
     if (m_trailingWhitespace.isNotNull() && !m_trailingWhitespace.isRenderedCharacter()) {
         Text* textNode = static_cast<Text*>(m_trailingWhitespace.node());
         ASSERT(!textNode->renderer() ||textNode->renderer()->style()->collapseWhiteSpace());
-        replaceTextInNode(textNode, m_trailingWhitespace.offset(), 1, nonBreakingSpaceString());
+        replaceTextInNode(textNode, m_trailingWhitespace.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
     }
 }
 
@@ -540,7 +545,7 @@ void DeleteSelectionCommand::mergeParagraphs()
             // Make sure that the ending position isn't inside the block we're about to prune.
             m_endingPosition = m_downstreamEnd;
             // We aren't going to merge into the start block, so remove it if it's empty.
-            prune(m_upstreamStart.node());
+            prune(m_startBlock);
             // Removing the start block during a deletion is usually an indication that we need
             // a placeholder, but not in this case.
             m_needPlaceholder = false;
@@ -556,12 +561,11 @@ void DeleteSelectionCommand::mergeParagraphs()
          return;
          
     // FIXME: The deletion algorithm shouldn't let this happen.
-    if (Range::compareBoundaryPoints(m_upstreamStart, m_downstreamEnd) > 0)
+    if (comparePositions(m_upstreamStart, m_downstreamEnd) > 0)
         return;
         
-    // FIXME: Merging will always be unnecessary in this case, but we really bail here because this is a case where
-    // deletion commonly fails to adjust its endpoints, which would cause the visible position comparison below to false negative.
-    if (m_endBlock == m_startBlock)
+    // There's nothing to merge.
+    if (m_upstreamStart == m_downstreamEnd)
         return;
         
     VisiblePosition startOfParagraphToMove(m_downstreamEnd);
@@ -576,7 +580,7 @@ void DeleteSelectionCommand::mergeParagraphs()
     }
     
     // We need to merge into m_upstreamStart's block, but it's been emptied out and collapsed by deletion.
-    if (!mergeDestination.deepEquivalent().node() || !mergeDestination.deepEquivalent().node()->isDescendantOf(m_upstreamStart.node()->enclosingBlockFlowElement())) {
+    if (!mergeDestination.deepEquivalent().node() || !mergeDestination.deepEquivalent().node()->isDescendantOf(m_upstreamStart.node()->enclosingBlockFlowElement()) || m_startsAtEmptyLine) {
         insertNodeAt(createBreakElement(document()).get(), m_upstreamStart);
         mergeDestination = VisiblePosition(m_upstreamStart);
     }
@@ -591,8 +595,7 @@ void DeleteSelectionCommand::mergeParagraphs()
     
     // The rule for merging into an empty block is: only do so if its farther to the right.
     // FIXME: Consider RTL.
-    // FIXME: handleSpecialCaseBRDelete prevents us from getting here in a case like <ul><li>foo<br><br></li></ul>^foo
-    if (isStartOfParagraph(mergeDestination) && startOfParagraphToMove.absoluteCaretBounds().x() > mergeDestination.absoluteCaretBounds().x()) {
+    if (!m_startsAtEmptyLine && isStartOfParagraph(mergeDestination) && startOfParagraphToMove.absoluteCaretBounds().x() > mergeDestination.absoluteCaretBounds().x()) {
         ASSERT(mergeDestination.deepEquivalent().downstream().node()->hasTagName(brTag));
         removeNodeAndPruneAncestors(mergeDestination.deepEquivalent().downstream().node());
         m_endingPosition = startOfParagraphToMove.deepEquivalent();
@@ -674,7 +677,7 @@ void DeleteSelectionCommand::calculateTypingStyleAfterDelete()
     if (m_typingStyle && 
         isStartOfParagraph(visibleEnd) &&
         isEndOfParagraph(visibleEnd) &&
-        lineBreakExistsAtPosition(visibleEnd)) {
+        lineBreakExistsAtVisiblePosition(visibleEnd)) {
         // Apply style to the placeholder that is now holding open the empty paragraph. 
         // This makes sure that the paragraph has the right height, and that the paragraph 
         // takes on the right style and retains it even if you move the selection away and
@@ -696,7 +699,7 @@ void DeleteSelectionCommand::calculateTypingStyleAfterDelete()
 
 void DeleteSelectionCommand::clearTransientState()
 {
-    m_selectionToDelete = Selection();
+    m_selectionToDelete = VisibleSelection();
     m_upstreamStart.clear();
     m_downstreamStart.clear();
     m_upstreamEnd.clear();
@@ -732,7 +735,7 @@ void DeleteSelectionCommand::doApply()
     Position downstreamEnd = m_selectionToDelete.end().downstream();
     m_needPlaceholder = isStartOfParagraph(m_selectionToDelete.visibleStart()) &&
                         isEndOfParagraph(m_selectionToDelete.visibleEnd()) &&
-                        !lineBreakExistsAtPosition(m_selectionToDelete.visibleEnd());
+                        !lineBreakExistsAtVisiblePosition(m_selectionToDelete.visibleEnd());
     if (m_needPlaceholder) {
         // Don't need a placeholder when deleting a selection that starts just before a table
         // and ends inside it (we do need placeholders to hold open empty cells, but that's
@@ -755,7 +758,7 @@ void DeleteSelectionCommand::doApply()
     // want to replace it with a placeholder BR!
     if (handleSpecialCaseBRDelete()) {
         calculateTypingStyleAfterDelete();
-        setEndingSelection(Selection(m_endingPosition, affinity));
+        setEndingSelection(VisibleSelection(m_endingPosition, affinity));
         clearTransientState();
         rebalanceWhitespace();
         return;
@@ -778,7 +781,7 @@ void DeleteSelectionCommand::doApply()
 
     calculateTypingStyleAfterDelete();
     
-    setEndingSelection(Selection(m_endingPosition, affinity));
+    setEndingSelection(VisibleSelection(m_endingPosition, affinity));
     clearTransientState();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.h b/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.h
index 0f9f2f7..c8872ef 100644
--- a/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/DeleteSelectionCommand.h
@@ -36,14 +36,14 @@ public:
     {
         return adoptRef(new DeleteSelectionCommand(document, smartDelete, mergeBlocksAfterDelete, replace, expandForSpecialElements));
     }
-    static PassRefPtr<DeleteSelectionCommand> create(const Selection& selection, bool smartDelete = false, bool mergeBlocksAfterDelete = true, bool replace = false, bool expandForSpecialElements = false)
+    static PassRefPtr<DeleteSelectionCommand> create(const VisibleSelection& selection, bool smartDelete = false, bool mergeBlocksAfterDelete = true, bool replace = false, bool expandForSpecialElements = false)
     {
         return adoptRef(new DeleteSelectionCommand(selection, smartDelete, mergeBlocksAfterDelete, replace, expandForSpecialElements));
     }
 
 private:
     DeleteSelectionCommand(Document*, bool smartDelete, bool mergeBlocksAfterDelete, bool replace, bool expandForSpecialElements);
-    DeleteSelectionCommand(const Selection&, bool smartDelete, bool mergeBlocksAfterDelete, bool replace, bool expandForSpecialElements);
+    DeleteSelectionCommand(const VisibleSelection&, bool smartDelete, bool mergeBlocksAfterDelete, bool replace, bool expandForSpecialElements);
 
     virtual void doApply();
     virtual EditAction editingAction() const;
@@ -72,9 +72,10 @@ private:
     bool m_replace;
     bool m_expandForSpecialElements;
     bool m_pruneStartBlockIfNecessary;
+    bool m_startsAtEmptyLine;
 
     // This data is transient and should be cleared at the end of the doApply function.
-    Selection m_selectionToDelete;
+    VisibleSelection m_selectionToDelete;
     Position m_upstreamStart;
     Position m_downstreamStart;
     Position m_upstreamEnd;
@@ -90,6 +91,7 @@ private:
     RefPtr<Node> m_endRoot;
     RefPtr<Node> m_startTableRow;
     RefPtr<Node> m_endTableRow;
+    RefPtr<Node> m_temporaryPlaceholder;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/editing/EditCommand.cpp b/src/3rdparty/webkit/WebCore/editing/EditCommand.cpp
index 7ec0c19..fefe658 100644
--- a/src/3rdparty/webkit/WebCore/editing/EditCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/EditCommand.cpp
@@ -47,8 +47,7 @@ EditCommand::EditCommand(Document* document)
 {
     ASSERT(m_document);
     ASSERT(m_document->frame());
-    DeleteButtonController* deleteButton = m_document->frame()->editor()->deleteButtonController();
-    setStartingSelection(avoidIntersectionWithNode(m_document->frame()->selection()->selection(), deleteButton ? deleteButton->containerElement() : 0));
+    setStartingSelection(avoidIntersectionWithNode(m_document->frame()->selection()->selection(), m_document->frame()->editor()->deleteButtonController()->containerElement()));
     setEndingSelection(m_startingSelection);
 }
 
@@ -94,7 +93,10 @@ void EditCommand::apply()
 
     if (!m_parent) {
         updateLayout();
-        frame->editor()->appliedEditing(this);
+        // Only need to call appliedEditing for top-level commands, and TypingCommands do it on their
+        // own (see TypingCommand::typingAddedToOpenCommand).
+        if (!isTypingCommand())
+            frame->editor()->appliedEditing(this);
     }
 }
 
@@ -158,7 +160,7 @@ EditAction EditCommand::editingAction() const
     return EditActionUnspecified;
 }
 
-void EditCommand::setStartingSelection(const Selection& s)
+void EditCommand::setStartingSelection(const VisibleSelection& s)
 {
     Element* root = s.rootEditableElement();
     for (EditCommand* cmd = this; ; cmd = cmd->m_parent) {
@@ -169,7 +171,7 @@ void EditCommand::setStartingSelection(const Selection& s)
     }
 }
 
-void EditCommand::setEndingSelection(const Selection &s)
+void EditCommand::setEndingSelection(const VisibleSelection &s)
 {
     Element* root = s.rootEditableElement();
     for (EditCommand* cmd = this; cmd; cmd = cmd->m_parent) {
diff --git a/src/3rdparty/webkit/WebCore/editing/EditCommand.h b/src/3rdparty/webkit/WebCore/editing/EditCommand.h
index 78490f8..c4969f6 100644
--- a/src/3rdparty/webkit/WebCore/editing/EditCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/EditCommand.h
@@ -28,7 +28,7 @@
 
 #include "EditAction.h"
 #include "Element.h"
-#include "Selection.h"
+#include "VisibleSelection.h"
 
 namespace WebCore {
 
@@ -47,8 +47,8 @@ public:
 
     virtual EditAction editingAction() const;
 
-    const Selection& startingSelection() const { return m_startingSelection; }
-    const Selection& endingSelection() const { return m_endingSelection; }
+    const VisibleSelection& startingSelection() const { return m_startingSelection; }
+    const VisibleSelection& endingSelection() const { return m_endingSelection; }
 
     Element* startingRootEditableElement() const { return m_startingRootEditableElement.get(); }
     Element* endingRootEditableElement() const { return m_endingRootEditableElement.get(); }
@@ -63,8 +63,8 @@ protected:
 
     Document* document() const { return m_document.get(); }
 
-    void setStartingSelection(const Selection&);
-    void setEndingSelection(const Selection&);
+    void setStartingSelection(const VisibleSelection&);
+    void setEndingSelection(const VisibleSelection&);
 
     PassRefPtr<CSSMutableStyleDeclaration> styleAtPosition(const Position&);
     void updateLayout() const;
@@ -75,8 +75,8 @@ private:
     virtual void doReapply(); // calls doApply()
 
     RefPtr<Document> m_document;
-    Selection m_startingSelection;
-    Selection m_endingSelection;
+    VisibleSelection m_startingSelection;
+    VisibleSelection m_endingSelection;
     RefPtr<Element> m_startingRootEditableElement;
     RefPtr<Element> m_endingRootEditableElement;
     CompositeEditCommand* m_parent;
diff --git a/src/3rdparty/webkit/WebCore/editing/Editor.cpp b/src/3rdparty/webkit/WebCore/editing/Editor.cpp
index ce0bcd2..2ad5cce 100644
--- a/src/3rdparty/webkit/WebCore/editing/Editor.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/Editor.cpp
@@ -29,7 +29,10 @@
 
 #include "AXObjectCache.h"
 #include "ApplyStyleCommand.h"
+#include "CharacterNames.h"
+#include "CreateLinkCommand.h"
 #include "CSSComputedStyleDeclaration.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
@@ -65,6 +68,7 @@
 #include "htmlediting.h"
 #include "markup.h"
 #include "visible_units.h"
+#include <wtf/UnusedParam.h>
 
 namespace WebCore {
 
@@ -73,9 +77,9 @@ using namespace HTMLNames;
 
 // When an event handler has moved the selection outside of a text control
 // we should use the target control's selection for this editing operation.
-Selection Editor::selectionForCommand(Event* event)
+VisibleSelection Editor::selectionForCommand(Event* event)
 {
-    Selection selection = m_frame->selection()->selection();
+    VisibleSelection selection = m_frame->selection()->selection();
     if (!event)
         return selection;
     // If the target is a text control, and the current selection is outside of its shadow tree,
@@ -221,7 +225,7 @@ bool Editor::isSelectTrailingWhitespaceEnabled()
 
 bool Editor::deleteWithDirection(SelectionController::EDirection direction, TextGranularity granularity, bool killRing, bool isTypingAction)
 {
-    if (!canEdit() || !m_frame->document())
+    if (!canEdit())
         return false;
 
     if (m_frame->selection()->isRange()) {
@@ -316,7 +320,7 @@ PassRefPtr<Range> Editor::selectedRange()
 {
     if (!m_frame)
         return 0;
-    return m_frame->selection()->toRange();
+    return m_frame->selection()->toNormalizedRange();
 }
 
 bool Editor::shouldDeleteRange(Range* range) const
@@ -336,9 +340,10 @@ bool Editor::tryDHTMLCopy()
     if (m_frame->selection()->isInPasswordField())
         return false;
 
-    // Must be done before oncopy adds types and data to the pboard,
-    // also done for security, as it erases data from the last copy/paste.
-    Pasteboard::generalPasteboard()->clear();
+    if (canCopy())
+        // Must be done before oncopy adds types and data to the pboard,
+        // also done for security, as it erases data from the last copy/paste.
+        Pasteboard::generalPasteboard()->clear();
 
     return !dispatchCPPEvent(eventNames().copyEvent, ClipboardWritable);
 }
@@ -347,10 +352,11 @@ bool Editor::tryDHTMLCut()
 {
     if (m_frame->selection()->isInPasswordField())
         return false;
-
-    // Must be done before oncut adds types and data to the pboard,
-    // also done for security, as it erases data from the last copy/paste.
-    Pasteboard::generalPasteboard()->clear();
+    
+    if (canCut())
+        // Must be done before oncut adds types and data to the pboard,
+        // also done for security, as it erases data from the last copy/paste.
+        Pasteboard::generalPasteboard()->clear();
 
     return !dispatchCPPEvent(eventNames().cutEvent, ClipboardWritable);
 }
@@ -375,19 +381,19 @@ bool Editor::shouldShowDeleteInterface(HTMLElement* element) const
     return client() && client()->shouldShowDeleteInterface(element);
 }
 
-void Editor::respondToChangedSelection(const Selection& oldSelection)
+void Editor::respondToChangedSelection(const VisibleSelection& oldSelection)
 {
     if (client())
         client()->respondToChangedSelection();
     m_deleteButtonController->respondToChangedSelection(oldSelection);
 }
 
-void Editor::respondToChangedContents(const Selection& endingSelection)
+void Editor::respondToChangedContents(const VisibleSelection& endingSelection)
 {
     if (AXObjectCache::accessibilityEnabled()) {
         Node* node = endingSelection.start().node();
         if (node)
-            m_frame->document()->axObjectCache()->postNotification(node->renderer(), "AXValueChanged");
+            m_frame->document()->axObjectCache()->postNotification(node->renderer(), "AXValueChanged", false);
     }
     
     if (client())
@@ -418,7 +424,7 @@ const SimpleFontData* Editor::fontForSelection(bool& hasMultipleFonts) const
 
     const SimpleFontData* font = 0;
 
-    RefPtr<Range> range = m_frame->selection()->toRange();
+    RefPtr<Range> range = m_frame->selection()->toNormalizedRange();
     Node* startNode = range->editingStartPosition().node();
     if (startNode) {
         Node* pastEnd = range->pastLastNode();
@@ -571,7 +577,7 @@ bool Editor::hasBidiSelection() const
     if (style->direction() == RTL)
         return true;
 
-    return static_cast<RenderBlock*>(renderer)->containsNonZeroBidiLevel();
+    return toRenderBlock(renderer)->containsNonZeroBidiLevel();
 }
 
 TriState Editor::selectionUnorderedListState() const
@@ -688,7 +694,7 @@ void Editor::clearLastEditCommand()
 bool Editor::dispatchCPPEvent(const AtomicString &eventType, ClipboardAccessPolicy policy)
 {
     Node* target = m_frame->selection()->start().element();
-    if (!target && m_frame->document())
+    if (!target)
         target = m_frame->document()->body();
     if (!target)
         return true;
@@ -698,7 +704,7 @@ bool Editor::dispatchCPPEvent(const AtomicString &eventType, ClipboardAccessPoli
 
     ExceptionCode ec = 0;
     RefPtr<Event> evt = ClipboardEvent::create(eventType, true, true, clipboard);
-    EventTargetNodeCast(target)->dispatchEvent(evt, ec);
+    target->dispatchEvent(evt, ec);
     bool noDefaultProcessing = evt->defaultPrevented();
 
     // invalidate clipboard here for security
@@ -709,15 +715,15 @@ bool Editor::dispatchCPPEvent(const AtomicString &eventType, ClipboardAccessPoli
 
 void Editor::applyStyle(CSSStyleDeclaration* style, EditAction editingAction)
 {
-    switch (m_frame->selection()->state()) {
-        case Selection::NONE:
+    switch (m_frame->selection()->selectionType()) {
+        case VisibleSelection::NoSelection:
             // do nothing
             break;
-        case Selection::CARET:
+        case VisibleSelection::CaretSelection:
             m_frame->computeAndSetTypingStyle(style, editingAction);
             break;
-        case Selection::RANGE:
-            if (m_frame->document() && style)
+        case VisibleSelection::RangeSelection:
+            if (style)
                 applyCommand(ApplyStyleCommand::create(m_frame->document(), style, editingAction));
             break;
     }
@@ -730,13 +736,13 @@ bool Editor::shouldApplyStyle(CSSStyleDeclaration* style, Range* range)
     
 void Editor::applyParagraphStyle(CSSStyleDeclaration* style, EditAction editingAction)
 {
-    switch (m_frame->selection()->state()) {
-        case Selection::NONE:
+    switch (m_frame->selection()->selectionType()) {
+        case VisibleSelection::NoSelection:
             // do nothing
             break;
-        case Selection::CARET:
-        case Selection::RANGE:
-            if (m_frame->document() && style)
+        case VisibleSelection::CaretSelection:
+        case VisibleSelection::RangeSelection:
+            if (style)
                 applyCommand(ApplyStyleCommand::create(m_frame->document(), style, editingAction, ApplyStyleCommand::ForceBlockProperties));
             break;
     }
@@ -747,7 +753,7 @@ void Editor::applyStyleToSelection(CSSStyleDeclaration* style, EditAction editin
     if (!style || style->length() == 0 || !canEditRichly())
         return;
 
-    if (client() && client()->shouldApplyStyle(style, m_frame->selection()->toRange().get()))
+    if (client() && client()->shouldApplyStyle(style, m_frame->selection()->toNormalizedRange().get()))
         applyStyle(style, editingAction);
 }
 
@@ -756,7 +762,7 @@ void Editor::applyParagraphStyleToSelection(CSSStyleDeclaration* style, EditActi
     if (!style || style->length() == 0 || !canEditRichly())
         return;
     
-    if (client() && client()->shouldApplyStyle(style, m_frame->selection()->toRange().get()))
+    if (client() && client()->shouldApplyStyle(style, m_frame->selection()->toNormalizedRange().get()))
         applyParagraphStyle(style, editingAction);
 }
 
@@ -869,14 +875,9 @@ void Editor::appliedEditing(PassRefPtr<EditCommand> cmd)
 {
     dispatchEditableContentChangedEvents(*cmd);
     
-    Selection newSelection(cmd->endingSelection());
-    // If there is no selection change, don't bother sending shouldChangeSelection, but still call setSelection,
-    // because there is work that it must do in this situation.
-    // The old selection can be invalid here and calling shouldChangeSelection can produce some strange calls.
-    // See <rdar://problem/5729315> Some shouldChangeSelectedDOMRange contain Ranges for selections that are no longer valid
+    VisibleSelection newSelection(cmd->endingSelection());
     // Don't clear the typing style with this selection change.  We do those things elsewhere if necessary.
-    if (newSelection == m_frame->selection()->selection() || m_frame->shouldChangeSelection(newSelection))
-        m_frame->selection()->setSelection(newSelection, false, false);
+    changeSelectionAfterCommand(newSelection, false, false, cmd.get());
         
     if (!cmd->preservesTypingStyle())
         m_frame->setTypingStyle(0);
@@ -898,13 +899,8 @@ void Editor::unappliedEditing(PassRefPtr<EditCommand> cmd)
 {
     dispatchEditableContentChangedEvents(*cmd);
     
-    Selection newSelection(cmd->startingSelection());
-    // If there is no selection change, don't bother sending shouldChangeSelection, but still call setSelection,
-    // because there is work that it must do in this situation.
-    // The old selection can be invalid here and calling shouldChangeSelection can produce some strange calls.
-    // See <rdar://problem/5729315> Some shouldChangeSelectedDOMRange contain Ranges for selections that are no longer valid
-    if (newSelection == m_frame->selection()->selection() || m_frame->shouldChangeSelection(newSelection))
-        m_frame->selection()->setSelection(newSelection, true);
+    VisibleSelection newSelection(cmd->startingSelection());
+    changeSelectionAfterCommand(newSelection, true, true, cmd.get());
     
     m_lastEditCommand = 0;
     if (client())
@@ -916,13 +912,8 @@ void Editor::reappliedEditing(PassRefPtr<EditCommand> cmd)
 {
     dispatchEditableContentChangedEvents(*cmd);
     
-    Selection newSelection(cmd->endingSelection());
-    // If there is no selection change, don't bother sending shouldChangeSelection, but still call setSelection,
-    // because there is work that it must do in this situation.
-    // The old selection can be invalid here and calling shouldChangeSelection can produce some strange calls.
-    // See <rdar://problem/5729315> Some shouldChangeSelectedDOMRange contain Ranges for selections that are no longer valid
-    if (newSelection == m_frame->selection()->selection() || m_frame->shouldChangeSelection(newSelection))
-        m_frame->selection()->setSelection(newSelection, true);
+    VisibleSelection newSelection(cmd->endingSelection());
+    changeSelectionAfterCommand(newSelection, true, true, cmd.get());
     
     m_lastEditCommand = 0;
     if (client())
@@ -935,6 +926,8 @@ Editor::Editor(Frame* frame)
     , m_deleteButtonController(new DeleteButtonController(frame))
     , m_ignoreCompositionSelectionChange(false)
     , m_shouldStartNewKillRingSequence(false)
+    // This is off by default, since most editors want this behavior (this matches IE but not FF).
+    , m_shouldStyleWithCSS(false)
 { 
 }
 
@@ -946,6 +939,7 @@ void Editor::clear()
 {
     m_compositionNode = 0;
     m_customCompositionUnderlines.clear();
+    m_shouldStyleWithCSS = false;
 }
 
 bool Editor::insertText(const String& text, Event* triggeringEvent)
@@ -958,10 +952,10 @@ bool Editor::insertTextWithoutSendingTextEvent(const String& text, bool selectIn
     if (text.isEmpty())
         return false;
 
-    Selection selection = selectionForCommand(triggeringEvent);
+    VisibleSelection selection = selectionForCommand(triggeringEvent);
     if (!selection.isContentEditable())
         return false;
-    RefPtr<Range> range = selection.toRange();
+    RefPtr<Range> range = selection.toNormalizedRange();
 
     if (!shouldInsertText(text, range.get(), EditorInsertActionTyped))
         return true;
@@ -980,7 +974,7 @@ bool Editor::insertTextWithoutSendingTextEvent(const String& text, bool selectIn
             // Reveal the current selection 
             if (Frame* editedFrame = document->frame())
                 if (Page* page = editedFrame->page())
-                    page->focusController()->focusedOrMainFrame()->revealSelection(RenderLayer::gAlignToEdgeIfNeeded);
+                    page->focusController()->focusedOrMainFrame()->revealSelection(ScrollAlignment::alignToEdgeIfNeeded);
         }
     }
 
@@ -992,7 +986,7 @@ bool Editor::insertLineBreak()
     if (!canEdit())
         return false;
 
-    if (!shouldInsertText("\n", m_frame->selection()->toRange().get(), EditorInsertActionTyped))
+    if (!shouldInsertText("\n", m_frame->selection()->toNormalizedRange().get(), EditorInsertActionTyped))
         return true;
 
     TypingCommand::insertLineBreak(m_frame->document());
@@ -1008,7 +1002,7 @@ bool Editor::insertParagraphSeparator()
     if (!canEditRichly())
         return insertLineBreak();
 
-    if (!shouldInsertText("\n", m_frame->selection()->toRange().get(), EditorInsertActionTyped))
+    if (!shouldInsertText("\n", m_frame->selection()->toNormalizedRange().get(), EditorInsertActionTyped))
         return true;
 
     TypingCommand::insertParagraphSeparator(m_frame->document());
@@ -1133,6 +1127,110 @@ int Editor::spellCheckerDocumentTag()
     return client() ? client()->spellCheckerDocumentTag() : 0;
 }
 
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+
+void Editor::uppercaseWord()
+{
+    if (client())
+        client()->uppercaseWord();
+}
+
+void Editor::lowercaseWord()
+{
+    if (client())
+        client()->lowercaseWord();
+}
+
+void Editor::capitalizeWord()
+{
+    if (client())
+        client()->capitalizeWord();
+}
+
+void Editor::showSubstitutionsPanel()
+{
+    if (!client()) {
+        LOG_ERROR("No NSSpellChecker");
+        return;
+    }
+
+    if (client()->substitutionsPanelIsShowing()) {
+        client()->showSubstitutionsPanel(false);
+        return;
+    }
+    client()->showSubstitutionsPanel(true);
+}
+
+bool Editor::substitutionsPanelIsShowing()
+{
+    if (!client())
+        return false;
+    return client()->substitutionsPanelIsShowing();
+}
+
+void Editor::toggleSmartInsertDelete()
+{
+    if (client())
+        client()->toggleSmartInsertDelete();
+}
+
+bool Editor::isAutomaticQuoteSubstitutionEnabled()
+{
+    return client() && client()->isAutomaticQuoteSubstitutionEnabled();
+}
+
+void Editor::toggleAutomaticQuoteSubstitution()
+{
+    if (client())
+        client()->toggleAutomaticQuoteSubstitution();
+}
+
+bool Editor::isAutomaticLinkDetectionEnabled()
+{
+    return client() && client()->isAutomaticLinkDetectionEnabled();
+}
+
+void Editor::toggleAutomaticLinkDetection()
+{
+    if (client())
+        client()->toggleAutomaticLinkDetection();
+}
+
+bool Editor::isAutomaticDashSubstitutionEnabled()
+{
+    return client() && client()->isAutomaticDashSubstitutionEnabled();
+}
+
+void Editor::toggleAutomaticDashSubstitution()
+{
+    if (client())
+        client()->toggleAutomaticDashSubstitution();
+}
+
+bool Editor::isAutomaticTextReplacementEnabled()
+{
+    return client() && client()->isAutomaticTextReplacementEnabled();
+}
+
+void Editor::toggleAutomaticTextReplacement()
+{
+    if (client())
+        client()->toggleAutomaticTextReplacement();
+}
+
+bool Editor::isAutomaticSpellingCorrectionEnabled()
+{
+    return client() && client()->isAutomaticSpellingCorrectionEnabled();
+}
+
+void Editor::toggleAutomaticSpellingCorrection()
+{
+    if (client())
+        client()->toggleAutomaticSpellingCorrection();
+}
+
+#endif
+
 bool Editor::shouldEndEditing(Range* range)
 {
     return client() && client()->shouldEndEditing(range);
@@ -1203,12 +1301,12 @@ void Editor::setBaseWritingDirection(WritingDirection direction)
 {
     Node* focusedNode = frame()->document()->focusedNode();
     if (focusedNode && (focusedNode->hasTagName(textareaTag)
-                        || focusedNode->hasTagName(inputTag) && (static_cast<HTMLInputElement*>(focusedNode)->inputType() == HTMLInputElement::TEXT
-                                                                || static_cast<HTMLInputElement*>(focusedNode)->inputType() == HTMLInputElement::SEARCH))) {
+                        || (focusedNode->hasTagName(inputTag) && (static_cast<HTMLInputElement*>(focusedNode)->inputType() == HTMLInputElement::TEXT
+                                                                || static_cast<HTMLInputElement*>(focusedNode)->inputType() == HTMLInputElement::SEARCH)))) {
         if (direction == NaturalWritingDirection)
             return;
         static_cast<HTMLElement*>(focusedNode)->setAttribute(dirAttr, direction == LeftToRightWritingDirection ? "ltr" : "rtl");
-        frame()->document()->updateRendering();
+        frame()->document()->updateStyleIfNeeded();
         return;
     }
 
@@ -1225,7 +1323,7 @@ void Editor::selectComposition()
     
     // The composition can start inside a composed character sequence, so we have to override checks.
     // See <http://bugs.webkit.org/show_bug.cgi?id=15781>
-    Selection selection;
+    VisibleSelection selection;
     selection.setWithoutValidation(range->startPosition(), range->endPosition());
     m_frame->selection()->setSelection(selection, false, false);
 }
@@ -1253,7 +1351,7 @@ void Editor::confirmComposition(const String& text, bool preserveSelection)
 {
     setIgnoreCompositionSelectionChange(true);
 
-    Selection oldSelection = m_frame->selection()->selection();
+    VisibleSelection oldSelection = m_frame->selection()->selection();
 
     selectComposition();
 
@@ -1301,9 +1399,9 @@ void Editor::setComposition(const String& text, const Vector<CompositionUnderlin
         TypingCommand::insertText(m_frame->document(), text, true, true);
 
         Node* baseNode = m_frame->selection()->base().node();
-        unsigned baseOffset = m_frame->selection()->base().offset();
+        unsigned baseOffset = m_frame->selection()->base().deprecatedEditingOffset();
         Node* extentNode = m_frame->selection()->extent().node();
-        unsigned extentOffset = m_frame->selection()->extent().offset();
+        unsigned extentOffset = m_frame->selection()->extent().deprecatedEditingOffset();
 
         if (baseNode && baseNode == extentNode && baseNode->isTextNode() && baseOffset + text.length() == extentOffset) {
             m_compositionNode = static_cast<Text*>(baseNode);
@@ -1333,7 +1431,7 @@ void Editor::ignoreSpelling()
     if (!client())
         return;
         
-    RefPtr<Range> selectedRange = frame()->selection()->toRange();
+    RefPtr<Range> selectedRange = frame()->selection()->toNormalizedRange();
     if (selectedRange)
         frame()->document()->removeMarkers(selectedRange.get(), DocumentMarker::Spelling);
 
@@ -1355,7 +1453,7 @@ void Editor::learnSpelling()
     client()->learnWord(text);
 }
 
-static String findFirstMisspellingInRange(EditorClient* client, Range* searchRange, int& firstMisspellingOffset, bool markAll)
+static String findFirstMisspellingInRange(EditorClient* client, Range* searchRange, int& firstMisspellingOffset, bool markAll, RefPtr<Range>& firstMisspellingRange)
 {
     ASSERT_ARG(client, client);
     ASSERT_ARG(searchRange, searchRange);
@@ -1389,23 +1487,24 @@ static String findFirstMisspellingInRange(EditorClient* client, Range* searchRan
             
             if (misspellingLocation >= 0 && misspellingLength > 0 && misspellingLocation < len && misspellingLength <= len && misspellingLocation + misspellingLength <= len) {
                 
-                // Remember first-encountered misspelling and its offset
+                // Compute range of misspelled word
+                RefPtr<Range> misspellingRange = TextIterator::subrange(searchRange, currentChunkOffset + misspellingLocation, misspellingLength);
+
+                // Remember first-encountered misspelling and its offset.
                 if (!firstMisspelling) {
                     firstMisspellingOffset = currentChunkOffset + misspellingLocation;
                     firstMisspelling = String(chars + misspellingLocation, misspellingLength);
+                    firstMisspellingRange = misspellingRange;
                 }
-                
-                // Mark this instance if we're marking all instances. Otherwise bail out because we found the first one.
-                if (!markAll)
-                    break;
-                
-                // Compute range of misspelled word
-                RefPtr<Range> misspellingRange = TextIterator::subrange(searchRange, currentChunkOffset + misspellingLocation, misspellingLength);
-                
-                // Store marker for misspelled word
+
+                // Store marker for misspelled word.
                 ExceptionCode ec = 0;
                 misspellingRange->startContainer(ec)->document()->addMarker(misspellingRange.get(), DocumentMarker::Spelling);
                 ASSERT(ec == 0);
+
+                // Bail out if we're marking only the first misspelling, and not all instances.
+                if (!markAll)
+                    break;
             }
         }
         
@@ -1547,6 +1646,131 @@ static String findFirstBadGrammarInRange(EditorClient* client, Range* searchRang
     
 #endif /* not BUILDING_ON_TIGER */
 
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+
+static String findFirstMisspellingOrBadGrammarInRange(EditorClient* client, Range* searchRange, bool checkGrammar, bool& outIsSpelling, int& outFirstFoundOffset, GrammarDetail& outGrammarDetail)
+{
+    ASSERT_ARG(client, client);
+    ASSERT_ARG(searchRange, searchRange);
+    
+    String firstFoundItem;
+    String misspelledWord;
+    String badGrammarPhrase;
+    ExceptionCode ec = 0;
+    
+    // Initialize out parameters; these will be updated if we find something to return.
+    outIsSpelling = true;
+    outFirstFoundOffset = 0;
+    outGrammarDetail.location = -1;
+    outGrammarDetail.length = 0;
+    outGrammarDetail.guesses.clear();
+    outGrammarDetail.userDescription = "";
+    
+    // Expand the search range to encompass entire paragraphs, since text checking needs that much context.
+    // Determine the character offset from the start of the paragraph to the start of the original search range,
+    // since we will want to ignore results in this area.
+    RefPtr<Range> paragraphRange = searchRange->cloneRange(ec);
+    setStart(paragraphRange.get(), startOfParagraph(searchRange->startPosition()));
+    int totalRangeLength = TextIterator::rangeLength(paragraphRange.get());
+    setEnd(paragraphRange.get(), endOfParagraph(searchRange->startPosition()));
+    
+    RefPtr<Range> offsetAsRange = Range::create(paragraphRange->startContainer(ec)->document(), paragraphRange->startPosition(), searchRange->startPosition());
+    int searchRangeStartOffset = TextIterator::rangeLength(offsetAsRange.get());
+    int totalLengthProcessed = 0;
+    
+    bool firstIteration = true;
+    bool lastIteration = false;
+    while (totalLengthProcessed < totalRangeLength) {
+        // Iterate through the search range by paragraphs, checking each one for spelling and grammar.
+        int currentLength = TextIterator::rangeLength(paragraphRange.get());
+        int currentStartOffset = firstIteration ? searchRangeStartOffset : 0;
+        int currentEndOffset = currentLength;
+        if (inSameParagraph(paragraphRange->startPosition(), searchRange->endPosition())) {
+            // Determine the character offset from the end of the original search range to the end of the paragraph,
+            // since we will want to ignore results in this area.
+            RefPtr<Range> endOffsetAsRange = Range::create(paragraphRange->startContainer(ec)->document(), paragraphRange->startPosition(), searchRange->endPosition());
+            currentEndOffset = TextIterator::rangeLength(endOffsetAsRange.get());
+            lastIteration = true;
+        }
+        if (currentStartOffset < currentEndOffset) {
+            String paragraphString = plainText(paragraphRange.get());
+            if (paragraphString.length() > 0) {
+                bool foundGrammar = false;
+                int spellingLocation = 0;
+                int grammarPhraseLocation = 0;
+                int grammarDetailLocation = 0;
+                unsigned grammarDetailIndex = 0;
+                
+                Vector<TextCheckingResult> results;
+                uint64_t checkingTypes = checkGrammar ? (TextCheckingTypeSpelling | TextCheckingTypeGrammar) : TextCheckingTypeSpelling;
+                client->checkTextOfParagraph(paragraphString.characters(), paragraphString.length(), checkingTypes, results);
+                
+                for (unsigned i = 0; i < results.size(); i++) {
+                    const TextCheckingResult* result = &results[i];
+                    if (result->type == TextCheckingTypeSpelling && result->location >= currentStartOffset && result->location + result->length <= currentEndOffset) {
+                        ASSERT(result->length > 0 && result->location >= 0);
+                        spellingLocation = result->location;
+                        misspelledWord = paragraphString.substring(result->location, result->length);
+                        ASSERT(misspelledWord.length() != 0);
+                        break;
+                    } else if (checkGrammar && result->type == TextCheckingTypeGrammar && result->location < currentEndOffset && result->location + result->length > currentStartOffset) {
+                        ASSERT(result->length > 0 && result->location >= 0);
+                        // We can't stop after the first grammar result, since there might still be a spelling result after
+                        // it begins but before the first detail in it, but we can stop if we find a second grammar result.
+                        if (foundGrammar) break;
+                        for (unsigned j = 0; j < result->details.size(); j++) {
+                            const GrammarDetail* detail = &result->details[j];
+                            ASSERT(detail->length > 0 && detail->location >= 0);
+                            if (result->location + detail->location >= currentStartOffset && result->location + detail->location + detail->length <= currentEndOffset && (!foundGrammar || result->location + detail->location < grammarDetailLocation)) {
+                                grammarDetailIndex = j;
+                                grammarDetailLocation = result->location + detail->location;
+                                foundGrammar = true;
+                            }
+                        }
+                        if (foundGrammar) {
+                            grammarPhraseLocation = result->location;
+                            outGrammarDetail = result->details[grammarDetailIndex];
+                            badGrammarPhrase = paragraphString.substring(result->location, result->length);
+                            ASSERT(badGrammarPhrase.length() != 0);
+                        }
+                    }
+                }
+
+                if (!misspelledWord.isEmpty() && (!checkGrammar || badGrammarPhrase.isEmpty() || spellingLocation <= grammarDetailLocation)) {
+                    int spellingOffset = spellingLocation - currentStartOffset;
+                    if (!firstIteration) {
+                        RefPtr<Range> paragraphOffsetAsRange = Range::create(paragraphRange->startContainer(ec)->document(), searchRange->startPosition(), paragraphRange->startPosition());
+                        spellingOffset += TextIterator::rangeLength(paragraphOffsetAsRange.get());
+                    }
+                    outIsSpelling = true;
+                    outFirstFoundOffset = spellingOffset;
+                    firstFoundItem = misspelledWord;
+                    break;
+                } else if (checkGrammar && !badGrammarPhrase.isEmpty()) {
+                    int grammarPhraseOffset = grammarPhraseLocation - currentStartOffset;
+                    if (!firstIteration) {
+                        RefPtr<Range> paragraphOffsetAsRange = Range::create(paragraphRange->startContainer(ec)->document(), searchRange->startPosition(), paragraphRange->startPosition());
+                        grammarPhraseOffset += TextIterator::rangeLength(paragraphOffsetAsRange.get());
+                    }
+                    outIsSpelling = false;
+                    outFirstFoundOffset = grammarPhraseOffset;
+                    firstFoundItem = badGrammarPhrase;
+                    break;
+                }
+            }
+        }
+        if (lastIteration || totalLengthProcessed + currentLength >= totalRangeLength)
+            break;
+        setStart(paragraphRange.get(), startOfNextParagraph(paragraphRange->endPosition()));
+        setEnd(paragraphRange.get(), endOfParagraph(paragraphRange->startPosition()));
+        firstIteration = false;
+        totalLengthProcessed += currentLength;
+    }
+    return firstFoundItem;
+}
+
+#endif
+
 void Editor::advanceToNextMisspelling(bool startBeforeSelection)
 {
     ExceptionCode ec = 0;
@@ -1556,7 +1780,7 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
     
     // Start at the end of the selection, search to edge of document.  Starting at the selection end makes
     // repeated "check spelling" commands work.
-    Selection selection(frame()->selection()->selection());
+    VisibleSelection selection(frame()->selection()->selection());
     RefPtr<Range> spellingSearchRange(rangeOfContents(frame()->document()));
     bool startedWithSelection = false;
     if (selection.start().node()) {
@@ -1583,13 +1807,14 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
             return;
         
         Position rangeCompliantPosition = rangeCompliantEquivalent(position);
-        spellingSearchRange->setStart(rangeCompliantPosition.node(), rangeCompliantPosition.offset(), ec);
+        spellingSearchRange->setStart(rangeCompliantPosition.node(), rangeCompliantPosition.deprecatedEditingOffset(), ec);
         startedWithSelection = false;   // won't need to wrap
     }
     
     // topNode defines the whole range we want to operate on 
     Node* topNode = highestEditableRoot(position);
-    spellingSearchRange->setEnd(topNode, maxDeepOffset(topNode), ec);
+    // FIXME: lastOffsetForEditing() is wrong here if editingIgnoresContent(highestEditableRoot()) returns true (e.g. a <table>)
+    spellingSearchRange->setEnd(topNode, lastOffsetForEditing(topNode), ec);
 
     // If spellingSearchRange starts in the middle of a word, advance to the next word so we start checking
     // at a word boundary. Going back by one char and then forward by a word does the trick.
@@ -1613,9 +1838,26 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
     Node *searchEndNodeAfterWrap = spellingSearchRange->endContainer(ec);
     int searchEndOffsetAfterWrap = spellingSearchRange->endOffset(ec);
     
-    int misspellingOffset;
-    String misspelledWord = findFirstMisspellingInRange(client(), spellingSearchRange.get(), misspellingOffset, false);
-    
+    int misspellingOffset = 0;
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    RefPtr<Range> grammarSearchRange = spellingSearchRange->cloneRange(ec);
+    String misspelledWord;
+    String badGrammarPhrase;
+    int grammarPhraseOffset = 0;
+    bool isSpelling = true;
+    int foundOffset = 0;
+    GrammarDetail grammarDetail;
+    String foundItem = findFirstMisspellingOrBadGrammarInRange(client(), spellingSearchRange.get(), isGrammarCheckingEnabled(), isSpelling, foundOffset, grammarDetail);
+    if (isSpelling) {
+        misspelledWord = foundItem;
+        misspellingOffset = foundOffset;
+    } else {
+        badGrammarPhrase = foundItem;
+        grammarPhraseOffset = foundOffset;
+    }
+#else
+    RefPtr<Range> firstMisspellingRange;
+    String misspelledWord = findFirstMisspellingInRange(client(), spellingSearchRange.get(), misspellingOffset, false, firstMisspellingRange);
     String badGrammarPhrase;
 
 #ifndef BUILDING_ON_TIGER
@@ -1634,6 +1876,7 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
     if (isGrammarCheckingEnabled())
         badGrammarPhrase = findFirstBadGrammarInRange(client(), grammarSearchRange.get(), grammarDetail, grammarPhraseOffset, false);
 #endif
+#endif
     
     // If we found neither bad grammar nor a misspelled word, wrap and try again (but don't bother if we started at the beginning of the
     // block rather than at a selection).
@@ -1642,7 +1885,18 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
         // going until the end of the very first chunk we tested is far enough
         spellingSearchRange->setEnd(searchEndNodeAfterWrap, searchEndOffsetAfterWrap, ec);
         
-        misspelledWord = findFirstMisspellingInRange(client(), spellingSearchRange.get(), misspellingOffset, false);
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+        grammarSearchRange = spellingSearchRange->cloneRange(ec);
+        foundItem = findFirstMisspellingOrBadGrammarInRange(client(), spellingSearchRange.get(), isGrammarCheckingEnabled(), isSpelling, foundOffset, grammarDetail);
+        if (isSpelling) {
+            misspelledWord = foundItem;
+            misspellingOffset = foundOffset;
+        } else {
+            badGrammarPhrase = foundItem;
+            grammarPhraseOffset = foundOffset;
+        }
+#else
+        misspelledWord = findFirstMisspellingInRange(client(), spellingSearchRange.get(), misspellingOffset, false, firstMisspellingRange);
 
 #ifndef BUILDING_ON_TIGER
         grammarSearchRange = spellingSearchRange->cloneRange(ec);
@@ -1655,6 +1909,7 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
         if (isGrammarCheckingEnabled())
             badGrammarPhrase = findFirstBadGrammarInRange(client(), grammarSearchRange.get(), grammarDetail, grammarPhraseOffset, false);
 #endif
+#endif
     }
     
     if (!badGrammarPhrase.isEmpty()) {
@@ -1670,7 +1925,7 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
         
         // FIXME 4859190: This gets confused with doubled punctuation at the end of a paragraph
         RefPtr<Range> badGrammarRange = TextIterator::subrange(grammarSearchRange.get(), grammarPhraseOffset + grammarDetail.location, grammarDetail.length);
-        frame()->selection()->setSelection(Selection(badGrammarRange.get(), SEL_DEFAULT_AFFINITY));
+        frame()->selection()->setSelection(VisibleSelection(badGrammarRange.get(), SEL_DEFAULT_AFFINITY));
         frame()->revealSelection();
         
         client()->updateSpellingUIWithGrammarString(badGrammarPhrase, grammarDetail);
@@ -1681,7 +1936,7 @@ void Editor::advanceToNextMisspelling(bool startBeforeSelection)
         // a marker so we draw the red squiggle later.
         
         RefPtr<Range> misspellingRange = TextIterator::subrange(spellingSearchRange.get(), misspellingOffset, misspelledWord.length());
-        frame()->selection()->setSelection(Selection(misspellingRange.get(), DOWNSTREAM));
+        frame()->selection()->setSelection(VisibleSelection(misspellingRange.get(), DOWNSTREAM));
         frame()->revealSelection();
         
         client()->updateSpellingUIWithMisspelledWord(misspelledWord);
@@ -1769,7 +2024,7 @@ bool Editor::isSelectionUngrammatical()
     return false;
 #else
     Vector<String> ignoredGuesses;
-    return isRangeUngrammatical(client(), frame()->selection()->toRange().get(), ignoredGuesses);
+    return isRangeUngrammatical(client(), frame()->selection()->toNormalizedRange().get(), ignoredGuesses);
 #endif
 }
 
@@ -1780,7 +2035,7 @@ Vector<String> Editor::guessesForUngrammaticalSelection()
 #else
     Vector<String> guesses;
     // Ignore the result of isRangeUngrammatical; we just want the guesses, whether or not there are any
-    isRangeUngrammatical(client(), frame()->selection()->toRange().get(), guesses);
+    isRangeUngrammatical(client(), frame()->selection()->toNormalizedRange().get(), guesses);
     return guesses;
 #endif
 }
@@ -1796,6 +2051,87 @@ Vector<String> Editor::guessesForMisspelledSelection()
     return guesses;
 }
 
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+
+static Vector<String> guessesForMisspelledOrUngrammaticalRange(EditorClient* client, Range *range, bool checkGrammar, bool& misspelled, bool& ungrammatical)
+{
+    Vector<String> guesses;
+    ExceptionCode ec;
+    misspelled = false;
+    ungrammatical = false;
+    
+    if (!client || !range || range->collapsed(ec))
+        return guesses;
+
+    // Expand the range to encompass entire paragraphs, since text checking needs that much context.
+    int rangeStartOffset;
+    String paragraphString;
+    RefPtr<Range> paragraphRange = paragraphAlignedRangeForRange(range, rangeStartOffset, paragraphString);
+    int rangeLength = TextIterator::rangeLength(range);
+    if (rangeLength == 0 || paragraphString.length() == 0)
+        return guesses;
+
+    Vector<TextCheckingResult> results;
+    uint64_t checkingTypes = checkGrammar ? (TextCheckingTypeSpelling | TextCheckingTypeGrammar) : TextCheckingTypeSpelling;
+    client->checkTextOfParagraph(paragraphString.characters(), paragraphString.length(), checkingTypes, results);
+    
+    for (unsigned i = 0; i < results.size(); i++) {
+        const TextCheckingResult* result = &results[i];
+        if (result->type == TextCheckingTypeSpelling && result->location == rangeStartOffset && result->length == rangeLength) {
+            String misspelledWord = paragraphString.substring(rangeStartOffset, rangeLength);
+            ASSERT(misspelledWord.length() != 0);
+            client->getGuessesForWord(misspelledWord, guesses);
+            client->updateSpellingUIWithMisspelledWord(misspelledWord);
+            misspelled = true;
+            return guesses;
+        }
+    }
+    
+    if (!checkGrammar)
+        return guesses;
+        
+    for (unsigned i = 0; i < results.size(); i++) {
+        const TextCheckingResult* result = &results[i];
+        if (result->type == TextCheckingTypeGrammar && result->location <= rangeStartOffset && result->location + result->length >= rangeStartOffset + rangeLength) {
+            for (unsigned j = 0; j < result->details.size(); j++) {
+                const GrammarDetail* detail = &result->details[j];
+                ASSERT(detail->length > 0 && detail->location >= 0);
+                if (result->location + detail->location == rangeStartOffset && detail->length == rangeLength) {
+                    String badGrammarPhrase = paragraphString.substring(result->location, result->length);
+                    ASSERT(badGrammarPhrase.length() != 0);
+                    for (unsigned k = 0; k < detail->guesses.size(); k++)
+                        guesses.append(detail->guesses[k]);
+                    client->updateSpellingUIWithGrammarString(badGrammarPhrase, *detail);
+                    ungrammatical = true;
+                    return guesses;
+                }
+            }
+        }
+    }
+    return guesses;
+}
+
+#endif
+
+Vector<String> Editor::guessesForMisspelledOrUngrammaticalSelection(bool& misspelled, bool& ungrammatical)
+{
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    return guessesForMisspelledOrUngrammaticalRange(client(), frame()->selection()->toNormalizedRange().get(), isGrammarCheckingEnabled(), misspelled, ungrammatical);
+#else
+    misspelled = isSelectionMisspelled();
+    if (misspelled) {
+        ungrammatical = false;
+        return guessesForMisspelledSelection();
+    }
+    if (isGrammarCheckingEnabled() && isSelectionUngrammatical()) {
+        ungrammatical = true;
+        return guessesForUngrammaticalSelection();
+    }
+    ungrammatical = false;
+    return Vector<String>();
+#endif
+}
+
 void Editor::showSpellingGuessPanel()
 {
     if (!client()) {
@@ -1825,25 +2161,72 @@ bool Editor::spellingPanelIsShowing()
 
 void Editor::markMisspellingsAfterTypingToPosition(const VisiblePosition &p)
 {
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    bool markSpelling = isContinuousSpellCheckingEnabled();
+    bool markGrammar = markSpelling && isGrammarCheckingEnabled();
+    bool performTextCheckingReplacements = isAutomaticQuoteSubstitutionEnabled() 
+                                        || isAutomaticLinkDetectionEnabled()
+                                        || isAutomaticDashSubstitutionEnabled()
+                                        || isAutomaticTextReplacementEnabled()
+                                        || (markSpelling && isAutomaticSpellingCorrectionEnabled());
+    if (!markSpelling && !performTextCheckingReplacements)
+        return;
+    
+    VisibleSelection adjacentWords = VisibleSelection(startOfWord(p, LeftWordIfOnBoundary), endOfWord(p, RightWordIfOnBoundary));
+    if (markGrammar) {
+        VisibleSelection selectedSentence = VisibleSelection(startOfSentence(p), endOfSentence(p));
+        markAllMisspellingsAndBadGrammarInRanges(true, adjacentWords.toNormalizedRange().get(), true, selectedSentence.toNormalizedRange().get(), performTextCheckingReplacements);
+    } else {
+        markAllMisspellingsAndBadGrammarInRanges(markSpelling, adjacentWords.toNormalizedRange().get(), false, adjacentWords.toNormalizedRange().get(), performTextCheckingReplacements);
+    }
+#else
     if (!isContinuousSpellCheckingEnabled())
         return;
     
     // Check spelling of one word
-    markMisspellings(Selection(startOfWord(p, LeftWordIfOnBoundary), endOfWord(p, RightWordIfOnBoundary)));
+    RefPtr<Range> misspellingRange;
+    markMisspellings(VisibleSelection(startOfWord(p, LeftWordIfOnBoundary), endOfWord(p, RightWordIfOnBoundary)), misspellingRange);
+
+    // Autocorrect the misspelled word.
+    if (misspellingRange == 0)
+        return;
     
+    // Get the misspelled word.
+    const String misspelledWord = plainText(misspellingRange.get());
+    String autocorrectedString = client()->getAutoCorrectSuggestionForMisspelledWord(misspelledWord);
+
+    // If autocorrected word is non empty, replace the misspelled word by this word.
+    if (!autocorrectedString.isEmpty()) {
+        VisibleSelection newSelection(misspellingRange.get(), DOWNSTREAM);
+        if (newSelection != frame()->selection()->selection()) {
+            if (!frame()->shouldChangeSelection(newSelection))
+                return;
+            frame()->selection()->setSelection(newSelection);
+        }
+
+        if (!frame()->editor()->shouldInsertText(autocorrectedString, misspellingRange.get(), EditorInsertActionTyped))
+            return;
+        frame()->editor()->replaceSelectionWithText(autocorrectedString, false, false);
+
+        // Reset the charet one character further.
+        frame()->selection()->moveTo(frame()->selection()->end());
+        frame()->selection()->modify(SelectionController::MOVE, SelectionController::FORWARD, CharacterGranularity);
+    }
+
     if (!isGrammarCheckingEnabled())
         return;
     
     // Check grammar of entire sentence
-    markBadGrammar(Selection(startOfSentence(p), endOfSentence(p)));
+    markBadGrammar(VisibleSelection(startOfSentence(p), endOfSentence(p)));
+#endif
 }
 
-static void markAllMisspellingsInRange(EditorClient* client, Range* searchRange)
+static void markAllMisspellingsInRange(EditorClient* client, Range* searchRange, RefPtr<Range>& firstMisspellingRange)
 {
     // Use the "markAll" feature of findFirstMisspellingInRange. Ignore the return value and the "out parameter";
     // all we need to do is mark every instance.
     int ignoredOffset;
-    findFirstMisspellingInRange(client, searchRange, ignoredOffset, true);
+    findFirstMisspellingInRange(client, searchRange, ignoredOffset, true, firstMisspellingRange);
 }
 
 #ifndef BUILDING_ON_TIGER
@@ -1857,7 +2240,7 @@ static void markAllBadGrammarInRange(EditorClient* client, Range* searchRange)
 }
 #endif
     
-static void markMisspellingsOrBadGrammar(Editor* editor, const Selection& selection, bool checkSpelling)
+static void markMisspellingsOrBadGrammar(Editor* editor, const VisibleSelection& selection, bool checkSpelling, RefPtr<Range>& firstMisspellingRange)
 {
     // This function is called with a selection already expanded to word boundaries.
     // Might be nice to assert that here.
@@ -1867,7 +2250,7 @@ static void markMisspellingsOrBadGrammar(Editor* editor, const Selection& select
     if (!editor->isContinuousSpellCheckingEnabled())
         return;
     
-    RefPtr<Range> searchRange(selection.toRange());
+    RefPtr<Range> searchRange(selection.toNormalizedRange());
     if (!searchRange)
         return;
     
@@ -1876,12 +2259,26 @@ static void markMisspellingsOrBadGrammar(Editor* editor, const Selection& select
     if (!editableNode || !editableNode->isContentEditable())
         return;
     
+    // Ascend the DOM tree to find a "spellcheck" attribute.
+    // When we find a "spellcheck" attribute, retrieve its value and exit if its value is "false".
+    const Node* node = editor->frame()->document()->focusedNode();
+    while (node) {
+        if (node->isElementNode()) {
+            const WebCore::AtomicString& value = static_cast<const Element*>(node)->getAttribute(spellcheckAttr);
+            if (equalIgnoringCase(value, "true"))
+                break;
+            if (equalIgnoringCase(value, "false"))
+                return;
+        }
+        node = node->parent();
+    }
+
     // Get the spell checker if it is available
     if (!editor->client())
         return;
     
     if (checkSpelling)
-        markAllMisspellingsInRange(editor->client(), searchRange.get());
+        markAllMisspellingsInRange(editor->client(), searchRange.get(), firstMisspellingRange);
     else {
 #ifdef BUILDING_ON_TIGER
         ASSERT_NOT_REACHED();
@@ -1892,15 +2289,245 @@ static void markMisspellingsOrBadGrammar(Editor* editor, const Selection& select
     }    
 }
 
-void Editor::markMisspellings(const Selection& selection)
+void Editor::markMisspellings(const VisibleSelection& selection, RefPtr<Range>& firstMisspellingRange)
 {
-    markMisspellingsOrBadGrammar(this, selection, true);
+    markMisspellingsOrBadGrammar(this, selection, true, firstMisspellingRange);
 }
     
-void Editor::markBadGrammar(const Selection& selection)
+void Editor::markBadGrammar(const VisibleSelection& selection)
 {
 #ifndef BUILDING_ON_TIGER
-    markMisspellingsOrBadGrammar(this, selection, false);
+    RefPtr<Range> firstMisspellingRange;
+    markMisspellingsOrBadGrammar(this, selection, false, firstMisspellingRange);
+#else
+    UNUSED_PARAM(selection);
+#endif
+}
+
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+
+static inline bool isAmbiguousBoundaryCharacter(UChar character)
+{
+    // These are characters that can behave as word boundaries, but can appear within words.
+    // If they are just typed, i.e. if they are immediately followed by a caret, we want to delay text checking until the next character has been typed.
+    // FIXME: this is required until 6853027 is fixed and text checking can do this for us.
+    return character == '\'' || character == rightSingleQuotationMark || character == hebrewPunctuationGershayim;
+}
+
+void Editor::markAllMisspellingsAndBadGrammarInRanges(bool markSpelling, Range* spellingRange, bool markGrammar, Range* grammarRange, bool performTextCheckingReplacements)
+{
+    // This function is called with selections already expanded to word boundaries.
+    ExceptionCode ec = 0;
+    if (!client() || !spellingRange || (markGrammar && !grammarRange))
+        return;
+    
+    // If we're not in an editable node, bail.
+    Node* editableNode = spellingRange->startContainer();
+    if (!editableNode || !editableNode->isContentEditable())
+        return;
+    
+    // Expand the range to encompass entire paragraphs, since text checking needs that much context.
+    int spellingRangeStartOffset = 0;
+    int spellingRangeEndOffset = 0;
+    int grammarRangeStartOffset = 0;
+    int grammarRangeEndOffset = 0;
+    int offsetDueToReplacement = 0;
+    int paragraphLength = 0;
+    int selectionOffset = 0;
+    int ambiguousBoundaryOffset = -1;
+    bool selectionChanged = false;
+    bool restoreSelectionAfterChange = false;
+    bool adjustSelectionForParagraphBoundaries = false;
+    String paragraphString;
+    RefPtr<Range> paragraphRange;
+    
+    if (markGrammar) {
+        // The spelling range should be contained in the paragraph-aligned extension of the grammar range.
+        paragraphRange = paragraphAlignedRangeForRange(grammarRange, grammarRangeStartOffset, paragraphString);
+        RefPtr<Range> offsetAsRange = Range::create(paragraphRange->startContainer(ec)->document(), paragraphRange->startPosition(), spellingRange->startPosition());
+        spellingRangeStartOffset = TextIterator::rangeLength(offsetAsRange.get());
+        grammarRangeEndOffset = grammarRangeStartOffset + TextIterator::rangeLength(grammarRange);
+    } else {
+        paragraphRange = paragraphAlignedRangeForRange(spellingRange, spellingRangeStartOffset, paragraphString);
+    }
+    spellingRangeEndOffset = spellingRangeStartOffset + TextIterator::rangeLength(spellingRange);
+    paragraphLength = paragraphString.length();
+    if (paragraphLength <= 0 || (spellingRangeStartOffset >= spellingRangeEndOffset && (!markGrammar || grammarRangeStartOffset >= grammarRangeEndOffset)))
+        return;
+    
+    if (performTextCheckingReplacements) {
+        if (m_frame->selection()->selectionType() == VisibleSelection::CaretSelection) {
+            // Attempt to save the caret position so we can restore it later if needed
+            RefPtr<Range> offsetAsRange = Range::create(paragraphRange->startContainer(ec)->document(), paragraphRange->startPosition(), paragraphRange->startPosition());
+            Position caretPosition = m_frame->selection()->end();
+            offsetAsRange->setEnd(caretPosition.containerNode(), caretPosition.computeOffsetInContainerNode(), ec);
+            if (!ec) {
+                selectionOffset = TextIterator::rangeLength(offsetAsRange.get());
+                restoreSelectionAfterChange = true;
+                if (selectionOffset > 0 && (selectionOffset > paragraphLength || paragraphString[selectionOffset - 1] == newlineCharacter))
+                    adjustSelectionForParagraphBoundaries = true;
+                if (selectionOffset > 0 && selectionOffset <= paragraphLength && isAmbiguousBoundaryCharacter(paragraphString[selectionOffset - 1]))
+                    ambiguousBoundaryOffset = selectionOffset - 1;
+            }
+        }
+    }
+    
+    Vector<TextCheckingResult> results;
+    uint64_t checkingTypes = 0;
+    if (markSpelling)
+        checkingTypes |= TextCheckingTypeSpelling;
+    if (markGrammar)
+        checkingTypes |= TextCheckingTypeGrammar;
+    if (performTextCheckingReplacements) {
+        if (isAutomaticLinkDetectionEnabled())
+            checkingTypes |= TextCheckingTypeLink;
+        if (isAutomaticQuoteSubstitutionEnabled())
+            checkingTypes |= TextCheckingTypeQuote;
+        if (isAutomaticDashSubstitutionEnabled())
+            checkingTypes |= TextCheckingTypeDash;
+        if (isAutomaticTextReplacementEnabled())
+            checkingTypes |= TextCheckingTypeReplacement;
+        if (markSpelling && isAutomaticSpellingCorrectionEnabled())
+            checkingTypes |= TextCheckingTypeCorrection;
+    }
+    client()->checkTextOfParagraph(paragraphString.characters(), paragraphLength, checkingTypes, results);
+    
+    for (unsigned i = 0; i < results.size(); i++) {
+        const TextCheckingResult* result = &results[i];
+        int resultLocation = result->location + offsetDueToReplacement;
+        int resultLength = result->length;
+        if (markSpelling && result->type == TextCheckingTypeSpelling && resultLocation >= spellingRangeStartOffset && resultLocation + resultLength <= spellingRangeEndOffset) {
+            ASSERT(resultLength > 0 && resultLocation >= 0);
+            RefPtr<Range> misspellingRange = TextIterator::subrange(spellingRange, resultLocation - spellingRangeStartOffset, resultLength);
+            misspellingRange->startContainer(ec)->document()->addMarker(misspellingRange.get(), DocumentMarker::Spelling);
+        } else if (markGrammar && result->type == TextCheckingTypeGrammar && resultLocation < grammarRangeEndOffset && resultLocation + resultLength > grammarRangeStartOffset) {
+            ASSERT(resultLength > 0 && resultLocation >= 0);
+            for (unsigned j = 0; j < result->details.size(); j++) {
+                const GrammarDetail* detail = &result->details[j];
+                ASSERT(detail->length > 0 && detail->location >= 0);
+                if (resultLocation + detail->location >= grammarRangeStartOffset && resultLocation + detail->location + detail->length <= grammarRangeEndOffset) {
+                    RefPtr<Range> badGrammarRange = TextIterator::subrange(grammarRange, resultLocation + detail->location - grammarRangeStartOffset, detail->length);
+                    grammarRange->startContainer(ec)->document()->addMarker(badGrammarRange.get(), DocumentMarker::Grammar, detail->userDescription);
+                }
+            }
+        } else if (performTextCheckingReplacements && resultLocation + resultLength <= spellingRangeEndOffset && resultLocation + resultLength >= spellingRangeStartOffset &&
+                    (result->type == TextCheckingTypeLink
+                    || result->type == TextCheckingTypeQuote
+                    || result->type == TextCheckingTypeDash
+                    || result->type == TextCheckingTypeReplacement
+                    || result->type == TextCheckingTypeCorrection)) {
+            // In this case the result range just has to touch the spelling range, so we can handle replacing non-word text such as punctuation.
+            ASSERT(resultLength > 0 && resultLocation >= 0);
+            int replacementLength = result->replacement.length();
+            bool doReplacement = (replacementLength > 0);
+            RefPtr<Range> rangeToReplace = TextIterator::subrange(paragraphRange.get(), resultLocation, resultLength);
+            VisibleSelection selectionToReplace(rangeToReplace.get(), DOWNSTREAM);
+        
+            // avoid correcting text after an ambiguous boundary character has been typed
+            // FIXME: this is required until 6853027 is fixed and text checking can do this for us
+            if (ambiguousBoundaryOffset >= 0 && resultLocation + resultLength == ambiguousBoundaryOffset)
+                doReplacement = false;
+
+            // adding links should be done only immediately after they are typed
+            if (result->type == TextCheckingTypeLink && selectionOffset > resultLocation + resultLength + 1)
+                doReplacement = false;
+
+            // Don't correct spelling in an already-corrected word.
+            if (doReplacement && result->type == TextCheckingTypeCorrection) {
+                Node* node = rangeToReplace->startContainer();
+                int startOffset = rangeToReplace->startOffset();
+                int endOffset = startOffset + replacementLength;
+                Vector<DocumentMarker> markers = node->document()->markersForNode(node);
+                size_t markerCount = markers.size();
+                for (size_t i = 0; i < markerCount; ++i) {
+                    const DocumentMarker& marker = markers[i];
+                    if (marker.type == DocumentMarker::Replacement && static_cast<int>(marker.startOffset) < endOffset && static_cast<int>(marker.endOffset) > startOffset) {
+                        doReplacement = false;
+                        break;
+                    }
+                    if (static_cast<int>(marker.startOffset) >= endOffset)
+                        break;
+                }
+            }
+            if (doReplacement && selectionToReplace != m_frame->selection()->selection()) {
+                if (m_frame->shouldChangeSelection(selectionToReplace)) {
+                    m_frame->selection()->setSelection(selectionToReplace);
+                    selectionChanged = true;
+                } else {
+                    doReplacement = false;
+                }
+            }
+            if (doReplacement) {
+                if (result->type == TextCheckingTypeLink) {
+                    restoreSelectionAfterChange = false;
+                    if (canEditRichly())
+                        applyCommand(CreateLinkCommand::create(m_frame->document(), result->replacement));
+                } else if (canEdit() && shouldInsertText(result->replacement, rangeToReplace.get(), EditorInsertActionTyped)) {
+                    String replacedString;
+                    if (result->type == TextCheckingTypeCorrection)
+                        replacedString = plainText(rangeToReplace.get());
+                    replaceSelectionWithText(result->replacement, false, false);
+                    spellingRangeEndOffset += replacementLength - resultLength;
+                    offsetDueToReplacement += replacementLength - resultLength;
+                    if (resultLocation < selectionOffset)
+                        selectionOffset += replacementLength - resultLength;
+                    if (result->type == TextCheckingTypeCorrection) {
+                        // Add a marker so that corrections can easily be undone and won't be re-corrected.
+                        RefPtr<Range> replacedRange = TextIterator::subrange(paragraphRange.get(), resultLocation, replacementLength);
+                        replacedRange->startContainer()->document()->addMarker(replacedRange.get(), DocumentMarker::Replacement, replacedString);
+                    }
+                }
+            }
+        }
+    }
+    
+    if (selectionChanged) {
+        // Restore the caret position if we have made any replacements
+        setEnd(paragraphRange.get(), endOfParagraph(startOfNextParagraph(paragraphRange->startPosition())));
+        int newLength = TextIterator::rangeLength(paragraphRange.get());
+        if (restoreSelectionAfterChange && selectionOffset >= 0 && selectionOffset <= newLength) {
+            RefPtr<Range> selectionRange = TextIterator::subrange(paragraphRange.get(), 0, selectionOffset);
+            m_frame->selection()->moveTo(selectionRange->endPosition(), DOWNSTREAM);
+            if (adjustSelectionForParagraphBoundaries)
+                m_frame->selection()->modify(SelectionController::MOVE, SelectionController::FORWARD, CharacterGranularity);
+        } else {
+            // If this fails for any reason, the fallback is to go one position beyond the last replacement
+            m_frame->selection()->moveTo(m_frame->selection()->end());
+            m_frame->selection()->modify(SelectionController::MOVE, SelectionController::FORWARD, CharacterGranularity);
+        }
+    }
+}
+
+void Editor::changeBackToReplacedString(const String& replacedString)
+{
+    if (replacedString.isEmpty())
+        return;
+
+    RefPtr<Range> selection = selectedRange();
+    if (!shouldInsertText(replacedString, selection.get(), EditorInsertActionPasted))
+        return;
+        
+    String paragraphString;
+    int selectionOffset;
+    RefPtr<Range> paragraphRange = paragraphAlignedRangeForRange(selection.get(), selectionOffset, paragraphString);
+    replaceSelectionWithText(replacedString, false, false);
+    RefPtr<Range> changedRange = TextIterator::subrange(paragraphRange.get(), selectionOffset, replacedString.length());
+    changedRange->startContainer()->document()->addMarker(changedRange.get(), DocumentMarker::Replacement, String());
+}
+
+#endif
+
+void Editor::markMisspellingsAndBadGrammar(const VisibleSelection& spellingSelection, bool markGrammar, const VisibleSelection& grammarSelection)
+{
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    if (!isContinuousSpellCheckingEnabled())
+        return;
+    markAllMisspellingsAndBadGrammarInRanges(true, spellingSelection.toNormalizedRange().get(), markGrammar && isGrammarCheckingEnabled(), grammarSelection.toNormalizedRange().get(), false);
+#else
+    RefPtr<Range> firstMisspellingRange;
+    markMisspellings(spellingSelection, firstMisspellingRange);
+    if (markGrammar)
+        markBadGrammar(grammarSelection);
 #endif
 }
 
@@ -1916,8 +2543,8 @@ PassRefPtr<Range> Editor::rangeForPoint(const IntPoint& windowPoint)
     if (!frameView)
         return 0;
     IntPoint framePoint = frameView->windowToContents(windowPoint);
-    Selection selection(frame->visiblePositionForPoint(framePoint));
-    return avoidIntersectionWithNode(selection.toRange().get(), deleteButtonController() ? deleteButtonController()->containerElement() : 0);
+    VisibleSelection selection(frame->visiblePositionForPoint(framePoint));
+    return avoidIntersectionWithNode(selection.toNormalizedRange().get(), m_deleteButtonController->containerElement());
 }
 
 void Editor::revealSelectionAfterEditingOperation()
@@ -1925,7 +2552,7 @@ void Editor::revealSelectionAfterEditingOperation()
     if (m_ignoreCompositionSelectionChange)
         return;
 
-    m_frame->revealSelection(RenderLayer::gAlignToEdgeIfNeeded);
+    m_frame->revealSelection(ScrollAlignment::alignToEdgeIfNeeded);
 }
 
 void Editor::setIgnoreCompositionSelectionChange(bool ignore)
@@ -1961,13 +2588,13 @@ bool Editor::getCompositionSelection(unsigned& selectionStart, unsigned& selecti
     if (end.node() != m_compositionNode)
         return false;
 
-    if (static_cast<unsigned>(start.offset()) < m_compositionStart)
+    if (static_cast<unsigned>(start.deprecatedEditingOffset()) < m_compositionStart)
         return false;
-    if (static_cast<unsigned>(end.offset()) > m_compositionEnd)
+    if (static_cast<unsigned>(end.deprecatedEditingOffset()) > m_compositionEnd)
         return false;
 
-    selectionStart = start.offset() - m_compositionStart;
-    selectionEnd = start.offset() - m_compositionEnd;
+    selectionStart = start.deprecatedEditingOffset() - m_compositionStart;
+    selectionEnd = start.deprecatedEditingOffset() - m_compositionEnd;
     return true;
 }
 
@@ -1976,7 +2603,7 @@ void Editor::transpose()
     if (!canEdit())
         return;
 
-     Selection selection = m_frame->selection()->selection();
+     VisibleSelection selection = m_frame->selection()->selection();
      if (!selection.isCaret())
          return;
 
@@ -1992,7 +2619,7 @@ void Editor::transpose()
     RefPtr<Range> range = makeRange(previous, next);
     if (!range)
         return;
-    Selection newSelection(range.get(), DOWNSTREAM);
+    VisibleSelection newSelection(range.get(), DOWNSTREAM);
 
     // Transpose the two characters.
     String text = plainText(range.get());
@@ -2018,8 +2645,7 @@ void Editor::addToKillRing(Range* range, bool prepend)
     if (m_shouldStartNewKillRingSequence)
         startNewKillRingSequence();
 
-    String text = plainText(range);
-    text.replace('\\', m_frame->backslashAsCurrencySymbol());
+    String text = m_frame->displayStringModifiedByEncoding(plainText(range));
     if (prepend)
         prependToKillRing(text);
     else
@@ -2068,8 +2694,8 @@ bool Editor::insideVisibleArea(const IntPoint& point) const
     if (!(container->style()->overflowX() == OHIDDEN || container->style()->overflowY() == OHIDDEN))
         return true;
 
-    IntRect rectInPageCoords = container->getOverflowClipRect(0, 0);
-    IntRect rectInFrameCoords = IntRect(renderer->xPos() * -1, renderer->yPos() * -1,
+    IntRect rectInPageCoords = container->overflowClipRect(0, 0);
+    IntRect rectInFrameCoords = IntRect(renderer->x() * -1, renderer->y() * -1,
                                     rectInPageCoords.width(), rectInPageCoords.height());
 
     return rectInFrameCoords.contains(point);
@@ -2094,8 +2720,8 @@ bool Editor::insideVisibleArea(Range* range) const
     if (!(container->style()->overflowX() == OHIDDEN || container->style()->overflowY() == OHIDDEN))
         return true;
 
-    IntRect rectInPageCoords = container->getOverflowClipRect(0, 0);
-    IntRect rectInFrameCoords = IntRect(renderer->xPos() * -1, renderer->yPos() * -1,
+    IntRect rectInPageCoords = container->overflowClipRect(0, 0);
+    IntRect rectInFrameCoords = IntRect(renderer->x() * -1, renderer->y() * -1,
                                     rectInPageCoords.width(), rectInPageCoords.height());
     IntRect resultRect = range->boundingBox();
     
@@ -2184,4 +2810,25 @@ PassRefPtr<Range> Editor::nextVisibleRange(Range* currentRange, const String& ta
     return lastVisibleRange(target, caseFlag);
 }
 
+void Editor::changeSelectionAfterCommand(const VisibleSelection& newSelection, bool closeTyping, bool clearTypingStyle, EditCommand* cmd)
+{
+    // If there is no selection change, don't bother sending shouldChangeSelection, but still call setSelection,
+    // because there is work that it must do in this situation.
+    // The old selection can be invalid here and calling shouldChangeSelection can produce some strange calls.
+    // See <rdar://problem/5729315> Some shouldChangeSelectedDOMRange contain Ranges for selections that are no longer valid
+    bool selectionDidNotChangeDOMPosition = newSelection == m_frame->selection()->selection();
+    if (selectionDidNotChangeDOMPosition || m_frame->shouldChangeSelection(newSelection))
+        m_frame->selection()->setSelection(newSelection, closeTyping, clearTypingStyle);
+        
+    // Some kinds of deletes and line break insertions change the selection's position within the document without 
+    // changing its position within the DOM.  For example when you press return in the following (the caret is marked by ^): 
+    // <div contentEditable="true"><div>^Hello</div></div>
+    // WebCore inserts <div><br></div> *before* the current block, which correctly moves the paragraph down but which doesn't
+    // change the caret's DOM position (["hello", 0]).  In these situations the above SelectionController::setSelection call
+    // does not call EditorClient::respondToChangedSelection(), which, on the Mac, sends selection change notifications and 
+    // starts a new kill ring sequence, but we want to do these things (matches AppKit).
+    if (selectionDidNotChangeDOMPosition && cmd->isTypingCommand())
+        client()->respondToChangedSelection();
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/editing/Editor.h b/src/3rdparty/webkit/WebCore/editing/Editor.h
index d97f670..67a4b59 100644
--- a/src/3rdparty/webkit/WebCore/editing/Editor.h
+++ b/src/3rdparty/webkit/WebCore/editing/Editor.h
@@ -110,8 +110,8 @@ public:
     bool shouldDeleteRange(Range*) const;
     bool shouldApplyStyle(CSSStyleDeclaration*, Range*);
     
-    void respondToChangedSelection(const Selection& oldSelection);
-    void respondToChangedContents(const Selection& endingSelection);
+    void respondToChangedSelection(const VisibleSelection& oldSelection);
+    void respondToChangedContents(const VisibleSelection& endingSelection);
 
     TriState selectionHasStyle(CSSStyleDeclaration*) const;
     const SimpleFontData* fontForSelection(bool&) const;
@@ -151,6 +151,9 @@ public:
     bool selectionStartHasStyle(CSSStyleDeclaration*) const;
 
     bool clientIsEditable() const;
+    
+    void setShouldStyleWithCSS(bool flag) { m_shouldStyleWithCSS = flag; }
+    bool shouldStyleWithCSS() const { return m_shouldStyleWithCSS; }
 
     class Command {
     public:
@@ -192,9 +195,31 @@ public:
     bool isSelectionMisspelled();
     Vector<String> guessesForMisspelledSelection();
     Vector<String> guessesForUngrammaticalSelection();
+    Vector<String> guessesForMisspelledOrUngrammaticalSelection(bool& misspelled, bool& ungrammatical);
     void markMisspellingsAfterTypingToPosition(const VisiblePosition&);
-    void markMisspellings(const Selection&);
-    void markBadGrammar(const Selection&);
+    void markMisspellings(const VisibleSelection&, RefPtr<Range>& firstMisspellingRange);
+    void markBadGrammar(const VisibleSelection&);
+    void markMisspellingsAndBadGrammar(const VisibleSelection& spellingSelection, bool markGrammar, const VisibleSelection& grammarSelection);
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    void uppercaseWord();
+    void lowercaseWord();
+    void capitalizeWord();
+    void showSubstitutionsPanel();
+    bool substitutionsPanelIsShowing();
+    void toggleSmartInsertDelete();
+    bool isAutomaticQuoteSubstitutionEnabled();
+    void toggleAutomaticQuoteSubstitution();
+    bool isAutomaticLinkDetectionEnabled();
+    void toggleAutomaticLinkDetection();
+    bool isAutomaticDashSubstitutionEnabled();
+    void toggleAutomaticDashSubstitution();
+    bool isAutomaticTextReplacementEnabled();
+    void toggleAutomaticTextReplacement();
+    bool isAutomaticSpellingCorrectionEnabled();
+    void toggleAutomaticSpellingCorrection();
+    void markAllMisspellingsAndBadGrammarInRanges(bool markSpelling, Range* spellingRange, bool markGrammar, Range* grammarRange, bool performTextCheckingReplacements);
+    void changeBackToReplacedString(const String& replacedString);
+#endif
     void advanceToNextMisspelling(bool startBeforeSelection = false);
     void showSpellingGuessPanel();
     bool spellingPanelIsShowing();
@@ -250,7 +275,7 @@ public:
 
     void clear();
 
-    Selection selectionForCommand(Event*);
+    VisibleSelection selectionForCommand(Event*);
 
     void appendToKillRing(const String&);
     void prependToKillRing(const String&);
@@ -278,6 +303,7 @@ private:
     Vector<CompositionUnderline> m_customCompositionUnderlines;
     bool m_ignoreCompositionSelectionChange;
     bool m_shouldStartNewKillRingSequence;
+    bool m_shouldStyleWithCSS;
 
     bool canDeleteRange(Range*) const;
     bool canSmartReplaceWithPasteboard(Pasteboard*);
@@ -295,6 +321,8 @@ private:
 
     PassRefPtr<Range> firstVisibleRange(const String&, bool caseFlag);
     PassRefPtr<Range> lastVisibleRange(const String&, bool caseFlag);
+    
+    void changeSelectionAfterCommand(const VisibleSelection& newSelection, bool closeTyping, bool clearTypingStyle, EditCommand*);
 };
 
 inline void Editor::setStartNewKillRingSequence(bool flag)
diff --git a/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp b/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
index cc680a6..ab62c09 100644
--- a/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/EditorCommand.cpp
@@ -27,6 +27,7 @@
 #include "config.h"
 
 #include "AtomicString.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "CreateLinkCommand.h"
@@ -35,13 +36,14 @@
 #include "EditorClient.h"
 #include "Event.h"
 #include "EventHandler.h"
-#include "Frame.h"
 #include "FormatBlockCommand.h"
+#include "Frame.h"
 #include "HTMLFontElement.h"
 #include "HTMLImageElement.h"
 #include "IndentOutdentCommand.h"
 #include "InsertListCommand.h"
 #include "Page.h"
+#include "RenderBox.h"
 #include "ReplaceSelectionCommand.h"
 #include "Scrollbar.h"
 #include "Settings.h"
@@ -184,15 +186,15 @@ static bool executeInsertNode(Frame* frame, PassRefPtr<Node> content)
 
 static bool expandSelectionToGranularity(Frame* frame, TextGranularity granularity)
 {
-    Selection selection = frame->selection()->selection();
+    VisibleSelection selection = frame->selection()->selection();
     selection.expandUsingGranularity(granularity);
-    RefPtr<Range> newRange = selection.toRange();
+    RefPtr<Range> newRange = selection.toNormalizedRange();
     if (!newRange)
         return false;
     ExceptionCode ec = 0;
     if (newRange->collapsed(ec))
         return false;
-    RefPtr<Range> oldRange = frame->selection()->selection().toRange();
+    RefPtr<Range> oldRange = frame->selection()->selection().toNormalizedRange();
     EAffinity affinity = frame->selection()->affinity();
     if (!frame->editor()->client()->shouldChangeSelectedRange(oldRange.get(), newRange.get(), affinity, false))
         return false;
@@ -225,14 +227,14 @@ static int verticalScrollDistance(Frame* frame)
     if (!focusedNode)
         return 0;
     RenderObject* renderer = focusedNode->renderer();
-    if (!renderer)
+    if (!renderer || !renderer->isBox())
         return 0;
     RenderStyle* style = renderer->style();
     if (!style)
         return 0;
     if (!(style->overflowY() == OSCROLL || style->overflowY() == OAUTO || renderer->isTextArea()))
         return 0;
-    int height = renderer->clientHeight();
+    int height = toRenderBox(renderer)->clientHeight();
     return max((height + 1) / 2, height - cAmountToKeepWhenPaging);
 }
 
@@ -342,7 +344,7 @@ static bool executeDeleteToEndOfParagraph(Frame* frame, Event*, EditorCommandSou
 
 static bool executeDeleteToMark(Frame* frame, Event*, EditorCommandSource, const String&)
 {
-    RefPtr<Range> mark = frame->mark().toRange();
+    RefPtr<Range> mark = frame->mark().toNormalizedRange();
     if (mark) {
         SelectionController* selection = frame->selection();
         bool selected = selection->setSelectedRange(unionDOMRanges(mark.get(), frame->editor()->selectedRange().get()).get(), DOWNSTREAM, true);
@@ -491,9 +493,9 @@ static bool executeInsertNewlineInQuotedContent(Frame* frame, Event*, EditorComm
     return true;
 }
 
-static bool executeInsertOrderedList(Frame* frame, Event*, EditorCommandSource, const String& value)
+static bool executeInsertOrderedList(Frame* frame, Event*, EditorCommandSource, const String&)
 {
-    applyCommand(InsertListCommand::create(frame->document(), InsertListCommand::OrderedList, value));
+    applyCommand(InsertListCommand::create(frame->document(), InsertListCommand::OrderedList));
     return true;
 }
 
@@ -514,9 +516,9 @@ static bool executeInsertText(Frame* frame, Event*, EditorCommandSource, const S
     return true;
 }
 
-static bool executeInsertUnorderedList(Frame* frame, Event*, EditorCommandSource, const String& value)
+static bool executeInsertUnorderedList(Frame* frame, Event*, EditorCommandSource, const String&)
 {
-    applyCommand(InsertListCommand::create(frame->document(), InsertListCommand::UnorderedList, value));
+    applyCommand(InsertListCommand::create(frame->document(), InsertListCommand::UnorderedList));
     return true;
 }
 
@@ -826,6 +828,30 @@ static bool executeMoveWordRightAndModifySelection(Frame* frame, Event*, EditorC
     return true;
 }
 
+static bool executeMoveToLeftEndOfLine(Frame* frame, Event*, EditorCommandSource, const String&)
+{
+    frame->selection()->modify(SelectionController::MOVE, SelectionController::LEFT, LineBoundary, true);
+    return true;
+}
+
+static bool executeMoveToLeftEndOfLineAndModifySelection(Frame* frame, Event*, EditorCommandSource, const String&)
+{
+    frame->selection()->modify(SelectionController::EXTEND, SelectionController::LEFT, LineBoundary, true);
+    return true;
+}
+
+static bool executeMoveToRightEndOfLine(Frame* frame, Event*, EditorCommandSource, const String&)
+{
+    frame->selection()->modify(SelectionController::MOVE, SelectionController::RIGHT, LineBoundary, true);
+    return true;
+}
+
+static bool executeMoveToRightEndOfLineAndModifySelection(Frame* frame, Event*, EditorCommandSource, const String&)
+{
+    frame->selection()->modify(SelectionController::EXTEND, SelectionController::RIGHT, LineBoundary, true);
+    return true;
+}
+
 static bool executeOutdent(Frame* frame, Event*, EditorCommandSource, const String&)
 {
     applyCommand(IndentOutdentCommand::create(frame->document(), IndentOutdentCommand::Outdent));
@@ -888,7 +914,7 @@ static bool executeSelectSentence(Frame* frame, Event*, EditorCommandSource, con
 
 static bool executeSelectToMark(Frame* frame, Event*, EditorCommandSource, const String&)
 {
-    RefPtr<Range> mark = frame->mark().toRange();
+    RefPtr<Range> mark = frame->mark().toNormalizedRange();
     RefPtr<Range> selection = frame->editor()->selectedRange();
     if (!mark || !selection) {
         systemBeep();
@@ -914,20 +940,29 @@ static bool executeStrikethrough(Frame* frame, Event*, EditorCommandSource sourc
     return executeToggleStyle(frame, source, EditActionChangeAttributes, CSSPropertyWebkitTextDecorationsInEffect, "none", "line-through");
 }
 
+static bool executeStyleWithCSS(Frame* frame, Event*, EditorCommandSource, const String& value)
+{
+    if (value != "false" && value != "true")
+        return false;
+    
+    frame->editor()->setShouldStyleWithCSS(value == "true" ? true : false);
+    return true;
+}
+
 static bool executeSubscript(Frame* frame, Event*, EditorCommandSource source, const String&)
 {
-    return executeApplyStyle(frame, source, EditActionSubscript, CSSPropertyVerticalAlign, "sub");
+    return executeToggleStyle(frame, source, EditActionSubscript, CSSPropertyVerticalAlign, "baseline", "sub");
 }
 
 static bool executeSuperscript(Frame* frame, Event*, EditorCommandSource source, const String&)
 {
-    return executeApplyStyle(frame, source, EditActionSuperscript, CSSPropertyVerticalAlign, "super");
+    return executeToggleStyle(frame, source, EditActionSuperscript, CSSPropertyVerticalAlign, "baseline", "super");
 }
 
 static bool executeSwapWithMark(Frame* frame, Event*, EditorCommandSource, const String&)
 {
-    const Selection& mark = frame->mark();
-    const Selection& selection = frame->selection()->selection();
+    const VisibleSelection& mark = frame->mark();
+    const VisibleSelection& selection = frame->selection()->selection();
     if (mark.isNone() || selection.isNone()) {
         systemBeep();
         return false;
@@ -1033,20 +1068,20 @@ static bool enabled(Frame*, Event*, EditorCommandSource)
 static bool enabledVisibleSelection(Frame* frame, Event* event, EditorCommandSource)
 {
     // The term "visible" here includes a caret in editable text or a range in any text.
-    const Selection& selection = frame->editor()->selectionForCommand(event);
+    const VisibleSelection& selection = frame->editor()->selectionForCommand(event);
     return (selection.isCaret() && selection.isContentEditable()) || selection.isRange();
 }
 
 static bool enabledVisibleSelectionAndMark(Frame* frame, Event* event, EditorCommandSource)
 {
-    const Selection& selection = frame->editor()->selectionForCommand(event);
+    const VisibleSelection& selection = frame->editor()->selectionForCommand(event);
     return ((selection.isCaret() && selection.isContentEditable()) || selection.isRange())
         && frame->mark().isCaretOrRange();
 }
 
 static bool enableCaretInEditableText(Frame* frame, Event* event, EditorCommandSource)
 {
-    const Selection& selection = frame->editor()->selectionForCommand(event);
+    const VisibleSelection& selection = frame->editor()->selectionForCommand(event);
     return selection.isCaret() && selection.isContentEditable();
 }
 
@@ -1138,6 +1173,11 @@ static TriState stateStrikethrough(Frame* frame, Event*)
     return stateStyle(frame, CSSPropertyTextDecoration, "line-through");
 }
 
+static TriState stateStyleWithCSS(Frame* frame, Event*)
+{
+    return frame->editor()->shouldStyleWithCSS() ? TrueTriState : FalseTriState;
+}
+
 static TriState stateSubscript(Frame* frame, Event*)
 {
     return stateStyle(frame, CSSPropertyVerticalAlign, "sub");
@@ -1180,37 +1220,36 @@ static String valueNull(Frame*, Event*)
     return String();
 }
 
-String valueBackColor(Frame* frame, Event*)
+static String valueBackColor(Frame* frame, Event*)
 {
     return valueStyle(frame, CSSPropertyBackgroundColor);
 }
 
-String valueFontName(Frame* frame, Event*)
+static String valueFontName(Frame* frame, Event*)
 {
     return valueStyle(frame, CSSPropertyFontFamily);
 }
 
-String valueFontSize(Frame* frame, Event*)
+static String valueFontSize(Frame* frame, Event*)
 {
     return valueStyle(frame, CSSPropertyFontSize);
 }
 
-String valueFontSizeDelta(Frame* frame, Event*)
+static String valueFontSizeDelta(Frame* frame, Event*)
 {
     return valueStyle(frame, CSSPropertyWebkitFontSizeDelta);
 }
 
-String valueForeColor(Frame* frame, Event*)
+static String valueForeColor(Frame* frame, Event*)
 {
     return valueStyle(frame, CSSPropertyColor);
 }
 
 // Map of functions
 
+struct CommandEntry { const char* name; EditorInternalCommand command; };
 static const CommandMap& createCommandMap()
 {
-    struct CommandEntry { const char* name; EditorInternalCommand command; };
-    
     static const CommandEntry commands[] = {
         { "AlignCenter", { executeJustifyCenter, supportedFromMenuOrKeyBinding, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "AlignJustified", { executeJustifyFull, supportedFromMenuOrKeyBinding, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
@@ -1244,8 +1283,8 @@ static const CommandMap& createCommandMap()
         { "IgnoreSpelling", { executeIgnoreSpelling, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "Indent", { executeIndent, supported, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "InsertBacktab", { executeInsertBacktab, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, isTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "InsertHorizontalRule", { executeInsertHorizontalRule, supported, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "InsertHTML", { executeInsertHTML, supported, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "InsertHorizontalRule", { executeInsertHorizontalRule, supported, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "InsertImage", { executeInsertImage, supported, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "InsertLineBreak", { executeInsertLineBreak, supported, enabledInEditableText, stateNone, valueNull, isTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "InsertNewline", { executeInsertNewline, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, isTextInsertion, doNotAllowExecutionWhenDisabled } },    
@@ -1296,6 +1335,10 @@ static const CommandMap& createCommandMap()
         { "MoveToEndOfParagraphAndModifySelection", { executeMoveToEndOfParagraphAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToEndOfSentence", { executeMoveToEndOfSentence, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveToEndOfSentenceAndModifySelection", { executeMoveToEndOfSentenceAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveToLeftEndOfLine", { executeMoveToLeftEndOfLine, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveToLeftEndOfLineAndModifySelection", { executeMoveToLeftEndOfLineAndModifySelection, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveToRightEndOfLine", { executeMoveToRightEndOfLine, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "MoveToRightEndOfLineAndModifySelection", { executeMoveToRightEndOfLineAndModifySelection, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveUp", { executeMoveUp, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveUpAndModifySelection", { executeMoveUpAndModifySelection, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "MoveWordBackward", { executeMoveWordBackward, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
@@ -1320,6 +1363,7 @@ static const CommandMap& createCommandMap()
         { "SelectWord", { executeSelectWord, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "SetMark", { executeSetMark, supportedFromMenuOrKeyBinding, enabledVisibleSelection, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "Strikethrough", { executeStrikethrough, supported, enabledInRichlyEditableText, stateStrikethrough, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "StyleWithCSS", { executeStyleWithCSS, supported, enabledInRichlyEditableText, stateStyleWithCSS, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "Subscript", { executeSubscript, supported, enabledInRichlyEditableText, stateSubscript, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "Superscript", { executeSuperscript, supported, enabledInRichlyEditableText, stateSuperscript, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "SwapWithMark", { executeSwapWithMark, supportedFromMenuOrKeyBinding, enabledVisibleSelectionAndMark, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
@@ -1428,7 +1472,7 @@ bool Editor::Command::execute(const String& parameter, Event* triggeringEvent) c
 {
     if (!isEnabled(triggeringEvent)) {
         // Let certain commands be executed when performed explicitly even if they are disabled.
-        if (!isSupported() || !m_frame || !m_frame->document() || !m_command->allowExecutionWhenDisabled)
+        if (!isSupported() || !m_frame || !m_command->allowExecutionWhenDisabled)
             return false;
     }
     m_frame->document()->updateLayoutIgnorePendingStylesheets();
@@ -1447,21 +1491,21 @@ bool Editor::Command::isSupported() const
 
 bool Editor::Command::isEnabled(Event* triggeringEvent) const
 {
-    if (!isSupported() || !m_frame || !m_frame->document())
+    if (!isSupported() || !m_frame)
         return false;
     return m_command->isEnabled(m_frame.get(), triggeringEvent, m_source);
 }
 
 TriState Editor::Command::state(Event* triggeringEvent) const
 {
-    if (!isSupported() || !m_frame || !m_frame->document())
+    if (!isSupported() || !m_frame)
         return FalseTriState;
     return m_command->state(m_frame.get(), triggeringEvent);
 }
 
 String Editor::Command::value(Event* triggeringEvent) const
 {
-    if (!isSupported() || !m_frame || !m_frame->document())
+    if (!isSupported() || !m_frame)
         return String();
     return m_command->value(m_frame.get(), triggeringEvent);
 }
diff --git a/src/3rdparty/webkit/WebCore/editing/FormatBlockCommand.cpp b/src/3rdparty/webkit/WebCore/editing/FormatBlockCommand.cpp
index 6a4ee7e..d92f365 100644
--- a/src/3rdparty/webkit/WebCore/editing/FormatBlockCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/FormatBlockCommand.cpp
@@ -63,7 +63,7 @@ bool FormatBlockCommand::modifyRange()
     setEndingSelection(visibleEnd);
     doApply();
     visibleEnd = endingSelection().visibleEnd();
-    setEndingSelection(Selection(visibleStart.deepEquivalent(), visibleEnd.deepEquivalent(), DOWNSTREAM));
+    setEndingSelection(VisibleSelection(visibleStart.deepEquivalent(), visibleEnd.deepEquivalent(), DOWNSTREAM));
 
     return true;
 }
@@ -87,7 +87,7 @@ void FormatBlockCommand::doApply()
     // margin/padding, but not others.  We should make the gap painting more consistent and 
     // then use a left margin/padding rule here.
     if (visibleEnd != visibleStart && isStartOfParagraph(visibleEnd))
-        setEndingSelection(Selection(visibleStart, visibleEnd.previous(true)));
+        setEndingSelection(VisibleSelection(visibleStart, visibleEnd.previous(true)));
 
     if (endingSelection().isRange() && modifyRange())
         return;
@@ -124,7 +124,7 @@ void FormatBlockCommand::doApply()
     appendNode(placeholder, blockNode);
     
     VisiblePosition destination(Position(placeholder.get(), 0));
-    if (paragraphStart == paragraphEnd && !lineBreakExistsAtPosition(paragraphStart)) {
+    if (paragraphStart == paragraphEnd && !lineBreakExistsAtVisiblePosition(paragraphStart)) {
         setEndingSelection(destination);
         return;
     }
diff --git a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
index 03c59d3..3922367 100644
--- a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.cpp
@@ -78,7 +78,7 @@ IndentOutdentCommand::IndentOutdentCommand(Document* document, EIndentType typeO
 
 // This function is a workaround for moveParagraph's tendency to strip blockquotes. It updates lastBlockquote to point to the
 // correct level for the current paragraph, and returns a pointer to a placeholder br where the insertion should be performed.
-PassRefPtr<Element> IndentOutdentCommand::prepareBlockquoteLevelForInsertion(VisiblePosition& currentParagraph, RefPtr<Element>& lastBlockquote)
+PassRefPtr<Element> IndentOutdentCommand::prepareBlockquoteLevelForInsertion(const VisiblePosition& currentParagraph, RefPtr<Element>& lastBlockquote)
 {
     int currentBlockquoteLevel = 0;
     int lastBlockquoteLevel = 0;
@@ -103,13 +103,69 @@ PassRefPtr<Element> IndentOutdentCommand::prepareBlockquoteLevelForInsertion(Vis
     // Add another br before the placeholder if it collapsed.
     VisiblePosition visiblePos(Position(placeholder.get(), 0));
     if (!isStartOfParagraph(visiblePos))
-        insertNodeBefore(createBreakElement(document()).get(), placeholder.get());
-    return placeholder.get();
+        insertNodeBefore(createBreakElement(document()), placeholder);
+    return placeholder.release();
+}
+
+bool IndentOutdentCommand::tryIndentingAsListItem(const VisiblePosition& endOfCurrentParagraph)
+{
+    // If our selection is not inside a list, bail out.
+    Node* lastNodeInSelectedParagraph = endOfCurrentParagraph.deepEquivalent().node();
+    RefPtr<Element> listNode = enclosingList(lastNodeInSelectedParagraph);
+    if (!listNode)
+        return false;
+
+    HTMLElement* selectedListItem = enclosingListChild(lastNodeInSelectedParagraph);
+
+    // FIXME: previousElementSibling does not ignore non-rendered content like <span></span>.  Should we?
+    Element* previousList = selectedListItem->previousElementSibling();
+    Element* nextList = selectedListItem->nextElementSibling();
+
+    RefPtr<Element> newList = document()->createElement(listNode->tagQName(), false);
+    RefPtr<Element> newListItem = selectedListItem->cloneElementWithoutChildren();
+    RefPtr<Element> placeholder = createBreakElement(document());
+    insertNodeBefore(newList, selectedListItem);
+    appendNode(newListItem, newList);
+    appendNode(placeholder, newListItem);
+
+    moveParagraph(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, VisiblePosition(Position(placeholder, 0)), true);
+
+    if (canMergeLists(previousList, newList.get()))
+        mergeIdenticalElements(previousList, newList);
+    if (canMergeLists(newList.get(), nextList))
+        mergeIdenticalElements(newList, nextList);
+
+    return true;
+}
+    
+void IndentOutdentCommand::indentIntoBlockquote(const VisiblePosition& endOfCurrentParagraph, const VisiblePosition& endOfNextParagraph, RefPtr<Element>& targetBlockquote)
+{
+    Node* enclosingCell = 0;
+
+    if (!targetBlockquote) {
+        // Create a new blockquote and insert it as a child of the root editable element. We accomplish
+        // this by splitting all parents of the current paragraph up to that point.
+        targetBlockquote = createIndentBlockquoteElement(document());
+        Position start = startOfParagraph(endOfCurrentParagraph).deepEquivalent();
+        enclosingCell = enclosingNodeOfType(start, &isTableCell);
+        Node* nodeToSplitTo = enclosingCell ? enclosingCell : editableRootForPosition(start);
+        RefPtr<Node> startOfNewBlock = splitTreeToNode(start.node(), nodeToSplitTo);
+        insertNodeBefore(targetBlockquote, startOfNewBlock);
+    }
+
+    RefPtr<Element> insertionPoint = prepareBlockquoteLevelForInsertion(endOfCurrentParagraph, targetBlockquote);
+
+    // Don't put the next paragraph in the blockquote we just created for this paragraph unless 
+    // the next paragraph is in the same cell.
+    if (enclosingCell && enclosingCell != enclosingNodeOfType(endOfNextParagraph.deepEquivalent(), &isTableCell))
+        targetBlockquote = 0;
+
+    moveParagraph(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, VisiblePosition(Position(insertionPoint, 0)), true);
 }
 
 void IndentOutdentCommand::indentRegion()
 {
-    Selection selection = selectionForParagraphIteration(endingSelection());
+    VisibleSelection selection = selectionForParagraphIteration(endingSelection());
     VisiblePosition startOfSelection = selection.visibleStart();
     VisiblePosition endOfSelection = selection.visibleEnd();
     int startIndex = indexForVisiblePosition(startOfSelection);
@@ -117,7 +173,7 @@ void IndentOutdentCommand::indentRegion()
 
     ASSERT(!startOfSelection.isNull());
     ASSERT(!endOfSelection.isNull());
-    
+
     // Special case empty root editable elements because there's nothing to split
     // and there's nothing to move.
     Position start = startOfSelection.deepEquivalent().downstream();
@@ -126,61 +182,24 @@ void IndentOutdentCommand::indentRegion()
         insertNodeAt(blockquote, start);
         RefPtr<Element> placeholder = createBreakElement(document());
         appendNode(placeholder, blockquote);
-        setEndingSelection(Selection(Position(placeholder.get(), 0), DOWNSTREAM));
+        setEndingSelection(VisibleSelection(Position(placeholder.get(), 0), DOWNSTREAM));
         return;
     }
-    
-    RefPtr<Element> previousListNode;
-    RefPtr<Element> newListNode;
-    RefPtr<Element> newBlockquote;
+
+    RefPtr<Element> blockquoteForNextIndent;
     VisiblePosition endOfCurrentParagraph = endOfParagraph(startOfSelection);
     VisiblePosition endAfterSelection = endOfParagraph(endOfParagraph(endOfSelection).next());
     while (endOfCurrentParagraph != endAfterSelection) {
         // Iterate across the selected paragraphs...
         VisiblePosition endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
-        RefPtr<Element> listNode = enclosingList(endOfCurrentParagraph.deepEquivalent().node());
-        RefPtr<Element> insertionPoint;
-        if (listNode) {
-            RefPtr<Element> placeholder = createBreakElement(document());
-            insertionPoint = placeholder;
-            newBlockquote = 0;
-            RefPtr<Element> listItem = createListItemElement(document());
-            if (listNode == previousListNode) {
-                // The previous paragraph was inside the same list, so add this list item to the list we already created
-                appendNode(listItem, newListNode);
-                appendNode(placeholder, listItem);
-            } else {
-                // Clone the list element, insert it before the current paragraph, and move the paragraph into it.
-                RefPtr<Element> clonedList = listNode->cloneElement();
-                insertNodeBefore(clonedList, enclosingListChild(endOfCurrentParagraph.deepEquivalent().node()));
-                appendNode(listItem, clonedList);
-                appendNode(placeholder, listItem);
-                newListNode = clonedList;
-                previousListNode = listNode;
-            }
-        } else if (newBlockquote)
-            // The previous paragraph was put into a new blockquote, so move this paragraph there as well
-            insertionPoint = prepareBlockquoteLevelForInsertion(endOfCurrentParagraph, newBlockquote);
-        else {
-            // Create a new blockquote and insert it as a child of the root editable element. We accomplish
-            // this by splitting all parents of the current paragraph up to that point.
-            RefPtr<Element> blockquote = createIndentBlockquoteElement(document());
-            Position start = startOfParagraph(endOfCurrentParagraph).deepEquivalent();
-            
-            Node* enclosingCell = enclosingNodeOfType(start, &isTableCell);
-            Node* nodeToSplitTo = enclosingCell ? enclosingCell : editableRootForPosition(start);
-            RefPtr<Node> startOfNewBlock = splitTreeToNode(start.node(), nodeToSplitTo);
-            insertNodeBefore(blockquote, startOfNewBlock);
-            newBlockquote = blockquote;
-            insertionPoint = prepareBlockquoteLevelForInsertion(endOfCurrentParagraph, newBlockquote);
-            // Don't put the next paragraph in the blockquote we just created for this paragraph unless 
-            // the next paragraph is in the same cell.
-            if (enclosingCell && enclosingCell != enclosingNodeOfType(endOfNextParagraph.deepEquivalent(), &isTableCell))
-                newBlockquote = 0;
-        }
-        moveParagraph(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, VisiblePosition(Position(insertionPoint, 0)), true);
-        // moveParagraph should not destroy content that contains endOfNextParagraph, but if it does, return here
-        // to avoid a crash.
+        if (tryIndentingAsListItem(endOfCurrentParagraph))
+            blockquoteForNextIndent = 0;
+        else
+            indentIntoBlockquote(endOfCurrentParagraph, endOfNextParagraph, blockquoteForNextIndent);
+            // blockquoteForNextIndent maybe updated
+            // this is due to the way prepareBlockquoteLevelForInsertion was designed.
+        // Sanity check: Make sure our moveParagraph calls didn't remove endOfNextParagraph.deepEquivalent().node()
+        // If somehow we did, return to prevent crashes.
         if (endOfNextParagraph.isNotNull() && !endOfNextParagraph.deepEquivalent().node()->inDocument()) {
             ASSERT_NOT_REACHED();
             return;
@@ -191,7 +210,7 @@ void IndentOutdentCommand::indentRegion()
     RefPtr<Range> startRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), startIndex, 0, true);
     RefPtr<Range> endRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), endIndex, 0, true);
     if (startRange && endRange)
-        setEndingSelection(Selection(startRange->startPosition(), endRange->startPosition(), DOWNSTREAM));
+        setEndingSelection(VisibleSelection(startRange->startPosition(), endRange->startPosition(), DOWNSTREAM));
 }
 
 void IndentOutdentCommand::outdentParagraph()
@@ -200,27 +219,40 @@ void IndentOutdentCommand::outdentParagraph()
     VisiblePosition visibleEndOfParagraph = endOfParagraph(visibleStartOfParagraph);
 
     Node* enclosingNode = enclosingNodeOfType(visibleStartOfParagraph.deepEquivalent(), &isListOrIndentBlockquote);
-    if (!enclosingNode)
+    if (!enclosingNode || !isContentEditable(enclosingNode->parentNode()))  // We can't outdent if there is no place to go!
         return;
 
     // Use InsertListCommand to remove the selection from the list
     if (enclosingNode->hasTagName(olTag)) {
-        applyCommandToComposite(InsertListCommand::create(document(), InsertListCommand::OrderedList, ""));
+        applyCommandToComposite(InsertListCommand::create(document(), InsertListCommand::OrderedList));
         return;        
     }
     if (enclosingNode->hasTagName(ulTag)) {
-        applyCommandToComposite(InsertListCommand::create(document(), InsertListCommand::UnorderedList, ""));
+        applyCommandToComposite(InsertListCommand::create(document(), InsertListCommand::UnorderedList));
         return;
     }
     
     // The selection is inside a blockquote
     VisiblePosition positionInEnclosingBlock = VisiblePosition(Position(enclosingNode, 0));
     VisiblePosition startOfEnclosingBlock = startOfBlock(positionInEnclosingBlock);
-    VisiblePosition endOfEnclosingBlock = endOfBlock(positionInEnclosingBlock);
+    VisiblePosition lastPositionInEnclosingBlock = VisiblePosition(Position(enclosingNode, enclosingNode->childNodeCount()));
+    VisiblePosition endOfEnclosingBlock = endOfBlock(lastPositionInEnclosingBlock);
     if (visibleStartOfParagraph == startOfEnclosingBlock &&
         visibleEndOfParagraph == endOfEnclosingBlock) {
         // The blockquote doesn't contain anything outside the paragraph, so it can be totally removed.
+        Node* splitPoint = enclosingNode->nextSibling();
         removeNodePreservingChildren(enclosingNode);
+        // outdentRegion() assumes it is operating on the first paragraph of an enclosing blockquote, but if there are multiply nested blockquotes and we've
+        // just removed one, then this assumption isn't true. By splitting the next containing blockquote after this node, we keep this assumption true
+        if (splitPoint) {
+            if (Node* splitPointParent = splitPoint->parentNode()) {
+                if (isIndentBlockquote(splitPointParent)
+                    && !isIndentBlockquote(splitPoint)
+                    && isContentEditable(splitPointParent->parentNode())) // We can't outdent if there is no place to go!
+                    splitElement(static_cast<Element*>(splitPointParent), splitPoint);
+            }
+        }
+        
         updateLayout();
         visibleStartOfParagraph = VisiblePosition(visibleStartOfParagraph.deepEquivalent());
         visibleEndOfParagraph = VisiblePosition(visibleEndOfParagraph.deepEquivalent());
@@ -228,6 +260,7 @@ void IndentOutdentCommand::outdentParagraph()
             insertNodeAt(createBreakElement(document()), visibleStartOfParagraph.deepEquivalent());
         if (visibleEndOfParagraph.isNotNull() && !isEndOfParagraph(visibleEndOfParagraph))
             insertNodeAt(createBreakElement(document()), visibleEndOfParagraph.deepEquivalent());
+
         return;
     }
     Node* enclosingBlockFlow = enclosingBlockFlowElement(visibleStartOfParagraph);
@@ -262,13 +295,13 @@ void IndentOutdentCommand::outdentRegion()
     while (endOfCurrentParagraph != endAfterSelection) {
         VisiblePosition endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
         if (endOfCurrentParagraph == endOfLastParagraph)
-            setEndingSelection(Selection(originalSelectionEnd, DOWNSTREAM));
+            setEndingSelection(VisibleSelection(originalSelectionEnd, DOWNSTREAM));
         else
             setEndingSelection(endOfCurrentParagraph);
         outdentParagraph();
         endOfCurrentParagraph = endOfNextParagraph;
     }
-    setEndingSelection(Selection(originalSelectionStart, endingSelection().end(), DOWNSTREAM));
+    setEndingSelection(VisibleSelection(originalSelectionStart, endingSelection().end(), DOWNSTREAM));
 }
 
 void IndentOutdentCommand::doApply()
@@ -290,7 +323,7 @@ void IndentOutdentCommand::doApply()
     // margin/padding, but not others.  We should make the gap painting more consistent and 
     // then use a left margin/padding rule here.
     if (visibleEnd != visibleStart && isStartOfParagraph(visibleEnd))
-        setEndingSelection(Selection(visibleStart, visibleEnd.previous(true)));
+        setEndingSelection(VisibleSelection(visibleStart, visibleEnd.previous(true)));
 
     if (m_typeOfAction == Indent)
         indentRegion();
diff --git a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
index bb1a1d2..419f832f 100644
--- a/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/IndentOutdentCommand.h
@@ -49,7 +49,9 @@ private:
     void indentRegion();
     void outdentRegion();
     void outdentParagraph();
-    PassRefPtr<Element> prepareBlockquoteLevelForInsertion(VisiblePosition&, RefPtr<Element>&);
+    PassRefPtr<Element> prepareBlockquoteLevelForInsertion(const VisiblePosition&, RefPtr<Element>&);
+    bool tryIndentingAsListItem(const VisiblePosition&);
+    void indentIntoBlockquote(const VisiblePosition&, const VisiblePosition&, RefPtr<Element>&);
 
     EIndentType m_typeOfAction;
     int m_marginInPixels;
diff --git a/src/3rdparty/webkit/WebCore/editing/InsertLineBreakCommand.cpp b/src/3rdparty/webkit/WebCore/editing/InsertLineBreakCommand.cpp
index 15750fe..f020459 100644
--- a/src/3rdparty/webkit/WebCore/editing/InsertLineBreakCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/InsertLineBreakCommand.cpp
@@ -28,13 +28,14 @@
 
 #include "CSSMutableStyleDeclaration.h"
 #include "Document.h"
-#include "Element.h"
 #include "Frame.h"
+#include "HTMLElement.h"
+#include "HTMLNames.h"
+#include "Range.h"
+#include "RenderObject.h"
 #include "Text.h"
 #include "VisiblePosition.h"
-#include "Range.h"
 #include "htmlediting.h"
-#include "HTMLNames.h"
 #include "visible_units.h"
 
 namespace WebCore {
@@ -88,7 +89,7 @@ bool InsertLineBreakCommand::shouldUseBreakElement(const Position& insertionPos)
 void InsertLineBreakCommand::doApply()
 {
     deleteSelection();
-    Selection selection = endingSelection();
+    VisibleSelection selection = endingSelection();
     if (selection.isNone())
         return;
     
@@ -107,38 +108,37 @@ void InsertLineBreakCommand::doApply()
     
     // FIXME: Need to merge text nodes when inserting just after or before text.
     
-    if (isEndOfParagraph(caret) && !lineBreakExistsAtPosition(caret)) {
+    if (isEndOfParagraph(caret) && !lineBreakExistsAtVisiblePosition(caret)) {
         bool needExtraLineBreak = !pos.node()->hasTagName(hrTag) && !pos.node()->hasTagName(tableTag);
         
         insertNodeAt(nodeToInsert.get(), pos);
         
         if (needExtraLineBreak)
-            insertNodeBefore(nodeToInsert->cloneNode(false).get(), nodeToInsert.get());
+            insertNodeBefore(nodeToInsert->cloneNode(false), nodeToInsert);
         
         VisiblePosition endingPosition(Position(nodeToInsert.get(), 0));
-        setEndingSelection(Selection(endingPosition));
-    } else if (pos.offset() <= caretMinOffset(pos.node())) {
+        setEndingSelection(VisibleSelection(endingPosition));
+    } else if (pos.deprecatedEditingOffset() <= caretMinOffset(pos.node())) {
         insertNodeAt(nodeToInsert.get(), pos);
         
         // Insert an extra br or '\n' if the just inserted one collapsed.
         if (!isStartOfParagraph(VisiblePosition(Position(nodeToInsert.get(), 0))))
             insertNodeBefore(nodeToInsert->cloneNode(false).get(), nodeToInsert.get());
         
-        setEndingSelection(Selection(positionAfterNode(nodeToInsert.get()), DOWNSTREAM));
-    } else if (pos.offset() >= caretMaxOffset(pos.node())) {
+        setEndingSelection(VisibleSelection(positionAfterNode(nodeToInsert.get()), DOWNSTREAM));
+    // If we're inserting after all of the rendered text in a text node, or into a non-text node,
+    // a simple insertion is sufficient.
+    } else if (pos.deprecatedEditingOffset() >= caretMaxOffset(pos.node()) || !pos.node()->isTextNode()) {
         insertNodeAt(nodeToInsert.get(), pos);
-        setEndingSelection(Selection(positionAfterNode(nodeToInsert.get()), DOWNSTREAM));
+        setEndingSelection(VisibleSelection(positionAfterNode(nodeToInsert.get()), DOWNSTREAM));
     } else {
         // Split a text node
         ASSERT(pos.node()->isTextNode());
         
         // Do the split
-        ExceptionCode ec = 0;
-        Text *textNode = static_cast<Text *>(pos.node());
-        RefPtr<Text> textBeforeNode = document()->createTextNode(textNode->substringData(0, selection.start().offset(), ec));
-        deleteTextFromNode(textNode, 0, pos.offset());
-        insertNodeBefore(textBeforeNode.get(), textNode);
-        insertNodeBefore(nodeToInsert.get(), textNode);
+        Text* textNode = static_cast<Text*>(pos.node());
+        splitTextNode(textNode, pos.deprecatedEditingOffset());
+        insertNodeBefore(nodeToInsert, textNode);
         Position endingPosition = Position(textNode, 0);
         
         // Handle whitespace that occurs after the split
@@ -158,7 +158,7 @@ void InsertLineBreakCommand::doApply()
             }
         }
         
-        setEndingSelection(Selection(endingPosition, DOWNSTREAM));
+        setEndingSelection(VisibleSelection(endingPosition, DOWNSTREAM));
     }
 
     // Handle the case where there is a typing style.
@@ -170,10 +170,9 @@ void InsertLineBreakCommand::doApply()
         // leaves and then comes back, new input will have the right style.
         // FIXME: We shouldn't always apply the typing style to the line break here,
         // see <rdar://problem/5794462>.
-        applyStyle(typingStyle, Position(nodeToInsert.get(), 0),
-                                Position(nodeToInsert.get(), maxDeepOffset(nodeToInsert.get())));
+        applyStyle(typingStyle, firstDeepEditingPositionForNode(nodeToInsert.get()), lastDeepEditingPositionForNode(nodeToInsert.get()));
         // Even though this applyStyle operates on a Range, it still sets an endingSelection().
-        // It tries to set a Selection around the content it operated on. So, that Selection
+        // It tries to set a VisibleSelection around the content it operated on. So, that VisibleSelection
         // will either (a) select the line break we inserted, or it will (b) be a caret just 
         // before the line break (if the line break is at the end of a block it isn't selectable).
         // So, this next call sets the endingSelection() to a caret just after the line break 
diff --git a/src/3rdparty/webkit/WebCore/editing/InsertListCommand.cpp b/src/3rdparty/webkit/WebCore/editing/InsertListCommand.cpp
index 20c63b8..ec707d2 100644
--- a/src/3rdparty/webkit/WebCore/editing/InsertListCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/InsertListCommand.cpp
@@ -39,7 +39,7 @@ using namespace HTMLNames;
 
 PassRefPtr<HTMLElement> InsertListCommand::insertList(Document* document, Type type)
 {
-    RefPtr<InsertListCommand> insertCommand = new InsertListCommand(document, type, "");
+    RefPtr<InsertListCommand> insertCommand = new InsertListCommand(document, type);
     insertCommand->apply();
     return insertCommand->m_listElement;
 }
@@ -54,14 +54,14 @@ HTMLElement* InsertListCommand::fixOrphanedListChild(Node* node)
     return listElement.get();
 }
 
-InsertListCommand::InsertListCommand(Document* document, Type type, const String& id) 
-    : CompositeEditCommand(document), m_type(type), m_id(id), m_forceCreateList(false)
+InsertListCommand::InsertListCommand(Document* document, Type type) 
+    : CompositeEditCommand(document), m_type(type), m_forceCreateList(false)
 {
 }
 
 bool InsertListCommand::modifyRange()
 {
-    Selection selection = selectionForParagraphIteration(endingSelection());
+    VisibleSelection selection = selectionForParagraphIteration(endingSelection());
     ASSERT(selection.isRange());
     VisiblePosition startOfSelection = selection.visibleStart();
     VisiblePosition endOfSelection = selection.visibleEnd();
@@ -99,7 +99,7 @@ bool InsertListCommand::modifyRange()
     doApply();
     // Fetch the end of the selection, for the reason mentioned above.
     endOfSelection = endingSelection().visibleEnd();
-    setEndingSelection(Selection(startOfSelection, endOfSelection));
+    setEndingSelection(VisibleSelection(startOfSelection, endOfSelection));
     m_forceCreateList = false;
     return true;
 }
@@ -123,7 +123,7 @@ void InsertListCommand::doApply()
     // margin/padding, but not others.  We should make the gap painting more consistent and 
     // then use a left margin/padding rule here.
     if (visibleEnd != visibleStart && isStartOfParagraph(visibleEnd))
-        setEndingSelection(Selection(visibleStart, visibleEnd.previous(true)));
+        setEndingSelection(VisibleSelection(visibleStart, visibleEnd.previous(true)));
 
     if (endingSelection().isRange() && modifyRange())
         return;
@@ -148,8 +148,8 @@ void InsertListCommand::doApply()
         VisiblePosition start;
         VisiblePosition end;
         if (listChildNode->hasTagName(liTag)) {
-            start = VisiblePosition(Position(listChildNode, 0));
-            end = VisiblePosition(Position(listChildNode, maxDeepOffset(listChildNode)));
+            start = firstDeepEditingPositionForNode(listChildNode);
+            end = lastDeepEditingPositionForNode(listChildNode);
             nextListChild = listChildNode->nextSibling();
             previousListChild = listChildNode->previousSibling();
         } else {
@@ -202,7 +202,8 @@ void InsertListCommand::doApply()
     }
     if (!listChildNode || switchListType || m_forceCreateList) {
         // Create list.
-        VisiblePosition start = startOfParagraph(endingSelection().visibleStart());
+        VisiblePosition originalStart = endingSelection().visibleStart();
+        VisiblePosition start = startOfParagraph(originalStart);
         VisiblePosition end = endOfParagraph(endingSelection().visibleEnd());
         
         // Check for adjoining lists.
@@ -230,8 +231,6 @@ void InsertListCommand::doApply()
             // Create the list.
             RefPtr<HTMLElement> listElement = m_type == OrderedList ? createOrderedListElement(document()) : createUnorderedListElement(document());
             m_listElement = listElement;
-            if (!m_id.isEmpty())
-                listElement->setId(m_id);
             appendNode(listItemElement, listElement);
             
             if (start == end && isBlock(start.deepEquivalent().node())) {
@@ -253,12 +252,17 @@ void InsertListCommand::doApply()
             Node* listChild = enclosingListChild(insertionPos.node());
             if (listChild && listChild->hasTagName(liTag))
                 insertionPos = positionBeforeNode(listChild);
-                
+
             insertNodeAt(listElement, insertionPos);
+
+            // We inserted the list at the start of the content we're about to move
+            // Update the start of content, so we don't try to move the list into itself.  bug 19066
+            if (insertionPos == start.deepEquivalent())
+                start = startOfParagraph(originalStart);
         }
         moveParagraph(start, end, VisiblePosition(Position(placeholder.get(), 0)), true);
         if (nextList && previousList)
-            mergeIdenticalElements(static_cast<Element*>(previousList), static_cast<Element*>(nextList));
+            mergeIdenticalElements(previousList, nextList);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/editing/InsertListCommand.h b/src/3rdparty/webkit/WebCore/editing/InsertListCommand.h
index b39f2b5..ecdd2cf 100644
--- a/src/3rdparty/webkit/WebCore/editing/InsertListCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/InsertListCommand.h
@@ -36,9 +36,9 @@ class InsertListCommand : public CompositeEditCommand {
 public:
     enum Type { OrderedList, UnorderedList };
 
-    static PassRefPtr<InsertListCommand> create(Document* document, Type listType, const String& listID)
+    static PassRefPtr<InsertListCommand> create(Document* document, Type listType)
     {
-        return adoptRef(new InsertListCommand(document, listType, listID));
+        return adoptRef(new InsertListCommand(document, listType));
     }
 
     static PassRefPtr<HTMLElement> insertList(Document*, Type);
@@ -46,7 +46,7 @@ public:
     virtual bool preservesTypingStyle() const { return true; }
 
 private:
-    InsertListCommand(Document*, Type, const String&);
+    InsertListCommand(Document*, Type);
 
     virtual void doApply();
     virtual EditAction editingAction() const { return EditActionInsertList; }
@@ -55,7 +55,6 @@ private:
     bool modifyRange();
     RefPtr<HTMLElement> m_listElement;
     Type m_type;
-    String m_id;
     bool m_forceCreateList;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp b/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp
index 8d82836..7d6e5c4 100644
--- a/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/InsertParagraphSeparatorCommand.cpp
@@ -26,16 +26,17 @@
 #include "config.h"
 #include "InsertParagraphSeparatorCommand.h"
 
-#include "Document.h"
-#include "Logging.h"
 #include "CSSComputedStyleDeclaration.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSPropertyNames.h"
-#include "Text.h"
-#include "htmlediting.h"
+#include "Document.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "InsertLineBreakCommand.h"
+#include "Logging.h"
 #include "RenderObject.h"
+#include "Text.h"
+#include "htmlediting.h"
 #include "visible_units.h"
 
 namespace WebCore {
@@ -106,42 +107,42 @@ void InsertParagraphSeparatorCommand::doApply()
     if (endingSelection().isNone())
         return;
     
-    Position pos = endingSelection().start();
+    Position insertionPosition = endingSelection().start();
         
     EAffinity affinity = endingSelection().affinity();
         
     // Delete the current selection.
     if (endingSelection().isRange()) {
-        calculateStyleBeforeInsertion(pos);
+        calculateStyleBeforeInsertion(insertionPosition);
         deleteSelection(false, true);
-        pos = endingSelection().start();
+        insertionPosition = endingSelection().start();
         affinity = endingSelection().affinity();
     }
     
     // FIXME: The rangeCompliantEquivalent conversion needs to be moved into enclosingBlock.
-    Node* startBlockNode = enclosingBlock(rangeCompliantEquivalent(pos).node());
-    Position canonicalPos = VisiblePosition(pos).deepEquivalent();
+    Node* startBlockNode = enclosingBlock(rangeCompliantEquivalent(insertionPosition).node());
+    Position canonicalPos = VisiblePosition(insertionPosition).deepEquivalent();
     Element* startBlock = static_cast<Element*>(startBlockNode);
     if (!startBlockNode
             || !startBlockNode->isElementNode()
             || !startBlock->parentNode()
             || isTableCell(startBlock)
             || startBlock->hasTagName(formTag)
-            || canonicalPos.node()->renderer() && canonicalPos.node()->renderer()->isTable()
+            || (canonicalPos.node()->renderer() && canonicalPos.node()->renderer()->isTable())
             || canonicalPos.node()->hasTagName(hrTag)) {
         applyCommandToComposite(InsertLineBreakCommand::create(document()));
         return;
     }
     
     // Use the leftmost candidate.
-    pos = pos.upstream();
-    if (!pos.isCandidate())
-        pos = pos.downstream();
+    insertionPosition = insertionPosition.upstream();
+    if (!insertionPosition.isCandidate())
+        insertionPosition = insertionPosition.downstream();
 
     // Adjust the insertion position after the delete
-    pos = positionAvoidingSpecialElementBoundary(pos);
-    VisiblePosition visiblePos(pos, affinity);
-    calculateStyleBeforeInsertion(pos);
+    insertionPosition = positionAvoidingSpecialElementBoundary(insertionPosition);
+    VisiblePosition visiblePos(insertionPosition, affinity);
+    calculateStyleBeforeInsertion(insertionPosition);
 
     //---------------------------------------------------------------------
     // Handle special case of typing return on an empty list item
@@ -150,10 +151,6 @@ void InsertParagraphSeparatorCommand::doApply()
 
     //---------------------------------------------------------------------
     // Prepare for more general cases.
-    // FIXME: We shouldn't peel off the node here because then we lose track of
-    // the fact that it's the node that belongs to an editing position and
-    // not a rangeCompliantEquivalent.
-    Node *startNode = pos.node();
 
     bool isFirstInBlock = isStartOfBlock(visiblePos);
     bool isLastInBlock = isEndOfBlock(visiblePos);
@@ -167,14 +164,15 @@ void InsertParagraphSeparatorCommand::doApply()
     } else if (shouldUseDefaultParagraphElement(startBlock)) 
         blockToInsert = createDefaultParagraphElement(document());
     else
-        blockToInsert = startBlock->cloneElement();
-    
+        blockToInsert = startBlock->cloneElementWithoutChildren();
+
     //---------------------------------------------------------------------
     // Handle case when position is in the last visible position in its block,
     // including when the block is empty. 
     if (isLastInBlock) {
+        bool shouldApplyStyleAfterInsertion = true;
         if (nestNewBlock) {
-            if (isFirstInBlock && !lineBreakExistsAtPosition(visiblePos)) {
+            if (isFirstInBlock && !lineBreakExistsAtVisiblePosition(visiblePos)) {
                 // The block is empty.  Create an empty block to
                 // represent the paragraph that we're leaving.
                 RefPtr<Element> extraBlock = createDefaultParagraphElement(document());
@@ -182,12 +180,21 @@ void InsertParagraphSeparatorCommand::doApply()
                 appendBlockPlaceholder(extraBlock);
             }
             appendNode(blockToInsert, startBlock);
-        } else
+        } else {
+            // We can get here if we pasted a copied portion of a blockquote with a newline at the end and are trying to paste it
+            // into an unquoted area. We then don't want the newline within the blockquote or else it will also be quoted.
+            if (Node* highestBlockquote = highestEnclosingNodeOfType(canonicalPos, &isMailBlockquote)) {
+                startBlock = static_cast<Element*>(highestBlockquote);
+                // When inserting the newline after the blockquote, we don't want to apply the original style after the insertion
+                shouldApplyStyleAfterInsertion = false;
+            }
             insertNodeAfter(blockToInsert, startBlock);
+        }
 
         appendBlockPlaceholder(blockToInsert);
-        setEndingSelection(Selection(Position(blockToInsert.get(), 0), DOWNSTREAM));
-        applyStyleAfterInsertion(startBlock);
+        setEndingSelection(VisibleSelection(Position(blockToInsert.get(), 0), DOWNSTREAM));
+        if (shouldApplyStyleAfterInsertion)
+            applyStyleAfterInsertion(startBlock);
         return;
     }
 
@@ -198,20 +205,20 @@ void InsertParagraphSeparatorCommand::doApply()
         Node *refNode;
         if (isFirstInBlock && !nestNewBlock)
             refNode = startBlock;
-        else if (pos.node() == startBlock && nestNewBlock) {
-            refNode = startBlock->childNode(pos.offset());
+        else if (insertionPosition.node() == startBlock && nestNewBlock) {
+            refNode = startBlock->childNode(insertionPosition.deprecatedEditingOffset());
             ASSERT(refNode); // must be true or we'd be in the end of block case
         } else
-            refNode = pos.node();
+            refNode = insertionPosition.node();
 
         // find ending selection position easily before inserting the paragraph
-        pos = pos.downstream();
+        insertionPosition = insertionPosition.downstream();
         
-        insertNodeBefore(blockToInsert.get(), refNode);
+        insertNodeBefore(blockToInsert, refNode);
         appendBlockPlaceholder(blockToInsert.get());
-        setEndingSelection(Selection(Position(blockToInsert.get(), 0), DOWNSTREAM));
+        setEndingSelection(VisibleSelection(Position(blockToInsert.get(), 0), DOWNSTREAM));
         applyStyleAfterInsertion(startBlock);
-        setEndingSelection(Selection(pos, DOWNSTREAM));
+        setEndingSelection(VisibleSelection(insertionPosition, DOWNSTREAM));
         return;
     }
 
@@ -224,41 +231,45 @@ void InsertParagraphSeparatorCommand::doApply()
     // content will move down a line.
     if (isStartOfParagraph(visiblePos)) {
         RefPtr<Element> br = createBreakElement(document());
-        insertNodeAt(br.get(), pos);
-        pos = positionAfterNode(br.get());
+        insertNodeAt(br.get(), insertionPosition);
+        insertionPosition = positionAfterNode(br.get());
     }
     
     // Move downstream. Typing style code will take care of carrying along the 
     // style of the upstream position.
-    pos = pos.downstream();
-    startNode = pos.node();
+    insertionPosition = insertionPosition.downstream();
+
+    // At this point, the insertionPosition's node could be a container, and we want to make sure we include
+    // all of the correct nodes when building the ancestor list.  So this needs to be the deepest representation of the position
+    // before we walk the DOM tree.
+    insertionPosition = VisiblePosition(insertionPosition).deepEquivalent();
 
     // Build up list of ancestors in between the start node and the start block.
     Vector<Element*> ancestors;
-    if (startNode != startBlock) {
-        for (Element* n = startNode->parentElement(); n && n != startBlock; n = n->parentElement())
+    if (insertionPosition.node() != startBlock) {
+        for (Element* n = insertionPosition.node()->parentElement(); n && n != startBlock; n = n->parentElement())
             ancestors.append(n);
     }
 
     // Make sure we do not cause a rendered space to become unrendered.
     // FIXME: We need the affinity for pos, but pos.downstream() does not give it
-    Position leadingWhitespace = pos.leadingWhitespacePosition(VP_DEFAULT_AFFINITY);
+    Position leadingWhitespace = insertionPosition.leadingWhitespacePosition(VP_DEFAULT_AFFINITY);
     // FIXME: leadingWhitespacePosition is returning the position before preserved newlines for positions
     // after the preserved newline, causing the newline to be turned into a nbsp.
     if (leadingWhitespace.isNotNull()) {
         Text* textNode = static_cast<Text*>(leadingWhitespace.node());
         ASSERT(!textNode->renderer() || textNode->renderer()->style()->collapseWhiteSpace());
-        replaceTextInNode(textNode, leadingWhitespace.offset(), 1, nonBreakingSpaceString());
+        replaceTextInNode(textNode, leadingWhitespace.deprecatedEditingOffset(), 1, nonBreakingSpaceString());
     }
     
     // Split at pos if in the middle of a text node.
-    if (startNode->isTextNode()) {
-        Text *textNode = static_cast<Text *>(startNode);
-        bool atEnd = (unsigned)pos.offset() >= textNode->length();
-        if (pos.offset() > 0 && !atEnd) {
-            splitTextNode(textNode, pos.offset());
-            pos = Position(startNode, 0);
-            visiblePos = VisiblePosition(pos);
+    if (insertionPosition.node()->isTextNode()) {
+        Text* textNode = static_cast<Text*>(insertionPosition.node());
+        bool atEnd = (unsigned)insertionPosition.deprecatedEditingOffset() >= textNode->length();
+        if (insertionPosition.deprecatedEditingOffset() > 0 && !atEnd) {
+            splitTextNode(textNode, insertionPosition.deprecatedEditingOffset());
+            insertionPosition.moveToOffset(0);
+            visiblePos = VisiblePosition(insertionPosition);
             splitText = true;
         }
     }
@@ -274,7 +285,7 @@ void InsertParagraphSeparatorCommand::doApply()
     // Make clones of ancestors in between the start node and the start block.
     RefPtr<Element> parent = blockToInsert;
     for (size_t i = ancestors.size(); i != 0; --i) {
-        RefPtr<Element> child = ancestors[i - 1]->cloneElement(); // shallow clone
+        RefPtr<Element> child = ancestors[i - 1]->cloneElementWithoutChildren();
         appendNode(child, parent);
         parent = child.release();
     }
@@ -282,14 +293,14 @@ void InsertParagraphSeparatorCommand::doApply()
     // If the paragraph separator was inserted at the end of a paragraph, an empty line must be
     // created.  All of the nodes, starting at visiblePos, are about to be added to the new paragraph 
     // element.  If the first node to be inserted won't be one that will hold an empty line open, add a br.
-    if (isEndOfParagraph(visiblePos) && !lineBreakExistsAtPosition(visiblePos))
+    if (isEndOfParagraph(visiblePos) && !lineBreakExistsAtVisiblePosition(visiblePos))
         appendNode(createBreakElement(document()).get(), blockToInsert.get());
         
     // Move the start node and the siblings of the start node.
-    if (startNode != startBlock) {
-        Node *n = startNode;
-        if (pos.offset() >= caretMaxOffset(startNode))
-            n = startNode->nextSibling();
+    if (insertionPosition.node() != startBlock) {
+        Node* n = insertionPosition.node();
+        if (insertionPosition.deprecatedEditingOffset() >= caretMaxOffset(n))
+            n = n->nextSibling();
 
         while (n && n != blockToInsert) {
             Node *next = n->nextSibling();
@@ -320,18 +331,17 @@ void InsertParagraphSeparatorCommand::doApply()
     // Handle whitespace that occurs after the split
     if (splitText) {
         updateLayout();
-        pos = Position(startNode, 0);
-        if (!pos.isRenderedCharacter()) {
+        insertionPosition = Position(insertionPosition.node(), 0);
+        if (!insertionPosition.isRenderedCharacter()) {
             // Clear out all whitespace and insert one non-breaking space
-            ASSERT(startNode);
-            ASSERT(startNode->isTextNode());
-            ASSERT(!startNode->renderer() || startNode->renderer()->style()->collapseWhiteSpace());
-            deleteInsignificantTextDownstream(pos);
-            insertTextIntoNode(static_cast<Text*>(startNode), 0, nonBreakingSpaceString());
+            ASSERT(insertionPosition.node()->isTextNode());
+            ASSERT(!insertionPosition.node()->renderer() || insertionPosition.node()->renderer()->style()->collapseWhiteSpace());
+            deleteInsignificantTextDownstream(insertionPosition);
+            insertTextIntoNode(static_cast<Text*>(insertionPosition.node()), 0, nonBreakingSpaceString());
         }
     }
 
-    setEndingSelection(Selection(Position(blockToInsert.get(), 0), DOWNSTREAM));
+    setEndingSelection(VisibleSelection(Position(blockToInsert.get(), 0), DOWNSTREAM));
     applyStyleAfterInsertion(startBlock);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/editing/InsertTextCommand.cpp b/src/3rdparty/webkit/WebCore/editing/InsertTextCommand.cpp
index 2f42f72..6b0af9b 100644
--- a/src/3rdparty/webkit/WebCore/editing/InsertTextCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/InsertTextCommand.cpp
@@ -89,39 +89,31 @@ bool InsertTextCommand::performTrivialReplace(const String& text, bool selectIns
     if (start.node() != end.node() || !start.node()->isTextNode() || isTabSpanTextNode(start.node()))
         return false;
         
-    replaceTextInNode(static_cast<Text*>(start.node()), start.offset(), end.offset() - start.offset(), text);
+    replaceTextInNode(static_cast<Text*>(start.node()), start.deprecatedEditingOffset(), end.deprecatedEditingOffset() - start.deprecatedEditingOffset(), text);
     
-    Position endPosition(start.node(), start.offset() + text.length());
+    Position endPosition(start.node(), start.deprecatedEditingOffset() + text.length());
     
     // We could have inserted a part of composed character sequence,
     // so we are basically treating ending selection as a range to avoid validation.
     // <http://bugs.webkit.org/show_bug.cgi?id=15781>
-    Selection forcedEndingSelection;
+    VisibleSelection forcedEndingSelection;
     forcedEndingSelection.setWithoutValidation(start, endPosition);
     setEndingSelection(forcedEndingSelection);
     
     if (!selectInsertedText)
-        setEndingSelection(Selection(endingSelection().visibleEnd()));
+        setEndingSelection(VisibleSelection(endingSelection().visibleEnd()));
     
     return true;
 }
 
-void InsertTextCommand::input(const String& originalText, bool selectInsertedText)
+void InsertTextCommand::input(const String& text, bool selectInsertedText)
 {
-    String text = originalText;
     
     ASSERT(text.find('\n') == -1);
 
     if (endingSelection().isNone())
         return;
-        
-    if (RenderObject* renderer = endingSelection().start().node()->renderer())
-        if (renderer->style()->collapseWhiteSpace())
-            // Turn all spaces into non breaking spaces, to make sure that they are treated
-            // literally, and aren't collapsed after insertion. They will be rebalanced 
-            // (turned into a sequence of regular and non breaking spaces) below.
-            text.replace(' ', noBreakSpace);
-    
+
     // Delete the current selection.
     // FIXME: This delete operation blows away the typing style.
     if (endingSelection().isRange()) {
@@ -129,9 +121,28 @@ void InsertTextCommand::input(const String& originalText, bool selectInsertedTex
             return;
         deleteSelection(false, true, true, false);
     }
+
+    Position startPosition(endingSelection().start());
+    
+    Position placeholder;
+    // We want to remove preserved newlines and brs that will collapse (and thus become unnecessary) when content 
+    // is inserted just before them.
+    // FIXME: We shouldn't really have to do this, but removing placeholders is a workaround for 9661.
+    // If the caret is just before a placeholder, downstream will normalize the caret to it.
+    Position downstream(startPosition.downstream());
+    if (lineBreakExistsAtPosition(downstream)) {
+        // FIXME: This doesn't handle placeholders at the end of anonymous blocks.
+        VisiblePosition caret(startPosition);
+        if (isEndOfBlock(caret) && isStartOfParagraph(caret))
+            placeholder = downstream;
+        // Don't remove the placeholder yet, otherwise the block we're inserting into would collapse before
+        // we get a chance to insert into it.  We check for a placeholder now, though, because doing so requires
+        // the creation of a VisiblePosition, and if we did that post-insertion it would force a layout.
+    }
     
     // Insert the character at the leftmost candidate.
-    Position startPosition = endingSelection().start().upstream();
+    startPosition = startPosition.upstream();
+    
     // It is possible for the node that contains startPosition to contain only unrendered whitespace,
     // and so deleteInsignificantText could remove it.  Save the position before the node in case that happens.
     Position positionBeforeStartNode(positionBeforeNode(startPosition.node()));
@@ -148,14 +159,16 @@ void InsertTextCommand::input(const String& originalText, bool selectInsertedTex
     if (text == "\t") {
         endPosition = insertTab(startPosition);
         startPosition = endPosition.previous();
-        removePlaceholderAt(VisiblePosition(startPosition));
+        if (placeholder.isNotNull())
+            removePlaceholderAt(placeholder);
         m_charactersAdded += 1;
     } else {
         // Make sure the document is set up to receive text
         startPosition = prepareForTextInsertion(startPosition);
-        removePlaceholderAt(VisiblePosition(startPosition));
+        if (placeholder.isNotNull())
+            removePlaceholderAt(placeholder);
         Text *textNode = static_cast<Text *>(startPosition.node());
-        int offset = startPosition.offset();
+        int offset = startPosition.deprecatedEditingOffset();
 
         insertTextIntoNode(textNode, offset, text);
         endPosition = Position(textNode, offset + text.length());
@@ -163,7 +176,7 @@ void InsertTextCommand::input(const String& originalText, bool selectInsertedTex
         // The insertion may require adjusting adjacent whitespace, if it is present.
         rebalanceWhitespaceAt(endPosition);
         // Rebalancing on both sides isn't necessary if we've inserted a space.
-        if (originalText != " ") 
+        if (text != " ") 
             rebalanceWhitespaceAt(startPosition);
             
         m_charactersAdded += text.length();
@@ -172,7 +185,7 @@ void InsertTextCommand::input(const String& originalText, bool selectInsertedTex
     // We could have inserted a part of composed character sequence,
     // so we are basically treating ending selection as a range to avoid validation.
     // <http://bugs.webkit.org/show_bug.cgi?id=15781>
-    Selection forcedEndingSelection;
+    VisibleSelection forcedEndingSelection;
     forcedEndingSelection.setWithoutValidation(startPosition, endPosition);
     setEndingSelection(forcedEndingSelection);
 
@@ -199,7 +212,7 @@ void InsertTextCommand::input(const String& originalText, bool selectInsertedTex
         applyStyle(typingStyle);
 
     if (!selectInsertedText)
-        setEndingSelection(Selection(endingSelection().end(), endingSelection().affinity()));
+        setEndingSelection(VisibleSelection(endingSelection().end(), endingSelection().affinity()));
 }
 
 Position InsertTextCommand::insertTab(const Position& pos)
@@ -207,7 +220,7 @@ Position InsertTextCommand::insertTab(const Position& pos)
     Position insertPos = VisiblePosition(pos, DOWNSTREAM).deepEquivalent();
         
     Node *node = insertPos.node();
-    unsigned int offset = insertPos.offset();
+    unsigned int offset = insertPos.deprecatedEditingOffset();
 
     // keep tabs coalesced in tab span
     if (isTabSpanTextNode(node)) {
@@ -232,7 +245,7 @@ Position InsertTextCommand::insertTab(const Position& pos)
             // insert the span before it.
             if (offset > 0)
                 splitTextNode(textNode, offset);
-            insertNodeBefore(spanNode.get(), textNode);
+            insertNodeBefore(spanNode, textNode);
         }
     }
     
diff --git a/src/3rdparty/webkit/WebCore/editing/ModifySelectionListLevel.cpp b/src/3rdparty/webkit/WebCore/editing/ModifySelectionListLevel.cpp
index 7c14868..9a7e105 100644
--- a/src/3rdparty/webkit/WebCore/editing/ModifySelectionListLevel.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/ModifySelectionListLevel.cpp
@@ -27,8 +27,8 @@
 #include "ModifySelectionListLevel.h"
 
 #include "Document.h"
-#include "Element.h"
 #include "Frame.h"
+#include "HTMLElement.h"
 #include "RenderObject.h"
 #include "SelectionController.h"
 #include "htmlediting.h"
@@ -46,7 +46,7 @@ bool ModifySelectionListLevelCommand::preservesTypingStyle() const
 }
 
 // This needs to be static so it can be called by canIncreaseSelectionListLevel and canDecreaseSelectionListLevel
-static bool getStartEndListChildren(const Selection& selection, Node*& start, Node*& end)
+static bool getStartEndListChildren(const VisibleSelection& selection, Node*& start, Node*& end)
 {
     if (selection.isNone())
         return false;
@@ -79,8 +79,8 @@ static bool getStartEndListChildren(const Selection& selection, Node*& start, No
     // if the selection ends on a list item with a sublist, include the entire sublist
     if (endListChild->renderer()->isListItem()) {
         RenderObject* r = endListChild->renderer()->nextSibling();
-        if (r && isListElement(r->element()))
-            endListChild = r->element();
+        if (r && isListElement(r->node()))
+            endListChild = r->node();
     }
 
     start = startListChild;
@@ -141,7 +141,7 @@ IncreaseSelectionListLevelCommand::IncreaseSelectionListLevelCommand(Document* d
 }
 
 // This needs to be static so it can be called by canIncreaseSelectionListLevel
-static bool canIncreaseListLevel(const Selection& selection, Node*& start, Node*& end)
+static bool canIncreaseListLevel(const VisibleSelection& selection, Node*& start, Node*& end)
 {
     if (!getStartEndListChildren(selection, start, end))
         return false;
@@ -175,7 +175,7 @@ void IncreaseSelectionListLevelCommand::doApply()
     if (!canIncreaseListLevel(endingSelection(), startListChild, endListChild))
         return;
 
-    Node* previousItem = startListChild->renderer()->previousSibling()->element();
+    Node* previousItem = startListChild->renderer()->previousSibling()->node();
     if (isListElement(previousItem)) {
         // move nodes up into preceding list
         appendSiblingNodeRange(startListChild, endListChild, static_cast<Element*>(previousItem));
@@ -187,7 +187,7 @@ void IncreaseSelectionListLevelCommand::doApply()
             case InheritedListType:
                 newParent = startListChild->parentElement();
                 if (newParent)
-                    newParent = newParent->cloneElement();
+                    newParent = newParent->cloneElementWithoutChildren();
                 break;
             case OrderedList:
                 newParent = createOrderedListElement(document());
@@ -196,9 +196,9 @@ void IncreaseSelectionListLevelCommand::doApply()
                 newParent = createUnorderedListElement(document());
                 break;
         }
-        insertNodeBefore(newParent.get(), startListChild);
+        insertNodeBefore(newParent, startListChild);
         appendSiblingNodeRange(startListChild, endListChild, newParent.get());
-        m_listElement = newParent.get();
+        m_listElement = newParent.release();
     }
 }
 
@@ -239,7 +239,7 @@ DecreaseSelectionListLevelCommand::DecreaseSelectionListLevelCommand(Document* d
 }
 
 // This needs to be static so it can be called by canDecreaseSelectionListLevel
-static bool canDecreaseListLevel(const Selection& selection, Node*& start, Node*& end)
+static bool canDecreaseListLevel(const VisibleSelection& selection, Node*& start, Node*& end)
 {
     if (!getStartEndListChildren(selection, start, end))
         return false;
@@ -258,8 +258,8 @@ void DecreaseSelectionListLevelCommand::doApply()
     if (!canDecreaseListLevel(endingSelection(), startListChild, endListChild))
         return;
 
-    Node* previousItem = startListChild->renderer()->previousSibling() ? startListChild->renderer()->previousSibling()->element() : 0;
-    Node* nextItem = endListChild->renderer()->nextSibling() ? endListChild->renderer()->nextSibling()->element() : 0;
+    Node* previousItem = startListChild->renderer()->previousSibling() ? startListChild->renderer()->previousSibling()->node() : 0;
+    Node* nextItem = endListChild->renderer()->nextSibling() ? endListChild->renderer()->nextSibling()->node() : 0;
     Element* listNode = startListChild->parentElement();
 
     if (!previousItem) {
diff --git a/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.cpp b/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.cpp
index 08587cb..0a2d3f4 100644
--- a/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/MoveSelectionCommand.cpp
@@ -39,7 +39,7 @@ MoveSelectionCommand::MoveSelectionCommand(PassRefPtr<DocumentFragment> fragment
 
 void MoveSelectionCommand::doApply()
 {
-    Selection selection = endingSelection();
+    VisibleSelection selection = endingSelection();
     ASSERT(selection.isRange());
 
     Position pos = m_position;
@@ -48,14 +48,14 @@ void MoveSelectionCommand::doApply()
         
     // Update the position otherwise it may become invalid after the selection is deleted.
     Node *positionNode = m_position.node();
-    int positionOffset = m_position.offset();
+    int positionOffset = m_position.deprecatedEditingOffset();
     Position selectionEnd = selection.end();
-    int selectionEndOffset = selectionEnd.offset();    
+    int selectionEndOffset = selectionEnd.deprecatedEditingOffset();
     if (selectionEnd.node() == positionNode && selectionEndOffset < positionOffset) {
         positionOffset -= selectionEndOffset;
         Position selectionStart = selection.start();
         if (selectionStart.node() == positionNode) {
-            positionOffset += selectionStart.offset();
+            positionOffset += selectionStart.deprecatedEditingOffset();
         }
         pos = Position(positionNode, positionOffset);
     }
@@ -69,7 +69,11 @@ void MoveSelectionCommand::doApply()
     if (!pos.node()->inDocument())
         pos = endingSelection().start();
 
-    setEndingSelection(Selection(pos, endingSelection().affinity()));
+    setEndingSelection(VisibleSelection(pos, endingSelection().affinity()));
+    if (!positionNode->inDocument()) {
+        // Document was modified out from under us.
+        return;
+    }
     applyCommandToComposite(ReplaceSelectionCommand::create(positionNode->document(), m_fragment, true, m_smartMove));
 }
 
diff --git a/src/3rdparty/webkit/WebCore/editing/RemoveCSSPropertyCommand.h b/src/3rdparty/webkit/WebCore/editing/RemoveCSSPropertyCommand.h
index fd81307..836f9d7 100644
--- a/src/3rdparty/webkit/WebCore/editing/RemoveCSSPropertyCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/RemoveCSSPropertyCommand.h
@@ -27,6 +27,7 @@
 #define RemoveCSSPropertyCommand_h
 
 #include "EditCommand.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSPropertyNames.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/editing/RemoveFormatCommand.cpp b/src/3rdparty/webkit/WebCore/editing/RemoveFormatCommand.cpp
index 80e0ee7..6d681ee 100644
--- a/src/3rdparty/webkit/WebCore/editing/RemoveFormatCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/RemoveFormatCommand.cpp
@@ -27,10 +27,11 @@
 #include "RemoveFormatCommand.h"
 
 #include "CSSComputedStyleDeclaration.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "Editor.h"
 #include "Frame.h"
 #include "HTMLNames.h"
-#include "Selection.h"
+#include "VisibleSelection.h"
 #include "SelectionController.h"
 #include "TextIterator.h"
 #include "TypingCommand.h"
@@ -49,7 +50,7 @@ void RemoveFormatCommand::doApply()
     Frame* frame = document()->frame();
     
     // Make a plain text string from the selection to remove formatting like tables and lists.
-    String string = plainText(frame->selection()->selection().toRange().get());
+    String string = plainText(frame->selection()->selection().toNormalizedRange().get());
 
     // Get the default style for this editable root, it's the style that we'll give the
     // content that we're operating on.
diff --git a/src/3rdparty/webkit/WebCore/editing/RemoveNodeAttributeCommand.cpp b/src/3rdparty/webkit/WebCore/editing/RemoveNodeAttributeCommand.cpp
deleted file mode 100644
index 817773d..0000000
--- a/src/3rdparty/webkit/WebCore/editing/RemoveNodeAttributeCommand.cpp
+++ /dev/null
@@ -1 +0,0 @@
-/* delete this file */
diff --git a/src/3rdparty/webkit/WebCore/editing/RemoveNodeAttributeCommand.h b/src/3rdparty/webkit/WebCore/editing/RemoveNodeAttributeCommand.h
deleted file mode 100644
index 8a2a98f..0000000
--- a/src/3rdparty/webkit/WebCore/editing/RemoveNodeAttributeCommand.h
+++ /dev/null
@@ -1 +0,0 @@
-#error delete this file
diff --git a/src/3rdparty/webkit/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp b/src/3rdparty/webkit/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp
index 98f4282..1452f88 100644
--- a/src/3rdparty/webkit/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/RemoveNodePreservingChildrenCommand.cpp
@@ -32,7 +32,8 @@
 namespace WebCore {
 
 RemoveNodePreservingChildrenCommand::RemoveNodePreservingChildrenCommand(PassRefPtr<Node> node)
-    : CompositeEditCommand(node->document()), m_node(node)
+    : CompositeEditCommand(node->document())
+    , m_node(node)
 {
     ASSERT(m_node);
 }
diff --git a/src/3rdparty/webkit/WebCore/editing/ReplaceNodeWithSpanCommand.cpp b/src/3rdparty/webkit/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
new file mode 100644
index 0000000..21ca924
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
@@ -0,0 +1,87 @@
+/*
+ * Copyright (c) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ReplaceNodeWithSpanCommand.h"
+
+#include "htmlediting.h"
+#include "HTMLElement.h"
+#include "HTMLNames.h"
+#include "NamedAttrMap.h"
+
+#include <wtf/Assertions.h>
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+ReplaceNodeWithSpanCommand::ReplaceNodeWithSpanCommand(PassRefPtr<Node> node)
+    : CompositeEditCommand(node->document())
+    , m_node(node)
+{
+    ASSERT(m_node);
+}
+
+static void swapInNodePreservingAttributesAndChildren(Node* newNode, Node* nodeToReplace)
+{
+    ASSERT(nodeToReplace->inDocument());
+    ExceptionCode ec = 0;
+    Node* parentNode = nodeToReplace->parentNode();
+    parentNode->insertBefore(newNode, nodeToReplace, ec);
+    ASSERT(!ec);
+
+    for (Node* child = nodeToReplace->firstChild(); child; child = child->nextSibling()) {
+        newNode->appendChild(child, ec);
+        ASSERT(!ec);
+    }
+
+    newNode->attributes()->setAttributes(*nodeToReplace->attributes());
+
+    parentNode->removeChild(nodeToReplace, ec);
+    ASSERT(!ec);
+}
+
+void ReplaceNodeWithSpanCommand::doApply()
+{
+    if (!m_node->inDocument())
+        return;
+    if (!m_spanElement)
+        m_spanElement = createHTMLElement(m_node->document(), spanTag);
+    swapInNodePreservingAttributesAndChildren(m_spanElement.get(), m_node.get());
+}
+
+void ReplaceNodeWithSpanCommand::doUnapply()
+{
+    if (!m_spanElement->inDocument())
+        return;
+    swapInNodePreservingAttributesAndChildren(m_node.get(), m_spanElement.get());
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/editing/ReplaceNodeWithSpanCommand.h b/src/3rdparty/webkit/WebCore/editing/ReplaceNodeWithSpanCommand.h
new file mode 100644
index 0000000..7b375b6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/editing/ReplaceNodeWithSpanCommand.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (c) 2009 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ReplaceNodeWithSpanCommand_h
+#define ReplaceNodeWithSpanCommand_h
+
+#include "CompositeEditCommand.h"
+
+namespace WebCore {
+
+class HTMLElement;
+
+// More accurately, this is ReplaceNodeWithSpanPreservingChildrenAndAttributesCommand
+class ReplaceNodeWithSpanCommand : public CompositeEditCommand {
+public:
+    static PassRefPtr<ReplaceNodeWithSpanCommand> create(PassRefPtr<Node> node)
+    {
+        return adoptRef(new ReplaceNodeWithSpanCommand(node));
+    }
+
+    HTMLElement* spanElement() { return m_spanElement.get(); }
+
+private:
+    ReplaceNodeWithSpanCommand(PassRefPtr<Node>);
+
+    virtual void doApply();
+    virtual void doUnapply();
+
+    RefPtr<Node> m_node;
+    RefPtr<HTMLElement> m_spanElement;
+};
+
+} // namespace WebCore
+
+#endif // ReplaceNodeWithSpanCommand
diff --git a/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp b/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp
index 0a19c5e..c6da864 100644
--- a/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.cpp
@@ -28,20 +28,21 @@
 
 #include "ApplyStyleCommand.h"
 #include "BeforeTextInsertedEvent.h"
-#include "BreakBlockquoteCommand.h" 
+#include "BreakBlockquoteCommand.h"
 #include "CSSComputedStyleDeclaration.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "DocumentFragment.h"
 #include "EditingText.h"
-#include "EventNames.h"
 #include "Element.h"
+#include "EventNames.h"
 #include "Frame.h"
 #include "HTMLElement.h"
-#include "HTMLInterchange.h"
 #include "HTMLInputElement.h"
+#include "HTMLInterchange.h"
 #include "HTMLNames.h"
 #include "SelectionController.h"
 #include "SmartReplace.h"
@@ -61,7 +62,7 @@ enum EFragmentType { EmptyFragment, SingleTextNodeFragment, TreeFragment };
 
 class ReplacementFragment : Noncopyable {
 public:
-    ReplacementFragment(Document*, DocumentFragment*, bool matchStyle, const Selection&);
+    ReplacementFragment(Document*, DocumentFragment*, bool matchStyle, const VisibleSelection&);
 
     Node* firstChild() const;
     Node* lastChild() const;
@@ -80,7 +81,7 @@ private:
     void restoreTestRenderingNodesToFragment(Node*);
     void removeInterchangeNodes(Node*);
     
-    void insertNodeBefore(Node* node, Node* refNode);
+    void insertNodeBefore(PassRefPtr<Node> node, Node* refNode);
 
     RefPtr<Document> m_document;
     RefPtr<DocumentFragment> m_fragment;
@@ -103,7 +104,7 @@ static bool isInterchangeConvertedSpaceSpan(const Node *node)
            static_cast<const HTMLElement *>(node)->getAttribute(classAttr) == convertedSpaceSpanClassString;
 }
 
-ReplacementFragment::ReplacementFragment(Document* document, DocumentFragment* fragment, bool matchStyle, const Selection& selection)
+ReplacementFragment::ReplacementFragment(Document* document, DocumentFragment* fragment, bool matchStyle, const VisibleSelection& selection)
     : m_document(document),
       m_fragment(fragment),
       m_matchStyle(matchStyle), 
@@ -124,10 +125,9 @@ ReplacementFragment::ReplacementFragment(Document* document, DocumentFragment* f
     
     Node* shadowAncestorNode = editableRoot->shadowAncestorNode();
     
-    if (!editableRoot->inlineEventListenerForType(eventNames().webkitBeforeTextInsertedEvent) &&
+    if (!editableRoot->getAttributeEventListener(eventNames().webkitBeforeTextInsertedEvent) &&
         // FIXME: Remove these checks once textareas and textfields actually register an event handler.
-        !(shadowAncestorNode && shadowAncestorNode->renderer() && shadowAncestorNode->renderer()->isTextField()) &&
-        !(shadowAncestorNode && shadowAncestorNode->renderer() && shadowAncestorNode->renderer()->isTextArea()) &&
+        !(shadowAncestorNode && shadowAncestorNode->renderer() && shadowAncestorNode->renderer()->isTextControl()) &&
         editableRoot->isContentRichlyEditable()) {
         removeInterchangeNodes(m_fragment.get());
         return;
@@ -136,7 +136,7 @@ ReplacementFragment::ReplacementFragment(Document* document, DocumentFragment* f
     Node* styleNode = selection.base().node();
     RefPtr<Node> holder = insertFragmentForTestRendering(styleNode);
     
-    RefPtr<Range> range = Selection::selectionFromContentsOfNode(holder.get()).toRange();
+    RefPtr<Range> range = VisibleSelection::selectionFromContentsOfNode(holder.get()).toNormalizedRange();
     String text = plainText(range.get());
     // Give the root a chance to change the text.
     RefPtr<BeforeTextInsertedEvent> evt = BeforeTextInsertedEvent::create(text);
@@ -147,7 +147,7 @@ ReplacementFragment::ReplacementFragment(Document* document, DocumentFragment* f
         restoreTestRenderingNodesToFragment(holder.get());
         removeNode(holder);
 
-        m_fragment = createFragmentFromText(selection.toRange().get(), evt->text());
+        m_fragment = createFragmentFromText(selection.toNormalizedRange().get(), evt->text());
         if (!m_fragment->firstChild())
             return;
         holder = insertFragmentForTestRendering(styleNode);
@@ -182,7 +182,7 @@ void ReplacementFragment::removeNodePreservingChildren(Node *node)
 
     while (RefPtr<Node> n = node->firstChild()) {
         removeNode(n);
-        insertNodeBefore(n.get(), node);
+        insertNodeBefore(n.release(), node);
     }
     removeNode(node);
 }
@@ -201,12 +201,12 @@ void ReplacementFragment::removeNode(PassRefPtr<Node> node)
     ASSERT(ec == 0);
 }
 
-void ReplacementFragment::insertNodeBefore(Node *node, Node *refNode)
+void ReplacementFragment::insertNodeBefore(PassRefPtr<Node> node, Node* refNode)
 {
     if (!node || !refNode)
         return;
         
-    Node *parent = refNode->parentNode();
+    Node* parent = refNode->parentNode();
     if (!parent)
         return;
         
@@ -311,7 +311,7 @@ void ReplacementFragment::removeInterchangeNodes(Node* container)
             RefPtr<Node> n = 0;
             while ((n = node->firstChild())) {
                 removeNode(n);
-                insertNodeBefore(n.get(), node);
+                insertNodeBefore(n, node);
             }
             removeNode(node);
             if (n)
@@ -344,14 +344,22 @@ static bool hasMatchingQuoteLevel(VisiblePosition endOfExistingContent, VisibleP
     return isInsideMailBlockquote && (numEnclosingMailBlockquotes(existing) == numEnclosingMailBlockquotes(inserted));
 }
 
-bool ReplaceSelectionCommand::shouldMergeStart(bool selectionStartWasStartOfParagraph, bool fragmentHasInterchangeNewlineAtStart)
+bool ReplaceSelectionCommand::shouldMergeStart(bool selectionStartWasStartOfParagraph, bool fragmentHasInterchangeNewlineAtStart, bool selectionStartWasInsideMailBlockquote)
 {
+    if (m_movingParagraph)
+        return false;
+    
     VisiblePosition startOfInsertedContent(positionAtStartOfInsertedContent());
     VisiblePosition prev = startOfInsertedContent.previous(true);
     if (prev.isNull())
         return false;
     
-    if (!m_movingParagraph && hasMatchingQuoteLevel(prev, positionAtEndOfInsertedContent()))
+    // When we have matching quote levels, its ok to merge more frequently.
+    // For a successful merge, we still need to make sure that the inserted content starts with the beginning of a paragraph.
+    // And we should only merge here if the selection start was inside a mail blockquote.  This prevents against removing a 
+    // blockquote from newly pasted quoted content that was pasted into an unquoted position.  If that unquoted position happens 
+    // to be right after another blockquote, we don't want to merge and risk stripping a valid block (and newline) from the pasted content.
+    if (isStartOfParagraph(startOfInsertedContent) && selectionStartWasInsideMailBlockquote && hasMatchingQuoteLevel(prev, positionAtEndOfInsertedContent()))
         return true;
 
     return !selectionStartWasStartOfParagraph && 
@@ -406,6 +414,23 @@ void ReplaceSelectionCommand::removeNodeAndPruneAncestors(Node* node)
         m_firstNodeInserted = m_lastLeafInserted && m_lastLeafInserted->inDocument() ? afterFirst : 0;
 }
 
+static bool isHeaderElement(Node* a)
+{
+    if (!a)
+        return false;
+        
+    return a->hasTagName(h1Tag) ||
+           a->hasTagName(h2Tag) ||
+           a->hasTagName(h3Tag) ||
+           a->hasTagName(h4Tag) ||
+           a->hasTagName(h5Tag);
+}
+
+static bool haveSameTagName(Node* a, Node* b)
+{
+    return a && b && a->isElementNode() && b->isElementNode() && static_cast<Element*>(a)->tagName() == static_cast<Element*>(b)->tagName();
+}
+
 bool ReplaceSelectionCommand::shouldMerge(const VisiblePosition& source, const VisiblePosition& destination)
 {
     if (source.isNull() || destination.isNull())
@@ -414,10 +439,12 @@ bool ReplaceSelectionCommand::shouldMerge(const VisiblePosition& source, const V
     Node* sourceNode = source.deepEquivalent().node();
     Node* destinationNode = destination.deepEquivalent().node();
     Node* sourceBlock = enclosingBlock(sourceNode);
+    Node* destinationBlock = enclosingBlock(destinationNode);
     return !enclosingNodeOfType(source.deepEquivalent(), &isMailPasteAsQuotationNode) &&
            sourceBlock && (!sourceBlock->hasTagName(blockquoteTag) || isMailBlockquote(sourceBlock))  &&
            enclosingListChild(sourceBlock) == enclosingListChild(destinationNode) &&
            enclosingTableCell(source.deepEquivalent()) == enclosingTableCell(destination.deepEquivalent()) &&
+           (!isHeaderElement(sourceBlock) || haveSameTagName(sourceBlock, destinationBlock)) &&
            // Don't merge to or from a position before or after a block because it would
            // be a no-op and cause infinite recursion.
            !isBlock(sourceNode) && !isBlock(destinationNode);
@@ -491,10 +518,11 @@ void ReplaceSelectionCommand::handlePasteAsQuotationNode()
 VisiblePosition ReplaceSelectionCommand::positionAtEndOfInsertedContent()
 {
     Node* lastNode = m_lastLeafInserted.get();
-    Node* enclosingSelect = enclosingNodeWithTag(Position(lastNode, 0), selectTag);
+    // FIXME: Why is this hack here?  What's special about <select> tags?
+    Node* enclosingSelect = enclosingNodeWithTag(firstDeepEditingPositionForNode(lastNode), selectTag);
     if (enclosingSelect)
         lastNode = enclosingSelect;
-    return VisiblePosition(Position(lastNode, maxDeepOffset(lastNode)));
+    return lastDeepEditingPositionForNode(lastNode);
 }
 
 VisiblePosition ReplaceSelectionCommand::positionAtStartOfInsertedContent()
@@ -509,8 +537,9 @@ static bool handleStyleSpansBeforeInsertion(ReplacementFragment& fragment, const
 {
     Node* topNode = fragment.firstChild();
     
-    // Handling this case is more complicated (see handleStyleSpans) and doesn't receive the optimization.
-    if (isMailPasteAsQuotationNode(topNode))
+    // Handling the case where we are doing Paste as Quotation or pasting into quoted content is more complicated (see handleStyleSpans)
+    // and doesn't receive the optimization.
+    if (isMailPasteAsQuotationNode(topNode) || nearestMailBlockquote(topNode))
         return false;
     
     // Either there are no style spans in the fragment or a WebKit client has added content to the fragment
@@ -573,11 +602,12 @@ void ReplaceSelectionCommand::handleStyleSpans()
     RefPtr<CSSMutableStyleDeclaration> sourceDocumentStyle = static_cast<HTMLElement*>(sourceDocumentStyleSpan)->getInlineStyleDecl()->copy();
     Node* context = sourceDocumentStyleSpan->parentNode();
     
-    // If Mail wraps the fragment with a Paste as Quotation blockquote, styles from that element are
-    // allowed to override those from the source document, see <rdar://problem/4930986>.
-    if (isMailPasteAsQuotationNode(context)) {
-        RefPtr<CSSMutableStyleDeclaration> blockquoteStyle = computedStyle(context)->copyInheritableProperties();
-        RefPtr<CSSMutableStyleDeclaration> parentStyle = computedStyle(context->parentNode())->copyInheritableProperties();
+    // If Mail wraps the fragment with a Paste as Quotation blockquote, or if you're pasting into a quoted region,
+    // styles from blockquoteNode are allowed to override those from the source document, see <rdar://problem/4930986> and <rdar://problem/5089327>.
+    Node* blockquoteNode = isMailPasteAsQuotationNode(context) ? context : nearestMailBlockquote(context);
+    if (blockquoteNode) {
+        RefPtr<CSSMutableStyleDeclaration> blockquoteStyle = computedStyle(blockquoteNode)->copyInheritableProperties();
+        RefPtr<CSSMutableStyleDeclaration> parentStyle = computedStyle(blockquoteNode->parentNode())->copyInheritableProperties();
         parentStyle->diff(blockquoteStyle.get());
 
         CSSMutableStyleDeclaration::const_iterator end = blockquoteStyle->end();
@@ -586,7 +616,7 @@ void ReplaceSelectionCommand::handleStyleSpans()
             sourceDocumentStyle->removeProperty(property.id());
         }        
 
-        context = context->parentNode();
+        context = blockquoteNode->parentNode();
     }
     
     RefPtr<CSSMutableStyleDeclaration> contextStyle = computedStyle(context)->copyInheritableProperties();
@@ -669,7 +699,8 @@ void ReplaceSelectionCommand::mergeEndIfNeeded()
     moveParagraph(startOfParagraphToMove, endOfParagraph(startOfParagraphToMove), destination);
     // Merging forward will remove m_lastLeafInserted from the document.
     // FIXME: Maintain positions for the start and end of inserted content instead of keeping nodes.  The nodes are
-    // only ever used to create positions where inserted content starts/ends.
+    // only ever used to create positions where inserted content starts/ends.  Also, we sometimes insert content
+    // directly into text nodes already in the document, in which case tracking inserted nodes is inadequate.
     if (mergeForward) {
         m_lastLeafInserted = destination.previous().deepEquivalent().node();
         if (!m_firstNodeInserted->inDocument())
@@ -679,7 +710,7 @@ void ReplaceSelectionCommand::mergeEndIfNeeded()
 
 void ReplaceSelectionCommand::doApply()
 {
-    Selection selection = endingSelection();
+    VisibleSelection selection = endingSelection();
     ASSERT(selection.isCaretOrRange());
     ASSERT(selection.start().node());
     if (selection.isNone() || !selection.start().node())
@@ -690,6 +721,9 @@ void ReplaceSelectionCommand::doApply()
     Element* currentRoot = selection.rootEditableElement();
     ReplacementFragment fragment(document(), m_documentFragment.get(), m_matchStyle, selection);
     
+    if (performTrivialReplace(fragment))
+        return;
+    
     if (m_matchStyle)
         m_insertionStyle = styleAtPosition(selection.start());
     
@@ -704,9 +738,9 @@ void ReplaceSelectionCommand::doApply()
     Position insertionPos = selection.start();
     bool startIsInsideMailBlockquote = nearestMailBlockquote(insertionPos.node());
     
-    if (selectionStartWasStartOfParagraph && selectionEndWasEndOfParagraph && !startIsInsideMailBlockquote ||
+    if ((selectionStartWasStartOfParagraph && selectionEndWasEndOfParagraph && !startIsInsideMailBlockquote) ||
         startBlock == currentRoot ||
-        startBlock && startBlock->renderer() && startBlock->renderer()->isListItem() ||
+        (startBlock && startBlock->renderer() && startBlock->renderer()->isListItem()) ||
         selectionIsPlainText)
         m_preventNesting = false;
     
@@ -751,9 +785,10 @@ void ReplaceSelectionCommand::doApply()
         insertionPos = endingSelection().start();
     }
     
-    if (startIsInsideMailBlockquote && m_preventNesting) { 
-        // We don't want any of the pasted content to end up nested in a Mail blockquote, so first break 
-        // out of any surrounding Mail blockquotes. 
+    // We don't want any of the pasted content to end up nested in a Mail blockquote, so first break 
+    // out of any surrounding Mail blockquotes. Unless we're inserting in a table, in which case
+    // breaking the blockquote will prevent the content from actually being inserted in the table.
+    if (startIsInsideMailBlockquote && m_preventNesting && !(enclosingNodeOfType(insertionPos, &isTableStructureNode))) { 
         applyCommandToComposite(BreakBlockquoteCommand::create(document())); 
         // This will leave a br between the split. 
         Node* br = endingSelection().start().node(); 
@@ -800,6 +835,9 @@ void ReplaceSelectionCommand::doApply()
     
     bool handledStyleSpans = handleStyleSpansBeforeInsertion(fragment, insertionPos);
     
+    // FIXME: When pasting rich content we're often prevented from heading down the fast path by style spans.  Try
+    // again here if they've been removed.
+    
     // We're finished if there is nothing to add.
     if (fragment.isEmpty() || !fragment.firstChild())
         return;
@@ -820,12 +858,21 @@ void ReplaceSelectionCommand::doApply()
     RefPtr<Node> node = refNode->nextSibling();
     
     fragment.removeNode(refNode);
-    insertNodeAtAndUpdateNodesInserted(refNode.get(), insertionPos);
-    
+    insertNodeAtAndUpdateNodesInserted(refNode, insertionPos);
+
+    // Mutation events (bug 22634) may have already removed the inserted content
+    if (!refNode->inDocument())
+        return;
+
     while (node) {
         Node* next = node->nextSibling();
         fragment.removeNode(node);
-        insertNodeAfterAndUpdateNodesInserted(node.get(), refNode.get());
+        insertNodeAfterAndUpdateNodesInserted(node, refNode.get());
+
+        // Mutation events (bug 22634) may have already removed the inserted content
+        if (!node->inDocument())
+            return;
+
         refNode = node;
         node = next;
     }
@@ -846,7 +893,7 @@ void ReplaceSelectionCommand::doApply()
     
     // We inserted before the startBlock to prevent nesting, and the content before the startBlock wasn't in its own block and
     // didn't have a br after it, so the inserted content ended up in the same paragraph.
-    if (startBlock && insertionPos.node() == startBlock->parentNode() && (unsigned)insertionPos.offset() < startBlock->nodeIndex() && !isStartOfParagraph(startOfInsertedContent))
+    if (startBlock && insertionPos.node() == startBlock->parentNode() && (unsigned)insertionPos.deprecatedEditingOffset() < startBlock->nodeIndex() && !isStartOfParagraph(startOfInsertedContent))
         insertNodeAt(createBreakElement(document()).get(), startOfInsertedContent.deepEquivalent());
     
     Position lastPositionToSelect;
@@ -860,13 +907,7 @@ void ReplaceSelectionCommand::doApply()
     // the start merge so that the start merge doesn't effect our decision.
     m_shouldMergeEnd = shouldMergeEnd(selectionEndWasEndOfParagraph);
     
-    if (shouldMergeStart(selectionStartWasStartOfParagraph, fragment.hasInterchangeNewlineAtStart())) {
-        // Bail to avoid infinite recursion.
-        if (m_movingParagraph) {
-            // setting display:inline does not work for td elements in quirks mode
-            ASSERT(m_firstNodeInserted->hasTagName(tdTag));
-            return;
-        }
+    if (shouldMergeStart(selectionStartWasStartOfParagraph, fragment.hasInterchangeNewlineAtStart(), startIsInsideMailBlockquote)) {
         VisiblePosition destination = startOfInsertedContent.previous();
         VisiblePosition startOfParagraphToMove = startOfInsertedContent;
         
@@ -878,9 +919,13 @@ void ReplaceSelectionCommand::doApply()
         // Insert a line break just after the inserted content to separate it from what 
         // comes after and prevent that from happening.
         VisiblePosition endOfInsertedContent = positionAtEndOfInsertedContent();
-        if (startOfParagraph(endOfInsertedContent) == startOfParagraphToMove)
+        if (startOfParagraph(endOfInsertedContent) == startOfParagraphToMove) {
             insertNodeAt(createBreakElement(document()).get(), endOfInsertedContent.deepEquivalent());
-        
+            // Mutation events (bug 22634) triggered by inserting the <br> might have removed the content we're about to move
+            if (!startOfParagraphToMove.deepEquivalent().node()->inDocument())
+                return;
+        }
+
         // FIXME: Maintain positions for the start and end of inserted content instead of keeping nodes.  The nodes are
         // only ever used to create positions where inserted content starts/ends.
         moveParagraph(startOfParagraphToMove, endOfParagraph(startOfParagraphToMove), destination);
@@ -938,7 +983,7 @@ void ReplaceSelectionCommand::doApply()
                 insertTextIntoNode(text, text->length(), collapseWhiteSpace ? nonBreakingSpaceString() : " ");
             } else {
                 RefPtr<Node> node = document()->createEditingTextNode(collapseWhiteSpace ? nonBreakingSpaceString() : " ");
-                insertNodeAfterAndUpdateNodesInserted(node.get(), endNode);
+                insertNodeAfterAndUpdateNodesInserted(node, endNode);
             }
         }
     
@@ -955,7 +1000,7 @@ void ReplaceSelectionCommand::doApply()
                 RefPtr<Node> node = document()->createEditingTextNode(collapseWhiteSpace ? nonBreakingSpaceString() : " ");
                 // Don't updateNodesInserted.  Doing so would set m_lastLeafInserted to be the node containing the 
                 // leading space, but m_lastLeafInserted is supposed to mark the end of pasted content.
-                insertNodeBefore(node.get(), startNode);
+                insertNodeBefore(node, startNode);
                 // FIXME: Use positions to track the start/end of inserted content.
                 m_firstNodeInserted = node;
             }
@@ -1013,9 +1058,9 @@ void ReplaceSelectionCommand::completeHTMLReplacement(const Position &lastPositi
         return;
     
     if (m_selectReplacement)
-        setEndingSelection(Selection(start, end, SEL_DEFAULT_AFFINITY));
+        setEndingSelection(VisibleSelection(start, end, SEL_DEFAULT_AFFINITY));
     else
-        setEndingSelection(Selection(end, SEL_DEFAULT_AFFINITY));
+        setEndingSelection(VisibleSelection(end, SEL_DEFAULT_AFFINITY));
 }
 
 EditAction ReplaceSelectionCommand::editingAction() const
@@ -1023,22 +1068,25 @@ EditAction ReplaceSelectionCommand::editingAction() const
     return m_editAction;
 }
 
-void ReplaceSelectionCommand::insertNodeAfterAndUpdateNodesInserted(Node *insertChild, Node *refChild)
+void ReplaceSelectionCommand::insertNodeAfterAndUpdateNodesInserted(PassRefPtr<Node> insertChild, Node* refChild)
 {
+    Node* nodeToUpdate = insertChild.get(); // insertChild will be cleared when passed
     insertNodeAfter(insertChild, refChild);
-    updateNodesInserted(insertChild);
+    updateNodesInserted(nodeToUpdate);
 }
 
-void ReplaceSelectionCommand::insertNodeAtAndUpdateNodesInserted(Node *insertChild, const Position& p)
+void ReplaceSelectionCommand::insertNodeAtAndUpdateNodesInserted(PassRefPtr<Node> insertChild, const Position& p)
 {
+    Node* nodeToUpdate = insertChild.get(); // insertChild will be cleared when passed
     insertNodeAt(insertChild, p);
-    updateNodesInserted(insertChild);
+    updateNodesInserted(nodeToUpdate);
 }
 
-void ReplaceSelectionCommand::insertNodeBeforeAndUpdateNodesInserted(Node *insertChild, Node *refChild)
+void ReplaceSelectionCommand::insertNodeBeforeAndUpdateNodesInserted(PassRefPtr<Node> insertChild, Node* refChild)
 {
+    Node* nodeToUpdate = insertChild.get(); // insertChild will be cleared when passed
     insertNodeBefore(insertChild, refChild);
-    updateNodesInserted(insertChild);
+    updateNodesInserted(nodeToUpdate);
 }
 
 void ReplaceSelectionCommand::updateNodesInserted(Node *node)
@@ -1055,4 +1103,38 @@ void ReplaceSelectionCommand::updateNodesInserted(Node *node)
     m_lastLeafInserted = node->lastDescendant();
 }
 
+// During simple pastes, where we're just pasting a text node into a run of text, we insert the text node
+// directly into the text node that holds the selection.  This is much faster than the generalized code in
+// ReplaceSelectionCommand, and works around <https://bugs.webkit.org/show_bug.cgi?id=6148> since we don't 
+// split text nodes.
+bool ReplaceSelectionCommand::performTrivialReplace(const ReplacementFragment& fragment)
+{
+    if (!fragment.firstChild() || fragment.firstChild() != fragment.lastChild() || !fragment.firstChild()->isTextNode())
+        return false;
+        
+    // FIXME: Would be nice to handle smart replace in the fast path.
+    if (m_smartReplace || fragment.hasInterchangeNewlineAtStart() || fragment.hasInterchangeNewlineAtEnd())
+        return false;
+    
+    Text* textNode = static_cast<Text*>(fragment.firstChild());
+    // Our fragment creation code handles tabs, spaces, and newlines, so we don't have to worry about those here.
+    String text(textNode->data());
+    
+    Position start = endingSelection().start();
+    Position end = endingSelection().end();
+    
+    if (start.anchorNode() != end.anchorNode() || !start.anchorNode()->isTextNode())
+        return false;
+        
+    replaceTextInNode(static_cast<Text*>(start.anchorNode()), start.offsetInContainerNode(), end.offsetInContainerNode() - start.offsetInContainerNode(), text);
+    
+    end = Position(start.anchorNode(), start.offsetInContainerNode() + text.length());
+    
+    VisibleSelection selectionAfterReplace(m_selectReplacement ? start : end, end);
+    
+    setEndingSelection(selectionAfterReplace);
+    
+    return true;
+}
+
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.h b/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.h
index 76f0a58..1cb93c3 100644
--- a/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/ReplaceSelectionCommand.h
@@ -31,6 +31,7 @@
 namespace WebCore {
 
 class DocumentFragment;
+class ReplacementFragment;
 
 class ReplaceSelectionCommand : public CompositeEditCommand {
 public:
@@ -50,14 +51,14 @@ private:
 
     void completeHTMLReplacement(const Position& lastPositionToSelect);
 
-    void insertNodeAfterAndUpdateNodesInserted(Node* insertChild, Node* refChild);
-    void insertNodeAtAndUpdateNodesInserted(Node*, const Position&);
-    void insertNodeBeforeAndUpdateNodesInserted(Node* insertChild, Node* refChild);
+    void insertNodeAfterAndUpdateNodesInserted(PassRefPtr<Node> insertChild, Node* refChild);
+    void insertNodeAtAndUpdateNodesInserted(PassRefPtr<Node>, const Position&);
+    void insertNodeBeforeAndUpdateNodesInserted(PassRefPtr<Node> insertChild, Node* refChild);
 
     void updateNodesInserted(Node*);
     bool shouldRemoveEndBR(Node*, const VisiblePosition&);
     
-    bool shouldMergeStart(bool, bool);
+    bool shouldMergeStart(bool, bool, bool);
     bool shouldMergeEnd(bool selectEndWasEndOfParagraph);
     bool shouldMerge(const VisiblePosition&, const VisiblePosition&);
     
@@ -74,6 +75,8 @@ private:
     
     VisiblePosition positionAtStartOfInsertedContent();
     VisiblePosition positionAtEndOfInsertedContent();
+    
+    bool performTrivialReplace(const ReplacementFragment&);
 
     RefPtr<Node> m_firstNodeInserted;
     RefPtr<Node> m_lastLeafInserted;
diff --git a/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp b/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp
index a027aa4..9bb68ad 100644
--- a/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/SelectionController.cpp
@@ -32,9 +32,9 @@
 #include "Editor.h"
 #include "Element.h"
 #include "EventHandler.h"
-#include "EventNames.h"
 #include "ExceptionCode.h"
 #include "FocusController.h"
+#include "FloatQuad.h"
 #include "Frame.h"
 #include "FrameTree.h"
 #include "FrameView.h"
@@ -69,36 +69,36 @@ SelectionController::SelectionController(Frame* frame, bool isDragCaretControlle
     , m_lastChangeWasHorizontalExtension(false)
     , m_isDragCaretController(isDragCaretController)
     , m_isCaretBlinkingSuspended(false)
-    , m_focused(false)
+    , m_focused(frame && frame->page() && frame->page()->focusController()->focusedFrame() == frame)
 {
 }
 
 void SelectionController::moveTo(const VisiblePosition &pos, bool userTriggered)
 {
-    setSelection(Selection(pos.deepEquivalent(), pos.deepEquivalent(), pos.affinity()), true, true, userTriggered);
+    setSelection(VisibleSelection(pos.deepEquivalent(), pos.deepEquivalent(), pos.affinity()), true, true, userTriggered);
 }
 
 void SelectionController::moveTo(const VisiblePosition &base, const VisiblePosition &extent, bool userTriggered)
 {
-    setSelection(Selection(base.deepEquivalent(), extent.deepEquivalent(), base.affinity()), true, true, userTriggered);
+    setSelection(VisibleSelection(base.deepEquivalent(), extent.deepEquivalent(), base.affinity()), true, true, userTriggered);
 }
 
 void SelectionController::moveTo(const Position &pos, EAffinity affinity, bool userTriggered)
 {
-    setSelection(Selection(pos, affinity), true, true, userTriggered);
+    setSelection(VisibleSelection(pos, affinity), true, true, userTriggered);
 }
 
 void SelectionController::moveTo(const Range *r, EAffinity affinity, bool userTriggered)
 {
-    setSelection(Selection(startPosition(r), endPosition(r), affinity), true, true, userTriggered);
+    setSelection(VisibleSelection(startPosition(r), endPosition(r), affinity), true, true, userTriggered);
 }
 
 void SelectionController::moveTo(const Position &base, const Position &extent, EAffinity affinity, bool userTriggered)
 {
-    setSelection(Selection(base, extent, affinity), true, true, userTriggered);
+    setSelection(VisibleSelection(base, extent, affinity), true, true, userTriggered);
 }
 
-void SelectionController::setSelection(const Selection& s, bool closeTyping, bool clearTypingStyle, bool userTriggered)
+void SelectionController::setSelection(const VisibleSelection& s, bool closeTyping, bool clearTypingStyle, bool userTriggered)
 {
     if (m_isDragCaretController) {
         invalidateCaretRect();
@@ -111,9 +111,16 @@ void SelectionController::setSelection(const Selection& s, bool closeTyping, boo
         m_sel = s;
         return;
     }
+
+    Node* baseNode = s.base().node();
+    Document* document = 0;
+    if (baseNode)
+        document = baseNode->document();
     
-    if (s.base().node() && s.base().node()->document() != m_frame->document()) {
-        s.base().node()->document()->frame()->selection()->setSelection(s, closeTyping, clearTypingStyle, userTriggered);
+    // <http://bugs.webkit.org/show_bug.cgi?id=23464>: Infinite recursion at SelectionController::setSelection
+    // if document->frame() == m_frame we can get into an infinite loop
+    if (document && document->frame() != m_frame && document != m_frame->document()) {
+        document->frame()->selection()->setSelection(s, closeTyping, clearTypingStyle, userTriggered);
         return;
     }
     
@@ -126,7 +133,7 @@ void SelectionController::setSelection(const Selection& s, bool closeTyping, boo
     if (m_sel == s)
         return;
     
-    Selection oldSelection = m_sel;
+    VisibleSelection oldSelection = m_sel;
 
     m_sel = s;
     
@@ -143,7 +150,7 @@ void SelectionController::setSelection(const Selection& s, bool closeTyping, boo
     m_frame->notifyRendererOfSelectionChange(userTriggered);
     m_frame->respondToChangedSelection(oldSelection, closeTyping);
     if (userTriggered)
-        m_frame->revealCaret(RenderLayer::gAlignToEdgeIfNeeded);
+        m_frame->revealSelection(ScrollAlignment::alignToEdgeIfNeeded, true);
 
     notifyAccessibilityForSelectionChange();
 }
@@ -195,8 +202,7 @@ void SelectionController::nodeWillBeRemoved(Node *node)
         else
             m_sel.setWithoutValidation(m_sel.end(), m_sel.start());
     // FIXME: This could be more efficient if we had an isNodeInRange function on Ranges.
-    } else if (Range::compareBoundaryPoints(m_sel.start(), Position(node, 0)) == -1 &&
-               Range::compareBoundaryPoints(m_sel.end(), Position(node, 0)) == 1) {
+    } else if (comparePositions(m_sel.start(), Position(node, 0)) == -1 && comparePositions(m_sel.end(), Position(node, 0)) == 1) {
         // If we did nothing here, when this node's renderer was destroyed, the rect that it 
         // occupied would be invalidated, but, selection gaps that change as a result of 
         // the removal wouldn't be invalidated.
@@ -206,13 +212,13 @@ void SelectionController::nodeWillBeRemoved(Node *node)
 
     if (clearRenderTreeSelection) {
         RefPtr<Document> document = m_sel.start().node()->document();
-        document->updateRendering();
-        if (RenderView* view = static_cast<RenderView*>(document->renderer()))
+        document->updateStyleIfNeeded();
+        if (RenderView* view = toRenderView(document->renderer()))
             view->clearSelection();
     }
 
     if (clearDOMTreeSelection)
-        setSelection(Selection(), false, false);
+        setSelection(VisibleSelection(), false, false);
 }
 
 void SelectionController::willBeModified(EAlteration alter, EDirection direction)
@@ -244,7 +250,53 @@ void SelectionController::willBeModified(EAlteration alter, EDirection direction
     }
 }
 
-VisiblePosition SelectionController::modifyExtendingRightForward(TextGranularity granularity)
+TextDirection SelectionController::directionOfEnclosingBlock() {
+    Node* n = m_sel.extent().node();
+    Node* enclosingBlockNode = enclosingBlock(n);
+    if (!enclosingBlockNode)
+        return LTR;
+    RenderObject* renderer = enclosingBlockNode->renderer();
+    if (renderer)
+        return renderer->style()->direction();
+    return LTR;
+}
+
+VisiblePosition SelectionController::modifyExtendingRight(TextGranularity granularity)
+{
+    VisiblePosition pos(m_sel.extent(), m_sel.affinity());
+
+    // The difference between modifyExtendingRight and modifyExtendingForward is:
+    // modifyExtendingForward always extends forward logically.
+    // modifyExtendingRight behaves the same as modifyExtendingForward except for extending character or word,
+    // it extends forward logically if the enclosing block is LTR direction,
+    // but it extends backward logically if the enclosing block is RTL direction.
+    switch (granularity) {
+        case CharacterGranularity:
+            if (directionOfEnclosingBlock() == LTR)
+                pos = pos.next(true);                
+            else
+                pos = pos.previous(true);
+            break;
+        case WordGranularity:
+            if (directionOfEnclosingBlock() == LTR)
+                pos = nextWordPosition(pos);
+            else
+                pos = previousWordPosition(pos);
+            break;
+        case SentenceGranularity:
+        case LineGranularity:
+        case ParagraphGranularity:
+        case SentenceBoundary:
+        case LineBoundary:
+        case ParagraphBoundary:
+        case DocumentBoundary:
+            // FIXME: implement all of the above?
+            pos = modifyExtendingForward(granularity);
+    }
+    return pos;
+}    
+        
+VisiblePosition SelectionController::modifyExtendingForward(TextGranularity granularity)
 {
     VisiblePosition pos(m_sel.extent(), m_sel.affinity());
     switch (granularity) {
@@ -267,7 +319,7 @@ VisiblePosition SelectionController::modifyExtendingRightForward(TextGranularity
             pos = endOfSentence(VisiblePosition(m_sel.end(), m_sel.affinity()));
             break;
         case LineBoundary:
-            pos = endOfLine(VisiblePosition(m_sel.end(), m_sel.affinity()));
+            pos = logicalEndOfLine(VisiblePosition(m_sel.end(), m_sel.affinity()));
             break;
         case ParagraphBoundary:
             pos = endOfParagraph(VisiblePosition(m_sel.end(), m_sel.affinity()));
@@ -341,7 +393,7 @@ VisiblePosition SelectionController::modifyMovingForward(TextGranularity granula
             pos = endOfSentence(VisiblePosition(m_sel.end(), m_sel.affinity()));
             break;
         case LineBoundary:
-            pos = endOfLine(VisiblePosition(m_sel.end(), m_sel.affinity()));
+            pos = logicalEndOfLine(VisiblePosition(m_sel.end(), m_sel.affinity()));
             break;
         case ParagraphBoundary:
             pos = endOfParagraph(VisiblePosition(m_sel.end(), m_sel.affinity()));
@@ -358,10 +410,44 @@ VisiblePosition SelectionController::modifyMovingForward(TextGranularity granula
     return pos;
 }
 
-VisiblePosition SelectionController::modifyExtendingLeftBackward(TextGranularity granularity)
+VisiblePosition SelectionController::modifyExtendingLeft(TextGranularity granularity)
 {
     VisiblePosition pos(m_sel.extent(), m_sel.affinity());
-        
+
+    // The difference between modifyExtendingLeft and modifyExtendingBackward is:
+    // modifyExtendingBackward always extends backward logically.
+    // modifyExtendingLeft behaves the same as modifyExtendingBackward except for extending character or word,
+    // it extends backward logically if the enclosing block is LTR direction,
+    // but it extends forward logically if the enclosing block is RTL direction.
+    switch (granularity) {
+        case CharacterGranularity:
+            if (directionOfEnclosingBlock() == LTR)
+                pos = pos.previous(true);
+            else
+                pos = pos.next(true);
+            break;
+        case WordGranularity:
+            if (directionOfEnclosingBlock() == LTR)
+                pos = previousWordPosition(pos);
+            else
+                pos = nextWordPosition(pos);
+            break;
+        case SentenceGranularity:
+        case LineGranularity:
+        case ParagraphGranularity:
+        case SentenceBoundary:
+        case LineBoundary:
+        case ParagraphBoundary:
+        case DocumentBoundary:
+            pos = modifyExtendingBackward(granularity);
+    }
+    return pos;
+}
+       
+VisiblePosition SelectionController::modifyExtendingBackward(TextGranularity granularity)
+{
+    VisiblePosition pos(m_sel.extent(), m_sel.affinity());
+
     // Extending a selection backward by word or character from just after a table selects
     // the table.  This "makes sense" from the user perspective, esp. when deleting.
     // It was done here instead of in VisiblePosition because we want VPs to iterate
@@ -386,7 +472,7 @@ VisiblePosition SelectionController::modifyExtendingLeftBackward(TextGranularity
             pos = startOfSentence(VisiblePosition(m_sel.start(), m_sel.affinity()));
             break;
         case LineBoundary:
-            pos = startOfLine(VisiblePosition(m_sel.start(), m_sel.affinity()));
+            pos = logicalStartOfLine(VisiblePosition(m_sel.start(), m_sel.affinity()));
             break;
         case ParagraphBoundary:
             pos = startOfParagraph(VisiblePosition(m_sel.start(), m_sel.affinity()));
@@ -453,7 +539,7 @@ VisiblePosition SelectionController::modifyMovingBackward(TextGranularity granul
             pos = startOfSentence(VisiblePosition(m_sel.start(), m_sel.affinity()));
             break;
         case LineBoundary:
-            pos = startOfLine(VisiblePosition(m_sel.start(), m_sel.affinity()));
+            pos = logicalStartOfLine(VisiblePosition(m_sel.start(), m_sel.affinity()));
             break;
         case ParagraphBoundary:
             pos = startOfParagraph(VisiblePosition(m_sel.start(), m_sel.affinity()));
@@ -493,11 +579,11 @@ bool SelectionController::modify(EAlteration alter, EDirection dir, TextGranular
             if (alter == MOVE)
                 pos = modifyMovingRight(granularity);
             else
-                pos = modifyExtendingRightForward(granularity);
+                pos = modifyExtendingRight(granularity);
             break;
         case FORWARD:
             if (alter == EXTEND)
-                pos = modifyExtendingRightForward(granularity);
+                pos = modifyExtendingForward(granularity);
             else
                 pos = modifyMovingForward(granularity);
             break;
@@ -505,11 +591,11 @@ bool SelectionController::modify(EAlteration alter, EDirection dir, TextGranular
             if (alter == MOVE)
                 pos = modifyMovingLeft(granularity);
             else
-                pos = modifyExtendingLeftBackward(granularity);
+                pos = modifyExtendingLeft(granularity);
             break;
         case BACKWARD:
             if (alter == EXTEND)
-                pos = modifyExtendingLeftBackward(granularity);
+                pos = modifyExtendingBackward(granularity);
             else
                 pos = modifyMovingBackward(granularity);
             break;
@@ -692,27 +778,27 @@ int SelectionController::xPosForVerticalArrowNavigation(EPositionType type)
 
 void SelectionController::clear()
 {
-    setSelection(Selection());
+    setSelection(VisibleSelection());
 }
 
 void SelectionController::setBase(const VisiblePosition &pos, bool userTriggered)
 {
-    setSelection(Selection(pos.deepEquivalent(), m_sel.extent(), pos.affinity()), true, true, userTriggered);
+    setSelection(VisibleSelection(pos.deepEquivalent(), m_sel.extent(), pos.affinity()), true, true, userTriggered);
 }
 
 void SelectionController::setExtent(const VisiblePosition &pos, bool userTriggered)
 {
-    setSelection(Selection(m_sel.base(), pos.deepEquivalent(), pos.affinity()), true, true, userTriggered);
+    setSelection(VisibleSelection(m_sel.base(), pos.deepEquivalent(), pos.affinity()), true, true, userTriggered);
 }
 
 void SelectionController::setBase(const Position &pos, EAffinity affinity, bool userTriggered)
 {
-    setSelection(Selection(pos, m_sel.extent(), affinity), true, true, userTriggered);
+    setSelection(VisibleSelection(pos, m_sel.extent(), affinity), true, true, userTriggered);
 }
 
 void SelectionController::setExtent(const Position &pos, EAffinity affinity, bool userTriggered)
 {
-    setSelection(Selection(m_sel.base(), pos, affinity), true, true, userTriggered);
+    setSelection(VisibleSelection(m_sel.base(), pos, affinity), true, true, userTriggered);
 }
 
 void SelectionController::setNeedsLayout(bool flag)
@@ -727,7 +813,7 @@ void SelectionController::layout()
         return;
     }
 
-    m_sel.start().node()->document()->updateRendering();
+    m_sel.start().node()->document()->updateStyleIfNeeded();
     
     m_caretRect = IntRect();
         
@@ -788,11 +874,20 @@ RenderObject* SelectionController::caretRenderer() const
 IntRect SelectionController::localCaretRect() const
 {
     if (m_needsLayout)
-        const_cast<SelectionController *>(this)->layout();
+        const_cast<SelectionController*>(this)->layout();
     
     return m_caretRect;
 }
 
+IntRect SelectionController::absoluteBoundsForLocalRect(const IntRect& rect) const
+{
+    RenderObject* caretPainter = caretRenderer();
+    if (!caretPainter)
+        return IntRect();
+        
+    return caretPainter->localToAbsoluteQuad(FloatRect(rect)).enclosingBoundingBox();
+}
+
 IntRect SelectionController::absoluteCaretBounds()
 {
     recomputeCaretRect();
@@ -811,18 +906,12 @@ static IntRect repaintRectForCaret(IntRect caret)
 
 IntRect SelectionController::caretRepaintRect() const
 {
-    IntRect localRect = repaintRectForCaret(localCaretRect());
-    
-    RenderObject* caretPainter = caretRenderer();
-    if (caretPainter)
-        return caretPainter->localToAbsoluteQuad(FloatRect(localRect)).enclosingBoundingBox();
-
-    return IntRect();
+    return absoluteBoundsForLocalRect(repaintRectForCaret(localCaretRect()));
 }
 
 bool SelectionController::recomputeCaretRect()
 {
-    if (!m_frame || !m_frame->document())
+    if (!m_frame)
         return false;
         
     FrameView* v = m_frame->document()->view();
@@ -833,21 +922,26 @@ bool SelectionController::recomputeCaretRect()
         return false;
 
     IntRect oldRect = m_caretRect;
-    m_needsLayout = true;
     IntRect newRect = localCaretRect();
     if (oldRect == newRect && !m_absCaretBoundsDirty)
         return false;
 
-    IntRect oldAbsRepaintRect = m_absCaretBounds;
-    m_absCaretBounds = caretRepaintRect();
+    IntRect oldAbsCaretBounds = m_absCaretBounds;
+    // FIXME: Rename m_caretRect to m_localCaretRect.
+    m_absCaretBounds = absoluteBoundsForLocalRect(m_caretRect);
     m_absCaretBoundsDirty = false;
     
-    if (oldAbsRepaintRect == m_absCaretBounds)
+    if (oldAbsCaretBounds == m_absCaretBounds)
         return false;
+        
+    IntRect oldAbsoluteCaretRepaintBounds = m_absoluteCaretRepaintBounds;
+    // We believe that we need to inflate the local rect before transforming it to obtain the repaint bounds.
+    m_absoluteCaretRepaintBounds = caretRepaintRect();
     
-    if (RenderView* view = static_cast<RenderView*>(m_frame->document()->renderer())) {
-        view->repaintViewRectangle(oldAbsRepaintRect, false);
-        view->repaintViewRectangle(m_absCaretBounds, false);
+    if (RenderView* view = toRenderView(m_frame->document()->renderer())) {
+        // FIXME: make caret repainting container-aware.
+        view->repaintRectangleInViewAndCompositedLayers(oldAbsoluteCaretRepaintBounds, false);
+        view->repaintRectangleInViewAndCompositedLayers(m_absoluteCaretRepaintBounds, false);
     }
 
     return true;
@@ -878,8 +972,8 @@ void SelectionController::invalidateCaretRect()
     m_needsLayout = true;
 
     if (!caretRectChanged) {
-        if (RenderView* view = static_cast<RenderView*>(d->renderer()))
-            view->repaintViewRectangle(caretRepaintRect(), false);
+        if (RenderView* view = toRenderView(d->renderer()))
+            view->repaintRectangleInViewAndCompositedLayers(caretRepaintRect(), false);
     }
 }
 
@@ -911,7 +1005,7 @@ void SelectionController::debugRenderer(RenderObject *r, bool selected) const
         fprintf(stderr, "%s%s\n", selected ? "==> " : "    ", element->localName().string().utf8().data());
     }
     else if (r->isText()) {
-        RenderText* textRenderer = static_cast<RenderText*>(r);
+        RenderText* textRenderer = toRenderText(r);
         if (textRenderer->textLength() == 0 || !textRenderer->firstTextBox()) {
             fprintf(stderr, "%s#text (empty)\n", selected ? "==> " : "    ");
             return;
@@ -923,13 +1017,13 @@ void SelectionController::debugRenderer(RenderObject *r, bool selected) const
         if (selected) {
             int offset = 0;
             if (r->node() == m_sel.start().node())
-                offset = m_sel.start().offset();
+                offset = m_sel.start().deprecatedEditingOffset();
             else if (r->node() == m_sel.end().node())
-                offset = m_sel.end().offset();
+                offset = m_sel.end().deprecatedEditingOffset();
                 
             int pos;
             InlineTextBox *box = textRenderer->findNextInlineTextBox(offset, pos);
-            text = text.substring(box->m_start, box->m_len);
+            text = text.substring(box->start(), box->len());
             
             String show;
             int mid = max / 2;
@@ -987,9 +1081,10 @@ bool SelectionController::contains(const IntPoint& point)
     if (!document->renderer()) 
         return false;
     
-    HitTestRequest request(true, true);
+    HitTestRequest request(HitTestRequest::ReadOnly |
+                           HitTestRequest::Active);
     HitTestResult result(point);
-    document->renderer()->layer()->hitTest(request, result);
+    document->renderView()->layer()->hitTest(request, result);
     Node* innerNode = result.innerNode();
     if (!innerNode || !innerNode->renderer())
         return false;
@@ -1033,8 +1128,6 @@ void SelectionController::selectFrameElementInParentIfFullySelected()
 
     // Get to the <iframe> or <frame> (or even <object>) element in the parent frame.
     Document* doc = m_frame->document();
-    if (!doc)
-        return;
     Element* ownerElement = doc->ownerElement();
     if (!ownerElement)
         return;
@@ -1052,7 +1145,7 @@ void SelectionController::selectFrameElementInParentIfFullySelected()
     VisiblePosition afterOwnerElement(VisiblePosition(ownerElementParent, ownerElementNodeIndex + 1, VP_UPSTREAM_IF_POSSIBLE));
 
     // Focus on the parent frame, and then select from before this element to after.
-    Selection newSelection(beforeOwnerElement, afterOwnerElement);
+    VisibleSelection newSelection(beforeOwnerElement, afterOwnerElement);
     if (parent->shouldChangeSelection(newSelection)) {
         page->focusController()->setFocusedFrame(parent);
         parent->selection()->setSelection(newSelection);
@@ -1062,8 +1155,6 @@ void SelectionController::selectFrameElementInParentIfFullySelected()
 void SelectionController::selectAll()
 {
     Document* document = m_frame->document();
-    if (!document)
-        return;
     
     if (document->focusedNode() && document->focusedNode()->canSelectAll()) {
         document->focusedNode()->selectAll();
@@ -1080,7 +1171,7 @@ void SelectionController::selectAll()
     }
     if (!root)
         return;
-    Selection newSelection(Selection::selectionFromContentsOfNode(root));
+    VisibleSelection newSelection(VisibleSelection::selectionFromContentsOfNode(root));
     if (m_frame->shouldChangeSelection(newSelection))
         setSelection(newSelection);
     selectFrameElementInParentIfFullySelected();
@@ -1124,7 +1215,7 @@ bool SelectionController::setSelectedRange(Range* range, EAffinity affinity, boo
     // FIXME: Can we provide extentAffinity?
     VisiblePosition visibleStart(startContainer, startOffset, collapsed ? affinity : DOWNSTREAM);
     VisiblePosition visibleEnd(endContainer, endOffset, SEL_DEFAULT_AFFINITY);
-    setSelection(Selection(visibleStart, visibleEnd), closeTyping);
+    setSelection(VisibleSelection(visibleStart, visibleEnd), closeTyping);
     return true;
 }
 
@@ -1158,8 +1249,8 @@ void SelectionController::focusedOrActiveStateChanged()
     // Because RenderObject::selectionBackgroundColor() and
     // RenderObject::selectionForegroundColor() check if the frame is active,
     // we have to update places those colors were painted.
-    if (RenderView* view = static_cast<RenderView*>(m_frame->document()->renderer()))
-        view->repaintViewRectangle(enclosingIntRect(m_frame->selectionBounds()));
+    if (RenderView* view = toRenderView(m_frame->document()->renderer()))
+        view->repaintRectangleInViewAndCompositedLayers(enclosingIntRect(m_frame->selectionBounds()));
 
     // Caret appears in the active frame.
     if (activeAndFocused)
@@ -1173,10 +1264,10 @@ void SelectionController::focusedOrActiveStateChanged()
     // RenderTheme::isFocused() check if the frame is active, we have to
     // update style and theme state that depended on those.
     if (Node* node = m_frame->document()->focusedNode()) {
-        node->setChanged();
+        node->setNeedsStyleRecalc();
         if (RenderObject* renderer = node->renderer())
             if (renderer && renderer->style()->hasAppearance())
-                theme()->stateChanged(renderer, FocusState);
+                renderer->theme()->stateChanged(renderer, FocusState);
     }
 
     // Secure keyboard entry is set by the active frame.
@@ -1196,9 +1287,6 @@ void SelectionController::setFocused(bool flag)
     m_focused = flag;
 
     focusedOrActiveStateChanged();
-
-    if (Document* doc = m_frame->document())
-        doc->dispatchWindowEvent(flag ? eventNames().focusEvent : eventNames().blurEvent, false, false);
 }
 
 bool SelectionController::isFocusedAndActive() const
diff --git a/src/3rdparty/webkit/WebCore/editing/SelectionController.h b/src/3rdparty/webkit/WebCore/editing/SelectionController.h
index fe5e90d..bbd343c 100644
--- a/src/3rdparty/webkit/WebCore/editing/SelectionController.h
+++ b/src/3rdparty/webkit/WebCore/editing/SelectionController.h
@@ -27,8 +27,8 @@
 #define SelectionController_h
 
 #include "IntRect.h"
-#include "Selection.h"
 #include "Range.h"
+#include "VisibleSelection.h"
 #include <wtf/Noncopyable.h>
 
 namespace WebCore {
@@ -56,8 +56,8 @@ public:
     void moveTo(const Position&, EAffinity, bool userTriggered = false);
     void moveTo(const Position&, const Position&, EAffinity, bool userTriggered = false);
 
-    const Selection& selection() const { return m_sel; }
-    void setSelection(const Selection&, bool closeTyping = true, bool clearTypingStyle = true, bool userTriggered = false);
+    const VisibleSelection& selection() const { return m_sel; }
+    void setSelection(const VisibleSelection&, bool closeTyping = true, bool clearTypingStyle = true, bool userTriggered = false);
     bool setSelectedRange(Range*, EAffinity, bool closeTyping);
     void selectAll();
     void clear();
@@ -67,7 +67,7 @@ public:
 
     bool contains(const IntPoint&);
 
-    Selection::EState state() const { return m_sel.state(); }
+    VisibleSelection::SelectionType selectionType() const { return m_sel.selectionType(); }
 
     EAffinity affinity() const { return m_sel.affinity(); }
 
@@ -102,8 +102,9 @@ public:
     bool isRange() const { return m_sel.isRange(); }
     bool isCaretOrRange() const { return m_sel.isCaretOrRange(); }
     bool isInPasswordField() const;
+    bool isAll(StayInEditableContent stayInEditableContent = MustStayInEditableContent) const { return m_sel.isAll(stayInEditableContent); }
     
-    PassRefPtr<Range> toRange() const { return m_sel.toRange(); }
+    PassRefPtr<Range> toNormalizedRange() const { return m_sel.toNormalizedRange(); }
 
     void debugRenderer(RenderObject*, bool selected) const;
     
@@ -119,6 +120,7 @@ public:
 
     // Focus
     void setFocused(bool);
+    bool isFocused() const { return m_focused; }
     bool isFocusedAndActive() const;
     void pageActivationChanged();
 
@@ -130,10 +132,14 @@ public:
 private:
     enum EPositionType { START, END, BASE, EXTENT };
 
-    VisiblePosition modifyExtendingRightForward(TextGranularity);
+    TextDirection directionOfEnclosingBlock();
+
+    VisiblePosition modifyExtendingRight(TextGranularity);
+    VisiblePosition modifyExtendingForward(TextGranularity);
     VisiblePosition modifyMovingRight(TextGranularity);
     VisiblePosition modifyMovingForward(TextGranularity);
-    VisiblePosition modifyExtendingLeftBackward(TextGranularity);
+    VisiblePosition modifyExtendingLeft(TextGranularity);
+    VisiblePosition modifyExtendingBackward(TextGranularity);
     VisiblePosition modifyMovingLeft(TextGranularity);
     VisiblePosition modifyMovingBackward(TextGranularity);
 
@@ -142,7 +148,7 @@ private:
 
     int xPosForVerticalArrowNavigation(EPositionType);
     
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || PLATFORM(GTK)
     void notifyAccessibilityForSelectionChange();
 #else
     void notifyAccessibilityForSelectionChange() {};
@@ -150,14 +156,17 @@ private:
 
     void focusedOrActiveStateChanged();
     bool caretRendersInsideNode(Node*) const;
+    
+    IntRect absoluteBoundsForLocalRect(const IntRect&) const;
 
     Frame* m_frame;
     int m_xPosForVerticalArrowNavigation;
 
-    Selection m_sel;
+    VisibleSelection m_sel;
 
     IntRect m_caretRect;        // caret rect in coords local to the renderer responsible for painting the caret
     IntRect m_absCaretBounds;   // absolute bounding rect for the caret
+    IntRect m_absoluteCaretRepaintBounds;
     
     bool m_needsLayout : 1;       // true if the caret and expectedVisible rectangles need to be calculated
     bool m_absCaretBoundsDirty: 1;
@@ -187,3 +196,4 @@ void showTree(const WebCore::SelectionController*);
 #endif
 
 #endif // SelectionController_h
+
diff --git a/src/3rdparty/webkit/WebCore/editing/SmartReplaceCF.cpp b/src/3rdparty/webkit/WebCore/editing/SmartReplaceCF.cpp
index f2fd985..c5fa9a8 100644
--- a/src/3rdparty/webkit/WebCore/editing/SmartReplaceCF.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/SmartReplaceCF.cpp
@@ -30,6 +30,7 @@
 #include "SmartReplace.h"
 
 #include <CoreFoundation/CFCharacterSet.h>
+#include <CoreFoundation/CFString.h>
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.cpp b/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.cpp
index 69447d4..35dfc6f 100644
--- a/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/SplitElementCommand.cpp
@@ -43,7 +43,7 @@ SplitElementCommand::SplitElementCommand(PassRefPtr<Element> element, PassRefPtr
 
 void SplitElementCommand::doApply()
 {
-    RefPtr<Element> prefixElement = m_element2->cloneElement();
+    RefPtr<Element> prefixElement = m_element2->cloneElementWithoutChildren();
 
     if (m_atChild->parentNode() != m_element2)
         return;
diff --git a/src/3rdparty/webkit/WebCore/editing/TextAffinity.h b/src/3rdparty/webkit/WebCore/editing/TextAffinity.h
index 5562cc4..a5565c7 100644
--- a/src/3rdparty/webkit/WebCore/editing/TextAffinity.h
+++ b/src/3rdparty/webkit/WebCore/editing/TextAffinity.h
@@ -38,20 +38,22 @@ namespace WebCore {
 // From NSTextView.h:
 // NSSelectionAffinityUpstream = 0
 // NSSelectionAffinityDownstream = 1
-typedef enum { UPSTREAM = 0, DOWNSTREAM = 1 } EAffinity;
+enum EAffinity { UPSTREAM = 0, DOWNSTREAM = 1 };
+
+} // namespace WebCore
 
 #ifdef __OBJC__
-inline NSSelectionAffinity kit(EAffinity affinity)
+
+inline NSSelectionAffinity kit(WebCore::EAffinity affinity)
 {
     return static_cast<NSSelectionAffinity>(affinity);
 }
 
-inline EAffinity core(NSSelectionAffinity affinity)
+inline WebCore::EAffinity core(NSSelectionAffinity affinity)
 {
-    return static_cast<EAffinity>(affinity);
+    return static_cast<WebCore::EAffinity>(affinity);
 }
-#endif
 
-} // namespace WebCore
+#endif
 
 #endif // TextAffinity_h
diff --git a/src/3rdparty/webkit/WebCore/editing/TextIterator.cpp b/src/3rdparty/webkit/WebCore/editing/TextIterator.cpp
index 79f1344..aee34df 100644
--- a/src/3rdparty/webkit/WebCore/editing/TextIterator.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/TextIterator.cpp
@@ -29,7 +29,7 @@
 
 #include "CharacterNames.h"
 #include "Document.h"
-#include "Element.h"
+#include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "htmlediting.h"
 #include "InlineTextBox.h"
@@ -38,6 +38,7 @@
 #include "RenderTableCell.h"
 #include "RenderTableRow.h"
 #include "RenderTextControl.h"
+#include "VisiblePosition.h"
 #include "visible_units.h"
 
 #if USE(ICU_UNICODE) && !UCONFIG_NO_COLLATION
@@ -96,12 +97,126 @@ private:
 
 // --------
 
+static const unsigned bitsInWord = sizeof(unsigned) * 8;
+static const unsigned bitInWordMask = bitsInWord - 1;
+
+BitStack::BitStack()
+    : m_size(0)
+{
+}
+
+void BitStack::push(bool bit)
+{
+    unsigned index = m_size / bitsInWord;
+    unsigned shift = m_size & bitInWordMask;
+    if (!shift && index == m_words.size()) {
+        m_words.grow(index + 1);
+        m_words[index] = 0;
+    }
+    unsigned& word = m_words[index];
+    unsigned mask = 1U << shift;
+    if (bit)
+        word |= mask;
+    else
+        word &= ~mask;
+    ++m_size;
+}
+
+void BitStack::pop()
+{
+    if (m_size)
+        --m_size;
+}
+
+bool BitStack::top() const
+{
+    if (!m_size)
+        return false;
+    unsigned shift = (m_size - 1) & bitInWordMask;
+    return m_words.last() & (1U << shift);
+}
+
+unsigned BitStack::size() const
+{
+    return m_size;
+}
+
+// --------
+
+static inline Node* parentOrShadowParent(Node* node)
+{
+    if (Node* parent = node->parentNode())
+        return parent;
+    return node->shadowParentNode();
+}
+
+#ifndef NDEBUG
+
+static unsigned depthCrossingShadowBoundaries(Node* node)
+{
+    unsigned depth = 0;
+    for (Node* parent = parentOrShadowParent(node); parent; parent = parentOrShadowParent(parent))
+        ++depth;
+    return depth;
+}
+
+#endif
+
+static inline bool fullyClipsContents(Node* node)
+{
+    RenderObject* renderer = node->renderer();
+    if (!renderer || !renderer->isBox())
+        return false;
+    RenderStyle* style = renderer->style();
+    if (style->overflowX() == OVISIBLE && style->overflowY() == OVISIBLE)
+        return false;
+    return toRenderBox(renderer)->size().isEmpty();
+}
+
+static inline bool ignoresContainerClip(Node* node)
+{
+    RenderObject* renderer = node->renderer();
+    if (!renderer || renderer->isText())
+        return false;
+    EPosition position = renderer->style()->position();
+    return position == AbsolutePosition || position == FixedPosition;
+}
+
+static void pushFullyClippedState(BitStack& stack, Node* node)
+{
+    ASSERT(stack.size() == depthCrossingShadowBoundaries(node));
+
+    // Push true if this node full clips its contents, or if a parent already has fully
+    // clipped and this is not a node that ignores its container's clip.
+    stack.push(fullyClipsContents(node) || stack.top() && !ignoresContainerClip(node));
+}
+
+static void setUpFullyClippedStack(BitStack& stack, Node* node)
+{
+    // Put the nodes in a vector so we can iterate in reverse order.
+    Vector<Node*, 100> ancestry;
+    for (Node* parent = parentOrShadowParent(node); parent; parent = parentOrShadowParent(parent))
+        ancestry.append(parent);
+
+    // Call pushFullyClippedState on each node starting with the earliest ancestor.
+    size_t size = ancestry.size();
+    for (size_t i = 0; i < size; ++i)
+        pushFullyClippedState(stack, ancestry[size - i - 1]);
+    pushFullyClippedState(stack, node);
+
+    ASSERT(stack.size() == 1 + depthCrossingShadowBoundaries(node));
+}
+
+// --------
+
 TextIterator::TextIterator()
     : m_startContainer(0)
     , m_startOffset(0)
     , m_endContainer(0)
     , m_endOffset(0)
     , m_positionNode(0)
+    , m_textCharacters(0)
+    , m_textLength(0)
     , m_lastCharacter(0)
     , m_emitCharactersBetweenAllVisiblePositions(false)
     , m_enterTextControls(false)
@@ -109,12 +224,13 @@ TextIterator::TextIterator()
 }
 
 TextIterator::TextIterator(const Range* r, bool emitCharactersBetweenAllVisiblePositions, bool enterTextControls) 
-    : m_inShadowContent(false)
-    , m_startContainer(0) 
+    : m_startContainer(0) 
     , m_startOffset(0)
     , m_endContainer(0)
     , m_endOffset(0)
     , m_positionNode(0)
+    , m_textCharacters(0)
+    , m_textLength(0)
     , m_emitCharactersBetweenAllVisiblePositions(emitCharactersBetweenAllVisiblePositions)
     , m_enterTextControls(enterTextControls)
 {
@@ -139,17 +255,11 @@ TextIterator::TextIterator(const Range* r, bool emitCharactersBetweenAllVisibleP
     m_endContainer = endContainer;
     m_endOffset = endOffset;
 
-    for (Node* n = startContainer; n; n = n->parentNode()) {
-        if (n->isShadowNode()) {
-            m_inShadowContent = true;
-            break;
-        }
-    }
-
     // set up the current node for processing
     m_node = r->firstNode();
-    if (m_node == 0)
+    if (!m_node)
         return;
+    setUpFullyClippedStack(m_fullyClippedStack, m_node);
     m_offset = m_node == m_startContainer ? m_startOffset : 0;
     m_handledNode = false;
     m_handledChildren = false;
@@ -214,7 +324,7 @@ void TextIterator::advance()
             return;
         }
         
-        RenderObject *renderer = m_node->renderer();
+        RenderObject* renderer = m_node->renderer();
         if (!renderer) {
             m_handledNode = true;
             m_handledChildren = true;
@@ -223,7 +333,9 @@ void TextIterator::advance()
             if (!m_handledNode) {
                 if (renderer->isText() && m_node->nodeType() == Node::TEXT_NODE) // FIXME: What about CDATA_SECTION_NODE?
                     m_handledNode = handleTextNode();
-                else if (renderer && (renderer->isImage() || renderer->isWidget() || (renderer->element() && renderer->element()->isControl())))
+                else if (renderer && (renderer->isImage() || renderer->isWidget() ||
+                         (renderer->node() && renderer->node()->isElementNode() &&
+                          static_cast<Element*>(renderer->node())->isFormControlElement())))
                     m_handledNode = handleReplacedElement();
                 else
                     m_handledNode = handleNonTextNode();
@@ -234,27 +346,20 @@ void TextIterator::advance()
 
         // find a new current node to handle in depth-first manner,
         // calling exitNode() as we come back thru a parent node
-        Node *next = m_handledChildren ? 0 : m_node->firstChild();
+        Node* next = m_handledChildren ? 0 : m_node->firstChild();
         m_offset = 0;
         if (!next) {
             next = m_node->nextSibling();
             if (!next) {
                 bool pastEnd = m_node->traverseNextNode() == m_pastEndNode;
-                Node* parentNode = m_node->parentNode();
-                if (!parentNode && m_inShadowContent) {
-                    m_inShadowContent = false;
-                    parentNode = m_node->shadowParentNode();
-                }
+                Node* parentNode = parentOrShadowParent(m_node);
                 while (!next && parentNode) {
-                    if (pastEnd && parentNode == m_endContainer || m_endContainer->isDescendantOf(parentNode))
+                    if ((pastEnd && parentNode == m_endContainer) || m_endContainer->isDescendantOf(parentNode))
                         return;
                     bool haveRenderer = m_node->renderer();
                     m_node = parentNode;
-                    parentNode = m_node->parentNode();
-                    if (!parentNode && m_inShadowContent) {
-                        m_inShadowContent = false;
-                        parentNode = m_node->shadowParentNode();
-                    }
+                    m_fullyClippedStack.pop();
+                    parentNode = parentOrShadowParent(m_node);
                     if (haveRenderer)
                         exitNode();
                     if (m_positionNode) {
@@ -265,10 +370,13 @@ void TextIterator::advance()
                     next = m_node->nextSibling();
                 }
             }
+            m_fullyClippedStack.pop();            
         }
 
         // set the new current node
         m_node = next;
+        if (m_node)
+            pushFullyClippedState(m_fullyClippedStack, m_node);
         m_handledNode = false;
         m_handledChildren = false;
 
@@ -278,14 +386,17 @@ void TextIterator::advance()
     }
 }
 
-static inline bool compareBoxStart(const InlineTextBox *first, const InlineTextBox *second)
+static inline bool compareBoxStart(const InlineTextBox* first, const InlineTextBox* second)
 {
     return first->start() < second->start();
 }
 
 bool TextIterator::handleTextNode()
 {
-    RenderText* renderer = static_cast<RenderText*>(m_node->renderer());
+    if (m_fullyClippedStack.top())
+        return false;
+
+    RenderText* renderer = toRenderText(m_node->renderer());
     if (renderer->style()->visibility() != VISIBLE)
         return false;
         
@@ -318,7 +429,7 @@ bool TextIterator::handleTextNode()
     // Used when text boxes are out of order (Hebrew/Arabic w/ embeded LTR text)
     if (renderer->containsReversedText()) {
         m_sortedTextBoxes.clear();
-        for (InlineTextBox * textBox = renderer->firstTextBox(); textBox; textBox = textBox->nextTextBox()) {
+        for (InlineTextBox* textBox = renderer->firstTextBox(); textBox; textBox = textBox->nextTextBox()) {
             m_sortedTextBoxes.append(textBox);
         }
         std::sort(m_sortedTextBoxes.begin(), m_sortedTextBoxes.end(), compareBoxStart); 
@@ -332,16 +443,16 @@ bool TextIterator::handleTextNode()
 
 void TextIterator::handleTextBox()
 {    
-    RenderText *renderer = static_cast<RenderText *>(m_node->renderer());
+    RenderText* renderer = toRenderText(m_node->renderer());
     String str = renderer->text();
     int start = m_offset;
     int end = (m_node == m_endContainer) ? m_endOffset : INT_MAX;
     while (m_textBox) {
-        int textBoxStart = m_textBox->m_start;
+        int textBoxStart = m_textBox->start();
         int runStart = max(textBoxStart, start);
 
         // Check for collapsed space at the start of this run.
-        InlineTextBox *firstTextBox = renderer->containsReversedText() ? m_sortedTextBoxes[0] : renderer->firstTextBox();
+        InlineTextBox* firstTextBox = renderer->containsReversedText() ? m_sortedTextBoxes[0] : renderer->firstTextBox();
         bool needSpace = m_lastTextNodeEndedWithCollapsedSpace
             || (m_textBox == firstTextBox && textBoxStart == runStart && runStart > 0);
         if (needSpace && !isCollapsibleWhitespace(m_lastCharacter) && m_lastCharacter) {
@@ -354,11 +465,11 @@ void TextIterator::handleTextBox()
                 emitCharacter(' ', m_node, 0, runStart, runStart);
             return;
         }
-        int textBoxEnd = textBoxStart + m_textBox->m_len;
+        int textBoxEnd = textBoxStart + m_textBox->len();
         int runEnd = min(textBoxEnd, end);
         
         // Determine what the next text box will be, but don't advance yet
-        InlineTextBox *nextTextBox = 0;
+        InlineTextBox* nextTextBox = 0;
         if (renderer->containsReversedText()) {
             if (m_sortedTextBoxesPosition + 1 < m_sortedTextBoxes.size())
                 nextTextBox = m_sortedTextBoxes[m_sortedTextBoxesPosition + 1];
@@ -387,7 +498,7 @@ void TextIterator::handleTextBox()
                 return;
 
             // Advance and return
-            int nextRunStart = nextTextBox ? nextTextBox->m_start : str.length();
+            int nextRunStart = nextTextBox ? nextTextBox->start() : str.length();
             if (nextRunStart > runEnd)
                 m_lastTextNodeEndedWithCollapsedSpace = true; // collapsed space between runs or at the end
             m_textBox = nextTextBox;
@@ -404,6 +515,9 @@ void TextIterator::handleTextBox()
 
 bool TextIterator::handleReplacedElement()
 {
+    if (m_fullyClippedStack.top())
+        return false;
+
     RenderObject* renderer = m_node->renderer();
     if (renderer->style()->visibility() != VISIBLE)
         return false;
@@ -413,11 +527,13 @@ bool TextIterator::handleReplacedElement()
         return false;
     }
 
-    if (m_enterTextControls && (renderer->isTextArea() || renderer->isTextField())) {
-        m_node = static_cast<RenderTextControl*>(renderer)->innerTextElement();
-        m_offset = 0;
-        m_inShadowContent = true;
-        return false;
+    if (m_enterTextControls && renderer->isTextControl()) {
+        if (HTMLElement* innerTextElement = toRenderTextControl(renderer)->innerTextElement()) {
+            m_node = innerTextElement->shadowTreeRootNode();
+            pushFullyClippedState(m_fullyClippedStack, m_node);
+            m_offset = 0;
+            return false;
+        }
     }
 
     m_haveEmitted = true;
@@ -535,7 +651,7 @@ static bool shouldEmitExtraNewlineForNode(Node* node)
     // result even without margin collapsing. For example: <div><p>text</p></div>
     // will work right even if both the <div> and the <p> have bottom margins.
     RenderObject* r = node->renderer();
-    if (!r)
+    if (!r || !r->isBox())
         return false;
     
     // NOTE: We only do this for a select set of nodes, and fwiw WinIE appears
@@ -549,7 +665,7 @@ static bool shouldEmitExtraNewlineForNode(Node* node)
         || node->hasTagName(pTag)) {
         RenderStyle* style = r->style();
         if (style) {
-            int bottomMargin = r->collapsedMarginBottom();
+            int bottomMargin = toRenderBox(r)->collapsedMarginBottom();
             int fontSize = style->fontDescription().computedPixelSize();
             if (bottomMargin * 2 >= fontSize)
                 return true;
@@ -606,11 +722,13 @@ bool TextIterator::shouldRepresentNodeOffsetZero()
     if (!m_node->renderer() || m_node->renderer()->style()->visibility() != VISIBLE)
         return false;
     
-    // The currPos.isNotNull() check is needed because positions in non-html content
-    // (like svg) do not have visible positions, and we don't want to emit for them either.
+    // The startPos.isNotNull() check is needed because the start could be before the body,
+    // and in that case we'll get null. We don't want to put in newlines at the start in that case.
+    // The currPos.isNotNull() check is needed because positions in non-HTML content
+    // (like SVG) do not have visible positions, and we don't want to emit for them either.
     VisiblePosition startPos = VisiblePosition(m_startContainer, m_startOffset, DOWNSTREAM);
     VisiblePosition currPos = VisiblePosition(m_node, 0, DOWNSTREAM);
-    return currPos.isNotNull() && !inSameLine(startPos, currPos);
+    return startPos.isNotNull() && currPos.isNotNull() && !inSameLine(startPos, currPos);
 }
 
 bool TextIterator::shouldEmitSpaceBeforeAndAfterNode(Node* node)
@@ -689,7 +807,7 @@ void TextIterator::exitNode()
         emitCharacter(' ', baseNode->parentNode(), baseNode, 1, 1);
 }
 
-void TextIterator::emitCharacter(UChar c, Node *textNode, Node *offsetBaseNode, int textStartOffset, int textEndOffset)
+void TextIterator::emitCharacter(UChar c, Node* textNode, Node* offsetBaseNode, int textStartOffset, int textEndOffset)
 {
     m_haveEmitted = true;
     
@@ -712,7 +830,7 @@ void TextIterator::emitCharacter(UChar c, Node *textNode, Node *offsetBaseNode,
 
 void TextIterator::emitText(Node* textNode, int textStartOffset, int textEndOffset)
 {
-    RenderText* renderer = static_cast<RenderText*>(m_node->renderer());
+    RenderText* renderer = toRenderText(m_node->renderer());
     String str = renderer->text();
     ASSERT(str.characters());
 
@@ -769,7 +887,7 @@ SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator() : m_positionN
 {
 }
 
-SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator(const Range *r)
+SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator(const Range* r)
 {
     m_positionNode = 0;
 
@@ -797,6 +915,7 @@ SimplifiedBackwardsTextIterator::SimplifiedBackwardsTextIterator(const Range *r)
     }
 
     m_node = endNode;
+    setUpFullyClippedStack(m_fullyClippedStack, m_node);    
     m_offset = endOffset;
     m_handledNode = false;
     m_handledChildren = endOffset == 0;
@@ -836,7 +955,7 @@ void SimplifiedBackwardsTextIterator::advance()
     while (m_node && m_node != m_pastStartNode) {
         // Don't handle node if we start iterating at [node, 0].
         if (!m_handledNode && !(m_node == m_endNode && m_endOffset == 0)) {
-            RenderObject *renderer = m_node->renderer();
+            RenderObject* renderer = m_node->renderer();
             if (renderer && renderer->isText() && m_node->nodeType() == Node::TEXT_NODE) {
                 // FIXME: What about CDATA_SECTION_NODE?
                 if (renderer->style()->visibility() == VISIBLE && m_offset > 0)
@@ -857,7 +976,7 @@ void SimplifiedBackwardsTextIterator::advance()
             if (!m_handledNode &&
                 canHaveChildrenForEditing(m_node) && 
                 m_node->parentNode() && 
-                (!m_node->lastChild() || m_node == m_endNode && m_endOffset == 0)) {
+                (!m_node->lastChild() || (m_node == m_endNode && m_endOffset == 0))) {
                 exitNode();
                 if (m_positionNode) {
                     m_handledNode = true;
@@ -868,9 +987,11 @@ void SimplifiedBackwardsTextIterator::advance()
             // Exit all other containers.
             next = m_node->previousSibling();
             while (!next) {
-                if (!m_node->parentNode())
+                Node* parentNode = parentOrShadowParent(m_node);
+                if (!parentNode)
                     break;
-                m_node = m_node->parentNode();
+                m_node = parentNode;
+                m_fullyClippedStack.pop();
                 exitNode();
                 if (m_positionNode) {
                     m_handledNode = true;
@@ -879,9 +1000,12 @@ void SimplifiedBackwardsTextIterator::advance()
                 }
                 next = m_node->previousSibling();
             }
+            m_fullyClippedStack.pop();
         }
         
         m_node = next;
+        if (m_node)
+            pushFullyClippedState(m_fullyClippedStack, m_node);
         m_offset = m_node ? caretMaxOffset(m_node) : 0;
         m_handledNode = false;
         m_handledChildren = false;
@@ -895,7 +1019,7 @@ bool SimplifiedBackwardsTextIterator::handleTextNode()
 {
     m_lastTextNode = m_node;
 
-    RenderText *renderer = static_cast<RenderText *>(m_node->renderer());
+    RenderText* renderer = toRenderText(m_node->renderer());
     String str = renderer->text();
 
     if (!renderer->firstTextBox() && str.length() > 0)
@@ -951,7 +1075,7 @@ void SimplifiedBackwardsTextIterator::exitNode()
         emitCharacter('\n', m_node, 0, 0);
 }
 
-void SimplifiedBackwardsTextIterator::emitCharacter(UChar c, Node *node, int startOffset, int endOffset)
+void SimplifiedBackwardsTextIterator::emitCharacter(UChar c, Node* node, int startOffset, int endOffset)
 {
     m_singleCharacterBuffer = c;
     m_positionNode = node;
@@ -979,7 +1103,7 @@ CharacterIterator::CharacterIterator()
 {
 }
 
-CharacterIterator::CharacterIterator(const Range *r, bool emitCharactersBetweenAllVisiblePositions, bool enterTextControls)
+CharacterIterator::CharacterIterator(const Range* r, bool emitCharactersBetweenAllVisiblePositions, bool enterTextControls)
     : m_offset(0)
     , m_runOffset(0)
     , m_atBreak(true)
@@ -1056,7 +1180,7 @@ void CharacterIterator::advance(int count)
 String CharacterIterator::string(int numChars)
 {
     Vector<UChar> result;
-    result.reserveCapacity(numChars);
+    result.reserveInitialCapacity(numChars);
     while (numChars > 0 && !atEnd()) {
         int runSize = min(numChars, length());
         result.append(characters(), runSize);
@@ -1080,18 +1204,95 @@ static PassRefPtr<Range> characterSubrange(CharacterIterator& it, int offset, in
         end->endContainer(), end->endOffset());
 }
 
+BackwardsCharacterIterator::BackwardsCharacterIterator()
+    : m_offset(0)
+    , m_runOffset(0)
+    , m_atBreak(true)
+{
+}
+
+BackwardsCharacterIterator::BackwardsCharacterIterator(const Range* range)
+    : m_offset(0)
+    , m_runOffset(0)
+    , m_atBreak(true)
+    , m_textIterator(range)
+{
+    while (!atEnd() && !m_textIterator.length())
+        m_textIterator.advance();
+}
+
+PassRefPtr<Range> BackwardsCharacterIterator::range() const
+{
+    RefPtr<Range> r = m_textIterator.range();
+    if (!m_textIterator.atEnd()) {
+        if (m_textIterator.length() <= 1)
+            ASSERT(m_runOffset == 0);
+        else {
+            Node* n = r->startContainer();
+            ASSERT(n == r->endContainer());
+            int offset = r->endOffset() - m_runOffset;
+            ExceptionCode ec = 0;
+            r->setStart(n, offset - 1, ec);
+            r->setEnd(n, offset, ec);
+            ASSERT(!ec);
+        }
+    }
+    return r.release();
+}
+
+void BackwardsCharacterIterator::advance(int count)
+{
+    if (count <= 0) {
+        ASSERT(!count);
+        return;
+    }
+
+    m_atBreak = false;
+
+    int remaining = m_textIterator.length() - m_runOffset;
+    if (count < remaining) {
+        m_runOffset += count;
+        m_offset += count;
+        return;
+    }
+
+    count -= remaining;
+    m_offset += remaining;
+
+    for (m_textIterator.advance(); !atEnd(); m_textIterator.advance()) {
+        int runLength = m_textIterator.length();
+        if (runLength == 0)
+            m_atBreak = true;
+        else {
+            if (count < runLength) {
+                m_runOffset = count;
+                m_offset += count;
+                return;
+            }
+            
+            count -= runLength;
+            m_offset += runLength;
+        }
+    }
+
+    m_atBreak = true;
+    m_runOffset = 0;
+}
+
 // --------
 
 WordAwareIterator::WordAwareIterator()
-: m_previousText(0), m_didLookAhead(false)
+    : m_previousText(0)
+    , m_didLookAhead(false)
 {
 }
 
-WordAwareIterator::WordAwareIterator(const Range *r)
-: m_previousText(0), m_didLookAhead(false), m_textIterator(r)
+WordAwareIterator::WordAwareIterator(const Range* r)
+    : m_previousText(0)
+    , m_didLookAhead(true) // so we consider the first chunk from the text iterator
+    , m_textIterator(r)
 {
-    m_didLookAhead = true;  // so we consider the first chunk from the text iterator
-    advance();              // get in position over the first chunk of text
+    advance(); // get in position over the first chunk of text
 }
 
 // We're always in one of these modes:
@@ -1101,7 +1302,7 @@ WordAwareIterator::WordAwareIterator(const Range *r)
 //      (we looked ahead to the next chunk and found a word boundary)
 // - We built up our own chunk of text from many chunks from the text iterator
 
-// FIXME: Perf could be bad for huge spans next to each other that don't fall on word boundaries
+// FIXME: Performance could be bad for huge spans next to each other that don't fall on word boundaries.
 
 void WordAwareIterator::advance()
 {
@@ -1224,7 +1425,7 @@ inline SearchBuffer::SearchBuffer(const String& target, bool isCaseSensitive)
     ASSERT(!m_target.isEmpty());
 
     size_t targetLength = target.length();
-    m_buffer.reserveCapacity(max(targetLength * 8, minimumSearchBufferSize));
+    m_buffer.reserveInitialCapacity(max(targetLength * 8, minimumSearchBufferSize));
     m_overlap = m_buffer.capacity() / 4;
 
     // Grab the single global searcher.
@@ -1423,7 +1624,7 @@ size_t SearchBuffer::length() const
 
 // --------
 
-int TextIterator::rangeLength(const Range *r, bool forSelectionPreservation)
+int TextIterator::rangeLength(const Range* r, bool forSelectionPreservation)
 {
     int length = 0;
     for (TextIterator it(r, forSelectionPreservation); !it.atEnd(); it.advance())
@@ -1438,7 +1639,7 @@ PassRefPtr<Range> TextIterator::subrange(Range* entireRange, int characterOffset
     return characterSubrange(entireRangeIterator, characterOffset, characterCount);
 }
 
-PassRefPtr<Range> TextIterator::rangeFromLocationAndLength(Element *scope, int rangeLocation, int rangeLength, bool forSelectionPreservation)
+PassRefPtr<Range> TextIterator::rangeFromLocationAndLength(Element* scope, int rangeLocation, int rangeLength, bool forSelectionPreservation)
 {
     RefPtr<Range> resultRange = scope->document()->createRange();
 
@@ -1480,7 +1681,7 @@ PassRefPtr<Range> TextIterator::rangeFromLocationAndLength(Element *scope, int r
                 Position runEnd = VisiblePosition(runStart).next().deepEquivalent();
                 if (runEnd.isNotNull()) {
                     ExceptionCode ec = 0;
-                    textRunRange->setEnd(runEnd.node(), runEnd.offset(), ec);
+                    textRunRange->setEnd(runEnd.node(), runEnd.deprecatedEditingOffset(), ec);
                     ASSERT(!ec);
                 }
             }
@@ -1530,7 +1731,7 @@ PassRefPtr<Range> TextIterator::rangeFromLocationAndLength(Element *scope, int r
 
 // --------
     
-UChar* plainTextToMallocAllocatedBuffer(const Range* r, unsigned& bufferLength) 
+UChar* plainTextToMallocAllocatedBuffer(const Range* r, unsigned& bufferLength, bool isDisplayString) 
 {
     UChar* result = 0;
 
@@ -1541,7 +1742,7 @@ UChar* plainTextToMallocAllocatedBuffer(const Range* r, unsigned& bufferLength)
     typedef pair<UChar*, unsigned> TextSegment;
     Vector<TextSegment>* textSegments = 0;
     Vector<UChar> textBuffer;
-    textBuffer.reserveCapacity(cMaxSegmentSize);
+    textBuffer.reserveInitialCapacity(cMaxSegmentSize);
     for (TextIterator it(r); !it.atEnd(); it.advance()) {
         if (textBuffer.size() && textBuffer.size() + it.length() > cMaxSegmentSize) {
             UChar* newSegmentBuffer = static_cast<UChar*>(malloc(textBuffer.size() * sizeof(UChar)));
@@ -1585,13 +1786,17 @@ exit:
             free(textSegments->at(i).first);
         delete textSegments;
     }
+    
+    if (isDisplayString && r->ownerDocument())
+        r->ownerDocument()->displayBufferModifiedByEncoding(result, bufferLength);
+
     return result;
 }
 
 String plainText(const Range* r)
 {
     unsigned length;
-    UChar* buf = plainTextToMallocAllocatedBuffer(r, length);
+    UChar* buf = plainTextToMallocAllocatedBuffer(r, length, false);
     if (!buf)
         return "";
     String result(buf, length);
diff --git a/src/3rdparty/webkit/WebCore/editing/TextIterator.h b/src/3rdparty/webkit/WebCore/editing/TextIterator.h
index 11a8354..44af3e5a 100644
--- a/src/3rdparty/webkit/WebCore/editing/TextIterator.h
+++ b/src/3rdparty/webkit/WebCore/editing/TextIterator.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -46,9 +46,24 @@ inline bool isCollapsibleWhitespace(UChar c)
 }
 
 String plainText(const Range*);
-UChar* plainTextToMallocAllocatedBuffer(const Range*, unsigned& bufferLength);
+UChar* plainTextToMallocAllocatedBuffer(const Range*, unsigned& bufferLength, bool isDisplayString);
 PassRefPtr<Range> findPlainText(const Range*, const String&, bool forward, bool caseSensitive);
 
+class BitStack {
+public:
+    BitStack();
+
+    void push(bool);
+    void pop();
+
+    bool top() const;
+    unsigned size() const;
+
+private:
+    unsigned m_size;
+    Vector<unsigned, 1> m_words;
+};
+
 // Iterates through the DOM range, returning all the text, and 0-length boundaries
 // at points where replaced elements break up the text flow.  The text comes back in
 // chunks so as to optimize for performance of the iteration.
@@ -80,27 +95,27 @@ private:
     bool handleReplacedElement();
     bool handleNonTextNode();
     void handleTextBox();
-    void emitCharacter(UChar, Node *textNode, Node *offsetBaseNode, int textStartOffset, int textEndOffset);
-    void emitText(Node *textNode, int textStartOffset, int textEndOffset);
+    void emitCharacter(UChar, Node* textNode, Node* offsetBaseNode, int textStartOffset, int textEndOffset);
+    void emitText(Node* textNode, int textStartOffset, int textEndOffset);
     
     // Current position, not necessarily of the text being returned, but position
     // as we walk through the DOM tree.
-    Node *m_node;
+    Node* m_node;
     int m_offset;
     bool m_handledNode;
     bool m_handledChildren;
-    bool m_inShadowContent;
+    BitStack m_fullyClippedStack;
     
     // The range.
-    Node *m_startContainer;
+    Node* m_startContainer;
     int m_startOffset;
-    Node *m_endContainer;
+    Node* m_endContainer;
     int m_endOffset;
-    Node *m_pastEndNode;
+    Node* m_pastEndNode;
     
     // The current text and its position, in the form to be returned from the iterator.
-    Node *m_positionNode;
-    mutable Node *m_positionOffsetBaseNode;
+    Node* m_positionNode;
+    mutable Node* m_positionOffsetBaseNode;
     mutable int m_positionStartOffset;
     mutable int m_positionEndOffset;
     const UChar* m_textCharacters;
@@ -109,10 +124,10 @@ private:
     // Used when there is still some pending text from the current node; when these
     // are false and 0, we go back to normal iterating.
     bool m_needAnotherNewline;
-    InlineTextBox *m_textBox;
+    InlineTextBox* m_textBox;
     
     // Used to do the whitespace collapsing logic.
-    Node *m_lastTextNode;    
+    Node* m_lastTextNode;    
     bool m_lastTextNodeEndedWithCollapsedSpace;
     UChar m_lastCharacter;
     
@@ -135,12 +150,12 @@ private:
 };
 
 // Iterates through the DOM range, returning all the text, and 0-length boundaries
-// at points where replaced elements break up the text flow.  The text comes back in
+// at points where replaced elements break up the text flow. The text comes back in
 // chunks so as to optimize for performance of the iteration.
 class SimplifiedBackwardsTextIterator {
 public:
     SimplifiedBackwardsTextIterator();
-    explicit SimplifiedBackwardsTextIterator(const Range *);
+    explicit SimplifiedBackwardsTextIterator(const Range*);
     
     bool atEnd() const { return !m_positionNode; }
     void advance();
@@ -155,7 +170,7 @@ private:
     bool handleTextNode();
     bool handleReplacedElement();
     bool handleNonTextNode();
-    void emitCharacter(UChar, Node *Node, int startOffset, int endOffset);
+    void emitCharacter(UChar, Node*, int startOffset, int endOffset);
     
     // Current position, not necessarily of the text being returned, but position
     // as we walk through the DOM tree.
@@ -163,7 +178,8 @@ private:
     int m_offset;
     bool m_handledNode;
     bool m_handledChildren;
-    
+    BitStack m_fullyClippedStack;
+
     // End of the range.
     Node* m_startNode;
     int m_startOffset;
@@ -194,7 +210,7 @@ private:
 class CharacterIterator {
 public:
     CharacterIterator();
-    explicit CharacterIterator(const Range* r, bool emitCharactersBetweenAllVisiblePositions = false, bool enterTextControls = false);
+    explicit CharacterIterator(const Range*, bool emitCharactersBetweenAllVisiblePositions = false, bool enterTextControls = false);
     
     void advance(int numCharacters);
     
@@ -216,12 +232,31 @@ private:
     TextIterator m_textIterator;
 };
     
+class BackwardsCharacterIterator {
+public:
+    BackwardsCharacterIterator();
+    explicit BackwardsCharacterIterator(const Range*);
+
+    void advance(int);
+
+    bool atEnd() const { return m_textIterator.atEnd(); }
+
+    PassRefPtr<Range> range() const;
+
+private:
+    int m_offset;
+    int m_runOffset;
+    bool m_atBreak;
+
+    SimplifiedBackwardsTextIterator m_textIterator;
+};
+
 // Very similar to the TextIterator, except that the chunks of text returned are "well behaved",
 // meaning they never end split up a word.  This is useful for spellcheck or (perhaps one day) searching.
 class WordAwareIterator {
 public:
     WordAwareIterator();
-    explicit WordAwareIterator(const Range *r);
+    explicit WordAwareIterator(const Range*);
 
     bool atEnd() const { return !m_didLookAhead && m_textIterator.atEnd(); }
     void advance();
diff --git a/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp b/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp
index 414680f..f5901d7 100644
--- a/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/TypingCommand.cpp
@@ -33,9 +33,11 @@
 #include "Editor.h"
 #include "Element.h"
 #include "Frame.h"
+#include "HTMLNames.h"
 #include "InsertLineBreakCommand.h"
 #include "InsertParagraphSeparatorCommand.h"
 #include "InsertTextCommand.h"
+#include "RenderObject.h"
 #include "SelectionController.h"
 #include "VisiblePosition.h"
 #include "htmlediting.h"
@@ -43,18 +45,20 @@
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
 TypingCommand::TypingCommand(Document *document, ETypingCommand commandType, const String &textToInsert, bool selectInsertedText, TextGranularity granularity, bool killRing)
     : CompositeEditCommand(document), 
       m_commandType(commandType), 
       m_textToInsert(textToInsert), 
       m_openForMoreTyping(true), 
-      m_applyEditing(false), 
       m_selectInsertedText(selectInsertedText),
       m_smartDelete(false),
       m_granularity(granularity),
       m_killRing(killRing),
       m_openedByBackwardDelete(false)
 {
+    updatePreservesTypingStyle(m_commandType);
 }
 
 void TypingCommand::deleteSelection(Document* document, bool smartDelete)
@@ -125,14 +129,14 @@ void TypingCommand::insertText(Document* document, const String& text, bool sele
     insertText(document, text, frame->selection()->selection(), selectInsertedText, insertedTextIsComposition);
 }
 
-void TypingCommand::insertText(Document* document, const String& text, const Selection& selectionForInsertion, bool selectInsertedText, bool insertedTextIsComposition)
+void TypingCommand::insertText(Document* document, const String& text, const VisibleSelection& selectionForInsertion, bool selectInsertedText, bool insertedTextIsComposition)
 {
     ASSERT(document);
     
     RefPtr<Frame> frame = document->frame();
     ASSERT(frame);
     
-    Selection currentSelection = frame->selection()->selection();
+    VisibleSelection currentSelection = frame->selection()->selection();
     bool changeSelection = currentSelection != selectionForInsertion;
     
     String newText = text;
@@ -281,8 +285,17 @@ EditAction TypingCommand::editingAction() const
 
 void TypingCommand::markMisspellingsAfterTyping()
 {
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    if (!document()->frame()->editor()->isContinuousSpellCheckingEnabled()
+     && !document()->frame()->editor()->isAutomaticQuoteSubstitutionEnabled()
+     && !document()->frame()->editor()->isAutomaticLinkDetectionEnabled()
+     && !document()->frame()->editor()->isAutomaticDashSubstitutionEnabled()
+     && !document()->frame()->editor()->isAutomaticTextReplacementEnabled())
+        return;
+#else
     if (!document()->frame()->editor()->isContinuousSpellCheckingEnabled())
         return;
+#endif
     // Take a look at the selection that results after typing and determine whether we need to spellcheck. 
     // Since the word containing the current selection is never marked, this does a check to
     // see if typing made a new word that is not in the current selection. Basically, you
@@ -297,16 +310,19 @@ void TypingCommand::markMisspellingsAfterTyping()
     }
 }
 
-void TypingCommand::typingAddedToOpenCommand()
+void TypingCommand::typingAddedToOpenCommand(ETypingCommand commandTypeForAddedTyping)
 {
+    updatePreservesTypingStyle(commandTypeForAddedTyping);
+    
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    document()->frame()->editor()->appliedEditing(this);
+    // Since the spellchecking code may also perform corrections and other replacements, it should happen after the typing changes.
     markMisspellingsAfterTyping();
-    // Do not apply editing to the frame on the first time through.
-    // The frame will get told in the same way as all other commands.
-    // But since this command stays open and is used for additional typing, 
-    // we need to tell the frame here as other commands are added.
-    if (m_applyEditing)
-        document()->frame()->editor()->appliedEditing(this);
-    m_applyEditing = true;
+#else
+    // The old spellchecking code requires that checking be done first, to prevent issues like that in 6864072, where <doesn't> is marked as misspelled.
+    markMisspellingsAfterTyping();
+    document()->frame()->editor()->appliedEditing(this);
+#endif
 }
 
 void TypingCommand::insertText(const String &text, bool selectInsertedText)
@@ -347,42 +363,70 @@ void TypingCommand::insertTextRunWithoutNewlines(const String &text, bool select
         applyCommandToComposite(command);
     }
     command->input(text, selectInsertedText);
-    typingAddedToOpenCommand();
+    typingAddedToOpenCommand(InsertText);
 }
 
 void TypingCommand::insertLineBreak()
 {
     applyCommandToComposite(InsertLineBreakCommand::create(document()));
-    typingAddedToOpenCommand();
+    typingAddedToOpenCommand(InsertLineBreak);
 }
 
 void TypingCommand::insertParagraphSeparator()
 {
     applyCommandToComposite(InsertParagraphSeparatorCommand::create(document()));
-    typingAddedToOpenCommand();
+    typingAddedToOpenCommand(InsertParagraphSeparator);
 }
 
 void TypingCommand::insertParagraphSeparatorInQuotedContent()
 {
+    // If the selection starts inside a table, just insert the paragraph separator normally
+    // Breaking the blockquote would also break apart the table, which is unecessary when inserting a newline
+    if (enclosingNodeOfType(endingSelection().start(), &isTableStructureNode)) {
+        insertParagraphSeparator();
+        return;
+    }
+        
     applyCommandToComposite(BreakBlockquoteCommand::create(document()));
-    typingAddedToOpenCommand();
+    typingAddedToOpenCommand(InsertParagraphSeparatorInQuotedContent);
+}
+
+bool TypingCommand::makeEditableRootEmpty()
+{
+    Element* root = endingSelection().rootEditableElement();
+    if (!root->firstChild())
+        return false;
+
+    if (root->firstChild() == root->lastChild() && root->firstElementChild() && root->firstElementChild()->hasTagName(brTag)) {
+        // If there is a single child and it could be a placeholder, leave it alone.
+        if (root->renderer() && root->renderer()->isBlockFlow())
+            return false;
+    }
+
+    while (Node* child = root->firstChild())
+        removeNode(child);
+
+    addBlockPlaceholderIfNeeded(root);
+    setEndingSelection(VisibleSelection(Position(root, 0), DOWNSTREAM));
+
+    return true;
 }
 
 void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
 {
-    Selection selectionToDelete;
-    Selection selectionAfterUndo;
+    VisibleSelection selectionToDelete;
+    VisibleSelection selectionAfterUndo;
     
-    switch (endingSelection().state()) {
-        case Selection::RANGE:
+    switch (endingSelection().selectionType()) {
+        case VisibleSelection::RangeSelection:
             selectionToDelete = endingSelection();
             selectionAfterUndo = selectionToDelete;
             break;
-        case Selection::CARET: {
-            if (breakOutOfEmptyMailBlockquotedParagraph()) {
-                typingAddedToOpenCommand();
-                return;
-            }
+        case VisibleSelection::CaretSelection: {
+            // After breaking out of an empty mail blockquote, we still want continue with the deletion
+            // so actual content will get deleted, and not just the quote style.
+            if (breakOutOfEmptyMailBlockquotedParagraph())
+                typingAddedToOpenCommand(DeleteKey);
         
             m_smartDelete = false;
 
@@ -392,10 +436,15 @@ void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
             if (killRing && selection.isCaret() && granularity != CharacterGranularity) 
                 selection.modify(SelectionController::EXTEND, SelectionController::BACKWARD, CharacterGranularity); 
             
-            // When the caret is at the start of the editable area in an empty list item, break out of the list item.
             if (endingSelection().visibleStart().previous(true).isNull()) {
+                // When the caret is at the start of the editable area in an empty list item, break out of the list item.
                 if (breakOutOfEmptyListItem()) {
-                    typingAddedToOpenCommand();
+                    typingAddedToOpenCommand(DeleteKey);
+                    return;
+                }
+                // When there are no visible positions in the editing root, delete its entire contents.
+                if (endingSelection().visibleStart().next(true).isNull() && makeEditableRootEmpty()) {
+                    typingAddedToOpenCommand(DeleteKey);
                     return;
                 }
             }
@@ -410,63 +459,62 @@ void TypingCommand::deleteKeyPressed(TextGranularity granularity, bool killRing)
                 selection.modify(SelectionController::EXTEND, SelectionController::BACKWARD, granularity);
             // If the caret is just after a table, select the table and don't delete anything.
             } else if (Node* table = isFirstPositionAfterTable(visibleStart)) {
-                setEndingSelection(Selection(Position(table, 0), endingSelection().start(), DOWNSTREAM));
-                typingAddedToOpenCommand();
+                setEndingSelection(VisibleSelection(Position(table, 0), endingSelection().start(), DOWNSTREAM));
+                typingAddedToOpenCommand(DeleteKey);
                 return;
             }
 
             selectionToDelete = selection.selection();
 
-            if (granularity == CharacterGranularity && selectionToDelete.end().offset() - selectionToDelete.start().offset() > 1) {
-                // When we delete a ligature consisting of multiple Unicode characters with a backspace key,
-                // we should not delete the ligature but delete only its last characeter. To check we are deleting
-                // a ligature, we retrieve the previous position of the caret and count the number of
-                // characters to be deleted.
-                // To prevent from calculating the previous position every time when pressing a backspace key,
-                // we retrieve the previous position only when the given selection consists of two or more characters.
-                if (selectionToDelete.end().offset() - selectionToDelete.end().previous(UsingComposedCharacters).offset() > 1)
-                    selectionToDelete.setWithoutValidation(selectionToDelete.end(), selectionToDelete.end().previous(NotUsingComposedCharacters));
+            if (granularity == CharacterGranularity && selectionToDelete.end().node() == selectionToDelete.start().node() && selectionToDelete.end().deprecatedEditingOffset() - selectionToDelete.start().deprecatedEditingOffset() > 1) {
+                // If there are multiple Unicode code points to be deleted, adjust the range to match platform conventions.
+                selectionToDelete.setWithoutValidation(selectionToDelete.end(), selectionToDelete.end().previous(BackwardDeletion));
             }
 
             if (!startingSelection().isRange() || selectionToDelete.base() != startingSelection().start())
                 selectionAfterUndo = selectionToDelete;
             else
                 // It's a little tricky to compute what the starting selection would have been in the original document.
-                // We can't let the Selection class's validation kick in or it'll adjust for us based on
+                // We can't let the VisibleSelection class's validation kick in or it'll adjust for us based on
                 // the current state of the document and we'll get the wrong result.
                 selectionAfterUndo.setWithoutValidation(startingSelection().end(), selectionToDelete.extent());
             break;
         }
-        case Selection::NONE:
+        case VisibleSelection::NoSelection:
             ASSERT_NOT_REACHED();
             break;
     }
     
-    if (selectionToDelete.isCaretOrRange() && document()->frame()->shouldDeleteSelection(selectionToDelete)) {
-        if (killRing)
-            document()->frame()->editor()->addToKillRing(selectionToDelete.toRange().get(), false);
-        // Make undo select everything that has been deleted, unless an undo will undo more than just this deletion.
-        // FIXME: This behaves like TextEdit except for the case where you open with text insertion and then delete
-        // more text than you insert.  In that case all of the text that was around originally should be selected.
-        if (m_openedByBackwardDelete)
-            setStartingSelection(selectionAfterUndo);
-        CompositeEditCommand::deleteSelection(selectionToDelete, m_smartDelete);
-        setSmartDelete(false);
-        typingAddedToOpenCommand();
-    }
+    ASSERT(!selectionToDelete.isNone());
+    if (selectionToDelete.isNone())
+        return;
+    
+    if (selectionToDelete.isCaret() || !document()->frame()->shouldDeleteSelection(selectionToDelete))
+        return;
+    
+    if (killRing)
+        document()->frame()->editor()->addToKillRing(selectionToDelete.toNormalizedRange().get(), false);
+    // Make undo select everything that has been deleted, unless an undo will undo more than just this deletion.
+    // FIXME: This behaves like TextEdit except for the case where you open with text insertion and then delete
+    // more text than you insert.  In that case all of the text that was around originally should be selected.
+    if (m_openedByBackwardDelete)
+        setStartingSelection(selectionAfterUndo);
+    CompositeEditCommand::deleteSelection(selectionToDelete, m_smartDelete);
+    setSmartDelete(false);
+    typingAddedToOpenCommand(DeleteKey);
 }
 
 void TypingCommand::forwardDeleteKeyPressed(TextGranularity granularity, bool killRing)
 {
-    Selection selectionToDelete;
-    Selection selectionAfterUndo;
+    VisibleSelection selectionToDelete;
+    VisibleSelection selectionAfterUndo;
 
-    switch (endingSelection().state()) {
-        case Selection::RANGE:
+    switch (endingSelection().selectionType()) {
+        case VisibleSelection::RangeSelection:
             selectionToDelete = endingSelection();
             selectionAfterUndo = selectionToDelete;
             break;
-        case Selection::CARET: {
+        case VisibleSelection::CaretSelection: {
             m_smartDelete = false;
 
             // Handle delete at beginning-of-block case.
@@ -483,9 +531,9 @@ void TypingCommand::forwardDeleteKeyPressed(TextGranularity granularity, bool ki
             if (visibleEnd == endOfParagraph(visibleEnd))
                 downstreamEnd = visibleEnd.next(true).deepEquivalent().downstream();
             // When deleting tables: Select the table first, then perform the deletion
-            if (downstreamEnd.node() && downstreamEnd.node()->renderer() && downstreamEnd.node()->renderer()->isTable() && downstreamEnd.offset() == 0) {
-                setEndingSelection(Selection(endingSelection().end(), Position(downstreamEnd.node(), maxDeepOffset(downstreamEnd.node())), DOWNSTREAM));
-                typingAddedToOpenCommand();
+            if (downstreamEnd.node() && downstreamEnd.node()->renderer() && downstreamEnd.node()->renderer()->isTable() && downstreamEnd.deprecatedEditingOffset() == 0) {
+                setEndingSelection(VisibleSelection(endingSelection().end(), lastDeepEditingPositionForNode(downstreamEnd.node()), DOWNSTREAM));
+                typingAddedToOpenCommand(ForwardDeleteKey);
                 return;
             }
 
@@ -498,7 +546,7 @@ void TypingCommand::forwardDeleteKeyPressed(TextGranularity granularity, bool ki
                 selectionAfterUndo = selectionToDelete;
             else {
                 // It's a little tricky to compute what the starting selection would have been in the original document.
-                // We can't let the Selection class's validation kick in or it'll adjust for us based on
+                // We can't let the VisibleSelection class's validation kick in or it'll adjust for us based on
                 // the current state of the document and we'll get the wrong result.
                 Position extent = startingSelection().end();
                 if (extent.node() != selectionToDelete.end().node())
@@ -506,52 +554,59 @@ void TypingCommand::forwardDeleteKeyPressed(TextGranularity granularity, bool ki
                 else {
                     int extraCharacters;
                     if (selectionToDelete.start().node() == selectionToDelete.end().node())
-                        extraCharacters = selectionToDelete.end().offset() - selectionToDelete.start().offset();
+                        extraCharacters = selectionToDelete.end().deprecatedEditingOffset() - selectionToDelete.start().deprecatedEditingOffset();
                     else
-                        extraCharacters = selectionToDelete.end().offset();
-                    extent = Position(extent.node(), extent.offset() + extraCharacters);
+                        extraCharacters = selectionToDelete.end().deprecatedEditingOffset();
+                    extent = Position(extent.node(), extent.deprecatedEditingOffset() + extraCharacters);
                 }
                 selectionAfterUndo.setWithoutValidation(startingSelection().start(), extent);
             }
             break;
         }
-        case Selection::NONE:
+        case VisibleSelection::NoSelection:
             ASSERT_NOT_REACHED();
             break;
     }
     
-    if (selectionToDelete.isCaretOrRange() && document()->frame()->shouldDeleteSelection(selectionToDelete)) {
-        if (killRing)
-            document()->frame()->editor()->addToKillRing(selectionToDelete.toRange().get(), false);
-        // make undo select what was deleted
-        setStartingSelection(selectionAfterUndo);
-        CompositeEditCommand::deleteSelection(selectionToDelete, m_smartDelete);
-        setSmartDelete(false);
-        typingAddedToOpenCommand();
-    }
+    ASSERT(!selectionToDelete.isNone());
+    if (selectionToDelete.isNone())
+        return;
+    
+    if (selectionToDelete.isCaret() || !document()->frame()->shouldDeleteSelection(selectionToDelete))
+        return;
+        
+    if (killRing)
+        document()->frame()->editor()->addToKillRing(selectionToDelete.toNormalizedRange().get(), false);
+    // make undo select what was deleted
+    setStartingSelection(selectionAfterUndo);
+    CompositeEditCommand::deleteSelection(selectionToDelete, m_smartDelete);
+    setSmartDelete(false);
+    typingAddedToOpenCommand(ForwardDeleteKey);
 }
 
 void TypingCommand::deleteSelection(bool smartDelete)
 {
     CompositeEditCommand::deleteSelection(smartDelete);
-    typingAddedToOpenCommand();
+    typingAddedToOpenCommand(DeleteSelection);
 }
 
-bool TypingCommand::preservesTypingStyle() const
+void TypingCommand::updatePreservesTypingStyle(ETypingCommand commandType)
 {
-    switch (m_commandType) {
+    switch (commandType) {
         case DeleteSelection:
         case DeleteKey:
         case ForwardDeleteKey:
         case InsertParagraphSeparator:
         case InsertLineBreak:
-            return true;
+            m_preservesTypingStyle = true;
+            return;
         case InsertParagraphSeparatorInQuotedContent:
         case InsertText:
-            return false;
+            m_preservesTypingStyle = false;
+            return;
     }
     ASSERT_NOT_REACHED();
-    return false;
+    m_preservesTypingStyle = false;
 }
 
 bool TypingCommand::isTypingCommand() const
diff --git a/src/3rdparty/webkit/WebCore/editing/TypingCommand.h b/src/3rdparty/webkit/WebCore/editing/TypingCommand.h
index b4e1091..7c89a7c 100644
--- a/src/3rdparty/webkit/WebCore/editing/TypingCommand.h
+++ b/src/3rdparty/webkit/WebCore/editing/TypingCommand.h
@@ -46,7 +46,7 @@ public:
     static void deleteKeyPressed(Document*, bool smartDelete = false, TextGranularity = CharacterGranularity, bool killRing = false);
     static void forwardDeleteKeyPressed(Document*, bool smartDelete = false, TextGranularity = CharacterGranularity, bool killRing = false);
     static void insertText(Document*, const String&, bool selectInsertedText = false, bool insertedTextIsComposition = false);
-    static void insertText(Document*, const String&, const Selection&, bool selectInsertedText = false, bool insertedTextIsComposition = false);
+    static void insertText(Document*, const String&, const VisibleSelection&, bool selectInsertedText = false, bool insertedTextIsComposition = false);
     static void insertLineBreak(Document*);
     static void insertParagraphSeparator(Document*);
     static void insertParagraphSeparatorInQuotedContent(Document*);
@@ -79,19 +79,21 @@ private:
     virtual void doApply();
     virtual EditAction editingAction() const;
     virtual bool isTypingCommand() const;
-    virtual bool preservesTypingStyle() const;
+    virtual bool preservesTypingStyle() const { return m_preservesTypingStyle; }
 
+    void updatePreservesTypingStyle(ETypingCommand);
     void markMisspellingsAfterTyping();
-    void typingAddedToOpenCommand();
+    void typingAddedToOpenCommand(ETypingCommand);
+    bool makeEditableRootEmpty();
     
     ETypingCommand m_commandType;
     String m_textToInsert;
     bool m_openForMoreTyping;
-    bool m_applyEditing;
     bool m_selectInsertedText;
     bool m_smartDelete;
     TextGranularity m_granularity;
     bool m_killRing;
+    bool m_preservesTypingStyle;
     
     // Undoing a series of backward deletes will restore a selection around all of the
     // characters that were deleted, but only if the typing command being undone
diff --git a/src/3rdparty/webkit/WebCore/editing/VisiblePosition.cpp b/src/3rdparty/webkit/WebCore/editing/VisiblePosition.cpp
index 9ecc4d8..2db6d31 100644
--- a/src/3rdparty/webkit/WebCore/editing/VisiblePosition.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/VisiblePosition.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,8 +28,8 @@
 
 #include "CString.h"
 #include "Document.h"
-#include "Element.h"
-#include "FloatRect.h"
+#include "FloatQuad.h"
+#include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "InlineTextBox.h"
 #include "Logging.h"
@@ -81,7 +81,7 @@ VisiblePosition VisiblePosition::previous(bool stayInEditableContent) const
     Position pos = previousVisuallyDistinctCandidate(m_deepPosition);
     
     // return null visible position if there is no previous visible position
-    if (pos.atStart())
+    if (pos.atStartOfTree())
         return VisiblePosition();
         
     VisiblePosition prev = VisiblePosition(pos, DOWNSTREAM);
@@ -125,7 +125,7 @@ Position VisiblePosition::leftVisuallyDistinctCandidate() const
         if (!box)
             return primaryDirection == LTR ? previousVisuallyDistinctCandidate(m_deepPosition) : nextVisuallyDistinctCandidate(m_deepPosition);
 
-        RenderObject* renderer = box->object();
+        RenderObject* renderer = box->renderer();
 
         while (true) {
             if ((renderer->isReplaced() || renderer->isBR()) && offset == box->caretRightmostOffset())
@@ -147,7 +147,7 @@ Position VisiblePosition::leftVisuallyDistinctCandidate() const
 
                 // Reposition at the other logical position corresponding to our edge's visual position and go for another round.
                 box = prevBox;
-                renderer = box->object();
+                renderer = box->renderer();
                 offset = prevBox->caretRightmostOffset();
                 continue;
             }
@@ -176,7 +176,7 @@ Position VisiblePosition::leftVisuallyDistinctCandidate() const
                         break;
                     box = prevBox;
                 }
-                renderer = box->object();
+                renderer = box->renderer();
                 offset = box->caretRightmostOffset();
                 if (box->direction() == primaryDirection)
                     break;
@@ -185,7 +185,7 @@ Position VisiblePosition::leftVisuallyDistinctCandidate() const
 
             if (prevBox) {
                 box = prevBox;
-                renderer = box->object();
+                renderer = box->renderer();
                 offset = box->caretRightmostOffset();
                 if (box->bidiLevel() > level) {
                     do {
@@ -215,15 +215,15 @@ Position VisiblePosition::leftVisuallyDistinctCandidate() const
                         break;
                     level = box->bidiLevel();
                 }
-                renderer = box->object();
+                renderer = box->renderer();
                 offset = primaryDirection == LTR ? box->caretMinOffset() : box->caretMaxOffset();
             }
             break;
         }
 
-        p = Position(renderer->element(), offset);
+        p = Position(renderer->node(), offset);
 
-        if (p.isCandidate() && p.downstream() != downstreamStart || p.atStart() || p.atEnd())
+        if ((p.isCandidate() && p.downstream() != downstreamStart) || p.atStartOfTree() || p.atEndOfTree())
             return p;
     }
 }
@@ -231,7 +231,8 @@ Position VisiblePosition::leftVisuallyDistinctCandidate() const
 VisiblePosition VisiblePosition::left(bool stayInEditableContent) const
 {
     Position pos = leftVisuallyDistinctCandidate();
-    if (pos.atStart() || pos.atEnd())
+    // FIXME: Why can't we move left from the last position in a tree?
+    if (pos.atStartOfTree() || pos.atEndOfTree())
         return VisiblePosition();
 
     VisiblePosition left = VisiblePosition(pos, DOWNSTREAM);
@@ -266,7 +267,7 @@ Position VisiblePosition::rightVisuallyDistinctCandidate() const
         if (!box)
             return primaryDirection == LTR ? nextVisuallyDistinctCandidate(m_deepPosition) : previousVisuallyDistinctCandidate(m_deepPosition);
 
-        RenderObject* renderer = box->object();
+        RenderObject* renderer = box->renderer();
 
         while (true) {
             if ((renderer->isReplaced() || renderer->isBR()) && offset == box->caretLeftmostOffset())
@@ -288,7 +289,7 @@ Position VisiblePosition::rightVisuallyDistinctCandidate() const
 
                 // Reposition at the other logical position corresponding to our edge's visual position and go for another round.
                 box = nextBox;
-                renderer = box->object();
+                renderer = box->renderer();
                 offset = nextBox->caretLeftmostOffset();
                 continue;
             }
@@ -318,7 +319,7 @@ Position VisiblePosition::rightVisuallyDistinctCandidate() const
                         break;
                     box = nextBox;
                 }
-                renderer = box->object();
+                renderer = box->renderer();
                 offset = box->caretLeftmostOffset();
                 if (box->direction() == primaryDirection)
                     break;
@@ -327,7 +328,7 @@ Position VisiblePosition::rightVisuallyDistinctCandidate() const
 
             if (nextBox) {
                 box = nextBox;
-                renderer = box->object();
+                renderer = box->renderer();
                 offset = box->caretLeftmostOffset();
                 if (box->bidiLevel() > level) {
                     do {
@@ -357,15 +358,15 @@ Position VisiblePosition::rightVisuallyDistinctCandidate() const
                         break;
                     level = box->bidiLevel();
                 }
-                renderer = box->object();
+                renderer = box->renderer();
                 offset = primaryDirection == LTR ? box->caretMaxOffset() : box->caretMinOffset();
             }
             break;
         }
 
-        p = Position(renderer->element(), offset);
+        p = Position(renderer->node(), offset);
 
-        if (p.isCandidate() && p.downstream() != downstreamStart || p.atStart() || p.atEnd())
+        if ((p.isCandidate() && p.downstream() != downstreamStart) || p.atStartOfTree() || p.atEndOfTree())
             return p;
     }
 }
@@ -373,7 +374,8 @@ Position VisiblePosition::rightVisuallyDistinctCandidate() const
 VisiblePosition VisiblePosition::right(bool stayInEditableContent) const
 {
     Position pos = rightVisuallyDistinctCandidate();
-    if (pos.atStart() || pos.atEnd())
+    // FIXME: Why can't we move left from the last position in a tree?
+    if (pos.atStartOfTree() || pos.atEndOfTree())
         return VisiblePosition();
 
     VisiblePosition right = VisiblePosition(pos, DOWNSTREAM);
@@ -399,7 +401,7 @@ VisiblePosition VisiblePosition::honorEditableBoundaryAtOrBefore(const VisiblePo
         
     // Return pos itself if the two are from the very same editable region, or both are non-editable
     // FIXME: In the non-editable case, just because the new position is non-editable doesn't mean movement
-    // to it is allowed.  Selection::adjustForEditableContent has this problem too.
+    // to it is allowed.  VisibleSelection::adjustForEditableContent has this problem too.
     if (highestEditableRoot(pos.deepEquivalent()) == highestRoot)
         return pos;
   
@@ -425,7 +427,7 @@ VisiblePosition VisiblePosition::honorEditableBoundaryAtOrAfter(const VisiblePos
     
     // Return pos itself if the two are from the very same editable region, or both are non-editable
     // FIXME: In the non-editable case, just because the new position is non-editable doesn't mean movement
-    // to it is allowed.  Selection::adjustForEditableContent has this problem too.
+    // to it is allowed.  VisibleSelection::adjustForEditableContent has this problem too.
     if (highestEditableRoot(pos.deepEquivalent()) == highestRoot)
         return pos;
 
@@ -438,7 +440,7 @@ VisiblePosition VisiblePosition::honorEditableBoundaryAtOrAfter(const VisiblePos
     return firstEditablePositionAfterPositionInRoot(pos.deepEquivalent(), highestRoot);
 }
 
-Position canonicalizeCandidate(const Position& candidate)
+static Position canonicalizeCandidate(const Position& candidate)
 {
     if (candidate.isNull())
         return Position();
@@ -478,24 +480,24 @@ Position VisiblePosition::canonicalPosition(const Position& position)
 
     // The new position must be in the same editable element. Enforce that first.
     // Unless the descent is from a non-editable html element to an editable body.
-    if (node->hasTagName(htmlTag) && !node->isContentEditable())
+    if (node->hasTagName(htmlTag) && !node->isContentEditable() && node->document()->body() && node->document()->body()->isContentEditable())
         return next.isNotNull() ? next : prev;
 
     Node* editingRoot = editableRootForPosition(position);
         
     // If the html element is editable, descending into its body will look like a descent 
     // from non-editable to editable content since rootEditableElement() always stops at the body.
-    if (editingRoot && editingRoot->hasTagName(htmlTag) || position.node()->isDocumentNode())
+    if ((editingRoot && editingRoot->hasTagName(htmlTag)) || position.node()->isDocumentNode())
         return next.isNotNull() ? next : prev;
         
     bool prevIsInSameEditableElement = prevNode && editableRootForPosition(prev) == editingRoot;
     bool nextIsInSameEditableElement = nextNode && editableRootForPosition(next) == editingRoot;
     if (prevIsInSameEditableElement && !nextIsInSameEditableElement)
         return prev;
-        
+
     if (nextIsInSameEditableElement && !prevIsInSameEditableElement)
         return next;
-        
+
     if (!nextIsInSameEditableElement && !prevIsInSameEditableElement)
         return Position();
 
@@ -509,7 +511,7 @@ Position VisiblePosition::canonicalPosition(const Position& position)
     return next;
 }
 
-UChar VisiblePosition::characterAfter() const
+UChar32 VisiblePosition::characterAfter() const
 {
     // We canonicalize to the first of two equivalent candidates, but the second of the two candidates
     // is the one that will be inside the text node containing the character after this visible position.
@@ -518,10 +520,15 @@ UChar VisiblePosition::characterAfter() const
     if (!node || !node->isTextNode())
         return 0;
     Text* textNode = static_cast<Text*>(pos.node());
-    int offset = pos.offset();
-    if ((unsigned)offset >= textNode->length())
+    unsigned offset = pos.deprecatedEditingOffset();
+    unsigned length = textNode->length();
+    if (offset >= length)
         return 0;
-    return textNode->data()[offset];
+
+    UChar32 ch;
+    const UChar* characters = textNode->data().characters();
+    U16_NEXT(characters, offset, length, ch);
+    return ch;
 }
 
 IntRect VisiblePosition::localCaretRect(RenderObject*& renderer) const
@@ -541,7 +548,7 @@ IntRect VisiblePosition::localCaretRect(RenderObject*& renderer) const
     getInlineBoxAndOffset(inlineBox, caretOffset);
 
     if (inlineBox)
-        renderer = inlineBox->object();
+        renderer = inlineBox->renderer();
 
     return renderer->localCaretRect(inlineBox, caretOffset);
 }
@@ -574,7 +581,7 @@ void VisiblePosition::debugPosition(const char* msg) const
     if (isNull())
         fprintf(stderr, "Position [%s]: null\n", msg);
     else
-        fprintf(stderr, "Position [%s]: %s [%p] at %d\n", msg, m_deepPosition.node()->nodeName().utf8().data(), m_deepPosition.node(), m_deepPosition.offset());
+        fprintf(stderr, "Position [%s]: %s [%p] at %d\n", msg, m_deepPosition.node()->nodeName().utf8().data(), m_deepPosition.node(), m_deepPosition.deprecatedEditingOffset());
 }
 
 #ifndef NDEBUG
@@ -593,9 +600,12 @@ void VisiblePosition::showTreeForThis() const
 
 PassRefPtr<Range> makeRange(const VisiblePosition &start, const VisiblePosition &end)
 {
+    if (start.isNull() || end.isNull())
+        return 0;
+    
     Position s = rangeCompliantEquivalent(start);
     Position e = rangeCompliantEquivalent(end);
-    return Range::create(s.node()->document(), s.node(), s.offset(), e.node(), e.offset());
+    return Range::create(s.node()->document(), s.node(), s.deprecatedEditingOffset(), e.node(), e.deprecatedEditingOffset());
 }
 
 VisiblePosition startVisiblePosition(const Range *r, EAffinity affinity)
@@ -616,7 +626,7 @@ bool setStart(Range *r, const VisiblePosition &visiblePosition)
         return false;
     Position p = rangeCompliantEquivalent(visiblePosition);
     int code = 0;
-    r->setStart(p.node(), p.offset(), code);
+    r->setStart(p.node(), p.deprecatedEditingOffset(), code);
     return code == 0;
 }
 
@@ -626,7 +636,7 @@ bool setEnd(Range *r, const VisiblePosition &visiblePosition)
         return false;
     Position p = rangeCompliantEquivalent(visiblePosition);
     int code = 0;
-    r->setEnd(p.node(), p.offset(), code);
+    r->setEnd(p.node(), p.deprecatedEditingOffset(), code);
     return code == 0;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/editing/VisiblePosition.h b/src/3rdparty/webkit/WebCore/editing/VisiblePosition.h
index 403c816..d888806 100644
--- a/src/3rdparty/webkit/WebCore/editing/VisiblePosition.h
+++ b/src/3rdparty/webkit/WebCore/editing/VisiblePosition.h
@@ -47,6 +47,8 @@ namespace WebCore {
 
 class InlineBox;
 
+enum StayInEditableContent { MayLeaveEditableContent, MustStayInEditableContent };
+
 class VisiblePosition {
 public:
     // NOTE: UPSTREAM affinity will be used only if pos is at end of a wrapped line,
@@ -64,6 +66,8 @@ public:
     EAffinity affinity() const { ASSERT(m_affinity == UPSTREAM || m_affinity == DOWNSTREAM); return m_affinity; }
     void setAffinity(EAffinity affinity) { m_affinity = affinity; }
 
+    // FIXME: Change the following functions' parameter from a boolean to StayInEditableContent.
+
     // next() and previous() will increment/decrement by a character cluster.
     VisiblePosition next(bool stayInEditableContent = false) const;
     VisiblePosition previous(bool stayInEditableContent = false) const;
@@ -73,8 +77,8 @@ public:
     VisiblePosition left(bool stayInEditableContent = false) const;
     VisiblePosition right(bool stayInEditableContent = false) const;
 
-    UChar characterAfter() const;
-    UChar characterBefore() const { return previous().characterAfter(); }
+    UChar32 characterAfter() const;
+    UChar32 characterBefore() const { return previous().characterAfter(); }
     
     void debugPosition(const char* msg = "") const;
     
diff --git a/src/3rdparty/webkit/WebCore/editing/Selection.cpp b/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp
index ea30f19..56ad6b3 100644
--- a/src/3rdparty/webkit/WebCore/editing/Selection.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/VisibleSelection.cpp
@@ -24,29 +24,32 @@
  */
   
 #include "config.h"
-#include "Selection.h"
+#include "VisibleSelection.h"
 
+#include "CharacterNames.h"
 #include "CString.h"
 #include "Document.h"
 #include "Element.h"
 #include "htmlediting.h"
+#include "TextIterator.h"
 #include "VisiblePosition.h"
 #include "visible_units.h"
 #include "Range.h"
+
 #include <wtf/Assertions.h>
 #include <stdio.h>
 
 namespace WebCore {
 
-Selection::Selection()
+VisibleSelection::VisibleSelection()
     : m_affinity(DOWNSTREAM)
     , m_granularity(CharacterGranularity)
-    , m_state(NONE)
+    , m_selectionType(NoSelection)
     , m_baseIsFirst(true)
 {
 }
 
-Selection::Selection(const Position& pos, EAffinity affinity)
+VisibleSelection::VisibleSelection(const Position& pos, EAffinity affinity)
     : m_base(pos)
     , m_extent(pos)
     , m_affinity(affinity)
@@ -55,7 +58,7 @@ Selection::Selection(const Position& pos, EAffinity affinity)
     validate();
 }
 
-Selection::Selection(const Position& base, const Position& extent, EAffinity affinity)
+VisibleSelection::VisibleSelection(const Position& base, const Position& extent, EAffinity affinity)
     : m_base(base)
     , m_extent(extent)
     , m_affinity(affinity)
@@ -64,7 +67,7 @@ Selection::Selection(const Position& base, const Position& extent, EAffinity aff
     validate();
 }
 
-Selection::Selection(const VisiblePosition& pos)
+VisibleSelection::VisibleSelection(const VisiblePosition& pos)
     : m_base(pos.deepEquivalent())
     , m_extent(pos.deepEquivalent())
     , m_affinity(pos.affinity())
@@ -73,7 +76,7 @@ Selection::Selection(const VisiblePosition& pos)
     validate();
 }
 
-Selection::Selection(const VisiblePosition& base, const VisiblePosition& extent)
+VisibleSelection::VisibleSelection(const VisiblePosition& base, const VisiblePosition& extent)
     : m_base(base.deepEquivalent())
     , m_extent(extent.deepEquivalent())
     , m_affinity(base.affinity())
@@ -82,7 +85,7 @@ Selection::Selection(const VisiblePosition& base, const VisiblePosition& extent)
     validate();
 }
 
-Selection::Selection(const Range* range, EAffinity affinity)
+VisibleSelection::VisibleSelection(const Range* range, EAffinity affinity)
     : m_base(range->startPosition())
     , m_extent(range->endPosition())
     , m_affinity(affinity)
@@ -91,36 +94,45 @@ Selection::Selection(const Range* range, EAffinity affinity)
     validate();
 }
 
-Selection Selection::selectionFromContentsOfNode(Node* node)
+VisibleSelection VisibleSelection::selectionFromContentsOfNode(Node* node)
 {
-    return Selection(Position(node, 0), Position(node, maxDeepOffset(node)), DOWNSTREAM);
+    return VisibleSelection(firstDeepEditingPositionForNode(node), lastDeepEditingPositionForNode(node), DOWNSTREAM);
 }
 
-void Selection::setBase(const Position& position)
+void VisibleSelection::setBase(const Position& position)
 {
     m_base = position;
     validate();
 }
 
-void Selection::setBase(const VisiblePosition& visiblePosition)
+void VisibleSelection::setBase(const VisiblePosition& visiblePosition)
 {
     m_base = visiblePosition.deepEquivalent();
     validate();
 }
 
-void Selection::setExtent(const Position& position)
+void VisibleSelection::setExtent(const Position& position)
 {
     m_extent = position;
     validate();
 }
 
-void Selection::setExtent(const VisiblePosition& visiblePosition)
+void VisibleSelection::setExtent(const VisiblePosition& visiblePosition)
 {
     m_extent = visiblePosition.deepEquivalent();
     validate();
 }
 
-PassRefPtr<Range> Selection::toRange() const
+PassRefPtr<Range> VisibleSelection::firstRange() const
+{
+    if (isNone())
+        return 0;
+    Position start = rangeCompliantEquivalent(m_start);
+    Position end = rangeCompliantEquivalent(m_end);
+    return Range::create(start.node()->document(), start, end);
+}
+
+PassRefPtr<Range> VisibleSelection::toNormalizedRange() const
 {
     if (isNone())
         return 0;
@@ -157,7 +169,7 @@ PassRefPtr<Range> Selection::toRange() const
         ASSERT(isRange());
         s = m_start.downstream();
         e = m_end.upstream();
-        if (Range::compareBoundaryPoints(s.node(), s.offset(), e.node(), e.offset()) > 0) {
+        if (comparePositions(s, e) > 0) {
             // Make sure the start is before the end.
             // The end can wind up before the start if collapsed whitespace is the only thing selected.
             Position tmp = s;
@@ -168,22 +180,12 @@ PassRefPtr<Range> Selection::toRange() const
         e = rangeCompliantEquivalent(e);
     }
 
-    ExceptionCode ec = 0;
-    RefPtr<Range> result(Range::create(s.node()->document()));
-    result->setStart(s.node(), s.offset(), ec);
-    if (ec) {
-        LOG_ERROR("Exception setting Range start from Selection: %d", ec);
-        return 0;
-    }
-    result->setEnd(e.node(), e.offset(), ec);
-    if (ec) {
-        LOG_ERROR("Exception setting Range end from Selection: %d", ec);
-        return 0;
-    }
-    return result.release();
+    // VisibleSelections are supposed to always be valid.  This constructor will ASSERT
+    // if a valid range could not be created, which is fine for this callsite.
+    return Range::create(s.node()->document(), s, e);
 }
 
-bool Selection::expandUsingGranularity(TextGranularity granularity)
+bool VisibleSelection::expandUsingGranularity(TextGranularity granularity)
 {
     if (isNone())
         return false;
@@ -193,15 +195,55 @@ bool Selection::expandUsingGranularity(TextGranularity granularity)
     return true;
 }
 
-void Selection::appendTrailingWhitespace()
+static PassRefPtr<Range> makeSearchRange(const Position& pos)
+{
+    Node* n = pos.node();
+    if (!n)
+        return 0;
+    Document* d = n->document();
+    Node* de = d->documentElement();
+    if (!de)
+        return 0;
+    Node* boundary = n->enclosingBlockFlowElement();
+    if (!boundary)
+        return 0;
+
+    RefPtr<Range> searchRange(Range::create(d));
+    ExceptionCode ec = 0;
+
+    Position start(rangeCompliantEquivalent(pos));
+    searchRange->selectNodeContents(boundary, ec);
+    searchRange->setStart(start.node(), start.deprecatedEditingOffset(), ec);
+
+    ASSERT(!ec);
+    if (ec)
+        return 0;
+
+    return searchRange.release();
+}
+
+bool VisibleSelection::isAll(StayInEditableContent stayInEditableContent) const
 {
-    VisiblePosition end = VisiblePosition(m_end, m_affinity);
-    while (end.isNotNull() && isSpaceOrNewline(end.characterAfter()))
-        end = end.next();
-    m_end = end.deepEquivalent();
+    return !shadowTreeRootNode() && visibleStart().previous(stayInEditableContent).isNull() && visibleEnd().next(stayInEditableContent).isNull();
 }
 
-void Selection::validate()
+void VisibleSelection::appendTrailingWhitespace()
+{
+    RefPtr<Range> searchRange = makeSearchRange(m_end);
+    if (!searchRange)
+        return;
+
+    CharacterIterator charIt(searchRange.get(), true);
+
+    for (; charIt.length(); charIt.advance(1)) {
+        UChar c = charIt.characters()[0];
+        if (!isSpaceOrNewline(c) && c != noBreakSpace)
+            break;
+        m_end = charIt.range()->endPosition();
+    }
+}
+
+void VisibleSelection::setBaseAndExtentToDeepEquivalents()
 {
     // Move the selection to rendered positions, if possible.
     bool baseAndExtentEqual = m_base == m_extent;
@@ -222,10 +264,12 @@ void Selection::validate()
     } else if (m_extent.isNull()) {
         m_extent = m_base;
         m_baseIsFirst = true;
-    } else {
+    } else
         m_baseIsFirst = comparePositions(m_base, m_extent) <= 0;
-    }
+}
 
+void VisibleSelection::setStartAndEndFromBaseAndExtentRespectingGranularity()
+{
     if (m_baseIsFirst) {
         m_start = m_base;
         m_end = m_extent;
@@ -234,7 +278,6 @@ void Selection::validate()
         m_end = m_base;
     }
 
-    // Expand the selection if requested.
     switch (m_granularity) {
         case CharacterGranularity:
             // Don't do any expansion.
@@ -348,26 +391,31 @@ void Selection::validate()
         m_start = m_end;
     if (m_end.isNull())
         m_end = m_start;
-    
-    adjustForEditableContent();
+}
 
-    // adjust the state
+void VisibleSelection::updateSelectionType()
+{
     if (m_start.isNull()) {
         ASSERT(m_end.isNull());
-        m_state = NONE;
-
-        // enforce downstream affinity if not caret, as affinity only
-        // makes sense for caret
-        m_affinity = DOWNSTREAM;
+        m_selectionType = NoSelection;
     } else if (m_start == m_end || m_start.upstream() == m_end.upstream()) {
-        m_state = CARET;
-    } else {
-        m_state = RANGE;
+        m_selectionType = CaretSelection;
+    } else
+        m_selectionType = RangeSelection;
 
-        // enforce downstream affinity if not caret, as affinity only
-        // makes sense for caret
+    // Affinity only makes sense for a caret
+    if (m_selectionType != CaretSelection)
         m_affinity = DOWNSTREAM;
+}
+
+void VisibleSelection::validate()
+{
+    setBaseAndExtentToDeepEquivalents();
+    setStartAndEndFromBaseAndExtentRespectingGranularity();
+    adjustSelectionToAvoidCrossingEditingBoundaries();
+    updateSelectionType();
 
+    if (selectionType() == RangeSelection) {
         // "Constrain" the selection to be the smallest equivalent range of nodes.
         // This is a somewhat arbitrary choice, but experience shows that it is
         // useful to make to make the selection "canonical" (if only for
@@ -382,12 +430,12 @@ void Selection::validate()
 }
 
 // FIXME: This function breaks the invariant of this class.
-// But because we use Selection to store values in editing commands for use when
+// But because we use VisibleSelection to store values in editing commands for use when
 // undoing the command, we need to be able to create a selection that while currently
 // invalid, will be valid once the changes are undone. This is a design problem.
-// To fix it we either need to change the invariants of Selection or create a new
+// To fix it we either need to change the invariants of VisibleSelection or create a new
 // class for editing to use that can manipulate selections that are not currently valid.
-void Selection::setWithoutValidation(const Position& base, const Position& extent)
+void VisibleSelection::setWithoutValidation(const Position& base, const Position& extent)
 {
     ASSERT(!base.isNull());
     ASSERT(!extent.isNull());
@@ -404,10 +452,10 @@ void Selection::setWithoutValidation(const Position& base, const Position& exten
         m_start = extent;
         m_end = base;
     }
-    m_state = RANGE;
+    m_selectionType = RangeSelection;
 }
 
-void Selection::adjustForEditableContent()
+void VisibleSelection::adjustSelectionToAvoidCrossingEditingBoundaries()
 {
     if (m_base.isNull() || m_start.isNull() || m_end.isNull())
         return;
@@ -459,17 +507,19 @@ void Selection::adjustForEditableContent()
             Position p = previousVisuallyDistinctCandidate(m_end);
             Node* shadowAncestor = endRoot ? endRoot->shadowAncestorNode() : 0;
             if (p.isNull() && endRoot && (shadowAncestor != endRoot))
-                p = Position(shadowAncestor, maxDeepOffset(shadowAncestor));
+                p = lastDeepEditingPositionForNode(shadowAncestor);
             while (p.isNotNull() && !(lowestEditableAncestor(p.node()) == baseEditableAncestor && !isEditablePosition(p))) {
                 Node* root = editableRootForPosition(p);
                 shadowAncestor = root ? root->shadowAncestorNode() : 0;
                 p = isAtomicNode(p.node()) ? positionBeforeNode(p.node()) : previousVisuallyDistinctCandidate(p);
                 if (p.isNull() && (shadowAncestor != root))
-                    p = Position(shadowAncestor, maxDeepOffset(shadowAncestor));
+                    p = lastDeepEditingPositionForNode(shadowAncestor);
             }
             VisiblePosition previous(p);
-            
+
             if (previous.isNull()) {
+                // The selection crosses an Editing boundary.  This is a
+                // programmer error in the editing code.  Happy debugging!
                 ASSERT_NOT_REACHED();
                 m_base = Position();
                 m_extent = Position();
@@ -497,6 +547,8 @@ void Selection::adjustForEditableContent()
             VisiblePosition next(p);
             
             if (next.isNull()) {
+                // The selection crosses an Editing boundary.  This is a
+                // programmer error in the editing code.  Happy debugging!
                 ASSERT_NOT_REACHED();
                 m_base = Position();
                 m_extent = Position();
@@ -512,42 +564,42 @@ void Selection::adjustForEditableContent()
         m_extent = m_baseIsFirst ? m_end : m_start;
 }
 
-bool Selection::isContentEditable() const
+bool VisibleSelection::isContentEditable() const
 {
     return isEditablePosition(start());
 }
 
-bool Selection::isContentRichlyEditable() const
+bool VisibleSelection::isContentRichlyEditable() const
 {
     return isRichlyEditablePosition(start());
 }
 
-Element* Selection::rootEditableElement() const
+Element* VisibleSelection::rootEditableElement() const
 {
     return editableRootForPosition(start());
 }
 
-Node* Selection::shadowTreeRootNode() const
+Node* VisibleSelection::shadowTreeRootNode() const
 {
     return start().node() ? start().node()->shadowTreeRootNode() : 0;
 }
 
-void Selection::debugPosition() const
+void VisibleSelection::debugPosition() const
 {
     if (!m_start.node())
         return;
 
-    fprintf(stderr, "Selection =================\n");
+    fprintf(stderr, "VisibleSelection =================\n");
 
     if (m_start == m_end) {
         Position pos = m_start;
-        fprintf(stderr, "pos:        %s %p:%d\n", pos.node()->nodeName().utf8().data(), pos.node(), pos.offset());
+        fprintf(stderr, "pos:        %s %p:%d\n", pos.node()->nodeName().utf8().data(), pos.node(), pos.deprecatedEditingOffset());
     } else {
         Position pos = m_start;
-        fprintf(stderr, "start:      %s %p:%d\n", pos.node()->nodeName().utf8().data(), pos.node(), pos.offset());
+        fprintf(stderr, "start:      %s %p:%d\n", pos.node()->nodeName().utf8().data(), pos.node(), pos.deprecatedEditingOffset());
         fprintf(stderr, "-----------------------------------\n");
         pos = m_end;
-        fprintf(stderr, "end:        %s %p:%d\n", pos.node()->nodeName().utf8().data(), pos.node(), pos.offset());
+        fprintf(stderr, "end:        %s %p:%d\n", pos.node()->nodeName().utf8().data(), pos.node(), pos.deprecatedEditingOffset());
         fprintf(stderr, "-----------------------------------\n");
     }
 
@@ -556,7 +608,7 @@ void Selection::debugPosition() const
 
 #ifndef NDEBUG
 
-void Selection::formatForDebugger(char* buffer, unsigned length) const
+void VisibleSelection::formatForDebugger(char* buffer, unsigned length) const
 {
     String result;
     String s;
@@ -577,11 +629,11 @@ void Selection::formatForDebugger(char* buffer, unsigned length) const
     strncpy(buffer, result.utf8().data(), length - 1);
 }
 
-void Selection::showTreeForThis() const
+void VisibleSelection::showTreeForThis() const
 {
     if (start().node()) {
         start().node()->showTreeAndMark(start().node(), "S", end().node(), "E");
-        fprintf(stderr, "start offset: %d, end offset: %d\n", start().offset(), end().offset());
+        fprintf(stderr, "start offset: %d, end offset: %d\n", start().deprecatedEditingOffset(), end().deprecatedEditingOffset());
     }
 }
 
@@ -591,12 +643,12 @@ void Selection::showTreeForThis() const
 
 #ifndef NDEBUG
 
-void showTree(const WebCore::Selection& sel)
+void showTree(const WebCore::VisibleSelection& sel)
 {
     sel.showTreeForThis();
 }
 
-void showTree(const WebCore::Selection* sel)
+void showTree(const WebCore::VisibleSelection* sel)
 {
     if (sel)
         sel->showTreeForThis();
diff --git a/src/3rdparty/webkit/WebCore/editing/Selection.h b/src/3rdparty/webkit/WebCore/editing/VisibleSelection.h
index 5e21701..e346b27 100644
--- a/src/3rdparty/webkit/WebCore/editing/Selection.h
+++ b/src/3rdparty/webkit/WebCore/editing/VisibleSelection.h
@@ -23,8 +23,8 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#ifndef Selection_h
-#define Selection_h
+#ifndef VisibleSelection_h
+#define VisibleSelection_h
 
 #include "TextGranularity.h"
 #include "VisiblePosition.h"
@@ -35,24 +35,23 @@ class Position;
 
 const EAffinity SEL_DEFAULT_AFFINITY = DOWNSTREAM;
 
-class Selection {
+class VisibleSelection {
 public:
-    enum EState { NONE, CARET, RANGE };
-    enum EDirection { FORWARD, BACKWARD, RIGHT, LEFT };
+    enum SelectionType { NoSelection, CaretSelection, RangeSelection };
 
-    Selection();
+    VisibleSelection();
 
-    Selection(const Position&, EAffinity);
-    Selection(const Position&, const Position&, EAffinity);
+    VisibleSelection(const Position&, EAffinity);
+    VisibleSelection(const Position&, const Position&, EAffinity = SEL_DEFAULT_AFFINITY);
 
-    Selection(const Range*, EAffinity = SEL_DEFAULT_AFFINITY);
+    VisibleSelection(const Range*, EAffinity = SEL_DEFAULT_AFFINITY);
     
-    Selection(const VisiblePosition&);
-    Selection(const VisiblePosition&, const VisiblePosition&);
+    VisibleSelection(const VisiblePosition&);
+    VisibleSelection(const VisiblePosition&, const VisiblePosition&);
 
-    static Selection selectionFromContentsOfNode(Node*);
+    static VisibleSelection selectionFromContentsOfNode(Node*);
 
-    EState state() const { return m_state; }
+    SelectionType selectionType() const { return m_selectionType; }
 
     void setAffinity(EAffinity affinity) { m_affinity = affinity; }
     EAffinity affinity() const { return m_affinity; }
@@ -63,26 +62,34 @@ public:
     void setExtent(const VisiblePosition&);
     
     Position base() const { return m_base; }
-    Position extent() const { return m_extent; }    
+    Position extent() const { return m_extent; }
     Position start() const { return m_start; }
     Position end() const { return m_end; }
     
     VisiblePosition visibleStart() const { return VisiblePosition(m_start, isRange() ? DOWNSTREAM : affinity()); }
     VisiblePosition visibleEnd() const { return VisiblePosition(m_end, isRange() ? UPSTREAM : affinity()); }
 
-    bool isNone() const { return state() == NONE; }
-    bool isCaret() const { return state() == CARET; }
-    bool isRange() const { return state() == RANGE; }
-    bool isCaretOrRange() const { return state() != NONE; }
+    bool isNone() const { return selectionType() == NoSelection; }
+    bool isCaret() const { return selectionType() == CaretSelection; }
+    bool isRange() const { return selectionType() == RangeSelection; }
+    bool isCaretOrRange() const { return selectionType() != NoSelection; }
 
     bool isBaseFirst() const { return m_baseIsFirst; }
 
+    bool isAll(StayInEditableContent) const;
+
     void appendTrailingWhitespace();
 
     bool expandUsingGranularity(TextGranularity granularity);
     TextGranularity granularity() const { return m_granularity; }
 
-    PassRefPtr<Range> toRange() const;
+    // We don't yet support multi-range selections, so we only ever have one range to return.
+    PassRefPtr<Range> firstRange() const;
+
+    // FIXME: Most callers probably don't want this function, but are using it
+    // for historical reasons.  toNormalizedRange contracts the range around
+    // text, and moves the caret upstream before returning the range.
+    PassRefPtr<Range> toNormalizedRange() const;
     
     Element* rootEditableElement() const;
     bool isContentEditable() const;
@@ -100,27 +107,33 @@ public:
 
 private:
     void validate();
-    void adjustForEditableContent();
 
-    Position m_base;                  // base position for the selection
-    Position m_extent;                // extent position for the selection
-    Position m_start;                 // start position for the selection
-    Position m_end;                   // end position for the selection
+    // Support methods for validate()
+    void setBaseAndExtentToDeepEquivalents();
+    void setStartAndEndFromBaseAndExtentRespectingGranularity();
+    void adjustSelectionToAvoidCrossingEditingBoundaries();
+    void updateSelectionType();
+
+    // FIXME: These should all be VisiblePositions
+    Position m_base;   // Where the first click happened
+    Position m_extent; // Where the end click happened
+    Position m_start;  // Leftmost position when expanded to respect granularity
+    Position m_end;    // Rightmost position when expanded to respect granularity
 
-    EAffinity m_affinity;             // the upstream/downstream affinity of the caret
-    TextGranularity m_granularity;   // granularity of start/end selection
+    EAffinity m_affinity;           // the upstream/downstream affinity of the caret
+    TextGranularity m_granularity;  // granularity of start/end selection
 
     // these are cached, can be recalculated by validate()
-    EState m_state;                   // the state of the selection
+    SelectionType m_selectionType;    // None, Caret, Range
     bool m_baseIsFirst;               // true if base is before the extent
 };
 
-inline bool operator==(const Selection& a, const Selection& b)
+inline bool operator==(const VisibleSelection& a, const VisibleSelection& b)
 {
     return a.start() == b.start() && a.end() == b.end() && a.affinity() == b.affinity() && a.granularity() == b.granularity() && a.isBaseFirst() == b.isBaseFirst();
 }
 
-inline bool operator!=(const Selection& a, const Selection& b)
+inline bool operator!=(const VisibleSelection& a, const VisibleSelection& b)
 {
     return !(a == b);
 }
@@ -129,8 +142,8 @@ inline bool operator!=(const Selection& a, const Selection& b)
 
 #ifndef NDEBUG
 // Outside the WebCore namespace for ease of invocation from gdb.
-void showTree(const WebCore::Selection&);
-void showTree(const WebCore::Selection*);
+void showTree(const WebCore::VisibleSelection&);
+void showTree(const WebCore::VisibleSelection*);
 #endif
 
-#endif // Selection_h
+#endif // VisibleSelection_h
diff --git a/src/3rdparty/webkit/WebCore/platform/qt/SystemTimeQt.cpp b/src/3rdparty/webkit/WebCore/editing/android/EditorAndroid.cpp
index a9f3d98..8e00326 100644
--- a/src/3rdparty/webkit/WebCore/platform/qt/SystemTimeQt.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/android/EditorAndroid.cpp
@@ -1,7 +1,6 @@
 /*
- * Copyright (C) 2006 Dirk Mueller <mueller@kde.org>
- *
- * All rights reserved.
+ * Copyright 2009, The Android Open Source Project
+ * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -22,25 +21,19 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
 #include "config.h"
-#include "SystemTime.h"
+#include "Editor.h"
 
-#include <sys/time.h>
+#include "ClipboardAndroid.h"
 
 namespace WebCore {
 
-double currentTime()
+PassRefPtr<Clipboard> Editor::newGeneralClipboard(ClipboardAccessPolicy policy)
 {
-    struct timeval tv;
-    struct timezone tz;
-
-    gettimeofday(&tv, &tz);
-    return (double)tv.tv_sec + (double)(tv.tv_usec / 1000000.0);
-}
-
+    return new ClipboardAndroid(policy, false);
 }
 
-// vim: ts=4 sw=4 et
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/editing/chromium/EditorChromium.cpp b/src/3rdparty/webkit/WebCore/editing/chromium/EditorChromium.cpp
new file mode 100644
index 0000000..1ea085b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/editing/chromium/EditorChromium.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Editor.h"
+
+#include "ChromiumDataObject.h"
+#include "ClipboardChromium.h"
+
+namespace WebCore {
+
+PassRefPtr<Clipboard> Editor::newGeneralClipboard(ClipboardAccessPolicy policy)
+{
+    return ClipboardChromium::create(false, ChromiumDataObject::create(), policy);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/editing/gtk/SelectionControllerGtk.cpp b/src/3rdparty/webkit/WebCore/editing/gtk/SelectionControllerGtk.cpp
new file mode 100644
index 0000000..c21c45a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/editing/gtk/SelectionControllerGtk.cpp
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2009 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+ 
+#include "config.h"
+#include "SelectionController.h"
+
+#include "AXObjectCache.h"
+#include "Frame.h"
+
+#include <gtk/gtk.h>
+
+namespace WebCore {
+
+void SelectionController::notifyAccessibilityForSelectionChange()
+{
+    if (AXObjectCache::accessibilityEnabled() && m_sel.start().isNotNull() && m_sel.end().isNotNull()) {
+        RenderObject* focusedNode = m_sel.start().node()->renderer();
+        AccessibilityObject* accessibilityObject = m_frame->document()->axObjectCache()->getOrCreate(focusedNode);
+        AtkObject* wrapper = accessibilityObject->wrapper();
+        if (ATK_IS_TEXT(wrapper)) {
+            g_signal_emit_by_name(wrapper, "text-caret-moved", m_sel.start().computeOffsetInContainerNode());
+
+            if (m_sel.isRange())
+                g_signal_emit_by_name(wrapper, "text-selection-changed");
+        }
+    }
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp b/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp
index ab2e397..c0bf009 100644
--- a/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/htmlediting.cpp
@@ -39,9 +39,8 @@
 #include "HTMLUListElement.h"
 #include "PositionIterator.h"
 #include "RenderObject.h"
-#include "RegularExpression.h"
 #include "Range.h"
-#include "Selection.h"
+#include "VisibleSelection.h"
 #include "Text.h"
 #include "TextIterator.h"
 #include "VisiblePosition.h"
@@ -85,6 +84,7 @@ bool canHaveChildrenForEditing(const Node* node)
            !node->hasTagName(embedTag) &&
            !node->hasTagName(appletTag) &&
            !node->hasTagName(selectTag) &&
+           !node->hasTagName(datagridTag) &&
 #if ENABLE(WML)
            !node->hasTagName(WMLNames::doTag) &&
 #endif
@@ -99,8 +99,8 @@ int comparePositions(const Position& a, const Position& b)
     ASSERT(nodeA);
     Node* nodeB = b.node();
     ASSERT(nodeB);
-    int offsetA = a.offset();
-    int offsetB = b.offset();
+    int offsetA = a.deprecatedEditingOffset();
+    int offsetB = b.deprecatedEditingOffset();
 
     Node* shadowAncestorA = nodeA->shadowAncestorNode();
     if (shadowAncestorA == nodeA)
@@ -127,6 +127,11 @@ int comparePositions(const Position& a, const Position& b)
     return result ? result : bias;
 }
 
+int comparePositions(const VisiblePosition& a, const VisiblePosition& b)
+{
+    return comparePositions(a.deepEquivalent(), b.deepEquivalent());
+}
+
 Node* highestEditableRoot(const Position& position)
 {
     Node* node = position.node();
@@ -222,8 +227,8 @@ Position nextVisuallyDistinctCandidate(const Position& position)
 {
     Position p = position;
     Position downstreamStart = p.downstream();
-    while (!p.atEnd()) {
-        p = p.next(UsingComposedCharacters);
+    while (!p.atEndOfTree()) {
+        p = p.next(Character);
         if (p.isCandidate() && p.downstream() != downstreamStart)
             return p;
     }
@@ -245,8 +250,8 @@ Position previousVisuallyDistinctCandidate(const Position& position)
 {
     Position p = position;
     Position downstreamStart = p.downstream();
-    while (!p.atStart()) {
-        p = p.previous(UsingComposedCharacters);
+    while (!p.atStartOfTree()) {
+        p = p.previous(Character);
         if (p.isCandidate() && p.downstream() != downstreamStart)
             return p;
     }
@@ -256,14 +261,14 @@ Position previousVisuallyDistinctCandidate(const Position& position)
 VisiblePosition firstEditablePositionAfterPositionInRoot(const Position& position, Node* highestRoot)
 {
     // position falls before highestRoot.
-    if (comparePositions(position, Position(highestRoot, 0)) == -1 && highestRoot->isContentEditable())
-        return VisiblePosition(Position(highestRoot, 0));
-        
+    if (comparePositions(position, firstDeepEditingPositionForNode(highestRoot)) == -1 && highestRoot->isContentEditable())
+        return firstDeepEditingPositionForNode(highestRoot);
+
     Position p = position;
     
     if (Node* shadowAncestor = p.node()->shadowAncestorNode())
         if (shadowAncestor != p.node())
-            p = Position(shadowAncestor, maxDeepOffset(shadowAncestor));
+            p = lastDeepEditingPositionForNode(shadowAncestor);
     
     while (p.node() && !isEditablePosition(p) && p.node()->isDescendantOf(highestRoot))
         p = isAtomicNode(p.node()) ? positionAfterNode(p.node()) : nextVisuallyDistinctCandidate(p);
@@ -277,14 +282,14 @@ VisiblePosition firstEditablePositionAfterPositionInRoot(const Position& positio
 VisiblePosition lastEditablePositionBeforePositionInRoot(const Position& position, Node* highestRoot)
 {
     // When position falls after highestRoot, the result is easy to compute.
-    if (comparePositions(position, Position(highestRoot, maxDeepOffset(highestRoot))) == 1)
-        return VisiblePosition(Position(highestRoot, maxDeepOffset(highestRoot)));
-        
+    if (comparePositions(position, lastDeepEditingPositionForNode(highestRoot)) == 1)
+        return lastDeepEditingPositionForNode(highestRoot);
+
     Position p = position;
     
     if (Node* shadowAncestor = p.node()->shadowAncestorNode())
         if (shadowAncestor != p.node())
-            p = Position(shadowAncestor, 0);
+            p = firstDeepEditingPositionForNode(shadowAncestor);
     
     while (p.node() && !isEditablePosition(p) && p.node()->isDescendantOf(highestRoot))
         p = isAtomicNode(p.node()) ? positionBeforeNode(p.node()) : previousVisuallyDistinctCandidate(p);
@@ -295,6 +300,7 @@ VisiblePosition lastEditablePositionBeforePositionInRoot(const Position& positio
     return VisiblePosition(p);
 }
 
+// FIXME: The method name, comment, and code say three different things here!
 // Whether or not content before and after this node will collapse onto the same line as it.
 bool isBlock(const Node* node)
 {
@@ -310,39 +316,44 @@ Node* enclosingBlock(Node* node)
     return static_cast<Element*>(enclosingNodeOfType(Position(node, 0), isBlock));
 }
 
+// Internally editing uses "invalid" positions for historical reasons.  For
+// example, in <div><img /></div>, Editing might use (img, 1) for the position
+// after <img>, but we have to convert that to (div, 1) before handing the
+// position to a Range object.  Ideally all internal positions should
+// be "range compliant" for simplicity.
 Position rangeCompliantEquivalent(const Position& pos)
 {
     if (pos.isNull())
         return Position();
 
-    Node *node = pos.node();
-    
-    if (pos.offset() <= 0) {
+    Node* node = pos.node();
+
+    if (pos.deprecatedEditingOffset() <= 0) {
         if (node->parentNode() && (editingIgnoresContent(node) || isTableElement(node)))
             return positionBeforeNode(node);
         return Position(node, 0);
     }
-    
+
     if (node->offsetInCharacters())
-        return Position(node, min(node->maxCharacterOffset(), pos.offset()));
-    
+        return Position(node, min(node->maxCharacterOffset(), pos.deprecatedEditingOffset()));
+
     int maxCompliantOffset = node->childNodeCount();
-    if (pos.offset() > maxCompliantOffset) {
+    if (pos.deprecatedEditingOffset() > maxCompliantOffset) {
         if (node->parentNode())
             return positionAfterNode(node);
-        
+
         // there is no other option at this point than to
         // use the highest allowed position in the node
         return Position(node, maxCompliantOffset);
     } 
 
     // Editing should never generate positions like this.
-    if ((pos.offset() < maxCompliantOffset) && editingIgnoresContent(node)) {
+    if ((pos.deprecatedEditingOffset() < maxCompliantOffset) && editingIgnoresContent(node)) {
         ASSERT_NOT_REACHED();
         return node->parentNode() ? positionBeforeNode(node) : Position(node, 0);
     }
     
-    if (pos.offset() == maxCompliantOffset && (editingIgnoresContent(node) || isTableElement(node)))
+    if (pos.deprecatedEditingOffset() == maxCompliantOffset && (editingIgnoresContent(node) || isTableElement(node)))
         return positionAfterNode(node);
     
     return Position(pos);
@@ -357,7 +368,7 @@ Position rangeCompliantEquivalent(const VisiblePosition& vpos)
 // in a node.  It returns 1 for some elements even though they do not have children, which
 // creates technically invalid DOM Positions.  Be sure to call rangeCompliantEquivalent
 // on a Position before using it to create a DOM Range, or an exception will be thrown.
-int maxDeepOffset(const Node *node)
+int lastOffsetForEditing(const Node* node)
 {
     ASSERT(node);
     if (!node)
@@ -537,7 +548,7 @@ Position positionOutsideContainingSpecialElement(const Position &pos, Node **con
 Node* isFirstPositionAfterTable(const VisiblePosition& visiblePosition)
 {
     Position upstream(visiblePosition.deepEquivalent().upstream());
-    if (upstream.node() && upstream.node()->renderer() && upstream.node()->renderer()->isTable() && upstream.offset() == maxDeepOffset(upstream.node()))
+    if (upstream.node() && upstream.node()->renderer() && upstream.node()->renderer()->isTable() && upstream.atLastEditingPositionForNode())
         return upstream.node();
     
     return 0;
@@ -546,19 +557,21 @@ Node* isFirstPositionAfterTable(const VisiblePosition& visiblePosition)
 Node* isLastPositionBeforeTable(const VisiblePosition& visiblePosition)
 {
     Position downstream(visiblePosition.deepEquivalent().downstream());
-    if (downstream.node() && downstream.node()->renderer() && downstream.node()->renderer()->isTable() && downstream.offset() == 0)
+    if (downstream.node() && downstream.node()->renderer() && downstream.node()->renderer()->isTable() && downstream.atFirstEditingPositionForNode())
         return downstream.node();
     
     return 0;
 }
 
-Position positionBeforeNode(const Node *node)
+Position positionBeforeNode(const Node* node)
 {
+    // FIXME: This should ASSERT(node->parentNode())
     return Position(node->parentNode(), node->nodeIndex());
 }
 
-Position positionAfterNode(const Node *node)
+Position positionAfterNode(const Node* node)
 {
+    // FIXME: This should ASSERT(node->parentNode())
     return Position(node->parentNode(), node->nodeIndex() + 1);
 }
 
@@ -652,7 +665,7 @@ HTMLElement* enclosingList(Node* node)
     return 0;
 }
 
-Node* enclosingListChild(Node *node)
+HTMLElement* enclosingListChild(Node *node)
 {
     if (!node)
         return 0;
@@ -663,7 +676,7 @@ Node* enclosingListChild(Node *node)
     // FIXME: This function is inappropriately named if it starts with node instead of node->parentNode()
     for (Node* n = node; n && n->parentNode(); n = n->parentNode()) {
         if (n->hasTagName(liTag) || isListElement(n->parentNode()))
-            return n;
+            return static_cast<HTMLElement*>(n);
         if (n == root || isTableCell(n))
             return 0;
     }
@@ -695,16 +708,17 @@ static Node* appendedSublist(Node* listItem)
     return 0;
 }
 
+// FIXME: This method should not need to call isStartOfParagraph/isEndOfParagraph
 Node* enclosingEmptyListItem(const VisiblePosition& visiblePos)
 {
     // Check that position is on a line by itself inside a list item
     Node* listChildNode = enclosingListChild(visiblePos.deepEquivalent().node());
     if (!listChildNode || !isStartOfParagraph(visiblePos) || !isEndOfParagraph(visiblePos))
         return 0;
-        
-    VisiblePosition firstInListChild(Position(listChildNode, 0));
-    VisiblePosition lastInListChild(Position(listChildNode, maxDeepOffset(listChildNode)));
-    
+
+    VisiblePosition firstInListChild(firstDeepEditingPositionForNode(listChildNode));
+    VisiblePosition lastInListChild(lastDeepEditingPositionForNode(listChildNode));
+
     if (firstInListChild != visiblePos || lastInListChild != visiblePos)
         return 0;
     
@@ -714,15 +728,6 @@ Node* enclosingEmptyListItem(const VisiblePosition& visiblePos)
     return listChildNode;
 }
 
-Node* outermostEnclosingListChild(Node* node)
-{
-    Node* listNode = 0;
-    Node* nextNode = node;
-    while ((nextNode = enclosingListChild(nextNode)))
-        listNode = nextNode;
-    return listNode;
-}
-
 HTMLElement* outermostEnclosingList(Node* node)
 {
     HTMLElement* list = enclosingList(node);
@@ -733,6 +738,18 @@ HTMLElement* outermostEnclosingList(Node* node)
     return list;
 }
 
+bool canMergeLists(Element* firstList, Element* secondList)
+{
+    if (!firstList || !secondList)
+        return false;
+
+    return firstList->hasTagName(secondList->tagQName())// make sure the list types match (ol vs. ul)
+    && isContentEditable(firstList) && isContentEditable(secondList)// both lists are editable
+    && firstList->rootEditableElement() == secondList->rootEditableElement()// don't cross editing boundaries
+    && isVisibilyAdjacent(positionAfterNode(firstList), positionBeforeNode(secondList));
+    // Make sure there is no visible content between this li and the previous list
+}
+
 Node* highestAncestor(Node* node)
 {
     ASSERT(node);
@@ -786,9 +803,14 @@ PassRefPtr<HTMLElement> createListItemElement(Document* document)
     return new HTMLLIElement(liTag, document);
 }
 
+PassRefPtr<HTMLElement> createHTMLElement(Document* document, const QualifiedName& name)
+{
+    return HTMLElementFactory::createHTMLElement(name, document, 0, false);
+}
+
 PassRefPtr<HTMLElement> createHTMLElement(Document* document, const AtomicString& tagName)
 {
-    return HTMLElementFactory::createHTMLElement(QualifiedName(nullAtom, tagName, xhtmlNamespaceURI), document, 0, false);
+    return createHTMLElement(document, QualifiedName(nullAtom, tagName, xhtmlNamespaceURI));
 }
 
 bool isTabSpanNode(const Node *node)
@@ -819,16 +841,16 @@ Position positionBeforeTabSpan(const Position& pos)
 
 PassRefPtr<Element> createTabSpanElement(Document* document, PassRefPtr<Node> tabTextNode)
 {
-    // make the span to hold the tab
-    ExceptionCode ec = 0;
-    RefPtr<Element> spanElement = document->createElementNS(xhtmlNamespaceURI, "span", ec);
-    ASSERT(ec == 0);
+    // Make the span to hold the tab.
+    RefPtr<Element> spanElement = document->createElement(spanTag, false);
     spanElement->setAttribute(classAttr, AppleTabSpanClass);
     spanElement->setAttribute(styleAttr, "white-space:pre");
 
-    // add tab text to that span
+    // Add tab text to that span.
     if (!tabTextNode)
         tabTextNode = document->createEditingTextNode("\t");
+
+    ExceptionCode ec = 0;
     spanElement->appendChild(tabTextNode, ec);
     ASSERT(ec == 0);
 
@@ -878,7 +900,7 @@ unsigned numEnclosingMailBlockquotes(const Position& p)
 
 bool isMailBlockquote(const Node *node)
 {
-    if (!node || !node->isElementNode() && !node->hasTagName(blockquoteTag))
+    if (!node || (!node->isElementNode() && !node->hasTagName(blockquoteTag)))
         return false;
         
     return static_cast<const Element *>(node)->getAttribute("type") == "cite";
@@ -891,36 +913,44 @@ int caretMinOffset(const Node* n)
     return r ? r->caretMinOffset() : 0;
 }
 
+// If a node can contain candidates for VisiblePositions, return the offset of the last candidate, otherwise 
+// return the number of children for container nodes and the length for unrendered text nodes.
 int caretMaxOffset(const Node* n)
 {
-    RenderObject* r = n->renderer();
-    ASSERT(!n->isCharacterDataNode() || !r || r->isText()); // FIXME: This was a runtime check that seemingly couldn't fail; changed it to an assertion for now.
-    if (r)
-        return r->caretMaxOffset();
+    // For rendered text nodes, return the last position that a caret could occupy.
+    if (n->isTextNode() && n->renderer())
+        return n->renderer()->caretMaxOffset();
+    // For containers return the number of children.  For others do the same as above.
+    return lastOffsetForEditing(n);
+}
 
-    if (n->isCharacterDataNode()) {
-        const CharacterData* c = static_cast<const CharacterData*>(n);
-        return static_cast<int>(c->length());
-    }
-    return 1;
+bool lineBreakExistsAtVisiblePosition(const VisiblePosition& visiblePosition)
+{
+    return lineBreakExistsAtPosition(visiblePosition.deepEquivalent().downstream());
 }
 
-bool lineBreakExistsAtPosition(const VisiblePosition& visiblePosition)
+bool lineBreakExistsAtPosition(const Position& position)
 {
-    if (visiblePosition.isNull())
+    if (position.isNull())
         return false;
-        
-    Position downstream(visiblePosition.deepEquivalent().downstream());
-    return downstream.node()->hasTagName(brTag) ||
-           downstream.node()->isTextNode() && downstream.node()->renderer()->style()->preserveNewline() && visiblePosition.characterAfter() == '\n';
+    
+    if (position.anchorNode()->hasTagName(brTag) && position.atFirstEditingPositionForNode())
+        return true;
+    
+    if (!position.anchorNode()->isTextNode() || !position.anchorNode()->renderer()->style()->preserveNewline())
+        return false;
+    
+    Text* textNode = static_cast<Text*>(position.anchorNode());
+    unsigned offset = position.offsetInContainerNode();
+    return offset < textNode->length() && textNode->data()[offset] == '\n';
 }
 
 // Modifies selections that have an end point at the edge of a table
 // that contains the other endpoint so that they don't confuse
 // code that iterates over selected paragraphs.
-Selection selectionForParagraphIteration(const Selection& original)
+VisibleSelection selectionForParagraphIteration(const VisibleSelection& original)
 {
-    Selection newSelection(original);
+    VisibleSelection newSelection(original);
     VisiblePosition startOfSelection(newSelection.visibleStart());
     VisiblePosition endOfSelection(newSelection.visibleEnd());
     
@@ -930,7 +960,7 @@ Selection selectionForParagraphIteration(const Selection& original)
     // (a table is itself a paragraph).
     if (Node* table = isFirstPositionAfterTable(endOfSelection))
         if (startOfSelection.deepEquivalent().node()->isDescendantOf(table))
-            newSelection = Selection(startOfSelection, endOfSelection.previous(true));
+            newSelection = VisibleSelection(startOfSelection, endOfSelection.previous(true));
     
     // If the start of the selection to modify is just before a table,
     // and if the end of the selection is inside that table, then the first paragraph
@@ -938,7 +968,7 @@ Selection selectionForParagraphIteration(const Selection& original)
     // containing the table itself.
     if (Node* table = isLastPositionBeforeTable(startOfSelection))
         if (endOfSelection.deepEquivalent().node()->isDescendantOf(table))
-            newSelection = Selection(startOfSelection.next(true), endOfSelection);
+            newSelection = VisibleSelection(startOfSelection.next(true), endOfSelection);
     
     return newSelection;
 }
@@ -953,6 +983,11 @@ int indexForVisiblePosition(VisiblePosition& visiblePosition)
     return TextIterator::rangeLength(range.get(), true);
 }
 
+bool isVisibilyAdjacent(const Position& first, const Position& second)
+{
+    return VisiblePosition(first) == VisiblePosition(second.upstream());
+}
+
 PassRefPtr<Range> avoidIntersectionWithNode(const Range* range, Node* node)
 {
     if (!range)
@@ -984,12 +1019,12 @@ PassRefPtr<Range> avoidIntersectionWithNode(const Range* range, Node* node)
     return Range::create(document, startContainer, startOffset, endContainer, endOffset);
 }
 
-Selection avoidIntersectionWithNode(const Selection& selection, Node* node)
+VisibleSelection avoidIntersectionWithNode(const VisibleSelection& selection, Node* node)
 {
     if (selection.isNone())
-        return Selection(selection);
+        return VisibleSelection(selection);
         
-    Selection updatedSelection(selection);
+    VisibleSelection updatedSelection(selection);
     Node* base = selection.base().node();
     Node* extent = selection.extent().node();
     ASSERT(base);
diff --git a/src/3rdparty/webkit/WebCore/editing/htmlediting.h b/src/3rdparty/webkit/WebCore/editing/htmlediting.h
index 634bbd4..25ff847 100644
--- a/src/3rdparty/webkit/WebCore/editing/htmlediting.h
+++ b/src/3rdparty/webkit/WebCore/editing/htmlediting.h
@@ -37,13 +37,13 @@ class HTMLElement;
 class Node;
 class Position;
 class Range;
-class Selection;
 class String;
 class VisiblePosition;
+class VisibleSelection;
 
 Position rangeCompliantEquivalent(const Position&);
 Position rangeCompliantEquivalent(const VisiblePosition&);
-int maxDeepOffset(const Node*);
+int lastOffsetForEditing(const Node*);
 bool isAtomicNode(const Node*);
 bool editingIgnoresContent(const Node*);
 bool canHaveChildrenForEditing(const Node*);
@@ -51,6 +51,7 @@ Node* highestEditableRoot(const Position&);
 VisiblePosition firstEditablePositionAfterPositionInRoot(const Position&, Node*);
 VisiblePosition lastEditablePositionBeforePositionInRoot(const Position&, Node*);
 int comparePositions(const Position&, const Position&);
+int comparePositions(const VisiblePosition&, const VisiblePosition&);
 Node* lowestEditableAncestor(Node*);
 bool isContentEditable(const Node*);
 Position nextCandidate(const Position&);
@@ -72,7 +73,7 @@ Position positionBeforeNode(const Node*);
 Position positionAfterNode(const Node*);
 
 PassRefPtr<Range> avoidIntersectionWithNode(const Range*, Node*);
-Selection avoidIntersectionWithNode(const Selection&, Node*);
+VisibleSelection avoidIntersectionWithNode(const VisibleSelection&, Node*);
 
 bool isSpecialElement(const Node*);
 bool validBlockTag(const String&);
@@ -82,6 +83,7 @@ PassRefPtr<HTMLElement> createBreakElement(Document*);
 PassRefPtr<HTMLElement> createOrderedListElement(Document*);
 PassRefPtr<HTMLElement> createUnorderedListElement(Document*);
 PassRefPtr<HTMLElement> createListItemElement(Document*);
+PassRefPtr<HTMLElement> createHTMLElement(Document*, const QualifiedName&);
 PassRefPtr<HTMLElement> createHTMLElement(Document*, const AtomicString&);
 
 bool isTabSpanNode(const Node*);
@@ -121,17 +123,19 @@ Node* enclosingAnchorElement(const Position&);
 bool isListElement(Node*);
 HTMLElement* enclosingList(Node*);
 HTMLElement* outermostEnclosingList(Node*);
-Node* enclosingListChild(Node*);
+HTMLElement* enclosingListChild(Node*);
+bool canMergeLists(Element* firstList, Element* secondList);
 Node* highestAncestor(Node*);
 bool isTableElement(Node*);
 bool isTableCell(const Node*);
 
-bool lineBreakExistsAtPosition(const VisiblePosition&);
+bool lineBreakExistsAtPosition(const Position&);
+bool lineBreakExistsAtVisiblePosition(const VisiblePosition&);
 
-Selection selectionForParagraphIteration(const Selection&);
+VisibleSelection selectionForParagraphIteration(const VisibleSelection&);
 
 int indexForVisiblePosition(VisiblePosition&);
-
+bool isVisibilyAdjacent(const Position& first, const Position& second);
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/editing/markup.cpp b/src/3rdparty/webkit/WebCore/editing/markup.cpp
index 83445f7..d6fe1ce 100644
--- a/src/3rdparty/webkit/WebCore/editing/markup.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/markup.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,6 +30,7 @@
 #include "CharacterNames.h"
 #include "Comment.h"
 #include "CSSComputedStyleDeclaration.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSPrimitiveValue.h"
 #include "CSSProperty.h"
 #include "CSSPropertyNames.h"
@@ -52,7 +53,7 @@
 #include "ProcessingInstruction.h"
 #include "QualifiedName.h"
 #include "Range.h"
-#include "Selection.h"
+#include "VisibleSelection.h"
 #include "TextIterator.h"
 #include "htmlediting.h"
 #include "visible_units.h"
@@ -190,7 +191,7 @@ static void appendQuotedURLAttributeValue(Vector<UChar>& result, const String& u
 {
     UChar quoteChar = '\"';
     String strippedURLString = urlString.stripWhiteSpace();
-    if (protocolIs(strippedURLString, "javascript")) {
+    if (protocolIsJavaScript(strippedURLString)) {
         // minimal escaping for javascript urls
         if (strippedURLString.contains('"')) {
             if (strippedURLString.contains('\''))
@@ -387,7 +388,14 @@ static void appendDocumentType(Vector<UChar>& result, const DocumentType* n)
     append(result, ">");
 }
 
-static void appendStartMarkup(Vector<UChar>& result, const Node *node, const Range *range, EAnnotateForInterchange annotate, bool convertBlocksToInlines = false, HashMap<AtomicStringImpl*, AtomicStringImpl*>* namespaces = 0)
+static void removeExteriorStyles(CSSMutableStyleDeclaration* style)
+{
+    style->removeProperty(CSSPropertyFloat);
+}
+
+enum RangeFullySelectsNode { DoesFullySelectNode, DoesNotFullySelectNode };
+
+static void appendStartMarkup(Vector<UChar>& result, const Node* node, const Range* range, EAnnotateForInterchange annotate, bool convertBlocksToInlines = false, HashMap<AtomicStringImpl*, AtomicStringImpl*>* namespaces = 0, RangeFullySelectsNode rangeFullySelectsNode = DoesFullySelectNode)
 {
     bool documentIsHTML = node->document()->isHTMLDocument();
     switch (node->nodeType()) {
@@ -408,8 +416,7 @@ static void appendStartMarkup(Vector<UChar>& result, const Node *node, const Ran
             
             bool useRenderedText = !enclosingNodeWithTag(Position(const_cast<Node*>(node), 0), selectTag);
             String markup = escapeContentText(useRenderedText ? renderedText(node, range) : stringValueForRange(node, range), false);
-            if (annotate)
-                markup = convertHTMLTextToInterchangeFormat(markup, static_cast<const Text*>(node));
+            markup = convertHTMLTextToInterchangeFormat(markup, static_cast<const Text*>(node));
             append(result, markup);
             break;
         }
@@ -438,9 +445,9 @@ static void appendStartMarkup(Vector<UChar>& result, const Node *node, const Ran
         case Node::ELEMENT_NODE: {
             result.append('<');
             const Element* el = static_cast<const Element*>(node);
-            bool convert = convertBlocksToInlines & isBlock(const_cast<Node*>(node));
+            bool convert = convertBlocksToInlines && isBlock(const_cast<Node*>(node));
             append(result, el->nodeNamePreservingCase());
-            NamedAttrMap *attrs = el->attributes();
+            NamedNodeMap *attrs = el->attributes();
             unsigned length = attrs->length();
             if (!documentIsHTML && namespaces && shouldAddNamespaceElem(el))
                 appendNamespace(result, el->prefix(), el->namespaceURI(), *namespaces);
@@ -503,6 +510,10 @@ static void appendStartMarkup(Vector<UChar>& result, const Node *node, const Ran
                 }
                 if (convert)
                     style->setProperty(CSSPropertyDisplay, CSSValueInline, true);
+                // If the node is not fully selected by the range, then we don't want to keep styles that affect its relationship to the nodes around it
+                // only the ones that affect it and the nodes within it.
+                if (rangeFullySelectsNode == DoesNotFullySelectNode)
+                    removeExteriorStyles(style.get());
                 if (style->length() > 0) {
                     DEFINE_STATIC_LOCAL(const String, stylePrefix, (" style=\""));
                     append(result, stylePrefix);
@@ -537,10 +548,10 @@ static void appendStartMarkup(Vector<UChar>& result, const Node *node, const Ran
     }
 }
 
-static String getStartMarkup(const Node *node, const Range *range, EAnnotateForInterchange annotate, bool convertBlocksToInlines = false, HashMap<AtomicStringImpl*, AtomicStringImpl*>* namespaces = 0)
+static String getStartMarkup(const Node* node, const Range* range, EAnnotateForInterchange annotate, bool convertBlocksToInlines = false, HashMap<AtomicStringImpl*, AtomicStringImpl*>* namespaces = 0, RangeFullySelectsNode rangeFullySelectsNode = DoesFullySelectNode)
 {
     Vector<UChar> result;
-    appendStartMarkup(result, node, range, annotate, convertBlocksToInlines, namespaces);
+    appendStartMarkup(result, node, range, annotate, convertBlocksToInlines, namespaces, rangeFullySelectsNode);
     return String::adopt(result);
 }
 
@@ -587,26 +598,50 @@ static String getEndMarkup(const Node *node)
     return String::adopt(result);
 }
 
-static void appendMarkup(Vector<UChar>& result, Node* startNode, bool onlyIncludeChildren, Vector<Node*>* nodes, const HashMap<AtomicStringImpl*, AtomicStringImpl*>* namespaces = 0)
+class MarkupAccumulator {
+public:
+    MarkupAccumulator(Node* nodeToSkip, Vector<Node*>* nodes)
+        : m_nodeToSkip(nodeToSkip)
+        , m_nodes(nodes)
+    {
+    }
+
+    void appendMarkup(Node* startNode, EChildrenOnly, const HashMap<AtomicStringImpl*, AtomicStringImpl*>* namespaces = 0);
+
+    String takeResult() { return String::adopt(m_result); }
+
+private:
+    Vector<UChar> m_result;
+    Node* m_nodeToSkip;
+    Vector<Node*>* m_nodes;
+};
+
+// FIXME: Would be nice to do this in a non-recursive way.
+void MarkupAccumulator::appendMarkup(Node* startNode, EChildrenOnly childrenOnly, const HashMap<AtomicStringImpl*, AtomicStringImpl*>* namespaces)
 {
+    if (startNode == m_nodeToSkip)
+        return;
+
     HashMap<AtomicStringImpl*, AtomicStringImpl*> namespaceHash;
     if (namespaces)
         namespaceHash = *namespaces;
-    
-    if (!onlyIncludeChildren) {
-        if (nodes)
-            nodes->append(startNode);
-        
-        appendStartMarkup(result,startNode, 0, DoNotAnnotateForInterchange, false, &namespaceHash);
+
+    // start tag
+    if (!childrenOnly) {
+        if (m_nodes)
+            m_nodes->append(startNode);
+        appendStartMarkup(m_result, startNode, 0, DoNotAnnotateForInterchange, false, &namespaceHash);
     }
-    // print children
-    if (!(startNode->document()->isHTMLDocument() && doesHTMLForbidEndTag(startNode)))
+
+    // children
+    if (!(startNode->document()->isHTMLDocument() && doesHTMLForbidEndTag(startNode))) {
         for (Node* current = startNode->firstChild(); current; current = current->nextSibling())
-            appendMarkup(result, current, false, nodes, &namespaceHash);
-    
-    // Print my ending tag
-    if (!onlyIncludeChildren)
-        appendEndMarkup(result, startNode);
+            appendMarkup(current, IncludeNode, &namespaceHash);
+    }
+
+    // end tag
+    if (!childrenOnly)
+        appendEndMarkup(m_result, startNode);
 }
 
 static void completeURLs(Node* node, const String& baseURL)
@@ -619,7 +654,7 @@ static void completeURLs(Node* node, const String& baseURL)
     for (Node* n = node; n != end; n = n->traverseNextNode()) {
         if (n->isElementNode()) {
             Element* e = static_cast<Element*>(n);
-            NamedAttrMap* attrs = e->attributes();
+            NamedNodeMap* attrs = e->attributes();
             unsigned length = attrs->length();
             for (unsigned i = 0; i < length; i++) {
                 Attribute* attr = attrs->attributeItem(i);
@@ -677,7 +712,7 @@ static bool elementHasTextDecorationProperty(const Node* node)
     return !propertyMissingOrEqualToNone(style.get(), CSSPropertyTextDecoration);
 }
 
-String joinMarkups(const Vector<String> preMarkups, const Vector<String>& postMarkups)
+static String joinMarkups(const Vector<String>& preMarkups, const Vector<String>& postMarkups)
 {
     size_t length = 0;
 
@@ -690,7 +725,7 @@ String joinMarkups(const Vector<String> preMarkups, const Vector<String>& postMa
         length += postMarkups[i].length();
 
     Vector<UChar> result;
-    result.reserveCapacity(length);
+    result.reserveInitialCapacity(length);
 
     for (size_t i = preCount; i > 0; --i)
         append(result, preMarkups[i - 1]);
@@ -701,6 +736,33 @@ String joinMarkups(const Vector<String> preMarkups, const Vector<String>& postMa
     return String::adopt(result);
 }
 
+static bool isSpecialAncestorBlock(Node* node)
+{
+    if (!node || !isBlock(node))
+        return false;
+        
+    return node->hasTagName(listingTag) ||
+           node->hasTagName(olTag) ||
+           node->hasTagName(preTag) ||
+           node->hasTagName(tableTag) ||
+           node->hasTagName(ulTag) ||
+           node->hasTagName(xmpTag) ||
+           node->hasTagName(h1Tag) ||
+           node->hasTagName(h2Tag) ||
+           node->hasTagName(h3Tag) ||
+           node->hasTagName(h4Tag) ||
+           node->hasTagName(h5Tag);
+}
+
+static bool shouldIncludeWrapperForFullySelectedRoot(Node* fullySelectedRoot, CSSMutableStyleDeclaration* style)
+{
+    if (fullySelectedRoot->isElementNode() && static_cast<Element*>(fullySelectedRoot)->hasAttribute(backgroundAttr))
+        return true;
+        
+    return style->getPropertyCSSValue(CSSPropertyBackgroundImage) ||
+           style->getPropertyCSSValue(CSSPropertyBackgroundColor);
+}
+
 // FIXME: Shouldn't we omit style info when annotate == DoNotAnnotateForInterchange? 
 // FIXME: At least, annotation and style info should probably not be included in range.markupString()
 String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterchange annotate, bool convertBlocksToInlines)
@@ -757,14 +819,20 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
 
         markups.append(interchangeNewlineString);
         startNode = visibleStart.next().deepEquivalent().node();
+
+        if (pastEnd && Range::compareBoundaryPoints(startNode, 0, pastEnd, 0) >= 0) {
+            if (deleteButton)
+                deleteButton->enable();
+            return interchangeNewlineString;
+        }
     }
 
     Node* next;
     for (Node* n = startNode; n != pastEnd; n = next) {
-    
-        // According to <rdar://problem/5730668>, it is possible for n to blow past pastEnd and become null here.  This 
-        // shouldn't be possible.  This null check will prevent crashes (but create too much markup) and the ASSERT will 
-        // hopefully lead us to understanding the problem.
+        // According to <rdar://problem/5730668>, it is possible for n to blow
+        // past pastEnd and become null here. This shouldn't be possible.
+        // This null check will prevent crashes (but create too much markup)
+        // and the ASSERT will hopefully lead us to understanding the problem.
         ASSERT(n);
         if (!n)
             break;
@@ -837,7 +905,7 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
             // We added markup for this node, and we're descending into it.  Set it to close eventually.
             ancestorsToClose.append(n);
     }
-    
+
     // Include ancestors that aren't completely inside the range but are required to retain 
     // the structure and appearance of the copied markup.
     Node* specialCommonAncestor = 0;
@@ -849,12 +917,7 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
                 table = table->parentNode();
             if (table)
                 specialCommonAncestor = table;
-        } else if (commonAncestorBlock->hasTagName(listingTag)
-                    || commonAncestorBlock->hasTagName(olTag)
-                    || commonAncestorBlock->hasTagName(preTag)
-                    || commonAncestorBlock->hasTagName(tableTag)
-                    || commonAncestorBlock->hasTagName(ulTag)
-                    || commonAncestorBlock->hasTagName(xmpTag))
+        } else if (isSpecialAncestorBlock(commonAncestorBlock))
             specialCommonAncestor = commonAncestorBlock;
     }
                                       
@@ -885,29 +948,29 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
         specialCommonAncestor = enclosingAnchor;
     
     Node* body = enclosingNodeWithTag(Position(commonAncestor, 0), bodyTag);
-    // FIXME: Only include markup for a fully selected root (and ancestors of lastClosed up to that root) if
-    // there are styles/attributes on those nodes that need to be included to preserve the appearance of the copied markup.
     // FIXME: Do this for all fully selected blocks, not just the body.
-    Node* fullySelectedRoot = body && *Selection::selectionFromContentsOfNode(body).toRange() == *updatedRange ? body : 0;
-    if (annotate && fullySelectedRoot)
-        specialCommonAncestor = fullySelectedRoot;
+    Node* fullySelectedRoot = body && *VisibleSelection::selectionFromContentsOfNode(body).toNormalizedRange() == *updatedRange ? body : 0;
+    RefPtr<CSSMutableStyleDeclaration> fullySelectedRootStyle = fullySelectedRoot ? styleFromMatchedRulesAndInlineDecl(fullySelectedRoot) : 0;
+    if (annotate && fullySelectedRoot) {
+        if (shouldIncludeWrapperForFullySelectedRoot(fullySelectedRoot, fullySelectedRootStyle.get()))
+            specialCommonAncestor = fullySelectedRoot;
+    }
         
     if (specialCommonAncestor && lastClosed) {
         // Also include all of the ancestors of lastClosed up to this special ancestor.
         for (Node* ancestor = lastClosed->parentNode(); ancestor; ancestor = ancestor->parentNode()) {
             if (ancestor == fullySelectedRoot && !convertBlocksToInlines) {
-                RefPtr<CSSMutableStyleDeclaration> style = styleFromMatchedRulesAndInlineDecl(fullySelectedRoot);
                 
                 // Bring the background attribute over, but not as an attribute because a background attribute on a div
                 // appears to have no effect.
-                if (!style->getPropertyCSSValue(CSSPropertyBackgroundImage) && static_cast<Element*>(fullySelectedRoot)->hasAttribute(backgroundAttr))
-                    style->setProperty(CSSPropertyBackgroundImage, "url('" + static_cast<Element*>(fullySelectedRoot)->getAttribute(backgroundAttr) + "')");
+                if (!fullySelectedRootStyle->getPropertyCSSValue(CSSPropertyBackgroundImage) && static_cast<Element*>(fullySelectedRoot)->hasAttribute(backgroundAttr))
+                    fullySelectedRootStyle->setProperty(CSSPropertyBackgroundImage, "url('" + static_cast<Element*>(fullySelectedRoot)->getAttribute(backgroundAttr) + "')");
                 
-                if (style->length()) {
+                if (fullySelectedRootStyle->length()) {
                     Vector<UChar> openTag;
                     DEFINE_STATIC_LOCAL(const String, divStyle, ("<div style=\""));
                     append(openTag, divStyle);
-                    appendAttributeValue(openTag, style->cssText(), documentIsHTML);
+                    appendAttributeValue(openTag, fullySelectedRootStyle->cssText(), documentIsHTML);
                     openTag.append('\"');
                     openTag.append('>');
                     preMarkups.append(String::adopt(openTag));
@@ -916,7 +979,9 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
                     markups.append(divCloseTag);
                 }
             } else {
-                preMarkups.append(getStartMarkup(ancestor, updatedRange.get(), annotate, convertBlocksToInlines));
+                // Since this node and all the other ancestors are not in the selection we want to set RangeFullySelectsNode to DoesNotFullySelectNode
+                // so that styles that affect the exterior of the node are not included.
+                preMarkups.append(getStartMarkup(ancestor, updatedRange.get(), annotate, convertBlocksToInlines, 0, DoesNotFullySelectNode));
                 markups.append(getEndMarkup(ancestor));
             }
             if (nodes)
@@ -1004,30 +1069,21 @@ PassRefPtr<DocumentFragment> createFragmentFromMarkup(Document* document, const
     return fragment.release();
 }
 
-String createMarkup(const Node* node, EChildrenOnly includeChildren, Vector<Node*>* nodes)
+String createMarkup(const Node* node, EChildrenOnly childrenOnly, Vector<Node*>* nodes)
 {
-    Vector<UChar> result;
-
     if (!node)
         return "";
 
-    Document* document = node->document();
-    Frame* frame = document->frame();
-    DeleteButtonController* deleteButton = frame ? frame->editor()->deleteButtonController() : 0;
-
-    // disable the delete button so it's elements are not serialized into the markup
-    if (deleteButton) {
-        if (node->isDescendantOf(deleteButton->containerElement()))
+    HTMLElement* deleteButtonContainerElement = 0;
+    if (Frame* frame = node->document()->frame()) {
+        deleteButtonContainerElement = frame->editor()->deleteButtonController()->containerElement();
+        if (node->isDescendantOf(deleteButtonContainerElement))
             return "";
-        deleteButton->disable();
     }
 
-    appendMarkup(result, const_cast<Node*>(node), includeChildren, nodes);
-
-    if (deleteButton)
-        deleteButton->enable();
-
-    return String::adopt(result);
+    MarkupAccumulator accumulator(deleteButtonContainerElement, nodes);
+    accumulator.appendMarkup(const_cast<Node*>(node), childrenOnly);
+    return accumulator.takeResult();
 }
 
 static void fillContainerFromString(ContainerNode* paragraph, const String& string)
@@ -1140,7 +1196,7 @@ PassRefPtr<DocumentFragment> createFragmentFromText(Range* context, const String
             element->setAttribute(classAttr, AppleInterchangeNewline);            
         } else {
             if (useClonesOfEnclosingBlock)
-                element = block->cloneElement();
+                element = block->cloneElementWithoutChildren();
             else
                 element = createDefaultParagraphElement(document);
             fillContainerFromString(element.get(), s);
diff --git a/src/3rdparty/webkit/WebCore/editing/qt/EditorQt.cpp b/src/3rdparty/webkit/WebCore/editing/qt/EditorQt.cpp
index 89ee78e..e74e2f3 100644
--- a/src/3rdparty/webkit/WebCore/editing/qt/EditorQt.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/qt/EditorQt.cpp
@@ -31,7 +31,7 @@
 #include "ClipboardQt.h"
 #include "Document.h"
 #include "Element.h"
-#include "Selection.h"
+#include "VisibleSelection.h"
 #include "SelectionController.h"
 #include "TextIterator.h"
 #include "htmlediting.h"
diff --git a/src/3rdparty/webkit/WebCore/editing/visible_units.cpp b/src/3rdparty/webkit/WebCore/editing/visible_units.cpp
index 2e151b9..02e9fb8 100644
--- a/src/3rdparty/webkit/WebCore/editing/visible_units.cpp
+++ b/src/3rdparty/webkit/WebCore/editing/visible_units.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,13 +34,44 @@
 #include "TextBoundaries.h"
 #include "TextBreakIterator.h"
 #include "TextIterator.h"
+#include "VisiblePosition.h"
 #include "htmlediting.h"
+#include <wtf/unicode/Unicode.h>
 
 namespace WebCore {
 
 using namespace HTMLNames;
+using namespace WTF::Unicode;
 
-static VisiblePosition previousBoundary(const VisiblePosition &c, unsigned (*searchFunction)(const UChar *, unsigned))
+static int endOfFirstWordBoundaryContext(const UChar* characters, int length)
+{
+    for (int i = 0; i < length; ) {
+        int first = i;
+        UChar32 ch;
+        U16_NEXT(characters, i, length, ch);
+        if (!requiresContextForWordBoundary(ch))
+            return first;
+    }
+    return length;
+}
+
+static int startOfLastWordBoundaryContext(const UChar* characters, int length)
+{
+    for (int i = length; i > 0; ) {
+        int last = i;
+        UChar32 ch;
+        U16_PREV(characters, 0, i, ch);
+        if (!requiresContextForWordBoundary(ch))
+            return last;
+    }
+    return 0;
+}
+
+enum BoundarySearchContextAvailability { DontHaveMoreContext, MayHaveMoreContext };
+
+typedef unsigned (*BoundarySearchFunction)(const UChar*, unsigned length, unsigned offset, BoundarySearchContextAvailability, bool& needMoreContext);
+
+static VisiblePosition previousBoundary(const VisiblePosition& c, BoundarySearchFunction searchFunction)
 {
     Position pos = c.deepEquivalent();
     Node *n = pos.node();
@@ -61,18 +92,38 @@ static VisiblePosition previousBoundary(const VisiblePosition &c, unsigned (*sea
     Position end = rangeCompliantEquivalent(pos);
     RefPtr<Range> searchRange = Range::create(d);
     
-    int exception = 0;
-    searchRange->setStart(start.node(), start.offset(), exception);
-    searchRange->setEnd(end.node(), end.offset(), exception);
+    Vector<UChar, 1024> string;
+    unsigned suffixLength = 0;
+
+    ExceptionCode ec = 0;
+    if (requiresContextForWordBoundary(c.characterBefore())) {
+        RefPtr<Range> forwardsScanRange(d->createRange());
+        forwardsScanRange->setEndAfter(boundary, ec);
+        forwardsScanRange->setStart(end.node(), end.deprecatedEditingOffset(), ec);
+        TextIterator forwardsIterator(forwardsScanRange.get());
+        while (!forwardsIterator.atEnd()) {
+            const UChar* characters = forwardsIterator.characters();
+            int length = forwardsIterator.length();
+            int i = endOfFirstWordBoundaryContext(characters, length);
+            string.append(characters, i);
+            suffixLength += i;
+            if (i < length)
+                break;
+            forwardsIterator.advance();
+        }
+    }
+
+    searchRange->setStart(start.node(), start.deprecatedEditingOffset(), ec);
+    searchRange->setEnd(end.node(), end.deprecatedEditingOffset(), ec);
     
-    ASSERT(!exception);
-    if (exception)
+    ASSERT(!ec);
+    if (ec)
         return VisiblePosition();
-        
+
     SimplifiedBackwardsTextIterator it(searchRange.get());
-    Vector<UChar, 1024> string;
     unsigned next = 0;
     bool inTextSecurityMode = start.node() && start.node()->renderer() && start.node()->renderer()->style()->textSecurity() != TSNONE;
+    bool needMoreContext = false;
     while (!it.atEnd()) {
         // iterate to get chunks until the searchFunction returns a non-zero value.
         if (!inTextSecurityMode) 
@@ -83,36 +134,37 @@ static VisiblePosition previousBoundary(const VisiblePosition &c, unsigned (*sea
             iteratorString = iteratorString.impl()->secure('x');
             string.prepend(iteratorString.characters(), iteratorString.length());
         }
-        
-        next = searchFunction(string.data(), string.size());
+        next = searchFunction(string.data(), string.size(), string.size() - suffixLength, MayHaveMoreContext, needMoreContext);
         if (next != 0)
             break;
         it.advance();
     }
-    
+    if (needMoreContext) {
+        // The last search returned the beginning of the buffer and asked for more context,
+        // but there is no earlier text. Force a search with what's available.
+        next = searchFunction(string.data(), string.size(), string.size() - suffixLength, DontHaveMoreContext, needMoreContext);
+        ASSERT(!needMoreContext);
+    }
+
     if (it.atEnd() && next == 0) {
         pos = it.range()->startPosition();
     } else if (next != 0) {
-        Node *node = it.range()->startContainer(exception);
-        if (node->isTextNode() || (node->renderer() && node->renderer()->isBR()))
+        Node *node = it.range()->startContainer(ec);
+        if ((node->isTextNode() && static_cast<int>(next) <= node->maxCharacterOffset()) || (node->renderer() && node->renderer()->isBR() && !next))
             // The next variable contains a usable index into a text node
             pos = Position(node, next);
         else {
-            // Use the end of the found range, the start is not guaranteed to
-            // be correct.
-            Position end = it.range()->endPosition();
-            VisiblePosition boundary(end);
-            unsigned i = it.length() - next;
-            while (i--)
-                boundary = boundary.previous();
-            return boundary;
+            // Use the character iterator to translate the next value into a DOM position.
+            BackwardsCharacterIterator charIt(searchRange.get());
+            charIt.advance(string.size() - suffixLength - next);
+            pos = charIt.range()->endPosition();
         }
     }
 
     return VisiblePosition(pos, DOWNSTREAM);
 }
 
-static VisiblePosition nextBoundary(const VisiblePosition &c, unsigned (*searchFunction)(const UChar *, unsigned))
+static VisiblePosition nextBoundary(const VisiblePosition& c, BoundarySearchFunction searchFunction)
 {
     Position pos = c.deepEquivalent();
     Node *n = pos.node();
@@ -131,13 +183,33 @@ static VisiblePosition nextBoundary(const VisiblePosition &c, unsigned (*searchF
 
     RefPtr<Range> searchRange(d->createRange());
     Position start(rangeCompliantEquivalent(pos));
+
+    Vector<UChar, 1024> string;
+    unsigned prefixLength = 0;
+
     ExceptionCode ec = 0;
+    if (requiresContextForWordBoundary(c.characterAfter())) {
+        RefPtr<Range> backwardsScanRange(d->createRange());
+        backwardsScanRange->setEnd(start.node(), start.deprecatedEditingOffset(), ec);
+        SimplifiedBackwardsTextIterator backwardsIterator(backwardsScanRange.get());
+        while (!backwardsIterator.atEnd()) {
+            const UChar* characters = backwardsIterator.characters();
+            int length = backwardsIterator.length();
+            int i = startOfLastWordBoundaryContext(characters, length);
+            string.prepend(characters + i, length - i);
+            prefixLength += length - i;
+            if (i > 0)
+                break;
+            backwardsIterator.advance();
+        }
+    }
+
     searchRange->selectNodeContents(boundary, ec);
-    searchRange->setStart(start.node(), start.offset(), ec);
+    searchRange->setStart(start.node(), start.deprecatedEditingOffset(), ec);
     TextIterator it(searchRange.get(), true);
-    Vector<UChar, 1024> string;
     unsigned next = 0;
     bool inTextSecurityMode = start.node() && start.node()->renderer() && start.node()->renderer()->style()->textSecurity() != TSNONE;
+    bool needMoreContext = false;
     while (!it.atEnd()) {
         // Keep asking the iterator for chunks until the search function
         // returns an end value not equal to the length of the string passed to it.
@@ -149,25 +221,32 @@ static VisiblePosition nextBoundary(const VisiblePosition &c, unsigned (*searchF
             iteratorString = iteratorString.impl()->secure('x');
             string.append(iteratorString.characters(), iteratorString.length());
         }
-
-        next = searchFunction(string.data(), string.size());
+        next = searchFunction(string.data(), string.size(), prefixLength, MayHaveMoreContext, needMoreContext);
         if (next != string.size())
             break;
         it.advance();
     }
+    if (needMoreContext) {
+        // The last search returned the end of the buffer and asked for more context,
+        // but there is no further text. Force a search with what's available.
+        next = searchFunction(string.data(), string.size(), prefixLength, DontHaveMoreContext, needMoreContext);
+        ASSERT(!needMoreContext);
+    }
     
     if (it.atEnd() && next == string.size()) {
         pos = it.range()->startPosition();
-    } else if (next != 0) {
+    } else if (next != prefixLength) {
         // Use the character iterator to translate the next value into a DOM position.
         CharacterIterator charIt(searchRange.get(), true);
-        charIt.advance(next - 1);
+        charIt.advance(next - prefixLength - 1);
         pos = charIt.range()->endPosition();
         
-        // FIXME: workaround for collapsed range (where only start position is correct) emitted for some emitted newlines (see rdar://5192593)
-        VisiblePosition visPos = VisiblePosition(pos);
-        if (visPos == VisiblePosition(charIt.range()->startPosition()))
-            pos = visPos.next(true).deepEquivalent();
+        if (*charIt.characters() == '\n') {
+            // FIXME: workaround for collapsed range (where only start position is correct) emitted for some emitted newlines (see rdar://5192593)
+            VisiblePosition visPos = VisiblePosition(pos);
+            if (visPos == VisiblePosition(charIt.range()->startPosition()))
+                pos = visPos.next(true).deepEquivalent();
+        }
     }
 
     // generate VisiblePosition, use UPSTREAM affinity if possible
@@ -176,10 +255,16 @@ static VisiblePosition nextBoundary(const VisiblePosition &c, unsigned (*searchF
 
 // ---------
 
-static unsigned startWordBoundary(const UChar* characters, unsigned length)
+static unsigned startWordBoundary(const UChar* characters, unsigned length, unsigned offset, BoundarySearchContextAvailability mayHaveMoreContext, bool& needMoreContext)
 {
+    ASSERT(offset);
+    if (mayHaveMoreContext && !startOfLastWordBoundaryContext(characters, offset)) {
+        needMoreContext = true;
+        return 0;
+    }
+    needMoreContext = false;
     int start, end;
-    findWordBoundary(characters, length, length, &start, &end);
+    findWordBoundary(characters, length, offset - 1, &start, &end);
     return start;
 }
 
@@ -200,10 +285,16 @@ VisiblePosition startOfWord(const VisiblePosition &c, EWordSide side)
     return previousBoundary(p, startWordBoundary);
 }
 
-static unsigned endWordBoundary(const UChar* characters, unsigned length)
+static unsigned endWordBoundary(const UChar* characters, unsigned length, unsigned offset, BoundarySearchContextAvailability mayHaveMoreContext, bool& needMoreContext)
 {
+    ASSERT(offset <= length);
+    if (mayHaveMoreContext && endOfFirstWordBoundaryContext(characters + offset, length - offset) == static_cast<int>(length - offset)) {
+        needMoreContext = true;
+        return length;
+    }
+    needMoreContext = false;
     int start, end;
-    findWordBoundary(characters, length, 0, &start, &end);
+    findWordBoundary(characters, length, offset, &start, &end);
     return end;
 }
 
@@ -223,9 +314,14 @@ VisiblePosition endOfWord(const VisiblePosition &c, EWordSide side)
     return nextBoundary(p, endWordBoundary);
 }
 
-static unsigned previousWordPositionBoundary(const UChar* characters, unsigned length)
+static unsigned previousWordPositionBoundary(const UChar* characters, unsigned length, unsigned offset, BoundarySearchContextAvailability mayHaveMoreContext, bool& needMoreContext)
 {
-    return findNextWordFromIndex(characters, length, length, false);
+    if (mayHaveMoreContext && !startOfLastWordBoundaryContext(characters, offset)) {
+        needMoreContext = true;
+        return 0;
+    }
+    needMoreContext = false;
+    return findNextWordFromIndex(characters, length, offset, false);
 }
 
 VisiblePosition previousWordPosition(const VisiblePosition &c)
@@ -234,9 +330,14 @@ VisiblePosition previousWordPosition(const VisiblePosition &c)
     return c.honorEditableBoundaryAtOrAfter(prev);
 }
 
-static unsigned nextWordPositionBoundary(const UChar* characters, unsigned length)
+static unsigned nextWordPositionBoundary(const UChar* characters, unsigned length, unsigned offset, BoundarySearchContextAvailability mayHaveMoreContext, bool& needMoreContext)
 {
-    return findNextWordFromIndex(characters, length, 0, true);
+    if (mayHaveMoreContext && endOfFirstWordBoundaryContext(characters + offset, length - offset) == static_cast<int>(length - offset)) {
+        needMoreContext = true;
+        return length;
+    }
+    needMoreContext = false;
+    return findNextWordFromIndex(characters, length, offset, true);
 }
 
 VisiblePosition nextWordPosition(const VisiblePosition &c)
@@ -285,7 +386,7 @@ static VisiblePosition startPositionForLine(const VisiblePosition& c)
         // There are VisiblePositions at offset 0 in blocks without
         // RootInlineBoxes, like empty editable blocks and bordered blocks.
         Position p = c.deepEquivalent();
-        if (p.node()->renderer() && p.node()->renderer()->isRenderBlock() && p.offset() == 0)
+        if (p.node()->renderer() && p.node()->renderer()->isRenderBlock() && p.deprecatedEditingOffset() == 0)
             return positionAvoidingFirstPositionInTable(c);
         
         return VisiblePosition();
@@ -300,11 +401,11 @@ static VisiblePosition startPositionForLine(const VisiblePosition& c)
         if (!startBox)
             return VisiblePosition();
 
-        RenderObject *startRenderer = startBox->object();
+        RenderObject *startRenderer = startBox->renderer();
         if (!startRenderer)
             return VisiblePosition();
 
-        startNode = startRenderer->element();
+        startNode = startRenderer->node();
         if (startNode)
             break;
         
@@ -314,7 +415,7 @@ static VisiblePosition startPositionForLine(const VisiblePosition& c)
     int startOffset = 0;
     if (startBox->isInlineTextBox()) {
         InlineTextBox *startTextBox = static_cast<InlineTextBox *>(startBox);
-        startOffset = startTextBox->m_start;
+        startOffset = startTextBox->start();
     }
   
     VisiblePosition visPos = VisiblePosition(startNode, startOffset, DOWNSTREAM);
@@ -332,7 +433,7 @@ VisiblePosition startOfLine(const VisiblePosition& c)
         // greater than the input position.  This fix is to account for the discrepancy between lines with webkit-line-break:after-white-space 
         // style versus lines without that style, which would break before a space by default. 
         Position p = visPos.deepEquivalent();
-        if (p.offset() > c.deepEquivalent().offset() && p.node()->isSameNode(c.deepEquivalent().node())) {
+        if (p.deprecatedEditingOffset() > c.deepEquivalent().deprecatedEditingOffset() && p.node()->isSameNode(c.deepEquivalent().node())) {
             visPos = c.previous();
             if (visPos.isNull())
                 return VisiblePosition();
@@ -353,7 +454,7 @@ static VisiblePosition endPositionForLine(const VisiblePosition& c)
         // There are VisiblePositions at offset 0 in blocks without
         // RootInlineBoxes, like empty editable blocks and bordered blocks.
         Position p = c.deepEquivalent();
-        if (p.node()->renderer() && p.node()->renderer()->isRenderBlock() && p.offset() == 0)
+        if (p.node()->renderer() && p.node()->renderer()->isRenderBlock() && p.deprecatedEditingOffset() == 0)
             return c;
         return VisiblePosition();
     }
@@ -367,11 +468,11 @@ static VisiblePosition endPositionForLine(const VisiblePosition& c)
         if (!endBox)
             return VisiblePosition();
 
-        RenderObject *endRenderer = endBox->object();
+        RenderObject *endRenderer = endBox->renderer();
         if (!endRenderer)
             return VisiblePosition();
 
-        endNode = endRenderer->element();
+        endNode = endRenderer->node();
         if (endNode)
             break;
         
@@ -383,9 +484,9 @@ static VisiblePosition endPositionForLine(const VisiblePosition& c)
         endOffset = 0;
     } else if (endBox->isInlineTextBox()) {
         InlineTextBox *endTextBox = static_cast<InlineTextBox *>(endBox);
-        endOffset = endTextBox->m_start;
+        endOffset = endTextBox->start();
         if (!endTextBox->isLineBreak())
-            endOffset += endTextBox->m_len;
+            endOffset += endTextBox->len();
     }
     
     return VisiblePosition(endNode, endOffset, VP_UPSTREAM_IF_POSSIBLE);
@@ -438,6 +539,15 @@ static Node* previousLeafWithSameEditability(Node* node)
     return 0;
 }
 
+static Node* enclosingNodeWithNonInlineRenderer(Node* n)
+{
+    for (Node* p = n; p; p = p->parentNode()) {
+        if (p->renderer() && !p->renderer()->isInline())
+            return p;
+    }
+    return 0;
+}
+
 VisiblePosition previousLinePosition(const VisiblePosition &visiblePosition, int x)
 {
     Position p = visiblePosition.deepEquivalent();
@@ -467,9 +577,9 @@ VisiblePosition previousLinePosition(const VisiblePosition &visiblePosition, int
         // This containing editable block does not have a previous line.
         // Need to move back to previous containing editable block in this root editable
         // block and find the last root line box in that block.
-        Node* startBlock = enclosingBlock(node);
+        Node* startBlock = enclosingNodeWithNonInlineRenderer(node);
         Node* n = previousLeafWithSameEditability(node);
-        while (n && startBlock == enclosingBlock(n))
+        while (n && startBlock == enclosingNodeWithNonInlineRenderer(n))
             n = previousLeafWithSameEditability(n);
         while (n) {
             if (highestEditableRoot(Position(n, 0)) != highestRoot)
@@ -494,20 +604,20 @@ VisiblePosition previousLinePosition(const VisiblePosition &visiblePosition, int
     
     if (root) {
         // FIXME: Can be wrong for multi-column layout and with transforms.
-        FloatPoint absPos = containingBlock->localToAbsoluteForContent(FloatPoint());
+        FloatPoint absPos = containingBlock->localToAbsolute(FloatPoint());
         if (containingBlock->hasOverflowClip())
             absPos -= containingBlock->layer()->scrolledContentOffset();
-        RenderObject *renderer = root->closestLeafChildForXPos(x - absPos.x(), isEditablePosition(p))->object();
+        RenderObject* renderer = root->closestLeafChildForXPos(x - absPos.x(), isEditablePosition(p))->renderer();
         Node* node = renderer->node();
-        if (editingIgnoresContent(node))
+        if (node && editingIgnoresContent(node))
             return Position(node->parent(), node->nodeIndex());
-        return renderer->positionForCoordinates(x - absPos.x(), root->topOverflow());
+        return renderer->positionForPoint(IntPoint(x - absPos.x(), root->topOverflow()));
     }
     
     // Could not find a previous line. This means we must already be on the first line.
     // Move to the start of the content in this block, which effectively moves us
     // to the start of the line we're on.
-    Node* rootElement = node->isContentEditable() ? node->rootEditableElement() : node->document()->documentElement();
+    Element* rootElement = node->isContentEditable() ? node->rootEditableElement() : node->document()->documentElement();
     return VisiblePosition(rootElement, 0, DOWNSTREAM);
 }
 
@@ -569,9 +679,9 @@ VisiblePosition nextLinePosition(const VisiblePosition &visiblePosition, int x)
         // This containing editable block does not have a next line.
         // Need to move forward to next containing editable block in this root editable
         // block and find the first root line box in that block.
-        Node* startBlock = enclosingBlock(node);
-        Node* n = nextLeafWithSameEditability(node, p.offset());
-        while (n && startBlock == enclosingBlock(n))
+        Node* startBlock = enclosingNodeWithNonInlineRenderer(node);
+        Node* n = nextLeafWithSameEditability(node, p.deprecatedEditingOffset());
+        while (n && startBlock == enclosingNodeWithNonInlineRenderer(n))
             n = nextLeafWithSameEditability(n);
         while (n) {
             if (highestEditableRoot(Position(n, 0)) != highestRoot)
@@ -595,14 +705,14 @@ VisiblePosition nextLinePosition(const VisiblePosition &visiblePosition, int x)
     
     if (root) {
         // FIXME: Can be wrong for multi-column layout and with transforms.
-        FloatPoint absPos = containingBlock->localToAbsoluteForContent(FloatPoint());
+        FloatPoint absPos = containingBlock->localToAbsolute(FloatPoint());
         if (containingBlock->hasOverflowClip())
             absPos -= containingBlock->layer()->scrolledContentOffset();
-        RenderObject *renderer = root->closestLeafChildForXPos(x - absPos.x(), isEditablePosition(p))->object();
+        RenderObject* renderer = root->closestLeafChildForXPos(x - absPos.x(), isEditablePosition(p))->renderer();
         Node* node = renderer->node();
-        if (editingIgnoresContent(node))
+        if (node && editingIgnoresContent(node))
             return Position(node->parent(), node->nodeIndex());
-        return renderer->positionForCoordinates(x - absPos.x(), root->topOverflow());
+        return renderer->positionForPoint(IntPoint(x - absPos.x(), root->topOverflow()));
     }    
 
     // Could not find a next line. This means we must already be on the last line.
@@ -614,7 +724,7 @@ VisiblePosition nextLinePosition(const VisiblePosition &visiblePosition, int x)
 
 // ---------
 
-static unsigned startSentenceBoundary(const UChar* characters, unsigned length)
+static unsigned startSentenceBoundary(const UChar* characters, unsigned length, unsigned, BoundarySearchContextAvailability, bool&)
 {
     TextBreakIterator* iterator = sentenceBreakIterator(characters, length);
     // FIXME: The following function can return -1; we don't handle that.
@@ -626,7 +736,7 @@ VisiblePosition startOfSentence(const VisiblePosition &c)
     return previousBoundary(c, startSentenceBoundary);
 }
 
-static unsigned endSentenceBoundary(const UChar* characters, unsigned length)
+static unsigned endSentenceBoundary(const UChar* characters, unsigned length, unsigned, BoundarySearchContextAvailability, bool&)
 {
     TextBreakIterator* iterator = sentenceBreakIterator(characters, length);
     return textBreakNext(iterator);
@@ -638,7 +748,7 @@ VisiblePosition endOfSentence(const VisiblePosition &c)
     return nextBoundary(c, endSentenceBoundary);
 }
 
-static unsigned previousSentencePositionBoundary(const UChar* characters, unsigned length)
+static unsigned previousSentencePositionBoundary(const UChar* characters, unsigned length, unsigned, BoundarySearchContextAvailability, bool&)
 {
     // FIXME: This is identical to startSentenceBoundary. I'm pretty sure that's not right.
     TextBreakIterator* iterator = sentenceBreakIterator(characters, length);
@@ -652,7 +762,7 @@ VisiblePosition previousSentencePosition(const VisiblePosition &c)
     return c.honorEditableBoundaryAtOrAfter(prev);
 }
 
-static unsigned nextSentencePositionBoundary(const UChar* characters, unsigned length)
+static unsigned nextSentencePositionBoundary(const UChar* characters, unsigned length, unsigned, BoundarySearchContextAvailability, bool&)
 {
     // FIXME: This is identical to endSentenceBoundary.  This isn't right, it needs to 
     // move to the equivlant position in the following sentence.
@@ -666,8 +776,13 @@ VisiblePosition nextSentencePosition(const VisiblePosition &c)
     return c.honorEditableBoundaryAtOrBefore(next);
 }
 
+static bool renderedAsNonInlineTableOrHR(RenderObject* renderer)
+{
+    return renderer && ((renderer->isTable() && !renderer->isInline()) || renderer->isHR());
+}
+
 // FIXME: Broken for positions before/after images that aren't inline (5027702)
-VisiblePosition startOfParagraph(const VisiblePosition &c)
+VisiblePosition startOfParagraph(const VisiblePosition& c)
 {
     Position p = c.deepEquivalent();
     Node *startNode = p.node();
@@ -675,16 +790,13 @@ VisiblePosition startOfParagraph(const VisiblePosition &c)
     if (!startNode)
         return VisiblePosition();
     
-    if (startNode->renderer()
-        && ((startNode->renderer()->isTable() && !startNode->renderer()->isInline())
-            || startNode->renderer()->isHR())
-        && p.offset() == maxDeepOffset(startNode))
-        return VisiblePosition(Position(startNode, 0));
+    if (renderedAsNonInlineTableOrHR(startNode->renderer()) && p.atLastEditingPositionForNode())
+        return firstDeepEditingPositionForNode(startNode);
 
     Node* startBlock = enclosingBlock(startNode);
 
     Node *node = startNode;
-    int offset = p.offset();
+    int offset = p.deprecatedEditingOffset();
 
     Node *n = startNode;
     while (n) {
@@ -706,8 +818,8 @@ VisiblePosition startOfParagraph(const VisiblePosition &c)
             
         if (r->isText()) {
             if (style->preserveNewline()) {
-                const UChar* chars = static_cast<RenderText*>(r)->characters();
-                int i = static_cast<RenderText*>(r)->textLength();
+                const UChar* chars = toRenderText(r)->characters();
+                int i = toRenderText(r)->textLength();
                 int o = offset;
                 if (n == startNode && o < i)
                     i = max(0, o);
@@ -738,17 +850,14 @@ VisiblePosition endOfParagraph(const VisiblePosition &c)
     Position p = c.deepEquivalent();
     Node* startNode = p.node();
 
-    if (startNode->renderer()
-        && ((startNode->renderer()->isTable() && !startNode->renderer()->isInline())
-            || startNode->renderer()->isHR())
-        && p.offset() == 0)
-        return VisiblePosition(Position(startNode, maxDeepOffset(startNode)));
+    if (renderedAsNonInlineTableOrHR(startNode->renderer()) && p.atFirstEditingPositionForNode())
+        return lastDeepEditingPositionForNode(startNode);
     
     Node* startBlock = enclosingBlock(startNode);
     Node *stayInsideBlock = startBlock;
     
     Node *node = startNode;
-    int offset = p.offset();
+    int offset = p.deprecatedEditingOffset();
 
     Node *n = startNode;
     while (n) {
@@ -771,9 +880,9 @@ VisiblePosition endOfParagraph(const VisiblePosition &c)
         // FIXME: We avoid returning a position where the renderer can't accept the caret.
         // We should probably do this in other cases such as startOfParagraph.
         if (r->isText() && r->caretMaxRenderedOffset() > 0) {
-            int length = static_cast<RenderText*>(r)->textLength();
+            int length = toRenderText(r)->textLength();
             if (style->preserveNewline()) {
-                const UChar* chars = static_cast<RenderText*>(r)->characters();
+                const UChar* chars = toRenderText(r)->characters();
                 int o = n == startNode ? offset : 0;
                 for (int i = o; i < length; ++i)
                     if (chars[i] == '\n')
@@ -784,7 +893,7 @@ VisiblePosition endOfParagraph(const VisiblePosition &c)
             n = n->traverseNextNode(stayInsideBlock);
         } else if (editingIgnoresContent(n) || isTableElement(n)) {
             node = n;
-            offset = maxDeepOffset(n);
+            offset = lastOffsetForEditing(n);
             n = n->traverseNextSibling(stayInsideBlock);
         } else
             n = n->traverseNextNode(stayInsideBlock);
@@ -819,25 +928,25 @@ bool isEndOfParagraph(const VisiblePosition &pos)
     return pos.isNotNull() && pos == endOfParagraph(pos);
 }
 
-VisiblePosition previousParagraphPosition(const VisiblePosition &p, int x)
+VisiblePosition previousParagraphPosition(const VisiblePosition& p, int x)
 {
     VisiblePosition pos = p;
     do {
         VisiblePosition n = previousLinePosition(pos, x);
         if (n.isNull() || n == pos)
-            return p;
+            break;
         pos = n;
     } while (inSameParagraph(p, pos));
     return pos;
 }
 
-VisiblePosition nextParagraphPosition(const VisiblePosition &p, int x)
+VisiblePosition nextParagraphPosition(const VisiblePosition& p, int x)
 {
     VisiblePosition pos = p;
     do {
         VisiblePosition n = nextLinePosition(pos, x);
         if (n.isNull() || n == pos)
-            return p;
+            break;
         pos = n;
     } while (inSameParagraph(p, pos));
     return pos;
@@ -943,7 +1052,7 @@ VisiblePosition startOfEditableContent(const VisiblePosition& visiblePosition)
     if (!highestRoot)
         return VisiblePosition();
 
-    return VisiblePosition(highestRoot, 0, DOWNSTREAM);
+    return firstDeepEditingPositionForNode(highestRoot);
 }
 
 VisiblePosition endOfEditableContent(const VisiblePosition& visiblePosition)
@@ -952,7 +1061,181 @@ VisiblePosition endOfEditableContent(const VisiblePosition& visiblePosition)
     if (!highestRoot)
         return VisiblePosition();
 
-    return VisiblePosition(highestRoot, maxDeepOffset(highestRoot), DOWNSTREAM);
+    return lastDeepEditingPositionForNode(highestRoot);
+}
+
+static void getLeafBoxesInLogicalOrder(RootInlineBox* rootBox, Vector<InlineBox*>& leafBoxesInLogicalOrder)
+{
+    unsigned char minLevel = 128;
+    unsigned char maxLevel = 0;
+    unsigned count = 0;
+    InlineBox* r = rootBox->firstLeafChild();
+    // First find highest and lowest levels,
+    // and initialize leafBoxesInLogicalOrder with the leaf boxes in visual order.
+    while (r) {
+        if (r->bidiLevel() > maxLevel)
+            maxLevel = r->bidiLevel();
+        if (r->bidiLevel() < minLevel)
+            minLevel = r->bidiLevel();
+        leafBoxesInLogicalOrder.append(r);
+        r = r->nextLeafChild();
+        ++count;
+    }
+
+    if (rootBox->renderer()->style()->visuallyOrdered())
+        return;
+    // Reverse of reordering of the line (L2 according to Bidi spec):
+    // L2. From the highest level found in the text to the lowest odd level on each line,
+    // reverse any contiguous sequence of characters that are at that level or higher.
+
+    // Reversing the reordering of the line is only done up to the lowest odd level.
+    if (!(minLevel % 2))
+        minLevel++;
+    
+    InlineBox** end = leafBoxesInLogicalOrder.end();
+    while (minLevel <= maxLevel) {
+        InlineBox** iter = leafBoxesInLogicalOrder.begin();
+        while (iter != end) {
+            while (iter != end) {
+                if ((*iter)->bidiLevel() >= minLevel)
+                    break;
+                ++iter;
+            }
+            InlineBox** first = iter;
+            while (iter != end) {
+                if ((*iter)->bidiLevel() < minLevel)
+                    break;
+                ++iter;
+            }
+            InlineBox** last = iter;
+            std::reverse(first, last);
+        }                
+        ++minLevel;
+    }
+}
+
+static void getLogicalStartBoxAndNode(RootInlineBox* rootBox, InlineBox*& startBox, Node*& startNode)
+{
+    Vector<InlineBox*> leafBoxesInLogicalOrder;
+    getLeafBoxesInLogicalOrder(rootBox, leafBoxesInLogicalOrder);
+    startBox = 0;
+    startNode = 0;
+    for (size_t i = 0; i < leafBoxesInLogicalOrder.size(); ++i) {
+        startBox = leafBoxesInLogicalOrder[i];
+        startNode = startBox->renderer()->node();
+        if (startNode)
+            return; 
+    }
+}
+
+static void getLogicalEndBoxAndNode(RootInlineBox* rootBox, InlineBox*& endBox, Node*& endNode)
+{
+    Vector<InlineBox*> leafBoxesInLogicalOrder;
+    getLeafBoxesInLogicalOrder(rootBox, leafBoxesInLogicalOrder);
+    endBox = 0;
+    endNode = 0;
+    // Generated content (e.g. list markers and CSS :before and :after
+    // pseudoelements) have no corresponding DOM element, and so cannot be
+    // represented by a VisiblePosition.  Use whatever precedes instead.
+    for (size_t i = leafBoxesInLogicalOrder.size(); i > 0; --i) { 
+        endBox = leafBoxesInLogicalOrder[i - 1];
+        endNode = endBox->renderer()->node();
+        if (endNode)
+            return;
+    }
+}
+
+static VisiblePosition logicalStartPositionForLine(const VisiblePosition& c)
+{
+    if (c.isNull())
+        return VisiblePosition();
+
+    RootInlineBox* rootBox = rootBoxForLine(c);
+    if (!rootBox) {
+        // There are VisiblePositions at offset 0 in blocks without
+        // RootInlineBoxes, like empty editable blocks and bordered blocks.
+        Position p = c.deepEquivalent();
+        if (p.node()->renderer() && p.node()->renderer()->isRenderBlock() && !p.deprecatedEditingOffset())
+            return positionAvoidingFirstPositionInTable(c);
+        
+        return VisiblePosition();
+    }
+    
+    InlineBox* logicalStartBox;
+    Node* logicalStartNode;
+    getLogicalStartBoxAndNode(rootBox, logicalStartBox, logicalStartNode);
+
+    if (!logicalStartNode)
+        return VisiblePosition();
+
+    int startOffset = logicalStartBox->caretMinOffset();
+  
+    VisiblePosition visPos = VisiblePosition(logicalStartNode, startOffset, DOWNSTREAM);
+    return positionAvoidingFirstPositionInTable(visPos);
+}
+
+VisiblePosition logicalStartOfLine(const VisiblePosition& c)
+{
+    VisiblePosition visPos = logicalStartPositionForLine(c);
+    
+    if (visPos.isNull())
+        return c.honorEditableBoundaryAtOrAfter(visPos);
+
+    return c.honorEditableBoundaryAtOrAfter(visPos);
+}
+
+static VisiblePosition logicalEndPositionForLine(const VisiblePosition& c)
+{
+    if (c.isNull())
+        return VisiblePosition();
+
+    RootInlineBox* rootBox = rootBoxForLine(c);
+    if (!rootBox) {
+        // There are VisiblePositions at offset 0 in blocks without
+        // RootInlineBoxes, like empty editable blocks and bordered blocks.
+        Position p = c.deepEquivalent();
+        if (p.node()->renderer() && p.node()->renderer()->isRenderBlock() && !p.deprecatedEditingOffset())
+            return c;
+        return VisiblePosition();
+    }
+    
+    InlineBox* logicalEndBox;
+    Node* logicalEndNode;
+    getLogicalEndBoxAndNode(rootBox, logicalEndBox, logicalEndNode);
+    if (!logicalEndNode)
+        return VisiblePosition();
+    
+    int endOffset = 1;
+    if (logicalEndNode->hasTagName(brTag))
+        endOffset = 0;
+    else if (logicalEndBox->isInlineTextBox()) {
+        InlineTextBox* endTextBox = static_cast<InlineTextBox*>(logicalEndBox);
+        endOffset = endTextBox->start();
+        if (!endTextBox->isLineBreak())
+            endOffset += endTextBox->len();
+    }
+    
+    return VisiblePosition(logicalEndNode, endOffset, VP_UPSTREAM_IF_POSSIBLE);
+}
+
+bool inSameLogicalLine(const VisiblePosition& a, const VisiblePosition& b)
+{
+    return a.isNotNull() && logicalStartOfLine(a) == logicalStartOfLine(b);
+}
+
+VisiblePosition logicalEndOfLine(const VisiblePosition& c)
+{
+    VisiblePosition visPos = logicalEndPositionForLine(c);
+    
+    // Make sure the end of line is at the same line as the given input position. For a wrapping line, the logical end
+    // position for the not-last-2-lines might incorrectly hand back the logical beginning of the next line. 
+    // For example, <div contenteditable dir="rtl" style="line-break:before-white-space">abcdefg abcdefg abcdefg
+    // a abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg abcdefg </div>
+    // In this case, use the previous position of the computed logical end position.
+    if (!inSameLogicalLine(c, visPos))
+        visPos = visPos.previous();
+    
+    return c.honorEditableBoundaryAtOrBefore(visPos);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/editing/visible_units.h b/src/3rdparty/webkit/WebCore/editing/visible_units.h
index 2663888..a20b588 100644
--- a/src/3rdparty/webkit/WebCore/editing/visible_units.h
+++ b/src/3rdparty/webkit/WebCore/editing/visible_units.h
@@ -53,8 +53,11 @@ VisiblePosition endOfLine(const VisiblePosition &);
 VisiblePosition previousLinePosition(const VisiblePosition &, int x);
 VisiblePosition nextLinePosition(const VisiblePosition &, int x);
 bool inSameLine(const VisiblePosition &, const VisiblePosition &);
+bool inSameLogicalLine(const VisiblePosition &, const VisiblePosition &);
 bool isStartOfLine(const VisiblePosition &);
 bool isEndOfLine(const VisiblePosition &);
+VisiblePosition logicalStartOfLine(const VisiblePosition &);
+VisiblePosition logicalEndOfLine(const VisiblePosition &);
 
 // paragraphs (perhaps a misnomer, can be divided by line break elements)
 VisiblePosition startOfParagraph(const VisiblePosition&);
diff --git a/src/3rdparty/webkit/WebCore/generated/ArrayPrototype.lut.h b/src/3rdparty/webkit/WebCore/generated/ArrayPrototype.lut.h
index 9beec6b..da67f2e 100644
--- a/src/3rdparty/webkit/WebCore/generated/ArrayPrototype.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/ArrayPrototype.lut.h
@@ -4,7 +4,7 @@
 
 namespace JSC {
 
-static const struct HashTableValue arrayTableValues[20] = {
+static const struct HashTableValue arrayTableValues[22] = {
    { "toString", DontEnum|Function, (intptr_t)arrayProtoFuncToString, (intptr_t)0 },
    { "toLocaleString", DontEnum|Function, (intptr_t)arrayProtoFuncToLocaleString, (intptr_t)0 },
    { "concat", DontEnum|Function, (intptr_t)arrayProtoFuncConcat, (intptr_t)1 },
@@ -23,15 +23,12 @@ static const struct HashTableValue arrayTableValues[20] = {
    { "indexOf", DontEnum|Function, (intptr_t)arrayProtoFuncIndexOf, (intptr_t)1 },
    { "lastIndexOf", DontEnum|Function, (intptr_t)arrayProtoFuncLastIndexOf, (intptr_t)1 },
    { "filter", DontEnum|Function, (intptr_t)arrayProtoFuncFilter, (intptr_t)1 },
+   { "reduce", DontEnum|Function, (intptr_t)arrayProtoFuncReduce, (intptr_t)1 },
+   { "reduceRight", DontEnum|Function, (intptr_t)arrayProtoFuncReduceRight, (intptr_t)1 },
    { "map", DontEnum|Function, (intptr_t)arrayProtoFuncMap, (intptr_t)1 },
    { 0, 0, 0, 0 }
 };
 
 extern const struct HashTable arrayTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 127, arrayTableValues, 0 };
-#else
     { 65, 63, arrayTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp
index b980a0a..4c85bee 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.cpp
@@ -75,132 +75,134 @@
       know about them.  */
    enum yytokentype {
      TOKEN_EOF = 0,
-     UNIMPORTANT_TOK = 258,
-     WHITESPACE = 259,
-     SGML_CD = 260,
-     INCLUDES = 261,
-     DASHMATCH = 262,
-     BEGINSWITH = 263,
-     ENDSWITH = 264,
-     CONTAINS = 265,
-     STRING = 266,
-     IDENT = 267,
-     NTH = 268,
-     HEX = 269,
-     IDSEL = 270,
-     IMPORT_SYM = 271,
-     PAGE_SYM = 272,
-     MEDIA_SYM = 273,
-     FONT_FACE_SYM = 274,
-     CHARSET_SYM = 275,
-     NAMESPACE_SYM = 276,
-     WEBKIT_RULE_SYM = 277,
-     WEBKIT_DECLS_SYM = 278,
-     WEBKIT_KEYFRAME_RULE_SYM = 279,
-     WEBKIT_KEYFRAMES_SYM = 280,
-     WEBKIT_VALUE_SYM = 281,
-     WEBKIT_MEDIAQUERY_SYM = 282,
-     WEBKIT_SELECTOR_SYM = 283,
-     WEBKIT_VARIABLES_SYM = 284,
-     WEBKIT_DEFINE_SYM = 285,
-     VARIABLES_FOR = 286,
-     WEBKIT_VARIABLES_DECLS_SYM = 287,
-     ATKEYWORD = 288,
-     IMPORTANT_SYM = 289,
-     MEDIA_ONLY = 290,
-     MEDIA_NOT = 291,
-     MEDIA_AND = 292,
-     QEMS = 293,
-     EMS = 294,
-     EXS = 295,
-     PXS = 296,
-     CMS = 297,
-     MMS = 298,
-     INS = 299,
-     PTS = 300,
-     PCS = 301,
-     DEGS = 302,
-     RADS = 303,
-     GRADS = 304,
-     TURNS = 305,
-     MSECS = 306,
-     SECS = 307,
-     HERZ = 308,
-     KHERZ = 309,
-     DIMEN = 310,
-     PERCENTAGE = 311,
-     FLOATTOKEN = 312,
-     INTEGER = 313,
-     URI = 314,
-     FUNCTION = 315,
-     NOTFUNCTION = 316,
-     UNICODERANGE = 317,
-     VARCALL = 318
+     LOWEST_PREC = 258,
+     UNIMPORTANT_TOK = 259,
+     WHITESPACE = 260,
+     SGML_CD = 261,
+     INCLUDES = 262,
+     DASHMATCH = 263,
+     BEGINSWITH = 264,
+     ENDSWITH = 265,
+     CONTAINS = 266,
+     STRING = 267,
+     IDENT = 268,
+     NTH = 269,
+     HEX = 270,
+     IDSEL = 271,
+     IMPORT_SYM = 272,
+     PAGE_SYM = 273,
+     MEDIA_SYM = 274,
+     FONT_FACE_SYM = 275,
+     CHARSET_SYM = 276,
+     NAMESPACE_SYM = 277,
+     WEBKIT_RULE_SYM = 278,
+     WEBKIT_DECLS_SYM = 279,
+     WEBKIT_KEYFRAME_RULE_SYM = 280,
+     WEBKIT_KEYFRAMES_SYM = 281,
+     WEBKIT_VALUE_SYM = 282,
+     WEBKIT_MEDIAQUERY_SYM = 283,
+     WEBKIT_SELECTOR_SYM = 284,
+     WEBKIT_VARIABLES_SYM = 285,
+     WEBKIT_DEFINE_SYM = 286,
+     VARIABLES_FOR = 287,
+     WEBKIT_VARIABLES_DECLS_SYM = 288,
+     ATKEYWORD = 289,
+     IMPORTANT_SYM = 290,
+     MEDIA_ONLY = 291,
+     MEDIA_NOT = 292,
+     MEDIA_AND = 293,
+     QEMS = 294,
+     EMS = 295,
+     EXS = 296,
+     PXS = 297,
+     CMS = 298,
+     MMS = 299,
+     INS = 300,
+     PTS = 301,
+     PCS = 302,
+     DEGS = 303,
+     RADS = 304,
+     GRADS = 305,
+     TURNS = 306,
+     MSECS = 307,
+     SECS = 308,
+     HERZ = 309,
+     KHERZ = 310,
+     DIMEN = 311,
+     PERCENTAGE = 312,
+     FLOATTOKEN = 313,
+     INTEGER = 314,
+     URI = 315,
+     FUNCTION = 316,
+     NOTFUNCTION = 317,
+     UNICODERANGE = 318,
+     VARCALL = 319
    };
 #endif
 /* Tokens.  */
 #define TOKEN_EOF 0
-#define UNIMPORTANT_TOK 258
-#define WHITESPACE 259
-#define SGML_CD 260
-#define INCLUDES 261
-#define DASHMATCH 262
-#define BEGINSWITH 263
-#define ENDSWITH 264
-#define CONTAINS 265
-#define STRING 266
-#define IDENT 267
-#define NTH 268
-#define HEX 269
-#define IDSEL 270
-#define IMPORT_SYM 271
-#define PAGE_SYM 272
-#define MEDIA_SYM 273
-#define FONT_FACE_SYM 274
-#define CHARSET_SYM 275
-#define NAMESPACE_SYM 276
-#define WEBKIT_RULE_SYM 277
-#define WEBKIT_DECLS_SYM 278
-#define WEBKIT_KEYFRAME_RULE_SYM 279
-#define WEBKIT_KEYFRAMES_SYM 280
-#define WEBKIT_VALUE_SYM 281
-#define WEBKIT_MEDIAQUERY_SYM 282
-#define WEBKIT_SELECTOR_SYM 283
-#define WEBKIT_VARIABLES_SYM 284
-#define WEBKIT_DEFINE_SYM 285
-#define VARIABLES_FOR 286
-#define WEBKIT_VARIABLES_DECLS_SYM 287
-#define ATKEYWORD 288
-#define IMPORTANT_SYM 289
-#define MEDIA_ONLY 290
-#define MEDIA_NOT 291
-#define MEDIA_AND 292
-#define QEMS 293
-#define EMS 294
-#define EXS 295
-#define PXS 296
-#define CMS 297
-#define MMS 298
-#define INS 299
-#define PTS 300
-#define PCS 301
-#define DEGS 302
-#define RADS 303
-#define GRADS 304
-#define TURNS 305
-#define MSECS 306
-#define SECS 307
-#define HERZ 308
-#define KHERZ 309
-#define DIMEN 310
-#define PERCENTAGE 311
-#define FLOATTOKEN 312
-#define INTEGER 313
-#define URI 314
-#define FUNCTION 315
-#define NOTFUNCTION 316
-#define UNICODERANGE 317
-#define VARCALL 318
+#define LOWEST_PREC 258
+#define UNIMPORTANT_TOK 259
+#define WHITESPACE 260
+#define SGML_CD 261
+#define INCLUDES 262
+#define DASHMATCH 263
+#define BEGINSWITH 264
+#define ENDSWITH 265
+#define CONTAINS 266
+#define STRING 267
+#define IDENT 268
+#define NTH 269
+#define HEX 270
+#define IDSEL 271
+#define IMPORT_SYM 272
+#define PAGE_SYM 273
+#define MEDIA_SYM 274
+#define FONT_FACE_SYM 275
+#define CHARSET_SYM 276
+#define NAMESPACE_SYM 277
+#define WEBKIT_RULE_SYM 278
+#define WEBKIT_DECLS_SYM 279
+#define WEBKIT_KEYFRAME_RULE_SYM 280
+#define WEBKIT_KEYFRAMES_SYM 281
+#define WEBKIT_VALUE_SYM 282
+#define WEBKIT_MEDIAQUERY_SYM 283
+#define WEBKIT_SELECTOR_SYM 284
+#define WEBKIT_VARIABLES_SYM 285
+#define WEBKIT_DEFINE_SYM 286
+#define VARIABLES_FOR 287
+#define WEBKIT_VARIABLES_DECLS_SYM 288
+#define ATKEYWORD 289
+#define IMPORTANT_SYM 290
+#define MEDIA_ONLY 291
+#define MEDIA_NOT 292
+#define MEDIA_AND 293
+#define QEMS 294
+#define EMS 295
+#define EXS 296
+#define PXS 297
+#define CMS 298
+#define MMS 299
+#define INS 300
+#define PTS 301
+#define PCS 302
+#define DEGS 303
+#define RADS 304
+#define GRADS 305
+#define TURNS 306
+#define MSECS 307
+#define SECS 308
+#define HERZ 309
+#define KHERZ 310
+#define DIMEN 311
+#define PERCENTAGE 312
+#define FLOATTOKEN 313
+#define INTEGER 314
+#define URI 315
+#define FUNCTION 316
+#define NOTFUNCTION 317
+#define UNICODERANGE 318
+#define VARCALL 319
 
 
 
@@ -235,6 +237,7 @@
 
 #include "CSSMediaRule.h"
 #include "CSSParser.h"
+#include "CSSPrimitiveValue.h"
 #include "CSSPropertyNames.h"
 #include "CSSRuleList.h"
 #include "CSSSelector.h"
@@ -281,7 +284,7 @@ using namespace HTMLNames;
 
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-#line 57 "../css/CSSGrammar.y"
+#line 58 "../css/CSSGrammar.y"
 {
     bool boolean;
     char character;
@@ -306,7 +309,7 @@ typedef union YYSTYPE
     float val;
 }
 /* Line 187 of yacc.c.  */
-#line 310 "WebCore/tmp/../generated/CSSGrammar.tab.c"
+#line 313 "WebCore/tmp/../generated/CSSGrammar.tab.c"
 	YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
@@ -316,7 +319,7 @@ typedef union YYSTYPE
 
 
 /* Copy the second part of user declarations.  */
-#line 81 "../css/CSSGrammar.y"
+#line 82 "../css/CSSGrammar.y"
 
 
 static inline int cssyyerror(const char*)
@@ -332,7 +335,7 @@ static int cssyylex(YYSTYPE* yylval, void* parser)
 
 
 /* Line 216 of yacc.c.  */
-#line 336 "WebCore/tmp/../generated/CSSGrammar.tab.c"
+#line 339 "WebCore/tmp/../generated/CSSGrammar.tab.c"
 
 #ifdef short
 # undef short
@@ -547,10 +550,10 @@ union yyalloc
 /* YYFINAL -- State number of the termination state.  */
 #define YYFINAL  28
 /* YYLAST -- Last index in YYTABLE.  */
-#define YYLAST   1274
+#define YYLAST   1315
 
 /* YYNTOKENS -- Number of terminals.  */
-#define YYNTOKENS  84
+#define YYNTOKENS  85
 /* YYNNTS -- Number of nonterminals.  */
 #define YYNNTS  90
 /* YYNRULES -- Number of rules.  */
@@ -560,7 +563,7 @@ union yyalloc
 
 /* YYTRANSLATE(YYLEX) -- Bison symbol number corresponding to YYLEX.  */
 #define YYUNDEFTOK  2
-#define YYMAXUTOK   318
+#define YYMAXUTOK   319
 
 #define YYTRANSLATE(YYX)						\
   ((unsigned int) (YYX) <= YYMAXUTOK ? yytranslate[YYX] : YYUNDEFTOK)
@@ -571,16 +574,16 @@ static const yytype_uint8 yytranslate[] =
        0,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,     2,     2,    82,     2,    83,     2,     2,
-      72,    73,    19,    75,    74,    78,    17,    81,     2,     2,
-       2,     2,     2,     2,     2,     2,     2,     2,    16,    71,
-       2,    80,    77,     2,     2,     2,     2,     2,     2,     2,
+       2,     2,     2,     2,     2,    83,     2,    84,     2,     2,
+      73,    74,    20,    76,    75,    79,    18,    82,     2,     2,
+       2,     2,     2,     2,     2,     2,     2,     2,    17,    72,
+       2,    81,    78,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,    18,     2,    79,     2,     2,     2,     2,     2,     2,
+       2,    19,     2,    80,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
-       2,     2,     2,    69,    20,    70,    76,     2,     2,     2,
+       2,     2,     2,    70,    21,    71,    77,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
@@ -595,11 +598,11 @@ static const yytype_uint8 yytranslate[] =
        2,     2,     2,     2,     2,     2,     2,     2,     2,     2,
        2,     2,     2,     2,     2,     2,     1,     2,     3,     4,
        5,     6,     7,     8,     9,    10,    11,    12,    13,    14,
-      15,    21,    22,    23,    24,    25,    26,    27,    28,    29,
+      15,    16,    22,    23,    24,    25,    26,    27,    28,    29,
       30,    31,    32,    33,    34,    35,    36,    37,    38,    39,
       40,    41,    42,    43,    44,    45,    46,    47,    48,    49,
       50,    51,    52,    53,    54,    55,    56,    57,    58,    59,
-      60,    61,    62,    63,    64,    65,    66,    67,    68
+      60,    61,    62,    63,    64,    65,    66,    67,    68,    69
 };
 
 #if YYDEBUG
@@ -639,130 +642,130 @@ static const yytype_uint16 yyprhs[] =
 /* YYRHS -- A `-1'-separated list of the rules' RHS.  */
 static const yytype_int16 yyrhs[] =
 {
-      85,     0,    -1,    96,    95,    99,   100,   101,   102,    -1,
-      87,    94,    -1,    89,    94,    -1,    91,    94,    -1,    92,
-      94,    -1,    93,    94,    -1,    90,    94,    -1,    88,    94,
-      -1,   103,    -1,   108,    -1,    27,    69,    94,    86,    94,
-      70,    -1,    29,    69,    94,   132,    94,    70,    -1,    28,
-      69,    94,   154,    70,    -1,    37,    69,    94,   111,    70,
-      -1,    31,    69,    94,   159,    70,    -1,    32,     4,    94,
-     124,    70,    -1,    33,    69,    94,   140,    70,    -1,    -1,
-      94,     4,    -1,    -1,    95,     5,    -1,    95,     4,    -1,
-      -1,    98,    -1,    70,    -1,     0,    -1,    25,    94,    11,
-      94,    71,    -1,    25,     1,   172,    -1,    25,     1,    71,
-      -1,    -1,    99,   108,    95,    -1,   168,    -1,    -1,   100,
-     109,    95,    -1,    -1,   101,   115,    95,    -1,    -1,   102,
-     104,    95,    -1,   139,    -1,   127,    -1,   135,    -1,   136,
-      -1,   129,    -1,   103,    -1,   171,    -1,   167,    -1,   169,
-      -1,    -1,   105,   107,    95,    -1,   139,    -1,   135,    -1,
-     136,    -1,   129,    -1,   106,    -1,   171,    -1,   167,    -1,
-     169,    -1,   170,    -1,    21,    94,   117,    94,   125,    71,
-      -1,    21,    94,   117,    94,   125,   172,    -1,    21,     1,
-      71,    -1,    21,     1,   172,    -1,    34,    94,   125,    69,
-      94,   111,    70,    -1,    35,    94,   110,    69,    94,   111,
-      70,    -1,    -1,    36,     4,   126,    -1,   113,    -1,   112,
-     113,    -1,   112,    -1,     1,   173,     1,    -1,     1,    -1,
-     112,     1,    -1,   113,    71,    94,    -1,   113,   173,    71,
-      94,    -1,     1,    71,    94,    -1,     1,   173,     1,    71,
-      94,    -1,   112,   113,    71,    94,    -1,   112,     1,    71,
-      94,    -1,   112,     1,   173,     1,    71,    94,    -1,   114,
-      16,    94,   159,    -1,   114,    94,    69,    94,   154,    70,
-      94,    -1,   114,     1,    -1,   114,    16,    94,     1,   159,
-      -1,   114,    16,    94,    -1,   114,    16,    94,     1,    -1,
-      12,    94,    -1,    26,    94,   116,   117,    94,    71,    -1,
-      26,     1,   172,    -1,    26,     1,    71,    -1,    -1,    12,
-       4,    -1,    11,    -1,    64,    -1,    12,    94,    -1,    -1,
-      16,    94,   159,    94,    -1,    72,    94,   118,    94,   119,
-      73,    94,    -1,   120,    -1,   121,    94,    42,    94,   120,
-      -1,    -1,    42,    94,   121,    -1,    -1,    40,    -1,    41,
-      -1,   121,    -1,   123,    94,   128,   122,    -1,    -1,   126,
-      -1,   124,    -1,   126,    74,    94,   124,    -1,   126,     1,
-      -1,    23,    94,   126,    69,    94,   105,   166,    -1,    23,
-      94,    69,    94,   105,   166,    -1,    12,    94,    -1,    30,
-      94,   130,    94,    69,    94,   131,    70,    -1,    12,    -1,
-      11,    -1,    -1,   131,   132,    94,    -1,   133,    94,    69,
-      94,   154,    70,    -1,   134,    -1,   133,    94,    74,    94,
-     134,    -1,    61,    -1,    12,    -1,    22,     1,   172,    -1,
-      22,     1,    71,    -1,    24,    94,    69,    94,   154,    70,
-      94,    -1,    24,     1,   172,    -1,    24,     1,    71,    -1,
-      75,    94,    -1,    76,    94,    -1,    77,    94,    -1,    78,
-      -1,    75,    -1,   140,    69,    94,   154,    97,    -1,   142,
-      -1,   140,    74,    94,   142,    -1,   140,     1,    -1,   142,
-       4,    -1,   144,    -1,   141,    -1,   141,   144,    -1,   142,
-     137,   144,    -1,   142,     1,    -1,    20,    -1,    19,    20,
-      -1,    12,    20,    -1,   145,    -1,   145,   146,    -1,   146,
-      -1,   143,   145,    -1,   143,   145,   146,    -1,   143,   146,
-      -1,    12,    -1,    19,    -1,   147,    -1,   146,   147,    -1,
-     146,     1,    -1,    15,    -1,    14,    -1,   148,    -1,   150,
-      -1,   153,    -1,    17,    12,    -1,    12,    94,    -1,    18,
-      94,   149,    79,    -1,    18,    94,   149,   151,    94,   152,
-      94,    79,    -1,    18,    94,   143,   149,    79,    -1,    18,
-      94,   143,   149,   151,    94,   152,    94,    79,    -1,    80,
-      -1,     6,    -1,     7,    -1,     8,    -1,     9,    -1,    10,
-      -1,    12,    -1,    11,    -1,    16,    12,    -1,    16,    16,
-      12,    -1,    16,    65,    13,    73,    -1,    16,    65,    63,
-      73,    -1,    16,    65,    12,    73,    -1,    16,    66,    94,
-     144,    94,    73,    -1,   156,    -1,   155,   156,    -1,   155,
-      -1,     1,   173,     1,    -1,     1,    -1,   155,     1,    -1,
-     155,   173,    -1,   156,    71,    94,    -1,   156,   173,    71,
-      94,    -1,     1,    71,    94,    -1,     1,   173,     1,    71,
-      94,    -1,   155,   156,    71,    94,    -1,   155,     1,    71,
-      94,    -1,   155,     1,   173,     1,    71,    94,    -1,   157,
-      16,    94,   159,   158,    -1,   163,    94,    -1,   157,     1,
-      -1,   157,    16,    94,     1,   159,   158,    -1,   157,    16,
-      94,   159,   158,     1,    -1,    39,    94,    -1,   157,    16,
-      94,    -1,   157,    16,    94,     1,    -1,   157,   172,    -1,
-      12,    94,    -1,    39,    94,    -1,    -1,   161,    -1,   159,
-     160,   161,    -1,   159,     1,    -1,    81,    94,    -1,    74,
-      94,    -1,    -1,   162,    -1,   138,   162,    -1,    11,    94,
-      -1,    12,    94,    -1,    60,    94,    -1,   138,    60,    94,
-      -1,    64,    94,    -1,    67,    94,    -1,   165,    -1,    82,
-      94,    -1,   164,    -1,   163,    94,    -1,    83,    94,    -1,
-      63,    94,    -1,    62,    94,    -1,    61,    94,    -1,    46,
-      94,    -1,    47,    94,    -1,    48,    94,    -1,    49,    94,
-      -1,    50,    94,    -1,    51,    94,    -1,    52,    94,    -1,
-      53,    94,    -1,    54,    94,    -1,    55,    94,    -1,    56,
-      94,    -1,    57,    94,    -1,    58,    94,    -1,    59,    94,
-      -1,    44,    94,    -1,    43,    94,    -1,    45,    94,    -1,
-      68,    -1,    65,    94,   159,    73,    94,    -1,    65,    94,
-       1,    -1,    14,    94,    -1,    15,    94,    -1,    97,    -1,
-       1,    97,    -1,    38,     1,   172,    -1,    38,     1,    71,
-      -1,   167,    95,    -1,   168,   167,    95,    -1,   108,    -1,
-     127,    -1,     1,   172,    -1,    69,     1,   173,     1,    97,
-      -1,    69,     1,    97,    -1,   172,    -1,   173,     1,   172,
+      86,     0,    -1,    97,    96,   100,   101,   102,   103,    -1,
+      88,    95,    -1,    90,    95,    -1,    92,    95,    -1,    93,
+      95,    -1,    94,    95,    -1,    91,    95,    -1,    89,    95,
+      -1,   104,    -1,   109,    -1,    28,    70,    95,    87,    95,
+      71,    -1,    30,    70,    95,   133,    95,    71,    -1,    29,
+      70,    95,   155,    71,    -1,    38,    70,    95,   112,    71,
+      -1,    32,    70,    95,   160,    71,    -1,    33,     5,    95,
+     125,    71,    -1,    34,    70,    95,   141,    71,    -1,    -1,
+      95,     5,    -1,    -1,    96,     6,    -1,    96,     5,    -1,
+      -1,    99,    -1,    71,    -1,     0,    -1,    26,    95,    12,
+      95,    72,    -1,    26,     1,   173,    -1,    26,     1,    72,
+      -1,    -1,   100,   109,    96,    -1,   169,    -1,    -1,   101,
+     110,    96,    -1,    -1,   102,   116,    96,    -1,    -1,   103,
+     105,    96,    -1,   140,    -1,   128,    -1,   136,    -1,   137,
+      -1,   130,    -1,   104,    -1,   172,    -1,   168,    -1,   170,
+      -1,    -1,   106,   108,    96,    -1,   140,    -1,   136,    -1,
+     137,    -1,   130,    -1,   107,    -1,   172,    -1,   168,    -1,
+     170,    -1,   171,    -1,    22,    95,   118,    95,   126,    72,
+      -1,    22,    95,   118,    95,   126,   173,    -1,    22,     1,
+      72,    -1,    22,     1,   173,    -1,    35,    95,   126,    70,
+      95,   112,    71,    -1,    36,    95,   111,    70,    95,   112,
+      71,    -1,    -1,    37,     5,   127,    -1,   114,    -1,   113,
+     114,    -1,   113,    -1,     1,   174,     1,    -1,     1,    -1,
+     113,     1,    -1,   114,    72,    95,    -1,   114,   174,    72,
+      95,    -1,     1,    72,    95,    -1,     1,   174,     1,    72,
+      95,    -1,   113,   114,    72,    95,    -1,   113,     1,    72,
+      95,    -1,   113,     1,   174,     1,    72,    95,    -1,   115,
+      17,    95,   160,    -1,   115,    95,    70,    95,   155,    71,
+      95,    -1,   115,     1,    -1,   115,    17,    95,     1,   160,
+      -1,   115,    17,    95,    -1,   115,    17,    95,     1,    -1,
+      13,    95,    -1,    27,    95,   117,   118,    95,    72,    -1,
+      27,     1,   173,    -1,    27,     1,    72,    -1,    -1,    13,
+       5,    -1,    12,    -1,    65,    -1,    13,    95,    -1,    -1,
+      17,    95,   160,    95,    -1,    73,    95,   119,    95,   120,
+      74,    95,    -1,   121,    -1,   122,    95,    43,    95,   121,
+      -1,    -1,    43,    95,   122,    -1,    -1,    41,    -1,    42,
+      -1,   122,    -1,   124,    95,   129,   123,    -1,    -1,   127,
+      -1,   125,    -1,   127,    75,    95,   125,    -1,   127,     1,
+      -1,    24,    95,   127,    70,    95,   106,   167,    -1,    24,
+      95,    70,    95,   106,   167,    -1,    13,    95,    -1,    31,
+      95,   131,    95,    70,    95,   132,    71,    -1,    13,    -1,
+      12,    -1,    -1,   132,   133,    95,    -1,   134,    95,    70,
+      95,   155,    71,    -1,   135,    -1,   134,    95,    75,    95,
+     135,    -1,    62,    -1,    13,    -1,    23,     1,   173,    -1,
+      23,     1,    72,    -1,    25,    95,    70,    95,   155,    71,
+      95,    -1,    25,     1,   173,    -1,    25,     1,    72,    -1,
+      76,    95,    -1,    77,    95,    -1,    78,    95,    -1,    79,
+      -1,    76,    -1,   141,    70,    95,   155,    98,    -1,   143,
+      -1,   141,    75,    95,   143,    -1,   141,     1,    -1,   143,
+       5,    -1,   145,    -1,   142,    -1,   142,   145,    -1,   143,
+     138,   145,    -1,   143,     1,    -1,    21,    -1,    20,    21,
+      -1,    13,    21,    -1,   146,    -1,   146,   147,    -1,   147,
+      -1,   144,   146,    -1,   144,   146,   147,    -1,   144,   147,
+      -1,    13,    -1,    20,    -1,   148,    -1,   147,   148,    -1,
+     147,     1,    -1,    16,    -1,    15,    -1,   149,    -1,   151,
+      -1,   154,    -1,    18,    13,    -1,    13,    95,    -1,    19,
+      95,   150,    80,    -1,    19,    95,   150,   152,    95,   153,
+      95,    80,    -1,    19,    95,   144,   150,    80,    -1,    19,
+      95,   144,   150,   152,    95,   153,    95,    80,    -1,    81,
+      -1,     7,    -1,     8,    -1,     9,    -1,    10,    -1,    11,
+      -1,    13,    -1,    12,    -1,    17,    13,    -1,    17,    17,
+      13,    -1,    17,    66,    14,    74,    -1,    17,    66,    64,
+      74,    -1,    17,    66,    13,    74,    -1,    17,    67,    95,
+     145,    95,    74,    -1,   157,    -1,   156,   157,    -1,   156,
+      -1,     1,   174,     1,    -1,     1,    -1,   156,     1,    -1,
+     156,   174,    -1,   157,    72,    95,    -1,   157,   174,    72,
+      95,    -1,     1,    72,    95,    -1,     1,   174,     1,    72,
+      95,    -1,   156,   157,    72,    95,    -1,   156,     1,    72,
+      95,    -1,   156,     1,   174,     1,    72,    95,    -1,   158,
+      17,    95,   160,   159,    -1,   164,    95,    -1,   158,     1,
+      -1,   158,    17,    95,     1,   160,   159,    -1,   158,    17,
+      95,   160,   159,     1,    -1,    40,    95,    -1,   158,    17,
+      95,    -1,   158,    17,    95,     1,    -1,   158,   173,    -1,
+      13,    95,    -1,    40,    95,    -1,    -1,   162,    -1,   160,
+     161,   162,    -1,   160,     1,    -1,    82,    95,    -1,    75,
+      95,    -1,    -1,   163,    -1,   139,   163,    -1,    12,    95,
+      -1,    13,    95,    -1,    61,    95,    -1,   139,    61,    95,
+      -1,    65,    95,    -1,    68,    95,    -1,   166,    -1,    83,
+      95,    -1,   165,    -1,   164,    95,    -1,    84,    95,    -1,
+      64,    95,    -1,    63,    95,    -1,    62,    95,    -1,    47,
+      95,    -1,    48,    95,    -1,    49,    95,    -1,    50,    95,
+      -1,    51,    95,    -1,    52,    95,    -1,    53,    95,    -1,
+      54,    95,    -1,    55,    95,    -1,    56,    95,    -1,    57,
+      95,    -1,    58,    95,    -1,    59,    95,    -1,    60,    95,
+      -1,    45,    95,    -1,    44,    95,    -1,    46,    95,    -1,
+      69,    -1,    66,    95,   160,    74,    95,    -1,    66,    95,
+       1,    -1,    15,    95,    -1,    16,    95,    -1,    98,    -1,
+       1,    98,    -1,    39,     1,   173,    -1,    39,     1,    72,
+      -1,   168,    96,    -1,   169,   168,    96,    -1,   109,    -1,
+     128,    -1,     1,   173,    -1,    70,     1,   174,     1,    98,
+      -1,    70,     1,    98,    -1,   173,    -1,   174,     1,   173,
       -1
 };
 
 /* YYRLINE[YYN] -- source line where rule number YYN was defined.  */
 static const yytype_uint16 yyrline[] =
 {
-       0,   263,   263,   264,   265,   266,   267,   268,   269,   270,
-     274,   275,   279,   285,   291,   297,   303,   317,   324,   334,
-     335,   338,   340,   341,   344,   346,   351,   352,   356,   362,
-     364,   368,   370,   375,   379,   381,   388,   390,   393,   395,
-     403,   404,   405,   406,   407,   411,   412,   413,   414,   418,
-     419,   430,   431,   432,   433,   437,   438,   439,   440,   441,
-     446,   449,   452,   455,   461,   465,   471,   475,   481,   484,
-     489,   492,   495,   498,   504,   507,   510,   513,   516,   521,
-     524,   530,   534,   538,   542,   546,   551,   558,   564,   569,
-     570,   574,   575,   579,   580,   584,   590,   593,   599,   606,
-     611,   618,   621,   627,   630,   633,   639,   644,   652,   655,
-     659,   664,   669,   675,   678,   684,   690,   697,   698,   702,
-     703,   711,   717,   722,   731,   732,   756,   759,   765,   769,
-     772,   778,   779,   780,   784,   785,   789,   795,   804,   812,
-     818,   824,   827,   831,   847,   867,   873,   874,   875,   879,
-     884,   891,   897,   907,   919,   932,   940,   948,   951,   964,
-     970,   978,   990,   991,   992,   996,  1007,  1018,  1023,  1029,
-    1037,  1049,  1052,  1055,  1058,  1061,  1064,  1070,  1071,  1075,
-    1100,  1115,  1133,  1151,  1170,  1185,  1188,  1193,  1196,  1199,
-    1202,  1205,  1211,  1214,  1217,  1220,  1223,  1228,  1231,  1237,
-    1251,  1263,  1267,  1274,  1279,  1284,  1289,  1294,  1301,  1307,
-    1308,  1312,  1317,  1331,  1337,  1340,  1343,  1349,  1350,  1351,
-    1352,  1358,  1359,  1360,  1361,  1362,  1363,  1365,  1368,  1371,
-    1375,  1376,  1377,  1378,  1379,  1380,  1381,  1382,  1383,  1384,
-    1385,  1386,  1387,  1388,  1389,  1390,  1391,  1392,  1393,  1394,
-    1398,  1406,  1415,  1431,  1432,  1439,  1442,  1448,  1451,  1457,
-    1458,  1462,  1468,  1474,  1492,  1493,  1497,  1498
+       0,   266,   266,   267,   268,   269,   270,   271,   272,   273,
+     277,   278,   282,   288,   294,   300,   306,   320,   327,   337,
+     338,   341,   343,   344,   347,   349,   354,   355,   359,   365,
+     367,   371,   373,   378,   382,   384,   391,   393,   396,   398,
+     406,   407,   408,   409,   410,   414,   415,   416,   417,   421,
+     422,   433,   434,   435,   436,   440,   441,   442,   443,   444,
+     449,   452,   455,   458,   464,   468,   474,   478,   484,   487,
+     492,   495,   498,   501,   507,   510,   513,   516,   519,   524,
+     527,   533,   537,   541,   545,   549,   554,   561,   567,   572,
+     573,   577,   578,   582,   583,   587,   593,   596,   602,   609,
+     614,   621,   624,   630,   633,   636,   642,   647,   655,   658,
+     662,   667,   672,   678,   681,   687,   693,   700,   701,   705,
+     706,   714,   720,   725,   734,   735,   759,   762,   768,   772,
+     775,   781,   782,   783,   787,   788,   792,   798,   807,   815,
+     821,   827,   830,   834,   850,   870,   876,   877,   878,   882,
+     887,   894,   900,   910,   922,   935,   943,   951,   954,   967,
+     973,   981,   993,   994,   995,   999,  1010,  1021,  1026,  1032,
+    1040,  1052,  1055,  1058,  1061,  1064,  1067,  1073,  1074,  1078,
+    1108,  1128,  1146,  1164,  1183,  1198,  1201,  1206,  1209,  1212,
+    1215,  1218,  1224,  1227,  1230,  1233,  1236,  1241,  1244,  1250,
+    1264,  1276,  1280,  1287,  1292,  1297,  1302,  1307,  1314,  1320,
+    1321,  1325,  1330,  1344,  1350,  1353,  1356,  1362,  1363,  1364,
+    1365,  1371,  1372,  1373,  1374,  1375,  1376,  1378,  1381,  1384,
+    1390,  1391,  1392,  1393,  1394,  1395,  1396,  1397,  1398,  1399,
+    1400,  1401,  1402,  1403,  1404,  1405,  1406,  1407,  1408,  1409,
+    1413,  1421,  1430,  1446,  1447,  1454,  1457,  1463,  1466,  1472,
+    1473,  1477,  1483,  1489,  1507,  1508,  1512,  1513
 };
 #endif
 
@@ -771,27 +774,28 @@ static const yytype_uint16 yyrline[] =
    First, the terminals, then, starting at YYNTOKENS, nonterminals.  */
 static const char *const yytname[] =
 {
-  "TOKEN_EOF", "error", "$undefined", "UNIMPORTANT_TOK", "WHITESPACE",
-  "SGML_CD", "INCLUDES", "DASHMATCH", "BEGINSWITH", "ENDSWITH", "CONTAINS",
-  "STRING", "IDENT", "NTH", "HEX", "IDSEL", "':'", "'.'", "'['", "'*'",
-  "'|'", "IMPORT_SYM", "PAGE_SYM", "MEDIA_SYM", "FONT_FACE_SYM",
-  "CHARSET_SYM", "NAMESPACE_SYM", "WEBKIT_RULE_SYM", "WEBKIT_DECLS_SYM",
-  "WEBKIT_KEYFRAME_RULE_SYM", "WEBKIT_KEYFRAMES_SYM", "WEBKIT_VALUE_SYM",
-  "WEBKIT_MEDIAQUERY_SYM", "WEBKIT_SELECTOR_SYM", "WEBKIT_VARIABLES_SYM",
-  "WEBKIT_DEFINE_SYM", "VARIABLES_FOR", "WEBKIT_VARIABLES_DECLS_SYM",
-  "ATKEYWORD", "IMPORTANT_SYM", "MEDIA_ONLY", "MEDIA_NOT", "MEDIA_AND",
-  "QEMS", "EMS", "EXS", "PXS", "CMS", "MMS", "INS", "PTS", "PCS", "DEGS",
-  "RADS", "GRADS", "TURNS", "MSECS", "SECS", "HERZ", "KHERZ", "DIMEN",
-  "PERCENTAGE", "FLOATTOKEN", "INTEGER", "URI", "FUNCTION", "NOTFUNCTION",
-  "UNICODERANGE", "VARCALL", "'{'", "'}'", "';'", "'('", "')'", "','",
-  "'+'", "'~'", "'>'", "'-'", "']'", "'='", "'/'", "'#'", "'%'", "$accept",
-  "stylesheet", "valid_rule_or_import", "webkit_rule",
-  "webkit_keyframe_rule", "webkit_decls", "webkit_variables_decls",
-  "webkit_value", "webkit_mediaquery", "webkit_selector", "maybe_space",
-  "maybe_sgml", "maybe_charset", "closing_brace", "charset", "import_list",
-  "variables_list", "namespace_list", "rule_list", "valid_rule", "rule",
-  "block_rule_list", "block_valid_rule", "block_rule", "import",
-  "variables_rule", "variables_media_list", "variables_declaration_list",
+  "TOKEN_EOF", "error", "$undefined", "LOWEST_PREC", "UNIMPORTANT_TOK",
+  "WHITESPACE", "SGML_CD", "INCLUDES", "DASHMATCH", "BEGINSWITH",
+  "ENDSWITH", "CONTAINS", "STRING", "IDENT", "NTH", "HEX", "IDSEL", "':'",
+  "'.'", "'['", "'*'", "'|'", "IMPORT_SYM", "PAGE_SYM", "MEDIA_SYM",
+  "FONT_FACE_SYM", "CHARSET_SYM", "NAMESPACE_SYM", "WEBKIT_RULE_SYM",
+  "WEBKIT_DECLS_SYM", "WEBKIT_KEYFRAME_RULE_SYM", "WEBKIT_KEYFRAMES_SYM",
+  "WEBKIT_VALUE_SYM", "WEBKIT_MEDIAQUERY_SYM", "WEBKIT_SELECTOR_SYM",
+  "WEBKIT_VARIABLES_SYM", "WEBKIT_DEFINE_SYM", "VARIABLES_FOR",
+  "WEBKIT_VARIABLES_DECLS_SYM", "ATKEYWORD", "IMPORTANT_SYM", "MEDIA_ONLY",
+  "MEDIA_NOT", "MEDIA_AND", "QEMS", "EMS", "EXS", "PXS", "CMS", "MMS",
+  "INS", "PTS", "PCS", "DEGS", "RADS", "GRADS", "TURNS", "MSECS", "SECS",
+  "HERZ", "KHERZ", "DIMEN", "PERCENTAGE", "FLOATTOKEN", "INTEGER", "URI",
+  "FUNCTION", "NOTFUNCTION", "UNICODERANGE", "VARCALL", "'{'", "'}'",
+  "';'", "'('", "')'", "','", "'+'", "'~'", "'>'", "'-'", "']'", "'='",
+  "'/'", "'#'", "'%'", "$accept", "stylesheet", "valid_rule_or_import",
+  "webkit_rule", "webkit_keyframe_rule", "webkit_decls",
+  "webkit_variables_decls", "webkit_value", "webkit_mediaquery",
+  "webkit_selector", "maybe_space", "maybe_sgml", "maybe_charset",
+  "closing_brace", "charset", "import_list", "variables_list",
+  "namespace_list", "rule_list", "valid_rule", "rule", "block_rule_list",
+  "block_valid_rule", "block_rule", "import", "variables_rule",
+  "variables_media_list", "variables_declaration_list",
   "variables_decl_list", "variables_declaration", "variable_name",
   "namespace", "maybe_ns_prefix", "string_or_uri", "media_feature",
   "maybe_media_value", "media_query_exp", "media_query_exp_list",
@@ -816,47 +820,47 @@ static const char *const yytname[] =
 static const yytype_uint16 yytoknum[] =
 {
        0,   256,   257,   258,   259,   260,   261,   262,   263,   264,
-     265,   266,   267,   268,   269,   270,    58,    46,    91,    42,
-     124,   271,   272,   273,   274,   275,   276,   277,   278,   279,
+     265,   266,   267,   268,   269,   270,   271,    58,    46,    91,
+      42,   124,   272,   273,   274,   275,   276,   277,   278,   279,
      280,   281,   282,   283,   284,   285,   286,   287,   288,   289,
      290,   291,   292,   293,   294,   295,   296,   297,   298,   299,
      300,   301,   302,   303,   304,   305,   306,   307,   308,   309,
-     310,   311,   312,   313,   314,   315,   316,   317,   318,   123,
-     125,    59,    40,    41,    44,    43,   126,    62,    45,    93,
-      61,    47,    35,    37
+     310,   311,   312,   313,   314,   315,   316,   317,   318,   319,
+     123,   125,    59,    40,    41,    44,    43,   126,    62,    45,
+      93,    61,    47,    35,    37
 };
 # endif
 
 /* YYR1[YYN] -- Symbol number of symbol that rule YYN derives.  */
 static const yytype_uint8 yyr1[] =
 {
-       0,    84,    85,    85,    85,    85,    85,    85,    85,    85,
-      86,    86,    87,    88,    89,    90,    91,    92,    93,    94,
-      94,    95,    95,    95,    96,    96,    97,    97,    98,    98,
-      98,    99,    99,    99,   100,   100,   101,   101,   102,   102,
-     103,   103,   103,   103,   103,   104,   104,   104,   104,   105,
-     105,   106,   106,   106,   106,   107,   107,   107,   107,   107,
-     108,   108,   108,   108,   109,   109,   110,   110,   111,   111,
-     111,   111,   111,   111,   112,   112,   112,   112,   112,   112,
-     112,   113,   113,   113,   113,   113,   113,   114,   115,   115,
-     115,   116,   116,   117,   117,   118,   119,   119,   120,   121,
-     121,   122,   122,   123,   123,   123,   124,   124,   125,   125,
-     126,   126,   126,   127,   127,   128,   129,   130,   130,   131,
-     131,   132,   133,   133,   134,   134,   135,   135,   136,   136,
-     136,   137,   137,   137,   138,   138,   139,   140,   140,   140,
-     141,   142,   142,   142,   142,   142,   143,   143,   143,   144,
-     144,   144,   144,   144,   144,   145,   145,   146,   146,   146,
-     147,   147,   147,   147,   147,   148,   149,   150,   150,   150,
-     150,   151,   151,   151,   151,   151,   151,   152,   152,   153,
-     153,   153,   153,   153,   153,   154,   154,   154,   154,   154,
-     154,   154,   155,   155,   155,   155,   155,   155,   155,   156,
-     156,   156,   156,   156,   156,   156,   156,   156,   157,   158,
-     158,   159,   159,   159,   160,   160,   160,   161,   161,   161,
-     161,   161,   161,   161,   161,   161,   161,   161,   161,   161,
+       0,    85,    86,    86,    86,    86,    86,    86,    86,    86,
+      87,    87,    88,    89,    90,    91,    92,    93,    94,    95,
+      95,    96,    96,    96,    97,    97,    98,    98,    99,    99,
+      99,   100,   100,   100,   101,   101,   102,   102,   103,   103,
+     104,   104,   104,   104,   104,   105,   105,   105,   105,   106,
+     106,   107,   107,   107,   107,   108,   108,   108,   108,   108,
+     109,   109,   109,   109,   110,   110,   111,   111,   112,   112,
+     112,   112,   112,   112,   113,   113,   113,   113,   113,   113,
+     113,   114,   114,   114,   114,   114,   114,   115,   116,   116,
+     116,   117,   117,   118,   118,   119,   120,   120,   121,   122,
+     122,   123,   123,   124,   124,   124,   125,   125,   126,   126,
+     127,   127,   127,   128,   128,   129,   130,   131,   131,   132,
+     132,   133,   134,   134,   135,   135,   136,   136,   137,   137,
+     137,   138,   138,   138,   139,   139,   140,   141,   141,   141,
+     142,   143,   143,   143,   143,   143,   144,   144,   144,   145,
+     145,   145,   145,   145,   145,   146,   146,   147,   147,   147,
+     148,   148,   148,   148,   148,   149,   150,   151,   151,   151,
+     151,   152,   152,   152,   152,   152,   152,   153,   153,   154,
+     154,   154,   154,   154,   154,   155,   155,   155,   155,   155,
+     155,   155,   156,   156,   156,   156,   156,   156,   156,   157,
+     157,   157,   157,   157,   157,   157,   157,   157,   158,   159,
+     159,   160,   160,   160,   161,   161,   161,   162,   162,   162,
      162,   162,   162,   162,   162,   162,   162,   162,   162,   162,
-     162,   162,   162,   162,   162,   162,   162,   162,   162,   162,
-     163,   164,   164,   165,   165,   166,   166,   167,   167,   168,
-     168,   169,   170,   171,   172,   172,   173,   173
+     163,   163,   163,   163,   163,   163,   163,   163,   163,   163,
+     163,   163,   163,   163,   163,   163,   163,   163,   163,   163,
+     164,   165,   165,   166,   166,   167,   167,   168,   168,   169,
+     169,   170,   171,   172,   173,   173,   174,   174
 };
 
 /* YYR2[YYN] -- Number of symbols composing right hand side of rule YYN.  */
@@ -966,75 +970,75 @@ static const yytype_int16 yydefgoto[] =
 
 /* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing
    STATE-NUM.  */
-#define YYPACT_NINF -299
+#define YYPACT_NINF -435
 static const yytype_int16 yypact[] =
 {
-     466,   425,   -26,   -20,    75,   118,   189,   139,   151,   263,
-    -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,   359,
-     300,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,   278,
-     278,   278,   278,   278,   278,   278,    33,   338,  -299,  -299,
-    -299,  -299,   749,   313,    32,  1074,    12,   545,    44,  -299,
-    -299,   345,   346,  -299,   335,   223,   194,   354,  -299,  -299,
-     419,   380,  -299,   383,  -299,   403,   408,  -299,   163,  -299,
-    -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,    86,   561,
-     199,   620,  -299,   626,   161,  -299,  -299,  -299,  -299,   374,
-    -299,  -299,  -299,   351,   239,   378,   179,  -299,  -299,  -299,
-    -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,
-    -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,
-    -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,
-    -299,  -299,  -299,  -299,  -299,   645,   882,  -299,  -299,  -299,
-    -299,  -299,  -299,  -299,  -299,  -299,    30,  -299,   363,    82,
-     402,  -299,   364,   185,   410,   190,   421,    28,  -299,   301,
-    -299,  -299,  -299,  -299,  -299,   423,  -299,  -299,  -299,   426,
-     337,  -299,  -299,    35,  -299,   542,   397,   640,     1,   691,
-      26,   448,   220,  -299,  -299,  -299,  -299,  -299,  -299,  -299,
-    -299,  -299,   561,  -299,  -299,   626,   343,   381,  -299,  -299,
-    -299,   443,   278,   278,  -299,   705,   377,    27,  -299,    59,
-    -299,  -299,  -299,   278,   242,   178,   278,   278,   278,   278,
-     278,   278,   278,   278,   278,   278,   278,   278,   278,   278,
-     278,   278,   278,   278,   278,   278,   278,   278,   278,   278,
-     278,   278,  1012,   278,   278,   278,  -299,  -299,  -299,  -299,
-    -299,  -299,  1132,   278,   201,   368,   312,  -299,  -299,  -299,
-     464,   278,  -299,   706,   395,  -299,    87,  -299,  -299,   188,
-    -299,  -299,  -299,  -299,   442,  -299,   301,   301,   223,  -299,
-     409,   413,   414,   545,   354,   383,   488,    69,  -299,  -299,
-    -299,  -299,  -299,  -299,  -299,  -299,  -299,   135,  -299,  -299,
-    -299,  -299,  -299,  -299,  -299,   313,   545,   278,   278,   278,
-    -299,   554,   278,   709,  -299,   475,  -299,   432,   278,  -299,
-     539,  -299,  -299,  -299,  -299,   947,   278,   278,   278,  -299,
-    -299,  -299,  -299,  -299,   462,   278,   712,  -299,   528,  -299,
-     278,  -299,   744,  -299,   294,   165,   382,  1229,  -299,   301,
-    -299,  -299,  -299,  -299,  -299,  -299,   278,  -299,   209,  -299,
-    -299,  -299,  -299,  -299,  -299,  -299,  -299,   339,   278,  -299,
-    -299,  -299,   313,   257,   174,   210,  -299,   278,   713,   278,
-     278,  1132,   463,   313,    32,  -299,   278,    42,   181,   278,
-    -299,  -299,  -299,   278,   754,   278,   278,  1132,   604,   313,
-     467,    97,   531,   473,   764,   329,   432,  -299,  -299,  -299,
-    -299,  -299,  -299,   301,    61,  -299,  -299,   458,   765,  1204,
-     278,    12,   477,  -299,  -299,   278,  -299,   463,  -299,   172,
-     478,  -299,   278,  -299,   479,  -299,   181,   278,  -299,   669,
-     486,  -299,    10,  -299,  -299,  -299,   562,   217,  -299,   301,
-    -299,   458,  -299,  -299,  -299,  -299,  -299,   223,  -299,  -299,
-    -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,
-    -299,  1204,  -299,  -299,   278,   278,  -299,   278,  -299,  -299,
-    1074,  -299,    30,   278,  -299,    44,   152,    44,  -299,  -299,
-    -299,     2,  -299,   301,  -299,   278,   307,   817,   278,   278,
-     497,   504,   225,    15,  -299,  -299,  -299,   278,  -299,  -299,
-    -299,  -299,   278
+     818,    44,   -36,   -18,   112,   127,    66,   141,   162,   243,
+    -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,   239,
+      43,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,   250,
+     250,   250,   250,   250,   250,   250,    37,   304,  -435,  -435,
+    -435,  -435,   763,   354,    31,  1114,   144,   622,    49,  -435,
+    -435,   346,   344,  -435,   332,    27,    23,   358,  -435,  -435,
+     401,   370,  -435,   371,  -435,   381,   406,  -435,   193,  -435,
+    -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,   171,   702,
+     143,   631,  -435,   756,   159,  -435,  -435,  -435,  -435,   240,
+    -435,  -435,  -435,   329,   303,   254,   199,  -435,  -435,  -435,
+    -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,
+    -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,
+    -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,
+    -435,  -435,  -435,  -435,  -435,   949,   903,  -435,  -435,  -435,
+    -435,  -435,  -435,  -435,  -435,  -435,    34,  -435,   342,     4,
+     274,  -435,   353,    59,   291,   223,   331,   395,  -435,   438,
+    -435,  -435,  -435,  -435,  -435,   437,  -435,  -435,  -435,   448,
+      24,  -435,  -435,   415,  -435,   349,   295,   377,   375,   399,
+     198,   421,   190,  -435,  -435,  -435,  -435,  -435,  -435,  -435,
+    -435,  -435,   702,  -435,  -435,   756,   334,   380,  -435,  -435,
+    -435,   463,   250,   250,  -435,   409,   398,   180,  -435,    15,
+    -435,  -435,  -435,   250,   221,   182,   250,   250,   250,   250,
+     250,   250,   250,   250,   250,   250,   250,   250,   250,   250,
+     250,   250,   250,   250,   250,   250,   250,   250,   250,   250,
+     250,   250,  1052,   250,   250,   250,  -435,  -435,  -435,  -435,
+    -435,  -435,  1172,   250,   188,   166,   301,  -435,  -435,  -435,
+     472,   250,  -435,   412,   404,  -435,    62,  -435,  -435,   220,
+    -435,  -435,  -435,  -435,   458,  -435,   438,   438,    27,  -435,
+     413,   417,   430,   622,   358,   371,   473,   158,  -435,  -435,
+    -435,  -435,  -435,  -435,  -435,  -435,  -435,   172,  -435,  -435,
+    -435,  -435,  -435,  -435,  -435,   354,   622,   250,   250,   250,
+    -435,   555,   250,   420,  -435,   502,  -435,   459,   250,  -435,
+     535,  -435,  -435,  -435,  -435,   976,   250,   250,   250,  -435,
+    -435,  -435,  -435,  -435,   496,   250,   423,  -435,   541,  -435,
+     250,  -435,   754,  -435,   424,    36,   552,   685,  -435,   438,
+    -435,  -435,  -435,  -435,  -435,  -435,   250,  -435,   277,  -435,
+    -435,  -435,  -435,  -435,  -435,  -435,  -435,   856,   250,  -435,
+    -435,  -435,   354,   226,    65,   203,  -435,   250,   428,   250,
+     250,  1172,   462,   354,    31,  -435,   250,    53,   186,   250,
+    -435,  -435,  -435,   250,   429,   250,   250,  1172,   608,   354,
+     479,    83,   538,   485,   482,   320,   459,  -435,  -435,  -435,
+    -435,  -435,  -435,   438,    78,  -435,  -435,   447,   489,  1244,
+     250,   144,   487,  -435,  -435,   250,  -435,   462,  -435,   205,
+     491,  -435,   250,  -435,   492,  -435,   186,   250,  -435,   681,
+     497,  -435,     5,  -435,  -435,  -435,   558,   150,  -435,   438,
+    -435,   447,  -435,  -435,  -435,  -435,  -435,    27,  -435,  -435,
+    -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,
+    -435,  1244,  -435,  -435,   250,   250,  -435,   250,  -435,  -435,
+    1114,  -435,    34,   250,  -435,    49,   178,    49,  -435,  -435,
+    -435,     1,  -435,   438,  -435,   250,   306,   827,   250,   250,
+     498,   504,   151,    14,  -435,  -435,  -435,   250,  -435,  -435,
+    -435,  -435,   250
 };
 
 /* YYPGOTO[NTERM-NUM].  */
 static const yytype_int16 yypgoto[] =
 {
-    -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,  -299,
-      -1,   -21,  -299,   -51,  -299,  -299,  -299,  -299,  -299,   265,
-    -299,   200,  -299,  -299,   258,  -299,  -299,   352,  -299,   472,
-    -299,  -299,  -299,   186,  -299,  -299,   238,   240,  -299,  -299,
-     -45,   279,  -176,  -238,  -299,  -194,  -299,  -299,   149,  -299,
-     293,  -116,   -66,  -299,  -299,   -48,   663,  -299,   429,   568,
-     -61,   661,   -50,   -55,  -299,   460,  -299,   391,   303,  -299,
-    -298,  -299,   692,  -299,   330,  -185,  -299,   533,   675,   -35,
-    -299,  -299,   349,   -19,  -299,   469,  -299,   470,   -16,    -3
+    -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,  -435,
+      -1,   -21,  -435,   -51,  -435,  -435,  -435,  -435,  -435,   229,
+    -435,   147,  -435,  -435,   256,  -435,  -435,  -434,  -435,   425,
+    -435,  -435,  -435,   130,  -435,  -435,   214,   174,  -435,  -435,
+     -45,   241,  -176,  -389,  -435,  -227,  -435,  -435,   116,  -435,
+     231,  -154,  -137,  -435,  -435,  -130,   566,  -435,   310,   449,
+     -61,   547,   -50,   -55,  -435,   348,  -435,   278,   194,  -435,
+    -298,  -435,   581,  -435,   261,  -185,  -435,   443,   546,   -35,
+    -435,  -435,   218,   -19,  -435,   352,  -435,   364,   -16,    -3
 };
 
 /* YYTABLE[YYPACT[STATE-NUM]].  What to do in state STATE-NUM.  If
@@ -1044,324 +1048,332 @@ static const yytype_int16 yypgoto[] =
 #define YYTABLE_NINF -217
 static const yytype_int16 yytable[] =
 {
-      20,   148,   297,    39,   163,    40,    40,   374,    97,    29,
-      30,    31,    32,    33,    34,    35,    40,    53,   186,    40,
-      42,    43,    44,    45,    46,    47,    48,  -191,   317,   199,
-      40,   196,   159,   197,   -19,   160,    40,    49,    50,    40,
-      56,   142,   143,    21,    98,   150,    40,   284,    40,    22,
-     142,   143,   142,   143,   285,    64,   151,   325,   433,    97,
-     317,   173,   272,   273,   176,    40,   178,   180,   181,   182,
-     295,    51,   -19,   144,   422,   359,   360,   361,   362,   363,
-     212,   504,   144,   183,   144,   430,   201,   183,   317,   202,
-     203,   207,   209,    99,   511,   300,   213,  -191,   369,   214,
+      20,   148,   297,    39,   163,   183,    40,   374,    97,    29,
+      30,    31,    32,    33,    34,    35,   317,    53,   186,    40,
+      42,    43,    44,    45,    46,    47,    48,   161,    40,   199,
+     461,   196,   159,   197,    21,   160,    40,   280,   281,   -19,
+      56,    40,    49,    50,    98,    19,   142,   143,    40,   -19,
+     150,   500,    22,   501,    40,    41,   -19,   325,    40,    97,
+     263,   173,   151,   317,   176,   161,   178,   180,   181,   182,
+     433,    25,   151,   402,   422,   258,    51,   -19,   144,   185,
+     212,   504,   461,    40,   369,   430,   201,   319,   282,   202,
+     203,   207,   209,    99,   511,   166,   213,    37,   162,   214,
      215,   440,   216,   217,   218,   219,   220,   221,   222,   223,
      224,   225,   226,   227,   228,   229,   230,   231,   232,   233,
      234,   235,   236,   237,   238,   239,   240,   241,   242,   243,
-     319,   310,   244,   245,   450,   382,   369,   276,   253,   277,
-     271,   199,   199,   254,    23,   311,   256,   260,   364,   365,
-     261,   266,   258,   369,   269,   184,   185,   398,   341,   289,
-     185,   294,   198,   299,   179,  -151,  -109,   -19,  -109,    40,
-     283,   371,  -199,   478,   161,    58,    59,    60,    61,    62,
-     210,   461,    40,   305,   306,    40,   263,    24,   307,   308,
-     309,   267,    40,    25,   -19,   211,   427,   151,    40,   312,
-     187,   402,   315,   188,   370,    40,   268,   318,    26,   371,
-     320,   187,   439,   330,   188,   359,   360,   361,   362,   363,
-      27,   -67,   355,   161,    40,   462,   371,   350,   290,    40,
-    -151,  -151,   -19,   461,  -151,  -151,  -151,  -151,  -151,  -187,
-     205,  -199,  -199,  -199,   162,   326,    40,   322,    37,   327,
-     328,    90,   323,   144,   349,   -70,   199,   343,   335,   -19,
-     338,    40,   351,    28,   340,   166,   486,   342,  -137,  -137,
-      97,   344,   345,  -137,   189,   190,   191,   462,    91,  -138,
-    -138,   291,    40,   356,  -138,   189,   190,   191,   415,   365,
-     304,   367,    37,   162,   368,   497,   510,   351,    40,   372,
-      72,   351,   373,   463,    40,    49,    50,    92,    37,  -187,
-     158,    41,   321,   377,    89,   379,    40,    40,   380,    98,
-     351,   383,   384,   424,   333,    90,   423,   413,   410,   386,
-     387,   388,   389,    40,   142,   143,   393,    97,   395,    55,
-     396,   446,   399,    40,   198,   405,   156,  -154,    97,   280,
-     281,  -103,    91,   464,   414,   463,   356,    58,    59,    60,
-      61,    62,   351,  -108,    97,   417,   144,    65,    99,   420,
-     421,   465,    40,    51,   167,   425,   472,   505,   351,   142,
-     143,    92,   198,   404,   432,  -150,   -19,   449,   445,   436,
-     448,   437,   172,   -19,   -19,    58,    59,    60,    61,    62,
-     282,    40,   456,   174,   175,   464,   492,   -19,   290,   177,
-     332,   144,  -154,  -154,   -19,   451,  -154,  -154,  -154,  -154,
-    -154,   204,   474,   465,   278,   475,    19,   477,    37,   -19,
-      38,   168,   480,   257,   262,   169,   -19,   483,   279,   493,
-     485,   448,   487,    37,   313,   200,   -19,    37,   316,   208,
-    -150,  -150,    40,   491,  -150,  -150,  -150,  -150,  -150,   301,
-     302,   291,    40,  -210,   248,   336,   339,   -19,   346,   452,
-     453,    37,   495,   259,  -216,  -216,   378,  -216,  -216,    37,
-     498,   265,   352,   499,   170,   171,   353,   354,   502,   503,
-      37,     1,   270,     2,     3,     4,   507,     5,     6,     7,
-     357,    37,   428,     8,   390,   512,  -216,  -216,  -216,  -216,
+     -70,   310,   244,   245,   341,   382,   162,   276,   253,   277,
+     271,   199,   199,   254,   187,   311,   256,   260,   188,    40,
+     261,   266,   450,  -109,   269,  -109,    40,   398,   371,   289,
+     198,   294,   290,   299,  -151,   359,   360,   361,   362,   363,
+     283,    40,   183,   369,    58,    59,    60,    61,    62,   369,
+    -191,   317,    23,   305,   306,   142,   143,    40,   307,   308,
+     309,    40,   462,    40,   179,    40,   427,    24,   -19,   312,
+     210,   330,   315,    40,   187,  -199,   478,   318,   188,   332,
+     320,    26,   439,  -137,  -137,   291,   211,   144,  -137,   189,
+     190,   191,   355,   510,   267,    40,    40,   350,   -19,  -151,
+    -151,    40,    27,  -151,  -151,  -151,  -151,  -151,   364,   365,
+     268,   184,   370,    28,   462,   326,   185,   371,   -67,   327,
+     328,  -191,   322,   371,   349,    40,   199,   323,   335,   144,
+     338,   304,   351,   -19,   340,   463,   486,   342,   300,    37,
+      97,   344,   345,  -138,  -138,  -199,  -199,  -199,  -138,   189,
+     190,   191,   464,   356,   359,   360,   361,   362,   363,   465,
+     343,   367,   321,   -19,   368,   497,   423,   351,    72,   372,
+      40,   351,   373,  -187,   205,    55,    40,   290,   158,    37,
+      37,    38,   200,   377,   333,   379,    90,   463,   380,    98,
+     351,   383,   384,   424,    37,    40,   208,   413,   410,   386,
+     387,   388,   389,   446,   464,   198,   393,    97,   395,  -154,
+     396,   465,   399,    91,    37,   405,   259,   156,    97,    58,
+      59,    60,    61,    62,   414,    89,   356,   415,   365,    40,
+     291,    37,   351,   265,    97,   417,    65,    90,    99,   420,
+     421,    51,    92,    37,  -187,   425,   472,   505,   351,   167,
+      40,   198,   175,   172,   432,  -150,   -19,   449,   445,   436,
+     448,   437,   174,   -19,    91,    58,    59,    60,    61,    62,
+     204,    37,   456,   270,  -154,  -154,   492,   177,  -154,  -154,
+    -154,  -154,  -154,   257,   168,   451,   142,   143,   169,    37,
+      40,   288,   474,    92,   262,   475,    40,   477,   284,    40,
+     272,   273,   480,   301,   302,   285,    64,   483,   278,   493,
+     485,   448,   487,    49,    50,   295,   -19,    37,   144,   293,
+    -150,  -150,    40,   491,  -150,  -150,  -150,  -150,  -150,   452,
+     453,   279,  -210,   248,   313,   142,   143,   170,   171,    37,
+     316,   298,   495,   336,  -216,  -216,   339,  -216,  -216,    37,
+     498,   314,    37,   499,   337,   346,   357,   352,   502,   503,
+      37,   353,   376,    37,  -108,   392,   507,   144,    37,    37,
+     426,   438,   428,   378,   354,   512,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,   394,
-    -216,  -216,  -210,  -210,  -210,   442,   441,   250,  -216,  -205,
-     381,  -216,   443,    40,   251,  -216,  -216,   473,   479,    40,
-     103,   104,   481,   105,   106,   198,   484,    57,  -153,    58,
-      59,    60,    61,    62,    63,    64,   488,   508,    58,    59,
-      60,    61,    62,    57,   509,    58,    59,    60,    61,    62,
-      63,    64,   107,   108,   109,   110,   111,   112,   113,   114,
-     115,   116,   117,   118,   119,   120,   121,   122,   123,   124,
-     125,   126,   127,   128,   129,   248,   130,    92,  -205,  -205,
-    -205,    37,   407,   288,   131,  -216,  -216,   132,  -216,  -216,
-     471,   133,   134,  -153,  -153,   264,   435,  -153,  -153,  -153,
-    -153,  -153,   193,   489,    58,    59,    60,    61,    62,   194,
-      58,    59,    60,    61,    62,   506,   418,  -216,  -216,  -216,
+    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,    37,
+    -216,  -216,  -210,  -210,  -210,  -205,   381,   250,  -216,   390,
+      40,  -216,   394,   442,   251,  -216,  -216,   103,   104,   441,
+     105,   106,    37,   404,   444,   443,   198,   -19,   473,    37,
+    -153,   455,   479,   488,   -19,   -19,   481,   471,   484,   508,
+      58,    59,    60,    61,    62,   509,   407,   489,   264,   107,
+     108,   109,   110,   111,   112,   113,   114,   115,   116,   117,
+     118,   119,   120,   121,   122,   123,   124,   125,   126,   127,
+     128,   129,   435,   130,    92,  -205,  -205,  -205,   418,   248,
+     482,   131,   506,   149,   132,   431,   375,   -19,   133,   134,
+    -216,  -216,   286,  -216,  -216,  -153,  -153,    40,   195,  -153,
+    -153,  -153,  -153,  -153,   358,    57,   416,    58,    59,    60,
+      61,    62,    63,    64,   193,   490,    58,    59,    60,    61,
+      62,   194,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
+    -216,  -216,  -216,  -216,  -216,   206,  -216,  -216,   -81,   -81,
+     -81,   247,   248,   250,  -216,    -2,   406,  -216,   476,   494,
+     251,  -216,  -216,  -216,  -216,   329,  -216,  -216,    57,   411,
+      58,    59,    60,    61,    62,    63,    64,    65,    66,    67,
+      68,   412,     0,     0,     0,    57,    69,    58,    59,    60,
+      61,    62,    63,    64,    51,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-     248,  -216,  -216,   -81,   -81,   -81,   482,   431,   250,  -216,
-    -216,  -216,  -216,  -216,  -216,   251,  -216,  -216,   107,   108,
+    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,     0,  -216,
+    -216,   -84,   -84,   -84,     0,   397,   250,  -216,     0,    40,
+    -216,     0,     0,   251,  -216,  -216,   103,   104,    40,   105,
+     106,    58,    59,    60,    61,    62,    57,     0,    58,    59,
+      60,    61,    62,    63,    64,    65,    66,    67,    68,     0,
+       0,     0,     0,     0,    69,     0,     0,     0,   107,   108,
      109,   110,   111,   112,   113,   114,   115,   116,   117,   118,
-     119,   120,   121,   122,   123,   246,   125,   126,   127,    37,
-     149,   293,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
+     119,   120,   121,   122,   123,   124,   125,   126,   127,   128,
+     129,     0,   130,    92,   -85,   -85,   -85,     0,   248,     0,
+     131,     0,   -19,   132,     0,     0,     0,   133,   134,  -216,
+    -216,     0,  -216,  -216,     1,     0,     2,     3,     4,     0,
+       5,     6,     7,     0,     0,     0,     8,     0,     0,     0,
+       0,    40,     0,     0,     0,     0,     0,     0,     0,  -103,
+       0,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,   375,  -216,  -216,   -84,   -84,
-     -84,   286,   195,   250,  -216,   397,   358,  -216,    40,   416,
-     251,  -216,  -216,    40,   490,   103,   104,   476,   105,   106,
-      37,    57,   298,    58,    59,    60,    61,    62,    63,    64,
-      65,    66,    67,    68,    37,    37,   314,   337,    37,    69,
-     376,    37,    37,   392,   426,   329,   206,   107,   108,   109,
-     110,   111,   112,   113,   114,   115,   116,   117,   118,   119,
-     120,   121,   122,   123,   124,   125,   126,   127,   128,   129,
-     247,   130,    92,   -85,   -85,   -85,   411,   412,   248,   131,
-     494,   -19,   132,    37,     0,   438,   133,   134,  -216,  -216,
-       0,  -216,  -216,    37,    37,   444,   455,   500,     0,   501,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+    -216,  -216,  -216,  -216,     0,  -216,  -216,   142,   143,     0,
+       0,   -19,   250,  -216,   248,     0,  -216,     0,     0,   251,
+    -216,  -216,     0,     0,     0,  -216,  -216,     0,  -216,  -216,
+       0,     0,     0,     0,     0,     0,     0,     0,     0,   144,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,   248,  -216,  -216,     0,     0,     0,     0,
-     -19,   250,  -216,  -216,  -216,  -216,  -216,  -216,   251,  -216,
-    -216,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,  -216,  -216,  -216,  -216,  -216,
+       0,  -216,  -216,     0,   249,     0,     0,   248,   250,  -216,
+       0,     0,  -216,     0,     0,   251,  -216,  -216,  -216,  -216,
+       0,  -216,  -216,   107,   108,   109,   110,   111,   112,   113,
+     114,   115,   116,   117,   118,   119,   120,   121,   122,   123,
+     246,   125,   126,   127,     0,     0,     0,     0,     0,     0,
+    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
     -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,   248,  -216,
-    -216,     0,   249,     0,     0,     0,   250,  -216,  -216,  -216,
-    -216,  -216,  -216,   251,  -216,  -216,     0,     0,     0,     0,
+    -216,  -216,  -216,     0,  -216,  -216,     0,     0,     0,     0,
+     385,   250,  -216,   324,     0,  -216,     0,    40,   251,  -216,
+    -216,     0,     0,     0,   103,   104,     0,   105,   106,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,  -216,
-    -216,  -216,  -216,   324,  -216,  -216,    40,     0,     0,     0,
-     385,   250,  -216,   103,   104,  -216,   105,   106,   251,  -216,
-    -216,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,   107,   108,   109,   110,
+     111,   112,   113,   114,   115,   116,   117,   118,   119,   120,
+     121,   122,   123,   124,   125,   126,   127,   128,   129,    40,
+     130,    92,     0,     0,     0,     0,   103,   104,   131,   105,
+     106,   132,     0,     0,     0,   133,   134,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,     0,     0,   107,   108,
+     109,   110,   111,   112,   113,   114,   115,   116,   117,   118,
+     119,   120,   121,   122,   123,   124,   125,   126,   127,   128,
+     129,     0,   130,    92,   103,   104,     0,   105,   106,     0,
+     131,     0,     0,   132,     0,     0,     0,   133,   134,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,   107,   108,   109,   110,   111,
-     112,   113,   114,   115,   116,   117,   118,   119,   120,   121,
-     122,   123,   124,   125,   126,   127,   128,   129,    40,   130,
-      92,     0,     0,     0,     0,   103,   104,   131,   105,   106,
-     132,     0,     0,     0,   133,   134,     0,     0,     0,     0,
+       0,     0,     0,     0,     0,     0,   107,   108,   109,   110,
+     111,   112,   113,   114,   115,   116,   117,   118,   119,   120,
+     121,   122,   123,   124,   125,   126,   127,   128,   129,     0,
+     130,    92,     0,     0,   161,   457,     0,     0,   131,     0,
+       0,   132,     0,     0,     0,   133,   134,    57,     0,    58,
+      59,    60,    61,    62,    63,    64,    65,    66,    67,    68,
+       0,     0,     0,     0,     0,    69,     0,     0,     0,     0,
+       0,     0,     0,    51,     0,     0,     0,     0,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,     0,     0,   107,   108,   109,
-     110,   111,   112,   113,   114,   115,   116,   117,   118,   119,
-     120,   121,   122,   123,   124,   125,   126,   127,   128,   129,
-       0,   130,    92,   103,   104,     0,   105,   106,     0,   131,
-       0,     0,   132,     0,     0,     0,   133,   134,     0,     0,
        0,     0,     0,     0,     0,     0,     0,     0,     0,     0,
-       0,     0,     0,     0,     0,   107,   108,   109,   110,   111,
-     112,   113,   114,   115,   116,   117,   118,   119,   120,   121,
-     122,   123,   124,   125,   126,   127,   128,   129,     0,   130,
-      92,     0,     0,     0,   161,   457,     0,   131,     0,     0,
-     132,     0,     0,     0,   133,   134,    57,     0,    58,    59,
-      60,    61,    62,    63,    64,    65,    66,    67,    68,    -2,
-     406,     0,     0,     0,    69,     0,     0,     0,     0,     0,
-       0,    57,    51,    58,    59,    60,    61,    62,    63,    64,
-      65,    66,    67,    68,     0,     0,     0,     0,     0,    69,
-       0,     0,     0,     0,     0,     0,     0,    51,     0,     0,
-       0,     0,     0,     0,   162
+       0,     0,     0,     0,     0,   162
 };
 
 static const yytype_int16 yycheck[] =
 {
-       1,    46,   178,    19,    55,     4,     4,   305,    43,    10,
-      11,    12,    13,    14,    15,    16,     4,    36,    79,     4,
-      21,    22,    23,    24,    25,    26,    27,     0,     1,    84,
-       4,    81,    53,    83,     4,    54,     4,     4,     5,     4,
-      41,    40,    41,    69,    12,     1,     4,    12,     4,    69,
-      40,    41,    40,    41,    19,    20,    12,   242,    16,    94,
-       1,    62,    34,    35,    65,     4,    67,    68,    69,    70,
-      69,    38,    42,    72,   372,     6,     7,     8,     9,    10,
-      96,    79,    72,     1,    72,   383,    89,     1,     1,    90,
-      91,    94,    95,    61,    79,    69,    97,    70,     1,   100,
+       1,    46,   178,    19,    55,     1,     5,   305,    43,    10,
+      11,    12,    13,    14,    15,    16,     1,    36,    79,     5,
+      21,    22,    23,    24,    25,    26,    27,     0,     5,    84,
+     419,    81,    53,    83,    70,    54,     5,    13,    14,     5,
+      41,     5,     5,     6,    13,     1,    41,    42,     5,     5,
+       1,   485,    70,   487,     5,    12,    12,   242,     5,    94,
+       1,    62,    13,     1,    65,     0,    67,    68,    69,    70,
+      17,     5,    13,    37,   372,    71,    39,    43,    73,    75,
+      96,    80,   471,     5,     1,   383,    89,    72,    64,    90,
+      91,    94,    95,    62,    80,    72,    97,    70,    71,   100,
      101,   399,   103,   104,   105,   106,   107,   108,   109,   110,
      111,   112,   113,   114,   115,   116,   117,   118,   119,   120,
      121,   122,   123,   124,   125,   126,   127,   128,   129,   130,
-      71,   192,   133,   134,    73,   320,     1,   158,   139,   160,
-     156,   196,   197,   144,    69,   195,   147,   150,    79,    80,
-     151,   154,    70,     1,   155,    69,    74,   342,    71,   175,
-      74,   177,     1,   179,     1,     4,    69,     4,    71,     4,
-     171,    74,     0,     1,     0,    14,    15,    16,    17,    18,
-       1,   419,     4,   184,   185,     4,     1,    69,   189,   190,
-     191,     1,     4,     4,     4,    16,   381,    12,     4,   200,
-       1,    36,   205,     4,    69,     4,    16,   208,    69,    74,
-     211,     1,   397,    12,     4,     6,     7,     8,     9,    10,
-      69,    69,   283,     0,     4,   419,    74,   278,    11,     4,
-      69,    70,    69,   471,    73,    74,    75,    76,    77,     0,
-       1,    69,    70,    71,    70,   246,     4,    69,    69,   250,
-     251,    12,    74,    72,   275,    70,   311,    69,   259,    69,
-     263,     4,   278,     0,   265,    71,   442,   268,    69,    70,
-     305,   272,   273,    74,    75,    76,    77,   471,    39,    69,
-      70,    64,     4,   284,    74,    75,    76,    77,    79,    80,
-      70,   292,    69,    70,   295,   480,    71,   313,     4,   300,
-      42,   317,   303,   419,     4,     4,     5,    68,    69,    70,
-      52,    11,    70,   314,     1,   316,     4,     4,   319,    12,
-     336,   322,   323,   374,    12,    12,    69,   348,   347,   330,
-     331,   332,   333,     4,    40,    41,   337,   372,   339,     1,
-     341,    12,   343,     4,     1,   346,     1,     4,   383,    12,
-      13,    12,    39,   419,   355,   471,   357,    14,    15,    16,
-      17,    18,   378,    69,   399,   366,    72,    21,    61,   370,
-     371,   419,     4,    38,    20,   376,   421,    70,   394,    40,
-      41,    68,     1,     1,   385,     4,     4,   408,   404,   390,
-     406,   392,    12,    11,    12,    14,    15,    16,    17,    18,
-      63,     4,   418,    20,     1,   471,   457,     4,    11,     1,
-      42,    72,    69,    70,    11,   416,    73,    74,    75,    76,
-      77,    70,   423,   471,     1,   426,     1,   428,    69,     4,
-      71,    12,   433,    70,    70,    16,    11,   438,    12,   460,
-     441,   457,   443,    69,     1,    71,    64,    69,    71,    71,
-      69,    70,     4,   454,    73,    74,    75,    76,    77,    11,
-      12,    64,     4,     0,     1,     1,    71,    64,    26,    11,
-      12,    69,   473,    71,    11,    12,     1,    14,    15,    69,
-     481,    71,    73,   484,    65,    66,    73,    73,   489,   490,
-      69,    25,    71,    27,    28,    29,   497,    31,    32,    33,
-      12,    69,    39,    37,    42,   506,    43,    44,    45,    46,
-      47,    48,    49,    50,    51,    52,    53,    54,    55,    56,
-      57,    58,    59,    60,    61,    62,    63,    64,    65,     1,
-      67,    68,    69,    70,    71,     4,    69,    74,    75,     0,
-       1,    78,    69,     4,    81,    82,    83,    70,    70,     4,
-      11,    12,    73,    14,    15,     1,    70,    12,     4,    14,
-      15,    16,    17,    18,    19,    20,     4,    70,    14,    15,
-      16,    17,    18,    12,    70,    14,    15,    16,    17,    18,
-      19,    20,    43,    44,    45,    46,    47,    48,    49,    50,
-      51,    52,    53,    54,    55,    56,    57,    58,    59,    60,
-      61,    62,    63,    64,    65,     1,    67,    68,    69,    70,
-      71,    69,   347,    71,    75,    11,    12,    78,    14,    15,
-     420,    82,    83,    69,    70,   153,   388,    73,    74,    75,
-      76,    77,    12,   447,    14,    15,    16,    17,    18,    19,
-      14,    15,    16,    17,    18,   496,   367,    43,    44,    45,
-      46,    47,    48,    49,    50,    51,    52,    53,    54,    55,
-      56,    57,    58,    59,    60,    61,    62,    63,    64,    65,
-       1,    67,    68,    69,    70,    71,   436,   384,    74,    75,
-      11,    12,    78,    14,    15,    81,    82,    83,    43,    44,
+      71,   192,   133,   134,    72,   320,    71,   158,   139,   160,
+     156,   196,   197,   144,     1,   195,   147,   150,     5,     5,
+     151,   154,    74,    70,   155,    72,     5,   342,    75,   175,
+       1,   177,    12,   179,     5,     7,     8,     9,    10,    11,
+     171,     5,     1,     1,    15,    16,    17,    18,    19,     1,
+       0,     1,    70,   184,   185,    41,    42,     5,   189,   190,
+     191,     5,   419,     5,     1,     5,   381,    70,     5,   200,
+       1,    13,   205,     5,     1,     0,     1,   208,     5,    43,
+     211,    70,   397,    70,    71,    65,    17,    73,    75,    76,
+      77,    78,   283,    72,     1,     5,     5,   278,     5,    70,
+      71,     5,    70,    74,    75,    76,    77,    78,    80,    81,
+      17,    70,    70,     0,   471,   246,    75,    75,    70,   250,
+     251,    71,    70,    75,   275,     5,   311,    75,   259,    73,
+     263,    71,   278,    70,   265,   419,   442,   268,    70,    70,
+     305,   272,   273,    70,    71,    70,    71,    72,    75,    76,
+      77,    78,   419,   284,     7,     8,     9,    10,    11,   419,
+      70,   292,    71,    70,   295,   480,    70,   313,    42,   300,
+       5,   317,   303,     0,     1,     1,     5,    12,    52,    70,
+      70,    72,    72,   314,    13,   316,    13,   471,   319,    13,
+     336,   322,   323,   374,    70,     5,    72,   348,   347,   330,
+     331,   332,   333,    13,   471,     1,   337,   372,   339,     5,
+     341,   471,   343,    40,    70,   346,    72,     1,   383,    15,
+      16,    17,    18,    19,   355,     1,   357,    80,    81,     5,
+      65,    70,   378,    72,   399,   366,    22,    13,    62,   370,
+     371,    39,    69,    70,    71,   376,   421,    71,   394,    21,
+       5,     1,     1,    13,   385,     5,     5,   408,   404,   390,
+     406,   392,    21,    12,    40,    15,    16,    17,    18,    19,
+      71,    70,   418,    72,    70,    71,   457,     1,    74,    75,
+      76,    77,    78,    71,    13,   416,    41,    42,    17,    70,
+       5,    72,   423,    69,    71,   426,     5,   428,    13,     5,
+      35,    36,   433,    12,    13,    20,    21,   438,     1,   460,
+     441,   457,   443,     5,     6,    70,    65,    70,    73,    72,
+      70,    71,     5,   454,    74,    75,    76,    77,    78,    12,
+      13,    13,     0,     1,     1,    41,    42,    66,    67,    70,
+      72,    72,   473,     1,    12,    13,    72,    15,    16,    70,
+     481,    72,    70,   484,    72,    27,    13,    74,   489,   490,
+      70,    74,    72,    70,    70,    72,   497,    73,    70,    70,
+      72,    72,    40,     1,    74,   506,    44,    45,    46,    47,
+      48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
+      58,    59,    60,    61,    62,    63,    64,    65,    66,    70,
+      68,    69,    70,    71,    72,     0,     1,    75,    76,    43,
+       5,    79,     1,     5,    82,    83,    84,    12,    13,    70,
+      15,    16,    70,     1,    72,    70,     1,     5,    71,    70,
+       5,    72,    71,     5,    12,    13,    74,   420,    71,    71,
+      15,    16,    17,    18,    19,    71,   347,   447,   153,    44,
       45,    46,    47,    48,    49,    50,    51,    52,    53,    54,
-      55,    56,    57,    58,    59,    60,    61,    62,    63,    69,
-      47,    71,    43,    44,    45,    46,    47,    48,    49,    50,
-      51,    52,    53,    54,    55,    56,    57,    58,    59,    60,
-      61,    62,    63,    64,    65,   306,    67,    68,    69,    70,
-      71,   173,    81,    74,    75,     1,   286,    78,     4,   358,
-      81,    82,    83,     4,   451,    11,    12,   427,    14,    15,
-      69,    12,    71,    14,    15,    16,    17,    18,    19,    20,
-      21,    22,    23,    24,    69,    69,    71,    71,    69,    30,
-      71,    69,    69,    71,    71,   252,    94,    43,    44,    45,
+      55,    56,    57,    58,    59,    60,    61,    62,    63,    64,
+      65,    66,   388,    68,    69,    70,    71,    72,   367,     1,
+     436,    76,   496,    47,    79,   384,   306,    65,    83,    84,
+      12,    13,   173,    15,    16,    70,    71,     5,    81,    74,
+      75,    76,    77,    78,   286,    13,   358,    15,    16,    17,
+      18,    19,    20,    21,    13,   451,    15,    16,    17,    18,
+      19,    20,    44,    45,    46,    47,    48,    49,    50,    51,
+      52,    53,    54,    55,    56,    57,    58,    59,    60,    61,
+      62,    63,    64,    65,    66,    94,    68,    69,    70,    71,
+      72,   135,     1,    75,    76,     0,     1,    79,   427,   471,
+      82,    83,    84,    12,    13,   252,    15,    16,    13,   347,
+      15,    16,    17,    18,    19,    20,    21,    22,    23,    24,
+      25,   347,    -1,    -1,    -1,    13,    31,    15,    16,    17,
+      18,    19,    20,    21,    39,    44,    45,    46,    47,    48,
+      49,    50,    51,    52,    53,    54,    55,    56,    57,    58,
+      59,    60,    61,    62,    63,    64,    65,    66,    -1,    68,
+      69,    70,    71,    72,    -1,     1,    75,    76,    -1,     5,
+      79,    -1,    -1,    82,    83,    84,    12,    13,     5,    15,
+      16,    15,    16,    17,    18,    19,    13,    -1,    15,    16,
+      17,    18,    19,    20,    21,    22,    23,    24,    25,    -1,
+      -1,    -1,    -1,    -1,    31,    -1,    -1,    -1,    44,    45,
       46,    47,    48,    49,    50,    51,    52,    53,    54,    55,
       56,    57,    58,    59,    60,    61,    62,    63,    64,    65,
-     135,    67,    68,    69,    70,    71,   347,   347,     1,    75,
-     471,     4,    78,    69,    -1,    71,    82,    83,    11,    12,
-      -1,    14,    15,    69,    69,    71,    71,   485,    -1,   487,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      43,    44,    45,    46,    47,    48,    49,    50,    51,    52,
+      66,    -1,    68,    69,    70,    71,    72,    -1,     1,    -1,
+      76,    -1,     5,    79,    -1,    -1,    -1,    83,    84,    12,
+      13,    -1,    15,    16,    26,    -1,    28,    29,    30,    -1,
+      32,    33,    34,    -1,    -1,    -1,    38,    -1,    -1,    -1,
+      -1,     5,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    13,
+      -1,    44,    45,    46,    47,    48,    49,    50,    51,    52,
       53,    54,    55,    56,    57,    58,    59,    60,    61,    62,
-      63,    64,    65,     1,    67,    68,    -1,    -1,    -1,    -1,
-      73,    74,    75,    11,    12,    78,    14,    15,    81,    82,
-      83,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    43,    44,    45,    46,    47,
-      48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
-      58,    59,    60,    61,    62,    63,    64,    65,     1,    67,
-      68,    -1,    70,    -1,    -1,    -1,    74,    75,    11,    12,
-      78,    14,    15,    81,    82,    83,    -1,    -1,    -1,    -1,
+      63,    64,    65,    66,    -1,    68,    69,    41,    42,    -1,
+      -1,    74,    75,    76,     1,    -1,    79,    -1,    -1,    82,
+      83,    84,    -1,    -1,    -1,    12,    13,    -1,    15,    16,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    73,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    44,    45,    46,
+      47,    48,    49,    50,    51,    52,    53,    54,    55,    56,
+      57,    58,    59,    60,    61,    62,    63,    64,    65,    66,
+      -1,    68,    69,    -1,    71,    -1,    -1,     1,    75,    76,
+      -1,    -1,    79,    -1,    -1,    82,    83,    84,    12,    13,
+      -1,    15,    16,    44,    45,    46,    47,    48,    49,    50,
+      51,    52,    53,    54,    55,    56,    57,    58,    59,    60,
+      61,    62,    63,    64,    -1,    -1,    -1,    -1,    -1,    -1,
+      44,    45,    46,    47,    48,    49,    50,    51,    52,    53,
+      54,    55,    56,    57,    58,    59,    60,    61,    62,    63,
+      64,    65,    66,    -1,    68,    69,    -1,    -1,    -1,    -1,
+      74,    75,    76,     1,    -1,    79,    -1,     5,    82,    83,
+      84,    -1,    -1,    -1,    12,    13,    -1,    15,    16,    -1,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      43,    44,    45,    46,    47,    48,    49,    50,    51,    52,
-      53,    54,    55,    56,    57,    58,    59,    60,    61,    62,
-      63,    64,    65,     1,    67,    68,     4,    -1,    -1,    -1,
-      73,    74,    75,    11,    12,    78,    14,    15,    81,    82,
-      83,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    43,    44,    45,    46,    47,
+      -1,    -1,    -1,    -1,    -1,    -1,    44,    45,    46,    47,
       48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
-      58,    59,    60,    61,    62,    63,    64,    65,     4,    67,
-      68,    -1,    -1,    -1,    -1,    11,    12,    75,    14,    15,
-      78,    -1,    -1,    -1,    82,    83,    -1,    -1,    -1,    -1,
+      58,    59,    60,    61,    62,    63,    64,    65,    66,     5,
+      68,    69,    -1,    -1,    -1,    -1,    12,    13,    76,    15,
+      16,    79,    -1,    -1,    -1,    83,    84,    -1,    -1,    -1,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    43,    44,    45,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    44,    45,
       46,    47,    48,    49,    50,    51,    52,    53,    54,    55,
       56,    57,    58,    59,    60,    61,    62,    63,    64,    65,
-      -1,    67,    68,    11,    12,    -1,    14,    15,    -1,    75,
-      -1,    -1,    78,    -1,    -1,    -1,    82,    83,    -1,    -1,
+      66,    -1,    68,    69,    12,    13,    -1,    15,    16,    -1,
+      76,    -1,    -1,    79,    -1,    -1,    -1,    83,    84,    -1,
       -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
-      -1,    -1,    -1,    -1,    -1,    43,    44,    45,    46,    47,
+      -1,    -1,    -1,    -1,    -1,    -1,    44,    45,    46,    47,
       48,    49,    50,    51,    52,    53,    54,    55,    56,    57,
-      58,    59,    60,    61,    62,    63,    64,    65,    -1,    67,
-      68,    -1,    -1,    -1,     0,     1,    -1,    75,    -1,    -1,
-      78,    -1,    -1,    -1,    82,    83,    12,    -1,    14,    15,
-      16,    17,    18,    19,    20,    21,    22,    23,    24,     0,
-       1,    -1,    -1,    -1,    30,    -1,    -1,    -1,    -1,    -1,
-      -1,    12,    38,    14,    15,    16,    17,    18,    19,    20,
-      21,    22,    23,    24,    -1,    -1,    -1,    -1,    -1,    30,
-      -1,    -1,    -1,    -1,    -1,    -1,    -1,    38,    -1,    -1,
-      -1,    -1,    -1,    -1,    70
+      58,    59,    60,    61,    62,    63,    64,    65,    66,    -1,
+      68,    69,    -1,    -1,     0,     1,    -1,    -1,    76,    -1,
+      -1,    79,    -1,    -1,    -1,    83,    84,    13,    -1,    15,
+      16,    17,    18,    19,    20,    21,    22,    23,    24,    25,
+      -1,    -1,    -1,    -1,    -1,    31,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    39,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,    -1,
+      -1,    -1,    -1,    -1,    -1,    71
 };
 
 /* YYSTOS[STATE-NUM] -- The (internal number of the) accessing
    symbol of state STATE-NUM.  */
 static const yytype_uint8 yystos[] =
 {
-       0,    25,    27,    28,    29,    31,    32,    33,    37,    85,
-      87,    88,    89,    90,    91,    92,    93,    96,    98,     1,
-      94,    69,    69,    69,    69,     4,    69,    69,     0,    94,
-      94,    94,    94,    94,    94,    94,    95,    69,    71,   172,
-       4,    11,    94,    94,    94,    94,    94,    94,    94,     4,
-       5,    38,    99,   167,   168,     1,    94,    12,    14,    15,
-      16,    17,    18,    19,    20,    21,    22,    23,    24,    30,
-      86,   103,   108,   127,   129,   135,   136,   139,   140,   141,
-     142,   143,   144,   145,   146,   147,   148,   150,   153,     1,
-      12,    39,    68,   154,   155,   156,   157,   163,    12,    61,
-     132,   133,   134,    11,    12,    14,    15,    43,    44,    45,
-      46,    47,    48,    49,    50,    51,    52,    53,    54,    55,
-      56,    57,    58,    59,    60,    61,    62,    63,    64,    65,
-      67,    75,    78,    82,    83,   138,   159,   161,   162,   163,
-     164,   165,    40,    41,    72,   120,   121,   123,   124,   140,
-       1,    12,   111,   112,   113,   114,     1,   100,   108,    95,
-     167,     0,    70,    97,   172,   173,    71,    20,    12,    16,
-      65,    66,    12,    94,    20,     1,    94,     1,    94,     1,
-      94,    94,    94,     1,    69,    74,   144,     1,     4,    75,
-      76,    77,   137,    12,    19,   145,   146,   146,     1,   147,
-      71,   173,    94,    94,    70,     1,   156,   173,    71,   173,
-       1,    16,   172,    94,    94,    94,    94,    94,    94,    94,
-      94,    94,    94,    94,    94,    94,    94,    94,    94,    94,
-      94,    94,    94,    94,    94,    94,    94,    94,    94,    94,
-      94,    94,    94,    94,    94,    94,    60,   162,     1,    70,
-      74,    81,   160,    94,    94,    94,    94,    70,    70,    71,
-     173,    94,    70,     1,   113,    71,   173,     1,    16,    94,
-      71,   172,    34,    35,   101,   109,    95,    95,     1,    12,
-      12,    13,    63,    94,    12,    19,   143,   149,    71,   172,
-      11,    64,   117,    71,   172,    69,   124,   126,    71,   172,
-      69,    11,    12,   130,    70,    94,    94,    94,    94,    94,
-     144,   146,    94,     1,    71,   173,    71,     1,    94,    71,
-      94,    70,    69,    74,     1,   159,    94,    94,    94,   161,
-      12,   118,    42,    12,   128,    94,     1,    71,   173,    71,
-      94,    71,    94,    69,    94,    94,    26,   102,   115,    95,
-      97,   172,    73,    73,    73,   144,    94,    12,   149,     6,
-       7,     8,     9,    10,    79,    80,   151,    94,    94,     1,
-      69,    74,    94,    94,   154,   142,    71,    94,     1,    94,
-      94,     1,   159,    94,    94,    73,    94,    94,    94,    94,
-      42,   122,    71,    94,     1,    94,    94,     1,   159,    94,
-     125,   126,    36,   110,     1,    94,     1,   103,   104,   108,
-     167,   169,   171,    95,    94,    79,   151,    94,   125,   105,
-      94,    94,   154,    69,    97,    94,    71,   159,    39,   158,
-     154,   134,    94,    16,   119,   120,    94,    94,    71,   159,
-     154,    69,     4,    69,    71,   172,    12,   116,   172,    95,
-      73,    94,    11,    12,   152,    71,   172,     1,    97,   106,
-     107,   127,   129,   135,   136,   139,   166,   167,   169,   170,
-     171,   105,   124,    70,    94,    94,   158,    94,     1,    70,
-      94,    73,   121,    94,    70,    94,   126,    94,     4,   117,
-     152,    94,    97,    95,   166,    94,   131,   159,    94,    94,
-     111,   111,    94,    94,    79,    70,   132,    94,    70,    70,
-      71,    79,    94
+       0,    26,    28,    29,    30,    32,    33,    34,    38,    86,
+      88,    89,    90,    91,    92,    93,    94,    97,    99,     1,
+      95,    70,    70,    70,    70,     5,    70,    70,     0,    95,
+      95,    95,    95,    95,    95,    95,    96,    70,    72,   173,
+       5,    12,    95,    95,    95,    95,    95,    95,    95,     5,
+       6,    39,   100,   168,   169,     1,    95,    13,    15,    16,
+      17,    18,    19,    20,    21,    22,    23,    24,    25,    31,
+      87,   104,   109,   128,   130,   136,   137,   140,   141,   142,
+     143,   144,   145,   146,   147,   148,   149,   151,   154,     1,
+      13,    40,    69,   155,   156,   157,   158,   164,    13,    62,
+     133,   134,   135,    12,    13,    15,    16,    44,    45,    46,
+      47,    48,    49,    50,    51,    52,    53,    54,    55,    56,
+      57,    58,    59,    60,    61,    62,    63,    64,    65,    66,
+      68,    76,    79,    83,    84,   139,   160,   162,   163,   164,
+     165,   166,    41,    42,    73,   121,   122,   124,   125,   141,
+       1,    13,   112,   113,   114,   115,     1,   101,   109,    96,
+     168,     0,    71,    98,   173,   174,    72,    21,    13,    17,
+      66,    67,    13,    95,    21,     1,    95,     1,    95,     1,
+      95,    95,    95,     1,    70,    75,   145,     1,     5,    76,
+      77,    78,   138,    13,    20,   146,   147,   147,     1,   148,
+      72,   174,    95,    95,    71,     1,   157,   174,    72,   174,
+       1,    17,   173,    95,    95,    95,    95,    95,    95,    95,
+      95,    95,    95,    95,    95,    95,    95,    95,    95,    95,
+      95,    95,    95,    95,    95,    95,    95,    95,    95,    95,
+      95,    95,    95,    95,    95,    95,    61,   163,     1,    71,
+      75,    82,   161,    95,    95,    95,    95,    71,    71,    72,
+     174,    95,    71,     1,   114,    72,   174,     1,    17,    95,
+      72,   173,    35,    36,   102,   110,    96,    96,     1,    13,
+      13,    14,    64,    95,    13,    20,   144,   150,    72,   173,
+      12,    65,   118,    72,   173,    70,   125,   127,    72,   173,
+      70,    12,    13,   131,    71,    95,    95,    95,    95,    95,
+     145,   147,    95,     1,    72,   174,    72,     1,    95,    72,
+      95,    71,    70,    75,     1,   160,    95,    95,    95,   162,
+      13,   119,    43,    13,   129,    95,     1,    72,   174,    72,
+      95,    72,    95,    70,    95,    95,    27,   103,   116,    96,
+      98,   173,    74,    74,    74,   145,    95,    13,   150,     7,
+       8,     9,    10,    11,    80,    81,   152,    95,    95,     1,
+      70,    75,    95,    95,   155,   143,    72,    95,     1,    95,
+      95,     1,   160,    95,    95,    74,    95,    95,    95,    95,
+      43,   123,    72,    95,     1,    95,    95,     1,   160,    95,
+     126,   127,    37,   111,     1,    95,     1,   104,   105,   109,
+     168,   170,   172,    96,    95,    80,   152,    95,   126,   106,
+      95,    95,   155,    70,    98,    95,    72,   160,    40,   159,
+     155,   135,    95,    17,   120,   121,    95,    95,    72,   160,
+     155,    70,     5,    70,    72,   173,    13,   117,   173,    96,
+      74,    95,    12,    13,   153,    72,   173,     1,    98,   107,
+     108,   128,   130,   136,   137,   140,   167,   168,   170,   171,
+     172,   106,   125,    71,    95,    95,   159,    95,     1,    71,
+      95,    74,   122,    95,    71,    95,   127,    95,     5,   118,
+     153,    95,    98,    96,   167,    95,   132,   160,    95,    95,
+     112,   112,    95,    95,    80,    71,   133,    95,    71,    71,
+      72,    80,    95
 };
 
 #define yyerrok		(yyerrstatus = 0)
@@ -2176,35 +2188,35 @@ yyreduce:
   switch (yyn)
     {
         case 12:
-#line 279 "../css/CSSGrammar.y"
+#line 282 "../css/CSSGrammar.y"
     {
         static_cast<CSSParser*>(parser)->m_rule = (yyvsp[(4) - (6)].rule);
     ;}
     break;
 
   case 13:
-#line 285 "../css/CSSGrammar.y"
+#line 288 "../css/CSSGrammar.y"
     {
         static_cast<CSSParser*>(parser)->m_keyframe = (yyvsp[(4) - (6)].keyframeRule);
     ;}
     break;
 
   case 14:
-#line 291 "../css/CSSGrammar.y"
+#line 294 "../css/CSSGrammar.y"
     {
         /* can be empty */
     ;}
     break;
 
   case 15:
-#line 297 "../css/CSSGrammar.y"
+#line 300 "../css/CSSGrammar.y"
     {
         /* can be empty */
     ;}
     break;
 
   case 16:
-#line 303 "../css/CSSGrammar.y"
+#line 306 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         if ((yyvsp[(4) - (5)].valueList)) {
@@ -2219,7 +2231,7 @@ yyreduce:
     break;
 
   case 17:
-#line 317 "../css/CSSGrammar.y"
+#line 320 "../css/CSSGrammar.y"
     {
          CSSParser* p = static_cast<CSSParser*>(parser);
          p->m_mediaQuery = p->sinkFloatingMediaQuery((yyvsp[(4) - (5)].mediaQuery));
@@ -2227,7 +2239,7 @@ yyreduce:
     break;
 
   case 18:
-#line 324 "../css/CSSGrammar.y"
+#line 327 "../css/CSSGrammar.y"
     {
         if ((yyvsp[(4) - (5)].selectorList)) {
             CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2238,13 +2250,13 @@ yyreduce:
     break;
 
   case 25:
-#line 346 "../css/CSSGrammar.y"
+#line 349 "../css/CSSGrammar.y"
     {
   ;}
     break;
 
   case 28:
-#line 356 "../css/CSSGrammar.y"
+#line 359 "../css/CSSGrammar.y"
     {
      CSSParser* p = static_cast<CSSParser*>(parser);
      (yyval.rule) = static_cast<CSSParser*>(parser)->createCharsetRule((yyvsp[(3) - (5)].string));
@@ -2254,19 +2266,19 @@ yyreduce:
     break;
 
   case 29:
-#line 362 "../css/CSSGrammar.y"
+#line 365 "../css/CSSGrammar.y"
     {
   ;}
     break;
 
   case 30:
-#line 364 "../css/CSSGrammar.y"
+#line 367 "../css/CSSGrammar.y"
     {
   ;}
     break;
 
   case 32:
-#line 370 "../css/CSSGrammar.y"
+#line 373 "../css/CSSGrammar.y"
     {
      CSSParser* p = static_cast<CSSParser*>(parser);
      if ((yyvsp[(2) - (3)].rule) && p->m_styleSheet)
@@ -2275,13 +2287,13 @@ yyreduce:
     break;
 
   case 33:
-#line 375 "../css/CSSGrammar.y"
+#line 378 "../css/CSSGrammar.y"
     {
  ;}
     break;
 
   case 35:
-#line 381 "../css/CSSGrammar.y"
+#line 384 "../css/CSSGrammar.y"
     {
     CSSParser* p = static_cast<CSSParser*>(parser);
      if ((yyvsp[(2) - (3)].rule) && p->m_styleSheet)
@@ -2290,7 +2302,7 @@ yyreduce:
     break;
 
   case 39:
-#line 395 "../css/CSSGrammar.y"
+#line 398 "../css/CSSGrammar.y"
     {
      CSSParser* p = static_cast<CSSParser*>(parser);
      if ((yyvsp[(2) - (3)].rule) && p->m_styleSheet)
@@ -2299,12 +2311,12 @@ yyreduce:
     break;
 
   case 49:
-#line 418 "../css/CSSGrammar.y"
+#line 421 "../css/CSSGrammar.y"
     { (yyval.ruleList) = 0; ;}
     break;
 
   case 50:
-#line 419 "../css/CSSGrammar.y"
+#line 422 "../css/CSSGrammar.y"
     {
       (yyval.ruleList) = (yyvsp[(1) - (3)].ruleList);
       if ((yyvsp[(2) - (3)].rule)) {
@@ -2316,70 +2328,70 @@ yyreduce:
     break;
 
   case 60:
-#line 446 "../css/CSSGrammar.y"
+#line 449 "../css/CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createImportRule((yyvsp[(3) - (6)].string), (yyvsp[(5) - (6)].mediaList));
     ;}
     break;
 
   case 61:
-#line 449 "../css/CSSGrammar.y"
+#line 452 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
   case 62:
-#line 452 "../css/CSSGrammar.y"
+#line 455 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
   case 63:
-#line 455 "../css/CSSGrammar.y"
+#line 458 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
   case 64:
-#line 461 "../css/CSSGrammar.y"
+#line 464 "../css/CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createVariablesRule((yyvsp[(3) - (7)].mediaList), true);
     ;}
     break;
 
   case 65:
-#line 465 "../css/CSSGrammar.y"
+#line 468 "../css/CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createVariablesRule((yyvsp[(3) - (7)].mediaList), false);
     ;}
     break;
 
   case 66:
-#line 471 "../css/CSSGrammar.y"
+#line 474 "../css/CSSGrammar.y"
     {
         (yyval.mediaList) = static_cast<CSSParser*>(parser)->createMediaList();
     ;}
     break;
 
   case 67:
-#line 475 "../css/CSSGrammar.y"
+#line 478 "../css/CSSGrammar.y"
     {
         (yyval.mediaList) = (yyvsp[(3) - (3)].mediaList);
     ;}
     break;
 
   case 68:
-#line 481 "../css/CSSGrammar.y"
+#line 484 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (1)].boolean);
     ;}
     break;
 
   case 69:
-#line 484 "../css/CSSGrammar.y"
+#line 487 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
         if ((yyvsp[(2) - (2)].boolean))
@@ -2388,63 +2400,63 @@ yyreduce:
     break;
 
   case 70:
-#line 489 "../css/CSSGrammar.y"
+#line 492 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (1)].boolean);
     ;}
     break;
 
   case 71:
-#line 492 "../css/CSSGrammar.y"
+#line 495 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 72:
-#line 495 "../css/CSSGrammar.y"
+#line 498 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 73:
-#line 498 "../css/CSSGrammar.y"
+#line 501 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
     ;}
     break;
 
   case 74:
-#line 504 "../css/CSSGrammar.y"
+#line 507 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (3)].boolean);
     ;}
     break;
 
   case 75:
-#line 507 "../css/CSSGrammar.y"
+#line 510 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 76:
-#line 510 "../css/CSSGrammar.y"
+#line 513 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 77:
-#line 513 "../css/CSSGrammar.y"
+#line 516 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 78:
-#line 516 "../css/CSSGrammar.y"
+#line 519 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (4)].boolean);
         if ((yyvsp[(2) - (4)].boolean))
@@ -2453,49 +2465,49 @@ yyreduce:
     break;
 
   case 79:
-#line 521 "../css/CSSGrammar.y"
+#line 524 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (4)].boolean);
     ;}
     break;
 
   case 80:
-#line 524 "../css/CSSGrammar.y"
+#line 527 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (6)].boolean);
     ;}
     break;
 
   case 81:
-#line 530 "../css/CSSGrammar.y"
+#line 533 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = static_cast<CSSParser*>(parser)->addVariable((yyvsp[(1) - (4)].string), (yyvsp[(4) - (4)].valueList));
     ;}
     break;
 
   case 82:
-#line 534 "../css/CSSGrammar.y"
+#line 537 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = static_cast<CSSParser*>(parser)->addVariableDeclarationBlock((yyvsp[(1) - (7)].string));
     ;}
     break;
 
   case 83:
-#line 538 "../css/CSSGrammar.y"
+#line 541 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 84:
-#line 542 "../css/CSSGrammar.y"
+#line 545 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 85:
-#line 546 "../css/CSSGrammar.y"
+#line 549 "../css/CSSGrammar.y"
     {
         /* @variables { varname: } Just reduce away this variable with no value. */
         (yyval.boolean) = false;
@@ -2503,7 +2515,7 @@ yyreduce:
     break;
 
   case 86:
-#line 551 "../css/CSSGrammar.y"
+#line 554 "../css/CSSGrammar.y"
     {
         /* if we come across rules with invalid values like this case: @variables { varname: *; }, just discard the property/value pair */
         (yyval.boolean) = false;
@@ -2511,14 +2523,14 @@ yyreduce:
     break;
 
   case 87:
-#line 558 "../css/CSSGrammar.y"
+#line 561 "../css/CSSGrammar.y"
     {
         (yyval.string) = (yyvsp[(1) - (2)].string);
     ;}
     break;
 
   case 88:
-#line 564 "../css/CSSGrammar.y"
+#line 567 "../css/CSSGrammar.y"
     {
     CSSParser* p = static_cast<CSSParser*>(parser);
     if (p->m_styleSheet)
@@ -2527,38 +2539,38 @@ yyreduce:
     break;
 
   case 91:
-#line 574 "../css/CSSGrammar.y"
+#line 577 "../css/CSSGrammar.y"
     { (yyval.string).characters = 0; ;}
     break;
 
   case 92:
-#line 575 "../css/CSSGrammar.y"
+#line 578 "../css/CSSGrammar.y"
     { (yyval.string) = (yyvsp[(1) - (2)].string); ;}
     break;
 
   case 95:
-#line 584 "../css/CSSGrammar.y"
+#line 587 "../css/CSSGrammar.y"
     {
         (yyval.string) = (yyvsp[(1) - (2)].string);
     ;}
     break;
 
   case 96:
-#line 590 "../css/CSSGrammar.y"
+#line 593 "../css/CSSGrammar.y"
     {
         (yyval.valueList) = 0;
     ;}
     break;
 
   case 97:
-#line 593 "../css/CSSGrammar.y"
+#line 596 "../css/CSSGrammar.y"
     {
         (yyval.valueList) = (yyvsp[(3) - (4)].valueList);
     ;}
     break;
 
   case 98:
-#line 599 "../css/CSSGrammar.y"
+#line 602 "../css/CSSGrammar.y"
     {
         (yyvsp[(3) - (7)].string).lower();
         (yyval.mediaQueryExp) = static_cast<CSSParser*>(parser)->createFloatingMediaQueryExp((yyvsp[(3) - (7)].string), (yyvsp[(5) - (7)].valueList));
@@ -2566,7 +2578,7 @@ yyreduce:
     break;
 
   case 99:
-#line 606 "../css/CSSGrammar.y"
+#line 609 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.mediaQueryExpList) = p->createFloatingMediaQueryExpList();
@@ -2575,7 +2587,7 @@ yyreduce:
     break;
 
   case 100:
-#line 611 "../css/CSSGrammar.y"
+#line 614 "../css/CSSGrammar.y"
     {
         (yyval.mediaQueryExpList) = (yyvsp[(1) - (5)].mediaQueryExpList);
         (yyval.mediaQueryExpList)->append(static_cast<CSSParser*>(parser)->sinkFloatingMediaQueryExp((yyvsp[(5) - (5)].mediaQueryExp)));
@@ -2583,42 +2595,42 @@ yyreduce:
     break;
 
   case 101:
-#line 618 "../css/CSSGrammar.y"
+#line 621 "../css/CSSGrammar.y"
     {
         (yyval.mediaQueryExpList) = static_cast<CSSParser*>(parser)->createFloatingMediaQueryExpList();
     ;}
     break;
 
   case 102:
-#line 621 "../css/CSSGrammar.y"
+#line 624 "../css/CSSGrammar.y"
     {
         (yyval.mediaQueryExpList) = (yyvsp[(3) - (3)].mediaQueryExpList);
     ;}
     break;
 
   case 103:
-#line 627 "../css/CSSGrammar.y"
+#line 630 "../css/CSSGrammar.y"
     {
         (yyval.mediaQueryRestrictor) = MediaQuery::None;
     ;}
     break;
 
   case 104:
-#line 630 "../css/CSSGrammar.y"
+#line 633 "../css/CSSGrammar.y"
     {
         (yyval.mediaQueryRestrictor) = MediaQuery::Only;
     ;}
     break;
 
   case 105:
-#line 633 "../css/CSSGrammar.y"
+#line 636 "../css/CSSGrammar.y"
     {
         (yyval.mediaQueryRestrictor) = MediaQuery::Not;
     ;}
     break;
 
   case 106:
-#line 639 "../css/CSSGrammar.y"
+#line 642 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.mediaQuery) = p->createFloatingMediaQuery(p->sinkFloatingMediaQueryExpList((yyvsp[(1) - (1)].mediaQueryExpList)));
@@ -2626,7 +2638,7 @@ yyreduce:
     break;
 
   case 107:
-#line 644 "../css/CSSGrammar.y"
+#line 647 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyvsp[(3) - (4)].string).lower();
@@ -2635,14 +2647,14 @@ yyreduce:
     break;
 
   case 108:
-#line 652 "../css/CSSGrammar.y"
+#line 655 "../css/CSSGrammar.y"
     {
         (yyval.mediaList) = static_cast<CSSParser*>(parser)->createMediaList();
      ;}
     break;
 
   case 110:
-#line 659 "../css/CSSGrammar.y"
+#line 662 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.mediaList) = p->createMediaList();
@@ -2651,7 +2663,7 @@ yyreduce:
     break;
 
   case 111:
-#line 664 "../css/CSSGrammar.y"
+#line 667 "../css/CSSGrammar.y"
     {
         (yyval.mediaList) = (yyvsp[(1) - (4)].mediaList);
         if ((yyval.mediaList))
@@ -2660,35 +2672,35 @@ yyreduce:
     break;
 
   case 112:
-#line 669 "../css/CSSGrammar.y"
+#line 672 "../css/CSSGrammar.y"
     {
         (yyval.mediaList) = 0;
     ;}
     break;
 
   case 113:
-#line 675 "../css/CSSGrammar.y"
+#line 678 "../css/CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createMediaRule((yyvsp[(3) - (7)].mediaList), (yyvsp[(6) - (7)].ruleList));
     ;}
     break;
 
   case 114:
-#line 678 "../css/CSSGrammar.y"
+#line 681 "../css/CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createMediaRule(0, (yyvsp[(5) - (6)].ruleList));
     ;}
     break;
 
   case 115:
-#line 684 "../css/CSSGrammar.y"
+#line 687 "../css/CSSGrammar.y"
     {
       (yyval.string) = (yyvsp[(1) - (2)].string);
   ;}
     break;
 
   case 116:
-#line 690 "../css/CSSGrammar.y"
+#line 693 "../css/CSSGrammar.y"
     {
         (yyval.rule) = (yyvsp[(7) - (8)].keyframesRule);
         (yyvsp[(7) - (8)].keyframesRule)->setNameInternal((yyvsp[(3) - (8)].string));
@@ -2696,12 +2708,12 @@ yyreduce:
     break;
 
   case 119:
-#line 702 "../css/CSSGrammar.y"
+#line 705 "../css/CSSGrammar.y"
     { (yyval.keyframesRule) = static_cast<CSSParser*>(parser)->createKeyframesRule(); ;}
     break;
 
   case 120:
-#line 703 "../css/CSSGrammar.y"
+#line 706 "../css/CSSGrammar.y"
     {
         (yyval.keyframesRule) = (yyvsp[(1) - (3)].keyframesRule);
         if ((yyvsp[(2) - (3)].keyframeRule))
@@ -2710,14 +2722,14 @@ yyreduce:
     break;
 
   case 121:
-#line 711 "../css/CSSGrammar.y"
+#line 714 "../css/CSSGrammar.y"
     {
         (yyval.keyframeRule) = static_cast<CSSParser*>(parser)->createKeyframeRule((yyvsp[(1) - (6)].valueList));
     ;}
     break;
 
   case 122:
-#line 717 "../css/CSSGrammar.y"
+#line 720 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.valueList) = p->createFloatingValueList();
@@ -2726,7 +2738,7 @@ yyreduce:
     break;
 
   case 123:
-#line 722 "../css/CSSGrammar.y"
+#line 725 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.valueList) = (yyvsp[(1) - (5)].valueList);
@@ -2736,12 +2748,12 @@ yyreduce:
     break;
 
   case 124:
-#line 731 "../css/CSSGrammar.y"
+#line 734 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).isInt = false; (yyval.value).fValue = (yyvsp[(1) - (1)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_NUMBER; ;}
     break;
 
   case 125:
-#line 732 "../css/CSSGrammar.y"
+#line 735 "../css/CSSGrammar.y"
     {
         (yyval.value).id = 0; (yyval.value).isInt = false; (yyval.value).unit = CSSPrimitiveValue::CSS_NUMBER;
         CSSParserString& str = (yyvsp[(1) - (1)].string);
@@ -2755,74 +2767,74 @@ yyreduce:
     break;
 
   case 126:
-#line 756 "../css/CSSGrammar.y"
+#line 759 "../css/CSSGrammar.y"
     {
       (yyval.rule) = 0;
     ;}
     break;
 
   case 127:
-#line 759 "../css/CSSGrammar.y"
+#line 762 "../css/CSSGrammar.y"
     {
       (yyval.rule) = 0;
     ;}
     break;
 
   case 128:
-#line 766 "../css/CSSGrammar.y"
+#line 769 "../css/CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createFontFaceRule();
     ;}
     break;
 
   case 129:
-#line 769 "../css/CSSGrammar.y"
+#line 772 "../css/CSSGrammar.y"
     {
       (yyval.rule) = 0;
     ;}
     break;
 
   case 130:
-#line 772 "../css/CSSGrammar.y"
+#line 775 "../css/CSSGrammar.y"
     {
       (yyval.rule) = 0;
     ;}
     break;
 
   case 131:
-#line 778 "../css/CSSGrammar.y"
+#line 781 "../css/CSSGrammar.y"
     { (yyval.relation) = CSSSelector::DirectAdjacent; ;}
     break;
 
   case 132:
-#line 779 "../css/CSSGrammar.y"
+#line 782 "../css/CSSGrammar.y"
     { (yyval.relation) = CSSSelector::IndirectAdjacent; ;}
     break;
 
   case 133:
-#line 780 "../css/CSSGrammar.y"
+#line 783 "../css/CSSGrammar.y"
     { (yyval.relation) = CSSSelector::Child; ;}
     break;
 
   case 134:
-#line 784 "../css/CSSGrammar.y"
+#line 787 "../css/CSSGrammar.y"
     { (yyval.integer) = -1; ;}
     break;
 
   case 135:
-#line 785 "../css/CSSGrammar.y"
+#line 788 "../css/CSSGrammar.y"
     { (yyval.integer) = 1; ;}
     break;
 
   case 136:
-#line 789 "../css/CSSGrammar.y"
+#line 792 "../css/CSSGrammar.y"
     {
         (yyval.rule) = static_cast<CSSParser*>(parser)->createStyleRule((yyvsp[(1) - (5)].selectorList));
     ;}
     break;
 
   case 137:
-#line 795 "../css/CSSGrammar.y"
+#line 798 "../css/CSSGrammar.y"
     {
         if ((yyvsp[(1) - (1)].selector)) {
             CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2835,7 +2847,7 @@ yyreduce:
     break;
 
   case 138:
-#line 804 "../css/CSSGrammar.y"
+#line 807 "../css/CSSGrammar.y"
     {
         if ((yyvsp[(1) - (4)].selectorList) && (yyvsp[(4) - (4)].selector)) {
             CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2847,35 +2859,35 @@ yyreduce:
     break;
 
   case 139:
-#line 812 "../css/CSSGrammar.y"
+#line 815 "../css/CSSGrammar.y"
     {
         (yyval.selectorList) = 0;
     ;}
     break;
 
   case 140:
-#line 818 "../css/CSSGrammar.y"
+#line 821 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (2)].selector);
     ;}
     break;
 
   case 141:
-#line 824 "../css/CSSGrammar.y"
+#line 827 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (1)].selector);
     ;}
     break;
 
   case 142:
-#line 828 "../css/CSSGrammar.y"
+#line 831 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (1)].selector);
     ;}
     break;
 
   case 143:
-#line 832 "../css/CSSGrammar.y"
+#line 835 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(2) - (2)].selector);
         if (!(yyvsp[(1) - (2)].selector))
@@ -2894,7 +2906,7 @@ yyreduce:
     break;
 
   case 144:
-#line 847 "../css/CSSGrammar.y"
+#line 850 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(3) - (3)].selector);
         if (!(yyvsp[(1) - (3)].selector))
@@ -2918,29 +2930,29 @@ yyreduce:
     break;
 
   case 145:
-#line 867 "../css/CSSGrammar.y"
+#line 870 "../css/CSSGrammar.y"
     {
         (yyval.selector) = 0;
     ;}
     break;
 
   case 146:
-#line 873 "../css/CSSGrammar.y"
+#line 876 "../css/CSSGrammar.y"
     { (yyval.string).characters = 0; (yyval.string).length = 0; ;}
     break;
 
   case 147:
-#line 874 "../css/CSSGrammar.y"
+#line 877 "../css/CSSGrammar.y"
     { static UChar star = '*'; (yyval.string).characters = &star; (yyval.string).length = 1; ;}
     break;
 
   case 148:
-#line 875 "../css/CSSGrammar.y"
+#line 878 "../css/CSSGrammar.y"
     { (yyval.string) = (yyvsp[(1) - (2)].string); ;}
     break;
 
   case 149:
-#line 879 "../css/CSSGrammar.y"
+#line 882 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
@@ -2949,7 +2961,7 @@ yyreduce:
     break;
 
   case 150:
-#line 884 "../css/CSSGrammar.y"
+#line 887 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(2) - (2)].selector);
         if ((yyval.selector)) {
@@ -2960,7 +2972,7 @@ yyreduce:
     break;
 
   case 151:
-#line 891 "../css/CSSGrammar.y"
+#line 894 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (1)].selector);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2970,7 +2982,7 @@ yyreduce:
     break;
 
   case 152:
-#line 897 "../css/CSSGrammar.y"
+#line 900 "../css/CSSGrammar.y"
     {
         AtomicString namespacePrefix = (yyvsp[(1) - (2)].string);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -2984,7 +2996,7 @@ yyreduce:
     break;
 
   case 153:
-#line 907 "../css/CSSGrammar.y"
+#line 910 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(3) - (3)].selector);
         if ((yyval.selector)) {
@@ -3000,7 +3012,7 @@ yyreduce:
     break;
 
   case 154:
-#line 919 "../css/CSSGrammar.y"
+#line 922 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(2) - (2)].selector);
         if ((yyval.selector)) {
@@ -3014,7 +3026,7 @@ yyreduce:
     break;
 
   case 155:
-#line 932 "../css/CSSGrammar.y"
+#line 935 "../css/CSSGrammar.y"
     {
         CSSParserString& str = (yyvsp[(1) - (1)].string);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3026,7 +3038,7 @@ yyreduce:
     break;
 
   case 156:
-#line 940 "../css/CSSGrammar.y"
+#line 943 "../css/CSSGrammar.y"
     {
         static UChar star = '*';
         (yyval.string).characters = &star;
@@ -3035,14 +3047,14 @@ yyreduce:
     break;
 
   case 157:
-#line 948 "../css/CSSGrammar.y"
+#line 951 "../css/CSSGrammar.y"
     {
         (yyval.selector) = (yyvsp[(1) - (1)].selector);
     ;}
     break;
 
   case 158:
-#line 951 "../css/CSSGrammar.y"
+#line 954 "../css/CSSGrammar.y"
     {
         if (!(yyvsp[(2) - (2)].selector))
             (yyval.selector) = 0;
@@ -3059,14 +3071,14 @@ yyreduce:
     break;
 
   case 159:
-#line 964 "../css/CSSGrammar.y"
+#line 967 "../css/CSSGrammar.y"
     {
         (yyval.selector) = 0;
     ;}
     break;
 
   case 160:
-#line 970 "../css/CSSGrammar.y"
+#line 973 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
@@ -3078,7 +3090,7 @@ yyreduce:
     break;
 
   case 161:
-#line 978 "../css/CSSGrammar.y"
+#line 981 "../css/CSSGrammar.y"
     {
         if ((yyvsp[(1) - (1)].string).characters[0] >= '0' && (yyvsp[(1) - (1)].string).characters[0] <= '9') {
             (yyval.selector) = 0;
@@ -3094,7 +3106,7 @@ yyreduce:
     break;
 
   case 165:
-#line 996 "../css/CSSGrammar.y"
+#line 999 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
@@ -3106,7 +3118,7 @@ yyreduce:
     break;
 
   case 166:
-#line 1007 "../css/CSSGrammar.y"
+#line 1010 "../css/CSSGrammar.y"
     {
         CSSParserString& str = (yyvsp[(1) - (2)].string);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3118,7 +3130,7 @@ yyreduce:
     break;
 
   case 167:
-#line 1018 "../css/CSSGrammar.y"
+#line 1021 "../css/CSSGrammar.y"
     {
         (yyval.selector) = static_cast<CSSParser*>(parser)->createFloatingSelector();
         (yyval.selector)->setAttribute(QualifiedName(nullAtom, (yyvsp[(3) - (4)].string), nullAtom));
@@ -3127,7 +3139,7 @@ yyreduce:
     break;
 
   case 168:
-#line 1023 "../css/CSSGrammar.y"
+#line 1026 "../css/CSSGrammar.y"
     {
         (yyval.selector) = static_cast<CSSParser*>(parser)->createFloatingSelector();
         (yyval.selector)->setAttribute(QualifiedName(nullAtom, (yyvsp[(3) - (8)].string), nullAtom));
@@ -3137,7 +3149,7 @@ yyreduce:
     break;
 
   case 169:
-#line 1029 "../css/CSSGrammar.y"
+#line 1032 "../css/CSSGrammar.y"
     {
         AtomicString namespacePrefix = (yyvsp[(3) - (5)].string);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3149,7 +3161,7 @@ yyreduce:
     break;
 
   case 170:
-#line 1037 "../css/CSSGrammar.y"
+#line 1040 "../css/CSSGrammar.y"
     {
         AtomicString namespacePrefix = (yyvsp[(3) - (9)].string);
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3162,49 +3174,49 @@ yyreduce:
     break;
 
   case 171:
-#line 1049 "../css/CSSGrammar.y"
+#line 1052 "../css/CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::Exact;
     ;}
     break;
 
   case 172:
-#line 1052 "../css/CSSGrammar.y"
+#line 1055 "../css/CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::List;
     ;}
     break;
 
   case 173:
-#line 1055 "../css/CSSGrammar.y"
+#line 1058 "../css/CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::Hyphen;
     ;}
     break;
 
   case 174:
-#line 1058 "../css/CSSGrammar.y"
+#line 1061 "../css/CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::Begin;
     ;}
     break;
 
   case 175:
-#line 1061 "../css/CSSGrammar.y"
+#line 1064 "../css/CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::End;
     ;}
     break;
 
   case 176:
-#line 1064 "../css/CSSGrammar.y"
+#line 1067 "../css/CSSGrammar.y"
     {
         (yyval.integer) = CSSSelector::Contain;
     ;}
     break;
 
   case 179:
-#line 1075 "../css/CSSGrammar.y"
+#line 1078 "../css/CSSGrammar.y"
     {
         (yyval.selector) = static_cast<CSSParser*>(parser)->createFloatingSelector();
         (yyval.selector)->m_match = CSSSelector::PseudoClass;
@@ -3228,12 +3240,17 @@ yyreduce:
             CSSParser* p = static_cast<CSSParser*>(parser);
             if (Document* doc = p->document())
                 doc->setUsesFirstLineRules(true);
+        } else if (type == CSSSelector::PseudoBefore ||
+                   type == CSSSelector::PseudoAfter) {
+            CSSParser* p = static_cast<CSSParser*>(parser);
+            if (Document* doc = p->document())
+                doc->setUsesBeforeAfterRules(true);
         }
     ;}
     break;
 
   case 180:
-#line 1100 "../css/CSSGrammar.y"
+#line 1108 "../css/CSSGrammar.y"
     {
         (yyval.selector) = static_cast<CSSParser*>(parser)->createFloatingSelector();
         (yyval.selector)->m_match = CSSSelector::PseudoElement;
@@ -3246,12 +3263,17 @@ yyreduce:
             CSSParser* p = static_cast<CSSParser*>(parser);
             if (Document* doc = p->document())
                 doc->setUsesFirstLineRules(true);
+        } else if (type == CSSSelector::PseudoBefore ||
+                   type == CSSSelector::PseudoAfter) {
+            CSSParser* p = static_cast<CSSParser*>(parser);
+            if (Document* doc = p->document())
+                doc->setUsesBeforeAfterRules(true);
         }
     ;}
     break;
 
   case 181:
-#line 1115 "../css/CSSGrammar.y"
+#line 1128 "../css/CSSGrammar.y"
     {
         CSSParser *p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
@@ -3272,7 +3294,7 @@ yyreduce:
     break;
 
   case 182:
-#line 1133 "../css/CSSGrammar.y"
+#line 1146 "../css/CSSGrammar.y"
     {
         CSSParser *p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
@@ -3293,7 +3315,7 @@ yyreduce:
     break;
 
   case 183:
-#line 1151 "../css/CSSGrammar.y"
+#line 1164 "../css/CSSGrammar.y"
     {
         CSSParser *p = static_cast<CSSParser*>(parser);
         (yyval.selector) = p->createFloatingSelector();
@@ -3315,9 +3337,9 @@ yyreduce:
     break;
 
   case 184:
-#line 1170 "../css/CSSGrammar.y"
+#line 1183 "../css/CSSGrammar.y"
     {
-        if (!(yyvsp[(4) - (6)].selector))
+        if (!(yyvsp[(4) - (6)].selector) || (yyvsp[(4) - (6)].selector)->simpleSelector() || (yyvsp[(4) - (6)].selector)->tagHistory())
             (yyval.selector) = 0;
         else {
             CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3331,14 +3353,14 @@ yyreduce:
     break;
 
   case 185:
-#line 1185 "../css/CSSGrammar.y"
+#line 1198 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (1)].boolean);
     ;}
     break;
 
   case 186:
-#line 1188 "../css/CSSGrammar.y"
+#line 1201 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
         if ( (yyvsp[(2) - (2)].boolean) )
@@ -3347,70 +3369,70 @@ yyreduce:
     break;
 
   case 187:
-#line 1193 "../css/CSSGrammar.y"
+#line 1206 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (1)].boolean);
     ;}
     break;
 
   case 188:
-#line 1196 "../css/CSSGrammar.y"
+#line 1209 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 189:
-#line 1199 "../css/CSSGrammar.y"
+#line 1212 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 190:
-#line 1202 "../css/CSSGrammar.y"
+#line 1215 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
     ;}
     break;
 
   case 191:
-#line 1205 "../css/CSSGrammar.y"
+#line 1218 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (2)].boolean);
     ;}
     break;
 
   case 192:
-#line 1211 "../css/CSSGrammar.y"
+#line 1224 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (3)].boolean);
     ;}
     break;
 
   case 193:
-#line 1214 "../css/CSSGrammar.y"
+#line 1227 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 194:
-#line 1217 "../css/CSSGrammar.y"
+#line 1230 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 195:
-#line 1220 "../css/CSSGrammar.y"
+#line 1233 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 196:
-#line 1223 "../css/CSSGrammar.y"
+#line 1236 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (4)].boolean);
         if ((yyvsp[(2) - (4)].boolean))
@@ -3419,21 +3441,21 @@ yyreduce:
     break;
 
   case 197:
-#line 1228 "../css/CSSGrammar.y"
+#line 1241 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (4)].boolean);
     ;}
     break;
 
   case 198:
-#line 1231 "../css/CSSGrammar.y"
+#line 1244 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = (yyvsp[(1) - (6)].boolean);
     ;}
     break;
 
   case 199:
-#line 1237 "../css/CSSGrammar.y"
+#line 1250 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
         CSSParser* p = static_cast<CSSParser*>(parser);
@@ -3450,7 +3472,7 @@ yyreduce:
     break;
 
   case 200:
-#line 1251 "../css/CSSGrammar.y"
+#line 1264 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         p->m_valueList = new CSSParserValueList;
@@ -3465,14 +3487,14 @@ yyreduce:
     break;
 
   case 201:
-#line 1263 "../css/CSSGrammar.y"
+#line 1276 "../css/CSSGrammar.y"
     {
         (yyval.boolean) = false;
     ;}
     break;
 
   case 202:
-#line 1267 "../css/CSSGrammar.y"
+#line 1280 "../css/CSSGrammar.y"
     {
         /* The default movable type template has letter-spacing: .none;  Handle this by looking for
         error tokens at the start of an expr, recover the expr and then treat as an error, cleaning
@@ -3482,7 +3504,7 @@ yyreduce:
     break;
 
   case 203:
-#line 1274 "../css/CSSGrammar.y"
+#line 1287 "../css/CSSGrammar.y"
     {
         /* When we encounter something like p {color: red !important fail;} we should drop the declaration */
         (yyval.boolean) = false;
@@ -3490,7 +3512,7 @@ yyreduce:
     break;
 
   case 204:
-#line 1279 "../css/CSSGrammar.y"
+#line 1292 "../css/CSSGrammar.y"
     {
         /* Handle this case: div { text-align: center; !important } Just reduce away the stray !important. */
         (yyval.boolean) = false;
@@ -3498,7 +3520,7 @@ yyreduce:
     break;
 
   case 205:
-#line 1284 "../css/CSSGrammar.y"
+#line 1297 "../css/CSSGrammar.y"
     {
         /* div { font-family: } Just reduce away this property with no value. */
         (yyval.boolean) = false;
@@ -3506,7 +3528,7 @@ yyreduce:
     break;
 
   case 206:
-#line 1289 "../css/CSSGrammar.y"
+#line 1302 "../css/CSSGrammar.y"
     {
         /* if we come across rules with invalid values like this case: p { weight: *; }, just discard the rule */
         (yyval.boolean) = false;
@@ -3514,7 +3536,7 @@ yyreduce:
     break;
 
   case 207:
-#line 1294 "../css/CSSGrammar.y"
+#line 1307 "../css/CSSGrammar.y"
     {
         /* if we come across: div { color{;color:maroon} }, ignore everything within curly brackets */
         (yyval.boolean) = false;
@@ -3522,24 +3544,24 @@ yyreduce:
     break;
 
   case 208:
-#line 1301 "../css/CSSGrammar.y"
+#line 1314 "../css/CSSGrammar.y"
     {
         (yyval.integer) = cssPropertyID((yyvsp[(1) - (2)].string));
     ;}
     break;
 
   case 209:
-#line 1307 "../css/CSSGrammar.y"
+#line 1320 "../css/CSSGrammar.y"
     { (yyval.boolean) = true; ;}
     break;
 
   case 210:
-#line 1308 "../css/CSSGrammar.y"
+#line 1321 "../css/CSSGrammar.y"
     { (yyval.boolean) = false; ;}
     break;
 
   case 211:
-#line 1312 "../css/CSSGrammar.y"
+#line 1325 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.valueList) = p->createFloatingValueList();
@@ -3548,7 +3570,7 @@ yyreduce:
     break;
 
   case 212:
-#line 1317 "../css/CSSGrammar.y"
+#line 1330 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         (yyval.valueList) = (yyvsp[(1) - (3)].valueList);
@@ -3566,50 +3588,50 @@ yyreduce:
     break;
 
   case 213:
-#line 1331 "../css/CSSGrammar.y"
+#line 1344 "../css/CSSGrammar.y"
     {
         (yyval.valueList) = 0;
     ;}
     break;
 
   case 214:
-#line 1337 "../css/CSSGrammar.y"
+#line 1350 "../css/CSSGrammar.y"
     {
         (yyval.character) = '/';
     ;}
     break;
 
   case 215:
-#line 1340 "../css/CSSGrammar.y"
+#line 1353 "../css/CSSGrammar.y"
     {
         (yyval.character) = ',';
     ;}
     break;
 
   case 216:
-#line 1343 "../css/CSSGrammar.y"
+#line 1356 "../css/CSSGrammar.y"
     {
         (yyval.character) = 0;
   ;}
     break;
 
   case 217:
-#line 1349 "../css/CSSGrammar.y"
+#line 1362 "../css/CSSGrammar.y"
     { (yyval.value) = (yyvsp[(1) - (1)].value); ;}
     break;
 
   case 218:
-#line 1350 "../css/CSSGrammar.y"
+#line 1363 "../css/CSSGrammar.y"
     { (yyval.value) = (yyvsp[(2) - (2)].value); (yyval.value).fValue *= (yyvsp[(1) - (2)].integer); ;}
     break;
 
   case 219:
-#line 1351 "../css/CSSGrammar.y"
+#line 1364 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_STRING; ;}
     break;
 
   case 220:
-#line 1352 "../css/CSSGrammar.y"
+#line 1365 "../css/CSSGrammar.y"
     {
       (yyval.value).id = cssValueKeywordID((yyvsp[(1) - (2)].string));
       (yyval.value).unit = CSSPrimitiveValue::CSS_IDENT;
@@ -3618,156 +3640,158 @@ yyreduce:
     break;
 
   case 221:
-#line 1358 "../css/CSSGrammar.y"
-    { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_DIMENSION ;}
+#line 1371 "../css/CSSGrammar.y"
+    { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_DIMENSION; ;}
     break;
 
   case 222:
-#line 1359 "../css/CSSGrammar.y"
-    { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(2) - (3)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_DIMENSION ;}
+#line 1372 "../css/CSSGrammar.y"
+    { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(2) - (3)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_DIMENSION; ;}
     break;
 
   case 223:
-#line 1360 "../css/CSSGrammar.y"
+#line 1373 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_URI; ;}
     break;
 
   case 224:
-#line 1361 "../css/CSSGrammar.y"
-    { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_UNICODE_RANGE ;}
+#line 1374 "../css/CSSGrammar.y"
+    { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (2)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_UNICODE_RANGE; ;}
     break;
 
   case 225:
-#line 1362 "../css/CSSGrammar.y"
+#line 1375 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = (yyvsp[(1) - (1)].string); (yyval.value).unit = CSSPrimitiveValue::CSS_PARSER_HEXCOLOR; ;}
     break;
 
   case 226:
-#line 1363 "../css/CSSGrammar.y"
+#line 1376 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).string = CSSParserString(); (yyval.value).unit = CSSPrimitiveValue::CSS_PARSER_HEXCOLOR; ;}
     break;
 
   case 227:
-#line 1365 "../css/CSSGrammar.y"
+#line 1378 "../css/CSSGrammar.y"
     {
       (yyval.value) = (yyvsp[(1) - (1)].value);
   ;}
     break;
 
   case 228:
-#line 1368 "../css/CSSGrammar.y"
+#line 1381 "../css/CSSGrammar.y"
     {
       (yyval.value) = (yyvsp[(1) - (2)].value);
   ;}
     break;
 
   case 229:
-#line 1371 "../css/CSSGrammar.y"
-    {;}
+#line 1384 "../css/CSSGrammar.y"
+    { /* Handle width: %; */
+      (yyval.value).id = 0; (yyval.value).unit = 0;
+  ;}
     break;
 
   case 230:
-#line 1375 "../css/CSSGrammar.y"
+#line 1390 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).isInt = true; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_NUMBER; ;}
     break;
 
   case 231:
-#line 1376 "../css/CSSGrammar.y"
+#line 1391 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).isInt = false; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_NUMBER; ;}
     break;
 
   case 232:
-#line 1377 "../css/CSSGrammar.y"
+#line 1392 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_PERCENTAGE; ;}
     break;
 
   case 233:
-#line 1378 "../css/CSSGrammar.y"
+#line 1393 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_PX; ;}
     break;
 
   case 234:
-#line 1379 "../css/CSSGrammar.y"
+#line 1394 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_CM; ;}
     break;
 
   case 235:
-#line 1380 "../css/CSSGrammar.y"
+#line 1395 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_MM; ;}
     break;
 
   case 236:
-#line 1381 "../css/CSSGrammar.y"
+#line 1396 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_IN; ;}
     break;
 
   case 237:
-#line 1382 "../css/CSSGrammar.y"
+#line 1397 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_PT; ;}
     break;
 
   case 238:
-#line 1383 "../css/CSSGrammar.y"
+#line 1398 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_PC; ;}
     break;
 
   case 239:
-#line 1384 "../css/CSSGrammar.y"
+#line 1399 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_DEG; ;}
     break;
 
   case 240:
-#line 1385 "../css/CSSGrammar.y"
+#line 1400 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_RAD; ;}
     break;
 
   case 241:
-#line 1386 "../css/CSSGrammar.y"
+#line 1401 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_GRAD; ;}
     break;
 
   case 242:
-#line 1387 "../css/CSSGrammar.y"
+#line 1402 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_TURN; ;}
     break;
 
   case 243:
-#line 1388 "../css/CSSGrammar.y"
+#line 1403 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_MS; ;}
     break;
 
   case 244:
-#line 1389 "../css/CSSGrammar.y"
+#line 1404 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_S; ;}
     break;
 
   case 245:
-#line 1390 "../css/CSSGrammar.y"
+#line 1405 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_HZ; ;}
     break;
 
   case 246:
-#line 1391 "../css/CSSGrammar.y"
+#line 1406 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_KHZ; ;}
     break;
 
   case 247:
-#line 1392 "../css/CSSGrammar.y"
+#line 1407 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_EMS; ;}
     break;
 
   case 248:
-#line 1393 "../css/CSSGrammar.y"
+#line 1408 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSParserValue::Q_EMS; ;}
     break;
 
   case 249:
-#line 1394 "../css/CSSGrammar.y"
+#line 1409 "../css/CSSGrammar.y"
     { (yyval.value).id = 0; (yyval.value).fValue = (yyvsp[(1) - (2)].number); (yyval.value).unit = CSSPrimitiveValue::CSS_EXS; ;}
     break;
 
   case 250:
-#line 1398 "../css/CSSGrammar.y"
+#line 1413 "../css/CSSGrammar.y"
     {
       (yyval.value).id = 0;
       (yyval.value).string = (yyvsp[(1) - (1)].string);
@@ -3776,7 +3800,7 @@ yyreduce:
     break;
 
   case 251:
-#line 1406 "../css/CSSGrammar.y"
+#line 1421 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         CSSParserFunction* f = p->createFloatingFunction();
@@ -3789,7 +3813,7 @@ yyreduce:
     break;
 
   case 252:
-#line 1415 "../css/CSSGrammar.y"
+#line 1430 "../css/CSSGrammar.y"
     {
         CSSParser* p = static_cast<CSSParser*>(parser);
         CSSParserFunction* f = p->createFloatingFunction();
@@ -3802,59 +3826,59 @@ yyreduce:
     break;
 
   case 253:
-#line 1431 "../css/CSSGrammar.y"
+#line 1446 "../css/CSSGrammar.y"
     { (yyval.string) = (yyvsp[(1) - (2)].string); ;}
     break;
 
   case 254:
-#line 1432 "../css/CSSGrammar.y"
+#line 1447 "../css/CSSGrammar.y"
     { (yyval.string) = (yyvsp[(1) - (2)].string); ;}
     break;
 
   case 255:
-#line 1439 "../css/CSSGrammar.y"
+#line 1454 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
   case 256:
-#line 1442 "../css/CSSGrammar.y"
+#line 1457 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
   case 257:
-#line 1448 "../css/CSSGrammar.y"
+#line 1463 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
   case 258:
-#line 1451 "../css/CSSGrammar.y"
+#line 1466 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
   case 261:
-#line 1462 "../css/CSSGrammar.y"
+#line 1477 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
   case 262:
-#line 1468 "../css/CSSGrammar.y"
+#line 1483 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
     break;
 
   case 263:
-#line 1474 "../css/CSSGrammar.y"
+#line 1489 "../css/CSSGrammar.y"
     {
         (yyval.rule) = 0;
     ;}
@@ -3862,7 +3886,7 @@ yyreduce:
 
 
 /* Line 1267 of yacc.c.  */
-#line 3866 "WebCore/tmp/../generated/CSSGrammar.tab.c"
+#line 3890 "WebCore/tmp/../generated/CSSGrammar.tab.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -4076,6 +4100,6 @@ yyreturn:
 }
 
 
-#line 1501 "../css/CSSGrammar.y"
+#line 1516 "../css/CSSGrammar.y"
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.h b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.h
index 1b60c68..61ba1f5 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSGrammar.h
+++ b/src/3rdparty/webkit/WebCore/generated/CSSGrammar.h
@@ -42,139 +42,141 @@
       know about them.  */
    enum yytokentype {
      TOKEN_EOF = 0,
-     UNIMPORTANT_TOK = 258,
-     WHITESPACE = 259,
-     SGML_CD = 260,
-     INCLUDES = 261,
-     DASHMATCH = 262,
-     BEGINSWITH = 263,
-     ENDSWITH = 264,
-     CONTAINS = 265,
-     STRING = 266,
-     IDENT = 267,
-     NTH = 268,
-     HEX = 269,
-     IDSEL = 270,
-     IMPORT_SYM = 271,
-     PAGE_SYM = 272,
-     MEDIA_SYM = 273,
-     FONT_FACE_SYM = 274,
-     CHARSET_SYM = 275,
-     NAMESPACE_SYM = 276,
-     WEBKIT_RULE_SYM = 277,
-     WEBKIT_DECLS_SYM = 278,
-     WEBKIT_KEYFRAME_RULE_SYM = 279,
-     WEBKIT_KEYFRAMES_SYM = 280,
-     WEBKIT_VALUE_SYM = 281,
-     WEBKIT_MEDIAQUERY_SYM = 282,
-     WEBKIT_SELECTOR_SYM = 283,
-     WEBKIT_VARIABLES_SYM = 284,
-     WEBKIT_DEFINE_SYM = 285,
-     VARIABLES_FOR = 286,
-     WEBKIT_VARIABLES_DECLS_SYM = 287,
-     ATKEYWORD = 288,
-     IMPORTANT_SYM = 289,
-     MEDIA_ONLY = 290,
-     MEDIA_NOT = 291,
-     MEDIA_AND = 292,
-     QEMS = 293,
-     EMS = 294,
-     EXS = 295,
-     PXS = 296,
-     CMS = 297,
-     MMS = 298,
-     INS = 299,
-     PTS = 300,
-     PCS = 301,
-     DEGS = 302,
-     RADS = 303,
-     GRADS = 304,
-     TURNS = 305,
-     MSECS = 306,
-     SECS = 307,
-     HERZ = 308,
-     KHERZ = 309,
-     DIMEN = 310,
-     PERCENTAGE = 311,
-     FLOATTOKEN = 312,
-     INTEGER = 313,
-     URI = 314,
-     FUNCTION = 315,
-     NOTFUNCTION = 316,
-     UNICODERANGE = 317,
-     VARCALL = 318
+     LOWEST_PREC = 258,
+     UNIMPORTANT_TOK = 259,
+     WHITESPACE = 260,
+     SGML_CD = 261,
+     INCLUDES = 262,
+     DASHMATCH = 263,
+     BEGINSWITH = 264,
+     ENDSWITH = 265,
+     CONTAINS = 266,
+     STRING = 267,
+     IDENT = 268,
+     NTH = 269,
+     HEX = 270,
+     IDSEL = 271,
+     IMPORT_SYM = 272,
+     PAGE_SYM = 273,
+     MEDIA_SYM = 274,
+     FONT_FACE_SYM = 275,
+     CHARSET_SYM = 276,
+     NAMESPACE_SYM = 277,
+     WEBKIT_RULE_SYM = 278,
+     WEBKIT_DECLS_SYM = 279,
+     WEBKIT_KEYFRAME_RULE_SYM = 280,
+     WEBKIT_KEYFRAMES_SYM = 281,
+     WEBKIT_VALUE_SYM = 282,
+     WEBKIT_MEDIAQUERY_SYM = 283,
+     WEBKIT_SELECTOR_SYM = 284,
+     WEBKIT_VARIABLES_SYM = 285,
+     WEBKIT_DEFINE_SYM = 286,
+     VARIABLES_FOR = 287,
+     WEBKIT_VARIABLES_DECLS_SYM = 288,
+     ATKEYWORD = 289,
+     IMPORTANT_SYM = 290,
+     MEDIA_ONLY = 291,
+     MEDIA_NOT = 292,
+     MEDIA_AND = 293,
+     QEMS = 294,
+     EMS = 295,
+     EXS = 296,
+     PXS = 297,
+     CMS = 298,
+     MMS = 299,
+     INS = 300,
+     PTS = 301,
+     PCS = 302,
+     DEGS = 303,
+     RADS = 304,
+     GRADS = 305,
+     TURNS = 306,
+     MSECS = 307,
+     SECS = 308,
+     HERZ = 309,
+     KHERZ = 310,
+     DIMEN = 311,
+     PERCENTAGE = 312,
+     FLOATTOKEN = 313,
+     INTEGER = 314,
+     URI = 315,
+     FUNCTION = 316,
+     NOTFUNCTION = 317,
+     UNICODERANGE = 318,
+     VARCALL = 319
    };
 #endif
 /* Tokens.  */
 #define TOKEN_EOF 0
-#define UNIMPORTANT_TOK 258
-#define WHITESPACE 259
-#define SGML_CD 260
-#define INCLUDES 261
-#define DASHMATCH 262
-#define BEGINSWITH 263
-#define ENDSWITH 264
-#define CONTAINS 265
-#define STRING 266
-#define IDENT 267
-#define NTH 268
-#define HEX 269
-#define IDSEL 270
-#define IMPORT_SYM 271
-#define PAGE_SYM 272
-#define MEDIA_SYM 273
-#define FONT_FACE_SYM 274
-#define CHARSET_SYM 275
-#define NAMESPACE_SYM 276
-#define WEBKIT_RULE_SYM 277
-#define WEBKIT_DECLS_SYM 278
-#define WEBKIT_KEYFRAME_RULE_SYM 279
-#define WEBKIT_KEYFRAMES_SYM 280
-#define WEBKIT_VALUE_SYM 281
-#define WEBKIT_MEDIAQUERY_SYM 282
-#define WEBKIT_SELECTOR_SYM 283
-#define WEBKIT_VARIABLES_SYM 284
-#define WEBKIT_DEFINE_SYM 285
-#define VARIABLES_FOR 286
-#define WEBKIT_VARIABLES_DECLS_SYM 287
-#define ATKEYWORD 288
-#define IMPORTANT_SYM 289
-#define MEDIA_ONLY 290
-#define MEDIA_NOT 291
-#define MEDIA_AND 292
-#define QEMS 293
-#define EMS 294
-#define EXS 295
-#define PXS 296
-#define CMS 297
-#define MMS 298
-#define INS 299
-#define PTS 300
-#define PCS 301
-#define DEGS 302
-#define RADS 303
-#define GRADS 304
-#define TURNS 305
-#define MSECS 306
-#define SECS 307
-#define HERZ 308
-#define KHERZ 309
-#define DIMEN 310
-#define PERCENTAGE 311
-#define FLOATTOKEN 312
-#define INTEGER 313
-#define URI 314
-#define FUNCTION 315
-#define NOTFUNCTION 316
-#define UNICODERANGE 317
-#define VARCALL 318
+#define LOWEST_PREC 258
+#define UNIMPORTANT_TOK 259
+#define WHITESPACE 260
+#define SGML_CD 261
+#define INCLUDES 262
+#define DASHMATCH 263
+#define BEGINSWITH 264
+#define ENDSWITH 265
+#define CONTAINS 266
+#define STRING 267
+#define IDENT 268
+#define NTH 269
+#define HEX 270
+#define IDSEL 271
+#define IMPORT_SYM 272
+#define PAGE_SYM 273
+#define MEDIA_SYM 274
+#define FONT_FACE_SYM 275
+#define CHARSET_SYM 276
+#define NAMESPACE_SYM 277
+#define WEBKIT_RULE_SYM 278
+#define WEBKIT_DECLS_SYM 279
+#define WEBKIT_KEYFRAME_RULE_SYM 280
+#define WEBKIT_KEYFRAMES_SYM 281
+#define WEBKIT_VALUE_SYM 282
+#define WEBKIT_MEDIAQUERY_SYM 283
+#define WEBKIT_SELECTOR_SYM 284
+#define WEBKIT_VARIABLES_SYM 285
+#define WEBKIT_DEFINE_SYM 286
+#define VARIABLES_FOR 287
+#define WEBKIT_VARIABLES_DECLS_SYM 288
+#define ATKEYWORD 289
+#define IMPORTANT_SYM 290
+#define MEDIA_ONLY 291
+#define MEDIA_NOT 292
+#define MEDIA_AND 293
+#define QEMS 294
+#define EMS 295
+#define EXS 296
+#define PXS 297
+#define CMS 298
+#define MMS 299
+#define INS 300
+#define PTS 301
+#define PCS 302
+#define DEGS 303
+#define RADS 304
+#define GRADS 305
+#define TURNS 306
+#define MSECS 307
+#define SECS 308
+#define HERZ 309
+#define KHERZ 310
+#define DIMEN 311
+#define PERCENTAGE 312
+#define FLOATTOKEN 313
+#define INTEGER 314
+#define URI 315
+#define FUNCTION 316
+#define NOTFUNCTION 317
+#define UNICODERANGE 318
+#define VARCALL 319
 
 
 
 
 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-#line 57 "../css/CSSGrammar.y"
+#line 58 "../css/CSSGrammar.y"
 {
     bool boolean;
     char character;
@@ -199,7 +201,7 @@ typedef union YYSTYPE
     float val;
 }
 /* Line 1489 of yacc.c.  */
-#line 201 "WebCore/tmp/../generated/CSSGrammar.tab.h"
+#line 203 "WebCore/tmp/../generated/CSSGrammar.tab.h"
 	YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
index 25313ac..dc00054 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.cpp
@@ -37,7 +37,7 @@ struct props {
     const char* name;
     int id;
 };
-/* maximum key range = 1766, duplicates = 0 */
+/* maximum key range = 1603, duplicates = 0 */
 
 #ifdef __GNUC__
 __inline
@@ -51,32 +51,32 @@ hash_prop (register const char *str, register unsigned int len)
 {
   static const unsigned short asso_values[] =
     {
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769,    0, 1769, 1769, 1769, 1769,
-      1769,    0, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769,    5,   20,    0,
-        10,    0,  325,  135,  210,    5,    0,    0,    0,   30,
-        10,    0,    0,   30,    0,   10,    0,  185,  170,   40,
-       355,  625,   45, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769, 1769,
-      1769, 1769, 1769, 1769, 1769, 1769
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609,    0, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609,    5,    0,   75,
+         0,    0,  325,    5,  295,    0,    0,    0,  105,    0,
+         5,    0,   55,   20,    5,   25,    0,   50,   55,   15,
+       400,  295,  145, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609, 1609,
+      1609, 1609, 1609, 1609, 1609, 1609
     };
   register int hval = len;
 
@@ -226,664 +226,676 @@ findProp (register const char *str, register unsigned int len)
 {
   enum
     {
-      TOTAL_KEYWORDS = 270,
+      TOTAL_KEYWORDS = 269,
       MIN_WORD_LENGTH = 3,
       MAX_WORD_LENGTH = 43,
-      MIN_HASH_VALUE = 3,
-      MAX_HASH_VALUE = 1768
+      MIN_HASH_VALUE = 6,
+      MAX_HASH_VALUE = 1608
     };
 
   static const struct props wordlist_prop[] =
     {
-#line 132 "CSSPropertyNames.gperf"
-      {"top", CSSPropertyTop},
-#line 44 "CSSPropertyNames.gperf"
-      {"color", CSSPropertyColor},
-#line 43 "CSSPropertyNames.gperf"
-      {"clip", CSSPropertyClip},
-#line 42 "CSSPropertyNames.gperf"
-      {"clear", CSSPropertyClear},
-#line 109 "CSSPropertyNames.gperf"
-      {"src", CSSPropertySrc},
-#line 263 "CSSPropertyNames.gperf"
-      {"stroke", CSSPropertyStroke},
-#line 248 "CSSPropertyNames.gperf"
-      {"stop-color", CSSPropertyStopColor},
-#line 45 "CSSPropertyNames.gperf"
-      {"content", CSSPropertyContent},
+#line 40 "CSSPropertyNames.gperf"
+      {"bottom", CSSPropertyBottom},
 #line 18 "CSSPropertyNames.gperf"
       {"border", CSSPropertyBorder},
-#line 97 "CSSPropertyNames.gperf"
-      {"position", CSSPropertyPosition},
-#line 49 "CSSPropertyNames.gperf"
-      {"direction", CSSPropertyDirection},
-#line 35 "CSSPropertyNames.gperf"
-      {"border-top", CSSPropertyBorderTop},
-#line 258 "CSSPropertyNames.gperf"
+#line 257 "CSSPropertyNames.gperf"
       {"marker", CSSPropertyMarker},
-#line 24 "CSSPropertyNames.gperf"
-      {"border-color", CSSPropertyBorderColor},
-#line 266 "CSSPropertyNames.gperf"
-      {"stroke-linecap", CSSPropertyStrokeLinecap},
-#line 36 "CSSPropertyNames.gperf"
-      {"border-top-color", CSSPropertyBorderTopColor},
-#line 242 "CSSPropertyNames.gperf"
-      {"mask", CSSPropertyMask},
-#line 250 "CSSPropertyNames.gperf"
-      {"color-interpolation", CSSPropertyColorInterpolation},
-#line 267 "CSSPropertyNames.gperf"
-      {"stroke-linejoin", CSSPropertyStrokeLinejoin},
-#line 40 "CSSPropertyNames.gperf"
-      {"bottom", CSSPropertyBottom},
-#line 41 "CSSPropertyNames.gperf"
-      {"caption-side", CSSPropertyCaptionSide},
-#line 23 "CSSPropertyNames.gperf"
-      {"border-collapse", CSSPropertyBorderCollapse},
-#line 107 "CSSPropertyNames.gperf"
-      {"scrollbar-track-color", CSSPropertyScrollbarTrackColor},
-#line 261 "CSSPropertyNames.gperf"
-      {"marker-start", CSSPropertyMarkerStart},
-#line 108 "CSSPropertyNames.gperf"
-      {"size", CSSPropertySize},
+#line 19 "CSSPropertyNames.gperf"
+      {"border-bottom", CSSPropertyBorderBottom},
 #line 259 "CSSPropertyNames.gperf"
+      {"marker-mid", CSSPropertyMarkerMid},
+#line 68 "CSSPropertyNames.gperf"
+      {"margin", CSSPropertyMargin},
+#line 276 "CSSPropertyNames.gperf"
+      {"kerning", CSSPropertyKerning},
+#line 258 "CSSPropertyNames.gperf"
       {"marker-end", CSSPropertyMarkerEnd},
-#line 99 "CSSPropertyNames.gperf"
-      {"resize", CSSPropertyResize},
-#line 144 "CSSPropertyNames.gperf"
-      {"zoom", CSSPropertyZoom},
-#line 140 "CSSPropertyNames.gperf"
+#line 69 "CSSPropertyNames.gperf"
+      {"margin-bottom", CSSPropertyMarginBottom},
+#line 241 "CSSPropertyNames.gperf"
+      {"mask", CSSPropertyMask},
+#line 262 "CSSPropertyNames.gperf"
+      {"stroke", CSSPropertyStroke},
+#line 133 "CSSPropertyNames.gperf"
       {"word-break", CSSPropertyWordBreak},
-#line 260 "CSSPropertyNames.gperf"
-      {"marker-mid", CSSPropertyMarkerMid},
-#line 19 "CSSPropertyNames.gperf"
-      {"border-bottom", CSSPropertyBorderBottom},
-#line 20 "CSSPropertyNames.gperf"
-      {"border-bottom-color", CSSPropertyBorderBottomColor},
-#line 102 "CSSPropertyNames.gperf"
-      {"scrollbar-arrow-color", CSSPropertyScrollbarArrowColor},
-#line 268 "CSSPropertyNames.gperf"
-      {"stroke-miterlimit", CSSPropertyStrokeMiterlimit},
-#line 142 "CSSPropertyNames.gperf"
-      {"word-wrap", CSSPropertyWordWrap},
-#line 153 "CSSPropertyNames.gperf"
-      {"-webkit-appearance", CSSPropertyWebkitAppearance},
+#line 278 "CSSPropertyNames.gperf"
+      {"writing-mode", CSSPropertyWritingMode},
+#line 151 "CSSPropertyNames.gperf"
+      {"-webkit-binding", CSSPropertyWebkitBinding},
+#line 256 "CSSPropertyNames.gperf"
+      {"image-rendering", CSSPropertyImageRendering},
 #line 138 "CSSPropertyNames.gperf"
-      {"widows", CSSPropertyWidows},
-#line 204 "CSSPropertyNames.gperf"
+      {"-webkit-animation", CSSPropertyWebkitAnimation},
+#line 156 "CSSPropertyNames.gperf"
+      {"-webkit-border-image", CSSPropertyWebkitBorderImage},
+#line 197 "CSSPropertyNames.gperf"
       {"-webkit-mask", CSSPropertyWebkitMask},
-#line 192 "CSSPropertyNames.gperf"
-      {"-webkit-line-break", CSSPropertyWebkitLineBreak},
-#line 231 "CSSPropertyNames.gperf"
-      {"-webkit-transition", CSSPropertyWebkitTransition},
-#line 207 "CSSPropertyNames.gperf"
-      {"-webkit-mask-clip", CSSPropertyWebkitMaskClip},
-#line 193 "CSSPropertyNames.gperf"
-      {"-webkit-line-clamp", CSSPropertyWebkitLineClamp},
-#line 214 "CSSPropertyNames.gperf"
-      {"-webkit-mask-repeat", CSSPropertyWebkitMaskRepeat},
-#line 274 "CSSPropertyNames.gperf"
-      {"dominant-baseline", CSSPropertyDominantBaseline},
+#line 125 "CSSPropertyNames.gperf"
+      {"top", CSSPropertyTop},
+#line 131 "CSSPropertyNames.gperf"
+      {"widows", CSSPropertyWidows},
+#line 260 "CSSPropertyNames.gperf"
+      {"marker-start", CSSPropertyMarkerStart},
+#line 143 "CSSPropertyNames.gperf"
+      {"-webkit-animation-name", CSSPropertyWebkitAnimationName},
 #line 92 "CSSPropertyNames.gperf"
       {"page", CSSPropertyPage},
-#line 145 "CSSPropertyNames.gperf"
-      {"-webkit-animation", CSSPropertyWebkitAnimation},
-#line 211 "CSSPropertyNames.gperf"
-      {"-webkit-mask-position", CSSPropertyWebkitMaskPosition},
-#line 217 "CSSPropertyNames.gperf"
-      {"-webkit-nbsp-mode", CSSPropertyWebkitNbspMode},
-#line 277 "CSSPropertyNames.gperf"
-      {"kerning", CSSPropertyKerning},
-#line 208 "CSSPropertyNames.gperf"
-      {"-webkit-mask-composite", CSSPropertyWebkitMaskComposite},
-#line 62 "CSSPropertyNames.gperf"
-      {"letter-spacing", CSSPropertyLetterSpacing},
+#line 202 "CSSPropertyNames.gperf"
+      {"-webkit-mask-image", CSSPropertyWebkitMaskImage},
+#line 35 "CSSPropertyNames.gperf"
+      {"border-top", CSSPropertyBorderTop},
 #line 87 "CSSPropertyNames.gperf"
       {"padding", CSSPropertyPadding},
-#line 253 "CSSPropertyNames.gperf"
-      {"color-rendering", CSSPropertyColorRendering},
+#line 230 "CSSPropertyNames.gperf"
+      {"-webkit-transition", CSSPropertyWebkitTransition},
+#line 203 "CSSPropertyNames.gperf"
+      {"-webkit-mask-origin", CSSPropertyWebkitMaskOrigin},
+#line 88 "CSSPropertyNames.gperf"
+      {"padding-bottom", CSSPropertyPaddingBottom},
+#line 72 "CSSPropertyNames.gperf"
+      {"margin-top", CSSPropertyMarginTop},
+#line 189 "CSSPropertyNames.gperf"
+      {"-webkit-margin-start", CSSPropertyWebkitMarginStart},
+#line 45 "CSSPropertyNames.gperf"
+      {"content", CSSPropertyContent},
+#line 97 "CSSPropertyNames.gperf"
+      {"position", CSSPropertyPosition},
+#line 49 "CSSPropertyNames.gperf"
+      {"direction", CSSPropertyDirection},
+#line 98 "CSSPropertyNames.gperf"
+      {"quotes", CSSPropertyQuotes},
+#line 102 "CSSPropertyNames.gperf"
+      {"src", CSSPropertySrc},
+#line 135 "CSSPropertyNames.gperf"
+      {"word-wrap", CSSPropertyWordWrap},
+#line 191 "CSSPropertyNames.gperf"
+      {"-webkit-marquee", CSSPropertyWebkitMarquee},
+#line 210 "CSSPropertyNames.gperf"
+      {"-webkit-nbsp-mode", CSSPropertyWebkitNbspMode},
+#line 95 "CSSPropertyNames.gperf"
+      {"page-break-inside", CSSPropertyPageBreakInside},
+#line 141 "CSSPropertyNames.gperf"
+      {"-webkit-animation-duration", CSSPropertyWebkitAnimationDuration},
+#line 235 "CSSPropertyNames.gperf"
+      {"-webkit-user-drag", CSSPropertyWebkitUserDrag},
+#line 207 "CSSPropertyNames.gperf"
+      {"-webkit-mask-repeat", CSSPropertyWebkitMaskRepeat},
+#line 157 "CSSPropertyNames.gperf"
+      {"-webkit-border-radius", CSSPropertyWebkitBorderRadius},
 #line 91 "CSSPropertyNames.gperf"
       {"padding-top", CSSPropertyPaddingTop},
-#line 215 "CSSPropertyNames.gperf"
-      {"-webkit-mask-size", CSSPropertyWebkitMaskSize},
-#line 68 "CSSPropertyNames.gperf"
-      {"margin", CSSPropertyMargin},
-#line 147 "CSSPropertyNames.gperf"
+#line 211 "CSSPropertyNames.gperf"
+      {"-webkit-padding-start", CSSPropertyWebkitPaddingStart},
+#line 126 "CSSPropertyNames.gperf"
+      {"unicode-bidi", CSSPropertyUnicodeBidi},
+#line 140 "CSSPropertyNames.gperf"
       {"-webkit-animation-direction", CSSPropertyWebkitAnimationDirection},
-#line 72 "CSSPropertyNames.gperf"
-      {"margin-top", CSSPropertyMarginTop},
-#line 241 "CSSPropertyNames.gperf"
-      {"clip-rule", CSSPropertyClipRule},
+#line 137 "CSSPropertyNames.gperf"
+      {"zoom", CSSPropertyZoom},
+#line 204 "CSSPropertyNames.gperf"
+      {"-webkit-mask-position", CSSPropertyWebkitMaskPosition},
+#line 232 "CSSPropertyNames.gperf"
+      {"-webkit-transition-duration", CSSPropertyWebkitTransitionDuration},
+#line 185 "CSSPropertyNames.gperf"
+      {"-webkit-line-break", CSSPropertyWebkitLineBreak},
+#line 10 "CSSPropertyNames.gperf"
+      {"background", CSSPropertyBackground},
+#line 267 "CSSPropertyNames.gperf"
+      {"stroke-miterlimit", CSSPropertyStrokeMiterlimit},
+#line 266 "CSSPropertyNames.gperf"
+      {"stroke-linejoin", CSSPropertyStrokeLinejoin},
+#line 127 "CSSPropertyNames.gperf"
+      {"unicode-range", CSSPropertyUnicodeRange},
+#line 96 "CSSPropertyNames.gperf"
+      {"pointer-events", CSSPropertyPointerEvents},
+#line 216 "CSSPropertyNames.gperf"
+      {"-webkit-rtl-ordering", CSSPropertyWebkitRtlOrdering},
 #line 48 "CSSPropertyNames.gperf"
       {"cursor", CSSPropertyCursor},
-#line 150 "CSSPropertyNames.gperf"
-      {"-webkit-animation-name", CSSPropertyWebkitAnimationName},
 #line 79 "CSSPropertyNames.gperf"
       {"outline", CSSPropertyOutline},
-#line 33 "CSSPropertyNames.gperf"
-      {"border-spacing", CSSPropertyBorderSpacing},
-#line 80 "CSSPropertyNames.gperf"
-      {"outline-color", CSSPropertyOutlineColor},
+#line 13 "CSSPropertyNames.gperf"
+      {"background-image", CSSPropertyBackgroundImage},
+#line 273 "CSSPropertyNames.gperf"
+      {"dominant-baseline", CSSPropertyDominantBaseline},
+#line 101 "CSSPropertyNames.gperf"
+      {"size", CSSPropertySize},
+#line 41 "CSSPropertyNames.gperf"
+      {"caption-side", CSSPropertyCaptionSide},
 #line 47 "CSSPropertyNames.gperf"
       {"counter-reset", CSSPropertyCounterReset},
-#line 96 "CSSPropertyNames.gperf"
-      {"pointer-events", CSSPropertyPointerEvents},
-#line 95 "CSSPropertyNames.gperf"
-      {"page-break-inside", CSSPropertyPageBreakInside},
-#line 141 "CSSPropertyNames.gperf"
+#line 99 "CSSPropertyNames.gperf"
+      {"resize", CSSPropertyResize},
+#line 194 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-repetition", CSSPropertyWebkitMarqueeRepetition},
+#line 44 "CSSPropertyNames.gperf"
+      {"color", CSSPropertyColor},
+#line 33 "CSSPropertyNames.gperf"
+      {"border-spacing", CSSPropertyBorderSpacing},
+#line 42 "CSSPropertyNames.gperf"
+      {"clear", CSSPropertyClear},
+#line 195 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-speed", CSSPropertyWebkitMarqueeSpeed},
+#line 149 "CSSPropertyNames.gperf"
+      {"-webkit-background-origin", CSSPropertyWebkitBackgroundOrigin},
+#line 134 "CSSPropertyNames.gperf"
       {"word-spacing", CSSPropertyWordSpacing},
-#line 240 "CSSPropertyNames.gperf"
-      {"clip-path", CSSPropertyClipPath},
-#line 98 "CSSPropertyNames.gperf"
-      {"quotes", CSSPropertyQuotes},
-#line 88 "CSSPropertyNames.gperf"
-      {"padding-bottom", CSSPropertyPaddingBottom},
-#line 78 "CSSPropertyNames.gperf"
-      {"orphans", CSSPropertyOrphans},
-#line 219 "CSSPropertyNames.gperf"
-      {"-webkit-rtl-ordering", CSSPropertyWebkitRtlOrdering},
-#line 279 "CSSPropertyNames.gperf"
-      {"writing-mode", CSSPropertyWritingMode},
-#line 69 "CSSPropertyNames.gperf"
-      {"margin-bottom", CSSPropertyMarginBottom},
-#line 133 "CSSPropertyNames.gperf"
-      {"unicode-bidi", CSSPropertyUnicodeBidi},
-#line 272 "CSSPropertyNames.gperf"
-      {"alignment-baseline", CSSPropertyAlignmentBaseline},
+#line 192 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-direction", CSSPropertyWebkitMarqueeDirection},
+#line 24 "CSSPropertyNames.gperf"
+      {"border-color", CSSPropertyBorderColor},
+#line 193 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-increment", CSSPropertyWebkitMarqueeIncrement},
+#line 142 "CSSPropertyNames.gperf"
+      {"-webkit-animation-iteration-count", CSSPropertyWebkitAnimationIterationCount},
+#line 20 "CSSPropertyNames.gperf"
+      {"border-bottom-color", CSSPropertyBorderBottomColor},
+#line 201 "CSSPropertyNames.gperf"
+      {"-webkit-mask-composite", CSSPropertyWebkitMaskComposite},
+#line 252 "CSSPropertyNames.gperf"
+      {"color-rendering", CSSPropertyColorRendering},
+#line 17 "CSSPropertyNames.gperf"
+      {"background-repeat", CSSPropertyBackgroundRepeat},
+#line 208 "CSSPropertyNames.gperf"
+      {"-webkit-mask-size", CSSPropertyWebkitMaskSize},
+#line 43 "CSSPropertyNames.gperf"
+      {"clip", CSSPropertyClip},
 #line 46 "CSSPropertyNames.gperf"
       {"counter-increment", CSSPropertyCounterIncrement},
-#line 139 "CSSPropertyNames.gperf"
+#line 145 "CSSPropertyNames.gperf"
+      {"-webkit-appearance", CSSPropertyWebkitAppearance},
+#line 14 "CSSPropertyNames.gperf"
+      {"background-position", CSSPropertyBackgroundPosition},
+#line 36 "CSSPropertyNames.gperf"
+      {"border-top-color", CSSPropertyBorderTopColor},
+#line 247 "CSSPropertyNames.gperf"
+      {"stop-color", CSSPropertyStopColor},
+#line 242 "CSSPropertyNames.gperf"
+      {"enable-background", CSSPropertyEnableBackground},
+#line 271 "CSSPropertyNames.gperf"
+      {"alignment-baseline", CSSPropertyAlignmentBaseline},
+#line 265 "CSSPropertyNames.gperf"
+      {"stroke-linecap", CSSPropertyStrokeLinecap},
+#line 182 "CSSPropertyNames.gperf"
+      {"-webkit-columns", CSSPropertyWebkitColumns},
+#line 62 "CSSPropertyNames.gperf"
+      {"letter-spacing", CSSPropertyLetterSpacing},
+#line 200 "CSSPropertyNames.gperf"
+      {"-webkit-mask-clip", CSSPropertyWebkitMaskClip},
+#line 212 "CSSPropertyNames.gperf"
+      {"-webkit-perspective", CSSPropertyWebkitPerspective},
+#line 100 "CSSPropertyNames.gperf"
+      {"right", CSSPropertyRight},
+#line 132 "CSSPropertyNames.gperf"
       {"width", CSSPropertyWidth},
-#line 158 "CSSPropertyNames.gperf"
-      {"-webkit-binding", CSSPropertyWebkitBinding},
-#line 218 "CSSPropertyNames.gperf"
-      {"-webkit-padding-start", CSSPropertyWebkitPaddingStart},
-#line 137 "CSSPropertyNames.gperf"
-      {"white-space", CSSPropertyWhiteSpace},
-#line 210 "CSSPropertyNames.gperf"
-      {"-webkit-mask-origin", CSSPropertyWebkitMaskOrigin},
-#line 196 "CSSPropertyNames.gperf"
-      {"-webkit-margin-start", CSSPropertyWebkitMarginStart},
-#line 270 "CSSPropertyNames.gperf"
-      {"stroke-width", CSSPropertyStrokeWidth},
-#line 195 "CSSPropertyNames.gperf"
-      {"-webkit-margin-collapse", CSSPropertyWebkitMarginCollapse},
-#line 238 "CSSPropertyNames.gperf"
+#line 174 "CSSPropertyNames.gperf"
+      {"-webkit-column-break-inside", CSSPropertyWebkitColumnBreakInside},
+#line 237 "CSSPropertyNames.gperf"
       {"-webkit-user-select", CSSPropertyWebkitUserSelect},
-#line 163 "CSSPropertyNames.gperf"
-      {"-webkit-border-image", CSSPropertyWebkitBorderImage},
-#line 197 "CSSPropertyNames.gperf"
-      {"-webkit-margin-top-collapse", CSSPropertyWebkitMarginTopCollapse},
-#line 209 "CSSPropertyNames.gperf"
-      {"-webkit-mask-image", CSSPropertyWebkitMaskImage},
-#line 39 "CSSPropertyNames.gperf"
-      {"border-width", CSSPropertyBorderWidth},
-#line 38 "CSSPropertyNames.gperf"
-      {"border-top-width", CSSPropertyBorderTopWidth},
-#line 189 "CSSPropertyNames.gperf"
-      {"-webkit-columns", CSSPropertyWebkitColumns},
 #line 76 "CSSPropertyNames.gperf"
       {"min-width", CSSPropertyMinWidth},
-#line 61 "CSSPropertyNames.gperf"
-      {"left", CSSPropertyLeft},
-#line 198 "CSSPropertyNames.gperf"
-      {"-webkit-marquee", CSSPropertyWebkitMarquee},
-#line 164 "CSSPropertyNames.gperf"
-      {"-webkit-border-radius", CSSPropertyWebkitBorderRadius},
-#line 106 "CSSPropertyNames.gperf"
-      {"scrollbar-shadow-color", CSSPropertyScrollbarShadowColor},
-#line 254 "CSSPropertyNames.gperf"
-      {"fill", CSSPropertyFill},
-#line 52 "CSSPropertyNames.gperf"
-      {"float", CSSPropertyFloat},
-#line 244 "CSSPropertyNames.gperf"
-      {"filter", CSSPropertyFilter},
+#line 213 "CSSPropertyNames.gperf"
+      {"-webkit-perspective-origin", CSSPropertyWebkitPerspectiveOrigin},
+#line 29 "CSSPropertyNames.gperf"
+      {"border-right", CSSPropertyBorderRight},
+#line 39 "CSSPropertyNames.gperf"
+      {"border-width", CSSPropertyBorderWidth},
+#line 176 "CSSPropertyNames.gperf"
+      {"-webkit-column-gap", CSSPropertyWebkitColumnGap},
 #line 53 "CSSPropertyNames.gperf"
       {"font", CSSPropertyFont},
-#line 252 "CSSPropertyNames.gperf"
-      {"color-profile", CSSPropertyColorProfile},
-#line 194 "CSSPropertyNames.gperf"
-      {"-webkit-margin-bottom-collapse", CSSPropertyWebkitMarginBottomCollapse},
-#line 245 "CSSPropertyNames.gperf"
-      {"flood-color", CSSPropertyFloodColor},
-#line 135 "CSSPropertyNames.gperf"
-      {"vertical-align", CSSPropertyVerticalAlign},
-#line 103 "CSSPropertyNames.gperf"
-      {"scrollbar-darkshadow-color", CSSPropertyScrollbarDarkshadowColor},
-#line 233 "CSSPropertyNames.gperf"
-      {"-webkit-transition-duration", CSSPropertyWebkitTransitionDuration},
-#line 100 "CSSPropertyNames.gperf"
-      {"right", CSSPropertyRight},
-#line 202 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-speed", CSSPropertyWebkitMarqueeSpeed},
-#line 239 "CSSPropertyNames.gperf"
-      {"-webkit-variable-declaration-block", CSSPropertyWebkitVariableDeclarationBlock},
-#line 257 "CSSPropertyNames.gperf"
-      {"image-rendering", CSSPropertyImageRendering},
-#line 201 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-repetition", CSSPropertyWebkitMarqueeRepetition},
+#line 71 "CSSPropertyNames.gperf"
+      {"margin-right", CSSPropertyMarginRight},
 #line 22 "CSSPropertyNames.gperf"
       {"border-bottom-width", CSSPropertyBorderBottomWidth},
-#line 25 "CSSPropertyNames.gperf"
-      {"border-left", CSSPropertyBorderLeft},
-#line 199 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-direction", CSSPropertyWebkitMarqueeDirection},
-#line 26 "CSSPropertyNames.gperf"
-      {"border-left-color", CSSPropertyBorderLeftColor},
-#line 134 "CSSPropertyNames.gperf"
-      {"unicode-range", CSSPropertyUnicodeRange},
-#line 10 "CSSPropertyNames.gperf"
-      {"background", CSSPropertyBackground},
 #line 148 "CSSPropertyNames.gperf"
-      {"-webkit-animation-duration", CSSPropertyWebkitAnimationDuration},
+      {"-webkit-background-composite", CSSPropertyWebkitBackgroundComposite},
 #line 12 "CSSPropertyNames.gperf"
       {"background-color", CSSPropertyBackgroundColor},
-#line 181 "CSSPropertyNames.gperf"
-      {"-webkit-column-break-inside", CSSPropertyWebkitColumnBreakInside},
-#line 104 "CSSPropertyNames.gperf"
-      {"scrollbar-face-color", CSSPropertyScrollbarFaceColor},
-#line 17 "CSSPropertyNames.gperf"
-      {"background-repeat", CSSPropertyBackgroundRepeat},
-#line 149 "CSSPropertyNames.gperf"
-      {"-webkit-animation-iteration-count", CSSPropertyWebkitAnimationIterationCount},
-#line 29 "CSSPropertyNames.gperf"
-      {"border-right", CSSPropertyBorderRight},
-#line 205 "CSSPropertyNames.gperf"
-      {"-webkit-mask-attachment", CSSPropertyWebkitMaskAttachment},
-#line 200 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-increment", CSSPropertyWebkitMarqueeIncrement},
-#line 30 "CSSPropertyNames.gperf"
-      {"border-right-color", CSSPropertyBorderRightColor},
-#line 112 "CSSPropertyNames.gperf"
-      {"text-decoration", CSSPropertyTextDecoration},
-#line 113 "CSSPropertyNames.gperf"
-      {"text-indent", CSSPropertyTextIndent},
-#line 251 "CSSPropertyNames.gperf"
-      {"color-interpolation-filters", CSSPropertyColorInterpolationFilters},
-#line 55 "CSSPropertyNames.gperf"
-      {"font-size", CSSPropertyFontSize},
-#line 262 "CSSPropertyNames.gperf"
-      {"shape-rendering", CSSPropertyShapeRendering},
-#line 14 "CSSPropertyNames.gperf"
-      {"background-position", CSSPropertyBackgroundPosition},
-#line 243 "CSSPropertyNames.gperf"
-      {"enable-background", CSSPropertyEnableBackground},
-#line 101 "CSSPropertyNames.gperf"
-      {"scrollbar-3dlight-color", CSSPropertyScrollbar3dlightColor},
-#line 236 "CSSPropertyNames.gperf"
-      {"-webkit-user-drag", CSSPropertyWebkitUserDrag},
-#line 143 "CSSPropertyNames.gperf"
-      {"z-index", CSSPropertyZIndex},
-#line 161 "CSSPropertyNames.gperf"
-      {"-webkit-border-fit", CSSPropertyWebkitBorderFit},
-#line 183 "CSSPropertyNames.gperf"
-      {"-webkit-column-gap", CSSPropertyWebkitColumnGap},
-#line 224 "CSSPropertyNames.gperf"
-      {"-webkit-text-stroke", CSSPropertyWebkitTextStroke},
-#line 225 "CSSPropertyNames.gperf"
-      {"-webkit-text-stroke-color", CSSPropertyWebkitTextStrokeColor},
+#line 269 "CSSPropertyNames.gperf"
+      {"stroke-width", CSSPropertyStrokeWidth},
+#line 150 "CSSPropertyNames.gperf"
+      {"-webkit-background-size", CSSPropertyWebkitBackgroundSize},
+#line 80 "CSSPropertyNames.gperf"
+      {"outline-color", CSSPropertyOutlineColor},
 #line 154 "CSSPropertyNames.gperf"
-      {"-webkit-background-clip", CSSPropertyWebkitBackgroundClip},
+      {"-webkit-border-fit", CSSPropertyWebkitBorderFit},
+#line 128 "CSSPropertyNames.gperf"
+      {"vertical-align", CSSPropertyVerticalAlign},
+#line 186 "CSSPropertyNames.gperf"
+      {"-webkit-line-clamp", CSSPropertyWebkitLineClamp},
+#line 249 "CSSPropertyNames.gperf"
+      {"color-interpolation", CSSPropertyColorInterpolation},
+#line 90 "CSSPropertyNames.gperf"
+      {"padding-right", CSSPropertyPaddingRight},
+#line 38 "CSSPropertyNames.gperf"
+      {"border-top-width", CSSPropertyBorderTopWidth},
+#line 23 "CSSPropertyNames.gperf"
+      {"border-collapse", CSSPropertyBorderCollapse},
+#line 78 "CSSPropertyNames.gperf"
+      {"orphans", CSSPropertyOrphans},
 #line 175 "CSSPropertyNames.gperf"
-      {"-webkit-box-pack", CSSPropertyWebkitBoxPack},
-#line 227 "CSSPropertyNames.gperf"
+      {"-webkit-column-count", CSSPropertyWebkitColumnCount},
+#line 224 "CSSPropertyNames.gperf"
       {"-webkit-transform", CSSPropertyWebkitTransform},
+#line 240 "CSSPropertyNames.gperf"
+      {"clip-rule", CSSPropertyClipRule},
+#line 58 "CSSPropertyNames.gperf"
+      {"font-variant", CSSPropertyFontVariant},
+#line 147 "CSSPropertyNames.gperf"
+      {"-webkit-background-clip", CSSPropertyWebkitBackgroundClip},
+#line 261 "CSSPropertyNames.gperf"
+      {"shape-rendering", CSSPropertyShapeRendering},
+#line 106 "CSSPropertyNames.gperf"
+      {"text-indent", CSSPropertyTextIndent},
+#line 94 "CSSPropertyNames.gperf"
+      {"page-break-before", CSSPropertyPageBreakBefore},
+#line 225 "CSSPropertyNames.gperf"
+      {"-webkit-transform-origin", CSSPropertyWebkitTransformOrigin},
+#line 93 "CSSPropertyNames.gperf"
+      {"page-break-after", CSSPropertyPageBreakAfter},
+#line 188 "CSSPropertyNames.gperf"
+      {"-webkit-margin-collapse", CSSPropertyWebkitMarginCollapse},
+#line 177 "CSSPropertyNames.gperf"
+      {"-webkit-column-rule", CSSPropertyWebkitColumnRule},
+#line 61 "CSSPropertyNames.gperf"
+      {"left", CSSPropertyLeft},
+#line 187 "CSSPropertyNames.gperf"
+      {"-webkit-margin-bottom-collapse", CSSPropertyWebkitMarginBottomCollapse},
+#line 77 "CSSPropertyNames.gperf"
+      {"opacity", CSSPropertyOpacity},
+#line 270 "CSSPropertyNames.gperf"
+      {"text-rendering", CSSPropertyTextRendering},
+#line 52 "CSSPropertyNames.gperf"
+      {"float", CSSPropertyFloat},
+#line 243 "CSSPropertyNames.gperf"
+      {"filter", CSSPropertyFilter},
 #line 167 "CSSPropertyNames.gperf"
-      {"-webkit-border-vertical-spacing", CSSPropertyWebkitBorderVerticalSpacing},
-#line 174 "CSSPropertyNames.gperf"
       {"-webkit-box-orient", CSSPropertyWebkitBoxOrient},
+#line 34 "CSSPropertyNames.gperf"
+      {"border-style", CSSPropertyBorderStyle},
+#line 206 "CSSPropertyNames.gperf"
+      {"-webkit-mask-position-y", CSSPropertyWebkitMaskPositionY},
+#line 153 "CSSPropertyNames.gperf"
+      {"-webkit-border-bottom-right-radius", CSSPropertyWebkitBorderBottomRightRadius},
+#line 25 "CSSPropertyNames.gperf"
+      {"border-left", CSSPropertyBorderLeft},
+#line 198 "CSSPropertyNames.gperf"
+      {"-webkit-mask-attachment", CSSPropertyWebkitMaskAttachment},
+#line 21 "CSSPropertyNames.gperf"
+      {"border-bottom-style", CSSPropertyBorderBottomStyle},
+#line 70 "CSSPropertyNames.gperf"
+      {"margin-left", CSSPropertyMarginLeft},
+#line 139 "CSSPropertyNames.gperf"
+      {"-webkit-animation-delay", CSSPropertyWebkitAnimationDelay},
+#line 221 "CSSPropertyNames.gperf"
+      {"-webkit-text-stroke", CSSPropertyWebkitTextStroke},
+#line 160 "CSSPropertyNames.gperf"
+      {"-webkit-border-vertical-spacing", CSSPropertyWebkitBorderVerticalSpacing},
+#line 268 "CSSPropertyNames.gperf"
+      {"stroke-opacity", CSSPropertyStrokeOpacity},
+#line 199 "CSSPropertyNames.gperf"
+      {"-webkit-mask-box-image", CSSPropertyWebkitMaskBoxImage},
+#line 130 "CSSPropertyNames.gperf"
+      {"white-space", CSSPropertyWhiteSpace},
 #line 83 "CSSPropertyNames.gperf"
       {"outline-width", CSSPropertyOutlineWidth},
-#line 172 "CSSPropertyNames.gperf"
-      {"-webkit-box-lines", CSSPropertyWebkitBoxLines},
-#line 169 "CSSPropertyNames.gperf"
-      {"-webkit-box-direction", CSSPropertyWebkitBoxDirection},
-#line 184 "CSSPropertyNames.gperf"
-      {"-webkit-column-rule", CSSPropertyWebkitColumnRule},
 #line 190 "CSSPropertyNames.gperf"
-      {"-webkit-font-size-delta", CSSPropertyWebkitFontSizeDelta},
-#line 185 "CSSPropertyNames.gperf"
-      {"-webkit-column-rule-color", CSSPropertyWebkitColumnRuleColor},
-#line 155 "CSSPropertyNames.gperf"
-      {"-webkit-background-composite", CSSPropertyWebkitBackgroundComposite},
-#line 182 "CSSPropertyNames.gperf"
-      {"-webkit-column-count", CSSPropertyWebkitColumnCount},
-#line 93 "CSSPropertyNames.gperf"
-      {"page-break-after", CSSPropertyPageBreakAfter},
+      {"-webkit-margin-top-collapse", CSSPropertyWebkitMarginTopCollapse},
+#line 231 "CSSPropertyNames.gperf"
+      {"-webkit-transition-delay", CSSPropertyWebkitTransitionDelay},
+#line 129 "CSSPropertyNames.gperf"
+      {"visibility", CSSPropertyVisibility},
+#line 50 "CSSPropertyNames.gperf"
+      {"display", CSSPropertyDisplay},
+#line 159 "CSSPropertyNames.gperf"
+      {"-webkit-border-top-right-radius", CSSPropertyWebkitBorderTopRightRadius},
+#line 233 "CSSPropertyNames.gperf"
+      {"-webkit-transition-property", CSSPropertyWebkitTransitionProperty},
+#line 105 "CSSPropertyNames.gperf"
+      {"text-decoration", CSSPropertyTextDecoration},
+#line 37 "CSSPropertyNames.gperf"
+      {"border-top-style", CSSPropertyBorderTopStyle},
+#line 55 "CSSPropertyNames.gperf"
+      {"font-size", CSSPropertyFontSize},
 #line 89 "CSSPropertyNames.gperf"
       {"padding-left", CSSPropertyPaddingLeft},
-#line 157 "CSSPropertyNames.gperf"
-      {"-webkit-background-size", CSSPropertyWebkitBackgroundSize},
-#line 247 "CSSPropertyNames.gperf"
-      {"lighting-color", CSSPropertyLightingColor},
-#line 212 "CSSPropertyNames.gperf"
-      {"-webkit-mask-position-x", CSSPropertyWebkitMaskPositionX},
-#line 111 "CSSPropertyNames.gperf"
-      {"text-align", CSSPropertyTextAlign},
-#line 70 "CSSPropertyNames.gperf"
-      {"margin-left", CSSPropertyMarginLeft},
-#line 256 "CSSPropertyNames.gperf"
-      {"fill-rule", CSSPropertyFillRule},
-#line 94 "CSSPropertyNames.gperf"
-      {"page-break-before", CSSPropertyPageBreakBefore},
-#line 90 "CSSPropertyNames.gperf"
-      {"padding-right", CSSPropertyPaddingRight},
-#line 271 "CSSPropertyNames.gperf"
-      {"text-rendering", CSSPropertyTextRendering},
-#line 58 "CSSPropertyNames.gperf"
-      {"font-variant", CSSPropertyFontVariant},
 #line 84 "CSSPropertyNames.gperf"
       {"overflow", CSSPropertyOverflow},
-#line 71 "CSSPropertyNames.gperf"
-      {"margin-right", CSSPropertyMarginRight},
-#line 120 "CSSPropertyNames.gperf"
-      {"text-overline", CSSPropertyTextOverline},
-#line 13 "CSSPropertyNames.gperf"
-      {"background-image", CSSPropertyBackgroundImage},
-#line 121 "CSSPropertyNames.gperf"
-      {"text-overline-color", CSSPropertyTextOverlineColor},
-#line 60 "CSSPropertyNames.gperf"
-      {"height", CSSPropertyHeight},
-#line 56 "CSSPropertyNames.gperf"
-      {"font-stretch", CSSPropertyFontStretch},
+#line 30 "CSSPropertyNames.gperf"
+      {"border-right-color", CSSPropertyBorderRightColor},
 #line 162 "CSSPropertyNames.gperf"
-      {"-webkit-border-horizontal-spacing", CSSPropertyWebkitBorderHorizontalSpacing},
-#line 188 "CSSPropertyNames.gperf"
-      {"-webkit-column-width", CSSPropertyWebkitColumnWidth},
-#line 63 "CSSPropertyNames.gperf"
-      {"line-height", CSSPropertyLineHeight},
-#line 127 "CSSPropertyNames.gperf"
-      {"text-underline", CSSPropertyTextUnderline},
-#line 278 "CSSPropertyNames.gperf"
-      {"text-anchor", CSSPropertyTextAnchor},
-#line 128 "CSSPropertyNames.gperf"
-      {"text-underline-color", CSSPropertyTextUnderlineColor},
-#line 122 "CSSPropertyNames.gperf"
-      {"text-overline-mode", CSSPropertyTextOverlineMode},
-#line 156 "CSSPropertyNames.gperf"
-      {"-webkit-background-origin", CSSPropertyWebkitBackgroundOrigin},
-#line 168 "CSSPropertyNames.gperf"
-      {"-webkit-box-align", CSSPropertyWebkitBoxAlign},
-#line 273 "CSSPropertyNames.gperf"
-      {"baseline-shift", CSSPropertyBaselineShift},
-#line 75 "CSSPropertyNames.gperf"
-      {"min-height", CSSPropertyMinHeight},
-#line 228 "CSSPropertyNames.gperf"
-      {"-webkit-transform-origin", CSSPropertyWebkitTransformOrigin},
-#line 129 "CSSPropertyNames.gperf"
-      {"text-underline-mode", CSSPropertyTextUnderlineMode},
-#line 28 "CSSPropertyNames.gperf"
-      {"border-left-width", CSSPropertyBorderLeftWidth},
-#line 125 "CSSPropertyNames.gperf"
-      {"text-shadow", CSSPropertyTextShadow},
-#line 77 "CSSPropertyNames.gperf"
-      {"opacity", CSSPropertyOpacity},
+      {"-webkit-box-direction", CSSPropertyWebkitBoxDirection},
+#line 248 "CSSPropertyNames.gperf"
+      {"stop-opacity", CSSPropertyStopOpacity},
+#line 104 "CSSPropertyNames.gperf"
+      {"text-align", CSSPropertyTextAlign},
+#line 144 "CSSPropertyNames.gperf"
+      {"-webkit-animation-timing-function", CSSPropertyWebkitAnimationTimingFunction},
+#line 253 "CSSPropertyNames.gperf"
+      {"fill", CSSPropertyFill},
+#line 196 "CSSPropertyNames.gperf"
+      {"-webkit-marquee-style", CSSPropertyWebkitMarqueeStyle},
+#line 16 "CSSPropertyNames.gperf"
+      {"background-position-y", CSSPropertyBackgroundPositionY},
 #line 11 "CSSPropertyNames.gperf"
       {"background-attachment", CSSPropertyBackgroundAttachment},
-#line 216 "CSSPropertyNames.gperf"
-      {"-webkit-match-nearest-mail-blockquote-color", CSSPropertyWebkitMatchNearestMailBlockquoteColor},
-#line 249 "CSSPropertyNames.gperf"
-      {"stop-opacity", CSSPropertyStopOpacity},
-#line 269 "CSSPropertyNames.gperf"
-      {"stroke-opacity", CSSPropertyStrokeOpacity},
+#line 161 "CSSPropertyNames.gperf"
+      {"-webkit-box-align", CSSPropertyWebkitBoxAlign},
+#line 205 "CSSPropertyNames.gperf"
+      {"-webkit-mask-position-x", CSSPropertyWebkitMaskPositionX},
+#line 136 "CSSPropertyNames.gperf"
+      {"z-index", CSSPropertyZIndex},
+#line 234 "CSSPropertyNames.gperf"
+      {"-webkit-transition-timing-function", CSSPropertyWebkitTransitionTimingFunction},
 #line 64 "CSSPropertyNames.gperf"
       {"list-style", CSSPropertyListStyle},
-#line 50 "CSSPropertyNames.gperf"
-      {"display", CSSPropertyDisplay},
-#line 32 "CSSPropertyNames.gperf"
-      {"border-right-width", CSSPropertyBorderRightWidth},
-#line 74 "CSSPropertyNames.gperf"
-      {"max-width", CSSPropertyMaxWidth},
+#line 168 "CSSPropertyNames.gperf"
+      {"-webkit-box-pack", CSSPropertyWebkitBoxPack},
 #line 165 "CSSPropertyNames.gperf"
-      {"-webkit-border-top-left-radius", CSSPropertyWebkitBorderTopLeftRadius},
-#line 178 "CSSPropertyNames.gperf"
+      {"-webkit-box-lines", CSSPropertyWebkitBoxLines},
+#line 228 "CSSPropertyNames.gperf"
+      {"-webkit-transform-origin-z", CSSPropertyWebkitTransformOriginZ},
+#line 152 "CSSPropertyNames.gperf"
+      {"-webkit-border-bottom-left-radius", CSSPropertyWebkitBorderBottomLeftRadius},
+#line 103 "CSSPropertyNames.gperf"
+      {"table-layout", CSSPropertyTableLayout},
+#line 181 "CSSPropertyNames.gperf"
+      {"-webkit-column-width", CSSPropertyWebkitColumnWidth},
+#line 65 "CSSPropertyNames.gperf"
+      {"list-style-image", CSSPropertyListStyleImage},
+#line 113 "CSSPropertyNames.gperf"
+      {"text-overline", CSSPropertyTextOverline},
+#line 120 "CSSPropertyNames.gperf"
+      {"text-underline", CSSPropertyTextUnderline},
+#line 115 "CSSPropertyNames.gperf"
+      {"text-overline-mode", CSSPropertyTextOverlineMode},
+#line 122 "CSSPropertyNames.gperf"
+      {"text-underline-mode", CSSPropertyTextUnderlineMode},
+#line 82 "CSSPropertyNames.gperf"
+      {"outline-style", CSSPropertyOutlineStyle},
+#line 239 "CSSPropertyNames.gperf"
+      {"clip-path", CSSPropertyClipPath},
+#line 60 "CSSPropertyNames.gperf"
+      {"height", CSSPropertyHeight},
+#line 238 "CSSPropertyNames.gperf"
+      {"-webkit-variable-declaration-block", CSSPropertyWebkitVariableDeclarationBlock},
+#line 75 "CSSPropertyNames.gperf"
+      {"min-height", CSSPropertyMinHeight},
+#line 171 "CSSPropertyNames.gperf"
       {"-webkit-box-sizing", CSSPropertyWebkitBoxSizing},
-#line 179 "CSSPropertyNames.gperf"
+#line 246 "CSSPropertyNames.gperf"
+      {"lighting-color", CSSPropertyLightingColor},
+#line 173 "CSSPropertyNames.gperf"
+      {"-webkit-column-break-before", CSSPropertyWebkitColumnBreakBefore},
+#line 178 "CSSPropertyNames.gperf"
+      {"-webkit-column-rule-color", CSSPropertyWebkitColumnRuleColor},
+#line 172 "CSSPropertyNames.gperf"
       {"-webkit-column-break-after", CSSPropertyWebkitColumnBreakAfter},
+#line 215 "CSSPropertyNames.gperf"
+      {"-webkit-perspective-origin-y", CSSPropertyWebkitPerspectiveOriginY},
+#line 158 "CSSPropertyNames.gperf"
+      {"-webkit-border-top-left-radius", CSSPropertyWebkitBorderTopLeftRadius},
+#line 244 "CSSPropertyNames.gperf"
+      {"flood-color", CSSPropertyFloodColor},
+#line 26 "CSSPropertyNames.gperf"
+      {"border-left-color", CSSPropertyBorderLeftColor},
+#line 32 "CSSPropertyNames.gperf"
+      {"border-right-width", CSSPropertyBorderRightWidth},
+#line 183 "CSSPropertyNames.gperf"
+      {"-webkit-font-size-delta", CSSPropertyWebkitFontSizeDelta},
+#line 15 "CSSPropertyNames.gperf"
+      {"background-position-x", CSSPropertyBackgroundPositionX},
+#line 222 "CSSPropertyNames.gperf"
+      {"-webkit-text-stroke-color", CSSPropertyWebkitTextStrokeColor},
+#line 59 "CSSPropertyNames.gperf"
+      {"font-weight", CSSPropertyFontWeight},
+#line 66 "CSSPropertyNames.gperf"
+      {"list-style-position", CSSPropertyListStylePosition},
 #line 51 "CSSPropertyNames.gperf"
       {"empty-cells", CSSPropertyEmptyCells},
-#line 34 "CSSPropertyNames.gperf"
-      {"border-style", CSSPropertyBorderStyle},
-#line 37 "CSSPropertyNames.gperf"
-      {"border-top-style", CSSPropertyBorderTopStyle},
-#line 206 "CSSPropertyNames.gperf"
-      {"-webkit-mask-box-image", CSSPropertyWebkitMaskBoxImage},
-#line 180 "CSSPropertyNames.gperf"
-      {"-webkit-column-break-before", CSSPropertyWebkitColumnBreakBefore},
 #line 166 "CSSPropertyNames.gperf"
-      {"-webkit-border-top-right-radius", CSSPropertyWebkitBorderTopRightRadius},
-#line 66 "CSSPropertyNames.gperf"
-      {"list-style-position", CSSPropertyListStylePosition},
-#line 223 "CSSPropertyNames.gperf"
+      {"-webkit-box-ordinal-group", CSSPropertyWebkitBoxOrdinalGroup},
+#line 263 "CSSPropertyNames.gperf"
+      {"stroke-dasharray", CSSPropertyStrokeDasharray},
+#line 251 "CSSPropertyNames.gperf"
+      {"color-profile", CSSPropertyColorProfile},
+#line 220 "CSSPropertyNames.gperf"
       {"-webkit-text-size-adjust", CSSPropertyWebkitTextSizeAdjust},
-#line 159 "CSSPropertyNames.gperf"
-      {"-webkit-border-bottom-left-radius", CSSPropertyWebkitBorderBottomLeftRadius},
-#line 226 "CSSPropertyNames.gperf"
-      {"-webkit-text-stroke-width", CSSPropertyWebkitTextStrokeWidth},
-#line 177 "CSSPropertyNames.gperf"
+#line 255 "CSSPropertyNames.gperf"
+      {"fill-rule", CSSPropertyFillRule},
+#line 63 "CSSPropertyNames.gperf"
+      {"line-height", CSSPropertyLineHeight},
+#line 227 "CSSPropertyNames.gperf"
+      {"-webkit-transform-origin-y", CSSPropertyWebkitTransformOriginY},
+#line 74 "CSSPropertyNames.gperf"
+      {"max-width", CSSPropertyMaxWidth},
+#line 214 "CSSPropertyNames.gperf"
+      {"-webkit-perspective-origin-x", CSSPropertyWebkitPerspectiveOriginX},
+#line 236 "CSSPropertyNames.gperf"
+      {"-webkit-user-modify", CSSPropertyWebkitUserModify},
+#line 56 "CSSPropertyNames.gperf"
+      {"font-stretch", CSSPropertyFontStretch},
+#line 180 "CSSPropertyNames.gperf"
+      {"-webkit-column-rule-width", CSSPropertyWebkitColumnRuleWidth},
+#line 118 "CSSPropertyNames.gperf"
+      {"text-shadow", CSSPropertyTextShadow},
+#line 31 "CSSPropertyNames.gperf"
+      {"border-right-style", CSSPropertyBorderRightStyle},
+#line 57 "CSSPropertyNames.gperf"
+      {"font-style", CSSPropertyFontStyle},
+#line 28 "CSSPropertyNames.gperf"
+      {"border-left-width", CSSPropertyBorderLeftWidth},
+#line 170 "CSSPropertyNames.gperf"
       {"-webkit-box-shadow", CSSPropertyWebkitBoxShadow},
-#line 21 "CSSPropertyNames.gperf"
-      {"border-bottom-style", CSSPropertyBorderBottomStyle},
-#line 59 "CSSPropertyNames.gperf"
-      {"font-weight", CSSPropertyFontWeight},
-#line 160 "CSSPropertyNames.gperf"
-      {"-webkit-border-bottom-right-radius", CSSPropertyWebkitBorderBottomRightRadius},
-#line 126 "CSSPropertyNames.gperf"
+#line 114 "CSSPropertyNames.gperf"
+      {"text-overline-color", CSSPropertyTextOverlineColor},
+#line 121 "CSSPropertyNames.gperf"
+      {"text-underline-color", CSSPropertyTextUnderlineColor},
+#line 223 "CSSPropertyNames.gperf"
+      {"-webkit-text-stroke-width", CSSPropertyWebkitTextStrokeWidth},
+#line 119 "CSSPropertyNames.gperf"
       {"text-transform", CSSPropertyTextTransform},
-#line 234 "CSSPropertyNames.gperf"
-      {"-webkit-transition-property", CSSPropertyWebkitTransitionProperty},
-#line 187 "CSSPropertyNames.gperf"
-      {"-webkit-column-rule-width", CSSPropertyWebkitColumnRuleWidth},
-#line 15 "CSSPropertyNames.gperf"
-      {"background-position-x", CSSPropertyBackgroundPositionX},
-#line 221 "CSSPropertyNames.gperf"
-      {"-webkit-text-fill-color", CSSPropertyWebkitTextFillColor},
-#line 232 "CSSPropertyNames.gperf"
-      {"-webkit-transition-delay", CSSPropertyWebkitTransitionDelay},
-#line 176 "CSSPropertyNames.gperf"
-      {"-webkit-box-reflect", CSSPropertyWebkitBoxReflect},
-#line 213 "CSSPropertyNames.gperf"
-      {"-webkit-mask-position-y", CSSPropertyWebkitMaskPositionY},
-#line 146 "CSSPropertyNames.gperf"
-      {"-webkit-animation-delay", CSSPropertyWebkitAnimationDelay},
-#line 151 "CSSPropertyNames.gperf"
-      {"-webkit-animation-play-state", CSSPropertyWebkitAnimationPlayState},
-#line 173 "CSSPropertyNames.gperf"
-      {"-webkit-box-ordinal-group", CSSPropertyWebkitBoxOrdinalGroup},
-#line 124 "CSSPropertyNames.gperf"
-      {"text-overline-width", CSSPropertyTextOverlineWidth},
-#line 65 "CSSPropertyNames.gperf"
-      {"list-style-image", CSSPropertyListStyleImage},
-#line 82 "CSSPropertyNames.gperf"
-      {"outline-style", CSSPropertyOutlineStyle},
-#line 110 "CSSPropertyNames.gperf"
-      {"table-layout", CSSPropertyTableLayout},
-#line 136 "CSSPropertyNames.gperf"
-      {"visibility", CSSPropertyVisibility},
-#line 131 "CSSPropertyNames.gperf"
-      {"text-underline-width", CSSPropertyTextUnderlineWidth},
-#line 235 "CSSPropertyNames.gperf"
-      {"-webkit-transition-timing-function", CSSPropertyWebkitTransitionTimingFunction},
+#line 155 "CSSPropertyNames.gperf"
+      {"-webkit-border-horizontal-spacing", CSSPropertyWebkitBorderHorizontalSpacing},
+#line 277 "CSSPropertyNames.gperf"
+      {"text-anchor", CSSPropertyTextAnchor},
+#line 272 "CSSPropertyNames.gperf"
+      {"baseline-shift", CSSPropertyBaselineShift},
+#line 86 "CSSPropertyNames.gperf"
+      {"overflow-y", CSSPropertyOverflowY},
+#line 226 "CSSPropertyNames.gperf"
+      {"-webkit-transform-origin-x", CSSPropertyWebkitTransformOriginX},
+#line 229 "CSSPropertyNames.gperf"
+      {"-webkit-transform-style", CSSPropertyWebkitTransformStyle},
 #line 81 "CSSPropertyNames.gperf"
       {"outline-offset", CSSPropertyOutlineOffset},
-#line 152 "CSSPropertyNames.gperf"
-      {"-webkit-animation-timing-function", CSSPropertyWebkitAnimationTimingFunction},
-#line 264 "CSSPropertyNames.gperf"
-      {"stroke-dasharray", CSSPropertyStrokeDasharray},
+#line 250 "CSSPropertyNames.gperf"
+      {"color-interpolation-filters", CSSPropertyColorInterpolationFilters},
+#line 179 "CSSPropertyNames.gperf"
+      {"-webkit-column-rule-style", CSSPropertyWebkitColumnRuleStyle},
+#line 245 "CSSPropertyNames.gperf"
+      {"flood-opacity", CSSPropertyFloodOpacity},
+#line 27 "CSSPropertyNames.gperf"
+      {"border-left-style", CSSPropertyBorderLeftStyle},
+#line 219 "CSSPropertyNames.gperf"
+      {"-webkit-text-security", CSSPropertyWebkitTextSecurity},
+#line 117 "CSSPropertyNames.gperf"
+      {"text-overline-width", CSSPropertyTextOverlineWidth},
+#line 124 "CSSPropertyNames.gperf"
+      {"text-underline-width", CSSPropertyTextUnderlineWidth},
 #line 85 "CSSPropertyNames.gperf"
       {"overflow-x", CSSPropertyOverflowX},
-#line 119 "CSSPropertyNames.gperf"
+#line 112 "CSSPropertyNames.gperf"
       {"text-overflow", CSSPropertyTextOverflow},
-#line 265 "CSSPropertyNames.gperf"
-      {"stroke-dashoffset", CSSPropertyStrokeDashoffset},
+#line 67 "CSSPropertyNames.gperf"
+      {"list-style-type", CSSPropertyListStyleType},
+#line 169 "CSSPropertyNames.gperf"
+      {"-webkit-box-reflect", CSSPropertyWebkitBoxReflect},
+#line 254 "CSSPropertyNames.gperf"
+      {"fill-opacity", CSSPropertyFillOpacity},
+#line 146 "CSSPropertyNames.gperf"
+      {"-webkit-backface-visibility", CSSPropertyWebkitBackfaceVisibility},
 #line 73 "CSSPropertyNames.gperf"
       {"max-height", CSSPropertyMaxHeight},
-#line 105 "CSSPropertyNames.gperf"
-      {"scrollbar-highlight-color", CSSPropertyScrollbarHighlightColor},
-#line 203 "CSSPropertyNames.gperf"
-      {"-webkit-marquee-style", CSSPropertyWebkitMarqueeStyle},
-#line 255 "CSSPropertyNames.gperf"
-      {"fill-opacity", CSSPropertyFillOpacity},
-#line 57 "CSSPropertyNames.gperf"
-      {"font-style", CSSPropertyFontStyle},
-#line 229 "CSSPropertyNames.gperf"
-      {"-webkit-transform-origin-x", CSSPropertyWebkitTransformOriginX},
-#line 246 "CSSPropertyNames.gperf"
-      {"flood-opacity", CSSPropertyFloodOpacity},
-#line 191 "CSSPropertyNames.gperf"
-      {"-webkit-highlight", CSSPropertyWebkitHighlight},
-#line 27 "CSSPropertyNames.gperf"
-      {"border-left-style", CSSPropertyBorderLeftStyle},
-#line 31 "CSSPropertyNames.gperf"
-      {"border-right-style", CSSPropertyBorderRightStyle},
-#line 16 "CSSPropertyNames.gperf"
-      {"background-position-y", CSSPropertyBackgroundPositionY},
-#line 114 "CSSPropertyNames.gperf"
-      {"text-line-through", CSSPropertyTextLineThrough},
-#line 115 "CSSPropertyNames.gperf"
-      {"text-line-through-color", CSSPropertyTextLineThroughColor},
-#line 186 "CSSPropertyNames.gperf"
-      {"-webkit-column-rule-style", CSSPropertyWebkitColumnRuleStyle},
-#line 170 "CSSPropertyNames.gperf"
-      {"-webkit-box-flex", CSSPropertyWebkitBoxFlex},
-#line 220 "CSSPropertyNames.gperf"
-      {"-webkit-text-decorations-in-effect", CSSPropertyWebkitTextDecorationsInEffect},
-#line 86 "CSSPropertyNames.gperf"
-      {"overflow-y", CSSPropertyOverflowY},
 #line 116 "CSSPropertyNames.gperf"
-      {"text-line-through-mode", CSSPropertyTextLineThroughMode},
-#line 123 "CSSPropertyNames.gperf"
       {"text-overline-style", CSSPropertyTextOverlineStyle},
-#line 276 "CSSPropertyNames.gperf"
-      {"glyph-orientation-vertical", CSSPropertyGlyphOrientationVertical},
-#line 130 "CSSPropertyNames.gperf"
+#line 123 "CSSPropertyNames.gperf"
       {"text-underline-style", CSSPropertyTextUnderlineStyle},
-#line 230 "CSSPropertyNames.gperf"
-      {"-webkit-transform-origin-y", CSSPropertyWebkitTransformOriginY},
-#line 222 "CSSPropertyNames.gperf"
-      {"-webkit-text-security", CSSPropertyWebkitTextSecurity},
-#line 237 "CSSPropertyNames.gperf"
-      {"-webkit-user-modify", CSSPropertyWebkitUserModify},
-#line 67 "CSSPropertyNames.gperf"
-      {"list-style-type", CSSPropertyListStyleType},
+#line 209 "CSSPropertyNames.gperf"
+      {"-webkit-match-nearest-mail-blockquote-color", CSSPropertyWebkitMatchNearestMailBlockquoteColor},
+#line 184 "CSSPropertyNames.gperf"
+      {"-webkit-highlight", CSSPropertyWebkitHighlight},
 #line 275 "CSSPropertyNames.gperf"
-      {"glyph-orientation-horizontal", CSSPropertyGlyphOrientationHorizontal},
+      {"glyph-orientation-vertical", CSSPropertyGlyphOrientationVertical},
+#line 264 "CSSPropertyNames.gperf"
+      {"stroke-dashoffset", CSSPropertyStrokeDashoffset},
 #line 54 "CSSPropertyNames.gperf"
       {"font-family", CSSPropertyFontFamily},
-#line 118 "CSSPropertyNames.gperf"
-      {"text-line-through-width", CSSPropertyTextLineThroughWidth},
-#line 171 "CSSPropertyNames.gperf"
+#line 218 "CSSPropertyNames.gperf"
+      {"-webkit-text-fill-color", CSSPropertyWebkitTextFillColor},
+#line 107 "CSSPropertyNames.gperf"
+      {"text-line-through", CSSPropertyTextLineThrough},
+#line 109 "CSSPropertyNames.gperf"
+      {"text-line-through-mode", CSSPropertyTextLineThroughMode},
+#line 163 "CSSPropertyNames.gperf"
+      {"-webkit-box-flex", CSSPropertyWebkitBoxFlex},
+#line 217 "CSSPropertyNames.gperf"
+      {"-webkit-text-decorations-in-effect", CSSPropertyWebkitTextDecorationsInEffect},
+#line 274 "CSSPropertyNames.gperf"
+      {"glyph-orientation-horizontal", CSSPropertyGlyphOrientationHorizontal},
+#line 108 "CSSPropertyNames.gperf"
+      {"text-line-through-color", CSSPropertyTextLineThroughColor},
+#line 164 "CSSPropertyNames.gperf"
       {"-webkit-box-flex-group", CSSPropertyWebkitBoxFlexGroup},
-#line 117 "CSSPropertyNames.gperf"
+#line 111 "CSSPropertyNames.gperf"
+      {"text-line-through-width", CSSPropertyTextLineThroughWidth},
+#line 110 "CSSPropertyNames.gperf"
       {"text-line-through-style", CSSPropertyTextLineThroughStyle}
     };
 
   static const short lookup[] =
     {
-       -1,  -1,  -1,   0,  -1,   1,  -1,  -1,  -1,   2,
-        3,  -1,  -1,   4,  -1,  -1,   5,  -1,  -1,  -1,
-        6,  -1,  -1,  -1,  -1,  -1,  -1,   7,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,   8,  -1,   9,  10,
-       11,  12,  13,  -1,  14,  -1,  15,  -1,  -1,  16,
-       -1,  -1,  -1,  -1,  17,  18,  19,  20,  -1,  -1,
-       21,  22,  23,  -1,  24,  25,  26,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  27,
-       -1,  -1,  -1,  -1,  -1,  28,  -1,  -1,  -1,  -1,
-       29,  -1,  -1,  30,  -1,  -1,  -1,  -1,  -1,  31,
-       -1,  32,  33,  -1,  34,  -1,  -1,  -1,  35,  -1,
-       -1,  36,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  37,  38,  -1,  -1,  -1,  -1,  39,  -1,
-       -1,  -1,  40,  41,  42,  -1,  -1,  43,  -1,  -1,
-       -1,  -1,  -1,  -1,  44,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  45,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  46,  47,  -1,  -1,  -1,  -1,  48,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  49,  -1,  50,
-       -1,  -1,  51,  -1,  -1,  52,  53,  54,  -1,  -1,
-       -1,  55,  56,  -1,  -1,  57,  -1,  -1,  -1,  58,
-       -1,  59,  60,  -1,  -1,  -1,  -1,  61,  -1,  62,
-       -1,  -1,  -1,  63,  -1,  -1,  -1,  -1,  64,  65,
-       -1,  -1,  66,  -1,  -1,  -1,  -1,  67,  -1,  68,
-       -1,  69,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  70,
-       -1,  -1,  71,  -1,  -1,  72,  -1,  73,  74,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  75,  76,  -1,  -1,  -1,  77,  -1,  -1,
-       78,  -1,  -1,  -1,  -1,  79,  80,  -1,  -1,  -1,
-       -1,  81,  -1,  -1,  82,  83,  -1,  84,  85,  86,
-       87,  -1,  88,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  89,  -1,  -1,  -1,  90,  -1,  -1,
-       -1,  91,  -1,  -1,  -1,  92,  -1,  -1,  -1,  93,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  94,
-       95,  96,  97,  -1,  98,  99, 100,  -1,  -1, 101,
-       -1,  -1,  -1, 102,  -1, 103, 104,  -1,  -1, 105,
-       -1, 106, 107,  -1,  -1, 108, 109,  -1,  -1, 110,
-      111, 112,  -1,  -1, 113,  -1, 114,  -1,  -1,  -1,
-      115,  -1, 116, 117,  -1, 118, 119,  -1,  -1,  -1,
-       -1, 120, 121,  -1,  -1, 122,  -1, 123, 124,  -1,
-       -1,  -1, 125, 126,  -1, 127,  -1,  -1, 128,  -1,
-      129, 130, 131,  -1, 132,  -1,  -1,  -1,  -1,  -1,
-      133,  -1,  -1,  -1, 134,  -1,  -1, 135, 136,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 137,  -1,  -1,
-       -1,  -1, 138,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 139,  -1,  -1,  -1,  -1, 140, 141,
-       -1,  -1,  -1,  -1,  -1, 142,  -1,  -1, 143,  -1,
-       -1, 144, 145,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 146,  -1, 147,  -1,  -1,  -1,  -1, 148,  -1,
-       -1,  -1, 149,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 150,  -1,  -1, 151,  -1,  -1,  -1, 152,  -1,
-      153,  -1,  -1, 154,  -1, 155,  -1,  -1,  -1,  -1,
-       -1, 156, 157, 158, 159,  -1,  -1,  -1, 160,  -1,
-      161, 162,  -1,  -1, 163,  -1,  -1, 164,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 165, 166,
-       -1,  -1, 167, 168,  -1,  -1,  -1, 169,  -1,  -1,
-       -1,  -1,  -1, 170,  -1,  -1, 171,  -1,  -1, 172,
-       -1,  -1,  -1,  -1,  -1,  -1, 173, 174, 175,  -1,
-       -1,  -1,  -1,  -1,  -1, 176,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 177,  -1,  -1, 178,
-       -1, 179,  -1,  -1,  -1, 180,  -1,  -1, 181,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      182,  -1, 183,  -1, 184, 185,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 186,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 187,  -1,  -1, 188,  -1,  -1,
-       -1, 189, 190,  -1,  -1,  -1, 191,  -1,  -1,  -1,
-       -1,  -1,  -1, 192,  -1,  -1,  -1, 193,  -1, 194,
-      195,  -1, 196, 197, 198, 199,  -1,  -1, 200,  -1,
-       -1, 201,  -1,  -1,  -1,  -1, 202, 203,  -1,  -1,
-       -1, 204, 205,  -1,  -1,  -1,  -1, 206,  -1,  -1,
-       -1, 207,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 208,
+       -1,  -1,  -1,  -1,  -1,  -1,   0,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,   1,  -1,  -1,  -1,
+       -1,   2,  -1,   3,  -1,   4,   5,   6,  -1,  -1,
+        7,  -1,  -1,   8,   9,  -1,  10,  -1,  -1,  -1,
+       11,  -1,  12,  -1,  -1,  13,  -1,  -1,  -1,  -1,
+       14,  -1,  15,  -1,  -1,  16,  -1,  17,  18,  -1,
+       -1,  19,  20,  -1,  -1,  -1,  -1,  21,  -1,  22,
+       -1,  -1,  -1,  23,  -1,  24,  -1,  25,  26,  27,
+       -1,  -1,  -1,  -1,  28,  29,  -1,  -1,  -1,  -1,
+       30,  -1,  31,  32,  33,  -1,  -1,  -1,  -1,  -1,
+       -1,  34,  -1,  -1,  -1,  -1,  -1,  -1,  35,  36,
+       37,  -1,  -1,  -1,  -1,  -1,  -1,  38,  -1,  -1,
+       -1,  -1,  39,  -1,  -1,  -1,  40,  41,  -1,  42,
+       -1,  43,  -1,  -1,  -1,  -1,  44,  -1,  -1,  -1,
+       -1,  45,  46,  -1,  -1,  -1,  -1,  47,  -1,  48,
+       -1,  49,  50,  51,  -1,  52,  -1,  53,  -1,  -1,
+       54,  -1,  -1,  55,  56,  57,  58,  59,  -1,  -1,
+       -1,  60,  61,  -1,  62,  -1,  -1,  63,  64,  -1,
+       -1,  65,  -1,  -1,  -1,  -1,  66,  -1,  -1,  -1,
+       67,  -1,  -1,  -1,  68,  69,  70,  -1,  -1,  -1,
+       71,  -1,  72,  -1,  -1,  73,  -1,  74,  -1,  -1,
+       75,  -1,  -1,  76,  77,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  78,  -1,  -1,  79,  -1,  80,  -1,  -1,
+       -1,  -1,  81,  -1,  -1,  -1,  -1,  -1,  -1,  82,
+       -1,  -1,  83,  84,  -1,  -1,  -1,  -1,  -1,  85,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  86,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  87,  -1,  88,  -1,  -1,
+       -1,  -1,  -1,  89,  -1,  -1,  -1,  -1,  -1,  90,
+       91,  -1,  -1,  -1,  92,  -1,  -1,  93,  -1,  -1,
+       -1,  -1,  -1,  -1,  94,  -1,  -1,  -1,  -1,  -1,
+       95,  -1,  -1,  -1,  -1,  96,  -1,  97,  -1,  98,
+       -1,  -1,  -1,  -1,  99,  -1, 100, 101,  -1,  -1,
+       -1,  -1, 102, 103, 104,  -1,  -1, 105,  -1, 106,
+       -1,  -1,  -1, 107,  -1,  -1, 108,  -1,  -1,  -1,
+       -1,  -1, 109, 110,  -1,  -1,  -1,  -1, 111,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 112,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 113,
+       -1,  -1,  -1, 114, 115,  -1,  -1,  -1, 116,  -1,
+       -1, 117,  -1,  -1,  -1, 118,  -1, 119,  -1,  -1,
+      120,  -1, 121,  -1, 122,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 123, 124,  -1,
+      125, 126, 127,  -1, 128,  -1, 129,  -1, 130, 131,
+       -1,  -1,  -1,  -1, 132, 133,  -1, 134,  -1, 135,
+      136, 137,  -1, 138,  -1,  -1,  -1, 139, 140, 141,
+       -1, 142,  -1, 143, 144,  -1,  -1,  -1,  -1,  -1,
+       -1, 145,  -1, 146, 147,  -1,  -1,  -1,  -1,  -1,
+       -1, 148,  -1,  -1, 149,  -1,  -1, 150,  -1,  -1,
+       -1, 151,  -1, 152,  -1,  -1,  -1, 153,  -1, 154,
+      155,  -1, 156,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 157, 158,  -1,  -1, 159, 160,  -1,  -1, 161,
+       -1,  -1, 162, 163,  -1,  -1,  -1,  -1, 164,  -1,
+       -1, 165, 166,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      167,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 168, 169,
+       -1, 170,  -1,  -1,  -1,  -1, 171,  -1,  -1,  -1,
+       -1, 172, 173, 174,  -1,  -1,  -1, 175,  -1,  -1,
+       -1,  -1,  -1,  -1, 176, 177, 178, 179,  -1,  -1,
+       -1, 180,  -1, 181,  -1,  -1,  -1, 182,  -1,  -1,
+      183, 184,  -1, 185, 186,  -1,  -1,  -1, 187, 188,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 189, 190,
+       -1, 191,  -1,  -1, 192,  -1,  -1,  -1,  -1,  -1,
+      193,  -1,  -1, 194, 195,  -1,  -1, 196,  -1,  -1,
+      197, 198,  -1, 199,  -1, 200, 201,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 202, 203,  -1,  -1,  -1,  -1, 204,  -1,
+       -1, 205,  -1,  -1,  -1, 206, 207,  -1,  -1, 208,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 209,  -1,  -1,  -1, 210,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 211,  -1, 212, 213,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 214,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 215,  -1,  -1,  -1,
+       -1, 216,  -1,  -1, 217,  -1,  -1,  -1, 218,  -1,
+       -1,  -1,  -1,  -1, 219,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 220,  -1,  -1, 221,  -1,  -1,  -1,  -1,
+       -1, 222,  -1,  -1,  -1,  -1,  -1,  -1, 223,  -1,
+       -1,  -1,  -1,  -1,  -1, 224,  -1, 225,  -1,  -1,
+       -1,  -1,  -1, 226, 227, 228,  -1,  -1,  -1,  -1,
+      229,  -1,  -1,  -1, 230,  -1,  -1,  -1, 231,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 232,  -1,  -1, 233,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      234,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 235,  -1,  -1,  -1,
+       -1,  -1,  -1, 236,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 237,
+       -1,  -1, 238,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      239,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 240,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 241,  -1,  -1,  -1, 242,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 243,
+      244,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 245,  -1,  -1, 246,  -1,
+      247,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 248,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 249,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 250,  -1,  -1,
+      251,  -1,  -1,  -1, 252, 253,  -1,  -1, 254,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 255,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 256, 257,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 209,  -1,  -1,  -1, 210,  -1,
-      211,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 212, 213,  -1, 214,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 215,  -1,  -1,  -1,  -1, 216,
+       -1, 258,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 217,  -1,  -1, 218,  -1,  -1,  -1,  -1,
-       -1, 219,  -1, 220, 221,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 222,  -1,  -1,  -1, 223,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 224,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 225,  -1,
-       -1,  -1,  -1,  -1,  -1, 226,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 227,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 228,  -1,  -1,  -1,  -1,  -1,  -1, 229,  -1,
-       -1,  -1, 230,  -1,  -1, 231,  -1,  -1,  -1,  -1,
-      232,  -1,  -1,  -1, 233,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 234,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 235,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 236,  -1,  -1,  -1,
-      237,  -1,  -1, 238,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 239,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      240,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      241, 242,  -1,  -1,  -1,  -1,  -1, 243,  -1,  -1,
-      244, 245,  -1, 246,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 247,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 248,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 259,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 249,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 250,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 260,  -1,  -1,
+       -1,  -1, 261,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -891,47 +903,30 @@ findProp (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 251,  -1,  -1,
-       -1,  -1,  -1, 252,  -1, 253, 254,  -1,  -1,  -1,
+       -1, 262,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 255,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      256,  -1, 257,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 258,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 259,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      260,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 261,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 262,  -1,  -1,  -1,
        -1,  -1,  -1,  -1, 263,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      264,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 265,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 266,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 267,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 264,  -1,  -1,  -1,  -1, 265,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 266,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 268,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 267,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -942,20 +937,7 @@ findProp (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 269
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 268
     };
 
   if (len <= MAX_WORD_LENGTH && len >= MIN_WORD_LENGTH)
@@ -977,9 +959,9 @@ findProp (register const char *str, register unsigned int len)
     }
   return 0;
 }
-#line 280 "CSSPropertyNames.gperf"
+#line 279 "CSSPropertyNames.gperf"
 
-static const char * const propertyNameStrings[270] = {
+static const char * const propertyNameStrings[269] = {
 "background",
 "background-attachment",
 "background-color",
@@ -1071,13 +1053,6 @@ static const char * const propertyNameStrings[270] = {
 "quotes",
 "resize",
 "right",
-"scrollbar-3dlight-color",
-"scrollbar-arrow-color",
-"scrollbar-darkshadow-color",
-"scrollbar-face-color",
-"scrollbar-highlight-color",
-"scrollbar-shadow-color",
-"scrollbar-track-color",
 "size",
 "src",
 "table-layout",
@@ -1121,9 +1096,9 @@ static const char * const propertyNameStrings[270] = {
 "-webkit-animation-duration",
 "-webkit-animation-iteration-count",
 "-webkit-animation-name",
-"-webkit-animation-play-state",
 "-webkit-animation-timing-function",
 "-webkit-appearance",
+"-webkit-backface-visibility",
 "-webkit-background-clip",
 "-webkit-background-composite",
 "-webkit-background-origin",
@@ -1189,6 +1164,10 @@ static const char * const propertyNameStrings[270] = {
 "-webkit-match-nearest-mail-blockquote-color",
 "-webkit-nbsp-mode",
 "-webkit-padding-start",
+"-webkit-perspective",
+"-webkit-perspective-origin",
+"-webkit-perspective-origin-x",
+"-webkit-perspective-origin-y",
 "-webkit-rtl-ordering",
 "-webkit-text-decorations-in-effect",
 "-webkit-text-fill-color",
@@ -1201,6 +1180,8 @@ static const char * const propertyNameStrings[270] = {
 "-webkit-transform-origin",
 "-webkit-transform-origin-x",
 "-webkit-transform-origin-y",
+"-webkit-transform-origin-z",
+"-webkit-transform-style",
 "-webkit-transition",
 "-webkit-transition-delay",
 "-webkit-transition-duration",
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
index 095c2c0..aaddf05 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/CSSPropertyNames.h
@@ -96,189 +96,188 @@ enum CSSPropertyID {
     CSSPropertyQuotes = 1089,
     CSSPropertyResize = 1090,
     CSSPropertyRight = 1091,
-    CSSPropertyScrollbar3dlightColor = 1092,
-    CSSPropertyScrollbarArrowColor = 1093,
-    CSSPropertyScrollbarDarkshadowColor = 1094,
-    CSSPropertyScrollbarFaceColor = 1095,
-    CSSPropertyScrollbarHighlightColor = 1096,
-    CSSPropertyScrollbarShadowColor = 1097,
-    CSSPropertyScrollbarTrackColor = 1098,
-    CSSPropertySize = 1099,
-    CSSPropertySrc = 1100,
-    CSSPropertyTableLayout = 1101,
-    CSSPropertyTextAlign = 1102,
-    CSSPropertyTextDecoration = 1103,
-    CSSPropertyTextIndent = 1104,
-    CSSPropertyTextLineThrough = 1105,
-    CSSPropertyTextLineThroughColor = 1106,
-    CSSPropertyTextLineThroughMode = 1107,
-    CSSPropertyTextLineThroughStyle = 1108,
-    CSSPropertyTextLineThroughWidth = 1109,
-    CSSPropertyTextOverflow = 1110,
-    CSSPropertyTextOverline = 1111,
-    CSSPropertyTextOverlineColor = 1112,
-    CSSPropertyTextOverlineMode = 1113,
-    CSSPropertyTextOverlineStyle = 1114,
-    CSSPropertyTextOverlineWidth = 1115,
-    CSSPropertyTextShadow = 1116,
-    CSSPropertyTextTransform = 1117,
-    CSSPropertyTextUnderline = 1118,
-    CSSPropertyTextUnderlineColor = 1119,
-    CSSPropertyTextUnderlineMode = 1120,
-    CSSPropertyTextUnderlineStyle = 1121,
-    CSSPropertyTextUnderlineWidth = 1122,
-    CSSPropertyTop = 1123,
-    CSSPropertyUnicodeBidi = 1124,
-    CSSPropertyUnicodeRange = 1125,
-    CSSPropertyVerticalAlign = 1126,
-    CSSPropertyVisibility = 1127,
-    CSSPropertyWhiteSpace = 1128,
-    CSSPropertyWidows = 1129,
-    CSSPropertyWidth = 1130,
-    CSSPropertyWordBreak = 1131,
-    CSSPropertyWordSpacing = 1132,
-    CSSPropertyWordWrap = 1133,
-    CSSPropertyZIndex = 1134,
-    CSSPropertyZoom = 1135,
-    CSSPropertyWebkitAnimation = 1136,
-    CSSPropertyWebkitAnimationDelay = 1137,
-    CSSPropertyWebkitAnimationDirection = 1138,
-    CSSPropertyWebkitAnimationDuration = 1139,
-    CSSPropertyWebkitAnimationIterationCount = 1140,
-    CSSPropertyWebkitAnimationName = 1141,
-    CSSPropertyWebkitAnimationPlayState = 1142,
-    CSSPropertyWebkitAnimationTimingFunction = 1143,
-    CSSPropertyWebkitAppearance = 1144,
-    CSSPropertyWebkitBackgroundClip = 1145,
-    CSSPropertyWebkitBackgroundComposite = 1146,
-    CSSPropertyWebkitBackgroundOrigin = 1147,
-    CSSPropertyWebkitBackgroundSize = 1148,
-    CSSPropertyWebkitBinding = 1149,
-    CSSPropertyWebkitBorderBottomLeftRadius = 1150,
-    CSSPropertyWebkitBorderBottomRightRadius = 1151,
-    CSSPropertyWebkitBorderFit = 1152,
-    CSSPropertyWebkitBorderHorizontalSpacing = 1153,
-    CSSPropertyWebkitBorderImage = 1154,
-    CSSPropertyWebkitBorderRadius = 1155,
-    CSSPropertyWebkitBorderTopLeftRadius = 1156,
-    CSSPropertyWebkitBorderTopRightRadius = 1157,
-    CSSPropertyWebkitBorderVerticalSpacing = 1158,
-    CSSPropertyWebkitBoxAlign = 1159,
-    CSSPropertyWebkitBoxDirection = 1160,
-    CSSPropertyWebkitBoxFlex = 1161,
-    CSSPropertyWebkitBoxFlexGroup = 1162,
-    CSSPropertyWebkitBoxLines = 1163,
-    CSSPropertyWebkitBoxOrdinalGroup = 1164,
-    CSSPropertyWebkitBoxOrient = 1165,
-    CSSPropertyWebkitBoxPack = 1166,
-    CSSPropertyWebkitBoxReflect = 1167,
-    CSSPropertyWebkitBoxShadow = 1168,
-    CSSPropertyWebkitBoxSizing = 1169,
-    CSSPropertyWebkitColumnBreakAfter = 1170,
-    CSSPropertyWebkitColumnBreakBefore = 1171,
-    CSSPropertyWebkitColumnBreakInside = 1172,
-    CSSPropertyWebkitColumnCount = 1173,
-    CSSPropertyWebkitColumnGap = 1174,
-    CSSPropertyWebkitColumnRule = 1175,
-    CSSPropertyWebkitColumnRuleColor = 1176,
-    CSSPropertyWebkitColumnRuleStyle = 1177,
-    CSSPropertyWebkitColumnRuleWidth = 1178,
-    CSSPropertyWebkitColumnWidth = 1179,
-    CSSPropertyWebkitColumns = 1180,
-    CSSPropertyWebkitFontSizeDelta = 1181,
-    CSSPropertyWebkitHighlight = 1182,
-    CSSPropertyWebkitLineBreak = 1183,
-    CSSPropertyWebkitLineClamp = 1184,
-    CSSPropertyWebkitMarginBottomCollapse = 1185,
-    CSSPropertyWebkitMarginCollapse = 1186,
-    CSSPropertyWebkitMarginStart = 1187,
-    CSSPropertyWebkitMarginTopCollapse = 1188,
-    CSSPropertyWebkitMarquee = 1189,
-    CSSPropertyWebkitMarqueeDirection = 1190,
-    CSSPropertyWebkitMarqueeIncrement = 1191,
-    CSSPropertyWebkitMarqueeRepetition = 1192,
-    CSSPropertyWebkitMarqueeSpeed = 1193,
-    CSSPropertyWebkitMarqueeStyle = 1194,
-    CSSPropertyWebkitMask = 1195,
-    CSSPropertyWebkitMaskAttachment = 1196,
-    CSSPropertyWebkitMaskBoxImage = 1197,
-    CSSPropertyWebkitMaskClip = 1198,
-    CSSPropertyWebkitMaskComposite = 1199,
-    CSSPropertyWebkitMaskImage = 1200,
-    CSSPropertyWebkitMaskOrigin = 1201,
-    CSSPropertyWebkitMaskPosition = 1202,
-    CSSPropertyWebkitMaskPositionX = 1203,
-    CSSPropertyWebkitMaskPositionY = 1204,
-    CSSPropertyWebkitMaskRepeat = 1205,
-    CSSPropertyWebkitMaskSize = 1206,
-    CSSPropertyWebkitMatchNearestMailBlockquoteColor = 1207,
-    CSSPropertyWebkitNbspMode = 1208,
-    CSSPropertyWebkitPaddingStart = 1209,
-    CSSPropertyWebkitRtlOrdering = 1210,
-    CSSPropertyWebkitTextDecorationsInEffect = 1211,
-    CSSPropertyWebkitTextFillColor = 1212,
-    CSSPropertyWebkitTextSecurity = 1213,
-    CSSPropertyWebkitTextSizeAdjust = 1214,
-    CSSPropertyWebkitTextStroke = 1215,
-    CSSPropertyWebkitTextStrokeColor = 1216,
-    CSSPropertyWebkitTextStrokeWidth = 1217,
-    CSSPropertyWebkitTransform = 1218,
-    CSSPropertyWebkitTransformOrigin = 1219,
-    CSSPropertyWebkitTransformOriginX = 1220,
-    CSSPropertyWebkitTransformOriginY = 1221,
-    CSSPropertyWebkitTransition = 1222,
-    CSSPropertyWebkitTransitionDelay = 1223,
-    CSSPropertyWebkitTransitionDuration = 1224,
-    CSSPropertyWebkitTransitionProperty = 1225,
-    CSSPropertyWebkitTransitionTimingFunction = 1226,
-    CSSPropertyWebkitUserDrag = 1227,
-    CSSPropertyWebkitUserModify = 1228,
-    CSSPropertyWebkitUserSelect = 1229,
-    CSSPropertyWebkitVariableDeclarationBlock = 1230,
-    CSSPropertyClipPath = 1231,
-    CSSPropertyClipRule = 1232,
-    CSSPropertyMask = 1233,
-    CSSPropertyEnableBackground = 1234,
-    CSSPropertyFilter = 1235,
-    CSSPropertyFloodColor = 1236,
-    CSSPropertyFloodOpacity = 1237,
-    CSSPropertyLightingColor = 1238,
-    CSSPropertyStopColor = 1239,
-    CSSPropertyStopOpacity = 1240,
-    CSSPropertyColorInterpolation = 1241,
-    CSSPropertyColorInterpolationFilters = 1242,
-    CSSPropertyColorProfile = 1243,
-    CSSPropertyColorRendering = 1244,
-    CSSPropertyFill = 1245,
-    CSSPropertyFillOpacity = 1246,
-    CSSPropertyFillRule = 1247,
-    CSSPropertyImageRendering = 1248,
-    CSSPropertyMarker = 1249,
-    CSSPropertyMarkerEnd = 1250,
-    CSSPropertyMarkerMid = 1251,
-    CSSPropertyMarkerStart = 1252,
-    CSSPropertyShapeRendering = 1253,
-    CSSPropertyStroke = 1254,
-    CSSPropertyStrokeDasharray = 1255,
-    CSSPropertyStrokeDashoffset = 1256,
-    CSSPropertyStrokeLinecap = 1257,
-    CSSPropertyStrokeLinejoin = 1258,
-    CSSPropertyStrokeMiterlimit = 1259,
-    CSSPropertyStrokeOpacity = 1260,
-    CSSPropertyStrokeWidth = 1261,
-    CSSPropertyTextRendering = 1262,
-    CSSPropertyAlignmentBaseline = 1263,
-    CSSPropertyBaselineShift = 1264,
-    CSSPropertyDominantBaseline = 1265,
-    CSSPropertyGlyphOrientationHorizontal = 1266,
-    CSSPropertyGlyphOrientationVertical = 1267,
-    CSSPropertyKerning = 1268,
-    CSSPropertyTextAnchor = 1269,
-    CSSPropertyWritingMode = 1270,
+    CSSPropertySize = 1092,
+    CSSPropertySrc = 1093,
+    CSSPropertyTableLayout = 1094,
+    CSSPropertyTextAlign = 1095,
+    CSSPropertyTextDecoration = 1096,
+    CSSPropertyTextIndent = 1097,
+    CSSPropertyTextLineThrough = 1098,
+    CSSPropertyTextLineThroughColor = 1099,
+    CSSPropertyTextLineThroughMode = 1100,
+    CSSPropertyTextLineThroughStyle = 1101,
+    CSSPropertyTextLineThroughWidth = 1102,
+    CSSPropertyTextOverflow = 1103,
+    CSSPropertyTextOverline = 1104,
+    CSSPropertyTextOverlineColor = 1105,
+    CSSPropertyTextOverlineMode = 1106,
+    CSSPropertyTextOverlineStyle = 1107,
+    CSSPropertyTextOverlineWidth = 1108,
+    CSSPropertyTextShadow = 1109,
+    CSSPropertyTextTransform = 1110,
+    CSSPropertyTextUnderline = 1111,
+    CSSPropertyTextUnderlineColor = 1112,
+    CSSPropertyTextUnderlineMode = 1113,
+    CSSPropertyTextUnderlineStyle = 1114,
+    CSSPropertyTextUnderlineWidth = 1115,
+    CSSPropertyTop = 1116,
+    CSSPropertyUnicodeBidi = 1117,
+    CSSPropertyUnicodeRange = 1118,
+    CSSPropertyVerticalAlign = 1119,
+    CSSPropertyVisibility = 1120,
+    CSSPropertyWhiteSpace = 1121,
+    CSSPropertyWidows = 1122,
+    CSSPropertyWidth = 1123,
+    CSSPropertyWordBreak = 1124,
+    CSSPropertyWordSpacing = 1125,
+    CSSPropertyWordWrap = 1126,
+    CSSPropertyZIndex = 1127,
+    CSSPropertyZoom = 1128,
+    CSSPropertyWebkitAnimation = 1129,
+    CSSPropertyWebkitAnimationDelay = 1130,
+    CSSPropertyWebkitAnimationDirection = 1131,
+    CSSPropertyWebkitAnimationDuration = 1132,
+    CSSPropertyWebkitAnimationIterationCount = 1133,
+    CSSPropertyWebkitAnimationName = 1134,
+    CSSPropertyWebkitAnimationTimingFunction = 1135,
+    CSSPropertyWebkitAppearance = 1136,
+    CSSPropertyWebkitBackfaceVisibility = 1137,
+    CSSPropertyWebkitBackgroundClip = 1138,
+    CSSPropertyWebkitBackgroundComposite = 1139,
+    CSSPropertyWebkitBackgroundOrigin = 1140,
+    CSSPropertyWebkitBackgroundSize = 1141,
+    CSSPropertyWebkitBinding = 1142,
+    CSSPropertyWebkitBorderBottomLeftRadius = 1143,
+    CSSPropertyWebkitBorderBottomRightRadius = 1144,
+    CSSPropertyWebkitBorderFit = 1145,
+    CSSPropertyWebkitBorderHorizontalSpacing = 1146,
+    CSSPropertyWebkitBorderImage = 1147,
+    CSSPropertyWebkitBorderRadius = 1148,
+    CSSPropertyWebkitBorderTopLeftRadius = 1149,
+    CSSPropertyWebkitBorderTopRightRadius = 1150,
+    CSSPropertyWebkitBorderVerticalSpacing = 1151,
+    CSSPropertyWebkitBoxAlign = 1152,
+    CSSPropertyWebkitBoxDirection = 1153,
+    CSSPropertyWebkitBoxFlex = 1154,
+    CSSPropertyWebkitBoxFlexGroup = 1155,
+    CSSPropertyWebkitBoxLines = 1156,
+    CSSPropertyWebkitBoxOrdinalGroup = 1157,
+    CSSPropertyWebkitBoxOrient = 1158,
+    CSSPropertyWebkitBoxPack = 1159,
+    CSSPropertyWebkitBoxReflect = 1160,
+    CSSPropertyWebkitBoxShadow = 1161,
+    CSSPropertyWebkitBoxSizing = 1162,
+    CSSPropertyWebkitColumnBreakAfter = 1163,
+    CSSPropertyWebkitColumnBreakBefore = 1164,
+    CSSPropertyWebkitColumnBreakInside = 1165,
+    CSSPropertyWebkitColumnCount = 1166,
+    CSSPropertyWebkitColumnGap = 1167,
+    CSSPropertyWebkitColumnRule = 1168,
+    CSSPropertyWebkitColumnRuleColor = 1169,
+    CSSPropertyWebkitColumnRuleStyle = 1170,
+    CSSPropertyWebkitColumnRuleWidth = 1171,
+    CSSPropertyWebkitColumnWidth = 1172,
+    CSSPropertyWebkitColumns = 1173,
+    CSSPropertyWebkitFontSizeDelta = 1174,
+    CSSPropertyWebkitHighlight = 1175,
+    CSSPropertyWebkitLineBreak = 1176,
+    CSSPropertyWebkitLineClamp = 1177,
+    CSSPropertyWebkitMarginBottomCollapse = 1178,
+    CSSPropertyWebkitMarginCollapse = 1179,
+    CSSPropertyWebkitMarginStart = 1180,
+    CSSPropertyWebkitMarginTopCollapse = 1181,
+    CSSPropertyWebkitMarquee = 1182,
+    CSSPropertyWebkitMarqueeDirection = 1183,
+    CSSPropertyWebkitMarqueeIncrement = 1184,
+    CSSPropertyWebkitMarqueeRepetition = 1185,
+    CSSPropertyWebkitMarqueeSpeed = 1186,
+    CSSPropertyWebkitMarqueeStyle = 1187,
+    CSSPropertyWebkitMask = 1188,
+    CSSPropertyWebkitMaskAttachment = 1189,
+    CSSPropertyWebkitMaskBoxImage = 1190,
+    CSSPropertyWebkitMaskClip = 1191,
+    CSSPropertyWebkitMaskComposite = 1192,
+    CSSPropertyWebkitMaskImage = 1193,
+    CSSPropertyWebkitMaskOrigin = 1194,
+    CSSPropertyWebkitMaskPosition = 1195,
+    CSSPropertyWebkitMaskPositionX = 1196,
+    CSSPropertyWebkitMaskPositionY = 1197,
+    CSSPropertyWebkitMaskRepeat = 1198,
+    CSSPropertyWebkitMaskSize = 1199,
+    CSSPropertyWebkitMatchNearestMailBlockquoteColor = 1200,
+    CSSPropertyWebkitNbspMode = 1201,
+    CSSPropertyWebkitPaddingStart = 1202,
+    CSSPropertyWebkitPerspective = 1203,
+    CSSPropertyWebkitPerspectiveOrigin = 1204,
+    CSSPropertyWebkitPerspectiveOriginX = 1205,
+    CSSPropertyWebkitPerspectiveOriginY = 1206,
+    CSSPropertyWebkitRtlOrdering = 1207,
+    CSSPropertyWebkitTextDecorationsInEffect = 1208,
+    CSSPropertyWebkitTextFillColor = 1209,
+    CSSPropertyWebkitTextSecurity = 1210,
+    CSSPropertyWebkitTextSizeAdjust = 1211,
+    CSSPropertyWebkitTextStroke = 1212,
+    CSSPropertyWebkitTextStrokeColor = 1213,
+    CSSPropertyWebkitTextStrokeWidth = 1214,
+    CSSPropertyWebkitTransform = 1215,
+    CSSPropertyWebkitTransformOrigin = 1216,
+    CSSPropertyWebkitTransformOriginX = 1217,
+    CSSPropertyWebkitTransformOriginY = 1218,
+    CSSPropertyWebkitTransformOriginZ = 1219,
+    CSSPropertyWebkitTransformStyle = 1220,
+    CSSPropertyWebkitTransition = 1221,
+    CSSPropertyWebkitTransitionDelay = 1222,
+    CSSPropertyWebkitTransitionDuration = 1223,
+    CSSPropertyWebkitTransitionProperty = 1224,
+    CSSPropertyWebkitTransitionTimingFunction = 1225,
+    CSSPropertyWebkitUserDrag = 1226,
+    CSSPropertyWebkitUserModify = 1227,
+    CSSPropertyWebkitUserSelect = 1228,
+    CSSPropertyWebkitVariableDeclarationBlock = 1229,
+    CSSPropertyClipPath = 1230,
+    CSSPropertyClipRule = 1231,
+    CSSPropertyMask = 1232,
+    CSSPropertyEnableBackground = 1233,
+    CSSPropertyFilter = 1234,
+    CSSPropertyFloodColor = 1235,
+    CSSPropertyFloodOpacity = 1236,
+    CSSPropertyLightingColor = 1237,
+    CSSPropertyStopColor = 1238,
+    CSSPropertyStopOpacity = 1239,
+    CSSPropertyColorInterpolation = 1240,
+    CSSPropertyColorInterpolationFilters = 1241,
+    CSSPropertyColorProfile = 1242,
+    CSSPropertyColorRendering = 1243,
+    CSSPropertyFill = 1244,
+    CSSPropertyFillOpacity = 1245,
+    CSSPropertyFillRule = 1246,
+    CSSPropertyImageRendering = 1247,
+    CSSPropertyMarker = 1248,
+    CSSPropertyMarkerEnd = 1249,
+    CSSPropertyMarkerMid = 1250,
+    CSSPropertyMarkerStart = 1251,
+    CSSPropertyShapeRendering = 1252,
+    CSSPropertyStroke = 1253,
+    CSSPropertyStrokeDasharray = 1254,
+    CSSPropertyStrokeDashoffset = 1255,
+    CSSPropertyStrokeLinecap = 1256,
+    CSSPropertyStrokeLinejoin = 1257,
+    CSSPropertyStrokeMiterlimit = 1258,
+    CSSPropertyStrokeOpacity = 1259,
+    CSSPropertyStrokeWidth = 1260,
+    CSSPropertyTextRendering = 1261,
+    CSSPropertyAlignmentBaseline = 1262,
+    CSSPropertyBaselineShift = 1263,
+    CSSPropertyDominantBaseline = 1264,
+    CSSPropertyGlyphOrientationHorizontal = 1265,
+    CSSPropertyGlyphOrientationVertical = 1266,
+    CSSPropertyKerning = 1267,
+    CSSPropertyTextAnchor = 1268,
+    CSSPropertyWritingMode = 1269,
 };
 
 const int firstCSSProperty = 1001;
-const int numCSSProperties = 270;
+const int numCSSProperties = 269;
 const size_t maxCSSPropertyNameLength = 43;
 
 const char* getPropertyName(CSSPropertyID);
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c
index 5ff0858..e84ca9e 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c
+++ b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.c
@@ -38,7 +38,7 @@ struct css_value {
     const char* name;
     int id;
 };
-/* maximum key range = 5296, duplicates = 0 */
+/* maximum key range = 8752, duplicates = 0 */
 
 #ifdef __GNUC__
 __inline
@@ -52,32 +52,32 @@ hash_val (register const char *str, register unsigned int len)
 {
   static const unsigned short asso_values[] =
     {
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296,   90,   37, 5296, 5296,    0,
-        55,   50,   40,   35,   30,   25,   20,    5, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296,    5,  200,   15,
-       285,    0,    1, 1005,  565,   35,  226,  850,   10,   20,
-        30,   10,   45,  661,  325,    5,   80,  305,  805,   32,
-       511,  256,  790,    0, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296, 5296,
-      5296, 5296, 5296, 5296, 5296, 5296, 5296
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752,  970,   27, 8752, 8752,    0,
+        55,    5,   50,   40,   35,   30,   25,   20, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752,    5,  200,   15,
+       590,    0,  515,  251,   21,   35,    1,  905,   10,   20,
+        30,   10,   45,  651,  160,    5,   80,  145,  960,  136,
+       920,  971,  105,    0, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752, 8752,
+      8752, 8752, 8752, 8752, 8752, 8752, 8752
     };
   register int hval = 0;
 
@@ -188,1402 +188,1537 @@ findValue (register const char *str, register unsigned int len)
 {
   enum
     {
-      TOTAL_KEYWORDS = 531,
+      TOTAL_KEYWORDS = 537,
       MIN_WORD_LENGTH = 2,
       MAX_WORD_LENGTH = 30,
       MIN_HASH_VALUE = 0,
-      MAX_HASH_VALUE = 5295
+      MAX_HASH_VALUE = 8751
     };
 
   static const struct css_value wordlist_value[] =
     {
 #line 40 "CSSValueKeywords.gperf"
       {"100", CSSValue100},
-#line 48 "CSSValueKeywords.gperf"
-      {"900", CSSValue900},
+#line 42 "CSSValueKeywords.gperf"
+      {"300", CSSValue300},
 #line 287 "CSSValueKeywords.gperf"
       {"end", CSSValueEnd},
-#line 539 "CSSValueKeywords.gperf"
+#line 545 "CSSValueKeywords.gperf"
       {"lr", CSSValueLr},
+#line 48 "CSSValueKeywords.gperf"
+      {"900", CSSValue900},
+#line 256 "CSSValueKeywords.gperf"
+      {"hide", CSSValueHide},
 #line 47 "CSSValueKeywords.gperf"
       {"800", CSSValue800},
+#line 369 "CSSValueKeywords.gperf"
+      {"lines", CSSValueLines},
 #line 46 "CSSValueKeywords.gperf"
       {"700", CSSValue700},
 #line 45 "CSSValueKeywords.gperf"
       {"600", CSSValue600},
+#line 209 "CSSValueKeywords.gperf"
+      {"alias", CSSValueAlias},
 #line 44 "CSSValueKeywords.gperf"
       {"500", CSSValue500},
-#line 43 "CSSValueKeywords.gperf"
-      {"400", CSSValue400},
+#line 81 "CSSValueKeywords.gperf"
+      {"lime", CSSValueLime},
 #line 34 "CSSValueKeywords.gperf"
       {"all", CSSValueAll},
-#line 207 "CSSValueKeywords.gperf"
-      {"cell", CSSValueCell},
-#line 69 "CSSValueKeywords.gperf"
-      {"serif", CSSValueSerif},
-#line 42 "CSSValueKeywords.gperf"
-      {"300", CSSValue300},
-#line 273 "CSSValueKeywords.gperf"
-      {"pre", CSSValuePre},
-#line 260 "CSSValueKeywords.gperf"
-      {"level", CSSValueLevel},
+#line 164 "CSSValueKeywords.gperf"
+      {"circle", CSSValueCircle},
+#line 43 "CSSValueKeywords.gperf"
+      {"400", CSSValue400},
+#line 463 "CSSValueKeywords.gperf"
+      {"linen", CSSValueLinen},
 #line 41 "CSSValueKeywords.gperf"
       {"200", CSSValue200},
-#line 473 "CSSValueKeywords.gperf"
+#line 479 "CSSValueKeywords.gperf"
       {"oldlace", CSSValueOldlace},
 #line 252 "CSSValueKeywords.gperf"
       {"cross", CSSValueCross},
-#line 394 "CSSValueKeywords.gperf"
+#line 400 "CSSValueKeywords.gperf"
       {"coral", CSSValueCoral},
+#line 312 "CSSValueKeywords.gperf"
+      {"clip", CSSValueClip},
 #line 13 "CSSValueKeywords.gperf"
       {"none", CSSValueNone},
-#line 499 "CSSValueKeywords.gperf"
-      {"snow", CSSValueSnow},
-#line 541 "CSSValueKeywords.gperf"
+#line 403 "CSSValueKeywords.gperf"
+      {"crimson", CSSValueCrimson},
+#line 547 "CSSValueKeywords.gperf"
       {"tb", CSSValueTb},
-#line 205 "CSSValueKeywords.gperf"
-      {"move", CSSValueMove},
-#line 300 "CSSValueKeywords.gperf"
-      {"slow", CSSValueSlow},
 #line 251 "CSSValueKeywords.gperf"
       {"crop", CSSValueCrop},
 #line 36 "CSSValueKeywords.gperf"
       {"normal", CSSValueNormal},
-#line 279 "CSSValueKeywords.gperf"
-      {"show", CSSValueShow},
 #line 183 "CSSValueKeywords.gperf"
       {"inline", CSSValueInline},
 #line 176 "CSSValueKeywords.gperf"
       {"armenian", CSSValueArmenian},
+#line 367 "CSSValueKeywords.gperf"
+      {"logical", CSSValueLogical},
 #line 241 "CSSValueKeywords.gperf"
       {"collapse", CSSValueCollapse},
-#line 308 "CSSValueKeywords.gperf"
-      {"element", CSSValueElement},
-#line 507 "CSSValueKeywords.gperf"
-      {"wheat", CSSValueWheat},
+#line 282 "CSSValueKeywords.gperf"
+      {"thin", CSSValueThin},
 #line 73 "CSSValueKeywords.gperf"
       {"monospace", CSSValueMonospace},
+#line 235 "CSSValueKeywords.gperf"
+      {"ltr", CSSValueLtr},
 #line 313 "CSSValueKeywords.gperf"
       {"ellipsis", CSSValueEllipsis},
+#line 12 "CSSValueKeywords.gperf"
+      {"initial", CSSValueInitial},
+#line 215 "CSSValueKeywords.gperf"
+      {"e-resize", CSSValueEResize},
+#line 546 "CSSValueKeywords.gperf"
+      {"rl", CSSValueRl},
+#line 221 "CSSValueKeywords.gperf"
+      {"s-resize", CSSValueSResize},
+#line 375 "CSSValueKeywords.gperf"
+      {"linear", CSSValueLinear},
+#line 505 "CSSValueKeywords.gperf"
+      {"snow", CSSValueSnow},
+#line 205 "CSSValueKeywords.gperf"
+      {"move", CSSValueMove},
 #line 15 "CSSValueKeywords.gperf"
       {"inset", CSSValueInset},
-#line 393 "CSSValueKeywords.gperf"
+#line 300 "CSSValueKeywords.gperf"
+      {"slow", CSSValueSlow},
+#line 218 "CSSValueKeywords.gperf"
+      {"n-resize", CSSValueNResize},
+#line 509 "CSSValueKeywords.gperf"
+      {"thistle", CSSValueThistle},
+#line 455 "CSSValueKeywords.gperf"
+      {"lightsalmon", CSSValueLightsalmon},
+#line 399 "CSSValueKeywords.gperf"
       {"chocolate", CSSValueChocolate},
-#line 274 "CSSValueKeywords.gperf"
-      {"pre-line", CSSValuePreLine},
+#line 279 "CSSValueKeywords.gperf"
+      {"show", CSSValueShow},
+#line 257 "CSSValueKeywords.gperf"
+      {"higher", CSSValueHigher},
+#line 520 "CSSValueKeywords.gperf"
+      {"srgb", CSSValueSrgb},
 #line 187 "CSSValueKeywords.gperf"
       {"compact", CSSValueCompact},
-#line 522 "CSSValueKeywords.gperf"
-      {"bevel", CSSValueBevel},
-#line 504 "CSSValueKeywords.gperf"
+#line 309 "CSSValueKeywords.gperf"
+      {"ignore", CSSValueIgnore},
+#line 510 "CSSValueKeywords.gperf"
       {"tomato", CSSValueTomato},
-#line 365 "CSSValueKeywords.gperf"
-      {"lines", CSSValueLines},
+#line 90 "CSSValueKeywords.gperf"
+      {"white", CSSValueWhite},
 #line 51 "CSSValueKeywords.gperf"
       {"small", CSSValueSmall},
-#line 379 "CSSValueKeywords.gperf"
-      {"fill", CSSValueFill},
-#line 359 "CSSValueKeywords.gperf"
+#line 362 "CSSValueKeywords.gperf"
       {"content", CSSValueContent},
-#line 209 "CSSValueKeywords.gperf"
-      {"alias", CSSValueAlias},
-#line 246 "CSSValueKeywords.gperf"
-      {"below", CSSValueBelow},
-#line 317 "CSSValueKeywords.gperf"
-      {"wave", CSSValueWave},
-#line 81 "CSSValueKeywords.gperf"
-      {"lime", CSSValueLime},
-#line 164 "CSSValueKeywords.gperf"
-      {"circle", CSSValueCircle},
+#line 285 "CSSValueKeywords.gperf"
+      {"stretch", CSSValueStretch},
 #line 82 "CSSValueKeywords.gperf"
       {"maroon", CSSValueMaroon},
-#line 457 "CSSValueKeywords.gperf"
-      {"linen", CSSValueLinen},
-#line 368 "CSSValueKeywords.gperf"
+#line 293 "CSSValueKeywords.gperf"
+      {"single", CSSValueSingle},
+#line 374 "CSSValueKeywords.gperf"
       {"ease", CSSValueEase},
-#line 490 "CSSValueKeywords.gperf"
+#line 155 "CSSValueKeywords.gperf"
+      {"right", CSSValueRight},
+#line 496 "CSSValueKeywords.gperf"
       {"salmon", CSSValueSalmon},
-#line 502 "CSSValueKeywords.gperf"
+#line 508 "CSSValueKeywords.gperf"
       {"tan", CSSValueTan},
-#line 89 "CSSValueKeywords.gperf"
-      {"teal", CSSValueTeal},
-#line 494 "CSSValueKeywords.gperf"
-      {"sienna", CSSValueSienna},
-#line 348 "CSSValueKeywords.gperf"
+#line 544 "CSSValueKeywords.gperf"
+      {"tb-rl", CSSValueTbRl},
+#line 39 "CSSValueKeywords.gperf"
+      {"lighter", CSSValueLighter},
+#line 202 "CSSValueKeywords.gperf"
+      {"crosshair", CSSValueCrosshair},
+#line 59 "CSSValueKeywords.gperf"
+      {"wider", CSSValueWider},
+#line 351 "CSSValueKeywords.gperf"
       {"caret", CSSValueCaret},
 #line 189 "CSSValueKeywords.gperf"
       {"table", CSSValueTable},
-#line 312 "CSSValueKeywords.gperf"
-      {"clip", CSSValueClip},
-#line 397 "CSSValueKeywords.gperf"
-      {"crimson", CSSValueCrimson},
-#line 389 "CSSValueKeywords.gperf"
+#line 332 "CSSValueKeywords.gperf"
+      {"listitem", CSSValueListitem},
+#line 475 "CSSValueKeywords.gperf"
+      {"mintcream", CSSValueMintcream},
+#line 222 "CSSValueKeywords.gperf"
+      {"w-resize", CSSValueWResize},
+#line 542 "CSSValueKeywords.gperf"
+      {"lr-tb", CSSValueLrTb},
+#line 179 "CSSValueKeywords.gperf"
+      {"hiragana", CSSValueHiragana},
+#line 236 "CSSValueKeywords.gperf"
+      {"rtl", CSSValueRtl},
+#line 527 "CSSValueKeywords.gperf"
+      {"miter", CSSValueMiter},
+#line 448 "CSSValueKeywords.gperf"
+      {"lightcoral", CSSValueLightcoral},
+#line 440 "CSSValueKeywords.gperf"
+      {"indigo", CSSValueIndigo},
+#line 243 "CSSValueKeywords.gperf"
+      {"absolute", CSSValueAbsolute},
+#line 289 "CSSValueKeywords.gperf"
+      {"horizontal", CSSValueHorizontal},
+#line 404 "CSSValueKeywords.gperf"
+      {"cyan", CSSValueCyan},
+#line 11 "CSSValueKeywords.gperf"
+      {"inherit", CSSValueInherit},
+#line 464 "CSSValueKeywords.gperf"
+      {"magenta", CSSValueMagenta},
+#line 516 "CSSValueKeywords.gperf"
+      {"nonzero", CSSValueNonzero},
+#line 204 "CSSValueKeywords.gperf"
+      {"pointer", CSSValuePointer},
+#line 283 "CSSValueKeywords.gperf"
+      {"underline", CSSValueUnderline},
+#line 130 "CSSValueKeywords.gperf"
+      {"no-repeat", CSSValueNoRepeat},
+#line 387 "CSSValueKeywords.gperf"
+      {"aliceblue", CSSValueAliceblue},
+#line 112 "CSSValueKeywords.gperf"
+      {"match", CSSValueMatch},
+#line 325 "CSSValueKeywords.gperf"
+      {"radio", CSSValueRadio},
+#line 249 "CSSValueKeywords.gperf"
+      {"both", CSSValueBoth},
+#line 17 "CSSValueKeywords.gperf"
+      {"ridge", CSSValueRidge},
+#line 57 "CSSValueKeywords.gperf"
+      {"smaller", CSSValueSmaller},
+#line 395 "CSSValueKeywords.gperf"
       {"brown", CSSValueBrown},
-#line 235 "CSSValueKeywords.gperf"
-      {"ltr", CSSValueLtr},
+#line 230 "CSSValueKeywords.gperf"
+      {"wait", CSSValueWait},
+#line 258 "CSSValueKeywords.gperf"
+      {"invert", CSSValueInvert},
+#line 540 "CSSValueKeywords.gperf"
+      {"no-change", CSSValueNoChange},
+#line 32 "CSSValueKeywords.gperf"
+      {"italic", CSSValueItalic},
+#line 224 "CSSValueKeywords.gperf"
+      {"ns-resize", CSSValueNsResize},
+#line 304 "CSSValueKeywords.gperf"
+      {"alternate", CSSValueAlternate},
+#line 272 "CSSValueKeywords.gperf"
+      {"portrait", CSSValuePortrait},
+#line 105 "CSSValueKeywords.gperf"
+      {"highlight", CSSValueHighlight},
+#line 53 "CSSValueKeywords.gperf"
+      {"large", CSSValueLarge},
+#line 310 "CSSValueKeywords.gperf"
+      {"intrinsic", CSSValueIntrinsic},
+#line 317 "CSSValueKeywords.gperf"
+      {"wave", CSSValueWave},
+#line 501 "CSSValueKeywords.gperf"
+      {"skyblue", CSSValueSkyblue},
+#line 302 "CSSValueKeywords.gperf"
+      {"infinite", CSSValueInfinite},
+#line 280 "CSSValueKeywords.gperf"
+      {"static", CSSValueStatic},
+#line 462 "CSSValueKeywords.gperf"
+      {"limegreen", CSSValueLimegreen},
+#line 543 "CSSValueKeywords.gperf"
+      {"rl-tb", CSSValueRlTb},
+#line 447 "CSSValueKeywords.gperf"
+      {"lightblue", CSSValueLightblue},
+#line 85 "CSSValueKeywords.gperf"
+      {"orange", CSSValueOrange},
+#line 151 "CSSValueKeywords.gperf"
+      {"bottom", CSSValueBottom},
+#line 210 "CSSValueKeywords.gperf"
+      {"progress", CSSValueProgress},
+#line 318 "CSSValueKeywords.gperf"
+      {"continuous", CSSValueContinuous},
+#line 385 "CSSValueKeywords.gperf"
+      {"fill", CSSValueFill},
+#line 144 "CSSValueKeywords.gperf"
+      {"baseline", CSSValueBaseline},
+#line 538 "CSSValueKeywords.gperf"
+      {"mathematical", CSSValueMathematical},
+#line 207 "CSSValueKeywords.gperf"
+      {"cell", CSSValueCell},
+#line 273 "CSSValueKeywords.gperf"
+      {"pre", CSSValuePre},
+#line 452 "CSSValueKeywords.gperf"
+      {"lightgreen", CSSValueLightgreen},
+#line 460 "CSSValueKeywords.gperf"
+      {"lightsteelblue", CSSValueLightsteelblue},
+#line 456 "CSSValueKeywords.gperf"
+      {"lightseagreen", CSSValueLightseagreen},
+#line 500 "CSSValueKeywords.gperf"
+      {"sienna", CSSValueSienna},
+#line 286 "CSSValueKeywords.gperf"
+      {"start", CSSValueStart},
+#line 231 "CSSValueKeywords.gperf"
+      {"help", CSSValueHelp},
+#line 303 "CSSValueKeywords.gperf"
+      {"slide", CSSValueSlide},
+#line 145 "CSSValueKeywords.gperf"
+      {"middle", CSSValueMiddle},
+#line 58 "CSSValueKeywords.gperf"
+      {"larger", CSSValueLarger},
 #line 277 "CSSValueKeywords.gperf"
       {"scroll", CSSValueScroll},
-#line 87 "CSSValueKeywords.gperf"
-      {"red", CSSValueRed},
-#line 91 "CSSValueKeywords.gperf"
-      {"yellow", CSSValueYellow},
 #line 253 "CSSValueKeywords.gperf"
       {"embed", CSSValueEmbed},
-#line 297 "CSSValueKeywords.gperf"
-      {"ahead", CSSValueAhead},
-#line 536 "CSSValueKeywords.gperf"
-      {"lr-tb", CSSValueLrTb},
+#line 92 "CSSValueKeywords.gperf"
+      {"transparent", CSSValueTransparent},
+#line 14 "CSSValueKeywords.gperf"
+      {"hidden", CSSValueHidden},
+#line 397 "CSSValueKeywords.gperf"
+      {"cadetblue", CSSValueCadetblue},
+#line 478 "CSSValueKeywords.gperf"
+      {"navajowhite", CSSValueNavajowhite},
+#line 502 "CSSValueKeywords.gperf"
+      {"slateblue", CSSValueSlateblue},
+#line 308 "CSSValueKeywords.gperf"
+      {"element", CSSValueElement},
+#line 260 "CSSValueKeywords.gperf"
+      {"level", CSSValueLevel},
+#line 87 "CSSValueKeywords.gperf"
+      {"red", CSSValueRed},
+#line 494 "CSSValueKeywords.gperf"
+      {"royalblue", CSSValueRoyalblue},
+#line 163 "CSSValueKeywords.gperf"
+      {"disc", CSSValueDisc},
+#line 433 "CSSValueKeywords.gperf"
+      {"ghostwhite", CSSValueGhostwhite},
 #line 25 "CSSValueKeywords.gperf"
       {"menu", CSSValueMenu},
-#line 540 "CSSValueKeywords.gperf"
-      {"rl", CSSValueRl},
-#line 483 "CSSValueKeywords.gperf"
+#line 21 "CSSValueKeywords.gperf"
+      {"solid", CSSValueSolid},
+#line 24 "CSSValueKeywords.gperf"
+      {"icon", CSSValueIcon},
+#line 60 "CSSValueKeywords.gperf"
+      {"narrower", CSSValueNarrower},
+#line 484 "CSSValueKeywords.gperf"
+      {"palegreen", CSSValuePalegreen},
+#line 489 "CSSValueKeywords.gperf"
       {"peru", CSSValuePeru},
-#line 301 "CSSValueKeywords.gperf"
-      {"fast", CSSValueFast},
 #line 131 "CSSValueKeywords.gperf"
       {"clear", CSSValueClear},
-#line 282 "CSSValueKeywords.gperf"
-      {"thin", CSSValueThin},
-#line 90 "CSSValueKeywords.gperf"
-      {"white", CSSValueWhite},
 #line 52 "CSSValueKeywords.gperf"
       {"medium", CSSValueMedium},
-#line 21 "CSSValueKeywords.gperf"
-      {"solid", CSSValueSolid},
-#line 24 "CSSValueKeywords.gperf"
-      {"icon", CSSValueIcon},
-#line 12 "CSSValueKeywords.gperf"
-      {"initial", CSSValueInitial},
-#line 245 "CSSValueKeywords.gperf"
-      {"avoid", CSSValueAvoid},
-#line 35 "CSSValueKeywords.gperf"
-      {"small-caps", CSSValueSmallCaps},
-#line 229 "CSSValueKeywords.gperf"
-      {"text", CSSValueText},
-#line 116 "CSSValueKeywords.gperf"
-      {"threedface", CSSValueThreedface},
-#line 197 "CSSValueKeywords.gperf"
-      {"table-cell", CSSValueTableCell},
-#line 156 "CSSValueKeywords.gperf"
-      {"center", CSSValueCenter},
-#line 370 "CSSValueKeywords.gperf"
-      {"ease-in", CSSValueEaseIn},
-#line 503 "CSSValueKeywords.gperf"
-      {"thistle", CSSValueThistle},
-#line 471 "CSSValueKeywords.gperf"
+#line 477 "CSSValueKeywords.gperf"
       {"moccasin", CSSValueMoccasin},
-#line 271 "CSSValueKeywords.gperf"
-      {"overline", CSSValueOverline},
 #line 162 "CSSValueKeywords.gperf"
       {"inside", CSSValueInside},
-#line 526 "CSSValueKeywords.gperf"
+#line 499 "CSSValueKeywords.gperf"
+      {"seashell", CSSValueSeashell},
+#line 513 "CSSValueKeywords.gperf"
+      {"wheat", CSSValueWheat},
+#line 150 "CSSValueKeywords.gperf"
+      {"top", CSSValueTop},
+#line 156 "CSSValueKeywords.gperf"
+      {"center", CSSValueCenter},
+#line 474 "CSSValueKeywords.gperf"
+      {"midnightblue", CSSValueMidnightblue},
+#line 532 "CSSValueKeywords.gperf"
       {"central", CSSValueCentral},
-#line 340 "CSSValueKeywords.gperf"
+#line 298 "CSSValueKeywords.gperf"
+      {"up", CSSValueUp},
+#line 521 "CSSValueKeywords.gperf"
+      {"linearrgb", CSSValueLinearrgb},
+#line 537 "CSSValueKeywords.gperf"
+      {"hanging", CSSValueHanging},
+#line 398 "CSSValueKeywords.gperf"
+      {"chartreuse", CSSValueChartreuse},
+#line 80 "CSSValueKeywords.gperf"
+      {"green", CSSValueGreen},
+#line 89 "CSSValueKeywords.gperf"
+      {"teal", CSSValueTeal},
+#line 245 "CSSValueKeywords.gperf"
+      {"avoid", CSSValueAvoid},
+#line 372 "CSSValueKeywords.gperf"
+      {"flat", CSSValueFlat},
+#line 343 "CSSValueKeywords.gperf"
       {"menulist", CSSValueMenulist},
-#line 538 "CSSValueKeywords.gperf"
-      {"tb-rl", CSSValueTbRl},
-#line 258 "CSSValueKeywords.gperf"
-      {"invert", CSSValueInvert},
-#line 374 "CSSValueKeywords.gperf"
+#line 255 "CSSValueKeywords.gperf"
+      {"hand", CSSValueHand},
+#line 380 "CSSValueKeywords.gperf"
       {"reset", CSSValueReset},
-#line 265 "CSSValueKeywords.gperf"
-      {"mix", CSSValueMix},
-#line 243 "CSSValueKeywords.gperf"
-      {"absolute", CSSValueAbsolute},
-#line 232 "CSSValueKeywords.gperf"
-      {"all-scroll", CSSValueAllScroll},
-#line 190 "CSSValueKeywords.gperf"
-      {"inline-table", CSSValueInlineTable},
-#line 83 "CSSValueKeywords.gperf"
-      {"navy", CSSValueNavy},
-#line 11 "CSSValueKeywords.gperf"
-      {"inherit", CSSValueInherit},
-#line 332 "CSSValueKeywords.gperf"
-      {"listitem", CSSValueListitem},
-#line 303 "CSSValueKeywords.gperf"
-      {"slide", CSSValueSlide},
-#line 230 "CSSValueKeywords.gperf"
-      {"wait", CSSValueWait},
-#line 145 "CSSValueKeywords.gperf"
-      {"middle", CSSValueMiddle},
-#line 513 "CSSValueKeywords.gperf"
-      {"new", CSSValueNew},
-#line 275 "CSSValueKeywords.gperf"
-      {"pre-wrap", CSSValuePreWrap},
+#line 175 "CSSValueKeywords.gperf"
+      {"hebrew", CSSValueHebrew},
+#line 219 "CSSValueKeywords.gperf"
+      {"se-resize", CSSValueSeResize},
 #line 37 "CSSValueKeywords.gperf"
       {"bold", CSSValueBold},
-#line 144 "CSSValueKeywords.gperf"
-      {"baseline", CSSValueBaseline},
-#line 72 "CSSValueKeywords.gperf"
-      {"fantasy", CSSValueFantasy},
-#line 141 "CSSValueKeywords.gperf"
-      {"xor", CSSValueXor},
-#line 27 "CSSValueKeywords.gperf"
-      {"small-caption", CSSValueSmallCaption},
-#line 130 "CSSValueKeywords.gperf"
-      {"no-repeat", CSSValueNoRepeat},
-#line 325 "CSSValueKeywords.gperf"
-      {"radio", CSSValueRadio},
+#line 154 "CSSValueKeywords.gperf"
+      {"left", CSSValueLeft},
+#line 528 "CSSValueKeywords.gperf"
+      {"bevel", CSSValueBevel},
+#line 439 "CSSValueKeywords.gperf"
+      {"indianred", CSSValueIndianred},
+#line 432 "CSSValueKeywords.gperf"
+      {"gainsboro", CSSValueGainsboro},
+#line 322 "CSSValueKeywords.gperf"
+      {"space", CSSValueSpace},
+#line 301 "CSSValueKeywords.gperf"
+      {"fast", CSSValueFast},
+#line 33 "CSSValueKeywords.gperf"
+      {"oblique", CSSValueOblique},
+#line 216 "CSSValueKeywords.gperf"
+      {"ne-resize", CSSValueNeResize},
 #line 259 "CSSValueKeywords.gperf"
       {"landscape", CSSValueLandscape},
-#line 369 "CSSValueKeywords.gperf"
-      {"linear", CSSValueLinear},
-#line 57 "CSSValueKeywords.gperf"
-      {"smaller", CSSValueSmaller},
-#line 59 "CSSValueKeywords.gperf"
-      {"wider", CSSValueWider},
+#line 246 "CSSValueKeywords.gperf"
+      {"below", CSSValueBelow},
 #line 120 "CSSValueKeywords.gperf"
       {"window", CSSValueWindow},
-#line 32 "CSSValueKeywords.gperf"
-      {"italic", CSSValueItalic},
-#line 163 "CSSValueKeywords.gperf"
-      {"disc", CSSValueDisc},
-#line 198 "CSSValueKeywords.gperf"
-      {"table-caption", CSSValueTableCaption},
-#line 272 "CSSValueKeywords.gperf"
-      {"portrait", CSSValuePortrait},
-#line 185 "CSSValueKeywords.gperf"
-      {"list-item", CSSValueListItem},
-#line 231 "CSSValueKeywords.gperf"
-      {"help", CSSValueHelp},
-#line 270 "CSSValueKeywords.gperf"
-      {"overlay", CSSValueOverlay},
-#line 280 "CSSValueKeywords.gperf"
-      {"static", CSSValueStatic},
-#line 166 "CSSValueKeywords.gperf"
-      {"decimal", CSSValueDecimal},
-#line 148 "CSSValueKeywords.gperf"
-      {"text-top", CSSValueTextTop},
-#line 511 "CSSValueKeywords.gperf"
-      {"evenodd", CSSValueEvenodd},
-#line 236 "CSSValueKeywords.gperf"
-      {"rtl", CSSValueRtl},
-#line 151 "CSSValueKeywords.gperf"
-      {"bottom", CSSValueBottom},
-#line 537 "CSSValueKeywords.gperf"
-      {"rl-tb", CSSValueRlTb},
-#line 50 "CSSValueKeywords.gperf"
-      {"x-small", CSSValueXSmall},
-#line 63 "CSSValueKeywords.gperf"
-      {"condensed", CSSValueCondensed},
-#line 70 "CSSValueKeywords.gperf"
-      {"sans-serif", CSSValueSansSerif},
-#line 363 "CSSValueKeywords.gperf"
-      {"logical", CSSValueLogical},
-#line 288 "CSSValueKeywords.gperf"
-      {"reverse", CSSValueReverse},
-#line 435 "CSSValueKeywords.gperf"
-      {"ivory", CSSValueIvory},
-#line 469 "CSSValueKeywords.gperf"
-      {"mintcream", CSSValueMintcream},
-#line 295 "CSSValueKeywords.gperf"
-      {"forwards", CSSValueForwards},
-#line 283 "CSSValueKeywords.gperf"
-      {"underline", CSSValueUnderline},
-#line 433 "CSSValueKeywords.gperf"
-      {"indianred", CSSValueIndianred},
-#line 440 "CSSValueKeywords.gperf"
-      {"lemonchiffon", CSSValueLemonchiffon},
-#line 354 "CSSValueKeywords.gperf"
-      {"textfield", CSSValueTextfield},
-#line 204 "CSSValueKeywords.gperf"
-      {"pointer", CSSValuePointer},
-#line 355 "CSSValueKeywords.gperf"
-      {"textarea", CSSValueTextarea},
-#line 194 "CSSValueKeywords.gperf"
-      {"table-row", CSSValueTableRow},
-#line 371 "CSSValueKeywords.gperf"
-      {"ease-out", CSSValueEaseOut},
-#line 254 "CSSValueKeywords.gperf"
-      {"fixed", CSSValueFixed},
-#line 304 "CSSValueKeywords.gperf"
-      {"alternate", CSSValueAlternate},
-#line 514 "CSSValueKeywords.gperf"
-      {"srgb", CSSValueSrgb},
-#line 291 "CSSValueKeywords.gperf"
-      {"inline-axis", CSSValueInlineAxis},
+#line 271 "CSSValueKeywords.gperf"
+      {"overline", CSSValueOverline},
+#line 434 "CSSValueKeywords.gperf"
+      {"gold", CSSValueGold},
 #line 211 "CSSValueKeywords.gperf"
       {"no-drop", CSSValueNoDrop},
-#line 381 "CSSValueKeywords.gperf"
-      {"aliceblue", CSSValueAliceblue},
-#line 196 "CSSValueKeywords.gperf"
-      {"table-column", CSSValueTableColumn},
-#line 150 "CSSValueKeywords.gperf"
-      {"top", CSSValueTop},
-#line 256 "CSSValueKeywords.gperf"
-      {"hide", CSSValueHide},
-#line 310 "CSSValueKeywords.gperf"
-      {"intrinsic", CSSValueIntrinsic},
-#line 493 "CSSValueKeywords.gperf"
-      {"seashell", CSSValueSeashell},
-#line 244 "CSSValueKeywords.gperf"
-      {"always", CSSValueAlways},
-#line 92 "CSSValueKeywords.gperf"
-      {"transparent", CSSValueTransparent},
+#line 524 "CSSValueKeywords.gperf"
+      {"crispedges", CSSValueCrispedges},
+#line 384 "CSSValueKeywords.gperf"
+      {"painted", CSSValuePainted},
+#line 490 "CSSValueKeywords.gperf"
+      {"pink", CSSValuePink},
 #line 391 "CSSValueKeywords.gperf"
-      {"cadetblue", CSSValueCadetblue},
-#line 338 "CSSValueKeywords.gperf"
-      {"media-slider", CSSValueMediaSlider},
-#line 496 "CSSValueKeywords.gperf"
-      {"slateblue", CSSValueSlateblue},
-#line 64 "CSSValueKeywords.gperf"
-      {"semi-condensed", CSSValueSemiCondensed},
-#line 212 "CSSValueKeywords.gperf"
-      {"not-allowed", CSSValueNotAllowed},
+      {"beige", CSSValueBeige},
+#line 141 "CSSValueKeywords.gperf"
+      {"xor", CSSValueXor},
+#line 288 "CSSValueKeywords.gperf"
+      {"reverse", CSSValueReverse},
 #line 146 "CSSValueKeywords.gperf"
       {"sub", CSSValueSub},
-#line 138 "CSSValueKeywords.gperf"
-      {"destination-in", CSSValueDestinationIn},
-#line 501 "CSSValueKeywords.gperf"
-      {"steelblue", CSSValueSteelblue},
-#line 318 "CSSValueKeywords.gperf"
-      {"continuous", CSSValueContinuous},
-#line 49 "CSSValueKeywords.gperf"
-      {"xx-small", CSSValueXxSmall},
+#line 84 "CSSValueKeywords.gperf"
+      {"olive", CSSValueOlive},
+#line 265 "CSSValueKeywords.gperf"
+      {"mix", CSSValueMix},
 #line 114 "CSSValueKeywords.gperf"
       {"scrollbar", CSSValueScrollbar},
-#line 358 "CSSValueKeywords.gperf"
+#line 361 "CSSValueKeywords.gperf"
       {"border", CSSValueBorder},
-#line 378 "CSSValueKeywords.gperf"
-      {"painted", CSSValuePainted},
-#line 242 "CSSValueKeywords.gperf"
-      {"above", CSSValueAbove},
-#line 299 "CSSValueKeywords.gperf"
-      {"down", CSSValueDown},
-#line 215 "CSSValueKeywords.gperf"
-      {"e-resize", CSSValueEResize},
 #line 38 "CSSValueKeywords.gperf"
       {"bolder", CSSValueBolder},
-#line 521 "CSSValueKeywords.gperf"
-      {"miter", CSSValueMiter},
-#line 221 "CSSValueKeywords.gperf"
-      {"s-resize", CSSValueSResize},
-#line 322 "CSSValueKeywords.gperf"
-      {"space", CSSValueSpace},
-#line 437 "CSSValueKeywords.gperf"
-      {"lavender", CSSValueLavender},
-#line 485 "CSSValueKeywords.gperf"
+#line 23 "CSSValueKeywords.gperf"
+      {"caption", CSSValueCaption},
+#line 242 "CSSValueKeywords.gperf"
+      {"above", CSSValueAbove},
+#line 430 "CSSValueKeywords.gperf"
+      {"floralwhite", CSSValueFloralwhite},
+#line 507 "CSSValueKeywords.gperf"
+      {"steelblue", CSSValueSteelblue},
+#line 536 "CSSValueKeywords.gperf"
+      {"alphabetic", CSSValueAlphabetic},
+#line 281 "CSSValueKeywords.gperf"
+      {"thick", CSSValueThick},
+#line 491 "CSSValueKeywords.gperf"
       {"plum", CSSValuePlum},
-#line 263 "CSSValueKeywords.gperf"
-      {"lower", CSSValueLower},
-#line 460 "CSSValueKeywords.gperf"
-      {"mediumblue", CSSValueMediumblue},
-#line 458 "CSSValueKeywords.gperf"
-      {"magenta", CSSValueMagenta},
-#line 140 "CSSValueKeywords.gperf"
-      {"destination-atop", CSSValueDestinationAtop},
-#line 218 "CSSValueKeywords.gperf"
-      {"n-resize", CSSValueNResize},
-#line 222 "CSSValueKeywords.gperf"
-      {"w-resize", CSSValueWResize},
-#line 149 "CSSValueKeywords.gperf"
-      {"text-bottom", CSSValueTextBottom},
+#line 402 "CSSValueKeywords.gperf"
+      {"cornsilk", CSSValueCornsilk},
 #line 86 "CSSValueKeywords.gperf"
       {"purple", CSSValuePurple},
-#line 286 "CSSValueKeywords.gperf"
-      {"start", CSSValueStart},
+#line 386 "CSSValueKeywords.gperf"
+      {"stroke", CSSValueStroke},
+#line 50 "CSSValueKeywords.gperf"
+      {"x-small", CSSValueXSmall},
+#line 69 "CSSValueKeywords.gperf"
+      {"serif", CSSValueSerif},
+#line 392 "CSSValueKeywords.gperf"
+      {"bisque", CSSValueBisque},
+#line 466 "CSSValueKeywords.gperf"
+      {"mediumblue", CSSValueMediumblue},
+#line 431 "CSSValueKeywords.gperf"
+      {"forestgreen", CSSValueForestgreen},
+#line 535 "CSSValueKeywords.gperf"
+      {"ideographic", CSSValueIdeographic},
+#line 512 "CSSValueKeywords.gperf"
+      {"violet", CSSValueViolet},
+#line 201 "CSSValueKeywords.gperf"
+      {"auto", CSSValueAuto},
+#line 390 "CSSValueKeywords.gperf"
+      {"azure", CSSValueAzure},
+#line 443 "CSSValueKeywords.gperf"
+      {"lavender", CSSValueLavender},
+#line 75 "CSSValueKeywords.gperf"
+      {"aqua", CSSValueAqua},
+#line 263 "CSSValueKeywords.gperf"
+      {"lower", CSSValueLower},
+#line 237 "CSSValueKeywords.gperf"
+      {"capitalize", CSSValueCapitalize},
+#line 468 "CSSValueKeywords.gperf"
+      {"mediumpurple", CSSValueMediumpurple},
+#line 88 "CSSValueKeywords.gperf"
+      {"silver", CSSValueSilver},
+#line 454 "CSSValueKeywords.gperf"
+      {"lightpink", CSSValueLightpink},
+#line 297 "CSSValueKeywords.gperf"
+      {"ahead", CSSValueAhead},
+#line 363 "CSSValueKeywords.gperf"
+      {"padding", CSSValuePadding},
+#line 449 "CSSValueKeywords.gperf"
+      {"lightcyan", CSSValueLightcyan},
+#line 248 "CSSValueKeywords.gperf"
+      {"blink", CSSValueBlink},
 #line 239 "CSSValueKeywords.gperf"
       {"lowercase", CSSValueLowercase},
-#line 372 "CSSValueKeywords.gperf"
-      {"ease-in-out", CSSValueEaseInOut},
-#line 60 "CSSValueKeywords.gperf"
-      {"narrower", CSSValueNarrower},
-#line 311 "CSSValueKeywords.gperf"
-      {"min-intrinsic", CSSValueMinIntrinsic},
-#line 175 "CSSValueKeywords.gperf"
-      {"hebrew", CSSValueHebrew},
-#line 309 "CSSValueKeywords.gperf"
-      {"ignore", CSSValueIgnore},
-#line 121 "CSSValueKeywords.gperf"
-      {"windowframe", CSSValueWindowframe},
-#line 290 "CSSValueKeywords.gperf"
-      {"vertical", CSSValueVertical},
-#line 268 "CSSValueKeywords.gperf"
-      {"nowrap", CSSValueNowrap},
-#line 298 "CSSValueKeywords.gperf"
-      {"up", CSSValueUp},
-#line 285 "CSSValueKeywords.gperf"
-      {"stretch", CSSValueStretch},
-#line 132 "CSSValueKeywords.gperf"
-      {"copy", CSSValueCopy},
-#line 533 "CSSValueKeywords.gperf"
-      {"use-script", CSSValueUseScript},
-#line 395 "CSSValueKeywords.gperf"
-      {"cornflowerblue", CSSValueCornflowerblue},
-#line 396 "CSSValueKeywords.gperf"
-      {"cornsilk", CSSValueCornsilk},
-#line 464 "CSSValueKeywords.gperf"
-      {"mediumslateblue", CSSValueMediumslateblue},
-#line 19 "CSSValueKeywords.gperf"
-      {"dotted", CSSValueDotted},
-#line 470 "CSSValueKeywords.gperf"
-      {"mistyrose", CSSValueMistyrose},
-#line 202 "CSSValueKeywords.gperf"
-      {"crosshair", CSSValueCrosshair},
-#line 113 "CSSValueKeywords.gperf"
-      {"menutext", CSSValueMenutext},
+#line 498 "CSSValueKeywords.gperf"
+      {"seagreen", CSSValueSeagreen},
 #line 294 "CSSValueKeywords.gperf"
       {"multiple", CSSValueMultiple},
 #line 77 "CSSValueKeywords.gperf"
       {"blue", CSSValueBlue},
-#line 23 "CSSValueKeywords.gperf"
-      {"caption", CSSValueCaption},
-#line 398 "CSSValueKeywords.gperf"
-      {"cyan", CSSValueCyan},
-#line 80 "CSSValueKeywords.gperf"
-      {"green", CSSValueGreen},
-#line 33 "CSSValueKeywords.gperf"
-      {"oblique", CSSValueOblique},
-#line 373 "CSSValueKeywords.gperf"
-      {"document", CSSValueDocument},
-#line 255 "CSSValueKeywords.gperf"
-      {"hand", CSSValueHand},
-#line 84 "CSSValueKeywords.gperf"
-      {"olive", CSSValueOlive},
-#line 362 "CSSValueKeywords.gperf"
-      {"content-box", CSSValueContentBox},
-#line 127 "CSSValueKeywords.gperf"
-      {"repeat", CSSValueRepeat},
-#line 278 "CSSValueKeywords.gperf"
-      {"separate", CSSValueSeparate},
-#line 434 "CSSValueKeywords.gperf"
-      {"indigo", CSSValueIndigo},
-#line 154 "CSSValueKeywords.gperf"
-      {"left", CSSValueLeft},
-#line 489 "CSSValueKeywords.gperf"
-      {"saddlebrown", CSSValueSaddlebrown},
-#line 112 "CSSValueKeywords.gperf"
-      {"match", CSSValueMatch},
-#line 14 "CSSValueKeywords.gperf"
-      {"hidden", CSSValueHidden},
-#line 462 "CSSValueKeywords.gperf"
-      {"mediumpurple", CSSValueMediumpurple},
-#line 249 "CSSValueKeywords.gperf"
-      {"both", CSSValueBoth},
-#line 331 "CSSValueKeywords.gperf"
-      {"listbox", CSSValueListbox},
-#line 424 "CSSValueKeywords.gperf"
-      {"floralwhite", CSSValueFloralwhite},
-#line 201 "CSSValueKeywords.gperf"
-      {"auto", CSSValueAuto},
 #line 184 "CSSValueKeywords.gperf"
       {"block", CSSValueBlock},
-#line 484 "CSSValueKeywords.gperf"
-      {"pink", CSSValuePink},
-#line 384 "CSSValueKeywords.gperf"
-      {"azure", CSSValueAzure},
-#line 75 "CSSValueKeywords.gperf"
-      {"aqua", CSSValueAqua},
-#line 172 "CSSValueKeywords.gperf"
-      {"lower-latin", CSSValueLowerLatin},
-#line 262 "CSSValueKeywords.gperf"
-      {"loud", CSSValueLoud},
-#line 139 "CSSValueKeywords.gperf"
-      {"destination-out", CSSValueDestinationOut},
-#line 506 "CSSValueKeywords.gperf"
-      {"violet", CSSValueViolet},
-#line 380 "CSSValueKeywords.gperf"
-      {"stroke", CSSValueStroke},
-#line 320 "CSSValueKeywords.gperf"
-      {"break-all", CSSValueBreakAll},
-#line 482 "CSSValueKeywords.gperf"
-      {"peachpuff", CSSValuePeachpuff},
-#line 476 "CSSValueKeywords.gperf"
-      {"orchid", CSSValueOrchid},
-#line 208 "CSSValueKeywords.gperf"
-      {"context-menu", CSSValueContextMenu},
-#line 431 "CSSValueKeywords.gperf"
-      {"honeydew", CSSValueHoneydew},
-#line 219 "CSSValueKeywords.gperf"
-      {"se-resize", CSSValueSeResize},
+#line 469 "CSSValueKeywords.gperf"
+      {"mediumseagreen", CSSValueMediumseagreen},
+#line 470 "CSSValueKeywords.gperf"
+      {"mediumslateblue", CSSValueMediumslateblue},
+#line 514 "CSSValueKeywords.gperf"
+      {"whitesmoke", CSSValueWhitesmoke},
 #line 18 "CSSValueKeywords.gperf"
       {"outset", CSSValueOutset},
-#line 281 "CSSValueKeywords.gperf"
-      {"thick", CSSValueThick},
-#line 305 "CSSValueKeywords.gperf"
-      {"read-only", CSSValueReadOnly},
-#line 510 "CSSValueKeywords.gperf"
-      {"nonzero", CSSValueNonzero},
-#line 472 "CSSValueKeywords.gperf"
-      {"navajowhite", CSSValueNavajowhite},
-#line 53 "CSSValueKeywords.gperf"
-      {"large", CSSValueLarge},
-#line 314 "CSSValueKeywords.gperf"
-      {"discard", CSSValueDiscard},
-#line 216 "CSSValueKeywords.gperf"
-      {"ne-resize", CSSValueNeResize},
-#line 342 "CSSValueKeywords.gperf"
-      {"menulist-text", CSSValueMenulistText},
-#line 302 "CSSValueKeywords.gperf"
-      {"infinite", CSSValueInfinite},
-#line 250 "CSSValueKeywords.gperf"
-      {"close-quote", CSSValueCloseQuote},
-#line 319 "CSSValueKeywords.gperf"
-      {"skip-white-space", CSSValueSkipWhiteSpace},
-#line 85 "CSSValueKeywords.gperf"
-      {"orange", CSSValueOrange},
-#line 293 "CSSValueKeywords.gperf"
-      {"single", CSSValueSingle},
-#line 508 "CSSValueKeywords.gperf"
-      {"whitesmoke", CSSValueWhitesmoke},
-#line 532 "CSSValueKeywords.gperf"
-      {"mathematical", CSSValueMathematical},
-#line 341 "CSSValueKeywords.gperf"
-      {"menulist-button", CSSValueMenulistButton},
-#line 335 "CSSValueKeywords.gperf"
-      {"media-play-button", CSSValueMediaPlayButton},
-#line 122 "CSSValueKeywords.gperf"
-      {"windowtext", CSSValueWindowtext},
-#line 125 "CSSValueKeywords.gperf"
-      {"grey", CSSValueGrey},
-#line 276 "CSSValueKeywords.gperf"
-      {"relative", CSSValueRelative},
+#line 368 "CSSValueKeywords.gperf"
+      {"visual", CSSValueVisual},
+#line 268 "CSSValueKeywords.gperf"
+      {"nowrap", CSSValueNowrap},
+#line 232 "CSSValueKeywords.gperf"
+      {"all-scroll", CSSValueAllScroll},
+#line 438 "CSSValueKeywords.gperf"
+      {"hotpink", CSSValueHotpink},
+#line 116 "CSSValueKeywords.gperf"
+      {"threedface", CSSValueThreedface},
+#line 481 "CSSValueKeywords.gperf"
+      {"orangered", CSSValueOrangered},
+#line 482 "CSSValueKeywords.gperf"
+      {"orchid", CSSValueOrchid},
+#line 223 "CSSValueKeywords.gperf"
+      {"ew-resize", CSSValueEwResize},
+#line 220 "CSSValueKeywords.gperf"
+      {"sw-resize", CSSValueSwResize},
+#line 388 "CSSValueKeywords.gperf"
+      {"antiquewhite", CSSValueAntiquewhite},
+#line 461 "CSSValueKeywords.gperf"
+      {"lightyellow", CSSValueLightyellow},
+#line 16 "CSSValueKeywords.gperf"
+      {"groove", CSSValueGroove},
+#line 185 "CSSValueKeywords.gperf"
+      {"list-item", CSSValueListItem},
+#line 401 "CSSValueKeywords.gperf"
+      {"cornflowerblue", CSSValueCornflowerblue},
+#line 217 "CSSValueKeywords.gperf"
+      {"nw-resize", CSSValueNwResize},
+#line 63 "CSSValueKeywords.gperf"
+      {"condensed", CSSValueCondensed},
+#line 240 "CSSValueKeywords.gperf"
+      {"visible", CSSValueVisible},
+#line 165 "CSSValueKeywords.gperf"
+      {"square", CSSValueSquare},
+#line 177 "CSSValueKeywords.gperf"
+      {"georgian", CSSValueGeorgian},
+#line 35 "CSSValueKeywords.gperf"
+      {"small-caps", CSSValueSmallCaps},
+#line 331 "CSSValueKeywords.gperf"
+      {"listbox", CSSValueListbox},
+#line 197 "CSSValueKeywords.gperf"
+      {"table-cell", CSSValueTableCell},
+#line 376 "CSSValueKeywords.gperf"
+      {"ease-in", CSSValueEaseIn},
+#line 476 "CSSValueKeywords.gperf"
+      {"mistyrose", CSSValueMistyrose},
+#line 83 "CSSValueKeywords.gperf"
+      {"navy", CSSValueNavy},
 #line 76 "CSSValueKeywords.gperf"
       {"black", CSSValueBlack},
-#line 392 "CSSValueKeywords.gperf"
-      {"chartreuse", CSSValueChartreuse},
-#line 418 "CSSValueKeywords.gperf"
-      {"deeppink", CSSValueDeeppink},
-#line 186 "CSSValueKeywords.gperf"
-      {"run-in", CSSValueRunIn},
-#line 266 "CSSValueKeywords.gperf"
-      {"no-close-quote", CSSValueNoCloseQuote},
-#line 512 "CSSValueKeywords.gperf"
-      {"accumulate", CSSValueAccumulate},
-#line 224 "CSSValueKeywords.gperf"
-      {"ns-resize", CSSValueNsResize},
-#line 487 "CSSValueKeywords.gperf"
-      {"rosybrown", CSSValueRosybrown},
-#line 188 "CSSValueKeywords.gperf"
-      {"inline-block", CSSValueInlineBlock},
-#line 119 "CSSValueKeywords.gperf"
-      {"threedshadow", CSSValueThreedshadow},
 #line 495 "CSSValueKeywords.gperf"
-      {"skyblue", CSSValueSkyblue},
-#line 65 "CSSValueKeywords.gperf"
-      {"semi-expanded", CSSValueSemiExpanded},
+      {"saddlebrown", CSSValueSaddlebrown},
+#line 441 "CSSValueKeywords.gperf"
+      {"ivory", CSSValueIvory},
 #line 227 "CSSValueKeywords.gperf"
       {"col-resize", CSSValueColResize},
-#line 248 "CSSValueKeywords.gperf"
-      {"blink", CSSValueBlink},
-#line 367 "CSSValueKeywords.gperf"
-      {"paused", CSSValuePaused},
-#line 267 "CSSValueKeywords.gperf"
-      {"no-open-quote", CSSValueNoOpenQuote},
-#line 22 "CSSValueKeywords.gperf"
-      {"double", CSSValueDouble},
-#line 134 "CSSValueKeywords.gperf"
-      {"source-in", CSSValueSourceIn},
-#line 334 "CSSValueKeywords.gperf"
-      {"media-mute-button", CSSValueMediaMuteButton},
-#line 491 "CSSValueKeywords.gperf"
-      {"sandybrown", CSSValueSandybrown},
-#line 428 "CSSValueKeywords.gperf"
-      {"gold", CSSValueGold},
-#line 240 "CSSValueKeywords.gperf"
-      {"visible", CSSValueVisible},
-#line 430 "CSSValueKeywords.gperf"
-      {"greenyellow", CSSValueGreenyellow},
-#line 168 "CSSValueKeywords.gperf"
-      {"lower-roman", CSSValueLowerRoman},
-#line 306 "CSSValueKeywords.gperf"
-      {"read-write", CSSValueReadWrite},
-#line 88 "CSSValueKeywords.gperf"
-      {"silver", CSSValueSilver},
-#line 225 "CSSValueKeywords.gperf"
-      {"nesw-resize", CSSValueNeswResize},
-#line 520 "CSSValueKeywords.gperf"
+#line 389 "CSSValueKeywords.gperf"
+      {"aquamarine", CSSValueAquamarine},
+#line 54 "CSSValueKeywords.gperf"
+      {"x-large", CSSValueXLarge},
+#line 526 "CSSValueKeywords.gperf"
       {"butt", CSSValueButt},
-#line 108 "CSSValueKeywords.gperf"
-      {"inactivecaption", CSSValueInactivecaption},
-#line 535 "CSSValueKeywords.gperf"
-      {"reset-size", CSSValueResetSize},
-#line 376 "CSSValueKeywords.gperf"
-      {"visiblefill", CSSValueVisiblefill},
-#line 20 "CSSValueKeywords.gperf"
-      {"dashed", CSSValueDashed},
-#line 129 "CSSValueKeywords.gperf"
-      {"repeat-y", CSSValueRepeatY},
-#line 411 "CSSValueKeywords.gperf"
-      {"darksalmon", CSSValueDarksalmon},
-#line 136 "CSSValueKeywords.gperf"
-      {"source-atop", CSSValueSourceAtop},
+#line 111 "CSSValueKeywords.gperf"
+      {"infotext", CSSValueInfotext},
+#line 190 "CSSValueKeywords.gperf"
+      {"inline-table", CSSValueInlineTable},
+#line 428 "CSSValueKeywords.gperf"
+      {"dodgerblue", CSSValueDodgerblue},
+#line 127 "CSSValueKeywords.gperf"
+      {"repeat", CSSValueRepeat},
+#line 506 "CSSValueKeywords.gperf"
+      {"springgreen", CSSValueSpringgreen},
+#line 278 "CSSValueKeywords.gperf"
+      {"separate", CSSValueSeparate},
 #line 328 "CSSValueKeywords.gperf"
       {"button", CSSValueButton},
-#line 364 "CSSValueKeywords.gperf"
-      {"visual", CSSValueVisual},
-#line 385 "CSSValueKeywords.gperf"
-      {"beige", CSSValueBeige},
-#line 210 "CSSValueKeywords.gperf"
-      {"progress", CSSValueProgress},
-#line 349 "CSSValueKeywords.gperf"
-      {"searchfield", CSSValueSearchfield},
-#line 161 "CSSValueKeywords.gperf"
-      {"outside", CSSValueOutside},
-#line 99 "CSSValueKeywords.gperf"
-      {"buttonface", CSSValueButtonface},
-#line 165 "CSSValueKeywords.gperf"
-      {"square", CSSValueSquare},
+#line 311 "CSSValueKeywords.gperf"
+      {"min-intrinsic", CSSValueMinIntrinsic},
 #line 79 "CSSValueKeywords.gperf"
       {"gray", CSSValueGray},
-#line 386 "CSSValueKeywords.gperf"
-      {"bisque", CSSValueBisque},
-#line 157 "CSSValueKeywords.gperf"
-      {"justify", CSSValueJustify},
-#line 357 "CSSValueKeywords.gperf"
+#line 117 "CSSValueKeywords.gperf"
+      {"threedhighlight", CSSValueThreedhighlight},
+#line 314 "CSSValueKeywords.gperf"
+      {"discard", CSSValueDiscard},
+#line 27 "CSSValueKeywords.gperf"
+      {"small-caption", CSSValueSmallCaption},
+#line 19 "CSSValueKeywords.gperf"
+      {"dotted", CSSValueDotted},
+#line 124 "CSSValueKeywords.gperf"
+      {"currentcolor", CSSValueCurrentcolor},
+#line 525 "CSSValueKeywords.gperf"
+      {"geometricprecision", CSSValueGeometricprecision},
+#line 295 "CSSValueKeywords.gperf"
+      {"forwards", CSSValueForwards},
+#line 519 "CSSValueKeywords.gperf"
+      {"new", CSSValueNew},
+#line 370 "CSSValueKeywords.gperf"
+      {"running", CSSValueRunning},
+#line 119 "CSSValueKeywords.gperf"
+      {"threedshadow", CSSValueThreedshadow},
+#line 20 "CSSValueKeywords.gperf"
+      {"dashed", CSSValueDashed},
+#line 377 "CSSValueKeywords.gperf"
+      {"ease-out", CSSValueEaseOut},
+#line 198 "CSSValueKeywords.gperf"
+      {"table-caption", CSSValueTableCaption},
+#line 485 "CSSValueKeywords.gperf"
+      {"paleturquoise", CSSValuePaleturquoise},
+#line 379 "CSSValueKeywords.gperf"
+      {"document", CSSValueDocument},
+#line 196 "CSSValueKeywords.gperf"
+      {"table-column", CSSValueTableColumn},
+#line 444 "CSSValueKeywords.gperf"
+      {"lavenderblush", CSSValueLavenderblush},
+#line 453 "CSSValueKeywords.gperf"
+      {"lightgrey", CSSValueLightgrey},
+#line 451 "CSSValueKeywords.gperf"
+      {"lightgray", CSSValueLightgray},
+#line 181 "CSSValueKeywords.gperf"
+      {"hiragana-iroha", CSSValueHiraganaIroha},
+#line 106 "CSSValueKeywords.gperf"
+      {"highlighttext", CSSValueHighlighttext},
+#line 108 "CSSValueKeywords.gperf"
+      {"inactivecaption", CSSValueInactivecaption},
+#line 467 "CSSValueKeywords.gperf"
+      {"mediumorchid", CSSValueMediumorchid},
+#line 194 "CSSValueKeywords.gperf"
+      {"table-row", CSSValueTableRow},
+#line 121 "CSSValueKeywords.gperf"
+      {"windowframe", CSSValueWindowframe},
+#line 299 "CSSValueKeywords.gperf"
+      {"down", CSSValueDown},
+#line 518 "CSSValueKeywords.gperf"
+      {"accumulate", CSSValueAccumulate},
+#line 203 "CSSValueKeywords.gperf"
+      {"default", CSSValueDefault},
+#line 445 "CSSValueKeywords.gperf"
+      {"lawngreen", CSSValueLawngreen},
+#line 262 "CSSValueKeywords.gperf"
+      {"loud", CSSValueLoud},
+#line 274 "CSSValueKeywords.gperf"
+      {"pre-line", CSSValuePreLine},
+#line 459 "CSSValueKeywords.gperf"
+      {"lightslategrey", CSSValueLightslategrey},
+#line 458 "CSSValueKeywords.gperf"
+      {"lightslategray", CSSValueLightslategray},
+#line 290 "CSSValueKeywords.gperf"
+      {"vertical", CSSValueVertical},
+#line 238 "CSSValueKeywords.gperf"
+      {"uppercase", CSSValueUppercase},
+#line 522 "CSSValueKeywords.gperf"
+      {"optimizespeed", CSSValueOptimizespeed},
+#line 229 "CSSValueKeywords.gperf"
+      {"text", CSSValueText},
+#line 91 "CSSValueKeywords.gperf"
+      {"yellow", CSSValueYellow},
+#line 261 "CSSValueKeywords.gperf"
+      {"line-through", CSSValueLineThrough},
+#line 132 "CSSValueKeywords.gperf"
+      {"copy", CSSValueCopy},
+#line 504 "CSSValueKeywords.gperf"
+      {"slategrey", CSSValueSlategrey},
+#line 503 "CSSValueKeywords.gperf"
+      {"slategray", CSSValueSlategray},
+#line 435 "CSSValueKeywords.gperf"
+      {"goldenrod", CSSValueGoldenrod},
+#line 471 "CSSValueKeywords.gperf"
+      {"mediumspringgreen", CSSValueMediumspringgreen},
+#line 446 "CSSValueKeywords.gperf"
+      {"lemonchiffon", CSSValueLemonchiffon},
+#line 393 "CSSValueKeywords.gperf"
+      {"blanchedalmond", CSSValueBlanchedalmond},
+#line 125 "CSSValueKeywords.gperf"
+      {"grey", CSSValueGrey},
+#line 161 "CSSValueKeywords.gperf"
+      {"outside", CSSValueOutside},
+#line 166 "CSSValueKeywords.gperf"
+      {"decimal", CSSValueDecimal},
+#line 113 "CSSValueKeywords.gperf"
+      {"menutext", CSSValueMenutext},
+#line 437 "CSSValueKeywords.gperf"
+      {"honeydew", CSSValueHoneydew},
+#line 276 "CSSValueKeywords.gperf"
+      {"relative", CSSValueRelative},
+#line 147 "CSSValueKeywords.gperf"
+      {"super", CSSValueSuper},
+#line 417 "CSSValueKeywords.gperf"
+      {"darksalmon", CSSValueDarksalmon},
+#line 360 "CSSValueKeywords.gperf"
       {"round", CSSValueRound},
-#line 425 "CSSValueKeywords.gperf"
-      {"forestgreen", CSSValueForestgreen},
+#line 72 "CSSValueKeywords.gperf"
+      {"fantasy", CSSValueFantasy},
+#line 465 "CSSValueKeywords.gperf"
+      {"mediumaquamarine", CSSValueMediumaquamarine},
+#line 493 "CSSValueKeywords.gperf"
+      {"rosybrown", CSSValueRosybrown},
+#line 371 "CSSValueKeywords.gperf"
+      {"paused", CSSValuePaused},
+#line 22 "CSSValueKeywords.gperf"
+      {"double", CSSValueDouble},
+#line 270 "CSSValueKeywords.gperf"
+      {"overlay", CSSValueOverlay},
+#line 358 "CSSValueKeywords.gperf"
+      {"textarea", CSSValueTextarea},
+#line 429 "CSSValueKeywords.gperf"
+      {"firebrick", CSSValueFirebrick},
+#line 382 "CSSValueKeywords.gperf"
+      {"visiblefill", CSSValueVisiblefill},
+#line 517 "CSSValueKeywords.gperf"
+      {"evenodd", CSSValueEvenodd},
+#line 118 "CSSValueKeywords.gperf"
+      {"threedlightshadow", CSSValueThreedlightshadow},
+#line 275 "CSSValueKeywords.gperf"
+      {"pre-wrap", CSSValuePreWrap},
+#line 511 "CSSValueKeywords.gperf"
+      {"turquoise", CSSValueTurquoise},
+#line 70 "CSSValueKeywords.gperf"
+      {"sans-serif", CSSValueSansSerif},
 #line 31 "CSSValueKeywords.gperf"
       {"status-bar", CSSValueStatusBar},
-#line 66 "CSSValueKeywords.gperf"
-      {"expanded", CSSValueExpanded},
-#line 449 "CSSValueKeywords.gperf"
-      {"lightsalmon", CSSValueLightsalmon},
-#line 58 "CSSValueKeywords.gperf"
-      {"larger", CSSValueLarger},
-#line 383 "CSSValueKeywords.gperf"
-      {"aquamarine", CSSValueAquamarine},
-#line 17 "CSSValueKeywords.gperf"
-      {"ridge", CSSValueRidge},
-#line 343 "CSSValueKeywords.gperf"
-      {"menulist-textfield", CSSValueMenulistTextfield},
-#line 492 "CSSValueKeywords.gperf"
-      {"seagreen", CSSValueSeagreen},
-#line 289 "CSSValueKeywords.gperf"
-      {"horizontal", CSSValueHorizontal},
-#line 315 "CSSValueKeywords.gperf"
-      {"dot-dash", CSSValueDotDash},
-#line 530 "CSSValueKeywords.gperf"
-      {"alphabetic", CSSValueAlphabetic},
-#line 518 "CSSValueKeywords.gperf"
-      {"crispedges", CSSValueCrispedges},
-#line 360 "CSSValueKeywords.gperf"
-      {"padding", CSSValuePadding},
-#line 171 "CSSValueKeywords.gperf"
-      {"lower-alpha", CSSValueLowerAlpha},
-#line 390 "CSSValueKeywords.gperf"
-      {"burlywood", CSSValueBurlywood},
-#line 461 "CSSValueKeywords.gperf"
-      {"mediumorchid", CSSValueMediumorchid},
-#line 478 "CSSValueKeywords.gperf"
-      {"palegreen", CSSValuePalegreen},
-#line 456 "CSSValueKeywords.gperf"
-      {"limegreen", CSSValueLimegreen},
-#line 124 "CSSValueKeywords.gperf"
-      {"currentcolor", CSSValueCurrentcolor},
-#line 324 "CSSValueKeywords.gperf"
-      {"checkbox", CSSValueCheckbox},
-#line 62 "CSSValueKeywords.gperf"
-      {"extra-condensed", CSSValueExtraCondensed},
-#line 400 "CSSValueKeywords.gperf"
-      {"darkcyan", CSSValueDarkcyan},
-#line 333 "CSSValueKeywords.gperf"
-      {"media-fullscreen-button", CSSValueMediaFullscreenButton},
+#line 483 "CSSValueKeywords.gperf"
+      {"palegoldenrod", CSSValuePalegoldenrod},
+#line 244 "CSSValueKeywords.gperf"
+      {"always", CSSValueAlways},
+#line 436 "CSSValueKeywords.gperf"
+      {"greenyellow", CSSValueGreenyellow},
+#line 250 "CSSValueKeywords.gperf"
+      {"close-quote", CSSValueCloseQuote},
+#line 480 "CSSValueKeywords.gperf"
+      {"olivedrab", CSSValueOlivedrab},
+#line 541 "CSSValueKeywords.gperf"
+      {"reset-size", CSSValueResetSize},
+#line 212 "CSSValueKeywords.gperf"
+      {"not-allowed", CSSValueNotAllowed},
 #line 96 "CSSValueKeywords.gperf"
       {"activecaption", CSSValueActivecaption},
-#line 423 "CSSValueKeywords.gperf"
-      {"firebrick", CSSValueFirebrick},
+#line 99 "CSSValueKeywords.gperf"
+      {"buttonface", CSSValueButtonface},
+#line 122 "CSSValueKeywords.gperf"
+      {"windowtext", CSSValueWindowtext},
+#line 472 "CSSValueKeywords.gperf"
+      {"mediumturquoise", CSSValueMediumturquoise},
+#line 49 "CSSValueKeywords.gperf"
+      {"xx-small", CSSValueXxSmall},
 #line 71 "CSSValueKeywords.gperf"
       {"cursive", CSSValueCursive},
-#line 361 "CSSValueKeywords.gperf"
-      {"border-box", CSSValueBorderBox},
-#line 128 "CSSValueKeywords.gperf"
-      {"repeat-x", CSSValueRepeatX},
-#line 387 "CSSValueKeywords.gperf"
-      {"blanchedalmond", CSSValueBlanchedalmond},
-#line 135 "CSSValueKeywords.gperf"
-      {"source-out", CSSValueSourceOut},
-#line 509 "CSSValueKeywords.gperf"
-      {"yellowgreen", CSSValueYellowgreen},
+#line 266 "CSSValueKeywords.gperf"
+      {"no-close-quote", CSSValueNoCloseQuote},
+#line 427 "CSSValueKeywords.gperf"
+      {"dimgrey", CSSValueDimgrey},
+#line 426 "CSSValueKeywords.gperf"
+      {"dimgray", CSSValueDimgray},
 #line 488 "CSSValueKeywords.gperf"
-      {"royalblue", CSSValueRoyalblue},
-#line 203 "CSSValueKeywords.gperf"
-      {"default", CSSValueDefault},
-#line 78 "CSSValueKeywords.gperf"
-      {"fuchsia", CSSValueFuchsia},
+      {"peachpuff", CSSValuePeachpuff},
+#line 225 "CSSValueKeywords.gperf"
+      {"nesw-resize", CSSValueNeswResize},
+#line 267 "CSSValueKeywords.gperf"
+      {"no-open-quote", CSSValueNoOpenQuote},
+#line 539 "CSSValueKeywords.gperf"
+      {"use-script", CSSValueUseScript},
+#line 405 "CSSValueKeywords.gperf"
+      {"darkblue", CSSValueDarkblue},
+#line 291 "CSSValueKeywords.gperf"
+      {"inline-axis", CSSValueInlineAxis},
+#line 352 "CSSValueKeywords.gperf"
+      {"searchfield", CSSValueSearchfield},
+#line 381 "CSSValueKeywords.gperf"
+      {"visiblepainted", CSSValueVisiblepainted},
+#line 254 "CSSValueKeywords.gperf"
+      {"fixed", CSSValueFixed},
+#line 442 "CSSValueKeywords.gperf"
+      {"khaki", CSSValueKhaki},
+#line 412 "CSSValueKeywords.gperf"
+      {"darkmagenta", CSSValueDarkmagenta},
 #line 103 "CSSValueKeywords.gperf"
       {"captiontext", CSSValueCaptiontext},
-#line 223 "CSSValueKeywords.gperf"
-      {"ew-resize", CSSValueEwResize},
-#line 220 "CSSValueKeywords.gperf"
-      {"sw-resize", CSSValueSwResize},
-#line 61 "CSSValueKeywords.gperf"
-      {"ultra-condensed", CSSValueUltraCondensed},
-#line 206 "CSSValueKeywords.gperf"
-      {"vertical-text", CSSValueVerticalText},
+#line 515 "CSSValueKeywords.gperf"
+      {"yellowgreen", CSSValueYellowgreen},
 #line 486 "CSSValueKeywords.gperf"
-      {"powderblue", CSSValuePowderblue},
-#line 111 "CSSValueKeywords.gperf"
-      {"infotext", CSSValueInfotext},
-#line 534 "CSSValueKeywords.gperf"
-      {"no-change", CSSValueNoChange},
-#line 217 "CSSValueKeywords.gperf"
-      {"nw-resize", CSSValueNwResize},
-#line 463 "CSSValueKeywords.gperf"
-      {"mediumseagreen", CSSValueMediumseagreen},
-#line 443 "CSSValueKeywords.gperf"
-      {"lightcyan", CSSValueLightcyan},
-#line 155 "CSSValueKeywords.gperf"
-      {"right", CSSValueRight},
-#line 455 "CSSValueKeywords.gperf"
-      {"lightyellow", CSSValueLightyellow},
-#line 39 "CSSValueKeywords.gperf"
-      {"lighter", CSSValueLighter},
-#line 459 "CSSValueKeywords.gperf"
-      {"mediumaquamarine", CSSValueMediumaquamarine},
-#line 292 "CSSValueKeywords.gperf"
-      {"block-axis", CSSValueBlockAxis},
-#line 147 "CSSValueKeywords.gperf"
-      {"super", CSSValueSuper},
-#line 321 "CSSValueKeywords.gperf"
-      {"break-word", CSSValueBreakWord},
-#line 442 "CSSValueKeywords.gperf"
-      {"lightcoral", CSSValueLightcoral},
-#line 480 "CSSValueKeywords.gperf"
       {"palevioletred", CSSValuePalevioletred},
-#line 237 "CSSValueKeywords.gperf"
-      {"capitalize", CSSValueCapitalize},
-#line 375 "CSSValueKeywords.gperf"
-      {"visiblepainted", CSSValueVisiblepainted},
-#line 179 "CSSValueKeywords.gperf"
-      {"hiragana", CSSValueHiragana},
-#line 269 "CSSValueKeywords.gperf"
-      {"open-quote", CSSValueOpenQuote},
-#line 481 "CSSValueKeywords.gperf"
+#line 487 "CSSValueKeywords.gperf"
       {"papayawhip", CSSValuePapayawhip},
-#line 399 "CSSValueKeywords.gperf"
-      {"darkblue", CSSValueDarkblue},
-#line 475 "CSSValueKeywords.gperf"
-      {"orangered", CSSValueOrangered},
+#line 492 "CSSValueKeywords.gperf"
+      {"powderblue", CSSValuePowderblue},
+#line 78 "CSSValueKeywords.gperf"
+      {"fuchsia", CSSValueFuchsia},
+#line 409 "CSSValueKeywords.gperf"
+      {"darkgreen", CSSValueDarkgreen},
+#line 100 "CSSValueKeywords.gperf"
+      {"buttonhighlight", CSSValueButtonhighlight},
+#line 418 "CSSValueKeywords.gperf"
+      {"darkseagreen", CSSValueDarkseagreen},
+#line 419 "CSSValueKeywords.gperf"
+      {"darkslateblue", CSSValueDarkslateblue},
+#line 414 "CSSValueKeywords.gperf"
+      {"darkorange", CSSValueDarkorange},
+#line 186 "CSSValueKeywords.gperf"
+      {"run-in", CSSValueRunIn},
+#line 171 "CSSValueKeywords.gperf"
+      {"lower-alpha", CSSValueLowerAlpha},
+#line 101 "CSSValueKeywords.gperf"
+      {"buttonshadow", CSSValueButtonshadow},
+#line 180 "CSSValueKeywords.gperf"
+      {"katakana", CSSValueKatakana},
+#line 347 "CSSValueKeywords.gperf"
+      {"slider-horizontal", CSSValueSliderHorizontal},
+#line 134 "CSSValueKeywords.gperf"
+      {"source-in", CSSValueSourceIn},
+#line 188 "CSSValueKeywords.gperf"
+      {"inline-block", CSSValueInlineBlock},
+#line 172 "CSSValueKeywords.gperf"
+      {"lower-latin", CSSValueLowerLatin},
+#line 394 "CSSValueKeywords.gperf"
+      {"blueviolet", CSSValueBlueviolet},
+#line 136 "CSSValueKeywords.gperf"
+      {"source-atop", CSSValueSourceAtop},
 #line 226 "CSSValueKeywords.gperf"
       {"nwse-resize", CSSValueNwseResize},
-#line 16 "CSSValueKeywords.gperf"
-      {"groove", CSSValueGroove},
-#line 432 "CSSValueKeywords.gperf"
-      {"hotpink", CSSValueHotpink},
-#line 474 "CSSValueKeywords.gperf"
-      {"olivedrab", CSSValueOlivedrab},
-#line 427 "CSSValueKeywords.gperf"
-      {"ghostwhite", CSSValueGhostwhite},
-#line 498 "CSSValueKeywords.gperf"
-      {"slategrey", CSSValueSlategrey},
 #line 497 "CSSValueKeywords.gperf"
-      {"slategray", CSSValueSlategray},
-#line 137 "CSSValueKeywords.gperf"
-      {"destination-over", CSSValueDestinationOver},
-#line 54 "CSSValueKeywords.gperf"
-      {"x-large", CSSValueXLarge},
-#line 505 "CSSValueKeywords.gperf"
-      {"turquoise", CSSValueTurquoise},
-#line 26 "CSSValueKeywords.gperf"
-      {"message-box", CSSValueMessageBox},
-#line 467 "CSSValueKeywords.gperf"
-      {"mediumvioletred", CSSValueMediumvioletred},
-#line 158 "CSSValueKeywords.gperf"
-      {"-webkit-left", CSSValueWebkitLeft},
-#line 410 "CSSValueKeywords.gperf"
+      {"sandybrown", CSSValueSandybrown},
+#line 208 "CSSValueKeywords.gperf"
+      {"context-menu", CSSValueContextMenu},
+#line 168 "CSSValueKeywords.gperf"
+      {"lower-roman", CSSValueLowerRoman},
+#line 344 "CSSValueKeywords.gperf"
+      {"menulist-button", CSSValueMenulistButton},
+#line 319 "CSSValueKeywords.gperf"
+      {"skip-white-space", CSSValueSkipWhiteSpace},
+#line 55 "CSSValueKeywords.gperf"
+      {"xx-large", CSSValueXxLarge},
+#line 338 "CSSValueKeywords.gperf"
+      {"media-slider", CSSValueMediaSlider},
+#line 366 "CSSValueKeywords.gperf"
+      {"content-box", CSSValueContentBox},
+#line 457 "CSSValueKeywords.gperf"
+      {"lightskyblue", CSSValueLightskyblue},
+#line 315 "CSSValueKeywords.gperf"
+      {"dot-dash", CSSValueDotDash},
+#line 531 "CSSValueKeywords.gperf"
+      {"after-edge", CSSValueAfterEdge},
+#line 135 "CSSValueKeywords.gperf"
+      {"source-out", CSSValueSourceOut},
+#line 228 "CSSValueKeywords.gperf"
+      {"row-resize", CSSValueRowResize},
+#line 383 "CSSValueKeywords.gperf"
+      {"visiblestroke", CSSValueVisiblestroke},
+#line 416 "CSSValueKeywords.gperf"
       {"darkred", CSSValueDarkred},
-#line 413 "CSSValueKeywords.gperf"
-      {"darkslateblue", CSSValueDarkslateblue},
-#line 419 "CSSValueKeywords.gperf"
-      {"deepskyblue", CSSValueDeepskyblue},
-#line 441 "CSSValueKeywords.gperf"
-      {"lightblue", CSSValueLightblue},
-#line 388 "CSSValueKeywords.gperf"
-      {"blueviolet", CSSValueBlueviolet},
-#line 438 "CSSValueKeywords.gperf"
-      {"lavenderblush", CSSValueLavenderblush},
-#line 436 "CSSValueKeywords.gperf"
-      {"khaki", CSSValueKhaki},
-#line 238 "CSSValueKeywords.gperf"
-      {"uppercase", CSSValueUppercase},
-#line 339 "CSSValueKeywords.gperf"
-      {"media-sliderthumb", CSSValueMediaSliderthumb},
-#line 479 "CSSValueKeywords.gperf"
-      {"paleturquoise", CSSValuePaleturquoise},
-#line 429 "CSSValueKeywords.gperf"
-      {"goldenrod", CSSValueGoldenrod},
-#line 426 "CSSValueKeywords.gperf"
-      {"gainsboro", CSSValueGainsboro},
-#line 519 "CSSValueKeywords.gperf"
-      {"geometricprecision", CSSValueGeometricprecision},
-#line 382 "CSSValueKeywords.gperf"
-      {"antiquewhite", CSSValueAntiquewhite},
-#line 529 "CSSValueKeywords.gperf"
-      {"ideographic", CSSValueIdeographic},
-#line 316 "CSSValueKeywords.gperf"
-      {"dot-dot-dash", CSSValueDotDotDash},
-#line 454 "CSSValueKeywords.gperf"
-      {"lightsteelblue", CSSValueLightsteelblue},
-#line 109 "CSSValueKeywords.gperf"
-      {"inactivecaptiontext", CSSValueInactivecaptiontext},
+#line 107 "CSSValueKeywords.gperf"
+      {"inactiveborder", CSSValueInactiveborder},
 #line 102 "CSSValueKeywords.gperf"
       {"buttontext", CSSValueButtontext},
-#line 515 "CSSValueKeywords.gperf"
-      {"linearrgb", CSSValueLinearrgb},
-#line 466 "CSSValueKeywords.gperf"
-      {"mediumturquoise", CSSValueMediumturquoise},
-#line 439 "CSSValueKeywords.gperf"
-      {"lawngreen", CSSValueLawngreen},
-#line 228 "CSSValueKeywords.gperf"
-      {"row-resize", CSSValueRowResize},
-#line 421 "CSSValueKeywords.gperf"
-      {"dimgrey", CSSValueDimgrey},
-#line 420 "CSSValueKeywords.gperf"
-      {"dimgray", CSSValueDimgray},
 #line 104 "CSSValueKeywords.gperf"
       {"graytext", CSSValueGraytext},
-#line 67 "CSSValueKeywords.gperf"
-      {"extra-expanded", CSSValueExtraExpanded},
-#line 55 "CSSValueKeywords.gperf"
-      {"xx-large", CSSValueXxLarge},
-#line 422 "CSSValueKeywords.gperf"
-      {"dodgerblue", CSSValueDodgerblue},
-#line 296 "CSSValueKeywords.gperf"
-      {"backwards", CSSValueBackwards},
-#line 516 "CSSValueKeywords.gperf"
-      {"optimizespeed", CSSValueOptimizespeed},
+#line 378 "CSSValueKeywords.gperf"
+      {"ease-in-out", CSSValueEaseInOut},
+#line 138 "CSSValueKeywords.gperf"
+      {"destination-in", CSSValueDestinationIn},
+#line 415 "CSSValueKeywords.gperf"
+      {"darkorchid", CSSValueDarkorchid},
+#line 143 "CSSValueKeywords.gperf"
+      {"plus-lighter", CSSValuePlusLighter},
+#line 473 "CSSValueKeywords.gperf"
+      {"mediumvioletred", CSSValueMediumvioletred},
+#line 97 "CSSValueKeywords.gperf"
+      {"appworkspace", CSSValueAppworkspace},
+#line 140 "CSSValueKeywords.gperf"
+      {"destination-atop", CSSValueDestinationAtop},
+#line 324 "CSSValueKeywords.gperf"
+      {"checkbox", CSSValueCheckbox},
+#line 110 "CSSValueKeywords.gperf"
+      {"infobackground", CSSValueInfobackground},
+#line 326 "CSSValueKeywords.gperf"
+      {"push-button", CSSValuePushButton},
+#line 320 "CSSValueKeywords.gperf"
+      {"break-all", CSSValueBreakAll},
+#line 529 "CSSValueKeywords.gperf"
+      {"optimizelegibility", CSSValueOptimizelegibility},
+#line 109 "CSSValueKeywords.gperf"
+      {"inactivecaptiontext", CSSValueInactivecaptiontext},
+#line 157 "CSSValueKeywords.gperf"
+      {"justify", CSSValueJustify},
+#line 173 "CSSValueKeywords.gperf"
+      {"upper-alpha", CSSValueUpperAlpha},
+#line 349 "CSSValueKeywords.gperf"
+      {"sliderthumb-horizontal", CSSValueSliderthumbHorizontal},
+#line 424 "CSSValueKeywords.gperf"
+      {"deeppink", CSSValueDeeppink},
+#line 139 "CSSValueKeywords.gperf"
+      {"destination-out", CSSValueDestinationOut},
+#line 61 "CSSValueKeywords.gperf"
+      {"ultra-condensed", CSSValueUltraCondensed},
+#line 406 "CSSValueKeywords.gperf"
+      {"darkcyan", CSSValueDarkcyan},
 #line 174 "CSSValueKeywords.gperf"
       {"upper-latin", CSSValueUpperLatin},
-#line 68 "CSSValueKeywords.gperf"
-      {"ultra-expanded", CSSValueUltraExpanded},
-#line 477 "CSSValueKeywords.gperf"
-      {"palegoldenrod", CSSValuePalegoldenrod},
-#line 345 "CSSValueKeywords.gperf"
-      {"slider-vertical", CSSValueSliderVertical},
-#line 366 "CSSValueKeywords.gperf"
-      {"running", CSSValueRunning},
-#line 257 "CSSValueKeywords.gperf"
-      {"higher", CSSValueHigher},
-#line 180 "CSSValueKeywords.gperf"
-      {"katakana", CSSValueKatakana},
-#line 153 "CSSValueKeywords.gperf"
-      {"-webkit-auto", CSSValueWebkitAuto},
+#line 148 "CSSValueKeywords.gperf"
+      {"text-top", CSSValueTextTop},
+#line 296 "CSSValueKeywords.gperf"
+      {"backwards", CSSValueBackwards},
+#line 423 "CSSValueKeywords.gperf"
+      {"darkviolet", CSSValueDarkviolet},
+#line 357 "CSSValueKeywords.gperf"
+      {"textfield", CSSValueTextfield},
+#line 169 "CSSValueKeywords.gperf"
+      {"upper-roman", CSSValueUpperRoman},
 #line 327 "CSSValueKeywords.gperf"
       {"square-button", CSSValueSquareButton},
-#line 417 "CSSValueKeywords.gperf"
-      {"darkviolet", CSSValueDarkviolet},
-#line 326 "CSSValueKeywords.gperf"
-      {"push-button", CSSValuePushButton},
-#line 528 "CSSValueKeywords.gperf"
-      {"text-after-edge", CSSValueTextAfterEdge},
-#line 284 "CSSValueKeywords.gperf"
-      {"-webkit-nowrap", CSSValueWebkitNowrap},
-#line 160 "CSSValueKeywords.gperf"
-      {"-webkit-center", CSSValueWebkitCenter},
-#line 107 "CSSValueKeywords.gperf"
-      {"inactiveborder", CSSValueInactiveborder},
-#line 350 "CSSValueKeywords.gperf"
-      {"searchfield-decoration", CSSValueSearchfieldDecoration},
-#line 101 "CSSValueKeywords.gperf"
-      {"buttonshadow", CSSValueButtonshadow},
+#line 339 "CSSValueKeywords.gperf"
+      {"media-sliderthumb", CSSValueMediaSliderthumb},
+#line 64 "CSSValueKeywords.gperf"
+      {"semi-condensed", CSSValueSemiCondensed},
+#line 66 "CSSValueKeywords.gperf"
+      {"expanded", CSSValueExpanded},
+#line 323 "CSSValueKeywords.gperf"
+      {"after-white-space", CSSValueAfterWhiteSpace},
+#line 306 "CSSValueKeywords.gperf"
+      {"read-write", CSSValueReadWrite},
+#line 95 "CSSValueKeywords.gperf"
+      {"activeborder", CSSValueActiveborder},
+#line 345 "CSSValueKeywords.gperf"
+      {"menulist-text", CSSValueMenulistText},
+#line 396 "CSSValueKeywords.gperf"
+      {"burlywood", CSSValueBurlywood},
+#line 523 "CSSValueKeywords.gperf"
+      {"optimizequality", CSSValueOptimizequality},
+#line 450 "CSSValueKeywords.gperf"
+      {"lightgoldenrodyellow", CSSValueLightgoldenrodyellow},
+#line 422 "CSSValueKeywords.gperf"
+      {"darkturquoise", CSSValueDarkturquoise},
+#line 530 "CSSValueKeywords.gperf"
+      {"before-edge", CSSValueBeforeEdge},
+#line 26 "CSSValueKeywords.gperf"
+      {"message-box", CSSValueMessageBox},
+#line 348 "CSSValueKeywords.gperf"
+      {"slider-vertical", CSSValueSliderVertical},
+#line 149 "CSSValueKeywords.gperf"
+      {"text-bottom", CSSValueTextBottom},
+#line 269 "CSSValueKeywords.gperf"
+      {"open-quote", CSSValueOpenQuote},
+#line 178 "CSSValueKeywords.gperf"
+      {"cjk-ideographic", CSSValueCjkIdeographic},
+#line 98 "CSSValueKeywords.gperf"
+      {"background", CSSValueBackground},
+#line 410 "CSSValueKeywords.gperf"
+      {"darkgrey", CSSValueDarkgrey},
+#line 195 "CSSValueKeywords.gperf"
+      {"table-column-group", CSSValueTableColumnGroup},
+#line 408 "CSSValueKeywords.gperf"
+      {"darkgray", CSSValueDarkgray},
+#line 340 "CSSValueKeywords.gperf"
+      {"media-timeline-container", CSSValueMediaTimelineContainer},
+#line 365 "CSSValueKeywords.gperf"
+      {"border-box", CSSValueBorderBox},
+#line 330 "CSSValueKeywords.gperf"
+      {"default-button", CSSValueDefaultButton},
+#line 292 "CSSValueKeywords.gperf"
+      {"block-axis", CSSValueBlockAxis},
 #line 247 "CSSValueKeywords.gperf"
       {"bidi-override", CSSValueBidiOverride},
-#line 30 "CSSValueKeywords.gperf"
-      {"-webkit-control", CSSValueWebkitControl},
-#line 353 "CSSValueKeywords.gperf"
-      {"searchfield-cancel-button", CSSValueSearchfieldCancelButton},
-#line 448 "CSSValueKeywords.gperf"
-      {"lightpink", CSSValueLightpink},
-#line 527 "CSSValueKeywords.gperf"
-      {"text-before-edge", CSSValueTextBeforeEdge},
+#line 115 "CSSValueKeywords.gperf"
+      {"threeddarkshadow", CSSValueThreeddarkshadow},
+#line 413 "CSSValueKeywords.gperf"
+      {"darkolivegreen", CSSValueDarkolivegreen},
+#line 191 "CSSValueKeywords.gperf"
+      {"table-row-group", CSSValueTableRowGroup},
+#line 421 "CSSValueKeywords.gperf"
+      {"darkslategrey", CSSValueDarkslategrey},
+#line 420 "CSSValueKeywords.gperf"
+      {"darkslategray", CSSValueDarkslategray},
+#line 364 "CSSValueKeywords.gperf"
+      {"padding-box", CSSValuePaddingBox},
+#line 373 "CSSValueKeywords.gperf"
+      {"preserve-3d", CSSValuePreserve3d},
 #line 133 "CSSValueKeywords.gperf"
       {"source-over", CSSValueSourceOver},
-#line 169 "CSSValueKeywords.gperf"
-      {"upper-roman", CSSValueUpperRoman},
-#line 177 "CSSValueKeywords.gperf"
-      {"georgian", CSSValueGeorgian},
-#line 468 "CSSValueKeywords.gperf"
-      {"midnightblue", CSSValueMidnightblue},
-#line 29 "CSSValueKeywords.gperf"
-      {"-webkit-small-control", CSSValueWebkitSmallControl},
-#line 406 "CSSValueKeywords.gperf"
-      {"darkmagenta", CSSValueDarkmagenta},
-#line 330 "CSSValueKeywords.gperf"
-      {"default-button", CSSValueDefaultButton},
-#line 126 "CSSValueKeywords.gperf"
-      {"-webkit-text", CSSValueWebkitText},
+#line 128 "CSSValueKeywords.gperf"
+      {"repeat-x", CSSValueRepeatX},
+#line 334 "CSSValueKeywords.gperf"
+      {"media-mute-button", CSSValueMediaMuteButton},
+#line 407 "CSSValueKeywords.gperf"
+      {"darkgoldenrod", CSSValueDarkgoldenrod},
+#line 129 "CSSValueKeywords.gperf"
+      {"repeat-y", CSSValueRepeatY},
+#line 182 "CSSValueKeywords.gperf"
+      {"katakana-iroha", CSSValueKatakanaIroha},
+#line 170 "CSSValueKeywords.gperf"
+      {"lower-greek", CSSValueLowerGreek},
+#line 305 "CSSValueKeywords.gperf"
+      {"read-only", CSSValueReadOnly},
+#line 350 "CSSValueKeywords.gperf"
+      {"sliderthumb-vertical", CSSValueSliderthumbVertical},
+#line 321 "CSSValueKeywords.gperf"
+      {"break-word", CSSValueBreakWord},
+#line 62 "CSSValueKeywords.gperf"
+      {"extra-condensed", CSSValueExtraCondensed},
 #line 329 "CSSValueKeywords.gperf"
       {"button-bevel", CSSValueButtonBevel},
-#line 191 "CSSValueKeywords.gperf"
-      {"table-row-group", CSSValueTableRowGroup},
-#line 28 "CSSValueKeywords.gperf"
-      {"-webkit-mini-control", CSSValueWebkitMiniControl},
-#line 195 "CSSValueKeywords.gperf"
-      {"table-column-group", CSSValueTableColumnGroup},
-#line 409 "CSSValueKeywords.gperf"
-      {"darkorchid", CSSValueDarkorchid},
-#line 199 "CSSValueKeywords.gperf"
-      {"-webkit-box", CSSValueWebkitBox},
-#line 95 "CSSValueKeywords.gperf"
-      {"activeborder", CSSValueActiveborder},
+#line 411 "CSSValueKeywords.gperf"
+      {"darkkhaki", CSSValueDarkkhaki},
+#line 137 "CSSValueKeywords.gperf"
+      {"destination-over", CSSValueDestinationOver},
+#line 68 "CSSValueKeywords.gperf"
+      {"ultra-expanded", CSSValueUltraExpanded},
 #line 193 "CSSValueKeywords.gperf"
       {"table-footer-group", CSSValueTableFooterGroup},
-#line 323 "CSSValueKeywords.gperf"
-      {"after-white-space", CSSValueAfterWhiteSpace},
-#line 74 "CSSValueKeywords.gperf"
-      {"-webkit-body", CSSValueWebkitBody},
-#line 97 "CSSValueKeywords.gperf"
-      {"appworkspace", CSSValueAppworkspace},
-#line 377 "CSSValueKeywords.gperf"
-      {"visiblestroke", CSSValueVisiblestroke},
-#line 307 "CSSValueKeywords.gperf"
-      {"read-write-plaintext-only", CSSValueReadWritePlaintextOnly},
-#line 173 "CSSValueKeywords.gperf"
-      {"upper-alpha", CSSValueUpperAlpha},
-#line 403 "CSSValueKeywords.gperf"
-      {"darkgreen", CSSValueDarkgreen},
-#line 412 "CSSValueKeywords.gperf"
-      {"darkseagreen", CSSValueDarkseagreen},
-#line 408 "CSSValueKeywords.gperf"
-      {"darkorange", CSSValueDarkorange},
+#line 192 "CSSValueKeywords.gperf"
+      {"table-header-group", CSSValueTableHeaderGroup},
+#line 206 "CSSValueKeywords.gperf"
+      {"vertical-text", CSSValueVerticalText},
+#line 65 "CSSValueKeywords.gperf"
+      {"semi-expanded", CSSValueSemiExpanded},
 #line 142 "CSSValueKeywords.gperf"
       {"plus-darker", CSSValuePlusDarker},
+#line 425 "CSSValueKeywords.gperf"
+      {"deepskyblue", CSSValueDeepskyblue},
+#line 333 "CSSValueKeywords.gperf"
+      {"media-fullscreen-button", CSSValueMediaFullscreenButton},
+#line 353 "CSSValueKeywords.gperf"
+      {"searchfield-decoration", CSSValueSearchfieldDecoration},
+#line 346 "CSSValueKeywords.gperf"
+      {"menulist-textfield", CSSValueMenulistTextfield},
+#line 316 "CSSValueKeywords.gperf"
+      {"dot-dot-dash", CSSValueDotDotDash},
+#line 335 "CSSValueKeywords.gperf"
+      {"media-play-button", CSSValueMediaPlayButton},
+#line 67 "CSSValueKeywords.gperf"
+      {"extra-expanded", CSSValueExtraExpanded},
 #line 356 "CSSValueKeywords.gperf"
+      {"searchfield-cancel-button", CSSValueSearchfieldCancelButton},
+#line 359 "CSSValueKeywords.gperf"
       {"caps-lock-indicator", CSSValueCapsLockIndicator},
-#line 115 "CSSValueKeywords.gperf"
-      {"threeddarkshadow", CSSValueThreeddarkshadow},
+#line 153 "CSSValueKeywords.gperf"
+      {"-webkit-auto", CSSValueWebkitAuto},
+#line 160 "CSSValueKeywords.gperf"
+      {"-webkit-center", CSSValueWebkitCenter},
+#line 167 "CSSValueKeywords.gperf"
+      {"decimal-leading-zero", CSSValueDecimalLeadingZero},
+#line 30 "CSSValueKeywords.gperf"
+      {"-webkit-control", CSSValueWebkitControl},
+#line 355 "CSSValueKeywords.gperf"
+      {"searchfield-results-button", CSSValueSearchfieldResultsButton},
+#line 284 "CSSValueKeywords.gperf"
+      {"-webkit-nowrap", CSSValueWebkitNowrap},
+#line 159 "CSSValueKeywords.gperf"
+      {"-webkit-right", CSSValueWebkitRight},
+#line 534 "CSSValueKeywords.gperf"
+      {"text-after-edge", CSSValueTextAfterEdge},
+#line 158 "CSSValueKeywords.gperf"
+      {"-webkit-left", CSSValueWebkitLeft},
+#line 233 "CSSValueKeywords.gperf"
+      {"-webkit-grab", CSSValueWebkitGrab},
+#line 533 "CSSValueKeywords.gperf"
+      {"text-before-edge", CSSValueTextBeforeEdge},
+#line 354 "CSSValueKeywords.gperf"
+      {"searchfield-results-decoration", CSSValueSearchfieldResultsDecoration},
 #line 93 "CSSValueKeywords.gperf"
       {"-webkit-link", CSSValueWebkitLink},
-#line 446 "CSSValueKeywords.gperf"
-      {"lightgreen", CSSValueLightgreen},
-#line 200 "CSSValueKeywords.gperf"
-      {"-webkit-inline-box", CSSValueWebkitInlineBox},
-#line 344 "CSSValueKeywords.gperf"
-      {"slider-horizontal", CSSValueSliderHorizontal},
-#line 450 "CSSValueKeywords.gperf"
-      {"lightseagreen", CSSValueLightseagreen},
+#line 264 "CSSValueKeywords.gperf"
+      {"-webkit-marquee", CSSValueWebkitMarquee},
+#line 126 "CSSValueKeywords.gperf"
+      {"-webkit-text", CSSValueWebkitText},
+#line 199 "CSSValueKeywords.gperf"
+      {"-webkit-box", CSSValueWebkitBox},
+#line 234 "CSSValueKeywords.gperf"
+      {"-webkit-grabbing", CSSValueWebkitGrabbing},
 #line 213 "CSSValueKeywords.gperf"
       {"-webkit-zoom-in", CSSValueWebkitZoomIn},
-#line 531 "CSSValueKeywords.gperf"
-      {"hanging", CSSValueHanging},
-#line 152 "CSSValueKeywords.gperf"
-      {"-webkit-baseline-middle", CSSValueWebkitBaselineMiddle},
-#line 337 "CSSValueKeywords.gperf"
-      {"media-seek-forward-button", CSSValueMediaSeekForwardButton},
-#line 181 "CSSValueKeywords.gperf"
-      {"hiragana-iroha", CSSValueHiraganaIroha},
-#line 524 "CSSValueKeywords.gperf"
-      {"before-edge", CSSValueBeforeEdge},
-#line 404 "CSSValueKeywords.gperf"
-      {"darkgrey", CSSValueDarkgrey},
-#line 402 "CSSValueKeywords.gperf"
-      {"darkgray", CSSValueDarkgray},
-#line 336 "CSSValueKeywords.gperf"
-      {"media-seek-back-button", CSSValueMediaSeekBackButton},
-#line 143 "CSSValueKeywords.gperf"
-      {"plus-lighter", CSSValuePlusLighter},
-#line 118 "CSSValueKeywords.gperf"
-      {"threedlightshadow", CSSValueThreedlightshadow},
-#line 525 "CSSValueKeywords.gperf"
-      {"after-edge", CSSValueAfterEdge},
-#line 415 "CSSValueKeywords.gperf"
-      {"darkslategrey", CSSValueDarkslategrey},
-#line 414 "CSSValueKeywords.gperf"
-      {"darkslategray", CSSValueDarkslategray},
-#line 447 "CSSValueKeywords.gperf"
-      {"lightgrey", CSSValueLightgrey},
-#line 445 "CSSValueKeywords.gperf"
-      {"lightgray", CSSValueLightgray},
-#line 352 "CSSValueKeywords.gperf"
-      {"searchfield-results-button", CSSValueSearchfieldResultsButton},
-#line 416 "CSSValueKeywords.gperf"
-      {"darkturquoise", CSSValueDarkturquoise},
-#line 451 "CSSValueKeywords.gperf"
-      {"lightskyblue", CSSValueLightskyblue},
-#line 500 "CSSValueKeywords.gperf"
-      {"springgreen", CSSValueSpringgreen},
-#line 453 "CSSValueKeywords.gperf"
-      {"lightslategrey", CSSValueLightslategrey},
-#line 452 "CSSValueKeywords.gperf"
-      {"lightslategray", CSSValueLightslategray},
-#line 351 "CSSValueKeywords.gperf"
-      {"searchfield-results-decoration", CSSValueSearchfieldResultsDecoration},
-#line 170 "CSSValueKeywords.gperf"
-      {"lower-greek", CSSValueLowerGreek},
+#line 342 "CSSValueKeywords.gperf"
+      {"media-time-remaining-display", CSSValueMediaTimeRemainingDisplay},
+#line 341 "CSSValueKeywords.gperf"
+      {"media-current-time-display", CSSValueMediaCurrentTimeDisplay},
+#line 29 "CSSValueKeywords.gperf"
+      {"-webkit-small-control", CSSValueWebkitSmallControl},
 #line 214 "CSSValueKeywords.gperf"
       {"-webkit-zoom-out", CSSValueWebkitZoomOut},
-#line 264 "CSSValueKeywords.gperf"
-      {"-webkit-marquee", CSSValueWebkitMarquee},
-#line 465 "CSSValueKeywords.gperf"
-      {"mediumspringgreen", CSSValueMediumspringgreen},
-#line 261 "CSSValueKeywords.gperf"
-      {"line-through", CSSValueLineThrough},
-#line 517 "CSSValueKeywords.gperf"
-      {"optimizequality", CSSValueOptimizequality},
-#line 182 "CSSValueKeywords.gperf"
-      {"katakana-iroha", CSSValueKatakanaIroha},
-#line 178 "CSSValueKeywords.gperf"
-      {"cjk-ideographic", CSSValueCjkIdeographic},
-#line 401 "CSSValueKeywords.gperf"
-      {"darkgoldenrod", CSSValueDarkgoldenrod},
-#line 167 "CSSValueKeywords.gperf"
-      {"decimal-leading-zero", CSSValueDecimalLeadingZero},
-#line 192 "CSSValueKeywords.gperf"
-      {"table-header-group", CSSValueTableHeaderGroup},
-#line 233 "CSSValueKeywords.gperf"
-      {"-webkit-grab", CSSValueWebkitGrab},
-#line 347 "CSSValueKeywords.gperf"
-      {"sliderthumb-vertical", CSSValueSliderthumbVertical},
-#line 98 "CSSValueKeywords.gperf"
-      {"background", CSSValueBackground},
-#line 523 "CSSValueKeywords.gperf"
-      {"optimizelegibility", CSSValueOptimizelegibility},
-#line 407 "CSSValueKeywords.gperf"
-      {"darkolivegreen", CSSValueDarkolivegreen},
-#line 105 "CSSValueKeywords.gperf"
-      {"highlight", CSSValueHighlight},
-#line 405 "CSSValueKeywords.gperf"
-      {"darkkhaki", CSSValueDarkkhaki},
+#line 28 "CSSValueKeywords.gperf"
+      {"-webkit-mini-control", CSSValueWebkitMiniControl},
+#line 336 "CSSValueKeywords.gperf"
+      {"media-seek-back-button", CSSValueMediaSeekBackButton},
+#line 74 "CSSValueKeywords.gperf"
+      {"-webkit-body", CSSValueWebkitBody},
+#line 337 "CSSValueKeywords.gperf"
+      {"media-seek-forward-button", CSSValueMediaSeekForwardButton},
 #line 94 "CSSValueKeywords.gperf"
       {"-webkit-activelink", CSSValueWebkitActivelink},
-#line 444 "CSSValueKeywords.gperf"
-      {"lightgoldenrodyellow", CSSValueLightgoldenrodyellow},
-#line 159 "CSSValueKeywords.gperf"
-      {"-webkit-right", CSSValueWebkitRight},
-#line 346 "CSSValueKeywords.gperf"
-      {"sliderthumb-horizontal", CSSValueSliderthumbHorizontal},
-#line 110 "CSSValueKeywords.gperf"
-      {"infobackground", CSSValueInfobackground},
+#line 200 "CSSValueKeywords.gperf"
+      {"-webkit-inline-box", CSSValueWebkitInlineBox},
+#line 307 "CSSValueKeywords.gperf"
+      {"read-write-plaintext-only", CSSValueReadWritePlaintextOnly},
+#line 152 "CSSValueKeywords.gperf"
+      {"-webkit-baseline-middle", CSSValueWebkitBaselineMiddle},
 #line 123 "CSSValueKeywords.gperf"
       {"-webkit-focus-ring-color", CSSValueWebkitFocusRingColor},
-#line 117 "CSSValueKeywords.gperf"
-      {"threedhighlight", CSSValueThreedhighlight},
-#line 106 "CSSValueKeywords.gperf"
-      {"highlighttext", CSSValueHighlighttext},
-#line 234 "CSSValueKeywords.gperf"
-      {"-webkit-grabbing", CSSValueWebkitGrabbing},
 #line 56 "CSSValueKeywords.gperf"
-      {"-webkit-xxx-large", CSSValueWebkitXxxLarge},
-#line 100 "CSSValueKeywords.gperf"
-      {"buttonhighlight", CSSValueButtonhighlight}
+      {"-webkit-xxx-large", CSSValueWebkitXxxLarge}
     };
 
   static const short lookup[] =
     {
         0,  -1,  -1,  -1,  -1,   1,  -1,  -1,  -1,  -1,
         2,  -1,  -1,  -1,  -1,   3,  -1,  -1,  -1,  -1,
-        4,  -1,  -1,  -1,  -1,   5,  -1,  -1,  -1,  -1,
-        6,  -1,  -1,  -1,  -1,   7,  -1,  -1,  -1,  -1,
-        8,  -1,  -1,  -1,  -1,   9,  10,  11,  -1,  -1,
-       12,  13,  -1,  14,  -1,  15,  -1,  -1,  -1,  -1,
-       16,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  17,  -1,  -1,  -1,  -1,
-       18,  -1,  -1,  -1,  -1,  19,  -1,  -1,  -1,  -1,
-       -1,  -1,  20,  -1,  -1,  21,  -1,  22,  -1,  -1,
-       -1,  -1,  23,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       24,  -1,  -1,  -1,  -1,  25,  -1,  26,  -1,  -1,
+        4,  -1,   5,  -1,  -1,   6,   7,  -1,  -1,  -1,
+        8,  -1,  -1,  -1,  -1,   9,  10,  -1,  -1,  -1,
+       11,  12,  -1,  -1,  -1,  13,  14,  -1,  -1,  -1,
+       15,  16,  -1,  -1,  -1,  17,  -1,  -1,  -1,  -1,
+       18,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  19,  -1,  -1,  -1,  -1,
+       20,  21,  -1,  -1,  -1,  22,  23,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  24,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       25,  -1,  -1,  -1,  -1,  26,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        27,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       28,  -1,  -1,  -1,  -1,  29,  -1,  -1,  -1,  -1,
-       -1,  30,  -1,  31,  -1,  32,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  33,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  34,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  35,  36,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  37,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  38,  -1,  -1,  -1,  -1,  -1,  -1,
-       39,  40,  -1,  -1,  -1,  41,  -1,  42,  -1,  -1,
-       43,  44,  -1,  45,  46,  -1,  47,  -1,  -1,  -1,
-       -1,  48,  -1,  -1,  -1,  49,  50,  -1,  -1,  -1,
-       51,  -1,  -1,  -1,  -1,  52,  -1,  -1,  -1,  -1,
-       53,  54,  -1,  -1,  -1,  -1,  -1,  55,  -1,  -1,
-       56,  -1,  -1,  -1,  -1,  57,  58,  -1,  -1,  -1,
-       -1,  59,  60,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       61,  -1,  -1,  -1,  -1,  62,  63,  -1,  -1,  64,
-       65,  66,  67,  -1,  -1,  -1,  68,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  69,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  70,  -1,  -1,  -1,
-       -1,  71,  -1,  -1,  -1,  -1,  72,  -1,  -1,  -1,
-       -1,  73,  -1,  74,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  75,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       76,  -1,  -1,  -1,  -1,  77,  -1,  -1,  -1,  -1,
-       -1,  78,  79,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  80,  -1,  81,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  82,  -1,  -1,  -1,
-       83,  84,  -1,  -1,  -1,  85,  86,  -1,  -1,  -1,
-       87,  -1,  -1,  88,  -1,  89,  90,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  91,  92,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  93,  -1,  -1,  -1,  94,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  95,  -1,  -1,  96,  -1,  -1,  -1,  -1,
-       97,  -1,  -1,  -1,  -1,  98,  -1,  -1,  99,  -1,
-      100,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 101,  -1,  -1,  -1,  -1, 102,  -1, 103,  -1,
-       -1, 104, 105,  -1,  -1,  -1,  -1,  -1, 106,  -1,
-      107,  -1,  -1,  -1,  -1, 108,  -1, 109,  -1,  -1,
-       -1, 110,  -1,  -1,  -1, 111,  -1, 112,  -1,  -1,
-      113,  -1,  -1,  -1,  -1, 114, 115,  -1,  -1,  -1,
-      116,  -1,  -1, 117,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 118,  -1,  -1,  -1,  -1,
-      119,  -1,  -1,  -1,  -1,  -1, 120,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 121,  -1,  -1,  -1,  -1,
-      122, 123,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 124,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 125,
-      126, 127, 128, 129,  -1,  -1,  -1,  -1,  -1,  -1,
-      130,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      131,  -1, 132,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 133,  -1, 134, 135,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 136,  -1,  -1, 137,  -1,
-       -1,  -1,  -1, 138,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 139,  -1, 140,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 141,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 142,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 143,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 144,  -1,
-       -1, 145, 146,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 147,  -1,  -1, 148,  -1,  -1, 149,  -1,
-      150,  -1,  -1,  -1,  -1, 151, 152, 153,  -1,  -1,
-       -1, 154,  -1,  -1,  -1, 155, 156,  -1,  -1,  -1,
-       -1, 157,  -1,  -1,  -1, 158, 159,  -1,  -1,  -1,
-       -1,  -1, 160,  -1,  -1, 161,  -1,  -1,  -1,  -1,
-      162, 163,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      164, 165, 166,  -1,  -1, 167, 168,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 169,  -1,  -1,  -1,
-      170,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1, 171, 172,  -1,  -1,  -1,  -1,
-      173,  -1,  -1,  -1,  -1,  -1, 174,  -1,  -1,  -1,
-      175, 176, 177,  -1,  -1, 178, 179, 180,  -1,  -1,
-       -1, 181, 182,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      183, 184,  -1,  -1,  -1,  -1, 185,  -1,  -1,  -1,
-      186, 187, 188,  -1, 189,  -1,  -1, 190,  -1,  -1,
-      191,  -1,  -1,  -1,  -1, 192, 193,  -1,  -1,  -1,
-      194,  -1,  -1,  -1,  -1,  -1,  -1, 195,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 196,  -1, 197,  -1,
-       -1,  -1,  -1,  -1,  -1, 198, 199,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 200,  -1,  -1,  -1,
-       -1, 201,  -1,  -1,  -1,  -1, 202,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 203,  -1, 204,  -1,  -1,
-       -1, 205,  -1,  -1,  -1,  -1,  -1,  -1, 206,  -1,
-       -1,  -1,  -1,  -1,  -1, 207, 208,  -1,  -1,  -1,
-      209,  -1, 210,  -1,  -1, 211,  -1, 212,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 213,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 214,  -1,  -1,  -1,  -1,
-       -1, 215,  -1,  -1,  -1, 216,  -1,  -1,  -1,  -1,
-       -1, 217,  -1,  -1,  -1,  -1, 218,  -1,  -1,  -1,
-      219,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      220, 221,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 222, 223,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 224,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 225, 226, 227,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 228, 229,  -1,  -1,  -1,
-       -1, 230,  -1,  -1,  -1, 231,  -1, 232, 233,  -1,
-       -1,  -1,  -1,  -1,  -1, 234,  -1,  -1,  -1,  -1,
-      235, 236,  -1,  -1,  -1, 237,  -1,  -1,  -1,  -1,
-      238, 239,  -1,  -1,  -1, 240,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 241,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 242,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 243, 244,  -1, 245,  -1,
-       -1,  -1,  -1,  -1,  -1, 246, 247,  -1,  -1,  -1,
-       -1,  -1,  -1, 248,  -1,  -1,  -1,  -1, 249,  -1,
-       -1,  -1,  -1,  -1,  -1, 250, 251, 252,  -1,  -1,
-      253,  -1,  -1,  -1,  -1, 254,  -1,  -1,  -1,  -1,
-      255, 256,  -1, 257,  -1,  -1,  -1, 258,  -1,  -1,
-      259, 260,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 261,  -1,
-      262,  -1,  -1,  -1,  -1,  -1, 263,  -1, 264,  -1,
-      265, 266, 267,  -1,  -1,  -1, 268, 269,  -1,  -1,
-       -1, 270,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       28,  29,  -1,  -1,  -1,  30,  31,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  32,  -1,  -1,  -1,  -1,
+       33,  -1,  -1,  -1,  -1,  34,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  35,  36,  -1,  -1,
+       37,  -1,  38,  -1,  -1,  -1,  39,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  40,  -1,  -1,  -1,
+       -1,  41,  -1,  -1,  -1,  42,  43,  44,  -1,  -1,
+       -1,  45,  -1,  46,  -1,  47,  -1,  -1,  -1,  -1,
+       -1,  48,  -1,  -1,  49,  -1,  -1,  -1,  -1,  -1,
+       -1,  50,  -1,  -1,  -1,  51,  52,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       53,  -1,  54,  -1,  -1,  55,  -1,  -1,  -1,  -1,
+       56,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  57,  -1,  -1,  -1,  58,  -1,  59,  -1,  -1,
+       60,  -1,  -1,  61,  -1,  62,  -1,  -1,  -1,  -1,
+       63,  -1,  64,  65,  -1,  -1,  66,  67,  -1,  -1,
+       68,  -1,  -1,  -1,  -1,  69,  70,  -1,  -1,  -1,
+       -1,  71,  -1,  72,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  73,  74,  -1,  75,  76,  -1,  -1,  -1,
+       -1,  -1,  -1,  77,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  78,  -1,  -1,  -1,  79,  80,  -1,  -1,  -1,
+       81,  -1,  -1,  -1,  -1,  82,  83,  -1,  -1,  -1,
+       84,  85,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       86,  -1,  87,  -1,  -1,  -1,  88,  -1,  -1,  -1,
+       -1,  89,  -1,  -1,  -1,  90,  -1,  -1,  -1,  -1,
+       -1,  91,  92,  -1,  -1,  93,  94,  95,  -1,  -1,
+       -1,  96,  -1,  -1,  97,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       98,  -1,  99,  -1,  -1, 100,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 101,  -1,  -1,  -1,  -1,
+       -1, 102,  -1,  -1,  -1,  -1, 103,  -1,  -1,  -1,
+      104,  -1, 105,  -1,  -1, 106, 107,  -1,  -1,  -1,
+      108,  -1, 109,  -1,  -1,  -1,  -1, 110, 111,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 112,  -1,  -1,  -1,
+      113,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 114,  -1,  -1,  -1,
+      115,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 116,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 117, 118,  -1,  -1,  -1,
+      119,  -1,  -1,  -1,  -1, 120,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1, 121,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 122, 123,  -1, 124,  -1,  -1,  -1,
+      125,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 126,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 127,  -1,  -1,  -1,
+       -1, 128,  -1,  -1,  -1,  -1, 129,  -1,  -1,  -1,
+      130,  -1,  -1,  -1,  -1, 131,  -1,  -1,  -1,  -1,
+      132,  -1, 133,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      134,  -1,  -1,  -1, 135,  -1,  -1,  -1,  -1,  -1,
+      136,  -1,  -1,  -1,  -1, 137,  -1,  -1,  -1,  -1,
+       -1, 138,  -1,  -1,  -1, 139,  -1,  -1,  -1,  -1,
+      140,  -1,  -1,  -1,  -1,  -1, 141,  -1, 142,  -1,
+      143,  -1,  -1,  -1,  -1, 144,  -1,  -1,  -1,  -1,
+      145, 146,  -1,  -1,  -1,  -1, 147,  -1,  -1,  -1,
+      148,  -1,  -1,  -1,  -1, 149,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 150,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 151,  -1,  -1,  -1,  -1,
+      152,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 153,  -1,  -1,  -1,
+       -1, 154,  -1,  -1,  -1,  -1, 155,  -1,  -1,  -1,
+      156,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 157,  -1, 158, 159, 160, 161,  -1,
+      162, 163,  -1,  -1,  -1, 164,  -1,  -1,  -1,  -1,
+       -1, 165,  -1,  -1,  -1, 166,  -1,  -1,  -1,  -1,
+      167, 168,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 169,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 170,  -1,  -1,
+       -1,  -1, 171,  -1,  -1, 172, 173,  -1,  -1,  -1,
+       -1, 174,  -1,  -1,  -1, 175,  -1, 176,  -1,  -1,
+       -1, 177,  -1,  -1,  -1, 178, 179, 180,  -1,  -1,
+      181, 182,  -1, 183,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 184,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 185, 186,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 187,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 188,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 189,  -1,  -1,  -1,  -1,  -1, 190,  -1,  -1,
+      191,  -1,  -1,  -1,  -1,  -1, 192,  -1,  -1,  -1,
+      193,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 194, 195,  -1,  -1, 196,  -1,  -1,  -1,  -1,
+      197,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 198,  -1,  -1,  -1,  -1,
+       -1, 199,  -1,  -1,  -1, 200,  -1, 201,  -1,  -1,
+      202,  -1, 203,  -1,  -1,  -1, 204,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 205,  -1,  -1,  -1,  -1,
+      206,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 207,  -1,  -1,  -1,  -1,
+      208,  -1, 209,  -1,  -1, 210,  -1, 211,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      212, 213, 214,  -1,  -1,  -1, 215,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      216,  -1,  -1,  -1,  -1, 217, 218,  -1,  -1,  -1,
+      219,  -1,  -1,  -1,  -1, 220, 221,  -1,  -1,  -1,
+      222,  -1,  -1,  -1,  -1,  -1, 223,  -1, 224,  -1,
+      225, 226,  -1,  -1, 227,  -1, 228,  -1,  -1,  -1,
+      229, 230,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      231,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      232,  -1,  -1,  -1,  -1, 233, 234,  -1,  -1,  -1,
+      235,  -1, 236,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      237, 238,  -1,  -1,  -1, 239,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 240, 241,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 242, 243,  -1,  -1,  -1,
+       -1, 244, 245,  -1,  -1,  -1,  -1, 246,  -1,  -1,
+       -1,  -1,  -1, 247,  -1,  -1,  -1,  -1,  -1,  -1,
+      248, 249,  -1,  -1,  -1,  -1, 250,  -1,  -1,  -1,
+       -1, 251, 252,  -1,  -1, 253, 254,  -1,  -1,  -1,
+      255,  -1, 256,  -1,  -1, 257,  -1,  -1,  -1,  -1,
+       -1, 258,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      259,  -1,  -1,  -1,  -1, 260,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 261,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 262,  -1,  -1,
+      263, 264,  -1,  -1,  -1,  -1,  -1, 265,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 266,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      267,  -1,  -1, 268,  -1, 269, 270,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1, 271,  -1,  -1,  -1,  -1,
-      272,  -1, 273,  -1,  -1, 274,  -1,  -1, 275,  -1,
-      276,  -1, 277, 278,  -1, 279,  -1, 280,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      281,  -1, 282,  -1,  -1, 283, 284,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      285,  -1,  -1, 286,  -1, 287,  -1,  -1,  -1,  -1,
-      288, 289,  -1, 290,  -1, 291, 292,  -1,  -1, 293,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 294,  -1, 295,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 296,  -1,  -1,  -1,  -1,  -1,  -1, 297,  -1,
-      298,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      299,  -1,  -1,  -1,  -1,  -1, 300,  -1,  -1,  -1,
-       -1,  -1, 301,  -1,  -1, 302,  -1,  -1, 303,  -1,
-      304,  -1,  -1,  -1,  -1, 305,  -1,  -1,  -1,  -1,
-      306, 307, 308,  -1,  -1, 309,  -1,  -1,  -1,  -1,
-       -1,  -1, 310,  -1,  -1, 311,  -1,  -1,  -1,  -1,
-       -1, 312,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 313, 314,  -1,  -1,  -1,
-       -1,  -1, 315,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 316,  -1,  -1,  -1,  -1,  -1,  -1,
-      317,  -1,  -1,  -1,  -1,  -1, 318,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      319,  -1, 320,  -1,  -1,  -1, 321,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 322,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 323, 324,  -1, 325,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 326,  -1,  -1,  -1,
+       -1, 272,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 273,  -1,  -1,  -1,  -1,  -1,  -1, 274,  -1,
+       -1, 275,  -1,  -1,  -1, 276, 277, 278,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 279,  -1,  -1,  -1,  -1,
+       -1, 280,  -1,  -1,  -1, 281,  -1,  -1,  -1,  -1,
+      282,  -1,  -1,  -1,  -1, 283, 284,  -1,  -1,  -1,
+       -1, 285,  -1,  -1,  -1, 286,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 287, 288,  -1,  -1,
+       -1, 289,  -1,  -1,  -1, 290,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 291, 292,  -1,  -1,  -1,
+      293,  -1,  -1,  -1,  -1, 294,  -1, 295,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 296,  -1,  -1,  -1,  -1,
+      297,  -1,  -1,  -1, 298,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 299,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 300,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 301,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 302,  -1, 303,  -1, 304,  -1,  -1,  -1,  -1,
+      305,  -1,  -1,  -1,  -1,  -1, 306,  -1,  -1,  -1,
+       -1, 307,  -1,  -1,  -1, 308,  -1,  -1,  -1,  -1,
+      309,  -1,  -1,  -1,  -1, 310,  -1,  -1,  -1,  -1,
+      311,  -1,  -1,  -1,  -1, 312,  -1,  -1,  -1,  -1,
+       -1,  -1, 313,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 314,  -1,  -1,  -1,  -1, 315,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 316,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 317,
+       -1,  -1, 318,  -1,  -1,  -1,  -1, 319,  -1,  -1,
+       -1,  -1, 320,  -1,  -1,  -1, 321,  -1,  -1,  -1,
+       -1,  -1, 322,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 323,  -1,  -1,  -1,
+       -1, 324, 325,  -1,  -1, 326,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1, 327,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 328, 329,  -1,  -1,  -1,
-       -1, 330,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      331,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 332,  -1, 333,  -1,  -1, 334,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 335, 336,  -1,  -1,  -1,
-      337,  -1,  -1,  -1,  -1,  -1,  -1, 338,  -1,  -1,
-       -1, 339,  -1,  -1,  -1,  -1, 340, 341,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 342,  -1, 343,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      344, 345,  -1, 346,  -1, 347,  -1,  -1,  -1,  -1,
-      348,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 349,
-      350, 351,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 352, 353, 354,  -1,  -1,  -1,  -1, 355,  -1,
-      356,  -1,  -1,  -1,  -1,  -1,  -1, 357,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 358,  -1,  -1,  -1,
-       -1, 359, 360, 361,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 362, 363,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 364,  -1,  -1, 365,  -1,  -1,  -1,  -1,  -1,
-       -1, 366, 367,  -1,  -1,  -1, 368,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 369,  -1,  -1,  -1,
-       -1,  -1,  -1, 370,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 371,  -1,  -1,  -1, 372,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 373,  -1,  -1,  -1,  -1, 374,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 375,  -1, 376, 377,
-       -1,  -1,  -1,  -1,  -1, 378,  -1,  -1,  -1,  -1,
-      379,  -1,  -1,  -1,  -1,  -1, 380,  -1,  -1,  -1,
-      381,  -1,  -1,  -1,  -1, 382, 383,  -1,  -1,  -1,
-       -1,  -1, 384,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 385,  -1,  -1,  -1,  -1, 386,  -1,  -1,  -1,
-       -1, 387,  -1, 388,  -1,  -1, 389,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 390,  -1,  -1,
-       -1, 391,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 392,  -1,
-      393,  -1,  -1,  -1,  -1, 394,  -1,  -1, 395,  -1,
-       -1, 396,  -1,  -1,  -1, 397,  -1, 398,  -1,  -1,
-      399,  -1,  -1,  -1,  -1,  -1,  -1, 400,  -1,  -1,
-       -1, 401,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 402,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 403,  -1,  -1,  -1,  -1,
-       -1, 404,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 405,  -1,  -1,  -1,
-       -1,  -1,  -1, 406,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 407,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      408,  -1,  -1,  -1,  -1,  -1, 409,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 410,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 411,  -1,  -1,  -1,  -1, 412, 413,  -1,  -1,
-       -1, 414,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 415, 416,  -1,  -1,
-       -1,  -1, 417,  -1,  -1,  -1,  -1, 418,  -1,  -1,
-       -1,  -1, 419,  -1,  -1,  -1,  -1,  -1,  -1, 420,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 421,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 422,  -1,  -1,
-       -1, 423,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 424,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 425,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 426, 427,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      428,  -1,  -1,  -1,  -1,  -1, 429,  -1,  -1,  -1,
-      430,  -1,  -1,  -1,  -1,  -1,  -1, 431,  -1,  -1,
+      328,  -1,  -1, 329,  -1, 330, 331,  -1,  -1,  -1,
+      332,  -1,  -1,  -1,  -1, 333, 334,  -1,  -1,  -1,
+       -1, 335, 336,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      337,  -1,  -1,  -1,  -1, 338,  -1, 339,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 340,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 341,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 342,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 343,  -1,  -1, 344,  -1,  -1,  -1,  -1,  -1,
+       -1, 345,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 346,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 347,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 348, 349,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 350,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 351,  -1,
+       -1, 352,  -1,  -1,  -1,  -1, 353,  -1,  -1,  -1,
+      354, 355,  -1,  -1,  -1, 356,  -1,  -1,  -1,  -1,
+      357,  -1,  -1, 358,  -1,  -1, 359,  -1, 360,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      361,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 362,  -1,
+       -1,  -1,  -1, 363,  -1,  -1,  -1,  -1, 364,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 365,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 366,  -1,  -1,  -1,
+       -1,  -1,  -1, 367,  -1,  -1,  -1,  -1,  -1,  -1,
+      368,  -1,  -1,  -1,  -1, 369,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 370, 371,  -1,  -1,  -1,
+       -1, 372,  -1,  -1,  -1,  -1,  -1, 373,  -1,  -1,
+      374,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 375,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 376,  -1, 377,  -1,  -1,  -1,  -1,  -1,  -1,
+      378,  -1,  -1,  -1, 379, 380,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 381,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 382,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      383, 384,  -1,  -1,  -1, 385, 386,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 387,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 388, 389,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      390,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 391,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      392,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      393,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 394,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 395,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 396,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 397,  -1,  -1,  -1,  -1,
+       -1,  -1, 398,  -1,  -1, 399,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      400,  -1,  -1,  -1,  -1, 401,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 402, 403, 404,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      405,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 406,
+       -1, 407, 408,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      409,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      410,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 411,  -1,  -1,  -1,
+      412,  -1,  -1,  -1,  -1, 413,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 414,  -1, 415,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      416,  -1,  -1,  -1,  -1, 417,  -1,  -1,  -1,  -1,
+       -1, 418,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 419,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      420,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 421,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      422,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 423,  -1, 424,  -1,  -1,
+       -1, 425,  -1,  -1,  -1, 426,  -1,  -1, 427,  -1,
+       -1,  -1,  -1,  -1,  -1, 428,  -1,  -1,  -1,  -1,
+       -1,  -1, 429,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1, 430,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 431,  -1,
       432,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 433,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 434,  -1,  -1,  -1,  -1,
+       -1, 435,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 436,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 437,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 438,  -1,  -1,  -1, 439, 440,  -1,  -1,  -1,
+       -1,  -1, 441,  -1,  -1, 442,  -1,  -1,  -1,  -1,
+       -1, 443,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 444,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 445,  -1,  -1,
+       -1,  -1,  -1, 446,  -1,  -1, 447,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 448,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      449,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 450,  -1,  -1,  -1,  -1,  -1, 451,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 452,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 453,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 454,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 455,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      433,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      434,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 435,  -1,
-       -1,  -1,  -1,  -1, 436,  -1,  -1, 437,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 438,  -1, 439,  -1,  -1,
-       -1,  -1, 440,  -1,  -1,  -1, 441, 442,  -1,  -1,
+       -1, 456,  -1,  -1,  -1,  -1, 457,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 458,  -1,  -1,  -1,  -1, 459,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 460, 461,  -1,  -1,  -1, 462, 463,  -1,  -1,
+      464,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      465,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 466,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      467, 468,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 469,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 443,  -1,  -1,  -1, 444,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 470,  -1,  -1,  -1,
+       -1,  -1, 471,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1, 445,  -1, 446,  -1,  -1,  -1,  -1,
-       -1,  -1, 447,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 472,  -1,  -1,  -1,  -1, 473,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 448,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 449, 450,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 451, 452,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 453,  -1,
-       -1,  -1,  -1,  -1,  -1, 454,  -1,  -1,  -1,  -1,
-       -1,  -1, 455,  -1,  -1,  -1,  -1, 456,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 457,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 458,  -1,  -1, 459,  -1,
-      460,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 474,  -1,  -1,  -1, 475,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 461, 462,  -1,  -1,  -1,  -1,  -1, 463,  -1,
-       -1,  -1,  -1,  -1, 464,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 465,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 476,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 466,  -1,  -1,  -1,  -1,
+       -1, 477,  -1,  -1,  -1, 478,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 467,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      468,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      469,  -1,  -1,  -1,  -1, 470,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 479, 480,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 471,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 472,  -1,  -1,  -1,
-       -1,  -1, 473,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 474,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 475,  -1, 476,  -1,
-       -1, 477,  -1,  -1,  -1,  -1, 478,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 481,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 479,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      480,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 481,  -1,  -1,
-       -1,  -1,  -1,  -1, 482,  -1, 483,  -1,  -1,  -1,
+       -1, 482,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 483,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 484,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 485,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 484,  -1,  -1,  -1,  -1, 485,  -1,  -1,  -1,
        -1, 486,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 487,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 488,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 487,  -1,  -1,  -1,  -1,
+       -1, 488,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      489,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 490,  -1,  -1,  -1,  -1,
+       -1, 491, 492,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 493,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 494,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 489,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      490,  -1,  -1,  -1,  -1,  -1, 491,  -1,  -1,  -1,
-       -1, 492, 493,  -1,  -1,  -1,  -1, 494,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 495,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 496,  -1,  -1,  -1,
-       -1,  -1, 497,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      495,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 496,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      497,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1, 498,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 499,  -1,  -1,  -1,  -1, 500,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 501,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      499, 500,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 501,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1, 502,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 503, 504,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 505,  -1,  -1,  -1,
-       -1, 506,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 507,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1591,40 +1726,120 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 503,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 504,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 505,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      506,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 507,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
       508,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      509,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      510,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 511,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 512,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 509,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 510,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 513,  -1,  -1,  -1, 514,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 511,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 512,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      513,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 514,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 515,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 516,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      517,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 515,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 516,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 517, 518,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1, 518,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1, 519,  -1,  -1,  -1,  -1,
@@ -1632,36 +1847,47 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 520,  -1, 521,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 522,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 520,  -1, 521,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1, 523,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 524,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      525,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 526,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 522,  -1,  -1,
+      527,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 528,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1, 523,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1672,11 +1898,9 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      524,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1, 525,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1687,11 +1911,10 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 529,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-      526,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1,  -1,  -1, 527,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1703,6 +1926,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 530,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1718,6 +1942,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+      531,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1729,11 +1954,11 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1, 528,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 532,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1745,13 +1970,13 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 529,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1, 533,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1759,6 +1984,7 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1, 534,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
@@ -1792,7 +2018,139 @@ findValue (register const char *str, register unsigned int len)
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
        -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
-       -1,  -1,  -1,  -1,  -1, 530
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1, 535,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,  -1,
+       -1, 536
     };
 
   if (len <= MAX_WORD_LENGTH && len >= MIN_WORD_LENGTH)
@@ -1814,7 +2172,7 @@ findValue (register const char *str, register unsigned int len)
     }
   return 0;
 }
-#line 542 "CSSValueKeywords.gperf"
+#line 548 "CSSValueKeywords.gperf"
 
 static const char * const valueList[] = {
 "",
@@ -2147,6 +2505,9 @@ static const char * const valueList[] = {
 "media-seek-forward-button", 
 "media-slider", 
 "media-sliderthumb", 
+"media-timeline-container", 
+"media-current-time-display", 
+"media-time-remaining-display", 
 "menulist", 
 "menulist-button", 
 "menulist-text", 
@@ -2168,6 +2529,7 @@ static const char * const valueList[] = {
 "border", 
 "content", 
 "padding", 
+"padding-box", 
 "border-box", 
 "content-box", 
 "logical", 
@@ -2175,6 +2537,8 @@ static const char * const valueList[] = {
 "lines", 
 "running", 
 "paused", 
+"flat", 
+"preserve-3d", 
 "ease", 
 "linear", 
 "ease-in", 
diff --git a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h
index 505c95e..8b6c669 100644
--- a/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h
+++ b/src/3rdparty/webkit/WebCore/generated/CSSValueKeywords.h
@@ -333,209 +333,215 @@ const int CSSValueMediaSeekBackButton = 326;
 const int CSSValueMediaSeekForwardButton = 327;
 const int CSSValueMediaSlider = 328;
 const int CSSValueMediaSliderthumb = 329;
-const int CSSValueMenulist = 330;
-const int CSSValueMenulistButton = 331;
-const int CSSValueMenulistText = 332;
-const int CSSValueMenulistTextfield = 333;
-const int CSSValueSliderHorizontal = 334;
-const int CSSValueSliderVertical = 335;
-const int CSSValueSliderthumbHorizontal = 336;
-const int CSSValueSliderthumbVertical = 337;
-const int CSSValueCaret = 338;
-const int CSSValueSearchfield = 339;
-const int CSSValueSearchfieldDecoration = 340;
-const int CSSValueSearchfieldResultsDecoration = 341;
-const int CSSValueSearchfieldResultsButton = 342;
-const int CSSValueSearchfieldCancelButton = 343;
-const int CSSValueTextfield = 344;
-const int CSSValueTextarea = 345;
-const int CSSValueCapsLockIndicator = 346;
-const int CSSValueRound = 347;
-const int CSSValueBorder = 348;
-const int CSSValueContent = 349;
-const int CSSValuePadding = 350;
-const int CSSValueBorderBox = 351;
-const int CSSValueContentBox = 352;
-const int CSSValueLogical = 353;
-const int CSSValueVisual = 354;
-const int CSSValueLines = 355;
-const int CSSValueRunning = 356;
-const int CSSValuePaused = 357;
-const int CSSValueEase = 358;
-const int CSSValueLinear = 359;
-const int CSSValueEaseIn = 360;
-const int CSSValueEaseOut = 361;
-const int CSSValueEaseInOut = 362;
-const int CSSValueDocument = 363;
-const int CSSValueReset = 364;
-const int CSSValueVisiblepainted = 365;
-const int CSSValueVisiblefill = 366;
-const int CSSValueVisiblestroke = 367;
-const int CSSValuePainted = 368;
-const int CSSValueFill = 369;
-const int CSSValueStroke = 370;
-const int CSSValueAliceblue = 371;
-const int CSSValueAntiquewhite = 372;
-const int CSSValueAquamarine = 373;
-const int CSSValueAzure = 374;
-const int CSSValueBeige = 375;
-const int CSSValueBisque = 376;
-const int CSSValueBlanchedalmond = 377;
-const int CSSValueBlueviolet = 378;
-const int CSSValueBrown = 379;
-const int CSSValueBurlywood = 380;
-const int CSSValueCadetblue = 381;
-const int CSSValueChartreuse = 382;
-const int CSSValueChocolate = 383;
-const int CSSValueCoral = 384;
-const int CSSValueCornflowerblue = 385;
-const int CSSValueCornsilk = 386;
-const int CSSValueCrimson = 387;
-const int CSSValueCyan = 388;
-const int CSSValueDarkblue = 389;
-const int CSSValueDarkcyan = 390;
-const int CSSValueDarkgoldenrod = 391;
-const int CSSValueDarkgray = 392;
-const int CSSValueDarkgreen = 393;
-const int CSSValueDarkgrey = 394;
-const int CSSValueDarkkhaki = 395;
-const int CSSValueDarkmagenta = 396;
-const int CSSValueDarkolivegreen = 397;
-const int CSSValueDarkorange = 398;
-const int CSSValueDarkorchid = 399;
-const int CSSValueDarkred = 400;
-const int CSSValueDarksalmon = 401;
-const int CSSValueDarkseagreen = 402;
-const int CSSValueDarkslateblue = 403;
-const int CSSValueDarkslategray = 404;
-const int CSSValueDarkslategrey = 405;
-const int CSSValueDarkturquoise = 406;
-const int CSSValueDarkviolet = 407;
-const int CSSValueDeeppink = 408;
-const int CSSValueDeepskyblue = 409;
-const int CSSValueDimgray = 410;
-const int CSSValueDimgrey = 411;
-const int CSSValueDodgerblue = 412;
-const int CSSValueFirebrick = 413;
-const int CSSValueFloralwhite = 414;
-const int CSSValueForestgreen = 415;
-const int CSSValueGainsboro = 416;
-const int CSSValueGhostwhite = 417;
-const int CSSValueGold = 418;
-const int CSSValueGoldenrod = 419;
-const int CSSValueGreenyellow = 420;
-const int CSSValueHoneydew = 421;
-const int CSSValueHotpink = 422;
-const int CSSValueIndianred = 423;
-const int CSSValueIndigo = 424;
-const int CSSValueIvory = 425;
-const int CSSValueKhaki = 426;
-const int CSSValueLavender = 427;
-const int CSSValueLavenderblush = 428;
-const int CSSValueLawngreen = 429;
-const int CSSValueLemonchiffon = 430;
-const int CSSValueLightblue = 431;
-const int CSSValueLightcoral = 432;
-const int CSSValueLightcyan = 433;
-const int CSSValueLightgoldenrodyellow = 434;
-const int CSSValueLightgray = 435;
-const int CSSValueLightgreen = 436;
-const int CSSValueLightgrey = 437;
-const int CSSValueLightpink = 438;
-const int CSSValueLightsalmon = 439;
-const int CSSValueLightseagreen = 440;
-const int CSSValueLightskyblue = 441;
-const int CSSValueLightslategray = 442;
-const int CSSValueLightslategrey = 443;
-const int CSSValueLightsteelblue = 444;
-const int CSSValueLightyellow = 445;
-const int CSSValueLimegreen = 446;
-const int CSSValueLinen = 447;
-const int CSSValueMagenta = 448;
-const int CSSValueMediumaquamarine = 449;
-const int CSSValueMediumblue = 450;
-const int CSSValueMediumorchid = 451;
-const int CSSValueMediumpurple = 452;
-const int CSSValueMediumseagreen = 453;
-const int CSSValueMediumslateblue = 454;
-const int CSSValueMediumspringgreen = 455;
-const int CSSValueMediumturquoise = 456;
-const int CSSValueMediumvioletred = 457;
-const int CSSValueMidnightblue = 458;
-const int CSSValueMintcream = 459;
-const int CSSValueMistyrose = 460;
-const int CSSValueMoccasin = 461;
-const int CSSValueNavajowhite = 462;
-const int CSSValueOldlace = 463;
-const int CSSValueOlivedrab = 464;
-const int CSSValueOrangered = 465;
-const int CSSValueOrchid = 466;
-const int CSSValuePalegoldenrod = 467;
-const int CSSValuePalegreen = 468;
-const int CSSValuePaleturquoise = 469;
-const int CSSValuePalevioletred = 470;
-const int CSSValuePapayawhip = 471;
-const int CSSValuePeachpuff = 472;
-const int CSSValuePeru = 473;
-const int CSSValuePink = 474;
-const int CSSValuePlum = 475;
-const int CSSValuePowderblue = 476;
-const int CSSValueRosybrown = 477;
-const int CSSValueRoyalblue = 478;
-const int CSSValueSaddlebrown = 479;
-const int CSSValueSalmon = 480;
-const int CSSValueSandybrown = 481;
-const int CSSValueSeagreen = 482;
-const int CSSValueSeashell = 483;
-const int CSSValueSienna = 484;
-const int CSSValueSkyblue = 485;
-const int CSSValueSlateblue = 486;
-const int CSSValueSlategray = 487;
-const int CSSValueSlategrey = 488;
-const int CSSValueSnow = 489;
-const int CSSValueSpringgreen = 490;
-const int CSSValueSteelblue = 491;
-const int CSSValueTan = 492;
-const int CSSValueThistle = 493;
-const int CSSValueTomato = 494;
-const int CSSValueTurquoise = 495;
-const int CSSValueViolet = 496;
-const int CSSValueWheat = 497;
-const int CSSValueWhitesmoke = 498;
-const int CSSValueYellowgreen = 499;
-const int CSSValueNonzero = 500;
-const int CSSValueEvenodd = 501;
-const int CSSValueAccumulate = 502;
-const int CSSValueNew = 503;
-const int CSSValueSrgb = 504;
-const int CSSValueLinearrgb = 505;
-const int CSSValueOptimizespeed = 506;
-const int CSSValueOptimizequality = 507;
-const int CSSValueCrispedges = 508;
-const int CSSValueGeometricprecision = 509;
-const int CSSValueButt = 510;
-const int CSSValueMiter = 511;
-const int CSSValueBevel = 512;
-const int CSSValueOptimizelegibility = 513;
-const int CSSValueBeforeEdge = 514;
-const int CSSValueAfterEdge = 515;
-const int CSSValueCentral = 516;
-const int CSSValueTextBeforeEdge = 517;
-const int CSSValueTextAfterEdge = 518;
-const int CSSValueIdeographic = 519;
-const int CSSValueAlphabetic = 520;
-const int CSSValueHanging = 521;
-const int CSSValueMathematical = 522;
-const int CSSValueUseScript = 523;
-const int CSSValueNoChange = 524;
-const int CSSValueResetSize = 525;
-const int CSSValueLrTb = 526;
-const int CSSValueRlTb = 527;
-const int CSSValueTbRl = 528;
-const int CSSValueLr = 529;
-const int CSSValueRl = 530;
-const int CSSValueTb = 531;
-const int numCSSValueKeywords = 532;
+const int CSSValueMediaTimelineContainer = 330;
+const int CSSValueMediaCurrentTimeDisplay = 331;
+const int CSSValueMediaTimeRemainingDisplay = 332;
+const int CSSValueMenulist = 333;
+const int CSSValueMenulistButton = 334;
+const int CSSValueMenulistText = 335;
+const int CSSValueMenulistTextfield = 336;
+const int CSSValueSliderHorizontal = 337;
+const int CSSValueSliderVertical = 338;
+const int CSSValueSliderthumbHorizontal = 339;
+const int CSSValueSliderthumbVertical = 340;
+const int CSSValueCaret = 341;
+const int CSSValueSearchfield = 342;
+const int CSSValueSearchfieldDecoration = 343;
+const int CSSValueSearchfieldResultsDecoration = 344;
+const int CSSValueSearchfieldResultsButton = 345;
+const int CSSValueSearchfieldCancelButton = 346;
+const int CSSValueTextfield = 347;
+const int CSSValueTextarea = 348;
+const int CSSValueCapsLockIndicator = 349;
+const int CSSValueRound = 350;
+const int CSSValueBorder = 351;
+const int CSSValueContent = 352;
+const int CSSValuePadding = 353;
+const int CSSValuePaddingBox = 354;
+const int CSSValueBorderBox = 355;
+const int CSSValueContentBox = 356;
+const int CSSValueLogical = 357;
+const int CSSValueVisual = 358;
+const int CSSValueLines = 359;
+const int CSSValueRunning = 360;
+const int CSSValuePaused = 361;
+const int CSSValueFlat = 362;
+const int CSSValuePreserve3d = 363;
+const int CSSValueEase = 364;
+const int CSSValueLinear = 365;
+const int CSSValueEaseIn = 366;
+const int CSSValueEaseOut = 367;
+const int CSSValueEaseInOut = 368;
+const int CSSValueDocument = 369;
+const int CSSValueReset = 370;
+const int CSSValueVisiblepainted = 371;
+const int CSSValueVisiblefill = 372;
+const int CSSValueVisiblestroke = 373;
+const int CSSValuePainted = 374;
+const int CSSValueFill = 375;
+const int CSSValueStroke = 376;
+const int CSSValueAliceblue = 377;
+const int CSSValueAntiquewhite = 378;
+const int CSSValueAquamarine = 379;
+const int CSSValueAzure = 380;
+const int CSSValueBeige = 381;
+const int CSSValueBisque = 382;
+const int CSSValueBlanchedalmond = 383;
+const int CSSValueBlueviolet = 384;
+const int CSSValueBrown = 385;
+const int CSSValueBurlywood = 386;
+const int CSSValueCadetblue = 387;
+const int CSSValueChartreuse = 388;
+const int CSSValueChocolate = 389;
+const int CSSValueCoral = 390;
+const int CSSValueCornflowerblue = 391;
+const int CSSValueCornsilk = 392;
+const int CSSValueCrimson = 393;
+const int CSSValueCyan = 394;
+const int CSSValueDarkblue = 395;
+const int CSSValueDarkcyan = 396;
+const int CSSValueDarkgoldenrod = 397;
+const int CSSValueDarkgray = 398;
+const int CSSValueDarkgreen = 399;
+const int CSSValueDarkgrey = 400;
+const int CSSValueDarkkhaki = 401;
+const int CSSValueDarkmagenta = 402;
+const int CSSValueDarkolivegreen = 403;
+const int CSSValueDarkorange = 404;
+const int CSSValueDarkorchid = 405;
+const int CSSValueDarkred = 406;
+const int CSSValueDarksalmon = 407;
+const int CSSValueDarkseagreen = 408;
+const int CSSValueDarkslateblue = 409;
+const int CSSValueDarkslategray = 410;
+const int CSSValueDarkslategrey = 411;
+const int CSSValueDarkturquoise = 412;
+const int CSSValueDarkviolet = 413;
+const int CSSValueDeeppink = 414;
+const int CSSValueDeepskyblue = 415;
+const int CSSValueDimgray = 416;
+const int CSSValueDimgrey = 417;
+const int CSSValueDodgerblue = 418;
+const int CSSValueFirebrick = 419;
+const int CSSValueFloralwhite = 420;
+const int CSSValueForestgreen = 421;
+const int CSSValueGainsboro = 422;
+const int CSSValueGhostwhite = 423;
+const int CSSValueGold = 424;
+const int CSSValueGoldenrod = 425;
+const int CSSValueGreenyellow = 426;
+const int CSSValueHoneydew = 427;
+const int CSSValueHotpink = 428;
+const int CSSValueIndianred = 429;
+const int CSSValueIndigo = 430;
+const int CSSValueIvory = 431;
+const int CSSValueKhaki = 432;
+const int CSSValueLavender = 433;
+const int CSSValueLavenderblush = 434;
+const int CSSValueLawngreen = 435;
+const int CSSValueLemonchiffon = 436;
+const int CSSValueLightblue = 437;
+const int CSSValueLightcoral = 438;
+const int CSSValueLightcyan = 439;
+const int CSSValueLightgoldenrodyellow = 440;
+const int CSSValueLightgray = 441;
+const int CSSValueLightgreen = 442;
+const int CSSValueLightgrey = 443;
+const int CSSValueLightpink = 444;
+const int CSSValueLightsalmon = 445;
+const int CSSValueLightseagreen = 446;
+const int CSSValueLightskyblue = 447;
+const int CSSValueLightslategray = 448;
+const int CSSValueLightslategrey = 449;
+const int CSSValueLightsteelblue = 450;
+const int CSSValueLightyellow = 451;
+const int CSSValueLimegreen = 452;
+const int CSSValueLinen = 453;
+const int CSSValueMagenta = 454;
+const int CSSValueMediumaquamarine = 455;
+const int CSSValueMediumblue = 456;
+const int CSSValueMediumorchid = 457;
+const int CSSValueMediumpurple = 458;
+const int CSSValueMediumseagreen = 459;
+const int CSSValueMediumslateblue = 460;
+const int CSSValueMediumspringgreen = 461;
+const int CSSValueMediumturquoise = 462;
+const int CSSValueMediumvioletred = 463;
+const int CSSValueMidnightblue = 464;
+const int CSSValueMintcream = 465;
+const int CSSValueMistyrose = 466;
+const int CSSValueMoccasin = 467;
+const int CSSValueNavajowhite = 468;
+const int CSSValueOldlace = 469;
+const int CSSValueOlivedrab = 470;
+const int CSSValueOrangered = 471;
+const int CSSValueOrchid = 472;
+const int CSSValuePalegoldenrod = 473;
+const int CSSValuePalegreen = 474;
+const int CSSValuePaleturquoise = 475;
+const int CSSValuePalevioletred = 476;
+const int CSSValuePapayawhip = 477;
+const int CSSValuePeachpuff = 478;
+const int CSSValuePeru = 479;
+const int CSSValuePink = 480;
+const int CSSValuePlum = 481;
+const int CSSValuePowderblue = 482;
+const int CSSValueRosybrown = 483;
+const int CSSValueRoyalblue = 484;
+const int CSSValueSaddlebrown = 485;
+const int CSSValueSalmon = 486;
+const int CSSValueSandybrown = 487;
+const int CSSValueSeagreen = 488;
+const int CSSValueSeashell = 489;
+const int CSSValueSienna = 490;
+const int CSSValueSkyblue = 491;
+const int CSSValueSlateblue = 492;
+const int CSSValueSlategray = 493;
+const int CSSValueSlategrey = 494;
+const int CSSValueSnow = 495;
+const int CSSValueSpringgreen = 496;
+const int CSSValueSteelblue = 497;
+const int CSSValueTan = 498;
+const int CSSValueThistle = 499;
+const int CSSValueTomato = 500;
+const int CSSValueTurquoise = 501;
+const int CSSValueViolet = 502;
+const int CSSValueWheat = 503;
+const int CSSValueWhitesmoke = 504;
+const int CSSValueYellowgreen = 505;
+const int CSSValueNonzero = 506;
+const int CSSValueEvenodd = 507;
+const int CSSValueAccumulate = 508;
+const int CSSValueNew = 509;
+const int CSSValueSrgb = 510;
+const int CSSValueLinearrgb = 511;
+const int CSSValueOptimizespeed = 512;
+const int CSSValueOptimizequality = 513;
+const int CSSValueCrispedges = 514;
+const int CSSValueGeometricprecision = 515;
+const int CSSValueButt = 516;
+const int CSSValueMiter = 517;
+const int CSSValueBevel = 518;
+const int CSSValueOptimizelegibility = 519;
+const int CSSValueBeforeEdge = 520;
+const int CSSValueAfterEdge = 521;
+const int CSSValueCentral = 522;
+const int CSSValueTextBeforeEdge = 523;
+const int CSSValueTextAfterEdge = 524;
+const int CSSValueIdeographic = 525;
+const int CSSValueAlphabetic = 526;
+const int CSSValueHanging = 527;
+const int CSSValueMathematical = 528;
+const int CSSValueUseScript = 529;
+const int CSSValueNoChange = 530;
+const int CSSValueResetSize = 531;
+const int CSSValueLrTb = 532;
+const int CSSValueRlTb = 533;
+const int CSSValueTbRl = 534;
+const int CSSValueLr = 535;
+const int CSSValueRl = 536;
+const int CSSValueTb = 537;
+const int numCSSValueKeywords = 538;
 const size_t maxCSSValueKeywordLength = 30;
 
 const char* getValueName(unsigned short id);
diff --git a/src/3rdparty/webkit/WebCore/generated/DatePrototype.lut.h b/src/3rdparty/webkit/WebCore/generated/DatePrototype.lut.h
index 5138355..3016f9e 100644
--- a/src/3rdparty/webkit/WebCore/generated/DatePrototype.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/DatePrototype.lut.h
@@ -4,15 +4,16 @@
 
 namespace JSC {
 
-static const struct HashTableValue dateTableValues[45] = {
+static const struct HashTableValue dateTableValues[47] = {
    { "toString", DontEnum|Function, (intptr_t)dateProtoFuncToString, (intptr_t)0 },
+   { "toISOString", DontEnum|Function, (intptr_t)dateProtoFuncToISOString, (intptr_t)0 },
    { "toUTCString", DontEnum|Function, (intptr_t)dateProtoFuncToUTCString, (intptr_t)0 },
    { "toDateString", DontEnum|Function, (intptr_t)dateProtoFuncToDateString, (intptr_t)0 },
    { "toTimeString", DontEnum|Function, (intptr_t)dateProtoFuncToTimeString, (intptr_t)0 },
    { "toLocaleString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleString, (intptr_t)0 },
    { "toLocaleDateString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleDateString, (intptr_t)0 },
    { "toLocaleTimeString", DontEnum|Function, (intptr_t)dateProtoFuncToLocaleTimeString, (intptr_t)0 },
-   { "valueOf", DontEnum|Function, (intptr_t)dateProtoFuncValueOf, (intptr_t)0 },
+   { "valueOf", DontEnum|Function, (intptr_t)dateProtoFuncGetTime, (intptr_t)0 },
    { "getTime", DontEnum|Function, (intptr_t)dateProtoFuncGetTime, (intptr_t)0 },
    { "getFullYear", DontEnum|Function, (intptr_t)dateProtoFuncGetFullYear, (intptr_t)0 },
    { "getUTCFullYear", DontEnum|Function, (intptr_t)dateProtoFuncGetUTCFullYear, (intptr_t)0 },
@@ -49,14 +50,10 @@ static const struct HashTableValue dateTableValues[45] = {
    { "setUTCFullYear", DontEnum|Function, (intptr_t)dateProtoFuncSetUTCFullYear, (intptr_t)3 },
    { "setYear", DontEnum|Function, (intptr_t)dateProtoFuncSetYear, (intptr_t)1 },
    { "getYear", DontEnum|Function, (intptr_t)dateProtoFuncGetYear, (intptr_t)0 },
+   { "toJSON", DontEnum|Function, (intptr_t)dateProtoFuncToJSON, (intptr_t)0 },
    { 0, 0, 0, 0 }
 };
 
 extern const struct HashTable dateTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 2047, dateTableValues, 0 };
-#else
     { 134, 127, dateTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/Grammar.cpp b/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
index 6f09be8..4ad3078 100644
--- a/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/Grammar.cpp
@@ -238,7 +238,7 @@
 #include <stdlib.h>
 #include "JSValue.h"
 #include "JSObject.h"
-#include "Nodes.h"
+#include "NodeConstructors.h"
 #include "Lexer.h"
 #include "JSString.h"
 #include "JSGlobalData.h"
@@ -289,7 +289,7 @@ static ExpressionNode* makeSubNode(void*, ExpressionNode*, ExpressionNode*, bool
 static ExpressionNode* makeLeftShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
 static ExpressionNode* makeRightShiftNode(void*, ExpressionNode*, ExpressionNode*, bool rightHasAssignments);
 static StatementNode* makeVarStatementNode(void*, ExpressionNode*);
-static ExpressionNode* combineVarInitializers(void*, ExpressionNode* list, AssignResolveNode* init);
+static ExpressionNode* combineCommaNodes(void*, ExpressionNode* list, ExpressionNode* init);
 
 #if COMPILER(MSVC)
 
@@ -308,24 +308,24 @@ static ExpressionNode* combineVarInitializers(void*, ExpressionNode* list, Assig
 #define YYPARSE_PARAM globalPtr
 #define YYLEX_PARAM globalPtr
 
-template <typename T> NodeDeclarationInfo<T> createNodeDeclarationInfo(T node, ParserRefCountedData<DeclarationStacks::VarStack>* varDecls, 
-                                                                       ParserRefCountedData<DeclarationStacks::FunctionStack>* funcDecls,
+template <typename T> NodeDeclarationInfo<T> createNodeDeclarationInfo(T node, ParserArenaData<DeclarationStacks::VarStack>* varDecls, 
+                                                                       ParserArenaData<DeclarationStacks::FunctionStack>* funcDecls,
                                                                        CodeFeatures info,
                                                                        int numConstants) 
 {
     ASSERT((info & ~AllFeatures) == 0);
-    NodeDeclarationInfo<T> result = {node, varDecls, funcDecls, info, numConstants};
+    NodeDeclarationInfo<T> result = { node, varDecls, funcDecls, info, numConstants };
     return result;
 }
 
 template <typename T> NodeInfo<T> createNodeInfo(T node, CodeFeatures info, int numConstants)
 {
     ASSERT((info & ~AllFeatures) == 0);
-    NodeInfo<T> result = {node, info, numConstants};
+    NodeInfo<T> result = { node, info, numConstants };
     return result;
 }
 
-template <typename T> T mergeDeclarationLists(T decls1, T decls2) 
+template <typename T> inline T mergeDeclarationLists(T decls1, T decls2) 
 {
     // decls1 or both are null
     if (!decls1)
@@ -337,28 +337,28 @@ template <typename T> T mergeDeclarationLists(T decls1, T decls2)
     // Both are non-null
     decls1->data.append(decls2->data);
     
-    // We manually release the declaration lists to avoid accumulating many many
-    // unused heap allocated vectors
-    decls2->ref();
-    decls2->deref();
+    // Manually release as much as possible from the now-defunct declaration lists
+    // to avoid accumulating so many unused heap allocated vectors.
+    decls2->data.clear();
+
     return decls1;
 }
 
-static void appendToVarDeclarationList(void* globalPtr, ParserRefCountedData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
+static void appendToVarDeclarationList(void* globalPtr, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
 {
     if (!varDecls)
-        varDecls = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+        varDecls = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
 
     varDecls->data.append(make_pair(ident, attrs));
 
 }
 
-static inline void appendToVarDeclarationList(void* globalPtr, ParserRefCountedData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
+static inline void appendToVarDeclarationList(void* globalPtr, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
 {
     unsigned attrs = DeclarationStacks::IsConstant;
-    if (decl->m_init)
+    if (decl->hasInitializer())
         attrs |= DeclarationStacks::HasInitializer;        
-    appendToVarDeclarationList(globalPtr, varDecls, decl->m_ident, attrs);
+    appendToVarDeclarationList(globalPtr, varDecls, decl->ident(), attrs);
 }
 
 
@@ -416,7 +416,7 @@ typedef union YYSTYPE
     Operator            op;
 }
 /* Line 187 of yacc.c.  */
-#line 420 "Grammar.tab.c"
+#line 420 "WebCore/tmp/../generated/Grammar.tab.c"
 	YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
@@ -441,7 +441,7 @@ typedef struct YYLTYPE
 
 
 /* Line 216 of yacc.c.  */
-#line 445 "Grammar.tab.c"
+#line 445 "WebCore/tmp/../generated/Grammar.tab.c"
 
 #ifdef short
 # undef short
@@ -1019,42 +1019,42 @@ static const yytype_uint16 yyrline[] =
      804,   805,   806,   807,   808,   809,   810,   811,   815,   817,
      822,   824,   830,   837,   846,   854,   867,   874,   883,   891,
      904,   906,   912,   920,   932,   933,   937,   941,   945,   949,
-     951,   956,   959,   968,   970,   972,   974,   980,   987,   996,
-    1002,  1013,  1014,  1018,  1019,  1023,  1027,  1031,  1035,  1042,
-    1045,  1048,  1051,  1057,  1060,  1063,  1066,  1072,  1078,  1084,
-    1085,  1094,  1095,  1099,  1105,  1115,  1116,  1120,  1121,  1125,
-    1131,  1135,  1142,  1148,  1154,  1164,  1166,  1171,  1172,  1183,
-    1184,  1191,  1192,  1202,  1205,  1211,  1212,  1216,  1217,  1222,
-    1229,  1240,  1241,  1242,  1243,  1244,  1245,  1246,  1250,  1251,
-    1252,  1253,  1254,  1258,  1259,  1263,  1264,  1265,  1267,  1271,
-    1272,  1273,  1274,  1275,  1279,  1280,  1281,  1285,  1286,  1289,
-    1291,  1295,  1296,  1300,  1301,  1302,  1303,  1304,  1308,  1309,
-    1310,  1311,  1315,  1316,  1320,  1321,  1325,  1326,  1327,  1328,
-    1332,  1333,  1334,  1335,  1339,  1340,  1344,  1345,  1349,  1350,
-    1354,  1355,  1359,  1360,  1361,  1365,  1366,  1367,  1371,  1372,
-    1373,  1374,  1375,  1376,  1377,  1378,  1379,  1380,  1381,  1384,
-    1385,  1389,  1390,  1394,  1395,  1396,  1397,  1401,  1402,  1403,
-    1404,  1408,  1409,  1410,  1414,  1415,  1416,  1420,  1421,  1422,
-    1423,  1427,  1428,  1429,  1430,  1434,  1435,  1436,  1437,  1438,
-    1439,  1440,  1444,  1445,  1446,  1447,  1448,  1449,  1453,  1454,
-    1455,  1456,  1457,  1458,  1459,  1463,  1464,  1465,  1466,  1467,
-    1471,  1472,  1473,  1474,  1475,  1479,  1480,  1481,  1482,  1483,
-    1487,  1488,  1492,  1493,  1497,  1498,  1502,  1503,  1507,  1508,
-    1512,  1513,  1517,  1518,  1522,  1523,  1527,  1528,  1532,  1533,
-    1537,  1538,  1542,  1543,  1547,  1548,  1552,  1553,  1557,  1558,
-    1562,  1563,  1567,  1568,  1572,  1573,  1577,  1578,  1582,  1583,
-    1587,  1588,  1592,  1593,  1594,  1595,  1596,  1597,  1598,  1599,
-    1600,  1601,  1602,  1603,  1607,  1608,  1612,  1613,  1617,  1618,
-    1622,  1623,  1624,  1625,  1626,  1627,  1628,  1629,  1630,  1631,
-    1632,  1633,  1634,  1635,  1636,  1637,  1638,  1642,  1643,  1647,
-    1648,  1652,  1653,  1654,  1655,  1659,  1660,  1661,  1662,  1666,
-    1667,  1671,  1672,  1676,  1677,  1681,  1685,  1689,  1693,  1694,
-    1698,  1699,  1703,  1704,  1705,  1706,  1707,  1708,  1709,  1710,
-    1713,  1715,  1718,  1720,  1724,  1725,  1726,  1727,  1731,  1732,
-    1733,  1734,  1738,  1739,  1740,  1741,  1745,  1749,  1753,  1754,
-    1757,  1759,  1763,  1764,  1768,  1769,  1773,  1774,  1778,  1782,
-    1783,  1787,  1788,  1789,  1793,  1794,  1798,  1799,  1803,  1804,
-    1805,  1806,  1810,  1811,  1814,  1816,  1820,  1821
+     951,   956,   959,   969,   971,   973,   975,   981,   988,   997,
+    1003,  1014,  1015,  1019,  1020,  1024,  1028,  1032,  1036,  1043,
+    1046,  1049,  1052,  1058,  1061,  1064,  1067,  1073,  1079,  1085,
+    1086,  1095,  1096,  1100,  1106,  1116,  1117,  1121,  1122,  1126,
+    1132,  1136,  1143,  1149,  1155,  1165,  1167,  1172,  1173,  1184,
+    1185,  1192,  1193,  1203,  1206,  1212,  1213,  1217,  1218,  1223,
+    1230,  1241,  1242,  1243,  1244,  1245,  1246,  1247,  1251,  1252,
+    1253,  1254,  1255,  1259,  1260,  1264,  1265,  1266,  1268,  1272,
+    1273,  1274,  1275,  1276,  1280,  1281,  1282,  1286,  1287,  1290,
+    1292,  1296,  1297,  1301,  1302,  1303,  1304,  1305,  1309,  1310,
+    1311,  1312,  1316,  1317,  1321,  1322,  1326,  1327,  1328,  1329,
+    1333,  1334,  1335,  1336,  1340,  1341,  1345,  1346,  1350,  1351,
+    1355,  1356,  1360,  1361,  1362,  1366,  1367,  1368,  1372,  1373,
+    1374,  1375,  1376,  1377,  1378,  1379,  1380,  1381,  1382,  1385,
+    1386,  1390,  1391,  1395,  1396,  1397,  1398,  1402,  1403,  1404,
+    1405,  1409,  1410,  1411,  1415,  1416,  1417,  1421,  1422,  1423,
+    1424,  1428,  1429,  1430,  1431,  1435,  1436,  1437,  1438,  1439,
+    1440,  1441,  1445,  1446,  1447,  1448,  1449,  1450,  1454,  1455,
+    1456,  1457,  1458,  1459,  1460,  1464,  1465,  1466,  1467,  1468,
+    1472,  1473,  1474,  1475,  1476,  1480,  1481,  1482,  1483,  1484,
+    1488,  1489,  1493,  1494,  1498,  1499,  1503,  1504,  1508,  1509,
+    1513,  1514,  1518,  1519,  1523,  1524,  1528,  1529,  1533,  1534,
+    1538,  1539,  1543,  1544,  1548,  1549,  1553,  1554,  1558,  1559,
+    1563,  1564,  1568,  1569,  1573,  1574,  1578,  1579,  1583,  1584,
+    1588,  1589,  1593,  1594,  1595,  1596,  1597,  1598,  1599,  1600,
+    1601,  1602,  1603,  1604,  1608,  1609,  1613,  1614,  1618,  1619,
+    1623,  1624,  1625,  1626,  1627,  1628,  1629,  1630,  1631,  1632,
+    1633,  1634,  1635,  1636,  1637,  1638,  1639,  1643,  1644,  1648,
+    1649,  1653,  1654,  1655,  1656,  1660,  1661,  1662,  1663,  1667,
+    1668,  1672,  1673,  1677,  1678,  1682,  1686,  1690,  1694,  1695,
+    1699,  1700,  1704,  1705,  1706,  1707,  1708,  1709,  1710,  1711,
+    1714,  1716,  1719,  1721,  1725,  1726,  1727,  1728,  1732,  1733,
+    1734,  1735,  1739,  1740,  1741,  1742,  1746,  1750,  1754,  1755,
+    1758,  1760,  1764,  1765,  1769,  1770,  1774,  1775,  1779,  1783,
+    1784,  1788,  1789,  1790,  1794,  1795,  1799,  1800,  1804,  1805,
+    1806,  1807,  1811,  1812,  1815,  1817,  1821,  1822
 };
 #endif
 
@@ -3009,17 +3009,17 @@ yyreduce:
     {
         case 2:
 #line 290 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NullNode(GLOBAL_DATA), 0, 1); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NullNode(GLOBAL_DATA), 0, 1); ;}
     break;
 
   case 3:
 #line 291 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BooleanNode(GLOBAL_DATA, true), 0, 1); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, true), 0, 1); ;}
     break;
 
   case 4:
 #line 292 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BooleanNode(GLOBAL_DATA, false), 0, 1); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, false), 0, 1); ;}
     break;
 
   case 5:
@@ -3029,7 +3029,7 @@ yyreduce:
 
   case 6:
 #line 294 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new StringNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident)), 0, 1); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StringNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident)), 0, 1); ;}
     break;
 
   case 7:
@@ -3038,7 +3038,7 @@ yyreduce:
                                             Lexer& l = *LEXER;
                                             if (!l.scanRegExp())
                                                 YYABORT;
-                                            RegExpNode* node = new RegExpNode(GLOBAL_DATA, l.pattern(), l.flags());
+                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, l.pattern(), l.flags());
                                             int size = l.pattern().size() + 2; // + 2 for the two /'s
                                             SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (1)]).first_column, (yylsp[(1) - (1)]).first_column + size, (yylsp[(1) - (1)]).first_column + size);
                                             (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, 0, 0);
@@ -3051,7 +3051,7 @@ yyreduce:
                                             Lexer& l = *LEXER;
                                             if (!l.scanRegExp())
                                                 YYABORT;
-                                            RegExpNode* node = new RegExpNode(GLOBAL_DATA, "=" + l.pattern(), l.flags());
+                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, "=" + l.pattern(), l.flags());
                                             int size = l.pattern().size() + 2; // + 2 for the two /'s
                                             SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (1)]).first_column, (yylsp[(1) - (1)]).first_column + size, (yylsp[(1) - (1)]).first_column + size);
                                             (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, 0, 0);
@@ -3060,17 +3060,17 @@ yyreduce:
 
   case 9:
 #line 316 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 10:
 #line 317 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 11:
 #line 318 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new PropertyNode(GLOBAL_DATA, Identifier(GLOBAL_DATA, UString::from((yyvsp[(1) - (3)].doubleValue))), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.propertyNode) = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, Identifier(GLOBAL_DATA, UString::from((yyvsp[(1) - (3)].doubleValue))), (yyvsp[(3) - (3)].expressionNode).m_node, PropertyNode::Constant), (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 12:
@@ -3092,7 +3092,7 @@ yyreduce:
 
   case 14:
 #line 332 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.propertyList).m_node.head = new PropertyListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].propertyNode).m_node); 
+    { (yyval.propertyList).m_node.head = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].propertyNode).m_node); 
                                           (yyval.propertyList).m_node.tail = (yyval.propertyList).m_node.head;
                                           (yyval.propertyList).m_features = (yyvsp[(1) - (1)].propertyNode).m_features;
                                           (yyval.propertyList).m_numConstants = (yyvsp[(1) - (1)].propertyNode).m_numConstants; ;}
@@ -3101,34 +3101,34 @@ yyreduce:
   case 15:
 #line 336 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.propertyList).m_node.head = (yyvsp[(1) - (3)].propertyList).m_node.head;
-                                          (yyval.propertyList).m_node.tail = new PropertyListNode(GLOBAL_DATA, (yyvsp[(3) - (3)].propertyNode).m_node, (yyvsp[(1) - (3)].propertyList).m_node.tail);
+                                          (yyval.propertyList).m_node.tail = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, (yyvsp[(3) - (3)].propertyNode).m_node, (yyvsp[(1) - (3)].propertyList).m_node.tail);
                                           (yyval.propertyList).m_features = (yyvsp[(1) - (3)].propertyList).m_features | (yyvsp[(3) - (3)].propertyNode).m_features;
                                           (yyval.propertyList).m_numConstants = (yyvsp[(1) - (3)].propertyList).m_numConstants + (yyvsp[(3) - (3)].propertyNode).m_numConstants; ;}
     break;
 
   case 17:
 #line 344 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ObjectLiteralNode(GLOBAL_DATA), 0, 0); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA), 0, 0); ;}
     break;
 
   case 18:
 #line 345 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (3)].propertyList).m_node.head), (yyvsp[(2) - (3)].propertyList).m_features, (yyvsp[(2) - (3)].propertyList).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (3)].propertyList).m_node.head), (yyvsp[(2) - (3)].propertyList).m_features, (yyvsp[(2) - (3)].propertyList).m_numConstants); ;}
     break;
 
   case 19:
 #line 347 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (4)].propertyList).m_node.head), (yyvsp[(2) - (4)].propertyList).m_features, (yyvsp[(2) - (4)].propertyList).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, (yyvsp[(2) - (4)].propertyList).m_node.head), (yyvsp[(2) - (4)].propertyList).m_features, (yyvsp[(2) - (4)].propertyList).m_numConstants); ;}
     break;
 
   case 20:
 #line 351 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ThisNode(GLOBAL_DATA), ThisFeature, 0); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ThisNode(GLOBAL_DATA), ThisFeature, 0); ;}
     break;
 
   case 23:
 #line 354 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), (yylsp[(1) - (1)]).first_column), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), (yylsp[(1) - (1)]).first_column), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
     break;
 
   case 24:
@@ -3138,22 +3138,22 @@ yyreduce:
 
   case 25:
 #line 359 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].intValue)), 0, (yyvsp[(2) - (3)].intValue) ? 1 : 0); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].intValue)), 0, (yyvsp[(2) - (3)].intValue) ? 1 : 0); ;}
     break;
 
   case 26:
 #line 360 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].elementList).m_node.head), (yyvsp[(2) - (3)].elementList).m_features, (yyvsp[(2) - (3)].elementList).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(2) - (3)].elementList).m_node.head), (yyvsp[(2) - (3)].elementList).m_features, (yyvsp[(2) - (3)].elementList).m_numConstants); ;}
     break;
 
   case 27:
 #line 361 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ArrayNode(GLOBAL_DATA, (yyvsp[(4) - (5)].intValue), (yyvsp[(2) - (5)].elementList).m_node.head), (yyvsp[(2) - (5)].elementList).m_features, (yyvsp[(4) - (5)].intValue) ? (yyvsp[(2) - (5)].elementList).m_numConstants + 1 : (yyvsp[(2) - (5)].elementList).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, (yyvsp[(4) - (5)].intValue), (yyvsp[(2) - (5)].elementList).m_node.head), (yyvsp[(2) - (5)].elementList).m_features, (yyvsp[(4) - (5)].intValue) ? (yyvsp[(2) - (5)].elementList).m_numConstants + 1 : (yyvsp[(2) - (5)].elementList).m_numConstants); ;}
     break;
 
   case 28:
 #line 365 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.elementList).m_node.head = new ElementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].intValue), (yyvsp[(2) - (2)].expressionNode).m_node);
+    { (yyval.elementList).m_node.head = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].intValue), (yyvsp[(2) - (2)].expressionNode).m_node);
                                           (yyval.elementList).m_node.tail = (yyval.elementList).m_node.head;
                                           (yyval.elementList).m_features = (yyvsp[(2) - (2)].expressionNode).m_features;
                                           (yyval.elementList).m_numConstants = (yyvsp[(2) - (2)].expressionNode).m_numConstants; ;}
@@ -3162,7 +3162,7 @@ yyreduce:
   case 29:
 #line 370 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.elementList).m_node.head = (yyvsp[(1) - (4)].elementList).m_node.head;
-                                          (yyval.elementList).m_node.tail = new ElementNode(GLOBAL_DATA, (yyvsp[(1) - (4)].elementList).m_node.tail, (yyvsp[(3) - (4)].intValue), (yyvsp[(4) - (4)].expressionNode).m_node);
+                                          (yyval.elementList).m_node.tail = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, (yyvsp[(1) - (4)].elementList).m_node.tail, (yyvsp[(3) - (4)].intValue), (yyvsp[(4) - (4)].expressionNode).m_node);
                                           (yyval.elementList).m_features = (yyvsp[(1) - (4)].elementList).m_features | (yyvsp[(4) - (4)].expressionNode).m_features;
                                           (yyval.elementList).m_numConstants = (yyvsp[(1) - (4)].elementList).m_numConstants + (yyvsp[(4) - (4)].expressionNode).m_numConstants; ;}
     break;
@@ -3189,7 +3189,7 @@ yyreduce:
 
   case 36:
 #line 389 "../../JavaScriptCore/parser/Grammar.y"
-    { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
+    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
@@ -3197,7 +3197,7 @@ yyreduce:
 
   case 37:
 #line 393 "../../JavaScriptCore/parser/Grammar.y"
-    { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
+    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants);
                                         ;}
@@ -3205,7 +3205,7 @@ yyreduce:
 
   case 38:
 #line 397 "../../JavaScriptCore/parser/Grammar.y"
-    { NewExprNode* node = new NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
+    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].argumentsNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].argumentsNode).m_numConstants);
                                         ;}
@@ -3213,7 +3213,7 @@ yyreduce:
 
   case 40:
 #line 405 "../../JavaScriptCore/parser/Grammar.y"
-    { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
+    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
@@ -3221,7 +3221,7 @@ yyreduce:
 
   case 41:
 #line 409 "../../JavaScriptCore/parser/Grammar.y"
-    { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
+    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants);
                                         ;}
@@ -3229,7 +3229,7 @@ yyreduce:
 
   case 42:
 #line 413 "../../JavaScriptCore/parser/Grammar.y"
-    { NewExprNode* node = new NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
+    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].argumentsNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].argumentsNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].argumentsNode).m_numConstants);
                                         ;}
@@ -3237,7 +3237,7 @@ yyreduce:
 
   case 44:
 #line 421 "../../JavaScriptCore/parser/Grammar.y"
-    { NewExprNode* node = new NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
+    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); 
                                         ;}
@@ -3245,7 +3245,7 @@ yyreduce:
 
   case 46:
 #line 429 "../../JavaScriptCore/parser/Grammar.y"
-    { NewExprNode* node = new NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
+    { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).last_column, (yylsp[(2) - (2)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants);
                                         ;}
@@ -3263,7 +3263,7 @@ yyreduce:
 
   case 49:
 #line 438 "../../JavaScriptCore/parser/Grammar.y"
-    { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
+    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
@@ -3271,7 +3271,7 @@ yyreduce:
 
   case 50:
 #line 442 "../../JavaScriptCore/parser/Grammar.y"
-    { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
+    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants); ;}
     break;
@@ -3288,7 +3288,7 @@ yyreduce:
 
   case 53:
 #line 450 "../../JavaScriptCore/parser/Grammar.y"
-    { BracketAccessorNode* node = new BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
+    { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_node, (yyvsp[(3) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (4)]).first_column, (yylsp[(1) - (4)]).last_column, (yylsp[(4) - (4)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (4)].expressionNode).m_features | (yyvsp[(3) - (4)].expressionNode).m_features, (yyvsp[(1) - (4)].expressionNode).m_numConstants + (yyvsp[(3) - (4)].expressionNode).m_numConstants); 
                                         ;}
@@ -3296,7 +3296,7 @@ yyreduce:
 
   case 54:
 #line 454 "../../JavaScriptCore/parser/Grammar.y"
-    { DotAccessorNode* node = new DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
+    { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, *(yyvsp[(3) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(1) - (3)]).last_column, (yylsp[(3) - (3)]).last_column);
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants); 
                                         ;}
@@ -3304,17 +3304,17 @@ yyreduce:
 
   case 55:
 #line 461 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new ArgumentsNode(GLOBAL_DATA), 0, 0); ;}
+    { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA), 0, 0); ;}
     break;
 
   case 56:
 #line 462 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new ArgumentsNode(GLOBAL_DATA, (yyvsp[(2) - (3)].argumentList).m_node.head), (yyvsp[(2) - (3)].argumentList).m_features, (yyvsp[(2) - (3)].argumentList).m_numConstants); ;}
+    { (yyval.argumentsNode) = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA, (yyvsp[(2) - (3)].argumentList).m_node.head), (yyvsp[(2) - (3)].argumentList).m_features, (yyvsp[(2) - (3)].argumentList).m_numConstants); ;}
     break;
 
   case 57:
 #line 466 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.argumentList).m_node.head = new ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].expressionNode).m_node);
+    { (yyval.argumentList).m_node.head = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].expressionNode).m_node);
                                           (yyval.argumentList).m_node.tail = (yyval.argumentList).m_node.head;
                                           (yyval.argumentList).m_features = (yyvsp[(1) - (1)].expressionNode).m_features;
                                           (yyval.argumentList).m_numConstants = (yyvsp[(1) - (1)].expressionNode).m_numConstants; ;}
@@ -3323,7 +3323,7 @@ yyreduce:
   case 58:
 #line 470 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.argumentList).m_node.head = (yyvsp[(1) - (3)].argumentList).m_node.head;
-                                          (yyval.argumentList).m_node.tail = new ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (3)].argumentList).m_node.tail, (yyvsp[(3) - (3)].expressionNode).m_node);
+                                          (yyval.argumentList).m_node.tail = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, (yyvsp[(1) - (3)].argumentList).m_node.tail, (yyvsp[(3) - (3)].expressionNode).m_node);
                                           (yyval.argumentList).m_features = (yyvsp[(1) - (3)].argumentList).m_features | (yyvsp[(3) - (3)].expressionNode).m_features;
                                           (yyval.argumentList).m_numConstants = (yyvsp[(1) - (3)].argumentList).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants; ;}
     break;
@@ -3355,7 +3355,7 @@ yyreduce:
 
   case 70:
 #line 500 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new VoidNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants + 1); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) VoidNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants + 1); ;}
     break;
 
   case 71:
@@ -3385,7 +3385,7 @@ yyreduce:
 
   case 76:
 #line 506 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new UnaryPlusNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 77:
@@ -3400,7 +3400,7 @@ yyreduce:
 
   case 79:
 #line 509 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalNotNode(GLOBAL_DATA, (yyvsp[(2) - (2)].expressionNode).m_node), (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 85:
@@ -3415,7 +3415,7 @@ yyreduce:
 
   case 87:
 #line 525 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 89:
@@ -3430,7 +3430,7 @@ yyreduce:
 
   case 91:
 #line 535 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 93:
@@ -3465,7 +3465,7 @@ yyreduce:
 
   case 101:
 #line 556 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 103:
@@ -3480,252 +3480,252 @@ yyreduce:
 
   case 105:
 #line 563 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 107:
 #line 568 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 108:
 #line 569 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 109:
 #line 570 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 110:
 #line 571 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 111:
 #line 572 "../../JavaScriptCore/parser/Grammar.y"
-    { InstanceOfNode* node = new InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
+    { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 112:
 #line 575 "../../JavaScriptCore/parser/Grammar.y"
-    { InNode* node = new InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
+    { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 114:
 #line 582 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 115:
 #line 583 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 116:
 #line 584 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 117:
 #line 585 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 118:
 #line 587 "../../JavaScriptCore/parser/Grammar.y"
-    { InstanceOfNode* node = new InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
+    { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 120:
 #line 594 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 121:
 #line 595 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 122:
 #line 596 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 123:
 #line 597 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 124:
 #line 599 "../../JavaScriptCore/parser/Grammar.y"
-    { InstanceOfNode* node = new InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
+    { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 125:
 #line 603 "../../JavaScriptCore/parser/Grammar.y"
-    { InNode* node = new InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
+    { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(3) - (3)]).first_column, (yylsp[(3) - (3)]).last_column);  
                                           (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(node, (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 127:
 #line 610 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 128:
 #line 611 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 129:
 #line 612 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 130:
 #line 613 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 132:
 #line 619 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 133:
 #line 621 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 134:
 #line 623 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 135:
 #line 625 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 137:
 #line 631 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 138:
 #line 632 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 139:
 #line 634 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 140:
 #line 636 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 142:
 #line 641 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 144:
 #line 647 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 146:
 #line 652 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 148:
 #line 657 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 150:
 #line 663 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 152:
 #line 669 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 154:
 #line 674 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 156:
 #line 680 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 158:
 #line 686 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_features & AssignFeature), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 160:
 #line 691 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 162:
 #line 697 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 164:
 #line 703 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalAnd), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 166:
 #line 708 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 168:
 #line 714 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 170:
 #line 719 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node, OpLogicalOr), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 172:
 #line 725 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 174:
 #line 731 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 176:
 #line 737 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, (yyvsp[(1) - (5)].expressionNode).m_node, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].expressionNode).m_node), (yyvsp[(1) - (5)].expressionNode).m_features | (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].expressionNode).m_features, (yyvsp[(1) - (5)].expressionNode).m_numConstants + (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].expressionNode).m_numConstants); ;}
     break;
 
   case 178:
@@ -3811,28 +3811,28 @@ yyreduce:
 
   case 196:
 #line 781 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 198:
 #line 786 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 200:
 #line 791 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(new CommaNode(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
+    { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (3)].expressionNode).m_node, (yyvsp[(3) - (3)].expressionNode).m_node), (yyvsp[(1) - (3)].expressionNode).m_features | (yyvsp[(3) - (3)].expressionNode).m_features, (yyvsp[(1) - (3)].expressionNode).m_numConstants + (yyvsp[(3) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 218:
 #line 815 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 219:
 #line 817 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new BlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].sourceElements).m_node), (yyvsp[(2) - (3)].sourceElements).m_varDeclarations, (yyvsp[(2) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (3)].sourceElements).m_features, (yyvsp[(2) - (3)].sourceElements).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].sourceElements).m_node), (yyvsp[(2) - (3)].sourceElements).m_varDeclarations, (yyvsp[(2) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (3)].sourceElements).m_features, (yyvsp[(2) - (3)].sourceElements).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
@@ -3852,7 +3852,7 @@ yyreduce:
   case 222:
 #line 830 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.varDeclList).m_node = 0;
-                                          (yyval.varDeclList).m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (1)].ident), 0);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
                                           (yyval.varDeclList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
@@ -3862,10 +3862,10 @@ yyreduce:
 
   case 223:
 #line 837 "../../JavaScriptCore/parser/Grammar.y"
-    { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
+    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
                                           (yyval.varDeclList).m_node = node;
-                                          (yyval.varDeclList).m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (2)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
                                           (yyval.varDeclList).m_features = ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features;
@@ -3886,9 +3886,9 @@ yyreduce:
 
   case 225:
 #line 855 "../../JavaScriptCore/parser/Grammar.y"
-    { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
+    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.varDeclList).m_node = combineVarInitializers(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
+                                          (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (4)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
@@ -3900,7 +3900,7 @@ yyreduce:
   case 226:
 #line 867 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.varDeclList).m_node = 0;
-                                          (yyval.varDeclList).m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (1)].ident), 0);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
                                           (yyval.varDeclList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
@@ -3910,10 +3910,10 @@ yyreduce:
 
   case 227:
 #line 874 "../../JavaScriptCore/parser/Grammar.y"
-    { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
+    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node, (yyvsp[(2) - (2)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(2) - (2)]).first_column + 1, (yylsp[(2) - (2)]).last_column);
                                           (yyval.varDeclList).m_node = node;
-                                          (yyval.varDeclList).m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          (yyval.varDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(1) - (2)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
                                           (yyval.varDeclList).m_features = ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features;
@@ -3934,9 +3934,9 @@ yyreduce:
 
   case 229:
 #line 892 "../../JavaScriptCore/parser/Grammar.y"
-    { AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
+    { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *(yyvsp[(3) - (4)].ident), (yyvsp[(4) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].expressionNode).m_features & AssignFeature);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (4)]).first_column, (yylsp[(4) - (4)]).first_column + 1, (yylsp[(4) - (4)]).last_column);
-                                          (yyval.varDeclList).m_node = combineVarInitializers(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
+                                          (yyval.varDeclList).m_node = combineCommaNodes(GLOBAL_DATA, (yyvsp[(1) - (4)].varDeclList).m_node, node);
                                           (yyval.varDeclList).m_varDeclarations = (yyvsp[(1) - (4)].varDeclList).m_varDeclarations;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.varDeclList).m_varDeclarations, *(yyvsp[(3) - (4)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.varDeclList).m_funcDeclarations = 0;
@@ -3947,13 +3947,13 @@ yyreduce:
 
   case 230:
 #line 904 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 231:
 #line 907 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, (yyvsp[(2) - (3)].constDeclList).m_node.head), (yyvsp[(2) - (3)].constDeclList).m_varDeclarations, (yyvsp[(2) - (3)].constDeclList).m_funcDeclarations, (yyvsp[(2) - (3)].constDeclList).m_features, (yyvsp[(2) - (3)].constDeclList).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
@@ -3961,7 +3961,7 @@ yyreduce:
 #line 912 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (1)].constDeclNode).m_node;
                                           (yyval.constDeclList).m_node.tail = (yyval.constDeclList).m_node.head;
-                                          (yyval.constDeclList).m_varDeclarations = new ParserRefCountedData<DeclarationStacks::VarStack>(GLOBAL_DATA);
+                                          (yyval.constDeclList).m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyval.constDeclList).m_varDeclarations, (yyvsp[(1) - (1)].constDeclNode).m_node);
                                           (yyval.constDeclList).m_funcDeclarations = 0; 
                                           (yyval.constDeclList).m_features = (yyvsp[(1) - (1)].constDeclNode).m_features;
@@ -3971,7 +3971,7 @@ yyreduce:
 
   case 233:
 #line 921 "../../JavaScriptCore/parser/Grammar.y"
-    {  (yyval.constDeclList).m_node.head = (yyvsp[(1) - (3)].constDeclList).m_node.head;
+    { (yyval.constDeclList).m_node.head = (yyvsp[(1) - (3)].constDeclList).m_node.head;
                                           (yyvsp[(1) - (3)].constDeclList).m_node.tail->m_next = (yyvsp[(3) - (3)].constDeclNode).m_node;
                                           (yyval.constDeclList).m_node.tail = (yyvsp[(3) - (3)].constDeclNode).m_node;
                                           (yyval.constDeclList).m_varDeclarations = (yyvsp[(1) - (3)].constDeclList).m_varDeclarations;
@@ -3983,12 +3983,12 @@ yyreduce:
 
   case 234:
 #line 932 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), 0), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
+    { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident), 0), (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); ;}
     break;
 
   case 235:
 #line 933 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node), ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
+    { (yyval.constDeclNode) = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *(yyvsp[(1) - (2)].ident), (yyvsp[(2) - (2)].expressionNode).m_node), ((*(yyvsp[(1) - (2)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(2) - (2)].expressionNode).m_features, (yyvsp[(2) - (2)].expressionNode).m_numConstants); ;}
     break;
 
   case 236:
@@ -4003,57 +4003,58 @@ yyreduce:
 
   case 238:
 #line 945 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new EmptyStatementNode(GLOBAL_DATA), 0, 0, 0, 0); ;}
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA), 0, 0, 0, 0); ;}
     break;
 
   case 239:
 #line 949 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 240:
 #line 951 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, (yyvsp[(1) - (2)].expressionNode).m_node), 0, 0, (yyvsp[(1) - (2)].expressionNode).m_features, (yyvsp[(1) - (2)].expressionNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 241:
 #line 957 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new IfNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 242:
 #line 960 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new IfElseNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].statementNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node), 
-                                                                                         mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations), mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfElseNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].statementNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node), 
+                                                                                         mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
+                                                                                         mergeDeclarationLists((yyvsp[(5) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(3) - (7)].expressionNode).m_features | (yyvsp[(5) - (7)].statementNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features,
                                                                                          (yyvsp[(3) - (7)].expressionNode).m_numConstants + (yyvsp[(5) - (7)].statementNode).m_numConstants + (yyvsp[(7) - (7)].statementNode).m_numConstants); 
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(4) - (7)])); ;}
     break;
 
   case 243:
-#line 968 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
+#line 969 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
                                              DBG((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
     break;
 
   case 244:
-#line 970 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
+#line 971 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node), (yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features, (yyvsp[(2) - (7)].statementNode).m_numConstants + (yyvsp[(5) - (7)].expressionNode).m_numConstants);
                                              DBG((yyval.statementNode).m_node, (yylsp[(1) - (7)]), (yylsp[(3) - (7)])); ;}
     break;
 
   case 245:
-#line 972 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new WhileNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
+#line 973 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WhileNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node), (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 246:
-#line 975 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ForNode(GLOBAL_DATA, (yyvsp[(3) - (9)].expressionNode).m_node, (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, false), (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations, 
+#line 976 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(3) - (9)].expressionNode).m_node, (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, false), (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations, 
                                                                                          (yyvsp[(3) - (9)].expressionNode).m_features | (yyvsp[(5) - (9)].expressionNode).m_features | (yyvsp[(7) - (9)].expressionNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features,
                                                                                          (yyvsp[(3) - (9)].expressionNode).m_numConstants + (yyvsp[(5) - (9)].expressionNode).m_numConstants + (yyvsp[(7) - (9)].expressionNode).m_numConstants + (yyvsp[(9) - (9)].statementNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (9)]), (yylsp[(8) - (9)])); 
@@ -4061,8 +4062,8 @@ yyreduce:
     break;
 
   case 247:
-#line 981 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new ForNode(GLOBAL_DATA, (yyvsp[(4) - (10)].varDeclList).m_node, (yyvsp[(6) - (10)].expressionNode).m_node, (yyvsp[(8) - (10)].expressionNode).m_node, (yyvsp[(10) - (10)].statementNode).m_node, true),
+#line 982 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, (yyvsp[(4) - (10)].varDeclList).m_node, (yyvsp[(6) - (10)].expressionNode).m_node, (yyvsp[(8) - (10)].expressionNode).m_node, (yyvsp[(10) - (10)].statementNode).m_node, true),
                                                                                          mergeDeclarationLists((yyvsp[(4) - (10)].varDeclList).m_varDeclarations, (yyvsp[(10) - (10)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(4) - (10)].varDeclList).m_funcDeclarations, (yyvsp[(10) - (10)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(4) - (10)].varDeclList).m_features | (yyvsp[(6) - (10)].expressionNode).m_features | (yyvsp[(8) - (10)].expressionNode).m_features | (yyvsp[(10) - (10)].statementNode).m_features,
@@ -4071,9 +4072,9 @@ yyreduce:
     break;
 
   case 248:
-#line 988 "../../JavaScriptCore/parser/Grammar.y"
+#line 989 "../../JavaScriptCore/parser/Grammar.y"
     {
-                                            ForInNode* node = new ForInNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node);
+                                            ForInNode* node = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, (yyvsp[(3) - (7)].expressionNode).m_node, (yyvsp[(5) - (7)].expressionNode).m_node, (yyvsp[(7) - (7)].statementNode).m_node);
                                             SET_EXCEPTION_LOCATION(node, (yylsp[(3) - (7)]).first_column, (yylsp[(3) - (7)]).last_column, (yylsp[(5) - (7)]).last_column);
                                             (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, (yyvsp[(7) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations,
                                                                                            (yyvsp[(3) - (7)].expressionNode).m_features | (yyvsp[(5) - (7)].expressionNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features,
@@ -4083,8 +4084,8 @@ yyreduce:
     break;
 
   case 249:
-#line 997 "../../JavaScriptCore/parser/Grammar.y"
-    { ForInNode *forIn = new ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (8)].ident), 0, (yyvsp[(6) - (8)].expressionNode).m_node, (yyvsp[(8) - (8)].statementNode).m_node, (yylsp[(5) - (8)]).first_column, (yylsp[(5) - (8)]).first_column - (yylsp[(4) - (8)]).first_column, (yylsp[(6) - (8)]).last_column - (yylsp[(5) - (8)]).first_column);
+#line 998 "../../JavaScriptCore/parser/Grammar.y"
+    { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (8)].ident), 0, (yyvsp[(6) - (8)].expressionNode).m_node, (yyvsp[(8) - (8)].statementNode).m_node, (yylsp[(5) - (8)]).first_column, (yylsp[(5) - (8)]).first_column - (yylsp[(4) - (8)]).first_column, (yylsp[(6) - (8)]).last_column - (yylsp[(5) - (8)]).first_column);
                                           SET_EXCEPTION_LOCATION(forIn, (yylsp[(4) - (8)]).first_column, (yylsp[(5) - (8)]).first_column + 1, (yylsp[(6) - (8)]).last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyvsp[(8) - (8)].statementNode).m_varDeclarations, *(yyvsp[(4) - (8)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(forIn, (yyvsp[(8) - (8)].statementNode).m_varDeclarations, (yyvsp[(8) - (8)].statementNode).m_funcDeclarations, ((*(yyvsp[(4) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(6) - (8)].expressionNode).m_features | (yyvsp[(8) - (8)].statementNode).m_features, (yyvsp[(6) - (8)].expressionNode).m_numConstants + (yyvsp[(8) - (8)].statementNode).m_numConstants);
@@ -4092,8 +4093,8 @@ yyreduce:
     break;
 
   case 250:
-#line 1003 "../../JavaScriptCore/parser/Grammar.y"
-    { ForInNode *forIn = new ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (9)].ident), (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, (yylsp[(5) - (9)]).first_column, (yylsp[(5) - (9)]).first_column - (yylsp[(4) - (9)]).first_column, (yylsp[(5) - (9)]).last_column - (yylsp[(5) - (9)]).first_column);
+#line 1004 "../../JavaScriptCore/parser/Grammar.y"
+    { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *(yyvsp[(4) - (9)].ident), (yyvsp[(5) - (9)].expressionNode).m_node, (yyvsp[(7) - (9)].expressionNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node, (yylsp[(5) - (9)]).first_column, (yylsp[(5) - (9)]).first_column - (yylsp[(4) - (9)]).first_column, (yylsp[(5) - (9)]).last_column - (yylsp[(5) - (9)]).first_column);
                                           SET_EXCEPTION_LOCATION(forIn, (yylsp[(4) - (9)]).first_column, (yylsp[(6) - (9)]).first_column + 1, (yylsp[(7) - (9)]).last_column);
                                           appendToVarDeclarationList(GLOBAL_DATA, (yyvsp[(9) - (9)].statementNode).m_varDeclarations, *(yyvsp[(4) - (9)].ident), DeclarationStacks::HasInitializer);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(forIn, (yyvsp[(9) - (9)].statementNode).m_varDeclarations, (yyvsp[(9) - (9)].statementNode).m_funcDeclarations,
@@ -4103,125 +4104,125 @@ yyreduce:
     break;
 
   case 251:
-#line 1013 "../../JavaScriptCore/parser/Grammar.y"
+#line 1014 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
     break;
 
   case 253:
-#line 1018 "../../JavaScriptCore/parser/Grammar.y"
+#line 1019 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.expressionNode) = createNodeInfo<ExpressionNode*>(0, 0, 0); ;}
     break;
 
   case 255:
-#line 1023 "../../JavaScriptCore/parser/Grammar.y"
-    { ContinueNode* node = new ContinueNode(GLOBAL_DATA);
+#line 1024 "../../JavaScriptCore/parser/Grammar.y"
+    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 256:
-#line 1027 "../../JavaScriptCore/parser/Grammar.y"
-    { ContinueNode* node = new ContinueNode(GLOBAL_DATA);
+#line 1028 "../../JavaScriptCore/parser/Grammar.y"
+    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 257:
-#line 1031 "../../JavaScriptCore/parser/Grammar.y"
-    { ContinueNode* node = new ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
+#line 1032 "../../JavaScriptCore/parser/Grammar.y"
+    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 258:
-#line 1035 "../../JavaScriptCore/parser/Grammar.y"
-    { ContinueNode* node = new ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
+#line 1036 "../../JavaScriptCore/parser/Grammar.y"
+    { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
   case 259:
-#line 1042 "../../JavaScriptCore/parser/Grammar.y"
-    { BreakNode* node = new BreakNode(GLOBAL_DATA);
+#line 1043 "../../JavaScriptCore/parser/Grammar.y"
+    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 260:
-#line 1045 "../../JavaScriptCore/parser/Grammar.y"
-    { BreakNode* node = new BreakNode(GLOBAL_DATA);
+#line 1046 "../../JavaScriptCore/parser/Grammar.y"
+    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new BreakNode(GLOBAL_DATA), 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA), 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 261:
-#line 1048 "../../JavaScriptCore/parser/Grammar.y"
-    { BreakNode* node = new BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
+#line 1049 "../../JavaScriptCore/parser/Grammar.y"
+    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 262:
-#line 1051 "../../JavaScriptCore/parser/Grammar.y"
-    { BreakNode* node = new BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
+#line 1052 "../../JavaScriptCore/parser/Grammar.y"
+    { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident));
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
-                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident)), 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
+                                          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *(yyvsp[(2) - (3)].ident)), 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
   case 263:
-#line 1057 "../../JavaScriptCore/parser/Grammar.y"
-    { ReturnNode* node = new ReturnNode(GLOBAL_DATA, 0); 
+#line 1058 "../../JavaScriptCore/parser/Grammar.y"
+    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 264:
-#line 1060 "../../JavaScriptCore/parser/Grammar.y"
-    { ReturnNode* node = new ReturnNode(GLOBAL_DATA, 0); 
+#line 1061 "../../JavaScriptCore/parser/Grammar.y"
+    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (2)]).first_column, (yylsp[(1) - (2)]).last_column, (yylsp[(1) - (2)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 265:
-#line 1063 "../../JavaScriptCore/parser/Grammar.y"
-    { ReturnNode* node = new ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
+#line 1064 "../../JavaScriptCore/parser/Grammar.y"
+    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(3) - (3)])); ;}
     break;
 
   case 266:
-#line 1066 "../../JavaScriptCore/parser/Grammar.y"
-    { ReturnNode* node = new ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
+#line 1067 "../../JavaScriptCore/parser/Grammar.y"
+    { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node); 
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column); 
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; ;}
     break;
 
   case 267:
-#line 1072 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new WithNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node, (yylsp[(3) - (5)]).last_column, (yylsp[(3) - (5)]).last_column - (yylsp[(3) - (5)]).first_column),
+#line 1073 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WithNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].statementNode).m_node, (yylsp[(3) - (5)]).last_column, (yylsp[(3) - (5)]).last_column - (yylsp[(3) - (5)]).first_column),
                                                                                          (yyvsp[(5) - (5)].statementNode).m_varDeclarations, (yyvsp[(5) - (5)].statementNode).m_funcDeclarations, (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].statementNode).m_features | WithFeature, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].statementNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 268:
-#line 1078 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new SwitchNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].caseBlockNode).m_node), (yyvsp[(5) - (5)].caseBlockNode).m_varDeclarations, (yyvsp[(5) - (5)].caseBlockNode).m_funcDeclarations,
+#line 1079 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) SwitchNode(GLOBAL_DATA, (yyvsp[(3) - (5)].expressionNode).m_node, (yyvsp[(5) - (5)].caseBlockNode).m_node), (yyvsp[(5) - (5)].caseBlockNode).m_varDeclarations, (yyvsp[(5) - (5)].caseBlockNode).m_funcDeclarations,
                                                                                          (yyvsp[(3) - (5)].expressionNode).m_features | (yyvsp[(5) - (5)].caseBlockNode).m_features, (yyvsp[(3) - (5)].expressionNode).m_numConstants + (yyvsp[(5) - (5)].caseBlockNode).m_numConstants);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (5)]), (yylsp[(4) - (5)])); ;}
     break;
 
   case 269:
-#line 1084 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].clauseList).m_node.head, 0, 0), (yyvsp[(2) - (3)].clauseList).m_varDeclarations, (yyvsp[(2) - (3)].clauseList).m_funcDeclarations, (yyvsp[(2) - (3)].clauseList).m_features, (yyvsp[(2) - (3)].clauseList).m_numConstants); ;}
+#line 1085 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (3)].clauseList).m_node.head, 0, 0), (yyvsp[(2) - (3)].clauseList).m_varDeclarations, (yyvsp[(2) - (3)].clauseList).m_funcDeclarations, (yyvsp[(2) - (3)].clauseList).m_features, (yyvsp[(2) - (3)].clauseList).m_numConstants); ;}
     break;
 
   case 270:
-#line 1086 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (5)].clauseList).m_node.head, (yyvsp[(3) - (5)].caseClauseNode).m_node, (yyvsp[(4) - (5)].clauseList).m_node.head),
+#line 1087 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.caseBlockNode) = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, (yyvsp[(2) - (5)].clauseList).m_node.head, (yyvsp[(3) - (5)].caseClauseNode).m_node, (yyvsp[(4) - (5)].clauseList).m_node.head),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (5)].clauseList).m_varDeclarations, (yyvsp[(3) - (5)].caseClauseNode).m_varDeclarations), (yyvsp[(4) - (5)].clauseList).m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (5)].clauseList).m_funcDeclarations, (yyvsp[(3) - (5)].caseClauseNode).m_funcDeclarations), (yyvsp[(4) - (5)].clauseList).m_funcDeclarations),
                                                                                          (yyvsp[(2) - (5)].clauseList).m_features | (yyvsp[(3) - (5)].caseClauseNode).m_features | (yyvsp[(4) - (5)].clauseList).m_features,
@@ -4229,13 +4230,13 @@ yyreduce:
     break;
 
   case 271:
-#line 1094 "../../JavaScriptCore/parser/Grammar.y"
+#line 1095 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.clauseList).m_node.head = 0; (yyval.clauseList).m_node.tail = 0; (yyval.clauseList).m_varDeclarations = 0; (yyval.clauseList).m_funcDeclarations = 0; (yyval.clauseList).m_features = 0; (yyval.clauseList).m_numConstants = 0; ;}
     break;
 
   case 273:
-#line 1099 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.clauseList).m_node.head = new ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].caseClauseNode).m_node);
+#line 1100 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.clauseList).m_node.head = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (1)].caseClauseNode).m_node);
                                           (yyval.clauseList).m_node.tail = (yyval.clauseList).m_node.head;
                                           (yyval.clauseList).m_varDeclarations = (yyvsp[(1) - (1)].caseClauseNode).m_varDeclarations;
                                           (yyval.clauseList).m_funcDeclarations = (yyvsp[(1) - (1)].caseClauseNode).m_funcDeclarations; 
@@ -4244,9 +4245,9 @@ yyreduce:
     break;
 
   case 274:
-#line 1105 "../../JavaScriptCore/parser/Grammar.y"
+#line 1106 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.clauseList).m_node.head = (yyvsp[(1) - (2)].clauseList).m_node.head;
-                                          (yyval.clauseList).m_node.tail = new ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (2)].clauseList).m_node.tail, (yyvsp[(2) - (2)].caseClauseNode).m_node);
+                                          (yyval.clauseList).m_node.tail = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, (yyvsp[(1) - (2)].clauseList).m_node.tail, (yyvsp[(2) - (2)].caseClauseNode).m_node);
                                           (yyval.clauseList).m_varDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].clauseList).m_varDeclarations, (yyvsp[(2) - (2)].caseClauseNode).m_varDeclarations);
                                           (yyval.clauseList).m_funcDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].clauseList).m_funcDeclarations, (yyvsp[(2) - (2)].caseClauseNode).m_funcDeclarations);
                                           (yyval.clauseList).m_features = (yyvsp[(1) - (2)].clauseList).m_features | (yyvsp[(2) - (2)].caseClauseNode).m_features;
@@ -4255,51 +4256,51 @@ yyreduce:
     break;
 
   case 275:
-#line 1115 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node), 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); ;}
+#line 1116 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node), 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); ;}
     break;
 
   case 276:
-#line 1116 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].sourceElements).m_node), (yyvsp[(4) - (4)].sourceElements).m_varDeclarations, (yyvsp[(4) - (4)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (4)].expressionNode).m_features | (yyvsp[(4) - (4)].sourceElements).m_features, (yyvsp[(2) - (4)].expressionNode).m_numConstants + (yyvsp[(4) - (4)].sourceElements).m_numConstants); ;}
+#line 1117 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, (yyvsp[(2) - (4)].expressionNode).m_node, (yyvsp[(4) - (4)].sourceElements).m_node), (yyvsp[(4) - (4)].sourceElements).m_varDeclarations, (yyvsp[(4) - (4)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (4)].expressionNode).m_features | (yyvsp[(4) - (4)].sourceElements).m_features, (yyvsp[(2) - (4)].expressionNode).m_numConstants + (yyvsp[(4) - (4)].sourceElements).m_numConstants); ;}
     break;
 
   case 277:
-#line 1120 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, 0), 0, 0, 0, 0); ;}
+#line 1121 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0), 0, 0, 0, 0); ;}
     break;
 
   case 278:
-#line 1121 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new CaseClauseNode(GLOBAL_DATA, 0, (yyvsp[(3) - (3)].sourceElements).m_node), (yyvsp[(3) - (3)].sourceElements).m_varDeclarations, (yyvsp[(3) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(3) - (3)].sourceElements).m_features, (yyvsp[(3) - (3)].sourceElements).m_numConstants); ;}
+#line 1122 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.caseClauseNode) = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0, (yyvsp[(3) - (3)].sourceElements).m_node), (yyvsp[(3) - (3)].sourceElements).m_varDeclarations, (yyvsp[(3) - (3)].sourceElements).m_funcDeclarations, (yyvsp[(3) - (3)].sourceElements).m_features, (yyvsp[(3) - (3)].sourceElements).m_numConstants); ;}
     break;
 
   case 279:
-#line 1125 "../../JavaScriptCore/parser/Grammar.y"
-    { LabelNode* node = new LabelNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].statementNode).m_node);
+#line 1126 "../../JavaScriptCore/parser/Grammar.y"
+    { LabelNode* node = new (GLOBAL_DATA) LabelNode(GLOBAL_DATA, *(yyvsp[(1) - (3)].ident), (yyvsp[(3) - (3)].statementNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, (yyvsp[(3) - (3)].statementNode).m_varDeclarations, (yyvsp[(3) - (3)].statementNode).m_funcDeclarations, (yyvsp[(3) - (3)].statementNode).m_features, (yyvsp[(3) - (3)].statementNode).m_numConstants); ;}
     break;
 
   case 280:
-#line 1131 "../../JavaScriptCore/parser/Grammar.y"
-    { ThrowNode* node = new ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
+#line 1132 "../../JavaScriptCore/parser/Grammar.y"
+    { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)]));
                                         ;}
     break;
 
   case 281:
-#line 1135 "../../JavaScriptCore/parser/Grammar.y"
-    { ThrowNode* node = new ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
+#line 1136 "../../JavaScriptCore/parser/Grammar.y"
+    { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, (yyvsp[(2) - (3)].expressionNode).m_node);
                                           SET_EXCEPTION_LOCATION(node, (yylsp[(1) - (3)]).first_column, (yylsp[(2) - (3)]).last_column, (yylsp[(2) - (3)]).last_column);
                                           (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, (yyvsp[(2) - (3)].expressionNode).m_features, (yyvsp[(2) - (3)].expressionNode).m_numConstants); DBG((yyval.statementNode).m_node, (yylsp[(1) - (3)]), (yylsp[(2) - (3)])); AUTO_SEMICOLON; 
                                         ;}
     break;
 
   case 282:
-#line 1142 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new TryNode(GLOBAL_DATA, (yyvsp[(2) - (4)].statementNode).m_node, GLOBAL_DATA->propertyNames->nullIdentifier, false, 0, (yyvsp[(4) - (4)].statementNode).m_node),
+#line 1143 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (4)].statementNode).m_node, GLOBAL_DATA->propertyNames->nullIdentifier, false, 0, (yyvsp[(4) - (4)].statementNode).m_node),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (4)].statementNode).m_varDeclarations, (yyvsp[(4) - (4)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (4)].statementNode).m_funcDeclarations, (yyvsp[(4) - (4)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(2) - (4)].statementNode).m_features | (yyvsp[(4) - (4)].statementNode).m_features,
@@ -4308,8 +4309,8 @@ yyreduce:
     break;
 
   case 283:
-#line 1148 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new TryNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, *(yyvsp[(5) - (7)].ident), ((yyvsp[(7) - (7)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (7)].statementNode).m_node, 0),
+#line 1149 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (7)].statementNode).m_node, *(yyvsp[(5) - (7)].ident), ((yyvsp[(7) - (7)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (7)].statementNode).m_node, 0),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (7)].statementNode).m_varDeclarations, (yyvsp[(7) - (7)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists((yyvsp[(2) - (7)].statementNode).m_funcDeclarations, (yyvsp[(7) - (7)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(2) - (7)].statementNode).m_features | (yyvsp[(7) - (7)].statementNode).m_features | CatchFeature,
@@ -4318,8 +4319,8 @@ yyreduce:
     break;
 
   case 284:
-#line 1155 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new TryNode(GLOBAL_DATA, (yyvsp[(2) - (9)].statementNode).m_node, *(yyvsp[(5) - (9)].ident), ((yyvsp[(7) - (9)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (9)].statementNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node),
+#line 1156 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, (yyvsp[(2) - (9)].statementNode).m_node, *(yyvsp[(5) - (9)].ident), ((yyvsp[(7) - (9)].statementNode).m_features & EvalFeature) != 0, (yyvsp[(7) - (9)].statementNode).m_node, (yyvsp[(9) - (9)].statementNode).m_node),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (9)].statementNode).m_varDeclarations, (yyvsp[(7) - (9)].statementNode).m_varDeclarations), (yyvsp[(9) - (9)].statementNode).m_varDeclarations),
                                                                                          mergeDeclarationLists(mergeDeclarationLists((yyvsp[(2) - (9)].statementNode).m_funcDeclarations, (yyvsp[(7) - (9)].statementNode).m_funcDeclarations), (yyvsp[(9) - (9)].statementNode).m_funcDeclarations),
                                                                                          (yyvsp[(2) - (9)].statementNode).m_features | (yyvsp[(7) - (9)].statementNode).m_features | (yyvsp[(9) - (9)].statementNode).m_features | CatchFeature,
@@ -4328,26 +4329,26 @@ yyreduce:
     break;
 
   case 285:
-#line 1164 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
+#line 1165 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(2) - (2)])); ;}
     break;
 
   case 286:
-#line 1166 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
+#line 1167 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
                                           DBG((yyval.statementNode).m_node, (yylsp[(1) - (2)]), (yylsp[(1) - (2)])); AUTO_SEMICOLON; ;}
     break;
 
   case 287:
-#line 1171 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), 0, new ParserRefCountedData<DeclarationStacks::FunctionStack>(GLOBAL_DATA), ((*(yyvsp[(2) - (7)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); DBG((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node)); ;}
+#line 1172 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (7)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); DBG((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); (yyval.statementNode).m_funcDeclarations->data.append(static_cast<FuncDeclNode*>((yyval.statementNode).m_node)); ;}
     break;
 
   case 288:
-#line 1173 "../../JavaScriptCore/parser/Grammar.y"
+#line 1174 "../../JavaScriptCore/parser/Grammar.y"
     { 
-          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), LEXER->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), 0, new ParserRefCountedData<DeclarationStacks::FunctionStack>(GLOBAL_DATA), ((*(yyvsp[(2) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
+          (yyval.statementNode) = createNodeDeclarationInfo<StatementNode*>(new FuncDeclNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), LEXER->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*(yyvsp[(2) - (8)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
           if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
               (yyvsp[(7) - (8)].functionBodyNode)->setUsesArguments(); 
           DBG((yyvsp[(7) - (8)].functionBodyNode), (yylsp[(6) - (8)]), (yylsp[(8) - (8)]));
@@ -4356,12 +4357,12 @@ yyreduce:
     break;
 
   case 289:
-#line 1183 "../../JavaScriptCore/parser/Grammar.y"
+#line 1184 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(5) - (6)].functionBodyNode), LEXER->sourceCode((yyvsp[(4) - (6)].intValue), (yyvsp[(6) - (6)].intValue), (yylsp[(4) - (6)]).first_line)), ClosureFeature, 0); DBG((yyvsp[(5) - (6)].functionBodyNode), (yylsp[(4) - (6)]), (yylsp[(6) - (6)])); ;}
     break;
 
   case 290:
-#line 1185 "../../JavaScriptCore/parser/Grammar.y"
+#line 1186 "../../JavaScriptCore/parser/Grammar.y"
     { 
           (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line), (yyvsp[(3) - (7)].parameterList).m_node.head), (yyvsp[(3) - (7)].parameterList).m_features | ClosureFeature, 0); 
           if ((yyvsp[(3) - (7)].parameterList).m_features & ArgumentsFeature) 
@@ -4371,12 +4372,12 @@ yyreduce:
     break;
 
   case 291:
-#line 1191 "../../JavaScriptCore/parser/Grammar.y"
+#line 1192 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (7)].ident), (yyvsp[(6) - (7)].functionBodyNode), LEXER->sourceCode((yyvsp[(5) - (7)].intValue), (yyvsp[(7) - (7)].intValue), (yylsp[(5) - (7)]).first_line)), ClosureFeature, 0); DBG((yyvsp[(6) - (7)].functionBodyNode), (yylsp[(5) - (7)]), (yylsp[(7) - (7)])); ;}
     break;
 
   case 292:
-#line 1193 "../../JavaScriptCore/parser/Grammar.y"
+#line 1194 "../../JavaScriptCore/parser/Grammar.y"
     { 
           (yyval.funcExprNode) = createNodeInfo(new FuncExprNode(GLOBAL_DATA, *(yyvsp[(2) - (8)].ident), (yyvsp[(7) - (8)].functionBodyNode), LEXER->sourceCode((yyvsp[(6) - (8)].intValue), (yyvsp[(8) - (8)].intValue), (yylsp[(6) - (8)]).first_line), (yyvsp[(4) - (8)].parameterList).m_node.head), (yyvsp[(4) - (8)].parameterList).m_features | ClosureFeature, 0); 
           if ((yyvsp[(4) - (8)].parameterList).m_features & ArgumentsFeature)
@@ -4386,43 +4387,43 @@ yyreduce:
     break;
 
   case 293:
-#line 1202 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.parameterList).m_node.head = new ParameterNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident));
+#line 1203 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.parameterList).m_node.head = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, *(yyvsp[(1) - (1)].ident));
                                           (yyval.parameterList).m_features = (*(yyvsp[(1) - (1)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
                                           (yyval.parameterList).m_node.tail = (yyval.parameterList).m_node.head; ;}
     break;
 
   case 294:
-#line 1205 "../../JavaScriptCore/parser/Grammar.y"
+#line 1206 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.parameterList).m_node.head = (yyvsp[(1) - (3)].parameterList).m_node.head;
                                           (yyval.parameterList).m_features = (yyvsp[(1) - (3)].parameterList).m_features | ((*(yyvsp[(3) - (3)].ident) == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0);
-                                          (yyval.parameterList).m_node.tail = new ParameterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].parameterList).m_node.tail, *(yyvsp[(3) - (3)].ident));  ;}
+                                          (yyval.parameterList).m_node.tail = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, (yyvsp[(1) - (3)].parameterList).m_node.tail, *(yyvsp[(3) - (3)].ident));  ;}
     break;
 
   case 295:
-#line 1211 "../../JavaScriptCore/parser/Grammar.y"
+#line 1212 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
     break;
 
   case 296:
-#line 1212 "../../JavaScriptCore/parser/Grammar.y"
+#line 1213 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.functionBodyNode) = FunctionBodyNode::create(GLOBAL_DATA); ;}
     break;
 
   case 297:
-#line 1216 "../../JavaScriptCore/parser/Grammar.y"
-    { GLOBAL_DATA->parser->didFinishParsing(new SourceElements(GLOBAL_DATA), 0, 0, NoFeatures, (yylsp[(0) - (0)]).last_line, 0); ;}
+#line 1217 "../../JavaScriptCore/parser/Grammar.y"
+    { GLOBAL_DATA->parser->didFinishParsing(new (GLOBAL_DATA) SourceElements(GLOBAL_DATA), 0, 0, NoFeatures, (yylsp[(0) - (0)]).last_line, 0); ;}
     break;
 
   case 298:
-#line 1217 "../../JavaScriptCore/parser/Grammar.y"
+#line 1218 "../../JavaScriptCore/parser/Grammar.y"
     { GLOBAL_DATA->parser->didFinishParsing((yyvsp[(1) - (1)].sourceElements).m_node, (yyvsp[(1) - (1)].sourceElements).m_varDeclarations, (yyvsp[(1) - (1)].sourceElements).m_funcDeclarations, (yyvsp[(1) - (1)].sourceElements).m_features, 
                                                                                 (yylsp[(1) - (1)]).last_line, (yyvsp[(1) - (1)].sourceElements).m_numConstants); ;}
     break;
 
   case 299:
-#line 1222 "../../JavaScriptCore/parser/Grammar.y"
-    { (yyval.sourceElements).m_node = new SourceElements(GLOBAL_DATA);
+#line 1223 "../../JavaScriptCore/parser/Grammar.y"
+    { (yyval.sourceElements).m_node = new (GLOBAL_DATA) SourceElements(GLOBAL_DATA);
                                           (yyval.sourceElements).m_node->append((yyvsp[(1) - (1)].statementNode).m_node);
                                           (yyval.sourceElements).m_varDeclarations = (yyvsp[(1) - (1)].statementNode).m_varDeclarations;
                                           (yyval.sourceElements).m_funcDeclarations = (yyvsp[(1) - (1)].statementNode).m_funcDeclarations;
@@ -4432,7 +4433,7 @@ yyreduce:
     break;
 
   case 300:
-#line 1229 "../../JavaScriptCore/parser/Grammar.y"
+#line 1230 "../../JavaScriptCore/parser/Grammar.y"
     { (yyval.sourceElements).m_node->append((yyvsp[(2) - (2)].statementNode).m_node);
                                           (yyval.sourceElements).m_varDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].sourceElements).m_varDeclarations, (yyvsp[(2) - (2)].statementNode).m_varDeclarations);
                                           (yyval.sourceElements).m_funcDeclarations = mergeDeclarationLists((yyvsp[(1) - (2)].sourceElements).m_funcDeclarations, (yyvsp[(2) - (2)].statementNode).m_funcDeclarations);
@@ -4442,188 +4443,188 @@ yyreduce:
     break;
 
   case 304:
-#line 1243 "../../JavaScriptCore/parser/Grammar.y"
+#line 1244 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 305:
-#line 1244 "../../JavaScriptCore/parser/Grammar.y"
+#line 1245 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 306:
-#line 1245 "../../JavaScriptCore/parser/Grammar.y"
+#line 1246 "../../JavaScriptCore/parser/Grammar.y"
     { Lexer& l = *LEXER; if (!l.scanRegExp()) YYABORT; ;}
     break;
 
   case 307:
-#line 1246 "../../JavaScriptCore/parser/Grammar.y"
+#line 1247 "../../JavaScriptCore/parser/Grammar.y"
     { Lexer& l = *LEXER; if (!l.scanRegExp()) YYABORT; ;}
     break;
 
   case 308:
-#line 1250 "../../JavaScriptCore/parser/Grammar.y"
+#line 1251 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 309:
-#line 1251 "../../JavaScriptCore/parser/Grammar.y"
+#line 1252 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 310:
-#line 1252 "../../JavaScriptCore/parser/Grammar.y"
+#line 1253 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 311:
-#line 1253 "../../JavaScriptCore/parser/Grammar.y"
+#line 1254 "../../JavaScriptCore/parser/Grammar.y"
     { if (*(yyvsp[(1) - (7)].ident) != "get" && *(yyvsp[(1) - (7)].ident) != "set") YYABORT; ;}
     break;
 
   case 312:
-#line 1254 "../../JavaScriptCore/parser/Grammar.y"
+#line 1255 "../../JavaScriptCore/parser/Grammar.y"
     { if (*(yyvsp[(1) - (8)].ident) != "get" && *(yyvsp[(1) - (8)].ident) != "set") YYABORT; ;}
     break;
 
   case 316:
-#line 1264 "../../JavaScriptCore/parser/Grammar.y"
+#line 1265 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 317:
-#line 1265 "../../JavaScriptCore/parser/Grammar.y"
+#line 1266 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 318:
-#line 1267 "../../JavaScriptCore/parser/Grammar.y"
+#line 1268 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 322:
-#line 1274 "../../JavaScriptCore/parser/Grammar.y"
+#line 1275 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 517:
-#line 1642 "../../JavaScriptCore/parser/Grammar.y"
+#line 1643 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 518:
-#line 1643 "../../JavaScriptCore/parser/Grammar.y"
+#line 1644 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 520:
-#line 1648 "../../JavaScriptCore/parser/Grammar.y"
+#line 1649 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 521:
-#line 1652 "../../JavaScriptCore/parser/Grammar.y"
+#line 1653 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 522:
-#line 1653 "../../JavaScriptCore/parser/Grammar.y"
+#line 1654 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 525:
-#line 1659 "../../JavaScriptCore/parser/Grammar.y"
+#line 1660 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 526:
-#line 1660 "../../JavaScriptCore/parser/Grammar.y"
+#line 1661 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 530:
-#line 1667 "../../JavaScriptCore/parser/Grammar.y"
+#line 1668 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 533:
-#line 1676 "../../JavaScriptCore/parser/Grammar.y"
+#line 1677 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 534:
-#line 1677 "../../JavaScriptCore/parser/Grammar.y"
+#line 1678 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 539:
-#line 1694 "../../JavaScriptCore/parser/Grammar.y"
+#line 1695 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 555:
-#line 1725 "../../JavaScriptCore/parser/Grammar.y"
+#line 1726 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 557:
-#line 1727 "../../JavaScriptCore/parser/Grammar.y"
+#line 1728 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 559:
-#line 1732 "../../JavaScriptCore/parser/Grammar.y"
+#line 1733 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 561:
-#line 1734 "../../JavaScriptCore/parser/Grammar.y"
+#line 1735 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 563:
-#line 1739 "../../JavaScriptCore/parser/Grammar.y"
+#line 1740 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 565:
-#line 1741 "../../JavaScriptCore/parser/Grammar.y"
+#line 1742 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 568:
-#line 1753 "../../JavaScriptCore/parser/Grammar.y"
+#line 1754 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 569:
-#line 1754 "../../JavaScriptCore/parser/Grammar.y"
+#line 1755 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 578:
-#line 1778 "../../JavaScriptCore/parser/Grammar.y"
+#line 1779 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
   case 580:
-#line 1783 "../../JavaScriptCore/parser/Grammar.y"
+#line 1784 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 585:
-#line 1794 "../../JavaScriptCore/parser/Grammar.y"
+#line 1795 "../../JavaScriptCore/parser/Grammar.y"
     { AUTO_SEMICOLON; ;}
     break;
 
   case 592:
-#line 1810 "../../JavaScriptCore/parser/Grammar.y"
+#line 1811 "../../JavaScriptCore/parser/Grammar.y"
     { ;}
     break;
 
 
 /* Line 1267 of yacc.c.  */
-#line 4627 "Grammar.tab.c"
+#line 4628 "WebCore/tmp/../generated/Grammar.tab.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
@@ -4843,29 +4844,29 @@ yyreturn:
 }
 
 
-#line 1826 "../../JavaScriptCore/parser/Grammar.y"
+#line 1827 "../../JavaScriptCore/parser/Grammar.y"
 
 
 static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Operator op, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end)
 {
     if (!loc->isLocation())
-        return new AssignErrorNode(GLOBAL_DATA, loc, op, expr, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) AssignErrorNode(GLOBAL_DATA, loc, op, expr, divot, divot - start, end - divot);
 
     if (loc->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(loc);
         if (op == OpEqual) {
-            AssignResolveNode* node = new AssignResolveNode(GLOBAL_DATA, resolve->identifier(), expr, exprHasAssignments);
+            AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, resolve->identifier(), expr, exprHasAssignments);
             SET_EXCEPTION_LOCATION(node, start, divot, end);
             return node;
         } else
-            return new ReadModifyResolveNode(GLOBAL_DATA, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+            return new (GLOBAL_DATA) ReadModifyResolveNode(GLOBAL_DATA, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     }
     if (loc->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(loc);
         if (op == OpEqual)
-            return new AssignBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
+            return new (GLOBAL_DATA) AssignBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
         else {
-            ReadModifyBracketNode* node = new ReadModifyBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
+            ReadModifyBracketNode* node = new (GLOBAL_DATA) ReadModifyBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
             node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
             return node;
         }
@@ -4873,9 +4874,9 @@ static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Oper
     ASSERT(loc->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(loc);
     if (op == OpEqual)
-        return new AssignDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
+        return new (GLOBAL_DATA) AssignDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
 
-    ReadModifyDotNode* node = new ReadModifyDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
+    ReadModifyDotNode* node = new (GLOBAL_DATA) ReadModifyDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
@@ -4883,21 +4884,21 @@ static ExpressionNode* makeAssignNode(void* globalPtr, ExpressionNode* loc, Oper
 static ExpressionNode* makePrefixNode(void* globalPtr, ExpressionNode* expr, Operator op, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new PrefixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PrefixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
     
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new PrefixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PrefixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PrefixBracketNode* node = new PrefixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PrefixBracketNode* node = new (GLOBAL_DATA) PrefixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->startOffset());
         return node;
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PrefixDotNode* node = new PrefixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PrefixDotNode* node = new (GLOBAL_DATA) PrefixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->startOffset());
     return node;
 }
@@ -4905,22 +4906,22 @@ static ExpressionNode* makePrefixNode(void* globalPtr, ExpressionNode* expr, Ope
 static ExpressionNode* makePostfixNode(void* globalPtr, ExpressionNode* expr, Operator op, int start, int divot, int end)
 { 
     if (!expr->isLocation())
-        return new PostfixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PostfixErrorNode(GLOBAL_DATA, expr, op, divot, divot - start, end - divot);
     
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new PostfixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) PostfixResolveNode(GLOBAL_DATA, resolve->identifier(), op, divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PostfixBracketNode* node = new PostfixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
+        PostfixBracketNode* node = new (GLOBAL_DATA) PostfixBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return node;
         
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PostfixDotNode* node = new PostfixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
+    PostfixDotNode* node = new (GLOBAL_DATA) PostfixDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return node;
 }
@@ -4930,23 +4931,29 @@ static ExpressionNodeInfo makeFunctionCallNode(void* globalPtr, ExpressionNodeIn
     CodeFeatures features = func.m_features | args.m_features;
     int numConstants = func.m_numConstants + args.m_numConstants;
     if (!func.m_node->isLocation())
-        return createNodeInfo<ExpressionNode*>(new FunctionCallValueNode(GLOBAL_DATA, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
+        return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) FunctionCallValueNode(GLOBAL_DATA, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
     if (func.m_node->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(func.m_node);
         const Identifier& identifier = resolve->identifier();
         if (identifier == GLOBAL_DATA->propertyNames->eval)
-            return createNodeInfo<ExpressionNode*>(new EvalFunctionCallNode(GLOBAL_DATA, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
-        return createNodeInfo<ExpressionNode*>(new FunctionCallResolveNode(GLOBAL_DATA, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
+            return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EvalFunctionCallNode(GLOBAL_DATA, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
+        return createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) FunctionCallResolveNode(GLOBAL_DATA, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
     }
     if (func.m_node->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(func.m_node);
-        FunctionCallBracketNode* node = new FunctionCallBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
+        FunctionCallBracketNode* node = new (GLOBAL_DATA) FunctionCallBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
         node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
         return createNodeInfo<ExpressionNode*>(node, features, numConstants);
     }
     ASSERT(func.m_node->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(func.m_node);
-    FunctionCallDotNode* node = new FunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    FunctionCallDotNode* node;
+    if (dot->identifier() == GLOBAL_DATA->propertyNames->call)
+        node = new (GLOBAL_DATA) CallFunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    else if (dot->identifier() == GLOBAL_DATA->propertyNames->apply)
+        node = new (GLOBAL_DATA) ApplyFunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
+    else
+        node = new (GLOBAL_DATA) FunctionCallDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
     node->setSubexpressionInfo(dot->divot(), dot->endOffset());
     return createNodeInfo<ExpressionNode*>(node, features, numConstants);
 }
@@ -4955,26 +4962,26 @@ static ExpressionNode* makeTypeOfNode(void* globalPtr, ExpressionNode* expr)
 {
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new TypeOfResolveNode(GLOBAL_DATA, resolve->identifier());
+        return new (GLOBAL_DATA) TypeOfResolveNode(GLOBAL_DATA, resolve->identifier());
     }
-    return new TypeOfValueNode(GLOBAL_DATA, expr);
+    return new (GLOBAL_DATA) TypeOfValueNode(GLOBAL_DATA, expr);
 }
 
 static ExpressionNode* makeDeleteNode(void* globalPtr, ExpressionNode* expr, int start, int divot, int end)
 {
     if (!expr->isLocation())
-        return new DeleteValueNode(GLOBAL_DATA, expr);
+        return new (GLOBAL_DATA) DeleteValueNode(GLOBAL_DATA, expr);
     if (expr->isResolveNode()) {
         ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new DeleteResolveNode(GLOBAL_DATA, resolve->identifier(), divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) DeleteResolveNode(GLOBAL_DATA, resolve->identifier(), divot, divot - start, end - divot);
     }
     if (expr->isBracketAccessorNode()) {
         BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        return new DeleteBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
+        return new (GLOBAL_DATA) DeleteBracketNode(GLOBAL_DATA, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
     }
     ASSERT(expr->isDotAccessorNode());
     DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    return new DeleteDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), divot, divot - start, end - divot);
+    return new (GLOBAL_DATA) DeleteDotNode(GLOBAL_DATA, dot->base(), dot->identifier(), divot, divot - start, end - divot);
 }
 
 static PropertyNode* makeGetterOrSetterPropertyNode(void* globalPtr, const Identifier& getOrSet, const Identifier& name, ParameterNode* params, FunctionBodyNode* body, const SourceCode& source)
@@ -4986,7 +4993,7 @@ static PropertyNode* makeGetterOrSetterPropertyNode(void* globalPtr, const Ident
         type = PropertyNode::Setter;
     else
         return 0;
-    return new PropertyNode(GLOBAL_DATA, name, new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, body, source, params), type);
+    return new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, name, new FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, body, source, params), type);
 }
 
 static ExpressionNode* makeNegateNode(void* globalPtr, ExpressionNode* n)
@@ -5000,19 +5007,19 @@ static ExpressionNode* makeNegateNode(void* globalPtr, ExpressionNode* n)
         }
     }
 
-    return new NegateNode(GLOBAL_DATA, n);
+    return new (GLOBAL_DATA) NegateNode(GLOBAL_DATA, n);
 }
 
 static NumberNode* makeNumberNode(void* globalPtr, double d)
 {
-    return new NumberNode(GLOBAL_DATA, d);
+    return new (GLOBAL_DATA) NumberNode(GLOBAL_DATA, d);
 }
 
 static ExpressionNode* makeBitwiseNotNode(void* globalPtr, ExpressionNode* expr)
 {
     if (expr->isNumber())
         return makeNumberNode(globalPtr, ~toInt32(static_cast<NumberNode*>(expr)->value()));
-    return new BitwiseNotNode(GLOBAL_DATA, expr);
+    return new (GLOBAL_DATA) BitwiseNotNode(GLOBAL_DATA, expr);
 }
 
 static ExpressionNode* makeMultNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
@@ -5024,12 +5031,12 @@ static ExpressionNode* makeMultNode(void* globalPtr, ExpressionNode* expr1, Expr
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() * static_cast<NumberNode*>(expr2)->value());
 
     if (expr1->isNumber() && static_cast<NumberNode*>(expr1)->value() == 1)
-        return new UnaryPlusNode(GLOBAL_DATA, expr2);
+        return new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, expr2);
 
     if (expr2->isNumber() && static_cast<NumberNode*>(expr2)->value() == 1)
-        return new UnaryPlusNode(GLOBAL_DATA, expr1);
+        return new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, expr1);
 
-    return new MultNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) MultNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeDivNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
@@ -5039,14 +5046,14 @@ static ExpressionNode* makeDivNode(void* globalPtr, ExpressionNode* expr1, Expre
 
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() / static_cast<NumberNode*>(expr2)->value());
-    return new DivNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) DivNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeAddNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() + static_cast<NumberNode*>(expr2)->value());
-    return new AddNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) AddNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeSubNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
@@ -5056,21 +5063,21 @@ static ExpressionNode* makeSubNode(void* globalPtr, ExpressionNode* expr1, Expre
 
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, static_cast<NumberNode*>(expr1)->value() - static_cast<NumberNode*>(expr2)->value());
-    return new SubNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) SubNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeLeftShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) << (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new LeftShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) LeftShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 static ExpressionNode* makeRightShiftNode(void* globalPtr, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
 {
     if (expr1->isNumber() && expr2->isNumber())
         return makeNumberNode(globalPtr, toInt32(static_cast<NumberNode*>(expr1)->value()) >> (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new RightShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
+    return new (GLOBAL_DATA) RightShiftNode(GLOBAL_DATA, expr1, expr2, rightHasAssignments);
 }
 
 /* called by yyparse on error */
@@ -5085,11 +5092,15 @@ static bool allowAutomaticSemicolon(Lexer& lexer, int yychar)
     return yychar == CLOSEBRACE || yychar == 0 || lexer.prevTerminator();
 }
 
-static ExpressionNode* combineVarInitializers(void* globalPtr, ExpressionNode* list, AssignResolveNode* init)
+static ExpressionNode* combineCommaNodes(void* globalPtr, ExpressionNode* list, ExpressionNode* init)
 {
     if (!list)
         return init;
-    return new VarDeclCommaNode(GLOBAL_DATA, list, init);
+    if (list->isCommaNode()) {
+        static_cast<CommaNode*>(list)->append(init);
+        return list;
+    }
+    return new (GLOBAL_DATA) CommaNode(GLOBAL_DATA, list, init);
 }
 
 // We turn variable declarations into either assignments or empty
@@ -5098,8 +5109,8 @@ static ExpressionNode* combineVarInitializers(void* globalPtr, ExpressionNode* l
 static StatementNode* makeVarStatementNode(void* globalPtr, ExpressionNode* expr)
 {
     if (!expr)
-        return new EmptyStatementNode(GLOBAL_DATA);
-    return new VarStatementNode(GLOBAL_DATA, expr);
+        return new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA);
+    return new (GLOBAL_DATA) VarStatementNode(GLOBAL_DATA, expr);
 }
 
 #undef GLOBAL_DATA
diff --git a/src/3rdparty/webkit/WebCore/generated/Grammar.h b/src/3rdparty/webkit/WebCore/generated/Grammar.h
index 4805844..4188cd8 100644
--- a/src/3rdparty/webkit/WebCore/generated/Grammar.h
+++ b/src/3rdparty/webkit/WebCore/generated/Grammar.h
@@ -207,7 +207,7 @@ typedef union YYSTYPE
     Operator            op;
 }
 /* Line 1489 of yacc.c.  */
-#line 211 "Grammar.tab.h"
+#line 211 "WebCore/tmp/../generated/Grammar.tab.h"
 	YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.cpp b/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.cpp
new file mode 100644
index 0000000..d14bc93
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.cpp
@@ -0,0 +1,574 @@
+/*
+ * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ *
+ *
+ * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+
+#include "config.h"
+#include "HTMLElementFactory.h"
+
+#include "HTMLNames.h"
+#if ENABLE(DASHBOARD_SUPPORT)
+#include "Document.h"
+#include "Settings.h"
+#endif
+
+#include "HTMLFormElement.h"
+#include "HTMLAnchorElement.h"
+#include "HTMLElement.h"
+#include "HTMLAppletElement.h"
+#include "HTMLAreaElement.h"
+#include "HTMLAudioElement.h"
+#include "HTMLBaseElement.h"
+#include "HTMLBaseFontElement.h"
+#include "HTMLBlockquoteElement.h"
+#include "HTMLBodyElement.h"
+#include "HTMLBRElement.h"
+#include "HTMLButtonElement.h"
+#include "HTMLCanvasElement.h"
+#include "HTMLTableCaptionElement.h"
+#include "HTMLTableColElement.h"
+#include "HTMLDataGridElement.h"
+#include "HTMLDataGridCellElement.h"
+#include "HTMLDataGridColElement.h"
+#include "HTMLModElement.h"
+#include "HTMLDirectoryElement.h"
+#include "HTMLDivElement.h"
+#include "HTMLDListElement.h"
+#include "HTMLDataGridRowElement.h"
+#include "HTMLEmbedElement.h"
+#include "HTMLFieldSetElement.h"
+#include "HTMLFontElement.h"
+#include "HTMLFormElement.h"
+#include "HTMLFrameElement.h"
+#include "HTMLFrameSetElement.h"
+#include "HTMLHeadingElement.h"
+#include "HTMLHeadElement.h"
+#include "HTMLHRElement.h"
+#include "HTMLHtmlElement.h"
+#include "HTMLIFrameElement.h"
+#include "HTMLImageElement.h"
+#include "HTMLInputElement.h"
+#include "HTMLIsIndexElement.h"
+#include "HTMLKeygenElement.h"
+#include "HTMLLabelElement.h"
+#include "HTMLLegendElement.h"
+#include "HTMLLIElement.h"
+#include "HTMLLinkElement.h"
+#include "HTMLPreElement.h"
+#include "HTMLMapElement.h"
+#include "HTMLMarqueeElement.h"
+#include "HTMLMenuElement.h"
+#include "HTMLMetaElement.h"
+#include "HTMLObjectElement.h"
+#include "HTMLOListElement.h"
+#include "HTMLOptGroupElement.h"
+#include "HTMLOptionElement.h"
+#include "HTMLParagraphElement.h"
+#include "HTMLParamElement.h"
+#include "HTMLQuoteElement.h"
+#include "HTMLScriptElement.h"
+#include "HTMLSelectElement.h"
+#include "HTMLSourceElement.h"
+#include "HTMLStyleElement.h"
+#include "HTMLTableElement.h"
+#include "HTMLTableSectionElement.h"
+#include "HTMLTableCellElement.h"
+#include "HTMLTextAreaElement.h"
+#include "HTMLTitleElement.h"
+#include "HTMLTableRowElement.h"
+#include "HTMLUListElement.h"
+#include "HTMLVideoElement.h"
+#include <wtf/HashMap.h>
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+typedef PassRefPtr<HTMLElement> (*ConstructorFunction)(const QualifiedName&, Document*, HTMLFormElement*, bool createdByParser);
+typedef HashMap<AtomicStringImpl*, ConstructorFunction> FunctionMap;
+
+static FunctionMap* gFunctionMap = 0;
+
+static PassRefPtr<HTMLElement> anchorConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLAnchorElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> appletConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLAppletElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> areaConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLAreaElement(tagName, doc);
+}
+
+#if ENABLE(VIDEO)
+
+static PassRefPtr<HTMLElement> audioConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    if (!MediaPlayer::isAvailable())
+        return new HTMLElement(tagName, doc);
+    return new HTMLAudioElement(tagName, doc);
+}
+
+#endif
+
+static PassRefPtr<HTMLElement> baseConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLBaseElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> basefontConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLBaseFontElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> blockquoteConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLBlockquoteElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> bodyConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLBodyElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> brConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLBRElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> buttonConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLButtonElement(tagName, doc, formElement);
+}
+
+static PassRefPtr<HTMLElement> canvasConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLCanvasElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> tablecaptionConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLTableCaptionElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> tablecolConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLTableColElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> datagridConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLDataGridElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> datagridcellConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLDataGridCellElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> datagridcolConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLDataGridColElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> modConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLModElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> directoryConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLDirectoryElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> divConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLDivElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> dlistConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLDListElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> datagridrowConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLDataGridRowElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> embedConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLEmbedElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> fieldsetConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLFieldSetElement(tagName, doc, formElement);
+}
+
+static PassRefPtr<HTMLElement> fontConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLFontElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> formConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLFormElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> frameConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLFrameElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> framesetConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLFrameSetElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> headingConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLHeadingElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> headConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLHeadElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> hrConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLHRElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> htmlConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLHtmlElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> iframeConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLIFrameElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> imageConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLImageElement(tagName, doc, formElement);
+}
+
+static PassRefPtr<HTMLElement> inputConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLInputElement(tagName, doc, formElement);
+}
+
+static PassRefPtr<HTMLElement> isindexConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLIsIndexElement(tagName, doc, formElement);
+}
+
+static PassRefPtr<HTMLElement> keygenConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLKeygenElement(tagName, doc, formElement);
+}
+
+static PassRefPtr<HTMLElement> labelConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLLabelElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> legendConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLLegendElement(tagName, doc, formElement);
+}
+
+static PassRefPtr<HTMLElement> liConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLLIElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> linkConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool createdByParser)
+{
+    return new HTMLLinkElement(tagName, doc, createdByParser);
+}
+
+static PassRefPtr<HTMLElement> preConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLPreElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> mapConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLMapElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> marqueeConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLMarqueeElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> menuConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLMenuElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> metaConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLMetaElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> objectConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool createdByParser)
+{
+    return new HTMLObjectElement(tagName, doc, createdByParser);
+}
+
+static PassRefPtr<HTMLElement> olistConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLOListElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> optgroupConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLOptGroupElement(tagName, doc, formElement);
+}
+
+static PassRefPtr<HTMLElement> optionConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLOptionElement(tagName, doc, formElement);
+}
+
+static PassRefPtr<HTMLElement> paragraphConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLParagraphElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> paramConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLParamElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> quoteConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLQuoteElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> scriptConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool createdByParser)
+{
+    return new HTMLScriptElement(tagName, doc, createdByParser);
+}
+
+static PassRefPtr<HTMLElement> selectConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLSelectElement(tagName, doc, formElement);
+}
+
+#if ENABLE(VIDEO)
+
+static PassRefPtr<HTMLElement> sourceConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    if (!MediaPlayer::isAvailable())
+        return new HTMLElement(tagName, doc);
+    return new HTMLSourceElement(tagName, doc);
+}
+
+#endif
+
+static PassRefPtr<HTMLElement> styleConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool createdByParser)
+{
+    return new HTMLStyleElement(tagName, doc, createdByParser);
+}
+
+static PassRefPtr<HTMLElement> tableConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLTableElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> tablesectionConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLTableSectionElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> tablecellConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLTableCellElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> textareaConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLTextAreaElement(tagName, doc, formElement);
+}
+
+static PassRefPtr<HTMLElement> titleConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLTitleElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> tablerowConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLTableRowElement(tagName, doc);
+}
+
+static PassRefPtr<HTMLElement> ulistConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    return new HTMLUListElement(tagName, doc);
+}
+
+#if ENABLE(VIDEO)
+
+static PassRefPtr<HTMLElement> videoConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
+{
+    if (!MediaPlayer::isAvailable())
+        return new HTMLElement(tagName, doc);
+    return new HTMLVideoElement(tagName, doc);
+}
+
+#endif
+
+static PassRefPtr<HTMLElement> imgToimageConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement* formElement, bool)
+{
+    return new HTMLImageElement(QualifiedName(tagName.prefix(), imgTag.localName(), tagName.namespaceURI()), doc, formElement);
+}
+
+static void addTag(const QualifiedName& tag, ConstructorFunction func)
+{
+    gFunctionMap->set(tag.localName().impl(), func);
+}
+
+static inline void createFunctionMapIfNecessary()
+{
+    if (gFunctionMap)
+        return;
+    // Create the table.
+    gFunctionMap = new FunctionMap;
+    
+    // Populate it with constructor functions.
+    addTag(aTag, anchorConstructor);
+    addTag(appletTag, appletConstructor);
+    addTag(areaTag, areaConstructor);
+#if ENABLE(VIDEO)
+    addTag(audioTag, audioConstructor);
+#endif
+
+    addTag(baseTag, baseConstructor);
+    addTag(basefontTag, basefontConstructor);
+    addTag(blockquoteTag, blockquoteConstructor);
+    addTag(bodyTag, bodyConstructor);
+    addTag(brTag, brConstructor);
+    addTag(buttonTag, buttonConstructor);
+    addTag(canvasTag, canvasConstructor);
+    addTag(captionTag, tablecaptionConstructor);
+    addTag(colTag, tablecolConstructor);
+    addTag(colgroupTag, tablecolConstructor);
+    addTag(datagridTag, datagridConstructor);
+    addTag(dcellTag, datagridcellConstructor);
+    addTag(dcolTag, datagridcolConstructor);
+    addTag(delTag, modConstructor);
+    addTag(dirTag, directoryConstructor);
+    addTag(divTag, divConstructor);
+    addTag(dlTag, dlistConstructor);
+    addTag(drowTag, datagridrowConstructor);
+    addTag(embedTag, embedConstructor);
+    addTag(fieldsetTag, fieldsetConstructor);
+    addTag(fontTag, fontConstructor);
+    addTag(formTag, formConstructor);
+    addTag(frameTag, frameConstructor);
+    addTag(framesetTag, framesetConstructor);
+    addTag(h1Tag, headingConstructor);
+    addTag(h2Tag, headingConstructor);
+    addTag(h3Tag, headingConstructor);
+    addTag(h4Tag, headingConstructor);
+    addTag(h5Tag, headingConstructor);
+    addTag(h6Tag, headingConstructor);
+    addTag(headTag, headConstructor);
+    addTag(hrTag, hrConstructor);
+    addTag(htmlTag, htmlConstructor);
+    addTag(iframeTag, iframeConstructor);
+    addTag(imageTag, imgToimageConstructor);
+    addTag(imgTag, imageConstructor);
+    addTag(inputTag, inputConstructor);
+    addTag(insTag, modConstructor);
+    addTag(isindexTag, isindexConstructor);
+    addTag(keygenTag, keygenConstructor);
+    addTag(labelTag, labelConstructor);
+    addTag(legendTag, legendConstructor);
+    addTag(liTag, liConstructor);
+    addTag(linkTag, linkConstructor);
+    addTag(listingTag, preConstructor);
+    addTag(mapTag, mapConstructor);
+    addTag(marqueeTag, marqueeConstructor);
+    addTag(menuTag, menuConstructor);
+    addTag(metaTag, metaConstructor);
+    addTag(objectTag, objectConstructor);
+    addTag(olTag, olistConstructor);
+    addTag(optgroupTag, optgroupConstructor);
+    addTag(optionTag, optionConstructor);
+    addTag(pTag, paragraphConstructor);
+    addTag(paramTag, paramConstructor);
+    addTag(preTag, preConstructor);
+    addTag(qTag, quoteConstructor);
+    addTag(scriptTag, scriptConstructor);
+    addTag(selectTag, selectConstructor);
+#if ENABLE(VIDEO)
+    addTag(sourceTag, sourceConstructor);
+#endif
+
+    addTag(styleTag, styleConstructor);
+    addTag(tableTag, tableConstructor);
+    addTag(tbodyTag, tablesectionConstructor);
+    addTag(tdTag, tablecellConstructor);
+    addTag(textareaTag, textareaConstructor);
+    addTag(tfootTag, tablesectionConstructor);
+    addTag(thTag, tablecellConstructor);
+    addTag(theadTag, tablesectionConstructor);
+    addTag(titleTag, titleConstructor);
+    addTag(trTag, tablerowConstructor);
+    addTag(ulTag, ulistConstructor);
+#if ENABLE(VIDEO)
+    addTag(videoTag, videoConstructor);
+#endif
+
+    addTag(xmpTag, preConstructor);
+}
+
+PassRefPtr<HTMLElement> HTMLElementFactory::createHTMLElement(const QualifiedName& qName, Document* doc, HTMLFormElement* formElement, bool createdByParser)
+{
+    // Don't make elements without a document
+    if (!doc)
+        return 0;
+
+    createFunctionMapIfNecessary();
+    ConstructorFunction func = gFunctionMap->get(qName.localName().impl());
+    if (func)
+        return func(qName, doc, formElement, createdByParser);
+    return new HTMLElement(qName, doc);
+}
+
+} // namespace WebCore
+
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.h b/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.h
new file mode 100644
index 0000000..566d9cd
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLElementFactory.h
@@ -0,0 +1,56 @@
+/*
+ * THIS FILE IS AUTOMATICALLY GENERATED, DO NOT EDIT.
+ *
+ *
+ * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+
+#ifndef HTMLElementFactory_h
+#define HTMLElementFactory_h
+
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+    class Element;
+    class Document;
+    class QualifiedName;
+    class AtomicString;
+}
+
+namespace WebCore {
+
+    class HTMLElement;
+     class HTMLFormElement;
+    // The idea behind this class is that there will eventually be a mapping from namespace URIs to ElementFactories that can dispense
+    // elements. In a compound document world, the generic createElement function (will end up being virtual) will be called.
+    class HTMLElementFactory {
+    public:
+        PassRefPtr<Element> createElement(const WebCore::QualifiedName&, WebCore::Document*, bool createdByParser = true);
+        static PassRefPtr<HTMLElement> createHTMLElement(const WebCore::QualifiedName&, WebCore::Document*, HTMLFormElement* = 0, bool /*createdByParser*/ = true);
+    };
+}
+
+#endif // HTMLElementFactory_h
+
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp b/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
index 713c370..4e23159 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLNames.cpp
@@ -68,12 +68,16 @@ DEFINE_GLOBAL(QualifiedName, citeTag, nullAtom, "cite", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, codeTag, nullAtom, "code", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, colTag, nullAtom, "col", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, colgroupTag, nullAtom, "colgroup", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, datagridTag, nullAtom, "datagrid", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, dcellTag, nullAtom, "dcell", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, dcolTag, nullAtom, "dcol", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, ddTag, nullAtom, "dd", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, delTag, nullAtom, "del", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, dfnTag, nullAtom, "dfn", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, dirTag, nullAtom, "dir", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, divTag, nullAtom, "div", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, dlTag, nullAtom, "dl", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, drowTag, nullAtom, "drow", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, dtTag, nullAtom, "dt", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, emTag, nullAtom, "em", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, embedTag, nullAtom, "embed", xhtmlNamespaceURI);
@@ -180,12 +184,16 @@ WebCore::QualifiedName** getHTMLTags(size_t* size)
         (WebCore::QualifiedName*)&codeTag,
         (WebCore::QualifiedName*)&colTag,
         (WebCore::QualifiedName*)&colgroupTag,
+        (WebCore::QualifiedName*)&datagridTag,
+        (WebCore::QualifiedName*)&dcellTag,
+        (WebCore::QualifiedName*)&dcolTag,
         (WebCore::QualifiedName*)&ddTag,
         (WebCore::QualifiedName*)&delTag,
         (WebCore::QualifiedName*)&dfnTag,
         (WebCore::QualifiedName*)&dirTag,
         (WebCore::QualifiedName*)&divTag,
         (WebCore::QualifiedName*)&dlTag,
+        (WebCore::QualifiedName*)&drowTag,
         (WebCore::QualifiedName*)&dtTag,
         (WebCore::QualifiedName*)&emTag,
         (WebCore::QualifiedName*)&embedTag,
@@ -265,7 +273,7 @@ WebCore::QualifiedName** getHTMLTags(size_t* size)
         (WebCore::QualifiedName*)&wbrTag,
         (WebCore::QualifiedName*)&xmpTag,
     };
-    *size = 107;
+    *size = 111;
     return HTMLTags;
 }
 
@@ -282,13 +290,17 @@ DEFINE_GLOBAL(QualifiedName, archiveAttr, nullAtom, "archive", xhtmlNamespaceURI
 DEFINE_GLOBAL(QualifiedName, aria_activedescendantAttr, nullAtom, "aria_activedescendant", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_checkedAttr, nullAtom, "aria_checked", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_describedbyAttr, nullAtom, "aria_describedby", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_disabledAttr, nullAtom, "aria_disabled", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_hiddenAttr, nullAtom, "aria_hidden", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_labeledbyAttr, nullAtom, "aria_labeledby", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_labelledbyAttr, nullAtom, "aria_labelledby", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_levelAttr, nullAtom, "aria_level", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_pressedAttr, nullAtom, "aria_pressed", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, aria_readonlyAttr, nullAtom, "aria_readonly", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_valuemaxAttr, nullAtom, "aria_valuemax", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_valueminAttr, nullAtom, "aria_valuemin", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, aria_valuenowAttr, nullAtom, "aria_valuenow", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, autobufferAttr, nullAtom, "autobuffer", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, autocompleteAttr, nullAtom, "autocomplete", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, autofocusAttr, nullAtom, "autofocus", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, autoplayAttr, nullAtom, "autoplay", xhtmlNamespaceURI);
@@ -333,7 +345,9 @@ DEFINE_GLOBAL(QualifiedName, directionAttr, nullAtom, "direction", xhtmlNamespac
 DEFINE_GLOBAL(QualifiedName, disabledAttr, nullAtom, "disabled", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, enctypeAttr, nullAtom, "enctype", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, endAttr, nullAtom, "end", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, expandedAttr, nullAtom, "expanded", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, faceAttr, nullAtom, "face", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, focusedAttr, nullAtom, "focused", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, forAttr, nullAtom, "for", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, frameAttr, nullAtom, "frame", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, frameborderAttr, nullAtom, "frameborder", xhtmlNamespaceURI);
@@ -346,6 +360,7 @@ DEFINE_GLOBAL(QualifiedName, hspaceAttr, nullAtom, "hspace", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, http_equivAttr, nullAtom, "http_equiv", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, idAttr, nullAtom, "id", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, incrementalAttr, nullAtom, "incremental", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, indeterminateAttr, nullAtom, "indeterminate", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, ismapAttr, nullAtom, "ismap", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, keytypeAttr, nullAtom, "keytype", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, labelAttr, nullAtom, "label", xhtmlNamespaceURI);
@@ -380,6 +395,8 @@ DEFINE_GLOBAL(QualifiedName, onbeforecutAttr, nullAtom, "onbeforecut", xhtmlName
 DEFINE_GLOBAL(QualifiedName, onbeforepasteAttr, nullAtom, "onbeforepaste", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onbeforeunloadAttr, nullAtom, "onbeforeunload", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onblurAttr, nullAtom, "onblur", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, oncanplayAttr, nullAtom, "oncanplay", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, oncanplaythroughAttr, nullAtom, "oncanplaythrough", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onchangeAttr, nullAtom, "onchange", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onclickAttr, nullAtom, "onclick", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, oncontextmenuAttr, nullAtom, "oncontextmenu", xhtmlNamespaceURI);
@@ -393,6 +410,9 @@ DEFINE_GLOBAL(QualifiedName, ondragleaveAttr, nullAtom, "ondragleave", xhtmlName
 DEFINE_GLOBAL(QualifiedName, ondragoverAttr, nullAtom, "ondragover", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, ondragstartAttr, nullAtom, "ondragstart", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, ondropAttr, nullAtom, "ondrop", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, ondurationchangeAttr, nullAtom, "ondurationchange", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onemptiedAttr, nullAtom, "onemptied", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onendedAttr, nullAtom, "onended", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onerrorAttr, nullAtom, "onerror", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onfocusAttr, nullAtom, "onfocus", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, oninputAttr, nullAtom, "oninput", xhtmlNamespaceURI);
@@ -400,22 +420,39 @@ DEFINE_GLOBAL(QualifiedName, onkeydownAttr, nullAtom, "onkeydown", xhtmlNamespac
 DEFINE_GLOBAL(QualifiedName, onkeypressAttr, nullAtom, "onkeypress", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onkeyupAttr, nullAtom, "onkeyup", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onloadAttr, nullAtom, "onload", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onloadeddataAttr, nullAtom, "onloadeddata", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onloadedmetadataAttr, nullAtom, "onloadedmetadata", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onloadstartAttr, nullAtom, "onloadstart", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onmousedownAttr, nullAtom, "onmousedown", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onmousemoveAttr, nullAtom, "onmousemove", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onmouseoutAttr, nullAtom, "onmouseout", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onmouseoverAttr, nullAtom, "onmouseover", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onmouseupAttr, nullAtom, "onmouseup", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onmousewheelAttr, nullAtom, "onmousewheel", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onofflineAttr, nullAtom, "onoffline", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, ononlineAttr, nullAtom, "ononline", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onpasteAttr, nullAtom, "onpaste", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onpauseAttr, nullAtom, "onpause", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onplayAttr, nullAtom, "onplay", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onplayingAttr, nullAtom, "onplaying", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onprogressAttr, nullAtom, "onprogress", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onratechangeAttr, nullAtom, "onratechange", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onresetAttr, nullAtom, "onreset", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onresizeAttr, nullAtom, "onresize", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onscrollAttr, nullAtom, "onscroll", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onsearchAttr, nullAtom, "onsearch", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onseekedAttr, nullAtom, "onseeked", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onseekingAttr, nullAtom, "onseeking", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onselectAttr, nullAtom, "onselect", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onselectstartAttr, nullAtom, "onselectstart", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onstalledAttr, nullAtom, "onstalled", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onstorageAttr, nullAtom, "onstorage", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onsubmitAttr, nullAtom, "onsubmit", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onsuspendAttr, nullAtom, "onsuspend", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, ontimeupdateAttr, nullAtom, "ontimeupdate", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onunloadAttr, nullAtom, "onunload", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onvolumechangeAttr, nullAtom, "onvolumechange", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, onwaitingAttr, nullAtom, "onwaiting", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onwebkitanimationendAttr, nullAtom, "onwebkitanimationend", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onwebkitanimationiterationAttr, nullAtom, "onwebkitanimationiteration", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, onwebkitanimationstartAttr, nullAtom, "onwebkitanimationstart", xhtmlNamespaceURI);
@@ -425,7 +462,9 @@ DEFINE_GLOBAL(QualifiedName, playcountAttr, nullAtom, "playcount", xhtmlNamespac
 DEFINE_GLOBAL(QualifiedName, pluginurlAttr, nullAtom, "pluginurl", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, posterAttr, nullAtom, "poster", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, precisionAttr, nullAtom, "precision", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, primaryAttr, nullAtom, "primary", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, profileAttr, nullAtom, "profile", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, progressAttr, nullAtom, "progress", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, promptAttr, nullAtom, "prompt", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, readonlyAttr, nullAtom, "readonly", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, relAttr, nullAtom, "rel", xhtmlNamespaceURI);
@@ -443,7 +482,10 @@ DEFINE_GLOBAL(QualifiedName, scrollingAttr, nullAtom, "scrolling", xhtmlNamespac
 DEFINE_GLOBAL(QualifiedName, selectedAttr, nullAtom, "selected", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, shapeAttr, nullAtom, "shape", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, sizeAttr, nullAtom, "size", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, sortableAttr, nullAtom, "sortable", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, sortdirectionAttr, nullAtom, "sortdirection", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, spanAttr, nullAtom, "span", xhtmlNamespaceURI);
+DEFINE_GLOBAL(QualifiedName, spellcheckAttr, nullAtom, "spellcheck", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, srcAttr, nullAtom, "src", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, standbyAttr, nullAtom, "standby", xhtmlNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, startAttr, nullAtom, "start", xhtmlNamespaceURI);
@@ -485,13 +527,17 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&aria_activedescendantAttr,
         (WebCore::QualifiedName*)&aria_checkedAttr,
         (WebCore::QualifiedName*)&aria_describedbyAttr,
+        (WebCore::QualifiedName*)&aria_disabledAttr,
+        (WebCore::QualifiedName*)&aria_hiddenAttr,
         (WebCore::QualifiedName*)&aria_labeledbyAttr,
         (WebCore::QualifiedName*)&aria_labelledbyAttr,
         (WebCore::QualifiedName*)&aria_levelAttr,
         (WebCore::QualifiedName*)&aria_pressedAttr,
+        (WebCore::QualifiedName*)&aria_readonlyAttr,
         (WebCore::QualifiedName*)&aria_valuemaxAttr,
         (WebCore::QualifiedName*)&aria_valueminAttr,
         (WebCore::QualifiedName*)&aria_valuenowAttr,
+        (WebCore::QualifiedName*)&autobufferAttr,
         (WebCore::QualifiedName*)&autocompleteAttr,
         (WebCore::QualifiedName*)&autofocusAttr,
         (WebCore::QualifiedName*)&autoplayAttr,
@@ -536,7 +582,9 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&disabledAttr,
         (WebCore::QualifiedName*)&enctypeAttr,
         (WebCore::QualifiedName*)&endAttr,
+        (WebCore::QualifiedName*)&expandedAttr,
         (WebCore::QualifiedName*)&faceAttr,
+        (WebCore::QualifiedName*)&focusedAttr,
         (WebCore::QualifiedName*)&forAttr,
         (WebCore::QualifiedName*)&frameAttr,
         (WebCore::QualifiedName*)&frameborderAttr,
@@ -549,6 +597,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&http_equivAttr,
         (WebCore::QualifiedName*)&idAttr,
         (WebCore::QualifiedName*)&incrementalAttr,
+        (WebCore::QualifiedName*)&indeterminateAttr,
         (WebCore::QualifiedName*)&ismapAttr,
         (WebCore::QualifiedName*)&keytypeAttr,
         (WebCore::QualifiedName*)&labelAttr,
@@ -583,6 +632,8 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&onbeforepasteAttr,
         (WebCore::QualifiedName*)&onbeforeunloadAttr,
         (WebCore::QualifiedName*)&onblurAttr,
+        (WebCore::QualifiedName*)&oncanplayAttr,
+        (WebCore::QualifiedName*)&oncanplaythroughAttr,
         (WebCore::QualifiedName*)&onchangeAttr,
         (WebCore::QualifiedName*)&onclickAttr,
         (WebCore::QualifiedName*)&oncontextmenuAttr,
@@ -596,6 +647,9 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&ondragoverAttr,
         (WebCore::QualifiedName*)&ondragstartAttr,
         (WebCore::QualifiedName*)&ondropAttr,
+        (WebCore::QualifiedName*)&ondurationchangeAttr,
+        (WebCore::QualifiedName*)&onemptiedAttr,
+        (WebCore::QualifiedName*)&onendedAttr,
         (WebCore::QualifiedName*)&onerrorAttr,
         (WebCore::QualifiedName*)&onfocusAttr,
         (WebCore::QualifiedName*)&oninputAttr,
@@ -603,22 +657,39 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&onkeypressAttr,
         (WebCore::QualifiedName*)&onkeyupAttr,
         (WebCore::QualifiedName*)&onloadAttr,
+        (WebCore::QualifiedName*)&onloadeddataAttr,
+        (WebCore::QualifiedName*)&onloadedmetadataAttr,
+        (WebCore::QualifiedName*)&onloadstartAttr,
         (WebCore::QualifiedName*)&onmousedownAttr,
         (WebCore::QualifiedName*)&onmousemoveAttr,
         (WebCore::QualifiedName*)&onmouseoutAttr,
         (WebCore::QualifiedName*)&onmouseoverAttr,
         (WebCore::QualifiedName*)&onmouseupAttr,
         (WebCore::QualifiedName*)&onmousewheelAttr,
+        (WebCore::QualifiedName*)&onofflineAttr,
+        (WebCore::QualifiedName*)&ononlineAttr,
         (WebCore::QualifiedName*)&onpasteAttr,
+        (WebCore::QualifiedName*)&onpauseAttr,
+        (WebCore::QualifiedName*)&onplayAttr,
+        (WebCore::QualifiedName*)&onplayingAttr,
+        (WebCore::QualifiedName*)&onprogressAttr,
+        (WebCore::QualifiedName*)&onratechangeAttr,
         (WebCore::QualifiedName*)&onresetAttr,
         (WebCore::QualifiedName*)&onresizeAttr,
         (WebCore::QualifiedName*)&onscrollAttr,
         (WebCore::QualifiedName*)&onsearchAttr,
+        (WebCore::QualifiedName*)&onseekedAttr,
+        (WebCore::QualifiedName*)&onseekingAttr,
         (WebCore::QualifiedName*)&onselectAttr,
         (WebCore::QualifiedName*)&onselectstartAttr,
+        (WebCore::QualifiedName*)&onstalledAttr,
         (WebCore::QualifiedName*)&onstorageAttr,
         (WebCore::QualifiedName*)&onsubmitAttr,
+        (WebCore::QualifiedName*)&onsuspendAttr,
+        (WebCore::QualifiedName*)&ontimeupdateAttr,
         (WebCore::QualifiedName*)&onunloadAttr,
+        (WebCore::QualifiedName*)&onvolumechangeAttr,
+        (WebCore::QualifiedName*)&onwaitingAttr,
         (WebCore::QualifiedName*)&onwebkitanimationendAttr,
         (WebCore::QualifiedName*)&onwebkitanimationiterationAttr,
         (WebCore::QualifiedName*)&onwebkitanimationstartAttr,
@@ -628,7 +699,9 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&pluginurlAttr,
         (WebCore::QualifiedName*)&posterAttr,
         (WebCore::QualifiedName*)&precisionAttr,
+        (WebCore::QualifiedName*)&primaryAttr,
         (WebCore::QualifiedName*)&profileAttr,
+        (WebCore::QualifiedName*)&progressAttr,
         (WebCore::QualifiedName*)&promptAttr,
         (WebCore::QualifiedName*)&readonlyAttr,
         (WebCore::QualifiedName*)&relAttr,
@@ -646,7 +719,10 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&selectedAttr,
         (WebCore::QualifiedName*)&shapeAttr,
         (WebCore::QualifiedName*)&sizeAttr,
+        (WebCore::QualifiedName*)&sortableAttr,
+        (WebCore::QualifiedName*)&sortdirectionAttr,
         (WebCore::QualifiedName*)&spanAttr,
+        (WebCore::QualifiedName*)&spellcheckAttr,
         (WebCore::QualifiedName*)&srcAttr,
         (WebCore::QualifiedName*)&standbyAttr,
         (WebCore::QualifiedName*)&startAttr,
@@ -672,7 +748,7 @@ WebCore::QualifiedName** getHTMLAttrs(size_t* size)
         (WebCore::QualifiedName*)&widthAttr,
         (WebCore::QualifiedName*)&wrapAttr,
     };
-    *size = 198;
+    *size = 232;
     return HTMLAttr;
 }
 
@@ -720,12 +796,16 @@ void init()
     const char *codeTagString = "code";
     const char *colTagString = "col";
     const char *colgroupTagString = "colgroup";
+    const char *datagridTagString = "datagrid";
+    const char *dcellTagString = "dcell";
+    const char *dcolTagString = "dcol";
     const char *ddTagString = "dd";
     const char *delTagString = "del";
     const char *dfnTagString = "dfn";
     const char *dirTagString = "dir";
     const char *divTagString = "div";
     const char *dlTagString = "dl";
+    const char *drowTagString = "drow";
     const char *dtTagString = "dt";
     const char *emTagString = "em";
     const char *embedTagString = "embed";
@@ -827,12 +907,16 @@ void init()
     new ((void*)&codeTag) QualifiedName(nullAtom, codeTagString, xhtmlNS);
     new ((void*)&colTag) QualifiedName(nullAtom, colTagString, xhtmlNS);
     new ((void*)&colgroupTag) QualifiedName(nullAtom, colgroupTagString, xhtmlNS);
+    new ((void*)&datagridTag) QualifiedName(nullAtom, datagridTagString, xhtmlNS);
+    new ((void*)&dcellTag) QualifiedName(nullAtom, dcellTagString, xhtmlNS);
+    new ((void*)&dcolTag) QualifiedName(nullAtom, dcolTagString, xhtmlNS);
     new ((void*)&ddTag) QualifiedName(nullAtom, ddTagString, xhtmlNS);
     new ((void*)&delTag) QualifiedName(nullAtom, delTagString, xhtmlNS);
     new ((void*)&dfnTag) QualifiedName(nullAtom, dfnTagString, xhtmlNS);
     new ((void*)&dirTag) QualifiedName(nullAtom, dirTagString, xhtmlNS);
     new ((void*)&divTag) QualifiedName(nullAtom, divTagString, xhtmlNS);
     new ((void*)&dlTag) QualifiedName(nullAtom, dlTagString, xhtmlNS);
+    new ((void*)&drowTag) QualifiedName(nullAtom, drowTagString, xhtmlNS);
     new ((void*)&dtTag) QualifiedName(nullAtom, dtTagString, xhtmlNS);
     new ((void*)&emTag) QualifiedName(nullAtom, emTagString, xhtmlNS);
     new ((void*)&embedTag) QualifiedName(nullAtom, embedTagString, xhtmlNS);
@@ -924,13 +1008,17 @@ void init()
     const char *aria_activedescendantAttrString = "aria-activedescendant";
     const char *aria_checkedAttrString = "aria-checked";
     const char *aria_describedbyAttrString = "aria-describedby";
+    const char *aria_disabledAttrString = "aria-disabled";
+    const char *aria_hiddenAttrString = "aria-hidden";
     const char *aria_labeledbyAttrString = "aria-labeledby";
     const char *aria_labelledbyAttrString = "aria-labelledby";
     const char *aria_levelAttrString = "aria-level";
     const char *aria_pressedAttrString = "aria-pressed";
+    const char *aria_readonlyAttrString = "aria-readonly";
     const char *aria_valuemaxAttrString = "aria-valuemax";
     const char *aria_valueminAttrString = "aria-valuemin";
     const char *aria_valuenowAttrString = "aria-valuenow";
+    const char *autobufferAttrString = "autobuffer";
     const char *autocompleteAttrString = "autocomplete";
     const char *autofocusAttrString = "autofocus";
     const char *autoplayAttrString = "autoplay";
@@ -974,7 +1062,9 @@ void init()
     const char *disabledAttrString = "disabled";
     const char *enctypeAttrString = "enctype";
     const char *endAttrString = "end";
+    const char *expandedAttrString = "expanded";
     const char *faceAttrString = "face";
+    const char *focusedAttrString = "focused";
     const char *forAttrString = "for";
     const char *frameAttrString = "frame";
     const char *frameborderAttrString = "frameborder";
@@ -987,6 +1077,7 @@ void init()
     const char *http_equivAttrString = "http-equiv";
     const char *idAttrString = "id";
     const char *incrementalAttrString = "incremental";
+    const char *indeterminateAttrString = "indeterminate";
     const char *ismapAttrString = "ismap";
     const char *keytypeAttrString = "keytype";
     const char *labelAttrString = "label";
@@ -1021,6 +1112,8 @@ void init()
     const char *onbeforepasteAttrString = "onbeforepaste";
     const char *onbeforeunloadAttrString = "onbeforeunload";
     const char *onblurAttrString = "onblur";
+    const char *oncanplayAttrString = "oncanplay";
+    const char *oncanplaythroughAttrString = "oncanplaythrough";
     const char *onchangeAttrString = "onchange";
     const char *onclickAttrString = "onclick";
     const char *oncontextmenuAttrString = "oncontextmenu";
@@ -1034,6 +1127,9 @@ void init()
     const char *ondragoverAttrString = "ondragover";
     const char *ondragstartAttrString = "ondragstart";
     const char *ondropAttrString = "ondrop";
+    const char *ondurationchangeAttrString = "ondurationchange";
+    const char *onemptiedAttrString = "onemptied";
+    const char *onendedAttrString = "onended";
     const char *onerrorAttrString = "onerror";
     const char *onfocusAttrString = "onfocus";
     const char *oninputAttrString = "oninput";
@@ -1041,22 +1137,39 @@ void init()
     const char *onkeypressAttrString = "onkeypress";
     const char *onkeyupAttrString = "onkeyup";
     const char *onloadAttrString = "onload";
+    const char *onloadeddataAttrString = "onloadeddata";
+    const char *onloadedmetadataAttrString = "onloadedmetadata";
+    const char *onloadstartAttrString = "onloadstart";
     const char *onmousedownAttrString = "onmousedown";
     const char *onmousemoveAttrString = "onmousemove";
     const char *onmouseoutAttrString = "onmouseout";
     const char *onmouseoverAttrString = "onmouseover";
     const char *onmouseupAttrString = "onmouseup";
     const char *onmousewheelAttrString = "onmousewheel";
+    const char *onofflineAttrString = "onoffline";
+    const char *ononlineAttrString = "ononline";
     const char *onpasteAttrString = "onpaste";
+    const char *onpauseAttrString = "onpause";
+    const char *onplayAttrString = "onplay";
+    const char *onplayingAttrString = "onplaying";
+    const char *onprogressAttrString = "onprogress";
+    const char *onratechangeAttrString = "onratechange";
     const char *onresetAttrString = "onreset";
     const char *onresizeAttrString = "onresize";
     const char *onscrollAttrString = "onscroll";
     const char *onsearchAttrString = "onsearch";
+    const char *onseekedAttrString = "onseeked";
+    const char *onseekingAttrString = "onseeking";
     const char *onselectAttrString = "onselect";
     const char *onselectstartAttrString = "onselectstart";
+    const char *onstalledAttrString = "onstalled";
     const char *onstorageAttrString = "onstorage";
     const char *onsubmitAttrString = "onsubmit";
+    const char *onsuspendAttrString = "onsuspend";
+    const char *ontimeupdateAttrString = "ontimeupdate";
     const char *onunloadAttrString = "onunload";
+    const char *onvolumechangeAttrString = "onvolumechange";
+    const char *onwaitingAttrString = "onwaiting";
     const char *onwebkitanimationendAttrString = "onwebkitanimationend";
     const char *onwebkitanimationiterationAttrString = "onwebkitanimationiteration";
     const char *onwebkitanimationstartAttrString = "onwebkitanimationstart";
@@ -1066,7 +1179,9 @@ void init()
     const char *pluginurlAttrString = "pluginurl";
     const char *posterAttrString = "poster";
     const char *precisionAttrString = "precision";
+    const char *primaryAttrString = "primary";
     const char *profileAttrString = "profile";
+    const char *progressAttrString = "progress";
     const char *promptAttrString = "prompt";
     const char *readonlyAttrString = "readonly";
     const char *relAttrString = "rel";
@@ -1084,7 +1199,10 @@ void init()
     const char *selectedAttrString = "selected";
     const char *shapeAttrString = "shape";
     const char *sizeAttrString = "size";
+    const char *sortableAttrString = "sortable";
+    const char *sortdirectionAttrString = "sortdirection";
     const char *spanAttrString = "span";
+    const char *spellcheckAttrString = "spellcheck";
     const char *srcAttrString = "src";
     const char *standbyAttrString = "standby";
     const char *startAttrString = "start";
@@ -1121,13 +1239,17 @@ void init()
     new ((void*)&aria_activedescendantAttr) QualifiedName(nullAtom, aria_activedescendantAttrString, nullAtom);
     new ((void*)&aria_checkedAttr) QualifiedName(nullAtom, aria_checkedAttrString, nullAtom);
     new ((void*)&aria_describedbyAttr) QualifiedName(nullAtom, aria_describedbyAttrString, nullAtom);
+    new ((void*)&aria_disabledAttr) QualifiedName(nullAtom, aria_disabledAttrString, nullAtom);
+    new ((void*)&aria_hiddenAttr) QualifiedName(nullAtom, aria_hiddenAttrString, nullAtom);
     new ((void*)&aria_labeledbyAttr) QualifiedName(nullAtom, aria_labeledbyAttrString, nullAtom);
     new ((void*)&aria_labelledbyAttr) QualifiedName(nullAtom, aria_labelledbyAttrString, nullAtom);
     new ((void*)&aria_levelAttr) QualifiedName(nullAtom, aria_levelAttrString, nullAtom);
     new ((void*)&aria_pressedAttr) QualifiedName(nullAtom, aria_pressedAttrString, nullAtom);
+    new ((void*)&aria_readonlyAttr) QualifiedName(nullAtom, aria_readonlyAttrString, nullAtom);
     new ((void*)&aria_valuemaxAttr) QualifiedName(nullAtom, aria_valuemaxAttrString, nullAtom);
     new ((void*)&aria_valueminAttr) QualifiedName(nullAtom, aria_valueminAttrString, nullAtom);
     new ((void*)&aria_valuenowAttr) QualifiedName(nullAtom, aria_valuenowAttrString, nullAtom);
+    new ((void*)&autobufferAttr) QualifiedName(nullAtom, autobufferAttrString, nullAtom);
     new ((void*)&autocompleteAttr) QualifiedName(nullAtom, autocompleteAttrString, nullAtom);
     new ((void*)&autofocusAttr) QualifiedName(nullAtom, autofocusAttrString, nullAtom);
     new ((void*)&autoplayAttr) QualifiedName(nullAtom, autoplayAttrString, nullAtom);
@@ -1172,7 +1294,9 @@ void init()
     new ((void*)&disabledAttr) QualifiedName(nullAtom, disabledAttrString, nullAtom);
     new ((void*)&enctypeAttr) QualifiedName(nullAtom, enctypeAttrString, nullAtom);
     new ((void*)&endAttr) QualifiedName(nullAtom, endAttrString, nullAtom);
+    new ((void*)&expandedAttr) QualifiedName(nullAtom, expandedAttrString, nullAtom);
     new ((void*)&faceAttr) QualifiedName(nullAtom, faceAttrString, nullAtom);
+    new ((void*)&focusedAttr) QualifiedName(nullAtom, focusedAttrString, nullAtom);
     new ((void*)&forAttr) QualifiedName(nullAtom, forAttrString, nullAtom);
     new ((void*)&frameAttr) QualifiedName(nullAtom, frameAttrString, nullAtom);
     new ((void*)&frameborderAttr) QualifiedName(nullAtom, frameborderAttrString, nullAtom);
@@ -1185,6 +1309,7 @@ void init()
     new ((void*)&http_equivAttr) QualifiedName(nullAtom, http_equivAttrString, nullAtom);
     new ((void*)&idAttr) QualifiedName(nullAtom, idAttrString, nullAtom);
     new ((void*)&incrementalAttr) QualifiedName(nullAtom, incrementalAttrString, nullAtom);
+    new ((void*)&indeterminateAttr) QualifiedName(nullAtom, indeterminateAttrString, nullAtom);
     new ((void*)&ismapAttr) QualifiedName(nullAtom, ismapAttrString, nullAtom);
     new ((void*)&keytypeAttr) QualifiedName(nullAtom, keytypeAttrString, nullAtom);
     new ((void*)&labelAttr) QualifiedName(nullAtom, labelAttrString, nullAtom);
@@ -1219,6 +1344,8 @@ void init()
     new ((void*)&onbeforepasteAttr) QualifiedName(nullAtom, onbeforepasteAttrString, nullAtom);
     new ((void*)&onbeforeunloadAttr) QualifiedName(nullAtom, onbeforeunloadAttrString, nullAtom);
     new ((void*)&onblurAttr) QualifiedName(nullAtom, onblurAttrString, nullAtom);
+    new ((void*)&oncanplayAttr) QualifiedName(nullAtom, oncanplayAttrString, nullAtom);
+    new ((void*)&oncanplaythroughAttr) QualifiedName(nullAtom, oncanplaythroughAttrString, nullAtom);
     new ((void*)&onchangeAttr) QualifiedName(nullAtom, onchangeAttrString, nullAtom);
     new ((void*)&onclickAttr) QualifiedName(nullAtom, onclickAttrString, nullAtom);
     new ((void*)&oncontextmenuAttr) QualifiedName(nullAtom, oncontextmenuAttrString, nullAtom);
@@ -1232,6 +1359,9 @@ void init()
     new ((void*)&ondragoverAttr) QualifiedName(nullAtom, ondragoverAttrString, nullAtom);
     new ((void*)&ondragstartAttr) QualifiedName(nullAtom, ondragstartAttrString, nullAtom);
     new ((void*)&ondropAttr) QualifiedName(nullAtom, ondropAttrString, nullAtom);
+    new ((void*)&ondurationchangeAttr) QualifiedName(nullAtom, ondurationchangeAttrString, nullAtom);
+    new ((void*)&onemptiedAttr) QualifiedName(nullAtom, onemptiedAttrString, nullAtom);
+    new ((void*)&onendedAttr) QualifiedName(nullAtom, onendedAttrString, nullAtom);
     new ((void*)&onerrorAttr) QualifiedName(nullAtom, onerrorAttrString, nullAtom);
     new ((void*)&onfocusAttr) QualifiedName(nullAtom, onfocusAttrString, nullAtom);
     new ((void*)&oninputAttr) QualifiedName(nullAtom, oninputAttrString, nullAtom);
@@ -1239,22 +1369,39 @@ void init()
     new ((void*)&onkeypressAttr) QualifiedName(nullAtom, onkeypressAttrString, nullAtom);
     new ((void*)&onkeyupAttr) QualifiedName(nullAtom, onkeyupAttrString, nullAtom);
     new ((void*)&onloadAttr) QualifiedName(nullAtom, onloadAttrString, nullAtom);
+    new ((void*)&onloadeddataAttr) QualifiedName(nullAtom, onloadeddataAttrString, nullAtom);
+    new ((void*)&onloadedmetadataAttr) QualifiedName(nullAtom, onloadedmetadataAttrString, nullAtom);
+    new ((void*)&onloadstartAttr) QualifiedName(nullAtom, onloadstartAttrString, nullAtom);
     new ((void*)&onmousedownAttr) QualifiedName(nullAtom, onmousedownAttrString, nullAtom);
     new ((void*)&onmousemoveAttr) QualifiedName(nullAtom, onmousemoveAttrString, nullAtom);
     new ((void*)&onmouseoutAttr) QualifiedName(nullAtom, onmouseoutAttrString, nullAtom);
     new ((void*)&onmouseoverAttr) QualifiedName(nullAtom, onmouseoverAttrString, nullAtom);
     new ((void*)&onmouseupAttr) QualifiedName(nullAtom, onmouseupAttrString, nullAtom);
     new ((void*)&onmousewheelAttr) QualifiedName(nullAtom, onmousewheelAttrString, nullAtom);
+    new ((void*)&onofflineAttr) QualifiedName(nullAtom, onofflineAttrString, nullAtom);
+    new ((void*)&ononlineAttr) QualifiedName(nullAtom, ononlineAttrString, nullAtom);
     new ((void*)&onpasteAttr) QualifiedName(nullAtom, onpasteAttrString, nullAtom);
+    new ((void*)&onpauseAttr) QualifiedName(nullAtom, onpauseAttrString, nullAtom);
+    new ((void*)&onplayAttr) QualifiedName(nullAtom, onplayAttrString, nullAtom);
+    new ((void*)&onplayingAttr) QualifiedName(nullAtom, onplayingAttrString, nullAtom);
+    new ((void*)&onprogressAttr) QualifiedName(nullAtom, onprogressAttrString, nullAtom);
+    new ((void*)&onratechangeAttr) QualifiedName(nullAtom, onratechangeAttrString, nullAtom);
     new ((void*)&onresetAttr) QualifiedName(nullAtom, onresetAttrString, nullAtom);
     new ((void*)&onresizeAttr) QualifiedName(nullAtom, onresizeAttrString, nullAtom);
     new ((void*)&onscrollAttr) QualifiedName(nullAtom, onscrollAttrString, nullAtom);
     new ((void*)&onsearchAttr) QualifiedName(nullAtom, onsearchAttrString, nullAtom);
+    new ((void*)&onseekedAttr) QualifiedName(nullAtom, onseekedAttrString, nullAtom);
+    new ((void*)&onseekingAttr) QualifiedName(nullAtom, onseekingAttrString, nullAtom);
     new ((void*)&onselectAttr) QualifiedName(nullAtom, onselectAttrString, nullAtom);
     new ((void*)&onselectstartAttr) QualifiedName(nullAtom, onselectstartAttrString, nullAtom);
+    new ((void*)&onstalledAttr) QualifiedName(nullAtom, onstalledAttrString, nullAtom);
     new ((void*)&onstorageAttr) QualifiedName(nullAtom, onstorageAttrString, nullAtom);
     new ((void*)&onsubmitAttr) QualifiedName(nullAtom, onsubmitAttrString, nullAtom);
+    new ((void*)&onsuspendAttr) QualifiedName(nullAtom, onsuspendAttrString, nullAtom);
+    new ((void*)&ontimeupdateAttr) QualifiedName(nullAtom, ontimeupdateAttrString, nullAtom);
     new ((void*)&onunloadAttr) QualifiedName(nullAtom, onunloadAttrString, nullAtom);
+    new ((void*)&onvolumechangeAttr) QualifiedName(nullAtom, onvolumechangeAttrString, nullAtom);
+    new ((void*)&onwaitingAttr) QualifiedName(nullAtom, onwaitingAttrString, nullAtom);
     new ((void*)&onwebkitanimationendAttr) QualifiedName(nullAtom, onwebkitanimationendAttrString, nullAtom);
     new ((void*)&onwebkitanimationiterationAttr) QualifiedName(nullAtom, onwebkitanimationiterationAttrString, nullAtom);
     new ((void*)&onwebkitanimationstartAttr) QualifiedName(nullAtom, onwebkitanimationstartAttrString, nullAtom);
@@ -1264,7 +1411,9 @@ void init()
     new ((void*)&pluginurlAttr) QualifiedName(nullAtom, pluginurlAttrString, nullAtom);
     new ((void*)&posterAttr) QualifiedName(nullAtom, posterAttrString, nullAtom);
     new ((void*)&precisionAttr) QualifiedName(nullAtom, precisionAttrString, nullAtom);
+    new ((void*)&primaryAttr) QualifiedName(nullAtom, primaryAttrString, nullAtom);
     new ((void*)&profileAttr) QualifiedName(nullAtom, profileAttrString, nullAtom);
+    new ((void*)&progressAttr) QualifiedName(nullAtom, progressAttrString, nullAtom);
     new ((void*)&promptAttr) QualifiedName(nullAtom, promptAttrString, nullAtom);
     new ((void*)&readonlyAttr) QualifiedName(nullAtom, readonlyAttrString, nullAtom);
     new ((void*)&relAttr) QualifiedName(nullAtom, relAttrString, nullAtom);
@@ -1282,7 +1431,10 @@ void init()
     new ((void*)&selectedAttr) QualifiedName(nullAtom, selectedAttrString, nullAtom);
     new ((void*)&shapeAttr) QualifiedName(nullAtom, shapeAttrString, nullAtom);
     new ((void*)&sizeAttr) QualifiedName(nullAtom, sizeAttrString, nullAtom);
+    new ((void*)&sortableAttr) QualifiedName(nullAtom, sortableAttrString, nullAtom);
+    new ((void*)&sortdirectionAttr) QualifiedName(nullAtom, sortdirectionAttrString, nullAtom);
     new ((void*)&spanAttr) QualifiedName(nullAtom, spanAttrString, nullAtom);
+    new ((void*)&spellcheckAttr) QualifiedName(nullAtom, spellcheckAttrString, nullAtom);
     new ((void*)&srcAttr) QualifiedName(nullAtom, srcAttrString, nullAtom);
     new ((void*)&standbyAttr) QualifiedName(nullAtom, standbyAttrString, nullAtom);
     new ((void*)&startAttr) QualifiedName(nullAtom, startAttrString, nullAtom);
diff --git a/src/3rdparty/webkit/WebCore/generated/HTMLNames.h b/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
index 507a0a5..fba6088 100644
--- a/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/HTMLNames.h
@@ -64,12 +64,16 @@ extern const WebCore::QualifiedName citeTag;
 extern const WebCore::QualifiedName codeTag;
 extern const WebCore::QualifiedName colTag;
 extern const WebCore::QualifiedName colgroupTag;
+extern const WebCore::QualifiedName datagridTag;
+extern const WebCore::QualifiedName dcellTag;
+extern const WebCore::QualifiedName dcolTag;
 extern const WebCore::QualifiedName ddTag;
 extern const WebCore::QualifiedName delTag;
 extern const WebCore::QualifiedName dfnTag;
 extern const WebCore::QualifiedName dirTag;
 extern const WebCore::QualifiedName divTag;
 extern const WebCore::QualifiedName dlTag;
+extern const WebCore::QualifiedName drowTag;
 extern const WebCore::QualifiedName dtTag;
 extern const WebCore::QualifiedName emTag;
 extern const WebCore::QualifiedName embedTag;
@@ -148,9 +152,6 @@ extern const WebCore::QualifiedName varTag;
 extern const WebCore::QualifiedName videoTag;
 extern const WebCore::QualifiedName wbrTag;
 extern const WebCore::QualifiedName xmpTag;
-
-
-WebCore::QualifiedName** getHTMLTags(size_t* size);
 // Attributes
 extern const WebCore::QualifiedName abbrAttr;
 extern const WebCore::QualifiedName acceptAttr;
@@ -164,13 +165,17 @@ extern const WebCore::QualifiedName archiveAttr;
 extern const WebCore::QualifiedName aria_activedescendantAttr;
 extern const WebCore::QualifiedName aria_checkedAttr;
 extern const WebCore::QualifiedName aria_describedbyAttr;
+extern const WebCore::QualifiedName aria_disabledAttr;
+extern const WebCore::QualifiedName aria_hiddenAttr;
 extern const WebCore::QualifiedName aria_labeledbyAttr;
 extern const WebCore::QualifiedName aria_labelledbyAttr;
 extern const WebCore::QualifiedName aria_levelAttr;
 extern const WebCore::QualifiedName aria_pressedAttr;
+extern const WebCore::QualifiedName aria_readonlyAttr;
 extern const WebCore::QualifiedName aria_valuemaxAttr;
 extern const WebCore::QualifiedName aria_valueminAttr;
 extern const WebCore::QualifiedName aria_valuenowAttr;
+extern const WebCore::QualifiedName autobufferAttr;
 extern const WebCore::QualifiedName autocompleteAttr;
 extern const WebCore::QualifiedName autofocusAttr;
 extern const WebCore::QualifiedName autoplayAttr;
@@ -216,7 +221,9 @@ extern const WebCore::QualifiedName directionAttr;
 extern const WebCore::QualifiedName disabledAttr;
 extern const WebCore::QualifiedName enctypeAttr;
 extern const WebCore::QualifiedName endAttr;
+extern const WebCore::QualifiedName expandedAttr;
 extern const WebCore::QualifiedName faceAttr;
+extern const WebCore::QualifiedName focusedAttr;
 extern const WebCore::QualifiedName forAttr;
 extern const WebCore::QualifiedName frameAttr;
 extern const WebCore::QualifiedName frameborderAttr;
@@ -229,6 +236,7 @@ extern const WebCore::QualifiedName hspaceAttr;
 extern const WebCore::QualifiedName http_equivAttr;
 extern const WebCore::QualifiedName idAttr;
 extern const WebCore::QualifiedName incrementalAttr;
+extern const WebCore::QualifiedName indeterminateAttr;
 extern const WebCore::QualifiedName ismapAttr;
 extern const WebCore::QualifiedName keytypeAttr;
 extern const WebCore::QualifiedName labelAttr;
@@ -263,6 +271,8 @@ extern const WebCore::QualifiedName onbeforecutAttr;
 extern const WebCore::QualifiedName onbeforepasteAttr;
 extern const WebCore::QualifiedName onbeforeunloadAttr;
 extern const WebCore::QualifiedName onblurAttr;
+extern const WebCore::QualifiedName oncanplayAttr;
+extern const WebCore::QualifiedName oncanplaythroughAttr;
 extern const WebCore::QualifiedName onchangeAttr;
 extern const WebCore::QualifiedName onclickAttr;
 extern const WebCore::QualifiedName oncontextmenuAttr;
@@ -276,6 +286,9 @@ extern const WebCore::QualifiedName ondragleaveAttr;
 extern const WebCore::QualifiedName ondragoverAttr;
 extern const WebCore::QualifiedName ondragstartAttr;
 extern const WebCore::QualifiedName ondropAttr;
+extern const WebCore::QualifiedName ondurationchangeAttr;
+extern const WebCore::QualifiedName onemptiedAttr;
+extern const WebCore::QualifiedName onendedAttr;
 extern const WebCore::QualifiedName onerrorAttr;
 extern const WebCore::QualifiedName onfocusAttr;
 extern const WebCore::QualifiedName oninputAttr;
@@ -283,22 +296,39 @@ extern const WebCore::QualifiedName onkeydownAttr;
 extern const WebCore::QualifiedName onkeypressAttr;
 extern const WebCore::QualifiedName onkeyupAttr;
 extern const WebCore::QualifiedName onloadAttr;
+extern const WebCore::QualifiedName onloadeddataAttr;
+extern const WebCore::QualifiedName onloadedmetadataAttr;
+extern const WebCore::QualifiedName onloadstartAttr;
 extern const WebCore::QualifiedName onmousedownAttr;
 extern const WebCore::QualifiedName onmousemoveAttr;
 extern const WebCore::QualifiedName onmouseoutAttr;
 extern const WebCore::QualifiedName onmouseoverAttr;
 extern const WebCore::QualifiedName onmouseupAttr;
 extern const WebCore::QualifiedName onmousewheelAttr;
+extern const WebCore::QualifiedName onofflineAttr;
+extern const WebCore::QualifiedName ononlineAttr;
 extern const WebCore::QualifiedName onpasteAttr;
+extern const WebCore::QualifiedName onpauseAttr;
+extern const WebCore::QualifiedName onplayAttr;
+extern const WebCore::QualifiedName onplayingAttr;
+extern const WebCore::QualifiedName onprogressAttr;
+extern const WebCore::QualifiedName onratechangeAttr;
 extern const WebCore::QualifiedName onresetAttr;
 extern const WebCore::QualifiedName onresizeAttr;
 extern const WebCore::QualifiedName onscrollAttr;
 extern const WebCore::QualifiedName onsearchAttr;
+extern const WebCore::QualifiedName onseekedAttr;
+extern const WebCore::QualifiedName onseekingAttr;
 extern const WebCore::QualifiedName onselectAttr;
 extern const WebCore::QualifiedName onselectstartAttr;
+extern const WebCore::QualifiedName onstalledAttr;
 extern const WebCore::QualifiedName onstorageAttr;
 extern const WebCore::QualifiedName onsubmitAttr;
+extern const WebCore::QualifiedName onsuspendAttr;
+extern const WebCore::QualifiedName ontimeupdateAttr;
 extern const WebCore::QualifiedName onunloadAttr;
+extern const WebCore::QualifiedName onvolumechangeAttr;
+extern const WebCore::QualifiedName onwaitingAttr;
 extern const WebCore::QualifiedName onwebkitanimationendAttr;
 extern const WebCore::QualifiedName onwebkitanimationiterationAttr;
 extern const WebCore::QualifiedName onwebkitanimationstartAttr;
@@ -308,7 +338,9 @@ extern const WebCore::QualifiedName playcountAttr;
 extern const WebCore::QualifiedName pluginurlAttr;
 extern const WebCore::QualifiedName posterAttr;
 extern const WebCore::QualifiedName precisionAttr;
+extern const WebCore::QualifiedName primaryAttr;
 extern const WebCore::QualifiedName profileAttr;
+extern const WebCore::QualifiedName progressAttr;
 extern const WebCore::QualifiedName promptAttr;
 extern const WebCore::QualifiedName readonlyAttr;
 extern const WebCore::QualifiedName relAttr;
@@ -326,7 +358,10 @@ extern const WebCore::QualifiedName scrollingAttr;
 extern const WebCore::QualifiedName selectedAttr;
 extern const WebCore::QualifiedName shapeAttr;
 extern const WebCore::QualifiedName sizeAttr;
+extern const WebCore::QualifiedName sortableAttr;
+extern const WebCore::QualifiedName sortdirectionAttr;
 extern const WebCore::QualifiedName spanAttr;
+extern const WebCore::QualifiedName spellcheckAttr;
 extern const WebCore::QualifiedName srcAttr;
 extern const WebCore::QualifiedName standbyAttr;
 extern const WebCore::QualifiedName startAttr;
@@ -351,11 +386,11 @@ extern const WebCore::QualifiedName vlinkAttr;
 extern const WebCore::QualifiedName vspaceAttr;
 extern const WebCore::QualifiedName widthAttr;
 extern const WebCore::QualifiedName wrapAttr;
-
-
-WebCore::QualifiedName** getHTMLAttr(size_t* size);
 #endif
 
+WebCore::QualifiedName** getHTMLTags(size_t* size);
+WebCore::QualifiedName** getHTMLAttrs(size_t* size);
+
 void init();
 
 } }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp b/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
index f7b7de3..bf9bea5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSAttr.cpp
@@ -19,11 +19,8 @@
 */
 
 #include "config.h"
-
 #include "JSAttr.h"
 
-#include <wtf/GetPtr.h>
-
 #include "Attr.h"
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
@@ -31,14 +28,13 @@
 #include "JSCSSStyleDeclaration.h"
 #include "JSElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSAttr)
+ASSERT_CLASS_FITS_IN_CELL(JSAttr);
 
 /* Hash table */
 
@@ -79,13 +75,13 @@ public:
     JSAttrConstructor(ExecState* exec)
         : DOMObject(JSAttrConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSAttrPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSAttrPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -114,21 +110,21 @@ static const HashTable JSAttrPrototypeTable =
 
 const ClassInfo JSAttrPrototype::s_info = { "AttrPrototype", 0, &JSAttrPrototypeTable, 0 };
 
-JSObject* JSAttrPrototype::self(ExecState* exec)
+JSObject* JSAttrPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSAttr>(exec);
+    return getDOMPrototype<JSAttr>(exec, globalObject);
 }
 
-const ClassInfo JSAttr::s_info = { "Attr", &JSEventTargetNode::s_info, &JSAttrTable, 0 };
+const ClassInfo JSAttr::s_info = { "Attr", &JSNode::s_info, &JSAttrTable, 0 };
 
 JSAttr::JSAttr(PassRefPtr<Structure> structure, PassRefPtr<Attr> impl)
-    : JSEventTargetNode(structure, impl)
+    : JSNode(structure, impl)
 {
 }
 
-JSObject* JSAttr::createPrototype(ExecState* exec)
+JSObject* JSAttr::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSAttrPrototype(JSAttrPrototype::createStructure(JSEventTargetNodePrototype::self(exec)));
+    return new (exec) JSAttrPrototype(JSAttrPrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
 bool JSAttr::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -136,58 +132,63 @@ bool JSAttr::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName,
     return getStaticValueSlot<JSAttr, Base>(exec, &JSAttrTable, this, propertyName, slot);
 }
 
-JSValuePtr jsAttrName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Attr* imp = static_cast<Attr*>(static_cast<JSAttr*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->name());
 }
 
-JSValuePtr jsAttrSpecified(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrSpecified(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Attr* imp = static_cast<Attr*>(static_cast<JSAttr*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->specified());
 }
 
-JSValuePtr jsAttrValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Attr* imp = static_cast<Attr*>(static_cast<JSAttr*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->value());
 }
 
-JSValuePtr jsAttrOwnerElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrOwnerElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Attr* imp = static_cast<Attr*>(static_cast<JSAttr*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->ownerElement()));
 }
 
-JSValuePtr jsAttrStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Attr* imp = static_cast<Attr*>(static_cast<JSAttr*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsAttrConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsAttrConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSAttr*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSAttr::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSAttr::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSAttr, Base>(exec, propertyName, value, &JSAttrTable, this, slot);
 }
 
-void setJSAttrValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSAttrValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSAttr*>(thisObject)->setValue(exec, value);
 }
 
-JSValuePtr JSAttr::getConstructor(ExecState* exec)
+JSValue JSAttr::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSAttrConstructor>(exec);
 }
 
-Attr* toAttr(JSC::JSValuePtr value)
+Attr* toAttr(JSC::JSValue value)
 {
-    return value->isObject(&JSAttr::s_info) ? static_cast<JSAttr*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSAttr::s_info) ? static_cast<JSAttr*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSAttr.h b/src/3rdparty/webkit/WebCore/generated/JSAttr.h
index 40b861e..4d13aa8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSAttr.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSAttr.h
@@ -21,42 +21,44 @@
 #ifndef JSAttr_h
 #define JSAttr_h
 
-#include "JSEventTargetNode.h"
 #include "Attr.h"
+#include "JSNode.h"
+
 namespace WebCore {
 
 class Attr;
 
-class JSAttr : public JSEventTargetNode {
-    typedef JSEventTargetNode Base;
+class JSAttr : public JSNode {
+    typedef JSNode Base;
 public:
     JSAttr(PassRefPtr<JSC::Structure>, PassRefPtr<Attr>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom attributes
-    void setValue(JSC::ExecState*, JSC::JSValuePtr);
+    void setValue(JSC::ExecState*, JSC::JSValue);
     Attr* impl() const
     {
         return static_cast<Attr*>(Base::impl());
     }
 };
 
-Attr* toAttr(JSC::JSValuePtr);
+Attr* toAttr(JSC::JSValue);
 
 class JSAttrPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSAttrPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -64,13 +66,13 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsAttrName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsAttrSpecified(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsAttrValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSAttrValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsAttrOwnerElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsAttrStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsAttrConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsAttrName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsAttrSpecified(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsAttrValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSAttrValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsAttrOwnerElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsAttrStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsAttrConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
index 566468f..25aede5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.cpp
@@ -19,19 +19,16 @@
 */
 
 #include "config.h"
-
 #include "JSBarInfo.h"
 
-#include <wtf/GetPtr.h>
-
 #include "BarInfo.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSBarInfo)
+ASSERT_CLASS_FITS_IN_CELL(JSBarInfo);
 
 /* Hash table */
 
@@ -64,9 +61,9 @@ static const HashTable JSBarInfoPrototypeTable =
 
 const ClassInfo JSBarInfoPrototype::s_info = { "BarInfoPrototype", 0, &JSBarInfoPrototypeTable, 0 };
 
-JSObject* JSBarInfoPrototype::self(ExecState* exec)
+JSObject* JSBarInfoPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSBarInfo>(exec);
+    return getDOMPrototype<JSBarInfo>(exec, globalObject);
 }
 
 const ClassInfo JSBarInfo::s_info = { "BarInfo", 0, &JSBarInfoTable, 0 };
@@ -80,12 +77,11 @@ JSBarInfo::JSBarInfo(PassRefPtr<Structure> structure, PassRefPtr<BarInfo> impl)
 JSBarInfo::~JSBarInfo()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSBarInfo::createPrototype(ExecState* exec)
+JSObject* JSBarInfo::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSBarInfoPrototype(JSBarInfoPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSBarInfoPrototype(JSBarInfoPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSBarInfo::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -93,19 +89,20 @@ bool JSBarInfo::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSBarInfo, Base>(exec, &JSBarInfoTable, this, propertyName, slot);
 }
 
-JSValuePtr jsBarInfoVisible(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsBarInfoVisible(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     BarInfo* imp = static_cast<BarInfo*>(static_cast<JSBarInfo*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->visible());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, BarInfo* object)
+JSC::JSValue toJS(JSC::ExecState* exec, BarInfo* object)
 {
     return getDOMObjectWrapper<JSBarInfo>(exec, object);
 }
-BarInfo* toBarInfo(JSC::JSValuePtr value)
+BarInfo* toBarInfo(JSC::JSValue value)
 {
-    return value->isObject(&JSBarInfo::s_info) ? static_cast<JSBarInfo*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSBarInfo::s_info) ? static_cast<JSBarInfo*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
index f13a62c..c27d6c1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSBarInfo.h
@@ -34,12 +34,12 @@ class JSBarInfo : public DOMObject {
 public:
     JSBarInfo(PassRefPtr<JSC::Structure>, PassRefPtr<BarInfo>);
     virtual ~JSBarInfo();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -50,12 +50,13 @@ private:
     RefPtr<BarInfo> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, BarInfo*);
-BarInfo* toBarInfo(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, BarInfo*);
+BarInfo* toBarInfo(JSC::JSValue);
 
 class JSBarInfoPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSBarInfoPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -63,7 +64,7 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsBarInfoVisible(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsBarInfoVisible(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
index 0374edd..f89540d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.cpp
@@ -19,20 +19,16 @@
 */
 
 #include "config.h"
-
 #include "JSCDATASection.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CDATASection.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCDATASection)
+ASSERT_CLASS_FITS_IN_CELL(JSCDATASection);
 
 /* Hash table */
 
@@ -68,13 +64,13 @@ public:
     JSCDATASectionConstructor(ExecState* exec)
         : DOMObject(JSCDATASectionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCDATASectionPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCDATASectionPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -103,9 +99,9 @@ static const HashTable JSCDATASectionPrototypeTable =
 
 const ClassInfo JSCDATASectionPrototype::s_info = { "CDATASectionPrototype", 0, &JSCDATASectionPrototypeTable, 0 };
 
-JSObject* JSCDATASectionPrototype::self(ExecState* exec)
+JSObject* JSCDATASectionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCDATASection>(exec);
+    return getDOMPrototype<JSCDATASection>(exec, globalObject);
 }
 
 const ClassInfo JSCDATASection::s_info = { "CDATASection", &JSText::s_info, &JSCDATASectionTable, 0 };
@@ -115,9 +111,9 @@ JSCDATASection::JSCDATASection(PassRefPtr<Structure> structure, PassRefPtr<CDATA
 {
 }
 
-JSObject* JSCDATASection::createPrototype(ExecState* exec)
+JSObject* JSCDATASection::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCDATASectionPrototype(JSCDATASectionPrototype::createStructure(JSTextPrototype::self(exec)));
+    return new (exec) JSCDATASectionPrototype(JSCDATASectionPrototype::createStructure(JSTextPrototype::self(exec, globalObject)));
 }
 
 bool JSCDATASection::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -125,11 +121,11 @@ bool JSCDATASection::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSCDATASection, Base>(exec, &JSCDATASectionTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCDATASectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCDATASectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCDATASection*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSCDATASection::getConstructor(ExecState* exec)
+JSValue JSCDATASection::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCDATASectionConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
index b92e3ac..724ca0b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCDATASection.h
@@ -31,23 +31,25 @@ class JSCDATASection : public JSText {
     typedef JSText Base;
 public:
     JSCDATASection(PassRefPtr<JSC::Structure>, PassRefPtr<CDATASection>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
+JSC::JSValue toJSNewlyCreated(JSC::ExecState*, CDATASection*);
 
 class JSCDATASectionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSCDATASectionPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -55,7 +57,7 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsCDATASectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCDATASectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
index 8dfe3c3..15cabbf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.cpp
@@ -19,21 +19,17 @@
 */
 
 #include "config.h"
-
 #include "JSCSSCharsetRule.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSCharsetRule.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSCharsetRule)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSCharsetRule);
 
 /* Hash table */
 
@@ -70,13 +66,13 @@ public:
     JSCSSCharsetRuleConstructor(ExecState* exec)
         : DOMObject(JSCSSCharsetRuleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSCharsetRulePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSCharsetRulePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -105,9 +101,9 @@ static const HashTable JSCSSCharsetRulePrototypeTable =
 
 const ClassInfo JSCSSCharsetRulePrototype::s_info = { "CSSCharsetRulePrototype", 0, &JSCSSCharsetRulePrototypeTable, 0 };
 
-JSObject* JSCSSCharsetRulePrototype::self(ExecState* exec)
+JSObject* JSCSSCharsetRulePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSCharsetRule>(exec);
+    return getDOMPrototype<JSCSSCharsetRule>(exec, globalObject);
 }
 
 const ClassInfo JSCSSCharsetRule::s_info = { "CSSCharsetRule", &JSCSSRule::s_info, &JSCSSCharsetRuleTable, 0 };
@@ -117,9 +113,9 @@ JSCSSCharsetRule::JSCSSCharsetRule(PassRefPtr<Structure> structure, PassRefPtr<C
 {
 }
 
-JSObject* JSCSSCharsetRule::createPrototype(ExecState* exec)
+JSObject* JSCSSCharsetRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSCharsetRulePrototype(JSCSSCharsetRulePrototype::createStructure(JSCSSRulePrototype::self(exec)));
+    return new (exec) JSCSSCharsetRulePrototype(JSCSSCharsetRulePrototype::createStructure(JSCSSRulePrototype::self(exec, globalObject)));
 }
 
 bool JSCSSCharsetRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -127,22 +123,23 @@ bool JSCSSCharsetRule::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSCSSCharsetRule, Base>(exec, &JSCSSCharsetRuleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCSSCharsetRuleEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSCharsetRuleEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSCharsetRule* imp = static_cast<CSSCharsetRule*>(static_cast<JSCSSCharsetRule*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->encoding());
 }
 
-JSValuePtr jsCSSCharsetRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSCharsetRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSCharsetRule*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSCSSCharsetRule::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSCSSCharsetRule::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSCSSCharsetRule, Base>(exec, propertyName, value, &JSCSSCharsetRuleTable, this, slot);
 }
 
-void setJSCSSCharsetRuleEncoding(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCSSCharsetRuleEncoding(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CSSCharsetRule* imp = static_cast<CSSCharsetRule*>(static_cast<JSCSSCharsetRule*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -150,7 +147,7 @@ void setJSCSSCharsetRuleEncoding(ExecState* exec, JSObject* thisObject, JSValueP
     setDOMException(exec, ec);
 }
 
-JSValuePtr JSCSSCharsetRule::getConstructor(ExecState* exec)
+JSValue JSCSSCharsetRule::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSCharsetRuleConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
index 9877f1a..54c3be3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSCharsetRule.h
@@ -31,24 +31,25 @@ class JSCSSCharsetRule : public JSCSSRule {
     typedef JSCSSRule Base;
 public:
     JSCSSCharsetRule(PassRefPtr<JSC::Structure>, PassRefPtr<CSSCharsetRule>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSCSSCharsetRulePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSCSSCharsetRulePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsCSSCharsetRuleEncoding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCSSCharsetRuleEncoding(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCSSCharsetRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSCharsetRuleEncoding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCSSCharsetRuleEncoding(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCSSCharsetRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
index 4109ea8..ab3b3a5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.cpp
@@ -19,23 +19,19 @@
 */
 
 #include "config.h"
-
 #include "JSCSSFontFaceRule.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSFontFaceRule.h"
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "JSCSSStyleDeclaration.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSFontFaceRule)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSFontFaceRule);
 
 /* Hash table */
 
@@ -72,13 +68,13 @@ public:
     JSCSSFontFaceRuleConstructor(ExecState* exec)
         : DOMObject(JSCSSFontFaceRuleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSFontFaceRulePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSFontFaceRulePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -107,9 +103,9 @@ static const HashTable JSCSSFontFaceRulePrototypeTable =
 
 const ClassInfo JSCSSFontFaceRulePrototype::s_info = { "CSSFontFaceRulePrototype", 0, &JSCSSFontFaceRulePrototypeTable, 0 };
 
-JSObject* JSCSSFontFaceRulePrototype::self(ExecState* exec)
+JSObject* JSCSSFontFaceRulePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSFontFaceRule>(exec);
+    return getDOMPrototype<JSCSSFontFaceRule>(exec, globalObject);
 }
 
 const ClassInfo JSCSSFontFaceRule::s_info = { "CSSFontFaceRule", &JSCSSRule::s_info, &JSCSSFontFaceRuleTable, 0 };
@@ -119,9 +115,9 @@ JSCSSFontFaceRule::JSCSSFontFaceRule(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSCSSFontFaceRule::createPrototype(ExecState* exec)
+JSObject* JSCSSFontFaceRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSFontFaceRulePrototype(JSCSSFontFaceRulePrototype::createStructure(JSCSSRulePrototype::self(exec)));
+    return new (exec) JSCSSFontFaceRulePrototype(JSCSSFontFaceRulePrototype::createStructure(JSCSSRulePrototype::self(exec, globalObject)));
 }
 
 bool JSCSSFontFaceRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -129,17 +125,18 @@ bool JSCSSFontFaceRule::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSCSSFontFaceRule, Base>(exec, &JSCSSFontFaceRuleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCSSFontFaceRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSFontFaceRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSFontFaceRule* imp = static_cast<CSSFontFaceRule*>(static_cast<JSCSSFontFaceRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsCSSFontFaceRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSFontFaceRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSFontFaceRule*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSCSSFontFaceRule::getConstructor(ExecState* exec)
+JSValue JSCSSFontFaceRule::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSFontFaceRuleConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
index 1567718..a2acf4c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSFontFaceRule.h
@@ -31,23 +31,24 @@ class JSCSSFontFaceRule : public JSCSSRule {
     typedef JSCSSRule Base;
 public:
     JSCSSFontFaceRule(PassRefPtr<JSC::Structure>, PassRefPtr<CSSFontFaceRule>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSCSSFontFaceRulePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSCSSFontFaceRulePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -55,8 +56,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsCSSFontFaceRuleStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSFontFaceRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSFontFaceRuleStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSFontFaceRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
index bc2dad5..4dc5151 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.cpp
@@ -19,25 +19,21 @@
 */
 
 #include "config.h"
-
 #include "JSCSSImportRule.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSImportRule.h"
 #include "CSSStyleSheet.h"
 #include "JSCSSStyleSheet.h"
 #include "JSMediaList.h"
 #include "KURL.h"
 #include "MediaList.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSImportRule)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSImportRule);
 
 /* Hash table */
 
@@ -76,13 +72,13 @@ public:
     JSCSSImportRuleConstructor(ExecState* exec)
         : DOMObject(JSCSSImportRuleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSImportRulePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSImportRulePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +107,9 @@ static const HashTable JSCSSImportRulePrototypeTable =
 
 const ClassInfo JSCSSImportRulePrototype::s_info = { "CSSImportRulePrototype", 0, &JSCSSImportRulePrototypeTable, 0 };
 
-JSObject* JSCSSImportRulePrototype::self(ExecState* exec)
+JSObject* JSCSSImportRulePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSImportRule>(exec);
+    return getDOMPrototype<JSCSSImportRule>(exec, globalObject);
 }
 
 const ClassInfo JSCSSImportRule::s_info = { "CSSImportRule", &JSCSSRule::s_info, &JSCSSImportRuleTable, 0 };
@@ -123,9 +119,9 @@ JSCSSImportRule::JSCSSImportRule(PassRefPtr<Structure> structure, PassRefPtr<CSS
 {
 }
 
-JSObject* JSCSSImportRule::createPrototype(ExecState* exec)
+JSObject* JSCSSImportRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSImportRulePrototype(JSCSSImportRulePrototype::createStructure(JSCSSRulePrototype::self(exec)));
+    return new (exec) JSCSSImportRulePrototype(JSCSSImportRulePrototype::createStructure(JSCSSRulePrototype::self(exec, globalObject)));
 }
 
 bool JSCSSImportRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,29 +129,32 @@ bool JSCSSImportRule::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSCSSImportRule, Base>(exec, &JSCSSImportRuleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCSSImportRuleHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSImportRuleHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSImportRule* imp = static_cast<CSSImportRule*>(static_cast<JSCSSImportRule*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->href());
 }
 
-JSValuePtr jsCSSImportRuleMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSImportRuleMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSImportRule* imp = static_cast<CSSImportRule*>(static_cast<JSCSSImportRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->media()));
 }
 
-JSValuePtr jsCSSImportRuleStyleSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSImportRuleStyleSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSImportRule* imp = static_cast<CSSImportRule*>(static_cast<JSCSSImportRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->styleSheet()));
 }
 
-JSValuePtr jsCSSImportRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSImportRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSImportRule*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSCSSImportRule::getConstructor(ExecState* exec)
+JSValue JSCSSImportRule::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSImportRuleConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h
index 19ed0d7..14bae40 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSImportRule.h
@@ -31,23 +31,24 @@ class JSCSSImportRule : public JSCSSRule {
     typedef JSCSSRule Base;
 public:
     JSCSSImportRule(PassRefPtr<JSC::Structure>, PassRefPtr<CSSImportRule>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSCSSImportRulePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSCSSImportRulePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -55,10 +56,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsCSSImportRuleHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSImportRuleMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSImportRuleStyleSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSImportRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSImportRuleHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSImportRuleMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSImportRuleStyleSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSImportRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp
index 727157d..35589af 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.cpp
@@ -19,25 +19,22 @@
 */
 
 #include "config.h"
-
 #include "JSCSSMediaRule.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMediaRule.h"
 #include "CSSRuleList.h"
 #include "JSCSSRuleList.h"
 #include "JSMediaList.h"
 #include "MediaList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSMediaRule)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSMediaRule);
 
 /* Hash table */
 
@@ -75,13 +72,13 @@ public:
     JSCSSMediaRuleConstructor(ExecState* exec)
         : DOMObject(JSCSSMediaRuleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSMediaRulePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSMediaRulePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -112,9 +109,9 @@ static const HashTable JSCSSMediaRulePrototypeTable =
 
 const ClassInfo JSCSSMediaRulePrototype::s_info = { "CSSMediaRulePrototype", 0, &JSCSSMediaRulePrototypeTable, 0 };
 
-JSObject* JSCSSMediaRulePrototype::self(ExecState* exec)
+JSObject* JSCSSMediaRulePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSMediaRule>(exec);
+    return getDOMPrototype<JSCSSMediaRule>(exec, globalObject);
 }
 
 bool JSCSSMediaRulePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -129,9 +126,9 @@ JSCSSMediaRule::JSCSSMediaRule(PassRefPtr<Structure> structure, PassRefPtr<CSSMe
 {
 }
 
-JSObject* JSCSSMediaRule::createPrototype(ExecState* exec)
+JSObject* JSCSSMediaRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSMediaRulePrototype(JSCSSMediaRulePrototype::createStructure(JSCSSRulePrototype::self(exec)));
+    return new (exec) JSCSSMediaRulePrototype(JSCSSMediaRulePrototype::createStructure(JSCSSRulePrototype::self(exec, globalObject)));
 }
 
 bool JSCSSMediaRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -139,51 +136,55 @@ bool JSCSSMediaRule::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSCSSMediaRule, Base>(exec, &JSCSSMediaRuleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCSSMediaRuleMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSMediaRuleMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSMediaRule* imp = static_cast<CSSMediaRule*>(static_cast<JSCSSMediaRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->media()));
 }
 
-JSValuePtr jsCSSMediaRuleCssRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSMediaRuleCssRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSMediaRule* imp = static_cast<CSSMediaRule*>(static_cast<JSCSSMediaRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->cssRules()));
 }
 
-JSValuePtr jsCSSMediaRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSMediaRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSMediaRule*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSCSSMediaRule::getConstructor(ExecState* exec)
+JSValue JSCSSMediaRule::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSMediaRuleConstructor>(exec);
 }
 
-JSValuePtr jsCSSMediaRulePrototypeFunctionInsertRule(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSMediaRulePrototypeFunctionInsertRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSMediaRule::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSMediaRule::s_info))
         return throwError(exec, TypeError);
     JSCSSMediaRule* castedThisObj = static_cast<JSCSSMediaRule*>(asObject(thisValue));
     CSSMediaRule* imp = static_cast<CSSMediaRule*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& rule = args.at(exec, 0)->toString(exec);
-    unsigned index = args.at(exec, 1)->toInt32(exec);
+    const UString& rule = args.at(0).toString(exec);
+    unsigned index = args.at(1).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->insertRule(rule, index, ec));
+    JSC::JSValue result = jsNumber(exec, imp->insertRule(rule, index, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCSSMediaRulePrototypeFunctionDeleteRule(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSMediaRulePrototypeFunctionDeleteRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSMediaRule::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSMediaRule::s_info))
         return throwError(exec, TypeError);
     JSCSSMediaRule* castedThisObj = static_cast<JSCSSMediaRule*>(asObject(thisValue));
     CSSMediaRule* imp = static_cast<CSSMediaRule*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
     imp->deleteRule(index, ec);
     setDOMException(exec, ec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h
index 79a9332..bccda5d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSMediaRule.h
@@ -31,27 +31,28 @@ class JSCSSMediaRule : public JSCSSRule {
     typedef JSCSSRule Base;
 public:
     JSCSSMediaRule(PassRefPtr<JSC::Structure>, PassRefPtr<CSSMediaRule>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSCSSMediaRulePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,13 +61,13 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsCSSMediaRulePrototypeFunctionInsertRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSMediaRulePrototypeFunctionDeleteRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSMediaRulePrototypeFunctionInsertRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSMediaRulePrototypeFunctionDeleteRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsCSSMediaRuleMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSMediaRuleCssRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSMediaRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSMediaRuleMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSMediaRuleCssRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSMediaRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp
index 588dc5e..6869a49 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.cpp
@@ -19,24 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSCSSPageRule.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSPageRule.h"
 #include "CSSStyleDeclaration.h"
 #include "JSCSSStyleDeclaration.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSPageRule)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSPageRule);
 
 /* Hash table */
 
@@ -74,13 +70,13 @@ public:
     JSCSSPageRuleConstructor(ExecState* exec)
         : DOMObject(JSCSSPageRuleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSPageRulePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSPageRulePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +105,9 @@ static const HashTable JSCSSPageRulePrototypeTable =
 
 const ClassInfo JSCSSPageRulePrototype::s_info = { "CSSPageRulePrototype", 0, &JSCSSPageRulePrototypeTable, 0 };
 
-JSObject* JSCSSPageRulePrototype::self(ExecState* exec)
+JSObject* JSCSSPageRulePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSPageRule>(exec);
+    return getDOMPrototype<JSCSSPageRule>(exec, globalObject);
 }
 
 const ClassInfo JSCSSPageRule::s_info = { "CSSPageRule", &JSCSSRule::s_info, &JSCSSPageRuleTable, 0 };
@@ -121,9 +117,9 @@ JSCSSPageRule::JSCSSPageRule(PassRefPtr<Structure> structure, PassRefPtr<CSSPage
 {
 }
 
-JSObject* JSCSSPageRule::createPrototype(ExecState* exec)
+JSObject* JSCSSPageRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSPageRulePrototype(JSCSSPageRulePrototype::createStructure(JSCSSRulePrototype::self(exec)));
+    return new (exec) JSCSSPageRulePrototype(JSCSSPageRulePrototype::createStructure(JSCSSRulePrototype::self(exec, globalObject)));
 }
 
 bool JSCSSPageRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,28 +127,30 @@ bool JSCSSPageRule::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSCSSPageRule, Base>(exec, &JSCSSPageRuleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCSSPageRuleSelectorText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSPageRuleSelectorText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSPageRule* imp = static_cast<CSSPageRule*>(static_cast<JSCSSPageRule*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->selectorText());
 }
 
-JSValuePtr jsCSSPageRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSPageRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSPageRule* imp = static_cast<CSSPageRule*>(static_cast<JSCSSPageRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsCSSPageRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSPageRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSPageRule*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSCSSPageRule::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSCSSPageRule::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSCSSPageRule, Base>(exec, propertyName, value, &JSCSSPageRuleTable, this, slot);
 }
 
-void setJSCSSPageRuleSelectorText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCSSPageRuleSelectorText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CSSPageRule* imp = static_cast<CSSPageRule*>(static_cast<JSCSSPageRule*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -160,7 +158,7 @@ void setJSCSSPageRuleSelectorText(ExecState* exec, JSObject* thisObject, JSValue
     setDOMException(exec, ec);
 }
 
-JSValuePtr JSCSSPageRule::getConstructor(ExecState* exec)
+JSValue JSCSSPageRule::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSPageRuleConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h
index 1fda2df..a815990 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPageRule.h
@@ -31,24 +31,25 @@ class JSCSSPageRule : public JSCSSRule {
     typedef JSCSSRule Base;
 public:
     JSCSSPageRule(PassRefPtr<JSC::Structure>, PassRefPtr<CSSPageRule>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSCSSPageRulePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSCSSPageRulePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,10 +57,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsCSSPageRuleSelectorText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCSSPageRuleSelectorText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCSSPageRuleStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPageRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPageRuleSelectorText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCSSPageRuleSelectorText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCSSPageRuleStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPageRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp
index 21012ee..61a39ec 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.cpp
@@ -19,11 +19,8 @@
 */
 
 #include "config.h"
-
 #include "JSCSSPrimitiveValue.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSPrimitiveValue.h"
 #include "Counter.h"
 #include "JSCounter.h"
@@ -31,16 +28,16 @@
 #include "JSRect.h"
 #include "KURL.h"
 #include "Rect.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSPrimitiveValue)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSPrimitiveValue);
 
 /* Hash table */
 
@@ -103,13 +100,13 @@ public:
     JSCSSPrimitiveValueConstructor(ExecState* exec)
         : DOMObject(JSCSSPrimitiveValueConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSPrimitiveValuePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSPrimitiveValuePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -171,9 +168,9 @@ static const HashTable JSCSSPrimitiveValuePrototypeTable =
 
 const ClassInfo JSCSSPrimitiveValuePrototype::s_info = { "CSSPrimitiveValuePrototype", 0, &JSCSSPrimitiveValuePrototypeTable, 0 };
 
-JSObject* JSCSSPrimitiveValuePrototype::self(ExecState* exec)
+JSObject* JSCSSPrimitiveValuePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSPrimitiveValue>(exec);
+    return getDOMPrototype<JSCSSPrimitiveValue>(exec, globalObject);
 }
 
 bool JSCSSPrimitiveValuePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -188,9 +185,9 @@ JSCSSPrimitiveValue::JSCSSPrimitiveValue(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSCSSPrimitiveValue::createPrototype(ExecState* exec)
+JSObject* JSCSSPrimitiveValue::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSPrimitiveValuePrototype(JSCSSPrimitiveValuePrototype::createStructure(JSCSSValuePrototype::self(exec)));
+    return new (exec) JSCSSPrimitiveValuePrototype(JSCSSPrimitiveValuePrototype::createStructure(JSCSSValuePrototype::self(exec, globalObject)));
 }
 
 bool JSCSSPrimitiveValue::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -198,250 +195,258 @@ bool JSCSSPrimitiveValue::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSCSSPrimitiveValue, Base>(exec, &JSCSSPrimitiveValueTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCSSPrimitiveValuePrimitiveType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSPrimitiveValuePrimitiveType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(static_cast<JSCSSPrimitiveValue*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->primitiveType());
 }
 
-JSValuePtr jsCSSPrimitiveValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSPrimitiveValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSPrimitiveValue*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSCSSPrimitiveValue::getConstructor(ExecState* exec)
+JSValue JSCSSPrimitiveValue::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSPrimitiveValueConstructor>(exec);
 }
 
-JSValuePtr jsCSSPrimitiveValuePrototypeFunctionSetFloatValue(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionSetFloatValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSPrimitiveValue::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSPrimitiveValue::s_info))
         return throwError(exec, TypeError);
     JSCSSPrimitiveValue* castedThisObj = static_cast<JSCSSPrimitiveValue*>(asObject(thisValue));
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned short unitType = args.at(exec, 0)->toInt32(exec);
-    float floatValue = args.at(exec, 1)->toFloat(exec);
+    unsigned short unitType = args.at(0).toInt32(exec);
+    float floatValue = args.at(1).toFloat(exec);
 
     imp->setFloatValue(unitType, floatValue, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsCSSPrimitiveValuePrototypeFunctionGetFloatValue(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetFloatValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSPrimitiveValue::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSPrimitiveValue::s_info))
         return throwError(exec, TypeError);
     JSCSSPrimitiveValue* castedThisObj = static_cast<JSCSSPrimitiveValue*>(asObject(thisValue));
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned short unitType = args.at(exec, 0)->toInt32(exec);
+    unsigned short unitType = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getFloatValue(unitType, ec));
+    JSC::JSValue result = jsNumber(exec, imp->getFloatValue(unitType, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCSSPrimitiveValuePrototypeFunctionSetStringValue(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionSetStringValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSPrimitiveValue::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSPrimitiveValue::s_info))
         return throwError(exec, TypeError);
     JSCSSPrimitiveValue* castedThisObj = static_cast<JSCSSPrimitiveValue*>(asObject(thisValue));
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned short stringType = args.at(exec, 0)->toInt32(exec);
-    const UString& stringValue = args.at(exec, 1)->toString(exec);
+    unsigned short stringType = args.at(0).toInt32(exec);
+    const UString& stringValue = args.at(1).toString(exec);
 
     imp->setStringValue(stringType, stringValue, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsCSSPrimitiveValuePrototypeFunctionGetStringValue(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetStringValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSPrimitiveValue::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSPrimitiveValue::s_info))
         return throwError(exec, TypeError);
     JSCSSPrimitiveValue* castedThisObj = static_cast<JSCSSPrimitiveValue*>(asObject(thisValue));
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->getStringValue(ec));
+    JSC::JSValue result = jsString(exec, imp->getStringValue(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCSSPrimitiveValuePrototypeFunctionGetCounterValue(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetCounterValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSPrimitiveValue::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSPrimitiveValue::s_info))
         return throwError(exec, TypeError);
     JSCSSPrimitiveValue* castedThisObj = static_cast<JSCSSPrimitiveValue*>(asObject(thisValue));
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getCounterValue(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getCounterValue(ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCSSPrimitiveValuePrototypeFunctionGetRectValue(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetRectValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSPrimitiveValue::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSPrimitiveValue::s_info))
         return throwError(exec, TypeError);
     JSCSSPrimitiveValue* castedThisObj = static_cast<JSCSSPrimitiveValue*>(asObject(thisValue));
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getRectValue(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getRectValue(ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCSSPrimitiveValuePrototypeFunctionGetRGBColorValue(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetRGBColorValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSPrimitiveValue::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSPrimitiveValue::s_info))
         return throwError(exec, TypeError);
     JSCSSPrimitiveValue* castedThisObj = static_cast<JSCSSPrimitiveValue*>(asObject(thisValue));
     CSSPrimitiveValue* imp = static_cast<CSSPrimitiveValue*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = getJSRGBColor(exec, imp->getRGBColorValue(ec));
+    JSC::JSValue result = getJSRGBColor(exec, imp->getRGBColorValue(ec));
     setDOMException(exec, ec);
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsCSSPrimitiveValueCSS_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_NUMBER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_NUMBER(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_PERCENTAGE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_PERCENTAGE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_EMS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_EMS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_EXS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_EXS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_PX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_PX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_CM(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_CM(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_MM(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_MM(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_IN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_IN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_PT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_PT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_PC(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_PC(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(10));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_DEG(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_DEG(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(11));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_RAD(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_RAD(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(12));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_GRAD(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_GRAD(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(13));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_MS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_MS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(14));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_S(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_S(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(15));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_HZ(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_HZ(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(16));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_KHZ(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_KHZ(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(17));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_DIMENSION(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_DIMENSION(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(18));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_STRING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_STRING(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(19));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_URI(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_URI(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(20));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_IDENT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_IDENT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(21));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_ATTR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_ATTR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(22));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_COUNTER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_COUNTER(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(23));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_RECT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_RECT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(24));
 }
 
-JSValuePtr jsCSSPrimitiveValueCSS_RGBCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSPrimitiveValueCSS_RGBCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(25));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h
index 94c46f2..39416aa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSPrimitiveValue.h
@@ -31,27 +31,28 @@ class JSCSSPrimitiveValue : public JSCSSValue {
     typedef JSCSSValue Base;
 public:
     JSCSSPrimitiveValue(PassRefPtr<JSC::Structure>, PassRefPtr<CSSPrimitiveValue>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSCSSPrimitiveValuePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,45 +61,45 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsCSSPrimitiveValuePrototypeFunctionSetFloatValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSPrimitiveValuePrototypeFunctionGetFloatValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSPrimitiveValuePrototypeFunctionSetStringValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSPrimitiveValuePrototypeFunctionGetStringValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSPrimitiveValuePrototypeFunctionGetCounterValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSPrimitiveValuePrototypeFunctionGetRectValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSPrimitiveValuePrototypeFunctionGetRGBColorValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionSetFloatValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetFloatValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionSetStringValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetStringValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetCounterValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetRectValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSPrimitiveValuePrototypeFunctionGetRGBColorValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsCSSPrimitiveValuePrimitiveType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValuePrimitiveType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_NUMBER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_PERCENTAGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_EMS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_EXS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_PX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_CM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_MM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_IN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_PT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_PC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_DEG(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_RAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_GRAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_MS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_S(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_HZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_KHZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_DIMENSION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_STRING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_URI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_IDENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_ATTR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_COUNTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_RECT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSPrimitiveValueCSS_RGBCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_NUMBER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_PERCENTAGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_EMS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_EXS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_PX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_CM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_MM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_IN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_PT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_PC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_DEG(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_RAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_GRAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_MS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_S(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_HZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_KHZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_DIMENSION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_STRING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_URI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_IDENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_ATTR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_COUNTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_RECT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSPrimitiveValueCSS_RGBCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
index 3dc2b55..31a4dc3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.cpp
@@ -19,24 +19,21 @@
 */
 
 #include "config.h"
-
 #include "JSCSSRule.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSRule.h"
 #include "CSSStyleSheet.h"
 #include "JSCSSRule.h"
 #include "JSCSSStyleSheet.h"
 #include "KURL.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSRule)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSRule);
 
 /* Hash table */
 
@@ -86,13 +83,13 @@ public:
     JSCSSRuleConstructor(ExecState* exec)
         : DOMObject(JSCSSRuleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSRulePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSRulePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -131,9 +128,9 @@ static const HashTable JSCSSRulePrototypeTable =
 
 const ClassInfo JSCSSRulePrototype::s_info = { "CSSRulePrototype", 0, &JSCSSRulePrototypeTable, 0 };
 
-JSObject* JSCSSRulePrototype::self(ExecState* exec)
+JSObject* JSCSSRulePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSRule>(exec);
+    return getDOMPrototype<JSCSSRule>(exec, globalObject);
 }
 
 bool JSCSSRulePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -152,12 +149,11 @@ JSCSSRule::JSCSSRule(PassRefPtr<Structure> structure, PassRefPtr<CSSRule> impl)
 JSCSSRule::~JSCSSRule()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSCSSRule::createPrototype(ExecState* exec)
+JSObject* JSCSSRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSRulePrototype(JSCSSRulePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSCSSRulePrototype(JSCSSRulePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSCSSRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -165,40 +161,44 @@ bool JSCSSRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSCSSRule, Base>(exec, &JSCSSRuleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCSSRuleType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSRule* imp = static_cast<CSSRule*>(static_cast<JSCSSRule*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->type());
 }
 
-JSValuePtr jsCSSRuleCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSRule* imp = static_cast<CSSRule*>(static_cast<JSCSSRule*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->cssText());
 }
 
-JSValuePtr jsCSSRuleParentStyleSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleParentStyleSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSRule* imp = static_cast<CSSRule*>(static_cast<JSCSSRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->parentStyleSheet()));
 }
 
-JSValuePtr jsCSSRuleParentRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleParentRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSRule* imp = static_cast<CSSRule*>(static_cast<JSCSSRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->parentRule()));
 }
 
-JSValuePtr jsCSSRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSRule*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSCSSRule::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSCSSRule::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSCSSRule, Base>(exec, propertyName, value, &JSCSSRuleTable, this, slot);
 }
 
-void setJSCSSRuleCssText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCSSRuleCssText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CSSRule* imp = static_cast<CSSRule*>(static_cast<JSCSSRule*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -206,66 +206,66 @@ void setJSCSSRuleCssText(ExecState* exec, JSObject* thisObject, JSValuePtr value
     setDOMException(exec, ec);
 }
 
-JSValuePtr JSCSSRule::getConstructor(ExecState* exec)
+JSValue JSCSSRule::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSRuleConstructor>(exec);
 }
 
 // Constant getters
 
-JSValuePtr jsCSSRuleUNKNOWN_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleUNKNOWN_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsCSSRuleSTYLE_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleSTYLE_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsCSSRuleCHARSET_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleCHARSET_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsCSSRuleIMPORT_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleIMPORT_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsCSSRuleMEDIA_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleMEDIA_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsCSSRuleFONT_FACE_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleFONT_FACE_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValuePtr jsCSSRulePAGE_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRulePAGE_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValuePtr jsCSSRuleVARIABLES_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleVARIABLES_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValuePtr jsCSSRuleWEBKIT_KEYFRAMES_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleWEBKIT_KEYFRAMES_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValuePtr jsCSSRuleWEBKIT_KEYFRAME_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSRuleWEBKIT_KEYFRAME_RULE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-CSSRule* toCSSRule(JSC::JSValuePtr value)
+CSSRule* toCSSRule(JSC::JSValue value)
 {
-    return value->isObject(&JSCSSRule::s_info) ? static_cast<JSCSSRule*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSCSSRule::s_info) ? static_cast<JSCSSRule*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h
index 0412812..75bb902 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRule.h
@@ -34,34 +34,35 @@ class JSCSSRule : public DOMObject {
 public:
     JSCSSRule(PassRefPtr<JSC::Structure>, PassRefPtr<CSSRule>);
     virtual ~JSCSSRule();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     CSSRule* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<CSSRule> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, CSSRule*);
-CSSRule* toCSSRule(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, CSSRule*);
+CSSRule* toCSSRule(JSC::JSValue);
 
 class JSCSSRulePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -70,24 +71,24 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsCSSRuleType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCSSRuleCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCSSRuleParentStyleSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleParentRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCSSRuleCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCSSRuleParentStyleSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleParentRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsCSSRuleUNKNOWN_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleSTYLE_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleCHARSET_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleIMPORT_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleMEDIA_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleFONT_FACE_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRulePAGE_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleVARIABLES_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleWEBKIT_KEYFRAMES_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleWEBKIT_KEYFRAME_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleUNKNOWN_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleSTYLE_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleCHARSET_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleIMPORT_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleMEDIA_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleFONT_FACE_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRulePAGE_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleVARIABLES_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleWEBKIT_KEYFRAMES_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleWEBKIT_KEYFRAME_RULE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
index 5a46eba..19e9d14 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.cpp
@@ -19,24 +19,21 @@
 */
 
 #include "config.h"
-
 #include "JSCSSRuleList.h"
 
-#include <wtf/GetPtr.h>
-
-#include <runtime/PropertyNameArray.h>
 #include "CSSRule.h"
 #include "CSSRuleList.h"
 #include "JSCSSRule.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSRuleList)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSRuleList);
 
 /* Hash table */
 
@@ -73,13 +70,13 @@ public:
     JSCSSRuleListConstructor(ExecState* exec)
         : DOMObject(JSCSSRuleListConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSRuleListPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSRuleListPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +106,9 @@ static const HashTable JSCSSRuleListPrototypeTable =
 
 const ClassInfo JSCSSRuleListPrototype::s_info = { "CSSRuleListPrototype", 0, &JSCSSRuleListPrototypeTable, 0 };
 
-JSObject* JSCSSRuleListPrototype::self(ExecState* exec)
+JSObject* JSCSSRuleListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSRuleList>(exec);
+    return getDOMPrototype<JSCSSRuleList>(exec, globalObject);
 }
 
 bool JSCSSRuleListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -130,12 +127,11 @@ JSCSSRuleList::JSCSSRuleList(PassRefPtr<Structure> structure, PassRefPtr<CSSRule
 JSCSSRuleList::~JSCSSRuleList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSCSSRuleList::createPrototype(ExecState* exec)
+JSObject* JSCSSRuleList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSRuleListPrototype(JSCSSRuleListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSCSSRuleListPrototype(JSCSSRuleListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSCSSRuleList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -163,13 +159,14 @@ bool JSCSSRuleList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, P
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsCSSRuleListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSRuleList* imp = static_cast<CSSRuleList*>(static_cast<JSCSSRuleList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsCSSRuleListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSRuleListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSRuleList*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
@@ -180,37 +177,38 @@ void JSCSSRuleList::getPropertyNames(ExecState* exec, PropertyNameArray& propert
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSCSSRuleList::getConstructor(ExecState* exec)
+JSValue JSCSSRuleList::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSRuleListConstructor>(exec);
 }
 
-JSValuePtr jsCSSRuleListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSRuleListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSRuleList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSRuleList::s_info))
         return throwError(exec, TypeError);
     JSCSSRuleList* castedThisObj = static_cast<JSCSSRuleList*>(asObject(thisValue));
     CSSRuleList* imp = static_cast<CSSRuleList*>(castedThisObj->impl());
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->item(index)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
     return result;
 }
 
 
-JSValuePtr JSCSSRuleList::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCSSRuleList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSCSSRuleList* thisObj = static_cast<JSCSSRuleList*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<CSSRuleList*>(thisObj->impl())->item(slot.index()));
 }
-JSC::JSValuePtr toJS(JSC::ExecState* exec, CSSRuleList* object)
+JSC::JSValue toJS(JSC::ExecState* exec, CSSRuleList* object)
 {
     return getDOMObjectWrapper<JSCSSRuleList>(exec, object);
 }
-CSSRuleList* toCSSRuleList(JSC::JSValuePtr value)
+CSSRuleList* toCSSRuleList(JSC::JSValue value)
 {
-    return value->isObject(&JSCSSRuleList::s_info) ? static_cast<JSCSSRuleList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSCSSRuleList::s_info) ? static_cast<JSCSSRuleList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h
index 168a1bb..ba3180c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSRuleList.h
@@ -34,36 +34,37 @@ class JSCSSRuleList : public DOMObject {
 public:
     JSCSSRuleList(PassRefPtr<JSC::Structure>, PassRefPtr<CSSRuleList>);
     virtual ~JSCSSRuleList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     CSSRuleList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<CSSRuleList> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, CSSRuleList*);
-CSSRuleList* toCSSRuleList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, CSSRuleList*);
+CSSRuleList* toCSSRuleList(JSC::JSValue);
 
 class JSCSSRuleListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -72,11 +73,11 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsCSSRuleListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSRuleListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsCSSRuleListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSRuleListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSRuleListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
index 331c153..cf7ceed 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.cpp
@@ -19,12 +19,8 @@
 */
 
 #include "config.h"
-
 #include "JSCSSStyleDeclaration.h"
 
-#include <wtf/GetPtr.h>
-
-#include <runtime/PropertyNameArray.h>
 #include "AtomicString.h"
 #include "CSSRule.h"
 #include "CSSStyleDeclaration.h"
@@ -33,15 +29,16 @@
 #include "JSCSSStyleDeclarationCustom.h"
 #include "JSCSSValue.h"
 #include "KURL.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSStyleDeclaration)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSStyleDeclaration);
 
 /* Hash table */
 
@@ -80,13 +77,13 @@ public:
     JSCSSStyleDeclarationConstructor(ExecState* exec)
         : DOMObject(JSCSSStyleDeclarationConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSStyleDeclarationPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSStyleDeclarationPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -123,9 +120,9 @@ static const HashTable JSCSSStyleDeclarationPrototypeTable =
 
 const ClassInfo JSCSSStyleDeclarationPrototype::s_info = { "CSSStyleDeclarationPrototype", 0, &JSCSSStyleDeclarationPrototypeTable, 0 };
 
-JSObject* JSCSSStyleDeclarationPrototype::self(ExecState* exec)
+JSObject* JSCSSStyleDeclarationPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSStyleDeclaration>(exec);
+    return getDOMPrototype<JSCSSStyleDeclaration>(exec, globalObject);
 }
 
 bool JSCSSStyleDeclarationPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -144,12 +141,11 @@ JSCSSStyleDeclaration::JSCSSStyleDeclaration(PassRefPtr<Structure> structure, Pa
 JSCSSStyleDeclaration::~JSCSSStyleDeclaration()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSCSSStyleDeclaration::createPrototype(ExecState* exec)
+JSObject* JSCSSStyleDeclaration::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSStyleDeclarationPrototype(JSCSSStyleDeclarationPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSCSSStyleDeclarationPrototype(JSCSSStyleDeclarationPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSCSSStyleDeclaration::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -181,36 +177,39 @@ bool JSCSSStyleDeclaration::getOwnPropertySlot(ExecState* exec, unsigned propert
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsCSSStyleDeclarationCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleDeclarationCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->cssText());
 }
 
-JSValuePtr jsCSSStyleDeclarationLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleDeclarationLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsCSSStyleDeclarationParentRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleDeclarationParentRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->parentRule()));
 }
 
-JSValuePtr jsCSSStyleDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSCSSStyleDeclaration::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSCSSStyleDeclaration::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    if (customPut(exec, propertyName, value, slot))
+    if (putDelegate(exec, propertyName, value, slot))
         return;
     lookupPut<JSCSSStyleDeclaration, Base>(exec, propertyName, value, &JSCSSStyleDeclarationTable, this, slot);
 }
 
-void setJSCSSStyleDeclarationCssText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCSSStyleDeclarationCssText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(static_cast<JSCSSStyleDeclaration*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -225,133 +224,141 @@ void JSCSSStyleDeclaration::getPropertyNames(ExecState* exec, PropertyNameArray&
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSCSSStyleDeclaration::getConstructor(ExecState* exec)
+JSValue JSCSSStyleDeclaration::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSStyleDeclarationConstructor>(exec);
 }
 
-JSValuePtr jsCSSStyleDeclarationPrototypeFunctionGetPropertyValue(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
-    const UString& propertyName = args.at(exec, 0)->toString(exec);
+    const UString& propertyName = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->getPropertyValue(propertyName));
+    JSC::JSValue result = jsStringOrNull(exec, imp->getPropertyValue(propertyName));
     return result;
 }
 
-JSValuePtr jsCSSStyleDeclarationPrototypeFunctionGetPropertyCSSValue(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyCSSValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
-    const UString& propertyName = args.at(exec, 0)->toString(exec);
+    const UString& propertyName = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPropertyCSSValue(propertyName)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPropertyCSSValue(propertyName)));
     return result;
 }
 
-JSValuePtr jsCSSStyleDeclarationPrototypeFunctionRemoveProperty(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionRemoveProperty(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& propertyName = args.at(exec, 0)->toString(exec);
+    const UString& propertyName = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->removeProperty(propertyName, ec));
+    JSC::JSValue result = jsStringOrNull(exec, imp->removeProperty(propertyName, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCSSStyleDeclarationPrototypeFunctionGetPropertyPriority(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyPriority(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
-    const UString& propertyName = args.at(exec, 0)->toString(exec);
+    const UString& propertyName = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->getPropertyPriority(propertyName));
+    JSC::JSValue result = jsStringOrNull(exec, imp->getPropertyPriority(propertyName));
     return result;
 }
 
-JSValuePtr jsCSSStyleDeclarationPrototypeFunctionSetProperty(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionSetProperty(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& propertyName = args.at(exec, 0)->toString(exec);
-    const UString& value = valueToStringWithNullCheck(exec, args.at(exec, 1));
-    const UString& priority = args.at(exec, 2)->toString(exec);
+    const UString& propertyName = args.at(0).toString(exec);
+    const UString& value = valueToStringWithNullCheck(exec, args.at(1));
+    const UString& priority = args.at(2).toString(exec);
 
     imp->setProperty(propertyName, value, priority, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsCSSStyleDeclarationPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->item(index));
+    JSC::JSValue result = jsStringOrNull(exec, imp->item(index));
     return result;
 }
 
-JSValuePtr jsCSSStyleDeclarationPrototypeFunctionGetPropertyShorthand(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyShorthand(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
-    const UString& propertyName = args.at(exec, 0)->toString(exec);
+    const UString& propertyName = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->getPropertyShorthand(propertyName));
+    JSC::JSValue result = jsStringOrNull(exec, imp->getPropertyShorthand(propertyName));
     return result;
 }
 
-JSValuePtr jsCSSStyleDeclarationPrototypeFunctionIsPropertyImplicit(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionIsPropertyImplicit(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleDeclaration* castedThisObj = static_cast<JSCSSStyleDeclaration*>(asObject(thisValue));
     CSSStyleDeclaration* imp = static_cast<CSSStyleDeclaration*>(castedThisObj->impl());
-    const UString& propertyName = args.at(exec, 0)->toString(exec);
+    const UString& propertyName = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->isPropertyImplicit(propertyName));
+    JSC::JSValue result = jsBoolean(imp->isPropertyImplicit(propertyName));
     return result;
 }
 
 
-JSValuePtr JSCSSStyleDeclaration::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCSSStyleDeclaration::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSCSSStyleDeclaration* thisObj = static_cast<JSCSSStyleDeclaration*>(asObject(slot.slotBase()));
     return jsStringOrNull(exec, thisObj->impl()->item(slot.index()));
 }
-JSC::JSValuePtr toJS(JSC::ExecState* exec, CSSStyleDeclaration* object)
+JSC::JSValue toJS(JSC::ExecState* exec, CSSStyleDeclaration* object)
 {
     return getDOMObjectWrapper<JSCSSStyleDeclaration>(exec, object);
 }
-CSSStyleDeclaration* toCSSStyleDeclaration(JSC::JSValuePtr value)
+CSSStyleDeclaration* toCSSStyleDeclaration(JSC::JSValue value)
 {
-    return value->isObject(&JSCSSStyleDeclaration::s_info) ? static_cast<JSCSSStyleDeclaration*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSCSSStyleDeclaration::s_info) ? static_cast<JSCSSStyleDeclaration*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h
index 5e9331e..df64dde 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleDeclaration.h
@@ -34,41 +34,42 @@ class JSCSSStyleDeclaration : public DOMObject {
 public:
     JSCSSStyleDeclaration(PassRefPtr<JSC::Structure>, PassRefPtr<CSSStyleDeclaration>);
     virtual ~JSCSSStyleDeclaration();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     CSSStyleDeclaration* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<CSSStyleDeclaration> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, CSSStyleDeclaration*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, CSSStyleDeclaration*);
-CSSStyleDeclaration* toCSSStyleDeclaration(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, CSSStyleDeclaration*);
+CSSStyleDeclaration* toCSSStyleDeclaration(JSC::JSValue);
 
 class JSCSSStyleDeclarationPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -77,21 +78,21 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsCSSStyleDeclarationPrototypeFunctionGetPropertyValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSStyleDeclarationPrototypeFunctionGetPropertyCSSValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSStyleDeclarationPrototypeFunctionRemoveProperty(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSStyleDeclarationPrototypeFunctionGetPropertyPriority(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSStyleDeclarationPrototypeFunctionSetProperty(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSStyleDeclarationPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSStyleDeclarationPrototypeFunctionGetPropertyShorthand(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSStyleDeclarationPrototypeFunctionIsPropertyImplicit(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyCSSValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionRemoveProperty(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyPriority(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionSetProperty(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionGetPropertyShorthand(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleDeclarationPrototypeFunctionIsPropertyImplicit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsCSSStyleDeclarationCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCSSStyleDeclarationCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCSSStyleDeclarationLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSStyleDeclarationParentRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSStyleDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleDeclarationCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCSSStyleDeclarationCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCSSStyleDeclarationLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleDeclarationParentRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp
index b44b910..1d92b22 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.cpp
@@ -19,24 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSCSSStyleRule.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSStyleRule.h"
 #include "JSCSSStyleDeclaration.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSStyleRule)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSStyleRule);
 
 /* Hash table */
 
@@ -74,13 +70,13 @@ public:
     JSCSSStyleRuleConstructor(ExecState* exec)
         : DOMObject(JSCSSStyleRuleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSStyleRulePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSStyleRulePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +105,9 @@ static const HashTable JSCSSStyleRulePrototypeTable =
 
 const ClassInfo JSCSSStyleRulePrototype::s_info = { "CSSStyleRulePrototype", 0, &JSCSSStyleRulePrototypeTable, 0 };
 
-JSObject* JSCSSStyleRulePrototype::self(ExecState* exec)
+JSObject* JSCSSStyleRulePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSStyleRule>(exec);
+    return getDOMPrototype<JSCSSStyleRule>(exec, globalObject);
 }
 
 const ClassInfo JSCSSStyleRule::s_info = { "CSSStyleRule", &JSCSSRule::s_info, &JSCSSStyleRuleTable, 0 };
@@ -121,9 +117,9 @@ JSCSSStyleRule::JSCSSStyleRule(PassRefPtr<Structure> structure, PassRefPtr<CSSSt
 {
 }
 
-JSObject* JSCSSStyleRule::createPrototype(ExecState* exec)
+JSObject* JSCSSStyleRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSStyleRulePrototype(JSCSSStyleRulePrototype::createStructure(JSCSSRulePrototype::self(exec)));
+    return new (exec) JSCSSStyleRulePrototype(JSCSSStyleRulePrototype::createStructure(JSCSSRulePrototype::self(exec, globalObject)));
 }
 
 bool JSCSSStyleRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,28 +127,30 @@ bool JSCSSStyleRule::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSCSSStyleRule, Base>(exec, &JSCSSStyleRuleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCSSStyleRuleSelectorText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleRuleSelectorText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSStyleRule* imp = static_cast<CSSStyleRule*>(static_cast<JSCSSStyleRule*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->selectorText());
 }
 
-JSValuePtr jsCSSStyleRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSStyleRule* imp = static_cast<CSSStyleRule*>(static_cast<JSCSSStyleRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsCSSStyleRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSStyleRule*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSCSSStyleRule::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSCSSStyleRule::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSCSSStyleRule, Base>(exec, propertyName, value, &JSCSSStyleRuleTable, this, slot);
 }
 
-void setJSCSSStyleRuleSelectorText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCSSStyleRuleSelectorText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CSSStyleRule* imp = static_cast<CSSStyleRule*>(static_cast<JSCSSStyleRule*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -160,7 +158,7 @@ void setJSCSSStyleRuleSelectorText(ExecState* exec, JSObject* thisObject, JSValu
     setDOMException(exec, ec);
 }
 
-JSValuePtr JSCSSStyleRule::getConstructor(ExecState* exec)
+JSValue JSCSSStyleRule::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSStyleRuleConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h
index 9cb2788..4f65c87 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleRule.h
@@ -31,24 +31,25 @@ class JSCSSStyleRule : public JSCSSRule {
     typedef JSCSSRule Base;
 public:
     JSCSSStyleRule(PassRefPtr<JSC::Structure>, PassRefPtr<CSSStyleRule>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSCSSStyleRulePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSCSSStyleRulePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,10 +57,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsCSSStyleRuleSelectorText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCSSStyleRuleSelectorText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCSSStyleRuleStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSStyleRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleRuleSelectorText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCSSStyleRuleSelectorText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCSSStyleRuleStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp
index 36395c1..f697203 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.cpp
@@ -19,25 +19,22 @@
 */
 
 #include "config.h"
-
 #include "JSCSSStyleSheet.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSRule.h"
 #include "CSSRuleList.h"
 #include "CSSStyleSheet.h"
 #include "JSCSSRule.h"
 #include "JSCSSRuleList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSStyleSheet)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSStyleSheet);
 
 /* Hash table */
 
@@ -76,13 +73,13 @@ public:
     JSCSSStyleSheetConstructor(ExecState* exec)
         : DOMObject(JSCSSStyleSheetConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSStyleSheetPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSStyleSheetPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -115,9 +112,9 @@ static const HashTable JSCSSStyleSheetPrototypeTable =
 
 const ClassInfo JSCSSStyleSheetPrototype::s_info = { "CSSStyleSheetPrototype", 0, &JSCSSStyleSheetPrototypeTable, 0 };
 
-JSObject* JSCSSStyleSheetPrototype::self(ExecState* exec)
+JSObject* JSCSSStyleSheetPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSStyleSheet>(exec);
+    return getDOMPrototype<JSCSSStyleSheet>(exec, globalObject);
 }
 
 bool JSCSSStyleSheetPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,9 +129,9 @@ JSCSSStyleSheet::JSCSSStyleSheet(PassRefPtr<Structure> structure, PassRefPtr<CSS
 {
 }
 
-JSObject* JSCSSStyleSheet::createPrototype(ExecState* exec)
+JSObject* JSCSSStyleSheet::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSStyleSheetPrototype(JSCSSStyleSheetPrototype::createStructure(JSStyleSheetPrototype::self(exec)));
+    return new (exec) JSCSSStyleSheetPrototype(JSCSSStyleSheetPrototype::createStructure(JSStyleSheetPrototype::self(exec, globalObject)));
 }
 
 bool JSCSSStyleSheet::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -142,97 +139,104 @@ bool JSCSSStyleSheet::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSCSSStyleSheet, Base>(exec, &JSCSSStyleSheetTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCSSStyleSheetOwnerRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleSheetOwnerRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(static_cast<JSCSSStyleSheet*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->ownerRule()));
 }
 
-JSValuePtr jsCSSStyleSheetCssRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleSheetCssRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(static_cast<JSCSSStyleSheet*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->cssRules()));
 }
 
-JSValuePtr jsCSSStyleSheetRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleSheetRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(static_cast<JSCSSStyleSheet*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->rules()));
 }
 
-JSValuePtr jsCSSStyleSheetConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSStyleSheetConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSStyleSheet*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSCSSStyleSheet::getConstructor(ExecState* exec)
+JSValue JSCSSStyleSheet::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSStyleSheetConstructor>(exec);
 }
 
-JSValuePtr jsCSSStyleSheetPrototypeFunctionInsertRule(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionInsertRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleSheet::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleSheet::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleSheet* castedThisObj = static_cast<JSCSSStyleSheet*>(asObject(thisValue));
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& rule = args.at(exec, 0)->toString(exec);
-    unsigned index = args.at(exec, 1)->toInt32(exec);
+    const UString& rule = args.at(0).toString(exec);
+    unsigned index = args.at(1).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->insertRule(rule, index, ec));
+    JSC::JSValue result = jsNumber(exec, imp->insertRule(rule, index, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCSSStyleSheetPrototypeFunctionDeleteRule(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionDeleteRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleSheet::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleSheet::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleSheet* castedThisObj = static_cast<JSCSSStyleSheet*>(asObject(thisValue));
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
     imp->deleteRule(index, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsCSSStyleSheetPrototypeFunctionAddRule(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionAddRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleSheet::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleSheet::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleSheet* castedThisObj = static_cast<JSCSSStyleSheet*>(asObject(thisValue));
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& selector = args.at(exec, 0)->toString(exec);
-    const UString& style = args.at(exec, 1)->toString(exec);
+    const UString& selector = args.at(0).toString(exec);
+    const UString& style = args.at(1).toString(exec);
 
     int argsCount = args.size();
     if (argsCount < 3) {
 
-        JSC::JSValuePtr result = jsNumber(exec, imp->addRule(selector, style, ec));
+        JSC::JSValue result = jsNumber(exec, imp->addRule(selector, style, ec));
         setDOMException(exec, ec);
         return result;
     }
 
-    unsigned index = args.at(exec, 2)->toInt32(exec);
+    unsigned index = args.at(2).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->addRule(selector, style, index, ec));
+    JSC::JSValue result = jsNumber(exec, imp->addRule(selector, style, index, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCSSStyleSheetPrototypeFunctionRemoveRule(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionRemoveRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSStyleSheet::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSStyleSheet::s_info))
         return throwError(exec, TypeError);
     JSCSSStyleSheet* castedThisObj = static_cast<JSCSSStyleSheet*>(asObject(thisValue));
     CSSStyleSheet* imp = static_cast<CSSStyleSheet*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
     imp->removeRule(index, ec);
     setDOMException(exec, ec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h
index dedf1ca..bd048f2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSStyleSheet.h
@@ -31,27 +31,28 @@ class JSCSSStyleSheet : public JSStyleSheet {
     typedef JSStyleSheet Base;
 public:
     JSCSSStyleSheet(PassRefPtr<JSC::Structure>, PassRefPtr<CSSStyleSheet>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSCSSStyleSheetPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,16 +61,16 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsCSSStyleSheetPrototypeFunctionInsertRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSStyleSheetPrototypeFunctionDeleteRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSStyleSheetPrototypeFunctionAddRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSStyleSheetPrototypeFunctionRemoveRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionInsertRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionDeleteRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionAddRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSStyleSheetPrototypeFunctionRemoveRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsCSSStyleSheetOwnerRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSStyleSheetCssRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSStyleSheetRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSStyleSheetConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleSheetOwnerRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleSheetCssRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleSheetRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSStyleSheetConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
index 50ee92b..87aff14 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.cpp
@@ -19,21 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSCSSValue.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSValue.h"
 #include "KURL.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSValue)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSValue);
 
 /* Hash table */
 
@@ -75,13 +72,13 @@ public:
     JSCSSValueConstructor(ExecState* exec)
         : DOMObject(JSCSSValueConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSValuePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSValuePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -114,9 +111,9 @@ static const HashTable JSCSSValuePrototypeTable =
 
 const ClassInfo JSCSSValuePrototype::s_info = { "CSSValuePrototype", 0, &JSCSSValuePrototypeTable, 0 };
 
-JSObject* JSCSSValuePrototype::self(ExecState* exec)
+JSObject* JSCSSValuePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSValue>(exec);
+    return getDOMPrototype<JSCSSValue>(exec, globalObject);
 }
 
 bool JSCSSValuePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -135,12 +132,11 @@ JSCSSValue::JSCSSValue(PassRefPtr<Structure> structure, PassRefPtr<CSSValue> imp
 JSCSSValue::~JSCSSValue()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSCSSValue::createPrototype(ExecState* exec)
+JSObject* JSCSSValue::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSValuePrototype(JSCSSValuePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSCSSValuePrototype(JSCSSValuePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSCSSValue::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -148,28 +144,30 @@ bool JSCSSValue::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSCSSValue, Base>(exec, &JSCSSValueTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCSSValueCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSValueCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSValue* imp = static_cast<CSSValue*>(static_cast<JSCSSValue*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->cssText());
 }
 
-JSValuePtr jsCSSValueCssValueType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSValueCssValueType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSValue* imp = static_cast<CSSValue*>(static_cast<JSCSSValue*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->cssValueType());
 }
 
-JSValuePtr jsCSSValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSValue*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSCSSValue::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSCSSValue::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSCSSValue, Base>(exec, propertyName, value, &JSCSSValueTable, this, slot);
 }
 
-void setJSCSSValueCssText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCSSValueCssText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CSSValue* imp = static_cast<CSSValue*>(static_cast<JSCSSValue*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -177,36 +175,36 @@ void setJSCSSValueCssText(ExecState* exec, JSObject* thisObject, JSValuePtr valu
     setDOMException(exec, ec);
 }
 
-JSValuePtr JSCSSValue::getConstructor(ExecState* exec)
+JSValue JSCSSValue::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSValueConstructor>(exec);
 }
 
 // Constant getters
 
-JSValuePtr jsCSSValueCSS_INHERIT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSValueCSS_INHERIT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsCSSValueCSS_PRIMITIVE_VALUE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSValueCSS_PRIMITIVE_VALUE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsCSSValueCSS_VALUE_LIST(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSValueCSS_VALUE_LIST(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsCSSValueCSS_CUSTOM(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsCSSValueCSS_CUSTOM(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-CSSValue* toCSSValue(JSC::JSValuePtr value)
+CSSValue* toCSSValue(JSC::JSValue value)
 {
-    return value->isObject(&JSCSSValue::s_info) ? static_cast<JSCSSValue*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSCSSValue::s_info) ? static_cast<JSCSSValue*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h
index ece0f07..d38c5c4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValue.h
@@ -34,34 +34,35 @@ class JSCSSValue : public DOMObject {
 public:
     JSCSSValue(PassRefPtr<JSC::Structure>, PassRefPtr<CSSValue>);
     virtual ~JSCSSValue();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     CSSValue* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<CSSValue> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, CSSValue*);
-CSSValue* toCSSValue(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, CSSValue*);
+CSSValue* toCSSValue(JSC::JSValue);
 
 class JSCSSValuePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -70,16 +71,16 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsCSSValueCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCSSValueCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCSSValueCssValueType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCSSValueCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCSSValueCssValueType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsCSSValueCSS_INHERIT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSValueCSS_PRIMITIVE_VALUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSValueCSS_VALUE_LIST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSValueCSS_CUSTOM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueCSS_INHERIT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueCSS_PRIMITIVE_VALUE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueCSS_VALUE_LIST(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueCSS_CUSTOM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp
index f5cc5ea..98721ec 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.cpp
@@ -19,24 +19,21 @@
 */
 
 #include "config.h"
-
 #include "JSCSSValueList.h"
 
-#include <wtf/GetPtr.h>
-
-#include <runtime/PropertyNameArray.h>
 #include "CSSValue.h"
 #include "CSSValueList.h"
 #include "JSCSSValue.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSValueList)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSValueList);
 
 /* Hash table */
 
@@ -73,13 +70,13 @@ public:
     JSCSSValueListConstructor(ExecState* exec)
         : DOMObject(JSCSSValueListConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSValueListPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSValueListPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +106,9 @@ static const HashTable JSCSSValueListPrototypeTable =
 
 const ClassInfo JSCSSValueListPrototype::s_info = { "CSSValueListPrototype", 0, &JSCSSValueListPrototypeTable, 0 };
 
-JSObject* JSCSSValueListPrototype::self(ExecState* exec)
+JSObject* JSCSSValueListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSValueList>(exec);
+    return getDOMPrototype<JSCSSValueList>(exec, globalObject);
 }
 
 bool JSCSSValueListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -126,9 +123,9 @@ JSCSSValueList::JSCSSValueList(PassRefPtr<Structure> structure, PassRefPtr<CSSVa
 {
 }
 
-JSObject* JSCSSValueList::createPrototype(ExecState* exec)
+JSObject* JSCSSValueList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSValueListPrototype(JSCSSValueListPrototype::createStructure(JSCSSValuePrototype::self(exec)));
+    return new (exec) JSCSSValueListPrototype(JSCSSValueListPrototype::createStructure(JSCSSValuePrototype::self(exec, globalObject)));
 }
 
 bool JSCSSValueList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -156,13 +153,14 @@ bool JSCSSValueList::getOwnPropertySlot(ExecState* exec, unsigned propertyName,
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsCSSValueListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSValueListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSValueList* imp = static_cast<CSSValueList*>(static_cast<JSCSSValueList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsCSSValueListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSValueListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSValueList*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
@@ -173,26 +171,27 @@ void JSCSSValueList::getPropertyNames(ExecState* exec, PropertyNameArray& proper
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSCSSValueList::getConstructor(ExecState* exec)
+JSValue JSCSSValueList::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSValueListConstructor>(exec);
 }
 
-JSValuePtr jsCSSValueListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSValueListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSValueList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSValueList::s_info))
         return throwError(exec, TypeError);
     JSCSSValueList* castedThisObj = static_cast<JSCSSValueList*>(asObject(thisValue));
     CSSValueList* imp = static_cast<CSSValueList*>(castedThisObj->impl());
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->item(index)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
     return result;
 }
 
 
-JSValuePtr JSCSSValueList::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCSSValueList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSCSSValueList* thisObj = static_cast<JSCSSValueList*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<CSSValueList*>(thisObj->impl())->item(slot.index()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h
index 892698c..3d35093 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSValueList.h
@@ -31,30 +31,31 @@ class JSCSSValueList : public JSCSSValue {
     typedef JSCSSValue Base;
 public:
     JSCSSValueList(PassRefPtr<JSC::Structure>, PassRefPtr<CSSValueList>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
 
 class JSCSSValueListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,11 +64,11 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsCSSValueListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSValueListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsCSSValueListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSValueListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSValueListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
index 28b7673..3c8c75a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.cpp
@@ -19,26 +19,23 @@
 */
 
 #include "config.h"
-
 #include "JSCSSVariablesDeclaration.h"
 
-#include <wtf/GetPtr.h>
-
-#include <runtime/PropertyNameArray.h>
 #include "CSSRule.h"
 #include "CSSVariablesDeclaration.h"
 #include "JSCSSRule.h"
 #include "KURL.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSVariablesDeclaration)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSVariablesDeclaration);
 
 /* Hash table */
 
@@ -77,13 +74,13 @@ public:
     JSCSSVariablesDeclarationConstructor(ExecState* exec)
         : DOMObject(JSCSSVariablesDeclarationConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSVariablesDeclarationPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSVariablesDeclarationPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -116,9 +113,9 @@ static const HashTable JSCSSVariablesDeclarationPrototypeTable =
 
 const ClassInfo JSCSSVariablesDeclarationPrototype::s_info = { "CSSVariablesDeclarationPrototype", 0, &JSCSSVariablesDeclarationPrototypeTable, 0 };
 
-JSObject* JSCSSVariablesDeclarationPrototype::self(ExecState* exec)
+JSObject* JSCSSVariablesDeclarationPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSVariablesDeclaration>(exec);
+    return getDOMPrototype<JSCSSVariablesDeclaration>(exec, globalObject);
 }
 
 bool JSCSSVariablesDeclarationPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -137,12 +134,11 @@ JSCSSVariablesDeclaration::JSCSSVariablesDeclaration(PassRefPtr<Structure> struc
 JSCSSVariablesDeclaration::~JSCSSVariablesDeclaration()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSCSSVariablesDeclaration::createPrototype(ExecState* exec)
+JSObject* JSCSSVariablesDeclaration::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSVariablesDeclarationPrototype(JSCSSVariablesDeclarationPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSCSSVariablesDeclarationPrototype(JSCSSVariablesDeclarationPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSCSSVariablesDeclaration::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -170,37 +166,40 @@ bool JSCSSVariablesDeclaration::getOwnPropertySlot(ExecState* exec, unsigned pro
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsCSSVariablesDeclarationCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesDeclarationCssText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(static_cast<JSCSSVariablesDeclaration*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->cssText());
 }
 
-JSValuePtr jsCSSVariablesDeclarationLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesDeclarationLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(static_cast<JSCSSVariablesDeclaration*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsCSSVariablesDeclarationParentRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesDeclarationParentRule(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(static_cast<JSCSSVariablesDeclaration*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->parentRule()));
 }
 
-JSValuePtr jsCSSVariablesDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSVariablesDeclaration*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSCSSVariablesDeclaration::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSCSSVariablesDeclaration::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSCSSVariablesDeclaration, Base>(exec, propertyName, value, &JSCSSVariablesDeclarationTable, this, slot);
 }
 
-void setJSCSSVariablesDeclarationCssText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCSSVariablesDeclarationCssText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(static_cast<JSCSSVariablesDeclaration*>(thisObject)->impl());
-    imp->setCssText(value->toString(exec));
+    imp->setCssText(value.toString(exec));
 }
 
 void JSCSSVariablesDeclaration::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
@@ -210,80 +209,84 @@ void JSCSSVariablesDeclaration::getPropertyNames(ExecState* exec, PropertyNameAr
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSCSSVariablesDeclaration::getConstructor(ExecState* exec)
+JSValue JSCSSVariablesDeclaration::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSVariablesDeclarationConstructor>(exec);
 }
 
-JSValuePtr jsCSSVariablesDeclarationPrototypeFunctionGetVariableValue(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionGetVariableValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSVariablesDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSVariablesDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSVariablesDeclaration* castedThisObj = static_cast<JSCSSVariablesDeclaration*>(asObject(thisValue));
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(castedThisObj->impl());
-    const UString& variableName = args.at(exec, 0)->toString(exec);
+    const UString& variableName = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->getVariableValue(variableName));
+    JSC::JSValue result = jsString(exec, imp->getVariableValue(variableName));
     return result;
 }
 
-JSValuePtr jsCSSVariablesDeclarationPrototypeFunctionRemoveVariable(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionRemoveVariable(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSVariablesDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSVariablesDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSVariablesDeclaration* castedThisObj = static_cast<JSCSSVariablesDeclaration*>(asObject(thisValue));
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& variableName = args.at(exec, 0)->toString(exec);
+    const UString& variableName = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->removeVariable(variableName, ec));
+    JSC::JSValue result = jsString(exec, imp->removeVariable(variableName, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCSSVariablesDeclarationPrototypeFunctionSetVariable(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionSetVariable(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSVariablesDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSVariablesDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSVariablesDeclaration* castedThisObj = static_cast<JSCSSVariablesDeclaration*>(asObject(thisValue));
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& variableName = args.at(exec, 0)->toString(exec);
-    const UString& value = args.at(exec, 1)->toString(exec);
+    const UString& variableName = args.at(0).toString(exec);
+    const UString& value = args.at(1).toString(exec);
 
     imp->setVariable(variableName, value, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsCSSVariablesDeclarationPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCSSVariablesDeclaration::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCSSVariablesDeclaration::s_info))
         return throwError(exec, TypeError);
     JSCSSVariablesDeclaration* castedThisObj = static_cast<JSCSSVariablesDeclaration*>(asObject(thisValue));
     CSSVariablesDeclaration* imp = static_cast<CSSVariablesDeclaration*>(castedThisObj->impl());
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->item(index));
+    JSC::JSValue result = jsString(exec, imp->item(index));
     return result;
 }
 
 
-JSValuePtr JSCSSVariablesDeclaration::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSCSSVariablesDeclaration::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSCSSVariablesDeclaration* thisObj = static_cast<JSCSSVariablesDeclaration*>(asObject(slot.slotBase()));
     return jsStringOrNull(exec, thisObj->impl()->item(slot.index()));
 }
-JSC::JSValuePtr toJS(JSC::ExecState* exec, CSSVariablesDeclaration* object)
+JSC::JSValue toJS(JSC::ExecState* exec, CSSVariablesDeclaration* object)
 {
     return getDOMObjectWrapper<JSCSSVariablesDeclaration>(exec, object);
 }
-CSSVariablesDeclaration* toCSSVariablesDeclaration(JSC::JSValuePtr value)
+CSSVariablesDeclaration* toCSSVariablesDeclaration(JSC::JSValue value)
 {
-    return value->isObject(&JSCSSVariablesDeclaration::s_info) ? static_cast<JSCSSVariablesDeclaration*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSCSSVariablesDeclaration::s_info) ? static_cast<JSCSSVariablesDeclaration*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h
index 8d0e2b9..fe98f8e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesDeclaration.h
@@ -34,37 +34,38 @@ class JSCSSVariablesDeclaration : public DOMObject {
 public:
     JSCSSVariablesDeclaration(PassRefPtr<JSC::Structure>, PassRefPtr<CSSVariablesDeclaration>);
     virtual ~JSCSSVariablesDeclaration();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     CSSVariablesDeclaration* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<CSSVariablesDeclaration> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, CSSVariablesDeclaration*);
-CSSVariablesDeclaration* toCSSVariablesDeclaration(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, CSSVariablesDeclaration*);
+CSSVariablesDeclaration* toCSSVariablesDeclaration(JSC::JSValue);
 
 class JSCSSVariablesDeclarationPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -73,17 +74,17 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsCSSVariablesDeclarationPrototypeFunctionGetVariableValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSVariablesDeclarationPrototypeFunctionRemoveVariable(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSVariablesDeclarationPrototypeFunctionSetVariable(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCSSVariablesDeclarationPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionGetVariableValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionRemoveVariable(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionSetVariable(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCSSVariablesDeclarationPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsCSSVariablesDeclarationCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCSSVariablesDeclarationCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCSSVariablesDeclarationLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSVariablesDeclarationParentRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSVariablesDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSVariablesDeclarationCssText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCSSVariablesDeclarationCssText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCSSVariablesDeclarationLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSVariablesDeclarationParentRule(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSVariablesDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp
index 1e80477..ed3050d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.cpp
@@ -19,24 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSCSSVariablesRule.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSVariablesDeclaration.h"
 #include "CSSVariablesRule.h"
 #include "JSCSSVariablesDeclaration.h"
 #include "JSMediaList.h"
 #include "MediaList.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCSSVariablesRule)
+ASSERT_CLASS_FITS_IN_CELL(JSCSSVariablesRule);
 
 /* Hash table */
 
@@ -74,13 +70,13 @@ public:
     JSCSSVariablesRuleConstructor(ExecState* exec)
         : DOMObject(JSCSSVariablesRuleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCSSVariablesRulePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCSSVariablesRulePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +105,9 @@ static const HashTable JSCSSVariablesRulePrototypeTable =
 
 const ClassInfo JSCSSVariablesRulePrototype::s_info = { "CSSVariablesRulePrototype", 0, &JSCSSVariablesRulePrototypeTable, 0 };
 
-JSObject* JSCSSVariablesRulePrototype::self(ExecState* exec)
+JSObject* JSCSSVariablesRulePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCSSVariablesRule>(exec);
+    return getDOMPrototype<JSCSSVariablesRule>(exec, globalObject);
 }
 
 const ClassInfo JSCSSVariablesRule::s_info = { "CSSVariablesRule", &JSCSSRule::s_info, &JSCSSVariablesRuleTable, 0 };
@@ -121,9 +117,9 @@ JSCSSVariablesRule::JSCSSVariablesRule(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSCSSVariablesRule::createPrototype(ExecState* exec)
+JSObject* JSCSSVariablesRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCSSVariablesRulePrototype(JSCSSVariablesRulePrototype::createStructure(JSCSSRulePrototype::self(exec)));
+    return new (exec) JSCSSVariablesRulePrototype(JSCSSVariablesRulePrototype::createStructure(JSCSSRulePrototype::self(exec, globalObject)));
 }
 
 bool JSCSSVariablesRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,23 +127,25 @@ bool JSCSSVariablesRule::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSCSSVariablesRule, Base>(exec, &JSCSSVariablesRuleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCSSVariablesRuleMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesRuleMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSVariablesRule* imp = static_cast<CSSVariablesRule*>(static_cast<JSCSSVariablesRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->media()));
 }
 
-JSValuePtr jsCSSVariablesRuleVariables(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesRuleVariables(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CSSVariablesRule* imp = static_cast<CSSVariablesRule*>(static_cast<JSCSSVariablesRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->variables()));
 }
 
-JSValuePtr jsCSSVariablesRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCSSVariablesRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCSSVariablesRule*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSCSSVariablesRule::getConstructor(ExecState* exec)
+JSValue JSCSSVariablesRule::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCSSVariablesRuleConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h
index 2c318ff..c204a1e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCSSVariablesRule.h
@@ -31,23 +31,24 @@ class JSCSSVariablesRule : public JSCSSRule {
     typedef JSCSSRule Base;
 public:
     JSCSSVariablesRule(PassRefPtr<JSC::Structure>, PassRefPtr<CSSVariablesRule>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSCSSVariablesRulePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSCSSVariablesRulePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -55,9 +56,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsCSSVariablesRuleMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSVariablesRuleVariables(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCSSVariablesRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSVariablesRuleMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSVariablesRuleVariables(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCSSVariablesRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp
index 69356d2..7801622 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.cpp
@@ -19,21 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSCanvasGradient.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CanvasGradient.h"
 #include "PlatformString.h"
-
 #include <runtime/Error.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasGradient)
+ASSERT_CLASS_FITS_IN_CELL(JSCanvasGradient);
 
 /* Hash table for prototype */
 
@@ -52,9 +49,9 @@ static const HashTable JSCanvasGradientPrototypeTable =
 
 const ClassInfo JSCanvasGradientPrototype::s_info = { "CanvasGradientPrototype", 0, &JSCanvasGradientPrototypeTable, 0 };
 
-JSObject* JSCanvasGradientPrototype::self(ExecState* exec)
+JSObject* JSCanvasGradientPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCanvasGradient>(exec);
+    return getDOMPrototype<JSCanvasGradient>(exec, globalObject);
 }
 
 bool JSCanvasGradientPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -73,36 +70,36 @@ JSCanvasGradient::JSCanvasGradient(PassRefPtr<Structure> structure, PassRefPtr<C
 JSCanvasGradient::~JSCanvasGradient()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSCanvasGradient::createPrototype(ExecState* exec)
+JSObject* JSCanvasGradient::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCanvasGradientPrototype(JSCanvasGradientPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSCanvasGradientPrototype(JSCanvasGradientPrototype::createStructure(globalObject->objectPrototype()));
 }
 
-JSValuePtr jsCanvasGradientPrototypeFunctionAddColorStop(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasGradientPrototypeFunctionAddColorStop(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasGradient::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasGradient::s_info))
         return throwError(exec, TypeError);
     JSCanvasGradient* castedThisObj = static_cast<JSCanvasGradient*>(asObject(thisValue));
     CanvasGradient* imp = static_cast<CanvasGradient*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float offset = args.at(exec, 0)->toFloat(exec);
-    const UString& color = args.at(exec, 1)->toString(exec);
+    float offset = args.at(0).toFloat(exec);
+    const UString& color = args.at(1).toString(exec);
 
     imp->addColorStop(offset, color, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, CanvasGradient* object)
+JSC::JSValue toJS(JSC::ExecState* exec, CanvasGradient* object)
 {
     return getDOMObjectWrapper<JSCanvasGradient>(exec, object);
 }
-CanvasGradient* toCanvasGradient(JSC::JSValuePtr value)
+CanvasGradient* toCanvasGradient(JSC::JSValue value)
 {
-    return value->isObject(&JSCanvasGradient::s_info) ? static_cast<JSCanvasGradient*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSCanvasGradient::s_info) ? static_cast<JSCanvasGradient*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h
index 0fc34b0..e81a3b4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasGradient.h
@@ -34,7 +34,7 @@ class JSCanvasGradient : public DOMObject {
 public:
     JSCanvasGradient(PassRefPtr<JSC::Structure>, PassRefPtr<CanvasGradient>);
     virtual ~JSCanvasGradient();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -44,16 +44,17 @@ private:
     RefPtr<CanvasGradient> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, CanvasGradient*);
-CanvasGradient* toCanvasGradient(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, CanvasGradient*);
+CanvasGradient* toCanvasGradient(JSC::JSValue);
 
 class JSCanvasGradientPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,7 +63,7 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsCanvasGradientPrototypeFunctionAddColorStop(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasGradientPrototypeFunctionAddColorStop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.cpp
index e14937f..14dc535 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.cpp
@@ -19,19 +19,16 @@
 */
 
 #include "config.h"
-
 #include "JSCanvasPattern.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CanvasPattern.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasPattern)
+ASSERT_CLASS_FITS_IN_CELL(JSCanvasPattern);
 
 /* Hash table for prototype */
 
@@ -49,9 +46,9 @@ static const HashTable JSCanvasPatternPrototypeTable =
 
 const ClassInfo JSCanvasPatternPrototype::s_info = { "CanvasPatternPrototype", 0, &JSCanvasPatternPrototypeTable, 0 };
 
-JSObject* JSCanvasPatternPrototype::self(ExecState* exec)
+JSObject* JSCanvasPatternPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCanvasPattern>(exec);
+    return getDOMPrototype<JSCanvasPattern>(exec, globalObject);
 }
 
 const ClassInfo JSCanvasPattern::s_info = { "CanvasPattern", 0, 0, 0 };
@@ -65,21 +62,20 @@ JSCanvasPattern::JSCanvasPattern(PassRefPtr<Structure> structure, PassRefPtr<Can
 JSCanvasPattern::~JSCanvasPattern()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSCanvasPattern::createPrototype(ExecState* exec)
+JSObject* JSCanvasPattern::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCanvasPatternPrototype(JSCanvasPatternPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSCanvasPatternPrototype(JSCanvasPatternPrototype::createStructure(globalObject->objectPrototype()));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, CanvasPattern* object)
+JSC::JSValue toJS(JSC::ExecState* exec, CanvasPattern* object)
 {
     return getDOMObjectWrapper<JSCanvasPattern>(exec, object);
 }
-CanvasPattern* toCanvasPattern(JSC::JSValuePtr value)
+CanvasPattern* toCanvasPattern(JSC::JSValue value)
 {
-    return value->isObject(&JSCanvasPattern::s_info) ? static_cast<JSCanvasPattern*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSCanvasPattern::s_info) ? static_cast<JSCanvasPattern*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h
index 1d691a2..776b830 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasPattern.h
@@ -34,7 +34,7 @@ class JSCanvasPattern : public DOMObject {
 public:
     JSCanvasPattern(PassRefPtr<JSC::Structure>, PassRefPtr<CanvasPattern>);
     virtual ~JSCanvasPattern();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -44,12 +44,13 @@ private:
     RefPtr<CanvasPattern> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, CanvasPattern*);
-CanvasPattern* toCanvasPattern(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, CanvasPattern*);
+CanvasPattern* toCanvasPattern(JSC::JSValue);
 
 class JSCanvasPatternPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSCanvasPatternPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp
index 5148f6a..2f318c1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.cpp
@@ -19,11 +19,8 @@
 */
 
 #include "config.h"
-
 #include "JSCanvasRenderingContext2D.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CanvasGradient.h"
 #include "CanvasPattern.h"
 #include "CanvasRenderingContext2D.h"
@@ -37,16 +34,16 @@
 #include "KURL.h"
 #include "PlatformString.h"
 #include "TextMetrics.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCanvasRenderingContext2D)
+ASSERT_CLASS_FITS_IN_CELL(JSCanvasRenderingContext2D);
 
 /* Hash table */
 
@@ -98,13 +95,13 @@ public:
     JSCanvasRenderingContext2DConstructor(ExecState* exec)
         : DOMObject(JSCanvasRenderingContext2DConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCanvasRenderingContext2DPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCanvasRenderingContext2DPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -177,9 +174,9 @@ static const HashTable JSCanvasRenderingContext2DPrototypeTable =
 
 const ClassInfo JSCanvasRenderingContext2DPrototype::s_info = { "CanvasRenderingContext2DPrototype", 0, &JSCanvasRenderingContext2DPrototypeTable, 0 };
 
-JSObject* JSCanvasRenderingContext2DPrototype::self(ExecState* exec)
+JSObject* JSCanvasRenderingContext2DPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCanvasRenderingContext2D>(exec);
+    return getDOMPrototype<JSCanvasRenderingContext2D>(exec, globalObject);
 }
 
 bool JSCanvasRenderingContext2DPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -198,12 +195,11 @@ JSCanvasRenderingContext2D::JSCanvasRenderingContext2D(PassRefPtr<Structure> str
 JSCanvasRenderingContext2D::~JSCanvasRenderingContext2D()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSCanvasRenderingContext2D::createPrototype(ExecState* exec)
+JSObject* JSCanvasRenderingContext2D::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCanvasRenderingContext2DPrototype(JSCanvasRenderingContext2DPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSCanvasRenderingContext2DPrototype(JSCanvasRenderingContext2DPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSCanvasRenderingContext2D::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -211,205 +207,220 @@ bool JSCanvasRenderingContext2D::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSCanvasRenderingContext2D, Base>(exec, &JSCanvasRenderingContext2DTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCanvasRenderingContext2DCanvas(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DCanvas(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->canvas()));
 }
 
-JSValuePtr jsCanvasRenderingContext2DGlobalAlpha(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DGlobalAlpha(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->globalAlpha());
 }
 
-JSValuePtr jsCanvasRenderingContext2DGlobalCompositeOperation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DGlobalCompositeOperation(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->globalCompositeOperation());
 }
 
-JSValuePtr jsCanvasRenderingContext2DLineWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DLineWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->lineWidth());
 }
 
-JSValuePtr jsCanvasRenderingContext2DLineCap(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DLineCap(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->lineCap());
 }
 
-JSValuePtr jsCanvasRenderingContext2DLineJoin(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DLineJoin(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->lineJoin());
 }
 
-JSValuePtr jsCanvasRenderingContext2DMiterLimit(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DMiterLimit(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->miterLimit());
 }
 
-JSValuePtr jsCanvasRenderingContext2DShadowOffsetX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DShadowOffsetX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->shadowOffsetX());
 }
 
-JSValuePtr jsCanvasRenderingContext2DShadowOffsetY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DShadowOffsetY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->shadowOffsetY());
 }
 
-JSValuePtr jsCanvasRenderingContext2DShadowBlur(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DShadowBlur(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->shadowBlur());
 }
 
-JSValuePtr jsCanvasRenderingContext2DShadowColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DShadowColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->shadowColor());
 }
 
-JSValuePtr jsCanvasRenderingContext2DFont(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DFont(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->font());
 }
 
-JSValuePtr jsCanvasRenderingContext2DTextAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DTextAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->textAlign());
 }
 
-JSValuePtr jsCanvasRenderingContext2DTextBaseline(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DTextBaseline(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->textBaseline());
 }
 
-JSValuePtr jsCanvasRenderingContext2DStrokeStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DStrokeStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->strokeStyle(exec);
 }
 
-JSValuePtr jsCanvasRenderingContext2DFillStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DFillStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->fillStyle(exec);
 }
 
-JSValuePtr jsCanvasRenderingContext2DConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCanvasRenderingContext2DConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCanvasRenderingContext2D*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSCanvasRenderingContext2D::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSCanvasRenderingContext2D::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSCanvasRenderingContext2D, Base>(exec, propertyName, value, &JSCanvasRenderingContext2DTable, this, slot);
 }
 
-void setJSCanvasRenderingContext2DGlobalAlpha(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DGlobalAlpha(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
-    imp->setGlobalAlpha(value->toFloat(exec));
+    imp->setGlobalAlpha(value.toFloat(exec));
 }
 
-void setJSCanvasRenderingContext2DGlobalCompositeOperation(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DGlobalCompositeOperation(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
     imp->setGlobalCompositeOperation(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSCanvasRenderingContext2DLineWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DLineWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
-    imp->setLineWidth(value->toFloat(exec));
+    imp->setLineWidth(value.toFloat(exec));
 }
 
-void setJSCanvasRenderingContext2DLineCap(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DLineCap(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
     imp->setLineCap(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSCanvasRenderingContext2DLineJoin(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DLineJoin(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
     imp->setLineJoin(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSCanvasRenderingContext2DMiterLimit(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DMiterLimit(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
-    imp->setMiterLimit(value->toFloat(exec));
+    imp->setMiterLimit(value.toFloat(exec));
 }
 
-void setJSCanvasRenderingContext2DShadowOffsetX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DShadowOffsetX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
-    imp->setShadowOffsetX(value->toFloat(exec));
+    imp->setShadowOffsetX(value.toFloat(exec));
 }
 
-void setJSCanvasRenderingContext2DShadowOffsetY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DShadowOffsetY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
-    imp->setShadowOffsetY(value->toFloat(exec));
+    imp->setShadowOffsetY(value.toFloat(exec));
 }
 
-void setJSCanvasRenderingContext2DShadowBlur(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DShadowBlur(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
-    imp->setShadowBlur(value->toFloat(exec));
+    imp->setShadowBlur(value.toFloat(exec));
 }
 
-void setJSCanvasRenderingContext2DShadowColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DShadowColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
     imp->setShadowColor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSCanvasRenderingContext2DFont(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DFont(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
-    imp->setFont(value->toString(exec));
+    imp->setFont(value.toString(exec));
 }
 
-void setJSCanvasRenderingContext2DTextAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DTextAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
-    imp->setTextAlign(value->toString(exec));
+    imp->setTextAlign(value.toString(exec));
 }
 
-void setJSCanvasRenderingContext2DTextBaseline(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DTextBaseline(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(static_cast<JSCanvasRenderingContext2D*>(thisObject)->impl());
-    imp->setTextBaseline(value->toString(exec));
+    imp->setTextBaseline(value.toString(exec));
 }
 
-void setJSCanvasRenderingContext2DStrokeStyle(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DStrokeStyle(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSCanvasRenderingContext2D*>(thisObject)->setStrokeStyle(exec, value);
 }
 
-void setJSCanvasRenderingContext2DFillStyle(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCanvasRenderingContext2DFillStyle(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSCanvasRenderingContext2D*>(thisObject)->setFillStyle(exec, value);
 }
 
-JSValuePtr JSCanvasRenderingContext2D::getConstructor(ExecState* exec)
+JSValue JSCanvasRenderingContext2D::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCanvasRenderingContext2DConstructor>(exec);
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSave(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSave(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -418,9 +429,10 @@ JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSave(ExecState* exec, JSOb
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionRestore(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionRestore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -429,149 +441,159 @@ JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionRestore(ExecState* exec, J
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionScale(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionScale(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float sx = args.at(exec, 0)->toFloat(exec);
-    float sy = args.at(exec, 1)->toFloat(exec);
+    float sx = args.at(0).toFloat(exec);
+    float sy = args.at(1).toFloat(exec);
 
     imp->scale(sx, sy);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionRotate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionRotate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float angle = args.at(exec, 0)->toFloat(exec);
+    float angle = args.at(0).toFloat(exec);
 
     imp->rotate(angle);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionTranslate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionTranslate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float tx = args.at(exec, 0)->toFloat(exec);
-    float ty = args.at(exec, 1)->toFloat(exec);
+    float tx = args.at(0).toFloat(exec);
+    float ty = args.at(1).toFloat(exec);
 
     imp->translate(tx, ty);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionTransform(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionTransform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float m11 = args.at(exec, 0)->toFloat(exec);
-    float m12 = args.at(exec, 1)->toFloat(exec);
-    float m21 = args.at(exec, 2)->toFloat(exec);
-    float m22 = args.at(exec, 3)->toFloat(exec);
-    float dx = args.at(exec, 4)->toFloat(exec);
-    float dy = args.at(exec, 5)->toFloat(exec);
+    float m11 = args.at(0).toFloat(exec);
+    float m12 = args.at(1).toFloat(exec);
+    float m21 = args.at(2).toFloat(exec);
+    float m22 = args.at(3).toFloat(exec);
+    float dx = args.at(4).toFloat(exec);
+    float dy = args.at(5).toFloat(exec);
 
     imp->transform(m11, m12, m21, m22, dx, dy);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetTransform(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetTransform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float m11 = args.at(exec, 0)->toFloat(exec);
-    float m12 = args.at(exec, 1)->toFloat(exec);
-    float m21 = args.at(exec, 2)->toFloat(exec);
-    float m22 = args.at(exec, 3)->toFloat(exec);
-    float dx = args.at(exec, 4)->toFloat(exec);
-    float dy = args.at(exec, 5)->toFloat(exec);
+    float m11 = args.at(0).toFloat(exec);
+    float m12 = args.at(1).toFloat(exec);
+    float m21 = args.at(2).toFloat(exec);
+    float m22 = args.at(3).toFloat(exec);
+    float dx = args.at(4).toFloat(exec);
+    float dy = args.at(5).toFloat(exec);
 
     imp->setTransform(m11, m12, m21, m22, dx, dy);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionCreateLinearGradient(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionCreateLinearGradient(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float x0 = args.at(exec, 0)->toFloat(exec);
-    float y0 = args.at(exec, 1)->toFloat(exec);
-    float x1 = args.at(exec, 2)->toFloat(exec);
-    float y1 = args.at(exec, 3)->toFloat(exec);
+    float x0 = args.at(0).toFloat(exec);
+    float y0 = args.at(1).toFloat(exec);
+    float x1 = args.at(2).toFloat(exec);
+    float y1 = args.at(3).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createLinearGradient(x0, y0, x1, y1, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createLinearGradient(x0, y0, x1, y1, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionCreateRadialGradient(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionCreateRadialGradient(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float x0 = args.at(exec, 0)->toFloat(exec);
-    float y0 = args.at(exec, 1)->toFloat(exec);
-    float r0 = args.at(exec, 2)->toFloat(exec);
-    float x1 = args.at(exec, 3)->toFloat(exec);
-    float y1 = args.at(exec, 4)->toFloat(exec);
-    float r1 = args.at(exec, 5)->toFloat(exec);
+    float x0 = args.at(0).toFloat(exec);
+    float y0 = args.at(1).toFloat(exec);
+    float r0 = args.at(2).toFloat(exec);
+    float x1 = args.at(3).toFloat(exec);
+    float y1 = args.at(4).toFloat(exec);
+    float r1 = args.at(5).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createRadialGradient(x0, y0, r0, x1, y1, r1, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createRadialGradient(x0, y0, r0, x1, y1, r1, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionClearRect(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClearRect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float width = args.at(exec, 2)->toFloat(exec);
-    float height = args.at(exec, 3)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float width = args.at(2).toFloat(exec);
+    float height = args.at(3).toFloat(exec);
 
     imp->clearRect(x, y, width, height);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionFillRect(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionFillRect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float width = args.at(exec, 2)->toFloat(exec);
-    float height = args.at(exec, 3)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float width = args.at(2).toFloat(exec);
+    float height = args.at(3).toFloat(exec);
 
     imp->fillRect(x, y, width, height);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionBeginPath(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionBeginPath(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -580,9 +602,10 @@ JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionBeginPath(ExecState* exec,
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionClosePath(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClosePath(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -591,119 +614,127 @@ JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionClosePath(ExecState* exec,
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionMoveTo(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionMoveTo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
     imp->moveTo(x, y);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionLineTo(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionLineTo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
     imp->lineTo(x, y);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionQuadraticCurveTo(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionQuadraticCurveTo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float cpx = args.at(exec, 0)->toFloat(exec);
-    float cpy = args.at(exec, 1)->toFloat(exec);
-    float x = args.at(exec, 2)->toFloat(exec);
-    float y = args.at(exec, 3)->toFloat(exec);
+    float cpx = args.at(0).toFloat(exec);
+    float cpy = args.at(1).toFloat(exec);
+    float x = args.at(2).toFloat(exec);
+    float y = args.at(3).toFloat(exec);
 
     imp->quadraticCurveTo(cpx, cpy, x, y);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionBezierCurveTo(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionBezierCurveTo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float cp1x = args.at(exec, 0)->toFloat(exec);
-    float cp1y = args.at(exec, 1)->toFloat(exec);
-    float cp2x = args.at(exec, 2)->toFloat(exec);
-    float cp2y = args.at(exec, 3)->toFloat(exec);
-    float x = args.at(exec, 4)->toFloat(exec);
-    float y = args.at(exec, 5)->toFloat(exec);
+    float cp1x = args.at(0).toFloat(exec);
+    float cp1y = args.at(1).toFloat(exec);
+    float cp2x = args.at(2).toFloat(exec);
+    float cp2y = args.at(3).toFloat(exec);
+    float x = args.at(4).toFloat(exec);
+    float y = args.at(5).toFloat(exec);
 
     imp->bezierCurveTo(cp1x, cp1y, cp2x, cp2y, x, y);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionArcTo(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionArcTo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float x1 = args.at(exec, 0)->toFloat(exec);
-    float y1 = args.at(exec, 1)->toFloat(exec);
-    float x2 = args.at(exec, 2)->toFloat(exec);
-    float y2 = args.at(exec, 3)->toFloat(exec);
-    float radius = args.at(exec, 4)->toFloat(exec);
+    float x1 = args.at(0).toFloat(exec);
+    float y1 = args.at(1).toFloat(exec);
+    float x2 = args.at(2).toFloat(exec);
+    float y2 = args.at(3).toFloat(exec);
+    float radius = args.at(4).toFloat(exec);
 
     imp->arcTo(x1, y1, x2, y2, radius, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionRect(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionRect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float width = args.at(exec, 2)->toFloat(exec);
-    float height = args.at(exec, 3)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float width = args.at(2).toFloat(exec);
+    float height = args.at(3).toFloat(exec);
 
     imp->rect(x, y, width, height);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionArc(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionArc(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float radius = args.at(exec, 2)->toFloat(exec);
-    float startAngle = args.at(exec, 3)->toFloat(exec);
-    float endAngle = args.at(exec, 4)->toFloat(exec);
-    bool anticlockwise = args.at(exec, 5)->toBoolean(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float radius = args.at(2).toFloat(exec);
+    float startAngle = args.at(3).toFloat(exec);
+    float endAngle = args.at(4).toFloat(exec);
+    bool anticlockwise = args.at(5).toBoolean(exec);
 
     imp->arc(x, y, radius, startAngle, endAngle, anticlockwise, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionFill(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionFill(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -712,9 +743,10 @@ JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionFill(ExecState* exec, JSOb
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionStroke(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionStroke(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -723,9 +755,10 @@ JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionStroke(ExecState* exec, JS
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionClip(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClip(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -734,124 +767,135 @@ JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionClip(ExecState* exec, JSOb
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionIsPointInPath(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionIsPointInPath(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->isPointInPath(x, y));
+    JSC::JSValue result = jsBoolean(imp->isPointInPath(x, y));
     return result;
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionFillText(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionFillText(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->fillText(exec, args);
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionStrokeText(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionStrokeText(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->strokeText(exec, args);
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionMeasureText(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionMeasureText(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    const UString& text = args.at(exec, 0)->toString(exec);
+    const UString& text = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->measureText(text)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->measureText(text)));
     return result;
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetAlpha(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetAlpha(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float alpha = args.at(exec, 0)->toFloat(exec);
+    float alpha = args.at(0).toFloat(exec);
 
     imp->setAlpha(alpha);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetCompositeOperation(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetCompositeOperation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    const UString& compositeOperation = args.at(exec, 0)->toString(exec);
+    const UString& compositeOperation = args.at(0).toString(exec);
 
     imp->setCompositeOperation(compositeOperation);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetLineWidth(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetLineWidth(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float width = args.at(exec, 0)->toFloat(exec);
+    float width = args.at(0).toFloat(exec);
 
     imp->setLineWidth(width);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetLineCap(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetLineCap(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    const UString& cap = args.at(exec, 0)->toString(exec);
+    const UString& cap = args.at(0).toString(exec);
 
     imp->setLineCap(cap);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetLineJoin(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetLineJoin(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    const UString& join = args.at(exec, 0)->toString(exec);
+    const UString& join = args.at(0).toString(exec);
 
     imp->setLineJoin(join);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetMiterLimit(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetMiterLimit(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float limit = args.at(exec, 0)->toFloat(exec);
+    float limit = args.at(0).toFloat(exec);
 
     imp->setMiterLimit(limit);
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionClearShadow(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClearShadow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
@@ -860,109 +904,119 @@ JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionClearShadow(ExecState* exe
     return jsUndefined();
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetStrokeColor(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetStrokeColor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->setStrokeColor(exec, args);
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetFillColor(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetFillColor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->setFillColor(exec, args);
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionStrokeRect(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionStrokeRect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->strokeRect(exec, args);
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionDrawImage(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionDrawImage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->drawImage(exec, args);
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionDrawImageFromRect(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionDrawImageFromRect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->drawImageFromRect(exec, args);
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetShadow(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetShadow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->setShadow(exec, args);
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionCreatePattern(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionCreatePattern(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->createPattern(exec, args);
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionCreateImageData(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionCreateImageData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
-    float sw = args.at(exec, 0)->toFloat(exec);
-    float sh = args.at(exec, 1)->toFloat(exec);
+    float sw = args.at(0).toFloat(exec);
+    float sh = args.at(1).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createImageData(sw, sh)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createImageData(sw, sh)));
     return result;
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionGetImageData(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionGetImageData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     CanvasRenderingContext2D* imp = static_cast<CanvasRenderingContext2D*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float sx = args.at(exec, 0)->toFloat(exec);
-    float sy = args.at(exec, 1)->toFloat(exec);
-    float sw = args.at(exec, 2)->toFloat(exec);
-    float sh = args.at(exec, 3)->toFloat(exec);
+    float sx = args.at(0).toFloat(exec);
+    float sy = args.at(1).toFloat(exec);
+    float sw = args.at(2).toFloat(exec);
+    float sh = args.at(3).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getImageData(sx, sy, sw, sh, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getImageData(sx, sy, sw, sh, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionPutImageData(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionPutImageData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCanvasRenderingContext2D::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCanvasRenderingContext2D::s_info))
         return throwError(exec, TypeError);
     JSCanvasRenderingContext2D* castedThisObj = static_cast<JSCanvasRenderingContext2D*>(asObject(thisValue));
     return castedThisObj->putImageData(exec, args);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, CanvasRenderingContext2D* object)
+JSC::JSValue toJS(JSC::ExecState* exec, CanvasRenderingContext2D* object)
 {
     return getDOMObjectWrapper<JSCanvasRenderingContext2D>(exec, object);
 }
-CanvasRenderingContext2D* toCanvasRenderingContext2D(JSC::JSValuePtr value)
+CanvasRenderingContext2D* toCanvasRenderingContext2D(JSC::JSValue value)
 {
-    return value->isObject(&JSCanvasRenderingContext2D::s_info) ? static_cast<JSCanvasRenderingContext2D*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSCanvasRenderingContext2D::s_info) ? static_cast<JSCanvasRenderingContext2D*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h
index ace29c8..6c084d1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCanvasRenderingContext2D.h
@@ -34,52 +34,53 @@ class JSCanvasRenderingContext2D : public DOMObject {
 public:
     JSCanvasRenderingContext2D(PassRefPtr<JSC::Structure>, PassRefPtr<CanvasRenderingContext2D>);
     virtual ~JSCanvasRenderingContext2D();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom attributes
-    JSC::JSValuePtr strokeStyle(JSC::ExecState*) const;
-    void setStrokeStyle(JSC::ExecState*, JSC::JSValuePtr);
-    JSC::JSValuePtr fillStyle(JSC::ExecState*) const;
-    void setFillStyle(JSC::ExecState*, JSC::JSValuePtr);
+    JSC::JSValue strokeStyle(JSC::ExecState*) const;
+    void setStrokeStyle(JSC::ExecState*, JSC::JSValue);
+    JSC::JSValue fillStyle(JSC::ExecState*) const;
+    void setFillStyle(JSC::ExecState*, JSC::JSValue);
 
     // Custom functions
-    JSC::JSValuePtr fillText(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr strokeText(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setStrokeColor(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setFillColor(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr strokeRect(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr drawImage(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr drawImageFromRect(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setShadow(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr createPattern(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr putImageData(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue fillText(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue strokeText(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setStrokeColor(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setFillColor(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue strokeRect(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue drawImage(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue drawImageFromRect(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setShadow(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue createPattern(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue putImageData(JSC::ExecState*, const JSC::ArgList&);
     CanvasRenderingContext2D* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<CanvasRenderingContext2D> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, CanvasRenderingContext2D*);
-CanvasRenderingContext2D* toCanvasRenderingContext2D(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, CanvasRenderingContext2D*);
+CanvasRenderingContext2D* toCanvasRenderingContext2D(JSC::JSValue);
 
 class JSCanvasRenderingContext2DPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -88,84 +89,84 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSave(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionRestore(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionScale(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionRotate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionTranslate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionTransform(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetTransform(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionCreateLinearGradient(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionCreateRadialGradient(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionClearRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionFillRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionBeginPath(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionClosePath(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionMoveTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionLineTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionQuadraticCurveTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionBezierCurveTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionArcTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionArc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionFill(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionStroke(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionClip(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionIsPointInPath(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionFillText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionStrokeText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionMeasureText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetAlpha(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetCompositeOperation(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetLineWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetLineCap(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetLineJoin(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetMiterLimit(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionClearShadow(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetStrokeColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetFillColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionStrokeRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionDrawImage(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionDrawImageFromRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionSetShadow(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionCreatePattern(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionCreateImageData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionGetImageData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCanvasRenderingContext2DPrototypeFunctionPutImageData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSave(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionRestore(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionScale(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionRotate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionTranslate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionTransform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetTransform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionCreateLinearGradient(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionCreateRadialGradient(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClearRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionFillRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionBeginPath(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClosePath(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionMoveTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionLineTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionQuadraticCurveTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionBezierCurveTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionArcTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionArc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionFill(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionStroke(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClip(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionIsPointInPath(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionFillText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionStrokeText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionMeasureText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetAlpha(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetCompositeOperation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetLineWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetLineCap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetLineJoin(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetMiterLimit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionClearShadow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetStrokeColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetFillColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionStrokeRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionDrawImage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionDrawImageFromRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionSetShadow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionCreatePattern(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionCreateImageData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionGetImageData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCanvasRenderingContext2DPrototypeFunctionPutImageData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsCanvasRenderingContext2DCanvas(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCanvasRenderingContext2DGlobalAlpha(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DGlobalAlpha(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DGlobalCompositeOperation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DGlobalCompositeOperation(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DLineWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DLineWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DLineCap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DLineCap(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DLineJoin(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DLineJoin(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DMiterLimit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DMiterLimit(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DShadowOffsetX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DShadowOffsetX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DShadowOffsetY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DShadowOffsetY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DShadowBlur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DShadowBlur(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DShadowColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DShadowColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DFont(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DFont(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DTextAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DTextAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DTextBaseline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DTextBaseline(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DStrokeStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DStrokeStyle(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DFillStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCanvasRenderingContext2DFillStyle(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCanvasRenderingContext2DConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DCanvas(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCanvasRenderingContext2DGlobalAlpha(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DGlobalAlpha(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DGlobalCompositeOperation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DGlobalCompositeOperation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DLineWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DLineWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DLineCap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DLineCap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DLineJoin(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DLineJoin(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DMiterLimit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DMiterLimit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DShadowOffsetX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DShadowOffsetX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DShadowOffsetY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DShadowOffsetY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DShadowBlur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DShadowBlur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DShadowColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DShadowColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DFont(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DFont(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DTextAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DTextAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DTextBaseline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DTextBaseline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DStrokeStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DStrokeStyle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DFillStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCanvasRenderingContext2DFillStyle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCanvasRenderingContext2DConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp
index ba59a0c..a860721 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.cpp
@@ -19,24 +19,21 @@
 */
 
 #include "config.h"
-
 #include "JSCharacterData.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CharacterData.h"
 #include "ExceptionCode.h"
 #include "KURL.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCharacterData)
+ASSERT_CLASS_FITS_IN_CELL(JSCharacterData);
 
 /* Hash table */
 
@@ -74,13 +71,13 @@ public:
     JSCharacterDataConstructor(ExecState* exec)
         : DOMObject(JSCharacterDataConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCharacterDataPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCharacterDataPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -114,9 +111,9 @@ static const HashTable JSCharacterDataPrototypeTable =
 
 const ClassInfo JSCharacterDataPrototype::s_info = { "CharacterDataPrototype", 0, &JSCharacterDataPrototypeTable, 0 };
 
-JSObject* JSCharacterDataPrototype::self(ExecState* exec)
+JSObject* JSCharacterDataPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCharacterData>(exec);
+    return getDOMPrototype<JSCharacterData>(exec, globalObject);
 }
 
 bool JSCharacterDataPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -124,16 +121,16 @@ bool JSCharacterDataPrototype::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticFunctionSlot<JSObject>(exec, &JSCharacterDataPrototypeTable, this, propertyName, slot);
 }
 
-const ClassInfo JSCharacterData::s_info = { "CharacterData", &JSEventTargetNode::s_info, &JSCharacterDataTable, 0 };
+const ClassInfo JSCharacterData::s_info = { "CharacterData", &JSNode::s_info, &JSCharacterDataTable, 0 };
 
 JSCharacterData::JSCharacterData(PassRefPtr<Structure> structure, PassRefPtr<CharacterData> impl)
-    : JSEventTargetNode(structure, impl)
+    : JSNode(structure, impl)
 {
 }
 
-JSObject* JSCharacterData::createPrototype(ExecState* exec)
+JSObject* JSCharacterData::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCharacterDataPrototype(JSCharacterDataPrototype::createStructure(JSEventTargetNodePrototype::self(exec)));
+    return new (exec) JSCharacterDataPrototype(JSCharacterDataPrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
 bool JSCharacterData::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -141,28 +138,30 @@ bool JSCharacterData::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSCharacterData, Base>(exec, &JSCharacterDataTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCharacterDataData(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCharacterDataData(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CharacterData* imp = static_cast<CharacterData*>(static_cast<JSCharacterData*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->data());
 }
 
-JSValuePtr jsCharacterDataLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCharacterDataLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     CharacterData* imp = static_cast<CharacterData*>(static_cast<JSCharacterData*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsCharacterDataConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCharacterDataConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCharacterData*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSCharacterData::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSCharacterData::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSCharacterData, Base>(exec, propertyName, value, &JSCharacterDataTable, this, slot);
 }
 
-void setJSCharacterDataData(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSCharacterDataData(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     CharacterData* imp = static_cast<CharacterData*>(static_cast<JSCharacterData*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -170,81 +169,85 @@ void setJSCharacterDataData(ExecState* exec, JSObject* thisObject, JSValuePtr va
     setDOMException(exec, ec);
 }
 
-JSValuePtr JSCharacterData::getConstructor(ExecState* exec)
+JSValue JSCharacterData::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCharacterDataConstructor>(exec);
 }
 
-JSValuePtr jsCharacterDataPrototypeFunctionSubstringData(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionSubstringData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCharacterData::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCharacterData::s_info))
         return throwError(exec, TypeError);
     JSCharacterData* castedThisObj = static_cast<JSCharacterData*>(asObject(thisValue));
     CharacterData* imp = static_cast<CharacterData*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    int offset = args.at(exec, 0)->toInt32(exec);
+    int offset = args.at(0).toInt32(exec);
     if (offset < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return jsUndefined();
     }
-    int length = args.at(exec, 1)->toInt32(exec);
+    int length = args.at(1).toInt32(exec);
     if (length < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return jsUndefined();
     }
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->substringData(offset, length, ec));
+    JSC::JSValue result = jsStringOrNull(exec, imp->substringData(offset, length, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsCharacterDataPrototypeFunctionAppendData(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionAppendData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCharacterData::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCharacterData::s_info))
         return throwError(exec, TypeError);
     JSCharacterData* castedThisObj = static_cast<JSCharacterData*>(asObject(thisValue));
     CharacterData* imp = static_cast<CharacterData*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& data = args.at(exec, 0)->toString(exec);
+    const UString& data = args.at(0).toString(exec);
 
     imp->appendData(data, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsCharacterDataPrototypeFunctionInsertData(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionInsertData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCharacterData::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCharacterData::s_info))
         return throwError(exec, TypeError);
     JSCharacterData* castedThisObj = static_cast<JSCharacterData*>(asObject(thisValue));
     CharacterData* imp = static_cast<CharacterData*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    int offset = args.at(exec, 0)->toInt32(exec);
+    int offset = args.at(0).toInt32(exec);
     if (offset < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return jsUndefined();
     }
-    const UString& data = args.at(exec, 1)->toString(exec);
+    const UString& data = args.at(1).toString(exec);
 
     imp->insertData(offset, data, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsCharacterDataPrototypeFunctionDeleteData(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionDeleteData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCharacterData::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCharacterData::s_info))
         return throwError(exec, TypeError);
     JSCharacterData* castedThisObj = static_cast<JSCharacterData*>(asObject(thisValue));
     CharacterData* imp = static_cast<CharacterData*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    int offset = args.at(exec, 0)->toInt32(exec);
+    int offset = args.at(0).toInt32(exec);
     if (offset < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return jsUndefined();
     }
-    int length = args.at(exec, 1)->toInt32(exec);
+    int length = args.at(1).toInt32(exec);
     if (length < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return jsUndefined();
@@ -255,24 +258,25 @@ JSValuePtr jsCharacterDataPrototypeFunctionDeleteData(ExecState* exec, JSObject*
     return jsUndefined();
 }
 
-JSValuePtr jsCharacterDataPrototypeFunctionReplaceData(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionReplaceData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSCharacterData::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCharacterData::s_info))
         return throwError(exec, TypeError);
     JSCharacterData* castedThisObj = static_cast<JSCharacterData*>(asObject(thisValue));
     CharacterData* imp = static_cast<CharacterData*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    int offset = args.at(exec, 0)->toInt32(exec);
+    int offset = args.at(0).toInt32(exec);
     if (offset < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return jsUndefined();
     }
-    int length = args.at(exec, 1)->toInt32(exec);
+    int length = args.at(1).toInt32(exec);
     if (length < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return jsUndefined();
     }
-    const UString& data = args.at(exec, 2)->toString(exec);
+    const UString& data = args.at(2).toString(exec);
 
     imp->replaceData(offset, length, data, ec);
     setDOMException(exec, ec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h
index 4aad715..273318f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCharacterData.h
@@ -21,38 +21,39 @@
 #ifndef JSCharacterData_h
 #define JSCharacterData_h
 
-#include "JSEventTargetNode.h"
+#include "JSNode.h"
 
 namespace WebCore {
 
 class CharacterData;
 
-class JSCharacterData : public JSEventTargetNode {
-    typedef JSEventTargetNode Base;
+class JSCharacterData : public JSNode {
+    typedef JSNode Base;
 public:
     JSCharacterData(PassRefPtr<JSC::Structure>, PassRefPtr<CharacterData>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSCharacterDataPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -61,17 +62,17 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsCharacterDataPrototypeFunctionSubstringData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCharacterDataPrototypeFunctionAppendData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCharacterDataPrototypeFunctionInsertData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCharacterDataPrototypeFunctionDeleteData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsCharacterDataPrototypeFunctionReplaceData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionSubstringData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionAppendData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionInsertData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionDeleteData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsCharacterDataPrototypeFunctionReplaceData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsCharacterDataData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSCharacterDataData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsCharacterDataLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCharacterDataConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCharacterDataData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSCharacterDataData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsCharacterDataLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCharacterDataConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
new file mode 100644
index 0000000..4db0efb
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRect.cpp
@@ -0,0 +1,197 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSClientRect.h"
+
+#include "ClientRect.h"
+#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSClientRect);
+
+/* Hash table */
+
+static const HashTableValue JSClientRectTableValues[8] =
+{
+    { "top", DontDelete|ReadOnly, (intptr_t)jsClientRectTop, (intptr_t)0 },
+    { "right", DontDelete|ReadOnly, (intptr_t)jsClientRectRight, (intptr_t)0 },
+    { "bottom", DontDelete|ReadOnly, (intptr_t)jsClientRectBottom, (intptr_t)0 },
+    { "left", DontDelete|ReadOnly, (intptr_t)jsClientRectLeft, (intptr_t)0 },
+    { "width", DontDelete|ReadOnly, (intptr_t)jsClientRectWidth, (intptr_t)0 },
+    { "height", DontDelete|ReadOnly, (intptr_t)jsClientRectHeight, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsClientRectConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSClientRectTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 255, JSClientRectTableValues, 0 };
+#else
+    { 18, 15, JSClientRectTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSClientRectConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSClientRectConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSClientRectConstructorTableValues, 0 };
+#else
+    { 1, 0, JSClientRectConstructorTableValues, 0 };
+#endif
+
+class JSClientRectConstructor : public DOMObject {
+public:
+    JSClientRectConstructor(ExecState* exec)
+        : DOMObject(JSClientRectConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    {
+        putDirect(exec->propertyNames().prototype, JSClientRectPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+    }
+};
+
+const ClassInfo JSClientRectConstructor::s_info = { "ClientRectConstructor", 0, &JSClientRectConstructorTable, 0 };
+
+bool JSClientRectConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSClientRectConstructor, DOMObject>(exec, &JSClientRectConstructorTable, this, propertyName, slot);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSClientRectPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSClientRectPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSClientRectPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSClientRectPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSClientRectPrototype::s_info = { "ClientRectPrototype", 0, &JSClientRectPrototypeTable, 0 };
+
+JSObject* JSClientRectPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSClientRect>(exec, globalObject);
+}
+
+const ClassInfo JSClientRect::s_info = { "ClientRect", 0, &JSClientRectTable, 0 };
+
+JSClientRect::JSClientRect(PassRefPtr<Structure> structure, PassRefPtr<ClientRect> impl)
+    : DOMObject(structure)
+    , m_impl(impl)
+{
+}
+
+JSClientRect::~JSClientRect()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSClientRect::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSClientRectPrototype(JSClientRectPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSClientRect::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSClientRect, Base>(exec, &JSClientRectTable, this, propertyName, slot);
+}
+
+JSValue jsClientRectTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    ClientRect* imp = static_cast<ClientRect*>(static_cast<JSClientRect*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->top());
+}
+
+JSValue jsClientRectRight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    ClientRect* imp = static_cast<ClientRect*>(static_cast<JSClientRect*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->right());
+}
+
+JSValue jsClientRectBottom(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    ClientRect* imp = static_cast<ClientRect*>(static_cast<JSClientRect*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->bottom());
+}
+
+JSValue jsClientRectLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    ClientRect* imp = static_cast<ClientRect*>(static_cast<JSClientRect*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->left());
+}
+
+JSValue jsClientRectWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    ClientRect* imp = static_cast<ClientRect*>(static_cast<JSClientRect*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->width());
+}
+
+JSValue jsClientRectHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    ClientRect* imp = static_cast<ClientRect*>(static_cast<JSClientRect*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->height());
+}
+
+JSValue jsClientRectConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSClientRect*>(asObject(slot.slotBase()))->getConstructor(exec);
+}
+JSValue JSClientRect::getConstructor(ExecState* exec)
+{
+    return getDOMConstructor<JSClientRectConstructor>(exec);
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, ClientRect* object)
+{
+    return getDOMObjectWrapper<JSClientRect>(exec, object);
+}
+ClientRect* toClientRect(JSC::JSValue value)
+{
+    return value.isObject(&JSClientRect::s_info) ? static_cast<JSClientRect*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRect.h b/src/3rdparty/webkit/WebCore/generated/JSClientRect.h
new file mode 100644
index 0000000..13a7b38
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRect.h
@@ -0,0 +1,78 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSClientRect_h
+#define JSClientRect_h
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class ClientRect;
+
+class JSClientRect : public DOMObject {
+    typedef DOMObject Base;
+public:
+    JSClientRect(PassRefPtr<JSC::Structure>, PassRefPtr<ClientRect>);
+    virtual ~JSClientRect();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*);
+    ClientRect* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<ClientRect> m_impl;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, ClientRect*);
+ClientRect* toClientRect(JSC::JSValue);
+
+class JSClientRectPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    JSClientRectPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Attributes
+
+JSC::JSValue jsClientRectTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClientRectRight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClientRectBottom(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClientRectLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClientRectWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClientRectHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClientRectConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
new file mode 100644
index 0000000..97eff69
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.cpp
@@ -0,0 +1,219 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSClientRectList.h"
+
+#include "ClientRect.h"
+#include "ClientRectList.h"
+#include "ExceptionCode.h"
+#include "JSClientRect.h"
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSClientRectList);
+
+/* Hash table */
+
+static const HashTableValue JSClientRectListTableValues[3] =
+{
+    { "length", DontDelete|ReadOnly, (intptr_t)jsClientRectListLength, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsClientRectListConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSClientRectListTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 15, JSClientRectListTableValues, 0 };
+#else
+    { 5, 3, JSClientRectListTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSClientRectListConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSClientRectListConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSClientRectListConstructorTableValues, 0 };
+#else
+    { 1, 0, JSClientRectListConstructorTableValues, 0 };
+#endif
+
+class JSClientRectListConstructor : public DOMObject {
+public:
+    JSClientRectListConstructor(ExecState* exec)
+        : DOMObject(JSClientRectListConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    {
+        putDirect(exec->propertyNames().prototype, JSClientRectListPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+    }
+};
+
+const ClassInfo JSClientRectListConstructor::s_info = { "ClientRectListConstructor", 0, &JSClientRectListConstructorTable, 0 };
+
+bool JSClientRectListConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSClientRectListConstructor, DOMObject>(exec, &JSClientRectListConstructorTable, this, propertyName, slot);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSClientRectListPrototypeTableValues[2] =
+{
+    { "item", DontDelete|Function, (intptr_t)jsClientRectListPrototypeFunctionItem, (intptr_t)1 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSClientRectListPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSClientRectListPrototypeTableValues, 0 };
+#else
+    { 2, 1, JSClientRectListPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSClientRectListPrototype::s_info = { "ClientRectListPrototype", 0, &JSClientRectListPrototypeTable, 0 };
+
+JSObject* JSClientRectListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSClientRectList>(exec, globalObject);
+}
+
+bool JSClientRectListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSClientRectListPrototypeTable, this, propertyName, slot);
+}
+
+const ClassInfo JSClientRectList::s_info = { "ClientRectList", 0, &JSClientRectListTable, 0 };
+
+JSClientRectList::JSClientRectList(PassRefPtr<Structure> structure, PassRefPtr<ClientRectList> impl)
+    : DOMObject(structure)
+    , m_impl(impl)
+{
+}
+
+JSClientRectList::~JSClientRectList()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSClientRectList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSClientRectListPrototype(JSClientRectListPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSClientRectList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    const HashEntry* entry = JSClientRectListTable.entry(exec, propertyName);
+    if (entry) {
+        slot.setCustom(this, entry->propertyGetter());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<ClientRectList*>(impl())->length()) {
+        slot.setCustomIndex(this, index, indexGetter);
+        return true;
+    }
+    return getStaticValueSlot<JSClientRectList, Base>(exec, &JSClientRectListTable, this, propertyName, slot);
+}
+
+bool JSClientRectList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (propertyName < static_cast<ClientRectList*>(impl())->length()) {
+        slot.setCustomIndex(this, propertyName, indexGetter);
+        return true;
+    }
+    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
+}
+
+JSValue jsClientRectListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    ClientRectList* imp = static_cast<ClientRectList*>(static_cast<JSClientRectList*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->length());
+}
+
+JSValue jsClientRectListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSClientRectList*>(asObject(slot.slotBase()))->getConstructor(exec);
+}
+void JSClientRectList::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    for (unsigned i = 0; i < static_cast<ClientRectList*>(impl())->length(); ++i)
+        propertyNames.add(Identifier::from(exec, i));
+     Base::getPropertyNames(exec, propertyNames);
+}
+
+JSValue JSClientRectList::getConstructor(ExecState* exec)
+{
+    return getDOMConstructor<JSClientRectListConstructor>(exec);
+}
+
+JSValue JSC_HOST_CALL jsClientRectListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSClientRectList::s_info))
+        return throwError(exec, TypeError);
+    JSClientRectList* castedThisObj = static_cast<JSClientRectList*>(asObject(thisValue));
+    ClientRectList* imp = static_cast<ClientRectList*>(castedThisObj->impl());
+    int index = args.at(0).toInt32(exec);
+    if (index < 0) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return jsUndefined();
+    }
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
+    return result;
+}
+
+
+JSValue JSClientRectList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSClientRectList* thisObj = static_cast<JSClientRectList*>(asObject(slot.slotBase()));
+    return toJS(exec, static_cast<ClientRectList*>(thisObj->impl())->item(slot.index()));
+}
+JSC::JSValue toJS(JSC::ExecState* exec, ClientRectList* object)
+{
+    return getDOMObjectWrapper<JSClientRectList>(exec, object);
+}
+ClientRectList* toClientRectList(JSC::JSValue value)
+{
+    return value.isObject(&JSClientRectList::s_info) ? static_cast<JSClientRectList*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMStringList.h b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h
index a08786b..fcb1f56 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMStringList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSClientRectList.h
@@ -18,8 +18,8 @@
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef JSDOMStringList_h
-#define JSDOMStringList_h
+#ifndef JSClientRectList_h
+#define JSClientRectList_h
 
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
@@ -27,60 +27,57 @@
 
 namespace WebCore {
 
-class DOMStringList;
+class ClientRectList;
 
-class JSDOMStringList : public DOMObject {
+class JSClientRectList : public DOMObject {
     typedef DOMObject Base;
 public:
-    JSDOMStringList(PassRefPtr<JSC::Structure>, PassRefPtr<DOMStringList>);
-    virtual ~JSDOMStringList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    JSClientRectList(PassRefPtr<JSC::Structure>, PassRefPtr<ClientRectList>);
+    virtual ~JSClientRectList();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
-
-    // Custom functions
-    JSC::JSValuePtr item(JSC::ExecState*, const JSC::ArgList&);
-    DOMStringList* impl() const { return m_impl.get(); }
+    static JSC::JSValue getConstructor(JSC::ExecState*);
+    ClientRectList* impl() const { return m_impl.get(); }
 
 private:
-    RefPtr<DOMStringList> m_impl;
-    JSC::JSValuePtr getByIndex(JSC::ExecState*, unsigned index);
+    RefPtr<ClientRectList> m_impl;
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, DOMStringList*);
-DOMStringList* toDOMStringList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, ClientRectList*);
+ClientRectList* toClientRectList(JSC::JSValue);
 
-class JSDOMStringListPrototype : public JSC::JSObject {
+class JSClientRectListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
-    JSDOMStringListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+    JSClientRectListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
 
 // Functions
 
-JSC::JSValuePtr jsDOMStringListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMStringListPrototypeFunctionContains(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsClientRectListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsDOMStringListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMStringListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClientRectListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClientRectListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp b/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
index de87a53..19c40b7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSClipboard.cpp
@@ -19,39 +19,38 @@
 */
 
 #include "config.h"
-
 #include "JSClipboard.h"
 
-#include <wtf/GetPtr.h>
-
 #include "Clipboard.h"
+#include "FileList.h"
+#include "JSFileList.h"
 #include "KURL.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSClipboard)
+ASSERT_CLASS_FITS_IN_CELL(JSClipboard);
 
 /* Hash table */
 
-static const HashTableValue JSClipboardTableValues[5] =
+static const HashTableValue JSClipboardTableValues[6] =
 {
     { "dropEffect", DontDelete, (intptr_t)jsClipboardDropEffect, (intptr_t)setJSClipboardDropEffect },
     { "effectAllowed", DontDelete, (intptr_t)jsClipboardEffectAllowed, (intptr_t)setJSClipboardEffectAllowed },
     { "types", DontDelete|ReadOnly, (intptr_t)jsClipboardTypes, (intptr_t)0 },
+    { "files", DontDelete|ReadOnly, (intptr_t)jsClipboardFiles, (intptr_t)0 },
     { "constructor", DontEnum|ReadOnly, (intptr_t)jsClipboardConstructor, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static const HashTable JSClipboardTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 15, JSClipboardTableValues, 0 };
+    { 63, JSClipboardTableValues, 0 };
 #else
-    { 10, 7, JSClipboardTableValues, 0 };
+    { 17, 15, JSClipboardTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -73,13 +72,13 @@ public:
     JSClipboardConstructor(ExecState* exec)
         : DOMObject(JSClipboardConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSClipboardPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSClipboardPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -112,9 +111,9 @@ static const HashTable JSClipboardPrototypeTable =
 
 const ClassInfo JSClipboardPrototype::s_info = { "ClipboardPrototype", 0, &JSClipboardPrototypeTable, 0 };
 
-JSObject* JSClipboardPrototype::self(ExecState* exec)
+JSObject* JSClipboardPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSClipboard>(exec);
+    return getDOMPrototype<JSClipboard>(exec, globalObject);
 }
 
 bool JSClipboardPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,12 +132,11 @@ JSClipboard::JSClipboard(PassRefPtr<Structure> structure, PassRefPtr<Clipboard>
 JSClipboard::~JSClipboard()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSClipboard::createPrototype(ExecState* exec)
+JSObject* JSClipboard::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSClipboardPrototype(JSClipboardPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSClipboardPrototype(JSClipboardPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSClipboard::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -146,88 +144,101 @@ bool JSClipboard::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSClipboard, Base>(exec, &JSClipboardTable, this, propertyName, slot);
 }
 
-JSValuePtr jsClipboardDropEffect(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClipboardDropEffect(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Clipboard* imp = static_cast<Clipboard*>(static_cast<JSClipboard*>(asObject(slot.slotBase()))->impl());
     return jsStringOrUndefined(exec, imp->dropEffect());
 }
 
-JSValuePtr jsClipboardEffectAllowed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClipboardEffectAllowed(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Clipboard* imp = static_cast<Clipboard*>(static_cast<JSClipboard*>(asObject(slot.slotBase()))->impl());
     return jsStringOrUndefined(exec, imp->effectAllowed());
 }
 
-JSValuePtr jsClipboardTypes(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClipboardTypes(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSClipboard*>(asObject(slot.slotBase()))->types(exec);
 }
 
-JSValuePtr jsClipboardConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsClipboardFiles(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Clipboard* imp = static_cast<Clipboard*>(static_cast<JSClipboard*>(asObject(slot.slotBase()))->impl());
+    return toJS(exec, WTF::getPtr(imp->files()));
+}
+
+JSValue jsClipboardConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSClipboard*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSClipboard::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSClipboard::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSClipboard, Base>(exec, propertyName, value, &JSClipboardTable, this, slot);
 }
 
-void setJSClipboardDropEffect(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSClipboardDropEffect(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Clipboard* imp = static_cast<Clipboard*>(static_cast<JSClipboard*>(thisObject)->impl());
-    imp->setDropEffect(value->toString(exec));
+    imp->setDropEffect(value.toString(exec));
 }
 
-void setJSClipboardEffectAllowed(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSClipboardEffectAllowed(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Clipboard* imp = static_cast<Clipboard*>(static_cast<JSClipboard*>(thisObject)->impl());
-    imp->setEffectAllowed(value->toString(exec));
+    imp->setEffectAllowed(value.toString(exec));
 }
 
-JSValuePtr JSClipboard::getConstructor(ExecState* exec)
+JSValue JSClipboard::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSClipboardConstructor>(exec);
 }
 
-JSValuePtr jsClipboardPrototypeFunctionClearData(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionClearData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSClipboard::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSClipboard::s_info))
         return throwError(exec, TypeError);
     JSClipboard* castedThisObj = static_cast<JSClipboard*>(asObject(thisValue));
     return castedThisObj->clearData(exec, args);
 }
 
-JSValuePtr jsClipboardPrototypeFunctionGetData(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionGetData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSClipboard::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSClipboard::s_info))
         return throwError(exec, TypeError);
     JSClipboard* castedThisObj = static_cast<JSClipboard*>(asObject(thisValue));
     return castedThisObj->getData(exec, args);
 }
 
-JSValuePtr jsClipboardPrototypeFunctionSetData(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionSetData(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSClipboard::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSClipboard::s_info))
         return throwError(exec, TypeError);
     JSClipboard* castedThisObj = static_cast<JSClipboard*>(asObject(thisValue));
     return castedThisObj->setData(exec, args);
 }
 
-JSValuePtr jsClipboardPrototypeFunctionSetDragImage(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionSetDragImage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSClipboard::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSClipboard::s_info))
         return throwError(exec, TypeError);
     JSClipboard* castedThisObj = static_cast<JSClipboard*>(asObject(thisValue));
     return castedThisObj->setDragImage(exec, args);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Clipboard* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Clipboard* object)
 {
     return getDOMObjectWrapper<JSClipboard>(exec, object);
 }
-Clipboard* toClipboard(JSC::JSValuePtr value)
+Clipboard* toClipboard(JSC::JSValue value)
 {
-    return value->isObject(&JSClipboard::s_info) ? static_cast<JSClipboard*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSClipboard::s_info) ? static_cast<JSClipboard*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSClipboard.h b/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
index 6f5ea7f..a6fbe3b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSClipboard.h
@@ -34,43 +34,44 @@ class JSClipboard : public DOMObject {
 public:
     JSClipboard(PassRefPtr<JSC::Structure>, PassRefPtr<Clipboard>);
     virtual ~JSClipboard();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom attributes
-    JSC::JSValuePtr types(JSC::ExecState*) const;
+    JSC::JSValue types(JSC::ExecState*) const;
 
     // Custom functions
-    JSC::JSValuePtr clearData(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr getData(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setData(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setDragImage(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue clearData(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getData(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setData(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setDragImage(JSC::ExecState*, const JSC::ArgList&);
     Clipboard* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Clipboard> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Clipboard*);
-Clipboard* toClipboard(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Clipboard*);
+Clipboard* toClipboard(JSC::JSValue);
 
 class JSClipboardPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -79,18 +80,19 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsClipboardPrototypeFunctionClearData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsClipboardPrototypeFunctionGetData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsClipboardPrototypeFunctionSetData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsClipboardPrototypeFunctionSetDragImage(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionClearData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionGetData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionSetData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsClipboardPrototypeFunctionSetDragImage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsClipboardDropEffect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSClipboardDropEffect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsClipboardEffectAllowed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSClipboardEffectAllowed(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsClipboardTypes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsClipboardConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClipboardDropEffect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSClipboardDropEffect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsClipboardEffectAllowed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSClipboardEffectAllowed(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsClipboardTypes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClipboardFiles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsClipboardConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSComment.cpp b/src/3rdparty/webkit/WebCore/generated/JSComment.cpp
index 8da1d42..7905094 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSComment.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSComment.cpp
@@ -19,20 +19,16 @@
 */
 
 #include "config.h"
-
 #include "JSComment.h"
 
-#include <wtf/GetPtr.h>
-
 #include "Comment.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSComment)
+ASSERT_CLASS_FITS_IN_CELL(JSComment);
 
 /* Hash table */
 
@@ -68,13 +64,13 @@ public:
     JSCommentConstructor(ExecState* exec)
         : DOMObject(JSCommentConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCommentPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCommentPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -103,9 +99,9 @@ static const HashTable JSCommentPrototypeTable =
 
 const ClassInfo JSCommentPrototype::s_info = { "CommentPrototype", 0, &JSCommentPrototypeTable, 0 };
 
-JSObject* JSCommentPrototype::self(ExecState* exec)
+JSObject* JSCommentPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSComment>(exec);
+    return getDOMPrototype<JSComment>(exec, globalObject);
 }
 
 const ClassInfo JSComment::s_info = { "Comment", &JSCharacterData::s_info, &JSCommentTable, 0 };
@@ -115,9 +111,9 @@ JSComment::JSComment(PassRefPtr<Structure> structure, PassRefPtr<Comment> impl)
 {
 }
 
-JSObject* JSComment::createPrototype(ExecState* exec)
+JSObject* JSComment::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCommentPrototype(JSCommentPrototype::createStructure(JSCharacterDataPrototype::self(exec)));
+    return new (exec) JSCommentPrototype(JSCommentPrototype::createStructure(JSCharacterDataPrototype::self(exec, globalObject)));
 }
 
 bool JSComment::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -125,11 +121,11 @@ bool JSComment::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSComment, Base>(exec, &JSCommentTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCommentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCommentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSComment*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSComment::getConstructor(ExecState* exec)
+JSValue JSComment::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCommentConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSComment.h b/src/3rdparty/webkit/WebCore/generated/JSComment.h
index b0dc55b..802256e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSComment.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSComment.h
@@ -31,23 +31,24 @@ class JSComment : public JSCharacterData {
     typedef JSCharacterData Base;
 public:
     JSComment(PassRefPtr<JSC::Structure>, PassRefPtr<Comment>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSCommentPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSCommentPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -55,7 +56,7 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsCommentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCommentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp b/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp
index 6adba28..24e5ef3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSConsole.cpp
@@ -19,21 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSConsole.h"
 
-#include <wtf/GetPtr.h>
-
 #include "Console.h"
 #include "ScriptCallStack.h"
-
 #include <runtime/Error.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSConsole)
+ASSERT_CLASS_FITS_IN_CELL(JSConsole);
 
 /* Hash table */
 
@@ -82,9 +79,9 @@ static const HashTable JSConsolePrototypeTable =
 
 const ClassInfo JSConsolePrototype::s_info = { "ConsolePrototype", 0, &JSConsolePrototypeTable, 0 };
 
-JSObject* JSConsolePrototype::self(ExecState* exec)
+JSObject* JSConsolePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSConsole>(exec);
+    return getDOMPrototype<JSConsole>(exec, globalObject);
 }
 
 bool JSConsolePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -103,12 +100,11 @@ JSConsole::JSConsole(PassRefPtr<Structure> structure, PassRefPtr<Console> impl)
 JSConsole::~JSConsole()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSConsole::createPrototype(ExecState* exec)
+JSObject* JSConsole::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSConsolePrototype(JSConsolePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSConsolePrototype(JSConsolePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSConsole::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -116,14 +112,15 @@ bool JSConsole::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSConsole, Base>(exec, &JSConsoleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsConsoleProfiles(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsConsoleProfiles(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSConsole*>(asObject(slot.slotBase()))->profiles(exec);
 }
 
-JSValuePtr jsConsolePrototypeFunctionDebug(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionDebug(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -133,9 +130,10 @@ JSValuePtr jsConsolePrototypeFunctionDebug(ExecState* exec, JSObject*, JSValuePt
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionError(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionError(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -145,9 +143,10 @@ JSValuePtr jsConsolePrototypeFunctionError(ExecState* exec, JSObject*, JSValuePt
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionInfo(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionInfo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -157,9 +156,10 @@ JSValuePtr jsConsolePrototypeFunctionInfo(ExecState* exec, JSObject*, JSValuePtr
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionLog(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionLog(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -169,9 +169,10 @@ JSValuePtr jsConsolePrototypeFunctionLog(ExecState* exec, JSObject*, JSValuePtr
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionWarn(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionWarn(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -181,9 +182,10 @@ JSValuePtr jsConsolePrototypeFunctionWarn(ExecState* exec, JSObject*, JSValuePtr
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionDir(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionDir(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -193,9 +195,10 @@ JSValuePtr jsConsolePrototypeFunctionDir(ExecState* exec, JSObject*, JSValuePtr
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionDirxml(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionDirxml(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -205,9 +208,10 @@ JSValuePtr jsConsolePrototypeFunctionDirxml(ExecState* exec, JSObject*, JSValueP
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionTrace(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionTrace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -217,22 +221,24 @@ JSValuePtr jsConsolePrototypeFunctionTrace(ExecState* exec, JSObject*, JSValuePt
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionAssert(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionAssert(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
     ScriptCallStack callStack(exec, args, 1);
-    bool condition = args.at(exec, 0)->toBoolean(exec);
+    bool condition = args.at(0).toBoolean(exec);
 
     imp->assertCondition(condition, &callStack);
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionCount(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionCount(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -242,60 +248,65 @@ JSValuePtr jsConsolePrototypeFunctionCount(ExecState* exec, JSObject*, JSValuePt
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionProfile(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionProfile(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
     ScriptCallStack callStack(exec, args, 1);
-    const UString& title = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
+    const UString& title = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
 
     imp->profile(title, &callStack);
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionProfileEnd(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionProfileEnd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
     ScriptCallStack callStack(exec, args, 1);
-    const UString& title = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
+    const UString& title = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
 
     imp->profileEnd(title, &callStack);
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionTime(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
-    const UString& title = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
+    const UString& title = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
 
     imp->time(title);
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionTimeEnd(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionTimeEnd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
     ScriptCallStack callStack(exec, args, 1);
-    const UString& title = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
+    const UString& title = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
 
     imp->timeEnd(title, &callStack);
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionGroup(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionGroup(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -305,9 +316,10 @@ JSValuePtr jsConsolePrototypeFunctionGroup(ExecState* exec, JSObject*, JSValuePt
     return jsUndefined();
 }
 
-JSValuePtr jsConsolePrototypeFunctionGroupEnd(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsConsolePrototypeFunctionGroupEnd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSConsole::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSConsole::s_info))
         return throwError(exec, TypeError);
     JSConsole* castedThisObj = static_cast<JSConsole*>(asObject(thisValue));
     Console* imp = static_cast<Console*>(castedThisObj->impl());
@@ -316,13 +328,13 @@ JSValuePtr jsConsolePrototypeFunctionGroupEnd(ExecState* exec, JSObject*, JSValu
     return jsUndefined();
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Console* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Console* object)
 {
     return getDOMObjectWrapper<JSConsole>(exec, object);
 }
-Console* toConsole(JSC::JSValuePtr value)
+Console* toConsole(JSC::JSValue value)
 {
-    return value->isObject(&JSConsole::s_info) ? static_cast<JSConsole*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSConsole::s_info) ? static_cast<JSConsole*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSConsole.h b/src/3rdparty/webkit/WebCore/generated/JSConsole.h
index d080c11..0b7f0d5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSConsole.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSConsole.h
@@ -34,35 +34,36 @@ class JSConsole : public DOMObject {
 public:
     JSConsole(PassRefPtr<JSC::Structure>, PassRefPtr<Console>);
     virtual ~JSConsole();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
 
     // Custom attributes
-    JSC::JSValuePtr profiles(JSC::ExecState*) const;
+    JSC::JSValue profiles(JSC::ExecState*) const;
     Console* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Console> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Console*);
-Console* toConsole(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Console*);
+Console* toConsole(JSC::JSValue);
 
 class JSConsolePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -71,25 +72,25 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsConsolePrototypeFunctionDebug(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionError(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionInfo(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionLog(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionWarn(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionDir(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionDirxml(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionTrace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionAssert(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionCount(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionProfile(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionProfileEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionTimeEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionGroup(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsConsolePrototypeFunctionGroupEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionDebug(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionError(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionInfo(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionLog(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionWarn(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionDir(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionDirxml(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionTrace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionAssert(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionCount(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionProfile(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionProfileEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionTimeEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionGroup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsConsolePrototypeFunctionGroupEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsConsoleProfiles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsConsoleProfiles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp
new file mode 100644
index 0000000..0db560b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.cpp
@@ -0,0 +1,171 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSCoordinates.h"
+
+#include "Coordinates.h"
+#include "KURL.h"
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSCoordinates);
+
+/* Hash table */
+
+static const HashTableValue JSCoordinatesTableValues[8] =
+{
+    { "latitude", DontDelete|ReadOnly, (intptr_t)jsCoordinatesLatitude, (intptr_t)0 },
+    { "longitude", DontDelete|ReadOnly, (intptr_t)jsCoordinatesLongitude, (intptr_t)0 },
+    { "altitude", DontDelete|ReadOnly, (intptr_t)jsCoordinatesAltitude, (intptr_t)0 },
+    { "accuracy", DontDelete|ReadOnly, (intptr_t)jsCoordinatesAccuracy, (intptr_t)0 },
+    { "altitudeAccuracy", DontDelete|ReadOnly, (intptr_t)jsCoordinatesAltitudeAccuracy, (intptr_t)0 },
+    { "heading", DontDelete|ReadOnly, (intptr_t)jsCoordinatesHeading, (intptr_t)0 },
+    { "speed", DontDelete|ReadOnly, (intptr_t)jsCoordinatesSpeed, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSCoordinatesTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 15, JSCoordinatesTableValues, 0 };
+#else
+    { 16, 15, JSCoordinatesTableValues, 0 };
+#endif
+
+/* Hash table for prototype */
+
+static const HashTableValue JSCoordinatesPrototypeTableValues[2] =
+{
+    { "toString", DontDelete|DontEnum|Function, (intptr_t)jsCoordinatesPrototypeFunctionToString, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSCoordinatesPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSCoordinatesPrototypeTableValues, 0 };
+#else
+    { 2, 1, JSCoordinatesPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSCoordinatesPrototype::s_info = { "CoordinatesPrototype", 0, &JSCoordinatesPrototypeTable, 0 };
+
+JSObject* JSCoordinatesPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSCoordinates>(exec, globalObject);
+}
+
+bool JSCoordinatesPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSCoordinatesPrototypeTable, this, propertyName, slot);
+}
+
+const ClassInfo JSCoordinates::s_info = { "Coordinates", 0, &JSCoordinatesTable, 0 };
+
+JSCoordinates::JSCoordinates(PassRefPtr<Structure> structure, PassRefPtr<Coordinates> impl)
+    : DOMObject(structure)
+    , m_impl(impl)
+{
+}
+
+JSCoordinates::~JSCoordinates()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSCoordinates::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSCoordinatesPrototype(JSCoordinatesPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSCoordinates::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSCoordinates, Base>(exec, &JSCoordinatesTable, this, propertyName, slot);
+}
+
+JSValue jsCoordinatesLatitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Coordinates* imp = static_cast<Coordinates*>(static_cast<JSCoordinates*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->latitude());
+}
+
+JSValue jsCoordinatesLongitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Coordinates* imp = static_cast<Coordinates*>(static_cast<JSCoordinates*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->longitude());
+}
+
+JSValue jsCoordinatesAltitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSCoordinates*>(asObject(slot.slotBase()))->altitude(exec);
+}
+
+JSValue jsCoordinatesAccuracy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Coordinates* imp = static_cast<Coordinates*>(static_cast<JSCoordinates*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->accuracy());
+}
+
+JSValue jsCoordinatesAltitudeAccuracy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSCoordinates*>(asObject(slot.slotBase()))->altitudeAccuracy(exec);
+}
+
+JSValue jsCoordinatesHeading(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSCoordinates*>(asObject(slot.slotBase()))->heading(exec);
+}
+
+JSValue jsCoordinatesSpeed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSCoordinates*>(asObject(slot.slotBase()))->speed(exec);
+}
+
+JSValue JSC_HOST_CALL jsCoordinatesPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSCoordinates::s_info))
+        return throwError(exec, TypeError);
+    JSCoordinates* castedThisObj = static_cast<JSCoordinates*>(asObject(thisValue));
+    Coordinates* imp = static_cast<Coordinates*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsString(exec, imp->toString());
+    return result;
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, Coordinates* object)
+{
+    return getDOMObjectWrapper<JSCoordinates>(exec, object);
+}
+Coordinates* toCoordinates(JSC::JSValue value)
+{
+    return value.isObject(&JSCoordinates::s_info) ? static_cast<JSCoordinates*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h
new file mode 100644
index 0000000..8a8643d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSCoordinates.h
@@ -0,0 +1,91 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSCoordinates_h
+#define JSCoordinates_h
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class Coordinates;
+
+class JSCoordinates : public DOMObject {
+    typedef DOMObject Base;
+public:
+    JSCoordinates(PassRefPtr<JSC::Structure>, PassRefPtr<Coordinates>);
+    virtual ~JSCoordinates();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+
+    // Custom attributes
+    JSC::JSValue altitude(JSC::ExecState*) const;
+    JSC::JSValue altitudeAccuracy(JSC::ExecState*) const;
+    JSC::JSValue heading(JSC::ExecState*) const;
+    JSC::JSValue speed(JSC::ExecState*) const;
+    Coordinates* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<Coordinates> m_impl;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, Coordinates*);
+Coordinates* toCoordinates(JSC::JSValue);
+
+class JSCoordinatesPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+    JSCoordinatesPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsCoordinatesPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsCoordinatesLatitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCoordinatesLongitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCoordinatesAltitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCoordinatesAccuracy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCoordinatesAltitudeAccuracy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCoordinatesHeading(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCoordinatesSpeed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp b/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
index 72c22e4..03a3eb3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSCounter.cpp
@@ -19,22 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSCounter.h"
 
-#include <wtf/GetPtr.h>
-
 #include "Counter.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSCounter)
+ASSERT_CLASS_FITS_IN_CELL(JSCounter);
 
 /* Hash table */
 
@@ -73,13 +69,13 @@ public:
     JSCounterConstructor(ExecState* exec)
         : DOMObject(JSCounterConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSCounterPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSCounterPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -108,9 +104,9 @@ static const HashTable JSCounterPrototypeTable =
 
 const ClassInfo JSCounterPrototype::s_info = { "CounterPrototype", 0, &JSCounterPrototypeTable, 0 };
 
-JSObject* JSCounterPrototype::self(ExecState* exec)
+JSObject* JSCounterPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSCounter>(exec);
+    return getDOMPrototype<JSCounter>(exec, globalObject);
 }
 
 const ClassInfo JSCounter::s_info = { "Counter", 0, &JSCounterTable, 0 };
@@ -124,12 +120,11 @@ JSCounter::JSCounter(PassRefPtr<Structure> structure, PassRefPtr<Counter> impl)
 JSCounter::~JSCounter()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSCounter::createPrototype(ExecState* exec)
+JSObject* JSCounter::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSCounterPrototype(JSCounterPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSCounterPrototype(JSCounterPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSCounter::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -137,40 +132,43 @@ bool JSCounter::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSCounter, Base>(exec, &JSCounterTable, this, propertyName, slot);
 }
 
-JSValuePtr jsCounterIdentifier(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCounterIdentifier(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Counter* imp = static_cast<Counter*>(static_cast<JSCounter*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->identifier());
 }
 
-JSValuePtr jsCounterListStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCounterListStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Counter* imp = static_cast<Counter*>(static_cast<JSCounter*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->listStyle());
 }
 
-JSValuePtr jsCounterSeparator(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCounterSeparator(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Counter* imp = static_cast<Counter*>(static_cast<JSCounter*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->separator());
 }
 
-JSValuePtr jsCounterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsCounterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSCounter*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSCounter::getConstructor(ExecState* exec)
+JSValue JSCounter::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSCounterConstructor>(exec);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Counter* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Counter* object)
 {
     return getDOMObjectWrapper<JSCounter>(exec, object);
 }
-Counter* toCounter(JSC::JSValuePtr value)
+Counter* toCounter(JSC::JSValue value)
 {
-    return value->isObject(&JSCounter::s_info) ? static_cast<JSCounter*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSCounter::s_info) ? static_cast<JSCounter*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSCounter.h b/src/3rdparty/webkit/WebCore/generated/JSCounter.h
index 6517bc4..ab195fe 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSCounter.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSCounter.h
@@ -34,29 +34,30 @@ class JSCounter : public DOMObject {
 public:
     JSCounter(PassRefPtr<JSC::Structure>, PassRefPtr<Counter>);
     virtual ~JSCounter();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     Counter* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Counter> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Counter*);
-Counter* toCounter(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Counter*);
+Counter* toCounter(JSC::JSValue);
 
 class JSCounterPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSCounterPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -64,10 +65,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsCounterIdentifier(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCounterListStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCounterSeparator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsCounterConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCounterIdentifier(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCounterListStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCounterSeparator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsCounterConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp
index dd8939b..0d7202b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.cpp
@@ -20,38 +20,32 @@
 
 #include "config.h"
 
-
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
 
 #include "JSDOMApplicationCache.h"
 
-#include <wtf/GetPtr.h>
-
 #include "DOMApplicationCache.h"
-#include "DOMStringList.h"
 #include "Event.h"
 #include "EventListener.h"
 #include "Frame.h"
 #include "JSDOMGlobalObject.h"
-#include "JSDOMStringList.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDOMApplicationCache)
+ASSERT_CLASS_FITS_IN_CELL(JSDOMApplicationCache);
 
 /* Hash table */
 
 static const HashTableValue JSDOMApplicationCacheTableValues[10] =
 {
     { "status", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheStatus, (intptr_t)0 },
-    { "items", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheItems, (intptr_t)0 },
     { "onchecking", DontDelete, (intptr_t)jsDOMApplicationCacheOnchecking, (intptr_t)setJSDOMApplicationCacheOnchecking },
     { "onerror", DontDelete, (intptr_t)jsDOMApplicationCacheOnerror, (intptr_t)setJSDOMApplicationCacheOnerror },
     { "onnoupdate", DontDelete, (intptr_t)jsDOMApplicationCacheOnnoupdate, (intptr_t)setJSDOMApplicationCacheOnnoupdate },
@@ -59,6 +53,7 @@ static const HashTableValue JSDOMApplicationCacheTableValues[10] =
     { "onprogress", DontDelete, (intptr_t)jsDOMApplicationCacheOnprogress, (intptr_t)setJSDOMApplicationCacheOnprogress },
     { "onupdateready", DontDelete, (intptr_t)jsDOMApplicationCacheOnupdateready, (intptr_t)setJSDOMApplicationCacheOnupdateready },
     { "oncached", DontDelete, (intptr_t)jsDOMApplicationCacheOncached, (intptr_t)setJSDOMApplicationCacheOncached },
+    { "onobsolete", DontDelete, (intptr_t)jsDOMApplicationCacheOnobsolete, (intptr_t)setJSDOMApplicationCacheOnobsolete },
     { 0, 0, 0, 0 }
 };
 
@@ -71,18 +66,16 @@ static const HashTable JSDOMApplicationCacheTable =
 
 /* Hash table for prototype */
 
-static const HashTableValue JSDOMApplicationCachePrototypeTableValues[14] =
+static const HashTableValue JSDOMApplicationCachePrototypeTableValues[12] =
 {
     { "UNCACHED", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheUNCACHED, (intptr_t)0 },
     { "IDLE", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheIDLE, (intptr_t)0 },
     { "CHECKING", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheCHECKING, (intptr_t)0 },
     { "DOWNLOADING", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheDOWNLOADING, (intptr_t)0 },
     { "UPDATEREADY", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheUPDATEREADY, (intptr_t)0 },
+    { "OBSOLETE", DontDelete|ReadOnly, (intptr_t)jsDOMApplicationCacheOBSOLETE, (intptr_t)0 },
     { "update", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionUpdate, (intptr_t)0 },
     { "swapCache", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionSwapCache, (intptr_t)0 },
-    { "hasItem", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionHasItem, (intptr_t)1 },
-    { "add", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionAdd, (intptr_t)1 },
-    { "remove", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionRemove, (intptr_t)1 },
     { "addEventListener", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionAddEventListener, (intptr_t)3 },
     { "removeEventListener", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionRemoveEventListener, (intptr_t)3 },
     { "dispatchEvent", DontDelete|Function, (intptr_t)jsDOMApplicationCachePrototypeFunctionDispatchEvent, (intptr_t)1 },
@@ -93,14 +86,14 @@ static const HashTable JSDOMApplicationCachePrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 255, JSDOMApplicationCachePrototypeTableValues, 0 };
 #else
-    { 35, 31, JSDOMApplicationCachePrototypeTableValues, 0 };
+    { 33, 31, JSDOMApplicationCachePrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSDOMApplicationCachePrototype::s_info = { "DOMApplicationCachePrototype", 0, &JSDOMApplicationCachePrototypeTable, 0 };
 
-JSObject* JSDOMApplicationCachePrototype::self(ExecState* exec)
+JSObject* JSDOMApplicationCachePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSDOMApplicationCache>(exec);
+    return getDOMPrototype<JSDOMApplicationCache>(exec, globalObject);
 }
 
 bool JSDOMApplicationCachePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -119,12 +112,11 @@ JSDOMApplicationCache::JSDOMApplicationCache(PassRefPtr<Structure> structure, Pa
 JSDOMApplicationCache::~JSDOMApplicationCache()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSDOMApplicationCache::createPrototype(ExecState* exec)
+JSObject* JSDOMApplicationCache::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSDOMApplicationCachePrototype(JSDOMApplicationCachePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSDOMApplicationCachePrototype(JSDOMApplicationCachePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSDOMApplicationCache::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,159 +124,190 @@ bool JSDOMApplicationCache::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSDOMApplicationCache, Base>(exec, &JSDOMApplicationCacheTable, this, propertyName, slot);
 }
 
-JSValuePtr jsDOMApplicationCacheStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->status());
 }
 
-JSValuePtr jsDOMApplicationCacheItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnchecking(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()))->impl());
-    return toJS(exec, WTF::getPtr(imp->items()));
+    if (EventListener* listener = imp->onchecking()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
 }
 
-JSValuePtr jsDOMApplicationCacheOnchecking(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onchecking())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onerror()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMApplicationCacheOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnnoupdate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onerror())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onnoupdate()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMApplicationCacheOnnoupdate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOndownloading(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onnoupdate())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ondownloading()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMApplicationCacheOndownloading(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnprogress(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->ondownloading())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onprogress()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMApplicationCacheOnprogress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnupdateready(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onprogress())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onupdateready()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMApplicationCacheOnupdateready(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOncached(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onupdateready())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->oncached()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMApplicationCacheOncached(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMApplicationCacheOnobsolete(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->oncached())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onobsolete()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-void JSDOMApplicationCache::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSDOMApplicationCache::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSDOMApplicationCache, Base>(exec, propertyName, value, &JSDOMApplicationCacheTable, this, slot);
 }
 
-void setJSDOMApplicationCacheOnchecking(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMApplicationCacheOnchecking(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnchecking(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnchecking(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMApplicationCacheOnerror(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMApplicationCacheOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnerror(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMApplicationCacheOnnoupdate(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMApplicationCacheOnnoupdate(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnnoupdate(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnnoupdate(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMApplicationCacheOndownloading(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMApplicationCacheOndownloading(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOndownloading(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOndownloading(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMApplicationCacheOnprogress(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMApplicationCacheOnprogress(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnprogress(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnprogress(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMApplicationCacheOnupdateready(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMApplicationCacheOnupdateready(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnupdateready(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnupdateready(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMApplicationCacheOncached(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMApplicationCacheOncached(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOncached(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOncached(globalObject->createJSAttributeEventListener(value));
 }
 
-JSValuePtr jsDOMApplicationCachePrototypeFunctionUpdate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+void setJSDOMApplicationCacheOnobsolete(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    if (!thisValue->isObject(&JSDOMApplicationCache::s_info))
+    UNUSED_PARAM(exec);
+    DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(static_cast<JSDOMApplicationCache*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnobsolete(globalObject->createJSAttributeEventListener(value));
+}
+
+JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionUpdate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMApplicationCache::s_info))
         return throwError(exec, TypeError);
     JSDOMApplicationCache* castedThisObj = static_cast<JSDOMApplicationCache*>(asObject(thisValue));
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThisObj->impl());
@@ -295,9 +318,10 @@ JSValuePtr jsDOMApplicationCachePrototypeFunctionUpdate(ExecState* exec, JSObjec
     return jsUndefined();
 }
 
-JSValuePtr jsDOMApplicationCachePrototypeFunctionSwapCache(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionSwapCache(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMApplicationCache::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMApplicationCache::s_info))
         return throwError(exec, TypeError);
     JSDOMApplicationCache* castedThisObj = static_cast<JSDOMApplicationCache*>(asObject(thisValue));
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThisObj->impl());
@@ -308,95 +332,79 @@ JSValuePtr jsDOMApplicationCachePrototypeFunctionSwapCache(ExecState* exec, JSOb
     return jsUndefined();
 }
 
-JSValuePtr jsDOMApplicationCachePrototypeFunctionHasItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMApplicationCache::s_info))
-        return throwError(exec, TypeError);
-    JSDOMApplicationCache* castedThisObj = static_cast<JSDOMApplicationCache*>(asObject(thisValue));
-    return castedThisObj->hasItem(exec, args);
-}
-
-JSValuePtr jsDOMApplicationCachePrototypeFunctionAdd(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSDOMApplicationCache::s_info))
-        return throwError(exec, TypeError);
-    JSDOMApplicationCache* castedThisObj = static_cast<JSDOMApplicationCache*>(asObject(thisValue));
-    return castedThisObj->add(exec, args);
-}
-
-JSValuePtr jsDOMApplicationCachePrototypeFunctionRemove(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSDOMApplicationCache::s_info))
-        return throwError(exec, TypeError);
-    JSDOMApplicationCache* castedThisObj = static_cast<JSDOMApplicationCache*>(asObject(thisValue));
-    return castedThisObj->remove(exec, args);
-}
-
-JSValuePtr jsDOMApplicationCachePrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSDOMApplicationCache::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMApplicationCache::s_info))
         return throwError(exec, TypeError);
     JSDOMApplicationCache* castedThisObj = static_cast<JSDOMApplicationCache*>(asObject(thisValue));
     return castedThisObj->addEventListener(exec, args);
 }
 
-JSValuePtr jsDOMApplicationCachePrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMApplicationCache::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMApplicationCache::s_info))
         return throwError(exec, TypeError);
     JSDOMApplicationCache* castedThisObj = static_cast<JSDOMApplicationCache*>(asObject(thisValue));
     return castedThisObj->removeEventListener(exec, args);
 }
 
-JSValuePtr jsDOMApplicationCachePrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMApplicationCache::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMApplicationCache::s_info))
         return throwError(exec, TypeError);
     JSDOMApplicationCache* castedThisObj = static_cast<JSDOMApplicationCache*>(asObject(thisValue));
     DOMApplicationCache* imp = static_cast<DOMApplicationCache*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Event* evt = toEvent(args.at(exec, 0));
+    Event* evt = toEvent(args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->dispatchEvent(evt, ec));
+    JSC::JSValue result = jsBoolean(imp->dispatchEvent(evt, ec));
     setDOMException(exec, ec);
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsDOMApplicationCacheUNCACHED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMApplicationCacheUNCACHED(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsDOMApplicationCacheIDLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMApplicationCacheIDLE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsDOMApplicationCacheCHECKING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMApplicationCacheCHECKING(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsDOMApplicationCacheDOWNLOADING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMApplicationCacheDOWNLOADING(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsDOMApplicationCacheUPDATEREADY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMApplicationCacheUPDATEREADY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, DOMApplicationCache* object)
+JSValue jsDOMApplicationCacheOBSOLETE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(5));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, DOMApplicationCache* object)
 {
     return getDOMObjectWrapper<JSDOMApplicationCache>(exec, object);
 }
-DOMApplicationCache* toDOMApplicationCache(JSC::JSValuePtr value)
+DOMApplicationCache* toDOMApplicationCache(JSC::JSValue value)
 {
-    return value->isObject(&JSDOMApplicationCache::s_info) ? static_cast<JSDOMApplicationCache*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSDOMApplicationCache::s_info) ? static_cast<JSDOMApplicationCache*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h
index af5612e..7a6ea14 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMApplicationCache.h
@@ -21,7 +21,6 @@
 #ifndef JSDOMApplicationCache_h
 #define JSDOMApplicationCache_h
 
-
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
 
 #include "JSDOMBinding.h"
@@ -37,13 +36,13 @@ class JSDOMApplicationCache : public DOMObject {
 public:
     JSDOMApplicationCache(PassRefPtr<JSC::Structure>, PassRefPtr<DOMApplicationCache>);
     virtual ~JSDOMApplicationCache();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -52,27 +51,25 @@ public:
 
 
     // Custom functions
-    JSC::JSValuePtr hasItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr add(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr remove(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr addEventListener(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
     DOMApplicationCache* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<DOMApplicationCache> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, DOMApplicationCache*);
-DOMApplicationCache* toDOMApplicationCache(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, DOMApplicationCache*);
+DOMApplicationCache* toDOMApplicationCache(JSC::JSValue);
 
 class JSDOMApplicationCachePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -81,39 +78,38 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsDOMApplicationCachePrototypeFunctionUpdate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMApplicationCachePrototypeFunctionSwapCache(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMApplicationCachePrototypeFunctionHasItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMApplicationCachePrototypeFunctionAdd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMApplicationCachePrototypeFunctionRemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMApplicationCachePrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMApplicationCachePrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMApplicationCachePrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionUpdate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionSwapCache(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMApplicationCachePrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsDOMApplicationCacheStatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMApplicationCacheItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMApplicationCacheOnchecking(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMApplicationCacheOnchecking(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMApplicationCacheOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMApplicationCacheOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMApplicationCacheOnnoupdate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMApplicationCacheOnnoupdate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMApplicationCacheOndownloading(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMApplicationCacheOndownloading(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMApplicationCacheOnprogress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMApplicationCacheOnprogress(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMApplicationCacheOnupdateready(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMApplicationCacheOnupdateready(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMApplicationCacheOncached(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMApplicationCacheOncached(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsDOMApplicationCacheStatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheOnchecking(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMApplicationCacheOnchecking(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMApplicationCacheOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMApplicationCacheOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMApplicationCacheOnnoupdate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMApplicationCacheOnnoupdate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMApplicationCacheOndownloading(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMApplicationCacheOndownloading(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMApplicationCacheOnprogress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMApplicationCacheOnprogress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMApplicationCacheOnupdateready(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMApplicationCacheOnupdateready(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMApplicationCacheOncached(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMApplicationCacheOncached(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMApplicationCacheOnobsolete(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMApplicationCacheOnobsolete(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 // Constants
 
-JSC::JSValuePtr jsDOMApplicationCacheUNCACHED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMApplicationCacheIDLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMApplicationCacheCHECKING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMApplicationCacheDOWNLOADING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMApplicationCacheUPDATEREADY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheUNCACHED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheIDLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheCHECKING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheDOWNLOADING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheUPDATEREADY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMApplicationCacheOBSOLETE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
index 87b6ce4..3b45220 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.cpp
@@ -19,23 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSDOMCoreException.h"
 
-#include <wtf/GetPtr.h>
-
 #include "DOMCoreException.h"
 #include "KURL.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDOMCoreException)
+ASSERT_CLASS_FITS_IN_CELL(JSDOMCoreException);
 
 /* Hash table */
 
@@ -57,7 +54,7 @@ static const HashTable JSDOMCoreExceptionTable =
 
 /* Hash table for constructor */
 
-static const HashTableValue JSDOMCoreExceptionConstructorTableValues[18] =
+static const HashTableValue JSDOMCoreExceptionConstructorTableValues[23] =
 {
     { "INDEX_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINDEX_SIZE_ERR, (intptr_t)0 },
     { "DOMSTRING_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionDOMSTRING_SIZE_ERR, (intptr_t)0 },
@@ -76,6 +73,11 @@ static const HashTableValue JSDOMCoreExceptionConstructorTableValues[18] =
     { "INVALID_ACCESS_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINVALID_ACCESS_ERR, (intptr_t)0 },
     { "VALIDATION_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionVALIDATION_ERR, (intptr_t)0 },
     { "TYPE_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionTYPE_MISMATCH_ERR, (intptr_t)0 },
+    { "SECURITY_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionSECURITY_ERR, (intptr_t)0 },
+    { "NETWORK_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNETWORK_ERR, (intptr_t)0 },
+    { "ABORT_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionABORT_ERR, (intptr_t)0 },
+    { "URL_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionURL_MISMATCH_ERR, (intptr_t)0 },
+    { "QUOTA_EXCEEDED_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionQUOTA_EXCEEDED_ERR, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -91,13 +93,13 @@ public:
     JSDOMCoreExceptionConstructor(ExecState* exec)
         : DOMObject(JSDOMCoreExceptionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSDOMCoreExceptionPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSDOMCoreExceptionPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -112,7 +114,7 @@ bool JSDOMCoreExceptionConstructor::getOwnPropertySlot(ExecState* exec, const Id
 
 /* Hash table for prototype */
 
-static const HashTableValue JSDOMCoreExceptionPrototypeTableValues[19] =
+static const HashTableValue JSDOMCoreExceptionPrototypeTableValues[24] =
 {
     { "INDEX_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINDEX_SIZE_ERR, (intptr_t)0 },
     { "DOMSTRING_SIZE_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionDOMSTRING_SIZE_ERR, (intptr_t)0 },
@@ -131,6 +133,11 @@ static const HashTableValue JSDOMCoreExceptionPrototypeTableValues[19] =
     { "INVALID_ACCESS_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionINVALID_ACCESS_ERR, (intptr_t)0 },
     { "VALIDATION_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionVALIDATION_ERR, (intptr_t)0 },
     { "TYPE_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionTYPE_MISMATCH_ERR, (intptr_t)0 },
+    { "SECURITY_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionSECURITY_ERR, (intptr_t)0 },
+    { "NETWORK_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionNETWORK_ERR, (intptr_t)0 },
+    { "ABORT_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionABORT_ERR, (intptr_t)0 },
+    { "URL_MISMATCH_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionURL_MISMATCH_ERR, (intptr_t)0 },
+    { "QUOTA_EXCEEDED_ERR", DontDelete|ReadOnly, (intptr_t)jsDOMCoreExceptionQUOTA_EXCEEDED_ERR, (intptr_t)0 },
     { "toString", DontDelete|DontEnum|Function, (intptr_t)jsDOMCoreExceptionPrototypeFunctionToString, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
@@ -139,14 +146,14 @@ static const HashTable JSDOMCoreExceptionPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 511, JSDOMCoreExceptionPrototypeTableValues, 0 };
 #else
-    { 67, 63, JSDOMCoreExceptionPrototypeTableValues, 0 };
+    { 68, 63, JSDOMCoreExceptionPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSDOMCoreExceptionPrototype::s_info = { "DOMExceptionPrototype", 0, &JSDOMCoreExceptionPrototypeTable, 0 };
 
-JSObject* JSDOMCoreExceptionPrototype::self(ExecState* exec)
+JSObject* JSDOMCoreExceptionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSDOMCoreException>(exec);
+    return getDOMPrototype<JSDOMCoreException>(exec, globalObject);
 }
 
 bool JSDOMCoreExceptionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -165,12 +172,11 @@ JSDOMCoreException::JSDOMCoreException(PassRefPtr<Structure> structure, PassRefP
 JSDOMCoreException::~JSDOMCoreException()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSDOMCoreException::createPrototype(ExecState* exec)
+JSObject* JSDOMCoreException::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSDOMCoreExceptionPrototype(JSDOMCoreExceptionPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSDOMCoreExceptionPrototype(JSDOMCoreExceptionPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSDOMCoreException::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -178,139 +184,168 @@ bool JSDOMCoreException::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSDOMCoreException, Base>(exec, &JSDOMCoreExceptionTable, this, propertyName, slot);
 }
 
-JSValuePtr jsDOMCoreExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMCoreExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMCoreException* imp = static_cast<DOMCoreException*>(static_cast<JSDOMCoreException*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->code());
 }
 
-JSValuePtr jsDOMCoreExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMCoreExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMCoreException* imp = static_cast<DOMCoreException*>(static_cast<JSDOMCoreException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsDOMCoreExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMCoreExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMCoreException* imp = static_cast<DOMCoreException*>(static_cast<JSDOMCoreException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->message());
 }
 
-JSValuePtr jsDOMCoreExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMCoreExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSDOMCoreException*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSDOMCoreException::getConstructor(ExecState* exec)
+JSValue JSDOMCoreException::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSDOMCoreExceptionConstructor>(exec);
 }
 
-JSValuePtr jsDOMCoreExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMCoreExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMCoreException::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMCoreException::s_info))
         return throwError(exec, TypeError);
     JSDOMCoreException* castedThisObj = static_cast<JSDOMCoreException*>(asObject(thisValue));
     DOMCoreException* imp = static_cast<DOMCoreException*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->toString());
+    JSC::JSValue result = jsString(exec, imp->toString());
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsDOMCoreExceptionINDEX_SIZE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINDEX_SIZE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsDOMCoreExceptionDOMSTRING_SIZE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionDOMSTRING_SIZE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsDOMCoreExceptionHIERARCHY_REQUEST_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionHIERARCHY_REQUEST_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsDOMCoreExceptionWRONG_DOCUMENT_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionWRONG_DOCUMENT_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsDOMCoreExceptionINVALID_CHARACTER_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINVALID_CHARACTER_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValuePtr jsDOMCoreExceptionNO_DATA_ALLOWED_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionNO_DATA_ALLOWED_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValuePtr jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValuePtr jsDOMCoreExceptionNOT_FOUND_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionNOT_FOUND_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValuePtr jsDOMCoreExceptionNOT_SUPPORTED_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionNOT_SUPPORTED_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSValuePtr jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(10));
 }
 
-JSValuePtr jsDOMCoreExceptionINVALID_STATE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINVALID_STATE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(11));
 }
 
-JSValuePtr jsDOMCoreExceptionSYNTAX_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionSYNTAX_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(12));
 }
 
-JSValuePtr jsDOMCoreExceptionINVALID_MODIFICATION_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINVALID_MODIFICATION_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(13));
 }
 
-JSValuePtr jsDOMCoreExceptionNAMESPACE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionNAMESPACE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(14));
 }
 
-JSValuePtr jsDOMCoreExceptionINVALID_ACCESS_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionINVALID_ACCESS_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(15));
 }
 
-JSValuePtr jsDOMCoreExceptionVALIDATION_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionVALIDATION_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(16));
 }
 
-JSValuePtr jsDOMCoreExceptionTYPE_MISMATCH_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsDOMCoreExceptionTYPE_MISMATCH_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(17));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, DOMCoreException* object)
+JSValue jsDOMCoreExceptionSECURITY_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(18));
+}
+
+JSValue jsDOMCoreExceptionNETWORK_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(19));
+}
+
+JSValue jsDOMCoreExceptionABORT_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(20));
+}
+
+JSValue jsDOMCoreExceptionURL_MISMATCH_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(21));
+}
+
+JSValue jsDOMCoreExceptionQUOTA_EXCEEDED_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(22));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, DOMCoreException* object)
 {
     return getDOMObjectWrapper<JSDOMCoreException>(exec, object);
 }
-DOMCoreException* toDOMCoreException(JSC::JSValuePtr value)
+DOMCoreException* toDOMCoreException(JSC::JSValue value)
 {
-    return value->isObject(&JSDOMCoreException::s_info) ? static_cast<JSDOMCoreException*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSDOMCoreException::s_info) ? static_cast<JSDOMCoreException*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h
index e5d9b39..75b4328 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMCoreException.h
@@ -34,33 +34,34 @@ class JSDOMCoreException : public DOMObject {
 public:
     JSDOMCoreException(PassRefPtr<JSC::Structure>, PassRefPtr<DOMCoreException>);
     virtual ~JSDOMCoreException();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     DOMCoreException* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<DOMCoreException> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, DOMCoreException*);
-DOMCoreException* toDOMCoreException(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, DOMCoreException*);
+DOMCoreException* toDOMCoreException(JSC::JSValue);
 
 class JSDOMCoreExceptionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,32 +70,37 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsDOMCoreExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMCoreExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsDOMCoreExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsDOMCoreExceptionINDEX_SIZE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionDOMSTRING_SIZE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionHIERARCHY_REQUEST_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionWRONG_DOCUMENT_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionINVALID_CHARACTER_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionNO_DATA_ALLOWED_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionNOT_FOUND_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionNOT_SUPPORTED_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionINVALID_STATE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionSYNTAX_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionINVALID_MODIFICATION_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionNAMESPACE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionINVALID_ACCESS_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionVALIDATION_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMCoreExceptionTYPE_MISMATCH_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionINDEX_SIZE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionDOMSTRING_SIZE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionHIERARCHY_REQUEST_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionWRONG_DOCUMENT_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionINVALID_CHARACTER_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionNO_DATA_ALLOWED_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionNO_MODIFICATION_ALLOWED_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionNOT_FOUND_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionNOT_SUPPORTED_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionINUSE_ATTRIBUTE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionINVALID_STATE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionSYNTAX_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionINVALID_MODIFICATION_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionNAMESPACE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionINVALID_ACCESS_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionVALIDATION_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionTYPE_MISMATCH_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionSECURITY_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionNETWORK_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionABORT_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionURL_MISMATCH_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMCoreExceptionQUOTA_EXCEEDED_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
index 76d00a8..1e2f950 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.cpp
@@ -19,11 +19,8 @@
 */
 
 #include "config.h"
-
 #include "JSDOMImplementation.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSStyleSheet.h"
 #include "DOMImplementation.h"
 #include "Document.h"
@@ -34,15 +31,14 @@
 #include "JSDocumentType.h"
 #include "JSHTMLDocument.h"
 #include "NodeFilter.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDOMImplementation)
+ASSERT_CLASS_FITS_IN_CELL(JSDOMImplementation);
 
 /* Hash table */
 
@@ -78,13 +74,13 @@ public:
     JSDOMImplementationConstructor(ExecState* exec)
         : DOMObject(JSDOMImplementationConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSDOMImplementationPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSDOMImplementationPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -118,9 +114,9 @@ static const HashTable JSDOMImplementationPrototypeTable =
 
 const ClassInfo JSDOMImplementationPrototype::s_info = { "DOMImplementationPrototype", 0, &JSDOMImplementationPrototypeTable, 0 };
 
-JSObject* JSDOMImplementationPrototype::self(ExecState* exec)
+JSObject* JSDOMImplementationPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSDOMImplementation>(exec);
+    return getDOMPrototype<JSDOMImplementation>(exec, globalObject);
 }
 
 bool JSDOMImplementationPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -139,12 +135,11 @@ JSDOMImplementation::JSDOMImplementation(PassRefPtr<Structure> structure, PassRe
 JSDOMImplementation::~JSDOMImplementation()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSDOMImplementation::createPrototype(ExecState* exec)
+JSObject* JSDOMImplementation::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSDOMImplementationPrototype(JSDOMImplementationPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSDOMImplementationPrototype(JSDOMImplementationPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSDOMImplementation::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -152,99 +147,104 @@ bool JSDOMImplementation::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSDOMImplementation, Base>(exec, &JSDOMImplementationTable, this, propertyName, slot);
 }
 
-JSValuePtr jsDOMImplementationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMImplementationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSDOMImplementation*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSDOMImplementation::getConstructor(ExecState* exec)
+JSValue JSDOMImplementation::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSDOMImplementationConstructor>(exec);
 }
 
-JSValuePtr jsDOMImplementationPrototypeFunctionHasFeature(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionHasFeature(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMImplementation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMImplementation::s_info))
         return throwError(exec, TypeError);
     JSDOMImplementation* castedThisObj = static_cast<JSDOMImplementation*>(asObject(thisValue));
     DOMImplementation* imp = static_cast<DOMImplementation*>(castedThisObj->impl());
-    const UString& feature = args.at(exec, 0)->toString(exec);
-    const UString& version = valueToStringWithNullCheck(exec, args.at(exec, 1));
+    const UString& feature = args.at(0).toString(exec);
+    const UString& version = valueToStringWithNullCheck(exec, args.at(1));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasFeature(feature, version));
+    JSC::JSValue result = jsBoolean(imp->hasFeature(feature, version));
     return result;
 }
 
-JSValuePtr jsDOMImplementationPrototypeFunctionCreateDocumentType(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateDocumentType(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMImplementation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMImplementation::s_info))
         return throwError(exec, TypeError);
     JSDOMImplementation* castedThisObj = static_cast<JSDOMImplementation*>(asObject(thisValue));
     DOMImplementation* imp = static_cast<DOMImplementation*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& qualifiedName = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
-    const UString& publicId = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 1));
-    const UString& systemId = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 2));
+    const UString& qualifiedName = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
+    const UString& publicId = valueToStringWithUndefinedOrNullCheck(exec, args.at(1));
+    const UString& systemId = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createDocumentType(qualifiedName, publicId, systemId, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createDocumentType(qualifiedName, publicId, systemId, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDOMImplementationPrototypeFunctionCreateDocument(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateDocument(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMImplementation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMImplementation::s_info))
         return throwError(exec, TypeError);
     JSDOMImplementation* castedThisObj = static_cast<JSDOMImplementation*>(asObject(thisValue));
     DOMImplementation* imp = static_cast<DOMImplementation*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    const UString& qualifiedName = valueToStringWithNullCheck(exec, args.at(exec, 1));
-    DocumentType* doctype = toDocumentType(args.at(exec, 2));
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    const UString& qualifiedName = valueToStringWithNullCheck(exec, args.at(1));
+    DocumentType* doctype = toDocumentType(args.at(2));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createDocument(namespaceURI, qualifiedName, doctype, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createDocument(namespaceURI, qualifiedName, doctype, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDOMImplementationPrototypeFunctionCreateCSSStyleSheet(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateCSSStyleSheet(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMImplementation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMImplementation::s_info))
         return throwError(exec, TypeError);
     JSDOMImplementation* castedThisObj = static_cast<JSDOMImplementation*>(asObject(thisValue));
     DOMImplementation* imp = static_cast<DOMImplementation*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& title = args.at(exec, 0)->toString(exec);
-    const UString& media = args.at(exec, 1)->toString(exec);
+    const UString& title = args.at(0).toString(exec);
+    const UString& media = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createCSSStyleSheet(title, media, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createCSSStyleSheet(title, media, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDOMImplementationPrototypeFunctionCreateHTMLDocument(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateHTMLDocument(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMImplementation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMImplementation::s_info))
         return throwError(exec, TypeError);
     JSDOMImplementation* castedThisObj = static_cast<JSDOMImplementation*>(asObject(thisValue));
     DOMImplementation* imp = static_cast<DOMImplementation*>(castedThisObj->impl());
-    const UString& title = args.at(exec, 0)->toString(exec);
+    const UString& title = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createHTMLDocument(title)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createHTMLDocument(title)));
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, DOMImplementation* object)
+JSC::JSValue toJS(JSC::ExecState* exec, DOMImplementation* object)
 {
     return getDOMObjectWrapper<JSDOMImplementation>(exec, object);
 }
-DOMImplementation* toDOMImplementation(JSC::JSValuePtr value)
+DOMImplementation* toDOMImplementation(JSC::JSValue value)
 {
-    return value->isObject(&JSDOMImplementation::s_info) ? static_cast<JSDOMImplementation*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSDOMImplementation::s_info) ? static_cast<JSDOMImplementation*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h
index 72fd40f..e017778 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMImplementation.h
@@ -34,33 +34,34 @@ class JSDOMImplementation : public DOMObject {
 public:
     JSDOMImplementation(PassRefPtr<JSC::Structure>, PassRefPtr<DOMImplementation>);
     virtual ~JSDOMImplementation();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     DOMImplementation* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<DOMImplementation> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, DOMImplementation*);
-DOMImplementation* toDOMImplementation(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, DOMImplementation*);
+DOMImplementation* toDOMImplementation(JSC::JSValue);
 
 class JSDOMImplementationPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,14 +70,14 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsDOMImplementationPrototypeFunctionHasFeature(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMImplementationPrototypeFunctionCreateDocumentType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMImplementationPrototypeFunctionCreateDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMImplementationPrototypeFunctionCreateCSSStyleSheet(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMImplementationPrototypeFunctionCreateHTMLDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionHasFeature(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateDocumentType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateCSSStyleSheet(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMImplementationPrototypeFunctionCreateHTMLDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsDOMImplementationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMImplementationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
index 162127c..ffb4f70 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.cpp
@@ -19,24 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSDOMParser.h"
 
-#include <wtf/GetPtr.h>
-
 #include "DOMParser.h"
 #include "Document.h"
 #include "JSDocument.h"
 #include "NodeFilter.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDOMParser)
+ASSERT_CLASS_FITS_IN_CELL(JSDOMParser);
 
 /* Hash table */
 
@@ -72,13 +68,13 @@ public:
     JSDOMParserConstructor(ExecState* exec)
         : DOMObject(JSDOMParserConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSDOMParserPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSDOMParserPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -117,9 +113,9 @@ static const HashTable JSDOMParserPrototypeTable =
 
 const ClassInfo JSDOMParserPrototype::s_info = { "DOMParserPrototype", 0, &JSDOMParserPrototypeTable, 0 };
 
-JSObject* JSDOMParserPrototype::self(ExecState* exec)
+JSObject* JSDOMParserPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSDOMParser>(exec);
+    return getDOMPrototype<JSDOMParser>(exec, globalObject);
 }
 
 bool JSDOMParserPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -138,12 +134,11 @@ JSDOMParser::JSDOMParser(PassRefPtr<Structure> structure, PassRefPtr<DOMParser>
 JSDOMParser::~JSDOMParser()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSDOMParser::createPrototype(ExecState* exec)
+JSObject* JSDOMParser::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSDOMParserPrototype(JSDOMParserPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSDOMParserPrototype(JSDOMParserPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSDOMParser::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -151,36 +146,37 @@ bool JSDOMParser::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSDOMParser, Base>(exec, &JSDOMParserTable, this, propertyName, slot);
 }
 
-JSValuePtr jsDOMParserConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMParserConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSDOMParser*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSDOMParser::getConstructor(ExecState* exec)
+JSValue JSDOMParser::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSDOMParserConstructor>(exec);
 }
 
-JSValuePtr jsDOMParserPrototypeFunctionParseFromString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMParserPrototypeFunctionParseFromString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMParser::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMParser::s_info))
         return throwError(exec, TypeError);
     JSDOMParser* castedThisObj = static_cast<JSDOMParser*>(asObject(thisValue));
     DOMParser* imp = static_cast<DOMParser*>(castedThisObj->impl());
-    const UString& str = args.at(exec, 0)->toString(exec);
-    const UString& contentType = args.at(exec, 1)->toString(exec);
+    const UString& str = args.at(0).toString(exec);
+    const UString& contentType = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->parseFromString(str, contentType)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->parseFromString(str, contentType)));
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, DOMParser* object)
+JSC::JSValue toJS(JSC::ExecState* exec, DOMParser* object)
 {
     return getDOMObjectWrapper<JSDOMParser>(exec, object);
 }
-DOMParser* toDOMParser(JSC::JSValuePtr value)
+DOMParser* toDOMParser(JSC::JSValue value)
 {
-    return value->isObject(&JSDOMParser::s_info) ? static_cast<JSDOMParser*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSDOMParser::s_info) ? static_cast<JSDOMParser*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h
index 0e2b604..cfdbe9b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMParser.h
@@ -34,33 +34,34 @@ class JSDOMParser : public DOMObject {
 public:
     JSDOMParser(PassRefPtr<JSC::Structure>, PassRefPtr<DOMParser>);
     virtual ~JSDOMParser();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     DOMParser* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<DOMParser> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, DOMParser*);
-DOMParser* toDOMParser(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, DOMParser*);
+DOMParser* toDOMParser(JSC::JSValue);
 
 class JSDOMParserPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,10 +70,10 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsDOMParserPrototypeFunctionParseFromString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMParserPrototypeFunctionParseFromString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsDOMParserConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMParserConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp
index 48f575c..422c410 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.cpp
@@ -19,27 +19,24 @@
 */
 
 #include "config.h"
-
 #include "JSDOMSelection.h"
 
-#include <wtf/GetPtr.h>
-
 #include "DOMSelection.h"
 #include "JSNode.h"
 #include "JSRange.h"
 #include "KURL.h"
 #include "Node.h"
 #include "Range.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDOMSelection)
+ASSERT_CLASS_FITS_IN_CELL(JSDOMSelection);
 
 /* Hash table */
 
@@ -49,13 +46,13 @@ static const HashTableValue JSDOMSelectionTableValues[12] =
     { "anchorOffset", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionAnchorOffset, (intptr_t)0 },
     { "focusNode", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionFocusNode, (intptr_t)0 },
     { "focusOffset", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionFocusOffset, (intptr_t)0 },
+    { "isCollapsed", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionIsCollapsed, (intptr_t)0 },
+    { "rangeCount", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionRangeCount, (intptr_t)0 },
     { "baseNode", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionBaseNode, (intptr_t)0 },
     { "baseOffset", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionBaseOffset, (intptr_t)0 },
     { "extentNode", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionExtentNode, (intptr_t)0 },
     { "extentOffset", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionExtentOffset, (intptr_t)0 },
-    { "isCollapsed", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionIsCollapsed, (intptr_t)0 },
     { "type", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionType, (intptr_t)0 },
-    { "rangeCount", DontDelete|ReadOnly, (intptr_t)jsDOMSelectionRangeCount, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -76,15 +73,15 @@ static const HashTableValue JSDOMSelectionPrototypeTableValues[16] =
     { "deleteFromDocument", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionDeleteFromDocument, (intptr_t)0 },
     { "containsNode", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionContainsNode, (intptr_t)2 },
     { "selectAllChildren", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionSelectAllChildren, (intptr_t)1 },
-    { "empty", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionEmpty, (intptr_t)0 },
-    { "setBaseAndExtent", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionSetBaseAndExtent, (intptr_t)4 },
-    { "setPosition", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionSetPosition, (intptr_t)2 },
-    { "modify", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionModify, (intptr_t)3 },
     { "extend", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionExtend, (intptr_t)2 },
     { "getRangeAt", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionGetRangeAt, (intptr_t)1 },
     { "removeAllRanges", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionRemoveAllRanges, (intptr_t)0 },
     { "addRange", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionAddRange, (intptr_t)1 },
     { "toString", DontDelete|DontEnum|Function, (intptr_t)jsDOMSelectionPrototypeFunctionToString, (intptr_t)0 },
+    { "modify", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionModify, (intptr_t)3 },
+    { "setBaseAndExtent", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionSetBaseAndExtent, (intptr_t)4 },
+    { "setPosition", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionSetPosition, (intptr_t)2 },
+    { "empty", DontDelete|Function, (intptr_t)jsDOMSelectionPrototypeFunctionEmpty, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -97,9 +94,9 @@ static const HashTable JSDOMSelectionPrototypeTable =
 
 const ClassInfo JSDOMSelectionPrototype::s_info = { "DOMSelectionPrototype", 0, &JSDOMSelectionPrototypeTable, 0 };
 
-JSObject* JSDOMSelectionPrototype::self(ExecState* exec)
+JSObject* JSDOMSelectionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSDOMSelection>(exec);
+    return getDOMPrototype<JSDOMSelection>(exec, globalObject);
 }
 
 bool JSDOMSelectionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -118,12 +115,11 @@ JSDOMSelection::JSDOMSelection(PassRefPtr<Structure> structure, PassRefPtr<DOMSe
 JSDOMSelection::~JSDOMSelection()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSDOMSelection::createPrototype(ExecState* exec)
+JSObject* JSDOMSelection::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSDOMSelectionPrototype(JSDOMSelectionPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSDOMSelectionPrototype(JSDOMSelectionPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSDOMSelection::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,90 +127,103 @@ bool JSDOMSelection::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSDOMSelection, Base>(exec, &JSDOMSelectionTable, this, propertyName, slot);
 }
 
-JSValuePtr jsDOMSelectionAnchorNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionAnchorNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(static_cast<JSDOMSelection*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->anchorNode()));
 }
 
-JSValuePtr jsDOMSelectionAnchorOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionAnchorOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(static_cast<JSDOMSelection*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->anchorOffset());
 }
 
-JSValuePtr jsDOMSelectionFocusNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionFocusNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(static_cast<JSDOMSelection*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->focusNode()));
 }
 
-JSValuePtr jsDOMSelectionFocusOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionFocusOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(static_cast<JSDOMSelection*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->focusOffset());
 }
 
-JSValuePtr jsDOMSelectionBaseNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionIsCollapsed(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(static_cast<JSDOMSelection*>(asObject(slot.slotBase()))->impl());
-    return toJS(exec, WTF::getPtr(imp->baseNode()));
+    return jsBoolean(imp->isCollapsed());
 }
 
-JSValuePtr jsDOMSelectionBaseOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionRangeCount(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(static_cast<JSDOMSelection*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->baseOffset());
+    return jsNumber(exec, imp->rangeCount());
 }
 
-JSValuePtr jsDOMSelectionExtentNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionBaseNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(static_cast<JSDOMSelection*>(asObject(slot.slotBase()))->impl());
-    return toJS(exec, WTF::getPtr(imp->extentNode()));
+    return toJS(exec, WTF::getPtr(imp->baseNode()));
 }
 
-JSValuePtr jsDOMSelectionExtentOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionBaseOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(static_cast<JSDOMSelection*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->extentOffset());
+    return jsNumber(exec, imp->baseOffset());
 }
 
-JSValuePtr jsDOMSelectionIsCollapsed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionExtentNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(static_cast<JSDOMSelection*>(asObject(slot.slotBase()))->impl());
-    return jsBoolean(imp->isCollapsed());
+    return toJS(exec, WTF::getPtr(imp->extentNode()));
 }
 
-JSValuePtr jsDOMSelectionType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionExtentOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(static_cast<JSDOMSelection*>(asObject(slot.slotBase()))->impl());
-    return jsString(exec, imp->type());
+    return jsNumber(exec, imp->extentOffset());
 }
 
-JSValuePtr jsDOMSelectionRangeCount(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMSelectionType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMSelection* imp = static_cast<DOMSelection*>(static_cast<JSDOMSelection*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->rangeCount());
+    return jsString(exec, imp->type());
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionCollapse(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionCollapse(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* node = toNode(args.at(exec, 0));
-    int index = args.at(exec, 1)->toInt32(exec);
+    Node* node = toNode(args.at(0));
+    int index = args.at(1).toInt32(exec);
 
     imp->collapse(node, index, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionCollapseToEnd(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionCollapseToEnd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
@@ -223,9 +232,10 @@ JSValuePtr jsDOMSelectionPrototypeFunctionCollapseToEnd(ExecState* exec, JSObjec
     return jsUndefined();
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionCollapseToStart(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionCollapseToStart(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
@@ -234,9 +244,10 @@ JSValuePtr jsDOMSelectionPrototypeFunctionCollapseToStart(ExecState* exec, JSObj
     return jsUndefined();
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionDeleteFromDocument(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionDeleteFromDocument(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
@@ -245,163 +256,174 @@ JSValuePtr jsDOMSelectionPrototypeFunctionDeleteFromDocument(ExecState* exec, JS
     return jsUndefined();
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionContainsNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionContainsNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
-    Node* node = toNode(args.at(exec, 0));
-    bool allowPartial = args.at(exec, 1)->toBoolean(exec);
+    Node* node = toNode(args.at(0));
+    bool allowPartial = args.at(1).toBoolean(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->containsNode(node, allowPartial));
+    JSC::JSValue result = jsBoolean(imp->containsNode(node, allowPartial));
     return result;
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionSelectAllChildren(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionSelectAllChildren(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* node = toNode(args.at(exec, 0));
+    Node* node = toNode(args.at(0));
 
     imp->selectAllChildren(node, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionEmpty(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionExtend(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    Node* node = toNode(args.at(0));
+    int offset = args.at(1).toInt32(exec);
 
-    imp->empty();
+    imp->extend(node, offset, ec);
+    setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionSetBaseAndExtent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionGetRangeAt(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* baseNode = toNode(args.at(exec, 0));
-    int baseOffset = args.at(exec, 1)->toInt32(exec);
-    Node* extentNode = toNode(args.at(exec, 2));
-    int extentOffset = args.at(exec, 3)->toInt32(exec);
+    int index = args.at(0).toInt32(exec);
 
-    imp->setBaseAndExtent(baseNode, baseOffset, extentNode, extentOffset, ec);
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getRangeAt(index, ec)));
     setDOMException(exec, ec);
-    return jsUndefined();
+    return result;
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionSetPosition(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionRemoveAllRanges(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    Node* node = toNode(args.at(exec, 0));
-    int offset = args.at(exec, 1)->toInt32(exec);
 
-    imp->setPosition(node, offset, ec);
-    setDOMException(exec, ec);
+    imp->removeAllRanges();
     return jsUndefined();
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionModify(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionAddRange(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
-    const UString& alter = args.at(exec, 0)->toString(exec);
-    const UString& direction = args.at(exec, 1)->toString(exec);
-    const UString& granularity = args.at(exec, 2)->toString(exec);
+    Range* range = toRange(args.at(0));
 
-    imp->modify(alter, direction, granularity);
+    imp->addRange(range);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionExtend(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    Node* node = toNode(args.at(exec, 0));
-    int offset = args.at(exec, 1)->toInt32(exec);
 
-    imp->extend(node, offset, ec);
-    setDOMException(exec, ec);
-    return jsUndefined();
+
+    JSC::JSValue result = jsString(exec, imp->toString());
+    return result;
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionGetRangeAt(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionModify(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    int index = args.at(exec, 0)->toInt32(exec);
+    const UString& alter = args.at(0).toString(exec);
+    const UString& direction = args.at(1).toString(exec);
+    const UString& granularity = args.at(2).toString(exec);
 
-
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getRangeAt(index, ec)));
-    setDOMException(exec, ec);
-    return result;
+    imp->modify(alter, direction, granularity);
+    return jsUndefined();
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionRemoveAllRanges(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionSetBaseAndExtent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    Node* baseNode = toNode(args.at(0));
+    int baseOffset = args.at(1).toInt32(exec);
+    Node* extentNode = toNode(args.at(2));
+    int extentOffset = args.at(3).toInt32(exec);
 
-    imp->removeAllRanges();
+    imp->setBaseAndExtent(baseNode, baseOffset, extentNode, extentOffset, ec);
+    setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionAddRange(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionSetPosition(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
-    Range* range = toRange(args.at(exec, 0));
+    ExceptionCode ec = 0;
+    Node* node = toNode(args.at(0));
+    int offset = args.at(1).toInt32(exec);
 
-    imp->addRange(range);
+    imp->setPosition(node, offset, ec);
+    setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMSelectionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionEmpty(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDOMSelection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDOMSelection::s_info))
         return throwError(exec, TypeError);
     JSDOMSelection* castedThisObj = static_cast<JSDOMSelection*>(asObject(thisValue));
     DOMSelection* imp = static_cast<DOMSelection*>(castedThisObj->impl());
 
-
-    JSC::JSValuePtr result = jsString(exec, imp->toString());
-    return result;
+    imp->empty();
+    return jsUndefined();
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, DOMSelection* object)
+JSC::JSValue toJS(JSC::ExecState* exec, DOMSelection* object)
 {
     return getDOMObjectWrapper<JSDOMSelection>(exec, object);
 }
-DOMSelection* toDOMSelection(JSC::JSValuePtr value)
+DOMSelection* toDOMSelection(JSC::JSValue value)
 {
-    return value->isObject(&JSDOMSelection::s_info) ? static_cast<JSDOMSelection*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSDOMSelection::s_info) ? static_cast<JSDOMSelection*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h
index cfa166c..2af8cbd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMSelection.h
@@ -34,12 +34,12 @@ class JSDOMSelection : public DOMObject {
 public:
     JSDOMSelection(PassRefPtr<JSC::Structure>, PassRefPtr<DOMSelection>);
     virtual ~JSDOMSelection();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -50,16 +50,17 @@ private:
     RefPtr<DOMSelection> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, DOMSelection*);
-DOMSelection* toDOMSelection(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, DOMSelection*);
+DOMSelection* toDOMSelection(JSC::JSValue);
 
 class JSDOMSelectionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -68,34 +69,34 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionCollapse(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionCollapseToEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionCollapseToStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionDeleteFromDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionContainsNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionSelectAllChildren(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionEmpty(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionSetBaseAndExtent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionSetPosition(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionModify(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionExtend(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionGetRangeAt(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionRemoveAllRanges(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionAddRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMSelectionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionCollapse(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionCollapseToEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionCollapseToStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionDeleteFromDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionContainsNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionSelectAllChildren(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionExtend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionGetRangeAt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionRemoveAllRanges(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionAddRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionModify(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionSetBaseAndExtent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionSetPosition(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMSelectionPrototypeFunctionEmpty(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsDOMSelectionAnchorNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMSelectionAnchorOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMSelectionFocusNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMSelectionFocusOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMSelectionBaseNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMSelectionBaseOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMSelectionExtentNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMSelectionExtentOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMSelectionIsCollapsed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMSelectionType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMSelectionRangeCount(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionAnchorNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionAnchorOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionFocusNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionFocusOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionIsCollapsed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionRangeCount(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionBaseNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionBaseOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionExtentNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionExtentOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMSelectionType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMStringList.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMStringList.cpp
deleted file mode 100644
index 729cd7d..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMStringList.cpp
+++ /dev/null
@@ -1,212 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#include "JSDOMStringList.h"
-
-#include <wtf/GetPtr.h>
-
-#include <runtime/PropertyNameArray.h>
-#include "DOMStringList.h"
-
-#include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSDOMStringList)
-
-/* Hash table */
-
-static const HashTableValue JSDOMStringListTableValues[3] =
-{
-    { "length", DontDelete|ReadOnly, (intptr_t)jsDOMStringListLength, (intptr_t)0 },
-    { "constructor", DontEnum|ReadOnly, (intptr_t)jsDOMStringListConstructor, (intptr_t)0 },
-    { 0, 0, 0, 0 }
-};
-
-static const HashTable JSDOMStringListTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 15, JSDOMStringListTableValues, 0 };
-#else
-    { 5, 3, JSDOMStringListTableValues, 0 };
-#endif
-
-/* Hash table for constructor */
-
-static const HashTableValue JSDOMStringListConstructorTableValues[1] =
-{
-    { 0, 0, 0, 0 }
-};
-
-static const HashTable JSDOMStringListConstructorTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSDOMStringListConstructorTableValues, 0 };
-#else
-    { 1, 0, JSDOMStringListConstructorTableValues, 0 };
-#endif
-
-class JSDOMStringListConstructor : public DOMObject {
-public:
-    JSDOMStringListConstructor(ExecState* exec)
-        : DOMObject(JSDOMStringListConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
-    {
-        putDirect(exec->propertyNames().prototype, JSDOMStringListPrototype::self(exec), None);
-    }
-    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
-    virtual const ClassInfo* classInfo() const { return &s_info; }
-    static const ClassInfo s_info;
-
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
-    { 
-        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
-    }
-};
-
-const ClassInfo JSDOMStringListConstructor::s_info = { "DOMStringListConstructor", 0, &JSDOMStringListConstructorTable, 0 };
-
-bool JSDOMStringListConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    return getStaticValueSlot<JSDOMStringListConstructor, DOMObject>(exec, &JSDOMStringListConstructorTable, this, propertyName, slot);
-}
-
-/* Hash table for prototype */
-
-static const HashTableValue JSDOMStringListPrototypeTableValues[3] =
-{
-    { "item", DontDelete|Function, (intptr_t)jsDOMStringListPrototypeFunctionItem, (intptr_t)1 },
-    { "contains", DontDelete|Function, (intptr_t)jsDOMStringListPrototypeFunctionContains, (intptr_t)1 },
-    { 0, 0, 0, 0 }
-};
-
-static const HashTable JSDOMStringListPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 1, JSDOMStringListPrototypeTableValues, 0 };
-#else
-    { 4, 3, JSDOMStringListPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSDOMStringListPrototype::s_info = { "DOMStringListPrototype", 0, &JSDOMStringListPrototypeTable, 0 };
-
-JSObject* JSDOMStringListPrototype::self(ExecState* exec)
-{
-    return getDOMPrototype<JSDOMStringList>(exec);
-}
-
-bool JSDOMStringListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<JSObject>(exec, &JSDOMStringListPrototypeTable, this, propertyName, slot);
-}
-
-const ClassInfo JSDOMStringList::s_info = { "DOMStringList", 0, &JSDOMStringListTable, 0 };
-
-JSDOMStringList::JSDOMStringList(PassRefPtr<Structure> structure, PassRefPtr<DOMStringList> impl)
-    : DOMObject(structure)
-    , m_impl(impl)
-{
-}
-
-JSDOMStringList::~JSDOMStringList()
-{
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
-}
-
-JSObject* JSDOMStringList::createPrototype(ExecState* exec)
-{
-    return new (exec) JSDOMStringListPrototype(JSDOMStringListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
-}
-
-bool JSDOMStringList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<DOMStringList*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, index));
-        return true;
-    }
-    return getStaticValueSlot<JSDOMStringList, Base>(exec, &JSDOMStringListTable, this, propertyName, slot);
-}
-
-bool JSDOMStringList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
-{
-    if (propertyName < static_cast<DOMStringList*>(impl())->length()) {
-        slot.setValue(getByIndex(exec, propertyName));
-        return true;
-    }
-    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
-}
-
-JSValuePtr jsDOMStringListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    DOMStringList* imp = static_cast<DOMStringList*>(static_cast<JSDOMStringList*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->length());
-}
-
-JSValuePtr jsDOMStringListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    return static_cast<JSDOMStringList*>(asObject(slot.slotBase()))->getConstructor(exec);
-}
-void JSDOMStringList::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
-{
-    for (unsigned i = 0; i < static_cast<DOMStringList*>(impl())->length(); ++i)
-        propertyNames.add(Identifier::from(exec, i));
-     Base::getPropertyNames(exec, propertyNames);
-}
-
-JSValuePtr JSDOMStringList::getConstructor(ExecState* exec)
-{
-    return getDOMConstructor<JSDOMStringListConstructor>(exec);
-}
-
-JSValuePtr jsDOMStringListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSDOMStringList::s_info))
-        return throwError(exec, TypeError);
-    JSDOMStringList* castedThisObj = static_cast<JSDOMStringList*>(asObject(thisValue));
-    return castedThisObj->item(exec, args);
-}
-
-JSValuePtr jsDOMStringListPrototypeFunctionContains(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSDOMStringList::s_info))
-        return throwError(exec, TypeError);
-    JSDOMStringList* castedThisObj = static_cast<JSDOMStringList*>(asObject(thisValue));
-    DOMStringList* imp = static_cast<DOMStringList*>(castedThisObj->impl());
-    const UString& str = args.at(exec, 0)->toString(exec);
-
-
-    JSC::JSValuePtr result = jsBoolean(imp->contains(str));
-    return result;
-}
-
-JSC::JSValuePtr toJS(JSC::ExecState* exec, DOMStringList* object)
-{
-    return getDOMObjectWrapper<JSDOMStringList>(exec, object);
-}
-DOMStringList* toDOMStringList(JSC::JSValuePtr value)
-{
-    return value->isObject(&JSDOMStringList::s_info) ? static_cast<JSDOMStringList*>(asObject(value))->impl() : 0;
-}
-
-}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
index 10b6c3b..d9c3ed9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.cpp
@@ -19,11 +19,8 @@
 */
 
 #include "config.h"
-
 #include "JSDOMWindow.h"
 
-#include <wtf/GetPtr.h>
-
 #include "BarInfo.h"
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSRuleList.h"
@@ -35,8 +32,8 @@
 #include "Database.h"
 #include "Document.h"
 #include "Element.h"
+#include "Event.h"
 #include "EventListener.h"
-#include "History.h"
 #include "JSAttr.h"
 #include "JSBarInfo.h"
 #include "JSCDATASection.h"
@@ -57,6 +54,8 @@
 #include "JSCSSVariablesRule.h"
 #include "JSCanvasRenderingContext2D.h"
 #include "JSCharacterData.h"
+#include "JSClientRect.h"
+#include "JSClientRectList.h"
 #include "JSClipboard.h"
 #include "JSComment.h"
 #include "JSConsole.h"
@@ -67,7 +66,6 @@
 #include "JSDOMImplementation.h"
 #include "JSDOMParser.h"
 #include "JSDOMSelection.h"
-#include "JSDOMStringList.h"
 #include "JSDOMWindow.h"
 #include "JSDOMWindowCustom.h"
 #include "JSDOMWindowShell.h"
@@ -96,6 +94,8 @@
 #include "JSHTMLCanvasElement.h"
 #include "JSHTMLCollection.h"
 #include "JSHTMLDListElement.h"
+#include "JSHTMLDataGridColElement.h"
+#include "JSHTMLDataGridElement.h"
 #include "JSHTMLDirectoryElement.h"
 #include "JSHTMLDivElement.h"
 #include "JSHTMLDocument.h"
@@ -145,9 +145,7 @@
 #include "JSHTMLTitleElement.h"
 #include "JSHTMLUListElement.h"
 #include "JSHTMLVideoElement.h"
-#include "JSHistory.h"
 #include "JSKeyboardEvent.h"
-#include "JSLocation.h"
 #include "JSMediaError.h"
 #include "JSMediaList.h"
 #include "JSMessageEvent.h"
@@ -195,9 +193,13 @@
 #include "JSWebKitAnimationEvent.h"
 #include "JSWebKitCSSKeyframeRule.h"
 #include "JSWebKitCSSKeyframesRule.h"
+#include "JSWebKitCSSMatrix.h"
 #include "JSWebKitCSSTransformValue.h"
+#include "JSWebKitPoint.h"
 #include "JSWebKitTransitionEvent.h"
 #include "JSWheelEvent.h"
+#include "JSWorker.h"
+#include "JSXMLHttpRequest.h"
 #include "JSXMLHttpRequestException.h"
 #include "JSXMLHttpRequestUpload.h"
 #include "JSXMLSerializer.h"
@@ -205,24 +207,25 @@
 #include "JSXPathException.h"
 #include "JSXPathResult.h"
 #include "KURL.h"
-#include "Location.h"
 #include "Navigator.h"
+#include "RegisteredEventListener.h"
 #include "Screen.h"
 #include "Storage.h"
-
+#include "WebKitPoint.h"
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDOMWindow)
+ASSERT_CLASS_FITS_IN_CELL(JSDOMWindow);
 
 /* Hash table */
 
-static const HashTableValue JSDOMWindowTableValues[227] =
+static const HashTableValue JSDOMWindowTableValues[272] =
 {
     { "screen", DontDelete|ReadOnly, (intptr_t)jsDOMWindowScreen, (intptr_t)0 },
     { "history", DontDelete|ReadOnly, (intptr_t)jsDOMWindowHistory, (intptr_t)0 },
@@ -235,6 +238,8 @@ static const HashTableValue JSDOMWindowTableValues[227] =
     { "navigator", DontDelete, (intptr_t)jsDOMWindowNavigator, (intptr_t)setJSDOMWindowNavigator },
     { "clientInformation", DontDelete, (intptr_t)jsDOMWindowClientInformation, (intptr_t)setJSDOMWindowClientInformation },
     { "location", DontDelete, (intptr_t)jsDOMWindowLocation, (intptr_t)setJSDOMWindowLocation },
+    { "event", DontDelete, (intptr_t)jsDOMWindowEvent, (intptr_t)setJSDOMWindowEvent },
+    { "crypto", DontDelete|ReadOnly, (intptr_t)jsDOMWindowCrypto, (intptr_t)0 },
     { "frameElement", DontDelete|ReadOnly, (intptr_t)jsDOMWindowFrameElement, (intptr_t)0 },
     { "offscreenBuffering", DontDelete, (intptr_t)jsDOMWindowOffscreenBuffering, (intptr_t)setJSDOMWindowOffscreenBuffering },
     { "outerHeight", DontDelete, (intptr_t)jsDOMWindowOuterHeight, (intptr_t)setJSDOMWindowOuterHeight },
@@ -268,33 +273,66 @@ static const HashTableValue JSDOMWindowTableValues[227] =
     { "localStorage", DontDelete|ReadOnly, (intptr_t)jsDOMWindowLocalStorage, (intptr_t)0 },
     { "console", DontDelete, (intptr_t)jsDOMWindowConsole, (intptr_t)setJSDOMWindowConsole },
     { "onabort", DontDelete, (intptr_t)jsDOMWindowOnabort, (intptr_t)setJSDOMWindowOnabort },
+    { "onbeforeunload", DontDelete, (intptr_t)jsDOMWindowOnbeforeunload, (intptr_t)setJSDOMWindowOnbeforeunload },
     { "onblur", DontDelete, (intptr_t)jsDOMWindowOnblur, (intptr_t)setJSDOMWindowOnblur },
+    { "oncanplay", DontDelete, (intptr_t)jsDOMWindowOncanplay, (intptr_t)setJSDOMWindowOncanplay },
+    { "oncanplaythrough", DontDelete, (intptr_t)jsDOMWindowOncanplaythrough, (intptr_t)setJSDOMWindowOncanplaythrough },
     { "onchange", DontDelete, (intptr_t)jsDOMWindowOnchange, (intptr_t)setJSDOMWindowOnchange },
     { "onclick", DontDelete, (intptr_t)jsDOMWindowOnclick, (intptr_t)setJSDOMWindowOnclick },
+    { "oncontextmenu", DontDelete, (intptr_t)jsDOMWindowOncontextmenu, (intptr_t)setJSDOMWindowOncontextmenu },
     { "ondblclick", DontDelete, (intptr_t)jsDOMWindowOndblclick, (intptr_t)setJSDOMWindowOndblclick },
+    { "ondrag", DontDelete, (intptr_t)jsDOMWindowOndrag, (intptr_t)setJSDOMWindowOndrag },
+    { "ondragend", DontDelete, (intptr_t)jsDOMWindowOndragend, (intptr_t)setJSDOMWindowOndragend },
+    { "ondragenter", DontDelete, (intptr_t)jsDOMWindowOndragenter, (intptr_t)setJSDOMWindowOndragenter },
+    { "ondragleave", DontDelete, (intptr_t)jsDOMWindowOndragleave, (intptr_t)setJSDOMWindowOndragleave },
+    { "ondragover", DontDelete, (intptr_t)jsDOMWindowOndragover, (intptr_t)setJSDOMWindowOndragover },
+    { "ondragstart", DontDelete, (intptr_t)jsDOMWindowOndragstart, (intptr_t)setJSDOMWindowOndragstart },
+    { "ondrop", DontDelete, (intptr_t)jsDOMWindowOndrop, (intptr_t)setJSDOMWindowOndrop },
+    { "ondurationchange", DontDelete, (intptr_t)jsDOMWindowOndurationchange, (intptr_t)setJSDOMWindowOndurationchange },
+    { "onemptied", DontDelete, (intptr_t)jsDOMWindowOnemptied, (intptr_t)setJSDOMWindowOnemptied },
+    { "onended", DontDelete, (intptr_t)jsDOMWindowOnended, (intptr_t)setJSDOMWindowOnended },
     { "onerror", DontDelete, (intptr_t)jsDOMWindowOnerror, (intptr_t)setJSDOMWindowOnerror },
     { "onfocus", DontDelete, (intptr_t)jsDOMWindowOnfocus, (intptr_t)setJSDOMWindowOnfocus },
+    { "oninput", DontDelete, (intptr_t)jsDOMWindowOninput, (intptr_t)setJSDOMWindowOninput },
     { "onkeydown", DontDelete, (intptr_t)jsDOMWindowOnkeydown, (intptr_t)setJSDOMWindowOnkeydown },
     { "onkeypress", DontDelete, (intptr_t)jsDOMWindowOnkeypress, (intptr_t)setJSDOMWindowOnkeypress },
     { "onkeyup", DontDelete, (intptr_t)jsDOMWindowOnkeyup, (intptr_t)setJSDOMWindowOnkeyup },
     { "onload", DontDelete, (intptr_t)jsDOMWindowOnload, (intptr_t)setJSDOMWindowOnload },
+    { "onloadeddata", DontDelete, (intptr_t)jsDOMWindowOnloadeddata, (intptr_t)setJSDOMWindowOnloadeddata },
+    { "onloadedmetadata", DontDelete, (intptr_t)jsDOMWindowOnloadedmetadata, (intptr_t)setJSDOMWindowOnloadedmetadata },
+    { "onloadstart", DontDelete, (intptr_t)jsDOMWindowOnloadstart, (intptr_t)setJSDOMWindowOnloadstart },
+    { "onmessage", DontDelete, (intptr_t)jsDOMWindowOnmessage, (intptr_t)setJSDOMWindowOnmessage },
     { "onmousedown", DontDelete, (intptr_t)jsDOMWindowOnmousedown, (intptr_t)setJSDOMWindowOnmousedown },
     { "onmousemove", DontDelete, (intptr_t)jsDOMWindowOnmousemove, (intptr_t)setJSDOMWindowOnmousemove },
     { "onmouseout", DontDelete, (intptr_t)jsDOMWindowOnmouseout, (intptr_t)setJSDOMWindowOnmouseout },
     { "onmouseover", DontDelete, (intptr_t)jsDOMWindowOnmouseover, (intptr_t)setJSDOMWindowOnmouseover },
     { "onmouseup", DontDelete, (intptr_t)jsDOMWindowOnmouseup, (intptr_t)setJSDOMWindowOnmouseup },
     { "onmousewheel", DontDelete, (intptr_t)jsDOMWindowOnmousewheel, (intptr_t)setJSDOMWindowOnmousewheel },
-    { "onreset", DontDelete, (intptr_t)jsDOMWindowOnreset, (intptr_t)setJSDOMWindowOnreset },
+    { "onoffline", DontDelete, (intptr_t)jsDOMWindowOnoffline, (intptr_t)setJSDOMWindowOnoffline },
+    { "ononline", DontDelete, (intptr_t)jsDOMWindowOnonline, (intptr_t)setJSDOMWindowOnonline },
+    { "onpause", DontDelete, (intptr_t)jsDOMWindowOnpause, (intptr_t)setJSDOMWindowOnpause },
+    { "onplay", DontDelete, (intptr_t)jsDOMWindowOnplay, (intptr_t)setJSDOMWindowOnplay },
+    { "onplaying", DontDelete, (intptr_t)jsDOMWindowOnplaying, (intptr_t)setJSDOMWindowOnplaying },
+    { "onprogress", DontDelete, (intptr_t)jsDOMWindowOnprogress, (intptr_t)setJSDOMWindowOnprogress },
+    { "onratechange", DontDelete, (intptr_t)jsDOMWindowOnratechange, (intptr_t)setJSDOMWindowOnratechange },
     { "onresize", DontDelete, (intptr_t)jsDOMWindowOnresize, (intptr_t)setJSDOMWindowOnresize },
     { "onscroll", DontDelete, (intptr_t)jsDOMWindowOnscroll, (intptr_t)setJSDOMWindowOnscroll },
-    { "onsearch", DontDelete, (intptr_t)jsDOMWindowOnsearch, (intptr_t)setJSDOMWindowOnsearch },
+    { "onseeked", DontDelete, (intptr_t)jsDOMWindowOnseeked, (intptr_t)setJSDOMWindowOnseeked },
+    { "onseeking", DontDelete, (intptr_t)jsDOMWindowOnseeking, (intptr_t)setJSDOMWindowOnseeking },
     { "onselect", DontDelete, (intptr_t)jsDOMWindowOnselect, (intptr_t)setJSDOMWindowOnselect },
+    { "onstalled", DontDelete, (intptr_t)jsDOMWindowOnstalled, (intptr_t)setJSDOMWindowOnstalled },
+    { "onstorage", DontDelete, (intptr_t)jsDOMWindowOnstorage, (intptr_t)setJSDOMWindowOnstorage },
     { "onsubmit", DontDelete, (intptr_t)jsDOMWindowOnsubmit, (intptr_t)setJSDOMWindowOnsubmit },
+    { "onsuspend", DontDelete, (intptr_t)jsDOMWindowOnsuspend, (intptr_t)setJSDOMWindowOnsuspend },
+    { "ontimeupdate", DontDelete, (intptr_t)jsDOMWindowOntimeupdate, (intptr_t)setJSDOMWindowOntimeupdate },
     { "onunload", DontDelete, (intptr_t)jsDOMWindowOnunload, (intptr_t)setJSDOMWindowOnunload },
-    { "onbeforeunload", DontDelete, (intptr_t)jsDOMWindowOnbeforeunload, (intptr_t)setJSDOMWindowOnbeforeunload },
-    { "onwebkitanimationstart", DontDelete, (intptr_t)jsDOMWindowOnwebkitanimationstart, (intptr_t)setJSDOMWindowOnwebkitanimationstart },
-    { "onwebkitanimationiteration", DontDelete, (intptr_t)jsDOMWindowOnwebkitanimationiteration, (intptr_t)setJSDOMWindowOnwebkitanimationiteration },
+    { "onvolumechange", DontDelete, (intptr_t)jsDOMWindowOnvolumechange, (intptr_t)setJSDOMWindowOnvolumechange },
+    { "onwaiting", DontDelete, (intptr_t)jsDOMWindowOnwaiting, (intptr_t)setJSDOMWindowOnwaiting },
+    { "onreset", DontDelete, (intptr_t)jsDOMWindowOnreset, (intptr_t)setJSDOMWindowOnreset },
+    { "onsearch", DontDelete, (intptr_t)jsDOMWindowOnsearch, (intptr_t)setJSDOMWindowOnsearch },
     { "onwebkitanimationend", DontDelete, (intptr_t)jsDOMWindowOnwebkitanimationend, (intptr_t)setJSDOMWindowOnwebkitanimationend },
+    { "onwebkitanimationiteration", DontDelete, (intptr_t)jsDOMWindowOnwebkitanimationiteration, (intptr_t)setJSDOMWindowOnwebkitanimationiteration },
+    { "onwebkitanimationstart", DontDelete, (intptr_t)jsDOMWindowOnwebkitanimationstart, (intptr_t)setJSDOMWindowOnwebkitanimationstart },
     { "onwebkittransitionend", DontDelete, (intptr_t)jsDOMWindowOnwebkittransitionend, (intptr_t)setJSDOMWindowOnwebkittransitionend },
     { "StyleSheet", DontDelete, (intptr_t)jsDOMWindowStyleSheetConstructor, (intptr_t)setJSDOMWindowStyleSheetConstructor },
     { "CSSStyleSheet", DontDelete, (intptr_t)jsDOMWindowCSSStyleSheetConstructor, (intptr_t)setJSDOMWindowCSSStyleSheetConstructor },
@@ -318,7 +356,6 @@ static const HashTableValue JSDOMWindowTableValues[227] =
     { "Rect", DontDelete, (intptr_t)jsDOMWindowRectConstructor, (intptr_t)setJSDOMWindowRectConstructor },
     { "StyleSheetList", DontDelete, (intptr_t)jsDOMWindowStyleSheetListConstructor, (intptr_t)setJSDOMWindowStyleSheetListConstructor },
     { "DOMException", DontDelete, (intptr_t)jsDOMWindowDOMExceptionConstructor, (intptr_t)setJSDOMWindowDOMExceptionConstructor },
-    { "DOMStringList", DontDelete, (intptr_t)jsDOMWindowDOMStringListConstructor, (intptr_t)setJSDOMWindowDOMStringListConstructor },
     { "DOMImplementation", DontDelete, (intptr_t)jsDOMWindowDOMImplementationConstructor, (intptr_t)setJSDOMWindowDOMImplementationConstructor },
     { "DocumentFragment", DontDelete, (intptr_t)jsDOMWindowDocumentFragmentConstructor, (intptr_t)setJSDOMWindowDocumentFragmentConstructor },
     { "Document", DontDelete, (intptr_t)jsDOMWindowDocumentConstructor, (intptr_t)setJSDOMWindowDocumentConstructor },
@@ -348,6 +385,8 @@ static const HashTableValue JSDOMWindowTableValues[227] =
     { "HTMLBodyElement", DontDelete, (intptr_t)jsDOMWindowHTMLBodyElementConstructor, (intptr_t)setJSDOMWindowHTMLBodyElementConstructor },
     { "HTMLButtonElement", DontDelete, (intptr_t)jsDOMWindowHTMLButtonElementConstructor, (intptr_t)setJSDOMWindowHTMLButtonElementConstructor },
     { "HTMLCanvasElement", DontDelete, (intptr_t)jsDOMWindowHTMLCanvasElementConstructor, (intptr_t)setJSDOMWindowHTMLCanvasElementConstructor },
+    { "HTMLDataGridElement", DontDelete, (intptr_t)jsDOMWindowHTMLDataGridElementConstructor, (intptr_t)setJSDOMWindowHTMLDataGridElementConstructor },
+    { "HTMLDataGridColElement", DontDelete, (intptr_t)jsDOMWindowHTMLDataGridColElementConstructor, (intptr_t)setJSDOMWindowHTMLDataGridColElementConstructor },
     { "HTMLDListElement", DontDelete, (intptr_t)jsDOMWindowHTMLDListElementConstructor, (intptr_t)setJSDOMWindowHTMLDListElementConstructor },
     { "HTMLDirectoryElement", DontDelete, (intptr_t)jsDOMWindowHTMLDirectoryElementConstructor, (intptr_t)setJSDOMWindowHTMLDirectoryElementConstructor },
     { "HTMLDivElement", DontDelete, (intptr_t)jsDOMWindowHTMLDivElementConstructor, (intptr_t)setJSDOMWindowHTMLDivElementConstructor },
@@ -395,6 +434,8 @@ static const HashTableValue JSDOMWindowTableValues[227] =
     { "HTMLTitleElement", DontDelete, (intptr_t)jsDOMWindowHTMLTitleElementConstructor, (intptr_t)setJSDOMWindowHTMLTitleElementConstructor },
     { "HTMLUListElement", DontDelete, (intptr_t)jsDOMWindowHTMLUListElementConstructor, (intptr_t)setJSDOMWindowHTMLUListElementConstructor },
     { "HTMLCollection", DontDelete, (intptr_t)jsDOMWindowHTMLCollectionConstructor, (intptr_t)setJSDOMWindowHTMLCollectionConstructor },
+    { "Image", DontDelete, (intptr_t)jsDOMWindowImageConstructor, (intptr_t)setJSDOMWindowImageConstructor },
+    { "Option", DontDelete, (intptr_t)jsDOMWindowOptionConstructor, (intptr_t)setJSDOMWindowOptionConstructor },
     { "CanvasRenderingContext2D", DontDelete, (intptr_t)jsDOMWindowCanvasRenderingContext2DConstructor, (intptr_t)setJSDOMWindowCanvasRenderingContext2DConstructor },
     { "TextMetrics", DontDelete, (intptr_t)jsDOMWindowTextMetricsConstructor, (intptr_t)setJSDOMWindowTextMetricsConstructor },
     { "Event", DontDelete, (intptr_t)jsDOMWindowEventConstructor, (intptr_t)setJSDOMWindowEventConstructor },
@@ -412,6 +453,8 @@ static const HashTableValue JSDOMWindowTableValues[227] =
     { "EventException", DontDelete, (intptr_t)jsDOMWindowEventExceptionConstructor, (intptr_t)setJSDOMWindowEventExceptionConstructor },
     { "WebKitCSSKeyframeRule", DontDelete, (intptr_t)jsDOMWindowWebKitCSSKeyframeRuleConstructor, (intptr_t)setJSDOMWindowWebKitCSSKeyframeRuleConstructor },
     { "WebKitCSSKeyframesRule", DontDelete, (intptr_t)jsDOMWindowWebKitCSSKeyframesRuleConstructor, (intptr_t)setJSDOMWindowWebKitCSSKeyframesRuleConstructor },
+    { "WebKitCSSMatrix", DontDelete, (intptr_t)jsDOMWindowWebKitCSSMatrixConstructor, (intptr_t)setJSDOMWindowWebKitCSSMatrixConstructor },
+    { "WebKitPoint", DontDelete, (intptr_t)jsDOMWindowWebKitPointConstructor, (intptr_t)setJSDOMWindowWebKitPointConstructor },
     { "Clipboard", DontDelete, (intptr_t)jsDOMWindowClipboardConstructor, (intptr_t)setJSDOMWindowClipboardConstructor },
     { "File", DontDelete, (intptr_t)jsDOMWindowFileConstructor, (intptr_t)setJSDOMWindowFileConstructor },
     { "FileList", DontDelete, (intptr_t)jsDOMWindowFileListConstructor, (intptr_t)setJSDOMWindowFileListConstructor },
@@ -421,15 +464,22 @@ static const HashTableValue JSDOMWindowTableValues[227] =
     { "XMLDocument", DontDelete, (intptr_t)jsDOMWindowXMLDocumentConstructor, (intptr_t)setJSDOMWindowXMLDocumentConstructor },
     { "DOMParser", DontDelete, (intptr_t)jsDOMWindowDOMParserConstructor, (intptr_t)setJSDOMWindowDOMParserConstructor },
     { "XMLSerializer", DontDelete, (intptr_t)jsDOMWindowXMLSerializerConstructor, (intptr_t)setJSDOMWindowXMLSerializerConstructor },
+    { "XMLHttpRequest", DontDelete, (intptr_t)jsDOMWindowXMLHttpRequestConstructor, (intptr_t)setJSDOMWindowXMLHttpRequestConstructor },
     { "XMLHttpRequestUpload", DontDelete, (intptr_t)jsDOMWindowXMLHttpRequestUploadConstructor, (intptr_t)setJSDOMWindowXMLHttpRequestUploadConstructor },
     { "XMLHttpRequestException", DontDelete, (intptr_t)jsDOMWindowXMLHttpRequestExceptionConstructor, (intptr_t)setJSDOMWindowXMLHttpRequestExceptionConstructor },
+    { "Worker", DontDelete, (intptr_t)jsDOMWindowWorkerConstructor, (intptr_t)setJSDOMWindowWorkerConstructor },
     { "Plugin", DontDelete, (intptr_t)jsDOMWindowPluginConstructor, (intptr_t)setJSDOMWindowPluginConstructor },
     { "PluginArray", DontDelete, (intptr_t)jsDOMWindowPluginArrayConstructor, (intptr_t)setJSDOMWindowPluginArrayConstructor },
     { "MimeType", DontDelete, (intptr_t)jsDOMWindowMimeTypeConstructor, (intptr_t)setJSDOMWindowMimeTypeConstructor },
     { "MimeTypeArray", DontDelete, (intptr_t)jsDOMWindowMimeTypeArrayConstructor, (intptr_t)setJSDOMWindowMimeTypeArrayConstructor },
+    { "ClientRect", DontDelete, (intptr_t)jsDOMWindowClientRectConstructor, (intptr_t)setJSDOMWindowClientRectConstructor },
+    { "ClientRectList", DontDelete, (intptr_t)jsDOMWindowClientRectListConstructor, (intptr_t)setJSDOMWindowClientRectListConstructor },
     { "Storage", DontDelete, (intptr_t)jsDOMWindowStorageConstructor, (intptr_t)setJSDOMWindowStorageConstructor },
     { "StorageEvent", DontDelete, (intptr_t)jsDOMWindowStorageEventConstructor, (intptr_t)setJSDOMWindowStorageEventConstructor },
 #if ENABLE(VIDEO)
+    { "Audio", DontDelete, (intptr_t)jsDOMWindowAudioConstructor, (intptr_t)setJSDOMWindowAudioConstructor },
+#endif
+#if ENABLE(VIDEO)
     { "HTMLAudioElement", DontDelete, (intptr_t)jsDOMWindowHTMLAudioElementConstructor, (intptr_t)setJSDOMWindowHTMLAudioElementConstructor },
 #endif
 #if ENABLE(VIDEO)
@@ -465,12 +515,12 @@ static const HashTable JSDOMWindowTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 32767, JSDOMWindowTableValues, 0 };
 #else
-    { 553, 511, JSDOMWindowTableValues, 0 };
+    { 1062, 1023, JSDOMWindowTableValues, 0 };
 #endif
 
 /* Hash table for prototype */
 
-static const HashTableValue JSDOMWindowPrototypeTableValues[30] =
+static const HashTableValue JSDOMWindowPrototypeTableValues[37] =
 {
     { "getSelection", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionGetSelection, (intptr_t)0 },
     { "focus", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionFocus, (intptr_t)0 },
@@ -478,6 +528,8 @@ static const HashTableValue JSDOMWindowPrototypeTableValues[30] =
     { "close", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionClose, (intptr_t)0 },
     { "print", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionPrint, (intptr_t)0 },
     { "stop", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionStop, (intptr_t)0 },
+    { "open", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionOpen, (intptr_t)3 },
+    { "showModalDialog", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionShowModalDialog, (intptr_t)3 },
     { "alert", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionAlert, (intptr_t)1 },
     { "confirm", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionConfirm, (intptr_t)1 },
     { "prompt", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionPrompt, (intptr_t)2 },
@@ -491,6 +543,8 @@ static const HashTableValue JSDOMWindowPrototypeTableValues[30] =
     { "resizeTo", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionResizeTo, (intptr_t)2 },
     { "getComputedStyle", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionGetComputedStyle, (intptr_t)2 },
     { "getMatchedCSSRules", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionGetMatchedCSSRules, (intptr_t)3 },
+    { "webkitConvertPointFromPageToNode", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionWebkitConvertPointFromPageToNode, (intptr_t)2 },
+    { "webkitConvertPointFromNodeToPage", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionWebkitConvertPointFromNodeToPage, (intptr_t)2 },
     { "openDatabase", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionOpenDatabase, (intptr_t)4 },
     { "postMessage", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionPostMessage, (intptr_t)3 },
     { "setTimeout", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionSetTimeout, (intptr_t)2 },
@@ -501,14 +555,17 @@ static const HashTableValue JSDOMWindowPrototypeTableValues[30] =
     { "btoa", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionBtoa, (intptr_t)1 },
     { "addEventListener", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionAddEventListener, (intptr_t)3 },
     { "removeEventListener", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionRemoveEventListener, (intptr_t)3 },
+    { "dispatchEvent", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionDispatchEvent, (intptr_t)1 },
+    { "captureEvents", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionCaptureEvents, (intptr_t)0 },
+    { "releaseEvents", DontDelete|Function, (intptr_t)jsDOMWindowPrototypeFunctionReleaseEvents, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static const HashTable JSDOMWindowPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 511, JSDOMWindowPrototypeTableValues, 0 };
+    { 1023, JSDOMWindowPrototypeTableValues, 0 };
 #else
-    { 69, 63, JSDOMWindowPrototypeTableValues, 0 };
+    { 134, 127, JSDOMWindowPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSDOMWindowPrototype::s_info = { "DOMWindowPrototype", 0, &JSDOMWindowPrototypeTable, 0 };
@@ -530,98 +587,117 @@ JSDOMWindow::JSDOMWindow(PassRefPtr<Structure> structure, PassRefPtr<DOMWindow>
 {
 }
 
-bool JSDOMWindow::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+JSDOMWindow::~JSDOMWindow()
 {
-    if (customGetOwnPropertySlot(exec, propertyName, slot))
-        return true;
-    return getStaticValueSlot<JSDOMWindow, Base>(exec, &JSDOMWindowTable, this, propertyName, slot);
+    invalidateEventListeners(impl()->eventListeners());
 }
 
-JSValuePtr jsDOMWindowScreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->screen()));
 }
 
-JSValuePtr jsDOMWindowHistory(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHistory(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
-    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    return toJS(exec, WTF::getPtr(imp->history()));
+    return static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->history(exec);
 }
 
-JSValuePtr jsDOMWindowLocationbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowLocationbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->locationbar()));
 }
 
-JSValuePtr jsDOMWindowMenubar(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMenubar(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->menubar()));
 }
 
-JSValuePtr jsDOMWindowPersonalbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowPersonalbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->personalbar()));
 }
 
-JSValuePtr jsDOMWindowScrollbars(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScrollbars(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->scrollbars()));
 }
 
-JSValuePtr jsDOMWindowStatusbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowStatusbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->statusbar()));
 }
 
-JSValuePtr jsDOMWindowToolbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowToolbar(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->toolbar()));
 }
 
-JSValuePtr jsDOMWindowNavigator(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowNavigator(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->navigator()));
 }
 
-JSValuePtr jsDOMWindowClientInformation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowClientInformation(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->clientInformation()));
 }
 
-JSValuePtr jsDOMWindowLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
-    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    return toJS(exec, WTF::getPtr(imp->location()));
+    return static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->location(exec);
+}
+
+JSValue jsDOMWindowEvent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    return static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->event(exec);
 }
 
-JSValuePtr jsDOMWindowFrameElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCrypto(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    return static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->crypto(exec);
+}
+
+JSValue jsDOMWindowFrameElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
@@ -629,2163 +705,3272 @@ JSValuePtr jsDOMWindowFrameElement(ExecState* exec, const Identifier&, const Pro
     return checkNodeSecurity(exec, imp->frameElement()) ? toJS(exec, WTF::getPtr(imp->frameElement())) : jsUndefined();
 }
 
-JSValuePtr jsDOMWindowOffscreenBuffering(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOffscreenBuffering(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->offscreenBuffering());
 }
 
-JSValuePtr jsDOMWindowOuterHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOuterHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->outerHeight());
 }
 
-JSValuePtr jsDOMWindowOuterWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOuterWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->outerWidth());
 }
 
-JSValuePtr jsDOMWindowInnerHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowInnerHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->innerHeight());
 }
 
-JSValuePtr jsDOMWindowInnerWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowInnerWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->innerWidth());
 }
 
-JSValuePtr jsDOMWindowScreenX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScreenX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->screenX());
 }
 
-JSValuePtr jsDOMWindowScreenY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScreenY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->screenY());
 }
 
-JSValuePtr jsDOMWindowScreenLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScreenLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->screenLeft());
 }
 
-JSValuePtr jsDOMWindowScreenTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScreenTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->screenTop());
 }
 
-JSValuePtr jsDOMWindowScrollX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScrollX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->scrollX());
 }
 
-JSValuePtr jsDOMWindowScrollY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowScrollY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->scrollY());
 }
 
-JSValuePtr jsDOMWindowPageXOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowPageXOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->pageXOffset());
 }
 
-JSValuePtr jsDOMWindowPageYOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowPageYOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->pageYOffset());
 }
 
-JSValuePtr jsDOMWindowClosed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowClosed(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->closed());
 }
 
-JSValuePtr jsDOMWindowLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsDOMWindowName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsDOMWindowStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->status());
 }
 
-JSValuePtr jsDOMWindowDefaultStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDefaultStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->defaultStatus());
 }
 
-JSValuePtr jsDOMWindowDefaultstatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDefaultstatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->defaultstatus());
 }
 
-JSValuePtr jsDOMWindowSelf(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSelf(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->self()));
 }
 
-JSValuePtr jsDOMWindowWindow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWindow(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->window()));
 }
 
-JSValuePtr jsDOMWindowFrames(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowFrames(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->frames()));
 }
 
-JSValuePtr jsDOMWindowOpener(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOpener(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->opener()));
 }
 
-JSValuePtr jsDOMWindowParent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowParent(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->parent()));
 }
 
-JSValuePtr jsDOMWindowTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->top()));
 }
 
-JSValuePtr jsDOMWindowDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->document()));
 }
 
-JSValuePtr jsDOMWindowDevicePixelRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDevicePixelRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->devicePixelRatio());
 }
 
-JSValuePtr jsDOMWindowApplicationCache(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowApplicationCache(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->applicationCache()));
 }
 
-JSValuePtr jsDOMWindowSessionStorage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSessionStorage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->sessionStorage()));
 }
 
-JSValuePtr jsDOMWindowLocalStorage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowLocalStorage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->localStorage()));
 }
 
-JSValuePtr jsDOMWindowConsole(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowConsole(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->console()));
 }
 
-JSValuePtr jsDOMWindowOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onabort()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnbeforeunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onbeforeunload()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnblur(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onblur()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOncanplay(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->oncanplay()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOncanplaythrough(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->oncanplaythrough()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onchange()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onclick()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOncontextmenu(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->oncontextmenu()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOndblclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondblclick()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOndrag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondrag()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOndragend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragend()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOndragenter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragenter()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOndragleave(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragleave()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOndragover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragover()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOndragstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onabort())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ondragstart()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnblur(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOndrop(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onblur())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ondrop()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOndurationchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onchange())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ondurationchange()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnemptied(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onclick())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onemptied()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOndblclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnended(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondblclick())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onended()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onerror())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onerror()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnfocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnfocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onfocus())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onfocus()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnkeydown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOninput(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onkeydown())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->oninput()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnkeypress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnkeydown(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onkeypress())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onkeydown()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnkeyup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnkeypress(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onkeyup())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onkeypress()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnkeyup(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onload())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onkeyup()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnmousedown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmousedown())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onload()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnmousemove(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnloadeddata(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmousemove())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onloadeddata()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnmouseout(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnloadedmetadata(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmouseout())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onloadedmetadata()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnmouseover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnloadstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmouseover())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onloadstart()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnmouseup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmouseup())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmessage()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnmousewheel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnmousedown(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmousewheel())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmousedown()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnreset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnmousemove(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onreset())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmousemove()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnresize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnmouseout(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onresize())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmouseout()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnscroll(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnmouseover(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onscroll())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmouseover()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnsearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnmouseup(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onsearch())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmouseup()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnselect(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnmousewheel(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onselect())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmousewheel()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnsubmit(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnoffline(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onsubmit())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onoffline()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnonline(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onunload())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ononline()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnbeforeunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnpause(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onbeforeunload())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onpause()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnwebkitanimationstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnplay(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onwebkitanimationstart())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onplay()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnwebkitanimationiteration(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnplaying(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onwebkitanimationiteration())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onplaying()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnwebkitanimationend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnprogress(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onwebkitanimationend())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onprogress()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowOnwebkittransitionend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnratechange(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onwebkittransitionend())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onratechange()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsDOMWindowStyleSheetConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOnresize(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onresize()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnscroll(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onscroll()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnseeked(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onseeked()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnseeking(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onseeking()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnselect(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onselect()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnstalled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onstalled()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnstorage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onstorage()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnsubmit(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onsubmit()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnsuspend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onsuspend()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOntimeupdate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ontimeupdate()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onunload()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnvolumechange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onvolumechange()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnwaiting(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onwaiting()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnreset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onreset()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnsearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onsearch()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnwebkitanimationend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onwebkitanimationend()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnwebkitanimationiteration(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onwebkitanimationiteration()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnwebkitanimationstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onwebkitanimationstart()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowOnwebkittransitionend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onwebkittransitionend()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDOMWindowStyleSheetConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSStyleSheet::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSStyleSheetConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSStyleSheetConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSStyleSheet::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSValue::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSPrimitiveValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSPrimitiveValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSPrimitiveValue::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSValueListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSValueListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSValueList::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowWebKitCSSTransformValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitCSSTransformValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSWebKitCSSTransformValue::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSRule::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSCharsetRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSCharsetRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSCharsetRule::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSFontFaceRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSFontFaceRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSFontFaceRule::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSImportRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSImportRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSImportRule::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSMediaRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSMediaRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSMediaRule::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSPageRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSPageRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSPageRule::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSStyleRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSStyleRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSStyleRule::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSVariablesRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSVariablesRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSVariablesRule::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSVariablesDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSVariablesDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSVariablesDeclaration::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSStyleDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSStyleDeclarationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSStyleDeclaration::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowMediaListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMediaListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSMediaList::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCounterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCounterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCounter::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCSSRuleListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCSSRuleListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCSSRuleList::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowRectConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowRectConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSRect::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowStyleSheetListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowStyleSheetListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSStyleSheetList::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowDOMExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDOMExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSDOMCoreException::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowDOMStringListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
-        return jsUndefined();
-    return JSDOMStringList::getConstructor(exec);
-}
-
-JSValuePtr jsDOMWindowDOMImplementationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDOMImplementationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSDOMImplementation::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowDocumentFragmentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDocumentFragmentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSDocumentFragment::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSDocument::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowNodeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowNodeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSNode::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowNodeListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowNodeListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSNodeList::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowNamedNodeMapConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowNamedNodeMapConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSNamedNodeMap::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCharacterDataConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCharacterDataConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCharacterData::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowAttrConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowAttrConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSAttr::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowTextConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowTextConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSText::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCommentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCommentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSComment::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCDATASectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowCDATASectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCDATASection::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowDocumentTypeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDocumentTypeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSDocumentType::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowNotationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowNotationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSNotation::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowEntityConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowEntityConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSEntity::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowEntityReferenceConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowEntityReferenceConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSEntityReference::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowProcessingInstructionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowProcessingInstructionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSProcessingInstruction::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLDocument::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLAnchorElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLAnchorElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLAnchorElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLAppletElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLAppletElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLAppletElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLAreaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLAreaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLAreaElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLBRElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLBRElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLBRElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLBaseElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLBaseElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLBaseElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLBaseFontElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLBaseFontElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLBaseFontElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLBlockquoteElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLBlockquoteElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLBlockquoteElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLBodyElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLBodyElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLBodyElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLButtonElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLButtonElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLButtonElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLCanvasElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLCanvasElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLCanvasElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLDListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLDataGridElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(slot);
+    return JSHTMLDataGridElement::getConstructor(exec);
+}
+
+JSValue jsDOMWindowHTMLDataGridColElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
+    return JSHTMLDataGridColElement::getConstructor(exec);
+}
+
+JSValue jsDOMWindowHTMLDListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLDListElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLDirectoryElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLDirectoryElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLDirectoryElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLDivElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLDivElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLDivElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLEmbedElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLEmbedElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLEmbedElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLFieldSetElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLFieldSetElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLFieldSetElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLFontElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLFontElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLFontElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLFormElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLFormElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLFormElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLFrameElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLFrameElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLFrameElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLFrameSetElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLFrameSetElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLFrameSetElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLHRElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLHRElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLHRElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLHeadElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLHeadElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLHeadElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLHeadingElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLHeadingElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLHeadingElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLHtmlElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLHtmlElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLHtmlElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLIFrameElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLIFrameElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLIFrameElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLImageElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLImageElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLImageElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLInputElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLInputElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLInputElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLIsIndexElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLIsIndexElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLIsIndexElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLLIElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLLIElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLLIElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLLabelElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLLabelElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLLabelElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLLegendElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLLegendElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLLegendElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLLinkElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLLinkElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLLinkElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLMapElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLMapElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLMapElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLMarqueeElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLMarqueeElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLMarqueeElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLMenuElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLMenuElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLMenuElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLMetaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLMetaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLMetaElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLModElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLModElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLModElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLOListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLOListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLOListElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLObjectElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLObjectElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLObjectElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLOptGroupElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLOptGroupElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLOptGroupElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLOptionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLOptionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLOptionElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLParagraphElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLParagraphElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLParagraphElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLParamElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLParamElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLParamElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLPreElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLPreElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLPreElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLQuoteElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLQuoteElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLQuoteElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLScriptElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLScriptElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLScriptElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLSelectElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLSelectElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLSelectElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLStyleElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLStyleElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLStyleElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLTableCaptionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableCaptionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLTableCaptionElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLTableCellElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableCellElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLTableCellElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLTableColElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableColElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLTableColElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLTableElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLTableElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLTableRowElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableRowElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLTableRowElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLTableSectionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTableSectionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLTableSectionElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLTextAreaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTextAreaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLTextAreaElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLTitleElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLTitleElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLTitleElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLUListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLUListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLUListElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowHTMLCollectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLCollectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLCollection::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowCanvasRenderingContext2DConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowImageConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    return static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->image(exec);
+}
+
+JSValue jsDOMWindowOptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    return static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->option(exec);
+}
+
+JSValue jsDOMWindowCanvasRenderingContext2DConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSCanvasRenderingContext2D::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowTextMetricsConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowTextMetricsConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSTextMetrics::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowKeyboardEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowKeyboardEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSKeyboardEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowMouseEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMouseEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSMouseEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowMutationEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMutationEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSMutationEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowOverflowEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowOverflowEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSOverflowEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowProgressEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowProgressEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSProgressEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowTextEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowTextEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSTextEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowUIEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowUIEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSUIEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowWebKitAnimationEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitAnimationEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSWebKitAnimationEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowWebKitTransitionEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitTransitionEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSWebKitTransitionEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowWheelEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWheelEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSWheelEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowMessageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMessageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSMessageEvent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowEventExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowEventExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSEventException::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowWebKitCSSKeyframeRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitCSSKeyframeRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSWebKitCSSKeyframeRule::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowWebKitCSSKeyframesRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitCSSKeyframesRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSWebKitCSSKeyframesRule::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowClipboardConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWebKitCSSMatrixConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    return static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->webKitCSSMatrix(exec);
+}
+
+JSValue jsDOMWindowWebKitPointConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    return static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->webKitPoint(exec);
+}
+
+JSValue jsDOMWindowClipboardConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSClipboard::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowFileConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowFileConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSFile::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowFileListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowFileListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSFileList::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowNodeFilterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowNodeFilterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSNodeFilter::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowRangeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowRangeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSRange::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowRangeExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowRangeExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSRangeException::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowXMLDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXMLDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSDocument::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowDOMParserConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowDOMParserConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSDOMParser::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowXMLSerializerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXMLSerializerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSXMLSerializer::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowXMLHttpRequestUploadConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXMLHttpRequestConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    return static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->xmlHttpRequest(exec);
+}
+
+JSValue jsDOMWindowXMLHttpRequestUploadConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSXMLHttpRequestUpload::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowXMLHttpRequestExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXMLHttpRequestExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSXMLHttpRequestException::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowPluginConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowWorkerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    return static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->worker(exec);
+}
+
+JSValue jsDOMWindowPluginConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSPlugin::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowPluginArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowPluginArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSPluginArray::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowMimeTypeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMimeTypeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSMimeType::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowMimeTypeArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMimeTypeArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSMimeTypeArray::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowStorageConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowClientRectConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
+    return JSClientRect::getConstructor(exec);
+}
+
+JSValue jsDOMWindowClientRectListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(slot);
+    return JSClientRectList::getConstructor(exec);
+}
+
+JSValue jsDOMWindowStorageConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSStorage::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowStorageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowStorageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSStorageEvent::getConstructor(exec);
 }
 
 #if ENABLE(VIDEO)
-JSValuePtr jsDOMWindowHTMLAudioElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowAudioConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
+        return jsUndefined();
+    return static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->audio(exec);
+}
+#endif
+
+#if ENABLE(VIDEO)
+JSValue jsDOMWindowHTMLAudioElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLAudioElement::getConstructor(exec);
 }
 #endif
 
 #if ENABLE(VIDEO)
-JSValuePtr jsDOMWindowHTMLMediaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLMediaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLMediaElement::getConstructor(exec);
 }
 #endif
 
 #if ENABLE(VIDEO)
-JSValuePtr jsDOMWindowHTMLVideoElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowHTMLVideoElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSHTMLVideoElement::getConstructor(exec);
 }
 #endif
 
 #if ENABLE(VIDEO)
-JSValuePtr jsDOMWindowMediaErrorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowMediaErrorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSMediaError::getConstructor(exec);
 }
 #endif
 
-JSValuePtr jsDOMWindowXPathEvaluatorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXPathEvaluatorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSXPathEvaluator::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowXPathResultConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXPathResultConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSXPathResult::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowXPathExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowXPathExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSXPathException::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGAngleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGAngleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGAngle::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGColorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGColorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGColor::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGException::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGGradientElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGGradientElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGGradientElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGLengthConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGLengthConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGLength::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGMarkerElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGMarkerElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGMarkerElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGPaintConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGPaintConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGPaint::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGPathSegConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGPathSegConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGPathSeg::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGPreserveAspectRatioConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGPreserveAspectRatioConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGPreserveAspectRatio::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGRenderingIntentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGRenderingIntentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGRenderingIntent::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGTextContentElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGTextContentElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGTextContentElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGTextPathElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGTextPathElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGTextPathElement::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGTransformConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGTransformConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGTransform::getConstructor(exec);
 }
 
-JSValuePtr jsDOMWindowSVGUnitTypesConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDOMWindowSVGUnitTypesConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     if (!static_cast<JSDOMWindow*>(asObject(slot.slotBase()))->allowsAccessFrom(exec))
         return jsUndefined();
+    UNUSED_PARAM(slot);
     return JSSVGUnitTypes::getConstructor(exec);
 }
 
-void JSDOMWindow::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
-{
-    if (customPut(exec, propertyName, value, slot))
-        return;
-    lookupPut<JSDOMWindow, Base>(exec, propertyName, value, &JSDOMWindowTable, this, slot);
-}
-
-void setJSDOMWindowLocationbar(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowLocationbar(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "locationbar"), value);
 }
 
-void setJSDOMWindowMenubar(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowMenubar(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "menubar"), value);
 }
 
-void setJSDOMWindowPersonalbar(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowPersonalbar(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "personalbar"), value);
 }
 
-void setJSDOMWindowScrollbars(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowScrollbars(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "scrollbars"), value);
 }
 
-void setJSDOMWindowStatusbar(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowStatusbar(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "statusbar"), value);
 }
 
-void setJSDOMWindowToolbar(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowToolbar(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "toolbar"), value);
 }
 
-void setJSDOMWindowNavigator(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowNavigator(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "navigator"), value);
 }
 
-void setJSDOMWindowClientInformation(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowClientInformation(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "clientInformation"), value);
 }
 
-void setJSDOMWindowLocation(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowLocation(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSDOMWindow*>(thisObject)->setLocation(exec, value);
 }
 
-void setJSDOMWindowOffscreenBuffering(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowEvent(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in object
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "event"), value);
+}
+
+void setJSDOMWindowOffscreenBuffering(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "offscreenBuffering"), value);
 }
 
-void setJSDOMWindowOuterHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOuterHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "outerHeight"), value);
 }
 
-void setJSDOMWindowOuterWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOuterWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "outerWidth"), value);
 }
 
-void setJSDOMWindowInnerHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowInnerHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "innerHeight"), value);
 }
 
-void setJSDOMWindowInnerWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowInnerWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "innerWidth"), value);
 }
 
-void setJSDOMWindowScreenX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowScreenX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "screenX"), value);
 }
 
-void setJSDOMWindowScreenY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowScreenY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "screenY"), value);
 }
 
-void setJSDOMWindowScreenLeft(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowScreenLeft(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "screenLeft"), value);
 }
 
-void setJSDOMWindowScreenTop(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowScreenTop(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "screenTop"), value);
 }
 
-void setJSDOMWindowScrollX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowScrollX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "scrollX"), value);
 }
 
-void setJSDOMWindowScrollY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowScrollY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "scrollY"), value);
 }
 
-void setJSDOMWindowLength(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowLength(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "length"), value);
 }
 
-void setJSDOMWindowName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    imp->setName(value->toString(exec));
+    imp->setName(value.toString(exec));
 }
 
-void setJSDOMWindowStatus(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowStatus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    imp->setStatus(value->toString(exec));
+    imp->setStatus(value.toString(exec));
 }
 
-void setJSDOMWindowDefaultStatus(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowDefaultStatus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    imp->setDefaultStatus(value->toString(exec));
+    imp->setDefaultStatus(value.toString(exec));
 }
 
-void setJSDOMWindowDefaultstatus(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowDefaultstatus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
-    imp->setDefaultstatus(value->toString(exec));
+    imp->setDefaultstatus(value.toString(exec));
 }
 
-void setJSDOMWindowSelf(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSelf(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "self"), value);
 }
 
-void setJSDOMWindowFrames(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowFrames(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "frames"), value);
 }
 
-void setJSDOMWindowOpener(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOpener(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "opener"), value);
 }
 
-void setJSDOMWindowParent(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowParent(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "parent"), value);
 }
 
-void setJSDOMWindowTop(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowTop(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "top"), value);
 }
 
-void setJSDOMWindowDevicePixelRatio(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowDevicePixelRatio(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "devicePixelRatio"), value);
 }
 
-void setJSDOMWindowConsole(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowConsole(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    // Shadowing a built-in object
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "console"), value);
 }
 
-void setJSDOMWindowOnabort(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnabort(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnabort(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnbeforeunload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnabort(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnbeforeunload(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnblur(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnblur(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnblur(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnblur(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnchange(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOncanplay(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnchange(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOncanplay(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnclick(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOncanplaythrough(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnclick(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOncanplaythrough(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOndblclick(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnchange(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOndblclick(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnchange(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnerror(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnclick(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnerror(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnclick(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnfocus(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOncontextmenu(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnfocus(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOncontextmenu(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnkeydown(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOndblclick(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnkeydown(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndblclick(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnkeypress(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOndrag(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnkeypress(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndrag(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnkeyup(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOndragend(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnkeyup(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndragend(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnload(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOndragenter(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnload(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndragenter(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnmousedown(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOndragleave(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmousedown(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndragleave(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnmousemove(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOndragover(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmousemove(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndragover(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnmouseout(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOndragstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmouseout(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndragstart(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnmouseover(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOndrop(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmouseover(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndrop(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnmouseup(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOndurationchange(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmouseup(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndurationchange(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnmousewheel(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnemptied(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnmousewheel(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnemptied(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnreset(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnended(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnreset(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnended(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnresize(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnresize(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnscroll(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnfocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnscroll(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnfocus(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnsearch(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOninput(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnsearch(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOninput(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnselect(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnkeydown(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnselect(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnkeydown(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnsubmit(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnkeypress(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnsubmit(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnkeypress(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnunload(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnkeyup(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnunload(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnkeyup(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnbeforeunload(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnbeforeunload(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnload(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnwebkitanimationstart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnloadeddata(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnwebkitanimationstart(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnloadeddata(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnwebkitanimationiteration(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnloadedmetadata(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnwebkitanimationiteration(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnloadedmetadata(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnwebkitanimationend(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnloadstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnwebkitanimationend(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnloadstart(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowOnwebkittransitionend(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
+    UNUSED_PARAM(exec);
     DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
-    imp->setOnwebkittransitionend(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSDOMWindowStyleSheetConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOnmousedown(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnmousedown(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnmousemove(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnmousemove(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnmouseout(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnmouseout(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnmouseover(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnmouseover(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnmouseup(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnmouseup(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnmousewheel(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnmousewheel(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnoffline(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnoffline(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnonline(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnonline(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnpause(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnpause(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnplay(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnplay(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnplaying(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnplaying(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnprogress(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnprogress(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnratechange(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnratechange(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnresize(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnresize(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnscroll(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnscroll(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnseeked(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnseeked(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnseeking(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnseeking(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnselect(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnselect(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnstalled(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnstalled(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnstorage(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnstorage(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnsubmit(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnsubmit(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnsuspend(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnsuspend(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOntimeupdate(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOntimeupdate(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnunload(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnunload(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnvolumechange(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnvolumechange(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnwaiting(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnwaiting(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnreset(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnreset(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnsearch(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnsearch(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnwebkitanimationend(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnwebkitanimationend(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnwebkitanimationiteration(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnwebkitanimationiteration(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnwebkitanimationstart(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnwebkitanimationstart(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowOnwebkittransitionend(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    UNUSED_PARAM(exec);
+    DOMWindow* imp = static_cast<DOMWindow*>(static_cast<JSDOMWindow*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSDOMWindow*>(thisObject);
+    imp->setOnwebkittransitionend(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDOMWindowStyleSheetConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2793,7 +3978,7 @@ void setJSDOMWindowStyleSheetConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "StyleSheet"), value);
 }
 
-void setJSDOMWindowCSSStyleSheetConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSStyleSheetConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2801,7 +3986,7 @@ void setJSDOMWindowCSSStyleSheetConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSStyleSheet"), value);
 }
 
-void setJSDOMWindowCSSValueConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSValueConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2809,7 +3994,7 @@ void setJSDOMWindowCSSValueConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSValue"), value);
 }
 
-void setJSDOMWindowCSSPrimitiveValueConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSPrimitiveValueConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2817,7 +4002,7 @@ void setJSDOMWindowCSSPrimitiveValueConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSPrimitiveValue"), value);
 }
 
-void setJSDOMWindowCSSValueListConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSValueListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2825,7 +4010,7 @@ void setJSDOMWindowCSSValueListConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSValueList"), value);
 }
 
-void setJSDOMWindowWebKitCSSTransformValueConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowWebKitCSSTransformValueConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2833,7 +4018,7 @@ void setJSDOMWindowWebKitCSSTransformValueConstructor(ExecState* exec, JSObject*
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebKitCSSTransformValue"), value);
 }
 
-void setJSDOMWindowCSSRuleConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSRuleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2841,7 +4026,7 @@ void setJSDOMWindowCSSRuleConstructor(ExecState* exec, JSObject* thisObject, JSV
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSRule"), value);
 }
 
-void setJSDOMWindowCSSCharsetRuleConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSCharsetRuleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2849,7 +4034,7 @@ void setJSDOMWindowCSSCharsetRuleConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSCharsetRule"), value);
 }
 
-void setJSDOMWindowCSSFontFaceRuleConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSFontFaceRuleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2857,7 +4042,7 @@ void setJSDOMWindowCSSFontFaceRuleConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSFontFaceRule"), value);
 }
 
-void setJSDOMWindowCSSImportRuleConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSImportRuleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2865,7 +4050,7 @@ void setJSDOMWindowCSSImportRuleConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSImportRule"), value);
 }
 
-void setJSDOMWindowCSSMediaRuleConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSMediaRuleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2873,7 +4058,7 @@ void setJSDOMWindowCSSMediaRuleConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSMediaRule"), value);
 }
 
-void setJSDOMWindowCSSPageRuleConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSPageRuleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2881,7 +4066,7 @@ void setJSDOMWindowCSSPageRuleConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSPageRule"), value);
 }
 
-void setJSDOMWindowCSSStyleRuleConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSStyleRuleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2889,7 +4074,7 @@ void setJSDOMWindowCSSStyleRuleConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSStyleRule"), value);
 }
 
-void setJSDOMWindowCSSVariablesRuleConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSVariablesRuleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2897,7 +4082,7 @@ void setJSDOMWindowCSSVariablesRuleConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSVariablesRule"), value);
 }
 
-void setJSDOMWindowCSSVariablesDeclarationConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSVariablesDeclarationConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2905,7 +4090,7 @@ void setJSDOMWindowCSSVariablesDeclarationConstructor(ExecState* exec, JSObject*
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSVariablesDeclaration"), value);
 }
 
-void setJSDOMWindowCSSStyleDeclarationConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSStyleDeclarationConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2913,7 +4098,7 @@ void setJSDOMWindowCSSStyleDeclarationConstructor(ExecState* exec, JSObject* thi
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSStyleDeclaration"), value);
 }
 
-void setJSDOMWindowMediaListConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowMediaListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2921,7 +4106,7 @@ void setJSDOMWindowMediaListConstructor(ExecState* exec, JSObject* thisObject, J
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "MediaList"), value);
 }
 
-void setJSDOMWindowCounterConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCounterConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2929,7 +4114,7 @@ void setJSDOMWindowCounterConstructor(ExecState* exec, JSObject* thisObject, JSV
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Counter"), value);
 }
 
-void setJSDOMWindowCSSRuleListConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCSSRuleListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2937,7 +4122,7 @@ void setJSDOMWindowCSSRuleListConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CSSRuleList"), value);
 }
 
-void setJSDOMWindowRectConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowRectConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2945,7 +4130,7 @@ void setJSDOMWindowRectConstructor(ExecState* exec, JSObject* thisObject, JSValu
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Rect"), value);
 }
 
-void setJSDOMWindowStyleSheetListConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowStyleSheetListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2953,7 +4138,7 @@ void setJSDOMWindowStyleSheetListConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "StyleSheetList"), value);
 }
 
-void setJSDOMWindowDOMExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowDOMExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2961,15 +4146,7 @@ void setJSDOMWindowDOMExceptionConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "DOMException"), value);
 }
 
-void setJSDOMWindowDOMStringListConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
-        return;
-    // Shadowing a built-in constructor
-    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "DOMStringList"), value);
-}
-
-void setJSDOMWindowDOMImplementationConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowDOMImplementationConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2977,7 +4154,7 @@ void setJSDOMWindowDOMImplementationConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "DOMImplementation"), value);
 }
 
-void setJSDOMWindowDocumentFragmentConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowDocumentFragmentConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2985,7 +4162,7 @@ void setJSDOMWindowDocumentFragmentConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "DocumentFragment"), value);
 }
 
-void setJSDOMWindowDocumentConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowDocumentConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -2993,7 +4170,7 @@ void setJSDOMWindowDocumentConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Document"), value);
 }
 
-void setJSDOMWindowNodeConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowNodeConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3001,7 +4178,7 @@ void setJSDOMWindowNodeConstructor(ExecState* exec, JSObject* thisObject, JSValu
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Node"), value);
 }
 
-void setJSDOMWindowNodeListConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowNodeListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3009,7 +4186,7 @@ void setJSDOMWindowNodeListConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "NodeList"), value);
 }
 
-void setJSDOMWindowNamedNodeMapConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowNamedNodeMapConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3017,7 +4194,7 @@ void setJSDOMWindowNamedNodeMapConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "NamedNodeMap"), value);
 }
 
-void setJSDOMWindowCharacterDataConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCharacterDataConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3025,7 +4202,7 @@ void setJSDOMWindowCharacterDataConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CharacterData"), value);
 }
 
-void setJSDOMWindowAttrConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowAttrConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3033,7 +4210,7 @@ void setJSDOMWindowAttrConstructor(ExecState* exec, JSObject* thisObject, JSValu
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Attr"), value);
 }
 
-void setJSDOMWindowElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3041,7 +4218,7 @@ void setJSDOMWindowElementConstructor(ExecState* exec, JSObject* thisObject, JSV
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Element"), value);
 }
 
-void setJSDOMWindowTextConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowTextConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3049,7 +4226,7 @@ void setJSDOMWindowTextConstructor(ExecState* exec, JSObject* thisObject, JSValu
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Text"), value);
 }
 
-void setJSDOMWindowCommentConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCommentConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3057,7 +4234,7 @@ void setJSDOMWindowCommentConstructor(ExecState* exec, JSObject* thisObject, JSV
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Comment"), value);
 }
 
-void setJSDOMWindowCDATASectionConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowCDATASectionConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3065,7 +4242,7 @@ void setJSDOMWindowCDATASectionConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CDATASection"), value);
 }
 
-void setJSDOMWindowDocumentTypeConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowDocumentTypeConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3073,7 +4250,7 @@ void setJSDOMWindowDocumentTypeConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "DocumentType"), value);
 }
 
-void setJSDOMWindowNotationConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowNotationConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3081,7 +4258,7 @@ void setJSDOMWindowNotationConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Notation"), value);
 }
 
-void setJSDOMWindowEntityConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowEntityConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3089,7 +4266,7 @@ void setJSDOMWindowEntityConstructor(ExecState* exec, JSObject* thisObject, JSVa
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Entity"), value);
 }
 
-void setJSDOMWindowEntityReferenceConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowEntityReferenceConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3097,7 +4274,7 @@ void setJSDOMWindowEntityReferenceConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "EntityReference"), value);
 }
 
-void setJSDOMWindowProcessingInstructionConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowProcessingInstructionConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3105,7 +4282,7 @@ void setJSDOMWindowProcessingInstructionConstructor(ExecState* exec, JSObject* t
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "ProcessingInstruction"), value);
 }
 
-void setJSDOMWindowHTMLDocumentConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLDocumentConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3113,7 +4290,7 @@ void setJSDOMWindowHTMLDocumentConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLDocument"), value);
 }
 
-void setJSDOMWindowHTMLElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3121,7 +4298,7 @@ void setJSDOMWindowHTMLElementConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLElement"), value);
 }
 
-void setJSDOMWindowHTMLAnchorElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLAnchorElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3129,7 +4306,7 @@ void setJSDOMWindowHTMLAnchorElementConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLAnchorElement"), value);
 }
 
-void setJSDOMWindowHTMLAppletElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLAppletElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3137,7 +4314,7 @@ void setJSDOMWindowHTMLAppletElementConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLAppletElement"), value);
 }
 
-void setJSDOMWindowHTMLAreaElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLAreaElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3145,7 +4322,7 @@ void setJSDOMWindowHTMLAreaElementConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLAreaElement"), value);
 }
 
-void setJSDOMWindowHTMLBRElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLBRElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3153,7 +4330,7 @@ void setJSDOMWindowHTMLBRElementConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLBRElement"), value);
 }
 
-void setJSDOMWindowHTMLBaseElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLBaseElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3161,7 +4338,7 @@ void setJSDOMWindowHTMLBaseElementConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLBaseElement"), value);
 }
 
-void setJSDOMWindowHTMLBaseFontElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLBaseFontElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3169,7 +4346,7 @@ void setJSDOMWindowHTMLBaseFontElementConstructor(ExecState* exec, JSObject* thi
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLBaseFontElement"), value);
 }
 
-void setJSDOMWindowHTMLBlockquoteElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLBlockquoteElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3177,7 +4354,7 @@ void setJSDOMWindowHTMLBlockquoteElementConstructor(ExecState* exec, JSObject* t
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLBlockquoteElement"), value);
 }
 
-void setJSDOMWindowHTMLBodyElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLBodyElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3185,7 +4362,7 @@ void setJSDOMWindowHTMLBodyElementConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLBodyElement"), value);
 }
 
-void setJSDOMWindowHTMLButtonElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLButtonElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3193,7 +4370,7 @@ void setJSDOMWindowHTMLButtonElementConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLButtonElement"), value);
 }
 
-void setJSDOMWindowHTMLCanvasElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLCanvasElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3201,7 +4378,23 @@ void setJSDOMWindowHTMLCanvasElementConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLCanvasElement"), value);
 }
 
-void setJSDOMWindowHTMLDListElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLDataGridElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLDataGridElement"), value);
+}
+
+void setJSDOMWindowHTMLDataGridColElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLDataGridColElement"), value);
+}
+
+void setJSDOMWindowHTMLDListElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3209,7 +4402,7 @@ void setJSDOMWindowHTMLDListElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLDListElement"), value);
 }
 
-void setJSDOMWindowHTMLDirectoryElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLDirectoryElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3217,7 +4410,7 @@ void setJSDOMWindowHTMLDirectoryElementConstructor(ExecState* exec, JSObject* th
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLDirectoryElement"), value);
 }
 
-void setJSDOMWindowHTMLDivElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLDivElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3225,7 +4418,7 @@ void setJSDOMWindowHTMLDivElementConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLDivElement"), value);
 }
 
-void setJSDOMWindowHTMLEmbedElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLEmbedElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3233,7 +4426,7 @@ void setJSDOMWindowHTMLEmbedElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLEmbedElement"), value);
 }
 
-void setJSDOMWindowHTMLFieldSetElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLFieldSetElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3241,7 +4434,7 @@ void setJSDOMWindowHTMLFieldSetElementConstructor(ExecState* exec, JSObject* thi
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLFieldSetElement"), value);
 }
 
-void setJSDOMWindowHTMLFontElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLFontElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3249,7 +4442,7 @@ void setJSDOMWindowHTMLFontElementConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLFontElement"), value);
 }
 
-void setJSDOMWindowHTMLFormElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLFormElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3257,7 +4450,7 @@ void setJSDOMWindowHTMLFormElementConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLFormElement"), value);
 }
 
-void setJSDOMWindowHTMLFrameElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLFrameElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3265,7 +4458,7 @@ void setJSDOMWindowHTMLFrameElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLFrameElement"), value);
 }
 
-void setJSDOMWindowHTMLFrameSetElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLFrameSetElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3273,7 +4466,7 @@ void setJSDOMWindowHTMLFrameSetElementConstructor(ExecState* exec, JSObject* thi
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLFrameSetElement"), value);
 }
 
-void setJSDOMWindowHTMLHRElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLHRElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3281,7 +4474,7 @@ void setJSDOMWindowHTMLHRElementConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLHRElement"), value);
 }
 
-void setJSDOMWindowHTMLHeadElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLHeadElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3289,7 +4482,7 @@ void setJSDOMWindowHTMLHeadElementConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLHeadElement"), value);
 }
 
-void setJSDOMWindowHTMLHeadingElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLHeadingElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3297,7 +4490,7 @@ void setJSDOMWindowHTMLHeadingElementConstructor(ExecState* exec, JSObject* this
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLHeadingElement"), value);
 }
 
-void setJSDOMWindowHTMLHtmlElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLHtmlElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3305,7 +4498,7 @@ void setJSDOMWindowHTMLHtmlElementConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLHtmlElement"), value);
 }
 
-void setJSDOMWindowHTMLIFrameElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLIFrameElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3313,7 +4506,7 @@ void setJSDOMWindowHTMLIFrameElementConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLIFrameElement"), value);
 }
 
-void setJSDOMWindowHTMLImageElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLImageElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3321,7 +4514,7 @@ void setJSDOMWindowHTMLImageElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLImageElement"), value);
 }
 
-void setJSDOMWindowHTMLInputElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLInputElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3329,7 +4522,7 @@ void setJSDOMWindowHTMLInputElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLInputElement"), value);
 }
 
-void setJSDOMWindowHTMLIsIndexElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLIsIndexElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3337,7 +4530,7 @@ void setJSDOMWindowHTMLIsIndexElementConstructor(ExecState* exec, JSObject* this
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLIsIndexElement"), value);
 }
 
-void setJSDOMWindowHTMLLIElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLLIElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3345,7 +4538,7 @@ void setJSDOMWindowHTMLLIElementConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLLIElement"), value);
 }
 
-void setJSDOMWindowHTMLLabelElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLLabelElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3353,7 +4546,7 @@ void setJSDOMWindowHTMLLabelElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLLabelElement"), value);
 }
 
-void setJSDOMWindowHTMLLegendElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLLegendElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3361,7 +4554,7 @@ void setJSDOMWindowHTMLLegendElementConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLLegendElement"), value);
 }
 
-void setJSDOMWindowHTMLLinkElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLLinkElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3369,7 +4562,7 @@ void setJSDOMWindowHTMLLinkElementConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLLinkElement"), value);
 }
 
-void setJSDOMWindowHTMLMapElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLMapElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3377,7 +4570,7 @@ void setJSDOMWindowHTMLMapElementConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLMapElement"), value);
 }
 
-void setJSDOMWindowHTMLMarqueeElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLMarqueeElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3385,7 +4578,7 @@ void setJSDOMWindowHTMLMarqueeElementConstructor(ExecState* exec, JSObject* this
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLMarqueeElement"), value);
 }
 
-void setJSDOMWindowHTMLMenuElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLMenuElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3393,7 +4586,7 @@ void setJSDOMWindowHTMLMenuElementConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLMenuElement"), value);
 }
 
-void setJSDOMWindowHTMLMetaElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLMetaElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3401,7 +4594,7 @@ void setJSDOMWindowHTMLMetaElementConstructor(ExecState* exec, JSObject* thisObj
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLMetaElement"), value);
 }
 
-void setJSDOMWindowHTMLModElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLModElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3409,7 +4602,7 @@ void setJSDOMWindowHTMLModElementConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLModElement"), value);
 }
 
-void setJSDOMWindowHTMLOListElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLOListElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3417,7 +4610,7 @@ void setJSDOMWindowHTMLOListElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLOListElement"), value);
 }
 
-void setJSDOMWindowHTMLObjectElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLObjectElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3425,7 +4618,7 @@ void setJSDOMWindowHTMLObjectElementConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLObjectElement"), value);
 }
 
-void setJSDOMWindowHTMLOptGroupElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLOptGroupElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3433,7 +4626,7 @@ void setJSDOMWindowHTMLOptGroupElementConstructor(ExecState* exec, JSObject* thi
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLOptGroupElement"), value);
 }
 
-void setJSDOMWindowHTMLOptionElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLOptionElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3441,7 +4634,7 @@ void setJSDOMWindowHTMLOptionElementConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLOptionElement"), value);
 }
 
-void setJSDOMWindowHTMLParagraphElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLParagraphElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3449,7 +4642,7 @@ void setJSDOMWindowHTMLParagraphElementConstructor(ExecState* exec, JSObject* th
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLParagraphElement"), value);
 }
 
-void setJSDOMWindowHTMLParamElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLParamElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3457,7 +4650,7 @@ void setJSDOMWindowHTMLParamElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLParamElement"), value);
 }
 
-void setJSDOMWindowHTMLPreElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLPreElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3465,7 +4658,7 @@ void setJSDOMWindowHTMLPreElementConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLPreElement"), value);
 }
 
-void setJSDOMWindowHTMLQuoteElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLQuoteElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3473,7 +4666,7 @@ void setJSDOMWindowHTMLQuoteElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLQuoteElement"), value);
 }
 
-void setJSDOMWindowHTMLScriptElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLScriptElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3481,7 +4674,7 @@ void setJSDOMWindowHTMLScriptElementConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLScriptElement"), value);
 }
 
-void setJSDOMWindowHTMLSelectElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLSelectElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3489,7 +4682,7 @@ void setJSDOMWindowHTMLSelectElementConstructor(ExecState* exec, JSObject* thisO
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLSelectElement"), value);
 }
 
-void setJSDOMWindowHTMLStyleElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLStyleElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3497,7 +4690,7 @@ void setJSDOMWindowHTMLStyleElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLStyleElement"), value);
 }
 
-void setJSDOMWindowHTMLTableCaptionElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLTableCaptionElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3505,7 +4698,7 @@ void setJSDOMWindowHTMLTableCaptionElementConstructor(ExecState* exec, JSObject*
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLTableCaptionElement"), value);
 }
 
-void setJSDOMWindowHTMLTableCellElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLTableCellElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3513,7 +4706,7 @@ void setJSDOMWindowHTMLTableCellElementConstructor(ExecState* exec, JSObject* th
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLTableCellElement"), value);
 }
 
-void setJSDOMWindowHTMLTableColElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLTableColElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3521,7 +4714,7 @@ void setJSDOMWindowHTMLTableColElementConstructor(ExecState* exec, JSObject* thi
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLTableColElement"), value);
 }
 
-void setJSDOMWindowHTMLTableElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLTableElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3529,7 +4722,7 @@ void setJSDOMWindowHTMLTableElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLTableElement"), value);
 }
 
-void setJSDOMWindowHTMLTableRowElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLTableRowElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3537,7 +4730,7 @@ void setJSDOMWindowHTMLTableRowElementConstructor(ExecState* exec, JSObject* thi
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLTableRowElement"), value);
 }
 
-void setJSDOMWindowHTMLTableSectionElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLTableSectionElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3545,7 +4738,7 @@ void setJSDOMWindowHTMLTableSectionElementConstructor(ExecState* exec, JSObject*
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLTableSectionElement"), value);
 }
 
-void setJSDOMWindowHTMLTextAreaElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLTextAreaElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3553,7 +4746,7 @@ void setJSDOMWindowHTMLTextAreaElementConstructor(ExecState* exec, JSObject* thi
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLTextAreaElement"), value);
 }
 
-void setJSDOMWindowHTMLTitleElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLTitleElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3561,7 +4754,7 @@ void setJSDOMWindowHTMLTitleElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLTitleElement"), value);
 }
 
-void setJSDOMWindowHTMLUListElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLUListElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3569,7 +4762,7 @@ void setJSDOMWindowHTMLUListElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLUListElement"), value);
 }
 
-void setJSDOMWindowHTMLCollectionConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLCollectionConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3577,7 +4770,23 @@ void setJSDOMWindowHTMLCollectionConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLCollection"), value);
 }
 
-void setJSDOMWindowCanvasRenderingContext2DConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowImageConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Image"), value);
+}
+
+void setJSDOMWindowOptionConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Option"), value);
+}
+
+void setJSDOMWindowCanvasRenderingContext2DConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3585,7 +4794,7 @@ void setJSDOMWindowCanvasRenderingContext2DConstructor(ExecState* exec, JSObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "CanvasRenderingContext2D"), value);
 }
 
-void setJSDOMWindowTextMetricsConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowTextMetricsConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3593,7 +4802,7 @@ void setJSDOMWindowTextMetricsConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "TextMetrics"), value);
 }
 
-void setJSDOMWindowEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3601,7 +4810,7 @@ void setJSDOMWindowEventConstructor(ExecState* exec, JSObject* thisObject, JSVal
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Event"), value);
 }
 
-void setJSDOMWindowKeyboardEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowKeyboardEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3609,7 +4818,7 @@ void setJSDOMWindowKeyboardEventConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "KeyboardEvent"), value);
 }
 
-void setJSDOMWindowMouseEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowMouseEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3617,7 +4826,7 @@ void setJSDOMWindowMouseEventConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "MouseEvent"), value);
 }
 
-void setJSDOMWindowMutationEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowMutationEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3625,7 +4834,7 @@ void setJSDOMWindowMutationEventConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "MutationEvent"), value);
 }
 
-void setJSDOMWindowOverflowEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowOverflowEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3633,7 +4842,7 @@ void setJSDOMWindowOverflowEventConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "OverflowEvent"), value);
 }
 
-void setJSDOMWindowProgressEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowProgressEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3641,7 +4850,7 @@ void setJSDOMWindowProgressEventConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "ProgressEvent"), value);
 }
 
-void setJSDOMWindowTextEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowTextEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3649,7 +4858,7 @@ void setJSDOMWindowTextEventConstructor(ExecState* exec, JSObject* thisObject, J
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "TextEvent"), value);
 }
 
-void setJSDOMWindowUIEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowUIEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3657,7 +4866,7 @@ void setJSDOMWindowUIEventConstructor(ExecState* exec, JSObject* thisObject, JSV
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "UIEvent"), value);
 }
 
-void setJSDOMWindowWebKitAnimationEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowWebKitAnimationEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3665,7 +4874,7 @@ void setJSDOMWindowWebKitAnimationEventConstructor(ExecState* exec, JSObject* th
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebKitAnimationEvent"), value);
 }
 
-void setJSDOMWindowWebKitTransitionEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowWebKitTransitionEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3673,7 +4882,7 @@ void setJSDOMWindowWebKitTransitionEventConstructor(ExecState* exec, JSObject* t
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebKitTransitionEvent"), value);
 }
 
-void setJSDOMWindowWheelEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowWheelEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3681,7 +4890,7 @@ void setJSDOMWindowWheelEventConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WheelEvent"), value);
 }
 
-void setJSDOMWindowMessageEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowMessageEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3689,7 +4898,7 @@ void setJSDOMWindowMessageEventConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "MessageEvent"), value);
 }
 
-void setJSDOMWindowEventExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowEventExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3697,7 +4906,7 @@ void setJSDOMWindowEventExceptionConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "EventException"), value);
 }
 
-void setJSDOMWindowWebKitCSSKeyframeRuleConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowWebKitCSSKeyframeRuleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3705,7 +4914,7 @@ void setJSDOMWindowWebKitCSSKeyframeRuleConstructor(ExecState* exec, JSObject* t
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebKitCSSKeyframeRule"), value);
 }
 
-void setJSDOMWindowWebKitCSSKeyframesRuleConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowWebKitCSSKeyframesRuleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3713,7 +4922,23 @@ void setJSDOMWindowWebKitCSSKeyframesRuleConstructor(ExecState* exec, JSObject*
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebKitCSSKeyframesRule"), value);
 }
 
-void setJSDOMWindowClipboardConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowWebKitCSSMatrixConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebKitCSSMatrix"), value);
+}
+
+void setJSDOMWindowWebKitPointConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "WebKitPoint"), value);
+}
+
+void setJSDOMWindowClipboardConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3721,7 +4946,7 @@ void setJSDOMWindowClipboardConstructor(ExecState* exec, JSObject* thisObject, J
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Clipboard"), value);
 }
 
-void setJSDOMWindowFileConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowFileConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3729,7 +4954,7 @@ void setJSDOMWindowFileConstructor(ExecState* exec, JSObject* thisObject, JSValu
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "File"), value);
 }
 
-void setJSDOMWindowFileListConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowFileListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3737,7 +4962,7 @@ void setJSDOMWindowFileListConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "FileList"), value);
 }
 
-void setJSDOMWindowNodeFilterConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowNodeFilterConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3745,7 +4970,7 @@ void setJSDOMWindowNodeFilterConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "NodeFilter"), value);
 }
 
-void setJSDOMWindowRangeConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowRangeConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3753,7 +4978,7 @@ void setJSDOMWindowRangeConstructor(ExecState* exec, JSObject* thisObject, JSVal
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Range"), value);
 }
 
-void setJSDOMWindowRangeExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowRangeExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3761,7 +4986,7 @@ void setJSDOMWindowRangeExceptionConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "RangeException"), value);
 }
 
-void setJSDOMWindowXMLDocumentConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowXMLDocumentConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3769,7 +4994,7 @@ void setJSDOMWindowXMLDocumentConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "XMLDocument"), value);
 }
 
-void setJSDOMWindowDOMParserConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowDOMParserConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3777,7 +5002,7 @@ void setJSDOMWindowDOMParserConstructor(ExecState* exec, JSObject* thisObject, J
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "DOMParser"), value);
 }
 
-void setJSDOMWindowXMLSerializerConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowXMLSerializerConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3785,7 +5010,15 @@ void setJSDOMWindowXMLSerializerConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "XMLSerializer"), value);
 }
 
-void setJSDOMWindowXMLHttpRequestUploadConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowXMLHttpRequestConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "XMLHttpRequest"), value);
+}
+
+void setJSDOMWindowXMLHttpRequestUploadConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3793,7 +5026,7 @@ void setJSDOMWindowXMLHttpRequestUploadConstructor(ExecState* exec, JSObject* th
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "XMLHttpRequestUpload"), value);
 }
 
-void setJSDOMWindowXMLHttpRequestExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowXMLHttpRequestExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3801,7 +5034,15 @@ void setJSDOMWindowXMLHttpRequestExceptionConstructor(ExecState* exec, JSObject*
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "XMLHttpRequestException"), value);
 }
 
-void setJSDOMWindowPluginConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowWorkerConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Worker"), value);
+}
+
+void setJSDOMWindowPluginConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3809,7 +5050,7 @@ void setJSDOMWindowPluginConstructor(ExecState* exec, JSObject* thisObject, JSVa
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Plugin"), value);
 }
 
-void setJSDOMWindowPluginArrayConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowPluginArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3817,7 +5058,7 @@ void setJSDOMWindowPluginArrayConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "PluginArray"), value);
 }
 
-void setJSDOMWindowMimeTypeConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowMimeTypeConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3825,7 +5066,7 @@ void setJSDOMWindowMimeTypeConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "MimeType"), value);
 }
 
-void setJSDOMWindowMimeTypeArrayConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowMimeTypeArrayConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3833,7 +5074,23 @@ void setJSDOMWindowMimeTypeArrayConstructor(ExecState* exec, JSObject* thisObjec
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "MimeTypeArray"), value);
 }
 
-void setJSDOMWindowStorageConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowClientRectConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "ClientRect"), value);
+}
+
+void setJSDOMWindowClientRectListConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "ClientRectList"), value);
+}
+
+void setJSDOMWindowStorageConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3841,7 +5098,7 @@ void setJSDOMWindowStorageConstructor(ExecState* exec, JSObject* thisObject, JSV
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Storage"), value);
 }
 
-void setJSDOMWindowStorageEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowStorageEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3849,7 +5106,15 @@ void setJSDOMWindowStorageEventConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "StorageEvent"), value);
 }
 
-void setJSDOMWindowHTMLAudioElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowAudioConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
+        return;
+    // Shadowing a built-in constructor
+    static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "Audio"), value);
+}
+
+void setJSDOMWindowHTMLAudioElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3857,7 +5122,7 @@ void setJSDOMWindowHTMLAudioElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLAudioElement"), value);
 }
 
-void setJSDOMWindowHTMLMediaElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLMediaElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3865,7 +5130,7 @@ void setJSDOMWindowHTMLMediaElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLMediaElement"), value);
 }
 
-void setJSDOMWindowHTMLVideoElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowHTMLVideoElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3873,7 +5138,7 @@ void setJSDOMWindowHTMLVideoElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "HTMLVideoElement"), value);
 }
 
-void setJSDOMWindowMediaErrorConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowMediaErrorConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3881,7 +5146,7 @@ void setJSDOMWindowMediaErrorConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "MediaError"), value);
 }
 
-void setJSDOMWindowXPathEvaluatorConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowXPathEvaluatorConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3889,7 +5154,7 @@ void setJSDOMWindowXPathEvaluatorConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "XPathEvaluator"), value);
 }
 
-void setJSDOMWindowXPathResultConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowXPathResultConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3897,7 +5162,7 @@ void setJSDOMWindowXPathResultConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "XPathResult"), value);
 }
 
-void setJSDOMWindowXPathExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowXPathExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3905,7 +5170,7 @@ void setJSDOMWindowXPathExceptionConstructor(ExecState* exec, JSObject* thisObje
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "XPathException"), value);
 }
 
-void setJSDOMWindowSVGAngleConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGAngleConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3913,7 +5178,7 @@ void setJSDOMWindowSVGAngleConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGAngle"), value);
 }
 
-void setJSDOMWindowSVGColorConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGColorConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3921,7 +5186,7 @@ void setJSDOMWindowSVGColorConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGColor"), value);
 }
 
-void setJSDOMWindowSVGExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGExceptionConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3929,7 +5194,7 @@ void setJSDOMWindowSVGExceptionConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGException"), value);
 }
 
-void setJSDOMWindowSVGGradientElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGGradientElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3937,7 +5202,7 @@ void setJSDOMWindowSVGGradientElementConstructor(ExecState* exec, JSObject* this
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGGradientElement"), value);
 }
 
-void setJSDOMWindowSVGLengthConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGLengthConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3945,7 +5210,7 @@ void setJSDOMWindowSVGLengthConstructor(ExecState* exec, JSObject* thisObject, J
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGLength"), value);
 }
 
-void setJSDOMWindowSVGMarkerElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGMarkerElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3953,7 +5218,7 @@ void setJSDOMWindowSVGMarkerElementConstructor(ExecState* exec, JSObject* thisOb
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGMarkerElement"), value);
 }
 
-void setJSDOMWindowSVGPaintConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGPaintConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3961,7 +5226,7 @@ void setJSDOMWindowSVGPaintConstructor(ExecState* exec, JSObject* thisObject, JS
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPaint"), value);
 }
 
-void setJSDOMWindowSVGPathSegConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGPathSegConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3969,7 +5234,7 @@ void setJSDOMWindowSVGPathSegConstructor(ExecState* exec, JSObject* thisObject,
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPathSeg"), value);
 }
 
-void setJSDOMWindowSVGPreserveAspectRatioConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGPreserveAspectRatioConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3977,7 +5242,7 @@ void setJSDOMWindowSVGPreserveAspectRatioConstructor(ExecState* exec, JSObject*
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGPreserveAspectRatio"), value);
 }
 
-void setJSDOMWindowSVGRenderingIntentConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGRenderingIntentConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3985,7 +5250,7 @@ void setJSDOMWindowSVGRenderingIntentConstructor(ExecState* exec, JSObject* this
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGRenderingIntent"), value);
 }
 
-void setJSDOMWindowSVGTextContentElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGTextContentElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -3993,7 +5258,7 @@ void setJSDOMWindowSVGTextContentElementConstructor(ExecState* exec, JSObject* t
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTextContentElement"), value);
 }
 
-void setJSDOMWindowSVGTextPathElementConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGTextPathElementConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -4001,7 +5266,7 @@ void setJSDOMWindowSVGTextPathElementConstructor(ExecState* exec, JSObject* this
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTextPathElement"), value);
 }
 
-void setJSDOMWindowSVGTransformConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGTransformConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -4009,7 +5274,7 @@ void setJSDOMWindowSVGTransformConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGTransform"), value);
 }
 
-void setJSDOMWindowSVGUnitTypesConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDOMWindowSVGUnitTypesConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     if (!static_cast<JSDOMWindow*>(thisObject)->allowsAccessFrom(exec))
         return;
@@ -4017,16 +5282,10 @@ void setJSDOMWindowSVGUnitTypesConstructor(ExecState* exec, JSObject* thisObject
     static_cast<JSDOMWindow*>(thisObject)->putDirect(Identifier(exec, "SVGUnitTypes"), value);
 }
 
-void JSDOMWindow::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
-{
-    if (customGetPropertyNames(exec, propertyNames))
-        return;
-     Base::getPropertyNames(exec, propertyNames);
-}
-
-JSValuePtr jsDOMWindowPrototypeFunctionGetSelection(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionGetSelection(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4034,13 +5293,14 @@ JSValuePtr jsDOMWindowPrototypeFunctionGetSelection(ExecState* exec, JSObject*,
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getSelection()));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getSelection()));
     return result;
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionFocus(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionFocus(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
@@ -4049,9 +5309,10 @@ JSValuePtr jsDOMWindowPrototypeFunctionFocus(ExecState* exec, JSObject*, JSValue
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionBlur(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionBlur(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
@@ -4060,9 +5321,10 @@ JSValuePtr jsDOMWindowPrototypeFunctionBlur(ExecState* exec, JSObject*, JSValueP
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionClose(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionClose(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
@@ -4071,9 +5333,10 @@ JSValuePtr jsDOMWindowPrototypeFunctionClose(ExecState* exec, JSObject*, JSValue
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionPrint(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionPrint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4084,9 +5347,10 @@ JSValuePtr jsDOMWindowPrototypeFunctionPrint(ExecState* exec, JSObject*, JSValue
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionStop(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionStop(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4097,75 +5361,102 @@ JSValuePtr jsDOMWindowPrototypeFunctionStop(ExecState* exec, JSObject*, JSValueP
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionAlert(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionOpen(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
+    if (!castedThisObj)
+        return throwError(exec, TypeError);
+    if (!castedThisObj->allowsAccessFrom(exec))
+        return jsUndefined();
+    return castedThisObj->open(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionShowModalDialog(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
+    if (!castedThisObj)
+        return throwError(exec, TypeError);
+    if (!castedThisObj->allowsAccessFrom(exec))
+        return jsUndefined();
+    return castedThisObj->showModalDialog(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionAlert(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
-    const UString& message = args.at(exec, 0)->toString(exec);
+    const UString& message = args.at(0).toString(exec);
 
     imp->alert(message);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionConfirm(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionConfirm(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
-    const UString& message = args.at(exec, 0)->toString(exec);
+    const UString& message = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->confirm(message));
+    JSC::JSValue result = jsBoolean(imp->confirm(message));
     return result;
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionPrompt(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionPrompt(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
-    const UString& message = args.at(exec, 0)->toString(exec);
-    const UString& defaultValue = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 1));
+    const UString& message = args.at(0).toString(exec);
+    const UString& defaultValue = valueToStringWithUndefinedOrNullCheck(exec, args.at(1));
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->prompt(message, defaultValue));
+    JSC::JSValue result = jsStringOrNull(exec, imp->prompt(message, defaultValue));
     return result;
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionFind(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionFind(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
-    const UString& string = args.at(exec, 0)->toString(exec);
-    bool caseSensitive = args.at(exec, 1)->toBoolean(exec);
-    bool backwards = args.at(exec, 2)->toBoolean(exec);
-    bool wrap = args.at(exec, 3)->toBoolean(exec);
-    bool wholeWord = args.at(exec, 4)->toBoolean(exec);
-    bool searchInFrames = args.at(exec, 5)->toBoolean(exec);
-    bool showDialog = args.at(exec, 6)->toBoolean(exec);
+    const UString& string = args.at(0).toString(exec);
+    bool caseSensitive = args.at(1).toBoolean(exec);
+    bool backwards = args.at(2).toBoolean(exec);
+    bool wrap = args.at(3).toBoolean(exec);
+    bool wholeWord = args.at(4).toBoolean(exec);
+    bool searchInFrames = args.at(5).toBoolean(exec);
+    bool showDialog = args.at(6).toBoolean(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->find(string, caseSensitive, backwards, wrap, wholeWord, searchInFrames, showDialog));
+    JSC::JSValue result = jsBoolean(imp->find(string, caseSensitive, backwards, wrap, wholeWord, searchInFrames, showDialog));
     return result;
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionScrollBy(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionScrollBy(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4173,16 +5464,17 @@ JSValuePtr jsDOMWindowPrototypeFunctionScrollBy(ExecState* exec, JSObject*, JSVa
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     if (args.size() < 2)
         return jsUndefined();
-    int x = args.at(exec, 0)->toInt32(exec);
-    int y = args.at(exec, 1)->toInt32(exec);
+    int x = args.at(0).toInt32(exec);
+    int y = args.at(1).toInt32(exec);
 
     imp->scrollBy(x, y);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionScrollTo(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionScrollTo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4190,16 +5482,17 @@ JSValuePtr jsDOMWindowPrototypeFunctionScrollTo(ExecState* exec, JSObject*, JSVa
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     if (args.size() < 2)
         return jsUndefined();
-    int x = args.at(exec, 0)->toInt32(exec);
-    int y = args.at(exec, 1)->toInt32(exec);
+    int x = args.at(0).toInt32(exec);
+    int y = args.at(1).toInt32(exec);
 
     imp->scrollTo(x, y);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionScroll(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionScroll(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4207,16 +5500,17 @@ JSValuePtr jsDOMWindowPrototypeFunctionScroll(ExecState* exec, JSObject*, JSValu
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     if (args.size() < 2)
         return jsUndefined();
-    int x = args.at(exec, 0)->toInt32(exec);
-    int y = args.at(exec, 1)->toInt32(exec);
+    int x = args.at(0).toInt32(exec);
+    int y = args.at(1).toInt32(exec);
 
     imp->scroll(x, y);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionMoveBy(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionMoveBy(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4224,16 +5518,17 @@ JSValuePtr jsDOMWindowPrototypeFunctionMoveBy(ExecState* exec, JSObject*, JSValu
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     if (args.size() < 2)
         return jsUndefined();
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
     imp->moveBy(x, y);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionMoveTo(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionMoveTo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4241,16 +5536,17 @@ JSValuePtr jsDOMWindowPrototypeFunctionMoveTo(ExecState* exec, JSObject*, JSValu
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     if (args.size() < 2)
         return jsUndefined();
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
     imp->moveTo(x, y);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionResizeBy(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionResizeBy(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4258,16 +5554,17 @@ JSValuePtr jsDOMWindowPrototypeFunctionResizeBy(ExecState* exec, JSObject*, JSVa
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     if (args.size() < 2)
         return jsUndefined();
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
     imp->resizeBy(x, y);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionResizeTo(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionResizeTo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4275,85 +5572,124 @@ JSValuePtr jsDOMWindowPrototypeFunctionResizeTo(ExecState* exec, JSObject*, JSVa
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     if (args.size() < 2)
         return jsUndefined();
-    float width = args.at(exec, 0)->toFloat(exec);
-    float height = args.at(exec, 1)->toFloat(exec);
+    float width = args.at(0).toFloat(exec);
+    float height = args.at(1).toFloat(exec);
 
     imp->resizeTo(width, height);
     return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionGetComputedStyle(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionGetComputedStyle(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
-    Element* element = toElement(args.at(exec, 0));
-    const UString& pseudoElement = args.at(exec, 1)->toString(exec);
+    Element* element = toElement(args.at(0));
+    const UString& pseudoElement = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getComputedStyle(element, pseudoElement)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getComputedStyle(element, pseudoElement)));
     return result;
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionGetMatchedCSSRules(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionGetMatchedCSSRules(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
-    Element* element = toElement(args.at(exec, 0));
-    const UString& pseudoElement = args.at(exec, 1)->toString(exec);
+    Element* element = toElement(args.at(0));
+    const UString& pseudoElement = args.at(1).toString(exec);
 
     int argsCount = args.size();
     if (argsCount < 3) {
 
-        JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getMatchedCSSRules(element, pseudoElement)));
+        JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getMatchedCSSRules(element, pseudoElement)));
         return result;
     }
 
-    bool authorOnly = args.at(exec, 2)->toBoolean(exec);
+    bool authorOnly = args.at(2).toBoolean(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getMatchedCSSRules(element, pseudoElement, authorOnly)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getMatchedCSSRules(element, pseudoElement, authorOnly)));
     return result;
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionOpenDatabase(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionWebkitConvertPointFromPageToNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
+    if (!castedThisObj)
+        return throwError(exec, TypeError);
+    if (!castedThisObj->allowsAccessFrom(exec))
+        return jsUndefined();
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
+    Node* node = toNode(args.at(0));
+    WebKitPoint* p = toWebKitPoint(args.at(1));
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->webkitConvertPointFromPageToNode(node, p)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionWebkitConvertPointFromNodeToPage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
+    if (!castedThisObj)
+        return throwError(exec, TypeError);
+    if (!castedThisObj->allowsAccessFrom(exec))
+        return jsUndefined();
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
+    Node* node = toNode(args.at(0));
+    WebKitPoint* p = toWebKitPoint(args.at(1));
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->webkitConvertPointFromNodeToPage(node, p)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionOpenDatabase(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
     DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& name = args.at(exec, 0)->toString(exec);
-    const UString& version = args.at(exec, 1)->toString(exec);
-    const UString& displayName = args.at(exec, 2)->toString(exec);
-    unsigned estimatedSize = args.at(exec, 3)->toInt32(exec);
+    const UString& name = args.at(0).toString(exec);
+    const UString& version = args.at(1).toString(exec);
+    const UString& displayName = args.at(2).toString(exec);
+    unsigned estimatedSize = args.at(3).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->openDatabase(name, version, displayName, estimatedSize, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->openDatabase(name, version, displayName, estimatedSize, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionPostMessage(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionPostMessage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     return castedThisObj->postMessage(exec, args);
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionSetTimeout(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionSetTimeout(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4361,19 +5697,25 @@ JSValuePtr jsDOMWindowPrototypeFunctionSetTimeout(ExecState* exec, JSObject*, JS
     return castedThisObj->setTimeout(exec, args);
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionClearTimeout(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionClearTimeout(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThisObj->clearTimeout(exec, args);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
+    int handle = args.at(0).toInt32(exec);
+
+    imp->clearTimeout(handle);
+    return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionSetInterval(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionSetInterval(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4381,19 +5723,25 @@ JSValuePtr jsDOMWindowPrototypeFunctionSetInterval(ExecState* exec, JSObject*, J
     return castedThisObj->setInterval(exec, args);
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionClearInterval(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionClearInterval(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
         return jsUndefined();
-    return castedThisObj->clearInterval(exec, args);
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
+    int handle = args.at(0).toInt32(exec);
+
+    imp->clearInterval(handle);
+    return jsUndefined();
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionAtob(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionAtob(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4401,9 +5749,10 @@ JSValuePtr jsDOMWindowPrototypeFunctionAtob(ExecState* exec, JSObject*, JSValueP
     return castedThisObj->atob(exec, args);
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionBtoa(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionBtoa(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4411,9 +5760,10 @@ JSValuePtr jsDOMWindowPrototypeFunctionBtoa(ExecState* exec, JSObject*, JSValueP
     return castedThisObj->btoa(exec, args);
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4421,9 +5771,10 @@ JSValuePtr jsDOMWindowPrototypeFunctionAddEventListener(ExecState* exec, JSObjec
     return castedThisObj->addEventListener(exec, args);
 }
 
-JSValuePtr jsDOMWindowPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue);
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
     if (!castedThisObj)
         return throwError(exec, TypeError);
     if (!castedThisObj->allowsAccessFrom(exec))
@@ -4431,5 +5782,51 @@ JSValuePtr jsDOMWindowPrototypeFunctionRemoveEventListener(ExecState* exec, JSOb
     return castedThisObj->removeEventListener(exec, args);
 }
 
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
+    if (!castedThisObj)
+        return throwError(exec, TypeError);
+    if (!castedThisObj->allowsAccessFrom(exec))
+        return jsUndefined();
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    Event* evt = toEvent(args.at(0));
+
+
+    JSC::JSValue result = jsBoolean(imp->dispatchEvent(evt, ec));
+    setDOMException(exec, ec);
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionCaptureEvents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
+    if (!castedThisObj)
+        return throwError(exec, TypeError);
+    if (!castedThisObj->allowsAccessFrom(exec))
+        return jsUndefined();
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
+
+    imp->captureEvents();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionReleaseEvents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    JSDOMWindow* castedThisObj = toJSDOMWindow(thisValue.toThisObject(exec));
+    if (!castedThisObj)
+        return throwError(exec, TypeError);
+    if (!castedThisObj->allowsAccessFrom(exec))
+        return jsUndefined();
+    DOMWindow* imp = static_cast<DOMWindow*>(castedThisObj->impl());
+
+    imp->releaseEvents();
+    return jsUndefined();
+}
+
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
index cea74ae..869e598 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMWindow.h
@@ -21,8 +21,9 @@
 #ifndef JSDOMWindow_h
 #define JSDOMWindow_h
 
-#include "JSDOMWindowBase.h"
 #include "DOMWindow.h"
+#include "JSDOMWindowBase.h"
+
 namespace WebCore {
 
 class DOMWindow;
@@ -33,14 +34,13 @@ class JSDOMWindow : public JSDOMWindowBase {
     typedef JSDOMWindowBase Base;
 public:
     JSDOMWindow(PassRefPtr<JSC::Structure>, PassRefPtr<DOMWindow>, JSDOMWindowShell*);
+    virtual ~JSDOMWindow();
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    bool customGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType, JSC::ImplementsHasInstance | JSC::NeedsThisConversion));
     }
@@ -49,41 +49,52 @@ public:
 
     virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    bool customGetPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     virtual bool getPropertyAttributes(JSC::ExecState*, const JSC::Identifier&, unsigned& attributes) const;
     virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);
     virtual void defineSetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* setterFunction);
-    virtual JSC::JSValuePtr lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);
-    virtual JSC::JSValuePtr lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);
+    virtual JSC::JSValue lookupGetter(JSC::ExecState*, const JSC::Identifier& propertyName);
+    virtual JSC::JSValue lookupSetter(JSC::ExecState*, const JSC::Identifier& propertyName);
 
     // Custom attributes
-    void setLocation(JSC::ExecState*, JSC::JSValuePtr);
+    JSC::JSValue history(JSC::ExecState*) const;
+    JSC::JSValue location(JSC::ExecState*) const;
+    void setLocation(JSC::ExecState*, JSC::JSValue);
+    JSC::JSValue event(JSC::ExecState*) const;
+    JSC::JSValue crypto(JSC::ExecState*) const;
+    JSC::JSValue image(JSC::ExecState*) const;
+    JSC::JSValue option(JSC::ExecState*) const;
+    JSC::JSValue webKitCSSMatrix(JSC::ExecState*) const;
+    JSC::JSValue webKitPoint(JSC::ExecState*) const;
+    JSC::JSValue xmlHttpRequest(JSC::ExecState*) const;
+    JSC::JSValue worker(JSC::ExecState*) const;
+    JSC::JSValue audio(JSC::ExecState*) const;
 
     // Custom functions
-    JSC::JSValuePtr postMessage(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setTimeout(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr clearTimeout(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setInterval(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr clearInterval(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr atob(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr btoa(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr addEventListener(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue open(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue showModalDialog(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue postMessage(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setTimeout(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setInterval(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue atob(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue btoa(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
     DOMWindow* impl() const
     {
         return static_cast<DOMWindow*>(Base::impl());
     }
 };
 
-DOMWindow* toDOMWindow(JSC::JSValuePtr);
+DOMWindow* toDOMWindow(JSC::JSValue);
 
 class JSDOMWindowPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
     void* operator new(size_t);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -92,478 +103,574 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionGetSelection(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionFocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionBlur(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionClose(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionPrint(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionStop(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionAlert(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionConfirm(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionPrompt(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionFind(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionScrollBy(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionScrollTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionScroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionMoveBy(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionMoveTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionResizeBy(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionResizeTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionGetComputedStyle(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionGetMatchedCSSRules(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionOpenDatabase(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionPostMessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionSetTimeout(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionClearTimeout(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionSetInterval(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionClearInterval(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionAtob(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionBtoa(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDOMWindowPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionGetSelection(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionFocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionBlur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionClose(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionPrint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionStop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionOpen(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionShowModalDialog(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionAlert(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionConfirm(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionPrompt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionFind(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionScrollBy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionScrollTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionScroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionMoveBy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionMoveTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionResizeBy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionResizeTo(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionGetComputedStyle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionGetMatchedCSSRules(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionWebkitConvertPointFromPageToNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionWebkitConvertPointFromNodeToPage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionOpenDatabase(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionPostMessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionSetTimeout(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionClearTimeout(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionSetInterval(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionClearInterval(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionAtob(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionBtoa(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionCaptureEvents(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDOMWindowPrototypeFunctionReleaseEvents(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsDOMWindowScreen(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMWindowHistory(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMWindowLocationbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowLocationbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowMenubar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowMenubar(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowPersonalbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowPersonalbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowScrollbars(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowScrollbars(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowStatusbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowStatusbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowToolbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowToolbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowNavigator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowNavigator(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowClientInformation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowClientInformation(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowFrameElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMWindowOffscreenBuffering(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOffscreenBuffering(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOuterHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOuterHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOuterWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOuterWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowInnerHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowInnerHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowInnerWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowInnerWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowScreenX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowScreenX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowScreenY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowScreenY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowScreenLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowScreenLeft(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowScreenTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowScreenTop(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowScrollX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowScrollX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowScrollY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowScrollY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowPageXOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMWindowPageYOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMWindowClosed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMWindowLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowStatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowStatus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowDefaultStatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowDefaultStatus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowDefaultstatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowDefaultstatus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSelf(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSelf(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowWindow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMWindowFrames(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowFrames(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOpener(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOpener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowParent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowParent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowTop(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMWindowDevicePixelRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowDevicePixelRatio(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowApplicationCache(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMWindowSessionStorage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMWindowLocalStorage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDOMWindowConsole(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowConsole(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnblur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnblur(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOndblclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOndblclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnfocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnfocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnkeydown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnkeydown(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnkeypress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnkeypress(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnkeyup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnkeyup(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnmousedown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnmousedown(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnmousemove(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnmousemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnmouseout(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnmouseout(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnmouseover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnmouseover(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnmouseup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnmouseup(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnmousewheel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnmousewheel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnreset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnreset(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnresize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnresize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnscroll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnscroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnsearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnsearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnselect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnselect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnsubmit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnsubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnbeforeunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnbeforeunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnwebkitanimationstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnwebkitanimationstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnwebkitanimationiteration(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnwebkitanimationiteration(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnwebkitanimationend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnwebkitanimationend(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOnwebkittransitionend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOnwebkittransitionend(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowStyleSheetConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowStyleSheetConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSStyleSheetConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSStyleSheetConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSValueConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSPrimitiveValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSPrimitiveValueConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSValueListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSValueListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowWebKitCSSTransformValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowWebKitCSSTransformValueConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSCharsetRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSCharsetRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSFontFaceRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSFontFaceRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSImportRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSImportRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSMediaRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSMediaRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSPageRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSPageRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSStyleRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSStyleRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSVariablesRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSVariablesRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSVariablesDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSVariablesDeclarationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSStyleDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSStyleDeclarationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowMediaListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowMediaListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCounterConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCounterConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCSSRuleListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCSSRuleListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowRectConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowRectConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowStyleSheetListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowStyleSheetListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowDOMExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowDOMExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowDOMStringListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowDOMStringListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowDOMImplementationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowDOMImplementationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowDocumentFragmentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowDocumentFragmentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowDocumentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowNodeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowNodeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowNodeListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowNodeListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowNamedNodeMapConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowNamedNodeMapConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCharacterDataConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCharacterDataConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowAttrConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowAttrConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowTextConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowTextConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCommentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCommentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCDATASectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCDATASectionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowDocumentTypeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowDocumentTypeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowNotationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowNotationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowEntityConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowEntityConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowEntityReferenceConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowEntityReferenceConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowProcessingInstructionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowProcessingInstructionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLDocumentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLAnchorElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLAnchorElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLAppletElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLAppletElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLAreaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLAreaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLBRElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLBRElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLBaseElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLBaseElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLBaseFontElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLBaseFontElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLBlockquoteElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLBlockquoteElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLBodyElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLBodyElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLButtonElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLButtonElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLCanvasElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLCanvasElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLDListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLDListElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLDirectoryElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLDirectoryElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLDivElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLDivElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLEmbedElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLEmbedElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLFieldSetElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLFieldSetElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLFontElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLFontElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLFormElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLFormElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLFrameElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLFrameElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLFrameSetElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLFrameSetElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLHRElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLHRElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLHeadElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLHeadElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLHeadingElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLHeadingElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLHtmlElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLHtmlElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLIFrameElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLIFrameElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLImageElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLImageElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLInputElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLInputElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLIsIndexElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLIsIndexElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLLIElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLLIElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLLabelElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLLabelElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLLegendElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLLegendElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLLinkElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLLinkElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLMapElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLMapElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLMarqueeElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLMarqueeElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLMenuElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLMenuElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLMetaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLMetaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLModElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLModElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLOListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLOListElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLObjectElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLObjectElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLOptGroupElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLOptGroupElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLOptionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLOptionElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLParagraphElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLParagraphElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLParamElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLParamElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLPreElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLPreElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLQuoteElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLQuoteElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLScriptElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLScriptElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLSelectElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLSelectElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLStyleElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLStyleElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLTableCaptionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLTableCaptionElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLTableCellElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLTableCellElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLTableColElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLTableColElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLTableElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLTableElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLTableRowElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLTableRowElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLTableSectionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLTableSectionElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLTextAreaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLTextAreaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLTitleElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLTitleElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLUListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLUListElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLCollectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLCollectionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowCanvasRenderingContext2DConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowCanvasRenderingContext2DConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowTextMetricsConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowTextMetricsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowKeyboardEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowKeyboardEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowMouseEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowMouseEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowMutationEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowMutationEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowOverflowEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowOverflowEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowProgressEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowProgressEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowTextEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowTextEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowUIEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowUIEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowWebKitAnimationEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowWebKitAnimationEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowWebKitTransitionEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowWebKitTransitionEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowWheelEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowWheelEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowMessageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowMessageEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowEventExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowEventExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowWebKitCSSKeyframeRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowWebKitCSSKeyframeRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowWebKitCSSKeyframesRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowWebKitCSSKeyframesRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowClipboardConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowClipboardConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowFileConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowFileConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowFileListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowFileListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowNodeFilterConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowNodeFilterConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowRangeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowRangeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowRangeExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowRangeExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowXMLDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowXMLDocumentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowDOMParserConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowDOMParserConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowXMLSerializerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowXMLSerializerConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowXMLHttpRequestUploadConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowXMLHttpRequestUploadConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowXMLHttpRequestExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowXMLHttpRequestExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowPluginConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowPluginConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowPluginArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowPluginArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowMimeTypeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowMimeTypeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowMimeTypeArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowMimeTypeArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowStorageConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowStorageConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowStorageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowStorageEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLAudioElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLAudioElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLMediaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLMediaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowHTMLVideoElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowHTMLVideoElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowMediaErrorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowMediaErrorConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowXPathEvaluatorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowXPathEvaluatorConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowXPathResultConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowXPathResultConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowXPathExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowXPathExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGAngleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGAngleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGColorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGColorConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGGradientElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGGradientElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGLengthConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGLengthConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGMarkerElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGMarkerElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGPaintConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGPaintConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGPathSegConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGPathSegConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGPreserveAspectRatioConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGPreserveAspectRatioConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGRenderingIntentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGRenderingIntentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGTextContentElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGTextContentElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGTextPathElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGTextPathElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGTransformConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGTransformConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDOMWindowSVGUnitTypesConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDOMWindowSVGUnitTypesConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsDOMWindowScreen(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowHistory(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowLocationbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowLocationbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowMenubar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowMenubar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowPersonalbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowPersonalbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowScrollbars(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowScrollbars(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowStatusbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowStatusbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowToolbar(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowToolbar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowNavigator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowNavigator(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowClientInformation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowClientInformation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowEvent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCrypto(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowFrameElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowOffscreenBuffering(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOffscreenBuffering(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOuterHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOuterHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOuterWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOuterWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowInnerHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowInnerHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowInnerWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowInnerWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowScreenX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowScreenX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowScreenY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowScreenY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowScreenLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowScreenLeft(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowScreenTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowScreenTop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowScrollX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowScrollX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowScrollY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowScrollY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowPageXOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowPageYOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowClosed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowStatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowStatus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowDefaultStatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowDefaultStatus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowDefaultstatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowDefaultstatus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSelf(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSelf(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWindow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowFrames(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowFrames(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOpener(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOpener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowParent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowParent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowTop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowDevicePixelRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowDevicePixelRatio(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowApplicationCache(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowSessionStorage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowLocalStorage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDOMWindowConsole(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowConsole(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnbeforeunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnbeforeunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnblur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnblur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOncanplay(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOncanplay(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOncanplaythrough(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOncanplaythrough(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOncontextmenu(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOncontextmenu(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOndblclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOndblclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOndrag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOndrag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOndragend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOndragend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOndragenter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOndragenter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOndragleave(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOndragleave(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOndragover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOndragover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOndragstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOndragstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOndrop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOndrop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOndurationchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOndurationchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnemptied(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnemptied(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnended(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnended(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnfocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnfocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOninput(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOninput(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnkeydown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnkeydown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnkeypress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnkeypress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnkeyup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnkeyup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnloadeddata(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnloadeddata(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnloadedmetadata(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnloadedmetadata(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnloadstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnloadstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnmousedown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnmousedown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnmousemove(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnmousemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnmouseout(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnmouseout(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnmouseover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnmouseover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnmouseup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnmouseup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnmousewheel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnmousewheel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnoffline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnoffline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnonline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnonline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnpause(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnpause(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnplay(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnplay(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnplaying(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnplaying(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnprogress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnprogress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnratechange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnratechange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnresize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnresize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnscroll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnscroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnseeked(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnseeked(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnseeking(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnseeking(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnselect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnselect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnstalled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnstalled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnstorage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnstorage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnsubmit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnsubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnsuspend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnsuspend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOntimeupdate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOntimeupdate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnvolumechange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnvolumechange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnwaiting(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnwaiting(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnreset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnreset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnsearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnsearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnwebkitanimationend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnwebkitanimationend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnwebkitanimationiteration(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnwebkitanimationiteration(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnwebkitanimationstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnwebkitanimationstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOnwebkittransitionend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOnwebkittransitionend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowStyleSheetConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowStyleSheetConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSStyleSheetConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSStyleSheetConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSValueConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSPrimitiveValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSPrimitiveValueConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSValueListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSValueListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebKitCSSTransformValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowWebKitCSSTransformValueConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSCharsetRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSCharsetRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSFontFaceRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSFontFaceRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSImportRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSImportRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSMediaRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSMediaRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSPageRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSPageRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSStyleRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSStyleRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSVariablesRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSVariablesRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSVariablesDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSVariablesDeclarationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSStyleDeclarationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSStyleDeclarationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowMediaListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowMediaListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCounterConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCounterConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCSSRuleListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCSSRuleListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowRectConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowRectConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowStyleSheetListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowStyleSheetListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowDOMExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowDOMExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowDOMImplementationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowDOMImplementationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowDocumentFragmentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowDocumentFragmentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowDocumentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowNodeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowNodeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowNodeListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowNodeListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowNamedNodeMapConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowNamedNodeMapConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCharacterDataConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCharacterDataConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowAttrConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowAttrConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowTextConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowTextConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCommentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCommentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCDATASectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCDATASectionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowDocumentTypeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowDocumentTypeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowNotationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowNotationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowEntityConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowEntityConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowEntityReferenceConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowEntityReferenceConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowProcessingInstructionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowProcessingInstructionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLDocumentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLAnchorElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLAnchorElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLAppletElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLAppletElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLAreaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLAreaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLBRElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLBRElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLBaseElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLBaseElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLBaseFontElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLBaseFontElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLBlockquoteElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLBlockquoteElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLBodyElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLBodyElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLButtonElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLButtonElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLCanvasElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLCanvasElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLDataGridElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLDataGridElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLDataGridColElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLDataGridColElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLDListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLDListElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLDirectoryElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLDirectoryElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLDivElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLDivElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLEmbedElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLEmbedElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLFieldSetElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLFieldSetElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLFontElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLFontElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLFormElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLFormElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLFrameElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLFrameElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLFrameSetElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLFrameSetElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLHRElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLHRElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLHeadElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLHeadElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLHeadingElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLHeadingElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLHtmlElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLHtmlElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLIFrameElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLIFrameElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLImageElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLImageElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLInputElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLInputElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLIsIndexElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLIsIndexElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLLIElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLLIElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLLabelElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLLabelElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLLegendElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLLegendElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLLinkElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLLinkElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLMapElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLMapElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLMarqueeElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLMarqueeElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLMenuElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLMenuElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLMetaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLMetaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLModElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLModElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLOListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLOListElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLObjectElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLObjectElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLOptGroupElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLOptGroupElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLOptionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLOptionElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLParagraphElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLParagraphElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLParamElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLParamElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLPreElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLPreElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLQuoteElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLQuoteElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLScriptElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLScriptElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLSelectElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLSelectElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLStyleElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLStyleElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLTableCaptionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLTableCaptionElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLTableCellElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLTableCellElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLTableColElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLTableColElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLTableElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLTableElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLTableRowElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLTableRowElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLTableSectionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLTableSectionElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLTextAreaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLTextAreaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLTitleElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLTitleElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLUListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLUListElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLCollectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLCollectionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowImageConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowImageConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowCanvasRenderingContext2DConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowCanvasRenderingContext2DConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowTextMetricsConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowTextMetricsConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowKeyboardEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowKeyboardEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowMouseEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowMouseEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowMutationEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowMutationEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowOverflowEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowOverflowEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowProgressEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowProgressEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowTextEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowTextEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowUIEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowUIEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebKitAnimationEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowWebKitAnimationEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebKitTransitionEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowWebKitTransitionEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWheelEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowWheelEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowMessageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowMessageEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowEventExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowEventExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebKitCSSKeyframeRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowWebKitCSSKeyframeRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebKitCSSKeyframesRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowWebKitCSSKeyframesRuleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebKitCSSMatrixConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowWebKitCSSMatrixConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWebKitPointConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowWebKitPointConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowClipboardConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowClipboardConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowFileConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowFileConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowFileListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowFileListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowNodeFilterConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowNodeFilterConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowRangeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowRangeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowRangeExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowRangeExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowXMLDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowXMLDocumentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowDOMParserConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowDOMParserConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowXMLSerializerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowXMLSerializerConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowXMLHttpRequestConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowXMLHttpRequestConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowXMLHttpRequestUploadConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowXMLHttpRequestUploadConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowXMLHttpRequestExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowXMLHttpRequestExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowWorkerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowWorkerConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowPluginConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowPluginConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowPluginArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowPluginArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowMimeTypeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowMimeTypeConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowMimeTypeArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowMimeTypeArrayConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowClientRectConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowClientRectConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowClientRectListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowClientRectListConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowStorageConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowStorageConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowStorageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowStorageEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowAudioConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowAudioConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLAudioElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLAudioElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLMediaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLMediaElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowHTMLVideoElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowHTMLVideoElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowMediaErrorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowMediaErrorConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowXPathEvaluatorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowXPathEvaluatorConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowXPathResultConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowXPathResultConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowXPathExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowXPathExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGAngleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGAngleConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGColorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGColorConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGExceptionConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGGradientElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGGradientElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGLengthConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGLengthConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGMarkerElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGMarkerElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPaintConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGPaintConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPathSegConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGPathSegConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGPreserveAspectRatioConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGPreserveAspectRatioConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGRenderingIntentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGRenderingIntentConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGTextContentElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGTextContentElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGTextPathElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGTextPathElementConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGTransformConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGTransformConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDOMWindowSVGUnitTypesConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDOMWindowSVGUnitTypesConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDOMWindowBase.lut.h b/src/3rdparty/webkit/WebCore/generated/JSDOMWindowBase.lut.h
index d32e184..e69de29 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDOMWindowBase.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDOMWindowBase.lut.h
@@ -1,31 +0,0 @@
-// Automatically generated from ../bindings/js/JSDOMWindowBase.cpp using WebCore/../JavaScriptCore/create_hash_table. DO NOT EDIT!
-
-namespace WebCore {
-
-using namespace JSC;
-
-static const struct HashTableValue JSDOMWindowBaseTableValues[14] = {
-   { "open", DontDelete|Function, (intptr_t)windowProtoFuncOpen, (intptr_t)3 },
-   { "showModalDialog", DontDelete|Function, (intptr_t)windowProtoFuncShowModalDialog, (intptr_t)1 },
-   { "captureEvents", DontDelete|Function, (intptr_t)windowProtoFuncNotImplemented, (intptr_t)0 },
-   { "releaseEvents", DontDelete|Function, (intptr_t)windowProtoFuncNotImplemented, (intptr_t)0 },
-   { "crypto", DontDelete|ReadOnly, (intptr_t)jsDOMWindowBaseCrypto, (intptr_t)0 },
-   { "event", DontDelete, (intptr_t)jsDOMWindowBaseEvent, (intptr_t)setJSDOMWindowBaseEvent },
-   { "Audio", DontDelete, (intptr_t)jsDOMWindowBaseAudio, (intptr_t)setJSDOMWindowBaseAudio },
-   { "Image", DontDelete, (intptr_t)jsDOMWindowBaseImage, (intptr_t)setJSDOMWindowBaseImage },
-   { "MessageChannel", DontDelete, (intptr_t)jsDOMWindowBaseMessageChannel, (intptr_t)setJSDOMWindowBaseMessageChannel },
-   { "Option", DontDelete, (intptr_t)jsDOMWindowBaseOption, (intptr_t)setJSDOMWindowBaseOption },
-   { "Worker", DontDelete, (intptr_t)jsDOMWindowBaseWorker, (intptr_t)setJSDOMWindowBaseWorker },
-   { "XMLHttpRequest", DontDelete, (intptr_t)jsDOMWindowBaseXMLHttpRequest, (intptr_t)setJSDOMWindowBaseXMLHttpRequest },
-   { "XSLTProcessor", DontDelete, (intptr_t)jsDOMWindowBaseXSLTProcessor, (intptr_t)setJSDOMWindowBaseXSLTProcessor },
-   { 0, 0, 0, 0 }
-};
-
-extern const struct HashTable JSDOMWindowBaseTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 63, JSDOMWindowBaseTableValues, 0 };
-#else
-    { 34, 31, JSDOMWindowBaseTableValues, 0 };
-#endif
-
-} // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
new file mode 100644
index 0000000..105b916
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.cpp
@@ -0,0 +1,289 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSDataGridColumn.h"
+
+#include "DataGridColumn.h"
+#include "KURL.h"
+#include <runtime/JSNumberCell.h>
+#include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSDataGridColumn);
+
+/* Hash table */
+
+static const HashTableValue JSDataGridColumnTableValues[8] =
+{
+    { "id", DontDelete, (intptr_t)jsDataGridColumnId, (intptr_t)setJSDataGridColumnId },
+    { "label", DontDelete, (intptr_t)jsDataGridColumnLabel, (intptr_t)setJSDataGridColumnLabel },
+    { "type", DontDelete, (intptr_t)jsDataGridColumnType, (intptr_t)setJSDataGridColumnType },
+    { "sortable", DontDelete, (intptr_t)jsDataGridColumnSortable, (intptr_t)setJSDataGridColumnSortable },
+    { "sortDirection", DontDelete, (intptr_t)jsDataGridColumnSortDirection, (intptr_t)setJSDataGridColumnSortDirection },
+    { "primary", DontDelete, (intptr_t)jsDataGridColumnPrimary, (intptr_t)setJSDataGridColumnPrimary },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsDataGridColumnConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSDataGridColumnTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 63, JSDataGridColumnTableValues, 0 };
+#else
+    { 17, 15, JSDataGridColumnTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSDataGridColumnConstructorTableValues[7] =
+{
+    { "NEVER_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnNEVER_SORTED, (intptr_t)0 },
+    { "ALWAYS_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnALWAYS_SORTED, (intptr_t)0 },
+    { "SOMETIMES_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSOMETIMES_SORTED, (intptr_t)0 },
+    { "NATURAL_SORT", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnNATURAL_SORT, (intptr_t)0 },
+    { "SORT_ASCENDING", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSORT_ASCENDING, (intptr_t)0 },
+    { "SORC_DESCENDING", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSORC_DESCENDING, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSDataGridColumnConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 31, JSDataGridColumnConstructorTableValues, 0 };
+#else
+    { 17, 15, JSDataGridColumnConstructorTableValues, 0 };
+#endif
+
+class JSDataGridColumnConstructor : public DOMObject {
+public:
+    JSDataGridColumnConstructor(ExecState* exec)
+        : DOMObject(JSDataGridColumnConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    {
+        putDirect(exec->propertyNames().prototype, JSDataGridColumnPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+    }
+};
+
+const ClassInfo JSDataGridColumnConstructor::s_info = { "DataGridColumnConstructor", 0, &JSDataGridColumnConstructorTable, 0 };
+
+bool JSDataGridColumnConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSDataGridColumnConstructor, DOMObject>(exec, &JSDataGridColumnConstructorTable, this, propertyName, slot);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSDataGridColumnPrototypeTableValues[7] =
+{
+    { "NEVER_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnNEVER_SORTED, (intptr_t)0 },
+    { "ALWAYS_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnALWAYS_SORTED, (intptr_t)0 },
+    { "SOMETIMES_SORTED", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSOMETIMES_SORTED, (intptr_t)0 },
+    { "NATURAL_SORT", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnNATURAL_SORT, (intptr_t)0 },
+    { "SORT_ASCENDING", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSORT_ASCENDING, (intptr_t)0 },
+    { "SORC_DESCENDING", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnSORC_DESCENDING, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSDataGridColumnPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 31, JSDataGridColumnPrototypeTableValues, 0 };
+#else
+    { 17, 15, JSDataGridColumnPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSDataGridColumnPrototype::s_info = { "DataGridColumnPrototype", 0, &JSDataGridColumnPrototypeTable, 0 };
+
+JSObject* JSDataGridColumnPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSDataGridColumn>(exec, globalObject);
+}
+
+bool JSDataGridColumnPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSDataGridColumnPrototype, JSObject>(exec, &JSDataGridColumnPrototypeTable, this, propertyName, slot);
+}
+
+const ClassInfo JSDataGridColumn::s_info = { "DataGridColumn", 0, &JSDataGridColumnTable, 0 };
+
+JSDataGridColumn::JSDataGridColumn(PassRefPtr<Structure> structure, PassRefPtr<DataGridColumn> impl)
+    : DOMObject(structure)
+    , m_impl(impl)
+{
+}
+
+JSDataGridColumn::~JSDataGridColumn()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSDataGridColumn::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSDataGridColumnPrototype(JSDataGridColumnPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSDataGridColumn::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSDataGridColumn, Base>(exec, &JSDataGridColumnTable, this, propertyName, slot);
+}
+
+JSValue jsDataGridColumnId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(asObject(slot.slotBase()))->impl());
+    return jsString(exec, imp->id());
+}
+
+JSValue jsDataGridColumnLabel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(asObject(slot.slotBase()))->impl());
+    return jsString(exec, imp->label());
+}
+
+JSValue jsDataGridColumnType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(asObject(slot.slotBase()))->impl());
+    return jsString(exec, imp->type());
+}
+
+JSValue jsDataGridColumnSortable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->sortable());
+}
+
+JSValue jsDataGridColumnSortDirection(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->sortDirection());
+}
+
+JSValue jsDataGridColumnPrimary(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(asObject(slot.slotBase()))->impl());
+    return jsBoolean(imp->primary());
+}
+
+JSValue jsDataGridColumnConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSDataGridColumn*>(asObject(slot.slotBase()))->getConstructor(exec);
+}
+void JSDataGridColumn::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    lookupPut<JSDataGridColumn, Base>(exec, propertyName, value, &JSDataGridColumnTable, this, slot);
+}
+
+void setJSDataGridColumnId(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    imp->setId(value.toString(exec));
+}
+
+void setJSDataGridColumnLabel(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    imp->setLabel(value.toString(exec));
+}
+
+void setJSDataGridColumnType(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    imp->setType(value.toString(exec));
+}
+
+void setJSDataGridColumnSortable(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    imp->setSortable(value.toInt32(exec));
+}
+
+void setJSDataGridColumnSortDirection(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    imp->setSortDirection(value.toInt32(exec));
+}
+
+void setJSDataGridColumnPrimary(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    DataGridColumn* imp = static_cast<DataGridColumn*>(static_cast<JSDataGridColumn*>(thisObject)->impl());
+    imp->setPrimary(value.toBoolean(exec));
+}
+
+JSValue JSDataGridColumn::getConstructor(ExecState* exec)
+{
+    return getDOMConstructor<JSDataGridColumnConstructor>(exec);
+}
+
+// Constant getters
+
+JSValue jsDataGridColumnNEVER_SORTED(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0));
+}
+
+JSValue jsDataGridColumnALWAYS_SORTED(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(1));
+}
+
+JSValue jsDataGridColumnSOMETIMES_SORTED(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(2));
+}
+
+JSValue jsDataGridColumnNATURAL_SORT(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(0));
+}
+
+JSValue jsDataGridColumnSORT_ASCENDING(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(1));
+}
+
+JSValue jsDataGridColumnSORC_DESCENDING(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(2));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, DataGridColumn* object)
+{
+    return getDOMObjectWrapper<JSDataGridColumn>(exec, object);
+}
+DataGridColumn* toDataGridColumn(JSC::JSValue value)
+{
+    return value.isObject(&JSDataGridColumn::s_info) ? static_cast<JSDataGridColumn*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h
new file mode 100644
index 0000000..331ad9d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumn.h
@@ -0,0 +1,98 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSDataGridColumn_h
+#define JSDataGridColumn_h
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class DataGridColumn;
+
+class JSDataGridColumn : public DOMObject {
+    typedef DOMObject Base;
+public:
+    JSDataGridColumn(PassRefPtr<JSC::Structure>, PassRefPtr<DataGridColumn>);
+    virtual ~JSDataGridColumn();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*);
+    DataGridColumn* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<DataGridColumn> m_impl;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, DataGridColumn*);
+DataGridColumn* toDataGridColumn(JSC::JSValue);
+
+class JSDataGridColumnPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+    JSDataGridColumnPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Attributes
+
+JSC::JSValue jsDataGridColumnId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDataGridColumnId(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDataGridColumnLabel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDataGridColumnLabel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDataGridColumnType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDataGridColumnType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDataGridColumnSortable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDataGridColumnSortable(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDataGridColumnSortDirection(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDataGridColumnSortDirection(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDataGridColumnPrimary(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDataGridColumnPrimary(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDataGridColumnConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+// Constants
+
+JSC::JSValue jsDataGridColumnNEVER_SORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnALWAYS_SORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnSOMETIMES_SORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnNATURAL_SORT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnSORT_ASCENDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnSORC_DESCENDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
new file mode 100644
index 0000000..276878e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.cpp
@@ -0,0 +1,301 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSDataGridColumnList.h"
+
+#include "AtomicString.h"
+#include "DataGridColumn.h"
+#include "DataGridColumnList.h"
+#include "ExceptionCode.h"
+#include "JSDataGridColumn.h"
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSDataGridColumnList);
+
+/* Hash table */
+
+static const HashTableValue JSDataGridColumnListTableValues[5] =
+{
+    { "length", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnListLength, (intptr_t)0 },
+    { "sortColumn", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnListSortColumn, (intptr_t)0 },
+    { "primaryColumn", DontDelete|ReadOnly, (intptr_t)jsDataGridColumnListPrimaryColumn, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsDataGridColumnListConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSDataGridColumnListTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 15, JSDataGridColumnListTableValues, 0 };
+#else
+    { 10, 7, JSDataGridColumnListTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSDataGridColumnListConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSDataGridColumnListConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSDataGridColumnListConstructorTableValues, 0 };
+#else
+    { 1, 0, JSDataGridColumnListConstructorTableValues, 0 };
+#endif
+
+class JSDataGridColumnListConstructor : public DOMObject {
+public:
+    JSDataGridColumnListConstructor(ExecState* exec)
+        : DOMObject(JSDataGridColumnListConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    {
+        putDirect(exec->propertyNames().prototype, JSDataGridColumnListPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+    }
+};
+
+const ClassInfo JSDataGridColumnListConstructor::s_info = { "DataGridColumnListConstructor", 0, &JSDataGridColumnListConstructorTable, 0 };
+
+bool JSDataGridColumnListConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSDataGridColumnListConstructor, DOMObject>(exec, &JSDataGridColumnListConstructorTable, this, propertyName, slot);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSDataGridColumnListPrototypeTableValues[6] =
+{
+    { "item", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionItem, (intptr_t)1 },
+    { "add", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionAdd, (intptr_t)5 },
+    { "remove", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionRemove, (intptr_t)1 },
+    { "move", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionMove, (intptr_t)2 },
+    { "clear", DontDelete|Function, (intptr_t)jsDataGridColumnListPrototypeFunctionClear, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSDataGridColumnListPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 31, JSDataGridColumnListPrototypeTableValues, 0 };
+#else
+    { 17, 15, JSDataGridColumnListPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSDataGridColumnListPrototype::s_info = { "DataGridColumnListPrototype", 0, &JSDataGridColumnListPrototypeTable, 0 };
+
+JSObject* JSDataGridColumnListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSDataGridColumnList>(exec, globalObject);
+}
+
+bool JSDataGridColumnListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSDataGridColumnListPrototypeTable, this, propertyName, slot);
+}
+
+const ClassInfo JSDataGridColumnList::s_info = { "DataGridColumnList", 0, &JSDataGridColumnListTable, 0 };
+
+JSDataGridColumnList::JSDataGridColumnList(PassRefPtr<Structure> structure, PassRefPtr<DataGridColumnList> impl)
+    : DOMObject(structure)
+    , m_impl(impl)
+{
+}
+
+JSDataGridColumnList::~JSDataGridColumnList()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSDataGridColumnList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSDataGridColumnListPrototype(JSDataGridColumnListPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSDataGridColumnList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    const HashEntry* entry = JSDataGridColumnListTable.entry(exec, propertyName);
+    if (entry) {
+        slot.setCustom(this, entry->propertyGetter());
+        return true;
+    }
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<DataGridColumnList*>(impl())->length()) {
+        slot.setCustomIndex(this, index, indexGetter);
+        return true;
+    }
+    if (canGetItemsForName(exec, static_cast<DataGridColumnList*>(impl()), propertyName)) {
+        slot.setCustom(this, nameGetter);
+        return true;
+    }
+    return getStaticValueSlot<JSDataGridColumnList, Base>(exec, &JSDataGridColumnListTable, this, propertyName, slot);
+}
+
+bool JSDataGridColumnList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, PropertySlot& slot)
+{
+    if (propertyName < static_cast<DataGridColumnList*>(impl())->length()) {
+        slot.setCustomIndex(this, propertyName, indexGetter);
+        return true;
+    }
+    return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
+}
+
+JSValue jsDataGridColumnListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->length());
+}
+
+JSValue jsDataGridColumnListSortColumn(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()))->impl());
+    return toJS(exec, WTF::getPtr(imp->sortColumn()));
+}
+
+JSValue jsDataGridColumnListPrimaryColumn(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()))->impl());
+    return toJS(exec, WTF::getPtr(imp->primaryColumn()));
+}
+
+JSValue jsDataGridColumnListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()))->getConstructor(exec);
+}
+void JSDataGridColumnList::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
+{
+    for (unsigned i = 0; i < static_cast<DataGridColumnList*>(impl())->length(); ++i)
+        propertyNames.add(Identifier::from(exec, i));
+     Base::getPropertyNames(exec, propertyNames);
+}
+
+JSValue JSDataGridColumnList::getConstructor(ExecState* exec)
+{
+    return getDOMConstructor<JSDataGridColumnListConstructor>(exec);
+}
+
+JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDataGridColumnList::s_info))
+        return throwError(exec, TypeError);
+    JSDataGridColumnList* castedThisObj = static_cast<JSDataGridColumnList*>(asObject(thisValue));
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThisObj->impl());
+    int index = args.at(0).toInt32(exec);
+    if (index < 0) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return jsUndefined();
+    }
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionAdd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDataGridColumnList::s_info))
+        return throwError(exec, TypeError);
+    JSDataGridColumnList* castedThisObj = static_cast<JSDataGridColumnList*>(asObject(thisValue));
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThisObj->impl());
+    const UString& id = args.at(0).toString(exec);
+    const UString& label = args.at(1).toString(exec);
+    const UString& type = args.at(2).toString(exec);
+    bool primary = args.at(3).toBoolean(exec);
+    unsigned short sortable = args.at(4).toInt32(exec);
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->add(id, label, type, primary, sortable)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionRemove(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDataGridColumnList::s_info))
+        return throwError(exec, TypeError);
+    JSDataGridColumnList* castedThisObj = static_cast<JSDataGridColumnList*>(asObject(thisValue));
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThisObj->impl());
+    DataGridColumn* column = toDataGridColumn(args.at(0));
+
+    imp->remove(column);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionMove(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDataGridColumnList::s_info))
+        return throwError(exec, TypeError);
+    JSDataGridColumnList* castedThisObj = static_cast<JSDataGridColumnList*>(asObject(thisValue));
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThisObj->impl());
+    DataGridColumn* column = toDataGridColumn(args.at(0));
+    unsigned index = args.at(1).toInt32(exec);
+
+    imp->move(column, index);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDataGridColumnList::s_info))
+        return throwError(exec, TypeError);
+    JSDataGridColumnList* castedThisObj = static_cast<JSDataGridColumnList*>(asObject(thisValue));
+    DataGridColumnList* imp = static_cast<DataGridColumnList*>(castedThisObj->impl());
+
+    imp->clear();
+    return jsUndefined();
+}
+
+
+JSValue JSDataGridColumnList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    JSDataGridColumnList* thisObj = static_cast<JSDataGridColumnList*>(asObject(slot.slotBase()));
+    return toJS(exec, static_cast<DataGridColumnList*>(thisObj->impl())->item(slot.index()));
+}
+JSC::JSValue toJS(JSC::ExecState* exec, DataGridColumnList* object)
+{
+    return getDOMObjectWrapper<JSDataGridColumnList>(exec, object);
+}
+DataGridColumnList* toDataGridColumnList(JSC::JSValue value)
+{
+    return value.isObject(&JSDataGridColumnList::s_info) ? static_cast<JSDataGridColumnList*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h
new file mode 100644
index 0000000..879daf9
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSDataGridColumnList.h
@@ -0,0 +1,93 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSDataGridColumnList_h
+#define JSDataGridColumnList_h
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class DataGridColumnList;
+
+class JSDataGridColumnList : public DOMObject {
+    typedef DOMObject Base;
+public:
+    JSDataGridColumnList(PassRefPtr<JSC::Structure>, PassRefPtr<DataGridColumnList>);
+    virtual ~JSDataGridColumnList();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
+    DataGridColumnList* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<DataGridColumnList> m_impl;
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+private:
+    static bool canGetItemsForName(JSC::ExecState*, DataGridColumnList*, const JSC::Identifier&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+};
+
+JSC::JSValue toJS(JSC::ExecState*, DataGridColumnList*);
+DataGridColumnList* toDataGridColumnList(JSC::JSValue);
+
+class JSDataGridColumnListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+    JSDataGridColumnListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionAdd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionRemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionMove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDataGridColumnListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsDataGridColumnListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnListSortColumn(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnListPrimaryColumn(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDataGridColumnListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp b/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp
index e663c52..490b081 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDatabase.cpp
@@ -20,21 +20,21 @@
 
 #include "config.h"
 
-#include "JSDatabase.h"
+#if ENABLE(DATABASE)
 
-#include <wtf/GetPtr.h>
+#include "JSDatabase.h"
 
 #include "Database.h"
 #include "KURL.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDatabase)
+ASSERT_CLASS_FITS_IN_CELL(JSDatabase);
 
 /* Hash table */
 
@@ -69,9 +69,9 @@ static const HashTable JSDatabasePrototypeTable =
 
 const ClassInfo JSDatabasePrototype::s_info = { "DatabasePrototype", 0, &JSDatabasePrototypeTable, 0 };
 
-JSObject* JSDatabasePrototype::self(ExecState* exec)
+JSObject* JSDatabasePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSDatabase>(exec);
+    return getDOMPrototype<JSDatabase>(exec, globalObject);
 }
 
 bool JSDatabasePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -90,12 +90,11 @@ JSDatabase::JSDatabase(PassRefPtr<Structure> structure, PassRefPtr<Database> imp
 JSDatabase::~JSDatabase()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSDatabase::createPrototype(ExecState* exec)
+JSObject* JSDatabase::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSDatabasePrototype(JSDatabasePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSDatabasePrototype(JSDatabasePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSDatabase::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -103,35 +102,40 @@ bool JSDatabase::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSDatabase, Base>(exec, &JSDatabaseTable, this, propertyName, slot);
 }
 
-JSValuePtr jsDatabaseVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDatabaseVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Database* imp = static_cast<Database*>(static_cast<JSDatabase*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->version());
 }
 
-JSValuePtr jsDatabasePrototypeFunctionChangeVersion(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDatabasePrototypeFunctionChangeVersion(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDatabase::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDatabase::s_info))
         return throwError(exec, TypeError);
     JSDatabase* castedThisObj = static_cast<JSDatabase*>(asObject(thisValue));
     return castedThisObj->changeVersion(exec, args);
 }
 
-JSValuePtr jsDatabasePrototypeFunctionTransaction(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDatabasePrototypeFunctionTransaction(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDatabase::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDatabase::s_info))
         return throwError(exec, TypeError);
     JSDatabase* castedThisObj = static_cast<JSDatabase*>(asObject(thisValue));
     return castedThisObj->transaction(exec, args);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Database* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Database* object)
 {
     return getDOMObjectWrapper<JSDatabase>(exec, object);
 }
-Database* toDatabase(JSC::JSValuePtr value)
+Database* toDatabase(JSC::JSValue value)
 {
-    return value->isObject(&JSDatabase::s_info) ? static_cast<JSDatabase*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSDatabase::s_info) ? static_cast<JSDatabase*>(asObject(value))->impl() : 0;
 }
 
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDatabase.h b/src/3rdparty/webkit/WebCore/generated/JSDatabase.h
index f0642e7..94b60be 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDatabase.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDatabase.h
@@ -21,6 +21,8 @@
 #ifndef JSDatabase_h
 #define JSDatabase_h
 
+#if ENABLE(DATABASE)
+
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -34,36 +36,37 @@ class JSDatabase : public DOMObject {
 public:
     JSDatabase(PassRefPtr<JSC::Structure>, PassRefPtr<Database>);
     virtual ~JSDatabase();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
 
     // Custom functions
-    JSC::JSValuePtr changeVersion(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr transaction(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue changeVersion(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue transaction(JSC::ExecState*, const JSC::ArgList&);
     Database* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Database> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Database*);
-Database* toDatabase(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Database*);
+Database* toDatabase(JSC::JSValue);
 
 class JSDatabasePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -72,12 +75,14 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsDatabasePrototypeFunctionChangeVersion(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDatabasePrototypeFunctionTransaction(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDatabasePrototypeFunctionChangeVersion(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDatabasePrototypeFunctionTransaction(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsDatabaseVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDatabaseVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
+#endif // ENABLE(DATABASE)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp b/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
index 13b73f9..2c59f13 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocument.cpp
@@ -19,11 +19,8 @@
 */
 
 #include "config.h"
-
 #include "JSDocument.h"
 
-#include <wtf/GetPtr.h>
-
 #include "Attr.h"
 #include "CDATASection.h"
 #include "CSSMutableStyleDeclaration.h"
@@ -38,6 +35,8 @@
 #include "Element.h"
 #include "EntityReference.h"
 #include "Event.h"
+#include "EventListener.h"
+#include "Frame.h"
 #include "HTMLCollection.h"
 #include "HTMLElement.h"
 #include "JSAttr.h"
@@ -46,6 +45,7 @@
 #include "JSCanvasRenderingContext2D.h"
 #include "JSComment.h"
 #include "JSCustomXPathNSResolver.h"
+#include "JSDOMGlobalObject.h"
 #include "JSDOMImplementation.h"
 #include "JSDOMSelection.h"
 #include "JSDOMWindow.h"
@@ -54,6 +54,7 @@
 #include "JSElement.h"
 #include "JSEntityReference.h"
 #include "JSEvent.h"
+#include "JSEventListener.h"
 #include "JSHTMLCollection.h"
 #include "JSHTMLElement.h"
 #include "JSNode.h"
@@ -83,20 +84,19 @@
 #include "XPathExpression.h"
 #include "XPathNSResolver.h"
 #include "XPathResult.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDocument)
+ASSERT_CLASS_FITS_IN_CELL(JSDocument);
 
 /* Hash table */
 
-static const HashTableValue JSDocumentTableValues[31] =
+static const HashTableValue JSDocumentTableValues[69] =
 {
     { "doctype", DontDelete|ReadOnly, (intptr_t)jsDocumentDoctype, (intptr_t)0 },
     { "implementation", DontDelete|ReadOnly, (intptr_t)jsDocumentImplementation, (intptr_t)0 },
@@ -127,15 +127,53 @@ static const HashTableValue JSDocumentTableValues[31] =
     { "characterSet", DontDelete|ReadOnly, (intptr_t)jsDocumentCharacterSet, (intptr_t)0 },
     { "preferredStylesheetSet", DontDelete|ReadOnly, (intptr_t)jsDocumentPreferredStylesheetSet, (intptr_t)0 },
     { "selectedStylesheetSet", DontDelete, (intptr_t)jsDocumentSelectedStylesheetSet, (intptr_t)setJSDocumentSelectedStylesheetSet },
+    { "onabort", DontDelete|DontEnum, (intptr_t)jsDocumentOnabort, (intptr_t)setJSDocumentOnabort },
+    { "onblur", DontDelete|DontEnum, (intptr_t)jsDocumentOnblur, (intptr_t)setJSDocumentOnblur },
+    { "onchange", DontDelete|DontEnum, (intptr_t)jsDocumentOnchange, (intptr_t)setJSDocumentOnchange },
+    { "onclick", DontDelete|DontEnum, (intptr_t)jsDocumentOnclick, (intptr_t)setJSDocumentOnclick },
+    { "oncontextmenu", DontDelete|DontEnum, (intptr_t)jsDocumentOncontextmenu, (intptr_t)setJSDocumentOncontextmenu },
+    { "ondblclick", DontDelete|DontEnum, (intptr_t)jsDocumentOndblclick, (intptr_t)setJSDocumentOndblclick },
+    { "ondrag", DontDelete|DontEnum, (intptr_t)jsDocumentOndrag, (intptr_t)setJSDocumentOndrag },
+    { "ondragend", DontDelete|DontEnum, (intptr_t)jsDocumentOndragend, (intptr_t)setJSDocumentOndragend },
+    { "ondragenter", DontDelete|DontEnum, (intptr_t)jsDocumentOndragenter, (intptr_t)setJSDocumentOndragenter },
+    { "ondragleave", DontDelete|DontEnum, (intptr_t)jsDocumentOndragleave, (intptr_t)setJSDocumentOndragleave },
+    { "ondragover", DontDelete|DontEnum, (intptr_t)jsDocumentOndragover, (intptr_t)setJSDocumentOndragover },
+    { "ondragstart", DontDelete|DontEnum, (intptr_t)jsDocumentOndragstart, (intptr_t)setJSDocumentOndragstart },
+    { "ondrop", DontDelete|DontEnum, (intptr_t)jsDocumentOndrop, (intptr_t)setJSDocumentOndrop },
+    { "onerror", DontDelete|DontEnum, (intptr_t)jsDocumentOnerror, (intptr_t)setJSDocumentOnerror },
+    { "onfocus", DontDelete|DontEnum, (intptr_t)jsDocumentOnfocus, (intptr_t)setJSDocumentOnfocus },
+    { "oninput", DontDelete|DontEnum, (intptr_t)jsDocumentOninput, (intptr_t)setJSDocumentOninput },
+    { "onkeydown", DontDelete|DontEnum, (intptr_t)jsDocumentOnkeydown, (intptr_t)setJSDocumentOnkeydown },
+    { "onkeypress", DontDelete|DontEnum, (intptr_t)jsDocumentOnkeypress, (intptr_t)setJSDocumentOnkeypress },
+    { "onkeyup", DontDelete|DontEnum, (intptr_t)jsDocumentOnkeyup, (intptr_t)setJSDocumentOnkeyup },
+    { "onload", DontDelete|DontEnum, (intptr_t)jsDocumentOnload, (intptr_t)setJSDocumentOnload },
+    { "onmousedown", DontDelete|DontEnum, (intptr_t)jsDocumentOnmousedown, (intptr_t)setJSDocumentOnmousedown },
+    { "onmousemove", DontDelete|DontEnum, (intptr_t)jsDocumentOnmousemove, (intptr_t)setJSDocumentOnmousemove },
+    { "onmouseout", DontDelete|DontEnum, (intptr_t)jsDocumentOnmouseout, (intptr_t)setJSDocumentOnmouseout },
+    { "onmouseover", DontDelete|DontEnum, (intptr_t)jsDocumentOnmouseover, (intptr_t)setJSDocumentOnmouseover },
+    { "onmouseup", DontDelete|DontEnum, (intptr_t)jsDocumentOnmouseup, (intptr_t)setJSDocumentOnmouseup },
+    { "onmousewheel", DontDelete|DontEnum, (intptr_t)jsDocumentOnmousewheel, (intptr_t)setJSDocumentOnmousewheel },
+    { "onscroll", DontDelete|DontEnum, (intptr_t)jsDocumentOnscroll, (intptr_t)setJSDocumentOnscroll },
+    { "onselect", DontDelete|DontEnum, (intptr_t)jsDocumentOnselect, (intptr_t)setJSDocumentOnselect },
+    { "onsubmit", DontDelete|DontEnum, (intptr_t)jsDocumentOnsubmit, (intptr_t)setJSDocumentOnsubmit },
+    { "onbeforecut", DontDelete|DontEnum, (intptr_t)jsDocumentOnbeforecut, (intptr_t)setJSDocumentOnbeforecut },
+    { "oncut", DontDelete|DontEnum, (intptr_t)jsDocumentOncut, (intptr_t)setJSDocumentOncut },
+    { "onbeforecopy", DontDelete|DontEnum, (intptr_t)jsDocumentOnbeforecopy, (intptr_t)setJSDocumentOnbeforecopy },
+    { "oncopy", DontDelete|DontEnum, (intptr_t)jsDocumentOncopy, (intptr_t)setJSDocumentOncopy },
+    { "onbeforepaste", DontDelete|DontEnum, (intptr_t)jsDocumentOnbeforepaste, (intptr_t)setJSDocumentOnbeforepaste },
+    { "onpaste", DontDelete|DontEnum, (intptr_t)jsDocumentOnpaste, (intptr_t)setJSDocumentOnpaste },
+    { "onreset", DontDelete|DontEnum, (intptr_t)jsDocumentOnreset, (intptr_t)setJSDocumentOnreset },
+    { "onsearch", DontDelete|DontEnum, (intptr_t)jsDocumentOnsearch, (intptr_t)setJSDocumentOnsearch },
+    { "onselectstart", DontDelete|DontEnum, (intptr_t)jsDocumentOnselectstart, (intptr_t)setJSDocumentOnselectstart },
     { "constructor", DontEnum|ReadOnly, (intptr_t)jsDocumentConstructor, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static const HashTable JSDocumentTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 255, JSDocumentTableValues, 0 };
+    { 2047, JSDocumentTableValues, 0 };
 #else
-    { 71, 63, JSDocumentTableValues, 0 };
+    { 259, 255, JSDocumentTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -157,13 +195,13 @@ public:
     JSDocumentConstructor(ExecState* exec)
         : DOMObject(JSDocumentConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSDocumentPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSDocumentPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -228,9 +266,9 @@ static const HashTable JSDocumentPrototypeTable =
 
 const ClassInfo JSDocumentPrototype::s_info = { "DocumentPrototype", 0, &JSDocumentPrototypeTable, 0 };
 
-JSObject* JSDocumentPrototype::self(ExecState* exec)
+JSObject* JSDocumentPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSDocument>(exec);
+    return getDOMPrototype<JSDocument>(exec, globalObject);
 }
 
 bool JSDocumentPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -238,10 +276,10 @@ bool JSDocumentPrototype::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticFunctionSlot<JSObject>(exec, &JSDocumentPrototypeTable, this, propertyName, slot);
 }
 
-const ClassInfo JSDocument::s_info = { "Document", &JSEventTargetNode::s_info, &JSDocumentTable, 0 };
+const ClassInfo JSDocument::s_info = { "Document", &JSNode::s_info, &JSDocumentTable, 0 };
 
 JSDocument::JSDocument(PassRefPtr<Structure> structure, PassRefPtr<Document> impl)
-    : JSEventTargetNode(structure, impl)
+    : JSNode(structure, impl)
 {
 }
 
@@ -250,194 +288,640 @@ JSDocument::~JSDocument()
     forgetDOMObject(*Heap::heap(this)->globalData(), static_cast<Document*>(impl()));
 }
 
-JSObject* JSDocument::createPrototype(ExecState* exec)
+JSObject* JSDocument::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSDocumentPrototype(JSDocumentPrototype::createStructure(JSEventTargetNodePrototype::self(exec)));
+    return new (exec) JSDocumentPrototype(JSDocumentPrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
-JSValuePtr jsDocumentDoctype(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDoctype(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->doctype()));
 }
 
-JSValuePtr jsDocumentImplementation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentImplementation(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->implementation()));
 }
 
-JSValuePtr jsDocumentDocumentElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDocumentElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->documentElement()));
 }
 
-JSValuePtr jsDocumentInputEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentInputEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->inputEncoding());
 }
 
-JSValuePtr jsDocumentXMLEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentXMLEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->xmlEncoding());
 }
 
-JSValuePtr jsDocumentXMLVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentXMLVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->xmlVersion());
 }
 
-JSValuePtr jsDocumentXMLStandalone(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentXMLStandalone(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->xmlStandalone());
 }
 
-JSValuePtr jsDocumentDocumentURI(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDocumentURI(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->documentURI());
 }
 
-JSValuePtr jsDocumentDefaultView(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDefaultView(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->defaultView()));
 }
 
-JSValuePtr jsDocumentStyleSheets(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentStyleSheets(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->styleSheets()));
 }
 
-JSValuePtr jsDocumentTitle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTitle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->title());
 }
 
-JSValuePtr jsDocumentReferrer(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentReferrer(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->referrer());
 }
 
-JSValuePtr jsDocumentDomain(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDomain(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->domain());
 }
 
-JSValuePtr jsDocumentURL(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentURL(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->url());
 }
 
-JSValuePtr jsDocumentCookie(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentCookie(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->cookie());
 }
 
-JSValuePtr jsDocumentBody(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentBody(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->body()));
 }
 
-JSValuePtr jsDocumentImages(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentImages(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->images()));
 }
 
-JSValuePtr jsDocumentApplets(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentApplets(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->applets()));
 }
 
-JSValuePtr jsDocumentLinks(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentLinks(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->links()));
 }
 
-JSValuePtr jsDocumentForms(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentForms(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->forms()));
 }
 
-JSValuePtr jsDocumentAnchors(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentAnchors(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->anchors()));
 }
 
-JSValuePtr jsDocumentLastModified(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentLastModified(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->lastModified());
 }
 
-JSValuePtr jsDocumentLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSDocument*>(asObject(slot.slotBase()))->location(exec);
 }
 
-JSValuePtr jsDocumentCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsStringOrUndefined(exec, imp->charset());
 }
 
-JSValuePtr jsDocumentDefaultCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentDefaultCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsStringOrUndefined(exec, imp->defaultCharset());
 }
 
-JSValuePtr jsDocumentReadyState(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentReadyState(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsStringOrUndefined(exec, imp->readyState());
 }
 
-JSValuePtr jsDocumentCharacterSet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentCharacterSet(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->characterSet());
 }
 
-JSValuePtr jsDocumentPreferredStylesheetSet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentPreferredStylesheetSet(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->preferredStylesheetSet());
 }
 
-JSValuePtr jsDocumentSelectedStylesheetSet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentSelectedStylesheetSet(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->selectedStylesheetSet());
 }
 
-JSValuePtr jsDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onabort()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnblur(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onblur()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onchange()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onclick()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOncontextmenu(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->oncontextmenu()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOndblclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondblclick()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOndrag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondrag()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOndragend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragend()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOndragenter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragenter()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOndragleave(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragleave()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOndragover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragover()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOndragstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragstart()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOndrop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondrop()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onerror()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnfocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onfocus()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOninput(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->oninput()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnkeydown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onkeydown()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnkeypress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onkeypress()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnkeyup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onkeyup()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onload()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnmousedown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmousedown()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnmousemove(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmousemove()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnmouseout(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmouseout()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnmouseover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmouseover()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnmouseup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmouseup()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnmousewheel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmousewheel()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnscroll(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onscroll()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnselect(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onselect()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnsubmit(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onsubmit()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnbeforecut(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onbeforecut()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOncut(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->oncut()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnbeforecopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onbeforecopy()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOncopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->oncopy()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnbeforepaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onbeforepaste()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnpaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onpaste()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnreset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onreset()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnsearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onsearch()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentOnselectstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onselectstart()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSDocument*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSDocument::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSDocument::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSDocument, Base>(exec, propertyName, value, &JSDocumentTable, this, slot);
 }
 
-void setJSDocumentXMLVersion(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDocumentXMLVersion(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -445,39 +929,39 @@ void setJSDocumentXMLVersion(ExecState* exec, JSObject* thisObject, JSValuePtr v
     setDOMException(exec, ec);
 }
 
-void setJSDocumentXMLStandalone(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDocumentXMLStandalone(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
     ExceptionCode ec = 0;
-    imp->setXMLStandalone(value->toBoolean(exec), ec);
+    imp->setXMLStandalone(value.toBoolean(exec), ec);
     setDOMException(exec, ec);
 }
 
-void setJSDocumentDocumentURI(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDocumentDocumentURI(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
     imp->setDocumentURI(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSDocumentTitle(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDocumentTitle(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
     imp->setTitle(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSDocumentDomain(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDocumentDomain(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
     imp->setDomain(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSDocumentCookie(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDocumentCookie(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
     imp->setCookie(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSDocumentBody(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDocumentBody(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -485,565 +969,981 @@ void setJSDocumentBody(ExecState* exec, JSObject* thisObject, JSValuePtr value)
     setDOMException(exec, ec);
 }
 
-void setJSDocumentLocation(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDocumentLocation(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSDocument*>(thisObject)->setLocation(exec, value);
 }
 
-void setJSDocumentCharset(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDocumentCharset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
     imp->setCharset(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSDocumentSelectedStylesheetSet(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSDocumentSelectedStylesheetSet(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
     imp->setSelectedStylesheetSet(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSDocument::getConstructor(ExecState* exec)
+void setJSDocumentOnabort(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnabort(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnblur(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnblur(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnchange(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnchange(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnclick(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnclick(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOncontextmenu(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOncontextmenu(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOndblclick(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndblclick(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOndrag(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndrag(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOndragend(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndragend(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOndragenter(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndragenter(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOndragleave(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndragleave(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOndragover(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndragover(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOndragstart(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndragstart(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOndrop(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndrop(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnfocus(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnfocus(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOninput(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOninput(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnkeydown(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnkeydown(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnkeypress(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnkeypress(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnkeyup(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnkeyup(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnload(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnload(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnmousedown(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnmousedown(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnmousemove(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnmousemove(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnmouseout(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnmouseout(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnmouseover(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnmouseover(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnmouseup(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnmouseup(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnmousewheel(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnmousewheel(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnscroll(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnscroll(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnselect(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnselect(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnsubmit(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnsubmit(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnbeforecut(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnbeforecut(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOncut(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOncut(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnbeforecopy(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnbeforecopy(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOncopy(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOncopy(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnbeforepaste(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnbeforepaste(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnpaste(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnpaste(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnreset(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnreset(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnsearch(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnsearch(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSDocumentOnselectstart(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Document* imp = static_cast<Document*>(static_cast<JSDocument*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnselectstart(globalObject->createJSAttributeEventListener(value));
+}
+
+JSValue JSDocument::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSDocumentConstructor>(exec);
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& tagName = valueToStringWithNullCheck(exec, args.at(exec, 0));
+    const UString& tagName = valueToStringWithNullCheck(exec, args.at(0));
 
 
-    JSC::JSValuePtr result = toJSNewlyCreated(exec, WTF::getPtr(imp->createElement(tagName, ec)));
+    JSC::JSValue result = toJSNewlyCreated(exec, WTF::getPtr(imp->createElement(tagName, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateDocumentFragment(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateDocumentFragment(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createDocumentFragment()));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createDocumentFragment()));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateTextNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateTextNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& data = args.at(exec, 0)->toString(exec);
+    const UString& data = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJSNewlyCreated(exec, WTF::getPtr(imp->createTextNode(data)));
+    JSC::JSValue result = toJSNewlyCreated(exec, WTF::getPtr(imp->createTextNode(data)));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateComment(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateComment(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& data = args.at(exec, 0)->toString(exec);
+    const UString& data = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJSNewlyCreated(exec, WTF::getPtr(imp->createComment(data)));
+    JSC::JSValue result = toJSNewlyCreated(exec, WTF::getPtr(imp->createComment(data)));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateCDATASection(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateCDATASection(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& data = args.at(exec, 0)->toString(exec);
+    const UString& data = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJSNewlyCreated(exec, WTF::getPtr(imp->createCDATASection(data, ec)));
+    JSC::JSValue result = toJSNewlyCreated(exec, WTF::getPtr(imp->createCDATASection(data, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateProcessingInstruction(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateProcessingInstruction(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& target = args.at(exec, 0)->toString(exec);
-    const UString& data = args.at(exec, 1)->toString(exec);
+    const UString& target = args.at(0).toString(exec);
+    const UString& data = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = toJSNewlyCreated(exec, WTF::getPtr(imp->createProcessingInstruction(target, data, ec)));
+    JSC::JSValue result = toJSNewlyCreated(exec, WTF::getPtr(imp->createProcessingInstruction(target, data, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJSNewlyCreated(exec, WTF::getPtr(imp->createAttribute(name, ec)));
+    JSC::JSValue result = toJSNewlyCreated(exec, WTF::getPtr(imp->createAttribute(name, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateEntityReference(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateEntityReference(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJSNewlyCreated(exec, WTF::getPtr(imp->createEntityReference(name, ec)));
+    JSC::JSValue result = toJSNewlyCreated(exec, WTF::getPtr(imp->createEntityReference(name, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionGetElementsByTagName(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByTagName(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& tagname = args.at(exec, 0)->toString(exec);
+    const UString& tagname = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getElementsByTagName(tagname)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getElementsByTagName(tagname)));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionImportNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionImportNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* importedNode = toNode(args.at(exec, 0));
-    bool deep = args.at(exec, 1)->toBoolean(exec);
+    Node* importedNode = toNode(args.at(0));
+    bool deep = args.at(1).toBoolean(exec);
 
 
-    JSC::JSValuePtr result = toJSNewlyCreated(exec, WTF::getPtr(imp->importNode(importedNode, deep, ec)));
+    JSC::JSValue result = toJSNewlyCreated(exec, WTF::getPtr(imp->importNode(importedNode, deep, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateElementNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateElementNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    const UString& qualifiedName = valueToStringWithNullCheck(exec, args.at(exec, 1));
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    const UString& qualifiedName = valueToStringWithNullCheck(exec, args.at(1));
 
 
-    JSC::JSValuePtr result = toJSNewlyCreated(exec, WTF::getPtr(imp->createElementNS(namespaceURI, qualifiedName, ec)));
+    JSC::JSValue result = toJSNewlyCreated(exec, WTF::getPtr(imp->createElementNS(namespaceURI, qualifiedName, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateAttributeNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateAttributeNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    const UString& qualifiedName = valueToStringWithNullCheck(exec, args.at(exec, 1));
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    const UString& qualifiedName = valueToStringWithNullCheck(exec, args.at(1));
 
 
-    JSC::JSValuePtr result = toJSNewlyCreated(exec, WTF::getPtr(imp->createAttributeNS(namespaceURI, qualifiedName, ec)));
+    JSC::JSValue result = toJSNewlyCreated(exec, WTF::getPtr(imp->createAttributeNS(namespaceURI, qualifiedName, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionGetElementsByTagNameNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByTagNameNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    const UString& localName = args.at(exec, 1)->toString(exec);
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    const UString& localName = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getElementsByTagNameNS(namespaceURI, localName)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getElementsByTagNameNS(namespaceURI, localName)));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionGetElementById(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementById(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& elementId = args.at(exec, 0)->toString(exec);
+    const UString& elementId = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getElementById(elementId)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getElementById(elementId)));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionAdoptNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionAdoptNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* source = toNode(args.at(exec, 0));
+    Node* source = toNode(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->adoptNode(source, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->adoptNode(source, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& eventType = args.at(exec, 0)->toString(exec);
+    const UString& eventType = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createEvent(eventType, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createEvent(eventType, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateRange(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateRange(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createRange()));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createRange()));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateNodeIterator(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateNodeIterator(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* root = toNode(args.at(exec, 0));
-    unsigned whatToShow = args.at(exec, 1)->toInt32(exec);
-    RefPtr<NodeFilter> filter = toNodeFilter(args.at(exec, 2));
-    bool expandEntityReferences = args.at(exec, 3)->toBoolean(exec);
+    Node* root = toNode(args.at(0));
+    unsigned whatToShow = args.at(1).toInt32(exec);
+    RefPtr<NodeFilter> filter = toNodeFilter(args.at(2));
+    bool expandEntityReferences = args.at(3).toBoolean(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createNodeIterator(root, whatToShow, filter.get(), expandEntityReferences, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createNodeIterator(root, whatToShow, filter.get(), expandEntityReferences, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateTreeWalker(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateTreeWalker(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* root = toNode(args.at(exec, 0));
-    unsigned whatToShow = args.at(exec, 1)->toInt32(exec);
-    RefPtr<NodeFilter> filter = toNodeFilter(args.at(exec, 2));
-    bool expandEntityReferences = args.at(exec, 3)->toBoolean(exec);
+    Node* root = toNode(args.at(0));
+    unsigned whatToShow = args.at(1).toInt32(exec);
+    RefPtr<NodeFilter> filter = toNodeFilter(args.at(2));
+    bool expandEntityReferences = args.at(3).toBoolean(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createTreeWalker(root, whatToShow, filter.get(), expandEntityReferences, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createTreeWalker(root, whatToShow, filter.get(), expandEntityReferences, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionGetOverrideStyle(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetOverrideStyle(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    Element* element = toElement(args.at(exec, 0));
-    const UString& pseudoElement = args.at(exec, 1)->toString(exec);
+    Element* element = toElement(args.at(0));
+    const UString& pseudoElement = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getOverrideStyle(element, pseudoElement)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getOverrideStyle(element, pseudoElement)));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateExpression(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateExpression(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& expression = args.at(exec, 0)->toString(exec);
+    const UString& expression = args.at(0).toString(exec);
     RefPtr<XPathNSResolver> customResolver;
-    XPathNSResolver* resolver = toXPathNSResolver(args.at(exec, 1));
+    XPathNSResolver* resolver = toXPathNSResolver(args.at(1));
     if (!resolver) {
-        customResolver = JSCustomXPathNSResolver::create(exec, args.at(exec, 1));
+        customResolver = JSCustomXPathNSResolver::create(exec, args.at(1));
         if (exec->hadException())
             return jsUndefined();
         resolver = customResolver.get();
     }
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createExpression(expression, resolver, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createExpression(expression, resolver, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionCreateNSResolver(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateNSResolver(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    Node* nodeResolver = toNode(args.at(exec, 0));
+    Node* nodeResolver = toNode(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createNSResolver(nodeResolver)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createNSResolver(nodeResolver)));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionEvaluate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionEvaluate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& expression = args.at(exec, 0)->toString(exec);
-    Node* contextNode = toNode(args.at(exec, 1));
+    const UString& expression = args.at(0).toString(exec);
+    Node* contextNode = toNode(args.at(1));
     RefPtr<XPathNSResolver> customResolver;
-    XPathNSResolver* resolver = toXPathNSResolver(args.at(exec, 2));
+    XPathNSResolver* resolver = toXPathNSResolver(args.at(2));
     if (!resolver) {
-        customResolver = JSCustomXPathNSResolver::create(exec, args.at(exec, 2));
+        customResolver = JSCustomXPathNSResolver::create(exec, args.at(2));
         if (exec->hadException())
             return jsUndefined();
         resolver = customResolver.get();
     }
-    unsigned short type = args.at(exec, 3)->toInt32(exec);
-    XPathResult* inResult = toXPathResult(args.at(exec, 4));
+    unsigned short type = args.at(3).toInt32(exec);
+    XPathResult* inResult = toXPathResult(args.at(4));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->evaluate(expression, contextNode, resolver, type, inResult, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->evaluate(expression, contextNode, resolver, type, inResult, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionExecCommand(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionExecCommand(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& command = args.at(exec, 0)->toString(exec);
-    bool userInterface = args.at(exec, 1)->toBoolean(exec);
-    const UString& value = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 2));
+    const UString& command = args.at(0).toString(exec);
+    bool userInterface = args.at(1).toBoolean(exec);
+    const UString& value = valueToStringWithUndefinedOrNullCheck(exec, args.at(2));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->execCommand(command, userInterface, value));
+    JSC::JSValue result = jsBoolean(imp->execCommand(command, userInterface, value));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionQueryCommandEnabled(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& command = args.at(exec, 0)->toString(exec);
+    const UString& command = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->queryCommandEnabled(command));
+    JSC::JSValue result = jsBoolean(imp->queryCommandEnabled(command));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionQueryCommandIndeterm(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandIndeterm(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& command = args.at(exec, 0)->toString(exec);
+    const UString& command = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->queryCommandIndeterm(command));
+    JSC::JSValue result = jsBoolean(imp->queryCommandIndeterm(command));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionQueryCommandState(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandState(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& command = args.at(exec, 0)->toString(exec);
+    const UString& command = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->queryCommandState(command));
+    JSC::JSValue result = jsBoolean(imp->queryCommandState(command));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionQueryCommandSupported(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandSupported(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& command = args.at(exec, 0)->toString(exec);
+    const UString& command = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->queryCommandSupported(command));
+    JSC::JSValue result = jsBoolean(imp->queryCommandSupported(command));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionQueryCommandValue(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& command = args.at(exec, 0)->toString(exec);
+    const UString& command = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsStringOrFalse(exec, imp->queryCommandValue(command));
+    JSC::JSValue result = jsStringOrFalse(exec, imp->queryCommandValue(command));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionGetElementsByName(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByName(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& elementName = args.at(exec, 0)->toString(exec);
+    const UString& elementName = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getElementsByName(elementName)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getElementsByName(elementName)));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionElementFromPoint(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionElementFromPoint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    int x = args.at(exec, 0)->toInt32(exec);
-    int y = args.at(exec, 1)->toInt32(exec);
+    int x = args.at(0).toInt32(exec);
+    int y = args.at(1).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->elementFromPoint(x, y)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->elementFromPoint(x, y)));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionGetSelection(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetSelection(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getSelection()));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getSelection()));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionGetCSSCanvasContext(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetCSSCanvasContext(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& contextId = args.at(exec, 0)->toString(exec);
-    const UString& name = args.at(exec, 1)->toString(exec);
-    int width = args.at(exec, 2)->toInt32(exec);
-    int height = args.at(exec, 3)->toInt32(exec);
+    const UString& contextId = args.at(0).toString(exec);
+    const UString& name = args.at(1).toString(exec);
+    int width = args.at(2).toInt32(exec);
+    int height = args.at(3).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getCSSCanvasContext(contextId, name, width, height)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getCSSCanvasContext(contextId, name, width, height)));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionGetElementsByClassName(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByClassName(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
-    const UString& tagname = args.at(exec, 0)->toString(exec);
+    const UString& tagname = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getElementsByClassName(tagname)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getElementsByClassName(tagname)));
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionQuerySelector(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQuerySelector(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& selectors = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
+    const UString& selectors = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->querySelector(selectors, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->querySelector(selectors, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentPrototypeFunctionQuerySelectorAll(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQuerySelectorAll(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocument::s_info))
         return throwError(exec, TypeError);
     JSDocument* castedThisObj = static_cast<JSDocument*>(asObject(thisValue));
     Document* imp = static_cast<Document*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& selectors = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
+    const UString& selectors = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->querySelectorAll(selectors, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->querySelectorAll(selectors, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-Document* toDocument(JSC::JSValuePtr value)
+Document* toDocument(JSC::JSValue value)
 {
-    return value->isObject(&JSDocument::s_info) ? static_cast<JSDocument*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSDocument::s_info) ? static_cast<JSDocument*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocument.h b/src/3rdparty/webkit/WebCore/generated/JSDocument.h
index f3430b7..c2032ea 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocument.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocument.h
@@ -21,37 +21,38 @@
 #ifndef JSDocument_h
 #define JSDocument_h
 
-#include "JSEventTargetNode.h"
+#include "Document.h"
+#include "JSNode.h"
 #include <runtime/Lookup.h>
 #include <wtf/AlwaysInline.h>
-#include "Document.h"
+
 namespace WebCore {
 
 class Document;
 
-class JSDocument : public JSEventTargetNode {
-    typedef JSEventTargetNode Base;
+class JSDocument : public JSNode {
+    typedef JSNode Base;
 public:
     JSDocument(PassRefPtr<JSC::Structure>, PassRefPtr<Document>);
     virtual ~JSDocument();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void mark();
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom attributes
-    JSC::JSValuePtr location(JSC::ExecState*) const;
-    void setLocation(JSC::ExecState*, JSC::JSValuePtr);
+    JSC::JSValue location(JSC::ExecState*) const;
+    void setLocation(JSC::ExecState*, JSC::JSValue);
     Document* impl() const
     {
         return static_cast<Document*>(Base::impl());
@@ -63,16 +64,17 @@ ALWAYS_INLINE bool JSDocument::getOwnPropertySlot(JSC::ExecState* exec, const JS
     return JSC::getStaticValueSlot<JSDocument, Base>(exec, s_info.staticPropHashTable, this, propertyName, slot);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Document*);
-Document* toDocument(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Document*);
+Document* toDocument(JSC::JSValue);
 
 class JSDocumentPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -81,84 +83,160 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateDocumentFragment(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateTextNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateComment(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateCDATASection(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateProcessingInstruction(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateEntityReference(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionGetElementsByTagName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionImportNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateElementNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateAttributeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionGetElementsByTagNameNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionGetElementById(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionAdoptNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateNodeIterator(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateTreeWalker(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionGetOverrideStyle(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateExpression(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionCreateNSResolver(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionEvaluate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionExecCommand(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionQueryCommandEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionQueryCommandIndeterm(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionQueryCommandState(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionQueryCommandSupported(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionQueryCommandValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionGetElementsByName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionElementFromPoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionGetSelection(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionGetCSSCanvasContext(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionGetElementsByClassName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionQuerySelector(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentPrototypeFunctionQuerySelectorAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateDocumentFragment(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateTextNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateComment(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateCDATASection(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateProcessingInstruction(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateEntityReference(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByTagName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionImportNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateElementNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateAttributeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByTagNameNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementById(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionAdoptNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateNodeIterator(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateTreeWalker(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetOverrideStyle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateExpression(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionCreateNSResolver(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionEvaluate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionExecCommand(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandIndeterm(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandState(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandSupported(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQueryCommandValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionElementFromPoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetSelection(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetCSSCanvasContext(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionGetElementsByClassName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQuerySelector(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentPrototypeFunctionQuerySelectorAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsDocumentDoctype(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentImplementation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentDocumentElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentInputEncoding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentXMLEncoding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentXMLVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDocumentXMLVersion(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDocumentXMLStandalone(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDocumentXMLStandalone(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDocumentDocumentURI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDocumentDocumentURI(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDocumentDefaultView(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentStyleSheets(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentTitle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDocumentTitle(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDocumentReferrer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentDomain(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDocumentDomain(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDocumentURL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentCookie(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDocumentCookie(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDocumentBody(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDocumentBody(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDocumentImages(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentApplets(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentLinks(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentForms(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentAnchors(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentLastModified(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDocumentLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDocumentCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDocumentCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDocumentDefaultCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentReadyState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentCharacterSet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentPreferredStylesheetSet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentSelectedStylesheetSet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSDocumentSelectedStylesheetSet(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentDoctype(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentImplementation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentDocumentElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentInputEncoding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentXMLEncoding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentXMLVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentXMLVersion(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentXMLStandalone(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentXMLStandalone(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentDocumentURI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentDocumentURI(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentDefaultView(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentStyleSheets(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentTitle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentTitle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentReferrer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentDomain(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentDomain(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentURL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentCookie(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentCookie(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentBody(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentBody(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentImages(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentApplets(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentLinks(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentForms(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentAnchors(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentLastModified(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentDefaultCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentReadyState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentCharacterSet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentPreferredStylesheetSet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentSelectedStylesheetSet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentSelectedStylesheetSet(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnblur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnblur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOncontextmenu(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOncontextmenu(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOndblclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOndblclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOndrag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOndrag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOndragend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOndragend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOndragenter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOndragenter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOndragleave(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOndragleave(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOndragover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOndragover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOndragstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOndragstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOndrop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOndrop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnfocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnfocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOninput(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOninput(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnkeydown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnkeydown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnkeypress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnkeypress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnkeyup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnkeyup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnmousedown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnmousedown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnmousemove(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnmousemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnmouseout(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnmouseout(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnmouseover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnmouseover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnmouseup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnmouseup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnmousewheel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnmousewheel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnscroll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnscroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnselect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnselect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnsubmit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnsubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnbeforecut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnbeforecut(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOncut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOncut(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnbeforecopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnbeforecopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOncopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOncopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnbeforepaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnbeforepaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnpaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnpaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnreset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnreset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnsearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnsearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentOnselectstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSDocumentOnselectstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp
index 6912e40..865efd2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.cpp
@@ -19,26 +19,22 @@
 */
 
 #include "config.h"
-
 #include "JSDocumentFragment.h"
 
-#include <wtf/GetPtr.h>
-
 #include "DocumentFragment.h"
 #include "Element.h"
 #include "JSElement.h"
 #include "JSNodeList.h"
 #include "NameNodeList.h"
 #include "NodeList.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDocumentFragment)
+ASSERT_CLASS_FITS_IN_CELL(JSDocumentFragment);
 
 /* Hash table */
 
@@ -74,13 +70,13 @@ public:
     JSDocumentFragmentConstructor(ExecState* exec)
         : DOMObject(JSDocumentFragmentConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSDocumentFragmentPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSDocumentFragmentPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +107,9 @@ static const HashTable JSDocumentFragmentPrototypeTable =
 
 const ClassInfo JSDocumentFragmentPrototype::s_info = { "DocumentFragmentPrototype", 0, &JSDocumentFragmentPrototypeTable, 0 };
 
-JSObject* JSDocumentFragmentPrototype::self(ExecState* exec)
+JSObject* JSDocumentFragmentPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSDocumentFragment>(exec);
+    return getDOMPrototype<JSDocumentFragment>(exec, globalObject);
 }
 
 bool JSDocumentFragmentPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -121,16 +117,16 @@ bool JSDocumentFragmentPrototype::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticFunctionSlot<JSObject>(exec, &JSDocumentFragmentPrototypeTable, this, propertyName, slot);
 }
 
-const ClassInfo JSDocumentFragment::s_info = { "DocumentFragment", &JSEventTargetNode::s_info, &JSDocumentFragmentTable, 0 };
+const ClassInfo JSDocumentFragment::s_info = { "DocumentFragment", &JSNode::s_info, &JSDocumentFragmentTable, 0 };
 
 JSDocumentFragment::JSDocumentFragment(PassRefPtr<Structure> structure, PassRefPtr<DocumentFragment> impl)
-    : JSEventTargetNode(structure, impl)
+    : JSNode(structure, impl)
 {
 }
 
-JSObject* JSDocumentFragment::createPrototype(ExecState* exec)
+JSObject* JSDocumentFragment::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSDocumentFragmentPrototype(JSDocumentFragmentPrototype::createStructure(JSEventTargetNodePrototype::self(exec)));
+    return new (exec) JSDocumentFragmentPrototype(JSDocumentFragmentPrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
 bool JSDocumentFragment::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -138,41 +134,43 @@ bool JSDocumentFragment::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSDocumentFragment, Base>(exec, &JSDocumentFragmentTable, this, propertyName, slot);
 }
 
-JSValuePtr jsDocumentFragmentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentFragmentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSDocumentFragment*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSDocumentFragment::getConstructor(ExecState* exec)
+JSValue JSDocumentFragment::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSDocumentFragmentConstructor>(exec);
 }
 
-JSValuePtr jsDocumentFragmentPrototypeFunctionQuerySelector(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentFragmentPrototypeFunctionQuerySelector(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocumentFragment::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocumentFragment::s_info))
         return throwError(exec, TypeError);
     JSDocumentFragment* castedThisObj = static_cast<JSDocumentFragment*>(asObject(thisValue));
     DocumentFragment* imp = static_cast<DocumentFragment*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& selectors = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
+    const UString& selectors = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->querySelector(selectors, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->querySelector(selectors, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsDocumentFragmentPrototypeFunctionQuerySelectorAll(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsDocumentFragmentPrototypeFunctionQuerySelectorAll(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSDocumentFragment::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSDocumentFragment::s_info))
         return throwError(exec, TypeError);
     JSDocumentFragment* castedThisObj = static_cast<JSDocumentFragment*>(asObject(thisValue));
     DocumentFragment* imp = static_cast<DocumentFragment*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& selectors = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
+    const UString& selectors = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->querySelectorAll(selectors, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->querySelectorAll(selectors, ec)));
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h
index b157827..d5f57a3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentFragment.h
@@ -21,37 +21,38 @@
 #ifndef JSDocumentFragment_h
 #define JSDocumentFragment_h
 
-#include "JSEventTargetNode.h"
+#include "JSNode.h"
 
 namespace WebCore {
 
 class DocumentFragment;
 
-class JSDocumentFragment : public JSEventTargetNode {
-    typedef JSEventTargetNode Base;
+class JSDocumentFragment : public JSNode {
+    typedef JSNode Base;
 public:
     JSDocumentFragment(PassRefPtr<JSC::Structure>, PassRefPtr<DocumentFragment>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSDocumentFragmentPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,11 +61,11 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsDocumentFragmentPrototypeFunctionQuerySelector(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsDocumentFragmentPrototypeFunctionQuerySelectorAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentFragmentPrototypeFunctionQuerySelector(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsDocumentFragmentPrototypeFunctionQuerySelectorAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsDocumentFragmentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentFragmentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp
index fb106b2..43e7a8c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.cpp
@@ -19,25 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSDocumentType.h"
 
-#include <wtf/GetPtr.h>
-
 #include "DocumentType.h"
 #include "JSNamedNodeMap.h"
 #include "KURL.h"
-#include "NamedAttrMap.h"
 #include "NamedNodeMap.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSDocumentType)
+ASSERT_CLASS_FITS_IN_CELL(JSDocumentType);
 
 /* Hash table */
 
@@ -79,13 +74,13 @@ public:
     JSDocumentTypeConstructor(ExecState* exec)
         : DOMObject(JSDocumentTypeConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSDocumentTypePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSDocumentTypePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -114,9 +109,9 @@ static const HashTable JSDocumentTypePrototypeTable =
 
 const ClassInfo JSDocumentTypePrototype::s_info = { "DocumentTypePrototype", 0, &JSDocumentTypePrototypeTable, 0 };
 
-JSObject* JSDocumentTypePrototype::self(ExecState* exec)
+JSObject* JSDocumentTypePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSDocumentType>(exec);
+    return getDOMPrototype<JSDocumentType>(exec, globalObject);
 }
 
 const ClassInfo JSDocumentType::s_info = { "DocumentType", &JSNode::s_info, &JSDocumentTypeTable, 0 };
@@ -126,9 +121,9 @@ JSDocumentType::JSDocumentType(PassRefPtr<Structure> structure, PassRefPtr<Docum
 {
 }
 
-JSObject* JSDocumentType::createPrototype(ExecState* exec)
+JSObject* JSDocumentType::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSDocumentTypePrototype(JSDocumentTypePrototype::createStructure(JSNodePrototype::self(exec)));
+    return new (exec) JSDocumentTypePrototype(JSDocumentTypePrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
 bool JSDocumentType::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -136,54 +131,60 @@ bool JSDocumentType::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSDocumentType, Base>(exec, &JSDocumentTypeTable, this, propertyName, slot);
 }
 
-JSValuePtr jsDocumentTypeName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(static_cast<JSDocumentType*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsDocumentTypeEntities(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeEntities(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(static_cast<JSDocumentType*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->entities()));
 }
 
-JSValuePtr jsDocumentTypeNotations(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeNotations(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(static_cast<JSDocumentType*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->notations()));
 }
 
-JSValuePtr jsDocumentTypePublicId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypePublicId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(static_cast<JSDocumentType*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->publicId());
 }
 
-JSValuePtr jsDocumentTypeSystemId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeSystemId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(static_cast<JSDocumentType*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->systemId());
 }
 
-JSValuePtr jsDocumentTypeInternalSubset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeInternalSubset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     DocumentType* imp = static_cast<DocumentType*>(static_cast<JSDocumentType*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->internalSubset());
 }
 
-JSValuePtr jsDocumentTypeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsDocumentTypeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSDocumentType*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSDocumentType::getConstructor(ExecState* exec)
+JSValue JSDocumentType::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSDocumentTypeConstructor>(exec);
 }
 
-DocumentType* toDocumentType(JSC::JSValuePtr value)
+DocumentType* toDocumentType(JSC::JSValue value)
 {
-    return value->isObject(&JSDocumentType::s_info) ? static_cast<JSDocumentType*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSDocumentType::s_info) ? static_cast<JSDocumentType*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h
index 56f3c7b..10a5530 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSDocumentType.h
@@ -21,8 +21,9 @@
 #ifndef JSDocumentType_h
 #define JSDocumentType_h
 
-#include "JSNode.h"
 #include "DocumentType.h"
+#include "JSNode.h"
+
 namespace WebCore {
 
 class DocumentType;
@@ -31,28 +32,29 @@ class JSDocumentType : public JSNode {
     typedef JSNode Base;
 public:
     JSDocumentType(PassRefPtr<JSC::Structure>, PassRefPtr<DocumentType>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     DocumentType* impl() const
     {
         return static_cast<DocumentType*>(Base::impl());
     }
 };
 
-DocumentType* toDocumentType(JSC::JSValuePtr);
+DocumentType* toDocumentType(JSC::JSValue);
 
 class JSDocumentTypePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSDocumentTypePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -60,13 +62,13 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsDocumentTypeName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentTypeEntities(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentTypeNotations(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentTypePublicId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentTypeSystemId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentTypeInternalSubset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsDocumentTypeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentTypeName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentTypeEntities(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentTypeNotations(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentTypePublicId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentTypeSystemId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentTypeInternalSubset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsDocumentTypeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
index 8ecc679..afa1d93 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSElement.cpp
@@ -19,36 +19,41 @@
 */
 
 #include "config.h"
-
 #include "JSElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "Attr.h"
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
+#include "ClientRect.h"
+#include "ClientRectList.h"
 #include "Element.h"
+#include "EventListener.h"
+#include "Frame.h"
 #include "JSAttr.h"
 #include "JSCSSStyleDeclaration.h"
+#include "JSClientRect.h"
+#include "JSClientRectList.h"
+#include "JSDOMGlobalObject.h"
 #include "JSElement.h"
+#include "JSEventListener.h"
 #include "JSNodeList.h"
 #include "KURL.h"
 #include "NameNodeList.h"
 #include "NodeList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSElement)
+ASSERT_CLASS_FITS_IN_CELL(JSElement);
 
 /* Hash table */
 
-static const HashTableValue JSElementTableValues[22] =
+static const HashTableValue JSElementTableValues[60] =
 {
     { "tagName", DontDelete|ReadOnly, (intptr_t)jsElementTagName, (intptr_t)0 },
     { "style", DontDelete|ReadOnly, (intptr_t)jsElementStyle, (intptr_t)0 },
@@ -70,6 +75,44 @@ static const HashTableValue JSElementTableValues[22] =
     { "previousElementSibling", DontDelete|ReadOnly, (intptr_t)jsElementPreviousElementSibling, (intptr_t)0 },
     { "nextElementSibling", DontDelete|ReadOnly, (intptr_t)jsElementNextElementSibling, (intptr_t)0 },
     { "childElementCount", DontDelete|ReadOnly, (intptr_t)jsElementChildElementCount, (intptr_t)0 },
+    { "onabort", DontDelete|DontEnum, (intptr_t)jsElementOnabort, (intptr_t)setJSElementOnabort },
+    { "onblur", DontDelete|DontEnum, (intptr_t)jsElementOnblur, (intptr_t)setJSElementOnblur },
+    { "onchange", DontDelete|DontEnum, (intptr_t)jsElementOnchange, (intptr_t)setJSElementOnchange },
+    { "onclick", DontDelete|DontEnum, (intptr_t)jsElementOnclick, (intptr_t)setJSElementOnclick },
+    { "oncontextmenu", DontDelete|DontEnum, (intptr_t)jsElementOncontextmenu, (intptr_t)setJSElementOncontextmenu },
+    { "ondblclick", DontDelete|DontEnum, (intptr_t)jsElementOndblclick, (intptr_t)setJSElementOndblclick },
+    { "ondrag", DontDelete|DontEnum, (intptr_t)jsElementOndrag, (intptr_t)setJSElementOndrag },
+    { "ondragend", DontDelete|DontEnum, (intptr_t)jsElementOndragend, (intptr_t)setJSElementOndragend },
+    { "ondragenter", DontDelete|DontEnum, (intptr_t)jsElementOndragenter, (intptr_t)setJSElementOndragenter },
+    { "ondragleave", DontDelete|DontEnum, (intptr_t)jsElementOndragleave, (intptr_t)setJSElementOndragleave },
+    { "ondragover", DontDelete|DontEnum, (intptr_t)jsElementOndragover, (intptr_t)setJSElementOndragover },
+    { "ondragstart", DontDelete|DontEnum, (intptr_t)jsElementOndragstart, (intptr_t)setJSElementOndragstart },
+    { "ondrop", DontDelete|DontEnum, (intptr_t)jsElementOndrop, (intptr_t)setJSElementOndrop },
+    { "onerror", DontDelete|DontEnum, (intptr_t)jsElementOnerror, (intptr_t)setJSElementOnerror },
+    { "onfocus", DontDelete|DontEnum, (intptr_t)jsElementOnfocus, (intptr_t)setJSElementOnfocus },
+    { "oninput", DontDelete|DontEnum, (intptr_t)jsElementOninput, (intptr_t)setJSElementOninput },
+    { "onkeydown", DontDelete|DontEnum, (intptr_t)jsElementOnkeydown, (intptr_t)setJSElementOnkeydown },
+    { "onkeypress", DontDelete|DontEnum, (intptr_t)jsElementOnkeypress, (intptr_t)setJSElementOnkeypress },
+    { "onkeyup", DontDelete|DontEnum, (intptr_t)jsElementOnkeyup, (intptr_t)setJSElementOnkeyup },
+    { "onload", DontDelete|DontEnum, (intptr_t)jsElementOnload, (intptr_t)setJSElementOnload },
+    { "onmousedown", DontDelete|DontEnum, (intptr_t)jsElementOnmousedown, (intptr_t)setJSElementOnmousedown },
+    { "onmousemove", DontDelete|DontEnum, (intptr_t)jsElementOnmousemove, (intptr_t)setJSElementOnmousemove },
+    { "onmouseout", DontDelete|DontEnum, (intptr_t)jsElementOnmouseout, (intptr_t)setJSElementOnmouseout },
+    { "onmouseover", DontDelete|DontEnum, (intptr_t)jsElementOnmouseover, (intptr_t)setJSElementOnmouseover },
+    { "onmouseup", DontDelete|DontEnum, (intptr_t)jsElementOnmouseup, (intptr_t)setJSElementOnmouseup },
+    { "onmousewheel", DontDelete|DontEnum, (intptr_t)jsElementOnmousewheel, (intptr_t)setJSElementOnmousewheel },
+    { "onscroll", DontDelete|DontEnum, (intptr_t)jsElementOnscroll, (intptr_t)setJSElementOnscroll },
+    { "onselect", DontDelete|DontEnum, (intptr_t)jsElementOnselect, (intptr_t)setJSElementOnselect },
+    { "onsubmit", DontDelete|DontEnum, (intptr_t)jsElementOnsubmit, (intptr_t)setJSElementOnsubmit },
+    { "onbeforecut", DontDelete|DontEnum, (intptr_t)jsElementOnbeforecut, (intptr_t)setJSElementOnbeforecut },
+    { "oncut", DontDelete|DontEnum, (intptr_t)jsElementOncut, (intptr_t)setJSElementOncut },
+    { "onbeforecopy", DontDelete|DontEnum, (intptr_t)jsElementOnbeforecopy, (intptr_t)setJSElementOnbeforecopy },
+    { "oncopy", DontDelete|DontEnum, (intptr_t)jsElementOncopy, (intptr_t)setJSElementOncopy },
+    { "onbeforepaste", DontDelete|DontEnum, (intptr_t)jsElementOnbeforepaste, (intptr_t)setJSElementOnbeforepaste },
+    { "onpaste", DontDelete|DontEnum, (intptr_t)jsElementOnpaste, (intptr_t)setJSElementOnpaste },
+    { "onreset", DontDelete|DontEnum, (intptr_t)jsElementOnreset, (intptr_t)setJSElementOnreset },
+    { "onsearch", DontDelete|DontEnum, (intptr_t)jsElementOnsearch, (intptr_t)setJSElementOnsearch },
+    { "onselectstart", DontDelete|DontEnum, (intptr_t)jsElementOnselectstart, (intptr_t)setJSElementOnselectstart },
     { "constructor", DontEnum|ReadOnly, (intptr_t)jsElementConstructor, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
@@ -78,7 +121,7 @@ static const HashTable JSElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 8191, JSElementTableValues, 0 };
 #else
-    { 68, 63, JSElementTableValues, 0 };
+    { 141, 127, JSElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -100,13 +143,13 @@ public:
     JSElementConstructor(ExecState* exec)
         : DOMObject(JSElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -121,7 +164,7 @@ bool JSElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier&
 
 /* Hash table for prototype */
 
-static const HashTableValue JSElementPrototypeTableValues[26] =
+static const HashTableValue JSElementPrototypeTableValues[28] =
 {
     { "getAttribute", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetAttribute, (intptr_t)1 },
     { "setAttribute", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionSetAttribute, (intptr_t)2 },
@@ -148,6 +191,8 @@ static const HashTableValue JSElementPrototypeTableValues[26] =
     { "getElementsByClassName", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetElementsByClassName, (intptr_t)1 },
     { "querySelector", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionQuerySelector, (intptr_t)1 },
     { "querySelectorAll", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionQuerySelectorAll, (intptr_t)1 },
+    { "getClientRects", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetClientRects, (intptr_t)0 },
+    { "getBoundingClientRect", DontDelete|Function, (intptr_t)jsElementPrototypeFunctionGetBoundingClientRect, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -155,14 +200,14 @@ static const HashTable JSElementPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 1023, JSElementPrototypeTableValues, 0 };
 #else
-    { 68, 63, JSElementPrototypeTableValues, 0 };
+    { 69, 63, JSElementPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSElementPrototype::s_info = { "ElementPrototype", 0, &JSElementPrototypeTable, 0 };
 
-JSObject* JSElementPrototype::self(ExecState* exec)
+JSObject* JSElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSElement>(exec);
+    return getDOMPrototype<JSElement>(exec, globalObject);
 }
 
 bool JSElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -170,351 +215,1185 @@ bool JSElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticFunctionSlot<JSObject>(exec, &JSElementPrototypeTable, this, propertyName, slot);
 }
 
-const ClassInfo JSElement::s_info = { "Element", &JSEventTargetNode::s_info, &JSElementTable, 0 };
+const ClassInfo JSElement::s_info = { "Element", &JSNode::s_info, &JSElementTable, 0 };
 
 JSElement::JSElement(PassRefPtr<Structure> structure, PassRefPtr<Element> impl)
-    : JSEventTargetNode(structure, impl)
+    : JSNode(structure, impl)
 {
 }
 
-JSObject* JSElement::createPrototype(ExecState* exec)
+JSObject* JSElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSElementPrototype(JSElementPrototype::createStructure(JSEventTargetNodePrototype::self(exec)));
+    return new (exec) JSElementPrototype(JSElementPrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
-JSValuePtr jsElementTagName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementTagName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->tagName());
 }
 
-JSValuePtr jsElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsElementOffsetLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOffsetLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->offsetLeft());
 }
 
-JSValuePtr jsElementOffsetTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOffsetTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->offsetTop());
 }
 
-JSValuePtr jsElementOffsetWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOffsetWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->offsetWidth());
 }
 
-JSValuePtr jsElementOffsetHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOffsetHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->offsetHeight());
 }
 
-JSValuePtr jsElementOffsetParent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOffsetParent(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->offsetParent()));
 }
 
-JSValuePtr jsElementClientLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementClientLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->clientLeft());
 }
 
-JSValuePtr jsElementClientTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementClientTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->clientTop());
 }
 
-JSValuePtr jsElementClientWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementClientWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->clientWidth());
 }
 
-JSValuePtr jsElementClientHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementClientHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->clientHeight());
 }
 
-JSValuePtr jsElementScrollLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementScrollLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->scrollLeft());
 }
 
-JSValuePtr jsElementScrollTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementScrollTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->scrollTop());
 }
 
-JSValuePtr jsElementScrollWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementScrollWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->scrollWidth());
 }
 
-JSValuePtr jsElementScrollHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementScrollHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->scrollHeight());
 }
 
-JSValuePtr jsElementFirstElementChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementFirstElementChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->firstElementChild()));
 }
 
-JSValuePtr jsElementLastElementChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementLastElementChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->lastElementChild()));
 }
 
-JSValuePtr jsElementPreviousElementSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementPreviousElementSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->previousElementSibling()));
 }
 
-JSValuePtr jsElementNextElementSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementNextElementSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nextElementSibling()));
 }
 
-JSValuePtr jsElementChildElementCount(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementChildElementCount(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->childElementCount());
 }
 
-JSValuePtr jsElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsElementOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onabort()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnblur(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onblur()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onchange()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onclick()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOncontextmenu(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->oncontextmenu()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOndblclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondblclick()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOndrag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondrag()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOndragend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragend()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOndragenter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragenter()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOndragleave(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragleave()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOndragover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragover()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOndragstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondragstart()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOndrop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ondrop()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onerror()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnfocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onfocus()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOninput(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->oninput()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnkeydown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onkeydown()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnkeypress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onkeypress()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnkeyup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onkeyup()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onload()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnmousedown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmousedown()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnmousemove(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmousemove()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnmouseout(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmouseout()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnmouseover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmouseover()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnmouseup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmouseup()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnmousewheel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmousewheel()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnscroll(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onscroll()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnselect(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onselect()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnsubmit(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onsubmit()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnbeforecut(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onbeforecut()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOncut(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->oncut()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnbeforecopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onbeforecopy()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOncopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->oncopy()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnbeforepaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onbeforepaste()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnpaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onpaste()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnreset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onreset()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnsearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onsearch()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementOnselectstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onselectstart()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSElement, Base>(exec, propertyName, value, &JSElementTable, this, slot);
 }
 
-void setJSElementScrollLeft(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSElementScrollLeft(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    imp->setScrollLeft(value.toInt32(exec));
+}
+
+void setJSElementScrollTop(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    imp->setScrollTop(value.toInt32(exec));
+}
+
+void setJSElementOnabort(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnabort(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOnblur(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnblur(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOnchange(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnchange(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOnclick(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnclick(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOncontextmenu(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOncontextmenu(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOndblclick(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndblclick(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOndrag(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndrag(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOndragend(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndragend(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOndragenter(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndragenter(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOndragleave(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndragleave(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOndragover(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndragover(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOndragstart(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndragstart(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOndrop(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOndrop(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOnfocus(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnfocus(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOninput(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOninput(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOnkeydown(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnkeydown(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOnkeypress(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnkeypress(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOnkeyup(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnkeyup(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOnload(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnload(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOnmousedown(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnmousedown(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOnmousemove(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnmousemove(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOnmouseout(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnmouseout(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOnmouseover(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnmouseover(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOnmouseup(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnmouseup(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOnmousewheel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    imp->setScrollLeft(value->toInt32(exec));
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnmousewheel(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSElementScrollTop(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSElementOnscroll(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
-    imp->setScrollTop(value->toInt32(exec));
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnscroll(globalObject->createJSAttributeEventListener(value));
 }
 
-JSValuePtr JSElement::getConstructor(ExecState* exec)
+void setJSElementOnselect(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnselect(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOnsubmit(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnsubmit(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOnbeforecut(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnbeforecut(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOncut(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOncut(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOnbeforecopy(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnbeforecopy(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOncopy(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOncopy(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOnbeforepaste(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnbeforepaste(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOnpaste(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnpaste(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOnreset(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnreset(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOnsearch(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnsearch(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSElementOnselectstart(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    Element* imp = static_cast<Element*>(static_cast<JSElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnselectstart(globalObject->createJSAttributeEventListener(value));
+}
+
+JSValue JSElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSElementConstructor>(exec);
 }
 
-JSValuePtr jsElementPrototypeFunctionGetAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->getAttribute(name));
+    JSC::JSValue result = jsStringOrNull(exec, imp->getAttribute(name));
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionSetAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     return castedThisObj->setAttribute(exec, args);
 }
 
-JSValuePtr jsElementPrototypeFunctionRemoveAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionRemoveAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
     imp->removeAttribute(name, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsElementPrototypeFunctionGetAttributeNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttributeNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getAttributeNode(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getAttributeNode(name)));
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionSetAttributeNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttributeNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     return castedThisObj->setAttributeNode(exec, args);
 }
 
-JSValuePtr jsElementPrototypeFunctionRemoveAttributeNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionRemoveAttributeNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Attr* oldAttr = toAttr(args.at(exec, 0));
+    Attr* oldAttr = toAttr(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->removeAttributeNode(oldAttr, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->removeAttributeNode(oldAttr, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionGetElementsByTagName(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetElementsByTagName(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getElementsByTagName(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getElementsByTagName(name)));
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionGetAttributeNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttributeNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    const UString& localName = args.at(exec, 1)->toString(exec);
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    const UString& localName = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->getAttributeNS(namespaceURI, localName));
+    JSC::JSValue result = jsString(exec, imp->getAttributeNS(namespaceURI, localName));
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionSetAttributeNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttributeNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     return castedThisObj->setAttributeNS(exec, args);
 }
 
-JSValuePtr jsElementPrototypeFunctionRemoveAttributeNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionRemoveAttributeNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    const UString& localName = args.at(exec, 1)->toString(exec);
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    const UString& localName = args.at(1).toString(exec);
 
     imp->removeAttributeNS(namespaceURI, localName, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsElementPrototypeFunctionGetElementsByTagNameNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetElementsByTagNameNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    const UString& localName = args.at(exec, 1)->toString(exec);
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    const UString& localName = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getElementsByTagNameNS(namespaceURI, localName)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getElementsByTagNameNS(namespaceURI, localName)));
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionGetAttributeNodeNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttributeNodeNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    const UString& localName = args.at(exec, 1)->toString(exec);
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    const UString& localName = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getAttributeNodeNS(namespaceURI, localName)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getAttributeNodeNS(namespaceURI, localName)));
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionSetAttributeNodeNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttributeNodeNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     return castedThisObj->setAttributeNodeNS(exec, args);
 }
 
-JSValuePtr jsElementPrototypeFunctionHasAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionHasAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasAttribute(name));
+    JSC::JSValue result = jsBoolean(imp->hasAttribute(name));
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionHasAttributeNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionHasAttributeNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    const UString& localName = args.at(exec, 1)->toString(exec);
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    const UString& localName = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasAttributeNS(namespaceURI, localName));
+    JSC::JSValue result = jsBoolean(imp->hasAttributeNS(namespaceURI, localName));
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionFocus(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionFocus(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -523,9 +1402,10 @@ JSValuePtr jsElementPrototypeFunctionFocus(ExecState* exec, JSObject*, JSValuePt
     return jsUndefined();
 }
 
-JSValuePtr jsElementPrototypeFunctionBlur(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionBlur(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -534,9 +1414,10 @@ JSValuePtr jsElementPrototypeFunctionBlur(ExecState* exec, JSObject*, JSValuePtr
     return jsUndefined();
 }
 
-JSValuePtr jsElementPrototypeFunctionScrollIntoView(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollIntoView(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -547,28 +1428,30 @@ JSValuePtr jsElementPrototypeFunctionScrollIntoView(ExecState* exec, JSObject*,
         return jsUndefined();
     }
 
-    bool alignWithTop = args.at(exec, 0)->toBoolean(exec);
+    bool alignWithTop = args.at(0).toBoolean(exec);
 
     imp->scrollIntoView(alignWithTop);
     return jsUndefined();
 }
 
-JSValuePtr jsElementPrototypeFunctionContains(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionContains(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    Element* element = toElement(args.at(exec, 0));
+    Element* element = toElement(args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->contains(element));
+    JSC::JSValue result = jsBoolean(imp->contains(element));
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionScrollIntoViewIfNeeded(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollIntoViewIfNeeded(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
@@ -579,82 +1462,113 @@ JSValuePtr jsElementPrototypeFunctionScrollIntoViewIfNeeded(ExecState* exec, JSO
         return jsUndefined();
     }
 
-    bool centerIfNeeded = args.at(exec, 0)->toBoolean(exec);
+    bool centerIfNeeded = args.at(0).toBoolean(exec);
 
     imp->scrollIntoViewIfNeeded(centerIfNeeded);
     return jsUndefined();
 }
 
-JSValuePtr jsElementPrototypeFunctionScrollByLines(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollByLines(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    int lines = args.at(exec, 0)->toInt32(exec);
+    int lines = args.at(0).toInt32(exec);
 
     imp->scrollByLines(lines);
     return jsUndefined();
 }
 
-JSValuePtr jsElementPrototypeFunctionScrollByPages(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollByPages(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    int pages = args.at(exec, 0)->toInt32(exec);
+    int pages = args.at(0).toInt32(exec);
 
     imp->scrollByPages(pages);
     return jsUndefined();
 }
 
-JSValuePtr jsElementPrototypeFunctionGetElementsByClassName(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetElementsByClassName(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getElementsByClassName(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getElementsByClassName(name)));
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionQuerySelector(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionQuerySelector(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& selectors = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
+    const UString& selectors = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->querySelector(selectors, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->querySelector(selectors, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsElementPrototypeFunctionQuerySelectorAll(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionQuerySelectorAll(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
         return throwError(exec, TypeError);
     JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
     Element* imp = static_cast<Element*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& selectors = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
+    const UString& selectors = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->querySelectorAll(selectors, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->querySelectorAll(selectors, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-Element* toElement(JSC::JSValuePtr value)
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetClientRects(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
+        return throwError(exec, TypeError);
+    JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
+    Element* imp = static_cast<Element*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getClientRects()));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetBoundingClientRect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSElement::s_info))
+        return throwError(exec, TypeError);
+    JSElement* castedThisObj = static_cast<JSElement*>(asObject(thisValue));
+    Element* imp = static_cast<Element*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getBoundingClientRect()));
+    return result;
+}
+
+Element* toElement(JSC::JSValue value)
 {
-    return value->isObject(&JSElement::s_info) ? static_cast<JSElement*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSElement::s_info) ? static_cast<JSElement*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSElement.h b/src/3rdparty/webkit/WebCore/generated/JSElement.h
index 391f757..36c81ac 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSElement.h
@@ -21,36 +21,37 @@
 #ifndef JSElement_h
 #define JSElement_h
 
-#include "JSEventTargetNode.h"
+#include "Element.h"
+#include "JSNode.h"
 #include <runtime/Lookup.h>
 #include <wtf/AlwaysInline.h>
-#include "Element.h"
+
 namespace WebCore {
 
 class Element;
 
-class JSElement : public JSEventTargetNode {
-    typedef JSEventTargetNode Base;
+class JSElement : public JSNode {
+    typedef JSNode Base;
 public:
     JSElement(PassRefPtr<JSC::Structure>, PassRefPtr<Element>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom functions
-    JSC::JSValuePtr setAttribute(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setAttributeNode(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setAttributeNS(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setAttributeNodeNS(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setAttribute(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setAttributeNode(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setAttributeNS(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setAttributeNodeNS(JSC::ExecState*, const JSC::ArgList&);
     Element* impl() const
     {
         return static_cast<Element*>(Base::impl());
@@ -62,16 +63,17 @@ ALWAYS_INLINE bool JSElement::getOwnPropertySlot(JSC::ExecState* exec, const JSC
     return JSC::getStaticValueSlot<JSElement, Base>(exec, s_info.staticPropHashTable, this, propertyName, slot);
 }
 
-Element* toElement(JSC::JSValuePtr);
-JSC::JSValuePtr toJSNewlyCreated(JSC::ExecState*, Element*);
+Element* toElement(JSC::JSValue);
+JSC::JSValue toJSNewlyCreated(JSC::ExecState*, Element*);
 
 class JSElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -80,56 +82,134 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsElementPrototypeFunctionGetAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionSetAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionRemoveAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionGetAttributeNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionSetAttributeNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionRemoveAttributeNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionGetElementsByTagName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionGetAttributeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionSetAttributeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionRemoveAttributeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionGetElementsByTagNameNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionGetAttributeNodeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionSetAttributeNodeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionHasAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionHasAttributeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionFocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionBlur(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionScrollIntoView(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionContains(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionScrollIntoViewIfNeeded(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionScrollByLines(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionScrollByPages(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionGetElementsByClassName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionQuerySelector(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsElementPrototypeFunctionQuerySelectorAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionRemoveAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttributeNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttributeNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionRemoveAttributeNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetElementsByTagName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttributeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttributeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionRemoveAttributeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetElementsByTagNameNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetAttributeNodeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionSetAttributeNodeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionHasAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionHasAttributeNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionFocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionBlur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollIntoView(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionContains(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollIntoViewIfNeeded(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollByLines(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionScrollByPages(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetElementsByClassName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionQuerySelector(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionQuerySelectorAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetClientRects(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsElementPrototypeFunctionGetBoundingClientRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsElementTagName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementOffsetLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementOffsetTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementOffsetWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementOffsetHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementOffsetParent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementClientLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementClientTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementClientWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementClientHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementScrollLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSElementScrollLeft(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsElementScrollTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSElementScrollTop(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsElementScrollWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementScrollHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementFirstElementChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementLastElementChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementPreviousElementSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementNextElementSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementChildElementCount(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementTagName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOffsetLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOffsetTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOffsetWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOffsetHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOffsetParent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementClientLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementClientTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementClientWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementClientHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementScrollLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementScrollLeft(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementScrollTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementScrollTop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementScrollWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementScrollHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementFirstElementChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementLastElementChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementPreviousElementSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementNextElementSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementChildElementCount(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsElementOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnblur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnblur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOncontextmenu(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOncontextmenu(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOndblclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOndblclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOndrag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOndrag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOndragend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOndragend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOndragenter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOndragenter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOndragleave(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOndragleave(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOndragover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOndragover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOndragstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOndragstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOndrop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOndrop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnfocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnfocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOninput(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOninput(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnkeydown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnkeydown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnkeypress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnkeypress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnkeyup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnkeyup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnmousedown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnmousedown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnmousemove(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnmousemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnmouseout(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnmouseout(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnmouseover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnmouseover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnmouseup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnmouseup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnmousewheel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnmousewheel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnscroll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnscroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnselect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnselect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnsubmit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnsubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnbeforecut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnbeforecut(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOncut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOncut(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnbeforecopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnbeforecopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOncopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOncopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnbeforepaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnbeforepaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnpaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnpaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnreset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnreset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnsearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnsearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementOnselectstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSElementOnselectstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp b/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp
index 464a93f..be4eed5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntity.cpp
@@ -19,21 +19,17 @@
 */
 
 #include "config.h"
-
 #include "JSEntity.h"
 
-#include <wtf/GetPtr.h>
-
 #include "Entity.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSEntity)
+ASSERT_CLASS_FITS_IN_CELL(JSEntity);
 
 /* Hash table */
 
@@ -72,13 +68,13 @@ public:
     JSEntityConstructor(ExecState* exec)
         : DOMObject(JSEntityConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSEntityPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSEntityPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -107,9 +103,9 @@ static const HashTable JSEntityPrototypeTable =
 
 const ClassInfo JSEntityPrototype::s_info = { "EntityPrototype", 0, &JSEntityPrototypeTable, 0 };
 
-JSObject* JSEntityPrototype::self(ExecState* exec)
+JSObject* JSEntityPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSEntity>(exec);
+    return getDOMPrototype<JSEntity>(exec, globalObject);
 }
 
 const ClassInfo JSEntity::s_info = { "Entity", &JSNode::s_info, &JSEntityTable, 0 };
@@ -119,9 +115,9 @@ JSEntity::JSEntity(PassRefPtr<Structure> structure, PassRefPtr<Entity> impl)
 {
 }
 
-JSObject* JSEntity::createPrototype(ExecState* exec)
+JSObject* JSEntity::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSEntityPrototype(JSEntityPrototype::createStructure(JSNodePrototype::self(exec)));
+    return new (exec) JSEntityPrototype(JSEntityPrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
 bool JSEntity::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -129,29 +125,32 @@ bool JSEntity::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNam
     return getStaticValueSlot<JSEntity, Base>(exec, &JSEntityTable, this, propertyName, slot);
 }
 
-JSValuePtr jsEntityPublicId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEntityPublicId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Entity* imp = static_cast<Entity*>(static_cast<JSEntity*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->publicId());
 }
 
-JSValuePtr jsEntitySystemId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEntitySystemId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Entity* imp = static_cast<Entity*>(static_cast<JSEntity*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->systemId());
 }
 
-JSValuePtr jsEntityNotationName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEntityNotationName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Entity* imp = static_cast<Entity*>(static_cast<JSEntity*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->notationName());
 }
 
-JSValuePtr jsEntityConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEntityConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSEntity*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSEntity::getConstructor(ExecState* exec)
+JSValue JSEntity::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSEntityConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntity.h b/src/3rdparty/webkit/WebCore/generated/JSEntity.h
index 890204f..b54cf58 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntity.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntity.h
@@ -31,23 +31,24 @@ class JSEntity : public JSNode {
     typedef JSNode Base;
 public:
     JSEntity(PassRefPtr<JSC::Structure>, PassRefPtr<Entity>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSEntityPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSEntityPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -55,10 +56,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsEntityPublicId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEntitySystemId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEntityNotationName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEntityConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEntityPublicId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEntitySystemId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEntityNotationName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEntityConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp
index 19effca..dc12c48 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.cpp
@@ -19,20 +19,16 @@
 */
 
 #include "config.h"
-
 #include "JSEntityReference.h"
 
-#include <wtf/GetPtr.h>
-
 #include "EntityReference.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSEntityReference)
+ASSERT_CLASS_FITS_IN_CELL(JSEntityReference);
 
 /* Hash table */
 
@@ -68,13 +64,13 @@ public:
     JSEntityReferenceConstructor(ExecState* exec)
         : DOMObject(JSEntityReferenceConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSEntityReferencePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSEntityReferencePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -103,9 +99,9 @@ static const HashTable JSEntityReferencePrototypeTable =
 
 const ClassInfo JSEntityReferencePrototype::s_info = { "EntityReferencePrototype", 0, &JSEntityReferencePrototypeTable, 0 };
 
-JSObject* JSEntityReferencePrototype::self(ExecState* exec)
+JSObject* JSEntityReferencePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSEntityReference>(exec);
+    return getDOMPrototype<JSEntityReference>(exec, globalObject);
 }
 
 const ClassInfo JSEntityReference::s_info = { "EntityReference", &JSNode::s_info, &JSEntityReferenceTable, 0 };
@@ -115,9 +111,9 @@ JSEntityReference::JSEntityReference(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSEntityReference::createPrototype(ExecState* exec)
+JSObject* JSEntityReference::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSEntityReferencePrototype(JSEntityReferencePrototype::createStructure(JSNodePrototype::self(exec)));
+    return new (exec) JSEntityReferencePrototype(JSEntityReferencePrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
 bool JSEntityReference::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -125,11 +121,11 @@ bool JSEntityReference::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSEntityReference, Base>(exec, &JSEntityReferenceTable, this, propertyName, slot);
 }
 
-JSValuePtr jsEntityReferenceConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEntityReferenceConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSEntityReference*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSEntityReference::getConstructor(ExecState* exec)
+JSValue JSEntityReference::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSEntityReferenceConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h
index 8a93de7..0c0957a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEntityReference.h
@@ -31,23 +31,24 @@ class JSEntityReference : public JSNode {
     typedef JSNode Base;
 public:
     JSEntityReference(PassRefPtr<JSC::Structure>, PassRefPtr<EntityReference>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSEntityReferencePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSEntityReferencePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -55,7 +56,7 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsEntityReferenceConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEntityReferenceConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
index cf2ee30..f00e179 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEvent.cpp
@@ -19,25 +19,22 @@
 */
 
 #include "config.h"
-
 #include "JSEvent.h"
 
-#include <wtf/GetPtr.h>
-
 #include "Event.h"
 #include "EventTarget.h"
 #include "JSEventTarget.h"
 #include "KURL.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSEvent);
 
 /* Hash table */
 
@@ -103,13 +100,13 @@ public:
     JSEventConstructor(ExecState* exec)
         : DOMObject(JSEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -164,9 +161,9 @@ static const HashTable* getJSEventPrototypeTable(ExecState* exec)
 }
 const ClassInfo JSEventPrototype::s_info = { "EventPrototype", 0, 0, getJSEventPrototypeTable };
 
-JSObject* JSEventPrototype::self(ExecState* exec)
+JSObject* JSEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSEvent>(exec);
+    return getDOMPrototype<JSEvent>(exec, globalObject);
 }
 
 bool JSEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -189,12 +186,11 @@ JSEvent::JSEvent(PassRefPtr<Structure> structure, PassRefPtr<Event> impl)
 JSEvent::~JSEvent()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSEvent::createPrototype(ExecState* exec)
+JSObject* JSEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSEventPrototype(JSEventPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSEventPrototype(JSEventPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -202,100 +198,111 @@ bool JSEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName
     return getStaticValueSlot<JSEvent, Base>(exec, getJSEventTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsEventType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsEventTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->target()));
 }
 
-JSValuePtr jsEventCurrentTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventCurrentTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->currentTarget()));
 }
 
-JSValuePtr jsEventEventPhase(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventEventPhase(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->eventPhase());
 }
 
-JSValuePtr jsEventBubbles(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventBubbles(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->bubbles());
 }
 
-JSValuePtr jsEventCancelable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventCancelable(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->cancelable());
 }
 
-JSValuePtr jsEventTimeStamp(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventTimeStamp(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->timeStamp());
 }
 
-JSValuePtr jsEventSrcElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventSrcElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->srcElement()));
 }
 
-JSValuePtr jsEventReturnValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventReturnValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->returnValue());
 }
 
-JSValuePtr jsEventCancelBubble(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventCancelBubble(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->cancelBubble());
 }
 
-JSValuePtr jsEventClipboardData(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventClipboardData(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSEvent*>(asObject(slot.slotBase()))->clipboardData(exec);
 }
 
-JSValuePtr jsEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSEvent::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSEvent::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSEvent, Base>(exec, propertyName, value, getJSEventTable(exec), this, slot);
 }
 
-void setJSEventReturnValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSEventReturnValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(thisObject)->impl());
-    imp->setReturnValue(value->toBoolean(exec));
+    imp->setReturnValue(value.toBoolean(exec));
 }
 
-void setJSEventCancelBubble(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSEventCancelBubble(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Event* imp = static_cast<Event*>(static_cast<JSEvent*>(thisObject)->impl());
-    imp->setCancelBubble(value->toBoolean(exec));
+    imp->setCancelBubble(value.toBoolean(exec));
 }
 
-JSValuePtr JSEvent::getConstructor(ExecState* exec)
+JSValue JSEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSEventConstructor>(exec);
 }
 
-JSValuePtr jsEventPrototypeFunctionStopPropagation(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsEventPrototypeFunctionStopPropagation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSEvent::s_info))
         return throwError(exec, TypeError);
     JSEvent* castedThisObj = static_cast<JSEvent*>(asObject(thisValue));
     Event* imp = static_cast<Event*>(castedThisObj->impl());
@@ -304,9 +311,10 @@ JSValuePtr jsEventPrototypeFunctionStopPropagation(ExecState* exec, JSObject*, J
     return jsUndefined();
 }
 
-JSValuePtr jsEventPrototypeFunctionPreventDefault(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsEventPrototypeFunctionPreventDefault(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSEvent::s_info))
         return throwError(exec, TypeError);
     JSEvent* castedThisObj = static_cast<JSEvent*>(asObject(thisValue));
     Event* imp = static_cast<Event*>(castedThisObj->impl());
@@ -315,15 +323,16 @@ JSValuePtr jsEventPrototypeFunctionPreventDefault(ExecState* exec, JSObject*, JS
     return jsUndefined();
 }
 
-JSValuePtr jsEventPrototypeFunctionInitEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsEventPrototypeFunctionInitEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSEvent::s_info))
         return throwError(exec, TypeError);
     JSEvent* castedThisObj = static_cast<JSEvent*>(asObject(thisValue));
     Event* imp = static_cast<Event*>(castedThisObj->impl());
-    const UString& eventTypeArg = args.at(exec, 0)->toString(exec);
-    bool canBubbleArg = args.at(exec, 1)->toBoolean(exec);
-    bool cancelableArg = args.at(exec, 2)->toBoolean(exec);
+    const UString& eventTypeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
 
     imp->initEvent(eventTypeArg, canBubbleArg, cancelableArg);
     return jsUndefined();
@@ -331,104 +340,104 @@ JSValuePtr jsEventPrototypeFunctionInitEvent(ExecState* exec, JSObject*, JSValue
 
 // Constant getters
 
-JSValuePtr jsEventCAPTURING_PHASE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventCAPTURING_PHASE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsEventAT_TARGET(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventAT_TARGET(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsEventBUBBLING_PHASE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventBUBBLING_PHASE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsEventMOUSEDOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEDOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsEventMOUSEUP(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEUP(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsEventMOUSEOVER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEOVER(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsEventMOUSEOUT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEOUT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValuePtr jsEventMOUSEMOVE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEMOVE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(16));
 }
 
-JSValuePtr jsEventMOUSEDRAG(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventMOUSEDRAG(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(32));
 }
 
-JSValuePtr jsEventCLICK(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventCLICK(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(64));
 }
 
-JSValuePtr jsEventDBLCLICK(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventDBLCLICK(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(128));
 }
 
-JSValuePtr jsEventKEYDOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventKEYDOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(256));
 }
 
-JSValuePtr jsEventKEYUP(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventKEYUP(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(512));
 }
 
-JSValuePtr jsEventKEYPRESS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventKEYPRESS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1024));
 }
 
-JSValuePtr jsEventDRAGDROP(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventDRAGDROP(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2048));
 }
 
-JSValuePtr jsEventFOCUS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventFOCUS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4096));
 }
 
-JSValuePtr jsEventBLUR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventBLUR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(8192));
 }
 
-JSValuePtr jsEventSELECT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventSELECT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(16384));
 }
 
-JSValuePtr jsEventCHANGE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventCHANGE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(32768));
 }
 
-Event* toEvent(JSC::JSValuePtr value)
+Event* toEvent(JSC::JSValue value)
 {
-    return value->isObject(&JSEvent::s_info) ? static_cast<JSEvent*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSEvent::s_info) ? static_cast<JSEvent*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEvent.h b/src/3rdparty/webkit/WebCore/generated/JSEvent.h
index 22a33f7..281010b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEvent.h
@@ -34,37 +34,38 @@ class JSEvent : public DOMObject {
 public:
     JSEvent(PassRefPtr<JSC::Structure>, PassRefPtr<Event>);
     virtual ~JSEvent();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom attributes
-    JSC::JSValuePtr clipboardData(JSC::ExecState*) const;
+    JSC::JSValue clipboardData(JSC::ExecState*) const;
     Event* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Event> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Event*);
-Event* toEvent(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Event*);
+Event* toEvent(JSC::JSValue);
 
 class JSEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -73,46 +74,46 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsEventPrototypeFunctionStopPropagation(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsEventPrototypeFunctionPreventDefault(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsEventPrototypeFunctionInitEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsEventPrototypeFunctionStopPropagation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsEventPrototypeFunctionPreventDefault(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsEventPrototypeFunctionInitEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsEventType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventCurrentTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventEventPhase(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventBubbles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventCancelable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventTimeStamp(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventSrcElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventReturnValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventReturnValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventCancelBubble(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventCancelBubble(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventClipboardData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventCurrentTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventEventPhase(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventBubbles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventCancelable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventTimeStamp(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventSrcElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventReturnValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSEventReturnValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsEventCancelBubble(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSEventCancelBubble(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsEventClipboardData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsEventCAPTURING_PHASE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventAT_TARGET(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventBUBBLING_PHASE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventMOUSEDOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventMOUSEUP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventMOUSEOVER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventMOUSEOUT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventMOUSEMOVE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventMOUSEDRAG(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventCLICK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventDBLCLICK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventKEYDOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventKEYUP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventKEYPRESS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventDRAGDROP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventFOCUS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventBLUR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventSELECT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventCHANGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventCAPTURING_PHASE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventAT_TARGET(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventBUBBLING_PHASE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventMOUSEDOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventMOUSEUP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventMOUSEOVER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventMOUSEOUT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventMOUSEMOVE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventMOUSEDRAG(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventCLICK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventDBLCLICK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventKEYDOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventKEYUP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventKEYPRESS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventDRAGDROP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventFOCUS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventBLUR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventSELECT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventCHANGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp b/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
index 547e802..2adb70a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventException.cpp
@@ -19,23 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSEventException.h"
 
-#include <wtf/GetPtr.h>
-
 #include "EventException.h"
 #include "KURL.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSEventException)
+ASSERT_CLASS_FITS_IN_CELL(JSEventException);
 
 /* Hash table */
 
@@ -75,13 +72,13 @@ public:
     JSEventExceptionConstructor(ExecState* exec)
         : DOMObject(JSEventExceptionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSEventExceptionPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSEventExceptionPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -110,19 +107,27 @@ static const HashTable JSEventExceptionPrototypeTable =
     { 5, 3, JSEventExceptionPrototypeTableValues, 0 };
 #endif
 
-const ClassInfo JSEventExceptionPrototype::s_info = { "EventExceptionPrototype", 0, &JSEventExceptionPrototypeTable, 0 };
+static const HashTable* getJSEventExceptionPrototypeTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSEventExceptionPrototypeTable);
+}
+const ClassInfo JSEventExceptionPrototype::s_info = { "EventExceptionPrototype", 0, 0, getJSEventExceptionPrototypeTable };
 
-JSObject* JSEventExceptionPrototype::self(ExecState* exec)
+JSObject* JSEventExceptionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSEventException>(exec);
+    return getDOMPrototype<JSEventException>(exec, globalObject);
 }
 
 bool JSEventExceptionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    return getStaticPropertySlot<JSEventExceptionPrototype, JSObject>(exec, &JSEventExceptionPrototypeTable, this, propertyName, slot);
+    return getStaticPropertySlot<JSEventExceptionPrototype, JSObject>(exec, getJSEventExceptionPrototypeTable(exec), this, propertyName, slot);
 }
 
-const ClassInfo JSEventException::s_info = { "EventException", 0, &JSEventExceptionTable, 0 };
+static const HashTable* getJSEventExceptionTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSEventExceptionTable);
+}
+const ClassInfo JSEventException::s_info = { "EventException", 0, 0, getJSEventExceptionTable };
 
 JSEventException::JSEventException(PassRefPtr<Structure> structure, PassRefPtr<EventException> impl)
     : DOMObject(structure)
@@ -133,72 +138,75 @@ JSEventException::JSEventException(PassRefPtr<Structure> structure, PassRefPtr<E
 JSEventException::~JSEventException()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSEventException::createPrototype(ExecState* exec)
+JSObject* JSEventException::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSEventExceptionPrototype(JSEventExceptionPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSEventExceptionPrototype(JSEventExceptionPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSEventException::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    return getStaticValueSlot<JSEventException, Base>(exec, &JSEventExceptionTable, this, propertyName, slot);
+    return getStaticValueSlot<JSEventException, Base>(exec, getJSEventExceptionTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsEventExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     EventException* imp = static_cast<EventException*>(static_cast<JSEventException*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->code());
 }
 
-JSValuePtr jsEventExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     EventException* imp = static_cast<EventException*>(static_cast<JSEventException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsEventExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     EventException* imp = static_cast<EventException*>(static_cast<JSEventException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->message());
 }
 
-JSValuePtr jsEventExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsEventExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSEventException*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSEventException::getConstructor(ExecState* exec)
+JSValue JSEventException::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSEventExceptionConstructor>(exec);
 }
 
-JSValuePtr jsEventExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsEventExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSEventException::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSEventException::s_info))
         return throwError(exec, TypeError);
     JSEventException* castedThisObj = static_cast<JSEventException*>(asObject(thisValue));
     EventException* imp = static_cast<EventException*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->toString());
+    JSC::JSValue result = jsString(exec, imp->toString());
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, EventException* object)
+JSC::JSValue toJS(JSC::ExecState* exec, EventException* object)
 {
     return getDOMObjectWrapper<JSEventException>(exec, object);
 }
-EventException* toEventException(JSC::JSValuePtr value)
+EventException* toEventException(JSC::JSValue value)
 {
-    return value->isObject(&JSEventException::s_info) ? static_cast<JSEventException*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSEventException::s_info) ? static_cast<JSEventException*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventException.h b/src/3rdparty/webkit/WebCore/generated/JSEventException.h
index d70dbff..bc71abe 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSEventException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSEventException.h
@@ -34,33 +34,34 @@ class JSEventException : public DOMObject {
 public:
     JSEventException(PassRefPtr<JSC::Structure>, PassRefPtr<EventException>);
     virtual ~JSEventException();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     EventException* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<EventException> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, EventException*);
-EventException* toEventException(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, EventException*);
+EventException* toEventException(JSC::JSValue);
 
 class JSEventExceptionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,16 +70,16 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsEventExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsEventExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsEventExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsEventExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsEventExceptionUNSPECIFIED_EVENT_TYPE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventTargetNode.cpp b/src/3rdparty/webkit/WebCore/generated/JSEventTargetNode.cpp
deleted file mode 100644
index 3dd23d1..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSEventTargetNode.cpp
+++ /dev/null
@@ -1,944 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-#include "JSEventTargetNode.h"
-
-#include <wtf/GetPtr.h>
-
-#include "Event.h"
-#include "EventListener.h"
-#include "EventTargetNode.h"
-#include "Frame.h"
-#include "JSDOMGlobalObject.h"
-#include "JSEvent.h"
-#include "JSEventListener.h"
-
-#include <runtime/Error.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSEventTargetNode)
-
-/* Hash table */
-
-static const HashTableValue JSEventTargetNodeTableValues[41] =
-{
-    { "onabort", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnabort, (intptr_t)setJSEventTargetNodeOnabort },
-    { "onblur", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnblur, (intptr_t)setJSEventTargetNodeOnblur },
-    { "onchange", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnchange, (intptr_t)setJSEventTargetNodeOnchange },
-    { "onclick", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnclick, (intptr_t)setJSEventTargetNodeOnclick },
-    { "oncontextmenu", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOncontextmenu, (intptr_t)setJSEventTargetNodeOncontextmenu },
-    { "ondblclick", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOndblclick, (intptr_t)setJSEventTargetNodeOndblclick },
-    { "onerror", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnerror, (intptr_t)setJSEventTargetNodeOnerror },
-    { "onfocus", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnfocus, (intptr_t)setJSEventTargetNodeOnfocus },
-    { "oninput", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOninput, (intptr_t)setJSEventTargetNodeOninput },
-    { "onkeydown", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnkeydown, (intptr_t)setJSEventTargetNodeOnkeydown },
-    { "onkeypress", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnkeypress, (intptr_t)setJSEventTargetNodeOnkeypress },
-    { "onkeyup", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnkeyup, (intptr_t)setJSEventTargetNodeOnkeyup },
-    { "onload", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnload, (intptr_t)setJSEventTargetNodeOnload },
-    { "onmousedown", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnmousedown, (intptr_t)setJSEventTargetNodeOnmousedown },
-    { "onmousemove", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnmousemove, (intptr_t)setJSEventTargetNodeOnmousemove },
-    { "onmouseout", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnmouseout, (intptr_t)setJSEventTargetNodeOnmouseout },
-    { "onmouseover", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnmouseover, (intptr_t)setJSEventTargetNodeOnmouseover },
-    { "onmouseup", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnmouseup, (intptr_t)setJSEventTargetNodeOnmouseup },
-    { "onmousewheel", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnmousewheel, (intptr_t)setJSEventTargetNodeOnmousewheel },
-    { "onbeforecut", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnbeforecut, (intptr_t)setJSEventTargetNodeOnbeforecut },
-    { "oncut", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOncut, (intptr_t)setJSEventTargetNodeOncut },
-    { "onbeforecopy", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnbeforecopy, (intptr_t)setJSEventTargetNodeOnbeforecopy },
-    { "oncopy", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOncopy, (intptr_t)setJSEventTargetNodeOncopy },
-    { "onbeforepaste", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnbeforepaste, (intptr_t)setJSEventTargetNodeOnbeforepaste },
-    { "onpaste", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnpaste, (intptr_t)setJSEventTargetNodeOnpaste },
-    { "ondragenter", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOndragenter, (intptr_t)setJSEventTargetNodeOndragenter },
-    { "ondragover", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOndragover, (intptr_t)setJSEventTargetNodeOndragover },
-    { "ondragleave", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOndragleave, (intptr_t)setJSEventTargetNodeOndragleave },
-    { "ondrop", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOndrop, (intptr_t)setJSEventTargetNodeOndrop },
-    { "ondragstart", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOndragstart, (intptr_t)setJSEventTargetNodeOndragstart },
-    { "ondrag", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOndrag, (intptr_t)setJSEventTargetNodeOndrag },
-    { "ondragend", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOndragend, (intptr_t)setJSEventTargetNodeOndragend },
-    { "onreset", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnreset, (intptr_t)setJSEventTargetNodeOnreset },
-    { "onresize", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnresize, (intptr_t)setJSEventTargetNodeOnresize },
-    { "onscroll", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnscroll, (intptr_t)setJSEventTargetNodeOnscroll },
-    { "onsearch", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnsearch, (intptr_t)setJSEventTargetNodeOnsearch },
-    { "onselect", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnselect, (intptr_t)setJSEventTargetNodeOnselect },
-    { "onselectstart", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnselectstart, (intptr_t)setJSEventTargetNodeOnselectstart },
-    { "onsubmit", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnsubmit, (intptr_t)setJSEventTargetNodeOnsubmit },
-    { "onunload", DontDelete|DontEnum, (intptr_t)jsEventTargetNodeOnunload, (intptr_t)setJSEventTargetNodeOnunload },
-    { 0, 0, 0, 0 }
-};
-
-static const HashTable JSEventTargetNodeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 2047, JSEventTargetNodeTableValues, 0 };
-#else
-    { 133, 127, JSEventTargetNodeTableValues, 0 };
-#endif
-
-/* Hash table for prototype */
-
-static const HashTableValue JSEventTargetNodePrototypeTableValues[4] =
-{
-    { "addEventListener", DontDelete|Function, (intptr_t)jsEventTargetNodePrototypeFunctionAddEventListener, (intptr_t)3 },
-    { "removeEventListener", DontDelete|Function, (intptr_t)jsEventTargetNodePrototypeFunctionRemoveEventListener, (intptr_t)3 },
-    { "dispatchEvent", DontDelete|Function, (intptr_t)jsEventTargetNodePrototypeFunctionDispatchEvent, (intptr_t)1 },
-    { 0, 0, 0, 0 }
-};
-
-static const HashTable JSEventTargetNodePrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 3, JSEventTargetNodePrototypeTableValues, 0 };
-#else
-    { 8, 7, JSEventTargetNodePrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSEventTargetNodePrototype::s_info = { "EventTargetNodePrototype", 0, &JSEventTargetNodePrototypeTable, 0 };
-
-JSObject* JSEventTargetNodePrototype::self(ExecState* exec)
-{
-    return getDOMPrototype<JSEventTargetNode>(exec);
-}
-
-bool JSEventTargetNodePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<JSObject>(exec, &JSEventTargetNodePrototypeTable, this, propertyName, slot);
-}
-
-const ClassInfo JSEventTargetNode::s_info = { "EventTargetNode", &JSNode::s_info, &JSEventTargetNodeTable, 0 };
-
-JSEventTargetNode::JSEventTargetNode(PassRefPtr<Structure> structure, PassRefPtr<EventTargetNode> impl)
-    : JSNode(structure, impl)
-{
-}
-
-JSObject* JSEventTargetNode::createPrototype(ExecState* exec)
-{
-    return new (exec) JSEventTargetNodePrototype(JSEventTargetNodePrototype::createStructure(JSNodePrototype::self(exec)));
-}
-
-bool JSEventTargetNode::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    return getStaticValueSlot<JSEventTargetNode, Base>(exec, &JSEventTargetNodeTable, this, propertyName, slot);
-}
-
-JSValuePtr jsEventTargetNodeOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onabort())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnblur(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onblur())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onchange())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onclick())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOncontextmenu(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->oncontextmenu())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOndblclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondblclick())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onerror())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnfocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onfocus())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOninput(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->oninput())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnkeydown(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onkeydown())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnkeypress(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onkeypress())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnkeyup(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onkeyup())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onload())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnmousedown(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmousedown())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnmousemove(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmousemove())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnmouseout(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmouseout())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnmouseover(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmouseover())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnmouseup(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmouseup())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnmousewheel(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmousewheel())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnbeforecut(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onbeforecut())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOncut(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->oncut())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnbeforecopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onbeforecopy())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOncopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->oncopy())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnbeforepaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onbeforepaste())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnpaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onpaste())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOndragenter(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondragenter())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOndragover(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondragover())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOndragleave(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondragleave())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOndrop(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondrop())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOndragstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondragstart())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOndrag(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondrag())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOndragend(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondragend())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnreset(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onreset())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnresize(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onresize())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnscroll(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onscroll())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnsearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onsearch())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnselect(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onselect())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnselectstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onselectstart())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnsubmit(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onsubmit())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsEventTargetNodeOnunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onunload())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-void JSEventTargetNode::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
-{
-    lookupPut<JSEventTargetNode, Base>(exec, propertyName, value, &JSEventTargetNodeTable, this, slot);
-}
-
-void setJSEventTargetNodeOnabort(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnabort(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnblur(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnblur(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnchange(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnchange(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnclick(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnclick(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOncontextmenu(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOncontextmenu(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOndblclick(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOndblclick(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnerror(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnerror(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnfocus(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnfocus(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOninput(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOninput(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnkeydown(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnkeydown(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnkeypress(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnkeypress(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnkeyup(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnkeyup(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnload(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnload(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnmousedown(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnmousedown(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnmousemove(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnmousemove(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnmouseout(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnmouseout(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnmouseover(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnmouseover(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnmouseup(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnmouseup(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnmousewheel(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnmousewheel(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnbeforecut(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnbeforecut(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOncut(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOncut(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnbeforecopy(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnbeforecopy(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOncopy(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOncopy(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnbeforepaste(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnbeforepaste(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnpaste(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnpaste(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOndragenter(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOndragenter(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOndragover(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOndragover(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOndragleave(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOndragleave(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOndrop(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOndrop(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOndragstart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOndragstart(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOndrag(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOndrag(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOndragend(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOndragend(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnreset(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnreset(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnresize(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnresize(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnscroll(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnscroll(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnsearch(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnsearch(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnselect(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnselect(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnselectstart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnselectstart(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnsubmit(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnsubmit(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-void setJSEventTargetNodeOnunload(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    EventTargetNode* imp = static_cast<EventTargetNode*>(static_cast<JSEventTargetNode*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnunload(globalObject->findOrCreateJSEventListener(exec, value, true));
-}
-
-JSValuePtr jsEventTargetNodePrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSEventTargetNode::s_info))
-        return throwError(exec, TypeError);
-    JSEventTargetNode* castedThisObj = static_cast<JSEventTargetNode*>(asObject(thisValue));
-    return castedThisObj->addEventListener(exec, args);
-}
-
-JSValuePtr jsEventTargetNodePrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSEventTargetNode::s_info))
-        return throwError(exec, TypeError);
-    JSEventTargetNode* castedThisObj = static_cast<JSEventTargetNode*>(asObject(thisValue));
-    return castedThisObj->removeEventListener(exec, args);
-}
-
-JSValuePtr jsEventTargetNodePrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSEventTargetNode::s_info))
-        return throwError(exec, TypeError);
-    JSEventTargetNode* castedThisObj = static_cast<JSEventTargetNode*>(asObject(thisValue));
-    EventTargetNode* imp = static_cast<EventTargetNode*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
-    Event* event = toEvent(args.at(exec, 0));
-
-
-    JSC::JSValuePtr result = jsBoolean(imp->dispatchEvent(event, ec));
-    setDOMException(exec, ec);
-    return result;
-}
-
-EventTargetNode* toEventTargetNode(JSC::JSValuePtr value)
-{
-    return value->isObject(&JSEventTargetNode::s_info) ? static_cast<JSEventTargetNode*>(asObject(value))->impl() : 0;
-}
-
-}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSEventTargetNode.h b/src/3rdparty/webkit/WebCore/generated/JSEventTargetNode.h
deleted file mode 100644
index 0463376..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSEventTargetNode.h
+++ /dev/null
@@ -1,162 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef JSEventTargetNode_h
-#define JSEventTargetNode_h
-
-#include "JSNode.h"
-#include "EventTargetNode.h"
-namespace WebCore {
-
-class EventTargetNode;
-
-class JSEventTargetNode : public JSNode {
-    typedef JSNode Base;
-public:
-    JSEventTargetNode(PassRefPtr<JSC::Structure>, PassRefPtr<EventTargetNode>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
-    }
-
-    virtual void pushEventHandlerScope(JSC::ExecState*, JSC::ScopeChain&) const;
-
-
-    // Custom functions
-    JSC::JSValuePtr addEventListener(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeEventListener(JSC::ExecState*, const JSC::ArgList&);
-    EventTargetNode* impl() const
-    {
-        return static_cast<EventTargetNode*>(Base::impl());
-    }
-};
-
-EventTargetNode* toEventTargetNode(JSC::JSValuePtr);
-
-class JSEventTargetNodePrototype : public JSC::JSObject {
-public:
-    static JSC::JSObject* self(JSC::ExecState*);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
-    }
-    JSEventTargetNodePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
-};
-
-// Functions
-
-JSC::JSValuePtr jsEventTargetNodePrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsEventTargetNodePrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsEventTargetNodePrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-// Attributes
-
-JSC::JSValuePtr jsEventTargetNodeOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnblur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnblur(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOncontextmenu(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOncontextmenu(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOndblclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOndblclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnfocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnfocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOninput(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOninput(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnkeydown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnkeydown(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnkeypress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnkeypress(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnkeyup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnkeyup(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnmousedown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnmousedown(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnmousemove(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnmousemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnmouseout(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnmouseout(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnmouseover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnmouseover(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnmouseup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnmouseup(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnmousewheel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnmousewheel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnbeforecut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnbeforecut(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOncut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOncut(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnbeforecopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnbeforecopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOncopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOncopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnbeforepaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnbeforepaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnpaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnpaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOndragenter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOndragenter(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOndragover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOndragover(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOndragleave(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOndragleave(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOndrop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOndrop(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOndragstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOndragstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOndrag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOndrag(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOndragend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOndragend(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnreset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnreset(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnresize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnresize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnscroll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnscroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnsearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnsearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnselect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnselect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnselectstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnselectstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnsubmit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnsubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsEventTargetNodeOnunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSEventTargetNodeOnunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-
-} // namespace WebCore
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFile.cpp b/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
index cbb4281..d25dfc6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSFile.cpp
@@ -19,22 +19,19 @@
 */
 
 #include "config.h"
-
 #include "JSFile.h"
 
-#include <wtf/GetPtr.h>
-
 #include "File.h"
 #include "KURL.h"
-
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSFile)
+ASSERT_CLASS_FITS_IN_CELL(JSFile);
 
 /* Hash table */
 
@@ -72,13 +69,13 @@ public:
     JSFileConstructor(ExecState* exec)
         : DOMObject(JSFileConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSFilePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSFilePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -107,9 +104,9 @@ static const HashTable JSFilePrototypeTable =
 
 const ClassInfo JSFilePrototype::s_info = { "FilePrototype", 0, &JSFilePrototypeTable, 0 };
 
-JSObject* JSFilePrototype::self(ExecState* exec)
+JSObject* JSFilePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSFile>(exec);
+    return getDOMPrototype<JSFile>(exec, globalObject);
 }
 
 const ClassInfo JSFile::s_info = { "File", 0, &JSFileTable, 0 };
@@ -123,12 +120,11 @@ JSFile::JSFile(PassRefPtr<Structure> structure, PassRefPtr<File> impl)
 JSFile::~JSFile()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSFile::createPrototype(ExecState* exec)
+JSObject* JSFile::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSFilePrototype(JSFilePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSFilePrototype(JSFilePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSFile::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -136,34 +132,36 @@ bool JSFile::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName,
     return getStaticValueSlot<JSFile, Base>(exec, &JSFileTable, this, propertyName, slot);
 }
 
-JSValuePtr jsFileFileName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsFileFileName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     File* imp = static_cast<File*>(static_cast<JSFile*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->fileName());
 }
 
-JSValuePtr jsFileFileSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsFileFileSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     File* imp = static_cast<File*>(static_cast<JSFile*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->fileSize());
 }
 
-JSValuePtr jsFileConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsFileConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSFile*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSFile::getConstructor(ExecState* exec)
+JSValue JSFile::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSFileConstructor>(exec);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, File* object)
+JSC::JSValue toJS(JSC::ExecState* exec, File* object)
 {
     return getDOMObjectWrapper<JSFile>(exec, object);
 }
-File* toFile(JSC::JSValuePtr value)
+File* toFile(JSC::JSValue value)
 {
-    return value->isObject(&JSFile::s_info) ? static_cast<JSFile*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSFile::s_info) ? static_cast<JSFile*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFile.h b/src/3rdparty/webkit/WebCore/generated/JSFile.h
index 0c7b83c..efa4744 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFile.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSFile.h
@@ -34,29 +34,30 @@ class JSFile : public DOMObject {
 public:
     JSFile(PassRefPtr<JSC::Structure>, PassRefPtr<File>);
     virtual ~JSFile();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     File* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<File> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, File*);
-File* toFile(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, File*);
+File* toFile(JSC::JSValue);
 
 class JSFilePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSFilePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -64,9 +65,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsFileFileName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsFileFileSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsFileConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsFileFileName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsFileFileSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsFileConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp b/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
index baf82c8..cd165c1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSFileList.cpp
@@ -19,25 +19,22 @@
 */
 
 #include "config.h"
-
 #include "JSFileList.h"
 
-#include <wtf/GetPtr.h>
-
-#include <runtime/PropertyNameArray.h>
 #include "ExceptionCode.h"
 #include "File.h"
 #include "FileList.h"
 #include "JSFile.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSFileList)
+ASSERT_CLASS_FITS_IN_CELL(JSFileList);
 
 /* Hash table */
 
@@ -74,13 +71,13 @@ public:
     JSFileListConstructor(ExecState* exec)
         : DOMObject(JSFileListConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSFileListPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSFileListPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -110,9 +107,9 @@ static const HashTable JSFileListPrototypeTable =
 
 const ClassInfo JSFileListPrototype::s_info = { "FileListPrototype", 0, &JSFileListPrototypeTable, 0 };
 
-JSObject* JSFileListPrototype::self(ExecState* exec)
+JSObject* JSFileListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSFileList>(exec);
+    return getDOMPrototype<JSFileList>(exec, globalObject);
 }
 
 bool JSFileListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,12 +128,11 @@ JSFileList::JSFileList(PassRefPtr<Structure> structure, PassRefPtr<FileList> imp
 JSFileList::~JSFileList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSFileList::createPrototype(ExecState* exec)
+JSObject* JSFileList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSFileListPrototype(JSFileListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSFileListPrototype(JSFileListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSFileList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -164,13 +160,14 @@ bool JSFileList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, Prop
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsFileListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsFileListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     FileList* imp = static_cast<FileList*>(static_cast<JSFileList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsFileListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsFileListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSFileList*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
@@ -181,41 +178,42 @@ void JSFileList::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNa
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSFileList::getConstructor(ExecState* exec)
+JSValue JSFileList::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSFileListConstructor>(exec);
 }
 
-JSValuePtr jsFileListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsFileListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSFileList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSFileList::s_info))
         return throwError(exec, TypeError);
     JSFileList* castedThisObj = static_cast<JSFileList*>(asObject(thisValue));
     FileList* imp = static_cast<FileList*>(castedThisObj->impl());
-    int index = args.at(exec, 0)->toInt32(exec);
+    int index = args.at(0).toInt32(exec);
     if (index < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return jsUndefined();
     }
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->item(index)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
     return result;
 }
 
 
-JSValuePtr JSFileList::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSFileList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSFileList* thisObj = static_cast<JSFileList*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<FileList*>(thisObj->impl())->item(slot.index()));
 }
-JSC::JSValuePtr toJS(JSC::ExecState* exec, FileList* object)
+JSC::JSValue toJS(JSC::ExecState* exec, FileList* object)
 {
     return getDOMObjectWrapper<JSFileList>(exec, object);
 }
-FileList* toFileList(JSC::JSValuePtr value)
+FileList* toFileList(JSC::JSValue value)
 {
-    return value->isObject(&JSFileList::s_info) ? static_cast<JSFileList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSFileList::s_info) ? static_cast<JSFileList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSFileList.h b/src/3rdparty/webkit/WebCore/generated/JSFileList.h
index 87628ce..4a7075d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSFileList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSFileList.h
@@ -34,36 +34,37 @@ class JSFileList : public DOMObject {
 public:
     JSFileList(PassRefPtr<JSC::Structure>, PassRefPtr<FileList>);
     virtual ~JSFileList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     FileList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<FileList> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, FileList*);
-FileList* toFileList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, FileList*);
+FileList* toFileList(JSC::JSValue);
 
 class JSFileListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -72,11 +73,11 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsFileListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsFileListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsFileListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsFileListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsFileListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsFileListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp
index 1d02e90..a75348b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.cpp
@@ -19,22 +19,19 @@
 */
 
 #include "config.h"
-
 #include "JSGeolocation.h"
 
-#include <wtf/GetPtr.h>
-
 #include "Geolocation.h"
 #include "Geoposition.h"
 #include "JSGeoposition.h"
-
 #include <runtime/Error.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSGeolocation)
+ASSERT_CLASS_FITS_IN_CELL(JSGeolocation);
 
 /* Hash table */
 
@@ -70,9 +67,9 @@ static const HashTable JSGeolocationPrototypeTable =
 
 const ClassInfo JSGeolocationPrototype::s_info = { "GeolocationPrototype", 0, &JSGeolocationPrototypeTable, 0 };
 
-JSObject* JSGeolocationPrototype::self(ExecState* exec)
+JSObject* JSGeolocationPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSGeolocation>(exec);
+    return getDOMPrototype<JSGeolocation>(exec, globalObject);
 }
 
 bool JSGeolocationPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -91,12 +88,11 @@ JSGeolocation::JSGeolocation(PassRefPtr<Structure> structure, PassRefPtr<Geoloca
 JSGeolocation::~JSGeolocation()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSGeolocation::createPrototype(ExecState* exec)
+JSObject* JSGeolocation::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSGeolocationPrototype(JSGeolocationPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSGeolocationPrototype(JSGeolocationPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSGeolocation::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -104,47 +100,51 @@ bool JSGeolocation::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSGeolocation, Base>(exec, &JSGeolocationTable, this, propertyName, slot);
 }
 
-JSValuePtr jsGeolocationLastPosition(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsGeolocationLastPosition(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Geolocation* imp = static_cast<Geolocation*>(static_cast<JSGeolocation*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->lastPosition()));
 }
 
-JSValuePtr jsGeolocationPrototypeFunctionGetCurrentPosition(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsGeolocationPrototypeFunctionGetCurrentPosition(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSGeolocation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSGeolocation::s_info))
         return throwError(exec, TypeError);
     JSGeolocation* castedThisObj = static_cast<JSGeolocation*>(asObject(thisValue));
     return castedThisObj->getCurrentPosition(exec, args);
 }
 
-JSValuePtr jsGeolocationPrototypeFunctionWatchPosition(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsGeolocationPrototypeFunctionWatchPosition(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSGeolocation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSGeolocation::s_info))
         return throwError(exec, TypeError);
     JSGeolocation* castedThisObj = static_cast<JSGeolocation*>(asObject(thisValue));
     return castedThisObj->watchPosition(exec, args);
 }
 
-JSValuePtr jsGeolocationPrototypeFunctionClearWatch(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsGeolocationPrototypeFunctionClearWatch(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSGeolocation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSGeolocation::s_info))
         return throwError(exec, TypeError);
     JSGeolocation* castedThisObj = static_cast<JSGeolocation*>(asObject(thisValue));
     Geolocation* imp = static_cast<Geolocation*>(castedThisObj->impl());
-    int watchId = args.at(exec, 0)->toInt32(exec);
+    int watchId = args.at(0).toInt32(exec);
 
     imp->clearWatch(watchId);
     return jsUndefined();
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Geolocation* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Geolocation* object)
 {
     return getDOMObjectWrapper<JSGeolocation>(exec, object);
 }
-Geolocation* toGeolocation(JSC::JSValuePtr value)
+Geolocation* toGeolocation(JSC::JSValue value)
 {
-    return value->isObject(&JSGeolocation::s_info) ? static_cast<JSGeolocation*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSGeolocation::s_info) ? static_cast<JSGeolocation*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h
index d738102..736d019 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeolocation.h
@@ -34,36 +34,37 @@ class JSGeolocation : public DOMObject {
 public:
     JSGeolocation(PassRefPtr<JSC::Structure>, PassRefPtr<Geolocation>);
     virtual ~JSGeolocation();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
 
     // Custom functions
-    JSC::JSValuePtr getCurrentPosition(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr watchPosition(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getCurrentPosition(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue watchPosition(JSC::ExecState*, const JSC::ArgList&);
     Geolocation* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Geolocation> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Geolocation*);
-Geolocation* toGeolocation(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Geolocation*);
+Geolocation* toGeolocation(JSC::JSValue);
 
 class JSGeolocationPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -72,12 +73,12 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsGeolocationPrototypeFunctionGetCurrentPosition(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsGeolocationPrototypeFunctionWatchPosition(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsGeolocationPrototypeFunctionClearWatch(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsGeolocationPrototypeFunctionGetCurrentPosition(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsGeolocationPrototypeFunctionWatchPosition(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsGeolocationPrototypeFunctionClearWatch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsGeolocationLastPosition(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsGeolocationLastPosition(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp
index fea5d2f..35399cf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.cpp
@@ -19,44 +19,37 @@
 */
 
 #include "config.h"
-
 #include "JSGeoposition.h"
 
-#include <wtf/GetPtr.h>
-
+#include "Coordinates.h"
 #include "Geoposition.h"
+#include "JSCoordinates.h"
 #include "KURL.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSGeoposition)
+ASSERT_CLASS_FITS_IN_CELL(JSGeoposition);
 
 /* Hash table */
 
-static const HashTableValue JSGeopositionTableValues[9] =
+static const HashTableValue JSGeopositionTableValues[3] =
 {
-    { "latitude", DontDelete|ReadOnly, (intptr_t)jsGeopositionLatitude, (intptr_t)0 },
-    { "longitude", DontDelete|ReadOnly, (intptr_t)jsGeopositionLongitude, (intptr_t)0 },
-    { "altitude", DontDelete|ReadOnly, (intptr_t)jsGeopositionAltitude, (intptr_t)0 },
-    { "accuracy", DontDelete|ReadOnly, (intptr_t)jsGeopositionAccuracy, (intptr_t)0 },
-    { "altitudeAccuracy", DontDelete|ReadOnly, (intptr_t)jsGeopositionAltitudeAccuracy, (intptr_t)0 },
-    { "heading", DontDelete|ReadOnly, (intptr_t)jsGeopositionHeading, (intptr_t)0 },
-    { "speed", DontDelete|ReadOnly, (intptr_t)jsGeopositionSpeed, (intptr_t)0 },
+    { "coords", DontDelete|ReadOnly, (intptr_t)jsGeopositionCoords, (intptr_t)0 },
     { "timestamp", DontDelete|ReadOnly, (intptr_t)jsGeopositionTimestamp, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static const HashTable JSGeopositionTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 255, JSGeopositionTableValues, 0 };
+    { 3, JSGeopositionTableValues, 0 };
 #else
-    { 17, 15, JSGeopositionTableValues, 0 };
+    { 4, 3, JSGeopositionTableValues, 0 };
 #endif
 
 /* Hash table for prototype */
@@ -76,9 +69,9 @@ static const HashTable JSGeopositionPrototypeTable =
 
 const ClassInfo JSGeopositionPrototype::s_info = { "GeopositionPrototype", 0, &JSGeopositionPrototypeTable, 0 };
 
-JSObject* JSGeopositionPrototype::self(ExecState* exec)
+JSObject* JSGeopositionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSGeoposition>(exec);
+    return getDOMPrototype<JSGeoposition>(exec, globalObject);
 }
 
 bool JSGeopositionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -97,12 +90,11 @@ JSGeoposition::JSGeoposition(PassRefPtr<Structure> structure, PassRefPtr<Geoposi
 JSGeoposition::~JSGeoposition()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSGeoposition::createPrototype(ExecState* exec)
+JSObject* JSGeoposition::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSGeopositionPrototype(JSGeopositionPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSGeopositionPrototype(JSGeopositionPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSGeoposition::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -110,73 +102,40 @@ bool JSGeoposition::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSGeoposition, Base>(exec, &JSGeopositionTable, this, propertyName, slot);
 }
 
-JSValuePtr jsGeopositionLatitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    Geoposition* imp = static_cast<Geoposition*>(static_cast<JSGeoposition*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->latitude());
-}
-
-JSValuePtr jsGeopositionLongitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    Geoposition* imp = static_cast<Geoposition*>(static_cast<JSGeoposition*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->longitude());
-}
-
-JSValuePtr jsGeopositionAltitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    Geoposition* imp = static_cast<Geoposition*>(static_cast<JSGeoposition*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->altitude());
-}
-
-JSValuePtr jsGeopositionAccuracy(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    Geoposition* imp = static_cast<Geoposition*>(static_cast<JSGeoposition*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->accuracy());
-}
-
-JSValuePtr jsGeopositionAltitudeAccuracy(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    Geoposition* imp = static_cast<Geoposition*>(static_cast<JSGeoposition*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->altitudeAccuracy());
-}
-
-JSValuePtr jsGeopositionHeading(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    Geoposition* imp = static_cast<Geoposition*>(static_cast<JSGeoposition*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->heading());
-}
-
-JSValuePtr jsGeopositionSpeed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsGeopositionCoords(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Geoposition* imp = static_cast<Geoposition*>(static_cast<JSGeoposition*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->speed());
+    return toJS(exec, WTF::getPtr(imp->coords()));
 }
 
-JSValuePtr jsGeopositionTimestamp(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsGeopositionTimestamp(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Geoposition* imp = static_cast<Geoposition*>(static_cast<JSGeoposition*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->timestamp());
 }
 
-JSValuePtr jsGeopositionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsGeopositionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSGeoposition::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSGeoposition::s_info))
         return throwError(exec, TypeError);
     JSGeoposition* castedThisObj = static_cast<JSGeoposition*>(asObject(thisValue));
     Geoposition* imp = static_cast<Geoposition*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->toString());
+    JSC::JSValue result = jsString(exec, imp->toString());
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Geoposition* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Geoposition* object)
 {
     return getDOMObjectWrapper<JSGeoposition>(exec, object);
 }
-Geoposition* toGeoposition(JSC::JSValuePtr value)
+Geoposition* toGeoposition(JSC::JSValue value)
 {
-    return value->isObject(&JSGeoposition::s_info) ? static_cast<JSGeoposition*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSGeoposition::s_info) ? static_cast<JSGeoposition*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h
index a7f1ba9..200bb6e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSGeoposition.h
@@ -34,12 +34,12 @@ class JSGeoposition : public DOMObject {
 public:
     JSGeoposition(PassRefPtr<JSC::Structure>, PassRefPtr<Geoposition>);
     virtual ~JSGeoposition();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -50,16 +50,17 @@ private:
     RefPtr<Geoposition> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Geoposition*);
-Geoposition* toGeoposition(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Geoposition*);
+Geoposition* toGeoposition(JSC::JSValue);
 
 class JSGeopositionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -68,17 +69,11 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsGeopositionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsGeopositionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsGeopositionLatitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsGeopositionLongitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsGeopositionAltitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsGeopositionAccuracy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsGeopositionAltitudeAccuracy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsGeopositionHeading(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsGeopositionSpeed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsGeopositionTimestamp(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsGeopositionCoords(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsGeopositionTimestamp(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp
index 8198a75..c422551 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.cpp
@@ -19,23 +19,19 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLAnchorElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLAnchorElement.h"
 #include "KURL.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLAnchorElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLAnchorElement);
 
 /* Hash table */
 
@@ -90,13 +86,13 @@ public:
     JSHTMLAnchorElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLAnchorElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLAnchorElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLAnchorElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -126,9 +122,9 @@ static const HashTable JSHTMLAnchorElementPrototypeTable =
 
 const ClassInfo JSHTMLAnchorElementPrototype::s_info = { "HTMLAnchorElementPrototype", 0, &JSHTMLAnchorElementPrototypeTable, 0 };
 
-JSObject* JSHTMLAnchorElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLAnchorElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLAnchorElement>(exec);
+    return getDOMPrototype<JSHTMLAnchorElement>(exec, globalObject);
 }
 
 bool JSHTMLAnchorElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -143,9 +139,9 @@ JSHTMLAnchorElement::JSHTMLAnchorElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSHTMLAnchorElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLAnchorElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLAnchorElementPrototype(JSHTMLAnchorElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLAnchorElementPrototype(JSHTMLAnchorElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLAnchorElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -153,209 +149,229 @@ bool JSHTMLAnchorElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLAnchorElement, Base>(exec, &JSHTMLAnchorElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLAnchorElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->accessKey());
 }
 
-JSValuePtr jsHTMLAnchorElementCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->charset());
 }
 
-JSValuePtr jsHTMLAnchorElementCoords(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementCoords(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->coords());
 }
 
-JSValuePtr jsHTMLAnchorElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->href());
 }
 
-JSValuePtr jsHTMLAnchorElementHreflang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementHreflang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->hreflang());
 }
 
-JSValuePtr jsHTMLAnchorElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLAnchorElementRel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementRel(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->rel());
 }
 
-JSValuePtr jsHTMLAnchorElementRev(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementRev(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->rev());
 }
 
-JSValuePtr jsHTMLAnchorElementShape(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementShape(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->shape());
 }
 
-JSValuePtr jsHTMLAnchorElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->target());
 }
 
-JSValuePtr jsHTMLAnchorElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLAnchorElementHash(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementHash(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->hash());
 }
 
-JSValuePtr jsHTMLAnchorElementHost(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementHost(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->host());
 }
 
-JSValuePtr jsHTMLAnchorElementHostname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementHostname(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->hostname());
 }
 
-JSValuePtr jsHTMLAnchorElementPathname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementPathname(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->pathname());
 }
 
-JSValuePtr jsHTMLAnchorElementPort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementPort(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->port());
 }
 
-JSValuePtr jsHTMLAnchorElementProtocol(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementProtocol(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->protocol());
 }
 
-JSValuePtr jsHTMLAnchorElementSearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementSearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->search());
 }
 
-JSValuePtr jsHTMLAnchorElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->text());
 }
 
-JSValuePtr jsHTMLAnchorElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAnchorElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLAnchorElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLAnchorElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLAnchorElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLAnchorElement, Base>(exec, propertyName, value, &JSHTMLAnchorElementTable, this, slot);
 }
 
-void setJSHTMLAnchorElementAccessKey(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAnchorElementAccessKey(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
     imp->setAccessKey(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAnchorElementCharset(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAnchorElementCharset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
     imp->setCharset(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAnchorElementCoords(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAnchorElementCoords(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
     imp->setCoords(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAnchorElementHref(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAnchorElementHref(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
     imp->setHref(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAnchorElementHreflang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAnchorElementHreflang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
     imp->setHreflang(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAnchorElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAnchorElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAnchorElementRel(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAnchorElementRel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
     imp->setRel(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAnchorElementRev(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAnchorElementRev(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
     imp->setRev(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAnchorElementShape(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAnchorElementShape(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
     imp->setShape(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAnchorElementTarget(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAnchorElementTarget(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
     imp->setTarget(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAnchorElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAnchorElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(static_cast<JSHTMLAnchorElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLAnchorElement::getConstructor(ExecState* exec)
+JSValue JSHTMLAnchorElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLAnchorElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLAnchorElementPrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLAnchorElementPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLAnchorElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLAnchorElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLAnchorElement* castedThisObj = static_cast<JSHTMLAnchorElement*>(asObject(thisValue));
     HTMLAnchorElement* imp = static_cast<HTMLAnchorElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->toString());
+    JSC::JSValue result = jsString(exec, imp->toString());
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h
index 35e0b75..b7864c4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAnchorElement.h
@@ -31,28 +31,29 @@ class JSHTMLAnchorElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLAnchorElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLAnchorElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLAnchorElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -61,40 +62,40 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLAnchorElementPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLAnchorElementPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLAnchorElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAnchorElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAnchorElementCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAnchorElementCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAnchorElementCoords(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAnchorElementCoords(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAnchorElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAnchorElementHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAnchorElementHreflang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAnchorElementHreflang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAnchorElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAnchorElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAnchorElementRel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAnchorElementRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAnchorElementRev(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAnchorElementRev(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAnchorElementShape(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAnchorElementShape(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAnchorElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAnchorElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAnchorElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAnchorElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAnchorElementHash(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAnchorElementHost(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAnchorElementHostname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAnchorElementPathname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAnchorElementPort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAnchorElementProtocol(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAnchorElementSearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAnchorElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAnchorElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAnchorElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAnchorElementCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementCoords(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAnchorElementCoords(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAnchorElementHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementHreflang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAnchorElementHreflang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAnchorElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementRel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAnchorElementRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementRev(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAnchorElementRev(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementShape(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAnchorElementShape(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAnchorElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAnchorElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAnchorElementHash(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementHost(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementHostname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementPathname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementPort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementProtocol(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementSearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAnchorElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp
index e77aba5..787c2c7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.cpp
@@ -19,24 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLAppletElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "AtomicString.h"
 #include "HTMLAppletElement.h"
 #include "JSHTMLAppletElementCustom.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLAppletElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLAppletElement);
 
 /* Hash table */
 
@@ -83,13 +79,13 @@ public:
     JSHTMLAppletElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLAppletElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLAppletElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLAppletElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -118,9 +114,9 @@ static const HashTable JSHTMLAppletElementPrototypeTable =
 
 const ClassInfo JSHTMLAppletElementPrototype::s_info = { "HTMLAppletElementPrototype", 0, &JSHTMLAppletElementPrototypeTable, 0 };
 
-JSObject* JSHTMLAppletElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLAppletElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLAppletElement>(exec);
+    return getDOMPrototype<JSHTMLAppletElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLAppletElement::s_info = { "HTMLAppletElement", &JSHTMLElement::s_info, &JSHTMLAppletElementTable, 0 };
@@ -130,9 +126,9 @@ JSHTMLAppletElement::JSHTMLAppletElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSHTMLAppletElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLAppletElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLAppletElementPrototype(JSHTMLAppletElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLAppletElementPrototype(JSHTMLAppletElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLAppletElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -141,155 +137,166 @@ bool JSHTMLAppletElement::getOwnPropertySlot(ExecState* exec, const Identifier&
         slot.setCustom(this, nameGetter);
         return true;
     }
-    if (customGetOwnPropertySlot(exec, propertyName, slot))
+    if (getOwnPropertySlotDelegate(exec, propertyName, slot))
         return true;
     return getStaticValueSlot<JSHTMLAppletElement, Base>(exec, &JSHTMLAppletElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLAppletElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLAppletElementAlt(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementAlt(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->alt());
 }
 
-JSValuePtr jsHTMLAppletElementArchive(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementArchive(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->archive());
 }
 
-JSValuePtr jsHTMLAppletElementCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->code());
 }
 
-JSValuePtr jsHTMLAppletElementCodeBase(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementCodeBase(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->codeBase());
 }
 
-JSValuePtr jsHTMLAppletElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->height());
 }
 
-JSValuePtr jsHTMLAppletElementHspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementHspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->hspace());
 }
 
-JSValuePtr jsHTMLAppletElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLAppletElementObject(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementObject(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->object());
 }
 
-JSValuePtr jsHTMLAppletElementVspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementVspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->vspace());
 }
 
-JSValuePtr jsHTMLAppletElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->width());
 }
 
-JSValuePtr jsHTMLAppletElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAppletElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLAppletElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLAppletElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLAppletElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    if (customPut(exec, propertyName, value, slot))
+    if (putDelegate(exec, propertyName, value, slot))
         return;
     lookupPut<JSHTMLAppletElement, Base>(exec, propertyName, value, &JSHTMLAppletElementTable, this, slot);
 }
 
-void setJSHTMLAppletElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAppletElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAppletElementAlt(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAppletElementAlt(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
     imp->setAlt(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAppletElementArchive(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAppletElementArchive(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
     imp->setArchive(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAppletElementCode(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAppletElementCode(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
     imp->setCode(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAppletElementCodeBase(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAppletElementCodeBase(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
     imp->setCodeBase(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAppletElementHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAppletElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
     imp->setHeight(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAppletElementHspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAppletElementHspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
     imp->setHspace(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAppletElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAppletElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAppletElementObject(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAppletElementObject(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
     imp->setObject(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAppletElementVspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAppletElementVspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
     imp->setVspace(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAppletElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAppletElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAppletElement* imp = static_cast<HTMLAppletElement*>(static_cast<JSHTMLAppletElement*>(thisObject)->impl());
     imp->setWidth(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLAppletElement::getConstructor(ExecState* exec)
+JSValue JSHTMLAppletElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLAppletElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h
index dd64eeb..0ebfc7b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAppletElement.h
@@ -32,31 +32,32 @@ class JSHTMLAppletElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLAppletElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLAppletElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    bool customGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLAppletElement*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
 
 class JSHTMLAppletElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLAppletElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -64,29 +65,29 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLAppletElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAppletElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAppletElementAlt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAppletElementAlt(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAppletElementArchive(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAppletElementArchive(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAppletElementCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAppletElementCode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAppletElementCodeBase(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAppletElementCodeBase(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAppletElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAppletElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAppletElementHspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAppletElementHspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAppletElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAppletElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAppletElementObject(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAppletElementObject(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAppletElementVspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAppletElementVspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAppletElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAppletElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAppletElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAppletElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAppletElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAppletElementAlt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAppletElementAlt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAppletElementArchive(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAppletElementArchive(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAppletElementCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAppletElementCode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAppletElementCodeBase(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAppletElementCodeBase(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAppletElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAppletElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAppletElementHspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAppletElementHspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAppletElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAppletElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAppletElementObject(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAppletElementObject(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAppletElementVspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAppletElementVspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAppletElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAppletElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAppletElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp
index d7d165f..1d40591 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.cpp
@@ -19,22 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLAreaElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLAreaElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLAreaElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLAreaElement);
 
 /* Hash table */
 
@@ -84,13 +80,13 @@ public:
     JSHTMLAreaElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLAreaElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLAreaElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLAreaElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -119,9 +115,9 @@ static const HashTable JSHTMLAreaElementPrototypeTable =
 
 const ClassInfo JSHTMLAreaElementPrototype::s_info = { "HTMLAreaElementPrototype", 0, &JSHTMLAreaElementPrototypeTable, 0 };
 
-JSObject* JSHTMLAreaElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLAreaElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLAreaElement>(exec);
+    return getDOMPrototype<JSHTMLAreaElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLAreaElement::s_info = { "HTMLAreaElement", &JSHTMLElement::s_info, &JSHTMLAreaElementTable, 0 };
@@ -131,9 +127,9 @@ JSHTMLAreaElement::JSHTMLAreaElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSHTMLAreaElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLAreaElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLAreaElementPrototype(JSHTMLAreaElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLAreaElementPrototype(JSHTMLAreaElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLAreaElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -141,142 +137,156 @@ bool JSHTMLAreaElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLAreaElement, Base>(exec, &JSHTMLAreaElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLAreaElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->accessKey());
 }
 
-JSValuePtr jsHTMLAreaElementAlt(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementAlt(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->alt());
 }
 
-JSValuePtr jsHTMLAreaElementCoords(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementCoords(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->coords());
 }
 
-JSValuePtr jsHTMLAreaElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->href());
 }
 
-JSValuePtr jsHTMLAreaElementNoHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementNoHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->noHref());
 }
 
-JSValuePtr jsHTMLAreaElementShape(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementShape(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->shape());
 }
 
-JSValuePtr jsHTMLAreaElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->target());
 }
 
-JSValuePtr jsHTMLAreaElementHash(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementHash(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->hash());
 }
 
-JSValuePtr jsHTMLAreaElementHost(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementHost(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->host());
 }
 
-JSValuePtr jsHTMLAreaElementHostname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementHostname(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->hostname());
 }
 
-JSValuePtr jsHTMLAreaElementPathname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementPathname(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->pathname());
 }
 
-JSValuePtr jsHTMLAreaElementPort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementPort(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->port());
 }
 
-JSValuePtr jsHTMLAreaElementProtocol(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementProtocol(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->protocol());
 }
 
-JSValuePtr jsHTMLAreaElementSearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementSearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->search());
 }
 
-JSValuePtr jsHTMLAreaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAreaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLAreaElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLAreaElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLAreaElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLAreaElement, Base>(exec, propertyName, value, &JSHTMLAreaElementTable, this, slot);
 }
 
-void setJSHTMLAreaElementAccessKey(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAreaElementAccessKey(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(thisObject)->impl());
     imp->setAccessKey(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAreaElementAlt(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAreaElementAlt(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(thisObject)->impl());
     imp->setAlt(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAreaElementCoords(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAreaElementCoords(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(thisObject)->impl());
     imp->setCoords(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAreaElementHref(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAreaElementHref(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(thisObject)->impl());
     imp->setHref(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAreaElementNoHref(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAreaElementNoHref(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(thisObject)->impl());
-    imp->setNoHref(value->toBoolean(exec));
+    imp->setNoHref(value.toBoolean(exec));
 }
 
-void setJSHTMLAreaElementShape(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAreaElementShape(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(thisObject)->impl());
     imp->setShape(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLAreaElementTarget(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLAreaElementTarget(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLAreaElement* imp = static_cast<HTMLAreaElement*>(static_cast<JSHTMLAreaElement*>(thisObject)->impl());
     imp->setTarget(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLAreaElement::getConstructor(ExecState* exec)
+JSValue JSHTMLAreaElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLAreaElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h
index fe37030..9d2d8fc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAreaElement.h
@@ -31,24 +31,25 @@ class JSHTMLAreaElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLAreaElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLAreaElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLAreaElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLAreaElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,28 +57,28 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLAreaElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAreaElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAreaElementAlt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAreaElementAlt(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAreaElementCoords(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAreaElementCoords(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAreaElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAreaElementHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAreaElementNoHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAreaElementNoHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAreaElementShape(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAreaElementShape(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAreaElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLAreaElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLAreaElementHash(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAreaElementHost(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAreaElementHostname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAreaElementPathname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAreaElementPort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAreaElementProtocol(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAreaElementSearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLAreaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAreaElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAreaElementAlt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAreaElementAlt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAreaElementCoords(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAreaElementCoords(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAreaElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAreaElementHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAreaElementNoHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAreaElementNoHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAreaElementShape(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAreaElementShape(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAreaElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLAreaElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLAreaElementHash(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementHost(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementHostname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementPathname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementPort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementProtocol(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementSearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAreaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp
index 630170e..00db209 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(VIDEO)
 
 #include "JSHTMLAudioElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLAudioElement.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLAudioElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLAudioElement);
 
 /* Hash table */
 
@@ -71,13 +67,13 @@ public:
     JSHTMLAudioElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLAudioElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLAudioElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLAudioElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +102,9 @@ static const HashTable JSHTMLAudioElementPrototypeTable =
 
 const ClassInfo JSHTMLAudioElementPrototype::s_info = { "HTMLAudioElementPrototype", 0, &JSHTMLAudioElementPrototypeTable, 0 };
 
-JSObject* JSHTMLAudioElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLAudioElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLAudioElement>(exec);
+    return getDOMPrototype<JSHTMLAudioElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLAudioElement::s_info = { "HTMLAudioElement", &JSHTMLMediaElement::s_info, &JSHTMLAudioElementTable, 0 };
@@ -118,9 +114,9 @@ JSHTMLAudioElement::JSHTMLAudioElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLAudioElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLAudioElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLAudioElementPrototype(JSHTMLAudioElementPrototype::createStructure(JSHTMLMediaElementPrototype::self(exec)));
+    return new (exec) JSHTMLAudioElementPrototype(JSHTMLAudioElementPrototype::createStructure(JSHTMLMediaElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLAudioElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,11 +124,11 @@ bool JSHTMLAudioElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLAudioElement, Base>(exec, &JSHTMLAudioElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLAudioElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLAudioElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLAudioElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSHTMLAudioElement::getConstructor(ExecState* exec)
+JSValue JSHTMLAudioElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLAudioElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h
index 3c16726..cea0209 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLAudioElement.h
@@ -21,7 +21,6 @@
 #ifndef JSHTMLAudioElement_h
 #define JSHTMLAudioElement_h
 
-
 #if ENABLE(VIDEO)
 
 #include "JSHTMLMediaElement.h"
@@ -34,23 +33,24 @@ class JSHTMLAudioElement : public JSHTMLMediaElement {
     typedef JSHTMLMediaElement Base;
 public:
     JSHTMLAudioElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLAudioElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLAudioElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLAudioElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,7 +58,7 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLAudioElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLAudioElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp
index 439004c..aff5b90 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.cpp
@@ -19,22 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLBRElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLBRElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLBRElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLBRElement);
 
 /* Hash table */
 
@@ -71,13 +67,13 @@ public:
     JSHTMLBRElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLBRElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLBRElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLBRElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +102,9 @@ static const HashTable JSHTMLBRElementPrototypeTable =
 
 const ClassInfo JSHTMLBRElementPrototype::s_info = { "HTMLBRElementPrototype", 0, &JSHTMLBRElementPrototypeTable, 0 };
 
-JSObject* JSHTMLBRElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLBRElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLBRElement>(exec);
+    return getDOMPrototype<JSHTMLBRElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLBRElement::s_info = { "HTMLBRElement", &JSHTMLElement::s_info, &JSHTMLBRElementTable, 0 };
@@ -118,9 +114,9 @@ JSHTMLBRElement::JSHTMLBRElement(PassRefPtr<Structure> structure, PassRefPtr<HTM
 {
 }
 
-JSObject* JSHTMLBRElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLBRElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLBRElementPrototype(JSHTMLBRElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLBRElementPrototype(JSHTMLBRElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLBRElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,28 +124,29 @@ bool JSHTMLBRElement::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSHTMLBRElement, Base>(exec, &JSHTMLBRElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLBRElementClear(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBRElementClear(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBRElement* imp = static_cast<HTMLBRElement*>(static_cast<JSHTMLBRElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->clear());
 }
 
-JSValuePtr jsHTMLBRElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBRElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLBRElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLBRElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLBRElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLBRElement, Base>(exec, propertyName, value, &JSHTMLBRElementTable, this, slot);
 }
 
-void setJSHTMLBRElementClear(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBRElementClear(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBRElement* imp = static_cast<HTMLBRElement*>(static_cast<JSHTMLBRElement*>(thisObject)->impl());
     imp->setClear(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLBRElement::getConstructor(ExecState* exec)
+JSValue JSHTMLBRElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLBRElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h
index 1dc4026..3352cb7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBRElement.h
@@ -31,24 +31,25 @@ class JSHTMLBRElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLBRElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLBRElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLBRElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLBRElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLBRElementClear(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBRElementClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBRElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBRElementClear(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBRElementClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBRElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp
index 1b35657..d0c6502 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.cpp
@@ -19,22 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLBaseElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLBaseElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLBaseElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLBaseElement);
 
 /* Hash table */
 
@@ -72,13 +68,13 @@ public:
     JSHTMLBaseElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLBaseElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLBaseElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLBaseElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -107,9 +103,9 @@ static const HashTable JSHTMLBaseElementPrototypeTable =
 
 const ClassInfo JSHTMLBaseElementPrototype::s_info = { "HTMLBaseElementPrototype", 0, &JSHTMLBaseElementPrototypeTable, 0 };
 
-JSObject* JSHTMLBaseElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLBaseElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLBaseElement>(exec);
+    return getDOMPrototype<JSHTMLBaseElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLBaseElement::s_info = { "HTMLBaseElement", &JSHTMLElement::s_info, &JSHTMLBaseElementTable, 0 };
@@ -119,9 +115,9 @@ JSHTMLBaseElement::JSHTMLBaseElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSHTMLBaseElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLBaseElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLBaseElementPrototype(JSHTMLBaseElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLBaseElementPrototype(JSHTMLBaseElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLBaseElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -129,40 +125,42 @@ bool JSHTMLBaseElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLBaseElement, Base>(exec, &JSHTMLBaseElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLBaseElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBaseElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBaseElement* imp = static_cast<HTMLBaseElement*>(static_cast<JSHTMLBaseElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->href());
 }
 
-JSValuePtr jsHTMLBaseElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBaseElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBaseElement* imp = static_cast<HTMLBaseElement*>(static_cast<JSHTMLBaseElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->target());
 }
 
-JSValuePtr jsHTMLBaseElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBaseElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLBaseElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLBaseElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLBaseElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLBaseElement, Base>(exec, propertyName, value, &JSHTMLBaseElementTable, this, slot);
 }
 
-void setJSHTMLBaseElementHref(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBaseElementHref(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBaseElement* imp = static_cast<HTMLBaseElement*>(static_cast<JSHTMLBaseElement*>(thisObject)->impl());
     imp->setHref(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLBaseElementTarget(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBaseElementTarget(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBaseElement* imp = static_cast<HTMLBaseElement*>(static_cast<JSHTMLBaseElement*>(thisObject)->impl());
     imp->setTarget(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLBaseElement::getConstructor(ExecState* exec)
+JSValue JSHTMLBaseElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLBaseElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h
index 8c5482e..8fdbe06 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseElement.h
@@ -31,24 +31,25 @@ class JSHTMLBaseElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLBaseElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLBaseElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLBaseElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLBaseElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,11 +57,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLBaseElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBaseElementHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBaseElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBaseElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBaseElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBaseElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBaseElementHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBaseElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBaseElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBaseElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp
index d942d86..24288a2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.cpp
@@ -19,22 +19,19 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLBaseFontElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLBaseFontElement.h"
 #include "KURL.h"
-
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLBaseFontElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLBaseFontElement);
 
 /* Hash table */
 
@@ -73,13 +70,13 @@ public:
     JSHTMLBaseFontElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLBaseFontElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLBaseFontElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLBaseFontElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -108,9 +105,9 @@ static const HashTable JSHTMLBaseFontElementPrototypeTable =
 
 const ClassInfo JSHTMLBaseFontElementPrototype::s_info = { "HTMLBaseFontElementPrototype", 0, &JSHTMLBaseFontElementPrototypeTable, 0 };
 
-JSObject* JSHTMLBaseFontElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLBaseFontElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLBaseFontElement>(exec);
+    return getDOMPrototype<JSHTMLBaseFontElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLBaseFontElement::s_info = { "HTMLBaseFontElement", &JSHTMLElement::s_info, &JSHTMLBaseFontElementTable, 0 };
@@ -120,9 +117,9 @@ JSHTMLBaseFontElement::JSHTMLBaseFontElement(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSHTMLBaseFontElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLBaseFontElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLBaseFontElementPrototype(JSHTMLBaseFontElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLBaseFontElementPrototype(JSHTMLBaseFontElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLBaseFontElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -130,52 +127,55 @@ bool JSHTMLBaseFontElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSHTMLBaseFontElement, Base>(exec, &JSHTMLBaseFontElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLBaseFontElementColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBaseFontElementColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBaseFontElement* imp = static_cast<HTMLBaseFontElement*>(static_cast<JSHTMLBaseFontElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->color());
 }
 
-JSValuePtr jsHTMLBaseFontElementFace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBaseFontElementFace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBaseFontElement* imp = static_cast<HTMLBaseFontElement*>(static_cast<JSHTMLBaseFontElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->face());
 }
 
-JSValuePtr jsHTMLBaseFontElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBaseFontElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBaseFontElement* imp = static_cast<HTMLBaseFontElement*>(static_cast<JSHTMLBaseFontElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->size());
 }
 
-JSValuePtr jsHTMLBaseFontElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBaseFontElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLBaseFontElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLBaseFontElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLBaseFontElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLBaseFontElement, Base>(exec, propertyName, value, &JSHTMLBaseFontElementTable, this, slot);
 }
 
-void setJSHTMLBaseFontElementColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBaseFontElementColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBaseFontElement* imp = static_cast<HTMLBaseFontElement*>(static_cast<JSHTMLBaseFontElement*>(thisObject)->impl());
     imp->setColor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLBaseFontElementFace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBaseFontElementFace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBaseFontElement* imp = static_cast<HTMLBaseFontElement*>(static_cast<JSHTMLBaseFontElement*>(thisObject)->impl());
     imp->setFace(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLBaseFontElementSize(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBaseFontElementSize(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBaseFontElement* imp = static_cast<HTMLBaseFontElement*>(static_cast<JSHTMLBaseFontElement*>(thisObject)->impl());
-    imp->setSize(value->toInt32(exec));
+    imp->setSize(value.toInt32(exec));
 }
 
-JSValuePtr JSHTMLBaseFontElement::getConstructor(ExecState* exec)
+JSValue JSHTMLBaseFontElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLBaseFontElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h
index d09fc2b..534bb80 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBaseFontElement.h
@@ -31,24 +31,25 @@ class JSHTMLBaseFontElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLBaseFontElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLBaseFontElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLBaseFontElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLBaseFontElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,13 +57,13 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLBaseFontElementColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBaseFontElementColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBaseFontElementFace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBaseFontElementFace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBaseFontElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBaseFontElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBaseFontElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBaseFontElementColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBaseFontElementColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBaseFontElementFace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBaseFontElementFace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBaseFontElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBaseFontElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBaseFontElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp
index 7f982aa..aa108aa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.cpp
@@ -19,22 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLBlockquoteElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLBlockquoteElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLBlockquoteElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLBlockquoteElement);
 
 /* Hash table */
 
@@ -71,13 +67,13 @@ public:
     JSHTMLBlockquoteElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLBlockquoteElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLBlockquoteElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLBlockquoteElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +102,9 @@ static const HashTable JSHTMLBlockquoteElementPrototypeTable =
 
 const ClassInfo JSHTMLBlockquoteElementPrototype::s_info = { "HTMLBlockquoteElementPrototype", 0, &JSHTMLBlockquoteElementPrototypeTable, 0 };
 
-JSObject* JSHTMLBlockquoteElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLBlockquoteElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLBlockquoteElement>(exec);
+    return getDOMPrototype<JSHTMLBlockquoteElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLBlockquoteElement::s_info = { "HTMLBlockquoteElement", &JSHTMLElement::s_info, &JSHTMLBlockquoteElementTable, 0 };
@@ -118,9 +114,9 @@ JSHTMLBlockquoteElement::JSHTMLBlockquoteElement(PassRefPtr<Structure> structure
 {
 }
 
-JSObject* JSHTMLBlockquoteElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLBlockquoteElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLBlockquoteElementPrototype(JSHTMLBlockquoteElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLBlockquoteElementPrototype(JSHTMLBlockquoteElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLBlockquoteElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,28 +124,29 @@ bool JSHTMLBlockquoteElement::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSHTMLBlockquoteElement, Base>(exec, &JSHTMLBlockquoteElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLBlockquoteElementCite(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBlockquoteElementCite(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBlockquoteElement* imp = static_cast<HTMLBlockquoteElement*>(static_cast<JSHTMLBlockquoteElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->cite());
 }
 
-JSValuePtr jsHTMLBlockquoteElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBlockquoteElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLBlockquoteElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLBlockquoteElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLBlockquoteElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLBlockquoteElement, Base>(exec, propertyName, value, &JSHTMLBlockquoteElementTable, this, slot);
 }
 
-void setJSHTMLBlockquoteElementCite(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBlockquoteElementCite(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBlockquoteElement* imp = static_cast<HTMLBlockquoteElement*>(static_cast<JSHTMLBlockquoteElement*>(thisObject)->impl());
     imp->setCite(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLBlockquoteElement::getConstructor(ExecState* exec)
+JSValue JSHTMLBlockquoteElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLBlockquoteElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h
index 86bf06b..7949bdd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBlockquoteElement.h
@@ -31,24 +31,25 @@ class JSHTMLBlockquoteElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLBlockquoteElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLBlockquoteElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLBlockquoteElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLBlockquoteElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLBlockquoteElementCite(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBlockquoteElementCite(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBlockquoteElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBlockquoteElementCite(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBlockquoteElementCite(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBlockquoteElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp
index c68d2ac..6da9517 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.cpp
@@ -19,26 +19,26 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLBodyElement.h"
 
-#include <wtf/GetPtr.h>
-
+#include "EventListener.h"
+#include "Frame.h"
 #include "HTMLBodyElement.h"
+#include "JSDOMGlobalObject.h"
+#include "JSEventListener.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLBodyElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLBodyElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLBodyElementTableValues[12] =
+static const HashTableValue JSHTMLBodyElementTableValues[15] =
 {
     { "aLink", DontDelete, (intptr_t)jsHTMLBodyElementALink, (intptr_t)setJSHTMLBodyElementALink },
     { "background", DontDelete, (intptr_t)jsHTMLBodyElementBackground, (intptr_t)setJSHTMLBodyElementBackground },
@@ -46,10 +46,13 @@ static const HashTableValue JSHTMLBodyElementTableValues[12] =
     { "link", DontDelete, (intptr_t)jsHTMLBodyElementLink, (intptr_t)setJSHTMLBodyElementLink },
     { "text", DontDelete, (intptr_t)jsHTMLBodyElementText, (intptr_t)setJSHTMLBodyElementText },
     { "vLink", DontDelete, (intptr_t)jsHTMLBodyElementVLink, (intptr_t)setJSHTMLBodyElementVLink },
-    { "scrollLeft", DontDelete, (intptr_t)jsHTMLBodyElementScrollLeft, (intptr_t)setJSHTMLBodyElementScrollLeft },
-    { "scrollTop", DontDelete, (intptr_t)jsHTMLBodyElementScrollTop, (intptr_t)setJSHTMLBodyElementScrollTop },
-    { "scrollWidth", DontDelete|ReadOnly, (intptr_t)jsHTMLBodyElementScrollWidth, (intptr_t)0 },
-    { "scrollHeight", DontDelete|ReadOnly, (intptr_t)jsHTMLBodyElementScrollHeight, (intptr_t)0 },
+    { "onbeforeunload", DontDelete|DontEnum, (intptr_t)jsHTMLBodyElementOnbeforeunload, (intptr_t)setJSHTMLBodyElementOnbeforeunload },
+    { "onmessage", DontDelete|DontEnum, (intptr_t)jsHTMLBodyElementOnmessage, (intptr_t)setJSHTMLBodyElementOnmessage },
+    { "onoffline", DontDelete|DontEnum, (intptr_t)jsHTMLBodyElementOnoffline, (intptr_t)setJSHTMLBodyElementOnoffline },
+    { "ononline", DontDelete|DontEnum, (intptr_t)jsHTMLBodyElementOnonline, (intptr_t)setJSHTMLBodyElementOnonline },
+    { "onresize", DontDelete|DontEnum, (intptr_t)jsHTMLBodyElementOnresize, (intptr_t)setJSHTMLBodyElementOnresize },
+    { "onstorage", DontDelete|DontEnum, (intptr_t)jsHTMLBodyElementOnstorage, (intptr_t)setJSHTMLBodyElementOnstorage },
+    { "onunload", DontDelete|DontEnum, (intptr_t)jsHTMLBodyElementOnunload, (intptr_t)setJSHTMLBodyElementOnunload },
     { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLBodyElementConstructor, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
@@ -58,7 +61,7 @@ static const HashTable JSHTMLBodyElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 63, JSHTMLBodyElementTableValues, 0 };
 #else
-    { 33, 31, JSHTMLBodyElementTableValues, 0 };
+    { 34, 31, JSHTMLBodyElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -80,13 +83,13 @@ public:
     JSHTMLBodyElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLBodyElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLBodyElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLBodyElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -115,9 +118,9 @@ static const HashTable JSHTMLBodyElementPrototypeTable =
 
 const ClassInfo JSHTMLBodyElementPrototype::s_info = { "HTMLBodyElementPrototype", 0, &JSHTMLBodyElementPrototypeTable, 0 };
 
-JSObject* JSHTMLBodyElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLBodyElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLBodyElement>(exec);
+    return getDOMPrototype<JSHTMLBodyElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLBodyElement::s_info = { "HTMLBodyElement", &JSHTMLElement::s_info, &JSHTMLBodyElementTable, 0 };
@@ -127,9 +130,9 @@ JSHTMLBodyElement::JSHTMLBodyElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSHTMLBodyElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLBodyElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLBodyElementPrototype(JSHTMLBodyElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLBodyElementPrototype(JSHTMLBodyElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLBodyElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -137,124 +140,241 @@ bool JSHTMLBodyElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLBodyElement, Base>(exec, &JSHTMLBodyElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLBodyElementALink(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementALink(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->aLink());
 }
 
-JSValuePtr jsHTMLBodyElementBackground(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementBackground(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->background());
 }
 
-JSValuePtr jsHTMLBodyElementBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->bgColor());
 }
 
-JSValuePtr jsHTMLBodyElementLink(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementLink(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->link());
 }
 
-JSValuePtr jsHTMLBodyElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->text());
 }
 
-JSValuePtr jsHTMLBodyElementVLink(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementVLink(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->vLink());
 }
 
-JSValuePtr jsHTMLBodyElementScrollLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementOnbeforeunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onbeforeunload()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsHTMLBodyElementOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmessage()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsHTMLBodyElementOnoffline(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->scrollLeft());
+    if (EventListener* listener = imp->onoffline()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
 }
 
-JSValuePtr jsHTMLBodyElementScrollTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementOnonline(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->scrollTop());
+    if (EventListener* listener = imp->ononline()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsHTMLBodyElementOnresize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onresize()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
 }
 
-JSValuePtr jsHTMLBodyElementScrollWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementOnstorage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->scrollWidth());
+    if (EventListener* listener = imp->onstorage()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
 }
 
-JSValuePtr jsHTMLBodyElementScrollHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementOnunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->scrollHeight());
+    if (EventListener* listener = imp->onunload()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
 }
 
-JSValuePtr jsHTMLBodyElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLBodyElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLBodyElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLBodyElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLBodyElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLBodyElement, Base>(exec, propertyName, value, &JSHTMLBodyElementTable, this, slot);
 }
 
-void setJSHTMLBodyElementALink(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBodyElementALink(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
     imp->setALink(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLBodyElementBackground(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBodyElementBackground(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
     imp->setBackground(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLBodyElementBgColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBodyElementBgColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
     imp->setBgColor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLBodyElementLink(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBodyElementLink(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
     imp->setLink(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLBodyElementText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBodyElementText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
     imp->setText(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLBodyElementVLink(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBodyElementVLink(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
     imp->setVLink(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLBodyElementScrollLeft(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBodyElementOnbeforeunload(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnbeforeunload(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSHTMLBodyElementOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSHTMLBodyElementOnoffline(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnoffline(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSHTMLBodyElementOnonline(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnonline(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSHTMLBodyElementOnresize(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnresize(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSHTMLBodyElementOnstorage(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
-    imp->setScrollLeft(value->toInt32(exec));
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnstorage(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSHTMLBodyElementScrollTop(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLBodyElementOnunload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     HTMLBodyElement* imp = static_cast<HTMLBodyElement*>(static_cast<JSHTMLBodyElement*>(thisObject)->impl());
-    imp->setScrollTop(value->toInt32(exec));
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnunload(globalObject->createJSAttributeEventListener(value));
 }
 
-JSValuePtr JSHTMLBodyElement::getConstructor(ExecState* exec)
+JSValue JSHTMLBodyElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLBodyElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h
index 784bf79..caabc5b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLBodyElement.h
@@ -31,24 +31,25 @@ class JSHTMLBodyElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLBodyElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLBodyElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLBodyElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLBodyElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,25 +57,33 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLBodyElementALink(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBodyElementALink(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBodyElementBackground(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBodyElementBackground(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBodyElementBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBodyElementBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBodyElementLink(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBodyElementLink(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBodyElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBodyElementText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBodyElementVLink(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBodyElementVLink(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBodyElementScrollLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBodyElementScrollLeft(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBodyElementScrollTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLBodyElementScrollTop(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLBodyElementScrollWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLBodyElementScrollHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLBodyElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLBodyElementALink(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBodyElementALink(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBodyElementBackground(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBodyElementBackground(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBodyElementBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBodyElementBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBodyElementLink(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBodyElementLink(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBodyElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBodyElementText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBodyElementVLink(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBodyElementVLink(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBodyElementOnbeforeunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBodyElementOnbeforeunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBodyElementOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBodyElementOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBodyElementOnoffline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBodyElementOnoffline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBodyElementOnonline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBodyElementOnonline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBodyElementOnresize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBodyElementOnresize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBodyElementOnstorage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBodyElementOnstorage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBodyElementOnunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLBodyElementOnunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLBodyElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp
index eea3361..96f463b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.cpp
@@ -19,25 +19,21 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLButtonElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLButtonElement.h"
 #include "HTMLFormElement.h"
 #include "JSHTMLFormElement.h"
 #include "KURL.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLButtonElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLButtonElement);
 
 /* Hash table */
 
@@ -81,13 +77,13 @@ public:
     JSHTMLButtonElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLButtonElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLButtonElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLButtonElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -117,9 +113,9 @@ static const HashTable JSHTMLButtonElementPrototypeTable =
 
 const ClassInfo JSHTMLButtonElementPrototype::s_info = { "HTMLButtonElementPrototype", 0, &JSHTMLButtonElementPrototypeTable, 0 };
 
-JSObject* JSHTMLButtonElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLButtonElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLButtonElement>(exec);
+    return getDOMPrototype<JSHTMLButtonElement>(exec, globalObject);
 }
 
 bool JSHTMLButtonElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -134,9 +130,9 @@ JSHTMLButtonElement::JSHTMLButtonElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSHTMLButtonElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLButtonElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLButtonElementPrototype(JSHTMLButtonElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLButtonElementPrototype(JSHTMLButtonElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLButtonElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -144,101 +140,110 @@ bool JSHTMLButtonElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLButtonElement, Base>(exec, &JSHTMLButtonElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLButtonElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->form()));
 }
 
-JSValuePtr jsHTMLButtonElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->accessKey());
 }
 
-JSValuePtr jsHTMLButtonElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->disabled());
 }
 
-JSValuePtr jsHTMLButtonElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->autofocus());
 }
 
-JSValuePtr jsHTMLButtonElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLButtonElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLButtonElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->value());
 }
 
-JSValuePtr jsHTMLButtonElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->willValidate());
 }
 
-JSValuePtr jsHTMLButtonElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLButtonElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLButtonElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLButtonElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLButtonElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLButtonElement, Base>(exec, propertyName, value, &JSHTMLButtonElementTable, this, slot);
 }
 
-void setJSHTMLButtonElementAccessKey(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLButtonElementAccessKey(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(thisObject)->impl());
     imp->setAccessKey(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLButtonElementDisabled(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLButtonElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(thisObject)->impl());
-    imp->setDisabled(value->toBoolean(exec));
+    imp->setDisabled(value.toBoolean(exec));
 }
 
-void setJSHTMLButtonElementAutofocus(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLButtonElementAutofocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(thisObject)->impl());
-    imp->setAutofocus(value->toBoolean(exec));
+    imp->setAutofocus(value.toBoolean(exec));
 }
 
-void setJSHTMLButtonElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLButtonElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLButtonElementValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLButtonElementValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(static_cast<JSHTMLButtonElement*>(thisObject)->impl());
     imp->setValue(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLButtonElement::getConstructor(ExecState* exec)
+JSValue JSHTMLButtonElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLButtonElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLButtonElementPrototypeFunctionClick(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLButtonElementPrototypeFunctionClick(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLButtonElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLButtonElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLButtonElement* castedThisObj = static_cast<JSHTMLButtonElement*>(asObject(thisValue));
     HTMLButtonElement* imp = static_cast<HTMLButtonElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h
index 85f7341..9849bbb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLButtonElement.h
@@ -31,28 +31,29 @@ class JSHTMLButtonElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLButtonElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLButtonElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLButtonElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -61,23 +62,23 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLButtonElementPrototypeFunctionClick(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLButtonElementPrototypeFunctionClick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLButtonElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLButtonElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLButtonElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLButtonElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLButtonElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLButtonElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLButtonElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLButtonElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLButtonElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLButtonElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLButtonElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLButtonElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLButtonElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLButtonElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLButtonElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLButtonElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLButtonElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLButtonElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLButtonElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLButtonElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLButtonElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLButtonElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLButtonElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLButtonElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLButtonElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLButtonElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLButtonElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLButtonElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp
index eee52cc..b90cbea 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.cpp
@@ -19,24 +19,21 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLCanvasElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLCanvasElement.h"
 #include "JSCanvasRenderingContext2D.h"
 #include "KURL.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLCanvasElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLCanvasElement);
 
 /* Hash table */
 
@@ -74,13 +71,13 @@ public:
     JSHTMLCanvasElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLCanvasElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLCanvasElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLCanvasElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +108,9 @@ static const HashTable JSHTMLCanvasElementPrototypeTable =
 
 const ClassInfo JSHTMLCanvasElementPrototype::s_info = { "HTMLCanvasElementPrototype", 0, &JSHTMLCanvasElementPrototypeTable, 0 };
 
-JSObject* JSHTMLCanvasElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLCanvasElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLCanvasElement>(exec);
+    return getDOMPrototype<JSHTMLCanvasElement>(exec, globalObject);
 }
 
 bool JSHTMLCanvasElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,9 +125,9 @@ JSHTMLCanvasElement::JSHTMLCanvasElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSHTMLCanvasElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLCanvasElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLCanvasElementPrototype(JSHTMLCanvasElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLCanvasElementPrototype(JSHTMLCanvasElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLCanvasElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -138,69 +135,73 @@ bool JSHTMLCanvasElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLCanvasElement, Base>(exec, &JSHTMLCanvasElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLCanvasElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLCanvasElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLCanvasElement* imp = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLCanvasElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->width());
 }
 
-JSValuePtr jsHTMLCanvasElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLCanvasElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLCanvasElement* imp = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLCanvasElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->height());
 }
 
-JSValuePtr jsHTMLCanvasElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLCanvasElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLCanvasElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLCanvasElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLCanvasElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLCanvasElement, Base>(exec, propertyName, value, &JSHTMLCanvasElementTable, this, slot);
 }
 
-void setJSHTMLCanvasElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLCanvasElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLCanvasElement* imp = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLCanvasElement*>(thisObject)->impl());
-    imp->setWidth(value->toInt32(exec));
+    imp->setWidth(value.toInt32(exec));
 }
 
-void setJSHTMLCanvasElementHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLCanvasElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLCanvasElement* imp = static_cast<HTMLCanvasElement*>(static_cast<JSHTMLCanvasElement*>(thisObject)->impl());
-    imp->setHeight(value->toInt32(exec));
+    imp->setHeight(value.toInt32(exec));
 }
 
-JSValuePtr JSHTMLCanvasElement::getConstructor(ExecState* exec)
+JSValue JSHTMLCanvasElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLCanvasElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLCanvasElementPrototypeFunctionToDataURL(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLCanvasElementPrototypeFunctionToDataURL(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLCanvasElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLCanvasElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLCanvasElement* castedThisObj = static_cast<JSHTMLCanvasElement*>(asObject(thisValue));
     HTMLCanvasElement* imp = static_cast<HTMLCanvasElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& type = valueToStringWithUndefinedOrNullCheck(exec, args.at(exec, 0));
+    const UString& type = valueToStringWithUndefinedOrNullCheck(exec, args.at(0));
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->toDataURL(type, ec));
+    JSC::JSValue result = jsString(exec, imp->toDataURL(type, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsHTMLCanvasElementPrototypeFunctionGetContext(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLCanvasElementPrototypeFunctionGetContext(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLCanvasElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLCanvasElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLCanvasElement* castedThisObj = static_cast<JSHTMLCanvasElement*>(asObject(thisValue));
     HTMLCanvasElement* imp = static_cast<HTMLCanvasElement*>(castedThisObj->impl());
-    const UString& contextId = args.at(exec, 0)->toString(exec);
+    const UString& contextId = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getContext(contextId)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getContext(contextId)));
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h
index 4c48d20..ad41d15 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCanvasElement.h
@@ -31,28 +31,29 @@ class JSHTMLCanvasElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLCanvasElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLCanvasElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLCanvasElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -61,15 +62,15 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLCanvasElementPrototypeFunctionToDataURL(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLCanvasElementPrototypeFunctionGetContext(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLCanvasElementPrototypeFunctionToDataURL(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLCanvasElementPrototypeFunctionGetContext(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLCanvasElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLCanvasElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLCanvasElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLCanvasElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLCanvasElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLCanvasElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLCanvasElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLCanvasElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLCanvasElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLCanvasElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
index 1888e46..7ff47ac 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.cpp
@@ -19,12 +19,8 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLCollection.h"
 
-#include <wtf/GetPtr.h>
-
-#include <runtime/PropertyNameArray.h>
 #include "AtomicString.h"
 #include "HTMLCollection.h"
 #include "JSNode.h"
@@ -32,15 +28,16 @@
 #include "NameNodeList.h"
 #include "Node.h"
 #include "NodeList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLCollection)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLCollection);
 
 /* Hash table */
 
@@ -77,13 +74,13 @@ public:
     JSHTMLCollectionConstructor(ExecState* exec)
         : DOMObject(JSHTMLCollectionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLCollectionPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLCollectionPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -115,9 +112,9 @@ static const HashTable JSHTMLCollectionPrototypeTable =
 
 const ClassInfo JSHTMLCollectionPrototype::s_info = { "HTMLCollectionPrototype", 0, &JSHTMLCollectionPrototypeTable, 0 };
 
-JSObject* JSHTMLCollectionPrototype::self(ExecState* exec)
+JSObject* JSHTMLCollectionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLCollection>(exec);
+    return getDOMPrototype<JSHTMLCollection>(exec, globalObject);
 }
 
 bool JSHTMLCollectionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -136,18 +133,17 @@ JSHTMLCollection::JSHTMLCollection(PassRefPtr<Structure> structure, PassRefPtr<H
 JSHTMLCollection::~JSHTMLCollection()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSHTMLCollection::createPrototype(ExecState* exec)
+JSObject* JSHTMLCollection::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLCollectionPrototype(JSHTMLCollectionPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSHTMLCollectionPrototype(JSHTMLCollectionPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSHTMLCollection::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    JSValuePtr proto = prototype();
-    if (proto->isObject() && static_cast<JSObject*>(asObject(proto))->hasProperty(exec, propertyName))
+    JSValue proto = prototype();
+    if (proto.isObject() && static_cast<JSObject*>(asObject(proto))->hasProperty(exec, propertyName))
         return false;
 
     const HashEntry* entry = JSHTMLCollectionTable.entry(exec, propertyName);
@@ -177,13 +173,14 @@ bool JSHTMLCollection::getOwnPropertySlot(ExecState* exec, unsigned propertyName
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsHTMLCollectionLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLCollectionLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLCollection* imp = static_cast<HTMLCollection*>(static_cast<JSHTMLCollection*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsHTMLCollectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLCollectionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLCollection*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
@@ -194,49 +191,52 @@ void JSHTMLCollection::getPropertyNames(ExecState* exec, PropertyNameArray& prop
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSHTMLCollection::getConstructor(ExecState* exec)
+JSValue JSHTMLCollection::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLCollectionConstructor>(exec);
 }
 
-JSValuePtr jsHTMLCollectionPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLCollection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLCollection::s_info))
         return throwError(exec, TypeError);
     JSHTMLCollection* castedThisObj = static_cast<JSHTMLCollection*>(asObject(thisValue));
     return castedThisObj->item(exec, args);
 }
 
-JSValuePtr jsHTMLCollectionPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLCollection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLCollection::s_info))
         return throwError(exec, TypeError);
     JSHTMLCollection* castedThisObj = static_cast<JSHTMLCollection*>(asObject(thisValue));
     return castedThisObj->namedItem(exec, args);
 }
 
-JSValuePtr jsHTMLCollectionPrototypeFunctionTags(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionTags(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLCollection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLCollection::s_info))
         return throwError(exec, TypeError);
     JSHTMLCollection* castedThisObj = static_cast<JSHTMLCollection*>(asObject(thisValue));
     HTMLCollection* imp = static_cast<HTMLCollection*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->tags(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->tags(name)));
     return result;
 }
 
 
-JSValuePtr JSHTMLCollection::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLCollection::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLCollection* thisObj = static_cast<JSHTMLCollection*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<HTMLCollection*>(thisObj->impl())->item(slot.index()));
 }
-HTMLCollection* toHTMLCollection(JSC::JSValuePtr value)
+HTMLCollection* toHTMLCollection(JSC::JSValue value)
 {
-    return value->isObject(&JSHTMLCollection::s_info) ? static_cast<JSHTMLCollection*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSHTMLCollection::s_info) ? static_cast<JSHTMLCollection*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h
index 2ec3824..44d977e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLCollection.h
@@ -22,9 +22,9 @@
 #define JSHTMLCollection_h
 
 #include "JSDOMBinding.h"
+#include <runtime/CallData.h>
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
-#include <runtime/CallData.h>
 
 namespace WebCore {
 
@@ -35,13 +35,13 @@ class JSHTMLCollection : public DOMObject {
 public:
     JSHTMLCollection(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLCollection>);
     virtual ~JSHTMLCollection();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,31 +49,32 @@ public:
     virtual JSC::CallType getCallData(JSC::CallData&);
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom functions
-    JSC::JSValuePtr item(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr namedItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue item(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue namedItem(JSC::ExecState*, const JSC::ArgList&);
     HTMLCollection* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<HTMLCollection> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLCollection*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, HTMLCollection*);
-HTMLCollection* toHTMLCollection(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, HTMLCollection*);
+HTMLCollection* toHTMLCollection(JSC::JSValue);
 
 class JSHTMLCollectionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -82,13 +83,13 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLCollectionPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLCollectionPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLCollectionPrototypeFunctionTags(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLCollectionPrototypeFunctionTags(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLCollectionLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLCollectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLCollectionLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLCollectionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp
index 0d9c9aa..e65bb1f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.cpp
@@ -19,20 +19,16 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLDListElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLDListElement.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLDListElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLDListElement);
 
 /* Hash table */
 
@@ -69,13 +65,13 @@ public:
     JSHTMLDListElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLDListElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLDListElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLDListElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -104,9 +100,9 @@ static const HashTable JSHTMLDListElementPrototypeTable =
 
 const ClassInfo JSHTMLDListElementPrototype::s_info = { "HTMLDListElementPrototype", 0, &JSHTMLDListElementPrototypeTable, 0 };
 
-JSObject* JSHTMLDListElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLDListElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLDListElement>(exec);
+    return getDOMPrototype<JSHTMLDListElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLDListElement::s_info = { "HTMLDListElement", &JSHTMLElement::s_info, &JSHTMLDListElementTable, 0 };
@@ -116,9 +112,9 @@ JSHTMLDListElement::JSHTMLDListElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLDListElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLDListElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLDListElementPrototype(JSHTMLDListElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLDListElementPrototype(JSHTMLDListElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLDListElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -126,28 +122,29 @@ bool JSHTMLDListElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLDListElement, Base>(exec, &JSHTMLDListElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLDListElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDListElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDListElement* imp = static_cast<HTMLDListElement*>(static_cast<JSHTMLDListElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->compact());
 }
 
-JSValuePtr jsHTMLDListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLDListElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLDListElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLDListElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLDListElement, Base>(exec, propertyName, value, &JSHTMLDListElementTable, this, slot);
 }
 
-void setJSHTMLDListElementCompact(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLDListElementCompact(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDListElement* imp = static_cast<HTMLDListElement*>(static_cast<JSHTMLDListElement*>(thisObject)->impl());
-    imp->setCompact(value->toBoolean(exec));
+    imp->setCompact(value.toBoolean(exec));
 }
 
-JSValuePtr JSHTMLDListElement::getConstructor(ExecState* exec)
+JSValue JSHTMLDListElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLDListElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h
index 9efceb3..a1519eb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDListElement.h
@@ -31,24 +31,25 @@ class JSHTMLDListElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLDListElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLDListElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLDListElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLDListElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLDListElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLDListElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLDListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDListElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDListElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.cpp
new file mode 100644
index 0000000..e0f8624
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.cpp
@@ -0,0 +1,212 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSHTMLDataGridCellElement.h"
+
+#include "HTMLDataGridCellElement.h"
+#include "KURL.h"
+#include <runtime/JSNumberCell.h>
+#include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLDataGridCellElement);
+
+/* Hash table */
+
+static const HashTableValue JSHTMLDataGridCellElementTableValues[7] =
+{
+    { "label", DontDelete, (intptr_t)jsHTMLDataGridCellElementLabel, (intptr_t)setJSHTMLDataGridCellElementLabel },
+    { "focused", DontDelete, (intptr_t)jsHTMLDataGridCellElementFocused, (intptr_t)setJSHTMLDataGridCellElementFocused },
+    { "checked", DontDelete, (intptr_t)jsHTMLDataGridCellElementChecked, (intptr_t)setJSHTMLDataGridCellElementChecked },
+    { "indeterminate", DontDelete, (intptr_t)jsHTMLDataGridCellElementIndeterminate, (intptr_t)setJSHTMLDataGridCellElementIndeterminate },
+    { "progress", DontDelete, (intptr_t)jsHTMLDataGridCellElementProgress, (intptr_t)setJSHTMLDataGridCellElementProgress },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLDataGridCellElementConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSHTMLDataGridCellElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 63, JSHTMLDataGridCellElementTableValues, 0 };
+#else
+    { 17, 15, JSHTMLDataGridCellElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSHTMLDataGridCellElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSHTMLDataGridCellElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSHTMLDataGridCellElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSHTMLDataGridCellElementConstructorTableValues, 0 };
+#endif
+
+class JSHTMLDataGridCellElementConstructor : public DOMObject {
+public:
+    JSHTMLDataGridCellElementConstructor(ExecState* exec)
+        : DOMObject(JSHTMLDataGridCellElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    {
+        putDirect(exec->propertyNames().prototype, JSHTMLDataGridCellElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+    }
+};
+
+const ClassInfo JSHTMLDataGridCellElementConstructor::s_info = { "HTMLDataGridCellElementConstructor", 0, &JSHTMLDataGridCellElementConstructorTable, 0 };
+
+bool JSHTMLDataGridCellElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSHTMLDataGridCellElementConstructor, DOMObject>(exec, &JSHTMLDataGridCellElementConstructorTable, this, propertyName, slot);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSHTMLDataGridCellElementPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSHTMLDataGridCellElementPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSHTMLDataGridCellElementPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSHTMLDataGridCellElementPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSHTMLDataGridCellElementPrototype::s_info = { "HTMLDataGridCellElementPrototype", 0, &JSHTMLDataGridCellElementPrototypeTable, 0 };
+
+JSObject* JSHTMLDataGridCellElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSHTMLDataGridCellElement>(exec, globalObject);
+}
+
+const ClassInfo JSHTMLDataGridCellElement::s_info = { "HTMLDataGridCellElement", &JSHTMLElement::s_info, &JSHTMLDataGridCellElementTable, 0 };
+
+JSHTMLDataGridCellElement::JSHTMLDataGridCellElement(PassRefPtr<Structure> structure, PassRefPtr<HTMLDataGridCellElement> impl)
+    : JSHTMLElement(structure, impl)
+{
+}
+
+JSObject* JSHTMLDataGridCellElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSHTMLDataGridCellElementPrototype(JSHTMLDataGridCellElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
+}
+
+bool JSHTMLDataGridCellElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSHTMLDataGridCellElement, Base>(exec, &JSHTMLDataGridCellElementTable, this, propertyName, slot);
+}
+
+JSValue jsHTMLDataGridCellElementLabel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(static_cast<JSHTMLDataGridCellElement*>(asObject(slot.slotBase()))->impl());
+    return jsString(exec, imp->label());
+}
+
+JSValue jsHTMLDataGridCellElementFocused(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(static_cast<JSHTMLDataGridCellElement*>(asObject(slot.slotBase()))->impl());
+    return jsBoolean(imp->focused());
+}
+
+JSValue jsHTMLDataGridCellElementChecked(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(static_cast<JSHTMLDataGridCellElement*>(asObject(slot.slotBase()))->impl());
+    return jsBoolean(imp->checked());
+}
+
+JSValue jsHTMLDataGridCellElementIndeterminate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(static_cast<JSHTMLDataGridCellElement*>(asObject(slot.slotBase()))->impl());
+    return jsBoolean(imp->indeterminate());
+}
+
+JSValue jsHTMLDataGridCellElementProgress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(static_cast<JSHTMLDataGridCellElement*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->progress());
+}
+
+JSValue jsHTMLDataGridCellElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSHTMLDataGridCellElement*>(asObject(slot.slotBase()))->getConstructor(exec);
+}
+void JSHTMLDataGridCellElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    lookupPut<JSHTMLDataGridCellElement, Base>(exec, propertyName, value, &JSHTMLDataGridCellElementTable, this, slot);
+}
+
+void setJSHTMLDataGridCellElementLabel(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(static_cast<JSHTMLDataGridCellElement*>(thisObject)->impl());
+    imp->setLabel(value.toString(exec));
+}
+
+void setJSHTMLDataGridCellElementFocused(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(static_cast<JSHTMLDataGridCellElement*>(thisObject)->impl());
+    imp->setFocused(value.toBoolean(exec));
+}
+
+void setJSHTMLDataGridCellElementChecked(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(static_cast<JSHTMLDataGridCellElement*>(thisObject)->impl());
+    imp->setChecked(value.toBoolean(exec));
+}
+
+void setJSHTMLDataGridCellElementIndeterminate(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(static_cast<JSHTMLDataGridCellElement*>(thisObject)->impl());
+    imp->setIndeterminate(value.toBoolean(exec));
+}
+
+void setJSHTMLDataGridCellElementProgress(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLDataGridCellElement* imp = static_cast<HTMLDataGridCellElement*>(static_cast<JSHTMLDataGridCellElement*>(thisObject)->impl());
+    imp->setProgress(value.toFloat(exec));
+}
+
+JSValue JSHTMLDataGridCellElement::getConstructor(ExecState* exec)
+{
+    return getDOMConstructor<JSHTMLDataGridCellElementConstructor>(exec);
+}
+
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.h
new file mode 100644
index 0000000..a0b8815
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridCellElement.h
@@ -0,0 +1,74 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSHTMLDataGridCellElement_h
+#define JSHTMLDataGridCellElement_h
+
+#include "JSHTMLElement.h"
+
+namespace WebCore {
+
+class HTMLDataGridCellElement;
+
+class JSHTMLDataGridCellElement : public JSHTMLElement {
+    typedef JSHTMLElement Base;
+public:
+    JSHTMLDataGridCellElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLDataGridCellElement>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*);
+};
+
+
+class JSHTMLDataGridCellElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    JSHTMLDataGridCellElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Attributes
+
+JSC::JSValue jsHTMLDataGridCellElementLabel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDataGridCellElementLabel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDataGridCellElementFocused(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDataGridCellElementFocused(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDataGridCellElementChecked(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDataGridCellElementChecked(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDataGridCellElementIndeterminate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDataGridCellElementIndeterminate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDataGridCellElementProgress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDataGridCellElementProgress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDataGridCellElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp
new file mode 100644
index 0000000..a608a1f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.cpp
@@ -0,0 +1,212 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSHTMLDataGridColElement.h"
+
+#include "HTMLDataGridColElement.h"
+#include "KURL.h"
+#include <runtime/JSNumberCell.h>
+#include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLDataGridColElement);
+
+/* Hash table */
+
+static const HashTableValue JSHTMLDataGridColElementTableValues[7] =
+{
+    { "label", DontDelete, (intptr_t)jsHTMLDataGridColElementLabel, (intptr_t)setJSHTMLDataGridColElementLabel },
+    { "type", DontDelete, (intptr_t)jsHTMLDataGridColElementType, (intptr_t)setJSHTMLDataGridColElementType },
+    { "sortable", DontDelete, (intptr_t)jsHTMLDataGridColElementSortable, (intptr_t)setJSHTMLDataGridColElementSortable },
+    { "sortDirection", DontDelete, (intptr_t)jsHTMLDataGridColElementSortDirection, (intptr_t)setJSHTMLDataGridColElementSortDirection },
+    { "primary", DontDelete, (intptr_t)jsHTMLDataGridColElementPrimary, (intptr_t)setJSHTMLDataGridColElementPrimary },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLDataGridColElementConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSHTMLDataGridColElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 63, JSHTMLDataGridColElementTableValues, 0 };
+#else
+    { 17, 15, JSHTMLDataGridColElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSHTMLDataGridColElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSHTMLDataGridColElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSHTMLDataGridColElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSHTMLDataGridColElementConstructorTableValues, 0 };
+#endif
+
+class JSHTMLDataGridColElementConstructor : public DOMObject {
+public:
+    JSHTMLDataGridColElementConstructor(ExecState* exec)
+        : DOMObject(JSHTMLDataGridColElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    {
+        putDirect(exec->propertyNames().prototype, JSHTMLDataGridColElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+    }
+};
+
+const ClassInfo JSHTMLDataGridColElementConstructor::s_info = { "HTMLDataGridColElementConstructor", 0, &JSHTMLDataGridColElementConstructorTable, 0 };
+
+bool JSHTMLDataGridColElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSHTMLDataGridColElementConstructor, DOMObject>(exec, &JSHTMLDataGridColElementConstructorTable, this, propertyName, slot);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSHTMLDataGridColElementPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSHTMLDataGridColElementPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSHTMLDataGridColElementPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSHTMLDataGridColElementPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSHTMLDataGridColElementPrototype::s_info = { "HTMLDataGridColElementPrototype", 0, &JSHTMLDataGridColElementPrototypeTable, 0 };
+
+JSObject* JSHTMLDataGridColElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSHTMLDataGridColElement>(exec, globalObject);
+}
+
+const ClassInfo JSHTMLDataGridColElement::s_info = { "HTMLDataGridColElement", &JSHTMLElement::s_info, &JSHTMLDataGridColElementTable, 0 };
+
+JSHTMLDataGridColElement::JSHTMLDataGridColElement(PassRefPtr<Structure> structure, PassRefPtr<HTMLDataGridColElement> impl)
+    : JSHTMLElement(structure, impl)
+{
+}
+
+JSObject* JSHTMLDataGridColElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSHTMLDataGridColElementPrototype(JSHTMLDataGridColElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
+}
+
+bool JSHTMLDataGridColElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSHTMLDataGridColElement, Base>(exec, &JSHTMLDataGridColElementTable, this, propertyName, slot);
+}
+
+JSValue jsHTMLDataGridColElementLabel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(static_cast<JSHTMLDataGridColElement*>(asObject(slot.slotBase()))->impl());
+    return jsString(exec, imp->label());
+}
+
+JSValue jsHTMLDataGridColElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(static_cast<JSHTMLDataGridColElement*>(asObject(slot.slotBase()))->impl());
+    return jsString(exec, imp->type());
+}
+
+JSValue jsHTMLDataGridColElementSortable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(static_cast<JSHTMLDataGridColElement*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->sortable());
+}
+
+JSValue jsHTMLDataGridColElementSortDirection(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(static_cast<JSHTMLDataGridColElement*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->sortDirection());
+}
+
+JSValue jsHTMLDataGridColElementPrimary(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(static_cast<JSHTMLDataGridColElement*>(asObject(slot.slotBase()))->impl());
+    return jsBoolean(imp->primary());
+}
+
+JSValue jsHTMLDataGridColElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSHTMLDataGridColElement*>(asObject(slot.slotBase()))->getConstructor(exec);
+}
+void JSHTMLDataGridColElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    lookupPut<JSHTMLDataGridColElement, Base>(exec, propertyName, value, &JSHTMLDataGridColElementTable, this, slot);
+}
+
+void setJSHTMLDataGridColElementLabel(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(static_cast<JSHTMLDataGridColElement*>(thisObject)->impl());
+    imp->setLabel(value.toString(exec));
+}
+
+void setJSHTMLDataGridColElementType(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(static_cast<JSHTMLDataGridColElement*>(thisObject)->impl());
+    imp->setType(value.toString(exec));
+}
+
+void setJSHTMLDataGridColElementSortable(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(static_cast<JSHTMLDataGridColElement*>(thisObject)->impl());
+    imp->setSortable(value.toInt32(exec));
+}
+
+void setJSHTMLDataGridColElementSortDirection(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(static_cast<JSHTMLDataGridColElement*>(thisObject)->impl());
+    imp->setSortDirection(value.toInt32(exec));
+}
+
+void setJSHTMLDataGridColElementPrimary(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLDataGridColElement* imp = static_cast<HTMLDataGridColElement*>(static_cast<JSHTMLDataGridColElement*>(thisObject)->impl());
+    imp->setPrimary(value.toBoolean(exec));
+}
+
+JSValue JSHTMLDataGridColElement::getConstructor(ExecState* exec)
+{
+    return getDOMConstructor<JSHTMLDataGridColElementConstructor>(exec);
+}
+
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.h
new file mode 100644
index 0000000..24efd48
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridColElement.h
@@ -0,0 +1,74 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSHTMLDataGridColElement_h
+#define JSHTMLDataGridColElement_h
+
+#include "JSHTMLElement.h"
+
+namespace WebCore {
+
+class HTMLDataGridColElement;
+
+class JSHTMLDataGridColElement : public JSHTMLElement {
+    typedef JSHTMLElement Base;
+public:
+    JSHTMLDataGridColElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLDataGridColElement>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*);
+};
+
+
+class JSHTMLDataGridColElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    JSHTMLDataGridColElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Attributes
+
+JSC::JSValue jsHTMLDataGridColElementLabel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDataGridColElementLabel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDataGridColElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDataGridColElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDataGridColElementSortable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDataGridColElementSortable(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDataGridColElementSortDirection(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDataGridColElementSortDirection(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDataGridColElementPrimary(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDataGridColElementPrimary(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDataGridColElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp
new file mode 100644
index 0000000..ea4237c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.cpp
@@ -0,0 +1,202 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSHTMLDataGridElement.h"
+
+#include "DataGridColumnList.h"
+#include "HTMLDataGridElement.h"
+#include "JSDataGridColumnList.h"
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLDataGridElement);
+
+/* Hash table */
+
+static const HashTableValue JSHTMLDataGridElementTableValues[7] =
+{
+    { "dataSource", DontDelete, (intptr_t)jsHTMLDataGridElementDataSource, (intptr_t)setJSHTMLDataGridElementDataSource },
+    { "columns", DontDelete|ReadOnly, (intptr_t)jsHTMLDataGridElementColumns, (intptr_t)0 },
+    { "autofocus", DontDelete, (intptr_t)jsHTMLDataGridElementAutofocus, (intptr_t)setJSHTMLDataGridElementAutofocus },
+    { "disabled", DontDelete, (intptr_t)jsHTMLDataGridElementDisabled, (intptr_t)setJSHTMLDataGridElementDisabled },
+    { "multiple", DontDelete, (intptr_t)jsHTMLDataGridElementMultiple, (intptr_t)setJSHTMLDataGridElementMultiple },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLDataGridElementConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSHTMLDataGridElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 63, JSHTMLDataGridElementTableValues, 0 };
+#else
+    { 18, 15, JSHTMLDataGridElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSHTMLDataGridElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSHTMLDataGridElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSHTMLDataGridElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSHTMLDataGridElementConstructorTableValues, 0 };
+#endif
+
+class JSHTMLDataGridElementConstructor : public DOMObject {
+public:
+    JSHTMLDataGridElementConstructor(ExecState* exec)
+        : DOMObject(JSHTMLDataGridElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    {
+        putDirect(exec->propertyNames().prototype, JSHTMLDataGridElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+    }
+};
+
+const ClassInfo JSHTMLDataGridElementConstructor::s_info = { "HTMLDataGridElementConstructor", 0, &JSHTMLDataGridElementConstructorTable, 0 };
+
+bool JSHTMLDataGridElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSHTMLDataGridElementConstructor, DOMObject>(exec, &JSHTMLDataGridElementConstructorTable, this, propertyName, slot);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSHTMLDataGridElementPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSHTMLDataGridElementPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSHTMLDataGridElementPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSHTMLDataGridElementPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSHTMLDataGridElementPrototype::s_info = { "HTMLDataGridElementPrototype", 0, &JSHTMLDataGridElementPrototypeTable, 0 };
+
+JSObject* JSHTMLDataGridElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSHTMLDataGridElement>(exec, globalObject);
+}
+
+const ClassInfo JSHTMLDataGridElement::s_info = { "HTMLDataGridElement", &JSHTMLElement::s_info, &JSHTMLDataGridElementTable, 0 };
+
+JSHTMLDataGridElement::JSHTMLDataGridElement(PassRefPtr<Structure> structure, PassRefPtr<HTMLDataGridElement> impl)
+    : JSHTMLElement(structure, impl)
+{
+}
+
+JSObject* JSHTMLDataGridElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSHTMLDataGridElementPrototype(JSHTMLDataGridElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
+}
+
+bool JSHTMLDataGridElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSHTMLDataGridElement, Base>(exec, &JSHTMLDataGridElementTable, this, propertyName, slot);
+}
+
+JSValue jsHTMLDataGridElementDataSource(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSHTMLDataGridElement*>(asObject(slot.slotBase()))->dataSource(exec);
+}
+
+JSValue jsHTMLDataGridElementColumns(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLDataGridElement* imp = static_cast<HTMLDataGridElement*>(static_cast<JSHTMLDataGridElement*>(asObject(slot.slotBase()))->impl());
+    return toJS(exec, WTF::getPtr(imp->columns()));
+}
+
+JSValue jsHTMLDataGridElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLDataGridElement* imp = static_cast<HTMLDataGridElement*>(static_cast<JSHTMLDataGridElement*>(asObject(slot.slotBase()))->impl());
+    return jsBoolean(imp->autofocus());
+}
+
+JSValue jsHTMLDataGridElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLDataGridElement* imp = static_cast<HTMLDataGridElement*>(static_cast<JSHTMLDataGridElement*>(asObject(slot.slotBase()))->impl());
+    return jsBoolean(imp->disabled());
+}
+
+JSValue jsHTMLDataGridElementMultiple(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLDataGridElement* imp = static_cast<HTMLDataGridElement*>(static_cast<JSHTMLDataGridElement*>(asObject(slot.slotBase()))->impl());
+    return jsBoolean(imp->multiple());
+}
+
+JSValue jsHTMLDataGridElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSHTMLDataGridElement*>(asObject(slot.slotBase()))->getConstructor(exec);
+}
+void JSHTMLDataGridElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    lookupPut<JSHTMLDataGridElement, Base>(exec, propertyName, value, &JSHTMLDataGridElementTable, this, slot);
+}
+
+void setJSHTMLDataGridElementDataSource(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    static_cast<JSHTMLDataGridElement*>(thisObject)->setDataSource(exec, value);
+}
+
+void setJSHTMLDataGridElementAutofocus(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLDataGridElement* imp = static_cast<HTMLDataGridElement*>(static_cast<JSHTMLDataGridElement*>(thisObject)->impl());
+    imp->setAutofocus(value.toBoolean(exec));
+}
+
+void setJSHTMLDataGridElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLDataGridElement* imp = static_cast<HTMLDataGridElement*>(static_cast<JSHTMLDataGridElement*>(thisObject)->impl());
+    imp->setDisabled(value.toBoolean(exec));
+}
+
+void setJSHTMLDataGridElementMultiple(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLDataGridElement* imp = static_cast<HTMLDataGridElement*>(static_cast<JSHTMLDataGridElement*>(thisObject)->impl());
+    imp->setMultiple(value.toBoolean(exec));
+}
+
+JSValue JSHTMLDataGridElement::getConstructor(ExecState* exec)
+{
+    return getDOMConstructor<JSHTMLDataGridElementConstructor>(exec);
+}
+
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h
new file mode 100644
index 0000000..ee6c8d8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridElement.h
@@ -0,0 +1,77 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSHTMLDataGridElement_h
+#define JSHTMLDataGridElement_h
+
+#include "JSHTMLElement.h"
+
+namespace WebCore {
+
+class HTMLDataGridElement;
+
+class JSHTMLDataGridElement : public JSHTMLElement {
+    typedef JSHTMLElement Base;
+public:
+    JSHTMLDataGridElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLDataGridElement>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*);
+
+    // Custom attributes
+    JSC::JSValue dataSource(JSC::ExecState*) const;
+    void setDataSource(JSC::ExecState*, JSC::JSValue);
+};
+
+
+class JSHTMLDataGridElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    JSHTMLDataGridElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Attributes
+
+JSC::JSValue jsHTMLDataGridElementDataSource(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDataGridElementDataSource(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDataGridElementColumns(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDataGridElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDataGridElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDataGridElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDataGridElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDataGridElementMultiple(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDataGridElementMultiple(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDataGridElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.cpp
new file mode 100644
index 0000000..938ff16
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.cpp
@@ -0,0 +1,181 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSHTMLDataGridRowElement.h"
+
+#include "HTMLDataGridRowElement.h"
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLDataGridRowElement);
+
+/* Hash table */
+
+static const HashTableValue JSHTMLDataGridRowElementTableValues[5] =
+{
+    { "selected", DontDelete, (intptr_t)jsHTMLDataGridRowElementSelected, (intptr_t)setJSHTMLDataGridRowElementSelected },
+    { "focused", DontDelete, (intptr_t)jsHTMLDataGridRowElementFocused, (intptr_t)setJSHTMLDataGridRowElementFocused },
+    { "expanded", DontDelete, (intptr_t)jsHTMLDataGridRowElementExpanded, (intptr_t)setJSHTMLDataGridRowElementExpanded },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLDataGridRowElementConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSHTMLDataGridRowElementTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 127, JSHTMLDataGridRowElementTableValues, 0 };
+#else
+    { 10, 7, JSHTMLDataGridRowElementTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSHTMLDataGridRowElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSHTMLDataGridRowElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSHTMLDataGridRowElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSHTMLDataGridRowElementConstructorTableValues, 0 };
+#endif
+
+class JSHTMLDataGridRowElementConstructor : public DOMObject {
+public:
+    JSHTMLDataGridRowElementConstructor(ExecState* exec)
+        : DOMObject(JSHTMLDataGridRowElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    {
+        putDirect(exec->propertyNames().prototype, JSHTMLDataGridRowElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+    }
+};
+
+const ClassInfo JSHTMLDataGridRowElementConstructor::s_info = { "HTMLDataGridRowElementConstructor", 0, &JSHTMLDataGridRowElementConstructorTable, 0 };
+
+bool JSHTMLDataGridRowElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSHTMLDataGridRowElementConstructor, DOMObject>(exec, &JSHTMLDataGridRowElementConstructorTable, this, propertyName, slot);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSHTMLDataGridRowElementPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSHTMLDataGridRowElementPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSHTMLDataGridRowElementPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSHTMLDataGridRowElementPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSHTMLDataGridRowElementPrototype::s_info = { "HTMLDataGridRowElementPrototype", 0, &JSHTMLDataGridRowElementPrototypeTable, 0 };
+
+JSObject* JSHTMLDataGridRowElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSHTMLDataGridRowElement>(exec, globalObject);
+}
+
+const ClassInfo JSHTMLDataGridRowElement::s_info = { "HTMLDataGridRowElement", &JSHTMLElement::s_info, &JSHTMLDataGridRowElementTable, 0 };
+
+JSHTMLDataGridRowElement::JSHTMLDataGridRowElement(PassRefPtr<Structure> structure, PassRefPtr<HTMLDataGridRowElement> impl)
+    : JSHTMLElement(structure, impl)
+{
+}
+
+JSObject* JSHTMLDataGridRowElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSHTMLDataGridRowElementPrototype(JSHTMLDataGridRowElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
+}
+
+bool JSHTMLDataGridRowElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSHTMLDataGridRowElement, Base>(exec, &JSHTMLDataGridRowElementTable, this, propertyName, slot);
+}
+
+JSValue jsHTMLDataGridRowElementSelected(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLDataGridRowElement* imp = static_cast<HTMLDataGridRowElement*>(static_cast<JSHTMLDataGridRowElement*>(asObject(slot.slotBase()))->impl());
+    return jsBoolean(imp->selected());
+}
+
+JSValue jsHTMLDataGridRowElementFocused(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLDataGridRowElement* imp = static_cast<HTMLDataGridRowElement*>(static_cast<JSHTMLDataGridRowElement*>(asObject(slot.slotBase()))->impl());
+    return jsBoolean(imp->focused());
+}
+
+JSValue jsHTMLDataGridRowElementExpanded(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLDataGridRowElement* imp = static_cast<HTMLDataGridRowElement*>(static_cast<JSHTMLDataGridRowElement*>(asObject(slot.slotBase()))->impl());
+    return jsBoolean(imp->expanded());
+}
+
+JSValue jsHTMLDataGridRowElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSHTMLDataGridRowElement*>(asObject(slot.slotBase()))->getConstructor(exec);
+}
+void JSHTMLDataGridRowElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    lookupPut<JSHTMLDataGridRowElement, Base>(exec, propertyName, value, &JSHTMLDataGridRowElementTable, this, slot);
+}
+
+void setJSHTMLDataGridRowElementSelected(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLDataGridRowElement* imp = static_cast<HTMLDataGridRowElement*>(static_cast<JSHTMLDataGridRowElement*>(thisObject)->impl());
+    imp->setSelected(value.toBoolean(exec));
+}
+
+void setJSHTMLDataGridRowElementFocused(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLDataGridRowElement* imp = static_cast<HTMLDataGridRowElement*>(static_cast<JSHTMLDataGridRowElement*>(thisObject)->impl());
+    imp->setFocused(value.toBoolean(exec));
+}
+
+void setJSHTMLDataGridRowElementExpanded(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLDataGridRowElement* imp = static_cast<HTMLDataGridRowElement*>(static_cast<JSHTMLDataGridRowElement*>(thisObject)->impl());
+    imp->setExpanded(value.toBoolean(exec));
+}
+
+JSValue JSHTMLDataGridRowElement::getConstructor(ExecState* exec)
+{
+    return getDOMConstructor<JSHTMLDataGridRowElementConstructor>(exec);
+}
+
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.h
new file mode 100644
index 0000000..562b5f7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDataGridRowElement.h
@@ -0,0 +1,70 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSHTMLDataGridRowElement_h
+#define JSHTMLDataGridRowElement_h
+
+#include "JSHTMLElement.h"
+
+namespace WebCore {
+
+class HTMLDataGridRowElement;
+
+class JSHTMLDataGridRowElement : public JSHTMLElement {
+    typedef JSHTMLElement Base;
+public:
+    JSHTMLDataGridRowElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLDataGridRowElement>);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*);
+};
+
+
+class JSHTMLDataGridRowElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    JSHTMLDataGridRowElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Attributes
+
+JSC::JSValue jsHTMLDataGridRowElementSelected(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDataGridRowElementSelected(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDataGridRowElementFocused(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDataGridRowElementFocused(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDataGridRowElementExpanded(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDataGridRowElementExpanded(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDataGridRowElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp
index 6a69c32..711057b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.cpp
@@ -19,20 +19,16 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLDirectoryElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLDirectoryElement.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLDirectoryElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLDirectoryElement);
 
 /* Hash table */
 
@@ -69,13 +65,13 @@ public:
     JSHTMLDirectoryElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLDirectoryElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLDirectoryElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLDirectoryElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -104,9 +100,9 @@ static const HashTable JSHTMLDirectoryElementPrototypeTable =
 
 const ClassInfo JSHTMLDirectoryElementPrototype::s_info = { "HTMLDirectoryElementPrototype", 0, &JSHTMLDirectoryElementPrototypeTable, 0 };
 
-JSObject* JSHTMLDirectoryElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLDirectoryElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLDirectoryElement>(exec);
+    return getDOMPrototype<JSHTMLDirectoryElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLDirectoryElement::s_info = { "HTMLDirectoryElement", &JSHTMLElement::s_info, &JSHTMLDirectoryElementTable, 0 };
@@ -116,9 +112,9 @@ JSHTMLDirectoryElement::JSHTMLDirectoryElement(PassRefPtr<Structure> structure,
 {
 }
 
-JSObject* JSHTMLDirectoryElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLDirectoryElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLDirectoryElementPrototype(JSHTMLDirectoryElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLDirectoryElementPrototype(JSHTMLDirectoryElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLDirectoryElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -126,28 +122,29 @@ bool JSHTMLDirectoryElement::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticValueSlot<JSHTMLDirectoryElement, Base>(exec, &JSHTMLDirectoryElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLDirectoryElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDirectoryElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDirectoryElement* imp = static_cast<HTMLDirectoryElement*>(static_cast<JSHTMLDirectoryElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->compact());
 }
 
-JSValuePtr jsHTMLDirectoryElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDirectoryElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLDirectoryElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLDirectoryElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLDirectoryElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLDirectoryElement, Base>(exec, propertyName, value, &JSHTMLDirectoryElementTable, this, slot);
 }
 
-void setJSHTMLDirectoryElementCompact(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLDirectoryElementCompact(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDirectoryElement* imp = static_cast<HTMLDirectoryElement*>(static_cast<JSHTMLDirectoryElement*>(thisObject)->impl());
-    imp->setCompact(value->toBoolean(exec));
+    imp->setCompact(value.toBoolean(exec));
 }
 
-JSValuePtr JSHTMLDirectoryElement::getConstructor(ExecState* exec)
+JSValue JSHTMLDirectoryElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLDirectoryElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h
index bdbe75c..09242bf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDirectoryElement.h
@@ -31,24 +31,25 @@ class JSHTMLDirectoryElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLDirectoryElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLDirectoryElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLDirectoryElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLDirectoryElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLDirectoryElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLDirectoryElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLDirectoryElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDirectoryElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDirectoryElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDirectoryElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp
index 7616fc1..43da933 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.cpp
@@ -19,22 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLDivElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLDivElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLDivElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLDivElement);
 
 /* Hash table */
 
@@ -71,13 +67,13 @@ public:
     JSHTMLDivElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLDivElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLDivElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLDivElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +102,9 @@ static const HashTable JSHTMLDivElementPrototypeTable =
 
 const ClassInfo JSHTMLDivElementPrototype::s_info = { "HTMLDivElementPrototype", 0, &JSHTMLDivElementPrototypeTable, 0 };
 
-JSObject* JSHTMLDivElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLDivElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLDivElement>(exec);
+    return getDOMPrototype<JSHTMLDivElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLDivElement::s_info = { "HTMLDivElement", &JSHTMLElement::s_info, &JSHTMLDivElementTable, 0 };
@@ -118,9 +114,9 @@ JSHTMLDivElement::JSHTMLDivElement(PassRefPtr<Structure> structure, PassRefPtr<H
 {
 }
 
-JSObject* JSHTMLDivElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLDivElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLDivElementPrototype(JSHTMLDivElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLDivElementPrototype(JSHTMLDivElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLDivElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,28 +124,29 @@ bool JSHTMLDivElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSHTMLDivElement, Base>(exec, &JSHTMLDivElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLDivElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDivElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDivElement* imp = static_cast<HTMLDivElement*>(static_cast<JSHTMLDivElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLDivElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDivElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLDivElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLDivElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLDivElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLDivElement, Base>(exec, propertyName, value, &JSHTMLDivElementTable, this, slot);
 }
 
-void setJSHTMLDivElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLDivElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDivElement* imp = static_cast<HTMLDivElement*>(static_cast<JSHTMLDivElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLDivElement::getConstructor(ExecState* exec)
+JSValue JSHTMLDivElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLDivElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h
index 412949d..1f3545b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDivElement.h
@@ -31,24 +31,25 @@ class JSHTMLDivElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLDivElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLDivElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLDivElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLDivElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLDivElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLDivElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLDivElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDivElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDivElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDivElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp
index ceca27d..1182aee 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.cpp
@@ -19,11 +19,8 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLDocument.h"
 
-#include <wtf/GetPtr.h>
-
 #include "AtomicString.h"
 #include "Element.h"
 #include "HTMLCollection.h"
@@ -31,16 +28,16 @@
 #include "JSElement.h"
 #include "JSHTMLCollection.h"
 #include "KURL.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLDocument)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLDocument);
 
 /* Hash table */
 
@@ -91,13 +88,13 @@ public:
     JSHTMLDocumentConstructor(ExecState* exec)
         : DOMObject(JSHTMLDocumentConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLDocumentPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLDocumentPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -134,9 +131,9 @@ static const HashTable JSHTMLDocumentPrototypeTable =
 
 const ClassInfo JSHTMLDocumentPrototype::s_info = { "HTMLDocumentPrototype", 0, &JSHTMLDocumentPrototypeTable, 0 };
 
-JSObject* JSHTMLDocumentPrototype::self(ExecState* exec)
+JSObject* JSHTMLDocumentPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLDocument>(exec);
+    return getDOMPrototype<JSHTMLDocument>(exec, globalObject);
 }
 
 bool JSHTMLDocumentPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -151,9 +148,9 @@ JSHTMLDocument::JSHTMLDocument(PassRefPtr<Structure> structure, PassRefPtr<HTMLD
 {
 }
 
-JSObject* JSHTMLDocument::createPrototype(ExecState* exec)
+JSObject* JSHTMLDocument::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLDocumentPrototype(JSHTMLDocumentPrototype::createStructure(JSDocumentPrototype::self(exec)));
+    return new (exec) JSHTMLDocumentPrototype(JSHTMLDocumentPrototype::createStructure(JSDocumentPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLDocument::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -165,167 +162,183 @@ bool JSHTMLDocument::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSHTMLDocument, Base>(exec, &JSHTMLDocumentTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLDocumentEmbeds(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentEmbeds(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->embeds()));
 }
 
-JSValuePtr jsHTMLDocumentPlugins(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentPlugins(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->plugins()));
 }
 
-JSValuePtr jsHTMLDocumentScripts(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentScripts(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->scripts()));
 }
 
-JSValuePtr jsHTMLDocumentAll(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentAll(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->all(exec);
 }
 
-JSValuePtr jsHTMLDocumentWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->width());
 }
 
-JSValuePtr jsHTMLDocumentHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->height());
 }
 
-JSValuePtr jsHTMLDocumentDir(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentDir(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->dir());
 }
 
-JSValuePtr jsHTMLDocumentDesignMode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentDesignMode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->designMode());
 }
 
-JSValuePtr jsHTMLDocumentCompatMode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentCompatMode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->compatMode());
 }
 
-JSValuePtr jsHTMLDocumentActiveElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentActiveElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->activeElement()));
 }
 
-JSValuePtr jsHTMLDocumentBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->bgColor());
 }
 
-JSValuePtr jsHTMLDocumentFgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentFgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->fgColor());
 }
 
-JSValuePtr jsHTMLDocumentAlinkColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentAlinkColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->alinkColor());
 }
 
-JSValuePtr jsHTMLDocumentLinkColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentLinkColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->linkColor());
 }
 
-JSValuePtr jsHTMLDocumentVlinkColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentVlinkColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->vlinkColor());
 }
 
-JSValuePtr jsHTMLDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLDocumentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLDocument*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLDocument::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLDocument::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLDocument, Base>(exec, propertyName, value, &JSHTMLDocumentTable, this, slot);
 }
 
-void setJSHTMLDocumentAll(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLDocumentAll(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSHTMLDocument*>(thisObject)->setAll(exec, value);
 }
 
-void setJSHTMLDocumentDir(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLDocumentDir(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(thisObject)->impl());
     imp->setDir(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLDocumentDesignMode(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLDocumentDesignMode(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(thisObject)->impl());
     imp->setDesignMode(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLDocumentBgColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLDocumentBgColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(thisObject)->impl());
     imp->setBgColor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLDocumentFgColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLDocumentFgColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(thisObject)->impl());
     imp->setFgColor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLDocumentAlinkColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLDocumentAlinkColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(thisObject)->impl());
     imp->setAlinkColor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLDocumentLinkColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLDocumentLinkColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(thisObject)->impl());
     imp->setLinkColor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLDocumentVlinkColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLDocumentVlinkColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLDocument* imp = static_cast<HTMLDocument*>(static_cast<JSHTMLDocument*>(thisObject)->impl());
     imp->setVlinkColor(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLDocument::getConstructor(ExecState* exec)
+JSValue JSHTMLDocument::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLDocumentConstructor>(exec);
 }
 
-JSValuePtr jsHTMLDocumentPrototypeFunctionOpen(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionOpen(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     return castedThisObj->open(exec, args);
 }
 
-JSValuePtr jsHTMLDocumentPrototypeFunctionClose(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionClose(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThisObj->impl());
@@ -334,25 +347,28 @@ JSValuePtr jsHTMLDocumentPrototypeFunctionClose(ExecState* exec, JSObject*, JSVa
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLDocumentPrototypeFunctionWrite(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionWrite(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     return castedThisObj->write(exec, args);
 }
 
-JSValuePtr jsHTMLDocumentPrototypeFunctionWriteln(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionWriteln(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     return castedThisObj->writeln(exec, args);
 }
 
-JSValuePtr jsHTMLDocumentPrototypeFunctionClear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThisObj->impl());
@@ -361,9 +377,10 @@ JSValuePtr jsHTMLDocumentPrototypeFunctionClear(ExecState* exec, JSObject*, JSVa
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLDocumentPrototypeFunctionCaptureEvents(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionCaptureEvents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThisObj->impl());
@@ -372,9 +389,10 @@ JSValuePtr jsHTMLDocumentPrototypeFunctionCaptureEvents(ExecState* exec, JSObjec
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLDocumentPrototypeFunctionReleaseEvents(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionReleaseEvents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThisObj->impl());
@@ -383,15 +401,16 @@ JSValuePtr jsHTMLDocumentPrototypeFunctionReleaseEvents(ExecState* exec, JSObjec
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLDocumentPrototypeFunctionHasFocus(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionHasFocus(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLDocument::s_info))
         return throwError(exec, TypeError);
     JSHTMLDocument* castedThisObj = static_cast<JSHTMLDocument*>(asObject(thisValue));
     HTMLDocument* imp = static_cast<HTMLDocument*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasFocus());
+    JSC::JSValue result = jsBoolean(imp->hasFocus());
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h
index 6fc4dc1..3827df2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLDocument.h
@@ -31,40 +31,41 @@ class JSHTMLDocument : public JSDocument {
     typedef JSDocument Base;
 public:
     JSHTMLDocument(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLDocument>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom attributes
-    JSC::JSValuePtr all(JSC::ExecState*) const;
-    void setAll(JSC::ExecState*, JSC::JSValuePtr);
+    JSC::JSValue all(JSC::ExecState*) const;
+    void setAll(JSC::ExecState*, JSC::JSValue);
 
     // Custom functions
-    JSC::JSValuePtr open(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr write(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr writeln(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue open(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue write(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue writeln(JSC::ExecState*, const JSC::ArgList&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLDocument*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
 
 class JSHTMLDocumentPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -73,40 +74,40 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLDocumentPrototypeFunctionOpen(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLDocumentPrototypeFunctionClose(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLDocumentPrototypeFunctionWrite(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLDocumentPrototypeFunctionWriteln(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLDocumentPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLDocumentPrototypeFunctionCaptureEvents(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLDocumentPrototypeFunctionReleaseEvents(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLDocumentPrototypeFunctionHasFocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionOpen(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionClose(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionWrite(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionWriteln(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionCaptureEvents(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionReleaseEvents(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLDocumentPrototypeFunctionHasFocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLDocumentEmbeds(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLDocumentPlugins(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLDocumentScripts(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLDocumentAll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLDocumentAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLDocumentWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLDocumentHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLDocumentDir(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLDocumentDir(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLDocumentDesignMode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLDocumentDesignMode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLDocumentCompatMode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLDocumentActiveElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLDocumentBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLDocumentBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLDocumentFgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLDocumentFgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLDocumentAlinkColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLDocumentAlinkColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLDocumentLinkColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLDocumentLinkColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLDocumentVlinkColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLDocumentVlinkColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentEmbeds(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentPlugins(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentScripts(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentAll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDocumentAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDocumentWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentDir(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDocumentDir(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDocumentDesignMode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDocumentDesignMode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDocumentCompatMode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentActiveElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLDocumentBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDocumentBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDocumentFgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDocumentFgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDocumentAlinkColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDocumentAlinkColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDocumentLinkColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDocumentLinkColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDocumentVlinkColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLDocumentVlinkColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLDocumentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp
index 40d74ac..ce77377 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.cpp
@@ -19,27 +19,25 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "Element.h"
 #include "HTMLCollection.h"
 #include "HTMLElement.h"
+#include "HTMLNames.h"
 #include "JSElement.h"
 #include "JSHTMLCollection.h"
 #include "KURL.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLElement);
 
 /* Hash table */
 
@@ -88,13 +86,13 @@ public:
     JSHTMLElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,10 +107,8 @@ bool JSHTMLElementConstructor::getOwnPropertySlot(ExecState* exec, const Identif
 
 /* Hash table for prototype */
 
-static const HashTableValue JSHTMLElementPrototypeTableValues[6] =
+static const HashTableValue JSHTMLElementPrototypeTableValues[4] =
 {
-    { "blur", DontDelete|Function, (intptr_t)jsHTMLElementPrototypeFunctionBlur, (intptr_t)0 },
-    { "focus", DontDelete|Function, (intptr_t)jsHTMLElementPrototypeFunctionFocus, (intptr_t)0 },
     { "insertAdjacentElement", DontDelete|Function, (intptr_t)jsHTMLElementPrototypeFunctionInsertAdjacentElement, (intptr_t)2 },
     { "insertAdjacentHTML", DontDelete|Function, (intptr_t)jsHTMLElementPrototypeFunctionInsertAdjacentHTML, (intptr_t)2 },
     { "insertAdjacentText", DontDelete|Function, (intptr_t)jsHTMLElementPrototypeFunctionInsertAdjacentText, (intptr_t)2 },
@@ -121,16 +117,16 @@ static const HashTableValue JSHTMLElementPrototypeTableValues[6] =
 
 static const HashTable JSHTMLElementPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 7, JSHTMLElementPrototypeTableValues, 0 };
+    { 3, JSHTMLElementPrototypeTableValues, 0 };
 #else
-    { 16, 15, JSHTMLElementPrototypeTableValues, 0 };
+    { 8, 7, JSHTMLElementPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSHTMLElementPrototype::s_info = { "HTMLElementPrototype", 0, &JSHTMLElementPrototypeTable, 0 };
 
-JSObject* JSHTMLElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLElement>(exec);
+    return getDOMPrototype<JSHTMLElement>(exec, globalObject);
 }
 
 bool JSHTMLElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -145,9 +141,9 @@ JSHTMLElement::JSHTMLElement(PassRefPtr<Structure> structure, PassRefPtr<HTMLEle
 {
 }
 
-JSObject* JSHTMLElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLElementPrototype(JSHTMLElementPrototype::createStructure(JSElementPrototype::self(exec)));
+    return new (exec) JSHTMLElementPrototype(JSHTMLElementPrototype::createStructure(JSElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -155,130 +151,143 @@ bool JSHTMLElement::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSHTMLElement, Base>(exec, &JSHTMLElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLElementId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
-    return jsString(exec, imp->id());
+    return jsString(exec, imp->getAttribute(HTMLNames::idAttr));
 }
 
-JSValuePtr jsHTMLElementTitle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementTitle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
-    return jsString(exec, imp->title());
+    return jsString(exec, imp->getAttribute(HTMLNames::titleAttr));
 }
 
-JSValuePtr jsHTMLElementLang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementLang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
-    return jsString(exec, imp->lang());
+    return jsString(exec, imp->getAttribute(HTMLNames::langAttr));
 }
 
-JSValuePtr jsHTMLElementDir(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementDir(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
-    return jsString(exec, imp->dir());
+    return jsString(exec, imp->getAttribute(HTMLNames::dirAttr));
 }
 
-JSValuePtr jsHTMLElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
-    return jsString(exec, imp->className());
+    return jsString(exec, imp->getAttribute(HTMLNames::classAttr));
 }
 
-JSValuePtr jsHTMLElementTabIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementTabIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->tabIndex());
 }
 
-JSValuePtr jsHTMLElementInnerHTML(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementInnerHTML(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->innerHTML());
 }
 
-JSValuePtr jsHTMLElementInnerText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementInnerText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->innerText());
 }
 
-JSValuePtr jsHTMLElementOuterHTML(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementOuterHTML(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->outerHTML());
 }
 
-JSValuePtr jsHTMLElementOuterText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementOuterText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->outerText());
 }
 
-JSValuePtr jsHTMLElementChildren(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementChildren(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->children()));
 }
 
-JSValuePtr jsHTMLElementContentEditable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementContentEditable(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->contentEditable());
 }
 
-JSValuePtr jsHTMLElementIsContentEditable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementIsContentEditable(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->isContentEditable());
 }
 
-JSValuePtr jsHTMLElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLElement, Base>(exec, propertyName, value, &JSHTMLElementTable, this, slot);
 }
 
-void setJSHTMLElementId(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLElementId(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
-    imp->setId(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::idAttr, valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLElementTitle(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLElementTitle(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
-    imp->setTitle(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::titleAttr, valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLElementLang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLElementLang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
-    imp->setLang(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::langAttr, valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLElementDir(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLElementDir(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
-    imp->setDir(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::dirAttr, valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLElementClassName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLElementClassName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
-    imp->setClassName(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::classAttr, valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLElementTabIndex(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLElementTabIndex(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
-    imp->setTabIndex(value->toInt32(exec));
+    imp->setTabIndex(value.toInt32(exec));
 }
 
-void setJSHTMLElementInnerHTML(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLElementInnerHTML(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -286,7 +295,7 @@ void setJSHTMLElementInnerHTML(ExecState* exec, JSObject* thisObject, JSValuePtr
     setDOMException(exec, ec);
 }
 
-void setJSHTMLElementInnerText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLElementInnerText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -294,7 +303,7 @@ void setJSHTMLElementInnerText(ExecState* exec, JSObject* thisObject, JSValuePtr
     setDOMException(exec, ec);
 }
 
-void setJSHTMLElementOuterHTML(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLElementOuterHTML(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -302,7 +311,7 @@ void setJSHTMLElementOuterHTML(ExecState* exec, JSObject* thisObject, JSValuePtr
     setDOMException(exec, ec);
 }
 
-void setJSHTMLElementOuterText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLElementOuterText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -310,88 +319,69 @@ void setJSHTMLElementOuterText(ExecState* exec, JSObject* thisObject, JSValuePtr
     setDOMException(exec, ec);
 }
 
-void setJSHTMLElementContentEditable(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLElementContentEditable(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLElement* imp = static_cast<HTMLElement*>(static_cast<JSHTMLElement*>(thisObject)->impl());
     imp->setContentEditable(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLElement::getConstructor(ExecState* exec)
+JSValue JSHTMLElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLElementPrototypeFunctionBlur(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSHTMLElement::s_info))
-        return throwError(exec, TypeError);
-    JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(asObject(thisValue));
-    HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
-
-    imp->blur();
-    return jsUndefined();
-}
-
-JSValuePtr jsHTMLElementPrototypeFunctionFocus(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSHTMLElement::s_info))
-        return throwError(exec, TypeError);
-    JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(asObject(thisValue));
-    HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
-
-    imp->focus();
-    return jsUndefined();
-}
-
-JSValuePtr jsHTMLElementPrototypeFunctionInsertAdjacentElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLElementPrototypeFunctionInsertAdjacentElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(asObject(thisValue));
     HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& where = args.at(exec, 0)->toString(exec);
-    Element* element = toElement(args.at(exec, 1));
+    const UString& where = args.at(0).toString(exec);
+    Element* element = toElement(args.at(1));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->insertAdjacentElement(where, element, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->insertAdjacentElement(where, element, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsHTMLElementPrototypeFunctionInsertAdjacentHTML(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLElementPrototypeFunctionInsertAdjacentHTML(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(asObject(thisValue));
     HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& where = args.at(exec, 0)->toString(exec);
-    const UString& html = args.at(exec, 1)->toString(exec);
+    const UString& where = args.at(0).toString(exec);
+    const UString& html = args.at(1).toString(exec);
 
     imp->insertAdjacentHTML(where, html, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLElementPrototypeFunctionInsertAdjacentText(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLElementPrototypeFunctionInsertAdjacentText(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLElement* castedThisObj = static_cast<JSHTMLElement*>(asObject(thisValue));
     HTMLElement* imp = static_cast<HTMLElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& where = args.at(exec, 0)->toString(exec);
-    const UString& text = args.at(exec, 1)->toString(exec);
+    const UString& where = args.at(0).toString(exec);
+    const UString& text = args.at(1).toString(exec);
 
     imp->insertAdjacentText(where, text, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-HTMLElement* toHTMLElement(JSC::JSValuePtr value)
+HTMLElement* toHTMLElement(JSC::JSValue value)
 {
-    return value->isObject(&JSHTMLElement::s_info) ? static_cast<JSHTMLElement*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSHTMLElement::s_info) ? static_cast<JSHTMLElement*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h
index 34df6fa..d4ca1f3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLElement.h
@@ -21,8 +21,9 @@
 #ifndef JSHTMLElement_h
 #define JSHTMLElement_h
 
-#include "JSElement.h"
 #include "HTMLElement.h"
+#include "JSElement.h"
+
 namespace WebCore {
 
 class HTMLElement;
@@ -31,35 +32,36 @@ class JSHTMLElement : public JSElement {
     typedef JSElement Base;
 public:
     JSHTMLElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void pushEventHandlerScope(JSC::ExecState*, JSC::ScopeChain&) const;
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     HTMLElement* impl() const
     {
         return static_cast<HTMLElement*>(Base::impl());
     }
 };
 
-HTMLElement* toHTMLElement(JSC::JSValuePtr);
+HTMLElement* toHTMLElement(JSC::JSValue);
 
 class JSHTMLElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -68,38 +70,36 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLElementPrototypeFunctionBlur(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLElementPrototypeFunctionFocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLElementPrototypeFunctionInsertAdjacentElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLElementPrototypeFunctionInsertAdjacentHTML(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLElementPrototypeFunctionInsertAdjacentText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLElementPrototypeFunctionInsertAdjacentElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLElementPrototypeFunctionInsertAdjacentHTML(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLElementPrototypeFunctionInsertAdjacentText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLElementId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLElementId(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLElementTitle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLElementTitle(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLElementLang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLElementLang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLElementDir(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLElementDir(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLElementClassName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLElementTabIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLElementTabIndex(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLElementInnerHTML(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLElementInnerHTML(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLElementInnerText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLElementInnerText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLElementOuterHTML(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLElementOuterHTML(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLElementOuterText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLElementOuterText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLElementChildren(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLElementContentEditable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLElementContentEditable(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLElementIsContentEditable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLElementId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLElementId(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLElementTitle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLElementTitle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLElementLang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLElementLang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLElementDir(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLElementDir(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLElementClassName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLElementTabIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLElementTabIndex(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLElementInnerHTML(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLElementInnerHTML(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLElementInnerText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLElementInnerText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLElementOuterHTML(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLElementOuterHTML(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLElementOuterText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLElementOuterText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLElementChildren(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLElementContentEditable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLElementContentEditable(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLElementIsContentEditable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLElementWrapperFactory.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLElementWrapperFactory.cpp
index 41b7998..7d66f62 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLElementWrapperFactory.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLElementWrapperFactory.cpp
@@ -43,10 +43,14 @@
 #include "JSHTMLCanvasElement.h"
 #include "JSHTMLTableCaptionElement.h"
 #include "JSHTMLTableColElement.h"
+#include "JSHTMLDataGridElement.h"
+#include "JSHTMLDataGridCellElement.h"
+#include "JSHTMLDataGridColElement.h"
 #include "JSHTMLModElement.h"
 #include "JSHTMLDirectoryElement.h"
 #include "JSHTMLDivElement.h"
 #include "JSHTMLDListElement.h"
+#include "JSHTMLDataGridRowElement.h"
 #include "JSHTMLEmbedElement.h"
 #include "JSHTMLFieldSetElement.h"
 #include "JSHTMLFontElement.h"
@@ -106,10 +110,14 @@
 #include "HTMLCanvasElement.h"
 #include "HTMLTableCaptionElement.h"
 #include "HTMLTableColElement.h"
+#include "HTMLDataGridElement.h"
+#include "HTMLDataGridCellElement.h"
+#include "HTMLDataGridColElement.h"
 #include "HTMLModElement.h"
 #include "HTMLDirectoryElement.h"
 #include "HTMLDivElement.h"
 #include "HTMLDListElement.h"
+#include "HTMLDataGridRowElement.h"
 #include "HTMLEmbedElement.h"
 #include "HTMLFieldSetElement.h"
 #include "HTMLFontElement.h"
@@ -235,6 +243,21 @@ static JSNode* createHTMLTableColElementWrapper(ExecState* exec, PassRefPtr<HTML
     return CREATE_DOM_NODE_WRAPPER(exec, HTMLTableColElement, element.get());
 }
 
+static JSNode* createHTMLDataGridElementWrapper(ExecState* exec, PassRefPtr<HTMLElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, HTMLDataGridElement, element.get());
+}
+
+static JSNode* createHTMLDataGridCellElementWrapper(ExecState* exec, PassRefPtr<HTMLElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, HTMLDataGridCellElement, element.get());
+}
+
+static JSNode* createHTMLDataGridColElementWrapper(ExecState* exec, PassRefPtr<HTMLElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, HTMLDataGridColElement, element.get());
+}
+
 static JSNode* createHTMLModElementWrapper(ExecState* exec, PassRefPtr<HTMLElement> element)
 {
     return CREATE_DOM_NODE_WRAPPER(exec, HTMLModElement, element.get());
@@ -255,6 +278,11 @@ static JSNode* createHTMLDListElementWrapper(ExecState* exec, PassRefPtr<HTMLEle
     return CREATE_DOM_NODE_WRAPPER(exec, HTMLDListElement, element.get());
 }
 
+static JSNode* createHTMLDataGridRowElementWrapper(ExecState* exec, PassRefPtr<HTMLElement> element)
+{
+    return CREATE_DOM_NODE_WRAPPER(exec, HTMLDataGridRowElement, element.get());
+}
+
 static JSNode* createHTMLEmbedElementWrapper(ExecState* exec, PassRefPtr<HTMLElement> element)
 {
     return CREATE_DOM_NODE_WRAPPER(exec, HTMLEmbedElement, element.get());
@@ -498,10 +526,14 @@ JSNode* createJSHTMLWrapper(ExecState* exec, PassRefPtr<HTMLElement> element)
        map.set(captionTag.localName().impl(), createHTMLTableCaptionElementWrapper);
        map.set(colTag.localName().impl(), createHTMLTableColElementWrapper);
        map.set(colgroupTag.localName().impl(), createHTMLTableColElementWrapper);
+       map.set(datagridTag.localName().impl(), createHTMLDataGridElementWrapper);
+       map.set(dcellTag.localName().impl(), createHTMLDataGridCellElementWrapper);
+       map.set(dcolTag.localName().impl(), createHTMLDataGridColElementWrapper);
        map.set(delTag.localName().impl(), createHTMLModElementWrapper);
        map.set(dirTag.localName().impl(), createHTMLDirectoryElementWrapper);
        map.set(divTag.localName().impl(), createHTMLDivElementWrapper);
        map.set(dlTag.localName().impl(), createHTMLDListElementWrapper);
+       map.set(drowTag.localName().impl(), createHTMLDataGridRowElementWrapper);
        map.set(embedTag.localName().impl(), createHTMLEmbedElementWrapper);
        map.set(fieldsetTag.localName().impl(), createHTMLFieldSetElementWrapper);
        map.set(fontTag.localName().impl(), createHTMLFontElementWrapper);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp
index 9a7b606..107a225 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.cpp
@@ -19,11 +19,8 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLEmbedElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "AtomicString.h"
 #include "HTMLEmbedElement.h"
 #include "JSDOMBinding.h"
@@ -31,16 +28,15 @@
 #include "JSSVGDocument.h"
 #include "KURL.h"
 #include "SVGDocument.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLEmbedElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLEmbedElement);
 
 /* Hash table */
 
@@ -82,13 +78,13 @@ public:
     JSHTMLEmbedElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLEmbedElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLEmbedElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLEmbedElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -118,9 +114,9 @@ static const HashTable JSHTMLEmbedElementPrototypeTable =
 
 const ClassInfo JSHTMLEmbedElementPrototype::s_info = { "HTMLEmbedElementPrototype", 0, &JSHTMLEmbedElementPrototypeTable, 0 };
 
-JSObject* JSHTMLEmbedElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLEmbedElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLEmbedElement>(exec);
+    return getDOMPrototype<JSHTMLEmbedElement>(exec, globalObject);
 }
 
 bool JSHTMLEmbedElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -135,9 +131,9 @@ JSHTMLEmbedElement::JSHTMLEmbedElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLEmbedElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLEmbedElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLEmbedElementPrototype(JSHTMLEmbedElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLEmbedElementPrototype(JSHTMLEmbedElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLEmbedElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -146,102 +142,109 @@ bool JSHTMLEmbedElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
         slot.setCustom(this, nameGetter);
         return true;
     }
-    if (customGetOwnPropertySlot(exec, propertyName, slot))
+    if (getOwnPropertySlotDelegate(exec, propertyName, slot))
         return true;
     return getStaticValueSlot<JSHTMLEmbedElement, Base>(exec, &JSHTMLEmbedElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLEmbedElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLEmbedElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLEmbedElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLEmbedElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->height());
 }
 
-JSValuePtr jsHTMLEmbedElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLEmbedElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLEmbedElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLEmbedElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->src());
 }
 
-JSValuePtr jsHTMLEmbedElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLEmbedElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLEmbedElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLEmbedElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->width());
 }
 
-JSValuePtr jsHTMLEmbedElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLEmbedElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLEmbedElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLEmbedElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLEmbedElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    if (customPut(exec, propertyName, value, slot))
+    if (putDelegate(exec, propertyName, value, slot))
         return;
     lookupPut<JSHTMLEmbedElement, Base>(exec, propertyName, value, &JSHTMLEmbedElementTable, this, slot);
 }
 
-void setJSHTMLEmbedElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLEmbedElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLEmbedElementHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLEmbedElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
     imp->setHeight(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLEmbedElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLEmbedElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLEmbedElementSrc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLEmbedElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
     imp->setSrc(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLEmbedElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLEmbedElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLEmbedElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLEmbedElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(static_cast<JSHTMLEmbedElement*>(thisObject)->impl());
     imp->setWidth(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLEmbedElement::getConstructor(ExecState* exec)
+JSValue JSHTMLEmbedElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLEmbedElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLEmbedElementPrototypeFunctionGetSVGDocument(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLEmbedElementPrototypeFunctionGetSVGDocument(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLEmbedElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLEmbedElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLEmbedElement* castedThisObj = static_cast<JSHTMLEmbedElement*>(asObject(thisValue));
     HTMLEmbedElement* imp = static_cast<HTMLEmbedElement*>(castedThisObj->impl());
@@ -250,7 +253,7 @@ JSValuePtr jsHTMLEmbedElementPrototypeFunctionGetSVGDocument(ExecState* exec, JS
         return jsUndefined();
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getSVGDocument(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getSVGDocument(ec)));
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h
index c9f2f25..2538ee3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLEmbedElement.h
@@ -32,35 +32,36 @@ class JSHTMLEmbedElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLEmbedElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLEmbedElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    bool customGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLEmbedElement*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
 
 class JSHTMLEmbedElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,22 +70,22 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLEmbedElementPrototypeFunctionGetSVGDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLEmbedElementPrototypeFunctionGetSVGDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLEmbedElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLEmbedElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLEmbedElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLEmbedElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLEmbedElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLEmbedElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLEmbedElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLEmbedElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLEmbedElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLEmbedElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLEmbedElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLEmbedElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLEmbedElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLEmbedElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLEmbedElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLEmbedElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLEmbedElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLEmbedElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLEmbedElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLEmbedElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLEmbedElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLEmbedElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLEmbedElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLEmbedElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLEmbedElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLEmbedElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp
index 26afc14..27a1ebb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.cpp
@@ -19,22 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLFieldSetElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLFieldSetElement.h"
 #include "HTMLFormElement.h"
 #include "JSHTMLFormElement.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLFieldSetElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLFieldSetElement);
 
 /* Hash table */
 
@@ -72,13 +68,13 @@ public:
     JSHTMLFieldSetElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLFieldSetElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLFieldSetElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLFieldSetElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -107,9 +103,9 @@ static const HashTable JSHTMLFieldSetElementPrototypeTable =
 
 const ClassInfo JSHTMLFieldSetElementPrototype::s_info = { "HTMLFieldSetElementPrototype", 0, &JSHTMLFieldSetElementPrototypeTable, 0 };
 
-JSObject* JSHTMLFieldSetElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLFieldSetElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLFieldSetElement>(exec);
+    return getDOMPrototype<JSHTMLFieldSetElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLFieldSetElement::s_info = { "HTMLFieldSetElement", &JSHTMLElement::s_info, &JSHTMLFieldSetElementTable, 0 };
@@ -119,9 +115,9 @@ JSHTMLFieldSetElement::JSHTMLFieldSetElement(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSHTMLFieldSetElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLFieldSetElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLFieldSetElementPrototype(JSHTMLFieldSetElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLFieldSetElementPrototype(JSHTMLFieldSetElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLFieldSetElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -129,23 +125,25 @@ bool JSHTMLFieldSetElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSHTMLFieldSetElement, Base>(exec, &JSHTMLFieldSetElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLFieldSetElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFieldSetElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFieldSetElement* imp = static_cast<HTMLFieldSetElement*>(static_cast<JSHTMLFieldSetElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->form()));
 }
 
-JSValuePtr jsHTMLFieldSetElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFieldSetElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFieldSetElement* imp = static_cast<HTMLFieldSetElement*>(static_cast<JSHTMLFieldSetElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->willValidate());
 }
 
-JSValuePtr jsHTMLFieldSetElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFieldSetElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLFieldSetElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSHTMLFieldSetElement::getConstructor(ExecState* exec)
+JSValue JSHTMLFieldSetElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLFieldSetElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h
index b885d87..fa6c56c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFieldSetElement.h
@@ -31,23 +31,24 @@ class JSHTMLFieldSetElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLFieldSetElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLFieldSetElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLFieldSetElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLFieldSetElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -55,9 +56,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLFieldSetElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLFieldSetElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLFieldSetElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFieldSetElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFieldSetElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFieldSetElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp
index da127cb..0bff1ee 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.cpp
@@ -19,22 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLFontElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLFontElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLFontElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLFontElement);
 
 /* Hash table */
 
@@ -73,13 +69,13 @@ public:
     JSHTMLFontElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLFontElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLFontElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLFontElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -108,9 +104,9 @@ static const HashTable JSHTMLFontElementPrototypeTable =
 
 const ClassInfo JSHTMLFontElementPrototype::s_info = { "HTMLFontElementPrototype", 0, &JSHTMLFontElementPrototypeTable, 0 };
 
-JSObject* JSHTMLFontElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLFontElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLFontElement>(exec);
+    return getDOMPrototype<JSHTMLFontElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLFontElement::s_info = { "HTMLFontElement", &JSHTMLElement::s_info, &JSHTMLFontElementTable, 0 };
@@ -120,9 +116,9 @@ JSHTMLFontElement::JSHTMLFontElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSHTMLFontElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLFontElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLFontElementPrototype(JSHTMLFontElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLFontElementPrototype(JSHTMLFontElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLFontElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -130,52 +126,55 @@ bool JSHTMLFontElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLFontElement, Base>(exec, &JSHTMLFontElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLFontElementColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFontElementColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFontElement* imp = static_cast<HTMLFontElement*>(static_cast<JSHTMLFontElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->color());
 }
 
-JSValuePtr jsHTMLFontElementFace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFontElementFace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFontElement* imp = static_cast<HTMLFontElement*>(static_cast<JSHTMLFontElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->face());
 }
 
-JSValuePtr jsHTMLFontElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFontElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFontElement* imp = static_cast<HTMLFontElement*>(static_cast<JSHTMLFontElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->size());
 }
 
-JSValuePtr jsHTMLFontElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFontElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLFontElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLFontElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLFontElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLFontElement, Base>(exec, propertyName, value, &JSHTMLFontElementTable, this, slot);
 }
 
-void setJSHTMLFontElementColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFontElementColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFontElement* imp = static_cast<HTMLFontElement*>(static_cast<JSHTMLFontElement*>(thisObject)->impl());
     imp->setColor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFontElementFace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFontElementFace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFontElement* imp = static_cast<HTMLFontElement*>(static_cast<JSHTMLFontElement*>(thisObject)->impl());
     imp->setFace(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFontElementSize(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFontElementSize(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFontElement* imp = static_cast<HTMLFontElement*>(static_cast<JSHTMLFontElement*>(thisObject)->impl());
     imp->setSize(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLFontElement::getConstructor(ExecState* exec)
+JSValue JSHTMLFontElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLFontElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h
index 6c38b3b..c53d90a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFontElement.h
@@ -31,24 +31,25 @@ class JSHTMLFontElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLFontElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLFontElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLFontElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLFontElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,13 +57,13 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLFontElementColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFontElementColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFontElementFace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFontElementFace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFontElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFontElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFontElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFontElementColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFontElementColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFontElementFace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFontElementFace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFontElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFontElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFontElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp
index 170ea74..de495a5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.cpp
@@ -19,27 +19,24 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLFormElement.h"
 
-#include <wtf/GetPtr.h>
-
-#include <runtime/PropertyNameArray.h>
 #include "AtomicString.h"
 #include "HTMLCollection.h"
 #include "HTMLFormElement.h"
 #include "JSHTMLCollection.h"
 #include "KURL.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLFormElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLFormElement);
 
 /* Hash table */
 
@@ -84,13 +81,13 @@ public:
     JSHTMLFormElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLFormElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLFormElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLFormElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -121,9 +118,9 @@ static const HashTable JSHTMLFormElementPrototypeTable =
 
 const ClassInfo JSHTMLFormElementPrototype::s_info = { "HTMLFormElementPrototype", 0, &JSHTMLFormElementPrototypeTable, 0 };
 
-JSObject* JSHTMLFormElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLFormElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLFormElement>(exec);
+    return getDOMPrototype<JSHTMLFormElement>(exec, globalObject);
 }
 
 bool JSHTMLFormElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -138,13 +135,19 @@ JSHTMLFormElement::JSHTMLFormElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSHTMLFormElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLFormElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLFormElementPrototype(JSHTMLFormElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLFormElementPrototype(JSHTMLFormElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLFormElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
+    bool ok;
+    unsigned index = propertyName.toUInt32(&ok, false);
+    if (ok && index < static_cast<HTMLFormElement*>(impl())->length()) {
+        slot.setCustomIndex(this, index, indexGetter);
+        return true;
+    }
     if (canGetItemsForName(exec, static_cast<HTMLFormElement*>(impl()), propertyName)) {
         slot.setCustom(this, nameGetter);
         return true;
@@ -154,115 +157,118 @@ bool JSHTMLFormElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
         slot.setCustom(this, entry->propertyGetter());
         return true;
     }
-    bool ok;
-    unsigned index = propertyName.toUInt32(&ok, false);
-    if (ok && index < static_cast<HTMLFormElement*>(impl())->length()) {
-        slot.setCustomIndex(this, index, indexGetter);
-        return true;
-    }
     return getStaticValueSlot<JSHTMLFormElement, Base>(exec, &JSHTMLFormElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLFormElementElements(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementElements(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->elements()));
 }
 
-JSValuePtr jsHTMLFormElementLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsHTMLFormElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLFormElementAcceptCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementAcceptCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->acceptCharset());
 }
 
-JSValuePtr jsHTMLFormElementAction(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementAction(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->action());
 }
 
-JSValuePtr jsHTMLFormElementEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementEncoding(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->encoding());
 }
 
-JSValuePtr jsHTMLFormElementEnctype(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementEnctype(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->enctype());
 }
 
-JSValuePtr jsHTMLFormElementMethod(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementMethod(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->method());
 }
 
-JSValuePtr jsHTMLFormElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->target());
 }
 
-JSValuePtr jsHTMLFormElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFormElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLFormElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLFormElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLFormElement, Base>(exec, propertyName, value, &JSHTMLFormElementTable, this, slot);
 }
 
-void setJSHTMLFormElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFormElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFormElementAcceptCharset(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFormElementAcceptCharset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
     imp->setAcceptCharset(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFormElementAction(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFormElementAction(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
     imp->setAction(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFormElementEncoding(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFormElementEncoding(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
     imp->setEncoding(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFormElementEnctype(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFormElementEnctype(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
     imp->setEnctype(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFormElementMethod(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFormElementMethod(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
     imp->setMethod(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFormElementTarget(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFormElementTarget(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(thisObject)->impl());
     imp->setTarget(valueToStringWithNullCheck(exec, value));
@@ -275,25 +281,24 @@ void JSHTMLFormElement::getPropertyNames(ExecState* exec, PropertyNameArray& pro
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSHTMLFormElement::getConstructor(ExecState* exec)
+JSValue JSHTMLFormElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLFormElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLFormElementPrototypeFunctionSubmit(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLFormElementPrototypeFunctionSubmit(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLFormElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLFormElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLFormElement* castedThisObj = static_cast<JSHTMLFormElement*>(asObject(thisValue));
-    HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThisObj->impl());
-
-    imp->submit();
-    return jsUndefined();
+    return castedThisObj->submit(exec, args);
 }
 
-JSValuePtr jsHTMLFormElementPrototypeFunctionReset(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLFormElementPrototypeFunctionReset(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLFormElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLFormElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLFormElement* castedThisObj = static_cast<JSHTMLFormElement*>(asObject(thisValue));
     HTMLFormElement* imp = static_cast<HTMLFormElement*>(castedThisObj->impl());
@@ -303,7 +308,7 @@ JSValuePtr jsHTMLFormElementPrototypeFunctionReset(ExecState* exec, JSObject*, J
 }
 
 
-JSValuePtr JSHTMLFormElement::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLFormElement::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLFormElement* thisObj = static_cast<JSHTMLFormElement*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<HTMLFormElement*>(thisObj->impl())->item(slot.index()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h
index e156126..b44e6db 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFormElement.h
@@ -31,33 +31,37 @@ class JSHTMLFormElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLFormElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLFormElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
+
+    // Custom functions
+    JSC::JSValue submit(JSC::ExecState*, const JSC::ArgList&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLFormElement*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
 
 class JSHTMLFormElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -66,27 +70,27 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLFormElementPrototypeFunctionSubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLFormElementPrototypeFunctionReset(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLFormElementPrototypeFunctionSubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLFormElementPrototypeFunctionReset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLFormElementElements(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLFormElementLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLFormElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFormElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFormElementAcceptCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFormElementAcceptCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFormElementAction(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFormElementAction(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFormElementEncoding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFormElementEncoding(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFormElementEnctype(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFormElementEnctype(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFormElementMethod(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFormElementMethod(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFormElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFormElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFormElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFormElementElements(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFormElementLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFormElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFormElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFormElementAcceptCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFormElementAcceptCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFormElementAction(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFormElementAction(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFormElementEncoding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFormElementEncoding(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFormElementEnctype(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFormElementEnctype(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFormElementMethod(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFormElementMethod(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFormElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFormElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFormElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp
index 8db4416..a5bff3e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.cpp
@@ -19,11 +19,8 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLFrameElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "DOMWindow.h"
 #include "Document.h"
 #include "HTMLFrameElement.h"
@@ -33,16 +30,16 @@
 #include "JSSVGDocument.h"
 #include "KURL.h"
 #include "SVGDocument.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLFrameElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLFrameElement);
 
 /* Hash table */
 
@@ -91,13 +88,13 @@ public:
     JSHTMLFrameElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLFrameElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLFrameElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLFrameElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -127,9 +124,9 @@ static const HashTable JSHTMLFrameElementPrototypeTable =
 
 const ClassInfo JSHTMLFrameElementPrototype::s_info = { "HTMLFrameElementPrototype", 0, &JSHTMLFrameElementPrototypeTable, 0 };
 
-JSObject* JSHTMLFrameElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLFrameElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLFrameElement>(exec);
+    return getDOMPrototype<JSHTMLFrameElement>(exec, globalObject);
 }
 
 bool JSHTMLFrameElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -144,9 +141,9 @@ JSHTMLFrameElement::JSHTMLFrameElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLFrameElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLFrameElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLFrameElementPrototype(JSHTMLFrameElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLFrameElementPrototype(JSHTMLFrameElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLFrameElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -154,153 +151,166 @@ bool JSHTMLFrameElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLFrameElement, Base>(exec, &JSHTMLFrameElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLFrameElementFrameBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementFrameBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->frameBorder());
 }
 
-JSValuePtr jsHTMLFrameElementLongDesc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementLongDesc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->longDesc());
 }
 
-JSValuePtr jsHTMLFrameElementMarginHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementMarginHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->marginHeight());
 }
 
-JSValuePtr jsHTMLFrameElementMarginWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementMarginWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->marginWidth());
 }
 
-JSValuePtr jsHTMLFrameElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLFrameElementNoResize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementNoResize(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->noResize());
 }
 
-JSValuePtr jsHTMLFrameElementScrolling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementScrolling(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->scrolling());
 }
 
-JSValuePtr jsHTMLFrameElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->src());
 }
 
-JSValuePtr jsHTMLFrameElementContentDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementContentDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return checkNodeSecurity(exec, imp->contentDocument()) ? toJS(exec, WTF::getPtr(imp->contentDocument())) : jsUndefined();
 }
 
-JSValuePtr jsHTMLFrameElementContentWindow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementContentWindow(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->contentWindow()));
 }
 
-JSValuePtr jsHTMLFrameElementLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->location());
 }
 
-JSValuePtr jsHTMLFrameElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->width());
 }
 
-JSValuePtr jsHTMLFrameElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->height());
 }
 
-JSValuePtr jsHTMLFrameElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLFrameElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLFrameElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLFrameElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLFrameElement, Base>(exec, propertyName, value, &JSHTMLFrameElementTable, this, slot);
 }
 
-void setJSHTMLFrameElementFrameBorder(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFrameElementFrameBorder(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
     imp->setFrameBorder(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFrameElementLongDesc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFrameElementLongDesc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
     imp->setLongDesc(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFrameElementMarginHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFrameElementMarginHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
     imp->setMarginHeight(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFrameElementMarginWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFrameElementMarginWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
     imp->setMarginWidth(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFrameElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFrameElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFrameElementNoResize(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFrameElementNoResize(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
-    imp->setNoResize(value->toBoolean(exec));
+    imp->setNoResize(value.toBoolean(exec));
 }
 
-void setJSHTMLFrameElementScrolling(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFrameElementScrolling(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(static_cast<JSHTMLFrameElement*>(thisObject)->impl());
     imp->setScrolling(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFrameElementSrc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFrameElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSHTMLFrameElement*>(thisObject)->setSrc(exec, value);
 }
 
-void setJSHTMLFrameElementLocation(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFrameElementLocation(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSHTMLFrameElement*>(thisObject)->setLocation(exec, value);
 }
 
-JSValuePtr JSHTMLFrameElement::getConstructor(ExecState* exec)
+JSValue JSHTMLFrameElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLFrameElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLFrameElementPrototypeFunctionGetSVGDocument(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLFrameElementPrototypeFunctionGetSVGDocument(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLFrameElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLFrameElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLFrameElement* castedThisObj = static_cast<JSHTMLFrameElement*>(asObject(thisValue));
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(castedThisObj->impl());
@@ -309,7 +319,7 @@ JSValuePtr jsHTMLFrameElementPrototypeFunctionGetSVGDocument(ExecState* exec, JS
         return jsUndefined();
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getSVGDocument(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getSVGDocument(ec)));
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h
index 06e272a..573ff52 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameElement.h
@@ -31,32 +31,33 @@ class JSHTMLFrameElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLFrameElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLFrameElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom attributes
-    void setSrc(JSC::ExecState*, JSC::JSValuePtr);
-    void setLocation(JSC::ExecState*, JSC::JSValuePtr);
+    void setSrc(JSC::ExecState*, JSC::JSValue);
+    void setLocation(JSC::ExecState*, JSC::JSValue);
 };
 
 
 class JSHTMLFrameElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -65,32 +66,32 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLFrameElementPrototypeFunctionGetSVGDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLFrameElementPrototypeFunctionGetSVGDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLFrameElementFrameBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFrameElementFrameBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFrameElementLongDesc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFrameElementLongDesc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFrameElementMarginHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFrameElementMarginHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFrameElementMarginWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFrameElementMarginWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFrameElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFrameElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFrameElementNoResize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFrameElementNoResize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFrameElementScrolling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFrameElementScrolling(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFrameElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFrameElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFrameElementContentDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLFrameElementContentWindow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLFrameElementLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFrameElementLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFrameElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLFrameElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLFrameElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameElementFrameBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameElementFrameBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameElementLongDesc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameElementLongDesc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameElementMarginHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameElementMarginHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameElementMarginWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameElementMarginWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameElementNoResize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameElementNoResize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameElementScrolling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameElementScrolling(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameElementContentDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameElementContentWindow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameElementLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameElementLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp
index c2563b9..7abfddd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.cpp
@@ -19,39 +19,46 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLFrameSetElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "AtomicString.h"
+#include "EventListener.h"
+#include "Frame.h"
 #include "HTMLFrameSetElement.h"
+#include "JSDOMGlobalObject.h"
+#include "JSEventListener.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLFrameSetElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLFrameSetElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLFrameSetElementTableValues[4] =
+static const HashTableValue JSHTMLFrameSetElementTableValues[11] =
 {
     { "cols", DontDelete, (intptr_t)jsHTMLFrameSetElementCols, (intptr_t)setJSHTMLFrameSetElementCols },
     { "rows", DontDelete, (intptr_t)jsHTMLFrameSetElementRows, (intptr_t)setJSHTMLFrameSetElementRows },
+    { "onbeforeunload", DontDelete|DontEnum, (intptr_t)jsHTMLFrameSetElementOnbeforeunload, (intptr_t)setJSHTMLFrameSetElementOnbeforeunload },
+    { "onmessage", DontDelete|DontEnum, (intptr_t)jsHTMLFrameSetElementOnmessage, (intptr_t)setJSHTMLFrameSetElementOnmessage },
+    { "onoffline", DontDelete|DontEnum, (intptr_t)jsHTMLFrameSetElementOnoffline, (intptr_t)setJSHTMLFrameSetElementOnoffline },
+    { "ononline", DontDelete|DontEnum, (intptr_t)jsHTMLFrameSetElementOnonline, (intptr_t)setJSHTMLFrameSetElementOnonline },
+    { "onresize", DontDelete|DontEnum, (intptr_t)jsHTMLFrameSetElementOnresize, (intptr_t)setJSHTMLFrameSetElementOnresize },
+    { "onstorage", DontDelete|DontEnum, (intptr_t)jsHTMLFrameSetElementOnstorage, (intptr_t)setJSHTMLFrameSetElementOnstorage },
+    { "onunload", DontDelete|DontEnum, (intptr_t)jsHTMLFrameSetElementOnunload, (intptr_t)setJSHTMLFrameSetElementOnunload },
     { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLFrameSetElementConstructor, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static const HashTable JSHTMLFrameSetElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 7, JSHTMLFrameSetElementTableValues, 0 };
+    { 31, JSHTMLFrameSetElementTableValues, 0 };
 #else
-    { 8, 7, JSHTMLFrameSetElementTableValues, 0 };
+    { 32, 31, JSHTMLFrameSetElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -73,13 +80,13 @@ public:
     JSHTMLFrameSetElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLFrameSetElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLFrameSetElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLFrameSetElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -108,9 +115,9 @@ static const HashTable JSHTMLFrameSetElementPrototypeTable =
 
 const ClassInfo JSHTMLFrameSetElementPrototype::s_info = { "HTMLFrameSetElementPrototype", 0, &JSHTMLFrameSetElementPrototypeTable, 0 };
 
-JSObject* JSHTMLFrameSetElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLFrameSetElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLFrameSetElement>(exec);
+    return getDOMPrototype<JSHTMLFrameSetElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLFrameSetElement::s_info = { "HTMLFrameSetElement", &JSHTMLElement::s_info, &JSHTMLFrameSetElementTable, 0 };
@@ -120,9 +127,9 @@ JSHTMLFrameSetElement::JSHTMLFrameSetElement(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSHTMLFrameSetElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLFrameSetElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLFrameSetElementPrototype(JSHTMLFrameSetElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLFrameSetElementPrototype(JSHTMLFrameSetElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLFrameSetElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -134,40 +141,189 @@ bool JSHTMLFrameSetElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSHTMLFrameSetElement, Base>(exec, &JSHTMLFrameSetElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLFrameSetElementCols(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameSetElementCols(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->cols());
 }
 
-JSValuePtr jsHTMLFrameSetElementRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameSetElementRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->rows());
 }
 
-JSValuePtr jsHTMLFrameSetElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLFrameSetElementOnbeforeunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onbeforeunload()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsHTMLFrameSetElementOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onmessage()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsHTMLFrameSetElementOnoffline(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onoffline()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsHTMLFrameSetElementOnonline(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->ononline()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsHTMLFrameSetElementOnresize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onresize()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsHTMLFrameSetElementOnstorage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onstorage()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsHTMLFrameSetElementOnunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()))->impl());
+    if (EventListener* listener = imp->onunload()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
+}
+
+JSValue jsHTMLFrameSetElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLFrameSetElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLFrameSetElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLFrameSetElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLFrameSetElement, Base>(exec, propertyName, value, &JSHTMLFrameSetElementTable, this, slot);
 }
 
-void setJSHTMLFrameSetElementCols(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFrameSetElementCols(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
     imp->setCols(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLFrameSetElementRows(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLFrameSetElementRows(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
     imp->setRows(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLFrameSetElement::getConstructor(ExecState* exec)
+void setJSHTMLFrameSetElementOnbeforeunload(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnbeforeunload(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSHTMLFrameSetElementOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSHTMLFrameSetElementOnoffline(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnoffline(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSHTMLFrameSetElementOnonline(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnonline(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSHTMLFrameSetElementOnresize(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnresize(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSHTMLFrameSetElementOnstorage(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnstorage(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSHTMLFrameSetElementOnunload(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    HTMLFrameSetElement* imp = static_cast<HTMLFrameSetElement*>(static_cast<JSHTMLFrameSetElement*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
+    if (!globalObject)
+        return;
+    imp->setOnunload(globalObject->createJSAttributeEventListener(value));
+}
+
+JSValue JSHTMLFrameSetElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLFrameSetElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h
index dac7e54..c4528e5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLFrameSetElement.h
@@ -31,27 +31,28 @@ class JSHTMLFrameSetElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLFrameSetElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLFrameSetElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLFrameSetElement*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
 
 class JSHTMLFrameSetElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLFrameSetElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -59,11 +60,25 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLFrameSetElementCols(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFrameSetElementCols(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFrameSetElementRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLFrameSetElementRows(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLFrameSetElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLFrameSetElementCols(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameSetElementCols(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameSetElementRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameSetElementRows(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameSetElementOnbeforeunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameSetElementOnbeforeunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameSetElementOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameSetElementOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameSetElementOnoffline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameSetElementOnoffline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameSetElementOnonline(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameSetElementOnonline(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameSetElementOnresize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameSetElementOnresize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameSetElementOnstorage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameSetElementOnstorage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameSetElementOnunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLFrameSetElementOnunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLFrameSetElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp
index 1432abf..8ec45b5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.cpp
@@ -19,22 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLHRElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLHRElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLHRElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLHRElement);
 
 /* Hash table */
 
@@ -74,13 +70,13 @@ public:
     JSHTMLHRElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLHRElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLHRElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLHRElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +105,9 @@ static const HashTable JSHTMLHRElementPrototypeTable =
 
 const ClassInfo JSHTMLHRElementPrototype::s_info = { "HTMLHRElementPrototype", 0, &JSHTMLHRElementPrototypeTable, 0 };
 
-JSObject* JSHTMLHRElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLHRElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLHRElement>(exec);
+    return getDOMPrototype<JSHTMLHRElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLHRElement::s_info = { "HTMLHRElement", &JSHTMLElement::s_info, &JSHTMLHRElementTable, 0 };
@@ -121,9 +117,9 @@ JSHTMLHRElement::JSHTMLHRElement(PassRefPtr<Structure> structure, PassRefPtr<HTM
 {
 }
 
-JSObject* JSHTMLHRElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLHRElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLHRElementPrototype(JSHTMLHRElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLHRElementPrototype(JSHTMLHRElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLHRElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,64 +127,68 @@ bool JSHTMLHRElement::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSHTMLHRElement, Base>(exec, &JSHTMLHRElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLHRElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHRElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLHRElement* imp = static_cast<HTMLHRElement*>(static_cast<JSHTMLHRElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLHRElementNoShade(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHRElementNoShade(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLHRElement* imp = static_cast<HTMLHRElement*>(static_cast<JSHTMLHRElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->noShade());
 }
 
-JSValuePtr jsHTMLHRElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHRElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLHRElement* imp = static_cast<HTMLHRElement*>(static_cast<JSHTMLHRElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->size());
 }
 
-JSValuePtr jsHTMLHRElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHRElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLHRElement* imp = static_cast<HTMLHRElement*>(static_cast<JSHTMLHRElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->width());
 }
 
-JSValuePtr jsHTMLHRElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHRElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLHRElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLHRElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLHRElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLHRElement, Base>(exec, propertyName, value, &JSHTMLHRElementTable, this, slot);
 }
 
-void setJSHTMLHRElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLHRElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLHRElement* imp = static_cast<HTMLHRElement*>(static_cast<JSHTMLHRElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLHRElementNoShade(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLHRElementNoShade(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLHRElement* imp = static_cast<HTMLHRElement*>(static_cast<JSHTMLHRElement*>(thisObject)->impl());
-    imp->setNoShade(value->toBoolean(exec));
+    imp->setNoShade(value.toBoolean(exec));
 }
 
-void setJSHTMLHRElementSize(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLHRElementSize(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLHRElement* imp = static_cast<HTMLHRElement*>(static_cast<JSHTMLHRElement*>(thisObject)->impl());
     imp->setSize(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLHRElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLHRElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLHRElement* imp = static_cast<HTMLHRElement*>(static_cast<JSHTMLHRElement*>(thisObject)->impl());
     imp->setWidth(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLHRElement::getConstructor(ExecState* exec)
+JSValue JSHTMLHRElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLHRElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h
index bd8c361..fb62440 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHRElement.h
@@ -31,24 +31,25 @@ class JSHTMLHRElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLHRElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLHRElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLHRElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLHRElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,15 +57,15 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLHRElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLHRElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLHRElementNoShade(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLHRElementNoShade(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLHRElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLHRElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLHRElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLHRElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLHRElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLHRElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLHRElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLHRElementNoShade(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLHRElementNoShade(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLHRElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLHRElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLHRElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLHRElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLHRElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp
index 9c7af5c..a2ec868 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.cpp
@@ -19,22 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLHeadElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLHeadElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLHeadElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLHeadElement);
 
 /* Hash table */
 
@@ -71,13 +67,13 @@ public:
     JSHTMLHeadElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLHeadElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLHeadElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLHeadElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +102,9 @@ static const HashTable JSHTMLHeadElementPrototypeTable =
 
 const ClassInfo JSHTMLHeadElementPrototype::s_info = { "HTMLHeadElementPrototype", 0, &JSHTMLHeadElementPrototypeTable, 0 };
 
-JSObject* JSHTMLHeadElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLHeadElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLHeadElement>(exec);
+    return getDOMPrototype<JSHTMLHeadElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLHeadElement::s_info = { "HTMLHeadElement", &JSHTMLElement::s_info, &JSHTMLHeadElementTable, 0 };
@@ -118,9 +114,9 @@ JSHTMLHeadElement::JSHTMLHeadElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSHTMLHeadElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLHeadElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLHeadElementPrototype(JSHTMLHeadElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLHeadElementPrototype(JSHTMLHeadElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLHeadElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,28 +124,29 @@ bool JSHTMLHeadElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLHeadElement, Base>(exec, &JSHTMLHeadElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLHeadElementProfile(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHeadElementProfile(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLHeadElement* imp = static_cast<HTMLHeadElement*>(static_cast<JSHTMLHeadElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->profile());
 }
 
-JSValuePtr jsHTMLHeadElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHeadElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLHeadElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLHeadElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLHeadElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLHeadElement, Base>(exec, propertyName, value, &JSHTMLHeadElementTable, this, slot);
 }
 
-void setJSHTMLHeadElementProfile(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLHeadElementProfile(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLHeadElement* imp = static_cast<HTMLHeadElement*>(static_cast<JSHTMLHeadElement*>(thisObject)->impl());
     imp->setProfile(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLHeadElement::getConstructor(ExecState* exec)
+JSValue JSHTMLHeadElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLHeadElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h
index 8995d29..b63b317 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadElement.h
@@ -31,24 +31,25 @@ class JSHTMLHeadElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLHeadElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLHeadElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLHeadElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLHeadElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLHeadElementProfile(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLHeadElementProfile(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLHeadElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLHeadElementProfile(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLHeadElementProfile(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLHeadElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp
index 0ac8d7a..5a5b8b2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.cpp
@@ -19,22 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLHeadingElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLHeadingElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLHeadingElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLHeadingElement);
 
 /* Hash table */
 
@@ -71,13 +67,13 @@ public:
     JSHTMLHeadingElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLHeadingElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLHeadingElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLHeadingElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +102,9 @@ static const HashTable JSHTMLHeadingElementPrototypeTable =
 
 const ClassInfo JSHTMLHeadingElementPrototype::s_info = { "HTMLHeadingElementPrototype", 0, &JSHTMLHeadingElementPrototypeTable, 0 };
 
-JSObject* JSHTMLHeadingElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLHeadingElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLHeadingElement>(exec);
+    return getDOMPrototype<JSHTMLHeadingElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLHeadingElement::s_info = { "HTMLHeadingElement", &JSHTMLElement::s_info, &JSHTMLHeadingElementTable, 0 };
@@ -118,9 +114,9 @@ JSHTMLHeadingElement::JSHTMLHeadingElement(PassRefPtr<Structure> structure, Pass
 {
 }
 
-JSObject* JSHTMLHeadingElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLHeadingElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLHeadingElementPrototype(JSHTMLHeadingElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLHeadingElementPrototype(JSHTMLHeadingElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLHeadingElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,28 +124,29 @@ bool JSHTMLHeadingElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLHeadingElement, Base>(exec, &JSHTMLHeadingElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLHeadingElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHeadingElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLHeadingElement* imp = static_cast<HTMLHeadingElement*>(static_cast<JSHTMLHeadingElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLHeadingElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHeadingElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLHeadingElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLHeadingElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLHeadingElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLHeadingElement, Base>(exec, propertyName, value, &JSHTMLHeadingElementTable, this, slot);
 }
 
-void setJSHTMLHeadingElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLHeadingElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLHeadingElement* imp = static_cast<HTMLHeadingElement*>(static_cast<JSHTMLHeadingElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLHeadingElement::getConstructor(ExecState* exec)
+JSValue JSHTMLHeadingElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLHeadingElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h
index 0120cb4..a5fdd87 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHeadingElement.h
@@ -31,24 +31,25 @@ class JSHTMLHeadingElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLHeadingElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLHeadingElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLHeadingElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLHeadingElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLHeadingElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLHeadingElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLHeadingElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLHeadingElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLHeadingElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLHeadingElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp
index 170640e..95ab223 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.cpp
@@ -19,22 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLHtmlElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLHtmlElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLHtmlElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLHtmlElement);
 
 /* Hash table */
 
@@ -71,13 +67,13 @@ public:
     JSHTMLHtmlElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLHtmlElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLHtmlElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLHtmlElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +102,9 @@ static const HashTable JSHTMLHtmlElementPrototypeTable =
 
 const ClassInfo JSHTMLHtmlElementPrototype::s_info = { "HTMLHtmlElementPrototype", 0, &JSHTMLHtmlElementPrototypeTable, 0 };
 
-JSObject* JSHTMLHtmlElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLHtmlElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLHtmlElement>(exec);
+    return getDOMPrototype<JSHTMLHtmlElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLHtmlElement::s_info = { "HTMLHtmlElement", &JSHTMLElement::s_info, &JSHTMLHtmlElementTable, 0 };
@@ -118,9 +114,9 @@ JSHTMLHtmlElement::JSHTMLHtmlElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSHTMLHtmlElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLHtmlElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLHtmlElementPrototype(JSHTMLHtmlElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLHtmlElementPrototype(JSHTMLHtmlElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLHtmlElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,28 +124,29 @@ bool JSHTMLHtmlElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLHtmlElement, Base>(exec, &JSHTMLHtmlElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLHtmlElementVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHtmlElementVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLHtmlElement* imp = static_cast<HTMLHtmlElement*>(static_cast<JSHTMLHtmlElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->version());
 }
 
-JSValuePtr jsHTMLHtmlElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLHtmlElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLHtmlElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLHtmlElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLHtmlElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLHtmlElement, Base>(exec, propertyName, value, &JSHTMLHtmlElementTable, this, slot);
 }
 
-void setJSHTMLHtmlElementVersion(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLHtmlElementVersion(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLHtmlElement* imp = static_cast<HTMLHtmlElement*>(static_cast<JSHTMLHtmlElement*>(thisObject)->impl());
     imp->setVersion(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLHtmlElement::getConstructor(ExecState* exec)
+JSValue JSHTMLHtmlElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLHtmlElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h
index a573037..b9e49c7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLHtmlElement.h
@@ -31,24 +31,25 @@ class JSHTMLHtmlElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLHtmlElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLHtmlElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLHtmlElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLHtmlElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLHtmlElementVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLHtmlElementVersion(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLHtmlElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLHtmlElementVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLHtmlElementVersion(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLHtmlElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp
index b8fae77..068dfc2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.cpp
@@ -19,11 +19,8 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLIFrameElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "DOMWindow.h"
 #include "Document.h"
 #include "HTMLIFrameElement.h"
@@ -33,16 +30,15 @@
 #include "JSSVGDocument.h"
 #include "KURL.h"
 #include "SVGDocument.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLIFrameElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLIFrameElement);
 
 /* Hash table */
 
@@ -90,13 +86,13 @@ public:
     JSHTMLIFrameElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLIFrameElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLIFrameElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLIFrameElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -126,9 +122,9 @@ static const HashTable JSHTMLIFrameElementPrototypeTable =
 
 const ClassInfo JSHTMLIFrameElementPrototype::s_info = { "HTMLIFrameElementPrototype", 0, &JSHTMLIFrameElementPrototypeTable, 0 };
 
-JSObject* JSHTMLIFrameElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLIFrameElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLIFrameElement>(exec);
+    return getDOMPrototype<JSHTMLIFrameElement>(exec, globalObject);
 }
 
 bool JSHTMLIFrameElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -143,9 +139,9 @@ JSHTMLIFrameElement::JSHTMLIFrameElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSHTMLIFrameElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLIFrameElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLIFrameElementPrototype(JSHTMLIFrameElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLIFrameElementPrototype(JSHTMLIFrameElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLIFrameElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -153,154 +149,166 @@ bool JSHTMLIFrameElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLIFrameElement, Base>(exec, &JSHTMLIFrameElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLIFrameElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLIFrameElementFrameBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementFrameBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->frameBorder());
 }
 
-JSValuePtr jsHTMLIFrameElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->height());
 }
 
-JSValuePtr jsHTMLIFrameElementLongDesc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementLongDesc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->longDesc());
 }
 
-JSValuePtr jsHTMLIFrameElementMarginHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementMarginHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->marginHeight());
 }
 
-JSValuePtr jsHTMLIFrameElementMarginWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementMarginWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->marginWidth());
 }
 
-JSValuePtr jsHTMLIFrameElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLIFrameElementScrolling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementScrolling(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->scrolling());
 }
 
-JSValuePtr jsHTMLIFrameElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->src());
 }
 
-JSValuePtr jsHTMLIFrameElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->width());
 }
 
-JSValuePtr jsHTMLIFrameElementContentDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementContentDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return checkNodeSecurity(exec, imp->contentDocument()) ? toJS(exec, WTF::getPtr(imp->contentDocument())) : jsUndefined();
 }
 
-JSValuePtr jsHTMLIFrameElementContentWindow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementContentWindow(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->contentWindow()));
 }
 
-JSValuePtr jsHTMLIFrameElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIFrameElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLIFrameElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLIFrameElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLIFrameElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLIFrameElement, Base>(exec, propertyName, value, &JSHTMLIFrameElementTable, this, slot);
 }
 
-void setJSHTMLIFrameElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLIFrameElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLIFrameElementFrameBorder(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLIFrameElementFrameBorder(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
     imp->setFrameBorder(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLIFrameElementHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLIFrameElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
     imp->setHeight(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLIFrameElementLongDesc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLIFrameElementLongDesc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
     imp->setLongDesc(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLIFrameElementMarginHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLIFrameElementMarginHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
     imp->setMarginHeight(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLIFrameElementMarginWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLIFrameElementMarginWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
     imp->setMarginWidth(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLIFrameElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLIFrameElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLIFrameElementScrolling(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLIFrameElementScrolling(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
     imp->setScrolling(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLIFrameElementSrc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLIFrameElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSHTMLIFrameElement*>(thisObject)->setSrc(exec, value);
 }
 
-void setJSHTMLIFrameElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLIFrameElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(static_cast<JSHTMLIFrameElement*>(thisObject)->impl());
     imp->setWidth(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLIFrameElement::getConstructor(ExecState* exec)
+JSValue JSHTMLIFrameElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLIFrameElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLIFrameElementPrototypeFunctionGetSVGDocument(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLIFrameElementPrototypeFunctionGetSVGDocument(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLIFrameElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLIFrameElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLIFrameElement* castedThisObj = static_cast<JSHTMLIFrameElement*>(asObject(thisValue));
     HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(castedThisObj->impl());
@@ -309,7 +317,7 @@ JSValuePtr jsHTMLIFrameElementPrototypeFunctionGetSVGDocument(ExecState* exec, J
         return jsUndefined();
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getSVGDocument(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getSVGDocument(ec)));
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h
index c31fdb2..158ae70 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIFrameElement.h
@@ -31,31 +31,32 @@ class JSHTMLIFrameElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLIFrameElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLIFrameElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom attributes
-    void setSrc(JSC::ExecState*, JSC::JSValuePtr);
+    void setSrc(JSC::ExecState*, JSC::JSValue);
 };
 
 
 class JSHTMLIFrameElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -64,32 +65,32 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLIFrameElementPrototypeFunctionGetSVGDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLIFrameElementPrototypeFunctionGetSVGDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLIFrameElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLIFrameElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLIFrameElementFrameBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLIFrameElementFrameBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLIFrameElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLIFrameElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLIFrameElementLongDesc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLIFrameElementLongDesc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLIFrameElementMarginHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLIFrameElementMarginHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLIFrameElementMarginWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLIFrameElementMarginWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLIFrameElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLIFrameElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLIFrameElementScrolling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLIFrameElementScrolling(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLIFrameElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLIFrameElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLIFrameElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLIFrameElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLIFrameElementContentDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLIFrameElementContentWindow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLIFrameElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLIFrameElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLIFrameElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLIFrameElementFrameBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLIFrameElementFrameBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLIFrameElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLIFrameElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLIFrameElementLongDesc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLIFrameElementLongDesc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLIFrameElementMarginHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLIFrameElementMarginHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLIFrameElementMarginWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLIFrameElementMarginWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLIFrameElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLIFrameElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLIFrameElementScrolling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLIFrameElementScrolling(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLIFrameElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLIFrameElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLIFrameElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLIFrameElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLIFrameElementContentDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLIFrameElementContentWindow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLIFrameElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp
index 0d4af9c..a0259bb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.cpp
@@ -19,22 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLImageElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLImageElement.h"
+#include "HTMLNames.h"
 #include "KURL.h"
-
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLImageElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLImageElement);
 
 /* Hash table */
 
@@ -88,13 +86,13 @@ public:
     JSHTMLImageElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLImageElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLImageElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLImageElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -123,9 +121,9 @@ static const HashTable JSHTMLImageElementPrototypeTable =
 
 const ClassInfo JSHTMLImageElementPrototype::s_info = { "HTMLImageElementPrototype", 0, &JSHTMLImageElementPrototypeTable, 0 };
 
-JSObject* JSHTMLImageElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLImageElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLImageElement>(exec);
+    return getDOMPrototype<JSHTMLImageElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLImageElement::s_info = { "HTMLImageElement", &JSHTMLElement::s_info, &JSHTMLImageElementTable, 0 };
@@ -135,9 +133,9 @@ JSHTMLImageElement::JSHTMLImageElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLImageElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLImageElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLImageElementPrototype(JSHTMLImageElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLImageElementPrototype(JSHTMLImageElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLImageElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -145,202 +143,220 @@ bool JSHTMLImageElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLImageElement, Base>(exec, &JSHTMLImageElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLImageElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
-    return jsString(exec, imp->name());
+    return jsString(exec, imp->getAttribute(HTMLNames::nameAttr));
 }
 
-JSValuePtr jsHTMLImageElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
-    return jsString(exec, imp->align());
+    return jsString(exec, imp->getAttribute(HTMLNames::alignAttr));
 }
 
-JSValuePtr jsHTMLImageElementAlt(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementAlt(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
-    return jsString(exec, imp->alt());
+    return jsString(exec, imp->getAttribute(HTMLNames::altAttr));
 }
 
-JSValuePtr jsHTMLImageElementBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
-    return jsString(exec, imp->border());
+    return jsString(exec, imp->getAttribute(HTMLNames::borderAttr));
 }
 
-JSValuePtr jsHTMLImageElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->height());
 }
 
-JSValuePtr jsHTMLImageElementHspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementHspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->hspace());
 }
 
-JSValuePtr jsHTMLImageElementIsMap(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementIsMap(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->isMap());
 }
 
-JSValuePtr jsHTMLImageElementLongDesc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementLongDesc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
-    return jsString(exec, imp->longDesc());
+    return jsString(exec, imp->getURLAttribute(HTMLNames::longdescAttr));
 }
 
-JSValuePtr jsHTMLImageElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
-    return jsString(exec, imp->src());
+    return jsString(exec, imp->getURLAttribute(HTMLNames::srcAttr));
 }
 
-JSValuePtr jsHTMLImageElementUseMap(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementUseMap(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
-    return jsString(exec, imp->useMap());
+    return jsString(exec, imp->getAttribute(HTMLNames::usemapAttr));
 }
 
-JSValuePtr jsHTMLImageElementVspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementVspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->vspace());
 }
 
-JSValuePtr jsHTMLImageElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->width());
 }
 
-JSValuePtr jsHTMLImageElementComplete(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementComplete(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->complete());
 }
 
-JSValuePtr jsHTMLImageElementLowsrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementLowsrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
-    return jsString(exec, imp->lowsrc());
+    return jsString(exec, imp->getURLAttribute(HTMLNames::lowsrcAttr));
 }
 
-JSValuePtr jsHTMLImageElementNaturalHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementNaturalHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->naturalHeight());
 }
 
-JSValuePtr jsHTMLImageElementNaturalWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementNaturalWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->naturalWidth());
 }
 
-JSValuePtr jsHTMLImageElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsHTMLImageElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-JSValuePtr jsHTMLImageElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLImageElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLImageElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLImageElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLImageElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLImageElement, Base>(exec, propertyName, value, &JSHTMLImageElementTable, this, slot);
 }
 
-void setJSHTMLImageElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
-    imp->setName(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::nameAttr, valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLImageElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
-    imp->setAlign(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::alignAttr, valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLImageElementAlt(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementAlt(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
-    imp->setAlt(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::altAttr, valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLImageElementBorder(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementBorder(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
-    imp->setBorder(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::borderAttr, valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLImageElementHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
-    imp->setHeight(value->toInt32(exec));
+    imp->setHeight(value.toInt32(exec));
 }
 
-void setJSHTMLImageElementHspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementHspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
-    imp->setHspace(value->toInt32(exec));
+    imp->setHspace(value.toInt32(exec));
 }
 
-void setJSHTMLImageElementIsMap(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementIsMap(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
-    imp->setIsMap(value->toBoolean(exec));
+    imp->setIsMap(value.toBoolean(exec));
 }
 
-void setJSHTMLImageElementLongDesc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementLongDesc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
-    imp->setLongDesc(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::longdescAttr, valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLImageElementSrc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
-    imp->setSrc(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::srcAttr, valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLImageElementUseMap(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementUseMap(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
-    imp->setUseMap(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::usemapAttr, valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLImageElementVspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementVspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
-    imp->setVspace(value->toInt32(exec));
+    imp->setVspace(value.toInt32(exec));
 }
 
-void setJSHTMLImageElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
-    imp->setWidth(value->toInt32(exec));
+    imp->setWidth(value.toInt32(exec));
 }
 
-void setJSHTMLImageElementLowsrc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLImageElementLowsrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLImageElement* imp = static_cast<HTMLImageElement*>(static_cast<JSHTMLImageElement*>(thisObject)->impl());
-    imp->setLowsrc(valueToStringWithNullCheck(exec, value));
+    imp->setAttribute(HTMLNames::lowsrcAttr, valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLImageElement::getConstructor(ExecState* exec)
+JSValue JSHTMLImageElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLImageElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h
index f4d8de1..d24fda0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLImageElement.h
@@ -31,24 +31,25 @@ class JSHTMLImageElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLImageElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLImageElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLImageElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLImageElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,38 +57,38 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLImageElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementAlt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementAlt(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementHspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementHspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementIsMap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementIsMap(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementLongDesc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementLongDesc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementUseMap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementUseMap(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementVspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementVspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementComplete(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLImageElementLowsrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLImageElementLowsrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLImageElementNaturalHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLImageElementNaturalWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLImageElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLImageElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLImageElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementAlt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementAlt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementHspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementHspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementIsMap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementIsMap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementLongDesc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementLongDesc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementUseMap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementUseMap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementVspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementVspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementComplete(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementLowsrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLImageElementLowsrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLImageElementNaturalHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementNaturalWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLImageElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp
index 2ed990d..720249a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.cpp
@@ -19,31 +19,28 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLInputElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "FileList.h"
 #include "HTMLFormElement.h"
 #include "HTMLInputElement.h"
 #include "JSFileList.h"
 #include "JSHTMLFormElement.h"
 #include "KURL.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLInputElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLInputElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLInputElementTableValues[25] =
+static const HashTableValue JSHTMLInputElementTableValues[27] =
 {
     { "defaultValue", DontDelete, (intptr_t)jsHTMLInputElementDefaultValue, (intptr_t)setJSHTMLInputElementDefaultValue },
     { "defaultChecked", DontDelete, (intptr_t)jsHTMLInputElementDefaultChecked, (intptr_t)setJSHTMLInputElementDefaultChecked },
@@ -56,7 +53,9 @@ static const HashTableValue JSHTMLInputElementTableValues[25] =
     { "disabled", DontDelete, (intptr_t)jsHTMLInputElementDisabled, (intptr_t)setJSHTMLInputElementDisabled },
     { "autofocus", DontDelete, (intptr_t)jsHTMLInputElementAutofocus, (intptr_t)setJSHTMLInputElementAutofocus },
     { "maxLength", DontDelete, (intptr_t)jsHTMLInputElementMaxLength, (intptr_t)setJSHTMLInputElementMaxLength },
+    { "multiple", DontDelete, (intptr_t)jsHTMLInputElementMultiple, (intptr_t)setJSHTMLInputElementMultiple },
     { "name", DontDelete, (intptr_t)jsHTMLInputElementName, (intptr_t)setJSHTMLInputElementName },
+    { "placeholder", DontDelete, (intptr_t)jsHTMLInputElementPlaceholder, (intptr_t)setJSHTMLInputElementPlaceholder },
     { "readOnly", DontDelete, (intptr_t)jsHTMLInputElementReadOnly, (intptr_t)setJSHTMLInputElementReadOnly },
     { "size", DontDelete, (intptr_t)jsHTMLInputElementSize, (intptr_t)setJSHTMLInputElementSize },
     { "src", DontDelete, (intptr_t)jsHTMLInputElementSrc, (intptr_t)setJSHTMLInputElementSrc },
@@ -76,7 +75,7 @@ static const HashTable JSHTMLInputElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 255, JSHTMLInputElementTableValues, 0 };
 #else
-    { 69, 63, JSHTMLInputElementTableValues, 0 };
+    { 70, 63, JSHTMLInputElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -98,13 +97,13 @@ public:
     JSHTMLInputElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLInputElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLInputElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLInputElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -136,9 +135,9 @@ static const HashTable JSHTMLInputElementPrototypeTable =
 
 const ClassInfo JSHTMLInputElementPrototype::s_info = { "HTMLInputElementPrototype", 0, &JSHTMLInputElementPrototypeTable, 0 };
 
-JSObject* JSHTMLInputElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLInputElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLInputElement>(exec);
+    return getDOMPrototype<JSHTMLInputElement>(exec, globalObject);
 }
 
 bool JSHTMLInputElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -153,291 +152,333 @@ JSHTMLInputElement::JSHTMLInputElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLInputElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLInputElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLInputElementPrototype(JSHTMLInputElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLInputElementPrototype(JSHTMLInputElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLInputElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    if (customGetOwnPropertySlot(exec, propertyName, slot))
-        return true;
     return getStaticValueSlot<JSHTMLInputElement, Base>(exec, &JSHTMLInputElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLInputElementDefaultValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementDefaultValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->defaultValue());
 }
 
-JSValuePtr jsHTMLInputElementDefaultChecked(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementDefaultChecked(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->defaultChecked());
 }
 
-JSValuePtr jsHTMLInputElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->form()));
 }
 
-JSValuePtr jsHTMLInputElementAccept(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementAccept(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->accept());
 }
 
-JSValuePtr jsHTMLInputElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->accessKey());
 }
 
-JSValuePtr jsHTMLInputElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLInputElementAlt(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementAlt(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->alt());
 }
 
-JSValuePtr jsHTMLInputElementChecked(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementChecked(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->checked());
 }
 
-JSValuePtr jsHTMLInputElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->disabled());
 }
 
-JSValuePtr jsHTMLInputElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->autofocus());
 }
 
-JSValuePtr jsHTMLInputElementMaxLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementMaxLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->maxLength());
 }
 
-JSValuePtr jsHTMLInputElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementMultiple(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
+    return jsBoolean(imp->multiple());
+}
+
+JSValue jsHTMLInputElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLInputElementReadOnly(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementPlaceholder(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
+    return jsString(exec, imp->placeholder());
+}
+
+JSValue jsHTMLInputElementReadOnly(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->readOnly());
 }
 
-JSValuePtr jsHTMLInputElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->size());
 }
 
-JSValuePtr jsHTMLInputElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->src());
 }
 
-JSValuePtr jsHTMLInputElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
-    return jsString(exec, imp->type());
+    return static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->type(exec);
 }
 
-JSValuePtr jsHTMLInputElementUseMap(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementUseMap(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->useMap());
 }
 
-JSValuePtr jsHTMLInputElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->value());
 }
 
-JSValuePtr jsHTMLInputElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->willValidate());
 }
 
-JSValuePtr jsHTMLInputElementIndeterminate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementIndeterminate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->indeterminate());
 }
 
-JSValuePtr jsHTMLInputElementSelectionStart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementSelectionStart(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->selectionStart(exec);
 }
 
-JSValuePtr jsHTMLInputElementSelectionEnd(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementSelectionEnd(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->selectionEnd(exec);
 }
 
-JSValuePtr jsHTMLInputElementFiles(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementFiles(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->files()));
 }
 
-JSValuePtr jsHTMLInputElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLInputElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLInputElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLInputElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLInputElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLInputElement, Base>(exec, propertyName, value, &JSHTMLInputElementTable, this, slot);
 }
 
-void setJSHTMLInputElementDefaultValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementDefaultValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
     imp->setDefaultValue(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLInputElementDefaultChecked(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementDefaultChecked(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
-    imp->setDefaultChecked(value->toBoolean(exec));
+    imp->setDefaultChecked(value.toBoolean(exec));
 }
 
-void setJSHTMLInputElementAccept(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementAccept(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
     imp->setAccept(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLInputElementAccessKey(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementAccessKey(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
     imp->setAccessKey(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLInputElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLInputElementAlt(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementAlt(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
     imp->setAlt(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLInputElementChecked(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementChecked(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
-    imp->setChecked(value->toBoolean(exec));
+    imp->setChecked(value.toBoolean(exec));
 }
 
-void setJSHTMLInputElementDisabled(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
-    imp->setDisabled(value->toBoolean(exec));
+    imp->setDisabled(value.toBoolean(exec));
 }
 
-void setJSHTMLInputElementAutofocus(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementAutofocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
-    imp->setAutofocus(value->toBoolean(exec));
+    imp->setAutofocus(value.toBoolean(exec));
 }
 
-void setJSHTMLInputElementMaxLength(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementMaxLength(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
-    imp->setMaxLength(value->toInt32(exec));
+    imp->setMaxLength(value.toInt32(exec));
 }
 
-void setJSHTMLInputElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementMultiple(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    imp->setMultiple(value.toBoolean(exec));
+}
+
+void setJSHTMLInputElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLInputElementReadOnly(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementPlaceholder(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
-    imp->setReadOnly(value->toBoolean(exec));
+    imp->setPlaceholder(value.toString(exec));
 }
 
-void setJSHTMLInputElementSize(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementReadOnly(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
-    imp->setSize(value->toInt32(exec));
+    imp->setReadOnly(value.toBoolean(exec));
 }
 
-void setJSHTMLInputElementSrc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementSize(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
+    imp->setSize(value.toInt32(exec));
+}
+
+void setJSHTMLInputElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
     imp->setSrc(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLInputElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLInputElementUseMap(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementUseMap(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
     imp->setUseMap(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLInputElementValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
     imp->setValue(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLInputElementIndeterminate(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementIndeterminate(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
-    imp->setIndeterminate(value->toBoolean(exec));
+    imp->setIndeterminate(value.toBoolean(exec));
 }
 
-void setJSHTMLInputElementSelectionStart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementSelectionStart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
-    imp->setSelectionStart(value->toInt32(exec));
+    static_cast<JSHTMLInputElement*>(thisObject)->setSelectionStart(exec, value);
 }
 
-void setJSHTMLInputElementSelectionEnd(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLInputElementSelectionEnd(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(static_cast<JSHTMLInputElement*>(thisObject)->impl());
-    imp->setSelectionEnd(value->toInt32(exec));
+    static_cast<JSHTMLInputElement*>(thisObject)->setSelectionEnd(exec, value);
 }
 
-JSValuePtr JSHTMLInputElement::getConstructor(ExecState* exec)
+JSValue JSHTMLInputElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLInputElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLInputElementPrototypeFunctionSelect(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionSelect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLInputElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLInputElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(asObject(thisValue));
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
@@ -446,9 +487,10 @@ JSValuePtr jsHTMLInputElementPrototypeFunctionSelect(ExecState* exec, JSObject*,
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLInputElementPrototypeFunctionClick(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionClick(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLInputElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLInputElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(asObject(thisValue));
     HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
@@ -457,17 +499,13 @@ JSValuePtr jsHTMLInputElementPrototypeFunctionClick(ExecState* exec, JSObject*,
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLInputElementPrototypeFunctionSetSelectionRange(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionSetSelectionRange(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLInputElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLInputElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLInputElement* castedThisObj = static_cast<JSHTMLInputElement*>(asObject(thisValue));
-    HTMLInputElement* imp = static_cast<HTMLInputElement*>(castedThisObj->impl());
-    int start = args.at(exec, 0)->toInt32(exec);
-    int end = args.at(exec, 1)->toInt32(exec);
-
-    imp->setSelectionRange(start, end);
-    return jsUndefined();
+    return castedThisObj->setSelectionRange(exec, args);
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h
index 4722fe8..ef9431c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLInputElement.h
@@ -31,33 +31,39 @@ class JSHTMLInputElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLInputElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLInputElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    bool customGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom attributes
-    JSC::JSValuePtr selectionStart(JSC::ExecState*) const;
-    JSC::JSValuePtr selectionEnd(JSC::ExecState*) const;
+    JSC::JSValue type(JSC::ExecState*) const;
+    JSC::JSValue selectionStart(JSC::ExecState*) const;
+    void setSelectionStart(JSC::ExecState*, JSC::JSValue);
+    JSC::JSValue selectionEnd(JSC::ExecState*) const;
+    void setSelectionEnd(JSC::ExecState*, JSC::JSValue);
+
+    // Custom functions
+    JSC::JSValue setSelectionRange(JSC::ExecState*, const JSC::ArgList&);
 };
 
 
 class JSHTMLInputElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -66,55 +72,59 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLInputElementPrototypeFunctionSelect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLInputElementPrototypeFunctionClick(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLInputElementPrototypeFunctionSetSelectionRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionSelect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionClick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLInputElementPrototypeFunctionSetSelectionRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLInputElementDefaultValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementDefaultValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementDefaultChecked(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementDefaultChecked(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLInputElementAccept(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementAccept(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementAlt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementAlt(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementChecked(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementChecked(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementMaxLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementMaxLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementReadOnly(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementReadOnly(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementUseMap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementUseMap(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLInputElementIndeterminate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementIndeterminate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementSelectionStart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementSelectionStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementSelectionEnd(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLInputElementSelectionEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLInputElementFiles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLInputElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementDefaultValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementDefaultValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementDefaultChecked(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementDefaultChecked(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementAccept(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementAccept(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementAlt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementAlt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementChecked(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementChecked(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementMaxLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementMaxLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementMultiple(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementMultiple(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementPlaceholder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementPlaceholder(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementReadOnly(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementReadOnly(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementUseMap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementUseMap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementIndeterminate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementIndeterminate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementSelectionStart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementSelectionStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementSelectionEnd(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLInputElementSelectionEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLInputElementFiles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLInputElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp
index 2c1aec0..d23f3f1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.cpp
@@ -19,24 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLIsIndexElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLFormElement.h"
 #include "HTMLIsIndexElement.h"
 #include "JSHTMLFormElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLIsIndexElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLIsIndexElement);
 
 /* Hash table */
 
@@ -74,13 +70,13 @@ public:
     JSHTMLIsIndexElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLIsIndexElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLIsIndexElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLIsIndexElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +105,9 @@ static const HashTable JSHTMLIsIndexElementPrototypeTable =
 
 const ClassInfo JSHTMLIsIndexElementPrototype::s_info = { "HTMLIsIndexElementPrototype", 0, &JSHTMLIsIndexElementPrototypeTable, 0 };
 
-JSObject* JSHTMLIsIndexElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLIsIndexElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLIsIndexElement>(exec);
+    return getDOMPrototype<JSHTMLIsIndexElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLIsIndexElement::s_info = { "HTMLIsIndexElement", &JSHTMLInputElement::s_info, &JSHTMLIsIndexElementTable, 0 };
@@ -121,9 +117,9 @@ JSHTMLIsIndexElement::JSHTMLIsIndexElement(PassRefPtr<Structure> structure, Pass
 {
 }
 
-JSObject* JSHTMLIsIndexElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLIsIndexElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLIsIndexElementPrototype(JSHTMLIsIndexElementPrototype::createStructure(JSHTMLInputElementPrototype::self(exec)));
+    return new (exec) JSHTMLIsIndexElementPrototype(JSHTMLIsIndexElementPrototype::createStructure(JSHTMLInputElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLIsIndexElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,34 +127,36 @@ bool JSHTMLIsIndexElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLIsIndexElement, Base>(exec, &JSHTMLIsIndexElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLIsIndexElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIsIndexElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIsIndexElement* imp = static_cast<HTMLIsIndexElement*>(static_cast<JSHTMLIsIndexElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->form()));
 }
 
-JSValuePtr jsHTMLIsIndexElementPrompt(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIsIndexElementPrompt(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLIsIndexElement* imp = static_cast<HTMLIsIndexElement*>(static_cast<JSHTMLIsIndexElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->prompt());
 }
 
-JSValuePtr jsHTMLIsIndexElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLIsIndexElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLIsIndexElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLIsIndexElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLIsIndexElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLIsIndexElement, Base>(exec, propertyName, value, &JSHTMLIsIndexElementTable, this, slot);
 }
 
-void setJSHTMLIsIndexElementPrompt(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLIsIndexElementPrompt(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLIsIndexElement* imp = static_cast<HTMLIsIndexElement*>(static_cast<JSHTMLIsIndexElement*>(thisObject)->impl());
     imp->setPrompt(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLIsIndexElement::getConstructor(ExecState* exec)
+JSValue JSHTMLIsIndexElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLIsIndexElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h
index a75c4d4..a4a3363 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLIsIndexElement.h
@@ -31,24 +31,25 @@ class JSHTMLIsIndexElement : public JSHTMLInputElement {
     typedef JSHTMLInputElement Base;
 public:
     JSHTMLIsIndexElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLIsIndexElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLIsIndexElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLIsIndexElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,10 +57,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLIsIndexElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLIsIndexElementPrompt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLIsIndexElementPrompt(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLIsIndexElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLIsIndexElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLIsIndexElementPrompt(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLIsIndexElementPrompt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLIsIndexElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp
index f316107..35f00d2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.cpp
@@ -19,22 +19,19 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLLIElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLLIElement.h"
 #include "KURL.h"
-
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLLIElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLLIElement);
 
 /* Hash table */
 
@@ -72,13 +69,13 @@ public:
     JSHTMLLIElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLLIElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLLIElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLLIElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -107,9 +104,9 @@ static const HashTable JSHTMLLIElementPrototypeTable =
 
 const ClassInfo JSHTMLLIElementPrototype::s_info = { "HTMLLIElementPrototype", 0, &JSHTMLLIElementPrototypeTable, 0 };
 
-JSObject* JSHTMLLIElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLLIElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLLIElement>(exec);
+    return getDOMPrototype<JSHTMLLIElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLLIElement::s_info = { "HTMLLIElement", &JSHTMLElement::s_info, &JSHTMLLIElementTable, 0 };
@@ -119,9 +116,9 @@ JSHTMLLIElement::JSHTMLLIElement(PassRefPtr<Structure> structure, PassRefPtr<HTM
 {
 }
 
-JSObject* JSHTMLLIElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLLIElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLLIElementPrototype(JSHTMLLIElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLLIElementPrototype(JSHTMLLIElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLLIElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -129,40 +126,42 @@ bool JSHTMLLIElement::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSHTMLLIElement, Base>(exec, &JSHTMLLIElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLLIElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLIElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLIElement* imp = static_cast<HTMLLIElement*>(static_cast<JSHTMLLIElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLLIElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLIElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLIElement* imp = static_cast<HTMLLIElement*>(static_cast<JSHTMLLIElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->value());
 }
 
-JSValuePtr jsHTMLLIElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLIElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLLIElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLLIElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLLIElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLLIElement, Base>(exec, propertyName, value, &JSHTMLLIElementTable, this, slot);
 }
 
-void setJSHTMLLIElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLIElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLIElement* imp = static_cast<HTMLLIElement*>(static_cast<JSHTMLLIElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLLIElementValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLIElementValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLIElement* imp = static_cast<HTMLLIElement*>(static_cast<JSHTMLLIElement*>(thisObject)->impl());
-    imp->setValue(value->toInt32(exec));
+    imp->setValue(value.toInt32(exec));
 }
 
-JSValuePtr JSHTMLLIElement::getConstructor(ExecState* exec)
+JSValue JSHTMLLIElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLLIElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h
index 2d592ad..1c3ffcd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLIElement.h
@@ -31,24 +31,25 @@ class JSHTMLLIElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLLIElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLLIElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLLIElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLLIElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,11 +57,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLLIElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLIElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLIElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLIElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLIElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLIElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLIElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLIElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLIElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLIElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp
index e646dc0..24d1f57 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.cpp
@@ -19,24 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLLabelElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLFormElement.h"
 #include "HTMLLabelElement.h"
 #include "JSHTMLFormElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLLabelElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLLabelElement);
 
 /* Hash table */
 
@@ -75,13 +71,13 @@ public:
     JSHTMLLabelElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLLabelElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLLabelElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLLabelElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -110,9 +106,9 @@ static const HashTable JSHTMLLabelElementPrototypeTable =
 
 const ClassInfo JSHTMLLabelElementPrototype::s_info = { "HTMLLabelElementPrototype", 0, &JSHTMLLabelElementPrototypeTable, 0 };
 
-JSObject* JSHTMLLabelElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLLabelElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLLabelElement>(exec);
+    return getDOMPrototype<JSHTMLLabelElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLLabelElement::s_info = { "HTMLLabelElement", &JSHTMLElement::s_info, &JSHTMLLabelElementTable, 0 };
@@ -122,9 +118,9 @@ JSHTMLLabelElement::JSHTMLLabelElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLLabelElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLLabelElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLLabelElementPrototype(JSHTMLLabelElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLLabelElementPrototype(JSHTMLLabelElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLLabelElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,46 +128,49 @@ bool JSHTMLLabelElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLLabelElement, Base>(exec, &JSHTMLLabelElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLLabelElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLabelElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLabelElement* imp = static_cast<HTMLLabelElement*>(static_cast<JSHTMLLabelElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->form()));
 }
 
-JSValuePtr jsHTMLLabelElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLabelElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLabelElement* imp = static_cast<HTMLLabelElement*>(static_cast<JSHTMLLabelElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->accessKey());
 }
 
-JSValuePtr jsHTMLLabelElementHtmlFor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLabelElementHtmlFor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLabelElement* imp = static_cast<HTMLLabelElement*>(static_cast<JSHTMLLabelElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->htmlFor());
 }
 
-JSValuePtr jsHTMLLabelElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLabelElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLLabelElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLLabelElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLLabelElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLLabelElement, Base>(exec, propertyName, value, &JSHTMLLabelElementTable, this, slot);
 }
 
-void setJSHTMLLabelElementAccessKey(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLabelElementAccessKey(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLabelElement* imp = static_cast<HTMLLabelElement*>(static_cast<JSHTMLLabelElement*>(thisObject)->impl());
     imp->setAccessKey(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLLabelElementHtmlFor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLabelElementHtmlFor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLabelElement* imp = static_cast<HTMLLabelElement*>(static_cast<JSHTMLLabelElement*>(thisObject)->impl());
     imp->setHtmlFor(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLLabelElement::getConstructor(ExecState* exec)
+JSValue JSHTMLLabelElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLLabelElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h
index 63e96cb..32eb056 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLabelElement.h
@@ -31,24 +31,25 @@ class JSHTMLLabelElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLLabelElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLLabelElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLLabelElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLLabelElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,12 +57,12 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLLabelElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLLabelElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLabelElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLabelElementHtmlFor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLabelElementHtmlFor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLabelElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLabelElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLabelElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLabelElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLabelElementHtmlFor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLabelElementHtmlFor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLabelElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp
index 55d7ffe..b52f3e9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.cpp
@@ -19,24 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLLegendElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLFormElement.h"
 #include "HTMLLegendElement.h"
 #include "JSHTMLFormElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLLegendElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLLegendElement);
 
 /* Hash table */
 
@@ -75,13 +71,13 @@ public:
     JSHTMLLegendElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLLegendElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLLegendElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLLegendElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -110,9 +106,9 @@ static const HashTable JSHTMLLegendElementPrototypeTable =
 
 const ClassInfo JSHTMLLegendElementPrototype::s_info = { "HTMLLegendElementPrototype", 0, &JSHTMLLegendElementPrototypeTable, 0 };
 
-JSObject* JSHTMLLegendElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLLegendElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLLegendElement>(exec);
+    return getDOMPrototype<JSHTMLLegendElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLLegendElement::s_info = { "HTMLLegendElement", &JSHTMLElement::s_info, &JSHTMLLegendElementTable, 0 };
@@ -122,9 +118,9 @@ JSHTMLLegendElement::JSHTMLLegendElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSHTMLLegendElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLLegendElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLLegendElementPrototype(JSHTMLLegendElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLLegendElementPrototype(JSHTMLLegendElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLLegendElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,46 +128,49 @@ bool JSHTMLLegendElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLLegendElement, Base>(exec, &JSHTMLLegendElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLLegendElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLegendElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLegendElement* imp = static_cast<HTMLLegendElement*>(static_cast<JSHTMLLegendElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->form()));
 }
 
-JSValuePtr jsHTMLLegendElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLegendElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLegendElement* imp = static_cast<HTMLLegendElement*>(static_cast<JSHTMLLegendElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->accessKey());
 }
 
-JSValuePtr jsHTMLLegendElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLegendElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLegendElement* imp = static_cast<HTMLLegendElement*>(static_cast<JSHTMLLegendElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLLegendElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLegendElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLLegendElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLLegendElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLLegendElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLLegendElement, Base>(exec, propertyName, value, &JSHTMLLegendElementTable, this, slot);
 }
 
-void setJSHTMLLegendElementAccessKey(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLegendElementAccessKey(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLegendElement* imp = static_cast<HTMLLegendElement*>(static_cast<JSHTMLLegendElement*>(thisObject)->impl());
     imp->setAccessKey(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLLegendElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLegendElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLegendElement* imp = static_cast<HTMLLegendElement*>(static_cast<JSHTMLLegendElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLLegendElement::getConstructor(ExecState* exec)
+JSValue JSHTMLLegendElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLLegendElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h
index 76c0f19..9f0b2c2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLegendElement.h
@@ -31,24 +31,25 @@ class JSHTMLLegendElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLLegendElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLLegendElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLLegendElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLLegendElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,12 +57,12 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLLegendElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLLegendElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLegendElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLegendElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLegendElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLegendElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLegendElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLegendElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLegendElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLegendElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLegendElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLegendElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp
index a552771..c40004e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.cpp
@@ -19,24 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLLinkElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLLinkElement.h"
 #include "JSStyleSheet.h"
 #include "KURL.h"
 #include "StyleSheet.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLLinkElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLLinkElement);
 
 /* Hash table */
 
@@ -82,13 +78,13 @@ public:
     JSHTMLLinkElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLLinkElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLLinkElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLLinkElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -117,9 +113,9 @@ static const HashTable JSHTMLLinkElementPrototypeTable =
 
 const ClassInfo JSHTMLLinkElementPrototype::s_info = { "HTMLLinkElementPrototype", 0, &JSHTMLLinkElementPrototypeTable, 0 };
 
-JSObject* JSHTMLLinkElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLLinkElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLLinkElement>(exec);
+    return getDOMPrototype<JSHTMLLinkElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLLinkElement::s_info = { "HTMLLinkElement", &JSHTMLElement::s_info, &JSHTMLLinkElementTable, 0 };
@@ -129,9 +125,9 @@ JSHTMLLinkElement::JSHTMLLinkElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSHTMLLinkElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLLinkElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLLinkElementPrototype(JSHTMLLinkElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLLinkElementPrototype(JSHTMLLinkElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLLinkElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -139,130 +135,140 @@ bool JSHTMLLinkElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLLinkElement, Base>(exec, &JSHTMLLinkElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLLinkElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->disabled());
 }
 
-JSValuePtr jsHTMLLinkElementCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->charset());
 }
 
-JSValuePtr jsHTMLLinkElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->href());
 }
 
-JSValuePtr jsHTMLLinkElementHreflang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementHreflang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->hreflang());
 }
 
-JSValuePtr jsHTMLLinkElementMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->media());
 }
 
-JSValuePtr jsHTMLLinkElementRel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementRel(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->rel());
 }
 
-JSValuePtr jsHTMLLinkElementRev(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementRev(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->rev());
 }
 
-JSValuePtr jsHTMLLinkElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->target());
 }
 
-JSValuePtr jsHTMLLinkElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLLinkElementSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->sheet()));
 }
 
-JSValuePtr jsHTMLLinkElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLLinkElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLLinkElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLLinkElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLLinkElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLLinkElement, Base>(exec, propertyName, value, &JSHTMLLinkElementTable, this, slot);
 }
 
-void setJSHTMLLinkElementDisabled(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLinkElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
-    imp->setDisabled(value->toBoolean(exec));
+    imp->setDisabled(value.toBoolean(exec));
 }
 
-void setJSHTMLLinkElementCharset(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLinkElementCharset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
     imp->setCharset(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLLinkElementHref(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLinkElementHref(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
     imp->setHref(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLLinkElementHreflang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLinkElementHreflang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
     imp->setHreflang(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLLinkElementMedia(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLinkElementMedia(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
     imp->setMedia(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLLinkElementRel(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLinkElementRel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
     imp->setRel(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLLinkElementRev(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLinkElementRev(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
     imp->setRev(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLLinkElementTarget(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLinkElementTarget(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
     imp->setTarget(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLLinkElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLLinkElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLLinkElement* imp = static_cast<HTMLLinkElement*>(static_cast<JSHTMLLinkElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLLinkElement::getConstructor(ExecState* exec)
+JSValue JSHTMLLinkElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLLinkElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h
index 36c9954..d1bb4de 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLLinkElement.h
@@ -31,24 +31,25 @@ class JSHTMLLinkElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLLinkElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLLinkElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLLinkElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLLinkElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,26 +57,26 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLLinkElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLinkElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLinkElementCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLinkElementCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLinkElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLinkElementHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLinkElementHreflang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLinkElementHreflang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLinkElementMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLinkElementMedia(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLinkElementRel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLinkElementRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLinkElementRev(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLinkElementRev(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLinkElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLinkElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLinkElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLLinkElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLLinkElementSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLLinkElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLinkElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLinkElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLinkElementCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLinkElementCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLinkElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLinkElementHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLinkElementHreflang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLinkElementHreflang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLinkElementMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLinkElementMedia(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLinkElementRel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLinkElementRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLinkElementRev(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLinkElementRev(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLinkElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLinkElementTarget(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLinkElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLLinkElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLLinkElementSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLLinkElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp
index 928fbb6..458c3f1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.cpp
@@ -19,24 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLMapElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLCollection.h"
 #include "HTMLMapElement.h"
 #include "JSHTMLCollection.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLMapElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLMapElement);
 
 /* Hash table */
 
@@ -74,13 +70,13 @@ public:
     JSHTMLMapElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLMapElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLMapElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLMapElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +105,9 @@ static const HashTable JSHTMLMapElementPrototypeTable =
 
 const ClassInfo JSHTMLMapElementPrototype::s_info = { "HTMLMapElementPrototype", 0, &JSHTMLMapElementPrototypeTable, 0 };
 
-JSObject* JSHTMLMapElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLMapElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLMapElement>(exec);
+    return getDOMPrototype<JSHTMLMapElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLMapElement::s_info = { "HTMLMapElement", &JSHTMLElement::s_info, &JSHTMLMapElementTable, 0 };
@@ -121,9 +117,9 @@ JSHTMLMapElement::JSHTMLMapElement(PassRefPtr<Structure> structure, PassRefPtr<H
 {
 }
 
-JSObject* JSHTMLMapElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLMapElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLMapElementPrototype(JSHTMLMapElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLMapElementPrototype(JSHTMLMapElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLMapElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,34 +127,36 @@ bool JSHTMLMapElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSHTMLMapElement, Base>(exec, &JSHTMLMapElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLMapElementAreas(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMapElementAreas(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMapElement* imp = static_cast<HTMLMapElement*>(static_cast<JSHTMLMapElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->areas()));
 }
 
-JSValuePtr jsHTMLMapElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMapElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMapElement* imp = static_cast<HTMLMapElement*>(static_cast<JSHTMLMapElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLMapElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMapElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLMapElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLMapElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLMapElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLMapElement, Base>(exec, propertyName, value, &JSHTMLMapElementTable, this, slot);
 }
 
-void setJSHTMLMapElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMapElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMapElement* imp = static_cast<HTMLMapElement*>(static_cast<JSHTMLMapElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLMapElement::getConstructor(ExecState* exec)
+JSValue JSHTMLMapElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLMapElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h
index 0d3ec32..8476c3a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMapElement.h
@@ -31,24 +31,25 @@ class JSHTMLMapElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLMapElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLMapElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLMapElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLMapElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,10 +57,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLMapElementAreas(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMapElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMapElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMapElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMapElementAreas(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMapElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMapElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMapElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp
index ef45746..90f090f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.cpp
@@ -19,21 +19,17 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLMarqueeElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLMarqueeElement.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLMarqueeElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLMarqueeElement);
 
 /* Hash table */
 
@@ -69,13 +65,13 @@ public:
     JSHTMLMarqueeElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLMarqueeElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLMarqueeElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLMarqueeElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +102,9 @@ static const HashTable JSHTMLMarqueeElementPrototypeTable =
 
 const ClassInfo JSHTMLMarqueeElementPrototype::s_info = { "HTMLMarqueeElementPrototype", 0, &JSHTMLMarqueeElementPrototypeTable, 0 };
 
-JSObject* JSHTMLMarqueeElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLMarqueeElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLMarqueeElement>(exec);
+    return getDOMPrototype<JSHTMLMarqueeElement>(exec, globalObject);
 }
 
 bool JSHTMLMarqueeElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -123,9 +119,9 @@ JSHTMLMarqueeElement::JSHTMLMarqueeElement(PassRefPtr<Structure> structure, Pass
 {
 }
 
-JSObject* JSHTMLMarqueeElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLMarqueeElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLMarqueeElementPrototype(JSHTMLMarqueeElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLMarqueeElementPrototype(JSHTMLMarqueeElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLMarqueeElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,18 +129,19 @@ bool JSHTMLMarqueeElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLMarqueeElement, Base>(exec, &JSHTMLMarqueeElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLMarqueeElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMarqueeElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLMarqueeElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSHTMLMarqueeElement::getConstructor(ExecState* exec)
+JSValue JSHTMLMarqueeElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLMarqueeElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLMarqueeElementPrototypeFunctionStart(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLMarqueeElementPrototypeFunctionStart(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLMarqueeElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLMarqueeElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLMarqueeElement* castedThisObj = static_cast<JSHTMLMarqueeElement*>(asObject(thisValue));
     HTMLMarqueeElement* imp = static_cast<HTMLMarqueeElement*>(castedThisObj->impl());
@@ -153,9 +150,10 @@ JSValuePtr jsHTMLMarqueeElementPrototypeFunctionStart(ExecState* exec, JSObject*
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLMarqueeElementPrototypeFunctionStop(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLMarqueeElementPrototypeFunctionStop(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLMarqueeElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLMarqueeElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLMarqueeElement* castedThisObj = static_cast<JSHTMLMarqueeElement*>(asObject(thisValue));
     HTMLMarqueeElement* imp = static_cast<HTMLMarqueeElement*>(castedThisObj->impl());
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h
index 3882a3b..238b8d3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMarqueeElement.h
@@ -31,27 +31,28 @@ class JSHTMLMarqueeElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLMarqueeElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLMarqueeElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLMarqueeElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,11 +61,11 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLMarqueeElementPrototypeFunctionStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLMarqueeElementPrototypeFunctionStop(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLMarqueeElementPrototypeFunctionStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLMarqueeElementPrototypeFunctionStop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLMarqueeElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMarqueeElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp
index 765dea8..1f04d40 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.cpp
@@ -20,43 +20,41 @@
 
 #include "config.h"
 
-
 #if ENABLE(VIDEO)
 
 #include "JSHTMLMediaElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLMediaElement.h"
 #include "JSMediaError.h"
 #include "JSTimeRanges.h"
 #include "KURL.h"
 #include "MediaError.h"
 #include "TimeRanges.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLMediaElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLMediaElement);
 
 /* Hash table */
 
-static const HashTableValue JSHTMLMediaElementTableValues[28] =
+static const HashTableValue JSHTMLMediaElementTableValues[25] =
 {
     { "error", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementError, (intptr_t)0 },
     { "src", DontDelete, (intptr_t)jsHTMLMediaElementSrc, (intptr_t)setJSHTMLMediaElementSrc },
     { "currentSrc", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementCurrentSrc, (intptr_t)0 },
     { "networkState", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNetworkState, (intptr_t)0 },
-    { "bufferingRate", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementBufferingRate, (intptr_t)0 },
+    { "autobuffer", DontDelete, (intptr_t)jsHTMLMediaElementAutobuffer, (intptr_t)setJSHTMLMediaElementAutobuffer },
     { "buffered", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementBuffered, (intptr_t)0 },
     { "readyState", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementReadyState, (intptr_t)0 },
     { "seeking", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementSeeking, (intptr_t)0 },
     { "currentTime", DontDelete, (intptr_t)jsHTMLMediaElementCurrentTime, (intptr_t)setJSHTMLMediaElementCurrentTime },
+    { "startTime", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementStartTime, (intptr_t)0 },
     { "duration", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementDuration, (intptr_t)0 },
     { "paused", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementPaused, (intptr_t)0 },
     { "defaultPlaybackRate", DontDelete, (intptr_t)jsHTMLMediaElementDefaultPlaybackRate, (intptr_t)setJSHTMLMediaElementDefaultPlaybackRate },
@@ -65,39 +63,36 @@ static const HashTableValue JSHTMLMediaElementTableValues[28] =
     { "seekable", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementSeekable, (intptr_t)0 },
     { "ended", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementEnded, (intptr_t)0 },
     { "autoplay", DontDelete, (intptr_t)jsHTMLMediaElementAutoplay, (intptr_t)setJSHTMLMediaElementAutoplay },
-    { "start", DontDelete, (intptr_t)jsHTMLMediaElementStart, (intptr_t)setJSHTMLMediaElementStart },
-    { "end", DontDelete, (intptr_t)jsHTMLMediaElementEnd, (intptr_t)setJSHTMLMediaElementEnd },
-    { "loopStart", DontDelete, (intptr_t)jsHTMLMediaElementLoopStart, (intptr_t)setJSHTMLMediaElementLoopStart },
-    { "loopEnd", DontDelete, (intptr_t)jsHTMLMediaElementLoopEnd, (intptr_t)setJSHTMLMediaElementLoopEnd },
-    { "playCount", DontDelete, (intptr_t)jsHTMLMediaElementPlayCount, (intptr_t)setJSHTMLMediaElementPlayCount },
-    { "currentLoop", DontDelete, (intptr_t)jsHTMLMediaElementCurrentLoop, (intptr_t)setJSHTMLMediaElementCurrentLoop },
+    { "loop", DontDelete, (intptr_t)jsHTMLMediaElementLoop, (intptr_t)setJSHTMLMediaElementLoop },
     { "controls", DontDelete, (intptr_t)jsHTMLMediaElementControls, (intptr_t)setJSHTMLMediaElementControls },
     { "volume", DontDelete, (intptr_t)jsHTMLMediaElementVolume, (intptr_t)setJSHTMLMediaElementVolume },
     { "muted", DontDelete, (intptr_t)jsHTMLMediaElementMuted, (intptr_t)setJSHTMLMediaElementMuted },
+    { "webkitPreservesPitch", DontDelete, (intptr_t)jsHTMLMediaElementWebkitPreservesPitch, (intptr_t)setJSHTMLMediaElementWebkitPreservesPitch },
     { "constructor", DontEnum|ReadOnly, (intptr_t)jsHTMLMediaElementConstructor, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static const HashTable JSHTMLMediaElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 127, JSHTMLMediaElementTableValues, 0 };
+    { 1023, JSHTMLMediaElementTableValues, 0 };
 #else
-    { 67, 63, JSHTMLMediaElementTableValues, 0 };
+    { 68, 63, JSHTMLMediaElementTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
 
-static const HashTableValue JSHTMLMediaElementConstructorTableValues[10] =
-{
-    { "EMPTY", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementEMPTY, (intptr_t)0 },
-    { "LOADING", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementLOADING, (intptr_t)0 },
-    { "LOADED_METADATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementLOADED_METADATA, (intptr_t)0 },
-    { "LOADED_FIRST_FRAME", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementLOADED_FIRST_FRAME, (intptr_t)0 },
-    { "LOADED", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementLOADED, (intptr_t)0 },
-    { "DATA_UNAVAILABLE", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementDATA_UNAVAILABLE, (intptr_t)0 },
-    { "CAN_SHOW_CURRENT_FRAME", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementCAN_SHOW_CURRENT_FRAME, (intptr_t)0 },
-    { "CAN_PLAY", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementCAN_PLAY, (intptr_t)0 },
-    { "CAN_PLAY_THROUGH", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementCAN_PLAY_THROUGH, (intptr_t)0 },
+static const HashTableValue JSHTMLMediaElementConstructorTableValues[11] =
+{
+    { "NETWORK_EMPTY", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_EMPTY, (intptr_t)0 },
+    { "NETWORK_IDLE", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_IDLE, (intptr_t)0 },
+    { "NETWORK_LOADING", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_LOADING, (intptr_t)0 },
+    { "NETWORK_LOADED", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_LOADED, (intptr_t)0 },
+    { "NETWORK_NO_SOURCE", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_NO_SOURCE, (intptr_t)0 },
+    { "HAVE_NOTHING", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_NOTHING, (intptr_t)0 },
+    { "HAVE_METADATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_METADATA, (intptr_t)0 },
+    { "HAVE_CURRENT_DATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_CURRENT_DATA, (intptr_t)0 },
+    { "HAVE_FUTURE_DATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_FUTURE_DATA, (intptr_t)0 },
+    { "HAVE_ENOUGH_DATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_ENOUGH_DATA, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -113,13 +108,13 @@ public:
     JSHTMLMediaElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLMediaElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLMediaElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLMediaElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -134,18 +129,20 @@ bool JSHTMLMediaElementConstructor::getOwnPropertySlot(ExecState* exec, const Id
 
 /* Hash table for prototype */
 
-static const HashTableValue JSHTMLMediaElementPrototypeTableValues[13] =
-{
-    { "EMPTY", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementEMPTY, (intptr_t)0 },
-    { "LOADING", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementLOADING, (intptr_t)0 },
-    { "LOADED_METADATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementLOADED_METADATA, (intptr_t)0 },
-    { "LOADED_FIRST_FRAME", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementLOADED_FIRST_FRAME, (intptr_t)0 },
-    { "LOADED", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementLOADED, (intptr_t)0 },
-    { "DATA_UNAVAILABLE", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementDATA_UNAVAILABLE, (intptr_t)0 },
-    { "CAN_SHOW_CURRENT_FRAME", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementCAN_SHOW_CURRENT_FRAME, (intptr_t)0 },
-    { "CAN_PLAY", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementCAN_PLAY, (intptr_t)0 },
-    { "CAN_PLAY_THROUGH", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementCAN_PLAY_THROUGH, (intptr_t)0 },
+static const HashTableValue JSHTMLMediaElementPrototypeTableValues[15] =
+{
+    { "NETWORK_EMPTY", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_EMPTY, (intptr_t)0 },
+    { "NETWORK_IDLE", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_IDLE, (intptr_t)0 },
+    { "NETWORK_LOADING", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_LOADING, (intptr_t)0 },
+    { "NETWORK_LOADED", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_LOADED, (intptr_t)0 },
+    { "NETWORK_NO_SOURCE", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementNETWORK_NO_SOURCE, (intptr_t)0 },
+    { "HAVE_NOTHING", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_NOTHING, (intptr_t)0 },
+    { "HAVE_METADATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_METADATA, (intptr_t)0 },
+    { "HAVE_CURRENT_DATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_CURRENT_DATA, (intptr_t)0 },
+    { "HAVE_FUTURE_DATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_FUTURE_DATA, (intptr_t)0 },
+    { "HAVE_ENOUGH_DATA", DontDelete|ReadOnly, (intptr_t)jsHTMLMediaElementHAVE_ENOUGH_DATA, (intptr_t)0 },
     { "load", DontDelete|Function, (intptr_t)jsHTMLMediaElementPrototypeFunctionLoad, (intptr_t)0 },
+    { "canPlayType", DontDelete|Function, (intptr_t)jsHTMLMediaElementPrototypeFunctionCanPlayType, (intptr_t)1 },
     { "play", DontDelete|Function, (intptr_t)jsHTMLMediaElementPrototypeFunctionPlay, (intptr_t)0 },
     { "pause", DontDelete|Function, (intptr_t)jsHTMLMediaElementPrototypeFunctionPause, (intptr_t)0 },
     { 0, 0, 0, 0 }
@@ -153,16 +150,16 @@ static const HashTableValue JSHTMLMediaElementPrototypeTableValues[13] =
 
 static const HashTable JSHTMLMediaElementPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 127, JSHTMLMediaElementPrototypeTableValues, 0 };
+    { 63, JSHTMLMediaElementPrototypeTableValues, 0 };
 #else
-    { 34, 31, JSHTMLMediaElementPrototypeTableValues, 0 };
+    { 33, 31, JSHTMLMediaElementPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSHTMLMediaElementPrototype::s_info = { "HTMLMediaElementPrototype", 0, &JSHTMLMediaElementPrototypeTable, 0 };
 
-JSObject* JSHTMLMediaElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLMediaElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLMediaElement>(exec);
+    return getDOMPrototype<JSHTMLMediaElement>(exec, globalObject);
 }
 
 bool JSHTMLMediaElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -177,9 +174,9 @@ JSHTMLMediaElement::JSHTMLMediaElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLMediaElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLMediaElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLMediaElementPrototype(JSHTMLMediaElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLMediaElementPrototype(JSHTMLMediaElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLMediaElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -187,273 +184,255 @@ bool JSHTMLMediaElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLMediaElement, Base>(exec, &JSHTMLMediaElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLMediaElementError(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementError(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->error()));
 }
 
-JSValuePtr jsHTMLMediaElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->src());
 }
 
-JSValuePtr jsHTMLMediaElementCurrentSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementCurrentSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->currentSrc());
 }
 
-JSValuePtr jsHTMLMediaElementNetworkState(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementNetworkState(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->networkState());
 }
 
-JSValuePtr jsHTMLMediaElementBufferingRate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementAutobuffer(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->bufferingRate());
+    return jsBoolean(imp->autobuffer());
 }
 
-JSValuePtr jsHTMLMediaElementBuffered(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementBuffered(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->buffered()));
 }
 
-JSValuePtr jsHTMLMediaElementReadyState(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementReadyState(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->readyState());
 }
 
-JSValuePtr jsHTMLMediaElementSeeking(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementSeeking(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->seeking());
 }
 
-JSValuePtr jsHTMLMediaElementCurrentTime(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementCurrentTime(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->currentTime());
 }
 
-JSValuePtr jsHTMLMediaElementDuration(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementStartTime(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->startTime());
+}
+
+JSValue jsHTMLMediaElementDuration(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->duration());
 }
 
-JSValuePtr jsHTMLMediaElementPaused(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementPaused(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->paused());
 }
 
-JSValuePtr jsHTMLMediaElementDefaultPlaybackRate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementDefaultPlaybackRate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->defaultPlaybackRate());
 }
 
-JSValuePtr jsHTMLMediaElementPlaybackRate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementPlaybackRate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->playbackRate());
 }
 
-JSValuePtr jsHTMLMediaElementPlayed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementPlayed(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->played()));
 }
 
-JSValuePtr jsHTMLMediaElementSeekable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementSeekable(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->seekable()));
 }
 
-JSValuePtr jsHTMLMediaElementEnded(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementEnded(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->ended());
 }
 
-JSValuePtr jsHTMLMediaElementAutoplay(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementAutoplay(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->autoplay());
 }
 
-JSValuePtr jsHTMLMediaElementStart(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->start());
-}
-
-JSValuePtr jsHTMLMediaElementEnd(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->end());
-}
-
-JSValuePtr jsHTMLMediaElementLoopStart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementLoop(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->loopStart());
+    return jsBoolean(imp->loop());
 }
 
-JSValuePtr jsHTMLMediaElementLoopEnd(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementControls(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->loopEnd());
-}
-
-JSValuePtr jsHTMLMediaElementPlayCount(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->playCount());
-}
-
-JSValuePtr jsHTMLMediaElementCurrentLoop(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->currentLoop());
+    return jsBoolean(imp->controls());
 }
 
-JSValuePtr jsHTMLMediaElementControls(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementVolume(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
-    return jsBoolean(imp->controls());
+    return jsNumber(exec, imp->volume());
 }
 
-JSValuePtr jsHTMLMediaElementVolume(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementMuted(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
-    return jsNumber(exec, imp->volume());
+    return jsBoolean(imp->muted());
 }
 
-JSValuePtr jsHTMLMediaElementMuted(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementWebkitPreservesPitch(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->impl());
-    return jsBoolean(imp->muted());
+    return jsBoolean(imp->webkitPreservesPitch());
 }
 
-JSValuePtr jsHTMLMediaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMediaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLMediaElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLMediaElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLMediaElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLMediaElement, Base>(exec, propertyName, value, &JSHTMLMediaElementTable, this, slot);
 }
 
-void setJSHTMLMediaElementSrc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMediaElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    imp->setSrc(value->toString(exec));
+    imp->setSrc(value.toString(exec));
 }
 
-void setJSHTMLMediaElementCurrentTime(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMediaElementAutobuffer(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    ExceptionCode ec = 0;
-    imp->setCurrentTime(value->toFloat(exec), ec);
-    setDOMException(exec, ec);
+    imp->setAutobuffer(value.toBoolean(exec));
 }
 
-void setJSHTMLMediaElementDefaultPlaybackRate(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMediaElementCurrentTime(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
-    imp->setDefaultPlaybackRate(value->toFloat(exec), ec);
+    imp->setCurrentTime(value.toFloat(exec), ec);
     setDOMException(exec, ec);
 }
 
-void setJSHTMLMediaElementPlaybackRate(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMediaElementDefaultPlaybackRate(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    ExceptionCode ec = 0;
-    imp->setPlaybackRate(value->toFloat(exec), ec);
-    setDOMException(exec, ec);
-}
-
-void setJSHTMLMediaElementAutoplay(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    imp->setAutoplay(value->toBoolean(exec));
+    imp->setDefaultPlaybackRate(value.toFloat(exec));
 }
 
-void setJSHTMLMediaElementStart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMediaElementPlaybackRate(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    imp->setStart(value->toFloat(exec));
+    imp->setPlaybackRate(value.toFloat(exec));
 }
 
-void setJSHTMLMediaElementEnd(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMediaElementAutoplay(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    imp->setEnd(value->toFloat(exec));
+    imp->setAutoplay(value.toBoolean(exec));
 }
 
-void setJSHTMLMediaElementLoopStart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMediaElementLoop(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    imp->setLoopStart(value->toFloat(exec));
+    imp->setLoop(value.toBoolean(exec));
 }
 
-void setJSHTMLMediaElementLoopEnd(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMediaElementControls(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    imp->setLoopEnd(value->toFloat(exec));
+    imp->setControls(value.toBoolean(exec));
 }
 
-void setJSHTMLMediaElementPlayCount(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMediaElementVolume(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
-    imp->setPlayCount(value->toInt32(exec), ec);
+    imp->setVolume(value.toFloat(exec), ec);
     setDOMException(exec, ec);
 }
 
-void setJSHTMLMediaElementCurrentLoop(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    imp->setCurrentLoop(value->toInt32(exec));
-}
-
-void setJSHTMLMediaElementControls(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    imp->setControls(value->toBoolean(exec));
-}
-
-void setJSHTMLMediaElementVolume(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMediaElementMuted(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    ExceptionCode ec = 0;
-    imp->setVolume(value->toFloat(exec), ec);
-    setDOMException(exec, ec);
+    imp->setMuted(value.toBoolean(exec));
 }
 
-void setJSHTMLMediaElementMuted(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMediaElementWebkitPreservesPitch(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(static_cast<JSHTMLMediaElement*>(thisObject)->impl());
-    imp->setMuted(value->toBoolean(exec));
+    imp->setWebkitPreservesPitch(value.toBoolean(exec));
 }
 
-JSValuePtr JSHTMLMediaElement::getConstructor(ExecState* exec)
+JSValue JSHTMLMediaElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLMediaElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLMediaElementPrototypeFunctionLoad(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionLoad(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLMediaElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLMediaElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(asObject(thisValue));
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
@@ -464,79 +443,96 @@ JSValuePtr jsHTMLMediaElementPrototypeFunctionLoad(ExecState* exec, JSObject*, J
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLMediaElementPrototypeFunctionPlay(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionCanPlayType(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLMediaElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLMediaElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(asObject(thisValue));
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
+    const UString& type = args.at(0).toString(exec);
 
-    imp->play(ec);
-    setDOMException(exec, ec);
+
+    JSC::JSValue result = jsString(exec, imp->canPlayType(type));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionPlay(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLMediaElement::s_info))
+        return throwError(exec, TypeError);
+    JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(asObject(thisValue));
+    HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
+
+    imp->play();
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLMediaElementPrototypeFunctionPause(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionPause(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLMediaElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLMediaElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLMediaElement* castedThisObj = static_cast<JSHTMLMediaElement*>(asObject(thisValue));
     HTMLMediaElement* imp = static_cast<HTMLMediaElement*>(castedThisObj->impl());
-    ExceptionCode ec = 0;
 
-    imp->pause(ec);
-    setDOMException(exec, ec);
+    imp->pause();
     return jsUndefined();
 }
 
 // Constant getters
 
-JSValuePtr jsHTMLMediaElementEMPTY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementNETWORK_EMPTY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsHTMLMediaElementLOADING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementNETWORK_IDLE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsHTMLMediaElementLOADED_METADATA(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementNETWORK_LOADING(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsHTMLMediaElementLOADED_FIRST_FRAME(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementNETWORK_LOADED(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsHTMLMediaElementLOADED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementNETWORK_NO_SOURCE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsHTMLMediaElementDATA_UNAVAILABLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementHAVE_NOTHING(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsHTMLMediaElementCAN_SHOW_CURRENT_FRAME(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementHAVE_METADATA(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsHTMLMediaElementCAN_PLAY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementHAVE_CURRENT_DATA(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsHTMLMediaElementCAN_PLAY_THROUGH(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsHTMLMediaElementHAVE_FUTURE_DATA(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
+JSValue jsHTMLMediaElementHAVE_ENOUGH_DATA(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(4));
+}
+
 
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h
index fbce249..c0fb829 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMediaElement.h
@@ -21,7 +21,6 @@
 #ifndef JSHTMLMediaElement_h
 #define JSHTMLMediaElement_h
 
-
 #if ENABLE(VIDEO)
 
 #include "JSHTMLElement.h"
@@ -34,28 +33,29 @@ class JSHTMLMediaElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLMediaElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLMediaElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLMediaElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -64,63 +64,59 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLMediaElementPrototypeFunctionLoad(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLMediaElementPrototypeFunctionPlay(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLMediaElementPrototypeFunctionPause(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionLoad(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionCanPlayType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionPlay(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLMediaElementPrototypeFunctionPause(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLMediaElementError(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementCurrentSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementNetworkState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementBufferingRate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementBuffered(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementReadyState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementSeeking(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementCurrentTime(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementCurrentTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementDuration(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementPaused(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementDefaultPlaybackRate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementDefaultPlaybackRate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementPlaybackRate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementPlaybackRate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementPlayed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementSeekable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementEnded(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementAutoplay(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementAutoplay(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementStart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementEnd(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementLoopStart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementLoopStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementLoopEnd(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementLoopEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementPlayCount(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementPlayCount(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementCurrentLoop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementCurrentLoop(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementControls(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementControls(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementVolume(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementVolume(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementMuted(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMediaElementMuted(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMediaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementError(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMediaElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMediaElementCurrentSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementNetworkState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementAutobuffer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMediaElementAutobuffer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMediaElementBuffered(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementReadyState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementSeeking(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementCurrentTime(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMediaElementCurrentTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMediaElementStartTime(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementDuration(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementPaused(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementDefaultPlaybackRate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMediaElementDefaultPlaybackRate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMediaElementPlaybackRate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMediaElementPlaybackRate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMediaElementPlayed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementSeekable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementEnded(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementAutoplay(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMediaElementAutoplay(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMediaElementLoop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMediaElementLoop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMediaElementControls(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMediaElementControls(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMediaElementVolume(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMediaElementVolume(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMediaElementMuted(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMediaElementMuted(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMediaElementWebkitPreservesPitch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMediaElementWebkitPreservesPitch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMediaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsHTMLMediaElementEMPTY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementLOADING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementLOADED_METADATA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementLOADED_FIRST_FRAME(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementLOADED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementDATA_UNAVAILABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementCAN_SHOW_CURRENT_FRAME(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementCAN_PLAY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLMediaElementCAN_PLAY_THROUGH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementNETWORK_EMPTY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementNETWORK_IDLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementNETWORK_LOADING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementNETWORK_LOADED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementNETWORK_NO_SOURCE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementHAVE_NOTHING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementHAVE_METADATA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementHAVE_CURRENT_DATA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementHAVE_FUTURE_DATA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMediaElementHAVE_ENOUGH_DATA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp
index 3f947dc..35ce014 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.cpp
@@ -19,20 +19,16 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLMenuElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLMenuElement.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLMenuElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLMenuElement);
 
 /* Hash table */
 
@@ -69,13 +65,13 @@ public:
     JSHTMLMenuElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLMenuElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLMenuElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLMenuElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -104,9 +100,9 @@ static const HashTable JSHTMLMenuElementPrototypeTable =
 
 const ClassInfo JSHTMLMenuElementPrototype::s_info = { "HTMLMenuElementPrototype", 0, &JSHTMLMenuElementPrototypeTable, 0 };
 
-JSObject* JSHTMLMenuElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLMenuElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLMenuElement>(exec);
+    return getDOMPrototype<JSHTMLMenuElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLMenuElement::s_info = { "HTMLMenuElement", &JSHTMLElement::s_info, &JSHTMLMenuElementTable, 0 };
@@ -116,9 +112,9 @@ JSHTMLMenuElement::JSHTMLMenuElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSHTMLMenuElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLMenuElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLMenuElementPrototype(JSHTMLMenuElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLMenuElementPrototype(JSHTMLMenuElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLMenuElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -126,28 +122,29 @@ bool JSHTMLMenuElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLMenuElement, Base>(exec, &JSHTMLMenuElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLMenuElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMenuElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMenuElement* imp = static_cast<HTMLMenuElement*>(static_cast<JSHTMLMenuElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->compact());
 }
 
-JSValuePtr jsHTMLMenuElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMenuElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLMenuElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLMenuElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLMenuElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLMenuElement, Base>(exec, propertyName, value, &JSHTMLMenuElementTable, this, slot);
 }
 
-void setJSHTMLMenuElementCompact(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMenuElementCompact(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMenuElement* imp = static_cast<HTMLMenuElement*>(static_cast<JSHTMLMenuElement*>(thisObject)->impl());
-    imp->setCompact(value->toBoolean(exec));
+    imp->setCompact(value.toBoolean(exec));
 }
 
-JSValuePtr JSHTMLMenuElement::getConstructor(ExecState* exec)
+JSValue JSHTMLMenuElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLMenuElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h
index a08e739..ca9321c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMenuElement.h
@@ -31,24 +31,25 @@ class JSHTMLMenuElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLMenuElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLMenuElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLMenuElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLMenuElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLMenuElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMenuElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMenuElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMenuElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMenuElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMenuElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp
index def9b39..213c2bf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.cpp
@@ -19,22 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLMetaElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLMetaElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLMetaElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLMetaElement);
 
 /* Hash table */
 
@@ -74,13 +70,13 @@ public:
     JSHTMLMetaElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLMetaElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLMetaElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLMetaElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +105,9 @@ static const HashTable JSHTMLMetaElementPrototypeTable =
 
 const ClassInfo JSHTMLMetaElementPrototype::s_info = { "HTMLMetaElementPrototype", 0, &JSHTMLMetaElementPrototypeTable, 0 };
 
-JSObject* JSHTMLMetaElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLMetaElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLMetaElement>(exec);
+    return getDOMPrototype<JSHTMLMetaElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLMetaElement::s_info = { "HTMLMetaElement", &JSHTMLElement::s_info, &JSHTMLMetaElementTable, 0 };
@@ -121,9 +117,9 @@ JSHTMLMetaElement::JSHTMLMetaElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSHTMLMetaElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLMetaElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLMetaElementPrototype(JSHTMLMetaElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLMetaElementPrototype(JSHTMLMetaElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLMetaElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,64 +127,68 @@ bool JSHTMLMetaElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSHTMLMetaElement, Base>(exec, &JSHTMLMetaElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLMetaElementContent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMetaElementContent(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(static_cast<JSHTMLMetaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->content());
 }
 
-JSValuePtr jsHTMLMetaElementHttpEquiv(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMetaElementHttpEquiv(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(static_cast<JSHTMLMetaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->httpEquiv());
 }
 
-JSValuePtr jsHTMLMetaElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMetaElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(static_cast<JSHTMLMetaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLMetaElementScheme(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMetaElementScheme(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(static_cast<JSHTMLMetaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->scheme());
 }
 
-JSValuePtr jsHTMLMetaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLMetaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLMetaElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLMetaElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLMetaElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLMetaElement, Base>(exec, propertyName, value, &JSHTMLMetaElementTable, this, slot);
 }
 
-void setJSHTMLMetaElementContent(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMetaElementContent(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(static_cast<JSHTMLMetaElement*>(thisObject)->impl());
     imp->setContent(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLMetaElementHttpEquiv(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMetaElementHttpEquiv(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(static_cast<JSHTMLMetaElement*>(thisObject)->impl());
     imp->setHttpEquiv(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLMetaElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMetaElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(static_cast<JSHTMLMetaElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLMetaElementScheme(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLMetaElementScheme(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLMetaElement* imp = static_cast<HTMLMetaElement*>(static_cast<JSHTMLMetaElement*>(thisObject)->impl());
     imp->setScheme(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLMetaElement::getConstructor(ExecState* exec)
+JSValue JSHTMLMetaElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLMetaElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h
index 0ad9bbe..ee531c5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLMetaElement.h
@@ -31,24 +31,25 @@ class JSHTMLMetaElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLMetaElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLMetaElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLMetaElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLMetaElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,15 +57,15 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLMetaElementContent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMetaElementContent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMetaElementHttpEquiv(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMetaElementHttpEquiv(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMetaElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMetaElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMetaElementScheme(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLMetaElementScheme(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLMetaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLMetaElementContent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMetaElementContent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMetaElementHttpEquiv(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMetaElementHttpEquiv(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMetaElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMetaElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMetaElementScheme(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLMetaElementScheme(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLMetaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp
index fe159b6..b55516c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.cpp
@@ -19,22 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLModElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLModElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLModElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLModElement);
 
 /* Hash table */
 
@@ -72,13 +68,13 @@ public:
     JSHTMLModElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLModElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLModElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLModElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -107,9 +103,9 @@ static const HashTable JSHTMLModElementPrototypeTable =
 
 const ClassInfo JSHTMLModElementPrototype::s_info = { "HTMLModElementPrototype", 0, &JSHTMLModElementPrototypeTable, 0 };
 
-JSObject* JSHTMLModElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLModElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLModElement>(exec);
+    return getDOMPrototype<JSHTMLModElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLModElement::s_info = { "HTMLModElement", &JSHTMLElement::s_info, &JSHTMLModElementTable, 0 };
@@ -119,9 +115,9 @@ JSHTMLModElement::JSHTMLModElement(PassRefPtr<Structure> structure, PassRefPtr<H
 {
 }
 
-JSObject* JSHTMLModElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLModElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLModElementPrototype(JSHTMLModElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLModElementPrototype(JSHTMLModElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLModElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -129,40 +125,42 @@ bool JSHTMLModElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSHTMLModElement, Base>(exec, &JSHTMLModElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLModElementCite(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLModElementCite(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLModElement* imp = static_cast<HTMLModElement*>(static_cast<JSHTMLModElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->cite());
 }
 
-JSValuePtr jsHTMLModElementDateTime(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLModElementDateTime(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLModElement* imp = static_cast<HTMLModElement*>(static_cast<JSHTMLModElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->dateTime());
 }
 
-JSValuePtr jsHTMLModElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLModElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLModElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLModElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLModElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLModElement, Base>(exec, propertyName, value, &JSHTMLModElementTable, this, slot);
 }
 
-void setJSHTMLModElementCite(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLModElementCite(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLModElement* imp = static_cast<HTMLModElement*>(static_cast<JSHTMLModElement*>(thisObject)->impl());
     imp->setCite(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLModElementDateTime(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLModElementDateTime(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLModElement* imp = static_cast<HTMLModElement*>(static_cast<JSHTMLModElement*>(thisObject)->impl());
     imp->setDateTime(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLModElement::getConstructor(ExecState* exec)
+JSValue JSHTMLModElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLModElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h
index c39d1cb..67b6e02 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLModElement.h
@@ -31,24 +31,25 @@ class JSHTMLModElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLModElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLModElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLModElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLModElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,11 +57,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLModElementCite(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLModElementCite(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLModElementDateTime(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLModElementDateTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLModElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLModElementCite(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLModElementCite(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLModElementDateTime(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLModElementDateTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLModElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp
index b6d9cf8..70fe0b4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.cpp
@@ -19,22 +19,19 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLOListElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLOListElement.h"
 #include "KURL.h"
-
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLOListElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLOListElement);
 
 /* Hash table */
 
@@ -73,13 +70,13 @@ public:
     JSHTMLOListElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLOListElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLOListElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLOListElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -108,9 +105,9 @@ static const HashTable JSHTMLOListElementPrototypeTable =
 
 const ClassInfo JSHTMLOListElementPrototype::s_info = { "HTMLOListElementPrototype", 0, &JSHTMLOListElementPrototypeTable, 0 };
 
-JSObject* JSHTMLOListElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLOListElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLOListElement>(exec);
+    return getDOMPrototype<JSHTMLOListElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLOListElement::s_info = { "HTMLOListElement", &JSHTMLElement::s_info, &JSHTMLOListElementTable, 0 };
@@ -120,9 +117,9 @@ JSHTMLOListElement::JSHTMLOListElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLOListElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLOListElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLOListElementPrototype(JSHTMLOListElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLOListElementPrototype(JSHTMLOListElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLOListElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -130,52 +127,55 @@ bool JSHTMLOListElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLOListElement, Base>(exec, &JSHTMLOListElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLOListElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOListElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOListElement* imp = static_cast<HTMLOListElement*>(static_cast<JSHTMLOListElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->compact());
 }
 
-JSValuePtr jsHTMLOListElementStart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOListElementStart(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOListElement* imp = static_cast<HTMLOListElement*>(static_cast<JSHTMLOListElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->start());
 }
 
-JSValuePtr jsHTMLOListElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOListElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOListElement* imp = static_cast<HTMLOListElement*>(static_cast<JSHTMLOListElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLOListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLOListElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLOListElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLOListElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLOListElement, Base>(exec, propertyName, value, &JSHTMLOListElementTable, this, slot);
 }
 
-void setJSHTMLOListElementCompact(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOListElementCompact(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOListElement* imp = static_cast<HTMLOListElement*>(static_cast<JSHTMLOListElement*>(thisObject)->impl());
-    imp->setCompact(value->toBoolean(exec));
+    imp->setCompact(value.toBoolean(exec));
 }
 
-void setJSHTMLOListElementStart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOListElementStart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOListElement* imp = static_cast<HTMLOListElement*>(static_cast<JSHTMLOListElement*>(thisObject)->impl());
-    imp->setStart(value->toInt32(exec));
+    imp->setStart(value.toInt32(exec));
 }
 
-void setJSHTMLOListElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOListElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOListElement* imp = static_cast<HTMLOListElement*>(static_cast<JSHTMLOListElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLOListElement::getConstructor(ExecState* exec)
+JSValue JSHTMLOListElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLOListElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h
index d166da6..e7cfac5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOListElement.h
@@ -31,24 +31,25 @@ class JSHTMLOListElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLOListElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLOListElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLOListElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLOListElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,13 +57,13 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLOListElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOListElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOListElementStart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOListElementStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOListElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOListElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOListElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOListElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOListElementStart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOListElementStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOListElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOListElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp
index 0233e57..c50e27a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.cpp
@@ -19,11 +19,8 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLObjectElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "AtomicString.h"
 #include "Document.h"
 #include "HTMLFormElement.h"
@@ -35,16 +32,16 @@
 #include "JSSVGDocument.h"
 #include "KURL.h"
 #include "SVGDocument.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLObjectElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLObjectElement);
 
 /* Hash table */
 
@@ -98,13 +95,13 @@ public:
     JSHTMLObjectElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLObjectElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLObjectElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLObjectElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -134,9 +131,9 @@ static const HashTable JSHTMLObjectElementPrototypeTable =
 
 const ClassInfo JSHTMLObjectElementPrototype::s_info = { "HTMLObjectElementPrototype", 0, &JSHTMLObjectElementPrototypeTable, 0 };
 
-JSObject* JSHTMLObjectElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLObjectElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLObjectElement>(exec);
+    return getDOMPrototype<JSHTMLObjectElement>(exec, globalObject);
 }
 
 bool JSHTMLObjectElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -151,9 +148,9 @@ JSHTMLObjectElement::JSHTMLObjectElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSHTMLObjectElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLObjectElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLObjectElementPrototype(JSHTMLObjectElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLObjectElementPrototype(JSHTMLObjectElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLObjectElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -162,234 +159,252 @@ bool JSHTMLObjectElement::getOwnPropertySlot(ExecState* exec, const Identifier&
         slot.setCustom(this, nameGetter);
         return true;
     }
-    if (customGetOwnPropertySlot(exec, propertyName, slot))
+    if (getOwnPropertySlotDelegate(exec, propertyName, slot))
         return true;
     return getStaticValueSlot<JSHTMLObjectElement, Base>(exec, &JSHTMLObjectElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLObjectElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->form()));
 }
 
-JSValuePtr jsHTMLObjectElementCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->code());
 }
 
-JSValuePtr jsHTMLObjectElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLObjectElementArchive(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementArchive(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->archive());
 }
 
-JSValuePtr jsHTMLObjectElementBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->border());
 }
 
-JSValuePtr jsHTMLObjectElementCodeBase(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementCodeBase(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->codeBase());
 }
 
-JSValuePtr jsHTMLObjectElementCodeType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementCodeType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->codeType());
 }
 
-JSValuePtr jsHTMLObjectElementData(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementData(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->data());
 }
 
-JSValuePtr jsHTMLObjectElementDeclare(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementDeclare(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->declare());
 }
 
-JSValuePtr jsHTMLObjectElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->height());
 }
 
-JSValuePtr jsHTMLObjectElementHspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementHspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->hspace());
 }
 
-JSValuePtr jsHTMLObjectElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLObjectElementStandby(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementStandby(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->standby());
 }
 
-JSValuePtr jsHTMLObjectElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLObjectElementUseMap(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementUseMap(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->useMap());
 }
 
-JSValuePtr jsHTMLObjectElementVspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementVspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->vspace());
 }
 
-JSValuePtr jsHTMLObjectElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->width());
 }
 
-JSValuePtr jsHTMLObjectElementContentDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementContentDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->impl());
     return checkNodeSecurity(exec, imp->contentDocument()) ? toJS(exec, WTF::getPtr(imp->contentDocument())) : jsUndefined();
 }
 
-JSValuePtr jsHTMLObjectElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLObjectElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLObjectElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLObjectElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLObjectElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    if (customPut(exec, propertyName, value, slot))
+    if (putDelegate(exec, propertyName, value, slot))
         return;
     lookupPut<JSHTMLObjectElement, Base>(exec, propertyName, value, &JSHTMLObjectElementTable, this, slot);
 }
 
-void setJSHTMLObjectElementCode(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementCode(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setCode(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementArchive(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementArchive(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setArchive(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementBorder(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementBorder(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setBorder(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementCodeBase(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementCodeBase(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setCodeBase(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementCodeType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementCodeType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setCodeType(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementData(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementData(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setData(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementDeclare(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementDeclare(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
-    imp->setDeclare(value->toBoolean(exec));
+    imp->setDeclare(value.toBoolean(exec));
 }
 
-void setJSHTMLObjectElementHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setHeight(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementHspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementHspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
-    imp->setHspace(value->toInt32(exec));
+    imp->setHspace(value.toInt32(exec));
 }
 
-void setJSHTMLObjectElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementStandby(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementStandby(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setStandby(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementUseMap(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementUseMap(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setUseMap(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLObjectElementVspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementVspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
-    imp->setVspace(value->toInt32(exec));
+    imp->setVspace(value.toInt32(exec));
 }
 
-void setJSHTMLObjectElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLObjectElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(static_cast<JSHTMLObjectElement*>(thisObject)->impl());
     imp->setWidth(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLObjectElement::getConstructor(ExecState* exec)
+JSValue JSHTMLObjectElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLObjectElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLObjectElementPrototypeFunctionGetSVGDocument(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLObjectElementPrototypeFunctionGetSVGDocument(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLObjectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLObjectElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLObjectElement* castedThisObj = static_cast<JSHTMLObjectElement*>(asObject(thisValue));
     HTMLObjectElement* imp = static_cast<HTMLObjectElement*>(castedThisObj->impl());
@@ -398,7 +413,7 @@ JSValuePtr jsHTMLObjectElementPrototypeFunctionGetSVGDocument(ExecState* exec, J
         return jsUndefined();
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getSVGDocument(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getSVGDocument(ec)));
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h
index e2885ad..5e9d01c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLObjectElement.h
@@ -32,35 +32,36 @@ class JSHTMLObjectElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLObjectElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLObjectElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    bool customGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual JSC::CallType getCallData(JSC::CallData&);
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 private:
     static bool canGetItemsForName(JSC::ExecState*, HTMLObjectElement*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
 
 class JSHTMLObjectElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,44 +70,44 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLObjectElementPrototypeFunctionGetSVGDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLObjectElementPrototypeFunctionGetSVGDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLObjectElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLObjectElementCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementCode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementArchive(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementArchive(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementCodeBase(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementCodeBase(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementCodeType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementCodeType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementDeclare(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementDeclare(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementHspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementHspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementStandby(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementStandby(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementUseMap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementUseMap(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementVspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementVspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLObjectElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLObjectElementContentDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLObjectElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLObjectElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLObjectElementCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementCode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementArchive(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementArchive(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementCodeBase(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementCodeBase(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementCodeType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementCodeType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementDeclare(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementDeclare(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementHspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementHspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementStandby(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementStandby(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementUseMap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementUseMap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementVspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementVspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLObjectElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLObjectElementContentDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLObjectElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp
index 7ca1fb3..69506b0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.cpp
@@ -19,22 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLOptGroupElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLOptGroupElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLOptGroupElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLOptGroupElement);
 
 /* Hash table */
 
@@ -72,13 +68,13 @@ public:
     JSHTMLOptGroupElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLOptGroupElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLOptGroupElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLOptGroupElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -107,9 +103,9 @@ static const HashTable JSHTMLOptGroupElementPrototypeTable =
 
 const ClassInfo JSHTMLOptGroupElementPrototype::s_info = { "HTMLOptGroupElementPrototype", 0, &JSHTMLOptGroupElementPrototypeTable, 0 };
 
-JSObject* JSHTMLOptGroupElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLOptGroupElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLOptGroupElement>(exec);
+    return getDOMPrototype<JSHTMLOptGroupElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLOptGroupElement::s_info = { "HTMLOptGroupElement", &JSHTMLElement::s_info, &JSHTMLOptGroupElementTable, 0 };
@@ -119,9 +115,9 @@ JSHTMLOptGroupElement::JSHTMLOptGroupElement(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSHTMLOptGroupElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLOptGroupElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLOptGroupElementPrototype(JSHTMLOptGroupElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLOptGroupElementPrototype(JSHTMLOptGroupElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLOptGroupElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -129,40 +125,42 @@ bool JSHTMLOptGroupElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSHTMLOptGroupElement, Base>(exec, &JSHTMLOptGroupElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLOptGroupElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptGroupElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOptGroupElement* imp = static_cast<HTMLOptGroupElement*>(static_cast<JSHTMLOptGroupElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->disabled());
 }
 
-JSValuePtr jsHTMLOptGroupElementLabel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptGroupElementLabel(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOptGroupElement* imp = static_cast<HTMLOptGroupElement*>(static_cast<JSHTMLOptGroupElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->label());
 }
 
-JSValuePtr jsHTMLOptGroupElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptGroupElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLOptGroupElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLOptGroupElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLOptGroupElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLOptGroupElement, Base>(exec, propertyName, value, &JSHTMLOptGroupElementTable, this, slot);
 }
 
-void setJSHTMLOptGroupElementDisabled(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOptGroupElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOptGroupElement* imp = static_cast<HTMLOptGroupElement*>(static_cast<JSHTMLOptGroupElement*>(thisObject)->impl());
-    imp->setDisabled(value->toBoolean(exec));
+    imp->setDisabled(value.toBoolean(exec));
 }
 
-void setJSHTMLOptGroupElementLabel(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOptGroupElementLabel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOptGroupElement* imp = static_cast<HTMLOptGroupElement*>(static_cast<JSHTMLOptGroupElement*>(thisObject)->impl());
     imp->setLabel(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLOptGroupElement::getConstructor(ExecState* exec)
+JSValue JSHTMLOptGroupElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLOptGroupElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h
index 23740f6..44cfa44 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptGroupElement.h
@@ -31,24 +31,25 @@ class JSHTMLOptGroupElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLOptGroupElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLOptGroupElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLOptGroupElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLOptGroupElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,11 +57,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLOptGroupElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOptGroupElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOptGroupElementLabel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOptGroupElementLabel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOptGroupElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOptGroupElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOptGroupElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOptGroupElementLabel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOptGroupElementLabel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOptGroupElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp
index 0991d2b..ee1283d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.cpp
@@ -19,24 +19,21 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLOptionElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLFormElement.h"
 #include "HTMLOptionElement.h"
 #include "JSHTMLFormElement.h"
 #include "KURL.h"
-
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLOptionElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLOptionElement);
 
 /* Hash table */
 
@@ -80,13 +77,13 @@ public:
     JSHTMLOptionElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLOptionElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLOptionElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLOptionElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -115,9 +112,9 @@ static const HashTable JSHTMLOptionElementPrototypeTable =
 
 const ClassInfo JSHTMLOptionElementPrototype::s_info = { "HTMLOptionElementPrototype", 0, &JSHTMLOptionElementPrototypeTable, 0 };
 
-JSObject* JSHTMLOptionElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLOptionElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLOptionElement>(exec);
+    return getDOMPrototype<JSHTMLOptionElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLOptionElement::s_info = { "HTMLOptionElement", &JSHTMLElement::s_info, &JSHTMLOptionElementTable, 0 };
@@ -127,9 +124,9 @@ JSHTMLOptionElement::JSHTMLOptionElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSHTMLOptionElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLOptionElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLOptionElementPrototype(JSHTMLOptionElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLOptionElementPrototype(JSHTMLOptionElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLOptionElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -137,70 +134,78 @@ bool JSHTMLOptionElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLOptionElement, Base>(exec, &JSHTMLOptionElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLOptionElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->form()));
 }
 
-JSValuePtr jsHTMLOptionElementDefaultSelected(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementDefaultSelected(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->defaultSelected());
 }
 
-JSValuePtr jsHTMLOptionElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->text());
 }
 
-JSValuePtr jsHTMLOptionElementIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->index());
 }
 
-JSValuePtr jsHTMLOptionElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->disabled());
 }
 
-JSValuePtr jsHTMLOptionElementLabel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementLabel(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->label());
 }
 
-JSValuePtr jsHTMLOptionElementSelected(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementSelected(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->selected());
 }
 
-JSValuePtr jsHTMLOptionElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->value());
 }
 
-JSValuePtr jsHTMLOptionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLOptionElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLOptionElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLOptionElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLOptionElement, Base>(exec, propertyName, value, &JSHTMLOptionElementTable, this, slot);
 }
 
-void setJSHTMLOptionElementDefaultSelected(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOptionElementDefaultSelected(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(thisObject)->impl());
-    imp->setDefaultSelected(value->toBoolean(exec));
+    imp->setDefaultSelected(value.toBoolean(exec));
 }
 
-void setJSHTMLOptionElementText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOptionElementText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -208,38 +213,38 @@ void setJSHTMLOptionElementText(ExecState* exec, JSObject* thisObject, JSValuePt
     setDOMException(exec, ec);
 }
 
-void setJSHTMLOptionElementDisabled(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOptionElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(thisObject)->impl());
-    imp->setDisabled(value->toBoolean(exec));
+    imp->setDisabled(value.toBoolean(exec));
 }
 
-void setJSHTMLOptionElementLabel(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOptionElementLabel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(thisObject)->impl());
     imp->setLabel(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLOptionElementSelected(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOptionElementSelected(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(thisObject)->impl());
-    imp->setSelected(value->toBoolean(exec));
+    imp->setSelected(value.toBoolean(exec));
 }
 
-void setJSHTMLOptionElementValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOptionElementValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOptionElement* imp = static_cast<HTMLOptionElement*>(static_cast<JSHTMLOptionElement*>(thisObject)->impl());
     imp->setValue(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLOptionElement::getConstructor(ExecState* exec)
+JSValue JSHTMLOptionElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLOptionElementConstructor>(exec);
 }
 
-HTMLOptionElement* toHTMLOptionElement(JSC::JSValuePtr value)
+HTMLOptionElement* toHTMLOptionElement(JSC::JSValue value)
 {
-    return value->isObject(&JSHTMLOptionElement::s_info) ? static_cast<JSHTMLOptionElement*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSHTMLOptionElement::s_info) ? static_cast<JSHTMLOptionElement*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h
index 3e53986..d9bd338 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionElement.h
@@ -21,8 +21,9 @@
 #ifndef JSHTMLOptionElement_h
 #define JSHTMLOptionElement_h
 
-#include "JSHTMLElement.h"
 #include "HTMLOptionElement.h"
+#include "JSHTMLElement.h"
+
 namespace WebCore {
 
 class HTMLOptionElement;
@@ -31,29 +32,30 @@ class JSHTMLOptionElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLOptionElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLOptionElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     HTMLOptionElement* impl() const
     {
         return static_cast<HTMLOptionElement*>(Base::impl());
     }
 };
 
-HTMLOptionElement* toHTMLOptionElement(JSC::JSValuePtr);
+HTMLOptionElement* toHTMLOptionElement(JSC::JSValue);
 
 class JSHTMLOptionElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLOptionElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -61,21 +63,21 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLOptionElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLOptionElementDefaultSelected(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOptionElementDefaultSelected(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOptionElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOptionElementText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOptionElementIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLOptionElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOptionElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOptionElementLabel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOptionElementLabel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOptionElementSelected(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOptionElementSelected(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOptionElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOptionElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOptionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOptionElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOptionElementDefaultSelected(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOptionElementDefaultSelected(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOptionElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOptionElementText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOptionElementIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLOptionElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOptionElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOptionElementLabel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOptionElementLabel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOptionElementSelected(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOptionElementSelected(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOptionElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOptionElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOptionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.cpp
index 0d41a16..578ab90 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.cpp
@@ -19,21 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLOptionsCollection.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLOptionsCollection.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLOptionsCollection)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLOptionsCollection);
 
 /* Hash table */
 
@@ -69,9 +66,9 @@ static const HashTable JSHTMLOptionsCollectionPrototypeTable =
 
 const ClassInfo JSHTMLOptionsCollectionPrototype::s_info = { "HTMLOptionsCollectionPrototype", 0, &JSHTMLOptionsCollectionPrototypeTable, 0 };
 
-JSObject* JSHTMLOptionsCollectionPrototype::self(ExecState* exec)
+JSObject* JSHTMLOptionsCollectionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLOptionsCollection>(exec);
+    return getDOMPrototype<JSHTMLOptionsCollection>(exec, globalObject);
 }
 
 bool JSHTMLOptionsCollectionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -86,9 +83,9 @@ JSHTMLOptionsCollection::JSHTMLOptionsCollection(PassRefPtr<Structure> structure
 {
 }
 
-JSObject* JSHTMLOptionsCollection::createPrototype(ExecState* exec)
+JSObject* JSHTMLOptionsCollection::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLOptionsCollectionPrototype(JSHTMLOptionsCollectionPrototype::createStructure(JSHTMLCollectionPrototype::self(exec)));
+    return new (exec) JSHTMLOptionsCollectionPrototype(JSHTMLOptionsCollectionPrototype::createStructure(JSHTMLCollectionPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLOptionsCollection::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -96,18 +93,19 @@ bool JSHTMLOptionsCollection::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSHTMLOptionsCollection, Base>(exec, &JSHTMLOptionsCollectionTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLOptionsCollectionSelectedIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionsCollectionSelectedIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(static_cast<JSHTMLOptionsCollection*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->selectedIndex());
 }
 
-JSValuePtr jsHTMLOptionsCollectionLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLOptionsCollectionLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLOptionsCollection*>(asObject(slot.slotBase()))->length(exec);
 }
 
-void JSHTMLOptionsCollection::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLOptionsCollection::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     bool ok;
     unsigned index = propertyName.toUInt32(&ok, false);
@@ -118,42 +116,44 @@ void JSHTMLOptionsCollection::put(ExecState* exec, const Identifier& propertyNam
     lookupPut<JSHTMLOptionsCollection, Base>(exec, propertyName, value, &JSHTMLOptionsCollectionTable, this, slot);
 }
 
-void JSHTMLOptionsCollection::put(ExecState* exec, unsigned propertyName, JSValuePtr value)
+void JSHTMLOptionsCollection::put(ExecState* exec, unsigned propertyName, JSValue value)
 {
     indexSetter(exec, propertyName, value);
     return;
 }
 
-void setJSHTMLOptionsCollectionSelectedIndex(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOptionsCollectionSelectedIndex(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLOptionsCollection* imp = static_cast<HTMLOptionsCollection*>(static_cast<JSHTMLOptionsCollection*>(thisObject)->impl());
-    imp->setSelectedIndex(value->toInt32(exec));
+    imp->setSelectedIndex(value.toInt32(exec));
 }
 
-void setJSHTMLOptionsCollectionLength(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLOptionsCollectionLength(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSHTMLOptionsCollection*>(thisObject)->setLength(exec, value);
 }
 
-JSValuePtr jsHTMLOptionsCollectionPrototypeFunctionAdd(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLOptionsCollectionPrototypeFunctionAdd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLOptionsCollection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLOptionsCollection::s_info))
         return throwError(exec, TypeError);
     JSHTMLOptionsCollection* castedThisObj = static_cast<JSHTMLOptionsCollection*>(asObject(thisValue));
     return castedThisObj->add(exec, args);
 }
 
-JSValuePtr jsHTMLOptionsCollectionPrototypeFunctionRemove(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLOptionsCollectionPrototypeFunctionRemove(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLOptionsCollection::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLOptionsCollection::s_info))
         return throwError(exec, TypeError);
     JSHTMLOptionsCollection* castedThisObj = static_cast<JSHTMLOptionsCollection*>(asObject(thisValue));
     return castedThisObj->remove(exec, args);
 }
 
-HTMLOptionsCollection* toHTMLOptionsCollection(JSC::JSValuePtr value)
+HTMLOptionsCollection* toHTMLOptionsCollection(JSC::JSValue value)
 {
-    return value->isObject(&JSHTMLOptionsCollection::s_info) ? static_cast<JSHTMLOptionsCollection*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSHTMLOptionsCollection::s_info) ? static_cast<JSHTMLOptionsCollection*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h
index f1b9def..40d89f6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLOptionsCollection.h
@@ -21,8 +21,9 @@
 #ifndef JSHTMLOptionsCollection_h
 #define JSHTMLOptionsCollection_h
 
-#include "JSHTMLCollection.h"
 #include "HTMLOptionsCollection.h"
+#include "JSHTMLCollection.h"
+
 namespace WebCore {
 
 class HTMLOptionsCollection;
@@ -31,42 +32,43 @@ class JSHTMLOptionsCollection : public JSHTMLCollection {
     typedef JSHTMLCollection Base;
 public:
     JSHTMLOptionsCollection(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLOptionsCollection>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValuePtr);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
 
     // Custom attributes
-    JSC::JSValuePtr length(JSC::ExecState*) const;
-    void setLength(JSC::ExecState*, JSC::JSValuePtr);
+    JSC::JSValue length(JSC::ExecState*) const;
+    void setLength(JSC::ExecState*, JSC::JSValue);
 
     // Custom functions
-    JSC::JSValuePtr add(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr remove(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue add(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue remove(JSC::ExecState*, const JSC::ArgList&);
     HTMLOptionsCollection* impl() const
     {
         return static_cast<HTMLOptionsCollection*>(Base::impl());
     }
-    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValuePtr);
+    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
 
-HTMLOptionsCollection* toHTMLOptionsCollection(JSC::JSValuePtr);
+HTMLOptionsCollection* toHTMLOptionsCollection(JSC::JSValue);
 
 class JSHTMLOptionsCollectionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -75,14 +77,14 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLOptionsCollectionPrototypeFunctionAdd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLOptionsCollectionPrototypeFunctionRemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLOptionsCollectionPrototypeFunctionAdd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLOptionsCollectionPrototypeFunctionRemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLOptionsCollectionSelectedIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOptionsCollectionSelectedIndex(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLOptionsCollectionLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLOptionsCollectionLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsHTMLOptionsCollectionSelectedIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOptionsCollectionSelectedIndex(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLOptionsCollectionLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLOptionsCollectionLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp
index 3b8d852..ba47a53 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.cpp
@@ -19,22 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLParagraphElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLParagraphElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLParagraphElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLParagraphElement);
 
 /* Hash table */
 
@@ -71,13 +67,13 @@ public:
     JSHTMLParagraphElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLParagraphElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLParagraphElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLParagraphElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +102,9 @@ static const HashTable JSHTMLParagraphElementPrototypeTable =
 
 const ClassInfo JSHTMLParagraphElementPrototype::s_info = { "HTMLParagraphElementPrototype", 0, &JSHTMLParagraphElementPrototypeTable, 0 };
 
-JSObject* JSHTMLParagraphElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLParagraphElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLParagraphElement>(exec);
+    return getDOMPrototype<JSHTMLParagraphElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLParagraphElement::s_info = { "HTMLParagraphElement", &JSHTMLElement::s_info, &JSHTMLParagraphElementTable, 0 };
@@ -118,9 +114,9 @@ JSHTMLParagraphElement::JSHTMLParagraphElement(PassRefPtr<Structure> structure,
 {
 }
 
-JSObject* JSHTMLParagraphElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLParagraphElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLParagraphElementPrototype(JSHTMLParagraphElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLParagraphElementPrototype(JSHTMLParagraphElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLParagraphElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,28 +124,29 @@ bool JSHTMLParagraphElement::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticValueSlot<JSHTMLParagraphElement, Base>(exec, &JSHTMLParagraphElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLParagraphElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLParagraphElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLParagraphElement* imp = static_cast<HTMLParagraphElement*>(static_cast<JSHTMLParagraphElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLParagraphElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLParagraphElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLParagraphElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLParagraphElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLParagraphElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLParagraphElement, Base>(exec, propertyName, value, &JSHTMLParagraphElementTable, this, slot);
 }
 
-void setJSHTMLParagraphElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLParagraphElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLParagraphElement* imp = static_cast<HTMLParagraphElement*>(static_cast<JSHTMLParagraphElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLParagraphElement::getConstructor(ExecState* exec)
+JSValue JSHTMLParagraphElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLParagraphElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h
index 32cb105..3693849 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParagraphElement.h
@@ -31,24 +31,25 @@ class JSHTMLParagraphElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLParagraphElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLParagraphElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLParagraphElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLParagraphElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLParagraphElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLParagraphElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLParagraphElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLParagraphElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLParagraphElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLParagraphElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp
index a07976b..b4c9348 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.cpp
@@ -19,22 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLParamElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLParamElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLParamElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLParamElement);
 
 /* Hash table */
 
@@ -74,13 +70,13 @@ public:
     JSHTMLParamElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLParamElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLParamElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLParamElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +105,9 @@ static const HashTable JSHTMLParamElementPrototypeTable =
 
 const ClassInfo JSHTMLParamElementPrototype::s_info = { "HTMLParamElementPrototype", 0, &JSHTMLParamElementPrototypeTable, 0 };
 
-JSObject* JSHTMLParamElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLParamElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLParamElement>(exec);
+    return getDOMPrototype<JSHTMLParamElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLParamElement::s_info = { "HTMLParamElement", &JSHTMLElement::s_info, &JSHTMLParamElementTable, 0 };
@@ -121,9 +117,9 @@ JSHTMLParamElement::JSHTMLParamElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLParamElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLParamElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLParamElementPrototype(JSHTMLParamElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLParamElementPrototype(JSHTMLParamElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLParamElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,64 +127,68 @@ bool JSHTMLParamElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLParamElement, Base>(exec, &JSHTMLParamElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLParamElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLParamElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLParamElement* imp = static_cast<HTMLParamElement*>(static_cast<JSHTMLParamElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLParamElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLParamElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLParamElement* imp = static_cast<HTMLParamElement*>(static_cast<JSHTMLParamElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLParamElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLParamElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLParamElement* imp = static_cast<HTMLParamElement*>(static_cast<JSHTMLParamElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->value());
 }
 
-JSValuePtr jsHTMLParamElementValueType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLParamElementValueType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLParamElement* imp = static_cast<HTMLParamElement*>(static_cast<JSHTMLParamElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->valueType());
 }
 
-JSValuePtr jsHTMLParamElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLParamElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLParamElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLParamElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLParamElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLParamElement, Base>(exec, propertyName, value, &JSHTMLParamElementTable, this, slot);
 }
 
-void setJSHTMLParamElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLParamElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLParamElement* imp = static_cast<HTMLParamElement*>(static_cast<JSHTMLParamElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLParamElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLParamElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLParamElement* imp = static_cast<HTMLParamElement*>(static_cast<JSHTMLParamElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLParamElementValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLParamElementValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLParamElement* imp = static_cast<HTMLParamElement*>(static_cast<JSHTMLParamElement*>(thisObject)->impl());
     imp->setValue(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLParamElementValueType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLParamElementValueType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLParamElement* imp = static_cast<HTMLParamElement*>(static_cast<JSHTMLParamElement*>(thisObject)->impl());
     imp->setValueType(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLParamElement::getConstructor(ExecState* exec)
+JSValue JSHTMLParamElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLParamElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h
index 2444be4..7e7760e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLParamElement.h
@@ -31,24 +31,25 @@ class JSHTMLParamElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLParamElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLParamElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLParamElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLParamElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,15 +57,15 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLParamElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLParamElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLParamElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLParamElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLParamElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLParamElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLParamElementValueType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLParamElementValueType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLParamElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLParamElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLParamElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLParamElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLParamElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLParamElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLParamElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLParamElementValueType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLParamElementValueType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLParamElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp
index b557a17..8aac7c1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.cpp
@@ -19,20 +19,17 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLPreElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLPreElement.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLPreElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLPreElement);
 
 /* Hash table */
 
@@ -70,13 +67,13 @@ public:
     JSHTMLPreElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLPreElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLPreElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLPreElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -105,9 +102,9 @@ static const HashTable JSHTMLPreElementPrototypeTable =
 
 const ClassInfo JSHTMLPreElementPrototype::s_info = { "HTMLPreElementPrototype", 0, &JSHTMLPreElementPrototypeTable, 0 };
 
-JSObject* JSHTMLPreElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLPreElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLPreElement>(exec);
+    return getDOMPrototype<JSHTMLPreElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLPreElement::s_info = { "HTMLPreElement", &JSHTMLElement::s_info, &JSHTMLPreElementTable, 0 };
@@ -117,9 +114,9 @@ JSHTMLPreElement::JSHTMLPreElement(PassRefPtr<Structure> structure, PassRefPtr<H
 {
 }
 
-JSObject* JSHTMLPreElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLPreElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLPreElementPrototype(JSHTMLPreElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLPreElementPrototype(JSHTMLPreElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLPreElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -127,40 +124,42 @@ bool JSHTMLPreElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSHTMLPreElement, Base>(exec, &JSHTMLPreElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLPreElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLPreElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLPreElement* imp = static_cast<HTMLPreElement*>(static_cast<JSHTMLPreElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->width());
 }
 
-JSValuePtr jsHTMLPreElementWrap(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLPreElementWrap(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLPreElement* imp = static_cast<HTMLPreElement*>(static_cast<JSHTMLPreElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->wrap());
 }
 
-JSValuePtr jsHTMLPreElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLPreElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLPreElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLPreElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLPreElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLPreElement, Base>(exec, propertyName, value, &JSHTMLPreElementTable, this, slot);
 }
 
-void setJSHTMLPreElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLPreElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLPreElement* imp = static_cast<HTMLPreElement*>(static_cast<JSHTMLPreElement*>(thisObject)->impl());
-    imp->setWidth(value->toInt32(exec));
+    imp->setWidth(value.toInt32(exec));
 }
 
-void setJSHTMLPreElementWrap(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLPreElementWrap(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLPreElement* imp = static_cast<HTMLPreElement*>(static_cast<JSHTMLPreElement*>(thisObject)->impl());
-    imp->setWrap(value->toBoolean(exec));
+    imp->setWrap(value.toBoolean(exec));
 }
 
-JSValuePtr JSHTMLPreElement::getConstructor(ExecState* exec)
+JSValue JSHTMLPreElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLPreElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h
index 3081de8..1938f93 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLPreElement.h
@@ -31,24 +31,25 @@ class JSHTMLPreElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLPreElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLPreElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLPreElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLPreElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,11 +57,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLPreElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLPreElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLPreElementWrap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLPreElementWrap(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLPreElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLPreElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLPreElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLPreElementWrap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLPreElementWrap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLPreElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp
index 517f65b..dd831c0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.cpp
@@ -19,22 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLQuoteElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLQuoteElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLQuoteElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLQuoteElement);
 
 /* Hash table */
 
@@ -71,13 +67,13 @@ public:
     JSHTMLQuoteElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLQuoteElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLQuoteElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLQuoteElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +102,9 @@ static const HashTable JSHTMLQuoteElementPrototypeTable =
 
 const ClassInfo JSHTMLQuoteElementPrototype::s_info = { "HTMLQuoteElementPrototype", 0, &JSHTMLQuoteElementPrototypeTable, 0 };
 
-JSObject* JSHTMLQuoteElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLQuoteElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLQuoteElement>(exec);
+    return getDOMPrototype<JSHTMLQuoteElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLQuoteElement::s_info = { "HTMLQuoteElement", &JSHTMLElement::s_info, &JSHTMLQuoteElementTable, 0 };
@@ -118,9 +114,9 @@ JSHTMLQuoteElement::JSHTMLQuoteElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLQuoteElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLQuoteElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLQuoteElementPrototype(JSHTMLQuoteElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLQuoteElementPrototype(JSHTMLQuoteElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLQuoteElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,28 +124,29 @@ bool JSHTMLQuoteElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLQuoteElement, Base>(exec, &JSHTMLQuoteElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLQuoteElementCite(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLQuoteElementCite(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLQuoteElement* imp = static_cast<HTMLQuoteElement*>(static_cast<JSHTMLQuoteElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->cite());
 }
 
-JSValuePtr jsHTMLQuoteElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLQuoteElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLQuoteElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLQuoteElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLQuoteElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLQuoteElement, Base>(exec, propertyName, value, &JSHTMLQuoteElementTable, this, slot);
 }
 
-void setJSHTMLQuoteElementCite(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLQuoteElementCite(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLQuoteElement* imp = static_cast<HTMLQuoteElement*>(static_cast<JSHTMLQuoteElement*>(thisObject)->impl());
     imp->setCite(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLQuoteElement::getConstructor(ExecState* exec)
+JSValue JSHTMLQuoteElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLQuoteElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h
index 08e6af1..a45fc2f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLQuoteElement.h
@@ -31,24 +31,25 @@ class JSHTMLQuoteElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLQuoteElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLQuoteElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLQuoteElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLQuoteElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLQuoteElementCite(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLQuoteElementCite(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLQuoteElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLQuoteElementCite(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLQuoteElementCite(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLQuoteElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp
index 3a20587..ab7bc3d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.cpp
@@ -19,22 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLScriptElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLScriptElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLScriptElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLScriptElement);
 
 /* Hash table */
 
@@ -77,13 +73,13 @@ public:
     JSHTMLScriptElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLScriptElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLScriptElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLScriptElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -112,9 +108,9 @@ static const HashTable JSHTMLScriptElementPrototypeTable =
 
 const ClassInfo JSHTMLScriptElementPrototype::s_info = { "HTMLScriptElementPrototype", 0, &JSHTMLScriptElementPrototypeTable, 0 };
 
-JSObject* JSHTMLScriptElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLScriptElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLScriptElement>(exec);
+    return getDOMPrototype<JSHTMLScriptElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLScriptElement::s_info = { "HTMLScriptElement", &JSHTMLElement::s_info, &JSHTMLScriptElementTable, 0 };
@@ -124,9 +120,9 @@ JSHTMLScriptElement::JSHTMLScriptElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSHTMLScriptElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLScriptElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLScriptElementPrototype(JSHTMLScriptElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLScriptElementPrototype(JSHTMLScriptElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLScriptElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -134,100 +130,107 @@ bool JSHTMLScriptElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLScriptElement, Base>(exec, &JSHTMLScriptElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLScriptElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->text());
 }
 
-JSValuePtr jsHTMLScriptElementHtmlFor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementHtmlFor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->htmlFor());
 }
 
-JSValuePtr jsHTMLScriptElementEvent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementEvent(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->event());
 }
 
-JSValuePtr jsHTMLScriptElementCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementCharset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->charset());
 }
 
-JSValuePtr jsHTMLScriptElementDefer(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementDefer(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->defer());
 }
 
-JSValuePtr jsHTMLScriptElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->src());
 }
 
-JSValuePtr jsHTMLScriptElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLScriptElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLScriptElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLScriptElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLScriptElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLScriptElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLScriptElement, Base>(exec, propertyName, value, &JSHTMLScriptElementTable, this, slot);
 }
 
-void setJSHTMLScriptElementText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLScriptElementText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(thisObject)->impl());
     imp->setText(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLScriptElementHtmlFor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLScriptElementHtmlFor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(thisObject)->impl());
     imp->setHtmlFor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLScriptElementEvent(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLScriptElementEvent(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(thisObject)->impl());
     imp->setEvent(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLScriptElementCharset(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLScriptElementCharset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(thisObject)->impl());
     imp->setCharset(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLScriptElementDefer(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLScriptElementDefer(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(thisObject)->impl());
-    imp->setDefer(value->toBoolean(exec));
+    imp->setDefer(value.toBoolean(exec));
 }
 
-void setJSHTMLScriptElementSrc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLScriptElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(thisObject)->impl());
     imp->setSrc(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLScriptElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLScriptElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLScriptElement* imp = static_cast<HTMLScriptElement*>(static_cast<JSHTMLScriptElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLScriptElement::getConstructor(ExecState* exec)
+JSValue JSHTMLScriptElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLScriptElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h
index 7a7b344..89b67ef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLScriptElement.h
@@ -31,24 +31,25 @@ class JSHTMLScriptElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLScriptElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLScriptElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLScriptElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLScriptElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,21 +57,21 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLScriptElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLScriptElementText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLScriptElementHtmlFor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLScriptElementHtmlFor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLScriptElementEvent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLScriptElementEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLScriptElementCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLScriptElementCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLScriptElementDefer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLScriptElementDefer(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLScriptElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLScriptElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLScriptElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLScriptElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLScriptElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLScriptElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLScriptElementText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLScriptElementHtmlFor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLScriptElementHtmlFor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLScriptElementEvent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLScriptElementEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLScriptElementCharset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLScriptElementCharset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLScriptElementDefer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLScriptElementDefer(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLScriptElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLScriptElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLScriptElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLScriptElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLScriptElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp
index 978165c..8a61381 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.cpp
@@ -19,12 +19,8 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLSelectElement.h"
 
-#include <wtf/GetPtr.h>
-
-#include <runtime/PropertyNameArray.h>
 #include "ExceptionCode.h"
 #include "HTMLFormElement.h"
 #include "HTMLOptionsCollection.h"
@@ -35,16 +31,17 @@
 #include "JSNode.h"
 #include "KURL.h"
 #include "Node.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLSelectElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLSelectElement);
 
 /* Hash table */
 
@@ -92,13 +89,13 @@ public:
     JSHTMLSelectElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLSelectElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLSelectElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLSelectElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -131,9 +128,9 @@ static const HashTable JSHTMLSelectElementPrototypeTable =
 
 const ClassInfo JSHTMLSelectElementPrototype::s_info = { "HTMLSelectElementPrototype", 0, &JSHTMLSelectElementPrototypeTable, 0 };
 
-JSObject* JSHTMLSelectElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLSelectElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLSelectElement>(exec);
+    return getDOMPrototype<JSHTMLSelectElement>(exec, globalObject);
 }
 
 bool JSHTMLSelectElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -148,9 +145,9 @@ JSHTMLSelectElement::JSHTMLSelectElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSHTMLSelectElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLSelectElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLSelectElementPrototype(JSHTMLSelectElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLSelectElementPrototype(JSHTMLSelectElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLSelectElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -178,83 +175,95 @@ bool JSHTMLSelectElement::getOwnPropertySlot(ExecState* exec, unsigned propertyN
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsHTMLSelectElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLSelectElementSelectedIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementSelectedIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->selectedIndex());
 }
 
-JSValuePtr jsHTMLSelectElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->value());
 }
 
-JSValuePtr jsHTMLSelectElementLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsHTMLSelectElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->form()));
 }
 
-JSValuePtr jsHTMLSelectElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->willValidate());
 }
 
-JSValuePtr jsHTMLSelectElementOptions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementOptions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->options()));
 }
 
-JSValuePtr jsHTMLSelectElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->disabled());
 }
 
-JSValuePtr jsHTMLSelectElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->autofocus());
 }
 
-JSValuePtr jsHTMLSelectElementMultiple(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementMultiple(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->multiple());
 }
 
-JSValuePtr jsHTMLSelectElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLSelectElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->size());
 }
 
-JSValuePtr jsHTMLSelectElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSelectElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLSelectElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLSelectElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     bool ok;
     unsigned index = propertyName.toUInt32(&ok, false);
@@ -265,60 +274,60 @@ void JSHTMLSelectElement::put(ExecState* exec, const Identifier& propertyName, J
     lookupPut<JSHTMLSelectElement, Base>(exec, propertyName, value, &JSHTMLSelectElementTable, this, slot);
 }
 
-void JSHTMLSelectElement::put(ExecState* exec, unsigned propertyName, JSValuePtr value)
+void JSHTMLSelectElement::put(ExecState* exec, unsigned propertyName, JSValue value)
 {
     indexSetter(exec, propertyName, value);
     return;
 }
 
-void setJSHTMLSelectElementSelectedIndex(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLSelectElementSelectedIndex(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
-    imp->setSelectedIndex(value->toInt32(exec));
+    imp->setSelectedIndex(value.toInt32(exec));
 }
 
-void setJSHTMLSelectElementValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLSelectElementValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
     imp->setValue(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLSelectElementLength(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLSelectElementLength(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
-    imp->setLength(value->toInt32(exec), ec);
+    imp->setLength(value.toInt32(exec), ec);
     setDOMException(exec, ec);
 }
 
-void setJSHTMLSelectElementDisabled(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLSelectElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
-    imp->setDisabled(value->toBoolean(exec));
+    imp->setDisabled(value.toBoolean(exec));
 }
 
-void setJSHTMLSelectElementAutofocus(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLSelectElementAutofocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
-    imp->setAutofocus(value->toBoolean(exec));
+    imp->setAutofocus(value.toBoolean(exec));
 }
 
-void setJSHTMLSelectElementMultiple(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLSelectElementMultiple(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
-    imp->setMultiple(value->toBoolean(exec));
+    imp->setMultiple(value.toBoolean(exec));
 }
 
-void setJSHTMLSelectElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLSelectElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLSelectElementSize(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLSelectElementSize(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(static_cast<JSHTMLSelectElement*>(thisObject)->impl());
-    imp->setSize(value->toInt32(exec));
+    imp->setSize(value.toInt32(exec));
 }
 
 void JSHTMLSelectElement::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
@@ -328,66 +337,70 @@ void JSHTMLSelectElement::getPropertyNames(ExecState* exec, PropertyNameArray& p
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSHTMLSelectElement::getConstructor(ExecState* exec)
+JSValue JSHTMLSelectElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLSelectElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLSelectElementPrototypeFunctionAdd(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionAdd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLSelectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLSelectElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLSelectElement* castedThisObj = static_cast<JSHTMLSelectElement*>(asObject(thisValue));
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    HTMLElement* element = toHTMLElement(args.at(exec, 0));
-    HTMLElement* before = toHTMLElement(args.at(exec, 1));
+    HTMLElement* element = toHTMLElement(args.at(0));
+    HTMLElement* before = toHTMLElement(args.at(1));
 
     imp->add(element, before, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLSelectElementPrototypeFunctionRemove(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionRemove(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLSelectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLSelectElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLSelectElement* castedThisObj = static_cast<JSHTMLSelectElement*>(asObject(thisValue));
     return castedThisObj->remove(exec, args);
 }
 
-JSValuePtr jsHTMLSelectElementPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLSelectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLSelectElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLSelectElement* castedThisObj = static_cast<JSHTMLSelectElement*>(asObject(thisValue));
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThisObj->impl());
-    int index = args.at(exec, 0)->toInt32(exec);
+    int index = args.at(0).toInt32(exec);
     if (index < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return jsUndefined();
     }
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->item(index)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
     return result;
 }
 
-JSValuePtr jsHTMLSelectElementPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLSelectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLSelectElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLSelectElement* castedThisObj = static_cast<JSHTMLSelectElement*>(asObject(thisValue));
     HTMLSelectElement* imp = static_cast<HTMLSelectElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->namedItem(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->namedItem(name)));
     return result;
 }
 
 
-JSValuePtr JSHTMLSelectElement::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSHTMLSelectElement::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSHTMLSelectElement* thisObj = static_cast<JSHTMLSelectElement*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<HTMLSelectElement*>(thisObj->impl())->item(slot.index()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h
index 21a6a4a..1790360 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSelectElement.h
@@ -31,36 +31,37 @@ class JSHTMLSelectElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLSelectElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLSelectElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValuePtr);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, unsigned propertyName, JSC::JSValue);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom functions
-    JSC::JSValuePtr remove(JSC::ExecState*, const JSC::ArgList&);
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValuePtr);
+    JSC::JSValue remove(JSC::ExecState*, const JSC::ArgList&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    void indexSetter(JSC::ExecState*, unsigned index, JSC::JSValue);
 };
 
 
 class JSHTMLSelectElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,33 +70,33 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLSelectElementPrototypeFunctionAdd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLSelectElementPrototypeFunctionRemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLSelectElementPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLSelectElementPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionAdd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionRemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLSelectElementPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLSelectElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLSelectElementSelectedIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLSelectElementSelectedIndex(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLSelectElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLSelectElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLSelectElementLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLSelectElementLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLSelectElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLSelectElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLSelectElementOptions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLSelectElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLSelectElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLSelectElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLSelectElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLSelectElementMultiple(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLSelectElementMultiple(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLSelectElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLSelectElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLSelectElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLSelectElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLSelectElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSelectElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSelectElementSelectedIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLSelectElementSelectedIndex(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLSelectElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLSelectElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLSelectElementLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLSelectElementLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLSelectElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSelectElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSelectElementOptions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSelectElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLSelectElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLSelectElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLSelectElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLSelectElementMultiple(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLSelectElementMultiple(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLSelectElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLSelectElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLSelectElementSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLSelectElementSize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLSelectElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp
index 39ca632..b9f65ad 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.cpp
@@ -20,24 +20,20 @@
 
 #include "config.h"
 
-
 #if ENABLE(VIDEO)
 
 #include "JSHTMLSourceElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLSourceElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLSourceElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLSourceElement);
 
 /* Hash table */
 
@@ -76,13 +72,13 @@ public:
     JSHTMLSourceElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLSourceElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLSourceElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLSourceElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +107,9 @@ static const HashTable JSHTMLSourceElementPrototypeTable =
 
 const ClassInfo JSHTMLSourceElementPrototype::s_info = { "HTMLSourceElementPrototype", 0, &JSHTMLSourceElementPrototypeTable, 0 };
 
-JSObject* JSHTMLSourceElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLSourceElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLSourceElement>(exec);
+    return getDOMPrototype<JSHTMLSourceElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLSourceElement::s_info = { "HTMLSourceElement", &JSHTMLElement::s_info, &JSHTMLSourceElementTable, 0 };
@@ -123,9 +119,9 @@ JSHTMLSourceElement::JSHTMLSourceElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSHTMLSourceElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLSourceElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLSourceElementPrototype(JSHTMLSourceElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLSourceElementPrototype(JSHTMLSourceElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLSourceElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,52 +129,55 @@ bool JSHTMLSourceElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSHTMLSourceElement, Base>(exec, &JSHTMLSourceElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLSourceElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSourceElementSrc(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSourceElement* imp = static_cast<HTMLSourceElement*>(static_cast<JSHTMLSourceElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->src());
 }
 
-JSValuePtr jsHTMLSourceElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSourceElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSourceElement* imp = static_cast<HTMLSourceElement*>(static_cast<JSHTMLSourceElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLSourceElementMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSourceElementMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLSourceElement* imp = static_cast<HTMLSourceElement*>(static_cast<JSHTMLSourceElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->media());
 }
 
-JSValuePtr jsHTMLSourceElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLSourceElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLSourceElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLSourceElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLSourceElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLSourceElement, Base>(exec, propertyName, value, &JSHTMLSourceElementTable, this, slot);
 }
 
-void setJSHTMLSourceElementSrc(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLSourceElementSrc(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLSourceElement* imp = static_cast<HTMLSourceElement*>(static_cast<JSHTMLSourceElement*>(thisObject)->impl());
-    imp->setSrc(value->toString(exec));
+    imp->setSrc(value.toString(exec));
 }
 
-void setJSHTMLSourceElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLSourceElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLSourceElement* imp = static_cast<HTMLSourceElement*>(static_cast<JSHTMLSourceElement*>(thisObject)->impl());
-    imp->setType(value->toString(exec));
+    imp->setType(value.toString(exec));
 }
 
-void setJSHTMLSourceElementMedia(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLSourceElementMedia(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLSourceElement* imp = static_cast<HTMLSourceElement*>(static_cast<JSHTMLSourceElement*>(thisObject)->impl());
-    imp->setMedia(value->toString(exec));
+    imp->setMedia(value.toString(exec));
 }
 
-JSValuePtr JSHTMLSourceElement::getConstructor(ExecState* exec)
+JSValue JSHTMLSourceElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLSourceElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h
index f253817..18ece59 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLSourceElement.h
@@ -21,7 +21,6 @@
 #ifndef JSHTMLSourceElement_h
 #define JSHTMLSourceElement_h
 
-
 #if ENABLE(VIDEO)
 
 #include "JSHTMLElement.h"
@@ -34,24 +33,25 @@ class JSHTMLSourceElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLSourceElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLSourceElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLSourceElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLSourceElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -59,13 +59,13 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLSourceElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLSourceElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLSourceElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLSourceElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLSourceElementMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLSourceElementMedia(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLSourceElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLSourceElementSrc(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLSourceElementSrc(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLSourceElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLSourceElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLSourceElementMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLSourceElementMedia(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLSourceElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp
index 5afede9..5b31c04 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.cpp
@@ -19,24 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLStyleElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLStyleElement.h"
 #include "JSStyleSheet.h"
 #include "KURL.h"
 #include "StyleSheet.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLStyleElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLStyleElement);
 
 /* Hash table */
 
@@ -76,13 +72,13 @@ public:
     JSHTMLStyleElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLStyleElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLStyleElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLStyleElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +107,9 @@ static const HashTable JSHTMLStyleElementPrototypeTable =
 
 const ClassInfo JSHTMLStyleElementPrototype::s_info = { "HTMLStyleElementPrototype", 0, &JSHTMLStyleElementPrototypeTable, 0 };
 
-JSObject* JSHTMLStyleElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLStyleElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLStyleElement>(exec);
+    return getDOMPrototype<JSHTMLStyleElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLStyleElement::s_info = { "HTMLStyleElement", &JSHTMLElement::s_info, &JSHTMLStyleElementTable, 0 };
@@ -123,9 +119,9 @@ JSHTMLStyleElement::JSHTMLStyleElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLStyleElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLStyleElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLStyleElementPrototype(JSHTMLStyleElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLStyleElementPrototype(JSHTMLStyleElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLStyleElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,58 +129,62 @@ bool JSHTMLStyleElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLStyleElement, Base>(exec, &JSHTMLStyleElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLStyleElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLStyleElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(static_cast<JSHTMLStyleElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->disabled());
 }
 
-JSValuePtr jsHTMLStyleElementMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLStyleElementMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(static_cast<JSHTMLStyleElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->media());
 }
 
-JSValuePtr jsHTMLStyleElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLStyleElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(static_cast<JSHTMLStyleElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLStyleElementSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLStyleElementSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(static_cast<JSHTMLStyleElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->sheet()));
 }
 
-JSValuePtr jsHTMLStyleElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLStyleElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLStyleElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLStyleElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLStyleElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLStyleElement, Base>(exec, propertyName, value, &JSHTMLStyleElementTable, this, slot);
 }
 
-void setJSHTMLStyleElementDisabled(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLStyleElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(static_cast<JSHTMLStyleElement*>(thisObject)->impl());
-    imp->setDisabled(value->toBoolean(exec));
+    imp->setDisabled(value.toBoolean(exec));
 }
 
-void setJSHTMLStyleElementMedia(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLStyleElementMedia(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(static_cast<JSHTMLStyleElement*>(thisObject)->impl());
     imp->setMedia(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLStyleElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLStyleElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLStyleElement* imp = static_cast<HTMLStyleElement*>(static_cast<JSHTMLStyleElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLStyleElement::getConstructor(ExecState* exec)
+JSValue JSHTMLStyleElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLStyleElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h
index c4e704a..d0e9201 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLStyleElement.h
@@ -31,24 +31,25 @@ class JSHTMLStyleElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLStyleElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLStyleElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLStyleElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLStyleElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,14 +57,14 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLStyleElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLStyleElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLStyleElementMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLStyleElementMedia(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLStyleElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLStyleElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLStyleElementSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLStyleElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLStyleElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLStyleElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLStyleElementMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLStyleElementMedia(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLStyleElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLStyleElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLStyleElementSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLStyleElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp
index d67a751..51b8dbe 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.cpp
@@ -19,22 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLTableCaptionElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLTableCaptionElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableCaptionElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableCaptionElement);
 
 /* Hash table */
 
@@ -71,13 +67,13 @@ public:
     JSHTMLTableCaptionElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLTableCaptionElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLTableCaptionElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLTableCaptionElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +102,9 @@ static const HashTable JSHTMLTableCaptionElementPrototypeTable =
 
 const ClassInfo JSHTMLTableCaptionElementPrototype::s_info = { "HTMLTableCaptionElementPrototype", 0, &JSHTMLTableCaptionElementPrototypeTable, 0 };
 
-JSObject* JSHTMLTableCaptionElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLTableCaptionElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLTableCaptionElement>(exec);
+    return getDOMPrototype<JSHTMLTableCaptionElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLTableCaptionElement::s_info = { "HTMLTableCaptionElement", &JSHTMLElement::s_info, &JSHTMLTableCaptionElementTable, 0 };
@@ -118,9 +114,9 @@ JSHTMLTableCaptionElement::JSHTMLTableCaptionElement(PassRefPtr<Structure> struc
 {
 }
 
-JSObject* JSHTMLTableCaptionElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLTableCaptionElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLTableCaptionElementPrototype(JSHTMLTableCaptionElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLTableCaptionElementPrototype(JSHTMLTableCaptionElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLTableCaptionElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,35 +124,36 @@ bool JSHTMLTableCaptionElement::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSHTMLTableCaptionElement, Base>(exec, &JSHTMLTableCaptionElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLTableCaptionElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCaptionElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCaptionElement* imp = static_cast<HTMLTableCaptionElement*>(static_cast<JSHTMLTableCaptionElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLTableCaptionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCaptionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLTableCaptionElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLTableCaptionElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLTableCaptionElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLTableCaptionElement, Base>(exec, propertyName, value, &JSHTMLTableCaptionElementTable, this, slot);
 }
 
-void setJSHTMLTableCaptionElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCaptionElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCaptionElement* imp = static_cast<HTMLTableCaptionElement*>(static_cast<JSHTMLTableCaptionElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLTableCaptionElement::getConstructor(ExecState* exec)
+JSValue JSHTMLTableCaptionElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLTableCaptionElementConstructor>(exec);
 }
 
-HTMLTableCaptionElement* toHTMLTableCaptionElement(JSC::JSValuePtr value)
+HTMLTableCaptionElement* toHTMLTableCaptionElement(JSC::JSValue value)
 {
-    return value->isObject(&JSHTMLTableCaptionElement::s_info) ? static_cast<JSHTMLTableCaptionElement*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSHTMLTableCaptionElement::s_info) ? static_cast<JSHTMLTableCaptionElement*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h
index a5f0ea4..bc37fd4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCaptionElement.h
@@ -21,8 +21,9 @@
 #ifndef JSHTMLTableCaptionElement_h
 #define JSHTMLTableCaptionElement_h
 
-#include "JSHTMLElement.h"
 #include "HTMLTableCaptionElement.h"
+#include "JSHTMLElement.h"
+
 namespace WebCore {
 
 class HTMLTableCaptionElement;
@@ -31,29 +32,30 @@ class JSHTMLTableCaptionElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLTableCaptionElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLTableCaptionElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     HTMLTableCaptionElement* impl() const
     {
         return static_cast<HTMLTableCaptionElement*>(Base::impl());
     }
 };
 
-HTMLTableCaptionElement* toHTMLTableCaptionElement(JSC::JSValuePtr);
+HTMLTableCaptionElement* toHTMLTableCaptionElement(JSC::JSValue);
 
 class JSHTMLTableCaptionElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLTableCaptionElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -61,9 +63,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLTableCaptionElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCaptionElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCaptionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableCaptionElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCaptionElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCaptionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp
index 6db1432..cb81f6d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.cpp
@@ -19,22 +19,19 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLTableCellElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLTableCellElement.h"
 #include "KURL.h"
-
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableCellElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableCellElement);
 
 /* Hash table */
 
@@ -85,13 +82,13 @@ public:
     JSHTMLTableCellElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLTableCellElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLTableCellElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLTableCellElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -120,9 +117,9 @@ static const HashTable JSHTMLTableCellElementPrototypeTable =
 
 const ClassInfo JSHTMLTableCellElementPrototype::s_info = { "HTMLTableCellElementPrototype", 0, &JSHTMLTableCellElementPrototypeTable, 0 };
 
-JSObject* JSHTMLTableCellElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLTableCellElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLTableCellElement>(exec);
+    return getDOMPrototype<JSHTMLTableCellElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLTableCellElement::s_info = { "HTMLTableCellElement", &JSHTMLElement::s_info, &JSHTMLTableCellElementTable, 0 };
@@ -132,9 +129,9 @@ JSHTMLTableCellElement::JSHTMLTableCellElement(PassRefPtr<Structure> structure,
 {
 }
 
-JSObject* JSHTMLTableCellElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLTableCellElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLTableCellElementPrototype(JSHTMLTableCellElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLTableCellElementPrototype(JSHTMLTableCellElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLTableCellElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -142,190 +139,205 @@ bool JSHTMLTableCellElement::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticValueSlot<JSHTMLTableCellElement, Base>(exec, &JSHTMLTableCellElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLTableCellElementCellIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementCellIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->cellIndex());
 }
 
-JSValuePtr jsHTMLTableCellElementAbbr(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementAbbr(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->abbr());
 }
 
-JSValuePtr jsHTMLTableCellElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLTableCellElementAxis(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementAxis(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->axis());
 }
 
-JSValuePtr jsHTMLTableCellElementBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->bgColor());
 }
 
-JSValuePtr jsHTMLTableCellElementCh(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementCh(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->ch());
 }
 
-JSValuePtr jsHTMLTableCellElementChOff(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementChOff(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->chOff());
 }
 
-JSValuePtr jsHTMLTableCellElementColSpan(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementColSpan(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->colSpan());
 }
 
-JSValuePtr jsHTMLTableCellElementHeaders(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementHeaders(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->headers());
 }
 
-JSValuePtr jsHTMLTableCellElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->height());
 }
 
-JSValuePtr jsHTMLTableCellElementNoWrap(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementNoWrap(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->noWrap());
 }
 
-JSValuePtr jsHTMLTableCellElementRowSpan(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementRowSpan(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->rowSpan());
 }
 
-JSValuePtr jsHTMLTableCellElementScope(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementScope(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->scope());
 }
 
-JSValuePtr jsHTMLTableCellElementVAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementVAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->vAlign());
 }
 
-JSValuePtr jsHTMLTableCellElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->width());
 }
 
-JSValuePtr jsHTMLTableCellElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableCellElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLTableCellElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLTableCellElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLTableCellElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLTableCellElement, Base>(exec, propertyName, value, &JSHTMLTableCellElementTable, this, slot);
 }
 
-void setJSHTMLTableCellElementAbbr(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementAbbr(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
     imp->setAbbr(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableCellElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableCellElementAxis(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementAxis(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
     imp->setAxis(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableCellElementBgColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementBgColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
     imp->setBgColor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableCellElementCh(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementCh(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
     imp->setCh(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableCellElementChOff(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementChOff(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
     imp->setChOff(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableCellElementColSpan(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementColSpan(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
-    imp->setColSpan(value->toInt32(exec));
+    imp->setColSpan(value.toInt32(exec));
 }
 
-void setJSHTMLTableCellElementHeaders(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementHeaders(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
     imp->setHeaders(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableCellElementHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
     imp->setHeight(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableCellElementNoWrap(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementNoWrap(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
-    imp->setNoWrap(value->toBoolean(exec));
+    imp->setNoWrap(value.toBoolean(exec));
 }
 
-void setJSHTMLTableCellElementRowSpan(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementRowSpan(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
-    imp->setRowSpan(value->toInt32(exec));
+    imp->setRowSpan(value.toInt32(exec));
 }
 
-void setJSHTMLTableCellElementScope(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementScope(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
     imp->setScope(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableCellElementVAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementVAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
     imp->setVAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableCellElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableCellElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableCellElement* imp = static_cast<HTMLTableCellElement*>(static_cast<JSHTMLTableCellElement*>(thisObject)->impl());
     imp->setWidth(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLTableCellElement::getConstructor(ExecState* exec)
+JSValue JSHTMLTableCellElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLTableCellElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h
index ab786f7..7aa08ef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableCellElement.h
@@ -31,24 +31,25 @@ class JSHTMLTableCellElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLTableCellElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLTableCellElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLTableCellElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLTableCellElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,36 +57,36 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLTableCellElementCellIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLTableCellElementAbbr(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementAbbr(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementAxis(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementAxis(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementCh(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementCh(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementChOff(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementChOff(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementColSpan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementColSpan(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementHeaders(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementHeaders(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementNoWrap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementNoWrap(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementRowSpan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementRowSpan(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementScope(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementScope(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementVAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementVAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableCellElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableCellElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableCellElementCellIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableCellElementAbbr(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementAbbr(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementAxis(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementAxis(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementCh(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementCh(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementChOff(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementChOff(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementColSpan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementColSpan(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementHeaders(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementHeaders(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementNoWrap(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementNoWrap(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementRowSpan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementRowSpan(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementScope(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementScope(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementVAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementVAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableCellElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableCellElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp
index 6712797..470cd02 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.cpp
@@ -19,22 +19,19 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLTableColElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLTableColElement.h"
 #include "KURL.h"
-
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableColElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableColElement);
 
 /* Hash table */
 
@@ -76,13 +73,13 @@ public:
     JSHTMLTableColElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLTableColElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLTableColElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLTableColElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +108,9 @@ static const HashTable JSHTMLTableColElementPrototypeTable =
 
 const ClassInfo JSHTMLTableColElementPrototype::s_info = { "HTMLTableColElementPrototype", 0, &JSHTMLTableColElementPrototypeTable, 0 };
 
-JSObject* JSHTMLTableColElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLTableColElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLTableColElement>(exec);
+    return getDOMPrototype<JSHTMLTableColElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLTableColElement::s_info = { "HTMLTableColElement", &JSHTMLElement::s_info, &JSHTMLTableColElementTable, 0 };
@@ -123,9 +120,9 @@ JSHTMLTableColElement::JSHTMLTableColElement(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSHTMLTableColElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLTableColElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLTableColElementPrototype(JSHTMLTableColElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLTableColElementPrototype(JSHTMLTableColElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLTableColElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,88 +130,94 @@ bool JSHTMLTableColElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSHTMLTableColElement, Base>(exec, &JSHTMLTableColElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLTableColElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableColElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLTableColElementCh(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableColElementCh(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->ch());
 }
 
-JSValuePtr jsHTMLTableColElementChOff(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableColElementChOff(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->chOff());
 }
 
-JSValuePtr jsHTMLTableColElementSpan(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableColElementSpan(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->span());
 }
 
-JSValuePtr jsHTMLTableColElementVAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableColElementVAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->vAlign());
 }
 
-JSValuePtr jsHTMLTableColElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableColElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->width());
 }
 
-JSValuePtr jsHTMLTableColElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableColElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLTableColElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLTableColElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLTableColElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLTableColElement, Base>(exec, propertyName, value, &JSHTMLTableColElementTable, this, slot);
 }
 
-void setJSHTMLTableColElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableColElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableColElementCh(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableColElementCh(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(thisObject)->impl());
     imp->setCh(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableColElementChOff(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableColElementChOff(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(thisObject)->impl());
     imp->setChOff(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableColElementSpan(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableColElementSpan(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(thisObject)->impl());
-    imp->setSpan(value->toInt32(exec));
+    imp->setSpan(value.toInt32(exec));
 }
 
-void setJSHTMLTableColElementVAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableColElementVAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(thisObject)->impl());
     imp->setVAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableColElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableColElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableColElement* imp = static_cast<HTMLTableColElement*>(static_cast<JSHTMLTableColElement*>(thisObject)->impl());
     imp->setWidth(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLTableColElement::getConstructor(ExecState* exec)
+JSValue JSHTMLTableColElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLTableColElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h
index 12562cf..a060d19 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableColElement.h
@@ -31,24 +31,25 @@ class JSHTMLTableColElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLTableColElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLTableColElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLTableColElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLTableColElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,19 +57,19 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLTableColElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableColElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableColElementCh(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableColElementCh(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableColElementChOff(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableColElementChOff(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableColElementSpan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableColElementSpan(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableColElementVAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableColElementVAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableColElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableColElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableColElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableColElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableColElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableColElementCh(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableColElementCh(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableColElementChOff(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableColElementChOff(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableColElementSpan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableColElementSpan(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableColElementVAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableColElementVAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableColElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableColElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableColElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp
index c28f67d..96b92e0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.cpp
@@ -19,11 +19,8 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLTableElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLCollection.h"
 #include "HTMLElement.h"
 #include "HTMLTableCaptionElement.h"
@@ -34,16 +31,15 @@
 #include "JSHTMLTableCaptionElement.h"
 #include "JSHTMLTableSectionElement.h"
 #include "KURL.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableElement);
 
 /* Hash table */
 
@@ -93,13 +89,13 @@ public:
     JSHTMLTableElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLTableElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLTableElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLTableElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -136,9 +132,9 @@ static const HashTable JSHTMLTableElementPrototypeTable =
 
 const ClassInfo JSHTMLTableElementPrototype::s_info = { "HTMLTableElementPrototype", 0, &JSHTMLTableElementPrototypeTable, 0 };
 
-JSObject* JSHTMLTableElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLTableElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLTableElement>(exec);
+    return getDOMPrototype<JSHTMLTableElement>(exec, globalObject);
 }
 
 bool JSHTMLTableElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -153,9 +149,9 @@ JSHTMLTableElement::JSHTMLTableElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLTableElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLTableElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLTableElementPrototype(JSHTMLTableElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLTableElementPrototype(JSHTMLTableElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLTableElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -163,100 +159,114 @@ bool JSHTMLTableElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLTableElement, Base>(exec, &JSHTMLTableElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLTableElementCaption(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementCaption(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->caption()));
 }
 
-JSValuePtr jsHTMLTableElementTHead(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementTHead(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->tHead()));
 }
 
-JSValuePtr jsHTMLTableElementTFoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementTFoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->tFoot()));
 }
 
-JSValuePtr jsHTMLTableElementRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->rows()));
 }
 
-JSValuePtr jsHTMLTableElementTBodies(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementTBodies(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->tBodies()));
 }
 
-JSValuePtr jsHTMLTableElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLTableElementBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->bgColor());
 }
 
-JSValuePtr jsHTMLTableElementBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementBorder(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->border());
 }
 
-JSValuePtr jsHTMLTableElementCellPadding(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementCellPadding(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->cellPadding());
 }
 
-JSValuePtr jsHTMLTableElementCellSpacing(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementCellSpacing(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->cellSpacing());
 }
 
-JSValuePtr jsHTMLTableElementFrame(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementFrame(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->frame());
 }
 
-JSValuePtr jsHTMLTableElementRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->rules());
 }
 
-JSValuePtr jsHTMLTableElementSummary(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementSummary(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->summary());
 }
 
-JSValuePtr jsHTMLTableElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->width());
 }
 
-JSValuePtr jsHTMLTableElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLTableElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLTableElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLTableElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLTableElement, Base>(exec, propertyName, value, &JSHTMLTableElementTable, this, slot);
 }
 
-void setJSHTMLTableElementCaption(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementCaption(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -264,7 +274,7 @@ void setJSHTMLTableElementCaption(ExecState* exec, JSObject* thisObject, JSValue
     setDOMException(exec, ec);
 }
 
-void setJSHTMLTableElementTHead(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementTHead(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -272,7 +282,7 @@ void setJSHTMLTableElementTHead(ExecState* exec, JSObject* thisObject, JSValuePt
     setDOMException(exec, ec);
 }
 
-void setJSHTMLTableElementTFoot(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementTFoot(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -280,80 +290,82 @@ void setJSHTMLTableElementTFoot(ExecState* exec, JSObject* thisObject, JSValuePt
     setDOMException(exec, ec);
 }
 
-void setJSHTMLTableElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableElementBgColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementBgColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     imp->setBgColor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableElementBorder(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementBorder(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     imp->setBorder(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableElementCellPadding(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementCellPadding(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     imp->setCellPadding(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableElementCellSpacing(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementCellSpacing(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     imp->setCellSpacing(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableElementFrame(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementFrame(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     imp->setFrame(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableElementRules(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementRules(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     imp->setRules(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableElementSummary(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementSummary(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     imp->setSummary(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(static_cast<JSHTMLTableElement*>(thisObject)->impl());
     imp->setWidth(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLTableElement::getConstructor(ExecState* exec)
+JSValue JSHTMLTableElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLTableElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLTableElementPrototypeFunctionCreateTHead(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionCreateTHead(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createTHead()));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createTHead()));
     return result;
 }
 
-JSValuePtr jsHTMLTableElementPrototypeFunctionDeleteTHead(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteTHead(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
@@ -362,21 +374,23 @@ JSValuePtr jsHTMLTableElementPrototypeFunctionDeleteTHead(ExecState* exec, JSObj
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLTableElementPrototypeFunctionCreateTFoot(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionCreateTFoot(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createTFoot()));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createTFoot()));
     return result;
 }
 
-JSValuePtr jsHTMLTableElementPrototypeFunctionDeleteTFoot(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteTFoot(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
@@ -385,21 +399,23 @@ JSValuePtr jsHTMLTableElementPrototypeFunctionDeleteTFoot(ExecState* exec, JSObj
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLTableElementPrototypeFunctionCreateCaption(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionCreateCaption(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createCaption()));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createCaption()));
     return result;
 }
 
-JSValuePtr jsHTMLTableElementPrototypeFunctionDeleteCaption(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteCaption(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
@@ -408,29 +424,31 @@ JSValuePtr jsHTMLTableElementPrototypeFunctionDeleteCaption(ExecState* exec, JSO
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLTableElementPrototypeFunctionInsertRow(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionInsertRow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    int index = args.at(exec, 0)->toInt32(exec);
+    int index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->insertRow(index, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->insertRow(index, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsHTMLTableElementPrototypeFunctionDeleteRow(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteRow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableElement* castedThisObj = static_cast<JSHTMLTableElement*>(asObject(thisValue));
     HTMLTableElement* imp = static_cast<HTMLTableElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    int index = args.at(exec, 0)->toInt32(exec);
+    int index = args.at(0).toInt32(exec);
 
     imp->deleteRow(index, ec);
     setDOMException(exec, ec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h
index a246801..234d812 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableElement.h
@@ -31,28 +31,29 @@ class JSHTMLTableElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLTableElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLTableElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLTableElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -61,43 +62,43 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLTableElementPrototypeFunctionCreateTHead(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLTableElementPrototypeFunctionDeleteTHead(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLTableElementPrototypeFunctionCreateTFoot(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLTableElementPrototypeFunctionDeleteTFoot(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLTableElementPrototypeFunctionCreateCaption(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLTableElementPrototypeFunctionDeleteCaption(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLTableElementPrototypeFunctionInsertRow(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLTableElementPrototypeFunctionDeleteRow(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionCreateTHead(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteTHead(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionCreateTFoot(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteTFoot(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionCreateCaption(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteCaption(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionInsertRow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableElementPrototypeFunctionDeleteRow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLTableElementCaption(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementCaption(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementTHead(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementTHead(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementTFoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementTFoot(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLTableElementTBodies(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLTableElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementCellPadding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementCellPadding(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementCellSpacing(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementCellSpacing(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementFrame(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementFrame(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementRules(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementSummary(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementSummary(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableElementCaption(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementCaption(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementTHead(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementTHead(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementTFoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementTFoot(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableElementTBodies(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementBorder(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementBorder(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementCellPadding(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementCellPadding(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementCellSpacing(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementCellSpacing(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementFrame(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementFrame(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementRules(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementSummary(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementSummary(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp
index 541036c..c384613 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.cpp
@@ -19,27 +19,24 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLTableRowElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLCollection.h"
 #include "HTMLElement.h"
 #include "HTMLTableRowElement.h"
 #include "JSHTMLCollection.h"
 #include "JSHTMLElement.h"
 #include "KURL.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableRowElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableRowElement);
 
 /* Hash table */
 
@@ -83,13 +80,13 @@ public:
     JSHTMLTableRowElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLTableRowElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLTableRowElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLTableRowElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -120,9 +117,9 @@ static const HashTable JSHTMLTableRowElementPrototypeTable =
 
 const ClassInfo JSHTMLTableRowElementPrototype::s_info = { "HTMLTableRowElementPrototype", 0, &JSHTMLTableRowElementPrototypeTable, 0 };
 
-JSObject* JSHTMLTableRowElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLTableRowElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLTableRowElement>(exec);
+    return getDOMPrototype<JSHTMLTableRowElement>(exec, globalObject);
 }
 
 bool JSHTMLTableRowElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -137,9 +134,9 @@ JSHTMLTableRowElement::JSHTMLTableRowElement(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSHTMLTableRowElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLTableRowElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLTableRowElementPrototype(JSHTMLTableRowElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLTableRowElementPrototype(JSHTMLTableRowElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLTableRowElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -147,121 +144,131 @@ bool JSHTMLTableRowElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSHTMLTableRowElement, Base>(exec, &JSHTMLTableRowElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLTableRowElementRowIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementRowIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->rowIndex());
 }
 
-JSValuePtr jsHTMLTableRowElementSectionRowIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementSectionRowIndex(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->sectionRowIndex());
 }
 
-JSValuePtr jsHTMLTableRowElementCells(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementCells(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->cells()));
 }
 
-JSValuePtr jsHTMLTableRowElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLTableRowElementBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementBgColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->bgColor());
 }
 
-JSValuePtr jsHTMLTableRowElementCh(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementCh(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->ch());
 }
 
-JSValuePtr jsHTMLTableRowElementChOff(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementChOff(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->chOff());
 }
 
-JSValuePtr jsHTMLTableRowElementVAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementVAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->vAlign());
 }
 
-JSValuePtr jsHTMLTableRowElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableRowElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLTableRowElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLTableRowElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLTableRowElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLTableRowElement, Base>(exec, propertyName, value, &JSHTMLTableRowElementTable, this, slot);
 }
 
-void setJSHTMLTableRowElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableRowElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableRowElementBgColor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableRowElementBgColor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(thisObject)->impl());
     imp->setBgColor(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableRowElementCh(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableRowElementCh(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(thisObject)->impl());
     imp->setCh(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableRowElementChOff(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableRowElementChOff(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(thisObject)->impl());
     imp->setChOff(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableRowElementVAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableRowElementVAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(static_cast<JSHTMLTableRowElement*>(thisObject)->impl());
     imp->setVAlign(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLTableRowElement::getConstructor(ExecState* exec)
+JSValue JSHTMLTableRowElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLTableRowElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLTableRowElementPrototypeFunctionInsertCell(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableRowElementPrototypeFunctionInsertCell(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableRowElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableRowElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableRowElement* castedThisObj = static_cast<JSHTMLTableRowElement*>(asObject(thisValue));
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    int index = args.at(exec, 0)->toInt32(exec);
+    int index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->insertCell(index, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->insertCell(index, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsHTMLTableRowElementPrototypeFunctionDeleteCell(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableRowElementPrototypeFunctionDeleteCell(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableRowElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableRowElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableRowElement* castedThisObj = static_cast<JSHTMLTableRowElement*>(asObject(thisValue));
     HTMLTableRowElement* imp = static_cast<HTMLTableRowElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    int index = args.at(exec, 0)->toInt32(exec);
+    int index = args.at(0).toInt32(exec);
 
     imp->deleteCell(index, ec);
     setDOMException(exec, ec);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h
index 65219c5..e3e93bc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableRowElement.h
@@ -31,28 +31,29 @@ class JSHTMLTableRowElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLTableRowElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLTableRowElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLTableRowElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -61,24 +62,24 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLTableRowElementPrototypeFunctionInsertCell(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLTableRowElementPrototypeFunctionDeleteCell(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableRowElementPrototypeFunctionInsertCell(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableRowElementPrototypeFunctionDeleteCell(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLTableRowElementRowIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLTableRowElementSectionRowIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLTableRowElementCells(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLTableRowElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableRowElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableRowElementBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableRowElementBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableRowElementCh(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableRowElementCh(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableRowElementChOff(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableRowElementChOff(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableRowElementVAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableRowElementVAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableRowElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableRowElementRowIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableRowElementSectionRowIndex(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableRowElementCells(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableRowElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableRowElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableRowElementBgColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableRowElementBgColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableRowElementCh(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableRowElementCh(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableRowElementChOff(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableRowElementChOff(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableRowElementVAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableRowElementVAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableRowElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp
index 97fad79..8e8ce54 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.cpp
@@ -19,27 +19,23 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLTableSectionElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLCollection.h"
 #include "HTMLElement.h"
 #include "HTMLTableSectionElement.h"
 #include "JSHTMLCollection.h"
 #include "JSHTMLElement.h"
 #include "KURL.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableSectionElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLTableSectionElement);
 
 /* Hash table */
 
@@ -80,13 +76,13 @@ public:
     JSHTMLTableSectionElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLTableSectionElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLTableSectionElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLTableSectionElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -117,9 +113,9 @@ static const HashTable JSHTMLTableSectionElementPrototypeTable =
 
 const ClassInfo JSHTMLTableSectionElementPrototype::s_info = { "HTMLTableSectionElementPrototype", 0, &JSHTMLTableSectionElementPrototypeTable, 0 };
 
-JSObject* JSHTMLTableSectionElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLTableSectionElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLTableSectionElement>(exec);
+    return getDOMPrototype<JSHTMLTableSectionElement>(exec, globalObject);
 }
 
 bool JSHTMLTableSectionElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -134,9 +130,9 @@ JSHTMLTableSectionElement::JSHTMLTableSectionElement(PassRefPtr<Structure> struc
 {
 }
 
-JSObject* JSHTMLTableSectionElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLTableSectionElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLTableSectionElementPrototype(JSHTMLTableSectionElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLTableSectionElementPrototype(JSHTMLTableSectionElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLTableSectionElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -144,106 +140,113 @@ bool JSHTMLTableSectionElement::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSHTMLTableSectionElement, Base>(exec, &JSHTMLTableSectionElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLTableSectionElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableSectionElementAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(static_cast<JSHTMLTableSectionElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->align());
 }
 
-JSValuePtr jsHTMLTableSectionElementCh(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableSectionElementCh(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(static_cast<JSHTMLTableSectionElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->ch());
 }
 
-JSValuePtr jsHTMLTableSectionElementChOff(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableSectionElementChOff(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(static_cast<JSHTMLTableSectionElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->chOff());
 }
 
-JSValuePtr jsHTMLTableSectionElementVAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableSectionElementVAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(static_cast<JSHTMLTableSectionElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->vAlign());
 }
 
-JSValuePtr jsHTMLTableSectionElementRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableSectionElementRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(static_cast<JSHTMLTableSectionElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->rows()));
 }
 
-JSValuePtr jsHTMLTableSectionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTableSectionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLTableSectionElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLTableSectionElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLTableSectionElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLTableSectionElement, Base>(exec, propertyName, value, &JSHTMLTableSectionElementTable, this, slot);
 }
 
-void setJSHTMLTableSectionElementAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableSectionElementAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(static_cast<JSHTMLTableSectionElement*>(thisObject)->impl());
     imp->setAlign(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableSectionElementCh(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableSectionElementCh(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(static_cast<JSHTMLTableSectionElement*>(thisObject)->impl());
     imp->setCh(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableSectionElementChOff(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableSectionElementChOff(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(static_cast<JSHTMLTableSectionElement*>(thisObject)->impl());
     imp->setChOff(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTableSectionElementVAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTableSectionElementVAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(static_cast<JSHTMLTableSectionElement*>(thisObject)->impl());
     imp->setVAlign(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLTableSectionElement::getConstructor(ExecState* exec)
+JSValue JSHTMLTableSectionElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLTableSectionElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLTableSectionElementPrototypeFunctionInsertRow(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableSectionElementPrototypeFunctionInsertRow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableSectionElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableSectionElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableSectionElement* castedThisObj = static_cast<JSHTMLTableSectionElement*>(asObject(thisValue));
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    int index = args.at(exec, 0)->toInt32(exec);
+    int index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->insertRow(index, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->insertRow(index, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsHTMLTableSectionElementPrototypeFunctionDeleteRow(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTableSectionElementPrototypeFunctionDeleteRow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTableSectionElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTableSectionElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTableSectionElement* castedThisObj = static_cast<JSHTMLTableSectionElement*>(asObject(thisValue));
     HTMLTableSectionElement* imp = static_cast<HTMLTableSectionElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    int index = args.at(exec, 0)->toInt32(exec);
+    int index = args.at(0).toInt32(exec);
 
     imp->deleteRow(index, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-HTMLTableSectionElement* toHTMLTableSectionElement(JSC::JSValuePtr value)
+HTMLTableSectionElement* toHTMLTableSectionElement(JSC::JSValue value)
 {
-    return value->isObject(&JSHTMLTableSectionElement::s_info) ? static_cast<JSHTMLTableSectionElement*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSHTMLTableSectionElement::s_info) ? static_cast<JSHTMLTableSectionElement*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h
index 5fef3e9..672165f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTableSectionElement.h
@@ -21,8 +21,9 @@
 #ifndef JSHTMLTableSectionElement_h
 #define JSHTMLTableSectionElement_h
 
-#include "JSHTMLElement.h"
 #include "HTMLTableSectionElement.h"
+#include "JSHTMLElement.h"
+
 namespace WebCore {
 
 class HTMLTableSectionElement;
@@ -31,33 +32,34 @@ class JSHTMLTableSectionElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLTableSectionElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLTableSectionElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     HTMLTableSectionElement* impl() const
     {
         return static_cast<HTMLTableSectionElement*>(Base::impl());
     }
 };
 
-HTMLTableSectionElement* toHTMLTableSectionElement(JSC::JSValuePtr);
+HTMLTableSectionElement* toHTMLTableSectionElement(JSC::JSValue);
 
 class JSHTMLTableSectionElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -66,20 +68,20 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLTableSectionElementPrototypeFunctionInsertRow(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLTableSectionElementPrototypeFunctionDeleteRow(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableSectionElementPrototypeFunctionInsertRow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTableSectionElementPrototypeFunctionDeleteRow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLTableSectionElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableSectionElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableSectionElementCh(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableSectionElementCh(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableSectionElementChOff(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableSectionElementChOff(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableSectionElementVAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTableSectionElementVAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTableSectionElementRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLTableSectionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableSectionElementAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableSectionElementAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableSectionElementCh(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableSectionElementCh(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableSectionElementChOff(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableSectionElementChOff(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableSectionElementVAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTableSectionElementVAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTableSectionElementRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTableSectionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp
index 3bb2572..6d845f9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.cpp
@@ -19,25 +19,22 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLTextAreaElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLFormElement.h"
 #include "HTMLTextAreaElement.h"
 #include "JSHTMLFormElement.h"
 #include "KURL.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLTextAreaElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLTextAreaElement);
 
 /* Hash table */
 
@@ -87,13 +84,13 @@ public:
     JSHTMLTextAreaElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLTextAreaElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLTextAreaElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLTextAreaElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -124,9 +121,9 @@ static const HashTable JSHTMLTextAreaElementPrototypeTable =
 
 const ClassInfo JSHTMLTextAreaElementPrototype::s_info = { "HTMLTextAreaElementPrototype", 0, &JSHTMLTextAreaElementPrototypeTable, 0 };
 
-JSObject* JSHTMLTextAreaElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLTextAreaElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLTextAreaElement>(exec);
+    return getDOMPrototype<JSHTMLTextAreaElement>(exec, globalObject);
 }
 
 bool JSHTMLTextAreaElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -141,9 +138,9 @@ JSHTMLTextAreaElement::JSHTMLTextAreaElement(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSHTMLTextAreaElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLTextAreaElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLTextAreaElementPrototype(JSHTMLTextAreaElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLTextAreaElementPrototype(JSHTMLTextAreaElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLTextAreaElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -151,173 +148,188 @@ bool JSHTMLTextAreaElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSHTMLTextAreaElement, Base>(exec, &JSHTMLTextAreaElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLTextAreaElementDefaultValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementDefaultValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->defaultValue());
 }
 
-JSValuePtr jsHTMLTextAreaElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementForm(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->form()));
 }
 
-JSValuePtr jsHTMLTextAreaElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementAccessKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->accessKey());
 }
 
-JSValuePtr jsHTMLTextAreaElementCols(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementCols(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->cols());
 }
 
-JSValuePtr jsHTMLTextAreaElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->disabled());
 }
 
-JSValuePtr jsHTMLTextAreaElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementAutofocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->autofocus());
 }
 
-JSValuePtr jsHTMLTextAreaElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsHTMLTextAreaElementReadOnly(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementReadOnly(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->readOnly());
 }
 
-JSValuePtr jsHTMLTextAreaElementRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->rows());
 }
 
-JSValuePtr jsHTMLTextAreaElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLTextAreaElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->value());
 }
 
-JSValuePtr jsHTMLTextAreaElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementWillValidate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->willValidate());
 }
 
-JSValuePtr jsHTMLTextAreaElementSelectionStart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementSelectionStart(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->selectionStart());
 }
 
-JSValuePtr jsHTMLTextAreaElementSelectionEnd(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementSelectionEnd(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->selectionEnd());
 }
 
-JSValuePtr jsHTMLTextAreaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTextAreaElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLTextAreaElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLTextAreaElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLTextAreaElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLTextAreaElement, Base>(exec, propertyName, value, &JSHTMLTextAreaElementTable, this, slot);
 }
 
-void setJSHTMLTextAreaElementDefaultValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTextAreaElementDefaultValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
     imp->setDefaultValue(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTextAreaElementAccessKey(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTextAreaElementAccessKey(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
     imp->setAccessKey(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTextAreaElementCols(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTextAreaElementCols(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
-    imp->setCols(value->toInt32(exec));
+    imp->setCols(value.toInt32(exec));
 }
 
-void setJSHTMLTextAreaElementDisabled(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTextAreaElementDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
-    imp->setDisabled(value->toBoolean(exec));
+    imp->setDisabled(value.toBoolean(exec));
 }
 
-void setJSHTMLTextAreaElementAutofocus(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTextAreaElementAutofocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
-    imp->setAutofocus(value->toBoolean(exec));
+    imp->setAutofocus(value.toBoolean(exec));
 }
 
-void setJSHTMLTextAreaElementName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTextAreaElementName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTextAreaElementReadOnly(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTextAreaElementReadOnly(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
-    imp->setReadOnly(value->toBoolean(exec));
+    imp->setReadOnly(value.toBoolean(exec));
 }
 
-void setJSHTMLTextAreaElementRows(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTextAreaElementRows(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
-    imp->setRows(value->toInt32(exec));
+    imp->setRows(value.toInt32(exec));
 }
 
-void setJSHTMLTextAreaElementValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTextAreaElementValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
     imp->setValue(valueToStringWithNullCheck(exec, value));
 }
 
-void setJSHTMLTextAreaElementSelectionStart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTextAreaElementSelectionStart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
-    imp->setSelectionStart(value->toInt32(exec));
+    imp->setSelectionStart(value.toInt32(exec));
 }
 
-void setJSHTMLTextAreaElementSelectionEnd(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTextAreaElementSelectionEnd(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(static_cast<JSHTMLTextAreaElement*>(thisObject)->impl());
-    imp->setSelectionEnd(value->toInt32(exec));
+    imp->setSelectionEnd(value.toInt32(exec));
 }
 
-JSValuePtr JSHTMLTextAreaElement::getConstructor(ExecState* exec)
+JSValue JSHTMLTextAreaElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLTextAreaElementConstructor>(exec);
 }
 
-JSValuePtr jsHTMLTextAreaElementPrototypeFunctionSelect(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTextAreaElementPrototypeFunctionSelect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTextAreaElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTextAreaElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTextAreaElement* castedThisObj = static_cast<JSHTMLTextAreaElement*>(asObject(thisValue));
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThisObj->impl());
@@ -326,14 +338,15 @@ JSValuePtr jsHTMLTextAreaElementPrototypeFunctionSelect(ExecState* exec, JSObjec
     return jsUndefined();
 }
 
-JSValuePtr jsHTMLTextAreaElementPrototypeFunctionSetSelectionRange(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHTMLTextAreaElementPrototypeFunctionSetSelectionRange(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHTMLTextAreaElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHTMLTextAreaElement::s_info))
         return throwError(exec, TypeError);
     JSHTMLTextAreaElement* castedThisObj = static_cast<JSHTMLTextAreaElement*>(asObject(thisValue));
     HTMLTextAreaElement* imp = static_cast<HTMLTextAreaElement*>(castedThisObj->impl());
-    int start = args.at(exec, 0)->toInt32(exec);
-    int end = args.at(exec, 1)->toInt32(exec);
+    int start = args.at(0).toInt32(exec);
+    int end = args.at(1).toInt32(exec);
 
     imp->setSelectionRange(start, end);
     return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h
index d50c322..d248975 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTextAreaElement.h
@@ -31,28 +31,29 @@ class JSHTMLTextAreaElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLTextAreaElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLTextAreaElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLTextAreaElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -61,36 +62,36 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHTMLTextAreaElementPrototypeFunctionSelect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHTMLTextAreaElementPrototypeFunctionSetSelectionRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTextAreaElementPrototypeFunctionSelect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHTMLTextAreaElementPrototypeFunctionSetSelectionRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHTMLTextAreaElementDefaultValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTextAreaElementDefaultValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTextAreaElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLTextAreaElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTextAreaElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTextAreaElementCols(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTextAreaElementCols(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTextAreaElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTextAreaElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTextAreaElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTextAreaElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTextAreaElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTextAreaElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTextAreaElementReadOnly(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTextAreaElementReadOnly(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTextAreaElementRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTextAreaElementRows(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTextAreaElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLTextAreaElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTextAreaElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTextAreaElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLTextAreaElementSelectionStart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTextAreaElementSelectionStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTextAreaElementSelectionEnd(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTextAreaElementSelectionEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTextAreaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTextAreaElementDefaultValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementDefaultValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementForm(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTextAreaElementAccessKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementAccessKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementCols(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementCols(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementAutofocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementAutofocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementReadOnly(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementReadOnly(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementRows(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTextAreaElementValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementWillValidate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTextAreaElementSelectionStart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementSelectionStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementSelectionEnd(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTextAreaElementSelectionEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTextAreaElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp
index b5b80aa..82a61ad 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.cpp
@@ -19,22 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLTitleElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLTitleElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLTitleElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLTitleElement);
 
 /* Hash table */
 
@@ -71,13 +67,13 @@ public:
     JSHTMLTitleElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLTitleElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLTitleElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLTitleElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +102,9 @@ static const HashTable JSHTMLTitleElementPrototypeTable =
 
 const ClassInfo JSHTMLTitleElementPrototype::s_info = { "HTMLTitleElementPrototype", 0, &JSHTMLTitleElementPrototypeTable, 0 };
 
-JSObject* JSHTMLTitleElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLTitleElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLTitleElement>(exec);
+    return getDOMPrototype<JSHTMLTitleElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLTitleElement::s_info = { "HTMLTitleElement", &JSHTMLElement::s_info, &JSHTMLTitleElementTable, 0 };
@@ -118,9 +114,9 @@ JSHTMLTitleElement::JSHTMLTitleElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLTitleElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLTitleElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLTitleElementPrototype(JSHTMLTitleElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLTitleElementPrototype(JSHTMLTitleElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLTitleElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,28 +124,29 @@ bool JSHTMLTitleElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLTitleElement, Base>(exec, &JSHTMLTitleElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLTitleElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTitleElementText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLTitleElement* imp = static_cast<HTMLTitleElement*>(static_cast<JSHTMLTitleElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->text());
 }
 
-JSValuePtr jsHTMLTitleElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLTitleElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLTitleElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLTitleElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLTitleElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLTitleElement, Base>(exec, propertyName, value, &JSHTMLTitleElementTable, this, slot);
 }
 
-void setJSHTMLTitleElementText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLTitleElementText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLTitleElement* imp = static_cast<HTMLTitleElement*>(static_cast<JSHTMLTitleElement*>(thisObject)->impl());
     imp->setText(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLTitleElement::getConstructor(ExecState* exec)
+JSValue JSHTMLTitleElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLTitleElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h
index 3d8f6f6..79e73ae 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLTitleElement.h
@@ -31,24 +31,25 @@ class JSHTMLTitleElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLTitleElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLTitleElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLTitleElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLTitleElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,9 +57,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLTitleElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLTitleElementText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLTitleElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLTitleElementText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLTitleElementText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLTitleElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp
index dccf7e3..522ff7f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.cpp
@@ -19,22 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSHTMLUListElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLUListElement.h"
 #include "KURL.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLUListElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLUListElement);
 
 /* Hash table */
 
@@ -72,13 +68,13 @@ public:
     JSHTMLUListElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLUListElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLUListElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLUListElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -107,9 +103,9 @@ static const HashTable JSHTMLUListElementPrototypeTable =
 
 const ClassInfo JSHTMLUListElementPrototype::s_info = { "HTMLUListElementPrototype", 0, &JSHTMLUListElementPrototypeTable, 0 };
 
-JSObject* JSHTMLUListElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLUListElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLUListElement>(exec);
+    return getDOMPrototype<JSHTMLUListElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLUListElement::s_info = { "HTMLUListElement", &JSHTMLElement::s_info, &JSHTMLUListElementTable, 0 };
@@ -119,9 +115,9 @@ JSHTMLUListElement::JSHTMLUListElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLUListElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLUListElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLUListElementPrototype(JSHTMLUListElementPrototype::createStructure(JSHTMLElementPrototype::self(exec)));
+    return new (exec) JSHTMLUListElementPrototype(JSHTMLUListElementPrototype::createStructure(JSHTMLElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLUListElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -129,40 +125,42 @@ bool JSHTMLUListElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLUListElement, Base>(exec, &JSHTMLUListElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLUListElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLUListElementCompact(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLUListElement* imp = static_cast<HTMLUListElement*>(static_cast<JSHTMLUListElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->compact());
 }
 
-JSValuePtr jsHTMLUListElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLUListElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLUListElement* imp = static_cast<HTMLUListElement*>(static_cast<JSHTMLUListElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsHTMLUListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLUListElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLUListElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLUListElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLUListElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLUListElement, Base>(exec, propertyName, value, &JSHTMLUListElementTable, this, slot);
 }
 
-void setJSHTMLUListElementCompact(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLUListElementCompact(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLUListElement* imp = static_cast<HTMLUListElement*>(static_cast<JSHTMLUListElement*>(thisObject)->impl());
-    imp->setCompact(value->toBoolean(exec));
+    imp->setCompact(value.toBoolean(exec));
 }
 
-void setJSHTMLUListElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLUListElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLUListElement* imp = static_cast<HTMLUListElement*>(static_cast<JSHTMLUListElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLUListElement::getConstructor(ExecState* exec)
+JSValue JSHTMLUListElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLUListElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h
index 0511b34..339b5f0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLUListElement.h
@@ -31,24 +31,25 @@ class JSHTMLUListElement : public JSHTMLElement {
     typedef JSHTMLElement Base;
 public:
     JSHTMLUListElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLUListElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLUListElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLUListElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,11 +57,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLUListElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLUListElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLUListElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLUListElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLUListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLUListElementCompact(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLUListElementCompact(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLUListElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLUListElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLUListElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp
index 9e868e5..c097281 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.cpp
@@ -20,24 +20,21 @@
 
 #include "config.h"
 
-
 #if ENABLE(VIDEO)
 
 #include "JSHTMLVideoElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "HTMLVideoElement.h"
 #include "KURL.h"
-
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHTMLVideoElement)
+ASSERT_CLASS_FITS_IN_CELL(JSHTMLVideoElement);
 
 /* Hash table */
 
@@ -78,13 +75,13 @@ public:
     JSHTMLVideoElementConstructor(ExecState* exec)
         : DOMObject(JSHTMLVideoElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSHTMLVideoElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSHTMLVideoElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -113,9 +110,9 @@ static const HashTable JSHTMLVideoElementPrototypeTable =
 
 const ClassInfo JSHTMLVideoElementPrototype::s_info = { "HTMLVideoElementPrototype", 0, &JSHTMLVideoElementPrototypeTable, 0 };
 
-JSObject* JSHTMLVideoElementPrototype::self(ExecState* exec)
+JSObject* JSHTMLVideoElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHTMLVideoElement>(exec);
+    return getDOMPrototype<JSHTMLVideoElement>(exec, globalObject);
 }
 
 const ClassInfo JSHTMLVideoElement::s_info = { "HTMLVideoElement", &JSHTMLMediaElement::s_info, &JSHTMLVideoElementTable, 0 };
@@ -125,9 +122,9 @@ JSHTMLVideoElement::JSHTMLVideoElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSHTMLVideoElement::createPrototype(ExecState* exec)
+JSObject* JSHTMLVideoElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHTMLVideoElementPrototype(JSHTMLVideoElementPrototype::createStructure(JSHTMLMediaElementPrototype::self(exec)));
+    return new (exec) JSHTMLVideoElementPrototype(JSHTMLVideoElementPrototype::createStructure(JSHTMLMediaElementPrototype::self(exec, globalObject)));
 }
 
 bool JSHTMLVideoElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -135,64 +132,69 @@ bool JSHTMLVideoElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSHTMLVideoElement, Base>(exec, &JSHTMLVideoElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHTMLVideoElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLVideoElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->width());
 }
 
-JSValuePtr jsHTMLVideoElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLVideoElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->height());
 }
 
-JSValuePtr jsHTMLVideoElementVideoWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLVideoElementVideoWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->videoWidth());
 }
 
-JSValuePtr jsHTMLVideoElementVideoHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLVideoElementVideoHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->videoHeight());
 }
 
-JSValuePtr jsHTMLVideoElementPoster(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLVideoElementPoster(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->poster());
 }
 
-JSValuePtr jsHTMLVideoElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHTMLVideoElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSHTMLVideoElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSHTMLVideoElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHTMLVideoElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSHTMLVideoElement, Base>(exec, propertyName, value, &JSHTMLVideoElementTable, this, slot);
 }
 
-void setJSHTMLVideoElementWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLVideoElementWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(thisObject)->impl());
-    imp->setWidth(value->toInt32(exec));
+    imp->setWidth(value.toInt32(exec));
 }
 
-void setJSHTMLVideoElementHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLVideoElementHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(thisObject)->impl());
-    imp->setHeight(value->toInt32(exec));
+    imp->setHeight(value.toInt32(exec));
 }
 
-void setJSHTMLVideoElementPoster(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSHTMLVideoElementPoster(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     HTMLVideoElement* imp = static_cast<HTMLVideoElement*>(static_cast<JSHTMLVideoElement*>(thisObject)->impl());
     imp->setPoster(valueToStringWithNullCheck(exec, value));
 }
 
-JSValuePtr JSHTMLVideoElement::getConstructor(ExecState* exec)
+JSValue JSHTMLVideoElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSHTMLVideoElementConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h
index 5dc28ef..3e3b8c2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHTMLVideoElement.h
@@ -21,7 +21,6 @@
 #ifndef JSHTMLVideoElement_h
 #define JSHTMLVideoElement_h
 
-
 #if ENABLE(VIDEO)
 
 #include "JSHTMLMediaElement.h"
@@ -34,24 +33,25 @@ class JSHTMLVideoElement : public JSHTMLMediaElement {
     typedef JSHTMLMediaElement Base;
 public:
     JSHTMLVideoElement(PassRefPtr<JSC::Structure>, PassRefPtr<HTMLVideoElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSHTMLVideoElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSHTMLVideoElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -59,15 +59,15 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsHTMLVideoElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLVideoElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLVideoElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLVideoElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLVideoElementVideoWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLVideoElementVideoHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsHTMLVideoElementPoster(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSHTMLVideoElementPoster(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsHTMLVideoElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLVideoElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLVideoElementWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLVideoElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLVideoElementHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLVideoElementVideoWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLVideoElementVideoHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHTMLVideoElementPoster(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSHTMLVideoElementPoster(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsHTMLVideoElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp b/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp
index 45b5e3a..55e22af 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSHistory.cpp
@@ -19,22 +19,19 @@
 */
 
 #include "config.h"
-
 #include "JSHistory.h"
 
-#include <wtf/GetPtr.h>
-
 #include "History.h"
 #include "JSHistoryCustom.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSHistory)
+ASSERT_CLASS_FITS_IN_CELL(JSHistory);
 
 /* Hash table */
 
@@ -70,9 +67,9 @@ static const HashTable JSHistoryPrototypeTable =
 
 const ClassInfo JSHistoryPrototype::s_info = { "HistoryPrototype", 0, &JSHistoryPrototypeTable, 0 };
 
-JSObject* JSHistoryPrototype::self(ExecState* exec)
+JSObject* JSHistoryPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSHistory>(exec);
+    return getDOMPrototype<JSHistory>(exec, globalObject);
 }
 
 bool JSHistoryPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -91,44 +88,38 @@ JSHistory::JSHistory(PassRefPtr<Structure> structure, PassRefPtr<History> impl)
 JSHistory::~JSHistory()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSHistory::createPrototype(ExecState* exec)
+JSObject* JSHistory::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSHistoryPrototype(JSHistoryPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSHistoryPrototype(JSHistoryPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSHistory::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    if (customGetOwnPropertySlot(exec, propertyName, slot))
+    if (getOwnPropertySlotDelegate(exec, propertyName, slot))
         return true;
     return getStaticValueSlot<JSHistory, Base>(exec, &JSHistoryTable, this, propertyName, slot);
 }
 
-JSValuePtr jsHistoryLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsHistoryLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     History* imp = static_cast<History*>(static_cast<JSHistory*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-void JSHistory::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSHistory::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    if (customPut(exec, propertyName, value, slot))
+    if (putDelegate(exec, propertyName, value, slot))
         return;
     Base::put(exec, propertyName, value, slot);
 }
 
-void JSHistory::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
-{
-    if (customGetPropertyNames(exec, propertyNames))
-        return;
-     Base::getPropertyNames(exec, propertyNames);
-}
-
-JSValuePtr jsHistoryPrototypeFunctionBack(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionBack(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHistory::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHistory::s_info))
         return throwError(exec, TypeError);
     JSHistory* castedThisObj = static_cast<JSHistory*>(asObject(thisValue));
     History* imp = static_cast<History*>(castedThisObj->impl());
@@ -137,9 +128,10 @@ JSValuePtr jsHistoryPrototypeFunctionBack(ExecState* exec, JSObject*, JSValuePtr
     return jsUndefined();
 }
 
-JSValuePtr jsHistoryPrototypeFunctionForward(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionForward(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHistory::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHistory::s_info))
         return throwError(exec, TypeError);
     JSHistory* castedThisObj = static_cast<JSHistory*>(asObject(thisValue));
     History* imp = static_cast<History*>(castedThisObj->impl());
@@ -148,25 +140,26 @@ JSValuePtr jsHistoryPrototypeFunctionForward(ExecState* exec, JSObject*, JSValue
     return jsUndefined();
 }
 
-JSValuePtr jsHistoryPrototypeFunctionGo(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionGo(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSHistory::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSHistory::s_info))
         return throwError(exec, TypeError);
     JSHistory* castedThisObj = static_cast<JSHistory*>(asObject(thisValue));
     History* imp = static_cast<History*>(castedThisObj->impl());
-    int distance = args.at(exec, 0)->toInt32(exec);
+    int distance = args.at(0).toInt32(exec);
 
     imp->go(distance);
     return jsUndefined();
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, History* object)
+JSC::JSValue toJS(JSC::ExecState* exec, History* object)
 {
     return getDOMObjectWrapper<JSHistory>(exec, object);
 }
-History* toHistory(JSC::JSValuePtr value)
+History* toHistory(JSC::JSValue value)
 {
-    return value->isObject(&JSHistory::s_info) ? static_cast<JSHistory*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSHistory::s_info) ? static_cast<JSHistory*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSHistory.h b/src/3rdparty/webkit/WebCore/generated/JSHistory.h
index 6ff263d..e81255a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSHistory.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSHistory.h
@@ -34,38 +34,38 @@ class JSHistory : public DOMObject {
 public:
     JSHistory(PassRefPtr<JSC::Structure>, PassRefPtr<History>);
     virtual ~JSHistory();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    bool customGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    bool customGetPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
     History* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<History> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, History*);
-History* toHistory(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, History*);
+History* toHistory(JSC::JSValue);
 
 class JSHistoryPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -74,12 +74,12 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsHistoryPrototypeFunctionBack(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHistoryPrototypeFunctionForward(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsHistoryPrototypeFunctionGo(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionBack(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionForward(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsHistoryPrototypeFunctionGo(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsHistoryLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsHistoryLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp b/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
index a92adaa..a965375 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSImageData.cpp
@@ -19,20 +19,17 @@
 */
 
 #include "config.h"
-
 #include "JSImageData.h"
 
-#include <wtf/GetPtr.h>
-
 #include "ImageData.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSImageData)
+ASSERT_CLASS_FITS_IN_CELL(JSImageData);
 
 /* Hash table */
 
@@ -70,13 +67,13 @@ public:
     JSImageDataConstructor(ExecState* exec)
         : DOMObject(JSImageDataConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSImageDataPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSImageDataPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -105,9 +102,9 @@ static const HashTable JSImageDataPrototypeTable =
 
 const ClassInfo JSImageDataPrototype::s_info = { "ImageDataPrototype", 0, &JSImageDataPrototypeTable, 0 };
 
-JSObject* JSImageDataPrototype::self(ExecState* exec)
+JSObject* JSImageDataPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSImageData>(exec);
+    return getDOMPrototype<JSImageData>(exec, globalObject);
 }
 
 const ClassInfo JSImageData::s_info = { "ImageData", 0, &JSImageDataTable, 0 };
@@ -121,12 +118,11 @@ JSImageData::JSImageData(PassRefPtr<Structure> structure, PassRefPtr<ImageData>
 JSImageData::~JSImageData()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSImageData::createPrototype(ExecState* exec)
+JSObject* JSImageData::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSImageDataPrototype(JSImageDataPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSImageDataPrototype(JSImageDataPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSImageData::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -134,30 +130,32 @@ bool JSImageData::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSImageData, Base>(exec, &JSImageDataTable, this, propertyName, slot);
 }
 
-JSValuePtr jsImageDataWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsImageDataWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     ImageData* imp = static_cast<ImageData*>(static_cast<JSImageData*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->width());
 }
 
-JSValuePtr jsImageDataHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsImageDataHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     ImageData* imp = static_cast<ImageData*>(static_cast<JSImageData*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->height());
 }
 
-JSValuePtr jsImageDataConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsImageDataConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSImageData*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSImageData::getConstructor(ExecState* exec)
+JSValue JSImageData::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSImageDataConstructor>(exec);
 }
 
-ImageData* toImageData(JSC::JSValuePtr value)
+ImageData* toImageData(JSC::JSValue value)
 {
-    return value->isObject(&JSImageData::s_info) ? static_cast<JSImageData*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSImageData::s_info) ? static_cast<JSImageData*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSImageData.h b/src/3rdparty/webkit/WebCore/generated/JSImageData.h
index a9e778a..12a9f01 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSImageData.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSImageData.h
@@ -34,29 +34,30 @@ class JSImageData : public DOMObject {
 public:
     JSImageData(PassRefPtr<JSC::Structure>, PassRefPtr<ImageData>);
     virtual ~JSImageData();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     ImageData* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<ImageData> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, ImageData*);
-ImageData* toImageData(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, ImageData*);
+ImageData* toImageData(JSC::JSValue);
 
 class JSImageDataPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSImageDataPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -64,9 +65,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsImageDataWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsImageDataHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsImageDataConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsImageDataWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsImageDataHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsImageDataConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSInspectorController.cpp b/src/3rdparty/webkit/WebCore/generated/JSInspectorController.cpp
new file mode 100644
index 0000000..a0dac40
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSInspectorController.cpp
@@ -0,0 +1,769 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSInspectorController.h"
+
+#include "DOMWindow.h"
+#include "InspectorController.h"
+#include "JSNode.h"
+#include "KURL.h"
+#include "Node.h"
+#include <runtime/Error.h>
+#include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSInspectorController);
+
+/* Hash table */
+
+static const HashTableValue JSInspectorControllerTableValues[2] =
+{
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsInspectorControllerConstructor, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSInspectorControllerTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSInspectorControllerTableValues, 0 };
+#else
+    { 2, 1, JSInspectorControllerTableValues, 0 };
+#endif
+
+/* Hash table for constructor */
+
+static const HashTableValue JSInspectorControllerConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSInspectorControllerConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSInspectorControllerConstructorTableValues, 0 };
+#else
+    { 1, 0, JSInspectorControllerConstructorTableValues, 0 };
+#endif
+
+class JSInspectorControllerConstructor : public DOMObject {
+public:
+    JSInspectorControllerConstructor(ExecState* exec)
+        : DOMObject(JSInspectorControllerConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    {
+        putDirect(exec->propertyNames().prototype, JSInspectorControllerPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+    }
+};
+
+const ClassInfo JSInspectorControllerConstructor::s_info = { "InspectorControllerConstructor", 0, &JSInspectorControllerConstructorTable, 0 };
+
+bool JSInspectorControllerConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSInspectorControllerConstructor, DOMObject>(exec, &JSInspectorControllerConstructorTable, this, propertyName, slot);
+}
+
+/* Hash table for prototype */
+
+static const HashTableValue JSInspectorControllerPrototypeTableValues[48] =
+{
+    { "hideDOMNodeHighlight", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionHideDOMNodeHighlight, (intptr_t)0 },
+    { "highlightDOMNode", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionHighlightDOMNode, (intptr_t)1 },
+    { "loaded", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionLoaded, (intptr_t)0 },
+    { "windowUnloading", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionWindowUnloading, (intptr_t)0 },
+    { "attach", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionAttach, (intptr_t)0 },
+    { "detach", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionDetach, (intptr_t)0 },
+    { "closeWindow", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionCloseWindow, (intptr_t)0 },
+    { "clearMessages", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionClearMessages, (intptr_t)0 },
+    { "toggleNodeSearch", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionToggleNodeSearch, (intptr_t)0 },
+    { "isWindowVisible", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionIsWindowVisible, (intptr_t)0 },
+    { "searchingForNode", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionSearchingForNode, (intptr_t)0 },
+    { "addResourceSourceToFrame", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionAddResourceSourceToFrame, (intptr_t)2 },
+    { "addSourceToFrame", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionAddSourceToFrame, (intptr_t)3 },
+    { "getResourceDocumentNode", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionGetResourceDocumentNode, (intptr_t)1 },
+    { "search", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionSearch, (intptr_t)2 },
+    { "databaseTableNames", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionDatabaseTableNames, (intptr_t)1 },
+    { "setting", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionSetting, (intptr_t)1 },
+    { "setSetting", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionSetSetting, (intptr_t)2 },
+    { "inspectedWindow", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionInspectedWindow, (intptr_t)0 },
+    { "localizedStringsURL", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionLocalizedStringsURL, (intptr_t)0 },
+    { "hiddenPanels", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionHiddenPanels, (intptr_t)0 },
+    { "platform", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionPlatform, (intptr_t)0 },
+    { "moveByUnrestricted", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionMoveByUnrestricted, (intptr_t)2 },
+    { "setAttachedWindowHeight", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionSetAttachedWindowHeight, (intptr_t)1 },
+    { "wrapCallback", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionWrapCallback, (intptr_t)1 },
+    { "resourceTrackingEnabled", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionResourceTrackingEnabled, (intptr_t)0 },
+    { "enableResourceTracking", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionEnableResourceTracking, (intptr_t)1 },
+    { "disableResourceTracking", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionDisableResourceTracking, (intptr_t)1 },
+    { "enableDebuggerFromFrontend", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionEnableDebuggerFromFrontend, (intptr_t)1 },
+    { "disableDebugger", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionDisableDebugger, (intptr_t)1 },
+    { "pauseInDebugger", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionPauseInDebugger, (intptr_t)0 },
+    { "resumeDebugger", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionResumeDebugger, (intptr_t)0 },
+    { "stepOverStatementInDebugger", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionStepOverStatementInDebugger, (intptr_t)0 },
+    { "stepIntoStatementInDebugger", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionStepIntoStatementInDebugger, (intptr_t)0 },
+    { "stepOutOfFunctionInDebugger", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionStepOutOfFunctionInDebugger, (intptr_t)0 },
+    { "debuggerEnabled", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionDebuggerEnabled, (intptr_t)0 },
+    { "pauseOnExceptions", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionPauseOnExceptions, (intptr_t)0 },
+    { "profilerEnabled", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionProfilerEnabled, (intptr_t)0 },
+    { "startProfiling", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionStartProfiling, (intptr_t)0 },
+    { "stopProfiling", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionStopProfiling, (intptr_t)0 },
+    { "enableProfiler", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionEnableProfiler, (intptr_t)1 },
+    { "disableProfiler", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionDisableProfiler, (intptr_t)1 },
+    { "currentCallFrame", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionCurrentCallFrame, (intptr_t)0 },
+    { "setPauseOnExceptions", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionSetPauseOnExceptions, (intptr_t)1 },
+    { "addBreakpoint", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionAddBreakpoint, (intptr_t)2 },
+    { "removeBreakpoint", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionRemoveBreakpoint, (intptr_t)2 },
+    { "profiles", DontDelete|Function, (intptr_t)jsInspectorControllerPrototypeFunctionProfiles, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSInspectorControllerPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 2047, JSInspectorControllerPrototypeTableValues, 0 };
+#else
+    { 137, 127, JSInspectorControllerPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSInspectorControllerPrototype::s_info = { "InspectorControllerPrototype", 0, &JSInspectorControllerPrototypeTable, 0 };
+
+JSObject* JSInspectorControllerPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSInspectorController>(exec, globalObject);
+}
+
+bool JSInspectorControllerPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSInspectorControllerPrototypeTable, this, propertyName, slot);
+}
+
+const ClassInfo JSInspectorController::s_info = { "InspectorController", 0, &JSInspectorControllerTable, 0 };
+
+JSInspectorController::JSInspectorController(PassRefPtr<Structure> structure, PassRefPtr<InspectorController> impl)
+    : DOMObject(structure)
+    , m_impl(impl)
+{
+}
+
+JSInspectorController::~JSInspectorController()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSInspectorController::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSInspectorControllerPrototype(JSInspectorControllerPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSInspectorController::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSInspectorController, Base>(exec, &JSInspectorControllerTable, this, propertyName, slot);
+}
+
+JSValue jsInspectorControllerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSInspectorController*>(asObject(slot.slotBase()))->getConstructor(exec);
+}
+JSValue JSInspectorController::getConstructor(ExecState* exec)
+{
+    return getDOMConstructor<JSInspectorControllerConstructor>(exec);
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionHideDOMNodeHighlight(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->hideHighlight();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionHighlightDOMNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    return castedThisObj->highlightDOMNode(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionLoaded(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->scriptObjectReady();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionWindowUnloading(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->close();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionAttach(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->attachWindow();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDetach(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->detachWindow();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionCloseWindow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->closeWindow();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionClearMessages(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->clearConsoleMessages();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionToggleNodeSearch(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->toggleSearchForNodeInPage();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionIsWindowVisible(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsBoolean(imp->windowVisible());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSearchingForNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsBoolean(imp->searchingForNodeInPage());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionAddResourceSourceToFrame(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    int identifier = args.at(0).toInt32(exec);
+    Node* frame = toNode(args.at(1));
+
+    imp->addResourceSourceToFrame(identifier, frame);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionAddSourceToFrame(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    const UString& mimeType = args.at(0).toString(exec);
+    const UString& sourceValue = args.at(1).toString(exec);
+    Node* frame = toNode(args.at(2));
+
+
+    JSC::JSValue result = jsBoolean(imp->addSourceToFrame(mimeType, sourceValue, frame));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionGetResourceDocumentNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    return castedThisObj->getResourceDocumentNode(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSearch(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    return castedThisObj->search(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDatabaseTableNames(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    return castedThisObj->databaseTableNames(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSetting(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    return castedThisObj->setting(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSetSetting(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    return castedThisObj->setSetting(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionInspectedWindow(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    return castedThisObj->inspectedWindow(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionLocalizedStringsURL(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsString(exec, imp->localizedStringsURL());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionHiddenPanels(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsString(exec, imp->hiddenPanels());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionPlatform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsString(exec, imp->platform());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionMoveByUnrestricted(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+
+    imp->moveWindowBy(x, y);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSetAttachedWindowHeight(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    unsigned height = args.at(0).toInt32(exec);
+
+    imp->setAttachedWindowHeight(height);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionWrapCallback(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    return castedThisObj->wrapCallback(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionResourceTrackingEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsBoolean(imp->resourceTrackingEnabled());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionEnableResourceTracking(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    bool always = args.at(0).toBoolean(exec);
+
+    imp->enableResourceTracking(always);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDisableResourceTracking(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    bool always = args.at(0).toBoolean(exec);
+
+    imp->disableResourceTracking(always);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionEnableDebuggerFromFrontend(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    bool always = args.at(0).toBoolean(exec);
+
+    imp->enableDebuggerFromFrontend(always);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDisableDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    bool always = args.at(0).toBoolean(exec);
+
+    imp->disableDebugger(always);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionPauseInDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->pauseInDebugger();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionResumeDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->resumeDebugger();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionStepOverStatementInDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->stepOverStatementInDebugger();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionStepIntoStatementInDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->stepIntoStatementInDebugger();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionStepOutOfFunctionInDebugger(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->stepOutOfFunctionInDebugger();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDebuggerEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsBoolean(imp->debuggerEnabled());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionPauseOnExceptions(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsBoolean(imp->pauseOnExceptions());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionProfilerEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsBoolean(imp->profilerEnabled());
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionStartProfiling(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->startUserInitiatedProfiling();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionStopProfiling(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+
+    imp->stopUserInitiatedProfiling();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionEnableProfiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    bool always = args.at(0).toBoolean(exec);
+
+    imp->enableProfiler(always);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDisableProfiler(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    bool always = args.at(0).toBoolean(exec);
+
+    imp->disableProfiler(always);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionCurrentCallFrame(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    return castedThisObj->currentCallFrame(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSetPauseOnExceptions(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    bool pauseOnExceptions = args.at(0).toBoolean(exec);
+
+    imp->setPauseOnExceptions(pauseOnExceptions);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionAddBreakpoint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    const UString& sourceID = args.at(0).toString(exec);
+    unsigned lineNumber = args.at(1).toInt32(exec);
+
+    imp->addBreakpoint(sourceID, lineNumber);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionRemoveBreakpoint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    InspectorController* imp = static_cast<InspectorController*>(castedThisObj->impl());
+    const UString& sourceID = args.at(0).toString(exec);
+    unsigned lineNumber = args.at(1).toInt32(exec);
+
+    imp->removeBreakpoint(sourceID, lineNumber);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionProfiles(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSInspectorController::s_info))
+        return throwError(exec, TypeError);
+    JSInspectorController* castedThisObj = static_cast<JSInspectorController*>(asObject(thisValue));
+    return castedThisObj->profiles(exec, args);
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, InspectorController* object)
+{
+    return getDOMObjectWrapper<JSInspectorController>(exec, object);
+}
+InspectorController* toInspectorController(JSC::JSValue value)
+{
+    return value.isObject(&JSInspectorController::s_info) ? static_cast<JSInspectorController*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSInspectorController.h b/src/3rdparty/webkit/WebCore/generated/JSInspectorController.h
new file mode 100644
index 0000000..3bb1480
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSInspectorController.h
@@ -0,0 +1,138 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSInspectorController_h
+#define JSInspectorController_h
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class InspectorController;
+
+class JSInspectorController : public DOMObject {
+    typedef DOMObject Base;
+public:
+    JSInspectorController(PassRefPtr<JSC::Structure>, PassRefPtr<InspectorController>);
+    virtual ~JSInspectorController();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    static JSC::JSValue getConstructor(JSC::ExecState*);
+
+    // Custom functions
+    JSC::JSValue highlightDOMNode(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getResourceDocumentNode(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue search(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue databaseTableNames(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setting(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setSetting(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue inspectedWindow(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue wrapCallback(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue currentCallFrame(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue profiles(JSC::ExecState*, const JSC::ArgList&);
+    InspectorController* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<InspectorController> m_impl;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, InspectorController*);
+InspectorController* toInspectorController(JSC::JSValue);
+
+class JSInspectorControllerPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+    JSInspectorControllerPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionHideDOMNodeHighlight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionHighlightDOMNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionLoaded(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionWindowUnloading(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionAttach(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDetach(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionCloseWindow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionClearMessages(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionToggleNodeSearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionIsWindowVisible(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSearchingForNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionAddResourceSourceToFrame(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionAddSourceToFrame(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionGetResourceDocumentNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDatabaseTableNames(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSetting(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSetSetting(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionInspectedWindow(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionLocalizedStringsURL(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionHiddenPanels(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionPlatform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionMoveByUnrestricted(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSetAttachedWindowHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionWrapCallback(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionResourceTrackingEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionEnableResourceTracking(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDisableResourceTracking(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionEnableDebuggerFromFrontend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDisableDebugger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionPauseInDebugger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionResumeDebugger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionStepOverStatementInDebugger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionStepIntoStatementInDebugger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionStepOutOfFunctionInDebugger(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDebuggerEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionPauseOnExceptions(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionProfilerEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionStartProfiling(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionStopProfiling(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionEnableProfiler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionDisableProfiler(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionCurrentCallFrame(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionSetPauseOnExceptions(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionAddBreakpoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionRemoveBreakpoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsInspectorControllerPrototypeFunctionProfiles(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsInspectorControllerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp
index 6b60c21..c8a3f3d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.cpp
@@ -20,23 +20,23 @@
 
 #include "config.h"
 
-#include "JSJavaScriptCallFrame.h"
+#if ENABLE(JAVASCRIPT_DEBUGGER)
 
-#include <wtf/GetPtr.h>
+#include "JSJavaScriptCallFrame.h"
 
 #include "JSJavaScriptCallFrame.h"
 #include "JavaScriptCallFrame.h"
 #include "KURL.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSJavaScriptCallFrame)
+ASSERT_CLASS_FITS_IN_CELL(JSJavaScriptCallFrame);
 
 /* Hash table */
 
@@ -76,9 +76,9 @@ static const HashTable JSJavaScriptCallFramePrototypeTable =
 
 const ClassInfo JSJavaScriptCallFramePrototype::s_info = { "JavaScriptCallFramePrototype", 0, &JSJavaScriptCallFramePrototypeTable, 0 };
 
-JSObject* JSJavaScriptCallFramePrototype::self(ExecState* exec)
+JSObject* JSJavaScriptCallFramePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSJavaScriptCallFrame>(exec);
+    return getDOMPrototype<JSJavaScriptCallFrame>(exec, globalObject);
 }
 
 bool JSJavaScriptCallFramePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -97,12 +97,11 @@ JSJavaScriptCallFrame::JSJavaScriptCallFrame(PassRefPtr<Structure> structure, Pa
 JSJavaScriptCallFrame::~JSJavaScriptCallFrame()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSJavaScriptCallFrame::createPrototype(ExecState* exec)
+JSObject* JSJavaScriptCallFrame::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSJavaScriptCallFramePrototype(JSJavaScriptCallFramePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSJavaScriptCallFramePrototype(JSJavaScriptCallFramePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSJavaScriptCallFrame::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -110,60 +109,67 @@ bool JSJavaScriptCallFrame::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSJavaScriptCallFrame, Base>(exec, &JSJavaScriptCallFrameTable, this, propertyName, slot);
 }
 
-JSValuePtr jsJavaScriptCallFrameCaller(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsJavaScriptCallFrameCaller(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     JavaScriptCallFrame* imp = static_cast<JavaScriptCallFrame*>(static_cast<JSJavaScriptCallFrame*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->caller()));
 }
 
-JSValuePtr jsJavaScriptCallFrameSourceID(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsJavaScriptCallFrameSourceID(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     JavaScriptCallFrame* imp = static_cast<JavaScriptCallFrame*>(static_cast<JSJavaScriptCallFrame*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->sourceID());
 }
 
-JSValuePtr jsJavaScriptCallFrameLine(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsJavaScriptCallFrameLine(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     JavaScriptCallFrame* imp = static_cast<JavaScriptCallFrame*>(static_cast<JSJavaScriptCallFrame*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->line());
 }
 
-JSValuePtr jsJavaScriptCallFrameScopeChain(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsJavaScriptCallFrameScopeChain(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSJavaScriptCallFrame*>(asObject(slot.slotBase()))->scopeChain(exec);
 }
 
-JSValuePtr jsJavaScriptCallFrameThisObject(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsJavaScriptCallFrameThisObject(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSJavaScriptCallFrame*>(asObject(slot.slotBase()))->thisObject(exec);
 }
 
-JSValuePtr jsJavaScriptCallFrameFunctionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsJavaScriptCallFrameFunctionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     JavaScriptCallFrame* imp = static_cast<JavaScriptCallFrame*>(static_cast<JSJavaScriptCallFrame*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->functionName());
 }
 
-JSValuePtr jsJavaScriptCallFrameType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsJavaScriptCallFrameType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSJavaScriptCallFrame*>(asObject(slot.slotBase()))->type(exec);
 }
 
-JSValuePtr jsJavaScriptCallFramePrototypeFunctionEvaluate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsJavaScriptCallFramePrototypeFunctionEvaluate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSJavaScriptCallFrame::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSJavaScriptCallFrame::s_info))
         return throwError(exec, TypeError);
     JSJavaScriptCallFrame* castedThisObj = static_cast<JSJavaScriptCallFrame*>(asObject(thisValue));
     return castedThisObj->evaluate(exec, args);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, JavaScriptCallFrame* object)
+JSC::JSValue toJS(JSC::ExecState* exec, JavaScriptCallFrame* object)
 {
     return getDOMObjectWrapper<JSJavaScriptCallFrame>(exec, object);
 }
-JavaScriptCallFrame* toJavaScriptCallFrame(JSC::JSValuePtr value)
+JavaScriptCallFrame* toJavaScriptCallFrame(JSC::JSValue value)
 {
-    return value->isObject(&JSJavaScriptCallFrame::s_info) ? static_cast<JSJavaScriptCallFrame*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSJavaScriptCallFrame::s_info) ? static_cast<JSJavaScriptCallFrame*>(asObject(value))->impl() : 0;
 }
 
 }
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h
index 9f1ca08..166ee60 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSJavaScriptCallFrame.h
@@ -21,6 +21,8 @@
 #ifndef JSJavaScriptCallFrame_h
 #define JSJavaScriptCallFrame_h
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -34,40 +36,41 @@ class JSJavaScriptCallFrame : public DOMObject {
 public:
     JSJavaScriptCallFrame(PassRefPtr<JSC::Structure>, PassRefPtr<JavaScriptCallFrame>);
     virtual ~JSJavaScriptCallFrame();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
 
     // Custom attributes
-    JSC::JSValuePtr scopeChain(JSC::ExecState*) const;
-    JSC::JSValuePtr thisObject(JSC::ExecState*) const;
-    JSC::JSValuePtr type(JSC::ExecState*) const;
+    JSC::JSValue scopeChain(JSC::ExecState*) const;
+    JSC::JSValue thisObject(JSC::ExecState*) const;
+    JSC::JSValue type(JSC::ExecState*) const;
 
     // Custom functions
-    JSC::JSValuePtr evaluate(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue evaluate(JSC::ExecState*, const JSC::ArgList&);
     JavaScriptCallFrame* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<JavaScriptCallFrame> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, JavaScriptCallFrame*);
-JavaScriptCallFrame* toJavaScriptCallFrame(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, JavaScriptCallFrame*);
+JavaScriptCallFrame* toJavaScriptCallFrame(JSC::JSValue);
 
 class JSJavaScriptCallFramePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -76,17 +79,19 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsJavaScriptCallFramePrototypeFunctionEvaluate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsJavaScriptCallFramePrototypeFunctionEvaluate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsJavaScriptCallFrameCaller(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsJavaScriptCallFrameSourceID(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsJavaScriptCallFrameLine(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsJavaScriptCallFrameScopeChain(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsJavaScriptCallFrameThisObject(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsJavaScriptCallFrameFunctionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsJavaScriptCallFrameType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsJavaScriptCallFrameCaller(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsJavaScriptCallFrameSourceID(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsJavaScriptCallFrameLine(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsJavaScriptCallFrameScopeChain(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsJavaScriptCallFrameThisObject(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsJavaScriptCallFrameFunctionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsJavaScriptCallFrameType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp
index 14dea9c..750d1be 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.cpp
@@ -19,24 +19,21 @@
 */
 
 #include "config.h"
-
 #include "JSKeyboardEvent.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSDOMWindow.h"
 #include "KURL.h"
 #include "KeyboardEvent.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSKeyboardEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSKeyboardEvent);
 
 /* Hash table */
 
@@ -79,13 +76,13 @@ public:
     JSKeyboardEventConstructor(ExecState* exec)
         : DOMObject(JSKeyboardEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSKeyboardEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSKeyboardEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -115,9 +112,9 @@ static const HashTable JSKeyboardEventPrototypeTable =
 
 const ClassInfo JSKeyboardEventPrototype::s_info = { "KeyboardEventPrototype", 0, &JSKeyboardEventPrototypeTable, 0 };
 
-JSObject* JSKeyboardEventPrototype::self(ExecState* exec)
+JSObject* JSKeyboardEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSKeyboardEvent>(exec);
+    return getDOMPrototype<JSKeyboardEvent>(exec, globalObject);
 }
 
 bool JSKeyboardEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,9 +129,9 @@ JSKeyboardEvent::JSKeyboardEvent(PassRefPtr<Structure> structure, PassRefPtr<Key
 {
 }
 
-JSObject* JSKeyboardEvent::createPrototype(ExecState* exec)
+JSObject* JSKeyboardEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSKeyboardEventPrototype(JSKeyboardEventPrototype::createStructure(JSUIEventPrototype::self(exec)));
+    return new (exec) JSKeyboardEventPrototype(JSKeyboardEventPrototype::createStructure(JSUIEventPrototype::self(exec, globalObject)));
 }
 
 bool JSKeyboardEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -142,74 +139,82 @@ bool JSKeyboardEvent::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSKeyboardEvent, Base>(exec, &JSKeyboardEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsKeyboardEventKeyIdentifier(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventKeyIdentifier(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->keyIdentifier());
 }
 
-JSValuePtr jsKeyboardEventKeyLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventKeyLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->keyLocation());
 }
 
-JSValuePtr jsKeyboardEventCtrlKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventCtrlKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->ctrlKey());
 }
 
-JSValuePtr jsKeyboardEventShiftKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventShiftKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->shiftKey());
 }
 
-JSValuePtr jsKeyboardEventAltKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventAltKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->altKey());
 }
 
-JSValuePtr jsKeyboardEventMetaKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventMetaKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->metaKey());
 }
 
-JSValuePtr jsKeyboardEventAltGraphKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventAltGraphKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->altGraphKey());
 }
 
-JSValuePtr jsKeyboardEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsKeyboardEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSKeyboardEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSKeyboardEvent::getConstructor(ExecState* exec)
+JSValue JSKeyboardEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSKeyboardEventConstructor>(exec);
 }
 
-JSValuePtr jsKeyboardEventPrototypeFunctionInitKeyboardEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsKeyboardEventPrototypeFunctionInitKeyboardEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSKeyboardEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSKeyboardEvent::s_info))
         return throwError(exec, TypeError);
     JSKeyboardEvent* castedThisObj = static_cast<JSKeyboardEvent*>(asObject(thisValue));
     KeyboardEvent* imp = static_cast<KeyboardEvent*>(castedThisObj->impl());
-    const UString& type = args.at(exec, 0)->toString(exec);
-    bool canBubble = args.at(exec, 1)->toBoolean(exec);
-    bool cancelable = args.at(exec, 2)->toBoolean(exec);
-    DOMWindow* view = toDOMWindow(args.at(exec, 3));
-    const UString& keyIdentifier = args.at(exec, 4)->toString(exec);
-    unsigned keyLocation = args.at(exec, 5)->toInt32(exec);
-    bool ctrlKey = args.at(exec, 6)->toBoolean(exec);
-    bool altKey = args.at(exec, 7)->toBoolean(exec);
-    bool shiftKey = args.at(exec, 8)->toBoolean(exec);
-    bool metaKey = args.at(exec, 9)->toBoolean(exec);
-    bool altGraphKey = args.at(exec, 10)->toBoolean(exec);
+    const UString& type = args.at(0).toString(exec);
+    bool canBubble = args.at(1).toBoolean(exec);
+    bool cancelable = args.at(2).toBoolean(exec);
+    DOMWindow* view = toDOMWindow(args.at(3));
+    const UString& keyIdentifier = args.at(4).toString(exec);
+    unsigned keyLocation = args.at(5).toInt32(exec);
+    bool ctrlKey = args.at(6).toBoolean(exec);
+    bool altKey = args.at(7).toBoolean(exec);
+    bool shiftKey = args.at(8).toBoolean(exec);
+    bool metaKey = args.at(9).toBoolean(exec);
+    bool altGraphKey = args.at(10).toBoolean(exec);
 
     imp->initKeyboardEvent(type, canBubble, cancelable, view, keyIdentifier, keyLocation, ctrlKey, altKey, shiftKey, metaKey, altGraphKey);
     return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h
index c2d981a..40e6eb1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSKeyboardEvent.h
@@ -31,27 +31,28 @@ class JSKeyboardEvent : public JSUIEvent {
     typedef JSUIEvent Base;
 public:
     JSKeyboardEvent(PassRefPtr<JSC::Structure>, PassRefPtr<KeyboardEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSKeyboardEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,17 +61,17 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsKeyboardEventPrototypeFunctionInitKeyboardEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsKeyboardEventPrototypeFunctionInitKeyboardEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsKeyboardEventKeyIdentifier(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsKeyboardEventKeyLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsKeyboardEventCtrlKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsKeyboardEventShiftKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsKeyboardEventAltKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsKeyboardEventMetaKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsKeyboardEventAltGraphKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsKeyboardEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsKeyboardEventKeyIdentifier(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsKeyboardEventKeyLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsKeyboardEventCtrlKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsKeyboardEventShiftKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsKeyboardEventAltKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsKeyboardEventMetaKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsKeyboardEventAltGraphKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsKeyboardEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp b/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp
index b1bbc16..a1c76be 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSLocation.cpp
@@ -19,23 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSLocation.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSLocationCustom.h"
 #include "KURL.h"
 #include "Location.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSLocation)
+ASSERT_CLASS_FITS_IN_CELL(JSLocation);
 
 /* Hash table */
 
@@ -79,9 +76,9 @@ static const HashTable JSLocationPrototypeTable =
 
 const ClassInfo JSLocationPrototype::s_info = { "LocationPrototype", 0, &JSLocationPrototypeTable, 0 };
 
-JSObject* JSLocationPrototype::self(ExecState* exec)
+JSObject* JSLocationPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSLocation>(exec);
+    return getDOMPrototype<JSLocation>(exec, globalObject);
 }
 
 bool JSLocationPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -89,6 +86,13 @@ bool JSLocationPrototype::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticFunctionSlot<JSObject>(exec, &JSLocationPrototypeTable, this, propertyName, slot);
 }
 
+void JSLocationPrototype::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    if (putDelegate(exec, propertyName, value, slot))
+        return;
+    Base::put(exec, propertyName, value, slot);
+}
+
 const ClassInfo JSLocation::s_info = { "Location", 0, &JSLocationTable, 0 };
 
 JSLocation::JSLocation(PassRefPtr<Structure> structure, PassRefPtr<Location> impl)
@@ -100,162 +104,166 @@ JSLocation::JSLocation(PassRefPtr<Structure> structure, PassRefPtr<Location> imp
 JSLocation::~JSLocation()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSLocation::createPrototype(ExecState* exec)
+JSObject* JSLocation::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSLocationPrototype(JSLocationPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSLocationPrototype(JSLocationPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSLocation::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    if (customGetOwnPropertySlot(exec, propertyName, slot))
+    if (getOwnPropertySlotDelegate(exec, propertyName, slot))
         return true;
     return getStaticValueSlot<JSLocation, Base>(exec, &JSLocationTable, this, propertyName, slot);
 }
 
-JSValuePtr jsLocationHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(static_cast<JSLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->href());
 }
 
-JSValuePtr jsLocationProtocol(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationProtocol(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(static_cast<JSLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->protocol());
 }
 
-JSValuePtr jsLocationHost(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationHost(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(static_cast<JSLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->host());
 }
 
-JSValuePtr jsLocationHostname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationHostname(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(static_cast<JSLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->hostname());
 }
 
-JSValuePtr jsLocationPort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationPort(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(static_cast<JSLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->port());
 }
 
-JSValuePtr jsLocationPathname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationPathname(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(static_cast<JSLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->pathname());
 }
 
-JSValuePtr jsLocationSearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationSearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(static_cast<JSLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->search());
 }
 
-JSValuePtr jsLocationHash(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsLocationHash(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Location* imp = static_cast<Location*>(static_cast<JSLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->hash());
 }
 
-void JSLocation::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSLocation::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    if (customPut(exec, propertyName, value, slot))
+    if (putDelegate(exec, propertyName, value, slot))
         return;
     lookupPut<JSLocation, Base>(exec, propertyName, value, &JSLocationTable, this, slot);
 }
 
-void setJSLocationHref(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSLocationHref(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSLocation*>(thisObject)->setHref(exec, value);
 }
 
-void setJSLocationProtocol(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSLocationProtocol(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSLocation*>(thisObject)->setProtocol(exec, value);
 }
 
-void setJSLocationHost(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSLocationHost(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSLocation*>(thisObject)->setHost(exec, value);
 }
 
-void setJSLocationHostname(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSLocationHostname(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSLocation*>(thisObject)->setHostname(exec, value);
 }
 
-void setJSLocationPort(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSLocationPort(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSLocation*>(thisObject)->setPort(exec, value);
 }
 
-void setJSLocationPathname(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSLocationPathname(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSLocation*>(thisObject)->setPathname(exec, value);
 }
 
-void setJSLocationSearch(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSLocationSearch(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSLocation*>(thisObject)->setSearch(exec, value);
 }
 
-void setJSLocationHash(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSLocationHash(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     static_cast<JSLocation*>(thisObject)->setHash(exec, value);
 }
 
-void JSLocation::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
-{
-    if (customGetPropertyNames(exec, propertyNames))
-        return;
-     Base::getPropertyNames(exec, propertyNames);
-}
-
-JSValuePtr jsLocationPrototypeFunctionAssign(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsLocationPrototypeFunctionAssign(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSLocation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSLocation::s_info))
         return throwError(exec, TypeError);
     JSLocation* castedThisObj = static_cast<JSLocation*>(asObject(thisValue));
     return castedThisObj->assign(exec, args);
 }
 
-JSValuePtr jsLocationPrototypeFunctionReplace(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsLocationPrototypeFunctionReplace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSLocation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSLocation::s_info))
         return throwError(exec, TypeError);
     JSLocation* castedThisObj = static_cast<JSLocation*>(asObject(thisValue));
     return castedThisObj->replace(exec, args);
 }
 
-JSValuePtr jsLocationPrototypeFunctionReload(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsLocationPrototypeFunctionReload(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSLocation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSLocation::s_info))
         return throwError(exec, TypeError);
     JSLocation* castedThisObj = static_cast<JSLocation*>(asObject(thisValue));
     return castedThisObj->reload(exec, args);
 }
 
-JSValuePtr jsLocationPrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsLocationPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSLocation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSLocation::s_info))
         return throwError(exec, TypeError);
     JSLocation* castedThisObj = static_cast<JSLocation*>(asObject(thisValue));
     return castedThisObj->toString(exec, args);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Location* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Location* object)
 {
     return getDOMObjectWrapper<JSLocation>(exec, object);
 }
-Location* toLocation(JSC::JSValuePtr value)
+Location* toLocation(JSC::JSValue value)
 {
-    return value->isObject(&JSLocation::s_info) ? static_cast<JSLocation*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSLocation::s_info) ? static_cast<JSLocation*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSLocation.h b/src/3rdparty/webkit/WebCore/generated/JSLocation.h
index a4e8e74..81cb7a3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSLocation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSLocation.h
@@ -34,84 +34,88 @@ class JSLocation : public DOMObject {
 public:
     JSLocation(PassRefPtr<JSC::Structure>, PassRefPtr<Location>);
     virtual ~JSLocation();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    bool customGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    bool customGetPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
+    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);
 
     // Custom attributes
-    void setHref(JSC::ExecState*, JSC::JSValuePtr);
-    void setProtocol(JSC::ExecState*, JSC::JSValuePtr);
-    void setHost(JSC::ExecState*, JSC::JSValuePtr);
-    void setHostname(JSC::ExecState*, JSC::JSValuePtr);
-    void setPort(JSC::ExecState*, JSC::JSValuePtr);
-    void setPathname(JSC::ExecState*, JSC::JSValuePtr);
-    void setSearch(JSC::ExecState*, JSC::JSValuePtr);
-    void setHash(JSC::ExecState*, JSC::JSValuePtr);
+    void setHref(JSC::ExecState*, JSC::JSValue);
+    void setProtocol(JSC::ExecState*, JSC::JSValue);
+    void setHost(JSC::ExecState*, JSC::JSValue);
+    void setHostname(JSC::ExecState*, JSC::JSValue);
+    void setPort(JSC::ExecState*, JSC::JSValue);
+    void setPathname(JSC::ExecState*, JSC::JSValue);
+    void setSearch(JSC::ExecState*, JSC::JSValue);
+    void setHash(JSC::ExecState*, JSC::JSValue);
 
     // Custom functions
-    JSC::JSValuePtr assign(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr replace(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr reload(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr toString(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue assign(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue replace(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue reload(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue toString(JSC::ExecState*, const JSC::ArgList&);
     Location* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Location> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Location*);
-Location* toLocation(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Location*);
+Location* toLocation(JSC::JSValue);
 
 class JSLocationPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual void defineGetter(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSObject* getterFunction);
     JSLocationPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
 };
 
 // Functions
 
-JSC::JSValuePtr jsLocationPrototypeFunctionAssign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsLocationPrototypeFunctionReplace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsLocationPrototypeFunctionReload(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsLocationPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsLocationPrototypeFunctionAssign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsLocationPrototypeFunctionReplace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsLocationPrototypeFunctionReload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsLocationPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsLocationHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSLocationHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsLocationProtocol(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSLocationProtocol(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsLocationHost(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSLocationHost(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsLocationHostname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSLocationHostname(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsLocationPort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSLocationPort(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsLocationPathname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSLocationPathname(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsLocationSearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSLocationSearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsLocationHash(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSLocationHash(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsLocationHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSLocationHref(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsLocationProtocol(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSLocationProtocol(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsLocationHost(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSLocationHost(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsLocationHostname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSLocationHostname(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsLocationPort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSLocationPort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsLocationPathname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSLocationPathname(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsLocationSearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSLocationSearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsLocationHash(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSLocationHash(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp b/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
index 6789d9d..490e06c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaError.cpp
@@ -20,22 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(VIDEO)
 
 #include "JSMediaError.h"
 
-#include <wtf/GetPtr.h>
-
 #include "MediaError.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSMediaError)
+ASSERT_CLASS_FITS_IN_CELL(JSMediaError);
 
 /* Hash table */
 
@@ -55,19 +52,20 @@ static const HashTable JSMediaErrorTable =
 
 /* Hash table for constructor */
 
-static const HashTableValue JSMediaErrorConstructorTableValues[4] =
+static const HashTableValue JSMediaErrorConstructorTableValues[5] =
 {
     { "MEDIA_ERR_ABORTED", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_ABORTED, (intptr_t)0 },
     { "MEDIA_ERR_NETWORK", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_NETWORK, (intptr_t)0 },
     { "MEDIA_ERR_DECODE", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_DECODE, (intptr_t)0 },
+    { "MEDIA_ERR_SRC_NOT_SUPPORTED", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_SRC_NOT_SUPPORTED, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static const HashTable JSMediaErrorConstructorTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 3, JSMediaErrorConstructorTableValues, 0 };
+    { 31, JSMediaErrorConstructorTableValues, 0 };
 #else
-    { 8, 7, JSMediaErrorConstructorTableValues, 0 };
+    { 9, 7, JSMediaErrorConstructorTableValues, 0 };
 #endif
 
 class JSMediaErrorConstructor : public DOMObject {
@@ -75,13 +73,13 @@ public:
     JSMediaErrorConstructor(ExecState* exec)
         : DOMObject(JSMediaErrorConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSMediaErrorPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSMediaErrorPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -96,26 +94,27 @@ bool JSMediaErrorConstructor::getOwnPropertySlot(ExecState* exec, const Identifi
 
 /* Hash table for prototype */
 
-static const HashTableValue JSMediaErrorPrototypeTableValues[4] =
+static const HashTableValue JSMediaErrorPrototypeTableValues[5] =
 {
     { "MEDIA_ERR_ABORTED", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_ABORTED, (intptr_t)0 },
     { "MEDIA_ERR_NETWORK", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_NETWORK, (intptr_t)0 },
     { "MEDIA_ERR_DECODE", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_DECODE, (intptr_t)0 },
+    { "MEDIA_ERR_SRC_NOT_SUPPORTED", DontDelete|ReadOnly, (intptr_t)jsMediaErrorMEDIA_ERR_SRC_NOT_SUPPORTED, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static const HashTable JSMediaErrorPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 3, JSMediaErrorPrototypeTableValues, 0 };
+    { 31, JSMediaErrorPrototypeTableValues, 0 };
 #else
-    { 8, 7, JSMediaErrorPrototypeTableValues, 0 };
+    { 9, 7, JSMediaErrorPrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSMediaErrorPrototype::s_info = { "MediaErrorPrototype", 0, &JSMediaErrorPrototypeTable, 0 };
 
-JSObject* JSMediaErrorPrototype::self(ExecState* exec)
+JSObject* JSMediaErrorPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSMediaError>(exec);
+    return getDOMPrototype<JSMediaError>(exec, globalObject);
 }
 
 bool JSMediaErrorPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -134,12 +133,11 @@ JSMediaError::JSMediaError(PassRefPtr<Structure> structure, PassRefPtr<MediaErro
 JSMediaError::~JSMediaError()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSMediaError::createPrototype(ExecState* exec)
+JSObject* JSMediaError::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSMediaErrorPrototype(JSMediaErrorPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSMediaErrorPrototype(JSMediaErrorPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSMediaError::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -147,45 +145,51 @@ bool JSMediaError::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSMediaError, Base>(exec, &JSMediaErrorTable, this, propertyName, slot);
 }
 
-JSValuePtr jsMediaErrorCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMediaErrorCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MediaError* imp = static_cast<MediaError*>(static_cast<JSMediaError*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->code());
 }
 
-JSValuePtr jsMediaErrorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMediaErrorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSMediaError*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSMediaError::getConstructor(ExecState* exec)
+JSValue JSMediaError::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSMediaErrorConstructor>(exec);
 }
 
 // Constant getters
 
-JSValuePtr jsMediaErrorMEDIA_ERR_ABORTED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsMediaErrorMEDIA_ERR_ABORTED(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsMediaErrorMEDIA_ERR_NETWORK(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsMediaErrorMEDIA_ERR_NETWORK(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsMediaErrorMEDIA_ERR_DECODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsMediaErrorMEDIA_ERR_DECODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, MediaError* object)
+JSValue jsMediaErrorMEDIA_ERR_SRC_NOT_SUPPORTED(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(4));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, MediaError* object)
 {
     return getDOMObjectWrapper<JSMediaError>(exec, object);
 }
-MediaError* toMediaError(JSC::JSValuePtr value)
+MediaError* toMediaError(JSC::JSValue value)
 {
-    return value->isObject(&JSMediaError::s_info) ? static_cast<JSMediaError*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSMediaError::s_info) ? static_cast<JSMediaError*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaError.h b/src/3rdparty/webkit/WebCore/generated/JSMediaError.h
index f221558..54f58a7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaError.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaError.h
@@ -21,7 +21,6 @@
 #ifndef JSMediaError_h
 #define JSMediaError_h
 
-
 #if ENABLE(VIDEO)
 
 #include "JSDOMBinding.h"
@@ -37,33 +36,34 @@ class JSMediaError : public DOMObject {
 public:
     JSMediaError(PassRefPtr<JSC::Structure>, PassRefPtr<MediaError>);
     virtual ~JSMediaError();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     MediaError* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<MediaError> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, MediaError*);
-MediaError* toMediaError(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, MediaError*);
+MediaError* toMediaError(JSC::JSValue);
 
 class JSMediaErrorPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -72,13 +72,14 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsMediaErrorCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMediaErrorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMediaErrorCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMediaErrorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsMediaErrorMEDIA_ERR_ABORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMediaErrorMEDIA_ERR_NETWORK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMediaErrorMEDIA_ERR_DECODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMediaErrorMEDIA_ERR_ABORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMediaErrorMEDIA_ERR_NETWORK(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMediaErrorMEDIA_ERR_DECODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMediaErrorMEDIA_ERR_SRC_NOT_SUPPORTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp b/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
index ce48c39..4a517c8f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaList.cpp
@@ -19,23 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSMediaList.h"
 
-#include <wtf/GetPtr.h>
-
-#include <runtime/PropertyNameArray.h>
 #include "KURL.h"
 #include "MediaList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSMediaList)
+ASSERT_CLASS_FITS_IN_CELL(JSMediaList);
 
 /* Hash table */
 
@@ -73,13 +70,13 @@ public:
     JSMediaListConstructor(ExecState* exec)
         : DOMObject(JSMediaListConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSMediaListPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSMediaListPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +108,9 @@ static const HashTable JSMediaListPrototypeTable =
 
 const ClassInfo JSMediaListPrototype::s_info = { "MediaListPrototype", 0, &JSMediaListPrototypeTable, 0 };
 
-JSObject* JSMediaListPrototype::self(ExecState* exec)
+JSObject* JSMediaListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSMediaList>(exec);
+    return getDOMPrototype<JSMediaList>(exec, globalObject);
 }
 
 bool JSMediaListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,12 +129,11 @@ JSMediaList::JSMediaList(PassRefPtr<Structure> structure, PassRefPtr<MediaList>
 JSMediaList::~JSMediaList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSMediaList::createPrototype(ExecState* exec)
+JSObject* JSMediaList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSMediaListPrototype(JSMediaListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSMediaListPrototype(JSMediaListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSMediaList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -165,28 +161,30 @@ bool JSMediaList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, Pro
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsMediaListMediaText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMediaListMediaText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MediaList* imp = static_cast<MediaList*>(static_cast<JSMediaList*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->mediaText());
 }
 
-JSValuePtr jsMediaListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMediaListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MediaList* imp = static_cast<MediaList*>(static_cast<JSMediaList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsMediaListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMediaListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSMediaList*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSMediaList::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSMediaList::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSMediaList, Base>(exec, propertyName, value, &JSMediaListTable, this, slot);
 }
 
-void setJSMediaListMediaText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSMediaListMediaText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     MediaList* imp = static_cast<MediaList*>(static_cast<JSMediaList*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -201,46 +199,49 @@ void JSMediaList::getPropertyNames(ExecState* exec, PropertyNameArray& propertyN
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSMediaList::getConstructor(ExecState* exec)
+JSValue JSMediaList::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSMediaListConstructor>(exec);
 }
 
-JSValuePtr jsMediaListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMediaListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMediaList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMediaList::s_info))
         return throwError(exec, TypeError);
     JSMediaList* castedThisObj = static_cast<JSMediaList*>(asObject(thisValue));
     MediaList* imp = static_cast<MediaList*>(castedThisObj->impl());
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->item(index));
+    JSC::JSValue result = jsStringOrNull(exec, imp->item(index));
     return result;
 }
 
-JSValuePtr jsMediaListPrototypeFunctionDeleteMedium(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMediaListPrototypeFunctionDeleteMedium(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMediaList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMediaList::s_info))
         return throwError(exec, TypeError);
     JSMediaList* castedThisObj = static_cast<JSMediaList*>(asObject(thisValue));
     MediaList* imp = static_cast<MediaList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& oldMedium = args.at(exec, 0)->toString(exec);
+    const UString& oldMedium = args.at(0).toString(exec);
 
     imp->deleteMedium(oldMedium, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsMediaListPrototypeFunctionAppendMedium(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMediaListPrototypeFunctionAppendMedium(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMediaList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMediaList::s_info))
         return throwError(exec, TypeError);
     JSMediaList* castedThisObj = static_cast<JSMediaList*>(asObject(thisValue));
     MediaList* imp = static_cast<MediaList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& newMedium = args.at(exec, 0)->toString(exec);
+    const UString& newMedium = args.at(0).toString(exec);
 
     imp->appendMedium(newMedium, ec);
     setDOMException(exec, ec);
@@ -248,18 +249,18 @@ JSValuePtr jsMediaListPrototypeFunctionAppendMedium(ExecState* exec, JSObject*,
 }
 
 
-JSValuePtr JSMediaList::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSMediaList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSMediaList* thisObj = static_cast<JSMediaList*>(asObject(slot.slotBase()));
     return jsStringOrNull(exec, thisObj->impl()->item(slot.index()));
 }
-JSC::JSValuePtr toJS(JSC::ExecState* exec, MediaList* object)
+JSC::JSValue toJS(JSC::ExecState* exec, MediaList* object)
 {
     return getDOMObjectWrapper<JSMediaList>(exec, object);
 }
-MediaList* toMediaList(JSC::JSValuePtr value)
+MediaList* toMediaList(JSC::JSValue value)
 {
-    return value->isObject(&JSMediaList::s_info) ? static_cast<JSMediaList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSMediaList::s_info) ? static_cast<JSMediaList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMediaList.h b/src/3rdparty/webkit/WebCore/generated/JSMediaList.h
index 01ce230..800d9d4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMediaList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMediaList.h
@@ -34,37 +34,38 @@ class JSMediaList : public DOMObject {
 public:
     JSMediaList(PassRefPtr<JSC::Structure>, PassRefPtr<MediaList>);
     virtual ~JSMediaList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     MediaList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<MediaList> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, MediaList*);
-MediaList* toMediaList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, MediaList*);
+MediaList* toMediaList(JSC::JSValue);
 
 class JSMediaListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -73,15 +74,15 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsMediaListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsMediaListPrototypeFunctionDeleteMedium(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsMediaListPrototypeFunctionAppendMedium(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMediaListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMediaListPrototypeFunctionDeleteMedium(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMediaListPrototypeFunctionAppendMedium(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsMediaListMediaText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSMediaListMediaText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsMediaListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMediaListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMediaListMediaText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSMediaListMediaText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsMediaListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMediaListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp
index ac725d4..8f660f2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.cpp
@@ -19,21 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSMessageChannel.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSMessagePort.h"
 #include "MessageChannel.h"
 #include "MessagePort.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSMessageChannel)
+ASSERT_CLASS_FITS_IN_CELL(JSMessageChannel);
 
 /* Hash table */
 
@@ -71,9 +68,9 @@ static const HashTable* getJSMessageChannelPrototypeTable(ExecState* exec)
 }
 const ClassInfo JSMessageChannelPrototype::s_info = { "MessageChannelPrototype", 0, 0, getJSMessageChannelPrototypeTable };
 
-JSObject* JSMessageChannelPrototype::self(ExecState* exec)
+JSObject* JSMessageChannelPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSMessageChannel>(exec);
+    return getDOMPrototype<JSMessageChannel>(exec, globalObject);
 }
 
 static const HashTable* getJSMessageChannelTable(ExecState* exec)
@@ -91,12 +88,11 @@ JSMessageChannel::JSMessageChannel(PassRefPtr<Structure> structure, PassRefPtr<M
 JSMessageChannel::~JSMessageChannel()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSMessageChannel::createPrototype(ExecState* exec)
+JSObject* JSMessageChannel::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSMessageChannelPrototype(JSMessageChannelPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSMessageChannelPrototype(JSMessageChannelPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSMessageChannel::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -104,25 +100,27 @@ bool JSMessageChannel::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSMessageChannel, Base>(exec, getJSMessageChannelTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsMessageChannelPort1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageChannelPort1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MessageChannel* imp = static_cast<MessageChannel*>(static_cast<JSMessageChannel*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->port1()));
 }
 
-JSValuePtr jsMessageChannelPort2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageChannelPort2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MessageChannel* imp = static_cast<MessageChannel*>(static_cast<JSMessageChannel*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->port2()));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, MessageChannel* object)
+JSC::JSValue toJS(JSC::ExecState* exec, MessageChannel* object)
 {
     return getDOMObjectWrapper<JSMessageChannel>(exec, object);
 }
-MessageChannel* toMessageChannel(JSC::JSValuePtr value)
+MessageChannel* toMessageChannel(JSC::JSValue value)
 {
-    return value->isObject(&JSMessageChannel::s_info) ? static_cast<JSMessageChannel*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSMessageChannel::s_info) ? static_cast<JSMessageChannel*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h
index f4aa3b5..f9a9026 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageChannel.h
@@ -34,12 +34,12 @@ class JSMessageChannel : public DOMObject {
 public:
     JSMessageChannel(PassRefPtr<JSC::Structure>, PassRefPtr<MessageChannel>);
     virtual ~JSMessageChannel();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -52,12 +52,13 @@ private:
     RefPtr<MessageChannel> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, MessageChannel*);
-MessageChannel* toMessageChannel(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, MessageChannel*);
+MessageChannel* toMessageChannel(JSC::JSValue);
 
 class JSMessageChannelPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSMessageChannelPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -65,8 +66,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsMessageChannelPort1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMessageChannelPort2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessageChannelPort1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessageChannelPort2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp
index f0ee016..e95dd9c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.cpp
@@ -19,27 +19,23 @@
 */
 
 #include "config.h"
-
 #include "JSMessageEvent.h"
 
-#include <wtf/GetPtr.h>
-
 #include "DOMWindow.h"
 #include "JSDOMWindow.h"
 #include "JSMessagePort.h"
 #include "KURL.h"
 #include "MessageEvent.h"
 #include "MessagePort.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSMessageEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSMessageEvent);
 
 /* Hash table */
 
@@ -80,13 +76,13 @@ public:
     JSMessageEventConstructor(ExecState* exec)
         : DOMObject(JSMessageEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSMessageEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSMessageEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -120,9 +116,9 @@ static const HashTable* getJSMessageEventPrototypeTable(ExecState* exec)
 }
 const ClassInfo JSMessageEventPrototype::s_info = { "MessageEventPrototype", 0, 0, getJSMessageEventPrototypeTable };
 
-JSObject* JSMessageEventPrototype::self(ExecState* exec)
+JSObject* JSMessageEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSMessageEvent>(exec);
+    return getDOMPrototype<JSMessageEvent>(exec, globalObject);
 }
 
 bool JSMessageEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -141,9 +137,9 @@ JSMessageEvent::JSMessageEvent(PassRefPtr<Structure> structure, PassRefPtr<Messa
 {
 }
 
-JSObject* JSMessageEvent::createPrototype(ExecState* exec)
+JSObject* JSMessageEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSMessageEventPrototype(JSMessageEventPrototype::createStructure(JSEventPrototype::self(exec)));
+    return new (exec) JSMessageEventPrototype(JSMessageEventPrototype::createStructure(JSEventPrototype::self(exec, globalObject)));
 }
 
 bool JSMessageEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -151,59 +147,65 @@ bool JSMessageEvent::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSMessageEvent, Base>(exec, getJSMessageEventTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsMessageEventData(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageEventData(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MessageEvent* imp = static_cast<MessageEvent*>(static_cast<JSMessageEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->data());
 }
 
-JSValuePtr jsMessageEventOrigin(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageEventOrigin(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MessageEvent* imp = static_cast<MessageEvent*>(static_cast<JSMessageEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->origin());
 }
 
-JSValuePtr jsMessageEventLastEventId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageEventLastEventId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MessageEvent* imp = static_cast<MessageEvent*>(static_cast<JSMessageEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->lastEventId());
 }
 
-JSValuePtr jsMessageEventSource(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageEventSource(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MessageEvent* imp = static_cast<MessageEvent*>(static_cast<JSMessageEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->source()));
 }
 
-JSValuePtr jsMessageEventMessagePort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageEventMessagePort(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MessageEvent* imp = static_cast<MessageEvent*>(static_cast<JSMessageEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->messagePort()));
 }
 
-JSValuePtr jsMessageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSMessageEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSMessageEvent::getConstructor(ExecState* exec)
+JSValue JSMessageEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSMessageEventConstructor>(exec);
 }
 
-JSValuePtr jsMessageEventPrototypeFunctionInitMessageEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMessageEventPrototypeFunctionInitMessageEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMessageEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMessageEvent::s_info))
         return throwError(exec, TypeError);
     JSMessageEvent* castedThisObj = static_cast<JSMessageEvent*>(asObject(thisValue));
     MessageEvent* imp = static_cast<MessageEvent*>(castedThisObj->impl());
-    const UString& typeArg = args.at(exec, 0)->toString(exec);
-    bool canBubbleArg = args.at(exec, 1)->toBoolean(exec);
-    bool cancelableArg = args.at(exec, 2)->toBoolean(exec);
-    const UString& dataArg = args.at(exec, 3)->toString(exec);
-    const UString& originArg = args.at(exec, 4)->toString(exec);
-    const UString& lastEventIdArg = args.at(exec, 5)->toString(exec);
-    DOMWindow* sourceArg = toDOMWindow(args.at(exec, 6));
-    MessagePort* messagePort = toMessagePort(args.at(exec, 7));
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    const UString& dataArg = args.at(3).toString(exec);
+    const UString& originArg = args.at(4).toString(exec);
+    const UString& lastEventIdArg = args.at(5).toString(exec);
+    DOMWindow* sourceArg = toDOMWindow(args.at(6));
+    MessagePort* messagePort = toMessagePort(args.at(7));
 
     imp->initMessageEvent(typeArg, canBubbleArg, cancelableArg, dataArg, originArg, lastEventIdArg, sourceArg, messagePort);
     return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h
index 501af7d..4cdefab 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessageEvent.h
@@ -31,27 +31,28 @@ class JSMessageEvent : public JSEvent {
     typedef JSEvent Base;
 public:
     JSMessageEvent(PassRefPtr<JSC::Structure>, PassRefPtr<MessageEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSMessageEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,15 +61,15 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsMessageEventPrototypeFunctionInitMessageEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMessageEventPrototypeFunctionInitMessageEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsMessageEventData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMessageEventOrigin(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMessageEventLastEventId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMessageEventSource(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMessageEventMessagePort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMessageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessageEventData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessageEventOrigin(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessageEventLastEventId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessageEventSource(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessageEventMessagePort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
index fe6c57f..7cb75b2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.cpp
@@ -19,11 +19,8 @@
 */
 
 #include "config.h"
-
 #include "JSMessagePort.h"
 
-#include <wtf/GetPtr.h>
-
 #include "Event.h"
 #include "EventListener.h"
 #include "Frame.h"
@@ -33,32 +30,29 @@
 #include "JSMessagePort.h"
 #include "MessagePort.h"
 #include "PlatformString.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSMessagePort)
+ASSERT_CLASS_FITS_IN_CELL(JSMessagePort);
 
 /* Hash table */
 
-static const HashTableValue JSMessagePortTableValues[5] =
+static const HashTableValue JSMessagePortTableValues[3] =
 {
-    { "active", DontDelete|ReadOnly, (intptr_t)jsMessagePortActive, (intptr_t)0 },
     { "onmessage", DontDelete, (intptr_t)jsMessagePortOnmessage, (intptr_t)setJSMessagePortOnmessage },
-    { "onclose", DontDelete, (intptr_t)jsMessagePortOnclose, (intptr_t)setJSMessagePortOnclose },
     { "constructor", DontEnum|ReadOnly, (intptr_t)jsMessagePortConstructor, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
 static const HashTable JSMessagePortTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 7, JSMessagePortTableValues, 0 };
+    { 1, JSMessagePortTableValues, 0 };
 #else
-    { 8, 7, JSMessagePortTableValues, 0 };
+    { 4, 3, JSMessagePortTableValues, 0 };
 #endif
 
 /* Hash table for constructor */
@@ -80,13 +74,13 @@ public:
     JSMessagePortConstructor(ExecState* exec)
         : DOMObject(JSMessagePortConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSMessagePortPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSMessagePortPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -101,10 +95,9 @@ bool JSMessagePortConstructor::getOwnPropertySlot(ExecState* exec, const Identif
 
 /* Hash table for prototype */
 
-static const HashTableValue JSMessagePortPrototypeTableValues[8] =
+static const HashTableValue JSMessagePortPrototypeTableValues[7] =
 {
     { "postMessage", DontDelete|Function, (intptr_t)jsMessagePortPrototypeFunctionPostMessage, (intptr_t)2 },
-    { "startConversation", DontDelete|Function, (intptr_t)jsMessagePortPrototypeFunctionStartConversation, (intptr_t)1 },
     { "start", DontDelete|Function, (intptr_t)jsMessagePortPrototypeFunctionStart, (intptr_t)0 },
     { "close", DontDelete|Function, (intptr_t)jsMessagePortPrototypeFunctionClose, (intptr_t)0 },
     { "addEventListener", DontDelete|Function, (intptr_t)jsMessagePortPrototypeFunctionAddEventListener, (intptr_t)3 },
@@ -115,9 +108,9 @@ static const HashTableValue JSMessagePortPrototypeTableValues[8] =
 
 static const HashTable JSMessagePortPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 127, JSMessagePortPrototypeTableValues, 0 };
+    { 31, JSMessagePortPrototypeTableValues, 0 };
 #else
-    { 18, 15, JSMessagePortPrototypeTableValues, 0 };
+    { 17, 15, JSMessagePortPrototypeTableValues, 0 };
 #endif
 
 static const HashTable* getJSMessagePortPrototypeTable(ExecState* exec)
@@ -126,9 +119,9 @@ static const HashTable* getJSMessagePortPrototypeTable(ExecState* exec)
 }
 const ClassInfo JSMessagePortPrototype::s_info = { "MessagePortPrototype", 0, 0, getJSMessagePortPrototypeTable };
 
-JSObject* JSMessagePortPrototype::self(ExecState* exec)
+JSObject* JSMessagePortPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSMessagePort>(exec);
+    return getDOMPrototype<JSMessagePort>(exec, globalObject);
 }
 
 bool JSMessagePortPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -151,12 +144,11 @@ JSMessagePort::JSMessagePort(PassRefPtr<Structure> structure, PassRefPtr<Message
 JSMessagePort::~JSMessagePort()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSMessagePort::createPrototype(ExecState* exec)
+JSObject* JSMessagePort::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSMessagePortPrototype(JSMessagePortPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSMessagePortPrototype(JSMessagePortPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSMessagePort::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -164,72 +156,50 @@ bool JSMessagePort::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSMessagePort, Base>(exec, getJSMessagePortTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsMessagePortActive(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    MessagePort* imp = static_cast<MessagePort*>(static_cast<JSMessagePort*>(asObject(slot.slotBase()))->impl());
-    return jsBoolean(imp->active());
-}
-
-JSValuePtr jsMessagePortOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
-{
-    MessagePort* imp = static_cast<MessagePort*>(static_cast<JSMessagePort*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onmessage())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
-}
-
-JSValuePtr jsMessagePortOnclose(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessagePortOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MessagePort* imp = static_cast<MessagePort*>(static_cast<JSMessagePort*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onclose())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmessage()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsMessagePortConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMessagePortConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSMessagePort*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSMessagePort::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSMessagePort::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSMessagePort, Base>(exec, propertyName, value, getJSMessagePortTable(exec), this, slot);
 }
 
-void setJSMessagePortOnmessage(ExecState* exec, JSObject* thisObject, JSValuePtr value)
-{
-    MessagePort* imp = static_cast<MessagePort*>(static_cast<JSMessagePort*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
-    if (!globalObject)
-        return;
-    imp->setOnmessage(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
-}
-
-void setJSMessagePortOnclose(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSMessagePortOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     MessagePort* imp = static_cast<MessagePort*>(static_cast<JSMessagePort*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnclose(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
 }
 
-JSValuePtr JSMessagePort::getConstructor(ExecState* exec)
+JSValue JSMessagePort::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSMessagePortConstructor>(exec);
 }
 
-JSValuePtr jsMessagePortPrototypeFunctionPostMessage(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionPostMessage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMessagePort::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMessagePort::s_info))
         return throwError(exec, TypeError);
     JSMessagePort* castedThisObj = static_cast<JSMessagePort*>(asObject(thisValue));
     MessagePort* imp = static_cast<MessagePort*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& message = args.at(exec, 0)->toString(exec);
+    const UString& message = args.at(0).toString(exec);
 
     int argsCount = args.size();
     if (argsCount < 2) {
@@ -238,24 +208,17 @@ JSValuePtr jsMessagePortPrototypeFunctionPostMessage(ExecState* exec, JSObject*,
         return jsUndefined();
     }
 
-    MessagePort* messagePort = toMessagePort(args.at(exec, 1));
+    MessagePort* messagePort = toMessagePort(args.at(1));
 
     imp->postMessage(message, messagePort, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsMessagePortPrototypeFunctionStartConversation(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSMessagePort::s_info))
-        return throwError(exec, TypeError);
-    JSMessagePort* castedThisObj = static_cast<JSMessagePort*>(asObject(thisValue));
-    return castedThisObj->startConversation(exec, args);
-}
-
-JSValuePtr jsMessagePortPrototypeFunctionStart(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionStart(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMessagePort::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMessagePort::s_info))
         return throwError(exec, TypeError);
     JSMessagePort* castedThisObj = static_cast<JSMessagePort*>(asObject(thisValue));
     MessagePort* imp = static_cast<MessagePort*>(castedThisObj->impl());
@@ -264,9 +227,10 @@ JSValuePtr jsMessagePortPrototypeFunctionStart(ExecState* exec, JSObject*, JSVal
     return jsUndefined();
 }
 
-JSValuePtr jsMessagePortPrototypeFunctionClose(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionClose(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMessagePort::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMessagePort::s_info))
         return throwError(exec, TypeError);
     JSMessagePort* castedThisObj = static_cast<JSMessagePort*>(asObject(thisValue));
     MessagePort* imp = static_cast<MessagePort*>(castedThisObj->impl());
@@ -275,44 +239,47 @@ JSValuePtr jsMessagePortPrototypeFunctionClose(ExecState* exec, JSObject*, JSVal
     return jsUndefined();
 }
 
-JSValuePtr jsMessagePortPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMessagePort::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMessagePort::s_info))
         return throwError(exec, TypeError);
     JSMessagePort* castedThisObj = static_cast<JSMessagePort*>(asObject(thisValue));
     return castedThisObj->addEventListener(exec, args);
 }
 
-JSValuePtr jsMessagePortPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMessagePort::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMessagePort::s_info))
         return throwError(exec, TypeError);
     JSMessagePort* castedThisObj = static_cast<JSMessagePort*>(asObject(thisValue));
     return castedThisObj->removeEventListener(exec, args);
 }
 
-JSValuePtr jsMessagePortPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMessagePort::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMessagePort::s_info))
         return throwError(exec, TypeError);
     JSMessagePort* castedThisObj = static_cast<JSMessagePort*>(asObject(thisValue));
     MessagePort* imp = static_cast<MessagePort*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Event* evt = toEvent(args.at(exec, 0));
+    Event* evt = toEvent(args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->dispatchEvent(evt, ec));
+    JSC::JSValue result = jsBoolean(imp->dispatchEvent(evt, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, MessagePort* object)
+JSC::JSValue toJS(JSC::ExecState* exec, MessagePort* object)
 {
     return getDOMObjectWrapper<JSMessagePort>(exec, object);
 }
-MessagePort* toMessagePort(JSC::JSValuePtr value)
+MessagePort* toMessagePort(JSC::JSValue value)
 {
-    return value->isObject(&JSMessagePort::s_info) ? static_cast<JSMessagePort*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSMessagePort::s_info) ? static_cast<JSMessagePort*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h
index 46e1591..1804d8d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMessagePort.h
@@ -34,41 +34,41 @@ class JSMessagePort : public DOMObject {
 public:
     JSMessagePort(PassRefPtr<JSC::Structure>, PassRefPtr<MessagePort>);
     virtual ~JSMessagePort();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void mark();
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom functions
-    JSC::JSValuePtr startConversation(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr addEventListener(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
     MessagePort* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<MessagePort> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, MessagePort*);
-MessagePort* toMessagePort(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, MessagePort*);
+MessagePort* toMessagePort(JSC::JSValue);
 
 class JSMessagePortPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -77,21 +77,17 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsMessagePortPrototypeFunctionPostMessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsMessagePortPrototypeFunctionStartConversation(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsMessagePortPrototypeFunctionStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsMessagePortPrototypeFunctionClose(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsMessagePortPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsMessagePortPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsMessagePortPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionPostMessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionClose(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMessagePortPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsMessagePortActive(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMessagePortOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSMessagePortOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsMessagePortOnclose(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSMessagePortOnclose(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsMessagePortConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMessagePortOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSMessagePortOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsMessagePortConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp b/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
index 0d83117..09a5dbd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeType.cpp
@@ -19,24 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSMimeType.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSPlugin.h"
 #include "KURL.h"
 #include "MimeType.h"
 #include "Plugin.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSMimeType)
+ASSERT_CLASS_FITS_IN_CELL(JSMimeType);
 
 /* Hash table */
 
@@ -76,13 +72,13 @@ public:
     JSMimeTypeConstructor(ExecState* exec)
         : DOMObject(JSMimeTypeConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSMimeTypePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSMimeTypePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +107,9 @@ static const HashTable JSMimeTypePrototypeTable =
 
 const ClassInfo JSMimeTypePrototype::s_info = { "MimeTypePrototype", 0, &JSMimeTypePrototypeTable, 0 };
 
-JSObject* JSMimeTypePrototype::self(ExecState* exec)
+JSObject* JSMimeTypePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSMimeType>(exec);
+    return getDOMPrototype<JSMimeType>(exec, globalObject);
 }
 
 const ClassInfo JSMimeType::s_info = { "MimeType", 0, &JSMimeTypeTable, 0 };
@@ -127,12 +123,11 @@ JSMimeType::JSMimeType(PassRefPtr<Structure> structure, PassRefPtr<MimeType> imp
 JSMimeType::~JSMimeType()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSMimeType::createPrototype(ExecState* exec)
+JSObject* JSMimeType::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSMimeTypePrototype(JSMimeTypePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSMimeTypePrototype(JSMimeTypePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSMimeType::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -140,46 +135,50 @@ bool JSMimeType::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSMimeType, Base>(exec, &JSMimeTypeTable, this, propertyName, slot);
 }
 
-JSValuePtr jsMimeTypeType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMimeTypeType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MimeType* imp = static_cast<MimeType*>(static_cast<JSMimeType*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsMimeTypeSuffixes(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMimeTypeSuffixes(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MimeType* imp = static_cast<MimeType*>(static_cast<JSMimeType*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->suffixes());
 }
 
-JSValuePtr jsMimeTypeDescription(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMimeTypeDescription(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MimeType* imp = static_cast<MimeType*>(static_cast<JSMimeType*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->description());
 }
 
-JSValuePtr jsMimeTypeEnabledPlugin(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMimeTypeEnabledPlugin(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MimeType* imp = static_cast<MimeType*>(static_cast<JSMimeType*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->enabledPlugin()));
 }
 
-JSValuePtr jsMimeTypeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMimeTypeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSMimeType*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSMimeType::getConstructor(ExecState* exec)
+JSValue JSMimeType::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSMimeTypeConstructor>(exec);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, MimeType* object)
+JSC::JSValue toJS(JSC::ExecState* exec, MimeType* object)
 {
     return getDOMObjectWrapper<JSMimeType>(exec, object);
 }
-MimeType* toMimeType(JSC::JSValuePtr value)
+MimeType* toMimeType(JSC::JSValue value)
 {
-    return value->isObject(&JSMimeType::s_info) ? static_cast<JSMimeType*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSMimeType::s_info) ? static_cast<JSMimeType*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeType.h b/src/3rdparty/webkit/WebCore/generated/JSMimeType.h
index 6de6aa2..79b904d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeType.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeType.h
@@ -34,29 +34,30 @@ class JSMimeType : public DOMObject {
 public:
     JSMimeType(PassRefPtr<JSC::Structure>, PassRefPtr<MimeType>);
     virtual ~JSMimeType();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     MimeType* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<MimeType> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, MimeType*);
-MimeType* toMimeType(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, MimeType*);
+MimeType* toMimeType(JSC::JSValue);
 
 class JSMimeTypePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSMimeTypePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -64,11 +65,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsMimeTypeType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMimeTypeSuffixes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMimeTypeDescription(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMimeTypeEnabledPlugin(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMimeTypeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMimeTypeType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMimeTypeSuffixes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMimeTypeDescription(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMimeTypeEnabledPlugin(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMimeTypeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
index 688f7f2..509d6d0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.cpp
@@ -19,25 +19,22 @@
 */
 
 #include "config.h"
-
 #include "JSMimeTypeArray.h"
 
-#include <wtf/GetPtr.h>
-
-#include <runtime/PropertyNameArray.h>
 #include "AtomicString.h"
 #include "JSMimeType.h"
 #include "MimeType.h"
 #include "MimeTypeArray.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSMimeTypeArray)
+ASSERT_CLASS_FITS_IN_CELL(JSMimeTypeArray);
 
 /* Hash table */
 
@@ -74,13 +71,13 @@ public:
     JSMimeTypeArrayConstructor(ExecState* exec)
         : DOMObject(JSMimeTypeArrayConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSMimeTypeArrayPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSMimeTypeArrayPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +108,9 @@ static const HashTable JSMimeTypeArrayPrototypeTable =
 
 const ClassInfo JSMimeTypeArrayPrototype::s_info = { "MimeTypeArrayPrototype", 0, &JSMimeTypeArrayPrototypeTable, 0 };
 
-JSObject* JSMimeTypeArrayPrototype::self(ExecState* exec)
+JSObject* JSMimeTypeArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSMimeTypeArray>(exec);
+    return getDOMPrototype<JSMimeTypeArray>(exec, globalObject);
 }
 
 bool JSMimeTypeArrayPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,12 +129,11 @@ JSMimeTypeArray::JSMimeTypeArray(PassRefPtr<Structure> structure, PassRefPtr<Mim
 JSMimeTypeArray::~JSMimeTypeArray()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSMimeTypeArray::createPrototype(ExecState* exec)
+JSObject* JSMimeTypeArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSMimeTypeArrayPrototype(JSMimeTypeArrayPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSMimeTypeArrayPrototype(JSMimeTypeArrayPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSMimeTypeArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -169,13 +165,14 @@ bool JSMimeTypeArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName,
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsMimeTypeArrayLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMimeTypeArrayLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MimeTypeArray* imp = static_cast<MimeTypeArray*>(static_cast<JSMimeTypeArray*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsMimeTypeArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMimeTypeArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSMimeTypeArray*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
@@ -186,50 +183,52 @@ void JSMimeTypeArray::getPropertyNames(ExecState* exec, PropertyNameArray& prope
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSMimeTypeArray::getConstructor(ExecState* exec)
+JSValue JSMimeTypeArray::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSMimeTypeArrayConstructor>(exec);
 }
 
-JSValuePtr jsMimeTypeArrayPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMimeTypeArrayPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMimeTypeArray::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMimeTypeArray::s_info))
         return throwError(exec, TypeError);
     JSMimeTypeArray* castedThisObj = static_cast<JSMimeTypeArray*>(asObject(thisValue));
     MimeTypeArray* imp = static_cast<MimeTypeArray*>(castedThisObj->impl());
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->item(index)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
     return result;
 }
 
-JSValuePtr jsMimeTypeArrayPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMimeTypeArrayPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMimeTypeArray::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMimeTypeArray::s_info))
         return throwError(exec, TypeError);
     JSMimeTypeArray* castedThisObj = static_cast<JSMimeTypeArray*>(asObject(thisValue));
     MimeTypeArray* imp = static_cast<MimeTypeArray*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->namedItem(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->namedItem(name)));
     return result;
 }
 
 
-JSValuePtr JSMimeTypeArray::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSMimeTypeArray::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSMimeTypeArray* thisObj = static_cast<JSMimeTypeArray*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<MimeTypeArray*>(thisObj->impl())->item(slot.index()));
 }
-JSC::JSValuePtr toJS(JSC::ExecState* exec, MimeTypeArray* object)
+JSC::JSValue toJS(JSC::ExecState* exec, MimeTypeArray* object)
 {
     return getDOMObjectWrapper<JSMimeTypeArray>(exec, object);
 }
-MimeTypeArray* toMimeTypeArray(JSC::JSValuePtr value)
+MimeTypeArray* toMimeTypeArray(JSC::JSValue value)
 {
-    return value->isObject(&JSMimeTypeArray::s_info) ? static_cast<JSMimeTypeArray*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSMimeTypeArray::s_info) ? static_cast<JSMimeTypeArray*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h
index b261caf..adc4824 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMimeTypeArray.h
@@ -34,39 +34,40 @@ class JSMimeTypeArray : public DOMObject {
 public:
     JSMimeTypeArray(PassRefPtr<JSC::Structure>, PassRefPtr<MimeTypeArray>);
     virtual ~JSMimeTypeArray();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     MimeTypeArray* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<MimeTypeArray> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, MimeTypeArray*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, MimeTypeArray*);
-MimeTypeArray* toMimeTypeArray(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, MimeTypeArray*);
+MimeTypeArray* toMimeTypeArray(JSC::JSValue);
 
 class JSMimeTypeArrayPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -75,12 +76,12 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsMimeTypeArrayPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsMimeTypeArrayPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMimeTypeArrayPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMimeTypeArrayPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsMimeTypeArrayLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMimeTypeArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMimeTypeArrayLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMimeTypeArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp
index dd39497..6daf2ab 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.cpp
@@ -19,29 +19,25 @@
 */
 
 #include "config.h"
-
 #include "JSMouseEvent.h"
 
-#include <wtf/GetPtr.h>
-
 #include "Clipboard.h"
 #include "EventTarget.h"
 #include "JSClipboard.h"
 #include "JSDOMWindow.h"
 #include "JSEventTarget.h"
-#include "JSEventTargetNode.h"
 #include "JSNode.h"
 #include "MouseEvent.h"
 #include "Node.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSMouseEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSMouseEvent);
 
 /* Hash table */
 
@@ -94,13 +90,13 @@ public:
     JSMouseEventConstructor(ExecState* exec)
         : DOMObject(JSMouseEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSMouseEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSMouseEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -130,9 +126,9 @@ static const HashTable JSMouseEventPrototypeTable =
 
 const ClassInfo JSMouseEventPrototype::s_info = { "MouseEventPrototype", 0, &JSMouseEventPrototypeTable, 0 };
 
-JSObject* JSMouseEventPrototype::self(ExecState* exec)
+JSObject* JSMouseEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSMouseEvent>(exec);
+    return getDOMPrototype<JSMouseEvent>(exec, globalObject);
 }
 
 bool JSMouseEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -147,9 +143,9 @@ JSMouseEvent::JSMouseEvent(PassRefPtr<Structure> structure, PassRefPtr<MouseEven
 {
 }
 
-JSObject* JSMouseEvent::createPrototype(ExecState* exec)
+JSObject* JSMouseEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSMouseEventPrototype(JSMouseEventPrototype::createStructure(JSUIEventPrototype::self(exec)));
+    return new (exec) JSMouseEventPrototype(JSMouseEventPrototype::createStructure(JSUIEventPrototype::self(exec, globalObject)));
 }
 
 bool JSMouseEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -157,138 +153,156 @@ bool JSMouseEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSMouseEvent, Base>(exec, &JSMouseEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsMouseEventScreenX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventScreenX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->screenX());
 }
 
-JSValuePtr jsMouseEventScreenY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventScreenY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->screenY());
 }
 
-JSValuePtr jsMouseEventClientX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventClientX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->clientX());
 }
 
-JSValuePtr jsMouseEventClientY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventClientY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->clientY());
 }
 
-JSValuePtr jsMouseEventCtrlKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventCtrlKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->ctrlKey());
 }
 
-JSValuePtr jsMouseEventShiftKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventShiftKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->shiftKey());
 }
 
-JSValuePtr jsMouseEventAltKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventAltKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->altKey());
 }
 
-JSValuePtr jsMouseEventMetaKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventMetaKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->metaKey());
 }
 
-JSValuePtr jsMouseEventButton(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventButton(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->button());
 }
 
-JSValuePtr jsMouseEventRelatedTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventRelatedTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->relatedTarget()));
 }
 
-JSValuePtr jsMouseEventOffsetX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventOffsetX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->offsetX());
 }
 
-JSValuePtr jsMouseEventOffsetY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventOffsetY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->offsetY());
 }
 
-JSValuePtr jsMouseEventX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsMouseEventY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-JSValuePtr jsMouseEventFromElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventFromElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->fromElement()));
 }
 
-JSValuePtr jsMouseEventToElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventToElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->toElement()));
 }
 
-JSValuePtr jsMouseEventDataTransfer(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventDataTransfer(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MouseEvent* imp = static_cast<MouseEvent*>(static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->dataTransfer()));
 }
 
-JSValuePtr jsMouseEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMouseEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSMouseEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSMouseEvent::getConstructor(ExecState* exec)
+JSValue JSMouseEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSMouseEventConstructor>(exec);
 }
 
-JSValuePtr jsMouseEventPrototypeFunctionInitMouseEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMouseEventPrototypeFunctionInitMouseEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMouseEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMouseEvent::s_info))
         return throwError(exec, TypeError);
     JSMouseEvent* castedThisObj = static_cast<JSMouseEvent*>(asObject(thisValue));
     MouseEvent* imp = static_cast<MouseEvent*>(castedThisObj->impl());
-    const UString& type = args.at(exec, 0)->toString(exec);
-    bool canBubble = args.at(exec, 1)->toBoolean(exec);
-    bool cancelable = args.at(exec, 2)->toBoolean(exec);
-    DOMWindow* view = toDOMWindow(args.at(exec, 3));
-    int detail = args.at(exec, 4)->toInt32(exec);
-    int screenX = args.at(exec, 5)->toInt32(exec);
-    int screenY = args.at(exec, 6)->toInt32(exec);
-    int clientX = args.at(exec, 7)->toInt32(exec);
-    int clientY = args.at(exec, 8)->toInt32(exec);
-    bool ctrlKey = args.at(exec, 9)->toBoolean(exec);
-    bool altKey = args.at(exec, 10)->toBoolean(exec);
-    bool shiftKey = args.at(exec, 11)->toBoolean(exec);
-    bool metaKey = args.at(exec, 12)->toBoolean(exec);
-    unsigned short button = args.at(exec, 13)->toInt32(exec);
-    EventTargetNode* relatedTarget = toEventTargetNode(args.at(exec, 14));
+    const UString& type = args.at(0).toString(exec);
+    bool canBubble = args.at(1).toBoolean(exec);
+    bool cancelable = args.at(2).toBoolean(exec);
+    DOMWindow* view = toDOMWindow(args.at(3));
+    int detail = args.at(4).toInt32(exec);
+    int screenX = args.at(5).toInt32(exec);
+    int screenY = args.at(6).toInt32(exec);
+    int clientX = args.at(7).toInt32(exec);
+    int clientY = args.at(8).toInt32(exec);
+    bool ctrlKey = args.at(9).toBoolean(exec);
+    bool altKey = args.at(10).toBoolean(exec);
+    bool shiftKey = args.at(11).toBoolean(exec);
+    bool metaKey = args.at(12).toBoolean(exec);
+    unsigned short button = args.at(13).toInt32(exec);
+    EventTarget* relatedTarget = toEventTarget(args.at(14));
 
     imp->initMouseEvent(type, canBubble, cancelable, view, detail, screenX, screenY, clientX, clientY, ctrlKey, altKey, shiftKey, metaKey, button, relatedTarget);
     return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h
index 4109680..3730d93 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMouseEvent.h
@@ -31,27 +31,28 @@ class JSMouseEvent : public JSUIEvent {
     typedef JSUIEvent Base;
 public:
     JSMouseEvent(PassRefPtr<JSC::Structure>, PassRefPtr<MouseEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSMouseEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,27 +61,27 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsMouseEventPrototypeFunctionInitMouseEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMouseEventPrototypeFunctionInitMouseEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsMouseEventScreenX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventScreenY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventClientX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventClientY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventCtrlKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventShiftKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventAltKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventMetaKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventButton(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventRelatedTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventOffsetX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventOffsetY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventFromElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventToElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventDataTransfer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMouseEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventScreenX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventScreenY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventClientX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventClientY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventCtrlKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventShiftKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventAltKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventMetaKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventButton(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventRelatedTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventOffsetX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventOffsetY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventFromElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventToElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventDataTransfer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMouseEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp
index 6e38809..71d339e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.cpp
@@ -19,25 +19,22 @@
 */
 
 #include "config.h"
-
 #include "JSMutationEvent.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSNode.h"
 #include "KURL.h"
 #include "MutationEvent.h"
 #include "Node.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSMutationEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSMutationEvent);
 
 /* Hash table */
 
@@ -81,13 +78,13 @@ public:
     JSMutationEventConstructor(ExecState* exec)
         : DOMObject(JSMutationEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSMutationEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSMutationEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -120,9 +117,9 @@ static const HashTable JSMutationEventPrototypeTable =
 
 const ClassInfo JSMutationEventPrototype::s_info = { "MutationEventPrototype", 0, &JSMutationEventPrototypeTable, 0 };
 
-JSObject* JSMutationEventPrototype::self(ExecState* exec)
+JSObject* JSMutationEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSMutationEvent>(exec);
+    return getDOMPrototype<JSMutationEvent>(exec, globalObject);
 }
 
 bool JSMutationEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -137,9 +134,9 @@ JSMutationEvent::JSMutationEvent(PassRefPtr<Structure> structure, PassRefPtr<Mut
 {
 }
 
-JSObject* JSMutationEvent::createPrototype(ExecState* exec)
+JSObject* JSMutationEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSMutationEventPrototype(JSMutationEventPrototype::createStructure(JSEventPrototype::self(exec)));
+    return new (exec) JSMutationEventPrototype(JSMutationEventPrototype::createStructure(JSEventPrototype::self(exec, globalObject)));
 }
 
 bool JSMutationEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -147,59 +144,65 @@ bool JSMutationEvent::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSMutationEvent, Base>(exec, &JSMutationEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsMutationEventRelatedNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMutationEventRelatedNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MutationEvent* imp = static_cast<MutationEvent*>(static_cast<JSMutationEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->relatedNode()));
 }
 
-JSValuePtr jsMutationEventPrevValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMutationEventPrevValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MutationEvent* imp = static_cast<MutationEvent*>(static_cast<JSMutationEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->prevValue());
 }
 
-JSValuePtr jsMutationEventNewValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMutationEventNewValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MutationEvent* imp = static_cast<MutationEvent*>(static_cast<JSMutationEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->newValue());
 }
 
-JSValuePtr jsMutationEventAttrName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMutationEventAttrName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MutationEvent* imp = static_cast<MutationEvent*>(static_cast<JSMutationEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->attrName());
 }
 
-JSValuePtr jsMutationEventAttrChange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMutationEventAttrChange(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     MutationEvent* imp = static_cast<MutationEvent*>(static_cast<JSMutationEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->attrChange());
 }
 
-JSValuePtr jsMutationEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsMutationEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSMutationEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSMutationEvent::getConstructor(ExecState* exec)
+JSValue JSMutationEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSMutationEventConstructor>(exec);
 }
 
-JSValuePtr jsMutationEventPrototypeFunctionInitMutationEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsMutationEventPrototypeFunctionInitMutationEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSMutationEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSMutationEvent::s_info))
         return throwError(exec, TypeError);
     JSMutationEvent* castedThisObj = static_cast<JSMutationEvent*>(asObject(thisValue));
     MutationEvent* imp = static_cast<MutationEvent*>(castedThisObj->impl());
-    const UString& type = args.at(exec, 0)->toString(exec);
-    bool canBubble = args.at(exec, 1)->toBoolean(exec);
-    bool cancelable = args.at(exec, 2)->toBoolean(exec);
-    Node* relatedNode = toNode(args.at(exec, 3));
-    const UString& prevValue = args.at(exec, 4)->toString(exec);
-    const UString& newValue = args.at(exec, 5)->toString(exec);
-    const UString& attrName = args.at(exec, 6)->toString(exec);
-    unsigned short attrChange = args.at(exec, 7)->toInt32(exec);
+    const UString& type = args.at(0).toString(exec);
+    bool canBubble = args.at(1).toBoolean(exec);
+    bool cancelable = args.at(2).toBoolean(exec);
+    Node* relatedNode = toNode(args.at(3));
+    const UString& prevValue = args.at(4).toString(exec);
+    const UString& newValue = args.at(5).toString(exec);
+    const UString& attrName = args.at(6).toString(exec);
+    unsigned short attrChange = args.at(7).toInt32(exec);
 
     imp->initMutationEvent(type, canBubble, cancelable, relatedNode, prevValue, newValue, attrName, attrChange);
     return jsUndefined();
@@ -207,17 +210,17 @@ JSValuePtr jsMutationEventPrototypeFunctionInitMutationEvent(ExecState* exec, JS
 
 // Constant getters
 
-JSValuePtr jsMutationEventMODIFICATION(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsMutationEventMODIFICATION(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsMutationEventADDITION(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsMutationEventADDITION(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsMutationEventREMOVAL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsMutationEventREMOVAL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h
index 15b9111..7948398 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSMutationEvent.h
@@ -31,27 +31,28 @@ class JSMutationEvent : public JSEvent {
     typedef JSEvent Base;
 public:
     JSMutationEvent(PassRefPtr<JSC::Structure>, PassRefPtr<MutationEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSMutationEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,20 +61,20 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsMutationEventPrototypeFunctionInitMutationEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsMutationEventPrototypeFunctionInitMutationEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsMutationEventRelatedNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMutationEventPrevValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMutationEventNewValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMutationEventAttrName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMutationEventAttrChange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMutationEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMutationEventRelatedNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMutationEventPrevValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMutationEventNewValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMutationEventAttrName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMutationEventAttrChange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMutationEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsMutationEventMODIFICATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMutationEventADDITION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsMutationEventREMOVAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMutationEventMODIFICATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMutationEventADDITION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsMutationEventREMOVAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
index 8711522..9c6a5a9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.cpp
@@ -19,25 +19,22 @@
 */
 
 #include "config.h"
-
 #include "JSNamedNodeMap.h"
 
-#include <wtf/GetPtr.h>
-
-#include <runtime/PropertyNameArray.h>
 #include "AtomicString.h"
 #include "JSNode.h"
 #include "NamedNodeMap.h"
 #include "Node.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSNamedNodeMap)
+ASSERT_CLASS_FITS_IN_CELL(JSNamedNodeMap);
 
 /* Hash table */
 
@@ -74,13 +71,13 @@ public:
     JSNamedNodeMapConstructor(ExecState* exec)
         : DOMObject(JSNamedNodeMapConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSNamedNodeMapPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSNamedNodeMapPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -116,9 +113,9 @@ static const HashTable JSNamedNodeMapPrototypeTable =
 
 const ClassInfo JSNamedNodeMapPrototype::s_info = { "NamedNodeMapPrototype", 0, &JSNamedNodeMapPrototypeTable, 0 };
 
-JSObject* JSNamedNodeMapPrototype::self(ExecState* exec)
+JSObject* JSNamedNodeMapPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSNamedNodeMap>(exec);
+    return getDOMPrototype<JSNamedNodeMap>(exec, globalObject);
 }
 
 bool JSNamedNodeMapPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -137,18 +134,17 @@ JSNamedNodeMap::JSNamedNodeMap(PassRefPtr<Structure> structure, PassRefPtr<Named
 JSNamedNodeMap::~JSNamedNodeMap()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSNamedNodeMap::createPrototype(ExecState* exec)
+JSObject* JSNamedNodeMap::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSNamedNodeMapPrototype(JSNamedNodeMapPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSNamedNodeMapPrototype(JSNamedNodeMapPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSNamedNodeMap::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    JSValuePtr proto = prototype();
-    if (proto->isObject() && static_cast<JSObject*>(asObject(proto))->hasProperty(exec, propertyName))
+    JSValue proto = prototype();
+    if (proto.isObject() && static_cast<JSObject*>(asObject(proto))->hasProperty(exec, propertyName))
         return false;
 
     const HashEntry* entry = JSNamedNodeMapTable.entry(exec, propertyName);
@@ -178,13 +174,14 @@ bool JSNamedNodeMap::getOwnPropertySlot(ExecState* exec, unsigned propertyName,
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsNamedNodeMapLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNamedNodeMapLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(static_cast<JSNamedNodeMap*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsNamedNodeMapConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNamedNodeMapConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSNamedNodeMap*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
@@ -195,125 +192,132 @@ void JSNamedNodeMap::getPropertyNames(ExecState* exec, PropertyNameArray& proper
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSNamedNodeMap::getConstructor(ExecState* exec)
+JSValue JSNamedNodeMap::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSNamedNodeMapConstructor>(exec);
 }
 
-JSValuePtr jsNamedNodeMapPrototypeFunctionGetNamedItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionGetNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNamedNodeMap::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNamedNodeMap::s_info))
         return throwError(exec, TypeError);
     JSNamedNodeMap* castedThisObj = static_cast<JSNamedNodeMap*>(asObject(thisValue));
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getNamedItem(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getNamedItem(name)));
     return result;
 }
 
-JSValuePtr jsNamedNodeMapPrototypeFunctionSetNamedItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionSetNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNamedNodeMap::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNamedNodeMap::s_info))
         return throwError(exec, TypeError);
     JSNamedNodeMap* castedThisObj = static_cast<JSNamedNodeMap*>(asObject(thisValue));
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* node = toNode(args.at(exec, 0));
+    Node* node = toNode(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->setNamedItem(node, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->setNamedItem(node, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsNamedNodeMapPrototypeFunctionRemoveNamedItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionRemoveNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNamedNodeMap::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNamedNodeMap::s_info))
         return throwError(exec, TypeError);
     JSNamedNodeMap* castedThisObj = static_cast<JSNamedNodeMap*>(asObject(thisValue));
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->removeNamedItem(name, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->removeNamedItem(name, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsNamedNodeMapPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNamedNodeMap::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNamedNodeMap::s_info))
         return throwError(exec, TypeError);
     JSNamedNodeMap* castedThisObj = static_cast<JSNamedNodeMap*>(asObject(thisValue));
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThisObj->impl());
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->item(index)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
     return result;
 }
 
-JSValuePtr jsNamedNodeMapPrototypeFunctionGetNamedItemNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionGetNamedItemNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNamedNodeMap::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNamedNodeMap::s_info))
         return throwError(exec, TypeError);
     JSNamedNodeMap* castedThisObj = static_cast<JSNamedNodeMap*>(asObject(thisValue));
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThisObj->impl());
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    const UString& localName = args.at(exec, 1)->toString(exec);
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    const UString& localName = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getNamedItemNS(namespaceURI, localName)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getNamedItemNS(namespaceURI, localName)));
     return result;
 }
 
-JSValuePtr jsNamedNodeMapPrototypeFunctionSetNamedItemNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionSetNamedItemNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNamedNodeMap::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNamedNodeMap::s_info))
         return throwError(exec, TypeError);
     JSNamedNodeMap* castedThisObj = static_cast<JSNamedNodeMap*>(asObject(thisValue));
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* node = toNode(args.at(exec, 0));
+    Node* node = toNode(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->setNamedItemNS(node, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->setNamedItemNS(node, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsNamedNodeMapPrototypeFunctionRemoveNamedItemNS(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionRemoveNamedItemNS(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNamedNodeMap::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNamedNodeMap::s_info))
         return throwError(exec, TypeError);
     JSNamedNodeMap* castedThisObj = static_cast<JSNamedNodeMap*>(asObject(thisValue));
     NamedNodeMap* imp = static_cast<NamedNodeMap*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
-    const UString& localName = args.at(exec, 1)->toString(exec);
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
+    const UString& localName = args.at(1).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->removeNamedItemNS(namespaceURI, localName, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->removeNamedItemNS(namespaceURI, localName, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
 
-JSValuePtr JSNamedNodeMap::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSNamedNodeMap::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSNamedNodeMap* thisObj = static_cast<JSNamedNodeMap*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<NamedNodeMap*>(thisObj->impl())->item(slot.index()));
 }
-JSC::JSValuePtr toJS(JSC::ExecState* exec, NamedNodeMap* object)
+JSC::JSValue toJS(JSC::ExecState* exec, NamedNodeMap* object)
 {
     return getDOMObjectWrapper<JSNamedNodeMap>(exec, object);
 }
-NamedNodeMap* toNamedNodeMap(JSC::JSValuePtr value)
+NamedNodeMap* toNamedNodeMap(JSC::JSValue value)
 {
-    return value->isObject(&JSNamedNodeMap::s_info) ? static_cast<JSNamedNodeMap*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSNamedNodeMap::s_info) ? static_cast<JSNamedNodeMap*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
index c58efe5..f7c132e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNamedNodeMap.h
@@ -34,39 +34,40 @@ class JSNamedNodeMap : public DOMObject {
 public:
     JSNamedNodeMap(PassRefPtr<JSC::Structure>, PassRefPtr<NamedNodeMap>);
     virtual ~JSNamedNodeMap();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     NamedNodeMap* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<NamedNodeMap> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, NamedNodeMap*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, NamedNodeMap*);
-NamedNodeMap* toNamedNodeMap(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, NamedNodeMap*);
+NamedNodeMap* toNamedNodeMap(JSC::JSValue);
 
 class JSNamedNodeMapPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -75,17 +76,17 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsNamedNodeMapPrototypeFunctionGetNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNamedNodeMapPrototypeFunctionSetNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNamedNodeMapPrototypeFunctionRemoveNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNamedNodeMapPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNamedNodeMapPrototypeFunctionGetNamedItemNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNamedNodeMapPrototypeFunctionSetNamedItemNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNamedNodeMapPrototypeFunctionRemoveNamedItemNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionGetNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionSetNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionRemoveNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionGetNamedItemNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionSetNamedItemNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNamedNodeMapPrototypeFunctionRemoveNamedItemNS(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsNamedNodeMapLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNamedNodeMapConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNamedNodeMapLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNamedNodeMapConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp b/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp
index 441510f..feefecc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNavigator.cpp
@@ -19,26 +19,23 @@
 */
 
 #include "config.h"
-
 #include "JSNavigator.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSMimeTypeArray.h"
 #include "JSPluginArray.h"
 #include "KURL.h"
 #include "MimeTypeArray.h"
 #include "Navigator.h"
 #include "PluginArray.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSNavigator)
+ASSERT_CLASS_FITS_IN_CELL(JSNavigator);
 
 /* Hash table */
 
@@ -85,9 +82,9 @@ static const HashTable JSNavigatorPrototypeTable =
 
 const ClassInfo JSNavigatorPrototype::s_info = { "NavigatorPrototype", 0, &JSNavigatorPrototypeTable, 0 };
 
-JSObject* JSNavigatorPrototype::self(ExecState* exec)
+JSObject* JSNavigatorPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSNavigator>(exec);
+    return getDOMPrototype<JSNavigator>(exec, globalObject);
 }
 
 bool JSNavigatorPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -106,12 +103,11 @@ JSNavigator::JSNavigator(PassRefPtr<Structure> structure, PassRefPtr<Navigator>
 JSNavigator::~JSNavigator()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSNavigator::createPrototype(ExecState* exec)
+JSObject* JSNavigator::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSNavigatorPrototype(JSNavigatorPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSNavigatorPrototype(JSNavigatorPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSNavigator::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -119,108 +115,124 @@ bool JSNavigator::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSNavigator, Base>(exec, &JSNavigatorTable, this, propertyName, slot);
 }
 
-JSValuePtr jsNavigatorAppCodeName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorAppCodeName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->appCodeName());
 }
 
-JSValuePtr jsNavigatorAppName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorAppName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->appName());
 }
 
-JSValuePtr jsNavigatorAppVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorAppVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
-    return static_cast<JSNavigator*>(asObject(slot.slotBase()))->appVersion(exec);
+    UNUSED_PARAM(exec);
+    Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
+    return jsString(exec, imp->appVersion());
 }
 
-JSValuePtr jsNavigatorLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->language());
 }
 
-JSValuePtr jsNavigatorUserAgent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorUserAgent(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->userAgent());
 }
 
-JSValuePtr jsNavigatorPlatform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorPlatform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->platform());
 }
 
-JSValuePtr jsNavigatorPlugins(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorPlugins(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->plugins()));
 }
 
-JSValuePtr jsNavigatorMimeTypes(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorMimeTypes(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->mimeTypes()));
 }
 
-JSValuePtr jsNavigatorProduct(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorProduct(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->product());
 }
 
-JSValuePtr jsNavigatorProductSub(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorProductSub(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->productSub());
 }
 
-JSValuePtr jsNavigatorVendor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorVendor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->vendor());
 }
 
-JSValuePtr jsNavigatorVendorSub(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorVendorSub(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->vendorSub());
 }
 
-JSValuePtr jsNavigatorCookieEnabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorCookieEnabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->cookieEnabled());
 }
 
-JSValuePtr jsNavigatorOnLine(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNavigatorOnLine(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Navigator* imp = static_cast<Navigator*>(static_cast<JSNavigator*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->onLine());
 }
 
-JSValuePtr jsNavigatorPrototypeFunctionJavaEnabled(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNavigatorPrototypeFunctionJavaEnabled(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNavigator::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNavigator::s_info))
         return throwError(exec, TypeError);
     JSNavigator* castedThisObj = static_cast<JSNavigator*>(asObject(thisValue));
     Navigator* imp = static_cast<Navigator*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->javaEnabled());
+    JSC::JSValue result = jsBoolean(imp->javaEnabled());
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Navigator* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Navigator* object)
 {
     return getDOMObjectWrapper<JSNavigator>(exec, object);
 }
-Navigator* toNavigator(JSC::JSValuePtr value)
+Navigator* toNavigator(JSC::JSValue value)
 {
-    return value->isObject(&JSNavigator::s_info) ? static_cast<JSNavigator*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSNavigator::s_info) ? static_cast<JSNavigator*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNavigator.h b/src/3rdparty/webkit/WebCore/generated/JSNavigator.h
index fbbdd31..0a3a5df 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNavigator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNavigator.h
@@ -34,37 +34,35 @@ class JSNavigator : public DOMObject {
 public:
     JSNavigator(PassRefPtr<JSC::Structure>, PassRefPtr<Navigator>);
     virtual ~JSNavigator();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void mark();
 
-
-    // Custom attributes
-    JSC::JSValuePtr appVersion(JSC::ExecState*) const;
     Navigator* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Navigator> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Navigator*);
-Navigator* toNavigator(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Navigator*);
+Navigator* toNavigator(JSC::JSValue);
 
 class JSNavigatorPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -73,23 +71,23 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsNavigatorPrototypeFunctionJavaEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNavigatorPrototypeFunctionJavaEnabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsNavigatorAppCodeName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorAppName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorAppVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorUserAgent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorPlatform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorPlugins(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorMimeTypes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorProduct(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorProductSub(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorVendor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorVendorSub(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorCookieEnabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNavigatorOnLine(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorAppCodeName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorAppName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorAppVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorUserAgent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorPlatform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorPlugins(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorMimeTypes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorProduct(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorProductSub(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorVendor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorVendorSub(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorCookieEnabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNavigatorOnLine(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNode.cpp b/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
index aa8fb00..fda843c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNode.cpp
@@ -19,31 +19,32 @@
 */
 
 #include "config.h"
-
 #include "JSNode.h"
 
-#include <wtf/GetPtr.h>
-
 #include "Document.h"
+#include "Element.h"
+#include "Event.h"
 #include "JSDocument.h"
+#include "JSElement.h"
+#include "JSEvent.h"
 #include "JSNamedNodeMap.h"
 #include "JSNode.h"
 #include "JSNodeList.h"
 #include "KURL.h"
 #include "NameNodeList.h"
-#include "NamedAttrMap.h"
 #include "NamedNodeMap.h"
 #include "Node.h"
 #include "NodeList.h"
-
+#include "RegisteredEventListener.h"
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSNode)
+ASSERT_CLASS_FITS_IN_CELL(JSNode);
 
 /* Hash table */
 
@@ -114,13 +115,13 @@ public:
     JSNodeConstructor(ExecState* exec)
         : DOMObject(JSNodeConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSNodePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSNodePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -135,7 +136,7 @@ bool JSNodeConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& pr
 
 /* Hash table for prototype */
 
-static const HashTableValue JSNodePrototypeTableValues[34] =
+static const HashTableValue JSNodePrototypeTableValues[37] =
 {
     { "ELEMENT_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeELEMENT_NODE, (intptr_t)0 },
     { "ATTRIBUTE_NODE", DontDelete|ReadOnly, (intptr_t)jsNodeATTRIBUTE_NODE, (intptr_t)0 },
@@ -170,6 +171,9 @@ static const HashTableValue JSNodePrototypeTableValues[34] =
     { "isDefaultNamespace", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionIsDefaultNamespace, (intptr_t)1 },
     { "lookupNamespaceURI", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionLookupNamespaceURI, (intptr_t)1 },
     { "compareDocumentPosition", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionCompareDocumentPosition, (intptr_t)1 },
+    { "addEventListener", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionAddEventListener, (intptr_t)3 },
+    { "removeEventListener", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionRemoveEventListener, (intptr_t)3 },
+    { "dispatchEvent", DontDelete|Function, (intptr_t)jsNodePrototypeFunctionDispatchEvent, (intptr_t)1 },
     { 0, 0, 0, 0 }
 };
 
@@ -182,9 +186,9 @@ static const HashTable JSNodePrototypeTable =
 
 const ClassInfo JSNodePrototype::s_info = { "NodePrototype", 0, &JSNodePrototypeTable, 0 };
 
-JSObject* JSNodePrototype::self(ExecState* exec)
+JSObject* JSNodePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSNode>(exec);
+    return getDOMPrototype<JSNode>(exec, globalObject);
 }
 
 bool JSNodePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -202,127 +206,144 @@ JSNode::JSNode(PassRefPtr<Structure> structure, PassRefPtr<Node> impl)
 
 JSNode::~JSNode()
 {
+    invalidateEventListeners(m_impl->eventListeners());
     forgetDOMNode(m_impl->document(), m_impl.get());
-
 }
 
-JSObject* JSNode::createPrototype(ExecState* exec)
+JSObject* JSNode::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSNodePrototype(JSNodePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSNodePrototype(JSNodePrototype::createStructure(globalObject->objectPrototype()));
 }
 
-JSValuePtr jsNodeNodeName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeNodeName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->nodeName());
 }
 
-JSValuePtr jsNodeNodeValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeNodeValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->nodeValue());
 }
 
-JSValuePtr jsNodeNodeType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeNodeType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->nodeType());
 }
 
-JSValuePtr jsNodeParentNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeParentNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->parentNode()));
 }
 
-JSValuePtr jsNodeChildNodes(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeChildNodes(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->childNodes()));
 }
 
-JSValuePtr jsNodeFirstChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeFirstChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->firstChild()));
 }
 
-JSValuePtr jsNodeLastChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeLastChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->lastChild()));
 }
 
-JSValuePtr jsNodePreviousSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodePreviousSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->previousSibling()));
 }
 
-JSValuePtr jsNodeNextSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeNextSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nextSibling()));
 }
 
-JSValuePtr jsNodeAttributes(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeAttributes(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->attributes()));
 }
 
-JSValuePtr jsNodeOwnerDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeOwnerDocument(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->ownerDocument()));
 }
 
-JSValuePtr jsNodeNamespaceURI(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeNamespaceURI(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->namespaceURI());
 }
 
-JSValuePtr jsNodePrefix(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodePrefix(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->prefix());
 }
 
-JSValuePtr jsNodeLocalName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeLocalName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->localName());
 }
 
-JSValuePtr jsNodeBaseURI(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeBaseURI(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->baseURI());
 }
 
-JSValuePtr jsNodeTextContent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeTextContent(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->textContent());
 }
 
-JSValuePtr jsNodeParentElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeParentElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->parentElement()));
 }
 
-JSValuePtr jsNodeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSNode*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSNode::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSNode::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSNode, Base>(exec, propertyName, value, &JSNodeTable, this, slot);
 }
 
-void setJSNodeNodeValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSNodeNodeValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -330,7 +351,7 @@ void setJSNodeNodeValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
     setDOMException(exec, ec);
 }
 
-void setJSNodePrefix(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSNodePrefix(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -338,7 +359,7 @@ void setJSNodePrefix(ExecState* exec, JSObject* thisObject, JSValuePtr value)
     setDOMException(exec, ec);
 }
 
-void setJSNodeTextContent(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSNodeTextContent(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     Node* imp = static_cast<Node*>(static_cast<JSNode*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -346,71 +367,78 @@ void setJSNodeTextContent(ExecState* exec, JSObject* thisObject, JSValuePtr valu
     setDOMException(exec, ec);
 }
 
-JSValuePtr JSNode::getConstructor(ExecState* exec)
+JSValue JSNode::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSNodeConstructor>(exec);
 }
 
-JSValuePtr jsNodePrototypeFunctionInsertBefore(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionInsertBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     return castedThisObj->insertBefore(exec, args);
 }
 
-JSValuePtr jsNodePrototypeFunctionReplaceChild(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionReplaceChild(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     return castedThisObj->replaceChild(exec, args);
 }
 
-JSValuePtr jsNodePrototypeFunctionRemoveChild(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionRemoveChild(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     return castedThisObj->removeChild(exec, args);
 }
 
-JSValuePtr jsNodePrototypeFunctionAppendChild(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionAppendChild(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     return castedThisObj->appendChild(exec, args);
 }
 
-JSValuePtr jsNodePrototypeFunctionHasChildNodes(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionHasChildNodes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasChildNodes());
+    JSC::JSValue result = jsBoolean(imp->hasChildNodes());
     return result;
 }
 
-JSValuePtr jsNodePrototypeFunctionCloneNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionCloneNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
-    bool deep = args.at(exec, 0)->toBoolean(exec);
+    bool deep = args.at(0).toBoolean(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->cloneNode(deep)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->cloneNode(deep)));
     return result;
 }
 
-JSValuePtr jsNodePrototypeFunctionNormalize(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionNormalize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
@@ -419,205 +447,247 @@ JSValuePtr jsNodePrototypeFunctionNormalize(ExecState* exec, JSObject*, JSValueP
     return jsUndefined();
 }
 
-JSValuePtr jsNodePrototypeFunctionIsSupported(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsSupported(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
-    const UString& feature = args.at(exec, 0)->toString(exec);
-    const UString& version = valueToStringWithNullCheck(exec, args.at(exec, 1));
+    const UString& feature = args.at(0).toString(exec);
+    const UString& version = valueToStringWithNullCheck(exec, args.at(1));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->isSupported(feature, version));
+    JSC::JSValue result = jsBoolean(imp->isSupported(feature, version));
     return result;
 }
 
-JSValuePtr jsNodePrototypeFunctionHasAttributes(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionHasAttributes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasAttributes());
+    JSC::JSValue result = jsBoolean(imp->hasAttributes());
     return result;
 }
 
-JSValuePtr jsNodePrototypeFunctionIsSameNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsSameNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
-    Node* other = toNode(args.at(exec, 0));
+    Node* other = toNode(args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->isSameNode(other));
+    JSC::JSValue result = jsBoolean(imp->isSameNode(other));
     return result;
 }
 
-JSValuePtr jsNodePrototypeFunctionIsEqualNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsEqualNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
-    Node* other = toNode(args.at(exec, 0));
+    Node* other = toNode(args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->isEqualNode(other));
+    JSC::JSValue result = jsBoolean(imp->isEqualNode(other));
     return result;
 }
 
-JSValuePtr jsNodePrototypeFunctionLookupPrefix(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionLookupPrefix(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->lookupPrefix(namespaceURI));
+    JSC::JSValue result = jsStringOrNull(exec, imp->lookupPrefix(namespaceURI));
     return result;
 }
 
-JSValuePtr jsNodePrototypeFunctionIsDefaultNamespace(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsDefaultNamespace(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
-    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(exec, 0));
+    const UString& namespaceURI = valueToStringWithNullCheck(exec, args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->isDefaultNamespace(namespaceURI));
+    JSC::JSValue result = jsBoolean(imp->isDefaultNamespace(namespaceURI));
     return result;
 }
 
-JSValuePtr jsNodePrototypeFunctionLookupNamespaceURI(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionLookupNamespaceURI(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
-    const UString& prefix = valueToStringWithNullCheck(exec, args.at(exec, 0));
+    const UString& prefix = valueToStringWithNullCheck(exec, args.at(0));
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->lookupNamespaceURI(prefix));
+    JSC::JSValue result = jsStringOrNull(exec, imp->lookupNamespaceURI(prefix));
     return result;
 }
 
-JSValuePtr jsNodePrototypeFunctionCompareDocumentPosition(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionCompareDocumentPosition(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNode::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
         return throwError(exec, TypeError);
     JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
     Node* imp = static_cast<Node*>(castedThisObj->impl());
-    Node* other = toNode(args.at(exec, 0));
+    Node* other = toNode(args.at(0));
+
 
+    JSC::JSValue result = jsNumber(exec, imp->compareDocumentPosition(other));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
+        return throwError(exec, TypeError);
+    JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
+    return castedThisObj->addEventListener(exec, args);
+}
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->compareDocumentPosition(other));
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
+        return throwError(exec, TypeError);
+    JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
+    return castedThisObj->removeEventListener(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsNodePrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNode::s_info))
+        return throwError(exec, TypeError);
+    JSNode* castedThisObj = static_cast<JSNode*>(asObject(thisValue));
+    Node* imp = static_cast<Node*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    Event* event = toEvent(args.at(0));
+
+
+    JSC::JSValue result = jsBoolean(imp->dispatchEvent(event, ec));
+    setDOMException(exec, ec);
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsNodeELEMENT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeELEMENT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsNodeATTRIBUTE_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeATTRIBUTE_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsNodeTEXT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeTEXT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsNodeCDATA_SECTION_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeCDATA_SECTION_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsNodeENTITY_REFERENCE_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeENTITY_REFERENCE_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValuePtr jsNodeENTITY_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeENTITY_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValuePtr jsNodePROCESSING_INSTRUCTION_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodePROCESSING_INSTRUCTION_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValuePtr jsNodeCOMMENT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeCOMMENT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValuePtr jsNodeDOCUMENT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSValuePtr jsNodeDOCUMENT_TYPE_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_TYPE_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(10));
 }
 
-JSValuePtr jsNodeDOCUMENT_FRAGMENT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_FRAGMENT_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(11));
 }
 
-JSValuePtr jsNodeNOTATION_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeNOTATION_NODE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(12));
 }
 
-JSValuePtr jsNodeDOCUMENT_POSITION_DISCONNECTED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_POSITION_DISCONNECTED(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x01));
 }
 
-JSValuePtr jsNodeDOCUMENT_POSITION_PRECEDING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_POSITION_PRECEDING(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x02));
 }
 
-JSValuePtr jsNodeDOCUMENT_POSITION_FOLLOWING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_POSITION_FOLLOWING(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x04));
 }
 
-JSValuePtr jsNodeDOCUMENT_POSITION_CONTAINS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_POSITION_CONTAINS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x08));
 }
 
-JSValuePtr jsNodeDOCUMENT_POSITION_CONTAINED_BY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_POSITION_CONTAINED_BY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x10));
 }
 
-JSValuePtr jsNodeDOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeDOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x20));
 }
 
-Node* toNode(JSC::JSValuePtr value)
+Node* toNode(JSC::JSValue value)
 {
-    return value->isObject(&JSNode::s_info) ? static_cast<JSNode*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSNode::s_info) ? static_cast<JSNode*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNode.h b/src/3rdparty/webkit/WebCore/generated/JSNode.h
index 6cb1f0d..3fdc5a3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNode.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNode.h
@@ -23,9 +23,8 @@
 
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
-#include <runtime/ObjectPrototype.h>
-#include "EventTargetNode.h"
 #include <runtime/Lookup.h>
+#include <runtime/ObjectPrototype.h>
 #include <wtf/AlwaysInline.h>
 
 namespace WebCore {
@@ -37,26 +36,30 @@ class JSNode : public DOMObject {
 public:
     JSNode(PassRefPtr<JSC::Structure>, PassRefPtr<Node>);
     virtual ~JSNode();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void mark();
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    virtual void pushEventHandlerScope(JSC::ExecState*, JSC::ScopeChain&) const;
+
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom functions
-    JSC::JSValuePtr insertBefore(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr replaceChild(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeChild(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr appendChild(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue insertBefore(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue replaceChild(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeChild(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue appendChild(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
     Node* impl() const { return m_impl.get(); }
 
 private:
@@ -68,18 +71,18 @@ ALWAYS_INLINE bool JSNode::getOwnPropertySlot(JSC::ExecState* exec, const JSC::I
     return JSC::getStaticValueSlot<JSNode, Base>(exec, s_info.staticPropHashTable, this, propertyName, slot);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Node*);
-inline JSC::JSValuePtr toJS(JSC::ExecState* exec, EventTargetNode* node) { return toJS(exec, static_cast<Node*>(node)); }
-Node* toNode(JSC::JSValuePtr);
-JSC::JSValuePtr toJSNewlyCreated(JSC::ExecState*, Node*);
+JSC::JSValue toJS(JSC::ExecState*, Node*);
+Node* toNode(JSC::JSValue);
+JSC::JSValue toJSNewlyCreated(JSC::ExecState*, Node*);
 
 class JSNodePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -88,64 +91,67 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsNodePrototypeFunctionInsertBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionReplaceChild(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionRemoveChild(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionAppendChild(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionHasChildNodes(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionCloneNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionNormalize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionIsSupported(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionHasAttributes(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionIsSameNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionIsEqualNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionLookupPrefix(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionIsDefaultNamespace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionLookupNamespaceURI(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodePrototypeFunctionCompareDocumentPosition(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionInsertBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionReplaceChild(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionRemoveChild(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionAppendChild(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionHasChildNodes(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionCloneNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionNormalize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsSupported(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionHasAttributes(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsSameNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsEqualNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionLookupPrefix(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionIsDefaultNamespace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionLookupNamespaceURI(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionCompareDocumentPosition(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodePrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsNodeNodeName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeNodeValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSNodeNodeValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsNodeNodeType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeParentNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeChildNodes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFirstChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeLastChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodePreviousSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeNextSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeAttributes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeOwnerDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeNamespaceURI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodePrefix(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSNodePrefix(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsNodeLocalName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeBaseURI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeTextContent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSNodeTextContent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsNodeParentElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeNodeName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeNodeValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeNodeValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeNodeType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeParentNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeChildNodes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFirstChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeLastChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodePreviousSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeNextSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeAttributes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeOwnerDocument(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeNamespaceURI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodePrefix(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodePrefix(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeLocalName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeBaseURI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeTextContent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSNodeTextContent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsNodeParentElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsNodeELEMENT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeATTRIBUTE_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeTEXT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeCDATA_SECTION_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeENTITY_REFERENCE_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeENTITY_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodePROCESSING_INSTRUCTION_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeCOMMENT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeDOCUMENT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeDOCUMENT_TYPE_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeDOCUMENT_FRAGMENT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeNOTATION_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeDOCUMENT_POSITION_DISCONNECTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeDOCUMENT_POSITION_PRECEDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeDOCUMENT_POSITION_FOLLOWING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeDOCUMENT_POSITION_CONTAINS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeDOCUMENT_POSITION_CONTAINED_BY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeDOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeELEMENT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeATTRIBUTE_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeTEXT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeCDATA_SECTION_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeENTITY_REFERENCE_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeENTITY_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodePROCESSING_INSTRUCTION_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeCOMMENT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeDOCUMENT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeDOCUMENT_TYPE_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeDOCUMENT_FRAGMENT_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeNOTATION_NODE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeDOCUMENT_POSITION_DISCONNECTED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeDOCUMENT_POSITION_PRECEDING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeDOCUMENT_POSITION_FOLLOWING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeDOCUMENT_POSITION_CONTAINS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeDOCUMENT_POSITION_CONTAINED_BY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeDOCUMENT_POSITION_IMPLEMENTATION_SPECIFIC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
index 2492f63..3084eed 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.cpp
@@ -19,21 +19,17 @@
 */
 
 #include "config.h"
-
 #include "JSNodeFilter.h"
 
-#include <wtf/GetPtr.h>
-
 #include "NodeFilter.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSNodeFilter)
+ASSERT_CLASS_FITS_IN_CELL(JSNodeFilter);
 
 /* Hash table */
 
@@ -85,13 +81,13 @@ public:
     JSNodeFilterConstructor(ExecState* exec)
         : DOMObject(JSNodeFilterConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSNodeFilterPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSNodeFilterPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -137,9 +133,9 @@ static const HashTable JSNodeFilterPrototypeTable =
 
 const ClassInfo JSNodeFilterPrototype::s_info = { "NodeFilterPrototype", 0, &JSNodeFilterPrototypeTable, 0 };
 
-JSObject* JSNodeFilterPrototype::self(ExecState* exec)
+JSObject* JSNodeFilterPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSNodeFilter>(exec);
+    return getDOMPrototype<JSNodeFilter>(exec, globalObject);
 }
 
 bool JSNodeFilterPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -158,12 +154,11 @@ JSNodeFilter::JSNodeFilter(PassRefPtr<Structure> structure, PassRefPtr<NodeFilte
 JSNodeFilter::~JSNodeFilter()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSNodeFilter::createPrototype(ExecState* exec)
+JSObject* JSNodeFilter::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSNodeFilterPrototype(JSNodeFilterPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSNodeFilterPrototype(JSNodeFilterPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSNodeFilter::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -171,18 +166,19 @@ bool JSNodeFilter::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSNodeFilter, Base>(exec, &JSNodeFilterTable, this, propertyName, slot);
 }
 
-JSValuePtr jsNodeFilterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeFilterConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSNodeFilter*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSNodeFilter::getConstructor(ExecState* exec)
+JSValue JSNodeFilter::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSNodeFilterConstructor>(exec);
 }
 
-JSValuePtr jsNodeFilterPrototypeFunctionAcceptNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodeFilterPrototypeFunctionAcceptNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNodeFilter::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNodeFilter::s_info))
         return throwError(exec, TypeError);
     JSNodeFilter* castedThisObj = static_cast<JSNodeFilter*>(asObject(thisValue));
     return castedThisObj->acceptNode(exec, args);
@@ -190,87 +186,87 @@ JSValuePtr jsNodeFilterPrototypeFunctionAcceptNode(ExecState* exec, JSObject*, J
 
 // Constant getters
 
-JSValuePtr jsNodeFilterFILTER_ACCEPT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterFILTER_ACCEPT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsNodeFilterFILTER_REJECT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterFILTER_REJECT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsNodeFilterFILTER_SKIP(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterFILTER_SKIP(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsNodeFilterSHOW_ALL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_ALL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0xFFFFFFFF));
 }
 
-JSValuePtr jsNodeFilterSHOW_ELEMENT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_ELEMENT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000001));
 }
 
-JSValuePtr jsNodeFilterSHOW_ATTRIBUTE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_ATTRIBUTE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000002));
 }
 
-JSValuePtr jsNodeFilterSHOW_TEXT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_TEXT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000004));
 }
 
-JSValuePtr jsNodeFilterSHOW_CDATA_SECTION(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_CDATA_SECTION(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000008));
 }
 
-JSValuePtr jsNodeFilterSHOW_ENTITY_REFERENCE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_ENTITY_REFERENCE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000010));
 }
 
-JSValuePtr jsNodeFilterSHOW_ENTITY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_ENTITY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000020));
 }
 
-JSValuePtr jsNodeFilterSHOW_PROCESSING_INSTRUCTION(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_PROCESSING_INSTRUCTION(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000040));
 }
 
-JSValuePtr jsNodeFilterSHOW_COMMENT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_COMMENT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000080));
 }
 
-JSValuePtr jsNodeFilterSHOW_DOCUMENT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_DOCUMENT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000100));
 }
 
-JSValuePtr jsNodeFilterSHOW_DOCUMENT_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_DOCUMENT_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000200));
 }
 
-JSValuePtr jsNodeFilterSHOW_DOCUMENT_FRAGMENT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_DOCUMENT_FRAGMENT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000400));
 }
 
-JSValuePtr jsNodeFilterSHOW_NOTATION(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsNodeFilterSHOW_NOTATION(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0x00000800));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, NodeFilter* object)
+JSC::JSValue toJS(JSC::ExecState* exec, NodeFilter* object)
 {
     return getDOMObjectWrapper<JSNodeFilter>(exec, object);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h
index 480d78c..0fd1b42 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeFilter.h
@@ -34,38 +34,39 @@ class JSNodeFilter : public DOMObject {
 public:
     JSNodeFilter(PassRefPtr<JSC::Structure>, PassRefPtr<NodeFilter>);
     virtual ~JSNodeFilter();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void mark();
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom functions
-    JSC::JSValuePtr acceptNode(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue acceptNode(JSC::ExecState*, const JSC::ArgList&);
     NodeFilter* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<NodeFilter> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, NodeFilter*);
-PassRefPtr<NodeFilter> toNodeFilter(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, NodeFilter*);
+PassRefPtr<NodeFilter> toNodeFilter(JSC::JSValue);
 
 class JSNodeFilterPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -74,28 +75,28 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsNodeFilterPrototypeFunctionAcceptNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodeFilterPrototypeFunctionAcceptNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsNodeFilterConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsNodeFilterFILTER_ACCEPT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterFILTER_REJECT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterFILTER_SKIP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_ALL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_ELEMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_ATTRIBUTE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_TEXT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_CDATA_SECTION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_ENTITY_REFERENCE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_ENTITY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_PROCESSING_INSTRUCTION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_COMMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_DOCUMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_DOCUMENT_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_DOCUMENT_FRAGMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeFilterSHOW_NOTATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterFILTER_ACCEPT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterFILTER_REJECT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterFILTER_SKIP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_ALL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_ELEMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_ATTRIBUTE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_TEXT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_CDATA_SECTION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_ENTITY_REFERENCE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_ENTITY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_PROCESSING_INSTRUCTION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_COMMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_DOCUMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_DOCUMENT_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_DOCUMENT_FRAGMENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeFilterSHOW_NOTATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
index 450a410..152ab6f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.cpp
@@ -19,25 +19,22 @@
 */
 
 #include "config.h"
-
 #include "JSNodeIterator.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSNode.h"
 #include "JSNodeFilter.h"
 #include "Node.h"
 #include "NodeFilter.h"
 #include "NodeIterator.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSNodeIterator)
+ASSERT_CLASS_FITS_IN_CELL(JSNodeIterator);
 
 /* Hash table */
 
@@ -79,13 +76,13 @@ public:
     JSNodeIteratorConstructor(ExecState* exec)
         : DOMObject(JSNodeIteratorConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSNodeIteratorPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSNodeIteratorPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -117,9 +114,9 @@ static const HashTable JSNodeIteratorPrototypeTable =
 
 const ClassInfo JSNodeIteratorPrototype::s_info = { "NodeIteratorPrototype", 0, &JSNodeIteratorPrototypeTable, 0 };
 
-JSObject* JSNodeIteratorPrototype::self(ExecState* exec)
+JSObject* JSNodeIteratorPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSNodeIterator>(exec);
+    return getDOMPrototype<JSNodeIterator>(exec, globalObject);
 }
 
 bool JSNodeIteratorPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -138,12 +135,11 @@ JSNodeIterator::JSNodeIterator(PassRefPtr<Structure> structure, PassRefPtr<NodeI
 JSNodeIterator::~JSNodeIterator()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSNodeIterator::createPrototype(ExecState* exec)
+JSObject* JSNodeIterator::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSNodeIteratorPrototype(JSNodeIteratorPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSNodeIteratorPrototype(JSNodeIteratorPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSNodeIterator::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -151,70 +147,79 @@ bool JSNodeIterator::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSNodeIterator, Base>(exec, &JSNodeIteratorTable, this, propertyName, slot);
 }
 
-JSValuePtr jsNodeIteratorRoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeIteratorRoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     NodeIterator* imp = static_cast<NodeIterator*>(static_cast<JSNodeIterator*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->root()));
 }
 
-JSValuePtr jsNodeIteratorWhatToShow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeIteratorWhatToShow(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     NodeIterator* imp = static_cast<NodeIterator*>(static_cast<JSNodeIterator*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->whatToShow());
 }
 
-JSValuePtr jsNodeIteratorFilter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeIteratorFilter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     NodeIterator* imp = static_cast<NodeIterator*>(static_cast<JSNodeIterator*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->filter()));
 }
 
-JSValuePtr jsNodeIteratorExpandEntityReferences(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeIteratorExpandEntityReferences(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     NodeIterator* imp = static_cast<NodeIterator*>(static_cast<JSNodeIterator*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->expandEntityReferences());
 }
 
-JSValuePtr jsNodeIteratorReferenceNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeIteratorReferenceNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     NodeIterator* imp = static_cast<NodeIterator*>(static_cast<JSNodeIterator*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->referenceNode()));
 }
 
-JSValuePtr jsNodeIteratorPointerBeforeReferenceNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeIteratorPointerBeforeReferenceNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     NodeIterator* imp = static_cast<NodeIterator*>(static_cast<JSNodeIterator*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->pointerBeforeReferenceNode());
 }
 
-JSValuePtr jsNodeIteratorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeIteratorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSNodeIterator*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSNodeIterator::getConstructor(ExecState* exec)
+JSValue JSNodeIterator::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSNodeIteratorConstructor>(exec);
 }
 
-JSValuePtr jsNodeIteratorPrototypeFunctionNextNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodeIteratorPrototypeFunctionNextNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNodeIterator::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNodeIterator::s_info))
         return throwError(exec, TypeError);
     JSNodeIterator* castedThisObj = static_cast<JSNodeIterator*>(asObject(thisValue));
     return castedThisObj->nextNode(exec, args);
 }
 
-JSValuePtr jsNodeIteratorPrototypeFunctionPreviousNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodeIteratorPrototypeFunctionPreviousNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNodeIterator::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNodeIterator::s_info))
         return throwError(exec, TypeError);
     JSNodeIterator* castedThisObj = static_cast<JSNodeIterator*>(asObject(thisValue));
     return castedThisObj->previousNode(exec, args);
 }
 
-JSValuePtr jsNodeIteratorPrototypeFunctionDetach(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodeIteratorPrototypeFunctionDetach(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNodeIterator::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNodeIterator::s_info))
         return throwError(exec, TypeError);
     JSNodeIterator* castedThisObj = static_cast<JSNodeIterator*>(asObject(thisValue));
     NodeIterator* imp = static_cast<NodeIterator*>(castedThisObj->impl());
@@ -223,13 +228,13 @@ JSValuePtr jsNodeIteratorPrototypeFunctionDetach(ExecState* exec, JSObject*, JSV
     return jsUndefined();
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, NodeIterator* object)
+JSC::JSValue toJS(JSC::ExecState* exec, NodeIterator* object)
 {
     return getDOMObjectWrapper<JSNodeIterator>(exec, object);
 }
-NodeIterator* toNodeIterator(JSC::JSValuePtr value)
+NodeIterator* toNodeIterator(JSC::JSValue value)
 {
-    return value->isObject(&JSNodeIterator::s_info) ? static_cast<JSNodeIterator*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSNodeIterator::s_info) ? static_cast<JSNodeIterator*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h
index db97842..ab5e7c6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeIterator.h
@@ -34,39 +34,40 @@ class JSNodeIterator : public DOMObject {
 public:
     JSNodeIterator(PassRefPtr<JSC::Structure>, PassRefPtr<NodeIterator>);
     virtual ~JSNodeIterator();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void mark();
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom functions
-    JSC::JSValuePtr nextNode(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr previousNode(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue nextNode(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue previousNode(JSC::ExecState*, const JSC::ArgList&);
     NodeIterator* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<NodeIterator> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, NodeIterator*);
-NodeIterator* toNodeIterator(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, NodeIterator*);
+NodeIterator* toNodeIterator(JSC::JSValue);
 
 class JSNodeIteratorPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -75,18 +76,18 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsNodeIteratorPrototypeFunctionNextNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodeIteratorPrototypeFunctionPreviousNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsNodeIteratorPrototypeFunctionDetach(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodeIteratorPrototypeFunctionNextNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodeIteratorPrototypeFunctionPreviousNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodeIteratorPrototypeFunctionDetach(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsNodeIteratorRoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeIteratorWhatToShow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeIteratorFilter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeIteratorExpandEntityReferences(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeIteratorReferenceNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeIteratorPointerBeforeReferenceNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeIteratorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeIteratorRoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeIteratorWhatToShow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeIteratorFilter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeIteratorExpandEntityReferences(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeIteratorReferenceNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeIteratorPointerBeforeReferenceNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeIteratorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp b/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
index 7e26427..80e1f22 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeList.cpp
@@ -19,26 +19,23 @@
 */
 
 #include "config.h"
-
 #include "JSNodeList.h"
 
-#include <wtf/GetPtr.h>
-
-#include <runtime/PropertyNameArray.h>
 #include "AtomicString.h"
 #include "ExceptionCode.h"
 #include "JSNode.h"
 #include "Node.h"
 #include "NodeList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSNodeList)
+ASSERT_CLASS_FITS_IN_CELL(JSNodeList);
 
 /* Hash table */
 
@@ -75,13 +72,13 @@ public:
     JSNodeListConstructor(ExecState* exec)
         : DOMObject(JSNodeListConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSNodeListPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSNodeListPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +108,9 @@ static const HashTable JSNodeListPrototypeTable =
 
 const ClassInfo JSNodeListPrototype::s_info = { "NodeListPrototype", 0, &JSNodeListPrototypeTable, 0 };
 
-JSObject* JSNodeListPrototype::self(ExecState* exec)
+JSObject* JSNodeListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSNodeList>(exec);
+    return getDOMPrototype<JSNodeList>(exec, globalObject);
 }
 
 bool JSNodeListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,12 +129,11 @@ JSNodeList::JSNodeList(PassRefPtr<Structure> structure, PassRefPtr<NodeList> imp
 JSNodeList::~JSNodeList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSNodeList::createPrototype(ExecState* exec)
+JSObject* JSNodeList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSNodeListPrototype(JSNodeListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSNodeListPrototype(JSNodeListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSNodeList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -169,13 +165,14 @@ bool JSNodeList::getOwnPropertySlot(ExecState* exec, unsigned propertyName, Prop
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsNodeListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     NodeList* imp = static_cast<NodeList*>(static_cast<JSNodeList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsNodeListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNodeListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSNodeList*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
@@ -186,41 +183,42 @@ void JSNodeList::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNa
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSNodeList::getConstructor(ExecState* exec)
+JSValue JSNodeList::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSNodeListConstructor>(exec);
 }
 
-JSValuePtr jsNodeListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsNodeListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSNodeList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSNodeList::s_info))
         return throwError(exec, TypeError);
     JSNodeList* castedThisObj = static_cast<JSNodeList*>(asObject(thisValue));
     NodeList* imp = static_cast<NodeList*>(castedThisObj->impl());
-    int index = args.at(exec, 0)->toInt32(exec);
+    int index = args.at(0).toInt32(exec);
     if (index < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return jsUndefined();
     }
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->item(index)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
     return result;
 }
 
 
-JSValuePtr JSNodeList::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSNodeList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSNodeList* thisObj = static_cast<JSNodeList*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<NodeList*>(thisObj->impl())->item(slot.index()));
 }
-JSC::JSValuePtr toJS(JSC::ExecState* exec, NodeList* object)
+JSC::JSValue toJS(JSC::ExecState* exec, NodeList* object)
 {
     return getDOMObjectWrapper<JSNodeList>(exec, object);
 }
-NodeList* toNodeList(JSC::JSValuePtr value)
+NodeList* toNodeList(JSC::JSValue value)
 {
-    return value->isObject(&JSNodeList::s_info) ? static_cast<JSNodeList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSNodeList::s_info) ? static_cast<JSNodeList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNodeList.h b/src/3rdparty/webkit/WebCore/generated/JSNodeList.h
index 2297c77..c4fce0b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNodeList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNodeList.h
@@ -22,9 +22,9 @@
 #define JSNodeList_h
 
 #include "JSDOMBinding.h"
+#include <runtime/CallData.h>
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
-#include <runtime/CallData.h>
 
 namespace WebCore {
 
@@ -35,13 +35,13 @@ class JSNodeList : public DOMObject {
 public:
     JSNodeList(PassRefPtr<JSC::Structure>, PassRefPtr<NodeList>);
     virtual ~JSNodeList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,27 +49,28 @@ public:
     virtual JSC::CallType getCallData(JSC::CallData&);
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     NodeList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<NodeList> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, NodeList*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, NodeList*);
-NodeList* toNodeList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, NodeList*);
+NodeList* toNodeList(JSC::JSValue);
 
 class JSNodeListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -78,11 +79,11 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsNodeListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsNodeListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsNodeListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNodeListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNodeListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp b/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp
index 67eed7b..95dacaa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSNotation.cpp
@@ -19,21 +19,17 @@
 */
 
 #include "config.h"
-
 #include "JSNotation.h"
 
-#include <wtf/GetPtr.h>
-
 #include "KURL.h"
 #include "Notation.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSNotation)
+ASSERT_CLASS_FITS_IN_CELL(JSNotation);
 
 /* Hash table */
 
@@ -71,13 +67,13 @@ public:
     JSNotationConstructor(ExecState* exec)
         : DOMObject(JSNotationConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSNotationPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSNotationPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -106,9 +102,9 @@ static const HashTable JSNotationPrototypeTable =
 
 const ClassInfo JSNotationPrototype::s_info = { "NotationPrototype", 0, &JSNotationPrototypeTable, 0 };
 
-JSObject* JSNotationPrototype::self(ExecState* exec)
+JSObject* JSNotationPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSNotation>(exec);
+    return getDOMPrototype<JSNotation>(exec, globalObject);
 }
 
 const ClassInfo JSNotation::s_info = { "Notation", &JSNode::s_info, &JSNotationTable, 0 };
@@ -118,9 +114,9 @@ JSNotation::JSNotation(PassRefPtr<Structure> structure, PassRefPtr<Notation> imp
 {
 }
 
-JSObject* JSNotation::createPrototype(ExecState* exec)
+JSObject* JSNotation::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSNotationPrototype(JSNotationPrototype::createStructure(JSNodePrototype::self(exec)));
+    return new (exec) JSNotationPrototype(JSNotationPrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
 bool JSNotation::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,23 +124,25 @@ bool JSNotation::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSNotation, Base>(exec, &JSNotationTable, this, propertyName, slot);
 }
 
-JSValuePtr jsNotationPublicId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNotationPublicId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Notation* imp = static_cast<Notation*>(static_cast<JSNotation*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->publicId());
 }
 
-JSValuePtr jsNotationSystemId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNotationSystemId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Notation* imp = static_cast<Notation*>(static_cast<JSNotation*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->systemId());
 }
 
-JSValuePtr jsNotationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsNotationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSNotation*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSNotation::getConstructor(ExecState* exec)
+JSValue JSNotation::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSNotationConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSNotation.h b/src/3rdparty/webkit/WebCore/generated/JSNotation.h
index 698a03a..00d3427 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSNotation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSNotation.h
@@ -31,23 +31,24 @@ class JSNotation : public JSNode {
     typedef JSNode Base;
 public:
     JSNotation(PassRefPtr<JSC::Structure>, PassRefPtr<Notation>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSNotationPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSNotationPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -55,9 +56,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsNotationPublicId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNotationSystemId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsNotationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNotationPublicId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNotationSystemId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsNotationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSONObject.lut.h b/src/3rdparty/webkit/WebCore/generated/JSONObject.lut.h
new file mode 100644
index 0000000..9a12bb4
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSONObject.lut.h
@@ -0,0 +1,15 @@
+// Automatically generated from ../../JavaScriptCore/runtime/JSONObject.cpp using JavaScriptCore/create_hash_table. DO NOT EDIT!
+
+#include "Lookup.h"
+
+namespace JSC {
+
+static const struct HashTableValue jsonTableValues[3] = {
+   { "parse", DontEnum|Function, (intptr_t)JSONProtoFuncParse, (intptr_t)1 },
+   { "stringify", DontEnum|Function, (intptr_t)JSONProtoFuncStringify, (intptr_t)1 },
+   { 0, 0, 0, 0 }
+};
+
+extern const struct HashTable jsonTable =
+    { 4, 3, jsonTableValues, 0 };
+} // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp
index fae420f..b704dcb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.cpp
@@ -19,21 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSOverflowEvent.h"
 
-#include <wtf/GetPtr.h>
-
 #include "OverflowEvent.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSOverflowEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSOverflowEvent);
 
 /* Hash table */
 
@@ -75,13 +72,13 @@ public:
     JSOverflowEventConstructor(ExecState* exec)
         : DOMObject(JSOverflowEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSOverflowEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSOverflowEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -114,9 +111,9 @@ static const HashTable JSOverflowEventPrototypeTable =
 
 const ClassInfo JSOverflowEventPrototype::s_info = { "OverflowEventPrototype", 0, &JSOverflowEventPrototypeTable, 0 };
 
-JSObject* JSOverflowEventPrototype::self(ExecState* exec)
+JSObject* JSOverflowEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSOverflowEvent>(exec);
+    return getDOMPrototype<JSOverflowEvent>(exec, globalObject);
 }
 
 bool JSOverflowEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,9 +128,9 @@ JSOverflowEvent::JSOverflowEvent(PassRefPtr<Structure> structure, PassRefPtr<Ove
 {
 }
 
-JSObject* JSOverflowEvent::createPrototype(ExecState* exec)
+JSObject* JSOverflowEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSOverflowEventPrototype(JSOverflowEventPrototype::createStructure(JSEventPrototype::self(exec)));
+    return new (exec) JSOverflowEventPrototype(JSOverflowEventPrototype::createStructure(JSEventPrototype::self(exec, globalObject)));
 }
 
 bool JSOverflowEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -141,42 +138,46 @@ bool JSOverflowEvent::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSOverflowEvent, Base>(exec, &JSOverflowEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsOverflowEventOrient(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsOverflowEventOrient(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     OverflowEvent* imp = static_cast<OverflowEvent*>(static_cast<JSOverflowEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->orient());
 }
 
-JSValuePtr jsOverflowEventHorizontalOverflow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsOverflowEventHorizontalOverflow(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     OverflowEvent* imp = static_cast<OverflowEvent*>(static_cast<JSOverflowEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->horizontalOverflow());
 }
 
-JSValuePtr jsOverflowEventVerticalOverflow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsOverflowEventVerticalOverflow(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     OverflowEvent* imp = static_cast<OverflowEvent*>(static_cast<JSOverflowEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->verticalOverflow());
 }
 
-JSValuePtr jsOverflowEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsOverflowEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSOverflowEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSOverflowEvent::getConstructor(ExecState* exec)
+JSValue JSOverflowEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSOverflowEventConstructor>(exec);
 }
 
-JSValuePtr jsOverflowEventPrototypeFunctionInitOverflowEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsOverflowEventPrototypeFunctionInitOverflowEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSOverflowEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSOverflowEvent::s_info))
         return throwError(exec, TypeError);
     JSOverflowEvent* castedThisObj = static_cast<JSOverflowEvent*>(asObject(thisValue));
     OverflowEvent* imp = static_cast<OverflowEvent*>(castedThisObj->impl());
-    unsigned short orient = args.at(exec, 0)->toInt32(exec);
-    bool horizontalOverflow = args.at(exec, 1)->toBoolean(exec);
-    bool verticalOverflow = args.at(exec, 2)->toBoolean(exec);
+    unsigned short orient = args.at(0).toInt32(exec);
+    bool horizontalOverflow = args.at(1).toBoolean(exec);
+    bool verticalOverflow = args.at(2).toBoolean(exec);
 
     imp->initOverflowEvent(orient, horizontalOverflow, verticalOverflow);
     return jsUndefined();
@@ -184,17 +185,17 @@ JSValuePtr jsOverflowEventPrototypeFunctionInitOverflowEvent(ExecState* exec, JS
 
 // Constant getters
 
-JSValuePtr jsOverflowEventHORIZONTAL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsOverflowEventHORIZONTAL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsOverflowEventVERTICAL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsOverflowEventVERTICAL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsOverflowEventBOTH(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsOverflowEventBOTH(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h
index afa8ea0..b018a86 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSOverflowEvent.h
@@ -31,27 +31,28 @@ class JSOverflowEvent : public JSEvent {
     typedef JSEvent Base;
 public:
     JSOverflowEvent(PassRefPtr<JSC::Structure>, PassRefPtr<OverflowEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSOverflowEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,18 +61,18 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsOverflowEventPrototypeFunctionInitOverflowEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsOverflowEventPrototypeFunctionInitOverflowEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsOverflowEventOrient(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsOverflowEventHorizontalOverflow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsOverflowEventVerticalOverflow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsOverflowEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsOverflowEventOrient(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsOverflowEventHorizontalOverflow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsOverflowEventVerticalOverflow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsOverflowEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsOverflowEventHORIZONTAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsOverflowEventVERTICAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsOverflowEventBOTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsOverflowEventHORIZONTAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsOverflowEventVERTICAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsOverflowEventBOTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp b/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
index ec3bc6d..9b3c480 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPlugin.cpp
@@ -19,27 +19,24 @@
 */
 
 #include "config.h"
-
 #include "JSPlugin.h"
 
-#include <wtf/GetPtr.h>
-
-#include <runtime/PropertyNameArray.h>
 #include "AtomicString.h"
 #include "JSMimeType.h"
 #include "KURL.h"
 #include "MimeType.h"
 #include "Plugin.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSPlugin)
+ASSERT_CLASS_FITS_IN_CELL(JSPlugin);
 
 /* Hash table */
 
@@ -79,13 +76,13 @@ public:
     JSPluginConstructor(ExecState* exec)
         : DOMObject(JSPluginConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSPluginPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSPluginPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -116,9 +113,9 @@ static const HashTable JSPluginPrototypeTable =
 
 const ClassInfo JSPluginPrototype::s_info = { "PluginPrototype", 0, &JSPluginPrototypeTable, 0 };
 
-JSObject* JSPluginPrototype::self(ExecState* exec)
+JSObject* JSPluginPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSPlugin>(exec);
+    return getDOMPrototype<JSPlugin>(exec, globalObject);
 }
 
 bool JSPluginPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -137,12 +134,11 @@ JSPlugin::JSPlugin(PassRefPtr<Structure> structure, PassRefPtr<Plugin> impl)
 JSPlugin::~JSPlugin()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSPlugin::createPrototype(ExecState* exec)
+JSObject* JSPlugin::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSPluginPrototype(JSPluginPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSPluginPrototype(JSPluginPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSPlugin::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -174,31 +170,35 @@ bool JSPlugin::getOwnPropertySlot(ExecState* exec, unsigned propertyName, Proper
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsPluginName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPluginName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Plugin* imp = static_cast<Plugin*>(static_cast<JSPlugin*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsPluginFilename(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPluginFilename(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Plugin* imp = static_cast<Plugin*>(static_cast<JSPlugin*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->filename());
 }
 
-JSValuePtr jsPluginDescription(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPluginDescription(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Plugin* imp = static_cast<Plugin*>(static_cast<JSPlugin*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->description());
 }
 
-JSValuePtr jsPluginLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPluginLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Plugin* imp = static_cast<Plugin*>(static_cast<JSPlugin*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsPluginConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPluginConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSPlugin*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
@@ -209,50 +209,52 @@ void JSPlugin::getPropertyNames(ExecState* exec, PropertyNameArray& propertyName
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSPlugin::getConstructor(ExecState* exec)
+JSValue JSPlugin::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSPluginConstructor>(exec);
 }
 
-JSValuePtr jsPluginPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsPluginPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSPlugin::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSPlugin::s_info))
         return throwError(exec, TypeError);
     JSPlugin* castedThisObj = static_cast<JSPlugin*>(asObject(thisValue));
     Plugin* imp = static_cast<Plugin*>(castedThisObj->impl());
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->item(index)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
     return result;
 }
 
-JSValuePtr jsPluginPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsPluginPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSPlugin::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSPlugin::s_info))
         return throwError(exec, TypeError);
     JSPlugin* castedThisObj = static_cast<JSPlugin*>(asObject(thisValue));
     Plugin* imp = static_cast<Plugin*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->namedItem(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->namedItem(name)));
     return result;
 }
 
 
-JSValuePtr JSPlugin::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSPlugin::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSPlugin* thisObj = static_cast<JSPlugin*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<Plugin*>(thisObj->impl())->item(slot.index()));
 }
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Plugin* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Plugin* object)
 {
     return getDOMObjectWrapper<JSPlugin>(exec, object);
 }
-Plugin* toPlugin(JSC::JSValuePtr value)
+Plugin* toPlugin(JSC::JSValue value)
 {
-    return value->isObject(&JSPlugin::s_info) ? static_cast<JSPlugin*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSPlugin::s_info) ? static_cast<JSPlugin*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPlugin.h b/src/3rdparty/webkit/WebCore/generated/JSPlugin.h
index adf03a3..7ff040f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPlugin.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSPlugin.h
@@ -34,39 +34,40 @@ class JSPlugin : public DOMObject {
 public:
     JSPlugin(PassRefPtr<JSC::Structure>, PassRefPtr<Plugin>);
     virtual ~JSPlugin();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     Plugin* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Plugin> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, Plugin*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Plugin*);
-Plugin* toPlugin(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Plugin*);
+Plugin* toPlugin(JSC::JSValue);
 
 class JSPluginPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -75,15 +76,15 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsPluginPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsPluginPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsPluginPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsPluginPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsPluginName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsPluginFilename(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsPluginDescription(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsPluginLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsPluginConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPluginName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPluginFilename(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPluginDescription(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPluginLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPluginConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
index 99a635c..ba960da 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.cpp
@@ -19,25 +19,22 @@
 */
 
 #include "config.h"
-
 #include "JSPluginArray.h"
 
-#include <wtf/GetPtr.h>
-
-#include <runtime/PropertyNameArray.h>
 #include "AtomicString.h"
 #include "JSPlugin.h"
 #include "Plugin.h"
 #include "PluginArray.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSPluginArray)
+ASSERT_CLASS_FITS_IN_CELL(JSPluginArray);
 
 /* Hash table */
 
@@ -74,13 +71,13 @@ public:
     JSPluginArrayConstructor(ExecState* exec)
         : DOMObject(JSPluginArrayConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSPluginArrayPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSPluginArrayPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -112,9 +109,9 @@ static const HashTable JSPluginArrayPrototypeTable =
 
 const ClassInfo JSPluginArrayPrototype::s_info = { "PluginArrayPrototype", 0, &JSPluginArrayPrototypeTable, 0 };
 
-JSObject* JSPluginArrayPrototype::self(ExecState* exec)
+JSObject* JSPluginArrayPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSPluginArray>(exec);
+    return getDOMPrototype<JSPluginArray>(exec, globalObject);
 }
 
 bool JSPluginArrayPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,12 +130,11 @@ JSPluginArray::JSPluginArray(PassRefPtr<Structure> structure, PassRefPtr<PluginA
 JSPluginArray::~JSPluginArray()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSPluginArray::createPrototype(ExecState* exec)
+JSObject* JSPluginArray::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSPluginArrayPrototype(JSPluginArrayPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSPluginArrayPrototype(JSPluginArrayPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSPluginArray::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -170,13 +166,14 @@ bool JSPluginArray::getOwnPropertySlot(ExecState* exec, unsigned propertyName, P
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsPluginArrayLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPluginArrayLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     PluginArray* imp = static_cast<PluginArray*>(static_cast<JSPluginArray*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsPluginArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPluginArrayConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSPluginArray*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
@@ -187,62 +184,65 @@ void JSPluginArray::getPropertyNames(ExecState* exec, PropertyNameArray& propert
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSPluginArray::getConstructor(ExecState* exec)
+JSValue JSPluginArray::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSPluginArrayConstructor>(exec);
 }
 
-JSValuePtr jsPluginArrayPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsPluginArrayPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSPluginArray::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSPluginArray::s_info))
         return throwError(exec, TypeError);
     JSPluginArray* castedThisObj = static_cast<JSPluginArray*>(asObject(thisValue));
     PluginArray* imp = static_cast<PluginArray*>(castedThisObj->impl());
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->item(index)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
     return result;
 }
 
-JSValuePtr jsPluginArrayPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsPluginArrayPrototypeFunctionNamedItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSPluginArray::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSPluginArray::s_info))
         return throwError(exec, TypeError);
     JSPluginArray* castedThisObj = static_cast<JSPluginArray*>(asObject(thisValue));
     PluginArray* imp = static_cast<PluginArray*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->namedItem(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->namedItem(name)));
     return result;
 }
 
-JSValuePtr jsPluginArrayPrototypeFunctionRefresh(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsPluginArrayPrototypeFunctionRefresh(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSPluginArray::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSPluginArray::s_info))
         return throwError(exec, TypeError);
     JSPluginArray* castedThisObj = static_cast<JSPluginArray*>(asObject(thisValue));
     PluginArray* imp = static_cast<PluginArray*>(castedThisObj->impl());
-    bool reload = args.at(exec, 0)->toBoolean(exec);
+    bool reload = args.at(0).toBoolean(exec);
 
     imp->refresh(reload);
     return jsUndefined();
 }
 
 
-JSValuePtr JSPluginArray::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSPluginArray::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSPluginArray* thisObj = static_cast<JSPluginArray*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<PluginArray*>(thisObj->impl())->item(slot.index()));
 }
-JSC::JSValuePtr toJS(JSC::ExecState* exec, PluginArray* object)
+JSC::JSValue toJS(JSC::ExecState* exec, PluginArray* object)
 {
     return getDOMObjectWrapper<JSPluginArray>(exec, object);
 }
-PluginArray* toPluginArray(JSC::JSValuePtr value)
+PluginArray* toPluginArray(JSC::JSValue value)
 {
-    return value->isObject(&JSPluginArray::s_info) ? static_cast<JSPluginArray*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSPluginArray::s_info) ? static_cast<JSPluginArray*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h
index b66b7cd..56bb33e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSPluginArray.h
@@ -34,39 +34,40 @@ class JSPluginArray : public DOMObject {
 public:
     JSPluginArray(PassRefPtr<JSC::Structure>, PassRefPtr<PluginArray>);
     virtual ~JSPluginArray();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     PluginArray* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<PluginArray> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, PluginArray*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, PluginArray*);
-PluginArray* toPluginArray(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, PluginArray*);
+PluginArray* toPluginArray(JSC::JSValue);
 
 class JSPluginArrayPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -75,13 +76,13 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsPluginArrayPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsPluginArrayPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsPluginArrayPrototypeFunctionRefresh(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsPluginArrayPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsPluginArrayPrototypeFunctionNamedItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsPluginArrayPrototypeFunctionRefresh(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsPluginArrayLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsPluginArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPluginArrayLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPluginArrayConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp b/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
index 5e0374d..89f9e56 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSPositionError.cpp
@@ -19,22 +19,19 @@
 */
 
 #include "config.h"
-
 #include "JSPositionError.h"
 
-#include <wtf/GetPtr.h>
-
 #include "KURL.h"
 #include "PositionError.h"
-
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSPositionError)
+ASSERT_CLASS_FITS_IN_CELL(JSPositionError);
 
 /* Hash table */
 
@@ -76,13 +73,13 @@ public:
     JSPositionErrorConstructor(ExecState* exec)
         : DOMObject(JSPositionErrorConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSPositionErrorPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSPositionErrorPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -115,9 +112,9 @@ static const HashTable JSPositionErrorPrototypeTable =
 
 const ClassInfo JSPositionErrorPrototype::s_info = { "PositionErrorPrototype", 0, &JSPositionErrorPrototypeTable, 0 };
 
-JSObject* JSPositionErrorPrototype::self(ExecState* exec)
+JSObject* JSPositionErrorPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSPositionError>(exec);
+    return getDOMPrototype<JSPositionError>(exec, globalObject);
 }
 
 bool JSPositionErrorPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -136,12 +133,11 @@ JSPositionError::JSPositionError(PassRefPtr<Structure> structure, PassRefPtr<Pos
 JSPositionError::~JSPositionError()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSPositionError::createPrototype(ExecState* exec)
+JSObject* JSPositionError::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSPositionErrorPrototype(JSPositionErrorPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSPositionErrorPrototype(JSPositionErrorPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSPositionError::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -149,56 +145,58 @@ bool JSPositionError::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSPositionError, Base>(exec, &JSPositionErrorTable, this, propertyName, slot);
 }
 
-JSValuePtr jsPositionErrorCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPositionErrorCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     PositionError* imp = static_cast<PositionError*>(static_cast<JSPositionError*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->code());
 }
 
-JSValuePtr jsPositionErrorMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPositionErrorMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     PositionError* imp = static_cast<PositionError*>(static_cast<JSPositionError*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->message());
 }
 
-JSValuePtr jsPositionErrorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsPositionErrorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSPositionError*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSPositionError::getConstructor(ExecState* exec)
+JSValue JSPositionError::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSPositionErrorConstructor>(exec);
 }
 
 // Constant getters
 
-JSValuePtr jsPositionErrorUNKNOWN_ERROR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsPositionErrorUNKNOWN_ERROR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsPositionErrorPERMISSION_DENIED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsPositionErrorPERMISSION_DENIED(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsPositionErrorPOSITION_UNAVAILABLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsPositionErrorPOSITION_UNAVAILABLE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsPositionErrorTIMEOUT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsPositionErrorTIMEOUT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, PositionError* object)
+JSC::JSValue toJS(JSC::ExecState* exec, PositionError* object)
 {
     return getDOMObjectWrapper<JSPositionError>(exec, object);
 }
-PositionError* toPositionError(JSC::JSValuePtr value)
+PositionError* toPositionError(JSC::JSValue value)
 {
-    return value->isObject(&JSPositionError::s_info) ? static_cast<JSPositionError*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSPositionError::s_info) ? static_cast<JSPositionError*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSPositionError.h b/src/3rdparty/webkit/WebCore/generated/JSPositionError.h
index d8cc4c1..9f256f4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSPositionError.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSPositionError.h
@@ -34,33 +34,34 @@ class JSPositionError : public DOMObject {
 public:
     JSPositionError(PassRefPtr<JSC::Structure>, PassRefPtr<PositionError>);
     virtual ~JSPositionError();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     PositionError* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<PositionError> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, PositionError*);
-PositionError* toPositionError(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, PositionError*);
+PositionError* toPositionError(JSC::JSValue);
 
 class JSPositionErrorPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,15 +70,15 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsPositionErrorCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsPositionErrorMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsPositionErrorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPositionErrorCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPositionErrorMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPositionErrorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsPositionErrorUNKNOWN_ERROR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsPositionErrorPERMISSION_DENIED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsPositionErrorPOSITION_UNAVAILABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsPositionErrorTIMEOUT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPositionErrorUNKNOWN_ERROR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPositionErrorPERMISSION_DENIED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPositionErrorPOSITION_UNAVAILABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsPositionErrorTIMEOUT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp
index 567cf03..7ca8069 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.cpp
@@ -19,23 +19,19 @@
 */
 
 #include "config.h"
-
 #include "JSProcessingInstruction.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSStyleSheet.h"
 #include "KURL.h"
 #include "ProcessingInstruction.h"
 #include "StyleSheet.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSProcessingInstruction)
+ASSERT_CLASS_FITS_IN_CELL(JSProcessingInstruction);
 
 /* Hash table */
 
@@ -74,13 +70,13 @@ public:
     JSProcessingInstructionConstructor(ExecState* exec)
         : DOMObject(JSProcessingInstructionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSProcessingInstructionPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSProcessingInstructionPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +105,9 @@ static const HashTable JSProcessingInstructionPrototypeTable =
 
 const ClassInfo JSProcessingInstructionPrototype::s_info = { "ProcessingInstructionPrototype", 0, &JSProcessingInstructionPrototypeTable, 0 };
 
-JSObject* JSProcessingInstructionPrototype::self(ExecState* exec)
+JSObject* JSProcessingInstructionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSProcessingInstruction>(exec);
+    return getDOMPrototype<JSProcessingInstruction>(exec, globalObject);
 }
 
 const ClassInfo JSProcessingInstruction::s_info = { "ProcessingInstruction", &JSNode::s_info, &JSProcessingInstructionTable, 0 };
@@ -121,9 +117,9 @@ JSProcessingInstruction::JSProcessingInstruction(PassRefPtr<Structure> structure
 {
 }
 
-JSObject* JSProcessingInstruction::createPrototype(ExecState* exec)
+JSObject* JSProcessingInstruction::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSProcessingInstructionPrototype(JSProcessingInstructionPrototype::createStructure(JSNodePrototype::self(exec)));
+    return new (exec) JSProcessingInstructionPrototype(JSProcessingInstructionPrototype::createStructure(JSNodePrototype::self(exec, globalObject)));
 }
 
 bool JSProcessingInstruction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,34 +127,37 @@ bool JSProcessingInstruction::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSProcessingInstruction, Base>(exec, &JSProcessingInstructionTable, this, propertyName, slot);
 }
 
-JSValuePtr jsProcessingInstructionTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProcessingInstructionTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     ProcessingInstruction* imp = static_cast<ProcessingInstruction*>(static_cast<JSProcessingInstruction*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->target());
 }
 
-JSValuePtr jsProcessingInstructionData(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProcessingInstructionData(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     ProcessingInstruction* imp = static_cast<ProcessingInstruction*>(static_cast<JSProcessingInstruction*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->data());
 }
 
-JSValuePtr jsProcessingInstructionSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProcessingInstructionSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     ProcessingInstruction* imp = static_cast<ProcessingInstruction*>(static_cast<JSProcessingInstruction*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->sheet()));
 }
 
-JSValuePtr jsProcessingInstructionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProcessingInstructionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSProcessingInstruction*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSProcessingInstruction::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSProcessingInstruction::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSProcessingInstruction, Base>(exec, propertyName, value, &JSProcessingInstructionTable, this, slot);
 }
 
-void setJSProcessingInstructionData(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSProcessingInstructionData(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     ProcessingInstruction* imp = static_cast<ProcessingInstruction*>(static_cast<JSProcessingInstruction*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -166,7 +165,7 @@ void setJSProcessingInstructionData(ExecState* exec, JSObject* thisObject, JSVal
     setDOMException(exec, ec);
 }
 
-JSValuePtr JSProcessingInstruction::getConstructor(ExecState* exec)
+JSValue JSProcessingInstruction::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSProcessingInstructionConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h
index 2b08ab7..7c0ccd6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSProcessingInstruction.h
@@ -31,24 +31,25 @@ class JSProcessingInstruction : public JSNode {
     typedef JSNode Base;
 public:
     JSProcessingInstruction(PassRefPtr<JSC::Structure>, PassRefPtr<ProcessingInstruction>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSProcessingInstructionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSProcessingInstructionPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,11 +57,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsProcessingInstructionTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsProcessingInstructionData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSProcessingInstructionData(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsProcessingInstructionSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsProcessingInstructionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsProcessingInstructionTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsProcessingInstructionData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSProcessingInstructionData(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsProcessingInstructionSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsProcessingInstructionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp
index 88f9ad2..b70c3c2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.cpp
@@ -19,21 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSProgressEvent.h"
 
-#include <wtf/GetPtr.h>
-
 #include "ProgressEvent.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSProgressEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSProgressEvent);
 
 /* Hash table */
 
@@ -72,13 +69,13 @@ public:
     JSProgressEventConstructor(ExecState* exec)
         : DOMObject(JSProgressEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSProgressEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSProgressEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -108,9 +105,9 @@ static const HashTable JSProgressEventPrototypeTable =
 
 const ClassInfo JSProgressEventPrototype::s_info = { "ProgressEventPrototype", 0, &JSProgressEventPrototypeTable, 0 };
 
-JSObject* JSProgressEventPrototype::self(ExecState* exec)
+JSObject* JSProgressEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSProgressEvent>(exec);
+    return getDOMPrototype<JSProgressEvent>(exec, globalObject);
 }
 
 bool JSProgressEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -125,9 +122,9 @@ JSProgressEvent::JSProgressEvent(PassRefPtr<Structure> structure, PassRefPtr<Pro
 {
 }
 
-JSObject* JSProgressEvent::createPrototype(ExecState* exec)
+JSObject* JSProgressEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSProgressEventPrototype(JSProgressEventPrototype::createStructure(JSEventPrototype::self(exec)));
+    return new (exec) JSProgressEventPrototype(JSProgressEventPrototype::createStructure(JSEventPrototype::self(exec, globalObject)));
 }
 
 bool JSProgressEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -135,45 +132,49 @@ bool JSProgressEvent::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSProgressEvent, Base>(exec, &JSProgressEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsProgressEventLengthComputable(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProgressEventLengthComputable(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     ProgressEvent* imp = static_cast<ProgressEvent*>(static_cast<JSProgressEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->lengthComputable());
 }
 
-JSValuePtr jsProgressEventLoaded(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProgressEventLoaded(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     ProgressEvent* imp = static_cast<ProgressEvent*>(static_cast<JSProgressEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->loaded());
 }
 
-JSValuePtr jsProgressEventTotal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProgressEventTotal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     ProgressEvent* imp = static_cast<ProgressEvent*>(static_cast<JSProgressEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->total());
 }
 
-JSValuePtr jsProgressEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsProgressEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSProgressEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSProgressEvent::getConstructor(ExecState* exec)
+JSValue JSProgressEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSProgressEventConstructor>(exec);
 }
 
-JSValuePtr jsProgressEventPrototypeFunctionInitProgressEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsProgressEventPrototypeFunctionInitProgressEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSProgressEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSProgressEvent::s_info))
         return throwError(exec, TypeError);
     JSProgressEvent* castedThisObj = static_cast<JSProgressEvent*>(asObject(thisValue));
     ProgressEvent* imp = static_cast<ProgressEvent*>(castedThisObj->impl());
-    const UString& typeArg = args.at(exec, 0)->toString(exec);
-    bool canBubbleArg = args.at(exec, 1)->toBoolean(exec);
-    bool cancelableArg = args.at(exec, 2)->toBoolean(exec);
-    bool lengthComputableArg = args.at(exec, 3)->toBoolean(exec);
-    unsigned loadedArg = args.at(exec, 4)->toInt32(exec);
-    unsigned totalArg = args.at(exec, 5)->toInt32(exec);
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    bool lengthComputableArg = args.at(3).toBoolean(exec);
+    unsigned loadedArg = args.at(4).toInt32(exec);
+    unsigned totalArg = args.at(5).toInt32(exec);
 
     imp->initProgressEvent(typeArg, canBubbleArg, cancelableArg, lengthComputableArg, loadedArg, totalArg);
     return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h
index 5eb95d5..5f0744a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSProgressEvent.h
@@ -31,27 +31,28 @@ class JSProgressEvent : public JSEvent {
     typedef JSEvent Base;
 public:
     JSProgressEvent(PassRefPtr<JSC::Structure>, PassRefPtr<ProgressEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSProgressEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,13 +61,13 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsProgressEventPrototypeFunctionInitProgressEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsProgressEventPrototypeFunctionInitProgressEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsProgressEventLengthComputable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsProgressEventLoaded(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsProgressEventTotal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsProgressEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsProgressEventLengthComputable(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsProgressEventLoaded(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsProgressEventTotal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsProgressEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.lut.h b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.lut.h
index 681e9ab..03bb415 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRGBColor.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRGBColor.lut.h
@@ -12,10 +12,5 @@ static const struct HashTableValue JSRGBColorTableValues[4] = {
 };
 
 extern const struct HashTable JSRGBColorTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 7, JSRGBColorTableValues, 0 };
-#else
     { 8, 7, JSRGBColorTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRange.cpp b/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
index 7ca3757..901b8f3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRange.cpp
@@ -19,11 +19,8 @@
 */
 
 #include "config.h"
-
 #include "JSRange.h"
 
-#include <wtf/GetPtr.h>
-
 #include "DocumentFragment.h"
 #include "JSDocumentFragment.h"
 #include "JSNode.h"
@@ -31,16 +28,16 @@
 #include "KURL.h"
 #include "Node.h"
 #include "Range.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSRange)
+ASSERT_CLASS_FITS_IN_CELL(JSRange);
 
 /* Hash table */
 
@@ -90,13 +87,13 @@ public:
     JSRangeConstructor(ExecState* exec)
         : DOMObject(JSRangeConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSRangePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSRangePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -156,9 +153,9 @@ static const HashTable JSRangePrototypeTable =
 
 const ClassInfo JSRangePrototype::s_info = { "RangePrototype", 0, &JSRangePrototypeTable, 0 };
 
-JSObject* JSRangePrototype::self(ExecState* exec)
+JSObject* JSRangePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSRange>(exec);
+    return getDOMPrototype<JSRange>(exec, globalObject);
 }
 
 bool JSRangePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -177,12 +174,11 @@ JSRange::JSRange(PassRefPtr<Structure> structure, PassRefPtr<Range> impl)
 JSRange::~JSRange()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSRange::createPrototype(ExecState* exec)
+JSObject* JSRange::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSRangePrototype(JSRangePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSRangePrototype(JSRangePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSRange::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -190,216 +186,227 @@ bool JSRange::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName
     return getStaticValueSlot<JSRange, Base>(exec, &JSRangeTable, this, propertyName, slot);
 }
 
-JSValuePtr jsRangeStartContainer(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeStartContainer(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     Range* imp = static_cast<Range*>(static_cast<JSRange*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->startContainer(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->startContainer(ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangeStartOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeStartOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     Range* imp = static_cast<Range*>(static_cast<JSRange*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = jsNumber(exec, imp->startOffset(ec));
+    JSC::JSValue result = jsNumber(exec, imp->startOffset(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangeEndContainer(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeEndContainer(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     Range* imp = static_cast<Range*>(static_cast<JSRange*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->endContainer(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->endContainer(ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangeEndOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeEndOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     Range* imp = static_cast<Range*>(static_cast<JSRange*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = jsNumber(exec, imp->endOffset(ec));
+    JSC::JSValue result = jsNumber(exec, imp->endOffset(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangeCollapsed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeCollapsed(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     Range* imp = static_cast<Range*>(static_cast<JSRange*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = jsBoolean(imp->collapsed(ec));
+    JSC::JSValue result = jsBoolean(imp->collapsed(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangeCommonAncestorContainer(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeCommonAncestorContainer(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     Range* imp = static_cast<Range*>(static_cast<JSRange*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->commonAncestorContainer(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->commonAncestorContainer(ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSRange*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSRange::getConstructor(ExecState* exec)
+JSValue JSRange::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSRangeConstructor>(exec);
 }
 
-JSValuePtr jsRangePrototypeFunctionSetStart(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetStart(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
-    int offset = args.at(exec, 1)->toInt32(exec);
+    Node* refNode = toNode(args.at(0));
+    int offset = args.at(1).toInt32(exec);
 
     imp->setStart(refNode, offset, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionSetEnd(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetEnd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
-    int offset = args.at(exec, 1)->toInt32(exec);
+    Node* refNode = toNode(args.at(0));
+    int offset = args.at(1).toInt32(exec);
 
     imp->setEnd(refNode, offset, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionSetStartBefore(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetStartBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
+    Node* refNode = toNode(args.at(0));
 
     imp->setStartBefore(refNode, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionSetStartAfter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetStartAfter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
+    Node* refNode = toNode(args.at(0));
 
     imp->setStartAfter(refNode, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionSetEndBefore(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetEndBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
+    Node* refNode = toNode(args.at(0));
 
     imp->setEndBefore(refNode, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionSetEndAfter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetEndAfter(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
+    Node* refNode = toNode(args.at(0));
 
     imp->setEndAfter(refNode, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionCollapse(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionCollapse(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    bool toStart = args.at(exec, 0)->toBoolean(exec);
+    bool toStart = args.at(0).toBoolean(exec);
 
     imp->collapse(toStart, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionSelectNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionSelectNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
+    Node* refNode = toNode(args.at(0));
 
     imp->selectNode(refNode, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionSelectNodeContents(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionSelectNodeContents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
+    Node* refNode = toNode(args.at(0));
 
     imp->selectNodeContents(refNode, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionCompareBoundaryPoints(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionCompareBoundaryPoints(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Range::CompareHow how = static_cast<Range::CompareHow>(args.at(exec, 0)->toInt32(exec));
-    Range* sourceRange = toRange(args.at(exec, 1));
+    Range::CompareHow how = static_cast<Range::CompareHow>(args.at(0).toInt32(exec));
+    Range* sourceRange = toRange(args.at(1));
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->compareBoundaryPoints(how, sourceRange, ec));
+    JSC::JSValue result = jsNumber(exec, imp->compareBoundaryPoints(how, sourceRange, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangePrototypeFunctionDeleteContents(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionDeleteContents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -410,93 +417,100 @@ JSValuePtr jsRangePrototypeFunctionDeleteContents(ExecState* exec, JSObject*, JS
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionExtractContents(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionExtractContents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->extractContents(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->extractContents(ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangePrototypeFunctionCloneContents(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionCloneContents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->cloneContents(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->cloneContents(ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangePrototypeFunctionInsertNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionInsertNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* newNode = toNode(args.at(exec, 0));
+    Node* newNode = toNode(args.at(0));
 
     imp->insertNode(newNode, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionSurroundContents(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionSurroundContents(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* newParent = toNode(args.at(exec, 0));
+    Node* newParent = toNode(args.at(0));
 
     imp->surroundContents(newParent, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionCloneRange(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionCloneRange(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->cloneRange(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->cloneRange(ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangePrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->toString(ec));
+    JSC::JSValue result = jsString(exec, imp->toString(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangePrototypeFunctionDetach(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionDetach(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
@@ -507,132 +521,137 @@ JSValuePtr jsRangePrototypeFunctionDetach(ExecState* exec, JSObject*, JSValuePtr
     return jsUndefined();
 }
 
-JSValuePtr jsRangePrototypeFunctionCreateContextualFragment(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionCreateContextualFragment(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& html = args.at(exec, 0)->toString(exec);
+    const UString& html = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createContextualFragment(html, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createContextualFragment(html, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangePrototypeFunctionIntersectsNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionIntersectsNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
+    Node* refNode = toNode(args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->intersectsNode(refNode, ec));
+    JSC::JSValue result = jsBoolean(imp->intersectsNode(refNode, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangePrototypeFunctionCompareNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionCompareNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
+    Node* refNode = toNode(args.at(0));
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->compareNode(refNode, ec));
+    JSC::JSValue result = jsNumber(exec, imp->compareNode(refNode, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangePrototypeFunctionComparePoint(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionComparePoint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
-    int offset = args.at(exec, 1)->toInt32(exec);
+    Node* refNode = toNode(args.at(0));
+    int offset = args.at(1).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->comparePoint(refNode, offset, ec));
+    JSC::JSValue result = jsNumber(exec, imp->comparePoint(refNode, offset, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsRangePrototypeFunctionIsPointInRange(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangePrototypeFunctionIsPointInRange(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRange::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRange::s_info))
         return throwError(exec, TypeError);
     JSRange* castedThisObj = static_cast<JSRange*>(asObject(thisValue));
     Range* imp = static_cast<Range*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* refNode = toNode(args.at(exec, 0));
-    int offset = args.at(exec, 1)->toInt32(exec);
+    Node* refNode = toNode(args.at(0));
+    int offset = args.at(1).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->isPointInRange(refNode, offset, ec));
+    JSC::JSValue result = jsBoolean(imp->isPointInRange(refNode, offset, ec));
     setDOMException(exec, ec);
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsRangeSTART_TO_START(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeSTART_TO_START(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsRangeSTART_TO_END(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeSTART_TO_END(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsRangeEND_TO_END(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeEND_TO_END(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsRangeEND_TO_START(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeEND_TO_START(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsRangeNODE_BEFORE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeNODE_BEFORE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsRangeNODE_AFTER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeNODE_AFTER(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsRangeNODE_BEFORE_AND_AFTER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeNODE_BEFORE_AND_AFTER(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsRangeNODE_INSIDE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeNODE_INSIDE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Range* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Range* object)
 {
     return getDOMObjectWrapper<JSRange>(exec, object);
 }
-Range* toRange(JSC::JSValuePtr value)
+Range* toRange(JSC::JSValue value)
 {
-    return value->isObject(&JSRange::s_info) ? static_cast<JSRange*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSRange::s_info) ? static_cast<JSRange*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRange.h b/src/3rdparty/webkit/WebCore/generated/JSRange.h
index bc79912..4d8a6f9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRange.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRange.h
@@ -34,33 +34,34 @@ class JSRange : public DOMObject {
 public:
     JSRange(PassRefPtr<JSC::Structure>, PassRefPtr<Range>);
     virtual ~JSRange();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     Range* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Range> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Range*);
-Range* toRange(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Range*);
+Range* toRange(JSC::JSValue);
 
 class JSRangePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,48 +70,48 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsRangePrototypeFunctionSetStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionSetEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionSetStartBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionSetStartAfter(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionSetEndBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionSetEndAfter(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionCollapse(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionSelectNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionSelectNodeContents(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionCompareBoundaryPoints(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionDeleteContents(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionExtractContents(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionCloneContents(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionInsertNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionSurroundContents(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionCloneRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionDetach(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionCreateContextualFragment(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionIntersectsNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionCompareNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionComparePoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsRangePrototypeFunctionIsPointInRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetStartBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetStartAfter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetEndBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionSetEndAfter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionCollapse(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionSelectNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionSelectNodeContents(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionCompareBoundaryPoints(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionDeleteContents(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionExtractContents(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionCloneContents(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionInsertNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionSurroundContents(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionCloneRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionDetach(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionCreateContextualFragment(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionIntersectsNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionCompareNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionComparePoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangePrototypeFunctionIsPointInRange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsRangeStartContainer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeStartOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeEndContainer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeEndOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeCollapsed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeCommonAncestorContainer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeStartContainer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeStartOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeEndContainer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeEndOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeCollapsed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeCommonAncestorContainer(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsRangeSTART_TO_START(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeSTART_TO_END(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeEND_TO_END(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeEND_TO_START(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeNODE_BEFORE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeNODE_AFTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeNODE_BEFORE_AND_AFTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeNODE_INSIDE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeSTART_TO_START(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeSTART_TO_END(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeEND_TO_END(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeEND_TO_START(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeNODE_BEFORE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeNODE_AFTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeNODE_BEFORE_AND_AFTER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeNODE_INSIDE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp b/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
index e796c7d..3cf51ee 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRangeException.cpp
@@ -19,23 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSRangeException.h"
 
-#include <wtf/GetPtr.h>
-
 #include "KURL.h"
 #include "RangeException.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSRangeException)
+ASSERT_CLASS_FITS_IN_CELL(JSRangeException);
 
 /* Hash table */
 
@@ -76,13 +73,13 @@ public:
     JSRangeExceptionConstructor(ExecState* exec)
         : DOMObject(JSRangeExceptionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSRangeExceptionPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSRangeExceptionPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -114,9 +111,9 @@ static const HashTable JSRangeExceptionPrototypeTable =
 
 const ClassInfo JSRangeExceptionPrototype::s_info = { "RangeExceptionPrototype", 0, &JSRangeExceptionPrototypeTable, 0 };
 
-JSObject* JSRangeExceptionPrototype::self(ExecState* exec)
+JSObject* JSRangeExceptionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSRangeException>(exec);
+    return getDOMPrototype<JSRangeException>(exec, globalObject);
 }
 
 bool JSRangeExceptionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -135,12 +132,11 @@ JSRangeException::JSRangeException(PassRefPtr<Structure> structure, PassRefPtr<R
 JSRangeException::~JSRangeException()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSRangeException::createPrototype(ExecState* exec)
+JSObject* JSRangeException::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSRangeExceptionPrototype(JSRangeExceptionPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSRangeExceptionPrototype(JSRangeExceptionPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSRangeException::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -148,64 +144,68 @@ bool JSRangeException::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSRangeException, Base>(exec, &JSRangeExceptionTable, this, propertyName, slot);
 }
 
-JSValuePtr jsRangeExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     RangeException* imp = static_cast<RangeException*>(static_cast<JSRangeException*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->code());
 }
 
-JSValuePtr jsRangeExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     RangeException* imp = static_cast<RangeException*>(static_cast<JSRangeException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsRangeExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     RangeException* imp = static_cast<RangeException*>(static_cast<JSRangeException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->message());
 }
 
-JSValuePtr jsRangeExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRangeExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSRangeException*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSRangeException::getConstructor(ExecState* exec)
+JSValue JSRangeException::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSRangeExceptionConstructor>(exec);
 }
 
-JSValuePtr jsRangeExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsRangeExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSRangeException::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSRangeException::s_info))
         return throwError(exec, TypeError);
     JSRangeException* castedThisObj = static_cast<JSRangeException*>(asObject(thisValue));
     RangeException* imp = static_cast<RangeException*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->toString());
+    JSC::JSValue result = jsString(exec, imp->toString());
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsRangeExceptionBAD_BOUNDARYPOINTS_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeExceptionBAD_BOUNDARYPOINTS_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsRangeExceptionINVALID_NODE_TYPE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsRangeExceptionINVALID_NODE_TYPE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, RangeException* object)
+JSC::JSValue toJS(JSC::ExecState* exec, RangeException* object)
 {
     return getDOMObjectWrapper<JSRangeException>(exec, object);
 }
-RangeException* toRangeException(JSC::JSValuePtr value)
+RangeException* toRangeException(JSC::JSValue value)
 {
-    return value->isObject(&JSRangeException::s_info) ? static_cast<JSRangeException*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSRangeException::s_info) ? static_cast<JSRangeException*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRangeException.h b/src/3rdparty/webkit/WebCore/generated/JSRangeException.h
index fc35242..5c45cd2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRangeException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRangeException.h
@@ -34,33 +34,34 @@ class JSRangeException : public DOMObject {
 public:
     JSRangeException(PassRefPtr<JSC::Structure>, PassRefPtr<RangeException>);
     virtual ~JSRangeException();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     RangeException* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<RangeException> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, RangeException*);
-RangeException* toRangeException(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, RangeException*);
+RangeException* toRangeException(JSC::JSValue);
 
 class JSRangeExceptionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,17 +70,17 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsRangeExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsRangeExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsRangeExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsRangeExceptionBAD_BOUNDARYPOINTS_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRangeExceptionINVALID_NODE_TYPE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeExceptionBAD_BOUNDARYPOINTS_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRangeExceptionINVALID_NODE_TYPE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
index 655afa0..02423ef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSRect.cpp
@@ -19,22 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSRect.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSPrimitiveValue.h"
 #include "JSCSSPrimitiveValue.h"
 #include "Rect.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSRect)
+ASSERT_CLASS_FITS_IN_CELL(JSRect);
 
 /* Hash table */
 
@@ -74,13 +70,13 @@ public:
     JSRectConstructor(ExecState* exec)
         : DOMObject(JSRectConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSRectPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSRectPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +105,9 @@ static const HashTable JSRectPrototypeTable =
 
 const ClassInfo JSRectPrototype::s_info = { "RectPrototype", 0, &JSRectPrototypeTable, 0 };
 
-JSObject* JSRectPrototype::self(ExecState* exec)
+JSObject* JSRectPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSRect>(exec);
+    return getDOMPrototype<JSRect>(exec, globalObject);
 }
 
 const ClassInfo JSRect::s_info = { "Rect", 0, &JSRectTable, 0 };
@@ -125,12 +121,11 @@ JSRect::JSRect(PassRefPtr<Structure> structure, PassRefPtr<Rect> impl)
 JSRect::~JSRect()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSRect::createPrototype(ExecState* exec)
+JSObject* JSRect::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSRectPrototype(JSRectPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSRectPrototype(JSRectPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSRect::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -138,46 +133,50 @@ bool JSRect::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName,
     return getStaticValueSlot<JSRect, Base>(exec, &JSRectTable, this, propertyName, slot);
 }
 
-JSValuePtr jsRectTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRectTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Rect* imp = static_cast<Rect*>(static_cast<JSRect*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->top()));
 }
 
-JSValuePtr jsRectRight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRectRight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Rect* imp = static_cast<Rect*>(static_cast<JSRect*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->right()));
 }
 
-JSValuePtr jsRectBottom(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRectBottom(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Rect* imp = static_cast<Rect*>(static_cast<JSRect*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->bottom()));
 }
 
-JSValuePtr jsRectLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRectLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Rect* imp = static_cast<Rect*>(static_cast<JSRect*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->left()));
 }
 
-JSValuePtr jsRectConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsRectConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSRect*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSRect::getConstructor(ExecState* exec)
+JSValue JSRect::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSRectConstructor>(exec);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Rect* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Rect* object)
 {
     return getDOMObjectWrapper<JSRect>(exec, object);
 }
-Rect* toRect(JSC::JSValuePtr value)
+Rect* toRect(JSC::JSValue value)
 {
-    return value->isObject(&JSRect::s_info) ? static_cast<JSRect*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSRect::s_info) ? static_cast<JSRect*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSRect.h b/src/3rdparty/webkit/WebCore/generated/JSRect.h
index 069ee81..be23966 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSRect.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSRect.h
@@ -34,29 +34,30 @@ class JSRect : public DOMObject {
 public:
     JSRect(PassRefPtr<JSC::Structure>, PassRefPtr<Rect>);
     virtual ~JSRect();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     Rect* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Rect> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Rect*);
-Rect* toRect(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Rect*);
+Rect* toRect(JSC::JSValue);
 
 class JSRectPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSRectPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -64,11 +65,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsRectTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRectRight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRectBottom(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRectLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsRectConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRectTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRectRight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRectBottom(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRectLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsRectConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp b/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp
index 3614d6a..77cdc74 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLError.cpp
@@ -20,21 +20,21 @@
 
 #include "config.h"
 
-#include "JSSQLError.h"
+#if ENABLE(DATABASE)
 
-#include <wtf/GetPtr.h>
+#include "JSSQLError.h"
 
 #include "KURL.h"
 #include "SQLError.h"
-
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSQLError)
+ASSERT_CLASS_FITS_IN_CELL(JSSQLError);
 
 /* Hash table */
 
@@ -68,9 +68,9 @@ static const HashTable JSSQLErrorPrototypeTable =
 
 const ClassInfo JSSQLErrorPrototype::s_info = { "SQLErrorPrototype", 0, &JSSQLErrorPrototypeTable, 0 };
 
-JSObject* JSSQLErrorPrototype::self(ExecState* exec)
+JSObject* JSSQLErrorPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSQLError>(exec);
+    return getDOMPrototype<JSSQLError>(exec, globalObject);
 }
 
 const ClassInfo JSSQLError::s_info = { "SQLError", 0, &JSSQLErrorTable, 0 };
@@ -84,12 +84,11 @@ JSSQLError::JSSQLError(PassRefPtr<Structure> structure, PassRefPtr<SQLError> imp
 JSSQLError::~JSSQLError()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSQLError::createPrototype(ExecState* exec)
+JSObject* JSSQLError::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSQLErrorPrototype(JSSQLErrorPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSQLErrorPrototype(JSSQLErrorPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSQLError::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -97,25 +96,29 @@ bool JSSQLError::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSSQLError, Base>(exec, &JSSQLErrorTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSQLErrorCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSQLErrorCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SQLError* imp = static_cast<SQLError*>(static_cast<JSSQLError*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->code());
 }
 
-JSValuePtr jsSQLErrorMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSQLErrorMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SQLError* imp = static_cast<SQLError*>(static_cast<JSSQLError*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->message());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SQLError* object)
+JSC::JSValue toJS(JSC::ExecState* exec, SQLError* object)
 {
     return getDOMObjectWrapper<JSSQLError>(exec, object);
 }
-SQLError* toSQLError(JSC::JSValuePtr value)
+SQLError* toSQLError(JSC::JSValue value)
 {
-    return value->isObject(&JSSQLError::s_info) ? static_cast<JSSQLError*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSQLError::s_info) ? static_cast<JSSQLError*>(asObject(value))->impl() : 0;
 }
 
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLError.h b/src/3rdparty/webkit/WebCore/generated/JSSQLError.h
index 470a72e..d500434f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLError.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLError.h
@@ -21,6 +21,8 @@
 #ifndef JSSQLError_h
 #define JSSQLError_h
 
+#if ENABLE(DATABASE)
+
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -34,12 +36,12 @@ class JSSQLError : public DOMObject {
 public:
     JSSQLError(PassRefPtr<JSC::Structure>, PassRefPtr<SQLError>);
     virtual ~JSSQLError();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -50,12 +52,13 @@ private:
     RefPtr<SQLError> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SQLError*);
-SQLError* toSQLError(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SQLError*);
+SQLError* toSQLError(JSC::JSValue);
 
 class JSSQLErrorPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSQLErrorPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -63,9 +66,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSQLErrorCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSQLErrorMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSQLErrorCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSQLErrorMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
+#endif // ENABLE(DATABASE)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp
index e2b23e8..8852997 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.cpp
@@ -20,21 +20,21 @@
 
 #include "config.h"
 
-#include "JSSQLResultSet.h"
+#if ENABLE(DATABASE)
 
-#include <wtf/GetPtr.h>
+#include "JSSQLResultSet.h"
 
 #include "JSSQLResultSetRowList.h"
 #include "SQLResultSet.h"
 #include "SQLResultSetRowList.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSQLResultSet)
+ASSERT_CLASS_FITS_IN_CELL(JSSQLResultSet);
 
 /* Hash table */
 
@@ -69,9 +69,9 @@ static const HashTable JSSQLResultSetPrototypeTable =
 
 const ClassInfo JSSQLResultSetPrototype::s_info = { "SQLResultSetPrototype", 0, &JSSQLResultSetPrototypeTable, 0 };
 
-JSObject* JSSQLResultSetPrototype::self(ExecState* exec)
+JSObject* JSSQLResultSetPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSQLResultSet>(exec);
+    return getDOMPrototype<JSSQLResultSet>(exec, globalObject);
 }
 
 const ClassInfo JSSQLResultSet::s_info = { "SQLResultSet", 0, &JSSQLResultSetTable, 0 };
@@ -85,12 +85,11 @@ JSSQLResultSet::JSSQLResultSet(PassRefPtr<Structure> structure, PassRefPtr<SQLRe
 JSSQLResultSet::~JSSQLResultSet()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSQLResultSet::createPrototype(ExecState* exec)
+JSObject* JSSQLResultSet::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSQLResultSetPrototype(JSSQLResultSetPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSQLResultSetPrototype(JSSQLResultSetPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSQLResultSet::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -98,34 +97,38 @@ bool JSSQLResultSet::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSSQLResultSet, Base>(exec, &JSSQLResultSetTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSQLResultSetRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSQLResultSetRows(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SQLResultSet* imp = static_cast<SQLResultSet*>(static_cast<JSSQLResultSet*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->rows()));
 }
 
-JSValuePtr jsSQLResultSetInsertId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSQLResultSetInsertId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     SQLResultSet* imp = static_cast<SQLResultSet*>(static_cast<JSSQLResultSet*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = jsNumber(exec, imp->insertId(ec));
+    JSC::JSValue result = jsNumber(exec, imp->insertId(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSQLResultSetRowsAffected(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSQLResultSetRowsAffected(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SQLResultSet* imp = static_cast<SQLResultSet*>(static_cast<JSSQLResultSet*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->rowsAffected());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SQLResultSet* object)
+JSC::JSValue toJS(JSC::ExecState* exec, SQLResultSet* object)
 {
     return getDOMObjectWrapper<JSSQLResultSet>(exec, object);
 }
-SQLResultSet* toSQLResultSet(JSC::JSValuePtr value)
+SQLResultSet* toSQLResultSet(JSC::JSValue value)
 {
-    return value->isObject(&JSSQLResultSet::s_info) ? static_cast<JSSQLResultSet*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSQLResultSet::s_info) ? static_cast<JSSQLResultSet*>(asObject(value))->impl() : 0;
 }
 
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h
index 0b8ac33..d009dad 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSet.h
@@ -21,6 +21,8 @@
 #ifndef JSSQLResultSet_h
 #define JSSQLResultSet_h
 
+#if ENABLE(DATABASE)
+
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -34,12 +36,12 @@ class JSSQLResultSet : public DOMObject {
 public:
     JSSQLResultSet(PassRefPtr<JSC::Structure>, PassRefPtr<SQLResultSet>);
     virtual ~JSSQLResultSet();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -50,12 +52,13 @@ private:
     RefPtr<SQLResultSet> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SQLResultSet*);
-SQLResultSet* toSQLResultSet(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SQLResultSet*);
+SQLResultSet* toSQLResultSet(JSC::JSValue);
 
 class JSSQLResultSetPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSQLResultSetPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -63,10 +66,12 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSQLResultSetRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSQLResultSetInsertId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSQLResultSetRowsAffected(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSQLResultSetRows(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSQLResultSetInsertId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSQLResultSetRowsAffected(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
+#endif // ENABLE(DATABASE)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.cpp
index da1804a..daf19f5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.cpp
@@ -20,20 +20,20 @@
 
 #include "config.h"
 
-#include "JSSQLResultSetRowList.h"
+#if ENABLE(DATABASE)
 
-#include <wtf/GetPtr.h>
+#include "JSSQLResultSetRowList.h"
 
 #include "SQLResultSetRowList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSQLResultSetRowList)
+ASSERT_CLASS_FITS_IN_CELL(JSSQLResultSetRowList);
 
 /* Hash table */
 
@@ -67,9 +67,9 @@ static const HashTable JSSQLResultSetRowListPrototypeTable =
 
 const ClassInfo JSSQLResultSetRowListPrototype::s_info = { "SQLResultSetRowListPrototype", 0, &JSSQLResultSetRowListPrototypeTable, 0 };
 
-JSObject* JSSQLResultSetRowListPrototype::self(ExecState* exec)
+JSObject* JSSQLResultSetRowListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSQLResultSetRowList>(exec);
+    return getDOMPrototype<JSSQLResultSetRowList>(exec, globalObject);
 }
 
 bool JSSQLResultSetRowListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -88,12 +88,11 @@ JSSQLResultSetRowList::JSSQLResultSetRowList(PassRefPtr<Structure> structure, Pa
 JSSQLResultSetRowList::~JSSQLResultSetRowList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSQLResultSetRowList::createPrototype(ExecState* exec)
+JSObject* JSSQLResultSetRowList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSQLResultSetRowListPrototype(JSSQLResultSetRowListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSQLResultSetRowListPrototype(JSSQLResultSetRowListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSQLResultSetRowList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -101,27 +100,31 @@ bool JSSQLResultSetRowList::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSSQLResultSetRowList, Base>(exec, &JSSQLResultSetRowListTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSQLResultSetRowListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSQLResultSetRowListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SQLResultSetRowList* imp = static_cast<SQLResultSetRowList*>(static_cast<JSSQLResultSetRowList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsSQLResultSetRowListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSQLResultSetRowListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSQLResultSetRowList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSQLResultSetRowList::s_info))
         return throwError(exec, TypeError);
     JSSQLResultSetRowList* castedThisObj = static_cast<JSSQLResultSetRowList*>(asObject(thisValue));
     return castedThisObj->item(exec, args);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SQLResultSetRowList* object)
+JSC::JSValue toJS(JSC::ExecState* exec, SQLResultSetRowList* object)
 {
     return getDOMObjectWrapper<JSSQLResultSetRowList>(exec, object);
 }
-SQLResultSetRowList* toSQLResultSetRowList(JSC::JSValuePtr value)
+SQLResultSetRowList* toSQLResultSetRowList(JSC::JSValue value)
 {
-    return value->isObject(&JSSQLResultSetRowList::s_info) ? static_cast<JSSQLResultSetRowList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSQLResultSetRowList::s_info) ? static_cast<JSSQLResultSetRowList*>(asObject(value))->impl() : 0;
 }
 
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h
index d2287c4..df28567 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLResultSetRowList.h
@@ -21,6 +21,8 @@
 #ifndef JSSQLResultSetRowList_h
 #define JSSQLResultSetRowList_h
 
+#if ENABLE(DATABASE)
+
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -34,35 +36,36 @@ class JSSQLResultSetRowList : public DOMObject {
 public:
     JSSQLResultSetRowList(PassRefPtr<JSC::Structure>, PassRefPtr<SQLResultSetRowList>);
     virtual ~JSSQLResultSetRowList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
 
     // Custom functions
-    JSC::JSValuePtr item(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue item(JSC::ExecState*, const JSC::ArgList&);
     SQLResultSetRowList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SQLResultSetRowList> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SQLResultSetRowList*);
-SQLResultSetRowList* toSQLResultSetRowList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SQLResultSetRowList*);
+SQLResultSetRowList* toSQLResultSetRowList(JSC::JSValue);
 
 class JSSQLResultSetRowListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -71,11 +74,13 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSQLResultSetRowListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSQLResultSetRowListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSQLResultSetRowListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSQLResultSetRowListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
+#endif // ENABLE(DATABASE)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.cpp b/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.cpp
index 01a9a30..1f086ee 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.cpp
@@ -20,19 +20,19 @@
 
 #include "config.h"
 
-#include "JSSQLTransaction.h"
+#if ENABLE(DATABASE)
 
-#include <wtf/GetPtr.h>
+#include "JSSQLTransaction.h"
 
 #include "SQLTransaction.h"
-
 #include <runtime/Error.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSQLTransaction)
+ASSERT_CLASS_FITS_IN_CELL(JSSQLTransaction);
 
 /* Hash table for prototype */
 
@@ -51,9 +51,9 @@ static const HashTable JSSQLTransactionPrototypeTable =
 
 const ClassInfo JSSQLTransactionPrototype::s_info = { "SQLTransactionPrototype", 0, &JSSQLTransactionPrototypeTable, 0 };
 
-JSObject* JSSQLTransactionPrototype::self(ExecState* exec)
+JSObject* JSSQLTransactionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSQLTransaction>(exec);
+    return getDOMPrototype<JSSQLTransaction>(exec, globalObject);
 }
 
 bool JSSQLTransactionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -72,29 +72,31 @@ JSSQLTransaction::JSSQLTransaction(PassRefPtr<Structure> structure, PassRefPtr<S
 JSSQLTransaction::~JSSQLTransaction()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSQLTransaction::createPrototype(ExecState* exec)
+JSObject* JSSQLTransaction::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSQLTransactionPrototype(JSSQLTransactionPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSQLTransactionPrototype(JSSQLTransactionPrototype::createStructure(globalObject->objectPrototype()));
 }
 
-JSValuePtr jsSQLTransactionPrototypeFunctionExecuteSql(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSQLTransactionPrototypeFunctionExecuteSql(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSQLTransaction::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSQLTransaction::s_info))
         return throwError(exec, TypeError);
     JSSQLTransaction* castedThisObj = static_cast<JSSQLTransaction*>(asObject(thisValue));
     return castedThisObj->executeSql(exec, args);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SQLTransaction* object)
+JSC::JSValue toJS(JSC::ExecState* exec, SQLTransaction* object)
 {
     return getDOMObjectWrapper<JSSQLTransaction>(exec, object);
 }
-SQLTransaction* toSQLTransaction(JSC::JSValuePtr value)
+SQLTransaction* toSQLTransaction(JSC::JSValue value)
 {
-    return value->isObject(&JSSQLTransaction::s_info) ? static_cast<JSSQLTransaction*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSQLTransaction::s_info) ? static_cast<JSSQLTransaction*>(asObject(value))->impl() : 0;
 }
 
 }
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h b/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h
index baa7240..94c10a5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSQLTransaction.h
@@ -21,6 +21,8 @@
 #ifndef JSSQLTransaction_h
 #define JSSQLTransaction_h
 
+#if ENABLE(DATABASE)
+
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -34,29 +36,30 @@ class JSSQLTransaction : public DOMObject {
 public:
     JSSQLTransaction(PassRefPtr<JSC::Structure>, PassRefPtr<SQLTransaction>);
     virtual ~JSSQLTransaction();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
 
     // Custom functions
-    JSC::JSValuePtr executeSql(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue executeSql(JSC::ExecState*, const JSC::ArgList&);
     SQLTransaction* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SQLTransaction> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SQLTransaction*);
-SQLTransaction* toSQLTransaction(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SQLTransaction*);
+SQLTransaction* toSQLTransaction(JSC::JSValue);
 
 class JSSQLTransactionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -65,8 +68,10 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSQLTransactionPrototypeFunctionExecuteSql(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSQLTransactionPrototypeFunctionExecuteSql(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 
 } // namespace WebCore
 
+#endif // ENABLE(DATABASE)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.cpp
index ef5977d..3e6d235 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGAElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -44,15 +40,15 @@
 #include "SVGAElement.h"
 #include "SVGElement.h"
 #include "SVGStringList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAElement);
 
 /* Hash table */
 
@@ -103,9 +99,9 @@ static const HashTable JSSVGAElementPrototypeTable =
 
 const ClassInfo JSSVGAElementPrototype::s_info = { "SVGAElementPrototype", 0, &JSSVGAElementPrototypeTable, 0 };
 
-JSObject* JSSVGAElementPrototype::self(ExecState* exec)
+JSObject* JSSVGAElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAElement>(exec);
+    return getDOMPrototype<JSSVGAElement>(exec, globalObject);
 }
 
 bool JSSVGAElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -120,9 +116,9 @@ JSSVGAElement::JSSVGAElement(PassRefPtr<Structure> structure, PassRefPtr<SVGAEle
 {
 }
 
-JSObject* JSSVGAElement::createPrototype(ExecState* exec)
+JSObject* JSSVGAElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAElementPrototype(JSSVGAElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGAElementPrototype(JSSVGAElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGAElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -130,179 +126,198 @@ bool JSSVGAElement::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSSVGAElement, Base>(exec, &JSSVGAElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->targetAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGAElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGAElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGAElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGAElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGAElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGAElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGAElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGAElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGAElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGAElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGAElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGAElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGAElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGAElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGAElement, Base>(exec, propertyName, value, &JSSVGAElementTable, this, slot);
 }
 
-void setJSSVGAElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGAElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAElement* imp = static_cast<SVGAElement*>(static_cast<JSSVGAElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGAElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAElement* castedThisObj = static_cast<JSSVGAElement*>(asObject(thisValue));
     SVGAElement* imp = static_cast<SVGAElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGAElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAElement* castedThisObj = static_cast<JSSVGAElement*>(asObject(thisValue));
     SVGAElement* imp = static_cast<SVGAElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGAElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAElement* castedThisObj = static_cast<JSSVGAElement*>(asObject(thisValue));
     SVGAElement* imp = static_cast<SVGAElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGAElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAElement* castedThisObj = static_cast<JSSVGAElement*>(asObject(thisValue));
     SVGAElement* imp = static_cast<SVGAElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGAElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAElement* castedThisObj = static_cast<JSSVGAElement*>(asObject(thisValue));
     SVGAElement* imp = static_cast<SVGAElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGAElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAElement* castedThisObj = static_cast<JSSVGAElement*>(asObject(thisValue));
     SVGAElement* imp = static_cast<SVGAElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h
index b5ca1fb..78406f6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGAElement_h
 #define JSSVGAElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGAElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGAElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGAElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,29 +64,29 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGAElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGAElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.cpp
index 5409761..89543b1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.cpp
@@ -20,25 +20,21 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FONTS)
 
-#include "SVGElement.h"
 #include "JSSVGAltGlyphElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGAnimatedString.h"
 #include "KURL.h"
 #include "SVGAltGlyphElement.h"
-
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAltGlyphElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAltGlyphElement);
 
 /* Hash table */
 
@@ -73,9 +69,9 @@ static const HashTable JSSVGAltGlyphElementPrototypeTable =
 
 const ClassInfo JSSVGAltGlyphElementPrototype::s_info = { "SVGAltGlyphElementPrototype", 0, &JSSVGAltGlyphElementPrototypeTable, 0 };
 
-JSObject* JSSVGAltGlyphElementPrototype::self(ExecState* exec)
+JSObject* JSSVGAltGlyphElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAltGlyphElement>(exec);
+    return getDOMPrototype<JSSVGAltGlyphElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAltGlyphElement::s_info = { "SVGAltGlyphElement", &JSSVGTextPositioningElement::s_info, &JSSVGAltGlyphElementTable, 0 };
@@ -85,9 +81,9 @@ JSSVGAltGlyphElement::JSSVGAltGlyphElement(PassRefPtr<Structure> structure, Pass
 {
 }
 
-JSObject* JSSVGAltGlyphElement::createPrototype(ExecState* exec)
+JSObject* JSSVGAltGlyphElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAltGlyphElementPrototype(JSSVGAltGlyphElementPrototype::createStructure(JSSVGTextPositioningElementPrototype::self(exec)));
+    return new (exec) JSSVGAltGlyphElementPrototype(JSSVGAltGlyphElementPrototype::createStructure(JSSVGTextPositioningElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGAltGlyphElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -95,43 +91,46 @@ bool JSSVGAltGlyphElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGAltGlyphElement, Base>(exec, &JSSVGAltGlyphElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAltGlyphElementGlyphRef(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAltGlyphElementGlyphRef(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAltGlyphElement* imp = static_cast<SVGAltGlyphElement*>(static_cast<JSSVGAltGlyphElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->glyphRef());
 }
 
-JSValuePtr jsSVGAltGlyphElementFormat(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAltGlyphElementFormat(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAltGlyphElement* imp = static_cast<SVGAltGlyphElement*>(static_cast<JSSVGAltGlyphElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->format());
 }
 
-JSValuePtr jsSVGAltGlyphElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAltGlyphElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAltGlyphElement* imp = static_cast<SVGAltGlyphElement*>(static_cast<JSSVGAltGlyphElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-void JSSVGAltGlyphElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGAltGlyphElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGAltGlyphElement, Base>(exec, propertyName, value, &JSSVGAltGlyphElementTable, this, slot);
 }
 
-void setJSSVGAltGlyphElementGlyphRef(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAltGlyphElementGlyphRef(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAltGlyphElement* imp = static_cast<SVGAltGlyphElement*>(static_cast<JSSVGAltGlyphElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
-    imp->setGlyphRef(value->toString(exec), ec);
+    imp->setGlyphRef(value.toString(exec), ec);
     setDOMException(exec, ec);
 }
 
-void setJSSVGAltGlyphElementFormat(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAltGlyphElementFormat(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAltGlyphElement* imp = static_cast<SVGAltGlyphElement*>(static_cast<JSSVGAltGlyphElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
-    imp->setFormat(value->toString(exec), ec);
+    imp->setFormat(value.toString(exec), ec);
     setDOMException(exec, ec);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h
index 79e4660..f92bdcd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAltGlyphElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGAltGlyphElement_h
 #define JSSVGAltGlyphElement_h
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FONTS)
 
 #include "JSSVGTextPositioningElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGAltGlyphElement : public JSSVGTextPositioningElement {
     typedef JSSVGTextPositioningElement Base;
 public:
     JSSVGAltGlyphElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAltGlyphElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGAltGlyphElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAltGlyphElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,11 +59,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAltGlyphElementGlyphRef(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAltGlyphElementGlyphRef(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAltGlyphElementFormat(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAltGlyphElementFormat(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAltGlyphElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAltGlyphElementGlyphRef(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAltGlyphElementGlyphRef(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAltGlyphElementFormat(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAltGlyphElementFormat(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAltGlyphElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp
index 649613c..39c7e73 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.cpp
@@ -20,26 +20,22 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGAngle.h"
 
-#include <wtf/GetPtr.h>
-
 #include "KURL.h"
 #include "SVGAngle.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAngle)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAngle);
 
 /* Hash table */
 
@@ -84,13 +80,13 @@ public:
     JSSVGAngleConstructor(ExecState* exec)
         : DOMObject(JSSVGAngleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGAnglePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGAnglePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -126,9 +122,9 @@ static const HashTable JSSVGAnglePrototypeTable =
 
 const ClassInfo JSSVGAnglePrototype::s_info = { "SVGAnglePrototype", 0, &JSSVGAnglePrototypeTable, 0 };
 
-JSObject* JSSVGAnglePrototype::self(ExecState* exec)
+JSObject* JSSVGAnglePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAngle>(exec);
+    return getDOMPrototype<JSSVGAngle>(exec, globalObject);
 }
 
 bool JSSVGAnglePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -148,12 +144,11 @@ JSSVGAngle::JSSVGAngle(PassRefPtr<Structure> structure, PassRefPtr<SVGAngle> imp
 JSSVGAngle::~JSSVGAngle()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAngle::createPrototype(ExecState* exec)
+JSObject* JSSVGAngle::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnglePrototype(JSSVGAnglePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnglePrototype(JSSVGAnglePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAngle::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -161,56 +156,60 @@ bool JSSVGAngle::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSSVGAngle, Base>(exec, &JSSVGAngleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAngleUnitType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAngleUnitType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAngle* imp = static_cast<SVGAngle*>(static_cast<JSSVGAngle*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->unitType());
 }
 
-JSValuePtr jsSVGAngleValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAngleValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAngle* imp = static_cast<SVGAngle*>(static_cast<JSSVGAngle*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->value());
 }
 
-JSValuePtr jsSVGAngleValueInSpecifiedUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAngleValueInSpecifiedUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAngle* imp = static_cast<SVGAngle*>(static_cast<JSSVGAngle*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->valueInSpecifiedUnits());
 }
 
-JSValuePtr jsSVGAngleValueAsString(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAngleValueAsString(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAngle* imp = static_cast<SVGAngle*>(static_cast<JSSVGAngle*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->valueAsString());
 }
 
-JSValuePtr jsSVGAngleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAngleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGAngle*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSSVGAngle::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGAngle::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGAngle, Base>(exec, propertyName, value, &JSSVGAngleTable, this, slot);
 }
 
-void setJSSVGAngleValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAngleValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAngle* imp = static_cast<SVGAngle*>(static_cast<JSSVGAngle*>(thisObject)->impl());
-    imp->setValue(value->toFloat(exec));
+    imp->setValue(value.toFloat(exec));
     if (static_cast<JSSVGAngle*>(thisObject)->context())
         static_cast<JSSVGAngle*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAngle*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGAngleValueInSpecifiedUnits(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAngleValueInSpecifiedUnits(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAngle* imp = static_cast<SVGAngle*>(static_cast<JSSVGAngle*>(thisObject)->impl());
-    imp->setValueInSpecifiedUnits(value->toFloat(exec));
+    imp->setValueInSpecifiedUnits(value.toFloat(exec));
     if (static_cast<JSSVGAngle*>(thisObject)->context())
         static_cast<JSSVGAngle*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAngle*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGAngleValueAsString(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAngleValueAsString(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAngle* imp = static_cast<SVGAngle*>(static_cast<JSSVGAngle*>(thisObject)->impl());
     imp->setValueAsString(valueToStringWithNullCheck(exec, value));
@@ -218,31 +217,33 @@ void setJSSVGAngleValueAsString(ExecState* exec, JSObject* thisObject, JSValuePt
         static_cast<JSSVGAngle*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAngle*>(thisObject)->impl()->associatedAttributeName());
 }
 
-JSValuePtr JSSVGAngle::getConstructor(ExecState* exec)
+JSValue JSSVGAngle::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGAngleConstructor>(exec);
 }
 
-JSValuePtr jsSVGAnglePrototypeFunctionNewValueSpecifiedUnits(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAnglePrototypeFunctionNewValueSpecifiedUnits(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAngle::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAngle::s_info))
         return throwError(exec, TypeError);
     JSSVGAngle* castedThisObj = static_cast<JSSVGAngle*>(asObject(thisValue));
     SVGAngle* imp = static_cast<SVGAngle*>(castedThisObj->impl());
-    unsigned short unitType = args.at(exec, 0)->toInt32(exec);
-    float valueInSpecifiedUnits = args.at(exec, 1)->toFloat(exec);
+    unsigned short unitType = args.at(0).toInt32(exec);
+    float valueInSpecifiedUnits = args.at(1).toFloat(exec);
 
     imp->newValueSpecifiedUnits(unitType, valueInSpecifiedUnits);
     return jsUndefined();
 }
 
-JSValuePtr jsSVGAnglePrototypeFunctionConvertToSpecifiedUnits(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAnglePrototypeFunctionConvertToSpecifiedUnits(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAngle::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAngle::s_info))
         return throwError(exec, TypeError);
     JSSVGAngle* castedThisObj = static_cast<JSSVGAngle*>(asObject(thisValue));
     SVGAngle* imp = static_cast<SVGAngle*>(castedThisObj->impl());
-    unsigned short unitType = args.at(exec, 0)->toInt32(exec);
+    unsigned short unitType = args.at(0).toInt32(exec);
 
     imp->convertToSpecifiedUnits(unitType);
     return jsUndefined();
@@ -250,38 +251,38 @@ JSValuePtr jsSVGAnglePrototypeFunctionConvertToSpecifiedUnits(ExecState* exec, J
 
 // Constant getters
 
-JSValuePtr jsSVGAngleSVG_ANGLETYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGAngleSVG_ANGLETYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGAngleSVG_ANGLETYPE_UNSPECIFIED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGAngleSVG_ANGLETYPE_UNSPECIFIED(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGAngleSVG_ANGLETYPE_DEG(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGAngleSVG_ANGLETYPE_DEG(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGAngleSVG_ANGLETYPE_RAD(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGAngleSVG_ANGLETYPE_RAD(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsSVGAngleSVG_ANGLETYPE_GRAD(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGAngleSVG_ANGLETYPE_GRAD(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAngle* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAngle* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAngle>(exec, object, context);
 }
-SVGAngle* toSVGAngle(JSC::JSValuePtr value)
+SVGAngle* toSVGAngle(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAngle::s_info) ? static_cast<JSSVGAngle*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAngle::s_info) ? static_cast<JSSVGAngle*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h
index f0fad17..5312581 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAngle.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGAngle_h
 #define JSSVGAngle_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -37,18 +37,18 @@ class JSSVGAngle : public DOMObject {
 public:
     JSSVGAngle(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAngle>, SVGElement* context);
     virtual ~JSSVGAngle();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     SVGAngle* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -57,16 +57,17 @@ private:
     RefPtr<SVGAngle > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAngle*, SVGElement* context);
-SVGAngle* toSVGAngle(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAngle*, SVGElement* context);
+SVGAngle* toSVGAngle(JSC::JSValue);
 
 class JSSVGAnglePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -75,25 +76,25 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGAnglePrototypeFunctionNewValueSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAnglePrototypeFunctionConvertToSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAnglePrototypeFunctionNewValueSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAnglePrototypeFunctionConvertToSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGAngleUnitType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAngleValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAngleValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAngleValueInSpecifiedUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAngleValueInSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAngleValueAsString(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAngleValueAsString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAngleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAngleUnitType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAngleValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAngleValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAngleValueInSpecifiedUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAngleValueInSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAngleValueAsString(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAngleValueAsString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAngleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGAngleSVG_ANGLETYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAngleSVG_ANGLETYPE_UNSPECIFIED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAngleSVG_ANGLETYPE_DEG(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAngleSVG_ANGLETYPE_RAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAngleSVG_ANGLETYPE_GRAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAngleSVG_ANGLETYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAngleSVG_ANGLETYPE_UNSPECIFIED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAngleSVG_ANGLETYPE_DEG(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAngleSVG_ANGLETYPE_RAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAngleSVG_ANGLETYPE_GRAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.cpp
index 9f6b380..cbb2269 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG_ANIMATION)
 
-#include "SVGElement.h"
 #include "JSSVGAnimateColorElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGAnimateColorElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimateColorElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimateColorElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +49,9 @@ static const HashTable JSSVGAnimateColorElementPrototypeTable =
 
 const ClassInfo JSSVGAnimateColorElementPrototype::s_info = { "SVGAnimateColorElementPrototype", 0, &JSSVGAnimateColorElementPrototypeTable, 0 };
 
-JSObject* JSSVGAnimateColorElementPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimateColorElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimateColorElement>(exec);
+    return getDOMPrototype<JSSVGAnimateColorElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimateColorElement::s_info = { "SVGAnimateColorElement", &JSSVGAnimationElement::s_info, 0, 0 };
@@ -65,9 +61,9 @@ JSSVGAnimateColorElement::JSSVGAnimateColorElement(PassRefPtr<Structure> structu
 {
 }
 
-JSObject* JSSVGAnimateColorElement::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimateColorElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimateColorElementPrototype(JSSVGAnimateColorElementPrototype::createStructure(JSSVGAnimationElementPrototype::self(exec)));
+    return new (exec) JSSVGAnimateColorElementPrototype(JSSVGAnimateColorElementPrototype::createStructure(JSSVGAnimationElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.h
index 8c7a341..a1519a4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateColorElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGAnimateColorElement_h
 #define JSSVGAnimateColorElement_h
 
-
 #if ENABLE(SVG_ANIMATION)
 
 #include "JSSVGAnimationElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,7 +34,7 @@ class JSSVGAnimateColorElement : public JSSVGAnimationElement {
     typedef JSSVGAnimationElement Base;
 public:
     JSSVGAnimateColorElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimateColorElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGAnimateColorElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimateColorElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.cpp
index b40aad2..77d0331 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG) && ENABLE(SVG_ANIMATION)
 
-#include "SVGElement.h"
 #include "JSSVGAnimateElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGAnimateElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimateElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimateElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +49,9 @@ static const HashTable JSSVGAnimateElementPrototypeTable =
 
 const ClassInfo JSSVGAnimateElementPrototype::s_info = { "SVGAnimateElementPrototype", 0, &JSSVGAnimateElementPrototypeTable, 0 };
 
-JSObject* JSSVGAnimateElementPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimateElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimateElement>(exec);
+    return getDOMPrototype<JSSVGAnimateElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimateElement::s_info = { "SVGAnimateElement", &JSSVGAnimationElement::s_info, 0, 0 };
@@ -65,9 +61,9 @@ JSSVGAnimateElement::JSSVGAnimateElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGAnimateElement::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimateElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimateElementPrototype(JSSVGAnimateElementPrototype::createStructure(JSSVGAnimationElementPrototype::self(exec)));
+    return new (exec) JSSVGAnimateElementPrototype(JSSVGAnimateElementPrototype::createStructure(JSSVGAnimationElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.h
index 818c721..77415d9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGAnimateElement_h
 #define JSSVGAnimateElement_h
 
-
 #if ENABLE(SVG) && ENABLE(SVG_ANIMATION)
 
 #include "JSSVGAnimationElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,7 +34,7 @@ class JSSVGAnimateElement : public JSSVGAnimationElement {
     typedef JSSVGAnimationElement Base;
 public:
     JSSVGAnimateElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimateElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGAnimateElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimateElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.cpp
index 07bd771..511108f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG) && ENABLE(SVG_ANIMATION)
 
-#include "SVGElement.h"
 #include "JSSVGAnimateTransformElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGAnimateTransformElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimateTransformElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimateTransformElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +49,9 @@ static const HashTable JSSVGAnimateTransformElementPrototypeTable =
 
 const ClassInfo JSSVGAnimateTransformElementPrototype::s_info = { "SVGAnimateTransformElementPrototype", 0, &JSSVGAnimateTransformElementPrototypeTable, 0 };
 
-JSObject* JSSVGAnimateTransformElementPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimateTransformElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimateTransformElement>(exec);
+    return getDOMPrototype<JSSVGAnimateTransformElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimateTransformElement::s_info = { "SVGAnimateTransformElement", &JSSVGAnimationElement::s_info, 0, 0 };
@@ -65,9 +61,9 @@ JSSVGAnimateTransformElement::JSSVGAnimateTransformElement(PassRefPtr<Structure>
 {
 }
 
-JSObject* JSSVGAnimateTransformElement::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimateTransformElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimateTransformElementPrototype(JSSVGAnimateTransformElementPrototype::createStructure(JSSVGAnimationElementPrototype::self(exec)));
+    return new (exec) JSSVGAnimateTransformElementPrototype(JSSVGAnimateTransformElementPrototype::createStructure(JSSVGAnimationElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.h
index 8d3eb52..ed8d9bb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimateTransformElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGAnimateTransformElement_h
 #define JSSVGAnimateTransformElement_h
 
-
 #if ENABLE(SVG) && ENABLE(SVG_ANIMATION)
 
 #include "JSSVGAnimationElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,7 +34,7 @@ class JSSVGAnimateTransformElement : public JSSVGAnimationElement {
     typedef JSSVGAnimationElement Base;
 public:
     JSSVGAnimateTransformElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimateTransformElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGAnimateTransformElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimateTransformElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.cpp
index ed756e2..92c485a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGAnimatedAngle.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGAngle.h"
 #include "SVGAngle.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedAngle)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedAngle);
 
 /* Hash table */
 
@@ -70,9 +66,9 @@ static const HashTable JSSVGAnimatedAnglePrototypeTable =
 
 const ClassInfo JSSVGAnimatedAnglePrototype::s_info = { "SVGAnimatedAnglePrototype", 0, &JSSVGAnimatedAnglePrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedAnglePrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedAnglePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedAngle>(exec);
+    return getDOMPrototype<JSSVGAnimatedAngle>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedAngle::s_info = { "SVGAnimatedAngle", 0, &JSSVGAnimatedAngleTable, 0 };
@@ -87,12 +83,11 @@ JSSVGAnimatedAngle::JSSVGAnimatedAngle(PassRefPtr<Structure> structure, PassRefP
 JSSVGAnimatedAngle::~JSSVGAnimatedAngle()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedAngle::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedAngle::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedAnglePrototype(JSSVGAnimatedAnglePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedAnglePrototype(JSSVGAnimatedAnglePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedAngle::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -100,25 +95,27 @@ bool JSSVGAnimatedAngle::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGAnimatedAngle, Base>(exec, &JSSVGAnimatedAngleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedAngleBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedAngleBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedAngle* imp = static_cast<SVGAnimatedAngle*>(static_cast<JSSVGAnimatedAngle*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->baseVal()), static_cast<JSSVGAnimatedAngle*>(asObject(slot.slotBase()))->context());
 }
 
-JSValuePtr jsSVGAnimatedAngleAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedAngleAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedAngle* imp = static_cast<SVGAnimatedAngle*>(static_cast<JSSVGAnimatedAngle*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->animVal()), static_cast<JSSVGAnimatedAngle*>(asObject(slot.slotBase()))->context());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedAngle* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedAngle* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedAngle>(exec, object, context);
 }
-SVGAnimatedAngle* toSVGAnimatedAngle(JSC::JSValuePtr value)
+SVGAnimatedAngle* toSVGAnimatedAngle(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedAngle::s_info) ? static_cast<JSSVGAnimatedAngle*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedAngle::s_info) ? static_cast<JSSVGAnimatedAngle*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h
index 39e5309..9500054 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedAngle.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGAnimatedAngle_h
 #define JSSVGAnimatedAngle_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -35,12 +35,12 @@ class JSSVGAnimatedAngle : public DOMObject {
 public:
     JSSVGAnimatedAngle(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedAngle>, SVGElement* context);
     virtual ~JSSVGAnimatedAngle();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -53,12 +53,13 @@ private:
     RefPtr<SVGAnimatedAngle > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedAngle*, SVGElement* context);
-SVGAnimatedAngle* toSVGAnimatedAngle(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedAngle*, SVGElement* context);
+SVGAnimatedAngle* toSVGAnimatedAngle(JSC::JSValue);
 
 class JSSVGAnimatedAnglePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedAnglePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -66,8 +67,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedAngleBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAnimatedAngleAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedAngleBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedAngleAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.cpp
index 3955417..2821aaa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.cpp
@@ -20,21 +20,17 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGAnimatedBoolean.h"
 
 #include <wtf/GetPtr.h>
 
-
-
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedBoolean)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedBoolean);
 
 /* Hash table */
 
@@ -68,9 +64,9 @@ static const HashTable JSSVGAnimatedBooleanPrototypeTable =
 
 const ClassInfo JSSVGAnimatedBooleanPrototype::s_info = { "SVGAnimatedBooleanPrototype", 0, &JSSVGAnimatedBooleanPrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedBooleanPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedBooleanPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedBoolean>(exec);
+    return getDOMPrototype<JSSVGAnimatedBoolean>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedBoolean::s_info = { "SVGAnimatedBoolean", 0, &JSSVGAnimatedBooleanTable, 0 };
@@ -85,12 +81,11 @@ JSSVGAnimatedBoolean::JSSVGAnimatedBoolean(PassRefPtr<Structure> structure, Pass
 JSSVGAnimatedBoolean::~JSSVGAnimatedBoolean()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedBoolean::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedBoolean::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedBooleanPrototype(JSSVGAnimatedBooleanPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedBooleanPrototype(JSSVGAnimatedBooleanPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedBoolean::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -98,38 +93,40 @@ bool JSSVGAnimatedBoolean::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGAnimatedBoolean, Base>(exec, &JSSVGAnimatedBooleanTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedBooleanBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedBooleanBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedBoolean* imp = static_cast<SVGAnimatedBoolean*>(static_cast<JSSVGAnimatedBoolean*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->baseVal());
 }
 
-JSValuePtr jsSVGAnimatedBooleanAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedBooleanAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedBoolean* imp = static_cast<SVGAnimatedBoolean*>(static_cast<JSSVGAnimatedBoolean*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->animVal());
 }
 
-void JSSVGAnimatedBoolean::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGAnimatedBoolean::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGAnimatedBoolean, Base>(exec, propertyName, value, &JSSVGAnimatedBooleanTable, this, slot);
 }
 
-void setJSSVGAnimatedBooleanBaseVal(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAnimatedBooleanBaseVal(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAnimatedBoolean* imp = static_cast<SVGAnimatedBoolean*>(static_cast<JSSVGAnimatedBoolean*>(thisObject)->impl());
-    imp->setBaseVal(value->toBoolean(exec));
+    imp->setBaseVal(value.toBoolean(exec));
     if (static_cast<JSSVGAnimatedBoolean*>(thisObject)->context())
         static_cast<JSSVGAnimatedBoolean*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAnimatedBoolean*>(thisObject)->impl()->associatedAttributeName());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedBoolean* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedBoolean* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedBoolean>(exec, object, context);
 }
-SVGAnimatedBoolean* toSVGAnimatedBoolean(JSC::JSValuePtr value)
+SVGAnimatedBoolean* toSVGAnimatedBoolean(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedBoolean::s_info) ? static_cast<JSSVGAnimatedBoolean*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedBoolean::s_info) ? static_cast<JSSVGAnimatedBoolean*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h
index 9b58e6c..4a4d6f6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedBoolean.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGAnimatedBoolean_h
 #define JSSVGAnimatedBoolean_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -35,13 +35,13 @@ class JSSVGAnimatedBoolean : public DOMObject {
 public:
     JSSVGAnimatedBoolean(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedBoolean>, SVGElement* context);
     virtual ~JSSVGAnimatedBoolean();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -54,12 +54,13 @@ private:
     RefPtr<SVGAnimatedBoolean > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedBoolean*, SVGElement* context);
-SVGAnimatedBoolean* toSVGAnimatedBoolean(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedBoolean*, SVGElement* context);
+SVGAnimatedBoolean* toSVGAnimatedBoolean(JSC::JSValue);
 
 class JSSVGAnimatedBooleanPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedBooleanPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -67,9 +68,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedBooleanBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAnimatedBooleanBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAnimatedBooleanAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedBooleanBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAnimatedBooleanBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAnimatedBooleanAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.cpp
index be9ae2e..3af330f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGAnimatedEnumeration.h"
 
-#include <wtf/GetPtr.h>
-
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedEnumeration)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedEnumeration);
 
 /* Hash table */
 
@@ -69,9 +65,9 @@ static const HashTable JSSVGAnimatedEnumerationPrototypeTable =
 
 const ClassInfo JSSVGAnimatedEnumerationPrototype::s_info = { "SVGAnimatedEnumerationPrototype", 0, &JSSVGAnimatedEnumerationPrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedEnumerationPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedEnumerationPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedEnumeration>(exec);
+    return getDOMPrototype<JSSVGAnimatedEnumeration>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedEnumeration::s_info = { "SVGAnimatedEnumeration", 0, &JSSVGAnimatedEnumerationTable, 0 };
@@ -86,12 +82,11 @@ JSSVGAnimatedEnumeration::JSSVGAnimatedEnumeration(PassRefPtr<Structure> structu
 JSSVGAnimatedEnumeration::~JSSVGAnimatedEnumeration()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedEnumeration::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedEnumeration::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedEnumerationPrototype(JSSVGAnimatedEnumerationPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedEnumerationPrototype(JSSVGAnimatedEnumerationPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedEnumeration::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -99,38 +94,40 @@ bool JSSVGAnimatedEnumeration::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSSVGAnimatedEnumeration, Base>(exec, &JSSVGAnimatedEnumerationTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedEnumerationBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedEnumerationBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedEnumeration* imp = static_cast<SVGAnimatedEnumeration*>(static_cast<JSSVGAnimatedEnumeration*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->baseVal());
 }
 
-JSValuePtr jsSVGAnimatedEnumerationAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedEnumerationAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedEnumeration* imp = static_cast<SVGAnimatedEnumeration*>(static_cast<JSSVGAnimatedEnumeration*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->animVal());
 }
 
-void JSSVGAnimatedEnumeration::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGAnimatedEnumeration::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGAnimatedEnumeration, Base>(exec, propertyName, value, &JSSVGAnimatedEnumerationTable, this, slot);
 }
 
-void setJSSVGAnimatedEnumerationBaseVal(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAnimatedEnumerationBaseVal(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAnimatedEnumeration* imp = static_cast<SVGAnimatedEnumeration*>(static_cast<JSSVGAnimatedEnumeration*>(thisObject)->impl());
-    imp->setBaseVal(value->toInt32(exec));
+    imp->setBaseVal(value.toInt32(exec));
     if (static_cast<JSSVGAnimatedEnumeration*>(thisObject)->context())
         static_cast<JSSVGAnimatedEnumeration*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAnimatedEnumeration*>(thisObject)->impl()->associatedAttributeName());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedEnumeration* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedEnumeration* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedEnumeration>(exec, object, context);
 }
-SVGAnimatedEnumeration* toSVGAnimatedEnumeration(JSC::JSValuePtr value)
+SVGAnimatedEnumeration* toSVGAnimatedEnumeration(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedEnumeration::s_info) ? static_cast<JSSVGAnimatedEnumeration*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedEnumeration::s_info) ? static_cast<JSSVGAnimatedEnumeration*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h
index eaaca25..b021183 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedEnumeration.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGAnimatedEnumeration_h
 #define JSSVGAnimatedEnumeration_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -35,13 +35,13 @@ class JSSVGAnimatedEnumeration : public DOMObject {
 public:
     JSSVGAnimatedEnumeration(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedEnumeration>, SVGElement* context);
     virtual ~JSSVGAnimatedEnumeration();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -54,12 +54,13 @@ private:
     RefPtr<SVGAnimatedEnumeration > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedEnumeration*, SVGElement* context);
-SVGAnimatedEnumeration* toSVGAnimatedEnumeration(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedEnumeration*, SVGElement* context);
+SVGAnimatedEnumeration* toSVGAnimatedEnumeration(JSC::JSValue);
 
 class JSSVGAnimatedEnumerationPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedEnumerationPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -67,9 +68,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedEnumerationBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAnimatedEnumerationBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAnimatedEnumerationAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedEnumerationBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAnimatedEnumerationBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAnimatedEnumerationAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.cpp
index fad8ff0..11337a2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGAnimatedInteger.h"
 
-#include <wtf/GetPtr.h>
-
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedInteger)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedInteger);
 
 /* Hash table */
 
@@ -69,9 +65,9 @@ static const HashTable JSSVGAnimatedIntegerPrototypeTable =
 
 const ClassInfo JSSVGAnimatedIntegerPrototype::s_info = { "SVGAnimatedIntegerPrototype", 0, &JSSVGAnimatedIntegerPrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedIntegerPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedIntegerPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedInteger>(exec);
+    return getDOMPrototype<JSSVGAnimatedInteger>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedInteger::s_info = { "SVGAnimatedInteger", 0, &JSSVGAnimatedIntegerTable, 0 };
@@ -86,12 +82,11 @@ JSSVGAnimatedInteger::JSSVGAnimatedInteger(PassRefPtr<Structure> structure, Pass
 JSSVGAnimatedInteger::~JSSVGAnimatedInteger()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedInteger::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedInteger::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedIntegerPrototype(JSSVGAnimatedIntegerPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedIntegerPrototype(JSSVGAnimatedIntegerPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedInteger::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -99,38 +94,40 @@ bool JSSVGAnimatedInteger::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGAnimatedInteger, Base>(exec, &JSSVGAnimatedIntegerTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedIntegerBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedIntegerBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedInteger* imp = static_cast<SVGAnimatedInteger*>(static_cast<JSSVGAnimatedInteger*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->baseVal());
 }
 
-JSValuePtr jsSVGAnimatedIntegerAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedIntegerAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedInteger* imp = static_cast<SVGAnimatedInteger*>(static_cast<JSSVGAnimatedInteger*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->animVal());
 }
 
-void JSSVGAnimatedInteger::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGAnimatedInteger::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGAnimatedInteger, Base>(exec, propertyName, value, &JSSVGAnimatedIntegerTable, this, slot);
 }
 
-void setJSSVGAnimatedIntegerBaseVal(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAnimatedIntegerBaseVal(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAnimatedInteger* imp = static_cast<SVGAnimatedInteger*>(static_cast<JSSVGAnimatedInteger*>(thisObject)->impl());
-    imp->setBaseVal(value->toInt32(exec));
+    imp->setBaseVal(value.toInt32(exec));
     if (static_cast<JSSVGAnimatedInteger*>(thisObject)->context())
         static_cast<JSSVGAnimatedInteger*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAnimatedInteger*>(thisObject)->impl()->associatedAttributeName());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedInteger* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedInteger* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedInteger>(exec, object, context);
 }
-SVGAnimatedInteger* toSVGAnimatedInteger(JSC::JSValuePtr value)
+SVGAnimatedInteger* toSVGAnimatedInteger(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedInteger::s_info) ? static_cast<JSSVGAnimatedInteger*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedInteger::s_info) ? static_cast<JSSVGAnimatedInteger*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h
index f8402d6..34947f0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedInteger.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGAnimatedInteger_h
 #define JSSVGAnimatedInteger_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -35,13 +35,13 @@ class JSSVGAnimatedInteger : public DOMObject {
 public:
     JSSVGAnimatedInteger(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedInteger>, SVGElement* context);
     virtual ~JSSVGAnimatedInteger();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -54,12 +54,13 @@ private:
     RefPtr<SVGAnimatedInteger > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedInteger*, SVGElement* context);
-SVGAnimatedInteger* toSVGAnimatedInteger(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedInteger*, SVGElement* context);
+SVGAnimatedInteger* toSVGAnimatedInteger(JSC::JSValue);
 
 class JSSVGAnimatedIntegerPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedIntegerPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -67,9 +68,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedIntegerBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAnimatedIntegerBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAnimatedIntegerAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedIntegerBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAnimatedIntegerBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAnimatedIntegerAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.cpp
index b6f95ee..2e1fc5b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGAnimatedLength.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGLength.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedLength)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedLength);
 
 /* Hash table */
 
@@ -69,9 +65,9 @@ static const HashTable JSSVGAnimatedLengthPrototypeTable =
 
 const ClassInfo JSSVGAnimatedLengthPrototype::s_info = { "SVGAnimatedLengthPrototype", 0, &JSSVGAnimatedLengthPrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedLengthPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedLengthPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedLength>(exec);
+    return getDOMPrototype<JSSVGAnimatedLength>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedLength::s_info = { "SVGAnimatedLength", 0, &JSSVGAnimatedLengthTable, 0 };
@@ -86,12 +82,11 @@ JSSVGAnimatedLength::JSSVGAnimatedLength(PassRefPtr<Structure> structure, PassRe
 JSSVGAnimatedLength::~JSSVGAnimatedLength()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedLength::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedLength::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedLengthPrototype(JSSVGAnimatedLengthPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedLengthPrototype(JSSVGAnimatedLengthPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedLength::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -99,25 +94,27 @@ bool JSSVGAnimatedLength::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGAnimatedLength, Base>(exec, &JSSVGAnimatedLengthTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedLengthBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedLengthBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedLength* imp = static_cast<SVGAnimatedLength*>(static_cast<JSSVGAnimatedLength*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, JSSVGDynamicPODTypeWrapperCache<SVGLength, SVGAnimatedLength>::lookupOrCreateWrapper(imp, &SVGAnimatedLength::baseVal, &SVGAnimatedLength::setBaseVal).get(), static_cast<JSSVGAnimatedLength*>(asObject(slot.slotBase()))->context());
 }
 
-JSValuePtr jsSVGAnimatedLengthAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedLengthAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedLength* imp = static_cast<SVGAnimatedLength*>(static_cast<JSSVGAnimatedLength*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, JSSVGDynamicPODTypeWrapperCache<SVGLength, SVGAnimatedLength>::lookupOrCreateWrapper(imp, &SVGAnimatedLength::animVal, &SVGAnimatedLength::setAnimVal).get(), static_cast<JSSVGAnimatedLength*>(asObject(slot.slotBase()))->context());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedLength* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedLength* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedLength>(exec, object, context);
 }
-SVGAnimatedLength* toSVGAnimatedLength(JSC::JSValuePtr value)
+SVGAnimatedLength* toSVGAnimatedLength(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedLength::s_info) ? static_cast<JSSVGAnimatedLength*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedLength::s_info) ? static_cast<JSSVGAnimatedLength*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h
index dd9a6ec..430d78b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLength.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGAnimatedLength_h
 #define JSSVGAnimatedLength_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -35,12 +35,12 @@ class JSSVGAnimatedLength : public DOMObject {
 public:
     JSSVGAnimatedLength(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedLength>, SVGElement* context);
     virtual ~JSSVGAnimatedLength();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -53,12 +53,13 @@ private:
     RefPtr<SVGAnimatedLength > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedLength*, SVGElement* context);
-SVGAnimatedLength* toSVGAnimatedLength(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedLength*, SVGElement* context);
+SVGAnimatedLength* toSVGAnimatedLength(JSC::JSValue);
 
 class JSSVGAnimatedLengthPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedLengthPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -66,8 +67,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedLengthBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAnimatedLengthAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedLengthBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedLengthAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.cpp
index 31c17e7..04fa5f2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGAnimatedLengthList.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGLengthList.h"
 #include "SVGLengthList.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedLengthList)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedLengthList);
 
 /* Hash table */
 
@@ -70,9 +66,9 @@ static const HashTable JSSVGAnimatedLengthListPrototypeTable =
 
 const ClassInfo JSSVGAnimatedLengthListPrototype::s_info = { "SVGAnimatedLengthListPrototype", 0, &JSSVGAnimatedLengthListPrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedLengthListPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedLengthListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedLengthList>(exec);
+    return getDOMPrototype<JSSVGAnimatedLengthList>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedLengthList::s_info = { "SVGAnimatedLengthList", 0, &JSSVGAnimatedLengthListTable, 0 };
@@ -87,12 +83,11 @@ JSSVGAnimatedLengthList::JSSVGAnimatedLengthList(PassRefPtr<Structure> structure
 JSSVGAnimatedLengthList::~JSSVGAnimatedLengthList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedLengthList::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedLengthList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedLengthListPrototype(JSSVGAnimatedLengthListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedLengthListPrototype(JSSVGAnimatedLengthListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedLengthList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -100,25 +95,27 @@ bool JSSVGAnimatedLengthList::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSSVGAnimatedLengthList, Base>(exec, &JSSVGAnimatedLengthListTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedLengthListBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedLengthListBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedLengthList* imp = static_cast<SVGAnimatedLengthList*>(static_cast<JSSVGAnimatedLengthList*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->baseVal()), static_cast<JSSVGAnimatedLengthList*>(asObject(slot.slotBase()))->context());
 }
 
-JSValuePtr jsSVGAnimatedLengthListAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedLengthListAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedLengthList* imp = static_cast<SVGAnimatedLengthList*>(static_cast<JSSVGAnimatedLengthList*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->animVal()), static_cast<JSSVGAnimatedLengthList*>(asObject(slot.slotBase()))->context());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedLengthList* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedLengthList* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedLengthList>(exec, object, context);
 }
-SVGAnimatedLengthList* toSVGAnimatedLengthList(JSC::JSValuePtr value)
+SVGAnimatedLengthList* toSVGAnimatedLengthList(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedLengthList::s_info) ? static_cast<JSSVGAnimatedLengthList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedLengthList::s_info) ? static_cast<JSSVGAnimatedLengthList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h
index 227ba01..bd19ac9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedLengthList.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGAnimatedLengthList_h
 #define JSSVGAnimatedLengthList_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -35,12 +35,12 @@ class JSSVGAnimatedLengthList : public DOMObject {
 public:
     JSSVGAnimatedLengthList(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedLengthList>, SVGElement* context);
     virtual ~JSSVGAnimatedLengthList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -53,12 +53,13 @@ private:
     RefPtr<SVGAnimatedLengthList > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedLengthList*, SVGElement* context);
-SVGAnimatedLengthList* toSVGAnimatedLengthList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedLengthList*, SVGElement* context);
+SVGAnimatedLengthList* toSVGAnimatedLengthList(JSC::JSValue);
 
 class JSSVGAnimatedLengthListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedLengthListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -66,8 +67,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedLengthListBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAnimatedLengthListAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedLengthListBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedLengthListAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.cpp
index dcdf076..0b1d5a3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGAnimatedNumber.h"
 
-#include <wtf/GetPtr.h>
-
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedNumber)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedNumber);
 
 /* Hash table */
 
@@ -69,9 +65,9 @@ static const HashTable JSSVGAnimatedNumberPrototypeTable =
 
 const ClassInfo JSSVGAnimatedNumberPrototype::s_info = { "SVGAnimatedNumberPrototype", 0, &JSSVGAnimatedNumberPrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedNumberPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedNumberPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedNumber>(exec);
+    return getDOMPrototype<JSSVGAnimatedNumber>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedNumber::s_info = { "SVGAnimatedNumber", 0, &JSSVGAnimatedNumberTable, 0 };
@@ -86,12 +82,11 @@ JSSVGAnimatedNumber::JSSVGAnimatedNumber(PassRefPtr<Structure> structure, PassRe
 JSSVGAnimatedNumber::~JSSVGAnimatedNumber()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedNumber::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedNumber::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedNumberPrototype(JSSVGAnimatedNumberPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedNumberPrototype(JSSVGAnimatedNumberPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedNumber::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -99,38 +94,40 @@ bool JSSVGAnimatedNumber::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGAnimatedNumber, Base>(exec, &JSSVGAnimatedNumberTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedNumberBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedNumberBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedNumber* imp = static_cast<SVGAnimatedNumber*>(static_cast<JSSVGAnimatedNumber*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->baseVal());
 }
 
-JSValuePtr jsSVGAnimatedNumberAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedNumberAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedNumber* imp = static_cast<SVGAnimatedNumber*>(static_cast<JSSVGAnimatedNumber*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->animVal());
 }
 
-void JSSVGAnimatedNumber::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGAnimatedNumber::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGAnimatedNumber, Base>(exec, propertyName, value, &JSSVGAnimatedNumberTable, this, slot);
 }
 
-void setJSSVGAnimatedNumberBaseVal(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAnimatedNumberBaseVal(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAnimatedNumber* imp = static_cast<SVGAnimatedNumber*>(static_cast<JSSVGAnimatedNumber*>(thisObject)->impl());
-    imp->setBaseVal(value->toFloat(exec));
+    imp->setBaseVal(value.toFloat(exec));
     if (static_cast<JSSVGAnimatedNumber*>(thisObject)->context())
         static_cast<JSSVGAnimatedNumber*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAnimatedNumber*>(thisObject)->impl()->associatedAttributeName());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedNumber* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedNumber* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedNumber>(exec, object, context);
 }
-SVGAnimatedNumber* toSVGAnimatedNumber(JSC::JSValuePtr value)
+SVGAnimatedNumber* toSVGAnimatedNumber(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedNumber::s_info) ? static_cast<JSSVGAnimatedNumber*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedNumber::s_info) ? static_cast<JSSVGAnimatedNumber*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h
index 77590fb..77f77a6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumber.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGAnimatedNumber_h
 #define JSSVGAnimatedNumber_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -35,13 +35,13 @@ class JSSVGAnimatedNumber : public DOMObject {
 public:
     JSSVGAnimatedNumber(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedNumber>, SVGElement* context);
     virtual ~JSSVGAnimatedNumber();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -54,12 +54,13 @@ private:
     RefPtr<SVGAnimatedNumber > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedNumber*, SVGElement* context);
-SVGAnimatedNumber* toSVGAnimatedNumber(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedNumber*, SVGElement* context);
+SVGAnimatedNumber* toSVGAnimatedNumber(JSC::JSValue);
 
 class JSSVGAnimatedNumberPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedNumberPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -67,9 +68,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedNumberBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAnimatedNumberBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAnimatedNumberAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedNumberBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAnimatedNumberBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAnimatedNumberAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.cpp
index cd39b16..3e07104 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGAnimatedNumberList.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGNumberList.h"
 #include "SVGNumberList.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedNumberList)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedNumberList);
 
 /* Hash table */
 
@@ -70,9 +66,9 @@ static const HashTable JSSVGAnimatedNumberListPrototypeTable =
 
 const ClassInfo JSSVGAnimatedNumberListPrototype::s_info = { "SVGAnimatedNumberListPrototype", 0, &JSSVGAnimatedNumberListPrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedNumberListPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedNumberListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedNumberList>(exec);
+    return getDOMPrototype<JSSVGAnimatedNumberList>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedNumberList::s_info = { "SVGAnimatedNumberList", 0, &JSSVGAnimatedNumberListTable, 0 };
@@ -87,12 +83,11 @@ JSSVGAnimatedNumberList::JSSVGAnimatedNumberList(PassRefPtr<Structure> structure
 JSSVGAnimatedNumberList::~JSSVGAnimatedNumberList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedNumberList::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedNumberList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedNumberListPrototype(JSSVGAnimatedNumberListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedNumberListPrototype(JSSVGAnimatedNumberListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedNumberList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -100,25 +95,27 @@ bool JSSVGAnimatedNumberList::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSSVGAnimatedNumberList, Base>(exec, &JSSVGAnimatedNumberListTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedNumberListBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedNumberListBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedNumberList* imp = static_cast<SVGAnimatedNumberList*>(static_cast<JSSVGAnimatedNumberList*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->baseVal()), static_cast<JSSVGAnimatedNumberList*>(asObject(slot.slotBase()))->context());
 }
 
-JSValuePtr jsSVGAnimatedNumberListAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedNumberListAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedNumberList* imp = static_cast<SVGAnimatedNumberList*>(static_cast<JSSVGAnimatedNumberList*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->animVal()), static_cast<JSSVGAnimatedNumberList*>(asObject(slot.slotBase()))->context());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedNumberList* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedNumberList* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedNumberList>(exec, object, context);
 }
-SVGAnimatedNumberList* toSVGAnimatedNumberList(JSC::JSValuePtr value)
+SVGAnimatedNumberList* toSVGAnimatedNumberList(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedNumberList::s_info) ? static_cast<JSSVGAnimatedNumberList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedNumberList::s_info) ? static_cast<JSSVGAnimatedNumberList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h
index 15e7888..bc1c751 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedNumberList.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGAnimatedNumberList_h
 #define JSSVGAnimatedNumberList_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -35,12 +35,12 @@ class JSSVGAnimatedNumberList : public DOMObject {
 public:
     JSSVGAnimatedNumberList(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedNumberList>, SVGElement* context);
     virtual ~JSSVGAnimatedNumberList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -53,12 +53,13 @@ private:
     RefPtr<SVGAnimatedNumberList > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedNumberList*, SVGElement* context);
-SVGAnimatedNumberList* toSVGAnimatedNumberList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedNumberList*, SVGElement* context);
+SVGAnimatedNumberList* toSVGAnimatedNumberList(JSC::JSValue);
 
 class JSSVGAnimatedNumberListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedNumberListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -66,8 +67,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedNumberListBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAnimatedNumberListAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedNumberListBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedNumberListAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.cpp
index 04b2e73..6209832 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGAnimatedPreserveAspectRatio.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGPreserveAspectRatio.h"
 #include "SVGPreserveAspectRatio.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedPreserveAspectRatio)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedPreserveAspectRatio);
 
 /* Hash table */
 
@@ -70,9 +66,9 @@ static const HashTable JSSVGAnimatedPreserveAspectRatioPrototypeTable =
 
 const ClassInfo JSSVGAnimatedPreserveAspectRatioPrototype::s_info = { "SVGAnimatedPreserveAspectRatioPrototype", 0, &JSSVGAnimatedPreserveAspectRatioPrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedPreserveAspectRatioPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedPreserveAspectRatioPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedPreserveAspectRatio>(exec);
+    return getDOMPrototype<JSSVGAnimatedPreserveAspectRatio>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedPreserveAspectRatio::s_info = { "SVGAnimatedPreserveAspectRatio", 0, &JSSVGAnimatedPreserveAspectRatioTable, 0 };
@@ -87,12 +83,11 @@ JSSVGAnimatedPreserveAspectRatio::JSSVGAnimatedPreserveAspectRatio(PassRefPtr<St
 JSSVGAnimatedPreserveAspectRatio::~JSSVGAnimatedPreserveAspectRatio()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedPreserveAspectRatio::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedPreserveAspectRatio::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedPreserveAspectRatioPrototype(JSSVGAnimatedPreserveAspectRatioPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedPreserveAspectRatioPrototype(JSSVGAnimatedPreserveAspectRatioPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedPreserveAspectRatio::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -100,25 +95,27 @@ bool JSSVGAnimatedPreserveAspectRatio::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSSVGAnimatedPreserveAspectRatio, Base>(exec, &JSSVGAnimatedPreserveAspectRatioTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedPreserveAspectRatioBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedPreserveAspectRatioBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedPreserveAspectRatio* imp = static_cast<SVGAnimatedPreserveAspectRatio*>(static_cast<JSSVGAnimatedPreserveAspectRatio*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->baseVal()), static_cast<JSSVGAnimatedPreserveAspectRatio*>(asObject(slot.slotBase()))->context());
 }
 
-JSValuePtr jsSVGAnimatedPreserveAspectRatioAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedPreserveAspectRatioAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedPreserveAspectRatio* imp = static_cast<SVGAnimatedPreserveAspectRatio*>(static_cast<JSSVGAnimatedPreserveAspectRatio*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->animVal()), static_cast<JSSVGAnimatedPreserveAspectRatio*>(asObject(slot.slotBase()))->context());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedPreserveAspectRatio* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedPreserveAspectRatio* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedPreserveAspectRatio>(exec, object, context);
 }
-SVGAnimatedPreserveAspectRatio* toSVGAnimatedPreserveAspectRatio(JSC::JSValuePtr value)
+SVGAnimatedPreserveAspectRatio* toSVGAnimatedPreserveAspectRatio(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedPreserveAspectRatio::s_info) ? static_cast<JSSVGAnimatedPreserveAspectRatio*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedPreserveAspectRatio::s_info) ? static_cast<JSSVGAnimatedPreserveAspectRatio*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h
index 05bcb19..3a36ff9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedPreserveAspectRatio.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGAnimatedPreserveAspectRatio_h
 #define JSSVGAnimatedPreserveAspectRatio_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -35,12 +35,12 @@ class JSSVGAnimatedPreserveAspectRatio : public DOMObject {
 public:
     JSSVGAnimatedPreserveAspectRatio(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedPreserveAspectRatio>, SVGElement* context);
     virtual ~JSSVGAnimatedPreserveAspectRatio();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -53,12 +53,13 @@ private:
     RefPtr<SVGAnimatedPreserveAspectRatio > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedPreserveAspectRatio*, SVGElement* context);
-SVGAnimatedPreserveAspectRatio* toSVGAnimatedPreserveAspectRatio(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedPreserveAspectRatio*, SVGElement* context);
+SVGAnimatedPreserveAspectRatio* toSVGAnimatedPreserveAspectRatio(JSC::JSValue);
 
 class JSSVGAnimatedPreserveAspectRatioPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedPreserveAspectRatioPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -66,8 +67,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedPreserveAspectRatioBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAnimatedPreserveAspectRatioAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedPreserveAspectRatioBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedPreserveAspectRatioAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.cpp
index 59ff2d1..41698eb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGAnimatedRect.h"
 
-#include <wtf/GetPtr.h>
-
 #include "FloatRect.h"
 #include "JSSVGRect.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedRect)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedRect);
 
 /* Hash table */
 
@@ -70,9 +66,9 @@ static const HashTable JSSVGAnimatedRectPrototypeTable =
 
 const ClassInfo JSSVGAnimatedRectPrototype::s_info = { "SVGAnimatedRectPrototype", 0, &JSSVGAnimatedRectPrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedRectPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedRectPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedRect>(exec);
+    return getDOMPrototype<JSSVGAnimatedRect>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedRect::s_info = { "SVGAnimatedRect", 0, &JSSVGAnimatedRectTable, 0 };
@@ -87,12 +83,11 @@ JSSVGAnimatedRect::JSSVGAnimatedRect(PassRefPtr<Structure> structure, PassRefPtr
 JSSVGAnimatedRect::~JSSVGAnimatedRect()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedRect::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedRect::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedRectPrototype(JSSVGAnimatedRectPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedRectPrototype(JSSVGAnimatedRectPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedRect::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -100,25 +95,27 @@ bool JSSVGAnimatedRect::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSSVGAnimatedRect, Base>(exec, &JSSVGAnimatedRectTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedRectBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedRectBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedRect* imp = static_cast<SVGAnimatedRect*>(static_cast<JSSVGAnimatedRect*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, JSSVGDynamicPODTypeWrapperCache<FloatRect, SVGAnimatedRect>::lookupOrCreateWrapper(imp, &SVGAnimatedRect::baseVal, &SVGAnimatedRect::setBaseVal).get(), static_cast<JSSVGAnimatedRect*>(asObject(slot.slotBase()))->context());
 }
 
-JSValuePtr jsSVGAnimatedRectAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedRectAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedRect* imp = static_cast<SVGAnimatedRect*>(static_cast<JSSVGAnimatedRect*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, JSSVGDynamicPODTypeWrapperCache<FloatRect, SVGAnimatedRect>::lookupOrCreateWrapper(imp, &SVGAnimatedRect::animVal, &SVGAnimatedRect::setAnimVal).get(), static_cast<JSSVGAnimatedRect*>(asObject(slot.slotBase()))->context());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedRect* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedRect* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedRect>(exec, object, context);
 }
-SVGAnimatedRect* toSVGAnimatedRect(JSC::JSValuePtr value)
+SVGAnimatedRect* toSVGAnimatedRect(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedRect::s_info) ? static_cast<JSSVGAnimatedRect*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedRect::s_info) ? static_cast<JSSVGAnimatedRect*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h
index 55b9ed3..00c9ffa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedRect.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGAnimatedRect_h
 #define JSSVGAnimatedRect_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -35,12 +35,12 @@ class JSSVGAnimatedRect : public DOMObject {
 public:
     JSSVGAnimatedRect(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedRect>, SVGElement* context);
     virtual ~JSSVGAnimatedRect();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -53,12 +53,13 @@ private:
     RefPtr<SVGAnimatedRect > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedRect*, SVGElement* context);
-SVGAnimatedRect* toSVGAnimatedRect(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedRect*, SVGElement* context);
+SVGAnimatedRect* toSVGAnimatedRect(JSC::JSValue);
 
 class JSSVGAnimatedRectPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedRectPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -66,8 +67,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedRectBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAnimatedRectAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedRectBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedRectAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.cpp
index e35e918..8d29f52 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.cpp
@@ -20,24 +20,20 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGAnimatedString.h"
 
-#include <wtf/GetPtr.h>
-
 #include "KURL.h"
 #include "PlatformString.h"
-
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedString)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedString);
 
 /* Hash table */
 
@@ -71,9 +67,9 @@ static const HashTable JSSVGAnimatedStringPrototypeTable =
 
 const ClassInfo JSSVGAnimatedStringPrototype::s_info = { "SVGAnimatedStringPrototype", 0, &JSSVGAnimatedStringPrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedStringPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedStringPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedString>(exec);
+    return getDOMPrototype<JSSVGAnimatedString>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedString::s_info = { "SVGAnimatedString", 0, &JSSVGAnimatedStringTable, 0 };
@@ -88,12 +84,11 @@ JSSVGAnimatedString::JSSVGAnimatedString(PassRefPtr<Structure> structure, PassRe
 JSSVGAnimatedString::~JSSVGAnimatedString()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedString::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedString::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedStringPrototype(JSSVGAnimatedStringPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedStringPrototype(JSSVGAnimatedStringPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedString::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -101,38 +96,40 @@ bool JSSVGAnimatedString::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGAnimatedString, Base>(exec, &JSSVGAnimatedStringTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedStringBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedStringBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedString* imp = static_cast<SVGAnimatedString*>(static_cast<JSSVGAnimatedString*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->baseVal());
 }
 
-JSValuePtr jsSVGAnimatedStringAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedStringAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedString* imp = static_cast<SVGAnimatedString*>(static_cast<JSSVGAnimatedString*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->animVal());
 }
 
-void JSSVGAnimatedString::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGAnimatedString::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGAnimatedString, Base>(exec, propertyName, value, &JSSVGAnimatedStringTable, this, slot);
 }
 
-void setJSSVGAnimatedStringBaseVal(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGAnimatedStringBaseVal(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGAnimatedString* imp = static_cast<SVGAnimatedString*>(static_cast<JSSVGAnimatedString*>(thisObject)->impl());
-    imp->setBaseVal(value->toString(exec));
+    imp->setBaseVal(value.toString(exec));
     if (static_cast<JSSVGAnimatedString*>(thisObject)->context())
         static_cast<JSSVGAnimatedString*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGAnimatedString*>(thisObject)->impl()->associatedAttributeName());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedString* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedString* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedString>(exec, object, context);
 }
-SVGAnimatedString* toSVGAnimatedString(JSC::JSValuePtr value)
+SVGAnimatedString* toSVGAnimatedString(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedString::s_info) ? static_cast<JSSVGAnimatedString*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedString::s_info) ? static_cast<JSSVGAnimatedString*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h
index 71bf12d..c7fd6db 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedString.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGAnimatedString_h
 #define JSSVGAnimatedString_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -35,13 +35,13 @@ class JSSVGAnimatedString : public DOMObject {
 public:
     JSSVGAnimatedString(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedString>, SVGElement* context);
     virtual ~JSSVGAnimatedString();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -54,12 +54,13 @@ private:
     RefPtr<SVGAnimatedString > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedString*, SVGElement* context);
-SVGAnimatedString* toSVGAnimatedString(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedString*, SVGElement* context);
+SVGAnimatedString* toSVGAnimatedString(JSC::JSValue);
 
 class JSSVGAnimatedStringPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedStringPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -67,9 +68,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedStringBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGAnimatedStringBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGAnimatedStringAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedStringBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGAnimatedStringBaseVal(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGAnimatedStringAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.cpp
index bf28b97..ecdf262 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGAnimatedTransformList.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGTransformList.h"
 #include "SVGTransformList.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedTransformList)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimatedTransformList);
 
 /* Hash table */
 
@@ -70,9 +66,9 @@ static const HashTable JSSVGAnimatedTransformListPrototypeTable =
 
 const ClassInfo JSSVGAnimatedTransformListPrototype::s_info = { "SVGAnimatedTransformListPrototype", 0, &JSSVGAnimatedTransformListPrototypeTable, 0 };
 
-JSObject* JSSVGAnimatedTransformListPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimatedTransformListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimatedTransformList>(exec);
+    return getDOMPrototype<JSSVGAnimatedTransformList>(exec, globalObject);
 }
 
 const ClassInfo JSSVGAnimatedTransformList::s_info = { "SVGAnimatedTransformList", 0, &JSSVGAnimatedTransformListTable, 0 };
@@ -87,12 +83,11 @@ JSSVGAnimatedTransformList::JSSVGAnimatedTransformList(PassRefPtr<Structure> str
 JSSVGAnimatedTransformList::~JSSVGAnimatedTransformList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGAnimatedTransformList::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimatedTransformList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimatedTransformListPrototype(JSSVGAnimatedTransformListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGAnimatedTransformListPrototype(JSSVGAnimatedTransformListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGAnimatedTransformList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -100,25 +95,27 @@ bool JSSVGAnimatedTransformList::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSSVGAnimatedTransformList, Base>(exec, &JSSVGAnimatedTransformListTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimatedTransformListBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedTransformListBaseVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedTransformList* imp = static_cast<SVGAnimatedTransformList*>(static_cast<JSSVGAnimatedTransformList*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->baseVal()), static_cast<JSSVGAnimatedTransformList*>(asObject(slot.slotBase()))->context());
 }
 
-JSValuePtr jsSVGAnimatedTransformListAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimatedTransformListAnimVal(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimatedTransformList* imp = static_cast<SVGAnimatedTransformList*>(static_cast<JSSVGAnimatedTransformList*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->animVal()), static_cast<JSSVGAnimatedTransformList*>(asObject(slot.slotBase()))->context());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGAnimatedTransformList* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGAnimatedTransformList* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGAnimatedTransformList>(exec, object, context);
 }
-SVGAnimatedTransformList* toSVGAnimatedTransformList(JSC::JSValuePtr value)
+SVGAnimatedTransformList* toSVGAnimatedTransformList(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGAnimatedTransformList::s_info) ? static_cast<JSSVGAnimatedTransformList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGAnimatedTransformList::s_info) ? static_cast<JSSVGAnimatedTransformList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h
index bd96456..eb129ef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimatedTransformList.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGAnimatedTransformList_h
 #define JSSVGAnimatedTransformList_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -35,12 +35,12 @@ class JSSVGAnimatedTransformList : public DOMObject {
 public:
     JSSVGAnimatedTransformList(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimatedTransformList>, SVGElement* context);
     virtual ~JSSVGAnimatedTransformList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -53,12 +53,13 @@ private:
     RefPtr<SVGAnimatedTransformList > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGAnimatedTransformList*, SVGElement* context);
-SVGAnimatedTransformList* toSVGAnimatedTransformList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGAnimatedTransformList*, SVGElement* context);
+SVGAnimatedTransformList* toSVGAnimatedTransformList(JSC::JSValue);
 
 class JSSVGAnimatedTransformListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGAnimatedTransformListPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -66,8 +67,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimatedTransformListBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAnimatedTransformListAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedTransformListBaseVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimatedTransformListAnimVal(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.cpp
index 6f22756..12d6f19 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.cpp
@@ -20,29 +20,25 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG_ANIMATION)
 
-#include "SVGElement.h"
 #include "JSSVGAnimationElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGAnimatedBoolean.h"
 #include "JSSVGElement.h"
 #include "JSSVGStringList.h"
 #include "SVGAnimationElement.h"
 #include "SVGElement.h"
 #include "SVGStringList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimationElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGAnimationElement);
 
 /* Hash table */
 
@@ -87,9 +83,9 @@ static const HashTable JSSVGAnimationElementPrototypeTable =
 
 const ClassInfo JSSVGAnimationElementPrototype::s_info = { "SVGAnimationElementPrototype", 0, &JSSVGAnimationElementPrototypeTable, 0 };
 
-JSObject* JSSVGAnimationElementPrototype::self(ExecState* exec)
+JSObject* JSSVGAnimationElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGAnimationElement>(exec);
+    return getDOMPrototype<JSSVGAnimationElement>(exec, globalObject);
 }
 
 bool JSSVGAnimationElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -104,9 +100,9 @@ JSSVGAnimationElement::JSSVGAnimationElement(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSSVGAnimationElement::createPrototype(ExecState* exec)
+JSObject* JSSVGAnimationElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGAnimationElementPrototype(JSSVGAnimationElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGAnimationElementPrototype(JSSVGAnimationElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGAnimationElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -114,142 +110,155 @@ bool JSSVGAnimationElement::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSSVGAnimationElement, Base>(exec, &JSSVGAnimationElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGAnimationElementTargetElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimationElementTargetElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(static_cast<JSSVGAnimationElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->targetElement()));
 }
 
-JSValuePtr jsSVGAnimationElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimationElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(static_cast<JSSVGAnimationElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGAnimationElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimationElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(static_cast<JSSVGAnimationElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGAnimationElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimationElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(static_cast<JSSVGAnimationElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGAnimationElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGAnimationElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(static_cast<JSSVGAnimationElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGAnimationElementPrototypeFunctionGetStartTime(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionGetStartTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAnimationElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getStartTime());
+    JSC::JSValue result = jsNumber(exec, imp->getStartTime());
     return result;
 }
 
-JSValuePtr jsSVGAnimationElementPrototypeFunctionGetCurrentTime(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionGetCurrentTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAnimationElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getCurrentTime());
+    JSC::JSValue result = jsNumber(exec, imp->getCurrentTime());
     return result;
 }
 
-JSValuePtr jsSVGAnimationElementPrototypeFunctionGetSimpleDuration(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionGetSimpleDuration(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAnimationElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getSimpleDuration(ec));
+    JSC::JSValue result = jsNumber(exec, imp->getSimpleDuration(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGAnimationElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAnimationElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGAnimationElementPrototypeFunctionBeginElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionBeginElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAnimationElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->beginElement(ec));
+    JSC::JSValue result = jsBoolean(imp->beginElement(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGAnimationElementPrototypeFunctionBeginElementAt(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionBeginElementAt(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAnimationElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float offset = args.at(exec, 0)->toFloat(exec);
+    float offset = args.at(0).toFloat(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->beginElementAt(offset, ec));
+    JSC::JSValue result = jsBoolean(imp->beginElementAt(offset, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGAnimationElementPrototypeFunctionEndElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionEndElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAnimationElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->endElement(ec));
+    JSC::JSValue result = jsBoolean(imp->endElement(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGAnimationElementPrototypeFunctionEndElementAt(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionEndElementAt(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGAnimationElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGAnimationElement::s_info))
         return throwError(exec, TypeError);
     JSSVGAnimationElement* castedThisObj = static_cast<JSSVGAnimationElement*>(asObject(thisValue));
     SVGAnimationElement* imp = static_cast<SVGAnimationElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float offset = args.at(exec, 0)->toFloat(exec);
+    float offset = args.at(0).toFloat(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->endElementAt(offset, ec));
+    JSC::JSValue result = jsBoolean(imp->endElementAt(offset, ec));
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h
index d2390e6..989c0d0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGAnimationElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGAnimationElement_h
 #define JSSVGAnimationElement_h
 
-
 #if ENABLE(SVG_ANIMATION)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,12 +34,12 @@ class JSSVGAnimationElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGAnimationElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGAnimationElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGAnimationElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,21 +63,21 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGAnimationElementPrototypeFunctionGetStartTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAnimationElementPrototypeFunctionGetCurrentTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAnimationElementPrototypeFunctionGetSimpleDuration(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAnimationElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAnimationElementPrototypeFunctionBeginElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAnimationElementPrototypeFunctionBeginElementAt(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAnimationElementPrototypeFunctionEndElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGAnimationElementPrototypeFunctionEndElementAt(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionGetStartTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionGetCurrentTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionGetSimpleDuration(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionBeginElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionBeginElementAt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionEndElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGAnimationElementPrototypeFunctionEndElementAt(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGAnimationElementTargetElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAnimationElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAnimationElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAnimationElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGAnimationElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimationElementTargetElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimationElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimationElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimationElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGAnimationElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.cpp
index f8d8069..f9fa2aa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGCircleElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -45,15 +41,15 @@
 #include "SVGCircleElement.h"
 #include "SVGElement.h"
 #include "SVGStringList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGCircleElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGCircleElement);
 
 /* Hash table */
 
@@ -105,9 +101,9 @@ static const HashTable JSSVGCircleElementPrototypeTable =
 
 const ClassInfo JSSVGCircleElementPrototype::s_info = { "SVGCircleElementPrototype", 0, &JSSVGCircleElementPrototypeTable, 0 };
 
-JSObject* JSSVGCircleElementPrototype::self(ExecState* exec)
+JSObject* JSSVGCircleElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGCircleElement>(exec);
+    return getDOMPrototype<JSSVGCircleElement>(exec, globalObject);
 }
 
 bool JSSVGCircleElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -122,9 +118,9 @@ JSSVGCircleElement::JSSVGCircleElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSSVGCircleElement::createPrototype(ExecState* exec)
+JSObject* JSSVGCircleElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGCircleElementPrototype(JSSVGCircleElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGCircleElementPrototype(JSSVGCircleElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGCircleElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,186 +128,206 @@ bool JSSVGCircleElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGCircleElement, Base>(exec, &JSSVGCircleElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGCircleElementCx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementCx(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->cxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGCircleElementCy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementCy(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->cyAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGCircleElementR(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementR(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->rAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGCircleElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGCircleElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGCircleElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGCircleElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGCircleElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGCircleElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGCircleElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGCircleElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGCircleElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGCircleElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGCircleElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCircleElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGCircleElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGCircleElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGCircleElement, Base>(exec, propertyName, value, &JSSVGCircleElementTable, this, slot);
 }
 
-void setJSSVGCircleElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGCircleElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGCircleElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGCircleElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(static_cast<JSSVGCircleElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGCircleElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGCircleElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGCircleElement::s_info))
         return throwError(exec, TypeError);
     JSSVGCircleElement* castedThisObj = static_cast<JSSVGCircleElement*>(asObject(thisValue));
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGCircleElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGCircleElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGCircleElement::s_info))
         return throwError(exec, TypeError);
     JSSVGCircleElement* castedThisObj = static_cast<JSSVGCircleElement*>(asObject(thisValue));
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGCircleElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGCircleElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGCircleElement::s_info))
         return throwError(exec, TypeError);
     JSSVGCircleElement* castedThisObj = static_cast<JSSVGCircleElement*>(asObject(thisValue));
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGCircleElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGCircleElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGCircleElement::s_info))
         return throwError(exec, TypeError);
     JSSVGCircleElement* castedThisObj = static_cast<JSSVGCircleElement*>(asObject(thisValue));
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGCircleElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGCircleElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGCircleElement::s_info))
         return throwError(exec, TypeError);
     JSSVGCircleElement* castedThisObj = static_cast<JSSVGCircleElement*>(asObject(thisValue));
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGCircleElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGCircleElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGCircleElement::s_info))
         return throwError(exec, TypeError);
     JSSVGCircleElement* castedThisObj = static_cast<JSSVGCircleElement*>(asObject(thisValue));
     SVGCircleElement* imp = static_cast<SVGCircleElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h
index 13e9fc0..8c9acda 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGCircleElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGCircleElement_h
 #define JSSVGCircleElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGCircleElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGCircleElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGCircleElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGCircleElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,30 +64,30 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGCircleElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGCircleElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGCircleElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGCircleElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGCircleElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGCircleElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGCircleElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGCircleElementCx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCircleElementCy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCircleElementR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCircleElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCircleElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCircleElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCircleElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGCircleElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGCircleElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGCircleElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGCircleElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCircleElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCircleElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCircleElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCircleElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCircleElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementCx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementCy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGCircleElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGCircleElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGCircleElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGCircleElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCircleElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.cpp
index f96a8c7..73e31af 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGClipPathElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -45,15 +41,15 @@
 #include "SVGClipPathElement.h"
 #include "SVGElement.h"
 #include "SVGStringList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGClipPathElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGClipPathElement);
 
 /* Hash table */
 
@@ -103,9 +99,9 @@ static const HashTable JSSVGClipPathElementPrototypeTable =
 
 const ClassInfo JSSVGClipPathElementPrototype::s_info = { "SVGClipPathElementPrototype", 0, &JSSVGClipPathElementPrototypeTable, 0 };
 
-JSObject* JSSVGClipPathElementPrototype::self(ExecState* exec)
+JSObject* JSSVGClipPathElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGClipPathElement>(exec);
+    return getDOMPrototype<JSSVGClipPathElement>(exec, globalObject);
 }
 
 bool JSSVGClipPathElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -120,9 +116,9 @@ JSSVGClipPathElement::JSSVGClipPathElement(PassRefPtr<Structure> structure, Pass
 {
 }
 
-JSObject* JSSVGClipPathElement::createPrototype(ExecState* exec)
+JSObject* JSSVGClipPathElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGClipPathElementPrototype(JSSVGClipPathElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGClipPathElementPrototype(JSSVGClipPathElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGClipPathElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -130,172 +126,190 @@ bool JSSVGClipPathElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGClipPathElement, Base>(exec, &JSSVGClipPathElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGClipPathElementClipPathUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementClipPathUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->clipPathUnitsAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGClipPathElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGClipPathElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGClipPathElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGClipPathElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGClipPathElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGClipPathElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGClipPathElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGClipPathElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGClipPathElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGClipPathElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGClipPathElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGClipPathElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGClipPathElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGClipPathElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGClipPathElement, Base>(exec, propertyName, value, &JSSVGClipPathElementTable, this, slot);
 }
 
-void setJSSVGClipPathElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGClipPathElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGClipPathElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGClipPathElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(static_cast<JSSVGClipPathElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGClipPathElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGClipPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGClipPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGClipPathElement* castedThisObj = static_cast<JSSVGClipPathElement*>(asObject(thisValue));
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGClipPathElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGClipPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGClipPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGClipPathElement* castedThisObj = static_cast<JSSVGClipPathElement*>(asObject(thisValue));
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGClipPathElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGClipPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGClipPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGClipPathElement* castedThisObj = static_cast<JSSVGClipPathElement*>(asObject(thisValue));
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGClipPathElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGClipPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGClipPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGClipPathElement* castedThisObj = static_cast<JSSVGClipPathElement*>(asObject(thisValue));
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGClipPathElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGClipPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGClipPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGClipPathElement* castedThisObj = static_cast<JSSVGClipPathElement*>(asObject(thisValue));
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGClipPathElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGClipPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGClipPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGClipPathElement* castedThisObj = static_cast<JSSVGClipPathElement*>(asObject(thisValue));
     SVGClipPathElement* imp = static_cast<SVGClipPathElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h
index 144d8e2..b4a44cf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGClipPathElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGClipPathElement_h
 #define JSSVGClipPathElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGClipPathElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGClipPathElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGClipPathElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGClipPathElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,28 +64,28 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGClipPathElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGClipPathElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGClipPathElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGClipPathElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGClipPathElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGClipPathElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGClipPathElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGClipPathElementClipPathUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGClipPathElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGClipPathElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGClipPathElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGClipPathElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGClipPathElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGClipPathElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGClipPathElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGClipPathElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGClipPathElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGClipPathElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGClipPathElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGClipPathElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGClipPathElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGClipPathElementClipPathUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGClipPathElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGClipPathElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGClipPathElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGClipPathElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGClipPathElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGClipPathElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGClipPathElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGClipPathElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGClipPathElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGClipPathElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGClipPathElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGClipPathElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGClipPathElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp
index 12109d6..88c62e4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.cpp
@@ -20,25 +20,21 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGColor.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSRGBColor.h"
 #include "SVGColor.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGColor)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGColor);
 
 /* Hash table */
 
@@ -80,13 +76,13 @@ public:
     JSSVGColorConstructor(ExecState* exec)
         : DOMObject(JSSVGColorConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGColorPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGColorPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -122,9 +118,9 @@ static const HashTable JSSVGColorPrototypeTable =
 
 const ClassInfo JSSVGColorPrototype::s_info = { "SVGColorPrototype", 0, &JSSVGColorPrototypeTable, 0 };
 
-JSObject* JSSVGColorPrototype::self(ExecState* exec)
+JSObject* JSSVGColorPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGColor>(exec);
+    return getDOMPrototype<JSSVGColor>(exec, globalObject);
 }
 
 bool JSSVGColorPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -139,9 +135,9 @@ JSSVGColor::JSSVGColor(PassRefPtr<Structure> structure, PassRefPtr<SVGColor> imp
 {
 }
 
-JSObject* JSSVGColor::createPrototype(ExecState* exec)
+JSObject* JSSVGColor::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGColorPrototype(JSSVGColorPrototype::createStructure(JSCSSValuePrototype::self(exec)));
+    return new (exec) JSSVGColorPrototype(JSSVGColorPrototype::createStructure(JSCSSValuePrototype::self(exec, globalObject)));
 }
 
 bool JSSVGColor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -149,66 +145,71 @@ bool JSSVGColor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSSVGColor, Base>(exec, &JSSVGColorTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGColorColorType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGColorColorType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGColor* imp = static_cast<SVGColor*>(static_cast<JSSVGColor*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->colorType());
 }
 
-JSValuePtr jsSVGColorRgbColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGColorRgbColor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGColor* imp = static_cast<SVGColor*>(static_cast<JSSVGColor*>(asObject(slot.slotBase()))->impl());
     return getJSRGBColor(exec, imp->rgbColor());
 }
 
-JSValuePtr jsSVGColorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGColorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGColor*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGColor::getConstructor(ExecState* exec)
+JSValue JSSVGColor::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGColorConstructor>(exec);
 }
 
-JSValuePtr jsSVGColorPrototypeFunctionSetRGBColor(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGColorPrototypeFunctionSetRGBColor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGColor::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGColor::s_info))
         return throwError(exec, TypeError);
     JSSVGColor* castedThisObj = static_cast<JSSVGColor*>(asObject(thisValue));
     SVGColor* imp = static_cast<SVGColor*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& rgbColor = args.at(exec, 0)->toString(exec);
+    const UString& rgbColor = args.at(0).toString(exec);
 
     imp->setRGBColor(rgbColor, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsSVGColorPrototypeFunctionSetRGBColorICCColor(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGColorPrototypeFunctionSetRGBColorICCColor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGColor::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGColor::s_info))
         return throwError(exec, TypeError);
     JSSVGColor* castedThisObj = static_cast<JSSVGColor*>(asObject(thisValue));
     SVGColor* imp = static_cast<SVGColor*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& rgbColor = args.at(exec, 0)->toString(exec);
-    const UString& iccColor = args.at(exec, 1)->toString(exec);
+    const UString& rgbColor = args.at(0).toString(exec);
+    const UString& iccColor = args.at(1).toString(exec);
 
     imp->setRGBColorICCColor(rgbColor, iccColor, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsSVGColorPrototypeFunctionSetColor(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGColorPrototypeFunctionSetColor(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGColor::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGColor::s_info))
         return throwError(exec, TypeError);
     JSSVGColor* castedThisObj = static_cast<JSSVGColor*>(asObject(thisValue));
     SVGColor* imp = static_cast<SVGColor*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned short colorType = args.at(exec, 0)->toInt32(exec);
-    const UString& rgbColor = args.at(exec, 1)->toString(exec);
-    const UString& iccColor = args.at(exec, 2)->toString(exec);
+    unsigned short colorType = args.at(0).toInt32(exec);
+    const UString& rgbColor = args.at(1).toString(exec);
+    const UString& iccColor = args.at(2).toString(exec);
 
     imp->setColor(colorType, rgbColor, iccColor, ec);
     setDOMException(exec, ec);
@@ -217,22 +218,22 @@ JSValuePtr jsSVGColorPrototypeFunctionSetColor(ExecState* exec, JSObject*, JSVal
 
 // Constant getters
 
-JSValuePtr jsSVGColorSVG_COLORTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGColorSVG_COLORTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGColorSVG_COLORTYPE_RGBCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGColorSVG_COLORTYPE_RGBCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGColorSVG_COLORTYPE_RGBCOLOR_ICCCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGColorSVG_COLORTYPE_RGBCOLOR_ICCCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGColorSVG_COLORTYPE_CURRENTCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGColorSVG_COLORTYPE_CURRENTCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h
index c3d39a6..43baabb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGColor.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGColor_h
 #define JSSVGColor_h
 
-
 #if ENABLE(SVG)
 
 #include "JSCSSValue.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,27 +34,28 @@ class JSSVGColor : public JSCSSValue {
     typedef JSCSSValue Base;
 public:
     JSSVGColor(PassRefPtr<JSC::Structure>, PassRefPtr<SVGColor>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGColorPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,20 +64,20 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGColorPrototypeFunctionSetRGBColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGColorPrototypeFunctionSetRGBColorICCColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGColorPrototypeFunctionSetColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGColorPrototypeFunctionSetRGBColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGColorPrototypeFunctionSetRGBColorICCColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGColorPrototypeFunctionSetColor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGColorColorType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGColorRgbColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGColorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGColorColorType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGColorRgbColor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGColorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGColorSVG_COLORTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGColorSVG_COLORTYPE_RGBCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGColorSVG_COLORTYPE_RGBCOLOR_ICCCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGColorSVG_COLORTYPE_CURRENTCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGColorSVG_COLORTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGColorSVG_COLORTYPE_RGBCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGColorSVG_COLORTYPE_RGBCOLOR_ICCCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGColorSVG_COLORTYPE_CURRENTCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp
index cc2f34c..d5be3bc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.cpp
@@ -20,26 +20,21 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGComponentTransferFunctionElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGAnimatedEnumeration.h"
 #include "JSSVGAnimatedNumber.h"
 #include "JSSVGAnimatedNumberList.h"
 #include "SVGComponentTransferFunctionElement.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGComponentTransferFunctionElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGComponentTransferFunctionElement);
 
 /* Hash table */
 
@@ -88,13 +83,13 @@ public:
     JSSVGComponentTransferFunctionElementConstructor(ExecState* exec)
         : DOMObject(JSSVGComponentTransferFunctionElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGComponentTransferFunctionElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGComponentTransferFunctionElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -129,9 +124,9 @@ static const HashTable JSSVGComponentTransferFunctionElementPrototypeTable =
 
 const ClassInfo JSSVGComponentTransferFunctionElementPrototype::s_info = { "SVGComponentTransferFunctionElementPrototype", 0, &JSSVGComponentTransferFunctionElementPrototypeTable, 0 };
 
-JSObject* JSSVGComponentTransferFunctionElementPrototype::self(ExecState* exec)
+JSObject* JSSVGComponentTransferFunctionElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGComponentTransferFunctionElement>(exec);
+    return getDOMPrototype<JSSVGComponentTransferFunctionElement>(exec, globalObject);
 }
 
 bool JSSVGComponentTransferFunctionElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -146,9 +141,9 @@ JSSVGComponentTransferFunctionElement::JSSVGComponentTransferFunctionElement(Pas
 {
 }
 
-JSObject* JSSVGComponentTransferFunctionElement::createPrototype(ExecState* exec)
+JSObject* JSSVGComponentTransferFunctionElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGComponentTransferFunctionElementPrototype(JSSVGComponentTransferFunctionElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGComponentTransferFunctionElementPrototype(JSSVGComponentTransferFunctionElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGComponentTransferFunctionElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -156,92 +151,99 @@ bool JSSVGComponentTransferFunctionElement::getOwnPropertySlot(ExecState* exec,
     return getStaticValueSlot<JSSVGComponentTransferFunctionElement, Base>(exec, &JSSVGComponentTransferFunctionElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGComponentTransferFunctionElement* imp = static_cast<SVGComponentTransferFunctionElement*>(static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->typeAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementTableValues(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementTableValues(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGComponentTransferFunctionElement* imp = static_cast<SVGComponentTransferFunctionElement*>(static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumberList> obj = imp->tableValuesAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementSlope(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementSlope(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGComponentTransferFunctionElement* imp = static_cast<SVGComponentTransferFunctionElement*>(static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->slopeAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementIntercept(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementIntercept(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGComponentTransferFunctionElement* imp = static_cast<SVGComponentTransferFunctionElement*>(static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->interceptAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementAmplitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementAmplitude(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGComponentTransferFunctionElement* imp = static_cast<SVGComponentTransferFunctionElement*>(static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->amplitudeAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementExponent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementExponent(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGComponentTransferFunctionElement* imp = static_cast<SVGComponentTransferFunctionElement*>(static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->exponentAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGComponentTransferFunctionElement* imp = static_cast<SVGComponentTransferFunctionElement*>(static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->offsetAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGComponentTransferFunctionElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGComponentTransferFunctionElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGComponentTransferFunctionElement::getConstructor(ExecState* exec)
+JSValue JSSVGComponentTransferFunctionElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGComponentTransferFunctionElementConstructor>(exec);
 }
 
 // Constant getters
 
-JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_IDENTITY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_IDENTITY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_TABLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_TABLE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_DISCRETE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_DISCRETE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_LINEAR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_LINEAR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_GAMMA(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_GAMMA(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
@@ -249,4 +251,4 @@ JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_GAM
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h
index dbcb93a..6576e32 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGComponentTransferFunctionElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGComponentTransferFunctionElement_h
 #define JSSVGComponentTransferFunctionElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,27 +34,28 @@ class JSSVGComponentTransferFunctionElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGComponentTransferFunctionElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGComponentTransferFunctionElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGComponentTransferFunctionElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,25 +64,25 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementTableValues(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementSlope(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementIntercept(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementAmplitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementExponent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementTableValues(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementSlope(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementIntercept(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementAmplitude(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementExponent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_IDENTITY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_TABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_DISCRETE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_LINEAR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_GAMMA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_IDENTITY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_TABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_DISCRETE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_LINEAR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGComponentTransferFunctionElementSVG_FECOMPONENTTRANSFER_TYPE_GAMMA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.cpp
index ca283f0..d6171c6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.cpp
@@ -20,28 +20,24 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGCursorElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGAnimatedBoolean.h"
 #include "JSSVGAnimatedLength.h"
 #include "JSSVGAnimatedString.h"
 #include "JSSVGStringList.h"
 #include "SVGCursorElement.h"
 #include "SVGStringList.h"
-
 #include <runtime/Error.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGCursorElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGCursorElement);
 
 /* Hash table */
 
@@ -81,9 +77,9 @@ static const HashTable JSSVGCursorElementPrototypeTable =
 
 const ClassInfo JSSVGCursorElementPrototype::s_info = { "SVGCursorElementPrototype", 0, &JSSVGCursorElementPrototypeTable, 0 };
 
-JSObject* JSSVGCursorElementPrototype::self(ExecState* exec)
+JSObject* JSSVGCursorElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGCursorElement>(exec);
+    return getDOMPrototype<JSSVGCursorElement>(exec, globalObject);
 }
 
 bool JSSVGCursorElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -98,9 +94,9 @@ JSSVGCursorElement::JSSVGCursorElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSSVGCursorElement::createPrototype(ExecState* exec)
+JSObject* JSSVGCursorElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGCursorElementPrototype(JSSVGCursorElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGCursorElementPrototype(JSSVGCursorElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGCursorElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -108,62 +104,70 @@ bool JSSVGCursorElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGCursorElement, Base>(exec, &JSSVGCursorElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGCursorElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCursorElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(static_cast<JSSVGCursorElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGCursorElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCursorElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(static_cast<JSSVGCursorElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGCursorElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCursorElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(static_cast<JSSVGCursorElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGCursorElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCursorElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(static_cast<JSSVGCursorElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGCursorElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCursorElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(static_cast<JSSVGCursorElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGCursorElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCursorElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(static_cast<JSSVGCursorElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGCursorElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGCursorElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(static_cast<JSSVGCursorElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGCursorElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGCursorElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGCursorElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGCursorElement::s_info))
         return throwError(exec, TypeError);
     JSSVGCursorElement* castedThisObj = static_cast<JSSVGCursorElement*>(asObject(thisValue));
     SVGCursorElement* imp = static_cast<SVGCursorElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h
index a7de88f..3771090 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGCursorElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGCursorElement_h
 #define JSSVGCursorElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,12 +34,12 @@ class JSSVGCursorElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGCursorElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGCursorElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGCursorElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,16 +63,16 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGCursorElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGCursorElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGCursorElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCursorElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCursorElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCursorElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCursorElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCursorElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGCursorElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCursorElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCursorElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCursorElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCursorElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCursorElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCursorElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGCursorElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDefinitionSrcElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGDefinitionSrcElement.cpp
index 90f6c49..6947dda 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDefinitionSrcElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDefinitionSrcElement.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FONTS)
 
-#include "SVGElement.h"
 #include "JSSVGDefinitionSrcElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGDefinitionSrcElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGDefinitionSrcElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGDefinitionSrcElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +49,9 @@ static const HashTable JSSVGDefinitionSrcElementPrototypeTable =
 
 const ClassInfo JSSVGDefinitionSrcElementPrototype::s_info = { "SVGDefinitionSrcElementPrototype", 0, &JSSVGDefinitionSrcElementPrototypeTable, 0 };
 
-JSObject* JSSVGDefinitionSrcElementPrototype::self(ExecState* exec)
+JSObject* JSSVGDefinitionSrcElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGDefinitionSrcElement>(exec);
+    return getDOMPrototype<JSSVGDefinitionSrcElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGDefinitionSrcElement::s_info = { "SVGDefinitionSrcElement", &JSSVGElement::s_info, 0, 0 };
@@ -65,9 +61,9 @@ JSSVGDefinitionSrcElement::JSSVGDefinitionSrcElement(PassRefPtr<Structure> struc
 {
 }
 
-JSObject* JSSVGDefinitionSrcElement::createPrototype(ExecState* exec)
+JSObject* JSSVGDefinitionSrcElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGDefinitionSrcElementPrototype(JSSVGDefinitionSrcElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGDefinitionSrcElementPrototype(JSSVGDefinitionSrcElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDefinitionSrcElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGDefinitionSrcElement.h
index 8bb0f18..9997f52 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDefinitionSrcElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDefinitionSrcElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGDefinitionSrcElement_h
 #define JSSVGDefinitionSrcElement_h
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FONTS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,7 +34,7 @@ class JSSVGDefinitionSrcElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGDefinitionSrcElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGDefinitionSrcElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGDefinitionSrcElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGDefinitionSrcElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.cpp
index 7331eda..83e26d0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGDefsElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -44,15 +40,15 @@
 #include "SVGDefsElement.h"
 #include "SVGElement.h"
 #include "SVGStringList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGDefsElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGDefsElement);
 
 /* Hash table */
 
@@ -101,9 +97,9 @@ static const HashTable JSSVGDefsElementPrototypeTable =
 
 const ClassInfo JSSVGDefsElementPrototype::s_info = { "SVGDefsElementPrototype", 0, &JSSVGDefsElementPrototypeTable, 0 };
 
-JSObject* JSSVGDefsElementPrototype::self(ExecState* exec)
+JSObject* JSSVGDefsElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGDefsElement>(exec);
+    return getDOMPrototype<JSSVGDefsElement>(exec, globalObject);
 }
 
 bool JSSVGDefsElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -118,9 +114,9 @@ JSSVGDefsElement::JSSVGDefsElement(PassRefPtr<Structure> structure, PassRefPtr<S
 {
 }
 
-JSObject* JSSVGDefsElement::createPrototype(ExecState* exec)
+JSObject* JSSVGDefsElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGDefsElementPrototype(JSSVGDefsElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGDefsElementPrototype(JSSVGDefsElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGDefsElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,165 +124,182 @@ bool JSSVGDefsElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGDefsElement, Base>(exec, &JSSVGDefsElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGDefsElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGDefsElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGDefsElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGDefsElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGDefsElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGDefsElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGDefsElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGDefsElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGDefsElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGDefsElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGDefsElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDefsElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGDefsElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGDefsElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGDefsElement, Base>(exec, propertyName, value, &JSSVGDefsElementTable, this, slot);
 }
 
-void setJSSVGDefsElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGDefsElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGDefsElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGDefsElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(static_cast<JSSVGDefsElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGDefsElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGDefsElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGDefsElement::s_info))
         return throwError(exec, TypeError);
     JSSVGDefsElement* castedThisObj = static_cast<JSSVGDefsElement*>(asObject(thisValue));
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGDefsElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGDefsElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGDefsElement::s_info))
         return throwError(exec, TypeError);
     JSSVGDefsElement* castedThisObj = static_cast<JSSVGDefsElement*>(asObject(thisValue));
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGDefsElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGDefsElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGDefsElement::s_info))
         return throwError(exec, TypeError);
     JSSVGDefsElement* castedThisObj = static_cast<JSSVGDefsElement*>(asObject(thisValue));
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGDefsElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGDefsElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGDefsElement::s_info))
         return throwError(exec, TypeError);
     JSSVGDefsElement* castedThisObj = static_cast<JSSVGDefsElement*>(asObject(thisValue));
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGDefsElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGDefsElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGDefsElement::s_info))
         return throwError(exec, TypeError);
     JSSVGDefsElement* castedThisObj = static_cast<JSSVGDefsElement*>(asObject(thisValue));
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGDefsElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGDefsElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGDefsElement::s_info))
         return throwError(exec, TypeError);
     JSSVGDefsElement* castedThisObj = static_cast<JSSVGDefsElement*>(asObject(thisValue));
     SVGDefsElement* imp = static_cast<SVGDefsElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h
index 7468939..e4fa8b5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDefsElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGDefsElement_h
 #define JSSVGDefsElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGDefsElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGDefsElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGDefsElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGDefsElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,27 +64,27 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGDefsElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGDefsElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGDefsElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGDefsElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGDefsElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGDefsElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGDefsElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGDefsElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGDefsElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGDefsElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGDefsElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGDefsElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGDefsElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGDefsElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGDefsElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGDefsElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGDefsElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGDefsElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGDefsElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGDefsElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDefsElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDefsElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDefsElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDefsElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGDefsElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGDefsElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGDefsElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGDefsElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDefsElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDefsElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDefsElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDefsElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDefsElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.cpp
index a2a609a..28641ab 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGDescElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -36,15 +32,15 @@
 #include "JSSVGAnimatedString.h"
 #include "KURL.h"
 #include "SVGDescElement.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGDescElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGDescElement);
 
 /* Hash table */
 
@@ -81,9 +77,9 @@ static const HashTable JSSVGDescElementPrototypeTable =
 
 const ClassInfo JSSVGDescElementPrototype::s_info = { "SVGDescElementPrototype", 0, &JSSVGDescElementPrototypeTable, 0 };
 
-JSObject* JSSVGDescElementPrototype::self(ExecState* exec)
+JSObject* JSSVGDescElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGDescElement>(exec);
+    return getDOMPrototype<JSSVGDescElement>(exec, globalObject);
 }
 
 bool JSSVGDescElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -98,9 +94,9 @@ JSSVGDescElement::JSSVGDescElement(PassRefPtr<Structure> structure, PassRefPtr<S
 {
 }
 
-JSObject* JSSVGDescElement::createPrototype(ExecState* exec)
+JSObject* JSSVGDescElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGDescElementPrototype(JSSVGDescElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGDescElementPrototype(JSSVGDescElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGDescElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -108,58 +104,63 @@ bool JSSVGDescElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGDescElement, Base>(exec, &JSSVGDescElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGDescElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDescElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDescElement* imp = static_cast<SVGDescElement*>(static_cast<JSSVGDescElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGDescElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDescElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDescElement* imp = static_cast<SVGDescElement*>(static_cast<JSSVGDescElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGDescElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDescElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDescElement* imp = static_cast<SVGDescElement*>(static_cast<JSSVGDescElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGDescElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDescElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDescElement* imp = static_cast<SVGDescElement*>(static_cast<JSSVGDescElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-void JSSVGDescElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGDescElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGDescElement, Base>(exec, propertyName, value, &JSSVGDescElementTable, this, slot);
 }
 
-void setJSSVGDescElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGDescElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGDescElement* imp = static_cast<SVGDescElement*>(static_cast<JSSVGDescElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGDescElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGDescElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGDescElement* imp = static_cast<SVGDescElement*>(static_cast<JSSVGDescElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGDescElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGDescElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGDescElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGDescElement::s_info))
         return throwError(exec, TypeError);
     JSSVGDescElement* castedThisObj = static_cast<JSSVGDescElement*>(asObject(thisValue));
     SVGDescElement* imp = static_cast<SVGDescElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h
index 05335ff..b8ca101 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDescElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGDescElement_h
 #define JSSVGDescElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGDescElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGDescElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGDescElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGDescElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,15 +64,15 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGDescElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGDescElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGDescElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGDescElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGDescElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGDescElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGDescElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGDescElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDescElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGDescElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGDescElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGDescElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGDescElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDescElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.cpp
index e851b72..840e6c9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.cpp
@@ -20,27 +20,23 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGDocument.h"
 
-#include <wtf/GetPtr.h>
-
 #include "Event.h"
 #include "JSEvent.h"
 #include "JSSVGSVGElement.h"
 #include "SVGDocument.h"
 #include "SVGSVGElement.h"
-
 #include <runtime/Error.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGDocument)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGDocument);
 
 /* Hash table */
 
@@ -74,9 +70,9 @@ static const HashTable JSSVGDocumentPrototypeTable =
 
 const ClassInfo JSSVGDocumentPrototype::s_info = { "SVGDocumentPrototype", 0, &JSSVGDocumentPrototypeTable, 0 };
 
-JSObject* JSSVGDocumentPrototype::self(ExecState* exec)
+JSObject* JSSVGDocumentPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGDocument>(exec);
+    return getDOMPrototype<JSSVGDocument>(exec, globalObject);
 }
 
 bool JSSVGDocumentPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -91,9 +87,9 @@ JSSVGDocument::JSSVGDocument(PassRefPtr<Structure> structure, PassRefPtr<SVGDocu
 {
 }
 
-JSObject* JSSVGDocument::createPrototype(ExecState* exec)
+JSObject* JSSVGDocument::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGDocumentPrototype(JSSVGDocumentPrototype::createStructure(JSDocumentPrototype::self(exec)));
+    return new (exec) JSSVGDocumentPrototype(JSSVGDocumentPrototype::createStructure(JSDocumentPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGDocument::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -101,23 +97,25 @@ bool JSSVGDocument::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSSVGDocument, Base>(exec, &JSSVGDocumentTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGDocumentRootElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGDocumentRootElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGDocument* imp = static_cast<SVGDocument*>(static_cast<JSSVGDocument*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->rootElement()));
 }
 
-JSValuePtr jsSVGDocumentPrototypeFunctionCreateEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGDocumentPrototypeFunctionCreateEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGDocument::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGDocument::s_info))
         return throwError(exec, TypeError);
     JSSVGDocument* castedThisObj = static_cast<JSSVGDocument*>(asObject(thisValue));
     SVGDocument* imp = static_cast<SVGDocument*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& eventType = args.at(exec, 0)->toString(exec);
+    const UString& eventType = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createEvent(eventType, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createEvent(eventType, ec)));
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h b/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h
index 11b1aee..d4bd50e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGDocument.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGDocument_h
 #define JSSVGDocument_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDocument.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,12 +34,12 @@ class JSSVGDocument : public JSDocument {
     typedef JSDocument Base;
 public:
     JSSVGDocument(PassRefPtr<JSC::Structure>, PassRefPtr<SVGDocument>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGDocumentPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,10 +63,10 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGDocumentPrototypeFunctionCreateEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGDocumentPrototypeFunctionCreateEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGDocumentRootElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGDocumentRootElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp
index 158aee5..e4defcf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.cpp
@@ -20,27 +20,23 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGElement.h"
 #include "JSSVGSVGElement.h"
 #include "KURL.h"
 #include "SVGElement.h"
 #include "SVGSVGElement.h"
-
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGElement);
 
 /* Hash table */
 
@@ -76,9 +72,9 @@ static const HashTable JSSVGElementPrototypeTable =
 
 const ClassInfo JSSVGElementPrototype::s_info = { "SVGElementPrototype", 0, &JSSVGElementPrototypeTable, 0 };
 
-JSObject* JSSVGElementPrototype::self(ExecState* exec)
+JSObject* JSSVGElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGElement>(exec);
+    return getDOMPrototype<JSSVGElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGElement::s_info = { "SVGElement", &JSElement::s_info, &JSSVGElementTable, 0 };
@@ -88,9 +84,9 @@ JSSVGElement::JSSVGElement(PassRefPtr<Structure> structure, PassRefPtr<SVGElemen
 {
 }
 
-JSObject* JSSVGElement::createPrototype(ExecState* exec)
+JSObject* JSSVGElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGElementPrototype(JSSVGElementPrototype::createStructure(JSElementPrototype::self(exec)));
+    return new (exec) JSSVGElementPrototype(JSSVGElementPrototype::createStructure(JSElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -98,36 +94,40 @@ bool JSSVGElement::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSSVGElement, Base>(exec, &JSSVGElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGElementId(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementId(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElement* imp = static_cast<SVGElement*>(static_cast<JSSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->id());
 }
 
-JSValuePtr jsSVGElementXmlbase(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementXmlbase(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElement* imp = static_cast<SVGElement*>(static_cast<JSSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlbase());
 }
 
-JSValuePtr jsSVGElementOwnerSVGElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementOwnerSVGElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElement* imp = static_cast<SVGElement*>(static_cast<JSSVGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->ownerSVGElement()));
 }
 
-JSValuePtr jsSVGElementViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElement* imp = static_cast<SVGElement*>(static_cast<JSSVGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->viewportElement()));
 }
 
-void JSSVGElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGElement, Base>(exec, propertyName, value, &JSSVGElementTable, this, slot);
 }
 
-void setJSSVGElementId(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementId(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGElement* imp = static_cast<SVGElement*>(static_cast<JSSVGElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -135,7 +135,7 @@ void setJSSVGElementId(ExecState* exec, JSObject* thisObject, JSValuePtr value)
     setDOMException(exec, ec);
 }
 
-void setJSSVGElementXmlbase(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementXmlbase(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGElement* imp = static_cast<SVGElement*>(static_cast<JSSVGElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -143,9 +143,9 @@ void setJSSVGElementXmlbase(ExecState* exec, JSObject* thisObject, JSValuePtr va
     setDOMException(exec, ec);
 }
 
-SVGElement* toSVGElement(JSC::JSValuePtr value)
+SVGElement* toSVGElement(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGElement::s_info) ? static_cast<JSSVGElement*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGElement::s_info) ? static_cast<JSSVGElement*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h
index a8b5cf3..7123c7d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElement.h
@@ -21,11 +21,11 @@
 #ifndef JSSVGElement_h
 #define JSSVGElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSElement.h"
 #include "SVGElement.h"
+
 namespace WebCore {
 
 class SVGElement;
@@ -34,13 +34,13 @@ class JSSVGElement : public JSElement {
     typedef JSElement Base;
 public:
     JSSVGElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -51,11 +51,12 @@ public:
     }
 };
 
-SVGElement* toSVGElement(JSC::JSValuePtr);
+SVGElement* toSVGElement(JSC::JSValue);
 
 class JSSVGElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -63,12 +64,12 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGElementId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementId(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementXmlbase(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementXmlbase(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementOwnerSVGElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGElementViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementId(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementId(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementXmlbase(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementXmlbase(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementOwnerSVGElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.cpp
index 8c903fa..3b4d6b1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGElementInstance.h"
 
-#include <wtf/GetPtr.h>
-
 #include "Event.h"
 #include "EventListener.h"
 #include "Frame.h"
@@ -42,14 +38,14 @@
 #include "SVGElementInstance.h"
 #include "SVGElementInstanceList.h"
 #include "SVGUseElement.h"
-
 #include <runtime/Error.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGElementInstance)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGElementInstance);
 
 /* Hash table */
 
@@ -132,9 +128,9 @@ static const HashTable JSSVGElementInstancePrototypeTable =
 
 const ClassInfo JSSVGElementInstancePrototype::s_info = { "SVGElementInstancePrototype", 0, &JSSVGElementInstancePrototypeTable, 0 };
 
-JSObject* JSSVGElementInstancePrototype::self(ExecState* exec)
+JSObject* JSSVGElementInstancePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGElementInstance>(exec);
+    return getDOMPrototype<JSSVGElementInstance>(exec, globalObject);
 }
 
 bool JSSVGElementInstancePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -153,12 +149,11 @@ JSSVGElementInstance::JSSVGElementInstance(PassRefPtr<Structure> structure, Pass
 JSSVGElementInstance::~JSSVGElementInstance()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGElementInstance::createPrototype(ExecState* exec)
+JSObject* JSSVGElementInstance::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGElementInstancePrototype(JSSVGElementInstancePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGElementInstancePrototype(JSSVGElementInstancePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGElementInstance::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -166,857 +161,944 @@ bool JSSVGElementInstance::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGElementInstance, Base>(exec, &JSSVGElementInstanceTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGElementInstanceCorrespondingElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceCorrespondingElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->correspondingElement()));
 }
 
-JSValuePtr jsSVGElementInstanceCorrespondingUseElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceCorrespondingUseElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->correspondingUseElement()));
 }
 
-JSValuePtr jsSVGElementInstanceParentNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceParentNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->parentNode()));
 }
 
-JSValuePtr jsSVGElementInstanceChildNodes(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceChildNodes(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->childNodes()));
 }
 
-JSValuePtr jsSVGElementInstanceFirstChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceFirstChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->firstChild()));
 }
 
-JSValuePtr jsSVGElementInstanceLastChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceLastChild(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->lastChild()));
 }
 
-JSValuePtr jsSVGElementInstancePreviousSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstancePreviousSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->previousSibling()));
 }
 
-JSValuePtr jsSVGElementInstanceNextSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceNextSibling(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nextSibling()));
 }
 
-JSValuePtr jsSVGElementInstanceOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onabort())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onabort()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnblur(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnblur(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onblur())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onblur()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnchange(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onchange())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onchange()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onclick())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onclick()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOncontextmenu(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOncontextmenu(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->oncontextmenu())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->oncontextmenu()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOndblclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndblclick(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondblclick())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ondblclick()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onerror())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onerror()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnfocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnfocus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onfocus())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onfocus()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOninput(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOninput(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->oninput())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->oninput()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnkeydown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnkeydown(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onkeydown())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onkeydown()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnkeypress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnkeypress(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onkeypress())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onkeypress()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnkeyup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnkeyup(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onkeyup())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onkeyup()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onload())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onload()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnmousedown(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnmousedown(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmousedown())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmousedown()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnmousemove(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnmousemove(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmousemove())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmousemove()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnmouseout(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnmouseout(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmouseout())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmouseout()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnmouseover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnmouseover(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmouseover())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmouseover()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnmouseup(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnmouseup(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmouseup())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmouseup()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnmousewheel(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnmousewheel(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onmousewheel())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmousewheel()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnbeforecut(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnbeforecut(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onbeforecut())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onbeforecut()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOncut(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOncut(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->oncut())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->oncut()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnbeforecopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnbeforecopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onbeforecopy())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onbeforecopy()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOncopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOncopy(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->oncopy())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->oncopy()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnbeforepaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnbeforepaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onbeforepaste())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onbeforepaste()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnpaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnpaste(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onpaste())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onpaste()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOndragenter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndragenter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondragenter())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ondragenter()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOndragover(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndragover(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondragover())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ondragover()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOndragleave(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndragleave(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondragleave())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ondragleave()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOndrop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndrop(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondrop())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ondrop()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOndragstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndragstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondragstart())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ondragstart()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOndrag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndrag(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondrag())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ondrag()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOndragend(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOndragend(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->ondragend())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->ondragend()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnreset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnreset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onreset())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onreset()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnresize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnresize(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onresize())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onresize()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnscroll(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnscroll(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onscroll())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onscroll()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnsearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnsearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onsearch())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onsearch()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnselect(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnselect(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onselect())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onselect()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnselectstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnselectstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onselectstart())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onselectstart()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnsubmit(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnsubmit(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onsubmit())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onsubmit()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsSVGElementInstanceOnunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceOnunload(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(asObject(slot.slotBase()))->impl());
-    if (JSEventListener* listener = static_cast<JSEventListener*>(imp->onunload())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onunload()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-void JSSVGElementInstance::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGElementInstance::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGElementInstance, Base>(exec, propertyName, value, &JSSVGElementInstanceTable, this, slot);
 }
 
-void setJSSVGElementInstanceOnabort(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnabort(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnabort(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnabort(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnblur(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnblur(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnblur(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnblur(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnchange(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnchange(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnchange(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnchange(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnclick(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnclick(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnclick(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnclick(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOncontextmenu(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOncontextmenu(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOncontextmenu(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOncontextmenu(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOndblclick(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOndblclick(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOndblclick(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndblclick(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnerror(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnerror(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnfocus(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnfocus(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnfocus(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnfocus(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOninput(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOninput(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOninput(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOninput(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnkeydown(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnkeydown(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnkeydown(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnkeydown(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnkeypress(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnkeypress(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnkeypress(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnkeypress(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnkeyup(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnkeyup(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnkeyup(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnkeyup(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnload(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnload(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnload(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnmousedown(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnmousedown(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnmousedown(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnmousedown(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnmousemove(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnmousemove(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnmousemove(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnmousemove(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnmouseout(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnmouseout(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnmouseout(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnmouseout(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnmouseover(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnmouseover(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnmouseover(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnmouseover(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnmouseup(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnmouseup(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnmouseup(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnmouseup(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnmousewheel(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnmousewheel(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnmousewheel(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnmousewheel(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnbeforecut(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnbeforecut(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnbeforecut(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnbeforecut(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOncut(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOncut(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOncut(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOncut(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnbeforecopy(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnbeforecopy(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnbeforecopy(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnbeforecopy(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOncopy(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOncopy(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOncopy(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOncopy(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnbeforepaste(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnbeforepaste(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnbeforepaste(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnbeforepaste(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnpaste(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnpaste(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnpaste(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnpaste(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOndragenter(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOndragenter(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOndragenter(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndragenter(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOndragover(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOndragover(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOndragover(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndragover(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOndragleave(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOndragleave(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOndragleave(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndragleave(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOndrop(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOndrop(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOndrop(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndrop(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOndragstart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOndragstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOndragstart(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndragstart(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOndrag(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOndrag(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOndrag(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndrag(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOndragend(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOndragend(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOndragend(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOndragend(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnreset(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnreset(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnreset(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnreset(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnresize(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnresize(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnresize(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnresize(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnscroll(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnscroll(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnscroll(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnscroll(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnsearch(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnsearch(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnsearch(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnsearch(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnselect(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnselect(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnselect(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnselect(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnselectstart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnselectstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnselectstart(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnselectstart(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnsubmit(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnsubmit(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnsubmit(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnsubmit(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSSVGElementInstanceOnunload(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGElementInstanceOnunload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(static_cast<JSSVGElementInstance*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnunload(globalObject->findOrCreateJSEventListener(exec, value, true));
+    imp->setOnunload(globalObject->createJSAttributeEventListener(value));
 }
 
-JSValuePtr jsSVGElementInstancePrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGElementInstancePrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGElementInstance::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGElementInstance::s_info))
         return throwError(exec, TypeError);
     JSSVGElementInstance* castedThisObj = static_cast<JSSVGElementInstance*>(asObject(thisValue));
     return castedThisObj->addEventListener(exec, args);
 }
 
-JSValuePtr jsSVGElementInstancePrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGElementInstancePrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGElementInstance::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGElementInstance::s_info))
         return throwError(exec, TypeError);
     JSSVGElementInstance* castedThisObj = static_cast<JSSVGElementInstance*>(asObject(thisValue));
     return castedThisObj->removeEventListener(exec, args);
 }
 
-JSValuePtr jsSVGElementInstancePrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGElementInstancePrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGElementInstance::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGElementInstance::s_info))
         return throwError(exec, TypeError);
     JSSVGElementInstance* castedThisObj = static_cast<JSSVGElementInstance*>(asObject(thisValue));
     SVGElementInstance* imp = static_cast<SVGElementInstance*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Event* event = toEvent(args.at(exec, 0));
+    Event* event = toEvent(args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->dispatchEvent(event, ec));
+    JSC::JSValue result = jsBoolean(imp->dispatchEvent(event, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGElementInstance* object)
-{
-    return getDOMObjectWrapper<JSSVGElementInstance>(exec, object);
-}
-SVGElementInstance* toSVGElementInstance(JSC::JSValuePtr value)
+SVGElementInstance* toSVGElementInstance(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGElementInstance::s_info) ? static_cast<JSSVGElementInstance*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGElementInstance::s_info) ? static_cast<JSSVGElementInstance*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h
index 27beed2..59a9c10 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstance.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGElementInstance_h
 #define JSSVGElementInstance_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -37,39 +37,42 @@ class JSSVGElementInstance : public DOMObject {
 public:
     JSSVGElementInstance(PassRefPtr<JSC::Structure>, PassRefPtr<SVGElementInstance>);
     virtual ~JSSVGElementInstance();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
+    virtual void mark();
+
     virtual void pushEventHandlerScope(JSC::ExecState*, JSC::ScopeChain&) const;
 
 
     // Custom functions
-    JSC::JSValuePtr addEventListener(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
     SVGElementInstance* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<SVGElementInstance> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGElementInstance*);
-SVGElementInstance* toSVGElementInstance(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGElementInstance*);
+SVGElementInstance* toSVGElementInstance(JSC::JSValue);
 
 class JSSVGElementInstancePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -78,99 +81,99 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGElementInstancePrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGElementInstancePrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGElementInstancePrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGElementInstancePrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGElementInstancePrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGElementInstancePrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGElementInstanceCorrespondingElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGElementInstanceCorrespondingUseElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGElementInstanceParentNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGElementInstanceChildNodes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGElementInstanceFirstChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGElementInstanceLastChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGElementInstancePreviousSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGElementInstanceNextSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGElementInstanceOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnblur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnblur(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOncontextmenu(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOncontextmenu(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOndblclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOndblclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnfocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnfocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOninput(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOninput(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnkeydown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnkeydown(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnkeypress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnkeypress(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnkeyup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnkeyup(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnmousedown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnmousedown(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnmousemove(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnmousemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnmouseout(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnmouseout(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnmouseover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnmouseover(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnmouseup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnmouseup(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnmousewheel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnmousewheel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnbeforecut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnbeforecut(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOncut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOncut(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnbeforecopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnbeforecopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOncopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOncopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnbeforepaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnbeforepaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnpaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnpaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOndragenter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOndragenter(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOndragover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOndragover(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOndragleave(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOndragleave(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOndrop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOndrop(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOndragstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOndragstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOndrag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOndrag(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOndragend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOndragend(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnreset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnreset(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnresize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnresize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnscroll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnscroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnsearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnsearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnselect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnselect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnselectstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnselectstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnsubmit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnsubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGElementInstanceOnunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGElementInstanceOnunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGElementInstanceCorrespondingElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceCorrespondingUseElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceParentNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceChildNodes(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceFirstChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceLastChild(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstancePreviousSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceNextSibling(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnblur(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnblur(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnchange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnchange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOncontextmenu(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOncontextmenu(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOndblclick(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOndblclick(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnfocus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnfocus(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOninput(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOninput(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnkeydown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnkeydown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnkeypress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnkeypress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnkeyup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnkeyup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnmousedown(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnmousedown(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnmousemove(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnmousemove(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnmouseout(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnmouseout(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnmouseover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnmouseover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnmouseup(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnmouseup(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnmousewheel(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnmousewheel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnbeforecut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnbeforecut(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOncut(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOncut(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnbeforecopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnbeforecopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOncopy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOncopy(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnbeforepaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnbeforepaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnpaste(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnpaste(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOndragenter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOndragenter(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOndragover(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOndragover(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOndragleave(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOndragleave(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOndrop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOndrop(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOndragstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOndragstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOndrag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOndrag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOndragend(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOndragend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnreset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnreset(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnresize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnresize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnscroll(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnscroll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnsearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnsearch(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnselect(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnselect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnselectstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnselectstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnsubmit(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnsubmit(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGElementInstanceOnunload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGElementInstanceOnunload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.cpp
index f5ece18..81c9335 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.cpp
@@ -20,26 +20,22 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGElementInstanceList.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGElementInstance.h"
 #include "SVGElementInstance.h"
 #include "SVGElementInstanceList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGElementInstanceList)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGElementInstanceList);
 
 /* Hash table */
 
@@ -73,9 +69,9 @@ static const HashTable JSSVGElementInstanceListPrototypeTable =
 
 const ClassInfo JSSVGElementInstanceListPrototype::s_info = { "SVGElementInstanceListPrototype", 0, &JSSVGElementInstanceListPrototypeTable, 0 };
 
-JSObject* JSSVGElementInstanceListPrototype::self(ExecState* exec)
+JSObject* JSSVGElementInstanceListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGElementInstanceList>(exec);
+    return getDOMPrototype<JSSVGElementInstanceList>(exec, globalObject);
 }
 
 bool JSSVGElementInstanceListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -94,12 +90,11 @@ JSSVGElementInstanceList::JSSVGElementInstanceList(PassRefPtr<Structure> structu
 JSSVGElementInstanceList::~JSSVGElementInstanceList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGElementInstanceList::createPrototype(ExecState* exec)
+JSObject* JSSVGElementInstanceList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGElementInstanceListPrototype(JSSVGElementInstanceListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGElementInstanceListPrototype(JSSVGElementInstanceListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGElementInstanceList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -107,32 +102,34 @@ bool JSSVGElementInstanceList::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSSVGElementInstanceList, Base>(exec, &JSSVGElementInstanceListTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGElementInstanceListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGElementInstanceListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGElementInstanceList* imp = static_cast<SVGElementInstanceList*>(static_cast<JSSVGElementInstanceList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsSVGElementInstanceListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGElementInstanceListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGElementInstanceList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGElementInstanceList::s_info))
         return throwError(exec, TypeError);
     JSSVGElementInstanceList* castedThisObj = static_cast<JSSVGElementInstanceList*>(asObject(thisValue));
     SVGElementInstanceList* imp = static_cast<SVGElementInstanceList*>(castedThisObj->impl());
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->item(index)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGElementInstanceList* object)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGElementInstanceList* object)
 {
     return getDOMObjectWrapper<JSSVGElementInstanceList>(exec, object);
 }
-SVGElementInstanceList* toSVGElementInstanceList(JSC::JSValuePtr value)
+SVGElementInstanceList* toSVGElementInstanceList(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGElementInstanceList::s_info) ? static_cast<JSSVGElementInstanceList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGElementInstanceList::s_info) ? static_cast<JSSVGElementInstanceList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h
index c14e0d7..956d44a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementInstanceList.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGElementInstanceList_h
 #define JSSVGElementInstanceList_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -37,12 +37,12 @@ class JSSVGElementInstanceList : public DOMObject {
 public:
     JSSVGElementInstanceList(PassRefPtr<JSC::Structure>, PassRefPtr<SVGElementInstanceList>);
     virtual ~JSSVGElementInstanceList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -53,16 +53,17 @@ private:
     RefPtr<SVGElementInstanceList> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGElementInstanceList*);
-SVGElementInstanceList* toSVGElementInstanceList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGElementInstanceList*);
+SVGElementInstanceList* toSVGElementInstanceList(JSC::JSValue);
 
 class JSSVGElementInstanceListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -71,10 +72,10 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGElementInstanceListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGElementInstanceListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGElementInstanceListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGElementInstanceListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGElementWrapperFactory.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGElementWrapperFactory.cpp
index a388fcb..6579833 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGElementWrapperFactory.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGElementWrapperFactory.cpp
@@ -44,29 +44,6 @@
 #include "JSSVGDefsElement.h"
 #include "JSSVGDescElement.h"
 #include "JSSVGEllipseElement.h"
-#include "JSSVGFEBlendElement.h"
-#include "JSSVGFEColorMatrixElement.h"
-#include "JSSVGFEComponentTransferElement.h"
-#include "JSSVGFECompositeElement.h"
-#include "JSSVGFEDiffuseLightingElement.h"
-#include "JSSVGFEDisplacementMapElement.h"
-#include "JSSVGFEDistantLightElement.h"
-#include "JSSVGFEFloodElement.h"
-#include "JSSVGFEFuncAElement.h"
-#include "JSSVGFEFuncBElement.h"
-#include "JSSVGFEFuncGElement.h"
-#include "JSSVGFEFuncRElement.h"
-#include "JSSVGFEGaussianBlurElement.h"
-#include "JSSVGFEImageElement.h"
-#include "JSSVGFEMergeElement.h"
-#include "JSSVGFEMergeNodeElement.h"
-#include "JSSVGFEOffsetElement.h"
-#include "JSSVGFEPointLightElement.h"
-#include "JSSVGFESpecularLightingElement.h"
-#include "JSSVGFESpotLightElement.h"
-#include "JSSVGFETileElement.h"
-#include "JSSVGFETurbulenceElement.h"
-#include "JSSVGFilterElement.h"
 #include "JSSVGFontElement.h"
 #include "JSSVGFontFaceElement.h"
 #include "JSSVGFontFaceFormatElement.h"
@@ -119,29 +96,6 @@
 #include "SVGDefsElement.h"
 #include "SVGDescElement.h"
 #include "SVGEllipseElement.h"
-#include "SVGFEBlendElement.h"
-#include "SVGFEColorMatrixElement.h"
-#include "SVGFEComponentTransferElement.h"
-#include "SVGFECompositeElement.h"
-#include "SVGFEDiffuseLightingElement.h"
-#include "SVGFEDisplacementMapElement.h"
-#include "SVGFEDistantLightElement.h"
-#include "SVGFEFloodElement.h"
-#include "SVGFEFuncAElement.h"
-#include "SVGFEFuncBElement.h"
-#include "SVGFEFuncGElement.h"
-#include "SVGFEFuncRElement.h"
-#include "SVGFEGaussianBlurElement.h"
-#include "SVGFEImageElement.h"
-#include "SVGFEMergeElement.h"
-#include "SVGFEMergeNodeElement.h"
-#include "SVGFEOffsetElement.h"
-#include "SVGFEPointLightElement.h"
-#include "SVGFESpecularLightingElement.h"
-#include "SVGFESpotLightElement.h"
-#include "SVGFETileElement.h"
-#include "SVGFETurbulenceElement.h"
-#include "SVGFilterElement.h"
 #include "SVGFontElement.h"
 #include "SVGFontFaceElement.h"
 #include "SVGFontFaceFormatElement.h"
@@ -251,121 +205,6 @@ static JSNode* createSVGEllipseElementWrapper(ExecState* exec, PassRefPtr<SVGEle
     return CREATE_DOM_NODE_WRAPPER(exec, SVGEllipseElement, element.get());
 }
 
-static JSNode* createSVGFEBlendElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEBlendElement, element.get());
-}
-
-static JSNode* createSVGFEColorMatrixElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEColorMatrixElement, element.get());
-}
-
-static JSNode* createSVGFEComponentTransferElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEComponentTransferElement, element.get());
-}
-
-static JSNode* createSVGFECompositeElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFECompositeElement, element.get());
-}
-
-static JSNode* createSVGFEDiffuseLightingElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEDiffuseLightingElement, element.get());
-}
-
-static JSNode* createSVGFEDisplacementMapElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEDisplacementMapElement, element.get());
-}
-
-static JSNode* createSVGFEDistantLightElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEDistantLightElement, element.get());
-}
-
-static JSNode* createSVGFEFloodElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEFloodElement, element.get());
-}
-
-static JSNode* createSVGFEFuncAElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEFuncAElement, element.get());
-}
-
-static JSNode* createSVGFEFuncBElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEFuncBElement, element.get());
-}
-
-static JSNode* createSVGFEFuncGElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEFuncGElement, element.get());
-}
-
-static JSNode* createSVGFEFuncRElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEFuncRElement, element.get());
-}
-
-static JSNode* createSVGFEGaussianBlurElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEGaussianBlurElement, element.get());
-}
-
-static JSNode* createSVGFEImageElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEImageElement, element.get());
-}
-
-static JSNode* createSVGFEMergeElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEMergeElement, element.get());
-}
-
-static JSNode* createSVGFEMergeNodeElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEMergeNodeElement, element.get());
-}
-
-static JSNode* createSVGFEOffsetElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEOffsetElement, element.get());
-}
-
-static JSNode* createSVGFEPointLightElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFEPointLightElement, element.get());
-}
-
-static JSNode* createSVGFESpecularLightingElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFESpecularLightingElement, element.get());
-}
-
-static JSNode* createSVGFESpotLightElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFESpotLightElement, element.get());
-}
-
-static JSNode* createSVGFETileElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFETileElement, element.get());
-}
-
-static JSNode* createSVGFETurbulenceElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFETurbulenceElement, element.get());
-}
-
-static JSNode* createSVGFilterElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
-{
-    return CREATE_DOM_NODE_WRAPPER(exec, SVGFilterElement, element.get());
-}
-
 static JSNode* createSVGFontElementWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
 {
     return CREATE_DOM_NODE_WRAPPER(exec, SVGFontElement, element.get());
@@ -563,29 +402,6 @@ JSNode* createJSSVGWrapper(ExecState* exec, PassRefPtr<SVGElement> element)
        map.set(defsTag.localName().impl(), createSVGDefsElementWrapper);
        map.set(descTag.localName().impl(), createSVGDescElementWrapper);
        map.set(ellipseTag.localName().impl(), createSVGEllipseElementWrapper);
-       map.set(feBlendTag.localName().impl(), createSVGFEBlendElementWrapper);
-       map.set(feColorMatrixTag.localName().impl(), createSVGFEColorMatrixElementWrapper);
-       map.set(feComponentTransferTag.localName().impl(), createSVGFEComponentTransferElementWrapper);
-       map.set(feCompositeTag.localName().impl(), createSVGFECompositeElementWrapper);
-       map.set(feDiffuseLightingTag.localName().impl(), createSVGFEDiffuseLightingElementWrapper);
-       map.set(feDisplacementMapTag.localName().impl(), createSVGFEDisplacementMapElementWrapper);
-       map.set(feDistantLightTag.localName().impl(), createSVGFEDistantLightElementWrapper);
-       map.set(feFloodTag.localName().impl(), createSVGFEFloodElementWrapper);
-       map.set(feFuncATag.localName().impl(), createSVGFEFuncAElementWrapper);
-       map.set(feFuncBTag.localName().impl(), createSVGFEFuncBElementWrapper);
-       map.set(feFuncGTag.localName().impl(), createSVGFEFuncGElementWrapper);
-       map.set(feFuncRTag.localName().impl(), createSVGFEFuncRElementWrapper);
-       map.set(feGaussianBlurTag.localName().impl(), createSVGFEGaussianBlurElementWrapper);
-       map.set(feImageTag.localName().impl(), createSVGFEImageElementWrapper);
-       map.set(feMergeTag.localName().impl(), createSVGFEMergeElementWrapper);
-       map.set(feMergeNodeTag.localName().impl(), createSVGFEMergeNodeElementWrapper);
-       map.set(feOffsetTag.localName().impl(), createSVGFEOffsetElementWrapper);
-       map.set(fePointLightTag.localName().impl(), createSVGFEPointLightElementWrapper);
-       map.set(feSpecularLightingTag.localName().impl(), createSVGFESpecularLightingElementWrapper);
-       map.set(feSpotLightTag.localName().impl(), createSVGFESpotLightElementWrapper);
-       map.set(feTileTag.localName().impl(), createSVGFETileElementWrapper);
-       map.set(feTurbulenceTag.localName().impl(), createSVGFETurbulenceElementWrapper);
-       map.set(filterTag.localName().impl(), createSVGFilterElementWrapper);
        map.set(fontTag.localName().impl(), createSVGFontElementWrapper);
        map.set(font_faceTag.localName().impl(), createSVGFontFaceElementWrapper);
        map.set(font_face_formatTag.localName().impl(), createSVGFontFaceFormatElementWrapper);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.cpp
index 94fd5a3..8d6d8ec 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGEllipseElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -45,15 +41,15 @@
 #include "SVGElement.h"
 #include "SVGEllipseElement.h"
 #include "SVGStringList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGEllipseElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGEllipseElement);
 
 /* Hash table */
 
@@ -106,9 +102,9 @@ static const HashTable JSSVGEllipseElementPrototypeTable =
 
 const ClassInfo JSSVGEllipseElementPrototype::s_info = { "SVGEllipseElementPrototype", 0, &JSSVGEllipseElementPrototypeTable, 0 };
 
-JSObject* JSSVGEllipseElementPrototype::self(ExecState* exec)
+JSObject* JSSVGEllipseElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGEllipseElement>(exec);
+    return getDOMPrototype<JSSVGEllipseElement>(exec, globalObject);
 }
 
 bool JSSVGEllipseElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -123,9 +119,9 @@ JSSVGEllipseElement::JSSVGEllipseElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGEllipseElement::createPrototype(ExecState* exec)
+JSObject* JSSVGEllipseElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGEllipseElementPrototype(JSSVGEllipseElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGEllipseElementPrototype(JSSVGEllipseElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGEllipseElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,193 +129,214 @@ bool JSSVGEllipseElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGEllipseElement, Base>(exec, &JSSVGEllipseElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGEllipseElementCx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementCx(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->cxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGEllipseElementCy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementCy(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->cyAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGEllipseElementRx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementRx(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->rxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGEllipseElementRy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementRy(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->ryAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGEllipseElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGEllipseElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGEllipseElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGEllipseElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGEllipseElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGEllipseElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGEllipseElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGEllipseElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGEllipseElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGEllipseElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGEllipseElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGEllipseElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGEllipseElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGEllipseElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGEllipseElement, Base>(exec, propertyName, value, &JSSVGEllipseElementTable, this, slot);
 }
 
-void setJSSVGEllipseElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGEllipseElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGEllipseElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGEllipseElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(static_cast<JSSVGEllipseElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGEllipseElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGEllipseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGEllipseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGEllipseElement* castedThisObj = static_cast<JSSVGEllipseElement*>(asObject(thisValue));
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGEllipseElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGEllipseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGEllipseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGEllipseElement* castedThisObj = static_cast<JSSVGEllipseElement*>(asObject(thisValue));
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGEllipseElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGEllipseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGEllipseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGEllipseElement* castedThisObj = static_cast<JSSVGEllipseElement*>(asObject(thisValue));
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGEllipseElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGEllipseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGEllipseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGEllipseElement* castedThisObj = static_cast<JSSVGEllipseElement*>(asObject(thisValue));
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGEllipseElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGEllipseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGEllipseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGEllipseElement* castedThisObj = static_cast<JSSVGEllipseElement*>(asObject(thisValue));
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGEllipseElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGEllipseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGEllipseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGEllipseElement* castedThisObj = static_cast<JSSVGEllipseElement*>(asObject(thisValue));
     SVGEllipseElement* imp = static_cast<SVGEllipseElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h
index 6533def..2ccb260 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGEllipseElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGEllipseElement_h
 #define JSSVGEllipseElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGEllipseElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGEllipseElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGEllipseElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGEllipseElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,31 +64,31 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGEllipseElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGEllipseElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGEllipseElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGEllipseElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGEllipseElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGEllipseElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGEllipseElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGEllipseElementCx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementCy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementRx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementRy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGEllipseElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGEllipseElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGEllipseElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGEllipseElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGEllipseElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementCx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementCy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementRx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementRy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGEllipseElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGEllipseElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGEllipseElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGEllipseElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGEllipseElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp
index 5b0980f..af6a2090 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGException.cpp
@@ -20,26 +20,22 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGException.h"
 
-#include <wtf/GetPtr.h>
-
 #include "KURL.h"
 #include "SVGException.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGException)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGException);
 
 /* Hash table */
 
@@ -81,13 +77,13 @@ public:
     JSSVGExceptionConstructor(ExecState* exec)
         : DOMObject(JSSVGExceptionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGExceptionPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGExceptionPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -120,9 +116,9 @@ static const HashTable JSSVGExceptionPrototypeTable =
 
 const ClassInfo JSSVGExceptionPrototype::s_info = { "SVGExceptionPrototype", 0, &JSSVGExceptionPrototypeTable, 0 };
 
-JSObject* JSSVGExceptionPrototype::self(ExecState* exec)
+JSObject* JSSVGExceptionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGException>(exec);
+    return getDOMPrototype<JSSVGException>(exec, globalObject);
 }
 
 bool JSSVGExceptionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -142,12 +138,11 @@ JSSVGException::JSSVGException(PassRefPtr<Structure> structure, PassRefPtr<SVGEx
 JSSVGException::~JSSVGException()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGException::createPrototype(ExecState* exec)
+JSObject* JSSVGException::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGExceptionPrototype(JSSVGExceptionPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGExceptionPrototype(JSSVGExceptionPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGException::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -155,69 +150,73 @@ bool JSSVGException::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSSVGException, Base>(exec, &JSSVGExceptionTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGException* imp = static_cast<SVGException*>(static_cast<JSSVGException*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->code());
 }
 
-JSValuePtr jsSVGExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGException* imp = static_cast<SVGException*>(static_cast<JSSVGException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsSVGExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGException* imp = static_cast<SVGException*>(static_cast<JSSVGException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->message());
 }
 
-JSValuePtr jsSVGExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGException*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGException::getConstructor(ExecState* exec)
+JSValue JSSVGException::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGExceptionConstructor>(exec);
 }
 
-JSValuePtr jsSVGExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGException::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGException::s_info))
         return throwError(exec, TypeError);
     JSSVGException* castedThisObj = static_cast<JSSVGException*>(asObject(thisValue));
     SVGException* imp = static_cast<SVGException*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->toString());
+    JSC::JSValue result = jsString(exec, imp->toString());
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsSVGExceptionSVG_WRONG_TYPE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGExceptionSVG_WRONG_TYPE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGExceptionSVG_INVALID_VALUE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGExceptionSVG_INVALID_VALUE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGExceptionSVG_MATRIX_NOT_INVERTABLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGExceptionSVG_MATRIX_NOT_INVERTABLE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGException* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGException* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGException>(exec, object, context);
 }
-SVGException* toSVGException(JSC::JSValuePtr value)
+SVGException* toSVGException(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGException::s_info) ? static_cast<JSSVGException*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGException::s_info) ? static_cast<JSSVGException*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGException.h b/src/3rdparty/webkit/WebCore/generated/JSSVGException.h
index 02dfef7..e8fb53d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGException.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGException_h
 #define JSSVGException_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -37,17 +37,17 @@ class JSSVGException : public DOMObject {
 public:
     JSSVGException(PassRefPtr<JSC::Structure>, PassRefPtr<SVGException>, SVGElement* context);
     virtual ~JSSVGException();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     SVGException* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -56,16 +56,17 @@ private:
     RefPtr<SVGException > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGException*, SVGElement* context);
-SVGException* toSVGException(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGException*, SVGElement* context);
+SVGException* toSVGException(JSC::JSValue);
 
 class JSSVGExceptionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -74,18 +75,18 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGExceptionSVG_WRONG_TYPE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGExceptionSVG_INVALID_VALUE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGExceptionSVG_MATRIX_NOT_INVERTABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGExceptionSVG_WRONG_TYPE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGExceptionSVG_INVALID_VALUE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGExceptionSVG_MATRIX_NOT_INVERTABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp
index 0442457..0ecbe59 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGFEBlendElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -37,15 +33,14 @@
 #include "JSSVGAnimatedLength.h"
 #include "JSSVGAnimatedString.h"
 #include "SVGFEBlendElement.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEBlendElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEBlendElement);
 
 /* Hash table */
 
@@ -97,13 +92,13 @@ public:
     JSSVGFEBlendElementConstructor(ExecState* exec)
         : DOMObject(JSSVGFEBlendElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGFEBlendElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGFEBlendElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -139,9 +134,9 @@ static const HashTable JSSVGFEBlendElementPrototypeTable =
 
 const ClassInfo JSSVGFEBlendElementPrototype::s_info = { "SVGFEBlendElementPrototype", 0, &JSSVGFEBlendElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEBlendElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEBlendElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEBlendElement>(exec);
+    return getDOMPrototype<JSSVGFEBlendElement>(exec, globalObject);
 }
 
 bool JSSVGFEBlendElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -156,9 +151,9 @@ JSSVGFEBlendElement::JSSVGFEBlendElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGFEBlendElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEBlendElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEBlendElementPrototype(JSSVGFEBlendElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEBlendElementPrototype(JSSVGFEBlendElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEBlendElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -166,125 +161,136 @@ bool JSSVGFEBlendElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGFEBlendElement, Base>(exec, &JSSVGFEBlendElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEBlendElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEBlendElementIn2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementIn2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in2Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEBlendElementMode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementMode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->modeAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEBlendElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEBlendElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEBlendElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEBlendElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEBlendElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEBlendElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEBlendElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFEBlendElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEBlendElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGFEBlendElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGFEBlendElement::getConstructor(ExecState* exec)
+JSValue JSSVGFEBlendElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGFEBlendElementConstructor>(exec);
 }
 
-JSValuePtr jsSVGFEBlendElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFEBlendElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFEBlendElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFEBlendElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEBlendElement* castedThisObj = static_cast<JSSVGFEBlendElement*>(asObject(thisValue));
     SVGFEBlendElement* imp = static_cast<SVGFEBlendElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_NORMAL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_NORMAL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_MULTIPLY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_MULTIPLY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_SCREEN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_SCREEN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_DARKEN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_DARKEN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_LIGHTEN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_LIGHTEN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
@@ -292,4 +298,4 @@ JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_LIGHTEN(ExecState* exec, const Id
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h
index cf5956a..34750a9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEBlendElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFEBlendElement_h
 #define JSSVGFEBlendElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,27 +34,28 @@ class JSSVGFEBlendElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEBlendElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEBlendElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGFEBlendElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,31 +64,31 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFEBlendElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEBlendElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFEBlendElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementIn2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementMode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementIn2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementMode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_NORMAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_MULTIPLY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_SCREEN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_DARKEN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEBlendElementSVG_FEBLEND_MODE_LIGHTEN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_NORMAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_MULTIPLY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_SCREEN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_DARKEN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEBlendElementSVG_FEBLEND_MODE_LIGHTEN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp
index 92c28c9..dd8db83 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGFEColorMatrixElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -38,15 +34,14 @@
 #include "JSSVGAnimatedNumberList.h"
 #include "JSSVGAnimatedString.h"
 #include "SVGFEColorMatrixElement.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEColorMatrixElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEColorMatrixElement);
 
 /* Hash table */
 
@@ -97,13 +92,13 @@ public:
     JSSVGFEColorMatrixElementConstructor(ExecState* exec)
         : DOMObject(JSSVGFEColorMatrixElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGFEColorMatrixElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGFEColorMatrixElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -138,9 +133,9 @@ static const HashTable JSSVGFEColorMatrixElementPrototypeTable =
 
 const ClassInfo JSSVGFEColorMatrixElementPrototype::s_info = { "SVGFEColorMatrixElementPrototype", 0, &JSSVGFEColorMatrixElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEColorMatrixElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEColorMatrixElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEColorMatrixElement>(exec);
+    return getDOMPrototype<JSSVGFEColorMatrixElement>(exec, globalObject);
 }
 
 bool JSSVGFEColorMatrixElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -155,9 +150,9 @@ JSSVGFEColorMatrixElement::JSSVGFEColorMatrixElement(PassRefPtr<Structure> struc
 {
 }
 
-JSObject* JSSVGFEColorMatrixElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEColorMatrixElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEColorMatrixElementPrototype(JSSVGFEColorMatrixElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEColorMatrixElementPrototype(JSSVGFEColorMatrixElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEColorMatrixElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -165,120 +160,131 @@ bool JSSVGFEColorMatrixElement::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSSVGFEColorMatrixElement, Base>(exec, &JSSVGFEColorMatrixElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEColorMatrixElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEColorMatrixElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->typeAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEColorMatrixElementValues(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementValues(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumberList> obj = imp->valuesAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEColorMatrixElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEColorMatrixElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEColorMatrixElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEColorMatrixElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEColorMatrixElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEColorMatrixElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEColorMatrixElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFEColorMatrixElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEColorMatrixElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGFEColorMatrixElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGFEColorMatrixElement::getConstructor(ExecState* exec)
+JSValue JSSVGFEColorMatrixElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGFEColorMatrixElementConstructor>(exec);
 }
 
-JSValuePtr jsSVGFEColorMatrixElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFEColorMatrixElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFEColorMatrixElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFEColorMatrixElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEColorMatrixElement* castedThisObj = static_cast<JSSVGFEColorMatrixElement*>(asObject(thisValue));
     SVGFEColorMatrixElement* imp = static_cast<SVGFEColorMatrixElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_MATRIX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_MATRIX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_SATURATE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_SATURATE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_HUEROTATE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_HUEROTATE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_LUMINANCETOALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_LUMINANCETOALPHA(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
@@ -286,4 +292,4 @@ JSValuePtr jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_LUMINANCETOALPHA(Exec
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h
index ff20cd0..de9ef2f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEColorMatrixElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFEColorMatrixElement_h
 #define JSSVGFEColorMatrixElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,27 +34,28 @@ class JSSVGFEColorMatrixElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEColorMatrixElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEColorMatrixElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGFEColorMatrixElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,30 +64,30 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFEColorMatrixElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEColorMatrixElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFEColorMatrixElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementValues(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementValues(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_MATRIX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_SATURATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_HUEROTATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_LUMINANCETOALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_MATRIX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_SATURATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_HUEROTATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEColorMatrixElementSVG_FECOLORMATRIX_TYPE_LUMINANCETOALPHA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.cpp
index 14099ec..cf4de5c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGFEComponentTransferElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -36,14 +32,14 @@
 #include "JSSVGAnimatedLength.h"
 #include "JSSVGAnimatedString.h"
 #include "SVGFEComponentTransferElement.h"
-
 #include <runtime/Error.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEComponentTransferElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEComponentTransferElement);
 
 /* Hash table */
 
@@ -84,9 +80,9 @@ static const HashTable JSSVGFEComponentTransferElementPrototypeTable =
 
 const ClassInfo JSSVGFEComponentTransferElementPrototype::s_info = { "SVGFEComponentTransferElementPrototype", 0, &JSSVGFEComponentTransferElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEComponentTransferElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEComponentTransferElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEComponentTransferElement>(exec);
+    return getDOMPrototype<JSSVGFEComponentTransferElement>(exec, globalObject);
 }
 
 bool JSSVGFEComponentTransferElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -101,9 +97,9 @@ JSSVGFEComponentTransferElement::JSSVGFEComponentTransferElement(PassRefPtr<Stru
 {
 }
 
-JSObject* JSSVGFEComponentTransferElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEComponentTransferElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEComponentTransferElementPrototype(JSSVGFEComponentTransferElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEComponentTransferElementPrototype(JSSVGFEComponentTransferElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEComponentTransferElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -111,75 +107,84 @@ bool JSSVGFEComponentTransferElement::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSSVGFEComponentTransferElement, Base>(exec, &JSSVGFEComponentTransferElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEComponentTransferElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEComponentTransferElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEComponentTransferElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEComponentTransferElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEComponentTransferElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEComponentTransferElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEComponentTransferElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEComponentTransferElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEComponentTransferElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(static_cast<JSSVGFEComponentTransferElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFEComponentTransferElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFEComponentTransferElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFEComponentTransferElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFEComponentTransferElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEComponentTransferElement* castedThisObj = static_cast<JSSVGFEComponentTransferElement*>(asObject(thisValue));
     SVGFEComponentTransferElement* imp = static_cast<SVGFEComponentTransferElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h
index 1638af4..803a32b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEComponentTransferElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFEComponentTransferElement_h
 #define JSSVGFEComponentTransferElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,12 +34,12 @@ class JSSVGFEComponentTransferElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEComponentTransferElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEComponentTransferElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGFEComponentTransferElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,20 +63,20 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFEComponentTransferElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEComponentTransferElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFEComponentTransferElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEComponentTransferElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEComponentTransferElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEComponentTransferElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEComponentTransferElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEComponentTransferElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEComponentTransferElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEComponentTransferElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEComponentTransferElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEComponentTransferElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEComponentTransferElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEComponentTransferElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEComponentTransferElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEComponentTransferElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEComponentTransferElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEComponentTransferElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp
index 88f42e6..6aff814 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGFECompositeElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -38,15 +34,14 @@
 #include "JSSVGAnimatedNumber.h"
 #include "JSSVGAnimatedString.h"
 #include "SVGFECompositeElement.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFECompositeElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFECompositeElement);
 
 /* Hash table */
 
@@ -103,13 +98,13 @@ public:
     JSSVGFECompositeElementConstructor(ExecState* exec)
         : DOMObject(JSSVGFECompositeElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGFECompositeElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGFECompositeElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -146,9 +141,9 @@ static const HashTable JSSVGFECompositeElementPrototypeTable =
 
 const ClassInfo JSSVGFECompositeElementPrototype::s_info = { "SVGFECompositeElementPrototype", 0, &JSSVGFECompositeElementPrototypeTable, 0 };
 
-JSObject* JSSVGFECompositeElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFECompositeElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFECompositeElement>(exec);
+    return getDOMPrototype<JSSVGFECompositeElement>(exec, globalObject);
 }
 
 bool JSSVGFECompositeElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -163,9 +158,9 @@ JSSVGFECompositeElement::JSSVGFECompositeElement(PassRefPtr<Structure> structure
 {
 }
 
-JSObject* JSSVGFECompositeElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFECompositeElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFECompositeElementPrototype(JSSVGFECompositeElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFECompositeElementPrototype(JSSVGFECompositeElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFECompositeElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -173,158 +168,173 @@ bool JSSVGFECompositeElement::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSSVGFECompositeElement, Base>(exec, &JSSVGFECompositeElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFECompositeElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementIn2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementIn2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in2Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElement_operator(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElement_operator(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->_operatorAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementK1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementK1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->k1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementK2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementK2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->k2Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementK3(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementK3(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->k3Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementK4(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementK4(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->k4Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFECompositeElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFECompositeElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFECompositeElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGFECompositeElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGFECompositeElement::getConstructor(ExecState* exec)
+JSValue JSSVGFECompositeElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGFECompositeElementConstructor>(exec);
 }
 
-JSValuePtr jsSVGFECompositeElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFECompositeElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFECompositeElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFECompositeElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFECompositeElement* castedThisObj = static_cast<JSSVGFECompositeElement*>(asObject(thisValue));
     SVGFECompositeElement* imp = static_cast<SVGFECompositeElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OVER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OVER(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_IN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_IN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OUT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OUT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ATOP(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ATOP(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_XOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_XOR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ARITHMETIC(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ARITHMETIC(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
@@ -332,4 +342,4 @@ JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ARITHMETIC(ExecState*
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h
index 8da510c..b2876c3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFECompositeElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFECompositeElement_h
 #define JSSVGFECompositeElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,27 +34,28 @@ class JSSVGFECompositeElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFECompositeElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFECompositeElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGFECompositeElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,36 +64,36 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFECompositeElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFECompositeElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFECompositeElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementIn2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElement_operator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementK1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementK2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementK3(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementK4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementIn2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElement_operator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementK1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementK2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementK3(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementK4(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OVER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_IN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OUT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ATOP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_XOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ARITHMETIC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OVER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_IN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_OUT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ATOP(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_XOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFECompositeElementSVG_FECOMPOSITE_OPERATOR_ARITHMETIC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.cpp
index 769ab78..4549381 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGFEDiffuseLightingElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -37,14 +33,14 @@
 #include "JSSVGAnimatedNumber.h"
 #include "JSSVGAnimatedString.h"
 #include "SVGFEDiffuseLightingElement.h"
-
 #include <runtime/Error.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEDiffuseLightingElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEDiffuseLightingElement);
 
 /* Hash table */
 
@@ -89,9 +85,9 @@ static const HashTable JSSVGFEDiffuseLightingElementPrototypeTable =
 
 const ClassInfo JSSVGFEDiffuseLightingElementPrototype::s_info = { "SVGFEDiffuseLightingElementPrototype", 0, &JSSVGFEDiffuseLightingElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEDiffuseLightingElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEDiffuseLightingElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEDiffuseLightingElement>(exec);
+    return getDOMPrototype<JSSVGFEDiffuseLightingElement>(exec, globalObject);
 }
 
 bool JSSVGFEDiffuseLightingElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -106,9 +102,9 @@ JSSVGFEDiffuseLightingElement::JSSVGFEDiffuseLightingElement(PassRefPtr<Structur
 {
 }
 
-JSObject* JSSVGFEDiffuseLightingElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEDiffuseLightingElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEDiffuseLightingElementPrototype(JSSVGFEDiffuseLightingElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEDiffuseLightingElementPrototype(JSSVGFEDiffuseLightingElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEDiffuseLightingElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -116,103 +112,116 @@ bool JSSVGFEDiffuseLightingElement::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSSVGFEDiffuseLightingElement, Base>(exec, &JSSVGFEDiffuseLightingElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementSurfaceScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementSurfaceScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->surfaceScaleAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementDiffuseConstant(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementDiffuseConstant(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->diffuseConstantAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementKernelUnitLengthX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementKernelUnitLengthX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->kernelUnitLengthXAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementKernelUnitLengthY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementKernelUnitLengthY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->kernelUnitLengthYAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDiffuseLightingElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(static_cast<JSSVGFEDiffuseLightingElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFEDiffuseLightingElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFEDiffuseLightingElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFEDiffuseLightingElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFEDiffuseLightingElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEDiffuseLightingElement* castedThisObj = static_cast<JSSVGFEDiffuseLightingElement*>(asObject(thisValue));
     SVGFEDiffuseLightingElement* imp = static_cast<SVGFEDiffuseLightingElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h
index cd89cfc..96bb14d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDiffuseLightingElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFEDiffuseLightingElement_h
 #define JSSVGFEDiffuseLightingElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,12 +34,12 @@ class JSSVGFEDiffuseLightingElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEDiffuseLightingElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEDiffuseLightingElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGFEDiffuseLightingElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,24 +63,24 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEDiffuseLightingElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementSurfaceScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementDiffuseConstant(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementKernelUnitLengthX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementKernelUnitLengthY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDiffuseLightingElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementSurfaceScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementDiffuseConstant(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementKernelUnitLengthX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementKernelUnitLengthY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDiffuseLightingElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp
index 671d53d..dca7363 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGFEDisplacementMapElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -38,15 +34,14 @@
 #include "JSSVGAnimatedNumber.h"
 #include "JSSVGAnimatedString.h"
 #include "SVGFEDisplacementMapElement.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEDisplacementMapElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEDisplacementMapElement);
 
 /* Hash table */
 
@@ -99,13 +94,13 @@ public:
     JSSVGFEDisplacementMapElementConstructor(ExecState* exec)
         : DOMObject(JSSVGFEDisplacementMapElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGFEDisplacementMapElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGFEDisplacementMapElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -140,9 +135,9 @@ static const HashTable JSSVGFEDisplacementMapElementPrototypeTable =
 
 const ClassInfo JSSVGFEDisplacementMapElementPrototype::s_info = { "SVGFEDisplacementMapElementPrototype", 0, &JSSVGFEDisplacementMapElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEDisplacementMapElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEDisplacementMapElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEDisplacementMapElement>(exec);
+    return getDOMPrototype<JSSVGFEDisplacementMapElement>(exec, globalObject);
 }
 
 bool JSSVGFEDisplacementMapElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -157,9 +152,9 @@ JSSVGFEDisplacementMapElement::JSSVGFEDisplacementMapElement(PassRefPtr<Structur
 {
 }
 
-JSObject* JSSVGFEDisplacementMapElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEDisplacementMapElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEDisplacementMapElementPrototype(JSSVGFEDisplacementMapElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEDisplacementMapElementPrototype(JSSVGFEDisplacementMapElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEDisplacementMapElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -167,134 +162,147 @@ bool JSSVGFEDisplacementMapElement::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSSVGFEDisplacementMapElement, Base>(exec, &JSSVGFEDisplacementMapElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementIn2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementIn2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in2Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->scaleAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementXChannelSelector(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementXChannelSelector(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->xChannelSelectorAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementYChannelSelector(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementYChannelSelector(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->yChannelSelectorAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDisplacementMapElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGFEDisplacementMapElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGFEDisplacementMapElement::getConstructor(ExecState* exec)
+JSValue JSSVGFEDisplacementMapElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGFEDisplacementMapElementConstructor>(exec);
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFEDisplacementMapElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFEDisplacementMapElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFEDisplacementMapElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEDisplacementMapElement* castedThisObj = static_cast<JSSVGFEDisplacementMapElement*>(asObject(thisValue));
     SVGFEDisplacementMapElement* imp = static_cast<SVGFEDisplacementMapElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsSVGFEDisplacementMapElementSVG_CHANNEL_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementSVG_CHANNEL_R(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_R(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementSVG_CHANNEL_G(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_G(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementSVG_CHANNEL_B(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_B(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsSVGFEDisplacementMapElementSVG_CHANNEL_A(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_A(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
@@ -302,4 +310,4 @@ JSValuePtr jsSVGFEDisplacementMapElementSVG_CHANNEL_A(ExecState* exec, const Ide
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h
index 88f5f32..93c9fe5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDisplacementMapElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFEDisplacementMapElement_h
 #define JSSVGFEDisplacementMapElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,27 +34,28 @@ class JSSVGFEDisplacementMapElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEDisplacementMapElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEDisplacementMapElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGFEDisplacementMapElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,32 +64,32 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFEDisplacementMapElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEDisplacementMapElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFEDisplacementMapElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementIn2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementXChannelSelector(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementYChannelSelector(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementIn2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementXChannelSelector(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementYChannelSelector(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGFEDisplacementMapElementSVG_CHANNEL_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementSVG_CHANNEL_R(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementSVG_CHANNEL_G(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementSVG_CHANNEL_B(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDisplacementMapElementSVG_CHANNEL_A(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_R(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_G(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_B(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDisplacementMapElementSVG_CHANNEL_A(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.cpp
index be849e0..55abac8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGFEDistantLightElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGAnimatedNumber.h"
 #include "SVGFEDistantLightElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEDistantLightElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEDistantLightElement);
 
 /* Hash table */
 
@@ -70,9 +66,9 @@ static const HashTable JSSVGFEDistantLightElementPrototypeTable =
 
 const ClassInfo JSSVGFEDistantLightElementPrototype::s_info = { "SVGFEDistantLightElementPrototype", 0, &JSSVGFEDistantLightElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEDistantLightElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEDistantLightElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEDistantLightElement>(exec);
+    return getDOMPrototype<JSSVGFEDistantLightElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFEDistantLightElement::s_info = { "SVGFEDistantLightElement", &JSSVGElement::s_info, &JSSVGFEDistantLightElementTable, 0 };
@@ -82,9 +78,9 @@ JSSVGFEDistantLightElement::JSSVGFEDistantLightElement(PassRefPtr<Structure> str
 {
 }
 
-JSObject* JSSVGFEDistantLightElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEDistantLightElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEDistantLightElementPrototype(JSSVGFEDistantLightElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEDistantLightElementPrototype(JSSVGFEDistantLightElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEDistantLightElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -92,15 +88,17 @@ bool JSSVGFEDistantLightElement::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSSVGFEDistantLightElement, Base>(exec, &JSSVGFEDistantLightElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEDistantLightElementAzimuth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDistantLightElementAzimuth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDistantLightElement* imp = static_cast<SVGFEDistantLightElement*>(static_cast<JSSVGFEDistantLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->azimuthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEDistantLightElementElevation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEDistantLightElementElevation(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEDistantLightElement* imp = static_cast<SVGFEDistantLightElement*>(static_cast<JSSVGFEDistantLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->elevationAnimated();
     return toJS(exec, obj.get(), imp);
@@ -109,4 +107,4 @@ JSValuePtr jsSVGFEDistantLightElementElevation(ExecState* exec, const Identifier
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h
index 201f905..1a61871 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEDistantLightElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFEDistantLightElement_h
 #define JSSVGFEDistantLightElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,12 +34,12 @@ class JSSVGFEDistantLightElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEDistantLightElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEDistantLightElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,8 +48,9 @@ public:
 
 
 class JSSVGFEDistantLightElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFEDistantLightElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -57,11 +58,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGFEDistantLightElementAzimuth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEDistantLightElementElevation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDistantLightElementAzimuth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEDistantLightElementElevation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp
index 2d1a049..1b7cab5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGFEFloodElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -36,19 +32,20 @@
 #include "JSSVGAnimatedLength.h"
 #include "JSSVGAnimatedString.h"
 #include "SVGFEFloodElement.h"
-
 #include <runtime/Error.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFloodElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFloodElement);
 
 /* Hash table */
 
-static const HashTableValue JSSVGFEFloodElementTableValues[8] =
+static const HashTableValue JSSVGFEFloodElementTableValues[10] =
 {
+    { "in1", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementIn1, (intptr_t)0 },
     { "x", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementX, (intptr_t)0 },
     { "y", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementY, (intptr_t)0 },
     { "width", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementWidth, (intptr_t)0 },
@@ -56,6 +53,7 @@ static const HashTableValue JSSVGFEFloodElementTableValues[8] =
     { "result", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementResult, (intptr_t)0 },
     { "className", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementClassName, (intptr_t)0 },
     { "style", DontDelete|ReadOnly, (intptr_t)jsSVGFEFloodElementStyle, (intptr_t)0 },
+    { "constructor", DontEnum|ReadOnly, (intptr_t)jsSVGFEFloodElementConstructor, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -63,9 +61,47 @@ static const HashTable JSSVGFEFloodElementTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 255, JSSVGFEFloodElementTableValues, 0 };
 #else
-    { 17, 15, JSSVGFEFloodElementTableValues, 0 };
+    { 34, 31, JSSVGFEFloodElementTableValues, 0 };
 #endif
 
+/* Hash table for constructor */
+
+static const HashTableValue JSSVGFEFloodElementConstructorTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSSVGFEFloodElementConstructorTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSSVGFEFloodElementConstructorTableValues, 0 };
+#else
+    { 1, 0, JSSVGFEFloodElementConstructorTableValues, 0 };
+#endif
+
+class JSSVGFEFloodElementConstructor : public DOMObject {
+public:
+    JSSVGFEFloodElementConstructor(ExecState* exec)
+        : DOMObject(JSSVGFEFloodElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
+    {
+        putDirect(exec->propertyNames().prototype, JSSVGFEFloodElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
+    }
+    virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
+    virtual const ClassInfo* classInfo() const { return &s_info; }
+    static const ClassInfo s_info;
+
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
+    { 
+        return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
+    }
+};
+
+const ClassInfo JSSVGFEFloodElementConstructor::s_info = { "SVGFEFloodElementConstructor", 0, &JSSVGFEFloodElementConstructorTable, 0 };
+
+bool JSSVGFEFloodElementConstructor::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSSVGFEFloodElementConstructor, DOMObject>(exec, &JSSVGFEFloodElementConstructorTable, this, propertyName, slot);
+}
+
 /* Hash table for prototype */
 
 static const HashTableValue JSSVGFEFloodElementPrototypeTableValues[2] =
@@ -83,9 +119,9 @@ static const HashTable JSSVGFEFloodElementPrototypeTable =
 
 const ClassInfo JSSVGFEFloodElementPrototype::s_info = { "SVGFEFloodElementPrototype", 0, &JSSVGFEFloodElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEFloodElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEFloodElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEFloodElement>(exec);
+    return getDOMPrototype<JSSVGFEFloodElement>(exec, globalObject);
 }
 
 bool JSSVGFEFloodElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -100,9 +136,9 @@ JSSVGFEFloodElement::JSSVGFEFloodElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGFEFloodElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEFloodElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEFloodElementPrototype(JSSVGFEFloodElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEFloodElementPrototype(JSSVGFEFloodElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEFloodElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -110,68 +146,93 @@ bool JSSVGFEFloodElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGFEFloodElement, Base>(exec, &JSSVGFEFloodElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEFloodElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEFloodElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
+    SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()))->impl());
+    RefPtr<SVGAnimatedString> obj = imp->in1Animated();
+    return toJS(exec, obj.get(), imp);
+}
+
+JSValue jsSVGFEFloodElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEFloodElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEFloodElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEFloodElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEFloodElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEFloodElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEFloodElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEFloodElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEFloodElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEFloodElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEFloodElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEFloodElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEFloodElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFEFloodElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue jsSVGFEFloodElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    return static_cast<JSSVGFEFloodElement*>(asObject(slot.slotBase()))->getConstructor(exec);
+}
+JSValue JSSVGFEFloodElement::getConstructor(ExecState* exec)
+{
+    return getDOMConstructor<JSSVGFEFloodElementConstructor>(exec);
+}
+
+JSValue JSC_HOST_CALL jsSVGFEFloodElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFEFloodElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFEFloodElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEFloodElement* castedThisObj = static_cast<JSSVGFEFloodElement*>(asObject(thisValue));
     SVGFEFloodElement* imp = static_cast<SVGFEFloodElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h
index 0423a2c..fe54ca4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFloodElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFEFloodElement_h
 #define JSSVGFEFloodElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,26 +34,28 @@ class JSSVGFEFloodElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEFloodElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEFloodElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGFEFloodElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,19 +64,21 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFEFloodElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEFloodElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFEFloodElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEFloodElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEFloodElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEFloodElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEFloodElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEFloodElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEFloodElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEFloodElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEFloodElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEFloodElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEFloodElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEFloodElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEFloodElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEFloodElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEFloodElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEFloodElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.cpp
index 90e4497..90dbf26 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGFEFuncAElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGFEFuncAElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFuncAElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFuncAElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +49,9 @@ static const HashTable JSSVGFEFuncAElementPrototypeTable =
 
 const ClassInfo JSSVGFEFuncAElementPrototype::s_info = { "SVGFEFuncAElementPrototype", 0, &JSSVGFEFuncAElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEFuncAElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEFuncAElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEFuncAElement>(exec);
+    return getDOMPrototype<JSSVGFEFuncAElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFEFuncAElement::s_info = { "SVGFEFuncAElement", &JSSVGComponentTransferFunctionElement::s_info, 0, 0 };
@@ -65,12 +61,12 @@ JSSVGFEFuncAElement::JSSVGFEFuncAElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGFEFuncAElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEFuncAElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEFuncAElementPrototype(JSSVGFEFuncAElementPrototype::createStructure(JSSVGComponentTransferFunctionElementPrototype::self(exec)));
+    return new (exec) JSSVGFEFuncAElementPrototype(JSSVGFEFuncAElementPrototype::createStructure(JSSVGComponentTransferFunctionElementPrototype::self(exec, globalObject)));
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.h
index 6389f34..1afcb58 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncAElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFEFuncAElement_h
 #define JSSVGFEFuncAElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGComponentTransferFunctionElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,7 +34,7 @@ class JSSVGFEFuncAElement : public JSSVGComponentTransferFunctionElement {
     typedef JSSVGComponentTransferFunctionElement Base;
 public:
     JSSVGFEFuncAElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEFuncAElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGFEFuncAElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFEFuncAElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -52,6 +53,6 @@ public:
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.cpp
index 81926d6..a2c895b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGFEFuncBElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGFEFuncBElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFuncBElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFuncBElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +49,9 @@ static const HashTable JSSVGFEFuncBElementPrototypeTable =
 
 const ClassInfo JSSVGFEFuncBElementPrototype::s_info = { "SVGFEFuncBElementPrototype", 0, &JSSVGFEFuncBElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEFuncBElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEFuncBElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEFuncBElement>(exec);
+    return getDOMPrototype<JSSVGFEFuncBElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFEFuncBElement::s_info = { "SVGFEFuncBElement", &JSSVGComponentTransferFunctionElement::s_info, 0, 0 };
@@ -65,12 +61,12 @@ JSSVGFEFuncBElement::JSSVGFEFuncBElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGFEFuncBElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEFuncBElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEFuncBElementPrototype(JSSVGFEFuncBElementPrototype::createStructure(JSSVGComponentTransferFunctionElementPrototype::self(exec)));
+    return new (exec) JSSVGFEFuncBElementPrototype(JSSVGFEFuncBElementPrototype::createStructure(JSSVGComponentTransferFunctionElementPrototype::self(exec, globalObject)));
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.h
index 165a188..5f44847 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncBElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFEFuncBElement_h
 #define JSSVGFEFuncBElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGComponentTransferFunctionElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,7 +34,7 @@ class JSSVGFEFuncBElement : public JSSVGComponentTransferFunctionElement {
     typedef JSSVGComponentTransferFunctionElement Base;
 public:
     JSSVGFEFuncBElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEFuncBElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGFEFuncBElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFEFuncBElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -52,6 +53,6 @@ public:
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.cpp
index 539e342..acebd39 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGFEFuncGElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGFEFuncGElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFuncGElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFuncGElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +49,9 @@ static const HashTable JSSVGFEFuncGElementPrototypeTable =
 
 const ClassInfo JSSVGFEFuncGElementPrototype::s_info = { "SVGFEFuncGElementPrototype", 0, &JSSVGFEFuncGElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEFuncGElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEFuncGElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEFuncGElement>(exec);
+    return getDOMPrototype<JSSVGFEFuncGElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFEFuncGElement::s_info = { "SVGFEFuncGElement", &JSSVGComponentTransferFunctionElement::s_info, 0, 0 };
@@ -65,12 +61,12 @@ JSSVGFEFuncGElement::JSSVGFEFuncGElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGFEFuncGElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEFuncGElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEFuncGElementPrototype(JSSVGFEFuncGElementPrototype::createStructure(JSSVGComponentTransferFunctionElementPrototype::self(exec)));
+    return new (exec) JSSVGFEFuncGElementPrototype(JSSVGFEFuncGElementPrototype::createStructure(JSSVGComponentTransferFunctionElementPrototype::self(exec, globalObject)));
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.h
index aafeab6..2a14252 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncGElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFEFuncGElement_h
 #define JSSVGFEFuncGElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGComponentTransferFunctionElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,7 +34,7 @@ class JSSVGFEFuncGElement : public JSSVGComponentTransferFunctionElement {
     typedef JSSVGComponentTransferFunctionElement Base;
 public:
     JSSVGFEFuncGElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEFuncGElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGFEFuncGElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFEFuncGElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -52,6 +53,6 @@ public:
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.cpp
index 96d9188..c6fad7b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGFEFuncRElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGFEFuncRElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFuncRElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEFuncRElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +49,9 @@ static const HashTable JSSVGFEFuncRElementPrototypeTable =
 
 const ClassInfo JSSVGFEFuncRElementPrototype::s_info = { "SVGFEFuncRElementPrototype", 0, &JSSVGFEFuncRElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEFuncRElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEFuncRElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEFuncRElement>(exec);
+    return getDOMPrototype<JSSVGFEFuncRElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFEFuncRElement::s_info = { "SVGFEFuncRElement", &JSSVGComponentTransferFunctionElement::s_info, 0, 0 };
@@ -65,12 +61,12 @@ JSSVGFEFuncRElement::JSSVGFEFuncRElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGFEFuncRElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEFuncRElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEFuncRElementPrototype(JSSVGFEFuncRElementPrototype::createStructure(JSSVGComponentTransferFunctionElementPrototype::self(exec)));
+    return new (exec) JSSVGFEFuncRElementPrototype(JSSVGFEFuncRElementPrototype::createStructure(JSSVGComponentTransferFunctionElementPrototype::self(exec, globalObject)));
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.h
index 03e176d..c6ba514 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEFuncRElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFEFuncRElement_h
 #define JSSVGFEFuncRElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGComponentTransferFunctionElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,7 +34,7 @@ class JSSVGFEFuncRElement : public JSSVGComponentTransferFunctionElement {
     typedef JSSVGComponentTransferFunctionElement Base;
 public:
     JSSVGFEFuncRElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEFuncRElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGFEFuncRElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFEFuncRElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -52,6 +53,6 @@ public:
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.cpp
index 3640b99..281c9be 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGFEGaussianBlurElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -37,14 +33,14 @@
 #include "JSSVGAnimatedNumber.h"
 #include "JSSVGAnimatedString.h"
 #include "SVGFEGaussianBlurElement.h"
-
 #include <runtime/Error.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEGaussianBlurElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEGaussianBlurElement);
 
 /* Hash table */
 
@@ -88,9 +84,9 @@ static const HashTable JSSVGFEGaussianBlurElementPrototypeTable =
 
 const ClassInfo JSSVGFEGaussianBlurElementPrototype::s_info = { "SVGFEGaussianBlurElementPrototype", 0, &JSSVGFEGaussianBlurElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEGaussianBlurElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEGaussianBlurElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEGaussianBlurElement>(exec);
+    return getDOMPrototype<JSSVGFEGaussianBlurElement>(exec, globalObject);
 }
 
 bool JSSVGFEGaussianBlurElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -105,9 +101,9 @@ JSSVGFEGaussianBlurElement::JSSVGFEGaussianBlurElement(PassRefPtr<Structure> str
 {
 }
 
-JSObject* JSSVGFEGaussianBlurElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEGaussianBlurElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEGaussianBlurElementPrototype(JSSVGFEGaussianBlurElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEGaussianBlurElementPrototype(JSSVGFEGaussianBlurElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEGaussianBlurElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -115,102 +111,114 @@ bool JSSVGFEGaussianBlurElement::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSSVGFEGaussianBlurElement, Base>(exec, &JSSVGFEGaussianBlurElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementStdDeviationX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementStdDeviationX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->stdDeviationXAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementStdDeviationY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementStdDeviationY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->stdDeviationYAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEGaussianBlurElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(static_cast<JSSVGFEGaussianBlurElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementPrototypeFunctionSetStdDeviation(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFEGaussianBlurElementPrototypeFunctionSetStdDeviation(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFEGaussianBlurElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFEGaussianBlurElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEGaussianBlurElement* castedThisObj = static_cast<JSSVGFEGaussianBlurElement*>(asObject(thisValue));
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(castedThisObj->impl());
-    float stdDeviationX = args.at(exec, 0)->toFloat(exec);
-    float stdDeviationY = args.at(exec, 1)->toFloat(exec);
+    float stdDeviationX = args.at(0).toFloat(exec);
+    float stdDeviationY = args.at(1).toFloat(exec);
 
     imp->setStdDeviation(stdDeviationX, stdDeviationY);
     return jsUndefined();
 }
 
-JSValuePtr jsSVGFEGaussianBlurElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFEGaussianBlurElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFEGaussianBlurElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFEGaussianBlurElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEGaussianBlurElement* castedThisObj = static_cast<JSSVGFEGaussianBlurElement*>(asObject(thisValue));
     SVGFEGaussianBlurElement* imp = static_cast<SVGFEGaussianBlurElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h
index 4452f50..2a5bcd3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEGaussianBlurElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFEGaussianBlurElement_h
 #define JSSVGFEGaussianBlurElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,12 +34,12 @@ class JSSVGFEGaussianBlurElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEGaussianBlurElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEGaussianBlurElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGFEGaussianBlurElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,23 +63,23 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFEGaussianBlurElementPrototypeFunctionSetStdDeviation(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGFEGaussianBlurElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEGaussianBlurElementPrototypeFunctionSetStdDeviation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEGaussianBlurElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFEGaussianBlurElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEGaussianBlurElementStdDeviationX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEGaussianBlurElementStdDeviationY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEGaussianBlurElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEGaussianBlurElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEGaussianBlurElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEGaussianBlurElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEGaussianBlurElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEGaussianBlurElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEGaussianBlurElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEGaussianBlurElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEGaussianBlurElementStdDeviationX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEGaussianBlurElementStdDeviationY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEGaussianBlurElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEGaussianBlurElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEGaussianBlurElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEGaussianBlurElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEGaussianBlurElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEGaussianBlurElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEGaussianBlurElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.cpp
index 0aa0bdd..08ea33e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGFEImageElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -38,15 +34,15 @@
 #include "JSSVGAnimatedString.h"
 #include "KURL.h"
 #include "SVGFEImageElement.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEImageElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEImageElement);
 
 /* Hash table */
 
@@ -90,9 +86,9 @@ static const HashTable JSSVGFEImageElementPrototypeTable =
 
 const ClassInfo JSSVGFEImageElementPrototype::s_info = { "SVGFEImageElementPrototype", 0, &JSSVGFEImageElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEImageElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEImageElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEImageElement>(exec);
+    return getDOMPrototype<JSSVGFEImageElement>(exec, globalObject);
 }
 
 bool JSSVGFEImageElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -107,9 +103,9 @@ JSSVGFEImageElement::JSSVGFEImageElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGFEImageElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEImageElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEImageElementPrototype(JSSVGFEImageElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEImageElementPrototype(JSSVGFEImageElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEImageElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -117,111 +113,123 @@ bool JSSVGFEImageElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGFEImageElement, Base>(exec, &JSSVGFEImageElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEImageElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEImageElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGFEImageElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGFEImageElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEImageElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEImageElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEImageElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEImageElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEImageElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEImageElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEImageElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEImageElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-void JSSVGFEImageElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGFEImageElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGFEImageElement, Base>(exec, propertyName, value, &JSSVGFEImageElementTable, this, slot);
 }
 
-void setJSSVGFEImageElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGFEImageElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGFEImageElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGFEImageElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(static_cast<JSSVGFEImageElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGFEImageElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFEImageElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFEImageElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFEImageElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEImageElement* castedThisObj = static_cast<JSSVGFEImageElement*>(asObject(thisValue));
     SVGFEImageElement* imp = static_cast<SVGFEImageElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h
index 2fa8c61..e07fb7d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEImageElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFEImageElement_h
 #define JSSVGFEImageElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGFEImageElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEImageElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEImageElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGFEImageElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,25 +64,25 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFEImageElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEImageElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFEImageElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEImageElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGFEImageElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGFEImageElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGFEImageElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGFEImageElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEImageElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEImageElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEImageElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEImageElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEImageElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEImageElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEImageElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEImageElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEImageElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGFEImageElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGFEImageElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGFEImageElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGFEImageElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEImageElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEImageElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEImageElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEImageElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEImageElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEImageElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEImageElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.cpp
index 4a5d839..7262013 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGFEMergeElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -36,14 +32,14 @@
 #include "JSSVGAnimatedLength.h"
 #include "JSSVGAnimatedString.h"
 #include "SVGFEMergeElement.h"
-
 #include <runtime/Error.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEMergeElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEMergeElement);
 
 /* Hash table */
 
@@ -83,9 +79,9 @@ static const HashTable JSSVGFEMergeElementPrototypeTable =
 
 const ClassInfo JSSVGFEMergeElementPrototype::s_info = { "SVGFEMergeElementPrototype", 0, &JSSVGFEMergeElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEMergeElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEMergeElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEMergeElement>(exec);
+    return getDOMPrototype<JSSVGFEMergeElement>(exec, globalObject);
 }
 
 bool JSSVGFEMergeElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -100,9 +96,9 @@ JSSVGFEMergeElement::JSSVGFEMergeElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGFEMergeElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEMergeElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEMergeElementPrototype(JSSVGFEMergeElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEMergeElementPrototype(JSSVGFEMergeElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEMergeElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -110,68 +106,76 @@ bool JSSVGFEMergeElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGFEMergeElement, Base>(exec, &JSSVGFEMergeElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEMergeElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(static_cast<JSSVGFEMergeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEMergeElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(static_cast<JSSVGFEMergeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEMergeElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(static_cast<JSSVGFEMergeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEMergeElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(static_cast<JSSVGFEMergeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEMergeElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(static_cast<JSSVGFEMergeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEMergeElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(static_cast<JSSVGFEMergeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEMergeElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(static_cast<JSSVGFEMergeElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFEMergeElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFEMergeElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFEMergeElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFEMergeElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEMergeElement* castedThisObj = static_cast<JSSVGFEMergeElement*>(asObject(thisValue));
     SVGFEMergeElement* imp = static_cast<SVGFEMergeElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h
index ffd28c6..1d8265d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFEMergeElement_h
 #define JSSVGFEMergeElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,12 +34,12 @@ class JSSVGFEMergeElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEMergeElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEMergeElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGFEMergeElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,19 +63,19 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFEMergeElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEMergeElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFEMergeElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEMergeElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEMergeElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEMergeElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEMergeElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEMergeElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEMergeElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMergeElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMergeElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMergeElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMergeElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMergeElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMergeElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMergeElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.cpp
index 6ea1742..32fc5c7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGFEMergeNodeElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGAnimatedString.h"
 #include "SVGFEMergeNodeElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEMergeNodeElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEMergeNodeElement);
 
 /* Hash table */
 
@@ -69,9 +65,9 @@ static const HashTable JSSVGFEMergeNodeElementPrototypeTable =
 
 const ClassInfo JSSVGFEMergeNodeElementPrototype::s_info = { "SVGFEMergeNodeElementPrototype", 0, &JSSVGFEMergeNodeElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEMergeNodeElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEMergeNodeElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEMergeNodeElement>(exec);
+    return getDOMPrototype<JSSVGFEMergeNodeElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFEMergeNodeElement::s_info = { "SVGFEMergeNodeElement", &JSSVGElement::s_info, &JSSVGFEMergeNodeElementTable, 0 };
@@ -81,9 +77,9 @@ JSSVGFEMergeNodeElement::JSSVGFEMergeNodeElement(PassRefPtr<Structure> structure
 {
 }
 
-JSObject* JSSVGFEMergeNodeElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEMergeNodeElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEMergeNodeElementPrototype(JSSVGFEMergeNodeElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEMergeNodeElementPrototype(JSSVGFEMergeNodeElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEMergeNodeElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -91,8 +87,9 @@ bool JSSVGFEMergeNodeElement::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSSVGFEMergeNodeElement, Base>(exec, &JSSVGFEMergeNodeElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEMergeNodeElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEMergeNodeElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEMergeNodeElement* imp = static_cast<SVGFEMergeNodeElement*>(static_cast<JSSVGFEMergeNodeElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
     return toJS(exec, obj.get(), imp);
@@ -101,4 +98,4 @@ JSValuePtr jsSVGFEMergeNodeElementIn1(ExecState* exec, const Identifier&, const
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h
index 6ffab92..d5d192e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEMergeNodeElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFEMergeNodeElement_h
 #define JSSVGFEMergeNodeElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,12 +34,12 @@ class JSSVGFEMergeNodeElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEMergeNodeElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEMergeNodeElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,8 +48,9 @@ public:
 
 
 class JSSVGFEMergeNodeElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFEMergeNodeElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -57,10 +58,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGFEMergeNodeElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEMergeNodeElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.cpp
index 8582bcb..3b36b96 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGFEOffsetElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -37,14 +33,14 @@
 #include "JSSVGAnimatedNumber.h"
 #include "JSSVGAnimatedString.h"
 #include "SVGFEOffsetElement.h"
-
 #include <runtime/Error.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEOffsetElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEOffsetElement);
 
 /* Hash table */
 
@@ -87,9 +83,9 @@ static const HashTable JSSVGFEOffsetElementPrototypeTable =
 
 const ClassInfo JSSVGFEOffsetElementPrototype::s_info = { "SVGFEOffsetElementPrototype", 0, &JSSVGFEOffsetElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEOffsetElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEOffsetElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEOffsetElement>(exec);
+    return getDOMPrototype<JSSVGFEOffsetElement>(exec, globalObject);
 }
 
 bool JSSVGFEOffsetElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -104,9 +100,9 @@ JSSVGFEOffsetElement::JSSVGFEOffsetElement(PassRefPtr<Structure> structure, Pass
 {
 }
 
-JSObject* JSSVGFEOffsetElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEOffsetElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEOffsetElementPrototype(JSSVGFEOffsetElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEOffsetElementPrototype(JSSVGFEOffsetElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEOffsetElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -114,89 +110,100 @@ bool JSSVGFEOffsetElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGFEOffsetElement, Base>(exec, &JSSVGFEOffsetElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEOffsetElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEOffsetElementDx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementDx(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->dxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEOffsetElementDy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementDy(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->dyAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEOffsetElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEOffsetElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEOffsetElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEOffsetElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEOffsetElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEOffsetElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEOffsetElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEOffsetElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(static_cast<JSSVGFEOffsetElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFEOffsetElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFEOffsetElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFEOffsetElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFEOffsetElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFEOffsetElement* castedThisObj = static_cast<JSSVGFEOffsetElement*>(asObject(thisValue));
     SVGFEOffsetElement* imp = static_cast<SVGFEOffsetElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h
index 32c7af6..0af9898 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEOffsetElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFEOffsetElement_h
 #define JSSVGFEOffsetElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,12 +34,12 @@ class JSSVGFEOffsetElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEOffsetElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEOffsetElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGFEOffsetElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,22 +63,22 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFEOffsetElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFEOffsetElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFEOffsetElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEOffsetElementDx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEOffsetElementDy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEOffsetElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEOffsetElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEOffsetElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEOffsetElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEOffsetElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEOffsetElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEOffsetElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEOffsetElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEOffsetElementDx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEOffsetElementDy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEOffsetElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEOffsetElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEOffsetElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEOffsetElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEOffsetElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEOffsetElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEOffsetElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.cpp
index b9945af..5004762 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGFEPointLightElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGAnimatedNumber.h"
 #include "SVGFEPointLightElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFEPointLightElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFEPointLightElement);
 
 /* Hash table */
 
@@ -71,9 +67,9 @@ static const HashTable JSSVGFEPointLightElementPrototypeTable =
 
 const ClassInfo JSSVGFEPointLightElementPrototype::s_info = { "SVGFEPointLightElementPrototype", 0, &JSSVGFEPointLightElementPrototypeTable, 0 };
 
-JSObject* JSSVGFEPointLightElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFEPointLightElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFEPointLightElement>(exec);
+    return getDOMPrototype<JSSVGFEPointLightElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFEPointLightElement::s_info = { "SVGFEPointLightElement", &JSSVGElement::s_info, &JSSVGFEPointLightElementTable, 0 };
@@ -83,9 +79,9 @@ JSSVGFEPointLightElement::JSSVGFEPointLightElement(PassRefPtr<Structure> structu
 {
 }
 
-JSObject* JSSVGFEPointLightElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFEPointLightElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFEPointLightElementPrototype(JSSVGFEPointLightElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFEPointLightElementPrototype(JSSVGFEPointLightElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFEPointLightElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -93,22 +89,25 @@ bool JSSVGFEPointLightElement::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSSVGFEPointLightElement, Base>(exec, &JSSVGFEPointLightElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFEPointLightElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEPointLightElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEPointLightElement* imp = static_cast<SVGFEPointLightElement*>(static_cast<JSSVGFEPointLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEPointLightElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEPointLightElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEPointLightElement* imp = static_cast<SVGFEPointLightElement*>(static_cast<JSSVGFEPointLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFEPointLightElementZ(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFEPointLightElementZ(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFEPointLightElement* imp = static_cast<SVGFEPointLightElement*>(static_cast<JSSVGFEPointLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->zAnimated();
     return toJS(exec, obj.get(), imp);
@@ -117,4 +116,4 @@ JSValuePtr jsSVGFEPointLightElementZ(ExecState* exec, const Identifier&, const P
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h
index b2fd6ac..bd35675 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFEPointLightElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFEPointLightElement_h
 #define JSSVGFEPointLightElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,12 +34,12 @@ class JSSVGFEPointLightElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFEPointLightElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFEPointLightElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,8 +48,9 @@ public:
 
 
 class JSSVGFEPointLightElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFEPointLightElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -57,12 +58,12 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGFEPointLightElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEPointLightElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFEPointLightElementZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEPointLightElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEPointLightElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFEPointLightElementZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.cpp
index 65c50af..7521e62 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGFESpecularLightingElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -37,14 +33,14 @@
 #include "JSSVGAnimatedNumber.h"
 #include "JSSVGAnimatedString.h"
 #include "SVGFESpecularLightingElement.h"
-
 #include <runtime/Error.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFESpecularLightingElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFESpecularLightingElement);
 
 /* Hash table */
 
@@ -88,9 +84,9 @@ static const HashTable JSSVGFESpecularLightingElementPrototypeTable =
 
 const ClassInfo JSSVGFESpecularLightingElementPrototype::s_info = { "SVGFESpecularLightingElementPrototype", 0, &JSSVGFESpecularLightingElementPrototypeTable, 0 };
 
-JSObject* JSSVGFESpecularLightingElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFESpecularLightingElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFESpecularLightingElement>(exec);
+    return getDOMPrototype<JSSVGFESpecularLightingElement>(exec, globalObject);
 }
 
 bool JSSVGFESpecularLightingElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -105,9 +101,9 @@ JSSVGFESpecularLightingElement::JSSVGFESpecularLightingElement(PassRefPtr<Struct
 {
 }
 
-JSObject* JSSVGFESpecularLightingElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFESpecularLightingElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFESpecularLightingElementPrototype(JSSVGFESpecularLightingElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFESpecularLightingElementPrototype(JSSVGFESpecularLightingElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFESpecularLightingElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -115,96 +111,108 @@ bool JSSVGFESpecularLightingElement::getOwnPropertySlot(ExecState* exec, const I
     return getStaticValueSlot<JSSVGFESpecularLightingElement, Base>(exec, &JSSVGFESpecularLightingElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFESpecularLightingElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpecularLightingElementSurfaceScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementSurfaceScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->surfaceScaleAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpecularLightingElementSpecularConstant(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementSpecularConstant(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->specularConstantAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpecularLightingElementSpecularExponent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementSpecularExponent(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->specularExponentAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpecularLightingElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpecularLightingElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpecularLightingElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpecularLightingElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpecularLightingElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpecularLightingElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpecularLightingElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpecularLightingElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(static_cast<JSSVGFESpecularLightingElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFESpecularLightingElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFESpecularLightingElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFESpecularLightingElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFESpecularLightingElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFESpecularLightingElement* castedThisObj = static_cast<JSSVGFESpecularLightingElement*>(asObject(thisValue));
     SVGFESpecularLightingElement* imp = static_cast<SVGFESpecularLightingElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h
index fba2831..8085629 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpecularLightingElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFESpecularLightingElement_h
 #define JSSVGFESpecularLightingElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,12 +34,12 @@ class JSSVGFESpecularLightingElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFESpecularLightingElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFESpecularLightingElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGFESpecularLightingElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,23 +63,23 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFESpecularLightingElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFESpecularLightingElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFESpecularLightingElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpecularLightingElementSurfaceScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpecularLightingElementSpecularConstant(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpecularLightingElementSpecularExponent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpecularLightingElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpecularLightingElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpecularLightingElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpecularLightingElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpecularLightingElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpecularLightingElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpecularLightingElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpecularLightingElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpecularLightingElementSurfaceScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpecularLightingElementSpecularConstant(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpecularLightingElementSpecularExponent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpecularLightingElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpecularLightingElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpecularLightingElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpecularLightingElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpecularLightingElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpecularLightingElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpecularLightingElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.cpp
index cf23d95..de15407 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGFESpotLightElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGAnimatedNumber.h"
 #include "SVGFESpotLightElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFESpotLightElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFESpotLightElement);
 
 /* Hash table */
 
@@ -76,9 +72,9 @@ static const HashTable JSSVGFESpotLightElementPrototypeTable =
 
 const ClassInfo JSSVGFESpotLightElementPrototype::s_info = { "SVGFESpotLightElementPrototype", 0, &JSSVGFESpotLightElementPrototypeTable, 0 };
 
-JSObject* JSSVGFESpotLightElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFESpotLightElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFESpotLightElement>(exec);
+    return getDOMPrototype<JSSVGFESpotLightElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFESpotLightElement::s_info = { "SVGFESpotLightElement", &JSSVGElement::s_info, &JSSVGFESpotLightElementTable, 0 };
@@ -88,9 +84,9 @@ JSSVGFESpotLightElement::JSSVGFESpotLightElement(PassRefPtr<Structure> structure
 {
 }
 
-JSObject* JSSVGFESpotLightElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFESpotLightElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFESpotLightElementPrototype(JSSVGFESpotLightElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFESpotLightElementPrototype(JSSVGFESpotLightElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFESpotLightElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -98,57 +94,65 @@ bool JSSVGFESpotLightElement::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSSVGFESpotLightElement, Base>(exec, &JSSVGFESpotLightElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFESpotLightElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpotLightElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpotLightElementZ(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementZ(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->zAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpotLightElementPointsAtX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementPointsAtX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->pointsAtXAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpotLightElementPointsAtY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementPointsAtY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->pointsAtYAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpotLightElementPointsAtZ(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementPointsAtZ(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->pointsAtZAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpotLightElementSpecularExponent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementSpecularExponent(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->specularExponentAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFESpotLightElementLimitingConeAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFESpotLightElementLimitingConeAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFESpotLightElement* imp = static_cast<SVGFESpotLightElement*>(static_cast<JSSVGFESpotLightElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->limitingConeAngleAnimated();
     return toJS(exec, obj.get(), imp);
@@ -157,4 +161,4 @@ JSValuePtr jsSVGFESpotLightElementLimitingConeAngle(ExecState* exec, const Ident
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h
index a4fd1c7..8a9d925 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFESpotLightElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFESpotLightElement_h
 #define JSSVGFESpotLightElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,12 +34,12 @@ class JSSVGFESpotLightElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFESpotLightElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFESpotLightElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,8 +48,9 @@ public:
 
 
 class JSSVGFESpotLightElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFESpotLightElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -57,17 +58,17 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGFESpotLightElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpotLightElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpotLightElementZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpotLightElementPointsAtX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpotLightElementPointsAtY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpotLightElementPointsAtZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpotLightElementSpecularExponent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFESpotLightElementLimitingConeAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpotLightElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpotLightElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpotLightElementZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpotLightElementPointsAtX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpotLightElementPointsAtY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpotLightElementPointsAtZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpotLightElementSpecularExponent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFESpotLightElementLimitingConeAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.cpp
index 7f0c248..66b19e8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGFETileElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -36,14 +32,14 @@
 #include "JSSVGAnimatedLength.h"
 #include "JSSVGAnimatedString.h"
 #include "SVGFETileElement.h"
-
 #include <runtime/Error.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFETileElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFETileElement);
 
 /* Hash table */
 
@@ -84,9 +80,9 @@ static const HashTable JSSVGFETileElementPrototypeTable =
 
 const ClassInfo JSSVGFETileElementPrototype::s_info = { "SVGFETileElementPrototype", 0, &JSSVGFETileElementPrototypeTable, 0 };
 
-JSObject* JSSVGFETileElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFETileElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFETileElement>(exec);
+    return getDOMPrototype<JSSVGFETileElement>(exec, globalObject);
 }
 
 bool JSSVGFETileElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -101,9 +97,9 @@ JSSVGFETileElement::JSSVGFETileElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSSVGFETileElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFETileElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFETileElementPrototype(JSSVGFETileElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFETileElementPrototype(JSSVGFETileElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFETileElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -111,75 +107,84 @@ bool JSSVGFETileElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGFETileElement, Base>(exec, &JSSVGFETileElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFETileElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementIn1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->in1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETileElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETileElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETileElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETileElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETileElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETileElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETileElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETileElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(static_cast<JSSVGFETileElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFETileElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFETileElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFETileElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFETileElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFETileElement* castedThisObj = static_cast<JSSVGFETileElement*>(asObject(thisValue));
     SVGFETileElement* imp = static_cast<SVGFETileElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h
index 84d4e66..b31e651 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFETileElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFETileElement_h
 #define JSSVGFETileElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,12 +34,12 @@ class JSSVGFETileElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFETileElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFETileElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGFETileElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,20 +63,20 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFETileElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFETileElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFETileElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETileElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETileElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETileElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETileElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETileElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETileElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETileElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETileElementIn1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETileElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETileElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETileElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETileElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETileElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETileElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETileElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp
index 5a29db1..50369f1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGFETurbulenceElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -39,15 +35,14 @@
 #include "JSSVGAnimatedNumber.h"
 #include "JSSVGAnimatedString.h"
 #include "SVGFETurbulenceElement.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFETurbulenceElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFETurbulenceElement);
 
 /* Hash table */
 
@@ -102,13 +97,13 @@ public:
     JSSVGFETurbulenceElementConstructor(ExecState* exec)
         : DOMObject(JSSVGFETurbulenceElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGFETurbulenceElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGFETurbulenceElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -144,9 +139,9 @@ static const HashTable JSSVGFETurbulenceElementPrototypeTable =
 
 const ClassInfo JSSVGFETurbulenceElementPrototype::s_info = { "SVGFETurbulenceElementPrototype", 0, &JSSVGFETurbulenceElementPrototypeTable, 0 };
 
-JSObject* JSSVGFETurbulenceElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFETurbulenceElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFETurbulenceElement>(exec);
+    return getDOMPrototype<JSSVGFETurbulenceElement>(exec, globalObject);
 }
 
 bool JSSVGFETurbulenceElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -161,9 +156,9 @@ JSSVGFETurbulenceElement::JSSVGFETurbulenceElement(PassRefPtr<Structure> structu
 {
 }
 
-JSObject* JSSVGFETurbulenceElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFETurbulenceElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFETurbulenceElementPrototype(JSSVGFETurbulenceElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFETurbulenceElementPrototype(JSSVGFETurbulenceElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFETurbulenceElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -171,146 +166,160 @@ bool JSSVGFETurbulenceElement::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSSVGFETurbulenceElement, Base>(exec, &JSSVGFETurbulenceElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFETurbulenceElementBaseFrequencyX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementBaseFrequencyX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->baseFrequencyXAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementBaseFrequencyY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementBaseFrequencyY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->baseFrequencyYAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementNumOctaves(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementNumOctaves(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedInteger> obj = imp->numOctavesAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementSeed(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementSeed(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->seedAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementStitchTiles(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementStitchTiles(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->stitchTilesAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->typeAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementResult(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->resultAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFETurbulenceElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGFETurbulenceElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFETurbulenceElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGFETurbulenceElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGFETurbulenceElement::getConstructor(ExecState* exec)
+JSValue JSSVGFETurbulenceElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGFETurbulenceElementConstructor>(exec);
 }
 
-JSValuePtr jsSVGFETurbulenceElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFETurbulenceElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFETurbulenceElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFETurbulenceElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFETurbulenceElement* castedThisObj = static_cast<JSSVGFETurbulenceElement*>(asObject(thisValue));
     SVGFETurbulenceElement* imp = static_cast<SVGFETurbulenceElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_FRACTALNOISE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_FRACTALNOISE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_TURBULENCE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_TURBULENCE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGFETurbulenceElementSVG_STITCHTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGFETurbulenceElementSVG_STITCHTYPE_STITCH(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_STITCH(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGFETurbulenceElementSVG_STITCHTYPE_NOSTITCH(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_NOSTITCH(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
@@ -318,4 +327,4 @@ JSValuePtr jsSVGFETurbulenceElementSVG_STITCHTYPE_NOSTITCH(ExecState* exec, cons
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h
index 6b2ff88..c973954 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFETurbulenceElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFETurbulenceElement_h
 #define JSSVGFETurbulenceElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,27 +34,28 @@ class JSSVGFETurbulenceElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFETurbulenceElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFETurbulenceElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGFETurbulenceElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,34 +64,34 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFETurbulenceElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFETurbulenceElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFETurbulenceElementBaseFrequencyX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementBaseFrequencyY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementNumOctaves(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementSeed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementStitchTiles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementBaseFrequencyX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementBaseFrequencyY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementNumOctaves(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementSeed(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementStitchTiles(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementResult(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_FRACTALNOISE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_TURBULENCE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementSVG_STITCHTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementSVG_STITCHTYPE_STITCH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFETurbulenceElementSVG_STITCHTYPE_NOSTITCH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_FRACTALNOISE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementSVG_TURBULENCE_TYPE_TURBULENCE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_STITCH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFETurbulenceElementSVG_STITCHTYPE_NOSTITCH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.cpp
index 695589b..9a63655 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
-
-#include "SVGElement.h"
 #include "JSSVGFilterElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -40,15 +36,15 @@
 #include "JSSVGAnimatedString.h"
 #include "KURL.h"
 #include "SVGFilterElement.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFilterElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFilterElement);
 
 /* Hash table */
 
@@ -96,9 +92,9 @@ static const HashTable JSSVGFilterElementPrototypeTable =
 
 const ClassInfo JSSVGFilterElementPrototype::s_info = { "SVGFilterElementPrototype", 0, &JSSVGFilterElementPrototypeTable, 0 };
 
-JSObject* JSSVGFilterElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFilterElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFilterElement>(exec);
+    return getDOMPrototype<JSSVGFilterElement>(exec, globalObject);
 }
 
 bool JSSVGFilterElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -113,9 +109,9 @@ JSSVGFilterElement::JSSVGFilterElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSSVGFilterElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFilterElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFilterElementPrototype(JSSVGFilterElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFilterElementPrototype(JSSVGFilterElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGFilterElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -123,145 +119,161 @@ bool JSSVGFilterElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGFilterElement, Base>(exec, &JSSVGFilterElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGFilterElementFilterUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementFilterUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->filterUnitsAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFilterElementPrimitiveUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementPrimitiveUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->primitiveUnitsAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFilterElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFilterElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFilterElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFilterElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFilterElementFilterResX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementFilterResX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedInteger> obj = imp->filterResXAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFilterElementFilterResY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementFilterResY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedInteger> obj = imp->filterResYAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFilterElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFilterElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGFilterElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGFilterElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFilterElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGFilterElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGFilterElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-void JSSVGFilterElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGFilterElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGFilterElement, Base>(exec, propertyName, value, &JSSVGFilterElementTable, this, slot);
 }
 
-void setJSSVGFilterElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGFilterElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGFilterElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGFilterElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(static_cast<JSSVGFilterElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGFilterElementPrototypeFunctionSetFilterRes(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFilterElementPrototypeFunctionSetFilterRes(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFilterElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFilterElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFilterElement* castedThisObj = static_cast<JSSVGFilterElement*>(asObject(thisValue));
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(castedThisObj->impl());
-    unsigned filterResX = args.at(exec, 0)->toInt32(exec);
-    unsigned filterResY = args.at(exec, 1)->toInt32(exec);
+    unsigned filterResX = args.at(0).toInt32(exec);
+    unsigned filterResY = args.at(1).toInt32(exec);
 
     imp->setFilterRes(filterResX, filterResY);
     return jsUndefined();
 }
 
-JSValuePtr jsSVGFilterElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGFilterElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGFilterElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGFilterElement::s_info))
         return throwError(exec, TypeError);
     JSSVGFilterElement* castedThisObj = static_cast<JSSVGFilterElement*>(asObject(thisValue));
     SVGFilterElement* imp = static_cast<SVGFilterElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 
 }
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h
index eb9062b..faa8d3c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFilterElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFilterElement_h
 #define JSSVGFilterElement_h
 
-
-#if ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#if ENABLE(SVG) && ENABLE(FILTERS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGFilterElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFilterElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFilterElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGFilterElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,29 +64,29 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGFilterElementPrototypeFunctionSetFilterRes(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGFilterElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFilterElementPrototypeFunctionSetFilterRes(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGFilterElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGFilterElementFilterUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFilterElementPrimitiveUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFilterElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFilterElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFilterElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFilterElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFilterElementFilterResX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFilterElementFilterResY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFilterElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFilterElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGFilterElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGFilterElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGFilterElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGFilterElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFilterElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGFilterElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementFilterUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementPrimitiveUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementFilterResX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementFilterResY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGFilterElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGFilterElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGFilterElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGFilterElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGFilterElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
-#endif // ENABLE(SVG) && ENABLE(SVG_FILTERS)
+#endif // ENABLE(SVG) && ENABLE(FILTERS)
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.cpp
index 9402314..d66d6b6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FONTS)
 
-#include "SVGElement.h"
 #include "JSSVGFontElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGFontElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFontElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFontElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +49,9 @@ static const HashTable JSSVGFontElementPrototypeTable =
 
 const ClassInfo JSSVGFontElementPrototype::s_info = { "SVGFontElementPrototype", 0, &JSSVGFontElementPrototypeTable, 0 };
 
-JSObject* JSSVGFontElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFontElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFontElement>(exec);
+    return getDOMPrototype<JSSVGFontElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFontElement::s_info = { "SVGFontElement", &JSSVGElement::s_info, 0, 0 };
@@ -65,9 +61,9 @@ JSSVGFontElement::JSSVGFontElement(PassRefPtr<Structure> structure, PassRefPtr<S
 {
 }
 
-JSObject* JSSVGFontElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFontElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFontElementPrototype(JSSVGFontElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFontElementPrototype(JSSVGFontElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.h
index 689377f..4e6dd3b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFontElement_h
 #define JSSVGFontElement_h
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FONTS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,7 +34,7 @@ class JSSVGFontElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFontElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFontElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGFontElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFontElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.cpp
index 87a012f..55633bb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FONTS)
 
-#include "SVGElement.h"
 #include "JSSVGFontFaceElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGFontFaceElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +49,9 @@ static const HashTable JSSVGFontFaceElementPrototypeTable =
 
 const ClassInfo JSSVGFontFaceElementPrototype::s_info = { "SVGFontFaceElementPrototype", 0, &JSSVGFontFaceElementPrototypeTable, 0 };
 
-JSObject* JSSVGFontFaceElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFontFaceElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFontFaceElement>(exec);
+    return getDOMPrototype<JSSVGFontFaceElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFontFaceElement::s_info = { "SVGFontFaceElement", &JSSVGElement::s_info, 0, 0 };
@@ -65,9 +61,9 @@ JSSVGFontFaceElement::JSSVGFontFaceElement(PassRefPtr<Structure> structure, Pass
 {
 }
 
-JSObject* JSSVGFontFaceElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFontFaceElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFontFaceElementPrototype(JSSVGFontFaceElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFontFaceElementPrototype(JSSVGFontFaceElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.h
index 538ea5f..2bae1cf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFontFaceElement_h
 #define JSSVGFontFaceElement_h
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FONTS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,7 +34,7 @@ class JSSVGFontFaceElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFontFaceElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFontFaceElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGFontFaceElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFontFaceElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.cpp
index afac6a9..50708c2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FONTS)
 
-#include "SVGElement.h"
 #include "JSSVGFontFaceFormatElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGFontFaceFormatElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceFormatElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceFormatElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +49,9 @@ static const HashTable JSSVGFontFaceFormatElementPrototypeTable =
 
 const ClassInfo JSSVGFontFaceFormatElementPrototype::s_info = { "SVGFontFaceFormatElementPrototype", 0, &JSSVGFontFaceFormatElementPrototypeTable, 0 };
 
-JSObject* JSSVGFontFaceFormatElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFontFaceFormatElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFontFaceFormatElement>(exec);
+    return getDOMPrototype<JSSVGFontFaceFormatElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFontFaceFormatElement::s_info = { "SVGFontFaceFormatElement", &JSSVGElement::s_info, 0, 0 };
@@ -65,9 +61,9 @@ JSSVGFontFaceFormatElement::JSSVGFontFaceFormatElement(PassRefPtr<Structure> str
 {
 }
 
-JSObject* JSSVGFontFaceFormatElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFontFaceFormatElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFontFaceFormatElementPrototype(JSSVGFontFaceFormatElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFontFaceFormatElementPrototype(JSSVGFontFaceFormatElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.h
index b1d6eb7..e7b9ad8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceFormatElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFontFaceFormatElement_h
 #define JSSVGFontFaceFormatElement_h
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FONTS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,7 +34,7 @@ class JSSVGFontFaceFormatElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFontFaceFormatElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFontFaceFormatElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGFontFaceFormatElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFontFaceFormatElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.cpp
index 3fe3a47..2f12035 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FONTS)
 
-#include "SVGElement.h"
 #include "JSSVGFontFaceNameElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGFontFaceNameElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceNameElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceNameElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +49,9 @@ static const HashTable JSSVGFontFaceNameElementPrototypeTable =
 
 const ClassInfo JSSVGFontFaceNameElementPrototype::s_info = { "SVGFontFaceNameElementPrototype", 0, &JSSVGFontFaceNameElementPrototypeTable, 0 };
 
-JSObject* JSSVGFontFaceNameElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFontFaceNameElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFontFaceNameElement>(exec);
+    return getDOMPrototype<JSSVGFontFaceNameElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFontFaceNameElement::s_info = { "SVGFontFaceNameElement", &JSSVGElement::s_info, 0, 0 };
@@ -65,9 +61,9 @@ JSSVGFontFaceNameElement::JSSVGFontFaceNameElement(PassRefPtr<Structure> structu
 {
 }
 
-JSObject* JSSVGFontFaceNameElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFontFaceNameElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFontFaceNameElementPrototype(JSSVGFontFaceNameElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFontFaceNameElementPrototype(JSSVGFontFaceNameElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.h
index 6a99c74..a334f98 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceNameElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFontFaceNameElement_h
 #define JSSVGFontFaceNameElement_h
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FONTS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,7 +34,7 @@ class JSSVGFontFaceNameElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFontFaceNameElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFontFaceNameElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGFontFaceNameElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFontFaceNameElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.cpp
index 1830d4b..82c6137 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FONTS)
 
-#include "SVGElement.h"
 #include "JSSVGFontFaceSrcElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGFontFaceSrcElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceSrcElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceSrcElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +49,9 @@ static const HashTable JSSVGFontFaceSrcElementPrototypeTable =
 
 const ClassInfo JSSVGFontFaceSrcElementPrototype::s_info = { "SVGFontFaceSrcElementPrototype", 0, &JSSVGFontFaceSrcElementPrototypeTable, 0 };
 
-JSObject* JSSVGFontFaceSrcElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFontFaceSrcElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFontFaceSrcElement>(exec);
+    return getDOMPrototype<JSSVGFontFaceSrcElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFontFaceSrcElement::s_info = { "SVGFontFaceSrcElement", &JSSVGElement::s_info, 0, 0 };
@@ -65,9 +61,9 @@ JSSVGFontFaceSrcElement::JSSVGFontFaceSrcElement(PassRefPtr<Structure> structure
 {
 }
 
-JSObject* JSSVGFontFaceSrcElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFontFaceSrcElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFontFaceSrcElementPrototype(JSSVGFontFaceSrcElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFontFaceSrcElementPrototype(JSSVGFontFaceSrcElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.h
index 4e5c94e..d6852c5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceSrcElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFontFaceSrcElement_h
 #define JSSVGFontFaceSrcElement_h
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FONTS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,7 +34,7 @@ class JSSVGFontFaceSrcElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFontFaceSrcElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFontFaceSrcElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGFontFaceSrcElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFontFaceSrcElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.cpp
index 7490501..32208d8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FONTS)
 
-#include "SVGElement.h"
 #include "JSSVGFontFaceUriElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGFontFaceUriElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceUriElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGFontFaceUriElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +49,9 @@ static const HashTable JSSVGFontFaceUriElementPrototypeTable =
 
 const ClassInfo JSSVGFontFaceUriElementPrototype::s_info = { "SVGFontFaceUriElementPrototype", 0, &JSSVGFontFaceUriElementPrototypeTable, 0 };
 
-JSObject* JSSVGFontFaceUriElementPrototype::self(ExecState* exec)
+JSObject* JSSVGFontFaceUriElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGFontFaceUriElement>(exec);
+    return getDOMPrototype<JSSVGFontFaceUriElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGFontFaceUriElement::s_info = { "SVGFontFaceUriElement", &JSSVGElement::s_info, 0, 0 };
@@ -65,9 +61,9 @@ JSSVGFontFaceUriElement::JSSVGFontFaceUriElement(PassRefPtr<Structure> structure
 {
 }
 
-JSObject* JSSVGFontFaceUriElement::createPrototype(ExecState* exec)
+JSObject* JSSVGFontFaceUriElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGFontFaceUriElementPrototype(JSSVGFontFaceUriElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGFontFaceUriElementPrototype(JSSVGFontFaceUriElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.h
index e402e31..e9b9ec2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGFontFaceUriElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGFontFaceUriElement_h
 #define JSSVGFontFaceUriElement_h
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FONTS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,7 +34,7 @@ class JSSVGFontFaceUriElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGFontFaceUriElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGFontFaceUriElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGFontFaceUriElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGFontFaceUriElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.cpp
index 3e123d1..7bba5bb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FOREIGN_OBJECT)
 
-#include "SVGElement.h"
 #include "JSSVGForeignObjectElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -45,15 +41,15 @@
 #include "SVGElement.h"
 #include "SVGForeignObjectElement.h"
 #include "SVGStringList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGForeignObjectElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGForeignObjectElement);
 
 /* Hash table */
 
@@ -106,9 +102,9 @@ static const HashTable JSSVGForeignObjectElementPrototypeTable =
 
 const ClassInfo JSSVGForeignObjectElementPrototype::s_info = { "SVGForeignObjectElementPrototype", 0, &JSSVGForeignObjectElementPrototypeTable, 0 };
 
-JSObject* JSSVGForeignObjectElementPrototype::self(ExecState* exec)
+JSObject* JSSVGForeignObjectElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGForeignObjectElement>(exec);
+    return getDOMPrototype<JSSVGForeignObjectElement>(exec, globalObject);
 }
 
 bool JSSVGForeignObjectElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -123,9 +119,9 @@ JSSVGForeignObjectElement::JSSVGForeignObjectElement(PassRefPtr<Structure> struc
 {
 }
 
-JSObject* JSSVGForeignObjectElement::createPrototype(ExecState* exec)
+JSObject* JSSVGForeignObjectElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGForeignObjectElementPrototype(JSSVGForeignObjectElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGForeignObjectElementPrototype(JSSVGForeignObjectElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGForeignObjectElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,193 +129,214 @@ bool JSSVGForeignObjectElement::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSSVGForeignObjectElement, Base>(exec, &JSSVGForeignObjectElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGForeignObjectElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGForeignObjectElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGForeignObjectElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGForeignObjectElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGForeignObjectElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGForeignObjectElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGForeignObjectElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGForeignObjectElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGForeignObjectElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGForeignObjectElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGForeignObjectElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGForeignObjectElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGForeignObjectElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGForeignObjectElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGForeignObjectElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGForeignObjectElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGForeignObjectElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGForeignObjectElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGForeignObjectElement, Base>(exec, propertyName, value, &JSSVGForeignObjectElementTable, this, slot);
 }
 
-void setJSSVGForeignObjectElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGForeignObjectElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGForeignObjectElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGForeignObjectElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(static_cast<JSSVGForeignObjectElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGForeignObjectElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGForeignObjectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGForeignObjectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGForeignObjectElement* castedThisObj = static_cast<JSSVGForeignObjectElement*>(asObject(thisValue));
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGForeignObjectElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGForeignObjectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGForeignObjectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGForeignObjectElement* castedThisObj = static_cast<JSSVGForeignObjectElement*>(asObject(thisValue));
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGForeignObjectElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGForeignObjectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGForeignObjectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGForeignObjectElement* castedThisObj = static_cast<JSSVGForeignObjectElement*>(asObject(thisValue));
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGForeignObjectElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGForeignObjectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGForeignObjectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGForeignObjectElement* castedThisObj = static_cast<JSSVGForeignObjectElement*>(asObject(thisValue));
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGForeignObjectElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGForeignObjectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGForeignObjectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGForeignObjectElement* castedThisObj = static_cast<JSSVGForeignObjectElement*>(asObject(thisValue));
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGForeignObjectElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGForeignObjectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGForeignObjectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGForeignObjectElement* castedThisObj = static_cast<JSSVGForeignObjectElement*>(asObject(thisValue));
     SVGForeignObjectElement* imp = static_cast<SVGForeignObjectElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h
index ebae7d6..ad699b6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGForeignObjectElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGForeignObjectElement_h
 #define JSSVGForeignObjectElement_h
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FOREIGN_OBJECT)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGForeignObjectElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGForeignObjectElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGForeignObjectElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGForeignObjectElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,31 +64,31 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGForeignObjectElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGForeignObjectElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGForeignObjectElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGForeignObjectElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGForeignObjectElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGForeignObjectElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGForeignObjectElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGForeignObjectElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGForeignObjectElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGForeignObjectElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGForeignObjectElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGForeignObjectElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGForeignObjectElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGForeignObjectElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGForeignObjectElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGForeignObjectElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGForeignObjectElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGForeignObjectElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.cpp
index 307765b..75a61b6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGGElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -44,15 +40,15 @@
 #include "SVGElement.h"
 #include "SVGGElement.h"
 #include "SVGStringList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGGElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGGElement);
 
 /* Hash table */
 
@@ -101,9 +97,9 @@ static const HashTable JSSVGGElementPrototypeTable =
 
 const ClassInfo JSSVGGElementPrototype::s_info = { "SVGGElementPrototype", 0, &JSSVGGElementPrototypeTable, 0 };
 
-JSObject* JSSVGGElementPrototype::self(ExecState* exec)
+JSObject* JSSVGGElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGGElement>(exec);
+    return getDOMPrototype<JSSVGGElement>(exec, globalObject);
 }
 
 bool JSSVGGElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -118,9 +114,9 @@ JSSVGGElement::JSSVGGElement(PassRefPtr<Structure> structure, PassRefPtr<SVGGEle
 {
 }
 
-JSObject* JSSVGGElement::createPrototype(ExecState* exec)
+JSObject* JSSVGGElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGGElementPrototype(JSSVGGElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGGElementPrototype(JSSVGGElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGGElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,165 +124,182 @@ bool JSSVGGElement::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSSVGGElement, Base>(exec, &JSSVGGElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGGElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGGElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGGElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGGElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGGElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGGElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGGElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGGElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGGElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGGElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGGElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGGElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGGElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGGElement, Base>(exec, propertyName, value, &JSSVGGElementTable, this, slot);
 }
 
-void setJSSVGGElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGGElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGGElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGGElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGGElement* imp = static_cast<SVGGElement*>(static_cast<JSSVGGElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGGElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGGElement* castedThisObj = static_cast<JSSVGGElement*>(asObject(thisValue));
     SVGGElement* imp = static_cast<SVGGElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGGElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGGElement* castedThisObj = static_cast<JSSVGGElement*>(asObject(thisValue));
     SVGGElement* imp = static_cast<SVGGElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGGElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGGElement* castedThisObj = static_cast<JSSVGGElement*>(asObject(thisValue));
     SVGGElement* imp = static_cast<SVGGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGGElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGGElement* castedThisObj = static_cast<JSSVGGElement*>(asObject(thisValue));
     SVGGElement* imp = static_cast<SVGGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGGElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGGElement* castedThisObj = static_cast<JSSVGGElement*>(asObject(thisValue));
     SVGGElement* imp = static_cast<SVGGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGGElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGGElement* castedThisObj = static_cast<JSSVGGElement*>(asObject(thisValue));
     SVGGElement* imp = static_cast<SVGGElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h
index 183cb48..62c9add 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGGElement_h
 #define JSSVGGElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGGElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGGElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGGElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGGElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,27 +64,27 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGGElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGGElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGGElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGGElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGGElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGGElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGGElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGGElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGGElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGGElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGGElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGGElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGGElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGGElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGGElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGGElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.cpp
index 0a33be9..684831f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FONTS)
 
-#include "SVGElement.h"
 #include "JSSVGGlyphElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGGlyphElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGGlyphElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGGlyphElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +49,9 @@ static const HashTable JSSVGGlyphElementPrototypeTable =
 
 const ClassInfo JSSVGGlyphElementPrototype::s_info = { "SVGGlyphElementPrototype", 0, &JSSVGGlyphElementPrototypeTable, 0 };
 
-JSObject* JSSVGGlyphElementPrototype::self(ExecState* exec)
+JSObject* JSSVGGlyphElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGGlyphElement>(exec);
+    return getDOMPrototype<JSSVGGlyphElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGGlyphElement::s_info = { "SVGGlyphElement", &JSSVGElement::s_info, 0, 0 };
@@ -65,9 +61,9 @@ JSSVGGlyphElement::JSSVGGlyphElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSSVGGlyphElement::createPrototype(ExecState* exec)
+JSObject* JSSVGGlyphElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGGlyphElementPrototype(JSSVGGlyphElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGGlyphElementPrototype(JSSVGGlyphElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.h
index 596bd20..36105e1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGlyphElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGGlyphElement_h
 #define JSSVGGlyphElement_h
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FONTS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,7 +34,7 @@ class JSSVGGlyphElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGGlyphElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGGlyphElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGGlyphElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGGlyphElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp
index 30b55ce..1dc75b0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGGradientElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -38,15 +34,14 @@
 #include "JSSVGAnimatedString.h"
 #include "JSSVGAnimatedTransformList.h"
 #include "SVGGradientElement.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGGradientElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGGradientElement);
 
 /* Hash table */
 
@@ -93,13 +88,13 @@ public:
     JSSVGGradientElementConstructor(ExecState* exec)
         : DOMObject(JSSVGGradientElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGGradientElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGGradientElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -133,9 +128,9 @@ static const HashTable JSSVGGradientElementPrototypeTable =
 
 const ClassInfo JSSVGGradientElementPrototype::s_info = { "SVGGradientElementPrototype", 0, &JSSVGGradientElementPrototypeTable, 0 };
 
-JSObject* JSSVGGradientElementPrototype::self(ExecState* exec)
+JSObject* JSSVGGradientElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGGradientElement>(exec);
+    return getDOMPrototype<JSSVGGradientElement>(exec, globalObject);
 }
 
 bool JSSVGGradientElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -150,9 +145,9 @@ JSSVGGradientElement::JSSVGGradientElement(PassRefPtr<Structure> structure, Pass
 {
 }
 
-JSObject* JSSVGGradientElement::createPrototype(ExecState* exec)
+JSObject* JSSVGGradientElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGGradientElementPrototype(JSSVGGradientElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGGradientElementPrototype(JSSVGGradientElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGGradientElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -160,94 +155,102 @@ bool JSSVGGradientElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGGradientElement, Base>(exec, &JSSVGGradientElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGGradientElementGradientUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementGradientUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->gradientUnitsAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGGradientElementGradientTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementGradientTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->gradientTransformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGGradientElementSpreadMethod(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementSpreadMethod(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->spreadMethodAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGGradientElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGGradientElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGGradientElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGGradientElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGGradientElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGGradientElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGGradientElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGGradientElement::getConstructor(ExecState* exec)
+JSValue JSSVGGradientElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGGradientElementConstructor>(exec);
 }
 
-JSValuePtr jsSVGGradientElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGGradientElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGGradientElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGGradientElement::s_info))
         return throwError(exec, TypeError);
     JSSVGGradientElement* castedThisObj = static_cast<JSSVGGradientElement*>(asObject(thisValue));
     SVGGradientElement* imp = static_cast<SVGGradientElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsSVGGradientElementSVG_SPREADMETHOD_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGGradientElementSVG_SPREADMETHOD_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGGradientElementSVG_SPREADMETHOD_PAD(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGGradientElementSVG_SPREADMETHOD_PAD(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGGradientElementSVG_SPREADMETHOD_REFLECT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGGradientElementSVG_SPREADMETHOD_REFLECT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGGradientElementSVG_SPREADMETHOD_REPEAT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGGradientElementSVG_SPREADMETHOD_REPEAT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h
index 728c257..11646e7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGGradientElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGGradientElement_h
 #define JSSVGGradientElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,27 +34,28 @@ class JSSVGGradientElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGGradientElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGGradientElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGGradientElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,23 +64,23 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGGradientElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGGradientElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGGradientElementGradientUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGradientElementGradientTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGradientElementSpreadMethod(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGradientElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGradientElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGradientElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGradientElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGradientElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementGradientUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementGradientTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementSpreadMethod(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGGradientElementSVG_SPREADMETHOD_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGradientElementSVG_SPREADMETHOD_PAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGradientElementSVG_SPREADMETHOD_REFLECT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGGradientElementSVG_SPREADMETHOD_REPEAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementSVG_SPREADMETHOD_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementSVG_SPREADMETHOD_PAD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementSVG_SPREADMETHOD_REFLECT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGGradientElementSVG_SPREADMETHOD_REPEAT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.cpp
index d555c22..87c1fe8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FONTS)
 
-#include "SVGElement.h"
 #include "JSSVGHKernElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGHKernElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGHKernElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGHKernElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +49,9 @@ static const HashTable JSSVGHKernElementPrototypeTable =
 
 const ClassInfo JSSVGHKernElementPrototype::s_info = { "SVGHKernElementPrototype", 0, &JSSVGHKernElementPrototypeTable, 0 };
 
-JSObject* JSSVGHKernElementPrototype::self(ExecState* exec)
+JSObject* JSSVGHKernElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGHKernElement>(exec);
+    return getDOMPrototype<JSSVGHKernElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGHKernElement::s_info = { "SVGHKernElement", &JSSVGElement::s_info, 0, 0 };
@@ -65,9 +61,9 @@ JSSVGHKernElement::JSSVGHKernElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSSVGHKernElement::createPrototype(ExecState* exec)
+JSObject* JSSVGHKernElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGHKernElementPrototype(JSSVGHKernElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGHKernElementPrototype(JSSVGHKernElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.h
index a8bde93..7718ecf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGHKernElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGHKernElement_h
 #define JSSVGHKernElement_h
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FONTS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,7 +34,7 @@ class JSSVGHKernElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGHKernElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGHKernElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGHKernElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGHKernElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.cpp
index 74c2ebd..4f6f84f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGImageElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -46,15 +42,15 @@
 #include "SVGElement.h"
 #include "SVGImageElement.h"
 #include "SVGStringList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGImageElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGImageElement);
 
 /* Hash table */
 
@@ -109,9 +105,9 @@ static const HashTable JSSVGImageElementPrototypeTable =
 
 const ClassInfo JSSVGImageElementPrototype::s_info = { "SVGImageElementPrototype", 0, &JSSVGImageElementPrototypeTable, 0 };
 
-JSObject* JSSVGImageElementPrototype::self(ExecState* exec)
+JSObject* JSSVGImageElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGImageElement>(exec);
+    return getDOMPrototype<JSSVGImageElement>(exec, globalObject);
 }
 
 bool JSSVGImageElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -126,9 +122,9 @@ JSSVGImageElement::JSSVGImageElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSSVGImageElement::createPrototype(ExecState* exec)
+JSObject* JSSVGImageElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGImageElementPrototype(JSSVGImageElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGImageElementPrototype(JSSVGImageElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGImageElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -136,207 +132,230 @@ bool JSSVGImageElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSSVGImageElement, Base>(exec, &JSSVGImageElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGImageElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGImageElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGImageElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGImageElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGImageElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedPreserveAspectRatio> obj = imp->preserveAspectRatioAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGImageElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGImageElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGImageElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGImageElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGImageElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGImageElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGImageElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGImageElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGImageElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGImageElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGImageElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGImageElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGImageElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGImageElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGImageElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGImageElement, Base>(exec, propertyName, value, &JSSVGImageElementTable, this, slot);
 }
 
-void setJSSVGImageElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGImageElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGImageElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGImageElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGImageElement* imp = static_cast<SVGImageElement*>(static_cast<JSSVGImageElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGImageElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGImageElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGImageElement::s_info))
         return throwError(exec, TypeError);
     JSSVGImageElement* castedThisObj = static_cast<JSSVGImageElement*>(asObject(thisValue));
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGImageElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGImageElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGImageElement::s_info))
         return throwError(exec, TypeError);
     JSSVGImageElement* castedThisObj = static_cast<JSSVGImageElement*>(asObject(thisValue));
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGImageElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGImageElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGImageElement::s_info))
         return throwError(exec, TypeError);
     JSSVGImageElement* castedThisObj = static_cast<JSSVGImageElement*>(asObject(thisValue));
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGImageElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGImageElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGImageElement::s_info))
         return throwError(exec, TypeError);
     JSSVGImageElement* castedThisObj = static_cast<JSSVGImageElement*>(asObject(thisValue));
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGImageElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGImageElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGImageElement::s_info))
         return throwError(exec, TypeError);
     JSSVGImageElement* castedThisObj = static_cast<JSSVGImageElement*>(asObject(thisValue));
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGImageElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGImageElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGImageElement::s_info))
         return throwError(exec, TypeError);
     JSSVGImageElement* castedThisObj = static_cast<JSSVGImageElement*>(asObject(thisValue));
     SVGImageElement* imp = static_cast<SVGImageElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h
index 9600ac1..17dbffb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGImageElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGImageElement_h
 #define JSSVGImageElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGImageElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGImageElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGImageElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGImageElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,33 +64,33 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGImageElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGImageElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGImageElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGImageElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGImageElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGImageElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGImageElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGImageElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGImageElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGImageElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGImageElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGImageElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGImageElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGImageElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGImageElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGImageElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGImageElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGImageElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp
index 2c494b0..7e86524 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.cpp
@@ -20,26 +20,22 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGLength.h"
 
-#include <wtf/GetPtr.h>
-
 #include "KURL.h"
 #include "SVGLength.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGLength)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGLength);
 
 /* Hash table */
 
@@ -90,13 +86,13 @@ public:
     JSSVGLengthConstructor(ExecState* exec)
         : DOMObject(JSSVGLengthConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGLengthPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGLengthPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -138,9 +134,9 @@ static const HashTable JSSVGLengthPrototypeTable =
 
 const ClassInfo JSSVGLengthPrototype::s_info = { "SVGLengthPrototype", 0, &JSSVGLengthPrototypeTable, 0 };
 
-JSObject* JSSVGLengthPrototype::self(ExecState* exec)
+JSObject* JSSVGLengthPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGLength>(exec);
+    return getDOMPrototype<JSSVGLength>(exec, globalObject);
 }
 
 bool JSSVGLengthPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -161,12 +157,11 @@ JSSVGLength::~JSSVGLength()
 {
     JSSVGDynamicPODTypeWrapperCache<SVGLength, SVGAnimatedLength>::forgetWrapper(m_impl.get());
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGLength::createPrototype(ExecState* exec)
+JSObject* JSSVGLength::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGLengthPrototype(JSSVGLengthPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGLengthPrototype(JSSVGLengthPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGLength::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -174,82 +169,87 @@ bool JSSVGLength::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSSVGLength, Base>(exec, &JSSVGLengthTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGLengthUnitType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLengthUnitType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLength imp(*static_cast<JSSVGLength*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.unitType());
 }
 
-JSValuePtr jsSVGLengthValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLengthValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGLength*>(asObject(slot.slotBase()))->value(exec);
 }
 
-JSValuePtr jsSVGLengthValueInSpecifiedUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLengthValueInSpecifiedUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLength imp(*static_cast<JSSVGLength*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.valueInSpecifiedUnits());
 }
 
-JSValuePtr jsSVGLengthValueAsString(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLengthValueAsString(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLength imp(*static_cast<JSSVGLength*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp.valueAsString());
 }
 
-JSValuePtr jsSVGLengthConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLengthConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGLength*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSSVGLength::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGLength::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGLength, Base>(exec, propertyName, value, &JSSVGLengthTable, this, slot);
 }
 
-void setJSSVGLengthValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGLengthValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGLength imp(*static_cast<JSSVGLength*>(thisObject)->impl());
-    imp.setValue(value->toFloat(exec));
+    imp.setValue(value.toFloat(exec));
         static_cast<JSSVGLength*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGLength*>(thisObject)->context());
 }
 
-void setJSSVGLengthValueInSpecifiedUnits(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGLengthValueInSpecifiedUnits(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGLength imp(*static_cast<JSSVGLength*>(thisObject)->impl());
-    imp.setValueInSpecifiedUnits(value->toFloat(exec));
+    imp.setValueInSpecifiedUnits(value.toFloat(exec));
         static_cast<JSSVGLength*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGLength*>(thisObject)->context());
 }
 
-void setJSSVGLengthValueAsString(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGLengthValueAsString(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGLength imp(*static_cast<JSSVGLength*>(thisObject)->impl());
     imp.setValueAsString(valueToStringWithNullCheck(exec, value));
         static_cast<JSSVGLength*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGLength*>(thisObject)->context());
 }
 
-JSValuePtr JSSVGLength::getConstructor(ExecState* exec)
+JSValue JSSVGLength::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGLengthConstructor>(exec);
 }
 
-JSValuePtr jsSVGLengthPrototypeFunctionNewValueSpecifiedUnits(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLengthPrototypeFunctionNewValueSpecifiedUnits(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLength::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLength::s_info))
         return throwError(exec, TypeError);
     JSSVGLength* castedThisObj = static_cast<JSSVGLength*>(asObject(thisValue));
     JSSVGPODTypeWrapper<SVGLength>* wrapper = castedThisObj->impl();
     SVGLength imp(*wrapper);
-    unsigned short unitType = args.at(exec, 0)->toInt32(exec);
-    float valueInSpecifiedUnits = args.at(exec, 1)->toFloat(exec);
+    unsigned short unitType = args.at(0).toInt32(exec);
+    float valueInSpecifiedUnits = args.at(1).toFloat(exec);
 
     imp.newValueSpecifiedUnits(unitType, valueInSpecifiedUnits);
     wrapper->commitChange(imp, castedThisObj->context());
     return jsUndefined();
 }
 
-JSValuePtr jsSVGLengthPrototypeFunctionConvertToSpecifiedUnits(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLengthPrototypeFunctionConvertToSpecifiedUnits(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLength::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLength::s_info))
         return throwError(exec, TypeError);
     JSSVGLength* castedThisObj = static_cast<JSSVGLength*>(asObject(thisValue));
     return castedThisObj->convertToSpecifiedUnits(exec, args);
@@ -257,68 +257,68 @@ JSValuePtr jsSVGLengthPrototypeFunctionConvertToSpecifiedUnits(ExecState* exec,
 
 // Constant getters
 
-JSValuePtr jsSVGLengthSVG_LENGTHTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGLengthSVG_LENGTHTYPE_NUMBER(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_NUMBER(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGLengthSVG_LENGTHTYPE_PERCENTAGE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_PERCENTAGE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGLengthSVG_LENGTHTYPE_EMS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_EMS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsSVGLengthSVG_LENGTHTYPE_EXS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_EXS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsSVGLengthSVG_LENGTHTYPE_PX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_PX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValuePtr jsSVGLengthSVG_LENGTHTYPE_CM(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_CM(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValuePtr jsSVGLengthSVG_LENGTHTYPE_MM(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_MM(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValuePtr jsSVGLengthSVG_LENGTHTYPE_IN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_IN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValuePtr jsSVGLengthSVG_LENGTHTYPE_PT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_PT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSValuePtr jsSVGLengthSVG_LENGTHTYPE_PC(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGLengthSVG_LENGTHTYPE_PC(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(10));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<SVGLength>* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<SVGLength>* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGLength, JSSVGPODTypeWrapper<SVGLength> >(exec, object, context);
 }
-SVGLength toSVGLength(JSC::JSValuePtr value)
+SVGLength toSVGLength(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGLength::s_info) ? (SVGLength) *static_cast<JSSVGLength*>(asObject(value))->impl() : SVGLength();
+    return value.isObject(&JSSVGLength::s_info) ? (SVGLength) *static_cast<JSSVGLength*>(asObject(value))->impl() : SVGLength();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h
index 167ca56..50ea7ce 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLength.h
@@ -21,14 +21,14 @@
 #ifndef JSSVGLength_h
 #define JSSVGLength_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "JSSVGPODTypeWrapper.h"
+#include "SVGElement.h"
+#include "SVGLength.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
-#include "SVGLength.h"
-#include "JSSVGPODTypeWrapper.h"
 
 namespace WebCore {
 
@@ -37,24 +37,24 @@ class JSSVGLength : public DOMObject {
 public:
     JSSVGLength(PassRefPtr<JSC::Structure>, PassRefPtr<JSSVGPODTypeWrapper<SVGLength> >, SVGElement* context);
     virtual ~JSSVGLength();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom attributes
-    JSC::JSValuePtr value(JSC::ExecState*) const;
+    JSC::JSValue value(JSC::ExecState*) const;
 
     // Custom functions
-    JSC::JSValuePtr convertToSpecifiedUnits(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue convertToSpecifiedUnits(JSC::ExecState*, const JSC::ArgList&);
     JSSVGPODTypeWrapper<SVGLength>* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -63,16 +63,17 @@ private:
     RefPtr<JSSVGPODTypeWrapper<SVGLength> > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, JSSVGPODTypeWrapper<SVGLength>*, SVGElement* context);
-SVGLength toSVGLength(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, JSSVGPODTypeWrapper<SVGLength>*, SVGElement* context);
+SVGLength toSVGLength(JSC::JSValue);
 
 class JSSVGLengthPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -81,31 +82,31 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGLengthPrototypeFunctionNewValueSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLengthPrototypeFunctionConvertToSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLengthPrototypeFunctionNewValueSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLengthPrototypeFunctionConvertToSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGLengthUnitType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLengthValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGLengthValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGLengthValueInSpecifiedUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGLengthValueInSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGLengthValueAsString(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGLengthValueAsString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGLengthConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthUnitType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGLengthValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGLengthValueInSpecifiedUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGLengthValueInSpecifiedUnits(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGLengthValueAsString(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGLengthValueAsString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGLengthConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGLengthSVG_LENGTHTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLengthSVG_LENGTHTYPE_NUMBER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLengthSVG_LENGTHTYPE_PERCENTAGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLengthSVG_LENGTHTYPE_EMS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLengthSVG_LENGTHTYPE_EXS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLengthSVG_LENGTHTYPE_PX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLengthSVG_LENGTHTYPE_CM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLengthSVG_LENGTHTYPE_MM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLengthSVG_LENGTHTYPE_IN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLengthSVG_LENGTHTYPE_PT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLengthSVG_LENGTHTYPE_PC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_NUMBER(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_PERCENTAGE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_EMS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_EXS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_PX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_CM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_MM(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_IN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_PT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthSVG_LENGTHTYPE_PC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.cpp
index 6dc9a6a..9283d38 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.cpp
@@ -20,26 +20,22 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGLengthList.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGLength.h"
 #include "SVGLength.h"
 #include "SVGLengthList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGLengthList)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGLengthList);
 
 /* Hash table */
 
@@ -79,9 +75,9 @@ static const HashTable JSSVGLengthListPrototypeTable =
 
 const ClassInfo JSSVGLengthListPrototype::s_info = { "SVGLengthListPrototype", 0, &JSSVGLengthListPrototypeTable, 0 };
 
-JSObject* JSSVGLengthListPrototype::self(ExecState* exec)
+JSObject* JSSVGLengthListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGLengthList>(exec);
+    return getDOMPrototype<JSSVGLengthList>(exec, globalObject);
 }
 
 bool JSSVGLengthListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -101,12 +97,11 @@ JSSVGLengthList::JSSVGLengthList(PassRefPtr<Structure> structure, PassRefPtr<SVG
 JSSVGLengthList::~JSSVGLengthList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGLengthList::createPrototype(ExecState* exec)
+JSObject* JSSVGLengthList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGLengthListPrototype(JSSVGLengthListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGLengthListPrototype(JSSVGLengthListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGLengthList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -114,15 +109,17 @@ bool JSSVGLengthList::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSSVGLengthList, Base>(exec, &JSSVGLengthListTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGLengthListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLengthListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLengthList* imp = static_cast<SVGLengthList*>(static_cast<JSSVGLengthList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->numberOfItems());
 }
 
-JSValuePtr jsSVGLengthListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLengthList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
     SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
@@ -133,105 +130,111 @@ JSValuePtr jsSVGLengthListPrototypeFunctionClear(ExecState* exec, JSObject*, JSV
     return jsUndefined();
 }
 
-JSValuePtr jsSVGLengthListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLengthList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
     SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGLength item = toSVGLength(args.at(exec, 0));
+    SVGLength item = toSVGLength(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->initialize(item, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->initialize(item, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGLengthListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLengthList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
     SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->getItem(index, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->getItem(index, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGLengthListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLengthList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
     SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGLength item = toSVGLength(args.at(exec, 0));
-    unsigned index = args.at(exec, 1)->toInt32(exec);
+    SVGLength item = toSVGLength(args.at(0));
+    unsigned index = args.at(1).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->insertItemBefore(item, index, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->insertItemBefore(item, index, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGLengthListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLengthList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
     SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGLength item = toSVGLength(args.at(exec, 0));
-    unsigned index = args.at(exec, 1)->toInt32(exec);
+    SVGLength item = toSVGLength(args.at(0));
+    unsigned index = args.at(1).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->replaceItem(item, index, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->replaceItem(item, index, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGLengthListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLengthList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
     SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->removeItem(index, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->removeItem(index, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGLengthListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLengthList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLengthList::s_info))
         return throwError(exec, TypeError);
     JSSVGLengthList* castedThisObj = static_cast<JSSVGLengthList*>(asObject(thisValue));
     SVGLengthList* imp = static_cast<SVGLengthList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGLength item = toSVGLength(args.at(exec, 0));
+    SVGLength item = toSVGLength(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->appendItem(item, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->appendItem(item, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGLengthList* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGLengthList* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGLengthList>(exec, object, context);
 }
-SVGLengthList* toSVGLengthList(JSC::JSValuePtr value)
+SVGLengthList* toSVGLengthList(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGLengthList::s_info) ? static_cast<JSSVGLengthList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGLengthList::s_info) ? static_cast<JSSVGLengthList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h
index 0a1c4f7..1345203 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLengthList.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGLengthList_h
 #define JSSVGLengthList_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -37,12 +37,12 @@ class JSSVGLengthList : public DOMObject {
 public:
     JSSVGLengthList(PassRefPtr<JSC::Structure>, PassRefPtr<SVGLengthList>, SVGElement* context);
     virtual ~JSSVGLengthList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -55,16 +55,17 @@ private:
     RefPtr<SVGLengthList > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGLengthList*, SVGElement* context);
-SVGLengthList* toSVGLengthList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGLengthList*, SVGElement* context);
+SVGLengthList* toSVGLengthList(JSC::JSValue);
 
 class JSSVGLengthListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -73,16 +74,16 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGLengthListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLengthListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLengthListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLengthListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLengthListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLengthListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLengthListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLengthListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGLengthListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLengthListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.cpp
index 1116d77..62e72c5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGLineElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -45,15 +41,15 @@
 #include "SVGElement.h"
 #include "SVGLineElement.h"
 #include "SVGStringList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGLineElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGLineElement);
 
 /* Hash table */
 
@@ -106,9 +102,9 @@ static const HashTable JSSVGLineElementPrototypeTable =
 
 const ClassInfo JSSVGLineElementPrototype::s_info = { "SVGLineElementPrototype", 0, &JSSVGLineElementPrototypeTable, 0 };
 
-JSObject* JSSVGLineElementPrototype::self(ExecState* exec)
+JSObject* JSSVGLineElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGLineElement>(exec);
+    return getDOMPrototype<JSSVGLineElement>(exec, globalObject);
 }
 
 bool JSSVGLineElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -123,9 +119,9 @@ JSSVGLineElement::JSSVGLineElement(PassRefPtr<Structure> structure, PassRefPtr<S
 {
 }
 
-JSObject* JSSVGLineElement::createPrototype(ExecState* exec)
+JSObject* JSSVGLineElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGLineElementPrototype(JSSVGLineElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGLineElementPrototype(JSSVGLineElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGLineElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,193 +129,214 @@ bool JSSVGLineElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGLineElement, Base>(exec, &JSSVGLineElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGLineElementX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->x1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGLineElementY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->y1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGLineElementX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->x2Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGLineElementY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->y2Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGLineElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGLineElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGLineElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGLineElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGLineElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGLineElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGLineElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGLineElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGLineElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGLineElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGLineElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLineElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGLineElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGLineElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGLineElement, Base>(exec, propertyName, value, &JSSVGLineElementTable, this, slot);
 }
 
-void setJSSVGLineElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGLineElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGLineElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGLineElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGLineElement* imp = static_cast<SVGLineElement*>(static_cast<JSSVGLineElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGLineElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGLineElement* castedThisObj = static_cast<JSSVGLineElement*>(asObject(thisValue));
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGLineElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGLineElement* castedThisObj = static_cast<JSSVGLineElement*>(asObject(thisValue));
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGLineElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGLineElement* castedThisObj = static_cast<JSSVGLineElement*>(asObject(thisValue));
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGLineElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGLineElement* castedThisObj = static_cast<JSSVGLineElement*>(asObject(thisValue));
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGLineElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGLineElement* castedThisObj = static_cast<JSSVGLineElement*>(asObject(thisValue));
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGLineElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGLineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGLineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGLineElement* castedThisObj = static_cast<JSSVGLineElement*>(asObject(thisValue));
     SVGLineElement* imp = static_cast<SVGLineElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h
index 62df2b8..bcdee6f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLineElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGLineElement_h
 #define JSSVGLineElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGLineElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGLineElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGLineElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGLineElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,31 +64,31 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGLineElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLineElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLineElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLineElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLineElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGLineElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGLineElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGLineElementX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGLineElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGLineElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGLineElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGLineElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLineElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGLineElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGLineElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGLineElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGLineElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLineElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.cpp
index c471ee5..4e0c48a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGLinearGradientElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGAnimatedLength.h"
 #include "SVGLinearGradientElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGLinearGradientElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGLinearGradientElement);
 
 /* Hash table */
 
@@ -72,9 +68,9 @@ static const HashTable JSSVGLinearGradientElementPrototypeTable =
 
 const ClassInfo JSSVGLinearGradientElementPrototype::s_info = { "SVGLinearGradientElementPrototype", 0, &JSSVGLinearGradientElementPrototypeTable, 0 };
 
-JSObject* JSSVGLinearGradientElementPrototype::self(ExecState* exec)
+JSObject* JSSVGLinearGradientElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGLinearGradientElement>(exec);
+    return getDOMPrototype<JSSVGLinearGradientElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGLinearGradientElement::s_info = { "SVGLinearGradientElement", &JSSVGGradientElement::s_info, &JSSVGLinearGradientElementTable, 0 };
@@ -84,9 +80,9 @@ JSSVGLinearGradientElement::JSSVGLinearGradientElement(PassRefPtr<Structure> str
 {
 }
 
-JSObject* JSSVGLinearGradientElement::createPrototype(ExecState* exec)
+JSObject* JSSVGLinearGradientElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGLinearGradientElementPrototype(JSSVGLinearGradientElementPrototype::createStructure(JSSVGGradientElementPrototype::self(exec)));
+    return new (exec) JSSVGLinearGradientElementPrototype(JSSVGLinearGradientElementPrototype::createStructure(JSSVGGradientElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGLinearGradientElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -94,29 +90,33 @@ bool JSSVGLinearGradientElement::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSSVGLinearGradientElement, Base>(exec, &JSSVGLinearGradientElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGLinearGradientElementX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLinearGradientElementX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLinearGradientElement* imp = static_cast<SVGLinearGradientElement*>(static_cast<JSSVGLinearGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->x1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGLinearGradientElementY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLinearGradientElementY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLinearGradientElement* imp = static_cast<SVGLinearGradientElement*>(static_cast<JSSVGLinearGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->y1Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGLinearGradientElementX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLinearGradientElementX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLinearGradientElement* imp = static_cast<SVGLinearGradientElement*>(static_cast<JSSVGLinearGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->x2Animated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGLinearGradientElementY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGLinearGradientElementY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGLinearGradientElement* imp = static_cast<SVGLinearGradientElement*>(static_cast<JSSVGLinearGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->y2Animated();
     return toJS(exec, obj.get(), imp);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h
index 95a0a5c..e05e515 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGLinearGradientElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGLinearGradientElement_h
 #define JSSVGLinearGradientElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGGradientElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,12 +34,12 @@ class JSSVGLinearGradientElement : public JSSVGGradientElement {
     typedef JSSVGGradientElement Base;
 public:
     JSSVGLinearGradientElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGLinearGradientElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,8 +48,9 @@ public:
 
 
 class JSSVGLinearGradientElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGLinearGradientElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -57,10 +58,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGLinearGradientElementX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLinearGradientElementY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLinearGradientElementX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGLinearGradientElementY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLinearGradientElementX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLinearGradientElementY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLinearGradientElementX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGLinearGradientElementY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp
index f707924..afaf538 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGMarkerElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -43,16 +39,15 @@
 #include "JSSVGAnimatedString.h"
 #include "KURL.h"
 #include "SVGMarkerElement.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGMarkerElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGMarkerElement);
 
 /* Hash table */
 
@@ -108,13 +103,13 @@ public:
     JSSVGMarkerElementConstructor(ExecState* exec)
         : DOMObject(JSSVGMarkerElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGMarkerElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGMarkerElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -152,9 +147,9 @@ static const HashTable JSSVGMarkerElementPrototypeTable =
 
 const ClassInfo JSSVGMarkerElementPrototype::s_info = { "SVGMarkerElementPrototype", 0, &JSSVGMarkerElementPrototypeTable, 0 };
 
-JSObject* JSSVGMarkerElementPrototype::self(ExecState* exec)
+JSObject* JSSVGMarkerElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGMarkerElement>(exec);
+    return getDOMPrototype<JSSVGMarkerElement>(exec, globalObject);
 }
 
 bool JSSVGMarkerElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -169,9 +164,9 @@ JSSVGMarkerElement::JSSVGMarkerElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSSVGMarkerElement::createPrototype(ExecState* exec)
+JSObject* JSSVGMarkerElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGMarkerElementPrototype(JSSVGMarkerElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGMarkerElementPrototype(JSSVGMarkerElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGMarkerElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -179,130 +174,145 @@ bool JSSVGMarkerElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGMarkerElement, Base>(exec, &JSSVGMarkerElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGMarkerElementRefX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementRefX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->refXAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMarkerElementRefY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementRefY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->refYAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMarkerElementMarkerUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementMarkerUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->markerUnitsAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMarkerElementMarkerWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementMarkerWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->markerWidthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMarkerElementMarkerHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementMarkerHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->markerHeightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMarkerElementOrientType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementOrientType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->orientTypeAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMarkerElementOrientAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementOrientAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedAngle> obj = imp->orientAngleAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMarkerElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGMarkerElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGMarkerElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMarkerElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMarkerElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGMarkerElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedRect> obj = imp->viewBoxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMarkerElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedPreserveAspectRatio> obj = imp->preserveAspectRatioAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMarkerElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMarkerElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGMarkerElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSSVGMarkerElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGMarkerElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGMarkerElement, Base>(exec, propertyName, value, &JSSVGMarkerElementTable, this, slot);
 }
 
-void setJSSVGMarkerElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGMarkerElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGMarkerElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGMarkerElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(static_cast<JSSVGMarkerElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr JSSVGMarkerElement::getConstructor(ExecState* exec)
+JSValue JSSVGMarkerElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGMarkerElementConstructor>(exec);
 }
 
-JSValuePtr jsSVGMarkerElementPrototypeFunctionSetOrientToAuto(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMarkerElementPrototypeFunctionSetOrientToAuto(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMarkerElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMarkerElement::s_info))
         return throwError(exec, TypeError);
     JSSVGMarkerElement* castedThisObj = static_cast<JSSVGMarkerElement*>(asObject(thisValue));
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThisObj->impl());
@@ -311,59 +321,61 @@ JSValuePtr jsSVGMarkerElementPrototypeFunctionSetOrientToAuto(ExecState* exec, J
     return jsUndefined();
 }
 
-JSValuePtr jsSVGMarkerElementPrototypeFunctionSetOrientToAngle(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMarkerElementPrototypeFunctionSetOrientToAngle(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMarkerElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMarkerElement::s_info))
         return throwError(exec, TypeError);
     JSSVGMarkerElement* castedThisObj = static_cast<JSSVGMarkerElement*>(asObject(thisValue));
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThisObj->impl());
-    SVGAngle* angle = toSVGAngle(args.at(exec, 0));
+    SVGAngle* angle = toSVGAngle(args.at(0));
 
     imp->setOrientToAngle(angle);
     return jsUndefined();
 }
 
-JSValuePtr jsSVGMarkerElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMarkerElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMarkerElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMarkerElement::s_info))
         return throwError(exec, TypeError);
     JSSVGMarkerElement* castedThisObj = static_cast<JSSVGMarkerElement*>(asObject(thisValue));
     SVGMarkerElement* imp = static_cast<SVGMarkerElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsSVGMarkerElementSVG_MARKERUNITS_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGMarkerElementSVG_MARKERUNITS_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGMarkerElementSVG_MARKERUNITS_USERSPACEONUSE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGMarkerElementSVG_MARKERUNITS_USERSPACEONUSE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGMarkerElementSVG_MARKERUNITS_STROKEWIDTH(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGMarkerElementSVG_MARKERUNITS_STROKEWIDTH(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGMarkerElementSVG_MARKER_ORIENT_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGMarkerElementSVG_MARKER_ORIENT_AUTO(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_AUTO(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGMarkerElementSVG_MARKER_ORIENT_ANGLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_ANGLE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h
index 9bdd93d..bf626c7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMarkerElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGMarkerElement_h
 #define JSSVGMarkerElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,28 +34,29 @@ class JSSVGMarkerElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGMarkerElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGMarkerElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGMarkerElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -64,36 +65,36 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGMarkerElementPrototypeFunctionSetOrientToAuto(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMarkerElementPrototypeFunctionSetOrientToAngle(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMarkerElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMarkerElementPrototypeFunctionSetOrientToAuto(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMarkerElementPrototypeFunctionSetOrientToAngle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMarkerElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGMarkerElementRefX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementRefY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementMarkerUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementMarkerWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementMarkerHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementOrientType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementOrientAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGMarkerElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGMarkerElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGMarkerElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGMarkerElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementRefX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementRefY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementMarkerUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementMarkerWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementMarkerHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementOrientType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementOrientAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGMarkerElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGMarkerElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGMarkerElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGMarkerElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGMarkerElementSVG_MARKERUNITS_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementSVG_MARKERUNITS_USERSPACEONUSE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementSVG_MARKERUNITS_STROKEWIDTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementSVG_MARKER_ORIENT_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementSVG_MARKER_ORIENT_AUTO(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMarkerElementSVG_MARKER_ORIENT_ANGLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementSVG_MARKERUNITS_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementSVG_MARKERUNITS_USERSPACEONUSE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementSVG_MARKERUNITS_STROKEWIDTH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_AUTO(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMarkerElementSVG_MARKER_ORIENT_ANGLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.cpp
index 2ac2f2e..d6e2a33 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGMaskElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -41,15 +37,15 @@
 #include "KURL.h"
 #include "SVGMaskElement.h"
 #include "SVGStringList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGMaskElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGMaskElement);
 
 /* Hash table */
 
@@ -97,9 +93,9 @@ static const HashTable JSSVGMaskElementPrototypeTable =
 
 const ClassInfo JSSVGMaskElementPrototype::s_info = { "SVGMaskElementPrototype", 0, &JSSVGMaskElementPrototypeTable, 0 };
 
-JSObject* JSSVGMaskElementPrototype::self(ExecState* exec)
+JSObject* JSSVGMaskElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGMaskElement>(exec);
+    return getDOMPrototype<JSSVGMaskElement>(exec, globalObject);
 }
 
 bool JSSVGMaskElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -114,9 +110,9 @@ JSSVGMaskElement::JSSVGMaskElement(PassRefPtr<Structure> structure, PassRefPtr<S
 {
 }
 
-JSObject* JSSVGMaskElement::createPrototype(ExecState* exec)
+JSObject* JSSVGMaskElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGMaskElementPrototype(JSSVGMaskElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGMaskElementPrototype(JSSVGMaskElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGMaskElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -124,138 +120,154 @@ bool JSSVGMaskElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGMaskElement, Base>(exec, &JSSVGMaskElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGMaskElementMaskUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementMaskUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->maskUnitsAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMaskElementMaskContentUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementMaskContentUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->maskContentUnitsAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMaskElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMaskElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMaskElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMaskElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMaskElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGMaskElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGMaskElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGMaskElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGMaskElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGMaskElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMaskElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGMaskElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMaskElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-void JSSVGMaskElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGMaskElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGMaskElement, Base>(exec, propertyName, value, &JSSVGMaskElementTable, this, slot);
 }
 
-void setJSSVGMaskElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGMaskElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGMaskElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGMaskElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(static_cast<JSSVGMaskElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGMaskElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMaskElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMaskElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMaskElement::s_info))
         return throwError(exec, TypeError);
     JSSVGMaskElement* castedThisObj = static_cast<JSSVGMaskElement*>(asObject(thisValue));
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGMaskElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMaskElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMaskElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMaskElement::s_info))
         return throwError(exec, TypeError);
     JSSVGMaskElement* castedThisObj = static_cast<JSSVGMaskElement*>(asObject(thisValue));
     SVGMaskElement* imp = static_cast<SVGMaskElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h
index dbe6b78..51f35cc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMaskElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGMaskElement_h
 #define JSSVGMaskElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGMaskElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGMaskElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGMaskElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGMaskElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,26 +64,26 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGMaskElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMaskElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMaskElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMaskElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGMaskElementMaskUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMaskElementMaskContentUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMaskElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMaskElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMaskElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMaskElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMaskElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMaskElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMaskElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMaskElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGMaskElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGMaskElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGMaskElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGMaskElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMaskElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGMaskElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementMaskUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementMaskContentUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGMaskElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGMaskElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGMaskElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGMaskElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGMaskElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.cpp
index 66c0b2c..761f128 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.cpp
@@ -20,23 +20,20 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGMatrix.h"
 
-#include <wtf/GetPtr.h>
-
-
+#include "JSSVGMatrix.h"
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGMatrix)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGMatrix);
 
 /* Hash table */
 
@@ -85,9 +82,9 @@ static const HashTable JSSVGMatrixPrototypeTable =
 
 const ClassInfo JSSVGMatrixPrototype::s_info = { "SVGMatrixPrototype", 0, &JSSVGMatrixPrototypeTable, 0 };
 
-JSObject* JSSVGMatrixPrototype::self(ExecState* exec)
+JSObject* JSSVGMatrixPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGMatrix>(exec);
+    return getDOMPrototype<JSSVGMatrix>(exec, globalObject);
 }
 
 bool JSSVGMatrixPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -107,12 +104,11 @@ JSSVGMatrix::JSSVGMatrix(PassRefPtr<Structure> structure, PassRefPtr<JSSVGPODTyp
 JSSVGMatrix::~JSSVGMatrix()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGMatrix::createPrototype(ExecState* exec)
+JSObject* JSSVGMatrix::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGMatrixPrototype(JSSVGMatrixPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGMatrixPrototype(JSSVGMatrixPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGMatrix::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -120,184 +116,255 @@ bool JSSVGMatrix::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSSVGMatrix, Base>(exec, &JSSVGMatrixTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGMatrixA(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMatrixA(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.a());
 }
 
-JSValuePtr jsSVGMatrixB(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMatrixB(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.b());
 }
 
-JSValuePtr jsSVGMatrixC(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMatrixC(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.c());
 }
 
-JSValuePtr jsSVGMatrixD(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMatrixD(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.d());
 }
 
-JSValuePtr jsSVGMatrixE(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMatrixE(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.e());
 }
 
-JSValuePtr jsSVGMatrixF(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGMatrixF(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.f());
 }
 
-void JSSVGMatrix::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGMatrix::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGMatrix, Base>(exec, propertyName, value, &JSSVGMatrixTable, this, slot);
 }
 
-void setJSSVGMatrixA(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGMatrixA(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(thisObject)->impl());
-    imp.setA(value->toNumber(exec));
+    imp.setA(value.toNumber(exec));
         static_cast<JSSVGMatrix*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGMatrix*>(thisObject)->context());
 }
 
-void setJSSVGMatrixB(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGMatrixB(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(thisObject)->impl());
-    imp.setB(value->toNumber(exec));
+    imp.setB(value.toNumber(exec));
         static_cast<JSSVGMatrix*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGMatrix*>(thisObject)->context());
 }
 
-void setJSSVGMatrixC(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGMatrixC(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(thisObject)->impl());
-    imp.setC(value->toNumber(exec));
+    imp.setC(value.toNumber(exec));
         static_cast<JSSVGMatrix*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGMatrix*>(thisObject)->context());
 }
 
-void setJSSVGMatrixD(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGMatrixD(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(thisObject)->impl());
-    imp.setD(value->toNumber(exec));
+    imp.setD(value.toNumber(exec));
         static_cast<JSSVGMatrix*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGMatrix*>(thisObject)->context());
 }
 
-void setJSSVGMatrixE(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGMatrixE(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(thisObject)->impl());
-    imp.setE(value->toNumber(exec));
+    imp.setE(value.toNumber(exec));
         static_cast<JSSVGMatrix*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGMatrix*>(thisObject)->context());
 }
 
-void setJSSVGMatrixF(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGMatrixF(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     TransformationMatrix imp(*static_cast<JSSVGMatrix*>(thisObject)->impl());
-    imp.setF(value->toNumber(exec));
+    imp.setF(value.toNumber(exec));
         static_cast<JSSVGMatrix*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGMatrix*>(thisObject)->context());
 }
 
-JSValuePtr jsSVGMatrixPrototypeFunctionMultiply(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionMultiply(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMatrix::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    return castedThisObj->multiply(exec, args);
+    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
+    TransformationMatrix imp(*wrapper);
+    TransformationMatrix secondMatrix = toSVGMatrix(args.at(0));
+
+
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.multiply(secondMatrix)).get(), castedThisObj->context());
+    return result;
 }
 
-JSValuePtr jsSVGMatrixPrototypeFunctionInverse(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionInverse(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMatrix::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
     return castedThisObj->inverse(exec, args);
 }
 
-JSValuePtr jsSVGMatrixPrototypeFunctionTranslate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionTranslate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMatrix::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    return castedThisObj->translate(exec, args);
+    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
+    TransformationMatrix imp(*wrapper);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+
+
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.translate(x, y)).get(), castedThisObj->context());
+    return result;
 }
 
-JSValuePtr jsSVGMatrixPrototypeFunctionScale(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionScale(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMatrix::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    return castedThisObj->scale(exec, args);
+    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
+    TransformationMatrix imp(*wrapper);
+    float scaleFactor = args.at(0).toFloat(exec);
+
+
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.scale(scaleFactor)).get(), castedThisObj->context());
+    return result;
 }
 
-JSValuePtr jsSVGMatrixPrototypeFunctionScaleNonUniform(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionScaleNonUniform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMatrix::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    return castedThisObj->scaleNonUniform(exec, args);
+    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
+    TransformationMatrix imp(*wrapper);
+    float scaleFactorX = args.at(0).toFloat(exec);
+    float scaleFactorY = args.at(1).toFloat(exec);
+
+
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.scaleNonUniform(scaleFactorX, scaleFactorY)).get(), castedThisObj->context());
+    return result;
 }
 
-JSValuePtr jsSVGMatrixPrototypeFunctionRotate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionRotate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMatrix::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    return castedThisObj->rotate(exec, args);
+    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
+    TransformationMatrix imp(*wrapper);
+    float angle = args.at(0).toFloat(exec);
+
+
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.rotate(angle)).get(), castedThisObj->context());
+    return result;
 }
 
-JSValuePtr jsSVGMatrixPrototypeFunctionRotateFromVector(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionRotateFromVector(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMatrix::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
     return castedThisObj->rotateFromVector(exec, args);
 }
 
-JSValuePtr jsSVGMatrixPrototypeFunctionFlipX(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionFlipX(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMatrix::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    return castedThisObj->flipX(exec, args);
+    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
+    TransformationMatrix imp(*wrapper);
+
+
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.flipX()).get(), castedThisObj->context());
+    return result;
 }
 
-JSValuePtr jsSVGMatrixPrototypeFunctionFlipY(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionFlipY(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMatrix::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    return castedThisObj->flipY(exec, args);
+    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
+    TransformationMatrix imp(*wrapper);
+
+
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.flipY()).get(), castedThisObj->context());
+    return result;
 }
 
-JSValuePtr jsSVGMatrixPrototypeFunctionSkewX(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionSkewX(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMatrix::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    return castedThisObj->skewX(exec, args);
+    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
+    TransformationMatrix imp(*wrapper);
+    float angle = args.at(0).toFloat(exec);
+
+
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.skewX(angle)).get(), castedThisObj->context());
+    return result;
 }
 
-JSValuePtr jsSVGMatrixPrototypeFunctionSkewY(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionSkewY(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGMatrix::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGMatrix::s_info))
         return throwError(exec, TypeError);
     JSSVGMatrix* castedThisObj = static_cast<JSSVGMatrix*>(asObject(thisValue));
-    return castedThisObj->skewY(exec, args);
+    JSSVGPODTypeWrapper<TransformationMatrix>* wrapper = castedThisObj->impl();
+    TransformationMatrix imp(*wrapper);
+    float angle = args.at(0).toFloat(exec);
+
+
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp.skewY(angle)).get(), castedThisObj->context());
+    return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<TransformationMatrix>* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<TransformationMatrix>* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGMatrix, JSSVGPODTypeWrapper<TransformationMatrix> >(exec, object, context);
 }
-TransformationMatrix toSVGMatrix(JSC::JSValuePtr value)
+TransformationMatrix toSVGMatrix(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGMatrix::s_info) ? (TransformationMatrix) *static_cast<JSSVGMatrix*>(asObject(value))->impl() : TransformationMatrix();
+    return value.isObject(&JSSVGMatrix::s_info) ? (TransformationMatrix) *static_cast<JSSVGMatrix*>(asObject(value))->impl() : TransformationMatrix();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h
index 0d8b249..c1c9068 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMatrix.h
@@ -21,14 +21,14 @@
 #ifndef JSSVGMatrix_h
 #define JSSVGMatrix_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "JSSVGPODTypeWrapper.h"
+#include "SVGElement.h"
+#include "TransformationMatrix.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
-#include "TransformationMatrix.h"
-#include "JSSVGPODTypeWrapper.h"
 
 namespace WebCore {
 
@@ -37,30 +37,21 @@ class JSSVGMatrix : public DOMObject {
 public:
     JSSVGMatrix(PassRefPtr<JSC::Structure>, PassRefPtr<JSSVGPODTypeWrapper<TransformationMatrix> >, SVGElement* context);
     virtual ~JSSVGMatrix();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
 
     // Custom functions
-    JSC::JSValuePtr multiply(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr inverse(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr translate(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr scale(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr scaleNonUniform(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr rotate(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr rotateFromVector(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr flipX(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr flipY(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr skewX(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr skewY(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue inverse(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue rotateFromVector(JSC::ExecState*, const JSC::ArgList&);
     JSSVGPODTypeWrapper<TransformationMatrix>* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -69,16 +60,17 @@ private:
     RefPtr<JSSVGPODTypeWrapper<TransformationMatrix> > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, JSSVGPODTypeWrapper<TransformationMatrix>*, SVGElement* context);
-TransformationMatrix toSVGMatrix(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, JSSVGPODTypeWrapper<TransformationMatrix>*, SVGElement* context);
+TransformationMatrix toSVGMatrix(JSC::JSValue);
 
 class JSSVGMatrixPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -87,31 +79,31 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGMatrixPrototypeFunctionMultiply(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMatrixPrototypeFunctionInverse(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMatrixPrototypeFunctionTranslate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMatrixPrototypeFunctionScale(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMatrixPrototypeFunctionScaleNonUniform(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMatrixPrototypeFunctionRotate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMatrixPrototypeFunctionRotateFromVector(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMatrixPrototypeFunctionFlipX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMatrixPrototypeFunctionFlipY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMatrixPrototypeFunctionSkewX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGMatrixPrototypeFunctionSkewY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionMultiply(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionInverse(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionTranslate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionScale(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionScaleNonUniform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionRotate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionRotateFromVector(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionFlipX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionFlipY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionSkewX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGMatrixPrototypeFunctionSkewY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGMatrixA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGMatrixA(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGMatrixB(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGMatrixB(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGMatrixC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGMatrixC(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGMatrixD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGMatrixD(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGMatrixE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGMatrixE(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGMatrixF(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGMatrixF(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGMatrixA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGMatrixA(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGMatrixB(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGMatrixB(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGMatrixC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGMatrixC(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGMatrixD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGMatrixD(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGMatrixE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGMatrixE(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGMatrixF(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGMatrixF(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.cpp
index 49acd21..a150bd3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGMetadataElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGMetadataElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGMetadataElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGMetadataElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +49,9 @@ static const HashTable JSSVGMetadataElementPrototypeTable =
 
 const ClassInfo JSSVGMetadataElementPrototype::s_info = { "SVGMetadataElementPrototype", 0, &JSSVGMetadataElementPrototypeTable, 0 };
 
-JSObject* JSSVGMetadataElementPrototype::self(ExecState* exec)
+JSObject* JSSVGMetadataElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGMetadataElement>(exec);
+    return getDOMPrototype<JSSVGMetadataElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGMetadataElement::s_info = { "SVGMetadataElement", &JSSVGElement::s_info, 0, 0 };
@@ -65,9 +61,9 @@ JSSVGMetadataElement::JSSVGMetadataElement(PassRefPtr<Structure> structure, Pass
 {
 }
 
-JSObject* JSSVGMetadataElement::createPrototype(ExecState* exec)
+JSObject* JSSVGMetadataElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGMetadataElementPrototype(JSSVGMetadataElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGMetadataElementPrototype(JSSVGMetadataElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.h
index 5da7044..49eb352 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMetadataElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGMetadataElement_h
 #define JSSVGMetadataElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,7 +34,7 @@ class JSSVGMetadataElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGMetadataElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGMetadataElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGMetadataElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGMetadataElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.cpp
index 435a567..f5eaa01 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FONTS)
 
-#include "SVGElement.h"
 #include "JSSVGMissingGlyphElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGMissingGlyphElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGMissingGlyphElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGMissingGlyphElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +49,9 @@ static const HashTable JSSVGMissingGlyphElementPrototypeTable =
 
 const ClassInfo JSSVGMissingGlyphElementPrototype::s_info = { "SVGMissingGlyphElementPrototype", 0, &JSSVGMissingGlyphElementPrototypeTable, 0 };
 
-JSObject* JSSVGMissingGlyphElementPrototype::self(ExecState* exec)
+JSObject* JSSVGMissingGlyphElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGMissingGlyphElement>(exec);
+    return getDOMPrototype<JSSVGMissingGlyphElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGMissingGlyphElement::s_info = { "SVGMissingGlyphElement", &JSSVGElement::s_info, 0, 0 };
@@ -65,9 +61,9 @@ JSSVGMissingGlyphElement::JSSVGMissingGlyphElement(PassRefPtr<Structure> structu
 {
 }
 
-JSObject* JSSVGMissingGlyphElement::createPrototype(ExecState* exec)
+JSObject* JSSVGMissingGlyphElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGMissingGlyphElementPrototype(JSSVGMissingGlyphElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGMissingGlyphElementPrototype(JSSVGMissingGlyphElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.h
index e696b0d..76be663 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGMissingGlyphElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGMissingGlyphElement_h
 #define JSSVGMissingGlyphElement_h
 
-
 #if ENABLE(SVG) && ENABLE(SVG_FONTS)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,7 +34,7 @@ class JSSVGMissingGlyphElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGMissingGlyphElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGMissingGlyphElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGMissingGlyphElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGMissingGlyphElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.cpp
index 6a770af..9e3dede 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGNumber.h"
 
-#include <wtf/GetPtr.h>
-
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGNumber)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGNumber);
 
 /* Hash table */
 
@@ -68,9 +64,9 @@ static const HashTable JSSVGNumberPrototypeTable =
 
 const ClassInfo JSSVGNumberPrototype::s_info = { "SVGNumberPrototype", 0, &JSSVGNumberPrototypeTable, 0 };
 
-JSObject* JSSVGNumberPrototype::self(ExecState* exec)
+JSObject* JSSVGNumberPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGNumber>(exec);
+    return getDOMPrototype<JSSVGNumber>(exec, globalObject);
 }
 
 const ClassInfo JSSVGNumber::s_info = { "SVGNumber", 0, &JSSVGNumberTable, 0 };
@@ -85,12 +81,11 @@ JSSVGNumber::JSSVGNumber(PassRefPtr<Structure> structure, PassRefPtr<JSSVGPODTyp
 JSSVGNumber::~JSSVGNumber()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGNumber::createPrototype(ExecState* exec)
+JSObject* JSSVGNumber::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGNumberPrototype(JSSVGNumberPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGNumberPrototype(JSSVGNumberPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGNumber::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -98,31 +93,32 @@ bool JSSVGNumber::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSSVGNumber, Base>(exec, &JSSVGNumberTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGNumberValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGNumberValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     float imp(*static_cast<JSSVGNumber*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp);
 }
 
-void JSSVGNumber::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGNumber::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGNumber, Base>(exec, propertyName, value, &JSSVGNumberTable, this, slot);
 }
 
-void setJSSVGNumberValue(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGNumberValue(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     float imp(*static_cast<JSSVGNumber*>(thisObject)->impl());
-    imp = value->toFloat(exec);
+    imp = value.toFloat(exec);
         static_cast<JSSVGNumber*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGNumber*>(thisObject)->context());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<float>* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<float>* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGNumber, JSSVGPODTypeWrapper<float> >(exec, object, context);
 }
-float toSVGNumber(JSC::JSValuePtr value)
+float toSVGNumber(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGNumber::s_info) ? (float) *static_cast<JSSVGNumber*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGNumber::s_info) ? (float) *static_cast<JSSVGNumber*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h b/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h
index 530c54a..08bfe82 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGNumber.h
@@ -21,13 +21,13 @@
 #ifndef JSSVGNumber_h
 #define JSSVGNumber_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "JSSVGPODTypeWrapper.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
-#include "JSSVGPODTypeWrapper.h"
 
 namespace WebCore {
 
@@ -36,13 +36,13 @@ class JSSVGNumber : public DOMObject {
 public:
     JSSVGNumber(PassRefPtr<JSC::Structure>, PassRefPtr<JSSVGPODTypeWrapper<float> >, SVGElement* context);
     virtual ~JSSVGNumber();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -55,12 +55,13 @@ private:
     RefPtr<JSSVGPODTypeWrapper<float> > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, JSSVGPODTypeWrapper<float>*, SVGElement* context);
-float toSVGNumber(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, JSSVGPODTypeWrapper<float>*, SVGElement* context);
+float toSVGNumber(JSC::JSValue);
 
 class JSSVGNumberPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGNumberPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -68,8 +69,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGNumberValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGNumberValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGNumberValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGNumberValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.cpp
index b5dfe53..28fd4bc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.cpp
@@ -20,25 +20,21 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGNumberList.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGNumber.h"
 #include "SVGNumberList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGNumberList)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGNumberList);
 
 /* Hash table */
 
@@ -78,9 +74,9 @@ static const HashTable JSSVGNumberListPrototypeTable =
 
 const ClassInfo JSSVGNumberListPrototype::s_info = { "SVGNumberListPrototype", 0, &JSSVGNumberListPrototypeTable, 0 };
 
-JSObject* JSSVGNumberListPrototype::self(ExecState* exec)
+JSObject* JSSVGNumberListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGNumberList>(exec);
+    return getDOMPrototype<JSSVGNumberList>(exec, globalObject);
 }
 
 bool JSSVGNumberListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -100,12 +96,11 @@ JSSVGNumberList::JSSVGNumberList(PassRefPtr<Structure> structure, PassRefPtr<SVG
 JSSVGNumberList::~JSSVGNumberList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGNumberList::createPrototype(ExecState* exec)
+JSObject* JSSVGNumberList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGNumberListPrototype(JSSVGNumberListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGNumberListPrototype(JSSVGNumberListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGNumberList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -113,15 +108,17 @@ bool JSSVGNumberList::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSSVGNumberList, Base>(exec, &JSSVGNumberListTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGNumberListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGNumberListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGNumberList* imp = static_cast<SVGNumberList*>(static_cast<JSSVGNumberList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->numberOfItems());
 }
 
-JSValuePtr jsSVGNumberListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGNumberList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
     SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
@@ -132,105 +129,111 @@ JSValuePtr jsSVGNumberListPrototypeFunctionClear(ExecState* exec, JSObject*, JSV
     return jsUndefined();
 }
 
-JSValuePtr jsSVGNumberListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGNumberList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
     SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float item = args.at(exec, 0)->toFloat(exec);
+    float item = args.at(0).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->initialize(item, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->initialize(item, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGNumberListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGNumberList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
     SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->getItem(index, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->getItem(index, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGNumberListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGNumberList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
     SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float item = args.at(exec, 0)->toFloat(exec);
-    unsigned index = args.at(exec, 1)->toInt32(exec);
+    float item = args.at(0).toFloat(exec);
+    unsigned index = args.at(1).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->insertItemBefore(item, index, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->insertItemBefore(item, index, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGNumberListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGNumberList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
     SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float item = args.at(exec, 0)->toFloat(exec);
-    unsigned index = args.at(exec, 1)->toInt32(exec);
+    float item = args.at(0).toFloat(exec);
+    unsigned index = args.at(1).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->replaceItem(item, index, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->replaceItem(item, index, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGNumberListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGNumberList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
     SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->removeItem(index, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->removeItem(index, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGNumberListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGNumberList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGNumberList::s_info))
         return throwError(exec, TypeError);
     JSSVGNumberList* castedThisObj = static_cast<JSSVGNumberList*>(asObject(thisValue));
     SVGNumberList* imp = static_cast<SVGNumberList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    float item = args.at(exec, 0)->toFloat(exec);
+    float item = args.at(0).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->appendItem(item, ec)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->appendItem(item, ec)).get(), castedThisObj->context());
     setDOMException(exec, ec);
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGNumberList* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGNumberList* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGNumberList>(exec, object, context);
 }
-SVGNumberList* toSVGNumberList(JSC::JSValuePtr value)
+SVGNumberList* toSVGNumberList(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGNumberList::s_info) ? static_cast<JSSVGNumberList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGNumberList::s_info) ? static_cast<JSSVGNumberList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h
index 64921bf..3eb5ece 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGNumberList.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGNumberList_h
 #define JSSVGNumberList_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -37,12 +37,12 @@ class JSSVGNumberList : public DOMObject {
 public:
     JSSVGNumberList(PassRefPtr<JSC::Structure>, PassRefPtr<SVGNumberList>, SVGElement* context);
     virtual ~JSSVGNumberList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -55,16 +55,17 @@ private:
     RefPtr<SVGNumberList > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGNumberList*, SVGElement* context);
-SVGNumberList* toSVGNumberList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGNumberList*, SVGElement* context);
+SVGNumberList* toSVGNumberList(JSC::JSValue);
 
 class JSSVGNumberListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -73,16 +74,16 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGNumberListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGNumberListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGNumberListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGNumberListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGNumberListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGNumberListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGNumberListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGNumberListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGNumberListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGNumberListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp
index 1baa716..8bfddc2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.cpp
@@ -20,26 +20,22 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPaint.h"
 
-#include <wtf/GetPtr.h>
-
 #include "KURL.h"
 #include "SVGPaint.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPaint)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPaint);
 
 /* Hash table */
 
@@ -87,13 +83,13 @@ public:
     JSSVGPaintConstructor(ExecState* exec)
         : DOMObject(JSSVGPaintConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGPaintPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGPaintPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -134,9 +130,9 @@ static const HashTable JSSVGPaintPrototypeTable =
 
 const ClassInfo JSSVGPaintPrototype::s_info = { "SVGPaintPrototype", 0, &JSSVGPaintPrototypeTable, 0 };
 
-JSObject* JSSVGPaintPrototype::self(ExecState* exec)
+JSObject* JSSVGPaintPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPaint>(exec);
+    return getDOMPrototype<JSSVGPaint>(exec, globalObject);
 }
 
 bool JSSVGPaintPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -151,9 +147,9 @@ JSSVGPaint::JSSVGPaint(PassRefPtr<Structure> structure, PassRefPtr<SVGPaint> imp
 {
 }
 
-JSObject* JSSVGPaint::createPrototype(ExecState* exec)
+JSObject* JSSVGPaint::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPaintPrototype(JSSVGPaintPrototype::createStructure(JSSVGColorPrototype::self(exec)));
+    return new (exec) JSSVGPaintPrototype(JSSVGPaintPrototype::createStructure(JSSVGColorPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPaint::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -161,50 +157,54 @@ bool JSSVGPaint::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSSVGPaint, Base>(exec, &JSSVGPaintTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPaintPaintType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPaintPaintType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPaint* imp = static_cast<SVGPaint*>(static_cast<JSSVGPaint*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->paintType());
 }
 
-JSValuePtr jsSVGPaintUri(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPaintUri(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPaint* imp = static_cast<SVGPaint*>(static_cast<JSSVGPaint*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->uri());
 }
 
-JSValuePtr jsSVGPaintConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPaintConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGPaint*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGPaint::getConstructor(ExecState* exec)
+JSValue JSSVGPaint::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGPaintConstructor>(exec);
 }
 
-JSValuePtr jsSVGPaintPrototypeFunctionSetUri(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPaintPrototypeFunctionSetUri(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPaint::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPaint::s_info))
         return throwError(exec, TypeError);
     JSSVGPaint* castedThisObj = static_cast<JSSVGPaint*>(asObject(thisValue));
     SVGPaint* imp = static_cast<SVGPaint*>(castedThisObj->impl());
-    const UString& uri = args.at(exec, 0)->toString(exec);
+    const UString& uri = args.at(0).toString(exec);
 
     imp->setUri(uri);
     return jsUndefined();
 }
 
-JSValuePtr jsSVGPaintPrototypeFunctionSetPaint(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPaintPrototypeFunctionSetPaint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPaint::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPaint::s_info))
         return throwError(exec, TypeError);
     JSSVGPaint* castedThisObj = static_cast<JSSVGPaint*>(asObject(thisValue));
     SVGPaint* imp = static_cast<SVGPaint*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGPaint::SVGPaintType paintType = static_cast<SVGPaint::SVGPaintType>(args.at(exec, 0)->toInt32(exec));
-    const UString& uri = args.at(exec, 1)->toString(exec);
-    const UString& rgbColor = args.at(exec, 2)->toString(exec);
-    const UString& iccColor = args.at(exec, 3)->toString(exec);
+    SVGPaint::SVGPaintType paintType = static_cast<SVGPaint::SVGPaintType>(args.at(0).toInt32(exec));
+    const UString& uri = args.at(1).toString(exec);
+    const UString& rgbColor = args.at(2).toString(exec);
+    const UString& iccColor = args.at(3).toString(exec);
 
     imp->setPaint(paintType, uri, rgbColor, iccColor, ec);
     setDOMException(exec, ec);
@@ -213,52 +213,52 @@ JSValuePtr jsSVGPaintPrototypeFunctionSetPaint(ExecState* exec, JSObject*, JSVal
 
 // Constant getters
 
-JSValuePtr jsSVGPaintSVG_PAINTTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGPaintSVG_PAINTTYPE_RGBCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_RGBCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGPaintSVG_PAINTTYPE_RGBCOLOR_ICCCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_RGBCOLOR_ICCCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGPaintSVG_PAINTTYPE_NONE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_NONE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(101));
 }
 
-JSValuePtr jsSVGPaintSVG_PAINTTYPE_CURRENTCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_CURRENTCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(102));
 }
 
-JSValuePtr jsSVGPaintSVG_PAINTTYPE_URI_NONE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_URI_NONE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(103));
 }
 
-JSValuePtr jsSVGPaintSVG_PAINTTYPE_URI_CURRENTCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_URI_CURRENTCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(104));
 }
 
-JSValuePtr jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(105));
 }
 
-JSValuePtr jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(106));
 }
 
-JSValuePtr jsSVGPaintSVG_PAINTTYPE_URI(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPaintSVG_PAINTTYPE_URI(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(107));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h
index c5aba40..495c5dd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPaint.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPaint_h
 #define JSSVGPaint_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGColor.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,27 +34,28 @@ class JSSVGPaint : public JSSVGColor {
     typedef JSSVGColor Base;
 public:
     JSSVGPaint(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPaint>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGPaintPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,25 +64,25 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGPaintPrototypeFunctionSetUri(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPaintPrototypeFunctionSetPaint(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPaintPrototypeFunctionSetUri(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPaintPrototypeFunctionSetPaint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGPaintPaintType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPaintUri(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPaintConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintPaintType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintUri(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGPaintSVG_PAINTTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPaintSVG_PAINTTYPE_RGBCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPaintSVG_PAINTTYPE_RGBCOLOR_ICCCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPaintSVG_PAINTTYPE_NONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPaintSVG_PAINTTYPE_CURRENTCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPaintSVG_PAINTTYPE_URI_NONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPaintSVG_PAINTTYPE_URI_CURRENTCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPaintSVG_PAINTTYPE_URI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_RGBCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_RGBCOLOR_ICCCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_NONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_CURRENTCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_URI_NONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_URI_CURRENTCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPaintSVG_PAINTTYPE_URI(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.cpp
index 8c0ca0e..0855624 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPathElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -77,16 +73,16 @@
 #include "SVGPathSegList.h"
 #include "SVGPathSegMoveto.h"
 #include "SVGStringList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathElement);
 
 /* Hash table */
 
@@ -162,9 +158,9 @@ static const HashTable JSSVGPathElementPrototypeTable =
 
 const ClassInfo JSSVGPathElementPrototype::s_info = { "SVGPathElementPrototype", 0, &JSSVGPathElementPrototypeTable, 0 };
 
-JSObject* JSSVGPathElementPrototype::self(ExecState* exec)
+JSObject* JSSVGPathElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathElement>(exec);
+    return getDOMPrototype<JSSVGPathElement>(exec, globalObject);
 }
 
 bool JSSVGPathElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -179,9 +175,9 @@ JSSVGPathElement::JSSVGPathElement(PassRefPtr<Structure> structure, PassRefPtr<S
 {
 }
 
-JSObject* JSSVGPathElement::createPrototype(ExecState* exec)
+JSObject* JSSVGPathElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathElementPrototype(JSSVGPathElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGPathElementPrototype(JSSVGPathElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -189,520 +185,564 @@ bool JSSVGPathElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGPathElement, Base>(exec, &JSSVGPathElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathElementPathLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementPathLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->pathLengthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPathElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGPathElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGPathElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGPathElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGPathElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGPathElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPathElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPathElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGPathElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPathElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGPathElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-JSValuePtr jsSVGPathElementPathSegList(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementPathSegList(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->pathSegList()), imp);
 }
 
-JSValuePtr jsSVGPathElementNormalizedPathSegList(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementNormalizedPathSegList(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->normalizedPathSegList()), imp);
 }
 
-JSValuePtr jsSVGPathElementAnimatedPathSegList(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementAnimatedPathSegList(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->animatedPathSegList()), imp);
 }
 
-JSValuePtr jsSVGPathElementAnimatedNormalizedPathSegList(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathElementAnimatedNormalizedPathSegList(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->animatedNormalizedPathSegList()), imp);
 }
 
-void JSSVGPathElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathElement, Base>(exec, propertyName, value, &JSSVGPathElementTable, this, slot);
 }
 
-void setJSSVGPathElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGPathElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathElement* imp = static_cast<SVGPathElement*>(static_cast<JSSVGPathElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionGetTotalLength(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetTotalLength(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getTotalLength());
+    JSC::JSValue result = jsNumber(exec, imp->getTotalLength());
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionGetPointAtLength(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetPointAtLength(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float distance = args.at(exec, 0)->toFloat(exec);
+    float distance = args.at(0).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->getPointAtLength(distance)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->getPointAtLength(distance)).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionGetPathSegAtLength(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetPathSegAtLength(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float distance = args.at(exec, 0)->toFloat(exec);
+    float distance = args.at(0).toFloat(exec);
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getPathSegAtLength(distance));
+    JSC::JSValue result = jsNumber(exec, imp->getPathSegAtLength(distance));
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegClosePath(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegClosePath(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegClosePath()), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegClosePath()), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoAbs(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegMovetoAbs(x, y)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegMovetoAbs(x, y)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoRel(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegMovetoRel(x, y)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegMovetoRel(x, y)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoAbs(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoAbs(x, y)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoAbs(x, y)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoRel(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoRel(x, y)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoRel(x, y)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicAbs(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float x1 = args.at(exec, 2)->toFloat(exec);
-    float y1 = args.at(exec, 3)->toFloat(exec);
-    float x2 = args.at(exec, 4)->toFloat(exec);
-    float y2 = args.at(exec, 5)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float x1 = args.at(2).toFloat(exec);
+    float y1 = args.at(3).toFloat(exec);
+    float x2 = args.at(4).toFloat(exec);
+    float y2 = args.at(5).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoCubicAbs(x, y, x1, y1, x2, y2)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoCubicAbs(x, y, x1, y1, x2, y2)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicRel(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float x1 = args.at(exec, 2)->toFloat(exec);
-    float y1 = args.at(exec, 3)->toFloat(exec);
-    float x2 = args.at(exec, 4)->toFloat(exec);
-    float y2 = args.at(exec, 5)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float x1 = args.at(2).toFloat(exec);
+    float y1 = args.at(3).toFloat(exec);
+    float x2 = args.at(4).toFloat(exec);
+    float y2 = args.at(5).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoCubicRel(x, y, x1, y1, x2, y2)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoCubicRel(x, y, x1, y1, x2, y2)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticAbs(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float x1 = args.at(exec, 2)->toFloat(exec);
-    float y1 = args.at(exec, 3)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float x1 = args.at(2).toFloat(exec);
+    float y1 = args.at(3).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoQuadraticAbs(x, y, x1, y1)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoQuadraticAbs(x, y, x1, y1)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticRel(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float x1 = args.at(exec, 2)->toFloat(exec);
-    float y1 = args.at(exec, 3)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float x1 = args.at(2).toFloat(exec);
+    float y1 = args.at(3).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoQuadraticRel(x, y, x1, y1)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoQuadraticRel(x, y, x1, y1)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcAbs(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float r1 = args.at(exec, 2)->toFloat(exec);
-    float r2 = args.at(exec, 3)->toFloat(exec);
-    float angle = args.at(exec, 4)->toFloat(exec);
-    bool largeArcFlag = args.at(exec, 5)->toBoolean(exec);
-    bool sweepFlag = args.at(exec, 6)->toBoolean(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float r1 = args.at(2).toFloat(exec);
+    float r2 = args.at(3).toFloat(exec);
+    float angle = args.at(4).toFloat(exec);
+    bool largeArcFlag = args.at(5).toBoolean(exec);
+    bool sweepFlag = args.at(6).toBoolean(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegArcAbs(x, y, r1, r2, angle, largeArcFlag, sweepFlag)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegArcAbs(x, y, r1, r2, angle, largeArcFlag, sweepFlag)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcRel(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float r1 = args.at(exec, 2)->toFloat(exec);
-    float r2 = args.at(exec, 3)->toFloat(exec);
-    float angle = args.at(exec, 4)->toFloat(exec);
-    bool largeArcFlag = args.at(exec, 5)->toBoolean(exec);
-    bool sweepFlag = args.at(exec, 6)->toBoolean(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float r1 = args.at(2).toFloat(exec);
+    float r2 = args.at(3).toFloat(exec);
+    float angle = args.at(4).toFloat(exec);
+    bool largeArcFlag = args.at(5).toBoolean(exec);
+    bool sweepFlag = args.at(6).toBoolean(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegArcRel(x, y, r1, r2, angle, largeArcFlag, sweepFlag)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegArcRel(x, y, r1, r2, angle, largeArcFlag, sweepFlag)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalAbs(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoHorizontalAbs(x)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoHorizontalAbs(x)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalRel(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoHorizontalRel(x)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoHorizontalRel(x)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalAbs(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float y = args.at(exec, 0)->toFloat(exec);
+    float y = args.at(0).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoVerticalAbs(y)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoVerticalAbs(y)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalRel(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float y = args.at(exec, 0)->toFloat(exec);
+    float y = args.at(0).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoVerticalRel(y)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegLinetoVerticalRel(y)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothAbs(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float x2 = args.at(exec, 2)->toFloat(exec);
-    float y2 = args.at(exec, 3)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float x2 = args.at(2).toFloat(exec);
+    float y2 = args.at(3).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoCubicSmoothAbs(x, y, x2, y2)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoCubicSmoothAbs(x, y, x2, y2)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothRel(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
-    float x2 = args.at(exec, 2)->toFloat(exec);
-    float y2 = args.at(exec, 3)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
+    float x2 = args.at(2).toFloat(exec);
+    float y2 = args.at(3).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoCubicSmoothRel(x, y, x2, y2)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoCubicSmoothRel(x, y, x2, y2)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothAbs(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothAbs(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoQuadraticSmoothAbs(x, y)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoQuadraticSmoothAbs(x, y)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothRel(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothRel(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    float x = args.at(exec, 0)->toFloat(exec);
-    float y = args.at(exec, 1)->toFloat(exec);
+    float x = args.at(0).toFloat(exec);
+    float y = args.at(1).toFloat(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoQuadraticSmoothRel(x, y)), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGPathSegCurvetoQuadraticSmoothRel(x, y)), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGPathElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPathElement* castedThisObj = static_cast<JSSVGPathElement*>(asObject(thisValue));
     SVGPathElement* imp = static_cast<SVGPathElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h
index 2b625a5..62fa439 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPathElement_h
 #define JSSVGPathElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGPathElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGPathElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGPathElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,54 +64,54 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionGetTotalLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionGetPointAtLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionGetPathSegAtLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegClosePath(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetTotalLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetPointAtLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetPathSegAtLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegClosePath(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegMovetoRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegArcRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoHorizontalRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegLinetoVerticalRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoCubicSmoothRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothAbs(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionCreateSVGPathSegCurvetoQuadraticSmoothRel(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGPathElementPathLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementPathSegList(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementNormalizedPathSegList(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementAnimatedPathSegList(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathElementAnimatedNormalizedPathSegList(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementPathLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementPathSegList(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementNormalizedPathSegList(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementAnimatedPathSegList(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathElementAnimatedNormalizedPathSegList(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp
index e440877..99c580b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.cpp
@@ -20,25 +20,21 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPathSeg.h"
 
-#include <wtf/GetPtr.h>
-
 #include "KURL.h"
 #include "SVGPathSeg.h"
-
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSeg)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSeg);
 
 /* Hash table */
 
@@ -96,13 +92,13 @@ public:
     JSSVGPathSegConstructor(ExecState* exec)
         : DOMObject(JSSVGPathSegConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGPathSegPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGPathSegPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -151,9 +147,9 @@ static const HashTable JSSVGPathSegPrototypeTable =
 
 const ClassInfo JSSVGPathSegPrototype::s_info = { "SVGPathSegPrototype", 0, &JSSVGPathSegPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSeg>(exec);
+    return getDOMPrototype<JSSVGPathSeg>(exec, globalObject);
 }
 
 bool JSSVGPathSegPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -173,12 +169,11 @@ JSSVGPathSeg::JSSVGPathSeg(PassRefPtr<Structure> structure, PassRefPtr<SVGPathSe
 JSSVGPathSeg::~JSSVGPathSeg()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGPathSeg::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSeg::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegPrototype(JSSVGPathSegPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGPathSegPrototype(JSSVGPathSegPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGPathSeg::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -186,132 +181,134 @@ bool JSSVGPathSeg::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSSVGPathSeg, Base>(exec, &JSSVGPathSegTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegPathSegType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegPathSegType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSeg* imp = static_cast<SVGPathSeg*>(static_cast<JSSVGPathSeg*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->pathSegType());
 }
 
-JSValuePtr jsSVGPathSegPathSegTypeAsLetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegPathSegTypeAsLetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSeg* imp = static_cast<SVGPathSeg*>(static_cast<JSSVGPathSeg*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->pathSegTypeAsLetter());
 }
 
-JSValuePtr jsSVGPathSegConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGPathSeg*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGPathSeg::getConstructor(ExecState* exec)
+JSValue JSSVGPathSeg::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGPathSegConstructor>(exec);
 }
 
 // Constant getters
 
-JSValuePtr jsSVGPathSegPATHSEG_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_CLOSEPATH(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CLOSEPATH(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_MOVETO_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_MOVETO_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_MOVETO_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_MOVETO_REL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_LINETO_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_LINETO_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_LINETO_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_LINETO_REL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_CURVETO_CUBIC_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_CURVETO_CUBIC_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_REL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_REL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_ARC_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_ARC_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(10));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_ARC_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_ARC_REL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(11));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(12));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_REL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(13));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_LINETO_VERTICAL_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_LINETO_VERTICAL_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(14));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_LINETO_VERTICAL_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_LINETO_VERTICAL_REL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(15));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(16));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_REL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(17));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(18));
 }
 
-JSValuePtr jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_REL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_REL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(19));
 }
 
-SVGPathSeg* toSVGPathSeg(JSC::JSValuePtr value)
+SVGPathSeg* toSVGPathSeg(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGPathSeg::s_info) ? static_cast<JSSVGPathSeg*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGPathSeg::s_info) ? static_cast<JSSVGPathSeg*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h
index f3795a1..7ba6512 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSeg.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPathSeg_h
 #define JSSVGPathSeg_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -37,17 +37,17 @@ class JSSVGPathSeg : public DOMObject {
 public:
     JSSVGPathSeg(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSeg>, SVGElement* context);
     virtual ~JSSVGPathSeg();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     SVGPathSeg* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -56,16 +56,17 @@ private:
     RefPtr<SVGPathSeg > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGPathSeg*, SVGElement* context);
-SVGPathSeg* toSVGPathSeg(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGPathSeg*, SVGElement* context);
+SVGPathSeg* toSVGPathSeg(JSC::JSValue);
 
 class JSSVGPathSegPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -74,31 +75,31 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegPathSegType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPathSegTypeAsLetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPathSegType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPathSegTypeAsLetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGPathSegPATHSEG_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_CLOSEPATH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_MOVETO_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_MOVETO_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_LINETO_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_LINETO_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_CURVETO_CUBIC_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_CURVETO_CUBIC_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_ARC_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_ARC_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_LINETO_VERTICAL_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_LINETO_VERTICAL_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_CLOSEPATH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_MOVETO_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_MOVETO_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_LINETO_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_LINETO_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_ARC_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_ARC_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_LINETO_HORIZONTAL_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_LINETO_VERTICAL_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_LINETO_VERTICAL_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_CUBIC_SMOOTH_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_ABS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegPATHSEG_CURVETO_QUADRATIC_SMOOTH_REL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.cpp
index 20d0adb..f754bf0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPathSegArcAbs.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGPathSegArc.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegArcAbs)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegArcAbs);
 
 /* Hash table */
 
@@ -75,9 +71,9 @@ static const HashTable JSSVGPathSegArcAbsPrototypeTable =
 
 const ClassInfo JSSVGPathSegArcAbsPrototype::s_info = { "SVGPathSegArcAbsPrototype", 0, &JSSVGPathSegArcAbsPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegArcAbsPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegArcAbsPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegArcAbs>(exec);
+    return getDOMPrototype<JSSVGPathSegArcAbs>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegArcAbs::s_info = { "SVGPathSegArcAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegArcAbsTable, 0 };
@@ -87,9 +83,9 @@ JSSVGPathSegArcAbs::JSSVGPathSegArcAbs(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSSVGPathSegArcAbs::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegArcAbs::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegArcAbsPrototype(JSSVGPathSegArcAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegArcAbsPrototype(JSSVGPathSegArcAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegArcAbs::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -97,105 +93,112 @@ bool JSSVGPathSegArcAbs::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGPathSegArcAbs, Base>(exec, &JSSVGPathSegArcAbsTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegArcAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegArcAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-JSValuePtr jsSVGPathSegArcAbsR1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcAbsR1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->r1());
 }
 
-JSValuePtr jsSVGPathSegArcAbsR2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcAbsR2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->r2());
 }
 
-JSValuePtr jsSVGPathSegArcAbsAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcAbsAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->angle());
 }
 
-JSValuePtr jsSVGPathSegArcAbsLargeArcFlag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcAbsLargeArcFlag(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->largeArcFlag());
 }
 
-JSValuePtr jsSVGPathSegArcAbsSweepFlag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcAbsSweepFlag(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->sweepFlag());
 }
 
-void JSSVGPathSegArcAbs::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegArcAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegArcAbs, Base>(exec, propertyName, value, &JSSVGPathSegArcAbsTable, this, slot);
 }
 
-void setJSSVGPathSegArcAbsX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegArcAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegArcAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcAbsY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegArcAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegArcAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcAbsR1(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcAbsR1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl());
-    imp->setR1(value->toFloat(exec));
+    imp->setR1(value.toFloat(exec));
     if (static_cast<JSSVGPathSegArcAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegArcAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcAbsR2(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcAbsR2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl());
-    imp->setR2(value->toFloat(exec));
+    imp->setR2(value.toFloat(exec));
     if (static_cast<JSSVGPathSegArcAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegArcAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcAbsAngle(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcAbsAngle(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl());
-    imp->setAngle(value->toFloat(exec));
+    imp->setAngle(value.toFloat(exec));
     if (static_cast<JSSVGPathSegArcAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegArcAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcAbsLargeArcFlag(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcAbsLargeArcFlag(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl());
-    imp->setLargeArcFlag(value->toBoolean(exec));
+    imp->setLargeArcFlag(value.toBoolean(exec));
     if (static_cast<JSSVGPathSegArcAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegArcAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcAbsSweepFlag(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcAbsSweepFlag(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcAbs* imp = static_cast<SVGPathSegArcAbs*>(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl());
-    imp->setSweepFlag(value->toBoolean(exec));
+    imp->setSweepFlag(value.toBoolean(exec));
     if (static_cast<JSSVGPathSegArcAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegArcAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcAbs*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h
index a591fbd..b051822 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcAbs.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPathSegArcAbs_h
 #define JSSVGPathSegArcAbs_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGPathSeg.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGPathSegArcAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegArcAbs(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegArcAbs>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegArcAbsPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegArcAbsPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,20 +59,20 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegArcAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcAbsR1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcAbsR1(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcAbsR2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcAbsR2(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcAbsAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcAbsAngle(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcAbsLargeArcFlag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcAbsLargeArcFlag(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcAbsSweepFlag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcAbsSweepFlag(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegArcAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcAbsR1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcAbsR1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcAbsR2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcAbsR2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcAbsAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcAbsAngle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcAbsLargeArcFlag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcAbsLargeArcFlag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcAbsSweepFlag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcAbsSweepFlag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.cpp
index f4f0a80..70a23c5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPathSegArcRel.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGPathSegArc.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegArcRel)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegArcRel);
 
 /* Hash table */
 
@@ -75,9 +71,9 @@ static const HashTable JSSVGPathSegArcRelPrototypeTable =
 
 const ClassInfo JSSVGPathSegArcRelPrototype::s_info = { "SVGPathSegArcRelPrototype", 0, &JSSVGPathSegArcRelPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegArcRelPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegArcRelPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegArcRel>(exec);
+    return getDOMPrototype<JSSVGPathSegArcRel>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegArcRel::s_info = { "SVGPathSegArcRel", &JSSVGPathSeg::s_info, &JSSVGPathSegArcRelTable, 0 };
@@ -87,9 +83,9 @@ JSSVGPathSegArcRel::JSSVGPathSegArcRel(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSSVGPathSegArcRel::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegArcRel::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegArcRelPrototype(JSSVGPathSegArcRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegArcRelPrototype(JSSVGPathSegArcRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegArcRel::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -97,105 +93,112 @@ bool JSSVGPathSegArcRel::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGPathSegArcRel, Base>(exec, &JSSVGPathSegArcRelTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegArcRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegArcRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-JSValuePtr jsSVGPathSegArcRelR1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcRelR1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->r1());
 }
 
-JSValuePtr jsSVGPathSegArcRelR2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcRelR2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->r2());
 }
 
-JSValuePtr jsSVGPathSegArcRelAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcRelAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->angle());
 }
 
-JSValuePtr jsSVGPathSegArcRelLargeArcFlag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcRelLargeArcFlag(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->largeArcFlag());
 }
 
-JSValuePtr jsSVGPathSegArcRelSweepFlag(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegArcRelSweepFlag(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->sweepFlag());
 }
 
-void JSSVGPathSegArcRel::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegArcRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegArcRel, Base>(exec, propertyName, value, &JSSVGPathSegArcRelTable, this, slot);
 }
 
-void setJSSVGPathSegArcRelX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegArcRel*>(thisObject)->context())
         static_cast<JSSVGPathSegArcRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcRelY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegArcRel*>(thisObject)->context())
         static_cast<JSSVGPathSegArcRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcRelR1(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcRelR1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl());
-    imp->setR1(value->toFloat(exec));
+    imp->setR1(value.toFloat(exec));
     if (static_cast<JSSVGPathSegArcRel*>(thisObject)->context())
         static_cast<JSSVGPathSegArcRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcRelR2(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcRelR2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl());
-    imp->setR2(value->toFloat(exec));
+    imp->setR2(value.toFloat(exec));
     if (static_cast<JSSVGPathSegArcRel*>(thisObject)->context())
         static_cast<JSSVGPathSegArcRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcRelAngle(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcRelAngle(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl());
-    imp->setAngle(value->toFloat(exec));
+    imp->setAngle(value.toFloat(exec));
     if (static_cast<JSSVGPathSegArcRel*>(thisObject)->context())
         static_cast<JSSVGPathSegArcRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcRelLargeArcFlag(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcRelLargeArcFlag(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl());
-    imp->setLargeArcFlag(value->toBoolean(exec));
+    imp->setLargeArcFlag(value.toBoolean(exec));
     if (static_cast<JSSVGPathSegArcRel*>(thisObject)->context())
         static_cast<JSSVGPathSegArcRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegArcRelSweepFlag(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegArcRelSweepFlag(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegArcRel* imp = static_cast<SVGPathSegArcRel*>(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl());
-    imp->setSweepFlag(value->toBoolean(exec));
+    imp->setSweepFlag(value.toBoolean(exec));
     if (static_cast<JSSVGPathSegArcRel*>(thisObject)->context())
         static_cast<JSSVGPathSegArcRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegArcRel*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h
index b395fa3..22028d2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegArcRel.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPathSegArcRel_h
 #define JSSVGPathSegArcRel_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGPathSeg.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGPathSegArcRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegArcRel(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegArcRel>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegArcRelPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegArcRelPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,20 +59,20 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegArcRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcRelR1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcRelR1(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcRelR2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcRelR2(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcRelAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcRelAngle(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcRelLargeArcFlag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcRelLargeArcFlag(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegArcRelSweepFlag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegArcRelSweepFlag(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegArcRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcRelR1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcRelR1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcRelR2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcRelR2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcRelAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcRelAngle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcRelLargeArcFlag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcRelLargeArcFlag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegArcRelSweepFlag(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegArcRelSweepFlag(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.cpp
index e44bd52..1270ef2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPathSegClosePath.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGPathSegClosePath.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegClosePath)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegClosePath);
 
 /* Hash table for prototype */
 
@@ -53,9 +49,9 @@ static const HashTable JSSVGPathSegClosePathPrototypeTable =
 
 const ClassInfo JSSVGPathSegClosePathPrototype::s_info = { "SVGPathSegClosePathPrototype", 0, &JSSVGPathSegClosePathPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegClosePathPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegClosePathPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegClosePath>(exec);
+    return getDOMPrototype<JSSVGPathSegClosePath>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegClosePath::s_info = { "SVGPathSegClosePath", &JSSVGPathSeg::s_info, 0, 0 };
@@ -65,9 +61,9 @@ JSSVGPathSegClosePath::JSSVGPathSegClosePath(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSSVGPathSegClosePath::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegClosePath::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegClosePathPrototype(JSSVGPathSegClosePathPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegClosePathPrototype(JSSVGPathSegClosePathPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.h
index a3ceb90..749eab1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegClosePath.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPathSegClosePath_h
 #define JSSVGPathSegClosePath_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGPathSeg.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,7 +34,7 @@ class JSSVGPathSegClosePath : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegClosePath(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegClosePath>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGPathSegClosePathPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegClosePathPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.cpp
index f121cd1..a33c4bc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPathSegCurvetoCubicAbs.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGPathSegCurvetoCubic.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoCubicAbs)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoCubicAbs);
 
 /* Hash table */
 
@@ -74,9 +70,9 @@ static const HashTable JSSVGPathSegCurvetoCubicAbsPrototypeTable =
 
 const ClassInfo JSSVGPathSegCurvetoCubicAbsPrototype::s_info = { "SVGPathSegCurvetoCubicAbsPrototype", 0, &JSSVGPathSegCurvetoCubicAbsPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegCurvetoCubicAbsPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoCubicAbsPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegCurvetoCubicAbs>(exec);
+    return getDOMPrototype<JSSVGPathSegCurvetoCubicAbs>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegCurvetoCubicAbs::s_info = { "SVGPathSegCurvetoCubicAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoCubicAbsTable, 0 };
@@ -86,9 +82,9 @@ JSSVGPathSegCurvetoCubicAbs::JSSVGPathSegCurvetoCubicAbs(PassRefPtr<Structure> s
 {
 }
 
-JSObject* JSSVGPathSegCurvetoCubicAbs::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoCubicAbs::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegCurvetoCubicAbsPrototype(JSSVGPathSegCurvetoCubicAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegCurvetoCubicAbsPrototype(JSSVGPathSegCurvetoCubicAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegCurvetoCubicAbs::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -96,91 +92,97 @@ bool JSSVGPathSegCurvetoCubicAbs::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSSVGPathSegCurvetoCubicAbs, Base>(exec, &JSSVGPathSegCurvetoCubicAbsTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicAbsX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicAbsX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x1());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicAbsY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicAbsY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y1());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicAbsX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicAbsX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x2());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicAbsY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicAbsY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y2());
 }
 
-void JSSVGPathSegCurvetoCubicAbs::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegCurvetoCubicAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoCubicAbs, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoCubicAbsTable, this, slot);
 }
 
-void setJSSVGPathSegCurvetoCubicAbsX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicAbsY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicAbsX1(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicAbsX1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl());
-    imp->setX1(value->toFloat(exec));
+    imp->setX1(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicAbsY1(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicAbsY1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl());
-    imp->setY1(value->toFloat(exec));
+    imp->setY1(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicAbsX2(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicAbsX2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl());
-    imp->setX2(value->toFloat(exec));
+    imp->setX2(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicAbsY2(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicAbsY2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicAbs* imp = static_cast<SVGPathSegCurvetoCubicAbs*>(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl());
-    imp->setY2(value->toFloat(exec));
+    imp->setY2(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicAbs*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h
index 2d0324d..7ffb1a0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicAbs.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPathSegCurvetoCubicAbs_h
 #define JSSVGPathSegCurvetoCubicAbs_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGPathSeg.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGPathSegCurvetoCubicAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegCurvetoCubicAbs(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegCurvetoCubicAbs>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegCurvetoCubicAbsPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegCurvetoCubicAbsPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,18 +59,18 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicAbsX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicAbsX1(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicAbsY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicAbsY1(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicAbsX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicAbsX2(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicAbsY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicAbsY2(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegCurvetoCubicAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicAbsX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicAbsX1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicAbsY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicAbsY1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicAbsX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicAbsX2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicAbsY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicAbsY2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.cpp
index 0d917ec..f6c6ad4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPathSegCurvetoCubicRel.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGPathSegCurvetoCubic.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoCubicRel)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoCubicRel);
 
 /* Hash table */
 
@@ -74,9 +70,9 @@ static const HashTable JSSVGPathSegCurvetoCubicRelPrototypeTable =
 
 const ClassInfo JSSVGPathSegCurvetoCubicRelPrototype::s_info = { "SVGPathSegCurvetoCubicRelPrototype", 0, &JSSVGPathSegCurvetoCubicRelPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegCurvetoCubicRelPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoCubicRelPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegCurvetoCubicRel>(exec);
+    return getDOMPrototype<JSSVGPathSegCurvetoCubicRel>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegCurvetoCubicRel::s_info = { "SVGPathSegCurvetoCubicRel", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoCubicRelTable, 0 };
@@ -86,9 +82,9 @@ JSSVGPathSegCurvetoCubicRel::JSSVGPathSegCurvetoCubicRel(PassRefPtr<Structure> s
 {
 }
 
-JSObject* JSSVGPathSegCurvetoCubicRel::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoCubicRel::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegCurvetoCubicRelPrototype(JSSVGPathSegCurvetoCubicRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegCurvetoCubicRelPrototype(JSSVGPathSegCurvetoCubicRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegCurvetoCubicRel::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -96,91 +92,97 @@ bool JSSVGPathSegCurvetoCubicRel::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSSVGPathSegCurvetoCubicRel, Base>(exec, &JSSVGPathSegCurvetoCubicRelTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicRelX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicRelX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x1());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicRelY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicRelY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y1());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicRelX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicRelX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x2());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicRelY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicRelY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y2());
 }
 
-void JSSVGPathSegCurvetoCubicRel::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegCurvetoCubicRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoCubicRel, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoCubicRelTable, this, slot);
 }
 
-void setJSSVGPathSegCurvetoCubicRelX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicRelY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicRelX1(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicRelX1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl());
-    imp->setX1(value->toFloat(exec));
+    imp->setX1(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicRelY1(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicRelY1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl());
-    imp->setY1(value->toFloat(exec));
+    imp->setY1(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicRelX2(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicRelX2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl());
-    imp->setX2(value->toFloat(exec));
+    imp->setX2(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicRelY2(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicRelY2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicRel* imp = static_cast<SVGPathSegCurvetoCubicRel*>(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl());
-    imp->setY2(value->toFloat(exec));
+    imp->setY2(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicRel*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h
index 65d891f..87d358d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicRel.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPathSegCurvetoCubicRel_h
 #define JSSVGPathSegCurvetoCubicRel_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGPathSeg.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGPathSegCurvetoCubicRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegCurvetoCubicRel(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegCurvetoCubicRel>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegCurvetoCubicRelPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegCurvetoCubicRelPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,18 +59,18 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicRelX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicRelX1(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicRelY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicRelY1(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicRelX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicRelX2(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicRelY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicRelY2(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegCurvetoCubicRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicRelX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicRelX1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicRelY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicRelY1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicRelX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicRelX2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicRelY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicRelY2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.cpp
index 6c0367f..22f8de9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPathSegCurvetoCubicSmoothAbs.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGPathSegCurvetoCubicSmooth.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoCubicSmoothAbs)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoCubicSmoothAbs);
 
 /* Hash table */
 
@@ -72,9 +68,9 @@ static const HashTable JSSVGPathSegCurvetoCubicSmoothAbsPrototypeTable =
 
 const ClassInfo JSSVGPathSegCurvetoCubicSmoothAbsPrototype::s_info = { "SVGPathSegCurvetoCubicSmoothAbsPrototype", 0, &JSSVGPathSegCurvetoCubicSmoothAbsPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegCurvetoCubicSmoothAbsPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoCubicSmoothAbsPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegCurvetoCubicSmoothAbs>(exec);
+    return getDOMPrototype<JSSVGPathSegCurvetoCubicSmoothAbs>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegCurvetoCubicSmoothAbs::s_info = { "SVGPathSegCurvetoCubicSmoothAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoCubicSmoothAbsTable, 0 };
@@ -84,9 +80,9 @@ JSSVGPathSegCurvetoCubicSmoothAbs::JSSVGPathSegCurvetoCubicSmoothAbs(PassRefPtr<
 {
 }
 
-JSObject* JSSVGPathSegCurvetoCubicSmoothAbs::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoCubicSmoothAbs::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegCurvetoCubicSmoothAbsPrototype(JSSVGPathSegCurvetoCubicSmoothAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegCurvetoCubicSmoothAbsPrototype(JSSVGPathSegCurvetoCubicSmoothAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegCurvetoCubicSmoothAbs::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -94,63 +90,67 @@ bool JSSVGPathSegCurvetoCubicSmoothAbs::getOwnPropertySlot(ExecState* exec, cons
     return getStaticValueSlot<JSSVGPathSegCurvetoCubicSmoothAbs, Base>(exec, &JSSVGPathSegCurvetoCubicSmoothAbsTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicSmoothAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicSmoothAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicSmoothAbsX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothAbsX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x2());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicSmoothAbsY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothAbsY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y2());
 }
 
-void JSSVGPathSegCurvetoCubicSmoothAbs::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegCurvetoCubicSmoothAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoCubicSmoothAbs, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoCubicSmoothAbsTable, this, slot);
 }
 
-void setJSSVGPathSegCurvetoCubicSmoothAbsX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicSmoothAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicSmoothAbsY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicSmoothAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicSmoothAbsX2(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicSmoothAbsX2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl());
-    imp->setX2(value->toFloat(exec));
+    imp->setX2(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicSmoothAbsY2(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicSmoothAbsY2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicSmoothAbs* imp = static_cast<SVGPathSegCurvetoCubicSmoothAbs*>(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl());
-    imp->setY2(value->toFloat(exec));
+    imp->setY2(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothAbs*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h
index a85e616..9b4ce0f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothAbs.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPathSegCurvetoCubicSmoothAbs_h
 #define JSSVGPathSegCurvetoCubicSmoothAbs_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGPathSeg.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGPathSegCurvetoCubicSmoothAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegCurvetoCubicSmoothAbs(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegCurvetoCubicSmoothAbs>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegCurvetoCubicSmoothAbsPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegCurvetoCubicSmoothAbsPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,14 +59,14 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicSmoothAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicSmoothAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicSmoothAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicSmoothAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicSmoothAbsX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicSmoothAbsX2(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicSmoothAbsY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicSmoothAbsY2(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicSmoothAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicSmoothAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothAbsX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicSmoothAbsX2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothAbsY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicSmoothAbsY2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.cpp
index 6f98a57..8608b28 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPathSegCurvetoCubicSmoothRel.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGPathSegCurvetoCubicSmooth.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoCubicSmoothRel)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoCubicSmoothRel);
 
 /* Hash table */
 
@@ -72,9 +68,9 @@ static const HashTable JSSVGPathSegCurvetoCubicSmoothRelPrototypeTable =
 
 const ClassInfo JSSVGPathSegCurvetoCubicSmoothRelPrototype::s_info = { "SVGPathSegCurvetoCubicSmoothRelPrototype", 0, &JSSVGPathSegCurvetoCubicSmoothRelPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegCurvetoCubicSmoothRelPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoCubicSmoothRelPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegCurvetoCubicSmoothRel>(exec);
+    return getDOMPrototype<JSSVGPathSegCurvetoCubicSmoothRel>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegCurvetoCubicSmoothRel::s_info = { "SVGPathSegCurvetoCubicSmoothRel", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoCubicSmoothRelTable, 0 };
@@ -84,9 +80,9 @@ JSSVGPathSegCurvetoCubicSmoothRel::JSSVGPathSegCurvetoCubicSmoothRel(PassRefPtr<
 {
 }
 
-JSObject* JSSVGPathSegCurvetoCubicSmoothRel::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoCubicSmoothRel::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegCurvetoCubicSmoothRelPrototype(JSSVGPathSegCurvetoCubicSmoothRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegCurvetoCubicSmoothRelPrototype(JSSVGPathSegCurvetoCubicSmoothRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegCurvetoCubicSmoothRel::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -94,63 +90,67 @@ bool JSSVGPathSegCurvetoCubicSmoothRel::getOwnPropertySlot(ExecState* exec, cons
     return getStaticValueSlot<JSSVGPathSegCurvetoCubicSmoothRel, Base>(exec, &JSSVGPathSegCurvetoCubicSmoothRelTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicSmoothRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicSmoothRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicSmoothRelX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothRelX2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x2());
 }
 
-JSValuePtr jsSVGPathSegCurvetoCubicSmoothRelY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoCubicSmoothRelY2(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y2());
 }
 
-void JSSVGPathSegCurvetoCubicSmoothRel::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegCurvetoCubicSmoothRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoCubicSmoothRel, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoCubicSmoothRelTable, this, slot);
 }
 
-void setJSSVGPathSegCurvetoCubicSmoothRelX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicSmoothRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicSmoothRelY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicSmoothRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicSmoothRelX2(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicSmoothRelX2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl());
-    imp->setX2(value->toFloat(exec));
+    imp->setX2(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoCubicSmoothRelY2(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoCubicSmoothRelY2(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoCubicSmoothRel* imp = static_cast<SVGPathSegCurvetoCubicSmoothRel*>(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl());
-    imp->setY2(value->toFloat(exec));
+    imp->setY2(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoCubicSmoothRel*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h
index f05dd7a..c705365 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoCubicSmoothRel.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPathSegCurvetoCubicSmoothRel_h
 #define JSSVGPathSegCurvetoCubicSmoothRel_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGPathSeg.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGPathSegCurvetoCubicSmoothRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegCurvetoCubicSmoothRel(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegCurvetoCubicSmoothRel>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegCurvetoCubicSmoothRelPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegCurvetoCubicSmoothRelPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,14 +59,14 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicSmoothRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicSmoothRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicSmoothRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicSmoothRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicSmoothRelX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicSmoothRelX2(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoCubicSmoothRelY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoCubicSmoothRelY2(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicSmoothRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicSmoothRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothRelX2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicSmoothRelX2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoCubicSmoothRelY2(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoCubicSmoothRelY2(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.cpp
index c4d685f..5897807 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPathSegCurvetoQuadraticAbs.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGPathSegCurvetoQuadratic.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoQuadraticAbs)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoQuadraticAbs);
 
 /* Hash table */
 
@@ -72,9 +68,9 @@ static const HashTable JSSVGPathSegCurvetoQuadraticAbsPrototypeTable =
 
 const ClassInfo JSSVGPathSegCurvetoQuadraticAbsPrototype::s_info = { "SVGPathSegCurvetoQuadraticAbsPrototype", 0, &JSSVGPathSegCurvetoQuadraticAbsPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegCurvetoQuadraticAbsPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoQuadraticAbsPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegCurvetoQuadraticAbs>(exec);
+    return getDOMPrototype<JSSVGPathSegCurvetoQuadraticAbs>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegCurvetoQuadraticAbs::s_info = { "SVGPathSegCurvetoQuadraticAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoQuadraticAbsTable, 0 };
@@ -84,9 +80,9 @@ JSSVGPathSegCurvetoQuadraticAbs::JSSVGPathSegCurvetoQuadraticAbs(PassRefPtr<Stru
 {
 }
 
-JSObject* JSSVGPathSegCurvetoQuadraticAbs::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoQuadraticAbs::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegCurvetoQuadraticAbsPrototype(JSSVGPathSegCurvetoQuadraticAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegCurvetoQuadraticAbsPrototype(JSSVGPathSegCurvetoQuadraticAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegCurvetoQuadraticAbs::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -94,63 +90,67 @@ bool JSSVGPathSegCurvetoQuadraticAbs::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSSVGPathSegCurvetoQuadraticAbs, Base>(exec, &JSSVGPathSegCurvetoQuadraticAbsTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticAbsX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticAbsX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x1());
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticAbsY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticAbsY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y1());
 }
 
-void JSSVGPathSegCurvetoQuadraticAbs::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegCurvetoQuadraticAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoQuadraticAbs, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoQuadraticAbsTable, this, slot);
 }
 
-void setJSSVGPathSegCurvetoQuadraticAbsX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoQuadraticAbsY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoQuadraticAbsX1(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticAbsX1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl());
-    imp->setX1(value->toFloat(exec));
+    imp->setX1(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoQuadraticAbsY1(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticAbsY1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticAbs* imp = static_cast<SVGPathSegCurvetoQuadraticAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl());
-    imp->setY1(value->toFloat(exec));
+    imp->setY1(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticAbs*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h
index b07efa5..6feebd8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticAbs.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPathSegCurvetoQuadraticAbs_h
 #define JSSVGPathSegCurvetoQuadraticAbs_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGPathSeg.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGPathSegCurvetoQuadraticAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegCurvetoQuadraticAbs(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegCurvetoQuadraticAbs>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegCurvetoQuadraticAbsPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegCurvetoQuadraticAbsPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,14 +59,14 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticAbsX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticAbsX1(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticAbsY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticAbsY1(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticAbsX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticAbsX1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticAbsY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticAbsY1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.cpp
index 98040c3..19f9b60 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPathSegCurvetoQuadraticRel.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGPathSegCurvetoQuadratic.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoQuadraticRel)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoQuadraticRel);
 
 /* Hash table */
 
@@ -72,9 +68,9 @@ static const HashTable JSSVGPathSegCurvetoQuadraticRelPrototypeTable =
 
 const ClassInfo JSSVGPathSegCurvetoQuadraticRelPrototype::s_info = { "SVGPathSegCurvetoQuadraticRelPrototype", 0, &JSSVGPathSegCurvetoQuadraticRelPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegCurvetoQuadraticRelPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoQuadraticRelPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegCurvetoQuadraticRel>(exec);
+    return getDOMPrototype<JSSVGPathSegCurvetoQuadraticRel>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegCurvetoQuadraticRel::s_info = { "SVGPathSegCurvetoQuadraticRel", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoQuadraticRelTable, 0 };
@@ -84,9 +80,9 @@ JSSVGPathSegCurvetoQuadraticRel::JSSVGPathSegCurvetoQuadraticRel(PassRefPtr<Stru
 {
 }
 
-JSObject* JSSVGPathSegCurvetoQuadraticRel::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoQuadraticRel::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegCurvetoQuadraticRelPrototype(JSSVGPathSegCurvetoQuadraticRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegCurvetoQuadraticRelPrototype(JSSVGPathSegCurvetoQuadraticRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegCurvetoQuadraticRel::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -94,63 +90,67 @@ bool JSSVGPathSegCurvetoQuadraticRel::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSSVGPathSegCurvetoQuadraticRel, Base>(exec, &JSSVGPathSegCurvetoQuadraticRelTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticRelX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticRelX1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x1());
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticRelY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticRelY1(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y1());
 }
 
-void JSSVGPathSegCurvetoQuadraticRel::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegCurvetoQuadraticRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoQuadraticRel, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoQuadraticRelTable, this, slot);
 }
 
-void setJSSVGPathSegCurvetoQuadraticRelX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoQuadraticRelY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoQuadraticRelX1(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticRelX1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl());
-    imp->setX1(value->toFloat(exec));
+    imp->setX1(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoQuadraticRelY1(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticRelY1(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticRel* imp = static_cast<SVGPathSegCurvetoQuadraticRel*>(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl());
-    imp->setY1(value->toFloat(exec));
+    imp->setY1(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticRel*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h
index 17c9b33..50c484b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticRel.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPathSegCurvetoQuadraticRel_h
 #define JSSVGPathSegCurvetoQuadraticRel_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGPathSeg.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGPathSegCurvetoQuadraticRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegCurvetoQuadraticRel(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegCurvetoQuadraticRel>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegCurvetoQuadraticRelPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegCurvetoQuadraticRelPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,14 +59,14 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticRelX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticRelX1(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticRelY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticRelY1(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticRelX1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticRelX1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticRelY1(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticRelY1(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.cpp
index 4a150f9..3fefc7e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPathSegCurvetoQuadraticSmoothAbs.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGPathSegCurvetoQuadraticSmooth.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoQuadraticSmoothAbs)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoQuadraticSmoothAbs);
 
 /* Hash table */
 
@@ -70,9 +66,9 @@ static const HashTable JSSVGPathSegCurvetoQuadraticSmoothAbsPrototypeTable =
 
 const ClassInfo JSSVGPathSegCurvetoQuadraticSmoothAbsPrototype::s_info = { "SVGPathSegCurvetoQuadraticSmoothAbsPrototype", 0, &JSSVGPathSegCurvetoQuadraticSmoothAbsPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegCurvetoQuadraticSmoothAbsPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoQuadraticSmoothAbsPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegCurvetoQuadraticSmoothAbs>(exec);
+    return getDOMPrototype<JSSVGPathSegCurvetoQuadraticSmoothAbs>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegCurvetoQuadraticSmoothAbs::s_info = { "SVGPathSegCurvetoQuadraticSmoothAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoQuadraticSmoothAbsTable, 0 };
@@ -82,9 +78,9 @@ JSSVGPathSegCurvetoQuadraticSmoothAbs::JSSVGPathSegCurvetoQuadraticSmoothAbs(Pas
 {
 }
 
-JSObject* JSSVGPathSegCurvetoQuadraticSmoothAbs::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoQuadraticSmoothAbs::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegCurvetoQuadraticSmoothAbsPrototype(JSSVGPathSegCurvetoQuadraticSmoothAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegCurvetoQuadraticSmoothAbsPrototype(JSSVGPathSegCurvetoQuadraticSmoothAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegCurvetoQuadraticSmoothAbs::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -92,35 +88,37 @@ bool JSSVGPathSegCurvetoQuadraticSmoothAbs::getOwnPropertySlot(ExecState* exec,
     return getStaticValueSlot<JSSVGPathSegCurvetoQuadraticSmoothAbs, Base>(exec, &JSSVGPathSegCurvetoQuadraticSmoothAbsTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticSmoothAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticSmoothAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticSmoothAbs* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticSmoothAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticSmoothAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticSmoothAbs* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-void JSSVGPathSegCurvetoQuadraticSmoothAbs::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegCurvetoQuadraticSmoothAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoQuadraticSmoothAbs, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoQuadraticSmoothAbsTable, this, slot);
 }
 
-void setJSSVGPathSegCurvetoQuadraticSmoothAbsX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticSmoothAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticSmoothAbs* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoQuadraticSmoothAbsY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticSmoothAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticSmoothAbs* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothAbs*>(static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticSmoothAbs*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h
index 95b5271..dee998c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothAbs.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPathSegCurvetoQuadraticSmoothAbs_h
 #define JSSVGPathSegCurvetoQuadraticSmoothAbs_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGPathSeg.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGPathSegCurvetoQuadraticSmoothAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegCurvetoQuadraticSmoothAbs(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegCurvetoQuadraticSmoothAbs>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegCurvetoQuadraticSmoothAbsPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegCurvetoQuadraticSmoothAbsPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,10 +59,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticSmoothAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticSmoothAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticSmoothAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticSmoothAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticSmoothAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticSmoothAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticSmoothAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticSmoothAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.cpp
index d2d2fe8..e16e6b5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPathSegCurvetoQuadraticSmoothRel.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGPathSegCurvetoQuadraticSmooth.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoQuadraticSmoothRel)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegCurvetoQuadraticSmoothRel);
 
 /* Hash table */
 
@@ -70,9 +66,9 @@ static const HashTable JSSVGPathSegCurvetoQuadraticSmoothRelPrototypeTable =
 
 const ClassInfo JSSVGPathSegCurvetoQuadraticSmoothRelPrototype::s_info = { "SVGPathSegCurvetoQuadraticSmoothRelPrototype", 0, &JSSVGPathSegCurvetoQuadraticSmoothRelPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegCurvetoQuadraticSmoothRelPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoQuadraticSmoothRelPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegCurvetoQuadraticSmoothRel>(exec);
+    return getDOMPrototype<JSSVGPathSegCurvetoQuadraticSmoothRel>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegCurvetoQuadraticSmoothRel::s_info = { "SVGPathSegCurvetoQuadraticSmoothRel", &JSSVGPathSeg::s_info, &JSSVGPathSegCurvetoQuadraticSmoothRelTable, 0 };
@@ -82,9 +78,9 @@ JSSVGPathSegCurvetoQuadraticSmoothRel::JSSVGPathSegCurvetoQuadraticSmoothRel(Pas
 {
 }
 
-JSObject* JSSVGPathSegCurvetoQuadraticSmoothRel::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegCurvetoQuadraticSmoothRel::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegCurvetoQuadraticSmoothRelPrototype(JSSVGPathSegCurvetoQuadraticSmoothRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegCurvetoQuadraticSmoothRelPrototype(JSSVGPathSegCurvetoQuadraticSmoothRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegCurvetoQuadraticSmoothRel::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -92,35 +88,37 @@ bool JSSVGPathSegCurvetoQuadraticSmoothRel::getOwnPropertySlot(ExecState* exec,
     return getStaticValueSlot<JSSVGPathSegCurvetoQuadraticSmoothRel, Base>(exec, &JSSVGPathSegCurvetoQuadraticSmoothRelTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticSmoothRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticSmoothRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticSmoothRel* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothRel*>(static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegCurvetoQuadraticSmoothRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegCurvetoQuadraticSmoothRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegCurvetoQuadraticSmoothRel* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothRel*>(static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-void JSSVGPathSegCurvetoQuadraticSmoothRel::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegCurvetoQuadraticSmoothRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegCurvetoQuadraticSmoothRel, Base>(exec, propertyName, value, &JSSVGPathSegCurvetoQuadraticSmoothRelTable, this, slot);
 }
 
-void setJSSVGPathSegCurvetoQuadraticSmoothRelX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticSmoothRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticSmoothRel* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothRel*>(static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegCurvetoQuadraticSmoothRelY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegCurvetoQuadraticSmoothRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegCurvetoQuadraticSmoothRel* imp = static_cast<SVGPathSegCurvetoQuadraticSmoothRel*>(static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->context())
         static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegCurvetoQuadraticSmoothRel*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h
index b05a572..5854a94 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegCurvetoQuadraticSmoothRel.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPathSegCurvetoQuadraticSmoothRel_h
 #define JSSVGPathSegCurvetoQuadraticSmoothRel_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGPathSeg.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGPathSegCurvetoQuadraticSmoothRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegCurvetoQuadraticSmoothRel(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegCurvetoQuadraticSmoothRel>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegCurvetoQuadraticSmoothRelPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegCurvetoQuadraticSmoothRelPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,10 +59,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticSmoothRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticSmoothRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegCurvetoQuadraticSmoothRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegCurvetoQuadraticSmoothRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticSmoothRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticSmoothRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegCurvetoQuadraticSmoothRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegCurvetoQuadraticSmoothRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.cpp
index cb5c828..8676d4b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPathSegLinetoAbs.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGPathSegLineto.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoAbs)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoAbs);
 
 /* Hash table */
 
@@ -70,9 +66,9 @@ static const HashTable JSSVGPathSegLinetoAbsPrototypeTable =
 
 const ClassInfo JSSVGPathSegLinetoAbsPrototype::s_info = { "SVGPathSegLinetoAbsPrototype", 0, &JSSVGPathSegLinetoAbsPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegLinetoAbsPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegLinetoAbsPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegLinetoAbs>(exec);
+    return getDOMPrototype<JSSVGPathSegLinetoAbs>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegLinetoAbs::s_info = { "SVGPathSegLinetoAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegLinetoAbsTable, 0 };
@@ -82,9 +78,9 @@ JSSVGPathSegLinetoAbs::JSSVGPathSegLinetoAbs(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSSVGPathSegLinetoAbs::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegLinetoAbs::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegLinetoAbsPrototype(JSSVGPathSegLinetoAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegLinetoAbsPrototype(JSSVGPathSegLinetoAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegLinetoAbs::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -92,35 +88,37 @@ bool JSSVGPathSegLinetoAbs::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSSVGPathSegLinetoAbs, Base>(exec, &JSSVGPathSegLinetoAbsTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegLinetoAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegLinetoAbs* imp = static_cast<SVGPathSegLinetoAbs*>(static_cast<JSSVGPathSegLinetoAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegLinetoAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegLinetoAbs* imp = static_cast<SVGPathSegLinetoAbs*>(static_cast<JSSVGPathSegLinetoAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-void JSSVGPathSegLinetoAbs::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegLinetoAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegLinetoAbs, Base>(exec, propertyName, value, &JSSVGPathSegLinetoAbsTable, this, slot);
 }
 
-void setJSSVGPathSegLinetoAbsX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegLinetoAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegLinetoAbs* imp = static_cast<SVGPathSegLinetoAbs*>(static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegLinetoAbsY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegLinetoAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegLinetoAbs* imp = static_cast<SVGPathSegLinetoAbs*>(static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoAbs*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h
index 3ba97a8..f737c49 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoAbs.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPathSegLinetoAbs_h
 #define JSSVGPathSegLinetoAbs_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGPathSeg.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGPathSegLinetoAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegLinetoAbs(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegLinetoAbs>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegLinetoAbsPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegLinetoAbsPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,10 +59,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegLinetoAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegLinetoAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegLinetoAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegLinetoAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegLinetoAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegLinetoAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegLinetoAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegLinetoAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.cpp
index 9146742..0289a9a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPathSegLinetoHorizontalAbs.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGPathSegLinetoHorizontal.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoHorizontalAbs)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoHorizontalAbs);
 
 /* Hash table */
 
@@ -69,9 +65,9 @@ static const HashTable JSSVGPathSegLinetoHorizontalAbsPrototypeTable =
 
 const ClassInfo JSSVGPathSegLinetoHorizontalAbsPrototype::s_info = { "SVGPathSegLinetoHorizontalAbsPrototype", 0, &JSSVGPathSegLinetoHorizontalAbsPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegLinetoHorizontalAbsPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegLinetoHorizontalAbsPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegLinetoHorizontalAbs>(exec);
+    return getDOMPrototype<JSSVGPathSegLinetoHorizontalAbs>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegLinetoHorizontalAbs::s_info = { "SVGPathSegLinetoHorizontalAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegLinetoHorizontalAbsTable, 0 };
@@ -81,9 +77,9 @@ JSSVGPathSegLinetoHorizontalAbs::JSSVGPathSegLinetoHorizontalAbs(PassRefPtr<Stru
 {
 }
 
-JSObject* JSSVGPathSegLinetoHorizontalAbs::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegLinetoHorizontalAbs::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegLinetoHorizontalAbsPrototype(JSSVGPathSegLinetoHorizontalAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegLinetoHorizontalAbsPrototype(JSSVGPathSegLinetoHorizontalAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegLinetoHorizontalAbs::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -91,21 +87,22 @@ bool JSSVGPathSegLinetoHorizontalAbs::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSSVGPathSegLinetoHorizontalAbs, Base>(exec, &JSSVGPathSegLinetoHorizontalAbsTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegLinetoHorizontalAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoHorizontalAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegLinetoHorizontalAbs* imp = static_cast<SVGPathSegLinetoHorizontalAbs*>(static_cast<JSSVGPathSegLinetoHorizontalAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-void JSSVGPathSegLinetoHorizontalAbs::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegLinetoHorizontalAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegLinetoHorizontalAbs, Base>(exec, propertyName, value, &JSSVGPathSegLinetoHorizontalAbsTable, this, slot);
 }
 
-void setJSSVGPathSegLinetoHorizontalAbsX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegLinetoHorizontalAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegLinetoHorizontalAbs* imp = static_cast<SVGPathSegLinetoHorizontalAbs*>(static_cast<JSSVGPathSegLinetoHorizontalAbs*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegLinetoHorizontalAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegLinetoHorizontalAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoHorizontalAbs*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h
index 6583717..fe2d270 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalAbs.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPathSegLinetoHorizontalAbs_h
 #define JSSVGPathSegLinetoHorizontalAbs_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGPathSeg.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGPathSegLinetoHorizontalAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegLinetoHorizontalAbs(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegLinetoHorizontalAbs>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegLinetoHorizontalAbsPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegLinetoHorizontalAbsPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,8 +59,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegLinetoHorizontalAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegLinetoHorizontalAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegLinetoHorizontalAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegLinetoHorizontalAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.cpp
index 925a07a..cd0755a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPathSegLinetoHorizontalRel.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGPathSegLinetoHorizontal.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoHorizontalRel)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoHorizontalRel);
 
 /* Hash table */
 
@@ -69,9 +65,9 @@ static const HashTable JSSVGPathSegLinetoHorizontalRelPrototypeTable =
 
 const ClassInfo JSSVGPathSegLinetoHorizontalRelPrototype::s_info = { "SVGPathSegLinetoHorizontalRelPrototype", 0, &JSSVGPathSegLinetoHorizontalRelPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegLinetoHorizontalRelPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegLinetoHorizontalRelPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegLinetoHorizontalRel>(exec);
+    return getDOMPrototype<JSSVGPathSegLinetoHorizontalRel>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegLinetoHorizontalRel::s_info = { "SVGPathSegLinetoHorizontalRel", &JSSVGPathSeg::s_info, &JSSVGPathSegLinetoHorizontalRelTable, 0 };
@@ -81,9 +77,9 @@ JSSVGPathSegLinetoHorizontalRel::JSSVGPathSegLinetoHorizontalRel(PassRefPtr<Stru
 {
 }
 
-JSObject* JSSVGPathSegLinetoHorizontalRel::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegLinetoHorizontalRel::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegLinetoHorizontalRelPrototype(JSSVGPathSegLinetoHorizontalRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegLinetoHorizontalRelPrototype(JSSVGPathSegLinetoHorizontalRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegLinetoHorizontalRel::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -91,21 +87,22 @@ bool JSSVGPathSegLinetoHorizontalRel::getOwnPropertySlot(ExecState* exec, const
     return getStaticValueSlot<JSSVGPathSegLinetoHorizontalRel, Base>(exec, &JSSVGPathSegLinetoHorizontalRelTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegLinetoHorizontalRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoHorizontalRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegLinetoHorizontalRel* imp = static_cast<SVGPathSegLinetoHorizontalRel*>(static_cast<JSSVGPathSegLinetoHorizontalRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-void JSSVGPathSegLinetoHorizontalRel::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegLinetoHorizontalRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegLinetoHorizontalRel, Base>(exec, propertyName, value, &JSSVGPathSegLinetoHorizontalRelTable, this, slot);
 }
 
-void setJSSVGPathSegLinetoHorizontalRelX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegLinetoHorizontalRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegLinetoHorizontalRel* imp = static_cast<SVGPathSegLinetoHorizontalRel*>(static_cast<JSSVGPathSegLinetoHorizontalRel*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegLinetoHorizontalRel*>(thisObject)->context())
         static_cast<JSSVGPathSegLinetoHorizontalRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoHorizontalRel*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h
index 66e5d31..b8edfb7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoHorizontalRel.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPathSegLinetoHorizontalRel_h
 #define JSSVGPathSegLinetoHorizontalRel_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGPathSeg.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGPathSegLinetoHorizontalRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegLinetoHorizontalRel(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegLinetoHorizontalRel>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegLinetoHorizontalRelPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegLinetoHorizontalRelPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,8 +59,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegLinetoHorizontalRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegLinetoHorizontalRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegLinetoHorizontalRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegLinetoHorizontalRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.cpp
index 37efb94..250196a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPathSegLinetoRel.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGPathSegLineto.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoRel)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoRel);
 
 /* Hash table */
 
@@ -70,9 +66,9 @@ static const HashTable JSSVGPathSegLinetoRelPrototypeTable =
 
 const ClassInfo JSSVGPathSegLinetoRelPrototype::s_info = { "SVGPathSegLinetoRelPrototype", 0, &JSSVGPathSegLinetoRelPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegLinetoRelPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegLinetoRelPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegLinetoRel>(exec);
+    return getDOMPrototype<JSSVGPathSegLinetoRel>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegLinetoRel::s_info = { "SVGPathSegLinetoRel", &JSSVGPathSeg::s_info, &JSSVGPathSegLinetoRelTable, 0 };
@@ -82,9 +78,9 @@ JSSVGPathSegLinetoRel::JSSVGPathSegLinetoRel(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSSVGPathSegLinetoRel::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegLinetoRel::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegLinetoRelPrototype(JSSVGPathSegLinetoRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegLinetoRelPrototype(JSSVGPathSegLinetoRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegLinetoRel::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -92,35 +88,37 @@ bool JSSVGPathSegLinetoRel::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSSVGPathSegLinetoRel, Base>(exec, &JSSVGPathSegLinetoRelTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegLinetoRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegLinetoRel* imp = static_cast<SVGPathSegLinetoRel*>(static_cast<JSSVGPathSegLinetoRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegLinetoRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegLinetoRel* imp = static_cast<SVGPathSegLinetoRel*>(static_cast<JSSVGPathSegLinetoRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-void JSSVGPathSegLinetoRel::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegLinetoRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegLinetoRel, Base>(exec, propertyName, value, &JSSVGPathSegLinetoRelTable, this, slot);
 }
 
-void setJSSVGPathSegLinetoRelX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegLinetoRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegLinetoRel* imp = static_cast<SVGPathSegLinetoRel*>(static_cast<JSSVGPathSegLinetoRel*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegLinetoRel*>(thisObject)->context())
         static_cast<JSSVGPathSegLinetoRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegLinetoRelY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegLinetoRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegLinetoRel* imp = static_cast<SVGPathSegLinetoRel*>(static_cast<JSSVGPathSegLinetoRel*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegLinetoRel*>(thisObject)->context())
         static_cast<JSSVGPathSegLinetoRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoRel*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h
index b0ec02e..5123bf1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoRel.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPathSegLinetoRel_h
 #define JSSVGPathSegLinetoRel_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGPathSeg.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGPathSegLinetoRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegLinetoRel(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegLinetoRel>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegLinetoRelPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegLinetoRelPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,10 +59,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegLinetoRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegLinetoRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegLinetoRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegLinetoRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegLinetoRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegLinetoRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegLinetoRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegLinetoRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.cpp
index aa9cba2..82f7ff8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPathSegLinetoVerticalAbs.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGPathSegLinetoVertical.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoVerticalAbs)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoVerticalAbs);
 
 /* Hash table */
 
@@ -69,9 +65,9 @@ static const HashTable JSSVGPathSegLinetoVerticalAbsPrototypeTable =
 
 const ClassInfo JSSVGPathSegLinetoVerticalAbsPrototype::s_info = { "SVGPathSegLinetoVerticalAbsPrototype", 0, &JSSVGPathSegLinetoVerticalAbsPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegLinetoVerticalAbsPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegLinetoVerticalAbsPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegLinetoVerticalAbs>(exec);
+    return getDOMPrototype<JSSVGPathSegLinetoVerticalAbs>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegLinetoVerticalAbs::s_info = { "SVGPathSegLinetoVerticalAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegLinetoVerticalAbsTable, 0 };
@@ -81,9 +77,9 @@ JSSVGPathSegLinetoVerticalAbs::JSSVGPathSegLinetoVerticalAbs(PassRefPtr<Structur
 {
 }
 
-JSObject* JSSVGPathSegLinetoVerticalAbs::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegLinetoVerticalAbs::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegLinetoVerticalAbsPrototype(JSSVGPathSegLinetoVerticalAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegLinetoVerticalAbsPrototype(JSSVGPathSegLinetoVerticalAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegLinetoVerticalAbs::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -91,21 +87,22 @@ bool JSSVGPathSegLinetoVerticalAbs::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSSVGPathSegLinetoVerticalAbs, Base>(exec, &JSSVGPathSegLinetoVerticalAbsTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegLinetoVerticalAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoVerticalAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegLinetoVerticalAbs* imp = static_cast<SVGPathSegLinetoVerticalAbs*>(static_cast<JSSVGPathSegLinetoVerticalAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-void JSSVGPathSegLinetoVerticalAbs::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegLinetoVerticalAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegLinetoVerticalAbs, Base>(exec, propertyName, value, &JSSVGPathSegLinetoVerticalAbsTable, this, slot);
 }
 
-void setJSSVGPathSegLinetoVerticalAbsY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegLinetoVerticalAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegLinetoVerticalAbs* imp = static_cast<SVGPathSegLinetoVerticalAbs*>(static_cast<JSSVGPathSegLinetoVerticalAbs*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegLinetoVerticalAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegLinetoVerticalAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoVerticalAbs*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h
index 52f48f6..184c021 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalAbs.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPathSegLinetoVerticalAbs_h
 #define JSSVGPathSegLinetoVerticalAbs_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGPathSeg.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGPathSegLinetoVerticalAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegLinetoVerticalAbs(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegLinetoVerticalAbs>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegLinetoVerticalAbsPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegLinetoVerticalAbsPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,8 +59,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegLinetoVerticalAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegLinetoVerticalAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegLinetoVerticalAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegLinetoVerticalAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.cpp
index e0b8b2b..e07cdd2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPathSegLinetoVerticalRel.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGPathSegLinetoVertical.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoVerticalRel)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegLinetoVerticalRel);
 
 /* Hash table */
 
@@ -69,9 +65,9 @@ static const HashTable JSSVGPathSegLinetoVerticalRelPrototypeTable =
 
 const ClassInfo JSSVGPathSegLinetoVerticalRelPrototype::s_info = { "SVGPathSegLinetoVerticalRelPrototype", 0, &JSSVGPathSegLinetoVerticalRelPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegLinetoVerticalRelPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegLinetoVerticalRelPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegLinetoVerticalRel>(exec);
+    return getDOMPrototype<JSSVGPathSegLinetoVerticalRel>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegLinetoVerticalRel::s_info = { "SVGPathSegLinetoVerticalRel", &JSSVGPathSeg::s_info, &JSSVGPathSegLinetoVerticalRelTable, 0 };
@@ -81,9 +77,9 @@ JSSVGPathSegLinetoVerticalRel::JSSVGPathSegLinetoVerticalRel(PassRefPtr<Structur
 {
 }
 
-JSObject* JSSVGPathSegLinetoVerticalRel::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegLinetoVerticalRel::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegLinetoVerticalRelPrototype(JSSVGPathSegLinetoVerticalRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegLinetoVerticalRelPrototype(JSSVGPathSegLinetoVerticalRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegLinetoVerticalRel::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -91,21 +87,22 @@ bool JSSVGPathSegLinetoVerticalRel::getOwnPropertySlot(ExecState* exec, const Id
     return getStaticValueSlot<JSSVGPathSegLinetoVerticalRel, Base>(exec, &JSSVGPathSegLinetoVerticalRelTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegLinetoVerticalRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegLinetoVerticalRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegLinetoVerticalRel* imp = static_cast<SVGPathSegLinetoVerticalRel*>(static_cast<JSSVGPathSegLinetoVerticalRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-void JSSVGPathSegLinetoVerticalRel::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegLinetoVerticalRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegLinetoVerticalRel, Base>(exec, propertyName, value, &JSSVGPathSegLinetoVerticalRelTable, this, slot);
 }
 
-void setJSSVGPathSegLinetoVerticalRelY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegLinetoVerticalRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegLinetoVerticalRel* imp = static_cast<SVGPathSegLinetoVerticalRel*>(static_cast<JSSVGPathSegLinetoVerticalRel*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegLinetoVerticalRel*>(thisObject)->context())
         static_cast<JSSVGPathSegLinetoVerticalRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegLinetoVerticalRel*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h
index 0cdb26b..a0cade4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegLinetoVerticalRel.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPathSegLinetoVerticalRel_h
 #define JSSVGPathSegLinetoVerticalRel_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGPathSeg.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGPathSegLinetoVerticalRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegLinetoVerticalRel(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegLinetoVerticalRel>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegLinetoVerticalRelPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegLinetoVerticalRelPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,8 +59,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegLinetoVerticalRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegLinetoVerticalRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegLinetoVerticalRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegLinetoVerticalRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.cpp
index 069f6d9..9a76052 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.cpp
@@ -20,25 +20,21 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPathSegList.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGPathSeg.h"
 #include "SVGPathSegList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegList)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegList);
 
 /* Hash table */
 
@@ -78,9 +74,9 @@ static const HashTable JSSVGPathSegListPrototypeTable =
 
 const ClassInfo JSSVGPathSegListPrototype::s_info = { "SVGPathSegListPrototype", 0, &JSSVGPathSegListPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegListPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegList>(exec);
+    return getDOMPrototype<JSSVGPathSegList>(exec, globalObject);
 }
 
 bool JSSVGPathSegListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -100,12 +96,11 @@ JSSVGPathSegList::JSSVGPathSegList(PassRefPtr<Structure> structure, PassRefPtr<S
 JSSVGPathSegList::~JSSVGPathSegList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGPathSegList::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegListPrototype(JSSVGPathSegListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGPathSegListPrototype(JSSVGPathSegListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGPathSegList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -113,75 +108,83 @@ bool JSSVGPathSegList::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGPathSegList, Base>(exec, &JSSVGPathSegListTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegList* imp = static_cast<SVGPathSegList*>(static_cast<JSSVGPathSegList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->numberOfItems());
 }
 
-JSValuePtr jsSVGPathSegListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathSegList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathSegList::s_info))
         return throwError(exec, TypeError);
     JSSVGPathSegList* castedThisObj = static_cast<JSSVGPathSegList*>(asObject(thisValue));
     return castedThisObj->clear(exec, args);
 }
 
-JSValuePtr jsSVGPathSegListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathSegList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathSegList::s_info))
         return throwError(exec, TypeError);
     JSSVGPathSegList* castedThisObj = static_cast<JSSVGPathSegList*>(asObject(thisValue));
     return castedThisObj->initialize(exec, args);
 }
 
-JSValuePtr jsSVGPathSegListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathSegList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathSegList::s_info))
         return throwError(exec, TypeError);
     JSSVGPathSegList* castedThisObj = static_cast<JSSVGPathSegList*>(asObject(thisValue));
     return castedThisObj->getItem(exec, args);
 }
 
-JSValuePtr jsSVGPathSegListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathSegList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathSegList::s_info))
         return throwError(exec, TypeError);
     JSSVGPathSegList* castedThisObj = static_cast<JSSVGPathSegList*>(asObject(thisValue));
     return castedThisObj->insertItemBefore(exec, args);
 }
 
-JSValuePtr jsSVGPathSegListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathSegList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathSegList::s_info))
         return throwError(exec, TypeError);
     JSSVGPathSegList* castedThisObj = static_cast<JSSVGPathSegList*>(asObject(thisValue));
     return castedThisObj->replaceItem(exec, args);
 }
 
-JSValuePtr jsSVGPathSegListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathSegList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathSegList::s_info))
         return throwError(exec, TypeError);
     JSSVGPathSegList* castedThisObj = static_cast<JSSVGPathSegList*>(asObject(thisValue));
     return castedThisObj->removeItem(exec, args);
 }
 
-JSValuePtr jsSVGPathSegListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPathSegList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPathSegList::s_info))
         return throwError(exec, TypeError);
     JSSVGPathSegList* castedThisObj = static_cast<JSSVGPathSegList*>(asObject(thisValue));
     return castedThisObj->appendItem(exec, args);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGPathSegList* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGPathSegList* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGPathSegList>(exec, object, context);
 }
-SVGPathSegList* toSVGPathSegList(JSC::JSValuePtr value)
+SVGPathSegList* toSVGPathSegList(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGPathSegList::s_info) ? static_cast<JSSVGPathSegList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGPathSegList::s_info) ? static_cast<JSSVGPathSegList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h
index 39a741e..5815d2c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegList.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPathSegList_h
 #define JSSVGPathSegList_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -37,25 +37,25 @@ class JSSVGPathSegList : public DOMObject {
 public:
     JSSVGPathSegList(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegList>, SVGElement* context);
     virtual ~JSSVGPathSegList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
 
     // Custom functions
-    JSC::JSValuePtr clear(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr initialize(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr getItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr insertItemBefore(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr replaceItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr appendItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue clear(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue initialize(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue insertItemBefore(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue replaceItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue appendItem(JSC::ExecState*, const JSC::ArgList&);
     SVGPathSegList* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -64,16 +64,17 @@ private:
     RefPtr<SVGPathSegList > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGPathSegList*, SVGElement* context);
-SVGPathSegList* toSVGPathSegList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGPathSegList*, SVGElement* context);
+SVGPathSegList* toSVGPathSegList(JSC::JSValue);
 
 class JSSVGPathSegListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -82,16 +83,16 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGPathSegListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathSegListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathSegListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathSegListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathSegListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathSegListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPathSegListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPathSegListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPathSegListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.cpp
index 9673c45..3f23fb6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPathSegMovetoAbs.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGPathSegMoveto.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegMovetoAbs)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegMovetoAbs);
 
 /* Hash table */
 
@@ -70,9 +66,9 @@ static const HashTable JSSVGPathSegMovetoAbsPrototypeTable =
 
 const ClassInfo JSSVGPathSegMovetoAbsPrototype::s_info = { "SVGPathSegMovetoAbsPrototype", 0, &JSSVGPathSegMovetoAbsPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegMovetoAbsPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegMovetoAbsPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegMovetoAbs>(exec);
+    return getDOMPrototype<JSSVGPathSegMovetoAbs>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegMovetoAbs::s_info = { "SVGPathSegMovetoAbs", &JSSVGPathSeg::s_info, &JSSVGPathSegMovetoAbsTable, 0 };
@@ -82,9 +78,9 @@ JSSVGPathSegMovetoAbs::JSSVGPathSegMovetoAbs(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSSVGPathSegMovetoAbs::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegMovetoAbs::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegMovetoAbsPrototype(JSSVGPathSegMovetoAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegMovetoAbsPrototype(JSSVGPathSegMovetoAbsPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegMovetoAbs::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -92,35 +88,37 @@ bool JSSVGPathSegMovetoAbs::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSSVGPathSegMovetoAbs, Base>(exec, &JSSVGPathSegMovetoAbsTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegMovetoAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegMovetoAbsX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegMovetoAbs* imp = static_cast<SVGPathSegMovetoAbs*>(static_cast<JSSVGPathSegMovetoAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegMovetoAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegMovetoAbsY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegMovetoAbs* imp = static_cast<SVGPathSegMovetoAbs*>(static_cast<JSSVGPathSegMovetoAbs*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-void JSSVGPathSegMovetoAbs::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegMovetoAbs::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegMovetoAbs, Base>(exec, propertyName, value, &JSSVGPathSegMovetoAbsTable, this, slot);
 }
 
-void setJSSVGPathSegMovetoAbsX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegMovetoAbsX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegMovetoAbs* imp = static_cast<SVGPathSegMovetoAbs*>(static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegMovetoAbsY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegMovetoAbsY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegMovetoAbs* imp = static_cast<SVGPathSegMovetoAbs*>(static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->context())
         static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegMovetoAbs*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h
index 1dffdfb..99e8582 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoAbs.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPathSegMovetoAbs_h
 #define JSSVGPathSegMovetoAbs_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGPathSeg.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGPathSegMovetoAbs : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegMovetoAbs(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegMovetoAbs>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegMovetoAbsPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegMovetoAbsPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,10 +59,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegMovetoAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegMovetoAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegMovetoAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegMovetoAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegMovetoAbsX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegMovetoAbsX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegMovetoAbsY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegMovetoAbsY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.cpp
index 5ef4069..51a946d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPathSegMovetoRel.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGPathSegMoveto.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegMovetoRel)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPathSegMovetoRel);
 
 /* Hash table */
 
@@ -70,9 +66,9 @@ static const HashTable JSSVGPathSegMovetoRelPrototypeTable =
 
 const ClassInfo JSSVGPathSegMovetoRelPrototype::s_info = { "SVGPathSegMovetoRelPrototype", 0, &JSSVGPathSegMovetoRelPrototypeTable, 0 };
 
-JSObject* JSSVGPathSegMovetoRelPrototype::self(ExecState* exec)
+JSObject* JSSVGPathSegMovetoRelPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPathSegMovetoRel>(exec);
+    return getDOMPrototype<JSSVGPathSegMovetoRel>(exec, globalObject);
 }
 
 const ClassInfo JSSVGPathSegMovetoRel::s_info = { "SVGPathSegMovetoRel", &JSSVGPathSeg::s_info, &JSSVGPathSegMovetoRelTable, 0 };
@@ -82,9 +78,9 @@ JSSVGPathSegMovetoRel::JSSVGPathSegMovetoRel(PassRefPtr<Structure> structure, Pa
 {
 }
 
-JSObject* JSSVGPathSegMovetoRel::createPrototype(ExecState* exec)
+JSObject* JSSVGPathSegMovetoRel::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPathSegMovetoRelPrototype(JSSVGPathSegMovetoRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec)));
+    return new (exec) JSSVGPathSegMovetoRelPrototype(JSSVGPathSegMovetoRelPrototype::createStructure(JSSVGPathSegPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPathSegMovetoRel::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -92,35 +88,37 @@ bool JSSVGPathSegMovetoRel::getOwnPropertySlot(ExecState* exec, const Identifier
     return getStaticValueSlot<JSSVGPathSegMovetoRel, Base>(exec, &JSSVGPathSegMovetoRelTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPathSegMovetoRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegMovetoRelX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegMovetoRel* imp = static_cast<SVGPathSegMovetoRel*>(static_cast<JSSVGPathSegMovetoRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsSVGPathSegMovetoRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPathSegMovetoRelY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPathSegMovetoRel* imp = static_cast<SVGPathSegMovetoRel*>(static_cast<JSSVGPathSegMovetoRel*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-void JSSVGPathSegMovetoRel::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPathSegMovetoRel::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPathSegMovetoRel, Base>(exec, propertyName, value, &JSSVGPathSegMovetoRelTable, this, slot);
 }
 
-void setJSSVGPathSegMovetoRelX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegMovetoRelX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegMovetoRel* imp = static_cast<SVGPathSegMovetoRel*>(static_cast<JSSVGPathSegMovetoRel*>(thisObject)->impl());
-    imp->setX(value->toFloat(exec));
+    imp->setX(value.toFloat(exec));
     if (static_cast<JSSVGPathSegMovetoRel*>(thisObject)->context())
         static_cast<JSSVGPathSegMovetoRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegMovetoRel*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPathSegMovetoRelY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPathSegMovetoRelY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPathSegMovetoRel* imp = static_cast<SVGPathSegMovetoRel*>(static_cast<JSSVGPathSegMovetoRel*>(thisObject)->impl());
-    imp->setY(value->toFloat(exec));
+    imp->setY(value.toFloat(exec));
     if (static_cast<JSSVGPathSegMovetoRel*>(thisObject)->context())
         static_cast<JSSVGPathSegMovetoRel*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPathSegMovetoRel*>(thisObject)->impl()->associatedAttributeName());
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h
index 2027c3f..179ea1a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPathSegMovetoRel.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPathSegMovetoRel_h
 #define JSSVGPathSegMovetoRel_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGPathSeg.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGPathSegMovetoRel : public JSSVGPathSeg {
     typedef JSSVGPathSeg Base;
 public:
     JSSVGPathSegMovetoRel(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPathSegMovetoRel>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGPathSegMovetoRelPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGPathSegMovetoRelPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,10 +59,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPathSegMovetoRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegMovetoRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPathSegMovetoRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPathSegMovetoRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPathSegMovetoRelX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegMovetoRelX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPathSegMovetoRelY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPathSegMovetoRelY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.cpp
index 35353d4..a01e6f2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPatternElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -44,15 +40,15 @@
 #include "KURL.h"
 #include "SVGPatternElement.h"
 #include "SVGStringList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPatternElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPatternElement);
 
 /* Hash table */
 
@@ -104,9 +100,9 @@ static const HashTable JSSVGPatternElementPrototypeTable =
 
 const ClassInfo JSSVGPatternElementPrototype::s_info = { "SVGPatternElementPrototype", 0, &JSSVGPatternElementPrototypeTable, 0 };
 
-JSObject* JSSVGPatternElementPrototype::self(ExecState* exec)
+JSObject* JSSVGPatternElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPatternElement>(exec);
+    return getDOMPrototype<JSSVGPatternElement>(exec, globalObject);
 }
 
 bool JSSVGPatternElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -121,9 +117,9 @@ JSSVGPatternElement::JSSVGPatternElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGPatternElement::createPrototype(ExecState* exec)
+JSObject* JSSVGPatternElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPatternElementPrototype(JSSVGPatternElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGPatternElementPrototype(JSSVGPatternElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPatternElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,166 +127,186 @@ bool JSSVGPatternElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGPatternElement, Base>(exec, &JSSVGPatternElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPatternElementPatternUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementPatternUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->patternUnitsAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPatternElementPatternContentUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementPatternContentUnits(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->patternContentUnitsAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPatternElementPatternTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementPatternTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->patternTransformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPatternElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPatternElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPatternElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPatternElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPatternElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPatternElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGPatternElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGPatternElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGPatternElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGPatternElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGPatternElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPatternElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPatternElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGPatternElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedRect> obj = imp->viewBoxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPatternElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPatternElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedPreserveAspectRatio> obj = imp->preserveAspectRatioAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-void JSSVGPatternElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPatternElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPatternElement, Base>(exec, propertyName, value, &JSSVGPatternElementTable, this, slot);
 }
 
-void setJSSVGPatternElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPatternElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGPatternElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPatternElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(static_cast<JSSVGPatternElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGPatternElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPatternElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPatternElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPatternElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPatternElement* castedThisObj = static_cast<JSSVGPatternElement*>(asObject(thisValue));
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGPatternElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPatternElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPatternElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPatternElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPatternElement* castedThisObj = static_cast<JSSVGPatternElement*>(asObject(thisValue));
     SVGPatternElement* imp = static_cast<SVGPatternElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h
index 6d11bc1..7541db1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPatternElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPatternElement_h
 #define JSSVGPatternElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGPatternElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGPatternElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPatternElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGPatternElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,30 +64,30 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGPatternElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPatternElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPatternElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPatternElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGPatternElementPatternUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementPatternContentUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementPatternTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPatternElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPatternElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPatternElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPatternElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPatternElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementPatternUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementPatternContentUnits(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementPatternTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPatternElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPatternElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPatternElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPatternElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPatternElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.cpp
index 633745c..ea8bc94 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.cpp
@@ -20,25 +20,21 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPoint.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGMatrix.h"
 #include "JSSVGPoint.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPoint)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPoint);
 
 /* Hash table */
 
@@ -73,9 +69,9 @@ static const HashTable JSSVGPointPrototypeTable =
 
 const ClassInfo JSSVGPointPrototype::s_info = { "SVGPointPrototype", 0, &JSSVGPointPrototypeTable, 0 };
 
-JSObject* JSSVGPointPrototype::self(ExecState* exec)
+JSObject* JSSVGPointPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPoint>(exec);
+    return getDOMPrototype<JSSVGPoint>(exec, globalObject);
 }
 
 bool JSSVGPointPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -95,12 +91,11 @@ JSSVGPoint::JSSVGPoint(PassRefPtr<Structure> structure, PassRefPtr<JSSVGPODTypeW
 JSSVGPoint::~JSSVGPoint()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGPoint::createPrototype(ExecState* exec)
+JSObject* JSSVGPoint::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPointPrototype(JSSVGPointPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGPointPrototype(JSSVGPointPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGPoint::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -108,59 +103,62 @@ bool JSSVGPoint::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return getStaticValueSlot<JSSVGPoint, Base>(exec, &JSSVGPointTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPointX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPointX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     FloatPoint imp(*static_cast<JSSVGPoint*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.x());
 }
 
-JSValuePtr jsSVGPointY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPointY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     FloatPoint imp(*static_cast<JSSVGPoint*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.y());
 }
 
-void JSSVGPoint::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPoint::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPoint, Base>(exec, propertyName, value, &JSSVGPointTable, this, slot);
 }
 
-void setJSSVGPointX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPointX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     FloatPoint imp(*static_cast<JSSVGPoint*>(thisObject)->impl());
-    imp.setX(value->toFloat(exec));
+    imp.setX(value.toFloat(exec));
         static_cast<JSSVGPoint*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGPoint*>(thisObject)->context());
 }
 
-void setJSSVGPointY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPointY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     FloatPoint imp(*static_cast<JSSVGPoint*>(thisObject)->impl());
-    imp.setY(value->toFloat(exec));
+    imp.setY(value.toFloat(exec));
         static_cast<JSSVGPoint*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGPoint*>(thisObject)->context());
 }
 
-JSValuePtr jsSVGPointPrototypeFunctionMatrixTransform(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPointPrototypeFunctionMatrixTransform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPoint::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPoint::s_info))
         return throwError(exec, TypeError);
     JSSVGPoint* castedThisObj = static_cast<JSSVGPoint*>(asObject(thisValue));
     JSSVGPODTypeWrapper<FloatPoint>* wrapper = castedThisObj->impl();
     FloatPoint imp(*wrapper);
-    TransformationMatrix matrix = toSVGMatrix(args.at(exec, 0));
+    TransformationMatrix matrix = toSVGMatrix(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp.matrixTransform(matrix)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp.matrixTransform(matrix)).get(), castedThisObj->context());
     wrapper->commitChange(imp, castedThisObj->context());
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<FloatPoint>* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<FloatPoint>* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGPoint, JSSVGPODTypeWrapper<FloatPoint> >(exec, object, context);
 }
-FloatPoint toSVGPoint(JSC::JSValuePtr value)
+FloatPoint toSVGPoint(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGPoint::s_info) ? (FloatPoint) *static_cast<JSSVGPoint*>(asObject(value))->impl() : FloatPoint();
+    return value.isObject(&JSSVGPoint::s_info) ? (FloatPoint) *static_cast<JSSVGPoint*>(asObject(value))->impl() : FloatPoint();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h
index fae362a..95ee72d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPoint.h
@@ -21,14 +21,14 @@
 #ifndef JSSVGPoint_h
 #define JSSVGPoint_h
 
-
 #if ENABLE(SVG)
 
+#include "FloatPoint.h"
 #include "JSDOMBinding.h"
+#include "JSSVGPODTypeWrapper.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
-#include "FloatPoint.h"
-#include "JSSVGPODTypeWrapper.h"
 
 namespace WebCore {
 
@@ -37,13 +37,13 @@ class JSSVGPoint : public DOMObject {
 public:
     JSSVGPoint(PassRefPtr<JSC::Structure>, PassRefPtr<JSSVGPODTypeWrapper<FloatPoint> >, SVGElement* context);
     virtual ~JSSVGPoint();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -56,16 +56,17 @@ private:
     RefPtr<JSSVGPODTypeWrapper<FloatPoint> > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, JSSVGPODTypeWrapper<FloatPoint>*, SVGElement* context);
-FloatPoint toSVGPoint(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, JSSVGPODTypeWrapper<FloatPoint>*, SVGElement* context);
+FloatPoint toSVGPoint(JSC::JSValue);
 
 class JSSVGPointPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -74,13 +75,13 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGPointPrototypeFunctionMatrixTransform(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPointPrototypeFunctionMatrixTransform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGPointX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPointX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPointY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPointY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGPointX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPointX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPointY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPointY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.cpp
index 7eebc21..74c85a6 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.cpp
@@ -20,24 +20,20 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPointList.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGPointList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPointList)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPointList);
 
 /* Hash table */
 
@@ -77,9 +73,9 @@ static const HashTable JSSVGPointListPrototypeTable =
 
 const ClassInfo JSSVGPointListPrototype::s_info = { "SVGPointListPrototype", 0, &JSSVGPointListPrototypeTable, 0 };
 
-JSObject* JSSVGPointListPrototype::self(ExecState* exec)
+JSObject* JSSVGPointListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPointList>(exec);
+    return getDOMPrototype<JSSVGPointList>(exec, globalObject);
 }
 
 bool JSSVGPointListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -99,12 +95,11 @@ JSSVGPointList::JSSVGPointList(PassRefPtr<Structure> structure, PassRefPtr<SVGPo
 JSSVGPointList::~JSSVGPointList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGPointList::createPrototype(ExecState* exec)
+JSObject* JSSVGPointList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPointListPrototype(JSSVGPointListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGPointListPrototype(JSSVGPointListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGPointList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -112,75 +107,83 @@ bool JSSVGPointList::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSSVGPointList, Base>(exec, &JSSVGPointListTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPointListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPointListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPointList* imp = static_cast<SVGPointList*>(static_cast<JSSVGPointList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->numberOfItems());
 }
 
-JSValuePtr jsSVGPointListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPointList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
     return castedThisObj->clear(exec, args);
 }
 
-JSValuePtr jsSVGPointListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPointList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
     return castedThisObj->initialize(exec, args);
 }
 
-JSValuePtr jsSVGPointListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPointList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
     return castedThisObj->getItem(exec, args);
 }
 
-JSValuePtr jsSVGPointListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPointList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
     return castedThisObj->insertItemBefore(exec, args);
 }
 
-JSValuePtr jsSVGPointListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPointList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
     return castedThisObj->replaceItem(exec, args);
 }
 
-JSValuePtr jsSVGPointListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPointList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
     return castedThisObj->removeItem(exec, args);
 }
 
-JSValuePtr jsSVGPointListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPointList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPointList::s_info))
         return throwError(exec, TypeError);
     JSSVGPointList* castedThisObj = static_cast<JSSVGPointList*>(asObject(thisValue));
     return castedThisObj->appendItem(exec, args);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGPointList* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGPointList* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGPointList>(exec, object, context);
 }
-SVGPointList* toSVGPointList(JSC::JSValuePtr value)
+SVGPointList* toSVGPointList(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGPointList::s_info) ? static_cast<JSSVGPointList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGPointList::s_info) ? static_cast<JSSVGPointList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h
index c28355a..29bd323 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPointList.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPointList_h
 #define JSSVGPointList_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -37,25 +37,25 @@ class JSSVGPointList : public DOMObject {
 public:
     JSSVGPointList(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPointList>, SVGElement* context);
     virtual ~JSSVGPointList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
 
     // Custom functions
-    JSC::JSValuePtr clear(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr initialize(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr getItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr insertItemBefore(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr replaceItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr appendItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue clear(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue initialize(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue insertItemBefore(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue replaceItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue appendItem(JSC::ExecState*, const JSC::ArgList&);
     SVGPointList* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -64,16 +64,17 @@ private:
     RefPtr<SVGPointList > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGPointList*, SVGElement* context);
-SVGPointList* toSVGPointList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGPointList*, SVGElement* context);
+SVGPointList* toSVGPointList(JSC::JSValue);
 
 class JSSVGPointListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -82,16 +83,16 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGPointListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPointListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPointListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPointListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPointListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPointListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPointListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPointListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGPointListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPointListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.cpp
index 15ccd91..33a19b4 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPolygonElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -46,15 +42,15 @@
 #include "SVGPointList.h"
 #include "SVGPolygonElement.h"
 #include "SVGStringList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPolygonElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPolygonElement);
 
 /* Hash table */
 
@@ -105,9 +101,9 @@ static const HashTable JSSVGPolygonElementPrototypeTable =
 
 const ClassInfo JSSVGPolygonElementPrototype::s_info = { "SVGPolygonElementPrototype", 0, &JSSVGPolygonElementPrototypeTable, 0 };
 
-JSObject* JSSVGPolygonElementPrototype::self(ExecState* exec)
+JSObject* JSSVGPolygonElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPolygonElement>(exec);
+    return getDOMPrototype<JSSVGPolygonElement>(exec, globalObject);
 }
 
 bool JSSVGPolygonElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -122,9 +118,9 @@ JSSVGPolygonElement::JSSVGPolygonElement(PassRefPtr<Structure> structure, PassRe
 {
 }
 
-JSObject* JSSVGPolygonElement::createPrototype(ExecState* exec)
+JSObject* JSSVGPolygonElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPolygonElementPrototype(JSSVGPolygonElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGPolygonElementPrototype(JSSVGPolygonElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPolygonElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,177 +128,196 @@ bool JSSVGPolygonElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGPolygonElement, Base>(exec, &JSSVGPolygonElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPolygonElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGPolygonElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGPolygonElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGPolygonElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGPolygonElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGPolygonElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPolygonElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPolygonElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGPolygonElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPolygonElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGPolygonElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-JSValuePtr jsSVGPolygonElementPoints(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementPoints(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->points()), imp);
 }
 
-JSValuePtr jsSVGPolygonElementAnimatedPoints(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolygonElementAnimatedPoints(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->animatedPoints()), imp);
 }
 
-void JSSVGPolygonElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPolygonElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPolygonElement, Base>(exec, propertyName, value, &JSSVGPolygonElementTable, this, slot);
 }
 
-void setJSSVGPolygonElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPolygonElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGPolygonElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPolygonElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(static_cast<JSSVGPolygonElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGPolygonElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolygonElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolygonElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolygonElement* castedThisObj = static_cast<JSSVGPolygonElement*>(asObject(thisValue));
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGPolygonElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolygonElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolygonElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolygonElement* castedThisObj = static_cast<JSSVGPolygonElement*>(asObject(thisValue));
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGPolygonElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolygonElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolygonElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolygonElement* castedThisObj = static_cast<JSSVGPolygonElement*>(asObject(thisValue));
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGPolygonElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolygonElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolygonElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolygonElement* castedThisObj = static_cast<JSSVGPolygonElement*>(asObject(thisValue));
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGPolygonElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolygonElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolygonElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolygonElement* castedThisObj = static_cast<JSSVGPolygonElement*>(asObject(thisValue));
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGPolygonElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolygonElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolygonElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolygonElement* castedThisObj = static_cast<JSSVGPolygonElement*>(asObject(thisValue));
     SVGPolygonElement* imp = static_cast<SVGPolygonElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h
index f98722f..b4c3131 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPolygonElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPolygonElement_h
 #define JSSVGPolygonElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGPolygonElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGPolygonElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPolygonElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGPolygonElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,29 +64,29 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGPolygonElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPolygonElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPolygonElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPolygonElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPolygonElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPolygonElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolygonElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGPolygonElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolygonElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolygonElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolygonElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPolygonElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPolygonElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPolygonElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPolygonElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolygonElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolygonElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolygonElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolygonElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolygonElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolygonElementPoints(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolygonElementAnimatedPoints(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPolygonElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPolygonElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPolygonElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPolygonElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementPoints(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolygonElementAnimatedPoints(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.cpp
index 19fe95a..a04f5fa 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPolylineElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -46,15 +42,15 @@
 #include "SVGPointList.h"
 #include "SVGPolylineElement.h"
 #include "SVGStringList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPolylineElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPolylineElement);
 
 /* Hash table */
 
@@ -105,9 +101,9 @@ static const HashTable JSSVGPolylineElementPrototypeTable =
 
 const ClassInfo JSSVGPolylineElementPrototype::s_info = { "SVGPolylineElementPrototype", 0, &JSSVGPolylineElementPrototypeTable, 0 };
 
-JSObject* JSSVGPolylineElementPrototype::self(ExecState* exec)
+JSObject* JSSVGPolylineElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPolylineElement>(exec);
+    return getDOMPrototype<JSSVGPolylineElement>(exec, globalObject);
 }
 
 bool JSSVGPolylineElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -122,9 +118,9 @@ JSSVGPolylineElement::JSSVGPolylineElement(PassRefPtr<Structure> structure, Pass
 {
 }
 
-JSObject* JSSVGPolylineElement::createPrototype(ExecState* exec)
+JSObject* JSSVGPolylineElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPolylineElementPrototype(JSSVGPolylineElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGPolylineElementPrototype(JSSVGPolylineElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGPolylineElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,177 +128,196 @@ bool JSSVGPolylineElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGPolylineElement, Base>(exec, &JSSVGPolylineElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPolylineElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGPolylineElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGPolylineElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGPolylineElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGPolylineElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGPolylineElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPolylineElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPolylineElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGPolylineElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGPolylineElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGPolylineElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-JSValuePtr jsSVGPolylineElementPoints(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementPoints(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->points()), imp);
 }
 
-JSValuePtr jsSVGPolylineElementAnimatedPoints(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPolylineElementAnimatedPoints(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->animatedPoints()), imp);
 }
 
-void JSSVGPolylineElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPolylineElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPolylineElement, Base>(exec, propertyName, value, &JSSVGPolylineElementTable, this, slot);
 }
 
-void setJSSVGPolylineElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPolylineElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGPolylineElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPolylineElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(static_cast<JSSVGPolylineElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGPolylineElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolylineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolylineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolylineElement* castedThisObj = static_cast<JSSVGPolylineElement*>(asObject(thisValue));
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGPolylineElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolylineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolylineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolylineElement* castedThisObj = static_cast<JSSVGPolylineElement*>(asObject(thisValue));
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGPolylineElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolylineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolylineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolylineElement* castedThisObj = static_cast<JSSVGPolylineElement*>(asObject(thisValue));
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGPolylineElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolylineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolylineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolylineElement* castedThisObj = static_cast<JSSVGPolylineElement*>(asObject(thisValue));
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGPolylineElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolylineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolylineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolylineElement* castedThisObj = static_cast<JSSVGPolylineElement*>(asObject(thisValue));
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGPolylineElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGPolylineElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGPolylineElement::s_info))
         return throwError(exec, TypeError);
     JSSVGPolylineElement* castedThisObj = static_cast<JSSVGPolylineElement*>(asObject(thisValue));
     SVGPolylineElement* imp = static_cast<SVGPolylineElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h
index 11f3cd4..6501a25 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPolylineElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPolylineElement_h
 #define JSSVGPolylineElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGPolylineElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGPolylineElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPolylineElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGPolylineElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,29 +64,29 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGPolylineElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPolylineElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPolylineElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPolylineElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPolylineElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGPolylineElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGPolylineElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGPolylineElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolylineElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolylineElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolylineElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPolylineElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPolylineElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPolylineElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPolylineElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolylineElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolylineElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolylineElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolylineElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolylineElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolylineElementPoints(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPolylineElementAnimatedPoints(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPolylineElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPolylineElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPolylineElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPolylineElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementPoints(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPolylineElementAnimatedPoints(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp
index 4ddc1b9..b586e60 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGPreserveAspectRatio.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGPreserveAspectRatio.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGPreserveAspectRatio)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGPreserveAspectRatio);
 
 /* Hash table */
 
@@ -88,13 +84,13 @@ public:
     JSSVGPreserveAspectRatioConstructor(ExecState* exec)
         : DOMObject(JSSVGPreserveAspectRatioConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGPreserveAspectRatioPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGPreserveAspectRatioPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -137,9 +133,9 @@ static const HashTable JSSVGPreserveAspectRatioPrototypeTable =
 
 const ClassInfo JSSVGPreserveAspectRatioPrototype::s_info = { "SVGPreserveAspectRatioPrototype", 0, &JSSVGPreserveAspectRatioPrototypeTable, 0 };
 
-JSObject* JSSVGPreserveAspectRatioPrototype::self(ExecState* exec)
+JSObject* JSSVGPreserveAspectRatioPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGPreserveAspectRatio>(exec);
+    return getDOMPrototype<JSSVGPreserveAspectRatio>(exec, globalObject);
 }
 
 bool JSSVGPreserveAspectRatioPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -159,12 +155,11 @@ JSSVGPreserveAspectRatio::JSSVGPreserveAspectRatio(PassRefPtr<Structure> structu
 JSSVGPreserveAspectRatio::~JSSVGPreserveAspectRatio()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGPreserveAspectRatio::createPrototype(ExecState* exec)
+JSObject* JSSVGPreserveAspectRatio::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGPreserveAspectRatioPrototype(JSSVGPreserveAspectRatioPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGPreserveAspectRatioPrototype(JSSVGPreserveAspectRatioPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGPreserveAspectRatio::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -172,127 +167,129 @@ bool JSSVGPreserveAspectRatio::getOwnPropertySlot(ExecState* exec, const Identif
     return getStaticValueSlot<JSSVGPreserveAspectRatio, Base>(exec, &JSSVGPreserveAspectRatioTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGPreserveAspectRatioAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPreserveAspectRatioAlign(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPreserveAspectRatio* imp = static_cast<SVGPreserveAspectRatio*>(static_cast<JSSVGPreserveAspectRatio*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->align());
 }
 
-JSValuePtr jsSVGPreserveAspectRatioMeetOrSlice(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPreserveAspectRatioMeetOrSlice(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGPreserveAspectRatio* imp = static_cast<SVGPreserveAspectRatio*>(static_cast<JSSVGPreserveAspectRatio*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->meetOrSlice());
 }
 
-JSValuePtr jsSVGPreserveAspectRatioConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGPreserveAspectRatioConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGPreserveAspectRatio*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSSVGPreserveAspectRatio::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGPreserveAspectRatio::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGPreserveAspectRatio, Base>(exec, propertyName, value, &JSSVGPreserveAspectRatioTable, this, slot);
 }
 
-void setJSSVGPreserveAspectRatioAlign(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPreserveAspectRatioAlign(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPreserveAspectRatio* imp = static_cast<SVGPreserveAspectRatio*>(static_cast<JSSVGPreserveAspectRatio*>(thisObject)->impl());
-    imp->setAlign(value->toInt32(exec));
+    imp->setAlign(value.toInt32(exec));
     if (static_cast<JSSVGPreserveAspectRatio*>(thisObject)->context())
         static_cast<JSSVGPreserveAspectRatio*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPreserveAspectRatio*>(thisObject)->impl()->associatedAttributeName());
 }
 
-void setJSSVGPreserveAspectRatioMeetOrSlice(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGPreserveAspectRatioMeetOrSlice(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGPreserveAspectRatio* imp = static_cast<SVGPreserveAspectRatio*>(static_cast<JSSVGPreserveAspectRatio*>(thisObject)->impl());
-    imp->setMeetOrSlice(value->toInt32(exec));
+    imp->setMeetOrSlice(value.toInt32(exec));
     if (static_cast<JSSVGPreserveAspectRatio*>(thisObject)->context())
         static_cast<JSSVGPreserveAspectRatio*>(thisObject)->context()->svgAttributeChanged(static_cast<JSSVGPreserveAspectRatio*>(thisObject)->impl()->associatedAttributeName());
 }
 
-JSValuePtr JSSVGPreserveAspectRatio::getConstructor(ExecState* exec)
+JSValue JSSVGPreserveAspectRatio::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGPreserveAspectRatioConstructor>(exec);
 }
 
 // Constant getters
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_NONE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_NONE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMIN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMIN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMIN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMIN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMIN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMIN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMID(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMID(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMID(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMID(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMID(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMID(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMAX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMAX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMAX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMAX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMAX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMAX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(10));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_MEETORSLICE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_MEETORSLICE_MEET(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_MEET(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGPreserveAspectRatioSVG_MEETORSLICE_SLICE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_SLICE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGPreserveAspectRatio* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGPreserveAspectRatio* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGPreserveAspectRatio>(exec, object, context);
 }
-SVGPreserveAspectRatio* toSVGPreserveAspectRatio(JSC::JSValuePtr value)
+SVGPreserveAspectRatio* toSVGPreserveAspectRatio(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGPreserveAspectRatio::s_info) ? static_cast<JSSVGPreserveAspectRatio*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGPreserveAspectRatio::s_info) ? static_cast<JSSVGPreserveAspectRatio*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h
index c16f2ce..d8c7fc8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGPreserveAspectRatio.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGPreserveAspectRatio_h
 #define JSSVGPreserveAspectRatio_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -37,18 +37,18 @@ class JSSVGPreserveAspectRatio : public DOMObject {
 public:
     JSSVGPreserveAspectRatio(PassRefPtr<JSC::Structure>, PassRefPtr<SVGPreserveAspectRatio>, SVGElement* context);
     virtual ~JSSVGPreserveAspectRatio();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     SVGPreserveAspectRatio* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -57,16 +57,17 @@ private:
     RefPtr<SVGPreserveAspectRatio > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGPreserveAspectRatio*, SVGElement* context);
-SVGPreserveAspectRatio* toSVGPreserveAspectRatio(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGPreserveAspectRatio*, SVGElement* context);
+SVGPreserveAspectRatio* toSVGPreserveAspectRatio(JSC::JSValue);
 
 class JSSVGPreserveAspectRatioPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -75,27 +76,27 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGPreserveAspectRatioAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPreserveAspectRatioAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPreserveAspectRatioMeetOrSlice(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGPreserveAspectRatioMeetOrSlice(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGPreserveAspectRatioConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioAlign(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPreserveAspectRatioAlign(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPreserveAspectRatioMeetOrSlice(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGPreserveAspectRatioMeetOrSlice(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGPreserveAspectRatioConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_NONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMIN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMIN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMIN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMID(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMID(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMID(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMAX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMAX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMAX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_MEETORSLICE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_MEETORSLICE_MEET(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGPreserveAspectRatioSVG_MEETORSLICE_SLICE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_NONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMIN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMIN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMIN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMID(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMID(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMID(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMINYMAX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMIDYMAX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_PRESERVEASPECTRATIO_XMAXYMAX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_MEET(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGPreserveAspectRatioSVG_MEETORSLICE_SLICE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.cpp
index 309f66e..b888704 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGRadialGradientElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGAnimatedLength.h"
 #include "SVGRadialGradientElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGRadialGradientElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGRadialGradientElement);
 
 /* Hash table */
 
@@ -73,9 +69,9 @@ static const HashTable JSSVGRadialGradientElementPrototypeTable =
 
 const ClassInfo JSSVGRadialGradientElementPrototype::s_info = { "SVGRadialGradientElementPrototype", 0, &JSSVGRadialGradientElementPrototypeTable, 0 };
 
-JSObject* JSSVGRadialGradientElementPrototype::self(ExecState* exec)
+JSObject* JSSVGRadialGradientElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGRadialGradientElement>(exec);
+    return getDOMPrototype<JSSVGRadialGradientElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGRadialGradientElement::s_info = { "SVGRadialGradientElement", &JSSVGGradientElement::s_info, &JSSVGRadialGradientElementTable, 0 };
@@ -85,9 +81,9 @@ JSSVGRadialGradientElement::JSSVGRadialGradientElement(PassRefPtr<Structure> str
 {
 }
 
-JSObject* JSSVGRadialGradientElement::createPrototype(ExecState* exec)
+JSObject* JSSVGRadialGradientElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGRadialGradientElementPrototype(JSSVGRadialGradientElementPrototype::createStructure(JSSVGGradientElementPrototype::self(exec)));
+    return new (exec) JSSVGRadialGradientElementPrototype(JSSVGRadialGradientElementPrototype::createStructure(JSSVGGradientElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGRadialGradientElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -95,36 +91,41 @@ bool JSSVGRadialGradientElement::getOwnPropertySlot(ExecState* exec, const Ident
     return getStaticValueSlot<JSSVGRadialGradientElement, Base>(exec, &JSSVGRadialGradientElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGRadialGradientElementCx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRadialGradientElementCx(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRadialGradientElement* imp = static_cast<SVGRadialGradientElement*>(static_cast<JSSVGRadialGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->cxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRadialGradientElementCy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRadialGradientElementCy(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRadialGradientElement* imp = static_cast<SVGRadialGradientElement*>(static_cast<JSSVGRadialGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->cyAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRadialGradientElementR(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRadialGradientElementR(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRadialGradientElement* imp = static_cast<SVGRadialGradientElement*>(static_cast<JSSVGRadialGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->rAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRadialGradientElementFx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRadialGradientElementFx(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRadialGradientElement* imp = static_cast<SVGRadialGradientElement*>(static_cast<JSSVGRadialGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->fxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRadialGradientElementFy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRadialGradientElementFy(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRadialGradientElement* imp = static_cast<SVGRadialGradientElement*>(static_cast<JSSVGRadialGradientElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->fyAnimated();
     return toJS(exec, obj.get(), imp);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h
index e8f853e..a0e34a5 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRadialGradientElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGRadialGradientElement_h
 #define JSSVGRadialGradientElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGGradientElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,12 +34,12 @@ class JSSVGRadialGradientElement : public JSSVGGradientElement {
     typedef JSSVGGradientElement Base;
 public:
     JSSVGRadialGradientElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGRadialGradientElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,8 +48,9 @@ public:
 
 
 class JSSVGRadialGradientElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGRadialGradientElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -57,11 +58,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGRadialGradientElementCx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRadialGradientElementCy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRadialGradientElementR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRadialGradientElementFx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRadialGradientElementFy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRadialGradientElementCx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRadialGradientElementCy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRadialGradientElementR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRadialGradientElementFx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRadialGradientElementFy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRect.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGRect.cpp
index d343a68..8e857f2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRect.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRect.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGRect.h"
 
-#include <wtf/GetPtr.h>
-
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGRect)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGRect);
 
 /* Hash table */
 
@@ -71,9 +67,9 @@ static const HashTable JSSVGRectPrototypeTable =
 
 const ClassInfo JSSVGRectPrototype::s_info = { "SVGRectPrototype", 0, &JSSVGRectPrototypeTable, 0 };
 
-JSObject* JSSVGRectPrototype::self(ExecState* exec)
+JSObject* JSSVGRectPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGRect>(exec);
+    return getDOMPrototype<JSSVGRect>(exec, globalObject);
 }
 
 const ClassInfo JSSVGRect::s_info = { "SVGRect", 0, &JSSVGRectTable, 0 };
@@ -89,12 +85,11 @@ JSSVGRect::~JSSVGRect()
 {
     JSSVGDynamicPODTypeWrapperCache<FloatRect, SVGAnimatedRect>::forgetWrapper(m_impl.get());
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGRect::createPrototype(ExecState* exec)
+JSObject* JSSVGRect::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGRectPrototype(JSSVGRectPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGRectPrototype(JSSVGRectPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGRect::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -102,70 +97,74 @@ bool JSSVGRect::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSSVGRect, Base>(exec, &JSSVGRectTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGRectX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     FloatRect imp(*static_cast<JSSVGRect*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.x());
 }
 
-JSValuePtr jsSVGRectY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     FloatRect imp(*static_cast<JSSVGRect*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.y());
 }
 
-JSValuePtr jsSVGRectWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     FloatRect imp(*static_cast<JSSVGRect*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.width());
 }
 
-JSValuePtr jsSVGRectHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     FloatRect imp(*static_cast<JSSVGRect*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.height());
 }
 
-void JSSVGRect::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGRect::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGRect, Base>(exec, propertyName, value, &JSSVGRectTable, this, slot);
 }
 
-void setJSSVGRectX(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGRectX(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     FloatRect imp(*static_cast<JSSVGRect*>(thisObject)->impl());
-    imp.setX(value->toFloat(exec));
+    imp.setX(value.toFloat(exec));
         static_cast<JSSVGRect*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGRect*>(thisObject)->context());
 }
 
-void setJSSVGRectY(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGRectY(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     FloatRect imp(*static_cast<JSSVGRect*>(thisObject)->impl());
-    imp.setY(value->toFloat(exec));
+    imp.setY(value.toFloat(exec));
         static_cast<JSSVGRect*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGRect*>(thisObject)->context());
 }
 
-void setJSSVGRectWidth(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGRectWidth(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     FloatRect imp(*static_cast<JSSVGRect*>(thisObject)->impl());
-    imp.setWidth(value->toFloat(exec));
+    imp.setWidth(value.toFloat(exec));
         static_cast<JSSVGRect*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGRect*>(thisObject)->context());
 }
 
-void setJSSVGRectHeight(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGRectHeight(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     FloatRect imp(*static_cast<JSSVGRect*>(thisObject)->impl());
-    imp.setHeight(value->toFloat(exec));
+    imp.setHeight(value.toFloat(exec));
         static_cast<JSSVGRect*>(thisObject)->impl()->commitChange(imp, static_cast<JSSVGRect*>(thisObject)->context());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<FloatRect>* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<FloatRect>* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGRect, JSSVGPODTypeWrapper<FloatRect> >(exec, object, context);
 }
-FloatRect toSVGRect(JSC::JSValuePtr value)
+FloatRect toSVGRect(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGRect::s_info) ? (FloatRect) *static_cast<JSSVGRect*>(asObject(value))->impl() : FloatRect();
+    return value.isObject(&JSSVGRect::s_info) ? (FloatRect) *static_cast<JSSVGRect*>(asObject(value))->impl() : FloatRect();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h
index 3e85f5d..b699a03 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRect.h
@@ -21,14 +21,14 @@
 #ifndef JSSVGRect_h
 #define JSSVGRect_h
 
-
 #if ENABLE(SVG)
 
+#include "FloatRect.h"
 #include "JSDOMBinding.h"
+#include "JSSVGPODTypeWrapper.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
-#include "FloatRect.h"
-#include "JSSVGPODTypeWrapper.h"
 
 namespace WebCore {
 
@@ -37,13 +37,13 @@ class JSSVGRect : public DOMObject {
 public:
     JSSVGRect(PassRefPtr<JSC::Structure>, PassRefPtr<JSSVGPODTypeWrapper<FloatRect> >, SVGElement* context);
     virtual ~JSSVGRect();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -56,12 +56,13 @@ private:
     RefPtr<JSSVGPODTypeWrapper<FloatRect> > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, JSSVGPODTypeWrapper<FloatRect>*, SVGElement* context);
-FloatRect toSVGRect(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, JSSVGPODTypeWrapper<FloatRect>*, SVGElement* context);
+FloatRect toSVGRect(JSC::JSValue);
 
 class JSSVGRectPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGRectPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -69,14 +70,14 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGRectX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGRectX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGRectY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGRectY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGRectWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGRectWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGRectHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGRectHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGRectX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGRectX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGRectY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGRectY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGRectWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGRectWidth(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGRectHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGRectHeight(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.cpp
index 6fac4c5..2f97100 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGRectElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -45,15 +41,15 @@
 #include "SVGElement.h"
 #include "SVGRectElement.h"
 #include "SVGStringList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGRectElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGRectElement);
 
 /* Hash table */
 
@@ -108,9 +104,9 @@ static const HashTable JSSVGRectElementPrototypeTable =
 
 const ClassInfo JSSVGRectElementPrototype::s_info = { "SVGRectElementPrototype", 0, &JSSVGRectElementPrototypeTable, 0 };
 
-JSObject* JSSVGRectElementPrototype::self(ExecState* exec)
+JSObject* JSSVGRectElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGRectElement>(exec);
+    return getDOMPrototype<JSSVGRectElement>(exec, globalObject);
 }
 
 bool JSSVGRectElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -125,9 +121,9 @@ JSSVGRectElement::JSSVGRectElement(PassRefPtr<Structure> structure, PassRefPtr<S
 {
 }
 
-JSObject* JSSVGRectElement::createPrototype(ExecState* exec)
+JSObject* JSSVGRectElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGRectElementPrototype(JSSVGRectElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGRectElementPrototype(JSSVGRectElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGRectElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -135,207 +131,230 @@ bool JSSVGRectElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGRectElement, Base>(exec, &JSSVGRectElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGRectElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRectElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRectElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRectElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRectElementRx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementRx(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->rxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRectElementRy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementRy(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->ryAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRectElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGRectElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGRectElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGRectElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGRectElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGRectElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRectElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRectElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGRectElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGRectElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGRectElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRectElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGRectElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGRectElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGRectElement, Base>(exec, propertyName, value, &JSSVGRectElementTable, this, slot);
 }
 
-void setJSSVGRectElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGRectElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGRectElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGRectElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGRectElement* imp = static_cast<SVGRectElement*>(static_cast<JSSVGRectElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGRectElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGRectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGRectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGRectElement* castedThisObj = static_cast<JSSVGRectElement*>(asObject(thisValue));
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGRectElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGRectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGRectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGRectElement* castedThisObj = static_cast<JSSVGRectElement*>(asObject(thisValue));
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGRectElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGRectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGRectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGRectElement* castedThisObj = static_cast<JSSVGRectElement*>(asObject(thisValue));
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGRectElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGRectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGRectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGRectElement* castedThisObj = static_cast<JSSVGRectElement*>(asObject(thisValue));
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGRectElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGRectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGRectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGRectElement* castedThisObj = static_cast<JSSVGRectElement*>(asObject(thisValue));
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGRectElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGRectElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGRectElement::s_info))
         return throwError(exec, TypeError);
     JSSVGRectElement* castedThisObj = static_cast<JSSVGRectElement*>(asObject(thisValue));
     SVGRectElement* imp = static_cast<SVGRectElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h
index f4bb5a9b..342b4be 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRectElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGRectElement_h
 #define JSSVGRectElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGRectElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGRectElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGRectElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGRectElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,33 +64,33 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGRectElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGRectElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGRectElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGRectElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGRectElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGRectElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGRectElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGRectElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementRx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementRy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGRectElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGRectElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGRectElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGRectElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRectElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementRx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementRy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGRectElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGRectElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGRectElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGRectElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRectElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp
index e4f1ca4..97df330 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.cpp
@@ -20,23 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGRenderingIntent.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGRenderingIntent.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGRenderingIntent)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGRenderingIntent);
 
 /* Hash table */
 
@@ -78,13 +73,13 @@ public:
     JSSVGRenderingIntentConstructor(ExecState* exec)
         : DOMObject(JSSVGRenderingIntentConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGRenderingIntentPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGRenderingIntentPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -119,9 +114,9 @@ static const HashTable JSSVGRenderingIntentPrototypeTable =
 
 const ClassInfo JSSVGRenderingIntentPrototype::s_info = { "SVGRenderingIntentPrototype", 0, &JSSVGRenderingIntentPrototypeTable, 0 };
 
-JSObject* JSSVGRenderingIntentPrototype::self(ExecState* exec)
+JSObject* JSSVGRenderingIntentPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGRenderingIntent>(exec);
+    return getDOMPrototype<JSSVGRenderingIntent>(exec, globalObject);
 }
 
 bool JSSVGRenderingIntentPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -141,12 +136,11 @@ JSSVGRenderingIntent::JSSVGRenderingIntent(PassRefPtr<Structure> structure, Pass
 JSSVGRenderingIntent::~JSSVGRenderingIntent()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGRenderingIntent::createPrototype(ExecState* exec)
+JSObject* JSSVGRenderingIntent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGRenderingIntentPrototype(JSSVGRenderingIntentPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGRenderingIntentPrototype(JSSVGRenderingIntentPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGRenderingIntent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -154,54 +148,54 @@ bool JSSVGRenderingIntent::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGRenderingIntent, Base>(exec, &JSSVGRenderingIntentTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGRenderingIntentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGRenderingIntentConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGRenderingIntent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGRenderingIntent::getConstructor(ExecState* exec)
+JSValue JSSVGRenderingIntent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGRenderingIntentConstructor>(exec);
 }
 
 // Constant getters
 
-JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGRenderingIntentRENDERING_INTENT_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_AUTO(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGRenderingIntentRENDERING_INTENT_AUTO(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_PERCEPTUAL(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGRenderingIntentRENDERING_INTENT_PERCEPTUAL(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_RELATIVE_COLORIMETRIC(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGRenderingIntentRENDERING_INTENT_RELATIVE_COLORIMETRIC(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_SATURATION(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGRenderingIntentRENDERING_INTENT_SATURATION(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_ABSOLUTE_COLORIMETRIC(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGRenderingIntentRENDERING_INTENT_ABSOLUTE_COLORIMETRIC(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGRenderingIntent* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGRenderingIntent* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGRenderingIntent>(exec, object, context);
 }
-SVGRenderingIntent* toSVGRenderingIntent(JSC::JSValuePtr value)
+SVGRenderingIntent* toSVGRenderingIntent(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGRenderingIntent::s_info) ? static_cast<JSSVGRenderingIntent*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGRenderingIntent::s_info) ? static_cast<JSSVGRenderingIntent*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h
index 9a60929..22aff9c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGRenderingIntent.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGRenderingIntent_h
 #define JSSVGRenderingIntent_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -37,17 +37,17 @@ class JSSVGRenderingIntent : public DOMObject {
 public:
     JSSVGRenderingIntent(PassRefPtr<JSC::Structure>, PassRefPtr<SVGRenderingIntent>, SVGElement* context);
     virtual ~JSSVGRenderingIntent();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     SVGRenderingIntent* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -56,16 +56,17 @@ private:
     RefPtr<SVGRenderingIntent > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGRenderingIntent*, SVGElement* context);
-SVGRenderingIntent* toSVGRenderingIntent(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGRenderingIntent*, SVGElement* context);
+SVGRenderingIntent* toSVGRenderingIntent(JSC::JSValue);
 
 class JSSVGRenderingIntentPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -74,15 +75,15 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGRenderingIntentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRenderingIntentConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_AUTO(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_PERCEPTUAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_RELATIVE_COLORIMETRIC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_SATURATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGRenderingIntentRENDERING_INTENT_ABSOLUTE_COLORIMETRIC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_AUTO(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_PERCEPTUAL(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_RELATIVE_COLORIMETRIC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_SATURATION(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGRenderingIntentRENDERING_INTENT_ABSOLUTE_COLORIMETRIC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.cpp
index f7dc4c2..072c0cf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGSVGElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -58,16 +54,16 @@
 #include "SVGSVGElement.h"
 #include "SVGStringList.h"
 #include "SVGTransform.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGSVGElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGSVGElement);
 
 /* Hash table */
 
@@ -157,9 +153,9 @@ static const HashTable JSSVGSVGElementPrototypeTable =
 
 const ClassInfo JSSVGSVGElementPrototype::s_info = { "SVGSVGElementPrototype", 0, &JSSVGSVGElementPrototypeTable, 0 };
 
-JSObject* JSSVGSVGElementPrototype::self(ExecState* exec)
+JSObject* JSSVGSVGElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGSVGElement>(exec);
+    return getDOMPrototype<JSSVGSVGElement>(exec, globalObject);
 }
 
 bool JSSVGSVGElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -174,9 +170,9 @@ JSSVGSVGElement::JSSVGSVGElement(PassRefPtr<Structure> structure, PassRefPtr<SVG
 {
 }
 
-JSObject* JSSVGSVGElement::createPrototype(ExecState* exec)
+JSObject* JSSVGSVGElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGSVGElementPrototype(JSSVGSVGElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGSVGElementPrototype(JSSVGSVGElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGSVGElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -184,253 +180,283 @@ bool JSSVGSVGElement::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSSVGSVGElement, Base>(exec, &JSSVGSVGElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGSVGElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSVGElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSVGElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSVGElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSVGElementContentScriptType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementContentScriptType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->contentScriptType());
 }
 
-JSValuePtr jsSVGSVGElementContentStyleType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementContentStyleType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->contentStyleType());
 }
 
-JSValuePtr jsSVGSVGElementViewport(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementViewport(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->viewport()).get(), imp);
 }
 
-JSValuePtr jsSVGSVGElementPixelUnitToMillimeterX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementPixelUnitToMillimeterX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->pixelUnitToMillimeterX());
 }
 
-JSValuePtr jsSVGSVGElementPixelUnitToMillimeterY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementPixelUnitToMillimeterY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->pixelUnitToMillimeterY());
 }
 
-JSValuePtr jsSVGSVGElementScreenPixelToMillimeterX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementScreenPixelToMillimeterX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->screenPixelToMillimeterX());
 }
 
-JSValuePtr jsSVGSVGElementScreenPixelToMillimeterY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementScreenPixelToMillimeterY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->screenPixelToMillimeterY());
 }
 
-JSValuePtr jsSVGSVGElementUseCurrentView(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementUseCurrentView(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->useCurrentView());
 }
 
-JSValuePtr jsSVGSVGElementCurrentScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementCurrentScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->currentScale());
 }
 
-JSValuePtr jsSVGSVGElementCurrentTranslate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementCurrentTranslate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, JSSVGStaticPODTypeWrapperWithParent<FloatPoint, SVGSVGElement>::create(imp, &SVGSVGElement::currentTranslate, &SVGSVGElement::setCurrentTranslate).get(), imp);
 }
 
-JSValuePtr jsSVGSVGElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGSVGElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGSVGElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGSVGElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGSVGElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGSVGElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSVGElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSVGElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGSVGElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGSVGElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-JSValuePtr jsSVGSVGElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedRect> obj = imp->viewBoxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSVGElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedPreserveAspectRatio> obj = imp->preserveAspectRatioAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSVGElementZoomAndPan(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSVGElementZoomAndPan(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->zoomAndPan());
 }
 
-void JSSVGSVGElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGSVGElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGSVGElement, Base>(exec, propertyName, value, &JSSVGSVGElementTable, this, slot);
 }
 
-void setJSSVGSVGElementContentScriptType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGSVGElementContentScriptType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(thisObject)->impl());
-    imp->setContentScriptType(value->toString(exec));
+    imp->setContentScriptType(value.toString(exec));
 }
 
-void setJSSVGSVGElementContentStyleType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGSVGElementContentStyleType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(thisObject)->impl());
-    imp->setContentStyleType(value->toString(exec));
+    imp->setContentStyleType(value.toString(exec));
 }
 
-void setJSSVGSVGElementUseCurrentView(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGSVGElementUseCurrentView(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(thisObject)->impl());
-    imp->setUseCurrentView(value->toBoolean(exec));
+    imp->setUseCurrentView(value.toBoolean(exec));
 }
 
-void setJSSVGSVGElementCurrentScale(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGSVGElementCurrentScale(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(thisObject)->impl());
-    imp->setCurrentScale(value->toFloat(exec));
+    imp->setCurrentScale(value.toFloat(exec));
 }
 
-void setJSSVGSVGElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGSVGElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGSVGElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGSVGElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-void setJSSVGSVGElementZoomAndPan(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGSVGElementZoomAndPan(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(static_cast<JSSVGSVGElement*>(thisObject)->impl());
-    imp->setZoomAndPan(value->toInt32(exec));
+    imp->setZoomAndPan(value.toInt32(exec));
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionSuspendRedraw(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionSuspendRedraw(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
-    unsigned maxWaitMilliseconds = args.at(exec, 0)->toInt32(exec);
+    unsigned maxWaitMilliseconds = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->suspendRedraw(maxWaitMilliseconds));
+    JSC::JSValue result = jsNumber(exec, imp->suspendRedraw(maxWaitMilliseconds));
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionUnsuspendRedraw(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionUnsuspendRedraw(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned suspendHandleId = args.at(exec, 0)->toInt32(exec);
+    unsigned suspendHandleId = args.at(0).toInt32(exec);
 
     imp->unsuspendRedraw(suspendHandleId, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionUnsuspendRedrawAll(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionUnsuspendRedrawAll(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -439,9 +465,10 @@ JSValuePtr jsSVGSVGElementPrototypeFunctionUnsuspendRedrawAll(ExecState* exec, J
     return jsUndefined();
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionForceRedraw(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionForceRedraw(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -450,9 +477,10 @@ JSValuePtr jsSVGSVGElementPrototypeFunctionForceRedraw(ExecState* exec, JSObject
     return jsUndefined();
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionPauseAnimations(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionPauseAnimations(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -461,9 +489,10 @@ JSValuePtr jsSVGSVGElementPrototypeFunctionPauseAnimations(ExecState* exec, JSOb
     return jsUndefined();
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionUnpauseAnimations(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionUnpauseAnimations(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -472,101 +501,109 @@ JSValuePtr jsSVGSVGElementPrototypeFunctionUnpauseAnimations(ExecState* exec, JS
     return jsUndefined();
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionAnimationsPaused(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionAnimationsPaused(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->animationsPaused());
+    JSC::JSValue result = jsBoolean(imp->animationsPaused());
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionGetCurrentTime(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetCurrentTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getCurrentTime());
+    JSC::JSValue result = jsNumber(exec, imp->getCurrentTime());
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionSetCurrentTime(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionSetCurrentTime(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
-    float seconds = args.at(exec, 0)->toFloat(exec);
+    float seconds = args.at(0).toFloat(exec);
 
     imp->setCurrentTime(seconds);
     return jsUndefined();
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionGetIntersectionList(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetIntersectionList(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
-    FloatRect rect = toSVGRect(args.at(exec, 0));
-    SVGElement* referenceElement = toSVGElement(args.at(exec, 1));
+    FloatRect rect = toSVGRect(args.at(0));
+    SVGElement* referenceElement = toSVGElement(args.at(1));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getIntersectionList(rect, referenceElement)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getIntersectionList(rect, referenceElement)));
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionGetEnclosureList(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetEnclosureList(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
-    FloatRect rect = toSVGRect(args.at(exec, 0));
-    SVGElement* referenceElement = toSVGElement(args.at(exec, 1));
+    FloatRect rect = toSVGRect(args.at(0));
+    SVGElement* referenceElement = toSVGElement(args.at(1));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getEnclosureList(rect, referenceElement)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getEnclosureList(rect, referenceElement)));
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionCheckIntersection(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCheckIntersection(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
-    SVGElement* element = toSVGElement(args.at(exec, 0));
-    FloatRect rect = toSVGRect(args.at(exec, 1));
+    SVGElement* element = toSVGElement(args.at(0));
+    FloatRect rect = toSVGRect(args.at(1));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->checkIntersection(element, rect));
+    JSC::JSValue result = jsBoolean(imp->checkIntersection(element, rect));
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionCheckEnclosure(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCheckEnclosure(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
-    SVGElement* element = toSVGElement(args.at(exec, 0));
-    FloatRect rect = toSVGRect(args.at(exec, 1));
+    SVGElement* element = toSVGElement(args.at(0));
+    FloatRect rect = toSVGRect(args.at(1));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->checkEnclosure(element, rect));
+    JSC::JSValue result = jsBoolean(imp->checkEnclosure(element, rect));
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionDeselectAll(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionDeselectAll(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
@@ -575,193 +612,207 @@ JSValuePtr jsSVGSVGElementPrototypeFunctionDeselectAll(ExecState* exec, JSObject
     return jsUndefined();
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGNumber(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGNumber(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->createSVGNumber()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<float>::create(imp->createSVGNumber()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGLength(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGLength(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->createSVGLength()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGLength>::create(imp->createSVGLength()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGAngle(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGAngle(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createSVGAngle()), imp);
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createSVGAngle()), imp);
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGPoint(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGPoint(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->createSVGPoint()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->createSVGPoint()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGMatrix(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGMatrix(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->createSVGMatrix()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->createSVGMatrix()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGRect(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGRect(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->createSVGRect()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->createSVGRect()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGTransform(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGTransform(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->createSVGTransform()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->createSVGTransform()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGTransformFromMatrix(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGTransformFromMatrix(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
-    TransformationMatrix matrix = toSVGMatrix(args.at(exec, 0));
+    TransformationMatrix matrix = toSVGMatrix(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->createSVGTransformFromMatrix(matrix)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->createSVGTransformFromMatrix(matrix)).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSVGElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSVGElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSVGElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSVGElement* castedThisObj = static_cast<JSSVGSVGElement*>(asObject(thisValue));
     SVGSVGElement* imp = static_cast<SVGSVGElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsSVGSVGElementSVG_ZOOMANDPAN_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGSVGElementSVG_ZOOMANDPAN_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGSVGElementSVG_ZOOMANDPAN_DISABLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGSVGElementSVG_ZOOMANDPAN_DISABLE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGSVGElementSVG_ZOOMANDPAN_MAGNIFY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGSVGElementSVG_ZOOMANDPAN_MAGNIFY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h
index 954c91e..7701efe 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSVGElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGSVGElement_h
 #define JSSVGSVGElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGSVGElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGSVGElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGSVGElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGSVGElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,75 +64,75 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionSuspendRedraw(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionUnsuspendRedraw(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionUnsuspendRedrawAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionForceRedraw(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionPauseAnimations(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionUnpauseAnimations(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionAnimationsPaused(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionGetCurrentTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionSetCurrentTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionGetIntersectionList(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionGetEnclosureList(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionCheckIntersection(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionCheckEnclosure(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionDeselectAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGNumber(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGAngle(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGPoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGMatrix(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGTransform(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionCreateSVGTransformFromMatrix(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSVGElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionSuspendRedraw(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionUnsuspendRedraw(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionUnsuspendRedrawAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionForceRedraw(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionPauseAnimations(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionUnpauseAnimations(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionAnimationsPaused(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetCurrentTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionSetCurrentTime(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetIntersectionList(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetEnclosureList(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCheckIntersection(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCheckEnclosure(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionDeselectAll(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGNumber(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGAngle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGPoint(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGMatrix(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGRect(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGTransform(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionCreateSVGTransformFromMatrix(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSVGElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGSVGElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementContentScriptType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGSVGElementContentScriptType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGSVGElementContentStyleType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGSVGElementContentStyleType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGSVGElementViewport(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementPixelUnitToMillimeterX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementPixelUnitToMillimeterY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementScreenPixelToMillimeterX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementScreenPixelToMillimeterY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementUseCurrentView(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGSVGElementUseCurrentView(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGSVGElementCurrentScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGSVGElementCurrentScale(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGSVGElementCurrentTranslate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGSVGElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGSVGElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGSVGElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGSVGElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementZoomAndPan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGSVGElementZoomAndPan(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGSVGElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementContentScriptType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGSVGElementContentScriptType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGSVGElementContentStyleType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGSVGElementContentStyleType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGSVGElementViewport(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementPixelUnitToMillimeterX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementPixelUnitToMillimeterY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementScreenPixelToMillimeterX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementScreenPixelToMillimeterY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementUseCurrentView(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGSVGElementUseCurrentView(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGSVGElementCurrentScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGSVGElementCurrentScale(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGSVGElementCurrentTranslate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGSVGElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGSVGElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGSVGElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGSVGElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementZoomAndPan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGSVGElementZoomAndPan(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 // Constants
 
-JSC::JSValuePtr jsSVGSVGElementSVG_ZOOMANDPAN_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementSVG_ZOOMANDPAN_DISABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSVGElementSVG_ZOOMANDPAN_MAGNIFY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementSVG_ZOOMANDPAN_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementSVG_ZOOMANDPAN_DISABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSVGElementSVG_ZOOMANDPAN_MAGNIFY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.cpp
index 0ebf205..da7b486 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.cpp
@@ -20,26 +20,22 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGScriptElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGAnimatedBoolean.h"
 #include "JSSVGAnimatedString.h"
 #include "KURL.h"
 #include "SVGScriptElement.h"
-
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGScriptElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGScriptElement);
 
 /* Hash table */
 
@@ -74,9 +70,9 @@ static const HashTable JSSVGScriptElementPrototypeTable =
 
 const ClassInfo JSSVGScriptElementPrototype::s_info = { "SVGScriptElementPrototype", 0, &JSSVGScriptElementPrototypeTable, 0 };
 
-JSObject* JSSVGScriptElementPrototype::self(ExecState* exec)
+JSObject* JSSVGScriptElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGScriptElement>(exec);
+    return getDOMPrototype<JSSVGScriptElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGScriptElement::s_info = { "SVGScriptElement", &JSSVGElement::s_info, &JSSVGScriptElementTable, 0 };
@@ -86,9 +82,9 @@ JSSVGScriptElement::JSSVGScriptElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSSVGScriptElement::createPrototype(ExecState* exec)
+JSObject* JSSVGScriptElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGScriptElementPrototype(JSSVGScriptElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGScriptElementPrototype(JSSVGScriptElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGScriptElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -96,32 +92,35 @@ bool JSSVGScriptElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGScriptElement, Base>(exec, &JSSVGScriptElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGScriptElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGScriptElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGScriptElement* imp = static_cast<SVGScriptElement*>(static_cast<JSSVGScriptElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsSVGScriptElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGScriptElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGScriptElement* imp = static_cast<SVGScriptElement*>(static_cast<JSSVGScriptElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGScriptElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGScriptElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGScriptElement* imp = static_cast<SVGScriptElement*>(static_cast<JSSVGScriptElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-void JSSVGScriptElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGScriptElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGScriptElement, Base>(exec, propertyName, value, &JSSVGScriptElementTable, this, slot);
 }
 
-void setJSSVGScriptElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGScriptElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGScriptElement* imp = static_cast<SVGScriptElement*>(static_cast<JSSVGScriptElement*>(thisObject)->impl());
     imp->setType(valueToStringWithNullCheck(exec, value));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h
index 9fdfc4d..0d7eb3a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGScriptElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGScriptElement_h
 #define JSSVGScriptElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGScriptElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGScriptElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGScriptElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGScriptElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGScriptElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,10 +59,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGScriptElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGScriptElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGScriptElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGScriptElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGScriptElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGScriptElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGScriptElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGScriptElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.cpp
index 60b0259..e54b57f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG_ANIMATION)
 
-#include "SVGElement.h"
 #include "JSSVGSetElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGSetElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGSetElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGSetElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +49,9 @@ static const HashTable JSSVGSetElementPrototypeTable =
 
 const ClassInfo JSSVGSetElementPrototype::s_info = { "SVGSetElementPrototype", 0, &JSSVGSetElementPrototypeTable, 0 };
 
-JSObject* JSSVGSetElementPrototype::self(ExecState* exec)
+JSObject* JSSVGSetElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGSetElement>(exec);
+    return getDOMPrototype<JSSVGSetElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGSetElement::s_info = { "SVGSetElement", &JSSVGAnimationElement::s_info, 0, 0 };
@@ -65,9 +61,9 @@ JSSVGSetElement::JSSVGSetElement(PassRefPtr<Structure> structure, PassRefPtr<SVG
 {
 }
 
-JSObject* JSSVGSetElement::createPrototype(ExecState* exec)
+JSObject* JSSVGSetElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGSetElementPrototype(JSSVGSetElementPrototype::createStructure(JSSVGAnimationElementPrototype::self(exec)));
+    return new (exec) JSSVGSetElementPrototype(JSSVGSetElementPrototype::createStructure(JSSVGAnimationElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.h
index 6d80905..23e7382 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSetElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGSetElement_h
 #define JSSVGSetElement_h
 
-
 #if ENABLE(SVG_ANIMATION)
 
 #include "JSSVGAnimationElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,7 +34,7 @@ class JSSVGSetElement : public JSSVGAnimationElement {
     typedef JSSVGAnimationElement Base;
 public:
     JSSVGSetElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGSetElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGSetElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGSetElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.cpp
index 92659da..8308fcb 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGStopElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -36,14 +32,14 @@
 #include "JSSVGAnimatedNumber.h"
 #include "JSSVGAnimatedString.h"
 #include "SVGStopElement.h"
-
 #include <runtime/Error.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGStopElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGStopElement);
 
 /* Hash table */
 
@@ -79,9 +75,9 @@ static const HashTable JSSVGStopElementPrototypeTable =
 
 const ClassInfo JSSVGStopElementPrototype::s_info = { "SVGStopElementPrototype", 0, &JSSVGStopElementPrototypeTable, 0 };
 
-JSObject* JSSVGStopElementPrototype::self(ExecState* exec)
+JSObject* JSSVGStopElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGStopElement>(exec);
+    return getDOMPrototype<JSSVGStopElement>(exec, globalObject);
 }
 
 bool JSSVGStopElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -96,9 +92,9 @@ JSSVGStopElement::JSSVGStopElement(PassRefPtr<Structure> structure, PassRefPtr<S
 {
 }
 
-JSObject* JSSVGStopElement::createPrototype(ExecState* exec)
+JSObject* JSSVGStopElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGStopElementPrototype(JSSVGStopElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGStopElementPrototype(JSSVGStopElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGStopElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -106,36 +102,40 @@ bool JSSVGStopElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGStopElement, Base>(exec, &JSSVGStopElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGStopElementOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStopElementOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGStopElement* imp = static_cast<SVGStopElement*>(static_cast<JSSVGStopElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumber> obj = imp->offsetAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGStopElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStopElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGStopElement* imp = static_cast<SVGStopElement*>(static_cast<JSSVGStopElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGStopElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStopElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGStopElement* imp = static_cast<SVGStopElement*>(static_cast<JSSVGStopElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGStopElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGStopElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGStopElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGStopElement::s_info))
         return throwError(exec, TypeError);
     JSSVGStopElement* castedThisObj = static_cast<JSSVGStopElement*>(asObject(thisValue));
     SVGStopElement* imp = static_cast<SVGStopElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h
index 525d8bc..56f181a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStopElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGStopElement_h
 #define JSSVGStopElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,12 +34,12 @@ class JSSVGStopElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGStopElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGStopElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGStopElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,12 +63,12 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGStopElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGStopElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGStopElementOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGStopElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGStopElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGStopElementOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGStopElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGStopElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.cpp
index b8de1bf..ee9cf18 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.cpp
@@ -20,26 +20,22 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGStringList.h"
 
-#include <wtf/GetPtr.h>
-
 #include "KURL.h"
 #include "SVGStringList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGStringList)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGStringList);
 
 /* Hash table */
 
@@ -79,9 +75,9 @@ static const HashTable JSSVGStringListPrototypeTable =
 
 const ClassInfo JSSVGStringListPrototype::s_info = { "SVGStringListPrototype", 0, &JSSVGStringListPrototypeTable, 0 };
 
-JSObject* JSSVGStringListPrototype::self(ExecState* exec)
+JSObject* JSSVGStringListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGStringList>(exec);
+    return getDOMPrototype<JSSVGStringList>(exec, globalObject);
 }
 
 bool JSSVGStringListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -101,12 +97,11 @@ JSSVGStringList::JSSVGStringList(PassRefPtr<Structure> structure, PassRefPtr<SVG
 JSSVGStringList::~JSSVGStringList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGStringList::createPrototype(ExecState* exec)
+JSObject* JSSVGStringList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGStringListPrototype(JSSVGStringListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGStringListPrototype(JSSVGStringListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGStringList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -114,15 +109,17 @@ bool JSSVGStringList::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSSVGStringList, Base>(exec, &JSSVGStringListTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGStringListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStringListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGStringList* imp = static_cast<SVGStringList*>(static_cast<JSSVGStringList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->numberOfItems());
 }
 
-JSValuePtr jsSVGStringListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGStringList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGStringList::s_info))
         return throwError(exec, TypeError);
     JSSVGStringList* castedThisObj = static_cast<JSSVGStringList*>(asObject(thisValue));
     SVGStringList* imp = static_cast<SVGStringList*>(castedThisObj->impl());
@@ -133,105 +130,111 @@ JSValuePtr jsSVGStringListPrototypeFunctionClear(ExecState* exec, JSObject*, JSV
     return jsUndefined();
 }
 
-JSValuePtr jsSVGStringListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGStringList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGStringList::s_info))
         return throwError(exec, TypeError);
     JSSVGStringList* castedThisObj = static_cast<JSSVGStringList*>(asObject(thisValue));
     SVGStringList* imp = static_cast<SVGStringList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& item = args.at(exec, 0)->toString(exec);
+    const UString& item = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->initialize(item, ec));
+    JSC::JSValue result = jsString(exec, imp->initialize(item, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGStringListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGStringList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGStringList::s_info))
         return throwError(exec, TypeError);
     JSSVGStringList* castedThisObj = static_cast<JSSVGStringList*>(asObject(thisValue));
     SVGStringList* imp = static_cast<SVGStringList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->getItem(index, ec));
+    JSC::JSValue result = jsString(exec, imp->getItem(index, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGStringListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGStringList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGStringList::s_info))
         return throwError(exec, TypeError);
     JSSVGStringList* castedThisObj = static_cast<JSSVGStringList*>(asObject(thisValue));
     SVGStringList* imp = static_cast<SVGStringList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& item = args.at(exec, 0)->toString(exec);
-    unsigned index = args.at(exec, 1)->toInt32(exec);
+    const UString& item = args.at(0).toString(exec);
+    unsigned index = args.at(1).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->insertItemBefore(item, index, ec));
+    JSC::JSValue result = jsString(exec, imp->insertItemBefore(item, index, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGStringListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGStringList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGStringList::s_info))
         return throwError(exec, TypeError);
     JSSVGStringList* castedThisObj = static_cast<JSSVGStringList*>(asObject(thisValue));
     SVGStringList* imp = static_cast<SVGStringList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& item = args.at(exec, 0)->toString(exec);
-    unsigned index = args.at(exec, 1)->toInt32(exec);
+    const UString& item = args.at(0).toString(exec);
+    unsigned index = args.at(1).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->replaceItem(item, index, ec));
+    JSC::JSValue result = jsString(exec, imp->replaceItem(item, index, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGStringListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGStringList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGStringList::s_info))
         return throwError(exec, TypeError);
     JSSVGStringList* castedThisObj = static_cast<JSSVGStringList*>(asObject(thisValue));
     SVGStringList* imp = static_cast<SVGStringList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->removeItem(index, ec));
+    JSC::JSValue result = jsString(exec, imp->removeItem(index, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGStringListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGStringList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGStringList::s_info))
         return throwError(exec, TypeError);
     JSSVGStringList* castedThisObj = static_cast<JSSVGStringList*>(asObject(thisValue));
     SVGStringList* imp = static_cast<SVGStringList*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& item = args.at(exec, 0)->toString(exec);
+    const UString& item = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->appendItem(item, ec));
+    JSC::JSValue result = jsString(exec, imp->appendItem(item, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGStringList* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGStringList* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGStringList>(exec, object, context);
 }
-SVGStringList* toSVGStringList(JSC::JSValuePtr value)
+SVGStringList* toSVGStringList(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGStringList::s_info) ? static_cast<JSSVGStringList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGStringList::s_info) ? static_cast<JSSVGStringList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h
index b909d62..e7b631e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStringList.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGStringList_h
 #define JSSVGStringList_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -37,12 +37,12 @@ class JSSVGStringList : public DOMObject {
 public:
     JSSVGStringList(PassRefPtr<JSC::Structure>, PassRefPtr<SVGStringList>, SVGElement* context);
     virtual ~JSSVGStringList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -55,16 +55,17 @@ private:
     RefPtr<SVGStringList > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGStringList*, SVGElement* context);
-SVGStringList* toSVGStringList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGStringList*, SVGElement* context);
+SVGStringList* toSVGStringList(JSC::JSValue);
 
 class JSSVGStringListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -73,16 +74,16 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGStringListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGStringListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGStringListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGStringListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGStringListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGStringListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGStringListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGStringListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGStringListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGStringListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.cpp
index e3b1210..6b9f6b7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.cpp
@@ -20,24 +20,20 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGStyleElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "KURL.h"
 #include "SVGStyleElement.h"
-
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGStyleElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGStyleElement);
 
 /* Hash table */
 
@@ -73,9 +69,9 @@ static const HashTable JSSVGStyleElementPrototypeTable =
 
 const ClassInfo JSSVGStyleElementPrototype::s_info = { "SVGStyleElementPrototype", 0, &JSSVGStyleElementPrototypeTable, 0 };
 
-JSObject* JSSVGStyleElementPrototype::self(ExecState* exec)
+JSObject* JSSVGStyleElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGStyleElement>(exec);
+    return getDOMPrototype<JSSVGStyleElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGStyleElement::s_info = { "SVGStyleElement", &JSSVGElement::s_info, &JSSVGStyleElementTable, 0 };
@@ -85,9 +81,9 @@ JSSVGStyleElement::JSSVGStyleElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSSVGStyleElement::createPrototype(ExecState* exec)
+JSObject* JSSVGStyleElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGStyleElementPrototype(JSSVGStyleElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGStyleElementPrototype(JSSVGStyleElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGStyleElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -95,64 +91,68 @@ bool JSSVGStyleElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSSVGStyleElement, Base>(exec, &JSSVGStyleElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGStyleElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStyleElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGStyleElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStyleElementType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->type());
 }
 
-JSValuePtr jsSVGStyleElementMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStyleElementMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->media());
 }
 
-JSValuePtr jsSVGStyleElementTitle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGStyleElementTitle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->title());
 }
 
-void JSSVGStyleElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGStyleElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGStyleElement, Base>(exec, propertyName, value, &JSSVGStyleElementTable, this, slot);
 }
 
-void setJSSVGStyleElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGStyleElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
-    imp->setXmlspace(value->toString(exec), ec);
+    imp->setXmlspace(value.toString(exec), ec);
     setDOMException(exec, ec);
 }
 
-void setJSSVGStyleElementType(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGStyleElementType(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
-    imp->setType(value->toString(exec), ec);
+    imp->setType(value.toString(exec), ec);
     setDOMException(exec, ec);
 }
 
-void setJSSVGStyleElementMedia(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGStyleElementMedia(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
-    imp->setMedia(value->toString(exec), ec);
+    imp->setMedia(value.toString(exec), ec);
     setDOMException(exec, ec);
 }
 
-void setJSSVGStyleElementTitle(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGStyleElementTitle(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGStyleElement* imp = static_cast<SVGStyleElement*>(static_cast<JSSVGStyleElement*>(thisObject)->impl());
     ExceptionCode ec = 0;
-    imp->setTitle(value->toString(exec), ec);
+    imp->setTitle(value.toString(exec), ec);
     setDOMException(exec, ec);
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h
index 80098df..d318c52 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGStyleElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGStyleElement_h
 #define JSSVGStyleElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGStyleElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGStyleElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGStyleElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,8 +49,9 @@ public:
 
 
 class JSSVGStyleElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGStyleElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -58,14 +59,14 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGStyleElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGStyleElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGStyleElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGStyleElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGStyleElementMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGStyleElementMedia(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGStyleElementTitle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGStyleElementTitle(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGStyleElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGStyleElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGStyleElementType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGStyleElementType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGStyleElementMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGStyleElementMedia(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGStyleElementTitle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGStyleElementTitle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.cpp
index 8771f72..563c735 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGSwitchElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -44,15 +40,15 @@
 #include "SVGElement.h"
 #include "SVGStringList.h"
 #include "SVGSwitchElement.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGSwitchElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGSwitchElement);
 
 /* Hash table */
 
@@ -101,9 +97,9 @@ static const HashTable JSSVGSwitchElementPrototypeTable =
 
 const ClassInfo JSSVGSwitchElementPrototype::s_info = { "SVGSwitchElementPrototype", 0, &JSSVGSwitchElementPrototypeTable, 0 };
 
-JSObject* JSSVGSwitchElementPrototype::self(ExecState* exec)
+JSObject* JSSVGSwitchElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGSwitchElement>(exec);
+    return getDOMPrototype<JSSVGSwitchElement>(exec, globalObject);
 }
 
 bool JSSVGSwitchElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -118,9 +114,9 @@ JSSVGSwitchElement::JSSVGSwitchElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSSVGSwitchElement::createPrototype(ExecState* exec)
+JSObject* JSSVGSwitchElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGSwitchElementPrototype(JSSVGSwitchElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGSwitchElementPrototype(JSSVGSwitchElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGSwitchElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,165 +124,182 @@ bool JSSVGSwitchElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGSwitchElement, Base>(exec, &JSSVGSwitchElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGSwitchElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGSwitchElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGSwitchElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGSwitchElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGSwitchElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGSwitchElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSwitchElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSwitchElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGSwitchElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSwitchElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGSwitchElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSwitchElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGSwitchElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGSwitchElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGSwitchElement, Base>(exec, propertyName, value, &JSSVGSwitchElementTable, this, slot);
 }
 
-void setJSSVGSwitchElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGSwitchElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGSwitchElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGSwitchElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(static_cast<JSSVGSwitchElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGSwitchElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSwitchElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSwitchElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSwitchElement* castedThisObj = static_cast<JSSVGSwitchElement*>(asObject(thisValue));
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGSwitchElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSwitchElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSwitchElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSwitchElement* castedThisObj = static_cast<JSSVGSwitchElement*>(asObject(thisValue));
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGSwitchElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSwitchElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSwitchElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSwitchElement* castedThisObj = static_cast<JSSVGSwitchElement*>(asObject(thisValue));
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSwitchElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSwitchElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSwitchElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSwitchElement* castedThisObj = static_cast<JSSVGSwitchElement*>(asObject(thisValue));
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSwitchElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSwitchElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSwitchElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSwitchElement* castedThisObj = static_cast<JSSVGSwitchElement*>(asObject(thisValue));
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGSwitchElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSwitchElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSwitchElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSwitchElement* castedThisObj = static_cast<JSSVGSwitchElement*>(asObject(thisValue));
     SVGSwitchElement* imp = static_cast<SVGSwitchElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h
index 567f8f9..3ae9bd1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSwitchElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGSwitchElement_h
 #define JSSVGSwitchElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGSwitchElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGSwitchElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGSwitchElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGSwitchElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,27 +64,27 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGSwitchElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSwitchElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSwitchElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSwitchElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSwitchElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGSwitchElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSwitchElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGSwitchElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSwitchElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSwitchElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSwitchElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGSwitchElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGSwitchElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGSwitchElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGSwitchElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSwitchElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSwitchElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSwitchElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSwitchElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSwitchElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSwitchElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSwitchElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSwitchElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSwitchElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGSwitchElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGSwitchElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGSwitchElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGSwitchElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSwitchElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSwitchElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSwitchElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSwitchElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSwitchElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.cpp
index 29a02d8..757bfd8f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGSymbolElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -39,15 +35,15 @@
 #include "JSSVGAnimatedString.h"
 #include "KURL.h"
 #include "SVGSymbolElement.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGSymbolElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGSymbolElement);
 
 /* Hash table */
 
@@ -87,9 +83,9 @@ static const HashTable JSSVGSymbolElementPrototypeTable =
 
 const ClassInfo JSSVGSymbolElementPrototype::s_info = { "SVGSymbolElementPrototype", 0, &JSSVGSymbolElementPrototypeTable, 0 };
 
-JSObject* JSSVGSymbolElementPrototype::self(ExecState* exec)
+JSObject* JSSVGSymbolElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGSymbolElement>(exec);
+    return getDOMPrototype<JSSVGSymbolElement>(exec, globalObject);
 }
 
 bool JSSVGSymbolElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -104,9 +100,9 @@ JSSVGSymbolElement::JSSVGSymbolElement(PassRefPtr<Structure> structure, PassRefP
 {
 }
 
-JSObject* JSSVGSymbolElement::createPrototype(ExecState* exec)
+JSObject* JSSVGSymbolElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGSymbolElementPrototype(JSSVGSymbolElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGSymbolElementPrototype(JSSVGSymbolElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGSymbolElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -114,79 +110,87 @@ bool JSSVGSymbolElement::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGSymbolElement, Base>(exec, &JSSVGSymbolElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGSymbolElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSymbolElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(static_cast<JSSVGSymbolElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGSymbolElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSymbolElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(static_cast<JSSVGSymbolElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGSymbolElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSymbolElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(static_cast<JSSVGSymbolElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSymbolElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSymbolElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(static_cast<JSSVGSymbolElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSymbolElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSymbolElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(static_cast<JSSVGSymbolElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGSymbolElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSymbolElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(static_cast<JSSVGSymbolElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedRect> obj = imp->viewBoxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGSymbolElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGSymbolElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(static_cast<JSSVGSymbolElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedPreserveAspectRatio> obj = imp->preserveAspectRatioAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-void JSSVGSymbolElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGSymbolElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGSymbolElement, Base>(exec, propertyName, value, &JSSVGSymbolElementTable, this, slot);
 }
 
-void setJSSVGSymbolElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGSymbolElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(static_cast<JSSVGSymbolElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGSymbolElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGSymbolElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(static_cast<JSSVGSymbolElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGSymbolElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGSymbolElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGSymbolElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGSymbolElement::s_info))
         return throwError(exec, TypeError);
     JSSVGSymbolElement* castedThisObj = static_cast<JSSVGSymbolElement*>(asObject(thisValue));
     SVGSymbolElement* imp = static_cast<SVGSymbolElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h
index 3664319..c5e5f71 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGSymbolElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGSymbolElement_h
 #define JSSVGSymbolElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGSymbolElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGSymbolElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGSymbolElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGSymbolElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,18 +64,18 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGSymbolElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGSymbolElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGSymbolElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGSymbolElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGSymbolElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGSymbolElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGSymbolElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSymbolElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSymbolElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSymbolElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGSymbolElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSymbolElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGSymbolElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGSymbolElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGSymbolElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGSymbolElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSymbolElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSymbolElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSymbolElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGSymbolElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.cpp
index cd38679..7abab12 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.cpp
@@ -20,23 +20,19 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGTRefElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGAnimatedString.h"
 #include "SVGTRefElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGTRefElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGTRefElement);
 
 /* Hash table */
 
@@ -69,9 +65,9 @@ static const HashTable JSSVGTRefElementPrototypeTable =
 
 const ClassInfo JSSVGTRefElementPrototype::s_info = { "SVGTRefElementPrototype", 0, &JSSVGTRefElementPrototypeTable, 0 };
 
-JSObject* JSSVGTRefElementPrototype::self(ExecState* exec)
+JSObject* JSSVGTRefElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGTRefElement>(exec);
+    return getDOMPrototype<JSSVGTRefElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGTRefElement::s_info = { "SVGTRefElement", &JSSVGTextPositioningElement::s_info, &JSSVGTRefElementTable, 0 };
@@ -81,9 +77,9 @@ JSSVGTRefElement::JSSVGTRefElement(PassRefPtr<Structure> structure, PassRefPtr<S
 {
 }
 
-JSObject* JSSVGTRefElement::createPrototype(ExecState* exec)
+JSObject* JSSVGTRefElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGTRefElementPrototype(JSSVGTRefElementPrototype::createStructure(JSSVGTextPositioningElementPrototype::self(exec)));
+    return new (exec) JSSVGTRefElementPrototype(JSSVGTRefElementPrototype::createStructure(JSSVGTextPositioningElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGTRefElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -91,8 +87,9 @@ bool JSSVGTRefElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGTRefElement, Base>(exec, &JSSVGTRefElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGTRefElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTRefElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTRefElement* imp = static_cast<SVGTRefElement*>(static_cast<JSSVGTRefElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h
index f9a6480..e70e821 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTRefElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGTRefElement_h
 #define JSSVGTRefElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGTextPositioningElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,12 +34,12 @@ class JSSVGTRefElement : public JSSVGTextPositioningElement {
     typedef JSSVGTextPositioningElement Base;
 public:
     JSSVGTRefElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGTRefElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,8 +48,9 @@ public:
 
 
 class JSSVGTRefElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGTRefElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -57,7 +58,7 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGTRefElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTRefElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.cpp
index b6519b0..acfbd95 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.cpp
@@ -20,22 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGTSpanElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGTSpanElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGTSpanElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGTSpanElement);
 
 /* Hash table for prototype */
 
@@ -53,9 +49,9 @@ static const HashTable JSSVGTSpanElementPrototypeTable =
 
 const ClassInfo JSSVGTSpanElementPrototype::s_info = { "SVGTSpanElementPrototype", 0, &JSSVGTSpanElementPrototypeTable, 0 };
 
-JSObject* JSSVGTSpanElementPrototype::self(ExecState* exec)
+JSObject* JSSVGTSpanElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGTSpanElement>(exec);
+    return getDOMPrototype<JSSVGTSpanElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGTSpanElement::s_info = { "SVGTSpanElement", &JSSVGTextPositioningElement::s_info, 0, 0 };
@@ -65,9 +61,9 @@ JSSVGTSpanElement::JSSVGTSpanElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSSVGTSpanElement::createPrototype(ExecState* exec)
+JSObject* JSSVGTSpanElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGTSpanElementPrototype(JSSVGTSpanElementPrototype::createStructure(JSSVGTextPositioningElementPrototype::self(exec)));
+    return new (exec) JSSVGTSpanElementPrototype(JSSVGTSpanElementPrototype::createStructure(JSSVGTextPositioningElementPrototype::self(exec, globalObject)));
 }
 
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.h
index 5617132..a3e9b6a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTSpanElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGTSpanElement_h
 #define JSSVGTSpanElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGTextPositioningElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,7 +34,7 @@ class JSSVGTSpanElement : public JSSVGTextPositioningElement {
     typedef JSSVGTextPositioningElement Base;
 public:
     JSSVGTSpanElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGTSpanElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -42,8 +42,9 @@ public:
 
 
 class JSSVGTSpanElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGTSpanElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp
index 3150594..16afd09 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.cpp
@@ -20,17 +20,14 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGTextContentElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
+#include "ExceptionCode.h"
 #include "FloatPoint.h"
 #include "JSCSSStyleDeclaration.h"
 #include "JSCSSValue.h"
@@ -44,16 +41,16 @@
 #include "KURL.h"
 #include "SVGStringList.h"
 #include "SVGTextContentElement.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGTextContentElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGTextContentElement);
 
 /* Hash table */
 
@@ -102,13 +99,13 @@ public:
     JSSVGTextContentElementConstructor(ExecState* exec)
         : DOMObject(JSSVGTextContentElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGTextContentElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGTextContentElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -151,9 +148,9 @@ static const HashTable JSSVGTextContentElementPrototypeTable =
 
 const ClassInfo JSSVGTextContentElementPrototype::s_info = { "SVGTextContentElementPrototype", 0, &JSSVGTextContentElementPrototypeTable, 0 };
 
-JSObject* JSSVGTextContentElementPrototype::self(ExecState* exec)
+JSObject* JSSVGTextContentElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGTextContentElement>(exec);
+    return getDOMPrototype<JSSVGTextContentElement>(exec, globalObject);
 }
 
 bool JSSVGTextContentElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -168,9 +165,9 @@ JSSVGTextContentElement::JSSVGTextContentElement(PassRefPtr<Structure> structure
 {
 }
 
-JSObject* JSSVGTextContentElement::createPrototype(ExecState* exec)
+JSObject* JSSVGTextContentElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGTextContentElementPrototype(JSSVGTextContentElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGTextContentElementPrototype(JSSVGTextContentElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGTextContentElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -178,263 +175,316 @@ bool JSSVGTextContentElement::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSSVGTextContentElement, Base>(exec, &JSSVGTextContentElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGTextContentElementTextLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementTextLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->textLengthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextContentElementLengthAdjust(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementLengthAdjust(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->lengthAdjustAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextContentElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGTextContentElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGTextContentElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGTextContentElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGTextContentElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGTextContentElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextContentElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextContentElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGTextContentElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextContentElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGTextContentElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSSVGTextContentElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGTextContentElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGTextContentElement, Base>(exec, propertyName, value, &JSSVGTextContentElementTable, this, slot);
 }
 
-void setJSSVGTextContentElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGTextContentElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGTextContentElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGTextContentElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(static_cast<JSSVGTextContentElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr JSSVGTextContentElement::getConstructor(ExecState* exec)
+JSValue JSSVGTextContentElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGTextContentElementConstructor>(exec);
 }
 
-JSValuePtr jsSVGTextContentElementPrototypeFunctionGetNumberOfChars(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetNumberOfChars(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextContentElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getNumberOfChars());
+    JSC::JSValue result = jsNumber(exec, imp->getNumberOfChars());
     return result;
 }
 
-JSValuePtr jsSVGTextContentElementPrototypeFunctionGetComputedTextLength(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetComputedTextLength(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextContentElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getComputedTextLength());
+    JSC::JSValue result = jsNumber(exec, imp->getComputedTextLength());
     return result;
 }
 
-JSValuePtr jsSVGTextContentElementPrototypeFunctionGetSubStringLength(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetSubStringLength(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextContentElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned offset = args.at(exec, 0)->toInt32(exec);
-    unsigned length = args.at(exec, 1)->toInt32(exec);
+    int offset = args.at(0).toInt32(exec);
+    if (offset < 0) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return jsUndefined();
+    }
+    int length = args.at(1).toInt32(exec);
+    if (length < 0) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return jsUndefined();
+    }
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getSubStringLength(offset, length, ec));
+    JSC::JSValue result = jsNumber(exec, imp->getSubStringLength(offset, length, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGTextContentElementPrototypeFunctionGetStartPositionOfChar(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetStartPositionOfChar(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextContentElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned offset = args.at(exec, 0)->toInt32(exec);
+    int offset = args.at(0).toInt32(exec);
+    if (offset < 0) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return jsUndefined();
+    }
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->getStartPositionOfChar(offset, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->getStartPositionOfChar(offset, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGTextContentElementPrototypeFunctionGetEndPositionOfChar(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetEndPositionOfChar(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextContentElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned offset = args.at(exec, 0)->toInt32(exec);
+    int offset = args.at(0).toInt32(exec);
+    if (offset < 0) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return jsUndefined();
+    }
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->getEndPositionOfChar(offset, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->getEndPositionOfChar(offset, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGTextContentElementPrototypeFunctionGetExtentOfChar(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetExtentOfChar(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextContentElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned offset = args.at(exec, 0)->toInt32(exec);
+    int offset = args.at(0).toInt32(exec);
+    if (offset < 0) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return jsUndefined();
+    }
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getExtentOfChar(offset, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getExtentOfChar(offset, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGTextContentElementPrototypeFunctionGetRotationOfChar(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetRotationOfChar(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextContentElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned offset = args.at(exec, 0)->toInt32(exec);
+    int offset = args.at(0).toInt32(exec);
+    if (offset < 0) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return jsUndefined();
+    }
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getRotationOfChar(offset, ec));
+    JSC::JSValue result = jsNumber(exec, imp->getRotationOfChar(offset, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsSVGTextContentElementPrototypeFunctionGetCharNumAtPosition(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetCharNumAtPosition(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextContentElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
-    FloatPoint point = toSVGPoint(args.at(exec, 0));
+    FloatPoint point = toSVGPoint(args.at(0));
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->getCharNumAtPosition(point));
+    JSC::JSValue result = jsNumber(exec, imp->getCharNumAtPosition(point));
     return result;
 }
 
-JSValuePtr jsSVGTextContentElementPrototypeFunctionSelectSubString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionSelectSubString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextContentElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned offset = args.at(exec, 0)->toInt32(exec);
-    unsigned length = args.at(exec, 1)->toInt32(exec);
+    int offset = args.at(0).toInt32(exec);
+    if (offset < 0) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return jsUndefined();
+    }
+    int length = args.at(1).toInt32(exec);
+    if (length < 0) {
+        setDOMException(exec, INDEX_SIZE_ERR);
+        return jsUndefined();
+    }
 
     imp->selectSubString(offset, length, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsSVGTextContentElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextContentElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGTextContentElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextContentElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextContentElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextContentElement* castedThisObj = static_cast<JSSVGTextContentElement*>(asObject(thisValue));
     SVGTextContentElement* imp = static_cast<SVGTextContentElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsSVGTextContentElementLENGTHADJUST_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextContentElementLENGTHADJUST_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGTextContentElementLENGTHADJUST_SPACING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextContentElementLENGTHADJUST_SPACING(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGTextContentElementLENGTHADJUST_SPACINGANDGLYPHS(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextContentElementLENGTHADJUST_SPACINGANDGLYPHS(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h
index 8a5b85e..3fbc5fd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextContentElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGTextContentElement_h
 #define JSSVGTextContentElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,28 +34,29 @@ class JSSVGTextContentElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGTextContentElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGTextContentElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGTextContentElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -64,37 +65,37 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGTextContentElementPrototypeFunctionGetNumberOfChars(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextContentElementPrototypeFunctionGetComputedTextLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextContentElementPrototypeFunctionGetSubStringLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextContentElementPrototypeFunctionGetStartPositionOfChar(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextContentElementPrototypeFunctionGetEndPositionOfChar(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextContentElementPrototypeFunctionGetExtentOfChar(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextContentElementPrototypeFunctionGetRotationOfChar(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextContentElementPrototypeFunctionGetCharNumAtPosition(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextContentElementPrototypeFunctionSelectSubString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextContentElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextContentElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetNumberOfChars(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetComputedTextLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetSubStringLength(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetStartPositionOfChar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetEndPositionOfChar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetExtentOfChar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetRotationOfChar(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetCharNumAtPosition(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionSelectSubString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextContentElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGTextContentElementTextLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextContentElementLengthAdjust(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextContentElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextContentElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextContentElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextContentElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGTextContentElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGTextContentElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGTextContentElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGTextContentElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextContentElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextContentElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextContentElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementTextLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementLengthAdjust(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGTextContentElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGTextContentElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGTextContentElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGTextContentElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGTextContentElementLENGTHADJUST_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextContentElementLENGTHADJUST_SPACING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextContentElementLENGTHADJUST_SPACINGANDGLYPHS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementLENGTHADJUST_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementLENGTHADJUST_SPACING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextContentElementLENGTHADJUST_SPACINGANDGLYPHS(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.cpp
index 50612ff..9ebc992 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.cpp
@@ -20,28 +20,24 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGTextElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGAnimatedTransformList.h"
 #include "JSSVGElement.h"
 #include "JSSVGMatrix.h"
 #include "JSSVGRect.h"
 #include "SVGElement.h"
 #include "SVGTextElement.h"
-
 #include <runtime/Error.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGTextElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGTextElement);
 
 /* Hash table */
 
@@ -80,9 +76,9 @@ static const HashTable JSSVGTextElementPrototypeTable =
 
 const ClassInfo JSSVGTextElementPrototype::s_info = { "SVGTextElementPrototype", 0, &JSSVGTextElementPrototypeTable, 0 };
 
-JSObject* JSSVGTextElementPrototype::self(ExecState* exec)
+JSObject* JSSVGTextElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGTextElement>(exec);
+    return getDOMPrototype<JSSVGTextElement>(exec, globalObject);
 }
 
 bool JSSVGTextElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -97,9 +93,9 @@ JSSVGTextElement::JSSVGTextElement(PassRefPtr<Structure> structure, PassRefPtr<S
 {
 }
 
-JSObject* JSSVGTextElement::createPrototype(ExecState* exec)
+JSObject* JSSVGTextElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGTextElementPrototype(JSSVGTextElementPrototype::createStructure(JSSVGTextPositioningElementPrototype::self(exec)));
+    return new (exec) JSSVGTextElementPrototype(JSSVGTextElementPrototype::createStructure(JSSVGTextPositioningElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGTextElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -107,72 +103,79 @@ bool JSSVGTextElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGTextElement, Base>(exec, &JSSVGTextElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGTextElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextElement* imp = static_cast<SVGTextElement*>(static_cast<JSSVGTextElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextElement* imp = static_cast<SVGTextElement*>(static_cast<JSSVGTextElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGTextElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextElement* imp = static_cast<SVGTextElement*>(static_cast<JSSVGTextElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-JSValuePtr jsSVGTextElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextElement* castedThisObj = static_cast<JSSVGTextElement*>(asObject(thisValue));
     SVGTextElement* imp = static_cast<SVGTextElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGTextElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextElement* castedThisObj = static_cast<JSSVGTextElement*>(asObject(thisValue));
     SVGTextElement* imp = static_cast<SVGTextElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGTextElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextElement* castedThisObj = static_cast<JSSVGTextElement*>(asObject(thisValue));
     SVGTextElement* imp = static_cast<SVGTextElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGTextElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTextElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTextElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTextElement* castedThisObj = static_cast<JSSVGTextElement*>(asObject(thisValue));
     SVGTextElement* imp = static_cast<SVGTextElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h
index 34169ac..4aff180 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGTextElement_h
 #define JSSVGTextElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGTextPositioningElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,12 +34,12 @@ class JSSVGTextElement : public JSSVGTextPositioningElement {
     typedef JSSVGTextPositioningElement Base;
 public:
     JSSVGTextElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGTextElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,12 +48,13 @@ public:
 
 
 class JSSVGTextElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,15 +63,15 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGTextElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTextElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTextElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGTextElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp
index 48d1eef..ff320ca 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.cpp
@@ -20,26 +20,21 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGTextPathElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGAnimatedEnumeration.h"
 #include "JSSVGAnimatedLength.h"
 #include "JSSVGAnimatedString.h"
 #include "SVGTextPathElement.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGTextPathElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGTextPathElement);
 
 /* Hash table */
 
@@ -85,13 +80,13 @@ public:
     JSSVGTextPathElementConstructor(ExecState* exec)
         : DOMObject(JSSVGTextPathElementConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGTextPathElementPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGTextPathElementPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -126,9 +121,9 @@ static const HashTable JSSVGTextPathElementPrototypeTable =
 
 const ClassInfo JSSVGTextPathElementPrototype::s_info = { "SVGTextPathElementPrototype", 0, &JSSVGTextPathElementPrototypeTable, 0 };
 
-JSObject* JSSVGTextPathElementPrototype::self(ExecState* exec)
+JSObject* JSSVGTextPathElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGTextPathElement>(exec);
+    return getDOMPrototype<JSSVGTextPathElement>(exec, globalObject);
 }
 
 bool JSSVGTextPathElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -143,9 +138,9 @@ JSSVGTextPathElement::JSSVGTextPathElement(PassRefPtr<Structure> structure, Pass
 {
 }
 
-JSObject* JSSVGTextPathElement::createPrototype(ExecState* exec)
+JSObject* JSSVGTextPathElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGTextPathElementPrototype(JSSVGTextPathElementPrototype::createStructure(JSSVGTextContentElementPrototype::self(exec)));
+    return new (exec) JSSVGTextPathElementPrototype(JSSVGTextPathElementPrototype::createStructure(JSSVGTextContentElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGTextPathElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -153,71 +148,75 @@ bool JSSVGTextPathElement::getOwnPropertySlot(ExecState* exec, const Identifier&
     return getStaticValueSlot<JSSVGTextPathElement, Base>(exec, &JSSVGTextPathElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGTextPathElementStartOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPathElementStartOffset(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextPathElement* imp = static_cast<SVGTextPathElement*>(static_cast<JSSVGTextPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->startOffsetAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextPathElementMethod(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPathElementMethod(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextPathElement* imp = static_cast<SVGTextPathElement*>(static_cast<JSSVGTextPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->methodAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextPathElementSpacing(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPathElementSpacing(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextPathElement* imp = static_cast<SVGTextPathElement*>(static_cast<JSSVGTextPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedEnumeration> obj = imp->spacingAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextPathElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPathElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextPathElement* imp = static_cast<SVGTextPathElement*>(static_cast<JSSVGTextPathElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextPathElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPathElementConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGTextPathElement*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGTextPathElement::getConstructor(ExecState* exec)
+JSValue JSSVGTextPathElement::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGTextPathElementConstructor>(exec);
 }
 
 // Constant getters
 
-JSValuePtr jsSVGTextPathElementTEXTPATH_METHODTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGTextPathElementTEXTPATH_METHODTYPE_ALIGN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_ALIGN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGTextPathElementTEXTPATH_METHODTYPE_STRETCH(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_STRETCH(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGTextPathElementTEXTPATH_SPACINGTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGTextPathElementTEXTPATH_SPACINGTYPE_AUTO(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_AUTO(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGTextPathElementTEXTPATH_SPACINGTYPE_EXACT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_EXACT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h
index fc2dd9b..9301f9d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPathElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGTextPathElement_h
 #define JSSVGTextPathElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGTextContentElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,27 +34,28 @@ class JSSVGTextPathElement : public JSSVGTextContentElement {
     typedef JSSVGTextContentElement Base;
 public:
     JSSVGTextPathElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGTextPathElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSSVGTextPathElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,19 +64,19 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGTextPathElementStartOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPathElementMethod(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPathElementSpacing(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPathElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPathElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementStartOffset(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementMethod(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementSpacing(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGTextPathElementTEXTPATH_METHODTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPathElementTEXTPATH_METHODTYPE_ALIGN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPathElementTEXTPATH_METHODTYPE_STRETCH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPathElementTEXTPATH_SPACINGTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPathElementTEXTPATH_SPACINGTYPE_AUTO(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPathElementTEXTPATH_SPACINGTYPE_EXACT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_ALIGN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementTEXTPATH_METHODTYPE_STRETCH(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_AUTO(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPathElementTEXTPATH_SPACINGTYPE_EXACT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.cpp
index b386046..373d0c3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.cpp
@@ -20,24 +20,20 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGTextPositioningElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGAnimatedLengthList.h"
 #include "JSSVGAnimatedNumberList.h"
 #include "SVGTextPositioningElement.h"
-
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGTextPositioningElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGTextPositioningElement);
 
 /* Hash table */
 
@@ -74,9 +70,9 @@ static const HashTable JSSVGTextPositioningElementPrototypeTable =
 
 const ClassInfo JSSVGTextPositioningElementPrototype::s_info = { "SVGTextPositioningElementPrototype", 0, &JSSVGTextPositioningElementPrototypeTable, 0 };
 
-JSObject* JSSVGTextPositioningElementPrototype::self(ExecState* exec)
+JSObject* JSSVGTextPositioningElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGTextPositioningElement>(exec);
+    return getDOMPrototype<JSSVGTextPositioningElement>(exec, globalObject);
 }
 
 const ClassInfo JSSVGTextPositioningElement::s_info = { "SVGTextPositioningElement", &JSSVGTextContentElement::s_info, &JSSVGTextPositioningElementTable, 0 };
@@ -86,9 +82,9 @@ JSSVGTextPositioningElement::JSSVGTextPositioningElement(PassRefPtr<Structure> s
 {
 }
 
-JSObject* JSSVGTextPositioningElement::createPrototype(ExecState* exec)
+JSObject* JSSVGTextPositioningElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGTextPositioningElementPrototype(JSSVGTextPositioningElementPrototype::createStructure(JSSVGTextContentElementPrototype::self(exec)));
+    return new (exec) JSSVGTextPositioningElementPrototype(JSSVGTextPositioningElementPrototype::createStructure(JSSVGTextContentElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGTextPositioningElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -96,36 +92,41 @@ bool JSSVGTextPositioningElement::getOwnPropertySlot(ExecState* exec, const Iden
     return getStaticValueSlot<JSSVGTextPositioningElement, Base>(exec, &JSSVGTextPositioningElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGTextPositioningElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPositioningElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextPositioningElement* imp = static_cast<SVGTextPositioningElement*>(static_cast<JSSVGTextPositioningElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLengthList> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextPositioningElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPositioningElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextPositioningElement* imp = static_cast<SVGTextPositioningElement*>(static_cast<JSSVGTextPositioningElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLengthList> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextPositioningElementDx(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPositioningElementDx(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextPositioningElement* imp = static_cast<SVGTextPositioningElement*>(static_cast<JSSVGTextPositioningElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLengthList> obj = imp->dxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextPositioningElementDy(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPositioningElementDy(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextPositioningElement* imp = static_cast<SVGTextPositioningElement*>(static_cast<JSSVGTextPositioningElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLengthList> obj = imp->dyAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTextPositioningElementRotate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTextPositioningElementRotate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTextPositioningElement* imp = static_cast<SVGTextPositioningElement*>(static_cast<JSSVGTextPositioningElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedNumberList> obj = imp->rotateAnimated();
     return toJS(exec, obj.get(), imp);
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h
index 4dab3a2..3f4864d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTextPositioningElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGTextPositioningElement_h
 #define JSSVGTextPositioningElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGTextContentElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,12 +34,12 @@ class JSSVGTextPositioningElement : public JSSVGTextContentElement {
     typedef JSSVGTextContentElement Base;
 public:
     JSSVGTextPositioningElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGTextPositioningElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,8 +48,9 @@ public:
 
 
 class JSSVGTextPositioningElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGTextPositioningElementPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -57,11 +58,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGTextPositioningElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPositioningElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPositioningElementDx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPositioningElementDy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTextPositioningElementRotate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPositioningElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPositioningElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPositioningElementDx(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPositioningElementDy(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTextPositioningElementRotate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.cpp
index e443a78..479cbcc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGTitleElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -36,15 +32,15 @@
 #include "JSSVGAnimatedString.h"
 #include "KURL.h"
 #include "SVGTitleElement.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGTitleElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGTitleElement);
 
 /* Hash table */
 
@@ -81,9 +77,9 @@ static const HashTable JSSVGTitleElementPrototypeTable =
 
 const ClassInfo JSSVGTitleElementPrototype::s_info = { "SVGTitleElementPrototype", 0, &JSSVGTitleElementPrototypeTable, 0 };
 
-JSObject* JSSVGTitleElementPrototype::self(ExecState* exec)
+JSObject* JSSVGTitleElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGTitleElement>(exec);
+    return getDOMPrototype<JSSVGTitleElement>(exec, globalObject);
 }
 
 bool JSSVGTitleElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -98,9 +94,9 @@ JSSVGTitleElement::JSSVGTitleElement(PassRefPtr<Structure> structure, PassRefPtr
 {
 }
 
-JSObject* JSSVGTitleElement::createPrototype(ExecState* exec)
+JSObject* JSSVGTitleElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGTitleElementPrototype(JSSVGTitleElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGTitleElementPrototype(JSSVGTitleElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGTitleElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -108,58 +104,63 @@ bool JSSVGTitleElement::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSSVGTitleElement, Base>(exec, &JSSVGTitleElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGTitleElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTitleElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTitleElement* imp = static_cast<SVGTitleElement*>(static_cast<JSSVGTitleElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGTitleElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTitleElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTitleElement* imp = static_cast<SVGTitleElement*>(static_cast<JSSVGTitleElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGTitleElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTitleElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTitleElement* imp = static_cast<SVGTitleElement*>(static_cast<JSSVGTitleElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGTitleElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTitleElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTitleElement* imp = static_cast<SVGTitleElement*>(static_cast<JSSVGTitleElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-void JSSVGTitleElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGTitleElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGTitleElement, Base>(exec, propertyName, value, &JSSVGTitleElementTable, this, slot);
 }
 
-void setJSSVGTitleElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGTitleElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGTitleElement* imp = static_cast<SVGTitleElement*>(static_cast<JSSVGTitleElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGTitleElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGTitleElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGTitleElement* imp = static_cast<SVGTitleElement*>(static_cast<JSSVGTitleElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGTitleElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTitleElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTitleElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTitleElement::s_info))
         return throwError(exec, TypeError);
     JSSVGTitleElement* castedThisObj = static_cast<JSSVGTitleElement*>(asObject(thisValue));
     SVGTitleElement* imp = static_cast<SVGTitleElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h
index a4ee478..31848a7 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTitleElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGTitleElement_h
 #define JSSVGTitleElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGTitleElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGTitleElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGTitleElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGTitleElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,15 +64,15 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGTitleElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTitleElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGTitleElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGTitleElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGTitleElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGTitleElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGTitleElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTitleElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTitleElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGTitleElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGTitleElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGTitleElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGTitleElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTitleElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp
index 6dbbfbe..cb98e9f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.cpp
@@ -20,25 +20,21 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGTransform.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGMatrix.h"
 #include "SVGTransform.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGTransform)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGTransform);
 
 /* Hash table */
 
@@ -84,13 +80,13 @@ public:
     JSSVGTransformConstructor(ExecState* exec)
         : DOMObject(JSSVGTransformConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGTransformPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGTransformPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -132,9 +128,9 @@ static const HashTable JSSVGTransformPrototypeTable =
 
 const ClassInfo JSSVGTransformPrototype::s_info = { "SVGTransformPrototype", 0, &JSSVGTransformPrototypeTable, 0 };
 
-JSObject* JSSVGTransformPrototype::self(ExecState* exec)
+JSObject* JSSVGTransformPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGTransform>(exec);
+    return getDOMPrototype<JSSVGTransform>(exec, globalObject);
 }
 
 bool JSSVGTransformPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -154,12 +150,11 @@ JSSVGTransform::JSSVGTransform(PassRefPtr<Structure> structure, PassRefPtr<JSSVG
 JSSVGTransform::~JSSVGTransform()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGTransform::createPrototype(ExecState* exec)
+JSObject* JSSVGTransform::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGTransformPrototype(JSSVGTransformPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGTransformPrototype(JSSVGTransformPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGTransform::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -167,115 +162,124 @@ bool JSSVGTransform::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSSVGTransform, Base>(exec, &JSSVGTransformTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGTransformType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTransformType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTransform imp(*static_cast<JSSVGTransform*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.type());
 }
 
-JSValuePtr jsSVGTransformMatrix(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTransformMatrix(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTransform imp(*static_cast<JSSVGTransform*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, JSSVGStaticPODTypeWrapperWithPODTypeParent<TransformationMatrix, SVGTransform>::create(imp.matrix(), static_cast<JSSVGTransform*>(asObject(slot.slotBase()))->impl()).get(), static_cast<JSSVGTransform*>(asObject(slot.slotBase()))->context());
 }
 
-JSValuePtr jsSVGTransformAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTransformAngle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTransform imp(*static_cast<JSSVGTransform*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp.angle());
 }
 
-JSValuePtr jsSVGTransformConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTransformConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGTransform*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGTransform::getConstructor(ExecState* exec)
+JSValue JSSVGTransform::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGTransformConstructor>(exec);
 }
 
-JSValuePtr jsSVGTransformPrototypeFunctionSetMatrix(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetMatrix(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransform::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
     JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
     SVGTransform imp(*wrapper);
-    TransformationMatrix matrix = toSVGMatrix(args.at(exec, 0));
+    TransformationMatrix matrix = toSVGMatrix(args.at(0));
 
     imp.setMatrix(matrix);
     wrapper->commitChange(imp, castedThisObj->context());
     return jsUndefined();
 }
 
-JSValuePtr jsSVGTransformPrototypeFunctionSetTranslate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetTranslate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransform::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
     JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
     SVGTransform imp(*wrapper);
-    float tx = args.at(exec, 0)->toFloat(exec);
-    float ty = args.at(exec, 1)->toFloat(exec);
+    float tx = args.at(0).toFloat(exec);
+    float ty = args.at(1).toFloat(exec);
 
     imp.setTranslate(tx, ty);
     wrapper->commitChange(imp, castedThisObj->context());
     return jsUndefined();
 }
 
-JSValuePtr jsSVGTransformPrototypeFunctionSetScale(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetScale(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransform::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
     JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
     SVGTransform imp(*wrapper);
-    float sx = args.at(exec, 0)->toFloat(exec);
-    float sy = args.at(exec, 1)->toFloat(exec);
+    float sx = args.at(0).toFloat(exec);
+    float sy = args.at(1).toFloat(exec);
 
     imp.setScale(sx, sy);
     wrapper->commitChange(imp, castedThisObj->context());
     return jsUndefined();
 }
 
-JSValuePtr jsSVGTransformPrototypeFunctionSetRotate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetRotate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransform::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
     JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
     SVGTransform imp(*wrapper);
-    float angle = args.at(exec, 0)->toFloat(exec);
-    float cx = args.at(exec, 1)->toFloat(exec);
-    float cy = args.at(exec, 2)->toFloat(exec);
+    float angle = args.at(0).toFloat(exec);
+    float cx = args.at(1).toFloat(exec);
+    float cy = args.at(2).toFloat(exec);
 
     imp.setRotate(angle, cx, cy);
     wrapper->commitChange(imp, castedThisObj->context());
     return jsUndefined();
 }
 
-JSValuePtr jsSVGTransformPrototypeFunctionSetSkewX(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetSkewX(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransform::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
     JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
     SVGTransform imp(*wrapper);
-    float angle = args.at(exec, 0)->toFloat(exec);
+    float angle = args.at(0).toFloat(exec);
 
     imp.setSkewX(angle);
     wrapper->commitChange(imp, castedThisObj->context());
     return jsUndefined();
 }
 
-JSValuePtr jsSVGTransformPrototypeFunctionSetSkewY(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetSkewY(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransform::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransform::s_info))
         return throwError(exec, TypeError);
     JSSVGTransform* castedThisObj = static_cast<JSSVGTransform*>(asObject(thisValue));
     JSSVGPODTypeWrapper<SVGTransform>* wrapper = castedThisObj->impl();
     SVGTransform imp(*wrapper);
-    float angle = args.at(exec, 0)->toFloat(exec);
+    float angle = args.at(0).toFloat(exec);
 
     imp.setSkewY(angle);
     wrapper->commitChange(imp, castedThisObj->context());
@@ -284,48 +288,48 @@ JSValuePtr jsSVGTransformPrototypeFunctionSetSkewY(ExecState* exec, JSObject*, J
 
 // Constant getters
 
-JSValuePtr jsSVGTransformSVG_TRANSFORM_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTransformSVG_TRANSFORM_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGTransformSVG_TRANSFORM_MATRIX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTransformSVG_TRANSFORM_MATRIX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGTransformSVG_TRANSFORM_TRANSLATE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTransformSVG_TRANSFORM_TRANSLATE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsSVGTransformSVG_TRANSFORM_SCALE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTransformSVG_TRANSFORM_SCALE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsSVGTransformSVG_TRANSFORM_ROTATE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTransformSVG_TRANSFORM_ROTATE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsSVGTransformSVG_TRANSFORM_SKEWX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTransformSVG_TRANSFORM_SKEWX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValuePtr jsSVGTransformSVG_TRANSFORM_SKEWY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGTransformSVG_TRANSFORM_SKEWY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<SVGTransform>* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, JSSVGPODTypeWrapper<SVGTransform>* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGTransform, JSSVGPODTypeWrapper<SVGTransform> >(exec, object, context);
 }
-SVGTransform toSVGTransform(JSC::JSValuePtr value)
+SVGTransform toSVGTransform(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGTransform::s_info) ? (SVGTransform) *static_cast<JSSVGTransform*>(asObject(value))->impl() : SVGTransform();
+    return value.isObject(&JSSVGTransform::s_info) ? (SVGTransform) *static_cast<JSSVGTransform*>(asObject(value))->impl() : SVGTransform();
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h
index 39cdf99..c95932a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransform.h
@@ -21,14 +21,14 @@
 #ifndef JSSVGTransform_h
 #define JSSVGTransform_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "JSSVGPODTypeWrapper.h"
+#include "SVGElement.h"
+#include "SVGTransform.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
-#include "SVGTransform.h"
-#include "JSSVGPODTypeWrapper.h"
 
 namespace WebCore {
 
@@ -37,17 +37,17 @@ class JSSVGTransform : public DOMObject {
 public:
     JSSVGTransform(PassRefPtr<JSC::Structure>, PassRefPtr<JSSVGPODTypeWrapper<SVGTransform> >, SVGElement* context);
     virtual ~JSSVGTransform();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     JSSVGPODTypeWrapper<SVGTransform>* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -56,16 +56,17 @@ private:
     RefPtr<JSSVGPODTypeWrapper<SVGTransform> > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, JSSVGPODTypeWrapper<SVGTransform>*, SVGElement* context);
-SVGTransform toSVGTransform(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, JSSVGPODTypeWrapper<SVGTransform>*, SVGElement* context);
+SVGTransform toSVGTransform(JSC::JSValue);
 
 class JSSVGTransformPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -74,27 +75,27 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGTransformPrototypeFunctionSetMatrix(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformPrototypeFunctionSetTranslate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformPrototypeFunctionSetScale(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformPrototypeFunctionSetRotate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformPrototypeFunctionSetSkewX(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformPrototypeFunctionSetSkewY(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetMatrix(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetTranslate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetScale(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetRotate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetSkewX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformPrototypeFunctionSetSkewY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGTransformType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTransformMatrix(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTransformAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTransformConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformMatrix(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformAngle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGTransformSVG_TRANSFORM_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTransformSVG_TRANSFORM_MATRIX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTransformSVG_TRANSFORM_TRANSLATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTransformSVG_TRANSFORM_SCALE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTransformSVG_TRANSFORM_ROTATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTransformSVG_TRANSFORM_SKEWX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGTransformSVG_TRANSFORM_SKEWY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformSVG_TRANSFORM_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformSVG_TRANSFORM_MATRIX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformSVG_TRANSFORM_TRANSLATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformSVG_TRANSFORM_SCALE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformSVG_TRANSFORM_ROTATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformSVG_TRANSFORM_SKEWX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformSVG_TRANSFORM_SKEWY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.cpp
index 37871c2..3232123 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.cpp
@@ -20,27 +20,23 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGTransformList.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGMatrix.h"
 #include "JSSVGTransform.h"
 #include "SVGTransform.h"
 #include "SVGTransformList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGTransformList)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGTransformList);
 
 /* Hash table */
 
@@ -82,9 +78,9 @@ static const HashTable JSSVGTransformListPrototypeTable =
 
 const ClassInfo JSSVGTransformListPrototype::s_info = { "SVGTransformListPrototype", 0, &JSSVGTransformListPrototypeTable, 0 };
 
-JSObject* JSSVGTransformListPrototype::self(ExecState* exec)
+JSObject* JSSVGTransformListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGTransformList>(exec);
+    return getDOMPrototype<JSSVGTransformList>(exec, globalObject);
 }
 
 bool JSSVGTransformListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -104,12 +100,11 @@ JSSVGTransformList::JSSVGTransformList(PassRefPtr<Structure> structure, PassRefP
 JSSVGTransformList::~JSSVGTransformList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGTransformList::createPrototype(ExecState* exec)
+JSObject* JSSVGTransformList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGTransformListPrototype(JSSVGTransformListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGTransformListPrototype(JSSVGTransformListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGTransformList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -117,100 +112,110 @@ bool JSSVGTransformList::getOwnPropertySlot(ExecState* exec, const Identifier& p
     return getStaticValueSlot<JSSVGTransformList, Base>(exec, &JSSVGTransformListTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGTransformListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGTransformListNumberOfItems(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGTransformList* imp = static_cast<SVGTransformList*>(static_cast<JSSVGTransformList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->numberOfItems());
 }
 
-JSValuePtr jsSVGTransformListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransformList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     return castedThisObj->clear(exec, args);
 }
 
-JSValuePtr jsSVGTransformListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionInitialize(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransformList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     return castedThisObj->initialize(exec, args);
 }
 
-JSValuePtr jsSVGTransformListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransformList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     return castedThisObj->getItem(exec, args);
 }
 
-JSValuePtr jsSVGTransformListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionInsertItemBefore(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransformList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     return castedThisObj->insertItemBefore(exec, args);
 }
 
-JSValuePtr jsSVGTransformListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionReplaceItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransformList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     return castedThisObj->replaceItem(exec, args);
 }
 
-JSValuePtr jsSVGTransformListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransformList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     return castedThisObj->removeItem(exec, args);
 }
 
-JSValuePtr jsSVGTransformListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionAppendItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransformList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     return castedThisObj->appendItem(exec, args);
 }
 
-JSValuePtr jsSVGTransformListPrototypeFunctionCreateSVGTransformFromMatrix(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionCreateSVGTransformFromMatrix(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransformList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     SVGTransformList* imp = static_cast<SVGTransformList*>(castedThisObj->impl());
-    TransformationMatrix matrix = toSVGMatrix(args.at(exec, 0));
+    TransformationMatrix matrix = toSVGMatrix(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->createSVGTransformFromMatrix(matrix)).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->createSVGTransformFromMatrix(matrix)).get(), castedThisObj->context());
     return result;
 }
 
-JSValuePtr jsSVGTransformListPrototypeFunctionConsolidate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionConsolidate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGTransformList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGTransformList::s_info))
         return throwError(exec, TypeError);
     JSSVGTransformList* castedThisObj = static_cast<JSSVGTransformList*>(asObject(thisValue));
     SVGTransformList* imp = static_cast<SVGTransformList*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->consolidate()).get(), castedThisObj->context());
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<SVGTransform>::create(imp->consolidate()).get(), castedThisObj->context());
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGTransformList* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGTransformList* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGTransformList>(exec, object, context);
 }
-SVGTransformList* toSVGTransformList(JSC::JSValuePtr value)
+SVGTransformList* toSVGTransformList(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGTransformList::s_info) ? static_cast<JSSVGTransformList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGTransformList::s_info) ? static_cast<JSSVGTransformList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h b/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h
index 0cdf369..9718f9b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGTransformList.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGTransformList_h
 #define JSSVGTransformList_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -37,25 +37,25 @@ class JSSVGTransformList : public DOMObject {
 public:
     JSSVGTransformList(PassRefPtr<JSC::Structure>, PassRefPtr<SVGTransformList>, SVGElement* context);
     virtual ~JSSVGTransformList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
 
     // Custom functions
-    JSC::JSValuePtr clear(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr initialize(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr getItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr insertItemBefore(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr replaceItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeItem(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr appendItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue clear(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue initialize(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue insertItemBefore(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue replaceItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeItem(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue appendItem(JSC::ExecState*, const JSC::ArgList&);
     SVGTransformList* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -64,16 +64,17 @@ private:
     RefPtr<SVGTransformList > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGTransformList*, SVGElement* context);
-SVGTransformList* toSVGTransformList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGTransformList*, SVGElement* context);
+SVGTransformList* toSVGTransformList(JSC::JSValue);
 
 class JSSVGTransformListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -82,18 +83,18 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGTransformListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformListPrototypeFunctionCreateSVGTransformFromMatrix(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGTransformListPrototypeFunctionConsolidate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionInitialize(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionInsertItemBefore(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionReplaceItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionAppendItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionCreateSVGTransformFromMatrix(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGTransformListPrototypeFunctionConsolidate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGTransformListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGTransformListNumberOfItems(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp
index dbfab2d..5477773 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.cpp
@@ -20,23 +20,18 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGUnitTypes.h"
 
-#include <wtf/GetPtr.h>
-
 #include "SVGUnitTypes.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGUnitTypes)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGUnitTypes);
 
 /* Hash table */
 
@@ -75,13 +70,13 @@ public:
     JSSVGUnitTypesConstructor(ExecState* exec)
         : DOMObject(JSSVGUnitTypesConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSSVGUnitTypesPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSSVGUnitTypesPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -113,9 +108,9 @@ static const HashTable JSSVGUnitTypesPrototypeTable =
 
 const ClassInfo JSSVGUnitTypesPrototype::s_info = { "SVGUnitTypesPrototype", 0, &JSSVGUnitTypesPrototypeTable, 0 };
 
-JSObject* JSSVGUnitTypesPrototype::self(ExecState* exec)
+JSObject* JSSVGUnitTypesPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGUnitTypes>(exec);
+    return getDOMPrototype<JSSVGUnitTypes>(exec, globalObject);
 }
 
 bool JSSVGUnitTypesPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -135,12 +130,11 @@ JSSVGUnitTypes::JSSVGUnitTypes(PassRefPtr<Structure> structure, PassRefPtr<SVGUn
 JSSVGUnitTypes::~JSSVGUnitTypes()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSSVGUnitTypes::createPrototype(ExecState* exec)
+JSObject* JSSVGUnitTypes::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGUnitTypesPrototype(JSSVGUnitTypesPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSSVGUnitTypesPrototype(JSSVGUnitTypesPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSSVGUnitTypes::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -148,39 +142,39 @@ bool JSSVGUnitTypes::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSSVGUnitTypes, Base>(exec, &JSSVGUnitTypesTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGUnitTypesConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUnitTypesConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSSVGUnitTypes*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSSVGUnitTypes::getConstructor(ExecState* exec)
+JSValue JSSVGUnitTypes::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSSVGUnitTypesConstructor>(exec);
 }
 
 // Constant getters
 
-JSValuePtr jsSVGUnitTypesSVG_UNIT_TYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGUnitTypesSVG_UNIT_TYPE_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGUnitTypesSVG_UNIT_TYPE_USERSPACEONUSE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGUnitTypesSVG_UNIT_TYPE_USERSPACEONUSE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGUnitTypesSVG_UNIT_TYPE_OBJECTBOUNDINGBOX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGUnitTypesSVG_UNIT_TYPE_OBJECTBOUNDINGBOX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, SVGUnitTypes* object, SVGElement* context)
+JSC::JSValue toJS(JSC::ExecState* exec, SVGUnitTypes* object, SVGElement* context)
 {
     return getDOMObjectWrapper<JSSVGUnitTypes>(exec, object, context);
 }
-SVGUnitTypes* toSVGUnitTypes(JSC::JSValuePtr value)
+SVGUnitTypes* toSVGUnitTypes(JSC::JSValue value)
 {
-    return value->isObject(&JSSVGUnitTypes::s_info) ? static_cast<JSSVGUnitTypes*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSSVGUnitTypes::s_info) ? static_cast<JSSVGUnitTypes*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h
index ef22d10..080f7ba 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGUnitTypes.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGUnitTypes_h
 #define JSSVGUnitTypes_h
 
-
 #if ENABLE(SVG)
 
 #include "JSDOMBinding.h"
+#include "SVGElement.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
 
@@ -37,17 +37,17 @@ class JSSVGUnitTypes : public DOMObject {
 public:
     JSSVGUnitTypes(PassRefPtr<JSC::Structure>, PassRefPtr<SVGUnitTypes>, SVGElement* context);
     virtual ~JSSVGUnitTypes();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     SVGUnitTypes* impl() const { return m_impl.get(); }
     SVGElement* context() const { return m_context.get(); }
 
@@ -56,16 +56,17 @@ private:
     RefPtr<SVGUnitTypes > m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, SVGUnitTypes*, SVGElement* context);
-SVGUnitTypes* toSVGUnitTypes(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, SVGUnitTypes*, SVGElement* context);
+SVGUnitTypes* toSVGUnitTypes(JSC::JSValue);
 
 class JSSVGUnitTypesPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -74,12 +75,12 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGUnitTypesConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUnitTypesConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsSVGUnitTypesSVG_UNIT_TYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUnitTypesSVG_UNIT_TYPE_USERSPACEONUSE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUnitTypesSVG_UNIT_TYPE_OBJECTBOUNDINGBOX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUnitTypesSVG_UNIT_TYPE_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUnitTypesSVG_UNIT_TYPE_USERSPACEONUSE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUnitTypesSVG_UNIT_TYPE_OBJECTBOUNDINGBOX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.cpp
index 8ada6d5..d05bc22 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.cpp
@@ -20,14 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGUseElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "CSSValue.h"
@@ -47,15 +43,15 @@
 #include "SVGElementInstance.h"
 #include "SVGStringList.h"
 #include "SVGUseElement.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGUseElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGUseElement);
 
 /* Hash table */
 
@@ -111,9 +107,9 @@ static const HashTable JSSVGUseElementPrototypeTable =
 
 const ClassInfo JSSVGUseElementPrototype::s_info = { "SVGUseElementPrototype", 0, &JSSVGUseElementPrototypeTable, 0 };
 
-JSObject* JSSVGUseElementPrototype::self(ExecState* exec)
+JSObject* JSSVGUseElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGUseElement>(exec);
+    return getDOMPrototype<JSSVGUseElement>(exec, globalObject);
 }
 
 bool JSSVGUseElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,9 +124,9 @@ JSSVGUseElement::JSSVGUseElement(PassRefPtr<Structure> structure, PassRefPtr<SVG
 {
 }
 
-JSObject* JSSVGUseElement::createPrototype(ExecState* exec)
+JSObject* JSSVGUseElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGUseElementPrototype(JSSVGUseElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGUseElementPrototype(JSSVGUseElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGUseElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -138,212 +134,236 @@ bool JSSVGUseElement::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSSVGUseElement, Base>(exec, &JSSVGUseElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGUseElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->xAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGUseElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->yAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGUseElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->widthAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGUseElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedLength> obj = imp->heightAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGUseElementInstanceRoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementInstanceRoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->instanceRoot()));
 }
 
-JSValuePtr jsSVGUseElementAnimatedInstanceRoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementAnimatedInstanceRoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->animatedInstanceRoot()));
 }
 
-JSValuePtr jsSVGUseElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->hrefAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGUseElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementRequiredFeatures(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredFeatures()), imp);
 }
 
-JSValuePtr jsSVGUseElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementRequiredExtensions(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->requiredExtensions()), imp);
 }
 
-JSValuePtr jsSVGUseElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementSystemLanguage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->systemLanguage()), imp);
 }
 
-JSValuePtr jsSVGUseElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementXmllang(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmllang());
 }
 
-JSValuePtr jsSVGUseElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementXmlspace(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->xmlspace());
 }
 
-JSValuePtr jsSVGUseElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGUseElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementClassName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedString> obj = imp->classNameAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGUseElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsSVGUseElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementTransform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedTransformList> obj = imp->transformAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGUseElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementNearestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->nearestViewportElement()));
 }
 
-JSValuePtr jsSVGUseElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGUseElementFarthestViewportElement(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->farthestViewportElement()));
 }
 
-void JSSVGUseElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGUseElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGUseElement, Base>(exec, propertyName, value, &JSSVGUseElementTable, this, slot);
 }
 
-void setJSSVGUseElementXmllang(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGUseElementXmllang(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(thisObject)->impl());
-    imp->setXmllang(value->toString(exec));
+    imp->setXmllang(value.toString(exec));
 }
 
-void setJSSVGUseElementXmlspace(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGUseElementXmlspace(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGUseElement* imp = static_cast<SVGUseElement*>(static_cast<JSSVGUseElement*>(thisObject)->impl());
-    imp->setXmlspace(value->toString(exec));
+    imp->setXmlspace(value.toString(exec));
 }
 
-JSValuePtr jsSVGUseElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionHasExtension(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGUseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGUseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGUseElement* castedThisObj = static_cast<JSSVGUseElement*>(asObject(thisValue));
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThisObj->impl());
-    const UString& extension = args.at(exec, 0)->toString(exec);
+    const UString& extension = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->hasExtension(extension));
+    JSC::JSValue result = jsBoolean(imp->hasExtension(extension));
     return result;
 }
 
-JSValuePtr jsSVGUseElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetPresentationAttribute(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGUseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGUseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGUseElement* castedThisObj = static_cast<JSSVGUseElement*>(asObject(thisValue));
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThisObj->impl());
-    const UString& name = args.at(exec, 0)->toString(exec);
+    const UString& name = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->getPresentationAttribute(name)));
     return result;
 }
 
-JSValuePtr jsSVGUseElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetBBox(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGUseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGUseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGUseElement* castedThisObj = static_cast<JSSVGUseElement*>(asObject(thisValue));
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->getBBox()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGUseElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGUseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGUseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGUseElement* castedThisObj = static_cast<JSSVGUseElement*>(asObject(thisValue));
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGUseElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetScreenCTM(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGUseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGUseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGUseElement* castedThisObj = static_cast<JSSVGUseElement*>(asObject(thisValue));
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getScreenCTM()).get(), imp);
     return result;
 }
 
-JSValuePtr jsSVGUseElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetTransformToElement(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSSVGUseElement::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSSVGUseElement::s_info))
         return throwError(exec, TypeError);
     JSSVGUseElement* castedThisObj = static_cast<JSSVGUseElement*>(asObject(thisValue));
     SVGUseElement* imp = static_cast<SVGUseElement*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    SVGElement* element = toSVGElement(args.at(exec, 0));
+    SVGElement* element = toSVGElement(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
+    JSC::JSValue result = toJS(exec, JSSVGStaticPODTypeWrapper<TransformationMatrix>::create(imp->getTransformToElement(element, ec)).get(), imp);
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h
index 1b5e357..e3ffef8 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGUseElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGUseElement_h
 #define JSSVGUseElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGUseElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGUseElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGUseElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGUseElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,34 +64,34 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsSVGUseElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGUseElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGUseElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGUseElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGUseElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsSVGUseElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionHasExtension(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetPresentationAttribute(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetBBox(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetScreenCTM(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsSVGUseElementPrototypeFunctionGetTransformToElement(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsSVGUseElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementInstanceRoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementAnimatedInstanceRoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGUseElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGUseElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGUseElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsSVGUseElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGUseElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementInstanceRoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementAnimatedInstanceRoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementRequiredFeatures(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementRequiredExtensions(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementSystemLanguage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementXmllang(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGUseElementXmllang(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGUseElementXmlspace(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGUseElementXmlspace(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsSVGUseElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementClassName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementTransform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementNearestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGUseElementFarthestViewportElement(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.cpp
index d8291ba..115ed1e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.cpp
@@ -20,28 +20,24 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGViewElement.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGAnimatedBoolean.h"
 #include "JSSVGAnimatedPreserveAspectRatio.h"
 #include "JSSVGAnimatedRect.h"
 #include "JSSVGStringList.h"
 #include "SVGStringList.h"
 #include "SVGViewElement.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGViewElement)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGViewElement);
 
 /* Hash table */
 
@@ -81,9 +77,9 @@ static const HashTable JSSVGViewElementPrototypeTable =
 
 const ClassInfo JSSVGViewElementPrototype::s_info = { "SVGViewElementPrototype", 0, &JSSVGViewElementPrototypeTable, 0 };
 
-JSObject* JSSVGViewElementPrototype::self(ExecState* exec)
+JSObject* JSSVGViewElementPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGViewElement>(exec);
+    return getDOMPrototype<JSSVGViewElement>(exec, globalObject);
 }
 
 bool JSSVGViewElementPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -98,9 +94,9 @@ JSSVGViewElement::JSSVGViewElement(PassRefPtr<Structure> structure, PassRefPtr<S
 {
 }
 
-JSObject* JSSVGViewElement::createPrototype(ExecState* exec)
+JSObject* JSSVGViewElement::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGViewElementPrototype(JSSVGViewElementPrototype::createStructure(JSSVGElementPrototype::self(exec)));
+    return new (exec) JSSVGViewElementPrototype(JSSVGViewElementPrototype::createStructure(JSSVGElementPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGViewElement::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -108,63 +104,68 @@ bool JSSVGViewElement::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSSVGViewElement, Base>(exec, &JSSVGViewElementTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGViewElementViewTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGViewElementViewTarget(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGViewElement* imp = static_cast<SVGViewElement*>(static_cast<JSSVGViewElement*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->viewTarget()), imp);
 }
 
-JSValuePtr jsSVGViewElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGViewElementExternalResourcesRequired(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGViewElement* imp = static_cast<SVGViewElement*>(static_cast<JSSVGViewElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedBoolean> obj = imp->externalResourcesRequiredAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGViewElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGViewElementViewBox(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGViewElement* imp = static_cast<SVGViewElement*>(static_cast<JSSVGViewElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedRect> obj = imp->viewBoxAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGViewElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGViewElementPreserveAspectRatio(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGViewElement* imp = static_cast<SVGViewElement*>(static_cast<JSSVGViewElement*>(asObject(slot.slotBase()))->impl());
     RefPtr<SVGAnimatedPreserveAspectRatio> obj = imp->preserveAspectRatioAnimated();
     return toJS(exec, obj.get(), imp);
 }
 
-JSValuePtr jsSVGViewElementZoomAndPan(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGViewElementZoomAndPan(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGViewElement* imp = static_cast<SVGViewElement*>(static_cast<JSSVGViewElement*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->zoomAndPan());
 }
 
-void JSSVGViewElement::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSSVGViewElement::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSSVGViewElement, Base>(exec, propertyName, value, &JSSVGViewElementTable, this, slot);
 }
 
-void setJSSVGViewElementZoomAndPan(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSSVGViewElementZoomAndPan(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     SVGViewElement* imp = static_cast<SVGViewElement*>(static_cast<JSSVGViewElement*>(thisObject)->impl());
-    imp->setZoomAndPan(value->toInt32(exec));
+    imp->setZoomAndPan(value.toInt32(exec));
 }
 
 // Constant getters
 
-JSValuePtr jsSVGViewElementSVG_ZOOMANDPAN_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGViewElementSVG_ZOOMANDPAN_UNKNOWN(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsSVGViewElementSVG_ZOOMANDPAN_DISABLE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGViewElementSVG_ZOOMANDPAN_DISABLE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsSVGViewElementSVG_ZOOMANDPAN_MAGNIFY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsSVGViewElementSVG_ZOOMANDPAN_MAGNIFY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h b/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h
index 0575720..0941a00 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGViewElement.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGViewElement_h
 #define JSSVGViewElement_h
 
-
 #if ENABLE(SVG)
 
 #include "JSSVGElement.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,13 +34,13 @@ class JSSVGViewElement : public JSSVGElement {
     typedef JSSVGElement Base;
 public:
     JSSVGViewElement(PassRefPtr<JSC::Structure>, PassRefPtr<SVGViewElement>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,12 +49,13 @@ public:
 
 
 class JSSVGViewElementPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -63,17 +64,17 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGViewElementViewTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGViewElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGViewElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGViewElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGViewElementZoomAndPan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSSVGViewElementZoomAndPan(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsSVGViewElementViewTarget(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGViewElementExternalResourcesRequired(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGViewElementViewBox(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGViewElementPreserveAspectRatio(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGViewElementZoomAndPan(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSSVGViewElementZoomAndPan(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 // Constants
 
-JSC::JSValuePtr jsSVGViewElementSVG_ZOOMANDPAN_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGViewElementSVG_ZOOMANDPAN_DISABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGViewElementSVG_ZOOMANDPAN_MAGNIFY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGViewElementSVG_ZOOMANDPAN_UNKNOWN(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGViewElementSVG_ZOOMANDPAN_DISABLE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGViewElementSVG_ZOOMANDPAN_MAGNIFY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.cpp
index 860b3d7..5434095 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.cpp
@@ -20,25 +20,21 @@
 
 #include "config.h"
 
-
 #if ENABLE(SVG)
 
-#include "SVGElement.h"
 #include "JSSVGZoomEvent.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSSVGPoint.h"
 #include "JSSVGRect.h"
 #include "SVGZoomEvent.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSSVGZoomEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSSVGZoomEvent);
 
 /* Hash table */
 
@@ -75,21 +71,21 @@ static const HashTable JSSVGZoomEventPrototypeTable =
 
 const ClassInfo JSSVGZoomEventPrototype::s_info = { "SVGZoomEventPrototype", 0, &JSSVGZoomEventPrototypeTable, 0 };
 
-JSObject* JSSVGZoomEventPrototype::self(ExecState* exec)
+JSObject* JSSVGZoomEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSSVGZoomEvent>(exec);
+    return getDOMPrototype<JSSVGZoomEvent>(exec, globalObject);
 }
 
 const ClassInfo JSSVGZoomEvent::s_info = { "SVGZoomEvent", &JSUIEvent::s_info, &JSSVGZoomEventTable, 0 };
 
-JSSVGZoomEvent::JSSVGZoomEvent(PassRefPtr<Structure> structure, PassRefPtr<SVGZoomEvent> impl, SVGElement* context)
+JSSVGZoomEvent::JSSVGZoomEvent(PassRefPtr<Structure> structure, PassRefPtr<SVGZoomEvent> impl, SVGElement*)
     : JSUIEvent(structure, impl)
 {
 }
 
-JSObject* JSSVGZoomEvent::createPrototype(ExecState* exec)
+JSObject* JSSVGZoomEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSSVGZoomEventPrototype(JSSVGZoomEventPrototype::createStructure(JSUIEventPrototype::self(exec)));
+    return new (exec) JSSVGZoomEventPrototype(JSSVGZoomEventPrototype::createStructure(JSUIEventPrototype::self(exec, globalObject)));
 }
 
 bool JSSVGZoomEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -97,32 +93,37 @@ bool JSSVGZoomEvent::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSSVGZoomEvent, Base>(exec, &JSSVGZoomEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsSVGZoomEventZoomRectScreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGZoomEventZoomRectScreen(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGZoomEvent* imp = static_cast<SVGZoomEvent*>(static_cast<JSSVGZoomEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, JSSVGStaticPODTypeWrapper<FloatRect>::create(imp->zoomRectScreen()).get(), 0);
 }
 
-JSValuePtr jsSVGZoomEventPreviousScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGZoomEventPreviousScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGZoomEvent* imp = static_cast<SVGZoomEvent*>(static_cast<JSSVGZoomEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->previousScale());
 }
 
-JSValuePtr jsSVGZoomEventPreviousTranslate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGZoomEventPreviousTranslate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGZoomEvent* imp = static_cast<SVGZoomEvent*>(static_cast<JSSVGZoomEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->previousTranslate()).get(), 0);
 }
 
-JSValuePtr jsSVGZoomEventNewScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGZoomEventNewScale(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGZoomEvent* imp = static_cast<SVGZoomEvent*>(static_cast<JSSVGZoomEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->newScale());
 }
 
-JSValuePtr jsSVGZoomEventNewTranslate(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsSVGZoomEventNewTranslate(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     SVGZoomEvent* imp = static_cast<SVGZoomEvent*>(static_cast<JSSVGZoomEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, JSSVGStaticPODTypeWrapper<FloatPoint>::create(imp->newTranslate()).get(), 0);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h b/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h
index 9412819..59d27a2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSSVGZoomEvent.h
@@ -21,10 +21,10 @@
 #ifndef JSSVGZoomEvent_h
 #define JSSVGZoomEvent_h
 
-
 #if ENABLE(SVG)
 
 #include "JSUIEvent.h"
+#include "SVGElement.h"
 
 namespace WebCore {
 
@@ -34,12 +34,12 @@ class JSSVGZoomEvent : public JSUIEvent {
     typedef JSUIEvent Base;
 public:
     JSSVGZoomEvent(PassRefPtr<JSC::Structure>, PassRefPtr<SVGZoomEvent>, SVGElement* context);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -48,8 +48,9 @@ public:
 
 
 class JSSVGZoomEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSSVGZoomEventPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -57,11 +58,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsSVGZoomEventZoomRectScreen(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGZoomEventPreviousScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGZoomEventPreviousTranslate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGZoomEventNewScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsSVGZoomEventNewTranslate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGZoomEventZoomRectScreen(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGZoomEventPreviousScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGZoomEventPreviousTranslate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGZoomEventNewScale(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsSVGZoomEventNewTranslate(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSScreen.cpp b/src/3rdparty/webkit/WebCore/generated/JSScreen.cpp
index 67f6aae..b68c308 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSScreen.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSScreen.cpp
@@ -19,20 +19,17 @@
 */
 
 #include "config.h"
-
 #include "JSScreen.h"
 
-#include <wtf/GetPtr.h>
-
 #include "Screen.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSScreen)
+ASSERT_CLASS_FITS_IN_CELL(JSScreen);
 
 /* Hash table */
 
@@ -72,9 +69,9 @@ static const HashTable JSScreenPrototypeTable =
 
 const ClassInfo JSScreenPrototype::s_info = { "ScreenPrototype", 0, &JSScreenPrototypeTable, 0 };
 
-JSObject* JSScreenPrototype::self(ExecState* exec)
+JSObject* JSScreenPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSScreen>(exec);
+    return getDOMPrototype<JSScreen>(exec, globalObject);
 }
 
 const ClassInfo JSScreen::s_info = { "Screen", 0, &JSScreenTable, 0 };
@@ -88,12 +85,11 @@ JSScreen::JSScreen(PassRefPtr<Structure> structure, PassRefPtr<Screen> impl)
 JSScreen::~JSScreen()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSScreen::createPrototype(ExecState* exec)
+JSObject* JSScreen::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSScreenPrototype(JSScreenPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSScreenPrototype(JSScreenPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSScreen::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -101,61 +97,69 @@ bool JSScreen::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNam
     return getStaticValueSlot<JSScreen, Base>(exec, &JSScreenTable, this, propertyName, slot);
 }
 
-JSValuePtr jsScreenHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(static_cast<JSScreen*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->height());
 }
 
-JSValuePtr jsScreenWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(static_cast<JSScreen*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->width());
 }
 
-JSValuePtr jsScreenColorDepth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenColorDepth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(static_cast<JSScreen*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->colorDepth());
 }
 
-JSValuePtr jsScreenPixelDepth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenPixelDepth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(static_cast<JSScreen*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->pixelDepth());
 }
 
-JSValuePtr jsScreenAvailLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenAvailLeft(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(static_cast<JSScreen*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->availLeft());
 }
 
-JSValuePtr jsScreenAvailTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenAvailTop(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(static_cast<JSScreen*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->availTop());
 }
 
-JSValuePtr jsScreenAvailHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenAvailHeight(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(static_cast<JSScreen*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->availHeight());
 }
 
-JSValuePtr jsScreenAvailWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsScreenAvailWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Screen* imp = static_cast<Screen*>(static_cast<JSScreen*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->availWidth());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Screen* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Screen* object)
 {
     return getDOMObjectWrapper<JSScreen>(exec, object);
 }
-Screen* toScreen(JSC::JSValuePtr value)
+Screen* toScreen(JSC::JSValue value)
 {
-    return value->isObject(&JSScreen::s_info) ? static_cast<JSScreen*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSScreen::s_info) ? static_cast<JSScreen*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSScreen.h b/src/3rdparty/webkit/WebCore/generated/JSScreen.h
index 60d0183..4e7be7b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSScreen.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSScreen.h
@@ -34,12 +34,12 @@ class JSScreen : public DOMObject {
 public:
     JSScreen(PassRefPtr<JSC::Structure>, PassRefPtr<Screen>);
     virtual ~JSScreen();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -50,12 +50,13 @@ private:
     RefPtr<Screen> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Screen*);
-Screen* toScreen(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Screen*);
+Screen* toScreen(JSC::JSValue);
 
 class JSScreenPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSScreenPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -63,14 +64,14 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsScreenHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsScreenWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsScreenColorDepth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsScreenPixelDepth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsScreenAvailLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsScreenAvailTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsScreenAvailHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsScreenAvailWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsScreenHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsScreenWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsScreenColorDepth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsScreenPixelDepth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsScreenAvailLeft(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsScreenAvailTop(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsScreenAvailHeight(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsScreenAvailWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp b/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp
index ea24553..bcdea8b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorage.cpp
@@ -20,24 +20,24 @@
 
 #include "config.h"
 
-#include "JSStorage.h"
+#if ENABLE(DOM_STORAGE)
 
-#include <wtf/GetPtr.h>
+#include "JSStorage.h"
 
 #include "AtomicString.h"
 #include "JSStorageCustom.h"
 #include "KURL.h"
 #include "Storage.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSStorage)
+ASSERT_CLASS_FITS_IN_CELL(JSStorage);
 
 /* Hash table */
 
@@ -74,13 +74,13 @@ public:
     JSStorageConstructor(ExecState* exec)
         : DOMObject(JSStorageConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSStoragePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSStoragePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -114,9 +114,9 @@ static const HashTable JSStoragePrototypeTable =
 
 const ClassInfo JSStoragePrototype::s_info = { "StoragePrototype", 0, &JSStoragePrototypeTable, 0 };
 
-JSObject* JSStoragePrototype::self(ExecState* exec)
+JSObject* JSStoragePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSStorage>(exec);
+    return getDOMPrototype<JSStorage>(exec, globalObject);
 }
 
 bool JSStoragePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -135,12 +135,11 @@ JSStorage::JSStorage(PassRefPtr<Structure> structure, PassRefPtr<Storage> impl)
 JSStorage::~JSStorage()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSStorage::createPrototype(ExecState* exec)
+JSObject* JSStorage::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSStoragePrototype(JSStoragePrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSStoragePrototype(JSStoragePrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSStorage::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -157,93 +156,92 @@ bool JSStorage::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSStorage, Base>(exec, &JSStorageTable, this, propertyName, slot);
 }
 
-JSValuePtr jsStorageLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Storage* imp = static_cast<Storage*>(static_cast<JSStorage*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsStorageConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSStorage*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSStorage::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSStorage::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    if (customPut(exec, propertyName, value, slot))
+    if (putDelegate(exec, propertyName, value, slot))
         return;
     Base::put(exec, propertyName, value, slot);
 }
 
-void JSStorage::getPropertyNames(ExecState* exec, PropertyNameArray& propertyNames)
-{
-    if (customGetPropertyNames(exec, propertyNames))
-        return;
-     Base::getPropertyNames(exec, propertyNames);
-}
-
-JSValuePtr JSStorage::getConstructor(ExecState* exec)
+JSValue JSStorage::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSStorageConstructor>(exec);
 }
 
-JSValuePtr jsStoragePrototypeFunctionKey(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsStoragePrototypeFunctionKey(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSStorage::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSStorage::s_info))
         return throwError(exec, TypeError);
     JSStorage* castedThisObj = static_cast<JSStorage*>(asObject(thisValue));
     Storage* imp = static_cast<Storage*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->key(index, ec));
+    JSC::JSValue result = jsString(exec, imp->key(index, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsStoragePrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsStoragePrototypeFunctionGetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSStorage::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSStorage::s_info))
         return throwError(exec, TypeError);
     JSStorage* castedThisObj = static_cast<JSStorage*>(asObject(thisValue));
     Storage* imp = static_cast<Storage*>(castedThisObj->impl());
-    const UString& key = args.at(exec, 0)->toString(exec);
+    const UString& key = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->getItem(key));
+    JSC::JSValue result = jsStringOrNull(exec, imp->getItem(key));
     return result;
 }
 
-JSValuePtr jsStoragePrototypeFunctionSetItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsStoragePrototypeFunctionSetItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSStorage::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSStorage::s_info))
         return throwError(exec, TypeError);
     JSStorage* castedThisObj = static_cast<JSStorage*>(asObject(thisValue));
     Storage* imp = static_cast<Storage*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& key = args.at(exec, 0)->toString(exec);
-    const UString& data = args.at(exec, 1)->toString(exec);
+    const UString& key = args.at(0).toString(exec);
+    const UString& data = args.at(1).toString(exec);
 
     imp->setItem(key, data, ec);
     setDOMException(exec, ec);
     return jsUndefined();
 }
 
-JSValuePtr jsStoragePrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsStoragePrototypeFunctionRemoveItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSStorage::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSStorage::s_info))
         return throwError(exec, TypeError);
     JSStorage* castedThisObj = static_cast<JSStorage*>(asObject(thisValue));
     Storage* imp = static_cast<Storage*>(castedThisObj->impl());
-    const UString& key = args.at(exec, 0)->toString(exec);
+    const UString& key = args.at(0).toString(exec);
 
     imp->removeItem(key);
     return jsUndefined();
 }
 
-JSValuePtr jsStoragePrototypeFunctionClear(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsStoragePrototypeFunctionClear(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSStorage::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSStorage::s_info))
         return throwError(exec, TypeError);
     JSStorage* castedThisObj = static_cast<JSStorage*>(asObject(thisValue));
     Storage* imp = static_cast<Storage*>(castedThisObj->impl());
@@ -252,13 +250,15 @@ JSValuePtr jsStoragePrototypeFunctionClear(ExecState* exec, JSObject*, JSValuePt
     return jsUndefined();
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Storage* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Storage* object)
 {
     return getDOMObjectWrapper<JSStorage>(exec, object);
 }
-Storage* toStorage(JSC::JSValuePtr value)
+Storage* toStorage(JSC::JSValue value)
 {
-    return value->isObject(&JSStorage::s_info) ? static_cast<JSStorage*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSStorage::s_info) ? static_cast<JSStorage*>(asObject(value))->impl() : 0;
 }
 
 }
+
+#endif // ENABLE(DOM_STORAGE)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorage.h b/src/3rdparty/webkit/WebCore/generated/JSStorage.h
index 4a3579a..077ccfc 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorage.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorage.h
@@ -21,6 +21,8 @@
 #ifndef JSStorage_h
 #define JSStorage_h
 
+#if ENABLE(DOM_STORAGE)
+
 #include "JSDOMBinding.h"
 #include <runtime/JSGlobalObject.h>
 #include <runtime/ObjectPrototype.h>
@@ -34,41 +36,41 @@ class JSStorage : public DOMObject {
 public:
     JSStorage(PassRefPtr<JSC::Structure>, PassRefPtr<Storage>);
     virtual ~JSStorage();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
-    bool customPut(JSC::ExecState*, const JSC::Identifier&, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    bool putDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual bool deleteProperty(JSC::ExecState*, const JSC::Identifier&);
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    bool customGetPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     Storage* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Storage> m_impl;
 private:
     static bool canGetItemsForName(JSC::ExecState*, Storage*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Storage*);
-Storage* toStorage(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Storage*);
+Storage* toStorage(JSC::JSValue);
 
 class JSStoragePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -77,16 +79,18 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsStoragePrototypeFunctionKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsStoragePrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsStoragePrototypeFunctionSetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsStoragePrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsStoragePrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsStoragePrototypeFunctionKey(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsStoragePrototypeFunctionGetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsStoragePrototypeFunctionSetItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsStoragePrototypeFunctionRemoveItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsStoragePrototypeFunctionClear(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsStorageLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStorageConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStorageLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStorageConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
+#endif // ENABLE(DOM_STORAGE)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp
index eda205c..293d0ad 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.cpp
@@ -20,34 +20,36 @@
 
 #include "config.h"
 
-#include "JSStorageEvent.h"
+#if ENABLE(DOM_STORAGE)
 
-#include <wtf/GetPtr.h>
+#include "JSStorageEvent.h"
 
 #include "DOMWindow.h"
 #include "JSDOMWindow.h"
+#include "JSStorage.h"
 #include "KURL.h"
+#include "Storage.h"
 #include "StorageEvent.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSStorageEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSStorageEvent);
 
 /* Hash table */
 
-static const HashTableValue JSStorageEventTableValues[7] =
+static const HashTableValue JSStorageEventTableValues[8] =
 {
     { "key", DontDelete|ReadOnly, (intptr_t)jsStorageEventKey, (intptr_t)0 },
     { "oldValue", DontDelete|ReadOnly, (intptr_t)jsStorageEventOldValue, (intptr_t)0 },
     { "newValue", DontDelete|ReadOnly, (intptr_t)jsStorageEventNewValue, (intptr_t)0 },
     { "uri", DontDelete|ReadOnly, (intptr_t)jsStorageEventUri, (intptr_t)0 },
     { "source", DontDelete|ReadOnly, (intptr_t)jsStorageEventSource, (intptr_t)0 },
+    { "storageArea", DontDelete|ReadOnly, (intptr_t)jsStorageEventStorageArea, (intptr_t)0 },
     { "constructor", DontEnum|ReadOnly, (intptr_t)jsStorageEventConstructor, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
@@ -78,13 +80,13 @@ public:
     JSStorageEventConstructor(ExecState* exec)
         : DOMObject(JSStorageEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSStorageEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSStorageEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -101,7 +103,7 @@ bool JSStorageEventConstructor::getOwnPropertySlot(ExecState* exec, const Identi
 
 static const HashTableValue JSStorageEventPrototypeTableValues[2] =
 {
-    { "initStorageEvent", DontDelete|Function, (intptr_t)jsStorageEventPrototypeFunctionInitStorageEvent, (intptr_t)8 },
+    { "initStorageEvent", DontDelete|Function, (intptr_t)jsStorageEventPrototypeFunctionInitStorageEvent, (intptr_t)9 },
     { 0, 0, 0, 0 }
 };
 
@@ -114,9 +116,9 @@ static const HashTable JSStorageEventPrototypeTable =
 
 const ClassInfo JSStorageEventPrototype::s_info = { "StorageEventPrototype", 0, &JSStorageEventPrototypeTable, 0 };
 
-JSObject* JSStorageEventPrototype::self(ExecState* exec)
+JSObject* JSStorageEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSStorageEvent>(exec);
+    return getDOMPrototype<JSStorageEvent>(exec, globalObject);
 }
 
 bool JSStorageEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,9 +133,9 @@ JSStorageEvent::JSStorageEvent(PassRefPtr<Structure> structure, PassRefPtr<Stora
 {
 }
 
-JSObject* JSStorageEvent::createPrototype(ExecState* exec)
+JSObject* JSStorageEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSStorageEventPrototype(JSStorageEventPrototype::createStructure(JSEventPrototype::self(exec)));
+    return new (exec) JSStorageEventPrototype(JSStorageEventPrototype::createStructure(JSEventPrototype::self(exec, globalObject)));
 }
 
 bool JSStorageEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -141,63 +143,79 @@ bool JSStorageEvent::getOwnPropertySlot(ExecState* exec, const Identifier& prope
     return getStaticValueSlot<JSStorageEvent, Base>(exec, &JSStorageEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsStorageEventKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageEventKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StorageEvent* imp = static_cast<StorageEvent*>(static_cast<JSStorageEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->key());
 }
 
-JSValuePtr jsStorageEventOldValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageEventOldValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StorageEvent* imp = static_cast<StorageEvent*>(static_cast<JSStorageEvent*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->oldValue());
 }
 
-JSValuePtr jsStorageEventNewValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageEventNewValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StorageEvent* imp = static_cast<StorageEvent*>(static_cast<JSStorageEvent*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->newValue());
 }
 
-JSValuePtr jsStorageEventUri(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageEventUri(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StorageEvent* imp = static_cast<StorageEvent*>(static_cast<JSStorageEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->uri());
 }
 
-JSValuePtr jsStorageEventSource(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageEventSource(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StorageEvent* imp = static_cast<StorageEvent*>(static_cast<JSStorageEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->source()));
 }
 
-JSValuePtr jsStorageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStorageEventStorageArea(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    StorageEvent* imp = static_cast<StorageEvent*>(static_cast<JSStorageEvent*>(asObject(slot.slotBase()))->impl());
+    return toJS(exec, WTF::getPtr(imp->storageArea()));
+}
+
+JSValue jsStorageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSStorageEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSStorageEvent::getConstructor(ExecState* exec)
+JSValue JSStorageEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSStorageEventConstructor>(exec);
 }
 
-JSValuePtr jsStorageEventPrototypeFunctionInitStorageEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsStorageEventPrototypeFunctionInitStorageEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSStorageEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSStorageEvent::s_info))
         return throwError(exec, TypeError);
     JSStorageEvent* castedThisObj = static_cast<JSStorageEvent*>(asObject(thisValue));
     StorageEvent* imp = static_cast<StorageEvent*>(castedThisObj->impl());
-    const UString& typeArg = args.at(exec, 0)->toString(exec);
-    bool canBubbleArg = args.at(exec, 1)->toBoolean(exec);
-    bool cancelableArg = args.at(exec, 2)->toBoolean(exec);
-    const UString& keyArg = args.at(exec, 3)->toString(exec);
-    const UString& oldValueArg = valueToStringWithNullCheck(exec, args.at(exec, 4));
-    const UString& newValueArg = valueToStringWithNullCheck(exec, args.at(exec, 5));
-    const UString& uriArg = args.at(exec, 6)->toString(exec);
-    DOMWindow* sourceArg = toDOMWindow(args.at(exec, 7));
-
-    imp->initStorageEvent(typeArg, canBubbleArg, cancelableArg, keyArg, oldValueArg, newValueArg, uriArg, sourceArg);
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    const UString& keyArg = args.at(3).toString(exec);
+    const UString& oldValueArg = valueToStringWithNullCheck(exec, args.at(4));
+    const UString& newValueArg = valueToStringWithNullCheck(exec, args.at(5));
+    const UString& uriArg = args.at(6).toString(exec);
+    DOMWindow* sourceArg = toDOMWindow(args.at(7));
+    Storage* storageAreaArg = toStorage(args.at(8));
+
+    imp->initStorageEvent(typeArg, canBubbleArg, cancelableArg, keyArg, oldValueArg, newValueArg, uriArg, sourceArg, storageAreaArg);
     return jsUndefined();
 }
 
 
 }
+
+#endif // ENABLE(DOM_STORAGE)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h
index 7489484..ec32abf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStorageEvent.h
@@ -21,6 +21,8 @@
 #ifndef JSStorageEvent_h
 #define JSStorageEvent_h
 
+#if ENABLE(DOM_STORAGE)
+
 #include "JSEvent.h"
 
 namespace WebCore {
@@ -31,27 +33,28 @@ class JSStorageEvent : public JSEvent {
     typedef JSEvent Base;
 public:
     JSStorageEvent(PassRefPtr<JSC::Structure>, PassRefPtr<StorageEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSStorageEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,16 +63,19 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsStorageEventPrototypeFunctionInitStorageEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsStorageEventPrototypeFunctionInitStorageEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsStorageEventKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStorageEventOldValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStorageEventNewValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStorageEventUri(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStorageEventSource(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStorageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStorageEventKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStorageEventOldValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStorageEventNewValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStorageEventUri(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStorageEventSource(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStorageEventStorageArea(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStorageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
+#endif // ENABLE(DOM_STORAGE)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp
index 193edda..04c6895 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.cpp
@@ -19,11 +19,8 @@
 */
 
 #include "config.h"
-
 #include "JSStyleSheet.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSMediaList.h"
 #include "JSNode.h"
 #include "JSStyleSheet.h"
@@ -31,14 +28,13 @@
 #include "MediaList.h"
 #include "Node.h"
 #include "StyleSheet.h"
-
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSStyleSheet)
+ASSERT_CLASS_FITS_IN_CELL(JSStyleSheet);
 
 /* Hash table */
 
@@ -81,13 +77,13 @@ public:
     JSStyleSheetConstructor(ExecState* exec)
         : DOMObject(JSStyleSheetConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSStyleSheetPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSStyleSheetPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -116,9 +112,9 @@ static const HashTable JSStyleSheetPrototypeTable =
 
 const ClassInfo JSStyleSheetPrototype::s_info = { "StyleSheetPrototype", 0, &JSStyleSheetPrototypeTable, 0 };
 
-JSObject* JSStyleSheetPrototype::self(ExecState* exec)
+JSObject* JSStyleSheetPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSStyleSheet>(exec);
+    return getDOMPrototype<JSStyleSheet>(exec, globalObject);
 }
 
 const ClassInfo JSStyleSheet::s_info = { "StyleSheet", 0, &JSStyleSheetTable, 0 };
@@ -132,12 +128,11 @@ JSStyleSheet::JSStyleSheet(PassRefPtr<Structure> structure, PassRefPtr<StyleShee
 JSStyleSheet::~JSStyleSheet()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSStyleSheet::createPrototype(ExecState* exec)
+JSObject* JSStyleSheet::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSStyleSheetPrototype(JSStyleSheetPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSStyleSheetPrototype(JSStyleSheetPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSStyleSheet::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -145,71 +140,78 @@ bool JSStyleSheet::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSStyleSheet, Base>(exec, &JSStyleSheetTable, this, propertyName, slot);
 }
 
-JSValuePtr jsStyleSheetType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StyleSheet* imp = static_cast<StyleSheet*>(static_cast<JSStyleSheet*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->type());
 }
 
-JSValuePtr jsStyleSheetDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetDisabled(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StyleSheet* imp = static_cast<StyleSheet*>(static_cast<JSStyleSheet*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->disabled());
 }
 
-JSValuePtr jsStyleSheetOwnerNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetOwnerNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StyleSheet* imp = static_cast<StyleSheet*>(static_cast<JSStyleSheet*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->ownerNode()));
 }
 
-JSValuePtr jsStyleSheetParentStyleSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetParentStyleSheet(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StyleSheet* imp = static_cast<StyleSheet*>(static_cast<JSStyleSheet*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->parentStyleSheet()));
 }
 
-JSValuePtr jsStyleSheetHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StyleSheet* imp = static_cast<StyleSheet*>(static_cast<JSStyleSheet*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->href());
 }
 
-JSValuePtr jsStyleSheetTitle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetTitle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StyleSheet* imp = static_cast<StyleSheet*>(static_cast<JSStyleSheet*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->title());
 }
 
-JSValuePtr jsStyleSheetMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetMedia(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StyleSheet* imp = static_cast<StyleSheet*>(static_cast<JSStyleSheet*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->media()));
 }
 
-JSValuePtr jsStyleSheetConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSStyleSheet*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSStyleSheet::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSStyleSheet::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSStyleSheet, Base>(exec, propertyName, value, &JSStyleSheetTable, this, slot);
 }
 
-void setJSStyleSheetDisabled(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSStyleSheetDisabled(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     StyleSheet* imp = static_cast<StyleSheet*>(static_cast<JSStyleSheet*>(thisObject)->impl());
-    imp->setDisabled(value->toBoolean(exec));
+    imp->setDisabled(value.toBoolean(exec));
 }
 
-JSValuePtr JSStyleSheet::getConstructor(ExecState* exec)
+JSValue JSStyleSheet::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSStyleSheetConstructor>(exec);
 }
 
-StyleSheet* toStyleSheet(JSC::JSValuePtr value)
+StyleSheet* toStyleSheet(JSC::JSValue value)
 {
-    return value->isObject(&JSStyleSheet::s_info) ? static_cast<JSStyleSheet*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSStyleSheet::s_info) ? static_cast<JSStyleSheet*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h
index c477eeb..d8e751e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheet.h
@@ -34,32 +34,33 @@ class JSStyleSheet : public DOMObject {
 public:
     JSStyleSheet(PassRefPtr<JSC::Structure>, PassRefPtr<StyleSheet>);
     virtual ~JSStyleSheet();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void mark();
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     StyleSheet* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<StyleSheet> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, StyleSheet*);
-StyleSheet* toStyleSheet(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, StyleSheet*);
+StyleSheet* toStyleSheet(JSC::JSValue);
 
 class JSStyleSheetPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSStyleSheetPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -67,15 +68,15 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsStyleSheetType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStyleSheetDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSStyleSheetDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsStyleSheetOwnerNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStyleSheetParentStyleSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStyleSheetHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStyleSheetTitle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStyleSheetMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStyleSheetConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStyleSheetType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStyleSheetDisabled(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSStyleSheetDisabled(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsStyleSheetOwnerNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStyleSheetParentStyleSheet(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStyleSheetHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStyleSheetTitle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStyleSheetMedia(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStyleSheetConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp
index fc4396c..fccd08b 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.cpp
@@ -19,25 +19,22 @@
 */
 
 #include "config.h"
-
 #include "JSStyleSheetList.h"
 
-#include <wtf/GetPtr.h>
-
-#include <runtime/PropertyNameArray.h>
 #include "AtomicString.h"
 #include "JSStyleSheet.h"
 #include "StyleSheet.h"
 #include "StyleSheetList.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSStyleSheetList)
+ASSERT_CLASS_FITS_IN_CELL(JSStyleSheetList);
 
 /* Hash table */
 
@@ -74,13 +71,13 @@ public:
     JSStyleSheetListConstructor(ExecState* exec)
         : DOMObject(JSStyleSheetListConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSStyleSheetListPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSStyleSheetListPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -110,9 +107,9 @@ static const HashTable JSStyleSheetListPrototypeTable =
 
 const ClassInfo JSStyleSheetListPrototype::s_info = { "StyleSheetListPrototype", 0, &JSStyleSheetListPrototypeTable, 0 };
 
-JSObject* JSStyleSheetListPrototype::self(ExecState* exec)
+JSObject* JSStyleSheetListPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSStyleSheetList>(exec);
+    return getDOMPrototype<JSStyleSheetList>(exec, globalObject);
 }
 
 bool JSStyleSheetListPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -131,12 +128,11 @@ JSStyleSheetList::JSStyleSheetList(PassRefPtr<Structure> structure, PassRefPtr<S
 JSStyleSheetList::~JSStyleSheetList()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSStyleSheetList::createPrototype(ExecState* exec)
+JSObject* JSStyleSheetList::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSStyleSheetListPrototype(JSStyleSheetListPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSStyleSheetListPrototype(JSStyleSheetListPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSStyleSheetList::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -168,13 +164,14 @@ bool JSStyleSheetList::getOwnPropertySlot(ExecState* exec, unsigned propertyName
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsStyleSheetListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetListLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     StyleSheetList* imp = static_cast<StyleSheetList*>(static_cast<JSStyleSheetList*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsStyleSheetListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsStyleSheetListConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSStyleSheetList*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
@@ -185,37 +182,38 @@ void JSStyleSheetList::getPropertyNames(ExecState* exec, PropertyNameArray& prop
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSStyleSheetList::getConstructor(ExecState* exec)
+JSValue JSStyleSheetList::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSStyleSheetListConstructor>(exec);
 }
 
-JSValuePtr jsStyleSheetListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsStyleSheetListPrototypeFunctionItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSStyleSheetList::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSStyleSheetList::s_info))
         return throwError(exec, TypeError);
     JSStyleSheetList* castedThisObj = static_cast<JSStyleSheetList*>(asObject(thisValue));
     StyleSheetList* imp = static_cast<StyleSheetList*>(castedThisObj->impl());
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->item(index)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->item(index)));
     return result;
 }
 
 
-JSValuePtr JSStyleSheetList::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSStyleSheetList::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSStyleSheetList* thisObj = static_cast<JSStyleSheetList*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<StyleSheetList*>(thisObj->impl())->item(slot.index()));
 }
-JSC::JSValuePtr toJS(JSC::ExecState* exec, StyleSheetList* object)
+JSC::JSValue toJS(JSC::ExecState* exec, StyleSheetList* object)
 {
     return getDOMObjectWrapper<JSStyleSheetList>(exec, object);
 }
-StyleSheetList* toStyleSheetList(JSC::JSValuePtr value)
+StyleSheetList* toStyleSheetList(JSC::JSValue value)
 {
-    return value->isObject(&JSStyleSheetList::s_info) ? static_cast<JSStyleSheetList*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSStyleSheetList::s_info) ? static_cast<JSStyleSheetList*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h
index f9edf94..bb06c58 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSStyleSheetList.h
@@ -34,39 +34,40 @@ class JSStyleSheetList : public DOMObject {
 public:
     JSStyleSheetList(PassRefPtr<JSC::Structure>, PassRefPtr<StyleSheetList>);
     virtual ~JSStyleSheetList();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     StyleSheetList* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<StyleSheetList> m_impl;
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 private:
     static bool canGetItemsForName(JSC::ExecState*, StyleSheetList*, const JSC::Identifier&);
-    static JSC::JSValuePtr nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue nameGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, StyleSheetList*);
-StyleSheetList* toStyleSheetList(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, StyleSheetList*);
+StyleSheetList* toStyleSheetList(JSC::JSValue);
 
 class JSStyleSheetListPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -75,11 +76,11 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsStyleSheetListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsStyleSheetListPrototypeFunctionItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsStyleSheetListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsStyleSheetListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStyleSheetListLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsStyleSheetListConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSText.cpp b/src/3rdparty/webkit/WebCore/generated/JSText.cpp
index 053e280..ea29d3c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSText.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSText.cpp
@@ -19,25 +19,21 @@
 */
 
 #include "config.h"
-
 #include "JSText.h"
 
-#include <wtf/GetPtr.h>
-
 #include "ExceptionCode.h"
 #include "JSText.h"
 #include "KURL.h"
 #include "Text.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSText)
+ASSERT_CLASS_FITS_IN_CELL(JSText);
 
 /* Hash table */
 
@@ -74,13 +70,13 @@ public:
     JSTextConstructor(ExecState* exec)
         : DOMObject(JSTextConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSTextPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSTextPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +107,9 @@ static const HashTable JSTextPrototypeTable =
 
 const ClassInfo JSTextPrototype::s_info = { "TextPrototype", 0, &JSTextPrototypeTable, 0 };
 
-JSObject* JSTextPrototype::self(ExecState* exec)
+JSObject* JSTextPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSText>(exec);
+    return getDOMPrototype<JSText>(exec, globalObject);
 }
 
 bool JSTextPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -128,9 +124,9 @@ JSText::JSText(PassRefPtr<Structure> structure, PassRefPtr<Text> impl)
 {
 }
 
-JSObject* JSText::createPrototype(ExecState* exec)
+JSObject* JSText::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSTextPrototype(JSTextPrototype::createStructure(JSCharacterDataPrototype::self(exec)));
+    return new (exec) JSTextPrototype(JSTextPrototype::createStructure(JSCharacterDataPrototype::self(exec, globalObject)));
 }
 
 bool JSText::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -138,51 +134,54 @@ bool JSText::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName,
     return getStaticValueSlot<JSText, Base>(exec, &JSTextTable, this, propertyName, slot);
 }
 
-JSValuePtr jsTextWholeText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTextWholeText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Text* imp = static_cast<Text*>(static_cast<JSText*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->wholeText());
 }
 
-JSValuePtr jsTextConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTextConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSText*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSText::getConstructor(ExecState* exec)
+JSValue JSText::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSTextConstructor>(exec);
 }
 
-JSValuePtr jsTextPrototypeFunctionSplitText(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTextPrototypeFunctionSplitText(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSText::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSText::s_info))
         return throwError(exec, TypeError);
     JSText* castedThisObj = static_cast<JSText*>(asObject(thisValue));
     Text* imp = static_cast<Text*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    int offset = args.at(exec, 0)->toInt32(exec);
+    int offset = args.at(0).toInt32(exec);
     if (offset < 0) {
         setDOMException(exec, INDEX_SIZE_ERR);
         return jsUndefined();
     }
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->splitText(offset, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->splitText(offset, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsTextPrototypeFunctionReplaceWholeText(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTextPrototypeFunctionReplaceWholeText(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSText::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSText::s_info))
         return throwError(exec, TypeError);
     JSText* castedThisObj = static_cast<JSText*>(asObject(thisValue));
     Text* imp = static_cast<Text*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& content = args.at(exec, 0)->toString(exec);
+    const UString& content = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->replaceWholeText(content, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->replaceWholeText(content, ec)));
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSText.h b/src/3rdparty/webkit/WebCore/generated/JSText.h
index e597244..e489274 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSText.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSText.h
@@ -31,27 +31,29 @@ class JSText : public JSCharacterData {
     typedef JSCharacterData Base;
 public:
     JSText(PassRefPtr<JSC::Structure>, PassRefPtr<Text>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
+JSC::JSValue toJSNewlyCreated(JSC::ExecState*, Text*);
 
 class JSTextPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,12 +62,12 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsTextPrototypeFunctionSplitText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsTextPrototypeFunctionReplaceWholeText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTextPrototypeFunctionSplitText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTextPrototypeFunctionReplaceWholeText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsTextWholeText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsTextConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTextWholeText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTextConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp
index 857faab..e20e411 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.cpp
@@ -19,24 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSTextEvent.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSDOMWindow.h"
 #include "KURL.h"
 #include "TextEvent.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSTextEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSTextEvent);
 
 /* Hash table */
 
@@ -73,13 +69,13 @@ public:
     JSTextEventConstructor(ExecState* exec)
         : DOMObject(JSTextEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSTextEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSTextEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +105,9 @@ static const HashTable JSTextEventPrototypeTable =
 
 const ClassInfo JSTextEventPrototype::s_info = { "TextEventPrototype", 0, &JSTextEventPrototypeTable, 0 };
 
-JSObject* JSTextEventPrototype::self(ExecState* exec)
+JSObject* JSTextEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSTextEvent>(exec);
+    return getDOMPrototype<JSTextEvent>(exec, globalObject);
 }
 
 bool JSTextEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -126,9 +122,9 @@ JSTextEvent::JSTextEvent(PassRefPtr<Structure> structure, PassRefPtr<TextEvent>
 {
 }
 
-JSObject* JSTextEvent::createPrototype(ExecState* exec)
+JSObject* JSTextEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSTextEventPrototype(JSTextEventPrototype::createStructure(JSUIEventPrototype::self(exec)));
+    return new (exec) JSTextEventPrototype(JSTextEventPrototype::createStructure(JSUIEventPrototype::self(exec, globalObject)));
 }
 
 bool JSTextEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -136,32 +132,34 @@ bool JSTextEvent::getOwnPropertySlot(ExecState* exec, const Identifier& property
     return getStaticValueSlot<JSTextEvent, Base>(exec, &JSTextEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsTextEventData(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTextEventData(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TextEvent* imp = static_cast<TextEvent*>(static_cast<JSTextEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->data());
 }
 
-JSValuePtr jsTextEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTextEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSTextEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSTextEvent::getConstructor(ExecState* exec)
+JSValue JSTextEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSTextEventConstructor>(exec);
 }
 
-JSValuePtr jsTextEventPrototypeFunctionInitTextEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTextEventPrototypeFunctionInitTextEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSTextEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSTextEvent::s_info))
         return throwError(exec, TypeError);
     JSTextEvent* castedThisObj = static_cast<JSTextEvent*>(asObject(thisValue));
     TextEvent* imp = static_cast<TextEvent*>(castedThisObj->impl());
-    const UString& typeArg = args.at(exec, 0)->toString(exec);
-    bool canBubbleArg = args.at(exec, 1)->toBoolean(exec);
-    bool cancelableArg = args.at(exec, 2)->toBoolean(exec);
-    DOMWindow* viewArg = toDOMWindow(args.at(exec, 3));
-    const UString& dataArg = args.at(exec, 4)->toString(exec);
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    DOMWindow* viewArg = toDOMWindow(args.at(3));
+    const UString& dataArg = args.at(4).toString(exec);
 
     imp->initTextEvent(typeArg, canBubbleArg, cancelableArg, viewArg, dataArg);
     return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h
index b4cd3b5..08f0141 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextEvent.h
@@ -31,27 +31,28 @@ class JSTextEvent : public JSUIEvent {
     typedef JSUIEvent Base;
 public:
     JSTextEvent(PassRefPtr<JSC::Structure>, PassRefPtr<TextEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSTextEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,11 +61,11 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsTextEventPrototypeFunctionInitTextEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTextEventPrototypeFunctionInitTextEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsTextEventData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsTextEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTextEventData(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTextEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp
index 5b31aeb..904be08 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.cpp
@@ -19,20 +19,17 @@
 */
 
 #include "config.h"
-
 #include "JSTextMetrics.h"
 
-#include <wtf/GetPtr.h>
-
 #include "TextMetrics.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSTextMetrics)
+ASSERT_CLASS_FITS_IN_CELL(JSTextMetrics);
 
 /* Hash table */
 
@@ -69,13 +66,13 @@ public:
     JSTextMetricsConstructor(ExecState* exec)
         : DOMObject(JSTextMetricsConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSTextMetricsPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSTextMetricsPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -104,9 +101,9 @@ static const HashTable JSTextMetricsPrototypeTable =
 
 const ClassInfo JSTextMetricsPrototype::s_info = { "TextMetricsPrototype", 0, &JSTextMetricsPrototypeTable, 0 };
 
-JSObject* JSTextMetricsPrototype::self(ExecState* exec)
+JSObject* JSTextMetricsPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSTextMetrics>(exec);
+    return getDOMPrototype<JSTextMetrics>(exec, globalObject);
 }
 
 const ClassInfo JSTextMetrics::s_info = { "TextMetrics", 0, &JSTextMetricsTable, 0 };
@@ -120,12 +117,11 @@ JSTextMetrics::JSTextMetrics(PassRefPtr<Structure> structure, PassRefPtr<TextMet
 JSTextMetrics::~JSTextMetrics()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSTextMetrics::createPrototype(ExecState* exec)
+JSObject* JSTextMetrics::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSTextMetricsPrototype(JSTextMetricsPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSTextMetricsPrototype(JSTextMetricsPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSTextMetrics::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,28 +129,29 @@ bool JSTextMetrics::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSTextMetrics, Base>(exec, &JSTextMetricsTable, this, propertyName, slot);
 }
 
-JSValuePtr jsTextMetricsWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTextMetricsWidth(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TextMetrics* imp = static_cast<TextMetrics*>(static_cast<JSTextMetrics*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->width());
 }
 
-JSValuePtr jsTextMetricsConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTextMetricsConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSTextMetrics*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSTextMetrics::getConstructor(ExecState* exec)
+JSValue JSTextMetrics::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSTextMetricsConstructor>(exec);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, TextMetrics* object)
+JSC::JSValue toJS(JSC::ExecState* exec, TextMetrics* object)
 {
     return getDOMObjectWrapper<JSTextMetrics>(exec, object);
 }
-TextMetrics* toTextMetrics(JSC::JSValuePtr value)
+TextMetrics* toTextMetrics(JSC::JSValue value)
 {
-    return value->isObject(&JSTextMetrics::s_info) ? static_cast<JSTextMetrics*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSTextMetrics::s_info) ? static_cast<JSTextMetrics*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h
index 5065932..4fb044f 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTextMetrics.h
@@ -34,29 +34,30 @@ class JSTextMetrics : public DOMObject {
 public:
     JSTextMetrics(PassRefPtr<JSC::Structure>, PassRefPtr<TextMetrics>);
     virtual ~JSTextMetrics();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     TextMetrics* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<TextMetrics> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, TextMetrics*);
-TextMetrics* toTextMetrics(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, TextMetrics*);
+TextMetrics* toTextMetrics(JSC::JSValue);
 
 class JSTextMetricsPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSTextMetricsPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -64,8 +65,8 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsTextMetricsWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsTextMetricsConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTextMetricsWidth(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTextMetricsConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.cpp b/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.cpp
index 1ba0cd4..eebd8cd 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.cpp
@@ -19,21 +19,18 @@
 */
 
 #include "config.h"
-
 #include "JSTimeRanges.h"
 
-#include <wtf/GetPtr.h>
-
 #include "TimeRanges.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSTimeRanges)
+ASSERT_CLASS_FITS_IN_CELL(JSTimeRanges);
 
 /* Hash table */
 
@@ -68,9 +65,9 @@ static const HashTable JSTimeRangesPrototypeTable =
 
 const ClassInfo JSTimeRangesPrototype::s_info = { "TimeRangesPrototype", 0, &JSTimeRangesPrototypeTable, 0 };
 
-JSObject* JSTimeRangesPrototype::self(ExecState* exec)
+JSObject* JSTimeRangesPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSTimeRanges>(exec);
+    return getDOMPrototype<JSTimeRanges>(exec, globalObject);
 }
 
 bool JSTimeRangesPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -89,12 +86,11 @@ JSTimeRanges::JSTimeRanges(PassRefPtr<Structure> structure, PassRefPtr<TimeRange
 JSTimeRanges::~JSTimeRanges()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSTimeRanges::createPrototype(ExecState* exec)
+JSObject* JSTimeRanges::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSTimeRangesPrototype(JSTimeRangesPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSTimeRangesPrototype(JSTimeRangesPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSTimeRanges::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -102,49 +98,52 @@ bool JSTimeRanges::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSTimeRanges, Base>(exec, &JSTimeRangesTable, this, propertyName, slot);
 }
 
-JSValuePtr jsTimeRangesLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTimeRangesLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TimeRanges* imp = static_cast<TimeRanges*>(static_cast<JSTimeRanges*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->length());
 }
 
-JSValuePtr jsTimeRangesPrototypeFunctionStart(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTimeRangesPrototypeFunctionStart(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSTimeRanges::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSTimeRanges::s_info))
         return throwError(exec, TypeError);
     JSTimeRanges* castedThisObj = static_cast<JSTimeRanges*>(asObject(thisValue));
     TimeRanges* imp = static_cast<TimeRanges*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->start(index, ec));
+    JSC::JSValue result = jsNumber(exec, imp->start(index, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsTimeRangesPrototypeFunctionEnd(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTimeRangesPrototypeFunctionEnd(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSTimeRanges::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSTimeRanges::s_info))
         return throwError(exec, TypeError);
     JSTimeRanges* castedThisObj = static_cast<JSTimeRanges*>(asObject(thisValue));
     TimeRanges* imp = static_cast<TimeRanges*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = jsNumber(exec, imp->end(index, ec));
+    JSC::JSValue result = jsNumber(exec, imp->end(index, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, TimeRanges* object)
+JSC::JSValue toJS(JSC::ExecState* exec, TimeRanges* object)
 {
     return getDOMObjectWrapper<JSTimeRanges>(exec, object);
 }
-TimeRanges* toTimeRanges(JSC::JSValuePtr value)
+TimeRanges* toTimeRanges(JSC::JSValue value)
 {
-    return value->isObject(&JSTimeRanges::s_info) ? static_cast<JSTimeRanges*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSTimeRanges::s_info) ? static_cast<JSTimeRanges*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h b/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h
index 0032039..41da9ef 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTimeRanges.h
@@ -34,12 +34,12 @@ class JSTimeRanges : public DOMObject {
 public:
     JSTimeRanges(PassRefPtr<JSC::Structure>, PassRefPtr<TimeRanges>);
     virtual ~JSTimeRanges();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -50,16 +50,17 @@ private:
     RefPtr<TimeRanges> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, TimeRanges*);
-TimeRanges* toTimeRanges(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, TimeRanges*);
+TimeRanges* toTimeRanges(JSC::JSValue);
 
 class JSTimeRangesPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -68,11 +69,11 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsTimeRangesPrototypeFunctionStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsTimeRangesPrototypeFunctionEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTimeRangesPrototypeFunctionStart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTimeRangesPrototypeFunctionEnd(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsTimeRangesLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTimeRangesLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp
index 31214a6..da610da 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.cpp
@@ -19,25 +19,22 @@
 */
 
 #include "config.h"
-
 #include "JSTreeWalker.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSNode.h"
 #include "JSNodeFilter.h"
 #include "Node.h"
 #include "NodeFilter.h"
 #include "TreeWalker.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSTreeWalker)
+ASSERT_CLASS_FITS_IN_CELL(JSTreeWalker);
 
 /* Hash table */
 
@@ -78,13 +75,13 @@ public:
     JSTreeWalkerConstructor(ExecState* exec)
         : DOMObject(JSTreeWalkerConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSTreeWalkerPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSTreeWalkerPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -120,9 +117,9 @@ static const HashTable JSTreeWalkerPrototypeTable =
 
 const ClassInfo JSTreeWalkerPrototype::s_info = { "TreeWalkerPrototype", 0, &JSTreeWalkerPrototypeTable, 0 };
 
-JSObject* JSTreeWalkerPrototype::self(ExecState* exec)
+JSObject* JSTreeWalkerPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSTreeWalker>(exec);
+    return getDOMPrototype<JSTreeWalker>(exec, globalObject);
 }
 
 bool JSTreeWalkerPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -141,12 +138,11 @@ JSTreeWalker::JSTreeWalker(PassRefPtr<Structure> structure, PassRefPtr<TreeWalke
 JSTreeWalker::~JSTreeWalker()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSTreeWalker::createPrototype(ExecState* exec)
+JSObject* JSTreeWalker::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSTreeWalkerPrototype(JSTreeWalkerPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSTreeWalkerPrototype(JSTreeWalkerPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSTreeWalker::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -154,46 +150,51 @@ bool JSTreeWalker::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSTreeWalker, Base>(exec, &JSTreeWalkerTable, this, propertyName, slot);
 }
 
-JSValuePtr jsTreeWalkerRoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTreeWalkerRoot(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TreeWalker* imp = static_cast<TreeWalker*>(static_cast<JSTreeWalker*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->root()));
 }
 
-JSValuePtr jsTreeWalkerWhatToShow(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTreeWalkerWhatToShow(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TreeWalker* imp = static_cast<TreeWalker*>(static_cast<JSTreeWalker*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->whatToShow());
 }
 
-JSValuePtr jsTreeWalkerFilter(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTreeWalkerFilter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TreeWalker* imp = static_cast<TreeWalker*>(static_cast<JSTreeWalker*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->filter()));
 }
 
-JSValuePtr jsTreeWalkerExpandEntityReferences(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTreeWalkerExpandEntityReferences(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TreeWalker* imp = static_cast<TreeWalker*>(static_cast<JSTreeWalker*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->expandEntityReferences());
 }
 
-JSValuePtr jsTreeWalkerCurrentNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTreeWalkerCurrentNode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     TreeWalker* imp = static_cast<TreeWalker*>(static_cast<JSTreeWalker*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->currentNode()));
 }
 
-JSValuePtr jsTreeWalkerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsTreeWalkerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSTreeWalker*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSTreeWalker::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSTreeWalker::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSTreeWalker, Base>(exec, propertyName, value, &JSTreeWalkerTable, this, slot);
 }
 
-void setJSTreeWalkerCurrentNode(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSTreeWalkerCurrentNode(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     TreeWalker* imp = static_cast<TreeWalker*>(static_cast<JSTreeWalker*>(thisObject)->impl());
     ExceptionCode ec = 0;
@@ -201,74 +202,81 @@ void setJSTreeWalkerCurrentNode(ExecState* exec, JSObject* thisObject, JSValuePt
     setDOMException(exec, ec);
 }
 
-JSValuePtr JSTreeWalker::getConstructor(ExecState* exec)
+JSValue JSTreeWalker::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSTreeWalkerConstructor>(exec);
 }
 
-JSValuePtr jsTreeWalkerPrototypeFunctionParentNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionParentNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSTreeWalker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSTreeWalker::s_info))
         return throwError(exec, TypeError);
     JSTreeWalker* castedThisObj = static_cast<JSTreeWalker*>(asObject(thisValue));
     return castedThisObj->parentNode(exec, args);
 }
 
-JSValuePtr jsTreeWalkerPrototypeFunctionFirstChild(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionFirstChild(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSTreeWalker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSTreeWalker::s_info))
         return throwError(exec, TypeError);
     JSTreeWalker* castedThisObj = static_cast<JSTreeWalker*>(asObject(thisValue));
     return castedThisObj->firstChild(exec, args);
 }
 
-JSValuePtr jsTreeWalkerPrototypeFunctionLastChild(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionLastChild(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSTreeWalker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSTreeWalker::s_info))
         return throwError(exec, TypeError);
     JSTreeWalker* castedThisObj = static_cast<JSTreeWalker*>(asObject(thisValue));
     return castedThisObj->lastChild(exec, args);
 }
 
-JSValuePtr jsTreeWalkerPrototypeFunctionPreviousSibling(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionPreviousSibling(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSTreeWalker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSTreeWalker::s_info))
         return throwError(exec, TypeError);
     JSTreeWalker* castedThisObj = static_cast<JSTreeWalker*>(asObject(thisValue));
     return castedThisObj->previousSibling(exec, args);
 }
 
-JSValuePtr jsTreeWalkerPrototypeFunctionNextSibling(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionNextSibling(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSTreeWalker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSTreeWalker::s_info))
         return throwError(exec, TypeError);
     JSTreeWalker* castedThisObj = static_cast<JSTreeWalker*>(asObject(thisValue));
     return castedThisObj->nextSibling(exec, args);
 }
 
-JSValuePtr jsTreeWalkerPrototypeFunctionPreviousNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionPreviousNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSTreeWalker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSTreeWalker::s_info))
         return throwError(exec, TypeError);
     JSTreeWalker* castedThisObj = static_cast<JSTreeWalker*>(asObject(thisValue));
     return castedThisObj->previousNode(exec, args);
 }
 
-JSValuePtr jsTreeWalkerPrototypeFunctionNextNode(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionNextNode(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSTreeWalker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSTreeWalker::s_info))
         return throwError(exec, TypeError);
     JSTreeWalker* castedThisObj = static_cast<JSTreeWalker*>(asObject(thisValue));
     return castedThisObj->nextNode(exec, args);
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, TreeWalker* object)
+JSC::JSValue toJS(JSC::ExecState* exec, TreeWalker* object)
 {
     return getDOMObjectWrapper<JSTreeWalker>(exec, object);
 }
-TreeWalker* toTreeWalker(JSC::JSValuePtr value)
+TreeWalker* toTreeWalker(JSC::JSValue value)
 {
-    return value->isObject(&JSTreeWalker::s_info) ? static_cast<JSTreeWalker*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSTreeWalker::s_info) ? static_cast<JSTreeWalker*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h
index 5378915..92b42bf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSTreeWalker.h
@@ -34,45 +34,46 @@ class JSTreeWalker : public DOMObject {
 public:
     JSTreeWalker(PassRefPtr<JSC::Structure>, PassRefPtr<TreeWalker>);
     virtual ~JSTreeWalker();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void mark();
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom functions
-    JSC::JSValuePtr parentNode(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr firstChild(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr lastChild(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr previousSibling(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr nextSibling(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr previousNode(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr nextNode(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue parentNode(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue firstChild(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue lastChild(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue previousSibling(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue nextSibling(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue previousNode(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue nextNode(JSC::ExecState*, const JSC::ArgList&);
     TreeWalker* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<TreeWalker> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, TreeWalker*);
-TreeWalker* toTreeWalker(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, TreeWalker*);
+TreeWalker* toTreeWalker(JSC::JSValue);
 
 class JSTreeWalkerPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -81,22 +82,22 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsTreeWalkerPrototypeFunctionParentNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsTreeWalkerPrototypeFunctionFirstChild(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsTreeWalkerPrototypeFunctionLastChild(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsTreeWalkerPrototypeFunctionPreviousSibling(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsTreeWalkerPrototypeFunctionNextSibling(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsTreeWalkerPrototypeFunctionPreviousNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsTreeWalkerPrototypeFunctionNextNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionParentNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionFirstChild(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionLastChild(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionPreviousSibling(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionNextSibling(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionPreviousNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsTreeWalkerPrototypeFunctionNextNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsTreeWalkerRoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsTreeWalkerWhatToShow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsTreeWalkerFilter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsTreeWalkerExpandEntityReferences(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsTreeWalkerCurrentNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSTreeWalkerCurrentNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsTreeWalkerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTreeWalkerRoot(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTreeWalkerWhatToShow(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTreeWalkerFilter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTreeWalkerExpandEntityReferences(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsTreeWalkerCurrentNode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSTreeWalkerCurrentNode(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsTreeWalkerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp
index 1b95936..3711f49 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.cpp
@@ -19,23 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSUIEvent.h"
 
-#include <wtf/GetPtr.h>
-
 #include "DOMWindow.h"
 #include "JSDOMWindow.h"
 #include "UIEvent.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSUIEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSUIEvent);
 
 /* Hash table */
 
@@ -80,13 +77,13 @@ public:
     JSUIEventConstructor(ExecState* exec)
         : DOMObject(JSUIEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSUIEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSUIEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -116,9 +113,9 @@ static const HashTable JSUIEventPrototypeTable =
 
 const ClassInfo JSUIEventPrototype::s_info = { "UIEventPrototype", 0, &JSUIEventPrototypeTable, 0 };
 
-JSObject* JSUIEventPrototype::self(ExecState* exec)
+JSObject* JSUIEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSUIEvent>(exec);
+    return getDOMPrototype<JSUIEvent>(exec, globalObject);
 }
 
 bool JSUIEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -133,9 +130,9 @@ JSUIEvent::JSUIEvent(PassRefPtr<Structure> structure, PassRefPtr<UIEvent> impl)
 {
 }
 
-JSObject* JSUIEvent::createPrototype(ExecState* exec)
+JSObject* JSUIEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSUIEventPrototype(JSUIEventPrototype::createStructure(JSEventPrototype::self(exec)));
+    return new (exec) JSUIEventPrototype(JSUIEventPrototype::createStructure(JSEventPrototype::self(exec, globalObject)));
 }
 
 bool JSUIEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -143,80 +140,90 @@ bool JSUIEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     return getStaticValueSlot<JSUIEvent, Base>(exec, &JSUIEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsUIEventView(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventView(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(static_cast<JSUIEvent*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->view()));
 }
 
-JSValuePtr jsUIEventDetail(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventDetail(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(static_cast<JSUIEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->detail());
 }
 
-JSValuePtr jsUIEventKeyCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventKeyCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(static_cast<JSUIEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->keyCode());
 }
 
-JSValuePtr jsUIEventCharCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventCharCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(static_cast<JSUIEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->charCode());
 }
 
-JSValuePtr jsUIEventLayerX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventLayerX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(static_cast<JSUIEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->layerX());
 }
 
-JSValuePtr jsUIEventLayerY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventLayerY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(static_cast<JSUIEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->layerY());
 }
 
-JSValuePtr jsUIEventPageX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventPageX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(static_cast<JSUIEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->pageX());
 }
 
-JSValuePtr jsUIEventPageY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventPageY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(static_cast<JSUIEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->pageY());
 }
 
-JSValuePtr jsUIEventWhich(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventWhich(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     UIEvent* imp = static_cast<UIEvent*>(static_cast<JSUIEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->which());
 }
 
-JSValuePtr jsUIEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsUIEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSUIEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSUIEvent::getConstructor(ExecState* exec)
+JSValue JSUIEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSUIEventConstructor>(exec);
 }
 
-JSValuePtr jsUIEventPrototypeFunctionInitUIEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsUIEventPrototypeFunctionInitUIEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSUIEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSUIEvent::s_info))
         return throwError(exec, TypeError);
     JSUIEvent* castedThisObj = static_cast<JSUIEvent*>(asObject(thisValue));
     UIEvent* imp = static_cast<UIEvent*>(castedThisObj->impl());
-    const UString& type = args.at(exec, 0)->toString(exec);
-    bool canBubble = args.at(exec, 1)->toBoolean(exec);
-    bool cancelable = args.at(exec, 2)->toBoolean(exec);
-    DOMWindow* view = toDOMWindow(args.at(exec, 3));
-    int detail = args.at(exec, 4)->toInt32(exec);
+    const UString& type = args.at(0).toString(exec);
+    bool canBubble = args.at(1).toBoolean(exec);
+    bool cancelable = args.at(2).toBoolean(exec);
+    DOMWindow* view = toDOMWindow(args.at(3));
+    int detail = args.at(4).toInt32(exec);
 
     imp->initUIEvent(type, canBubble, cancelable, view, detail);
     return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h
index b8b0e62..3999438 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSUIEvent.h
@@ -31,27 +31,28 @@ class JSUIEvent : public JSEvent {
     typedef JSEvent Base;
 public:
     JSUIEvent(PassRefPtr<JSC::Structure>, PassRefPtr<UIEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSUIEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,19 +61,19 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsUIEventPrototypeFunctionInitUIEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsUIEventPrototypeFunctionInitUIEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsUIEventView(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsUIEventDetail(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsUIEventKeyCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsUIEventCharCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsUIEventLayerX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsUIEventLayerY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsUIEventPageX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsUIEventPageY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsUIEventWhich(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsUIEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsUIEventView(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsUIEventDetail(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsUIEventKeyCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsUIEventCharCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsUIEventLayerX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsUIEventLayerY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsUIEventPageX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsUIEventPageY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsUIEventWhich(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsUIEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.cpp b/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.cpp
index d11a11a..ad9ae01 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.cpp
@@ -19,20 +19,17 @@
 */
 
 #include "config.h"
-
 #include "JSVoidCallback.h"
 
-#include <wtf/GetPtr.h>
-
 #include "VoidCallback.h"
-
 #include <runtime/Error.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSVoidCallback)
+ASSERT_CLASS_FITS_IN_CELL(JSVoidCallback);
 
 /* Hash table for prototype */
 
@@ -51,9 +48,9 @@ static const HashTable JSVoidCallbackPrototypeTable =
 
 const ClassInfo JSVoidCallbackPrototype::s_info = { "VoidCallbackPrototype", 0, &JSVoidCallbackPrototypeTable, 0 };
 
-JSObject* JSVoidCallbackPrototype::self(ExecState* exec)
+JSObject* JSVoidCallbackPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSVoidCallback>(exec);
+    return getDOMPrototype<JSVoidCallback>(exec, globalObject);
 }
 
 bool JSVoidCallbackPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -72,17 +69,17 @@ JSVoidCallback::JSVoidCallback(PassRefPtr<Structure> structure, PassRefPtr<VoidC
 JSVoidCallback::~JSVoidCallback()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSVoidCallback::createPrototype(ExecState* exec)
+JSObject* JSVoidCallback::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSVoidCallbackPrototype(JSVoidCallbackPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSVoidCallbackPrototype(JSVoidCallbackPrototype::createStructure(globalObject->objectPrototype()));
 }
 
-JSValuePtr jsVoidCallbackPrototypeFunctionHandleEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsVoidCallbackPrototypeFunctionHandleEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSVoidCallback::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSVoidCallback::s_info))
         return throwError(exec, TypeError);
     JSVoidCallback* castedThisObj = static_cast<JSVoidCallback*>(asObject(thisValue));
     VoidCallback* imp = static_cast<VoidCallback*>(castedThisObj->impl());
@@ -91,7 +88,7 @@ JSValuePtr jsVoidCallbackPrototypeFunctionHandleEvent(ExecState* exec, JSObject*
     return jsUndefined();
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, VoidCallback* object)
+JSC::JSValue toJS(JSC::ExecState* exec, VoidCallback* object)
 {
     return getDOMObjectWrapper<JSVoidCallback>(exec, object);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h b/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h
index 5da934f..ac05cb9 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSVoidCallback.h
@@ -34,7 +34,7 @@ class JSVoidCallback : public DOMObject {
 public:
     JSVoidCallback(PassRefPtr<JSC::Structure>, PassRefPtr<VoidCallback>);
     virtual ~JSVoidCallback();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -44,16 +44,17 @@ private:
     RefPtr<VoidCallback> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, VoidCallback*);
-VoidCallback* toVoidCallback(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, VoidCallback*);
+VoidCallback* toVoidCallback(JSC::JSValue);
 
 class JSVoidCallbackPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -62,7 +63,7 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsVoidCallbackPrototypeFunctionHandleEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsVoidCallbackPrototypeFunctionHandleEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp
index f2356ec..a1cb988 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.cpp
@@ -19,23 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSWebKitAnimationEvent.h"
 
-#include <wtf/GetPtr.h>
-
 #include "KURL.h"
 #include "WebKitAnimationEvent.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSWebKitAnimationEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSWebKitAnimationEvent);
 
 /* Hash table */
 
@@ -73,13 +70,13 @@ public:
     JSWebKitAnimationEventConstructor(ExecState* exec)
         : DOMObject(JSWebKitAnimationEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSWebKitAnimationEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSWebKitAnimationEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +106,9 @@ static const HashTable JSWebKitAnimationEventPrototypeTable =
 
 const ClassInfo JSWebKitAnimationEventPrototype::s_info = { "WebKitAnimationEventPrototype", 0, &JSWebKitAnimationEventPrototypeTable, 0 };
 
-JSObject* JSWebKitAnimationEventPrototype::self(ExecState* exec)
+JSObject* JSWebKitAnimationEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSWebKitAnimationEvent>(exec);
+    return getDOMPrototype<JSWebKitAnimationEvent>(exec, globalObject);
 }
 
 bool JSWebKitAnimationEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -126,9 +123,9 @@ JSWebKitAnimationEvent::JSWebKitAnimationEvent(PassRefPtr<Structure> structure,
 {
 }
 
-JSObject* JSWebKitAnimationEvent::createPrototype(ExecState* exec)
+JSObject* JSWebKitAnimationEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSWebKitAnimationEventPrototype(JSWebKitAnimationEventPrototype::createStructure(JSEventPrototype::self(exec)));
+    return new (exec) JSWebKitAnimationEventPrototype(JSWebKitAnimationEventPrototype::createStructure(JSEventPrototype::self(exec, globalObject)));
 }
 
 bool JSWebKitAnimationEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -136,38 +133,41 @@ bool JSWebKitAnimationEvent::getOwnPropertySlot(ExecState* exec, const Identifie
     return getStaticValueSlot<JSWebKitAnimationEvent, Base>(exec, &JSWebKitAnimationEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsWebKitAnimationEventAnimationName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitAnimationEventAnimationName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WebKitAnimationEvent* imp = static_cast<WebKitAnimationEvent*>(static_cast<JSWebKitAnimationEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->animationName());
 }
 
-JSValuePtr jsWebKitAnimationEventElapsedTime(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitAnimationEventElapsedTime(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WebKitAnimationEvent* imp = static_cast<WebKitAnimationEvent*>(static_cast<JSWebKitAnimationEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->elapsedTime());
 }
 
-JSValuePtr jsWebKitAnimationEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitAnimationEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSWebKitAnimationEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSWebKitAnimationEvent::getConstructor(ExecState* exec)
+JSValue JSWebKitAnimationEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSWebKitAnimationEventConstructor>(exec);
 }
 
-JSValuePtr jsWebKitAnimationEventPrototypeFunctionInitWebKitAnimationEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWebKitAnimationEventPrototypeFunctionInitWebKitAnimationEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWebKitAnimationEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitAnimationEvent::s_info))
         return throwError(exec, TypeError);
     JSWebKitAnimationEvent* castedThisObj = static_cast<JSWebKitAnimationEvent*>(asObject(thisValue));
     WebKitAnimationEvent* imp = static_cast<WebKitAnimationEvent*>(castedThisObj->impl());
-    const UString& typeArg = args.at(exec, 0)->toString(exec);
-    bool canBubbleArg = args.at(exec, 1)->toBoolean(exec);
-    bool cancelableArg = args.at(exec, 2)->toBoolean(exec);
-    const UString& animationNameArg = args.at(exec, 3)->toString(exec);
-    double elapsedTimeArg = args.at(exec, 4)->toNumber(exec);
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    const UString& animationNameArg = args.at(3).toString(exec);
+    double elapsedTimeArg = args.at(4).toNumber(exec);
 
     imp->initWebKitAnimationEvent(typeArg, canBubbleArg, cancelableArg, animationNameArg, elapsedTimeArg);
     return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h
index d7a271b..5c6862e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitAnimationEvent.h
@@ -31,27 +31,28 @@ class JSWebKitAnimationEvent : public JSEvent {
     typedef JSEvent Base;
 public:
     JSWebKitAnimationEvent(PassRefPtr<JSC::Structure>, PassRefPtr<WebKitAnimationEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSWebKitAnimationEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,12 +61,12 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsWebKitAnimationEventPrototypeFunctionInitWebKitAnimationEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitAnimationEventPrototypeFunctionInitWebKitAnimationEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsWebKitAnimationEventAnimationName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitAnimationEventElapsedTime(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitAnimationEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitAnimationEventAnimationName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitAnimationEventElapsedTime(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitAnimationEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp
index 9cccf8b..c07c962 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.cpp
@@ -19,25 +19,21 @@
 */
 
 #include "config.h"
-
 #include "JSWebKitCSSKeyframeRule.h"
 
-#include <wtf/GetPtr.h>
-
 #include "CSSMutableStyleDeclaration.h"
 #include "CSSStyleDeclaration.h"
 #include "JSCSSStyleDeclaration.h"
 #include "KURL.h"
 #include "WebKitCSSKeyframeRule.h"
-
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSWebKitCSSKeyframeRule)
+ASSERT_CLASS_FITS_IN_CELL(JSWebKitCSSKeyframeRule);
 
 /* Hash table */
 
@@ -75,13 +71,13 @@ public:
     JSWebKitCSSKeyframeRuleConstructor(ExecState* exec)
         : DOMObject(JSWebKitCSSKeyframeRuleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSWebKitCSSKeyframeRulePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSWebKitCSSKeyframeRulePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -110,9 +106,9 @@ static const HashTable JSWebKitCSSKeyframeRulePrototypeTable =
 
 const ClassInfo JSWebKitCSSKeyframeRulePrototype::s_info = { "WebKitCSSKeyframeRulePrototype", 0, &JSWebKitCSSKeyframeRulePrototypeTable, 0 };
 
-JSObject* JSWebKitCSSKeyframeRulePrototype::self(ExecState* exec)
+JSObject* JSWebKitCSSKeyframeRulePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSWebKitCSSKeyframeRule>(exec);
+    return getDOMPrototype<JSWebKitCSSKeyframeRule>(exec, globalObject);
 }
 
 const ClassInfo JSWebKitCSSKeyframeRule::s_info = { "WebKitCSSKeyframeRule", &JSCSSRule::s_info, &JSWebKitCSSKeyframeRuleTable, 0 };
@@ -122,9 +118,9 @@ JSWebKitCSSKeyframeRule::JSWebKitCSSKeyframeRule(PassRefPtr<Structure> structure
 {
 }
 
-JSObject* JSWebKitCSSKeyframeRule::createPrototype(ExecState* exec)
+JSObject* JSWebKitCSSKeyframeRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSWebKitCSSKeyframeRulePrototype(JSWebKitCSSKeyframeRulePrototype::createStructure(JSCSSRulePrototype::self(exec)));
+    return new (exec) JSWebKitCSSKeyframeRulePrototype(JSWebKitCSSKeyframeRulePrototype::createStructure(JSCSSRulePrototype::self(exec, globalObject)));
 }
 
 bool JSWebKitCSSKeyframeRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,34 +128,36 @@ bool JSWebKitCSSKeyframeRule::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSWebKitCSSKeyframeRule, Base>(exec, &JSWebKitCSSKeyframeRuleTable, this, propertyName, slot);
 }
 
-JSValuePtr jsWebKitCSSKeyframeRuleKeyText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSKeyframeRuleKeyText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WebKitCSSKeyframeRule* imp = static_cast<WebKitCSSKeyframeRule*>(static_cast<JSWebKitCSSKeyframeRule*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->keyText());
 }
 
-JSValuePtr jsWebKitCSSKeyframeRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSKeyframeRuleStyle(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WebKitCSSKeyframeRule* imp = static_cast<WebKitCSSKeyframeRule*>(static_cast<JSWebKitCSSKeyframeRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->style()));
 }
 
-JSValuePtr jsWebKitCSSKeyframeRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSKeyframeRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSWebKitCSSKeyframeRule*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSWebKitCSSKeyframeRule::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSWebKitCSSKeyframeRule::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSWebKitCSSKeyframeRule, Base>(exec, propertyName, value, &JSWebKitCSSKeyframeRuleTable, this, slot);
 }
 
-void setJSWebKitCSSKeyframeRuleKeyText(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSWebKitCSSKeyframeRuleKeyText(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     WebKitCSSKeyframeRule* imp = static_cast<WebKitCSSKeyframeRule*>(static_cast<JSWebKitCSSKeyframeRule*>(thisObject)->impl());
-    imp->setKeyText(value->toString(exec));
+    imp->setKeyText(value.toString(exec));
 }
 
-JSValuePtr JSWebKitCSSKeyframeRule::getConstructor(ExecState* exec)
+JSValue JSWebKitCSSKeyframeRule::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSWebKitCSSKeyframeRuleConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h
index 8a0d83c..f77c226 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframeRule.h
@@ -31,24 +31,25 @@ class JSWebKitCSSKeyframeRule : public JSCSSRule {
     typedef JSCSSRule Base;
 public:
     JSWebKitCSSKeyframeRule(PassRefPtr<JSC::Structure>, PassRefPtr<WebKitCSSKeyframeRule>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSWebKitCSSKeyframeRulePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSWebKitCSSKeyframeRulePrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -56,10 +57,10 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsWebKitCSSKeyframeRuleKeyText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSWebKitCSSKeyframeRuleKeyText(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsWebKitCSSKeyframeRuleStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSKeyframeRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSKeyframeRuleKeyText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSKeyframeRuleKeyText(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSKeyframeRuleStyle(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSKeyframeRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp
index 0bfcfa9..1bc7805 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.cpp
@@ -19,27 +19,23 @@
 */
 
 #include "config.h"
-
 #include "JSWebKitCSSKeyframesRule.h"
 
-#include <wtf/GetPtr.h>
-
-#include <runtime/PropertyNameArray.h>
 #include "CSSRuleList.h"
 #include "JSCSSRuleList.h"
 #include "JSWebKitCSSKeyframeRule.h"
 #include "KURL.h"
 #include "WebKitCSSKeyframeRule.h"
 #include "WebKitCSSKeyframesRule.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
+#include <runtime/PropertyNameArray.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSWebKitCSSKeyframesRule)
+ASSERT_CLASS_FITS_IN_CELL(JSWebKitCSSKeyframesRule);
 
 /* Hash table */
 
@@ -77,13 +73,13 @@ public:
     JSWebKitCSSKeyframesRuleConstructor(ExecState* exec)
         : DOMObject(JSWebKitCSSKeyframesRuleConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSWebKitCSSKeyframesRulePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSWebKitCSSKeyframesRulePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -115,9 +111,9 @@ static const HashTable JSWebKitCSSKeyframesRulePrototypeTable =
 
 const ClassInfo JSWebKitCSSKeyframesRulePrototype::s_info = { "WebKitCSSKeyframesRulePrototype", 0, &JSWebKitCSSKeyframesRulePrototypeTable, 0 };
 
-JSObject* JSWebKitCSSKeyframesRulePrototype::self(ExecState* exec)
+JSObject* JSWebKitCSSKeyframesRulePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSWebKitCSSKeyframesRule>(exec);
+    return getDOMPrototype<JSWebKitCSSKeyframesRule>(exec, globalObject);
 }
 
 bool JSWebKitCSSKeyframesRulePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,9 +128,9 @@ JSWebKitCSSKeyframesRule::JSWebKitCSSKeyframesRule(PassRefPtr<Structure> structu
 {
 }
 
-JSObject* JSWebKitCSSKeyframesRule::createPrototype(ExecState* exec)
+JSObject* JSWebKitCSSKeyframesRule::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSWebKitCSSKeyframesRulePrototype(JSWebKitCSSKeyframesRulePrototype::createStructure(JSCSSRulePrototype::self(exec)));
+    return new (exec) JSWebKitCSSKeyframesRulePrototype(JSWebKitCSSKeyframesRulePrototype::createStructure(JSCSSRulePrototype::self(exec, globalObject)));
 }
 
 bool JSWebKitCSSKeyframesRule::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -162,28 +158,30 @@ bool JSWebKitCSSKeyframesRule::getOwnPropertySlot(ExecState* exec, unsigned prop
     return getOwnPropertySlot(exec, Identifier::from(exec, propertyName), slot);
 }
 
-JSValuePtr jsWebKitCSSKeyframesRuleName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSKeyframesRuleName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WebKitCSSKeyframesRule* imp = static_cast<WebKitCSSKeyframesRule*>(static_cast<JSWebKitCSSKeyframesRule*>(asObject(slot.slotBase()))->impl());
     return jsStringOrNull(exec, imp->name());
 }
 
-JSValuePtr jsWebKitCSSKeyframesRuleCssRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSKeyframesRuleCssRules(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WebKitCSSKeyframesRule* imp = static_cast<WebKitCSSKeyframesRule*>(static_cast<JSWebKitCSSKeyframesRule*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->cssRules()));
 }
 
-JSValuePtr jsWebKitCSSKeyframesRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSKeyframesRuleConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSWebKitCSSKeyframesRule*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSWebKitCSSKeyframesRule::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSWebKitCSSKeyframesRule::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSWebKitCSSKeyframesRule, Base>(exec, propertyName, value, &JSWebKitCSSKeyframesRuleTable, this, slot);
 }
 
-void setJSWebKitCSSKeyframesRuleName(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSWebKitCSSKeyframesRuleName(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     WebKitCSSKeyframesRule* imp = static_cast<WebKitCSSKeyframesRule*>(static_cast<JSWebKitCSSKeyframesRule*>(thisObject)->impl());
     imp->setName(valueToStringWithNullCheck(exec, value));
@@ -196,50 +194,53 @@ void JSWebKitCSSKeyframesRule::getPropertyNames(ExecState* exec, PropertyNameArr
      Base::getPropertyNames(exec, propertyNames);
 }
 
-JSValuePtr JSWebKitCSSKeyframesRule::getConstructor(ExecState* exec)
+JSValue JSWebKitCSSKeyframesRule::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSWebKitCSSKeyframesRuleConstructor>(exec);
 }
 
-JSValuePtr jsWebKitCSSKeyframesRulePrototypeFunctionInsertRule(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWebKitCSSKeyframesRulePrototypeFunctionInsertRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWebKitCSSKeyframesRule::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitCSSKeyframesRule::s_info))
         return throwError(exec, TypeError);
     JSWebKitCSSKeyframesRule* castedThisObj = static_cast<JSWebKitCSSKeyframesRule*>(asObject(thisValue));
     WebKitCSSKeyframesRule* imp = static_cast<WebKitCSSKeyframesRule*>(castedThisObj->impl());
-    const UString& rule = args.at(exec, 0)->toString(exec);
+    const UString& rule = args.at(0).toString(exec);
 
     imp->insertRule(rule);
     return jsUndefined();
 }
 
-JSValuePtr jsWebKitCSSKeyframesRulePrototypeFunctionDeleteRule(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWebKitCSSKeyframesRulePrototypeFunctionDeleteRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWebKitCSSKeyframesRule::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitCSSKeyframesRule::s_info))
         return throwError(exec, TypeError);
     JSWebKitCSSKeyframesRule* castedThisObj = static_cast<JSWebKitCSSKeyframesRule*>(asObject(thisValue));
     WebKitCSSKeyframesRule* imp = static_cast<WebKitCSSKeyframesRule*>(castedThisObj->impl());
-    const UString& key = args.at(exec, 0)->toString(exec);
+    const UString& key = args.at(0).toString(exec);
 
     imp->deleteRule(key);
     return jsUndefined();
 }
 
-JSValuePtr jsWebKitCSSKeyframesRulePrototypeFunctionFindRule(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWebKitCSSKeyframesRulePrototypeFunctionFindRule(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWebKitCSSKeyframesRule::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitCSSKeyframesRule::s_info))
         return throwError(exec, TypeError);
     JSWebKitCSSKeyframesRule* castedThisObj = static_cast<JSWebKitCSSKeyframesRule*>(asObject(thisValue));
     WebKitCSSKeyframesRule* imp = static_cast<WebKitCSSKeyframesRule*>(castedThisObj->impl());
-    const UString& key = args.at(exec, 0)->toString(exec);
+    const UString& key = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->findRule(key)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->findRule(key)));
     return result;
 }
 
 
-JSValuePtr JSWebKitCSSKeyframesRule::indexGetter(ExecState* exec, const Identifier& propertyName, const PropertySlot& slot)
+JSValue JSWebKitCSSKeyframesRule::indexGetter(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     JSWebKitCSSKeyframesRule* thisObj = static_cast<JSWebKitCSSKeyframesRule*>(asObject(slot.slotBase()));
     return toJS(exec, static_cast<WebKitCSSKeyframesRule*>(thisObj->impl())->item(slot.index()));
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h
index b689e12..789f0a1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSKeyframesRule.h
@@ -31,31 +31,32 @@ class JSWebKitCSSKeyframesRule : public JSCSSRule {
     typedef JSCSSRule Base;
 public:
     JSWebKitCSSKeyframesRule(PassRefPtr<JSC::Structure>, PassRefPtr<WebKitCSSKeyframesRule>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual bool getOwnPropertySlot(JSC::ExecState*, unsigned propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void getPropertyNames(JSC::ExecState*, JSC::PropertyNameArray&);
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
-    static JSC::JSValuePtr indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
+    static JSC::JSValue indexGetter(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 };
 
 
 class JSWebKitCSSKeyframesRulePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -64,15 +65,15 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsWebKitCSSKeyframesRulePrototypeFunctionInsertRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsWebKitCSSKeyframesRulePrototypeFunctionDeleteRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsWebKitCSSKeyframesRulePrototypeFunctionFindRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitCSSKeyframesRulePrototypeFunctionInsertRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitCSSKeyframesRulePrototypeFunctionDeleteRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitCSSKeyframesRulePrototypeFunctionFindRule(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsWebKitCSSKeyframesRuleName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSWebKitCSSKeyframesRuleName(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsWebKitCSSKeyframesRuleCssRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSKeyframesRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSKeyframesRuleName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSKeyframesRuleName(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSKeyframesRuleCssRules(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSKeyframesRuleConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.cpp
new file mode 100644
index 0000000..8b28647
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.cpp
@@ -0,0 +1,553 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSWebKitCSSMatrix.h"
+
+#include "JSWebKitCSSMatrix.h"
+#include "KURL.h"
+#include "WebKitCSSMatrix.h"
+#include <runtime/Error.h>
+#include <runtime/JSNumberCell.h>
+#include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebKitCSSMatrix);
+
+/* Hash table */
+
+static const HashTableValue JSWebKitCSSMatrixTableValues[23] =
+{
+    { "a", DontDelete, (intptr_t)jsWebKitCSSMatrixA, (intptr_t)setJSWebKitCSSMatrixA },
+    { "b", DontDelete, (intptr_t)jsWebKitCSSMatrixB, (intptr_t)setJSWebKitCSSMatrixB },
+    { "c", DontDelete, (intptr_t)jsWebKitCSSMatrixC, (intptr_t)setJSWebKitCSSMatrixC },
+    { "d", DontDelete, (intptr_t)jsWebKitCSSMatrixD, (intptr_t)setJSWebKitCSSMatrixD },
+    { "e", DontDelete, (intptr_t)jsWebKitCSSMatrixE, (intptr_t)setJSWebKitCSSMatrixE },
+    { "f", DontDelete, (intptr_t)jsWebKitCSSMatrixF, (intptr_t)setJSWebKitCSSMatrixF },
+    { "m11", DontDelete, (intptr_t)jsWebKitCSSMatrixM11, (intptr_t)setJSWebKitCSSMatrixM11 },
+    { "m12", DontDelete, (intptr_t)jsWebKitCSSMatrixM12, (intptr_t)setJSWebKitCSSMatrixM12 },
+    { "m13", DontDelete, (intptr_t)jsWebKitCSSMatrixM13, (intptr_t)setJSWebKitCSSMatrixM13 },
+    { "m14", DontDelete, (intptr_t)jsWebKitCSSMatrixM14, (intptr_t)setJSWebKitCSSMatrixM14 },
+    { "m21", DontDelete, (intptr_t)jsWebKitCSSMatrixM21, (intptr_t)setJSWebKitCSSMatrixM21 },
+    { "m22", DontDelete, (intptr_t)jsWebKitCSSMatrixM22, (intptr_t)setJSWebKitCSSMatrixM22 },
+    { "m23", DontDelete, (intptr_t)jsWebKitCSSMatrixM23, (intptr_t)setJSWebKitCSSMatrixM23 },
+    { "m24", DontDelete, (intptr_t)jsWebKitCSSMatrixM24, (intptr_t)setJSWebKitCSSMatrixM24 },
+    { "m31", DontDelete, (intptr_t)jsWebKitCSSMatrixM31, (intptr_t)setJSWebKitCSSMatrixM31 },
+    { "m32", DontDelete, (intptr_t)jsWebKitCSSMatrixM32, (intptr_t)setJSWebKitCSSMatrixM32 },
+    { "m33", DontDelete, (intptr_t)jsWebKitCSSMatrixM33, (intptr_t)setJSWebKitCSSMatrixM33 },
+    { "m34", DontDelete, (intptr_t)jsWebKitCSSMatrixM34, (intptr_t)setJSWebKitCSSMatrixM34 },
+    { "m41", DontDelete, (intptr_t)jsWebKitCSSMatrixM41, (intptr_t)setJSWebKitCSSMatrixM41 },
+    { "m42", DontDelete, (intptr_t)jsWebKitCSSMatrixM42, (intptr_t)setJSWebKitCSSMatrixM42 },
+    { "m43", DontDelete, (intptr_t)jsWebKitCSSMatrixM43, (intptr_t)setJSWebKitCSSMatrixM43 },
+    { "m44", DontDelete, (intptr_t)jsWebKitCSSMatrixM44, (intptr_t)setJSWebKitCSSMatrixM44 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSWebKitCSSMatrixTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 255, JSWebKitCSSMatrixTableValues, 0 };
+#else
+    { 65, 63, JSWebKitCSSMatrixTableValues, 0 };
+#endif
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebKitCSSMatrixPrototypeTableValues[9] =
+{
+    { "setMatrixValue", DontDelete|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionSetMatrixValue, (intptr_t)1 },
+    { "multiply", DontDelete|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionMultiply, (intptr_t)1 },
+    { "inverse", DontDelete|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionInverse, (intptr_t)0 },
+    { "translate", DontDelete|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionTranslate, (intptr_t)3 },
+    { "scale", DontDelete|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionScale, (intptr_t)3 },
+    { "rotate", DontDelete|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionRotate, (intptr_t)3 },
+    { "rotateAxisAngle", DontDelete|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionRotateAxisAngle, (intptr_t)4 },
+    { "toString", DontDelete|DontEnum|Function, (intptr_t)jsWebKitCSSMatrixPrototypeFunctionToString, (intptr_t)0 },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSWebKitCSSMatrixPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 63, JSWebKitCSSMatrixPrototypeTableValues, 0 };
+#else
+    { 17, 15, JSWebKitCSSMatrixPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSWebKitCSSMatrixPrototype::s_info = { "WebKitCSSMatrixPrototype", 0, &JSWebKitCSSMatrixPrototypeTable, 0 };
+
+JSObject* JSWebKitCSSMatrixPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebKitCSSMatrix>(exec, globalObject);
+}
+
+bool JSWebKitCSSMatrixPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticFunctionSlot<JSObject>(exec, &JSWebKitCSSMatrixPrototypeTable, this, propertyName, slot);
+}
+
+const ClassInfo JSWebKitCSSMatrix::s_info = { "WebKitCSSMatrix", 0, &JSWebKitCSSMatrixTable, 0 };
+
+JSWebKitCSSMatrix::JSWebKitCSSMatrix(PassRefPtr<Structure> structure, PassRefPtr<WebKitCSSMatrix> impl)
+    : DOMObject(structure)
+    , m_impl(impl)
+{
+}
+
+JSWebKitCSSMatrix::~JSWebKitCSSMatrix()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSWebKitCSSMatrix::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebKitCSSMatrixPrototype(JSWebKitCSSMatrixPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSWebKitCSSMatrix::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSWebKitCSSMatrix, Base>(exec, &JSWebKitCSSMatrixTable, this, propertyName, slot);
+}
+
+JSValue jsWebKitCSSMatrixA(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->a());
+}
+
+JSValue jsWebKitCSSMatrixB(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->b());
+}
+
+JSValue jsWebKitCSSMatrixC(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->c());
+}
+
+JSValue jsWebKitCSSMatrixD(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->d());
+}
+
+JSValue jsWebKitCSSMatrixE(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->e());
+}
+
+JSValue jsWebKitCSSMatrixF(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->f());
+}
+
+JSValue jsWebKitCSSMatrixM11(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m11());
+}
+
+JSValue jsWebKitCSSMatrixM12(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m12());
+}
+
+JSValue jsWebKitCSSMatrixM13(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m13());
+}
+
+JSValue jsWebKitCSSMatrixM14(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m14());
+}
+
+JSValue jsWebKitCSSMatrixM21(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m21());
+}
+
+JSValue jsWebKitCSSMatrixM22(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m22());
+}
+
+JSValue jsWebKitCSSMatrixM23(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m23());
+}
+
+JSValue jsWebKitCSSMatrixM24(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m24());
+}
+
+JSValue jsWebKitCSSMatrixM31(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m31());
+}
+
+JSValue jsWebKitCSSMatrixM32(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m32());
+}
+
+JSValue jsWebKitCSSMatrixM33(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m33());
+}
+
+JSValue jsWebKitCSSMatrixM34(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m34());
+}
+
+JSValue jsWebKitCSSMatrixM41(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m41());
+}
+
+JSValue jsWebKitCSSMatrixM42(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m42());
+}
+
+JSValue jsWebKitCSSMatrixM43(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m43());
+}
+
+JSValue jsWebKitCSSMatrixM44(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->m44());
+}
+
+void JSWebKitCSSMatrix::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    lookupPut<JSWebKitCSSMatrix, Base>(exec, propertyName, value, &JSWebKitCSSMatrixTable, this, slot);
+}
+
+void setJSWebKitCSSMatrixA(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setA(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixB(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setB(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixC(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setC(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixD(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setD(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixE(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setE(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixF(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setF(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM11(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM11(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM12(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM12(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM13(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM13(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM14(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM14(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM21(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM21(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM22(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM22(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM23(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM23(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM24(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM24(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM31(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM31(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM32(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM32(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM33(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM33(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM34(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM34(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM41(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM41(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM42(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM42(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM43(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM43(value.toNumber(exec));
+}
+
+void setJSWebKitCSSMatrixM44(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(static_cast<JSWebKitCSSMatrix*>(thisObject)->impl());
+    imp->setM44(value.toNumber(exec));
+}
+
+JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionSetMatrixValue(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+        return throwError(exec, TypeError);
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+    const UString& string = args.at(0).toString(exec);
+
+    imp->setMatrixValue(string, ec);
+    setDOMException(exec, ec);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionMultiply(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+        return throwError(exec, TypeError);
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
+    WebKitCSSMatrix* secondMatrix = toWebKitCSSMatrix(args.at(0));
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->multiply(secondMatrix)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionInverse(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+        return throwError(exec, TypeError);
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
+    ExceptionCode ec = 0;
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->inverse(ec)));
+    setDOMException(exec, ec);
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionTranslate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+        return throwError(exec, TypeError);
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
+    double x = args.at(0).toNumber(exec);
+    double y = args.at(1).toNumber(exec);
+    double z = args.at(2).toNumber(exec);
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->translate(x, y, z)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionScale(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+        return throwError(exec, TypeError);
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
+    double scaleX = args.at(0).toNumber(exec);
+    double scaleY = args.at(1).toNumber(exec);
+    double scaleZ = args.at(2).toNumber(exec);
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->scale(scaleX, scaleY, scaleZ)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionRotate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+        return throwError(exec, TypeError);
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
+    double rotX = args.at(0).toNumber(exec);
+    double rotY = args.at(1).toNumber(exec);
+    double rotZ = args.at(2).toNumber(exec);
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->rotate(rotX, rotY, rotZ)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionRotateAxisAngle(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+        return throwError(exec, TypeError);
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
+    double x = args.at(0).toNumber(exec);
+    double y = args.at(1).toNumber(exec);
+    double z = args.at(2).toNumber(exec);
+    double angle = args.at(3).toNumber(exec);
+
+
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->rotateAxisAngle(x, y, z, angle)));
+    return result;
+}
+
+JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitCSSMatrix::s_info))
+        return throwError(exec, TypeError);
+    JSWebKitCSSMatrix* castedThisObj = static_cast<JSWebKitCSSMatrix*>(asObject(thisValue));
+    WebKitCSSMatrix* imp = static_cast<WebKitCSSMatrix*>(castedThisObj->impl());
+
+
+    JSC::JSValue result = jsString(exec, imp->toString());
+    return result;
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, WebKitCSSMatrix* object)
+{
+    return getDOMObjectWrapper<JSWebKitCSSMatrix>(exec, object);
+}
+WebKitCSSMatrix* toWebKitCSSMatrix(JSC::JSValue value)
+{
+    return value.isObject(&JSWebKitCSSMatrix::s_info) ? static_cast<JSWebKitCSSMatrix*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.h
new file mode 100644
index 0000000..ad37712
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSMatrix.h
@@ -0,0 +1,130 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSWebKitCSSMatrix_h
+#define JSWebKitCSSMatrix_h
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class WebKitCSSMatrix;
+
+class JSWebKitCSSMatrix : public DOMObject {
+    typedef DOMObject Base;
+public:
+    JSWebKitCSSMatrix(PassRefPtr<JSC::Structure>, PassRefPtr<WebKitCSSMatrix>);
+    virtual ~JSWebKitCSSMatrix();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    WebKitCSSMatrix* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<WebKitCSSMatrix> m_impl;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, WebKitCSSMatrix*);
+WebKitCSSMatrix* toWebKitCSSMatrix(JSC::JSValue);
+
+class JSWebKitCSSMatrixPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+    JSWebKitCSSMatrixPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Functions
+
+JSC::JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionSetMatrixValue(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionMultiply(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionInverse(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionTranslate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionScale(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionRotate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionRotateAxisAngle(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitCSSMatrixPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+// Attributes
+
+JSC::JSValue jsWebKitCSSMatrixA(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixA(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixB(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixB(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixC(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixC(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixD(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixD(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixE(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixF(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixF(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM11(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM11(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM12(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM12(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM13(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM13(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM14(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM14(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM21(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM21(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM22(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM22(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM23(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM23(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM24(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM24(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM31(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM31(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM32(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM32(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM33(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM33(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM34(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM34(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM41(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM41(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM42(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM42(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM43(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM43(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitCSSMatrixM44(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitCSSMatrixM44(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp
index d0b1072..37f1563 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.cpp
@@ -19,20 +19,17 @@
 */
 
 #include "config.h"
-
 #include "JSWebKitCSSTransformValue.h"
 
-#include <wtf/GetPtr.h>
-
 #include "WebKitCSSTransformValue.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSWebKitCSSTransformValue)
+ASSERT_CLASS_FITS_IN_CELL(JSWebKitCSSTransformValue);
 
 /* Hash table */
 
@@ -52,7 +49,7 @@ static const HashTable JSWebKitCSSTransformValueTable =
 
 /* Hash table for constructor */
 
-static const HashTableValue JSWebKitCSSTransformValueConstructorTableValues[12] =
+static const HashTableValue JSWebKitCSSTransformValueConstructorTableValues[22] =
 {
     { "CSS_TRANSLATE", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATE, (intptr_t)0 },
     { "CSS_TRANSLATEX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATEX, (intptr_t)0 },
@@ -65,6 +62,16 @@ static const HashTableValue JSWebKitCSSTransformValueConstructorTableValues[12]
     { "CSS_SKEWX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SKEWX, (intptr_t)0 },
     { "CSS_SKEWY", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SKEWY, (intptr_t)0 },
     { "CSS_MATRIX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_MATRIX, (intptr_t)0 },
+    { "CSS_TRANSLATEZ", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATEZ, (intptr_t)0 },
+    { "CSS_TRANSLATE3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATE3D, (intptr_t)0 },
+    { "CSS_ROTATEX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATEX, (intptr_t)0 },
+    { "CSS_ROTATEY", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATEY, (intptr_t)0 },
+    { "CSS_ROTATEZ", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATEZ, (intptr_t)0 },
+    { "CSS_ROTATE3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATE3D, (intptr_t)0 },
+    { "CSS_SCALEZ", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SCALEZ, (intptr_t)0 },
+    { "CSS_SCALE3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SCALE3D, (intptr_t)0 },
+    { "CSS_PERSPECTIVE", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_PERSPECTIVE, (intptr_t)0 },
+    { "CSS_MATRIX3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_MATRIX3D, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -72,7 +79,7 @@ static const HashTable JSWebKitCSSTransformValueConstructorTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 1023, JSWebKitCSSTransformValueConstructorTableValues, 0 };
 #else
-    { 33, 31, JSWebKitCSSTransformValueConstructorTableValues, 0 };
+    { 68, 63, JSWebKitCSSTransformValueConstructorTableValues, 0 };
 #endif
 
 class JSWebKitCSSTransformValueConstructor : public DOMObject {
@@ -80,13 +87,13 @@ public:
     JSWebKitCSSTransformValueConstructor(ExecState* exec)
         : DOMObject(JSWebKitCSSTransformValueConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSWebKitCSSTransformValuePrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSWebKitCSSTransformValuePrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -101,7 +108,7 @@ bool JSWebKitCSSTransformValueConstructor::getOwnPropertySlot(ExecState* exec, c
 
 /* Hash table for prototype */
 
-static const HashTableValue JSWebKitCSSTransformValuePrototypeTableValues[12] =
+static const HashTableValue JSWebKitCSSTransformValuePrototypeTableValues[22] =
 {
     { "CSS_TRANSLATE", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATE, (intptr_t)0 },
     { "CSS_TRANSLATEX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATEX, (intptr_t)0 },
@@ -114,6 +121,16 @@ static const HashTableValue JSWebKitCSSTransformValuePrototypeTableValues[12] =
     { "CSS_SKEWX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SKEWX, (intptr_t)0 },
     { "CSS_SKEWY", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SKEWY, (intptr_t)0 },
     { "CSS_MATRIX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_MATRIX, (intptr_t)0 },
+    { "CSS_TRANSLATEZ", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATEZ, (intptr_t)0 },
+    { "CSS_TRANSLATE3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_TRANSLATE3D, (intptr_t)0 },
+    { "CSS_ROTATEX", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATEX, (intptr_t)0 },
+    { "CSS_ROTATEY", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATEY, (intptr_t)0 },
+    { "CSS_ROTATEZ", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATEZ, (intptr_t)0 },
+    { "CSS_ROTATE3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_ROTATE3D, (intptr_t)0 },
+    { "CSS_SCALEZ", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SCALEZ, (intptr_t)0 },
+    { "CSS_SCALE3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_SCALE3D, (intptr_t)0 },
+    { "CSS_PERSPECTIVE", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_PERSPECTIVE, (intptr_t)0 },
+    { "CSS_MATRIX3D", DontDelete|ReadOnly, (intptr_t)jsWebKitCSSTransformValueCSS_MATRIX3D, (intptr_t)0 },
     { 0, 0, 0, 0 }
 };
 
@@ -121,14 +138,14 @@ static const HashTable JSWebKitCSSTransformValuePrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 1023, JSWebKitCSSTransformValuePrototypeTableValues, 0 };
 #else
-    { 33, 31, JSWebKitCSSTransformValuePrototypeTableValues, 0 };
+    { 68, 63, JSWebKitCSSTransformValuePrototypeTableValues, 0 };
 #endif
 
 const ClassInfo JSWebKitCSSTransformValuePrototype::s_info = { "WebKitCSSTransformValuePrototype", 0, &JSWebKitCSSTransformValuePrototypeTable, 0 };
 
-JSObject* JSWebKitCSSTransformValuePrototype::self(ExecState* exec)
+JSObject* JSWebKitCSSTransformValuePrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSWebKitCSSTransformValue>(exec);
+    return getDOMPrototype<JSWebKitCSSTransformValue>(exec, globalObject);
 }
 
 bool JSWebKitCSSTransformValuePrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -143,9 +160,9 @@ JSWebKitCSSTransformValue::JSWebKitCSSTransformValue(PassRefPtr<Structure> struc
 {
 }
 
-JSObject* JSWebKitCSSTransformValue::createPrototype(ExecState* exec)
+JSObject* JSWebKitCSSTransformValue::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSWebKitCSSTransformValuePrototype(JSWebKitCSSTransformValuePrototype::createStructure(JSCSSValueListPrototype::self(exec)));
+    return new (exec) JSWebKitCSSTransformValuePrototype(JSWebKitCSSTransformValuePrototype::createStructure(JSCSSValueListPrototype::self(exec, globalObject)));
 }
 
 bool JSWebKitCSSTransformValue::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -153,77 +170,128 @@ bool JSWebKitCSSTransformValue::getOwnPropertySlot(ExecState* exec, const Identi
     return getStaticValueSlot<JSWebKitCSSTransformValue, Base>(exec, &JSWebKitCSSTransformValueTable, this, propertyName, slot);
 }
 
-JSValuePtr jsWebKitCSSTransformValueOperationType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSTransformValueOperationType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WebKitCSSTransformValue* imp = static_cast<WebKitCSSTransformValue*>(static_cast<JSWebKitCSSTransformValue*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->operationType());
 }
 
-JSValuePtr jsWebKitCSSTransformValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitCSSTransformValueConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSWebKitCSSTransformValue*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSWebKitCSSTransformValue::getConstructor(ExecState* exec)
+JSValue JSWebKitCSSTransformValue::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSWebKitCSSTransformValueConstructor>(exec);
 }
 
 // Constant getters
 
-JSValuePtr jsWebKitCSSTransformValueCSS_TRANSLATE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_TRANSLATE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsWebKitCSSTransformValueCSS_TRANSLATEX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_TRANSLATEX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsWebKitCSSTransformValueCSS_TRANSLATEY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_TRANSLATEY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsWebKitCSSTransformValueCSS_ROTATE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_ROTATE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsWebKitCSSTransformValueCSS_SCALE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_SCALE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValuePtr jsWebKitCSSTransformValueCSS_SCALEX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_SCALEX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValuePtr jsWebKitCSSTransformValueCSS_SCALEY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_SCALEY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValuePtr jsWebKitCSSTransformValueCSS_SKEW(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_SKEW(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValuePtr jsWebKitCSSTransformValueCSS_SKEWX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_SKEWX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSValuePtr jsWebKitCSSTransformValueCSS_SKEWY(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_SKEWY(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(10));
 }
 
-JSValuePtr jsWebKitCSSTransformValueCSS_MATRIX(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsWebKitCSSTransformValueCSS_MATRIX(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(11));
 }
 
+JSValue jsWebKitCSSTransformValueCSS_TRANSLATEZ(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(12));
+}
+
+JSValue jsWebKitCSSTransformValueCSS_TRANSLATE3D(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(13));
+}
+
+JSValue jsWebKitCSSTransformValueCSS_ROTATEX(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(14));
+}
+
+JSValue jsWebKitCSSTransformValueCSS_ROTATEY(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(15));
+}
+
+JSValue jsWebKitCSSTransformValueCSS_ROTATEZ(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(16));
+}
+
+JSValue jsWebKitCSSTransformValueCSS_ROTATE3D(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(17));
+}
+
+JSValue jsWebKitCSSTransformValueCSS_SCALEZ(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(18));
+}
+
+JSValue jsWebKitCSSTransformValueCSS_SCALE3D(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(19));
+}
+
+JSValue jsWebKitCSSTransformValueCSS_PERSPECTIVE(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(20));
+}
+
+JSValue jsWebKitCSSTransformValueCSS_MATRIX3D(ExecState* exec, const Identifier&, const PropertySlot&)
+{
+    return jsNumber(exec, static_cast<int>(21));
+}
+
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h
index d5d8915..3f636e3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitCSSTransformValue.h
@@ -31,27 +31,28 @@ class JSWebKitCSSTransformValue : public JSCSSValueList {
     typedef JSCSSValueList Base;
 public:
     JSWebKitCSSTransformValue(PassRefPtr<JSC::Structure>, PassRefPtr<WebKitCSSTransformValue>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSWebKitCSSTransformValuePrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,21 +61,31 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsWebKitCSSTransformValueOperationType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSTransformValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueOperationType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsWebKitCSSTransformValueCSS_TRANSLATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSTransformValueCSS_TRANSLATEX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSTransformValueCSS_TRANSLATEY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSTransformValueCSS_ROTATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSTransformValueCSS_SCALE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSTransformValueCSS_SCALEX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSTransformValueCSS_SCALEY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSTransformValueCSS_SKEW(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSTransformValueCSS_SKEWX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSTransformValueCSS_SKEWY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitCSSTransformValueCSS_MATRIX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_TRANSLATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_TRANSLATEX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_TRANSLATEY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_ROTATE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SCALE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SCALEX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SCALEY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SKEW(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SKEWX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SKEWY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_MATRIX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_TRANSLATEZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_TRANSLATE3D(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_ROTATEX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_ROTATEY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_ROTATEZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_ROTATE3D(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SCALEZ(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_SCALE3D(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_PERSPECTIVE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitCSSTransformValueCSS_MATRIX3D(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.cpp
new file mode 100644
index 0000000..b954f24
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.cpp
@@ -0,0 +1,134 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "JSWebKitPoint.h"
+
+#include "WebKitPoint.h"
+#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+ASSERT_CLASS_FITS_IN_CELL(JSWebKitPoint);
+
+/* Hash table */
+
+static const HashTableValue JSWebKitPointTableValues[3] =
+{
+    { "x", DontDelete, (intptr_t)jsWebKitPointX, (intptr_t)setJSWebKitPointX },
+    { "y", DontDelete, (intptr_t)jsWebKitPointY, (intptr_t)setJSWebKitPointY },
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSWebKitPointTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 1, JSWebKitPointTableValues, 0 };
+#else
+    { 4, 3, JSWebKitPointTableValues, 0 };
+#endif
+
+/* Hash table for prototype */
+
+static const HashTableValue JSWebKitPointPrototypeTableValues[1] =
+{
+    { 0, 0, 0, 0 }
+};
+
+static const HashTable JSWebKitPointPrototypeTable =
+#if ENABLE(PERFECT_HASH_SIZE)
+    { 0, JSWebKitPointPrototypeTableValues, 0 };
+#else
+    { 1, 0, JSWebKitPointPrototypeTableValues, 0 };
+#endif
+
+const ClassInfo JSWebKitPointPrototype::s_info = { "WebKitPointPrototype", 0, &JSWebKitPointPrototypeTable, 0 };
+
+JSObject* JSWebKitPointPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return getDOMPrototype<JSWebKitPoint>(exec, globalObject);
+}
+
+const ClassInfo JSWebKitPoint::s_info = { "WebKitPoint", 0, &JSWebKitPointTable, 0 };
+
+JSWebKitPoint::JSWebKitPoint(PassRefPtr<Structure> structure, PassRefPtr<WebKitPoint> impl)
+    : DOMObject(structure)
+    , m_impl(impl)
+{
+}
+
+JSWebKitPoint::~JSWebKitPoint()
+{
+    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
+}
+
+JSObject* JSWebKitPoint::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
+{
+    return new (exec) JSWebKitPointPrototype(JSWebKitPointPrototype::createStructure(globalObject->objectPrototype()));
+}
+
+bool JSWebKitPoint::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
+{
+    return getStaticValueSlot<JSWebKitPoint, Base>(exec, &JSWebKitPointTable, this, propertyName, slot);
+}
+
+JSValue jsWebKitPointX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitPoint* imp = static_cast<WebKitPoint*>(static_cast<JSWebKitPoint*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->x());
+}
+
+JSValue jsWebKitPointY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
+    WebKitPoint* imp = static_cast<WebKitPoint*>(static_cast<JSWebKitPoint*>(asObject(slot.slotBase()))->impl());
+    return jsNumber(exec, imp->y());
+}
+
+void JSWebKitPoint::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+{
+    lookupPut<JSWebKitPoint, Base>(exec, propertyName, value, &JSWebKitPointTable, this, slot);
+}
+
+void setJSWebKitPointX(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitPoint* imp = static_cast<WebKitPoint*>(static_cast<JSWebKitPoint*>(thisObject)->impl());
+    imp->setX(value.toFloat(exec));
+}
+
+void setJSWebKitPointY(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    WebKitPoint* imp = static_cast<WebKitPoint*>(static_cast<JSWebKitPoint*>(thisObject)->impl());
+    imp->setY(value.toFloat(exec));
+}
+
+JSC::JSValue toJS(JSC::ExecState* exec, WebKitPoint* object)
+{
+    return getDOMObjectWrapper<JSWebKitPoint>(exec, object);
+}
+WebKitPoint* toWebKitPoint(JSC::JSValue value)
+{
+    return value.isObject(&JSWebKitPoint::s_info) ? static_cast<JSWebKitPoint*>(asObject(value))->impl() : 0;
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.h
new file mode 100644
index 0000000..1a7c88f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitPoint.h
@@ -0,0 +1,75 @@
+/*
+    This file is part of the WebKit open source project.
+    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef JSWebKitPoint_h
+#define JSWebKitPoint_h
+
+#include "JSDOMBinding.h"
+#include <runtime/JSGlobalObject.h>
+#include <runtime/ObjectPrototype.h>
+
+namespace WebCore {
+
+class WebKitPoint;
+
+class JSWebKitPoint : public DOMObject {
+    typedef DOMObject Base;
+public:
+    JSWebKitPoint(PassRefPtr<JSC::Structure>, PassRefPtr<WebKitPoint>);
+    virtual ~JSWebKitPoint();
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
+    {
+        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
+    }
+
+    WebKitPoint* impl() const { return m_impl.get(); }
+
+private:
+    RefPtr<WebKitPoint> m_impl;
+};
+
+JSC::JSValue toJS(JSC::ExecState*, WebKitPoint*);
+WebKitPoint* toWebKitPoint(JSC::JSValue);
+
+class JSWebKitPointPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
+public:
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
+    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
+    static const JSC::ClassInfo s_info;
+    JSWebKitPointPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
+};
+
+// Attributes
+
+JSC::JSValue jsWebKitPointX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitPointX(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWebKitPointY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWebKitPointY(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp
index 2090734..3ca4c82 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.cpp
@@ -19,23 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSWebKitTransitionEvent.h"
 
-#include <wtf/GetPtr.h>
-
 #include "KURL.h"
 #include "WebKitTransitionEvent.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSWebKitTransitionEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSWebKitTransitionEvent);
 
 /* Hash table */
 
@@ -73,13 +70,13 @@ public:
     JSWebKitTransitionEventConstructor(ExecState* exec)
         : DOMObject(JSWebKitTransitionEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSWebKitTransitionEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSWebKitTransitionEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -109,9 +106,9 @@ static const HashTable JSWebKitTransitionEventPrototypeTable =
 
 const ClassInfo JSWebKitTransitionEventPrototype::s_info = { "WebKitTransitionEventPrototype", 0, &JSWebKitTransitionEventPrototypeTable, 0 };
 
-JSObject* JSWebKitTransitionEventPrototype::self(ExecState* exec)
+JSObject* JSWebKitTransitionEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSWebKitTransitionEvent>(exec);
+    return getDOMPrototype<JSWebKitTransitionEvent>(exec, globalObject);
 }
 
 bool JSWebKitTransitionEventPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -126,9 +123,9 @@ JSWebKitTransitionEvent::JSWebKitTransitionEvent(PassRefPtr<Structure> structure
 {
 }
 
-JSObject* JSWebKitTransitionEvent::createPrototype(ExecState* exec)
+JSObject* JSWebKitTransitionEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSWebKitTransitionEventPrototype(JSWebKitTransitionEventPrototype::createStructure(JSEventPrototype::self(exec)));
+    return new (exec) JSWebKitTransitionEventPrototype(JSWebKitTransitionEventPrototype::createStructure(JSEventPrototype::self(exec, globalObject)));
 }
 
 bool JSWebKitTransitionEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -136,38 +133,41 @@ bool JSWebKitTransitionEvent::getOwnPropertySlot(ExecState* exec, const Identifi
     return getStaticValueSlot<JSWebKitTransitionEvent, Base>(exec, &JSWebKitTransitionEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsWebKitTransitionEventPropertyName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitTransitionEventPropertyName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WebKitTransitionEvent* imp = static_cast<WebKitTransitionEvent*>(static_cast<JSWebKitTransitionEvent*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->propertyName());
 }
 
-JSValuePtr jsWebKitTransitionEventElapsedTime(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitTransitionEventElapsedTime(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WebKitTransitionEvent* imp = static_cast<WebKitTransitionEvent*>(static_cast<JSWebKitTransitionEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->elapsedTime());
 }
 
-JSValuePtr jsWebKitTransitionEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWebKitTransitionEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSWebKitTransitionEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSWebKitTransitionEvent::getConstructor(ExecState* exec)
+JSValue JSWebKitTransitionEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSWebKitTransitionEventConstructor>(exec);
 }
 
-JSValuePtr jsWebKitTransitionEventPrototypeFunctionInitWebKitTransitionEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWebKitTransitionEventPrototypeFunctionInitWebKitTransitionEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWebKitTransitionEvent::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWebKitTransitionEvent::s_info))
         return throwError(exec, TypeError);
     JSWebKitTransitionEvent* castedThisObj = static_cast<JSWebKitTransitionEvent*>(asObject(thisValue));
     WebKitTransitionEvent* imp = static_cast<WebKitTransitionEvent*>(castedThisObj->impl());
-    const UString& typeArg = args.at(exec, 0)->toString(exec);
-    bool canBubbleArg = args.at(exec, 1)->toBoolean(exec);
-    bool cancelableArg = args.at(exec, 2)->toBoolean(exec);
-    const UString& propertyNameArg = args.at(exec, 3)->toString(exec);
-    double elapsedTimeArg = args.at(exec, 4)->toNumber(exec);
+    const UString& typeArg = args.at(0).toString(exec);
+    bool canBubbleArg = args.at(1).toBoolean(exec);
+    bool cancelableArg = args.at(2).toBoolean(exec);
+    const UString& propertyNameArg = args.at(3).toString(exec);
+    double elapsedTimeArg = args.at(4).toNumber(exec);
 
     imp->initWebKitTransitionEvent(typeArg, canBubbleArg, cancelableArg, propertyNameArg, elapsedTimeArg);
     return jsUndefined();
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h
index f342d47..de22ec3 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWebKitTransitionEvent.h
@@ -31,27 +31,28 @@ class JSWebKitTransitionEvent : public JSEvent {
     typedef JSEvent Base;
 public:
     JSWebKitTransitionEvent(PassRefPtr<JSC::Structure>, PassRefPtr<WebKitTransitionEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSWebKitTransitionEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -60,12 +61,12 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsWebKitTransitionEventPrototypeFunctionInitWebKitTransitionEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWebKitTransitionEventPrototypeFunctionInitWebKitTransitionEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsWebKitTransitionEventPropertyName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitTransitionEventElapsedTime(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWebKitTransitionEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitTransitionEventPropertyName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitTransitionEventElapsedTime(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWebKitTransitionEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp
index 752cd13..e56513d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.cpp
@@ -19,20 +19,17 @@
 */
 
 #include "config.h"
-
 #include "JSWheelEvent.h"
 
-#include <wtf/GetPtr.h>
-
 #include "WheelEvent.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSWheelEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSWheelEvent);
 
 /* Hash table */
 
@@ -83,13 +80,13 @@ public:
     JSWheelEventConstructor(ExecState* exec)
         : DOMObject(JSWheelEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSWheelEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSWheelEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -118,9 +115,9 @@ static const HashTable JSWheelEventPrototypeTable =
 
 const ClassInfo JSWheelEventPrototype::s_info = { "WheelEventPrototype", 0, &JSWheelEventPrototypeTable, 0 };
 
-JSObject* JSWheelEventPrototype::self(ExecState* exec)
+JSObject* JSWheelEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSWheelEvent>(exec);
+    return getDOMPrototype<JSWheelEvent>(exec, globalObject);
 }
 
 const ClassInfo JSWheelEvent::s_info = { "WheelEvent", &JSUIEvent::s_info, &JSWheelEventTable, 0 };
@@ -130,9 +127,9 @@ JSWheelEvent::JSWheelEvent(PassRefPtr<Structure> structure, PassRefPtr<WheelEven
 {
 }
 
-JSObject* JSWheelEvent::createPrototype(ExecState* exec)
+JSObject* JSWheelEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSWheelEventPrototype(JSWheelEventPrototype::createStructure(JSUIEventPrototype::self(exec)));
+    return new (exec) JSWheelEventPrototype(JSWheelEventPrototype::createStructure(JSUIEventPrototype::self(exec, globalObject)));
 }
 
 bool JSWheelEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -140,101 +137,116 @@ bool JSWheelEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propert
     return getStaticValueSlot<JSWheelEvent, Base>(exec, &JSWheelEventTable, this, propertyName, slot);
 }
 
-JSValuePtr jsWheelEventScreenX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventScreenX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->screenX());
 }
 
-JSValuePtr jsWheelEventScreenY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventScreenY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->screenY());
 }
 
-JSValuePtr jsWheelEventClientX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventClientX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->clientX());
 }
 
-JSValuePtr jsWheelEventClientY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventClientY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->clientY());
 }
 
-JSValuePtr jsWheelEventCtrlKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventCtrlKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->ctrlKey());
 }
 
-JSValuePtr jsWheelEventShiftKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventShiftKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->shiftKey());
 }
 
-JSValuePtr jsWheelEventAltKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventAltKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->altKey());
 }
 
-JSValuePtr jsWheelEventMetaKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventMetaKey(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->metaKey());
 }
 
-JSValuePtr jsWheelEventWheelDelta(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventWheelDelta(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->wheelDelta());
 }
 
-JSValuePtr jsWheelEventWheelDeltaX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventWheelDeltaX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->wheelDeltaX());
 }
 
-JSValuePtr jsWheelEventWheelDeltaY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventWheelDeltaY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->wheelDeltaY());
 }
 
-JSValuePtr jsWheelEventOffsetX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventOffsetX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->offsetX());
 }
 
-JSValuePtr jsWheelEventOffsetY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventOffsetY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->offsetY());
 }
 
-JSValuePtr jsWheelEventX(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventX(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->x());
 }
 
-JSValuePtr jsWheelEventY(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventY(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WheelEvent* imp = static_cast<WheelEvent*>(static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->y());
 }
 
-JSValuePtr jsWheelEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWheelEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSWheelEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSWheelEvent::getConstructor(ExecState* exec)
+JSValue JSWheelEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSWheelEventConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h
index 4c2d5e8..ae9730d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWheelEvent.h
@@ -31,23 +31,24 @@ class JSWheelEvent : public JSUIEvent {
     typedef JSUIEvent Base;
 public:
     JSWheelEvent(PassRefPtr<JSC::Structure>, PassRefPtr<WheelEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSWheelEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSWheelEventPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -55,22 +56,22 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsWheelEventScreenX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventScreenY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventClientX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventClientY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventCtrlKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventShiftKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventAltKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventMetaKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventWheelDelta(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventWheelDeltaX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventWheelDeltaY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventOffsetX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventOffsetY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWheelEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventScreenX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventScreenY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventClientX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventClientY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventCtrlKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventShiftKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventAltKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventMetaKey(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventWheelDelta(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventWheelDeltaX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventWheelDeltaY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventOffsetX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventOffsetY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventX(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventY(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWheelEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorker.cpp b/src/3rdparty/webkit/WebCore/generated/JSWorker.cpp
index e88aa96..4c4f8a0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorker.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorker.cpp
@@ -20,13 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(WORKERS)
 
 #include "JSWorker.h"
 
-#include <wtf/GetPtr.h>
-
 #include "Event.h"
 #include "EventListener.h"
 #include "Frame.h"
@@ -34,14 +31,14 @@
 #include "JSEvent.h"
 #include "JSEventListener.h"
 #include "Worker.h"
-
 #include <runtime/Error.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSWorker)
+ASSERT_CLASS_FITS_IN_CELL(JSWorker);
 
 /* Hash table */
 
@@ -80,9 +77,9 @@ static const HashTable JSWorkerPrototypeTable =
 
 const ClassInfo JSWorkerPrototype::s_info = { "WorkerPrototype", 0, &JSWorkerPrototypeTable, 0 };
 
-JSObject* JSWorkerPrototype::self(ExecState* exec)
+JSObject* JSWorkerPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSWorker>(exec);
+    return getDOMPrototype<JSWorker>(exec, globalObject);
 }
 
 bool JSWorkerPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -101,12 +98,11 @@ JSWorker::JSWorker(PassRefPtr<Structure> structure, PassRefPtr<Worker> impl)
 JSWorker::~JSWorker()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSWorker::createPrototype(ExecState* exec)
+JSObject* JSWorker::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSWorkerPrototype(JSWorkerPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSWorkerPrototype(JSWorkerPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSWorker::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -114,64 +110,70 @@ bool JSWorker::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNam
     return getStaticValueSlot<JSWorker, Base>(exec, &JSWorkerTable, this, propertyName, slot);
 }
 
-JSValuePtr jsWorkerOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Worker* imp = static_cast<Worker*>(static_cast<JSWorker*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onerror())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onerror()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsWorkerOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     Worker* imp = static_cast<Worker*>(static_cast<JSWorker*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onmessage())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onmessage()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-void JSWorker::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSWorker::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     lookupPut<JSWorker, Base>(exec, propertyName, value, &JSWorkerTable, this, slot);
 }
 
-void setJSWorkerOnerror(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSWorkerOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     Worker* imp = static_cast<Worker*>(static_cast<JSWorker*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnerror(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSWorkerOnmessage(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSWorkerOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     Worker* imp = static_cast<Worker*>(static_cast<JSWorker*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnmessage(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
 }
 
-JSValuePtr jsWorkerPrototypeFunctionPostMessage(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionPostMessage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWorker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorker::s_info))
         return throwError(exec, TypeError);
     JSWorker* castedThisObj = static_cast<JSWorker*>(asObject(thisValue));
     Worker* imp = static_cast<Worker*>(castedThisObj->impl());
-    const UString& message = args.at(exec, 0)->toString(exec);
+    const UString& message = args.at(0).toString(exec);
 
     imp->postMessage(message);
     return jsUndefined();
 }
 
-JSValuePtr jsWorkerPrototypeFunctionTerminate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionTerminate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWorker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorker::s_info))
         return throwError(exec, TypeError);
     JSWorker* castedThisObj = static_cast<JSWorker*>(asObject(thisValue));
     Worker* imp = static_cast<Worker*>(castedThisObj->impl());
@@ -180,44 +182,47 @@ JSValuePtr jsWorkerPrototypeFunctionTerminate(ExecState* exec, JSObject*, JSValu
     return jsUndefined();
 }
 
-JSValuePtr jsWorkerPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWorker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorker::s_info))
         return throwError(exec, TypeError);
     JSWorker* castedThisObj = static_cast<JSWorker*>(asObject(thisValue));
     return castedThisObj->addEventListener(exec, args);
 }
 
-JSValuePtr jsWorkerPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWorker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorker::s_info))
         return throwError(exec, TypeError);
     JSWorker* castedThisObj = static_cast<JSWorker*>(asObject(thisValue));
     return castedThisObj->removeEventListener(exec, args);
 }
 
-JSValuePtr jsWorkerPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWorker::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorker::s_info))
         return throwError(exec, TypeError);
     JSWorker* castedThisObj = static_cast<JSWorker*>(asObject(thisValue));
     Worker* imp = static_cast<Worker*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Event* evt = toEvent(args.at(exec, 0));
+    Event* evt = toEvent(args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->dispatchEvent(evt, ec));
+    JSC::JSValue result = jsBoolean(imp->dispatchEvent(evt, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, Worker* object)
+JSC::JSValue toJS(JSC::ExecState* exec, Worker* object)
 {
     return getDOMObjectWrapper<JSWorker>(exec, object);
 }
-Worker* toWorker(JSC::JSValuePtr value)
+Worker* toWorker(JSC::JSValue value)
 {
-    return value->isObject(&JSWorker::s_info) ? static_cast<JSWorker*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSWorker::s_info) ? static_cast<JSWorker*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorker.h b/src/3rdparty/webkit/WebCore/generated/JSWorker.h
index 98e26cf..c1ed4af 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorker.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorker.h
@@ -21,7 +21,6 @@
 #ifndef JSWorker_h
 #define JSWorker_h
 
-
 #if ENABLE(WORKERS)
 
 #include "JSDOMBinding.h"
@@ -37,13 +36,13 @@ class JSWorker : public DOMObject {
 public:
     JSWorker(PassRefPtr<JSC::Structure>, PassRefPtr<Worker>);
     virtual ~JSWorker();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -52,24 +51,25 @@ public:
 
 
     // Custom functions
-    JSC::JSValuePtr addEventListener(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
     Worker* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<Worker> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, Worker*);
-Worker* toWorker(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, Worker*);
+Worker* toWorker(JSC::JSValue);
 
 class JSWorkerPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -78,17 +78,17 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsWorkerPrototypeFunctionPostMessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsWorkerPrototypeFunctionTerminate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsWorkerPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsWorkerPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsWorkerPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionPostMessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionTerminate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsWorkerOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSWorkerOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsWorkerOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSWorkerOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsWorkerOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWorkerOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWorkerOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWorkerOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.cpp b/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.cpp
index f0702ea..cf2e02d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.cpp
@@ -20,42 +20,42 @@
 
 #include "config.h"
 
-
 #if ENABLE(WORKERS)
 
 #include "JSWorkerContext.h"
 
-#include <wtf/GetPtr.h>
-
 #include "Event.h"
 #include "EventListener.h"
 #include "JSEvent.h"
 #include "JSEventListener.h"
 #include "JSMessageEvent.h"
+#include "JSWorkerContext.h"
 #include "JSWorkerLocation.h"
 #include "JSWorkerNavigator.h"
+#include "JSXMLHttpRequest.h"
 #include "WorkerContext.h"
 #include "WorkerLocation.h"
 #include "WorkerNavigator.h"
-
 #include <runtime/Error.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSWorkerContext)
+ASSERT_CLASS_FITS_IN_CELL(JSWorkerContext);
 
 /* Hash table */
 
-static const HashTableValue JSWorkerContextTableValues[7] =
+static const HashTableValue JSWorkerContextTableValues[8] =
 {
     { "self", DontDelete, (intptr_t)jsWorkerContextSelf, (intptr_t)setJSWorkerContextSelf },
-    { "onmessage", DontDelete, (intptr_t)jsWorkerContextOnmessage, (intptr_t)setJSWorkerContextOnmessage },
     { "location", DontDelete, (intptr_t)jsWorkerContextLocation, (intptr_t)setJSWorkerContextLocation },
     { "navigator", DontDelete, (intptr_t)jsWorkerContextNavigator, (intptr_t)setJSWorkerContextNavigator },
+    { "onmessage", DontDelete, (intptr_t)jsWorkerContextOnmessage, (intptr_t)setJSWorkerContextOnmessage },
     { "MessageEvent", DontDelete, (intptr_t)jsWorkerContextMessageEventConstructor, (intptr_t)setJSWorkerContextMessageEventConstructor },
     { "WorkerLocation", DontDelete, (intptr_t)jsWorkerContextWorkerLocationConstructor, (intptr_t)setJSWorkerContextWorkerLocationConstructor },
+    { "XMLHttpRequest", DontDelete, (intptr_t)jsWorkerContextXMLHttpRequestConstructor, (intptr_t)setJSWorkerContextXMLHttpRequestConstructor },
     { 0, 0, 0, 0 }
 };
 
@@ -68,9 +68,15 @@ static const HashTable JSWorkerContextTable =
 
 /* Hash table for prototype */
 
-static const HashTableValue JSWorkerContextPrototypeTableValues[5] =
+static const HashTableValue JSWorkerContextPrototypeTableValues[11] =
 {
+    { "close", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionClose, (intptr_t)0 },
+    { "importScripts", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionImportScripts, (intptr_t)0 },
     { "postMessage", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionPostMessage, (intptr_t)1 },
+    { "setTimeout", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionSetTimeout, (intptr_t)2 },
+    { "clearTimeout", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionClearTimeout, (intptr_t)1 },
+    { "setInterval", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionSetInterval, (intptr_t)2 },
+    { "clearInterval", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionClearInterval, (intptr_t)1 },
     { "addEventListener", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionAddEventListener, (intptr_t)3 },
     { "removeEventListener", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionRemoveEventListener, (intptr_t)3 },
     { "dispatchEvent", DontDelete|Function, (intptr_t)jsWorkerContextPrototypeFunctionDispatchEvent, (intptr_t)1 },
@@ -79,9 +85,9 @@ static const HashTableValue JSWorkerContextPrototypeTableValues[5] =
 
 static const HashTable JSWorkerContextPrototypeTable =
 #if ENABLE(PERFECT_HASH_SIZE)
-    { 7, JSWorkerContextPrototypeTableValues, 0 };
+    { 1023, JSWorkerContextPrototypeTableValues, 0 };
 #else
-    { 8, 7, JSWorkerContextPrototypeTableValues, 0 };
+    { 34, 31, JSWorkerContextPrototypeTableValues, 0 };
 #endif
 
 static const HashTable* getJSWorkerContextPrototypeTable(ExecState* exec)
@@ -113,126 +119,217 @@ JSWorkerContext::JSWorkerContext(PassRefPtr<Structure> structure, PassRefPtr<Wor
 
 bool JSWorkerContext::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    if (customGetOwnPropertySlot(exec, propertyName, slot))
+    if (getOwnPropertySlotDelegate(exec, propertyName, slot))
         return true;
     return getStaticValueSlot<JSWorkerContext, Base>(exec, getJSWorkerContextTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsWorkerContextSelf(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerContextSelf(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
-    return static_cast<JSWorkerContext*>(asObject(slot.slotBase()))->self(exec);
+    UNUSED_PARAM(exec);
+    WorkerContext* imp = static_cast<WorkerContext*>(static_cast<JSWorkerContext*>(asObject(slot.slotBase()))->impl());
+    return toJS(exec, WTF::getPtr(imp->self()));
 }
 
-JSValuePtr jsWorkerContextOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerContextLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerContext* imp = static_cast<WorkerContext*>(static_cast<JSWorkerContext*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onmessage())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
-    }
-    return jsNull();
+    return toJS(exec, WTF::getPtr(imp->location()));
 }
 
-JSValuePtr jsWorkerContextLocation(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerContextNavigator(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerContext* imp = static_cast<WorkerContext*>(static_cast<JSWorkerContext*>(asObject(slot.slotBase()))->impl());
-    return toJS(exec, WTF::getPtr(imp->location()));
+    return toJS(exec, WTF::getPtr(imp->navigator()));
 }
 
-JSValuePtr jsWorkerContextNavigator(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerContextOnmessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerContext* imp = static_cast<WorkerContext*>(static_cast<JSWorkerContext*>(asObject(slot.slotBase()))->impl());
-    return toJS(exec, WTF::getPtr(imp->navigator()));
+    if (EventListener* listener = imp->onmessage()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
+    }
+    return jsNull();
 }
 
-JSValuePtr jsWorkerContextMessageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerContextMessageEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(slot);
     return JSMessageEvent::getConstructor(exec);
 }
 
-JSValuePtr jsWorkerContextWorkerLocationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerContextWorkerLocationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(slot);
     return JSWorkerLocation::getConstructor(exec);
 }
 
-void JSWorkerContext::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+JSValue jsWorkerContextXMLHttpRequestConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
-    lookupPut<JSWorkerContext, Base>(exec, propertyName, value, getJSWorkerContextTable(exec), this, slot);
+    return static_cast<JSWorkerContext*>(asObject(slot.slotBase()))->xmlHttpRequest(exec);
 }
 
-void setJSWorkerContextSelf(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void JSWorkerContext::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    static_cast<JSWorkerContext*>(thisObject)->setSelf(exec, value);
+    lookupPut<JSWorkerContext, Base>(exec, propertyName, value, getJSWorkerContextTable(exec), this, slot);
 }
 
-void setJSWorkerContextOnmessage(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSWorkerContextSelf(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    WorkerContext* imp = static_cast<WorkerContext*>(static_cast<JSWorkerContext*>(thisObject)->impl());
-    JSDOMGlobalObject* globalObject = static_cast<JSWorkerContext*>(thisObject);
-    imp->setOnmessage(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    // Shadowing a built-in object
+    static_cast<JSWorkerContext*>(thisObject)->putDirect(Identifier(exec, "self"), value);
 }
 
-void setJSWorkerContextLocation(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSWorkerContextLocation(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    // Shadowing a built-in object
     static_cast<JSWorkerContext*>(thisObject)->putDirect(Identifier(exec, "location"), value);
 }
 
-void setJSWorkerContextNavigator(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSWorkerContextNavigator(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    // Shadowing a built-in object
     static_cast<JSWorkerContext*>(thisObject)->putDirect(Identifier(exec, "navigator"), value);
 }
 
-void setJSWorkerContextMessageEventConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSWorkerContextOnmessage(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    UNUSED_PARAM(exec);
+    WorkerContext* imp = static_cast<WorkerContext*>(static_cast<JSWorkerContext*>(thisObject)->impl());
+    JSDOMGlobalObject* globalObject = static_cast<JSWorkerContext*>(thisObject);
+    imp->setOnmessage(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSWorkerContextMessageEventConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     // Shadowing a built-in constructor
     static_cast<JSWorkerContext*>(thisObject)->putDirect(Identifier(exec, "MessageEvent"), value);
 }
 
-void setJSWorkerContextWorkerLocationConstructor(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSWorkerContextWorkerLocationConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
     // Shadowing a built-in constructor
     static_cast<JSWorkerContext*>(thisObject)->putDirect(Identifier(exec, "WorkerLocation"), value);
 }
 
-JSValuePtr jsWorkerContextPrototypeFunctionPostMessage(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+void setJSWorkerContextXMLHttpRequestConstructor(ExecState* exec, JSObject* thisObject, JSValue value)
 {
-    if (!thisValue->isObject(&JSWorkerContext::s_info))
+    // Shadowing a built-in constructor
+    static_cast<JSWorkerContext*>(thisObject)->putDirect(Identifier(exec, "XMLHttpRequest"), value);
+}
+
+JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionClose(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorkerContext::s_info))
         return throwError(exec, TypeError);
     JSWorkerContext* castedThisObj = static_cast<JSWorkerContext*>(asObject(thisValue));
     WorkerContext* imp = static_cast<WorkerContext*>(castedThisObj->impl());
-    const UString& message = args.at(exec, 0)->toString(exec);
+
+    imp->close();
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionImportScripts(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorkerContext::s_info))
+        return throwError(exec, TypeError);
+    JSWorkerContext* castedThisObj = static_cast<JSWorkerContext*>(asObject(thisValue));
+    return castedThisObj->importScripts(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionPostMessage(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorkerContext::s_info))
+        return throwError(exec, TypeError);
+    JSWorkerContext* castedThisObj = static_cast<JSWorkerContext*>(asObject(thisValue));
+    WorkerContext* imp = static_cast<WorkerContext*>(castedThisObj->impl());
+    const UString& message = args.at(0).toString(exec);
 
     imp->postMessage(message);
     return jsUndefined();
 }
 
-JSValuePtr jsWorkerContextPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionSetTimeout(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorkerContext::s_info))
+        return throwError(exec, TypeError);
+    JSWorkerContext* castedThisObj = static_cast<JSWorkerContext*>(asObject(thisValue));
+    return castedThisObj->setTimeout(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionClearTimeout(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorkerContext::s_info))
+        return throwError(exec, TypeError);
+    JSWorkerContext* castedThisObj = static_cast<JSWorkerContext*>(asObject(thisValue));
+    WorkerContext* imp = static_cast<WorkerContext*>(castedThisObj->impl());
+    int handle = args.at(0).toInt32(exec);
+
+    imp->clearTimeout(handle);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionSetInterval(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorkerContext::s_info))
+        return throwError(exec, TypeError);
+    JSWorkerContext* castedThisObj = static_cast<JSWorkerContext*>(asObject(thisValue));
+    return castedThisObj->setInterval(exec, args);
+}
+
+JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionClearInterval(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
+{
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorkerContext::s_info))
+        return throwError(exec, TypeError);
+    JSWorkerContext* castedThisObj = static_cast<JSWorkerContext*>(asObject(thisValue));
+    WorkerContext* imp = static_cast<WorkerContext*>(castedThisObj->impl());
+    int handle = args.at(0).toInt32(exec);
+
+    imp->clearInterval(handle);
+    return jsUndefined();
+}
+
+JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWorkerContext::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorkerContext::s_info))
         return throwError(exec, TypeError);
     JSWorkerContext* castedThisObj = static_cast<JSWorkerContext*>(asObject(thisValue));
     return castedThisObj->addEventListener(exec, args);
 }
 
-JSValuePtr jsWorkerContextPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWorkerContext::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorkerContext::s_info))
         return throwError(exec, TypeError);
     JSWorkerContext* castedThisObj = static_cast<JSWorkerContext*>(asObject(thisValue));
     return castedThisObj->removeEventListener(exec, args);
 }
 
-JSValuePtr jsWorkerContextPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWorkerContext::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorkerContext::s_info))
         return throwError(exec, TypeError);
     JSWorkerContext* castedThisObj = static_cast<JSWorkerContext*>(asObject(thisValue));
     WorkerContext* imp = static_cast<WorkerContext*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Event* evt = toEvent(args.at(exec, 0));
+    Event* evt = toEvent(args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->dispatchEvent(evt, ec));
+    JSC::JSValue result = jsBoolean(imp->dispatchEvent(evt, ec));
     setDOMException(exec, ec);
     return result;
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h b/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h
index fe04c18..c522808 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerContext.h
@@ -21,7 +21,6 @@
 #ifndef JSWorkerContext_h
 #define JSWorkerContext_h
 
-
 #if ENABLE(WORKERS)
 
 #include "JSWorkerContextBase.h"
@@ -35,12 +34,12 @@ class JSWorkerContext : public JSWorkerContextBase {
 public:
     JSWorkerContext(PassRefPtr<JSC::Structure>, PassRefPtr<WorkerContext>);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    bool customGetOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    bool getOwnPropertySlotDelegate(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,22 +48,25 @@ public:
 
 
     // Custom attributes
-    JSC::JSValuePtr self(JSC::ExecState*) const;
-    void setSelf(JSC::ExecState*, JSC::JSValuePtr);
+    JSC::JSValue xmlHttpRequest(JSC::ExecState*) const;
 
     // Custom functions
-    JSC::JSValuePtr addEventListener(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue importScripts(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setTimeout(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setInterval(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
 };
 
 
 class JSWorkerContextPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
     void* operator new(size_t, JSC::JSGlobalData*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -73,24 +75,32 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsWorkerContextPrototypeFunctionPostMessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsWorkerContextPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsWorkerContextPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsWorkerContextPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionClose(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionImportScripts(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionPostMessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionSetTimeout(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionClearTimeout(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionSetInterval(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionClearInterval(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerContextPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsWorkerContextSelf(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSWorkerContextSelf(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsWorkerContextOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSWorkerContextOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsWorkerContextLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSWorkerContextLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsWorkerContextNavigator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSWorkerContextNavigator(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsWorkerContextMessageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSWorkerContextMessageEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsWorkerContextWorkerLocationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSWorkerContextWorkerLocationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
+JSC::JSValue jsWorkerContextSelf(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWorkerContextSelf(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWorkerContextLocation(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWorkerContextLocation(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWorkerContextNavigator(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWorkerContextNavigator(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWorkerContextOnmessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWorkerContextOnmessage(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWorkerContextMessageEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWorkerContextMessageEventConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWorkerContextWorkerLocationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWorkerContextWorkerLocationConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsWorkerContextXMLHttpRequestConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSWorkerContextXMLHttpRequestConstructor(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerContextBase.lut.h b/src/3rdparty/webkit/WebCore/generated/JSWorkerContextBase.lut.h
index 6f02e02..e69de29 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerContextBase.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerContextBase.lut.h
@@ -1,18 +0,0 @@
-// Automatically generated from ../bindings/js/JSWorkerContextBase.cpp using WebCore/../JavaScriptCore/create_hash_table. DO NOT EDIT!
-
-namespace WebCore {
-
-using namespace JSC;
-
-static const struct HashTableValue JSWorkerContextBaseTableValues[1] = {
-   { 0, 0, 0, 0 }
-};
-
-extern const struct HashTable JSWorkerContextBaseTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 0, JSWorkerContextBaseTableValues, 0 };
-#else
-    { 1, 0, JSWorkerContextBaseTableValues, 0 };
-#endif
-
-} // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp
index 8439657..7960f9a 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.cpp
@@ -20,25 +20,21 @@
 
 #include "config.h"
 
-
 #if ENABLE(WORKERS)
 
 #include "JSWorkerLocation.h"
 
-#include <wtf/GetPtr.h>
-
 #include "KURL.h"
 #include "WorkerLocation.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSWorkerLocation)
+ASSERT_CLASS_FITS_IN_CELL(JSWorkerLocation);
 
 /* Hash table */
 
@@ -82,13 +78,13 @@ public:
     JSWorkerLocationConstructor(ExecState* exec)
         : DOMObject(JSWorkerLocationConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSWorkerLocationPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSWorkerLocationPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -122,9 +118,9 @@ static const HashTable* getJSWorkerLocationPrototypeTable(ExecState* exec)
 }
 const ClassInfo JSWorkerLocationPrototype::s_info = { "WorkerLocationPrototype", 0, 0, getJSWorkerLocationPrototypeTable };
 
-JSObject* JSWorkerLocationPrototype::self(ExecState* exec)
+JSObject* JSWorkerLocationPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSWorkerLocation>(exec);
+    return getDOMPrototype<JSWorkerLocation>(exec, globalObject);
 }
 
 bool JSWorkerLocationPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -147,12 +143,11 @@ JSWorkerLocation::JSWorkerLocation(PassRefPtr<Structure> structure, PassRefPtr<W
 JSWorkerLocation::~JSWorkerLocation()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSWorkerLocation::createPrototype(ExecState* exec)
+JSObject* JSWorkerLocation::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSWorkerLocationPrototype(JSWorkerLocationPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSWorkerLocationPrototype(JSWorkerLocationPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSWorkerLocation::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -160,82 +155,91 @@ bool JSWorkerLocation::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSWorkerLocation, Base>(exec, getJSWorkerLocationTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsWorkerLocationHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationHref(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(static_cast<JSWorkerLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->href());
 }
 
-JSValuePtr jsWorkerLocationProtocol(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationProtocol(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(static_cast<JSWorkerLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->protocol());
 }
 
-JSValuePtr jsWorkerLocationHost(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationHost(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(static_cast<JSWorkerLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->host());
 }
 
-JSValuePtr jsWorkerLocationHostname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationHostname(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(static_cast<JSWorkerLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->hostname());
 }
 
-JSValuePtr jsWorkerLocationPort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationPort(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(static_cast<JSWorkerLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->port());
 }
 
-JSValuePtr jsWorkerLocationPathname(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationPathname(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(static_cast<JSWorkerLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->pathname());
 }
 
-JSValuePtr jsWorkerLocationSearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationSearch(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(static_cast<JSWorkerLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->search());
 }
 
-JSValuePtr jsWorkerLocationHash(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationHash(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerLocation* imp = static_cast<WorkerLocation*>(static_cast<JSWorkerLocation*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->hash());
 }
 
-JSValuePtr jsWorkerLocationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerLocationConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSWorkerLocation*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSWorkerLocation::getConstructor(ExecState* exec)
+JSValue JSWorkerLocation::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSWorkerLocationConstructor>(exec);
 }
 
-JSValuePtr jsWorkerLocationPrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsWorkerLocationPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSWorkerLocation::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSWorkerLocation::s_info))
         return throwError(exec, TypeError);
     JSWorkerLocation* castedThisObj = static_cast<JSWorkerLocation*>(asObject(thisValue));
     WorkerLocation* imp = static_cast<WorkerLocation*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->toString());
+    JSC::JSValue result = jsString(exec, imp->toString());
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, WorkerLocation* object)
+JSC::JSValue toJS(JSC::ExecState* exec, WorkerLocation* object)
 {
     return getDOMObjectWrapper<JSWorkerLocation>(exec, object);
 }
-WorkerLocation* toWorkerLocation(JSC::JSValuePtr value)
+WorkerLocation* toWorkerLocation(JSC::JSValue value)
 {
-    return value->isObject(&JSWorkerLocation::s_info) ? static_cast<JSWorkerLocation*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSWorkerLocation::s_info) ? static_cast<JSWorkerLocation*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h
index 161b8a9..cab657d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerLocation.h
@@ -21,7 +21,6 @@
 #ifndef JSWorkerLocation_h
 #define JSWorkerLocation_h
 
-
 #if ENABLE(WORKERS)
 
 #include "JSDOMBinding.h"
@@ -37,33 +36,34 @@ class JSWorkerLocation : public DOMObject {
 public:
     JSWorkerLocation(PassRefPtr<JSC::Structure>, PassRefPtr<WorkerLocation>);
     virtual ~JSWorkerLocation();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     WorkerLocation* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<WorkerLocation> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, WorkerLocation*);
-WorkerLocation* toWorkerLocation(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, WorkerLocation*);
+WorkerLocation* toWorkerLocation(JSC::JSValue);
 
 class JSWorkerLocationPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -72,18 +72,18 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsWorkerLocationPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsWorkerLocationPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsWorkerLocationHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerLocationProtocol(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerLocationHost(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerLocationHostname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerLocationPort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerLocationPathname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerLocationSearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerLocationHash(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerLocationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerLocationHref(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerLocationProtocol(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerLocationHost(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerLocationHostname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerLocationPort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerLocationPathname(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerLocationSearch(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerLocationHash(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerLocationConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.cpp b/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.cpp
index 25a30af..457f163 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.cpp
@@ -20,23 +20,20 @@
 
 #include "config.h"
 
-
 #if ENABLE(WORKERS)
 
 #include "JSWorkerNavigator.h"
 
-#include <wtf/GetPtr.h>
-
 #include "KURL.h"
 #include "WorkerNavigator.h"
-
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSWorkerNavigator)
+ASSERT_CLASS_FITS_IN_CELL(JSWorkerNavigator);
 
 /* Hash table */
 
@@ -77,9 +74,9 @@ static const HashTable* getJSWorkerNavigatorPrototypeTable(ExecState* exec)
 }
 const ClassInfo JSWorkerNavigatorPrototype::s_info = { "WorkerNavigatorPrototype", 0, 0, getJSWorkerNavigatorPrototypeTable };
 
-JSObject* JSWorkerNavigatorPrototype::self(ExecState* exec)
+JSObject* JSWorkerNavigatorPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSWorkerNavigator>(exec);
+    return getDOMPrototype<JSWorkerNavigator>(exec, globalObject);
 }
 
 static const HashTable* getJSWorkerNavigatorTable(ExecState* exec)
@@ -97,12 +94,11 @@ JSWorkerNavigator::JSWorkerNavigator(PassRefPtr<Structure> structure, PassRefPtr
 JSWorkerNavigator::~JSWorkerNavigator()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSWorkerNavigator::createPrototype(ExecState* exec)
+JSObject* JSWorkerNavigator::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSWorkerNavigatorPrototype(JSWorkerNavigatorPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSWorkerNavigatorPrototype(JSWorkerNavigatorPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSWorkerNavigator::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -110,43 +106,48 @@ bool JSWorkerNavigator::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSWorkerNavigator, Base>(exec, getJSWorkerNavigatorTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsWorkerNavigatorAppName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerNavigatorAppName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerNavigator* imp = static_cast<WorkerNavigator*>(static_cast<JSWorkerNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->appName());
 }
 
-JSValuePtr jsWorkerNavigatorAppVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerNavigatorAppVersion(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerNavigator* imp = static_cast<WorkerNavigator*>(static_cast<JSWorkerNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->appVersion());
 }
 
-JSValuePtr jsWorkerNavigatorPlatform(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerNavigatorPlatform(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerNavigator* imp = static_cast<WorkerNavigator*>(static_cast<JSWorkerNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->platform());
 }
 
-JSValuePtr jsWorkerNavigatorUserAgent(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerNavigatorUserAgent(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerNavigator* imp = static_cast<WorkerNavigator*>(static_cast<JSWorkerNavigator*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->userAgent());
 }
 
-JSValuePtr jsWorkerNavigatorOnLine(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsWorkerNavigatorOnLine(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     WorkerNavigator* imp = static_cast<WorkerNavigator*>(static_cast<JSWorkerNavigator*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->onLine());
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, WorkerNavigator* object)
+JSC::JSValue toJS(JSC::ExecState* exec, WorkerNavigator* object)
 {
     return getDOMObjectWrapper<JSWorkerNavigator>(exec, object);
 }
-WorkerNavigator* toWorkerNavigator(JSC::JSValuePtr value)
+WorkerNavigator* toWorkerNavigator(JSC::JSValue value)
 {
-    return value->isObject(&JSWorkerNavigator::s_info) ? static_cast<JSWorkerNavigator*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSWorkerNavigator::s_info) ? static_cast<JSWorkerNavigator*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h b/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h
index b280458..f07606c 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSWorkerNavigator.h
@@ -21,7 +21,6 @@
 #ifndef JSWorkerNavigator_h
 #define JSWorkerNavigator_h
 
-
 #if ENABLE(WORKERS)
 
 #include "JSDOMBinding.h"
@@ -37,12 +36,12 @@ class JSWorkerNavigator : public DOMObject {
 public:
     JSWorkerNavigator(PassRefPtr<JSC::Structure>, PassRefPtr<WorkerNavigator>);
     virtual ~JSWorkerNavigator();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -53,12 +52,13 @@ private:
     RefPtr<WorkerNavigator> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, WorkerNavigator*);
-WorkerNavigator* toWorkerNavigator(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, WorkerNavigator*);
+WorkerNavigator* toWorkerNavigator(JSC::JSValue);
 
 class JSWorkerNavigatorPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSWorkerNavigatorPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -66,11 +66,11 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsWorkerNavigatorAppName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerNavigatorAppVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerNavigatorPlatform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerNavigatorUserAgent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsWorkerNavigatorOnLine(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerNavigatorAppName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerNavigatorAppVersion(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerNavigatorPlatform(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerNavigatorUserAgent(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsWorkerNavigatorOnLine(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.cpp
index a326915..1677954 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.cpp
@@ -19,11 +19,8 @@
 */
 
 #include "config.h"
-
 #include "JSXMLHttpRequest.h"
 
-#include <wtf/GetPtr.h>
-
 #include "Document.h"
 #include "Event.h"
 #include "EventListener.h"
@@ -36,20 +33,20 @@
 #include "KURL.h"
 #include "XMLHttpRequest.h"
 #include "XMLHttpRequestUpload.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequest)
+ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequest);
 
 /* Hash table */
 
-static const HashTableValue JSXMLHttpRequestTableValues[13] =
+static const HashTableValue JSXMLHttpRequestTableValues[14] =
 {
     { "onabort", DontDelete, (intptr_t)jsXMLHttpRequestOnabort, (intptr_t)setJSXMLHttpRequestOnabort },
     { "onerror", DontDelete, (intptr_t)jsXMLHttpRequestOnerror, (intptr_t)setJSXMLHttpRequestOnerror },
@@ -58,6 +55,7 @@ static const HashTableValue JSXMLHttpRequestTableValues[13] =
     { "onprogress", DontDelete, (intptr_t)jsXMLHttpRequestOnprogress, (intptr_t)setJSXMLHttpRequestOnprogress },
     { "onreadystatechange", DontDelete, (intptr_t)jsXMLHttpRequestOnreadystatechange, (intptr_t)setJSXMLHttpRequestOnreadystatechange },
     { "readyState", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestReadyState, (intptr_t)0 },
+    { "withCredentials", DontDelete, (intptr_t)jsXMLHttpRequestWithCredentials, (intptr_t)setJSXMLHttpRequestWithCredentials },
     { "upload", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestUpload, (intptr_t)0 },
     { "responseText", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestResponseText, (intptr_t)0 },
     { "responseXML", DontDelete|ReadOnly, (intptr_t)jsXMLHttpRequestResponseXML, (intptr_t)0 },
@@ -70,7 +68,7 @@ static const HashTable JSXMLHttpRequestTable =
 #if ENABLE(PERFECT_HASH_SIZE)
     { 127, JSXMLHttpRequestTableValues, 0 };
 #else
-    { 34, 31, JSXMLHttpRequestTableValues, 0 };
+    { 35, 31, JSXMLHttpRequestTableValues, 0 };
 #endif
 
 /* Hash table for prototype */
@@ -102,19 +100,27 @@ static const HashTable JSXMLHttpRequestPrototypeTable =
     { 37, 31, JSXMLHttpRequestPrototypeTableValues, 0 };
 #endif
 
-const ClassInfo JSXMLHttpRequestPrototype::s_info = { "XMLHttpRequestPrototype", 0, &JSXMLHttpRequestPrototypeTable, 0 };
+static const HashTable* getJSXMLHttpRequestPrototypeTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSXMLHttpRequestPrototypeTable);
+}
+const ClassInfo JSXMLHttpRequestPrototype::s_info = { "XMLHttpRequestPrototype", 0, 0, getJSXMLHttpRequestPrototypeTable };
 
-JSObject* JSXMLHttpRequestPrototype::self(ExecState* exec)
+JSObject* JSXMLHttpRequestPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSXMLHttpRequest>(exec);
+    return getDOMPrototype<JSXMLHttpRequest>(exec, globalObject);
 }
 
 bool JSXMLHttpRequestPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    return getStaticPropertySlot<JSXMLHttpRequestPrototype, JSObject>(exec, &JSXMLHttpRequestPrototypeTable, this, propertyName, slot);
+    return getStaticPropertySlot<JSXMLHttpRequestPrototype, JSObject>(exec, getJSXMLHttpRequestPrototypeTable(exec), this, propertyName, slot);
 }
 
-const ClassInfo JSXMLHttpRequest::s_info = { "XMLHttpRequest", 0, &JSXMLHttpRequestTable, 0 };
+static const HashTable* getJSXMLHttpRequestTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSXMLHttpRequestTable);
+}
+const ClassInfo JSXMLHttpRequest::s_info = { "XMLHttpRequest", 0, 0, getJSXMLHttpRequestTable };
 
 JSXMLHttpRequest::JSXMLHttpRequest(PassRefPtr<Structure> structure, PassRefPtr<XMLHttpRequest> impl)
     : DOMObject(structure)
@@ -125,206 +131,239 @@ JSXMLHttpRequest::JSXMLHttpRequest(PassRefPtr<Structure> structure, PassRefPtr<X
 JSXMLHttpRequest::~JSXMLHttpRequest()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSXMLHttpRequest::createPrototype(ExecState* exec)
+JSObject* JSXMLHttpRequest::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSXMLHttpRequestPrototype(JSXMLHttpRequestPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSXMLHttpRequestPrototype(JSXMLHttpRequestPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSXMLHttpRequest::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    return getStaticValueSlot<JSXMLHttpRequest, Base>(exec, &JSXMLHttpRequestTable, this, propertyName, slot);
+    return getStaticValueSlot<JSXMLHttpRequest, Base>(exec, getJSXMLHttpRequestTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsXMLHttpRequestOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onabort())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onabort()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsXMLHttpRequestOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onerror())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onerror()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsXMLHttpRequestOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onload())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onload()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsXMLHttpRequestOnloadstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestOnloadstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onloadstart())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onloadstart()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsXMLHttpRequestOnprogress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestOnprogress(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onprogress())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onprogress()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsXMLHttpRequestOnreadystatechange(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestOnreadystatechange(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onreadystatechange())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onreadystatechange()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsXMLHttpRequestReadyState(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestReadyState(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->readyState());
 }
 
-JSValuePtr jsXMLHttpRequestUpload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestWithCredentials(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
+    XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
+    return jsBoolean(imp->withCredentials());
+}
+
+JSValue jsXMLHttpRequestUpload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+{
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->upload()));
 }
 
-JSValuePtr jsXMLHttpRequestResponseText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestResponseText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->responseText(exec);
 }
 
-JSValuePtr jsXMLHttpRequestResponseXML(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestResponseXML(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
     return toJS(exec, WTF::getPtr(imp->responseXML()));
 }
 
-JSValuePtr jsXMLHttpRequestStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestStatus(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = jsNumber(exec, imp->status(ec));
+    JSC::JSValue result = jsNumber(exec, imp->status(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsXMLHttpRequestStatusText(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestStatusText(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = jsString(exec, imp->statusText(ec));
+    JSC::JSValue result = jsString(exec, imp->statusText(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-void JSXMLHttpRequest::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSXMLHttpRequest::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    lookupPut<JSXMLHttpRequest, Base>(exec, propertyName, value, &JSXMLHttpRequestTable, this, slot);
+    lookupPut<JSXMLHttpRequest, Base>(exec, propertyName, value, getJSXMLHttpRequestTable(exec), this, slot);
 }
 
-void setJSXMLHttpRequestOnabort(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSXMLHttpRequestOnabort(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnabort(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnabort(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSXMLHttpRequestOnerror(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSXMLHttpRequestOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnerror(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSXMLHttpRequestOnload(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSXMLHttpRequestOnload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnload(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnload(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSXMLHttpRequestOnloadstart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSXMLHttpRequestOnloadstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnloadstart(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnloadstart(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSXMLHttpRequestOnprogress(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSXMLHttpRequestOnprogress(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnprogress(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnprogress(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSXMLHttpRequestOnreadystatechange(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSXMLHttpRequestOnreadystatechange(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnreadystatechange(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnreadystatechange(globalObject->createJSAttributeEventListener(value));
+}
+
+void setJSXMLHttpRequestWithCredentials(ExecState* exec, JSObject* thisObject, JSValue value)
+{
+    XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(static_cast<JSXMLHttpRequest*>(thisObject)->impl());
+    ExceptionCode ec = 0;
+    imp->setWithCredentials(value.toBoolean(exec), ec);
+    setDOMException(exec, ec);
 }
 
-JSValuePtr jsXMLHttpRequestPrototypeFunctionOpen(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionOpen(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequest::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     return castedThisObj->open(exec, args);
 }
 
-JSValuePtr jsXMLHttpRequestPrototypeFunctionSetRequestHeader(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionSetRequestHeader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequest::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     return castedThisObj->setRequestHeader(exec, args);
 }
 
-JSValuePtr jsXMLHttpRequestPrototypeFunctionSend(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionSend(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequest::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     return castedThisObj->send(exec, args);
 }
 
-JSValuePtr jsXMLHttpRequestPrototypeFunctionAbort(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionAbort(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequest::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(castedThisObj->impl());
@@ -333,101 +372,107 @@ JSValuePtr jsXMLHttpRequestPrototypeFunctionAbort(ExecState* exec, JSObject*, JS
     return jsUndefined();
 }
 
-JSValuePtr jsXMLHttpRequestPrototypeFunctionGetAllResponseHeaders(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionGetAllResponseHeaders(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequest::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = jsStringOrUndefined(exec, imp->getAllResponseHeaders(ec));
+    JSC::JSValue result = jsStringOrUndefined(exec, imp->getAllResponseHeaders(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsXMLHttpRequestPrototypeFunctionGetResponseHeader(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionGetResponseHeader(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequest::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     return castedThisObj->getResponseHeader(exec, args);
 }
 
-JSValuePtr jsXMLHttpRequestPrototypeFunctionOverrideMimeType(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionOverrideMimeType(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequest::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     return castedThisObj->overrideMimeType(exec, args);
 }
 
-JSValuePtr jsXMLHttpRequestPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequest::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     return castedThisObj->addEventListener(exec, args);
 }
 
-JSValuePtr jsXMLHttpRequestPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequest::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     return castedThisObj->removeEventListener(exec, args);
 }
 
-JSValuePtr jsXMLHttpRequestPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequest::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequest::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequest* castedThisObj = static_cast<JSXMLHttpRequest*>(asObject(thisValue));
     XMLHttpRequest* imp = static_cast<XMLHttpRequest*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Event* evt = toEvent(args.at(exec, 0));
+    Event* evt = toEvent(args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->dispatchEvent(evt, ec));
+    JSC::JSValue result = jsBoolean(imp->dispatchEvent(evt, ec));
     setDOMException(exec, ec);
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsXMLHttpRequestUNSENT(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXMLHttpRequestUNSENT(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsXMLHttpRequestOPENED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXMLHttpRequestOPENED(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsXMLHttpRequestHEADERS_RECEIVED(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXMLHttpRequestHEADERS_RECEIVED(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsXMLHttpRequestLOADING(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXMLHttpRequestLOADING(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsXMLHttpRequestDONE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXMLHttpRequestDONE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, XMLHttpRequest* object)
+JSC::JSValue toJS(JSC::ExecState* exec, XMLHttpRequest* object)
 {
     return getDOMObjectWrapper<JSXMLHttpRequest>(exec, object);
 }
-XMLHttpRequest* toXMLHttpRequest(JSC::JSValuePtr value)
+XMLHttpRequest* toXMLHttpRequest(JSC::JSValue value)
 {
-    return value->isObject(&JSXMLHttpRequest::s_info) ? static_cast<JSXMLHttpRequest*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSXMLHttpRequest::s_info) ? static_cast<JSXMLHttpRequest*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h
index 29be622..9529b0d 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequest.h
@@ -34,13 +34,13 @@ class JSXMLHttpRequest : public DOMObject {
 public:
     JSXMLHttpRequest(PassRefPtr<JSC::Structure>, PassRefPtr<XMLHttpRequest>);
     virtual ~JSXMLHttpRequest();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -49,32 +49,33 @@ public:
 
 
     // Custom attributes
-    JSC::JSValuePtr responseText(JSC::ExecState*) const;
+    JSC::JSValue responseText(JSC::ExecState*) const;
 
     // Custom functions
-    JSC::JSValuePtr open(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setRequestHeader(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr send(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr getResponseHeader(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr overrideMimeType(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr addEventListener(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue open(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue setRequestHeader(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue send(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue getResponseHeader(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue overrideMimeType(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
     XMLHttpRequest* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<XMLHttpRequest> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, XMLHttpRequest*);
-XMLHttpRequest* toXMLHttpRequest(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, XMLHttpRequest*);
+XMLHttpRequest* toXMLHttpRequest(JSC::JSValue);
 
 class JSXMLHttpRequestPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -83,43 +84,45 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsXMLHttpRequestPrototypeFunctionOpen(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXMLHttpRequestPrototypeFunctionSetRequestHeader(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXMLHttpRequestPrototypeFunctionSend(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXMLHttpRequestPrototypeFunctionAbort(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXMLHttpRequestPrototypeFunctionGetAllResponseHeaders(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXMLHttpRequestPrototypeFunctionGetResponseHeader(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXMLHttpRequestPrototypeFunctionOverrideMimeType(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXMLHttpRequestPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXMLHttpRequestPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXMLHttpRequestPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionOpen(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionSetRequestHeader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionSend(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionAbort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionGetAllResponseHeaders(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionGetResponseHeader(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionOverrideMimeType(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsXMLHttpRequestOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSXMLHttpRequestOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsXMLHttpRequestOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSXMLHttpRequestOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsXMLHttpRequestOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSXMLHttpRequestOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsXMLHttpRequestOnloadstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSXMLHttpRequestOnloadstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsXMLHttpRequestOnprogress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSXMLHttpRequestOnprogress(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsXMLHttpRequestOnreadystatechange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSXMLHttpRequestOnreadystatechange(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsXMLHttpRequestReadyState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestUpload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestResponseText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestResponseXML(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestStatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestStatusText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestOnloadstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestOnloadstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestOnprogress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestOnprogress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestOnreadystatechange(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestOnreadystatechange(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestReadyState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestWithCredentials(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestWithCredentials(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestUpload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestResponseText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestResponseXML(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestStatus(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestStatusText(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsXMLHttpRequestUNSENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestOPENED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestHEADERS_RECEIVED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestLOADING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestDONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestUNSENT(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestOPENED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestHEADERS_RECEIVED(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestLOADING(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestDONE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp
index 8a669cd..34a5444 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.cpp
@@ -19,23 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSXMLHttpRequestException.h"
 
-#include <wtf/GetPtr.h>
-
 #include "KURL.h"
 #include "XMLHttpRequestException.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequestException)
+ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequestException);
 
 /* Hash table */
 
@@ -76,13 +73,13 @@ public:
     JSXMLHttpRequestExceptionConstructor(ExecState* exec)
         : DOMObject(JSXMLHttpRequestExceptionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSXMLHttpRequestExceptionPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSXMLHttpRequestExceptionPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -112,19 +109,27 @@ static const HashTable JSXMLHttpRequestExceptionPrototypeTable =
     { 8, 7, JSXMLHttpRequestExceptionPrototypeTableValues, 0 };
 #endif
 
-const ClassInfo JSXMLHttpRequestExceptionPrototype::s_info = { "XMLHttpRequestExceptionPrototype", 0, &JSXMLHttpRequestExceptionPrototypeTable, 0 };
+static const HashTable* getJSXMLHttpRequestExceptionPrototypeTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSXMLHttpRequestExceptionPrototypeTable);
+}
+const ClassInfo JSXMLHttpRequestExceptionPrototype::s_info = { "XMLHttpRequestExceptionPrototype", 0, 0, getJSXMLHttpRequestExceptionPrototypeTable };
 
-JSObject* JSXMLHttpRequestExceptionPrototype::self(ExecState* exec)
+JSObject* JSXMLHttpRequestExceptionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSXMLHttpRequestException>(exec);
+    return getDOMPrototype<JSXMLHttpRequestException>(exec, globalObject);
 }
 
 bool JSXMLHttpRequestExceptionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    return getStaticPropertySlot<JSXMLHttpRequestExceptionPrototype, JSObject>(exec, &JSXMLHttpRequestExceptionPrototypeTable, this, propertyName, slot);
+    return getStaticPropertySlot<JSXMLHttpRequestExceptionPrototype, JSObject>(exec, getJSXMLHttpRequestExceptionPrototypeTable(exec), this, propertyName, slot);
 }
 
-const ClassInfo JSXMLHttpRequestException::s_info = { "XMLHttpRequestException", 0, &JSXMLHttpRequestExceptionTable, 0 };
+static const HashTable* getJSXMLHttpRequestExceptionTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSXMLHttpRequestExceptionTable);
+}
+const ClassInfo JSXMLHttpRequestException::s_info = { "XMLHttpRequestException", 0, 0, getJSXMLHttpRequestExceptionTable };
 
 JSXMLHttpRequestException::JSXMLHttpRequestException(PassRefPtr<Structure> structure, PassRefPtr<XMLHttpRequestException> impl)
     : DOMObject(structure)
@@ -135,77 +140,80 @@ JSXMLHttpRequestException::JSXMLHttpRequestException(PassRefPtr<Structure> struc
 JSXMLHttpRequestException::~JSXMLHttpRequestException()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSXMLHttpRequestException::createPrototype(ExecState* exec)
+JSObject* JSXMLHttpRequestException::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSXMLHttpRequestExceptionPrototype(JSXMLHttpRequestExceptionPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSXMLHttpRequestExceptionPrototype(JSXMLHttpRequestExceptionPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSXMLHttpRequestException::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    return getStaticValueSlot<JSXMLHttpRequestException, Base>(exec, &JSXMLHttpRequestExceptionTable, this, propertyName, slot);
+    return getStaticValueSlot<JSXMLHttpRequestException, Base>(exec, getJSXMLHttpRequestExceptionTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsXMLHttpRequestExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestException* imp = static_cast<XMLHttpRequestException*>(static_cast<JSXMLHttpRequestException*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->code());
 }
 
-JSValuePtr jsXMLHttpRequestExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestException* imp = static_cast<XMLHttpRequestException*>(static_cast<JSXMLHttpRequestException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsXMLHttpRequestExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestException* imp = static_cast<XMLHttpRequestException*>(static_cast<JSXMLHttpRequestException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->message());
 }
 
-JSValuePtr jsXMLHttpRequestExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSXMLHttpRequestException*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSXMLHttpRequestException::getConstructor(ExecState* exec)
+JSValue JSXMLHttpRequestException::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSXMLHttpRequestExceptionConstructor>(exec);
 }
 
-JSValuePtr jsXMLHttpRequestExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequestException::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequestException::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequestException* castedThisObj = static_cast<JSXMLHttpRequestException*>(asObject(thisValue));
     XMLHttpRequestException* imp = static_cast<XMLHttpRequestException*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->toString());
+    JSC::JSValue result = jsString(exec, imp->toString());
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsXMLHttpRequestExceptionNETWORK_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXMLHttpRequestExceptionNETWORK_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(101));
 }
 
-JSValuePtr jsXMLHttpRequestExceptionABORT_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXMLHttpRequestExceptionABORT_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(102));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, XMLHttpRequestException* object)
+JSC::JSValue toJS(JSC::ExecState* exec, XMLHttpRequestException* object)
 {
     return getDOMObjectWrapper<JSXMLHttpRequestException>(exec, object);
 }
-XMLHttpRequestException* toXMLHttpRequestException(JSC::JSValuePtr value)
+XMLHttpRequestException* toXMLHttpRequestException(JSC::JSValue value)
 {
-    return value->isObject(&JSXMLHttpRequestException::s_info) ? static_cast<JSXMLHttpRequestException*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSXMLHttpRequestException::s_info) ? static_cast<JSXMLHttpRequestException*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h
index 5c4443e..52f26bf 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestException.h
@@ -34,33 +34,34 @@ class JSXMLHttpRequestException : public DOMObject {
 public:
     JSXMLHttpRequestException(PassRefPtr<JSC::Structure>, PassRefPtr<XMLHttpRequestException>);
     virtual ~JSXMLHttpRequestException();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     XMLHttpRequestException* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<XMLHttpRequestException> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, XMLHttpRequestException*);
-XMLHttpRequestException* toXMLHttpRequestException(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, XMLHttpRequestException*);
+XMLHttpRequestException* toXMLHttpRequestException(JSC::JSValue);
 
 class JSXMLHttpRequestExceptionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,17 +70,17 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsXMLHttpRequestExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsXMLHttpRequestExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsXMLHttpRequestExceptionNETWORK_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestExceptionABORT_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestExceptionNETWORK_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestExceptionABORT_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp
index 2df3a90..4882570 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.cpp
@@ -19,20 +19,17 @@
 */
 
 #include "config.h"
-
 #include "JSXMLHttpRequestProgressEvent.h"
 
-#include <wtf/GetPtr.h>
-
 #include "XMLHttpRequestProgressEvent.h"
-
 #include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequestProgressEvent)
+ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequestProgressEvent);
 
 /* Hash table */
 
@@ -70,13 +67,13 @@ public:
     JSXMLHttpRequestProgressEventConstructor(ExecState* exec)
         : DOMObject(JSXMLHttpRequestProgressEventConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSXMLHttpRequestProgressEventPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSXMLHttpRequestProgressEventPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -103,47 +100,57 @@ static const HashTable JSXMLHttpRequestProgressEventPrototypeTable =
     { 1, 0, JSXMLHttpRequestProgressEventPrototypeTableValues, 0 };
 #endif
 
-const ClassInfo JSXMLHttpRequestProgressEventPrototype::s_info = { "XMLHttpRequestProgressEventPrototype", 0, &JSXMLHttpRequestProgressEventPrototypeTable, 0 };
+static const HashTable* getJSXMLHttpRequestProgressEventPrototypeTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSXMLHttpRequestProgressEventPrototypeTable);
+}
+const ClassInfo JSXMLHttpRequestProgressEventPrototype::s_info = { "XMLHttpRequestProgressEventPrototype", 0, 0, getJSXMLHttpRequestProgressEventPrototypeTable };
 
-JSObject* JSXMLHttpRequestProgressEventPrototype::self(ExecState* exec)
+JSObject* JSXMLHttpRequestProgressEventPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSXMLHttpRequestProgressEvent>(exec);
+    return getDOMPrototype<JSXMLHttpRequestProgressEvent>(exec, globalObject);
 }
 
-const ClassInfo JSXMLHttpRequestProgressEvent::s_info = { "XMLHttpRequestProgressEvent", &JSProgressEvent::s_info, &JSXMLHttpRequestProgressEventTable, 0 };
+static const HashTable* getJSXMLHttpRequestProgressEventTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSXMLHttpRequestProgressEventTable);
+}
+const ClassInfo JSXMLHttpRequestProgressEvent::s_info = { "XMLHttpRequestProgressEvent", &JSProgressEvent::s_info, 0, getJSXMLHttpRequestProgressEventTable };
 
 JSXMLHttpRequestProgressEvent::JSXMLHttpRequestProgressEvent(PassRefPtr<Structure> structure, PassRefPtr<XMLHttpRequestProgressEvent> impl)
     : JSProgressEvent(structure, impl)
 {
 }
 
-JSObject* JSXMLHttpRequestProgressEvent::createPrototype(ExecState* exec)
+JSObject* JSXMLHttpRequestProgressEvent::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSXMLHttpRequestProgressEventPrototype(JSXMLHttpRequestProgressEventPrototype::createStructure(JSProgressEventPrototype::self(exec)));
+    return new (exec) JSXMLHttpRequestProgressEventPrototype(JSXMLHttpRequestProgressEventPrototype::createStructure(JSProgressEventPrototype::self(exec, globalObject)));
 }
 
 bool JSXMLHttpRequestProgressEvent::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    return getStaticValueSlot<JSXMLHttpRequestProgressEvent, Base>(exec, &JSXMLHttpRequestProgressEventTable, this, propertyName, slot);
+    return getStaticValueSlot<JSXMLHttpRequestProgressEvent, Base>(exec, getJSXMLHttpRequestProgressEventTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsXMLHttpRequestProgressEventPosition(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestProgressEventPosition(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestProgressEvent* imp = static_cast<XMLHttpRequestProgressEvent*>(static_cast<JSXMLHttpRequestProgressEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->position());
 }
 
-JSValuePtr jsXMLHttpRequestProgressEventTotalSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestProgressEventTotalSize(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestProgressEvent* imp = static_cast<XMLHttpRequestProgressEvent*>(static_cast<JSXMLHttpRequestProgressEvent*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->totalSize());
 }
 
-JSValuePtr jsXMLHttpRequestProgressEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestProgressEventConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSXMLHttpRequestProgressEvent*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSXMLHttpRequestProgressEvent::getConstructor(ExecState* exec)
+JSValue JSXMLHttpRequestProgressEvent::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSXMLHttpRequestProgressEventConstructor>(exec);
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h
index 6cd548c..45ce610 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestProgressEvent.h
@@ -31,23 +31,24 @@ class JSXMLHttpRequestProgressEvent : public JSProgressEvent {
     typedef JSProgressEvent Base;
 public:
     JSXMLHttpRequestProgressEvent(PassRefPtr<JSC::Structure>, PassRefPtr<XMLHttpRequestProgressEvent>);
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 };
 
 
 class JSXMLHttpRequestProgressEventPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     JSXMLHttpRequestProgressEventPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
@@ -55,9 +56,9 @@ public:
 
 // Attributes
 
-JSC::JSValuePtr jsXMLHttpRequestProgressEventPosition(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestProgressEventTotalSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXMLHttpRequestProgressEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestProgressEventPosition(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestProgressEventTotalSize(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestProgressEventConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp
index fa98106..34942b0 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.cpp
@@ -19,11 +19,8 @@
 */
 
 #include "config.h"
-
 #include "JSXMLHttpRequestUpload.h"
 
-#include <wtf/GetPtr.h>
-
 #include "Event.h"
 #include "EventListener.h"
 #include "Frame.h"
@@ -31,15 +28,14 @@
 #include "JSEvent.h"
 #include "JSEventListener.h"
 #include "XMLHttpRequestUpload.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequestUpload)
+ASSERT_CLASS_FITS_IN_CELL(JSXMLHttpRequestUpload);
 
 /* Hash table */
 
@@ -80,13 +76,13 @@ public:
     JSXMLHttpRequestUploadConstructor(ExecState* exec)
         : DOMObject(JSXMLHttpRequestUploadConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSXMLHttpRequestUploadPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSXMLHttpRequestUploadPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -116,19 +112,27 @@ static const HashTable JSXMLHttpRequestUploadPrototypeTable =
     { 8, 7, JSXMLHttpRequestUploadPrototypeTableValues, 0 };
 #endif
 
-const ClassInfo JSXMLHttpRequestUploadPrototype::s_info = { "XMLHttpRequestUploadPrototype", 0, &JSXMLHttpRequestUploadPrototypeTable, 0 };
+static const HashTable* getJSXMLHttpRequestUploadPrototypeTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSXMLHttpRequestUploadPrototypeTable);
+}
+const ClassInfo JSXMLHttpRequestUploadPrototype::s_info = { "XMLHttpRequestUploadPrototype", 0, 0, getJSXMLHttpRequestUploadPrototypeTable };
 
-JSObject* JSXMLHttpRequestUploadPrototype::self(ExecState* exec)
+JSObject* JSXMLHttpRequestUploadPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSXMLHttpRequestUpload>(exec);
+    return getDOMPrototype<JSXMLHttpRequestUpload>(exec, globalObject);
 }
 
 bool JSXMLHttpRequestUploadPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    return getStaticFunctionSlot<JSObject>(exec, &JSXMLHttpRequestUploadPrototypeTable, this, propertyName, slot);
+    return getStaticFunctionSlot<JSObject>(exec, getJSXMLHttpRequestUploadPrototypeTable(exec), this, propertyName, slot);
 }
 
-const ClassInfo JSXMLHttpRequestUpload::s_info = { "XMLHttpRequestUpload", 0, &JSXMLHttpRequestUploadTable, 0 };
+static const HashTable* getJSXMLHttpRequestUploadTable(ExecState* exec)
+{
+    return getHashTableForGlobalData(exec->globalData(), &JSXMLHttpRequestUploadTable);
+}
+const ClassInfo JSXMLHttpRequestUpload::s_info = { "XMLHttpRequestUpload", 0, 0, getJSXMLHttpRequestUploadTable };
 
 JSXMLHttpRequestUpload::JSXMLHttpRequestUpload(PassRefPtr<Structure> structure, PassRefPtr<XMLHttpRequestUpload> impl)
     : DOMObject(structure)
@@ -139,166 +143,178 @@ JSXMLHttpRequestUpload::JSXMLHttpRequestUpload(PassRefPtr<Structure> structure,
 JSXMLHttpRequestUpload::~JSXMLHttpRequestUpload()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSXMLHttpRequestUpload::createPrototype(ExecState* exec)
+JSObject* JSXMLHttpRequestUpload::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSXMLHttpRequestUploadPrototype(JSXMLHttpRequestUploadPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSXMLHttpRequestUploadPrototype(JSXMLHttpRequestUploadPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSXMLHttpRequestUpload::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
-    return getStaticValueSlot<JSXMLHttpRequestUpload, Base>(exec, &JSXMLHttpRequestUploadTable, this, propertyName, slot);
+    return getStaticValueSlot<JSXMLHttpRequestUpload, Base>(exec, getJSXMLHttpRequestUploadTable(exec), this, propertyName, slot);
 }
 
-JSValuePtr jsXMLHttpRequestUploadOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestUploadOnabort(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onabort())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onabort()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsXMLHttpRequestUploadOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestUploadOnerror(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onerror())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onerror()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsXMLHttpRequestUploadOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestUploadOnload(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onload())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onload()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsXMLHttpRequestUploadOnloadstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestUploadOnloadstart(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onloadstart())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onloadstart()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsXMLHttpRequestUploadOnprogress(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestUploadOnprogress(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(asObject(slot.slotBase()))->impl());
-    if (JSUnprotectedEventListener* listener = static_cast<JSUnprotectedEventListener*>(imp->onprogress())) {
-        if (JSObject* listenerObj = listener->listenerObj())
-            return listenerObj;
+    if (EventListener* listener = imp->onprogress()) {
+        if (JSObject* jsFunction = listener->jsFunction())
+            return jsFunction;
     }
     return jsNull();
 }
 
-JSValuePtr jsXMLHttpRequestUploadConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLHttpRequestUploadConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSXMLHttpRequestUpload*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-void JSXMLHttpRequestUpload::put(ExecState* exec, const Identifier& propertyName, JSValuePtr value, PutPropertySlot& slot)
+void JSXMLHttpRequestUpload::put(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    lookupPut<JSXMLHttpRequestUpload, Base>(exec, propertyName, value, &JSXMLHttpRequestUploadTable, this, slot);
+    lookupPut<JSXMLHttpRequestUpload, Base>(exec, propertyName, value, getJSXMLHttpRequestUploadTable(exec), this, slot);
 }
 
-void setJSXMLHttpRequestUploadOnabort(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSXMLHttpRequestUploadOnabort(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnabort(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnabort(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSXMLHttpRequestUploadOnerror(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSXMLHttpRequestUploadOnerror(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnerror(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnerror(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSXMLHttpRequestUploadOnload(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSXMLHttpRequestUploadOnload(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnload(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnload(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSXMLHttpRequestUploadOnloadstart(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSXMLHttpRequestUploadOnloadstart(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnloadstart(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnloadstart(globalObject->createJSAttributeEventListener(value));
 }
 
-void setJSXMLHttpRequestUploadOnprogress(ExecState* exec, JSObject* thisObject, JSValuePtr value)
+void setJSXMLHttpRequestUploadOnprogress(ExecState* exec, JSObject* thisObject, JSValue value)
 {
+    UNUSED_PARAM(exec);
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(static_cast<JSXMLHttpRequestUpload*>(thisObject)->impl());
     JSDOMGlobalObject* globalObject = toJSDOMGlobalObject(imp->scriptExecutionContext());
     if (!globalObject)
         return;
-    imp->setOnprogress(globalObject->findOrCreateJSUnprotectedEventListener(exec, value, true));
+    imp->setOnprogress(globalObject->createJSAttributeEventListener(value));
 }
 
-JSValuePtr JSXMLHttpRequestUpload::getConstructor(ExecState* exec)
+JSValue JSXMLHttpRequestUpload::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSXMLHttpRequestUploadConstructor>(exec);
 }
 
-JSValuePtr jsXMLHttpRequestUploadPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestUploadPrototypeFunctionAddEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequestUpload::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequestUpload::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequestUpload* castedThisObj = static_cast<JSXMLHttpRequestUpload*>(asObject(thisValue));
     return castedThisObj->addEventListener(exec, args);
 }
 
-JSValuePtr jsXMLHttpRequestUploadPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestUploadPrototypeFunctionRemoveEventListener(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequestUpload::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequestUpload::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequestUpload* castedThisObj = static_cast<JSXMLHttpRequestUpload*>(asObject(thisValue));
     return castedThisObj->removeEventListener(exec, args);
 }
 
-JSValuePtr jsXMLHttpRequestUploadPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLHttpRequestUploadPrototypeFunctionDispatchEvent(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLHttpRequestUpload::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLHttpRequestUpload::s_info))
         return throwError(exec, TypeError);
     JSXMLHttpRequestUpload* castedThisObj = static_cast<JSXMLHttpRequestUpload*>(asObject(thisValue));
     XMLHttpRequestUpload* imp = static_cast<XMLHttpRequestUpload*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Event* evt = toEvent(args.at(exec, 0));
+    Event* evt = toEvent(args.at(0));
 
 
-    JSC::JSValuePtr result = jsBoolean(imp->dispatchEvent(evt, ec));
+    JSC::JSValue result = jsBoolean(imp->dispatchEvent(evt, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, XMLHttpRequestUpload* object)
+JSC::JSValue toJS(JSC::ExecState* exec, XMLHttpRequestUpload* object)
 {
     return getDOMObjectWrapper<JSXMLHttpRequestUpload>(exec, object);
 }
-XMLHttpRequestUpload* toXMLHttpRequestUpload(JSC::JSValuePtr value)
+XMLHttpRequestUpload* toXMLHttpRequestUpload(JSC::JSValue value)
 {
-    return value->isObject(&JSXMLHttpRequestUpload::s_info) ? static_cast<JSXMLHttpRequestUpload*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSXMLHttpRequestUpload::s_info) ? static_cast<JSXMLHttpRequestUpload*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h
index af0f1eb..ed0313e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLHttpRequestUpload.h
@@ -34,40 +34,41 @@ class JSXMLHttpRequestUpload : public DOMObject {
 public:
     JSXMLHttpRequestUpload(PassRefPtr<JSC::Structure>, PassRefPtr<XMLHttpRequestUpload>);
     virtual ~JSXMLHttpRequestUpload();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
-    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValuePtr, JSC::PutPropertySlot&);
+    virtual void put(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::JSValue, JSC::PutPropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
     virtual void mark();
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
 
     // Custom functions
-    JSC::JSValuePtr addEventListener(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue addEventListener(JSC::ExecState*, const JSC::ArgList&);
+    JSC::JSValue removeEventListener(JSC::ExecState*, const JSC::ArgList&);
     XMLHttpRequestUpload* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<XMLHttpRequestUpload> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, XMLHttpRequestUpload*);
-XMLHttpRequestUpload* toXMLHttpRequestUpload(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, XMLHttpRequestUpload*);
+XMLHttpRequestUpload* toXMLHttpRequestUpload(JSC::JSValue);
 
 class JSXMLHttpRequestUploadPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -76,22 +77,22 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsXMLHttpRequestUploadPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXMLHttpRequestUploadPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXMLHttpRequestUploadPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestUploadPrototypeFunctionAddEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestUploadPrototypeFunctionRemoveEventListener(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLHttpRequestUploadPrototypeFunctionDispatchEvent(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsXMLHttpRequestUploadOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSXMLHttpRequestUploadOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsXMLHttpRequestUploadOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSXMLHttpRequestUploadOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsXMLHttpRequestUploadOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSXMLHttpRequestUploadOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsXMLHttpRequestUploadOnloadstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSXMLHttpRequestUploadOnloadstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsXMLHttpRequestUploadOnprogress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-void setJSXMLHttpRequestUploadOnprogress(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr);
-JSC::JSValuePtr jsXMLHttpRequestUploadConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLHttpRequestUploadOnabort(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestUploadOnabort(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestUploadOnerror(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestUploadOnerror(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestUploadOnload(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestUploadOnload(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestUploadOnloadstart(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestUploadOnloadstart(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestUploadOnprogress(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+void setJSXMLHttpRequestUploadOnprogress(JSC::ExecState*, JSC::JSObject*, JSC::JSValue);
+JSC::JSValue jsXMLHttpRequestUploadConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp
index 4b2b3e8..211f027 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.cpp
@@ -19,24 +19,20 @@
 */
 
 #include "config.h"
-
 #include "JSXMLSerializer.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSNode.h"
 #include "KURL.h"
 #include "XMLSerializer.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXMLSerializer)
+ASSERT_CLASS_FITS_IN_CELL(JSXMLSerializer);
 
 /* Hash table */
 
@@ -72,13 +68,13 @@ public:
     JSXMLSerializerConstructor(ExecState* exec)
         : DOMObject(JSXMLSerializerConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSXMLSerializerPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSXMLSerializerPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -117,9 +113,9 @@ static const HashTable JSXMLSerializerPrototypeTable =
 
 const ClassInfo JSXMLSerializerPrototype::s_info = { "XMLSerializerPrototype", 0, &JSXMLSerializerPrototypeTable, 0 };
 
-JSObject* JSXMLSerializerPrototype::self(ExecState* exec)
+JSObject* JSXMLSerializerPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSXMLSerializer>(exec);
+    return getDOMPrototype<JSXMLSerializer>(exec, globalObject);
 }
 
 bool JSXMLSerializerPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -138,12 +134,11 @@ JSXMLSerializer::JSXMLSerializer(PassRefPtr<Structure> structure, PassRefPtr<XML
 JSXMLSerializer::~JSXMLSerializer()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSXMLSerializer::createPrototype(ExecState* exec)
+JSObject* JSXMLSerializer::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSXMLSerializerPrototype(JSXMLSerializerPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSXMLSerializerPrototype(JSXMLSerializerPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSXMLSerializer::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -151,37 +146,38 @@ bool JSXMLSerializer::getOwnPropertySlot(ExecState* exec, const Identifier& prop
     return getStaticValueSlot<JSXMLSerializer, Base>(exec, &JSXMLSerializerTable, this, propertyName, slot);
 }
 
-JSValuePtr jsXMLSerializerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXMLSerializerConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSXMLSerializer*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSXMLSerializer::getConstructor(ExecState* exec)
+JSValue JSXMLSerializer::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSXMLSerializerConstructor>(exec);
 }
 
-JSValuePtr jsXMLSerializerPrototypeFunctionSerializeToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXMLSerializerPrototypeFunctionSerializeToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXMLSerializer::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXMLSerializer::s_info))
         return throwError(exec, TypeError);
     JSXMLSerializer* castedThisObj = static_cast<JSXMLSerializer*>(asObject(thisValue));
     XMLSerializer* imp = static_cast<XMLSerializer*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* node = toNode(args.at(exec, 0));
+    Node* node = toNode(args.at(0));
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->serializeToString(node, ec));
+    JSC::JSValue result = jsString(exec, imp->serializeToString(node, ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, XMLSerializer* object)
+JSC::JSValue toJS(JSC::ExecState* exec, XMLSerializer* object)
 {
     return getDOMObjectWrapper<JSXMLSerializer>(exec, object);
 }
-XMLSerializer* toXMLSerializer(JSC::JSValuePtr value)
+XMLSerializer* toXMLSerializer(JSC::JSValue value)
 {
-    return value->isObject(&JSXMLSerializer::s_info) ? static_cast<JSXMLSerializer*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSXMLSerializer::s_info) ? static_cast<JSXMLSerializer*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h
index c8c72a6..c973455 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXMLSerializer.h
@@ -34,33 +34,34 @@ class JSXMLSerializer : public DOMObject {
 public:
     JSXMLSerializer(PassRefPtr<JSC::Structure>, PassRefPtr<XMLSerializer>);
     virtual ~JSXMLSerializer();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     XMLSerializer* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<XMLSerializer> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, XMLSerializer*);
-XMLSerializer* toXMLSerializer(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, XMLSerializer*);
+XMLSerializer* toXMLSerializer(JSC::JSValue);
 
 class JSXMLSerializerPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -69,10 +70,10 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsXMLSerializerPrototypeFunctionSerializeToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXMLSerializerPrototypeFunctionSerializeToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsXMLSerializerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXMLSerializerConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp
index 7db5109..6103329 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.cpp
@@ -20,13 +20,10 @@
 
 #include "config.h"
 
-
 #if ENABLE(XPATH)
 
 #include "JSXPathEvaluator.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSCustomXPathNSResolver.h"
 #include "JSNode.h"
 #include "JSXPathExpression.h"
@@ -37,15 +34,14 @@
 #include "XPathExpression.h"
 #include "XPathNSResolver.h"
 #include "XPathResult.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXPathEvaluator)
+ASSERT_CLASS_FITS_IN_CELL(JSXPathEvaluator);
 
 /* Hash table */
 
@@ -81,13 +77,13 @@ public:
     JSXPathEvaluatorConstructor(ExecState* exec)
         : DOMObject(JSXPathEvaluatorConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSXPathEvaluatorPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSXPathEvaluatorPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -128,9 +124,9 @@ static const HashTable JSXPathEvaluatorPrototypeTable =
 
 const ClassInfo JSXPathEvaluatorPrototype::s_info = { "XPathEvaluatorPrototype", 0, &JSXPathEvaluatorPrototypeTable, 0 };
 
-JSObject* JSXPathEvaluatorPrototype::self(ExecState* exec)
+JSObject* JSXPathEvaluatorPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSXPathEvaluator>(exec);
+    return getDOMPrototype<JSXPathEvaluator>(exec, globalObject);
 }
 
 bool JSXPathEvaluatorPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -149,12 +145,11 @@ JSXPathEvaluator::JSXPathEvaluator(PassRefPtr<Structure> structure, PassRefPtr<X
 JSXPathEvaluator::~JSXPathEvaluator()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSXPathEvaluator::createPrototype(ExecState* exec)
+JSObject* JSXPathEvaluator::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSXPathEvaluatorPrototype(JSXPathEvaluatorPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSXPathEvaluatorPrototype(JSXPathEvaluatorPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSXPathEvaluator::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -162,84 +157,87 @@ bool JSXPathEvaluator::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSXPathEvaluator, Base>(exec, &JSXPathEvaluatorTable, this, propertyName, slot);
 }
 
-JSValuePtr jsXPathEvaluatorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathEvaluatorConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSXPathEvaluator*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSXPathEvaluator::getConstructor(ExecState* exec)
+JSValue JSXPathEvaluator::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSXPathEvaluatorConstructor>(exec);
 }
 
-JSValuePtr jsXPathEvaluatorPrototypeFunctionCreateExpression(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXPathEvaluatorPrototypeFunctionCreateExpression(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXPathEvaluator::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXPathEvaluator::s_info))
         return throwError(exec, TypeError);
     JSXPathEvaluator* castedThisObj = static_cast<JSXPathEvaluator*>(asObject(thisValue));
     XPathEvaluator* imp = static_cast<XPathEvaluator*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& expression = args.at(exec, 0)->toString(exec);
+    const UString& expression = args.at(0).toString(exec);
     RefPtr<XPathNSResolver> customResolver;
-    XPathNSResolver* resolver = toXPathNSResolver(args.at(exec, 1));
+    XPathNSResolver* resolver = toXPathNSResolver(args.at(1));
     if (!resolver) {
-        customResolver = JSCustomXPathNSResolver::create(exec, args.at(exec, 1));
+        customResolver = JSCustomXPathNSResolver::create(exec, args.at(1));
         if (exec->hadException())
             return jsUndefined();
         resolver = customResolver.get();
     }
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createExpression(expression, resolver, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createExpression(expression, resolver, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsXPathEvaluatorPrototypeFunctionCreateNSResolver(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXPathEvaluatorPrototypeFunctionCreateNSResolver(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXPathEvaluator::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXPathEvaluator::s_info))
         return throwError(exec, TypeError);
     JSXPathEvaluator* castedThisObj = static_cast<JSXPathEvaluator*>(asObject(thisValue));
     XPathEvaluator* imp = static_cast<XPathEvaluator*>(castedThisObj->impl());
-    Node* nodeResolver = toNode(args.at(exec, 0));
+    Node* nodeResolver = toNode(args.at(0));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->createNSResolver(nodeResolver)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->createNSResolver(nodeResolver)));
     return result;
 }
 
-JSValuePtr jsXPathEvaluatorPrototypeFunctionEvaluate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXPathEvaluatorPrototypeFunctionEvaluate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXPathEvaluator::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXPathEvaluator::s_info))
         return throwError(exec, TypeError);
     JSXPathEvaluator* castedThisObj = static_cast<JSXPathEvaluator*>(asObject(thisValue));
     XPathEvaluator* imp = static_cast<XPathEvaluator*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    const UString& expression = args.at(exec, 0)->toString(exec);
-    Node* contextNode = toNode(args.at(exec, 1));
+    const UString& expression = args.at(0).toString(exec);
+    Node* contextNode = toNode(args.at(1));
     RefPtr<XPathNSResolver> customResolver;
-    XPathNSResolver* resolver = toXPathNSResolver(args.at(exec, 2));
+    XPathNSResolver* resolver = toXPathNSResolver(args.at(2));
     if (!resolver) {
-        customResolver = JSCustomXPathNSResolver::create(exec, args.at(exec, 2));
+        customResolver = JSCustomXPathNSResolver::create(exec, args.at(2));
         if (exec->hadException())
             return jsUndefined();
         resolver = customResolver.get();
     }
-    unsigned short type = args.at(exec, 3)->toInt32(exec);
-    XPathResult* inResult = toXPathResult(args.at(exec, 4));
+    unsigned short type = args.at(3).toInt32(exec);
+    XPathResult* inResult = toXPathResult(args.at(4));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->evaluate(expression, contextNode, resolver, type, inResult, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->evaluate(expression, contextNode, resolver, type, inResult, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, XPathEvaluator* object)
+JSC::JSValue toJS(JSC::ExecState* exec, XPathEvaluator* object)
 {
     return getDOMObjectWrapper<JSXPathEvaluator>(exec, object);
 }
-XPathEvaluator* toXPathEvaluator(JSC::JSValuePtr value)
+XPathEvaluator* toXPathEvaluator(JSC::JSValue value)
 {
-    return value->isObject(&JSXPathEvaluator::s_info) ? static_cast<JSXPathEvaluator*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSXPathEvaluator::s_info) ? static_cast<JSXPathEvaluator*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h
index 6f9cd72..be11874 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathEvaluator.h
@@ -21,7 +21,6 @@
 #ifndef JSXPathEvaluator_h
 #define JSXPathEvaluator_h
 
-
 #if ENABLE(XPATH)
 
 #include "JSDOMBinding.h"
@@ -37,33 +36,34 @@ class JSXPathEvaluator : public DOMObject {
 public:
     JSXPathEvaluator(PassRefPtr<JSC::Structure>, PassRefPtr<XPathEvaluator>);
     virtual ~JSXPathEvaluator();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     XPathEvaluator* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<XPathEvaluator> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, XPathEvaluator*);
-XPathEvaluator* toXPathEvaluator(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, XPathEvaluator*);
+XPathEvaluator* toXPathEvaluator(JSC::JSValue);
 
 class JSXPathEvaluatorPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -72,12 +72,12 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsXPathEvaluatorPrototypeFunctionCreateExpression(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXPathEvaluatorPrototypeFunctionCreateNSResolver(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXPathEvaluatorPrototypeFunctionEvaluate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXPathEvaluatorPrototypeFunctionCreateExpression(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXPathEvaluatorPrototypeFunctionCreateNSResolver(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXPathEvaluatorPrototypeFunctionEvaluate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsXPathEvaluatorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathEvaluatorConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp
index 8b2ab42..82518b1 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathException.cpp
@@ -20,25 +20,22 @@
 
 #include "config.h"
 
-
 #if ENABLE(XPATH)
 
 #include "JSXPathException.h"
 
-#include <wtf/GetPtr.h>
-
 #include "KURL.h"
 #include "XPathException.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXPathException)
+ASSERT_CLASS_FITS_IN_CELL(JSXPathException);
 
 /* Hash table */
 
@@ -79,13 +76,13 @@ public:
     JSXPathExceptionConstructor(ExecState* exec)
         : DOMObject(JSXPathExceptionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSXPathExceptionPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSXPathExceptionPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -117,9 +114,9 @@ static const HashTable JSXPathExceptionPrototypeTable =
 
 const ClassInfo JSXPathExceptionPrototype::s_info = { "XPathExceptionPrototype", 0, &JSXPathExceptionPrototypeTable, 0 };
 
-JSObject* JSXPathExceptionPrototype::self(ExecState* exec)
+JSObject* JSXPathExceptionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSXPathException>(exec);
+    return getDOMPrototype<JSXPathException>(exec, globalObject);
 }
 
 bool JSXPathExceptionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -138,12 +135,11 @@ JSXPathException::JSXPathException(PassRefPtr<Structure> structure, PassRefPtr<X
 JSXPathException::~JSXPathException()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSXPathException::createPrototype(ExecState* exec)
+JSObject* JSXPathException::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSXPathExceptionPrototype(JSXPathExceptionPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSXPathExceptionPrototype(JSXPathExceptionPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSXPathException::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -151,64 +147,68 @@ bool JSXPathException::getOwnPropertySlot(ExecState* exec, const Identifier& pro
     return getStaticValueSlot<JSXPathException, Base>(exec, &JSXPathExceptionTable, this, propertyName, slot);
 }
 
-JSValuePtr jsXPathExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathExceptionCode(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XPathException* imp = static_cast<XPathException*>(static_cast<JSXPathException*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->code());
 }
 
-JSValuePtr jsXPathExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathExceptionName(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XPathException* imp = static_cast<XPathException*>(static_cast<JSXPathException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->name());
 }
 
-JSValuePtr jsXPathExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathExceptionMessage(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XPathException* imp = static_cast<XPathException*>(static_cast<JSXPathException*>(asObject(slot.slotBase()))->impl());
     return jsString(exec, imp->message());
 }
 
-JSValuePtr jsXPathExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathExceptionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSXPathException*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSXPathException::getConstructor(ExecState* exec)
+JSValue JSXPathException::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSXPathExceptionConstructor>(exec);
 }
 
-JSValuePtr jsXPathExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXPathExceptionPrototypeFunctionToString(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXPathException::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXPathException::s_info))
         return throwError(exec, TypeError);
     JSXPathException* castedThisObj = static_cast<JSXPathException*>(asObject(thisValue));
     XPathException* imp = static_cast<XPathException*>(castedThisObj->impl());
 
 
-    JSC::JSValuePtr result = jsString(exec, imp->toString());
+    JSC::JSValue result = jsString(exec, imp->toString());
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsXPathExceptionINVALID_EXPRESSION_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathExceptionINVALID_EXPRESSION_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(51));
 }
 
-JSValuePtr jsXPathExceptionTYPE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathExceptionTYPE_ERR(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(52));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, XPathException* object)
+JSC::JSValue toJS(JSC::ExecState* exec, XPathException* object)
 {
     return getDOMObjectWrapper<JSXPathException>(exec, object);
 }
-XPathException* toXPathException(JSC::JSValuePtr value)
+XPathException* toXPathException(JSC::JSValue value)
 {
-    return value->isObject(&JSXPathException::s_info) ? static_cast<JSXPathException*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSXPathException::s_info) ? static_cast<JSXPathException*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathException.h b/src/3rdparty/webkit/WebCore/generated/JSXPathException.h
index 53b1874..023e6a2 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathException.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathException.h
@@ -21,7 +21,6 @@
 #ifndef JSXPathException_h
 #define JSXPathException_h
 
-
 #if ENABLE(XPATH)
 
 #include "JSDOMBinding.h"
@@ -37,33 +36,34 @@ class JSXPathException : public DOMObject {
 public:
     JSXPathException(PassRefPtr<JSC::Structure>, PassRefPtr<XPathException>);
     virtual ~JSXPathException();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     XPathException* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<XPathException> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, XPathException*);
-XPathException* toXPathException(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, XPathException*);
+XPathException* toXPathException(JSC::JSValue);
 
 class JSXPathExceptionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -72,17 +72,17 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsXPathExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXPathExceptionPrototypeFunctionToString(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsXPathExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathExceptionCode(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathExceptionName(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathExceptionMessage(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathExceptionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsXPathExceptionINVALID_EXPRESSION_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathExceptionTYPE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathExceptionINVALID_EXPRESSION_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathExceptionTYPE_ERR(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp
index a7a6259..fd945fe 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.cpp
@@ -20,26 +20,22 @@
 
 #include "config.h"
 
-
 #if ENABLE(XPATH)
 
 #include "JSXPathExpression.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSNode.h"
 #include "JSXPathResult.h"
 #include "XPathExpression.h"
 #include "XPathResult.h"
-
 #include <runtime/Error.h>
-#include <runtime/JSNumberCell.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXPathExpression)
+ASSERT_CLASS_FITS_IN_CELL(JSXPathExpression);
 
 /* Hash table */
 
@@ -75,13 +71,13 @@ public:
     JSXPathExpressionConstructor(ExecState* exec)
         : DOMObject(JSXPathExpressionConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSXPathExpressionPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSXPathExpressionPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -111,9 +107,9 @@ static const HashTable JSXPathExpressionPrototypeTable =
 
 const ClassInfo JSXPathExpressionPrototype::s_info = { "XPathExpressionPrototype", 0, &JSXPathExpressionPrototypeTable, 0 };
 
-JSObject* JSXPathExpressionPrototype::self(ExecState* exec)
+JSObject* JSXPathExpressionPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSXPathExpression>(exec);
+    return getDOMPrototype<JSXPathExpression>(exec, globalObject);
 }
 
 bool JSXPathExpressionPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -132,12 +128,11 @@ JSXPathExpression::JSXPathExpression(PassRefPtr<Structure> structure, PassRefPtr
 JSXPathExpression::~JSXPathExpression()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSXPathExpression::createPrototype(ExecState* exec)
+JSObject* JSXPathExpression::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSXPathExpressionPrototype(JSXPathExpressionPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSXPathExpressionPrototype(JSXPathExpressionPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSXPathExpression::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -145,39 +140,40 @@ bool JSXPathExpression::getOwnPropertySlot(ExecState* exec, const Identifier& pr
     return getStaticValueSlot<JSXPathExpression, Base>(exec, &JSXPathExpressionTable, this, propertyName, slot);
 }
 
-JSValuePtr jsXPathExpressionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathExpressionConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSXPathExpression*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSXPathExpression::getConstructor(ExecState* exec)
+JSValue JSXPathExpression::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSXPathExpressionConstructor>(exec);
 }
 
-JSValuePtr jsXPathExpressionPrototypeFunctionEvaluate(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXPathExpressionPrototypeFunctionEvaluate(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXPathExpression::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXPathExpression::s_info))
         return throwError(exec, TypeError);
     JSXPathExpression* castedThisObj = static_cast<JSXPathExpression*>(asObject(thisValue));
     XPathExpression* imp = static_cast<XPathExpression*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    Node* contextNode = toNode(args.at(exec, 0));
-    unsigned short type = args.at(exec, 1)->toInt32(exec);
-    XPathResult* inResult = toXPathResult(args.at(exec, 2));
+    Node* contextNode = toNode(args.at(0));
+    unsigned short type = args.at(1).toInt32(exec);
+    XPathResult* inResult = toXPathResult(args.at(2));
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->evaluate(contextNode, type, inResult, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->evaluate(contextNode, type, inResult, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, XPathExpression* object)
+JSC::JSValue toJS(JSC::ExecState* exec, XPathExpression* object)
 {
     return getDOMObjectWrapper<JSXPathExpression>(exec, object);
 }
-XPathExpression* toXPathExpression(JSC::JSValuePtr value)
+XPathExpression* toXPathExpression(JSC::JSValue value)
 {
-    return value->isObject(&JSXPathExpression::s_info) ? static_cast<JSXPathExpression*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSXPathExpression::s_info) ? static_cast<JSXPathExpression*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h
index d18b001..9102894 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathExpression.h
@@ -21,7 +21,6 @@
 #ifndef JSXPathExpression_h
 #define JSXPathExpression_h
 
-
 #if ENABLE(XPATH)
 
 #include "JSDOMBinding.h"
@@ -37,33 +36,34 @@ class JSXPathExpression : public DOMObject {
 public:
     JSXPathExpression(PassRefPtr<JSC::Structure>, PassRefPtr<XPathExpression>);
     virtual ~JSXPathExpression();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     XPathExpression* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<XPathExpression> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, XPathExpression*);
-XPathExpression* toXPathExpression(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, XPathExpression*);
+XPathExpression* toXPathExpression(JSC::JSValue);
 
 class JSXPathExpressionPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -72,10 +72,10 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsXPathExpressionPrototypeFunctionEvaluate(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXPathExpressionPrototypeFunctionEvaluate(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsXPathExpressionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathExpressionConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.cpp
index a56a998..550c85e 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.cpp
@@ -20,25 +20,22 @@
 
 #include "config.h"
 
-
 #if ENABLE(XPATH)
 
 #include "JSXPathNSResolver.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSCustomXPathNSResolver.h"
 #include "JSXPathNSResolver.h"
 #include "KURL.h"
 #include "PlatformString.h"
-
 #include <runtime/Error.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXPathNSResolver)
+ASSERT_CLASS_FITS_IN_CELL(JSXPathNSResolver);
 
 /* Hash table for prototype */
 
@@ -57,9 +54,9 @@ static const HashTable JSXPathNSResolverPrototypeTable =
 
 const ClassInfo JSXPathNSResolverPrototype::s_info = { "XPathNSResolverPrototype", 0, &JSXPathNSResolverPrototypeTable, 0 };
 
-JSObject* JSXPathNSResolverPrototype::self(ExecState* exec)
+JSObject* JSXPathNSResolverPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSXPathNSResolver>(exec);
+    return getDOMPrototype<JSXPathNSResolver>(exec, globalObject);
 }
 
 bool JSXPathNSResolverPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -78,34 +75,34 @@ JSXPathNSResolver::JSXPathNSResolver(PassRefPtr<Structure> structure, PassRefPtr
 JSXPathNSResolver::~JSXPathNSResolver()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSXPathNSResolver::createPrototype(ExecState* exec)
+JSObject* JSXPathNSResolver::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSXPathNSResolverPrototype(JSXPathNSResolverPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSXPathNSResolverPrototype(JSXPathNSResolverPrototype::createStructure(globalObject->objectPrototype()));
 }
 
-JSValuePtr jsXPathNSResolverPrototypeFunctionLookupNamespaceURI(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXPathNSResolverPrototypeFunctionLookupNamespaceURI(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXPathNSResolver::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXPathNSResolver::s_info))
         return throwError(exec, TypeError);
     JSXPathNSResolver* castedThisObj = static_cast<JSXPathNSResolver*>(asObject(thisValue));
     XPathNSResolver* imp = static_cast<XPathNSResolver*>(castedThisObj->impl());
-    const UString& prefix = args.at(exec, 0)->toString(exec);
+    const UString& prefix = args.at(0).toString(exec);
 
 
-    JSC::JSValuePtr result = jsStringOrNull(exec, imp->lookupNamespaceURI(prefix));
+    JSC::JSValue result = jsStringOrNull(exec, imp->lookupNamespaceURI(prefix));
     return result;
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, XPathNSResolver* object)
+JSC::JSValue toJS(JSC::ExecState* exec, XPathNSResolver* object)
 {
     return getDOMObjectWrapper<JSXPathNSResolver>(exec, object);
 }
-XPathNSResolver* toXPathNSResolver(JSC::JSValuePtr value)
+XPathNSResolver* toXPathNSResolver(JSC::JSValue value)
 {
-    return value->isObject(&JSXPathNSResolver::s_info) ? static_cast<JSXPathNSResolver*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSXPathNSResolver::s_info) ? static_cast<JSXPathNSResolver*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h b/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h
index 0219093..e829c71 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathNSResolver.h
@@ -21,7 +21,6 @@
 #ifndef JSXPathNSResolver_h
 #define JSXPathNSResolver_h
 
-
 #if ENABLE(XPATH)
 
 #include "JSDOMBinding.h"
@@ -37,7 +36,7 @@ class JSXPathNSResolver : public DOMObject {
 public:
     JSXPathNSResolver(PassRefPtr<JSC::Structure>, PassRefPtr<XPathNSResolver>);
     virtual ~JSXPathNSResolver();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
@@ -47,16 +46,17 @@ private:
     RefPtr<XPathNSResolver> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, XPathNSResolver*);
-XPathNSResolver* toXPathNSResolver(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, XPathNSResolver*);
+XPathNSResolver* toXPathNSResolver(JSC::JSValue);
 
 class JSXPathNSResolverPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -65,7 +65,7 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsXPathNSResolverPrototypeFunctionLookupNamespaceURI(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXPathNSResolverPrototypeFunctionLookupNamespaceURI(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp
index 1dd7ffa..cecdf90 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.cpp
@@ -20,27 +20,24 @@
 
 #include "config.h"
 
-
 #if ENABLE(XPATH)
 
 #include "JSXPathResult.h"
 
-#include <wtf/GetPtr.h>
-
 #include "JSNode.h"
 #include "KURL.h"
 #include "Node.h"
 #include "XPathResult.h"
-
 #include <runtime/Error.h>
 #include <runtime/JSNumberCell.h>
 #include <runtime/JSString.h>
+#include <wtf/GetPtr.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-ASSERT_CLASS_FITS_IN_CELL(JSXPathResult)
+ASSERT_CLASS_FITS_IN_CELL(JSXPathResult);
 
 /* Hash table */
 
@@ -93,13 +90,13 @@ public:
     JSXPathResultConstructor(ExecState* exec)
         : DOMObject(JSXPathResultConstructor::createStructure(exec->lexicalGlobalObject()->objectPrototype()))
     {
-        putDirect(exec->propertyNames().prototype, JSXPathResultPrototype::self(exec), None);
+        putDirect(exec->propertyNames().prototype, JSXPathResultPrototype::self(exec, exec->lexicalGlobalObject()), None);
     }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
     virtual const ClassInfo* classInfo() const { return &s_info; }
     static const ClassInfo s_info;
 
-    static PassRefPtr<Structure> createStructure(JSValuePtr proto) 
+    static PassRefPtr<Structure> createStructure(JSValue proto) 
     { 
         return Structure::create(proto, TypeInfo(ObjectType, ImplementsHasInstance)); 
     }
@@ -140,9 +137,9 @@ static const HashTable JSXPathResultPrototypeTable =
 
 const ClassInfo JSXPathResultPrototype::s_info = { "XPathResultPrototype", 0, &JSXPathResultPrototypeTable, 0 };
 
-JSObject* JSXPathResultPrototype::self(ExecState* exec)
+JSObject* JSXPathResultPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return getDOMPrototype<JSXPathResult>(exec);
+    return getDOMPrototype<JSXPathResult>(exec, globalObject);
 }
 
 bool JSXPathResultPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -161,12 +158,11 @@ JSXPathResult::JSXPathResult(PassRefPtr<Structure> structure, PassRefPtr<XPathRe
 JSXPathResult::~JSXPathResult()
 {
     forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
 }
 
-JSObject* JSXPathResult::createPrototype(ExecState* exec)
+JSObject* JSXPathResult::createPrototype(ExecState* exec, JSGlobalObject* globalObject)
 {
-    return new (exec) JSXPathResultPrototype(JSXPathResultPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
+    return new (exec) JSXPathResultPrototype(JSXPathResultPrototype::createStructure(globalObject->objectPrototype()));
 }
 
 bool JSXPathResult::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
@@ -174,160 +170,164 @@ bool JSXPathResult::getOwnPropertySlot(ExecState* exec, const Identifier& proper
     return getStaticValueSlot<JSXPathResult, Base>(exec, &JSXPathResultTable, this, propertyName, slot);
 }
 
-JSValuePtr jsXPathResultResultType(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultResultType(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XPathResult* imp = static_cast<XPathResult*>(static_cast<JSXPathResult*>(asObject(slot.slotBase()))->impl());
     return jsNumber(exec, imp->resultType());
 }
 
-JSValuePtr jsXPathResultNumberValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultNumberValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     XPathResult* imp = static_cast<XPathResult*>(static_cast<JSXPathResult*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = jsNumber(exec, imp->numberValue(ec));
+    JSC::JSValue result = jsNumber(exec, imp->numberValue(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsXPathResultStringValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultStringValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     XPathResult* imp = static_cast<XPathResult*>(static_cast<JSXPathResult*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = jsString(exec, imp->stringValue(ec));
+    JSC::JSValue result = jsString(exec, imp->stringValue(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsXPathResultBooleanValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultBooleanValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     XPathResult* imp = static_cast<XPathResult*>(static_cast<JSXPathResult*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = jsBoolean(imp->booleanValue(ec));
+    JSC::JSValue result = jsBoolean(imp->booleanValue(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsXPathResultSingleNodeValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultSingleNodeValue(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     XPathResult* imp = static_cast<XPathResult*>(static_cast<JSXPathResult*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->singleNodeValue(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->singleNodeValue(ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsXPathResultInvalidIteratorState(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultInvalidIteratorState(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
+    UNUSED_PARAM(exec);
     XPathResult* imp = static_cast<XPathResult*>(static_cast<JSXPathResult*>(asObject(slot.slotBase()))->impl());
     return jsBoolean(imp->invalidIteratorState());
 }
 
-JSValuePtr jsXPathResultSnapshotLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultSnapshotLength(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     ExceptionCode ec = 0;
     XPathResult* imp = static_cast<XPathResult*>(static_cast<JSXPathResult*>(asObject(slot.slotBase()))->impl());
-    JSC::JSValuePtr result = jsNumber(exec, imp->snapshotLength(ec));
+    JSC::JSValue result = jsNumber(exec, imp->snapshotLength(ec));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsXPathResultConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
+JSValue jsXPathResultConstructor(ExecState* exec, const Identifier&, const PropertySlot& slot)
 {
     return static_cast<JSXPathResult*>(asObject(slot.slotBase()))->getConstructor(exec);
 }
-JSValuePtr JSXPathResult::getConstructor(ExecState* exec)
+JSValue JSXPathResult::getConstructor(ExecState* exec)
 {
     return getDOMConstructor<JSXPathResultConstructor>(exec);
 }
 
-JSValuePtr jsXPathResultPrototypeFunctionIterateNext(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXPathResultPrototypeFunctionIterateNext(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXPathResult::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXPathResult::s_info))
         return throwError(exec, TypeError);
     JSXPathResult* castedThisObj = static_cast<JSXPathResult*>(asObject(thisValue));
     XPathResult* imp = static_cast<XPathResult*>(castedThisObj->impl());
     ExceptionCode ec = 0;
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->iterateNext(ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->iterateNext(ec)));
     setDOMException(exec, ec);
     return result;
 }
 
-JSValuePtr jsXPathResultPrototypeFunctionSnapshotItem(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
+JSValue JSC_HOST_CALL jsXPathResultPrototypeFunctionSnapshotItem(ExecState* exec, JSObject*, JSValue thisValue, const ArgList& args)
 {
-    if (!thisValue->isObject(&JSXPathResult::s_info))
+    UNUSED_PARAM(args);
+    if (!thisValue.isObject(&JSXPathResult::s_info))
         return throwError(exec, TypeError);
     JSXPathResult* castedThisObj = static_cast<JSXPathResult*>(asObject(thisValue));
     XPathResult* imp = static_cast<XPathResult*>(castedThisObj->impl());
     ExceptionCode ec = 0;
-    unsigned index = args.at(exec, 0)->toInt32(exec);
+    unsigned index = args.at(0).toInt32(exec);
 
 
-    JSC::JSValuePtr result = toJS(exec, WTF::getPtr(imp->snapshotItem(index, ec)));
+    JSC::JSValue result = toJS(exec, WTF::getPtr(imp->snapshotItem(index, ec)));
     setDOMException(exec, ec);
     return result;
 }
 
 // Constant getters
 
-JSValuePtr jsXPathResultANY_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultANY_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(0));
 }
 
-JSValuePtr jsXPathResultNUMBER_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultNUMBER_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(1));
 }
 
-JSValuePtr jsXPathResultSTRING_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultSTRING_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(2));
 }
 
-JSValuePtr jsXPathResultBOOLEAN_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultBOOLEAN_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(3));
 }
 
-JSValuePtr jsXPathResultUNORDERED_NODE_ITERATOR_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultUNORDERED_NODE_ITERATOR_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(4));
 }
 
-JSValuePtr jsXPathResultORDERED_NODE_ITERATOR_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultORDERED_NODE_ITERATOR_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(5));
 }
 
-JSValuePtr jsXPathResultUNORDERED_NODE_SNAPSHOT_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultUNORDERED_NODE_SNAPSHOT_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(6));
 }
 
-JSValuePtr jsXPathResultORDERED_NODE_SNAPSHOT_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultORDERED_NODE_SNAPSHOT_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(7));
 }
 
-JSValuePtr jsXPathResultANY_UNORDERED_NODE_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultANY_UNORDERED_NODE_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(8));
 }
 
-JSValuePtr jsXPathResultFIRST_ORDERED_NODE_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
+JSValue jsXPathResultFIRST_ORDERED_NODE_TYPE(ExecState* exec, const Identifier&, const PropertySlot&)
 {
     return jsNumber(exec, static_cast<int>(9));
 }
 
-JSC::JSValuePtr toJS(JSC::ExecState* exec, XPathResult* object)
+JSC::JSValue toJS(JSC::ExecState* exec, XPathResult* object)
 {
     return getDOMObjectWrapper<JSXPathResult>(exec, object);
 }
-XPathResult* toXPathResult(JSC::JSValuePtr value)
+XPathResult* toXPathResult(JSC::JSValue value)
 {
-    return value->isObject(&JSXPathResult::s_info) ? static_cast<JSXPathResult*>(asObject(value))->impl() : 0;
+    return value.isObject(&JSXPathResult::s_info) ? static_cast<JSXPathResult*>(asObject(value))->impl() : 0;
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h
index 055adc3..0f07f80 100644
--- a/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h
+++ b/src/3rdparty/webkit/WebCore/generated/JSXPathResult.h
@@ -21,7 +21,6 @@
 #ifndef JSXPathResult_h
 #define JSXPathResult_h
 
-
 #if ENABLE(XPATH)
 
 #include "JSDOMBinding.h"
@@ -37,33 +36,34 @@ class JSXPathResult : public DOMObject {
 public:
     JSXPathResult(PassRefPtr<JSC::Structure>, PassRefPtr<XPathResult>);
     virtual ~JSXPathResult();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
+    static JSC::JSObject* createPrototype(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier& propertyName, JSC::PropertySlot&);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
 
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
 
-    static JSC::JSValuePtr getConstructor(JSC::ExecState*);
+    static JSC::JSValue getConstructor(JSC::ExecState*);
     XPathResult* impl() const { return m_impl.get(); }
 
 private:
     RefPtr<XPathResult> m_impl;
 };
 
-JSC::JSValuePtr toJS(JSC::ExecState*, XPathResult*);
-XPathResult* toXPathResult(JSC::JSValuePtr);
+JSC::JSValue toJS(JSC::ExecState*, XPathResult*);
+XPathResult* toXPathResult(JSC::JSValue);
 
 class JSXPathResultPrototype : public JSC::JSObject {
+    typedef JSC::JSObject Base;
 public:
-    static JSC::JSObject* self(JSC::ExecState*);
+    static JSC::JSObject* self(JSC::ExecState*, JSC::JSGlobalObject*);
     virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
     static const JSC::ClassInfo s_info;
     virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
+    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValue prototype)
     {
         return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
     }
@@ -72,30 +72,30 @@ public:
 
 // Functions
 
-JSC::JSValuePtr jsXPathResultPrototypeFunctionIterateNext(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXPathResultPrototypeFunctionSnapshotItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXPathResultPrototypeFunctionIterateNext(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
+JSC::JSValue JSC_HOST_CALL jsXPathResultPrototypeFunctionSnapshotItem(JSC::ExecState*, JSC::JSObject*, JSC::JSValue, const JSC::ArgList&);
 // Attributes
 
-JSC::JSValuePtr jsXPathResultResultType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultNumberValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultStringValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultBooleanValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultSingleNodeValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultInvalidIteratorState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultSnapshotLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultResultType(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultNumberValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultStringValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultBooleanValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultSingleNodeValue(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultInvalidIteratorState(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultSnapshotLength(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultConstructor(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 // Constants
 
-JSC::JSValuePtr jsXPathResultANY_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultNUMBER_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultSTRING_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultBOOLEAN_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultUNORDERED_NODE_ITERATOR_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultORDERED_NODE_ITERATOR_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultUNORDERED_NODE_SNAPSHOT_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultORDERED_NODE_SNAPSHOT_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultANY_UNORDERED_NODE_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
-JSC::JSValuePtr jsXPathResultFIRST_ORDERED_NODE_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultANY_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultNUMBER_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultSTRING_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultBOOLEAN_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultUNORDERED_NODE_ITERATOR_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultORDERED_NODE_ITERATOR_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultUNORDERED_NODE_SNAPSHOT_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultORDERED_NODE_SNAPSHOT_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultANY_UNORDERED_NODE_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
+JSC::JSValue jsXPathResultFIRST_ORDERED_NODE_TYPE(JSC::ExecState*, const JSC::Identifier&, const JSC::PropertySlot&);
 
 } // namespace WebCore
 
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.cpp b/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.cpp
deleted file mode 100644
index 3ec48fb..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.cpp
+++ /dev/null
@@ -1,177 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-
-
-#if ENABLE(XSLT)
-
-#include "JSXSLTProcessor.h"
-
-#include <wtf/GetPtr.h>
-
-#include "Document.h"
-#include "DocumentFragment.h"
-#include "NodeFilter.h"
-#include "XSLTProcessor.h"
-
-#include <runtime/Error.h>
-
-using namespace JSC;
-
-namespace WebCore {
-
-ASSERT_CLASS_FITS_IN_CELL(JSXSLTProcessor)
-
-/* Hash table for prototype */
-
-static const HashTableValue JSXSLTProcessorPrototypeTableValues[9] =
-{
-    { "importStylesheet", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionImportStylesheet, (intptr_t)1 },
-    { "transformToFragment", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionTransformToFragment, (intptr_t)2 },
-    { "transformToDocument", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionTransformToDocument, (intptr_t)1 },
-    { "setParameter", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionSetParameter, (intptr_t)3 },
-    { "getParameter", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionGetParameter, (intptr_t)2 },
-    { "removeParameter", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionRemoveParameter, (intptr_t)2 },
-    { "clearParameters", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionClearParameters, (intptr_t)0 },
-    { "reset", DontDelete|Function, (intptr_t)jsXSLTProcessorPrototypeFunctionReset, (intptr_t)0 },
-    { 0, 0, 0, 0 }
-};
-
-static const HashTable JSXSLTProcessorPrototypeTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 63, JSXSLTProcessorPrototypeTableValues, 0 };
-#else
-    { 17, 15, JSXSLTProcessorPrototypeTableValues, 0 };
-#endif
-
-const ClassInfo JSXSLTProcessorPrototype::s_info = { "XSLTProcessorPrototype", 0, &JSXSLTProcessorPrototypeTable, 0 };
-
-JSObject* JSXSLTProcessorPrototype::self(ExecState* exec)
-{
-    return getDOMPrototype<JSXSLTProcessor>(exec);
-}
-
-bool JSXSLTProcessorPrototype::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
-{
-    return getStaticFunctionSlot<JSObject>(exec, &JSXSLTProcessorPrototypeTable, this, propertyName, slot);
-}
-
-const ClassInfo JSXSLTProcessor::s_info = { "XSLTProcessor", 0, 0, 0 };
-
-JSXSLTProcessor::JSXSLTProcessor(PassRefPtr<Structure> structure, PassRefPtr<XSLTProcessor> impl)
-    : DOMObject(structure)
-    , m_impl(impl)
-{
-}
-
-JSXSLTProcessor::~JSXSLTProcessor()
-{
-    forgetDOMObject(*Heap::heap(this)->globalData(), m_impl.get());
-
-}
-
-JSObject* JSXSLTProcessor::createPrototype(ExecState* exec)
-{
-    return new (exec) JSXSLTProcessorPrototype(JSXSLTProcessorPrototype::createStructure(exec->lexicalGlobalObject()->objectPrototype()));
-}
-
-JSValuePtr jsXSLTProcessorPrototypeFunctionImportStylesheet(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSXSLTProcessor::s_info))
-        return throwError(exec, TypeError);
-    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
-    return castedThisObj->importStylesheet(exec, args);
-}
-
-JSValuePtr jsXSLTProcessorPrototypeFunctionTransformToFragment(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSXSLTProcessor::s_info))
-        return throwError(exec, TypeError);
-    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
-    return castedThisObj->transformToFragment(exec, args);
-}
-
-JSValuePtr jsXSLTProcessorPrototypeFunctionTransformToDocument(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSXSLTProcessor::s_info))
-        return throwError(exec, TypeError);
-    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
-    return castedThisObj->transformToDocument(exec, args);
-}
-
-JSValuePtr jsXSLTProcessorPrototypeFunctionSetParameter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSXSLTProcessor::s_info))
-        return throwError(exec, TypeError);
-    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
-    return castedThisObj->setParameter(exec, args);
-}
-
-JSValuePtr jsXSLTProcessorPrototypeFunctionGetParameter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSXSLTProcessor::s_info))
-        return throwError(exec, TypeError);
-    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
-    return castedThisObj->getParameter(exec, args);
-}
-
-JSValuePtr jsXSLTProcessorPrototypeFunctionRemoveParameter(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSXSLTProcessor::s_info))
-        return throwError(exec, TypeError);
-    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
-    return castedThisObj->removeParameter(exec, args);
-}
-
-JSValuePtr jsXSLTProcessorPrototypeFunctionClearParameters(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSXSLTProcessor::s_info))
-        return throwError(exec, TypeError);
-    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
-    XSLTProcessor* imp = static_cast<XSLTProcessor*>(castedThisObj->impl());
-
-    imp->clearParameters();
-    return jsUndefined();
-}
-
-JSValuePtr jsXSLTProcessorPrototypeFunctionReset(ExecState* exec, JSObject*, JSValuePtr thisValue, const ArgList& args)
-{
-    if (!thisValue->isObject(&JSXSLTProcessor::s_info))
-        return throwError(exec, TypeError);
-    JSXSLTProcessor* castedThisObj = static_cast<JSXSLTProcessor*>(asObject(thisValue));
-    XSLTProcessor* imp = static_cast<XSLTProcessor*>(castedThisObj->impl());
-
-    imp->reset();
-    return jsUndefined();
-}
-
-JSC::JSValuePtr toJS(JSC::ExecState* exec, XSLTProcessor* object)
-{
-    return getDOMObjectWrapper<JSXSLTProcessor>(exec, object);
-}
-XSLTProcessor* toXSLTProcessor(JSC::JSValuePtr value)
-{
-    return value->isObject(&JSXSLTProcessor::s_info) ? static_cast<JSXSLTProcessor*>(asObject(value))->impl() : 0;
-}
-
-}
-
-#endif // ENABLE(XSLT)
diff --git a/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.h b/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.h
deleted file mode 100644
index 3a71388..0000000
--- a/src/3rdparty/webkit/WebCore/generated/JSXSLTProcessor.h
+++ /dev/null
@@ -1,89 +0,0 @@
-/*
-    This file is part of the WebKit open source project.
-    This file has been generated by generate-bindings.pl. DO NOT MODIFY!
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef JSXSLTProcessor_h
-#define JSXSLTProcessor_h
-
-
-#if ENABLE(XSLT)
-
-#include "JSDOMBinding.h"
-#include <runtime/JSGlobalObject.h>
-#include <runtime/ObjectPrototype.h>
-
-namespace WebCore {
-
-class XSLTProcessor;
-
-class JSXSLTProcessor : public DOMObject {
-    typedef DOMObject Base;
-public:
-    JSXSLTProcessor(PassRefPtr<JSC::Structure>, PassRefPtr<XSLTProcessor>);
-    virtual ~JSXSLTProcessor();
-    static JSC::JSObject* createPrototype(JSC::ExecState*);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-
-
-    // Custom functions
-    JSC::JSValuePtr importStylesheet(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr transformToFragment(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr transformToDocument(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr setParameter(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr getParameter(JSC::ExecState*, const JSC::ArgList&);
-    JSC::JSValuePtr removeParameter(JSC::ExecState*, const JSC::ArgList&);
-    XSLTProcessor* impl() const { return m_impl.get(); }
-
-private:
-    RefPtr<XSLTProcessor> m_impl;
-};
-
-JSC::JSValuePtr toJS(JSC::ExecState*, XSLTProcessor*);
-XSLTProcessor* toXSLTProcessor(JSC::JSValuePtr);
-
-class JSXSLTProcessorPrototype : public JSC::JSObject {
-public:
-    static JSC::JSObject* self(JSC::ExecState*);
-    virtual const JSC::ClassInfo* classInfo() const { return &s_info; }
-    static const JSC::ClassInfo s_info;
-    virtual bool getOwnPropertySlot(JSC::ExecState*, const JSC::Identifier&, JSC::PropertySlot&);
-    static PassRefPtr<JSC::Structure> createStructure(JSC::JSValuePtr prototype)
-    {
-        return JSC::Structure::create(prototype, JSC::TypeInfo(JSC::ObjectType));
-    }
-    JSXSLTProcessorPrototype(PassRefPtr<JSC::Structure> structure) : JSC::JSObject(structure) { }
-};
-
-// Functions
-
-JSC::JSValuePtr jsXSLTProcessorPrototypeFunctionImportStylesheet(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXSLTProcessorPrototypeFunctionTransformToFragment(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXSLTProcessorPrototypeFunctionTransformToDocument(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXSLTProcessorPrototypeFunctionSetParameter(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXSLTProcessorPrototypeFunctionGetParameter(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXSLTProcessorPrototypeFunctionRemoveParameter(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXSLTProcessorPrototypeFunctionClearParameters(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-JSC::JSValuePtr jsXSLTProcessorPrototypeFunctionReset(JSC::ExecState*, JSC::JSObject*, JSC::JSValuePtr, const JSC::ArgList&);
-
-} // namespace WebCore
-
-#endif // ENABLE(XSLT)
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/generated/Lexer.lut.h b/src/3rdparty/webkit/WebCore/generated/Lexer.lut.h
index 638f45a..4c46e07 100644
--- a/src/3rdparty/webkit/WebCore/generated/Lexer.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/Lexer.lut.h
@@ -45,10 +45,5 @@ static const struct HashTableValue mainTableValues[37] = {
 };
 
 extern const struct HashTable mainTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 1023, mainTableValues, 0 };
-#else
     { 133, 127, mainTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/MathObject.lut.h b/src/3rdparty/webkit/WebCore/generated/MathObject.lut.h
index cd8c507..c8359c1 100644
--- a/src/3rdparty/webkit/WebCore/generated/MathObject.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/MathObject.lut.h
@@ -27,10 +27,5 @@ static const struct HashTableValue mathTableValues[19] = {
 };
 
 extern const struct HashTable mathTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 511, mathTableValues, 0 };
-#else
     { 67, 63, mathTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/NumberConstructor.lut.h b/src/3rdparty/webkit/WebCore/generated/NumberConstructor.lut.h
index e726f5c..6879c03 100644
--- a/src/3rdparty/webkit/WebCore/generated/NumberConstructor.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/NumberConstructor.lut.h
@@ -14,10 +14,5 @@ static const struct HashTableValue numberTableValues[6] = {
 };
 
 extern const struct HashTable numberTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 15, numberTableValues, 0 };
-#else
     { 16, 15, numberTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/RegExpConstructor.lut.h b/src/3rdparty/webkit/WebCore/generated/RegExpConstructor.lut.h
index e9dfed2..0bdf10c 100644
--- a/src/3rdparty/webkit/WebCore/generated/RegExpConstructor.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/RegExpConstructor.lut.h
@@ -30,10 +30,5 @@ static const struct HashTableValue regExpConstructorTableValues[22] = {
 };
 
 extern const struct HashTable regExpConstructorTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 511, regExpConstructorTableValues, 0 };
-#else
     { 65, 63, regExpConstructorTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/RegExpObject.lut.h b/src/3rdparty/webkit/WebCore/generated/RegExpObject.lut.h
index 39230b9..69a745d 100644
--- a/src/3rdparty/webkit/WebCore/generated/RegExpObject.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/RegExpObject.lut.h
@@ -14,10 +14,5 @@ static const struct HashTableValue regExpTableValues[6] = {
 };
 
 extern const struct HashTable regExpTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 31, regExpTableValues, 0 };
-#else
     { 17, 15, regExpTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.cpp b/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.cpp
index c39dcc1..3b5318b 100644
--- a/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.cpp
@@ -49,29 +49,6 @@
 #include "SVGDefsElement.h"
 #include "SVGDescElement.h"
 #include "SVGEllipseElement.h"
-#include "SVGFEBlendElement.h"
-#include "SVGFEColorMatrixElement.h"
-#include "SVGFEComponentTransferElement.h"
-#include "SVGFECompositeElement.h"
-#include "SVGFEDiffuseLightingElement.h"
-#include "SVGFEDisplacementMapElement.h"
-#include "SVGFEDistantLightElement.h"
-#include "SVGFEFloodElement.h"
-#include "SVGFEFuncAElement.h"
-#include "SVGFEFuncBElement.h"
-#include "SVGFEFuncGElement.h"
-#include "SVGFEFuncRElement.h"
-#include "SVGFEGaussianBlurElement.h"
-#include "SVGFEImageElement.h"
-#include "SVGFEMergeElement.h"
-#include "SVGFEMergeNodeElement.h"
-#include "SVGFEOffsetElement.h"
-#include "SVGFEPointLightElement.h"
-#include "SVGFESpecularLightingElement.h"
-#include "SVGFESpotLightElement.h"
-#include "SVGFETileElement.h"
-#include "SVGFETurbulenceElement.h"
-#include "SVGFilterElement.h"
 #include "SVGFontElement.h"
 #include "SVGFontFaceElement.h"
 #include "SVGFontFaceFormatElement.h"
@@ -112,388 +89,278 @@
 #include "SVGViewElement.h"
 #include <wtf/HashMap.h>
 
-using namespace WebCore;
-
-typedef PassRefPtr<SVGElement> (*ConstructorFunction)(Document*, bool createdByParser);
-typedef WTF::HashMap<AtomicStringImpl*, ConstructorFunction> FunctionMap;
-
-static FunctionMap* gFunctionMap = 0;
-
 namespace WebCore {
 
-#if ENABLE(SVG)
-static PassRefPtr<SVGElement> aConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGAElement(SVGNames::aTag, doc);
-}
-
-static PassRefPtr<SVGElement> altGlyphConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGAltGlyphElement(SVGNames::altGlyphTag, doc);
-}
-
-static PassRefPtr<SVGElement> animateConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGAnimateElement(SVGNames::animateTag, doc);
-}
-
-static PassRefPtr<SVGElement> animateColorConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGAnimateColorElement(SVGNames::animateColorTag, doc);
-}
-
-static PassRefPtr<SVGElement> animateMotionConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGAnimateMotionElement(SVGNames::animateMotionTag, doc);
-}
-
-static PassRefPtr<SVGElement> animateTransformConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGAnimateTransformElement(SVGNames::animateTransformTag, doc);
-}
-
-static PassRefPtr<SVGElement> circleConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGCircleElement(SVGNames::circleTag, doc);
-}
-
-static PassRefPtr<SVGElement> clipPathConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGClipPathElement(SVGNames::clipPathTag, doc);
-}
-
-static PassRefPtr<SVGElement> cursorConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGCursorElement(SVGNames::cursorTag, doc);
-}
-
-static PassRefPtr<SVGElement> definition_srcConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGDefinitionSrcElement(SVGNames::definition_srcTag, doc);
-}
-
-static PassRefPtr<SVGElement> defsConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGDefsElement(SVGNames::defsTag, doc);
-}
-
-static PassRefPtr<SVGElement> descConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGDescElement(SVGNames::descTag, doc);
-}
-
-static PassRefPtr<SVGElement> ellipseConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGEllipseElement(SVGNames::ellipseTag, doc);
-}
-
-static PassRefPtr<SVGElement> feBlendConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGFEBlendElement(SVGNames::feBlendTag, doc);
-}
-
-static PassRefPtr<SVGElement> feColorMatrixConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGFEColorMatrixElement(SVGNames::feColorMatrixTag, doc);
-}
-
-static PassRefPtr<SVGElement> feComponentTransferConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGFEComponentTransferElement(SVGNames::feComponentTransferTag, doc);
-}
-
-static PassRefPtr<SVGElement> feCompositeConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGFECompositeElement(SVGNames::feCompositeTag, doc);
-}
-
-static PassRefPtr<SVGElement> feDiffuseLightingConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGFEDiffuseLightingElement(SVGNames::feDiffuseLightingTag, doc);
-}
-
-static PassRefPtr<SVGElement> feDisplacementMapConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGFEDisplacementMapElement(SVGNames::feDisplacementMapTag, doc);
-}
-
-static PassRefPtr<SVGElement> feDistantLightConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGFEDistantLightElement(SVGNames::feDistantLightTag, doc);
-}
+using namespace SVGNames;
 
-static PassRefPtr<SVGElement> feFloodConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGFEFloodElement(SVGNames::feFloodTag, doc);
-}
+typedef PassRefPtr<SVGElement> (*ConstructorFunction)(const QualifiedName&, Document*, bool createdByParser);
+typedef HashMap<AtomicStringImpl*, ConstructorFunction> FunctionMap;
 
-static PassRefPtr<SVGElement> feFuncAConstructor(Document* doc, bool createdByParser)
-{
-    return new SVGFEFuncAElement(SVGNames::feFuncATag, doc);
-}
+static FunctionMap* gFunctionMap = 0;
 
-static PassRefPtr<SVGElement> feFuncBConstructor(Document* doc, bool createdByParser)
+#if ENABLE(SVG)
+static PassRefPtr<SVGElement> aConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFEFuncBElement(SVGNames::feFuncBTag, doc);
+    return new SVGAElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> feFuncGConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> altglyphConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFEFuncGElement(SVGNames::feFuncGTag, doc);
+    return new SVGAltGlyphElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> feFuncRConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> animateConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFEFuncRElement(SVGNames::feFuncRTag, doc);
+    return new SVGAnimateElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> feGaussianBlurConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> animatecolorConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFEGaussianBlurElement(SVGNames::feGaussianBlurTag, doc);
+    return new SVGAnimateColorElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> feImageConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> animatemotionConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFEImageElement(SVGNames::feImageTag, doc);
+    return new SVGAnimateMotionElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> feMergeConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> animatetransformConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFEMergeElement(SVGNames::feMergeTag, doc);
+    return new SVGAnimateTransformElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> feMergeNodeConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> circleConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFEMergeNodeElement(SVGNames::feMergeNodeTag, doc);
+    return new SVGCircleElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> feOffsetConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> clippathConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFEOffsetElement(SVGNames::feOffsetTag, doc);
+    return new SVGClipPathElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> fePointLightConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> cursorConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFEPointLightElement(SVGNames::fePointLightTag, doc);
+    return new SVGCursorElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> feSpecularLightingConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> definitionsrcConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFESpecularLightingElement(SVGNames::feSpecularLightingTag, doc);
+    return new SVGDefinitionSrcElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> feSpotLightConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> defsConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFESpotLightElement(SVGNames::feSpotLightTag, doc);
+    return new SVGDefsElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> feTileConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> descConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFETileElement(SVGNames::feTileTag, doc);
+    return new SVGDescElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> feTurbulenceConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> ellipseConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFETurbulenceElement(SVGNames::feTurbulenceTag, doc);
+    return new SVGEllipseElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> filterConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> fontConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFilterElement(SVGNames::filterTag, doc);
+    return new SVGFontElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> fontConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> fontfaceConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFontElement(SVGNames::fontTag, doc);
+    return new SVGFontFaceElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> font_faceConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> fontfaceformatConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFontFaceElement(SVGNames::font_faceTag, doc);
+    return new SVGFontFaceFormatElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> font_face_formatConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> fontfacenameConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFontFaceFormatElement(SVGNames::font_face_formatTag, doc);
+    return new SVGFontFaceNameElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> font_face_nameConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> fontfacesrcConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFontFaceNameElement(SVGNames::font_face_nameTag, doc);
+    return new SVGFontFaceSrcElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> font_face_srcConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> fontfaceuriConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFontFaceSrcElement(SVGNames::font_face_srcTag, doc);
+    return new SVGFontFaceUriElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> font_face_uriConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> foreignobjectConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGFontFaceUriElement(SVGNames::font_face_uriTag, doc);
+    return new SVGForeignObjectElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> foreignObjectConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> gConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGForeignObjectElement(SVGNames::foreignObjectTag, doc);
+    return new SVGGElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> gConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> glyphConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGGElement(SVGNames::gTag, doc);
+    return new SVGGlyphElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> glyphConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> hkernConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGGlyphElement(SVGNames::glyphTag, doc);
+    return new SVGHKernElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> hkernConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> imageConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGHKernElement(SVGNames::hkernTag, doc);
+    return new SVGImageElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> imageConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> lineConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGImageElement(SVGNames::imageTag, doc);
+    return new SVGLineElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> lineConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> lineargradientConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGLineElement(SVGNames::lineTag, doc);
+    return new SVGLinearGradientElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> linearGradientConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> markerConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGLinearGradientElement(SVGNames::linearGradientTag, doc);
+    return new SVGMarkerElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> markerConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> maskConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGMarkerElement(SVGNames::markerTag, doc);
+    return new SVGMaskElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> maskConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> metadataConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGMaskElement(SVGNames::maskTag, doc);
+    return new SVGMetadataElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> metadataConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> missingglyphConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGMetadataElement(SVGNames::metadataTag, doc);
+    return new SVGMissingGlyphElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> missing_glyphConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> mpathConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGMissingGlyphElement(SVGNames::missing_glyphTag, doc);
+    return new SVGMPathElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> mpathConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> pathConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGMPathElement(SVGNames::mpathTag, doc);
+    return new SVGPathElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> pathConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> patternConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGPathElement(SVGNames::pathTag, doc);
+    return new SVGPatternElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> patternConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> polygonConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGPatternElement(SVGNames::patternTag, doc);
+    return new SVGPolygonElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> polygonConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> polylineConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGPolygonElement(SVGNames::polygonTag, doc);
+    return new SVGPolylineElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> polylineConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> radialgradientConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGPolylineElement(SVGNames::polylineTag, doc);
+    return new SVGRadialGradientElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> radialGradientConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> rectConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGRadialGradientElement(SVGNames::radialGradientTag, doc);
+    return new SVGRectElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> rectConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> scriptConstructor(const QualifiedName& tagName, Document* doc, bool createdByParser)
 {
-    return new SVGRectElement(SVGNames::rectTag, doc);
+    return new SVGScriptElement(tagName, doc, createdByParser);
 }
 
-static PassRefPtr<SVGElement> scriptConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> setConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGScriptElement(SVGNames::scriptTag, doc, createdByParser);
+    return new SVGSetElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> setConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> stopConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGSetElement(SVGNames::setTag, doc);
+    return new SVGStopElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> stopConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> styleConstructor(const QualifiedName& tagName, Document* doc, bool createdByParser)
 {
-    return new SVGStopElement(SVGNames::stopTag, doc);
+    return new SVGStyleElement(tagName, doc, createdByParser);
 }
 
-static PassRefPtr<SVGElement> styleConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> svgConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGStyleElement(SVGNames::styleTag, doc, createdByParser);
+    return new SVGSVGElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> svgConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> switchConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGSVGElement(SVGNames::svgTag, doc);
+    return new SVGSwitchElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> switchConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> symbolConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGSwitchElement(SVGNames::switchTag, doc);
+    return new SVGSymbolElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> symbolConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> textConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGSymbolElement(SVGNames::symbolTag, doc);
+    return new SVGTextElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> textConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> textpathConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGTextElement(SVGNames::textTag, doc);
+    return new SVGTextPathElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> textPathConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> titleConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGTextPathElement(SVGNames::textPathTag, doc);
+    return new SVGTitleElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> titleConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> trefConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGTitleElement(SVGNames::titleTag, doc);
+    return new SVGTRefElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> trefConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> tspanConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGTRefElement(SVGNames::trefTag, doc);
+    return new SVGTSpanElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> tspanConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> useConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGTSpanElement(SVGNames::tspanTag, doc);
+    return new SVGUseElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> useConstructor(Document* doc, bool createdByParser)
+static PassRefPtr<SVGElement> viewConstructor(const QualifiedName& tagName, Document* doc, bool)
 {
-    return new SVGUseElement(SVGNames::useTag, doc);
+    return new SVGViewElement(tagName, doc);
 }
 
-static PassRefPtr<SVGElement> viewConstructor(Document* doc, bool createdByParser)
+#endif
+#if ENABLE(SVG)
+static void addTag(const QualifiedName& tag, ConstructorFunction func)
 {
-    return new SVGViewElement(SVGNames::viewTag, doc);
+    gFunctionMap->set(tag.localName().impl(), func);
 }
 
-#endif
-#if ENABLE(SVG)
 static inline void createFunctionMapIfNecessary()
 {
     if (gFunctionMap)
@@ -502,80 +369,57 @@ static inline void createFunctionMapIfNecessary()
     gFunctionMap = new FunctionMap;
     
     // Populate it with constructor functions.
-    gFunctionMap->set(SVGNames::aTag.localName().impl(), aConstructor);
-    gFunctionMap->set(SVGNames::altGlyphTag.localName().impl(), altGlyphConstructor);
-    gFunctionMap->set(SVGNames::animateTag.localName().impl(), animateConstructor);
-    gFunctionMap->set(SVGNames::animateColorTag.localName().impl(), animateColorConstructor);
-    gFunctionMap->set(SVGNames::animateMotionTag.localName().impl(), animateMotionConstructor);
-    gFunctionMap->set(SVGNames::animateTransformTag.localName().impl(), animateTransformConstructor);
-    gFunctionMap->set(SVGNames::circleTag.localName().impl(), circleConstructor);
-    gFunctionMap->set(SVGNames::clipPathTag.localName().impl(), clipPathConstructor);
-    gFunctionMap->set(SVGNames::cursorTag.localName().impl(), cursorConstructor);
-    gFunctionMap->set(SVGNames::definition_srcTag.localName().impl(), definition_srcConstructor);
-    gFunctionMap->set(SVGNames::defsTag.localName().impl(), defsConstructor);
-    gFunctionMap->set(SVGNames::descTag.localName().impl(), descConstructor);
-    gFunctionMap->set(SVGNames::ellipseTag.localName().impl(), ellipseConstructor);
-    gFunctionMap->set(SVGNames::feBlendTag.localName().impl(), feBlendConstructor);
-    gFunctionMap->set(SVGNames::feColorMatrixTag.localName().impl(), feColorMatrixConstructor);
-    gFunctionMap->set(SVGNames::feComponentTransferTag.localName().impl(), feComponentTransferConstructor);
-    gFunctionMap->set(SVGNames::feCompositeTag.localName().impl(), feCompositeConstructor);
-    gFunctionMap->set(SVGNames::feDiffuseLightingTag.localName().impl(), feDiffuseLightingConstructor);
-    gFunctionMap->set(SVGNames::feDisplacementMapTag.localName().impl(), feDisplacementMapConstructor);
-    gFunctionMap->set(SVGNames::feDistantLightTag.localName().impl(), feDistantLightConstructor);
-    gFunctionMap->set(SVGNames::feFloodTag.localName().impl(), feFloodConstructor);
-    gFunctionMap->set(SVGNames::feFuncATag.localName().impl(), feFuncAConstructor);
-    gFunctionMap->set(SVGNames::feFuncBTag.localName().impl(), feFuncBConstructor);
-    gFunctionMap->set(SVGNames::feFuncGTag.localName().impl(), feFuncGConstructor);
-    gFunctionMap->set(SVGNames::feFuncRTag.localName().impl(), feFuncRConstructor);
-    gFunctionMap->set(SVGNames::feGaussianBlurTag.localName().impl(), feGaussianBlurConstructor);
-    gFunctionMap->set(SVGNames::feImageTag.localName().impl(), feImageConstructor);
-    gFunctionMap->set(SVGNames::feMergeTag.localName().impl(), feMergeConstructor);
-    gFunctionMap->set(SVGNames::feMergeNodeTag.localName().impl(), feMergeNodeConstructor);
-    gFunctionMap->set(SVGNames::feOffsetTag.localName().impl(), feOffsetConstructor);
-    gFunctionMap->set(SVGNames::fePointLightTag.localName().impl(), fePointLightConstructor);
-    gFunctionMap->set(SVGNames::feSpecularLightingTag.localName().impl(), feSpecularLightingConstructor);
-    gFunctionMap->set(SVGNames::feSpotLightTag.localName().impl(), feSpotLightConstructor);
-    gFunctionMap->set(SVGNames::feTileTag.localName().impl(), feTileConstructor);
-    gFunctionMap->set(SVGNames::feTurbulenceTag.localName().impl(), feTurbulenceConstructor);
-    gFunctionMap->set(SVGNames::filterTag.localName().impl(), filterConstructor);
-    gFunctionMap->set(SVGNames::fontTag.localName().impl(), fontConstructor);
-    gFunctionMap->set(SVGNames::font_faceTag.localName().impl(), font_faceConstructor);
-    gFunctionMap->set(SVGNames::font_face_formatTag.localName().impl(), font_face_formatConstructor);
-    gFunctionMap->set(SVGNames::font_face_nameTag.localName().impl(), font_face_nameConstructor);
-    gFunctionMap->set(SVGNames::font_face_srcTag.localName().impl(), font_face_srcConstructor);
-    gFunctionMap->set(SVGNames::font_face_uriTag.localName().impl(), font_face_uriConstructor);
-    gFunctionMap->set(SVGNames::foreignObjectTag.localName().impl(), foreignObjectConstructor);
-    gFunctionMap->set(SVGNames::gTag.localName().impl(), gConstructor);
-    gFunctionMap->set(SVGNames::glyphTag.localName().impl(), glyphConstructor);
-    gFunctionMap->set(SVGNames::hkernTag.localName().impl(), hkernConstructor);
-    gFunctionMap->set(SVGNames::imageTag.localName().impl(), imageConstructor);
-    gFunctionMap->set(SVGNames::lineTag.localName().impl(), lineConstructor);
-    gFunctionMap->set(SVGNames::linearGradientTag.localName().impl(), linearGradientConstructor);
-    gFunctionMap->set(SVGNames::markerTag.localName().impl(), markerConstructor);
-    gFunctionMap->set(SVGNames::maskTag.localName().impl(), maskConstructor);
-    gFunctionMap->set(SVGNames::metadataTag.localName().impl(), metadataConstructor);
-    gFunctionMap->set(SVGNames::missing_glyphTag.localName().impl(), missing_glyphConstructor);
-    gFunctionMap->set(SVGNames::mpathTag.localName().impl(), mpathConstructor);
-    gFunctionMap->set(SVGNames::pathTag.localName().impl(), pathConstructor);
-    gFunctionMap->set(SVGNames::patternTag.localName().impl(), patternConstructor);
-    gFunctionMap->set(SVGNames::polygonTag.localName().impl(), polygonConstructor);
-    gFunctionMap->set(SVGNames::polylineTag.localName().impl(), polylineConstructor);
-    gFunctionMap->set(SVGNames::radialGradientTag.localName().impl(), radialGradientConstructor);
-    gFunctionMap->set(SVGNames::rectTag.localName().impl(), rectConstructor);
-    gFunctionMap->set(SVGNames::scriptTag.localName().impl(), scriptConstructor);
-    gFunctionMap->set(SVGNames::setTag.localName().impl(), setConstructor);
-    gFunctionMap->set(SVGNames::stopTag.localName().impl(), stopConstructor);
-    gFunctionMap->set(SVGNames::styleTag.localName().impl(), styleConstructor);
-    gFunctionMap->set(SVGNames::svgTag.localName().impl(), svgConstructor);
-    gFunctionMap->set(SVGNames::switchTag.localName().impl(), switchConstructor);
-    gFunctionMap->set(SVGNames::symbolTag.localName().impl(), symbolConstructor);
-    gFunctionMap->set(SVGNames::textTag.localName().impl(), textConstructor);
-    gFunctionMap->set(SVGNames::textPathTag.localName().impl(), textPathConstructor);
-    gFunctionMap->set(SVGNames::titleTag.localName().impl(), titleConstructor);
-    gFunctionMap->set(SVGNames::trefTag.localName().impl(), trefConstructor);
-    gFunctionMap->set(SVGNames::tspanTag.localName().impl(), tspanConstructor);
-    gFunctionMap->set(SVGNames::useTag.localName().impl(), useConstructor);
-    gFunctionMap->set(SVGNames::viewTag.localName().impl(), viewConstructor);
+    addTag(aTag, aConstructor);
+    addTag(altGlyphTag, altglyphConstructor);
+    addTag(animateTag, animateConstructor);
+    addTag(animateColorTag, animatecolorConstructor);
+    addTag(animateMotionTag, animatemotionConstructor);
+    addTag(animateTransformTag, animatetransformConstructor);
+    addTag(circleTag, circleConstructor);
+    addTag(clipPathTag, clippathConstructor);
+    addTag(cursorTag, cursorConstructor);
+    addTag(definition_srcTag, definitionsrcConstructor);
+    addTag(defsTag, defsConstructor);
+    addTag(descTag, descConstructor);
+    addTag(ellipseTag, ellipseConstructor);
+    addTag(fontTag, fontConstructor);
+    addTag(font_faceTag, fontfaceConstructor);
+    addTag(font_face_formatTag, fontfaceformatConstructor);
+    addTag(font_face_nameTag, fontfacenameConstructor);
+    addTag(font_face_srcTag, fontfacesrcConstructor);
+    addTag(font_face_uriTag, fontfaceuriConstructor);
+    addTag(foreignObjectTag, foreignobjectConstructor);
+    addTag(gTag, gConstructor);
+    addTag(glyphTag, glyphConstructor);
+    addTag(hkernTag, hkernConstructor);
+    addTag(imageTag, imageConstructor);
+    addTag(lineTag, lineConstructor);
+    addTag(linearGradientTag, lineargradientConstructor);
+    addTag(markerTag, markerConstructor);
+    addTag(maskTag, maskConstructor);
+    addTag(metadataTag, metadataConstructor);
+    addTag(missing_glyphTag, missingglyphConstructor);
+    addTag(mpathTag, mpathConstructor);
+    addTag(pathTag, pathConstructor);
+    addTag(patternTag, patternConstructor);
+    addTag(polygonTag, polygonConstructor);
+    addTag(polylineTag, polylineConstructor);
+    addTag(radialGradientTag, radialgradientConstructor);
+    addTag(rectTag, rectConstructor);
+    addTag(scriptTag, scriptConstructor);
+    addTag(setTag, setConstructor);
+    addTag(stopTag, stopConstructor);
+    addTag(styleTag, styleConstructor);
+    addTag(svgTag, svgConstructor);
+    addTag(switchTag, switchConstructor);
+    addTag(symbolTag, symbolConstructor);
+    addTag(textTag, textConstructor);
+    addTag(textPathTag, textpathConstructor);
+    addTag(titleTag, titleConstructor);
+    addTag(trefTag, trefConstructor);
+    addTag(tspanTag, tspanConstructor);
+    addTag(useTag, useConstructor);
+    addTag(viewTag, viewConstructor);
 }
 #endif
 
@@ -591,12 +435,10 @@ PassRefPtr<SVGElement> SVGElementFactory::createSVGElement(const QualifiedName&
     if (settings && settings->usesDashboardBackwardCompatibilityMode())
         return 0;
 #endif
-
     createFunctionMapIfNecessary();
     ConstructorFunction func = gFunctionMap->get(qName.localName().impl());
     if (func)
-        return func(doc, createdByParser);
-
+        return func(qName, doc, createdByParser);
     return new SVGElement(qName, doc);
 #else
     return 0;
diff --git a/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.h b/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.h
index 9c48146..edbf308 100644
--- a/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.h
+++ b/src/3rdparty/webkit/WebCore/generated/SVGElementFactory.h
@@ -42,13 +42,12 @@ namespace WebCore {
 namespace WebCore {
 
     class SVGElement;
-
     // The idea behind this class is that there will eventually be a mapping from namespace URIs to ElementFactories that can dispense
     // elements. In a compound document world, the generic createElement function (will end up being virtual) will be called.
     class SVGElementFactory {
     public:
         PassRefPtr<Element> createElement(const WebCore::QualifiedName&, WebCore::Document*, bool createdByParser = true);
-        static PassRefPtr<SVGElement> createSVGElement(const WebCore::QualifiedName&, WebCore::Document*, bool createdByParser = true);
+        static PassRefPtr<SVGElement> createSVGElement(const WebCore::QualifiedName&, WebCore::Document*, bool /*createdByParser*/ = true);
     };
 }
 
diff --git a/src/3rdparty/webkit/WebCore/generated/SVGNames.cpp b/src/3rdparty/webkit/WebCore/generated/SVGNames.cpp
index 417d1f7..445a59f 100644
--- a/src/3rdparty/webkit/WebCore/generated/SVGNames.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/SVGNames.cpp
@@ -58,29 +58,6 @@ DEFINE_GLOBAL(QualifiedName, definition_srcTag, nullAtom, "definition_src", svgN
 DEFINE_GLOBAL(QualifiedName, defsTag, nullAtom, "defs", svgNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, descTag, nullAtom, "desc", svgNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, ellipseTag, nullAtom, "ellipse", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feBlendTag, nullAtom, "feBlend", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feColorMatrixTag, nullAtom, "feColorMatrix", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feComponentTransferTag, nullAtom, "feComponentTransfer", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feCompositeTag, nullAtom, "feComposite", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feDiffuseLightingTag, nullAtom, "feDiffuseLighting", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feDisplacementMapTag, nullAtom, "feDisplacementMap", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feDistantLightTag, nullAtom, "feDistantLight", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feFloodTag, nullAtom, "feFlood", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feFuncATag, nullAtom, "feFuncA", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feFuncBTag, nullAtom, "feFuncB", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feFuncGTag, nullAtom, "feFuncG", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feFuncRTag, nullAtom, "feFuncR", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feGaussianBlurTag, nullAtom, "feGaussianBlur", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feImageTag, nullAtom, "feImage", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feMergeTag, nullAtom, "feMerge", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feMergeNodeTag, nullAtom, "feMergeNode", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feOffsetTag, nullAtom, "feOffset", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, fePointLightTag, nullAtom, "fePointLight", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feSpecularLightingTag, nullAtom, "feSpecularLighting", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feSpotLightTag, nullAtom, "feSpotLight", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feTileTag, nullAtom, "feTile", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, feTurbulenceTag, nullAtom, "feTurbulence", svgNamespaceURI);
-DEFINE_GLOBAL(QualifiedName, filterTag, nullAtom, "filter", svgNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, fontTag, nullAtom, "font", svgNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, font_faceTag, nullAtom, "font_face", svgNamespaceURI);
 DEFINE_GLOBAL(QualifiedName, font_face_formatTag, nullAtom, "font_face_format", svgNamespaceURI);
@@ -137,29 +114,6 @@ WebCore::QualifiedName** getSVGTags(size_t* size)
         (WebCore::QualifiedName*)&defsTag,
         (WebCore::QualifiedName*)&descTag,
         (WebCore::QualifiedName*)&ellipseTag,
-        (WebCore::QualifiedName*)&feBlendTag,
-        (WebCore::QualifiedName*)&feColorMatrixTag,
-        (WebCore::QualifiedName*)&feComponentTransferTag,
-        (WebCore::QualifiedName*)&feCompositeTag,
-        (WebCore::QualifiedName*)&feDiffuseLightingTag,
-        (WebCore::QualifiedName*)&feDisplacementMapTag,
-        (WebCore::QualifiedName*)&feDistantLightTag,
-        (WebCore::QualifiedName*)&feFloodTag,
-        (WebCore::QualifiedName*)&feFuncATag,
-        (WebCore::QualifiedName*)&feFuncBTag,
-        (WebCore::QualifiedName*)&feFuncGTag,
-        (WebCore::QualifiedName*)&feFuncRTag,
-        (WebCore::QualifiedName*)&feGaussianBlurTag,
-        (WebCore::QualifiedName*)&feImageTag,
-        (WebCore::QualifiedName*)&feMergeTag,
-        (WebCore::QualifiedName*)&feMergeNodeTag,
-        (WebCore::QualifiedName*)&feOffsetTag,
-        (WebCore::QualifiedName*)&fePointLightTag,
-        (WebCore::QualifiedName*)&feSpecularLightingTag,
-        (WebCore::QualifiedName*)&feSpotLightTag,
-        (WebCore::QualifiedName*)&feTileTag,
-        (WebCore::QualifiedName*)&feTurbulenceTag,
-        (WebCore::QualifiedName*)&filterTag,
         (WebCore::QualifiedName*)&fontTag,
         (WebCore::QualifiedName*)&font_faceTag,
         (WebCore::QualifiedName*)&font_face_formatTag,
@@ -199,7 +153,7 @@ WebCore::QualifiedName** getSVGTags(size_t* size)
         (WebCore::QualifiedName*)&useTag,
         (WebCore::QualifiedName*)&viewTag,
     };
-    *size = 74;
+    *size = 51;
     return SVGTags;
 }
 
@@ -722,29 +676,6 @@ char definition_srcTagString[] = "definition-src";
 char defsTagString[] = "defs";
 char descTagString[] = "desc";
 char ellipseTagString[] = "ellipse";
-char feBlendTagString[] = "feBlend";
-char feColorMatrixTagString[] = "feColorMatrix";
-char feComponentTransferTagString[] = "feComponentTransfer";
-char feCompositeTagString[] = "feComposite";
-char feDiffuseLightingTagString[] = "feDiffuseLighting";
-char feDisplacementMapTagString[] = "feDisplacementMap";
-char feDistantLightTagString[] = "feDistantLight";
-char feFloodTagString[] = "feFlood";
-char feFuncATagString[] = "feFuncA";
-char feFuncBTagString[] = "feFuncB";
-char feFuncGTagString[] = "feFuncG";
-char feFuncRTagString[] = "feFuncR";
-char feGaussianBlurTagString[] = "feGaussianBlur";
-char feImageTagString[] = "feImage";
-char feMergeTagString[] = "feMerge";
-char feMergeNodeTagString[] = "feMergeNode";
-char feOffsetTagString[] = "feOffset";
-char fePointLightTagString[] = "fePointLight";
-char feSpecularLightingTagString[] = "feSpecularLighting";
-char feSpotLightTagString[] = "feSpotLight";
-char feTileTagString[] = "feTile";
-char feTurbulenceTagString[] = "feTurbulence";
-char filterTagString[] = "filter";
 char fontTagString[] = "font";
 char font_faceTagString[] = "font-face";
 char font_face_formatTagString[] = "font-face-format";
@@ -1062,29 +993,6 @@ void init()
     new ((void*)&defsTag) QualifiedName(nullAtom, defsTagString, svgNS);
     new ((void*)&descTag) QualifiedName(nullAtom, descTagString, svgNS);
     new ((void*)&ellipseTag) QualifiedName(nullAtom, ellipseTagString, svgNS);
-    new ((void*)&feBlendTag) QualifiedName(nullAtom, feBlendTagString, svgNS);
-    new ((void*)&feColorMatrixTag) QualifiedName(nullAtom, feColorMatrixTagString, svgNS);
-    new ((void*)&feComponentTransferTag) QualifiedName(nullAtom, feComponentTransferTagString, svgNS);
-    new ((void*)&feCompositeTag) QualifiedName(nullAtom, feCompositeTagString, svgNS);
-    new ((void*)&feDiffuseLightingTag) QualifiedName(nullAtom, feDiffuseLightingTagString, svgNS);
-    new ((void*)&feDisplacementMapTag) QualifiedName(nullAtom, feDisplacementMapTagString, svgNS);
-    new ((void*)&feDistantLightTag) QualifiedName(nullAtom, feDistantLightTagString, svgNS);
-    new ((void*)&feFloodTag) QualifiedName(nullAtom, feFloodTagString, svgNS);
-    new ((void*)&feFuncATag) QualifiedName(nullAtom, feFuncATagString, svgNS);
-    new ((void*)&feFuncBTag) QualifiedName(nullAtom, feFuncBTagString, svgNS);
-    new ((void*)&feFuncGTag) QualifiedName(nullAtom, feFuncGTagString, svgNS);
-    new ((void*)&feFuncRTag) QualifiedName(nullAtom, feFuncRTagString, svgNS);
-    new ((void*)&feGaussianBlurTag) QualifiedName(nullAtom, feGaussianBlurTagString, svgNS);
-    new ((void*)&feImageTag) QualifiedName(nullAtom, feImageTagString, svgNS);
-    new ((void*)&feMergeTag) QualifiedName(nullAtom, feMergeTagString, svgNS);
-    new ((void*)&feMergeNodeTag) QualifiedName(nullAtom, feMergeNodeTagString, svgNS);
-    new ((void*)&feOffsetTag) QualifiedName(nullAtom, feOffsetTagString, svgNS);
-    new ((void*)&fePointLightTag) QualifiedName(nullAtom, fePointLightTagString, svgNS);
-    new ((void*)&feSpecularLightingTag) QualifiedName(nullAtom, feSpecularLightingTagString, svgNS);
-    new ((void*)&feSpotLightTag) QualifiedName(nullAtom, feSpotLightTagString, svgNS);
-    new ((void*)&feTileTag) QualifiedName(nullAtom, feTileTagString, svgNS);
-    new ((void*)&feTurbulenceTag) QualifiedName(nullAtom, feTurbulenceTagString, svgNS);
-    new ((void*)&filterTag) QualifiedName(nullAtom, filterTagString, svgNS);
     new ((void*)&fontTag) QualifiedName(nullAtom, fontTagString, svgNS);
     new ((void*)&font_faceTag) QualifiedName(nullAtom, font_faceTagString, svgNS);
     new ((void*)&font_face_formatTag) QualifiedName(nullAtom, font_face_formatTagString, svgNS);
diff --git a/src/3rdparty/webkit/WebCore/generated/SVGNames.h b/src/3rdparty/webkit/WebCore/generated/SVGNames.h
index d7121d5..89703ff 100644
--- a/src/3rdparty/webkit/WebCore/generated/SVGNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/SVGNames.h
@@ -67,52 +67,6 @@ extern const WebCore::QualifiedName descTag;
 extern char descTagString[];
 extern const WebCore::QualifiedName ellipseTag;
 extern char ellipseTagString[];
-extern const WebCore::QualifiedName feBlendTag;
-extern char feBlendTagString[];
-extern const WebCore::QualifiedName feColorMatrixTag;
-extern char feColorMatrixTagString[];
-extern const WebCore::QualifiedName feComponentTransferTag;
-extern char feComponentTransferTagString[];
-extern const WebCore::QualifiedName feCompositeTag;
-extern char feCompositeTagString[];
-extern const WebCore::QualifiedName feDiffuseLightingTag;
-extern char feDiffuseLightingTagString[];
-extern const WebCore::QualifiedName feDisplacementMapTag;
-extern char feDisplacementMapTagString[];
-extern const WebCore::QualifiedName feDistantLightTag;
-extern char feDistantLightTagString[];
-extern const WebCore::QualifiedName feFloodTag;
-extern char feFloodTagString[];
-extern const WebCore::QualifiedName feFuncATag;
-extern char feFuncATagString[];
-extern const WebCore::QualifiedName feFuncBTag;
-extern char feFuncBTagString[];
-extern const WebCore::QualifiedName feFuncGTag;
-extern char feFuncGTagString[];
-extern const WebCore::QualifiedName feFuncRTag;
-extern char feFuncRTagString[];
-extern const WebCore::QualifiedName feGaussianBlurTag;
-extern char feGaussianBlurTagString[];
-extern const WebCore::QualifiedName feImageTag;
-extern char feImageTagString[];
-extern const WebCore::QualifiedName feMergeTag;
-extern char feMergeTagString[];
-extern const WebCore::QualifiedName feMergeNodeTag;
-extern char feMergeNodeTagString[];
-extern const WebCore::QualifiedName feOffsetTag;
-extern char feOffsetTagString[];
-extern const WebCore::QualifiedName fePointLightTag;
-extern char fePointLightTagString[];
-extern const WebCore::QualifiedName feSpecularLightingTag;
-extern char feSpecularLightingTagString[];
-extern const WebCore::QualifiedName feSpotLightTag;
-extern char feSpotLightTagString[];
-extern const WebCore::QualifiedName feTileTag;
-extern char feTileTagString[];
-extern const WebCore::QualifiedName feTurbulenceTag;
-extern char feTurbulenceTagString[];
-extern const WebCore::QualifiedName filterTag;
-extern char filterTagString[];
 extern const WebCore::QualifiedName fontTag;
 extern char fontTagString[];
 extern const WebCore::QualifiedName font_faceTag;
@@ -189,9 +143,6 @@ extern const WebCore::QualifiedName useTag;
 extern char useTagString[];
 extern const WebCore::QualifiedName viewTag;
 extern char viewTagString[];
-
-
-WebCore::QualifiedName** getSVGTags(size_t* size);
 // Attributes
 extern const WebCore::QualifiedName accent_heightAttr;
 extern char accent_heightAttrString[];
@@ -687,11 +638,11 @@ extern const WebCore::QualifiedName zAttr;
 extern char zAttrString[];
 extern const WebCore::QualifiedName zoomAndPanAttr;
 extern char zoomAndPanAttrString[];
-
-
-WebCore::QualifiedName** getSVGAttr(size_t* size);
 #endif
 
+WebCore::QualifiedName** getSVGTags(size_t* size);
+WebCore::QualifiedName** getSVGAttrs(size_t* size);
+
 void init();
 
 } }
diff --git a/src/3rdparty/webkit/WebCore/generated/StringPrototype.lut.h b/src/3rdparty/webkit/WebCore/generated/StringPrototype.lut.h
index b0298a6..aa044fa 100644
--- a/src/3rdparty/webkit/WebCore/generated/StringPrototype.lut.h
+++ b/src/3rdparty/webkit/WebCore/generated/StringPrototype.lut.h
@@ -41,10 +41,5 @@ static const struct HashTableValue stringTableValues[33] = {
 };
 
 extern const struct HashTable stringTable =
-#if ENABLE(PERFECT_HASH_SIZE)
-    { 2047, stringTableValues, 0 };
-#else
     { 71, 63, stringTableValues, 0 };
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
index c7711fa..6c53189 100644
--- a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
+++ b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheets.h
@@ -1,8 +1,8 @@
 namespace WebCore {
-extern const char html4UserAgentStyleSheet[8200];
+extern const char html4UserAgentStyleSheet[8585];
 extern const char quirksUserAgentStyleSheet[359];
 extern const char svgUserAgentStyleSheet[358];
-extern const char sourceUserAgentStyleSheet[2025];
+extern const char sourceUserAgentStyleSheet[2004];
 extern const char wmlUserAgentStyleSheet[2956];
-extern const char mediaControlsUserAgentStyleSheet[1587];
+extern const char mediaControlsUserAgentStyleSheet[1999];
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
index aa2a51e..efc6b9a 100644
--- a/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/UserAgentStyleSheetsData.cpp
@@ -1,5 +1,5 @@
 namespace WebCore {
-extern const char html4UserAgentStyleSheet[8200] = {
+extern const char html4UserAgentStyleSheet[8585] = {
     110, 97, 109, 101, 115, 112, 97, 99, 101, 32, 34, 104, 116, 116, 112, 58,
     47, 47, 119, 119, 119, 46, 119, 51, 46, 111, 114, 103, 47, 49, 57, 57,
     57, 47, 120, 104, 116, 109, 108, 34, 59, 32, 104, 116, 109, 108, 32, 123,
@@ -174,345 +174,369 @@ extern const char html4UserAgentStyleSheet[8200] = {
     32, 105, 110, 112, 117, 116, 44, 32, 116, 101, 120, 116, 97, 114, 101, 97,
     44, 32, 107, 101, 121, 103, 101, 110, 44, 32, 115, 101, 108, 101, 99, 116,
     44, 32, 98, 117, 116, 116, 111, 110, 44, 32, 105, 115, 105, 110, 100, 101,
-    120, 32, 123, 32, 109, 97, 114, 103, 105, 110, 58, 32, 48, 95, 95, 113,
-    101, 109, 59, 32, 102, 111, 110, 116, 58, 32, 45, 119, 101, 98, 107, 105,
-    116, 45, 115, 109, 97, 108, 108, 45, 99, 111, 110, 116, 114, 111, 108, 59,
-    32, 99, 111, 108, 111, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59,
-    32, 108, 101, 116, 116, 101, 114, 45, 115, 112, 97, 99, 105, 110, 103, 58,
-    32, 110, 111, 114, 109, 97, 108, 59, 32, 119, 111, 114, 100, 45, 115, 112,
-    97, 99, 105, 110, 103, 58, 32, 110, 111, 114, 109, 97, 108, 59, 32, 108,
-    105, 110, 101, 45, 104, 101, 105, 103, 104, 116, 58, 32, 110, 111, 114, 109,
-    97, 108, 59, 32, 116, 101, 120, 116, 45, 116, 114, 97, 110, 115, 102, 111,
-    114, 109, 58, 32, 110, 111, 110, 101, 59, 32, 116, 101, 120, 116, 45, 105,
-    110, 100, 101, 110, 116, 58, 32, 48, 59, 32, 116, 101, 120, 116, 45, 115,
-    104, 97, 100, 111, 119, 58, 32, 110, 111, 110, 101, 59, 32, 100, 105, 115,
-    112, 108, 97, 121, 58, 32, 105, 110, 108, 105, 110, 101, 45, 98, 108, 111,
-    99, 107, 59, 32, 116, 101, 120, 116, 45, 97, 108, 105, 103, 110, 58, 32,
-    45, 119, 101, 98, 107, 105, 116, 45, 97, 117, 116, 111, 59, 32, 125, 32,
-    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 104, 105, 100, 100,
-    101, 110, 34, 93, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
-    110, 111, 110, 101, 32, 125, 32, 105, 110, 112, 117, 116, 44, 32, 105, 110,
-    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 112, 97, 115, 115, 119, 111,
-    114, 100, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 115, 101, 97, 114, 99, 104, 34, 93, 44, 32, 105, 115, 105, 110,
-    100, 101, 120, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112,
-    112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 116, 101, 120, 116, 102, 105,
-    101, 108, 100, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 49, 112,
-    120, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111,
-    108, 111, 114, 58, 32, 119, 104, 105, 116, 101, 59, 32, 98, 111, 114, 100,
-    101, 114, 58, 32, 50, 112, 120, 32, 105, 110, 115, 101, 116, 59, 32, 45,
-    119, 101, 98, 107, 105, 116, 45, 114, 116, 108, 45, 111, 114, 100, 101, 114,
-    105, 110, 103, 58, 32, 108, 111, 103, 105, 99, 97, 108, 59, 32, 45, 119,
-    101, 98, 107, 105, 116, 45, 117, 115, 101, 114, 45, 115, 101, 108, 101, 99,
-    116, 58, 32, 116, 101, 120, 116, 59, 32, 99, 117, 114, 115, 111, 114, 58,
-    32, 97, 117, 116, 111, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116,
-    121, 112, 101, 61, 34, 115, 101, 97, 114, 99, 104, 34, 93, 32, 123, 32,
+    120, 44, 32, 100, 97, 116, 97, 103, 114, 105, 100, 32, 123, 32, 109, 97,
+    114, 103, 105, 110, 58, 32, 48, 95, 95, 113, 101, 109, 59, 32, 102, 111,
+    110, 116, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 115, 109, 97, 108,
+    108, 45, 99, 111, 110, 116, 114, 111, 108, 59, 32, 99, 111, 108, 111, 114,
+    58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 108, 101, 116, 116, 101,
+    114, 45, 115, 112, 97, 99, 105, 110, 103, 58, 32, 110, 111, 114, 109, 97,
+    108, 59, 32, 119, 111, 114, 100, 45, 115, 112, 97, 99, 105, 110, 103, 58,
+    32, 110, 111, 114, 109, 97, 108, 59, 32, 108, 105, 110, 101, 45, 104, 101,
+    105, 103, 104, 116, 58, 32, 110, 111, 114, 109, 97, 108, 59, 32, 116, 101,
+    120, 116, 45, 116, 114, 97, 110, 115, 102, 111, 114, 109, 58, 32, 110, 111,
+    110, 101, 59, 32, 116, 101, 120, 116, 45, 105, 110, 100, 101, 110, 116, 58,
+    32, 48, 59, 32, 116, 101, 120, 116, 45, 115, 104, 97, 100, 111, 119, 58,
+    32, 110, 111, 110, 101, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
+    105, 110, 108, 105, 110, 101, 45, 98, 108, 111, 99, 107, 59, 32, 116, 101,
+    120, 116, 45, 97, 108, 105, 103, 110, 58, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 97, 117, 116, 111, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91,
+    116, 121, 112, 101, 61, 34, 104, 105, 100, 100, 101, 110, 34, 93, 32, 123,
+    32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 32, 125,
+    32, 105, 110, 112, 117, 116, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
+    112, 101, 61, 34, 112, 97, 115, 115, 119, 111, 114, 100, 34, 93, 44, 32,
+    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 101, 97, 114,
+    99, 104, 34, 93, 44, 32, 105, 115, 105, 110, 100, 101, 120, 32, 123, 32,
     45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110,
-    99, 101, 58, 32, 115, 101, 97, 114, 99, 104, 102, 105, 101, 108, 100, 59,
-    32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122,
-    105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 59,
+    99, 101, 58, 32, 116, 101, 120, 116, 102, 105, 101, 108, 100, 59, 32, 112,
+    97, 100, 100, 105, 110, 103, 58, 32, 49, 112, 120, 59, 32, 98, 97, 99,
+    107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 119,
+    104, 105, 116, 101, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 50, 112,
+    120, 32, 105, 110, 115, 101, 116, 59, 32, 45, 119, 101, 98, 107, 105, 116,
+    45, 114, 116, 108, 45, 111, 114, 100, 101, 114, 105, 110, 103, 58, 32, 108,
+    111, 103, 105, 99, 97, 108, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45,
+    117, 115, 101, 114, 45, 115, 101, 108, 101, 99, 116, 58, 32, 116, 101, 120,
+    116, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 97, 117, 116, 111, 59,
     32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115,
-    101, 97, 114, 99, 104, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116,
-    45, 115, 101, 97, 114, 99, 104, 45, 99, 97, 110, 99, 101, 108, 45, 98,
-    117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45,
-    97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 115, 101, 97, 114,
-    99, 104, 102, 105, 101, 108, 100, 45, 99, 97, 110, 99, 101, 108, 45, 98,
-    117, 116, 116, 111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32,
-    105, 110, 108, 105, 110, 101, 45, 98, 108, 111, 99, 107, 59, 32, 125, 32,
-    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 101, 97, 114,
-    99, 104, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 115, 101,
-    97, 114, 99, 104, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111, 110, 32,
+    101, 97, 114, 99, 104, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 115, 101,
+    97, 114, 99, 104, 102, 105, 101, 108, 100, 59, 32, 45, 119, 101, 98, 107,
+    105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105, 110, 103, 58, 32, 98,
+    111, 114, 100, 101, 114, 45, 98, 111, 120, 59, 32, 125, 32, 105, 110, 112,
+    117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 101, 97, 114, 99, 104, 34,
+    93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 115, 101, 97, 114, 99,
+    104, 45, 99, 97, 110, 99, 101, 108, 45, 98, 117, 116, 116, 111, 110, 32,
     123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114,
     97, 110, 99, 101, 58, 32, 115, 101, 97, 114, 99, 104, 102, 105, 101, 108,
-    100, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111, 110, 59, 32, 100, 105,
+    100, 45, 99, 97, 110, 99, 101, 108, 45, 98, 117, 116, 116, 111, 110, 59,
+    32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105, 110, 101,
+    45, 98, 108, 111, 99, 107, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91,
+    116, 121, 112, 101, 61, 34, 115, 101, 97, 114, 99, 104, 34, 93, 58, 58,
+    45, 119, 101, 98, 107, 105, 116, 45, 115, 101, 97, 114, 99, 104, 45, 100,
+    101, 99, 111, 114, 97, 116, 105, 111, 110, 32, 123, 32, 45, 119, 101, 98,
+    107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32,
+    115, 101, 97, 114, 99, 104, 102, 105, 101, 108, 100, 45, 100, 101, 99, 111,
+    114, 97, 116, 105, 111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58,
+    32, 105, 110, 108, 105, 110, 101, 45, 98, 108, 111, 99, 107, 59, 32, 125,
+    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 101, 97,
+    114, 99, 104, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 115,
+    101, 97, 114, 99, 104, 45, 114, 101, 115, 117, 108, 116, 115, 45, 100, 101,
+    99, 111, 114, 97, 116, 105, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107,
+    105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 115,
+    101, 97, 114, 99, 104, 102, 105, 101, 108, 100, 45, 114, 101, 115, 117, 108,
+    116, 115, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111, 110, 59, 32, 100,
+    105, 115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105, 110, 101, 45, 98,
+    108, 111, 99, 107, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121,
+    112, 101, 61, 34, 115, 101, 97, 114, 99, 104, 34, 93, 58, 58, 45, 119,
+    101, 98, 107, 105, 116, 45, 115, 101, 97, 114, 99, 104, 45, 114, 101, 115,
+    117, 108, 116, 115, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119,
+    101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101,
+    58, 32, 115, 101, 97, 114, 99, 104, 102, 105, 101, 108, 100, 45, 114, 101,
+    115, 117, 108, 116, 115, 45, 98, 117, 116, 116, 111, 110, 59, 32, 100, 105,
     115, 112, 108, 97, 121, 58, 32, 105, 110, 108, 105, 110, 101, 45, 98, 108,
-    111, 99, 107, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
-    101, 61, 34, 115, 101, 97, 114, 99, 104, 34, 93, 58, 58, 45, 119, 101,
-    98, 107, 105, 116, 45, 115, 101, 97, 114, 99, 104, 45, 114, 101, 115, 117,
-    108, 116, 115, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111, 110, 32, 123,
-    32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97,
-    110, 99, 101, 58, 32, 115, 101, 97, 114, 99, 104, 102, 105, 101, 108, 100,
-    45, 114, 101, 115, 117, 108, 116, 115, 45, 100, 101, 99, 111, 114, 97, 116,
-    105, 111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 105, 110,
-    108, 105, 110, 101, 45, 98, 108, 111, 99, 107, 59, 32, 125, 32, 105, 110,
-    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 101, 97, 114, 99, 104,
-    34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 115, 101, 97, 114,
-    99, 104, 45, 114, 101, 115, 117, 108, 116, 115, 45, 98, 117, 116, 116, 111,
-    110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
-    97, 114, 97, 110, 99, 101, 58, 32, 115, 101, 97, 114, 99, 104, 102, 105,
-    101, 108, 100, 45, 114, 101, 115, 117, 108, 116, 115, 45, 98, 117, 116, 116,
-    111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 105, 110, 108,
-    105, 110, 101, 45, 98, 108, 111, 99, 107, 59, 32, 125, 32, 116, 101, 120,
-    116, 97, 114, 101, 97, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45,
-    97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 116, 101, 120, 116,
-    97, 114, 101, 97, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100,
-    45, 99, 111, 108, 111, 114, 58, 32, 119, 104, 105, 116, 101, 59, 32, 98,
-    111, 114, 100, 101, 114, 58, 32, 49, 112, 120, 32, 115, 111, 108, 105, 100,
-    59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 114, 116, 108, 45, 111, 114,
-    100, 101, 114, 105, 110, 103, 58, 32, 108, 111, 103, 105, 99, 97, 108, 59,
-    32, 45, 119, 101, 98, 107, 105, 116, 45, 117, 115, 101, 114, 45, 115, 101,
-    108, 101, 99, 116, 58, 32, 116, 101, 120, 116, 59, 32, 45, 119, 101, 98,
-    107, 105, 116, 45, 98, 111, 120, 45, 111, 114, 105, 101, 110, 116, 58, 32,
-    118, 101, 114, 116, 105, 99, 97, 108, 59, 32, 114, 101, 115, 105, 122, 101,
-    58, 32, 97, 117, 116, 111, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32,
-    97, 117, 116, 111, 59, 32, 125, 32, 105, 110, 112, 117, 116, 58, 58, 45,
-    119, 101, 98, 107, 105, 116, 45, 105, 110, 112, 117, 116, 45, 112, 108, 97,
-    99, 101, 104, 111, 108, 100, 101, 114, 32, 123, 32, 99, 111, 108, 111, 114,
-    58, 32, 100, 97, 114, 107, 71, 114, 97, 121, 59, 32, 125, 32, 105, 110,
-    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 112, 97, 115, 115, 119, 111,
-    114, 100, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 116,
-    101, 120, 116, 45, 115, 101, 99, 117, 114, 105, 116, 121, 58, 32, 100, 105,
-    115, 99, 32, 33, 105, 109, 112, 111, 114, 116, 97, 110, 116, 59, 32, 125,
-    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 104, 105, 100,
-    100, 101, 110, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
-    101, 61, 34, 105, 109, 97, 103, 101, 34, 93, 44, 32, 105, 110, 112, 117,
-    116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 32, 123,
-    32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97,
-    110, 99, 101, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 112, 97,
-    100, 100, 105, 110, 103, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32,
+    111, 99, 107, 59, 32, 125, 32, 116, 101, 120, 116, 97, 114, 101, 97, 32,
+    123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114,
+    97, 110, 99, 101, 58, 32, 116, 101, 120, 116, 97, 114, 101, 97, 59, 32,
     98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114,
-    58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 98, 111, 114, 100, 101,
-    114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 125, 32, 105, 110,
-    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93,
-    32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 97,
-    108, 105, 103, 110, 58, 32, 98, 97, 115, 101, 108, 105, 110, 101, 59, 32,
-    116, 101, 120, 116, 45, 97, 108, 105, 103, 110, 58, 32, 115, 116, 97, 114,
-    116, 32, 33, 105, 109, 112, 111, 114, 116, 97, 110, 116, 59, 32, 125, 32,
-    105, 110, 112, 117, 116, 58, 45, 119, 101, 98, 107, 105, 116, 45, 97, 117,
-    116, 111, 102, 105, 108, 108, 32, 123, 32, 98, 97, 99, 107, 103, 114, 111,
-    117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 98, 97, 99, 107, 103,
-    114, 111, 117, 110, 100, 45, 105, 109, 97, 103, 101, 58, 110, 111, 110, 101,
-    32, 33, 105, 109, 112, 111, 114, 116, 97, 110, 116, 59, 32, 125, 32, 105,
-    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97, 100, 105, 111,
-    34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
-    99, 104, 101, 99, 107, 98, 111, 120, 34, 93, 32, 123, 32, 109, 97, 114,
-    103, 105, 110, 58, 32, 51, 112, 120, 32, 48, 46, 53, 101, 120, 59, 32,
-    112, 97, 100, 100, 105, 110, 103, 58, 32, 105, 110, 105, 116, 105, 97, 108,
-    59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108,
-    111, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 98, 111, 114,
-    100, 101, 114, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 125, 32,
-    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98, 117, 116, 116,
-    111, 110, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 44, 32, 105, 110, 112, 117,
-    116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93, 44,
-    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108,
-    101, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108,
-    101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 32,
+    58, 32, 119, 104, 105, 116, 101, 59, 32, 98, 111, 114, 100, 101, 114, 58,
+    32, 49, 112, 120, 32, 115, 111, 108, 105, 100, 59, 32, 45, 119, 101, 98,
+    107, 105, 116, 45, 114, 116, 108, 45, 111, 114, 100, 101, 114, 105, 110, 103,
+    58, 32, 108, 111, 103, 105, 99, 97, 108, 59, 32, 45, 119, 101, 98, 107,
+    105, 116, 45, 117, 115, 101, 114, 45, 115, 101, 108, 101, 99, 116, 58, 32,
+    116, 101, 120, 116, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
+    120, 45, 111, 114, 105, 101, 110, 116, 58, 32, 118, 101, 114, 116, 105, 99,
+    97, 108, 59, 32, 114, 101, 115, 105, 122, 101, 58, 32, 97, 117, 116, 111,
+    59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 97, 117, 116, 111, 59, 32,
+    112, 97, 100, 100, 105, 110, 103, 58, 32, 50, 112, 120, 59, 32, 125, 32,
+    105, 110, 112, 117, 116, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 105,
+    110, 112, 117, 116, 45, 112, 108, 97, 99, 101, 104, 111, 108, 100, 101, 114,
+    44, 32, 105, 115, 105, 110, 100, 101, 120, 58, 58, 45, 119, 101, 98, 107,
+    105, 116, 45, 105, 110, 112, 117, 116, 45, 112, 108, 97, 99, 101, 104, 111,
+    108, 100, 101, 114, 32, 123, 32, 99, 111, 108, 111, 114, 58, 32, 100, 97,
+    114, 107, 71, 114, 97, 121, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91,
+    116, 121, 112, 101, 61, 34, 112, 97, 115, 115, 119, 111, 114, 100, 34, 93,
+    32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 116, 101, 120, 116, 45,
+    115, 101, 99, 117, 114, 105, 116, 121, 58, 32, 100, 105, 115, 99, 32, 33,
+    105, 109, 112, 111, 114, 116, 97, 110, 116, 59, 32, 125, 32, 105, 110, 112,
+    117, 116, 91, 116, 121, 112, 101, 61, 34, 104, 105, 100, 100, 101, 110, 34,
+    93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 105,
+    109, 97, 103, 101, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
+    112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 32, 123, 32, 45, 119, 101,
+    98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58,
+    32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 112, 97, 100, 100, 105, 110,
+    103, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 98, 97, 99, 107,
+    103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 105, 110,
+    105, 116, 105, 97, 108, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 105,
+    110, 105, 116, 105, 97, 108, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91,
+    116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 32, 123, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 97, 108, 105, 103, 110,
+    58, 32, 98, 97, 115, 101, 108, 105, 110, 101, 59, 32, 116, 101, 120, 116,
+    45, 97, 108, 105, 103, 110, 58, 32, 115, 116, 97, 114, 116, 32, 33, 105,
+    109, 112, 111, 114, 116, 97, 110, 116, 59, 32, 125, 32, 105, 110, 112, 117,
+    116, 58, 45, 119, 101, 98, 107, 105, 116, 45, 97, 117, 116, 111, 102, 105,
+    108, 108, 32, 123, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45,
+    99, 111, 108, 111, 114, 58, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110,
+    100, 45, 105, 109, 97, 103, 101, 58, 110, 111, 110, 101, 32, 33, 105, 109,
+    112, 111, 114, 116, 97, 110, 116, 59, 32, 125, 32, 105, 110, 112, 117, 116,
+    91, 116, 121, 112, 101, 61, 34, 114, 97, 100, 105, 111, 34, 93, 44, 32,
+    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 99, 104, 101, 99,
+    107, 98, 111, 120, 34, 93, 32, 123, 32, 109, 97, 114, 103, 105, 110, 58,
+    32, 51, 112, 120, 32, 48, 46, 53, 101, 120, 59, 32, 112, 97, 100, 100,
+    105, 110, 103, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 98, 97,
+    99, 107, 103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32,
+    105, 110, 105, 116, 105, 97, 108, 59, 32, 98, 111, 114, 100, 101, 114, 58,
+    32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 125, 32, 105, 110, 112, 117,
+    116, 91, 116, 121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93,
+    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 117,
+    98, 109, 105, 116, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
+    112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93, 44, 32, 105, 110, 112,
+    117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 58,
+    58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112,
+    108, 111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119,
+    101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101,
+    58, 32, 112, 117, 115, 104, 45, 98, 117, 116, 116, 111, 110, 59, 32, 119,
+    104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 112, 114, 101, 32,
+    125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98, 117,
+    116, 116, 111, 110, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
+    112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 44, 32, 105, 110,
+    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116, 34,
+    93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102,
+    105, 108, 101, 34, 93, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102,
+    105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116, 111,
+    110, 44, 32, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98,
+    107, 105, 116, 45, 98, 111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 99,
+    101, 110, 116, 101, 114, 59, 32, 116, 101, 120, 116, 45, 97, 108, 105, 103,
+    110, 58, 32, 99, 101, 110, 116, 101, 114, 59, 32, 99, 117, 114, 115, 111,
+    114, 58, 32, 100, 101, 102, 97, 117, 108, 116, 59, 32, 99, 111, 108, 111,
+    114, 58, 32, 66, 117, 116, 116, 111, 110, 84, 101, 120, 116, 59, 32, 112,
+    97, 100, 100, 105, 110, 103, 58, 32, 50, 112, 120, 32, 54, 112, 120, 32,
+    51, 112, 120, 32, 54, 112, 120, 59, 32, 98, 111, 114, 100, 101, 114, 58,
+    32, 50, 112, 120, 32, 111, 117, 116, 115, 101, 116, 32, 66, 117, 116, 116,
+    111, 110, 70, 97, 99, 101, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117,
+    110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 66, 117, 116, 116, 111, 110,
+    70, 97, 99, 101, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
+    120, 45, 115, 105, 122, 105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114,
+    45, 98, 111, 120, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
+    101, 61, 34, 114, 97, 110, 103, 101, 34, 93, 32, 123, 32, 45, 119, 101,
+    98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58,
+    32, 115, 108, 105, 100, 101, 114, 45, 104, 111, 114, 105, 122, 111, 110, 116,
+    97, 108, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 105, 110, 105,
+    116, 105, 97, 108, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 105, 110,
+    105, 116, 105, 97, 108, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 50,
+    112, 120, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
+    61, 34, 114, 97, 110, 103, 101, 34, 93, 58, 58, 45, 119, 101, 98, 107,
+    105, 116, 45, 115, 108, 105, 100, 101, 114, 45, 116, 104, 117, 109, 98, 32,
     123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114,
-    97, 110, 99, 101, 58, 32, 112, 117, 115, 104, 45, 98, 117, 116, 116, 111,
-    110, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32,
-    112, 114, 101, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 44, 32, 105, 110, 112, 117,
-    116, 91, 116, 121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93,
-    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101,
-    115, 101, 116, 34, 93, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
-    101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 58, 45, 119, 101, 98, 107,
-    105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98,
-    117, 116, 116, 111, 110, 44, 32, 98, 117, 116, 116, 111, 110, 32, 123, 32,
-    45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 97, 108, 105, 103,
-    110, 58, 32, 99, 101, 110, 116, 101, 114, 59, 32, 116, 101, 120, 116, 45,
-    97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116, 101, 114, 59, 32, 99,
-    117, 114, 115, 111, 114, 58, 32, 100, 101, 102, 97, 117, 108, 116, 59, 32,
-    99, 111, 108, 111, 114, 58, 32, 66, 117, 116, 116, 111, 110, 84, 101, 120,
-    116, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 50, 112, 120, 32,
-    54, 112, 120, 32, 51, 112, 120, 32, 54, 112, 120, 59, 32, 98, 111, 114,
-    100, 101, 114, 58, 32, 50, 112, 120, 32, 111, 117, 116, 115, 101, 116, 32,
-    66, 117, 116, 116, 111, 110, 70, 97, 99, 101, 59, 32, 98, 97, 99, 107,
-    103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 66, 117,
-    116, 116, 111, 110, 70, 97, 99, 101, 59, 32, 45, 119, 101, 98, 107, 105,
-    116, 45, 98, 111, 120, 45, 115, 105, 122, 105, 110, 103, 58, 32, 98, 111,
-    114, 100, 101, 114, 45, 98, 111, 120, 32, 125, 32, 105, 110, 112, 117, 116,
-    91, 116, 121, 112, 101, 61, 34, 114, 97, 110, 103, 101, 34, 93, 32, 123,
+    97, 110, 99, 101, 58, 32, 115, 108, 105, 100, 101, 114, 116, 104, 117, 109,
+    98, 45, 104, 111, 114, 105, 122, 111, 110, 116, 97, 108, 59, 32, 125, 32,
+    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98, 117, 116, 116,
+    111, 110, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105,
+    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 117, 98, 109, 105,
+    116, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110,
+    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116, 34,
+    93, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117,
+    116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 100,
+    105, 115, 97, 98, 108, 101, 100, 58, 58, 45, 119, 101, 98, 107, 105, 116,
+    45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117, 116,
+    116, 111, 110, 44, 32, 98, 117, 116, 116, 111, 110, 58, 100, 105, 115, 97,
+    98, 108, 101, 100, 44, 32, 115, 101, 108, 101, 99, 116, 58, 100, 105, 115,
+    97, 98, 108, 101, 100, 44, 32, 107, 101, 121, 103, 101, 110, 58, 100, 105,
+    115, 97, 98, 108, 101, 100, 44, 32, 111, 112, 116, 103, 114, 111, 117, 112,
+    58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 111, 112, 116, 105, 111,
+    110, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 100, 97, 116, 97,
+    103, 114, 105, 100, 58, 100, 105, 115, 97, 98, 108, 101, 100, 32, 123, 32,
+    99, 111, 108, 111, 114, 58, 32, 71, 114, 97, 121, 84, 101, 120, 116, 32,
+    125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98, 117,
+    116, 116, 111, 110, 34, 93, 58, 97, 99, 116, 105, 118, 101, 44, 32, 105,
+    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 117, 98, 109, 105,
+    116, 34, 93, 58, 97, 99, 116, 105, 118, 101, 44, 32, 105, 110, 112, 117,
+    116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93, 58,
+    97, 99, 116, 105, 118, 101, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
+    112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 97, 99, 116, 105, 118,
+    101, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108, 101, 45,
+    117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 44, 32, 98,
+    117, 116, 116, 111, 110, 58, 97, 99, 116, 105, 118, 101, 32, 123, 32, 98,
+    111, 114, 100, 101, 114, 45, 115, 116, 121, 108, 101, 58, 32, 105, 110, 115,
+    101, 116, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
+    34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 97, 99, 116, 105, 118, 101,
+    58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116,
+    91, 116, 121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58,
+    97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44,
+    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115,
+    101, 116, 34, 93, 58, 97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97,
+    98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
+    61, 34, 102, 105, 108, 101, 34, 93, 58, 97, 99, 116, 105, 118, 101, 58,
+    100, 105, 115, 97, 98, 108, 101, 100, 58, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117,
+    116, 116, 111, 110, 44, 32, 98, 117, 116, 116, 111, 110, 58, 97, 99, 116,
+    105, 118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100, 32, 123, 32, 98,
+    111, 114, 100, 101, 114, 45, 115, 116, 121, 108, 101, 58, 32, 111, 117, 116,
+    115, 101, 116, 32, 125, 32, 97, 114, 101, 97, 44, 32, 112, 97, 114, 97,
+    109, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110,
+    101, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
+    99, 104, 101, 99, 107, 98, 111, 120, 34, 93, 32, 123, 32, 45, 119, 101,
+    98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58,
+    32, 99, 104, 101, 99, 107, 98, 111, 120, 59, 32, 45, 119, 101, 98, 107,
+    105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105, 110, 103, 58, 32, 98,
+    111, 114, 100, 101, 114, 45, 98, 111, 120, 59, 32, 125, 32, 105, 110, 112,
+    117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97, 100, 105, 111, 34, 93,
+    32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97,
+    114, 97, 110, 99, 101, 58, 32, 114, 97, 100, 105, 111, 59, 32, 45, 119,
+    101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105, 110, 103,
+    58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 59, 32, 125, 32,
+    107, 101, 121, 103, 101, 110, 44, 32, 115, 101, 108, 101, 99, 116, 32, 123,
     32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97,
-    110, 99, 101, 58, 32, 115, 108, 105, 100, 101, 114, 45, 104, 111, 114, 105,
-    122, 111, 110, 116, 97, 108, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58,
-    32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 98, 111, 114, 100, 101, 114,
-    58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 109, 97, 114, 103, 105,
-    110, 58, 32, 50, 112, 120, 59, 32, 125, 32, 105, 110, 112, 117, 116, 91,
-    116, 121, 112, 101, 61, 34, 114, 97, 110, 103, 101, 34, 93, 58, 58, 45,
-    119, 101, 98, 107, 105, 116, 45, 115, 108, 105, 100, 101, 114, 45, 116, 104,
-    117, 109, 98, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112,
-    112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 115, 108, 105, 100, 101, 114,
-    116, 104, 117, 109, 98, 45, 104, 111, 114, 105, 122, 111, 110, 116, 97, 108,
-    59, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
-    98, 117, 116, 116, 111, 110, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101,
-    100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115,
-    117, 98, 109, 105, 116, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101, 100,
-    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101,
-    115, 101, 116, 34, 93, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32,
-    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101,
-    34, 93, 58, 100, 105, 115, 97, 98, 108, 101, 100, 58, 58, 45, 119, 101,
-    98, 107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100,
-    45, 98, 117, 116, 116, 111, 110, 44, 32, 98, 117, 116, 116, 111, 110, 58,
-    100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 115, 101, 108, 101, 99, 116,
-    58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 107, 101, 121, 103, 101,
-    110, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 111, 112, 116, 103,
-    114, 111, 117, 112, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 111,
-    112, 116, 105, 111, 110, 58, 100, 105, 115, 97, 98, 108, 101, 100, 32, 123,
-    32, 99, 111, 108, 111, 114, 58, 32, 71, 114, 97, 121, 84, 101, 120, 116,
-    32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 98,
-    117, 116, 116, 111, 110, 34, 93, 58, 97, 99, 116, 105, 118, 101, 44, 32,
-    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 115, 117, 98, 109,
-    105, 116, 34, 93, 58, 97, 99, 116, 105, 118, 101, 44, 32, 105, 110, 112,
-    117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93,
-    58, 97, 99, 116, 105, 118, 101, 44, 32, 105, 110, 112, 117, 116, 91, 116,
-    121, 112, 101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 97, 99, 116, 105,
-    118, 101, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 105, 108, 101,
-    45, 117, 112, 108, 111, 97, 100, 45, 98, 117, 116, 116, 111, 110, 44, 32,
-    98, 117, 116, 116, 111, 110, 58, 97, 99, 116, 105, 118, 101, 32, 123, 32,
-    98, 111, 114, 100, 101, 114, 45, 115, 116, 121, 108, 101, 58, 32, 105, 110,
-    115, 101, 116, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 97, 99, 116, 105, 118,
-    101, 58, 100, 105, 115, 97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117,
-    116, 91, 116, 121, 112, 101, 61, 34, 115, 117, 98, 109, 105, 116, 34, 93,
-    58, 97, 99, 116, 105, 118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100,
-    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101,
-    115, 101, 116, 34, 93, 58, 97, 99, 116, 105, 118, 101, 58, 100, 105, 115,
-    97, 98, 108, 101, 100, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
-    101, 61, 34, 102, 105, 108, 101, 34, 93, 58, 97, 99, 116, 105, 118, 101,
-    58, 100, 105, 115, 97, 98, 108, 101, 100, 58, 58, 45, 119, 101, 98, 107,
-    105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98,
-    117, 116, 116, 111, 110, 44, 32, 98, 117, 116, 116, 111, 110, 58, 97, 99,
-    116, 105, 118, 101, 58, 100, 105, 115, 97, 98, 108, 101, 100, 32, 123, 32,
-    98, 111, 114, 100, 101, 114, 45, 115, 116, 121, 108, 101, 58, 32, 111, 117,
-    116, 115, 101, 116, 32, 125, 32, 97, 114, 101, 97, 44, 32, 112, 97, 114,
-    97, 109, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111,
-    110, 101, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
-    34, 99, 104, 101, 99, 107, 98, 111, 120, 34, 93, 32, 123, 32, 45, 119,
-    101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101,
-    58, 32, 99, 104, 101, 99, 107, 98, 111, 120, 59, 32, 45, 119, 101, 98,
-    107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105, 110, 103, 58, 32,
-    98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 59, 32, 125, 32, 105, 110,
-    112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97, 100, 105, 111, 34,
-    93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
-    97, 114, 97, 110, 99, 101, 58, 32, 114, 97, 100, 105, 111, 59, 32, 45,
+    110, 99, 101, 58, 32, 109, 101, 110, 117, 108, 105, 115, 116, 59, 32, 45,
     119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105, 110,
-    103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 59, 32, 125,
-    32, 107, 101, 121, 103, 101, 110, 44, 32, 115, 101, 108, 101, 99, 116, 32,
-    123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114,
-    97, 110, 99, 101, 58, 32, 109, 101, 110, 117, 108, 105, 115, 116, 59, 32,
-    45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105,
-    110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 59, 32,
-    45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 97, 108, 105, 103,
-    110, 58, 32, 99, 101, 110, 116, 101, 114, 59, 32, 98, 111, 114, 100, 101,
-    114, 58, 32, 49, 112, 120, 32, 115, 111, 108, 105, 100, 59, 32, 45, 119,
-    101, 98, 107, 105, 116, 45, 98, 111, 114, 100, 101, 114, 45, 114, 97, 100,
-    105, 117, 115, 58, 32, 53, 112, 120, 59, 32, 119, 104, 105, 116, 101, 45,
-    115, 112, 97, 99, 101, 58, 32, 112, 114, 101, 59, 32, 45, 119, 101, 98,
-    107, 105, 116, 45, 114, 116, 108, 45, 111, 114, 100, 101, 114, 105, 110, 103,
-    58, 32, 108, 111, 103, 105, 99, 97, 108, 59, 32, 99, 111, 108, 111, 114,
-    58, 32, 98, 108, 97, 99, 107, 59, 32, 98, 97, 99, 107, 103, 114, 111,
-    117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 119, 104, 105, 116, 101,
-    59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 100, 101, 102, 97, 117, 108,
-    116, 59, 32, 125, 32, 115, 101, 108, 101, 99, 116, 91, 115, 105, 122, 101,
-    93, 44, 32, 115, 101, 108, 101, 99, 116, 91, 109, 117, 108, 116, 105, 112,
-    108, 101, 93, 44, 32, 115, 101, 108, 101, 99, 116, 91, 115, 105, 122, 101,
-    93, 91, 109, 117, 108, 116, 105, 112, 108, 101, 93, 32, 123, 32, 45, 119,
-    101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101,
-    58, 32, 108, 105, 115, 116, 98, 111, 120, 59, 32, 45, 119, 101, 98, 107,
-    105, 116, 45, 98, 111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 115, 116,
-    97, 114, 116, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120,
-    32, 105, 110, 115, 101, 116, 32, 103, 114, 97, 121, 59, 32, 45, 119, 101,
+    103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 59, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 97, 108, 105, 103, 110,
+    58, 32, 99, 101, 110, 116, 101, 114, 59, 32, 98, 111, 114, 100, 101, 114,
+    58, 32, 49, 112, 120, 32, 115, 111, 108, 105, 100, 59, 32, 45, 119, 101,
     98, 107, 105, 116, 45, 98, 111, 114, 100, 101, 114, 45, 114, 97, 100, 105,
-    117, 115, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 119, 104, 105,
-    116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 105, 110, 105, 116, 105, 97,
-    108, 59, 32, 125, 32, 115, 101, 108, 101, 99, 116, 91, 115, 105, 122, 101,
-    61, 34, 48, 34, 93, 44, 32, 115, 101, 108, 101, 99, 116, 91, 115, 105,
-    122, 101, 61, 34, 49, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105,
-    116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101,
-    110, 117, 108, 105, 115, 116, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45,
-    98, 111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116, 101,
-    114, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120, 32, 115,
-    111, 108, 105, 100, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
-    114, 100, 101, 114, 45, 114, 97, 100, 105, 117, 115, 58, 32, 53, 112, 120,
-    59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 112,
-    114, 101, 59, 32, 125, 32, 111, 112, 116, 103, 114, 111, 117, 112, 32, 123,
-    32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32, 98, 111,
-    108, 100, 101, 114, 59, 32, 125, 32, 111, 112, 116, 105, 111, 110, 32, 123,
-    32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32, 110, 111,
-    114, 109, 97, 108, 59, 32, 125, 32, 117, 44, 32, 105, 110, 115, 32, 123,
-    32, 116, 101, 120, 116, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111, 110,
-    58, 32, 117, 110, 100, 101, 114, 108, 105, 110, 101, 32, 125, 32, 115, 116,
-    114, 111, 110, 103, 44, 32, 98, 32, 123, 32, 102, 111, 110, 116, 45, 119,
-    101, 105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 101, 114, 32, 125, 32,
-    105, 44, 32, 99, 105, 116, 101, 44, 32, 101, 109, 44, 32, 118, 97, 114,
-    44, 32, 97, 100, 100, 114, 101, 115, 115, 32, 123, 32, 102, 111, 110, 116,
-    45, 115, 116, 121, 108, 101, 58, 32, 105, 116, 97, 108, 105, 99, 32, 125,
-    32, 116, 116, 44, 32, 99, 111, 100, 101, 44, 32, 107, 98, 100, 44, 32,
-    115, 97, 109, 112, 32, 123, 32, 102, 111, 110, 116, 45, 102, 97, 109, 105,
-    108, 121, 58, 32, 109, 111, 110, 111, 115, 112, 97, 99, 101, 32, 125, 32,
-    112, 114, 101, 44, 32, 120, 109, 112, 44, 32, 112, 108, 97, 105, 110, 116,
-    101, 120, 116, 44, 32, 108, 105, 115, 116, 105, 110, 103, 32, 123, 32, 100,
-    105, 115, 112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 102,
-    111, 110, 116, 45, 102, 97, 109, 105, 108, 121, 58, 32, 109, 111, 110, 111,
-    115, 112, 97, 99, 101, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97,
-    99, 101, 58, 32, 112, 114, 101, 59, 32, 109, 97, 114, 103, 105, 110, 58,
-    32, 49, 95, 95, 113, 101, 109, 32, 48, 32, 125, 32, 98, 105, 103, 32,
-    123, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 108, 97, 114,
-    103, 101, 114, 32, 125, 32, 115, 109, 97, 108, 108, 32, 123, 32, 102, 111,
-    110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109, 97, 108, 108, 101, 114,
-    32, 125, 32, 115, 44, 32, 115, 116, 114, 105, 107, 101, 44, 32, 100, 101,
-    108, 32, 123, 32, 116, 101, 120, 116, 45, 100, 101, 99, 111, 114, 97, 116,
-    105, 111, 110, 58, 32, 108, 105, 110, 101, 45, 116, 104, 114, 111, 117, 103,
-    104, 32, 125, 32, 115, 117, 98, 32, 123, 32, 118, 101, 114, 116, 105, 99,
-    97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 115, 117, 98, 59, 32, 102,
+    117, 115, 58, 32, 53, 112, 120, 59, 32, 119, 104, 105, 116, 101, 45, 115,
+    112, 97, 99, 101, 58, 32, 112, 114, 101, 59, 32, 45, 119, 101, 98, 107,
+    105, 116, 45, 114, 116, 108, 45, 111, 114, 100, 101, 114, 105, 110, 103, 58,
+    32, 108, 111, 103, 105, 99, 97, 108, 59, 32, 99, 111, 108, 111, 114, 58,
+    32, 98, 108, 97, 99, 107, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117,
+    110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 119, 104, 105, 116, 101, 59,
+    32, 99, 117, 114, 115, 111, 114, 58, 32, 100, 101, 102, 97, 117, 108, 116,
+    59, 32, 125, 32, 115, 101, 108, 101, 99, 116, 91, 115, 105, 122, 101, 93,
+    44, 32, 115, 101, 108, 101, 99, 116, 91, 109, 117, 108, 116, 105, 112, 108,
+    101, 93, 44, 32, 115, 101, 108, 101, 99, 116, 91, 115, 105, 122, 101, 93,
+    91, 109, 117, 108, 116, 105, 112, 108, 101, 93, 32, 123, 32, 45, 119, 101,
+    98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58,
+    32, 108, 105, 115, 116, 98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 98, 111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 115, 116, 97,
+    114, 116, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120, 32,
+    105, 110, 115, 101, 116, 32, 103, 114, 97, 121, 59, 32, 45, 119, 101, 98,
+    107, 105, 116, 45, 98, 111, 114, 100, 101, 114, 45, 114, 97, 100, 105, 117,
+    115, 58, 32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 119, 104, 105, 116,
+    101, 45, 115, 112, 97, 99, 101, 58, 32, 105, 110, 105, 116, 105, 97, 108,
+    59, 32, 125, 32, 115, 101, 108, 101, 99, 116, 91, 115, 105, 122, 101, 61,
+    34, 48, 34, 93, 44, 32, 115, 101, 108, 101, 99, 116, 91, 115, 105, 122,
+    101, 61, 34, 49, 34, 93, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116,
+    45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 110,
+    117, 108, 105, 115, 116, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98,
+    111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116, 101, 114,
+    59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 49, 112, 120, 32, 115, 111,
+    108, 105, 100, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 114,
+    100, 101, 114, 45, 114, 97, 100, 105, 117, 115, 58, 32, 53, 112, 120, 59,
+    32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 112, 114,
+    101, 59, 32, 125, 32, 111, 112, 116, 103, 114, 111, 117, 112, 32, 123, 32,
+    102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32, 98, 111, 108,
+    100, 101, 114, 59, 32, 125, 32, 111, 112, 116, 105, 111, 110, 32, 123, 32,
+    102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32, 110, 111, 114,
+    109, 97, 108, 59, 32, 125, 32, 100, 97, 116, 97, 103, 114, 105, 100, 32,
+    123, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 53, 48, 112, 120, 59,
+    32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97,
+    110, 99, 101, 58, 32, 100, 97, 116, 97, 103, 114, 105, 100, 59, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105, 110,
+    103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 59, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 114, 116, 108, 45, 111, 114, 100, 101, 114,
+    105, 110, 103, 58, 32, 108, 111, 103, 105, 99, 97, 108, 59, 32, 99, 111,
+    108, 111, 114, 58, 32, 98, 108, 97, 99, 107, 59, 32, 98, 97, 99, 107,
+    103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 119, 104,
+    105, 116, 101, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 100, 101, 102,
+    97, 117, 108, 116, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 49, 112,
+    120, 32, 105, 110, 115, 101, 116, 32, 103, 114, 97, 121, 59, 32, 119, 104,
+    105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 105, 110, 105, 116, 105,
+    97, 108, 59, 32, 125, 32, 117, 44, 32, 105, 110, 115, 32, 123, 32, 116,
+    101, 120, 116, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111, 110, 58, 32,
+    117, 110, 100, 101, 114, 108, 105, 110, 101, 32, 125, 32, 115, 116, 114, 111,
+    110, 103, 44, 32, 98, 32, 123, 32, 102, 111, 110, 116, 45, 119, 101, 105,
+    103, 104, 116, 58, 32, 98, 111, 108, 100, 101, 114, 32, 125, 32, 105, 44,
+    32, 99, 105, 116, 101, 44, 32, 101, 109, 44, 32, 118, 97, 114, 44, 32,
+    97, 100, 100, 114, 101, 115, 115, 32, 123, 32, 102, 111, 110, 116, 45, 115,
+    116, 121, 108, 101, 58, 32, 105, 116, 97, 108, 105, 99, 32, 125, 32, 116,
+    116, 44, 32, 99, 111, 100, 101, 44, 32, 107, 98, 100, 44, 32, 115, 97,
+    109, 112, 32, 123, 32, 102, 111, 110, 116, 45, 102, 97, 109, 105, 108, 121,
+    58, 32, 109, 111, 110, 111, 115, 112, 97, 99, 101, 32, 125, 32, 112, 114,
+    101, 44, 32, 120, 109, 112, 44, 32, 112, 108, 97, 105, 110, 116, 101, 120,
+    116, 44, 32, 108, 105, 115, 116, 105, 110, 103, 32, 123, 32, 100, 105, 115,
+    112, 108, 97, 121, 58, 32, 98, 108, 111, 99, 107, 59, 32, 102, 111, 110,
+    116, 45, 102, 97, 109, 105, 108, 121, 58, 32, 109, 111, 110, 111, 115, 112,
+    97, 99, 101, 59, 32, 119, 104, 105, 116, 101, 45, 115, 112, 97, 99, 101,
+    58, 32, 112, 114, 101, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 49,
+    95, 95, 113, 101, 109, 32, 48, 32, 125, 32, 98, 105, 103, 32, 123, 32,
+    102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 108, 97, 114, 103, 101,
+    114, 32, 125, 32, 115, 109, 97, 108, 108, 32, 123, 32, 102, 111, 110, 116,
+    45, 115, 105, 122, 101, 58, 32, 115, 109, 97, 108, 108, 101, 114, 32, 125,
+    32, 115, 44, 32, 115, 116, 114, 105, 107, 101, 44, 32, 100, 101, 108, 32,
+    123, 32, 116, 101, 120, 116, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111,
+    110, 58, 32, 108, 105, 110, 101, 45, 116, 104, 114, 111, 117, 103, 104, 32,
+    125, 32, 115, 117, 98, 32, 123, 32, 118, 101, 114, 116, 105, 99, 97, 108,
+    45, 97, 108, 105, 103, 110, 58, 32, 115, 117, 98, 59, 32, 102, 111, 110,
+    116, 45, 115, 105, 122, 101, 58, 32, 115, 109, 97, 108, 108, 101, 114, 32,
+    125, 32, 115, 117, 112, 32, 123, 32, 118, 101, 114, 116, 105, 99, 97, 108,
+    45, 97, 108, 105, 103, 110, 58, 32, 115, 117, 112, 101, 114, 59, 32, 102,
     111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109, 97, 108, 108, 101,
-    114, 32, 125, 32, 115, 117, 112, 32, 123, 32, 118, 101, 114, 116, 105, 99,
-    97, 108, 45, 97, 108, 105, 103, 110, 58, 32, 115, 117, 112, 101, 114, 59,
-    32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 115, 109, 97, 108,
-    108, 101, 114, 32, 125, 32, 110, 111, 98, 114, 32, 123, 32, 119, 104, 105,
-    116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 110, 111, 119, 114, 97, 112,
-    32, 125, 32, 58, 102, 111, 99, 117, 115, 32, 123, 32, 111, 117, 116, 108,
-    105, 110, 101, 58, 32, 97, 117, 116, 111, 32, 53, 112, 120, 32, 45, 119,
-    101, 98, 107, 105, 116, 45, 102, 111, 99, 117, 115, 45, 114, 105, 110, 103,
-    45, 99, 111, 108, 111, 114, 32, 125, 32, 104, 116, 109, 108, 58, 102, 111,
-    99, 117, 115, 44, 32, 98, 111, 100, 121, 58, 102, 111, 99, 117, 115, 44,
-    32, 105, 110, 112, 117, 116, 91, 114, 101, 97, 100, 111, 110, 108, 121, 93,
-    58, 102, 111, 99, 117, 115, 32, 123, 32, 111, 117, 116, 108, 105, 110, 101,
-    58, 32, 110, 111, 110, 101, 32, 125, 32, 105, 110, 112, 117, 116, 58, 102,
-    111, 99, 117, 115, 44, 32, 116, 101, 120, 116, 97, 114, 101, 97, 58, 102,
-    111, 99, 117, 115, 44, 32, 105, 115, 105, 110, 100, 101, 120, 58, 102, 111,
-    99, 117, 115, 44, 32, 107, 101, 121, 103, 101, 110, 58, 102, 111, 99, 117,
-    115, 44, 32, 115, 101, 108, 101, 99, 116, 58, 102, 111, 99, 117, 115, 32,
-    123, 32, 111, 117, 116, 108, 105, 110, 101, 45, 111, 102, 102, 115, 101, 116,
-    58, 32, 45, 50, 112, 120, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116,
-    121, 112, 101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 102, 111,
-    99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61,
-    34, 99, 104, 101, 99, 107, 98, 111, 120, 34, 93, 58, 102, 111, 99, 117,
-    115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102,
-    105, 108, 101, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112,
-    117, 116, 91, 116, 121, 112, 101, 61, 34, 104, 105, 100, 100, 101, 110, 34,
-    93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116,
-    121, 112, 101, 61, 34, 105, 109, 97, 103, 101, 34, 93, 58, 102, 111, 99,
+    114, 32, 125, 32, 110, 111, 98, 114, 32, 123, 32, 119, 104, 105, 116, 101,
+    45, 115, 112, 97, 99, 101, 58, 32, 110, 111, 119, 114, 97, 112, 32, 125,
+    32, 58, 102, 111, 99, 117, 115, 32, 123, 32, 111, 117, 116, 108, 105, 110,
+    101, 58, 32, 97, 117, 116, 111, 32, 53, 112, 120, 32, 45, 119, 101, 98,
+    107, 105, 116, 45, 102, 111, 99, 117, 115, 45, 114, 105, 110, 103, 45, 99,
+    111, 108, 111, 114, 32, 125, 32, 104, 116, 109, 108, 58, 102, 111, 99, 117,
+    115, 44, 32, 98, 111, 100, 121, 58, 102, 111, 99, 117, 115, 44, 32, 105,
+    110, 112, 117, 116, 91, 114, 101, 97, 100, 111, 110, 108, 121, 93, 58, 102,
+    111, 99, 117, 115, 32, 123, 32, 111, 117, 116, 108, 105, 110, 101, 58, 32,
+    110, 111, 110, 101, 32, 125, 32, 105, 110, 112, 117, 116, 58, 102, 111, 99,
+    117, 115, 44, 32, 116, 101, 120, 116, 97, 114, 101, 97, 58, 102, 111, 99,
+    117, 115, 44, 32, 105, 115, 105, 110, 100, 101, 120, 58, 102, 111, 99, 117,
+    115, 44, 32, 107, 101, 121, 103, 101, 110, 58, 102, 111, 99, 117, 115, 44,
+    32, 115, 101, 108, 101, 99, 116, 58, 102, 111, 99, 117, 115, 32, 123, 32,
+    111, 117, 116, 108, 105, 110, 101, 45, 111, 102, 102, 115, 101, 116, 58, 32,
+    45, 50, 112, 120, 32, 125, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
+    101, 61, 34, 98, 117, 116, 116, 111, 110, 34, 93, 58, 102, 111, 99, 117,
+    115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 99,
+    104, 101, 99, 107, 98, 111, 120, 34, 93, 58, 102, 111, 99, 117, 115, 44,
+    32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108,
+    101, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116,
+    91, 116, 121, 112, 101, 61, 34, 104, 105, 100, 100, 101, 110, 34, 93, 58,
+    102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112,
+    101, 61, 34, 105, 109, 97, 103, 101, 34, 93, 58, 102, 111, 99, 117, 115,
+    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 97,
+    100, 105, 111, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112,
+    117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116, 34, 93,
+    58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121,
+    112, 101, 61, 34, 115, 101, 97, 114, 99, 104, 34, 93, 58, 102, 111, 99,
     117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34,
-    114, 97, 100, 105, 111, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105,
-    110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 114, 101, 115, 101, 116,
-    34, 93, 58, 102, 111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91,
-    116, 121, 112, 101, 61, 34, 115, 101, 97, 114, 99, 104, 34, 93, 58, 102,
-    111, 99, 117, 115, 44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101,
-    61, 34, 115, 117, 98, 109, 105, 116, 34, 93, 58, 102, 111, 99, 117, 115,
-    44, 32, 105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105,
-    108, 101, 34, 93, 58, 102, 111, 99, 117, 115, 58, 58, 45, 119, 101, 98,
-    107, 105, 116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45,
-    98, 117, 116, 116, 111, 110, 32, 123, 32, 111, 117, 116, 108, 105, 110, 101,
-    45, 111, 102, 102, 115, 101, 116, 58, 32, 48, 32, 125, 32, 97, 58, 45,
-    119, 101, 98, 107, 105, 116, 45, 97, 110, 121, 45, 108, 105, 110, 107, 32,
-    123, 32, 99, 111, 108, 111, 114, 58, 32, 45, 119, 101, 98, 107, 105, 116,
-    45, 108, 105, 110, 107, 59, 32, 116, 101, 120, 116, 45, 100, 101, 99, 111,
-    114, 97, 116, 105, 111, 110, 58, 32, 117, 110, 100, 101, 114, 108, 105, 110,
-    101, 59, 32, 99, 117, 114, 115, 111, 114, 58, 32, 97, 117, 116, 111, 59,
-    32, 125, 32, 97, 58, 45, 119, 101, 98, 107, 105, 116, 45, 97, 110, 121,
-    45, 108, 105, 110, 107, 58, 97, 99, 116, 105, 118, 101, 32, 123, 32, 99,
-    111, 108, 111, 114, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 99,
-    116, 105, 118, 101, 108, 105, 110, 107, 32, 125, 32, 110, 111, 102, 114, 97,
-    109, 101, 115, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110,
-    111, 110, 101, 32, 125, 32, 102, 114, 97, 109, 101, 115, 101, 116, 44, 32,
-    102, 114, 97, 109, 101, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58,
-    32, 98, 108, 111, 99, 107, 32, 125, 32, 102, 114, 97, 109, 101, 115, 101,
-    116, 32, 123, 32, 98, 111, 114, 100, 101, 114, 45, 99, 111, 108, 111, 114,
-    58, 32, 105, 110, 104, 101, 114, 105, 116, 32, 125, 32, 105, 102, 114, 97,
-    109, 101, 32, 123, 32, 98, 111, 114, 100, 101, 114, 58, 32, 50, 112, 120,
-    32, 105, 110, 115, 101, 116, 32, 125
+    115, 117, 98, 109, 105, 116, 34, 93, 58, 102, 111, 99, 117, 115, 44, 32,
+    105, 110, 112, 117, 116, 91, 116, 121, 112, 101, 61, 34, 102, 105, 108, 101,
+    34, 93, 58, 102, 111, 99, 117, 115, 58, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 102, 105, 108, 101, 45, 117, 112, 108, 111, 97, 100, 45, 98, 117,
+    116, 116, 111, 110, 32, 123, 32, 111, 117, 116, 108, 105, 110, 101, 45, 111,
+    102, 102, 115, 101, 116, 58, 32, 48, 32, 125, 32, 97, 58, 45, 119, 101,
+    98, 107, 105, 116, 45, 97, 110, 121, 45, 108, 105, 110, 107, 32, 123, 32,
+    99, 111, 108, 111, 114, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 108,
+    105, 110, 107, 59, 32, 116, 101, 120, 116, 45, 100, 101, 99, 111, 114, 97,
+    116, 105, 111, 110, 58, 32, 117, 110, 100, 101, 114, 108, 105, 110, 101, 59,
+    32, 99, 117, 114, 115, 111, 114, 58, 32, 97, 117, 116, 111, 59, 32, 125,
+    32, 97, 58, 45, 119, 101, 98, 107, 105, 116, 45, 97, 110, 121, 45, 108,
+    105, 110, 107, 58, 97, 99, 116, 105, 118, 101, 32, 123, 32, 99, 111, 108,
+    111, 114, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 99, 116, 105,
+    118, 101, 108, 105, 110, 107, 32, 125, 32, 110, 111, 102, 114, 97, 109, 101,
+    115, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110,
+    101, 32, 125, 32, 102, 114, 97, 109, 101, 115, 101, 116, 44, 32, 102, 114,
+    97, 109, 101, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 98,
+    108, 111, 99, 107, 32, 125, 32, 102, 114, 97, 109, 101, 115, 101, 116, 32,
+    123, 32, 98, 111, 114, 100, 101, 114, 45, 99, 111, 108, 111, 114, 58, 32,
+    105, 110, 104, 101, 114, 105, 116, 32, 125, 32, 105, 102, 114, 97, 109, 101,
+    32, 123, 32, 98, 111, 114, 100, 101, 114, 58, 32, 50, 112, 120, 32, 105,
+    110, 115, 101, 116, 32, 125, 32, 105, 109, 103, 44, 32, 105, 110, 112, 117,
+    116, 91, 116, 121, 112, 101, 61, 105, 109, 97, 103, 101, 93, 44, 32, 118,
+    105, 100, 101, 111, 44, 32, 105, 102, 114, 97, 109, 101, 44, 32, 111, 98,
+    106, 101, 99, 116, 44, 32, 101, 109, 98, 101, 100, 44, 32, 97, 112, 112,
+    108, 101, 116, 32, 123, 32, 111, 118, 101, 114, 102, 108, 111, 119, 58, 32,
+    104, 105, 100, 100, 101, 110, 59, 32, 125
 };
 extern const char quirksUserAgentStyleSheet[359] = {
     105, 109, 103, 91, 97, 108, 105, 103, 110, 61, 34, 108, 101, 102, 116, 34,
@@ -564,7 +588,7 @@ extern const char svgUserAgentStyleSheet[358] = {
     107, 105, 116, 45, 102, 111, 99, 117, 115, 45, 114, 105, 110, 103, 45, 99,
     111, 108, 111, 114, 32, 125
 };
-extern const char sourceUserAgentStyleSheet[2025] = {
+extern const char sourceUserAgentStyleSheet[2004] = {
     98, 111, 100, 121, 32, 123, 32, 109, 97, 114, 103, 105, 110, 58, 32, 48,
     32, 125, 32, 116, 97, 98, 108, 101, 32, 123, 32, 119, 105, 100, 116, 104,
     58, 32, 49, 48, 48, 37, 59, 32, 98, 111, 114, 100, 101, 114, 45, 115,
@@ -575,123 +599,122 @@ extern const char sourceUserAgentStyleSheet[2025] = {
     116, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 48, 59, 32, 119, 111,
     114, 100, 45, 98, 114, 101, 97, 107, 58, 32, 98, 114, 101, 97, 107, 45,
     119, 111, 114, 100, 59, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58,
-    32, 49, 48, 112, 120, 59, 32, 102, 111, 110, 116, 45, 102, 97, 109, 105,
-    108, 121, 58, 32, 77, 111, 110, 97, 99, 111, 44, 32, 76, 117, 99, 105,
-    100, 97, 32, 67, 111, 110, 115, 111, 108, 101, 44, 32, 109, 111, 110, 111,
-    115, 112, 97, 99, 101, 59, 32, 125, 32, 116, 100, 32, 123, 32, 112, 97,
-    100, 100, 105, 110, 103, 58, 32, 48, 32, 33, 105, 109, 112, 111, 114, 116,
-    97, 110, 116, 59, 32, 118, 101, 114, 116, 105, 99, 97, 108, 45, 97, 108,
-    105, 103, 110, 58, 32, 98, 97, 115, 101, 108, 105, 110, 101, 32, 125, 32,
-    46, 119, 101, 98, 107, 105, 116, 45, 108, 105, 110, 101, 45, 103, 117, 116,
-    116, 101, 114, 45, 98, 97, 99, 107, 100, 114, 111, 112, 44, 32, 46, 119,
-    101, 98, 107, 105, 116, 45, 108, 105, 110, 101, 45, 110, 117, 109, 98, 101,
-    114, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45,
-    115, 105, 122, 105, 110, 103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98,
-    111, 120, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 48, 32, 52,
-    112, 120, 32, 33, 105, 109, 112, 111, 114, 116, 97, 110, 116, 59, 32, 119,
-    105, 100, 116, 104, 58, 32, 51, 49, 112, 120, 59, 32, 98, 97, 99, 107,
-    103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 114, 103,
-    98, 40, 50, 52, 48, 44, 32, 50, 52, 48, 44, 32, 50, 52, 48, 41,
-    59, 32, 98, 111, 114, 100, 101, 114, 45, 114, 105, 103, 104, 116, 58, 32,
-    49, 112, 120, 32, 115, 111, 108, 105, 100, 32, 114, 103, 98, 40, 49, 56,
-    55, 44, 32, 49, 56, 55, 44, 32, 49, 56, 55, 41, 32, 33, 105, 109,
-    112, 111, 114, 116, 97, 110, 116, 59, 32, 45, 119, 101, 98, 107, 105, 116,
-    45, 117, 115, 101, 114, 45, 115, 101, 108, 101, 99, 116, 58, 32, 110, 111,
-    110, 101, 59, 32, 125, 32, 46, 119, 101, 98, 107, 105, 116, 45, 108, 105,
-    110, 101, 45, 103, 117, 116, 116, 101, 114, 45, 98, 97, 99, 107, 100, 114,
-    111, 112, 32, 123, 32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 97,
-    98, 115, 111, 108, 117, 116, 101, 59, 32, 122, 45, 105, 110, 100, 101, 120,
-    58, 32, 45, 49, 59, 32, 108, 101, 102, 116, 58, 32, 48, 59, 32, 116,
-    111, 112, 58, 32, 48, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49,
-    48, 48, 37, 32, 125, 32, 46, 119, 101, 98, 107, 105, 116, 45, 108, 105,
-    110, 101, 45, 110, 117, 109, 98, 101, 114, 32, 123, 32, 116, 101, 120, 116,
-    45, 97, 108, 105, 103, 110, 58, 32, 114, 105, 103, 104, 116, 59, 32, 99,
-    111, 108, 111, 114, 58, 32, 114, 103, 98, 40, 49, 50, 56, 44, 32, 49,
-    50, 56, 44, 32, 49, 50, 56, 41, 59, 32, 119, 111, 114, 100, 45, 98,
-    114, 101, 97, 107, 58, 32, 110, 111, 114, 109, 97, 108, 59, 32, 119, 104,
-    105, 116, 101, 45, 115, 112, 97, 99, 101, 58, 32, 110, 111, 119, 114, 97,
-    112, 59, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 57, 112,
-    120, 59, 32, 102, 111, 110, 116, 45, 102, 97, 109, 105, 108, 121, 58, 32,
-    72, 101, 108, 118, 101, 116, 105, 99, 97, 32, 125, 32, 46, 119, 101, 98,
-    107, 105, 116, 45, 108, 105, 110, 101, 45, 110, 117, 109, 98, 101, 114, 58,
-    58, 98, 101, 102, 111, 114, 101, 32, 123, 32, 99, 111, 110, 116, 101, 110,
-    116, 58, 32, 99, 111, 117, 110, 116, 101, 114, 40, 108, 105, 110, 101, 115,
-    41, 59, 32, 99, 111, 117, 110, 116, 101, 114, 45, 105, 110, 99, 114, 101,
-    109, 101, 110, 116, 58, 32, 108, 105, 110, 101, 115, 59, 32, 45, 119, 101,
-    98, 107, 105, 116, 45, 117, 115, 101, 114, 45, 115, 101, 108, 101, 99, 116,
-    58, 32, 110, 111, 110, 101, 32, 125, 32, 46, 119, 101, 98, 107, 105, 116,
-    45, 108, 105, 110, 101, 45, 99, 111, 110, 116, 101, 110, 116, 32, 123, 32,
-    112, 97, 100, 100, 105, 110, 103, 58, 32, 48, 32, 53, 112, 120, 32, 33,
-    105, 109, 112, 111, 114, 116, 97, 110, 116, 59, 32, 125, 32, 46, 119, 101,
-    98, 107, 105, 116, 45, 104, 116, 109, 108, 45, 116, 97, 103, 32, 123, 32,
-    99, 111, 108, 111, 114, 58, 32, 114, 103, 98, 40, 49, 51, 54, 44, 32,
-    49, 56, 44, 32, 49, 50, 56, 41, 59, 32, 125, 32, 46, 119, 101, 98,
-    107, 105, 116, 45, 104, 116, 109, 108, 45, 97, 116, 116, 114, 105, 98, 117,
-    116, 101, 45, 110, 97, 109, 101, 32, 123, 32, 99, 111, 108, 111, 114, 58,
-    32, 114, 103, 98, 40, 49, 53, 51, 44, 32, 54, 57, 44, 32, 48, 41,
+    32, 105, 110, 105, 116, 105, 97, 108, 59, 32, 102, 111, 110, 116, 45, 102,
+    97, 109, 105, 108, 121, 58, 32, 109, 111, 110, 111, 115, 112, 97, 99, 101,
+    59, 32, 125, 32, 116, 100, 32, 123, 32, 112, 97, 100, 100, 105, 110, 103,
+    58, 32, 48, 32, 33, 105, 109, 112, 111, 114, 116, 97, 110, 116, 59, 32,
+    118, 101, 114, 116, 105, 99, 97, 108, 45, 97, 108, 105, 103, 110, 58, 32,
+    98, 97, 115, 101, 108, 105, 110, 101, 32, 125, 32, 46, 119, 101, 98, 107,
+    105, 116, 45, 108, 105, 110, 101, 45, 103, 117, 116, 116, 101, 114, 45, 98,
+    97, 99, 107, 100, 114, 111, 112, 44, 32, 46, 119, 101, 98, 107, 105, 116,
+    45, 108, 105, 110, 101, 45, 110, 117, 109, 98, 101, 114, 32, 123, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 105, 122, 105, 110,
+    103, 58, 32, 98, 111, 114, 100, 101, 114, 45, 98, 111, 120, 59, 32, 112,
+    97, 100, 100, 105, 110, 103, 58, 32, 48, 32, 52, 112, 120, 32, 33, 105,
+    109, 112, 111, 114, 116, 97, 110, 116, 59, 32, 119, 105, 100, 116, 104, 58,
+    32, 51, 49, 112, 120, 59, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110,
+    100, 45, 99, 111, 108, 111, 114, 58, 32, 114, 103, 98, 40, 50, 52, 48,
+    44, 32, 50, 52, 48, 44, 32, 50, 52, 48, 41, 59, 32, 98, 111, 114,
+    100, 101, 114, 45, 114, 105, 103, 104, 116, 58, 32, 49, 112, 120, 32, 115,
+    111, 108, 105, 100, 32, 114, 103, 98, 40, 49, 56, 55, 44, 32, 49, 56,
+    55, 44, 32, 49, 56, 55, 41, 32, 33, 105, 109, 112, 111, 114, 116, 97,
+    110, 116, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 117, 115, 101, 114,
+    45, 115, 101, 108, 101, 99, 116, 58, 32, 110, 111, 110, 101, 59, 32, 125,
+    32, 46, 119, 101, 98, 107, 105, 116, 45, 108, 105, 110, 101, 45, 103, 117,
+    116, 116, 101, 114, 45, 98, 97, 99, 107, 100, 114, 111, 112, 32, 123, 32,
+    112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 97, 98, 115, 111, 108, 117,
+    116, 101, 59, 32, 122, 45, 105, 110, 100, 101, 120, 58, 32, 45, 49, 59,
+    32, 108, 101, 102, 116, 58, 32, 48, 59, 32, 116, 111, 112, 58, 32, 48,
+    59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 48, 48, 37, 32, 125,
+    32, 46, 119, 101, 98, 107, 105, 116, 45, 108, 105, 110, 101, 45, 110, 117,
+    109, 98, 101, 114, 32, 123, 32, 116, 101, 120, 116, 45, 97, 108, 105, 103,
+    110, 58, 32, 114, 105, 103, 104, 116, 59, 32, 99, 111, 108, 111, 114, 58,
+    32, 114, 103, 98, 40, 49, 50, 56, 44, 32, 49, 50, 56, 44, 32, 49,
+    50, 56, 41, 59, 32, 119, 111, 114, 100, 45, 98, 114, 101, 97, 107, 58,
+    32, 110, 111, 114, 109, 97, 108, 59, 32, 119, 104, 105, 116, 101, 45, 115,
+    112, 97, 99, 101, 58, 32, 110, 111, 119, 114, 97, 112, 59, 32, 102, 111,
+    110, 116, 45, 115, 105, 122, 101, 58, 32, 57, 112, 120, 59, 32, 102, 111,
+    110, 116, 45, 102, 97, 109, 105, 108, 121, 58, 32, 72, 101, 108, 118, 101,
+    116, 105, 99, 97, 32, 125, 32, 46, 119, 101, 98, 107, 105, 116, 45, 108,
+    105, 110, 101, 45, 110, 117, 109, 98, 101, 114, 58, 58, 98, 101, 102, 111,
+    114, 101, 32, 123, 32, 99, 111, 110, 116, 101, 110, 116, 58, 32, 99, 111,
+    117, 110, 116, 101, 114, 40, 108, 105, 110, 101, 115, 41, 59, 32, 99, 111,
+    117, 110, 116, 101, 114, 45, 105, 110, 99, 114, 101, 109, 101, 110, 116, 58,
+    32, 108, 105, 110, 101, 115, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45,
+    117, 115, 101, 114, 45, 115, 101, 108, 101, 99, 116, 58, 32, 110, 111, 110,
+    101, 32, 125, 32, 46, 119, 101, 98, 107, 105, 116, 45, 108, 105, 110, 101,
+    45, 99, 111, 110, 116, 101, 110, 116, 32, 123, 32, 112, 97, 100, 100, 105,
+    110, 103, 58, 32, 48, 32, 53, 112, 120, 32, 33, 105, 109, 112, 111, 114,
+    116, 97, 110, 116, 59, 32, 125, 32, 46, 119, 101, 98, 107, 105, 116, 45,
+    104, 116, 109, 108, 45, 116, 97, 103, 32, 123, 32, 99, 111, 108, 111, 114,
+    58, 32, 114, 103, 98, 40, 49, 51, 54, 44, 32, 49, 56, 44, 32, 49,
+    50, 56, 41, 59, 32, 125, 32, 46, 119, 101, 98, 107, 105, 116, 45, 104,
+    116, 109, 108, 45, 97, 116, 116, 114, 105, 98, 117, 116, 101, 45, 110, 97,
+    109, 101, 32, 123, 32, 99, 111, 108, 111, 114, 58, 32, 114, 103, 98, 40,
+    49, 53, 51, 44, 32, 54, 57, 44, 32, 48, 41, 59, 32, 125, 32, 46,
+    119, 101, 98, 107, 105, 116, 45, 104, 116, 109, 108, 45, 97, 116, 116, 114,
+    105, 98, 117, 116, 101, 45, 118, 97, 108, 117, 101, 32, 123, 32, 99, 111,
+    108, 111, 114, 58, 32, 114, 103, 98, 40, 50, 54, 44, 32, 50, 54, 44,
+    32, 49, 54, 54, 41, 59, 32, 125, 32, 46, 119, 101, 98, 107, 105, 116,
+    45, 104, 116, 109, 108, 45, 101, 120, 116, 101, 114, 110, 97, 108, 45, 108,
+    105, 110, 107, 44, 32, 46, 119, 101, 98, 107, 105, 116, 45, 104, 116, 109,
+    108, 45, 114, 101, 115, 111, 117, 114, 99, 101, 45, 108, 105, 110, 107, 32,
+    123, 32, 99, 111, 108, 111, 114, 58, 32, 125, 32, 46, 119, 101, 98, 107,
+    105, 116, 45, 104, 116, 109, 108, 45, 101, 120, 116, 101, 114, 110, 97, 108,
+    45, 108, 105, 110, 107, 32, 123, 32, 116, 101, 120, 116, 45, 100, 101, 99,
+    111, 114, 97, 116, 105, 111, 110, 58, 32, 110, 111, 110, 101, 59, 32, 125,
+    32, 46, 119, 101, 98, 107, 105, 116, 45, 104, 116, 109, 108, 45, 101, 120,
+    116, 101, 114, 110, 97, 108, 45, 108, 105, 110, 107, 58, 104, 111, 118, 101,
+    114, 32, 123, 32, 116, 101, 120, 116, 45, 100, 101, 99, 111, 114, 97, 116,
+    105, 111, 110, 58, 32, 117, 110, 100, 101, 114, 108, 105, 110, 101, 59, 32,
+    125, 32, 46, 119, 101, 98, 107, 105, 116, 45, 104, 116, 109, 108, 45, 99,
+    111, 109, 109, 101, 110, 116, 32, 123, 32, 99, 111, 108, 111, 114, 58, 32,
+    114, 103, 98, 40, 51, 53, 44, 32, 49, 49, 48, 44, 32, 51, 55, 41,
     59, 32, 125, 32, 46, 119, 101, 98, 107, 105, 116, 45, 104, 116, 109, 108,
-    45, 97, 116, 116, 114, 105, 98, 117, 116, 101, 45, 118, 97, 108, 117, 101,
-    32, 123, 32, 99, 111, 108, 111, 114, 58, 32, 114, 103, 98, 40, 50, 54,
-    44, 32, 50, 54, 44, 32, 49, 54, 54, 41, 59, 32, 125, 32, 46, 119,
-    101, 98, 107, 105, 116, 45, 104, 116, 109, 108, 45, 101, 120, 116, 101, 114,
-    110, 97, 108, 45, 108, 105, 110, 107, 44, 32, 46, 119, 101, 98, 107, 105,
-    116, 45, 104, 116, 109, 108, 45, 114, 101, 115, 111, 117, 114, 99, 101, 45,
-    108, 105, 110, 107, 32, 123, 32, 99, 111, 108, 111, 114, 58, 32, 125, 32,
-    46, 119, 101, 98, 107, 105, 116, 45, 104, 116, 109, 108, 45, 101, 120, 116,
-    101, 114, 110, 97, 108, 45, 108, 105, 110, 107, 32, 123, 32, 116, 101, 120,
-    116, 45, 100, 101, 99, 111, 114, 97, 116, 105, 111, 110, 58, 32, 110, 111,
-    110, 101, 59, 32, 125, 32, 46, 119, 101, 98, 107, 105, 116, 45, 104, 116,
-    109, 108, 45, 101, 120, 116, 101, 114, 110, 97, 108, 45, 108, 105, 110, 107,
-    58, 104, 111, 118, 101, 114, 32, 123, 32, 116, 101, 120, 116, 45, 100, 101,
-    99, 111, 114, 97, 116, 105, 111, 110, 58, 32, 117, 110, 100, 101, 114, 108,
-    105, 110, 101, 59, 32, 125, 32, 46, 119, 101, 98, 107, 105, 116, 45, 104,
-    116, 109, 108, 45, 99, 111, 109, 109, 101, 110, 116, 32, 123, 32, 99, 111,
-    108, 111, 114, 58, 32, 114, 103, 98, 40, 51, 53, 44, 32, 49, 49, 48,
-    44, 32, 51, 55, 41, 59, 32, 125, 32, 46, 119, 101, 98, 107, 105, 116,
-    45, 104, 116, 109, 108, 45, 100, 111, 99, 116, 121, 112, 101, 32, 123, 32,
-    99, 111, 108, 111, 114, 58, 32, 114, 103, 98, 40, 49, 57, 50, 44, 32,
-    49, 57, 50, 44, 32, 49, 57, 50, 41, 59, 32, 125, 32, 46, 119, 101,
-    98, 107, 105, 116, 45, 104, 116, 109, 108, 45, 101, 110, 116, 105, 116, 121,
-    32, 123, 32, 114, 103, 98, 40, 49, 51, 54, 44, 32, 49, 56, 44, 32,
-    49, 50, 56, 41, 59, 32, 125, 32, 46, 119, 101, 98, 107, 105, 116, 45,
-    104, 116, 109, 108, 45, 109, 101, 115, 115, 97, 103, 101, 45, 98, 117, 98,
-    98, 108, 101, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
-    120, 45, 115, 104, 97, 100, 111, 119, 58, 32, 98, 108, 97, 99, 107, 32,
-    48, 112, 120, 32, 50, 112, 120, 32, 53, 112, 120, 59, 32, 45, 119, 101,
-    98, 107, 105, 116, 45, 98, 111, 114, 100, 101, 114, 45, 114, 97, 100, 105,
-    117, 115, 58, 32, 57, 112, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116,
-    45, 98, 111, 114, 100, 101, 114, 45, 102, 105, 116, 58, 32, 108, 105, 110,
-    101, 115, 59, 32, 109, 105, 110, 45, 104, 101, 105, 103, 104, 116, 58, 32,
-    49, 51, 112, 120, 59, 32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58,
-    32, 57, 112, 120, 59, 32, 102, 111, 110, 116, 45, 102, 97, 109, 105, 108,
-    121, 58, 32, 76, 117, 99, 105, 100, 97, 32, 71, 114, 97, 110, 100, 101,
-    59, 32, 102, 111, 110, 116, 45, 119, 101, 105, 103, 104, 116, 58, 32, 98,
-    111, 108, 100, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 54, 112, 120,
-    32, 50, 53, 112, 120, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32,
-    48, 32, 55, 112, 120, 32, 49, 112, 120, 59, 32, 125, 32, 46, 119, 101,
-    98, 107, 105, 116, 45, 104, 116, 109, 108, 45, 119, 97, 114, 110, 105, 110,
-    103, 45, 109, 101, 115, 115, 97, 103, 101, 32, 123, 32, 98, 97, 99, 107,
-    103, 114, 111, 117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 114, 103,
-    98, 40, 49, 48, 48, 37, 44, 32, 54, 50, 37, 44, 32, 52, 50, 37,
-    41, 59, 32, 98, 111, 114, 100, 101, 114, 58, 32, 50, 112, 120, 32, 115,
-    111, 108, 105, 100, 32, 114, 103, 98, 40, 49, 48, 48, 37, 44, 32, 53,
-    50, 37, 44, 32, 50, 49, 37, 41, 59, 32, 125, 32, 46, 119, 101, 98,
-    107, 105, 116, 45, 104, 116, 109, 108, 45, 101, 114, 114, 111, 114, 45, 109,
-    101, 115, 115, 97, 103, 101, 32, 123, 32, 98, 97, 99, 107, 103, 114, 111,
-    117, 110, 100, 45, 99, 111, 108, 111, 114, 58, 32, 114, 103, 98, 40, 49,
-    48, 48, 37, 44, 32, 52, 50, 37, 44, 32, 52, 50, 37, 41, 59, 32,
-    98, 111, 114, 100, 101, 114, 58, 32, 50, 112, 120, 32, 115, 111, 108, 105,
-    100, 32, 114, 103, 98, 40, 49, 48, 48, 37, 44, 32, 51, 49, 37, 44,
-    32, 51, 49, 37, 41, 59, 32, 125, 32, 46, 119, 101, 98, 107, 105, 116,
-    45, 104, 116, 109, 108, 45, 109, 101, 115, 115, 97, 103, 101, 45, 108, 105,
-    110, 101, 32, 123, 32, 112, 97, 100, 100, 105, 110, 103, 45, 108, 101, 102,
-    116, 58, 32, 50, 51, 112, 120, 59, 32, 116, 101, 120, 116, 45, 105, 110,
-    100, 101, 110, 116, 58, 32, 45, 50, 48, 112, 120, 59, 32, 125, 32, 46,
-    119, 101, 98, 107, 105, 116, 45, 104, 116, 109, 108, 45, 109, 101, 115, 115,
-    97, 103, 101, 45, 105, 99, 111, 110, 32, 123, 32, 112, 111, 115, 105, 116,
-    105, 111, 110, 58, 32, 114, 101, 108, 97, 116, 105, 118, 101, 59, 32, 116,
-    111, 112, 58, 32, 50, 112, 120, 59, 32, 109, 97, 114, 103, 105, 110, 58,
-    32, 48, 32, 52, 112, 120, 59, 32, 125
+    45, 100, 111, 99, 116, 121, 112, 101, 32, 123, 32, 99, 111, 108, 111, 114,
+    58, 32, 114, 103, 98, 40, 49, 57, 50, 44, 32, 49, 57, 50, 44, 32,
+    49, 57, 50, 41, 59, 32, 125, 32, 46, 119, 101, 98, 107, 105, 116, 45,
+    104, 116, 109, 108, 45, 101, 110, 116, 105, 116, 121, 32, 123, 32, 114, 103,
+    98, 40, 49, 51, 54, 44, 32, 49, 56, 44, 32, 49, 50, 56, 41, 59,
+    32, 125, 32, 46, 119, 101, 98, 107, 105, 116, 45, 104, 116, 109, 108, 45,
+    109, 101, 115, 115, 97, 103, 101, 45, 98, 117, 98, 98, 108, 101, 32, 123,
+    32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45, 115, 104, 97,
+    100, 111, 119, 58, 32, 98, 108, 97, 99, 107, 32, 48, 112, 120, 32, 50,
+    112, 120, 32, 53, 112, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45,
+    98, 111, 114, 100, 101, 114, 45, 114, 97, 100, 105, 117, 115, 58, 32, 57,
+    112, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 114, 100,
+    101, 114, 45, 102, 105, 116, 58, 32, 108, 105, 110, 101, 115, 59, 32, 109,
+    105, 110, 45, 104, 101, 105, 103, 104, 116, 58, 32, 49, 51, 112, 120, 59,
+    32, 102, 111, 110, 116, 45, 115, 105, 122, 101, 58, 32, 57, 112, 120, 59,
+    32, 102, 111, 110, 116, 45, 102, 97, 109, 105, 108, 121, 58, 32, 76, 117,
+    99, 105, 100, 97, 32, 71, 114, 97, 110, 100, 101, 59, 32, 102, 111, 110,
+    116, 45, 119, 101, 105, 103, 104, 116, 58, 32, 98, 111, 108, 100, 59, 32,
+    109, 97, 114, 103, 105, 110, 58, 32, 54, 112, 120, 32, 50, 53, 112, 120,
+    59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 48, 32, 55, 112, 120,
+    32, 49, 112, 120, 59, 32, 125, 32, 46, 119, 101, 98, 107, 105, 116, 45,
+    104, 116, 109, 108, 45, 119, 97, 114, 110, 105, 110, 103, 45, 109, 101, 115,
+    115, 97, 103, 101, 32, 123, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110,
+    100, 45, 99, 111, 108, 111, 114, 58, 32, 114, 103, 98, 40, 49, 48, 48,
+    37, 44, 32, 54, 50, 37, 44, 32, 52, 50, 37, 41, 59, 32, 98, 111,
+    114, 100, 101, 114, 58, 32, 50, 112, 120, 32, 115, 111, 108, 105, 100, 32,
+    114, 103, 98, 40, 49, 48, 48, 37, 44, 32, 53, 50, 37, 44, 32, 50,
+    49, 37, 41, 59, 32, 125, 32, 46, 119, 101, 98, 107, 105, 116, 45, 104,
+    116, 109, 108, 45, 101, 114, 114, 111, 114, 45, 109, 101, 115, 115, 97, 103,
+    101, 32, 123, 32, 98, 97, 99, 107, 103, 114, 111, 117, 110, 100, 45, 99,
+    111, 108, 111, 114, 58, 32, 114, 103, 98, 40, 49, 48, 48, 37, 44, 32,
+    52, 50, 37, 44, 32, 52, 50, 37, 41, 59, 32, 98, 111, 114, 100, 101,
+    114, 58, 32, 50, 112, 120, 32, 115, 111, 108, 105, 100, 32, 114, 103, 98,
+    40, 49, 48, 48, 37, 44, 32, 51, 49, 37, 44, 32, 51, 49, 37, 41,
+    59, 32, 125, 32, 46, 119, 101, 98, 107, 105, 116, 45, 104, 116, 109, 108,
+    45, 109, 101, 115, 115, 97, 103, 101, 45, 108, 105, 110, 101, 32, 123, 32,
+    112, 97, 100, 100, 105, 110, 103, 45, 108, 101, 102, 116, 58, 32, 50, 51,
+    112, 120, 59, 32, 116, 101, 120, 116, 45, 105, 110, 100, 101, 110, 116, 58,
+    32, 45, 50, 48, 112, 120, 59, 32, 125, 32, 46, 119, 101, 98, 107, 105,
+    116, 45, 104, 116, 109, 108, 45, 109, 101, 115, 115, 97, 103, 101, 45, 105,
+    99, 111, 110, 32, 123, 32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32,
+    114, 101, 108, 97, 116, 105, 118, 101, 59, 32, 116, 111, 112, 58, 32, 50,
+    112, 120, 59, 32, 109, 97, 114, 103, 105, 110, 58, 32, 48, 32, 52, 112,
+    120, 59, 32, 125
 };
 extern const char wmlUserAgentStyleSheet[2956] = {
     110, 97, 109, 101, 115, 112, 97, 99, 101, 32, 34, 104, 116, 116, 112, 58,
@@ -880,7 +903,7 @@ extern const char wmlUserAgentStyleSheet[2956] = {
     32, 99, 111, 108, 111, 114, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45,
     97, 99, 116, 105, 118, 101, 108, 105, 110, 107, 32, 125
 };
-extern const char mediaControlsUserAgentStyleSheet[1587] = {
+extern const char mediaControlsUserAgentStyleSheet[1999] = {
     97, 117, 100, 105, 111, 32, 123, 32, 119, 105, 100, 116, 104, 58, 32, 50,
     48, 48, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54,
     112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
@@ -888,98 +911,123 @@ extern const char mediaControlsUserAgentStyleSheet[1587] = {
     111, 108, 115, 45, 112, 97, 110, 101, 108, 44, 32, 118, 105, 100, 101, 111,
     58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45,
     99, 111, 110, 116, 114, 111, 108, 115, 45, 112, 97, 110, 101, 108, 32, 123,
-    32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 97, 98, 115, 111, 108,
-    117, 116, 101, 59, 32, 98, 111, 116, 116, 111, 109, 58, 32, 48, 59, 32,
-    119, 105, 100, 116, 104, 58, 32, 49, 48, 48, 37, 59, 32, 104, 101, 105,
-    103, 104, 116, 58, 32, 49, 48, 48, 37, 59, 32, 45, 119, 101, 98, 107,
-    105, 116, 45, 117, 115, 101, 114, 45, 115, 101, 108, 101, 99, 116, 58, 32,
-    110, 111, 110, 101, 59, 32, 125, 32, 118, 105, 100, 101, 111, 58, 45, 119,
-    101, 98, 107, 105, 116, 45, 102, 117, 108, 108, 45, 112, 97, 103, 101, 45,
-    109, 101, 100, 105, 97, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109,
-    101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 112, 97,
-    110, 101, 108, 32, 123, 32, 98, 111, 116, 116, 111, 109, 58, 32, 45, 49,
-    54, 112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119,
+    32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98,
+    111, 120, 45, 111, 114, 105, 101, 110, 116, 58, 32, 104, 111, 114, 105, 122,
+    111, 110, 116, 97, 108, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 117,
+    115, 101, 114, 45, 115, 101, 108, 101, 99, 116, 58, 32, 110, 111, 110, 101,
+    59, 32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 97, 98, 115, 111,
+    108, 117, 116, 101, 59, 32, 98, 111, 116, 116, 111, 109, 58, 32, 48, 59,
+    32, 119, 105, 100, 116, 104, 58, 32, 49, 48, 48, 37, 59, 32, 122, 45,
+    105, 110, 100, 101, 120, 58, 32, 48, 59, 32, 111, 118, 101, 114, 102, 108,
+    111, 119, 58, 32, 104, 105, 100, 100, 101, 110, 59, 32, 104, 101, 105, 103,
+    104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 116, 101, 120, 116, 45, 97,
+    108, 105, 103, 110, 58, 32, 114, 105, 103, 104, 116, 59, 32, 125, 32, 118,
+    105, 100, 101, 111, 58, 45, 119, 101, 98, 107, 105, 116, 45, 102, 117, 108,
+    108, 45, 112, 97, 103, 101, 45, 109, 101, 100, 105, 97, 58, 58, 45, 119,
     101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116,
-    114, 111, 108, 115, 45, 109, 117, 116, 101, 45, 98, 117, 116, 116, 111, 110,
+    114, 111, 108, 115, 45, 112, 97, 110, 101, 108, 32, 123, 32, 98, 111, 116,
+    116, 111, 109, 58, 32, 45, 49, 54, 112, 120, 59, 32, 125, 32, 97, 117,
+    100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100,
+    105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 109, 117, 116, 101,
+    45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58,
+    45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111,
+    110, 116, 114, 111, 108, 115, 45, 109, 117, 116, 101, 45, 98, 117, 116, 116,
+    111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112,
+    101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105, 97, 45, 109,
+    117, 116, 101, 45, 98, 117, 116, 116, 111, 110, 59, 32, 100, 105, 115, 112,
+    108, 97, 121, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120,
+    59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 54, 112, 120, 59, 32, 104,
+    101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 125, 32, 97,
+    117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101,
+    100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 112, 108, 97,
+    121, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58,
+    58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99,
+    111, 110, 116, 114, 111, 108, 115, 45, 112, 108, 97, 121, 45, 98, 117, 116,
+    116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112,
+    112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105, 97, 45,
+    112, 108, 97, 121, 45, 98, 117, 116, 116, 111, 110, 59, 32, 100, 105, 115,
+    112, 108, 97, 121, 58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111,
+    120, 59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 54, 112, 120, 59, 32,
+    104, 101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 125, 32,
+    97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109,
+    101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105,
+    109, 101, 108, 105, 110, 101, 45, 99, 111, 110, 116, 97, 105, 110, 101, 114,
     44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116,
     45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45,
-    109, 117, 116, 101, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119,
-    101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101,
-    58, 32, 109, 101, 100, 105, 97, 45, 109, 117, 116, 101, 45, 98, 117, 116,
-    116, 111, 110, 59, 32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 97,
-    98, 115, 111, 108, 117, 116, 101, 59, 32, 116, 111, 112, 58, 32, 97, 117,
-    116, 111, 59, 32, 98, 111, 116, 116, 111, 109, 58, 32, 48, 59, 32, 108,
-    101, 102, 116, 58, 32, 48, 59, 32, 119, 105, 100, 116, 104, 58, 32, 49,
-    55, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54, 112,
-    120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98,
+    116, 105, 109, 101, 108, 105, 110, 101, 45, 99, 111, 110, 116, 97, 105, 110,
+    101, 114, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112,
+    101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105, 97, 45, 116,
+    105, 109, 101, 108, 105, 110, 101, 45, 99, 111, 110, 116, 97, 105, 110, 101,
+    114, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 45, 119, 101, 98,
+    107, 105, 116, 45, 98, 111, 120, 59, 32, 45, 119, 101, 98, 107, 105, 116,
+    45, 98, 111, 120, 45, 111, 114, 105, 101, 110, 116, 58, 32, 104, 111, 114,
+    105, 122, 111, 110, 116, 97, 108, 59, 32, 45, 119, 101, 98, 107, 105, 116,
+    45, 98, 111, 120, 45, 97, 108, 105, 103, 110, 58, 32, 99, 101, 110, 116,
+    101, 114, 59, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 45,
+    112, 97, 99, 107, 58, 32, 101, 110, 100, 59, 32, 45, 119, 101, 98, 107,
+    105, 116, 45, 98, 111, 120, 45, 102, 108, 101, 120, 58, 32, 49, 59, 32,
+    45, 119, 101, 98, 107, 105, 116, 45, 117, 115, 101, 114, 45, 115, 101, 108,
+    101, 99, 116, 58, 32, 110, 111, 110, 101, 59, 32, 104, 101, 105, 103, 104,
+    116, 58, 32, 49, 54, 112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111,
+    58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45,
+    99, 111, 110, 116, 114, 111, 108, 115, 45, 99, 117, 114, 114, 101, 110, 116,
+    45, 116, 105, 109, 101, 45, 100, 105, 115, 112, 108, 97, 121, 44, 32, 118,
+    105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101,
+    100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 99, 117, 114,
+    114, 101, 110, 116, 45, 116, 105, 109, 101, 45, 100, 105, 115, 112, 108, 97,
+    121, 32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110,
+    101, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98,
     107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111,
-    108, 115, 45, 112, 108, 97, 121, 45, 98, 117, 116, 116, 111, 110, 44, 32,
-    118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109,
-    101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 112, 108,
-    97, 121, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98,
-    107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32,
-    109, 101, 100, 105, 97, 45, 112, 108, 97, 121, 45, 98, 117, 116, 116, 111,
-    110, 59, 32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 97, 98, 115,
-    111, 108, 117, 116, 101, 59, 32, 116, 111, 112, 58, 32, 97, 117, 116, 111,
-    59, 32, 98, 111, 116, 116, 111, 109, 58, 32, 48, 59, 32, 108, 101, 102,
-    116, 58, 32, 49, 54, 112, 120, 59, 32, 119, 105, 100, 116, 104, 58, 32,
-    49, 55, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54,
-    112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101,
+    108, 115, 45, 116, 105, 109, 101, 45, 114, 101, 109, 97, 105, 110, 105, 110,
+    103, 45, 100, 105, 115, 112, 108, 97, 121, 44, 32, 118, 105, 100, 101, 111,
+    58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45,
+    99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 45, 114, 101,
+    109, 97, 105, 110, 105, 110, 103, 45, 100, 105, 115, 112, 108, 97, 121, 32,
+    123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 59,
+    32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115,
+    45, 116, 105, 109, 101, 108, 105, 110, 101, 44, 32, 118, 105, 100, 101, 111,
+    58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45,
+    99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 108, 105, 110,
+    101, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
+    97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105, 97, 45, 115, 108,
+    105, 100, 101, 114, 59, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 45,
+    119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 59, 32, 45, 119, 101, 98,
+    107, 105, 116, 45, 98, 111, 120, 45, 102, 108, 101, 120, 58, 32, 49, 59,
+    32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 112,
+    97, 100, 100, 105, 110, 103, 58, 32, 48, 112, 120, 32, 50, 112, 120, 59,
+    32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115,
+    45, 115, 101, 101, 107, 45, 98, 97, 99, 107, 45, 98, 117, 116, 116, 111,
+    110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115,
+    45, 115, 101, 101, 107, 45, 98, 97, 99, 107, 45, 98, 117, 116, 116, 111,
+    110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101,
+    97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100, 105, 97, 45, 115, 101,
+    101, 107, 45, 98, 97, 99, 107, 45, 98, 117, 116, 116, 111, 110, 59, 32,
+    100, 105, 115, 112, 108, 97, 121, 58, 32, 45, 119, 101, 98, 107, 105, 116,
+    45, 98, 111, 120, 59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 54, 112,
+    120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59,
+    32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105,
+    116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115,
+    45, 115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100, 45, 98, 117,
+    116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101,
     98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114,
-    111, 108, 115, 45, 116, 105, 109, 101, 45, 100, 105, 115, 112, 108, 97, 121,
-    44, 32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116,
-    45, 109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45,
-    116, 105, 109, 101, 45, 100, 105, 115, 112, 108, 97, 121, 32, 123, 32, 100,
-    105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 59, 32, 125, 32,
-    97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109,
-    101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 116, 105,
-    109, 101, 108, 105, 110, 101, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45,
-    119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110,
-    116, 114, 111, 108, 115, 45, 116, 105, 109, 101, 108, 105, 110, 101, 32, 123,
-    32, 45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97,
-    110, 99, 101, 58, 32, 109, 101, 100, 105, 97, 45, 115, 108, 105, 100, 101,
-    114, 59, 32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 97, 98, 115,
-    111, 108, 117, 116, 101, 59, 32, 116, 111, 112, 58, 32, 97, 117, 116, 111,
-    59, 32, 98, 111, 116, 116, 111, 109, 58, 32, 48, 59, 32, 108, 101, 102,
-    116, 58, 32, 51, 50, 112, 120, 59, 32, 114, 105, 103, 104, 116, 58, 32,
-    51, 50, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58, 32, 49, 54,
-    112, 120, 59, 32, 112, 97, 100, 100, 105, 110, 103, 58, 32, 48, 112, 120,
-    32, 50, 112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58, 45,
-    119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110,
-    116, 114, 111, 108, 115, 45, 115, 101, 101, 107, 45, 98, 97, 99, 107, 45,
-    98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101, 111, 58, 58, 45,
-    119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111, 110,
-    116, 114, 111, 108, 115, 45, 115, 101, 101, 107, 45, 98, 97, 99, 107, 45,
-    98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105, 116,
-    45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101, 100,
-    105, 97, 45, 115, 101, 101, 107, 45, 98, 97, 99, 107, 45, 98, 117, 116,
-    116, 111, 110, 59, 32, 112, 111, 115, 105, 116, 105, 111, 110, 58, 32, 97,
-    98, 115, 111, 108, 117, 116, 101, 59, 32, 116, 111, 112, 58, 32, 97, 117,
-    116, 111, 59, 32, 98, 111, 116, 116, 111, 109, 58, 32, 48, 59, 32, 114,
-    105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 119, 105, 100, 116,
-    104, 58, 32, 49, 55, 112, 120, 59, 32, 104, 101, 105, 103, 104, 116, 58,
-    32, 49, 54, 112, 120, 59, 32, 125, 32, 97, 117, 100, 105, 111, 58, 58,
-    45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97, 45, 99, 111,
-    110, 116, 114, 111, 108, 115, 45, 115, 101, 101, 107, 45, 102, 111, 114, 119,
-    97, 114, 100, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100, 101,
+    111, 108, 115, 45, 115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100,
+    45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 45, 119, 101, 98, 107, 105,
+    116, 45, 97, 112, 112, 101, 97, 114, 97, 110, 99, 101, 58, 32, 109, 101,
+    100, 105, 97, 45, 115, 101, 101, 107, 45, 102, 111, 114, 119, 97, 114, 100,
+    45, 98, 117, 116, 116, 111, 110, 59, 32, 100, 105, 115, 112, 108, 97, 121,
+    58, 32, 45, 119, 101, 98, 107, 105, 116, 45, 98, 111, 120, 59, 32, 119,
+    105, 100, 116, 104, 58, 32, 49, 54, 112, 120, 59, 32, 104, 101, 105, 103,
+    104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 125, 32, 97, 117, 100, 105,
     111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105, 97,
-    45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 115, 101, 101, 107, 45, 102,
-    111, 114, 119, 97, 114, 100, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32,
-    45, 119, 101, 98, 107, 105, 116, 45, 97, 112, 112, 101, 97, 114, 97, 110,
-    99, 101, 58, 32, 109, 101, 100, 105, 97, 45, 115, 101, 101, 107, 45, 102,
-    111, 114, 119, 97, 114, 100, 45, 98, 117, 116, 116, 111, 110, 59, 32, 112,
-    111, 115, 105, 116, 105, 111, 110, 58, 32, 97, 98, 115, 111, 108, 117, 116,
-    101, 59, 32, 116, 111, 112, 58, 32, 97, 117, 116, 111, 59, 32, 98, 111,
-    116, 116, 111, 109, 58, 32, 48, 59, 32, 114, 105, 103, 104, 116, 58, 32,
-    48, 59, 32, 119, 105, 100, 116, 104, 58, 32, 49, 55, 112, 120, 59, 32,
-    104, 101, 105, 103, 104, 116, 58, 32, 49, 54, 112, 120, 59, 32, 125, 32,
-    97, 117, 100, 105, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109,
-    101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 102, 117,
-    108, 108, 115, 99, 114, 101, 101, 110, 45, 98, 117, 116, 116, 111, 110, 44,
-    32, 118, 105, 100, 101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45,
-    109, 101, 100, 105, 97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 102,
-    117, 108, 108, 115, 99, 114, 101, 101, 110, 45, 98, 117, 116, 116, 111, 110,
-    32, 123, 32, 100, 105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101,
-    59, 32, 125
+    45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 102, 117, 108, 108, 115, 99,
+    114, 101, 101, 110, 45, 98, 117, 116, 116, 111, 110, 44, 32, 118, 105, 100,
+    101, 111, 58, 58, 45, 119, 101, 98, 107, 105, 116, 45, 109, 101, 100, 105,
+    97, 45, 99, 111, 110, 116, 114, 111, 108, 115, 45, 102, 117, 108, 108, 115,
+    99, 114, 101, 101, 110, 45, 98, 117, 116, 116, 111, 110, 32, 123, 32, 100,
+    105, 115, 112, 108, 97, 121, 58, 32, 110, 111, 110, 101, 59, 32, 125
 };
 }
diff --git a/src/3rdparty/webkit/WebCore/generated/XLinkNames.h b/src/3rdparty/webkit/WebCore/generated/XLinkNames.h
index 3e796c5..9a9cb29 100644
--- a/src/3rdparty/webkit/WebCore/generated/XLinkNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/XLinkNames.h
@@ -55,11 +55,10 @@ extern const WebCore::QualifiedName titleAttr;
 extern char titleAttrString[];
 extern const WebCore::QualifiedName typeAttr;
 extern char typeAttrString[];
-
-
-WebCore::QualifiedName** getXLinkAttr(size_t* size);
 #endif
 
+WebCore::QualifiedName** getXLinkAttrs(size_t* size);
+
 void init();
 
 } }
diff --git a/src/3rdparty/webkit/WebCore/generated/XMLNames.h b/src/3rdparty/webkit/WebCore/generated/XMLNames.h
index 7f04550..f135e96 100644
--- a/src/3rdparty/webkit/WebCore/generated/XMLNames.h
+++ b/src/3rdparty/webkit/WebCore/generated/XMLNames.h
@@ -44,11 +44,10 @@ extern const WebCore::AtomicString xmlNamespaceURI;
 extern const WebCore::QualifiedName baseAttr;
 extern const WebCore::QualifiedName langAttr;
 extern const WebCore::QualifiedName spaceAttr;
-
-
-WebCore::QualifiedName** getXMLAttr(size_t* size);
 #endif
 
+WebCore::QualifiedName** getXMLAttrs(size_t* size);
+
 void init();
 
 } }
diff --git a/src/3rdparty/webkit/WebCore/generated/XPathGrammar.cpp b/src/3rdparty/webkit/WebCore/generated/XPathGrammar.cpp
index 1e67ca6..d06adf6 100644
--- a/src/3rdparty/webkit/WebCore/generated/XPathGrammar.cpp
+++ b/src/3rdparty/webkit/WebCore/generated/XPathGrammar.cpp
@@ -178,7 +178,7 @@ typedef union YYSTYPE
     LocationPath* locationPath;
 }
 /* Line 187 of yacc.c.  */
-#line 182 "XPathGrammar.tab.c"
+#line 182 "WebCore/tmp/../generated/XPathGrammar.tab.c"
 	YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
@@ -191,13 +191,13 @@ typedef union YYSTYPE
 #line 69 "../xml/XPathGrammar.y"
 
 
-int xpathyylex(YYSTYPE* yylval) { return Parser::current()->lex(yylval); }
-void xpathyyerror(const char*) { }
+static int xpathyylex(YYSTYPE* yylval) { return Parser::current()->lex(yylval); }
+static void xpathyyerror(const char*) { }
     
 
 
 /* Line 216 of yacc.c.  */
-#line 201 "XPathGrammar.tab.c"
+#line 201 "WebCore/tmp/../generated/XPathGrammar.tab.c"
 
 #ifdef short
 # undef short
@@ -1929,7 +1929,7 @@ yyreduce:
 
 
 /* Line 1267 of yacc.c.  */
-#line 1933 "XPathGrammar.tab.c"
+#line 1933 "WebCore/tmp/../generated/XPathGrammar.tab.c"
       default: break;
     }
   YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc);
diff --git a/src/3rdparty/webkit/WebCore/generated/XPathGrammar.h b/src/3rdparty/webkit/WebCore/generated/XPathGrammar.h
index cabe35a..9728266 100644
--- a/src/3rdparty/webkit/WebCore/generated/XPathGrammar.h
+++ b/src/3rdparty/webkit/WebCore/generated/XPathGrammar.h
@@ -98,7 +98,7 @@ typedef union YYSTYPE
     LocationPath* locationPath;
 }
 /* Line 1489 of yacc.c.  */
-#line 102 "XPathGrammar.tab.h"
+#line 102 "WebCore/tmp/../generated/XPathGrammar.tab.h"
 	YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
diff --git a/src/3rdparty/webkit/WebCore/history/BackForwardList.h b/src/3rdparty/webkit/WebCore/history/BackForwardList.h
index 6b1db3e..a99d387 100644
--- a/src/3rdparty/webkit/WebCore/history/BackForwardList.h
+++ b/src/3rdparty/webkit/WebCore/history/BackForwardList.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
  * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2009 Google, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -40,10 +41,31 @@ class Page;
 typedef Vector<RefPtr<HistoryItem> > HistoryItemVector;
 typedef HashSet<RefPtr<HistoryItem> > HistoryItemHashSet;
 
+#if PLATFORM(CHROMIUM)
+// In the Chromium port, the back/forward list is managed externally.
+// See BackForwardListChromium.cpp
+class BackForwardListClient {
+public:
+    virtual ~BackForwardListClient() {}
+    virtual void addItem(PassRefPtr<HistoryItem>) = 0;
+    virtual void goToItem(HistoryItem*) = 0;
+    virtual HistoryItem* currentItem() = 0;
+    virtual HistoryItem* itemAtIndex(int) = 0;
+    virtual int backListCount() = 0;
+    virtual int forwardListCount() = 0;
+    virtual void close() = 0;
+};
+#endif
+
 class BackForwardList : public RefCounted<BackForwardList> {
 public: 
     static PassRefPtr<BackForwardList> create(Page* page) { return adoptRef(new BackForwardList(page)); }
     ~BackForwardList();
+
+#if PLATFORM(CHROMIUM)
+    // Must be called before any other methods. 
+    void setClient(BackForwardListClient* client) { m_client = client; }
+#endif
     
     Page* page() { return m_page; }
     
@@ -82,14 +104,18 @@ private:
     BackForwardList(Page*);
 
     Page* m_page;
+#if PLATFORM(CHROMIUM) 
+    BackForwardListClient* m_client;
+#else
     HistoryItemVector m_entries;
     HistoryItemHashSet m_entryHash;
     unsigned m_current;
+#endif
     unsigned m_capacity;
     bool m_closed;
     bool m_enabled;
-}; //class BackForwardList
+};
     
-}; //namespace WebCore
+} //namespace WebCore
 
-#endif //BACKFORWARDLIST_H
+#endif
diff --git a/src/3rdparty/webkit/WebCore/history/BackForwardListChromium.cpp b/src/3rdparty/webkit/WebCore/history/BackForwardListChromium.cpp
new file mode 100644
index 0000000..34f294c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/history/BackForwardListChromium.cpp
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "BackForwardList.h"
+
+#include "HistoryItem.h"
+#include "Logging.h"
+
+namespace WebCore {
+
+static const unsigned DefaultCapacity = 100;
+static const unsigned NoCurrentItemIndex = UINT_MAX;
+
+BackForwardList::BackForwardList(Page* page)
+    : m_page(page)
+    , m_client(0)
+    , m_capacity(DefaultCapacity)
+    , m_closed(true)
+    , m_enabled(true)
+{
+}
+
+BackForwardList::~BackForwardList()
+{
+    ASSERT(m_closed);
+}
+
+void BackForwardList::addItem(PassRefPtr<HistoryItem> prpItem)
+{
+    ASSERT(prpItem);
+    if (m_capacity == 0 || !m_enabled)
+        return;
+ 
+    m_client->addItem(prpItem);
+}
+
+void BackForwardList::goToItem(HistoryItem* item)
+{
+    m_client->goToItem(item);
+}
+
+HistoryItem* BackForwardList::backItem()
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+HistoryItem* BackForwardList::forwardItem()
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+HistoryItem* BackForwardList::currentItem()
+{
+    return m_client->currentItem();
+}
+
+int BackForwardList::capacity()
+{
+    return m_capacity;
+}
+
+void BackForwardList::setCapacity(int size)
+{
+    m_capacity = size;
+}
+
+bool BackForwardList::enabled()
+{
+    return m_enabled;
+}
+
+void BackForwardList::setEnabled(bool enabled)
+{
+    m_enabled = enabled;
+    if (!enabled) {
+        int capacity = m_capacity;
+        setCapacity(0);
+        setCapacity(capacity);
+    }
+}
+
+int BackForwardList::backListCount()
+{
+    return m_client->backListCount();
+}
+
+int BackForwardList::forwardListCount()
+{
+    return m_client->forwardListCount();
+}
+
+HistoryItem* BackForwardList::itemAtIndex(int index)
+{
+    return m_client->itemAtIndex(index);
+}
+
+HistoryItemVector& BackForwardList::entries()
+{
+    static HistoryItemVector noEntries;
+    return noEntries;
+}
+
+void BackForwardList::close()
+{
+    if (m_client)
+        m_client->close();
+    m_page = 0;
+    m_closed = true;
+}
+
+bool BackForwardList::closed()
+{
+    return m_closed;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/history/CachedFrame.cpp b/src/3rdparty/webkit/WebCore/history/CachedFrame.cpp
new file mode 100644
index 0000000..9a43b9d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/history/CachedFrame.cpp
@@ -0,0 +1,158 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+#include "config.h"
+#include "CachedPage.h"
+
+#include "CachedFramePlatformData.h"
+#include "CString.h"
+#include "DocumentLoader.h"
+#include "Frame.h"
+#include "FrameLoaderClient.h"
+#include "FrameView.h"
+#include "Logging.h"
+#include <wtf/RefCountedLeakCounter.h>
+
+#if ENABLE(SVG)
+#include "SVGDocumentExtensions.h"
+#endif
+
+namespace WebCore {
+
+#ifndef NDEBUG
+static WTF::RefCountedLeakCounter& cachedFrameCounter()
+{
+    DEFINE_STATIC_LOCAL(WTF::RefCountedLeakCounter, counter, ("CachedFrame"));
+    return counter;
+}
+#endif
+
+CachedFrame::CachedFrame(Frame* frame)
+    : m_document(frame->document())
+    , m_documentLoader(frame->loader()->documentLoader())
+    , m_view(frame->view())
+    , m_mousePressNode(frame->eventHandler()->mousePressNode())
+    , m_url(frame->loader()->url())
+{
+#ifndef NDEBUG
+    cachedFrameCounter().increment();
+#endif
+    ASSERT(m_document);
+    ASSERT(m_documentLoader);
+    ASSERT(m_view);
+
+    // Active DOM objects must be suspended before we cached the frame script data
+    m_document->suspendActiveDOMObjects();
+    m_cachedFrameScriptData.set(new ScriptCachedFrameData(frame));
+    
+    m_document->documentWillBecomeInactive(); 
+    frame->clearTimers();
+    m_document->setInPageCache(true);
+    
+    frame->loader()->client()->savePlatformDataToCachedFrame(this);
+
+    for (Frame* child = frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
+        m_childFrames.append(CachedFrame::create(child));
+
+    LOG(PageCache, "Finished creating CachedFrame with url %s and documentloader %p\n", m_url.string().utf8().data(), m_documentLoader.get());
+}
+
+CachedFrame::~CachedFrame()
+{
+#ifndef NDEBUG
+    cachedFrameCounter().decrement();
+#endif
+
+    clear();
+}
+
+void CachedFrame::restore()
+{
+    ASSERT(m_document->view() == m_view);
+    
+    Frame* frame = m_view->frame();
+    m_cachedFrameScriptData->restore(frame);
+
+#if ENABLE(SVG)
+    if (m_document->svgExtensions())
+        m_document->accessSVGExtensions()->unpauseAnimations();
+#endif
+
+    frame->animation()->resumeAnimations(m_document.get());
+    frame->eventHandler()->setMousePressNode(mousePressNode());
+    m_document->resumeActiveDOMObjects();
+
+    // It is necessary to update any platform script objects after restoring the
+    // cached page.
+    frame->script()->updatePlatformScriptObjects();
+}
+
+void CachedFrame::clear()
+{
+    if (!m_document)
+        return;
+
+    if (m_cachedFramePlatformData)
+        m_cachedFramePlatformData->clear();
+        
+    ASSERT(m_view);
+    ASSERT(m_document->frame() == m_view->frame());
+
+    if (m_document->inPageCache()) {
+        Frame::clearTimers(m_view.get(), m_document.get());
+
+        // FIXME: Why do we need to call removeAllEventListeners here? When the document is in page cache, this method won't work
+        // fully anyway, because the document won't be able to access its DOMWindow object (due to being frameless).
+        m_document->removeAllEventListeners();
+
+        m_document->setInPageCache(false);
+        // FIXME: We don't call willRemove here. Why is that OK?
+        m_document->detach();
+        m_view->clearFrame();
+    }
+
+    ASSERT(!m_document->inPageCache());
+
+    m_document = 0;
+    m_view = 0;
+    m_mousePressNode = 0;
+    m_url = KURL();
+
+    m_cachedFramePlatformData.clear();
+
+    m_cachedFrameScriptData.clear();
+}
+
+void CachedFrame::setCachedFramePlatformData(CachedFramePlatformData* data)
+{
+    m_cachedFramePlatformData.set(data);
+}
+
+CachedFramePlatformData* CachedFrame::cachedFramePlatformData()
+{
+    return m_cachedFramePlatformData.get();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/history/CachedFrame.h b/src/3rdparty/webkit/WebCore/history/CachedFrame.h
new file mode 100644
index 0000000..83c3c3c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/history/CachedFrame.h
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+ 
+#ifndef CachedFrame_h
+#define CachedFrame_h
+
+#include "KURL.h"
+#include "ScriptCachedFrameData.h"
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+    
+    class CachedFrame;
+    class CachedFramePlatformData;
+    class DOMWindow;
+    class Document;
+    class DocumentLoader;
+    class Frame;
+    class FrameView;
+    class Node;
+
+typedef Vector<RefPtr<CachedFrame> > CachedFrameVector;
+
+class CachedFrame : public RefCounted<CachedFrame> {
+public:
+    static PassRefPtr<CachedFrame> create(Frame* frame) { return adoptRef(new CachedFrame(frame)); }
+    ~CachedFrame();
+
+    void restore();
+    void clear();
+
+    Document* document() const { return m_document.get(); }
+    DocumentLoader* documentLoader() const { return m_documentLoader.get(); }
+    FrameView* view() const { return m_view.get(); }
+    Node* mousePressNode() const { return m_mousePressNode.get(); }
+    const KURL& url() const { return m_url; }
+    DOMWindow* domWindow() const { return m_cachedFrameScriptData->domWindow(); }
+
+    void setCachedFramePlatformData(CachedFramePlatformData*);
+    CachedFramePlatformData* cachedFramePlatformData();
+
+private:
+    CachedFrame(Frame*);
+
+    RefPtr<Document> m_document;
+    RefPtr<DocumentLoader> m_documentLoader;
+    RefPtr<FrameView> m_view;
+    RefPtr<Node> m_mousePressNode;
+    KURL m_url;
+    OwnPtr<ScriptCachedFrameData> m_cachedFrameScriptData;
+    OwnPtr<CachedFramePlatformData> m_cachedFramePlatformData;
+    
+    CachedFrameVector m_childFrames;
+};
+
+} // namespace WebCore
+
+#endif // CachedFrame_h
diff --git a/src/3rdparty/webkit/WebCore/history/CachedPagePlatformData.h b/src/3rdparty/webkit/WebCore/history/CachedFramePlatformData.h
index c623f2f..01da8e5 100644
--- a/src/3rdparty/webkit/WebCore/history/CachedPagePlatformData.h
+++ b/src/3rdparty/webkit/WebCore/history/CachedFramePlatformData.h
@@ -25,8 +25,8 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
-#ifndef CachedPagePlatformData_h
-#define CachedPagePlatformData_h
+#ifndef CachedFramePlatformData_h
+#define CachedFramePlatformData_h
 
 namespace WebCore {
 
@@ -34,12 +34,12 @@ namespace WebCore {
 // goes into the Back/Forward page cache, and perform some action with that data when the page comes out.  
 // Each platform should subclass this class as neccessary
 
-class CachedPagePlatformData {
+class CachedFramePlatformData {
 public:
-    virtual ~CachedPagePlatformData() { }
+    virtual ~CachedFramePlatformData() { }
     virtual void clear() { }
 };
 
 } // namespace WebCore
 
-#endif // CachedPagePlatformData_h
+#endif // CachedFramePlatformData_h
diff --git a/src/3rdparty/webkit/WebCore/history/CachedPage.cpp b/src/3rdparty/webkit/WebCore/history/CachedPage.cpp
index 2690f76..8898ce2 100644
--- a/src/3rdparty/webkit/WebCore/history/CachedPage.cpp
+++ b/src/3rdparty/webkit/WebCore/history/CachedPage.cpp
@@ -26,26 +26,13 @@
 #include "config.h"
 #include "CachedPage.h"
 
-#include "AnimationController.h"
-#include "CachedPagePlatformData.h"
-#include "Document.h"
-#include "DocumentLoader.h"
-#include "Element.h"
-#include "EventHandler.h"
 #include "FocusController.h"
 #include "Frame.h"
-#include "FrameLoader.h"
 #include "FrameView.h"
-#include "Logging.h"
 #include "Page.h"
-#include "PageGroup.h"
-#include "SystemTime.h"
+#include <wtf/CurrentTime.h>
 #include <wtf/RefCountedLeakCounter.h>
 
-#if ENABLE(SVG)
-#include "SVGDocumentExtensions.h"
-#endif
-
 using namespace JSC;
 
 namespace WebCore {
@@ -60,23 +47,12 @@ PassRefPtr<CachedPage> CachedPage::create(Page* page)
 }
 
 CachedPage::CachedPage(Page* page)
-    : m_timeStamp(0)
-    , m_document(page->mainFrame()->document())
-    , m_view(page->mainFrame()->view())
-    , m_mousePressNode(page->mainFrame()->eventHandler()->mousePressNode())
-    , m_URL(page->mainFrame()->loader()->url())
-    , m_cachedPageScriptData(page)
+    : m_timeStamp(currentTime())
+    , m_cachedMainFrame(CachedFrame::create(page->mainFrame()))
 {
 #ifndef NDEBUG
     cachedPageCounter.increment();
 #endif
-    
-    m_document->documentWillBecomeInactive(); 
-    
-    Frame* mainFrame = page->mainFrame();
-    mainFrame->clearTimers();
-
-    m_document->setInPageCache(true);
 }
 
 CachedPage::~CachedPage()
@@ -88,28 +64,11 @@ CachedPage::~CachedPage()
     clear();
 }
 
-DOMWindow* CachedPage::domWindow() const
-{
-    return m_cachedPageScriptData.domWindow();
-}
-
 void CachedPage::restore(Page* page)
 {
-    ASSERT(m_document->view() == m_view);
-
-    Frame* mainFrame = page->mainFrame();
-
-    m_cachedPageScriptData.restore(page);
-
-#if ENABLE(SVG)
-    if (m_document && m_document->svgExtensions())
-        m_document->accessSVGExtensions()->unpauseAnimations();
-#endif
-
-    mainFrame->animation()->resumeAnimations(m_document.get());
+    ASSERT(page && page->mainFrame() && page->mainFrame() == m_cachedMainFrame->view()->frame());
+    m_cachedMainFrame->restore();
 
-    mainFrame->eventHandler()->setMousePressNode(mousePressNode());
-        
     // Restore the focus appearance for the focused element.
     // FIXME: Right now we don't support pages w/ frames in the b/f cache.  This may need to be tweaked when we add support for that.
     Document* focusedDocument = page->focusController()->focusedOrMainFrame()->document();
@@ -121,71 +80,7 @@ void CachedPage::restore(Page* page)
 
 void CachedPage::clear()
 {
-    if (!m_document)
-        return;
-
-    if (m_cachedPagePlatformData)
-        m_cachedPagePlatformData->clear();
-        
-    ASSERT(m_view);
-    ASSERT(m_document->frame() == m_view->frame());
-
-    if (m_document->inPageCache()) {
-        Frame::clearTimers(m_view.get(), m_document.get());
-
-        m_document->setInPageCache(false);
-        // FIXME: We don't call willRemove here. Why is that OK?
-        m_document->detach();
-        m_document->removeAllEventListenersFromAllNodes();
-
-        m_view->clearFrame();
-    }
-
-    ASSERT(!m_document->inPageCache());
-
-    m_document = 0;
-    m_view = 0;
-    m_mousePressNode = 0;
-    m_URL = KURL();
-
-    m_cachedPagePlatformData.clear();
-
-    m_cachedPageScriptData.clear();
-}
-
-void CachedPage::setDocumentLoader(PassRefPtr<DocumentLoader> loader)
-{
-    m_documentLoader = loader;
-}
-
-DocumentLoader* CachedPage::documentLoader()
-{
-    return m_documentLoader.get();
-}
-
-void CachedPage::setTimeStamp(double timeStamp)
-{
-    m_timeStamp = timeStamp;
-}
-
-void CachedPage::setTimeStampToNow()
-{
-    m_timeStamp = currentTime();
-}
-
-double CachedPage::timeStamp() const
-{
-    return m_timeStamp;
-}
-
-void CachedPage::setCachedPagePlatformData(CachedPagePlatformData* data)
-{
-    m_cachedPagePlatformData.set(data);
-}
-
-CachedPagePlatformData* CachedPage::cachedPagePlatformData()
-{
-    return m_cachedPagePlatformData.get();
+    m_cachedMainFrame.clear();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/history/CachedPage.h b/src/3rdparty/webkit/WebCore/history/CachedPage.h
index 7602e20..430cf3a 100644
--- a/src/3rdparty/webkit/WebCore/history/CachedPage.h
+++ b/src/3rdparty/webkit/WebCore/history/CachedPage.h
@@ -26,18 +26,16 @@
 #ifndef CachedPage_h
 #define CachedPage_h
 
-#include "KURL.h"
-#include <wtf/OwnPtr.h>
-#include "ScriptCachedPageData.h"
+#include "CachedFrame.h"
 
 namespace WebCore {
     
-    class CachedPagePlatformData;
+    class CachedFramePlatformData;
     class DOMWindow;
     class Document;
     class DocumentLoader;
     class FrameView;
-    class JSDOMWindow;
+    class KURL;
     class Node;
     class Page;
 
@@ -45,37 +43,25 @@ class CachedPage : public RefCounted<CachedPage> {
 public:
     static PassRefPtr<CachedPage> create(Page*);
     ~CachedPage();
-    
-    void clear();
-
-    Document* document() const { return m_document.get(); }
-    FrameView* view() const { return m_view.get(); }
-    Node* mousePressNode() const { return m_mousePressNode.get(); }
-    const KURL& url() const { return m_URL; }
-    DOMWindow* domWindow() const;
 
     void restore(Page*);
-        
-    void setTimeStamp(double);
-    void setTimeStampToNow();
-    double timeStamp() const;
-    void setDocumentLoader(PassRefPtr<DocumentLoader>);
-    DocumentLoader* documentLoader();
+    void clear();
 
-    void setCachedPagePlatformData(CachedPagePlatformData*);
-    CachedPagePlatformData* cachedPagePlatformData();
+    Document* document() const { return m_cachedMainFrame->document(); }
+    DocumentLoader* documentLoader() const { return m_cachedMainFrame->documentLoader(); }
+    FrameView* mainFrameView() const { return m_cachedMainFrame->view(); }
+    const KURL& url() const { return m_cachedMainFrame->url(); }
+    DOMWindow* domWindow() const { return m_cachedMainFrame->domWindow(); }
+
+    double timeStamp() const { return m_timeStamp; }
+    
+    CachedFrame* cachedMainFrame() { return m_cachedMainFrame.get(); }
 
 private:
     CachedPage(Page*);
-    RefPtr<DocumentLoader> m_documentLoader;
-    double m_timeStamp;
 
-    RefPtr<Document> m_document;
-    RefPtr<FrameView> m_view;
-    RefPtr<Node> m_mousePressNode;
-    KURL m_URL;
-    ScriptCachedPageData m_cachedPageScriptData;
-    OwnPtr<CachedPagePlatformData> m_cachedPagePlatformData;
+    double m_timeStamp;
+    RefPtr<CachedFrame> m_cachedMainFrame;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/history/HistoryItem.cpp b/src/3rdparty/webkit/WebCore/history/HistoryItem.cpp
index 10efd4d..6156524 100644
--- a/src/3rdparty/webkit/WebCore/history/HistoryItem.cpp
+++ b/src/3rdparty/webkit/WebCore/history/HistoryItem.cpp
@@ -44,8 +44,8 @@ void (*notifyHistoryItemChanged)() = defaultNotifyHistoryItemChanged;
 
 HistoryItem::HistoryItem()
     : m_lastVisitedTime(0)
+    , m_lastVisitWasHTTPNonGet(false)
     , m_lastVisitWasFailure(false)
-    , m_isInPageCache(false)
     , m_isTargetItem(false)
     , m_visitCount(0)
 {
@@ -56,8 +56,8 @@ HistoryItem::HistoryItem(const String& urlString, const String& title, double ti
     , m_originalURLString(urlString)
     , m_title(title)
     , m_lastVisitedTime(time)
+    , m_lastVisitWasHTTPNonGet(false)
     , m_lastVisitWasFailure(false)
-    , m_isInPageCache(false)
     , m_isTargetItem(false)
     , m_visitCount(0)
 {    
@@ -70,11 +70,11 @@ HistoryItem::HistoryItem(const String& urlString, const String& title, const Str
     , m_title(title)
     , m_displayTitle(alternateTitle)
     , m_lastVisitedTime(time)
+    , m_lastVisitWasHTTPNonGet(false)
     , m_lastVisitWasFailure(false)
-    , m_isInPageCache(false)
     , m_isTargetItem(false)
     , m_visitCount(0)
-{    
+{
     iconDatabase()->retainIconForPageURL(m_urlString);
 }
 
@@ -85,8 +85,8 @@ HistoryItem::HistoryItem(const KURL& url, const String& target, const String& pa
     , m_parent(parent)
     , m_title(title)
     , m_lastVisitedTime(0)
+    , m_lastVisitWasHTTPNonGet(false)
     , m_lastVisitWasFailure(false)
-    , m_isInPageCache(false)
     , m_isTargetItem(false)
     , m_visitCount(0)
 {    
@@ -95,7 +95,7 @@ HistoryItem::HistoryItem(const KURL& url, const String& target, const String& pa
 
 HistoryItem::~HistoryItem()
 {
-    ASSERT(!m_isInPageCache);
+    ASSERT(!m_cachedPage);
     iconDatabase()->releaseIconForPageURL(m_urlString);
 }
 
@@ -103,27 +103,33 @@ inline HistoryItem::HistoryItem(const HistoryItem& item)
     : RefCounted<HistoryItem>()
     , m_urlString(item.m_urlString)
     , m_originalURLString(item.m_originalURLString)
+    , m_referrer(item.m_referrer)
     , m_target(item.m_target)
     , m_parent(item.m_parent)
     , m_title(item.m_title)
     , m_displayTitle(item.m_displayTitle)
     , m_lastVisitedTime(item.m_lastVisitedTime)
+    , m_lastVisitWasHTTPNonGet(item.m_lastVisitWasHTTPNonGet)
     , m_scrollPoint(item.m_scrollPoint)
     , m_lastVisitWasFailure(item.m_lastVisitWasFailure)
-    , m_isInPageCache(item.m_isInPageCache)
     , m_isTargetItem(item.m_isTargetItem)
     , m_visitCount(item.m_visitCount)
+    , m_dailyVisitCounts(item.m_dailyVisitCounts)
+    , m_weeklyVisitCounts(item.m_weeklyVisitCounts)
     , m_formContentType(item.m_formContentType)
-    , m_formReferrer(item.m_formReferrer)
-    , m_rssFeedReferrer(item.m_rssFeedReferrer)
 {
+    ASSERT(!item.m_cachedPage);
+
     if (item.m_formData)
         m_formData = item.m_formData->copy();
         
-    unsigned size = item.m_subItems.size();
-    m_subItems.reserveCapacity(size);
+    unsigned size = item.m_children.size();
+    m_children.reserveInitialCapacity(size);
     for (unsigned i = 0; i < size; ++i)
-        m_subItems.append(item.m_subItems[i]->copy());
+        m_children.uncheckedAppend(item.m_children[i]->copy());
+
+    if (item.m_redirectURLs)
+        m_redirectURLs.set(new Vector<String>(*item.m_redirectURLs));
 }
 
 PassRefPtr<HistoryItem> HistoryItem::copy() const
@@ -174,6 +180,11 @@ KURL HistoryItem::originalURL() const
     return KURL(m_originalURLString);
 }
 
+const String& HistoryItem::referrer() const
+{
+    return m_referrer;
+}
+
 const String& HistoryItem::target() const
 {
     return m_target;
@@ -214,6 +225,12 @@ void HistoryItem::setOriginalURLString(const String& urlString)
     notifyHistoryItemChanged();
 }
 
+void HistoryItem::setReferrer(const String& referrer)
+{
+    m_referrer = referrer;
+    notifyHistoryItemChanged();
+}
+
 void HistoryItem::setTitle(const String& title)
 {
     m_title = title;
@@ -231,19 +248,67 @@ void HistoryItem::setParent(const String& parent)
     m_parent = parent;
 }
 
-void HistoryItem::setLastVisitedTime(double time)
+static inline int timeToDay(double time)
+{
+    static const double secondsPerDay = 60 * 60 * 24;
+    return static_cast<int>(ceil(time / secondsPerDay));
+}
+
+void HistoryItem::padDailyCountsForNewVisit(double time)
+{
+    if (m_dailyVisitCounts.isEmpty())
+        m_dailyVisitCounts.prepend(m_visitCount);
+
+    int daysElapsed = timeToDay(time) - timeToDay(m_lastVisitedTime);
+
+    if (daysElapsed < 0)
+      daysElapsed = 0;
+
+    Vector<int> padding;
+    padding.fill(0, daysElapsed);
+    m_dailyVisitCounts.prepend(padding);
+}
+
+static const size_t daysPerWeek = 7;
+static const size_t maxDailyCounts = 2 * daysPerWeek - 1;
+static const size_t maxWeeklyCounts = 5;
+
+void HistoryItem::collapseDailyVisitsToWeekly()
 {
-    if (m_lastVisitedTime != time) {
-        m_lastVisitedTime = time;
-        m_visitCount++;
+    while (m_dailyVisitCounts.size() > maxDailyCounts) {
+        int oldestWeekTotal = 0;
+        for (size_t i = 0; i < daysPerWeek; i++)
+            oldestWeekTotal += m_dailyVisitCounts[m_dailyVisitCounts.size() - daysPerWeek + i];
+        m_dailyVisitCounts.shrink(m_dailyVisitCounts.size() - daysPerWeek);
+        m_weeklyVisitCounts.prepend(oldestWeekTotal);
     }
+
+    if (m_weeklyVisitCounts.size() > maxWeeklyCounts)
+        m_weeklyVisitCounts.shrink(maxWeeklyCounts);
 }
 
-void HistoryItem::visited(const String& title, double time)
+void HistoryItem::recordVisitAtTime(double time)
 {
-    m_title = title;
+    padDailyCountsForNewVisit(time);
+
     m_lastVisitedTime = time;
     m_visitCount++;
+
+    m_dailyVisitCounts[0]++;
+
+    collapseDailyVisitsToWeekly();
+}
+
+void HistoryItem::setLastVisitedTime(double time)
+{
+    if (m_lastVisitedTime != time)
+        recordVisitAtTime(time);
+}
+
+void HistoryItem::visited(const String& title, double time)
+{
+    m_title = title;
+    recordVisitAtTime(time);
 }
 
 int HistoryItem::visitCount() const
@@ -251,11 +316,25 @@ int HistoryItem::visitCount() const
     return m_visitCount;
 }
 
+void HistoryItem::recordInitialVisit()
+{
+    ASSERT(!m_visitCount);
+    recordVisitAtTime(m_lastVisitedTime);
+}
+
 void HistoryItem::setVisitCount(int count)
 {
     m_visitCount = count;
 }
 
+void HistoryItem::adoptVisitCounts(Vector<int>& dailyCounts, Vector<int>& weeklyCounts)
+{
+  m_dailyVisitCounts.clear();
+  m_dailyVisitCounts.swap(dailyCounts);
+  m_weeklyVisitCounts.clear();
+  m_weeklyVisitCounts.swap(weeklyCounts);
+}
+
 const IntPoint& HistoryItem::scrollPoint() const
 {
     return m_scrollPoint;
@@ -299,89 +378,98 @@ void HistoryItem::setIsTargetItem(bool flag)
 
 void HistoryItem::addChildItem(PassRefPtr<HistoryItem> child)
 {
-    m_subItems.append(child);
+    ASSERT(!childItemWithTarget(child->target()));
+    m_children.append(child);
+}
+
+void HistoryItem::setChildItem(PassRefPtr<HistoryItem> child)
+{
+    ASSERT(!child->isTargetItem());
+    unsigned size = m_children.size();
+    for (unsigned i = 0; i < size; ++i)  {
+        if (m_children[i]->target() == child->target()) {
+            child->setIsTargetItem(m_children[i]->isTargetItem());
+            m_children[i] = child;
+            return;
+        }
+    }
+    m_children.append(child);
 }
 
-HistoryItem* HistoryItem::childItemWithName(const String& name) const
+HistoryItem* HistoryItem::childItemWithTarget(const String& target) const
 {
-    unsigned size = m_subItems.size();
-    for (unsigned i = 0; i < size; ++i) 
-        if (m_subItems[i]->target() == name)
-            return m_subItems[i].get();
+    unsigned size = m_children.size();
+    for (unsigned i = 0; i < size; ++i) {
+        if (m_children[i]->target() == target)
+            return m_children[i].get();
+    }
     return 0;
 }
 
-// <rdar://problem/4895849> HistoryItem::recurseToFindTargetItem() should be replace with a non-recursive method
-HistoryItem* HistoryItem::recurseToFindTargetItem()
+// <rdar://problem/4895849> HistoryItem::findTargetItem() should be replaced with a non-recursive method.
+HistoryItem* HistoryItem::findTargetItem()
 {
     if (m_isTargetItem)
         return this;
-    if (!m_subItems.size())
-        return 0;
-    
-    HistoryItem* match;
-    unsigned size = m_subItems.size();
+    unsigned size = m_children.size();
     for (unsigned i = 0; i < size; ++i) {
-        match = m_subItems[i]->recurseToFindTargetItem();
-        if (match)
+        if (HistoryItem* match = m_children[i]->targetItem())
             return match;
     }
-    
     return 0;
 }
 
 HistoryItem* HistoryItem::targetItem()
 {
-    if (!m_subItems.size())
-        return this;
-    return recurseToFindTargetItem();
+    HistoryItem* foundItem = findTargetItem();
+    return foundItem ? foundItem : this;
 }
 
 const HistoryItemVector& HistoryItem::children() const
 {
-    return m_subItems;
+    return m_children;
 }
 
 bool HistoryItem::hasChildren() const
 {
-    return m_subItems.size();
-}
-
-String HistoryItem::formContentType() const
-{
-    return m_formContentType;
-}
-
-String HistoryItem::formReferrer() const
-{
-    return m_formReferrer;
+    return !m_children.isEmpty();
 }
 
-String HistoryItem::rssFeedReferrer() const
+void HistoryItem::clearChildren()
 {
-    return m_rssFeedReferrer;
+    m_children.clear();
 }
 
-void HistoryItem::setRSSFeedReferrer(const String& referrer)
+String HistoryItem::formContentType() const
 {
-    m_rssFeedReferrer = referrer;
+    return m_formContentType;
 }
 
 void HistoryItem::setFormInfoFromRequest(const ResourceRequest& request)
 {
+    m_referrer = request.httpReferrer();
+    
     if (equalIgnoringCase(request.httpMethod(), "POST")) {
         // FIXME: Eventually we have to make this smart enough to handle the case where
         // we have a stream for the body to handle the "data interspersed with files" feature.
         m_formData = request.httpBody();
         m_formContentType = request.httpContentType();
-        m_formReferrer = request.httpReferrer();
     } else {
         m_formData = 0;
         m_formContentType = String();
-        m_formReferrer = String();
     }
 }
 
+void HistoryItem::setFormData(PassRefPtr<FormData> formData)
+{
+    m_formData = formData;
+}
+
+void HistoryItem::setFormContentType(const String& formContentType)
+{
+    m_formContentType = formContentType;
+}
+
 FormData* HistoryItem::formData()
 {
     return m_formData.get();
@@ -395,11 +483,35 @@ bool HistoryItem::isCurrentDocument(Document* doc) const
 
 void HistoryItem::mergeAutoCompleteHints(HistoryItem* otherItem)
 {
+    // FIXME: this is broken - we should be merging the daily counts
+    // somehow.  but this is to support API that's not really used in
+    // practice so leave it broken for now.
     ASSERT(otherItem);
     if (otherItem != this)
         m_visitCount += otherItem->m_visitCount;
 }
 
+void HistoryItem::addRedirectURL(const String& url)
+{
+    if (!m_redirectURLs)
+        m_redirectURLs.set(new Vector<String>);
+
+    // Our API allows us to store all the URLs in the redirect chain, but for
+    // now we only have a use for the final URL.
+    (*m_redirectURLs).resize(1);
+    (*m_redirectURLs)[0] = url;
+}
+
+Vector<String>* HistoryItem::redirectURLs() const
+{
+    return m_redirectURLs.get();
+}
+
+void HistoryItem::setRedirectURLs(PassOwnPtr<Vector<String> > redirectURLs)
+{
+    m_redirectURLs = redirectURLs;
+}
+
 #ifndef NDEBUG
 
 int HistoryItem::showTree() const
@@ -412,12 +524,13 @@ int HistoryItem::showTreeWithIndent(unsigned indentLevel) const
     Vector<char> prefix;
     for (unsigned i = 0; i < indentLevel; ++i)
         prefix.append("  ", 2);
+    prefix.append("\0", 1);
 
     fprintf(stderr, "%s+-%s (%p)\n", prefix.data(), m_urlString.utf8().data(), this);
     
     int totalSubItems = 0;
-    for (unsigned i = 0; i < m_subItems.size(); ++i)
-        totalSubItems += m_subItems[i]->showTreeWithIndent(indentLevel + 1);
+    for (unsigned i = 0; i < m_children.size(); ++i)
+        totalSubItems += m_children[i]->showTreeWithIndent(indentLevel + 1);
     return totalSubItems + 1;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/history/HistoryItem.h b/src/3rdparty/webkit/WebCore/history/HistoryItem.h
index 7d3caa7..ac7d124 100644
--- a/src/3rdparty/webkit/WebCore/history/HistoryItem.h
+++ b/src/3rdparty/webkit/WebCore/history/HistoryItem.h
@@ -28,6 +28,8 @@
 
 #include "IntPoint.h"
 #include "PlatformString.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 #if PLATFORM(MAC)
 #import <wtf/RetainPtr.h>
@@ -36,6 +38,8 @@ typedef struct objc_object* id;
 
 #if PLATFORM(QT)
 #include <QVariant>
+#include <QByteArray>
+#include <QDataStream>
 #endif
 
 namespace WebCore {
@@ -46,7 +50,7 @@ class FormData;
 class HistoryItem;
 class Image;
 class KURL;
-class ResourceRequest;
+struct ResourceRequest;
 
 typedef Vector<RefPtr<HistoryItem> > HistoryItemVector;
 
@@ -78,8 +82,7 @@ public:
     const String& urlString() const;
     const String& title() const;
     
-    void setInPageCache(bool inPageCache) { m_isInPageCache = inPageCache; }
-    bool isInPageCache() const { return m_isInPageCache; }
+    bool isInPageCache() const { return m_cachedPage; }
     
     double lastVisitedTime() const;
     
@@ -91,16 +94,16 @@ public:
     const String& parent() const;
     KURL url() const;
     KURL originalURL() const;
+    const String& referrer() const;
     const String& target() const;
     bool isTargetItem() const;
     
     FormData* formData();
     String formContentType() const;
-    String formReferrer() const;
-    String rssFeedReferrer() const;
     
     int visitCount() const;
     bool lastVisitWasFailure() const { return m_lastVisitWasFailure; }
+    bool lastVisitWasHTTPNonGet() const { return m_lastVisitWasHTTPNonGet; }
 
     void mergeAutoCompleteHints(HistoryItem* otherItem);
     
@@ -114,29 +117,39 @@ public:
     void setURL(const KURL&);
     void setURLString(const String&);
     void setOriginalURLString(const String&);
+    void setReferrer(const String&);
     void setTarget(const String&);
     void setParent(const String&);
     void setTitle(const String&);
     void setIsTargetItem(bool);
     
     void setFormInfoFromRequest(const ResourceRequest&);
+    void setFormData(PassRefPtr<FormData>);
+    void setFormContentType(const String&);
+
+    void recordInitialVisit();
 
-    void setRSSFeedReferrer(const String&);
     void setVisitCount(int);
     void setLastVisitWasFailure(bool wasFailure) { m_lastVisitWasFailure = wasFailure; }
+    void setLastVisitWasHTTPNonGet(bool wasNotGet) { m_lastVisitWasHTTPNonGet = wasNotGet; }
 
     void addChildItem(PassRefPtr<HistoryItem>);
-    HistoryItem* childItemWithName(const String&) const;
+    void setChildItem(PassRefPtr<HistoryItem>);
+    HistoryItem* childItemWithTarget(const String&) const;
     HistoryItem* targetItem();
-    HistoryItem* recurseToFindTargetItem();
     const HistoryItemVector& children() const;
     bool hasChildren() const;
+    void clearChildren();
 
     // This should not be called directly for HistoryItems that are already included
     // in GlobalHistory. The WebKit api for this is to use -[WebHistory setLastVisitedTimeInterval:forItem:] instead.
     void setLastVisitedTime(double);
     void visited(const String& title, double time);
-    
+
+    void addRedirectURL(const String&);
+    Vector<String>* redirectURLs() const;
+    void setRedirectURLs(PassOwnPtr<Vector<String> >);
+
     bool isCurrentDocument(Document*) const;
     
 #if PLATFORM(MAC)
@@ -152,6 +165,9 @@ public:
 #if PLATFORM(QT)
     QVariant userData() const { return m_userData; }
     void setUserData(const QVariant& userData) { m_userData = userData; }
+
+    bool restoreState(QDataStream& buffer, int version);
+    QDataStream& saveState(QDataStream& out, int version) const;
 #endif
 
 #ifndef NDEBUG
@@ -159,40 +175,55 @@ public:
     int showTreeWithIndent(unsigned indentLevel) const;
 #endif
 
+    void adoptVisitCounts(Vector<int>& dailyCounts, Vector<int>& weeklyCounts);
+    const Vector<int>& dailyVisitCounts() const { return m_dailyVisitCounts; }
+    const Vector<int>& weeklyVisitCounts() const { return m_weeklyVisitCounts; }
+
 private:
     HistoryItem();
     HistoryItem(const String& urlString, const String& title, double lastVisited);
     HistoryItem(const String& urlString, const String& title, const String& alternateTitle, double lastVisited);
-    HistoryItem(const KURL& url, const String& target, const String& parent, const String& title);
+    HistoryItem(const KURL& url, const String& frameName, const String& parent, const String& title);
 
     HistoryItem(const HistoryItem&);
 
+    void padDailyCountsForNewVisit(double time);
+    void collapseDailyVisitsToWeekly();
+    void recordVisitAtTime(double);
+
+    HistoryItem* findTargetItem();
+
+    /* When adding new member variables to this class, please notify the Qt team.
+     * qt/HistoryItemQt.cpp contains code to serialize history items.
+     */
+
     String m_urlString;
     String m_originalURLString;
+    String m_referrer;
     String m_target;
     String m_parent;
     String m_title;
     String m_displayTitle;
     
     double m_lastVisitedTime;
+    bool m_lastVisitWasHTTPNonGet;
 
     IntPoint m_scrollPoint;
     Vector<String> m_documentState;
     
-    HistoryItemVector m_subItems;
+    HistoryItemVector m_children;
     
     bool m_lastVisitWasFailure;
-    bool m_isInPageCache;
     bool m_isTargetItem;
     int m_visitCount;
-    
+    Vector<int> m_dailyVisitCounts;
+    Vector<int> m_weeklyVisitCounts;
+
+    OwnPtr<Vector<String> > m_redirectURLs;
+
     // info used to repost form data
     RefPtr<FormData> m_formData;
     String m_formContentType;
-    String m_formReferrer;
-    
-    // info used to support RSS feeds
-    String m_rssFeedReferrer;
 
     // PageCache controls these fields.
     HistoryItem* m_next;
diff --git a/src/3rdparty/webkit/WebCore/history/PageCache.cpp b/src/3rdparty/webkit/WebCore/history/PageCache.cpp
index dc24fd2..7c25701 100644
--- a/src/3rdparty/webkit/WebCore/history/PageCache.cpp
+++ b/src/3rdparty/webkit/WebCore/history/PageCache.cpp
@@ -32,6 +32,7 @@
 #include "HistoryItem.h"
 #include "Logging.h"
 #include "SystemTime.h"
+#include <wtf/CurrentTime.h>
 
 using namespace std;
 
diff --git a/src/3rdparty/webkit/WebCore/history/cf/HistoryPropertyList.cpp b/src/3rdparty/webkit/WebCore/history/cf/HistoryPropertyList.cpp
new file mode 100644
index 0000000..fd28237
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/history/cf/HistoryPropertyList.cpp
@@ -0,0 +1,156 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "HistoryPropertyList.h"
+
+#include "HistoryItem.h"
+#include <wtf/StringExtras.h>
+
+namespace WebCore {
+
+static const int currentFileVersion = 1;
+
+HistoryPropertyListWriter::HistoryPropertyListWriter()
+    : m_dailyVisitCountsKey("D")
+    , m_displayTitleKey("displayTitle")
+    , m_lastVisitWasFailureKey("lastVisitWasFailure")
+    , m_lastVisitWasHTTPNonGetKey("lastVisitWasHTTPNonGet")
+    , m_lastVisitedDateKey("lastVisitedDate")
+    , m_redirectURLsKey("redirectURLs")
+    , m_titleKey("title")
+    , m_urlKey("")
+    , m_visitCountKey("visitCount")
+    , m_weeklyVisitCountsKey("W")
+    , m_buffer(0)
+{
+}
+
+UInt8* HistoryPropertyListWriter::buffer(size_t size)
+{
+    ASSERT(!m_buffer);
+    m_buffer = static_cast<UInt8*>(CFAllocatorAllocate(0, size, 0));
+    m_bufferSize = size;
+    return m_buffer;
+}
+
+RetainPtr<CFDataRef> HistoryPropertyListWriter::releaseData()
+{
+    UInt8* buffer = m_buffer;
+    if (!buffer)
+        return 0;
+    m_buffer = 0;
+    RetainPtr<CFDataRef> data(AdoptCF, CFDataCreateWithBytesNoCopy(0, buffer, m_bufferSize, 0));
+    if (!data) {
+        CFAllocatorDeallocate(0, buffer);
+        return 0;
+    }
+    return data;
+}
+
+void HistoryPropertyListWriter::writeObjects(BinaryPropertyListObjectStream& stream)
+{
+    size_t outerDictionaryStart = stream.writeDictionaryStart();
+
+    stream.writeString("WebHistoryFileVersion");
+    stream.writeString("WebHistoryDates");
+
+    stream.writeInteger(currentFileVersion);
+    size_t outerDateArrayStart = stream.writeArrayStart();
+    writeHistoryItems(stream);
+    stream.writeArrayEnd(outerDateArrayStart);
+
+    stream.writeDictionaryEnd(outerDictionaryStart);
+}
+
+void HistoryPropertyListWriter::writeHistoryItem(BinaryPropertyListObjectStream& stream, HistoryItem* item)
+{
+    size_t itemDictionaryStart = stream.writeDictionaryStart();
+
+    const String& title = item->title();
+    const String& displayTitle = item->alternateTitle();
+    double lastVisitedDate = item->lastVisitedTime();
+    int visitCount = item->visitCount();
+    Vector<String>* redirectURLs = item->redirectURLs();
+    const Vector<int>& dailyVisitCounts = item->dailyVisitCounts();
+    const Vector<int>& weeklyVisitCounts = item->weeklyVisitCounts();
+
+    // keys
+    stream.writeString(m_urlKey);
+    if (!title.isEmpty())
+        stream.writeString(m_titleKey);
+    if (!displayTitle.isEmpty())
+        stream.writeString(m_displayTitleKey);
+    if (lastVisitedDate)
+        stream.writeString(m_lastVisitedDateKey);
+    if (visitCount)
+        stream.writeString(m_visitCountKey);
+    if (item->lastVisitWasFailure())
+        stream.writeString(m_lastVisitWasFailureKey);
+    if (item->lastVisitWasHTTPNonGet())
+        stream.writeString(m_lastVisitWasHTTPNonGetKey);
+    if (redirectURLs)
+        stream.writeString(m_redirectURLsKey);
+    if (!dailyVisitCounts.isEmpty())
+        stream.writeString(m_dailyVisitCountsKey);
+    if (!weeklyVisitCounts.isEmpty())
+        stream.writeString(m_weeklyVisitCountsKey);
+
+    // values
+    stream.writeUniqueString(item->urlString());
+    if (!title.isEmpty())
+        stream.writeString(title);
+    if (!displayTitle.isEmpty())
+        stream.writeString(displayTitle);
+    if (lastVisitedDate) {
+        char buffer[32];
+        snprintf(buffer, sizeof(buffer), "%.1lf", lastVisitedDate);
+        stream.writeUniqueString(buffer);
+    }
+    if (visitCount)
+        stream.writeInteger(visitCount);
+    if (item->lastVisitWasFailure())
+        stream.writeBooleanTrue();
+    if (item->lastVisitWasHTTPNonGet()) {
+        ASSERT(item->urlString().startsWith("http:", false) || item->urlString().startsWith("https:", false));
+        stream.writeBooleanTrue();
+    }
+    if (redirectURLs) {
+        size_t redirectArrayStart = stream.writeArrayStart();
+        size_t size = redirectURLs->size();
+        ASSERT(size);
+        for (size_t i = 0; i < size; ++i)
+            stream.writeUniqueString(redirectURLs->at(i));
+        stream.writeArrayEnd(redirectArrayStart);
+    }
+    if (size_t size = dailyVisitCounts.size())
+        stream.writeIntegerArray(dailyVisitCounts.data(), size);
+    if (size_t size = weeklyVisitCounts.size())
+        stream.writeIntegerArray(weeklyVisitCounts.data(), size);
+
+    stream.writeDictionaryEnd(itemDictionaryStart);
+}
+
+}
diff --git a/src/3rdparty/webkit/WebCore/page/win/AccessibilityObjectWrapperWin.h b/src/3rdparty/webkit/WebCore/history/cf/HistoryPropertyList.h
index 779443c..fcb8c47 100644
--- a/src/3rdparty/webkit/WebCore/page/win/AccessibilityObjectWrapperWin.h
+++ b/src/3rdparty/webkit/WebCore/history/cf/HistoryPropertyList.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,32 +23,47 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
+#ifndef HistoryPropertyList_h
+#define HistoryPropertyList_h
 
-#ifndef AccessibilityObjectWrapperWin_h
-#define AccessibilityObjectWrapperWin_h
+#include "BinaryPropertyList.h"
+#include "PlatformString.h"
+#include <wtf/RetainPtr.h>
 
 namespace WebCore {
 
-    class AccessibilityObject;
- 
-    class AccessibilityObjectWrapper : public IUnknown {
-    public:
-        // IUnknown
-        virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID riid, void** ppvObject) = 0;        
-        virtual ULONG STDMETHODCALLTYPE AddRef(void) = 0;
-        virtual ULONG STDMETHODCALLTYPE Release(void) = 0;
+class HistoryItem;
 
-        virtual void detach() = 0;
-        bool attached() const { return m_object; }
-        AccessibilityObject* accessibilityObject() const { return m_object; }
+class HistoryPropertyListWriter : public BinaryPropertyListWriter {
+public:
+    RetainPtr<CFDataRef> releaseData();
 
-    protected:
-        AccessibilityObjectWrapper(AccessibilityObject* obj) : m_object(obj) { }
-        AccessibilityObjectWrapper() : m_object(0) { }
+protected:
+    HistoryPropertyListWriter();
 
-        AccessibilityObject* m_object;
-    };
+    void writeHistoryItem(BinaryPropertyListObjectStream&, HistoryItem*);
 
-} // namespace WebCore
+private:
+    virtual void writeHistoryItems(BinaryPropertyListObjectStream&) = 0;
 
-#endif // AccessibilityObjectWrapperWin_h
+    virtual void writeObjects(BinaryPropertyListObjectStream&);
+    virtual UInt8* buffer(size_t);
+
+    const String m_dailyVisitCountsKey;
+    const String m_displayTitleKey;
+    const String m_lastVisitWasFailureKey;
+    const String m_lastVisitWasHTTPNonGetKey;
+    const String m_lastVisitedDateKey;
+    const String m_redirectURLsKey;
+    const String m_titleKey;
+    const String m_urlKey;
+    const String m_visitCountKey;
+    const String m_weeklyVisitCountsKey;
+
+    UInt8* m_buffer;
+    size_t m_bufferSize;
+};
+
+}
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/history/qt/HistoryItemQt.cpp b/src/3rdparty/webkit/WebCore/history/qt/HistoryItemQt.cpp
new file mode 100644
index 0000000..68fee87
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/history/qt/HistoryItemQt.cpp
@@ -0,0 +1,114 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "HistoryItem.h"
+
+#include "CString.h"
+#include "FormData.h"
+
+bool WebCore::HistoryItem::restoreState(QDataStream& in, int /*version*/)
+{
+    // there is no different version right now
+    // switch  (version) {
+    WebCore::String url;
+    WebCore::String title;
+    WebCore::String altTitle;
+    WebCore::String orginalUrl;
+    WebCore::String referrer;
+    WebCore::String target;
+    WebCore::String parrent;
+    double lastVisitedTime;
+    bool validUserData;
+    WebCore::String parent;
+    bool lastVisitWasHTTPNonGet;
+    bool lastVisitWasFailure;
+    bool isTargetItem;
+    int visitCount;
+    WTF::Vector<WebCore::String> documentState;
+    WebCore::IntPoint scrollPoint;
+    WTF::Vector<int> weeklyVisitCounts;
+    WTF::Vector<int> dailyVisitCounts;
+    bool loadFormdata;
+    // WebCore::String formContentType;
+    // WTF::Vector<char> formData;
+
+    in >> url >> title >> altTitle >> lastVisitedTime >> orginalUrl >> referrer >> target >> parent;
+    in >> lastVisitWasHTTPNonGet >> lastVisitWasFailure >> isTargetItem >> visitCount >> documentState;
+    in >> scrollPoint >> dailyVisitCounts >> weeklyVisitCounts;
+    /*in >> loadFormdata;
+    if (loadFormdata) {
+        in >> formContentType >> formData;
+        // direct assigned (!)
+        m_formContentType = formContentType;
+        m_formData = FormData::create(CString(formData));
+    }*/
+    // use setters
+    adoptVisitCounts(dailyVisitCounts, weeklyVisitCounts);
+    setScrollPoint(scrollPoint);
+    setDocumentState(documentState);
+    setVisitCount(visitCount);
+    setIsTargetItem(isTargetItem);
+    setLastVisitWasFailure(lastVisitWasFailure);
+    setLastVisitWasHTTPNonGet(lastVisitWasHTTPNonGet);
+    setParent(parent);
+    setTarget(target);
+    setReferrer(referrer);
+    setOriginalURLString(orginalUrl);
+    setURLString(url);
+    setLastVisitedTime(lastVisitedTime);
+    setTitle(title);
+    setAlternateTitle(altTitle);
+
+    // at the end load userData
+    in >> validUserData;
+    if (validUserData) {
+        QVariant tmp;
+        in >> tmp;
+        setUserData(tmp);
+    }
+
+    return in.status() == QDataStream::Ok;
+}
+
+QDataStream& WebCore::HistoryItem::saveState(QDataStream& out, int /*version*/) const
+{
+    // there is no different version right now
+    // switch  (version) {
+    out << urlString() << title() << alternateTitle() << lastVisitedTime();
+    out << originalURLString() << referrer() << target() << parent();
+    out << lastVisitWasHTTPNonGet() << lastVisitWasFailure() << isTargetItem();
+    out << visitCount() << documentState() << scrollPoint();
+    out << dailyVisitCounts() << weeklyVisitCounts();
+    /*if (m_formData) {
+        out << true;
+        out << formContentType();
+        out << m_formData->flatten();
+    } else {
+        out << false;
+    }*/
+    // save user data
+    if (userData().isValid())
+        out << true << userData();
+    else
+        out << false;
+
+    return out;
+}
+
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasGradient.cpp b/src/3rdparty/webkit/WebCore/html/CanvasGradient.cpp
index 693d8f7..fd48194 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasGradient.cpp
+++ b/src/3rdparty/webkit/WebCore/html/CanvasGradient.cpp
@@ -34,11 +34,13 @@ namespace WebCore {
 
 CanvasGradient::CanvasGradient(const FloatPoint& p0, const FloatPoint& p1)
     : m_gradient(Gradient::create(p0, p1))
+    , m_dashbardCompatibilityMode(false)
 {
 }
 
 CanvasGradient::CanvasGradient(const FloatPoint& p0, float r0, const FloatPoint& p1, float r1)
     : m_gradient(Gradient::create(p0, r0, p1, r1))
+    , m_dashbardCompatibilityMode(false)
 {
 }
 
@@ -51,7 +53,8 @@ void CanvasGradient::addColorStop(float value, const String& color, ExceptionCod
 
     RGBA32 rgba = 0;
     if (!CSSParser::parseColor(rgba, color)) {
-        ec = SYNTAX_ERR;
+        if (!m_dashbardCompatibilityMode)
+            ec = SYNTAX_ERR;
         return;
     }
 
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasGradient.h b/src/3rdparty/webkit/WebCore/html/CanvasGradient.h
index 3b81dbd..0a77652 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasGradient.h
+++ b/src/3rdparty/webkit/WebCore/html/CanvasGradient.h
@@ -54,11 +54,16 @@ namespace WebCore {
 
         void getColor(float value, float* r, float* g, float* b, float* a) const { m_gradient->getColor(value, r, g, b, a); }
 
+#if ENABLE(DASHBOARD_SUPPORT)
+        void setDashboardCompatibilityMode() { m_dashbardCompatibilityMode = true; }
+#endif
+
     private:
         CanvasGradient(const FloatPoint& p0, const FloatPoint& p1);
         CanvasGradient(const FloatPoint& p0, float r0, const FloatPoint& p1, float r1);
         
         RefPtr<Gradient> m_gradient;
+        bool m_dashbardCompatibilityMode;
     };
 
 } //namespace
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransactionCallback.idl b/src/3rdparty/webkit/WebCore/html/CanvasPixelArray.cpp
index cee726f..a377c83 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransactionCallback.idl
+++ b/src/3rdparty/webkit/WebCore/html/CanvasPixelArray.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,10 +26,19 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-module storage {
-
-    interface SQLTransactionCallback {
-        void handleEvent(in SQLTransaction transaction);
-    };
+#include "config.h"
+#include "CanvasPixelArray.h"
 
+namespace WebCore {
+    
+    PassRefPtr<CanvasPixelArray> CanvasPixelArray::create(unsigned length)
+    {
+        return adoptRef(new CanvasPixelArray(length));
+    }
+    
+    CanvasPixelArray::CanvasPixelArray(unsigned length)
+        : m_data(WTF::ByteArray::create(length))
+    {
+    }
+    
 }
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasPixelArray.h b/src/3rdparty/webkit/WebCore/html/CanvasPixelArray.h
new file mode 100644
index 0000000..b91a642
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/CanvasPixelArray.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef CanvasPixelArray_h
+#define CanvasPixelArray_h
+
+#include <wtf/ByteArray.h>
+#include <wtf/MathExtras.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+    
+    class CanvasPixelArray : public RefCounted<CanvasPixelArray> {
+    public:
+        static PassRefPtr<CanvasPixelArray> create(unsigned length);
+        
+        WTF::ByteArray* data() { return m_data.get(); }
+        unsigned length() const { return m_data->length(); }
+        
+        void set(unsigned index, double value)
+        {
+            m_data->set(index, value);
+        }
+        
+        bool get(unsigned index, unsigned char& result) const
+        {
+            return m_data->get(index, result);
+        }
+
+    private:
+        CanvasPixelArray(unsigned length);
+        RefPtr<WTF::ByteArray> m_data;
+    };
+    
+} // namespace WebCore
+
+#endif // CanvasPixelArray_h
diff --git a/src/3rdparty/webkit/WebCore/storage/SQLTransactionErrorCallback.idl b/src/3rdparty/webkit/WebCore/html/CanvasPixelArray.idl
index 9355d9a..c815788 100644
--- a/src/3rdparty/webkit/WebCore/storage/SQLTransactionErrorCallback.idl
+++ b/src/3rdparty/webkit/WebCore/html/CanvasPixelArray.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,10 +26,14 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-module storage {
-
-    interface SQLTransactionErrorCallback {
-        void handleEvent(in SQLError error);
+module html {
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT || defined(V8_BINDING) && V8_BINDING
+    interface [
+        CustomHeader,
+        HasCustomIndexGetter,
+        HasCustomIndexSetter
+    ] CanvasPixelArray {
+        readonly attribute long length;
     };
-
+#endif
 }
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.cpp b/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.cpp
index ceea77a..37f4799 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.cpp
+++ b/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
@@ -36,6 +36,7 @@
 #include "CanvasGradient.h"
 #include "CanvasPattern.h"
 #include "CanvasStyle.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSPropertyNames.h"
 #include "CSSStyleSelector.h"
 #include "Document.h"
@@ -49,17 +50,18 @@
 #include "ImageBuffer.h"
 #include "ImageData.h"
 #include "KURL.h"
-#include "NotImplemented.h"
 #include "Page.h"
 #include "RenderHTMLCanvas.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
 #include "StrokeStyleApplier.h"
 #include "TextMetrics.h"
+#include "HTMLVideoElement.h"
 #include <stdio.h>
 
-#include <runtime/ByteArray.h>
+#include <wtf/ByteArray.h>
 #include <wtf/MathExtras.h>
+#include <wtf/OwnPtr.h>
 
 using namespace std;
 
@@ -95,6 +97,9 @@ CanvasRenderingContext2D::CanvasRenderingContext2D(HTMLCanvasElement* canvas)
     : m_canvas(canvas)
     , m_stateStack(1)
 {
+    // Make sure that even if the drawingContext() has a different default
+    // thickness, it is in sync with the canvas thickness.
+    setLineWidth(lineWidth());
 }
 
 void CanvasRenderingContext2D::ref()
@@ -357,7 +362,7 @@ void CanvasRenderingContext2D::scale(float sx, float sy)
         return;
 
     TransformationMatrix newTransform = state().m_transform;
-    newTransform.scale(sx, sy);
+    newTransform.scaleNonUniform(sx, sy);
     if (!newTransform.isInvertible()) {
         state().m_invertibleCTM = false;
         return;
@@ -365,7 +370,7 @@ void CanvasRenderingContext2D::scale(float sx, float sy)
 
     state().m_transform = newTransform;
     c->scale(FloatSize(sx, sy));
-    m_path.transform(TransformationMatrix().scale(1.0/sx, 1.0/sy));
+    m_path.transform(TransformationMatrix().scaleNonUniform(1.0/sx, 1.0/sy));
 }
 
 void CanvasRenderingContext2D::rotate(float angleInRadians)
@@ -422,9 +427,7 @@ void CanvasRenderingContext2D::transform(float m11, float m12, float m21, float
         return;
 
     TransformationMatrix transform(m11, m12, m21, m22, dx, dy);
-
-    TransformationMatrix newTransform = state().m_transform;
-    newTransform.multiply(transform);
+    TransformationMatrix newTransform = transform * state().m_transform;
     if (!newTransform.isInvertible()) {
         state().m_invertibleCTM = false;
         return;
@@ -869,7 +872,6 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     GraphicsContext* dc = drawingContext();
     if (!dc)
         return;
-    // FIXME: Do this through platform-independent GraphicsContext API.
 #if PLATFORM(CG)
     const CGFloat components[5] = { c, m, y, k, a };
     CGColorSpaceRef colorSpace = CGColorSpaceCreateDeviceCMYK();
@@ -877,6 +879,8 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     CGColorSpaceRelease(colorSpace);
     CGContextSetShadowWithColor(dc->platformContext(), adjustedShadowSize(width, -height), blur, shadowColor);
     CGColorRelease(shadowColor);
+#else
+    dc->setShadow(IntSize(width, -height), blur, Color(c, m, y, k, a));
 #endif
 }
 
@@ -909,6 +913,15 @@ static IntSize size(HTMLImageElement* image)
     return IntSize();
 }
 
+#if ENABLE(VIDEO)
+static IntSize size(HTMLVideoElement* video)
+{
+    if (MediaPlayer* player = video->player())
+        return player->naturalSize();
+    return IntSize();
+}
+#endif
+
 static inline FloatRect normalizeRect(const FloatRect& rect)
 {
     return FloatRect(min(rect.x(), rect.right()),
@@ -917,6 +930,20 @@ static inline FloatRect normalizeRect(const FloatRect& rect)
         max(rect.height(), -rect.height()));
 }
 
+void CanvasRenderingContext2D::checkOrigin(const KURL& url)
+{
+    RefPtr<SecurityOrigin> origin = SecurityOrigin::create(url);
+    if (!m_canvas->document()->securityOrigin()->canAccess(origin.get()))
+        m_canvas->setOriginTainted();
+}
+
+void CanvasRenderingContext2D::checkOrigin(const String& url)
+{
+    RefPtr<SecurityOrigin> origin = SecurityOrigin::createFromString(url);
+    if (!m_canvas->document()->securityOrigin()->canAccess(origin.get()))
+        m_canvas->setOriginTainted();
+}
+
 void CanvasRenderingContext2D::drawImage(HTMLImageElement* image, float x, float y)
 {
     ASSERT(image);
@@ -933,13 +960,6 @@ void CanvasRenderingContext2D::drawImage(HTMLImageElement* image,
     drawImage(image, FloatRect(0, 0, s.width(), s.height()), FloatRect(x, y, width, height), ec);
 }
 
-void CanvasRenderingContext2D::checkOrigin(const KURL& url)
-{
-    RefPtr<SecurityOrigin> origin = SecurityOrigin::create(url);
-    if (!m_canvas->document()->securityOrigin()->canAccess(origin.get()))
-        m_canvas->setOriginTainted();
-}
-
 void CanvasRenderingContext2D::drawImage(HTMLImageElement* image, const FloatRect& srcRect, const FloatRect& dstRect,
     ExceptionCode& ec)
 {
@@ -1030,6 +1050,64 @@ void CanvasRenderingContext2D::drawImage(HTMLCanvasElement* canvas, const FloatR
                         // FIXME: Arguably willDraw should become didDraw and occur after drawing calls and not before them to avoid problems like this.
 }
 
+#if ENABLE(VIDEO)
+void CanvasRenderingContext2D::drawImage(HTMLVideoElement* video, float x, float y)
+{
+    ASSERT(video);
+    IntSize s = size(video);
+    ExceptionCode ec;
+    drawImage(video, x, y, s.width(), s.height(), ec);
+}
+
+void CanvasRenderingContext2D::drawImage(HTMLVideoElement* video,
+                                         float x, float y, float width, float height, ExceptionCode& ec)
+{
+    ASSERT(video);
+    IntSize s = size(video);
+    drawImage(video, FloatRect(0, 0, s.width(), s.height()), FloatRect(x, y, width, height), ec);
+}
+
+void CanvasRenderingContext2D::drawImage(HTMLVideoElement* video, const FloatRect& srcRect, const FloatRect& dstRect,
+                                         ExceptionCode& ec)
+{
+    ASSERT(video);
+    
+    ec = 0;
+    FloatRect videoRect = FloatRect(FloatPoint(), size(video));
+    if (!videoRect.contains(normalizeRect(srcRect)) || srcRect.width() == 0 || srcRect.height() == 0) {
+        ec = INDEX_SIZE_ERR;
+        return;
+    }
+    
+    if (!dstRect.width() || !dstRect.height())
+        return;
+    
+    GraphicsContext* c = drawingContext();
+    if (!c)
+        return;
+    if (!state().m_invertibleCTM)
+        return;
+
+    if (m_canvas->originClean())
+        checkOrigin(video->currentSrc());
+
+    if (m_canvas->originClean() && !video->hasSingleSecurityOrigin())
+        m_canvas->setOriginTainted();
+
+    FloatRect sourceRect = c->roundToDevicePixels(srcRect);
+    FloatRect destRect = c->roundToDevicePixels(dstRect);
+    willDraw(destRect);
+
+    c->save();
+    c->clip(destRect);
+    c->translate(destRect.x(), destRect.y());
+    c->scale(FloatSize(destRect.width()/sourceRect.width(), destRect.height()/sourceRect.height()));
+    c->translate(-sourceRect.x(), -sourceRect.y());
+    video->paint(c, IntRect(IntPoint(), size(video)));
+    c->restore();
+}
+#endif
+
 // FIXME: Why isn't this just another overload of drawImage? Why have a different name?
 void CanvasRenderingContext2D::drawImageFromRect(HTMLImageElement* image,
     float sx, float sy, float sw, float sh,
@@ -1074,6 +1152,15 @@ void CanvasRenderingContext2D::setCompositeOperation(const String& operation)
     setGlobalCompositeOperation(operation);
 }
 
+void CanvasRenderingContext2D::prepareGradientForDashboard(CanvasGradient* gradient) const
+{
+#if ENABLE(DASHBOARD_SUPPORT)
+    if (Settings* settings = m_canvas->document()->settings())
+        if (settings->usesDashboardBackwardCompatibilityMode())
+            gradient->setDashboardCompatibilityMode();
+#endif
+}
+
 PassRefPtr<CanvasGradient> CanvasRenderingContext2D::createLinearGradient(float x0, float y0, float x1, float y1, ExceptionCode& ec)
 {
     if (!isfinite(x0) || !isfinite(y0) || !isfinite(x1) || !isfinite(y1)) {
@@ -1081,7 +1168,9 @@ PassRefPtr<CanvasGradient> CanvasRenderingContext2D::createLinearGradient(float
         return 0;
     }
 
-    return CanvasGradient::create(FloatPoint(x0, y0), FloatPoint(x1, y1));
+    PassRefPtr<CanvasGradient> gradient = CanvasGradient::create(FloatPoint(x0, y0), FloatPoint(x1, y1));
+    prepareGradientForDashboard(gradient.get());
+    return gradient;
 }
 
 PassRefPtr<CanvasGradient> CanvasRenderingContext2D::createRadialGradient(float x0, float y0, float r0, float x1, float y1, float r1, ExceptionCode& ec)
@@ -1091,7 +1180,9 @@ PassRefPtr<CanvasGradient> CanvasRenderingContext2D::createRadialGradient(float
         ec = NOT_SUPPORTED_ERR;
         return 0;
     }
-    return CanvasGradient::create(FloatPoint(x0, y0), r0, FloatPoint(x1, y1), r1);
+    PassRefPtr<CanvasGradient> gradient =  CanvasGradient::create(FloatPoint(x0, y0), r0, FloatPoint(x1, y1), r1);
+    prepareGradientForDashboard(gradient.get());
+    return gradient;
 }
 
 PassRefPtr<CanvasPattern> CanvasRenderingContext2D::createPattern(HTMLImageElement* image,
@@ -1112,8 +1203,7 @@ PassRefPtr<CanvasPattern> CanvasRenderingContext2D::createPattern(HTMLImageEleme
     if (!cachedImage || !image->cachedImage()->image())
         return CanvasPattern::create(Image::nullImage(), repeatX, repeatY, true);
 
-    KURL url(cachedImage->url());
-    RefPtr<SecurityOrigin> origin = SecurityOrigin::create(url);
+    RefPtr<SecurityOrigin> origin = SecurityOrigin::createFromString(cachedImage->url());
     bool originClean = m_canvas->document()->securityOrigin()->canAccess(origin.get());
     return CanvasPattern::create(cachedImage->image(), repeatX, repeatY, originClean);
 }
@@ -1172,9 +1262,9 @@ GraphicsContext* CanvasRenderingContext2D::drawingContext() const
 
 static PassRefPtr<ImageData> createEmptyImageData(const IntSize& size)
 {
-    PassRefPtr<ImageData> data = ImageData::create(size.width(), size.height());
-    memset(data->data()->data(), 0, data->data()->length());
-    return data;
+    RefPtr<ImageData> data = ImageData::create(size.width(), size.height());
+    memset(data->data()->data()->data(), 0, data->data()->data()->length());
+    return data.get();
 }
 
 PassRefPtr<ImageData> CanvasRenderingContext2D::createImageData(float sw, float sh) const
@@ -1291,12 +1381,6 @@ void CanvasRenderingContext2D::setFont(const String& newFont)
     state().m_font = newStyle->font();
     state().m_font.update(styleSelector->fontSelector());
     state().m_realizedFont = true;
-    
-    // Set the font in the graphics context.
-    GraphicsContext* c = drawingContext();
-    if (!c)
-        return;
-    c->setFont(state().m_font);
 }
         
 String CanvasRenderingContext2D::textAlign() const
@@ -1425,13 +1509,14 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
         m_canvas->willDraw(FloatRect(0, 0, m_canvas->width(), m_canvas->height()));
     }
     
+#if PLATFORM(CG)
     CanvasStyle* drawStyle = fill ? state().m_fillStyle.get() : state().m_strokeStyle.get();
     if (drawStyle->canvasGradient() || drawStyle->canvasPattern()) {
         // FIXME: The rect is not big enough for miters on stroked text.
         IntRect maskRect = enclosingIntRect(textRect);
 
-        auto_ptr<ImageBuffer> maskImage = ImageBuffer::create(maskRect.size(), false);
-        
+        OwnPtr<ImageBuffer> maskImage = ImageBuffer::create(maskRect.size(), false);
+
         GraphicsContext* maskImageContext = maskImage->context();
 
         if (fill)
@@ -1444,8 +1529,7 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
         maskImageContext->setTextDrawingMode(fill ? cTextFill : cTextStroke);
         maskImageContext->translate(-maskRect.x(), -maskRect.y());
         
-        maskImageContext->setFont(font);
-        maskImageContext->drawBidiText(textRun, location);
+        maskImageContext->drawBidiText(font, textRun, location);
         
         c->save();
         c->clipToImageBuffer(maskRect, maskImage.get());
@@ -1455,9 +1539,10 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
 
         return;
     }
+#endif
 
     c->setTextDrawingMode(fill ? cTextFill : cTextStroke);
-    c->drawBidiText(textRun, location);
+    c->drawBidiText(font, textRun, location);
 }
 
 const Font& CanvasRenderingContext2D::accessFont()
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.h b/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.h
index 8d05b92..f6baa70 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.h
+++ b/src/3rdparty/webkit/WebCore/html/CanvasRenderingContext2D.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -47,6 +47,7 @@ namespace WebCore {
     class GraphicsContext;
     class HTMLCanvasElement;
     class HTMLImageElement;
+    class HTMLVideoElement;
     class ImageData;
     class KURL;
     class TextMetrics;
@@ -159,6 +160,11 @@ namespace WebCore {
         void drawImage(HTMLCanvasElement*, float x, float y);
         void drawImage(HTMLCanvasElement*, float x, float y, float width, float height, ExceptionCode&);
         void drawImage(HTMLCanvasElement*, const FloatRect& srcRect, const FloatRect& dstRect, ExceptionCode&);
+#if ENABLE(VIDEO)
+        void drawImage(HTMLVideoElement*, float x, float y);
+        void drawImage(HTMLVideoElement*, float x, float y, float width, float height, ExceptionCode&);
+        void drawImage(HTMLVideoElement*, const FloatRect& srcRect, const FloatRect& dstRect, ExceptionCode&);
+#endif
 
         void drawImageFromRect(HTMLImageElement*, float sx, float sy, float sw, float sh,
             float dx, float dy, float dw, float dh, const String& compositeOperation);
@@ -251,8 +257,10 @@ namespace WebCore {
 #if ENABLE(DASHBOARD_SUPPORT)
         void clearPathForDashboardBackwardCompatibilityMode();
 #endif
-
+        
+        void prepareGradientForDashboard(CanvasGradient* gradient) const;
         void checkOrigin(const KURL&);
+        void checkOrigin(const String&);
 
         HTMLCanvasElement* m_canvas;
         Vector<State, 1> m_stateStack;
diff --git a/src/3rdparty/webkit/WebCore/html/CanvasStyle.cpp b/src/3rdparty/webkit/WebCore/html/CanvasStyle.cpp
index ce1674e..743ed4f 100644
--- a/src/3rdparty/webkit/WebCore/html/CanvasStyle.cpp
+++ b/src/3rdparty/webkit/WebCore/html/CanvasStyle.cpp
@@ -44,8 +44,6 @@
 #include <QBrush>
 #include <QPen>
 #include <QColor>
-#elif PLATFORM(CAIRO)
-#include "NotImplemented.h"
 #endif
 
 namespace WebCore {
@@ -78,12 +76,21 @@ CanvasStyle::CanvasStyle(float grayLevel, float alpha)
 }
 
 CanvasStyle::CanvasStyle(float r, float g, float b, float a)
-    : m_type(RGBA), m_alpha(a), m_red(r), m_green(g), m_blue(b)
+    : m_type(RGBA)
+    , m_alpha(a)
+    , m_red(r)
+    , m_green(g)
+    , m_blue(b)
 {
 }
 
 CanvasStyle::CanvasStyle(float c, float m, float y, float k, float a)
-    : m_type(CMYKA), m_alpha(a), m_cyan(c), m_magenta(m), m_yellow(y), m_black(k)
+    : m_type(CMYKA)
+    , m_alpha(a)
+    , m_cyan(c)
+    , m_magenta(m)
+    , m_yellow(y)
+    , m_black(k)
 {
 }
 
@@ -146,8 +153,8 @@ void CanvasStyle::applyStrokeColor(GraphicsContext* context)
             clr.setCmykF(m_cyan, m_magenta, m_yellow, m_black, m_alpha);
             currentPen.setColor(clr);
             context->platformContext()->setPen(currentPen);
-#elif PLATFORM(CAIRO)
-            notImplemented();
+#else
+            context->setStrokeColor(Color(m_cyan, m_magenta, m_yellow, m_black, m_alpha));
 #endif
             break;
         }
@@ -207,6 +214,8 @@ void CanvasStyle::applyFillColor(GraphicsContext* context)
             clr.setCmykF(m_cyan, m_magenta, m_yellow, m_black, m_alpha);
             currentBrush.setColor(clr);
             context->platformContext()->setBrush(currentBrush);
+#else
+            context->setFillColor(Color(m_cyan, m_magenta, m_yellow, m_black, m_alpha));
 #endif
             break;
         }
diff --git a/src/3rdparty/webkit/WebCore/html/CollectionCache.cpp b/src/3rdparty/webkit/WebCore/html/CollectionCache.cpp
new file mode 100644
index 0000000..feecd96
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/CollectionCache.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "CollectionCache.h"
+
+namespace WebCore {
+
+CollectionCache::CollectionCache()
+    : version(0)
+{
+    reset();
+}
+
+inline void CollectionCache::copyCacheMap(NodeCacheMap& dest, const NodeCacheMap& src)
+{
+    ASSERT(dest.isEmpty());
+    NodeCacheMap::const_iterator end = src.end();
+    for (NodeCacheMap::const_iterator it = src.begin(); it != end; ++it)
+        dest.add(it->first, new Vector<Element*>(*it->second));
+}
+
+CollectionCache::CollectionCache(const CollectionCache& other)
+    : version(other.version)
+    , current(other.current)
+    , position(other.position)
+    , length(other.length)
+    , elementsArrayPosition(other.elementsArrayPosition)
+    , hasLength(other.hasLength)
+    , hasNameCache(other.hasNameCache)
+{
+    copyCacheMap(idCache, other.idCache);
+    copyCacheMap(nameCache, other.nameCache);
+}
+
+void CollectionCache::swap(CollectionCache& other)
+{
+    std::swap(version, other.version);
+    std::swap(current, other.current);
+    std::swap(position, other.position);
+    std::swap(length, other.length);
+    std::swap(elementsArrayPosition, other.elementsArrayPosition);
+
+    idCache.swap(other.idCache);
+    nameCache.swap(other.nameCache);
+    
+    std::swap(hasLength, other.hasLength);
+    std::swap(hasNameCache, other.hasNameCache);
+}
+
+CollectionCache::~CollectionCache()
+{
+    deleteAllValues(idCache);
+    deleteAllValues(nameCache);
+}
+
+void CollectionCache::reset()
+{
+    current = 0;
+    position = 0;
+    length = 0;
+    hasLength = false;
+    elementsArrayPosition = 0;
+    deleteAllValues(idCache);
+    idCache.clear();
+    deleteAllValues(nameCache);
+    nameCache.clear();
+    hasNameCache = false;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/CollectionCache.h b/src/3rdparty/webkit/WebCore/html/CollectionCache.h
new file mode 100644
index 0000000..7cdcdd5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/CollectionCache.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef CollectionCache_h
+#define CollectionCache_h
+
+#include <wtf/HashMap.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class AtomicStringImpl;
+class Element;
+
+struct CollectionCache {
+    CollectionCache();
+    CollectionCache(const CollectionCache&);
+    CollectionCache& operator=(const CollectionCache& other)
+    {
+        CollectionCache tmp(other);    
+        swap(tmp);
+        return *this;
+    }
+    ~CollectionCache();
+
+    void reset();
+    void swap(CollectionCache&);
+
+    typedef HashMap<AtomicStringImpl*, Vector<Element*>*> NodeCacheMap;
+
+    unsigned version;
+    Element* current;
+    unsigned position;
+    unsigned length;
+    int elementsArrayPosition;
+    NodeCacheMap idCache;
+    NodeCacheMap nameCache;
+    bool hasLength;
+    bool hasNameCache;
+
+private:
+    static void copyCacheMap(NodeCacheMap&, const NodeCacheMap&);
+};
+
+} // namespace
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/html/CollectionType.h b/src/3rdparty/webkit/WebCore/html/CollectionType.h
new file mode 100644
index 0000000..e5973a3
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/CollectionType.h
@@ -0,0 +1,67 @@
+/*
+ * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
+ *           (C) 1999 Antti Koivisto (koivisto@kde.org)
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef CollectionType_h
+#define CollectionType_h
+
+namespace WebCore {
+
+enum CollectionType {
+    // unnamed collection types cached in the document
+
+    DocImages,    // all <img> elements in the document
+    DocApplets,   // all <object> and <applet> elements
+    DocEmbeds,    // all <embed> elements
+    DocObjects,   // all <object> elements
+    DocForms,     // all <form> elements
+    DocLinks,     // all <a> _and_ <area> elements with a value for href
+    DocAnchors,   // all <a> elements with a value for name
+    DocScripts,   // all <script> elements
+
+    DocAll,       // "all" elements (IE)
+    NodeChildren, // first-level children (IE)
+
+    // named collection types cached in the document
+
+    WindowNamedItems,
+    DocumentNamedItems,
+
+    // types not cached in the document; these are types that can't be used on a document
+
+    TableTBodies, // all <tbody> elements in this table
+    TSectionRows, // all row elements in this table section
+    TRCells,      // all cells in this row
+    SelectOptions,
+    MapAreas,
+
+    OtherCollection
+};
+
+static const CollectionType FirstUnnamedDocumentCachedType = DocImages;
+static const unsigned NumUnnamedDocumentCachedTypes = NodeChildren - DocImages + 1;
+
+static const CollectionType FirstNamedDocumentCachedType = WindowNamedItems;
+static const unsigned NumNamedDocumentCachedTypes = DocumentNamedItems - WindowNamedItems + 1;
+
+} // namespace
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/html/DataGridColumn.cpp b/src/3rdparty/webkit/WebCore/html/DataGridColumn.cpp
new file mode 100644
index 0000000..136c08e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/DataGridColumn.cpp
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DataGridColumn.h"
+
+#include "DataGridColumnList.h"
+
+namespace WebCore {
+
+void DataGridColumn::setPrimary(bool primary)
+{
+    if (m_primary != primary) {
+        m_primary = primary;
+        if (m_columns)
+            m_columns->primaryColumnChanged(this);
+    }
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/DataGridColumn.h b/src/3rdparty/webkit/WebCore/html/DataGridColumn.h
new file mode 100644
index 0000000..8e63cd6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/DataGridColumn.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DataGridColumn_h
+#define DataGridColumn_h
+
+#include "AtomicString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class DataGridColumnList;
+
+class DataGridColumn : public RefCounted<DataGridColumn> {
+public:
+    static PassRefPtr<DataGridColumn> create(DataGridColumnList* columns, const String& columnID, const String& label, const String& type, bool primary, unsigned short sortable)
+    {
+        return new DataGridColumn(columns, columnID, label, type, primary, sortable);
+    }
+
+    const AtomicString& id() const { return m_id; }
+    void setId(const AtomicString& id) { m_id = id; }
+
+    const AtomicString& label() const { return m_label; }
+    void setLabel(const AtomicString& label) { m_label = label; }
+    
+    const AtomicString& type() const { return m_type; }
+    void setType(const AtomicString& type) { m_type = type; }
+    
+    unsigned short sortable() const { return m_sortable; }
+    void setSortable(unsigned short sortable) { m_sortable = sortable; }
+    
+    unsigned short sortDirection() const { return m_sortDirection; }
+    void setSortDirection(unsigned short sortDirection) { m_sortDirection = sortDirection; }
+    
+    bool primary() const { return m_primary; }
+    void setPrimary(bool);
+
+    void detachFromColumnList() { m_columns = 0; }
+
+private:
+    DataGridColumn(DataGridColumnList* columns, const String& columnID, const String& label, const String& type, bool primary, unsigned short sortable)
+        : m_columns(columns)
+        , m_id(columnID)
+        , m_label(label)
+        , m_type(type)
+        , m_primary(primary)
+        , m_sortable(sortable)
+        , m_sortDirection(0)
+    {
+    }
+
+    DataGridColumnList* m_columns; // Not refcounted.  The columns list will null out our reference when it goes away.
+
+    AtomicString m_id;
+    AtomicString m_label;
+    AtomicString m_type;
+
+    bool m_primary;
+
+    unsigned short m_sortable;
+    unsigned short m_sortDirection;
+};
+
+} // namespace WebCore
+
+#endif // DataGridColumn_h
diff --git a/src/3rdparty/webkit/WebCore/html/DataGridColumn.idl b/src/3rdparty/webkit/WebCore/html/DataGridColumn.idl
new file mode 100644
index 0000000..04418a1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/DataGridColumn.idl
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+
+    interface [
+        GenerateConstructor
+    ] DataGridColumn {
+        attribute DOMString id; // The identifier for the column.
+        attribute DOMString label; // The text to display in the column.
+        attribute DOMString type; // The type of data displayed in this column.
+
+        const unsigned short NEVER_SORTED = 0;
+        const unsigned short ALWAYS_SORTED = 1;
+        const unsigned short SOMETIMES_SORTED = 2;
+        attribute unsigned short sortable; // Whether or not the column can be sorted.
+
+        const unsigned short NATURAL_SORT = 0;
+        const unsigned short SORT_ASCENDING = 1;
+        const unsigned short SORC_DESCENDING = 2;
+        attribute unsigned short sortDirection; // The sort direction for the column.  Valid values are ascending, descending and natural (no sort applied).
+    
+        attribute boolean primary; // Whether or not this is the primary column of the tree (this will be where the disclosure triangle and connecting tree lines will display)
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/html/DataGridColumnList.cpp b/src/3rdparty/webkit/WebCore/html/DataGridColumnList.cpp
new file mode 100644
index 0000000..48f7d60
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/DataGridColumnList.cpp
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DataGridColumnList.h"
+
+#include "AtomicString.h"
+#include "PlatformString.h"
+
+namespace WebCore {
+
+DataGridColumnList::~DataGridColumnList()
+{
+    clear();
+}
+
+DataGridColumn* DataGridColumnList::itemWithName(const AtomicString& name) const
+{
+    unsigned length = m_columns.size();
+    for (unsigned i = 0; i < length; ++i) {
+        if (m_columns[i]->id() == name)
+            return m_columns[i].get();
+    }
+    return 0;
+}
+
+DataGridColumn* DataGridColumnList::add(const String& id, const String& label, const String& type, bool primary, unsigned short sortable)
+{
+    RefPtr<DataGridColumn> column = DataGridColumn::create(this, id, label, type, primary, sortable);
+    if (primary)
+        m_primaryColumn = column;
+    m_columns.append(column);
+    return column.get();
+}
+
+void DataGridColumnList::remove(DataGridColumn* col)
+{
+    size_t index = m_columns.find(col);
+    if (index == notFound)
+        return;
+    m_columns.remove(index);
+    if (col == m_primaryColumn)
+        m_primaryColumn = 0;
+    if (col == m_sortColumn)
+        m_sortColumn = 0;
+}
+
+void DataGridColumnList::move(DataGridColumn* col, unsigned long index)
+{
+    size_t colIndex = m_columns.find(col);
+    if (colIndex == notFound)
+        return;
+    m_columns.insert(index, col);
+}
+
+void DataGridColumnList::clear()
+{
+    unsigned length = m_columns.size();
+    for (unsigned i = 0; i < length; ++i)
+        m_columns[i]->detachFromColumnList();
+    m_columns.clear();
+    m_primaryColumn = 0;
+    m_sortColumn = 0;
+}
+
+void DataGridColumnList::primaryColumnChanged(DataGridColumn* col)
+{
+    if (col->primary())
+        m_primaryColumn = col;
+    else if (m_primaryColumn = col)
+        m_primaryColumn = 0;
+    
+    // FIXME: Invalidate the tree.
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/DataGridColumnList.h b/src/3rdparty/webkit/WebCore/html/DataGridColumnList.h
new file mode 100644
index 0000000..d0caebe
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/DataGridColumnList.h
@@ -0,0 +1,48 @@
+#ifndef DataGridColumnList_h
+#define DataGridColumnList_h
+
+#include "DataGridColumn.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class AtomicString;
+
+class DataGridColumnList : public RefCounted<DataGridColumnList> {
+    friend class DataGridColumn;
+public:
+    static PassRefPtr<DataGridColumnList> create()
+    {
+        return new DataGridColumnList();
+    }
+
+    ~DataGridColumnList();
+
+    unsigned length() const { return m_columns.size(); }
+
+    DataGridColumn* item(unsigned index) const { return m_columns[index].get(); }
+    DataGridColumn* itemWithName(const AtomicString&) const;
+
+    DataGridColumn* primaryColumn() const { return m_primaryColumn.get(); }
+
+    DataGridColumn* sortColumn() const { return m_sortColumn.get(); }
+
+    DataGridColumn* add(const String& id, const String& label, const String& type, bool primary, unsigned short sortable);
+    void remove(DataGridColumn*);
+    void move(DataGridColumn*, unsigned long index);
+    void clear();
+
+private:
+    void primaryColumnChanged(DataGridColumn* col);
+
+    Vector<RefPtr<DataGridColumn> > m_columns;
+    RefPtr<DataGridColumn> m_primaryColumn;
+    RefPtr<DataGridColumn> m_sortColumn;
+};
+
+} // namespace WebCore
+
+#endif // DataGridColumnList_h
diff --git a/src/3rdparty/webkit/WebCore/html/DataGridColumnList.idl b/src/3rdparty/webkit/WebCore/html/DataGridColumnList.idl
new file mode 100644
index 0000000..cab4339
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/DataGridColumnList.idl
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+
+    interface [
+        GenerateConstructor,
+        HasIndexGetter,
+        HasNameGetter
+    ] DataGridColumnList {
+        DataGridColumn item(in [IsIndex] unsigned long index);
+        readonly attribute unsigned long length;
+
+        readonly attribute DataGridColumn sortColumn;
+        readonly attribute DataGridColumn primaryColumn;
+
+        DataGridColumn add(in DOMString id, in DOMString label, in DOMString type, in boolean primary, in unsigned short sortable);
+        void remove(in DataGridColumn column);
+        void move(in DataGridColumn column, in unsigned long index);
+        void clear();
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/html/DataGridDataSource.h b/src/3rdparty/webkit/WebCore/html/DataGridDataSource.h
new file mode 100644
index 0000000..0c9a24d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/DataGridDataSource.h
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef DataGridDataSource_h
+#define DataGridDataSource_h
+
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class HTMLDataGridElement;
+
+class DataGridDataSource : public RefCounted<DataGridDataSource> {
+public:
+    virtual ~DataGridDataSource() { }
+
+    virtual bool isJSDataGridDataSource() const { return false; }
+
+    virtual void initialize(HTMLDataGridElement*) = 0;
+};
+
+} // namespace WebCore
+
+#endif // DataGridDataSource_h
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp
index ce08bcc..354f9f0 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.cpp
@@ -36,9 +36,11 @@
 #include "HTMLImageElement.h"
 #include "HTMLNames.h"
 #include "KeyboardEvent.h"
+#include "MappedAttribute.h"
 #include "MouseEvent.h"
 #include "MutationEvent.h"
-#include "RenderFlow.h"
+#include "Page.h"
+#include "RenderBox.h"
 #include "RenderImage.h"
 #include "ResourceRequest.h"
 #include "SelectionController.h"
@@ -107,12 +109,14 @@ bool HTMLAnchorElement::isKeyboardFocusable(KeyboardEvent* event) const
     if (!document()->frame()->eventHandler()->tabsToLinks(event))
         return false;
 
+    if (!renderer() || !renderer()->isBoxModelObject())
+        return false;
+    
     // Before calling absoluteRects, check for the common case where the renderer
-    // or one of the continuations is non-empty, since this is a faster check and
-    // almost always returns true.
-    for (RenderObject* r = renderer(); r; r = r->continuation())
-        if (r->width() > 0 && r->height() > 0)
-            return true;
+    // is non-empty, since this is a faster check and almost always returns true.
+    RenderBoxModelObject* box = toRenderBoxModelObject(renderer());
+    if (!box->borderBoundingBox().isEmpty())
+        return true;
 
     Vector<IntRect> rects;
     FloatPoint absPos = renderer()->localToAbsolute();
@@ -197,7 +201,7 @@ void HTMLAnchorElement::defaultEventHandler(Event* evt)
         if (evt->target()->toNode()->hasTagName(imgTag)) {
             HTMLImageElement* img = static_cast<HTMLImageElement*>(evt->target()->toNode());
             if (img && img->isServerMap()) {
-                RenderImage* r = static_cast<RenderImage*>(img->renderer());
+                RenderImage* r = toRenderImage(img->renderer());
                 if (r && e) {
                     // FIXME: broken with transforms
                     FloatPoint absPos = r->localToAbsolute();
@@ -216,7 +220,7 @@ void HTMLAnchorElement::defaultEventHandler(Event* evt)
         }
 
         if (!evt->defaultPrevented() && document()->frame())
-            document()->frame()->loader()->urlSelected(document()->completeURL(url), getAttribute(targetAttr), evt, false, true);
+            document()->frame()->loader()->urlSelected(document()->completeURL(url), getAttribute(targetAttr), evt, false, false, true);
 
         evt->setDefaultHandled();
     } else if (isLink() && isContentEditable()) {
@@ -277,11 +281,17 @@ void HTMLAnchorElement::parseMappedAttribute(MappedAttribute *attr)
         bool wasLink = isLink();
         setIsLink(!attr->isNull());
         if (wasLink != isLink())
-            setChanged();
-        if (isLink() && document()->isDNSPrefetchEnabled()) {
-            String value = attr->value();
-            if (protocolIs(value, "http") || protocolIs(value, "https") || value.startsWith("//"))
-                prefetchDNS(document()->completeURL(value).host());
+            setNeedsStyleRecalc();
+        if (isLink()) {
+            String parsedURL = parseURL(attr->value());
+            if (document()->isDNSPrefetchEnabled()) {
+                if (protocolIs(parsedURL, "http") || protocolIs(parsedURL, "https") || parsedURL.startsWith("//"))
+                    prefetchDNS(document()->completeURL(parsedURL).host());
+            }
+            if (document()->page() && !document()->page()->javaScriptURLsAreAllowed() && protocolIsJavaScript(parsedURL)) {
+                setIsLink(false);
+                attr->setValue(nullAtom);
+            }
         }
     } else if (attr->name() == nameAttr ||
              attr->name() == titleAttr ||
@@ -428,7 +438,8 @@ void HTMLAnchorElement::setType(const AtomicString& value)
 
 String HTMLAnchorElement::hash() const
 {
-    return "#" + href().ref();
+    String ref = href().ref();
+    return ref.isEmpty() ? "" : "#" + ref;
 }
 
 String HTMLAnchorElement::host() const
@@ -461,7 +472,8 @@ String HTMLAnchorElement::protocol() const
 
 String HTMLAnchorElement::search() const
 {
-    return href().query();
+    String query = href().query();
+    return query.isEmpty() ? "" : "?" + query;
 }
 
 String HTMLAnchorElement::text() const
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.idl
index f3a15ee..c2dda3d 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAnchorElement.idl
@@ -47,11 +47,11 @@ module html {
         readonly attribute DOMString search;
         readonly attribute DOMString text;
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         [DontEnum] DOMString toString();
 #endif
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extension:
         readonly attribute URL absoluteLinkURL;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.cpp
index 9d7ab6a6..13dd911 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.cpp
@@ -27,6 +27,7 @@
 #include "Frame.h"
 #include "HTMLDocument.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderApplet.h"
 #include "RenderInline.h"
 #include "Settings.h"
@@ -99,9 +100,12 @@ void HTMLAppletElement::removedFromDocument()
     HTMLPlugInElement::removedFromDocument();
 }
 
-bool HTMLAppletElement::rendererIsNeeded(RenderStyle*)
+bool HTMLAppletElement::rendererIsNeeded(RenderStyle* style)
 {
-    return !getAttribute(codeAttr).isNull();
+    if (getAttribute(codeAttr).isNull())
+        return false;
+
+    return HTMLPlugInElement::rendererIsNeeded(style);
 }
 
 RenderObject* HTMLAppletElement::createRenderer(RenderArena*, RenderStyle* style)
@@ -112,9 +116,11 @@ RenderObject* HTMLAppletElement::createRenderer(RenderArena*, RenderStyle* style
         HashMap<String, String> args;
 
         args.set("code", getAttribute(codeAttr));
+
         const AtomicString& codeBase = getAttribute(codebaseAttr);
-        if(!codeBase.isNull())
+        if (!codeBase.isNull())
             args.set("codeBase", codeBase);
+
         const AtomicString& name = getAttribute(document()->isHTMLDocument() ? nameAttr : idAttr);
         if (!name.isNull())
             args.set("name", name);
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.idl
index 794f000..da7a33a 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAppletElement.idl
@@ -22,8 +22,8 @@ module html {
 
     interface [
         GenerateConstructor,
-        CustomPutFunction,
-        CustomGetOwnPropertySlot,
+        DelegatingPutFunction,
+        DelegatingGetOwnPropertySlot,
         CustomCall,
         HasOverridingNameGetter,
         InterfaceUUID=9b5cb4a8-c156-4b55-afdb-c60938a4d1b1,
@@ -35,14 +35,14 @@ module html {
                  attribute [ConvertNullToNullString] DOMString code;
                  attribute [ConvertNullToNullString] DOMString codeBase;
                  attribute [ConvertNullToNullString] DOMString height;
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
                  attribute [ConvertNullToNullString] DOMString hspace;
 #else
                  attribute [ConvertFromString] long hspace;
 #endif
                  attribute [ConvertNullToNullString] DOMString name;
                  attribute [ConvertNullToNullString] DOMString object;
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
                  attribute [ConvertNullToNullString] DOMString vspace;
 #else
                  attribute [ConvertFromString] long vspace;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.cpp
index 7a3c9e0..2f7c1a5 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2005, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -27,6 +27,8 @@
 #include "HTMLNames.h"
 #include "HitTestResult.h"
 #include "Length.h"
+#include "MappedAttribute.h"
+#include "Path.h"
 #include "RenderObject.h"
 
 using namespace std;
@@ -35,8 +37,8 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLAreaElement::HTMLAreaElement(const QualifiedName& tagName, Document *doc)
-    : HTMLAnchorElement(tagName, doc)
+HTMLAreaElement::HTMLAreaElement(const QualifiedName& tagName, Document* document)
+    : HTMLAnchorElement(tagName, document)
     , m_coords(0)
     , m_coordsLen(0)
     , m_lastSize(-1, -1)
@@ -73,11 +75,11 @@ void HTMLAreaElement::parseMappedAttribute(MappedAttribute *attr)
 bool HTMLAreaElement::mapMouseEvent(int x, int y, const IntSize& size, HitTestResult& result)
 {
     if (m_lastSize != size) {
-        region = getRegion(size);
+        m_region.set(new Path(getRegion(size)));
         m_lastSize = size;
     }
 
-    if (!region.contains(IntPoint(x, y)))
+    if (!m_region->contains(IntPoint(x, y)))
         return false;
     
     result.setInnerNode(this);
@@ -150,32 +152,32 @@ Path HTMLAreaElement::getRegion(const IntSize& size) const
     return path;
 }
 
-String HTMLAreaElement::accessKey() const
+const AtomicString& HTMLAreaElement::accessKey() const
 {
     return getAttribute(accesskeyAttr);
 }
 
-void HTMLAreaElement::setAccessKey(const String& value)
+void HTMLAreaElement::setAccessKey(const AtomicString& value)
 {
     setAttribute(accesskeyAttr, value);
 }
 
-String HTMLAreaElement::alt() const
+const AtomicString& HTMLAreaElement::alt() const
 {
     return getAttribute(altAttr);
 }
 
-void HTMLAreaElement::setAlt(const String& value)
+void HTMLAreaElement::setAlt(const AtomicString& value)
 {
     setAttribute(altAttr, value);
 }
 
-String HTMLAreaElement::coords() const
+const AtomicString& HTMLAreaElement::coords() const
 {
     return getAttribute(coordsAttr);
 }
 
-void HTMLAreaElement::setCoords(const String& value)
+void HTMLAreaElement::setCoords(const AtomicString& value)
 {
     setAttribute(coordsAttr, value);
 }
@@ -185,7 +187,7 @@ KURL HTMLAreaElement::href() const
     return document()->completeURL(getAttribute(hrefAttr));
 }
 
-void HTMLAreaElement::setHref(const String& value)
+void HTMLAreaElement::setHref(const AtomicString& value)
 {
     setAttribute(hrefAttr, value);
 }
@@ -200,12 +202,12 @@ void HTMLAreaElement::setNoHref(bool noHref)
     setAttribute(nohrefAttr, noHref ? "" : 0);
 }
 
-String HTMLAreaElement::shape() const
+const AtomicString& HTMLAreaElement::shape() const
 {
     return getAttribute(shapeAttr);
 }
 
-void HTMLAreaElement::setShape(const String& value)
+void HTMLAreaElement::setShape(const AtomicString& value)
 {
     setAttribute(shapeAttr, value);
 }
@@ -220,7 +222,7 @@ String HTMLAreaElement::target() const
     return getAttribute(targetAttr);
 }
 
-void HTMLAreaElement::setTarget(const String& value)
+void HTMLAreaElement::setTarget(const AtomicString& value)
 {
     setAttribute(targetAttr, value);
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.h b/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.h
index 7de5832..19533b1 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,11 +25,11 @@
 
 #include "HTMLAnchorElement.h"
 #include "IntSize.h"
-#include "Path.h"
 
 namespace WebCore {
 
 class HitTestResult;
+class Path;
 
 class HTMLAreaElement : public HTMLAnchorElement {
 public:
@@ -47,33 +47,34 @@ public:
 
     virtual IntRect getRect(RenderObject*) const;
 
-    String accessKey() const;
-    void setAccessKey(const String&);
+    const AtomicString& accessKey() const;
+    void setAccessKey(const AtomicString&);
 
-    String alt() const;
-    void setAlt(const String&);
+    const AtomicString& alt() const;
+    void setAlt(const AtomicString&);
 
-    String coords() const;
-    void setCoords(const String&);
+    const AtomicString& coords() const;
+    void setCoords(const AtomicString&);
 
     KURL href() const;
-    void setHref(const String&);
+    void setHref(const AtomicString&);
 
     bool noHref() const;
     void setNoHref(bool);
 
-    String shape() const;
-    void setShape(const String&);
+    const AtomicString& shape() const;
+    void setShape(const AtomicString&);
 
     virtual bool isFocusable() const;
 
     virtual String target() const;
-    void setTarget(const String&);
+    void setTarget(const AtomicString&);
 
 private:
     enum Shape { Default, Poly, Rect, Circle, Unknown };
     Path getRegion(const IntSize&) const;
-    Path region;
+
+    OwnPtr<Path> m_region;
     Length* m_coords;
     int m_coordsLen;
     IntSize m_lastSize;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.idl
index 39cc719..d80ebed 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAreaElement.idl
@@ -42,7 +42,7 @@ module html {
         readonly attribute DOMString protocol;
         readonly attribute DOMString search;
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extension:
         readonly attribute URL absoluteLinkURL;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in b/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
index 2f6b4ea..a29d6d2 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
+++ b/src/3rdparty/webkit/WebCore/html/HTMLAttributeNames.in
@@ -1,7 +1,7 @@
 namespace="HTML"
 namespacePrefix="xhtml"
 namespaceURI="http://www.w3.org/1999/xhtml"
-attrsNullNamespace="1"
+attrsNullNamespace
 
 abbr
 accept_charset
@@ -15,13 +15,17 @@ archive
 aria-activedescendant
 aria-checked
 aria-describedby
+aria-disabled
+aria-hidden
 aria-labeledby
 aria-labelledby
 aria-level
 aria-pressed
+aria-readonly
 aria-valuemax
 aria-valuemin
 aria-valuenow
+autobuffer
 autocomplete
 autofocus
 autoplay
@@ -42,7 +46,7 @@ charset
 checked
 cellborder
 cite
-class exportString="1"
+class exportString
 classid
 clear
 code
@@ -66,7 +70,9 @@ direction
 disabled
 enctype
 end
+expanded
 face
+focused
 for
 frame
 frameborder
@@ -79,6 +85,7 @@ hspace
 http_equiv
 id
 incremental
+indeterminate
 ismap
 keytype
 label
@@ -114,6 +121,8 @@ onbeforecut
 onbeforepaste
 onbeforeunload
 onblur
+oncanplay
+oncanplaythrough
 onchange
 onclick
 oncontextmenu
@@ -127,6 +136,9 @@ ondragleave
 ondragover
 ondragstart
 ondrop
+ondurationchange
+onemptied
+onended
 onerror
 onfocus
 oninput
@@ -134,22 +146,39 @@ onkeydown
 onkeypress
 onkeyup
 onload
+onloadeddata
+onloadedmetadata
+onloadstart
 onmousedown
 onmousemove
 onmouseout
 onmouseover
 onmouseup
 onmousewheel
+ononline
+onoffline
 onpaste
+onpause
+onplay
+onplaying
+onprogress
+onratechange
 onreset
 onresize
 onscroll
 onsearch
+onseeked
+onseeking
 onselect
 onselectstart
+onstalled
 onstorage
+onsuspend
 onsubmit
+ontimeupdate
 onunload
+onvolumechange
+onwaiting
 onwebkitanimationstart
 onwebkitanimationiteration
 onwebkitanimationend
@@ -158,7 +187,9 @@ placeholder
 pluginurl
 poster
 precision
+primary
 profile
+progress
 prompt
 readonly
 rel
@@ -176,7 +207,10 @@ scrolling
 selected
 shape
 size
+sortable
+sortdirection
 span
+spellcheck
 src
 standby
 start
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBRElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLBRElement.cpp
index e98f8d1..6f86e6a 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBRElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBRElement.cpp
@@ -19,11 +19,13 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLBRElement.h"
 
 #include "CSSPropertyNames.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderBR.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBaseElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLBaseElement.cpp
index dd4f7b3..a278908 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBaseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBaseElement.cpp
@@ -29,6 +29,7 @@
 #include "FrameLoader.h"
 #include "HTMLNames.h"
 #include "KURL.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBaseFontElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLBaseFontElement.cpp
index 0d7c59b..ef08822 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBaseFontElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBaseFontElement.cpp
@@ -1,4 +1,4 @@
-/**
+/*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBaseFontElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLBaseFontElement.idl
index a94f3ab..f09c9d7 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBaseFontElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBaseFontElement.idl
@@ -26,7 +26,7 @@ module html {
     ] HTMLBaseFontElement : HTMLElement {
         attribute [ConvertNullToNullString] DOMString color;
         attribute [ConvertNullToNullString] DOMString face;
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         attribute [ConvertToString] DOMString size; // this changed to a long, but our existing API is a string
 #else
         attribute long size;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.cpp
index a23f9be..74c7c9e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.cpp
@@ -32,9 +32,12 @@
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "EventNames.h"
+#include "Frame.h"
 #include "FrameView.h"
 #include "HTMLFrameElementBase.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
+#include "ScriptEventListener.h"
 
 namespace WebCore {
 
@@ -131,25 +134,26 @@ void HTMLBodyElement::parseMappedAttribute(MappedAttribute *attr)
         if (attached())
             document()->recalcStyle(Force);
     } else if (attr->name() == onloadAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().loadEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onbeforeunloadAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().beforeunloadEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().beforeunloadEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onunloadAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().unloadEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().unloadEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onblurAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().blurEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onfocusAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().focusEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onresizeAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().resizeEvent, attr);
+        document()->setWindowAttributeEventListener(eventNames().resizeEvent, createAttributeEventListener(document()->frame(), attr));
     else if (attr->name() == onscrollAttr)
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().scrollEvent, attr);
-    else if (attr->name() == onstorageAttr) {
-        // The HTML5 spec currently specifies that storage events are fired only at the body element of
-        // an HTMLDocument, which is why the onstorage attribute differs from the ones before it.
-        // The spec might change on this, and then so should we!
-        setInlineEventListenerForTypeAndAttribute(eventNames().storageEvent, attr);
-    } else
+        document()->setWindowAttributeEventListener(eventNames().scrollEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onstorageAttr)
+        document()->setWindowAttributeEventListener(eventNames().storageEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == ononlineAttr)
+        document()->setWindowAttributeEventListener(eventNames().onlineEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onofflineAttr)
+        document()->setWindowAttributeEventListener(eventNames().offlineEvent, createAttributeEventListener(document()->frame(), attr));
+    else
         HTMLElement::parseMappedAttribute(attr);
 }
 
@@ -240,13 +244,24 @@ void HTMLBodyElement::setVLink(const String& value)
     setAttribute(vlinkAttr, value);
 }
 
+static int adjustForZoom(int value, FrameView* frameView)
+{
+    float zoomFactor = frameView->frame()->zoomFactor();
+    if (zoomFactor == 1)
+        return value;
+    // Needed because of truncation (rather than rounding) when scaling up.
+    if (zoomFactor > 1)
+        value++;
+    return static_cast<int>(value / zoomFactor);
+}
+
 int HTMLBodyElement::scrollLeft() const
 {
     // Update the document's layout.
     Document* doc = document();
     doc->updateLayoutIgnorePendingStylesheets();
     FrameView* view = doc->view();
-    return view ? view->scrollX() : 0;
+    return view ? adjustForZoom(view->scrollX(), view) : 0;
 }
 
 void HTMLBodyElement::setScrollLeft(int scrollLeft)
@@ -255,7 +270,7 @@ void HTMLBodyElement::setScrollLeft(int scrollLeft)
     if (sview) {
         // Update the document's layout
         document()->updateLayoutIgnorePendingStylesheets();
-        sview->setScrollPosition(IntPoint(scrollLeft, sview->scrollY()));
+        sview->setScrollPosition(IntPoint(static_cast<int>(scrollLeft * sview->frame()->zoomFactor()), sview->scrollY()));
     }    
 }
 
@@ -265,7 +280,7 @@ int HTMLBodyElement::scrollTop() const
     Document* doc = document();
     doc->updateLayoutIgnorePendingStylesheets();
     FrameView* view = doc->view();
-    return view ? view->scrollY() : 0;
+    return view ? adjustForZoom(view->scrollY(), view) : 0;
 }
 
 void HTMLBodyElement::setScrollTop(int scrollTop)
@@ -274,7 +289,7 @@ void HTMLBodyElement::setScrollTop(int scrollTop)
     if (sview) {
         // Update the document's layout
         document()->updateLayoutIgnorePendingStylesheets();
-        sview->setScrollPosition(IntPoint(sview->scrollX(), scrollTop));
+        sview->setScrollPosition(IntPoint(sview->scrollX(), static_cast<int>(scrollTop * sview->frame()->zoomFactor())));
     }        
 }
 
@@ -284,7 +299,7 @@ int HTMLBodyElement::scrollHeight() const
     Document* doc = document();
     doc->updateLayoutIgnorePendingStylesheets();
     FrameView* view = doc->view();
-    return view ? view->contentsHeight() : 0;    
+    return view ? adjustForZoom(view->contentsHeight(), view) : 0;    
 }
 
 int HTMLBodyElement::scrollWidth() const
@@ -293,7 +308,7 @@ int HTMLBodyElement::scrollWidth() const
     Document* doc = document();
     doc->updateLayoutIgnorePendingStylesheets();
     FrameView* view = doc->view();
-    return view ? view->contentsWidth() : 0;    
+    return view ? adjustForZoom(view->contentsWidth(), view) : 0;    
 }
 
 void HTMLBodyElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
@@ -303,4 +318,126 @@ void HTMLBodyElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
     addSubresourceURL(urls, document()->completeURL(background()));
 }
 
+void HTMLBodyElement::didMoveToNewOwnerDocument()
+{
+    // When moving body elements between documents, we should have to reset the parent sheet for any
+    // link style declarations.  If we don't we might crash later.
+    // In practice I can't reproduce this theoretical problem.
+    // webarchive/adopt-attribute-styled-body-webarchive.html tries to make sure this crash won't surface.
+    if (m_linkDecl)
+        m_linkDecl->setParent(document()->elementSheet());
+    
+    HTMLElement::didMoveToNewOwnerDocument();
+}
+
+EventListener* HTMLBodyElement::onblur() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().blurEvent);
+}
+
+void HTMLBodyElement::setOnblur(PassRefPtr<EventListener> eventListener)
+{
+    document()->setAttributeEventListener(eventNames().blurEvent, eventListener);
+}
+
+EventListener* HTMLBodyElement::onerror() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().errorEvent);
+}
+
+void HTMLBodyElement::setOnerror(PassRefPtr<EventListener> eventListener)
+{
+    document()->setAttributeEventListener(eventNames().errorEvent, eventListener);
+}
+
+EventListener* HTMLBodyElement::onfocus() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().focusEvent);
+}
+
+void HTMLBodyElement::setOnfocus(PassRefPtr<EventListener> eventListener)
+{
+    document()->setAttributeEventListener(eventNames().focusEvent, eventListener);
+}
+
+EventListener* HTMLBodyElement::onload() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().loadEvent);
+}
+
+void HTMLBodyElement::setOnload(PassRefPtr<EventListener> eventListener)
+{
+    document()->setAttributeEventListener(eventNames().loadEvent, eventListener);
+}
+
+EventListener* HTMLBodyElement::onbeforeunload() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().beforeunloadEvent);
+}
+
+void HTMLBodyElement::setOnbeforeunload(PassRefPtr<EventListener> eventListener)
+{
+    document()->setAttributeEventListener(eventNames().beforeunloadEvent, eventListener);
+}
+
+EventListener* HTMLBodyElement::onmessage() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().messageEvent);
+}
+
+void HTMLBodyElement::setOnmessage(PassRefPtr<EventListener> eventListener)
+{
+    document()->setAttributeEventListener(eventNames().messageEvent, eventListener);
+}
+
+EventListener* HTMLBodyElement::onoffline() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().offlineEvent);
+}
+
+void HTMLBodyElement::setOnoffline(PassRefPtr<EventListener> eventListener)
+{
+    document()->setAttributeEventListener(eventNames().offlineEvent, eventListener);
+}
+
+EventListener* HTMLBodyElement::ononline() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().onlineEvent);
+}
+
+void HTMLBodyElement::setOnonline(PassRefPtr<EventListener> eventListener)
+{
+    document()->setAttributeEventListener(eventNames().onlineEvent, eventListener);
+}
+
+EventListener* HTMLBodyElement::onresize() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().resizeEvent);
+}
+
+void HTMLBodyElement::setOnresize(PassRefPtr<EventListener> eventListener)
+{
+    document()->setAttributeEventListener(eventNames().resizeEvent, eventListener);
+}
+
+EventListener* HTMLBodyElement::onstorage() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().storageEvent);
+}
+
+void HTMLBodyElement::setOnstorage(PassRefPtr<EventListener> eventListener)
+{
+    document()->setAttributeEventListener(eventNames().storageEvent, eventListener);
+}
+
+EventListener* HTMLBodyElement::onunload() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().unloadEvent);
 }
+
+void HTMLBodyElement::setOnunload(PassRefPtr<EventListener> eventListener)
+{
+    document()->setAttributeEventListener(eventNames().unloadEvent, eventListener);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.h b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.h
index a72e668..274a675 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.h
@@ -30,8 +30,7 @@
 
 namespace WebCore {
 
-class HTMLBodyElement : public HTMLElement
-{
+class HTMLBodyElement : public HTMLElement {
 public:
     HTMLBodyElement(const QualifiedName&, Document*);
     ~HTMLBodyElement();
@@ -61,19 +60,47 @@ public:
     String vLink() const;
     void setVLink(const String&);
 
-    int scrollLeft() const;
-    void setScrollLeft(int scrollLeft);
+    // Event handler attributes
+    virtual EventListener* onblur() const;
+    virtual void setOnblur(PassRefPtr<EventListener>);
+    virtual EventListener* onerror() const;
+    virtual void setOnerror(PassRefPtr<EventListener>);
+    virtual EventListener* onfocus() const;
+    virtual void setOnfocus(PassRefPtr<EventListener>);
+    virtual EventListener* onload() const;
+    virtual void setOnload(PassRefPtr<EventListener>);
+
+    EventListener* onbeforeunload() const;
+    void setOnbeforeunload(PassRefPtr<EventListener>);
+    EventListener* onmessage() const;
+    void setOnmessage(PassRefPtr<EventListener>);
+    EventListener* onoffline() const;
+    void setOnoffline(PassRefPtr<EventListener>);
+    EventListener* ononline() const;
+    void setOnonline(PassRefPtr<EventListener>);
+    EventListener* onresize() const;
+    void setOnresize(PassRefPtr<EventListener>);
+    EventListener* onstorage() const;
+    void setOnstorage(PassRefPtr<EventListener>);
+    EventListener* onunload() const;
+    void setOnunload(PassRefPtr<EventListener>);
+
+    virtual int scrollLeft() const;
+    virtual void setScrollLeft(int scrollLeft);
     
-    int scrollTop() const;
-    void setScrollTop(int scrollTop);
+    virtual int scrollTop() const;
+    virtual void setScrollTop(int scrollTop);
     
-    int scrollHeight() const;
-    int scrollWidth() const;
+    virtual int scrollHeight() const;
+    virtual int scrollWidth() const;
     
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
     
 protected:
     RefPtr<CSSMutableStyleDeclaration> m_linkDecl;
+
+private:
+    virtual void didMoveToNewOwnerDocument();
 };
 
 } //namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.idl
index 41d20d6..fa3fef9 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBodyElement.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -30,13 +30,34 @@ module html {
         attribute [ConvertNullToNullString] DOMString bgColor;
         attribute [ConvertNullToNullString] DOMString link;
         attribute [ConvertNullToNullString] DOMString text;
-        attribute [ConvertNullToNullString] DOMString vLink; 
+        attribute [ConvertNullToNullString] DOMString vLink;
 
-        // IE Extensions
-                 attribute long scrollLeft;
-                 attribute long scrollTop;
-        readonly attribute long scrollWidth;
-        readonly attribute long scrollHeight;
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+        // Event handler attributes
+        attribute [DontEnum] EventListener onbeforeunload;
+        attribute [DontEnum] EventListener onmessage;
+        attribute [DontEnum] EventListener onoffline;
+        attribute [DontEnum] EventListener ononline;
+        attribute [DontEnum] EventListener onresize;
+        attribute [DontEnum] EventListener onstorage;
+        attribute [DontEnum] EventListener onunload;
+
+        // Overrides of Element attributes.
+        // attribute [DontEnum] EventListener onblur;
+        // attribute [DontEnum] EventListener onerror;
+        // attribute [DontEnum] EventListener onfocus;
+        // attribute [DontEnum] EventListener onload;
+
+        // Not implemented yet.
+        // attribute [DontEnum] EventListener onafterprint;
+        // attribute [DontEnum] EventListener onbeforeprint;
+        // attribute [DontEnum] EventListener onhashchange;
+        // attribute [DontEnum] EventListener onpopstate;
+        // attribute [DontEnum] EventListener onredo;
+        // attribute [DontEnum] EventListener onundo;
+#endif
+#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.cpp
index 571f30c..3987859 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.cpp
@@ -30,7 +30,9 @@
 #include "FormDataList.h"
 #include "HTMLFormElement.h"
 #include "HTMLNames.h"
+#include "ScriptEventListener.h"
 #include "KeyboardEvent.h"
+#include "MappedAttribute.h"
 #include "RenderButton.h"
 #include <wtf/StdLibExtras.h>
 
@@ -55,7 +57,7 @@ RenderObject* HTMLButtonElement::createRenderer(RenderArena* arena, RenderStyle*
     return new (arena) RenderButton(this);
 }
 
-const AtomicString& HTMLButtonElement::type() const
+const AtomicString& HTMLButtonElement::formControlType() const
 {
     switch (m_type) {
         case SUBMIT: {
@@ -89,9 +91,9 @@ void HTMLButtonElement::parseMappedAttribute(MappedAttribute* attr)
         // Don't map 'align' attribute.  This matches what Firefox and IE do, but not Opera.
         // See http://bugs.webkit.org/show_bug.cgi?id=12071
     } else if (attr->name() == onfocusAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().focusEvent, attr);
+        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onblurAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().blurEvent, attr);
+        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
     } else
         HTMLFormControlElement::parseMappedAttribute(attr);
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.h b/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.h
index c8f51cb..b1d744c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLButtonElement.h
@@ -33,7 +33,7 @@ public:
     HTMLButtonElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
     virtual ~HTMLButtonElement();
 
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
         
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp
index 76c3202..9e635e7 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.cpp
@@ -39,6 +39,7 @@
 #include "HTMLNames.h"
 #include "ImageBuffer.h"
 #include "MIMETypeRegistry.h"
+#include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderHTMLCanvas.h"
 #include "Settings.h"
@@ -71,6 +72,8 @@ HTMLCanvasElement::HTMLCanvasElement(const QualifiedName& tagName, Document* doc
 
 HTMLCanvasElement::~HTMLCanvasElement()
 {
+    if (m_observer)
+        m_observer->canvasDestroyed(this);
 }
 
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -155,8 +158,8 @@ void HTMLCanvasElement::willDraw(const FloatRect& rect)
 {
     m_imageBuffer->clearImage();
     
-    if (RenderObject* ro = renderer()) {
-        FloatRect destRect = ro->contentBox();
+    if (RenderBox* ro = renderBox()) {
+        FloatRect destRect = ro->contentBoxRect();
         FloatRect r = mapRect(rect, FloatRect(0, 0, m_size.width(), m_size.height()), destRect);
         r.intersect(destRect);
         if (m_dirtyRect.contains(r))
@@ -256,7 +259,7 @@ void HTMLCanvasElement::createImageBuffer() const
     if (!size.width() || !size.height())
         return;
 
-    m_imageBuffer.set(ImageBuffer::create(size, false).release());
+    m_imageBuffer = ImageBuffer::create(size, false);
     // The convertLogicalToDevice MaxCanvasArea check should prevent common cases
     // where ImageBuffer::create() returns NULL, however we could still be low on memory.
     if (!m_imageBuffer)
@@ -284,7 +287,7 @@ TransformationMatrix HTMLCanvasElement::baseTransform() const
     IntSize size = convertLogicalToDevice(unscaledSize);
     TransformationMatrix transform;
     if (size.width() && size.height())
-        transform.scale(size.width() / unscaledSize.width(), size.height() / unscaledSize.height());
+        transform.scaleNonUniform(size.width() / unscaledSize.width(), size.height() / unscaledSize.height());
     transform.multiply(m_imageBuffer->baseTransform());
     return transform;
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.h b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.h
index 12b3cb2..bba1f2d 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.h
@@ -49,8 +49,9 @@ class CanvasObserver {
 public:
     virtual ~CanvasObserver() {};
 
-    virtual void canvasChanged(HTMLCanvasElement* element, const FloatRect& changedRect) = 0;
-    virtual void canvasResized(HTMLCanvasElement* element) = 0;
+    virtual void canvasChanged(HTMLCanvasElement*, const FloatRect& changedRect) = 0;
+    virtual void canvasResized(HTMLCanvasElement*) = 0;
+    virtual void canvasDestroyed(HTMLCanvasElement*) = 0;
 };
 
 class HTMLCanvasElement : public HTMLElement {
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.idl
index e457c15..13fc623 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCanvasElement.idl
@@ -37,8 +37,8 @@ module html {
         DOMString toDataURL(in [ConvertUndefinedOrNullToNullString] DOMString type)
             raises(DOMException);
 
-#if !defined(LANGUAGE_OBJECTIVE_C)
-        DOMObject getContext(in DOMString contextId);
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
+        [V8Custom] DOMObject getContext(in DOMString contextId);
 #endif
 
     };
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCollection.cpp b/src/3rdparty/webkit/WebCore/html/HTMLCollection.cpp
index 78c9c3c..9dca48f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCollection.cpp
@@ -35,7 +35,7 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLCollection::HTMLCollection(PassRefPtr<Node> base, Type type)
+HTMLCollection::HTMLCollection(PassRefPtr<Node> base, CollectionType type)
     : m_idsDone(false)
     , m_base(base)
     , m_type(type)
@@ -44,7 +44,7 @@ HTMLCollection::HTMLCollection(PassRefPtr<Node> base, Type type)
 {
 }
 
-HTMLCollection::HTMLCollection(PassRefPtr<Node> base, Type type, CollectionInfo* info)
+HTMLCollection::HTMLCollection(PassRefPtr<Node> base, CollectionType type, CollectionCache* info)
     : m_idsDone(false)
     , m_base(base)
     , m_type(type)
@@ -53,7 +53,7 @@ HTMLCollection::HTMLCollection(PassRefPtr<Node> base, Type type, CollectionInfo*
 {
 }
 
-PassRefPtr<HTMLCollection> HTMLCollection::create(PassRefPtr<Node> base, Type type)
+PassRefPtr<HTMLCollection> HTMLCollection::create(PassRefPtr<Node> base, CollectionType type)
 {
     return adoptRef(new HTMLCollection(base, type));
 }
@@ -64,74 +64,12 @@ HTMLCollection::~HTMLCollection()
         delete m_info;
 }
 
-HTMLCollection::CollectionInfo::CollectionInfo()
-    : version(0)
-{
-    reset();
-}
-
-inline void HTMLCollection::CollectionInfo::copyCacheMap(NodeCacheMap& dest, const NodeCacheMap& src)
-{
-    ASSERT(dest.isEmpty());
-    NodeCacheMap::const_iterator end = src.end();
-    for (NodeCacheMap::const_iterator it = src.begin(); it != end; ++it)
-        dest.add(it->first, new Vector<Element*>(*it->second));
-}
-
-HTMLCollection::CollectionInfo::CollectionInfo(const CollectionInfo& other)
-    : version(other.version)
-    , current(other.current)
-    , position(other.position)
-    , length(other.length)
-    , elementsArrayPosition(other.elementsArrayPosition)
-    , hasLength(other.hasLength)
-    , hasNameCache(other.hasNameCache)
-{
-    copyCacheMap(idCache, other.idCache);
-    copyCacheMap(nameCache, other.nameCache);
-}
-
-void HTMLCollection::CollectionInfo::swap(CollectionInfo& other)
-{
-    std::swap(version, other.version);
-    std::swap(current, other.current);
-    std::swap(position, other.position);
-    std::swap(length, other.length);
-    std::swap(elementsArrayPosition, other.elementsArrayPosition);
-
-    idCache.swap(other.idCache);
-    nameCache.swap(other.nameCache);
-    
-    std::swap(hasLength, other.hasLength);
-    std::swap(hasNameCache, other.hasNameCache);
-}
-
-HTMLCollection::CollectionInfo::~CollectionInfo()
-{
-    deleteAllValues(idCache);
-    deleteAllValues(nameCache);
-}
-
-void HTMLCollection::CollectionInfo::reset()
-{
-    current = 0;
-    position = 0;
-    length = 0;
-    hasLength = false;
-    elementsArrayPosition = 0;
-    deleteAllValues(idCache);
-    idCache.clear();
-    deleteAllValues(nameCache);
-    nameCache.clear();
-    hasNameCache = false;
-}
-
 void HTMLCollection::resetCollectionInfo() const
 {
     unsigned docversion = static_cast<HTMLDocument*>(m_base->document())->domTreeVersion();
 
     if (!m_info) {
-        m_info = new CollectionInfo;
+        m_info = new CollectionCache;
         m_ownsInfo = true;
         m_info->version = docversion;
         return;
@@ -164,7 +102,7 @@ Element* HTMLCollection::itemAfter(Element* previous) const
         case DocScripts:
         case DocumentNamedItems:
         case MapAreas:
-        case Other:
+        case OtherCollection:
         case SelectOptions:
         case WindowNamedItems:
             break;
@@ -245,7 +183,7 @@ Element* HTMLCollection::itemAfter(Element* previous) const
             case NodeChildren:
                 return e;
             case DocumentNamedItems:
-            case Other:
+            case OtherCollection:
             case WindowNamedItems:
                 ASSERT_NOT_REACHED();
                 break;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCollection.h b/src/3rdparty/webkit/WebCore/html/HTMLCollection.h
index 083ec05..b04bcbc 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCollection.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCollection.h
@@ -23,6 +23,7 @@
 #ifndef HTMLCollection_h
 #define HTMLCollection_h
 
+#include "CollectionType.h"
 #include <wtf/RefCounted.h>
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
@@ -37,46 +38,11 @@ class Node;
 class NodeList;
 class String;
 
+struct CollectionCache;
+
 class HTMLCollection : public RefCounted<HTMLCollection> {
 public:
-    enum Type {
-        // unnamed collection types cached in the document
-
-        DocImages,    // all <img> elements in the document
-        DocApplets,   // all <object> and <applet> elements
-        DocEmbeds,    // all <embed> elements
-        DocObjects,   // all <object> elements
-        DocForms,     // all <form> elements
-        DocLinks,     // all <a> _and_ <area> elements with a value for href
-        DocAnchors,   // all <a> elements with a value for name
-        DocScripts,   // all <script> elements
-
-        DocAll,       // "all" elements (IE)
-        NodeChildren, // first-level children (IE)
-
-        // named collection types cached in the document
-
-        WindowNamedItems,
-        DocumentNamedItems,
-
-        // types not cached in the document; these are types that can't be used on a document
-
-        TableTBodies, // all <tbody> elements in this table
-        TSectionRows, // all row elements in this table section
-        TRCells,      // all cells in this row
-        SelectOptions,
-        MapAreas,
-
-        Other
-    };
-
-    static const Type FirstUnnamedDocumentCachedType = DocImages;
-    static const unsigned NumUnnamedDocumentCachedTypes = NodeChildren - DocImages + 1;
-
-    static const Type FirstNamedDocumentCachedType = WindowNamedItems;
-    static const unsigned NumNamedDocumentCachedTypes = DocumentNamedItems - WindowNamedItems + 1;
-
-    static PassRefPtr<HTMLCollection> create(PassRefPtr<Node> base, Type);
+    static PassRefPtr<HTMLCollection> create(PassRefPtr<Node> base, CollectionType);
     virtual ~HTMLCollection();
     
     unsigned length() const;
@@ -94,52 +60,18 @@ public:
     PassRefPtr<NodeList> tags(const String&);
 
     Node* base() const { return m_base.get(); }
-    Type type() const { return m_type; }
-
-    // FIXME: This class name is a bad in two ways. First, "info" is much too vague,
-    // and doesn't convey the job of this class (caching collection state).
-    // Second, since this is a member of HTMLCollection, it doesn't need "collection"
-    // in its name.
-    struct CollectionInfo {
-        CollectionInfo();
-        CollectionInfo(const CollectionInfo&);
-        CollectionInfo& operator=(const CollectionInfo& other)
-        {
-            CollectionInfo tmp(other);    
-            swap(tmp);
-            return *this;
-        }
-        ~CollectionInfo();
-
-        void reset();
-        void swap(CollectionInfo&);
-
-        typedef HashMap<AtomicStringImpl*, Vector<Element*>*> NodeCacheMap;
-
-        unsigned version;
-        Element* current;
-        unsigned position;
-        unsigned length;
-        int elementsArrayPosition;
-        NodeCacheMap idCache;
-        NodeCacheMap nameCache;
-        bool hasLength;
-        bool hasNameCache;
-
-    private:
-        static void copyCacheMap(NodeCacheMap&, const NodeCacheMap&);
-    };
+    CollectionType type() const { return m_type; }
 
 protected:
-    HTMLCollection(PassRefPtr<Node> base, Type, CollectionInfo*);
+    HTMLCollection(PassRefPtr<Node> base, CollectionType, CollectionCache*);
 
-    CollectionInfo* info() const { return m_info; }
-    virtual void resetCollectionInfo() const;
+    CollectionCache* info() const { return m_info; }
+    void resetCollectionInfo() const;
 
     mutable bool m_idsDone; // for nextNamedItem()
 
 private:
-    HTMLCollection(PassRefPtr<Node> base, Type);
+    HTMLCollection(PassRefPtr<Node> base, CollectionType);
 
     virtual Element* itemAfter(Element*) const;
     virtual unsigned calcLength() const;
@@ -148,9 +80,9 @@ private:
     bool checkForNameMatch(Element*, bool checkName, const AtomicString& name) const;
 
     RefPtr<Node> m_base;
-    Type m_type;
+    CollectionType m_type;
 
-    mutable CollectionInfo* m_info;
+    mutable CollectionCache* m_info;
     mutable bool m_ownsInfo;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLCollection.idl b/src/3rdparty/webkit/WebCore/html/HTMLCollection.idl
index 8290e1a..1ba5ec7 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLCollection.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLCollection.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -26,6 +26,7 @@ module html {
         HasNameGetter,
         CustomCall,
         CustomToJS,
+        Polymorphic,
         InterfaceUUID=b0d215ff-6f9c-4d1f-86c3-f200a65a5134,
         ImplementationUUID=8e81b17f-7f74-4121-8f2f-a339a7e66447
     ] HTMLCollection {
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.cpp
new file mode 100644
index 0000000..d06ad82
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.cpp
@@ -0,0 +1,91 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "HTMLDataGridCellElement.h"
+
+#include "HTMLNames.h"
+#include "Text.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+HTMLDataGridCellElement::HTMLDataGridCellElement(const QualifiedName& name, Document* doc)
+    : HTMLElement(name, doc)
+{
+}
+
+String HTMLDataGridCellElement::label() const
+{
+    return getAttribute(labelAttr);
+}
+
+void HTMLDataGridCellElement::setLabel(const String& label)
+{
+    setAttribute(labelAttr, label);
+}
+
+bool HTMLDataGridCellElement::focused() const
+{
+    return hasAttribute(focusedAttr);
+}
+
+void HTMLDataGridCellElement::setFocused(bool focused)
+{
+    setAttribute(focusedAttr, focused ? "" : 0);
+}
+
+bool HTMLDataGridCellElement::checked() const
+{
+    return hasAttribute(checkedAttr);
+}
+
+void HTMLDataGridCellElement::setChecked(bool checked)
+{
+    setAttribute(checkedAttr, checked ? "" : 0);
+}
+
+bool HTMLDataGridCellElement::indeterminate() const
+{
+    return hasAttribute(indeterminateAttr);
+}
+
+void HTMLDataGridCellElement::setIndeterminate(bool indeterminate)
+{
+    setAttribute(indeterminateAttr, indeterminate ? "" : 0);
+}
+
+float HTMLDataGridCellElement::progress() const
+{
+    return getAttribute(progressAttr).toInt();
+}
+
+void HTMLDataGridCellElement::setProgress(float progress)
+{
+    setAttribute(progressAttr, String::number(progress));
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.h b/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.h
new file mode 100644
index 0000000..9de6e40
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef HTMLDataGridCellElement_h
+#define HTMLDataGridCellElement_h
+
+#include "HTMLElement.h"
+
+namespace WebCore {
+
+class HTMLDataGridCellElement : public HTMLElement {
+public:
+    HTMLDataGridCellElement(const QualifiedName&, Document*);
+
+    virtual HTMLTagStatus endTagRequirement() const { return TagStatusForbidden; }
+    virtual int tagPriority() const { return 0; }
+    
+    String label() const;
+    void setLabel(const String&);
+    
+    bool focused() const;
+    void setFocused(bool);
+
+    bool checked() const;
+    void setChecked(bool);
+    
+    bool indeterminate() const;
+    void setIndeterminate(bool);
+    
+    float progress() const;
+    void setProgress(float);
+};
+
+} // namespace WebCore
+
+#endif // HTMLDataGridCellElement_h
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.idl
new file mode 100644
index 0000000..4d15f6f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridCellElement.idl
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+
+    interface [
+        GenerateConstructor
+    ] HTMLDataGridCellElement : HTMLElement {
+        attribute DOMString label; // The text to display in the column, assuming the type supports text.
+
+        attribute boolean focused; // Whether or not this cell is currently focused.
+
+        attribute boolean checked; // The checked state of the column, assuming the type of the column is checkbox.
+        attribute boolean indeterminate; // If the checked state is indeterminate.
+
+        attribute float progress; // For progress cells, a value from 0-1.0 indicating the state of progress.
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.cpp
new file mode 100644
index 0000000..b209447
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.cpp
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "HTMLDataGridColElement.h"
+
+#include "HTMLNames.h"
+#include "Text.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+HTMLDataGridColElement::HTMLDataGridColElement(const QualifiedName& name, Document* doc)
+    : HTMLElement(name, doc)
+{
+}
+
+String HTMLDataGridColElement::label() const
+{
+    return getAttribute(labelAttr);
+}
+
+void HTMLDataGridColElement::setLabel(const String& label)
+{
+    setAttribute(labelAttr, label);
+}
+
+String HTMLDataGridColElement::type() const
+{
+    return getAttribute(typeAttr);
+}
+
+void HTMLDataGridColElement::setType(const String& type)
+{
+    setAttribute(typeAttr, type);
+}
+
+unsigned short HTMLDataGridColElement::sortable() const
+{
+    return hasAttribute(sortableAttr);
+}
+
+void HTMLDataGridColElement::setSortable(unsigned short sortable)
+{
+    setAttribute(sortableAttr, sortable ? "" : 0);
+}
+
+unsigned short HTMLDataGridColElement::sortDirection() const
+{
+    String sortDirection = getAttribute(sortdirectionAttr);
+    if (equalIgnoringCase(sortDirection, "ascending"))
+        return 1;
+    if (equalIgnoringCase(sortDirection, "descending"))
+        return 2;
+    return 0;
+}
+
+void HTMLDataGridColElement::setSortDirection(unsigned short sortDirection)
+{
+    // FIXME: Check sortable rules.
+    if (sortDirection == 0)
+        setAttribute(sortdirectionAttr, "natural");
+    else if (sortDirection == 1)
+        setAttribute(sortdirectionAttr, "ascending");
+    else if (sortDirection == 2)
+        setAttribute(sortdirectionAttr, "descending");
+}
+
+bool HTMLDataGridColElement::primary() const
+{
+    return hasAttribute(primaryAttr);
+}
+
+void HTMLDataGridColElement::setPrimary(bool primary)
+{
+    setAttribute(primaryAttr, primary ? "" : 0);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.h b/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.h
new file mode 100644
index 0000000..87133cc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef HTMLDataGridColElement_h
+#define HTMLDataGridColElement_h
+
+#include "HTMLElement.h"
+
+namespace WebCore {
+
+class HTMLDataGridColElement : public HTMLElement {
+public:
+    HTMLDataGridColElement(const QualifiedName&, Document*);
+
+    virtual HTMLTagStatus endTagRequirement() const { return TagStatusForbidden; }
+    virtual int tagPriority() const { return 0; }
+    
+    String label() const;
+    void setLabel(const String&);
+    
+    String type() const;
+    void setType(const String&);
+    
+    unsigned short sortable() const;
+    void setSortable(unsigned short);
+    
+    unsigned short sortDirection() const;
+    void setSortDirection(unsigned short);
+    
+    bool primary() const;
+    void setPrimary(bool);
+};
+
+} // namespace WebCore
+
+#endif // HTMLDataGridColElement_h
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.idl
new file mode 100644
index 0000000..c72751c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridColElement.idl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+
+    interface [
+        GenerateConstructor
+    ] HTMLDataGridColElement : HTMLElement {
+        attribute DOMString label; // The text to display in the column.
+        attribute DOMString type; // The type of data displayed in this column.
+
+        attribute unsigned short sortable; // Whether or not the column can be sorted.  Values are none, ascending/descending, and ascending/descending/na
+        attribute unsigned short sortDirection; // The sort direction for the column.  Valid values are ascending, descending and natural (no sort applied).
+    
+        attribute boolean primary; // Whether or not this is the primary column of the tree (this will be where the disclosure triangle and connecting tree lines will display)
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.cpp
new file mode 100644
index 0000000..2d9f852
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.cpp
@@ -0,0 +1,104 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "HTMLDataGridElement.h"
+
+#include "HTMLNames.h"
+#include "RenderDataGrid.h"
+#include "Text.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+HTMLDataGridElement::HTMLDataGridElement(const QualifiedName& tagName, Document* document)
+    : HTMLElement(tagName, document)
+    , m_initializationTimer(this, &HTMLDataGridElement::initializationTimerFired)
+{
+    m_columns = DataGridColumnList::create();
+}
+
+HTMLDataGridElement::~HTMLDataGridElement()
+{
+}
+
+bool HTMLDataGridElement::checkDTD(const Node* newChild)
+{
+    if (newChild->isTextNode())
+        return static_cast<const Text*>(newChild)->containsOnlyWhitespace();
+    return newChild->hasTagName(dcolTag) || newChild->hasTagName(drowTag);
+}
+
+RenderObject* HTMLDataGridElement::createRenderer(RenderArena* arena, RenderStyle*)
+{
+    return new (arena) RenderDataGrid(this);
+}
+
+bool HTMLDataGridElement::autofocus() const
+{
+    return hasAttribute(autofocusAttr);
+}
+
+void HTMLDataGridElement::setAutofocus(bool autofocus)
+{
+    setAttribute(autofocusAttr, autofocus ? "" : 0);
+}
+
+bool HTMLDataGridElement::disabled() const
+{
+    return hasAttribute(disabledAttr);
+}
+
+void HTMLDataGridElement::setDisabled(bool disabled)
+{
+    setAttribute(disabledAttr, disabled ? "" : 0);
+}
+
+bool HTMLDataGridElement::multiple() const
+{
+    return hasAttribute(multipleAttr);
+}
+
+void HTMLDataGridElement::setMultiple(bool multiple)
+{
+    setAttribute(multipleAttr, multiple ? "" : 0);
+}
+
+void HTMLDataGridElement::setDataSource(PassRefPtr<DataGridDataSource> dataSource)
+{
+    if (m_initializationTimer.isActive())
+        m_initializationTimer.stop();
+
+    m_dataSource = dataSource;
+    m_initializationTimer.startOneShot(0);
+}
+
+void HTMLDataGridElement::initializationTimerFired(Timer<HTMLDataGridElement>*)
+{
+    m_dataSource->initialize(this);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.h b/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.h
new file mode 100644
index 0000000..646c97e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.h
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef HTMLDataGridElement_h
+#define HTMLDataGridElement_h
+
+#include "DataGridColumnList.h"
+#include "DataGridDataSource.h"
+#include "HTMLElement.h"
+#include "Timer.h"
+
+namespace WebCore {
+
+class HTMLDataGridElement : public HTMLElement {
+public:
+    HTMLDataGridElement(const QualifiedName&, Document*);
+    virtual ~HTMLDataGridElement();
+
+    virtual int tagPriority() const { return 6; } // Same as <select>s
+    virtual bool checkDTD(const Node*);
+
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+
+    bool autofocus() const;
+    void setAutofocus(bool);
+
+    bool disabled() const;
+    void setDisabled(bool);
+
+    bool multiple() const;
+    void setMultiple(bool);
+
+    void setDataSource(PassRefPtr<DataGridDataSource>);
+    DataGridDataSource* dataSource() const { return m_dataSource.get(); }
+
+    DataGridColumnList* columns() const { return m_columns.get(); }
+
+private:
+    void initializationTimerFired(Timer<HTMLDataGridElement>*);
+
+    Timer<HTMLDataGridElement> m_initializationTimer;
+    RefPtr<DataGridDataSource> m_dataSource;
+
+    RefPtr<DataGridColumnList> m_columns;
+};
+
+} // namespace WebCore
+
+#endif // HTMLDataGridElement_h
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.idl
new file mode 100644
index 0000000..b4b0897
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridElement.idl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+
+    interface [
+        GenerateConstructor
+    ] HTMLDataGridElement : HTMLElement {
+        attribute [Custom] DataGridDataSource dataSource;
+
+        readonly attribute DataGridColumnList columns;
+
+        attribute boolean autofocus; // Whether or not the datagrid should autofocus.
+        attribute boolean disabled; // Whether or not the datagrid can be interacted with.
+        attribute boolean multiple; // Whether or not the datagrid supports multiple selection.
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.cpp
new file mode 100644
index 0000000..e671806
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "HTMLDataGridRowElement.h"
+
+#include "HTMLNames.h"
+#include "Text.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+HTMLDataGridRowElement::HTMLDataGridRowElement(const QualifiedName& name, Document* doc)
+    : HTMLElement(name, doc)
+{
+}
+
+bool HTMLDataGridRowElement::checkDTD(const Node* newChild)
+{
+    if (newChild->isTextNode())
+        return static_cast<const Text*>(newChild)->containsOnlyWhitespace();
+    return newChild->hasTagName(drowTag) || newChild->hasTagName(dcellTag);
+}
+
+bool HTMLDataGridRowElement::selected() const
+{
+    return hasAttribute(selectedAttr);
+}
+
+void HTMLDataGridRowElement::setSelected(bool selected)
+{
+    setAttribute(selectedAttr, selected ? "" : 0);
+}
+
+bool HTMLDataGridRowElement::focused() const
+{
+    return hasAttribute(focusedAttr);
+}
+
+void HTMLDataGridRowElement::setFocused(bool focused)
+{
+    setAttribute(focusedAttr, focused ? "" : 0);
+}
+
+bool HTMLDataGridRowElement::expanded() const
+{
+    return hasAttribute(expandedAttr);
+}
+
+void HTMLDataGridRowElement::setExpanded(bool expanded)
+{
+    setAttribute(expandedAttr, expanded ? "" : 0);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.h b/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.h
new file mode 100644
index 0000000..d911db2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef HTMLDataGridRowElement_h
+#define HTMLDataGridRowElement_h
+
+#include "HTMLElement.h"
+
+namespace WebCore {
+
+class HTMLDataGridRowElement : public HTMLElement {
+public:
+    HTMLDataGridRowElement(const QualifiedName&, Document*);
+
+    virtual int tagPriority() const { return 2; } // Same as <option>s.
+    virtual bool checkDTD(const Node*);
+
+    bool selected() const;
+    void setSelected(bool);
+    
+    bool focused() const;
+    void setFocused(bool);
+    
+    bool expanded() const;
+    void setExpanded(bool);
+};
+
+} // namespace WebCore
+
+#endif // HTMLDataGridRowElement_h
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.idl
new file mode 100644
index 0000000..4aeb4d5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDataGridRowElement.idl
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2009 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module html {
+
+    interface [
+        GenerateConstructor
+    ] HTMLDataGridRowElement : HTMLElement {
+        attribute boolean selected; // Whether or not the row is currently selected.
+        attribute boolean focused; // Whether or not the row is the current object in the tree for keyboard navigation (or as the principal item of a multiple selection).
+        
+        attribute boolean expanded; // Whether or not the row is open (if it is, child rows will be shown).
+    };
+
+}
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDivElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLDivElement.cpp
index 7ffccd7..bd7195e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDivElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDivElement.cpp
@@ -19,12 +19,14 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "HTMLDivElement.h"
 
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp b/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp
index 04716bf..5867f0e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDocument.cpp
@@ -421,5 +421,11 @@ void HTMLDocument::clear()
     // We've long had a comment saying that IE doesn't support this.
     // But I do see it in the documentation for Mozilla.
 }
-    
+
+bool HTMLDocument::isFrameSet() const
+{
+    HTMLElement* bodyElement = body();
+    return bodyElement && bodyElement->renderer() && bodyElement->hasTagName(framesetTag);
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDocument.h b/src/3rdparty/webkit/WebCore/html/HTMLDocument.h
index de84c70..ab5da50 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDocument.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDocument.h
@@ -88,6 +88,7 @@ protected:
 
 private:
     virtual bool isHTMLDocument() const { return true; }
+    virtual bool isFrameSet() const;
     virtual Tokenizer* createTokenizer();
     virtual void determineParseMode();
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLDocument.idl b/src/3rdparty/webkit/WebCore/html/HTMLDocument.idl
index 4345195..3dd7a07 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLDocument.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLDocument.idl
@@ -37,7 +37,7 @@ module html {
 
         // Extensions
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // FIXME: This should eventually be available (if they are wanted) for all languages.
                  attribute [Custom, Deletable] HTMLCollection all;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp
index 4caf336..5655df8 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLElement.cpp
@@ -2,6 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -32,12 +33,15 @@
 #include "ExceptionCode.h"
 #include "Frame.h"
 #include "HTMLBRElement.h"
+#include "HTMLCollection.h"
 #include "HTMLDocument.h"
 #include "HTMLElementFactory.h"
 #include "HTMLFormElement.h"
 #include "HTMLNames.h"
-#include "HTMLTokenizer.h" // parseHTMLDocumentFragment
+#include "HTMLTokenizer.h"
+#include "MappedAttribute.h"
 #include "RenderWordBreak.h"
+#include "ScriptEventListener.h"
 #include "Settings.h"
 #include "Text.h"
 #include "TextIterator.h"
@@ -65,7 +69,8 @@ String HTMLElement::nodeName() const
 {
     // FIXME: Would be nice to have an atomicstring lookup based off uppercase chars that does not have to copy
     // the string on a hit in the hash.
-    if (document()->isHTMLDocument())
+    // FIXME: We should have a way to detect XHTML elements and replace the hasPrefix() check with it.
+    if (document()->isHTMLDocument() && !tagQName().hasPrefix())
         return tagQName().localName().string().upper();
     return Element::nodeName();
 }
@@ -96,23 +101,6 @@ int HTMLElement::tagPriority() const
     return 1;
 }
 
-PassRefPtr<Node> HTMLElement::cloneNode(bool deep)
-{
-    RefPtr<HTMLElement> clone = HTMLElementFactory::createHTMLElement(tagQName(), document(), 0, false);
-    if (!clone)
-        return 0;
-
-    if (namedAttrMap)
-        clone->attributes()->setAttributes(*namedAttrMap);
-
-    clone->copyNonAttributeProperties(this);
-
-    if (deep)
-        cloneChildNodes(clone.get());
-
-    return clone.release();
-}
-
 bool HTMLElement::mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const
 {
     if (attrName == alignAttr ||
@@ -158,75 +146,77 @@ void HTMLElement::parseMappedAttribute(MappedAttribute *attr)
     }
 // standard events
     else if (attr->name() == onclickAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().clickEvent, attr);
+        setAttributeEventListener(eventNames().clickEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == oncontextmenuAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().contextmenuEvent, attr);
+        setAttributeEventListener(eventNames().contextmenuEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondblclickAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dblclickEvent, attr);
+        setAttributeEventListener(eventNames().dblclickEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onmousedownAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().mousedownEvent, attr);
+        setAttributeEventListener(eventNames().mousedownEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onmousemoveAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().mousemoveEvent, attr);
+        setAttributeEventListener(eventNames().mousemoveEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onmouseoutAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().mouseoutEvent, attr);
+        setAttributeEventListener(eventNames().mouseoutEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onmouseoverAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().mouseoverEvent, attr);
+        setAttributeEventListener(eventNames().mouseoverEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onmouseupAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().mouseupEvent, attr);
+        setAttributeEventListener(eventNames().mouseupEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onmousewheelAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().mousewheelEvent, attr);
+        setAttributeEventListener(eventNames().mousewheelEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onfocusAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().focusEvent, attr);
+        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onblurAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().blurEvent, attr);
+        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onkeydownAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().keydownEvent, attr);
+        setAttributeEventListener(eventNames().keydownEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onkeypressAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().keypressEvent, attr);
+        setAttributeEventListener(eventNames().keypressEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onkeyupAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().keyupEvent, attr);
+        setAttributeEventListener(eventNames().keyupEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onscrollAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().scrollEvent, attr);
+        setAttributeEventListener(eventNames().scrollEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onbeforecutAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().beforecutEvent, attr);
+        setAttributeEventListener(eventNames().beforecutEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == oncutAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().cutEvent, attr);
+        setAttributeEventListener(eventNames().cutEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onbeforecopyAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().beforecopyEvent, attr);
+        setAttributeEventListener(eventNames().beforecopyEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == oncopyAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().copyEvent, attr);
+        setAttributeEventListener(eventNames().copyEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onbeforepasteAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().beforepasteEvent, attr);
+        setAttributeEventListener(eventNames().beforepasteEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onpasteAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().pasteEvent, attr);
+        setAttributeEventListener(eventNames().pasteEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondragenterAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dragenterEvent, attr);
+        setAttributeEventListener(eventNames().dragenterEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondragoverAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dragoverEvent, attr);
+        setAttributeEventListener(eventNames().dragoverEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondragleaveAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dragleaveEvent, attr);
+        setAttributeEventListener(eventNames().dragleaveEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondropAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dropEvent, attr);
+        setAttributeEventListener(eventNames().dropEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondragstartAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dragstartEvent, attr);
+        setAttributeEventListener(eventNames().dragstartEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondragAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dragEvent, attr);
+        setAttributeEventListener(eventNames().dragEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == ondragendAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().dragendEvent, attr);
+        setAttributeEventListener(eventNames().dragendEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onselectstartAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().selectstartEvent, attr);
+        setAttributeEventListener(eventNames().selectstartEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onsubmitAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().submitEvent, attr);
+        setAttributeEventListener(eventNames().submitEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onerrorAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().errorEvent, attr);
+        setAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onwebkitanimationstartAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().webkitAnimationStartEvent, attr);
+        setAttributeEventListener(eventNames().webkitAnimationStartEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onwebkitanimationiterationAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().webkitAnimationIterationEvent, attr);
+        setAttributeEventListener(eventNames().webkitAnimationIterationEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onwebkitanimationendAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().webkitAnimationEndEvent, attr);
+        setAttributeEventListener(eventNames().webkitAnimationEndEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onwebkittransitionendAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().webkitTransitionEndEvent, attr);
+        setAttributeEventListener(eventNames().webkitTransitionEndEvent, createAttributeEventListener(this, attr));
+    } else if (attr->name() == oninputAttr) {
+        setAttributeEventListener(eventNames().inputEvent, createAttributeEventListener(this, attr));
     }
 }
 
@@ -401,7 +391,7 @@ void HTMLElement::setInnerText(const String& text, ExceptionCode& ec)
     }
 
     // FIXME: Do we need to be able to detect preserveNewline style even when there's no renderer?
-    // FIXME: Can the renderer be out of date here? Do we need to call updateRendering?
+    // FIXME: Can the renderer be out of date here? Do we need to call updateStyleIfNeeded?
     // For example, for the contents of textarea elements that are display:none?
     RenderObject* r = renderer();
     if (r && r->style()->preserveNewline()) {
@@ -618,7 +608,7 @@ bool HTMLElement::isContentEditable() const
 
     // FIXME: this is a terrible thing to do here:
     // https://bugs.webkit.org/show_bug.cgi?id=21834
-    document()->updateRendering();
+    document()->updateStyleIfNeeded();
 
     if (!renderer()) {
         if (parentNode())
@@ -635,7 +625,7 @@ bool HTMLElement::isContentRichlyEditable() const
     if (document()->frame() && document()->frame()->isContentEditable())
         return true;
 
-    document()->updateRendering();
+    document()->updateStyleIfNeeded();
 
     if (!renderer()) {
         if (parentNode())
@@ -649,7 +639,7 @@ bool HTMLElement::isContentRichlyEditable() const
 
 String HTMLElement::contentEditable() const 
 {
-    document()->updateRendering();
+    document()->updateStyleIfNeeded();
 
     if (!renderer())
         return "false";
@@ -784,7 +774,7 @@ void HTMLElement::setTabIndex(int value)
 
 PassRefPtr<HTMLCollection> HTMLElement::children()
 {
-    return HTMLCollection::create(this, HTMLCollection::NodeChildren);
+    return HTMLCollection::create(this, NodeChildren);
 }
 
 // DOM Section 1.1.1
@@ -829,7 +819,7 @@ bool HTMLElement::isRecognizedTagName(const QualifiedName& tagName)
 
 // The terms inline and block are used here loosely.  Don't make the mistake of assuming all inlines or all blocks
 // need to be in these two lists.
-HashSet<AtomicStringImpl*>* inlineTagList()
+static HashSet<AtomicStringImpl*>* inlineTagList()
 {
     DEFINE_STATIC_LOCAL(HashSet<AtomicStringImpl*>, tagList, ());
     if (tagList.isEmpty()) {
@@ -873,6 +863,7 @@ HashSet<AtomicStringImpl*>* inlineTagList()
         tagList.add(inputTag.localName().impl());
         tagList.add(keygenTag.localName().impl());
         tagList.add(selectTag.localName().impl());
+        tagList.add(datagridTag.localName().impl());
         tagList.add(textareaTag.localName().impl());
         tagList.add(labelTag.localName().impl());
         tagList.add(buttonTag.localName().impl());
@@ -888,7 +879,7 @@ HashSet<AtomicStringImpl*>* inlineTagList()
     return &tagList;
 }
 
-HashSet<AtomicStringImpl*>* blockTagList()
+static HashSet<AtomicStringImpl*>* blockTagList()
 {
     DEFINE_STATIC_LOCAL(HashSet<AtomicStringImpl*>, tagList, ());
     if (tagList.isEmpty()) {
@@ -937,8 +928,18 @@ bool HTMLElement::inEitherTagList(const Node* newChild)
         
     if (newChild->isHTMLElement()) {
         const HTMLElement* child = static_cast<const HTMLElement*>(newChild);
-        if (inlineTagList()->contains(child->tagQName().localName().impl()))
+        if (inlineTagList()->contains(child->tagQName().localName().impl())) {
+#if PLATFORM(MAC)
+            if (child->tagQName().localName() == styleTag) {
+                // Leopard Mail doesn't expect <style> to be in the body of the document, so don't allow it in that case.
+                // See <rdar://problem/6621310>
+                Settings* settings = newChild->document() ? newChild->document()->settings() : 0;
+                if (settings && settings->needsLeopardMailQuirks())
+                    return false;
+            }
+#endif
             return true;
+        }
         if (blockTagList()->contains(child->tagQName().localName().impl()))
             return true;
         return !isRecognizedTagName(child->tagQName()); // Accept custom html tags
@@ -984,12 +985,14 @@ bool HTMLElement::checkDTD(const Node* newChild)
     
 bool HTMLElement::rendererIsNeeded(RenderStyle *style)
 {
+#if !ENABLE(XHTMLMP)
     if (hasLocalName(noscriptTag)) {
         Settings* settings = document()->settings();
         if (settings && settings->isJavaScriptEnabled())
             return false;
     }
-    return (document()->documentElement() == this) || (style->display() != NONE);
+#endif
+    return StyledElement::rendererIsNeeded(style);
 }
     
 RenderObject* HTMLElement::createRenderer(RenderArena* arena, RenderStyle* style)
@@ -1015,6 +1018,10 @@ HTMLFormElement* HTMLElement::virtualForm() const
 } // namespace WebCore
 
 #ifndef NDEBUG
+
+// For use in the debugger
+void dumpInnerHTML(WebCore::HTMLElement*);
+
 void dumpInnerHTML(WebCore::HTMLElement* element)
 {
     printf("%s\n", element->innerHTML().ascii().data());
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLElement.h b/src/3rdparty/webkit/WebCore/html/HTMLElement.h
index 59ccde7..60152cd 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLElement.h
@@ -45,8 +45,6 @@ public:
     virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
     virtual void parseMappedAttribute(MappedAttribute*);
 
-    virtual PassRefPtr<Node> cloneNode(bool deep);
-
     PassRefPtr<HTMLCollection> children();
     
     String id() const;
@@ -85,8 +83,6 @@ public:
 
     virtual void accessKeyAction(bool sendToAnyElement);
 
-    virtual bool isGenericFormElement() const { return false; }
-
     virtual HTMLTagStatus endTagRequirement() const;
     virtual int tagPriority() const;
     virtual bool childAllowed(Node* newChild); // Error-checking during parsing that checks the DTD
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLElement.idl
index 8ce5542..38f960a 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLElement.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -29,15 +29,13 @@ module html {
     ] HTMLElement : Element {
                  // iht.com relies on id returning the empty string when no id is present. 
                  // Other browsers do this as well. So we don't convert null to JS null.
-                 attribute [ConvertNullToNullString] DOMString id;
-                 attribute [ConvertNullToNullString] DOMString title;
-                 attribute [ConvertNullToNullString] DOMString lang;
-                 attribute [ConvertNullToNullString] DOMString dir;
-                 attribute [ConvertNullToNullString] DOMString className;
+                 attribute [ConvertNullToNullString, Reflect] DOMString id;
+                 attribute [ConvertNullToNullString, Reflect] DOMString title;
+                 attribute [ConvertNullToNullString, Reflect] DOMString lang;
+                 attribute [ConvertNullToNullString, Reflect] DOMString dir;
+                 attribute [ConvertNullToNullString, Reflect=class] DOMString className;
 
                  attribute long            tabIndex;
-                 void                      blur();
-                 void                      focus();
 
         // Extensions
                  attribute [ConvertNullToNullString] DOMString innerHTML
@@ -64,7 +62,7 @@ module html {
                  attribute [ConvertNullToNullString] DOMString contentEditable;
         readonly attribute boolean isContentEditable;
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute DOMString titleDisplayString;
 #endif
     };
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLElementFactory.cpp b/src/3rdparty/webkit/WebCore/html/HTMLElementFactory.cpp
deleted file mode 100644
index c7fee28..0000000
--- a/src/3rdparty/webkit/WebCore/html/HTMLElementFactory.cpp
+++ /dev/null
@@ -1,509 +0,0 @@
-/*
- * This file is part of the HTML DOM implementation for KDE.
- *
- * Copyright (C) 2005 Apple Computer, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "HTMLElementFactory.h"
-
-#include "HTMLAnchorElement.h"
-#include "HTMLAppletElement.h"
-#include "HTMLAreaElement.h"
-#include "HTMLAudioElement.h"
-#include "HTMLBRElement.h"
-#include "HTMLBaseElement.h"
-#include "HTMLBaseFontElement.h"
-#include "HTMLBlockquoteElement.h"
-#include "HTMLBodyElement.h"
-#include "HTMLButtonElement.h"
-#include "HTMLCanvasElement.h"
-#include "HTMLDListElement.h"
-#include "HTMLDirectoryElement.h"
-#include "HTMLDivElement.h"
-#include "HTMLDocument.h"
-#include "HTMLEmbedElement.h"
-#include "HTMLFieldSetElement.h"
-#include "HTMLFontElement.h"
-#include "HTMLFormElement.h"
-#include "HTMLFrameElement.h"
-#include "HTMLFrameSetElement.h"
-#include "HTMLHRElement.h"
-#include "HTMLHeadElement.h"
-#include "HTMLHeadingElement.h"
-#include "HTMLHtmlElement.h"
-#include "HTMLIFrameElement.h"
-#include "HTMLImageElement.h"
-#include "HTMLIsIndexElement.h"
-#include "HTMLKeygenElement.h"
-#include "HTMLLIElement.h"
-#include "HTMLLabelElement.h"
-#include "HTMLLegendElement.h"
-#include "HTMLLinkElement.h"
-#include "HTMLMapElement.h"
-#include "HTMLMarqueeElement.h"
-#include "HTMLMenuElement.h"
-#include "HTMLMetaElement.h"
-#include "HTMLModElement.h"
-#include "HTMLNames.h"
-#include "HTMLOListElement.h"
-#include "HTMLObjectElement.h"
-#include "HTMLOptGroupElement.h"
-#include "HTMLOptionElement.h"
-#include "HTMLParagraphElement.h"
-#include "HTMLParamElement.h"
-#include "HTMLPreElement.h"
-#include "HTMLQuoteElement.h"
-#include "HTMLScriptElement.h"
-#include "HTMLSelectElement.h"
-#include "HTMLSourceElement.h"
-#include "HTMLStyleElement.h"
-#include "HTMLTableCaptionElement.h"
-#include "HTMLTableCellElement.h"
-#include "HTMLTableColElement.h"
-#include "HTMLTableElement.h"
-#include "HTMLTableRowElement.h"
-#include "HTMLTableSectionElement.h"
-#include "HTMLTextAreaElement.h"
-#include "HTMLTitleElement.h"
-#include "HTMLUListElement.h"
-#include "HTMLVideoElement.h"
-
-namespace WebCore {
-
-using namespace HTMLNames;
-
-typedef PassRefPtr<HTMLElement> (*ConstructorFunc)(const QualifiedName& tagName, Document*, HTMLFormElement*, bool createdByParser);
-typedef HashMap<AtomicStringImpl*, ConstructorFunc> FunctionMap;
-static FunctionMap* gFunctionMap;
-
-static PassRefPtr<HTMLElement> htmlConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLHtmlElement(htmlTag, doc);
-}
-
-static PassRefPtr<HTMLElement> headConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLHeadElement(headTag, doc);
-}
-
-static PassRefPtr<HTMLElement> bodyConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLBodyElement(bodyTag, doc);
-}
-
-static PassRefPtr<HTMLElement> baseConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLBaseElement(baseTag, doc);
-}
-
-static PassRefPtr<HTMLElement> linkConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool createdByParser)
-{
-    return new HTMLLinkElement(linkTag, doc, createdByParser);
-}
-
-static PassRefPtr<HTMLElement> metaConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLMetaElement(metaTag, doc);
-}
-
-static PassRefPtr<HTMLElement> styleConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool createdByParser)
-{
-    return new HTMLStyleElement(styleTag, doc, createdByParser);
-}
-
-static PassRefPtr<HTMLElement> titleConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLTitleElement(titleTag, doc);
-}
-
-static PassRefPtr<HTMLElement> frameConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool createdByParser)
-{
-    return new HTMLFrameElement(frameTag, doc, createdByParser);
-}
-
-static PassRefPtr<HTMLElement> framesetConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLFrameSetElement(framesetTag, doc);
-}
-
-static PassRefPtr<HTMLElement> iframeConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool createdByParser)
-{
-    return new HTMLIFrameElement(iframeTag, doc, createdByParser);
-}
-
-static PassRefPtr<HTMLElement> formConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLFormElement(formTag, doc);
-}
-
-static PassRefPtr<HTMLElement> buttonConstructor(const QualifiedName&, Document* doc, HTMLFormElement* form, bool)
-{
-    return new HTMLButtonElement(buttonTag, doc, form);
-}
-
-static PassRefPtr<HTMLElement> inputConstructor(const QualifiedName&, Document* doc, HTMLFormElement* form, bool)
-{
-    return new HTMLInputElement(inputTag, doc, form);
-}
-
-static PassRefPtr<HTMLElement> isindexConstructor(const QualifiedName&, Document* doc, HTMLFormElement* form, bool)
-{
-    return new HTMLIsIndexElement(isindexTag, doc, form);
-}
-
-static PassRefPtr<HTMLElement> fieldsetConstructor(const QualifiedName&, Document* doc, HTMLFormElement* form, bool)
-{
-    return new HTMLFieldSetElement(fieldsetTag, doc, form);
-}
-
-static PassRefPtr<HTMLElement> keygenConstructor(const QualifiedName&, Document* doc, HTMLFormElement* form, bool)
-{
-    return new HTMLKeygenElement(keygenTag, doc, form);
-}
-
-static PassRefPtr<HTMLElement> labelConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLLabelElement(labelTag, doc);
-}
-
-static PassRefPtr<HTMLElement> legendConstructor(const QualifiedName&, Document* doc, HTMLFormElement* form, bool)
-{
-    return new HTMLLegendElement(legendTag, doc, form);
-}
-
-static PassRefPtr<HTMLElement> optgroupConstructor(const QualifiedName&, Document* doc, HTMLFormElement* form, bool)
-{
-    return new HTMLOptGroupElement(optgroupTag, doc, form);
-}
-
-static PassRefPtr<HTMLElement> optionConstructor(const QualifiedName&, Document* doc, HTMLFormElement* form, bool)
-{
-    return new HTMLOptionElement(optionTag, doc, form);
-}
-
-static PassRefPtr<HTMLElement> selectConstructor(const QualifiedName&, Document* doc, HTMLFormElement* form, bool)
-{
-    return new HTMLSelectElement(selectTag, doc, form);
-}
-
-static PassRefPtr<HTMLElement> textareaConstructor(const QualifiedName&, Document* doc, HTMLFormElement* form, bool)
-{
-    return new HTMLTextAreaElement(textareaTag, doc, form);
-}
-
-static PassRefPtr<HTMLElement> dlConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLDListElement(dlTag, doc);
-}
-
-static PassRefPtr<HTMLElement> ulConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLUListElement(ulTag, doc);
-}
-
-static PassRefPtr<HTMLElement> olConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLOListElement(olTag, doc);
-}
-
-static PassRefPtr<HTMLElement> dirConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLDirectoryElement(dirTag, doc);
-}
-
-static PassRefPtr<HTMLElement> menuConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLMenuElement(menuTag, doc);
-}
-
-static PassRefPtr<HTMLElement> liConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLLIElement(liTag, doc);
-}
-
-static PassRefPtr<HTMLElement> blockquoteConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLBlockquoteElement(blockquoteTag, doc);
-}
-
-static PassRefPtr<HTMLElement> divConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLDivElement(divTag, doc);
-}
-
-static PassRefPtr<HTMLElement> headingConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLHeadingElement(tagName, doc);
-}
-
-static PassRefPtr<HTMLElement> hrConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLHRElement(hrTag, doc);
-}
-
-static PassRefPtr<HTMLElement> paragraphConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLParagraphElement(pTag, doc);
-}
-
-static PassRefPtr<HTMLElement> preConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLPreElement(tagName, doc);
-}
-
-static PassRefPtr<HTMLElement> basefontConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLBaseFontElement(basefontTag, doc);
-}
-
-static PassRefPtr<HTMLElement> fontConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLFontElement(fontTag, doc);
-}
-
-static PassRefPtr<HTMLElement> modConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLModElement(tagName, doc);
-}
-
-static PassRefPtr<HTMLElement> anchorConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLAnchorElement(aTag, doc);
-}
-
-static PassRefPtr<HTMLElement> imageConstructor(const QualifiedName&, Document* doc, HTMLFormElement* form, bool)
-{
-    return new HTMLImageElement(imgTag, doc, form);
-}
-
-static PassRefPtr<HTMLElement> mapConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLMapElement(mapTag, doc);
-}
-
-static PassRefPtr<HTMLElement> areaConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLAreaElement(areaTag, doc);
-}
-
-static PassRefPtr<HTMLElement> canvasConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLCanvasElement(canvasTag, doc);
-}
-
-static PassRefPtr<HTMLElement> appletConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLAppletElement(appletTag, doc);
-}
-
-static PassRefPtr<HTMLElement> embedConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLEmbedElement(embedTag, doc);
-}
-
-static PassRefPtr<HTMLElement> objectConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool createdByParser)
-{
-    return new HTMLObjectElement(objectTag, doc, createdByParser);
-}
-
-static PassRefPtr<HTMLElement> paramConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLParamElement(paramTag, doc);
-}
-
-static PassRefPtr<HTMLElement> scriptConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool createdByParser)
-{
-    return new HTMLScriptElement(scriptTag, doc, createdByParser);
-}
-
-static PassRefPtr<HTMLElement> tableConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLTableElement(tableTag, doc);
-}
-
-static PassRefPtr<HTMLElement> tableCaptionConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLTableCaptionElement(captionTag, doc);
-}
-
-static PassRefPtr<HTMLElement> tableColConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLTableColElement(tagName, doc);
-}
-
-static PassRefPtr<HTMLElement> tableRowConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLTableRowElement(trTag, doc);
-}
-
-static PassRefPtr<HTMLElement> tableCellConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLTableCellElement(tagName, doc);
-}
-
-static PassRefPtr<HTMLElement> tableSectionConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLTableSectionElement(tagName, doc);
-}
-
-static PassRefPtr<HTMLElement> brConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLBRElement(brTag, doc);
-}
-
-static PassRefPtr<HTMLElement> quoteConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLQuoteElement(qTag, doc);
-}
-
-static PassRefPtr<HTMLElement> marqueeConstructor(const QualifiedName&, Document* doc, HTMLFormElement*, bool)
-{
-    return new HTMLMarqueeElement(marqueeTag, doc);
-}
-
-#if ENABLE(VIDEO)
-static PassRefPtr<HTMLElement> audioConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
-{
-    if (!MediaPlayer::isAvailable())
-        return new HTMLElement(tagName, doc);
-    return new HTMLAudioElement(audioTag, doc);
-}
-
-static PassRefPtr<HTMLElement> videoConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
-{
-    if (!MediaPlayer::isAvailable())
-        return new HTMLElement(tagName, doc);
-    return new HTMLVideoElement(videoTag, doc);
-}
-
-static PassRefPtr<HTMLElement> sourceConstructor(const QualifiedName& tagName, Document* doc, HTMLFormElement*, bool)
-{
-    if (!MediaPlayer::isAvailable())
-        return new HTMLElement(tagName, doc);
-    return new HTMLSourceElement(sourceTag, doc);
-}
-#endif
-
-static void addTag(const QualifiedName& tag, ConstructorFunc func)
-{
-    gFunctionMap->set(tag.localName().impl(), func);
-}
-
-static void createFunctionMap()
-{
-    // Create the table.
-    gFunctionMap = new FunctionMap;
-    
-    // Populate it with constructor functions.
-    addTag(aTag, anchorConstructor);
-    addTag(appletTag, appletConstructor);
-    addTag(areaTag, areaConstructor);
-    addTag(baseTag, baseConstructor);
-    addTag(basefontTag, basefontConstructor);
-    addTag(blockquoteTag, blockquoteConstructor);
-    addTag(bodyTag, bodyConstructor);
-    addTag(brTag, brConstructor);
-    addTag(buttonTag, buttonConstructor);
-    addTag(canvasTag, canvasConstructor);
-    addTag(captionTag, tableCaptionConstructor);
-    addTag(colTag, tableColConstructor);
-    addTag(colgroupTag, tableColConstructor);
-    addTag(delTag, modConstructor);
-    addTag(dirTag, dirConstructor);
-    addTag(divTag, divConstructor);
-    addTag(dlTag, dlConstructor);
-    addTag(embedTag, embedConstructor);
-    addTag(fieldsetTag, fieldsetConstructor);
-    addTag(fontTag, fontConstructor);
-    addTag(formTag, formConstructor);
-    addTag(frameTag, frameConstructor);
-    addTag(framesetTag, framesetConstructor);
-    addTag(h1Tag, headingConstructor);
-    addTag(h2Tag, headingConstructor);
-    addTag(h3Tag, headingConstructor);
-    addTag(h4Tag, headingConstructor);
-    addTag(h5Tag, headingConstructor);
-    addTag(h6Tag, headingConstructor);
-    addTag(headTag, headConstructor);
-    addTag(hrTag, hrConstructor);
-    addTag(htmlTag, htmlConstructor);
-    addTag(iframeTag, iframeConstructor);
-    addTag(imageTag, imageConstructor);
-    addTag(imgTag, imageConstructor);
-    addTag(inputTag, inputConstructor);
-    addTag(insTag, modConstructor);
-    addTag(isindexTag, isindexConstructor);
-    addTag(keygenTag, keygenConstructor);
-    addTag(labelTag, labelConstructor);
-    addTag(legendTag, legendConstructor);
-    addTag(liTag, liConstructor);
-    addTag(linkTag, linkConstructor);
-    addTag(listingTag, preConstructor);
-    addTag(mapTag, mapConstructor);
-    addTag(marqueeTag, marqueeConstructor);
-    addTag(menuTag, menuConstructor);
-    addTag(metaTag, metaConstructor);
-    addTag(objectTag, objectConstructor);
-    addTag(olTag, olConstructor);
-    addTag(optgroupTag, optgroupConstructor);
-    addTag(optionTag, optionConstructor);
-    addTag(pTag, paragraphConstructor);
-    addTag(paramTag, paramConstructor);
-    addTag(preTag, preConstructor);
-    addTag(qTag, quoteConstructor);
-    addTag(scriptTag, scriptConstructor);
-    addTag(selectTag, selectConstructor);
-    addTag(styleTag, styleConstructor);
-    addTag(tableTag, tableConstructor);
-    addTag(tbodyTag, tableSectionConstructor);
-    addTag(tdTag, tableCellConstructor);
-    addTag(textareaTag, textareaConstructor);
-    addTag(tfootTag, tableSectionConstructor);
-    addTag(thTag, tableCellConstructor);
-    addTag(theadTag, tableSectionConstructor);
-    addTag(titleTag, titleConstructor);
-    addTag(trTag, tableRowConstructor);
-    addTag(ulTag, ulConstructor);
-    addTag(xmpTag, preConstructor);
-#if ENABLE(VIDEO)
-    addTag(audioTag, audioConstructor);
-    addTag(sourceTag, sourceConstructor);
-    addTag(videoTag, videoConstructor);
-#endif
-}
-
-PassRefPtr<HTMLElement> HTMLElementFactory::createHTMLElement(const QualifiedName& tagName, Document* doc, HTMLFormElement* form, bool createdByParser)
-{
-    if (!doc)
-        return 0; // Don't allow elements to ever be made without having a doc.
-
-    if (!gFunctionMap)
-        createFunctionMap();
-
-    ConstructorFunc func = gFunctionMap->get(tagName.localName().impl());
-    if (func)
-        return func(tagName, doc, form, createdByParser);
-
-    // elements with no special representation in the DOM
-    return new HTMLElement(tagName, doc);
-}
-
-}
-
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLElementFactory.h b/src/3rdparty/webkit/WebCore/html/HTMLElementFactory.h
deleted file mode 100644
index 539d070..0000000
--- a/src/3rdparty/webkit/WebCore/html/HTMLElementFactory.h
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * This file is part of the HTML DOM implementation for KDE.
- *
- * Copyright (C) 2005, 2006 Apple Computer, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef HTMLElementFactory_h
-#define HTMLElementFactory_h
-
-#include <wtf/Forward.h>
-
-namespace WebCore {
-
-class AtomicString;
-class Document;
-class Element;
-class HTMLElement;
-class HTMLFormElement;
-class QualifiedName;
-
-// The idea behind this class is that there will eventually be a mapping from namespace URIs to ElementFactories that can dispense elements.
-// In a compound document world, the generic createElement function (will end up being virtual) will be called.
-class HTMLElementFactory {
-public:
-    PassRefPtr<Element> createElement(const QualifiedName&, Document*, bool createdByParser = true);
-    static PassRefPtr<HTMLElement> createHTMLElement(const QualifiedName& tagName, Document*, HTMLFormElement* = 0, bool createdByParser = true);
-};
-
-}
-
-#endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLElementsAllInOne.cpp b/src/3rdparty/webkit/WebCore/html/HTMLElementsAllInOne.cpp
new file mode 100644
index 0000000..f9c970a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLElementsAllInOne.cpp
@@ -0,0 +1,105 @@
+/*
+ * Copyright (c) 2009, Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ *       notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ *       copyright notice, this list of conditions and the following disclaimer
+ *       in the documentation and/or other materials provided with the
+ *       distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ *       contributors may be used to endorse or promote products derived from
+ *       this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// This source file coalesces the HTML elements into a single object file to
+// reduce bloat and allow us to link release builds on 32-bit Windows.
+
+#include "HTMLAnchorElement.cpp"
+#include "HTMLAppletElement.cpp"
+#include "HTMLAreaElement.cpp"
+#include "HTMLAudioElement.cpp"
+#include "HTMLBRElement.cpp"
+#include "HTMLBaseElement.cpp"
+#include "HTMLBaseFontElement.cpp"
+#include "HTMLBlockquoteElement.cpp"
+#include "HTMLBodyElement.cpp"
+#include "HTMLButtonElement.cpp"
+#include "HTMLCanvasElement.cpp"
+#include "HTMLDataGridElement.cpp"
+#include "HTMLDataGridCellElement.cpp"
+#include "HTMLDataGridColElement.cpp"
+#include "HTMLDataGridRowElement.cpp"
+#include "HTMLDListElement.cpp"
+#include "HTMLDirectoryElement.cpp"
+#include "HTMLDivElement.cpp"
+#include "HTMLElement.cpp"
+#include "HTMLEmbedElement.cpp"
+#include "HTMLFieldSetElement.cpp"
+#include "HTMLFontElement.cpp"
+#include "HTMLFormControlElement.cpp"
+#include "HTMLFormElement.cpp"
+#include "HTMLFrameElement.cpp"
+#include "HTMLFrameElementBase.cpp"
+#include "HTMLFrameOwnerElement.cpp"
+#include "HTMLFrameSetElement.cpp"
+#include "HTMLHRElement.cpp"
+#include "HTMLHeadElement.cpp"
+#include "HTMLHeadingElement.cpp"
+#include "HTMLHtmlElement.cpp"
+#include "HTMLIFrameElement.cpp"
+#include "HTMLImageElement.cpp"
+#include "HTMLInputElement.cpp"
+#include "HTMLIsIndexElement.cpp"
+#include "HTMLKeygenElement.cpp"
+#include "HTMLLIElement.cpp"
+#include "HTMLLabelElement.cpp"
+#include "HTMLLegendElement.cpp"
+#include "HTMLLinkElement.cpp"
+#include "HTMLMapElement.cpp"
+#include "HTMLMarqueeElement.cpp"
+#include "HTMLMediaElement.cpp"
+#include "HTMLMenuElement.cpp"
+#include "HTMLMetaElement.cpp"
+#include "HTMLModElement.cpp"
+#include "HTMLOListElement.cpp"
+#include "HTMLObjectElement.cpp"
+#include "HTMLOptGroupElement.cpp"
+#include "HTMLOptionElement.cpp"
+#include "HTMLParagraphElement.cpp"
+#include "HTMLParamElement.cpp"
+#include "HTMLPlugInElement.cpp"
+#include "HTMLPlugInImageElement.cpp"
+#include "HTMLPreElement.cpp"
+#include "HTMLQuoteElement.cpp"
+#include "HTMLScriptElement.cpp"
+#include "HTMLSelectElement.cpp"
+#include "HTMLSourceElement.cpp"
+#include "HTMLStyleElement.cpp"
+#include "HTMLTableCaptionElement.cpp"
+#include "HTMLTableCellElement.cpp"
+#include "HTMLTableColElement.cpp"
+#include "HTMLTableElement.cpp"
+#include "HTMLTablePartElement.cpp"
+#include "HTMLTableRowElement.cpp"
+#include "HTMLTableSectionElement.cpp"
+#include "HTMLTextAreaElement.cpp"
+#include "HTMLTitleElement.cpp"
+#include "HTMLUListElement.cpp"
+#include "HTMLVideoElement.cpp"
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.cpp
index 1af7147..2500dd6 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.cpp
@@ -31,10 +31,12 @@
 #include "HTMLImageLoader.h"
 #include "HTMLNames.h"
 #include "HTMLObjectElement.h"
+#include "MappedAttribute.h"
 #include "RenderImage.h"
 #include "RenderPartObject.h"
 #include "RenderWidget.h"
 #include "ScriptController.h"
+#include "Settings.h"
 
 namespace WebCore {
 
@@ -137,7 +139,15 @@ bool HTMLEmbedElement::rendererIsNeeded(RenderStyle* style)
         return false;
     }
 
-    return true;
+#if ENABLE(DASHBOARD_SUPPORT)
+    // Workaround for <rdar://problem/6642221>. 
+    if (Settings* settings = frame->settings()) {
+        if (settings->usesDashboardBackwardCompatibilityMode())
+            return true;
+    }
+#endif
+
+    return HTMLPlugInElement::rendererIsNeeded(style);
 }
 
 RenderObject* HTMLEmbedElement::createRenderer(RenderArena* arena, RenderStyle*)
@@ -164,13 +174,13 @@ void HTMLEmbedElement::attach()
         m_imageLoader->updateFromElement();
 
         if (renderer())
-            static_cast<RenderImage*>(renderer())->setCachedImage(m_imageLoader->image());
+            toRenderImage(renderer())->setCachedImage(m_imageLoader->image());
     }
 }
 
 void HTMLEmbedElement::updateWidget()
 {
-    document()->updateRendering();
+    document()->updateStyleIfNeeded();
     if (m_needWidgetUpdate && renderer() && !isImageType())
         static_cast<RenderPartObject*>(renderer())->updateWidget(true);
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.idl
index 10c3007..a38402c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLEmbedElement.idl
@@ -22,15 +22,15 @@ module html {
 
     interface [
         GenerateConstructor,
-        CustomPutFunction,
-        CustomGetOwnPropertySlot,
+        DelegatingPutFunction,
+        DelegatingGetOwnPropertySlot,
         CustomCall,
         HasOverridingNameGetter,
         InterfaceUUID=18f9bd58-6bb3-4b5c-aa30-6da13adfc91e,
         ImplementationUUID=93e0407a-8380-4ff0-978d-f773f2dee6a3
     ] HTMLEmbedElement : HTMLElement {
                  attribute [ConvertNullToNullString] DOMString align;
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
                  attribute [ConvertNullToNullString] DOMString height;
 #else
                  attribute [ConvertFromString] long height;
@@ -38,18 +38,20 @@ module html {
                  attribute [ConvertNullToNullString] DOMString name;
                  attribute [ConvertNullToNullString] DOMString src;
                  attribute [ConvertNullToNullString] DOMString type;
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
                  attribute [ConvertNullToNullString] DOMString width;
 #else
                  attribute [ConvertFromString] long width;
 #endif
 
-#if !defined(LANGUAGE_COM)
-#if ENABLE_SVG
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+#if defined(ENABLE_SVG) && ENABLE_SVG
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C || defined(ENABLE_SVG_DOM_OBJC_BINDINGS) && ENABLE_SVG_DOM_OBJC_BINDINGS
         [SVGCheckSecurityDocument] SVGDocument getSVGDocument()
             raises(DOMException);
 #endif
 #endif
+#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.cpp
index d90550d..eb8d4ed 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.cpp
@@ -53,7 +53,7 @@ bool HTMLFieldSetElement::isFocusable() const
     return HTMLElement::isFocusable();
 }
 
-const AtomicString& HTMLFieldSetElement::type() const
+const AtomicString& HTMLFieldSetElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, fieldset, ("fieldset"));
     return fieldset;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.h
index 9a6cff1..e79f2c5 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFieldSetElement.h
@@ -46,7 +46,7 @@ public:
 
     virtual bool isFocusable() const;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
 
     virtual bool willValidate() const { return false; }
 };
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFontElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFontElement.cpp
index 91b6448..d19032a 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFontElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFontElement.cpp
@@ -26,6 +26,7 @@
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 using namespace WTF;
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormCollection.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFormCollection.cpp
index 03796d6..812d98a 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormCollection.cpp
@@ -23,6 +23,7 @@
 #include "config.h"
 #include "HTMLFormCollection.h"
 
+#include "CollectionCache.h"
 #include "HTMLFormControlElement.h"
 #include "HTMLFormElement.h"
 #include "HTMLImageElement.h"
@@ -35,15 +36,15 @@ using namespace HTMLNames;
 // Since the collections are to be "live", we have to do the
 // calculation every time if anything has changed.
 
-inline HTMLCollection::CollectionInfo* HTMLFormCollection::formCollectionInfo(HTMLFormElement* form)
+inline CollectionCache* HTMLFormCollection::formCollectionInfo(HTMLFormElement* form)
 {
     if (!form->collectionInfo)
-        form->collectionInfo = new CollectionInfo;
+        form->collectionInfo = new CollectionCache;
     return form->collectionInfo;
 }
 
 HTMLFormCollection::HTMLFormCollection(PassRefPtr<HTMLFormElement> form)
-    : HTMLCollection(form.get(), Other, formCollectionInfo(form.get()))
+    : HTMLCollection(form.get(), OtherCollection, formCollectionInfo(form.get()))
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormCollection.h b/src/3rdparty/webkit/WebCore/html/HTMLFormCollection.h
index 524a59b..a204446 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormCollection.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormCollection.h
@@ -51,7 +51,7 @@ private:
     virtual void updateNameCache() const;
     virtual unsigned calcLength() const;
 
-    static CollectionInfo* formCollectionInfo(HTMLFormElement*);
+    static CollectionCache* formCollectionInfo(HTMLFormElement*);
 
     Element* getNamedItem(const QualifiedName& attrName, const AtomicString& name) const;
     Element* nextNamedItemInternal(const String& name) const;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp
index 28a77aa..b985e75 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.cpp
@@ -34,6 +34,8 @@
 #include "HTMLNames.h"
 #include "HTMLParser.h"
 #include "HTMLTokenizer.h"
+#include "MappedAttribute.h"
+#include "RenderBox.h"
 #include "RenderTheme.h"
 
 namespace WebCore {
@@ -67,17 +69,17 @@ void HTMLFormControlElement::parseMappedAttribute(MappedAttribute *attr)
         bool oldDisabled = m_disabled;
         m_disabled = !attr->isNull();
         if (oldDisabled != m_disabled) {
-            setChanged();
+            setNeedsStyleRecalc();
             if (renderer() && renderer()->style()->hasAppearance())
-                theme()->stateChanged(renderer(), EnabledState);
+                renderer()->theme()->stateChanged(renderer(), EnabledState);
         }
     } else if (attr->name() == readonlyAttr) {
         bool oldReadOnly = m_readOnly;
         m_readOnly = !attr->isNull();
         if (oldReadOnly != m_readOnly) {
-            setChanged();
+            setNeedsStyleRecalc();
             if (renderer() && renderer()->style()->hasAppearance())
-                theme()->stateChanged(renderer(), ReadOnlyState);
+                renderer()->theme()->stateChanged(renderer(), ReadOnlyState);
         }
     } else
         HTMLElement::parseMappedAttribute(attr);
@@ -98,8 +100,12 @@ void HTMLFormControlElement::attach()
     // Focus the element if it should honour its autofocus attribute.
     // We have to determine if the element is a TextArea/Input/Button/Select,
     // if input type hidden ignore autofocus. So if disabled or readonly.
-    if (autofocus() && renderer() && !document()->ignoreAutofocus() && !isReadOnlyControl() &&
-            ((hasTagName(inputTag) && !isInputTypeHidden()) || hasTagName(selectTag) ||
+    bool isInputTypeHidden = false;
+    if (hasTagName(inputTag))
+        isInputTypeHidden = static_cast<HTMLInputElement*>(this)->isInputTypeHidden();
+
+    if (autofocus() && renderer() && !document()->ignoreAutofocus() && !isReadOnlyFormControl() &&
+            ((hasTagName(inputTag) && !isInputTypeHidden) || hasTagName(selectTag) ||
               hasTagName(buttonTag) || hasTagName(textareaTag)))
          focus();
 }
@@ -146,7 +152,7 @@ void HTMLFormControlElement::removedFromTree(bool deep)
     HTMLElement::removedFromTree(deep);
 }
 
-const AtomicString& HTMLFormControlElement::name() const
+const AtomicString& HTMLFormControlElement::formControlName() const
 {
     const AtomicString& n = getAttribute(nameAttr);
     return n.isNull() ? emptyAtom : n;
@@ -157,9 +163,9 @@ void HTMLFormControlElement::setName(const AtomicString &value)
     setAttribute(nameAttr, value);
 }
 
-void HTMLFormControlElement::onChange()
+void HTMLFormControlElement::dispatchFormControlChangeEvent()
 {
-    dispatchEventForType(eventNames().changeEvent, true, false);
+    dispatchEvent(eventNames().changeEvent, true, false);
 }
 
 bool HTMLFormControlElement::disabled() const
@@ -199,7 +205,7 @@ bool HTMLFormControlElement::isFocusable() const
 {
     if (disabled() || !renderer() || 
         (renderer()->style() && renderer()->style()->visibility() != VISIBLE) || 
-        renderer()->width() == 0 || renderer()->height() == 0)
+        !renderer()->isBox() || toRenderBox(renderer())->size().isEmpty())
         return false;
     return true;
 }
@@ -233,7 +239,7 @@ bool HTMLFormControlElement::willValidate() const
     //      The control does not have a repetition template as an ancestor.
     //      The control does not have a datalist element as an ancestor.
     //      The control is not an output element.
-    return form() && name().length() && !disabled() && !isReadOnlyControl();
+    return form() && name().length() && !disabled() && !isReadOnlyFormControl();
 }
     
 bool HTMLFormControlElement::supportsFocus() const
@@ -257,7 +263,7 @@ void HTMLFormControlElement::removeFromForm()
 HTMLFormControlElementWithState::HTMLFormControlElementWithState(const QualifiedName& tagName, Document* doc, HTMLFormElement* f)
     : HTMLFormControlElement(tagName, doc, f)
 {
-    doc->registerFormElementWithState(this);
+    document()->registerFormElementWithState(this);
 }
 
 HTMLFormControlElementWithState::~HTMLFormControlElementWithState()
@@ -284,7 +290,7 @@ void HTMLFormControlElementWithState::finishParsingChildren()
     if (doc->hasStateForNewFormElements()) {
         String state;
         if (doc->takeStateForFormElement(name().impl(), type().impl(), state))
-            restoreState(state);
+            restoreFormControlState(state);
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h
index bdcc085..0a7bbd1 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormControlElement.h
@@ -24,7 +24,6 @@
 #ifndef HTMLFormControlElement_h
 #define HTMLFormControlElement_h
 
-#include "FormControlElement.h"
 #include "HTMLElement.h"
 
 namespace WebCore {
@@ -32,7 +31,7 @@ namespace WebCore {
 class FormDataList;
 class HTMLFormElement;
 
-class HTMLFormControlElement : public HTMLElement, public FormControlElement {
+class HTMLFormControlElement : public HTMLElement {
 public:
     HTMLFormControlElement(const QualifiedName& tagName, Document*, HTMLFormElement*);
     virtual ~HTMLFormControlElement();
@@ -42,10 +41,8 @@ public:
 
     HTMLFormElement* form() const { return m_form; }
 
-    virtual const AtomicString& type() const = 0;
-
-    virtual bool isControl() const { return true; }
-    virtual bool isEnabled() const { return !disabled(); }
+    virtual bool isTextFormControl() const { return false; }
+    virtual bool isEnabledFormControl() const { return !disabled(); }
 
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual void attach();
@@ -54,10 +51,10 @@ public:
 
     virtual void reset() {}
 
-    virtual bool valueMatchesRenderer() const { return m_valueMatchesRenderer; }
-    virtual void setValueMatchesRenderer(bool b = true) { m_valueMatchesRenderer = b; }
+    virtual bool formControlValueMatchesRenderer() const { return m_valueMatchesRenderer; }
+    virtual void setFormControlValueMatchesRenderer(bool b) { m_valueMatchesRenderer = b; }
 
-    void onChange();
+    virtual void dispatchFormControlChangeEvent();
 
     bool disabled() const;
     void setDisabled(bool);
@@ -68,7 +65,7 @@ public:
     virtual bool isMouseFocusable() const;
     virtual bool isEnumeratable() const { return false; }
 
-    virtual bool isReadOnlyControl() const { return m_readOnly; }
+    virtual bool isReadOnlyFormControl() const { return m_readOnly; }
     void setReadOnly(bool);
 
     // Determines whether or not a control will be automatically focused
@@ -77,10 +74,15 @@ public:
 
     virtual void recalcStyle(StyleChange);
 
-    virtual const AtomicString& name() const;
+    virtual const AtomicString& formControlName() const;
+    virtual const AtomicString& formControlType() const = 0;
+
+    const AtomicString& type() const { return formControlType(); }
+    const AtomicString& name() const { return formControlName(); }
+
     void setName(const AtomicString& name);
 
-    virtual bool isGenericFormElement() const { return true; }
+    virtual bool isFormControlElement() const { return true; }
     virtual bool isRadioButton() const { return false; }
 
     /* Override in derived classes to get the encoded name=value pair for submitting.
@@ -117,14 +119,9 @@ public:
 
     virtual void finishParsingChildren();
 
-    virtual bool saveState(String& value) const = 0;
-
 protected:
     virtual void willMoveToNewOwnerDocument();
     virtual void didMoveToNewOwnerDocument();
-
-private:
-    virtual void restoreState(const String& value) = 0;
 };
 
 } //namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp
index e039081..64cac37 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
@@ -34,6 +34,7 @@
 #include "FileSystem.h"
 #include "FormData.h"
 #include "FormDataList.h"
+#include "FormState.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLDocument.h"
@@ -41,26 +42,34 @@
 #include "HTMLImageElement.h"
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
+#include "ScriptEventListener.h"
 #include "MIMETypeRegistry.h"
+#include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderTextControl.h"
-#include <wtf/RandomNumber.h>
-
 #include <limits>
+#include <wtf/CurrentTime.h>
+#include <wtf/RandomNumber.h>
 
 #if PLATFORM(WX)
 #include <wx/defs.h>
 #include <wx/filename.h>
 #endif
 
-#if PLATFORM(WIN_OS)
-#include <shlwapi.h>
-#endif
+using namespace std;
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
+static int64_t generateFormDataIdentifier()
+{
+    // Initialize to the current time to reduce the likelihood of generating
+    // identifiers that overlap with those from past/future browser sessions.
+    static int64_t nextIdentifier = static_cast<int64_t>(currentTime() * 1000000.0);
+    return ++nextIdentifier;
+}
+
 HTMLFormElement::HTMLFormElement(const QualifiedName& tagName, Document* doc)
     : HTMLElement(tagName, doc)
     , m_elementAliases(0)
@@ -70,6 +79,7 @@ HTMLFormElement::HTMLFormElement(const QualifiedName& tagName, Document* doc)
     , m_doingsubmit(false)
     , m_inreset(false)
     , m_malformed(false)
+    , m_demoted(false)
 {
     ASSERT(hasTagName(formTag));
 }
@@ -98,6 +108,31 @@ void HTMLFormElement::attach()
     HTMLElement::attach();
 }
 
+bool HTMLFormElement::rendererIsNeeded(RenderStyle* style)
+{
+    if (!isDemoted())
+        return HTMLElement::rendererIsNeeded(style);
+    
+    Node* node = parentNode();
+    RenderObject* parentRenderer = node->renderer();
+    bool parentIsTableElementPart = (parentRenderer->isTable() && node->hasTagName(tableTag))
+        || (parentRenderer->isTableRow() && node->hasTagName(trTag))
+        || (parentRenderer->isTableSection() && node->hasTagName(tbodyTag))
+        || (parentRenderer->isTableCol() && node->hasTagName(colTag)) 
+        || (parentRenderer->isTableCell() && node->hasTagName(trTag));
+
+    if (!parentIsTableElementPart)
+        return true;
+
+    EDisplay display = style->display();
+    bool formIsTablePart = display == TABLE || display == INLINE_TABLE || display == TABLE_ROW_GROUP
+        || display == TABLE_HEADER_GROUP || display == TABLE_FOOTER_GROUP || display == TABLE_ROW
+        || display == TABLE_COLUMN_GROUP || display == TABLE_COLUMN || display == TABLE_CELL
+        || display == TABLE_CAPTION;
+
+    return formIsTablePart;
+}
+
 void HTMLFormElement::insertedIntoDocument()
 {
     if (document()->isHTMLDocument())
@@ -116,7 +151,7 @@ void HTMLFormElement::removedFromDocument()
 
 void HTMLFormElement::handleLocalEvents(Event* event, bool useCapture)
 {
-    EventTargetNode* targetNode = event->target()->toNode();
+    Node* targetNode = event->target()->toNode();
     if (!useCapture && targetNode && targetNode != this && (event->type() == eventNames().submitEvent || event->type() == eventNames().resetEvent)) {
         event->stopPropagation();
         return;
@@ -202,7 +237,8 @@ PassRefPtr<FormData> HTMLFormElement::createFormData(const CString& boundary)
                         if (!path.isEmpty()) {
                             if (Page* page = document()->page()) {
                                 String generatedFileName;
-                                if (shouldGenerateFile = page->chrome()->client()->shouldReplaceWithGeneratedFileForUpload(path, generatedFileName))
+                                shouldGenerateFile = page->chrome()->client()->shouldReplaceWithGeneratedFileForUpload(path, generatedFileName);
+                                if (shouldGenerateFile)
                                     fileName = generatedFileName;
                             }
                         }
@@ -240,6 +276,8 @@ PassRefPtr<FormData> HTMLFormElement::createFormData(const CString& boundary)
         m_formDataBuilder.addBoundaryToMultiPartHeader(encodedData, boundary, true);
 
     result->appendData(encodedData.data(), encodedData.size());
+
+    result->setIdentifier(generateFormDataIdentifier());
     return result;
 }
 
@@ -257,7 +295,7 @@ bool HTMLFormElement::prepareSubmit(Event* event)
     m_insubmit = true;
     m_doingsubmit = false;
 
-    if (dispatchEventForType(eventNames().submitEvent, true, true) && !m_doingsubmit)
+    if (dispatchEvent(eventNames().submitEvent, true, true) && !m_doingsubmit)
         m_doingsubmit = true;
 
     m_insubmit = false;
@@ -268,12 +306,29 @@ bool HTMLFormElement::prepareSubmit(Event* event)
     return m_doingsubmit;
 }
 
-void HTMLFormElement::submit()
+static void transferMailtoPostFormDataToURL(RefPtr<FormData>& data, KURL& url, const String& encodingType)
 {
-    submit(0, false);
+    String body = data->flattenToString();
+    data = FormData::create();
+
+    if (equalIgnoringCase(encodingType, "text/plain")) {
+        // Convention seems to be to decode, and s/&/\r\n/. Also, spaces are encoded as %20.
+        body = decodeURLEscapeSequences(body.replace('&', "\r\n").replace('+', ' ') + "\r\n");
+    }
+
+    Vector<char> bodyData;
+    bodyData.append("body=", 5);
+    FormDataBuilder::encodeStringAsFormData(bodyData, body.utf8());
+    body = String(bodyData.data(), bodyData.size()).replace('+', "%20");
+
+    String query = url.query();
+    if (!query.isEmpty())
+        query.append('&');
+    query.append(body);
+    url.setQuery(query);
 }
 
-void HTMLFormElement::submit(Event* event, bool activateSubmitButton)
+void HTMLFormElement::submit(Event* event, bool activateSubmitButton, bool lockHistory, bool lockBackForwardList)
 {
     FrameView* view = document()->view();
     Frame* frame = document()->frame();
@@ -290,14 +345,14 @@ void HTMLFormElement::submit(Event* event, bool activateSubmitButton)
     HTMLFormControlElement* firstSuccessfulSubmitButton = 0;
     bool needButtonActivation = activateSubmitButton; // do we need to activate a submit button?
     
-    frame->loader()->clearRecordedFormValues();
-    frame->loader()->setFormAboutToBeSubmitted(this);
+    Vector<pair<String, String> > formValues;
+
     for (unsigned i = 0; i < formElements.size(); ++i) {
         HTMLFormControlElement* control = formElements[i];
         if (control->hasLocalName(inputTag)) {
             HTMLInputElement* input = static_cast<HTMLInputElement*>(control);
             if (input->isTextField()) {
-                frame->loader()->recordFormValue(input->name(), input->value());
+                formValues.append(pair<String, String>(input->name(), input->value()));
                 if (input->isSearchField())
                     input->addSearchResult();
             }
@@ -310,6 +365,8 @@ void HTMLFormElement::submit(Event* event, bool activateSubmitButton)
         }
     }
 
+    RefPtr<FormState> formState = FormState::create(this, formValues, frame);
+
     if (needButtonActivation && firstSuccessfulSubmitButton)
         firstSuccessfulSubmitButton->setActivatedSubmit(true);
     
@@ -324,25 +381,22 @@ void HTMLFormElement::submit(Event* event, bool activateSubmitButton)
 
         if (!m_formDataBuilder.isMultiPartForm()) {
             RefPtr<FormData> data = createFormData(CString());
+
             if (isMailtoForm()) {
-                String body = data->flattenToString();
-                if (equalIgnoringCase(m_formDataBuilder.encodingType(), "text/plain")) {
-                    // Convention seems to be to decode, and s/&/\r\n/. Also, spaces are encoded as %20.
-                    body = decodeURLEscapeSequences(body.replace('&', "\r\n").replace('+', ' ') + "\r\n");
-                }
-                Vector<char> bodyData;
-                bodyData.append("body=", 5);
-                FormDataBuilder::encodeStringAsFormData(bodyData, body.utf8());
-                data = FormData::create(String(bodyData.data(), bodyData.size()).replace('+', "%20").latin1());
+                // Convert the form data into a string that we put into the URL.
+                KURL url = document()->completeURL(m_url);
+                transferMailtoPostFormDataToURL(data, url, m_formDataBuilder.encodingType());
+                m_url = url.string();
             }
-            frame->loader()->submitForm("POST", m_url, data, m_target, m_formDataBuilder.encodingType(), String(), event);
+
+            frame->loader()->submitForm("POST", m_url, data.release(), m_target, m_formDataBuilder.encodingType(), String(), lockHistory, lockBackForwardList, event, formState.release());
         } else {
             Vector<char> boundary = m_formDataBuilder.generateUniqueBoundaryString();
-            frame->loader()->submitForm("POST", m_url, createFormData(boundary.data()), m_target, m_formDataBuilder.encodingType(), boundary.data(), event);
+            frame->loader()->submitForm("POST", m_url, createFormData(boundary.data()), m_target, m_formDataBuilder.encodingType(), boundary.data(), lockHistory, lockBackForwardList, event, formState.release());
         }
     } else {
         m_formDataBuilder.setIsMultiPartForm(false);
-        frame->loader()->submitForm("GET", m_url, createFormData(CString()), m_target, String(), String(), event);
+        frame->loader()->submitForm("GET", m_url, createFormData(CString()), m_target, String(), String(), lockHistory, lockBackForwardList, event, formState.release());
     }
 
     if (needButtonActivation && firstSuccessfulSubmitButton)
@@ -361,7 +415,7 @@ void HTMLFormElement::reset()
 
     // ### DOM2 labels this event as not cancelable, however
     // common browsers( sick! ) allow it be cancelled.
-    if ( !dispatchEventForType(eventNames().resetEvent,true, true) ) {
+    if ( !dispatchEvent(eventNames().resetEvent,true, true) ) {
         m_inreset = false;
         return;
     }
@@ -395,9 +449,9 @@ void HTMLFormElement::parseMappedAttribute(MappedAttribute* attr)
         else
             document()->unregisterForDocumentActivationCallbacks(this);
     } else if (attr->name() == onsubmitAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().submitEvent, attr);
+        setAttributeEventListener(eventNames().submitEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onresetAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().resetEvent, attr);
+        setAttributeEventListener(eventNames().resetEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == nameAttr) {
         const AtomicString& newName = attr->value();
         if (inDocument() && document()->isHTMLDocument()) {
@@ -432,7 +486,7 @@ unsigned HTMLFormElement::formElementIndex(HTMLFormControlElement* e)
             if (node == e)
                 return i;
             if (node->isHTMLElement()
-                    && static_cast<HTMLElement*>(node)->isGenericFormElement()
+                    && static_cast<Element*>(node)->isFormControlElement()
                     && static_cast<HTMLFormControlElement*>(node)->form() == this)
                 ++i;
         }
@@ -574,68 +628,14 @@ void HTMLFormElement::willMoveToNewOwnerDocument()
 {
     if (!m_autocomplete)
         document()->unregisterForDocumentActivationCallbacks(this);
+    HTMLElement::willMoveToNewOwnerDocument();
 }
 
 void HTMLFormElement::didMoveToNewOwnerDocument()
 {
-    if(m_autocomplete)
+    if (!m_autocomplete)
         document()->registerForDocumentActivationCallbacks(this);
-}
-
-void HTMLFormElement::CheckedRadioButtons::addButton(HTMLFormControlElement* element)
-{
-    // We only want to add radio buttons.
-    if (!element->isRadioButton())
-        return;
-
-    // Without a name, there is no group.
-    if (element->name().isEmpty())
-        return;
-
-    HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(element);
-
-    // We only track checked buttons.
-    if (!inputElement->checked())
-        return;
-
-    if (!m_nameToCheckedRadioButtonMap)
-        m_nameToCheckedRadioButtonMap.set(new NameToInputMap);
-
-    pair<NameToInputMap::iterator, bool> result = m_nameToCheckedRadioButtonMap->add(element->name().impl(), inputElement);
-    if (result.second)
-        return;
-    
-    HTMLInputElement* oldCheckedButton = result.first->second;
-    if (oldCheckedButton == inputElement)
-        return;
-
-    result.first->second = inputElement;
-    oldCheckedButton->setChecked(false);
-}
-
-HTMLInputElement* HTMLFormElement::CheckedRadioButtons::checkedButtonForGroup(const AtomicString& name) const
-{
-    if (!m_nameToCheckedRadioButtonMap)
-        return 0;
-    
-    return m_nameToCheckedRadioButtonMap->get(name.impl());
-}
-
-void HTMLFormElement::CheckedRadioButtons::removeButton(HTMLFormControlElement* element)
-{
-    if (element->name().isEmpty() || !m_nameToCheckedRadioButtonMap)
-        return;
-    
-    NameToInputMap::iterator it = m_nameToCheckedRadioButtonMap->find(element->name().impl());
-    if (it == m_nameToCheckedRadioButtonMap->end() || it->second != element)
-        return;
-    
-    ASSERT(element->isRadioButton());
-    ASSERT(element->isChecked());
-    
-    m_nameToCheckedRadioButtonMap->remove(it);
-    if (m_nameToCheckedRadioButtonMap->isEmpty())
-        m_nameToCheckedRadioButtonMap.clear();
+    HTMLElement::didMoveToNewOwnerDocument();
 }
 
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.h
index ef22043..d08e16c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,10 +24,9 @@
 #ifndef HTMLFormElement_h
 #define HTMLFormElement_h
 
+#include "CheckedRadioButtons.h"
 #include "FormDataBuilder.h"
-#include "HTMLCollection.h" 
 #include "HTMLElement.h"
-
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
@@ -40,6 +39,8 @@ class HTMLInputElement;
 class HTMLFormCollection;
 class TextEncoding;
 
+struct CollectionCache;
+
 class HTMLFormElement : public HTMLElement { 
 public:
     HTMLFormElement(const QualifiedName&, Document*);
@@ -49,6 +50,7 @@ public:
     virtual int tagPriority() const { return 3; }
 
     virtual void attach();
+    virtual bool rendererIsNeeded(RenderStyle*);
     virtual void insertedIntoDocument();
     virtual void removedFromDocument();
  
@@ -76,14 +78,16 @@ public:
     void removeImgElement(HTMLImageElement*);
 
     bool prepareSubmit(Event*);
-    void submit();
-    void submit(Event*, bool activateSubmitButton = false);
+    void submit(Event* = 0, bool activateSubmitButton = false, bool lockHistory = false, bool lockBackForwardList = false);
     void reset();
 
     // Used to indicate a malformed state to keep from applying the bottom margin of the form.
     void setMalformed(bool malformed) { m_malformed = malformed; }
     bool isMalformed() const { return m_malformed; }
 
+    void setDemoted(bool demoted) { m_demoted = demoted; }
+    bool isDemoted() const { return m_demoted; }
+
     virtual bool isURLAttribute(Attribute*) const;
     
     void submitClick(Event*);
@@ -110,17 +114,6 @@ public:
     // FIXME: Change this to be private after getting rid of all the clients.
     Vector<HTMLFormControlElement*> formElements;
 
-    class CheckedRadioButtons {
-    public:
-        void addButton(HTMLFormControlElement*);
-        void removeButton(HTMLFormControlElement*);
-        HTMLInputElement* checkedButtonForGroup(const AtomicString& name) const;
-
-    private:
-        typedef HashMap<AtomicStringImpl*, HTMLInputElement*> NameToInputMap;
-        OwnPtr<NameToInputMap> m_nameToCheckedRadioButtonMap;
-    };
-    
     CheckedRadioButtons& checkedRadioButtons() { return m_checkedRadioButtons; }
     
     virtual void documentDidBecomeActive();
@@ -141,7 +134,7 @@ private:
 
     FormDataBuilder m_formDataBuilder;
     AliasMap* m_elementAliases;
-    HTMLCollection::CollectionInfo* collectionInfo;
+    CollectionCache* collectionInfo;
 
     CheckedRadioButtons m_checkedRadioButtons;
     
@@ -153,6 +146,7 @@ private:
     bool m_doingsubmit : 1;
     bool m_inreset : 1;
     bool m_malformed : 1;
+    bool m_demoted : 1;
     AtomicString m_name;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.idl
index 39db70c..f3aca87 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFormElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFormElement.idl
@@ -37,7 +37,7 @@ module html {
                  attribute [ConvertNullToNullString] DOMString       method;
                  attribute [ConvertNullToNullString] DOMString       target;
         
-        void               submit();
-        void               reset();
+        [Custom] void submit();
+        void reset();
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.cpp
index 63ec265..adc3ff1 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.cpp
@@ -27,14 +27,15 @@
 #include "Frame.h"
 #include "HTMLFrameSetElement.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderFrame.h"
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLFrameElement::HTMLFrameElement(const QualifiedName& tagName, Document* doc, bool createdByParser)
-    : HTMLFrameElementBase(tagName, doc, createdByParser)
+HTMLFrameElement::HTMLFrameElement(const QualifiedName& tagName, Document* document)
+    : HTMLFrameElementBase(tagName, document)
     , m_frameBorder(true)
     , m_frameBorderSet(false)
 {
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.h
index 5cd9b92..ab602ee 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.h
@@ -33,10 +33,9 @@ class RenderObject;
 class RenderArena;
 class RenderStyle;
 
-class HTMLFrameElement : public HTMLFrameElementBase
-{
+class HTMLFrameElement : public HTMLFrameElementBase {
 public:
-    HTMLFrameElement(const QualifiedName&, Document*, bool createdByParser);
+    HTMLFrameElement(const QualifiedName&, Document*);
 
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusForbidden; }
     virtual int tagPriority() const { return 0; }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.idl
index bc512ff..106e57e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameElement.idl
@@ -38,15 +38,17 @@ module html {
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // Extensions
         readonly attribute DOMWindow contentWindow;
 
-#if ENABLE_SVG
+#if defined(ENABLE_SVG) && ENABLE_SVG
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C || defined(ENABLE_SVG_DOM_OBJC_BINDINGS) && ENABLE_SVG_DOM_OBJC_BINDINGS
         [SVGCheckSecurityDocument] SVGDocument getSVGDocument()
             raises(DOMException);
 #endif
 #endif
+#endif
 
                  attribute [ConvertNullToNullString, CustomSetter] DOMString       location;
         readonly attribute long            width;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp
index a692d08..1e09595 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.cpp
@@ -34,7 +34,9 @@
 #include "FrameView.h"
 #include "HTMLFrameSetElement.h"
 #include "HTMLNames.h"
+#include "ScriptEventListener.h"
 #include "KURL.h"
+#include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderFrame.h"
 #include "Settings.h"
@@ -43,8 +45,8 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLFrameElementBase::HTMLFrameElementBase(const QualifiedName& tagName, Document* doc, bool createdByParser)
-    : HTMLFrameOwnerElement(tagName, doc, createdByParser)
+HTMLFrameElementBase::HTMLFrameElementBase(const QualifiedName& tagName, Document* document)
+    : HTMLFrameOwnerElement(tagName, document)
     , m_scrolling(ScrollbarAuto)
     , m_marginWidth(-1)
     , m_marginHeight(-1)
@@ -140,10 +142,10 @@ void HTMLFrameElementBase::parseMappedAttribute(MappedAttribute *attr)
         if (contentFrame())
             contentFrame()->setInViewSourceMode(viewSourceMode());
     } else if (attr->name() == onloadAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().loadEvent, attr);
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onbeforeunloadAttr) {
         // FIXME: should <frame> elements have beforeunload handlers?
-        setInlineEventListenerForTypeAndAttribute(eventNames().beforeunloadEvent, attr);
+        setAttributeEventListener(eventNames().beforeunloadEvent, createAttributeEventListener(this, attr));
     } else
         HTMLFrameOwnerElement::parseMappedAttribute(attr);
 }
@@ -311,7 +313,7 @@ int HTMLFrameElementBase::width() const
         return 0;
     
     document()->updateLayoutIgnorePendingStylesheets();
-    return renderer()->width();
+    return toRenderBox(renderer())->width();
 }
 
 int HTMLFrameElementBase::height() const
@@ -320,7 +322,7 @@ int HTMLFrameElementBase::height() const
         return 0;
     
     document()->updateLayoutIgnorePendingStylesheets();
-    return renderer()->height();
+    return toRenderBox(renderer())->height();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.h b/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.h
index 923cd2f..4a24451 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameElementBase.h
@@ -82,7 +82,7 @@ public:
     bool viewSourceMode() const { return m_viewSource; }
 
 protected:
-    HTMLFrameElementBase(const QualifiedName&, Document*, bool createdByParser);
+    HTMLFrameElementBase(const QualifiedName&, Document*);
 
     bool isURLAllowed(const AtomicString&) const;
     void setNameAndOpenURL();
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.cpp
index 2e16e33..a98a3df 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.cpp
@@ -32,10 +32,9 @@
 
 namespace WebCore {
 
-HTMLFrameOwnerElement::HTMLFrameOwnerElement(const QualifiedName& tagName, Document* document, bool createdByParser)
+HTMLFrameOwnerElement::HTMLFrameOwnerElement(const QualifiedName& tagName, Document* document)
     : HTMLElement(tagName, document)
     , m_contentFrame(0)
-    , m_createdByParser(createdByParser)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.h
index e887be0..3f50a02 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameOwnerElement.h
@@ -35,7 +35,7 @@ class SVGDocument;
 
 class HTMLFrameOwnerElement : public HTMLElement {
 protected:
-    HTMLFrameOwnerElement(const QualifiedName& tagName, Document*, bool createdByParser);
+    HTMLFrameOwnerElement(const QualifiedName& tagName, Document*);
 
 public:
     virtual ~HTMLFrameOwnerElement();
@@ -49,8 +49,6 @@ public:
     virtual bool isFrameOwnerElement() const { return true; }
     virtual bool isKeyboardFocusable(KeyboardEvent*) const { return m_contentFrame; }
     
-    bool createdByParser() const { return m_createdByParser; }
-
     virtual ScrollbarMode scrollingMode() const { return ScrollbarAuto; }
 
 #if ENABLE(SVG)
@@ -60,7 +58,6 @@ public:
 private:
     friend class Frame;
     Frame* m_contentFrame;
-    bool m_createdByParser;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.cpp
index dacd32b..42c1d7f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.cpp
@@ -3,7 +3,7 @@
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann (hausmann@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -29,8 +29,9 @@
 #include "Event.h"
 #include "EventNames.h"
 #include "HTMLNames.h"
+#include "ScriptEventListener.h"
 #include "Length.h"
-#include "Length.h"
+#include "MappedAttribute.h"
 #include "MouseEvent.h"
 #include "RenderFrameSet.h"
 #include "Text.h"
@@ -88,13 +89,13 @@ void HTMLFrameSetElement::parseMappedAttribute(MappedAttribute *attr)
         if (!attr->isNull()) {
             if (m_rows) delete [] m_rows;
             m_rows = newLengthArray(attr->value().string(), m_totalRows);
-            setChanged();
+            setNeedsStyleRecalc();
         }
     } else if (attr->name() == colsAttr) {
         if (!attr->isNull()) {
             delete [] m_cols;
             m_cols = newLengthArray(attr->value().string(), m_totalCols);
-            setChanged();
+            setNeedsStyleRecalc();
         }
     } else if (attr->name() == frameborderAttr) {
         if (!attr->isNull()) {
@@ -124,13 +125,27 @@ void HTMLFrameSetElement::parseMappedAttribute(MappedAttribute *attr)
             addCSSColor(attr, CSSPropertyBorderColor, attr->value());
             m_borderColorSet = true;
         }
-    } else if (attr->name() == onloadAttr) {
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().loadEvent, attr);
-    } else if (attr->name() == onbeforeunloadAttr) {
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().beforeunloadEvent, attr);
-    } else if (attr->name() == onunloadAttr) {
-        document()->setWindowInlineEventListenerForTypeAndAttribute(eventNames().unloadEvent, attr);
-    } else
+    } else if (attr->name() == onloadAttr)
+        document()->setWindowAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onbeforeunloadAttr)
+        document()->setWindowAttributeEventListener(eventNames().beforeunloadEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onunloadAttr)
+        document()->setWindowAttributeEventListener(eventNames().unloadEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onblurAttr)
+        document()->setWindowAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onfocusAttr)
+        document()->setWindowAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onresizeAttr)
+        document()->setWindowAttributeEventListener(eventNames().resizeEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onscrollAttr)
+        document()->setWindowAttributeEventListener(eventNames().scrollEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onstorageAttr)
+        document()->setWindowAttributeEventListener(eventNames().storageEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == ononlineAttr)
+        document()->setWindowAttributeEventListener(eventNames().onlineEvent, createAttributeEventListener(document()->frame(), attr));
+    else if (attr->name() == onofflineAttr)
+        document()->setWindowAttributeEventListener(eventNames().offlineEvent, createAttributeEventListener(document()->frame(), attr));
+    else
         HTMLElement::parseMappedAttribute(attr);
 }
 
@@ -186,9 +201,9 @@ void HTMLFrameSetElement::defaultEventHandler(Event* evt)
 
 void HTMLFrameSetElement::recalcStyle(StyleChange ch)
 {
-    if (changed() && renderer()) {
+    if (needsStyleRecalc() && renderer()) {
         renderer()->setNeedsLayout(true);
-        setChanged(NoStyleChange);
+        setNeedsStyleRecalc(NoStyleChange);
     }
     HTMLElement::recalcStyle(ch);
 }
@@ -213,4 +228,114 @@ void HTMLFrameSetElement::setRows(const String &value)
     setAttribute(rowsAttr, value);
 }
 
+EventListener* HTMLFrameSetElement::onblur() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().blurEvent);
+}
+
+void HTMLFrameSetElement::setOnblur(PassRefPtr<EventListener> eventListener)
+{
+    document()->setAttributeEventListener(eventNames().blurEvent, eventListener);
+}
+
+EventListener* HTMLFrameSetElement::onerror() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().errorEvent);
+}
+
+void HTMLFrameSetElement::setOnerror(PassRefPtr<EventListener> eventListener)
+{
+    document()->setAttributeEventListener(eventNames().errorEvent, eventListener);
+}
+
+EventListener* HTMLFrameSetElement::onfocus() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().focusEvent);
+}
+
+void HTMLFrameSetElement::setOnfocus(PassRefPtr<EventListener> eventListener)
+{
+    document()->setAttributeEventListener(eventNames().focusEvent, eventListener);
+}
+
+EventListener* HTMLFrameSetElement::onload() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().loadEvent);
+}
+
+void HTMLFrameSetElement::setOnload(PassRefPtr<EventListener> eventListener)
+{
+    document()->setAttributeEventListener(eventNames().loadEvent, eventListener);
+}
+
+EventListener* HTMLFrameSetElement::onbeforeunload() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().beforeunloadEvent);
+}
+
+void HTMLFrameSetElement::setOnbeforeunload(PassRefPtr<EventListener> eventListener)
+{
+    document()->setAttributeEventListener(eventNames().beforeunloadEvent, eventListener);
+}
+
+EventListener* HTMLFrameSetElement::onmessage() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().messageEvent);
+}
+
+void HTMLFrameSetElement::setOnmessage(PassRefPtr<EventListener> eventListener)
+{
+    document()->setAttributeEventListener(eventNames().messageEvent, eventListener);
+}
+
+EventListener* HTMLFrameSetElement::onoffline() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().offlineEvent);
+}
+
+void HTMLFrameSetElement::setOnoffline(PassRefPtr<EventListener> eventListener)
+{
+    document()->setAttributeEventListener(eventNames().offlineEvent, eventListener);
+}
+
+EventListener* HTMLFrameSetElement::ononline() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().onlineEvent);
+}
+
+void HTMLFrameSetElement::setOnonline(PassRefPtr<EventListener> eventListener)
+{
+    document()->setAttributeEventListener(eventNames().onlineEvent, eventListener);
+}
+
+EventListener* HTMLFrameSetElement::onresize() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().resizeEvent);
 }
+
+void HTMLFrameSetElement::setOnresize(PassRefPtr<EventListener> eventListener)
+{
+    document()->setAttributeEventListener(eventNames().resizeEvent, eventListener);
+}
+
+EventListener* HTMLFrameSetElement::onstorage() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().storageEvent);
+}
+
+void HTMLFrameSetElement::setOnstorage(PassRefPtr<EventListener> eventListener)
+{
+    document()->setAttributeEventListener(eventNames().storageEvent, eventListener);
+}
+
+EventListener* HTMLFrameSetElement::onunload() const
+{
+    return document()->getWindowAttributeEventListener(eventNames().unloadEvent);
+}
+
+void HTMLFrameSetElement::setOnunload(PassRefPtr<EventListener> eventListener)
+{
+    document()->setAttributeEventListener(eventNames().unloadEvent, eventListener);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.h b/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.h
index bb9156f..4319c7a 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.h
@@ -1,10 +1,8 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
- * Copyright (C) 2004, 2006 Apple Computer, Inc.
+ * Copyright (C) 2004, 2006, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -45,7 +43,7 @@ public:
 
     virtual void attach();
     virtual bool rendererIsNeeded(RenderStyle*);
-    virtual RenderObject *createRenderer(RenderArena*, RenderStyle*);
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     
     virtual void defaultEventHandler(Event*);
 
@@ -58,7 +56,7 @@ public:
 
     bool hasBorderColor() const { return m_borderColorSet; }
 
-    virtual void recalcStyle( StyleChange ch );
+    virtual void recalcStyle(StyleChange);
     
     String cols() const;
     void setCols(const String&);
@@ -69,6 +67,31 @@ public:
     const Length* rowLengths() const { return m_rows; }
     const Length* colLengths() const { return m_cols; }
 
+    // Event handler attributes
+    virtual EventListener* onblur() const;
+    virtual void setOnblur(PassRefPtr<EventListener>);
+    virtual EventListener* onerror() const;
+    virtual void setOnerror(PassRefPtr<EventListener>);
+    virtual EventListener* onfocus() const;
+    virtual void setOnfocus(PassRefPtr<EventListener>);
+    virtual EventListener* onload() const;
+    virtual void setOnload(PassRefPtr<EventListener>);
+
+    EventListener* onbeforeunload() const;
+    void setOnbeforeunload(PassRefPtr<EventListener>);
+    EventListener* onmessage() const;
+    void setOnmessage(PassRefPtr<EventListener>);
+    EventListener* onoffline() const;
+    void setOnoffline(PassRefPtr<EventListener>);
+    EventListener* ononline() const;
+    void setOnonline(PassRefPtr<EventListener>);
+    EventListener* onresize() const;
+    void setOnresize(PassRefPtr<EventListener>);
+    EventListener* onstorage() const;
+    void setOnstorage(PassRefPtr<EventListener>);
+    EventListener* onunload() const;
+    void setOnunload(PassRefPtr<EventListener>);
+
 private:
     Length* m_rows;
     Length* m_cols;
@@ -86,6 +109,6 @@ private:
     bool noresize;
 };
 
-} //namespace
+} // namespace WebCore
 
-#endif
+#endif // HTMLFrameSetElement_h
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.idl
index 060616e..4050f2c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLFrameSetElement.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserve
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserve
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -26,10 +26,35 @@ module html {
         InterfaceUUID=5038a73d-c0db-4847-acb4-4c6d31f48790,
         ImplementationUUID=450f7bf6-fdc0-4a0f-b7e1-baea7f7e5732
     ] HTMLFrameSetElement : HTMLElement {
-
         attribute [ConvertNullToNullString] DOMString cols;
         attribute [ConvertNullToNullString] DOMString rows;
 
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+        // Event handler attributes
+        attribute [DontEnum] EventListener onbeforeunload;
+        attribute [DontEnum] EventListener onmessage;
+        attribute [DontEnum] EventListener onoffline;
+        attribute [DontEnum] EventListener ononline;
+        attribute [DontEnum] EventListener onresize;
+        attribute [DontEnum] EventListener onstorage;
+        attribute [DontEnum] EventListener onunload;
+
+        // Overrides of Element attributes.
+        // attribute [DontEnum] EventListener onblur;
+        // attribute [DontEnum] EventListener onerror;
+        // attribute [DontEnum] EventListener onfocus;
+        // attribute [DontEnum] EventListener onload;
+
+        // Not implemented yet.
+        // attribute [DontEnum] EventListener onafterprint;
+        // attribute [DontEnum] EventListener onbeforeprint;
+        // attribute [DontEnum] EventListener onhashchange;
+        // attribute [DontEnum] EventListener onpopstate;
+        // attribute [DontEnum] EventListener onredo;
+        // attribute [DontEnum] EventListener onundo;
+#endif
+#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLHRElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLHRElement.cpp
index 8be23fd..d6cc58e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLHRElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLHRElement.cpp
@@ -19,12 +19,14 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "HTMLHRElement.h"
 
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLHtmlElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLHtmlElement.cpp
index 4ed2400..d4867a4 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLHtmlElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLHtmlElement.cpp
@@ -53,10 +53,8 @@ void HTMLHtmlElement::setVersion(const String &value)
 
 bool HTMLHtmlElement::checkDTD(const Node* newChild)
 {
-    // FIXME: Why is <script> allowed here?
     return newChild->hasTagName(headTag) || newChild->hasTagName(bodyTag) ||
-           newChild->hasTagName(framesetTag) || newChild->hasTagName(noframesTag) ||
-           newChild->hasTagName(scriptTag);
+           newChild->hasTagName(framesetTag) || newChild->hasTagName(noframesTag);
 }
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.cpp
index 9ba3b13..a190bca 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.cpp
@@ -28,14 +28,15 @@
 #include "Frame.h"
 #include "HTMLDocument.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderPartObject.h"
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLIFrameElement::HTMLIFrameElement(const QualifiedName& tagName, Document* doc, bool createdByParser)
-    : HTMLFrameElementBase(tagName, doc, createdByParser)
+HTMLIFrameElement::HTMLIFrameElement(const QualifiedName& tagName, Document* document)
+    : HTMLFrameElementBase(tagName, document)
 {
     ASSERT(hasTagName(iframeTag));
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.h b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.h
index 3407a6d..362b991 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.h
@@ -30,7 +30,7 @@ namespace WebCore {
 
 class HTMLIFrameElement : public HTMLFrameElementBase {
 public:
-    HTMLIFrameElement(const QualifiedName&, Document*, bool createdByParser);
+    HTMLIFrameElement(const QualifiedName&, Document*);
 
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
     virtual int tagPriority() const { return 1; }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.idl
index c6a8599..b5684ca 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLIFrameElement.idl
@@ -40,15 +40,17 @@ module html {
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // Extensions
         readonly attribute DOMWindow contentWindow;
 
-#if ENABLE_SVG
+#if defined(ENABLE_SVG) && ENABLE_SVG
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C || defined(ENABLE_SVG_DOM_OBJC_BINDINGS) && ENABLE_SVG_DOM_OBJC_BINDINGS
         [SVGCheckSecurityDocument] SVGDocument getSVGDocument()
             raises(DOMException);
 #endif
 #endif
+#endif
 
     };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
index be89858..c4bf5dc 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.cpp
@@ -30,7 +30,9 @@
 #include "HTMLDocument.h"
 #include "HTMLFormElement.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderImage.h"
+#include "ScriptEventListener.h"
 
 using namespace std;
 
@@ -80,7 +82,7 @@ void HTMLImageElement::parseMappedAttribute(MappedAttribute* attr)
     const QualifiedName& attrName = attr->name();
     if (attrName == altAttr) {
         if (renderer() && renderer()->isImage())
-            static_cast<RenderImage*>(renderer())->updateAltText();
+            toRenderImage(renderer())->updateAltText();
     } else if (attrName == srcAttr)
         m_imageLoader.updateFromElementIgnoringPreviousError();
     else if (attrName == widthAttr)
@@ -113,9 +115,9 @@ void HTMLImageElement::parseMappedAttribute(MappedAttribute* attr)
     } else if (attrName == ismapAttr)
         ismap = true;
     else if (attrName == onabortAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().abortEvent, attr);
+        setAttributeEventListener(eventNames().abortEvent, createAttributeEventListener(this, attr));
     else if (attrName == onloadAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().loadEvent, attr);
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
     else if (attrName == compositeAttr) {
         if (!parseCompositeOperator(attr->value(), m_compositeOperator))
             m_compositeOperator = CompositeSourceOver;
@@ -166,7 +168,7 @@ void HTMLImageElement::attach()
     HTMLElement::attach();
 
     if (renderer() && renderer()->isImage()) {
-        RenderImage* imageObj = static_cast<RenderImage*>(renderer());
+        RenderImage* imageObj = toRenderImage(renderer());
         if (imageObj->hasImage())
             return;
         imageObj->setCachedImage(m_imageLoader.image());
@@ -226,7 +228,7 @@ int HTMLImageElement::width(bool ignorePendingStylesheets) const
     else
         document()->updateLayout();
 
-    return renderer() ? renderer()->contentWidth() : 0;
+    return renderBox() ? renderBox()->contentWidth() : 0;
 }
 
 int HTMLImageElement::height(bool ignorePendingStylesheets) const
@@ -250,7 +252,7 @@ int HTMLImageElement::height(bool ignorePendingStylesheets) const
     else
         document()->updateLayout();
 
-    return renderer() ? renderer()->contentHeight() : 0;
+    return renderBox() ? renderBox()->contentHeight() : 0;
 }
 
 int HTMLImageElement::naturalWidth() const
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.idl
index fe64e6f..a90ae25 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLImageElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLImageElement.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -25,28 +25,28 @@ module html {
         InterfaceUUID=b21b8125-d00b-4bdf-b0e8-659678db3923,
         ImplementationUUID=2121ca21-8118-4f1b-b9fe-4788a9050281
     ] HTMLImageElement : HTMLElement {
-                 attribute [ConvertNullToNullString] DOMString name;
-                 attribute [ConvertNullToNullString] DOMString align;
-                 attribute [ConvertNullToNullString] DOMString alt;
-                 attribute [ConvertNullToNullString] DOMString border;        
+                 attribute [ConvertNullToNullString, Reflect] DOMString name;
+                 attribute [ConvertNullToNullString, Reflect] DOMString align;
+                 attribute [ConvertNullToNullString, Reflect] DOMString alt;
+                 attribute [ConvertNullToNullString, Reflect] DOMString border;        
                  attribute long height;
                  attribute long hspace;
                  attribute boolean isMap;
-                 attribute [ConvertNullToNullString] DOMString longDesc;
-                 attribute [ConvertNullToNullString] DOMString src;
-                 attribute [ConvertNullToNullString] DOMString useMap;
+                 attribute [ConvertNullToNullString, ReflectURL=longdesc] DOMString longDesc;
+                 attribute [ConvertNullToNullString, ReflectURL] DOMString src;
+                 attribute [ConvertNullToNullString, Reflect=usemap] DOMString useMap;
                  attribute long vspace;
                  attribute long width;
         
         // Extensions
         readonly attribute boolean complete;
-                 attribute [ConvertNullToNullString] DOMString lowsrc;
+                 attribute [ConvertNullToNullString, ReflectURL] DOMString lowsrc;
         readonly attribute long naturalHeight;
         readonly attribute long naturalWidth;
         readonly attribute long x;
         readonly attribute long y;
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extension:
         readonly attribute DOMString altDisplayString;
         readonly attribute URL absoluteImageURL;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLImageLoader.cpp b/src/3rdparty/webkit/WebCore/html/HTMLImageLoader.cpp
index 22e3abc..ea53d7e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLImageLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLImageLoader.cpp
@@ -42,10 +42,10 @@ HTMLImageLoader::~HTMLImageLoader()
 
 void HTMLImageLoader::dispatchLoadEvent()
 {
-    if (!haveFiredLoadEvent() && image()) {
-        setHaveFiredLoadEvent(true);
-        element()->dispatchEventForType(image()->errorOccurred() ? eventNames().errorEvent : eventNames().loadEvent, false, false);
-    }
+    bool errorOccurred = image()->errorOccurred();
+    if (!errorOccurred && image()->httpStatusCodeErrorOccurred())
+        errorOccurred = element()->hasTagName(HTMLNames::objectTag); // An <object> considers a 404 to be an error and should fire onerror.
+    element()->dispatchEvent(errorOccurred ? eventNames().errorEvent : eventNames().loadEvent, false, false);
 }
 
 String HTMLImageLoader::sourceURI(const AtomicString& attr) const
@@ -53,12 +53,14 @@ String HTMLImageLoader::sourceURI(const AtomicString& attr) const
     return parseURL(attr);
 }
 
-void HTMLImageLoader::notifyFinished(CachedResource* image)
-{
+void HTMLImageLoader::notifyFinished(CachedResource*)
+{    
+    CachedImage* cachedImage = image();
+
     Element* elem = element();
-    ImageLoader::notifyFinished(image);
+    ImageLoader::notifyFinished(cachedImage);
 
-    if (image->errorOccurred() && elem->hasTagName(HTMLNames::objectTag))
+    if ((cachedImage->errorOccurred() || cachedImage->httpStatusCodeErrorOccurred()) && elem->hasTagName(HTMLNames::objectTag))
         static_cast<HTMLObjectElement*>(elem)->renderFallbackContent();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
index dae0be5..ae7e768 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.cpp
@@ -26,9 +26,8 @@
 #include "config.h"
 #include "HTMLInputElement.h"
 
-#include "BeforeTextInsertedEvent.h"
-#include "ChromeClient.h"
 #include "CSSPropertyNames.h"
+#include "ChromeClient.h"
 #include "Document.h"
 #include "Editor.h"
 #include "Event.h"
@@ -42,8 +41,10 @@
 #include "HTMLFormElement.h"
 #include "HTMLImageLoader.h"
 #include "HTMLNames.h"
+#include "ScriptEventListener.h"
 #include "KeyboardEvent.h"
 #include "LocalizedStrings.h"
+#include "MappedAttribute.h"
 #include "MouseEvent.h"
 #include "Page.h"
 #include "RenderButton.h"
@@ -53,10 +54,7 @@
 #include "RenderText.h"
 #include "RenderTextControlSingleLine.h"
 #include "RenderTheme.h"
-#include "SelectionController.h"
-#include "TextBreakIterator.h"
 #include "TextEvent.h"
-#include "TextIterator.h"
 #include <wtf/StdLibExtras.h>
 
 using namespace std;
@@ -67,79 +65,23 @@ using namespace HTMLNames;
 
 const int maxSavedResults = 256;
 
-// FIXME: According to HTML4, the length attribute's value can be arbitrarily
-// large. However, due to http://bugs.webkit.org/show_bugs.cgi?id=14536 things
-// get rather sluggish when a text field has a larger number of characters than
-// this, even when just clicking in the text field.
-static const int cMaxLen = 524288;
-
-static int numGraphemeClusters(StringImpl* s)
-{
-    if (!s)
-        return 0;
-
-    TextBreakIterator* it = characterBreakIterator(s->characters(), s->length());
-    if (!it)
-        return 0;
-    int num = 0;
-    while (textBreakNext(it) != TextBreakDone)
-        ++num;
-    return num;
-}
-
-static int numCharactersInGraphemeClusters(StringImpl* s, int numGraphemeClusters)
-{
-    if (!s)
-        return 0;
-
-    TextBreakIterator* it = characterBreakIterator(s->characters(), s->length());
-    if (!it)
-        return 0;
-    for (int i = 0; i < numGraphemeClusters; ++i)
-        if (textBreakNext(it) == TextBreakDone)
-            return s->length();
-    return textBreakCurrent(it);
-}
-
-static inline void notifyFormStateChanged(const HTMLInputElement* element)
-{
-    Frame* frame = element->document()->frame();
-    if (!frame)
-        return;
-    frame->page()->chrome()->client()->formStateDidChange(element);
-}
-
 HTMLInputElement::HTMLInputElement(const QualifiedName& tagName, Document* doc, HTMLFormElement* f)
     : HTMLFormControlElementWithState(tagName, doc, f)
+    , m_xPos(0)
+    , m_yPos(0)
+    , m_maxResults(-1)
+    , m_type(TEXT)
+    , m_checked(false)
+    , m_defaultChecked(false)
+    , m_useDefaultChecked(true)
+    , m_indeterminate(false)
+    , m_haveType(false)
+    , m_activeSubmit(false)
+    , m_autocomplete(Uninitialized)
+    , m_autofilled(false)
+    , m_inited(false)
 {
     ASSERT(hasTagName(inputTag) || hasTagName(isindexTag));
-    init();
-}
-
-void HTMLInputElement::init()
-{
-    m_type = TEXT;
-    m_maxLen = cMaxLen;
-    m_size = 20;
-    m_checked = false;
-    m_defaultChecked = false;
-    m_useDefaultChecked = true;
-    m_indeterminate = false;
-
-    m_haveType = false;
-    m_activeSubmit = false;
-    m_autocomplete = Uninitialized;
-    m_inited = false;
-    m_autofilled = false;
-    m_placeholderShouldBeVisible = false;
-    
-    xPos = 0;
-    yPos = 0;
-    
-    cachedSelStart = -1;
-    cachedSelEnd = -1;
-
-    m_maxResults = -1;
 }
 
 HTMLInputElement::~HTMLInputElement()
@@ -154,9 +96,9 @@ HTMLInputElement::~HTMLInputElement()
     removeFromForm();
 }
 
-const AtomicString& HTMLInputElement::name() const
+const AtomicString& HTMLInputElement::formControlName() const
 {
-    return m_name.isNull() ? emptyAtom : m_name;
+    return m_data.name();
 }
 
 bool HTMLInputElement::autoComplete() const
@@ -172,8 +114,7 @@ bool HTMLInputElement::autoComplete() const
     return true;
 }
 
-
-static inline HTMLFormElement::CheckedRadioButtons& checkedRadioButtons(const HTMLInputElement *element)
+static inline CheckedRadioButtons& checkedRadioButtons(const HTMLInputElement *element)
 {
     if (HTMLFormElement* form = element->form())
         return form->checkedRadioButtons();
@@ -192,9 +133,6 @@ bool HTMLInputElement::isKeyboardFocusable(KeyboardEvent* event) const
         return false;
 
     if (inputType() == RADIO) {
-        // Unnamed radio buttons are never focusable (matches WinIE).
-        if (name().isEmpty())
-            return false;
 
         // Never allow keyboard tabbing to leave you in the same radio group.  Always
         // skip any other elements in the group.
@@ -222,23 +160,15 @@ bool HTMLInputElement::isMouseFocusable() const
 
 void HTMLInputElement::updateFocusAppearance(bool restorePreviousSelection)
 {        
-    if (isTextField()) {
-        if (!restorePreviousSelection || cachedSelStart == -1)
-            select();
-        else
-            // Restore the cached selection.
-            setSelectionRange(cachedSelStart, cachedSelEnd); 
-        
-        if (document() && document()->frame())
-            document()->frame()->revealSelection();
-    } else
+    if (isTextField())
+        InputElement::updateFocusAppearance(m_data, this, this, restorePreviousSelection);
+    else
         HTMLFormControlElementWithState::updateFocusAppearance(restorePreviousSelection);
 }
 
 void HTMLInputElement::aboutToUnload()
 {
-    if (isTextField() && focused() && document()->frame())
-        document()->frame()->textFieldDidEndEditing(this);
+    InputElement::aboutToUnload(this, this);
 }
 
 bool HTMLInputElement::shouldUseInputMethod() const
@@ -248,23 +178,17 @@ bool HTMLInputElement::shouldUseInputMethod() const
 
 void HTMLInputElement::dispatchFocusEvent()
 {
-    if (isTextField()) {
-        setAutofilled(false);
-        updatePlaceholderVisibility();
-        if (inputType() == PASSWORD && document()->frame())
-            document()->setUseSecureKeyboardEntryWhenActive(true);
-    }
+    InputElement::dispatchFocusEvent(m_data, this, this);
+
+    if (isTextField())
+        m_autofilled = false;
+
     HTMLFormControlElementWithState::dispatchFocusEvent();
 }
 
 void HTMLInputElement::dispatchBlurEvent()
 {
-    if (isTextField() && document()->frame()) {
-        updatePlaceholderVisibility();
-        if (inputType() == PASSWORD)
-            document()->setUseSecureKeyboardEntryWhenActive(false);
-        document()->frame()->textFieldDidEndEditing(this);
-    }
+    InputElement::dispatchBlurEvent(m_data, this, this);
     HTMLFormControlElementWithState::dispatchBlurEvent();
 }
 
@@ -305,6 +229,14 @@ void HTMLInputElement::setInputType(const String& t)
         newType = SEARCH;
     else if (equalIgnoringCase(t, "range"))
         newType = RANGE;
+    else if (equalIgnoringCase(t, "email"))
+        newType = EMAIL;
+    else if (equalIgnoringCase(t, "number"))
+        newType = NUMBER;
+    else if (equalIgnoringCase(t, "tel"))
+        newType = TELEPHONE;
+    else if (equalIgnoringCase(t, "url"))
+        newType = URL;
     else
         newType = TEXT;
 
@@ -334,14 +266,14 @@ void HTMLInputElement::setInputType(const String& t)
             bool isPasswordField = inputType() == PASSWORD;
             bool willRespectHeightAndWidth = respectHeightAndWidthAttrs();
 
-            if (didStoreValue && !willStoreValue && !m_value.isNull()) {
-                setAttribute(valueAttr, m_value);
-                m_value = String();
+            if (didStoreValue && !willStoreValue && !m_data.value().isNull()) {
+                setAttribute(valueAttr, m_data.value());
+                m_data.setValue(String());
             }
             if (!didStoreValue && willStoreValue)
-                m_value = constrainValue(getAttribute(valueAttr));
+                m_data.setValue(constrainValue(getAttribute(valueAttr)));
             else
-                recheckValue();
+                InputElement::updateValueIfNeeded(m_data, this);
 
             if (wasPasswordField && !isPasswordField)
                 unregisterForActivationCallbackIfNeeded();
@@ -350,6 +282,7 @@ void HTMLInputElement::setInputType(const String& t)
 
             if (didRespectHeightAndWidth != willRespectHeightAndWidth) {
                 NamedMappedAttrMap* map = mappedAttributes();
+                ASSERT(map);
                 if (Attribute* height = map->getAttributeItem(heightAttr))
                     attributeChanged(height, false);
                 if (Attribute* width = map->getAttributeItem(widthAttr))
@@ -367,7 +300,7 @@ void HTMLInputElement::setInputType(const String& t)
             checkedRadioButtons(this).addButton(this);
         }
 
-        notifyFormStateChanged(this);
+        InputElement::notifyFormStateChanged(this);
     }
     m_haveType = true;
 
@@ -375,7 +308,7 @@ void HTMLInputElement::setInputType(const String& t)
         m_imageLoader.clear();
 }
 
-const AtomicString& HTMLInputElement::type() const
+const AtomicString& HTMLInputElement::formControlType() const
 {
     // needs to be lowercase according to DOM spec
     switch (inputType()) {
@@ -387,6 +320,10 @@ const AtomicString& HTMLInputElement::type() const
             DEFINE_STATIC_LOCAL(const AtomicString, checkbox, ("checkbox"));
             return checkbox;
         }
+        case EMAIL: {
+            DEFINE_STATIC_LOCAL(const AtomicString, email, ("email"));
+            return email;
+        }
         case FILE: {
             DEFINE_STATIC_LOCAL(const AtomicString, file, ("file"));
             return file;
@@ -401,6 +338,10 @@ const AtomicString& HTMLInputElement::type() const
         }
         case ISINDEX:
             return emptyAtom;
+        case NUMBER: {
+            DEFINE_STATIC_LOCAL(const AtomicString, number, ("number"));
+            return number;
+        }
         case PASSWORD: {
             DEFINE_STATIC_LOCAL(const AtomicString, password, ("password"));
             return password;
@@ -425,30 +366,42 @@ const AtomicString& HTMLInputElement::type() const
             DEFINE_STATIC_LOCAL(const AtomicString, submit, ("submit"));
             return submit;
         }
+        case TELEPHONE: {
+            DEFINE_STATIC_LOCAL(const AtomicString, telephone, ("tel"));
+            return telephone;
+        }
         case TEXT: {
             DEFINE_STATIC_LOCAL(const AtomicString, text, ("text"));
             return text;
         }
+        case URL: {
+            DEFINE_STATIC_LOCAL(const AtomicString, url, ("url"));
+            return url;
+        }
     }
     return emptyAtom;
 }
 
-bool HTMLInputElement::saveState(String& result) const
+bool HTMLInputElement::saveFormControlState(String& result) const
 {
     if (!autoComplete())
         return false;
 
     switch (inputType()) {
         case BUTTON:
+        case EMAIL:
         case FILE:
         case HIDDEN:
         case IMAGE:
         case ISINDEX:
+        case NUMBER:
         case RANGE:
         case RESET:
         case SEARCH:
         case SUBMIT:
+        case TELEPHONE:
         case TEXT:
+        case URL:
             result = value();
             return true;
         case CHECKBOX:
@@ -462,20 +415,24 @@ bool HTMLInputElement::saveState(String& result) const
     return false;
 }
 
-void HTMLInputElement::restoreState(const String& state)
+void HTMLInputElement::restoreFormControlState(const String& state)
 {
     ASSERT(inputType() != PASSWORD); // should never save/restore password fields
     switch (inputType()) {
         case BUTTON:
+        case EMAIL:
         case FILE:
         case HIDDEN:
         case IMAGE:
         case ISINDEX:
+        case NUMBER:
         case RANGE:
         case RESET:
         case SEARCH:
         case SUBMIT:
+        case TELEPHONE:
         case TEXT:
+        case URL:
             setValue(state);
             break;
         case CHECKBOX:
@@ -503,22 +460,22 @@ int HTMLInputElement::selectionStart() const
 {
     if (!isTextField())
         return 0;
-    if (document()->focusedNode() != this && cachedSelStart != -1)
-        return cachedSelStart;
+    if (document()->focusedNode() != this && m_data.cachedSelectionStart() != -1)
+        return m_data.cachedSelectionStart();
     if (!renderer())
         return 0;
-    return static_cast<RenderTextControl*>(renderer())->selectionStart();
+    return toRenderTextControl(renderer())->selectionStart();
 }
 
 int HTMLInputElement::selectionEnd() const
 {
     if (!isTextField())
         return 0;
-    if (document()->focusedNode() != this && cachedSelEnd != -1)
-        return cachedSelEnd;
+    if (document()->focusedNode() != this && m_data.cachedSelectionEnd() != -1)
+        return m_data.cachedSelectionEnd();
     if (!renderer())
         return 0;
-    return static_cast<RenderTextControl*>(renderer())->selectionEnd();
+    return toRenderTextControl(renderer())->selectionEnd();
 }
 
 void HTMLInputElement::setSelectionStart(int start)
@@ -527,7 +484,7 @@ void HTMLInputElement::setSelectionStart(int start)
         return;
     if (!renderer())
         return;
-    static_cast<RenderTextControl*>(renderer())->setSelectionStart(start);
+    toRenderTextControl(renderer())->setSelectionStart(start);
 }
 
 void HTMLInputElement::setSelectionEnd(int end)
@@ -536,7 +493,7 @@ void HTMLInputElement::setSelectionEnd(int end)
         return;
     if (!renderer())
         return;
-    static_cast<RenderTextControl*>(renderer())->setSelectionEnd(end);
+    toRenderTextControl(renderer())->setSelectionEnd(end);
 }
 
 void HTMLInputElement::select()
@@ -545,16 +502,12 @@ void HTMLInputElement::select()
         return;
     if (!renderer())
         return;
-    static_cast<RenderTextControl*>(renderer())->select();
+    toRenderTextControl(renderer())->select();
 }
 
 void HTMLInputElement::setSelectionRange(int start, int end)
 {
-    if (!isTextField())
-        return;
-    if (!renderer())
-        return;
-    static_cast<RenderTextControl*>(renderer())->setSelectionRange(start, end);
+    InputElement::updateSelectionRange(this, this, start, end);
 }
 
 void HTMLInputElement::accessKeyAction(bool sendToAnyElement)
@@ -575,10 +528,14 @@ void HTMLInputElement::accessKeyAction(bool sendToAnyElement)
         case HIDDEN:
             // a no-op for this type
             break;
+        case EMAIL:
         case ISINDEX:
+        case NUMBER:
         case PASSWORD:
         case SEARCH:
+        case TELEPHONE:
         case TEXT:
+        case URL:
             // should never restore previous selection here
             focus(false);
             break;
@@ -609,7 +566,7 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
 {
     if (attr->name() == nameAttr) {
         checkedRadioButtons(this).removeButton(this);
-        m_name = attr->value();
+        m_data.setName(attr->value());
         checkedRadioButtons(this).addButton(this);
     } else if (attr->name() == autocompleteAttr) {
         if (equalIgnoringCase(attr->value(), "off")) {
@@ -627,30 +584,22 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
         setInputType(attr->value());
     } else if (attr->name() == valueAttr) {
         // We only need to setChanged if the form is looking at the default value right now.
-        if (m_value.isNull())
-            setChanged();
-        setValueMatchesRenderer(false);
+        if (m_data.value().isNull())
+            setNeedsStyleRecalc();
+        setFormControlValueMatchesRenderer(false);
     } else if (attr->name() == checkedAttr) {
         m_defaultChecked = !attr->isNull();
         if (m_useDefaultChecked) {
             setChecked(m_defaultChecked);
             m_useDefaultChecked = true;
         }
-    } else if (attr->name() == maxlengthAttr) {
-        int oldMaxLen = m_maxLen;
-        m_maxLen = !attr->isNull() ? attr->value().toInt() : cMaxLen;
-        if (m_maxLen <= 0 || m_maxLen > cMaxLen)
-            m_maxLen = cMaxLen;
-        if (oldMaxLen != m_maxLen)
-            recheckValue();
-        setChanged();
-    } else if (attr->name() == sizeAttr) {
-        m_size = !attr->isNull() ? attr->value().toInt() : 20;
-        if (renderer())
-            renderer()->setNeedsLayoutAndPrefWidthsRecalc();
-    } else if (attr->name() == altAttr) {
+    } else if (attr->name() == maxlengthAttr)
+        InputElement::parseMaxLengthAttribute(m_data, this, this, attr);
+    else if (attr->name() == sizeAttr)
+        InputElement::parseSizeAttribute(m_data, this, attr);
+    else if (attr->name() == altAttr) {
         if (renderer() && inputType() == IMAGE)
-            static_cast<RenderImage*>(renderer())->updateAltText();
+            toRenderImage(renderer())->updateAltText();
     } else if (attr->name() == srcAttr) {
         if (renderer() && inputType() == IMAGE) {
             if (!m_imageLoader)
@@ -676,20 +625,18 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
         if (respectHeightAndWidthAttrs())
             addCSSLength(attr, CSSPropertyHeight, attr->value());
     } else if (attr->name() == onfocusAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().focusEvent, attr);
+        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onblurAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().blurEvent, attr);
+        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onselectAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().selectEvent, attr);
+        setAttributeEventListener(eventNames().selectEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onchangeAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().changeEvent, attr);
-    } else if (attr->name() == oninputAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().inputEvent, attr);
+        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
     }
     // Search field and slider attributes all just cause updateFromElement to be called through style
     // recalcing.
     else if (attr->name() == onsearchAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().searchEvent, attr);
+        setAttributeEventListener(eventNames().searchEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == resultsAttr) {
         int oldResults = m_maxResults;
         m_maxResults = !attr->isNull() ? min(attr->value().toInt(), maxSavedResults) : -1;
@@ -699,17 +646,17 @@ void HTMLInputElement::parseMappedAttribute(MappedAttribute *attr)
             detach();
             attach();
         }
-        setChanged();
+        setNeedsStyleRecalc();
     } else if (attr->name() == placeholderAttr) {
         if (isTextField())
-            updatePlaceholderVisibility(true);
+            updatePlaceholderVisibility();
     } else if (attr->name() == autosaveAttr ||
-               attr->name() == incrementalAttr ||
-               attr->name() == minAttr ||
-               attr->name() == maxAttr ||
-               attr->name() == multipleAttr ||
-               attr->name() == precisionAttr)
-        setChanged();
+             attr->name() == incrementalAttr ||
+             attr->name() == minAttr ||
+             attr->name() == maxAttr ||
+             attr->name() == multipleAttr ||
+             attr->name() == precisionAttr)
+        setNeedsStyleRecalc();
     else
         HTMLFormControlElementWithState::parseMappedAttribute(attr);
 }
@@ -719,16 +666,20 @@ bool HTMLInputElement::rendererIsNeeded(RenderStyle *style)
     switch (inputType()) {
         case BUTTON:
         case CHECKBOX:
+        case EMAIL:
         case FILE:
         case IMAGE:
         case ISINDEX:
+        case NUMBER:
         case PASSWORD:
         case RADIO:
         case RANGE:
         case RESET:
         case SEARCH:
         case SUBMIT:
+        case TELEPHONE:
         case TEXT:
+        case URL:
             return HTMLFormControlElementWithState::rendererIsNeeded(style);
         case HIDDEN:
             return false;
@@ -755,10 +706,14 @@ RenderObject *HTMLInputElement::createRenderer(RenderArena *arena, RenderStyle *
             return new (arena) RenderImage(this);
         case RANGE:
             return new (arena) RenderSlider(this);
+        case EMAIL:
         case ISINDEX:
+        case NUMBER:
         case PASSWORD:
         case SEARCH:
+        case TELEPHONE:
         case TEXT:
+        case URL:
             return new (arena) RenderTextControlSingleLine(this);
     }
     ASSERT(false);
@@ -780,7 +735,7 @@ void HTMLInputElement::attach()
             m_imageLoader.set(new HTMLImageLoader(this));
         m_imageLoader->updateFromElement();
         if (renderer()) {
-            RenderImage* imageObj = static_cast<RenderImage*>(renderer());
+            RenderImage* imageObj = toRenderImage(renderer());
             imageObj->setCachedImage(m_imageLoader->image()); 
             
             // If we have no image at all because we have no src attribute, set
@@ -794,7 +749,7 @@ void HTMLInputElement::attach()
 void HTMLInputElement::detach()
 {
     HTMLFormControlElementWithState::detach();
-    setValueMatchesRenderer(false);
+    setFormControlValueMatchesRenderer(false);
 }
 
 String HTMLInputElement::altText() const
@@ -837,12 +792,16 @@ bool HTMLInputElement::appendFormData(FormDataList& encoding, bool multipart)
         return false;
 
     switch (inputType()) {
+        case EMAIL:
         case HIDDEN:
         case ISINDEX:
+        case NUMBER:
         case PASSWORD:
         case RANGE:
         case SEARCH:
+        case TELEPHONE:
         case TEXT:
+        case URL:
             // always successful
             encoding.appendData(name(), value());
             return true;
@@ -862,8 +821,8 @@ bool HTMLInputElement::appendFormData(FormDataList& encoding, bool multipart)
 
         case IMAGE:
             if (m_activeSubmit) {
-                encoding.appendData(name().isEmpty() ? "x" : (name() + ".x"), xPos);
-                encoding.appendData(name().isEmpty() ? "y" : (name() + ".y"), yPos);
+                encoding.appendData(name().isEmpty() ? "x" : (name() + ".x"), m_xPos);
+                encoding.appendData(name().isEmpty() ? "y" : (name() + ".y"), m_yPos);
                 if (!name().isEmpty() && !value().isEmpty())
                     encoding.appendData(name(), value());
                 return true;
@@ -917,12 +876,12 @@ void HTMLInputElement::setChecked(bool nowChecked, bool sendChangeEvent)
 
     m_useDefaultChecked = false;
     m_checked = nowChecked;
-    setChanged();
+    setNeedsStyleRecalc();
 
     checkedRadioButtons(this).addButton(this);
-    
+
     if (renderer() && renderer()->style()->hasAppearance())
-        theme()->stateChanged(renderer(), CheckedState);
+        renderer()->theme()->stateChanged(renderer(), CheckedState);
 
     // Only send a change event for items in the document (avoid firing during
     // parsing) and don't send a change event for a radio button that's getting
@@ -930,7 +889,7 @@ void HTMLInputElement::setChecked(bool nowChecked, bool sendChangeEvent)
     // because it says only to fire change events at "lose focus" time, which is
     // definitely wrong in practice for these types of elements.
     if (sendChangeEvent && inDocument() && (inputType() != RADIO || nowChecked))
-        onChange();
+        dispatchFormControlChangeEvent();
 }
 
 void HTMLInputElement::setIndeterminate(bool _indeterminate)
@@ -941,20 +900,25 @@ void HTMLInputElement::setIndeterminate(bool _indeterminate)
 
     m_indeterminate = _indeterminate;
 
-    setChanged();
+    setNeedsStyleRecalc();
 
     if (renderer() && renderer()->style()->hasAppearance())
-        theme()->stateChanged(renderer(), CheckedState);
+        renderer()->theme()->stateChanged(renderer(), CheckedState);
 }
 
-void HTMLInputElement::copyNonAttributeProperties(const Element *source)
+int HTMLInputElement::size() const
 {
-    const HTMLInputElement *sourceElem = static_cast<const HTMLInputElement *>(source);
+    return m_data.size();
+}
+
+void HTMLInputElement::copyNonAttributeProperties(const Element* source)
+{
+    const HTMLInputElement* sourceElement = static_cast<const HTMLInputElement*>(source);
+
+    m_data.setValue(sourceElement->m_data.value());
+    m_checked = sourceElement->m_checked;
+    m_indeterminate = sourceElement->m_indeterminate;
 
-    m_value = sourceElem->m_value;
-    m_checked = sourceElem->m_checked;
-    m_indeterminate = sourceElem->m_indeterminate;
-    
     HTMLFormControlElementWithState::copyNonAttributeProperties(source);
 }
 
@@ -968,7 +932,7 @@ String HTMLInputElement::value() const
         return String();
     }
 
-    String value = m_value;
+    String value = m_data.value();
     if (value.isNull()) {
         value = constrainValue(getAttribute(valueAttr));
 
@@ -987,15 +951,19 @@ String HTMLInputElement::valueWithDefault() const
         switch (inputType()) {
             case BUTTON:
             case CHECKBOX:
+            case EMAIL:
             case FILE:
             case HIDDEN:
             case IMAGE:
             case ISINDEX:
+            case NUMBER:
             case PASSWORD:
             case RADIO:
             case RANGE:
             case SEARCH:
+            case TELEPHONE:
             case TEXT:
+            case URL:
                 break;
             case RESET:
                 v = resetButtonDefaultLabel();
@@ -1016,61 +984,54 @@ void HTMLInputElement::setValue(const String& value)
     if (inputType() == FILE && !value.isEmpty())
         return;
 
-    if (isTextField())
-        updatePlaceholderVisibility();
-    
-    setValueMatchesRenderer(false);
+    setFormControlValueMatchesRenderer(false);
     if (storesValueSeparateFromAttribute()) {
         if (inputType() == FILE)
             m_fileList->clear();
         else {
-            m_value = constrainValue(value);
-            if (isTextField() && inDocument())
-                document()->updateRendering();
+            m_data.setValue(constrainValue(value));
+            if (isTextField()) {
+                InputElement::updatePlaceholderVisibility(m_data, this, this);
+                if (inDocument())
+                    document()->updateStyleIfNeeded();
+            }
         }
         if (renderer())
             renderer()->updateFromElement();
-        setChanged();
+        setNeedsStyleRecalc();
     } else
         setAttribute(valueAttr, constrainValue(value));
     
     if (isTextField()) {
-        unsigned max = m_value.length();
+        unsigned max = m_data.value().length();
         if (document()->focusedNode() == this)
-            setSelectionRange(max, max);
-        else {
-            cachedSelStart = max;
-            cachedSelEnd = max;
-        }
+            InputElement::updateSelectionRange(this, this, max, max);
+        else
+            cacheSelection(max, max);
     }
-    notifyFormStateChanged(this);
+    InputElement::notifyFormStateChanged(this);
 }
 
-void HTMLInputElement::setValueFromRenderer(const String& value)
+String HTMLInputElement::placeholder() const
 {
-    // Renderer and our event handler are responsible for constraining values.
-    ASSERT(value == constrainValue(value) || constrainValue(value).isEmpty());
-
-    // File upload controls will always use setFileListFromRenderer.
-    ASSERT (inputType() != FILE);
-
-    if (isTextField())
-        updatePlaceholderVisibility();
-    
-    // Workaround for bug where trailing \n is included in the result of textContent.
-    // The assert macro above may also be simplified to:  value == constrainValue(value)
-    // http://bugs.webkit.org/show_bug.cgi?id=9661
-    if (value == "\n")
-        m_value = "";
-    else
-        m_value = value;
+    return getAttribute(placeholderAttr).string();
+}
 
-    setValueMatchesRenderer();
+void HTMLInputElement::setPlaceholder(const String& value)
+{
+    setAttribute(placeholderAttr, value);
+}
 
-    // Fire the "input" DOM event.
-    dispatchEventForType(eventNames().inputEvent, true, false);
+bool HTMLInputElement::searchEventsShouldBeDispatched() const
+{
+    return hasAttribute(incrementalAttr);
+}
 
-    notifyFormStateChanged(this);
+void HTMLInputElement::setValueFromRenderer(const String& value)
+{
+    // File upload controls will always use setFileListFromRenderer.
+    ASSERT(inputType() != FILE);
+    InputElement::setValueFromRenderer(m_data, this, this, value);
 }
 
 void HTMLInputElement::setFileListFromRenderer(const Vector<String>& paths)
@@ -1080,8 +1041,8 @@ void HTMLInputElement::setFileListFromRenderer(const Vector<String>& paths)
     for (int i = 0; i < size; i++)
         m_fileList->append(File::create(paths[i]));
 
-    setValueMatchesRenderer();
-    notifyFormStateChanged(this);
+    setFormControlValueMatchesRenderer(true);
+    InputElement::notifyFormStateChanged(this);
 }
 
 bool HTMLInputElement::storesValueSeparateFromAttribute() const
@@ -1095,12 +1056,16 @@ bool HTMLInputElement::storesValueSeparateFromAttribute() const
         case RESET:
         case SUBMIT:
             return false;
+        case EMAIL:
         case FILE:
         case ISINDEX:
+        case NUMBER:
         case PASSWORD:
         case RANGE:
         case SEARCH:
+        case TELEPHONE:
         case TEXT:
+        case URL:
             return true;
     }
     return false;
@@ -1126,11 +1091,6 @@ void* HTMLInputElement::preDispatchEventHandler(Event *evt)
             }
         } else {
             // For radio buttons, store the current selected radio object.
-            if (name().isEmpty() || checked())
-                return 0; // Match WinIE and don't allow unnamed radio buttons to be checked.
-                          // Checked buttons just stay checked.
-                          // FIXME: Need to learn to work without a form.
-
             // We really want radio groups to end up in sane states, i.e., to have something checked.
             // Therefore if nothing is currently selected, we won't allow this action to be "undone", since
             // we want some object in the radio group to actually get selected.
@@ -1166,8 +1126,7 @@ void HTMLInputElement::postDispatchEventHandler(Event *evt, void* data)
                 // Make sure it is still a radio button and only do the restoration if it still
                 // belongs to our group.
 
-                // Match WinIE and don't allow unnamed radio buttons to be checked.
-                if (input->form() == form() && input->inputType() == RADIO && !name().isEmpty() && input->name() == name()) {
+                if (input->form() == form() && input->inputType() == RADIO && input->name() == name()) {
                     // Ok, the old radio button is still in our form and in our group and is still a 
                     // radio button, so it's safe to restore selection to it.
                     input->setChecked(true);
@@ -1183,6 +1142,9 @@ void HTMLInputElement::postDispatchEventHandler(Event *evt, void* data)
 
 void HTMLInputElement::defaultEventHandler(Event* evt)
 {
+    // FIXME: It would be better to refactor this for the different types of input element.
+    // Having them all in one giant function makes this hard to read, and almost all the handling is type-specific.
+
     bool clickDefaultFormButton = false;
 
     if (isTextField() && evt->type() == eventNames().textInputEvent && evt->isTextEvent() && static_cast<TextEvent*>(evt)->data() == "\n")
@@ -1194,30 +1156,40 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
         // FIXME: We could just call offsetX() and offsetY() on the event,
         // but that's currently broken, so for now do the computation here.
         if (me->isSimulated() || !renderer()) {
-            xPos = 0;
-            yPos = 0;
+            m_xPos = 0;
+            m_yPos = 0;
         } else {
             // FIXME: This doesn't work correctly with transforms.
+            // FIXME: pageX/pageY need adjusting for pageZoomFactor(). Use actualPageLocation()?
             IntPoint absOffset = roundedIntPoint(renderer()->localToAbsolute());
-            xPos = me->pageX() - absOffset.x();
-            yPos = me->pageY() - absOffset.y();
+            m_xPos = me->pageX() - absOffset.x();
+            m_yPos = me->pageY() - absOffset.y();
         }
     }
 
-    if (isTextField() && evt->type() == eventNames().keydownEvent && evt->isKeyboardEvent() && focused() && document()->frame()
-                && document()->frame()->doTextFieldCommandFromEvent(this, static_cast<KeyboardEvent*>(evt))) {
+    if (isTextField()
+            && evt->type() == eventNames().keydownEvent
+            && evt->isKeyboardEvent()
+            && focused()
+            && document()->frame()
+            && document()->frame()->doTextFieldCommandFromEvent(this, static_cast<KeyboardEvent*>(evt))) {
         evt->setDefaultHandled();
         return;
     }
 
-    if (inputType() == RADIO && evt->isMouseEvent()
-            && evt->type() == eventNames().clickEvent && static_cast<MouseEvent*>(evt)->button() == LeftButton) {
+    if (inputType() == RADIO
+            && evt->isMouseEvent()
+            && evt->type() == eventNames().clickEvent
+            && static_cast<MouseEvent*>(evt)->button() == LeftButton) {
         evt->setDefaultHandled();
         return;
     }
     
-    // Let the key handling done in EventTargetNode take precedence over the event handling here for editable text fields
-    if (!clickDefaultFormButton) {
+    // Call the base event handler before any of our own event handling for almost all events in text fields.
+    // Makes editing keyboard handling take precedence over the keydown and keypress handling in this function.
+    bool callBaseClassEarly = isTextField() && !clickDefaultFormButton
+        && (evt->type() == eventNames().keydownEvent || evt->type() == eventNames().keypressEvent);
+    if (callBaseClassEarly) {
         HTMLFormControlElementWithState::defaultEventHandler(evt);
         if (evt->defaultHandled())
             return;
@@ -1235,13 +1207,13 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
                 form()->reset();
             else {
                 m_activeSubmit = true;
-                // FIXME: Would be cleaner to get xPos and yPos out of the underlying mouse
+                // FIXME: Would be cleaner to get m_xPos and m_yPos out of the underlying mouse
                 // event (if any) here instead of relying on the variables set above when
                 // processing the click event. Even better, appendFormData could pass the
-                // event in, and then we could get rid of xPos and yPos altogether!
+                // event in, and then we could get rid of m_xPos and m_yPos altogether!
                 if (!form()->prepareSubmit(evt)) {
-                    xPos = 0;
-                    yPos = 0;
+                    m_xPos = 0;
+                    m_yPos = 0;
                 }
                 m_activeSubmit = false;
             }
@@ -1259,12 +1231,16 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
         if (charCode == '\r') {
             switch (inputType()) {
                 case CHECKBOX:
+                case EMAIL:
                 case HIDDEN:
                 case ISINDEX:
+                case NUMBER:
                 case PASSWORD:
                 case RANGE:
                 case SEARCH:
+                case TELEPHONE:
                 case TEXT:
+                case URL:
                     // Simulate mouse click on the default form button for enter for these types of elements.
                     clickDefaultFormButton = true;
                     break;
@@ -1316,7 +1292,8 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
                 case SUBMIT:
                 case RADIO:
                     setActive(true, true);
-                    // No setDefaultHandled() - IE dispatches a keypress in this case.
+                    // No setDefaultHandled(), because IE dispatches a keypress in this case
+                    // and the caller will only dispatch a keypress if we don't call setDefaultHandled.
                     return;
                 default:
                     break;
@@ -1344,9 +1321,8 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
                     if (elt->form() != form())
                         break;
                     if (n->hasTagName(inputTag)) {
-                        // Match WinIE and don't allow unnamed radio buttons to be checked.
                         HTMLInputElement* inputElt = static_cast<HTMLInputElement*>(n);
-                        if (inputElt->inputType() == RADIO && !name().isEmpty() && inputElt->name() == name() && inputElt->isFocusable()) {
+                        if (inputElt->inputType() == RADIO && inputElt->name() == name() && inputElt->isFocusable()) {
                             inputElt->setChecked(true);
                             document()->setFocusedNode(inputElt);
                             inputElt->dispatchSimulatedClick(evt, false, false);
@@ -1382,12 +1358,16 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
                     if (!checked())
                         clickElement = true;
                     break;
+                case EMAIL:
                 case HIDDEN:
                 case ISINDEX:
+                case NUMBER:
                 case PASSWORD:
                 case RANGE:
                 case SEARCH:
+                case TELEPHONE:
                 case TEXT:
+                case URL:
                     break;
             }
         }
@@ -1407,12 +1387,12 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
         }
         // Fire onChange for text fields.
         RenderObject* r = renderer();
-        if (r && r->isTextField() && r->isEdited()) {
-            onChange();
+        if (r && r->isTextField() && toRenderTextControl(r)->isEdited()) {
+            dispatchFormControlChangeEvent();
             // Refetch the renderer since arbitrary JS code run during onchange can do anything, including destroying it.
             r = renderer();
-            if (r)
-                r->setEdited(false);
+            if (r && r->isTextField())
+                toRenderTextControl(r)->setEdited(false);
         }
         // Form may never have been present, or may have been destroyed by the change event.
         if (form())
@@ -1421,36 +1401,17 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
         return;
     }
 
-    if (evt->isBeforeTextInsertedEvent()) {
-        // Make sure that the text to be inserted will not violate the maxLength.
-        int oldLen = numGraphemeClusters(value().impl());
-        ASSERT(oldLen <= maxLength());
-        int selectionLen = numGraphemeClusters(plainText(document()->frame()->selection()->selection().toRange().get()).impl());
-        ASSERT(oldLen >= selectionLen);
-        int maxNewLen = maxLength() - (oldLen - selectionLen);
-
-        // Truncate the inserted text to avoid violating the maxLength and other constraints.
-        BeforeTextInsertedEvent* textEvent = static_cast<BeforeTextInsertedEvent*>(evt);
-        textEvent->setText(constrainValue(textEvent->text(), maxNewLen));
-    }
+    if (evt->isBeforeTextInsertedEvent())
+        InputElement::handleBeforeTextInsertedEvent(m_data, this, document(), evt);
 
     if (isTextField() && renderer() && (evt->isMouseEvent() || evt->isDragEvent() || evt->isWheelEvent() || evt->type() == eventNames().blurEvent || evt->type() == eventNames().focusEvent))
         static_cast<RenderTextControlSingleLine*>(renderer())->forwardEvent(evt);
 
-    if (inputType() == RANGE && renderer()) {
-        RenderSlider* slider = static_cast<RenderSlider*>(renderer());
-        if (evt->isMouseEvent() && evt->type() == eventNames().mousedownEvent && static_cast<MouseEvent*>(evt)->button() == LeftButton) {
-            MouseEvent* mEvt = static_cast<MouseEvent*>(evt);
-            if (!slider->mouseEventIsInThumb(mEvt)) {
-                IntPoint eventOffset(mEvt->offsetX(), mEvt->offsetY());
-                if (mEvt->target() != this) // Does this ever happen now? Was added for <video> controls
-                    eventOffset = roundedIntPoint(renderer()->absoluteToLocal(FloatPoint(mEvt->pageX(), mEvt->pageY()), false, true));
-                slider->setValueForPosition(slider->positionForOffset(eventOffset));
-            }
-        }
-        if (evt->isMouseEvent() || evt->isDragEvent() || evt->isWheelEvent())
-            slider->forwardEvent(evt);
-    }
+    if (inputType() == RANGE && renderer() && (evt->isMouseEvent() || evt->isDragEvent() || evt->isWheelEvent()))
+        static_cast<RenderSlider*>(renderer())->forwardEvent(evt);
+
+    if (!callBaseClassEarly && !evt->defaultHandled())
+        HTMLFormControlElementWithState::defaultEventHandler(evt);
 }
 
 bool HTMLInputElement::isURLAttribute(Attribute *attr) const
@@ -1478,6 +1439,11 @@ void HTMLInputElement::setDefaultChecked(bool defaultChecked)
     setAttribute(checkedAttr, defaultChecked ? "" : 0);
 }
 
+void HTMLInputElement::setDefaultName(const AtomicString& name)
+{
+    m_data.setName(name);
+}
+
 String HTMLInputElement::accept() const
 {
     return getAttribute(acceptAttr);
@@ -1518,11 +1484,26 @@ void HTMLInputElement::setAlt(const String &value)
     setAttribute(altAttr, value);
 }
 
+int HTMLInputElement::maxLength() const
+{
+    return m_data.maxLength();
+}
+
 void HTMLInputElement::setMaxLength(int _maxLength)
 {
     setAttribute(maxlengthAttr, String::number(_maxLength));
 }
 
+bool HTMLInputElement::multiple() const
+{
+    return !getAttribute(multipleAttr).isNull();
+}
+
+void HTMLInputElement::setMultiple(bool multiple)
+{
+    setAttribute(multipleAttr, multiple ? "" : 0);
+}
+    
 void HTMLInputElement::setSize(unsigned _size)
 {
     setAttribute(sizeAttr, String::number(_size));
@@ -1554,7 +1535,7 @@ void HTMLInputElement::setAutofilled(bool b)
         return;
         
     m_autofilled = b;
-    setChanged();
+    setNeedsStyleRecalc();
 }
 
 FileList* HTMLInputElement::files()
@@ -1566,15 +1547,7 @@ FileList* HTMLInputElement::files()
 
 String HTMLInputElement::constrainValue(const String& proposedValue) const
 {
-    return constrainValue(proposedValue, m_maxLen);
-}
-
-void HTMLInputElement::recheckValue()
-{
-    String oldValue = value();
-    String newValue = constrainValue(oldValue);
-    if (newValue != oldValue)
-        setValue(newValue);
+    return InputElement::constrainValue(this, proposedValue, m_data.maxLength());
 }
 
 bool HTMLInputElement::needsActivationCallback()
@@ -1594,40 +1567,10 @@ void HTMLInputElement::unregisterForActivationCallbackIfNeeded()
         document()->unregisterForDocumentActivationCallbacks(this);
 }
 
-void HTMLInputElement::updatePlaceholderVisibility(bool placeholderValueChanged)
+void HTMLInputElement::cacheSelection(int start, int end)
 {
-    ASSERT(isTextField());
-
-    bool oldPlaceholderShouldBeVisible = m_placeholderShouldBeVisible;
-
-    m_placeholderShouldBeVisible = value().isEmpty() 
-        && document()->focusedNode() != this
-        && !getAttribute(placeholderAttr).isEmpty();
-
-    if ((oldPlaceholderShouldBeVisible != m_placeholderShouldBeVisible || placeholderValueChanged) && renderer())
-        static_cast<RenderTextControlSingleLine*>(renderer())->updatePlaceholderVisibility();
-}
-
-String HTMLInputElement::constrainValue(const String& proposedValue, int maxLen) const
-{
-    String string = proposedValue;
-    if (isTextField()) {
-        string.replace("\r\n", " ");
-        string.replace('\r', ' ');
-        string.replace('\n', ' ');
-        StringImpl* s = string.impl();
-        int newLen = numCharactersInGraphemeClusters(s, maxLen);
-        for (int i = 0; i < newLen; ++i) {
-            const UChar current = (*s)[i];
-            if (current < ' ' && current != '\t') {
-                newLen = i;
-                break;
-            }
-        }
-        if (newLen < static_cast<int>(string.length()))
-            return string.substring(0, newLen);
-    }
-    return string;
+    m_data.setCachedSelectionStart(start);
+    m_data.setCachedSelectionEnd(end);
 }
 
 void HTMLInputElement::addSearchResult()
@@ -1642,14 +1585,14 @@ void HTMLInputElement::onSearch()
     ASSERT(isSearchField());
     if (renderer())
         static_cast<RenderTextControlSingleLine*>(renderer())->stopSearchEventTimer();
-    dispatchEventForType(eventNames().searchEvent, true, false);
+    dispatchEvent(eventNames().searchEvent, true, false);
 }
 
-Selection HTMLInputElement::selection() const
+VisibleSelection HTMLInputElement::selection() const
 {
-   if (!renderer() || !isTextField() || cachedSelStart == -1 || cachedSelEnd == -1)
-        return Selection();
-   return static_cast<RenderTextControl*>(renderer())->selection(cachedSelStart, cachedSelEnd);
+   if (!renderer() || !isTextField() || m_data.cachedSelectionStart() == -1 || m_data.cachedSelectionEnd() == -1)
+        return VisibleSelection();
+   return toRenderTextControl(renderer())->selection(m_data.cachedSelectionStart(), m_data.cachedSelectionEnd());
 }
 
 void HTMLInputElement::documentDidBecomeActive()
@@ -1689,4 +1632,10 @@ bool HTMLInputElement::willValidate() const
     return HTMLFormControlElementWithState::willValidate() && inputType() != HIDDEN &&
            inputType() != BUTTON && inputType() != RESET;
 }
+
+bool HTMLInputElement::placeholderShouldBeVisible() const
+{
+    return m_data.placeholderShouldBeVisible();
+}
+
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
index 8636e4b..be2b4f4 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.h
@@ -25,6 +25,7 @@
 #define HTMLInputElement_h
 
 #include "HTMLFormControlElement.h"
+#include "InputElement.h"
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
@@ -32,9 +33,9 @@ namespace WebCore {
 class FileList;
 class HTMLImageLoader;
 class KURL;
-class Selection;
+class VisibleSelection;
 
-class HTMLInputElement : public HTMLFormControlElementWithState {
+class HTMLInputElement : public HTMLFormControlElementWithState, public InputElement {
 public:
     enum InputType {
         TEXT,
@@ -49,7 +50,11 @@ public:
         IMAGE,
         BUTTON,
         SEARCH,
-        RANGE
+        RANGE,
+        EMAIL,
+        NUMBER,
+        TELEPHONE,
+        URL
     };
     
     enum AutoCompleteSetting {
@@ -73,22 +78,22 @@ public:
     virtual void aboutToUnload();
     virtual bool shouldUseInputMethod() const;
 
-    virtual const AtomicString& name() const;
-
+    virtual const AtomicString& formControlName() const;
+ 
     bool autoComplete() const;
 
     // isChecked is used by the rendering tree/CSS while checked() is used by JS to determine checked state
     virtual bool isChecked() const { return checked() && (inputType() == CHECKBOX || inputType() == RADIO); }
     virtual bool isIndeterminate() const { return indeterminate(); }
     
-    bool readOnly() const { return isReadOnlyControl(); }
+    bool readOnly() const { return isReadOnlyFormControl(); }
 
-    virtual bool isTextControl() const { return isTextField(); }
+    virtual bool isTextFormControl() const { return isTextField(); }
 
     bool isTextButton() const { return m_type == SUBMIT || m_type == RESET || m_type == BUTTON; }
     virtual bool isRadioButton() const { return m_type == RADIO; }
-    bool isTextField() const { return m_type == TEXT || m_type == PASSWORD || m_type == SEARCH || m_type == ISINDEX; }
-    bool isSearchField() const { return m_type == SEARCH; }
+    virtual bool isTextField() const { return m_type == TEXT || m_type == PASSWORD || m_type == SEARCH || m_type == ISINDEX || m_type == EMAIL || m_type == NUMBER || m_type == TELEPHONE || m_type == URL; }
+    virtual bool isSearchField() const { return m_type == SEARCH; }
     virtual bool isInputTypeHidden() const { return m_type == HIDDEN; }
     virtual bool isPasswordField() const { return m_type == PASSWORD; }
 
@@ -96,21 +101,25 @@ public:
     void setChecked(bool, bool sendChangeEvent = false);
     bool indeterminate() const { return m_indeterminate; }
     void setIndeterminate(bool);
-    int maxLength() const { return m_maxLen; }
-    int size() const { return m_size; }
-    virtual const AtomicString& type() const;
+    virtual int size() const;
+    virtual const AtomicString& formControlType() const;
     void setType(const String&);
 
-    String value() const;
-    void setValue(const String&);
+    virtual String value() const;
+    virtual void setValue(const String&);
+
+    virtual String placeholder() const;
+    virtual void setPlaceholder(const String&);
+
+    virtual bool searchEventsShouldBeDispatched() const;
 
     String valueWithDefault() const;
 
-    void setValueFromRenderer(const String&);
+    virtual void setValueFromRenderer(const String&);
     void setFileListFromRenderer(const Vector<String>&);
 
-    virtual bool saveState(String& value) const;
-    virtual void restoreState(const String&);
+    virtual bool saveFormControlState(String& value) const;
+    virtual void restoreFormControlState(const String&);
 
     virtual bool canStartSelection() const;
     
@@ -119,7 +128,7 @@ public:
     int selectionEnd() const;
     void setSelectionStart(int);
     void setSelectionEnd(int);
-    void select();
+    virtual void select();
     void setSelectionRange(int start, int end);
 
     virtual void accessKeyAction(bool sendToAnyElement);
@@ -163,6 +172,8 @@ public:
     bool defaultChecked() const;
     void setDefaultChecked(bool);
 
+    void setDefaultName(const AtomicString&);
+
     String accept() const;
     void setAccept(const String&);
 
@@ -180,23 +191,27 @@ public:
     KURL src() const;
     void setSrc(const String&);
 
+    int maxLength() const;
     void setMaxLength(int);
 
+    bool multiple() const;
+    void setMultiple(bool);
+
     String useMap() const;
     void setUseMap(const String&);
 
     virtual bool isAutofilled() const { return m_autofilled; }
-    void setAutofilled(bool b = true);
+    void setAutofilled(bool value = true);
 
     FileList* files();
 
-    void cacheSelection(int s, int e) { cachedSelStart = s; cachedSelEnd = e; };
+    virtual void cacheSelection(int start, int end);
     void addSearchResult();
     void onSearch();
-    
-    Selection selection() const;
 
-    String constrainValue(const String& proposedValue) const;
+    VisibleSelection selection() const;
+
+    virtual String constrainValue(const String& proposedValue) const;
 
     virtual void documentDidBecomeActive();
 
@@ -204,40 +219,31 @@ public:
     
     virtual bool willValidate() const;
 
-    bool placeholderShouldBeVisible() const { return m_placeholderShouldBeVisible; }
+    virtual bool placeholderShouldBeVisible() const;
     
 protected:
     virtual void willMoveToNewOwnerDocument();
     virtual void didMoveToNewOwnerDocument();
-    
-    AtomicString m_name;
+
+    void updatePlaceholderVisibility()
+    {
+        InputElement::updatePlaceholderVisibility(m_data, this, this, true);
+    }
 
 private:
-    void init();
     bool storesValueSeparateFromAttribute() const;
-    String constrainValue(const String& proposedValue, int maxLen) const;
-    void recheckValue();
-    
+
     bool needsActivationCallback();
     void registerForActivationCallbackIfNeeded();
     void unregisterForActivationCallbackIfNeeded();
 
-    void updatePlaceholderVisibility(bool placeholderValueChanged = false);
-    
-    String m_value;
-    String m_originalValue;
-    int xPos;
-    int yPos;
-    int m_maxLen;
-    int m_size;
-
+    InputElementData m_data;
+    int m_xPos;
+    int m_yPos;
     short m_maxResults;
-
     OwnPtr<HTMLImageLoader> m_imageLoader;
-
     RefPtr<FileList> m_fileList;
-
-    unsigned m_type : 4; // InputType 
+    unsigned m_type : 5; // InputType 
     bool m_checked : 1;
     bool m_defaultChecked : 1;
     bool m_useDefaultChecked : 1;
@@ -247,10 +253,6 @@ private:
     unsigned m_autocomplete : 2; // AutoCompleteSetting
     bool m_autofilled : 1;
     bool m_inited : 1;
-    bool m_placeholderShouldBeVisible : 1;
-    
-    int cachedSelStart;
-    int cachedSelEnd;
 };
 
 } //namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl
index a9b6d2c..5536733 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLInputElement.idl
@@ -21,7 +21,6 @@
 module html {
 
     interface [
-        CustomGetOwnPropertySlot,
         GenerateConstructor,
         InterfaceUUID=8f388ea3-1c31-4cca-8edd-449d14e222e1,
         ImplementationUUID=aeb56b87-a90e-4d9d-a4d5-7eec3687c338
@@ -37,16 +36,18 @@ module html {
                  attribute boolean         disabled;
                  attribute boolean         autofocus;
                  attribute long            maxLength;
+                 attribute boolean         multiple;
                  attribute [ConvertNullToNullString] DOMString name;
+                 attribute DOMString       placeholder;
                  attribute boolean         readOnly;
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
                  attribute [ConvertToString] DOMString size; // DOM level 2 changed this to a long, but our existing API is a string
 #else
                  // FIXME: the spec says this should be a long, not an unsigned long
                  attribute unsigned long   size; // Changed string -> long as part of DOM level 2
 #endif
                  attribute [ConvertNullToNullString] DOMString src;
-                 attribute [ConvertNullToNullString] DOMString type; // readonly dropped as part of DOM level 2
+                 attribute [ConvertNullToNullString, JSCCustomGetter] DOMString type; // readonly dropped as part of DOM level 2
                  attribute [ConvertNullToNullString] DOMString useMap;
                  attribute [ConvertNullToNullString] DOMString value;
         readonly attribute boolean         willValidate;
@@ -58,9 +59,9 @@ module html {
 
         // WinIE & FireFox extension:
 
-                 attribute [CustomGetter] long selectionStart;
-                 attribute [CustomGetter] long selectionEnd;
-        void               setSelectionRange(in long start, in long end);
+                 attribute [Custom] long selectionStart;
+                 attribute [Custom] long selectionEnd;
+        [Custom] void setSelectionRange(in long start, in long end);
 
 #if defined(LANGUAGE_OBJECTIVE_C)
         // Objective-C extension:
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLIsIndexElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLIsIndexElement.cpp
index ee66ca8..bcfa623 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLIsIndexElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLIsIndexElement.cpp
@@ -24,7 +24,9 @@
 
 #include "config.h"
 #include "HTMLIsIndexElement.h"
+
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
@@ -34,13 +36,15 @@ HTMLIsIndexElement::HTMLIsIndexElement(const QualifiedName& tagName, Document *d
     : HTMLInputElement(tagName, doc, f)
 {
     ASSERT(hasTagName(isindexTag));
-    m_name = "isindex";
+    setDefaultName(isindexTag.localName());
 }
 
 void HTMLIsIndexElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == promptAttr)
         setValue(attr->value());
+    else if (attr->name() == placeholderAttr)
+        updatePlaceholderVisibility();
     else
         // don't call HTMLInputElement::parseMappedAttribute here, as it would
         // accept attributes this element does not support
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLKeygenElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLKeygenElement.cpp
index 563ad3c..b1b6238 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLKeygenElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLKeygenElement.cpp
@@ -29,6 +29,7 @@
 #include "FormDataList.h"
 #include "HTMLNames.h"
 #include "HTMLOptionElement.h"
+#include "MappedAttribute.h"
 #include "SSLKeyGenerator.h"
 #include "Text.h"
 #include <wtf/StdLibExtras.h>
@@ -54,7 +55,7 @@ HTMLKeygenElement::HTMLKeygenElement(const QualifiedName& tagName, Document* doc
     }
 }
 
-const AtomicString& HTMLKeygenElement::type() const
+const AtomicString& HTMLKeygenElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, keygen, ("keygen"));
     return keygen;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLKeygenElement.h b/src/3rdparty/webkit/WebCore/html/HTMLKeygenElement.h
index 7997635..b2a0c26 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLKeygenElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLKeygenElement.h
@@ -33,7 +33,7 @@ public:
     HTMLKeygenElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
 
     virtual int tagPriority() const { return 0; }
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
     virtual bool isEnumeratable() const { return false; }
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual bool appendFormData(FormDataList&, bool);
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLIElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLLIElement.cpp
index 2d5518e..044b93c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLIElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLIElement.cpp
@@ -26,6 +26,7 @@
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderListItem.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLabelElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLLabelElement.cpp
index a6c4b89..06b3b2f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLabelElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLabelElement.cpp
@@ -59,7 +59,7 @@ HTMLElement* HTMLLabelElement::correspondingControl()
         while ((node = node->traverseNextNode(this))) {
             if (node->isHTMLElement()) {
                 HTMLElement* element = static_cast<HTMLElement*>(node);
-                if (element->isGenericFormElement())
+                if (element->isFormControlElement())
                     return element;
             }
         }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.cpp
index e3f48fb..d6e08c7 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.cpp
@@ -26,7 +26,6 @@
 #include "HTMLLegendElement.h"
 
 #include "HTMLNames.h"
-#include "RenderLegend.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
@@ -48,15 +47,7 @@ bool HTMLLegendElement::isFocusable() const
     return HTMLElement::isFocusable();
 }
 
-RenderObject* HTMLLegendElement::createRenderer(RenderArena* arena, RenderStyle* style)
-{
-    if (style->contentData())
-        return RenderObject::createObject(this, style);
-    
-    return new (arena) RenderLegend(this);
-}
-
-const AtomicString& HTMLLegendElement::type() const
+const AtomicString& HTMLLegendElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, legend, ("legend"));
     return legend;
@@ -97,7 +88,7 @@ Element *HTMLLegendElement::formElement()
     while ((node = node->traverseNextNode(fieldset))) {
         if (node->isHTMLElement()) {
             HTMLElement *element = static_cast<HTMLElement *>(node);
-            if (!element->hasLocalName(legendTag) && element->isGenericFormElement())
+            if (!element->hasLocalName(legendTag) && element->isFormControlElement())
                 return element;
         }
     }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.h b/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.h
index b2ee51a..713d73c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLegendElement.h
@@ -34,8 +34,7 @@ public:
     virtual ~HTMLLegendElement();
 
     virtual bool isFocusable() const;
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
     virtual void accessKeyAction(bool sendToAnyElement);
 
     /**
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp
index 192226d..cb8f36c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.cpp
@@ -2,7 +2,8 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2003, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Rob Buis (rwlbuis@gmail.com)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -33,6 +34,7 @@
 #include "FrameLoaderClient.h"
 #include "FrameTree.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "MediaList.h"
 #include "MediaQueryEvaluator.h"
 #include "Page.h"
@@ -114,7 +116,7 @@ void HTMLLinkElement::parseMappedAttribute(MappedAttribute *attr)
         tokenizeRelAttribute(attr->value(), m_isStyleSheet, m_alternate, m_isIcon, m_isDNSPrefetch);
         process();
     } else if (attr->name() == hrefAttr) {
-        m_url = document()->completeURL(parseURL(attr->value())).string();
+        m_url = document()->completeURL(parseURL(attr->value()));
         process();
     } else if (attr->name() == typeAttr) {
         m_type = attr->value();
@@ -173,46 +175,37 @@ void HTMLLinkElement::process()
 
     // IE extension: location of small icon for locationbar / bookmarks
     // We'll record this URL per document, even if we later only use it in top level frames
-    if (m_isIcon && !m_url.isEmpty())
-        document()->setIconURL(m_url, type);
+    if (m_isIcon && m_url.isValid() && !m_url.isEmpty())
+        document()->setIconURL(m_url.string(), type);
 
-    if (m_isDNSPrefetch && !m_url.isEmpty())
-        prefetchDNS(KURL(m_url).host());
+    if (m_isDNSPrefetch && m_url.isValid() && !m_url.isEmpty())
+        prefetchDNS(m_url.host());
 
     // Stylesheet
     // This was buggy and would incorrectly match <link rel="alternate">, which has a different specified meaning. -dwh
-    if (m_disabledState != 2 && m_isStyleSheet && document()->frame()) {
-        // no need to load style sheets which aren't for the screen output
-        // ### there may be in some situations e.g. for an editor or script to manipulate
+    if (m_disabledState != 2 && m_isStyleSheet && document()->frame() && m_url.isValid()) {
         // also, don't load style sheets for standalone documents
-        MediaQueryEvaluator allEval(true);
-        MediaQueryEvaluator screenEval("screen", true);
-        MediaQueryEvaluator printEval("print", true);
-        RefPtr<MediaList> media = MediaList::createAllowingDescriptionSyntax(m_media);
-        if (allEval.eval(media.get()) || screenEval.eval(media.get()) || printEval.eval(media.get())) {
-
-            // Add ourselves as a pending sheet, but only if we aren't an alternate 
-            // stylesheet.  Alternate stylesheets don't hold up render tree construction.
-            if (!isAlternate())
-                document()->addPendingSheet();
+        // Add ourselves as a pending sheet, but only if we aren't an alternate 
+        // stylesheet.  Alternate stylesheets don't hold up render tree construction.
+        if (!isAlternate())
+            document()->addPendingSheet();
+
+        String charset = getAttribute(charsetAttr);
+        if (charset.isEmpty() && document()->frame())
+            charset = document()->frame()->loader()->encoding();
 
-            String chset = getAttribute(charsetAttr);
-            if (chset.isEmpty() && document()->frame())
-                chset = document()->frame()->loader()->encoding();
-            
-            if (m_cachedSheet) {
-                if (m_loading)
-                    document()->removePendingSheet();
-                m_cachedSheet->removeClient(this);
-            }
-            m_loading = true;
-            m_cachedSheet = document()->docLoader()->requestCSSStyleSheet(m_url, chset);
-            if (m_cachedSheet)
-                m_cachedSheet->addClient(this);
-            else if (!isAlternate()) { // request may have been denied if stylesheet is local and document is remote.
-                m_loading = false;
+        if (m_cachedSheet) {
+            if (m_loading)
                 document()->removePendingSheet();
-            }
+            m_cachedSheet->removeClient(this);
+        }
+        m_loading = true;
+        m_cachedSheet = document()->docLoader()->requestCSSStyleSheet(m_url, charset);
+        if (m_cachedSheet)
+            m_cachedSheet->addClient(this);
+        else if (!isAlternate()) { // The request may have been denied if stylesheet is local and document is remote.
+            m_loading = false;
+            document()->removePendingSheet();
         }
     } else if (m_sheet) {
         // we no longer contain a stylesheet, e.g. perhaps rel or type was changed
@@ -232,11 +225,11 @@ void HTMLLinkElement::removedFromDocument()
 {
     HTMLElement::removedFromDocument();
 
+    document()->removeStyleSheetCandidateNode(this);
+
     // FIXME: It's terrible to do a synchronous update of the style selector just because a <style> or <link> element got removed.
-    if (document()->renderer()) {
-        document()->removeStyleSheetCandidateNode(this);
+    if (document()->renderer())
         document()->updateStyleSelector();
-    }
 }
 
 void HTMLLinkElement::finishParsingChildren()
@@ -384,11 +377,10 @@ void HTMLLinkElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
 {
     HTMLElement::addSubresourceAttributeURLs(urls);
 
-    if (m_isIcon) {
-        addSubresourceURL(urls, href());
+    // Favicons are handled by a special case in LegacyWebArchive::create()
+    if (m_isIcon)
         return;
-    }
-    
+
     if (!m_isStyleSheet)
         return;
     
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.h b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.h
index b41fc9e..aacac92 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.h
@@ -102,7 +102,7 @@ public:
 protected:
     CachedResourceHandle<CachedCSSStyleSheet> m_cachedSheet;
     RefPtr<CSSStyleSheet> m_sheet;
-    String m_url;
+    KURL m_url;
     String m_type;
     String m_media;
     int m_disabledState; // 0=unset(default), 1=enabled via script, 2=disabled
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.idl
index 532ac31..98de809 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLLinkElement.idl
@@ -35,12 +35,12 @@ module html {
         attribute  [ConvertNullToNullString] DOMString            target;
         attribute  [ConvertNullToNullString] DOMString            type;
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // DOM Level 2 Style
         readonly attribute StyleSheet   sheet;
 #endif
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extension:
         readonly attribute URL absoluteLinkURL;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMapElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLMapElement.cpp
index d7109c9..90204e0 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMapElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMapElement.cpp
@@ -18,6 +18,7 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLMapElement.h"
 
@@ -25,8 +26,9 @@
 #include "HTMLAreaElement.h"
 #include "HTMLCollection.h"
 #include "HTMLNames.h"
-#include "IntSize.h"
 #include "HitTestResult.h"
+#include "IntSize.h"
+#include "MappedAttribute.h"
 
 using namespace std;
 
@@ -96,7 +98,7 @@ void HTMLMapElement::parseMappedAttribute(MappedAttribute* attr)
 
 PassRefPtr<HTMLCollection> HTMLMapElement::areas()
 {
-    return HTMLCollection::create(this, HTMLCollection::MapAreas);
+    return HTMLCollection::create(this, MapAreas);
 }
 
 String HTMLMapElement::name() const
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.cpp
index d2d69e4..d62eaab 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.cpp
@@ -19,12 +19,14 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "HTMLMarqueeElement.h"
 
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderLayer.h"
 #include "RenderMarquee.h"
 
@@ -37,6 +39,7 @@ const int defaultMinimumDelay = 60;
 
 HTMLMarqueeElement::HTMLMarqueeElement(const QualifiedName& tagName, Document* doc)
     : HTMLElement(tagName, doc)
+    , ActiveDOMObject(doc, this)
     , m_minimumDelay(defaultMinimumDelay)
 {
     ASSERT(hasTagName(marqueeTag));
@@ -109,14 +112,31 @@ void HTMLMarqueeElement::parseMappedAttribute(MappedAttribute *attr)
 
 void HTMLMarqueeElement::start()
 {
-    if (renderer() && renderer()->hasLayer() && renderer()->layer()->marquee())
-        renderer()->layer()->marquee()->start();
+    if (renderer() && renderer()->hasLayer() && renderBox()->layer()->marquee())
+        renderBox()->layer()->marquee()->start();
 }
 
 void HTMLMarqueeElement::stop()
 {
-    if (renderer() && renderer()->hasLayer() && renderer()->layer()->marquee())
-        renderer()->layer()->marquee()->stop();
+    if (renderer() && renderer()->hasLayer() && renderBox()->layer()->marquee())
+        renderBox()->layer()->marquee()->stop();
+}
+
+bool HTMLMarqueeElement::canSuspend() const
+{
+    return true;
+}
+
+void HTMLMarqueeElement::suspend()
+{
+    if (renderer() && renderer()->hasLayer() && renderBox()->layer()->marquee())
+        renderBox()->layer()->marquee()->suspend();
+}
+    
+void HTMLMarqueeElement::resume()
+{
+    if (renderer() && renderer()->hasLayer() && renderBox()->layer()->marquee())
+        renderBox()->layer()->marquee()->updateMarqueePosition();
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.h b/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.h
index acd639b..2423fc6 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMarqueeElement.h
@@ -23,11 +23,12 @@
 #ifndef HTMLMarqueeElement_h
 #define HTMLMarqueeElement_h
 
+#include "ActiveDOMObject.h"
 #include "HTMLElement.h"
 
 namespace WebCore {
 
-class HTMLMarqueeElement : public HTMLElement {
+class HTMLMarqueeElement : public HTMLElement, private ActiveDOMObject {
 public:
     HTMLMarqueeElement(const QualifiedName&, Document*);
     
@@ -45,6 +46,11 @@ public:
     void stop();
     
 private:
+    // ActiveDOMObject
+    virtual bool canSuspend() const;
+    virtual void suspend();
+    virtual void resume();
+
     int m_minimumDelay;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
index df38f01..3d48b82 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,25 +31,43 @@
 #include "CSSHelper.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
+#include "ContentType.h"
+#include "DocLoader.h"
 #include "Event.h"
 #include "EventNames.h"
 #include "ExceptionCode.h"
+#include "Frame.h"
+#include "FrameLoader.h"
 #include "HTMLDocument.h"
 #include "HTMLNames.h"
 #include "HTMLSourceElement.h"
 #include "HTMLVideoElement.h"
-#include <limits>
+#include "MIMETypeRegistry.h"
+#include "MappedAttribute.h"
+#include "MediaDocument.h"
 #include "MediaError.h"
 #include "MediaList.h"
-#include "MediaQueryEvaluator.h"
-#include "MIMETypeRegistry.h"
 #include "MediaPlayer.h"
+#include "MediaQueryEvaluator.h"
 #include "Page.h"
+#include "ProgressEvent.h"
 #include "RenderVideo.h"
-#include "SystemTime.h"
+#include "ScriptEventListener.h"
 #include "TimeRanges.h"
+#include <limits>
+#include <wtf/CurrentTime.h>
 #include <wtf/MathExtras.h>
 
+#if USE(ACCELERATED_COMPOSITING)
+#include "RenderView.h"
+#include "RenderLayerCompositor.h"
+#endif
+
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+#include "RenderPartObject.h"
+#include "Widget.h"
+#endif
+
 using namespace std;
 
 namespace WebCore {
@@ -61,27 +79,40 @@ HTMLMediaElement::HTMLMediaElement(const QualifiedName& tagName, Document* doc)
     , m_loadTimer(this, &HTMLMediaElement::loadTimerFired)
     , m_asyncEventTimer(this, &HTMLMediaElement::asyncEventTimerFired)
     , m_progressEventTimer(this, &HTMLMediaElement::progressEventTimerFired)
+    , m_playbackProgressTimer(this, &HTMLMediaElement::playbackProgressTimerFired)
+    , m_playedTimeRanges()
+    , m_playbackRate(1.0f)
     , m_defaultPlaybackRate(1.0f)
-    , m_networkState(EMPTY)
-    , m_readyState(DATA_UNAVAILABLE)
-    , m_begun(false)
-    , m_loadedFirstFrame(false)
-    , m_autoplaying(true)
-    , m_currentLoop(0)
+    , m_webkitPreservesPitch(true)
+    , m_networkState(NETWORK_EMPTY)
+    , m_readyState(HAVE_NOTHING)
     , m_volume(1.0f)
+    , m_lastSeekTime(0)
+    , m_previousProgress(0)
+    , m_previousProgressTime(numeric_limits<double>::max())
+    , m_lastTimeUpdateEventWallTime(0)
+    , m_lastTimeUpdateEventMovieTime(numeric_limits<float>::max())
+    , m_loadState(WaitingForSource)
+    , m_currentSourceNode(0)
+    , m_player(0)
+    , m_restrictions(NoRestrictions)
+    , m_playing(false)
+    , m_processingMediaPlayerCallback(0)
+    , m_processingLoad(false)
+    , m_delayingTheLoadEvent(false)
+    , m_haveFiredLoadedData(false)
+    , m_inActiveDocument(true)
+    , m_autoplaying(true)
     , m_muted(false)
     , m_paused(true)
     , m_seeking(false)
-    , m_currentTimeDuringSeek(0)
-    , m_previousProgress(0)
-    , m_previousProgressTime(numeric_limits<double>::max())
     , m_sentStalledEvent(false)
-    , m_bufferingRate(0)
-    , m_loadNestingLevel(0)
-    , m_terminateLoadBelowNestingLevel(0)
+    , m_sentEndEvent(false)
     , m_pausedInternal(false)
-    , m_inActiveDocument(true)
-    , m_player(0)
+    , m_sendProgressEvents(true)
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    , m_needWidgetUpdate(false)
+#endif
 {
     document()->registerForDocumentActivationCallbacks(this);
     document()->registerForMediaVolumeCallbacks(this);
@@ -104,11 +135,12 @@ void HTMLMediaElement::attributeChanged(Attribute* attr, bool preserveDecls)
 
     const QualifiedName& attrName = attr->name();
     if (attrName == srcAttr) {
-        // 3.14.9.2.
-        // change to src attribute triggers load()
-        if (inDocument() && m_networkState == EMPTY)
+        // don't have a src or any <source> children, trigger load
+        if (inDocument() && m_loadState == WaitingForSource)
             scheduleLoad();
-    } if (attrName == controlsAttr) {
+    } 
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    else if (attrName == controlsAttr) {
         if (!isVideo() && attached() && (controls() != (renderer() != 0))) {
             detach();
             attach();
@@ -116,16 +148,87 @@ void HTMLMediaElement::attributeChanged(Attribute* attr, bool preserveDecls)
         if (renderer())
             renderer()->updateFromElement();
     }
+#endif
 }
-    
+
+void HTMLMediaElement::parseMappedAttribute(MappedAttribute* attr)
+{
+    const QualifiedName& attrName = attr->name();
+
+    if (attrName == autobufferAttr) {
+        if (m_player)
+            m_player->setAutobuffer(!attr->isNull());
+    } else if (attrName == onabortAttr)
+        setAttributeEventListener(eventNames().abortEvent, createAttributeEventListener(this, attr));
+    else if (attrName == oncanplayAttr)
+        setAttributeEventListener(eventNames().canplayEvent, createAttributeEventListener(this, attr));
+    else if (attrName == oncanplaythroughAttr)
+        setAttributeEventListener(eventNames().canplaythroughEvent, createAttributeEventListener(this, attr));
+    else if (attrName == ondurationchangeAttr)
+        setAttributeEventListener(eventNames().durationchangeEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onemptiedAttr)
+        setAttributeEventListener(eventNames().emptiedEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onendedAttr)
+        setAttributeEventListener(eventNames().endedEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onerrorAttr)
+        setAttributeEventListener(eventNames().errorEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onloadAttr)
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onloadeddataAttr)
+        setAttributeEventListener(eventNames().loadeddataEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onloadedmetadataAttr)
+        setAttributeEventListener(eventNames().loadedmetadataEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onloadstartAttr)
+        setAttributeEventListener(eventNames().loadstartEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onpauseAttr)
+        setAttributeEventListener(eventNames().pauseEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onplayAttr)
+        setAttributeEventListener(eventNames().playEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onplayingAttr)
+        setAttributeEventListener(eventNames().playingEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onprogressAttr)
+        setAttributeEventListener(eventNames().progressEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onratechangeAttr)
+        setAttributeEventListener(eventNames().ratechangeEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onseekedAttr)
+        setAttributeEventListener(eventNames().seekedEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onseekingAttr)
+        setAttributeEventListener(eventNames().seekingEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onstalledAttr)
+        setAttributeEventListener(eventNames().stalledEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onsuspendAttr)
+        setAttributeEventListener(eventNames().suspendEvent, createAttributeEventListener(this, attr));
+    else if (attrName == ontimeupdateAttr)
+        setAttributeEventListener(eventNames().timeupdateEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onvolumechangeAttr)
+        setAttributeEventListener(eventNames().volumechangeEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onwaitingAttr)
+        setAttributeEventListener(eventNames().waitingEvent, createAttributeEventListener(this, attr));
+    else
+        HTMLElement::parseMappedAttribute(attr);
+}
+
 bool HTMLMediaElement::rendererIsNeeded(RenderStyle* style)
 {
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    UNUSED_PARAM(style);
+    Frame* frame = document()->frame();
+    if (!frame)
+        return false;
+
+    return true;
+#else
     return controls() ? HTMLElement::rendererIsNeeded(style) : false;
+#endif
 }
 
 RenderObject* HTMLMediaElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    return new (arena) RenderPartObject(this);
+#else
     return new (arena) RenderMedia(this);
+#endif
 }
  
 void HTMLMediaElement::insertedIntoDocument()
@@ -137,10 +240,8 @@ void HTMLMediaElement::insertedIntoDocument()
 
 void HTMLMediaElement::removedFromDocument()
 {
-    // FIXME: pause() may invoke load() which seem like a strange thing to do as a side effect
-    // of removing an element. This might need to be fixed in the spec.
-    ExceptionCode ec;
-    pause(ec);
+    if (m_networkState > NETWORK_EMPTY)
+        pause();
     HTMLElement::removedFromDocument();
 }
 
@@ -148,6 +249,10 @@ void HTMLMediaElement::attach()
 {
     ASSERT(!attached());
 
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    m_needWidgetUpdate = true;
+#endif
+
     HTMLElement::attach();
 
     if (renderer())
@@ -167,39 +272,56 @@ void HTMLMediaElement::scheduleLoad()
     m_loadTimer.startOneShot(0);
 }
 
-void HTMLMediaElement::initAndDispatchProgressEvent(const AtomicString& eventName)
+void HTMLMediaElement::scheduleProgressEvent(const AtomicString& eventName)
 {
+    if (!m_sendProgressEvents)
+        return;
+
+    // FIXME: don't schedule timeupdate or progress events unless there are registered listeners
+
     bool totalKnown = m_player && m_player->totalBytesKnown();
     unsigned loaded = m_player ? m_player->bytesLoaded() : 0;
     unsigned total = m_player ? m_player->totalBytes() : 0;
-    dispatchProgressEvent(eventName, totalKnown, loaded, total);
+
+    RefPtr<ProgressEvent> evt = ProgressEvent::create(eventName, totalKnown, loaded, total);
+    enqueueEvent(evt);
+
     if (renderer())
         renderer()->updateFromElement();
 }
 
-void HTMLMediaElement::dispatchEventAsync(const AtomicString& eventName)
+void HTMLMediaElement::scheduleEvent(const AtomicString& eventName)
 {
-    m_asyncEventsToDispatch.append(eventName);
-    if (!m_asyncEventTimer.isActive())                            
-        m_asyncEventTimer.startOneShot(0);
+    enqueueEvent(Event::create(eventName, false, true));
 }
 
-void HTMLMediaElement::loadTimerFired(Timer<HTMLMediaElement>*)
+void HTMLMediaElement::enqueueEvent(RefPtr<Event> event)
 {
-    ExceptionCode ec;
-    load(ec);
+    m_pendingEvents.append(event);
+    if (!m_asyncEventTimer.isActive())
+        m_asyncEventTimer.startOneShot(0);
 }
 
 void HTMLMediaElement::asyncEventTimerFired(Timer<HTMLMediaElement>*)
 {
-    Vector<AtomicString> asyncEventsToDispatch;
-    m_asyncEventsToDispatch.swap(asyncEventsToDispatch);
-    unsigned count = asyncEventsToDispatch.size();
-    for (unsigned n = 0; n < count; ++n)
-        dispatchEventForType(asyncEventsToDispatch[n], false, true);
+    Vector<RefPtr<Event> > pendingEvents;
+    ExceptionCode ec = 0;
+
+    m_pendingEvents.swap(pendingEvents);
+    unsigned count = pendingEvents.size();
+    for (unsigned ndx = 0; ndx < count; ++ndx) 
+        dispatchEvent(pendingEvents[ndx].release(), ec);
 }
 
-String serializeTimeOffset(float time)
+void HTMLMediaElement::loadTimerFired(Timer<HTMLMediaElement>*)
+{
+    if (m_loadState == LoadingFromSourceElement)
+        loadNextSourceChild();
+    else
+        loadInternal();
+}
+
+static String serializeTimeOffset(float time)
 {
     String timeString = String::number(time);
     // FIXME serialize time offset values properly (format not specified yet)
@@ -207,7 +329,7 @@ String serializeTimeOffset(float time)
     return timeString;
 }
 
-float parseTimeOffset(const String& timeString, bool* ok = 0)
+static float parseTimeOffset(const String& timeString, bool* ok = 0)
 {
     const UChar* characters = timeString.characters();
     unsigned length = timeString.length();
@@ -260,252 +382,457 @@ HTMLMediaElement::NetworkState HTMLMediaElement::networkState() const
     return m_networkState;
 }
 
-float HTMLMediaElement::bufferingRate()
+String HTMLMediaElement::canPlayType(const String& mimeType) const
 {
-    if (!m_player)
-        return 0;
-    return m_bufferingRate;
-    //return m_player->dataRate();
+    MediaPlayer::SupportsType support = MediaPlayer::supportsType(ContentType(mimeType));
+    String canPlay;
+
+    // 4.8.10.3
+    switch (support)
+    {
+        case MediaPlayer::IsNotSupported:
+            canPlay = "no";
+            break;
+        case MediaPlayer::MayBeSupported:
+            canPlay = "maybe";
+            break;
+        case MediaPlayer::IsSupported:
+            canPlay = "probably";
+            break;
+    }
+    
+    return canPlay;
 }
 
 void HTMLMediaElement::load(ExceptionCode& ec)
 {
-    String mediaSrc;
-    
-    // 3.14.9.4. Loading the media resource
-    // 1
-    // if an event generated during load() ends up re-entering load(), terminate previous instances
-    m_loadNestingLevel++;
-    m_terminateLoadBelowNestingLevel = m_loadNestingLevel;
-    
-    m_progressEventTimer.stop();
-    m_sentStalledEvent = false;
-    m_bufferingRate = 0;
+    if (m_restrictions & RequireUserGestureForLoadRestriction && !processingUserGesture())
+        ec = INVALID_STATE_ERR;
+    else
+        loadInternal();
+}
+
+void HTMLMediaElement::loadInternal()
+{
+    // 1 - If the load() method for this element is already being invoked, then abort these steps.
+    if (m_processingLoad)
+        return;
+    m_processingLoad = true;
     
+    stopPeriodicTimers();
     m_loadTimer.stop();
+    m_sentStalledEvent = false;
+    m_haveFiredLoadedData = false;
+
+    // 2 - Abort any already-running instance of the resource selection algorithm for this element.
+    m_currentSourceNode = 0;
+
+    // 3 - If there are any tasks from the media element's media element event task source in 
+    // one of the task queues, then remove those tasks.
+    cancelPendingEventsAndCallbacks();
     
-    // 2
-    if (m_begun) {
-        m_begun = false;
+    // 4 - If the media element's networkState is set to NETWORK_LOADING or NETWORK_IDLE, set the 
+    // error attribute to a new MediaError object whose code attribute is set to MEDIA_ERR_ABORTED, 
+    // and fire a progress event called abort at the media element.
+    if (m_networkState == NETWORK_LOADING || m_networkState == NETWORK_IDLE) {
         m_error = MediaError::create(MediaError::MEDIA_ERR_ABORTED);
-        initAndDispatchProgressEvent(eventNames().abortEvent);
-        if (m_loadNestingLevel < m_terminateLoadBelowNestingLevel)
-            goto end;
+        
+        // fire synchronous 'abort'
+        bool totalKnown = m_player && m_player->totalBytesKnown();
+        unsigned loaded = m_player ? m_player->bytesLoaded() : 0;
+        unsigned total = m_player ? m_player->totalBytes() : 0;
+        dispatchProgressEvent(eventNames().abortEvent, totalKnown, loaded, total);
     }
     
-    // 3
+    // 5 
     m_error = 0;
-    m_loadedFirstFrame = false;
     m_autoplaying = true;
+    m_playedTimeRanges = TimeRanges::create();
+    m_lastSeekTime = 0;
+
+    // 6
+    setPlaybackRate(defaultPlaybackRate());
     
-    // 4
-    setPlaybackRate(defaultPlaybackRate(), ec);
-    
-    // 5
-    if (networkState() != EMPTY) {
-        m_networkState = EMPTY;
-        m_readyState = DATA_UNAVAILABLE;
+    // 7
+    if (m_networkState != NETWORK_EMPTY) {
+        m_networkState = NETWORK_EMPTY;
+        m_readyState = HAVE_NOTHING;
         m_paused = true;
         m_seeking = false;
         if (m_player) {
             m_player->pause();
+            m_playing = false;
             m_player->seek(0);
         }
-        m_currentLoop = 0;
-        dispatchEventForType(eventNames().emptiedEvent, false, true);
-        if (m_loadNestingLevel < m_terminateLoadBelowNestingLevel)
-            goto end;
+        dispatchEvent(eventNames().emptiedEvent, false, true);
     }
     
-    // 6
-    mediaSrc = pickMedia();
-    if (mediaSrc.isEmpty()) {
-        ec = INVALID_STATE_ERR;
-        goto end;
+    selectMediaResource();
+    m_processingLoad = false;
+}
+
+void HTMLMediaElement::selectMediaResource()
+{
+    // 1 - If the media element has neither a src attribute nor any source element children, run these substeps
+    String mediaSrc = getAttribute(srcAttr);
+    if (!mediaSrc && !havePotentialSourceChild()) {
+        m_loadState = WaitingForSource;
+
+        // 1 -  Set the networkState to NETWORK_NO_SOURCE
+        m_networkState = NETWORK_NO_SOURCE;
+        
+        // 2 - While the media element has neither a src attribute nor any source element children, 
+        // wait. (This steps might wait forever.)
+
+        m_delayingTheLoadEvent = false;
+        return;
     }
-    
-    // 7
-    m_networkState = LOADING;
-    
-    // 8
-    m_currentSrc = mediaSrc;
-    
-    // 9
-    m_begun = true;        
-    dispatchProgressEvent(eventNames().loadstartEvent, false, 0, 0);
-    if (m_loadNestingLevel < m_terminateLoadBelowNestingLevel)
-        goto end;
-    
-    // 10, 11, 12, 13
+
+    // 2
+    m_delayingTheLoadEvent = true;
+
+    // 3
+    m_networkState = NETWORK_LOADING;
+
+    // 4
+    scheduleProgressEvent(eventNames().loadstartEvent);
+
+    // 5 - If the media element has a src attribute, then run these substeps
+    ContentType contentType("");
+    if (!mediaSrc.isEmpty()) {
+        KURL mediaURL = document()->completeURL(mediaSrc);
+        if (isSafeToLoadURL(mediaURL, Complain)) {
+            m_loadState = LoadingFromSrcAttr;
+            loadResource(mediaURL, contentType);
+        } else 
+            noneSupported();
+
+        return;
+    }
+
+    // Otherwise, the source elements will be used
+    m_currentSourceNode = 0;
+    loadNextSourceChild();
+}
+
+void HTMLMediaElement::loadNextSourceChild()
+{
+    ContentType contentType("");
+    KURL mediaURL = selectNextSourceChild(&contentType, Complain);
+    if (!mediaURL.isValid()) {
+        // It seems wrong to fail silently when we give up because no suitable <source>
+        // element can be found and set the error attribute if the element's 'src' attribute
+        // fails, but that is what the spec says.
+        return;
+    }
+
+    m_loadState = LoadingFromSourceElement;
+    loadResource(mediaURL, contentType);
+}
+
+void HTMLMediaElement::loadResource(const KURL& url, ContentType& contentType)
+{
+    ASSERT(isSafeToLoadURL(url, Complain));
+
+    // The resource fetch algorithm 
+    m_networkState = NETWORK_LOADING;
+
+    m_currentSrc = url;
+
+    if (m_sendProgressEvents) 
+        startProgressEventTimer();
+
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     m_player.clear();
     m_player.set(new MediaPlayer(this));
+#else
+    if (!m_player)
+        m_player.set(new MediaPlayer(this));
+#endif
+
+    m_player->setPreservesPitch(m_webkitPreservesPitch);
     updateVolume();
-    m_player->load(m_currentSrc);
-    if (m_loadNestingLevel < m_terminateLoadBelowNestingLevel)
-        goto end;
+
+    m_player->load(m_currentSrc, contentType);
     
     if (renderer())
         renderer()->updateFromElement();
+}
+
+bool HTMLMediaElement::isSafeToLoadURL(const KURL& url, InvalidSourceAction actionIfInvalid)
+{
+    Frame* frame = document()->frame();
+    FrameLoader* loader = frame ? frame->loader() : 0;
+
+    // don't allow remote to local urls
+    if (!loader || !loader->canLoad(url, String(), document())) {
+        if (actionIfInvalid == Complain)
+            FrameLoader::reportLocalLoadFailed(frame, url.string());
+        return false;
+    }
     
-    // 14
-    m_previousProgressTime = WebCore::currentTime();
+    return true;
+}
+
+void HTMLMediaElement::startProgressEventTimer()
+{
+    if (m_progressEventTimer.isActive())
+        return;
+
+    m_previousProgressTime = WTF::currentTime();
     m_previousProgress = 0;
-    if (m_begun)
-        // 350ms is not magic, it is in the spec!
-        m_progressEventTimer.startRepeating(0.350);
-end:
-    ASSERT(m_loadNestingLevel);
-    m_loadNestingLevel--;
+    // 350ms is not magic, it is in the spec!
+    m_progressEventTimer.startRepeating(0.350);
+}
+
+void HTMLMediaElement::noneSupported()
+{
+    stopPeriodicTimers();
+    m_loadState = WaitingForSource;
+    m_currentSourceNode = 0;
+
+    // 3 - Reaching this step indicates that either the URL failed to resolve, or the media 
+    // resource failed to load. Set the error attribute to a new MediaError object whose 
+    // code attribute is set to MEDIA_ERR_SRC_NOT_SUPPORTED.
+    m_error = MediaError::create(MediaError::MEDIA_ERR_SRC_NOT_SUPPORTED);
+
+    // 4- Set the element's networkState attribute to the NETWORK_NO_SOURCE value.
+    m_networkState = NETWORK_NO_SOURCE;
+
+    // 5 - Queue a task to fire a progress event called error at the media element.
+    scheduleProgressEvent(eventNames().errorEvent); 
+
+    // 6 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
+    m_delayingTheLoadEvent = false;
+
+    // Abort these steps. Until the load() method is invoked, the element won't attempt to load another resource.
+    
+    if (isVideo())
+        static_cast<HTMLVideoElement*>(this)->updatePosterImage();
+    if (renderer())
+        renderer()->updateFromElement();
+}
+
+void HTMLMediaElement::mediaEngineError(PassRefPtr<MediaError> err)
+{
+    // 1 - The user agent should cancel the fetching process.
+    stopPeriodicTimers();
+    m_loadState = WaitingForSource;
+
+    // 2 - Set the error attribute to a new MediaError object whose code attribute is 
+    // set to MEDIA_ERR_NETWORK/MEDIA_ERR_DECODE.
+    m_error = err;
+
+    // 3 - Queue a task to fire a progress event called error at the media element.
+    scheduleProgressEvent(eventNames().errorEvent); 
+
+    // 3 - Set the element's networkState attribute to the NETWORK_EMPTY value and queue a 
+    // task to fire a simple event called emptied at the element.
+    m_networkState = NETWORK_EMPTY;
+    scheduleEvent(eventNames().emptiedEvent);
+
+    // 4 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
+    m_delayingTheLoadEvent = false;
+
+    // 5 - Abort the overall resource selection algorithm.
+    m_currentSourceNode = 0;
+
+}
+
+void HTMLMediaElement::cancelPendingEventsAndCallbacks()
+{
+    m_pendingEvents.clear();
+
+    for (Node* node = firstChild(); node; node = node->nextSibling()) {
+        if (node->hasTagName(sourceTag))
+            static_cast<HTMLSourceElement*>(node)->cancelPendingErrorEvent();
+    }
 }
 
 void HTMLMediaElement::mediaPlayerNetworkStateChanged(MediaPlayer*)
 {
-    if (!m_begun || m_networkState == EMPTY)
+    beginProcessingMediaPlayerCallback();
+    setNetworkState(m_player->networkState());
+    endProcessingMediaPlayerCallback();
+}
+
+void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
+{
+    if (state == MediaPlayer::Empty) {
+        // just update the cached state and leave, we can't do anything 
+        m_networkState = NETWORK_EMPTY;
         return;
-    
-    m_terminateLoadBelowNestingLevel = m_loadNestingLevel;
+    }
 
-    MediaPlayer::NetworkState state = m_player->networkState();
-    
-    // 3.14.9.4. Loading the media resource
-    // 14
-    if (state == MediaPlayer::LoadFailed) {
-        //delete m_player;
-        //m_player = 0;
-        // FIXME better error handling
-        m_error = MediaError::create(MediaError::MEDIA_ERR_NETWORK);
-        m_begun = false;
-        m_progressEventTimer.stop();
-        m_bufferingRate = 0;
-        
-        initAndDispatchProgressEvent(eventNames().errorEvent); 
-        if (m_loadNestingLevel < m_terminateLoadBelowNestingLevel)
+    if (state == MediaPlayer::FormatError || state == MediaPlayer::NetworkError || state == MediaPlayer::DecodeError) {
+        stopPeriodicTimers();
+
+        // If we failed while trying to load a <source> element, the movie was never parsed, and there are more
+        // <source> children, schedule the next one
+        if (m_readyState < HAVE_METADATA && m_loadState == LoadingFromSourceElement) {
+            m_currentSourceNode->scheduleErrorEvent();
+            if (havePotentialSourceChild())
+                scheduleLoad();
             return;
-        
-        m_networkState = EMPTY;
-        
+        }
+
+        if (state == MediaPlayer::NetworkError)
+            mediaEngineError(MediaError::create(MediaError::MEDIA_ERR_NETWORK));
+        else if (state == MediaPlayer::DecodeError)
+            mediaEngineError(MediaError::create(MediaError::MEDIA_ERR_DECODE));
+        else if (state == MediaPlayer::FormatError && m_loadState == LoadingFromSrcAttr)
+            noneSupported();
+
         if (isVideo())
             static_cast<HTMLVideoElement*>(this)->updatePosterImage();
 
-        dispatchEventForType(eventNames().emptiedEvent, false, true);
         return;
     }
-    
-    if (state >= MediaPlayer::Loading && m_networkState < LOADING)
-        m_networkState = LOADING;
-    
-    if (state >= MediaPlayer::LoadedMetaData && m_networkState < LOADED_METADATA) {
-        m_player->seek(effectiveStart());
-        m_networkState = LOADED_METADATA;
-        
-        dispatchEventForType(eventNames().durationchangeEvent, false, true);
-        if (m_loadNestingLevel < m_terminateLoadBelowNestingLevel)
-            return;
-        
-        dispatchEventForType(eventNames().loadedmetadataEvent, false, true);
-        if (m_loadNestingLevel < m_terminateLoadBelowNestingLevel)
-            return;
-    }
-    
-    if (state >= MediaPlayer::LoadedFirstFrame && m_networkState < LOADED_FIRST_FRAME) {
-        m_networkState = LOADED_FIRST_FRAME;
-        
-        setReadyState(CAN_SHOW_CURRENT_FRAME);
-        
-        if (isVideo())
-            static_cast<HTMLVideoElement*>(this)->updatePosterImage();
-        
-        if (m_loadNestingLevel < m_terminateLoadBelowNestingLevel)
-            return;
-        
-        m_loadedFirstFrame = true;
-        if (renderer()) {
-            ASSERT(!renderer()->isImage());
-            static_cast<RenderVideo*>(renderer())->videoSizeChanged();
+
+    if (state == MediaPlayer::Idle) {
+        ASSERT(static_cast<ReadyState>(m_player->readyState()) < HAVE_ENOUGH_DATA);
+        if (m_networkState > NETWORK_IDLE) {
+            stopPeriodicTimers();
+            scheduleProgressEvent(eventNames().suspendEvent);
         }
-        
-        dispatchEventForType(eventNames().loadedfirstframeEvent, false, true);
-        if (m_loadNestingLevel < m_terminateLoadBelowNestingLevel)
-            return;
-        
-        dispatchEventForType(eventNames().canshowcurrentframeEvent, false, true);
-        if (m_loadNestingLevel < m_terminateLoadBelowNestingLevel)
-            return;
+        m_networkState = NETWORK_IDLE;
     }
-    
-    // 15
-    if (state == MediaPlayer::Loaded && m_networkState < LOADED) {
-        m_begun = false;
-        m_networkState = LOADED;
-        m_progressEventTimer.stop();
-        m_bufferingRate = 0;
-        initAndDispatchProgressEvent(eventNames().loadEvent); 
+
+    if (state == MediaPlayer::Loading) {
+        if (m_networkState < NETWORK_LOADING || m_networkState == NETWORK_NO_SOURCE)
+            startProgressEventTimer();
+        m_networkState = NETWORK_LOADING;
+    }
+
+    if (state == MediaPlayer::Loaded) {
+        NetworkState oldState = m_networkState;
+
+        m_networkState = NETWORK_LOADED;
+        if (oldState < NETWORK_LOADED || oldState == NETWORK_NO_SOURCE) {
+            m_progressEventTimer.stop();
+
+            // Check to see if readyState changes need to be dealt with before sending the 
+            // 'load' event so we report 'canplaythrough' first. This is necessary because a
+            //  media engine reports readyState and networkState changes separately
+            MediaPlayer::ReadyState currentState = m_player->readyState();
+            if (static_cast<ReadyState>(currentState) != m_readyState)
+                setReadyState(currentState);
+
+             scheduleProgressEvent(eventNames().loadEvent); 
+        }
     }
 }
 
 void HTMLMediaElement::mediaPlayerReadyStateChanged(MediaPlayer*)
 {
-    MediaPlayer::ReadyState state = m_player->readyState();
-    setReadyState((ReadyState)state);
+    beginProcessingMediaPlayerCallback();
+
+    setReadyState(m_player->readyState());
+
+    endProcessingMediaPlayerCallback();
 }
 
-void HTMLMediaElement::setReadyState(ReadyState state)
+void HTMLMediaElement::setReadyState(MediaPlayer::ReadyState state)
 {
-    // 3.14.9.6. The ready states
-    if (m_readyState == state)
+    // Set "wasPotentiallyPlaying" BEFORE updating m_readyState, potentiallyPlaying() uses it
+    bool wasPotentiallyPlaying = potentiallyPlaying();
+
+    ReadyState oldState = m_readyState;
+    m_readyState = static_cast<ReadyState>(state);
+
+    if (m_readyState == oldState)
         return;
     
-    bool wasActivelyPlaying = activelyPlaying();
-    m_readyState = state;
-    
-    if (state >= CAN_PLAY)
+    if (m_readyState >= HAVE_CURRENT_DATA)
         m_seeking = false;
     
-    if (networkState() == EMPTY)
+    if (m_networkState == NETWORK_EMPTY)
         return;
-    
-    if (state == DATA_UNAVAILABLE) {
-        dispatchEventForType(eventNames().dataunavailableEvent, false, true);
-        if (wasActivelyPlaying) {
-            dispatchEventForType(eventNames().timeupdateEvent, false, true);
-            dispatchEventForType(eventNames().waitingEvent, false, true);
-        }
-    } else if (state == CAN_SHOW_CURRENT_FRAME) {
-        if (m_loadedFirstFrame)
-            dispatchEventForType(eventNames().canshowcurrentframeEvent, false, true);
-        if (wasActivelyPlaying) {
-            dispatchEventForType(eventNames().timeupdateEvent, false, true);
-            dispatchEventForType(eventNames().waitingEvent, false, true);
+
+    if (m_seeking && m_readyState < HAVE_CURRENT_DATA) {
+        // 4.8.10.10, step 9
+        scheduleEvent(eventNames().seekingEvent);
+        m_seeking = false;
+    }
+
+    if (wasPotentiallyPlaying && m_readyState < HAVE_FUTURE_DATA) {
+        // 4.8.10.9
+        scheduleTimeupdateEvent(false);
+        scheduleEvent(eventNames().waitingEvent);
+    }
+
+    if (m_readyState >= HAVE_METADATA && oldState < HAVE_METADATA) {
+        scheduleEvent(eventNames().durationchangeEvent);
+        scheduleEvent(eventNames().loadedmetadataEvent);
+
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+        if (renderer() && renderer()->isVideo()) {
+            static_cast<RenderVideo*>(renderer())->videoSizeChanged();
         }
-    } else if (state == CAN_PLAY) {
-        dispatchEventForType(eventNames().canplayEvent, false, true);
-    } else if (state == CAN_PLAY_THROUGH) {
-        dispatchEventForType(eventNames().canplaythroughEvent, false, true);
+#endif        
+        m_delayingTheLoadEvent = false;
+        m_player->seek(0);
+    }
+
+    // 4.8.10.7 says loadeddata is sent only when the new state *is* HAVE_CURRENT_DATA: "If the
+    // previous ready state was HAVE_METADATA and the new ready state is HAVE_CURRENT_DATA", 
+    // but the event table at the end of the spec says it is sent when: "readyState newly 
+    // increased to HAVE_CURRENT_DATA  or greater for the first time"
+    // We go with the later because it seems useful to count on getting this event
+    if (m_readyState >= HAVE_CURRENT_DATA && oldState < HAVE_CURRENT_DATA && !m_haveFiredLoadedData) {
+        m_haveFiredLoadedData = true;
+        scheduleEvent(eventNames().loadeddataEvent);
+    }
+
+    bool isPotentiallyPlaying = potentiallyPlaying();
+    if (m_readyState == HAVE_FUTURE_DATA && oldState <= HAVE_CURRENT_DATA) {
+        scheduleEvent(eventNames().canplayEvent);
+        if (isPotentiallyPlaying)
+            scheduleEvent(eventNames().playingEvent);
+
+        if (isVideo())
+            static_cast<HTMLVideoElement*>(this)->updatePosterImage();
+    }
+
+    if (m_readyState == HAVE_ENOUGH_DATA && oldState < HAVE_ENOUGH_DATA) {
+        if (oldState <= HAVE_CURRENT_DATA)
+            scheduleEvent(eventNames().canplayEvent);
+
+        scheduleEvent(eventNames().canplaythroughEvent);
+
+        if (isPotentiallyPlaying && oldState <= HAVE_CURRENT_DATA)
+            scheduleEvent(eventNames().playingEvent);
+
         if (m_autoplaying && m_paused && autoplay()) {
             m_paused = false;
-            dispatchEventForType(eventNames().playEvent, false, true);
+            scheduleEvent(eventNames().playEvent);
+            scheduleEvent(eventNames().playingEvent);
         }
+
+        if (isVideo())
+            static_cast<HTMLVideoElement*>(this)->updatePosterImage();
     }
+
     updatePlayState();
 }
 
 void HTMLMediaElement::progressEventTimerFired(Timer<HTMLMediaElement>*)
 {
     ASSERT(m_player);
+    if (m_networkState == NETWORK_EMPTY || m_networkState >= NETWORK_LOADED)
+        return;
+
     unsigned progress = m_player->bytesLoaded();
-    double time = WebCore::currentTime();
+    double time = WTF::currentTime();
     double timedelta = time - m_previousProgressTime;
-    if (timedelta)
-        m_bufferingRate = (float)(0.8 * m_bufferingRate + 0.2 * ((float)(progress - m_previousProgress)) / timedelta);
-    
+
     if (progress == m_previousProgress) {
         if (timedelta > 3.0 && !m_sentStalledEvent) {
-            m_bufferingRate = 0;
-            initAndDispatchProgressEvent(eventNames().stalledEvent);
+            scheduleProgressEvent(eventNames().stalledEvent);
             m_sentStalledEvent = true;
         }
     } else {
-        initAndDispatchProgressEvent(eventNames().progressEvent);
+        scheduleProgressEvent(eventNames().progressEvent);
         m_previousProgress = progress;
         m_previousProgressTime = time;
         m_sentStalledEvent = false;
@@ -514,52 +841,49 @@ void HTMLMediaElement::progressEventTimerFired(Timer<HTMLMediaElement>*)
 
 void HTMLMediaElement::seek(float time, ExceptionCode& ec)
 {
-    // 3.14.9.8. Seeking
+    // 4.8.10.10. Seeking
     // 1
-    if (networkState() < LOADED_METADATA) {
+    if (m_readyState == HAVE_NOTHING || !m_player) {
         ec = INVALID_STATE_ERR;
         return;
     }
-    
+
     // 2
-    float minTime;
-    if (currentLoop() == 0)
-        minTime = effectiveStart();
-    else
-        minTime = effectiveLoopStart();
- 
+    time = min(time, duration());
+
     // 3
-    float maxTime = currentLoop() == playCount() - 1 ? effectiveEnd() : effectiveLoopEnd();
-    
+    time = max(time, 0.0f);
+
     // 4
-    time = min(time, maxTime);
-    
-    // 5
-    time = max(time, minTime);
-    
-    // 6
     RefPtr<TimeRanges> seekableRanges = seekable();
     if (!seekableRanges->contain(time)) {
         ec = INDEX_SIZE_ERR;
         return;
     }
     
-    // 7
-    m_currentTimeDuringSeek = time;
+    // avoid generating events when the time won't actually change
+    float now = currentTime();
+    if (time == now)
+        return;
 
-    // 8
+    // 5
+    if (m_playing) {
+        if (m_lastSeekTime < now)
+            m_playedTimeRanges->add(m_lastSeekTime, now);
+    }
+    m_lastSeekTime = time;
+
+    // 6 - set the seeking flag, it will be cleared when the engine tells is the time has actually changed
     m_seeking = true;
-    
-    // 9
-    dispatchEventForType(eventNames().timeupdateEvent, false, true);
-    
+
+    // 7
+    scheduleTimeupdateEvent(false);
+
+    // 8 - this is covered, if necessary, when the engine signals a readystate change
+
     // 10
-    // As soon as the user agent has established whether or not the media data for the new playback position is available, 
-    // and, if it is, decoded enough data to play back that position, the seeking DOM attribute must be set to false.
-    if (m_player) {
-        m_player->setEndTime(maxTime);
-        m_player->seek(time);
-    }
+    m_player->seek(time);
+    m_sentEndEvent = false;
 }
 
 HTMLMediaElement::ReadyState HTMLMediaElement::readyState() const
@@ -578,7 +902,7 @@ float HTMLMediaElement::currentTime() const
     if (!m_player)
         return 0;
     if (m_seeking)
-        return m_currentTimeDuringSeek;
+        return m_lastSeekTime;
     return m_player->currentTime();
 }
 
@@ -587,9 +911,19 @@ void HTMLMediaElement::setCurrentTime(float time, ExceptionCode& ec)
     seek(time, ec);
 }
 
+float HTMLMediaElement::startTime() const
+{
+    if (!m_player)
+        return 0;
+    return m_player->startTime();
+}
+
 float HTMLMediaElement::duration() const
 {
-    return m_player ? m_player->duration() : 0;
+    if (m_readyState >= HAVE_METADATA)
+        return m_player->duration();
+
+    return numeric_limits<float>::quiet_NaN();
 }
 
 bool HTMLMediaElement::paused() const
@@ -602,15 +936,11 @@ float HTMLMediaElement::defaultPlaybackRate() const
     return m_defaultPlaybackRate;
 }
 
-void HTMLMediaElement::setDefaultPlaybackRate(float rate, ExceptionCode& ec)
+void HTMLMediaElement::setDefaultPlaybackRate(float rate)
 {
-    if (rate == 0.0f) {
-        ec = NOT_SUPPORTED_ERR;
-        return;
-    }
     if (m_defaultPlaybackRate != rate) {
         m_defaultPlaybackRate = rate;
-        dispatchEventAsync(eventNames().ratechangeEvent);
+        scheduleEvent(eventNames().ratechangeEvent);
     }
 }
 
@@ -619,16 +949,29 @@ float HTMLMediaElement::playbackRate() const
     return m_player ? m_player->rate() : 0;
 }
 
-void HTMLMediaElement::setPlaybackRate(float rate, ExceptionCode& ec)
+void HTMLMediaElement::setPlaybackRate(float rate)
 {
-    if (rate == 0.0f) {
-        ec = NOT_SUPPORTED_ERR;
-        return;
+    if (m_playbackRate != rate) {
+        m_playbackRate = rate;
+        scheduleEvent(eventNames().ratechangeEvent);
     }
-    if (m_player && m_player->rate() != rate) {
+    if (m_player && potentiallyPlaying() && m_player->rate() != rate)
         m_player->setRate(rate);
-        dispatchEventAsync(eventNames().ratechangeEvent);
-    }
+}
+
+bool HTMLMediaElement::webkitPreservesPitch() const
+{
+    return m_webkitPreservesPitch;
+}
+
+void HTMLMediaElement::setWebkitPreservesPitch(bool preservesPitch)
+{
+    m_webkitPreservesPitch = preservesPitch;
+    
+    if (!m_player)
+        return;
+
+    m_player->setPreservesPitch(preservesPitch);
 }
 
 bool HTMLMediaElement::ended() const
@@ -646,126 +989,95 @@ void HTMLMediaElement::setAutoplay(bool b)
     setBooleanAttribute(autoplayAttr, b);
 }
 
-void HTMLMediaElement::play(ExceptionCode& ec)
+bool HTMLMediaElement::autobuffer() const
 {
-    // 3.14.9.7. Playing the media resource
-    if (!m_player || networkState() == EMPTY) {
-        ec = 0;
-        load(ec);
-        if (ec)
-            return;
-    }
-    ExceptionCode unused;
-    if (endedPlayback()) {
-        m_currentLoop = 0;
-        seek(effectiveStart(), unused);
-    }
-    setPlaybackRate(defaultPlaybackRate(), unused);
-    
-    if (m_paused) {
-        m_paused = false;
-        dispatchEventAsync(eventNames().playEvent);
-    }
-
-    m_autoplaying = false;
-    
-    updatePlayState();
+    return hasAttribute(autobufferAttr);
 }
 
-void HTMLMediaElement::pause(ExceptionCode& ec)
+void HTMLMediaElement::setAutobuffer(bool b)
 {
-    // 3.14.9.7. Playing the media resource
-    if (!m_player || networkState() == EMPTY) {
-        ec = 0;
-        load(ec);
-        if (ec)
-            return;
-    }
-
-    if (!m_paused) {
-        m_paused = true;
-        dispatchEventAsync(eventNames().timeupdateEvent);
-        dispatchEventAsync(eventNames().pauseEvent);
-    }
-
-    m_autoplaying = false;
-    
-    updatePlayState();
+    setBooleanAttribute(autobufferAttr, b);
 }
 
-unsigned HTMLMediaElement::playCount() const
+void HTMLMediaElement::play()
 {
-    bool ok;
-    unsigned count = getAttribute(playcountAttr).string().toUInt(&ok);
-    return (count > 0 && ok) ? count : 1; 
+    if (m_restrictions & RequireUserGestureForRateChangeRestriction && !processingUserGesture())
+        return;
+
+    playInternal();
 }
 
-void HTMLMediaElement::setPlayCount(unsigned count, ExceptionCode& ec)
+void HTMLMediaElement::playInternal()
 {
-    if (!count) {
-        ec = INDEX_SIZE_ERR;
-        return;
+    // 4.8.10.9. Playing the media resource
+    if (!m_player || m_networkState == NETWORK_EMPTY)
+        scheduleLoad();
+
+    if (endedPlayback()) {
+        ExceptionCode unused;
+        seek(0, unused);
     }
-    setAttribute(playcountAttr, String::number(count));
-    checkIfSeekNeeded();
-}
+    
+    setPlaybackRate(defaultPlaybackRate());
+    
+    if (m_paused) {
+        m_paused = false;
+        scheduleEvent(eventNames().playEvent);
 
-float HTMLMediaElement::start() const 
-{ 
-    return getTimeOffsetAttribute(startAttr, 0); 
-}
+        if (m_readyState <= HAVE_CURRENT_DATA)
+            scheduleEvent(eventNames().waitingEvent);
+        else if (m_readyState >= HAVE_FUTURE_DATA)
+            scheduleEvent(eventNames().playingEvent);
+    }
+    m_autoplaying = false;
 
-void HTMLMediaElement::setStart(float time) 
-{ 
-    setTimeOffsetAttribute(startAttr, time); 
-    checkIfSeekNeeded();
+    updatePlayState();
 }
 
-float HTMLMediaElement::end() const 
-{ 
-    return getTimeOffsetAttribute(endAttr, std::numeric_limits<float>::infinity()); 
-}
+void HTMLMediaElement::pause()
+{
+    if (m_restrictions & RequireUserGestureForRateChangeRestriction && !processingUserGesture())
+        return;
 
-void HTMLMediaElement::setEnd(float time) 
-{ 
-    setTimeOffsetAttribute(endAttr, time); 
-    checkIfSeekNeeded();
+    pauseInternal();
 }
 
-float HTMLMediaElement::loopStart() const 
-{ 
-    return getTimeOffsetAttribute(loopstartAttr, start()); 
-}
 
-void HTMLMediaElement::setLoopStart(float time) 
+void HTMLMediaElement::pauseInternal()
 {
-    setTimeOffsetAttribute(loopstartAttr, time); 
-    checkIfSeekNeeded();
-}
+    // 4.8.10.9. Playing the media resource
+    if (!m_player || m_networkState == NETWORK_EMPTY)
+        scheduleLoad();
 
-float HTMLMediaElement::loopEnd() const 
-{ 
-    return getTimeOffsetAttribute(loopendAttr, end()); 
-}
+    m_autoplaying = false;
+    
+    if (!m_paused) {
+        m_paused = true;
+        scheduleTimeupdateEvent(false);
+        scheduleEvent(eventNames().pauseEvent);
+    }
 
-void HTMLMediaElement::setLoopEnd(float time) 
-{ 
-    setTimeOffsetAttribute(loopendAttr, time); 
-    checkIfSeekNeeded();
+    updatePlayState();
 }
 
-unsigned HTMLMediaElement::currentLoop() const
+bool HTMLMediaElement::loop() const
 {
-    return m_currentLoop;
+    return hasAttribute(loopAttr);
 }
 
-void HTMLMediaElement::setCurrentLoop(unsigned currentLoop)
+void HTMLMediaElement::setLoop(bool b)
 {
-    m_currentLoop = currentLoop;
+    setBooleanAttribute(loopAttr, b);
 }
 
 bool HTMLMediaElement::controls() const
 {
+    Frame* frame = document()->frame();
+
+    // always show controls when scripting is disabled
+    if (frame && !frame->script()->isEnabled())
+        return true;
+
     return hasAttribute(controlsAttr);
 }
 
@@ -789,7 +1101,7 @@ void HTMLMediaElement::setVolume(float vol, ExceptionCode& ec)
     if (m_volume != vol) {
         m_volume = vol;
         updateVolume();
-        dispatchEventAsync(eventNames().volumechangeEvent);
+        scheduleEvent(eventNames().volumechangeEvent);
     }
 }
 
@@ -803,112 +1115,274 @@ void HTMLMediaElement::setMuted(bool muted)
     if (m_muted != muted) {
         m_muted = muted;
         updateVolume();
-        dispatchEventAsync(eventNames().volumechangeEvent);
+        scheduleEvent(eventNames().volumechangeEvent);
     }
 }
 
-bool HTMLMediaElement::canPlay() const
+void HTMLMediaElement::togglePlayState()
 {
-    return paused() || ended() || networkState() < LOADED_METADATA;
+    // We can safely call the internal play/pause methods, which don't check restrictions, because
+    // this method is only called from the built-in media controller
+    if (canPlay())
+        playInternal();
+    else 
+        pauseInternal();
 }
 
-String HTMLMediaElement::pickMedia()
+void HTMLMediaElement::beginScrubbing()
 {
-    // 3.14.9.2. Location of the media resource
-    String mediaSrc = getAttribute(srcAttr);
-    if (mediaSrc.isEmpty()) {
-        for (Node* n = firstChild(); n; n = n->nextSibling()) {
-            if (n->hasTagName(sourceTag)) {
-                HTMLSourceElement* source = static_cast<HTMLSourceElement*>(n);
-                if (!source->hasAttribute(srcAttr))
-                    continue; 
-                if (source->hasAttribute(mediaAttr)) {
-                    MediaQueryEvaluator screenEval("screen", document()->frame(), renderer() ? renderer()->style() : 0);
-                    RefPtr<MediaList> media = MediaList::createAllowingDescriptionSyntax(source->media());
-                    if (!screenEval.eval(media.get()))
-                        continue;
-                }
-                if (source->hasAttribute(typeAttr)) {
-                    String type = source->type().stripWhiteSpace();
-
-                    // "type" can have parameters after a semi-colon, strip them before checking with the type registry
-                    int semi = type.find(';');
-                    if (semi != -1)
-                        type = type.left(semi).stripWhiteSpace();
-
-                    if (!MIMETypeRegistry::isSupportedMediaMIMEType(type))
-                        continue;
-                }
-                mediaSrc = source->src().string();
-                break;
-            }
+    if (!paused()) {
+        if (ended()) {
+            // Because a media element stays in non-paused state when it reaches end, playback resumes 
+            // when the slider is dragged from the end to another position unless we pause first. Do 
+            // a "hard pause" so an event is generated, since we want to stay paused after scrubbing finishes.
+            pause();
+        } else {
+            // Not at the end but we still want to pause playback so the media engine doesn't try to
+            // continue playing during scrubbing. Pause without generating an event as we will 
+            // unpause after scrubbing finishes.
+            setPausedInternal(true);
         }
     }
-    if (!mediaSrc.isEmpty())
-        mediaSrc = document()->completeURL(mediaSrc).string();
-    return mediaSrc;
 }
 
-void HTMLMediaElement::checkIfSeekNeeded()
+void HTMLMediaElement::endScrubbing()
 {
-    // 3.14.9.5. Offsets into the media resource
-    // 1
-    if (playCount() <= m_currentLoop)
-        m_currentLoop = playCount() - 1;
-    
-    // 2
-    if (networkState() <= LOADING)
+    if (m_pausedInternal)
+        setPausedInternal(false);
+}
+
+// The spec says to fire periodic timeupdate events (those sent while playing) every
+// "15 to 250ms", we choose the slowest frequency
+static const double maxTimeupdateEventFrequency = 0.25;
+
+void HTMLMediaElement::startPlaybackProgressTimer()
+{
+    if (m_playbackProgressTimer.isActive())
+        return;
+
+    m_previousProgressTime = WTF::currentTime();
+    m_previousProgress = 0;
+    m_playbackProgressTimer.startRepeating(maxTimeupdateEventFrequency);
+}
+
+void HTMLMediaElement::playbackProgressTimerFired(Timer<HTMLMediaElement>*)
+{
+    ASSERT(m_player);
+    if (!m_playbackRate)
         return;
+
+    scheduleTimeupdateEvent(true);
     
-    // 3
-    ExceptionCode ec;
-    float time = currentTime();
-    if (!m_currentLoop && time < effectiveStart())
-        seek(effectiveStart(), ec);
+    // FIXME: deal with cue ranges here
+}
 
-    // 4
-    if (m_currentLoop && time < effectiveLoopStart())
-        seek(effectiveLoopStart(), ec);
-        
-    // 5
-    if (m_currentLoop < playCount() - 1 && time > effectiveLoopEnd()) {
-        seek(effectiveLoopStart(), ec);
-        m_currentLoop++;
+void HTMLMediaElement::scheduleTimeupdateEvent(bool periodicEvent)
+{
+    double now = WTF::currentTime();
+    double timedelta = now - m_lastTimeUpdateEventWallTime;
+
+    // throttle the periodic events
+    if (periodicEvent && timedelta < maxTimeupdateEventFrequency)
+        return;
+
+    // Some media engines make multiple "time changed" callbacks at the same time, but we only want one
+    // event at a given time so filter here
+    float movieTime = m_player ? m_player->currentTime() : 0;
+    if (movieTime != m_lastTimeUpdateEventMovieTime) {
+        scheduleEvent(eventNames().timeupdateEvent);
+        m_lastTimeUpdateEventWallTime = now;
+        m_lastTimeUpdateEventMovieTime = movieTime;
     }
-    
-    // 6
-    if (m_currentLoop == playCount() - 1 && time > effectiveEnd())
-        seek(effectiveEnd(), ec);
+}
 
-    updatePlayState();
+bool HTMLMediaElement::canPlay() const
+{
+    return paused() || ended() || m_readyState < HAVE_METADATA;
+}
+
+float HTMLMediaElement::percentLoaded() const
+{
+    if (!m_player)
+        return 0;
+    float duration = m_player->duration();
+    return duration ? m_player->maxTimeBuffered() / duration : 0;
+}
+
+bool HTMLMediaElement::havePotentialSourceChild()
+{
+    // Stash the current <source> node so we can restore it after checking
+    // to see there is another potential
+    HTMLSourceElement* currentSourceNode = m_currentSourceNode;
+    KURL nextURL = selectNextSourceChild(0, DoNothing);
+    m_currentSourceNode = currentSourceNode;
+
+    return nextURL.isValid();
+}
+
+KURL HTMLMediaElement::selectNextSourceChild(ContentType *contentType, InvalidSourceAction actionIfInvalid)
+{
+    KURL mediaURL;
+    Node* node;
+    bool lookingForPreviousNode = m_currentSourceNode;
+    bool canUse = false;
+
+    for (node = firstChild(); !canUse && node; node = node->nextSibling()) {
+        if (!node->hasTagName(sourceTag))
+            continue;
+
+        if (lookingForPreviousNode) {
+            if (m_currentSourceNode == static_cast<HTMLSourceElement*>(node))
+                lookingForPreviousNode = false;
+            continue;
+        }
+
+        HTMLSourceElement* source = static_cast<HTMLSourceElement*>(node);
+        if (!source->hasAttribute(srcAttr))
+            goto check_again; 
+
+        if (source->hasAttribute(mediaAttr)) {
+            MediaQueryEvaluator screenEval("screen", document()->frame(), renderer() ? renderer()->style() : 0);
+            RefPtr<MediaList> media = MediaList::createAllowingDescriptionSyntax(source->media());
+            if (!screenEval.eval(media.get())) 
+                goto check_again;
+        }
+
+        if (source->hasAttribute(typeAttr)) {
+            if (!MediaPlayer::supportsType(ContentType(source->type())))
+                goto check_again;
+        }
+
+        // Is it safe to load this url?
+        mediaURL = source->src();
+        if (!mediaURL.isValid() || !isSafeToLoadURL(mediaURL, actionIfInvalid))
+            goto check_again;
+
+        // Making it this far means the <source> looks reasonable
+        canUse = true;
+        if (contentType)
+            *contentType = ContentType(source->type());
+
+check_again:
+        if (!canUse && actionIfInvalid == Complain)
+            source->scheduleErrorEvent();
+        m_currentSourceNode = static_cast<HTMLSourceElement*>(node);
+    }
+
+    if (!canUse)
+        m_currentSourceNode = 0;
+    return canUse ? mediaURL : KURL();
 }
 
 void HTMLMediaElement::mediaPlayerTimeChanged(MediaPlayer*)
 {
-    if (readyState() >= CAN_PLAY)
+    beginProcessingMediaPlayerCallback();
+
+    if (m_readyState >= HAVE_CURRENT_DATA && m_seeking) {
+        scheduleEvent(eventNames().seekedEvent);
         m_seeking = false;
-    
-    if (m_currentLoop < playCount() - 1 && currentTime() >= effectiveLoopEnd()) {
-        ExceptionCode ec;
-        seek(effectiveLoopStart(), ec);
-        m_currentLoop++;
-        dispatchEventForType(eventNames().timeupdateEvent, false, true);
     }
     
-    if (m_currentLoop == playCount() - 1 && currentTime() >= effectiveEnd()) {
-        dispatchEventForType(eventNames().timeupdateEvent, false, true);
-        dispatchEventForType(eventNames().endedEvent, false, true);
+    float now = currentTime();
+    float dur = duration();
+    if (!isnan(dur) && dur && now >= dur) {
+        if (loop()) {
+            ExceptionCode ignoredException;
+            m_sentEndEvent = false;
+            seek(0, ignoredException);
+        } else {
+            if (!m_sentEndEvent) {
+                m_sentEndEvent = true;
+                scheduleTimeupdateEvent(false);
+                scheduleEvent(eventNames().endedEvent);
+            }
+        }
     }
+    else
+        m_sentEndEvent = false;
 
     updatePlayState();
+    endProcessingMediaPlayerCallback();
+}
+
+void HTMLMediaElement::mediaPlayerVolumeChanged(MediaPlayer*)
+{
+    beginProcessingMediaPlayerCallback();
+    updateVolume();
+    endProcessingMediaPlayerCallback();
+}
+
+void HTMLMediaElement::mediaPlayerDurationChanged(MediaPlayer*)
+{
+    beginProcessingMediaPlayerCallback();
+    scheduleEvent(eventNames().durationchangeEvent);
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    if (renderer()) {
+        renderer()->updateFromElement();
+        if (renderer()->isVideo())
+            static_cast<RenderVideo*>(renderer())->videoSizeChanged();
+    }
+#endif        
+    endProcessingMediaPlayerCallback();
+}
+
+void HTMLMediaElement::mediaPlayerRateChanged(MediaPlayer*)
+{
+    beginProcessingMediaPlayerCallback();
+    // Stash the rate in case the one we tried to set isn't what the engine is
+    // using (eg. it can't handle the rate we set)
+    m_playbackRate = m_player->rate();
+    endProcessingMediaPlayerCallback();
+}
+
+void HTMLMediaElement::mediaPlayerSawUnsupportedTracks(MediaPlayer*)
+{
+    // The MediaPlayer came across content it cannot completely handle.
+    // This is normally acceptable except when we are in a standalone
+    // MediaDocument. If so, tell the document what has happened.
+    if (ownerDocument()->isMediaDocument()) {
+        MediaDocument* mediaDocument = static_cast<MediaDocument*>(ownerDocument());
+        mediaDocument->mediaElementSawUnsupportedTracks();
+    }
 }
 
+// MediaPlayerPresentation methods
 void HTMLMediaElement::mediaPlayerRepaint(MediaPlayer*)
 {
+    beginProcessingMediaPlayerCallback();
     if (renderer())
         renderer()->repaint();
+    endProcessingMediaPlayerCallback();
 }
 
+void HTMLMediaElement::mediaPlayerSizeChanged(MediaPlayer*)
+{
+    beginProcessingMediaPlayerCallback();
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    if (renderer() && renderer()->isVideo())
+        static_cast<RenderVideo*>(renderer())->videoSizeChanged();
+#endif        
+    endProcessingMediaPlayerCallback();
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+bool HTMLMediaElement::mediaPlayerRenderingCanBeAccelerated(MediaPlayer*)
+{
+    if (renderer() && renderer()->isVideo()) {
+        ASSERT(renderer()->view());
+        return renderer()->view()->compositor()->canAccelerateVideoRendering(static_cast<RenderVideo*>(renderer()));
+    }
+    return false;
+}
+
+GraphicsLayer* HTMLMediaElement::mediaPlayerGraphicsLayer(MediaPlayer*)
+{
+    if (renderer() && renderer()->isVideo())
+        return static_cast<RenderVideo*>(renderer())->videoGraphicsLayer();
+    return 0;
+}
+#endif
+
 PassRefPtr<TimeRanges> HTMLMediaElement::buffered() const
 {
     // FIXME real ranges support
@@ -919,8 +1393,16 @@ PassRefPtr<TimeRanges> HTMLMediaElement::buffered() const
 
 PassRefPtr<TimeRanges> HTMLMediaElement::played() const
 {
-    // FIXME track played
-    return TimeRanges::create();
+    if (!m_playedTimeRanges) {
+        // We are not yet loaded
+        return TimeRanges::create();
+    }
+    if (m_playing) {
+        float time = currentTime();
+        if (m_lastSeekTime < time)
+            m_playedTimeRanges->add(m_lastSeekTime, time);
+    }
+    return m_playedTimeRanges->copy();
 }
 
 PassRefPtr<TimeRanges> HTMLMediaElement::seekable() const
@@ -931,53 +1413,49 @@ PassRefPtr<TimeRanges> HTMLMediaElement::seekable() const
     return TimeRanges::create(0, m_player->maxTimeSeekable());
 }
 
-float HTMLMediaElement::effectiveStart() const
+bool HTMLMediaElement::potentiallyPlaying() const
 {
-    if (!m_player)
-        return 0;
-    return min(start(), m_player->duration());
+    return !paused() && m_readyState >= HAVE_FUTURE_DATA && !endedPlayback() && !stoppedDueToErrors() && !pausedForUserInteraction();
 }
 
-float HTMLMediaElement::effectiveEnd() const
-{
-    if (!m_player)
-        return 0;
-    return min(max(end(), max(start(), loopStart())), m_player->duration());
-}
-
-float HTMLMediaElement::effectiveLoopStart() const
+bool HTMLMediaElement::endedPlayback() const
 {
-    if (!m_player)
-        return 0;
-    return min(loopStart(), m_player->duration());
+    if (!m_player || m_readyState < HAVE_METADATA)
+        return false;
+    
+    float dur = duration();
+    return !isnan(dur) && currentTime() >= dur && !loop();
 }
 
-float HTMLMediaElement::effectiveLoopEnd() const
+bool HTMLMediaElement::stoppedDueToErrors() const
 {
-    if (!m_player)
-        return 0;
-    return min(max(start(), max(loopStart(), loopEnd())), m_player->duration());
+    if (m_readyState >= HAVE_METADATA && m_error) {
+        RefPtr<TimeRanges> seekableRanges = seekable();
+        if (!seekableRanges->contain(currentTime()))
+            return true;
+    }
+    
+    return false;
 }
 
-bool HTMLMediaElement::activelyPlaying() const
+bool HTMLMediaElement::pausedForUserInteraction() const
 {
-    return !paused() && readyState() >= CAN_PLAY && !endedPlayback(); // && !stoppedDueToErrors() && !pausedForUserInteraction();
+//    return !paused() && m_readyState >= HAVE_FUTURE_DATA && [UA requires a decitions from the user]
+    return false;
 }
 
-bool HTMLMediaElement::endedPlayback() const
-{
-    return networkState() >= LOADED_METADATA && currentTime() >= effectiveEnd() && currentLoop() == playCount() - 1;
-}
-    
 void HTMLMediaElement::updateVolume()
 {
     if (!m_player)
         return;
 
-    Page* page = document()->page();
-    float volumeMultiplier = page ? page->mediaVolume() : 1;
-
-    m_player->setVolume(m_muted ? 0 : m_volume * volumeMultiplier);
+    // Avoid recursion when the player reports volume changes.
+    if (!processingMediaPlayerCallback()) {
+        Page* page = document()->page();
+        float volumeMultiplier = page ? page->mediaVolume() : 1;
+    
+        m_player->setVolume(m_muted ? 0 : m_volume * volumeMultiplier);
+    }
     
     if (renderer())
         renderer()->updateFromElement();
@@ -987,20 +1465,31 @@ void HTMLMediaElement::updatePlayState()
 {
     if (!m_player)
         return;
-    
+
     if (m_pausedInternal) {
         if (!m_player->paused())
             m_player->pause();
+        m_playbackProgressTimer.stop();
         return;
     }
     
-    m_player->setEndTime(currentLoop() == playCount() - 1 ? effectiveEnd() : effectiveLoopEnd());
-
-    bool shouldBePlaying = activelyPlaying() && currentTime() < effectiveEnd();
-    if (shouldBePlaying && m_player->paused())
+    bool shouldBePlaying = potentiallyPlaying();
+    bool playerPaused = m_player->paused();
+    if (shouldBePlaying && playerPaused) {
+        // Set rate before calling play in case the rate was set before the media engine wasn't setup.
+        // The media engine should just stash the rate since it isn't already playing.
+        m_player->setRate(m_playbackRate);
         m_player->play();
-    else if (!shouldBePlaying && !m_player->paused())
+        startPlaybackProgressTimer();
+        m_playing = true;
+    } else if (!shouldBePlaying && !playerPaused) {
         m_player->pause();
+        m_playbackProgressTimer.stop();
+        m_playing = false;
+        float time = currentTime();
+        if (m_lastSeekTime < time)
+            m_playedTimeRanges->add(m_lastSeekTime, time);
+    }
     
     if (renderer())
         renderer()->updateFromElement();
@@ -1012,30 +1501,58 @@ void HTMLMediaElement::setPausedInternal(bool b)
     updatePlayState();
 }
 
-void HTMLMediaElement::documentWillBecomeInactive()
+void HTMLMediaElement::stopPeriodicTimers()
+{
+    m_progressEventTimer.stop();
+    m_playbackProgressTimer.stop();
+}
+
+void HTMLMediaElement::userCancelledLoad()
 {
-    // 3.14.9.4. Loading the media resource
-    // 14
-    if (m_begun) {
-        // For simplicity cancel the incomplete load by deleting the player
+    if (m_networkState != NETWORK_EMPTY) {
+
+        // If the media data fetching process is aborted by the user:
+
+        // 1 - The user agent should cancel the fetching process.
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
         m_player.clear();
-        m_progressEventTimer.stop();
+#endif
+        stopPeriodicTimers();
 
+        // 2 - Set the error attribute to a new MediaError object whose code attribute is set to MEDIA_ERR_ABORT.
         m_error = MediaError::create(MediaError::MEDIA_ERR_ABORTED);
-        m_begun = false;
-        initAndDispatchProgressEvent(eventNames().abortEvent);
-        if (m_networkState >= LOADING) {
-            m_networkState = EMPTY;
-            m_readyState = DATA_UNAVAILABLE;
-            dispatchEventForType(eventNames().emptiedEvent, false, true);
+
+        // 3 - Queue a task to fire a progress event called abort at the media element.
+        scheduleProgressEvent(eventNames().abortEvent);
+
+        // 4 - If the media element's readyState attribute has a value equal to HAVE_NOTHING, set the 
+        // element's networkState attribute to the NETWORK_EMPTY value and queue a task to fire a 
+        // simple event called emptied at the element. Otherwise, set set the element's networkState 
+        // attribute to the NETWORK_IDLE value.
+        if (m_networkState >= NETWORK_LOADING) {
+            m_networkState = NETWORK_EMPTY;
+            m_readyState = HAVE_NOTHING;
+            scheduleEvent(eventNames().emptiedEvent);
         }
+
+        // 5 - Set the element's delaying-the-load-event flag to false. This stops delaying the load event.
+        m_delayingTheLoadEvent = false;
     }
+}
+
+void HTMLMediaElement::documentWillBecomeInactive()
+{
     m_inActiveDocument = false;
+    userCancelledLoad();
+
     // Stop the playback without generating events
     setPausedInternal(true);
 
     if (renderer())
         renderer()->updateFromElement();
+
+    stopPeriodicTimers();
+    cancelPendingEventsAndCallbacks();
 }
 
 void HTMLMediaElement::documentDidBecomeActive()
@@ -1045,6 +1562,8 @@ void HTMLMediaElement::documentDidBecomeActive()
 
     if (m_error && m_error->code() == MediaError::MEDIA_ERR_ABORTED) {
         // Restart the load if it was aborted in the middle by moving the document to the page cache.
+        // m_error is only left at MEDIA_ERR_ABORTED when the document becomes inactive (it is set to
+        //  MEDIA_ERR_ABORTED while the abortEvent is being sent, but cleared immediately afterwards).
         // This behavior is not specified but it seems like a sensible thing to do.
         ExceptionCode ec;
         load(ec);
@@ -1061,13 +1580,74 @@ void HTMLMediaElement::mediaVolumeDidChange()
 
 void HTMLMediaElement::defaultEventHandler(Event* event)
 {
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    RenderObject* r = renderer();
+    if (!r || !r->isWidget())
+        return;
+
+    Widget* widget = static_cast<RenderWidget*>(r)->widget();
+    if (widget)
+        widget->handleEvent(event);
+#else
     if (renderer() && renderer()->isMedia())
         static_cast<RenderMedia*>(renderer())->forwardEvent(event);
     if (event->defaultHandled())
         return;
     HTMLElement::defaultEventHandler(event);
+#endif
+}
+
+bool HTMLMediaElement::processingUserGesture() const
+{
+    Frame* frame = document()->frame();
+    FrameLoader* loader = frame ? frame->loader() : 0;
+
+    // return 'true' for safety if we don't know the answer 
+    return loader ? loader->userGestureHint() : true;
+}
+
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+void HTMLMediaElement::deliverNotification(MediaPlayerProxyNotificationType notification)
+{
+    if (notification == MediaPlayerNotificationPlayPauseButtonPressed) {
+        togglePlayState();
+        return;
+    }
+
+    if (m_player)
+        m_player->deliverNotification(notification);
 }
 
+void HTMLMediaElement::setMediaPlayerProxy(WebMediaPlayerProxy* proxy)
+{
+    if (m_player)
+        m_player->setMediaPlayerProxy(proxy);
+}
+
+String HTMLMediaElement::initialURL()
+{
+    KURL initialSrc = document()->completeURL(getAttribute(srcAttr));
+    
+    if (!initialSrc.isValid())
+        initialSrc = selectNextSourceChild(0, DoNothing);
+
+    m_currentSrc = initialSrc.string();
+
+    return initialSrc;
+}
+
+void HTMLMediaElement::finishParsingChildren()
+{
+    HTMLElement::finishParsingChildren();
+    if (!m_player)
+        m_player.set(new MediaPlayer(this));
+    
+    document()->updateStyleIfNeeded();
+    if (m_needWidgetUpdate && renderer())
+        static_cast<RenderPartObject*>(renderer())->updateWidget(true);
+}
+#endif
+
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
index 6dd562c..8d238d5 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,13 +31,18 @@
 #include "HTMLElement.h"
 #include "MediaPlayer.h"
 #include "Timer.h"
-#include "VoidCallback.h"
+
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+#include "MediaPlayerProxy.h"
+#endif
 
 namespace WebCore {
 
+class Event;
+class HTMLSourceElement;
 class MediaError;
-class TimeRanges;
 class KURL;
+class TimeRanges;
     
 class HTMLMediaElement : public HTMLElement, public MediaPlayerClient {
 public:
@@ -47,6 +52,7 @@ public:
     bool checkDTD(const Node* newChild);
     
     void attributeChanged(Attribute*, bool preserveDecls);
+    void parseMappedAttribute(MappedAttribute *);
 
     virtual bool rendererIsNeeded(RenderStyle*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
@@ -58,7 +64,10 @@ public:
     MediaPlayer* player() const { return m_player.get(); }
     
     virtual bool isVideo() const { return false; }
-    
+    virtual bool hasVideo() const { return false; }
+
+    virtual bool supportsFullscreen() const { return false; }
+
     void scheduleLoad();
     
     virtual void defaultEventHandler(Event*);
@@ -76,49 +85,43 @@ public:
     KURL src() const;
     void setSrc(const String&);
     String currentSrc() const;
-    
-    enum NetworkState { EMPTY, LOADING, LOADED_METADATA, LOADED_FIRST_FRAME, LOADED };
+
+    enum NetworkState { NETWORK_EMPTY, NETWORK_IDLE, NETWORK_LOADING, NETWORK_LOADED, NETWORK_NO_SOURCE };
     NetworkState networkState() const;
-    float bufferingRate();
+    bool autobuffer() const;    
+    void setAutobuffer(bool);
+
     PassRefPtr<TimeRanges> buffered() const;
     void load(ExceptionCode&);
+    String canPlayType(const String& mimeType) const;
 
 // ready state
-    enum ReadyState { DATA_UNAVAILABLE, CAN_SHOW_CURRENT_FRAME, CAN_PLAY, CAN_PLAY_THROUGH };
+    enum ReadyState { HAVE_NOTHING, HAVE_METADATA, HAVE_CURRENT_DATA, HAVE_FUTURE_DATA, HAVE_ENOUGH_DATA };
     ReadyState readyState() const;
     bool seeking() const;
 
 // playback state
     float currentTime() const;
     void setCurrentTime(float, ExceptionCode&);
+    float startTime() const;
     float duration() const;
     bool paused() const;
     float defaultPlaybackRate() const;
-    void setDefaultPlaybackRate(float, ExceptionCode&);
+    void setDefaultPlaybackRate(float);
     float playbackRate() const;
-    void setPlaybackRate(float, ExceptionCode&);
+    void setPlaybackRate(float);
+    bool webkitPreservesPitch() const;
+    void setWebkitPreservesPitch(bool);
     PassRefPtr<TimeRanges> played() const;
     PassRefPtr<TimeRanges> seekable() const;
     bool ended() const;
     bool autoplay() const;    
     void setAutoplay(bool b);
-    void play(ExceptionCode&);
-    void pause(ExceptionCode&);
-    
-// looping
-    float start() const;
-    void setStart(float time);
-    float end() const;
-    void setEnd(float time);
-    float loopStart() const;
-    void setLoopStart(float time);
-    float loopEnd() const;
-    void setLoopEnd(float time);
-    unsigned playCount() const;
-    void setPlayCount(unsigned, ExceptionCode&);
-    unsigned currentLoop() const;
-    void setCurrentLoop(unsigned);
-
+    bool loop() const;    
+    void setLoop(bool b);
+    void play();
+    void pause();
+    
 // controls
     bool controls() const;
     void setControls(bool);
@@ -126,9 +129,24 @@ public:
     void setVolume(float, ExceptionCode&);
     bool muted() const;
     void setMuted(bool);
+    void togglePlayState();
+    void beginScrubbing();
+    void endScrubbing();
 
     bool canPlay() const;
 
+    float percentLoaded() const;
+
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    void setNeedWidgetUpdate(bool needWidgetUpdate) { m_needWidgetUpdate = needWidgetUpdate; }
+    void deliverNotification(MediaPlayerProxyNotificationType notification);
+    void setMediaPlayerProxy(WebMediaPlayerProxy* proxy);
+    String initialURL();
+    virtual void finishParsingChildren();
+#endif
+
+    bool hasSingleSecurityOrigin() const { return !m_player || m_player->hasSingleSecurityOrigin(); }
+
 protected:
     float getTimeOffsetAttribute(const QualifiedName&, float valueOnError) const;
     void setTimeOffsetAttribute(const QualifiedName&, float value);
@@ -137,73 +155,149 @@ protected:
     virtual void documentDidBecomeActive();
     virtual void mediaVolumeDidChange();
     
-    void initAndDispatchProgressEvent(const AtomicString& eventName);
-    void dispatchEventAsync(const AtomicString& eventName);
-    
-    void setReadyState(ReadyState);
+    void setReadyState(MediaPlayer::ReadyState);
+    void setNetworkState(MediaPlayer::NetworkState);
     
-private: // MediaPlayerObserver
+private: // MediaPlayerClient
     virtual void mediaPlayerNetworkStateChanged(MediaPlayer*);
     virtual void mediaPlayerReadyStateChanged(MediaPlayer*);
     virtual void mediaPlayerTimeChanged(MediaPlayer*);
+    virtual void mediaPlayerVolumeChanged(MediaPlayer*);
+    virtual void mediaPlayerDurationChanged(MediaPlayer*);
+    virtual void mediaPlayerRateChanged(MediaPlayer*);
+    virtual void mediaPlayerSawUnsupportedTracks(MediaPlayer*);
     virtual void mediaPlayerRepaint(MediaPlayer*);
+    virtual void mediaPlayerSizeChanged(MediaPlayer*);
+#if USE(ACCELERATED_COMPOSITING)
+    virtual bool mediaPlayerRenderingCanBeAccelerated(MediaPlayer*);
+    virtual GraphicsLayer* mediaPlayerGraphicsLayer(MediaPlayer*);
+#endif
 
 private:
     void loadTimerFired(Timer<HTMLMediaElement>*);
     void asyncEventTimerFired(Timer<HTMLMediaElement>*);
     void progressEventTimerFired(Timer<HTMLMediaElement>*);
-    void seek(float time, ExceptionCode& ec);
+    void playbackProgressTimerFired(Timer<HTMLMediaElement>*);
+    void startPlaybackProgressTimer();
+    void startProgressEventTimer();
+    void stopPeriodicTimers();
+
+    void seek(float time, ExceptionCode&);
     void checkIfSeekNeeded();
     
-    String pickMedia();
+    void scheduleTimeupdateEvent(bool periodicEvent);
+    void scheduleProgressEvent(const AtomicString& eventName);
+    void scheduleEvent(const AtomicString& eventName);
+    void enqueueEvent(RefPtr<Event> event);
+    
+    // loading
+    void selectMediaResource();
+    void loadResource(const KURL&, ContentType&);
+    void loadNextSourceChild();
+    void userCancelledLoad();
+    bool havePotentialSourceChild();
+    void noneSupported();
+    void mediaEngineError(PassRefPtr<MediaError> err);
+    void cancelPendingEventsAndCallbacks();
+
+    enum InvalidSourceAction { DoNothing, Complain };
+    bool isSafeToLoadURL(const KURL&, InvalidSourceAction);
+    KURL selectNextSourceChild(ContentType*, InvalidSourceAction);
+
+    // These "internal" functions do not check user gesture restrictions.
+    void loadInternal();
+    void playInternal();
+    void pauseInternal();
+    
+    bool processingUserGesture() const;
+    bool processingMediaPlayerCallback() const { return m_processingMediaPlayerCallback > 0; }
+    void beginProcessingMediaPlayerCallback() { ++m_processingMediaPlayerCallback; }
+    void endProcessingMediaPlayerCallback() { ASSERT(m_processingMediaPlayerCallback); --m_processingMediaPlayerCallback; }
+
     void updateVolume();
     void updatePlayState();
-    float effectiveStart() const;
-    float effectiveEnd() const;
-    float effectiveLoopStart() const;
-    float effectiveLoopEnd() const;
-    bool activelyPlaying() const;
+    bool potentiallyPlaying() const;
     bool endedPlayback() const;
-    
+    bool stoppedDueToErrors() const;
+    bool pausedForUserInteraction() const;
+
+    // Restrictions to change default behaviors. This is a effectively a compile time choice at the moment
+    //  because there are no accessor methods.
+    enum BehaviorRestrictions 
+    { 
+        NoRestrictions = 0,
+        RequireUserGestureForLoadRestriction = 1 << 0,
+        RequireUserGestureForRateChangeRestriction = 1 << 1,
+    };
+
 protected:
     Timer<HTMLMediaElement> m_loadTimer;
     Timer<HTMLMediaElement> m_asyncEventTimer;
     Timer<HTMLMediaElement> m_progressEventTimer;
-    Vector<AtomicString> m_asyncEventsToDispatch;
+    Timer<HTMLMediaElement> m_playbackProgressTimer;
+    Vector<RefPtr<Event> > m_pendingEvents;
+    RefPtr<TimeRanges> m_playedTimeRanges;
     
+    float m_playbackRate;
     float m_defaultPlaybackRate;
+    bool m_webkitPreservesPitch;
     NetworkState m_networkState;
     ReadyState m_readyState;
     String m_currentSrc;
     
     RefPtr<MediaError> m_error;
-    
-    bool m_begun;
-    bool m_loadedFirstFrame;
-    bool m_autoplaying;
-    
-    unsigned m_currentLoop;
+
     float m_volume;
-    bool m_muted;
-    
-    bool m_paused;
-    bool m_seeking;
-    
-    float m_currentTimeDuringSeek;
+    float m_lastSeekTime;
     
     unsigned m_previousProgress;
     double m_previousProgressTime;
-    bool m_sentStalledEvent;
-    
-    float m_bufferingRate;
+
+    // the last time a timeupdate event was sent (wall clock)
+    double m_lastTimeUpdateEventWallTime;
+
+    // the last time a timeupdate event was sent in movie time
+    float m_lastTimeUpdateEventMovieTime;
     
-    unsigned m_loadNestingLevel;
-    unsigned m_terminateLoadBelowNestingLevel;
+    // loading state
+    enum LoadState { WaitingForSource, LoadingFromSrcAttr, LoadingFromSourceElement };
+    LoadState m_loadState;
+    HTMLSourceElement *m_currentSourceNode;
     
-    bool m_pausedInternal;
-    bool m_inActiveDocument;
-
     OwnPtr<MediaPlayer> m_player;
+
+    BehaviorRestrictions m_restrictions;
+
+    bool m_playing;
+
+    // counter incremented while processing a callback from the media player, so we can avoid
+    //  calling the media engine recursively
+    int m_processingMediaPlayerCallback;
+
+    bool m_processingLoad : 1;
+    bool m_delayingTheLoadEvent : 1;
+    bool m_haveFiredLoadedData : 1;
+    bool m_inActiveDocument : 1;
+    bool m_autoplaying : 1;
+    bool m_muted : 1;
+    bool m_paused : 1;
+    bool m_seeking : 1;
+
+    // data has not been loaded since sending a "stalled" event
+    bool m_sentStalledEvent : 1;
+
+    // time has not changed since sending an "ended" event
+    bool m_sentEndEvent : 1;
+
+    bool m_pausedInternal : 1;
+
+    // Not all media engines provide enough information about a file to be able to
+    // support progress events so setting m_sendProgressEvents disables them 
+    bool m_sendProgressEvents : 1;
+
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    bool m_needWidgetUpdate : 1;
+#endif
 };
 
 } //namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.idl
index 1e3eb90..7278fa6 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMediaElement.idl
@@ -33,56 +33,51 @@ interface [GenerateConstructor, Conditional=VIDEO] HTMLMediaElement : HTMLElemen
     attribute DOMString src;
     readonly attribute DOMString currentSrc;
     
-    const unsigned short EMPTY = 0;
-    const unsigned short LOADING = 1;
-    const unsigned short LOADED_METADATA = 2;
-    const unsigned short LOADED_FIRST_FRAME = 3;
-    const unsigned short LOADED = 4;
+    const unsigned short NETWORK_EMPTY = 0;
+    const unsigned short NETWORK_IDLE = 1;
+    const unsigned short NETWORK_LOADING = 2;
+    const unsigned short NETWORK_LOADED = 3;
+    const unsigned short NETWORK_NO_SOURCE = 4;
     readonly attribute unsigned short networkState;
-    readonly attribute float bufferingRate;
+    attribute boolean autobuffer;
+
     readonly attribute TimeRanges buffered;
     void load() 
         raises (DOMException);
+    DOMString canPlayType(in DOMString type);
 
     // ready state
-    const unsigned short DATA_UNAVAILABLE = 0;
-    const unsigned short CAN_SHOW_CURRENT_FRAME = 1;
-    const unsigned short CAN_PLAY = 2;
-    const unsigned short CAN_PLAY_THROUGH = 3;
+    const unsigned short HAVE_NOTHING = 0;
+    const unsigned short HAVE_METADATA = 1;
+    const unsigned short HAVE_CURRENT_DATA = 2;
+    const unsigned short HAVE_FUTURE_DATA = 3;
+    const unsigned short HAVE_ENOUGH_DATA = 4;
     readonly attribute unsigned short readyState;
     readonly attribute boolean seeking;
 
     // playback state
     attribute float currentTime
         setter raises (DOMException);
+    readonly attribute float startTime;
     readonly attribute float duration;
     readonly attribute boolean paused;
-    attribute float defaultPlaybackRate 
-        setter raises (DOMException);
-    attribute float playbackRate 
-        setter raises (DOMException);
+    attribute float defaultPlaybackRate;
+    attribute float playbackRate;
     readonly attribute TimeRanges played;
     readonly attribute TimeRanges seekable;
     readonly attribute boolean ended;
     attribute boolean autoplay;
-    void play() 
-        raises (DOMException);
-    void pause() 
-        raises (DOMException);
-
-    // looping
-    attribute float start;
-    attribute float end;
-    attribute float loopStart;
-    attribute float loopEnd;
-    attribute unsigned long playCount
-        setter raises (DOMException);
-    attribute unsigned long currentLoop;
+    attribute boolean loop;
+    void play();
+    void pause();
 
     // controls
     attribute boolean controls;
     attribute float volume 
         setter raises (DOMException);
     attribute boolean muted;
+    
+    // WebKit extension
+    attribute boolean webkitPreservesPitch;
 };
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLMetaElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLMetaElement.cpp
index c2fb199..cf667ca 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLMetaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLMetaElement.cpp
@@ -19,11 +19,13 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLMetaElement.h"
 
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLNameCollection.cpp b/src/3rdparty/webkit/WebCore/html/HTMLNameCollection.cpp
index fdebe78..d5657da 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLNameCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLNameCollection.cpp
@@ -32,7 +32,7 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLNameCollection::HTMLNameCollection(PassRefPtr<Document> document, Type type, const String& name)
+HTMLNameCollection::HTMLNameCollection(PassRefPtr<Document> document, CollectionType type, const String& name)
     : HTMLCollection(document.get(), type, document->nameCollectionInfo(type, name))
     , m_name(name)
 {
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLNameCollection.h b/src/3rdparty/webkit/WebCore/html/HTMLNameCollection.h
index 9add926..3e990d7 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLNameCollection.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLNameCollection.h
@@ -32,13 +32,13 @@ class Document;
 
 class HTMLNameCollection : public HTMLCollection {
 public:
-    static PassRefPtr<HTMLNameCollection> create(PassRefPtr<Document> document, Type type, const String& name)
+    static PassRefPtr<HTMLNameCollection> create(PassRefPtr<Document> document, CollectionType type, const String& name)
     {
         return adoptRef(new HTMLNameCollection(document, type, name));
     }
     
 private:
-    HTMLNameCollection(PassRefPtr<Document>, Type, const String& name);
+    HTMLNameCollection(PassRefPtr<Document>, CollectionType, const String& name);
 
     virtual Element* itemAfter(Element*) const;
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLNoScriptElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLNoScriptElement.cpp
new file mode 100644
index 0000000..3bbfbe6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLNoScriptElement.cpp
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(XHTMLMP)
+#include "HTMLNoScriptElement.h"
+
+#include "CSSStyleSelector.h"
+#include "HTMLNames.h"
+#include "RenderObject.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+HTMLNoScriptElement::HTMLNoScriptElement(const QualifiedName& tagName, Document* doc)
+    : HTMLElement(tagName, doc)
+{
+    ASSERT(hasTagName(noscriptTag));
+}
+
+HTMLNoScriptElement::~HTMLNoScriptElement()
+{
+}
+
+bool HTMLNoScriptElement::checkDTD(const Node* newChild)
+{
+    return newChild->isTextNode() || inBlockTagList(newChild); 
+}
+
+void HTMLNoScriptElement::attach()
+{
+    HTMLElement::attach();
+
+    // If no need to process <noscript>, we hide it by setting display:none temporarily
+    if (!document()->shouldProcessNoscriptElement()) {
+        if (renderer() && renderer()->style())
+            renderer()->style()->setDisplay(NONE);
+        setNeedsStyleRecalc();
+    }
+}
+
+void HTMLNoScriptElement::recalcStyle(StyleChange change)
+{
+    if (!document()->shouldProcessNoscriptElement() || !renderer() || !renderer()->style())
+        return;
+
+    // If <noscript> needs processing, we make it visiable here, including its visible children
+    RefPtr<RenderStyle> style = renderer()->style();
+    if (style->display() == NONE) {
+        style->setDisplay(INLINE);
+
+        // Create renderers for its children
+        if (hasChildNodes()) {
+            for (Node* n = firstChild(); n; n = n->traverseNextNode(this))
+                if (!n->renderer())
+                    n->createRendererIfNeeded();
+        }
+    }
+}
+
+bool HTMLNoScriptElement::childShouldCreateRenderer(Node* child) const
+{
+    return document()->shouldProcessNoscriptElement();
+}
+
+}
+#endif
diff --git a/src/3rdparty/webkit/WebCore/rendering/RenderLegend.h b/src/3rdparty/webkit/WebCore/html/HTMLNoScriptElement.h
index 649f132..2cc5a3c 100644
--- a/src/3rdparty/webkit/WebCore/rendering/RenderLegend.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLNoScriptElement.h
@@ -1,10 +1,5 @@
 /*
- * This file is part of the DOM implementation for KDE.
- *
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- *           (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2006 Apple Computer, Inc.
+ * Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -23,20 +18,29 @@
  *
  */
 
-#ifndef RenderLegend_h
-#define RenderLegend_h
+#ifndef HTMLNoScriptElement_h
+#define HTMLNoScriptElement_h
 
-#include "RenderBlock.h"
+#if ENABLE(XHTMLMP)
+#include "HTMLElement.h"
 
 namespace WebCore {
 
-    class RenderLegend : public RenderBlock {
-    public:
-        RenderLegend(Node*);
+class HTMLNoScriptElement : public HTMLElement {
+public:
+    HTMLNoScriptElement(const QualifiedName&, Document*);
+
+private:
+    virtual ~HTMLNoScriptElement();
 
-        virtual const char* renderName() const { return "RenderLegend"; }
-    };
+    virtual bool checkDTD(const Node*);
+    virtual void attach();
+    virtual void recalcStyle(StyleChange);
+    virtual bool childShouldCreateRenderer(Node*) const;
+    virtual bool rendererIsNeeded(RenderStyle*) {  return true; }
+};
 
-} // namespace WebCore
+} //namespace
 
-#endif // RenderLegend_h
+#endif
+#endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOListElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLOListElement.cpp
index c1e0d7c..63fd437 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOListElement.cpp
@@ -18,12 +18,14 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "HTMLOListElement.h"
 
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderListItem.h"
 
 namespace WebCore {
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp
index 6f85d18..6be41c9 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.cpp
@@ -32,14 +32,15 @@
 #include "HTMLFormElement.h"
 #include "HTMLImageLoader.h"
 #include "HTMLNames.h"
+#include "ScriptEventListener.h"
 #include "MIMETypeRegistry.h"
+#include "MappedAttribute.h"
 #include "RenderImage.h"
 #include "RenderPartObject.h"
 #include "RenderWidget.h"
 #include "ScriptController.h"
 #include "Text.h"
 
-
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -94,7 +95,7 @@ void HTMLObjectElement::parseMappedAttribute(MappedAttribute *attr)
         if (renderer())
           m_needWidgetUpdate = true;
     } else if (attr->name() == onloadAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().loadEvent, attr);
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == nameAttr) {
         const AtomicString& newName = attr->value();
         if (isDocNamedItem() && inDocument() && document()->isHTMLDocument()) {
@@ -119,14 +120,15 @@ void HTMLObjectElement::parseMappedAttribute(MappedAttribute *attr)
 
 bool HTMLObjectElement::rendererIsNeeded(RenderStyle* style)
 {
-    if (m_useFallbackContent || isImageType())
-        return HTMLPlugInElement::rendererIsNeeded(style);
-
     Frame* frame = document()->frame();
     if (!frame)
         return false;
     
-    return true;
+    // Temporary Workaround for Gears plugin - see bug 24215 for details and bug 24346 to track removal.
+    // Gears expects the plugin to be instantiated even if display:none is set
+    // for the object element.
+    bool isGearsPlugin = equalIgnoringCase(getAttribute(typeAttr), "application/x-googlegears");
+    return isGearsPlugin || HTMLPlugInElement::rendererIsNeeded(style);
 }
 
 RenderObject *HTMLObjectElement::createRenderer(RenderArena* arena, RenderStyle* style)
@@ -156,13 +158,13 @@ void HTMLObjectElement::attach()
             return;
 
         if (renderer())
-            static_cast<RenderImage*>(renderer())->setCachedImage(m_imageLoader->image());
+            toRenderImage(renderer())->setCachedImage(m_imageLoader->image());
     }
 }
 
 void HTMLObjectElement::updateWidget()
 {
-    document()->updateRendering();
+    document()->updateStyleIfNeeded();
     if (m_needWidgetUpdate && renderer() && !m_useFallbackContent && !isImageType())
         static_cast<RenderPartObject*>(renderer())->updateWidget(true);
 }
@@ -173,7 +175,7 @@ void HTMLObjectElement::finishParsingChildren()
     if (!m_useFallbackContent) {
         m_needWidgetUpdate = true;
         if (inDocument())
-            setChanged();
+            setNeedsStyleRecalc();
     }
 }
 
@@ -221,7 +223,7 @@ void HTMLObjectElement::childrenChanged(bool changedByParser, Node* beforeChange
     updateDocNamedItem();
     if (inDocument() && !m_useFallbackContent) {
         m_needWidgetUpdate = true;
-        setChanged();
+        setNeedsStyleRecalc();
     }
     HTMLPlugInElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.idl
index c225238..1880836 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLObjectElement.idl
@@ -22,8 +22,8 @@ module html {
 
     interface [
         GenerateConstructor,
-        CustomPutFunction,
-        CustomGetOwnPropertySlot,
+        DelegatingPutFunction,
+        DelegatingGetOwnPropertySlot,
         CustomCall,
         HasOverridingNameGetter,
         InterfaceUUID=9d04a3b8-9016-4b64-913a-3b00d548aca7,
@@ -50,14 +50,16 @@ module html {
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document        contentDocument;
 
-#if !defined(LANGUAGE_COM)
-#if ENABLE_SVG
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
+#if defined(ENABLE_SVG) && ENABLE_SVG
+#if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C || defined(ENABLE_SVG_DOM_OBJC_BINDINGS) && ENABLE_SVG_DOM_OBJC_BINDINGS
         [SVGCheckSecurityDocument] SVGDocument getSVGDocument()
             raises(DOMException);
 #endif
 #endif
+#endif
 
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         // Objective-C extension:
         readonly attribute URL             absoluteImageURL;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.cpp
index 2025f63..af81b07 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.cpp
@@ -49,7 +49,7 @@ bool HTMLOptGroupElement::isFocusable() const
     return HTMLElement::isFocusable();
 }
 
-const AtomicString& HTMLOptGroupElement::type() const
+const AtomicString& HTMLOptGroupElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, optgroup, ("optgroup"));
     return optgroup;
@@ -58,40 +58,30 @@ const AtomicString& HTMLOptGroupElement::type() const
 bool HTMLOptGroupElement::insertBefore(PassRefPtr<Node> newChild, Node* refChild, ExceptionCode& ec, bool shouldLazyAttach)
 {
     bool result = HTMLFormControlElement::insertBefore(newChild, refChild, ec, shouldLazyAttach);
-    if (result)
-        recalcSelectOptions();
     return result;
 }
 
 bool HTMLOptGroupElement::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, ExceptionCode& ec, bool shouldLazyAttach)
 {
     bool result = HTMLFormControlElement::replaceChild(newChild, oldChild, ec, shouldLazyAttach);
-    if (result)
-        recalcSelectOptions();
     return result;
 }
 
 bool HTMLOptGroupElement::removeChild(Node* oldChild, ExceptionCode& ec)
 {
     bool result = HTMLFormControlElement::removeChild(oldChild, ec);
-    if (result)
-        recalcSelectOptions();
     return result;
 }
 
 bool HTMLOptGroupElement::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bool shouldLazyAttach)
 {
     bool result = HTMLFormControlElement::appendChild(newChild, ec, shouldLazyAttach);
-    if (result)
-        recalcSelectOptions();
     return result;
 }
 
 bool HTMLOptGroupElement::removeChildren()
 {
     bool result = HTMLFormControlElement::removeChildren();
-    if (result)
-        recalcSelectOptions();
     return result;
 }
 
@@ -157,9 +147,8 @@ RenderStyle* HTMLOptGroupElement::nonRendererRenderStyle() const
 
 String HTMLOptGroupElement::groupLabelText() const
 {
-    String itemText = getAttribute(labelAttr);
+    String itemText = document()->displayStringModifiedByEncoding(getAttribute(labelAttr));
     
-    itemText.replace('\\', document()->backslashAsCurrencySymbol());
     // In WinIE, leading and trailing whitespace is ignored in options and optgroups. We match this behavior.
     itemText = itemText.stripWhiteSpace();
     // We want to collapse our whitespace too.  This will match other browsers.
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.h b/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.h
index 55311dc..13e92ca 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOptGroupElement.h
@@ -25,17 +25,18 @@
 #define HTMLOptGroupElement_h
 
 #include "HTMLFormControlElement.h"
+#include "OptionGroupElement.h"
 
 namespace WebCore {
     
 class HTMLSelectElement;
 
-class HTMLOptGroupElement : public HTMLFormControlElement {
+class HTMLOptGroupElement : public HTMLFormControlElement, public OptionGroupElement {
 public:
     HTMLOptGroupElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
 
     virtual bool checkDTD(const Node*);
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
     virtual bool isFocusable() const;
     virtual void parseMappedAttribute(MappedAttribute*);
     virtual bool rendererIsNeeded(RenderStyle*) { return false; }
@@ -53,7 +54,7 @@ public:
     String label() const;
     void setLabel(const String&);
     
-    String groupLabelText() const;
+    virtual String groupLabelText() const;
     HTMLSelectElement* ownerSelectElement() const;
     virtual void accessKeyAction(bool sendToAnyElement);
     
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.cpp
index 999f4d3..1d446f7 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.cpp
@@ -30,9 +30,10 @@
 #include "ExceptionCode.h"
 #include "HTMLNames.h"
 #include "HTMLSelectElement.h"
+#include "MappedAttribute.h"
+#include "NodeRenderStyle.h"
 #include "RenderMenuList.h"
 #include "Text.h"
-#include "NodeRenderStyle.h"
 #include <wtf/StdLibExtras.h>
 #include <wtf/Vector.h>
 
@@ -42,7 +43,6 @@ using namespace HTMLNames;
 
 HTMLOptionElement::HTMLOptionElement(const QualifiedName& tagName, Document* doc, HTMLFormElement* f)
     : HTMLFormControlElement(tagName, doc, f)
-    , m_selected(false)
     , m_style(0)
 {
     ASSERT(hasTagName(optionTag));
@@ -71,7 +71,7 @@ bool HTMLOptionElement::isFocusable() const
     return HTMLElement::isFocusable();
 }
 
-const AtomicString& HTMLOptionElement::type() const
+const AtomicString& HTMLOptionElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, option, ("option"));
     return option;
@@ -79,32 +79,7 @@ const AtomicString& HTMLOptionElement::type() const
 
 String HTMLOptionElement::text() const
 {
-    String text;
-
-    // WinIE does not use the label attribute, so as a quirk, we ignore it.
-    if (!document()->inCompatMode())
-        text = getAttribute(labelAttr);
-
-    if (text.isEmpty()) {
-        const Node* n = firstChild();
-        while (n) {
-            if (n->nodeType() == TEXT_NODE || n->nodeType() == CDATA_SECTION_NODE)
-                text += n->nodeValue();
-            // skip script content
-            if (n->isElementNode() && n->hasTagName(HTMLNames::scriptTag))
-                n = n->traverseNextSibling(this);
-            else
-                n = n->traverseNextNode(this);
-        }
-    }
-
-    text.replace('\\', document()->backslashAsCurrencySymbol());
-    // In WinIE, leading and trailing whitespace is ignored in options and optgroups. We match this behavior.
-    text = text.stripWhiteSpace();
-    // We want to collapse our whitespace too.  This will match other browsers.
-    text = text.simplifyWhiteSpace();
-
-    return text;
+    return OptionElement::collectOptionText(m_data, this);
 }
 
 void HTMLOptionElement::setText(const String &text, ExceptionCode& ec)
@@ -129,40 +104,24 @@ void HTMLOptionElement::accessKeyAction(bool)
 
 int HTMLOptionElement::index() const
 {
-    // Let's do this dynamically. Might be a bit slow, but we're sure
-    // we won't forget to update a member variable in some cases...
-    HTMLSelectElement* select = ownerSelectElement();
-    if (select) {
-        const Vector<HTMLElement*>& items = select->listItems();
-        int l = items.size();
-        int optionIndex = 0;
-        for(int i = 0; i < l; i++) {
-            if (items[i]->hasLocalName(optionTag)) {
-                if (static_cast<HTMLOptionElement*>(items[i]) == this)
-                    return optionIndex;
-                optionIndex++;
-            }
-        }
-    }
-    return 0;
+    return OptionElement::optionIndex(ownerSelectElement(), this);
 }
 
 void HTMLOptionElement::parseMappedAttribute(MappedAttribute *attr)
 {
     if (attr->name() == selectedAttr)
-        m_selected = (!attr->isNull());
+        m_data.setSelected(!attr->isNull());
     else if (attr->name() == valueAttr)
-        m_value = attr->value();
+        m_data.setValue(attr->value());
+    else if (attr->name() == labelAttr)
+        m_data.setLabel(attr->value());
     else
         HTMLFormControlElement::parseMappedAttribute(attr);
 }
 
 String HTMLOptionElement::value() const
 {
-    if ( !m_value.isNull() )
-        return m_value;
-    // Use the text if the value wasn't set.
-    return text().stripWhiteSpace();
+    return OptionElement::collectOptionValue(m_data, this);
 }
 
 void HTMLOptionElement::setValue(const String& value)
@@ -170,21 +129,25 @@ void HTMLOptionElement::setValue(const String& value)
     setAttribute(valueAttr, value);
 }
 
+bool HTMLOptionElement::selected() const
+{
+    return m_data.selected();
+}
+
 void HTMLOptionElement::setSelected(bool selected)
 {
-    if (m_selected == selected)
+    if (m_data.selected() == selected)
         return;
+
+    OptionElement::setSelectedState(m_data, this, selected);
+
     if (HTMLSelectElement* select = ownerSelectElement())
         select->setSelectedIndex(selected ? index() : -1, false);
-    m_selected = selected;
 }
 
 void HTMLOptionElement::setSelectedState(bool selected)
 {
-    if (m_selected == selected)
-        return;
-    m_selected = selected;
-    setChanged();
+    OptionElement::setSelectedState(m_data, this, selected);
 }
 
 void HTMLOptionElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
@@ -219,7 +182,7 @@ void HTMLOptionElement::setDefaultSelected(bool b)
 
 String HTMLOptionElement::label() const
 {
-    return getAttribute(labelAttr);
+    return m_data.label();
 }
 
 void HTMLOptionElement::setLabel(const String& value)
@@ -237,12 +200,9 @@ RenderStyle* HTMLOptionElement::nonRendererRenderStyle() const
     return m_style.get(); 
 }
 
-String HTMLOptionElement::optionText()
+String HTMLOptionElement::textIndentedToRespectGroupLabel() const
 {
-    if (parentNode() && parentNode()->hasTagName(optgroupTag))
-        return "    " + text();
-        
-    return text();
+    return OptionElement::collectOptionTextRespectingGroupLabel(m_data, this);
 }
 
 bool HTMLOptionElement::disabled() const
@@ -250,13 +210,16 @@ bool HTMLOptionElement::disabled() const
     return HTMLFormControlElement::disabled() || (parentNode() && static_cast<HTMLFormControlElement*>(parentNode())->disabled()); 
 }
 
-void HTMLOptionElement::insertedIntoDocument()
+void HTMLOptionElement::insertedIntoTree(bool deep)
 {
-    HTMLSelectElement* select;
-    if (selected() && (select = ownerSelectElement()))
+    if (HTMLSelectElement* select = ownerSelectElement()) {
+        select->setRecalcListItems();
+        if (selected())
+            select->setSelectedIndex(index(), false);
         select->scrollToSelection();
+    }
     
-    HTMLFormControlElement::insertedIntoDocument();
+    HTMLFormControlElement::insertedIntoTree(deep);
 }
 
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.h b/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.h
index 4b8238c..f13a802 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.h
@@ -24,6 +24,7 @@
 #define HTMLOptionElement_h
 
 #include "HTMLFormControlElement.h"
+#include "OptionElement.h"
 
 namespace WebCore {
 
@@ -31,7 +32,7 @@ class HTMLSelectElement;
 class HTMLFormElement;
 class MappedAttribute;
 
-class HTMLOptionElement : public HTMLFormControlElement {
+class HTMLOptionElement : public HTMLFormControlElement, public OptionElement {
     friend class HTMLSelectElement;
     friend class RenderMenuList;
 
@@ -47,20 +48,20 @@ public:
     virtual void detach();
     virtual void setRenderStyle(PassRefPtr<RenderStyle>);
     
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
 
-    String text() const;
+    virtual String text() const;
     void setText(const String&, ExceptionCode&);
 
     int index() const;
     virtual void parseMappedAttribute(MappedAttribute*);
 
-    String value() const;
+    virtual String value() const;
     void setValue(const String&);
 
-    bool selected() const { return m_selected; }
+    virtual bool selected() const;
     void setSelected(bool);
-    void setSelectedState(bool);
+    virtual void setSelectedState(bool);
 
     HTMLSelectElement* ownerSelectElement() const;
 
@@ -71,19 +72,18 @@ public:
 
     String label() const;
     void setLabel(const String&);
-    
-    String optionText();
-    
+
+    virtual String textIndentedToRespectGroupLabel() const;
+
     virtual bool disabled() const;
     
-    virtual void insertedIntoDocument();
+    virtual void insertedIntoTree(bool);
     virtual void accessKeyAction(bool);
     
 private:
     virtual RenderStyle* nonRendererRenderStyle() const;
-    
-    String m_value;
-    bool m_selected;
+
+    OptionElementData m_data;
     RefPtr<RenderStyle> m_style;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.idl
index 34fa999..612d459 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOptionElement.idl
@@ -28,7 +28,7 @@ module html {
     ] HTMLOptionElement : HTMLElement {
         readonly attribute  HTMLFormElement      form;
                  attribute  boolean              defaultSelected;
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
                  attribute  [ConvertNullToNullString] DOMString            text
                      setter raises(DOMException);
 #else
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLOptionsCollection.idl b/src/3rdparty/webkit/WebCore/html/HTMLOptionsCollection.idl
index 226f3d7..5f85fcb 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLOptionsCollection.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLOptionsCollection.idl
@@ -36,7 +36,7 @@ module html {
              raises (DOMException);
         [Custom] void remove(in unsigned long index);
 
-#if !defined(LANGUAGE_JAVASCRIPT)
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT
         Node item(in unsigned long index);
         Node namedItem(in DOMString name);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLParagraphElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLParagraphElement.cpp
index 44eaecc..a8deb10 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLParagraphElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLParagraphElement.cpp
@@ -19,6 +19,7 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "HTMLParagraphElement.h"
 
@@ -26,6 +27,7 @@
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLParamElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLParamElement.cpp
index 6e1197b..d5fc6e7 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLParamElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLParamElement.cpp
@@ -25,6 +25,7 @@
 
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp b/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp
index 0403dad..ea6bbe2 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLParser.cpp
@@ -3,7 +3,8 @@
               (C) 1997 Torben Weis (weis@kde.org)
               (C) 1999,2001 Lars Knoll (knoll@kde.org)
               (C) 2000,2001 Dirk Mueller (mueller@kde.org)
-    Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+    Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+    Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -27,6 +28,7 @@
 #include "CharacterNames.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
+#include "ChromeClient.h"
 #include "Comment.h"
 #include "Console.h"
 #include "DOMWindow.h"
@@ -45,15 +47,17 @@
 #include "HTMLIsIndexElement.h"
 #include "HTMLMapElement.h"
 #include "HTMLNames.h"
+#include "HTMLParserQuirks.h"
 #include "HTMLTableCellElement.h"
 #include "HTMLTableRowElement.h"
 #include "HTMLTableSectionElement.h"
 #include "HTMLTokenizer.h"
 #include "LocalizedStrings.h"
+#include "Page.h"
 #include "Settings.h"
 #include "Text.h"
 #include <wtf/StdLibExtras.h>
-    
+
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -61,6 +65,13 @@ using namespace HTMLNames;
 static const unsigned cMaxRedundantTagDepth = 20;
 static const unsigned cResidualStyleMaxDepth = 200;
 
+static const int minBlockLevelTagPriority = 3;
+
+// A cap on the number of tags with priority minBlockLevelTagPriority or higher
+// allowed in m_blockStack. The cap is enforced by adding such new elements as
+// siblings instead of children once it is reached.
+static const size_t cMaxBlockDepth = 4096;
+
 struct HTMLStackElem : Noncopyable {
     HTMLStackElem(const AtomicString& t, int lvl, Node* n, bool r, HTMLStackElem* nx)
         : tagName(t)
@@ -113,36 +124,38 @@ struct HTMLStackElem : Noncopyable {
  */
 
 HTMLParser::HTMLParser(HTMLDocument* doc, bool reportErrors)
-    : document(doc)
-    , current(doc)
-    , didRefCurrent(false)
-    , blockStack(0)
+    : m_document(doc)
+    , m_current(doc)
+    , m_didRefCurrent(false)
+    , m_blockStack(0)
+    , m_blocksInStack(0)
     , m_hasPElementInScope(NotInScope)
-    , head(0)
-    , inBody(false)
-    , haveContent(false)
-    , haveFrameSet(false)
+    , m_inBody(false)
+    , m_haveContent(false)
+    , m_haveFrameSet(false)
     , m_isParsingFragment(false)
     , m_reportErrors(reportErrors)
     , m_handlingResidualStyleAcrossBlocks(false)
-    , inStrayTableContent(0)
+    , m_inStrayTableContent(0)
+    , m_parserQuirks(m_document->page() ? m_document->page()->chrome()->client()->createHTMLParserQuirks() : 0)
 {
 }
 
 HTMLParser::HTMLParser(DocumentFragment* frag)
-    : document(frag->document())
-    , current(frag)
-    , didRefCurrent(true)
-    , blockStack(0)
+    : m_document(frag->document())
+    , m_current(frag)
+    , m_didRefCurrent(true)
+    , m_blockStack(0)
+    , m_blocksInStack(0)
     , m_hasPElementInScope(NotInScope)
-    , head(0)
-    , inBody(true)
-    , haveContent(false)
-    , haveFrameSet(false)
+    , m_inBody(true)
+    , m_haveContent(false)
+    , m_haveFrameSet(false)
     , m_isParsingFragment(true)
     , m_reportErrors(false)
     , m_handlingResidualStyleAcrossBlocks(false)
-    , inStrayTableContent(0)
+    , m_inStrayTableContent(0)
+    , m_parserQuirks(m_document->page() ? m_document->page()->chrome()->client()->createHTMLParserQuirks() : 0)
 {
     if (frag)
         frag->ref();
@@ -151,40 +164,43 @@ HTMLParser::HTMLParser(DocumentFragment* frag)
 HTMLParser::~HTMLParser()
 {
     freeBlock();
-    if (didRefCurrent) 
-        current->deref(); 
+    if (m_didRefCurrent)
+        m_current->deref();
 }
 
 void HTMLParser::reset()
 {
     ASSERT(!m_isParsingFragment);
 
-    setCurrent(document);
+    setCurrent(m_document);
 
     freeBlock();
 
-    inBody = false;
-    haveFrameSet = false;
-    haveContent = false;
-    inStrayTableContent = 0;
+    m_inBody = false;
+    m_haveFrameSet = false;
+    m_haveContent = false;
+    m_inStrayTableContent = 0;
 
     m_currentFormElement = 0;
     m_currentMapElement = 0;
-    head = 0;
+    m_head = 0;
     m_isindexElement = 0;
 
     m_skipModeTag = nullAtom;
+    
+    if (m_parserQuirks)
+        m_parserQuirks->reset();
 }
 
 void HTMLParser::setCurrent(Node* newCurrent) 
 {
-    bool didRefNewCurrent = newCurrent && newCurrent != document;
+    bool didRefNewCurrent = newCurrent && newCurrent != m_document;
     if (didRefNewCurrent) 
         newCurrent->ref(); 
-    if (didRefCurrent) 
-        current->deref(); 
-    current = newCurrent;
-    didRefCurrent = didRefNewCurrent;
+    if (m_didRefCurrent) 
+        m_current->deref();
+    m_current = newCurrent;
+    m_didRefCurrent = didRefNewCurrent;
 }
 
 PassRefPtr<Node> HTMLParser::parseToken(Token* t)
@@ -193,7 +209,7 @@ PassRefPtr<Node> HTMLParser::parseToken(Token* t)
         if (!t->beginTag && t->tagName == m_skipModeTag)
             // Found the end tag for the current skip mode, so we're done skipping.
             m_skipModeTag = nullAtom;
-        else if (current->localName() == t->tagName)
+        else if (m_current->localName() == t->tagName)
             // Do not skip </iframe>.
             // FIXME: What does that comment mean? How can it be right to parse a token without clearing m_skipModeTag?
             ;
@@ -202,7 +218,7 @@ PassRefPtr<Node> HTMLParser::parseToken(Token* t)
     }
 
     // Apparently some sites use </br> instead of <br>. Be compatible with IE and Firefox and treat this like <br>.
-    if (t->isCloseTag(brTag) && document->inCompatMode()) {
+    if (t->isCloseTag(brTag) && m_document->inCompatMode()) {
         reportError(MalformedBRError);
         t->beginTag = true;
     }
@@ -214,17 +230,17 @@ PassRefPtr<Node> HTMLParser::parseToken(Token* t)
 
     // Ignore spaces, if we're not inside a paragraph or other inline code.
     // Do not alter the text if it is part of a scriptTag.
-    if (t->tagName == textAtom && t->text && current->localName() != scriptTag) {
-        if (inBody && !skipMode() && current->localName() != styleTag &&
-            current->localName() != titleTag && !t->text->containsOnlyWhitespace())
-            haveContent = true;
+    if (t->tagName == textAtom && t->text && m_current->localName() != scriptTag) {
+        if (m_inBody && !skipMode() && m_current->localName() != styleTag &&
+            m_current->localName() != titleTag && !t->text->containsOnlyWhitespace())
+            m_haveContent = true;
         
         RefPtr<Node> n;
         String text = t->text.get();
         unsigned charsLeft = text.length();
         while (charsLeft) {
             // split large blocks of text to nodes of manageable size
-            n = Text::createWithLengthLimit(document, text, charsLeft);
+            n = Text::createWithLengthLimit(m_document, text, charsLeft);
             if (!insertNode(n.get(), t->selfClosingTag))
                 return 0;
         }
@@ -269,8 +285,8 @@ PassRefPtr<Node> HTMLParser::parseToken(Token* t)
         if (m_currentFormElement == n)
             m_currentFormElement = 0;
 
-        if (head == n)
-            head = 0;
+        if (m_head == n)
+            m_head = 0;
 
         return 0;
     }
@@ -280,25 +296,25 @@ PassRefPtr<Node> HTMLParser::parseToken(Token* t)
 void HTMLParser::parseDoctypeToken(DoctypeToken* t)
 {
     // Ignore any doctype after the first.  Ignore doctypes in fragments.
-    if (document->doctype() || m_isParsingFragment || current != document)
+    if (m_document->doctype() || m_isParsingFragment || m_current != m_document)
         return;
         
     // Make a new doctype node and set it as our doctype.
-    document->addChild(DocumentType::create(document, String::adopt(t->m_name), String::adopt(t->m_publicID), String::adopt(t->m_systemID)));
+    m_document->addChild(DocumentType::create(m_document, String::adopt(t->m_name), String::adopt(t->m_publicID), String::adopt(t->m_systemID)));
 }
 
-static bool isTableSection(Node* n)
+static bool isTableSection(const Node* n)
 {
     return n->hasTagName(tbodyTag) || n->hasTagName(tfootTag) || n->hasTagName(theadTag);
 }
 
-static bool isTablePart(Node* n)
+static bool isTablePart(const Node* n)
 {
     return n->hasTagName(trTag) || n->hasTagName(tdTag) || n->hasTagName(thTag) ||
            isTableSection(n);
 }
 
-static bool isTableRelated(Node* n)
+static bool isTableRelated(const Node* n)
 {
     return n->hasTagName(tableTag) || isTablePart(n);
 }
@@ -317,33 +333,43 @@ bool HTMLParser::insertNode(Node* n, bool flat)
     
     // <table> is never allowed inside stray table content.  Always pop out of the stray table content
     // and close up the first table, and then start the second table as a sibling.
-    if (inStrayTableContent && localName == tableTag)
+    if (m_inStrayTableContent && localName == tableTag)
         popBlock(tableTag);
-    
+
+    if (tagPriority >= minBlockLevelTagPriority) {
+        while (m_blocksInStack >= cMaxBlockDepth)
+            popBlock(m_blockStack->tagName);
+    }
+
+    if (m_parserQuirks && !m_parserQuirks->shouldInsertNode(m_current, n))
+        return false;
+
     // let's be stupid and just try to insert it.
     // this should work if the document is well-formed
-    Node* newNode = current->addChild(n);
+    Node* newNode = m_current->addChild(n);
     if (!newNode)
         return handleError(n, flat, localName, tagPriority); // Try to handle the error.
 
     // don't push elements without end tags (e.g., <img>) on the stack
-    bool parentAttached = current->attached();
+    bool parentAttached = m_current->attached();
     if (tagPriority > 0 && !flat) {
-        if (newNode == current) {
+        if (newNode == m_current) {
             // This case should only be hit when a demoted <form> is placed inside a table.
             ASSERT(localName == formTag);
-            reportError(FormInsideTablePartError, &current->localName());
+            reportError(FormInsideTablePartError, &m_current->localName());
+            HTMLFormElement* form = static_cast<HTMLFormElement*>(n);
+            form->setDemoted(true);
         } else {
             // The pushBlock function transfers ownership of current to the block stack
-            // so we're guaranteed that didRefCurrent is false. The code below is an
+            // so we're guaranteed that m_didRefCurrent is false. The code below is an
             // optimized version of setCurrent that takes advantage of that fact and also
             // assumes that newNode is neither 0 nor a pointer to the document.
             pushBlock(localName, tagPriority);
             newNode->beginParsingChildren();
-            ASSERT(!didRefCurrent);
+            ASSERT(!m_didRefCurrent);
             newNode->ref(); 
-            current = newNode;
-            didRefCurrent = true;
+            m_current = newNode;
+            m_didRefCurrent = true;
         }
         if (parentAttached && !n->attached() && !m_isParsingFragment)
             n->attach();
@@ -353,6 +379,9 @@ bool HTMLParser::insertNode(Node* n, bool flat)
         n->finishParsingChildren();
     }
 
+    if (localName == htmlTag && m_document->frame())
+        m_document->frame()->loader()->dispatchDocumentElementAvailable();
+
     return true;
 }
 
@@ -366,28 +395,28 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
     if (n->isHTMLElement()) {
         HTMLElement* h = static_cast<HTMLElement*>(n);
         if (h->hasLocalName(trTag) || h->hasLocalName(thTag) || h->hasLocalName(tdTag)) {
-            if (inStrayTableContent && !isTableRelated(current)) {
-                reportError(MisplacedTablePartError, &localName, &current->localName());
+            if (m_inStrayTableContent && !isTableRelated(m_current)) {
+                reportError(MisplacedTablePartError, &localName, &m_current->localName());
                 // pop out to the nearest enclosing table-related tag.
-                while (blockStack && !isTableRelated(current))
+                while (m_blockStack && !isTableRelated(m_current))
                     popOneBlock();
                 return insertNode(n);
             }
         } else if (h->hasLocalName(headTag)) {
-            if (!current->isDocumentNode() && !current->hasTagName(htmlTag)) {
+            if (!m_current->isDocumentNode() && !m_current->hasTagName(htmlTag)) {
                 reportError(MisplacedHeadError);
                 return false;
             }
         } else if (h->hasLocalName(metaTag) || h->hasLocalName(linkTag) || h->hasLocalName(baseTag)) {
             bool createdHead = false;
-            if (!head) {
+            if (!m_head) {
                 createHead();
                 createdHead = true;
             }
-            if (head) {
+            if (m_head) {
                 if (!createdHead)
-                    reportError(MisplacedHeadContentError, &localName, &current->localName());
-                if (head->addChild(n)) {
+                    reportError(MisplacedHeadContentError, &localName, &m_current->localName());
+                if (m_head->addChild(n)) {
                     if (!n->attached() && !m_isParsingFragment)
                         n->attach();
                     return true;
@@ -395,14 +424,14 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
                     return false;
             }
         } else if (h->hasLocalName(htmlTag)) {
-            if (!current->isDocumentNode() ) {
-                if (document->documentElement() && document->documentElement()->hasTagName(htmlTag)) {
+            if (!m_current->isDocumentNode() ) {
+                if (m_document->documentElement() && m_document->documentElement()->hasTagName(htmlTag)) {
                     reportError(RedundantHTMLBodyError, &localName);
                     // we have another <HTML> element.... apply attributes to existing one
                     // make sure we don't overwrite already existing attributes
-                    NamedAttrMap* map = static_cast<Element*>(n)->attributes(true);
-                    Element* existingHTML = static_cast<Element*>(document->documentElement());
-                    NamedAttrMap* bmap = existingHTML->attributes(false);
+                    NamedNodeMap* map = static_cast<Element*>(n)->attributes(true);
+                    Element* existingHTML = static_cast<Element*>(m_document->documentElement());
+                    NamedNodeMap* bmap = existingHTML->attributes(false);
                     for (unsigned l = 0; map && l < map->length(); ++l) {
                         Attribute* it = map->attributeItem(l);
                         if (!bmap->getAttributeItem(it->name()))
@@ -411,21 +440,21 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
                 }
                 return false;
             }
-        } else if (h->hasLocalName(titleTag) || h->hasLocalName(styleTag)) {
+        } else if (h->hasLocalName(titleTag) || h->hasLocalName(styleTag) || h->hasLocalName(scriptTag)) {
             bool createdHead = false;
-            if (!head) {
+            if (!m_head) {
                 createHead();
                 createdHead = true;
             }
-            if (head) {
-                Node* newNode = head->addChild(n);
+            if (m_head) {
+                Node* newNode = m_head->addChild(n);
                 if (!newNode) {
                     setSkipMode(h->tagQName());
                     return false;
                 }
                 
                 if (!createdHead)
-                    reportError(MisplacedHeadContentError, &localName, &current->localName());
+                    reportError(MisplacedHeadContentError, &localName, &m_current->localName());
                 
                 pushBlock(localName, tagPriority);
                 newNode->beginParsingChildren();
@@ -434,19 +463,19 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
                     n->attach();
                 return true;
             }
-            if (inBody) {
+            if (m_inBody) {
                 setSkipMode(h->tagQName());
                 return false;
             }
         } else if (h->hasLocalName(bodyTag)) {
-            if (inBody && document->body()) {
+            if (m_inBody && m_document->body()) {
                 // we have another <BODY> element.... apply attributes to existing one
                 // make sure we don't overwrite already existing attributes
                 // some sites use <body bgcolor=rightcolor>...<body bgcolor=wrongcolor>
                 reportError(RedundantHTMLBodyError, &localName);
-                NamedAttrMap* map = static_cast<Element*>(n)->attributes(true);
-                Element* existingBody = document->body();
-                NamedAttrMap* bmap = existingBody->attributes(false);
+                NamedNodeMap* map = static_cast<Element*>(n)->attributes(true);
+                Element* existingBody = m_document->body();
+                NamedNodeMap* bmap = existingBody->attributes(false);
                 for (unsigned l = 0; map && l < map->length(); ++l) {
                     Attribute* it = map->attributeItem(l);
                     if (!bmap->getAttributeItem(it->name()))
@@ -454,11 +483,11 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
                 }
                 return false;
             }
-            else if (!current->isDocumentNode())
+            else if (!m_current->isDocumentNode())
                 return false;
         } else if (h->hasLocalName(areaTag)) {
             if (m_currentMapElement) {
-                reportError(MisplacedAreaError, &current->localName());
+                reportError(MisplacedAreaError, &m_current->localName());
                 m_currentMapElement->addChild(n);
                 if (!n->attached() && !m_isParsingFragment)
                     n->attach();
@@ -467,18 +496,18 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
             }
             return false;
         } else if (h->hasLocalName(colgroupTag) || h->hasLocalName(captionTag)) {
-            if (isTableRelated(current)) {
-                while (blockStack && isTablePart(current))
+            if (isTableRelated(m_current)) {
+                while (m_blockStack && isTablePart(m_current))
                     popOneBlock();
                 return insertNode(n);
             }
         }
-    } else if (n->isCommentNode() && !head)
+    } else if (n->isCommentNode() && !m_head)
         return false;
 
     // 2. Next we examine our currently active element to do some further error handling.
-    if (current->isHTMLElement()) {
-        HTMLElement* h = static_cast<HTMLElement*>(current);
+    if (m_current->isHTMLElement()) {
+        HTMLElement* h = static_cast<HTMLElement*>(m_current);
         const AtomicString& currentTagName = h->localName();
         if (h->hasLocalName(htmlTag)) {
             HTMLElement* elt = n->isHTMLElement() ? static_cast<HTMLElement*>(n) : 0;
@@ -487,10 +516,9 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
                 elt->hasLocalName(objectTag) || elt->hasLocalName(embedTag) ||
                 elt->hasLocalName(titleTag) || elt->hasLocalName(isindexTag) ||
                 elt->hasLocalName(baseTag))) {
-                if (!head) {
-                    head = new HTMLHeadElement(headTag, document);
-                    e = head;
-                    insertNode(e);
+                if (!m_head) {
+                    m_head = new HTMLHeadElement(headTag, m_document);
+                    insertNode(m_head.get());
                     handled = true;
                 }
             } else {
@@ -499,8 +527,14 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
                     if (t->containsOnlyWhitespace())
                         return false;
                 }
-                if (!haveFrameSet) {
-                    e = new HTMLBodyElement(bodyTag, document);
+                if (!m_haveFrameSet) {
+                    // Ensure that head exists.
+                    // But not for older versions of Mail, where the implicit <head> isn't expected - <rdar://problem/6863795>
+                    if (shouldCreateImplicitHead(m_document))
+                        createHead();
+
+                    popBlock(headTag);
+                    e = new HTMLBodyElement(bodyTag, m_document);
                     startBody();
                     insertNode(e);
                     handled = true;
@@ -512,9 +546,10 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
                 return false;
             else {
                 // This means the body starts here...
-                if (!haveFrameSet) {
+                if (!m_haveFrameSet) {
+                    ASSERT(currentTagName == headTag);
                     popBlock(currentTagName);
-                    e = new HTMLBodyElement(bodyTag, document);
+                    e = new HTMLBodyElement(bodyTag, m_document);
                     startBody();
                     insertNode(e);
                     handled = true;
@@ -542,7 +577,7 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
                 handled = true;      // ...and start a new one
             } else {
                 ExceptionCode ec = 0;
-                Node* node = current;
+                Node* node = m_current;
                 Node* parent = node->parentNode();
                 // A script may have removed the current node's parent from the DOM
                 // http://bugs.webkit.org/show_bug.cgi?id=7137
@@ -574,24 +609,24 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
                             pushBlock(localName, tagPriority);
                             n->beginParsingChildren();
                             setCurrent(n);
-                            inStrayTableContent++;
-                            blockStack->strayTableContent = true;
+                            m_inStrayTableContent++;
+                            m_blockStack->strayTableContent = true;
                         }
                         return true;
                     }
                 }
 
                 if (!ec) {
-                    if (current->hasTagName(trTag)) {
+                    if (m_current->hasTagName(trTag)) {
                         reportError(TablePartRequiredError, &localName, &tdTag.localName());
-                        e = new HTMLTableCellElement(tdTag, document);
-                    } else if (current->hasTagName(tableTag)) {
+                        e = new HTMLTableCellElement(tdTag, m_document);
+                    } else if (m_current->hasTagName(tableTag)) {
                         // Don't report an error in this case, since making a <tbody> happens all the time when you have <table><tr>,
                         // and it isn't really a parse error per se.
-                        e = new HTMLTableSectionElement(tbodyTag, document); 
+                        e = new HTMLTableSectionElement(tbodyTag, m_document);
                     } else {
                         reportError(TablePartRequiredError, &localName, &trTag.localName());
-                        e = new HTMLTableRowElement(trTag, document);
+                        e = new HTMLTableRowElement(trTag, m_document);
                     }
 
                     insertNode(e);
@@ -625,20 +660,20 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
             popBlock(currentTagName);
             handled = true;
         } else if (!h->hasLocalName(bodyTag)) {
-            if (isInline(current)) {
+            if (isInline(m_current)) {
                 popInlineBlocks();
                 handled = true;
             }
         }
-    } else if (current->isDocumentNode()) {
+    } else if (m_current->isDocumentNode()) {
         if (n->isTextNode()) {
             Text* t = static_cast<Text*>(n);
             if (t->containsOnlyWhitespace())
                 return false;
         }
 
-        if (!document->documentElement()) {
-            e = new HTMLHtmlElement(htmlTag, document);
+        if (!m_document->documentElement()) {
+            e = new HTMLHtmlElement(htmlTag, m_document);
             insertNode(e);
             handled = true;
         }
@@ -646,7 +681,7 @@ bool HTMLParser::handleError(Node* n, bool flat, const AtomicString& localName,
 
     // 3. If we couldn't handle the error, just return false and attempt to error-correct again.
     if (!handled) {
-        reportError(IgnoredContentError, &localName, &current->localName());
+        reportError(IgnoredContentError, &localName, &m_current->localName());
         return false;
     }
     return insertNode(n);
@@ -657,21 +692,21 @@ typedef HashMap<AtomicStringImpl*, CreateErrorCheckFunc> FunctionMap;
 
 bool HTMLParser::textCreateErrorCheck(Token* t, RefPtr<Node>& result)
 {
-    result = new Text(document, t->text.get());
+    result = new Text(m_document, t->text.get());
     return false;
 }
 
 bool HTMLParser::commentCreateErrorCheck(Token* t, RefPtr<Node>& result)
 {
-    result = new Comment(document, t->text.get());
+    result = new Comment(m_document, t->text.get());
     return false;
 }
 
 bool HTMLParser::headCreateErrorCheck(Token*, RefPtr<Node>& result)
 {
-    if (!head || current->localName() == htmlTag) {
-        head = new HTMLHeadElement(headTag, document);
-        result = head;
+    if (!m_head || m_current->localName() == htmlTag) {
+        m_head = new HTMLHeadElement(headTag, m_document);
+        result = m_head;
     } else
         reportError(MisplacedHeadError);
     return false;
@@ -680,8 +715,14 @@ bool HTMLParser::headCreateErrorCheck(Token*, RefPtr<Node>& result)
 bool HTMLParser::bodyCreateErrorCheck(Token*, RefPtr<Node>&)
 {
     // body no longer allowed if we have a frameset
-    if (haveFrameSet)
+    if (m_haveFrameSet)
         return false;
+    
+    // Ensure that head exists (unless parsing a fragment).
+    // But not for older versions of Mail, where the implicit <head> isn't expected - <rdar://problem/6863795>
+    if (!m_isParsingFragment && shouldCreateImplicitHead(m_document))
+        createHead();
+    
     popBlock(headTag);
     startBody();
     return true;
@@ -690,19 +731,19 @@ bool HTMLParser::bodyCreateErrorCheck(Token*, RefPtr<Node>&)
 bool HTMLParser::framesetCreateErrorCheck(Token*, RefPtr<Node>&)
 {
     popBlock(headTag);
-    if (inBody && !haveFrameSet && !haveContent) {
+    if (m_inBody && !m_haveFrameSet && !m_haveContent) {
         popBlock(bodyTag);
         // ### actually for IE document.body returns the now hidden "body" element
         // we can't implement that behaviour now because it could cause too many
         // regressions and the headaches are not worth the work as long as there is
         // no site actually relying on that detail (Dirk)
-        if (document->body())
-            document->body()->setAttribute(styleAttr, "display:none");
-        inBody = false;
+        if (m_document->body())
+            m_document->body()->setAttribute(styleAttr, "display:none");
+        m_inBody = false;
     }
-    if ((haveContent || haveFrameSet) && current->localName() == htmlTag)
+    if ((m_haveContent || m_haveFrameSet) && m_current->localName() == htmlTag)
         return false;
-    haveFrameSet = true;
+    m_haveFrameSet = true;
     startBody();
     return true;
 }
@@ -712,7 +753,7 @@ bool HTMLParser::formCreateErrorCheck(Token* t, RefPtr<Node>& result)
     // Only create a new form if we're not already inside one.
     // This is consistent with other browsers' behavior.
     if (!m_currentFormElement) {
-        m_currentFormElement = new HTMLFormElement(formTag, document);
+        m_currentFormElement = new HTMLFormElement(formTag, m_document);
         result = m_currentFormElement;
         pCloserCreateErrorCheck(t, result);
     }
@@ -722,7 +763,7 @@ bool HTMLParser::formCreateErrorCheck(Token* t, RefPtr<Node>& result)
 bool HTMLParser::isindexCreateErrorCheck(Token* t, RefPtr<Node>& result)
 {
     RefPtr<Node> n = handleIsindex(t);
-    if (!inBody)
+    if (!m_inBody)
         m_isindexElement = n.release();
     else {
         t->selfClosingTag = true;
@@ -800,7 +841,7 @@ bool HTMLParser::noframesCreateErrorCheck(Token*, RefPtr<Node>&)
 bool HTMLParser::noscriptCreateErrorCheck(Token*, RefPtr<Node>&)
 {
     if (!m_isParsingFragment) {
-        Settings* settings = document->settings();
+        Settings* settings = m_document->settings();
         if (settings && settings->isJavaScriptEnabled())
             setSkipMode(noscriptTag);
     }
@@ -816,7 +857,7 @@ bool HTMLParser::pCloserCreateErrorCheck(Token*, RefPtr<Node>&)
 
 bool HTMLParser::pCloserStrictCreateErrorCheck(Token*, RefPtr<Node>&)
 {
-    if (document->inCompatMode())
+    if (m_document->inCompatMode())
         return true;
     if (hasPElementInScope())
         popBlock(pTag);
@@ -825,7 +866,7 @@ bool HTMLParser::pCloserStrictCreateErrorCheck(Token*, RefPtr<Node>&)
 
 bool HTMLParser::mapCreateErrorCheck(Token*, RefPtr<Node>& result)
 {
-    m_currentMapElement = new HTMLMapElement(mapTag, document);
+    m_currentMapElement = new HTMLMapElement(mapTag, m_document);
     result = m_currentMapElement;
     return false;
 }
@@ -869,7 +910,9 @@ PassRefPtr<Node> HTMLParser::getNode(Token* t)
         gFunctionMap.set(nobrTag.localName().impl(), &HTMLParser::nestedCreateErrorCheck);
         gFunctionMap.set(noembedTag.localName().impl(), &HTMLParser::noembedCreateErrorCheck);
         gFunctionMap.set(noframesTag.localName().impl(), &HTMLParser::noframesCreateErrorCheck);
+#if !ENABLE(XHTMLMP)
         gFunctionMap.set(noscriptTag.localName().impl(), &HTMLParser::noscriptCreateErrorCheck);
+#endif
         gFunctionMap.set(olTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
         gFunctionMap.set(pTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
         gFunctionMap.set(plaintextTag.localName().impl(), &HTMLParser::pCloserCreateErrorCheck);
@@ -896,7 +939,7 @@ PassRefPtr<Node> HTMLParser::getNode(Token* t)
     if (CreateErrorCheckFunc errorCheckFunc = gFunctionMap.get(t->tagName.impl()))
         proceed = (this->*errorCheckFunc)(t, result);
     if (proceed)
-        result = HTMLElementFactory::createHTMLElement(QualifiedName(nullAtom, t->tagName, xhtmlNamespaceURI), document, m_currentFormElement.get());
+        result = HTMLElementFactory::createHTMLElement(QualifiedName(nullAtom, t->tagName, xhtmlNamespaceURI), m_document, m_currentFormElement.get());
     return result.release();
 }
 
@@ -906,7 +949,7 @@ bool HTMLParser::allowNestedRedundantTag(const AtomicString& tagName)
     // about 1500 tags, all from a bunch of <b>s.  We will only allow at most 20
     // nested tags of the same type before just ignoring them all together.
     unsigned i = 0;
-    for (HTMLStackElem* curr = blockStack;
+    for (HTMLStackElem* curr = m_blockStack;
          i < cMaxRedundantTagDepth && curr && curr->tagName == tagName;
          curr = curr->next, i++) { }
     return i != cMaxRedundantTagDepth;
@@ -929,9 +972,9 @@ void HTMLParser::processCloseTag(Token* t)
     else if (t->tagName == pTag)
         checkForCloseTagErrors = false;
         
-    HTMLStackElem* oldElem = blockStack;
+    HTMLStackElem* oldElem = m_blockStack;
     popBlock(t->tagName, checkForCloseTagErrors);
-    if (oldElem == blockStack && t->tagName == pTag) {
+    if (oldElem == m_blockStack && t->tagName == pTag) {
         // We encountered a stray </p>.  Amazingly Gecko, WinIE, and MacIE all treat
         // this as a valid break, i.e., <p></p>.  So go ahead and make the empty
         // paragraph.
@@ -975,11 +1018,13 @@ bool HTMLParser::isInline(Node* node) const
             e->hasLocalName(noframesTag) || e->hasLocalName(nolayerTag) ||
             e->hasLocalName(noembedTag))
             return true;
+#if !ENABLE(XHTMLMP)
         if (e->hasLocalName(noscriptTag) && !m_isParsingFragment) {
-            Settings* settings = document->settings();
+            Settings* settings = m_document->settings();
             if (settings && settings->isJavaScriptEnabled())
                 return true;
         }
+#endif
     }
     
     return false;
@@ -1031,6 +1076,7 @@ bool HTMLParser::isAffectedByResidualStyle(const AtomicString& tagName)
         unaffectedTags.add(optgroupTag.localName().impl());
         unaffectedTags.add(selectTag.localName().impl());
         unaffectedTags.add(objectTag.localName().impl());
+        unaffectedTags.add(datagridTag.localName().impl());
     }
     
     return !unaffectedTags.contains(tagName.impl());
@@ -1047,7 +1093,7 @@ void HTMLParser::handleResidualStyleCloseTagAcrossBlocks(HTMLStackElem* elem)
         // Find the outermost element that crosses over to a higher level. If there exists another higher-level
         // element, we will do another pass, until we have corrected the innermost one.
         ExceptionCode ec = 0;
-        HTMLStackElem* curr = blockStack;
+        HTMLStackElem* curr = m_blockStack;
         HTMLStackElem* prev = 0;
         HTMLStackElem* prevMaxElem = 0;
         maxElem = 0;
@@ -1071,7 +1117,7 @@ void HTMLParser::handleResidualStyleCloseTagAcrossBlocks(HTMLStackElem* elem)
             return;
 
         Node* residualElem = prev->node;
-        Node* blockElem = prevMaxElem ? prevMaxElem->node : current;
+        Node* blockElem = prevMaxElem ? prevMaxElem->node : m_current;
         Node* parentElem = elem->node;
 
         // Check to see if the reparenting that is going to occur is allowed according to the DOM.
@@ -1220,13 +1266,13 @@ void HTMLParser::handleResidualStyleCloseTagAcrossBlocks(HTMLStackElem* elem)
     // <table><b><i><form></b></form></i></table>
     // Then this check will be too simplistic.  Right now the <i><form> chain will end up inside the <tbody>, which is pretty crazy.
     if (strayTableContent)
-        inStrayTableContent--;
+        m_inStrayTableContent--;
 
     // Step 7: Reopen intermediate inlines, e.g., <b><p><i>Foo</b>Goo</p>.
     // In the above example, Goo should stay italic.
     // We cap the number of tags we're willing to reopen based off cResidualStyleMaxDepth.
     
-    HTMLStackElem* curr = blockStack;
+    HTMLStackElem* curr = m_blockStack;
     HTMLStackElem* residualStyleStack = 0;
     unsigned stackDepth = 1;
     unsigned redundantStyleCount = 0;
@@ -1254,7 +1300,7 @@ void HTMLParser::handleResidualStyleCloseTagAcrossBlocks(HTMLStackElem* elem)
         } else
             popOneBlock();
 
-        curr = blockStack;
+        curr = m_blockStack;
     }
 
     reopenResidualStyleTags(residualStyleStack, 0); // Stray table content can't be an issue here, since some element above will always become the root of new stray table content.
@@ -1276,7 +1322,7 @@ void HTMLParser::reopenResidualStyleTags(HTMLStackElem* elem, Node* malformedTab
         if (malformedTableParent)
             malformedTableParent->insertBefore(newNode, malformedTableParent->lastChild(), ec);
         else
-            current->appendChild(newNode, ec);
+            m_current->appendChild(newNode, ec);
         // FIXME: Is it really OK to ignore the exceptions here?
 
         // Now push a new stack element for this node we just created.
@@ -1285,9 +1331,9 @@ void HTMLParser::reopenResidualStyleTags(HTMLStackElem* elem, Node* malformedTab
 
         // Set our strayTableContent boolean if needed, so that the reopened tag also knows
         // that it is inside a malformed table.
-        blockStack->strayTableContent = malformedTableParent != 0;
-        if (blockStack->strayTableContent)
-            inStrayTableContent++;
+        m_blockStack->strayTableContent = malformedTableParent != 0;
+        if (m_blockStack->strayTableContent)
+            m_inStrayTableContent++;
 
         // Clear our malformed table parent variable.
         malformedTableParent = 0;
@@ -1305,8 +1351,10 @@ void HTMLParser::reopenResidualStyleTags(HTMLStackElem* elem, Node* malformedTab
 
 void HTMLParser::pushBlock(const AtomicString& tagName, int level)
 {
-    blockStack = new HTMLStackElem(tagName, level, current, didRefCurrent, blockStack);
-    didRefCurrent = false;
+    m_blockStack = new HTMLStackElem(tagName, level, m_current, m_didRefCurrent, m_blockStack);
+    if (level >= minBlockLevelTagPriority)
+        m_blocksInStack++;
+    m_didRefCurrent = false;
     if (tagName == pTag)
         m_hasPElementInScope = InScope;
     else if (isScopingTag(tagName))
@@ -1315,8 +1363,11 @@ void HTMLParser::pushBlock(const AtomicString& tagName, int level)
 
 void HTMLParser::popBlock(const AtomicString& tagName, bool reportErrors)
 {
-    HTMLStackElem* elem = blockStack;
-    
+    HTMLStackElem* elem = m_blockStack;
+
+    if (m_parserQuirks && elem && !m_parserQuirks->shouldPopBlock(elem->tagName, tagName))
+        return;
+
     int maxLevel = 0;
 
     while (elem && (elem->tagName != tagName)) {
@@ -1343,12 +1394,12 @@ void HTMLParser::popBlock(const AtomicString& tagName, bool reportErrors)
     HTMLStackElem* residualStyleStack = 0;
     Node* malformedTableParent = 0;
     
-    elem = blockStack;
+    elem = m_blockStack;
     unsigned stackDepth = 1;
     unsigned redundantStyleCount = 0;
     while (elem) {
         if (elem->tagName == tagName) {
-            int strayTable = inStrayTableContent;
+            int strayTable = m_inStrayTableContent;
             popOneBlock();
             elem = 0;
 
@@ -1356,8 +1407,8 @@ void HTMLParser::popBlock(const AtomicString& tagName, bool reportErrors)
             // explicit <tbody> or <tr>.
             // If we end up needing to reopen residual style tags, the root of the reopened chain
             // must also know that it is the root of malformed content inside a <tbody>/<tr>.
-            if (strayTable && (inStrayTableContent < strayTable) && residualStyleStack) {
-                Node* curr = current;
+            if (strayTable && (m_inStrayTableContent < strayTable) && residualStyleStack) {
+                Node* curr = m_current;
                 while (curr && !curr->hasTagName(tableTag))
                     curr = curr->parentNode();
                 malformedTableParent = curr ? curr->parentNode() : 0;
@@ -1392,7 +1443,7 @@ void HTMLParser::popBlock(const AtomicString& tagName, bool reportErrors)
                     popOneBlock();
             } else
                 popOneBlock();
-            elem = blockStack;
+            elem = m_blockStack;
         }
     }
 
@@ -1401,19 +1452,23 @@ void HTMLParser::popBlock(const AtomicString& tagName, bool reportErrors)
 
 inline HTMLStackElem* HTMLParser::popOneBlockCommon()
 {
-    HTMLStackElem* elem = blockStack;
+    HTMLStackElem* elem = m_blockStack;
 
     // Form elements restore their state during the parsing process.
     // Also, a few elements (<applet>, <object>) need to know when all child elements (<param>s) are available.
-    if (current && elem->node != current)
-        current->finishParsingChildren();
+    if (m_current && elem->node != m_current)
+        m_current->finishParsingChildren();
 
-    blockStack = elem->next;
-    current = elem->node;
-    didRefCurrent = elem->didRefNode;
+    if (m_blockStack->level >= minBlockLevelTagPriority) {
+        ASSERT(m_blocksInStack > 0);
+        m_blocksInStack--;
+    }
+    m_blockStack = elem->next;
+    m_current = elem->node;
+    m_didRefCurrent = elem->didRefNode;
 
     if (elem->strayTableContent)
-        inStrayTableContent--;
+        m_inStrayTableContent--;
 
     if (elem->tagName == pTag)
         m_hasPElementInScope = NotInScope;
@@ -1426,8 +1481,8 @@ inline HTMLStackElem* HTMLParser::popOneBlockCommon()
 void HTMLParser::popOneBlock()
 {
     // Store the current node before popOneBlockCommon overwrites it.
-    Node* lastCurrent = current;
-    bool didRefLastCurrent = didRefCurrent;
+    Node* lastCurrent = m_current;
+    bool didRefLastCurrent = m_didRefCurrent;
 
     delete popOneBlockCommon();
 
@@ -1441,8 +1496,8 @@ void HTMLParser::moveOneBlockToStack(HTMLStackElem*& head)
     // See the two callers for details.
 
     // Store the current node before popOneBlockCommon overwrites it.
-    Node* lastCurrent = current;
-    bool didRefLastCurrent = didRefCurrent;
+    Node* lastCurrent = m_current;
+    bool didRefLastCurrent = m_didRefCurrent;
 
     // Pop the block, but don't deref the current node as popOneBlock does because
     // we'll be using the pointer in the new stack element.
@@ -1450,7 +1505,7 @@ void HTMLParser::moveOneBlockToStack(HTMLStackElem*& head)
 
     // Transfer the current node into the stack element.
     // No need to deref the old elem->node because popOneBlockCommon transferred
-    // it into the current/didRefCurrent fields.
+    // it into the m_current/m_didRefCurrent fields.
     elem->node = lastCurrent;
     elem->didRefNode = didRefLastCurrent;
     elem->next = head;
@@ -1460,7 +1515,7 @@ void HTMLParser::moveOneBlockToStack(HTMLStackElem*& head)
 void HTMLParser::checkIfHasPElementInScope()
 {
     m_hasPElementInScope = NotInScope;
-    HTMLStackElem* elem = blockStack;
+    HTMLStackElem* elem = m_blockStack;
     while (elem) {
         const AtomicString& tagName = elem->tagName;
         if (tagName == pTag) {
@@ -1474,42 +1529,48 @@ void HTMLParser::checkIfHasPElementInScope()
 
 void HTMLParser::popInlineBlocks()
 {
-    while (blockStack && isInline(current))
+    while (m_blockStack && isInline(m_current))
         popOneBlock();
 }
 
 void HTMLParser::freeBlock()
 {
-    while (blockStack)
+    while (m_blockStack)
         popOneBlock();
+    ASSERT(!m_blocksInStack);
 }
 
 void HTMLParser::createHead()
 {
-    if (head || !document->documentElement())
+    if (m_head)
         return;
 
-    head = new HTMLHeadElement(headTag, document);
-    HTMLElement* body = document->body();
+    if (!m_document->documentElement()) {
+        insertNode(new HTMLHtmlElement(htmlTag, m_document));
+        ASSERT(m_document->documentElement());
+    }
+
+    m_head = new HTMLHeadElement(headTag, m_document);
+    HTMLElement* body = m_document->body();
     ExceptionCode ec = 0;
-    document->documentElement()->insertBefore(head, body, ec);
+    m_document->documentElement()->insertBefore(m_head.get(), body, ec);
     if (ec)
-        head = 0;
+        m_head = 0;
         
     // If the body does not exist yet, then the <head> should be pushed as the current block.
-    if (head && !body) {
-        pushBlock(head->localName(), head->tagPriority());
-        setCurrent(head);
+    if (m_head && !body) {
+        pushBlock(m_head->localName(), m_head->tagPriority());
+        setCurrent(m_head.get());
     }
 }
 
 PassRefPtr<Node> HTMLParser::handleIsindex(Token* t)
 {
-    RefPtr<Node> n = new HTMLDivElement(divTag, document);
+    RefPtr<Node> n = new HTMLDivElement(divTag, m_document);
 
     NamedMappedAttrMap* attrs = t->attrs.get();
 
-    RefPtr<HTMLIsIndexElement> isIndex = new HTMLIsIndexElement(isindexTag, document, m_currentFormElement.get());
+    RefPtr<HTMLIsIndexElement> isIndex = new HTMLIsIndexElement(isindexTag, m_document, m_currentFormElement.get());
     isIndex->setAttributeMap(attrs);
     isIndex->setAttribute(typeAttr, "khtml_isindex");
 
@@ -1520,20 +1581,20 @@ PassRefPtr<Node> HTMLParser::handleIsindex(Token* t)
         t->attrs = 0;
     }
 
-    n->addChild(new HTMLHRElement(hrTag, document));
-    n->addChild(new Text(document, text));
+    n->addChild(new HTMLHRElement(hrTag, m_document));
+    n->addChild(new Text(m_document, text));
     n->addChild(isIndex.release());
-    n->addChild(new HTMLHRElement(hrTag, document));
+    n->addChild(new HTMLHRElement(hrTag, m_document));
 
     return n.release();
 }
 
 void HTMLParser::startBody()
 {
-    if (inBody)
+    if (m_inBody)
         return;
 
-    inBody = true;
+    m_inBody = true;
 
     if (m_isindexElement) {
         insertNode(m_isindexElement.get(), true /* don't descend into this node */);
@@ -1544,8 +1605,8 @@ void HTMLParser::startBody()
 void HTMLParser::finished()
 {
     // In the case of a completely empty document, here's the place to create the HTML element.
-    if (current && current->isDocumentNode() && !document->documentElement())
-        insertNode(new HTMLHtmlElement(htmlTag, document));
+    if (m_current && m_current->isDocumentNode() && !m_document->documentElement())
+        insertNode(new HTMLHtmlElement(htmlTag, m_document));
 
     // This ensures that "current" is not left pointing to a node when the document is destroyed.
     freeBlock();
@@ -1553,16 +1614,16 @@ void HTMLParser::finished()
 
     // Warning, this may delete the tokenizer and parser, so don't try to do anything else after this.
     if (!m_isParsingFragment)
-        document->finishedParsing();
+        m_document->finishedParsing();
 }
 
 void HTMLParser::reportErrorToConsole(HTMLParserErrorCode errorCode, const AtomicString* tagName1, const AtomicString* tagName2, bool closeTags)
 {    
-    Frame* frame = document->frame();
+    Frame* frame = m_document->frame();
     if (!frame)
         return;
     
-    HTMLTokenizer* htmlTokenizer = static_cast<HTMLTokenizer*>(document->tokenizer());
+    HTMLTokenizer* htmlTokenizer = static_cast<HTMLTokenizer*>(m_document->tokenizer());
     int lineNumber = htmlTokenizer->lineNumber() + 1;
 
     AtomicString tag1;
@@ -1597,7 +1658,25 @@ void HTMLParser::reportErrorToConsole(HTMLParserErrorCode errorCode, const Atomi
 
     frame->domWindow()->console()->addMessage(HTMLMessageSource,
         isWarning(errorCode) ? WarningMessageLevel : ErrorMessageLevel,
-        message, lineNumber, document->url().string());
+        message, lineNumber, m_document->url().string());
+}
+
+#ifdef BUILDING_ON_LEOPARD
+bool shouldCreateImplicitHead(Document* document)
+{
+    ASSERT(document);
+    
+    Settings* settings = document->page() ? document->page()->settings() : 0;
+    return settings ? !settings->needsLeopardMailQuirks() : true;
+}
+#elif defined(BUILDING_ON_TIGER)
+bool shouldCreateImplicitHead(Document* document)
+{
+    ASSERT(document);
+    
+    Settings* settings = document->page() ? document->page()->settings() : 0;
+    return settings ? !settings->needsTigerMailQuirks() : true;
 }
+#endif
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLParser.h b/src/3rdparty/webkit/WebCore/html/HTMLParser.h
index 866835f..19f553e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLParser.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLParser.h
@@ -3,7 +3,7 @@
               (C) 1997 Torben Weis (weis@kde.org)
               (C) 1998 Waldo Bastian (bastian@kde.org)
               (C) 1999 Lars Knoll (knoll@kde.org)
-    Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+    Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -26,6 +26,7 @@
 
 #include "QualifiedName.h"
 #include <wtf/Forward.h>
+#include <wtf/OwnPtr.h>
 #include <wtf/RefPtr.h>
 #include "HTMLParserErrorCodes.h"
 
@@ -38,6 +39,7 @@ class HTMLDocument;
 class HTMLFormElement;
 class HTMLHeadElement;
 class HTMLMapElement;
+class HTMLParserQuirks;
 class Node;
 
 struct HTMLStackElem;
@@ -150,35 +152,48 @@ private:
 
     void reportErrorToConsole(HTMLParserErrorCode, const AtomicString* tagName1, const AtomicString* tagName2, bool closeTags);
     
-    Document* document;
+    Document* m_document;
 
     // The currently active element (the one new elements will be added to). Can be a document fragment, a document or an element.
-    Node* current;
+    Node* m_current;
     // We can't ref a document, but we don't want to constantly check if a node is a document just to decide whether to deref.
-    bool didRefCurrent;
+    bool m_didRefCurrent;
 
-    HTMLStackElem* blockStack;
+    HTMLStackElem* m_blockStack;
+
+    // The number of tags with priority minBlockLevelTagPriority or higher
+    // currently in m_blockStack. The parser enforces a cap on this value by
+    // adding such new elements as siblings instead of children once it is reached.
+    size_t m_blocksInStack;
 
     enum ElementInScopeState { NotInScope, InScope, Unknown }; 
     ElementInScopeState m_hasPElementInScope;
 
     RefPtr<HTMLFormElement> m_currentFormElement; // currently active form
     RefPtr<HTMLMapElement> m_currentMapElement; // current map
-    HTMLHeadElement* head; // head element; needed for HTML which defines <base> after </head>
+    RefPtr<HTMLHeadElement> m_head; // head element; needed for HTML which defines <base> after </head>
     RefPtr<Node> m_isindexElement; // a possible <isindex> element in the head
 
-    bool inBody;
-    bool haveContent;
-    bool haveFrameSet;
+    bool m_inBody;
+    bool m_haveContent;
+    bool m_haveFrameSet;
 
     AtomicString m_skipModeTag; // tells the parser to discard all tags until it reaches the one specified
 
     bool m_isParsingFragment;
     bool m_reportErrors;
     bool m_handlingResidualStyleAcrossBlocks;
-    int inStrayTableContent;
+    int m_inStrayTableContent;
+
+    OwnPtr<HTMLParserQuirks> m_parserQuirks;
 };
 
+#if defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_TIGER)
+bool shouldCreateImplicitHead(Document*);
+#else
+inline bool shouldCreateImplicitHead(Document*) { return true; }
+#endif
+
 }
     
 #endif // HTMLParser_h
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLParserQuirks.h b/src/3rdparty/webkit/WebCore/html/HTMLParserQuirks.h
new file mode 100644
index 0000000..b5972a6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/html/HTMLParserQuirks.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HTMLParserQuirks_h
+#define HTMLParserQuirks_h
+
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+class AtomicString;
+class Node;
+
+class HTMLParserQuirks : Noncopyable {
+public:
+    HTMLParserQuirks() { }
+    virtual ~HTMLParserQuirks() { }
+
+    virtual void reset() = 0;
+
+    virtual bool shouldInsertNode(Node* parent, Node* newNode) = 0;
+    virtual bool shouldPopBlock(const AtomicString& tagNameOnStack, const AtomicString& tagNameToPop) = 0;
+};
+
+} // namespace WebCore
+
+#endif // HTMLParserQuirks_h
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLPlugInElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLPlugInElement.cpp
index 4344b3d..d950d9d 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLPlugInElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLPlugInElement.cpp
@@ -21,6 +21,7 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLPlugInElement.h"
 
@@ -30,6 +31,7 @@
 #include "FrameLoader.h"
 #include "FrameTree.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderWidget.h"
 #include "ScriptController.h"
@@ -46,7 +48,7 @@ using namespace HTMLNames;
 
 HTMLPlugInElement::HTMLPlugInElement(const QualifiedName& tagName, Document* doc)
     // FIXME: Always passing false as createdByParser is odd (see bug22851).
-    : HTMLFrameOwnerElement(tagName, doc, false)
+    : HTMLFrameOwnerElement(tagName, doc)
 #if ENABLE(NETSCAPE_PLUGIN_API)
     , m_NPObject(0)
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLPreElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLPreElement.cpp
index 23ecaaa..f340ae3 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLPreElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLPreElement.cpp
@@ -21,12 +21,14 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "HTMLPreElement.h"
 
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLQuoteElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLQuoteElement.cpp
index 19164e2..e548215 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLQuoteElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLQuoteElement.cpp
@@ -22,6 +22,7 @@
 #include "config.h"
 #include "HTMLQuoteElement.h"
 
+#include "Document.h"
 #include "HTMLNames.h"
 
 namespace WebCore {
@@ -34,6 +35,13 @@ HTMLQuoteElement::HTMLQuoteElement(const QualifiedName& tagName, Document* doc)
     ASSERT(hasTagName(qTag));
 }
 
+void HTMLQuoteElement::insertedIntoDocument()
+{
+    document()->setUsesBeforeAfterRules(true);
+
+    HTMLElement::insertedIntoDocument();
+}
+
 String HTMLQuoteElement::cite() const
 {
     return getAttribute(citeAttr);
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLQuoteElement.h b/src/3rdparty/webkit/WebCore/html/HTMLQuoteElement.h
index 1e35431..623c28f 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLQuoteElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLQuoteElement.h
@@ -36,6 +36,8 @@ public:
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
     virtual int tagPriority() const { return 1; }
 
+    virtual void insertedIntoDocument();
+
     String cite() const;
     void setCite(const String&);
 };
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.cpp
index 4744b34..86cc3a2 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.cpp
@@ -26,6 +26,8 @@
 #include "Document.h"
 #include "EventNames.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
+#include "ScriptEventListener.h"
 #include "Text.h"
 
 namespace WebCore {
@@ -67,7 +69,7 @@ void HTMLScriptElement::parseMappedAttribute(MappedAttribute* attr)
     if (attrName == srcAttr)
         handleSourceAttribute(m_data, attr->value());
     else if (attrName == onloadAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().loadEvent, attr);
+        setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
     else
         HTMLElement::parseMappedAttribute(attr);
 }
@@ -209,18 +211,23 @@ String HTMLScriptElement::languageAttributeValue() const
 {
     return getAttribute(languageAttr).string();
 }
+
+String HTMLScriptElement::forAttributeValue() const
+{
+    return getAttribute(forAttr).string();
+}
  
 void HTMLScriptElement::dispatchLoadEvent()
 {
     ASSERT(!m_data.haveFiredLoadEvent());
     m_data.setHaveFiredLoadEvent(true);
 
-    dispatchEventForType(eventNames().loadEvent, false, false);
+    dispatchEvent(eventNames().loadEvent, false, false);
 }
 
 void HTMLScriptElement::dispatchErrorEvent()
 {
-    dispatchEventForType(eventNames().errorEvent, true, false);
+    dispatchEvent(eventNames().errorEvent, true, false);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.h b/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.h
index 8839131..4d18beb 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLScriptElement.h
@@ -35,7 +35,7 @@ public:
     HTMLScriptElement(const QualifiedName&, Document*, bool createdByParser);
     ~HTMLScriptElement();
 
-    bool shouldExecuteAsJavaScript() const;
+    virtual bool shouldExecuteAsJavaScript() const;
     virtual String scriptContent() const;
 
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
@@ -75,11 +75,14 @@ public:
     
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
+    bool haveFiredLoadEvent() const { return m_data.haveFiredLoadEvent(); }
+
 protected:
     virtual String sourceAttributeValue() const;
     virtual String charsetAttributeValue() const;
     virtual String typeAttributeValue() const;
     virtual String languageAttributeValue() const;
+    virtual String forAttributeValue() const;
 
     virtual void dispatchLoadEvent();
     virtual void dispatchErrorEvent();
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.cpp
index f347698..c47bb70 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.cpp
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *           (C) 2006 Alexey Proskuryakov (ap@nypop.com)
  *
  * This library is free software; you can redistribute it and/or
@@ -21,64 +21,31 @@
  * Boston, MA 02110-1301, USA.
  *
  */
- 
+
 #include "config.h"
 #include "HTMLSelectElement.h"
 
 #include "AXObjectCache.h"
-#include "CSSPropertyNames.h"
-#include "CSSStyleSelector.h"
-#include "CharacterNames.h"
-#include "ChromeClient.h"
-#include "Document.h"
-#include "Event.h"
-#include "EventHandler.h"
 #include "EventNames.h"
-#include "FormDataList.h"
-#include "Frame.h"
-#include "FrameLoader.h"
-#include "FrameLoaderClient.h"
-#include "HTMLFormElement.h"
 #include "HTMLNames.h"
 #include "HTMLOptionElement.h"
 #include "HTMLOptionsCollection.h"
-#include "KeyboardEvent.h"
-#include "MouseEvent.h"
-#include "Page.h"
+#include "MappedAttribute.h"
 #include "RenderListBox.h"
 #include "RenderMenuList.h"
-#include <math.h>
-#include <wtf/StdLibExtras.h>
-#include <wtf/Vector.h>
-
-#if PLATFORM(MAC)
-#define ARROW_KEYS_POP_MENU 1
-#else
-#define ARROW_KEYS_POP_MENU 0
-#endif
+#include "ScriptEventListener.h"
 
 using namespace std;
-using namespace WTF;
-using namespace Unicode;
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
-static const DOMTimeStamp typeAheadTimeout = 1000;
+// Upper limit agreed upon with representatives of Opera and Mozilla.
+static const unsigned maxSelectItems = 10000;
 
-HTMLSelectElement::HTMLSelectElement(const QualifiedName& tagName, Document* doc, HTMLFormElement* f)
-    : HTMLFormControlElementWithState(tagName, doc, f)
-    , m_minwidth(0)
-    , m_size(0)
-    , m_multiple(false)
-    , m_recalcListItems(false)
-    , m_lastOnChangeIndex(-1)
-    , m_activeSelectionAnchorIndex(-1)
-    , m_activeSelectionEndIndex(-1)
-    , m_activeSelectionState(false)
-    , m_repeatingChar(0)
-    , m_lastCharTime(0)
+HTMLSelectElement::HTMLSelectElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
+    : HTMLFormControlElementWithState(tagName, document, form)
 {
     ASSERT(hasTagName(selectTag) || hasTagName(keygenTag));
 }
@@ -90,120 +57,57 @@ bool HTMLSelectElement::checkDTD(const Node* newChild)
            newChild->hasTagName(scriptTag);
 }
 
-void HTMLSelectElement::recalcStyle( StyleChange ch )
+void HTMLSelectElement::recalcStyle(StyleChange change)
 {
-    if (hasChangedChild() && renderer()) {
-        if (usesMenuList())
-            static_cast<RenderMenuList*>(renderer())->setOptionsChanged(true);
-        else
-            static_cast<RenderListBox*>(renderer())->setOptionsChanged(true);
-    } else if (m_recalcListItems)
-        recalcListItems();
-
-    HTMLFormControlElementWithState::recalcStyle(ch);
+    SelectElement::recalcStyle(m_data, this);
+    HTMLFormControlElementWithState::recalcStyle(change);
 }
 
-const AtomicString& HTMLSelectElement::type() const
+const AtomicString& HTMLSelectElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, selectMultiple, ("select-multiple"));
     DEFINE_STATIC_LOCAL(const AtomicString, selectOne, ("select-one"));
-    return m_multiple ? selectMultiple : selectOne;
+    return m_data.multiple() ? selectMultiple : selectOne;
 }
 
 int HTMLSelectElement::selectedIndex() const
 {
-    // return the number of the first option selected
-    unsigned index = 0;
-    const Vector<HTMLElement*>& items = listItems();
-    for (unsigned int i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag)) {
-            if (static_cast<HTMLOptionElement*>(items[i])->selected())
-                return index;
-            index++;
-        }
-    }
-    return -1;
+    return SelectElement::selectedIndex(m_data, this);
 }
 
-int HTMLSelectElement::lastSelectedListIndex() const
+void HTMLSelectElement::deselectItems(HTMLOptionElement* excludeElement)
 {
-    // return the number of the last option selected
-    unsigned index = 0;
-    bool found = false;
-    const Vector<HTMLElement*>& items = listItems();
-    for (unsigned int i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag)) {
-            if (static_cast<HTMLOptionElement*>(items[i])->selected()) {
-                index = i;
-                found = true;
-            }
-        }
-    }
-    return found ? (int) index : -1;
+    SelectElement::deselectItems(m_data, this, excludeElement);
 }
 
-void HTMLSelectElement::deselectItems(HTMLOptionElement* excludeElement)
+void HTMLSelectElement::setSelectedIndex(int optionIndex, bool deselect)
 {
-    const Vector<HTMLElement*>& items = listItems();
-    unsigned i;
-    for (i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag) && (items[i] != excludeElement)) {
-            HTMLOptionElement* element = static_cast<HTMLOptionElement*>(items[i]);
-            element->setSelectedState(false);
-        }
-    }
+    SelectElement::setSelectedIndex(m_data, this, optionIndex, deselect, false, false);
 }
 
-void HTMLSelectElement::setSelectedIndex(int optionIndex, bool deselect, bool fireOnChange)
+void HTMLSelectElement::setSelectedIndexByUser(int optionIndex, bool deselect, bool fireOnChangeNow)
 {
-    const Vector<HTMLElement*>& items = listItems();
-    int listIndex = optionToListIndex(optionIndex);
-    HTMLOptionElement* element = 0;
-
-    if (!multiple())
-        deselect = true;
-
-    if (listIndex >= 0) {
-        if (m_activeSelectionAnchorIndex < 0 || deselect)
-            setActiveSelectionAnchorIndex(listIndex);
-        if (m_activeSelectionEndIndex < 0 || deselect)
-            setActiveSelectionEndIndex(listIndex);
-        element = static_cast<HTMLOptionElement*>(items[listIndex]);
-        element->setSelectedState(true);
-    }
-
-    if (deselect)
-        deselectItems(element);
-
-    scrollToSelection();
-
-    // This only gets called with fireOnChange for menu lists. 
-    if (fireOnChange && usesMenuList())
-        menuListOnChange();
-
-    Frame* frame = document()->frame();
-    if (frame)
-        frame->page()->chrome()->client()->formStateDidChange(this);
+    SelectElement::setSelectedIndex(m_data, this, optionIndex, deselect, fireOnChangeNow, true);
 }
 
 int HTMLSelectElement::activeSelectionStartListIndex() const
 {
-    if (m_activeSelectionAnchorIndex >= 0)
-        return m_activeSelectionAnchorIndex;
+    if (m_data.activeSelectionAnchorIndex() >= 0)
+        return m_data.activeSelectionAnchorIndex();
     return optionToListIndex(selectedIndex());
 }
 
 int HTMLSelectElement::activeSelectionEndListIndex() const
 {
-    if (m_activeSelectionEndIndex >= 0)
-        return m_activeSelectionEndIndex;
-    return lastSelectedListIndex();
+    if (m_data.activeSelectionEndIndex() >= 0)
+        return m_data.activeSelectionEndIndex();
+    return SelectElement::lastSelectedListIndex(m_data, this);
 }
 
 unsigned HTMLSelectElement::length() const
 {
     unsigned len = 0;
-    const Vector<HTMLElement*>& items = listItems();
+    const Vector<Element*>& items = listItems();
     for (unsigned i = 0; i < items.size(); ++i) {
         if (items[i]->hasLocalName(optionTag))
             ++len;
@@ -218,37 +122,29 @@ void HTMLSelectElement::add(HTMLElement *element, HTMLElement *before, Exception
     if (!element || !(element->hasLocalName(optionTag) || element->hasLocalName(hrTag)))
         return;
 
-    ec = 0;
     insertBefore(element, before, ec);
-    if (!ec)
-        setRecalcListItems();
 }
 
 void HTMLSelectElement::remove(int index)
 {
-    ExceptionCode ec = 0;
     int listIndex = optionToListIndex(index);
+    if (listIndex < 0)
+        return;
 
-    const Vector<HTMLElement*>& items = listItems();
-    if (listIndex < 0 || index >= int(items.size()))
-        return; // ### what should we do ? remove the last item?
-
-    Element *item = items[listIndex];
+    Element* item = listItems()[listIndex];
     ASSERT(item->parentNode());
+    ExceptionCode ec;
     item->parentNode()->removeChild(item, ec);
-    if (!ec)
-        setRecalcListItems();
 }
 
 String HTMLSelectElement::value()
 {
-    unsigned i;
-    const Vector<HTMLElement*>& items = listItems();
-    for (i = 0; i < items.size(); i++) {
+    const Vector<Element*>& items = listItems();
+    for (unsigned i = 0; i < items.size(); i++) {
         if (items[i]->hasLocalName(optionTag) && static_cast<HTMLOptionElement*>(items[i])->selected())
             return static_cast<HTMLOptionElement*>(items[i])->value();
     }
-    return String("");
+    return "";
 }
 
 void HTMLSelectElement::setValue(const String &value)
@@ -257,9 +153,9 @@ void HTMLSelectElement::setValue(const String &value)
         return;
     // find the option with value() matching the given parameter
     // and make it the current selection.
-    const Vector<HTMLElement*>& items = listItems();
+    const Vector<Element*>& items = listItems();
     unsigned optionIndex = 0;
-    for (unsigned i = 0; i < items.size(); i++)
+    for (unsigned i = 0; i < items.size(); i++) {
         if (items[i]->hasLocalName(optionTag)) {
             if (static_cast<HTMLOptionElement*>(items[i])->value() == value) {
                 setSelectedIndex(optionIndex, true);
@@ -267,80 +163,24 @@ void HTMLSelectElement::setValue(const String &value)
             }
             optionIndex++;
         }
-}
-
-bool HTMLSelectElement::saveState(String& value) const
-{
-    const Vector<HTMLElement*>& items = listItems();
-    int l = items.size();
-    Vector<char, 1024> characters(l);
-    for (int i = 0; i < l; ++i) {
-        HTMLElement* e = items[i];
-        bool selected = e->hasLocalName(optionTag) && static_cast<HTMLOptionElement*>(e)->selected();
-        characters[i] = selected ? 'X' : '.';
     }
-    value = String(characters.data(), l);
-    return true;
 }
 
-void HTMLSelectElement::restoreState(const String& state)
+bool HTMLSelectElement::saveFormControlState(String& value) const
 {
-    recalcListItems();
-    
-    const Vector<HTMLElement*>& items = listItems();
-    int l = items.size();
-    for (int i = 0; i < l; i++)
-        if (items[i]->hasLocalName(optionTag))
-            static_cast<HTMLOptionElement*>(items[i])->setSelectedState(state[i] == 'X');
-            
-    setChanged();
-}
-
-bool HTMLSelectElement::insertBefore(PassRefPtr<Node> newChild, Node* refChild, ExceptionCode& ec, bool shouldLazyAttach)
-{
-    bool result = HTMLFormControlElementWithState::insertBefore(newChild, refChild, ec, shouldLazyAttach);
-    if (result)
-        setRecalcListItems();
-    return result;
+    return SelectElement::saveFormControlState(m_data, this, value);
 }
 
-bool HTMLSelectElement::replaceChild(PassRefPtr<Node> newChild, Node *oldChild, ExceptionCode& ec, bool shouldLazyAttach)
+void HTMLSelectElement::restoreFormControlState(const String& state)
 {
-    bool result = HTMLFormControlElementWithState::replaceChild(newChild, oldChild, ec, shouldLazyAttach);
-    if (result)
-        setRecalcListItems();
-    return result;
+    SelectElement::restoreFormControlState(m_data, this, state);
 }
 
-bool HTMLSelectElement::removeChild(Node* oldChild, ExceptionCode& ec)
+void HTMLSelectElement::parseMappedAttribute(MappedAttribute* attr) 
 {
-    bool result = HTMLFormControlElementWithState::removeChild(oldChild, ec);
-    if (result)
-        setRecalcListItems();
-    return result;
-}
-
-bool HTMLSelectElement::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bool shouldLazyAttach)
-{
-    bool result = HTMLFormControlElementWithState::appendChild(newChild, ec, shouldLazyAttach);
-    if (result)
-        setRecalcListItems();
-    return result;
-}
-
-bool HTMLSelectElement::removeChildren()
-{
-    bool result = HTMLFormControlElementWithState::removeChildren();
-    if (result)
-        setRecalcListItems();
-    return result;
-}
-
-void HTMLSelectElement::parseMappedAttribute(MappedAttribute *attr)
-{
-    bool oldUsesMenuList = usesMenuList();
+    bool oldUsesMenuList = m_data.usesMenuList();
     if (attr->name() == sizeAttr) {
-        int oldSize = m_size;
+        int oldSize = m_data.size();
         // Set the attribute value to a number.
         // This is important since the style rules for this attribute can determine the appearance property.
         int size = attr->value().toInt();
@@ -348,31 +188,25 @@ void HTMLSelectElement::parseMappedAttribute(MappedAttribute *attr)
         if (attrSize != attr->value())
             attr->setValue(attrSize);
 
-        m_size = max(size, 1);
-        if ((oldUsesMenuList != usesMenuList() || !oldUsesMenuList && m_size != oldSize) && attached()) {
+        m_data.setSize(max(size, 1));
+        if ((oldUsesMenuList != m_data.usesMenuList() || (!oldUsesMenuList && m_data.size() != oldSize)) && attached()) {
             detach();
             attach();
             setRecalcListItems();
         }
-    } else if (attr->name() == widthAttr) {
-        m_minwidth = max(attr->value().toInt(), 0);
-    } else if (attr->name() == multipleAttr) {
-        m_multiple = (!attr->isNull());
-        if (oldUsesMenuList != usesMenuList() && attached()) {
-            detach();
-            attach();
-        }
-    } else if (attr->name() == accesskeyAttr) {
+    } else if (attr->name() == multipleAttr)
+        SelectElement::parseMultipleAttribute(m_data, this, attr);
+    else if (attr->name() == accesskeyAttr) {
         // FIXME: ignore for the moment
     } else if (attr->name() == alignAttr) {
         // Don't map 'align' attribute.  This matches what Firefox, Opera and IE do.
         // See http://bugs.webkit.org/show_bug.cgi?id=12072
     } else if (attr->name() == onfocusAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().focusEvent, attr);
+        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onblurAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().blurEvent, attr);
+        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onchangeAttr) {
-        setInlineEventListenerForTypeAndAttribute(eventNames().changeEvent, attr);
+        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
     } else
         HTMLFormControlElementWithState::parseMappedAttribute(attr);
 }
@@ -393,95 +227,34 @@ bool HTMLSelectElement::isMouseFocusable() const
 
 bool HTMLSelectElement::canSelectAll() const
 {
-    return !usesMenuList(); 
+    return !m_data.usesMenuList(); 
 }
 
 void HTMLSelectElement::selectAll()
 {
-    ASSERT(!usesMenuList());
-    if (!renderer() || !multiple())
-        return;
-    
-    // Save the selection so it can be compared to the new selectAll selection when we call onChange
-    saveLastSelection();
-    
-    m_activeSelectionState = true;
-    setActiveSelectionAnchorIndex(nextSelectableListIndex(-1));
-    setActiveSelectionEndIndex(previousSelectableListIndex(-1));
-    
-    updateListBoxSelection(false);
-    listBoxOnChange();
+    SelectElement::selectAll(m_data, this);
 }
 
 RenderObject* HTMLSelectElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
-    if (usesMenuList())
+    if (m_data.usesMenuList())
         return new (arena) RenderMenuList(this);
     return new (arena) RenderListBox(this);
 }
 
 bool HTMLSelectElement::appendFormData(FormDataList& list, bool)
 {
-    bool successful = false;
-    const Vector<HTMLElement*>& items = listItems();
-
-    unsigned i;
-    for (i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag)) {
-            HTMLOptionElement *option = static_cast<HTMLOptionElement*>(items[i]);
-            if (option->selected()) {
-                list.appendData(name(), option->value());
-                successful = true;
-            }
-        }
-    }
-
-    // ### this case should not happen. make sure that we select the first option
-    // in any case. otherwise we have no consistency with the DOM interface. FIXME!
-    // we return the first one if it was a combobox select
-    if (!successful && !m_multiple && m_size <= 1 && items.size() &&
-        (items[0]->hasLocalName(optionTag))) {
-        HTMLOptionElement *option = static_cast<HTMLOptionElement*>(items[0]);
-        if (option->value().isNull())
-            list.appendData(name(), option->text().stripWhiteSpace());
-        else
-            list.appendData(name(), option->value());
-        successful = true;
-    }
-
-    return successful;
+    return SelectElement::appendFormData(m_data, this, list);
 }
 
 int HTMLSelectElement::optionToListIndex(int optionIndex) const
 {
-    const Vector<HTMLElement*>& items = listItems();
-    int listSize = (int)items.size();
-    if (optionIndex < 0 || optionIndex >= listSize)
-        return -1;
-
-    int optionIndex2 = -1;
-    for (int listIndex = 0; listIndex < listSize; listIndex++) {
-        if (items[listIndex]->hasLocalName(optionTag)) {
-            optionIndex2++;
-            if (optionIndex2 == optionIndex)
-                return listIndex;
-        }
-    }
-    return -1;
+    return SelectElement::optionToListIndex(m_data, this, optionIndex);
 }
 
 int HTMLSelectElement::listToOptionIndex(int listIndex) const
 {
-    const Vector<HTMLElement*>& items = listItems();
-    if (listIndex < 0 || listIndex >= int(items.size()) ||
-        !items[listIndex]->hasLocalName(optionTag))
-        return -1;
-
-    int optionIndex = 0; // actual index of option not counting OPTGROUP entries that may be in list
-    for (int i = 0; i < listIndex; i++)
-        if (items[i]->hasLocalName(optionTag))
-            optionIndex++;
-    return optionIndex;
+    return SelectElement::listToOptionIndex(m_data, this, listIndex);
 }
 
 PassRefPtr<HTMLOptionsCollection> HTMLSelectElement::options()
@@ -491,37 +264,7 @@ PassRefPtr<HTMLOptionsCollection> HTMLSelectElement::options()
 
 void HTMLSelectElement::recalcListItems(bool updateSelectedStates) const
 {
-    m_listItems.clear();
-    HTMLOptionElement* foundSelected = 0;
-    for (Node* current = firstChild(); current; current = current->traverseNextSibling(this)) {
-        if (current->hasTagName(optgroupTag) && current->firstChild()) {
-            // FIXME: It doesn't make sense to add an optgroup to the list items,
-            // when it has children, but not to add it if it happens to have,
-            // children (say some comment nodes or text nodes), yet that's what
-            // this code does!
-            m_listItems.append(static_cast<HTMLElement*>(current));
-            current = current->firstChild();
-            // FIXME: It doesn't make sense to handle an <optgroup> inside another <optgroup>
-            // if it's not the first child, but not handle it if it happens to be the first
-            // child, yet that's what this code does!
-        }
-
-        if (current->hasTagName(optionTag)) {
-            m_listItems.append(static_cast<HTMLElement*>(current));
-            if (updateSelectedStates) {
-                if (!foundSelected && (usesMenuList() || (!m_multiple && static_cast<HTMLOptionElement*>(current)->selected()))) {
-                    foundSelected = static_cast<HTMLOptionElement*>(current);
-                    foundSelected->setSelectedState(true);
-                } else if (foundSelected && !m_multiple && static_cast<HTMLOptionElement*>(current)->selected()) {
-                    foundSelected->setSelectedState(false);
-                    foundSelected = static_cast<HTMLOptionElement*>(current);
-                }
-            }
-        }
-        if (current->hasTagName(hrTag))
-            m_listItems.append(static_cast<HTMLElement*>(current));
-    }
-    m_recalcListItems = false;
+    SelectElement::recalcListItems(const_cast<SelectElementData&>(m_data), this, updateSelectedStates);
 }
 
 void HTMLSelectElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
@@ -535,482 +278,65 @@ void HTMLSelectElement::childrenChanged(bool changedByParser, Node* beforeChange
 
 void HTMLSelectElement::setRecalcListItems()
 {
-    m_recalcListItems = true;
-    if (renderer()) {
-        if (usesMenuList())
-            static_cast<RenderMenuList*>(renderer())->setOptionsChanged(true);
-        else
-            static_cast<RenderListBox*>(renderer())->setOptionsChanged(true);
-    }
+    SelectElement::setRecalcListItems(m_data, this);
+
     if (!inDocument())
         m_collectionInfo.reset();
-    setChanged();
 }
 
 void HTMLSelectElement::reset()
 {
-    bool optionSelected = false;
-    HTMLOptionElement* firstOption = 0;
-    const Vector<HTMLElement*>& items = listItems();
-    unsigned i;
-    for (i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag)) {
-            HTMLOptionElement *option = static_cast<HTMLOptionElement*>(items[i]);
-            if (!option->getAttribute(selectedAttr).isNull()) {
-                option->setSelectedState(true);
-                optionSelected = true;
-            } else
-                option->setSelectedState(false);
-            if (!firstOption)
-                firstOption = option;
-        }
-    }
-    if (!optionSelected && firstOption && usesMenuList())
-        firstOption->setSelectedState(true);
-    
-    setChanged();
+    SelectElement::reset(m_data, this);
 }
 
 void HTMLSelectElement::dispatchFocusEvent()
 {
-    if (usesMenuList())
-        // Save the selection so it can be compared to the new selection when we call onChange during dispatchBlurEvent.
-        saveLastSelection();
+    SelectElement::dispatchFocusEvent(m_data, this);
     HTMLFormControlElementWithState::dispatchFocusEvent();
 }
 
 void HTMLSelectElement::dispatchBlurEvent()
 {
-    // We only need to fire onChange here for menu lists, because we fire onChange for list boxes whenever the selection change is actually made.
-    // This matches other browsers' behavior.
-    if (usesMenuList())
-        menuListOnChange();
+    SelectElement::dispatchBlurEvent(m_data, this);
     HTMLFormControlElementWithState::dispatchBlurEvent();
 }
 
-void HTMLSelectElement::defaultEventHandler(Event* evt)
+void HTMLSelectElement::defaultEventHandler(Event* event)
 {
-    if (!renderer())
+    SelectElement::defaultEventHandler(m_data, this, event, form());
+    if (event->defaultHandled())
         return;
-    
-    if (usesMenuList())
-        menuListDefaultEventHandler(evt);
-    else 
-        listBoxDefaultEventHandler(evt);
-    
-    if (evt->defaultHandled())
-        return;
-
-    if (evt->type() == eventNames().keypressEvent && evt->isKeyboardEvent()) {
-        KeyboardEvent* keyboardEvent = static_cast<KeyboardEvent*>(evt);
-    
-        if (!keyboardEvent->ctrlKey() && !keyboardEvent->altKey() && !keyboardEvent->metaKey() &&
-            isPrintableChar(keyboardEvent->charCode())) {
-            typeAheadFind(keyboardEvent);
-            evt->setDefaultHandled();
-            return;
-        }
-    }
-
-    HTMLFormControlElementWithState::defaultEventHandler(evt);
-}
-
-void HTMLSelectElement::menuListDefaultEventHandler(Event* evt)
-{
-    RenderMenuList* menuList = static_cast<RenderMenuList*>(renderer());
-
-    if (evt->type() == eventNames().keydownEvent) {
-        if (!renderer() || !evt->isKeyboardEvent())
-            return;
-        String keyIdentifier = static_cast<KeyboardEvent*>(evt)->keyIdentifier();
-        bool handled = false;
-#if ARROW_KEYS_POP_MENU
-        if (keyIdentifier == "Down" || keyIdentifier == "Up") {
-            focus();
-            // Save the selection so it can be compared to the new selection when we call onChange during setSelectedIndex,
-            // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
-            saveLastSelection();
-            menuList->showPopup();
-            handled = true;
-        }
-#else
-        int listIndex = optionToListIndex(selectedIndex());
-        if (keyIdentifier == "Down" || keyIdentifier == "Right") {
-            int size = listItems().size();
-            for (listIndex += 1;
-                 listIndex >= 0 && listIndex < size && (listItems()[listIndex]->disabled() || !listItems()[listIndex]->hasTagName(optionTag));
-                 ++listIndex) { }
-            
-            if (listIndex >= 0 && listIndex < size)
-                setSelectedIndex(listToOptionIndex(listIndex));
-            handled = true;
-        } else if (keyIdentifier == "Up" || keyIdentifier == "Left") {
-            int size = listItems().size();
-            for (listIndex -= 1;
-                 listIndex >= 0 && listIndex < size && (listItems()[listIndex]->disabled() || !listItems()[listIndex]->hasTagName(optionTag));
-                 --listIndex) { }
-            
-            if (listIndex >= 0 && listIndex < size)
-                setSelectedIndex(listToOptionIndex(listIndex));
-            handled = true;
-        }
-#endif
-        if (handled)
-            evt->setDefaultHandled();
-    }
-
-    // Use key press event here since sending simulated mouse events
-    // on key down blocks the proper sending of the key press event.
-    if (evt->type() == eventNames().keypressEvent) {
-        if (!renderer() || !evt->isKeyboardEvent())
-            return;
-        int keyCode = static_cast<KeyboardEvent*>(evt)->keyCode();
-        bool handled = false;
-#if ARROW_KEYS_POP_MENU
-        if (keyCode == ' ') {
-            focus();
-            // Save the selection so it can be compared to the new selection when we call onChange during setSelectedIndex,
-            // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
-            saveLastSelection();
-            menuList->showPopup();
-            handled = true;
-        }
-        if (keyCode == '\r') {
-            menuListOnChange();
-            if (form())
-                form()->submitClick(evt);
-            handled = true;
-        }
-#else
-        int listIndex = optionToListIndex(selectedIndex());
-        if (keyCode == '\r') {
-            // listIndex should already be selected, but this will fire the onchange handler.
-            setSelectedIndex(listToOptionIndex(listIndex), true, true);
-            handled = true;
-        }
-#endif
-        if (handled)
-            evt->setDefaultHandled();
-    }
-
-    if (evt->type() == eventNames().mousedownEvent && evt->isMouseEvent() && static_cast<MouseEvent*>(evt)->button() == LeftButton) {
-        focus();
-        if (menuList->popupIsVisible())
-            menuList->hidePopup();
-        else {
-            // Save the selection so it can be compared to the new selection when we call onChange during setSelectedIndex,
-            // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
-            saveLastSelection();
-            menuList->showPopup();
-        }
-        evt->setDefaultHandled();
-    }
+    HTMLFormControlElementWithState::defaultEventHandler(event);
 }
 
-void HTMLSelectElement::listBoxDefaultEventHandler(Event* evt)
+void HTMLSelectElement::setActiveSelectionAnchorIndex(int index)
 {
-    if (evt->type() == eventNames().mousedownEvent && evt->isMouseEvent() && static_cast<MouseEvent*>(evt)->button() == LeftButton) {
-        focus();
-        
-        MouseEvent* mEvt = static_cast<MouseEvent*>(evt);
-        int listIndex = static_cast<RenderListBox*>(renderer())->listIndexAtOffset(mEvt->offsetX(), mEvt->offsetY());
-        if (listIndex >= 0) {
-            // Save the selection so it can be compared to the new selection when we call onChange during mouseup, or after autoscroll finishes.
-            saveLastSelection();
-
-            m_activeSelectionState = true;
-            
-            bool multiSelectKeyPressed = false;
-#if PLATFORM(MAC)
-            multiSelectKeyPressed = mEvt->metaKey();
-#else
-            multiSelectKeyPressed = mEvt->ctrlKey();
-#endif
-
-            bool shiftSelect = multiple() && mEvt->shiftKey();
-            bool multiSelect = multiple() && multiSelectKeyPressed && !mEvt->shiftKey();
-            
-            HTMLElement* clickedElement = listItems()[listIndex];            
-            HTMLOptionElement* option = 0;
-            if (clickedElement->hasLocalName(optionTag)) {
-                option = static_cast<HTMLOptionElement*>(clickedElement);
-                
-                // Keep track of whether an active selection (like during drag selection), should select or deselect
-                if (option->selected() && multiSelectKeyPressed)
-                    m_activeSelectionState = false;
-
-                if (!m_activeSelectionState)
-                    option->setSelectedState(false);
-            }
-            
-            // If we're not in any special multiple selection mode, then deselect all other items, excluding the clicked option.
-            // If no option was clicked, then this will deselect all items in the list.
-            if (!shiftSelect && !multiSelect)
-                deselectItems(option);
-
-            // If the anchor hasn't been set, and we're doing a single selection or a shift selection, then initialize the anchor to the first selected index.
-            if (m_activeSelectionAnchorIndex < 0 && !multiSelect)
-                setActiveSelectionAnchorIndex(selectedIndex());
-
-            // Set the selection state of the clicked option
-            if (option && !option->disabled())
-                option->setSelectedState(true);
-            
-            // If there was no selectedIndex() for the previous initialization, or
-            // If we're doing a single selection, or a multiple selection (using cmd or ctrl), then initialize the anchor index to the listIndex that just got clicked.
-            if (listIndex >= 0 && (m_activeSelectionAnchorIndex < 0 || !shiftSelect))
-                setActiveSelectionAnchorIndex(listIndex);
-            
-            setActiveSelectionEndIndex(listIndex);
-            updateListBoxSelection(!multiSelect);
-
-            if (Frame* frame = document()->frame())
-                frame->eventHandler()->setMouseDownMayStartAutoscroll();
-
-            evt->setDefaultHandled();
-        }
-    } else if (evt->type() == eventNames().mouseupEvent && evt->isMouseEvent() && static_cast<MouseEvent*>(evt)->button() == LeftButton && document()->frame()->eventHandler()->autoscrollRenderer() != renderer())
-        // This makes sure we fire onChange for a single click.  For drag selection, onChange will fire when the autoscroll timer stops.
-        listBoxOnChange();
-    else if (evt->type() == eventNames().keydownEvent) {
-        if (!evt->isKeyboardEvent())
-            return;
-        String keyIdentifier = static_cast<KeyboardEvent*>(evt)->keyIdentifier();
-
-        int endIndex = 0;        
-        if (m_activeSelectionEndIndex < 0) {
-            // Initialize the end index
-            if (keyIdentifier == "Down")
-                endIndex = nextSelectableListIndex(lastSelectedListIndex());
-            else if (keyIdentifier == "Up")
-                endIndex = previousSelectableListIndex(optionToListIndex(selectedIndex()));
-        } else {
-            // Set the end index based on the current end index
-            if (keyIdentifier == "Down")
-                endIndex = nextSelectableListIndex(m_activeSelectionEndIndex);
-            else if (keyIdentifier == "Up")
-                endIndex = previousSelectableListIndex(m_activeSelectionEndIndex);    
-        }
-        
-        if (keyIdentifier == "Down" || keyIdentifier == "Up") {
-            // Save the selection so it can be compared to the new selection when we call onChange immediately after making the new selection.
-            saveLastSelection();
-
-            ASSERT(endIndex >= 0 && (unsigned)endIndex < listItems().size()); 
-            setActiveSelectionEndIndex(endIndex);
-            
-            // If the anchor is unitialized, or if we're going to deselect all other options, then set the anchor index equal to the end index.
-            bool deselectOthers = !multiple() || !static_cast<KeyboardEvent*>(evt)->shiftKey();
-            if (m_activeSelectionAnchorIndex < 0 || deselectOthers) {
-                m_activeSelectionState = true;
-                if (deselectOthers)
-                    deselectItems();
-                setActiveSelectionAnchorIndex(m_activeSelectionEndIndex);
-            }
-
-            static_cast<RenderListBox*>(renderer())->scrollToRevealElementAtListIndex(endIndex);
-            updateListBoxSelection(deselectOthers);
-            listBoxOnChange();
-            evt->setDefaultHandled();
-        }
-    } else if (evt->type() == eventNames().keypressEvent) {
-        if (!evt->isKeyboardEvent())
-            return;
-        int keyCode = static_cast<KeyboardEvent*>(evt)->keyCode();
-
-        if (keyCode == '\r') {
-            if (form())
-                form()->submitClick(evt);
-            evt->setDefaultHandled();
-            return;
-        }
-    }
+    SelectElement::setActiveSelectionAnchorIndex(m_data, this, index);
 }
 
-void HTMLSelectElement::setActiveSelectionAnchorIndex(int index)
+void HTMLSelectElement::setActiveSelectionEndIndex(int index)
 {
-    m_activeSelectionAnchorIndex = index;
-    
-    // Cache the selection state so we can restore the old selection as the new selection pivots around this anchor index
-    const Vector<HTMLElement*>& items = listItems();
-    m_cachedStateForActiveSelection.clear();
-    for (unsigned i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag)) {
-            HTMLOptionElement* option = static_cast<HTMLOptionElement*>(items[i]);
-            m_cachedStateForActiveSelection.append(option->selected());
-        } else
-            m_cachedStateForActiveSelection.append(false);
-    }
+    SelectElement::setActiveSelectionEndIndex(m_data, index);
 }
 
 void HTMLSelectElement::updateListBoxSelection(bool deselectOtherOptions)
 {
-    ASSERT(renderer() && renderer()->isListBox());
-    
-    unsigned start;
-    unsigned end;
-    ASSERT(m_activeSelectionAnchorIndex >= 0);
-    start = min(m_activeSelectionAnchorIndex, m_activeSelectionEndIndex);
-    end = max(m_activeSelectionAnchorIndex, m_activeSelectionEndIndex);
-
-    const Vector<HTMLElement*>& items = listItems();
-    for (unsigned i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag)) {
-            HTMLOptionElement* option = static_cast<HTMLOptionElement*>(items[i]);
-            if (!option->disabled()) {
-                if (i >= start && i <= end)
-                    option->setSelectedState(m_activeSelectionState);
-                else if (deselectOtherOptions || i >= m_cachedStateForActiveSelection.size())
-                    option->setSelectedState(false);
-                else
-                    option->setSelectedState(m_cachedStateForActiveSelection[i]);
-            }
-        }
-    }
-
-    scrollToSelection();
+    SelectElement::updateListBoxSelection(m_data, this, deselectOtherOptions);
 }
 
 void HTMLSelectElement::menuListOnChange()
 {
-    ASSERT(usesMenuList());
-    int selected = selectedIndex();
-    if (m_lastOnChangeIndex != selected) {
-        m_lastOnChangeIndex = selected;
-        onChange();
-    }
+    SelectElement::menuListOnChange(m_data, this);
 }
 
 void HTMLSelectElement::listBoxOnChange()
 {
-    ASSERT(!usesMenuList());
-
-    const Vector<HTMLElement*>& items = listItems();
-    
-    // If the cached selection list is empty, or the size has changed, then fire onChange, and return early.
-    if (m_lastOnChangeSelection.isEmpty() || m_lastOnChangeSelection.size() != items.size()) {
-        onChange();
-        return;
-    }
-    
-    // Update m_lastOnChangeSelection and fire onChange
-    bool fireOnChange = false;
-    for (unsigned i = 0; i < items.size(); i++) {
-        bool selected = false;
-        if (items[i]->hasLocalName(optionTag))
-            selected = static_cast<HTMLOptionElement*>(items[i])->selected();
-        if (selected != m_lastOnChangeSelection[i])      
-            fireOnChange = true;
-        m_lastOnChangeSelection[i] = selected;
-    }
-    if (fireOnChange)
-        onChange();
+    SelectElement::listBoxOnChange(m_data, this);
 }
 
 void HTMLSelectElement::saveLastSelection()
 {
-    const Vector<HTMLElement*>& items = listItems();
-
-    if (usesMenuList()) {
-        m_lastOnChangeIndex = selectedIndex();
-        return;
-    }
-    
-    m_lastOnChangeSelection.clear();
-    for (unsigned i = 0; i < items.size(); i++) {
-        if (items[i]->hasLocalName(optionTag)) {
-            HTMLOptionElement* option = static_cast<HTMLOptionElement*>(items[i]);
-            m_lastOnChangeSelection.append(option->selected());
-        } else
-            m_lastOnChangeSelection.append(false);
-    }
-}
-
-static String stripLeadingWhiteSpace(const String& string)
-{
-    int length = string.length();
-    int i;
-    for (i = 0; i < length; ++i)
-        if (string[i] != noBreakSpace &&
-            (string[i] <= 0x7F ? !isASCIISpace(string[i]) : (direction(string[i]) != WhiteSpaceNeutral)))
-            break;
-
-    return string.substring(i, length - i);
-}
-
-void HTMLSelectElement::typeAheadFind(KeyboardEvent* event)
-{
-    if (event->timeStamp() < m_lastCharTime)
-        return;
-
-    DOMTimeStamp delta = event->timeStamp() - m_lastCharTime;
-
-    m_lastCharTime = event->timeStamp();
-
-    UChar c = event->charCode();
-
-    String prefix;
-    int searchStartOffset = 1;
-    if (delta > typeAheadTimeout) {
-        m_typedString = prefix = String(&c, 1);
-        m_repeatingChar = c;
-    } else {
-        m_typedString.append(c);
-
-        if (c == m_repeatingChar)
-            // The user is likely trying to cycle through all the items starting with this character, so just search on the character
-            prefix = String(&c, 1);
-        else {
-            m_repeatingChar = 0;
-            prefix = m_typedString;
-            searchStartOffset = 0;
-        }
-    }
-
-    const Vector<HTMLElement*>& items = listItems();
-    int itemCount = items.size();
-    if (itemCount < 1)
-        return;
-
-    int selected = selectedIndex();
-    int index = (optionToListIndex(selected >= 0 ? selected : 0) + searchStartOffset) % itemCount;
-    ASSERT(index >= 0);
-    for (int i = 0; i < itemCount; i++, index = (index + 1) % itemCount) {
-        if (!items[index]->hasTagName(optionTag) || items[index]->disabled())
-            continue;
-
-        if (stripLeadingWhiteSpace(static_cast<HTMLOptionElement*>(items[index])->optionText()).startsWith(prefix, false)) {
-            setSelectedIndex(listToOptionIndex(index));
-            if(!usesMenuList())
-                listBoxOnChange();
-            setChanged();
-            return;
-        }
-    }
-}
-
-int HTMLSelectElement::nextSelectableListIndex(int startIndex)
-{
-    const Vector<HTMLElement*>& items = listItems();
-    int index = startIndex + 1;
-    while (index >= 0 && (unsigned)index < items.size() && (!items[index]->hasLocalName(optionTag) || items[index]->disabled()))
-        index++;
-    if ((unsigned) index == items.size())
-        return startIndex;
-    return index;
-}
-
-int HTMLSelectElement::previousSelectableListIndex(int startIndex)
-{
-    const Vector<HTMLElement*>& items = listItems();
-    if (startIndex == -1)
-        startIndex = items.size();
-    int index = startIndex - 1;
-    while (index >= 0 && (unsigned)index < items.size() && (!items[index]->hasLocalName(optionTag) || items[index]->disabled()))
-        index--;
-    if (index == -1)
-        return startIndex;
-    return index;
+    SelectElement::saveLastSelection(m_data, this);
 }
 
 void HTMLSelectElement::accessKeyAction(bool sendToAnyElement)
@@ -1020,23 +346,8 @@ void HTMLSelectElement::accessKeyAction(bool sendToAnyElement)
 }
 
 void HTMLSelectElement::accessKeySetSelectedIndex(int index)
-{    
-    // first bring into focus the list box
-    if (!focused())
-        accessKeyAction(false);
-    
-    // if this index is already selected, unselect. otherwise update the selected index
-    Node* listNode = item(index);
-    if (listNode && listNode->hasTagName(optionTag)) {
-        HTMLOptionElement* listElement = static_cast<HTMLOptionElement*>(listNode);
-        if (listElement->selected())
-            listElement->setSelectedState(false);
-        else
-            setSelectedIndex(index, false, true);
-    }
-    
-    listBoxOnChange();
-    scrollToSelection();
+{
+    SelectElement::accessKeySetSelectedIndex(m_data, this, index);
 }
     
 void HTMLSelectElement::setMultiple(bool multiple)
@@ -1062,8 +373,8 @@ Node* HTMLSelectElement::item(unsigned index)
 void HTMLSelectElement::setOption(unsigned index, HTMLOptionElement* option, ExceptionCode& ec)
 {
     ec = 0;
-    if (index > INT_MAX)
-        index = INT_MAX;
+    if (index > maxSelectItems - 1)
+        index = maxSelectItems - 1;
     int diff = index  - length();
     HTMLElement* before = 0;
     // out of array bounds ? first insert empty dummies
@@ -1078,47 +389,48 @@ void HTMLSelectElement::setOption(unsigned index, HTMLOptionElement* option, Exc
     if (!ec) {
         add(option, before, ec);
         if (diff >= 0 && option->selected())
-            setSelectedIndex(index, !m_multiple);
+            setSelectedIndex(index, !m_data.multiple());
     }
 }
 
 void HTMLSelectElement::setLength(unsigned newLen, ExceptionCode& ec)
 {
     ec = 0;
-    if (newLen > INT_MAX)
-        newLen = INT_MAX;
+    if (newLen > maxSelectItems)
+        newLen = maxSelectItems;
     int diff = length() - newLen;
 
     if (diff < 0) { // add dummy elements
         do {
-            RefPtr<Element> option = document()->createElement("option", ec);
-            if (!option)
-                break;
+            RefPtr<Element> option = document()->createElement(optionTag, false);
+            ASSERT(option);
             add(static_cast<HTMLElement*>(option.get()), 0, ec);
             if (ec)
                 break;
         } while (++diff);
+    } else {
+        const Vector<Element*>& items = listItems();
+
+        size_t optionIndex = 0;
+        for (size_t listIndex = 0; listIndex < items.size(); listIndex++) {
+            if (items[listIndex]->hasLocalName(optionTag) && optionIndex++ >= newLen) {
+                Element *item = items[listIndex];
+                ASSERT(item->parentNode());
+                item->parentNode()->removeChild(item, ec);
+            }
+        }
     }
-    else // remove elements
-        while (diff-- > 0)
-            remove(newLen);
 }
 
 void HTMLSelectElement::scrollToSelection()
 {
-    if (renderer() && !usesMenuList())
-        static_cast<RenderListBox*>(renderer())->selectionChanged();
+    SelectElement::scrollToSelection(m_data, this);
 }
 
-#ifndef NDEBUG
-
-void HTMLSelectElement::checkListItems() const
+void HTMLSelectElement::insertedIntoTree(bool deep)
 {
-    Vector<HTMLElement*> items = m_listItems;
-    recalcListItems(false);
-    ASSERT(items == m_listItems);
+    SelectElement::insertedIntoTree(m_data, this);
+    HTMLFormControlElementWithState::insertedIntoTree(deep);
 }
 
-#endif
-
 } // namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.h b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.h
index 0185ed8..e523641 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,10 +24,9 @@
 #ifndef HTMLSelectElement_h
 #define HTMLSelectElement_h
 
-#include "Event.h"
-#include "HTMLCollection.h"
+#include "CollectionCache.h"
 #include "HTMLFormControlElement.h"
-#include <wtf/Vector.h>
+#include "SelectElement.h"
 
 namespace WebCore {
 
@@ -35,82 +34,33 @@ class HTMLOptionElement;
 class HTMLOptionsCollection;
 class KeyboardEvent;
 
-class HTMLSelectElement : public HTMLFormControlElementWithState {
+class HTMLSelectElement : public HTMLFormControlElementWithState, public SelectElement {
 public:
     HTMLSelectElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
 
-    virtual int tagPriority() const { return 6; }
-    virtual bool checkDTD(const Node* newChild);
-
-    virtual const AtomicString& type() const;
-    
-    virtual bool isKeyboardFocusable(KeyboardEvent*) const;
-    virtual bool isMouseFocusable() const;
-    virtual bool canSelectAll() const;
-    virtual void selectAll();
-
-    virtual void recalcStyle(StyleChange);
-
-    virtual void dispatchFocusEvent();
-    virtual void dispatchBlurEvent();
-    
-    virtual bool canStartSelection() const { return false; }
-
-    int selectedIndex() const;
-    void setSelectedIndex(int index, bool deselect = true, bool fireOnChange = false);
-    int lastSelectedListIndex() const;
-
-    virtual bool isEnumeratable() const { return true; }
+    virtual int selectedIndex() const;
+    virtual void setSelectedIndex(int index, bool deselect = true);
+    virtual void setSelectedIndexByUser(int index, bool deselect = true, bool fireOnChangeNow = false);
 
     unsigned length() const;
 
-    int minWidth() const { return m_minwidth; }
-
-    int size() const { return m_size; }
-
-    bool multiple() const { return m_multiple; }
+    virtual int size() const { return m_data.size(); }
+    virtual bool multiple() const { return m_data.multiple(); }
 
     void add(HTMLElement* element, HTMLElement* before, ExceptionCode&);
     void remove(int index);
 
     String value();
     void setValue(const String&);
-    
-    PassRefPtr<HTMLOptionsCollection> options();
 
-    virtual bool saveState(String& value) const;
-    virtual void restoreState(const String&);
+    PassRefPtr<HTMLOptionsCollection> options();
 
-    virtual bool insertBefore(PassRefPtr<Node> newChild, Node* refChild, ExceptionCode&, bool shouldLazyAttach = false);
-    virtual bool replaceChild(PassRefPtr<Node> newChild, Node* oldChild, ExceptionCode&, bool shouldLazyAttach = false);
-    virtual bool removeChild(Node* child, ExceptionCode&);
-    virtual bool appendChild(PassRefPtr<Node> newChild, ExceptionCode&, bool shouldLazyAttach = false);
-    virtual bool removeChildren();
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
-    virtual void parseMappedAttribute(MappedAttribute*);
-
-    virtual RenderObject* createRenderer(RenderArena*, RenderStyle *);
-    virtual bool appendFormData(FormDataList&, bool);
-
-    // get the actual listbox index of the optionIndexth option
-    int optionToListIndex(int optionIndex) const;
-    // reverse of optionToListIndex - get optionIndex from listboxIndex
-    int listToOptionIndex(int listIndex) const;
-
     void setRecalcListItems();
 
-    const Vector<HTMLElement*>& listItems() const
-    {
-        if (m_recalcListItems)
-            recalcListItems();
-        else
-            checkListItems();
-        return m_listItems;
-    }
-    virtual void reset();
+    virtual const Vector<Element*>& listItems() const { return m_data.listItems(this); }
 
-    virtual void defaultEventHandler(Event*);
     virtual void accessKeyAction(bool sendToAnyElement);
     void accessKeySetSelectedIndex(int);
 
@@ -124,60 +74,65 @@ public:
     Node* namedItem(const AtomicString& name);
     Node* item(unsigned index);
 
-    HTMLCollection::CollectionInfo* collectionInfo() { return &m_collectionInfo; }
-    
-    void setActiveSelectionAnchorIndex(int index);
-    void setActiveSelectionEndIndex(int index) { m_activeSelectionEndIndex = index; }
-    void updateListBoxSelection(bool deselectOtherOptions);
-    void listBoxOnChange();
-    void menuListOnChange();
-    
-    int activeSelectionStartListIndex() const;
-    int activeSelectionEndListIndex() const;
-    
+    CollectionCache* collectionInfo() { return &m_collectionInfo; }
+
     void scrollToSelection();
 
 private:
+    virtual int tagPriority() const { return 6; }
+    virtual bool checkDTD(const Node* newChild);
+
+    virtual const AtomicString& formControlType() const;
+    
+    virtual bool isKeyboardFocusable(KeyboardEvent*) const;
+    virtual bool isMouseFocusable() const;
+    virtual bool canSelectAll() const;
+    virtual void selectAll();
+
+    virtual void recalcStyle(StyleChange);
+
+    virtual void dispatchFocusEvent();
+    virtual void dispatchBlurEvent();
+    
+    virtual bool canStartSelection() const { return false; }
+
+    virtual bool isEnumeratable() const { return true; }
+
+    virtual bool saveFormControlState(String& value) const;
+    virtual void restoreFormControlState(const String&);
+
+    virtual void parseMappedAttribute(MappedAttribute*);
+
+    virtual RenderObject* createRenderer(RenderArena*, RenderStyle *);
+    virtual bool appendFormData(FormDataList&, bool);
+
+    virtual int optionToListIndex(int optionIndex) const;
+    virtual int listToOptionIndex(int listIndex) const;
+
+    virtual void reset();
+
+    virtual void defaultEventHandler(Event*);
+
+    virtual void setActiveSelectionAnchorIndex(int index);
+    virtual void setActiveSelectionEndIndex(int index);
+    virtual void updateListBoxSelection(bool deselectOtherOptions);
+    virtual void listBoxOnChange();
+    virtual void menuListOnChange();
+    
+    virtual int activeSelectionStartListIndex() const;
+    virtual int activeSelectionEndListIndex() const;
+    
     void recalcListItems(bool updateSelectedStates = true) const;
-    void checkListItems() const;
 
     void deselectItems(HTMLOptionElement* excludeElement = 0);
-    bool usesMenuList() const { return !m_multiple && m_size <= 1; }
-    int nextSelectableListIndex(int startIndex);
-    int previousSelectableListIndex(int startIndex);
-    void menuListDefaultEventHandler(Event*);
-    void listBoxDefaultEventHandler(Event*);
     void typeAheadFind(KeyboardEvent*);
     void saveLastSelection();
 
-    mutable Vector<HTMLElement*> m_listItems;
-    Vector<bool> m_cachedStateForActiveSelection;
-    Vector<bool> m_lastOnChangeSelection;
-    int m_minwidth;
-    int m_size;
-    bool m_multiple;
-    mutable bool m_recalcListItems;
-    mutable int m_lastOnChangeIndex;
-
-    int m_activeSelectionAnchorIndex;
-    int m_activeSelectionEndIndex;
-    bool m_activeSelectionState;
-
-    // Instance variables for type-ahead find
-    UChar m_repeatingChar;
-    DOMTimeStamp m_lastCharTime;
-    String m_typedString;
-
-    HTMLCollection::CollectionInfo m_collectionInfo;
-};
-
-#ifdef NDEBUG
-
-inline void HTMLSelectElement::checkListItems() const
-{
-}
+    virtual void insertedIntoTree(bool);
 
-#endif
+    SelectElementData m_data;
+    CollectionCache m_collectionInfo;
+};
 
 } // namespace
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.idl
index d3e85a8..fb08bb1 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLSelectElement.idl
@@ -33,7 +33,7 @@ module html {
                  attribute [ConvertNullToNullString] DOMString       value;
         
         // Modified in DOM Level 2:
-#if defined(LANGUAGE_OBJECTIVE_C)
+#if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
         readonly attribute long            length;
 #else
                  attribute unsigned long   length
@@ -56,7 +56,7 @@ module html {
                                in HTMLElement before)
             raises(DOMException);
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // In JS, we support both options index and options object parameters - this cannot be autogenerated now.
         [Custom] void      remove(/* 1 */);
 #else
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLSourceElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLSourceElement.cpp
index c8f814f..2f09997 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLSourceElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLSourceElement.cpp
@@ -28,6 +28,7 @@
 #if ENABLE(VIDEO)
 #include "HTMLSourceElement.h"
 
+#include "EventNames.h"
 #include "HTMLDocument.h"
 #include "HTMLMediaElement.h"
 #include "HTMLNames.h"
@@ -40,6 +41,7 @@ using namespace HTMLNames;
 
 HTMLSourceElement::HTMLSourceElement(const QualifiedName& tagName, Document* doc)
     : HTMLElement(tagName, doc)
+    , m_errorEventTimer(this, &HTMLSourceElement::errorEventTimerFired)
 {
     ASSERT(hasTagName(sourceTag));
 }
@@ -53,7 +55,7 @@ void HTMLSourceElement::insertedIntoDocument()
     HTMLElement::insertedIntoDocument();
     if (parentNode() && (parentNode()->hasTagName(audioTag) ||  parentNode()->hasTagName(videoTag))) {
         HTMLMediaElement* media = static_cast<HTMLMediaElement*>(parentNode());
-        if (media->networkState() == HTMLMediaElement::EMPTY)
+        if (media->networkState() == HTMLMediaElement::NETWORK_EMPTY)
             media->scheduleLoad();
     }
 }
@@ -88,5 +90,23 @@ void HTMLSourceElement::setType(const String& type)
     setAttribute(typeAttr, type);
 }
 
+void HTMLSourceElement::scheduleErrorEvent()
+{
+    if (m_errorEventTimer.isActive())
+        return;
+
+    m_errorEventTimer.startOneShot(0);
+}
+
+void HTMLSourceElement::cancelPendingErrorEvent()
+{
+    m_errorEventTimer.stop();
+}
+
+void HTMLSourceElement::errorEventTimerFired(Timer<HTMLSourceElement>*)
+{
+    dispatchEvent(eventNames().errorEvent, false, true);
+}
+
 }
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLSourceElement.h b/src/3rdparty/webkit/WebCore/html/HTMLSourceElement.h
index 9027b88..50d6687 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLSourceElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLSourceElement.h
@@ -29,6 +29,7 @@
 #if ENABLE(VIDEO)
 
 #include "HTMLElement.h"
+#include "Timer.h"
 #include <limits>
 
 namespace WebCore {
@@ -51,6 +52,14 @@ public:
     void setSrc(const String&);    
     void setMedia(const String&);
     void setType(const String&);
+    
+    void scheduleErrorEvent();
+    void cancelPendingErrorEvent();
+
+private:
+    void errorEventTimerFired(Timer<HTMLSourceElement>*);
+
+    Timer<HTMLSourceElement> m_errorEventTimer;
 };
 
 } //namespace
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.cpp
index bed1cdc..206aec4 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.cpp
@@ -20,11 +20,13 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLStyleElement.h"
 
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
@@ -69,8 +71,7 @@ void HTMLStyleElement::insertedIntoDocument()
 void HTMLStyleElement::removedFromDocument()
 {
     HTMLElement::removedFromDocument();
-    if (document()->renderer())
-        document()->removeStyleSheetCandidateNode(this);
+    document()->removeStyleSheetCandidateNode(this);
     StyleElement::removedFromDocument(document());
 }
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.idl b/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.idl
index e6238b7..a1b86f8 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.idl
+++ b/src/3rdparty/webkit/WebCore/html/HTMLStyleElement.idl
@@ -29,7 +29,7 @@ module html {
         attribute  [ConvertNullToNullString] DOMString            media;
         attribute  [ConvertNullToNullString] DOMString            type;
 
-#if !defined(LANGUAGE_COM)
+#if !defined(LANGUAGE_COM) || !LANGUAGE_COM
         // DOM Level 2 Style
         readonly attribute StyleSheet sheet;
 #endif
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableCaptionElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTableCaptionElement.cpp
index 35cf8a1..2c94727 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableCaptionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableCaptionElement.cpp
@@ -21,11 +21,13 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLTableCaptionElement.h"
 
 #include "CSSPropertyNames.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.cpp
index 01af2ad0..878549d 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableCellElement.cpp
@@ -23,6 +23,7 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLTableCellElement.h"
 
@@ -30,6 +31,7 @@
 #include "CSSValueKeywords.h"
 #include "HTMLNames.h"
 #include "HTMLTableElement.h"
+#include "MappedAttribute.h"
 #include "RenderTableCell.h"
 
 using std::max;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.cpp
index 11f6df6..4e4f89e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableColElement.cpp
@@ -23,13 +23,15 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLTableColElement.h"
 
 #include "CSSPropertyNames.h"
 #include "HTMLNames.h"
-#include "RenderTableCol.h"
 #include "HTMLTableElement.h"
+#include "MappedAttribute.h"
+#include "RenderTableCol.h"
 #include "Text.h"
 
 namespace WebCore {
@@ -79,8 +81,15 @@ void HTMLTableColElement::parseMappedAttribute(MappedAttribute *attr)
         if (renderer() && renderer()->isTableCol())
             static_cast<RenderTableCol*>(renderer())->updateFromElement();
     } else if (attr->name() == widthAttr) {
-        if (!attr->value().isEmpty())
+        if (!attr->value().isEmpty()) {
             addCSSLength(attr, CSSPropertyWidth, attr->value());
+            if (renderer() && renderer()->isTableCol()) {
+                RenderTableCol* col = static_cast<RenderTableCol*>(renderer());
+                int newWidth = width().toInt();
+                if (newWidth != col->width())
+                    col->setNeedsLayoutAndPrefWidthsRecalc();
+            }
+        }
     } else
         HTMLTablePartElement::parseMappedAttribute(attr);
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTableElement.cpp
index bb2c2ee..e37c171 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableElement.cpp
@@ -31,9 +31,10 @@
 #include "ExceptionCode.h"
 #include "HTMLNames.h"
 #include "HTMLTableCaptionElement.h"
-#include "HTMLTableRowsCollection.h"
 #include "HTMLTableRowElement.h"
+#include "HTMLTableRowsCollection.h"
 #include "HTMLTableSectionElement.h"
+#include "MappedAttribute.h"
 #include "RenderTable.h"
 #include "Text.h"
 
@@ -310,7 +311,7 @@ static bool setTableCellsChanged(Node* n)
     }
 
     if (cellChanged)
-       n->setChanged();
+       n->setNeedsStyleRecalc();
 
     return cellChanged;
 }
@@ -455,7 +456,7 @@ void HTMLTableElement::parseMappedAttribute(MappedAttribute* attr)
         for (Node* child = firstChild(); child; child = child->nextSibling())
             cellChanged |= setTableCellsChanged(child);
         if (cellChanged)
-            setChanged();
+            setNeedsStyleRecalc();
     }
 }
 
@@ -655,7 +656,7 @@ PassRefPtr<HTMLCollection> HTMLTableElement::rows()
 
 PassRefPtr<HTMLCollection> HTMLTableElement::tBodies()
 {
-    return HTMLCollection::create(this, HTMLCollection::TableTBodies);
+    return HTMLCollection::create(this, TableTBodies);
 }
 
 String HTMLTableElement::align() const
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTablePartElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTablePartElement.cpp
index 6341197..19babf6 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTablePartElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTablePartElement.cpp
@@ -23,6 +23,7 @@
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
  */
+
 #include "config.h"
 #include "HTMLTablePartElement.h"
 
@@ -31,6 +32,7 @@
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableRowElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTableRowElement.cpp
index 98d928a..94be02e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableRowElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableRowElement.cpp
@@ -168,7 +168,7 @@ void HTMLTableRowElement::deleteCell(int index, ExceptionCode& ec)
 
 PassRefPtr<HTMLCollection> HTMLTableRowElement::cells()
 {
-    return HTMLCollection::create(this, HTMLCollection::TRCells);
+    return HTMLCollection::create(this, TRCells);
 }
 
 void HTMLTableRowElement::setCells(HTMLCollection *, ExceptionCode& ec)
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableRowsCollection.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTableRowsCollection.cpp
index 7047576..b38c271 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableRowsCollection.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableRowsCollection.cpp
@@ -149,7 +149,7 @@ HTMLTableRowElement* HTMLTableRowsCollection::lastRow(HTMLTableElement* table)
 }
 
 HTMLTableRowsCollection::HTMLTableRowsCollection(PassRefPtr<HTMLTableElement> table)
-    : HTMLCollection(table, Other, 0)
+    : HTMLCollection(table, OtherCollection, 0)
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTableSectionElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTableSectionElement.cpp
index 900976c..e91a96a 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTableSectionElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTableSectionElement.cpp
@@ -167,7 +167,7 @@ void HTMLTableSectionElement::setVAlign(const String &value)
 
 PassRefPtr<HTMLCollection> HTMLTableSectionElement::rows()
 {
-    return HTMLCollection::create(this, HTMLCollection::TSectionRows);
+    return HTMLCollection::create(this, TSectionRows);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTagNames.in b/src/3rdparty/webkit/WebCore/html/HTMLTagNames.in
index d4797b4..e6bbfc9 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTagNames.in
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTagNames.in
@@ -8,7 +8,7 @@ acronym interfaceName=HTMLElement
 address interfaceName=HTMLElement
 applet
 area
-audio wrapperOnlyIfMediaIsAvailable=1,conditional=VIDEO
+audio wrapperOnlyIfMediaIsAvailable,conditional=VIDEO
 b interfaceName=HTMLElement
 base
 basefont interfaceName=HTMLBaseFontElement
@@ -17,7 +17,7 @@ big interfaceName=HTMLElement
 blockquote
 body
 br interfaceName=HTMLBRElement
-button
+button constructorNeedsFormElement
 canvas
 caption interfaceName=HTMLTableCaptionElement
 center interfaceName=HTMLElement
@@ -25,6 +25,10 @@ cite interfaceName=HTMLElement
 code interfaceName=HTMLElement
 col interfaceName=HTMLTableColElement
 colgroup interfaceName=HTMLTableColElement
+datagrid interfaceName=HTMLDataGridElement
+dcell interfaceName=HTMLDataGridCellElement
+dcol interfaceName=HTMLDataGridColElement
+drow interfaceName=HTMLDataGridRowElement
 dd interfaceName=HTMLElement
 del interfaceName=HTMLModElement
 dfn interfaceName=HTMLElement
@@ -34,10 +38,10 @@ dl interfaceName=HTMLDListElement
 dt interfaceName=HTMLElement
 em interfaceName=HTMLElement
 embed
-fieldset interfaceName=HTMLFieldSetElement
+fieldset interfaceName=HTMLFieldSetElement, constructorNeedsFormElement
 font
 form
-frame constructorNeedsCreatedByParser=1
+frame
 frameset interfaceName=HTMLFrameSetElement
 head
 h1 interfaceName=HTMLHeadingElement
@@ -49,19 +53,19 @@ h6 interfaceName=HTMLHeadingElement
 hr interfaceName=HTMLHRElement
 html
 i interfaceName=HTMLElement
-iframe interfaceName=HTMLIFrameElement, constructorNeedsCreatedByParser=1
-image
-img interfaceName=HTMLImageElement
-input
+iframe interfaceName=HTMLIFrameElement
+image mapToTagName=img
+img interfaceName=HTMLImageElement, constructorNeedsFormElement
+input constructorNeedsFormElement
 ins interfaceName=HTMLModElement
-isindex interfaceName=HTMLIsIndexElement
+isindex interfaceName=HTMLIsIndexElement, constructorNeedsFormElement
 kbd interfaceName=HTMLElement
-keygen JSInterfaceName=HTMLSelectElement
+keygen JSInterfaceName=HTMLSelectElement, constructorNeedsFormElement
 label
 layer interfaceName=HTMLElement
-legend
+legend constructorNeedsFormElement
 li interfaceName=HTMLLIElement
-link constructorNeedsCreatedByParser=1
+link constructorNeedsCreatedByParser
 listing interfaceName=HTMLPreElement
 map
 marquee
@@ -71,11 +75,15 @@ nobr interfaceName=HTMLElement
 noembed interfaceName=HTMLElement
 noframes interfaceName=HTMLElement
 nolayer interfaceName=HTMLElement
+#if ENABLE_XHTMLMP
+noscript interfaceName=HTMLNoScriptElement
+#else
 noscript interfaceName=HTMLElement
-object
+#endif
+object constructorNeedsCreatedByParser
 ol interfaceName=HTMLOListElement
-optgroup interfaceName=HTMLOptGroupElement
-option
+optgroup interfaceName=HTMLOptGroupElement, constructorNeedsFormElement
+option constructorNeedsFormElement
 p interfaceName=HTMLParagraphElement
 param
 plaintext interfaceName=HTMLElement
@@ -83,20 +91,20 @@ pre
 q interfaceName=HTMLQuoteElement
 s interfaceName=HTMLElement
 samp interfaceName=HTMLElement
-script constructorNeedsCreatedByParser=1
-select
+script constructorNeedsCreatedByParser
+select constructorNeedsFormElement
 small interfaceName=HTMLElement
-source wrapperOnlyIfMediaIsAvailable=1,conditional=VIDEO
+source wrapperOnlyIfMediaIsAvailable,conditional=VIDEO
 span interfaceName=HTMLElement
 strike interfaceName=HTMLElement
 strong interfaceName=HTMLElement
-style constructorNeedsCreatedByParser=1
+style constructorNeedsCreatedByParser
 sub interfaceName=HTMLElement
 sup interfaceName=HTMLElement
 table
 tbody interfaceName=HTMLTableSectionElement
 td interfaceName=HTMLTableCellElement
-textarea interfaceName=HTMLTextAreaElement
+textarea interfaceName=HTMLTextAreaElement, constructorNeedsFormElement
 tfoot interfaceName=HTMLTableSectionElement
 th interfaceName=HTMLTableCellElement
 thead interfaceName=HTMLTableSectionElement
@@ -106,6 +114,6 @@ tt interfaceName=HTMLElement
 u interfaceName=HTMLElement
 ul interfaceName=HTMLUListElement
 var interfaceName=HTMLElement
-video wrapperOnlyIfMediaIsAvailable=1,conditional=VIDEO
+video wrapperOnlyIfMediaIsAvailable,conditional=VIDEO
 wbr interfaceName=HTMLElement
 xmp interfaceName=HTMLPreElement
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp
index 2d4d7a9..e19ac0a 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.cpp
@@ -34,11 +34,13 @@
 #include "FormDataList.h"
 #include "Frame.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderStyle.h"
 #include "RenderTextControlMultiLine.h"
-#include "Selection.h"
+#include "ScriptEventListener.h"
 #include "Text.h"
+#include "VisibleSelection.h"
 #include <wtf/StdLibExtras.h>
 
 namespace WebCore {
@@ -65,23 +67,23 @@ HTMLTextAreaElement::HTMLTextAreaElement(const QualifiedName& tagName, Document*
     , m_cachedSelectionEnd(-1)
 {
     ASSERT(hasTagName(textareaTag));
-    setValueMatchesRenderer();
+    setFormControlValueMatchesRenderer(true);
     notifyFormStateChanged(this);
 }
 
-const AtomicString& HTMLTextAreaElement::type() const
+const AtomicString& HTMLTextAreaElement::formControlType() const
 {
     DEFINE_STATIC_LOCAL(const AtomicString, textarea, ("textarea"));
     return textarea;
 }
 
-bool HTMLTextAreaElement::saveState(String& result) const
+bool HTMLTextAreaElement::saveFormControlState(String& result) const
 {
     result = value();
     return true;
 }
 
-void HTMLTextAreaElement::restoreState(const String& state)
+void HTMLTextAreaElement::restoreFormControlState(const String& state)
 {
     setDefaultValue(state);
 }
@@ -92,7 +94,7 @@ int HTMLTextAreaElement::selectionStart()
         return 0;
     if (document()->focusedNode() != this && m_cachedSelectionStart >= 0)
         return m_cachedSelectionStart;
-    return static_cast<RenderTextControl*>(renderer())->selectionStart();
+    return toRenderTextControl(renderer())->selectionStart();
 }
 
 int HTMLTextAreaElement::selectionEnd()
@@ -101,35 +103,35 @@ int HTMLTextAreaElement::selectionEnd()
         return 0;
     if (document()->focusedNode() != this && m_cachedSelectionEnd >= 0)
         return m_cachedSelectionEnd;
-    return static_cast<RenderTextControl*>(renderer())->selectionEnd();
+    return toRenderTextControl(renderer())->selectionEnd();
 }
 
 void HTMLTextAreaElement::setSelectionStart(int start)
 {
     if (!renderer())
         return;
-    static_cast<RenderTextControl*>(renderer())->setSelectionStart(start);
+    toRenderTextControl(renderer())->setSelectionStart(start);
 }
 
 void HTMLTextAreaElement::setSelectionEnd(int end)
 {
     if (!renderer())
         return;
-    static_cast<RenderTextControl*>(renderer())->setSelectionEnd(end);
+    toRenderTextControl(renderer())->setSelectionEnd(end);
 }
 
 void HTMLTextAreaElement::select()
 {
     if (!renderer())
         return;
-    static_cast<RenderTextControl*>(renderer())->select();
+    toRenderTextControl(renderer())->select();
 }
 
 void HTMLTextAreaElement::setSelectionRange(int start, int end)
 {
     if (!renderer())
         return;
-    static_cast<RenderTextControl*>(renderer())->setSelectionRange(start, end);
+    toRenderTextControl(renderer())->setSelectionRange(start, end);
 }
 
 void HTMLTextAreaElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
@@ -179,13 +181,13 @@ void HTMLTextAreaElement::parseMappedAttribute(MappedAttribute* attr)
         // Don't map 'align' attribute.  This matches what Firefox, Opera and IE do.
         // See http://bugs.webkit.org/show_bug.cgi?id=7075
     } else if (attr->name() == onfocusAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().focusEvent, attr);
+        setAttributeEventListener(eventNames().focusEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onblurAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().blurEvent, attr);
+        setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onselectAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().selectEvent, attr);
+        setAttributeEventListener(eventNames().selectEvent, createAttributeEventListener(this, attr));
     else if (attr->name() == onchangeAttr)
-        setInlineEventListenerForTypeAndAttribute(eventNames().changeEvent, attr);
+        setAttributeEventListener(eventNames().changeEvent, createAttributeEventListener(this, attr));
     else
         HTMLFormControlElementWithState::parseMappedAttribute(attr);
 }
@@ -202,7 +204,7 @@ bool HTMLTextAreaElement::appendFormData(FormDataList& encoding, bool)
 
     // FIXME: It's not acceptable to ignore the HardWrap setting when there is no renderer.
     // While we have no evidence this has ever been a practical problem, it would be best to fix it some day.
-    RenderTextControl* control = static_cast<RenderTextControl*>(renderer());
+    RenderTextControl* control = toRenderTextControl(renderer());
     const String& text = (m_wrap == HardWrap && control) ? control->textWithHardLineBreaks() : value();
     encoding.appendData(name(), text);
     return true;
@@ -229,10 +231,17 @@ void HTMLTextAreaElement::updateFocusAppearance(bool restorePreviousSelection)
     ASSERT(renderer());
     
     if (!restorePreviousSelection || m_cachedSelectionStart < 0) {
+#if ENABLE(ON_FIRST_TEXTAREA_FOCUS_SELECT_ALL)
+        // Devices with trackballs or d-pads may focus on a textarea in route
+        // to another focusable node. By selecting all text, the next movement
+        // can more readily be interpreted as moving to the next node.
+        select();
+#else
         // If this is the first focus, set a caret at the beginning of the text.  
         // This matches some browsers' behavior; see bug 11746 Comment #15.
         // http://bugs.webkit.org/show_bug.cgi?id=11746#c15
         setSelectionRange(0, 0);
+#endif
     } else {
         // Restore the cached selection.  This matches other browsers' behavior.
         setSelectionRange(m_cachedSelectionStart, m_cachedSelectionEnd);
@@ -257,12 +266,12 @@ void HTMLTextAreaElement::rendererWillBeDestroyed()
 
 void HTMLTextAreaElement::updateValue() const
 {
-    if (valueMatchesRenderer())
+    if (formControlValueMatchesRenderer())
         return;
 
     ASSERT(renderer());
-    m_value = static_cast<RenderTextControl*>(renderer())->text();
-    const_cast<HTMLTextAreaElement*>(this)->setValueMatchesRenderer();
+    m_value = toRenderTextControl(renderer())->text();
+    const_cast<HTMLTextAreaElement*>(this)->setFormControlValueMatchesRenderer(true);
     notifyFormStateChanged(this);
 }
 
@@ -286,9 +295,9 @@ void HTMLTextAreaElement::setValue(const String& value)
         return;
 
     m_value = normalizedValue;
-    setValueMatchesRenderer();
+    setFormControlValueMatchesRenderer(true);
     if (inDocument())
-        document()->updateRendering();
+        document()->updateStyleIfNeeded();
     if (renderer())
         renderer()->updateFromElement();
 
@@ -298,7 +307,7 @@ void HTMLTextAreaElement::setValue(const String& value)
         setSelectionRange(endOfString, endOfString);
     }
 
-    setChanged();
+    setNeedsStyleRecalc();
     notifyFormStateChanged(this);
 }
 
@@ -374,11 +383,11 @@ void HTMLTextAreaElement::setRows(int rows)
     setAttribute(rowsAttr, String::number(rows));
 }
 
-Selection HTMLTextAreaElement::selection() const
+VisibleSelection HTMLTextAreaElement::selection() const
 {
     if (!renderer() || m_cachedSelectionStart < 0 || m_cachedSelectionEnd < 0)
-        return Selection();
-    return static_cast<RenderTextControl*>(renderer())->selection(m_cachedSelectionStart, m_cachedSelectionEnd);
+        return VisibleSelection();
+    return toRenderTextControl(renderer())->selection(m_cachedSelectionStart, m_cachedSelectionEnd);
 }
 
 bool HTMLTextAreaElement::shouldUseInputMethod() const
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h
index f02ad65..e22b5d5 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTextAreaElement.h
@@ -28,7 +28,7 @@
 
 namespace WebCore {
 
-class Selection;
+class VisibleSelection;
 
 class HTMLTextAreaElement : public HTMLFormControlElementWithState {
 public:
@@ -43,14 +43,14 @@ public:
 
     virtual bool isEnumeratable() const { return true; }
 
-    virtual const AtomicString& type() const;
+    virtual const AtomicString& formControlType() const;
 
-    virtual bool saveState(String& value) const;
-    virtual void restoreState(const String&);
+    virtual bool saveFormControlState(String& value) const;
+    virtual void restoreFormControlState(const String&);
 
-    bool readOnly() const { return isReadOnlyControl(); }
+    bool readOnly() const { return isReadOnlyFormControl(); }
 
-    virtual bool isTextControl() const { return true; }
+    virtual bool isTextFormControl() const { return true; }
 
     int selectionStart();
     int selectionEnd();
@@ -87,7 +87,7 @@ public:
     void setRows(int);
     
     void cacheSelection(int s, int e) { m_cachedSelectionStart = s; m_cachedSelectionEnd = e; };
-    Selection selection() const;
+    VisibleSelection selection() const;
 
     virtual bool shouldUseInputMethod() const;
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
index 6de9951..6966351 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.cpp
@@ -5,8 +5,9 @@
               (C) 1999 Lars Knoll (knoll@kde.org)
               (C) 1999 Antti Koivisto (koivisto@kde.org)
               (C) 2001 Dirk Mueller (mueller@kde.org)
-    Copyright (C) 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+    Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
     Copyright (C) 2005, 2006 Alexey Proskuryakov (ap@nypop.com)
+    Copyright (C) 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -41,13 +42,15 @@
 #include "HTMLParser.h"
 #include "HTMLScriptElement.h"
 #include "HTMLViewSourceDocument.h"
+#include "MappedAttribute.h"
 #include "Page.h"
 #include "PreloadScanner.h"
 #include "ScriptController.h"
 #include "ScriptSourceCode.h"
 #include "ScriptValue.h"
-#include "SystemTime.h"
+#include "XSSAuditor.h"
 #include <wtf/ASCIICType.h>
+#include <wtf/CurrentTime.h>
 
 #include "HTMLEntityNames.c"
 
@@ -133,14 +136,14 @@ static inline bool tagMatch(const char* s1, const UChar* s2, unsigned length)
     return true;
 }
 
-inline void Token::addAttribute(Document* doc, AtomicString& attrName, const AtomicString& attributeValue, bool viewSourceMode)
+inline void Token::addAttribute(AtomicString& attrName, const AtomicString& attributeValue, bool viewSourceMode)
 {
     if (!attrName.isEmpty()) {
         ASSERT(!attrName.contains('/'));
         RefPtr<MappedAttribute> a = MappedAttribute::create(attrName, attributeValue);
         if (!attrs) {
             attrs = NamedMappedAttrMap::create();
-            attrs->reserveCapacity(10);
+            attrs->reserveInitialCapacity(10);
         }
         attrs->insertAttribute(a.release(), viewSourceMode);
     }
@@ -314,7 +317,7 @@ HTMLTokenizer::State HTMLTokenizer::processListing(SegmentedString list, State s
     return state;
 }
 
-HTMLTokenizer::State HTMLTokenizer::parseSpecial(SegmentedString& src, State state)
+HTMLTokenizer::State HTMLTokenizer::parseNonHTMLText(SegmentedString& src, State state)
 {
     ASSERT(state.inTextArea() || state.inTitle() || state.inIFrame() || !state.hasEntityState());
     ASSERT(!state.hasTagState());
@@ -445,16 +448,11 @@ HTMLTokenizer::State HTMLTokenizer::scriptHandler(State state)
             m_scriptTagSrcAttrValue = String();
         } else {
             // Parse m_scriptCode containing <script> info
-#if USE(LOW_BANDWIDTH_DISPLAY)
-            if (m_doc->inLowBandwidthDisplay()) {
-                // ideal solution is only skipping internal JavaScript if there is external JavaScript.
-                // but internal JavaScript can use document.write() to create an external JavaScript,
-                // so we have to skip internal JavaScript all the time.
-                m_doc->frame()->loader()->needToSwitchOutLowBandwidthDisplay();
-                doScriptExec = false;
-            } else
-#endif
             doScriptExec = m_scriptNode->shouldExecuteAsJavaScript();
+#if ENABLE(XHTMLMP)
+            if (!doScriptExec)
+                m_doc->setShouldProcessNoscriptElement(true);
+#endif
             m_scriptNode = 0;
         }
     }
@@ -867,7 +865,9 @@ HTMLTokenizer::State HTMLTokenizer::parseEntity(SegmentedString& src, UChar*& de
                     }
                 } else {
                     // FIXME: We should eventually colorize entities by sending them as a special token.
-                    checkBuffer(11);
+                    // 12 bytes required: up to 10 bytes in m_cBuffer plus the
+                    // leading '&' and trailing ';'
+                    checkBuffer(12);
                     *dest++ = '&';
                     for (unsigned i = 0; i < cBufferPos; i++)
                         dest[i] = m_cBuffer[i];
@@ -878,7 +878,9 @@ HTMLTokenizer::State HTMLTokenizer::parseEntity(SegmentedString& src, UChar*& de
                     }
                 }
             } else {
-                checkBuffer(10);
+                // 11 bytes required: up to 10 bytes in m_cBuffer plus the
+                // leading '&'
+                checkBuffer(11);
                 // ignore the sequence, add it to the buffer as plaintext
                 *dest++ = '&';
                 for (unsigned i = 0; i < cBufferPos; i++)
@@ -1309,7 +1311,7 @@ HTMLTokenizer::State HTMLTokenizer::parseTag(SegmentedString& src, State state)
                             m_currentToken.addViewSourceChar(curchar);
                         src.advancePastNonNewline();
                     } else {
-                        m_currentToken.addAttribute(m_doc, m_attrName, emptyAtom, inViewSourceMode());
+                        m_currentToken.addAttribute(m_attrName, emptyAtom, inViewSourceMode());
                         m_dest = m_buffer;
                         state.setTagState(SearchAttribute);
                         lastIsSlash = false;
@@ -1363,7 +1365,7 @@ HTMLTokenizer::State HTMLTokenizer::parseTag(SegmentedString& src, State state)
                         AtomicString attributeValue(m_buffer + 1, m_dest - m_buffer - 1);
                         if (!attributeValue.contains('/'))
                             m_attrName = attributeValue; // Just make the name/value match. (FIXME: Is this some WinIE quirk?)
-                        m_currentToken.addAttribute(m_doc, m_attrName, attributeValue, inViewSourceMode());
+                        m_currentToken.addAttribute(m_attrName, attributeValue, inViewSourceMode());
                         if (inViewSourceMode())
                             m_currentToken.addViewSourceChar('x');
                         state.setTagState(SearchAttribute);
@@ -1389,7 +1391,7 @@ HTMLTokenizer::State HTMLTokenizer::parseTag(SegmentedString& src, State state)
                                 m_currentToken.addViewSourceChar('x');
                         } else if (inViewSourceMode())
                             m_currentToken.addViewSourceChar('v');
-                        m_currentToken.addAttribute(m_doc, m_attrName, attributeValue, inViewSourceMode());
+                        m_currentToken.addAttribute(m_attrName, attributeValue, inViewSourceMode());
                         m_dest = m_buffer;
                         state.setTagState(SearchAttribute);
                         tquote = NoQuote;
@@ -1419,7 +1421,7 @@ HTMLTokenizer::State HTMLTokenizer::parseTag(SegmentedString& src, State state)
                     // '/' does not delimit in IE!
                     if (isASCIISpace(curchar) || curchar == '>') {
                         AtomicString attributeValue(m_buffer + 1, m_dest - m_buffer - 1);
-                        m_currentToken.addAttribute(m_doc, m_attrName, attributeValue, inViewSourceMode());
+                        m_currentToken.addAttribute(m_attrName, attributeValue, inViewSourceMode());
                         if (inViewSourceMode())
                             m_currentToken.addViewSourceChar('v');
                         m_dest = m_buffer;
@@ -1471,8 +1473,11 @@ HTMLTokenizer::State HTMLTokenizer::parseTag(SegmentedString& src, State state)
                 m_scriptTagCharsetAttrValue = String();
                 if (m_currentToken.attrs && !m_fragment) {
                     if (m_doc->frame() && m_doc->frame()->script()->isEnabled()) {
-                        if ((a = m_currentToken.attrs->getAttributeItem(srcAttr)))
+                        if ((a = m_currentToken.attrs->getAttributeItem(srcAttr))) {
                             m_scriptTagSrcAttrValue = m_doc->completeURL(parseURL(a->value())).string();
+                            if (m_XSSAuditor && !m_XSSAuditor->canLoadExternalScriptFromSrc(a->value()))
+                                m_scriptTagSrcAttrValue = String();
+                        }
                     }
                 }
             }
@@ -1480,6 +1485,9 @@ HTMLTokenizer::State HTMLTokenizer::parseTag(SegmentedString& src, State state)
             RefPtr<Node> n = processToken();
             m_cBufferPos = cBufferPos;
             if (n || inViewSourceMode()) {
+                State savedState = state;
+                SegmentedString savedSrc = src;
+                long savedLineno = m_lineNumber;
                 if ((tagName == preTag || tagName == listingTag) && !inViewSourceMode()) {
                     if (beginTag)
                         state.setDiscardLF(true); // Discard the first LF after we open a pre.
@@ -1492,7 +1500,7 @@ HTMLTokenizer::State HTMLTokenizer::parseTag(SegmentedString& src, State state)
                         m_searchStopper = scriptEnd;
                         m_searchStopperLength = 8;
                         state.setInScript(true);
-                        state = parseSpecial(src, state);
+                        state = parseNonHTMLText(src, state);
                     } else if (isSelfClosingScript) { // Handle <script src="foo"/>
                         state.setInScript(true);
                         state = scriptHandler(state);
@@ -1502,53 +1510,50 @@ HTMLTokenizer::State HTMLTokenizer::parseTag(SegmentedString& src, State state)
                         m_searchStopper = styleEnd;
                         m_searchStopperLength = 7;
                         state.setInStyle(true);
-                        state = parseSpecial(src, state);
+                        state = parseNonHTMLText(src, state);
                     }
                 } else if (tagName == textareaTag) {
                     if (beginTag) {
                         m_searchStopper = textareaEnd;
                         m_searchStopperLength = 10;
                         state.setInTextArea(true);
-                        state = parseSpecial(src, state);
+                        state = parseNonHTMLText(src, state);
                     }
                 } else if (tagName == titleTag) {
                     if (beginTag) {
                         m_searchStopper = titleEnd;
                         m_searchStopperLength = 7;
-                        State savedState = state;
-                        SegmentedString savedSrc = src;
-                        long savedLineno = m_lineNumber;
                         state.setInTitle(true);
-                        state = parseSpecial(src, state);
-                        if (state.inTitle() && src.isEmpty()) {
-                            // We just ate the rest of the document as the title #text node!
-                            // Reset the state then retokenize without special title handling.
-                            // Let the parser clean up the missing </title> tag.
-                            // FIXME: This is incorrect, because src.isEmpty() doesn't mean we're
-                            // at the end of the document unless m_noMoreData is also true. We need
-                            // to detect this case elsewhere, and save the state somewhere other
-                            // than a local variable.
-                            state = savedState;
-                            src = savedSrc;
-                            m_lineNumber = savedLineno;
-                            m_scriptCodeSize = 0;
-                        }
+                        state = parseNonHTMLText(src, state);
                     }
                 } else if (tagName == xmpTag) {
                     if (beginTag) {
                         m_searchStopper = xmpEnd;
                         m_searchStopperLength = 5;
                         state.setInXmp(true);
-                        state = parseSpecial(src, state);
+                        state = parseNonHTMLText(src, state);
                     }
                 } else if (tagName == iframeTag) {
                     if (beginTag) {
                         m_searchStopper = iframeEnd;
                         m_searchStopperLength = 8;
                         state.setInIFrame(true);
-                        state = parseSpecial(src, state);
+                        state = parseNonHTMLText(src, state);
                     }
                 }
+                if (src.isEmpty() && (state.inTitle() || inViewSourceMode()) && !state.inComment() && !(state.inScript() && m_currentScriptTagStartLineNumber)) {
+                    // We just ate the rest of the document as the #text node under the special tag!
+                    // Reset the state then retokenize without special handling.
+                    // Let the parser clean up the missing close tag.
+                    // FIXME: This is incorrect, because src.isEmpty() doesn't mean we're
+                    // at the end of the document unless m_noMoreData is also true. We need
+                    // to detect this case elsewhere, and save the state somewhere other
+                    // than a local variable.
+                    state = savedState;
+                    src = savedSrc;
+                    m_lineNumber = savedLineno;
+                    m_scriptCodeSize = 0;
+                }
             }
             if (tagName == plaintextTag)
                 state.setInPlainText(beginTag);
@@ -1588,13 +1593,13 @@ inline bool HTMLTokenizer::continueProcessing(int& processedCount, double startT
     return true;
 }
 
-bool HTMLTokenizer::write(const SegmentedString& str, bool appendData)
+void HTMLTokenizer::write(const SegmentedString& str, bool appendData)
 {
     if (!m_buffer)
-        return false;
+        return;
     
     if (m_parserStopped)
-        return false;
+        return;
 
     SegmentedString source(str);
     if (m_executingScript)
@@ -1611,7 +1616,7 @@ bool HTMLTokenizer::write(const SegmentedString& str, bool appendData)
                 m_preloadScanner->write(source);
 #endif
         }
-        return false;
+        return;
     }
     
 #if PRELOAD_SCANNER_ENABLED
@@ -1626,7 +1631,7 @@ bool HTMLTokenizer::write(const SegmentedString& str, bool appendData)
 
     // Once a timer is set, it has control of when the tokenizer continues.
     if (m_timer.isActive())
-        return false;
+        return;
 
     bool wasInWrite = m_inWrite;
     m_inWrite = true;
@@ -1664,8 +1669,8 @@ bool HTMLTokenizer::write(const SegmentedString& str, bool appendData)
                 state = parseEntity(m_src, m_dest, state, m_cBufferPos, false, state.hasTagState());
             else if (state.inPlainText())
                 state = parseText(m_src, state);
-            else if (state.inAnySpecial())
-                state = parseSpecial(m_src, state);
+            else if (state.inAnyNonHTMLText())
+                state = parseNonHTMLText(m_src, state);
             else if (state.inComment())
                 state = parseComment(m_src, state);
             else if (state.inDoctype())
@@ -1764,11 +1769,8 @@ bool HTMLTokenizer::write(const SegmentedString& str, bool appendData)
 
     m_state = state;
 
-    if (m_noMoreData && !m_inWrite && !state.loadingExtScript() && !m_executingScript && !m_timer.isActive()) {
+    if (m_noMoreData && !m_inWrite && !state.loadingExtScript() && !m_executingScript && !m_timer.isActive())
         end(); // this actually causes us to be deleted
-        return true;
-    }
-    return false;
 }
 
 void HTMLTokenizer::stopParsing()
@@ -1872,7 +1874,7 @@ PassRefPtr<Node> HTMLTokenizer::processToken()
     ScriptController* scriptController = (!m_fragment && m_doc->frame()) ? m_doc->frame()->script() : 0;
     if (scriptController && scriptController->isEnabled())
         // FIXME: Why isn't this m_currentScriptTagStartLineNumber?  I suspect this is wrong.
-        scriptController->setEventHandlerLineno(m_currentTagStartLineNumber + 1); // Script line numbers are 1 based.
+        scriptController->setEventHandlerLineNumber(m_currentTagStartLineNumber + 1); // Script line numbers are 1 based.
     if (m_dest > m_buffer) {
         m_currentToken.text = StringImpl::createStrippingNullCharacters(m_buffer, m_dest - m_buffer);
         if (m_currentToken.tagName != commentAtom)
@@ -1880,7 +1882,7 @@ PassRefPtr<Node> HTMLTokenizer::processToken()
     } else if (m_currentToken.tagName == nullAtom) {
         m_currentToken.reset();
         if (scriptController)
-            scriptController->setEventHandlerLineno(m_lineNumber + 1); // Script line numbers are 1 based.
+            scriptController->setEventHandlerLineNumber(m_lineNumber + 1); // Script line numbers are 1 based.
         return 0;
     }
 
@@ -1899,7 +1901,7 @@ PassRefPtr<Node> HTMLTokenizer::processToken()
     }
     m_currentToken.reset();
     if (scriptController)
-        scriptController->setEventHandlerLineno(0);
+        scriptController->setEventHandlerLineNumber(0);
 
     return n.release();
 }
@@ -1921,7 +1923,16 @@ HTMLTokenizer::~HTMLTokenizer()
 
 void HTMLTokenizer::enlargeBuffer(int len)
 {
-    int newSize = max(m_bufferSize * 2, m_bufferSize + len);
+    // Resize policy: Always at least double the size of the buffer each time.
+    int delta = max(len, m_bufferSize);
+
+    // Check for overflow.
+    // For now, handle overflow the same way we handle fastRealloc failure, with CRASH.
+    static const int maxSize = INT_MAX / sizeof(UChar);
+    if (delta > maxSize - m_bufferSize)
+        CRASH();
+
+    int newSize = m_bufferSize + delta;
     int oldOffset = m_dest - m_buffer;
     m_buffer = static_cast<UChar*>(fastRealloc(m_buffer, newSize * sizeof(UChar)));
     m_dest = m_buffer + oldOffset;
@@ -1930,7 +1941,16 @@ void HTMLTokenizer::enlargeBuffer(int len)
 
 void HTMLTokenizer::enlargeScriptBuffer(int len)
 {
-    int newSize = max(m_scriptCodeCapacity * 2, m_scriptCodeCapacity + len);
+    // Resize policy: Always at least double the size of the buffer each time.
+    int delta = max(len, m_scriptCodeCapacity);
+
+    // Check for overflow.
+    // For now, handle overflow the same way we handle fastRealloc failure, with CRASH.
+    static const int maxSize = INT_MAX / sizeof(UChar);
+    if (delta > maxSize - m_scriptCodeCapacity)
+        CRASH();
+
+    int newSize = m_scriptCodeCapacity + delta;
     m_scriptCode = static_cast<UChar*>(fastRealloc(m_scriptCode, newSize * sizeof(UChar)));
     m_scriptCodeCapacity = newSize;
 }
@@ -1980,11 +2000,15 @@ void HTMLTokenizer::notifyFinished(CachedResource*)
 #endif
 
         if (errorOccurred)
-            EventTargetNodeCast(n.get())->dispatchEventForType(eventNames().errorEvent, true, false);
+            n->dispatchEvent(eventNames().errorEvent, true, false);
         else {
             if (static_cast<HTMLScriptElement*>(n.get())->shouldExecuteAsJavaScript())
                 m_state = scriptExecution(sourceCode, m_state);
-            EventTargetNodeCast(n.get())->dispatchEventForType(eventNames().loadEvent, false, false);
+#if ENABLE(XHTMLMP)
+            else
+                m_doc->setShouldProcessNoscriptElement(true);
+#endif
+            n->dispatchEvent(eventNames().loadEvent, false, false);
         }
 
         // The state of m_pendingScripts.isEmpty() can change inside the scriptExecution()
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.h b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.h
index 8615791..6612af8 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLTokenizer.h
@@ -3,7 +3,7 @@
               (C) 1997 Torben Weis (weis@kde.org)
               (C) 1998 Waldo Bastian (bastian@kde.org)
               (C) 2001 Dirk Mueller (mueller@kde.org)
-    Copyright (C) 2003, 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+    Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -63,7 +63,7 @@ struct Token {
     { }
     ~Token() { }
 
-    void addAttribute(Document*, AtomicString& attrName, const AtomicString& v, bool viewSourceMode);
+    void addAttribute(AtomicString& attrName, const AtomicString& v, bool viewSourceMode);
 
     bool isOpenTag(const QualifiedName& fullName) const { return beginTag && fullName.localName() == tagName; }
     bool isCloseTag(const QualifiedName& fullName) const { return !beginTag && fullName.localName() == tagName; }
@@ -138,7 +138,7 @@ public:
     HTMLTokenizer(DocumentFragment*);
     virtual ~HTMLTokenizer();
 
-    virtual bool write(const SegmentedString&, bool appendData);
+    virtual void write(const SegmentedString&, bool appendData);
     virtual void finish();
     virtual void setForceSynchronous(bool force);
     virtual bool isWaitingForScripts() const;
@@ -173,7 +173,7 @@ private:
     State parseDoctype(SegmentedString&, State);
     State parseServer(SegmentedString&, State);
     State parseText(SegmentedString&, State);
-    State parseSpecial(SegmentedString&, State);
+    State parseNonHTMLText(SegmentedString&, State);
     State parseTag(SegmentedString&, State);
     State parseEntity(SegmentedString&, UChar*& dest, State, unsigned& cBufferPos, bool start, bool parsingTag);
     State parseProcessingInstruction(SegmentedString&, State);
@@ -288,7 +288,7 @@ private:
         bool forceSynchronous() const { return testBit(ForceSynchronous); }
         void setForceSynchronous(bool v) { setBit(ForceSynchronous, v); }
 
-        bool inAnySpecial() const { return m_bits & (InScript | InStyle | InXmp | InTextArea | InTitle | InIFrame); }
+        bool inAnyNonHTMLText() const { return m_bits & (InScript | InStyle | InXmp | InTextArea | InTitle | InIFrame); }
         bool hasTagState() const { return m_bits & TagMask; }
         bool hasEntityState() const { return m_bits & EntityMask; }
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLUListElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLUListElement.cpp
index c1a7644..f36cb57 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLUListElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLUListElement.cpp
@@ -18,11 +18,13 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "HTMLUListElement.h"
 
 #include "CSSPropertyNames.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 
 namespace WebCore {
 
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.cpp
index a67db71..a6210a2 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,6 +33,7 @@
 #include "Document.h"
 #include "HTMLImageLoader.h"
 #include "HTMLNames.h"
+#include "MappedAttribute.h"
 #include "RenderImage.h"
 #include "RenderVideo.h"
 
@@ -52,27 +53,30 @@ bool HTMLVideoElement::rendererIsNeeded(RenderStyle* style)
     return HTMLElement::rendererIsNeeded(style); 
 }
 
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
 RenderObject* HTMLVideoElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
     if (m_shouldShowPosterImage)
         return new (arena) RenderImage(this);
     return new (arena) RenderVideo(this);
 }
+#endif
 
 void HTMLVideoElement::attach()
 {
     HTMLMediaElement::attach();
-    
+
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     if (m_shouldShowPosterImage) {
         if (!m_imageLoader)
             m_imageLoader.set(new HTMLImageLoader(this));
         m_imageLoader->updateFromElement();
         if (renderer() && renderer()->isImage()) {
-            RenderImage* imageRenderer = static_cast<RenderImage*>(renderer());
+            RenderImage* imageRenderer = toRenderImage(renderer());
             imageRenderer->setCachedImage(m_imageLoader->image()); 
         }
     }
-
+#endif
 }
 
 void HTMLVideoElement::detach()
@@ -91,9 +95,14 @@ void HTMLVideoElement::parseMappedAttribute(MappedAttribute* attr)
     if (attrName == posterAttr) {
         updatePosterImage();
         if (m_shouldShowPosterImage) {
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
             if (!m_imageLoader)
                 m_imageLoader.set(new HTMLImageLoader(this));
             m_imageLoader->updateFromElementIgnoringPreviousError();
+#else
+            if (m_player)
+                m_player->setPoster(poster());
+#endif
         }
     } else if (attrName == widthAttr)
         addCSSLength(attr, CSSPropertyWidth, attr->value());
@@ -163,12 +172,30 @@ const QualifiedName& HTMLVideoElement::imageSourceAttributeName() const
 
 void HTMLVideoElement::updatePosterImage()
 {
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     bool oldShouldShowPosterImage = m_shouldShowPosterImage;
-    m_shouldShowPosterImage = !poster().isEmpty() && m_networkState < LOADED_FIRST_FRAME;
+#endif
+
+    m_shouldShowPosterImage = !poster().isEmpty() && readyState() < HAVE_CURRENT_DATA;
+
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     if (attached() && oldShouldShowPosterImage != m_shouldShowPosterImage) {
         detach();
         attach();
     }
+#endif
+}
+
+void HTMLVideoElement::paint(GraphicsContext* context, const IntRect& r)
+{
+    // FIXME: We should also be able to paint the poster image.
+
+    MediaPlayer* player = HTMLMediaElement::player();
+    if (!player)
+        return;
+
+    player->setVisible(true); // Make player visible or it won't draw.
+    player->paint(context, r);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h
index 8779c85..830e72e 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLVideoElement.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -42,11 +42,15 @@ public:
     
     virtual int tagPriority() const { return 5; }
     virtual bool rendererIsNeeded(RenderStyle*);
+#if !ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+#endif
     virtual void attach();
     virtual void detach();
     virtual void parseMappedAttribute(MappedAttribute* attr);
     virtual bool isVideo() const { return true; }
+    virtual bool hasVideo() const { return player() && player()->hasVideo(); }
+    virtual bool supportsFullscreen() const { return player() && player()->supportsFullscreen(); }
     virtual bool isURLAttribute(Attribute*) const;
     virtual const QualifiedName& imageSourceAttributeName() const;
 
@@ -63,6 +67,9 @@ public:
 
     void updatePosterImage();
 
+    // Used by canvas to gain raw pixel access
+    void paint(GraphicsContext*, const IntRect&);
+
 private:
     OwnPtr<HTMLImageLoader> m_imageLoader;
     bool m_shouldShowPosterImage;
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp b/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp
index 752df5e..13404cc 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.cpp
@@ -26,18 +26,19 @@
 #include "HTMLViewSourceDocument.h"
 
 #include "DOMImplementation.h"
-#include "HTMLTokenizer.h"
-#include "HTMLHtmlElement.h"
 #include "HTMLAnchorElement.h"
 #include "HTMLBodyElement.h"
 #include "HTMLDivElement.h"
-#include "HTMLTableElement.h"
+#include "HTMLHtmlElement.h"
+#include "HTMLNames.h"
 #include "HTMLTableCellElement.h"
+#include "HTMLTableElement.h"
 #include "HTMLTableRowElement.h"
 #include "HTMLTableSectionElement.h"
+#include "HTMLTokenizer.h"
+#include "MappedAttribute.h"
 #include "Text.h"
 #include "TextDocument.h"
-#include "HTMLNames.h"
 
 namespace WebCore {
 
@@ -50,13 +51,21 @@ HTMLViewSourceDocument::HTMLViewSourceDocument(Frame* frame, const String& mimeT
     , m_tbody(0)
     , m_td(0)
 {
+    setUsesBeforeAfterRules(true);
 }
 
 Tokenizer* HTMLViewSourceDocument::createTokenizer()
 {
-    if (implementation()->isTextMIMEType(m_type))
-        return createTextTokenizer(this);
-    return new HTMLTokenizer(this);
+    // Use HTMLTokenizer if applicable, otherwise use TextTokenizer.
+    if (m_type == "text/html" || m_type == "application/xhtml+xml" || m_type == "image/svg+xml" || implementation()->isXMLMIMEType(m_type)
+#if ENABLE(XHTMLMP)
+        || m_type == "application/vnd.wap.xhtml+xml"
+#endif
+        ) {
+        return new HTMLTokenizer(this);
+    }
+
+    return createTextTokenizer(this);
 }
 
 void HTMLViewSourceDocument::createContainingTable()
@@ -72,7 +81,7 @@ void HTMLViewSourceDocument::createContainingTable()
     // document.
     RefPtr<Element> div = new HTMLDivElement(divTag, this);
     RefPtr<NamedMappedAttrMap> attrs = NamedMappedAttrMap::create();
-    attrs->insertAttribute(MappedAttribute::create(classAttr, "webkit-line-gutter-backdrop"), true);
+    attrs->addAttribute(MappedAttribute::create(classAttr, "webkit-line-gutter-backdrop"));
     div->setAttributeMap(attrs.release());
     body->addChild(div);
     div->attach();
@@ -149,6 +158,17 @@ void HTMLViewSourceDocument::addViewSourceToken(Token* token)
                                 m_current = static_cast<Element*>(m_current->parent());
                         } else {
                             const String& value = attr->value().string();
+
+                            // Compare ignoring case since HTMLTokenizer doesn't
+                            // lower names when passing in tokens to
+                            // HTMLViewSourceDocument.
+                            if (equalIgnoringCase(token->tagName, "base") && equalIgnoringCase(attr->name().localName(), "href")) {
+                                // Catch the href attribute in the base element.
+                                // It will be used for rendering anchors created
+                                // by addLink() below.
+                                setBaseElementURL(KURL(url(), value));
+                            }
+
                             // FIXME: XML could use namespace prefixes and confuse us.
                             if (equalIgnoringCase(attr->name().localName(), "src") || equalIgnoringCase(attr->name().localName(), "href"))
                                 m_current = addLink(value, equalIgnoringCase(token->tagName, "a"));
@@ -194,7 +214,7 @@ Element* HTMLViewSourceDocument::addSpanWithClassName(const String& className)
 
     Element* span = new HTMLElement(spanTag, this);
     RefPtr<NamedMappedAttrMap> attrs = NamedMappedAttrMap::create();
-    attrs->insertAttribute(MappedAttribute::create(classAttr, className), true);
+    attrs->addAttribute(MappedAttribute::create(classAttr, className));
     span->setAttributeMap(attrs.release());
     m_current->addChild(span);
     span->attach();
@@ -211,7 +231,7 @@ void HTMLViewSourceDocument::addLine(const String& className)
     // Create a cell that will hold the line number (it is generated in the stylesheet using counters).
     Element* td = new HTMLTableCellElement(tdTag, this);
     RefPtr<NamedMappedAttrMap> attrs = NamedMappedAttrMap::create();
-    attrs->insertAttribute(MappedAttribute::create(classAttr, "webkit-line-number"), true);
+    attrs->addAttribute(MappedAttribute::create(classAttr, "webkit-line-number"));
     td->setAttributeMap(attrs.release());
     trow->addChild(td);
     td->attach();
@@ -219,7 +239,7 @@ void HTMLViewSourceDocument::addLine(const String& className)
     // Create a second cell for the line contents
     td = new HTMLTableCellElement(tdTag, this);
     attrs = NamedMappedAttrMap::create();
-    attrs->insertAttribute(MappedAttribute::create(classAttr, "webkit-line-content"), true);
+    attrs->addAttribute(MappedAttribute::create(classAttr, "webkit-line-content"));
     td->setAttributeMap(attrs.release());
     trow->addChild(td);
     td->attach();
@@ -282,9 +302,9 @@ Element* HTMLViewSourceDocument::addLink(const String& url, bool isAnchor)
         classValue = "webkit-html-attribute-value webkit-html-external-link";
     else
         classValue = "webkit-html-attribute-value webkit-html-resource-link";
-    attrs->insertAttribute(MappedAttribute::create(classAttr, classValue), true);
-    attrs->insertAttribute(MappedAttribute::create(targetAttr, "_blank"), true);
-    attrs->insertAttribute(MappedAttribute::create(hrefAttr, url), true);
+    attrs->addAttribute(MappedAttribute::create(classAttr, classValue));
+    attrs->addAttribute(MappedAttribute::create(targetAttr, "_blank"));
+    attrs->addAttribute(MappedAttribute::create(hrefAttr, url));
     anchor->setAttributeMap(attrs.release());
     m_current->addChild(anchor);
     anchor->attach();
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.h b/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.h
index 4e725c7..57a8f21 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.h
+++ b/src/3rdparty/webkit/WebCore/html/HTMLViewSourceDocument.h
@@ -38,9 +38,10 @@ public:
     {
         return new HTMLViewSourceDocument(frame, mimeType);
     }
-    
+
+    // Returns HTMLTokenizer or TextTokenizer based on m_type.
     virtual Tokenizer* createTokenizer();
-    
+
     void addViewSourceToken(Token*); // Used by the HTML tokenizer.
     void addViewSourceText(const String&); // Used by the plaintext tokenizer.
     void addViewSourceDoctypeToken(DoctypeToken*);
diff --git a/src/3rdparty/webkit/WebCore/html/ImageData.cpp b/src/3rdparty/webkit/WebCore/html/ImageData.cpp
index f06228f..104ffb55 100644
--- a/src/3rdparty/webkit/WebCore/html/ImageData.cpp
+++ b/src/3rdparty/webkit/WebCore/html/ImageData.cpp
@@ -39,7 +39,7 @@ PassRefPtr<ImageData> ImageData::create(unsigned width, unsigned height)
 ImageData::ImageData(unsigned width, unsigned height)
     : m_width(width)
     , m_height(height)
-    , m_data(JSC::ByteArray::create(width * height * 4))
+    , m_data(CanvasPixelArray::create(width * height * 4))
 {
 }
 
diff --git a/src/3rdparty/webkit/WebCore/html/ImageData.h b/src/3rdparty/webkit/WebCore/html/ImageData.h
index ad63e19..fe79f66 100644
--- a/src/3rdparty/webkit/WebCore/html/ImageData.h
+++ b/src/3rdparty/webkit/WebCore/html/ImageData.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,7 +29,7 @@
 #ifndef ImageData_h
 #define ImageData_h
 
-#include <runtime/ByteArray.h>
+#include "CanvasPixelArray.h"
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 
@@ -41,13 +41,13 @@ namespace WebCore {
 
         unsigned width() const { return m_width; }
         unsigned height() const { return m_height; }
-        JSC::ByteArray* data() const { return m_data.get(); }
+        CanvasPixelArray* data() const { return m_data.get(); }
 
     private:
         ImageData(unsigned width, unsigned height);
         unsigned m_width;
         unsigned m_height;
-        RefPtr<JSC::ByteArray> m_data;
+        RefPtr<CanvasPixelArray> m_data;
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/html/ImageData.idl b/src/3rdparty/webkit/WebCore/html/ImageData.idl
index 69c92ad..7f37b52 100644
--- a/src/3rdparty/webkit/WebCore/html/ImageData.idl
+++ b/src/3rdparty/webkit/WebCore/html/ImageData.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,6 +34,9 @@ module html {
     ] ImageData {
         readonly attribute long width;
         readonly attribute long height;
+#if !defined(LANGUAGE_JAVASCRIPT) || !LANGUAGE_JAVASCRIPT || defined(V8_BINDING) && V8_BINDING
+        readonly attribute CanvasPixelArray data;
+#endif
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/html/MediaError.h b/src/3rdparty/webkit/WebCore/html/MediaError.h
index fbf375f..5e77d9e 100644
--- a/src/3rdparty/webkit/WebCore/html/MediaError.h
+++ b/src/3rdparty/webkit/WebCore/html/MediaError.h
@@ -34,7 +34,7 @@ namespace WebCore {
 
 class MediaError : public RefCounted<MediaError> {
 public:
-    enum Code { MEDIA_ERR_ABORTED = 1, MEDIA_ERR_NETWORK, MEDIA_ERR_DECODE };
+    enum Code { MEDIA_ERR_ABORTED = 1, MEDIA_ERR_NETWORK, MEDIA_ERR_DECODE, MEDIA_ERR_SRC_NOT_SUPPORTED };
 
     static PassRefPtr<MediaError> create(Code code) { return adoptRef(new MediaError(code)); }
 
diff --git a/src/3rdparty/webkit/WebCore/html/MediaError.idl b/src/3rdparty/webkit/WebCore/html/MediaError.idl
index 5b4f0a2..4dcea7d 100644
--- a/src/3rdparty/webkit/WebCore/html/MediaError.idl
+++ b/src/3rdparty/webkit/WebCore/html/MediaError.idl
@@ -28,6 +28,7 @@ module html {
           const unsigned short MEDIA_ERR_ABORTED = 1;
           const unsigned short MEDIA_ERR_NETWORK = 2;
           const unsigned short MEDIA_ERR_DECODE = 3;
+          const unsigned short MEDIA_ERR_SRC_NOT_SUPPORTED = 4;
           readonly attribute unsigned short code;
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/html/PreloadScanner.cpp b/src/3rdparty/webkit/WebCore/html/PreloadScanner.cpp
index f029711..1c1d28a 100644
--- a/src/3rdparty/webkit/WebCore/html/PreloadScanner.cpp
+++ b/src/3rdparty/webkit/WebCore/html/PreloadScanner.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Torch Mobile, Inc. http://www.torchmobile.com/
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -40,10 +41,11 @@
 #include "FrameLoader.h"
 #include "HTMLLinkElement.h"
 #include "HTMLNames.h"
-#include "SystemTime.h"
+#include <wtf/CurrentTime.h>
 #include <wtf/unicode/Unicode.h>
 
-#if COMPILER(GCC)
+// Use __GNUC__ instead of PLATFORM(GCC) to stay consistent with the gperf generated c file
+#ifdef __GNUC__
 // The main tokenizer includes this too so we are getting two copies of the data. However, this way the code gets inlined.
 #include "HTMLEntityNames.c"
 #else
@@ -128,9 +130,13 @@ bool PreloadScanner::scanningBody() const
     
 void PreloadScanner::write(const SegmentedString& source)
 {
+#if PRELOAD_DEBUG
     double startTime = currentTime();
+#endif
     tokenize(source);
+#if PRELOAD_DEBUG
     m_timeUsed += currentTime() - startTime;
+#endif
 }
     
 static inline bool isWhitespace(UChar c)
@@ -220,8 +226,8 @@ unsigned PreloadScanner::consumeEntity(SegmentedString& source, bool& notEnoughC
             else if (cc >= 'A' && cc <= 'F')
                 result = 10 + cc - 'A';
             else {
-                source.push(seenChars[1]);
                 source.push('#');
+                source.push(seenChars[1]);
                 return 0;
             }
             entityState = Hex;
@@ -275,8 +281,8 @@ unsigned PreloadScanner::consumeEntity(SegmentedString& source, bool& notEnoughC
             if (seenChars.size() == 2)
                 source.push(seenChars[0]);
             else if (seenChars.size() == 3) {
-                source.push(seenChars[1]);
                 source.push(seenChars[0]);
+                source.push(seenChars[1]);
             } else
                 source.prepend(SegmentedString(String(seenChars.data(), seenChars.size() - 1)));
             return 0;
diff --git a/src/3rdparty/webkit/WebCore/html/TimeRanges.cpp b/src/3rdparty/webkit/WebCore/html/TimeRanges.cpp
index ad81ac8..e5b070d 100644
--- a/src/3rdparty/webkit/WebCore/html/TimeRanges.cpp
+++ b/src/3rdparty/webkit/WebCore/html/TimeRanges.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,6 +34,17 @@ TimeRanges::TimeRanges(float start, float end)
     add(start, end);
 }
 
+PassRefPtr<TimeRanges> TimeRanges::copy()
+{
+    RefPtr<TimeRanges> newSession = TimeRanges::create();
+    
+    unsigned size = m_ranges.size();
+    for (unsigned i = 0; i < size; i++)
+        newSession->add(m_ranges[i].m_start, m_ranges[i].m_end);
+    
+    return newSession.release();
+}
+
 float TimeRanges::start(unsigned index, ExceptionCode& ec) const 
 { 
     if (index >= length()) {
@@ -53,9 +64,46 @@ float TimeRanges::end(unsigned index, ExceptionCode& ec) const
 }
 
 void TimeRanges::add(float start, float end) 
-{ 
-    m_ranges.append(Range(start, end));
-    // FIXME normalize
+{
+    ASSERT(start <= end);
+    unsigned int overlappingArcIndex;
+    Range addedRange(start, end);
+
+    // For each present range check if we need to:
+    // - merge with the added range, in case we are overlapping or contiguous
+    // - Need to insert in place, we we are completely, not overlapping and not contiguous
+    // in between two ranges.
+    //
+    // TODO: Given that we assume that ranges are correctly ordered, this could be optimized.
+
+    for (overlappingArcIndex = 0; overlappingArcIndex < m_ranges.size(); overlappingArcIndex++) {
+        if (addedRange.isOverlappingRange(m_ranges[overlappingArcIndex])
+         || addedRange.isContiguousWithRange(m_ranges[overlappingArcIndex])) {
+            // We need to merge the addedRange and that range.
+            addedRange = addedRange.unionWithOverlappingOrContiguousRange(m_ranges[overlappingArcIndex]);
+            m_ranges.remove(overlappingArcIndex);
+            overlappingArcIndex--;
+        } else {
+            // Check the case for which there is no more to do
+            if (!overlappingArcIndex) {
+                if (addedRange.isBeforeRange(m_ranges[0])) {
+                    // First index, and we are completely before that range (and not contiguous, nor overlapping).
+                    // We just need to be inserted here.
+                    break;
+                }
+            } else {
+                if (m_ranges[overlappingArcIndex - 1].isBeforeRange(addedRange)
+                 && addedRange.isBeforeRange(m_ranges[overlappingArcIndex])) {
+                    // We are exactly after the current previous range, and before the current range, while
+                    // not overlapping with none of them. Insert here.
+                    break;
+                }
+            }
+        }
+    }
+
+    // Now that we are sure we don't overlap with any range, just add it.
+    m_ranges.insert(overlappingArcIndex, addedRange);
 }
 
 bool TimeRanges::contain(float time) const
diff --git a/src/3rdparty/webkit/WebCore/html/TimeRanges.h b/src/3rdparty/webkit/WebCore/html/TimeRanges.h
index eb54f6b..37820dc 100644
--- a/src/3rdparty/webkit/WebCore/html/TimeRanges.h
+++ b/src/3rdparty/webkit/WebCore/html/TimeRanges.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,6 +27,8 @@
 #define TimeRanges_h
 
 #include "ExceptionCode.h"
+
+#include <algorithm>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
@@ -44,6 +46,8 @@ public:
         return adoptRef(new TimeRanges(start, end));
     }
 
+    PassRefPtr<TimeRanges> copy();
+
     unsigned length() const { return m_ranges.size(); }
     float start(unsigned index, ExceptionCode&) const;
     float end(unsigned index, ExceptionCode&) const;
@@ -55,7 +59,9 @@ public:
 private:
     TimeRanges() { }
     TimeRanges(float start, float end);
-    
+    TimeRanges(const TimeRanges&);
+
+    // We consider all the Ranges to be semi-bounded as follow: [start, end[
     struct Range {
         Range() { }
         Range(float start, float end) {
@@ -64,6 +70,36 @@ private:
         }
         float m_start;
         float m_end;
+
+        inline bool isPointInRange(float point) const
+        {
+            return m_start <= point && point < m_end;
+        }
+        
+        inline bool isOverlappingRange(const Range& range) const
+        {
+            return isPointInRange(range.m_start) || isPointInRange(range.m_end) || range.isPointInRange(m_start);
+        }
+
+        inline bool isContiguousWithRange(const Range& range) const
+        {
+            return range.m_start == m_end || range.m_end == m_start;
+        }
+        
+        inline Range unionWithOverlappingOrContiguousRange(const Range& range) const
+        {
+            Range ret;
+
+            ret.m_start = std::min(m_start, range.m_start);
+            ret.m_end = std::max(m_end, range.m_end);
+
+            return ret;
+        }
+
+        inline bool isBeforeRange(const Range& range) const
+        {
+            return range.m_start >= m_end;
+        }
     };
     
     Vector<Range> m_ranges;
diff --git a/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.cpp b/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.cpp
new file mode 100644
index 0000000..b3c0218
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.cpp
@@ -0,0 +1,119 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ConsoleMessage.h"
+
+#include "InspectorFrontend.h"
+#include "InspectorJSONObject.h"
+#include "ScriptCallStack.h"
+#include "ScriptObjectQuarantine.h"
+
+namespace WebCore {
+
+ConsoleMessage::ConsoleMessage(MessageSource s, MessageLevel l, const String& m, unsigned li, const String& u, unsigned g)
+    : m_source(s)
+    , m_level(l)
+    , m_message(m)
+    , m_line(li)
+    , m_url(u)
+    , m_groupLevel(g)
+    , m_repeatCount(1)
+{
+}
+
+ConsoleMessage::ConsoleMessage(MessageSource s, MessageLevel l, ScriptCallStack* callStack, unsigned g, bool storeTrace)
+    : m_source(s)
+    , m_level(l)
+    , m_wrappedArguments(callStack->at(0).argumentCount())
+    , m_frames(storeTrace ? callStack->size() : 0)
+    , m_groupLevel(g)
+    , m_repeatCount(1)
+{
+    const ScriptCallFrame& lastCaller = callStack->at(0);
+    m_line = lastCaller.lineNumber();
+    m_url = lastCaller.sourceURL().string();
+
+    // FIXME: For now, just store function names as strings.
+    // As ScriptCallStack start storing line number and source URL for all
+    // frames, refactor to use that, as well.
+    if (storeTrace) {
+        for (unsigned i = 0; i < callStack->size(); ++i)
+            m_frames[i] = callStack->at(i).functionName();
+    }
+
+    for (unsigned i = 0; i < lastCaller.argumentCount(); ++i)
+        m_wrappedArguments[i] = quarantineValue(callStack->state(), lastCaller.argumentAt(i));
+}
+
+void ConsoleMessage::addToConsole(InspectorFrontend* frontend)
+{
+    InspectorJSONObject jsonObj = frontend->newInspectorJSONObject();
+    jsonObj.set("source", static_cast<int>(m_source));
+    jsonObj.set("level", static_cast<int>(m_level));
+    jsonObj.set("line", static_cast<int>(m_line));
+    jsonObj.set("url", m_url);
+    jsonObj.set("groupLevel", static_cast<int>(m_groupLevel));
+    jsonObj.set("repeatCount", static_cast<int>(m_repeatCount));
+    frontend->addMessageToConsole(jsonObj, m_frames, m_wrappedArguments,  m_message);
+}
+
+bool ConsoleMessage::isEqual(ScriptState* state, ConsoleMessage* msg) const
+{
+    if (msg->m_wrappedArguments.size() != m_wrappedArguments.size())
+        return false;
+    if (!state && msg->m_wrappedArguments.size())
+        return false;
+
+    ASSERT_ARG(state, state || msg->m_wrappedArguments.isEmpty());
+
+    for (size_t i = 0; i < msg->m_wrappedArguments.size(); ++i) {
+        if (!m_wrappedArguments[i].isEqual(state, msg->m_wrappedArguments[i]))
+            return false;
+    }
+
+    size_t frameCount = msg->m_frames.size();
+    if (frameCount != m_frames.size())
+        return false;
+
+    for (size_t i = 0; i < frameCount; ++i) {
+        if (m_frames[i] != msg->m_frames[i])
+            return false;
+    }
+
+    return msg->m_source == m_source
+        && msg->m_level == m_level
+        && msg->m_message == m_message
+        && msg->m_line == m_line
+        && msg->m_url == m_url
+        && msg->m_groupLevel == m_groupLevel;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.h b/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.h
new file mode 100644
index 0000000..15e6e7e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/ConsoleMessage.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ConsoleMessage_h
+#define ConsoleMessage_h
+
+#include "Console.h"
+#include "ScriptObject.h"
+#include "ScriptState.h"
+
+#include <wtf/Vector.h>
+
+namespace WebCore {
+    class InspectorFrontend;
+    class ScriptCallStack;
+    class ScriptString;
+
+    class ConsoleMessage {
+    public:
+        ConsoleMessage(MessageSource, MessageLevel, const String& m, unsigned li, const String& u, unsigned g);        
+        ConsoleMessage(MessageSource, MessageLevel, ScriptCallStack*, unsigned g, bool storeTrace = false);
+
+        void addToConsole(InspectorFrontend* frontend);
+        void incrementCount() { ++m_repeatCount; };
+        bool isEqual(ScriptState*, ConsoleMessage* msg) const;
+
+    private:
+        MessageSource m_source;
+        MessageLevel m_level;
+        String m_message;
+        Vector<ScriptValue> m_wrappedArguments;
+        Vector<ScriptString> m_frames;
+        unsigned m_line;
+        String m_url;
+        unsigned m_groupLevel;
+        unsigned m_repeatCount;
+    };
+
+} // namespace WebCore
+
+#endif // ConsoleMessage_h
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorClient.h b/src/3rdparty/webkit/WebCore/inspector/InspectorClient.h
index fcbf79d..2508536 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorClient.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorClient.h
@@ -44,6 +44,8 @@ public:
 
     virtual String localizedStringsURL() = 0;
 
+    virtual String hiddenPanels() = 0;
+
     virtual void showWindow() = 0;
     virtual void closeWindow() = 0;
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
index 9d42964..7e0cf31 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorController.cpp
@@ -33,478 +33,74 @@
 #include "CString.h"
 #include "CachedResource.h"
 #include "Console.h"
-#include "DOMWindow.h"
-#include "DocLoader.h"
+#include "ConsoleMessage.h"
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
 #include "FloatConversion.h"
+#include "FloatQuad.h"
 #include "FloatRect.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameTree.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
-#include "HitTestResult.h"
 #include "HTMLFrameOwnerElement.h"
+#include "HitTestResult.h"
 #include "InspectorClient.h"
-#include "JSDOMWindow.h"
-#include "JSInspectedObjectWrapper.h"
-#include "JSInspectorCallbackWrapper.h"
-#include "JSNode.h"
-#include "JSRange.h"
+#include "InspectorFrontend.h"
+#include "InspectorDatabaseResource.h"
+#include "InspectorDOMStorageResource.h"
+#include "InspectorResource.h"
 #include "JavaScriptProfile.h"
 #include "Page.h"
 #include "Range.h"
+#include "RenderInline.h"
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
-#include "Settings.h"
 #include "ScriptCallStack.h"
+#include "ScriptObject.h"
+#include "ScriptString.h"
+#include "SecurityOrigin.h"
+#include "Settings.h"
 #include "SharedBuffer.h"
-#include "SystemTime.h"
 #include "TextEncoding.h"
 #include "TextIterator.h"
-#include "ScriptController.h"
-#include <JavaScriptCore/APICast.h>
-#include <JavaScriptCore/JSRetainPtr.h>
-#include <JavaScriptCore/JSStringRef.h>
-#include <JavaScriptCore/OpaqueJSString.h>
-#include <runtime/JSLock.h>
-#include <runtime/UString.h>
-#include <runtime/CollectorHeapIterator.h>
-#include <profiler/Profile.h>
-#include <profiler/Profiler.h>
+#include <wtf/CurrentTime.h>
 #include <wtf/RefCounted.h>
 #include <wtf/StdLibExtras.h>
 
 #if ENABLE(DATABASE)
 #include "Database.h"
-#include "JSDatabase.h"
+#endif
+
+#if ENABLE(DOM_STORAGE)
+#include "Storage.h"
+#include "StorageArea.h"
 #endif
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 #include "JavaScriptCallFrame.h"
 #include "JavaScriptDebugServer.h"
 #include "JSJavaScriptCallFrame.h"
-#endif
+
+#include <profiler/Profile.h>
+#include <profiler/Profiler.h>
+#include <runtime/JSLock.h>
+#include <runtime/UString.h>
 
 using namespace JSC;
+#endif
 using namespace std;
 
 namespace WebCore {
 
 static const char* const UserInitiatedProfileName = "org.webkit.profiles.user-initiated";
+static const char* const resourceTrackingEnabledSettingName = "resourceTrackingEnabled";
+static const char* const debuggerEnabledSettingName = "debuggerEnabled";
+static const char* const profilerEnabledSettingName = "profilerEnabled";
 
-static JSRetainPtr<JSStringRef> jsStringRef(const char* str)
-{
-    return JSRetainPtr<JSStringRef>(Adopt, JSStringCreateWithUTF8CString(str));
-}
-
-static JSRetainPtr<JSStringRef> jsStringRef(const SourceCode& str)
-{
-    return JSRetainPtr<JSStringRef>(Adopt, JSStringCreateWithCharacters(str.data(), str.length()));
-}
-
-static JSRetainPtr<JSStringRef> jsStringRef(const String& str)
-{
-    return JSRetainPtr<JSStringRef>(Adopt, JSStringCreateWithCharacters(str.characters(), str.length()));
-}
-
-static JSRetainPtr<JSStringRef> jsStringRef(const UString& str)
-{
-    return JSRetainPtr<JSStringRef>(Adopt, OpaqueJSString::create(str).releaseRef());
-}
-
-static String toString(JSContextRef context, JSValueRef value, JSValueRef* exception)
-{
-    ASSERT_ARG(value, value);
-    if (!value)
-        return String();
-    JSRetainPtr<JSStringRef> scriptString(Adopt, JSValueToStringCopy(context, value, exception));
-    if (exception && *exception)
-        return String();
-    return String(JSStringGetCharactersPtr(scriptString.get()), JSStringGetLength(scriptString.get()));
-}
-
-#define HANDLE_EXCEPTION(context, exception) handleException((context), (exception), __LINE__)
-
-JSValueRef InspectorController::callSimpleFunction(JSContextRef context, JSObjectRef thisObject, const char* functionName) const
-{
-    JSValueRef exception = 0;
-    return callFunction(context, thisObject, functionName, 0, 0, exception);
-}
-
-JSValueRef InspectorController::callFunction(JSContextRef context, JSObjectRef thisObject, const char* functionName, size_t argumentCount, const JSValueRef arguments[], JSValueRef& exception) const
-{
-    ASSERT_ARG(context, context);
-    ASSERT_ARG(thisObject, thisObject);
-
-    if (exception)
-        return JSValueMakeUndefined(context);
-
-    JSValueRef functionProperty = JSObjectGetProperty(context, thisObject, jsStringRef(functionName).get(), &exception);
-    if (HANDLE_EXCEPTION(context, exception))
-        return JSValueMakeUndefined(context);
-
-    JSObjectRef function = JSValueToObject(context, functionProperty, &exception);
-    if (HANDLE_EXCEPTION(context, exception))
-        return JSValueMakeUndefined(context);
-
-    JSValueRef result = JSObjectCallAsFunction(context, function, thisObject, argumentCount, arguments, &exception);
-    if (HANDLE_EXCEPTION(context, exception))
-        return JSValueMakeUndefined(context);
-
-    return result;
-}
-
-// ConsoleMessage Struct
-
-struct ConsoleMessage {
-    ConsoleMessage(MessageSource s, MessageLevel l, const String& m, unsigned li, const String& u, unsigned g)
-        : source(s)
-        , level(l)
-        , message(m)
-        , line(li)
-        , url(u)
-        , groupLevel(g)
-        , repeatCount(1)
-    {
-    }
-
-    ConsoleMessage(MessageSource s, MessageLevel l, ScriptCallStack* callStack, unsigned g, bool storeTrace = false)
-        : source(s)
-        , level(l)
-        , wrappedArguments(callStack->at(0).argumentCount())
-        , frames(storeTrace ? callStack->size() : 0)
-        , groupLevel(g)
-        , repeatCount(1)
-    {
-        const ScriptCallFrame& lastCaller = callStack->at(0);
-        line = lastCaller.lineNumber();
-        url = lastCaller.sourceURL().string();
-
-        // FIXME: For now, just store function names as strings.
-        // As ScriptCallStack start storing line number and source URL for all
-        // frames, refactor to use that, as well.
-        if (storeTrace) {
-            unsigned stackSize = callStack->size();
-            for (unsigned i = 0; i < stackSize; ++i)
-                frames[i] = callStack->at(i).functionName();
-        }
-
-        JSLock lock(false);
-
-        for (unsigned i = 0; i < lastCaller.argumentCount(); ++i)
-            wrappedArguments[i] = JSInspectedObjectWrapper::wrap(callStack->state(), lastCaller.argumentAt(i).jsValue());
-    }
-    
-    bool isEqual(ExecState* exec, ConsoleMessage* msg) const
-    {
-        if (msg->wrappedArguments.size() != this->wrappedArguments.size() ||
-           (!exec && msg->wrappedArguments.size()))
-            return false;
-
-        for (size_t i = 0; i < msg->wrappedArguments.size(); ++i) {
-            ASSERT_ARG(exec, exec);
-            if (!JSValueIsEqual(toRef(exec), toRef(msg->wrappedArguments[i].get()), toRef(this->wrappedArguments[i].get()), 0))
-                return false;
-        }
-
-        size_t frameCount = msg->frames.size();
-        if (frameCount != this->frames.size())
-            return false;
-        
-        for (size_t i = 0; i < frameCount; ++i) {
-            const ScriptString& myFrameFunctionName = this->frames[i];
-            if (myFrameFunctionName != msg->frames[i])
-                return false;
-        }
-    
-        return msg->source == this->source
-            && msg->level == this->level
-            && msg->message == this->message
-            && msg->line == this->line
-            && msg->url == this->url
-            && msg->groupLevel == this->groupLevel;
-    }
-
-    MessageSource source;
-    MessageLevel level;
-    String message;
-    Vector<ProtectedJSValuePtr> wrappedArguments;
-    Vector<ScriptString> frames;
-    unsigned line;
-    String url;
-    unsigned groupLevel;
-    unsigned repeatCount;
-};
-
-// XMLHttpRequestResource Class
-
-struct XMLHttpRequestResource {
-    XMLHttpRequestResource(const JSC::UString& sourceString)
-    {
-        JSC::JSLock lock(false);
-        this->sourceString = sourceString.rep();
-    }
-
-    ~XMLHttpRequestResource()
-    {
-        JSC::JSLock lock(false);
-        sourceString.clear();
-    }
-
-    RefPtr<JSC::UString::Rep> sourceString;
-};
-
-// InspectorResource Struct
-
-struct InspectorResource : public RefCounted<InspectorResource> {
-    // Keep these in sync with WebInspector.Resource.Type
-    enum Type {
-        Doc,
-        Stylesheet,
-        Image,
-        Font,
-        Script,
-        XHR,
-        Media,
-        Other
-    };
-
-    static PassRefPtr<InspectorResource> create(long long identifier, DocumentLoader* documentLoader, Frame* frame)
-    {
-        return adoptRef(new InspectorResource(identifier, documentLoader, frame));
-    }
-    
-    ~InspectorResource()
-    {
-        setScriptObject(0, 0);
-    }
-
-    Type type() const
-    {
-        if (xmlHttpRequestResource)
-            return XHR;
-
-        if (requestURL == loader->requestURL())
-            return Doc;
-
-        if (loader->frameLoader() && requestURL == loader->frameLoader()->iconURL())
-            return Image;
-
-        CachedResource* cachedResource = frame->document()->docLoader()->cachedResource(requestURL.string());
-        if (!cachedResource)
-            return Other;
-
-        switch (cachedResource->type()) {
-            case CachedResource::ImageResource:
-                return Image;
-            case CachedResource::FontResource:
-                return Font;
-            case CachedResource::CSSStyleSheet:
-#if ENABLE(XSLT)
-            case CachedResource::XSLStyleSheet:
-#endif
-                return Stylesheet;
-            case CachedResource::Script:
-                return Script;
-            default:
-                return Other;
-        }
-    }
-
-    void setScriptObject(JSContextRef context, JSObjectRef newScriptObject)
-    {
-        if (scriptContext && scriptObject)
-            JSValueUnprotect(scriptContext, scriptObject);
-
-        scriptObject = newScriptObject;
-        scriptContext = context;
-
-        ASSERT((context && newScriptObject) || (!context && !newScriptObject));
-        if (context && newScriptObject)
-            JSValueProtect(context, newScriptObject);
-    }
-
-    void setXMLHttpRequestProperties(const JSC::UString& data)
-    {
-        xmlHttpRequestResource.set(new XMLHttpRequestResource(data));
-    }
-    
-    String sourceString() const
-     {
-         if (xmlHttpRequestResource)
-            return JSC::UString(xmlHttpRequestResource->sourceString);
-
-        RefPtr<SharedBuffer> buffer;
-        String textEncodingName;
-
-        if (requestURL == loader->requestURL()) {
-            buffer = loader->mainResourceData();
-            textEncodingName = frame->document()->inputEncoding();
-        } else {
-            CachedResource* cachedResource = frame->document()->docLoader()->cachedResource(requestURL.string());
-            if (!cachedResource)
-                return String();
-
-            if (cachedResource->isPurgeable()) {
-                // If the resource is purgeable then make it unpurgeable to get
-                // get its data. This might fail, in which case we return an
-                // empty String.
-                // FIXME: should we do something else in the case of a purged
-                // resource that informs the user why there is no data in the
-                // inspector?
-                if (!cachedResource->makePurgeable(false))
-                    return String();
-            }
-
-            buffer = cachedResource->data();
-            textEncodingName = cachedResource->encoding();
-        }
-
-        if (!buffer)
-            return String();
-
-        TextEncoding encoding(textEncodingName);
-        if (!encoding.isValid())
-            encoding = WindowsLatin1Encoding();
-        return encoding.decode(buffer->data(), buffer->size());
-     }
-
-    long long identifier;
-    RefPtr<DocumentLoader> loader;
-    RefPtr<Frame> frame;
-    OwnPtr<XMLHttpRequestResource> xmlHttpRequestResource;
-    KURL requestURL;
-    HTTPHeaderMap requestHeaderFields;
-    HTTPHeaderMap responseHeaderFields;
-    String mimeType;
-    String suggestedFilename;
-    JSContextRef scriptContext;
-    JSObjectRef scriptObject;
-    long long expectedContentLength;
-    bool cached;
-    bool finished;
-    bool failed;
-    int length;
-    int responseStatusCode;
-    double startTime;
-    double responseReceivedTime;
-    double endTime;
-
-protected:
-    InspectorResource(long long identifier, DocumentLoader* documentLoader, Frame* frame)
-        : identifier(identifier)
-        , loader(documentLoader)
-        , frame(frame)
-        , xmlHttpRequestResource(0)
-        , scriptContext(0)
-        , scriptObject(0)
-        , expectedContentLength(0)
-        , cached(false)
-        , finished(false)
-        , failed(false)
-        , length(0)
-        , responseStatusCode(0)
-        , startTime(-1.0)
-        , responseReceivedTime(-1.0)
-        , endTime(-1.0)
-    {
-    }
-};
-
-// InspectorDatabaseResource Struct
-
-#if ENABLE(DATABASE)
-struct InspectorDatabaseResource : public RefCounted<InspectorDatabaseResource> {
-    static PassRefPtr<InspectorDatabaseResource> create(Database* database, const String& domain, const String& name, const String& version)
-    {
-        return adoptRef(new InspectorDatabaseResource(database, domain, name, version));
-    }
-
-    void setScriptObject(JSContextRef context, JSObjectRef newScriptObject)
-    {
-        if (scriptContext && scriptObject)
-            JSValueUnprotect(scriptContext, scriptObject);
-
-        scriptObject = newScriptObject;
-        scriptContext = context;
-
-        ASSERT((context && newScriptObject) || (!context && !newScriptObject));
-        if (context && newScriptObject)
-            JSValueProtect(context, newScriptObject);
-    }
-
-    RefPtr<Database> database;
-    String domain;
-    String name;
-    String version;
-    JSContextRef scriptContext;
-    JSObjectRef scriptObject;
-    
-private:
-    InspectorDatabaseResource(Database* database, const String& domain, const String& name, const String& version)
-        : database(database)
-        , domain(domain)
-        , name(name)
-        , version(version)
-        , scriptContext(0)
-        , scriptObject(0)
-    {
-    }
-};
-#endif
-
-// JavaScript Callbacks
-
-#define SIMPLE_INSPECTOR_CALLBACK(jsFunction, inspectorControllerMethod) \
-static JSValueRef jsFunction(JSContextRef ctx, JSObjectRef, JSObjectRef thisObject, size_t, const JSValueRef[], JSValueRef*) \
-{ \
-    if (InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject))) \
-        controller->inspectorControllerMethod(); \
-    return JSValueMakeUndefined(ctx); \
-}
-
-SIMPLE_INSPECTOR_CALLBACK(hideDOMNodeHighlight, hideHighlight);
-SIMPLE_INSPECTOR_CALLBACK(loaded, scriptObjectReady);
-SIMPLE_INSPECTOR_CALLBACK(unloading, close);
-SIMPLE_INSPECTOR_CALLBACK(attach, attachWindow);
-SIMPLE_INSPECTOR_CALLBACK(detach, detachWindow);
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-SIMPLE_INSPECTOR_CALLBACK(enableDebugger, enableDebugger);
-SIMPLE_INSPECTOR_CALLBACK(disableDebugger, disableDebugger);
-SIMPLE_INSPECTOR_CALLBACK(pauseInDebugger, pauseInDebugger);
-SIMPLE_INSPECTOR_CALLBACK(resumeDebugger, resumeDebugger);
-SIMPLE_INSPECTOR_CALLBACK(stepOverStatementInDebugger, stepOverStatementInDebugger);
-SIMPLE_INSPECTOR_CALLBACK(stepIntoStatementInDebugger, stepIntoStatementInDebugger);
-SIMPLE_INSPECTOR_CALLBACK(stepOutOfFunctionInDebugger, stepOutOfFunctionInDebugger);
-#endif
-SIMPLE_INSPECTOR_CALLBACK(closeWindow, closeWindow);
-SIMPLE_INSPECTOR_CALLBACK(clearMessages, clearConsoleMessages);
-SIMPLE_INSPECTOR_CALLBACK(startProfiling, startUserInitiatedProfilingSoon);
-SIMPLE_INSPECTOR_CALLBACK(stopProfiling, stopUserInitiatedProfiling);
-SIMPLE_INSPECTOR_CALLBACK(enableProfiler, enableProfiler);
-SIMPLE_INSPECTOR_CALLBACK(disableProfiler, disableProfiler);
-SIMPLE_INSPECTOR_CALLBACK(toggleNodeSearch, toggleSearchForNodeInPage);
-
-#define BOOL_INSPECTOR_CALLBACK(jsFunction, inspectorControllerMethod) \
-static JSValueRef jsFunction(JSContextRef ctx, JSObjectRef, JSObjectRef thisObject, size_t, const JSValueRef[], JSValueRef*) \
-{ \
-    if (InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject))) \
-        return JSValueMakeBoolean(ctx, controller->inspectorControllerMethod()); \
-    return JSValueMakeUndefined(ctx); \
-}
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-BOOL_INSPECTOR_CALLBACK(debuggerEnabled, debuggerEnabled);
-BOOL_INSPECTOR_CALLBACK(pauseOnExceptions, pauseOnExceptions);
-#endif
-BOOL_INSPECTOR_CALLBACK(profilerEnabled, profilerEnabled);
-BOOL_INSPECTOR_CALLBACK(isWindowVisible, windowVisible);
-BOOL_INSPECTOR_CALLBACK(searchingForNode, searchingForNodeInPage);
-
-static bool addSourceToFrame(const String& mimeType, const String& source, Node* frameNode)
+bool InspectorController::addSourceToFrame(const String& mimeType, const String& source, Node* frameNode)
 {
     ASSERT_ARG(frameNode, frameNode);
 
@@ -540,362 +136,7 @@ static bool addSourceToFrame(const String& mimeType, const String& source, Node*
     return true;
 }
 
-static JSValueRef addResourceSourceToFrame(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
-{
-    JSValueRef undefined = JSValueMakeUndefined(ctx);
-
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (argumentCount < 2 || !controller)
-        return undefined;
-
-    JSValueRef identifierValue = arguments[0];
-    if (!JSValueIsNumber(ctx, identifierValue))
-        return undefined;
-
-    long long identifier = static_cast<long long>(JSValueToNumber(ctx, identifierValue, exception));
-    if (exception && *exception)
-        return undefined;
-
-    RefPtr<InspectorResource> resource = controller->resources().get(identifier);
-    ASSERT(resource);
-    if (!resource)
-        return undefined;
-
-    String sourceString = resource->sourceString();
-    if (sourceString.isEmpty())
-        return undefined;
-
-    bool successfullyAddedSource = addSourceToFrame(resource->mimeType, sourceString, toNode(toJS(arguments[1])));
-    return JSValueMakeBoolean(ctx, successfullyAddedSource);
-}
-
-static JSValueRef addSourceToFrame(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
-{
-    JSValueRef undefined = JSValueMakeUndefined(ctx);
-
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (argumentCount < 3 || !controller)
-        return undefined;
-
-    JSValueRef mimeTypeValue = arguments[0];
-    if (!JSValueIsString(ctx, mimeTypeValue))
-        return undefined;
-
-    JSValueRef sourceValue = arguments[1];
-    if (!JSValueIsString(ctx, sourceValue))
-        return undefined;
-
-    String mimeType = toString(ctx, mimeTypeValue, exception);
-    if (mimeType.isEmpty())
-        return undefined;
-
-    String source = toString(ctx, sourceValue, exception);
-    if (source.isEmpty())
-        return undefined;
-
-    bool successfullyAddedSource = addSourceToFrame(mimeType, source, toNode(toJS(arguments[2])));
-    return JSValueMakeBoolean(ctx, successfullyAddedSource);
-}
-
-static JSValueRef getResourceDocumentNode(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
-{
-    JSValueRef undefined = JSValueMakeUndefined(ctx);
-
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!argumentCount || argumentCount > 1 || !controller)
-        return undefined;
-
-    JSValueRef identifierValue = arguments[0];
-    if (!JSValueIsNumber(ctx, identifierValue))
-        return undefined;
-
-    long long identifier = static_cast<long long>(JSValueToNumber(ctx, identifierValue, exception));
-    if (exception && *exception)
-        return undefined;
-
-    RefPtr<InspectorResource> resource = controller->resources().get(identifier);
-    ASSERT(resource);
-    if (!resource)
-        return undefined;
-
-    Frame* frame = resource->frame.get();
-
-    Document* document = frame->document();
-    if (!document)
-        return undefined;
-
-    if (document->isPluginDocument() || document->isImageDocument() || document->isMediaDocument())
-        return undefined;
-
-    ExecState* exec = toJSDOMWindowShell(resource->frame.get())->window()->globalExec();
-
-    JSC::JSLock lock(false);
-    JSValueRef documentValue = toRef(JSInspectedObjectWrapper::wrap(exec, toJS(exec, document)));
-    return documentValue;
-}
-
-static JSValueRef highlightDOMNode(JSContextRef context, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* /*exception*/)
-{
-    JSValueRef undefined = JSValueMakeUndefined(context);
-
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (argumentCount < 1 || !controller)
-        return undefined;
-
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(toJS(arguments[0]));
-    if (!wrapper)
-        return undefined;
-    Node* node = toNode(wrapper->unwrappedObject());
-    if (!node)
-        return undefined;
-
-    controller->highlight(node);
-
-    return undefined;
-}
-
-static JSValueRef search(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    if (argumentCount < 2 || !JSValueIsString(ctx, arguments[1]))
-        return JSValueMakeUndefined(ctx);
-
-    Node* node = toNode(toJS(arguments[0]));
-    if (!node)
-        return JSValueMakeUndefined(ctx);
-
-    String target = toString(ctx, arguments[1], exception);
-
-    JSObjectRef global = JSContextGetGlobalObject(ctx);
-
-    JSValueRef arrayProperty = JSObjectGetProperty(ctx, global, jsStringRef("Array").get(), exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSObjectRef arrayConstructor = JSValueToObject(ctx, arrayProperty, exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSObjectRef result = JSObjectCallAsConstructor(ctx, arrayConstructor, 0, 0, exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSValueRef pushProperty = JSObjectGetProperty(ctx, result, jsStringRef("push").get(), exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSObjectRef pushFunction = JSValueToObject(ctx, pushProperty, exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    RefPtr<Range> searchRange(rangeOfContents(node));
-
-    ExceptionCode ec = 0;
-    do {
-        RefPtr<Range> resultRange(findPlainText(searchRange.get(), target, true, false));
-        if (resultRange->collapsed(ec))
-            break;
-
-        // A non-collapsed result range can in some funky whitespace cases still not
-        // advance the range's start position (4509328). Break to avoid infinite loop.
-        VisiblePosition newStart = endVisiblePosition(resultRange.get(), DOWNSTREAM);
-        if (newStart == startVisiblePosition(searchRange.get(), DOWNSTREAM))
-            break;
-
-        JSC::JSLock lock(false);
-        JSValueRef arg0 = toRef(toJS(toJS(ctx), resultRange.get()));
-        JSObjectCallAsFunction(ctx, pushFunction, result, 1, &arg0, exception);
-        if (exception && *exception)
-            return JSValueMakeUndefined(ctx);
-
-        setStart(searchRange.get(), newStart);
-    } while (true);
-
-    return result;
-}
-
-#if ENABLE(DATABASE)
-static JSValueRef databaseTableNames(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    if (argumentCount < 1)
-        return JSValueMakeUndefined(ctx);
-
-    JSQuarantinedObjectWrapper* wrapper = JSQuarantinedObjectWrapper::asWrapper(toJS(arguments[0]));
-    if (!wrapper)
-        return JSValueMakeUndefined(ctx);
-
-    Database* database = toDatabase(wrapper->unwrappedObject());
-    if (!database)
-        return JSValueMakeUndefined(ctx);
-
-    JSObjectRef global = JSContextGetGlobalObject(ctx);
-
-    JSValueRef arrayProperty = JSObjectGetProperty(ctx, global, jsStringRef("Array").get(), exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSObjectRef arrayConstructor = JSValueToObject(ctx, arrayProperty, exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSObjectRef result = JSObjectCallAsConstructor(ctx, arrayConstructor, 0, 0, exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSValueRef pushProperty = JSObjectGetProperty(ctx, result, jsStringRef("push").get(), exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSObjectRef pushFunction = JSValueToObject(ctx, pushProperty, exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    Vector<String> tableNames = database->tableNames();
-    unsigned length = tableNames.size();
-    for (unsigned i = 0; i < length; ++i) {
-        String tableName = tableNames[i];
-        JSValueRef tableNameValue = JSValueMakeString(ctx, jsStringRef(tableName).get());
-
-        JSValueRef pushArguments[] = { tableNameValue };
-        JSObjectCallAsFunction(ctx, pushFunction, result, 1, pushArguments, exception);
-        if (exception && *exception)
-            return JSValueMakeUndefined(ctx);
-    }
-
-    return result;
-}
-#endif
-
-static JSValueRef inspectedWindow(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments[]*/, JSValueRef* /*exception*/)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    JSDOMWindow* inspectedWindow = toJSDOMWindow(controller->inspectedPage()->mainFrame());
-    JSLock lock(false);
-    return toRef(JSInspectedObjectWrapper::wrap(inspectedWindow->globalExec(), inspectedWindow));
-}
-
-static JSValueRef setting(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef arguments[], JSValueRef* exception)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    JSValueRef keyValue = arguments[0];
-    if (!JSValueIsString(ctx, keyValue))
-        return JSValueMakeUndefined(ctx);
-
-    const InspectorController::Setting& setting = controller->setting(toString(ctx, keyValue, exception));
-
-    switch (setting.type()) {
-        default:
-        case InspectorController::Setting::NoType:
-            return JSValueMakeUndefined(ctx);
-        case InspectorController::Setting::StringType:
-            return JSValueMakeString(ctx, jsStringRef(setting.string()).get());
-        case InspectorController::Setting::DoubleType:
-            return JSValueMakeNumber(ctx, setting.doubleValue());
-        case InspectorController::Setting::IntegerType:
-            return JSValueMakeNumber(ctx, setting.integerValue());
-        case InspectorController::Setting::BooleanType:
-            return JSValueMakeBoolean(ctx, setting.booleanValue());
-        case InspectorController::Setting::StringVectorType: {
-            Vector<JSValueRef> stringValues;
-            const Vector<String>& strings = setting.stringVector();
-            const unsigned length = strings.size();
-            for (unsigned i = 0; i < length; ++i)
-                stringValues.append(JSValueMakeString(ctx, jsStringRef(strings[i]).get()));
-
-            JSObjectRef stringsArray = JSObjectMakeArray(ctx, stringValues.size(), stringValues.data(), exception);
-            if (exception && *exception)
-                return JSValueMakeUndefined(ctx);
-            return stringsArray;
-        }
-    }
-}
-
-static JSValueRef setSetting(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef arguments[], JSValueRef* exception)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    JSValueRef keyValue = arguments[0];
-    if (!JSValueIsString(ctx, keyValue))
-        return JSValueMakeUndefined(ctx);
-
-    InspectorController::Setting setting;
-
-    JSValueRef value = arguments[1];
-    switch (JSValueGetType(ctx, value)) {
-        default:
-        case kJSTypeUndefined:
-        case kJSTypeNull:
-            // Do nothing. The setting is already NoType.
-            ASSERT(setting.type() == InspectorController::Setting::NoType);
-            break;
-        case kJSTypeString:
-            setting.set(toString(ctx, value, exception));
-            break;
-        case kJSTypeNumber:
-            setting.set(JSValueToNumber(ctx, value, exception));
-            break;
-        case kJSTypeBoolean:
-            setting.set(JSValueToBoolean(ctx, value));
-            break;
-        case kJSTypeObject: {
-            JSObjectRef object = JSValueToObject(ctx, value, 0);
-            JSValueRef lengthValue = JSObjectGetProperty(ctx, object, jsStringRef("length").get(), exception);
-            if (exception && *exception)
-                return JSValueMakeUndefined(ctx);
-
-            Vector<String> strings;
-            const unsigned length = static_cast<unsigned>(JSValueToNumber(ctx, lengthValue, 0));
-            for (unsigned i = 0; i < length; ++i) {
-                JSValueRef itemValue = JSObjectGetPropertyAtIndex(ctx, object, i, exception);
-                if (exception && *exception)
-                    return JSValueMakeUndefined(ctx);
-                strings.append(toString(ctx, itemValue, exception));
-                if (exception && *exception)
-                    return JSValueMakeUndefined(ctx);
-            }
-
-            setting.set(strings);
-            break;
-        }
-    }
-
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    controller->setSetting(toString(ctx, keyValue, exception), setting);
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef localizedStrings(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments[]*/, JSValueRef* /*exception*/)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    String url = controller->localizedStringsURL();
-    if (url.isNull())
-        return JSValueMakeNull(ctx);
-
-    return JSValueMakeString(ctx, jsStringRef(url).get());
-}
-
-static JSValueRef platform(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef /*thisObject*/, size_t /*argumentCount*/, const JSValueRef[] /*arguments[]*/, JSValueRef* /*exception*/)
+const String& InspectorController::platform() const
 {
 #if PLATFORM(MAC)
 #ifdef BUILDING_ON_TIGER
@@ -915,184 +156,9 @@ static JSValueRef platform(JSContextRef ctx, JSObjectRef /*function*/, JSObjectR
     DEFINE_STATIC_LOCAL(const String, platform, ("unknown"));
 #endif
 
-    JSValueRef platformValue = JSValueMakeString(ctx, jsStringRef(platform).get());
-
-    return platformValue;
-}
-
-static JSValueRef moveByUnrestricted(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    if (argumentCount < 2)
-        return JSValueMakeUndefined(ctx);
-
-    double x = JSValueToNumber(ctx, arguments[0], exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    double y = JSValueToNumber(ctx, arguments[1], exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    controller->moveWindowBy(narrowPrecisionToFloat(x), narrowPrecisionToFloat(y));
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef setAttachedWindowHeight(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    if (argumentCount < 1)
-        return JSValueMakeUndefined(ctx);
-
-    unsigned height = static_cast<unsigned>(JSValueToNumber(ctx, arguments[0], exception));
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    controller->setAttachedWindowHeight(height);
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef wrapCallback(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* /*exception*/)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    if (argumentCount < 1)
-        return JSValueMakeUndefined(ctx);
-
-    JSLock lock(false);
-    return toRef(JSInspectorCallbackWrapper::wrap(toJS(ctx), toJS(arguments[0])));
-}
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-static JSValueRef currentCallFrame(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    JavaScriptCallFrame* callFrame = controller->currentCallFrame();
-    if (!callFrame || !callFrame->isValid())
-        return JSValueMakeNull(ctx);
-
-    ExecState* globalExec = callFrame->scopeChain()->globalObject()->globalExec();
-
-    JSLock lock(false);
-    return toRef(JSInspectedObjectWrapper::wrap(globalExec, toJS(toJS(ctx), callFrame)));
-}
-
-static JSValueRef setPauseOnExceptions(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* /*exception*/)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    if (argumentCount < 1)
-        return JSValueMakeUndefined(ctx);
-
-    controller->setPauseOnExceptions(JSValueToBoolean(ctx, arguments[0]));
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef addBreakpoint(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    if (argumentCount < 2)
-        return JSValueMakeUndefined(ctx);
-
-    double sourceID = JSValueToNumber(ctx, arguments[0], exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    double lineNumber = JSValueToNumber(ctx, arguments[1], exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    controller->addBreakpoint(static_cast<int>(sourceID), static_cast<unsigned>(lineNumber));
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef removeBreakpoint(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    if (argumentCount < 2)
-        return JSValueMakeUndefined(ctx);
-
-    double sourceID = JSValueToNumber(ctx, arguments[0], exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    double lineNumber = JSValueToNumber(ctx, arguments[1], exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    controller->removeBreakpoint(static_cast<int>(sourceID), static_cast<unsigned>(lineNumber));
-
-    return JSValueMakeUndefined(ctx);
-}
-#endif
-
-static JSValueRef profiles(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* exception)
-{
-    InspectorController* controller = reinterpret_cast<InspectorController*>(JSObjectGetPrivate(thisObject));
-    if (!controller)
-        return JSValueMakeUndefined(ctx);
-
-    JSLock lock(false);
-
-    const Vector<RefPtr<Profile> >& profiles = controller->profiles();
-
-    JSObjectRef global = JSContextGetGlobalObject(ctx);
-
-    JSValueRef arrayProperty = JSObjectGetProperty(ctx, global, jsStringRef("Array").get(), exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSObjectRef arrayConstructor = JSValueToObject(ctx, arrayProperty, exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSObjectRef result = JSObjectCallAsConstructor(ctx, arrayConstructor, 0, 0, exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSValueRef pushProperty = JSObjectGetProperty(ctx, result, jsStringRef("push").get(), exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    JSObjectRef pushFunction = JSValueToObject(ctx, pushProperty, exception);
-    if (exception && *exception)
-        return JSValueMakeUndefined(ctx);
-
-    for (size_t i = 0; i < profiles.size(); ++i) {
-        JSValueRef arg0 = toRef(toJS(toJS(ctx), profiles[i].get()));
-        JSObjectCallAsFunction(ctx, pushFunction, result, 1, &arg0, exception);
-        if (exception && *exception)
-            return JSValueMakeUndefined(ctx);
-    }
-
-    return result;
+    return platform;
 }
 
-// InspectorController Class
-
 static unsigned s_inspectorControllerCount;
 static HashMap<String, InspectorController::Setting*>* s_settingCache;
 
@@ -1100,24 +166,24 @@ InspectorController::InspectorController(Page* page, InspectorClient* client)
     : m_inspectedPage(page)
     , m_client(client)
     , m_page(0)
-    , m_scriptObject(0)
-    , m_controllerScriptObject(0)
-    , m_scriptContext(0)
+    , m_scriptState(0)
     , m_windowVisible(false)
+    , m_showAfterVisible(ElementsPanel)
+    , m_nextIdentifier(-2)
+    , m_groupLevel(0)
+    , m_searchingForNode(false)
+    , m_previousMessage(0)
+    , m_resourceTrackingEnabled(false)
+    , m_resourceTrackingSettingsLoaded(false)
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     , m_debuggerEnabled(false)
     , m_attachDebuggerWhenShown(false)
-#endif
     , m_profilerEnabled(false)
     , m_recordingUserInitiatedProfile(false)
-    , m_showAfterVisible(ElementsPanel)
-    , m_nextIdentifier(-2)
-    , m_groupLevel(0)
-    , m_searchingForNode(false)
     , m_currentUserInitiatedProfileNumber(-1)
     , m_nextUserInitiatedProfileNumber(1)
-    , m_previousMessage(0)
     , m_startProfiling(this, &InspectorController::startUserInitiatedProfiling)
+#endif
 {
     ASSERT_ARG(page, page);
     ASSERT_ARG(client, client);
@@ -1126,26 +192,11 @@ InspectorController::InspectorController(Page* page, InspectorClient* client)
 
 InspectorController::~InspectorController()
 {
-    m_client->inspectorDestroyed();
-
-    if (m_scriptContext) {
-        JSValueRef exception = 0;
-
-        JSObjectRef global = JSContextGetGlobalObject(m_scriptContext);
-        JSValueRef controllerProperty = JSObjectGetProperty(m_scriptContext, global, jsStringRef("InspectorController").get(), &exception);
-        if (!HANDLE_EXCEPTION(m_scriptContext, exception)) {
-            if (JSObjectRef controller = JSValueToObject(m_scriptContext, controllerProperty, &exception)) {
-                if (!HANDLE_EXCEPTION(m_scriptContext, exception))
-                    JSObjectSetPrivate(controller, 0);
-            }
-        }
-    }
-
-    if (m_page)
-        m_page->setParentInspectorController(0);
-
-    // m_inspectedPage should have been cleared in inspectedPageDestroyed().
+    // These should have been cleared in inspectedPageDestroyed().
+    ASSERT(!m_client);
+    ASSERT(!m_scriptState);
     ASSERT(!m_inspectedPage);
+    ASSERT(!m_page || (m_page && !m_page->parentInspectorController()));
 
     deleteAllValues(m_frameResources);
     deleteAllValues(m_consoleMessages);
@@ -1164,8 +215,19 @@ void InspectorController::inspectedPageDestroyed()
 {
     close();
 
+    if (m_scriptState)
+        ScriptGlobalObject::remove(m_scriptState, "InspectorController");
+
+    if (m_page) {
+        m_page->setParentInspectorController(0);
+        m_page = 0;
+    }
+
     ASSERT(m_inspectedPage);
     m_inspectedPage = 0;
+
+    m_client->inspectorDestroyed();
+    m_client = 0;
 }
 
 bool InspectorController::enabled() const
@@ -1224,6 +286,13 @@ String InspectorController::localizedStringsURL()
     return m_client->localizedStringsURL();
 }
 
+String InspectorController::hiddenPanels()
+{
+    if (!enabled())
+        return String();
+    return m_client->hiddenPanels();
+}
+
 // Trying to inspect something in a frame with JavaScript disabled would later lead to
 // crashes trying to create JavaScript wrappers. Some day we could fix this issue, but
 // for now prevent crashes here by never targeting a node in such a frame.
@@ -1246,7 +315,7 @@ void InspectorController::inspect(Node* node)
         node = node->parentNode();
     m_nodeToFocus = node;
 
-    if (!m_scriptObject) {
+    if (!m_frontend) {
         m_showAfterVisible = ElementsPanel;
         return;
     }
@@ -1260,27 +329,11 @@ void InspectorController::focusNode()
     if (!enabled())
         return;
 
-    ASSERT(m_scriptContext);
-    ASSERT(m_scriptObject);
+    ASSERT(m_frontend);
     ASSERT(m_nodeToFocus);
 
-    Frame* frame = m_nodeToFocus->document()->frame();
-    if (!frame)
-        return;
-
-    ExecState* exec = toJSDOMWindow(frame)->globalExec();
-
-    JSValueRef arg0;
-
-    {
-        JSC::JSLock lock(false);
-        arg0 = toRef(JSInspectedObjectWrapper::wrap(exec, toJS(exec, m_nodeToFocus.get())));
-    }
-
+    m_frontend->updateFocusedNode(m_nodeToFocus.get());
     m_nodeToFocus = 0;
-
-    JSValueRef exception = 0;
-    callFunction(m_scriptContext, m_scriptObject, "updateFocusedNode", 1, &arg0, exception);
 }
 
 void InspectorController::highlight(Node* node)
@@ -1296,6 +349,7 @@ void InspectorController::hideHighlight()
 {
     if (!enabled())
         return;
+    m_highlightedNode = 0;
     m_client->hideHighlight();
 }
 
@@ -1311,7 +365,7 @@ void InspectorController::setWindowVisible(bool visible, bool attached)
 
     m_windowVisible = visible;
 
-    if (!m_scriptContext || !m_scriptObject)
+    if (!m_frontend)
         return;
 
     if (m_windowVisible) {
@@ -1327,7 +381,13 @@ void InspectorController::setWindowVisible(bool visible, bool attached)
             showPanel(m_showAfterVisible);
     } else {
 #if ENABLE(JAVASCRIPT_DEBUGGER)
+        // If the window is being closed with the debugger enabled,
+        // remember this state to re-enable debugger on the next window
+        // opening.
+        bool debuggerWasEnabled = m_debuggerEnabled;
         disableDebugger();
+        if (debuggerWasEnabled)
+            m_attachDebuggerWhenShown = true;
 #endif
         resetScriptObjects();
     }
@@ -1351,13 +411,13 @@ void InspectorController::addMessageToConsole(MessageSource source, MessageLevel
     addConsoleMessage(0, new ConsoleMessage(source, level, message, lineNumber, sourceID, m_groupLevel));
 }
 
-void InspectorController::addConsoleMessage(ExecState* exec, ConsoleMessage* consoleMessage)
+void InspectorController::addConsoleMessage(ScriptState* scriptState, ConsoleMessage* consoleMessage)
 {
     ASSERT(enabled());
     ASSERT_ARG(consoleMessage, consoleMessage);
 
-    if (m_previousMessage && m_previousMessage->isEqual(exec, consoleMessage)) {
-        ++m_previousMessage->repeatCount;
+    if (m_previousMessage && m_previousMessage->isEqual(scriptState, consoleMessage)) {
+        m_previousMessage->incrementCount();
         delete consoleMessage;
     } else {
         m_previousMessage = consoleMessage;
@@ -1365,7 +425,7 @@ void InspectorController::addConsoleMessage(ExecState* exec, ConsoleMessage* con
     }
 
     if (windowVisible())
-        addScriptConsoleMessage(m_previousMessage);
+        m_previousMessage->addToConsole(m_frontend.get());
 }
 
 void InspectorController::clearConsoleMessages()
@@ -1376,18 +436,8 @@ void InspectorController::clearConsoleMessages()
     m_groupLevel = 0;
 }
 
-void InspectorController::toggleRecordButton(bool isProfiling)
-{
-    if (!m_scriptContext)
-        return;
-
-    JSValueRef exception = 0;
-    JSValueRef isProvingValue = JSValueMakeBoolean(m_scriptContext, isProfiling);
-    callFunction(m_scriptContext, m_scriptObject, "setRecordingProfile", 1, &isProvingValue, exception);
-}
-
 void InspectorController::startGroup(MessageSource source, ScriptCallStack* callStack)
-{    
+{
     ++m_groupLevel;
 
     addConsoleMessage(callStack->state(), new ConsoleMessage(source, StartGroupMessageLevel, callStack, m_groupLevel));
@@ -1403,32 +453,6 @@ void InspectorController::endGroup(MessageSource source, unsigned lineNumber, co
     addConsoleMessage(0, new ConsoleMessage(source, EndGroupMessageLevel, String(), lineNumber, sourceURL, m_groupLevel));
 }
 
-void InspectorController::addProfile(PassRefPtr<Profile> prpProfile, unsigned lineNumber, const UString& sourceURL)
-{
-    if (!enabled())
-        return;
-
-    RefPtr<Profile> profile = prpProfile;
-    m_profiles.append(profile);
-
-    if (windowVisible())
-        addScriptProfile(profile.get());
-
-    addProfileMessageToConsole(profile, lineNumber, sourceURL);
-}
-
-void InspectorController::addProfileMessageToConsole(PassRefPtr<Profile> prpProfile, unsigned lineNumber, const UString& sourceURL)
-{
-    RefPtr<Profile> profile = prpProfile;
-
-    UString message = "Profile \"webkit-profile://";
-    message += encodeWithURLEscapeSequences(profile->title());
-    message += "/";
-    message += UString::from(profile->uid());
-    message += "\" finished.";
-    addMessageToConsole(JSMessageSource, LogMessageLevel, message, lineNumber, sourceURL);
-}
-
 void InspectorController::attachWindow()
 {
     if (!enabled())
@@ -1445,13 +469,10 @@ void InspectorController::detachWindow()
 
 void InspectorController::setAttachedWindow(bool attached)
 {
-    if (!enabled() || !m_scriptContext || !m_scriptObject)
+    if (!enabled() || !m_frontend)
         return;
 
-    JSValueRef attachedValue = JSValueMakeBoolean(m_scriptContext, attached);
-
-    JSValueRef exception = 0;
-    callFunction(m_scriptContext, m_scriptObject, "setAttachedWindow", 1, &attachedValue, exception);
+    m_frontend->setAttachedWindow(attached);
 }
 
 void InspectorController::setAttachedWindowHeight(unsigned height)
@@ -1471,6 +492,19 @@ void InspectorController::toggleSearchForNodeInPage()
         hideHighlight();
 }
 
+void InspectorController::addResourceSourceToFrame(long identifier, Node* frame)
+{
+    if (!enabled() || !m_frontend)
+        return;
+
+    RefPtr<InspectorResource> resource = resources().get(identifier);
+    if (resource) {
+        String sourceString = resource->sourceString();
+        if (!sourceString.isEmpty())
+            addSourceToFrame(resource->mimeType(), sourceString, frame);
+    }
+}
+
 void InspectorController::mouseDidMoveOverElement(const HitTestResult& result, unsigned)
 {
     if (!enabled() || !m_searchingForNode)
@@ -1497,21 +531,10 @@ void InspectorController::handleMousePressOnNode(Node* node)
 
 void InspectorController::inspectedWindowScriptObjectCleared(Frame* frame)
 {
-    if (!enabled() || !m_scriptContext || !m_scriptObject)
+    if (!enabled() || !m_frontend)
         return;
 
-    JSDOMWindow* win = toJSDOMWindow(frame);
-    ExecState* exec = win->globalExec();
-
-    JSValueRef arg0;
-
-    {
-        JSC::JSLock lock(false);
-        arg0 = toRef(JSInspectedObjectWrapper::wrap(exec, win));
-    }
-
-    JSValueRef exception = 0;
-    callFunction(m_scriptContext, m_scriptObject, "inspectedWindowCleared", 1, &arg0, exception);
+    m_frontend->inspectedWindowScriptObjectCleared(frame);
 }
 
 void InspectorController::windowScriptObjectAvailable()
@@ -1519,122 +542,51 @@ void InspectorController::windowScriptObjectAvailable()
     if (!m_page || !enabled())
         return;
 
-    m_scriptContext = toRef(m_page->mainFrame()->script()->globalObject()->globalExec());
-
-    JSObjectRef global = JSContextGetGlobalObject(m_scriptContext);
-    ASSERT(global);
-
-    static JSStaticFunction staticFunctions[] = {
-        // SIMPLE_INSPECTOR_CALLBACK
-        { "hideDOMNodeHighlight", WebCore::hideDOMNodeHighlight, kJSPropertyAttributeNone },
-        { "loaded", WebCore::loaded, kJSPropertyAttributeNone },
-        { "windowUnloading", WebCore::unloading, kJSPropertyAttributeNone },
-        { "attach", WebCore::attach, kJSPropertyAttributeNone },
-        { "detach", WebCore::detach, kJSPropertyAttributeNone },
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-        { "enableDebugger", WebCore::enableDebugger, kJSPropertyAttributeNone },
-        { "disableDebugger", WebCore::disableDebugger, kJSPropertyAttributeNone },
-        { "pauseInDebugger", WebCore::pauseInDebugger, kJSPropertyAttributeNone },
-        { "resumeDebugger", WebCore::resumeDebugger, kJSPropertyAttributeNone },
-        { "stepOverStatementInDebugger", WebCore::stepOverStatementInDebugger, kJSPropertyAttributeNone },
-        { "stepIntoStatementInDebugger", WebCore::stepIntoStatementInDebugger, kJSPropertyAttributeNone },
-        { "stepOutOfFunctionInDebugger", WebCore::stepOutOfFunctionInDebugger, kJSPropertyAttributeNone },
-#endif
-        { "closeWindow", WebCore::closeWindow, kJSPropertyAttributeNone },
-        { "clearMessages", WebCore::clearMessages, kJSPropertyAttributeNone },
-        { "startProfiling", WebCore::startProfiling, kJSPropertyAttributeNone },
-        { "stopProfiling", WebCore::stopProfiling, kJSPropertyAttributeNone },
-        { "enableProfiler", WebCore::enableProfiler, kJSPropertyAttributeNone },
-        { "disableProfiler", WebCore::disableProfiler, kJSPropertyAttributeNone },
-        { "toggleNodeSearch", WebCore::toggleNodeSearch, kJSPropertyAttributeNone },
-
-        // BOOL_INSPECTOR_CALLBACK
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-        { "debuggerEnabled", WebCore::debuggerEnabled, kJSPropertyAttributeNone },
-        { "pauseOnExceptions", WebCore::pauseOnExceptions, kJSPropertyAttributeNone },
-#endif
-        { "profilerEnabled", WebCore::profilerEnabled, kJSPropertyAttributeNone },
-        { "isWindowVisible", WebCore::isWindowVisible, kJSPropertyAttributeNone },
-        { "searchingForNode", WebCore::searchingForNode, kJSPropertyAttributeNone },
-
-        // Custom callbacks
-        { "addResourceSourceToFrame", WebCore::addResourceSourceToFrame, kJSPropertyAttributeNone },
-        { "addSourceToFrame", WebCore::addSourceToFrame, kJSPropertyAttributeNone },
-        { "getResourceDocumentNode", WebCore::getResourceDocumentNode, kJSPropertyAttributeNone },
-        { "highlightDOMNode", WebCore::highlightDOMNode, kJSPropertyAttributeNone },
-        { "search", WebCore::search, kJSPropertyAttributeNone },
-#if ENABLE(DATABASE)
-        { "databaseTableNames", WebCore::databaseTableNames, kJSPropertyAttributeNone },
-#endif
-        { "setting", WebCore::setting, kJSPropertyAttributeNone },
-        { "setSetting", WebCore::setSetting, kJSPropertyAttributeNone },
-        { "inspectedWindow", WebCore::inspectedWindow, kJSPropertyAttributeNone },
-        { "localizedStringsURL", WebCore::localizedStrings, kJSPropertyAttributeNone },
-        { "platform", WebCore::platform, kJSPropertyAttributeNone },
-        { "moveByUnrestricted", WebCore::moveByUnrestricted, kJSPropertyAttributeNone },
-        { "setAttachedWindowHeight", WebCore::setAttachedWindowHeight, kJSPropertyAttributeNone },
-        { "wrapCallback", WebCore::wrapCallback, kJSPropertyAttributeNone },
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-        { "currentCallFrame", WebCore::currentCallFrame, kJSPropertyAttributeNone },
-        { "setPauseOnExceptions", WebCore::setPauseOnExceptions, kJSPropertyAttributeNone },
-        { "addBreakpoint", WebCore::addBreakpoint, kJSPropertyAttributeNone },
-        { "removeBreakpoint", WebCore::removeBreakpoint, kJSPropertyAttributeNone },
-#endif
-        { "profiles", WebCore::profiles, kJSPropertyAttributeNone },
-        { 0, 0, 0 }
-    };
-
-    JSClassDefinition inspectorControllerDefinition = {
-        0, kJSClassAttributeNone, "InspectorController", 0, 0, staticFunctions,
-        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
-    };
+    // Grant the inspector the ability to script the inspected page.
+    m_page->mainFrame()->document()->securityOrigin()->grantUniversalAccess();
 
-    JSClassRef controllerClass = JSClassCreate(&inspectorControllerDefinition);
-    ASSERT(controllerClass);
-
-    m_controllerScriptObject = JSObjectMake(m_scriptContext, controllerClass, reinterpret_cast<void*>(this));
-    ASSERT(m_controllerScriptObject);
-
-    JSObjectSetProperty(m_scriptContext, global, jsStringRef("InspectorController").get(), m_controllerScriptObject, kJSPropertyAttributeNone, 0);
+    m_scriptState = scriptStateFromPage(m_page);
+    ScriptGlobalObject::set(m_scriptState, "InspectorController", this);
 }
 
 void InspectorController::scriptObjectReady()
 {
-    ASSERT(m_scriptContext);
-    if (!m_scriptContext)
-        return;
-
-    JSObjectRef global = JSContextGetGlobalObject(m_scriptContext);
-    ASSERT(global);
-
-    JSValueRef exception = 0;
-
-    JSValueRef inspectorValue = JSObjectGetProperty(m_scriptContext, global, jsStringRef("WebInspector").get(), &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    ASSERT(inspectorValue);
-    if (!inspectorValue)
+    ASSERT(m_scriptState);
+    if (!m_scriptState)
         return;
 
-    m_scriptObject = JSValueToObject(m_scriptContext, inspectorValue, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
+    ScriptObject webInspectorObj;
+    if (!ScriptGlobalObject::get(m_scriptState, "WebInspector", webInspectorObj))
         return;
+    setFrontendProxyObject(m_scriptState, webInspectorObj);
 
-    ASSERT(m_scriptObject);
-
-    JSValueProtect(m_scriptContext, m_scriptObject);
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    Setting debuggerEnabled = setting(debuggerEnabledSettingName);
+    if (debuggerEnabled.type() == Setting::BooleanType && debuggerEnabled.booleanValue())
+        enableDebugger();
+    Setting profilerEnabled = setting(profilerEnabledSettingName);
+    if (profilerEnabled.type() == Setting::BooleanType && profilerEnabled.booleanValue())
+        enableProfiler();
+#endif
 
     // Make sure our window is visible now that the page loaded
     showWindow();
 }
 
+void InspectorController::setFrontendProxyObject(ScriptState* scriptState, ScriptObject webInspectorObj)
+{
+    m_frontend.set(new InspectorFrontend(scriptState, webInspectorObj));
+}
+
 void InspectorController::show()
 {
     if (!enabled())
         return;
-
+    
     if (!m_page) {
+        if (m_frontend)
+            return;  // We are using custom frontend - no need to create page.
+
         m_page = m_client->createPage();
         if (!m_page)
             return;
@@ -1654,7 +606,7 @@ void InspectorController::showPanel(SpecialPanels panel)
 
     show();
 
-    if (!m_scriptObject) {
+    if (!m_frontend) {
         m_showAfterVisible = panel;
         return;
     }
@@ -1662,33 +614,7 @@ void InspectorController::showPanel(SpecialPanels panel)
     if (panel == CurrentPanel)
         return;
 
-    const char* showFunctionName;
-    switch (panel) {
-        case ConsolePanel:
-            showFunctionName = "showConsole";
-            break;
-        case DatabasesPanel:
-            showFunctionName = "showDatabasesPanel";
-            break;
-        case ElementsPanel:
-            showFunctionName = "showElementsPanel";
-            break;
-        case ProfilesPanel:
-            showFunctionName = "showProfilesPanel";
-            break;
-        case ResourcesPanel:
-            showFunctionName = "showResourcesPanel";
-            break;
-        case ScriptsPanel:
-            showFunctionName = "showScriptsPanel";
-            break;
-        default:
-            ASSERT_NOT_REACHED();
-            showFunctionName = 0;
-    }
-
-    if (showFunctionName)
-        callSimpleFunction(m_scriptContext, m_scriptObject, showFunctionName);
+    m_frontend->showPanel(panel);
 }
 
 void InspectorController::close()
@@ -1696,17 +622,14 @@ void InspectorController::close()
     if (!enabled())
         return;
 
-    stopUserInitiatedProfiling();
 #if ENABLE(JAVASCRIPT_DEBUGGER)
+    stopUserInitiatedProfiling();
     disableDebugger();
 #endif
     closeWindow();
 
-    if (m_scriptContext && m_scriptObject)
-        JSValueUnprotect(m_scriptContext, m_scriptObject);
-
-    m_scriptObject = 0;
-    m_scriptContext = 0;
+    m_frontend.set(0);
+    m_scriptState = 0;
 }
 
 void InspectorController::showWindow()
@@ -1720,557 +643,55 @@ void InspectorController::closeWindow()
     m_client->closeWindow();
 }
 
-void InspectorController::startUserInitiatedProfilingSoon()
-{
-    m_startProfiling.startOneShot(0);
-}
-
-void InspectorController::startUserInitiatedProfiling(Timer<InspectorController>*)
-{
-    if (!enabled())
-        return;
-
-    if (!profilerEnabled()) {
-        enableProfiler(true);
-        JavaScriptDebugServer::shared().recompileAllJSFunctions();
-    }
-
-    m_recordingUserInitiatedProfile = true;
-    m_currentUserInitiatedProfileNumber = m_nextUserInitiatedProfileNumber++;
-
-    UString title = UserInitiatedProfileName;
-    title += ".";
-    title += UString::from(m_currentUserInitiatedProfileNumber);
-
-    ExecState* exec = toJSDOMWindow(m_inspectedPage->mainFrame())->globalExec();
-    Profiler::profiler()->startProfiling(exec, title);
-
-    toggleRecordButton(true);
-}
-
-void InspectorController::stopUserInitiatedProfiling()
-{
-    if (!enabled())
-        return;
-
-    m_recordingUserInitiatedProfile = false;
-
-    UString title =  UserInitiatedProfileName;
-    title += ".";
-    title += UString::from(m_currentUserInitiatedProfileNumber);
-
-    ExecState* exec = toJSDOMWindow(m_inspectedPage->mainFrame())->globalExec();
-    RefPtr<Profile> profile = Profiler::profiler()->stopProfiling(exec, title);
-    if (profile)
-        addProfile(profile, 0, UString());
-
-    toggleRecordButton(false);
-}
-
-void InspectorController::enableProfiler(bool skipRecompile)
-{
-    if (m_profilerEnabled)
-        return;
-
-    m_profilerEnabled = true;
-
-    if (!skipRecompile)
-        JavaScriptDebugServer::shared().recompileAllJSFunctionsSoon();
-
-    if (m_scriptContext && m_scriptObject)
-        callSimpleFunction(m_scriptContext, m_scriptObject, "profilerWasEnabled");
-}
-
-void InspectorController::disableProfiler()
-{
-    if (!m_profilerEnabled)
-        return;
-
-    m_profilerEnabled = false;
-
-    JavaScriptDebugServer::shared().recompileAllJSFunctionsSoon();
-
-    if (m_scriptContext && m_scriptObject)
-        callSimpleFunction(m_scriptContext, m_scriptObject, "profilerWasDisabled");
-}
-
-static void addHeaders(JSContextRef context, JSObjectRef object, const HTTPHeaderMap& headers, JSValueRef* exception)
-{
-    ASSERT_ARG(context, context);
-    ASSERT_ARG(object, object);
-
-    HTTPHeaderMap::const_iterator end = headers.end();
-    for (HTTPHeaderMap::const_iterator it = headers.begin(); it != end; ++it) {
-        JSValueRef value = JSValueMakeString(context, jsStringRef(it->second).get());
-        JSObjectSetProperty(context, object, jsStringRef((it->first).string()).get(), value, kJSPropertyAttributeNone, exception);
-        if (exception && *exception)
-            return;
-    }
-}
-
-static JSObjectRef scriptObjectForRequest(JSContextRef context, const InspectorResource* resource, JSValueRef* exception)
-{
-    ASSERT_ARG(context, context);
-
-    JSObjectRef object = JSObjectMake(context, 0, 0);
-    addHeaders(context, object, resource->requestHeaderFields, exception);
-
-    return object;
-}
-
-static JSObjectRef scriptObjectForResponse(JSContextRef context, const InspectorResource* resource, JSValueRef* exception)
-{
-    ASSERT_ARG(context, context);
-
-    JSObjectRef object = JSObjectMake(context, 0, 0);
-    addHeaders(context, object, resource->responseHeaderFields, exception);
-
-    return object;
-}
-
-JSObjectRef InspectorController::addScriptResource(InspectorResource* resource)
-{
-    ASSERT_ARG(resource, resource);
-
-    ASSERT(m_scriptContext);
-    ASSERT(m_scriptObject);
-    if (!m_scriptContext || !m_scriptObject)
-        return 0;
-
-    if (!resource->scriptObject) {
-        JSValueRef exception = 0;
-
-        JSValueRef resourceProperty = JSObjectGetProperty(m_scriptContext, m_scriptObject, jsStringRef("Resource").get(), &exception);
-        if (HANDLE_EXCEPTION(m_scriptContext, exception))
-            return 0;
-
-        JSObjectRef resourceConstructor = JSValueToObject(m_scriptContext, resourceProperty, &exception);
-        if (HANDLE_EXCEPTION(m_scriptContext, exception))
-            return 0;
-
-        JSValueRef urlValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.string()).get());
-        JSValueRef domainValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.host()).get());
-        JSValueRef pathValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.path()).get());
-        JSValueRef lastPathComponentValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.lastPathComponent()).get());
-
-        JSValueRef identifier = JSValueMakeNumber(m_scriptContext, resource->identifier);
-        JSValueRef mainResource = JSValueMakeBoolean(m_scriptContext, m_mainResource == resource);
-        JSValueRef cached = JSValueMakeBoolean(m_scriptContext, resource->cached);
-
-        JSObjectRef scriptObject = scriptObjectForRequest(m_scriptContext, resource, &exception);
-        if (HANDLE_EXCEPTION(m_scriptContext, exception))
-            return 0;
-
-        JSValueRef arguments[] = { scriptObject, urlValue, domainValue, pathValue, lastPathComponentValue, identifier, mainResource, cached };
-        JSObjectRef result = JSObjectCallAsConstructor(m_scriptContext, resourceConstructor, 8, arguments, &exception);
-        if (HANDLE_EXCEPTION(m_scriptContext, exception))
-            return 0;
-
-        ASSERT(result);
-
-        resource->setScriptObject(m_scriptContext, result);
-    }
-
-    JSValueRef exception = 0;
-    callFunction(m_scriptContext, m_scriptObject, "addResource", 1, &resource->scriptObject, exception);
-
-    if (exception)
-        return 0;
-
-    return resource->scriptObject;
-}
-
-JSObjectRef InspectorController::addAndUpdateScriptResource(InspectorResource* resource)
-{
-    ASSERT_ARG(resource, resource);
-
-    JSObjectRef scriptResource = addScriptResource(resource);
-    if (!scriptResource)
-        return 0;
-
-    updateScriptResourceResponse(resource);
-    updateScriptResource(resource, resource->length);
-    updateScriptResource(resource, resource->startTime, resource->responseReceivedTime, resource->endTime);
-    updateScriptResource(resource, resource->finished, resource->failed);
-    return scriptResource;
-}
-
-void InspectorController::removeScriptResource(InspectorResource* resource)
-{
-    ASSERT(m_scriptContext);
-    ASSERT(m_scriptObject);
-    if (!m_scriptContext || !m_scriptObject)
-        return;
-
-    ASSERT(resource);
-    ASSERT(resource->scriptObject);
-    if (!resource || !resource->scriptObject)
-        return;
-
-    JSObjectRef scriptObject = resource->scriptObject;
-    resource->setScriptObject(0, 0);
-
-    JSValueRef exception = 0;
-    callFunction(m_scriptContext, m_scriptObject, "removeResource", 1, &scriptObject, exception);
-}
-
-static void updateResourceRequest(InspectorResource* resource, const ResourceRequest& request)
-{
-    resource->requestHeaderFields = request.httpHeaderFields();
-    resource->requestURL = request.url();
-}
-
-static void updateResourceResponse(InspectorResource* resource, const ResourceResponse& response)
-{
-    resource->expectedContentLength = response.expectedContentLength();
-    resource->mimeType = response.mimeType();
-    resource->responseHeaderFields = response.httpHeaderFields();
-    resource->responseStatusCode = response.httpStatusCode();
-    resource->suggestedFilename = response.suggestedFilename();
-}
-
-void InspectorController::updateScriptResourceRequest(InspectorResource* resource)
-{
-    ASSERT(resource->scriptObject);
-    ASSERT(m_scriptContext);
-    if (!resource->scriptObject || !m_scriptContext)
-        return;
-
-    JSValueRef urlValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.string()).get());
-    JSValueRef domainValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.host()).get());
-    JSValueRef pathValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.path()).get());
-    JSValueRef lastPathComponentValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->requestURL.lastPathComponent()).get());
-
-    JSValueRef mainResourceValue = JSValueMakeBoolean(m_scriptContext, m_mainResource == resource);
-
-    JSValueRef exception = 0;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("url").get(), urlValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("domain").get(), domainValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("path").get(), pathValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("lastPathComponent").get(), lastPathComponentValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectRef scriptObject = scriptObjectForRequest(m_scriptContext, resource, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("requestHeaders").get(), scriptObject, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("mainResource").get(), mainResourceValue, kJSPropertyAttributeNone, &exception);
-    HANDLE_EXCEPTION(m_scriptContext, exception);
-}
-
-void InspectorController::updateScriptResourceResponse(InspectorResource* resource)
-{
-    ASSERT(resource->scriptObject);
-    ASSERT(m_scriptContext);
-    if (!resource->scriptObject || !m_scriptContext)
-        return;
-
-    JSValueRef mimeTypeValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->mimeType).get());
-
-    JSValueRef suggestedFilenameValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->suggestedFilename).get());
-
-    JSValueRef expectedContentLengthValue = JSValueMakeNumber(m_scriptContext, static_cast<double>(resource->expectedContentLength));
-    JSValueRef statusCodeValue = JSValueMakeNumber(m_scriptContext, resource->responseStatusCode);
-
-    JSValueRef exception = 0;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("mimeType").get(), mimeTypeValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("suggestedFilename").get(), suggestedFilenameValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("expectedContentLength").get(), expectedContentLengthValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("statusCode").get(), statusCodeValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectRef scriptObject = scriptObjectForResponse(m_scriptContext, resource, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("responseHeaders").get(), scriptObject, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    updateScriptResourceType(resource);
-}
-
-void InspectorController::updateScriptResourceType(InspectorResource* resource)
-{
-    ASSERT(resource->scriptObject);
-    ASSERT(m_scriptContext);
-    if (!resource->scriptObject || !m_scriptContext)
-        return;
-
-    JSValueRef exception = 0;
-
-    JSValueRef typeValue = JSValueMakeNumber(m_scriptContext, resource->type());
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("type").get(), typeValue, kJSPropertyAttributeNone, &exception);
-    HANDLE_EXCEPTION(m_scriptContext, exception);
-}
-
-void InspectorController::updateScriptResource(InspectorResource* resource, int length)
-{
-    ASSERT(resource->scriptObject);
-    ASSERT(m_scriptContext);
-    if (!resource->scriptObject || !m_scriptContext)
-        return;
-
-    JSValueRef lengthValue = JSValueMakeNumber(m_scriptContext, length);
-
-    JSValueRef exception = 0;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("contentLength").get(), lengthValue, kJSPropertyAttributeNone, &exception);
-    HANDLE_EXCEPTION(m_scriptContext, exception);
-}
-
-void InspectorController::updateScriptResource(InspectorResource* resource, bool finished, bool failed)
-{
-    ASSERT(resource->scriptObject);
-    ASSERT(m_scriptContext);
-    if (!resource->scriptObject || !m_scriptContext)
-        return;
-
-    JSValueRef failedValue = JSValueMakeBoolean(m_scriptContext, failed);
-    JSValueRef finishedValue = JSValueMakeBoolean(m_scriptContext, finished);
-
-    JSValueRef exception = 0;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("failed").get(), failedValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("finished").get(), finishedValue, kJSPropertyAttributeNone, &exception);
-    HANDLE_EXCEPTION(m_scriptContext, exception);
-}
-
-void InspectorController::updateScriptResource(InspectorResource* resource, double startTime, double responseReceivedTime, double endTime)
-{
-    ASSERT(resource->scriptObject);
-    ASSERT(m_scriptContext);
-    if (!resource->scriptObject || !m_scriptContext)
-        return;
-
-    JSValueRef startTimeValue = JSValueMakeNumber(m_scriptContext, startTime);
-    JSValueRef responseReceivedTimeValue = JSValueMakeNumber(m_scriptContext, responseReceivedTime);
-    JSValueRef endTimeValue = JSValueMakeNumber(m_scriptContext, endTime);
-
-    JSValueRef exception = 0;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("startTime").get(), startTimeValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("responseReceivedTime").get(), responseReceivedTimeValue, kJSPropertyAttributeNone, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectSetProperty(m_scriptContext, resource->scriptObject, jsStringRef("endTime").get(), endTimeValue, kJSPropertyAttributeNone, &exception);
-    HANDLE_EXCEPTION(m_scriptContext, exception);
-}
-
 void InspectorController::populateScriptObjects()
 {
-    ASSERT(m_scriptContext);
-    if (!m_scriptContext)
+    ASSERT(m_frontend);
+    if (!m_frontend)
         return;
 
     ResourcesMap::iterator resourcesEnd = m_resources.end();
     for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it)
-        addAndUpdateScriptResource(it->second.get());
+        it->second->createScriptObject(m_frontend.get());
 
     unsigned messageCount = m_consoleMessages.size();
     for (unsigned i = 0; i < messageCount; ++i)
-        addScriptConsoleMessage(m_consoleMessages[i]);
+        m_consoleMessages[i]->addToConsole(m_frontend.get());
 
 #if ENABLE(DATABASE)
     DatabaseResourcesSet::iterator databasesEnd = m_databaseResources.end();
     for (DatabaseResourcesSet::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
-        addDatabaseScriptResource((*it).get());
+        (*it)->bind(m_frontend.get());
 #endif
-
-    callSimpleFunction(m_scriptContext, m_scriptObject, "populateInterface");
-}
-
-#if ENABLE(DATABASE)
-JSObjectRef InspectorController::addDatabaseScriptResource(InspectorDatabaseResource* resource)
-{
-    ASSERT_ARG(resource, resource);
-
-    if (resource->scriptObject)
-        return resource->scriptObject;
-
-    ASSERT(m_scriptContext);
-    ASSERT(m_scriptObject);
-    if (!m_scriptContext || !m_scriptObject)
-        return 0;
-
-    Frame* frame = resource->database->document()->frame();
-    if (!frame)
-        return 0;
-
-    JSValueRef exception = 0;
-
-    JSValueRef databaseProperty = JSObjectGetProperty(m_scriptContext, m_scriptObject, jsStringRef("Database").get(), &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return 0;
-
-    JSObjectRef databaseConstructor = JSValueToObject(m_scriptContext, databaseProperty, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return 0;
-
-    ExecState* exec = toJSDOMWindow(frame)->globalExec();
-
-    JSValueRef database;
-
-    {
-        JSC::JSLock lock(false);
-        database = toRef(JSInspectedObjectWrapper::wrap(exec, toJS(exec, resource->database.get())));
-    }
-
-    JSValueRef domainValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->domain).get());
-    JSValueRef nameValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->name).get());
-    JSValueRef versionValue = JSValueMakeString(m_scriptContext, jsStringRef(resource->version).get());
-
-    JSValueRef arguments[] = { database, domainValue, nameValue, versionValue };
-    JSObjectRef result = JSObjectCallAsConstructor(m_scriptContext, databaseConstructor, 4, arguments, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return 0;
-
-    ASSERT(result);
-
-    callFunction(m_scriptContext, m_scriptObject, "addDatabase", 1, &result, exception);
-
-    if (exception)
-        return 0;
-
-    resource->setScriptObject(m_scriptContext, result);
-
-    return result;
-}
-
-void InspectorController::removeDatabaseScriptResource(InspectorDatabaseResource* resource)
-{
-    ASSERT(m_scriptContext);
-    ASSERT(m_scriptObject);
-    if (!m_scriptContext || !m_scriptObject)
-        return;
-
-    ASSERT(resource);
-    ASSERT(resource->scriptObject);
-    if (!resource || !resource->scriptObject)
-        return;
-
-    JSObjectRef scriptObject = resource->scriptObject;
-    resource->setScriptObject(0, 0);
-
-    JSValueRef exception = 0;
-    callFunction(m_scriptContext, m_scriptObject, "removeDatabase", 1, &scriptObject, exception);
-}
+#if ENABLE(DOM_STORAGE)
+    DOMStorageResourcesSet::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesSet::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
+        (*it)->bind(m_frontend.get());
 #endif
 
-void InspectorController::addScriptConsoleMessage(const ConsoleMessage* message)
-{
-    ASSERT_ARG(message, message);
-
-    JSValueRef exception = 0;
-
-    JSValueRef messageConstructorProperty = JSObjectGetProperty(m_scriptContext, m_scriptObject, jsStringRef("ConsoleMessage").get(), &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSObjectRef messageConstructor = JSValueToObject(m_scriptContext, messageConstructorProperty, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    JSValueRef sourceValue = JSValueMakeNumber(m_scriptContext, message->source);
-    JSValueRef levelValue = JSValueMakeNumber(m_scriptContext, message->level);
-    JSValueRef lineValue = JSValueMakeNumber(m_scriptContext, message->line);
-    JSValueRef urlValue = JSValueMakeString(m_scriptContext, jsStringRef(message->url).get());
-    JSValueRef groupLevelValue = JSValueMakeNumber(m_scriptContext, message->groupLevel);
-    JSValueRef repeatCountValue = JSValueMakeNumber(m_scriptContext, message->repeatCount);
-
-    static const unsigned maximumMessageArguments = 256;
-    JSValueRef arguments[maximumMessageArguments];
-    unsigned argumentCount = 0;
-    arguments[argumentCount++] = sourceValue;
-    arguments[argumentCount++] = levelValue;
-    arguments[argumentCount++] = lineValue;
-    arguments[argumentCount++] = urlValue;
-    arguments[argumentCount++] = groupLevelValue;
-    arguments[argumentCount++] = repeatCountValue;
-
-    if (!message->frames.isEmpty()) {
-        unsigned remainingSpaceInArguments = maximumMessageArguments - argumentCount;
-        unsigned argumentsToAdd = min(remainingSpaceInArguments, static_cast<unsigned>(message->frames.size()));
-        for (unsigned i = 0; i < argumentsToAdd; ++i)
-            arguments[argumentCount++] = JSValueMakeString(m_scriptContext, jsStringRef(message->frames[i]).get());
-    } else if (!message->wrappedArguments.isEmpty()) {
-        unsigned remainingSpaceInArguments = maximumMessageArguments - argumentCount;
-        unsigned argumentsToAdd = min(remainingSpaceInArguments, static_cast<unsigned>(message->wrappedArguments.size()));
-        for (unsigned i = 0; i < argumentsToAdd; ++i)
-            arguments[argumentCount++] = toRef(message->wrappedArguments[i]);
-    } else {
-        JSValueRef messageValue = JSValueMakeString(m_scriptContext, jsStringRef(message->message).get());
-        arguments[argumentCount++] = messageValue;
-    }
-
-    JSObjectRef messageObject = JSObjectCallAsConstructor(m_scriptContext, messageConstructor, argumentCount, arguments, &exception);
-    if (HANDLE_EXCEPTION(m_scriptContext, exception))
-        return;
-
-    callFunction(m_scriptContext, m_scriptObject, "addMessageToConsole", 1, &messageObject, exception);
-}
-
-void InspectorController::addScriptProfile(Profile* profile)
-{
-    JSLock lock(false);
-    JSValueRef exception = 0;
-    JSValueRef profileObject = toRef(toJS(toJS(m_scriptContext), profile));
-    callFunction(m_scriptContext, m_scriptObject, "addProfile", 1, &profileObject, exception);
+    m_frontend->populateInterface();
 }
 
 void InspectorController::resetScriptObjects()
 {
-    if (!m_scriptContext || !m_scriptObject)
+    if (!m_frontend)
         return;
 
     ResourcesMap::iterator resourcesEnd = m_resources.end();
-    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it) {
-        InspectorResource* resource = it->second.get();
-        resource->setScriptObject(0, 0);
-    }
+    for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it)
+        it->second->releaseScriptObject(m_frontend.get(), false);
 
 #if ENABLE(DATABASE)
     DatabaseResourcesSet::iterator databasesEnd = m_databaseResources.end();
-    for (DatabaseResourcesSet::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it) {
-        InspectorDatabaseResource* resource = (*it).get();
-        resource->setScriptObject(0, 0);
-    }
+    for (DatabaseResourcesSet::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
+        (*it)->unbind();
+#endif
+#if ENABLE(DOM_STORAGE)
+    DOMStorageResourcesSet::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesSet::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
+        (*it)->unbind();
 #endif
 
-    callSimpleFunction(m_scriptContext, m_scriptObject, "reset");
+    m_frontend->reset();
 }
 
 void InspectorController::pruneResources(ResourcesMap* resourceMap, DocumentLoader* loaderToKeep)
@@ -2284,10 +705,10 @@ void InspectorController::pruneResources(ResourcesMap* resourceMap, DocumentLoad
         if (resource == m_mainResource)
             continue;
 
-        if (!loaderToKeep || resource->loader != loaderToKeep) {
+        if (!loaderToKeep || !resource->isSameLoader(loaderToKeep)) {
             removeResource(resource);
-            if (windowVisible() && resource->scriptObject)
-                removeScriptResource(resource);
+            if (windowVisible())
+                resource->releaseScriptObject(m_frontend.get(), true);
         }
     }
 }
@@ -2306,21 +727,27 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
 
         m_times.clear();
         m_counts.clear();
+#if ENABLE(JAVASCRIPT_DEBUGGER)
         m_profiles.clear();
-
+        m_currentUserInitiatedProfileNumber = 1;
+        m_nextUserInitiatedProfileNumber = 1;
+#endif
 #if ENABLE(DATABASE)
         m_databaseResources.clear();
 #endif
+#if ENABLE(DOM_STORAGE)
+        m_domStorageResources.clear();
+#endif
 
         if (windowVisible()) {
             resetScriptObjects();
 
             if (!loader->isLoadingFromCachedPage()) {
-                ASSERT(m_mainResource && m_mainResource->loader == loader);
+                ASSERT(m_mainResource && m_mainResource->isSameLoader(loader));
                 // We don't add the main resource until its load is committed. This is
                 // needed to keep the load for a user-entered URL from showing up in the
                 // list of resources for the page they are navigating away from.
-                addAndUpdateScriptResource(m_mainResource.get());
+                m_mainResource->createScriptObject(m_frontend.get());
             } else {
                 // Pages loaded from the page cache are committed before
                 // m_mainResource is the right resource for this load, so we
@@ -2346,39 +773,54 @@ void InspectorController::frameDetachedFromParent(Frame* frame)
 
 void InspectorController::addResource(InspectorResource* resource)
 {
-    m_resources.set(resource->identifier, resource);
-    m_knownResources.add(resource->requestURL.string());
+    m_resources.set(resource->identifier(), resource);
+    m_knownResources.add(resource->requestURL());
 
-    Frame* frame = resource->frame.get();
+    Frame* frame = resource->frame();
     ResourcesMap* resourceMap = m_frameResources.get(frame);
     if (resourceMap)
-        resourceMap->set(resource->identifier, resource);
+        resourceMap->set(resource->identifier(), resource);
     else {
         resourceMap = new ResourcesMap;
-        resourceMap->set(resource->identifier, resource);
+        resourceMap->set(resource->identifier(), resource);
         m_frameResources.set(frame, resourceMap);
     }
 }
 
 void InspectorController::removeResource(InspectorResource* resource)
 {
-    m_resources.remove(resource->identifier);
-    m_knownResources.remove(resource->requestURL.string());
+    m_resources.remove(resource->identifier());
+    m_knownResources.remove(resource->requestURL());
 
-    Frame* frame = resource->frame.get();
+    Frame* frame = resource->frame();
     ResourcesMap* resourceMap = m_frameResources.get(frame);
     if (!resourceMap) {
         ASSERT_NOT_REACHED();
         return;
     }
 
-    resourceMap->remove(resource->identifier);
+    resourceMap->remove(resource->identifier());
     if (resourceMap->isEmpty()) {
         m_frameResources.remove(frame);
         delete resourceMap;
     }
 }
 
+InspectorResource* InspectorController::getTrackedResource(long long identifier)
+{
+    if (!enabled())
+        return 0;
+
+    if (m_resourceTrackingEnabled)
+        return m_resources.get(identifier).get();
+
+    bool isMainResource = m_mainResource && m_mainResource->identifier() == identifier;
+    if (isMainResource)
+        return m_mainResource.get();
+
+    return 0;
+}
+
 void InspectorController::didLoadResourceFromMemoryCache(DocumentLoader* loader, const CachedResource* cachedResource)
 {
     if (!enabled())
@@ -2388,172 +830,204 @@ void InspectorController::didLoadResourceFromMemoryCache(DocumentLoader* loader,
     if (m_knownResources.contains(cachedResource->url()))
         return;
 
-    RefPtr<InspectorResource> resource = InspectorResource::create(m_nextIdentifier--, loader, loader->frame());
-    resource->finished = true;
-
-    resource->requestURL = KURL(cachedResource->url());
-    updateResourceResponse(resource.get(), cachedResource->response());
-
-    resource->length = cachedResource->encodedSize();
-    resource->cached = true;
-    resource->startTime = currentTime();
-    resource->responseReceivedTime = resource->startTime;
-    resource->endTime = resource->startTime;
-
     ASSERT(m_inspectedPage);
+    bool isMainResource = isMainResourceLoader(loader, KURL(cachedResource->url()));
+    ensureResourceTrackingSettingsLoaded();
+    if (!isMainResource && !m_resourceTrackingEnabled)
+        return;
+    
+    RefPtr<InspectorResource> resource = InspectorResource::createCached(m_nextIdentifier--, loader, cachedResource);
 
-    if (loader->frame() == m_inspectedPage->mainFrame() && cachedResource->url() == loader->requestURL())
+    if (isMainResource) {
         m_mainResource = resource;
+        resource->markMainResource();
+    }
 
     addResource(resource.get());
 
     if (windowVisible())
-        addAndUpdateScriptResource(resource.get());
+        resource->createScriptObject(m_frontend.get());
 }
 
 void InspectorController::identifierForInitialRequest(unsigned long identifier, DocumentLoader* loader, const ResourceRequest& request)
 {
     if (!enabled())
         return;
+    ASSERT(m_inspectedPage);
 
-    RefPtr<InspectorResource> resource = InspectorResource::create(identifier, loader, loader->frame());
+    bool isMainResource = isMainResourceLoader(loader, request.url());
+    ensureResourceTrackingSettingsLoaded();
+    if (!isMainResource && !m_resourceTrackingEnabled)
+        return;
 
-    updateResourceRequest(resource.get(), request);
+    RefPtr<InspectorResource> resource = InspectorResource::create(identifier, loader);
 
-    ASSERT(m_inspectedPage);
+    resource->updateRequest(request);
 
-    if (loader->frame() == m_inspectedPage->mainFrame() && request.url() == loader->requestURL())
+    if (isMainResource) {
         m_mainResource = resource;
+        resource->markMainResource();
+    }
 
     addResource(resource.get());
 
     if (windowVisible() && loader->isLoadingFromCachedPage() && resource == m_mainResource)
-        addAndUpdateScriptResource(resource.get());
+        resource->createScriptObject(m_frontend.get());
 }
 
-void InspectorController::willSendRequest(DocumentLoader*, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
+bool InspectorController::isMainResourceLoader(DocumentLoader* loader, const KURL& requestUrl)
 {
-    if (!enabled())
-        return;
+    return loader->frame() == m_inspectedPage->mainFrame() && requestUrl == loader->requestURL();
+}
 
-    InspectorResource* resource = m_resources.get(identifier).get();
+void InspectorController::willSendRequest(DocumentLoader*, unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
+{
+    RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
         return;
 
-    resource->startTime = currentTime();
+    resource->startTiming();
 
     if (!redirectResponse.isNull()) {
-        updateResourceRequest(resource, request);
-        updateResourceResponse(resource, redirectResponse);
+        resource->updateRequest(request);
+        resource->updateResponse(redirectResponse);
     }
 
-    if (resource != m_mainResource && windowVisible()) {
-        if (!resource->scriptObject)
-            addScriptResource(resource);
-        else
-            updateScriptResourceRequest(resource);
-
-        updateScriptResource(resource, resource->startTime, resource->responseReceivedTime, resource->endTime);
-
-        if (!redirectResponse.isNull())
-            updateScriptResourceResponse(resource);
-    }
+    if (resource != m_mainResource && windowVisible())
+        resource->createScriptObject(m_frontend.get());
 }
 
 void InspectorController::didReceiveResponse(DocumentLoader*, unsigned long identifier, const ResourceResponse& response)
 {
-    if (!enabled())
-        return;
-
-    InspectorResource* resource = m_resources.get(identifier).get();
+    RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
         return;
 
-    updateResourceResponse(resource, response);
-
-    resource->responseReceivedTime = currentTime();
+    resource->updateResponse(response);
+    resource->markResponseReceivedTime();
 
-    if (windowVisible() && resource->scriptObject) {
-        updateScriptResourceResponse(resource);
-        updateScriptResource(resource, resource->startTime, resource->responseReceivedTime, resource->endTime);
-    }
+    if (windowVisible())
+        resource->updateScriptObject(m_frontend.get());
 }
 
 void InspectorController::didReceiveContentLength(DocumentLoader*, unsigned long identifier, int lengthReceived)
 {
-    if (!enabled())
-        return;
-
-    InspectorResource* resource = m_resources.get(identifier).get();
+    RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
         return;
 
-    resource->length += lengthReceived;
+    resource->addLength(lengthReceived);
 
-    if (windowVisible() && resource->scriptObject)
-        updateScriptResource(resource, resource->length);
+    if (windowVisible())
+        resource->updateScriptObject(m_frontend.get());
 }
 
 void InspectorController::didFinishLoading(DocumentLoader*, unsigned long identifier)
 {
-    if (!enabled())
-        return;
-
-    RefPtr<InspectorResource> resource = m_resources.get(identifier);
+    RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
         return;
 
     removeResource(resource.get());
 
-    resource->finished = true;
-    resource->endTime = currentTime();
+    resource->endTiming();
 
     addResource(resource.get());
 
-    if (windowVisible() && resource->scriptObject) {
-        updateScriptResource(resource.get(), resource->startTime, resource->responseReceivedTime, resource->endTime);
-        updateScriptResource(resource.get(), resource->finished);
-    }
+    if (windowVisible())
+        resource->updateScriptObject(m_frontend.get());
 }
 
 void InspectorController::didFailLoading(DocumentLoader*, unsigned long identifier, const ResourceError& /*error*/)
 {
-    if (!enabled())
-        return;
-
-    RefPtr<InspectorResource> resource = m_resources.get(identifier);
+    RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
         return;
 
     removeResource(resource.get());
 
-    resource->finished = true;
-    resource->failed = true;
-    resource->endTime = currentTime();
+    resource->markFailed();
+    resource->endTiming();
 
     addResource(resource.get());
 
-    if (windowVisible() && resource->scriptObject) {
-        updateScriptResource(resource.get(), resource->startTime, resource->responseReceivedTime, resource->endTime);
-        updateScriptResource(resource.get(), resource->finished, resource->failed);
-    }
+    if (windowVisible())
+        resource->updateScriptObject(m_frontend.get());
 }
 
-void InspectorController::resourceRetrievedByXMLHttpRequest(unsigned long identifier, const JSC::UString& sourceString)
+void InspectorController::resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString)
 {
-    if (!enabled())
+    if (!enabled() || !m_resourceTrackingEnabled)
+        return;
+
+    InspectorResource* resource = m_resources.get(identifier).get();
+    if (!resource)
         return;
 
+    resource->setXMLHttpResponseText(sourceString);
+
+    if (windowVisible())
+        resource->updateScriptObject(m_frontend.get());
+}
+
+void InspectorController::scriptImported(unsigned long identifier, const String& sourceString)
+{
+    if (!enabled() || !m_resourceTrackingEnabled)
+        return;
+    
     InspectorResource* resource = m_resources.get(identifier).get();
     if (!resource)
         return;
+    
+    // FIXME: imported script and XHR response are currently viewed as the same
+    // thing by the Inspector. They should be made into distinct types.
+    resource->setXMLHttpResponseText(ScriptString(sourceString));
+    
+    if (windowVisible())
+        resource->updateScriptObject(m_frontend.get());
+}
+
+void InspectorController::enableResourceTracking(bool always) {
+    if (!enabled())
+        return;
+
+    if (always)
+        setSetting(resourceTrackingEnabledSettingName, Setting(true));
+
+    if (m_resourceTrackingEnabled)
+        return;
+
+    ASSERT(m_inspectedPage);
+    m_resourceTrackingEnabled = true;
+    if (m_frontend)
+        m_frontend->resourceTrackingWasEnabled();
+
+    m_inspectedPage->mainFrame()->loader()->reload();
+}
+
+void InspectorController::disableResourceTracking(bool always) {
+    if (!enabled())
+        return;
 
-    resource->setXMLHttpRequestProperties(sourceString);
+    if (always)
+        setSetting(resourceTrackingEnabledSettingName, Setting(false));
 
-    if (windowVisible() && resource->scriptObject)
-        updateScriptResourceType(resource);
+    ASSERT(m_inspectedPage);
+    m_resourceTrackingEnabled = false;
+    if (m_frontend)
+        m_frontend->resourceTrackingWasDisabled();
 }
 
+void InspectorController::ensureResourceTrackingSettingsLoaded()
+{
+    if (m_resourceTrackingSettingsLoaded)
+        return;
+    m_resourceTrackingSettingsLoaded = true;
+
+    Setting resourceTracking = setting(resourceTrackingEnabledSettingName);
+    if (resourceTracking.type() == Setting::BooleanType && resourceTracking.booleanValue())
+        m_resourceTrackingEnabled = true;
+}
 
 #if ENABLE(DATABASE)
 void InspectorController::didOpenDatabase(Database* database, const String& domain, const String& name, const String& version)
@@ -2566,7 +1040,27 @@ void InspectorController::didOpenDatabase(Database* database, const String& doma
     m_databaseResources.add(resource);
 
     if (windowVisible())
-        addDatabaseScriptResource(resource.get());
+        resource->bind(m_frontend.get());
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+void InspectorController::didUseDOMStorage(StorageArea* storageArea, bool isLocalStorage, Frame* frame)
+{
+    if (!enabled())
+        return;
+
+    DOMStorageResourcesSet::iterator domStorageEnd = m_domStorageResources.end();
+    for (DOMStorageResourcesSet::iterator it = m_domStorageResources.begin(); it != domStorageEnd; ++it)
+        if ((*it)->isSameHostAndType(frame, isLocalStorage))
+            return;
+
+    RefPtr<Storage> domStorage = Storage::create(frame, storageArea);
+    RefPtr<InspectorDOMStorageResource> resource = InspectorDOMStorageResource::create(domStorage.get(), isLocalStorage, frame);
+
+    m_domStorageResources.add(resource);
+    if (windowVisible())
+        resource->bind(m_frontend.get());
 }
 #endif
 
@@ -2581,32 +1075,183 @@ void InspectorController::moveWindowBy(float x, float y) const
 }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-void InspectorController::enableDebugger()
+void InspectorController::addProfile(PassRefPtr<Profile> prpProfile, unsigned lineNumber, const UString& sourceURL)
 {
     if (!enabled())
         return;
 
-    if (!m_scriptContext || !m_scriptObject) {
-        m_attachDebuggerWhenShown = true;
+    RefPtr<Profile> profile = prpProfile;
+    m_profiles.append(profile);
+
+    if (windowVisible())
+        addScriptProfile(profile.get());
+
+    addProfileFinishedMessageToConsole(profile, lineNumber, sourceURL);
+}
+
+void InspectorController::addProfileFinishedMessageToConsole(PassRefPtr<Profile> prpProfile, unsigned lineNumber, const UString& sourceURL)
+{
+    RefPtr<Profile> profile = prpProfile;
+
+    UString message = "Profile \"webkit-profile://";
+    message += encodeWithURLEscapeSequences(profile->title());
+    message += "/";
+    message += UString::from(profile->uid());
+    message += "\" finished.";
+    addMessageToConsole(JSMessageSource, LogMessageLevel, message, lineNumber, sourceURL);
+}
+
+void InspectorController::addStartProfilingMessageToConsole(const UString& title, unsigned lineNumber, const UString& sourceURL)
+{
+    UString message = "Profile \"webkit-profile://";
+    message += encodeWithURLEscapeSequences(title);
+    message += "/0\" started.";
+    addMessageToConsole(JSMessageSource, LogMessageLevel, message, lineNumber, sourceURL);
+}
+
+void InspectorController::addScriptProfile(Profile* profile)
+{
+    if (!m_frontend)
+        return;
+
+    JSLock lock(false);
+    m_frontend->addProfile(toJS(m_scriptState, profile));
+}
+
+UString InspectorController::getCurrentUserInitiatedProfileName(bool incrementProfileNumber = false)
+{
+    if (incrementProfileNumber)
+        m_currentUserInitiatedProfileNumber = m_nextUserInitiatedProfileNumber++;        
+
+    UString title = UserInitiatedProfileName;
+    title += ".";
+    title += UString::from(m_currentUserInitiatedProfileNumber);
+    
+    return title;
+}
+
+void InspectorController::startUserInitiatedProfilingSoon()
+{
+    m_startProfiling.startOneShot(0);
+}
+
+void InspectorController::startUserInitiatedProfiling(Timer<InspectorController>*)
+{
+    if (!enabled())
         return;
+
+    if (!profilerEnabled()) {
+        enableProfiler(false, true);
+        JavaScriptDebugServer::shared().recompileAllJSFunctions();
     }
 
+    m_recordingUserInitiatedProfile = true;
+
+    UString title = getCurrentUserInitiatedProfileName(true);
+
+    ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame())->globalExec();
+    Profiler::profiler()->startProfiling(scriptState, title);
+
+    addStartProfilingMessageToConsole(title, 0, UString());
+
+    toggleRecordButton(true);
+}
+
+void InspectorController::stopUserInitiatedProfiling()
+{
+    if (!enabled())
+        return;
+
+    m_recordingUserInitiatedProfile = false;
+
+    UString title = getCurrentUserInitiatedProfileName();
+
+    ExecState* scriptState = toJSDOMWindow(m_inspectedPage->mainFrame())->globalExec();
+    RefPtr<Profile> profile = Profiler::profiler()->stopProfiling(scriptState, title);
+    if (profile)
+        addProfile(profile, 0, UString());
+
+    toggleRecordButton(false);
+}
+
+void InspectorController::toggleRecordButton(bool isProfiling)
+{
+    if (!m_frontend)
+        return;
+    m_frontend->setRecordingProfile(isProfiling);
+}
+
+void InspectorController::enableProfiler(bool always, bool skipRecompile)
+{
+    if (always)
+        setSetting(profilerEnabledSettingName, Setting(true));
+
+    if (m_profilerEnabled)
+        return;
+
+    m_profilerEnabled = true;
+
+    if (!skipRecompile)
+        JavaScriptDebugServer::shared().recompileAllJSFunctionsSoon();
+
+    if (m_frontend)
+        m_frontend->profilerWasEnabled();
+}
+
+void InspectorController::disableProfiler(bool always)
+{
+    if (always)
+        setSetting(profilerEnabledSettingName, Setting(false));
+
+    if (!m_profilerEnabled)
+        return;
+
+    m_profilerEnabled = false;
+
+    JavaScriptDebugServer::shared().recompileAllJSFunctionsSoon();
+
+    if (m_frontend)
+        m_frontend->profilerWasDisabled();
+}
+
+void InspectorController::enableDebuggerFromFrontend(bool always)
+{
+    if (always)
+        setSetting(debuggerEnabledSettingName, Setting(true));
+
     ASSERT(m_inspectedPage);
 
     JavaScriptDebugServer::shared().addListener(this, m_inspectedPage);
     JavaScriptDebugServer::shared().clearBreakpoints();
 
     m_debuggerEnabled = true;
-    m_attachDebuggerWhenShown = false;
+    m_frontend->debuggerWasEnabled();
+}
+
+void InspectorController::enableDebugger()
+{
+    if (!enabled())
+        return;
 
-    callSimpleFunction(m_scriptContext, m_scriptObject, "debuggerWasEnabled");
+    if (m_debuggerEnabled)
+        return;
+
+    if (!m_scriptState || !m_frontend) {
+        m_attachDebuggerWhenShown = true;
+    } else {
+        m_frontend->attachDebuggerWhenShown();
+        m_attachDebuggerWhenShown = false;
+    }
 }
 
-void InspectorController::disableDebugger()
+void InspectorController::disableDebugger(bool always)
 {
     if (!enabled())
         return;
 
+    if (always)
+        setSetting(debuggerEnabledSettingName, Setting(false));
+
     ASSERT(m_inspectedPage);
 
     JavaScriptDebugServer::shared().removeListener(this, m_inspectedPage);
@@ -2614,8 +1259,8 @@ void InspectorController::disableDebugger()
     m_debuggerEnabled = false;
     m_attachDebuggerWhenShown = false;
 
-    if (m_scriptContext && m_scriptObject)
-        callSimpleFunction(m_scriptContext, m_scriptObject, "debuggerWasDisabled");
+    if (m_frontend)
+        m_frontend->debuggerWasDisabled();
 }
 
 JavaScriptCallFrame* InspectorController::currentCallFrame() const
@@ -2668,37 +1313,59 @@ void InspectorController::stepOutOfFunctionInDebugger()
     JavaScriptDebugServer::shared().stepOutOfFunction();
 }
 
-void InspectorController::addBreakpoint(intptr_t sourceID, unsigned lineNumber)
+void InspectorController::addBreakpoint(const String& sourceID, unsigned lineNumber)
 {
-    JavaScriptDebugServer::shared().addBreakpoint(sourceID, lineNumber);
+    intptr_t sourceIDValue = sourceID.toIntPtr();
+    JavaScriptDebugServer::shared().addBreakpoint(sourceIDValue, lineNumber);
 }
 
-void InspectorController::removeBreakpoint(intptr_t sourceID, unsigned lineNumber)
+void InspectorController::removeBreakpoint(const String& sourceID, unsigned lineNumber)
 {
-    JavaScriptDebugServer::shared().removeBreakpoint(sourceID, lineNumber);
+    intptr_t sourceIDValue = sourceID.toIntPtr();
+    JavaScriptDebugServer::shared().removeBreakpoint(sourceIDValue, lineNumber);
 }
-#endif
 
-static void drawOutlinedQuad(GraphicsContext& context, const FloatQuad& quad, const Color& fillColor)
+// JavaScriptDebugListener functions
+
+void InspectorController::didParseSource(ExecState*, const SourceCode& source)
 {
-    static const int outlineThickness = 2;
-    static const Color outlineColor(62, 86, 180, 228);
+    m_frontend->parsedScriptSource(source);
+}
 
+void InspectorController::failedToParseSource(ExecState*, const SourceCode& source, int errorLine, const UString& errorMessage)
+{
+    m_frontend->failedToParseScriptSource(source, errorLine, errorMessage);
+}
+
+void InspectorController::didPause()
+{
+    m_frontend->pausedScript();
+}
+
+void InspectorController::didContinue()
+{
+    m_frontend->resumedScript();
+}
+
+#endif
+
+static Path quadToPath(const FloatQuad& quad)
+{
     Path quadPath;
     quadPath.moveTo(quad.p1());
     quadPath.addLineTo(quad.p2());
     quadPath.addLineTo(quad.p3());
     quadPath.addLineTo(quad.p4());
     quadPath.closeSubpath();
-    
-    // Clear the quad
-    {
-        context.save();
-        context.setCompositeOperation(CompositeClear);
-        context.addPath(quadPath);
-        context.fillPath();
-        context.restore();
-    }
+    return quadPath;
+}
+
+static void drawOutlinedQuad(GraphicsContext& context, const FloatQuad& quad, const Color& fillColor)
+{
+    static const int outlineThickness = 2;
+    static const Color outlineColor(62, 86, 180, 228);
+
+    Path quadPath = quadToPath(quad);
 
     // Clip out the quad, then draw with a 2px stroke to get a pixel
     // of outline (because inflating a quad is hard)
@@ -2721,29 +1388,40 @@ static void drawOutlinedQuad(GraphicsContext& context, const FloatQuad& quad, co
     context.fillPath();
 }
 
-static void drawHighlightForBoxes(GraphicsContext& context, const Vector<FloatQuad>& lineBoxQuads, const FloatQuad& contentQuad, const FloatQuad& paddingQuad, const FloatQuad& borderQuad, const FloatQuad& marginQuad)
+static void drawOutlinedQuadWithClip(GraphicsContext& context, const FloatQuad& quad, const FloatQuad& clipQuad, const Color& fillColor)
+{
+    context.save();
+    Path clipQuadPath = quadToPath(clipQuad);
+    context.clipOut(clipQuadPath);
+    drawOutlinedQuad(context, quad, fillColor);
+    context.restore();
+}
+
+static void drawHighlightForBox(GraphicsContext& context, const FloatQuad& contentQuad, const FloatQuad& paddingQuad, const FloatQuad& borderQuad, const FloatQuad& marginQuad)
 {
     static const Color contentBoxColor(125, 173, 217, 128);
     static const Color paddingBoxColor(125, 173, 217, 160);
     static const Color borderBoxColor(125, 173, 217, 192);
     static const Color marginBoxColor(125, 173, 217, 228);
 
-    if (!lineBoxQuads.isEmpty()) {
-        for (size_t i = 0; i < lineBoxQuads.size(); ++i)
-            drawOutlinedQuad(context, lineBoxQuads[i], contentBoxColor);
-        return;
-    }
-
     if (marginQuad != borderQuad)
-        drawOutlinedQuad(context, marginQuad, marginBoxColor);
+        drawOutlinedQuadWithClip(context, marginQuad, borderQuad, marginBoxColor);
     if (borderQuad != paddingQuad)
-        drawOutlinedQuad(context, borderQuad, borderBoxColor);
+        drawOutlinedQuadWithClip(context, borderQuad, paddingQuad, borderBoxColor);
     if (paddingQuad != contentQuad)
-        drawOutlinedQuad(context, paddingQuad, paddingBoxColor);
+        drawOutlinedQuadWithClip(context, paddingQuad, contentQuad, paddingBoxColor);
 
     drawOutlinedQuad(context, contentQuad, contentBoxColor);
 }
 
+static void drawHighlightForLineBoxes(GraphicsContext& context, const Vector<FloatQuad>& lineBoxQuads)
+{
+    static const Color lineBoxColor(125, 173, 217, 128);
+
+    for (size_t i = 0; i < lineBoxQuads.size(); ++i)
+        drawOutlinedQuad(context, lineBoxQuads[i], lineBoxColor);
+}
+
 static inline void convertFromFrameToMainFrame(Frame* frame, IntRect& rect)
 {
     rect = frame->page()->mainFrame()->view()->windowToContents(frame->view()->contentsToWindow(rect));
@@ -2765,66 +1443,52 @@ void InspectorController::drawNodeHighlight(GraphicsContext& context) const
     if (!renderer || !containingFrame)
         return;
 
-    IntRect contentBox = renderer->contentBox();
-
-    // FIXME: Should we add methods to RenderObject to obtain these rects?
-    IntRect paddingBox(contentBox.x() - renderer->paddingLeft(), contentBox.y() - renderer->paddingTop(),
-                       contentBox.width() + renderer->paddingLeft() + renderer->paddingRight(), contentBox.height() + renderer->paddingTop() + renderer->paddingBottom());
-    IntRect borderBox(paddingBox.x() - renderer->borderLeft(), paddingBox.y() - renderer->borderTop(),
-                      paddingBox.width() + renderer->borderLeft() + renderer->borderRight(), paddingBox.height() + renderer->borderTop() + renderer->borderBottom());
-    IntRect marginBox(borderBox.x() - renderer->marginLeft(), borderBox.y() - renderer->marginTop(),
-                      borderBox.width() + renderer->marginLeft() + renderer->marginRight(), borderBox.height() + renderer->marginTop() + renderer->marginBottom());
-
-
     IntSize mainFrameOffset = frameToMainFrameOffset(containingFrame);
-
-    FloatQuad absContentQuad = renderer->localToAbsoluteQuad(FloatRect(contentBox));
-    FloatQuad absPaddingQuad = renderer->localToAbsoluteQuad(FloatRect(paddingBox));
-    FloatQuad absBorderQuad = renderer->localToAbsoluteQuad(FloatRect(borderBox));
-    FloatQuad absMarginQuad = renderer->localToAbsoluteQuad(FloatRect(marginBox));
-
-    absContentQuad.move(mainFrameOffset);
-    absPaddingQuad.move(mainFrameOffset);
-    absBorderQuad.move(mainFrameOffset);
-    absMarginQuad.move(mainFrameOffset);
-
     IntRect boundingBox = renderer->absoluteBoundingBoxRect(true);
     boundingBox.move(mainFrameOffset);
 
-    Vector<FloatQuad> lineBoxQuads;
-    if (renderer->isInline() || (renderer->isText() && !m_highlightedNode->isSVGElement())) {
-        // FIXME: We should show margins/padding/border for inlines.
-        renderer->collectAbsoluteLineBoxQuads(lineBoxQuads);
-    }
-
-    for (unsigned i = 0; i < lineBoxQuads.size(); ++i)
-        lineBoxQuads[i] += mainFrameOffset;
-
-    if (lineBoxQuads.isEmpty() && contentBox.isEmpty()) {
-        // If we have no line boxes and our content box is empty, we'll just draw our bounding box.
-        // This can happen, e.g., with an <a> enclosing an <img style="float:right">.
-        // FIXME: Can we make this better/more accurate? The <a> in the above case has no
-        // width/height but the highlight makes it appear to be the size of the <img>.
-        lineBoxQuads.append(FloatRect(boundingBox));
-    }
-
     ASSERT(m_inspectedPage);
 
     FrameView* view = m_inspectedPage->mainFrame()->view();
     FloatRect overlayRect = view->visibleContentRect();
-
-    if (!overlayRect.contains(boundingBox) && !boundingBox.contains(enclosingIntRect(overlayRect))) {
-        Element* element;
-        if (m_highlightedNode->isElementNode())
-            element = static_cast<Element*>(m_highlightedNode.get());
-        else
-            element = static_cast<Element*>(m_highlightedNode->parent());
+    if (!overlayRect.contains(boundingBox) && !boundingBox.contains(enclosingIntRect(overlayRect)))
         overlayRect = view->visibleContentRect();
-    }
-
     context.translate(-overlayRect.x(), -overlayRect.y());
 
-    drawHighlightForBoxes(context, lineBoxQuads, absContentQuad, absPaddingQuad, absBorderQuad, absMarginQuad);
+    if (renderer->isBox()) {
+        RenderBox* renderBox = toRenderBox(renderer);
+
+        IntRect contentBox = renderBox->contentBoxRect();
+
+        IntRect paddingBox(contentBox.x() - renderBox->paddingLeft(), contentBox.y() - renderBox->paddingTop(),
+                           contentBox.width() + renderBox->paddingLeft() + renderBox->paddingRight(), contentBox.height() + renderBox->paddingTop() + renderBox->paddingBottom());
+        IntRect borderBox(paddingBox.x() - renderBox->borderLeft(), paddingBox.y() - renderBox->borderTop(),
+                          paddingBox.width() + renderBox->borderLeft() + renderBox->borderRight(), paddingBox.height() + renderBox->borderTop() + renderBox->borderBottom());
+        IntRect marginBox(borderBox.x() - renderBox->marginLeft(), borderBox.y() - renderBox->marginTop(),
+                          borderBox.width() + renderBox->marginLeft() + renderBox->marginRight(), borderBox.height() + renderBox->marginTop() + renderBox->marginBottom());
+
+        FloatQuad absContentQuad = renderBox->localToAbsoluteQuad(FloatRect(contentBox));
+        FloatQuad absPaddingQuad = renderBox->localToAbsoluteQuad(FloatRect(paddingBox));
+        FloatQuad absBorderQuad = renderBox->localToAbsoluteQuad(FloatRect(borderBox));
+        FloatQuad absMarginQuad = renderBox->localToAbsoluteQuad(FloatRect(marginBox));
+
+        absContentQuad.move(mainFrameOffset);
+        absPaddingQuad.move(mainFrameOffset);
+        absBorderQuad.move(mainFrameOffset);
+        absMarginQuad.move(mainFrameOffset);
+
+        drawHighlightForBox(context, absContentQuad, absPaddingQuad, absBorderQuad, absMarginQuad);
+    } else if (renderer->isRenderInline()) {
+        RenderInline* renderInline = toRenderInline(renderer);
+
+        // FIXME: We should show margins/padding/border for inlines.
+        Vector<FloatQuad> lineBoxQuads;
+        renderInline->absoluteQuads(lineBoxQuads);
+        for (unsigned i = 0; i < lineBoxQuads.size(); ++i)
+            lineBoxQuads[i] += mainFrameOffset;
+
+        drawHighlightForLineBoxes(context, lineBoxQuads);
+    }
 }
 
 void InspectorController::count(const String& title, unsigned lineNumber, const String& sourceID)
@@ -2863,66 +1527,4 @@ bool InspectorController::stopTiming(const String& title, double& elapsed)
     return true;
 }
 
-bool InspectorController::handleException(JSContextRef context, JSValueRef exception, unsigned lineNumber) const
-{
-    if (!exception)
-        return false;
-
-    if (!m_page)
-        return true;
-
-    String message = toString(context, exception, 0);
-    String file(__FILE__);
-
-    if (JSObjectRef exceptionObject = JSValueToObject(context, exception, 0)) {
-        JSValueRef lineValue = JSObjectGetProperty(context, exceptionObject, jsStringRef("line").get(), NULL);
-        if (lineValue)
-            lineNumber = static_cast<unsigned>(JSValueToNumber(context, lineValue, 0));
-
-        JSValueRef fileValue = JSObjectGetProperty(context, exceptionObject, jsStringRef("sourceURL").get(), NULL);
-        if (fileValue)
-            file = toString(context, fileValue, 0);
-    }
-
-    m_page->mainFrame()->domWindow()->console()->addMessage(JSMessageSource, ErrorMessageLevel, message, lineNumber, file);
-    return true;
-}
-
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-
-// JavaScriptDebugListener functions
-
-void InspectorController::didParseSource(ExecState*, const SourceCode& source)
-{
-    JSValueRef sourceIDValue = JSValueMakeNumber(m_scriptContext, source.provider()->asID());
-    JSValueRef sourceURLValue = JSValueMakeString(m_scriptContext, jsStringRef(source.provider()->url()).get());
-    JSValueRef sourceValue = JSValueMakeString(m_scriptContext, jsStringRef(source).get());
-    JSValueRef firstLineValue = JSValueMakeNumber(m_scriptContext, source.firstLine());
-
-    JSValueRef exception = 0;
-    JSValueRef arguments[] = { sourceIDValue, sourceURLValue, sourceValue, firstLineValue };
-    callFunction(m_scriptContext, m_scriptObject, "parsedScriptSource", 4, arguments, exception);
-}
-
-void InspectorController::failedToParseSource(ExecState*, const SourceCode& source, int errorLine, const UString& errorMessage)
-{
-    JSValueRef sourceURLValue = JSValueMakeString(m_scriptContext, jsStringRef(source.provider()->url()).get());
-    JSValueRef sourceValue = JSValueMakeString(m_scriptContext, jsStringRef(source.data()).get());
-    JSValueRef firstLineValue = JSValueMakeNumber(m_scriptContext, source.firstLine());
-    JSValueRef errorLineValue = JSValueMakeNumber(m_scriptContext, errorLine);
-    JSValueRef errorMessageValue = JSValueMakeString(m_scriptContext, jsStringRef(errorMessage).get());
-
-    JSValueRef exception = 0;
-    JSValueRef arguments[] = { sourceURLValue, sourceValue, firstLineValue, errorLineValue, errorMessageValue };
-    callFunction(m_scriptContext, m_scriptObject, "failedToParseScriptSource", 5, arguments, exception);
-}
-
-void InspectorController::didPause()
-{
-    JSValueRef exception = 0;
-    callFunction(m_scriptContext, m_scriptObject, "pausedScript", 0, 0, exception);
-}
-
-#endif
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorController.h b/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
index e52bee9..8ba8669 100644
--- a/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorController.h
@@ -31,22 +31,23 @@
 
 #include "Console.h"
 #include "PlatformString.h"
+#include "ScriptState.h"
 #include "StringHash.h"
 #include "Timer.h"
-#include <JavaScriptCore/JSContextRef.h>
+
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
+#include <wtf/RefCounted.h>
 #include <wtf/Vector.h>
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
 #include "JavaScriptDebugListener.h"
-#endif
-
 
 namespace JSC {
     class Profile;
     class UString;
 }
+#endif
 
 namespace WebCore {
 
@@ -56,28 +57,35 @@ class DocumentLoader;
 class GraphicsContext;
 class HitTestResult;
 class InspectorClient;
+class InspectorFrontend;
 class JavaScriptCallFrame;
+class StorageArea;
+class KURL;
 class Node;
 class Page;
-class ResourceRequest;
+struct ResourceRequest;
 class ResourceResponse;
 class ResourceError;
 class ScriptCallStack;
+class ScriptObject;
+class ScriptString;
 class SharedBuffer;
 
-struct ConsoleMessage;
-struct InspectorDatabaseResource;
-struct InspectorResource;
+class ConsoleMessage;
+class InspectorDatabaseResource;
+class InspectorDOMStorageResource;
+class InspectorResource;
 
-class InspectorController
+class InspectorController : public RefCounted<InspectorController>
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-                          : JavaScriptDebugListener
+                          , JavaScriptDebugListener
 #endif
                                                     {
 public:
     typedef HashMap<long long, RefPtr<InspectorResource> > ResourcesMap;
     typedef HashMap<RefPtr<Frame>, ResourcesMap*> FrameResourcesMap;
     typedef HashSet<RefPtr<InspectorDatabaseResource> > DatabaseResourcesSet;
+    typedef HashSet<RefPtr<InspectorDOMStorageResource> > DOMStorageResourcesSet;
 
     typedef enum {
         CurrentPanel,
@@ -99,6 +107,12 @@ public:
         {
         }
 
+        explicit Setting(bool value)
+            : m_type(BooleanType)
+        {
+            m_simpleContent.m_boolean = value;
+        }
+
         Type type() const { return m_type; }
 
         String string() const { ASSERT(m_type == StringType); return m_string; }
@@ -126,7 +140,11 @@ public:
         } m_simpleContent;
     };
 
-    InspectorController(Page*, InspectorClient*);
+    static PassRefPtr<InspectorController> create(Page* page, InspectorClient* inspectorClient)
+    {
+        return adoptRef(new InspectorController(page, inspectorClient));
+    }
+
     ~InspectorController();
 
     void inspectedPageDestroyed();
@@ -140,6 +158,7 @@ public:
     void setSetting(const String& key, const Setting&);
 
     String localizedStringsURL();
+    String hiddenPanels();
 
     void inspect(Node*);
     void highlight(Node*);
@@ -149,27 +168,14 @@ public:
     void showPanel(SpecialPanels);
     void close();
 
-    bool isRecordingUserInitiatedProfile() const { return m_recordingUserInitiatedProfile; }
-    void startUserInitiatedProfilingSoon();
-    void startUserInitiatedProfiling(Timer<InspectorController>* = 0);
-    void stopUserInitiatedProfiling();
-
-    void enableProfiler(bool skipRecompile = false);
-    void disableProfiler();
-    bool profilerEnabled() const { return enabled() && m_profilerEnabled; }
-
     bool windowVisible();
     void setWindowVisible(bool visible = true, bool attached = false);
 
+    void addResourceSourceToFrame(long identifier, Node* frame);
+    bool addSourceToFrame(const String& mimeType, const String& source, Node*);
     void addMessageToConsole(MessageSource, MessageLevel, ScriptCallStack*);
     void addMessageToConsole(MessageSource, MessageLevel, const String& message, unsigned lineNumber, const String& sourceID);
     void clearConsoleMessages();
-    void toggleRecordButton(bool);
-
-    void addProfile(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
-    void addProfileMessageToConsole(PassRefPtr<JSC::Profile> prpProfile, unsigned lineNumber, const JSC::UString& sourceURL);
-    void addScriptProfile(JSC::Profile* profile);
-    const ProfilesArray& profiles() const { return m_profiles; }
 
     void attachWindow();
     void detachWindow();
@@ -182,13 +188,11 @@ public:
     void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
     void handleMousePressOnNode(Node*);
 
-    JSContextRef scriptContext() const { return m_scriptContext; };
-    void setScriptContext(JSContextRef context) { m_scriptContext = context; };
-
     void inspectedWindowScriptObjectCleared(Frame*);
     void windowScriptObjectAvailable();
 
     void scriptObjectReady();
+    void setFrontendProxyObject(ScriptState* state, ScriptObject object);
 
     void populateScriptObjects();
     void resetScriptObjects();
@@ -204,26 +208,66 @@ public:
     void didReceiveContentLength(DocumentLoader*, unsigned long identifier, int lengthReceived);
     void didFinishLoading(DocumentLoader*, unsigned long identifier);
     void didFailLoading(DocumentLoader*, unsigned long identifier, const ResourceError&);
-    void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const JSC::UString& sourceString);
+    void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
+    void scriptImported(unsigned long identifier, const String& sourceString);
+
+    void enableResourceTracking(bool always = false);
+    void disableResourceTracking(bool always = false);
+    bool resourceTrackingEnabled() const { return m_resourceTrackingEnabled; }
+    void ensureResourceTrackingSettingsLoaded();
 
 #if ENABLE(DATABASE)
     void didOpenDatabase(Database*, const String& domain, const String& name, const String& version);
 #endif
+#if ENABLE(DOM_STORAGE)
+    void didUseDOMStorage(StorageArea* storageArea, bool isLocalStorage, Frame* frame);
+#endif
 
     const ResourcesMap& resources() const { return m_resources; }
 
     void moveWindowBy(float x, float y) const;
     void closeWindow();
 
+    void drawNodeHighlight(GraphicsContext&) const;
+
+    void count(const String& title, unsigned lineNumber, const String& sourceID);
+
+    void startTiming(const String& title);
+    bool stopTiming(const String& title, double& elapsed);
+
+    void startGroup(MessageSource source, ScriptCallStack* callFrame);
+    void endGroup(MessageSource source, unsigned lineNumber, const String& sourceURL);
+
+    const String& platform() const;
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
+    void addProfile(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
+    void addProfileFinishedMessageToConsole(PassRefPtr<JSC::Profile>, unsigned lineNumber, const JSC::UString& sourceURL);
+    void addStartProfilingMessageToConsole(const JSC::UString& title, unsigned lineNumber, const JSC::UString& sourceURL);
+    void addScriptProfile(JSC::Profile*);
+    const ProfilesArray& profiles() const { return m_profiles; }
+
+    bool isRecordingUserInitiatedProfile() const { return m_recordingUserInitiatedProfile; }
+
+    JSC::UString getCurrentUserInitiatedProfileName(bool incrementProfileNumber);
+    void startUserInitiatedProfilingSoon();
+    void startUserInitiatedProfiling(Timer<InspectorController>* = 0);
+    void stopUserInitiatedProfiling();
+    void toggleRecordButton(bool);
+
+    void enableProfiler(bool always = false, bool skipRecompile = false);
+    void disableProfiler(bool always = false);
+    bool profilerEnabled() const { return enabled() && m_profilerEnabled; }
+
+    void enableDebuggerFromFrontend(bool always);
     void enableDebugger();
-    void disableDebugger();
+    void disableDebugger(bool always = false);
     bool debuggerEnabled() const { return m_debuggerEnabled; }
 
     JavaScriptCallFrame* currentCallFrame() const;
 
-    void addBreakpoint(intptr_t sourceID, unsigned lineNumber);
-    void removeBreakpoint(intptr_t sourceID, unsigned lineNumber);
+    void addBreakpoint(const String& sourceID, unsigned lineNumber);
+    void removeBreakpoint(const String& sourceID, unsigned lineNumber);
 
     bool pauseOnExceptions();
     void setPauseOnExceptions(bool pause);
@@ -234,61 +278,34 @@ public:
     void stepOverStatementInDebugger();
     void stepIntoStatementInDebugger();
     void stepOutOfFunctionInDebugger();
-#endif
-
-    void drawNodeHighlight(GraphicsContext&) const;
-    
-    void count(const String& title, unsigned lineNumber, const String& sourceID);
-
-    void startTiming(const String& title);
-    bool stopTiming(const String& title, double& elapsed);
 
-    void startGroup(MessageSource source, ScriptCallStack* callFrame);
-    void endGroup(MessageSource source, unsigned lineNumber, const String& sourceURL);
+    virtual void didParseSource(JSC::ExecState*, const JSC::SourceCode&);
+    virtual void failedToParseSource(JSC::ExecState*, const JSC::SourceCode&, int errorLine, const JSC::UString& errorMessage);
+    virtual void didPause();
+    virtual void didContinue();
+#endif
 
 private:
+    InspectorController(Page*, InspectorClient*);
+
     void focusNode();
 
-    void addConsoleMessage(JSC::ExecState*, ConsoleMessage*);
-    void addScriptConsoleMessage(const ConsoleMessage*);
+    void addConsoleMessage(ScriptState*, ConsoleMessage*);
 
     void addResource(InspectorResource*);
     void removeResource(InspectorResource*);
-
-    JSObjectRef addScriptResource(InspectorResource*);
-    void removeScriptResource(InspectorResource*);
-
-    JSObjectRef addAndUpdateScriptResource(InspectorResource*);
-    void updateScriptResourceRequest(InspectorResource*);
-    void updateScriptResourceResponse(InspectorResource*);
-    void updateScriptResourceType(InspectorResource*);
-    void updateScriptResource(InspectorResource*, int length);
-    void updateScriptResource(InspectorResource*, bool finished, bool failed = false);
-    void updateScriptResource(InspectorResource*, double startTime, double responseReceivedTime, double endTime);
+    InspectorResource* getTrackedResource(long long identifier);
 
     void pruneResources(ResourcesMap*, DocumentLoader* loaderToKeep = 0);
     void removeAllResources(ResourcesMap* map) { pruneResources(map); }
 
-#if ENABLE(DATABASE)
-    JSObjectRef addDatabaseScriptResource(InspectorDatabaseResource*);
-    void removeDatabaseScriptResource(InspectorDatabaseResource*);
-#endif
-
-    JSValueRef callSimpleFunction(JSContextRef, JSObjectRef thisObject, const char* functionName) const;
-    JSValueRef callFunction(JSContextRef, JSObjectRef thisObject, const char* functionName, size_t argumentCount, const JSValueRef arguments[], JSValueRef& exception) const;
-
-    bool handleException(JSContextRef, JSValueRef exception, unsigned lineNumber) const;
-
     void showWindow();
 
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    virtual void didParseSource(JSC::ExecState*, const JSC::SourceCode&);
-    virtual void failedToParseSource(JSC::ExecState*, const JSC::SourceCode&, int errorLine, const JSC::UString& errorMessage);
-    virtual void didPause();
-#endif
+    bool isMainResourceLoader(DocumentLoader* loader, const KURL& requestUrl);
 
     Page* m_inspectedPage;
     InspectorClient* m_client;
+    OwnPtr<InspectorFrontend> m_frontend;
     Page* m_page;
     RefPtr<Node> m_nodeToFocus;
     RefPtr<InspectorResource> m_mainResource;
@@ -296,31 +313,34 @@ private:
     HashSet<String> m_knownResources;
     FrameResourcesMap m_frameResources;
     Vector<ConsoleMessage*> m_consoleMessages;
-    ProfilesArray m_profiles;
     HashMap<String, double> m_times;
     HashMap<String, unsigned> m_counts;
 #if ENABLE(DATABASE)
     DatabaseResourcesSet m_databaseResources;
 #endif
-    JSObjectRef m_scriptObject;
-    JSObjectRef m_controllerScriptObject;
-    JSContextRef m_scriptContext;
-    bool m_windowVisible;
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    bool m_debuggerEnabled;
-    bool m_attachDebuggerWhenShown;
+#if ENABLE(DOM_STORAGE)
+    DOMStorageResourcesSet m_domStorageResources;
 #endif
-    bool m_profilerEnabled;
-    bool m_recordingUserInitiatedProfile;
+    ScriptState* m_scriptState;
+    bool m_windowVisible;
     SpecialPanels m_showAfterVisible;
     long long m_nextIdentifier;
     RefPtr<Node> m_highlightedNode;
     unsigned m_groupLevel;
     bool m_searchingForNode;
+    ConsoleMessage* m_previousMessage;
+    bool m_resourceTrackingEnabled;
+    bool m_resourceTrackingSettingsLoaded;
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    bool m_debuggerEnabled;
+    bool m_attachDebuggerWhenShown;
+    bool m_profilerEnabled;
+    bool m_recordingUserInitiatedProfile;
     int m_currentUserInitiatedProfileNumber;
     unsigned m_nextUserInitiatedProfileNumber;
-    ConsoleMessage* m_previousMessage;
     Timer<InspectorController> m_startProfiling;
+    ProfilesArray m_profiles;
+#endif
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorController.idl b/src/3rdparty/webkit/WebCore/inspector/InspectorController.idl
new file mode 100644
index 0000000..c626305
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorController.idl
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+    interface [
+        GenerateConstructor
+    ] InspectorController {
+        [ImplementationFunction=hideHighlight] void hideDOMNodeHighlight();
+        [Custom] void highlightDOMNode(in Node node);
+        [ImplementationFunction=scriptObjectReady] void loaded();
+        [ImplementationFunction=close] void windowUnloading();
+        [ImplementationFunction=attachWindow] void attach();
+        [ImplementationFunction=detachWindow] void detach();
+
+        void closeWindow();
+        [ImplementationFunction=clearConsoleMessages] void clearMessages();
+        [ImplementationFunction=toggleSearchForNodeInPage] void toggleNodeSearch();
+
+        [ImplementationFunction=windowVisible] boolean isWindowVisible();
+        [ImplementationFunction=searchingForNodeInPage] boolean searchingForNode();
+
+        void addResourceSourceToFrame(in long identifier, in Node frame);
+        boolean addSourceToFrame(in DOMString mimeType, in DOMString sourceValue, in Node frame);
+        [Custom] Node getResourceDocumentNode(in long long identifier);
+        [Custom] void search(in Node node, in DOMString query);
+#if defined(ENABLE_DATABASE) && ENABLE_DATABASE
+        [Custom] DOMObject databaseTableNames(in Database database);
+#endif
+        [Custom] DOMObject setting(in DOMString key);
+        [Custom] void setSetting(in DOMString key, in DOMObject  value);
+        [Custom] DOMWindow inspectedWindow();
+        DOMString localizedStringsURL();
+        DOMString hiddenPanels();
+        DOMString platform();
+        [ImplementationFunction=moveWindowBy] void moveByUnrestricted(in float x, in float y);
+        void setAttachedWindowHeight(in unsigned long height);
+        [Custom] DOMObject wrapCallback(in DOMObject callback);
+        boolean resourceTrackingEnabled();
+        void enableResourceTracking(in boolean always);
+        void disableResourceTracking(in boolean always);
+
+#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
+        void enableDebuggerFromFrontend(in boolean always);
+        void disableDebugger(in boolean always);
+        void pauseInDebugger();
+        void resumeDebugger();
+        void stepOverStatementInDebugger();
+        void stepIntoStatementInDebugger();
+        void stepOutOfFunctionInDebugger();
+        boolean debuggerEnabled();
+        boolean pauseOnExceptions();
+        boolean profilerEnabled();
+        [ImplementationFunction=startUserInitiatedProfiling] void startProfiling();
+        [ImplementationFunction=stopUserInitiatedProfiling] void stopProfiling();
+        void enableProfiler(in boolean always);
+        void disableProfiler(in boolean always);
+        [Custom] DOMObject currentCallFrame();
+        void setPauseOnExceptions(in boolean pauseOnExceptions);
+        void addBreakpoint(in DOMString sourceID, in unsigned long lineNumber);
+        void removeBreakpoint(in DOMString sourceID, in unsigned long lineNumber);
+
+        [Custom] Array profiles();
+#endif
+     };
+ }
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp
new file mode 100644
index 0000000..b808a84
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if ENABLE(DOM_STORAGE)
+
+#include "InspectorDOMStorageResource.h"
+
+#include "Document.h"
+#include "Frame.h"
+#include "InspectorFrontend.h"
+#include "InspectorJSONObject.h"
+#include "ScriptObjectQuarantine.h"
+#include "Storage.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+InspectorDOMStorageResource::InspectorDOMStorageResource(Storage* domStorage, bool isLocalStorage, Frame* frame)
+    : m_domStorage(domStorage)
+    , m_isLocalStorage(isLocalStorage)
+    , m_frame(frame)
+    , m_scriptObjectCreated(false)
+{
+}
+
+bool InspectorDOMStorageResource::isSameHostAndType(Frame* frame, bool isLocalStorage) const
+{
+    return equalIgnoringCase(m_frame->document()->securityOrigin()->host(), frame->document()->securityOrigin()->host()) && m_isLocalStorage == isLocalStorage;
+}
+
+void InspectorDOMStorageResource::bind(InspectorFrontend* frontend)
+{
+    if (m_scriptObjectCreated)
+        return;
+
+    InspectorJSONObject jsonObject = frontend->newInspectorJSONObject();
+    ScriptObject domStorage;
+    if (!getQuarantinedScriptObject(m_frame.get(), m_domStorage.get(), domStorage))
+        return;
+    jsonObject.set("domStorage", domStorage);
+    jsonObject.set("host", m_frame->document()->securityOrigin()->host());
+    jsonObject.set("isLocalStorage", m_isLocalStorage);
+    if (frontend->addDOMStorage(jsonObject))
+        m_scriptObjectCreated = true;
+}
+
+void InspectorDOMStorageResource::unbind()
+{
+    m_scriptObjectCreated = false;
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.h b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.h
new file mode 100644
index 0000000..3e05897
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDOMStorageResource.h
@@ -0,0 +1,76 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InspectorDOMStorageResource_h
+#define InspectorDOMStorageResource_h
+
+#if ENABLE(DOM_STORAGE)
+
+#include "ScriptObject.h"
+#include "ScriptState.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+    class Storage;
+    class Frame;
+    class InspectorFrontend;
+
+    class InspectorDOMStorageResource : public RefCounted<InspectorDOMStorageResource> {
+    public:
+        static PassRefPtr<InspectorDOMStorageResource> create(Storage* domStorage, bool isLocalStorage, Frame* frame)
+        {
+            return adoptRef(new InspectorDOMStorageResource(domStorage, isLocalStorage, frame));
+        }
+
+        void bind(InspectorFrontend* frontend);
+        void unbind();
+
+        bool isSameHostAndType(Frame*, bool isLocalStorage) const;
+
+    private:
+
+        InspectorDOMStorageResource(Storage*, bool isLocalStorage, Frame*);
+
+        RefPtr<Storage> m_domStorage;
+        bool m_isLocalStorage;
+        RefPtr<Frame> m_frame;
+        bool m_scriptObjectCreated;
+
+    };
+
+} // namespace WebCore
+
+#endif
+
+#endif // InspectorDOMStorageResource_h
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.cpp
new file mode 100644
index 0000000..c75ca87
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#if ENABLE(DATABASE)
+#include "InspectorDatabaseResource.h"
+
+#include "Database.h"
+#include "Document.h"
+#include "Frame.h"
+#include "InspectorFrontend.h"
+#include "InspectorJSONObject.h"
+#include "ScriptObjectQuarantine.h"
+
+
+namespace WebCore {
+
+InspectorDatabaseResource::InspectorDatabaseResource(Database* database, const String& domain, const String& name, const String& version)
+    : m_database(database)
+    , m_domain(domain)
+    , m_name(name)
+    , m_version(version)
+    , m_scriptObjectCreated(false)
+{
+}
+
+void InspectorDatabaseResource::bind(InspectorFrontend* frontend)
+{
+    if (m_scriptObjectCreated)
+        return;
+
+    InspectorJSONObject jsonObject = frontend->newInspectorJSONObject();
+    ScriptObject database;
+    if (!getQuarantinedScriptObject(m_database.get(), database))
+        return;
+    jsonObject.set("database", database);
+    jsonObject.set("domain", m_domain);
+    jsonObject.set("name", m_name);
+    jsonObject.set("version", m_version);
+    if (frontend->addDatabase(jsonObject))
+        m_scriptObjectCreated = true;
+}
+
+void InspectorDatabaseResource::unbind()
+{
+    m_scriptObjectCreated = false;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(DATABASE)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.h b/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.h
new file mode 100644
index 0000000..38f9fa1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorDatabaseResource.h
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InspectorDatabaseResource_h
+#define InspectorDatabaseResource_h
+
+#if ENABLE(DATABASE)
+
+#include "Database.h"
+#include "ScriptObject.h"
+#include "ScriptState.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+    class InspectorFrontend;
+    
+    class InspectorDatabaseResource : public RefCounted<InspectorDatabaseResource> {
+    public:
+        static PassRefPtr<InspectorDatabaseResource> create(Database* database, const String& domain, const String& name, const String& version)
+        {
+            return adoptRef(new InspectorDatabaseResource(database, domain, name, version));
+        }
+
+        void bind(InspectorFrontend* frontend);
+        void unbind();
+
+    private:
+        InspectorDatabaseResource(Database*, const String& domain, const String& name, const String& version);
+        
+        RefPtr<Database> m_database;
+        String m_domain;
+        String m_name;
+        String m_version;
+        bool m_scriptObjectCreated;
+
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(DATABASE)
+
+#endif // InspectorDatabaseResource_h
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp
new file mode 100644
index 0000000..255f1d8
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.cpp
@@ -0,0 +1,298 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorFrontend.h"
+
+#include "ConsoleMessage.h"
+#include "Frame.h"
+#include "InspectorController.h"  // TODO(pfeldman): Extract SpecialPanels to remove include.
+#include "InspectorJSONObject.h"
+#include "Node.h"
+#include "ScriptFunctionCall.h"
+#include "ScriptObject.h"
+#include "ScriptObjectQuarantine.h"
+#include "ScriptState.h"
+#include "ScriptString.h"
+#include <wtf/OwnPtr.h>
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+#include <parser/SourceCode.h>
+#include <runtime/JSValue.h>
+#include <runtime/UString.h>
+#endif
+
+namespace WebCore {
+
+InspectorFrontend::InspectorFrontend(ScriptState* scriptState, ScriptObject webInspector)
+    : m_scriptState(scriptState)
+    , m_webInspector(webInspector)
+{
+}
+
+InspectorFrontend::~InspectorFrontend() 
+{
+    m_webInspector = ScriptObject();
+}
+
+InspectorJSONObject InspectorFrontend::newInspectorJSONObject() {
+    return InspectorJSONObject::createNew(m_scriptState);
+}
+
+void InspectorFrontend::addMessageToConsole(const InspectorJSONObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addMessageToConsole"));
+    function->appendArgument(messageObj.scriptObject());
+    if (!frames.isEmpty()) {
+        for (unsigned i = 0; i < frames.size(); ++i)
+            function->appendArgument(frames[i]);
+    } else if (!wrappedArguments.isEmpty()) {
+        for (unsigned i = 0; i < wrappedArguments.size(); ++i)
+            function->appendArgument(wrappedArguments[i]);
+    } else
+        function->appendArgument(message);
+    function->call();
+}
+
+bool InspectorFrontend::addResource(long long identifier, const InspectorJSONObject& resourceObj)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addResource"));
+    function->appendArgument(identifier);
+    function->appendArgument(resourceObj.scriptObject());
+    bool hadException = false;
+    function->call(hadException);
+    return !hadException;
+}
+
+bool InspectorFrontend::updateResource(long long identifier, const InspectorJSONObject& resourceObj)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateResource"));
+    function->appendArgument(identifier);
+    function->appendArgument(resourceObj.scriptObject());
+    bool hadException = false;
+    function->call(hadException);
+    return !hadException;
+}
+
+void InspectorFrontend::removeResource(long long identifier)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("removeResource"));
+    function->appendArgument(identifier);
+    function->call();
+}
+
+void InspectorFrontend::updateFocusedNode(Node* node)
+{
+    ScriptObject quarantinedNode;
+    if (!getQuarantinedScriptObject(node, quarantinedNode))
+        return;
+
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("updateFocusedNode"));
+    function->appendArgument(quarantinedNode);
+    function->call();
+}
+
+void InspectorFrontend::setAttachedWindow(bool attached)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setAttachedWindow"));
+    function->appendArgument(attached);
+    function->call();
+}
+
+void InspectorFrontend::inspectedWindowScriptObjectCleared(Frame* frame)
+{
+    ScriptObject domWindow;
+    if (!getQuarantinedScriptObject(frame->domWindow(), domWindow))
+        return;
+
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("inspectedWindowCleared"));
+    function->appendArgument(domWindow);
+    function->call();
+}
+
+void InspectorFrontend::showPanel(int panel)
+{
+    const char* showFunctionName;
+    switch (panel) {
+        case InspectorController::ConsolePanel:
+            showFunctionName = "showConsole";
+            break;
+        case InspectorController::DatabasesPanel:
+            showFunctionName = "showDatabasesPanel";
+            break;
+        case InspectorController::ElementsPanel:
+            showFunctionName = "showElementsPanel";
+            break;
+        case InspectorController::ProfilesPanel:
+            showFunctionName = "showProfilesPanel";
+            break;
+        case InspectorController::ResourcesPanel:
+            showFunctionName = "showResourcesPanel";
+            break;
+        case InspectorController::ScriptsPanel:
+            showFunctionName = "showScriptsPanel";
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+            showFunctionName = 0;
+    }
+
+    if (showFunctionName)
+        callSimpleFunction(showFunctionName);
+}
+
+void InspectorFrontend::populateInterface()
+{
+    callSimpleFunction("populateInterface");
+}
+
+void InspectorFrontend::reset()
+{
+    callSimpleFunction("reset");
+}
+
+void InspectorFrontend::resourceTrackingWasEnabled()
+{
+    callSimpleFunction("resourceTrackingWasEnabled");
+}
+
+void InspectorFrontend::resourceTrackingWasDisabled()
+{
+    callSimpleFunction("resourceTrackingWasDisabled");
+}
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+void InspectorFrontend::attachDebuggerWhenShown()
+{
+    callSimpleFunction("attachDebuggerWhenShown");
+}
+
+void InspectorFrontend::debuggerWasEnabled()
+{
+    callSimpleFunction("debuggerWasEnabled");
+}
+
+void InspectorFrontend::debuggerWasDisabled()
+{
+    callSimpleFunction("debuggerWasDisabled");
+}
+
+void InspectorFrontend::profilerWasEnabled()
+{
+    callSimpleFunction("profilerWasEnabled");
+}
+
+void InspectorFrontend::profilerWasDisabled()
+{
+    callSimpleFunction("profilerWasDisabled");
+}
+
+void InspectorFrontend::parsedScriptSource(const JSC::SourceCode& source)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("parsedScriptSource"));
+    function->appendArgument(JSC::UString(JSC::UString::from(source.provider()->asID())));
+    function->appendArgument(source.provider()->url());
+    function->appendArgument(JSC::UString(source.data(), source.length()));
+    function->appendArgument(source.firstLine());
+    function->call();
+}
+
+void InspectorFrontend::failedToParseScriptSource(const JSC::SourceCode& source, int errorLine, const JSC::UString& errorMessage)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("failedToParseScriptSource"));
+    function->appendArgument(source.provider()->url());
+    function->appendArgument(JSC::UString(source.data(), source.length()));
+    function->appendArgument(source.firstLine());
+    function->appendArgument(errorLine);
+    function->appendArgument(errorMessage);
+    function->call();
+}
+
+void InspectorFrontend::addProfile(const JSC::JSValue& profile)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addProfile"));
+    function->appendArgument(profile);
+    function->call();
+}
+
+void InspectorFrontend::setRecordingProfile(bool isProfiling)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("setRecordingProfile"));
+    function->appendArgument(isProfiling);
+    function->call();
+}
+
+void InspectorFrontend::pausedScript()
+{
+    callSimpleFunction("pausedScript");
+}
+
+void InspectorFrontend::resumedScript()
+{
+    callSimpleFunction("resumedScript");
+}
+#endif
+
+#if ENABLE(DATABASE)
+bool InspectorFrontend::addDatabase(const InspectorJSONObject& dbObject)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDatabase"));
+    function->appendArgument(dbObject.scriptObject());
+    bool hadException = false;
+    function->call(hadException);
+    return !hadException;
+}
+#endif
+
+#if ENABLE(DOM_STORAGE)
+bool InspectorFrontend::addDOMStorage(const InspectorJSONObject& domStorageObj)
+{
+    OwnPtr<ScriptFunctionCall> function(newFunctionCall("addDOMStorage"));
+    function->appendArgument(domStorageObj.scriptObject());
+    bool hadException = false;
+    function->call(hadException);
+    return !hadException;
+}
+#endif
+
+PassOwnPtr<ScriptFunctionCall> InspectorFrontend::newFunctionCall(const String& functionName)
+{
+    ScriptFunctionCall* function = new ScriptFunctionCall(m_scriptState, m_webInspector, "dispatch");
+    function->appendArgument(functionName);
+    return function;
+}
+
+void InspectorFrontend::callSimpleFunction(const String& functionName)
+{
+    ScriptFunctionCall function(m_scriptState, m_webInspector, "dispatch");
+    function.appendArgument(functionName);
+    function.call();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h
new file mode 100644
index 0000000..1bf3fea
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorFrontend.h
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InspectorFrontend_h
+#define InspectorFrontend_h
+
+#include "InspectorJSONObject.h"
+#include "ScriptState.h"
+#include <wtf/PassOwnPtr.h>
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+namespace JSC {
+    class JSValue;
+    class SourceCode;
+    class UString;
+}
+#endif
+
+namespace WebCore {
+    class ConsoleMessage;
+    class InspectorResource;
+    class Node;
+    class ScriptFunctionCall;
+    class ScriptString;
+
+    class InspectorFrontend {
+    public:
+        InspectorFrontend(ScriptState*, ScriptObject webInspector);
+        ~InspectorFrontend();
+        InspectorJSONObject newInspectorJSONObject();
+
+        void addMessageToConsole(const InspectorJSONObject& messageObj, const Vector<ScriptString>& frames, const Vector<ScriptValue> wrappedArguments, const String& message);
+        
+        bool addResource(long long identifier, const InspectorJSONObject& resourceObj);
+        bool updateResource(long long identifier, const InspectorJSONObject& resourceObj);
+        void removeResource(long long identifier);
+
+        void updateFocusedNode(Node* node);
+        void setAttachedWindow(bool attached);
+        void inspectedWindowScriptObjectCleared(Frame* frame);
+        void showPanel(int panel);
+        void populateInterface();
+        void reset();
+
+        void resourceTrackingWasEnabled();
+        void resourceTrackingWasDisabled();
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+        void attachDebuggerWhenShown();
+        void debuggerWasEnabled();
+        void debuggerWasDisabled();
+        void profilerWasEnabled();
+        void profilerWasDisabled();
+        void parsedScriptSource(const JSC::SourceCode&);
+        void failedToParseScriptSource(const JSC::SourceCode&, int errorLine, const JSC::UString& errorMessage);
+        void addProfile(const JSC::JSValue& profile);
+        void setRecordingProfile(bool isProfiling);
+        void pausedScript();
+        void resumedScript();
+#endif
+
+#if ENABLE(DATABASE)
+        bool addDatabase(const InspectorJSONObject& dbObj);
+#endif
+        
+#if ENABLE(DOM_STORAGE)
+        bool addDOMStorage(const InspectorJSONObject& domStorageObj);
+#endif
+
+    private:
+        PassOwnPtr<ScriptFunctionCall> newFunctionCall(const String& functionName);
+        void callSimpleFunction(const String& functionName);
+        ScriptState* m_scriptState;
+        ScriptObject m_webInspector;
+    };
+
+} // namespace WebCore
+
+#endif // !defined(InspectorFrontend_h)
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorJSONObject.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorJSONObject.cpp
new file mode 100644
index 0000000..e7b5178
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorJSONObject.cpp
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorJSONObject.h"
+
+#include "PlatformString.h"
+#include "ScriptObject.h"
+#include "ScriptState.h"
+
+namespace WebCore {
+
+InspectorJSONObject::InspectorJSONObject(ScriptState* scriptState)
+    : m_scriptState(scriptState)
+{
+    m_scriptObject = ScriptObject::createNew(scriptState);
+}
+
+bool InspectorJSONObject::set(const String& name, const String& value)
+{
+    return m_scriptObject.set(m_scriptState, name, value);
+}
+
+bool InspectorJSONObject::set(const char* name, const ScriptObject& value)
+{
+    return m_scriptObject.set(m_scriptState, name, value);
+}
+
+bool InspectorJSONObject::set(const char* name, const InspectorJSONObject& value)
+{
+    return set(name, value.scriptObject());
+}
+
+bool InspectorJSONObject::set(const char* name, const String& value)
+{
+    return m_scriptObject.set(m_scriptState, name, value);
+}
+
+bool InspectorJSONObject::set(const char* name, double value)
+{
+    return m_scriptObject.set(m_scriptState, name, value);
+}
+
+bool InspectorJSONObject::set(const char* name, long long value)
+{
+    return m_scriptObject.set(m_scriptState, name, value);
+}
+
+bool InspectorJSONObject::set(const char* name, int value)
+{
+    return m_scriptObject.set(m_scriptState, name, value);
+}
+
+bool InspectorJSONObject::set(const char* name, bool value)
+{
+    return m_scriptObject.set(m_scriptState, name, value);
+}
+
+ScriptObject InspectorJSONObject::scriptObject() const
+{
+    return m_scriptObject;
+}
+
+InspectorJSONObject InspectorJSONObject::createNew(ScriptState* scriptState)
+{
+    return InspectorJSONObject(scriptState);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorJSONObject.h b/src/3rdparty/webkit/WebCore/inspector/InspectorJSONObject.h
new file mode 100644
index 0000000..5858ff2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorJSONObject.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#ifndef InspectorJSONObject_h
+#define InspectorJSONObject_h
+
+#include "ScriptObject.h"
+#include "ScriptState.h"
+
+namespace WebCore {
+    class String;
+
+    class InspectorJSONObject {
+    public:
+        bool set(const String& name, const String&);
+        bool set(const char* name, const InspectorJSONObject&);
+        bool set(const char* name, const ScriptObject&);
+        bool set(const char* name, const String&);
+        bool set(const char* name, double);
+        bool set(const char* name, long long);
+        bool set(const char* name, int);
+        bool set(const char* name, bool);
+        ScriptObject scriptObject() const;
+
+        static InspectorJSONObject createNew(ScriptState* scriptState);
+    private:
+        InspectorJSONObject(ScriptState* scriptState);
+        ScriptState* m_scriptState;
+        ScriptObject m_scriptObject;
+    };
+}
+
+#endif // InspectorJSONObject.h
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp
new file mode 100644
index 0000000..15ecce0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.cpp
@@ -0,0 +1,325 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorResource.h"
+
+#include "CachedResource.h"
+#include "DocLoader.h"
+#include "DocumentLoader.h"
+#include "Frame.h"
+#include "InspectorFrontend.h"
+#include "InspectorJSONObject.h"
+#include "ResourceRequest.h"
+#include "ResourceResponse.h"
+#include "TextEncoding.h"
+
+namespace WebCore {
+
+InspectorResource::InspectorResource(long long identifier, DocumentLoader* loader)
+    : m_identifier(identifier)
+    , m_loader(loader)
+    , m_frame(loader->frame())
+    , m_scriptObjectCreated(false)
+    , m_expectedContentLength(0)
+    , m_cached(false)
+    , m_finished(false)
+    , m_failed(false)
+    , m_length(0)
+    , m_responseStatusCode(0)
+    , m_startTime(-1.0)
+    , m_responseReceivedTime(-1.0)
+    , m_endTime(-1.0)
+    , m_isMainResource(false)
+{
+}
+
+InspectorResource::~InspectorResource()
+{
+}
+
+PassRefPtr<InspectorResource> InspectorResource::createCached(long long identifier, DocumentLoader* loader, const CachedResource* cachedResource)
+{
+    PassRefPtr<InspectorResource> resource = create(identifier, loader);
+
+    resource->m_finished = true;
+
+    resource->m_requestURL = KURL(cachedResource->url());
+    resource->updateResponse(cachedResource->response());
+
+    resource->m_length = cachedResource->encodedSize();
+    resource->m_cached = true;
+    resource->m_startTime = currentTime();
+    resource->m_responseReceivedTime = resource->m_startTime;
+    resource->m_endTime = resource->m_startTime;
+
+    resource->m_changes.setAll();
+
+    return resource;
+}
+
+void InspectorResource::updateRequest(const ResourceRequest& request)
+{
+    m_requestHeaderFields = request.httpHeaderFields();
+    m_requestURL = request.url();
+
+    m_changes.set(RequestChange);
+}
+
+void InspectorResource::updateResponse(const ResourceResponse& response)
+{
+    m_expectedContentLength = response.expectedContentLength();
+    m_mimeType = response.mimeType();
+    m_responseHeaderFields = response.httpHeaderFields();
+    m_responseStatusCode = response.httpStatusCode();
+    m_suggestedFilename = response.suggestedFilename();
+
+    m_changes.set(ResponseChange);
+    m_changes.set(TypeChange);
+}
+
+static void populateHeadersObject(InspectorJSONObject* object, const HTTPHeaderMap& headers)
+{
+    HTTPHeaderMap::const_iterator end = headers.end();
+    for (HTTPHeaderMap::const_iterator it = headers.begin(); it != end; ++it) {
+        object->set(it->first.string(), it->second);
+    }
+}
+
+void InspectorResource::createScriptObject(InspectorFrontend* frontend)
+{
+    if (!m_scriptObjectCreated) {
+        InspectorJSONObject jsonObject = frontend->newInspectorJSONObject();
+        InspectorJSONObject requestHeaders = frontend->newInspectorJSONObject();
+        populateHeadersObject(&requestHeaders, m_requestHeaderFields);
+        jsonObject.set("requestHeaders", requestHeaders);
+        jsonObject.set("requestURL", requestURL());
+        jsonObject.set("host", m_requestURL.host());
+        jsonObject.set("path", m_requestURL.path());
+        jsonObject.set("lastPathComponent", m_requestURL.lastPathComponent());
+        jsonObject.set("isMainResource", m_isMainResource);
+        jsonObject.set("cached", m_cached);
+        if (!frontend->addResource(m_identifier, jsonObject))
+            return;
+
+        m_scriptObjectCreated = true;
+        m_changes.clear(RequestChange);
+    }
+    updateScriptObject(frontend);
+}
+
+void InspectorResource::updateScriptObject(InspectorFrontend* frontend)
+{
+    if (!m_scriptObjectCreated)
+        return;
+
+    if (m_changes.hasChange(NoChange))
+        return;
+
+    InspectorJSONObject jsonObject = frontend->newInspectorJSONObject();
+    if (m_changes.hasChange(RequestChange)) {
+        jsonObject.set("url", requestURL());
+        jsonObject.set("domain", m_requestURL.host());
+        jsonObject.set("path", m_requestURL.path());
+        jsonObject.set("lastPathComponent", m_requestURL.lastPathComponent());
+        InspectorJSONObject requestHeaders = frontend->newInspectorJSONObject();
+        populateHeadersObject(&requestHeaders, m_requestHeaderFields);
+        jsonObject.set("requestHeaders", requestHeaders);
+        jsonObject.set("mainResource", m_isMainResource);
+        jsonObject.set("didRequestChange", true);
+    }
+
+    if (m_changes.hasChange(ResponseChange)) {
+        jsonObject.set("mimeType", m_mimeType);
+        jsonObject.set("suggestedFilename", m_suggestedFilename);
+        jsonObject.set("expectedContentLength", m_expectedContentLength);
+        jsonObject.set("statusCode", m_responseStatusCode);
+        jsonObject.set("suggestedFilename", m_suggestedFilename);
+        InspectorJSONObject responseHeaders = frontend->newInspectorJSONObject();
+        populateHeadersObject(&responseHeaders, m_responseHeaderFields);
+        jsonObject.set("responseHeaders", responseHeaders);
+        jsonObject.set("didResponseChange", true);
+    }
+
+    if (m_changes.hasChange(TypeChange)) {
+        jsonObject.set("type", static_cast<int>(type()));
+        jsonObject.set("didTypeChange", true);
+    }
+    
+    if (m_changes.hasChange(LengthChange)) {
+        jsonObject.set("contentLength", m_length);
+        jsonObject.set("didLengthChange", true);
+    }
+
+    if (m_changes.hasChange(CompletionChange)) {
+        jsonObject.set("failed", m_failed);
+        jsonObject.set("finished", m_finished);
+        jsonObject.set("didCompletionChange", true);
+    }
+
+    if (m_changes.hasChange(TimingChange)) {
+        if (m_startTime > 0)
+            jsonObject.set("startTime", m_startTime);
+        if (m_responseReceivedTime > 0)
+            jsonObject.set("responseReceivedTime", m_responseReceivedTime);
+        if (m_endTime > 0)
+            jsonObject.set("endTime", m_endTime);
+        jsonObject.set("didTimingChange", true);
+    }
+    if (!frontend->updateResource(m_identifier, jsonObject))
+        return;
+    m_changes.clearAll();
+}
+
+void InspectorResource::releaseScriptObject(InspectorFrontend* frontend, bool callRemoveResource)
+{
+    if (!m_scriptObjectCreated)
+        return;
+
+    m_scriptObjectCreated = false;
+    m_changes.setAll();
+
+    if (!callRemoveResource)
+        return;
+
+    frontend->removeResource(m_identifier);
+}
+
+InspectorResource::Type InspectorResource::type() const
+{
+    if (!m_xmlHttpResponseText.isNull())
+        return XHR;
+
+    if (m_requestURL == m_loader->requestURL())
+        return Doc;
+
+    if (m_loader->frameLoader() && m_requestURL == m_loader->frameLoader()->iconURL())
+        return Image;
+
+    CachedResource* cachedResource = m_frame->document()->docLoader()->cachedResource(requestURL());
+    if (!cachedResource)
+        return Other;
+
+    switch (cachedResource->type()) {
+        case CachedResource::ImageResource:
+            return Image;
+        case CachedResource::FontResource:
+            return Font;
+        case CachedResource::CSSStyleSheet:
+#if ENABLE(XSLT)
+        case CachedResource::XSLStyleSheet:
+#endif
+            return Stylesheet;
+        case CachedResource::Script:
+            return Script;
+        default:
+            return Other;
+    }
+}
+
+void InspectorResource::setXMLHttpResponseText(const ScriptString& data)
+{
+    m_xmlHttpResponseText = data;
+    m_changes.set(TypeChange);
+}
+
+String InspectorResource::sourceString() const
+{
+    if (!m_xmlHttpResponseText.isNull())
+        return String(m_xmlHttpResponseText);
+
+    RefPtr<SharedBuffer> buffer;
+    String textEncodingName;
+
+    if (m_requestURL == m_loader->requestURL()) {
+        buffer = m_loader->mainResourceData();
+        textEncodingName = m_frame->document()->inputEncoding();
+    } else {
+        CachedResource* cachedResource = m_frame->document()->docLoader()->cachedResource(requestURL());
+        if (!cachedResource)
+            return String();
+
+        if (cachedResource->isPurgeable()) {
+            // If the resource is purgeable then make it unpurgeable to get
+            // get its data. This might fail, in which case we return an
+            // empty String.
+            // FIXME: should we do something else in the case of a purged
+            // resource that informs the user why there is no data in the
+            // inspector?
+            if (!cachedResource->makePurgeable(false))
+                return String();
+        }
+
+        buffer = cachedResource->data();
+        textEncodingName = cachedResource->encoding();
+    }
+
+    if (!buffer)
+        return String();
+
+    TextEncoding encoding(textEncodingName);
+    if (!encoding.isValid())
+        encoding = WindowsLatin1Encoding();
+    return encoding.decode(buffer->data(), buffer->size());
+}
+
+void InspectorResource::startTiming()
+{
+    m_startTime = currentTime();
+    m_changes.set(TimingChange);
+}
+
+void InspectorResource::markResponseReceivedTime()
+{
+    m_responseReceivedTime = currentTime();
+    m_changes.set(TimingChange);
+}
+
+void InspectorResource::endTiming()
+{
+    m_endTime = currentTime();
+    m_finished = true;
+    m_changes.set(TimingChange);
+    m_changes.set(CompletionChange);
+}
+
+void InspectorResource::markFailed()
+{
+    m_failed = true;
+    m_changes.set(CompletionChange);
+}
+
+void InspectorResource::addLength(int lengthReceived)
+{
+    m_length += lengthReceived;
+    m_changes.set(LengthChange);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h
new file mode 100644
index 0000000..8380a8f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/InspectorResource.h
@@ -0,0 +1,163 @@
+/*
+ * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Matt Lilek <webkit@mattlilek.com>
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InspectorResource_h
+#define InspectorResource_h
+
+#include "HTTPHeaderMap.h"
+#include "KURL.h"
+#include "ScriptObject.h"
+#include "ScriptState.h"
+#include "ScriptString.h"
+
+#include <wtf/CurrentTime.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+    class CachedResource;
+    class DocumentLoader;
+    class InspectorFrontend;
+    class Frame;
+    class ResourceResponse;
+
+    struct ResourceRequest;
+
+    class InspectorResource : public RefCounted<InspectorResource> {
+    public:
+
+        // Keep these in sync with WebInspector.Resource.Type
+        enum Type {
+            Doc,
+            Stylesheet,
+            Image,
+            Font,
+            Script,
+            XHR,
+            Media,
+            Other
+        };
+
+        static PassRefPtr<InspectorResource> create(long long identifier, DocumentLoader* loader)
+        {
+            return adoptRef(new InspectorResource(identifier, loader));
+        }
+
+        static PassRefPtr<InspectorResource> createCached(long long identifier, DocumentLoader*, const CachedResource*);
+
+        ~InspectorResource();
+
+        void createScriptObject(InspectorFrontend* frontend);
+        void updateScriptObject(InspectorFrontend* frontend);
+        void releaseScriptObject(InspectorFrontend* frontend, bool callRemoveResource);
+
+        void updateRequest(const ResourceRequest&);
+        void updateResponse(const ResourceResponse&);
+
+        void setXMLHttpResponseText(const ScriptString& data);
+
+        String sourceString() const;
+        bool isSameLoader(DocumentLoader* loader) const { return loader == m_loader; }
+        void markMainResource() { m_isMainResource = true; }
+        long long identifier() const { return m_identifier; }
+        String requestURL() const { return m_requestURL.string(); }
+        Frame* frame() const { return m_frame.get(); }
+        const String& mimeType() const { return m_mimeType; }
+        void startTiming();
+        void markResponseReceivedTime();
+        void endTiming();
+
+        void markFailed();
+        void addLength(int lengthReceived);
+
+    private:
+        enum ChangeType {
+            NoChange = 0,
+            RequestChange = 1,
+            ResponseChange = 2,
+            TypeChange = 4,
+            LengthChange = 8,
+            CompletionChange = 16,
+            TimingChange = 32
+        };
+
+        class Changes {
+        public:
+            Changes() : m_change(NoChange) {}
+
+            inline bool hasChange(ChangeType change) { return (m_change & change) || !(m_change + change); }
+            inline void set(ChangeType change)
+            {
+                m_change = static_cast<ChangeType>(static_cast<unsigned>(m_change) | static_cast<unsigned>(change));            
+            }
+            inline void clear(ChangeType change)
+            {
+                m_change = static_cast<ChangeType>(static_cast<unsigned>(m_change) & ~static_cast<unsigned>(change));
+            }
+
+            inline void setAll() { m_change = static_cast<ChangeType>(63); }
+            inline void clearAll() { m_change = NoChange; }
+
+        private:
+            ChangeType m_change;
+        };
+
+        InspectorResource(long long identifier, DocumentLoader*);
+        Type type() const;
+
+        long long m_identifier;
+        RefPtr<DocumentLoader> m_loader;
+        RefPtr<Frame> m_frame;
+        KURL m_requestURL;
+        HTTPHeaderMap m_requestHeaderFields;
+        HTTPHeaderMap m_responseHeaderFields;
+        String m_mimeType;
+        String m_suggestedFilename;
+        bool m_scriptObjectCreated;
+        long long m_expectedContentLength;
+        bool m_cached;
+        bool m_finished;
+        bool m_failed;
+        int m_length;
+        int m_responseStatusCode;
+        double m_startTime;
+        double m_responseReceivedTime;
+        double m_endTime;
+        ScriptString m_xmlHttpResponseText;
+        Changes m_changes;
+        bool m_isMainResource;
+    };
+
+} // namespace WebCore
+
+#endif // InspectorResource_h
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.cpp b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.cpp
index 4962892..6e8fce9 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JavaScriptCallFrame.h"
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include "PlatformString.h"
 #include <debugger/DebuggerCallFrame.h>
 #include <runtime/JSGlobalObject.h>
@@ -37,7 +39,7 @@
 using namespace JSC;
 
 namespace WebCore {
-
+    
 JavaScriptCallFrame::JavaScriptCallFrame(const DebuggerCallFrame& debuggerCallFrame, PassRefPtr<JavaScriptCallFrame> caller, intptr_t sourceID, int line)
     : m_debuggerCallFrame(debuggerCallFrame)
     , m_caller(caller)
@@ -65,10 +67,10 @@ String JavaScriptCallFrame::functionName() const
     ASSERT(m_isValid);
     if (!m_isValid)
         return String();
-    const UString* functionName = m_debuggerCallFrame.functionName();
-    if (!functionName)
+    UString functionName = m_debuggerCallFrame.calculatedFunctionName();
+    if (functionName.isEmpty())
         return String();
-    return *functionName;
+    return functionName;
 }
 
 DebuggerCallFrame::Type JavaScriptCallFrame::type() const
@@ -88,7 +90,7 @@ JSObject* JavaScriptCallFrame::thisObject() const
 }
 
 // Evaluate some JavaScript code in the scope of this frame.
-JSValuePtr JavaScriptCallFrame::evaluate(const UString& script, JSValuePtr& exception) const
+JSValue JavaScriptCallFrame::evaluate(const UString& script, JSValue& exception) const
 {
     ASSERT(m_isValid);
     if (!m_isValid)
@@ -99,3 +101,5 @@ JSValuePtr JavaScriptCallFrame::evaluate(const UString& script, JSValuePtr& exce
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.h b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.h
index 6b55bb9..9f193d8 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.h
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.h
@@ -26,6 +26,8 @@
 #ifndef JavaScriptCallFrame_h
 #define JavaScriptCallFrame_h
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include <interpreter/CallFrame.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -61,18 +63,20 @@ namespace WebCore {
         const JSC::ScopeChainNode* scopeChain() const;
 
         JSC::JSObject* thisObject() const;
-        JSC::JSValuePtr evaluate(const JSC::UString& script, JSC::JSValuePtr& exception) const;
+        JSC::JSValue evaluate(const JSC::UString& script, JSC::JSValue& exception) const;
         
     private:
         JavaScriptCallFrame(const JSC::DebuggerCallFrame&, PassRefPtr<JavaScriptCallFrame> caller, intptr_t sourceID, int line);
 
         JSC::DebuggerCallFrame m_debuggerCallFrame;
         RefPtr<JavaScriptCallFrame> m_caller;
-        int m_sourceID;
+        intptr_t m_sourceID;
         int m_line;
         bool m_isValid;
     };
 
 } // namespace WebCore
 
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
 #endif // JavaScriptCallFrame_h
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.idl b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.idl
index 96e4c6e..2f247f0 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.idl
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptCallFrame.idl
@@ -25,7 +25,7 @@
 
 module inspector {
 
-    interface JavaScriptCallFrame {
+    interface [Conditional=JAVASCRIPT_DEBUGGER] JavaScriptCallFrame {
         [Custom] void evaluate(in DOMString script);
 
         readonly attribute JavaScriptCallFrame caller;
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugListener.h b/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugListener.h
index f1cd77f..912a751 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugListener.h
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugListener.h
@@ -29,6 +29,8 @@
 #ifndef JavaScriptDebugListener_h
 #define JavaScriptDebugListener_h
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 namespace JSC {
     class ExecState;
     class SourceCode;
@@ -47,8 +49,11 @@ namespace WebCore {
         virtual void didParseSource(JSC::ExecState*, const JSC::SourceCode& source) = 0;
         virtual void failedToParseSource(JSC::ExecState*, const JSC::SourceCode& source, int errorLine, const JSC::UString& errorMessage) = 0;
         virtual void didPause() = 0;
+        virtual void didContinue() = 0;
     };
 
 } // namespace WebCore
 
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
 #endif // JavaScriptDebugListener_h
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.cpp b/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.cpp
index 680e57e..bb6358c 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.cpp
@@ -29,6 +29,8 @@
 #include "config.h"
 #include "JavaScriptDebugServer.h"
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include "DOMWindow.h"
 #include "EventLoop.h"
 #include "Frame.h"
@@ -363,19 +365,25 @@ void JavaScriptDebugServer::setJavaScriptPaused(Frame* frame, bool paused)
 
     frame->script()->setPaused(paused);
 
-    if (Document* document = frame->document()) {
-        if (paused)
-            document->suspendActiveDOMObjects();
-        else
-            document->resumeActiveDOMObjects();
-    }
+    Document* document = frame->document();
+    if (paused)
+        document->suspendActiveDOMObjects();
+    else
+        document->resumeActiveDOMObjects();
 
     setJavaScriptPaused(frame->view(), paused);
 }
 
+#if PLATFORM(MAC)
+
+void JavaScriptDebugServer::setJavaScriptPaused(FrameView*, bool)
+{
+}
+
+#else
+
 void JavaScriptDebugServer::setJavaScriptPaused(FrameView* view, bool paused)
 {
-#if !PLATFORM(MAC)
     if (!view)
         return;
 
@@ -389,9 +397,10 @@ void JavaScriptDebugServer::setJavaScriptPaused(FrameView* view, bool paused)
             continue;
         static_cast<PluginView*>(widget)->setJavaScriptPaused(paused);
     }
-#endif
 }
 
+#endif
+
 void JavaScriptDebugServer::pauseIfNeeded(Page* page)
 {
     if (m_paused)
@@ -424,6 +433,8 @@ void JavaScriptDebugServer::pauseIfNeeded(Page* page)
     setJavaScriptPaused(page->group(), false);
 
     m_paused = false;
+
+    dispatchFunctionToListeners(&JavaScriptDebugListener::didContinue, page);
 }
 
 void JavaScriptDebugServer::callEvent(const DebuggerCallFrame& debuggerCallFrame, intptr_t sourceID, int lineNumber)
@@ -542,8 +553,11 @@ void JavaScriptDebugServer::recompileAllJSFunctions(Timer<JavaScriptDebugServer>
     Vector<ProtectedPtr<JSFunction> > functions;
     Heap::iterator heapEnd = globalData->heap.primaryHeapEnd();
     for (Heap::iterator it = globalData->heap.primaryHeapBegin(); it != heapEnd; ++it) {
-        if ((*it)->isObject(&JSFunction::info))
-            functions.append(static_cast<JSFunction*>(*it));
+        if ((*it)->isObject(&JSFunction::info)) {
+            JSFunction* function = static_cast<JSFunction*>(*it);
+            if (!function->isHostFunction())
+                functions.append(function);
+        }
     }
 
     typedef HashMap<RefPtr<FunctionBodyNode>, RefPtr<FunctionBodyNode> > FunctionBodyMap;
@@ -573,7 +587,7 @@ void JavaScriptDebugServer::recompileAllJSFunctions(Timer<JavaScriptDebugServer>
         result.first->second = newBody;
         function->setBody(newBody.release());
 
-        if (hasListeners())
+        if (hasListeners() && function->scope().globalObject()->debugger() == this)
             sourceProviders.add(sourceCode.provider(), exec);
     }
 
@@ -613,3 +627,5 @@ void JavaScriptDebugServer::didRemoveLastListener()
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.h b/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.h
index 12c1099..4ec3e33 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.h
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptDebugServer.h
@@ -29,6 +29,8 @@
 #ifndef JavaScriptDebugServer_h
 #define JavaScriptDebugServer_h
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include "Timer.h"
 #include <debugger/Debugger.h>
 #include <wtf/HashMap.h>
@@ -127,4 +129,6 @@ namespace WebCore {
 
 } // namespace WebCore
 
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
 #endif // JavaScriptDebugServer_h
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfile.cpp b/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfile.cpp
index b0be7a0..3a65fb8 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfile.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfile.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JavaScriptProfile.h"
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include "JavaScriptProfileNode.h"
 #include <profiler/Profile.h>
 #include <JavaScriptCore/APICast.h>
@@ -68,26 +70,9 @@ static JSValueRef getHeadCallback(JSContextRef ctx, JSObjectRef thisObject, JSSt
     if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
         return JSValueMakeUndefined(ctx);
 
+    ExecState* exec = toJS(ctx);
     Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    return toRef(toJS(toJS(ctx), profile->head()));
-}
-
-static JSValueRef getHeavyProfileCallback(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    return toRef(toJS(toJS(ctx), profile->heavyProfile()));
-}
-
-static JSValueRef getTreeProfileCallback(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    return toRef(toJS(toJS(ctx), profile->treeProfile()));
+    return toRef(exec, toJS(exec, profile->head()));
 }
 
 static JSValueRef getUniqueIdCallback(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
@@ -146,94 +131,6 @@ static JSValueRef restoreAll(JSContextRef ctx, JSObjectRef /*function*/, JSObjec
     return JSValueMakeUndefined(ctx);
 }
 
-static JSValueRef sortTotalTimeDescending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortTotalTimeDescending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef sortTotalTimeAscending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortTotalTimeAscending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef sortSelfTimeDescending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortSelfTimeDescending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef sortSelfTimeAscending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortSelfTimeAscending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef sortCallsDescending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortCallsDescending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef sortCallsAscending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortCallsAscending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef sortFunctionNameDescending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortFunctionNameDescending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
-static JSValueRef sortFunctionNameAscending(JSContextRef ctx, JSObjectRef /*function*/, JSObjectRef thisObject, size_t /*argumentCount*/, const JSValueRef[] /*arguments*/, JSValueRef* /*exception*/)
-{
-    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileClass()))
-        return JSValueMakeUndefined(ctx);
-
-    Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(thisObject));
-    profile->sortFunctionNameAscending();
-
-    return JSValueMakeUndefined(ctx);
-}
-
 static void finalize(JSObjectRef object)
 {
     Profile* profile = static_cast<Profile*>(JSObjectGetPrivate(object));
@@ -246,8 +143,6 @@ JSClassRef ProfileClass()
     static JSStaticValue staticValues[] = {
         { "title", getTitleCallback, 0, kJSPropertyAttributeNone },
         { "head", getHeadCallback, 0, kJSPropertyAttributeNone },
-        { "heavyProfile", getHeavyProfileCallback, 0, kJSPropertyAttributeNone },
-        { "treeProfile", getTreeProfileCallback, 0, kJSPropertyAttributeNone },
         { "uid", getUniqueIdCallback, 0, kJSPropertyAttributeNone },
         { 0, 0, 0, 0 }
     };
@@ -256,14 +151,6 @@ JSClassRef ProfileClass()
         { "focus", focus, kJSPropertyAttributeNone },
         { "exclude", exclude, kJSPropertyAttributeNone },
         { "restoreAll", restoreAll, kJSPropertyAttributeNone },
-        { "sortTotalTimeDescending", sortTotalTimeDescending, kJSPropertyAttributeNone },
-        { "sortTotalTimeAscending", sortTotalTimeAscending, kJSPropertyAttributeNone },
-        { "sortSelfTimeDescending", sortSelfTimeDescending, kJSPropertyAttributeNone },
-        { "sortSelfTimeAscending", sortSelfTimeAscending, kJSPropertyAttributeNone },
-        { "sortCallsDescending", sortCallsDescending, kJSPropertyAttributeNone },
-        { "sortCallsAscending", sortCallsAscending, kJSPropertyAttributeNone },
-        { "sortFunctionNameDescending", sortFunctionNameDescending, kJSPropertyAttributeNone },
-        { "sortFunctionNameAscending", sortFunctionNameAscending, kJSPropertyAttributeNone },
         { 0, 0, 0 }
     };
 
@@ -276,7 +163,7 @@ JSClassRef ProfileClass()
     return profileClass;
 }
 
-JSValuePtr toJS(ExecState* exec, Profile* profile)
+JSValue toJS(ExecState* exec, Profile* profile)
 {
     if (!profile)
         return jsNull();
@@ -292,3 +179,5 @@ JSValuePtr toJS(ExecState* exec, Profile* profile)
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfile.h b/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfile.h
index 4076165..28fd3e4 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfile.h
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfile.h
@@ -26,6 +26,8 @@
 #ifndef JavaScriptProfile_h
 #define JavaScriptProfile_h
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include <runtime/JSValue.h>
 
 namespace JSC {
@@ -35,8 +37,10 @@ namespace JSC {
 
 namespace WebCore {
 
-    JSC::JSValuePtr toJS(JSC::ExecState*, JSC::Profile*);
+    JSC::JSValue toJS(JSC::ExecState*, JSC::Profile*);
 
 } // namespace WebCore
 
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.cpp b/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.cpp
index 8d00783..5b5c340 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.cpp
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.cpp
@@ -26,6 +26,8 @@
 #include "config.h"
 #include "JavaScriptProfileNode.h"
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include "JSDOMBinding.h"
 #include <profiler/ProfileNode.h>
 #include <JavaScriptCore/APICast.h>
@@ -46,7 +48,7 @@ namespace WebCore {
 typedef HashMap<ProfileNode*, JSObject*> ProfileNodeMap;
 
 static ProfileNodeMap& profileNodeCache()
-{ 
+{
     DEFINE_STATIC_LOCAL(ProfileNodeMap, staticProfileNodes, ());
     return staticProfileNodes;
 }
@@ -162,7 +164,7 @@ static JSValueRef getChildren(JSContextRef ctx, JSObjectRef thisObject, JSString
         return JSValueMakeUndefined(ctx);
 
     JSRetainPtr<JSStringRef> pushString(Adopt, JSStringCreateWithUTF8CString("push"));
-    
+
     JSValueRef pushProperty = JSObjectGetProperty(ctx, result, pushString.get(), exception);
     if (exception && *exception)
         return JSValueMakeUndefined(ctx);
@@ -171,8 +173,9 @@ static JSValueRef getChildren(JSContextRef ctx, JSObjectRef thisObject, JSString
     if (exception && *exception)
         return JSValueMakeUndefined(ctx);
 
+    ExecState* exec = toJS(ctx);
     for (Vector<RefPtr<ProfileNode> >::const_iterator it = children.begin(); it != children.end(); ++it) {
-        JSValueRef arg0 = toRef(toJS(toJS(ctx), (*it).get() ));
+        JSValueRef arg0 = toRef(exec, toJS(exec, (*it).get() ));
         JSObjectCallAsFunction(ctx, pushFunction, result, 1, &arg0, exception);
         if (exception && *exception)
             return JSValueMakeUndefined(ctx);
@@ -181,6 +184,30 @@ static JSValueRef getChildren(JSContextRef ctx, JSObjectRef thisObject, JSString
     return result;
 }
 
+static JSValueRef getParent(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    JSC::JSLock lock(false);
+
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    ExecState* exec = toJS(ctx);
+    return toRef(exec, toJS(exec, profileNode->parent()));
+}
+
+static JSValueRef getHead(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    JSC::JSLock lock(false);
+
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    ExecState* exec = toJS(ctx);
+    return toRef(exec, toJS(exec, profileNode->head()));
+}
+
 static JSValueRef getVisible(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
 {
     JSC::JSLock lock(false);
@@ -192,6 +219,17 @@ static JSValueRef getVisible(JSContextRef ctx, JSObjectRef thisObject, JSStringR
     return JSValueMakeBoolean(ctx, profileNode->visible());
 }
 
+static JSValueRef getCallUID(JSContextRef ctx, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    JSC::JSLock lock(false);
+
+    if (!JSValueIsObjectOfClass(ctx, thisObject, ProfileNodeClass()))
+        return JSValueMakeUndefined(ctx);
+
+    ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(thisObject));
+    return JSValueMakeNumber(ctx, profileNode->callIdentifier().hash());
+}
+
 static void finalize(JSObjectRef object)
 {
     ProfileNode* profileNode = static_cast<ProfileNode*>(JSObjectGetPrivate(object));
@@ -211,7 +249,10 @@ JSClassRef ProfileNodeClass()
         { "selfPercent", getSelfPercent, 0, kJSPropertyAttributeNone },
         { "numberOfCalls", getNumberOfCalls, 0, kJSPropertyAttributeNone },
         { "children", getChildren, 0, kJSPropertyAttributeNone },
+        { "parent", getParent, 0, kJSPropertyAttributeNone },
+        { "head", getHead, 0, kJSClassAttributeNone },
         { "visible", getVisible, 0, kJSPropertyAttributeNone },
+        { "callUID", getCallUID, 0, kJSPropertyAttributeNone },
         { 0, 0, 0, 0 }
     };
 
@@ -224,7 +265,7 @@ JSClassRef ProfileNodeClass()
     return profileNodeClass;
 }
 
-JSValuePtr toJS(ExecState* exec, ProfileNode* profileNode)
+JSValue toJS(ExecState* exec, ProfileNode* profileNode)
 {
     if (!profileNode)
         return jsNull();
@@ -241,3 +282,5 @@ JSValuePtr toJS(ExecState* exec, ProfileNode* profileNode)
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
diff --git a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.h b/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.h
index 286aac6..ad72b71 100644
--- a/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.h
+++ b/src/3rdparty/webkit/WebCore/inspector/JavaScriptProfileNode.h
@@ -26,6 +26,8 @@
 #ifndef JavaScriptProfileNode_h
 #define JavaScriptProfileNode_h
 
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+
 #include <runtime/JSValue.h>
 #include <JavaScriptCore/JSBase.h>
 
@@ -37,8 +39,10 @@ namespace JSC {
 namespace WebCore {
 
     JSClassRef ProfileNodeClass();
-    JSC::JSValuePtr toJS(JSC::ExecState*, JSC::ProfileNode*);
+    JSC::JSValue toJS(JSC::ExecState*, JSC::ProfileNode*);
 
 } // namespace WebCore
 
+#endif // ENABLE(JAVASCRIPT_DEBUGGER)
+
 #endif
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js b/src/3rdparty/webkit/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js
new file mode 100644
index 0000000..89b4ddc
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/BottomUpProfileDataGridTree.js
@@ -0,0 +1,252 @@
+/*
+ * Copyright (C) 2009 280 North Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// Bottom Up Profiling shows the entire callstack backwards:
+// The root node is a representation of each individual function called, and each child of that node represents
+// a reverse-callstack showing how many of those calls came from it. So, unlike top-down, the statistics in
+// each child still represent the root node. We have to be particularly careful of recursion with this mode
+// because a root node can represent itself AND an ancestor.
+
+WebInspector.BottomUpProfileDataGridTree = function(/*ProfileView*/ aProfileView, /*ProfileNode*/ aProfileNode)
+{
+    WebInspector.ProfileDataGridTree.call(this, aProfileView, aProfileNode);
+
+    // Iterate each node in pre-order.
+    var profileNodeUIDs = 0;
+    var profileNodeGroups = [[], [aProfileNode]];
+    var visitedProfileNodesForCallUID = {};
+
+    this._remainingNodeInfos = [];
+
+    for (var profileNodeGroupIndex = 0; profileNodeGroupIndex < profileNodeGroups.length; ++profileNodeGroupIndex) {
+        var parentProfileNodes = profileNodeGroups[profileNodeGroupIndex];
+        var profileNodes = profileNodeGroups[++profileNodeGroupIndex];
+        var count = profileNodes.length;
+
+        for (var index = 0; index < count; ++index) {
+            var profileNode = profileNodes[index];
+
+            if (!profileNode.UID)
+                profileNode.UID = ++profileNodeUIDs;
+
+            if (profileNode.head && profileNode !== profileNode.head) {
+                // The total time of this ancestor is accounted for if we're in any form of recursive cycle.
+                var visitedNodes = visitedProfileNodesForCallUID[profileNode.callUID];
+                var totalTimeAccountedFor = false;
+
+                if (!visitedNodes) {
+                    visitedNodes = {}
+                    visitedProfileNodesForCallUID[profileNode.callUID] = visitedNodes;
+                } else {
+                    // The total time for this node has already been accounted for iff one of it's parents has already been visited.
+                    // We can do this check in this style because we are traversing the tree in pre-order.
+                    var parentCount = parentProfileNodes.length;
+                    for (var parentIndex = 0; parentIndex < parentCount; ++parentIndex) {
+                        if (visitedNodes[parentProfileNodes[parentIndex].UID]) {
+                            totalTimeAccountedFor = true;
+                            break;
+                        }
+                    }
+                }
+
+                visitedNodes[profileNode.UID] = true;
+
+                this._remainingNodeInfos.push({ ancestor:profileNode, focusNode:profileNode, totalTimeAccountedFor:totalTimeAccountedFor });
+            }
+
+            var children = profileNode.children;
+            if (children.length) {
+                profileNodeGroups.push(parentProfileNodes.concat([profileNode]))
+                profileNodeGroups.push(children);
+            }
+        }
+    }
+
+    // Populate the top level nodes.
+    WebInspector.BottomUpProfileDataGridNode.prototype._populate.call(this);
+
+    return this;
+}
+
+WebInspector.BottomUpProfileDataGridTree.prototype = {
+    // When focusing, we keep the entire callstack up to this ancestor.
+    focus: function(/*ProfileDataGridNode*/ profileDataGridNode)
+    {
+        if (!profileDataGridNode)
+            return;
+
+        this._save();
+
+        var currentNode = profileDataGridNode;
+        var focusNode = profileDataGridNode;
+
+        while (currentNode.parent && (currentNode instanceof WebInspector.ProfileDataGridNode)) {
+            currentNode._takePropertiesFromProfileDataGridNode(profileDataGridNode);
+
+            focusNode = currentNode;
+            currentNode = currentNode.parent;
+
+            if (currentNode instanceof WebInspector.ProfileDataGridNode)
+                currentNode._keepOnlyChild(focusNode);
+        }
+
+        this.children = [focusNode];
+        this.totalTime = profileDataGridNode.totalTime;
+    },
+
+    exclude: function(/*ProfileDataGridNode*/ profileDataGridNode)
+    {
+        if (!profileDataGridNode)
+            return;
+
+        this._save();
+
+        var excludedCallUID = profileDataGridNode.callUID;
+        var excludedTopLevelChild = this.childrenByCallUID[excludedCallUID];
+
+        // If we have a top level node that is excluded, get rid of it completely (not keeping children),
+        // since bottom up data relies entirely on the root node.
+        if (excludedTopLevelChild)
+            this.children.remove(excludedTopLevelChild);
+
+        var children = this.children;
+        var count = children.length;
+
+        for (var index = 0; index < count; ++index)
+            children[index]._exclude(excludedCallUID);
+
+        if (this.lastComparator)
+            this.sort(this.lastComparator, true);
+    }
+}
+
+WebInspector.BottomUpProfileDataGridTree.prototype.__proto__ = WebInspector.ProfileDataGridTree.prototype;
+
+WebInspector.BottomUpProfileDataGridNode = function(/*ProfileView*/ profileView, /*ProfileNode*/ profileNode, /*BottomUpProfileDataGridTree*/ owningTree)
+{
+    // In bottom up mode, our parents are our children since we display an inverted tree.
+    // However, we don't want to show the very top parent since it is redundant.
+    var hasChildren = !!(profileNode.parent && profileNode.parent.parent);
+
+    WebInspector.ProfileDataGridNode.call(this, profileView, profileNode, owningTree, hasChildren);
+
+    this._remainingNodeInfos = [];
+}
+
+WebInspector.BottomUpProfileDataGridNode.prototype = {
+    _takePropertiesFromProfileDataGridNode: function(/*ProfileDataGridNode*/ profileDataGridNode)
+    {
+        this._save();
+
+        this.selfTime = profileDataGridNode.selfTime;
+        this.totalTime = profileDataGridNode.totalTime;
+        this.numberOfCalls = profileDataGridNode.numberOfCalls;
+    },
+
+    // When focusing, we keep just the members of the callstack.
+    _keepOnlyChild: function(/*ProfileDataGridNode*/ child)
+    {
+        this._save();
+
+        this.removeChildren();
+        this.appendChild(child);
+    },
+
+    _exclude: function(aCallUID)
+    {
+        if (this._remainingNodeInfos)
+            this._populate();
+
+        this._save();
+
+        var children = this.children;
+        var index = this.children.length;
+
+        while (index--)
+            children[index]._exclude(aCallUID);
+
+        var child = this.childrenByCallUID[aCallUID];
+
+        if (child)
+            this._merge(child, true);
+    },
+
+    _merge: function(/*ProfileDataGridNode*/ child, /*Boolean*/ shouldAbsorb)
+    {
+        this.selfTime -= child.selfTime;
+
+        WebInspector.ProfileDataGridNode.prototype._merge.call(this, child, shouldAbsorb);
+    },
+
+    _populate: function(event)
+    {
+        var remainingNodeInfos = this._remainingNodeInfos;
+        var count = remainingNodeInfos.length;
+
+        for (var index = 0; index < count; ++index) {
+            var nodeInfo = remainingNodeInfos[index];
+            var ancestor = nodeInfo.ancestor;
+            var focusNode = nodeInfo.focusNode;
+            var child = this.findChild(ancestor);
+
+            // If we already have this child, then merge the data together.
+            if (child) {
+                var totalTimeAccountedFor = nodeInfo.totalTimeAccountedFor;
+
+                child.selfTime += focusNode.selfTime;
+                child.numberOfCalls += focusNode.numberOfCalls;
+
+                if (!totalTimeAccountedFor)
+                    child.totalTime += focusNode.totalTime;
+            } else {
+                // If not, add it as a true ancestor.
+                // In heavy mode, we take our visual identity from ancestor node...
+                var child = new WebInspector.BottomUpProfileDataGridNode(this.profileView, ancestor, this.tree);
+
+                if (ancestor !== focusNode) {
+                    // but the actual statistics from the "root" node (bottom of the callstack).
+                    child.selfTime = focusNode.selfTime;
+                    child.totalTime = focusNode.totalTime;
+                    child.numberOfCalls = focusNode.numberOfCalls;
+                }
+
+                this.appendChild(child);
+            }
+
+            var parent = ancestor.parent;
+            if (parent && parent.parent) {
+                nodeInfo.ancestor = parent;
+                child._remainingNodeInfos.push(nodeInfo);
+            }
+        }
+
+        delete this._remainingNodeInfos;
+
+        if (this.removeEventListener)
+            this.removeEventListener("populate", this._populate, this);
+    }
+}
+
+WebInspector.BottomUpProfileDataGridNode.prototype.__proto__ = WebInspector.ProfileDataGridNode.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Console.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Console.js
index 31e466c..bce1784 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Console.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Console.js
@@ -141,7 +141,7 @@ WebInspector.Console.prototype = {
 
     addMessage: function(msg)
     {
-        if (msg instanceof WebInspector.ConsoleMessage) {
+        if (msg instanceof WebInspector.ConsoleMessage && !(msg instanceof WebInspector.ConsoleCommandResult)) {
             msg.totalRepeatCount = msg.repeatCount;
             msg.repeatDelta = msg.repeatCount;
 
@@ -241,7 +241,7 @@ WebInspector.Console.prototype = {
         delete this.previousMessage;
     },
 
-    completions: function(wordRange, bestMatchOnly)
+    completions: function(wordRange, bestMatchOnly, completionsReadyCallback)
     {
         // Pass less stop characters to rangeOfWord so the range will be a more complete expression.
         const expressionStopCharacters = " =:{;";
@@ -259,22 +259,20 @@ WebInspector.Console.prototype = {
         if (!expressionString && !prefix)
             return;
 
-        var result;
+        var reportCompletions = this._reportCompletions.bind(this, bestMatchOnly, completionsReadyCallback, dotNotation, bracketNotation, prefix);
         if (expressionString) {
-            try {
-                result = this._evalInInspectedWindow(expressionString);
-            } catch(e) {
-                // Do nothing, the prefix will be considered a window property.
-            }
+            this._evalInInspectedWindow(expressionString, reportCompletions);
         } else {
             // There is no expressionString, so the completion should happen against global properties.
             // Or if the debugger is paused, against properties in scope of the selected call frame.
             if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused)
-                result = WebInspector.panels.scripts.variablesInScopeForSelectedCallFrame();
+                reportCompletions(WebInspector.panels.scripts.variablesInScopeForSelectedCallFrame());
             else
-                result = InspectorController.inspectedWindow();
+                reportCompletions(InspectorController.inspectedWindow());
         }
-
+    },
+    
+    _reportCompletions: function(bestMatchOnly, completionsReadyCallback, dotNotation, bracketNotation, prefix, result) {
         if (bracketNotation) {
             if (prefix.length && prefix[0] === "'")
                 var quoteUsed = "'";
@@ -305,8 +303,7 @@ WebInspector.Console.prototype = {
             if (bestMatchOnly)
                 break;
         }
-
-        return results;
+        setTimeout(completionsReadyCallback, 0, results);
     },
 
     _toggleButtonClicked: function()
@@ -394,12 +391,18 @@ WebInspector.Console.prototype = {
         event.stopPropagation();
     },
 
-    _evalInInspectedWindow: function(expression)
+    _evalInInspectedWindow: function(expression, callback)
     {
-        if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused)
-            return WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression);
+        if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused) {
+            WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression, false, callback);
+            return;
+        }
 
-        var inspectedWindow = InspectorController.inspectedWindow();
+        this.doEvalInWindow(expression, callback);
+    },
+    
+    _ensureCommandLineAPIInstalled: function(inspectedWindow)
+    {
         if (!inspectedWindow._inspectorCommandLineAPI) {
             inspectedWindow.eval("window._inspectorCommandLineAPI = { \
                 $: function() { return document.getElementById.apply(document, arguments) }, \
@@ -424,12 +427,26 @@ WebInspector.Console.prototype = {
 
             inspectedWindow._inspectorCommandLineAPI.clear = InspectorController.wrapCallback(this.clearMessages.bind(this));
         }
-
+    },
+    
+    doEvalInWindow: function(expression, callback)
+    {
         // Surround the expression in with statements to inject our command line API so that
         // the window object properties still take more precedent than our API functions.
         expression = "with (window._inspectorCommandLineAPI) { with (window) { " + expression + " } }";
 
-        return inspectedWindow.eval(expression);
+        var self = this;
+        function delayedEvaluation()
+        {
+            var inspectedWindow = InspectorController.inspectedWindow();
+            self._ensureCommandLineAPIInstalled(inspectedWindow);
+            try {
+                callback(inspectedWindow.eval(expression));
+            } catch (e) {
+                callback(e, true);
+            }
+        }
+        setTimeout(delayedEvaluation, 0);
     },
 
     _enterKeyPressed: function(event)
@@ -446,44 +463,23 @@ WebInspector.Console.prototype = {
         if (!str.length)
             return;
 
-        var result;
-        var exception = false;
-        try {
-            result = this._evalInInspectedWindow(str);
-        } catch(e) {
-            result = e;
-            exception = true;
-        }
-
-        this.prompt.history.push(str);
-        this.prompt.historyOffset = 0;
-        this.prompt.text = "";
+        var commandMessage = new WebInspector.ConsoleCommand(str);
+        this.addMessage(commandMessage);
 
-        var level = exception ? WebInspector.ConsoleMessage.MessageLevel.Error : WebInspector.ConsoleMessage.MessageLevel.Log;
-        this.addMessage(new WebInspector.ConsoleCommand(str, result, this._format(result), level));
-    },
-
-    _mouseOverNode: function(event)
-    {
-        var anchorElement = event.target.enclosingNodeOrSelfWithNodeName("a");
-        WebInspector.hoveredDOMNode = (anchorElement ? anchorElement.representedNode : null);
-    },
-
-    _mouseOutOfNode: function(event)
-    {
-        var nodeUnderMouse = document.elementFromPoint(event.pageX, event.pageY);
-        var anchorElement = nodeUnderMouse.enclosingNodeOrSelfWithNodeName("a");
-        if (!anchorElement || !anchorElement.representedNode)
-            WebInspector.hoveredDOMNode = null;
+        var self = this;
+        function printResult(result, exception)
+        {
+            self.prompt.history.push(str);
+            self.prompt.historyOffset = 0;
+            self.prompt.text = "";
+            self.addMessage(new WebInspector.ConsoleCommandResult(result, exception, commandMessage));
+        }
+        this._evalInInspectedWindow(str, printResult);
     },
 
-    _format: function(output, inline)
+    _format: function(output, forceObjectFormat)
     {
-        var type = Object.type(output, InspectorController.inspectedWindow());
-        if (type === "object") {
-            if (output instanceof InspectorController.inspectedWindow().Node)
-                type = "node";
-        }
+        var type = (forceObjectFormat ? "object" : Object.type(output, InspectorController.inspectedWindow()));
 
         // We don't perform any special formatting on these types, so we just
         // pass them through the simple _formatvalue function.
@@ -497,7 +493,9 @@ WebInspector.Console.prototype = {
         };
 
         var formatter;
-        if (type in undecoratedTypes)
+        if (forceObjectFormat)
+            formatter = "_formatobject";
+        else if (type in undecoratedTypes)
             formatter = "_formatvalue";
         else {
             formatter = "_format" + type;
@@ -509,77 +507,74 @@ WebInspector.Console.prototype = {
 
         var span = document.createElement("span");
         span.addStyleClass("console-formatted-" + type);
-        this[formatter](output, span, inline);
+        this[formatter](output, span);
         return span;
     },
 
-    _formatvalue: function(val, elem, inline)
+    _formatvalue: function(val, elem)
     {
         elem.appendChild(document.createTextNode(val));
     },
 
-    _formatstring: function(str, elem, inline)
+    _formatstring: function(str, elem)
     {
         elem.appendChild(document.createTextNode("\"" + str + "\""));
     },
 
-    _formatregexp: function(re, elem, inline)
+    _formatregexp: function(re, elem)
     {
         var formatted = String(re).replace(/([\\\/])/g, "\\$1").replace(/\\(\/[gim]*)$/, "$1").substring(1);
         elem.appendChild(document.createTextNode(formatted));
     },
 
-    _formatarray: function(arr, elem, inline)
+    _formatarray: function(arr, elem)
     {
         elem.appendChild(document.createTextNode("["));
         for (var i = 0; i < arr.length; ++i) {
-            elem.appendChild(this._format(arr[i], true));
+            elem.appendChild(this._format(arr[i]));
             if (i < arr.length - 1)
                 elem.appendChild(document.createTextNode(", "));
         }
         elem.appendChild(document.createTextNode("]"));
     },
 
-    _formatnode: function(node, elem, inline)
+    _formatnode: function(node, elem)
     {
-        var anchor = document.createElement("a");
-        anchor.className = "inspectible-node";
-        anchor.innerHTML = nodeTitleInfo.call(node).title;
-        anchor.representedNode = node;
-        anchor.addEventListener("mouseover", this._mouseOverNode.bind(this), false);
-        anchor.addEventListener("mouseout", this._mouseOutOfNode.bind(this), false);
-
-        if (inline)
-            elem.appendChild(anchor);
-        else
-            elem.appendChild(new WebInspector.ObjectPropertiesSection(node, anchor, null, null, true).element);
+        var treeOutline = new WebInspector.ElementsTreeOutline();
+        treeOutline.rootDOMNode = node;
+        treeOutline.element.addStyleClass("outline-disclosure");
+        if (!treeOutline.children[0].hasChildren)
+            treeOutline.element.addStyleClass("single-node");
+        elem.appendChild(treeOutline.element);
     },
 
-    _formatobject: function(obj, elem, inline)
+    _formatobject: function(obj, elem)
     {
-        if (inline)
-            elem.appendChild(document.createTextNode(Object.describe(obj)));
-        else
-            elem.appendChild(new WebInspector.ObjectPropertiesSection(obj, null, null, null, true).element);
+        elem.appendChild(new WebInspector.ObjectPropertiesSection(obj, null, null, null, true).element);
     },
 
-    _formaterror: function(obj, elem, inline)
+    _formaterror: function(obj, elem)
     {
-        elem.appendChild(document.createTextNode(obj.name + ": " + obj.message + " "));
+        var messageElement = document.createElement("span");
+        messageElement.className = "error-message";
+        messageElement.textContent = obj.name + ": " + obj.message;
+        elem.appendChild(messageElement);
 
         if (obj.sourceURL) {
             var urlElement = document.createElement("a");
-            urlElement.className = "console-message-url webkit-html-resource-link";
+            urlElement.className = "webkit-html-resource-link";
             urlElement.href = obj.sourceURL;
             urlElement.lineNumber = obj.line;
             urlElement.preferredPanel = "scripts";
 
             if (obj.line > 0)
-                urlElement.textContent = WebInspector.UIString("%s (line %d)", obj.sourceURL, obj.line);
+                urlElement.textContent = WebInspector.displayNameForURL(obj.sourceURL) + ":" + obj.line;
             else
-                urlElement.textContent = obj.sourceURL;
+                urlElement.textContent = WebInspector.displayNameForURL(obj.sourceURL);
 
+            elem.appendChild(document.createTextNode(" ("));
             elem.appendChild(urlElement);
+            elem.appendChild(document.createTextNode(")"));
         }
     },
 }
@@ -594,41 +589,36 @@ WebInspector.ConsoleMessage = function(source, level, line, url, groupLevel, rep
     this.url = url;
     this.groupLevel = groupLevel;
     this.repeatCount = repeatCount;
-
-    switch (this.level) {
-        case WebInspector.ConsoleMessage.MessageLevel.Object:
-            var propertiesSection = new WebInspector.ObjectPropertiesSection(arguments[6], null, null, null, true);
-            propertiesSection.element.addStyleClass("console-message");
-            this.propertiesSection = propertiesSection;
-            break;
-        case WebInspector.ConsoleMessage.MessageLevel.Node:
-            var node = arguments[6];
-            if (!(node instanceof InspectorController.inspectedWindow().Node))
-                return;
-            this.elementsTreeOutline = new WebInspector.ElementsTreeOutline();
-            this.elementsTreeOutline.rootDOMNode = node;
-            break;
-        case WebInspector.ConsoleMessage.MessageLevel.Trace:
-            var span = document.createElement("span");
-            span.addStyleClass("console-formatted-trace");
-            var stack = Array.prototype.slice.call(arguments, 6);
-            var funcNames = stack.map(function(f) {
-                return f || WebInspector.UIString("(anonymous function)");
-            });
-            span.appendChild(document.createTextNode(funcNames.join("\n")));
-            this.formattedMessage = span;
-            break;
-        default:
-            // The formatedMessage property is used for the rich and interactive console.
-            this.formattedMessage = this._format(Array.prototype.slice.call(arguments, 6));
-
-            // This is used for inline message bubbles in SourceFrames, or other plain-text representations.
-            this.message = this.formattedMessage.textContent;
-            break;
-    }
+    if (arguments.length > 6)
+        this.setMessageBody(Array.prototype.slice.call(arguments, 6));
 }
 
 WebInspector.ConsoleMessage.prototype = {
+    setMessageBody: function(args)
+    {
+        switch (this.level) {
+            case WebInspector.ConsoleMessage.MessageLevel.Trace:
+                var span = document.createElement("span");
+                span.addStyleClass("console-formatted-trace");
+                var stack = Array.prototype.slice.call(args);
+                var funcNames = stack.map(function(f) {
+                    return f || WebInspector.UIString("(anonymous function)");
+                });
+                span.appendChild(document.createTextNode(funcNames.join("\n")));
+                this.formattedMessage = span;
+                break;
+            case WebInspector.ConsoleMessage.MessageLevel.Object:
+                this.formattedMessage = this._format(["%O", args[0]]);
+                break;
+            default:
+                this.formattedMessage = this._format(args);
+                break;
+        }
+
+        // This is used for inline message bubbles in SourceFrames, or other plain-text representations.
+        this.message = this.formattedMessage.textContent;
+    },
+
     isErrorOrWarning: function()
     {
         return (this.level === WebInspector.ConsoleMessage.MessageLevel.Warning || this.level === WebInspector.ConsoleMessage.MessageLevel.Error);
@@ -643,6 +633,11 @@ WebInspector.ConsoleMessage.prototype = {
 
         function formatForConsole(obj)
         {
+            return WebInspector.console._format(obj);
+        }
+
+        function formatAsObjectForConsole(obj)
+        {
             return WebInspector.console._format(obj, true);
         }
 
@@ -655,6 +650,8 @@ WebInspector.ConsoleMessage.prototype = {
             formatters.o = formatForConsole;
             // Firebug allows both %i and %d for formatting integers.
             formatters.i = formatters.d;
+            // Support %O to force object formating, instead of the type-based %o formatting.
+            formatters.O = formatAsObjectForConsole;
 
             function append(a, b)
             {
@@ -675,10 +672,9 @@ WebInspector.ConsoleMessage.prototype = {
         for (var i = 0; i < parameters.length; ++i) {
             if (typeof parameters[i] === "string")
                 formattedResult.appendChild(WebInspector.linkifyStringAsFragment(parameters[i]));
-            else if (parameters.length === 1)
-                formattedResult.appendChild(WebInspector.console._format(parameters[0]));
             else
                 formattedResult.appendChild(formatForConsole(parameters[i]));
+
             if (i < parameters.length - 1)
                 formattedResult.appendChild(document.createTextNode(" "));
         }
@@ -758,7 +754,7 @@ WebInspector.ConsoleMessage.prototype = {
                 urlElement.preferredPanel = "scripts";
 
             if (this.line > 0)
-                urlElement.textContent = WebInspector.UIString("%s (line %d)", WebInspector.displayNameForURL(this.url), this.line);
+                urlElement.textContent = WebInspector.displayNameForURL(this.url) + ":" + this.line;
             else
                 urlElement.textContent = WebInspector.displayNameForURL(this.url);
 
@@ -814,14 +810,20 @@ WebInspector.ConsoleMessage.prototype = {
             case WebInspector.ConsoleMessage.MessageLevel.Object:
                 levelString = "Object";
                 break;
-            case WebInspector.ConsoleMessage.MessageLevel.GroupTitle:
-                levelString = "GroupTitle";
+            case WebInspector.ConsoleMessage.MessageLevel.Trace:
+                levelString = "Trace";
+                break;
+            case WebInspector.ConsoleMessage.MessageLevel.StartGroup:
+                levelString = "Start Group";
+                break;
+            case WebInspector.ConsoleMessage.MessageLevel.EndGroup:
+                levelString = "End Group";
                 break;
         }
 
         return sourceString + " " + levelString + ": " + this.formattedMessage.textContent + "\n" + this.url + " line " + this.line;
     },
-    
+
     isEqual: function(msg, disreguardGroup)
     {
         if (!msg)
@@ -853,17 +855,14 @@ WebInspector.ConsoleMessage.MessageLevel = {
     Warning: 2,
     Error: 3,
     Object: 4,
-    Node: 5,
-    Trace: 6,
-    StartGroup: 7,
-    EndGroup: 8
+    Trace: 5,
+    StartGroup: 6,
+    EndGroup: 7
 }
 
-WebInspector.ConsoleCommand = function(command, result, formattedResultElement, level)
+WebInspector.ConsoleCommand = function(command)
 {
     this.command = command;
-    this.formattedResultElement = formattedResultElement;
-    this.level = level;
 }
 
 WebInspector.ConsoleCommand.prototype = {
@@ -878,30 +877,33 @@ WebInspector.ConsoleCommand.prototype = {
         commandTextElement.textContent = this.command;
         element.appendChild(commandTextElement);
 
-        var resultElement = document.createElement("div");
-        resultElement.className = "console-message";
-        element.appendChild(resultElement);
+        return element;
+    }
+}
 
-        switch (this.level) {
-            case WebInspector.ConsoleMessage.MessageLevel.Log:
-                resultElement.addStyleClass("console-log-level");
-                break;
-            case WebInspector.ConsoleMessage.MessageLevel.Warning:
-                resultElement.addStyleClass("console-warning-level");
-                break;
-            case WebInspector.ConsoleMessage.MessageLevel.Error:
-                resultElement.addStyleClass("console-error-level");
-        }
+WebInspector.ConsoleCommandResult = function(result, exception, originatingCommand)
+{
+    var level = (exception ? WebInspector.ConsoleMessage.MessageLevel.Error : WebInspector.ConsoleMessage.MessageLevel.Log);
+    var message = (exception ? String(result) : result);
+    var line = (exception ? result.line : -1);
+    var url = (exception ? result.sourceURL : null);
+
+    WebInspector.ConsoleMessage.call(this, WebInspector.ConsoleMessage.MessageSource.JS, level, line, url, null, 1, message);
 
-        var resultTextElement = document.createElement("span");
-        resultTextElement.className = "console-message-text";
-        resultTextElement.appendChild(this.formattedResultElement);
-        resultElement.appendChild(resultTextElement);
+    this.originatingCommand = originatingCommand;
+}
 
+WebInspector.ConsoleCommandResult.prototype = {
+    toMessageElement: function()
+    {
+        var element = WebInspector.ConsoleMessage.prototype.toMessageElement.call(this);
+        element.addStyleClass("console-user-command-result");
         return element;
     }
 }
 
+WebInspector.ConsoleCommandResult.prototype.__proto__ = WebInspector.ConsoleMessage.prototype;
+
 WebInspector.ConsoleGroup = function(parentGroup, level)
 {
     this.parentGroup = parentGroup;
@@ -928,8 +930,11 @@ WebInspector.ConsoleGroup.prototype = {
             element.addEventListener("click", this._titleClicked.bind(this), true);
         } else
             this.messagesElement.appendChild(element);
+
+        if (element.previousSibling && msg.originatingCommand && element.previousSibling.command === msg.originatingCommand)
+            element.previousSibling.addStyleClass("console-adjacent-user-command-result");
     },
-    
+
     _titleClicked: function(event)
     {
         var groupTitleElement = event.target.enclosingNodeOrSelfWithClass("console-group-title-level");
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorage.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorage.js
new file mode 100644
index 0000000..5207b69
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorage.js
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2008 Nokia Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.DOMStorage = function(domStorage, domain, isLocalStorage)
+{
+    this.domStorage = domStorage;
+    this.domain = domain;
+    this.isLocalStorage = isLocalStorage;
+}
+
+WebInspector.DOMStorage.prototype = {
+    get domStorage()
+    {
+        return this._domStorage;
+    },
+
+    set domStorage(x)
+    {
+        if (this._domStorage === x)
+            return;
+        this._domStorage = x;
+    },
+
+    get domain()
+    {
+        return this._domain;
+    },
+
+    set domain(x)
+    {
+        if (this._domain === x)
+            return;
+        this._domain = x;
+    },
+    
+    get isLocalStorage()
+    {
+        return this._isLocalStorage;
+    },
+    
+    set isLocalStorage(x)
+    {
+        if (this._isLocalStorage === x)
+            return;
+        this._isLocalStorage = x;
+    }
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageDataGrid.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageDataGrid.js
new file mode 100644
index 0000000..9946415
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageDataGrid.js
@@ -0,0 +1,103 @@
+/*
+ * Copyright (C) 2009 Nokia Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *        notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *        notice, this list of conditions and the following disclaimer in the
+ *        documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.         IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.DOMStorageDataGrid = function(columns)
+{
+    WebInspector.DataGrid.call(this, columns);
+    this.dataTableBody.addEventListener("dblclick", this._ondblclick.bind(this), false);
+}
+
+WebInspector.DOMStorageDataGrid.prototype = {
+    _ondblclick: function(event)
+    {
+        if (this._editing)
+            return;
+        if (this._editingNode)
+            return;
+        this._startEditing(event);
+    },
+    
+    _startEditing: function(event)
+    {
+        var element = event.target.enclosingNodeOrSelfWithNodeName("td");
+        if (!element)
+            return;
+        this._editingNode = this.dataGridNodeFromEvent(event);
+        if (!this._editingNode)
+            return;
+        this._editing = true;
+            
+        WebInspector.startEditing(element, this._editingCommitted.bind(this), this._editingCancelled.bind(this), element.textContent);
+        window.getSelection().setBaseAndExtent(element, 0, element, 1);
+    },
+    
+    _editingCommitted: function(element, newText)
+    {
+        if (element.hasStyleClass("0-column"))
+            columnIdentifier = 0;
+        else
+            columnIdentifier = 1;
+        textBeforeEditing = this._editingNode.data[columnIdentifier];
+        if (textBeforeEditing == newText) {
+            this._editingCancelled(element);
+            return;
+        }
+        
+        var domStorage = WebInspector.panels.databases.visibleView.domStorage.domStorage;
+        if (domStorage) {
+            if (columnIdentifier == 0) {
+                if (domStorage.getItem(newText) != null) {
+                    element.textContent = this._editingNode.data[0];
+                    this._editingCancelled(element);
+                    return;
+                }
+                domStorage.removeItem(this._editingNode.data[0]);
+                domStorage.setItem(newText, this._editingNode.data[1]);
+                this._editingNode.data[0] = newText;            
+            } else {
+                domStorage.setItem(this._editingNode.data[0], newText);
+                this._editingNode.data[1] = newText;
+            }
+        }
+        
+        this._editingCancelled(element);
+    },
+    
+    _editingCancelled: function(element, context)
+    {
+        delete this._editing;
+        this._editingNode = null;
+    },
+    
+    deleteSelectedRow: function()
+    {
+        var node = this.selectedNode;
+        var domStorage = WebInspector.panels.databases.visibleView.domStorage.domStorage;
+        if (node && domStorage)
+            domStorage.removeItem(node.data[0]);
+    }
+}
+
+WebInspector.DOMStorageDataGrid.prototype.__proto__ = WebInspector.DataGrid.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageItemsView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageItemsView.js
new file mode 100644
index 0000000..912573e
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DOMStorageItemsView.js
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2008 Nokia Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.DOMStorageItemsView = function(domStorage)
+{
+    WebInspector.View.call(this);
+
+    this.domStorage = domStorage;
+
+    this.element.addStyleClass("storage-view");
+    this.element.addStyleClass("table");
+
+    this.deleteButton = document.createElement("button");
+    this.deleteButton.title = WebInspector.UIString("Delete");
+    this.deleteButton.className = "delete-storage-status-bar-item status-bar-item hidden";
+    this.deleteButton.addEventListener("click", this._deleteButtonClicked.bind(this), false);
+
+    this.refreshButton = document.createElement("button");
+    this.refreshButton.title = WebInspector.UIString("Refresh");
+    this.refreshButton.className = "refresh-storage-status-bar-item status-bar-item";
+    this.refreshButton.addEventListener("click", this._refreshButtonClicked.bind(this), false);
+}
+
+WebInspector.DOMStorageItemsView.prototype = {
+    get statusBarItems()
+    {
+        return [this.refreshButton, this.deleteButton];
+    },
+
+    show: function(parentElement)
+    {
+        WebInspector.View.prototype.show.call(this, parentElement);
+        this.update();
+    },
+
+    hide: function()
+    {
+        WebInspector.View.prototype.hide.call(this);
+        this.deleteButton.addStyleClass("hidden");
+    },
+
+    update: function()
+    {
+        this.element.removeChildren();
+        var hasDOMStorage = this.domStorage;
+        if (hasDOMStorage)
+            hasDOMStorage = this.domStorage.domStorage;
+
+        if (hasDOMStorage) {
+            var dataGrid = WebInspector.panels.databases.dataGridForDOMStorage(this.domStorage.domStorage);
+            if (!dataGrid)
+                hasDOMStorage = 0;
+            else {
+                this._dataGrid = dataGrid;
+                this.element.appendChild(dataGrid.element);
+                this.deleteButton.removeStyleClass("hidden");
+            }
+        }
+
+        if (!hasDOMStorage) {
+            var emptyMsgElement = document.createElement("div");
+            emptyMsgElement.className = "storage-table-empty";
+            if (this.domStorage)
+            emptyMsgElement.textContent = WebInspector.UIString("This storage is empty.");
+            this.element.appendChild(emptyMsgElement);
+            this._dataGrid = null;
+            this.deleteButton.addStyleClass("hidden");
+        }
+    },
+
+    _deleteButtonClicked: function(event)
+    {
+        if (this._dataGrid) {
+            this._dataGrid.deleteSelectedRow();
+            
+            this.show();
+        }
+    },
+
+    _refreshButtonClicked: function(event)
+    {
+        this.update();
+    }
+}
+
+WebInspector.DOMStorageItemsView.prototype.__proto__ = WebInspector.View.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DataGrid.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DataGrid.js
index 6f103ed..2fcb08c 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DataGrid.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DataGrid.js
@@ -169,32 +169,19 @@ WebInspector.DataGrid.prototype = {
     insertChild: function(child, index)
     {
         if (!child)
-            throw("Node can't be undefined or null.");
+            throw("insertChild: Node can't be undefined or null.");
         if (child.parent === this)
-            throw("Node is already a child of this node.");
+            throw("insertChild: Node is already a child of this node.");
 
         if (child.parent)
             child.parent.removeChild(child);
 
-        var previousChild = (index > 0 ? this.children[index - 1] : null);
-        if (previousChild) {
-            previousChild.nextSibling = child;
-            child.previousSibling = previousChild;
-        } else
-            child.previousSibling = null;
-
-        var nextChild = this.children[index];
-        if (nextChild) {
-            nextChild.previousSibling = child;
-            child.nextSibling = nextChild;
-        } else
-            child.nextSibling = null;
-
         this.children.splice(index, 0, child);
         this.hasChildren = true;
 
         child.parent = this;
         child.dataGrid = this.dataGrid;
+        child._recalculateSiblings(index);
 
         delete child._depth;
         delete child._revealed;
@@ -216,9 +203,9 @@ WebInspector.DataGrid.prototype = {
     removeChild: function(child)
     {
         if (!child)
-            throw("Node can't be undefined or null.");
+            throw("removeChild: Node can't be undefined or null.");
         if (child.parent !== this)
-            throw("Node is not a child of this node.");
+            throw("removeChild: Node is not a child of this node.");
 
         child.deselect();
 
@@ -233,6 +220,9 @@ WebInspector.DataGrid.prototype = {
         child.parent = null;
         child.nextSibling = null;
         child.previousSibling = null;
+
+        if (this.children.length <= 0)
+            this.hasChildren = false;
     },
 
     removeChildren: function()
@@ -249,6 +239,7 @@ WebInspector.DataGrid.prototype = {
         }
 
         this.children = [];
+        this.hasChildren = false;
     },
 
     removeChildrenRecursive: function()
@@ -405,7 +396,7 @@ WebInspector.DataGrid.prototype = {
         var gridNode = this.dataGridNodeFromEvent(event);
         if (!gridNode || !gridNode.selectable)
             return;
-    
+
         if (gridNode.isEventWithinDisclosureTriangle(event))
             return;
 
@@ -519,6 +510,34 @@ WebInspector.DataGridNode.prototype = {
         return true;
     },
 
+    set hasChildren(x)
+    {
+        if (this._hasChildren === x)
+            return;
+
+        this._hasChildren = x;
+
+        if (!this._element)
+            return;
+
+        if (this._hasChildren)
+        {
+            this._element.addStyleClass("parent");
+            if (this.expanded)
+                this._element.addStyleClass("expanded");
+        }
+        else
+        {
+            this._element.removeStyleClass("parent");
+            this._element.removeStyleClass("expanded");
+        }
+    },
+
+    get hasChildren()
+    {
+        return this._hasChildren;
+    },
+
     set revealed(x)
     {
         if (this._revealed === x)
@@ -624,6 +643,28 @@ WebInspector.DataGridNode.prototype = {
     removeChildren: WebInspector.DataGrid.prototype.removeChildren,
     removeChildrenRecursive: WebInspector.DataGrid.prototype.removeChildrenRecursive,
 
+    _recalculateSiblings: function(myIndex)
+    {
+        if (!this.parent)
+            return;
+
+        var previousChild = (myIndex > 0 ? this.parent.children[myIndex - 1] : null);
+
+        if (previousChild) {
+            previousChild.nextSibling = this;
+            this.previousSibling = previousChild;
+        } else
+            this.previousSibling = null;
+
+        var nextChild = this.parent.children[myIndex + 1];
+
+        if (nextChild) {
+            nextChild.previousSibling = this;
+            this.nextSibling = nextChild;
+        } else
+            this.nextSibling = null;
+    },
+
     collapse: function()
     {
         if (this._element)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js
index 6a91625..429c2c3 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseQueryView.js
@@ -29,7 +29,7 @@ WebInspector.DatabaseQueryView = function(database)
 
     this.database = database;
 
-    this.element.addStyleClass("database-view");
+    this.element.addStyleClass("storage-view");
     this.element.addStyleClass("query");
     this.element.tabIndex = 0;
 
@@ -58,7 +58,7 @@ WebInspector.DatabaseQueryView.prototype = {
         setTimeout(moveBackIfOutside.bind(this), 0);
     },
 
-    completions: function(wordRange, bestMatchOnly)
+    completions: function(wordRange, bestMatchOnly, completionsReadyCallback)
     {
         var prefix = wordRange.toString().toLowerCase();
         if (!prefix.length)
@@ -85,7 +85,7 @@ WebInspector.DatabaseQueryView.prototype = {
         accumulateMatches(this.database.tableNames.map(function(name) { return name + " " }));
         accumulateMatches(["SELECT ", "FROM ", "WHERE ", "LIMIT ", "DELETE FROM ", "CREATE ", "DROP ", "TABLE ", "INDEX ", "UPDATE ", "INSERT INTO ", "VALUES ("]);
 
-        return results;
+        completionsReadyCallback(results);
     },
 
     _promptKeyDown: function(event)
@@ -157,7 +157,7 @@ WebInspector.DatabaseQueryView.prototype = {
         else if (error.code == 2)
             var message = WebInspector.UIString("Database no longer has expected version.");
         else
-            var message = WebInspector.UIString("An unexpected error %s occured.", error.code);
+            var message = WebInspector.UIString("An unexpected error %s occurred.", error.code);
 
         this._appendQueryResult(query, message, "error");
     },
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseTableView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseTableView.js
index 2e72240..bbca9d0 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseTableView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabaseTableView.js
@@ -30,8 +30,13 @@ WebInspector.DatabaseTableView = function(database, tableName)
     this.database = database;
     this.tableName = tableName;
 
-    this.element.addStyleClass("database-view");
+    this.element.addStyleClass("storage-view");
     this.element.addStyleClass("table");
+
+    this.refreshButton = document.createElement("button");
+    this.refreshButton.title = WebInspector.UIString("Refresh");
+    this.refreshButton.className = "refresh-storage-status-bar-item status-bar-item";
+    this.refreshButton.addEventListener("click", this._refreshButtonClicked.bind(this), false);
 }
 
 WebInspector.DatabaseTableView.prototype = {
@@ -41,6 +46,11 @@ WebInspector.DatabaseTableView.prototype = {
         this.update();
     },
 
+    get statusBarItems()
+    {
+        return [this.refreshButton];
+    },
+
     update: function()
     {
         function queryTransaction(tx)
@@ -58,7 +68,7 @@ WebInspector.DatabaseTableView.prototype = {
         var dataGrid = WebInspector.panels.databases.dataGridForResult(result);
         if (!dataGrid) {
             var emptyMsgElement = document.createElement("div");
-            emptyMsgElement.className = "database-table-empty";
+            emptyMsgElement.className = "storage-table-empty";
             emptyMsgElement.textContent = WebInspector.UIString("The “%s”\ntable is empty.", this.tableName);
             this.element.appendChild(emptyMsgElement);
             return;
@@ -72,11 +82,15 @@ WebInspector.DatabaseTableView.prototype = {
         this.element.removeChildren();
 
         var errorMsgElement = document.createElement("div");
-        errorMsgElement.className = "database-table-error";
+        errorMsgElement.className = "storage-table-error";
         errorMsgElement.textContent = WebInspector.UIString("An error occurred trying to\nread the “%s” table.", this.tableName);
         this.element.appendChild(errorMsgElement);
     },
 
+    _refreshButtonClicked: function(event)
+    {
+        this.update();
+    }
 }
 
 WebInspector.DatabaseTableView.prototype.__proto__ = WebInspector.View.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabasesPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabasesPanel.js
index df5bbb3..4644b3b 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/DatabasesPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/DatabasesPanel.js
@@ -46,9 +46,24 @@ WebInspector.DatabasesPanel = function(database)
 
     this.sidebarTree = new TreeOutline(this.sidebarTreeElement);
 
-    this.databaseViews = document.createElement("div");
-    this.databaseViews.id = "database-views";
-    this.element.appendChild(this.databaseViews);
+    this.databasesListTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("DATABASES"), {}, true);
+    this.sidebarTree.appendChild(this.databasesListTreeElement);
+    this.databasesListTreeElement.expand();
+
+    this.localStorageListTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("LOCAL STORAGE"), {}, true);
+    this.sidebarTree.appendChild(this.localStorageListTreeElement);
+    this.localStorageListTreeElement.expand();
+
+    this.sessionStorageListTreeElement = new WebInspector.SidebarSectionTreeElement(WebInspector.UIString("SESSION STORAGE"), {}, true);
+    this.sidebarTree.appendChild(this.sessionStorageListTreeElement);
+    this.sessionStorageListTreeElement.expand();
+
+    this.storageViews = document.createElement("div");
+    this.storageViews.id = "storage-views";
+    this.element.appendChild(this.storageViews);
+
+    this.storageViewStatusBarItemsContainer = document.createElement("div");
+    this.storageViewStatusBarItemsContainer.id = "storage-view-status-bar-items";
 
     this.reset();
 }
@@ -61,6 +76,11 @@ WebInspector.DatabasesPanel.prototype = {
         return WebInspector.UIString("Databases");
     },
 
+    get statusBarItems()
+    {
+        return [this.storageViewStatusBarItemsContainer];
+    },
+
     show: function()
     {
         WebInspector.Panel.prototype.show.call(this);
@@ -81,8 +101,23 @@ WebInspector.DatabasesPanel.prototype = {
 
         this._databases = [];
 
-        this.sidebarTree.removeChildren();
-        this.databaseViews.removeChildren();
+        if (this._domStorage) {
+            var domStorageLength = this._domStorage.length;
+            for (var i = 0; i < domStorageLength; ++i) {
+                var domStorage = this._domStorage[i];
+
+                delete domStorage._domStorageView;
+            }
+        }
+
+        this._domStorage = [];
+
+        this.databasesListTreeElement.removeChildren();
+        this.localStorageListTreeElement.removeChildren();
+        this.sessionStorageListTreeElement.removeChildren();
+        this.storageViews.removeChildren();
+        
+        this.storageViewStatusBarItemsContainer.removeChildren();
     },
 
     handleKeyEvent: function(event)
@@ -96,8 +131,18 @@ WebInspector.DatabasesPanel.prototype = {
 
         var databaseTreeElement = new WebInspector.DatabaseSidebarTreeElement(database);
         database._databasesTreeElement = databaseTreeElement;
+        this.databasesListTreeElement.appendChild(databaseTreeElement);
+    },
 
-        this.sidebarTree.appendChild(databaseTreeElement);
+    addDOMStorage: function(domStorage)
+    {
+        this._domStorage.push(domStorage);
+        var domStorageTreeElement = new WebInspector.DOMStorageSidebarTreeElement(domStorage);
+        domStorage._domStorageTreeElement = domStorageTreeElement;
+        if (domStorage.isLocalStorage)
+            this.localStorageListTreeElement.appendChild(domStorageTreeElement);
+        else
+            this.sessionStorageListTreeElement.appendChild(domStorageTreeElement);
     },
 
     showDatabase: function(database, tableName)
@@ -105,8 +150,8 @@ WebInspector.DatabasesPanel.prototype = {
         if (!database)
             return;
 
-        if (this.visibleDatabaseView)
-            this.visibleDatabaseView.hide();
+        if (this.visibleView)
+            this.visibleView.hide();
 
         var view;
         if (tableName) {
@@ -125,16 +170,46 @@ WebInspector.DatabasesPanel.prototype = {
             }
         }
 
-        view.show(this.databaseViews);
+        view.show(this.storageViews);
+
+        this.visibleView = view;
 
-        this.visibleDatabaseView = view;
+        this.storageViewStatusBarItemsContainer.removeChildren();
+        var statusBarItems = view.statusBarItems;
+        for (var i = 0; i < statusBarItems.length; ++i)
+            this.storageViewStatusBarItemsContainer.appendChild(statusBarItems[i]);
+    },
+
+    showDOMStorage: function(domStorage)
+    {
+        if (!domStorage)
+            return;
+
+        if (this.visibleView)
+            this.visibleView.hide();
+
+        var view;
+        view = domStorage._domStorageView;
+        if (!view) {
+            view = new WebInspector.DOMStorageItemsView(domStorage);
+            domStorage._domStorageView = view;
+        }
+
+        view.show(this.storageViews);
+
+        this.visibleView = view;
+
+        this.storageViewStatusBarItemsContainer.removeChildren();
+        var statusBarItems = view.statusBarItems;
+        for (var i = 0; i < statusBarItems.length; ++i)
+            this.storageViewStatusBarItemsContainer.appendChild(statusBarItems[i]);
     },
 
     closeVisibleView: function()
     {
-        if (this.visibleDatabaseView)
-            this.visibleDatabaseView.hide();
-        delete this.visibleDatabaseView;
+        if (this.visibleView)
+            this.visibleView.hide();
+        delete this.visibleView;
     },
 
     updateDatabaseTables: function(database)
@@ -155,7 +230,7 @@ WebInspector.DatabasesPanel.prototype = {
 
         for (var tableName in database._tableViews) {
             if (!(tableName in tableNamesHash)) {
-                if (this.visibleDatabaseView === database._tableViews[tableName])
+                if (this.visibleView === database._tableViews[tableName])
                     this.closeVisibleView();
                 delete database._tableViews[tableName];
             }
@@ -241,6 +316,60 @@ WebInspector.DatabasesPanel.prototype = {
         return dataGrid;
     },
 
+    dataGridForDOMStorage: function(domStorage)
+    {
+        if (!domStorage.length)
+            return null;
+
+        var columns = {};
+        columns[0] = {};
+        columns[1] = {};
+        columns[0].title = WebInspector.UIString("Key");
+        columns[0].width = columns[0].title.length;
+        columns[1].title = WebInspector.UIString("Value");
+        columns[1].width = columns[0].title.length;
+
+        var nodes = [];
+        
+        var length = domStorage.length;
+        for (index = 0; index < domStorage.length; index++) {
+            var data = {};
+       
+            var key = String(domStorage.key(index));
+            data[0] = key;
+            if (key.length > columns[0].width)
+                columns[0].width = key.length;
+        
+            var value = String(domStorage.getItem(key));
+            data[1] = value;
+            if (value.length > columns[1].width)
+                columns[1].width = value.length;
+            var node = new WebInspector.DataGridNode(data, false);
+            node.selectable = true;
+            nodes.push(node);
+        }
+
+        var totalColumnWidths = columns[0].width + columns[1].width;
+        width = Math.round((columns[0].width * 100) / totalColumnWidths);
+        const minimumPrecent = 10;
+        if (width < minimumPrecent)
+            width = minimumPrecent;
+        if (width > 100 - minimumPrecent)
+            width = 100 - minimumPrecent;
+        columns[0].width = width;
+        columns[1].width = 100 - width;
+        columns[0].width += "%";
+        columns[1].width += "%";
+
+        var dataGrid = new WebInspector.DOMStorageDataGrid(columns);
+        var length = nodes.length;
+        for (var i = 0; i < length; ++i)
+            dataGrid.appendChild(nodes[i]);
+        if (length > 0)
+            nodes[0].selected = true;
+        return dataGrid;
+    },
+
     _startSidebarDragging: function(event)
     {
         WebInspector.elementDragStart(this.sidebarResizeElement, this._sidebarDragging.bind(this), this._endSidebarDragging.bind(this), event, "col-resize");
@@ -277,7 +406,8 @@ WebInspector.DatabasesPanel.prototype = {
         this._currentSidebarWidth = width;
 
         this.sidebarElement.style.width = width + "px";
-        this.databaseViews.style.left = width + "px";
+        this.storageViews.style.left = width + "px";
+        this.storageViewStatusBarItemsContainer.style.left = width + "px";
         this.sidebarResizeElement.style.left = (width - 3) + "px";
     }
 }
@@ -355,3 +485,42 @@ WebInspector.SidebarDatabaseTableTreeElement.prototype = {
 }
 
 WebInspector.SidebarDatabaseTableTreeElement.prototype.__proto__ = WebInspector.SidebarTreeElement.prototype;
+
+WebInspector.DOMStorageSidebarTreeElement = function(domStorage)
+{
+
+    this.domStorage = domStorage;
+
+    WebInspector.SidebarTreeElement.call(this, "domstorage-sidebar-tree-item", domStorage, "", null, false);
+
+    this.refreshTitles();
+}
+
+WebInspector.DOMStorageSidebarTreeElement.prototype = {
+    onselect: function()
+    {
+        WebInspector.panels.databases.showDOMStorage(this.domStorage);
+    },
+
+    get mainTitle()
+    {
+        return this.domStorage.domain;
+    },
+
+    set mainTitle(x)
+    {
+        // Do nothing.
+    },
+
+    get subtitle()
+    {
+        return ""; //this.database.displayDomain;
+    },
+
+    set subtitle(x)
+    {
+        // Do nothing.
+    }
+}
+
+WebInspector.DOMStorageSidebarTreeElement.prototype.__proto__ = WebInspector.SidebarTreeElement.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js
index 16e31b8..2da2f10 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -487,7 +487,7 @@ WebInspector.ElementsTreeElement.prototype = {
             return;
 
         if (this.treeOutline.panel) {
-            this.treeOutline.rootDOMNode = this.parent.representedObject;
+            this.treeOutline.rootDOMNode = this.representedObject.parentNode;
             this.treeOutline.focusedDOMNode = this.representedObject;
         }
 
@@ -571,7 +571,7 @@ WebInspector.ElementsTreeElement.prototype = {
         parseContainerElement.innerHTML = "<span " + newText + "></span>";
         var parseElement = parseContainerElement.firstChild;
         if (!parseElement || !parseElement.hasAttributes()) {
-            editingCancelled(element, context);
+            this._editingCancelled(element, context);
             return;
         }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/domStorage.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/domStorage.png
new file mode 100644
index 0000000..028550c
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/domStorage.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/radioDot.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/radioDot.png
new file mode 100644
index 0000000..609878f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/radioDot.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/resourcesSilhouette.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/resourcesSilhouette.png
new file mode 100644
index 0000000..9c8bb53
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/resourcesSilhouette.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Images/userInputResultIcon.png b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/userInputResultIcon.png
new file mode 100644
index 0000000..794a5ca
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Images/userInputResultIcon.png
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ObjectPropertiesSection.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ObjectPropertiesSection.js
index ab6ac55..59e7374 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ObjectPropertiesSection.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ObjectPropertiesSection.js
@@ -214,13 +214,18 @@ WebInspector.ObjectPropertyTreeElement.prototype = {
         this.editingEnded(context);
     },
 
-    evaluateExpression: function(expression)
+    evaluateExpression: function(expression, callback)
     {
         // Evaluate in the currently selected call frame if the debugger is paused.
         // Otherwise evaluate in against the inspected window.
         if (WebInspector.panels.scripts && WebInspector.panels.scripts.paused && this.treeOutline.section.editInSelectedCallFrameWhenPaused)
-            return WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression, false);
-        return InspectorController.inspectedWindow().eval(expression);
+            return WebInspector.panels.scripts.evaluateInSelectedCallFrame(expression, false, callback);
+        try {
+            var result = InspectorController.inspectedWindow().eval(expression);
+            callback(result);
+        } catch (e) {
+            callback(e, true);
+        }
     },
 
     applyExpression: function(expression, updateInterface)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/PanelEnablerView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/PanelEnablerView.js
index 6ec565b..fab6d76 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/PanelEnablerView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/PanelEnablerView.js
@@ -44,6 +44,23 @@ WebInspector.PanelEnablerView = function(identifier, headingText, disclaimerText
     this.headerElement.textContent = headingText;
     this.choicesForm.appendChild(this.headerElement);
 
+    var self = this;
+    function enableOption(text, checked) {
+        var label = document.createElement("label");
+        var option = document.createElement("input");
+        option.type = "radio";
+        option.name = "enable-option";
+        if (checked)
+            option.checked = true;
+        label.appendChild(option);
+        label.appendChild(document.createTextNode(text));
+        self.choicesForm.appendChild(label);
+        return option;
+    };
+
+    this.enabledForSession = enableOption(WebInspector.UIString("Only enable for this session"), true);
+    this.enabledAlways = enableOption(WebInspector.UIString("Always enable"));
+
     this.disclaimerElement = document.createElement("div");
     this.disclaimerElement.className = "panel-enabler-disclaimer";
     this.disclaimerElement.textContent = disclaimerText;
@@ -70,6 +87,10 @@ WebInspector.PanelEnablerView.prototype = {
 
         if (this.element.offsetWidth < (this.choicesForm.offsetWidth + this.imageElement.offsetWidth))
             this.imageElement.addStyleClass("hidden");
+    },
+
+    get alwaysEnabled() {
+        return this.enabledAlways.checked;
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileDataGridTree.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileDataGridTree.js
new file mode 100644
index 0000000..84d9923
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileDataGridTree.js
@@ -0,0 +1,398 @@
+/*
+ * Copyright (C) 2009 280 North Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.ProfileDataGridNode = function(profileView, profileNode, owningTree, hasChildren)
+{
+    this.profileView = profileView;
+    this.profileNode = profileNode;
+
+    WebInspector.DataGridNode.call(this, null, hasChildren);
+
+    this.addEventListener("populate", this._populate, this);
+
+    this.tree = owningTree;
+
+    this.childrenByCallUID = {};
+    this.lastComparator = null;
+
+    this.callUID = profileNode.callUID;
+    this.selfTime = profileNode.selfTime;
+    this.totalTime = profileNode.totalTime;
+    this.functionName = profileNode.functionName;
+    this.numberOfCalls = profileNode.numberOfCalls;
+    this.url = profileNode.url;
+}
+
+WebInspector.ProfileDataGridNode.prototype = {
+    get data()
+    {
+        function formatMilliseconds(time)
+        {
+            return Number.secondsToString(time / 1000, WebInspector.UIString.bind(WebInspector), true);
+        }
+
+        var data = {};
+
+        data["function"] = this.functionName;
+        data["calls"] = this.numberOfCalls;
+
+        if (this.profileView.showSelfTimeAsPercent)
+            data["self"] = WebInspector.UIString("%.2f%%", this.selfPercent);
+        else
+            data["self"] = formatMilliseconds(this.selfTime);
+
+        if (this.profileView.showTotalTimeAsPercent)
+            data["total"] = WebInspector.UIString("%.2f%%", this.totalPercent);
+        else
+            data["total"] = formatMilliseconds(this.totalTime);
+
+        if (this.profileView.showAverageTimeAsPercent)
+            data["average"] = WebInspector.UIString("%.2f%%", this.averagePercent);
+        else
+            data["average"] = formatMilliseconds(this.averageTime);
+
+        return data;
+    },
+
+    createCell: function(columnIdentifier)
+    {
+        var cell = WebInspector.DataGridNode.prototype.createCell.call(this, columnIdentifier);
+
+        if (columnIdentifier === "self" && this._searchMatchedSelfColumn)
+            cell.addStyleClass("highlight");
+        else if (columnIdentifier === "total" && this._searchMatchedTotalColumn)
+            cell.addStyleClass("highlight");
+        else if (columnIdentifier === "average" && this._searchMatchedAverageColumn)
+            cell.addStyleClass("highlight");
+        else if (columnIdentifier === "calls" && this._searchMatchedCallsColumn)
+            cell.addStyleClass("highlight");
+
+        if (columnIdentifier !== "function")
+            return cell;
+
+        if (this.profileNode._searchMatchedFunctionColumn)
+            cell.addStyleClass("highlight");
+
+        if (this.profileNode.url) {
+            var fileName = WebInspector.displayNameForURL(this.profileNode.url);
+
+            var urlElement = document.createElement("a");
+            urlElement.className = "profile-node-file webkit-html-resource-link";
+            urlElement.href = this.profileNode.url;
+            urlElement.lineNumber = this.profileNode.lineNumber;
+
+            if (this.profileNode.lineNumber > 0)
+                urlElement.textContent = fileName + ":" + this.profileNode.lineNumber;
+            else
+                urlElement.textContent = fileName;
+
+            cell.insertBefore(urlElement, cell.firstChild);
+        }
+
+        return cell;
+    },
+
+    select: function(supressSelectedEvent)
+    {
+        WebInspector.DataGridNode.prototype.select.call(this, supressSelectedEvent);
+        this.profileView._dataGridNodeSelected(this);
+    },
+
+    deselect: function(supressDeselectedEvent)
+    {
+        WebInspector.DataGridNode.prototype.deselect.call(this, supressDeselectedEvent);
+        this.profileView._dataGridNodeDeselected(this);
+    },
+
+    expand: function()
+    {
+        if (!this.parent) {
+            var currentComparator = this.parent.lastComparator;
+
+            if (!currentComparator || (currentComparator === this.lastComparator))
+                return;
+
+            this.sort(currentComparator);
+        }
+
+        WebInspector.DataGridNode.prototype.expand.call(this);
+    },
+
+    sort: function(/*Function*/ comparator, /*Boolean*/ force)
+    {
+        var gridNodeGroups = [[this]];
+
+        for (var gridNodeGroupIndex = 0; gridNodeGroupIndex < gridNodeGroups.length; ++gridNodeGroupIndex) {
+            var gridNodes = gridNodeGroups[gridNodeGroupIndex];
+            var count = gridNodes.length;
+
+            for (var index = 0; index < count; ++index) {
+                var gridNode = gridNodes[index];
+
+                // If the grid node is collapsed, then don't sort children (save operation for later).
+                // If the grid node has the same sorting as previously, then there is no point in sorting it again.
+                if (!force && !gridNode.expanded || gridNode.lastComparator === comparator)
+                    continue;
+
+                gridNode.lastComparator = comparator;
+
+                var children = gridNode.children;
+                var childCount = children.length;
+
+                if (childCount) {
+                    children.sort(comparator);
+
+                    for (var childIndex = 0; childIndex < childCount; ++childIndex)
+                        children[childIndex]._recalculateSiblings(childIndex);
+
+                    gridNodeGroups.push(children);
+                }
+            }
+        }
+    },
+
+    insertChild: function(/*ProfileDataGridNode*/ profileDataGridNode, index)
+    {
+        WebInspector.DataGridNode.prototype.insertChild.call(this, profileDataGridNode, index);
+
+        this.childrenByCallUID[profileDataGridNode.callUID] = profileDataGridNode;
+    },
+
+    removeChild: function(/*ProfileDataGridNode*/ profileDataGridNode)
+    {
+        WebInspector.DataGridNode.prototype.removeChild.call(this, profileDataGridNode);
+
+        delete this.childrenByCallUID[profileDataGridNode.callUID];
+    },
+
+    removeChildren: function(/*ProfileDataGridNode*/ profileDataGridNode)
+    {
+        WebInspector.DataGridNode.prototype.removeChildren.call(this);
+
+        this.childrenByCallUID = {};
+    },
+
+    findChild: function(/*Node*/ node)
+    {
+        if (!node)
+            return null;
+        return this.childrenByCallUID[node.callUID];
+    },
+
+    get averageTime()
+    {
+        return this.selfTime / Math.max(1, this.numberOfCalls);
+    },
+
+    get averagePercent()
+    {
+        return this.averageTime / this.tree.totalTime * 100.0;
+    },
+
+    get selfPercent()
+    {
+        return this.selfTime / this.tree.totalTime * 100.0;
+    },
+
+    get totalPercent()
+    {
+        return this.totalTime / this.tree.totalTime * 100.0;
+    },
+
+    // When focusing and collapsing we modify lots of nodes in the tree.
+    // This allows us to restore them all to their original state when we revert.
+    _save: function()
+    {
+        if (this._savedChildren)
+            return;
+
+        this._savedSelfTime = this.selfTime;
+        this._savedTotalTime = this.totalTime;
+        this._savedNumberOfCalls = this.numberOfCalls;
+
+        this._savedChildren = this.children.slice();
+    },
+
+    // When focusing and collapsing we modify lots of nodes in the tree.
+    // This allows us to restore them all to their original state when we revert.
+    _restore: function()
+    {
+        if (!this._savedChildren)
+            return;
+
+        this.selfTime = this._savedSelfTime;
+        this.totalTime = this._savedTotalTime;
+        this.numberOfCalls = this._savedNumberOfCalls;
+
+        this.removeChildren();
+
+        var children = this._savedChildren;
+        var count = children.length;
+
+        for (var index = 0; index < count; ++index) {
+            children[index]._restore();
+            this.appendChild(children[index]);
+        }
+    },
+
+    _merge: function(child, shouldAbsorb)
+    {
+        this.selfTime += child.selfTime;
+
+        if (!shouldAbsorb) {
+            this.totalTime += child.totalTime;
+            this.numberOfCalls += child.numberOfCalls;
+        }
+
+        var children = this.children.slice();
+
+        this.removeChildren();
+
+        var count = children.length;
+
+        for (var index = 0; index < count; ++index) {
+            if (!shouldAbsorb || children[index] !== child)
+                this.appendChild(children[index]);
+        }
+
+        children = child.children.slice();
+        count = children.length;
+
+        for (var index = 0; index < count; ++index) {
+            var orphanedChild = children[index],
+                existingChild = this.childrenByCallUID[orphanedChild.callUID];
+
+            if (existingChild)
+                existingChild._merge(orphanedChild, false);
+            else
+                this.appendChild(orphanedChild);
+        }
+    }
+}
+
+WebInspector.ProfileDataGridNode.prototype.__proto__ = WebInspector.DataGridNode.prototype;
+
+WebInspector.ProfileDataGridTree = function(profileView, profileNode)
+{
+    this.tree = this;
+    this.children = [];
+
+    this.profileView = profileView;
+
+    this.totalTime = profileNode.totalTime;
+    this.lastComparator = null;
+
+    this.childrenByCallUID = {};
+}
+
+WebInspector.ProfileDataGridTree.prototype = {
+    get expanded()
+    {
+        return true;
+    },
+
+    appendChild: function(child)
+    {
+        this.insertChild(child, this.children.length);
+    },
+
+    insertChild: function(child, index)
+    {
+        this.children.splice(index, 0, child);
+        this.childrenByCallUID[child.callUID] = child;
+    },
+
+    removeChildren: function()
+    {
+        this.children = [];
+        this.childrenByCallUID = {};
+    },
+
+    findChild: WebInspector.ProfileDataGridNode.prototype.findChild,
+    sort: WebInspector.ProfileDataGridNode.prototype.sort,
+
+    _save: function()
+    {
+        if (this._savedChildren)
+            return;
+
+        this._savedTotalTime = this.totalTime;
+        this._savedChildren = this.children.slice();
+    },
+
+    restore: function()
+    {
+        if (!this._savedChildren)
+            return;
+
+        this.children = this._savedChildren;
+        this.totalTime = this._savedTotalTime;
+
+        var children = this.children;
+        var count = children.length;
+
+        for (var index = 0; index < count; ++index)
+            children[index]._restore();
+
+        this._savedChildren = null;
+    }
+}
+
+WebInspector.ProfileDataGridTree.propertyComparators = [{}, {}];
+
+WebInspector.ProfileDataGridTree.propertyComparator = function(/*String*/ property, /*Boolean*/ isAscending)
+{
+    var comparator = this.propertyComparators[(isAscending ? 1 : 0)][property];
+
+    if (!comparator) {
+        if (isAscending) {
+            comparator = function(lhs, rhs)
+            {
+                if (lhs[property] < rhs[property])
+                    return -1;
+
+                if (lhs[property] > rhs[property])
+                    return 1;
+
+                return 0;
+            }
+        } else {
+            comparator = function(lhs, rhs)
+            {
+                if (lhs[property] > rhs[property])
+                    return -1;
+
+                if (lhs[property] < rhs[property])
+                    return 1;
+
+                return 0;
+            }
+        }
+
+        this.propertyComparators[(isAscending ? 1 : 0)][property] = comparator;
+    }
+
+    return comparator;
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
index 92e9726..bc78fc8 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfileView.js
@@ -31,9 +31,11 @@ WebInspector.ProfileView = function(profile)
 
     this.showSelfTimeAsPercent = true;
     this.showTotalTimeAsPercent = true;
+    this.showAverageTimeAsPercent = true;
 
     var columns = { "self": { title: WebInspector.UIString("Self"), width: "72px", sort: "descending", sortable: true },
                     "total": { title: WebInspector.UIString("Total"), width: "72px", sortable: true },
+                    "average": { title: WebInspector.UIString("Average"), width: "72px", sortable: true },
                     "calls": { title: WebInspector.UIString("Calls"), width: "54px", sortable: true },
                     "function": { title: WebInspector.UIString("Function"), disclosure: true, sortable: true } };
 
@@ -75,16 +77,14 @@ WebInspector.ProfileView = function(profile)
     this.resetButton.className = "reset-profile-status-bar-item status-bar-item hidden";
     this.resetButton.addEventListener("click", this._resetClicked.bind(this), false);
 
-    // Default to the heavy profile.
-    profile = profile.heavyProfile;
+    this.profile = profile;
 
-    // By default the profile isn't sorted, so sort based on our default sort
-    // column and direction added to the DataGrid columns above.
-    profile.sortSelfTimeDescending();
+    this.profileDataGridTree = this.bottomUpProfileDataGridTree;
+    this.profileDataGridTree.sort(WebInspector.ProfileDataGridTree.propertyComparator("selfTime", false));
 
-    this._updatePercentButton();
+    this.refresh();
 
-    this.profile = profile;
+    this._updatePercentButton();
 }
 
 WebInspector.ProfileView.prototype = {
@@ -101,9 +101,53 @@ WebInspector.ProfileView.prototype = {
     set profile(profile)
     {
         this._profile = profile;
+    },
+
+    get bottomUpProfileDataGridTree()
+    {
+        if (!this._bottomUpProfileDataGridTree)
+            this._bottomUpProfileDataGridTree = new WebInspector.BottomUpProfileDataGridTree(this, this.profile.head);
+        return this._bottomUpProfileDataGridTree;
+    },
+
+    get topDownProfileDataGridTree()
+    {
+        if (!this._topDownProfileDataGridTree)
+            this._topDownProfileDataGridTree = new WebInspector.TopDownProfileDataGridTree(this, this.profile.head);
+        return this._topDownProfileDataGridTree;
+    },
+
+    get currentTree()
+    {
+        return this._currentTree;
+    },
+
+    set currentTree(tree)
+    {
+        this._currentTree = tree;
         this.refresh();
     },
 
+    get topDownTree()
+    {
+        if (!this._topDownTree) {
+            this._topDownTree = WebInspector.TopDownTreeFactory.create(this.profile.head);
+            this._sortProfile(this._topDownTree);
+        }
+
+        return this._topDownTree;
+    },
+
+    get bottomUpTree()
+    {
+        if (!this._bottomUpTree) {
+            this._bottomUpTree = WebInspector.BottomUpTreeFactory.create(this.profile.head);
+            this._sortProfile(this._bottomUpTree);
+        }
+
+        return this._bottomUpTree;
+    },
+
     hide: function()
     {
         WebInspector.View.prototype.hide.call(this);
@@ -116,20 +160,18 @@ WebInspector.ProfileView.prototype = {
 
         this.dataGrid.removeChildren();
 
-        var children = this.profile.head.children;
-        var childrenLength = children.length;
-        for (var i = 0; i < childrenLength; ++i)
-            if (children[i].visible)
-                this.dataGrid.appendChild(new WebInspector.ProfileDataGridNode(this, children[i]));
+        var children = this.profileDataGridTree.children;
+        var count = children.length;
+
+        for (var index = 0; index < count; ++index)
+            this.dataGrid.appendChild(children[index]);
 
-        if (selectedProfileNode && selectedProfileNode._dataGridNode)
-            selectedProfileNode._dataGridNode.selected = true;
+        if (selectedProfileNode)
+            selectedProfileNode.selected = true;
     },
 
-    refreshShowAsPercents: function()
+    refreshVisibleData: function()
     {
-        this._updatePercentButton();
-
         var child = this.dataGrid.children[0];
         while (child) {
             child.refresh();
@@ -137,6 +179,12 @@ WebInspector.ProfileView.prototype = {
         }
     },
 
+    refreshShowAsPercents: function()
+    {
+        this._updatePercentButton();
+        this.refreshVisibleData();
+    },
+
     searchCanceled: function()
     {
         if (this._searchResults) {
@@ -148,8 +196,7 @@ WebInspector.ProfileView.prototype = {
                 delete profileNode._searchMatchedCallsColumn;
                 delete profileNode._searchMatchedFunctionColumn;
 
-                if (profileNode._dataGridNode)
-                    profileNode._dataGridNode.refresh();
+                profileNode.refresh();
             }
         }
 
@@ -191,112 +238,97 @@ WebInspector.ProfileView.prototype = {
         if (!isNaN(queryNumber) && !(greaterThan || lessThan))
             equalTo = true;
 
-        function matchesQuery(profileNode)
+        function matchesQuery(/*ProfileDataGridNode*/ profileDataGridNode)
         {
-            delete profileNode._searchMatchedSelfColumn;
-            delete profileNode._searchMatchedTotalColumn;
-            delete profileNode._searchMatchedCallsColumn;
-            delete profileNode._searchMatchedFunctionColumn;
+            delete profileDataGridNode._searchMatchedSelfColumn;
+            delete profileDataGridNode._searchMatchedTotalColumn;
+            delete profileDataGridNode._searchMatchedAverageColumn;
+            delete profileDataGridNode._searchMatchedCallsColumn;
+            delete profileDataGridNode._searchMatchedFunctionColumn;
 
             if (percentUnits) {
                 if (lessThan) {
-                    if (profileNode.selfPercent < queryNumber)
-                        profileNode._searchMatchedSelfColumn = true;
-                    if (profileNode.totalPercent < queryNumber)
-                        profileNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.selfPercent < queryNumber)
+                        profileDataGridNode._searchMatchedSelfColumn = true;
+                    if (profileDataGridNode.totalPercent < queryNumber)
+                        profileDataGridNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.averagePercent < queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedAverageColumn = true;
                 } else if (greaterThan) {
-                    if (profileNode.selfPercent > queryNumber)
-                        profileNode._searchMatchedSelfColumn = true;
-                    if (profileNode.totalPercent > queryNumber)
-                        profileNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.selfPercent > queryNumber)
+                        profileDataGridNode._searchMatchedSelfColumn = true;
+                    if (profileDataGridNode.totalPercent > queryNumber)
+                        profileDataGridNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.averagePercent < queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedAverageColumn = true;
                 }
 
                 if (equalTo) {
-                    if (profileNode.selfPercent == queryNumber)
-                        profileNode._searchMatchedSelfColumn = true;
-                    if (profileNode.totalPercent == queryNumber)
-                        profileNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.selfPercent == queryNumber)
+                        profileDataGridNode._searchMatchedSelfColumn = true;
+                    if (profileDataGridNode.totalPercent == queryNumber)
+                        profileDataGridNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.averagePercent < queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedAverageColumn = true;
                 }
             } else if (millisecondsUnits || secondsUnits) {
                 if (lessThan) {
-                    if (profileNode.selfTime < queryNumberMilliseconds)
-                        profileNode._searchMatchedSelfColumn = true;
-                    if (profileNode.totalTime < queryNumberMilliseconds)
-                        profileNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.selfTime < queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedSelfColumn = true;
+                    if (profileDataGridNode.totalTime < queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.averageTime < queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedAverageColumn = true;
                 } else if (greaterThan) {
-                    if (profileNode.selfTime > queryNumberMilliseconds)
-                        profileNode._searchMatchedSelfColumn = true;
-                    if (profileNode.totalTime > queryNumberMilliseconds)
-                        profileNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.selfTime > queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedSelfColumn = true;
+                    if (profileDataGridNode.totalTime > queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.averageTime > queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedAverageColumn = true;
                 }
 
                 if (equalTo) {
-                    if (profileNode.selfTime == queryNumberMilliseconds)
-                        profileNode._searchMatchedSelfColumn = true;
-                    if (profileNode.totalTime == queryNumberMilliseconds)
-                        profileNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.selfTime == queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedSelfColumn = true;
+                    if (profileDataGridNode.totalTime == queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedTotalColumn = true;
+                    if (profileDataGridNode.averageTime == queryNumberMilliseconds)
+                        profileDataGridNode._searchMatchedAverageColumn = true;
                 }
             } else {
-                if (equalTo && profileNode.numberOfCalls == queryNumber)
-                    profileNode._searchMatchedCallsColumn = true;
-                if (greaterThan && profileNode.numberOfCalls > queryNumber)
-                    profileNode._searchMatchedCallsColumn = true;
-                if (lessThan && profileNode.numberOfCalls < queryNumber)
-                    profileNode._searchMatchedCallsColumn = true;
+                if (equalTo && profileDataGridNode.numberOfCalls == queryNumber)
+                    profileDataGridNode._searchMatchedCallsColumn = true;
+                if (greaterThan && profileDataGridNode.numberOfCalls > queryNumber)
+                    profileDataGridNode._searchMatchedCallsColumn = true;
+                if (lessThan && profileDataGridNode.numberOfCalls < queryNumber)
+                    profileDataGridNode._searchMatchedCallsColumn = true;
             }
 
-            if (profileNode.functionName.hasSubstring(query, true) || profileNode.url.hasSubstring(query, true))
-                profileNode._searchMatchedFunctionColumn = true;
-
-            var matched = (profileNode._searchMatchedSelfColumn || profileNode._searchMatchedTotalColumn || profileNode._searchMatchedCallsColumn || profileNode._searchMatchedFunctionColumn);
-            if (matched && profileNode._dataGridNode)
-                profileNode._dataGridNode.refresh();
+            if (profileDataGridNode.functionName.hasSubstring(query, true) || profileDataGridNode.url.hasSubstring(query, true))
+                profileDataGridNode._searchMatchedFunctionColumn = true;
+
+            if (profileDataGridNode._searchMatchedSelfColumn ||
+                profileDataGridNode._searchMatchedTotalColumn ||
+                profileDataGridNode._searchMatchedAverageColumn ||
+                profileDataGridNode._searchMatchedCallsColumn ||
+                profileDataGridNode._searchMatchedFunctionColumn)
+            {
+                profileDataGridNode.refresh();
+                return true;
+            }
 
-            return matched;
+            return false;
         }
 
-        var current = this.profile.head;
-        var ancestors = [];
-        var nextIndexes = [];
-        var startIndex = 0;
+        var current = this.profileDataGridTree.children[0];
 
         while (current) {
-            var children = current.children;
-            var childrenLength = children.length;
-
-            if (startIndex >= childrenLength) {
-                current = ancestors.pop();
-                startIndex = nextIndexes.pop();
-                continue;
+            if (matchesQuery(current)) {
+                this._searchResults.push({ profileNode: current });
             }
 
-            for (var i = startIndex; i < childrenLength; ++i) {
-                var child = children[i];
-
-                if (matchesQuery(child)) {
-                    if (child._dataGridNode) {
-                        // The child has a data grid node already, no need to remember the ancestors.
-                        this._searchResults.push({ profileNode: child });
-                    } else {
-                        var ancestorsCopy = [].concat(ancestors);
-                        ancestorsCopy.push(current);
-                        this._searchResults.push({ profileNode: child, ancestors: ancestorsCopy });
-                    }
-                }
-
-                if (child.children.length) {
-                    ancestors.push(current);
-                    nextIndexes.push(i + 1);
-                    current = child;
-                    startIndex = 0;
-                    break;
-                }
-
-                if (i === (childrenLength - 1)) {
-                    current = ancestors.pop();
-                    startIndex = nextIndexes.pop();
-                }
-            }
+            current = current.traverseNextNode(false, null, false);
         }
 
         finishedCallback(this, this._searchResults.length);
@@ -352,26 +384,9 @@ WebInspector.ProfileView.prototype = {
         if (!searchResult)
             return;
 
-        var profileNode = this._searchResults[index].profileNode;
-        if (!profileNode._dataGridNode && searchResult.ancestors) {
-            var ancestors = searchResult.ancestors;
-            for (var i = 0; i < ancestors.length; ++i) {
-                var ancestorProfileNode = ancestors[i];
-                var gridNode = ancestorProfileNode._dataGridNode;
-                if (gridNode)
-                    gridNode.expand();
-            }
-
-            // No need to keep the ancestors around.
-            delete searchResult.ancestors;
-        }
-
-        gridNode = profileNode._dataGridNode;
-        if (!gridNode)
-            return;
-
-        gridNode.reveal();
-        gridNode.select();
+        var profileNode = searchResult.profileNode;
+        profileNode.reveal();
+        profileNode.select();
     },
 
     _changeView: function(event)
@@ -380,12 +395,12 @@ WebInspector.ProfileView.prototype = {
             return;
 
         if (event.target.selectedIndex == 1 && this.view == "Heavy") {
-            this._sortProfile(this.profile.treeProfile);
-            this.profile = this.profile.treeProfile;
+            this.profileDataGridTree = this.topDownProfileDataGridTree;
+            this._sortProfile();
             this.view = "Tree";
         } else if (event.target.selectedIndex == 0 && this.view == "Tree") {
-            this._sortProfile(this.profile.heavyProfile);
-            this.profile = this.profile.heavyProfile;
+            this.profileDataGridTree = this.bottomUpProfileDataGridTree;
+            this._sortProfile();
             this.view = "Heavy";
         }
 
@@ -401,15 +416,16 @@ WebInspector.ProfileView.prototype = {
 
     _percentClicked: function(event)
     {
-        var currentState = this.showSelfTimeAsPercent && this.showTotalTimeAsPercent;
+        var currentState = this.showSelfTimeAsPercent && this.showTotalTimeAsPercent && this.showAverageTimeAsPercent;
         this.showSelfTimeAsPercent = !currentState;
         this.showTotalTimeAsPercent = !currentState;
+        this.showAverageTimeAsPercent = !currentState;
         this.refreshShowAsPercents();
     },
 
     _updatePercentButton: function()
     {
-        if (this.showSelfTimeAsPercent && this.showTotalTimeAsPercent) {
+        if (this.showSelfTimeAsPercent && this.showTotalTimeAsPercent && this.showAverageTimeAsPercent) {
             this.percentButton.title = WebInspector.UIString("Show absolute total and self times.");
             this.percentButton.addStyleClass("toggled-on");
         } else {
@@ -420,28 +436,36 @@ WebInspector.ProfileView.prototype = {
 
     _focusClicked: function(event)
     {
-        if (!this.dataGrid.selectedNode || !this.dataGrid.selectedNode.profileNode)
+        if (!this.dataGrid.selectedNode)
             return;
+
         this.resetButton.removeStyleClass("hidden");
-        this.profile.focus(this.dataGrid.selectedNode.profileNode);
+        this.profileDataGridTree.focus(this.dataGrid.selectedNode);
         this.refresh();
+        this.refreshVisibleData();
     },
 
     _excludeClicked: function(event)
     {
-        if (!this.dataGrid.selectedNode || !this.dataGrid.selectedNode.profileNode)
+        var selectedNode = this.dataGrid.selectedNode
+
+        if (!selectedNode)
             return;
+
+        selectedNode.deselect();
+
         this.resetButton.removeStyleClass("hidden");
-        this.profile.exclude(this.dataGrid.selectedNode.profileNode);
-        this.dataGrid.selectedNode.deselect();
+        this.profileDataGridTree.exclude(selectedNode);
         this.refresh();
+        this.refreshVisibleData();
     },
 
     _resetClicked: function(event)
     {
         this.resetButton.addStyleClass("hidden");
-        this.profile.restoreAll();
+        this.profileDataGridTree.restore();
         this.refresh();
+        this.refreshVisibleData();
     },
 
     _dataGridNodeSelected: function(node)
@@ -461,37 +485,21 @@ WebInspector.ProfileView.prototype = {
         this._sortProfile(this.profile);
     },
 
-    _sortProfile: function(profile)
+    _sortProfile: function()
     {
-        if (!profile)
-            return;
-
-        var sortOrder = this.dataGrid.sortOrder;
+        var sortAscending = this.dataGrid.sortOrder === "ascending";
         var sortColumnIdentifier = this.dataGrid.sortColumnIdentifier;
+        var sortProperty = {
+                "average": "averageTime",
+                "self": "selfTime",
+                "total": "totalTime",
+                "calls": "numberOfCalls",
+                "function": "functionName"
+            }[sortColumnIdentifier];
 
-        var sortingFunctionName = "sort";
-
-        if (sortColumnIdentifier === "self")
-            sortingFunctionName += "SelfTime";
-        else if (sortColumnIdentifier === "total")
-            sortingFunctionName += "TotalTime";
-        else if (sortColumnIdentifier === "calls")
-            sortingFunctionName += "Calls";
-        else if (sortColumnIdentifier === "function")
-            sortingFunctionName += "FunctionName";
+        this.profileDataGridTree.sort(WebInspector.ProfileDataGridTree.propertyComparator(sortProperty, sortAscending));
 
-        if (sortOrder === "ascending")
-            sortingFunctionName += "Ascending";
-        else
-            sortingFunctionName += "Descending";
-
-        if (!(sortingFunctionName in this.profile))
-            return;
-
-        profile[sortingFunctionName]();
-
-        if (profile === this.profile)
-            this.refresh();
+        this.refresh();
     },
 
     _mouseDownInDataGrid: function(event)
@@ -500,13 +508,15 @@ WebInspector.ProfileView.prototype = {
             return;
 
         var cell = event.target.enclosingNodeOrSelfWithNodeName("td");
-        if (!cell || (!cell.hasStyleClass("total-column") && !cell.hasStyleClass("self-column")))
+        if (!cell || (!cell.hasStyleClass("total-column") && !cell.hasStyleClass("self-column") && !cell.hasStyleClass("average-column")))
             return;
 
         if (cell.hasStyleClass("total-column"))
             this.showTotalTimeAsPercent = !this.showTotalTimeAsPercent;
         else if (cell.hasStyleClass("self-column"))
             this.showSelfTimeAsPercent = !this.showSelfTimeAsPercent;
+        else if (cell.hasStyleClass("average-column"))
+            this.showAverageTimeAsPercent = !this.showAverageTimeAsPercent;
 
         this.refreshShowAsPercents();
 
@@ -516,127 +526,3 @@ WebInspector.ProfileView.prototype = {
 }
 
 WebInspector.ProfileView.prototype.__proto__ = WebInspector.View.prototype;
-
-WebInspector.ProfileDataGridNode = function(profileView, profileNode)
-{
-    this.profileView = profileView;
-
-    this.profileNode = profileNode;
-    profileNode._dataGridNode = this;
-
-    // Find the first child that is visible. Since we don't want to claim
-    // we have children if all the children are invisible.
-    var hasChildren = false;
-    var children = this.profileNode.children;
-    var childrenLength = children.length;
-    for (var i = 0; i < childrenLength; ++i) {
-        if (children[i].visible) {
-            hasChildren = true;
-            break;
-        }
-    }
-
-    WebInspector.DataGridNode.call(this, null, hasChildren);
-
-    this.addEventListener("populate", this._populate, this);
-
-    this.expanded = profileNode._expanded;
-}
-
-WebInspector.ProfileDataGridNode.prototype = {
-    get data()
-    {
-        function formatMilliseconds(time)
-        {
-            return Number.secondsToString(time / 1000, WebInspector.UIString.bind(WebInspector), true);
-        }
-
-        var data = {};
-        data["function"] = this.profileNode.functionName;
-        data["calls"] = this.profileNode.numberOfCalls;
-
-        if (this.profileView.showSelfTimeAsPercent)
-            data["self"] = WebInspector.UIString("%.2f%%", this.profileNode.selfPercent);
-        else
-            data["self"] = formatMilliseconds(this.profileNode.selfTime);
-
-        if (this.profileView.showTotalTimeAsPercent)
-            data["total"] = WebInspector.UIString("%.2f%%", this.profileNode.totalPercent);
-        else
-            data["total"] = formatMilliseconds(this.profileNode.totalTime);
-
-        return data;
-    },
-
-    createCell: function(columnIdentifier)
-    {
-        var cell = WebInspector.DataGridNode.prototype.createCell.call(this, columnIdentifier);
-
-        if (columnIdentifier === "self" && this.profileNode._searchMatchedSelfColumn)
-            cell.addStyleClass("highlight");
-        else if (columnIdentifier === "total" && this.profileNode._searchMatchedTotalColumn)
-            cell.addStyleClass("highlight");
-        else if (columnIdentifier === "calls" && this.profileNode._searchMatchedCallsColumn)
-            cell.addStyleClass("highlight");
-
-        if (columnIdentifier !== "function")
-            return cell;
-
-        if (this.profileNode._searchMatchedFunctionColumn)
-            cell.addStyleClass("highlight");
-
-        if (this.profileNode.url) {
-            var fileName = WebInspector.displayNameForURL(this.profileNode.url);
-
-            var urlElement = document.createElement("a");
-            urlElement.className = "profile-node-file webkit-html-resource-link";
-            urlElement.href = this.profileNode.url;
-            urlElement.lineNumber = this.profileNode.lineNumber;
-
-            if (this.profileNode.lineNumber > 0)
-                urlElement.textContent = fileName + ":" + this.profileNode.lineNumber;
-            else
-                urlElement.textContent = fileName;
-
-            cell.insertBefore(urlElement, cell.firstChild);
-        }
-
-        return cell;
-    },
-
-    select: function(supressSelectedEvent)
-    {
-        WebInspector.DataGridNode.prototype.select.call(this, supressSelectedEvent);
-        this.profileView._dataGridNodeSelected(this);
-    },
-
-    deselect: function(supressDeselectedEvent)
-    {
-        WebInspector.DataGridNode.prototype.deselect.call(this, supressDeselectedEvent);
-        this.profileView._dataGridNodeDeselected(this);
-    },
-
-    expand: function()
-    {
-        WebInspector.DataGridNode.prototype.expand.call(this);
-        this.profileNode._expanded = true;
-    },
-
-    collapse: function()
-    {
-        WebInspector.DataGridNode.prototype.collapse.call(this);
-        this.profileNode._expanded = false;
-    },
-
-    _populate: function(event)
-    {
-        var children = this.profileNode.children;
-        var childrenLength = children.length;
-        for (var i = 0; i < childrenLength; ++i)
-            if (children[i].visible)
-                this.appendChild(new WebInspector.ProfileDataGridNode(this.profileView, children[i]));
-        this.removeEventListener("populate", this._populate, this);
-    }
-}
-
-WebInspector.ProfileDataGridNode.prototype.__proto__ = WebInspector.DataGridNode.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js
index ea3b85c..3808025 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ProfilesPanel.js
@@ -218,7 +218,7 @@ WebInspector.ProfilesPanel.prototype = {
         view.show(this.profileViews);
 
         profile._profilesTreeElement.select(true);
-        profile._profilesTreeElement.reveal()
+        profile._profilesTreeElement.reveal();
 
         this.visibleView = view;
 
@@ -231,8 +231,7 @@ WebInspector.ProfilesPanel.prototype = {
 
     showView: function(view)
     {
-        // Always use the treeProfile, since the heavy profile might be showing.
-        this.showProfile(view.profile.treeProfile);
+        this.showProfile(view.profile);
     },
 
     profileViewForProfile: function(profile)
@@ -267,8 +266,10 @@ WebInspector.ProfilesPanel.prototype = {
 
             groupNumber = ++this._profileGroupsForLinks[title];
 
-            if (groupNumber >= 2)
-                title += " " + WebInspector.UIString("Run %d", groupNumber);
+            if (groupNumber > 2)
+                // The title is used in the console message announcing that a profile has started so it gets
+                // incremented twice as often as it's displayed
+                title += " " + WebInspector.UIString("Run %d", groupNumber / 2);
         }
         
         return title;
@@ -295,8 +296,7 @@ WebInspector.ProfilesPanel.prototype = {
 
     searchMatchFound: function(view, matches)
     {
-        // Always use the treeProfile, since the heavy profile might be showing.
-        view.profile.treeProfile._profilesTreeElement.searchMatches = matches;
+        view.profile._profilesTreeElement.searchMatches = matches;
     },
 
     searchCanceled: function(startingNewSearch)
@@ -356,15 +356,15 @@ WebInspector.ProfilesPanel.prototype = {
     {
         if (InspectorController.profilerEnabled())
             return;
-        this._toggleProfiling();
+        this._toggleProfiling(this.panelEnablerView.alwaysEnabled);
     },
 
-    _toggleProfiling: function()
+    _toggleProfiling: function(optionalAlways)
     {
         if (InspectorController.profilerEnabled())
-            InspectorController.disableProfiler();
+            InspectorController.disableProfiler(true);
         else
-            InspectorController.enableProfiler();
+            InspectorController.enableProfiler(!!optionalAlways);
     },
 
     _populateProfiles: function()
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
index e02baf3..04d998e 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ResourcesPanel.js
@@ -126,6 +126,19 @@ WebInspector.ResourcesPanel = function()
 
     this.resourcesTreeElement.expand();
 
+    var panelEnablerHeading = WebInspector.UIString("You need to enable resource tracking to use the this panel.");
+    var panelEnablerDisclaimer = WebInspector.UIString("Enabling resource tracking will reload the page and make page loading slower.");
+    var panelEnablerButton = WebInspector.UIString("Enable resource tracking");
+
+    this.panelEnablerView = new WebInspector.PanelEnablerView("resources", panelEnablerHeading, panelEnablerDisclaimer, panelEnablerButton);
+    this.panelEnablerView.addEventListener("enable clicked", this._enableResourceTracking, this);
+
+    this.element.appendChild(this.panelEnablerView.element);
+
+    this.enableToggleButton = document.createElement("button");
+    this.enableToggleButton.className = "enable-toggle-status-bar-item status-bar-item";
+    this.enableToggleButton.addEventListener("click", this._toggleResourceTracking.bind(this), false);
+
     this.largerResourcesButton = document.createElement("button");
     this.largerResourcesButton.id = "resources-larger-resources-status-bar-item";
     this.largerResourcesButton.className = "status-bar-item toggled-on";
@@ -151,7 +164,7 @@ WebInspector.ResourcesPanel.prototype = {
 
     get statusBarItems()
     {
-        return [this.largerResourcesButton, this.sortingSelectElement];
+        return [this.enableToggleButton, this.largerResourcesButton, this.sortingSelectElement];
     },
 
     show: function()
@@ -358,6 +371,16 @@ WebInspector.ResourcesPanel.prototype = {
         this._updateSummaryGraph();
     },
 
+    resourceTrackingWasEnabled: function()
+    {
+        this.reset();
+    },
+
+    resourceTrackingWasDisabled: function()
+    {
+        this.reset();
+    },
+
     reset: function()
     {
         this.closeVisibleResource();
@@ -394,6 +417,20 @@ WebInspector.ResourcesPanel.prototype = {
         this._updateGraphDividersIfNeeded(true);
 
         this._drawSummaryGraph(); // draws an empty graph
+
+        if (InspectorController.resourceTrackingEnabled()) {
+            this.enableToggleButton.title = WebInspector.UIString("Resource tracking enabled. Click to disable.");
+            this.enableToggleButton.addStyleClass("toggled-on");
+            this.largerResourcesButton.removeStyleClass("hidden");
+            this.sortingSelectElement.removeStyleClass("hidden");
+            this.panelEnablerView.visible = false;
+        } else {
+            this.enableToggleButton.title = WebInspector.UIString("Resource tracking disabled. Click to enable.");
+            this.enableToggleButton.removeStyleClass("toggled-on");
+            this.largerResourcesButton.addStyleClass("hidden");
+            this.sortingSelectElement.addStyleClass("hidden");
+            this.panelEnablerView.visible = true;
+        }
     },
 
     addResource: function(resource)
@@ -1085,6 +1122,26 @@ WebInspector.ResourcesPanel.prototype = {
         var visibleView = this.visibleView;
         if (visibleView && "resize" in visibleView)
             visibleView.resize();
+    },
+
+    _enableResourceTracking: function()
+    {
+        if (InspectorController.resourceTrackingEnabled())
+            return;
+        this._toggleResourceTracking(this.panelEnablerView.alwaysEnabled);
+    },
+
+    _toggleResourceTracking: function(optionalAlways)
+    {
+        if (InspectorController.resourceTrackingEnabled()) {
+            this.largerResourcesButton.visible = false;
+            this.sortingSelectElement.visible = false;
+            InspectorController.disableResourceTracking(true);
+        } else {
+            this.largerResourcesButton.visible = true;
+            this.sortingSelectElement.visible = true;
+            InspectorController.enableResourceTracking(!!optionalAlways);
+        }
     }
 }
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/Script.js b/src/3rdparty/webkit/WebCore/inspector/front-end/Script.js
index 46502a6..e6413a9 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/Script.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/Script.js
@@ -31,6 +31,19 @@ WebInspector.Script = function(sourceID, sourceURL, source, startingLine, errorL
     this.startingLine = startingLine;
     this.errorLine = errorLine;
     this.errorMessage = errorMessage;
+
+    // if no URL, look for "//@ sourceURL=" decorator
+    // note that this sourceURL comment decorator is behavior that FireBug added
+    // in it's 1.1 release as noted in the release notes:
+    // http://fbug.googlecode.com/svn/branches/firebug1.1/docs/ReleaseNotes_1.1.txt
+    if (!sourceURL) {
+        // use of [ \t] rather than \s is to prevent \n from matching
+        var pattern = /^\s*\/\/[ \t]*@[ \t]*sourceURL[ \t]*=[ \t]*(\S+).*$/m;
+        var match = pattern.exec(source);
+
+        if (match)
+            this.sourceURL = WebInspector.UIString("(program): %s", match[1]);
+    }
 }
 
 WebInspector.Script.prototype = {
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js b/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js
index 38a6a96..d30c002 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/ScriptsPanel.js
@@ -205,6 +205,10 @@ WebInspector.ScriptsPanel.prototype = {
                 continue;
             view.visible = false;
         }
+        if (this._attachDebuggerWhenShown) {
+            InspectorController.enableDebuggerFromFrontend(false);
+            delete this._attachDebuggerWhenShown;
+        }
     },
 
     get searchableViews()
@@ -312,17 +316,36 @@ WebInspector.ScriptsPanel.prototype = {
             sourceFrame.removeBreakpoint(breakpoint);
     },
 
-    evaluateInSelectedCallFrame: function(code, updateInterface)
+    evaluateInSelectedCallFrame: function(code, updateInterface, callback)
     {
         var selectedCallFrame = this.sidebarPanes.callstack.selectedCallFrame;
         if (!this._paused || !selectedCallFrame)
             return;
+
         if (typeof updateInterface === "undefined")
             updateInterface = true;
-        var result = selectedCallFrame.evaluate(code);
-        if (updateInterface)
-            this.sidebarPanes.scopechain.update(selectedCallFrame);
-        return result;
+
+        var self = this;
+        function updatingCallbackWrapper(result)
+        {
+            callback(result);
+            if (updateInterface)
+                self.sidebarPanes.scopechain.update(selectedCallFrame);
+        }        
+        this.doEvalInCallFrame(selectedCallFrame, code, updatingCallbackWrapper);
+    },
+
+    doEvalInCallFrame: function(callFrame, code, callback)
+    {
+        function delayedEvaluation()
+        {
+            try {
+                callback(callFrame.evaluate(code));
+            } catch (e) {
+                callback(e, true);
+            }
+        }
+        setTimeout(delayedEvaluation, 0);
     },
 
     variablesInScopeForSelectedCallFrame: function()
@@ -359,6 +382,24 @@ WebInspector.ScriptsPanel.prototype = {
         window.focus();
     },
 
+    debuggerResumed: function()
+    {
+        this._paused = false;
+        this._waitingToPause = false;
+        this._stepping = false;
+
+        this._clearInterface();
+    },
+
+    attachDebuggerWhenShown: function()
+    {
+        if (this.element.parentElement) {
+            InspectorController.enableDebuggerFromFrontend(false);
+        } else {
+            this._attachDebuggerWhenShown = true;
+        }
+    },
+
     debuggerWasEnabled: function()
     {
         this.reset();
@@ -569,11 +610,33 @@ WebInspector.ScriptsPanel.prototype = {
 
         var select = this.filesSelectElement;
 
-        // FIXME: Append in some meaningful order.
         var option = document.createElement("option");
         option.representedObject = (script.resource || script);
         option.text = (script.sourceURL ? WebInspector.displayNameForURL(script.sourceURL) : WebInspector.UIString("(program)"));
-        select.appendChild(option);
+
+        function optionCompare(a, b)
+        {
+            var aTitle = a.text.toLowerCase();
+            var bTitle = b.text.toLowerCase();
+            if (aTitle < bTitle)
+                return -1;
+            else if (aTitle > bTitle)
+                return 1;
+
+            var aSourceID = a.representedObject.sourceID;
+            var bSourceID = b.representedObject.sourceID;
+            if (aSourceID < bSourceID)
+                return -1;
+            else if (aSourceID > bSourceID)
+                return 1;
+            return 0;
+        }
+
+        var insertionIndex = insertionIndexForObjectInListSortedByFunction(option, select.childNodes, optionCompare);
+        if (insertionIndex < 0)
+            select.appendChild(option);
+        else
+            select.insertBefore(option, select.childNodes.item(insertionIndex));
 
         script.filesSelectOption = option;
 
@@ -740,19 +803,19 @@ WebInspector.ScriptsPanel.prototype = {
     {
         if (InspectorController.debuggerEnabled())
             return;
-        this._toggleDebugging();
+        this._toggleDebugging(this.panelEnablerView.alwaysEnabled);
     },
 
-    _toggleDebugging: function()
+    _toggleDebugging: function(optionalAlways)
     {
         this._paused = false;
         this._waitingToPause = false;
         this._stepping = false;
 
         if (InspectorController.debuggerEnabled())
-            InspectorController.disableDebugger();
+            InspectorController.disableDebugger(true);
         else
-            InspectorController.enableDebugger();
+            InspectorController.enableDebuggerFromFrontend(!!optionalAlways);
     },
 
     _togglePauseOnExceptions: function()
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js
index 8d6d6d3..18d9073 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceFrame.js
@@ -110,6 +110,11 @@ WebInspector.SourceFrame.prototype = {
 
     revealLine: function(lineNumber)
     {
+        if (!this._isContentLoaded()) {
+            this._lineNumberToReveal = lineNumber;
+            return;
+        }
+    
         var row = this.sourceRow(lineNumber);
         if (row)
             row.scrollIntoViewIfNeeded(true);
@@ -172,6 +177,11 @@ WebInspector.SourceFrame.prototype = {
 
     highlightLine: function(lineNumber)
     {
+        if (!this._isContentLoaded()) {
+            this._lineNumberToHighlight = lineNumber;
+            return;
+        }
+
         var sourceRow = this.sourceRow(lineNumber);
         if (!sourceRow)
             return;
@@ -225,15 +235,36 @@ WebInspector.SourceFrame.prototype = {
 
         this.element.contentWindow.Element.prototype.addStyleClass = Element.prototype.addStyleClass;
         this.element.contentWindow.Element.prototype.removeStyleClass = Element.prototype.removeStyleClass;
+        this.element.contentWindow.Element.prototype.removeMatchingStyleClasses = Element.prototype.removeMatchingStyleClasses;
         this.element.contentWindow.Element.prototype.hasStyleClass = Element.prototype.hasStyleClass;
         this.element.contentWindow.Node.prototype.enclosingNodeOrSelfWithNodeName = Node.prototype.enclosingNodeOrSelfWithNodeName;
+        this.element.contentWindow.Node.prototype.enclosingNodeOrSelfWithNodeNameInArray = Node.prototype.enclosingNodeOrSelfWithNodeNameInArray;
 
         this._addExistingMessagesToSource();
         this._addExistingBreakpointsToSource();
         this._updateExecutionLine();
+        if (this._executionLine)
+            this.revealLine(this._executionLine);
 
         if (this.autoSizesToFitContentHeight)
             this.sizeToFitContentHeight();
+            
+        if (this._lineNumberToReveal) {
+            this.revealLine(this._lineNumberToReveal);
+            delete this._lineNumberToReveal;
+        }
+    
+        if (this._lineNumberToHighlight) {
+            this.highlightLine(this._lineNumberToHighlight);
+            delete this._lineNumberToHighlight;
+        }
+        
+        this.dispatchEventToListeners("content loaded");
+    },
+    
+    _isContentLoaded: function() {
+        var doc = this.element.contentDocument;
+        return doc && doc.getElementsByTagName("table")[0];
     },
 
     _windowResized: function(event)
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceView.js b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceView.js
index 309027e..7510c8c 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/SourceView.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/SourceView.js
@@ -95,10 +95,15 @@ WebInspector.SourceView.prototype = {
 
         this.attach();
 
-        if (!InspectorController.addResourceSourceToFrame(this.resource.identifier, this.sourceFrame.element))
-            return;
-
         delete this._frameNeedsSetup;
+        this.sourceFrame.addEventListener("content loaded", this._contentLoaded, this);
+        InspectorController.addResourceSourceToFrame(this.resource.identifier, this.sourceFrame.element);
+    },
+    
+    _contentLoaded: function()
+    {
+        delete this._frameNeedsSetup;
+        this.sourceFrame.removeEventListener("content loaded", this._contentLoaded, this);
 
         if (this.resource.type === WebInspector.Resource.Type.Script) {
             this.sourceFrame.addEventListener("syntax highlighting complete", this._syntaxHighlightingComplete, this);
@@ -274,7 +279,7 @@ WebInspector.SourceView.prototype = {
         if (!foundRange)
             return;
 
-        var selection = window.getSelection();
+        var selection = this.sourceFrame.element.contentWindow.getSelection();
         selection.removeAllRanges();
         selection.addRange(foundRange);
 
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/StylesSidebarPane.js b/src/3rdparty/webkit/WebCore/inspector/front-end/StylesSidebarPane.js
index f0a9afb..c30444b 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/StylesSidebarPane.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/StylesSidebarPane.js
@@ -586,8 +586,8 @@ WebInspector.StylePropertyTreeElement.prototype = {
         this.listItemElement.appendChild(document.createTextNode(";"));
 
         if (value) {
-            // FIXME: this dosen't catch keyword based colors like black and white
-            var colors = value.match(/((rgb|hsl)a?\([^)]+\))|(#[0-9a-fA-F]{6})|(#[0-9a-fA-F]{3})/g);
+            // FIXME: this only covers W3C and CSS 16 valid color names
+            var colors = value.match(/((rgb|hsl)a?\([^)]+\))|(#[0-9a-fA-F]{6})|(#[0-9a-fA-F]{3})|aqua|black|blue|fuchsia|gray|green|lime|maroon|navy|olive|purple|red|silver|teal|white|yellow/g);
             if (colors) {
                 var colorsLength = colors.length;
                 for (var i = 0; i < colorsLength; ++i) {
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js
index 61e1b52..30772f7 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TextPrompt.js
@@ -140,7 +140,6 @@ WebInspector.TextPrompt.prototype = {
     complete: function(auto)
     {
         this.clearAutoComplete(true);
-
         var selection = window.getSelection();
         if (!selection.rangeCount)
             return;
@@ -150,17 +149,25 @@ WebInspector.TextPrompt.prototype = {
             return;
         if (auto && !this.isCaretAtEndOfPrompt())
             return;
-
         var wordPrefixRange = selectionRange.startContainer.rangeOfWord(selectionRange.startOffset, this.completionStopCharacters, this.element, "backward");
-        var completions = this.completions(wordPrefixRange, auto);
+        this.completions(wordPrefixRange, auto, this._completionsReady.bind(this, selection, auto, wordPrefixRange));
+    },
 
+    _completionsReady: function(selection, auto, originalWordPrefixRange, completions)
+    {
         if (!completions || !completions.length)
             return;
 
+        var selectionRange = selection.getRangeAt(0);
+        var wordPrefixRange = selectionRange.startContainer.rangeOfWord(selectionRange.startOffset, this.completionStopCharacters, this.element, "backward");
+
         var fullWordRange = document.createRange();
         fullWordRange.setStart(wordPrefixRange.startContainer, wordPrefixRange.startOffset);
         fullWordRange.setEnd(selectionRange.endContainer, selectionRange.endOffset);
 
+        if (originalWordPrefixRange.toString() + selectionRange.toString() != fullWordRange.toString())
+            return;
+
         if (completions.length === 1 || selection.isCollapsed || auto) {
             var completionText = completions[0];
         } else {
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/TopDownProfileDataGridTree.js b/src/3rdparty/webkit/WebCore/inspector/front-end/TopDownProfileDataGridTree.js
new file mode 100644
index 0000000..b9d8b94
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/TopDownProfileDataGridTree.js
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2009 280 North Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.TopDownProfileDataGridNode = function(/*ProfileView*/ profileView, /*ProfileNode*/ profileNode, /*TopDownProfileDataGridTree*/ owningTree)
+{
+    var hasChildren = (profileNode.children && profileNode.children.length);
+
+    WebInspector.ProfileDataGridNode.call(this, profileView, profileNode, owningTree, hasChildren);
+
+    this._remainingChildren = profileNode.children;
+}
+
+WebInspector.TopDownProfileDataGridNode.prototype = {
+    _populate: function(event)
+    {
+        var children = this._remainingChildren;
+        var childrenLength = children.length;
+
+        for (var i = 0; i < childrenLength; ++i)
+            this.appendChild(new WebInspector.TopDownProfileDataGridNode(this.profileView, children[i], this.tree));
+
+        if (this.removeEventListener)
+            this.removeEventListener("populate", this._populate, this);
+
+        this._remainingChildren = null;
+    },
+
+    _exclude: function(aCallUID)
+    {
+        if (this._remainingChildren)
+            this._populate();
+
+        this._save();
+
+        var children = this.children;
+        var index = this.children.length;
+
+        while (index--)
+            children[index]._exclude(aCallUID);
+
+        var child = this.childrenByCallUID[aCallUID];
+
+        if (child)
+            this._merge(child, true);
+    }
+}
+
+WebInspector.TopDownProfileDataGridNode.prototype.__proto__ = WebInspector.ProfileDataGridNode.prototype;
+
+WebInspector.TopDownProfileDataGridTree = function(/*ProfileView*/ profileView, /*ProfileNode*/ profileNode)
+{
+    WebInspector.ProfileDataGridTree.call(this, profileView, profileNode);
+
+    this._remainingChildren = profileNode.children;
+
+    WebInspector.TopDownProfileDataGridNode.prototype._populate.call(this);
+}
+
+WebInspector.TopDownProfileDataGridTree.prototype = {
+    focus: function(/*ProfileDataGridNode*/ profileDataGrideNode)
+    {
+        if (!profileDataGrideNode)
+            return;
+
+        this._save();
+
+        this.children = [profileDataGrideNode];
+        this.totalTime = profileDataGrideNode.totalTime;
+    },
+
+    exclude: function(/*ProfileDataGridNode*/ profileDataGrideNode)
+    {
+        if (!profileDataGrideNode)
+            return;
+
+        this._save();
+
+        var excludedCallUID = profileDataGrideNode.callUID;
+
+        WebInspector.TopDownProfileDataGridNode.prototype._exclude.call(this, excludedCallUID);
+
+        if (this.lastComparator)
+            this.sort(this.lastComparator, true);
+    },
+
+    _merge: WebInspector.TopDownProfileDataGridNode.prototype._merge
+}
+
+WebInspector.TopDownProfileDataGridTree.prototype.__proto__ = WebInspector.ProfileDataGridTree.prototype;
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc b/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
index 52a8578..76a925b 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/WebKit.qrc
@@ -1,6 +1,7 @@
 <!DOCTYPE RCC><RCC version="1.0">
 <qresource prefix="/webkit/inspector">
     <file>inspector.html</file>
+    <file>BottomUpProfileDataGridTree.js</file>
     <file>Breakpoint.js</file>
     <file>BreakpointsSidebarPane.js</file>
     <file>CallStackSidebarPane.js</file>
@@ -10,6 +11,9 @@
     <file>DatabasesPanel.js</file>
     <file>DatabaseTableView.js</file>
     <file>DataGrid.js</file>
+    <file>DOMStorage.js</file>
+    <file>DOMStorageDataGrid.js</file>
+    <file>DOMStorageItemsView.js</file>
     <file>ElementsPanel.js</file>
     <file>ElementsTreeOutline.js</file>
     <file>FontView.js</file>
@@ -21,6 +25,7 @@
     <file>Panel.js</file>
     <file>PanelEnablerView.js</file>
     <file>Placard.js</file>
+    <file>ProfileDataGridTree.js</file>
     <file>ProfilesPanel.js</file>
     <file>ProfileView.js</file>
     <file>PropertiesSection.js</file>
@@ -39,6 +44,7 @@
     <file>SourceView.js</file>
     <file>StylesSidebarPane.js</file>
     <file>TextPrompt.js</file>
+    <file>TopDownProfileDataGridTree.js</file>
     <file>treeoutline.js</file>
     <file>utilities.js</file>
     <file>View.js</file>
@@ -66,6 +72,7 @@
     <file>Images/disclosureTriangleSmallRightDownWhite.png</file>
     <file>Images/disclosureTriangleSmallRightWhite.png</file>
     <file>Images/dockButtons.png</file>
+    <file>Images/domStorage.png</file>
     <file>Images/elementsIcon.png</file>
     <file>Images/enableButtons.png</file>
     <file>Images/errorIcon.png</file>
@@ -92,6 +99,7 @@
     <file>Images/profilesIcon.png</file>
     <file>Images/profileSmallIcon.png</file>
     <file>Images/profilesSilhouette.png</file>
+    <file>Images/radioDot.png</file>
     <file>Images/recordButtons.png</file>
     <file>Images/reloadButtons.png</file>
     <file>Images/resourceCSSIcon.png</file>
@@ -151,6 +159,7 @@
     <file>Images/treeUpTriangleWhite.png</file>
     <file>Images/userInputIcon.png</file>
     <file>Images/userInputPreviousIcon.png</file>
+    <file>Images/userInputResultIcon.png</file>
     <file>Images/warningIcon.png</file>
     <file>Images/warningMediumIcon.png</file>
     <file>Images/warningsErrors.png</file>
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
index 7e3c224..c162531 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.css
@@ -439,12 +439,13 @@ body.console-visible #console {
 
 #console-messages {
     position: absolute;
+    z-index: 0;
     top: 0;
     left: 0;
     right: 0;
     bottom: 23px;
-    font-size: 10px;
-    font-family: Monaco, Lucida Console, monospace;
+    font-size: initial;
+    font-family: monospace;
     padding: 2px 0;
     overflow-y: overlay;
     -webkit-user-select: text;
@@ -463,6 +464,10 @@ body.console-visible #console {
     background-image: url(Images/userInputIcon.png);
 }
 
+.console-user-command-result.console-log-level::before {
+    background-image: url(Images/userInputResultIcon.png);
+}
+
 .console-message, .console-user-command {
     position: relative;
     border-bottom: 1px solid rgb(240, 240, 240);
@@ -470,6 +475,14 @@ body.console-visible #console {
     min-height: 16px;
 }
 
+.console-adjacent-user-command-result {
+    border-bottom: none;
+}
+
+.console-adjacent-user-command-result + .console-user-command-result.console-log-level::before {
+    background-image: none;
+}
+
 .console-message::before, .console-user-command::before, #console-prompt::before, .console-group-title-level::before {
     position: absolute;
     display: block;
@@ -561,35 +574,34 @@ body.console-visible #console {
     color: rgb(0, 128, 255);
 }
 
-.console-message-url {
-    color: rgb(33%, 33%, 33%) !important;
+#console-messages a {
+    color: rgb(33%, 33%, 33%);
     cursor: pointer;
-    float: right;
 }
 
-.console-message-url:hover {
+#console-messages a:hover {
     color: rgb(15%, 15%, 15%);
 }
 
-.console-message-url:hover::after {
-    opacity: 1;
+.console-message-url {
+    float: right;
 }
 
 .console-group-messages .section {
-    margin: 0;
+    margin: 0 0 0 12px !important;
 }
 
 .console-group-messages .section .header {
     padding: 0 8px 0 0;
     background-image: none;
     border: none;
-    min-height: 16px;
+    min-height: 0;
 }
 
 .console-group-messages .section .header::before {
     position: absolute;
     top: 1px;
-    left: 12px;
+    left: 1px;
     width: 8px;
     height: 8px;
     content: url(Images/treeRightTriangleBlack.png);
@@ -601,6 +613,21 @@ body.console-visible #console {
 
 .console-group-messages .section .header .title {
     color: black;
+    font-weight: normal;
+}
+
+.console-group-messages .section .properties li .info {
+    padding-top: 0;
+    padding-bottom: 0;
+    color: rgb(60%, 60%, 60%);
+}
+
+.console-group-messages .outline-disclosure {
+    padding-left: 0;
+}
+
+.console-group-messages .outline-disclosure > ol {
+    padding: 0 0 0 12px !important;
 }
 
 .console-group-messages .outline-disclosure, .console-group-messages .outline-disclosure ol {
@@ -608,33 +635,39 @@ body.console-visible #console {
     line-height: 1em;
 }
 
-.console-group-messages .outline-disclosure li {
-    padding-top: 2px;
-    padding-bottom: 2px;
+.console-group-messages .outline-disclosure.single-node li {
+    padding-left: 2px;
 }
 
 .console-group-messages .outline-disclosure li .selection {
-    z-index: 0;
-    margin-top: -1px;
+    margin-left: -6px;
+    margin-right: -6px;
+}
+
+.console-formatted-object, .console-formatted-node {
+    position: relative;
+    display: inline-block;
+    vertical-align: top;
 }
 
 .console-formatted-object .section, .console-formatted-node .section {
     position: static;
 }
 
+.console-formatted-object .properties, .console-formatted-node .properties {
+    padding-left: 0 !important;
+}
+
+.error-message {
+    color: red;
+}
+
 .auto-complete-text {
     color: rgb(128, 128, 128);
     -webkit-user-select: none;
     -webkit-user-modify: read-only;
 }
 
-.inspectible-node:hover {
-    background-color: rgba(56, 121, 217, 0.1);
-    -webkit-border-radius: 5px;
-    padding: 0 5px 1px;
-    margin: 0 -5px -1px;
-}
-
 .panel {
     display: none;
     overflow: hidden;
@@ -1532,7 +1565,11 @@ body.inactive .sidebar {
     content: url(Images/databaseTable.png);
 }
 
-#database-views {
+.domstorage-sidebar-tree-item .icon {
+    content: url(Images/domStorage.png);
+}
+
+#storage-views {
     position: absolute;
     top: 0;
     right: 0;
@@ -1540,7 +1577,7 @@ body.inactive .sidebar {
     bottom: 0;
 }
 
-.database-view {
+.storage-view {
     display: none;
     overflow: hidden;
     position: absolute;
@@ -1550,20 +1587,20 @@ body.inactive .sidebar {
     bottom: 0;
 }
 
-.database-view.visible {
+.storage-view.visible {
     display: block;
 }
 
-.database-view.table {
+.storage-view.table {
     overflow: hidden;
 }
 
-.database-view.table .data-grid {
+.storage-view.table .data-grid {
     border: none;
     height: 100%;
 }
 
-.database-view.table .database-table-empty, .database-view.table .database-table-error {
+.storage-view.table .storage-table-empty, .storage-view.table .storage-table-error {
     position: absolute;
     top: 0;
     bottom: 25%;
@@ -1581,7 +1618,7 @@ body.inactive .sidebar {
     white-space: pre-wrap;
 }
 
-.database-view.table .database-table-error {
+.storage-view.table .storage-table-error {
     color: rgb(66%, 33%, 33%);
 }
 
@@ -1773,9 +1810,9 @@ body.inactive .data-grid th.sort-ascending, body.inactive .data-grid th.sort-des
     text-indent: 10px;
 }
 
-.database-view.query {
-    font-size: 10px;
-    font-family: Monaco, Lucida Console, monospace;
+.storage-view.query {
+    font-size: initial;
+    font-family: monospace;
     padding: 2px 0;
     overflow-y: overlay;
     overflow-x: hidden;
@@ -1882,6 +1919,7 @@ body.inactive .data-grid th.sort-ascending, body.inactive .data-grid th.sort-des
     font-size: 10px;
     color: rgb(110, 116, 128);
     margin-bottom: 12px;
+    margin-left: 20px;
 }
 
 .panel-enabler-disclaimer:empty {
@@ -1917,10 +1955,8 @@ body.inactive .data-grid th.sort-ascending, body.inactive .data-grid th.sort-des
     position: relative;
     display: block;
     text-align: left;
-    margin-left: 50px;
-    margin-bottom: 6px;
-    line-height: 18px;
     word-break: break-word;
+    margin: 0 0 5px 20px;
 }
 
 .panel-enabler-view button {
@@ -1949,6 +1985,30 @@ body.inactive .panel-enabler-view button, .panel-enabler-view button:disabled {
     background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(250, 250, 250)), to(rgb(235, 235, 235)));
 }
 
+.panel-enabler-view input {
+    height: 17px;
+    width: 17px;
+    border: 1px solid rgb(165, 165, 165);
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(252, 252, 252)), to(rgb(223, 223, 223)));
+    -webkit-border-radius: 8px;
+    -webkit-appearance: none;
+    vertical-align: middle;
+    margin: 0 5px 5px 0;
+}
+
+.panel-enabler-view input:active {
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgb(194, 194, 194)), to(rgb(239, 239, 239)));
+}
+
+.panel-enabler-view input:checked {
+    background: url(Images/radioDot.png) center no-repeat,
+                -webkit-gradient(linear, left top, left bottom, from(rgb(252, 252, 252)), to(rgb(223, 223, 223)));
+}
+
+.panel-enabler-view.resources img {
+    content: url(Images/resourcesSilhouette.png);
+}
+
 .panel-enabler-view.scripts img {
     content: url(Images/scriptsSilhouette.png);
 }
@@ -2498,6 +2558,10 @@ button.enable-toggle-status-bar-item.toggled-on:active {
     padding-left: 37px;
 }
 
+.sidebar-tree > .children > .children > .sidebar-tree-item {
+    padding-left: 37px;
+}
+
 .sidebar-tree.hide-disclosure-buttons > .children {
     display: none;
 }
@@ -2889,6 +2953,14 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
     height: 100%;
 }
 
+.profile-view .data-grid th.average-column {
+    text-align: center;
+}
+
+.profile-view .data-grid td.average-column {
+    text-align: right;
+}
+
 .profile-view .data-grid th.self-column {
     text-align: center;
 }
@@ -2994,3 +3066,39 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
 .reset-profile-status-bar-item:active {
     background-position: 32px 0;
 }
+
+.delete-storage-status-bar-item {
+    background-image: url(Images/excludeButtons.png) !important;
+}
+
+.delete-storage-status-bar-item:active {
+    background-position: 32px 0;
+}
+
+#storage-view-status-bar-items {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    left: 200px;
+    overflow: hidden;
+    border-left: 1px solid rgb(184, 184, 184);
+    margin-left: -1px;
+}
+
+.refresh-storage-status-bar-item {
+    background-image: url(Images/reloadButtons.png) !important;
+}
+
+.refresh-storage-status-bar-item:active {
+    background-position: 32px 0;
+}
+
+#storage-view-status-bar-items {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    left: 200px;
+    overflow: hidden;
+    border-left: 1px solid rgb(184, 184, 184);
+    margin-left: -1px;
+}
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html
index cb38886..184bb45 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.html
@@ -41,7 +41,10 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="Resource.js"></script>
     <script type="text/javascript" src="ResourceCategory.js"></script>
     <script type="text/javascript" src="Database.js"></script>
+    <script type="text/javascript" src="DOMStorage.js"></script>
+    <script type="text/javascript" src="DOMStorageItemsView.js"></script>
     <script type="text/javascript" src="DataGrid.js"></script>
+    <script type="text/javascript" src="DOMStorageDataGrid.js"></script>
     <script type="text/javascript" src="Script.js"></script>
     <script type="text/javascript" src="Breakpoint.js"></script>
     <script type="text/javascript" src="SidebarPane.js"></script>
@@ -70,6 +73,9 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="DatabaseTableView.js"></script>
     <script type="text/javascript" src="DatabaseQueryView.js"></script>
     <script type="text/javascript" src="ScriptView.js"></script>
+    <script type="text/javascript" src="ProfileDataGridTree.js"></script>
+    <script type="text/javascript" src="BottomUpProfileDataGridTree.js"></script>
+    <script type="text/javascript" src="TopDownProfileDataGridTree.js"></script>
     <script type="text/javascript" src="ProfileView.js"></script>
 </head>
 <body class="detached">
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js
index 07ae7db..9d5bac0 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/inspector.js
@@ -41,7 +41,7 @@ var Preferences = {
 }
 
 var WebInspector = {
-    resources: [],
+    resources: {},
     resourceURLMap: {},
     missingLocalizedStrings: {},
 
@@ -279,13 +279,19 @@ WebInspector.loaded = function()
     document.body.addStyleClass("platform-" + platform);
 
     this.console = new WebInspector.Console();
-    this.panels = {
-        elements: new WebInspector.ElementsPanel(),
-        resources: new WebInspector.ResourcesPanel(),
-        scripts: new WebInspector.ScriptsPanel(),
-        profiles: new WebInspector.ProfilesPanel(),
-        databases: new WebInspector.DatabasesPanel()
-    };
+
+    this.panels = {};
+    var hiddenPanels = (InspectorController.hiddenPanels() || "").split(',');
+    if (hiddenPanels.indexOf("elements") === -1)
+        this.panels.elements = new WebInspector.ElementsPanel();
+    if (hiddenPanels.indexOf("resources") === -1)
+        this.panels.resources = new WebInspector.ResourcesPanel();
+    if (hiddenPanels.indexOf("scripts") === -1)
+        this.panels.scripts = new WebInspector.ScriptsPanel();
+    if (hiddenPanels.indexOf("profiles") === -1)
+        this.panels.profiles = new WebInspector.ProfilesPanel();
+    if (hiddenPanels.indexOf("databases") === -1)
+        this.panels.databases = new WebInspector.DatabasesPanel();
 
     var toolbarElement = document.getElementById("toolbar");
     var previousToolbarItem = toolbarElement.children[0];
@@ -383,6 +389,12 @@ var windowLoaded = function()
 
 window.addEventListener("load", windowLoaded, false);
 
+WebInspector.dispatch = function() {
+    var methodName = arguments[0];
+    var parameters = Array.prototype.slice.call(arguments, 1);
+    WebInspector[methodName].apply(this, parameters);
+}
+
 WebInspector.windowUnload = function(event)
 {
     InspectorController.windowUnloading();
@@ -765,9 +777,18 @@ WebInspector.showDatabasesPanel = function()
     this.currentPanel = this.panels.databases;
 }
 
-WebInspector.addResource = function(resource)
+WebInspector.addResource = function(identifier, payload)
 {
-    this.resources.push(resource);
+    var resource = new WebInspector.Resource(
+        payload.requestHeaders,
+        payload.requestURL,
+        payload.host,
+        payload.path,
+        payload.lastPathComponent,
+        identifier,
+        payload.isMainResource,
+        payload.cached);
+    this.resources[identifier] = resource;
     this.resourceURLMap[resource.url] = resource;
 
     if (resource.mainResource) {
@@ -779,22 +800,101 @@ WebInspector.addResource = function(resource)
         this.panels.resources.addResource(resource);
 }
 
-WebInspector.removeResource = function(resource)
+WebInspector.updateResource = function(identifier, payload)
+{
+    var resource = this.resources[identifier];
+    if (!resource)
+        return;
+
+    if (payload.didRequestChange) {
+        resource.url = payload.url;
+        resource.domain = payload.domain;
+        resource.path = payload.path;
+        resource.lastPathComponent = payload.lastPathComponent;
+        resource.requestHeaders = payload.requestHeaders;
+        resource.mainResource = payload.mainResource;
+    }
+
+    if (payload.didResponseChange) {
+        resource.mimeType = payload.mimeType;
+        resource.suggestedFilename = payload.suggestedFilename;
+        resource.expectedContentLength = payload.expectedContentLength;
+        resource.statusCode = payload.statusCode;
+        resource.suggestedFilename = payload.suggestedFilename;
+        resource.responseHeaders = payload.responseHeaders;
+    }
+
+    if (payload.didTypeChange) {
+        resource.type = payload.type;
+    }
+    
+    if (payload.didLengthChange) {
+        resource.contentLength = payload.contentLength;
+    }
+
+    if (payload.didCompletionChange) {
+        resource.failed = payload.failed;
+        resource.finished = payload.finished;
+    }
+
+    if (payload.didTimingChange) {
+        if (payload.startTime)
+            resource.startTime = payload.startTime;
+        if (payload.responseReceivedTime)
+            resource.responseReceivedTime = payload.responseReceivedTime;
+        if (payload.endTime)
+            resource.endTime = payload.endTime;
+    }
+}
+
+WebInspector.removeResource = function(identifier)
 {
+    var resource = this.resources[identifier];
+    if (!resource)
+        return;
+
     resource.category.removeResource(resource);
     delete this.resourceURLMap[resource.url];
-
-    this.resources.remove(resource, true);
+    delete this.resources[identifier];
 
     if (this.panels.resources)
         this.panels.resources.removeResource(resource);
 }
 
-WebInspector.addDatabase = function(database)
+WebInspector.addDatabase = function(payload)
 {
+    var database = new WebInspector.Database(
+        payload.database,
+        payload.domain,
+        payload.name,
+        payload.version);
     this.panels.databases.addDatabase(database);
 }
 
+WebInspector.addDOMStorage = function(payload)
+{
+    var domStorage = new WebInspector.DOMStorage(
+        payload.domStorage,
+        payload.host,
+        payload.isLocalStorage);
+    this.panels.databases.addDOMStorage(domStorage);
+}
+
+WebInspector.resourceTrackingWasEnabled = function()
+{
+    this.panels.resources.resourceTrackingWasEnabled();
+}
+
+WebInspector.resourceTrackingWasDisabled = function()
+{
+    this.panels.resources.resourceTrackingWasDisabled();
+}
+
+WebInspector.attachDebuggerWhenShown = function()
+{
+    this.panels.scripts.attachDebuggerWhenShown();
+}
+
 WebInspector.debuggerWasEnabled = function()
 {
     this.panels.scripts.debuggerWasEnabled();
@@ -830,6 +930,11 @@ WebInspector.pausedScript = function()
     this.panels.scripts.debuggerPaused();
 }
 
+WebInspector.resumedScript = function()
+{
+    this.panels.scripts.debuggerResumed();
+}
+
 WebInspector.populateInterface = function()
 {
     for (var panelName in this.panels) {
@@ -850,7 +955,7 @@ WebInspector.reset = function()
     for (var category in this.resourceCategories)
         this.resourceCategories[category].removeAllResources();
 
-    this.resources = [];
+    this.resources = {};
     this.resourceURLMap = {};
     this.hoveredDOMNode = null;
 
@@ -870,9 +975,17 @@ WebInspector.resourceURLChanged = function(resource, oldURL)
     this.resourceURLMap[resource.url] = resource;
 }
 
-WebInspector.addMessageToConsole = function(msg)
+WebInspector.addMessageToConsole = function(payload)
 {
-    this.console.addMessage(msg);
+    var consoleMessage = new WebInspector.ConsoleMessage(
+        payload.source,
+        payload.level,
+        payload.line,
+        payload.url,
+        payload.groupLevel,
+        payload.repeatCount);
+    consoleMessage.setMessageBody(Array.prototype.slice.call(arguments, 1));
+    this.console.addMessage(consoleMessage);
 }
 
 WebInspector.addProfile = function(profile)
@@ -1247,6 +1360,7 @@ WebInspector.MIMETypes = {
     "image/png":                   {2: true},
     "image/gif":                   {2: true},
     "image/bmp":                   {2: true},
+    "image/vnd.microsoft.icon":    {2: true},
     "image/x-icon":                {2: true},
     "image/x-xbitmap":             {2: true},
     "font/ttf":                    {3: true},
diff --git a/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js b/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js
index 8f86504..8fb50e2 100644
--- a/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js
+++ b/src/3rdparty/webkit/WebCore/inspector/front-end/utilities.js
@@ -37,6 +37,8 @@ Object.type = function(obj, win)
 
     win = win || window;
 
+    if (obj instanceof win.Node)
+        return "node";
     if (obj instanceof win.String)
         return "string";
     if (obj instanceof win.Array)
@@ -70,6 +72,7 @@ Object.describe = function(obj, abbreviated)
 
     switch (type1) {
     case "object":
+    case "node":
         return type2;
     case "array":
         return "[" + obj.toString() + "]";
@@ -937,6 +940,41 @@ Array.prototype.remove = function(value, onlyFirst)
     }
 }
 
+function insertionIndexForObjectInListSortedByFunction(anObject, aList, aFunction)
+{
+    // indexOf returns (-lowerBound - 1). Taking (-result - 1) works out to lowerBound.
+    return (-indexOfObjectInListSortedByFunction(anObject, aList, aFunction) - 1);
+}
+
+function indexOfObjectInListSortedByFunction(anObject, aList, aFunction)
+{
+    var first = 0;
+    var last = aList.length - 1;
+    var floor = Math.floor;
+    var mid, c;
+
+    while (first <= last) {
+        mid = floor((first + last) / 2);
+        c = aFunction(anObject, aList[mid]);
+
+        if (c > 0)
+            first = mid + 1;
+        else if (c < 0)
+            last = mid - 1;
+        else {
+            // Return the first occurance of an item in the list.
+            while (mid > 0 && aFunction(anObject, aList[mid - 1]) === 0)
+                mid--;
+            first = mid;
+            break;
+        }
+    }
+
+    // By returning 1 less than the negative lower search bound, we can reuse this function
+    // for both indexOf and insertionIndexFor, with some simple arithmetic.
+    return (-first - 1);
+}
+
 String.sprintf = function(format)
 {
     return String.vsprintf(format, Array.prototype.slice.call(arguments, 1));
diff --git a/src/3rdparty/webkit/WebCore/loader/Cache.cpp b/src/3rdparty/webkit/WebCore/loader/Cache.cpp
index 1db6ce6..250ea0d 100644
--- a/src/3rdparty/webkit/WebCore/loader/Cache.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/Cache.cpp
@@ -34,8 +34,8 @@
 #include "FrameView.h"
 #include "Image.h"
 #include "ResourceHandle.h"
-#include "SystemTime.h"
 #include <stdio.h>
+#include <wtf/CurrentTime.h>
 
 using namespace std;
 
@@ -141,13 +141,6 @@ CachedResource* Cache::requestResource(DocLoader* docLoader, CachedResource::Typ
     if (resource->type() != type)
         return 0;
 
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    // addLowBandwidthDisplayRequest() returns true if requesting CSS or JS during low bandwidth display.
-    // Here, return 0 to not block parsing or layout.
-    if (docLoader->frame() && docLoader->frame()->loader()->addLowBandwidthDisplayRequest(resource))
-        return 0;
-#endif
-
     if (!disabled()) {
         // This will move the resource to the front of its LRU list and increase its access count.
         resourceAccessed(resource);
@@ -188,6 +181,7 @@ CachedCSSStyleSheet* Cache::requestUserCSSStyleSheet(DocLoader* docLoader, const
 void Cache::revalidateResource(CachedResource* resource, DocLoader* docLoader)
 {
     ASSERT(resource);
+    ASSERT(resource->inCache());
     ASSERT(!disabled());
     if (resource->resourceToRevalidate())
         return;
@@ -217,7 +211,7 @@ void Cache::revalidationSucceeded(CachedResource* revalidatingResource, const Re
     ASSERT(!m_resources.get(resource->url()));
     m_resources.set(resource->url(), resource);
     resource->setInCache(true);
-    resource->setExpirationDate(response.expirationDate());
+    resource->updateResponseAfterRevalidation(response);
     insertInLRUList(resource);
     int delta = resource->size();
     if (resource->decodedSize() && resource->hasClients())
@@ -274,7 +268,7 @@ void Cache::pruneLiveResources()
     unsigned targetSize = static_cast<unsigned>(capacity * cTargetPrunePercentage); // Cut by a percentage to avoid immediately pruning again.
     double currentTime = FrameView::currentPaintTimeStamp();
     if (!currentTime) // In case prune is called directly, outside of a Frame paint.
-        currentTime = WebCore::currentTime();
+        currentTime = WTF::currentTime();
     
     // Destroy any decoded data in live objects that we can.
     // Start from the tail, since this is the least recently accessed of the objects.
@@ -397,15 +391,6 @@ void Cache::evict(CachedResource* resource)
     // The resource may have already been removed by someone other than our caller,
     // who needed a fresh copy for a reload. See <http://bugs.webkit.org/show_bug.cgi?id=12479#c6>.
     if (resource->inCache()) {
-        if (!resource->isCacheValidator()) {
-            // Notify all doc loaders that might be observing this object still that it has been
-            // extracted from the set of resources.
-            // No need to do this for cache validator resources, they are replaced automatically by using CachedResourceHandles.
-            HashSet<DocLoader*>::iterator end = m_docLoaders.end();
-            for (HashSet<DocLoader*>::iterator itr = m_docLoaders.begin(); itr != end; ++itr)
-                (*itr)->removeCachedResource(resource);
-        }
-        
         // Remove from the resource map.
         m_resources.remove(resource->url());
         resource->setInCache(false);
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.cpp b/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.cpp
index 10d566e..4c466fa 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.cpp
@@ -29,6 +29,7 @@
 
 #include "CachedResourceClient.h"
 #include "CachedResourceClientWalker.h"
+#include "HTTPParsers.h"
 #include "TextResourceDecoder.h"
 #include "loader.h"
 #include <wtf/Vector.h>
@@ -48,10 +49,8 @@ CachedCSSStyleSheet::~CachedCSSStyleSheet()
 {
 }
 
-void CachedCSSStyleSheet::addClient(CachedResourceClient *c)
+void CachedCSSStyleSheet::didAddClient(CachedResourceClient *c)
 {
-    CachedResource::addClient(c);
-
     if (!m_loading)
         c->setCSSStyleSheet(m_url, m_decoder->encoding().name(), this);
 }
@@ -114,15 +113,6 @@ void CachedCSSStyleSheet::checkNotify()
     CachedResourceClientWalker w(m_clients);
     while (CachedResourceClient *c = w.next())
         c->setCSSStyleSheet(m_response.url().string(), m_decoder->encoding().name(), this);
-
-#if USE(LOW_BANDWIDTH_DISPLAY)        
-    // if checkNotify() is called from error(), client's setCSSStyleSheet(...)
-    // can't find "this" from url, so they can't do clean up if needed.
-    // call notifyFinished() to make sure they have a chance.
-    CachedResourceClientWalker n(m_clients);
-    while (CachedResourceClient* s = n.next())
-        s->notifyFinished(this);
-#endif        
 }
 
 void CachedCSSStyleSheet::error()
@@ -140,8 +130,14 @@ bool CachedCSSStyleSheet::canUseSheet(bool enforceMIMEType) const
     if (!enforceMIMEType)
         return true;
 
-    // This check exactly matches Firefox.
-    String mimeType = response().mimeType();
+    // This check exactly matches Firefox.  Note that we grab the Content-Type
+    // header directly because we want to see what the value is BEFORE content
+    // sniffing.  Firefox does this by setting a "type hint" on the channel.
+    // This implementation should be observationally equivalent.
+    //
+    // This code defaults to allowing the stylesheet for non-HTTP protocols so
+    // folks can use standards mode for local HTML documents.
+    String mimeType = extractMIMETypeFromMediaType(response().httpHeaderField("Content-Type"));
     return mimeType.isEmpty() || equalIgnoringCase(mimeType, "text/css") || equalIgnoringCase(mimeType, "application/x-unknown-content-type");
 }
  
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.h b/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.h
index fa0b31a..e782f2e 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedCSSStyleSheet.h
@@ -42,7 +42,7 @@ namespace WebCore {
 
         const String sheetText(bool enforceMIMEType = true) const;
 
-        virtual void addClient(CachedResourceClient*);
+        virtual void didAddClient(CachedResourceClient*);
         
         virtual void allClientsRemoved();
 
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedFont.cpp b/src/3rdparty/webkit/WebCore/loader/CachedFont.cpp
index 5fd9a22..af18cc9 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedFont.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedFont.cpp
@@ -31,7 +31,7 @@
 #include "CachedResourceClientWalker.h"
 #include "DOMImplementation.h"
 #include "FontPlatformData.h"
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK)
+#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && PLATFORM(WIN_OS))
 #include "FontCustomPlatformData.h"
 #endif
 #include "TextResourceDecoder.h"
@@ -60,7 +60,7 @@ CachedFont::CachedFont(const String &url)
 
 CachedFont::~CachedFont()
 {
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK)
+#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && PLATFORM(WIN_OS))
     delete m_fontData;
 #endif
 }
@@ -71,10 +71,8 @@ void CachedFont::load(DocLoader*)
     m_loading = true;
 }
 
-void CachedFont::addClient(CachedResourceClient* c)
+void CachedFont::didAddClient(CachedResourceClient* c)
 {
-    CachedResource::addClient(c);
-    
     if (!m_loading)
         c->fontLoaded(this);
 }
@@ -100,7 +98,7 @@ void CachedFont::beginLoadIfNeeded(DocLoader* dl)
 
 bool CachedFont::ensureCustomFontData()
 {
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK)
+#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && PLATFORM(WIN_OS))
 #if ENABLE(SVG_FONTS)
     ASSERT(!m_isSVGFont);
 #endif
@@ -119,7 +117,7 @@ FontPlatformData CachedFont::platformDataFromCustomData(float size, bool bold, b
     if (m_externalSVGDocument)
         return FontPlatformData(size, bold, italic);
 #endif
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK)
+#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && PLATFORM(WIN_OS))
     ASSERT(m_fontData);
     return m_fontData->fontPlatformData(static_cast<int>(size), bold, italic, renderingMode);
 #else
@@ -137,6 +135,7 @@ bool CachedFont::ensureSVGFontData()
 
         RefPtr<TextResourceDecoder> decoder = TextResourceDecoder::create("application/xml");
         m_externalSVGDocument->write(decoder->decode(m_data->data(), m_data->size()));
+        m_externalSVGDocument->write(decoder->flush());
         if (decoder->sawError()) {
             m_externalSVGDocument.clear();
             return 0;
@@ -174,7 +173,7 @@ SVGFontElement* CachedFont::getSVGFontById(const String& fontName) const
 
 void CachedFont::allClientsRemoved()
 {
-#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK)
+#if PLATFORM(CG) || PLATFORM(QT) || PLATFORM(GTK) || (PLATFORM(CHROMIUM) && PLATFORM(WIN_OS))
     if (m_fontData) {
         delete m_fontData;
         m_fontData = 0;
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedFont.h b/src/3rdparty/webkit/WebCore/loader/CachedFont.h
index fd19cdb..05b28f3 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedFont.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedFont.h
@@ -39,10 +39,11 @@ namespace WebCore {
 
 class DocLoader;
 class Cache;
-class FontCustomPlatformData;
 class FontPlatformData;
 class SVGFontElement;
 
+struct FontCustomPlatformData;
+
 class CachedFont : public CachedResource {
 public:
     CachedFont(const String& url);
@@ -50,7 +51,7 @@ public:
     
     virtual void load(DocLoader* docLoader);
 
-    virtual void addClient(CachedResourceClient*);
+    virtual void didAddClient(CachedResourceClient*);
     virtual void data(PassRefPtr<SharedBuffer> data, bool allDataReceived);
     virtual void error();
 
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedImage.cpp b/src/3rdparty/webkit/WebCore/loader/CachedImage.cpp
index 98aee9e..e610ad1 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedImage.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedImage.cpp
@@ -33,7 +33,7 @@
 #include "FrameView.h"
 #include "Request.h"
 #include "Settings.h"
-#include "SystemTime.h"
+#include <wtf/CurrentTime.h>
 #include <wtf/StdLibExtras.h>
 #include <wtf/Vector.h>
 
@@ -53,6 +53,7 @@ CachedImage::CachedImage(const String& url)
     : CachedResource(url, ImageResource)
     , m_image(0)
     , m_decodedDataDeletionTimer(this, &CachedImage::decodedDataDeletionTimerFired)
+    , m_httpStatusCodeErrorOccurred(false)
 {
     m_status = Unknown;
 }
@@ -61,6 +62,7 @@ CachedImage::CachedImage(Image* image)
     : CachedResource(String(), ImageResource)
     , m_image(image)
     , m_decodedDataDeletionTimer(this, &CachedImage::decodedDataDeletionTimerFired)
+    , m_httpStatusCodeErrorOccurred(false)
 {
     m_status = Cached;
     m_loading = false;
@@ -84,10 +86,8 @@ void CachedImage::load(DocLoader* docLoader)
         m_loading = false;
 }
 
-void CachedImage::addClient(CachedResourceClient* c)
+void CachedImage::didAddClient(CachedResourceClient* c)
 {
-    CachedResource::addClient(c);
-
     if (m_decodedDataDeletionTimer.isActive())
         m_decodedDataDeletionTimer.stop();
     
@@ -96,7 +96,7 @@ void CachedImage::addClient(CachedResourceClient* c)
         m_image->setData(m_data, true);
     }
 
-    if (m_image && !m_image->rect().isEmpty())
+    if (m_image && !m_image->isNull())
         c->imageChanged(this);
 
     if (!m_loading)
@@ -305,6 +305,7 @@ void CachedImage::error()
 {
     clear();
     m_errorOccurred = true;
+    m_data.clear();
     notifyObservers();
     m_loading = false;
     checkNotify();
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedImage.h b/src/3rdparty/webkit/WebCore/loader/CachedImage.h
index 9c3442f..2aa35ac 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedImage.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedImage.h
@@ -60,14 +60,17 @@ public:
     IntSize imageSize(float multiplier) const;  // returns the size of the complete image.
     IntRect imageRect(float multiplier) const;  // The size of the currently decoded portion of the image.
 
-    virtual void addClient(CachedResourceClient*);
+    virtual void didAddClient(CachedResourceClient*);
     
     virtual void allClientsRemoved();
     virtual void destroyDecodedData();
 
     virtual void data(PassRefPtr<SharedBuffer> data, bool allDataReceived);
     virtual void error();
-
+    
+    virtual void httpStatusCodeError() { m_httpStatusCodeErrorOccurred = true; }
+    bool httpStatusCodeErrorOccurred() const { return m_httpStatusCodeErrorOccurred; }
+    
     virtual bool schedule() const { return true; }
 
     void checkNotify();
@@ -96,6 +99,7 @@ private:
 
     RefPtr<Image> m_image;
     Timer<CachedImage> m_decodedDataDeletionTimer;
+    bool m_httpStatusCodeErrorOccurred;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp b/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp
index c1e7191..478873f 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedResource.cpp
@@ -32,8 +32,10 @@
 #include "KURL.h"
 #include "PurgeableBuffer.h"
 #include "Request.h"
-#include "SystemTime.h"
+#include <wtf/CurrentTime.h>
+#include <wtf/MathExtras.h>
 #include <wtf/RefCountedLeakCounter.h>
+#include <wtf/StdLibExtras.h>
 #include <wtf/Vector.h>
 
 using namespace WTF;
@@ -46,6 +48,7 @@ static RefCountedLeakCounter cachedResourceLeakCounter("CachedResource");
 
 CachedResource::CachedResource(const String& url, Type type)
     : m_url(url)
+    , m_responseTimestamp(currentTime())
     , m_lastDecodedAccessTime(0)
     , m_sendResourceLoadCallbacks(true)
     , m_preloadCount(0)
@@ -57,7 +60,6 @@ CachedResource::CachedResource(const String& url, Type type)
     , m_handleCount(0)
     , m_resourceToRevalidate(0)
     , m_isBeingRevalidated(false)
-    , m_expirationDate(0)
 {
 #ifndef NDEBUG
     cachedResourceLeakCounter.increment();
@@ -116,16 +118,50 @@ void CachedResource::finish()
 
 bool CachedResource::isExpired() const
 {
-    if (!m_expirationDate)
+    if (m_response.isNull())
         return false;
-    time_t now = time(0);
-    return difftime(now, m_expirationDate) >= 0;
+
+    return currentAge() > freshnessLifetime();
+}
+    
+double CachedResource::currentAge() const
+{
+    // RFC2616 13.2.3
+    // No compensation for latency as that is not terribly important in practice
+    double dateValue = m_response.date();
+    double apparentAge = isfinite(dateValue) ? max(0., m_responseTimestamp - dateValue) : 0;
+    double ageValue = m_response.age();
+    double correctedReceivedAge = isfinite(ageValue) ? max(apparentAge, ageValue) : apparentAge;
+    double residentTime = currentTime() - m_responseTimestamp;
+    return correctedReceivedAge + residentTime;
+}
+    
+double CachedResource::freshnessLifetime() const
+{
+    // Cache non-http resources liberally
+    if (!m_response.url().protocolInHTTPFamily())
+        return std::numeric_limits<double>::max();
+
+    // RFC2616 13.2.4
+    double maxAgeValue = m_response.cacheControlMaxAge();
+    if (isfinite(maxAgeValue))
+        return maxAgeValue;
+    double expiresValue = m_response.expires();
+    double dateValue = m_response.date();
+    double creationTime = isfinite(dateValue) ? dateValue : m_responseTimestamp;
+    if (isfinite(expiresValue))
+        return expiresValue - creationTime;
+    double lastModifiedValue = m_response.lastModified();
+    if (isfinite(lastModifiedValue))
+        return (creationTime - lastModifiedValue) * 0.1;
+    // If no cache headers are present, the specification leaves the decision to the UA. Other browsers seem to opt for 0.
+    return 0;
 }
 
 void CachedResource::setResponse(const ResourceResponse& response)
 {
     m_response = response;
-    m_expirationDate = response.expirationDate();
+    m_responseTimestamp = currentTime();
 }
 
 void CachedResource::setRequest(Request* request)
@@ -137,7 +173,13 @@ void CachedResource::setRequest(Request* request)
         delete this;
 }
 
-void CachedResource::addClient(CachedResourceClient *c)
+void CachedResource::addClient(CachedResourceClient* client)
+{
+    addClientToSet(client);
+    didAddClient(client);
+}
+
+void CachedResource::addClientToSet(CachedResourceClient* client)
 {
     ASSERT(!isPurgeable());
 
@@ -151,21 +193,28 @@ void CachedResource::addClient(CachedResourceClient *c)
     }
     if (!hasClients() && inCache())
         cache()->addToLiveResourcesSize(this);
-    m_clients.add(c);
+    m_clients.add(client);
 }
 
-void CachedResource::removeClient(CachedResourceClient *c)
+void CachedResource::removeClient(CachedResourceClient* client)
 {
-    ASSERT(m_clients.contains(c));
-    m_clients.remove(c);
+    ASSERT(m_clients.contains(client));
+    m_clients.remove(client);
+
     if (canDelete() && !inCache())
         delete this;
     else if (!hasClients() && inCache()) {
         cache()->removeFromLiveResourcesSize(this);
         cache()->removeFromLiveDecodedResourcesList(this);
         allClientsRemoved();
-        cache()->prune();
+        if (response().cacheControlContainsNoStore()) {
+            // RFC2616 14.9.2:
+            // "no-store: ...MUST make a best-effort attempt to remove the information from volatile storage as promptly as possible"
+            cache()->remove(this);
+        } else
+            cache()->prune();
     }
+    // This object may be dead here.
 }
 
 void CachedResource::deleteIfPossible()
@@ -259,7 +308,6 @@ void CachedResource::setResourceToRevalidate(CachedResource* resource)
 void CachedResource::clearResourceToRevalidate() 
 { 
     ASSERT(m_resourceToRevalidate);
-    ASSERT(m_resourceToRevalidate->m_isBeingRevalidated);
     m_resourceToRevalidate->m_isBeingRevalidated = false;
     m_resourceToRevalidate->deleteIfPossible();
     m_handlesToRevalidate.clear();
@@ -270,6 +318,7 @@ void CachedResource::clearResourceToRevalidate()
 void CachedResource::switchClientsToRevalidatedResource()
 {
     ASSERT(m_resourceToRevalidate);
+    ASSERT(m_resourceToRevalidate->inCache());
     ASSERT(!inCache());
 
     HashSet<CachedResourceHandleBase*>::iterator end = m_handlesToRevalidate.end();
@@ -294,26 +343,62 @@ void CachedResource::switchClientsToRevalidatedResource()
     }
     // Equivalent of calling removeClient() for all clients
     m_clients.clear();
-    
+
     unsigned moveCount = clientsToMove.size();
     for (unsigned n = 0; n < moveCount; ++n)
-        m_resourceToRevalidate->addClient(clientsToMove[n]);
+        m_resourceToRevalidate->addClientToSet(clientsToMove[n]);
+    for (unsigned n = 0; n < moveCount; ++n) {
+        // Calling didAddClient for a client may end up removing another client. In that case it won't be in the set anymore.
+        if (m_resourceToRevalidate->m_clients.contains(clientsToMove[n]))
+            m_resourceToRevalidate->didAddClient(clientsToMove[n]);
+    }
+}
+    
+void CachedResource::updateResponseAfterRevalidation(const ResourceResponse& validatingResponse)
+{
+    m_responseTimestamp = currentTime();
+
+    DEFINE_STATIC_LOCAL(const AtomicString, contentHeaderPrefix, ("content-"));
+    // RFC2616 10.3.5
+    // Update cached headers from the 304 response
+    const HTTPHeaderMap& newHeaders = validatingResponse.httpHeaderFields();
+    HTTPHeaderMap::const_iterator end = newHeaders.end();
+    for (HTTPHeaderMap::const_iterator it = newHeaders.begin(); it != end; ++it) {
+        // Don't allow 304 response to update content headers, these can't change but some servers send wrong values.
+        if (it->first.startsWith(contentHeaderPrefix, false))
+            continue;
+        m_response.setHTTPHeaderField(it->first, it->second);
+    }
 }
     
 bool CachedResource::canUseCacheValidator() const
 {
-    return !m_loading && (!m_response.httpHeaderField("Last-Modified").isEmpty() || !m_response.httpHeaderField("ETag").isEmpty());
+    if (m_loading || m_errorOccurred)
+        return false;
+
+    if (m_response.cacheControlContainsNoStore())
+        return false;
+
+    DEFINE_STATIC_LOCAL(const AtomicString, lastModifiedHeader, ("last-modified"));
+    DEFINE_STATIC_LOCAL(const AtomicString, eTagHeader, ("etag"));
+    return !m_response.httpHeaderField(lastModifiedHeader).isEmpty() || !m_response.httpHeaderField(eTagHeader).isEmpty();
 }
     
 bool CachedResource::mustRevalidate(CachePolicy cachePolicy) const
 {
+    if (m_errorOccurred)
+        return true;
+
     if (m_loading)
         return false;
+    
+    if (m_response.cacheControlContainsNoCache() || m_response.cacheControlContainsNoStore())
+        return true;
 
-    // FIXME: Also look at max-age, min-fresh, max-stale in Cache-Control
     if (cachePolicy == CachePolicyCache)
-        return m_response.cacheControlContainsNoCache() || (isExpired() && m_response.cacheControlContainsMustRevalidate());
-    return isExpired() || m_response.cacheControlContainsNoCache();
+        return m_response.cacheControlContainsMustRevalidate() && isExpired();
+
+    return isExpired();
 }
 
 bool CachedResource::isSafeToMakePurgeable() const
@@ -379,18 +464,10 @@ bool CachedResource::wasPurged() const
 
 unsigned CachedResource::overheadSize() const
 {
-   
-    // FIXME: Find some programmatic lighweight way to calculate response size, and size of the different CachedResource classes.  
-    // This is a rough estimate of resource overhead based on stats collected from the stress test.
-    return sizeof(CachedResource) + 3648;
-    
-    /*  sizeof(CachedResource) + 
-        192 +                        // average size of m_url.
-        384 +                        // average size of m_clients hash map.
-        1280 * 2 +                   // average size of ResourceResponse.  Doubled to account for the WebCore copy and the CF copy. 
-                                     // Mostly due to the size of the hash maps, the Header Map strings and the URL.
-        256 * 2                      // Overhead from ResourceRequest, doubled to account for WebCore copy and CF copy. 
-                                     // Mostly due to the URL and Header Map.
+    return sizeof(CachedResource) + m_response.memoryUsage() + 576;
+    /*
+        576 = 192 +                   // average size of m_url
+              384;                    // average size of m_clients hash map
     */
 }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedResource.h b/src/3rdparty/webkit/WebCore/loader/CachedResource.h
index 63c250b..babdf89 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedResource.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedResource.h
@@ -82,11 +82,12 @@ public:
     virtual String encoding() const { return String(); }
     virtual void data(PassRefPtr<SharedBuffer> data, bool allDataReceived) = 0;
     virtual void error() = 0;
+    virtual void httpStatusCodeError() { error(); } // Images keep loading in spite of HTTP errors (for legacy compat with <img>, etc.).
 
     const String &url() const { return m_url; }
     Type type() const { return m_type; }
 
-    virtual void addClient(CachedResourceClient*);
+    void addClient(CachedResourceClient*);
     void removeClient(CachedResourceClient*);
     bool hasClients() const { return !m_clients.isEmpty(); }
     void deleteIfPossible();
@@ -99,7 +100,8 @@ public:
     };
     PreloadResult preloadResult() const { return m_preloadResult; }
     void setRequestedFromNetworkingLayer() { m_requestedFromNetworkingLayer = true; }
-        
+
+    virtual void didAddClient(CachedResourceClient*) = 0;
     virtual void allClientsRemoved() { }
 
     unsigned count() const { return m_clients.size(); }
@@ -126,7 +128,8 @@ public:
     // Called by the cache if the object has been removed from the cache
     // while still being referenced. This means the object should delete itself
     // if the number of clients observing it ever drops to 0.
-    void setInCache(bool b) { m_inCache = b; }
+    // The resource can be brought back to cache after successful revalidation.
+    void setInCache(bool b) { m_inCache = b; if (b) m_isBeingRevalidated = false; }
     bool inCache() const { return m_inCache; }
     
     void setInLiveDecodedResourcesList(bool b) { m_inLiveDecodedResourcesList = b; }
@@ -162,7 +165,7 @@ public:
     void decreasePreloadCount() { ASSERT(m_preloadCount); --m_preloadCount; }
     
     void registerHandle(CachedResourceHandleBase* h) { ++m_handleCount; if (m_resourceToRevalidate) m_handlesToRevalidate.add(h); }
-    void unregisterHandle(CachedResourceHandleBase* h) { --m_handleCount; if (m_resourceToRevalidate) m_handlesToRevalidate.remove(h); if (!m_handleCount) deleteIfPossible(); }
+    void unregisterHandle(CachedResourceHandleBase* h) { ASSERT(m_handleCount > 0); --m_handleCount; if (m_resourceToRevalidate) m_handlesToRevalidate.remove(h); if (!m_handleCount) deleteIfPossible(); }
     
     bool canUseCacheValidator() const;
     bool mustRevalidate(CachePolicy) const;
@@ -172,12 +175,16 @@ public:
     bool isPurgeable() const;
     bool wasPurged() const;
     
+    // This is used by the archive machinery to get at a purged resource without
+    // triggering a load. We should make it protected again if we can find a
+    // better way to handle the archive case.
+    bool makePurgeable(bool purgeable);
+
 protected:
     void setEncodedSize(unsigned);
     void setDecodedSize(unsigned);
     void didAccessDecodedData(double timeStamp);
 
-    bool makePurgeable(bool purgeable);
     bool isSafeToMakePurgeable() const;
     
     HashCountedSet<CachedResourceClient*> m_clients;
@@ -187,6 +194,8 @@ protected:
     Request* m_request;
 
     ResourceResponse m_response;
+    double m_responseTimestamp;
+
     RefPtr<SharedBuffer> m_data;
     OwnPtr<PurgeableBuffer> m_purgeableData;
 
@@ -196,11 +205,16 @@ protected:
     bool m_errorOccurred;
 
 private:
+    void addClientToSet(CachedResourceClient*);
+                                        
     // These are called by the friendly Cache only
     void setResourceToRevalidate(CachedResource*);
     void switchClientsToRevalidatedResource();
     void clearResourceToRevalidate();
-    void setExpirationDate(time_t expirationDate) { m_expirationDate = expirationDate; }
+    void updateResponseAfterRevalidation(const ResourceResponse& validatingResponse);
+
+    double currentAge() const;
+    double freshnessLifetime() const;
 
     unsigned m_encodedSize;
     unsigned m_decodedSize;
@@ -217,7 +231,6 @@ private:
 protected:
     bool m_inCache;
     bool m_loading;
-    bool m_expireDateChanged;
 #ifndef NDEBUG
     bool m_deleted;
     unsigned m_lruIndex;
@@ -241,8 +254,6 @@ private:
     bool m_isBeingRevalidated;
     // These handles will need to be updated to point to the m_resourceToRevalidate in case we get 304 response.
     HashSet<CachedResourceHandleBase*> m_handlesToRevalidate;
-    
-    time_t m_expirationDate;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedScript.cpp b/src/3rdparty/webkit/WebCore/loader/CachedScript.cpp
index 411521b..31483d6 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedScript.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedScript.cpp
@@ -29,30 +29,28 @@
 
 #include "CachedResourceClient.h"
 #include "CachedResourceClientWalker.h"
+#include "TextResourceDecoder.h"
 #include <wtf/Vector.h>
 
 namespace WebCore {
 
 CachedScript::CachedScript(const String& url, const String& charset)
     : CachedResource(url, Script)
-    , m_encoding(charset)
+    , m_decoder(TextResourceDecoder::create("application/javascript", charset))
     , m_decodedDataDeletionTimer(this, &CachedScript::decodedDataDeletionTimerFired)
 {
     // It's javascript we want.
     // But some websites think their scripts are <some wrong mimetype here>
     // and refuse to serve them if we only accept application/x-javascript.
     setAccept("*/*");
-    if (!m_encoding.isValid())
-        m_encoding = Latin1Encoding();
 }
 
 CachedScript::~CachedScript()
 {
 }
 
-void CachedScript::addClient(CachedResourceClient* c)
+void CachedScript::didAddClient(CachedResourceClient* c)
 {
-    CachedResource::addClient(c);
     if (!m_loading)
         c->notifyFinished(this);
 }
@@ -64,14 +62,12 @@ void CachedScript::allClientsRemoved()
 
 void CachedScript::setEncoding(const String& chs)
 {
-    TextEncoding encoding(chs);
-    if (encoding.isValid())
-        m_encoding = encoding;
+    m_decoder->setEncoding(chs, TextResourceDecoder::EncodingFromHTTPHeader);
 }
 
 String CachedScript::encoding() const
 {
-    return m_encoding.name();
+    return m_decoder->encoding().name();
 }
 
 const String& CachedScript::script()
@@ -79,7 +75,8 @@ const String& CachedScript::script()
     ASSERT(!isPurgeable());
 
     if (!m_script && m_data) {
-        m_script = m_encoding.decode(m_data->data(), encodedSize());
+        m_script = m_decoder->decode(m_data->data(), encodedSize());
+        m_script += m_decoder->flush();
         setDecodedSize(m_script.length() * sizeof(UChar));
     }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedScript.h b/src/3rdparty/webkit/WebCore/loader/CachedScript.h
index 1715e06..13afa89 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedScript.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedScript.h
@@ -27,12 +27,12 @@
 #define CachedScript_h
 
 #include "CachedResource.h"
-#include "TextEncoding.h"
 #include "Timer.h"
 
 namespace WebCore {
 
     class DocLoader;
+    class TextResourceDecoder;
 
     class CachedScript : public CachedResource {
     public:
@@ -41,7 +41,7 @@ namespace WebCore {
 
         const String& script();
 
-        virtual void addClient(CachedResourceClient*);
+        virtual void didAddClient(CachedResourceClient*);
         virtual void allClientsRemoved();
 
         virtual void setEncoding(const String&);
@@ -59,7 +59,7 @@ namespace WebCore {
         void decodedDataDeletionTimerFired(Timer<CachedScript>*);
 
         String m_script;
-        TextEncoding m_encoding;
+        RefPtr<TextResourceDecoder> m_decoder;
         Timer<CachedScript> m_decodedDataDeletionTimer;
     };
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedXSLStyleSheet.cpp b/src/3rdparty/webkit/WebCore/loader/CachedXSLStyleSheet.cpp
index f221664..5da0abf 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedXSLStyleSheet.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/CachedXSLStyleSheet.cpp
@@ -45,10 +45,8 @@ CachedXSLStyleSheet::CachedXSLStyleSheet(const String &url)
     setAccept("text/xml, application/xml, application/xhtml+xml, text/xsl, application/rss+xml, application/atom+xml");
 }
 
-void CachedXSLStyleSheet::addClient(CachedResourceClient *c)
-{
-    CachedResource::addClient(c);
-    
+void CachedXSLStyleSheet::didAddClient(CachedResourceClient* c)
+{  
     if (!m_loading)
         c->setXSLStyleSheet(m_url, m_sheet);
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/CachedXSLStyleSheet.h b/src/3rdparty/webkit/WebCore/loader/CachedXSLStyleSheet.h
index 9eca098..b6b0585 100644
--- a/src/3rdparty/webkit/WebCore/loader/CachedXSLStyleSheet.h
+++ b/src/3rdparty/webkit/WebCore/loader/CachedXSLStyleSheet.h
@@ -41,7 +41,7 @@ namespace WebCore {
 
         const String& sheet() const { return m_sheet; }
         
-        virtual void addClient(CachedResourceClient*);
+        virtual void didAddClient(CachedResourceClient*);
         
         virtual void setEncoding(const String&);
         virtual String encoding() const;
diff --git a/src/3rdparty/webkit/WebCore/loader/CrossOriginAccessControl.cpp b/src/3rdparty/webkit/WebCore/loader/CrossOriginAccessControl.cpp
new file mode 100644
index 0000000..f0f8b6a
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/CrossOriginAccessControl.cpp
@@ -0,0 +1,116 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "config.h"
+#include "CrossOriginAccessControl.h"
+
+#include "AtomicString.h"
+#include "HTTPParsers.h"
+#include "ResourceResponse.h"
+#include "SecurityOrigin.h"
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+bool isOnAccessControlSimpleRequestMethodWhitelist(const String& method)
+{
+    return method == "GET" || method == "HEAD" || method == "POST";
+}
+
+bool isOnAccessControlSimpleRequestHeaderWhitelist(const String& name, const String& value)
+{
+    if (equalIgnoringCase(name, "accept") || equalIgnoringCase(name, "accept-language") || equalIgnoringCase(name, "content-language"))
+        return true;
+
+    // Preflight is required for MIME types that can not be sent via form submission.
+    if (equalIgnoringCase(name, "content-type")) {
+        String mimeType = extractMIMETypeFromMediaType(value);
+        return equalIgnoringCase(mimeType, "application/x-www-form-urlencoded")
+            || equalIgnoringCase(mimeType, "multipart/form-data")
+            || equalIgnoringCase(mimeType, "text/plain");
+    }
+
+    return false;
+}
+
+bool isSimpleCrossOriginAccessRequest(const String& method, const HTTPHeaderMap& headerMap)
+{
+    if (!isOnAccessControlSimpleRequestMethodWhitelist(method))
+        return false;
+
+    HTTPHeaderMap::const_iterator end = headerMap.end();
+    for (HTTPHeaderMap::const_iterator it = headerMap.begin(); it != end; ++it) {
+        if (!isOnAccessControlSimpleRequestHeaderWhitelist(it->first, it->second))
+            return false;
+    }
+
+    return true;
+}
+
+typedef HashSet<String, CaseFoldingHash> HTTPHeaderSet;
+static HTTPHeaderSet* createAllowedCrossOriginResponseHeadersSet()
+{
+    HTTPHeaderSet* headerSet = new HashSet<String, CaseFoldingHash>;
+    
+    headerSet->add("cache-control");
+    headerSet->add("content-language");
+    headerSet->add("content-type");
+    headerSet->add("expires");
+    headerSet->add("last-modified");
+    headerSet->add("pragma");
+
+    return headerSet;
+}
+
+bool isOnAccessControlResponseHeaderWhitelist(const String& name)
+{
+    AtomicallyInitializedStatic(HTTPHeaderSet*, allowedCrossOriginResponseHeaders = createAllowedCrossOriginResponseHeadersSet());
+
+    return allowedCrossOriginResponseHeaders->contains(name);
+}
+
+bool passesAccessControlCheck(const ResourceResponse& response, bool includeCredentials, SecurityOrigin* securityOrigin)
+{
+    // A wildcard Access-Control-Allow-Origin can not be used if credentials are to be sent,
+    // even with Access-Control-Allow-Credentials set to true.
+    const String& accessControlOriginString = response.httpHeaderField("Access-Control-Allow-Origin");
+    if (accessControlOriginString == "*" && !includeCredentials)
+        return true;
+
+    RefPtr<SecurityOrigin> accessControlOrigin = SecurityOrigin::createFromString(accessControlOriginString);
+    if (!accessControlOrigin->isSameSchemeHostPort(securityOrigin))
+        return false;
+
+    if (includeCredentials) {
+        const String& accessControlCredentialsString = response.httpHeaderField("Access-Control-Allow-Credentials");
+        if (accessControlCredentialsString != "true")
+            return false;
+    }
+
+    return true;
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/CrossOriginAccessControl.h b/src/3rdparty/webkit/WebCore/loader/CrossOriginAccessControl.h
new file mode 100644
index 0000000..267646f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/CrossOriginAccessControl.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+namespace WebCore {
+
+    class HTTPHeaderMap;
+    class ResourceResponse;
+    class SecurityOrigin;
+    class String;
+
+    bool isSimpleCrossOriginAccessRequest(const String& method, const HTTPHeaderMap&);
+    bool isOnAccessControlSimpleRequestMethodWhitelist(const String&);
+    bool isOnAccessControlSimpleRequestHeaderWhitelist(const String& name, const String& value);
+    bool isOnAccessControlResponseHeaderWhitelist(const String&);
+
+    bool passesAccessControlCheck(const ResourceResponse&, bool includeCredentials, SecurityOrigin*);
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.cpp b/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.cpp
new file mode 100644
index 0000000..4bd05b2
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.cpp
@@ -0,0 +1,173 @@
+/*
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "config.h"
+#include "CrossOriginPreflightResultCache.h"
+
+#include "CrossOriginAccessControl.h"
+#include "ResourceResponse.h"
+#include <wtf/CurrentTime.h>
+
+namespace WebCore {
+
+// These values are at the discretion of the user agent.
+static const unsigned defaultPreflightCacheTimeoutSeconds = 5;
+static const unsigned maxPreflightCacheTimeoutSeconds = 600; // Should be short enough to minimize the risk of using a poisoned cache after switching to a secure network.
+
+static bool parseAccessControlMaxAge(const String& string, unsigned& expiryDelta)
+{
+    // FIXME: this will not do the correct thing for a number starting with a '+'
+    bool ok = false;
+    expiryDelta = string.toUIntStrict(&ok);
+    return ok;
+}
+
+template<class HashType>
+static void addToAccessControlAllowList(const String& string, unsigned start, unsigned end, HashSet<String, HashType>& set)
+{
+    StringImpl* stringImpl = string.impl();
+    if (!stringImpl)
+        return;
+
+    // Skip white space from start.
+    while (start <= end && isSpaceOrNewline((*stringImpl)[start]))
+        ++start;
+
+    // only white space
+    if (start > end) 
+        return;
+
+    // Skip white space from end.
+    while (end && isSpaceOrNewline((*stringImpl)[end]))
+        --end;
+
+    // substringCopy() is called on the strings because the cache is accessed on multiple threads.
+    set.add(string.substringCopy(start, end - start + 1));
+}
+
+template<class HashType>
+static bool parseAccessControlAllowList(const String& string, HashSet<String, HashType>& set)
+{
+    int start = 0;
+    int end;
+    while ((end = string.find(',', start)) != -1) {
+        if (start == end)
+            return false;
+
+        addToAccessControlAllowList(string, start, end - 1, set);
+        start = end + 1;
+    }
+    if (start != static_cast<int>(string.length()))
+        addToAccessControlAllowList(string, start, string.length() - 1, set);
+
+    return true;
+}
+
+bool CrossOriginPreflightResultCacheItem::parse(const ResourceResponse& response)
+{
+    m_methods.clear();
+    if (!parseAccessControlAllowList(response.httpHeaderField("Access-Control-Allow-Methods"), m_methods))
+        return false;
+
+    m_headers.clear();
+    if (!parseAccessControlAllowList(response.httpHeaderField("Access-Control-Allow-Headers"), m_headers))
+        return false;
+
+    unsigned expiryDelta;
+    if (parseAccessControlMaxAge(response.httpHeaderField("Access-Control-Max-Age"), expiryDelta)) {
+        if (expiryDelta > maxPreflightCacheTimeoutSeconds)
+            expiryDelta = maxPreflightCacheTimeoutSeconds;
+    } else
+        expiryDelta = defaultPreflightCacheTimeoutSeconds;
+
+    m_absoluteExpiryTime = currentTime() + expiryDelta;
+    return true;
+}
+
+bool CrossOriginPreflightResultCacheItem::allowsCrossOriginMethod(const String& method) const
+{
+    return m_methods.contains(method) || isOnAccessControlSimpleRequestMethodWhitelist(method);
+}
+
+bool CrossOriginPreflightResultCacheItem::allowsCrossOriginHeaders(const HTTPHeaderMap& requestHeaders) const
+{
+    HTTPHeaderMap::const_iterator end = requestHeaders.end();
+    for (HTTPHeaderMap::const_iterator it = requestHeaders.begin(); it != end; ++it) {
+        if (!m_headers.contains(it->first) && !isOnAccessControlSimpleRequestHeaderWhitelist(it->first, it->second))
+            return false;
+    }
+    return true;
+}
+
+bool CrossOriginPreflightResultCacheItem::allowsRequest(bool includeCredentials, const String& method, const HTTPHeaderMap& requestHeaders) const
+{
+    if (m_absoluteExpiryTime < currentTime())
+        return false;
+    if (includeCredentials && !m_credentials)
+        return false;
+    if (!allowsCrossOriginMethod(method))
+        return false;
+    if (!allowsCrossOriginHeaders(requestHeaders))
+        return false;
+    return true;
+}
+
+CrossOriginPreflightResultCache& CrossOriginPreflightResultCache::shared()
+{
+    AtomicallyInitializedStatic(CrossOriginPreflightResultCache&, cache = *new CrossOriginPreflightResultCache);
+    return cache;
+}
+
+void CrossOriginPreflightResultCache::appendEntry(const String& origin, const KURL& url, CrossOriginPreflightResultCacheItem* preflightResult)
+{
+    MutexLocker lock(m_mutex);
+    // Note that the entry may already be present in the HashMap if another thread is accessing the same location.
+    m_preflightHashMap.set(std::make_pair(origin.copy(), url.copy()), preflightResult);
+}
+
+bool CrossOriginPreflightResultCache::canSkipPreflight(const String& origin, const KURL& url, bool includeCredentials, const String& method, const HTTPHeaderMap& requestHeaders)
+{
+    MutexLocker lock(m_mutex);
+    CrossOriginPreflightResultHashMap::iterator cacheIt = m_preflightHashMap.find(std::make_pair(origin, url));
+    if (cacheIt == m_preflightHashMap.end())
+        return false;
+
+    if (cacheIt->second->allowsRequest(includeCredentials, method, requestHeaders))
+        return true;
+
+    delete cacheIt->second;
+    m_preflightHashMap.remove(cacheIt);
+    return false;
+}
+
+void CrossOriginPreflightResultCache::empty()
+{
+    MutexLocker lock(m_mutex);
+    deleteAllValues(m_preflightHashMap);
+    m_preflightHashMap.clear();
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.h b/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.h
new file mode 100644
index 0000000..39c3cd1
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/CrossOriginPreflightResultCache.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "KURLHash.h"
+#include "StringHash.h"
+
+namespace WebCore {
+
+    class HTTPHeaderMap;
+    class ResourceResponse;
+
+    class CrossOriginPreflightResultCacheItem : Noncopyable {
+    public:
+        CrossOriginPreflightResultCacheItem(bool credentials)
+            : m_absoluteExpiryTime(0)
+            , m_credentials(credentials)
+        {
+        }
+
+        bool parse(const ResourceResponse&);
+        bool allowsCrossOriginMethod(const String&) const;
+        bool allowsCrossOriginHeaders(const HTTPHeaderMap&) const;
+        bool allowsRequest(bool includeCredentials, const String& method, const HTTPHeaderMap& requestHeaders) const;
+
+    private:
+        typedef HashSet<String, CaseFoldingHash> HeadersSet;
+
+        // FIXME: A better solution to holding onto the absolute expiration time might be
+        // to start a timer for the expiration delta that removes this from the cache when
+        // it fires.
+        double m_absoluteExpiryTime;
+        bool m_credentials;
+        HashSet<String> m_methods;
+        HeadersSet m_headers;
+    };
+
+    class CrossOriginPreflightResultCache : Noncopyable {
+    public:
+        static CrossOriginPreflightResultCache& shared();
+
+        void appendEntry(const String& origin, const KURL&, CrossOriginPreflightResultCacheItem*);
+        bool canSkipPreflight(const String& origin, const KURL&, bool includeCredentials, const String& method, const HTTPHeaderMap& requestHeaders);
+
+        void empty();
+
+    private:
+        CrossOriginPreflightResultCache() { }
+
+        typedef HashMap<std::pair<String, KURL>, CrossOriginPreflightResultCacheItem*> CrossOriginPreflightResultHashMap;
+
+        CrossOriginPreflightResultHashMap m_preflightHashMap;
+        Mutex m_mutex;
+    };
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/DocLoader.cpp b/src/3rdparty/webkit/WebCore/loader/DocLoader.cpp
index 27c1552..06d96bc 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/DocLoader.cpp
@@ -3,6 +3,7 @@
     Copyright (C) 2001 Dirk Mueller (mueller@kde.org)
     Copyright (C) 2002 Waldo Bastian (bastian@kde.org)
     Copyright (C) 2004, 2005, 2006, 2008 Apple Inc. All rights reserved.
+    Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -36,6 +37,7 @@
 #include "CString.h"
 #include "Document.h"
 #include "DOMWindow.h"
+#include "HTMLElement.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "loader.h"
@@ -59,11 +61,17 @@ DocLoader::DocLoader(Document* doc)
 
 DocLoader::~DocLoader()
 {
+    if (m_requestCount)
+        m_cache->loader()->cancelRequests(this);
+
     clearPreloads();
     DocumentResourceMap::iterator end = m_documentResources.end();
     for (DocumentResourceMap::iterator it = m_documentResources.begin(); it != end; ++it)
         it->second->setDocLoader(0);
     m_cache->removeDocLoader(this);
+
+    // Make sure no requests still point to this DocLoader
+    ASSERT(m_requestCount == 0);
 }
 
 Frame* DocLoader::frame() const
@@ -191,7 +199,7 @@ CachedResource* DocLoader::requestResource(CachedResource::Type type, const Stri
 {
     KURL fullURL = m_doc->completeURL(url);
 
-    if (!canRequest(type, fullURL))
+    if (!fullURL.isValid() || !canRequest(type, fullURL))
         return 0;
 
     if (cache()->disabled()) {
@@ -266,11 +274,16 @@ void DocLoader::setAutoLoadImages(bool enable)
 
 CachePolicy DocLoader::cachePolicy() const
 {
-    return frame() ? frame()->loader()->cachePolicy() : CachePolicyVerify;
+    return frame() ? frame()->loader()->subresourceCachePolicy() : CachePolicyVerify;
 }
 
 void DocLoader::removeCachedResource(CachedResource* resource) const
 {
+#ifndef NDEBUG
+    DocumentResourceMap::iterator it = m_documentResources.find(resource->url());
+    if (it != m_documentResources.end())
+        ASSERT(it->second.get() == resource);
+#endif
     m_documentResources.remove(resource->url());
 }
 
@@ -339,7 +352,9 @@ void DocLoader::checkForPendingPreloads()
         return;
     for (unsigned i = 0; i < count; ++i) {
         PendingPreload& preload = m_pendingPreloads[i];
-        requestPreload(preload.m_type, preload.m_url, preload.m_charset);
+        // Don't request preload if the resource already loaded normally (this will result in double load if the page is being reloaded with cached results ignored).
+        if (!cachedResource(m_doc->completeURL(preload.m_url)))
+            requestPreload(preload.m_type, preload.m_url, preload.m_charset);
     }
     m_pendingPreloads.clear();
 }
@@ -377,6 +392,11 @@ void DocLoader::clearPreloads()
     m_preloads.clear();
 }
 
+void DocLoader::clearPendingPreloads()
+{
+    m_pendingPreloads.clear();
+}
+
 #if PRELOAD_DEBUG
 void DocLoader::printPreloadStats()
 {
diff --git a/src/3rdparty/webkit/WebCore/loader/DocLoader.h b/src/3rdparty/webkit/WebCore/loader/DocLoader.h
index 17edcc5..13a57bd 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/DocLoader.h
@@ -2,6 +2,7 @@
     Copyright (C) 1998 Lars Knoll (knoll@mpi-hd.mpg.de)
     Copyright (C) 2001 Dirk Mueller <mueller@kde.org>
     Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.
+    Copyright (C) 2009 Torch Mobile Inc. http://www.torchmobile.com/
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -91,15 +92,12 @@ public:
     
     void setAllowStaleResources(bool allowStaleResources) { m_allowStaleResources = allowStaleResources; }
 
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    void replaceDocument(Document* doc) { m_doc = doc; }
-#endif
-
     void incrementRequestCount();
     void decrementRequestCount();
     int requestCount();
     
     void clearPreloads();
+    void clearPendingPreloads();
     void preload(CachedResource::Type, const String& url, const String& charset, bool referencedFromBody);
     void checkForPendingPreloads();
     void printPreloadStats();
diff --git a/src/3rdparty/webkit/WebCore/loader/DocumentLoader.cpp b/src/3rdparty/webkit/WebCore/loader/DocumentLoader.cpp
index 88c54f6..87cb725 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocumentLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/DocumentLoader.cpp
@@ -95,9 +95,6 @@ static inline String canonicalizedTitle(const String& title, Frame* frame)
                 continue;
             buffer[builderIndex++] = ' ';
             previousCharWasWS = true;
-        } else if (c == '\\') {
-            buffer[builderIndex++] = frame->backslashAsCurrencySymbol();
-            previousCharWasWS = false;
         } else {
             buffer[builderIndex++] = c;
             previousCharWasWS = false;
@@ -115,6 +112,10 @@ static inline String canonicalizedTitle(const String& title, Frame* frame)
         return "";
 
     buffer.shrink(builderIndex + 1);
+    
+    // Replace the backslashes with currency symbols if the encoding requires it.
+    frame->document()->displayBufferModifiedByEncoding(buffer.characters(), buffer.length());
+
     return String::adopt(buffer);
 }
 
@@ -150,6 +151,7 @@ DocumentLoader::DocumentLoader(const ResourceRequest& req, const SubstituteData&
     , m_loadingFromCachedPage(false)
     , m_stopRecordingResponses(false)
     , m_substituteResourceDeliveryTimer(this, &DocumentLoader::substituteResourceDeliveryTimerFired)
+    , m_didCreateGlobalHistoryEntry(false)
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     , m_candidateApplicationCacheGroup(0)
 #endif
@@ -169,9 +171,9 @@ DocumentLoader::~DocumentLoader()
     
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     if (m_applicationCache)
-        m_applicationCache->group()->documentLoaderDestroyed(this);
+        m_applicationCache->group()->disassociateDocumentLoader(this);
     else if (m_candidateApplicationCacheGroup)
-        m_candidateApplicationCacheGroup->documentLoaderDestroyed(this);
+        m_candidateApplicationCacheGroup->disassociateDocumentLoader(this);
 #endif
 }
 
@@ -253,10 +255,14 @@ void DocumentLoader::clearErrors()
 
 void DocumentLoader::mainReceivedError(const ResourceError& error, bool isComplete)
 {
+    ASSERT(!error.isNull());
+
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     ApplicationCacheGroup* group = m_candidateApplicationCacheGroup;
-    if (!group && m_applicationCache && !mainResourceApplicationCache())
+    if (!group && m_applicationCache) {
+        ASSERT(!mainResourceApplicationCache()); // If the main resource were loaded from a cache, it wouldn't fail.
         group = m_applicationCache->group();
+    }
     
     if (group)
         group->failedLoadingMainResource(this);
@@ -273,7 +279,7 @@ void DocumentLoader::mainReceivedError(const ResourceError& error, bool isComple
 // one document at a time, but one document may have many related resources. 
 // stopLoading will stop all loads initiated by the data source, 
 // but not loads initiated by child frames' data sources -- that's the WebFrame's job.
-void DocumentLoader::stopLoading()
+void DocumentLoader::stopLoading(DatabasePolicy databasePolicy)
 {
     // In some rare cases, calling FrameLoader::stopLoading could set m_loading to false.
     // (This can happen when there's a single XMLHttpRequest currently loading and stopLoading causes it
@@ -285,8 +291,8 @@ void DocumentLoader::stopLoading()
         // still  parsing. Failure to do so can cause a world leak.
         Document* doc = m_frame->document();
         
-        if (loading || (doc && doc->parsing()))
-            m_frame->loader()->stopLoading(false);
+        if (loading || doc->parsing())
+            m_frame->loader()->stopLoading(false, databasePolicy);
     }
 
     // Always cancel multipart loaders
@@ -399,6 +405,10 @@ void DocumentLoader::setupForReplaceByMIMEType(const String& newMIMEType)
 
 void DocumentLoader::updateLoading()
 {
+    if (!m_frame) {
+        setLoading(false);
+        return;
+    }
     ASSERT(this == frameLoader()->activeDocumentLoader());
     setLoading(frameLoader()->isLoading());
 }
@@ -461,13 +471,12 @@ bool DocumentLoader::isLoadingInAPISense() const
             return true;
         if (!m_subresourceLoaders.isEmpty())
             return true;
-        if (Document* doc = m_frame->document()) {
-            if (doc->docLoader()->requestCount())
+        Document* doc = m_frame->document();
+        if (doc->docLoader()->requestCount())
+            return true;
+        if (Tokenizer* tok = doc->tokenizer())
+            if (tok->processingData())
                 return true;
-            if (Tokenizer* tok = doc->tokenizer())
-                if (tok->processingData())
-                    return true;
-        }
     }
     return frameLoader()->subframeIsLoading();
 }
@@ -544,15 +553,20 @@ PassRefPtr<ArchiveResource> DocumentLoader::subresource(const KURL& url) const
     if (!isCommitted())
         return 0;
     
-    Document* doc = m_frame->document();
-    if (!doc)
+    CachedResource* resource = m_frame->document()->docLoader()->cachedResource(url);
+    if (!resource || !resource->isLoaded())
         return archiveResourceForURL(url);
-        
-    CachedResource* resource = doc->docLoader()->cachedResource(url);
-    if (!resource || resource->preloadResult() == CachedResource::PreloadReferenced)
-        return archiveResourceForURL(url);
-        
-    return ArchiveResource::create(resource->data(), url, resource->response());
+
+    // FIXME: This has the side effect of making the resource non-purgeable.
+    // It would be better if it didn't have this permanent effect.
+    if (!resource->makePurgeable(false))
+        return 0;
+
+    RefPtr<SharedBuffer> data = resource->data();
+    if (!data)
+        return 0;
+
+    return ArchiveResource::create(data.release(), url, resource->response());
 }
 
 void DocumentLoader::getSubresources(Vector<PassRefPtr<ArchiveResource> >& subresources) const
@@ -561,8 +575,6 @@ void DocumentLoader::getSubresources(Vector<PassRefPtr<ArchiveResource> >& subre
         return;
 
     Document* document = m_frame->document();
-    if (!document)
-        return;
 
     const DocLoader::DocumentResourceMap& allResources = document->docLoader()->allCachedResources();
     DocLoader::DocumentResourceMap::const_iterator end = allResources.end();
@@ -864,14 +876,14 @@ ApplicationCache* DocumentLoader::mainResourceApplicationCache() const
 bool DocumentLoader::shouldLoadResourceFromApplicationCache(const ResourceRequest& request, ApplicationCacheResource*& resource)
 {
     ApplicationCache* cache = applicationCache();
-    if (!cache)
+    if (!cache || !cache->isComplete())
         return false;
 
     // If the resource is not a HTTP/HTTPS GET, then abort
     if (!ApplicationCache::requestIsHTTPOrHTTPSGet(request))
         return false;
 
-    // If the resource's URL is an master entry, the manifest, an explicit entry, a fallback entry, or a dynamic entry
+    // If the resource's URL is an master entry, the manifest, an explicit entry, or a fallback entry
     // in the application cache, then get the resource from the cache (instead of fetching it).
     resource = cache->resourceForURL(request.url());
 
@@ -892,6 +904,8 @@ bool DocumentLoader::getApplicationCacheFallbackResource(const ResourceRequest&
         if (!cache)
             return false;
     }
+    if (!cache->isComplete())
+        return false;
     
     // If the resource is not a HTTP/HTTPS GET, then abort
     if (!ApplicationCache::requestIsHTTPOrHTTPSGet(request))
diff --git a/src/3rdparty/webkit/WebCore/loader/DocumentLoader.h b/src/3rdparty/webkit/WebCore/loader/DocumentLoader.h
index 691a7e2..d4ac427 100644
--- a/src/3rdparty/webkit/WebCore/loader/DocumentLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/DocumentLoader.h
@@ -93,7 +93,7 @@ namespace WebCore {
         
         void replaceRequestURLForAnchorScroll(const KURL&);
         bool isStopping() const { return m_isStopping; }
-        void stopLoading();
+        void stopLoading(DatabasePolicy = DatabasePolicyStop);
         void setCommitted(bool committed) { m_committed = committed; }
         bool isCommitted() const { return m_committed; }
         bool isLoading() const { return m_loading; }
@@ -156,6 +156,21 @@ namespace WebCore {
 
         KURL urlForHistory() const;
         bool urlForHistoryReflectsFailure() const;
+
+        // These accessors accomodate WebCore's somewhat fickle custom of creating history
+        // items for redirects, but only sometimes. For "source" and "destination",
+        // these accessors return the URL that would have been used if a history
+        // item were created. This allows WebKit to link history items reflecting
+        // redirects into a chain from start to finish.
+        String clientRedirectSourceForHistory() const { return m_clientRedirectSourceForHistory; } // null if no client redirect occurred.
+        String clientRedirectDestinationForHistory() const { return urlForHistory(); }
+        void setClientRedirectSourceForHistory(const String& clientedirectSourceForHistory) { m_clientRedirectSourceForHistory = clientedirectSourceForHistory; }
+        
+        String serverRedirectSourceForHistory() const { return urlForHistory() == url() ? String() : urlForHistory(); } // null if no server redirect occurred.
+        String serverRedirectDestinationForHistory() const { return url(); }
+
+        bool didCreateGlobalHistoryEntry() const { return m_didCreateGlobalHistoryEntry; }
+        void setDidCreateGlobalHistoryEntry(bool didCreateGlobalHistoryEntry) { m_didCreateGlobalHistoryEntry = didCreateGlobalHistoryEntry; }
         
         void loadFromCachedPage(PassRefPtr<CachedPage>);
         void setLoadingFromCachedPage(bool loading) { m_loadingFromCachedPage = loading; }
@@ -287,6 +302,9 @@ namespace WebCore {
 
         HashSet<String> m_resourcesClientKnowsAbout;
         Vector<String> m_resourcesLoadedFromMemoryCacheForClientNotification;
+        
+        String m_clientRedirectSourceForHistory;
+        bool m_didCreateGlobalHistoryEntry;
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)  
         // The application cache that the document loader is associated with (if any).
diff --git a/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.cpp b/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.cpp
new file mode 100644
index 0000000..ae6702b
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.cpp
@@ -0,0 +1,202 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DocumentThreadableLoader.h"
+
+#include "AuthenticationChallenge.h"
+#include "Document.h"
+#include "DocumentThreadableLoader.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "ResourceRequest.h"
+#include "SecurityOrigin.h"
+#include "SubresourceLoader.h"
+#include "ThreadableLoaderClient.h"
+
+namespace WebCore {
+
+void DocumentThreadableLoader::loadResourceSynchronously(Document* document, const ResourceRequest& request, ThreadableLoaderClient& client, StoredCredentials storedCredentials)
+{
+    bool sameOriginRequest = document->securityOrigin()->canRequest(request.url());
+
+    Vector<char> data;
+    ResourceError error;
+    ResourceResponse response;
+    unsigned long identifier = std::numeric_limits<unsigned long>::max();
+    if (document->frame())
+        identifier = document->frame()->loader()->loadResourceSynchronously(request, storedCredentials, error, response, data);
+
+    // No exception for file:/// resources, see <rdar://problem/4962298>.
+    // Also, if we have an HTTP response, then it wasn't a network error in fact.
+    if (!error.isNull() && !request.url().isLocalFile() && response.httpStatusCode() <= 0) {
+        client.didFail(error);
+        return;
+    }
+
+    // FIXME: This check along with the one in willSendRequest is specific to xhr and
+    // should be made more generic.
+    if (sameOriginRequest && !document->securityOrigin()->canRequest(response.url())) {
+        client.didFailRedirectCheck();
+        return;
+    }
+
+    client.didReceiveResponse(response);
+
+    const char* bytes = static_cast<const char*>(data.data());
+    int len = static_cast<int>(data.size());
+    client.didReceiveData(bytes, len);
+
+    client.didFinishLoading(identifier);
+}
+
+PassRefPtr<DocumentThreadableLoader> DocumentThreadableLoader::create(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+{
+    ASSERT(document);
+    RefPtr<DocumentThreadableLoader> loader = adoptRef(new DocumentThreadableLoader(document, client, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy));
+    if (!loader->m_loader)
+        loader = 0;
+    return loader.release();
+}
+
+DocumentThreadableLoader::DocumentThreadableLoader(Document* document, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+    : m_client(client)
+    , m_document(document)
+    , m_allowStoredCredentials(storedCredentials == AllowStoredCredentials)
+    , m_sameOriginRequest(document->securityOrigin()->canRequest(request.url()))
+    , m_denyCrossOriginRedirect(crossOriginRedirectPolicy == DenyCrossOriginRedirect)
+{
+    ASSERT(document);
+    ASSERT(client);
+    ASSERT(storedCredentials == AllowStoredCredentials || storedCredentials == DoNotAllowStoredCredentials);
+    ASSERT(crossOriginRedirectPolicy == DenyCrossOriginRedirect || crossOriginRedirectPolicy == AllowCrossOriginRedirect);
+    m_loader = SubresourceLoader::create(document->frame(), this, request, false, callbacksSetting == SendLoadCallbacks, contentSniff == SniffContent);
+}
+
+DocumentThreadableLoader::~DocumentThreadableLoader()
+{
+    if (m_loader)
+        m_loader->clearClient();
+}
+
+void DocumentThreadableLoader::cancel()
+{
+    if (!m_loader)
+        return;
+
+    m_loader->cancel();
+    m_loader->clearClient();
+    m_loader = 0;
+    m_client = 0;
+}
+
+void DocumentThreadableLoader::willSendRequest(SubresourceLoader* loader, ResourceRequest& request, const ResourceResponse&)
+{
+    ASSERT(m_client);
+    ASSERT_UNUSED(loader, loader == m_loader);
+
+    // FIXME: This needs to be fixed to follow the redirect correctly even for cross-domain requests.
+    if (m_denyCrossOriginRedirect && !m_document->securityOrigin()->canRequest(request.url())) {
+        RefPtr<DocumentThreadableLoader> protect(this);
+        m_client->didFailRedirectCheck();
+        request = ResourceRequest();
+    }
+}
+
+void DocumentThreadableLoader::didSendData(SubresourceLoader* loader, unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
+{
+    ASSERT(m_client);
+    ASSERT_UNUSED(loader, loader == m_loader);
+
+    m_client->didSendData(bytesSent, totalBytesToBeSent);
+}
+
+void DocumentThreadableLoader::didReceiveResponse(SubresourceLoader* loader, const ResourceResponse& response)
+{
+    ASSERT(m_client);
+    ASSERT_UNUSED(loader, loader == m_loader);
+
+    m_client->didReceiveResponse(response);
+}
+
+void DocumentThreadableLoader::didReceiveData(SubresourceLoader* loader, const char* data, int lengthReceived)
+{
+    ASSERT(m_client);
+    ASSERT_UNUSED(loader, loader == m_loader);
+
+    m_client->didReceiveData(data, lengthReceived);
+}
+
+void DocumentThreadableLoader::didFinishLoading(SubresourceLoader* loader)
+{
+    ASSERT(loader == m_loader);
+    ASSERT(m_client);
+    m_client->didFinishLoading(loader->identifier());
+}
+
+void DocumentThreadableLoader::didFail(SubresourceLoader* loader, const ResourceError& error)
+{
+    ASSERT(m_client);
+    ASSERT_UNUSED(loader, loader == m_loader);
+
+    m_client->didFail(error);
+}
+
+bool DocumentThreadableLoader::getShouldUseCredentialStorage(SubresourceLoader* loader, bool& shouldUseCredentialStorage)
+{
+    ASSERT_UNUSED(loader, loader == m_loader);
+
+    if (!m_allowStoredCredentials) {
+        shouldUseCredentialStorage = false;
+        return true;
+    }
+
+    return false; // Only FrameLoaderClient can ultimately permit credential use.
+}
+
+void DocumentThreadableLoader::didReceiveAuthenticationChallenge(SubresourceLoader* loader, const AuthenticationChallenge&)
+{
+    ASSERT(loader == m_loader);
+    // Users are not prompted for credentials for cross-origin requests.
+    if (!m_sameOriginRequest) {
+        RefPtr<DocumentThreadableLoader> protect(this);
+        m_client->didFail(loader->blockedError());
+        cancel();
+    }
+}
+
+void DocumentThreadableLoader::receivedCancellation(SubresourceLoader* loader, const AuthenticationChallenge& challenge)
+{
+    ASSERT(m_client);
+    ASSERT_UNUSED(loader, loader == m_loader);
+    m_client->didReceiveAuthenticationCancellation(challenge.failureResponse());
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.h b/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.h
new file mode 100644
index 0000000..465475f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/DocumentThreadableLoader.h
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DocumentThreadableLoader_h
+#define DocumentThreadableLoader_h
+
+#include "SubresourceLoaderClient.h"
+#include "ThreadableLoader.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+    class Document;
+    struct ResourceRequest;
+    class ThreadableLoaderClient;
+
+    class DocumentThreadableLoader : public RefCounted<DocumentThreadableLoader>, public ThreadableLoader, private SubresourceLoaderClient  {
+    public:
+        static void loadResourceSynchronously(Document*, const ResourceRequest&, ThreadableLoaderClient&, StoredCredentials);
+        static PassRefPtr<DocumentThreadableLoader> create(Document*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+        virtual ~DocumentThreadableLoader();
+
+        virtual void cancel();
+
+        using RefCounted<DocumentThreadableLoader>::ref;
+        using RefCounted<DocumentThreadableLoader>::deref;
+
+    protected:
+        virtual void refThreadableLoader() { ref(); }
+        virtual void derefThreadableLoader() { deref(); }
+
+    private:
+        DocumentThreadableLoader(Document*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+        virtual void willSendRequest(SubresourceLoader*, ResourceRequest&, const ResourceResponse& redirectResponse);
+        virtual void didSendData(SubresourceLoader*, unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
+
+        virtual void didReceiveResponse(SubresourceLoader*, const ResourceResponse&);
+        virtual void didReceiveData(SubresourceLoader*, const char*, int lengthReceived);
+        virtual void didFinishLoading(SubresourceLoader*);
+        virtual void didFail(SubresourceLoader*, const ResourceError&);
+
+        virtual bool getShouldUseCredentialStorage(SubresourceLoader*, bool& shouldUseCredentialStorage);
+        virtual void didReceiveAuthenticationChallenge(SubresourceLoader*, const AuthenticationChallenge&);
+        virtual void receivedCancellation(SubresourceLoader*, const AuthenticationChallenge&);
+
+        RefPtr<SubresourceLoader> m_loader;
+        ThreadableLoaderClient* m_client;
+        Document* m_document;
+        bool m_allowStoredCredentials;
+        bool m_sameOriginRequest;
+        bool m_denyCrossOriginRedirect;
+    };
+
+} // namespace WebCore
+
+#endif // DocumentThreadableLoader_h
diff --git a/src/3rdparty/webkit/WebCore/loader/EmptyClients.h b/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
index 5562d13..2abd54f 100644
--- a/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
+++ b/src/3rdparty/webkit/WebCore/loader/EmptyClients.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006 Eric Seidel (eric@webkit.org)
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,12 +29,14 @@
 
 #include "ChromeClient.h"
 #include "ContextMenuClient.h"
-#include "DragClient.h"
+#include "Console.h"
 #include "DocumentLoader.h"
+#include "DragClient.h"
 #include "EditCommand.h"
 #include "EditorClient.h"
-#include "FocusDirection.h"
 #include "FloatRect.h"
+#include "FocusDirection.h"
+#include "FormState.h"
 #include "FrameLoaderClient.h"
 #include "InspectorClient.h"
 #include "ResourceError.h"
@@ -92,7 +95,7 @@ public:
 
     virtual void setResizable(bool) { }
 
-    virtual void addMessageToConsole(const String&, unsigned, const String&) { }
+    virtual void addMessageToConsole(MessageSource, MessageLevel, const String&, unsigned, const String&) { }
 
     virtual bool canRunBeforeUnloadConfirmPanel() { return false; }
     virtual bool runBeforeUnloadConfirmPanel(const String&, Frame*) { return true; }
@@ -118,7 +121,7 @@ public:
     virtual IntPoint screenToWindow(const IntPoint& p) const { return p; }
     virtual IntRect windowToScreen(const IntRect& r) const { return r; }
     virtual PlatformWidget platformWindow() const { return 0; }
-    virtual void contentsSizeChanged(Frame*, const IntSize& s) const { }
+    virtual void contentsSizeChanged(Frame*, const IntSize&) const { }
 
     virtual void mouseDidMoveOverElement(const HitTestResult&, unsigned) { }
 
@@ -126,11 +129,27 @@ public:
 
     virtual void print(Frame*) { }
 
+#if ENABLE(DATABASE)
     virtual void exceededDatabaseQuota(Frame*, const String&) { }
+#endif
 
     virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>) { }
 
     virtual void formStateDidChange(const Node*) { }
+
+    virtual PassOwnPtr<HTMLParserQuirks> createHTMLParserQuirks() { return 0; }
+
+    virtual bool setCursor(PlatformCursorHandle) { return false; }
+
+    virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const {}
+
+    virtual void requestGeolocationPermissionForFrame(Frame*, Geolocation*) {}
+
+#if USE(ACCELERATED_COMPOSITING)
+    virtual void attachRootGraphicsLayer(Frame*, GraphicsLayer*) {};
+    virtual void setNeedsOneShotDrawingSynchronization() {};
+    virtual void scheduleViewUpdate() {};
+#endif
 };
 
 class EmptyFrameLoaderClient : public FrameLoaderClient {
@@ -161,6 +180,7 @@ public:
     virtual void dispatchDidFinishLoading(DocumentLoader*, unsigned long) { }
     virtual void dispatchDidFailLoading(DocumentLoader*, unsigned long, const ResourceError&) { }
     virtual bool dispatchDidLoadResourceFromMemoryCache(DocumentLoader*, const ResourceRequest&, const ResourceResponse&, int) { return false; }
+    virtual void dispatchDidLoadResourceByXMLHttpRequest(unsigned long, const ScriptString&) { }
 
     virtual void dispatchDidHandleOnloadEvents() { }
     virtual void dispatchDidReceiveServerRedirectForProvisionalLoad() { }
@@ -211,14 +231,14 @@ public:
     virtual void committedLoad(DocumentLoader*, const char*, int) { }
     virtual void finishedLoading(DocumentLoader*) { }
 
-    virtual ResourceError cancelledError(const ResourceRequest&) { return ResourceError(); }
-    virtual ResourceError blockedError(const ResourceRequest&) { return ResourceError(); }
-    virtual ResourceError cannotShowURLError(const ResourceRequest&) { return ResourceError(); }
-    virtual ResourceError interruptForPolicyChangeError(const ResourceRequest&) { return ResourceError(); }
+    virtual ResourceError cancelledError(const ResourceRequest&) { ResourceError error("", 0, "", ""); error.setIsCancellation(true); return error; }
+    virtual ResourceError blockedError(const ResourceRequest&) { return ResourceError("", 0, "", ""); }
+    virtual ResourceError cannotShowURLError(const ResourceRequest&) { return ResourceError("", 0, "", ""); }
+    virtual ResourceError interruptForPolicyChangeError(const ResourceRequest&) { return ResourceError("", 0, "", ""); }
 
-    virtual ResourceError cannotShowMIMETypeError(const ResourceResponse&) { return ResourceError(); }
-    virtual ResourceError fileDoesNotExistError(const ResourceResponse&) { return ResourceError(); }
-    virtual ResourceError pluginWillHandleLoadError(const ResourceResponse&) { return ResourceError(); }
+    virtual ResourceError cannotShowMIMETypeError(const ResourceResponse&) { return ResourceError("", 0, "", ""); }
+    virtual ResourceError fileDoesNotExistError(const ResourceResponse&) { return ResourceError("", 0, "", ""); }
+    virtual ResourceError pluginWillHandleLoadError(const ResourceResponse&) { return ResourceError("", 0, "", ""); }
 
     virtual bool shouldFallBack(const ResourceError&) { return false; }
 
@@ -239,31 +259,41 @@ public:
 
     virtual String userAgent(const KURL&) { return ""; }
 
-    virtual void savePlatformDataToCachedPage(CachedPage*) { }
-    virtual void transitionToCommittedFromCachedPage(CachedPage*) { }
+    virtual void savePlatformDataToCachedFrame(CachedFrame*) { }
+    virtual void transitionToCommittedFromCachedFrame(CachedFrame*) { }
     virtual void transitionToCommittedForNewPage() { }    
 
     virtual void updateGlobalHistory() { }
+    virtual void updateGlobalHistoryRedirectLinks() { }
     virtual bool shouldGoToHistoryItem(HistoryItem*) const { return false; }
     virtual void saveViewStateToItem(HistoryItem*) { }
     virtual bool canCachePage() const { return false; }
 
     virtual PassRefPtr<Frame> createFrame(const KURL&, const String&, HTMLFrameOwnerElement*, const String&, bool, int, int) { return 0; }
-    virtual Widget* createPlugin(const IntSize&, Element*, const KURL&, const Vector<String>&, const Vector<String>&, const String&, bool) { return 0; }
-    virtual Widget* createJavaAppletWidget(const IntSize&, Element*, const KURL&, const Vector<String>&, const Vector<String>&) { return 0; }
+    virtual Widget* createPlugin(const IntSize&, HTMLPlugInElement*, const KURL&, const Vector<String>&, const Vector<String>&, const String&, bool) { return 0; }
+    virtual Widget* createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const KURL&, const Vector<String>&, const Vector<String>&) { return 0; }
 
     virtual ObjectContentType objectContentType(const KURL&, const String&) { return ObjectContentType(); }
     virtual String overrideMediaType() const { return String(); }
 
     virtual void redirectDataToPlugin(Widget*) { }
     virtual void windowObjectCleared() { }
+    virtual void documentElementAvailable() { }
     virtual void didPerformFirstNavigation() const { }
 
     virtual void registerForIconNotification(bool) { }
 
+#if USE(V8)
+    virtual void didCreateScriptContext() { }
+    virtual void didDestroyScriptContext() { }
+#endif
+
 #if PLATFORM(MAC)
     virtual NSCachedURLResponse* willCacheResponse(DocumentLoader*, unsigned long, NSCachedURLResponse* response) const { return response; }
 #endif
+#if USE(CFNETWORK)
+    virtual bool shouldCacheResponse(DocumentLoader*, unsigned long, const ResourceResponse&, const unsigned char*, unsigned long long) { return true; }
+#endif
 
 };
 
@@ -335,10 +365,32 @@ public:
     virtual NSArray* pasteboardTypesForSelection(Frame*) { return 0; }
 #endif
 #endif
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    virtual void uppercaseWord() { }
+    virtual void lowercaseWord() { }
+    virtual void capitalizeWord() { }
+    virtual void showSubstitutionsPanel(bool) { }
+    virtual bool substitutionsPanelIsShowing() { return false; }
+    virtual void toggleSmartInsertDelete() { }
+    virtual bool isAutomaticQuoteSubstitutionEnabled() { return false; }
+    virtual void toggleAutomaticQuoteSubstitution() { }
+    virtual bool isAutomaticLinkDetectionEnabled() { return false; }
+    virtual void toggleAutomaticLinkDetection() { }
+    virtual bool isAutomaticDashSubstitutionEnabled() { return false; }
+    virtual void toggleAutomaticDashSubstitution() { }
+    virtual bool isAutomaticTextReplacementEnabled() { return false; }
+    virtual void toggleAutomaticTextReplacement() { }
+    virtual bool isAutomaticSpellingCorrectionEnabled() { return false; }
+    virtual void toggleAutomaticSpellingCorrection() { }
+#endif
     virtual void ignoreWordInSpellDocument(const String&) { }
     virtual void learnWord(const String&) { }
     virtual void checkSpellingOfString(const UChar*, int, int*, int*) { }
+    virtual String getAutoCorrectSuggestionForMisspelledWord(const String&) { return String(); }
     virtual void checkGrammarOfString(const UChar*, int, Vector<GrammarDetail>&, int*, int*) { }
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    virtual void checkTextOfParagraph(const UChar*, int, uint64_t, Vector<TextCheckingResult>&) { };
+#endif
     virtual void updateSpellingUIWithGrammarString(const String&, const GrammarDetail&) { }
     virtual void updateSpellingUIWithMisspelledWord(const String&) { }
     virtual void showSpellingUI(bool) { }
@@ -361,6 +413,7 @@ public:
     virtual void copyImageToClipboard(const HitTestResult&) { }
     virtual void searchWithGoogle(const Frame*) { }
     virtual void lookUpInDictionary(Frame*) { }
+    virtual bool isSpeaking() { return false; }
     virtual void speak(const String&) { }
     virtual void stopSpeaking() { }
 
@@ -391,6 +444,8 @@ public:
 
     virtual String localizedStringsURL() { return String(); }
 
+    virtual String hiddenPanels() { return String(); }
+
     virtual void showWindow() { }
     virtual void closeWindow() { }
 
@@ -411,3 +466,4 @@ public:
 }
 
 #endif // EmptyClients_h
+
diff --git a/src/3rdparty/webkit/WebCore/loader/FTPDirectoryDocument.cpp b/src/3rdparty/webkit/WebCore/loader/FTPDirectoryDocument.cpp
index 08ef896..ace4cfe 100644
--- a/src/3rdparty/webkit/WebCore/loader/FTPDirectoryDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/FTPDirectoryDocument.cpp
@@ -57,7 +57,7 @@ class FTPDirectoryTokenizer : public HTMLTokenizer {
 public:
     FTPDirectoryTokenizer(HTMLDocument*);
 
-    virtual bool write(const SegmentedString&, bool appendData);
+    virtual void write(const SegmentedString&, bool appendData);
     virtual void finish();
     
     virtual bool isWaitingForScripts() const { return false; }
@@ -117,7 +117,7 @@ void FTPDirectoryTokenizer::appendEntry(const String& filename, const String& si
     RefPtr<Element> rowElement = m_tableElement->insertRow(-1, ec);
     rowElement->setAttribute("class", "ftpDirectoryEntryRow", ec);
    
-    RefPtr<Element> element = m_doc->createElementNS(xhtmlNamespaceURI, "td", ec);
+    RefPtr<Element> element = m_doc->createElement(tdTag, false);
     element->appendChild(new Text(m_doc, String(&noBreakSpace, 1)), ec);
     if (isDirectory)
         element->setAttribute("class", "ftpDirectoryIcon ftpDirectoryTypeDirectory", ec);
@@ -129,12 +129,12 @@ void FTPDirectoryTokenizer::appendEntry(const String& filename, const String& si
     element->setAttribute("class", "ftpDirectoryFileName", ec);
     rowElement->appendChild(element, ec);
     
-    element = m_doc->createElementNS(xhtmlNamespaceURI, "td", ec);
+    element = m_doc->createElement(tdTag, false);
     element->appendChild(new Text(m_doc, date), ec);
     element->setAttribute("class", "ftpDirectoryFileDate", ec);
     rowElement->appendChild(element, ec);
     
-    element = m_doc->createElementNS(xhtmlNamespaceURI, "td", ec);
+    element = m_doc->createElement(tdTag, false);
     element->appendChild(new Text(m_doc, size), ec);
     element->setAttribute("class", "ftpDirectoryFileSize", ec);
     rowElement->appendChild(element, ec);
@@ -150,11 +150,11 @@ PassRefPtr<Element> FTPDirectoryTokenizer::createTDForFilename(const String& fil
     else
         fullURL.append("/" + filename);
 
-    RefPtr<Element> anchorElement = m_doc->createElementNS(xhtmlNamespaceURI, "a", ec);
+    RefPtr<Element> anchorElement = m_doc->createElement(aTag, false);
     anchorElement->setAttribute("href", fullURL, ec);
     anchorElement->appendChild(new Text(m_doc, filename), ec);
     
-    RefPtr<Element> tdElement = m_doc->createElementNS(xhtmlNamespaceURI, "td", ec);
+    RefPtr<Element> tdElement = m_doc->createElement(tdTag, false);
     tdElement->appendChild(anchorElement, ec);
     
     return tdElement.release();
@@ -235,7 +235,11 @@ static struct tm *localTimeQt(const time_t *const timep, struct tm *result)
 
 #define localtime_r(x, y) localTimeQt(x, y)
 #elif PLATFORM(WIN_OS) && !defined(localtime_r)
+#if defined(_MSC_VER) && (_MSC_VER >= 1400) 
 #define localtime_r(x, y) localtime_s((y), (x))
+#else /* !_MSC_VER */ 
+#define localtime_r(x,y) (localtime(x)?(*(y)=*localtime(x),(y)):0)
+#endif
 #endif
 
 static String processFileDateString(const FTPTime& fileTime)
@@ -276,7 +280,7 @@ static String processFileDateString(const FTPTime& fileTime)
                 return "Yesterday" + timeOfDay;
         }
         
-        if (now.tm_mday == 1 && (now.tm_mon == fileTime.tm_mon + 1 || now.tm_mon == 0 && fileTime.tm_mon == 11) &&
+        if (now.tm_mday == 1 && (now.tm_mon == fileTime.tm_mon + 1 || (now.tm_mon == 0 && fileTime.tm_mon == 11)) &&
             wasLastDayOfMonth(fileTime.tm_year, fileTime.tm_mon, fileTime.tm_mday))
                 return "Yesterday" + timeOfDay;
     }
@@ -303,8 +307,9 @@ static String processFileDateString(const FTPTime& fileTime)
 void FTPDirectoryTokenizer::parseAndAppendOneLine(const String& inputLine)
 {
     ListResult result;
+    CString latin1Input = inputLine.latin1();
 
-    FTPEntryType typeResult = parseOneFTPLine(inputLine.latin1().data(), m_listState, result);
+    FTPEntryType typeResult = parseOneFTPLine(latin1Input.data(), m_listState, result);
     
     // FTPMiscEntry is a comment or usage statistic which we don't care about, and junk is invalid data - bail in these 2 cases
     if (typeResult == FTPMiscEntry || typeResult == FTPJunkEntry)
@@ -364,9 +369,9 @@ bool FTPDirectoryTokenizer::loadDocumentTemplate()
         return true;
 
     // Otherwise create one manually
-    ExceptionCode ec;        
-    tableElement = m_doc->createElementNS(xhtmlNamespaceURI, "table", ec);
+    tableElement = m_doc->createElement(tableTag, false);
     m_tableElement = static_cast<HTMLTableElement*>(tableElement.get());
+    ExceptionCode ec;        
     m_tableElement->setAttribute("id", "ftpDirectoryTable", ec);
 
     // If we didn't find the table element, lets try to append our own to the body
@@ -386,20 +391,20 @@ void FTPDirectoryTokenizer::createBasicDocument()
 
     // FIXME: Make this "basic document" more acceptable
 
-    ExceptionCode ec;
     
-    RefPtr<Element> bodyElement = m_doc->createElementNS(xhtmlNamespaceURI, "body", ec);
+    RefPtr<Element> bodyElement = m_doc->createElement(bodyTag, false);
                             
+    ExceptionCode ec;
     m_doc->appendChild(bodyElement, ec);
     
-    RefPtr<Element> tableElement = m_doc->createElementNS(xhtmlNamespaceURI, "table", ec);
+    RefPtr<Element> tableElement = m_doc->createElement(tableTag, false);
     m_tableElement = static_cast<HTMLTableElement*>(tableElement.get());
     m_tableElement->setAttribute("id", "ftpDirectoryTable", ec);
 
     bodyElement->appendChild(m_tableElement, ec);
 }
 
-bool FTPDirectoryTokenizer::write(const SegmentedString& s, bool /*appendData*/)
+void FTPDirectoryTokenizer::write(const SegmentedString& s, bool /*appendData*/)
 {    
     // Make sure we have the table element to append to by loading the template set in the pref, or
     // creating a very basic document with the appropriate table
@@ -439,7 +444,7 @@ bool FTPDirectoryTokenizer::write(const SegmentedString& s, bool /*appendData*/)
     
     if (!foundNewLine) {
         m_dest = m_buffer;
-        return false;
+        return;
     }
 
     UChar* start = m_buffer;
@@ -460,8 +465,6 @@ bool FTPDirectoryTokenizer::write(const SegmentedString& s, bool /*appendData*/)
     // Copy the partial line we have left to the carryover buffer
     if (cursor - start > 1)
         m_carryOver.append(String(start, cursor - start - 1));
-    
-    return false;
 }
 
 void FTPDirectoryTokenizer::finish()
diff --git a/src/3rdparty/webkit/WebCore/loader/FTPDirectoryParser.cpp b/src/3rdparty/webkit/WebCore/loader/FTPDirectoryParser.cpp
index 8c76e97..6573fb6 100644
--- a/src/3rdparty/webkit/WebCore/loader/FTPDirectoryParser.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/FTPDirectoryParser.cpp
@@ -50,7 +50,11 @@ static struct tm *gmtimeQt(const time_t *const timep, struct tm *result)
 
 #define gmtime_r(x, y) gmtimeQt(x, y)
 #elif PLATFORM(WIN_OS) && !defined(gmtime_r)
+#if defined(_MSC_VER) && (_MSC_VER >= 1400) 
 #define gmtime_r(x, y) gmtime_s((y), (x))
+#else /* !_MSC_VER */ 
+#define gmtime_r(x,y) (gmtime(x)?(*(y)=*gmtime(x),(y)):0)
+#endif
 #endif
 
 FTPEntryType parseOneFTPLine(const char* line, ListState& state, ListResult& result)
diff --git a/src/3rdparty/webkit/WebCore/loader/FormState.cpp b/src/3rdparty/webkit/WebCore/loader/FormState.cpp
index c55b8ac..bd37086 100644
--- a/src/3rdparty/webkit/WebCore/loader/FormState.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/FormState.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,16 +34,16 @@
 
 namespace WebCore {
 
-PassRefPtr<FormState> FormState::create(PassRefPtr<HTMLFormElement> form, const HashMap<String, String>& values, PassRefPtr<Frame> sourceFrame)
+inline FormState::FormState(PassRefPtr<HTMLFormElement> form, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame> sourceFrame)
+    : m_form(form)
+    , m_sourceFrame(sourceFrame)
 {
-    return adoptRef(new FormState(form, values, sourceFrame));
+    m_textFieldValues.swap(textFieldValuesToAdopt);
 }
 
-FormState::FormState(PassRefPtr<HTMLFormElement> form, const HashMap<String, String>& values, PassRefPtr<Frame> sourceFrame)
-    : m_form(form)
-    , m_values(values)
-    , m_sourceFrame(sourceFrame)
+PassRefPtr<FormState> FormState::create(PassRefPtr<HTMLFormElement> form, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame> sourceFrame)
 {
+    return adoptRef(new FormState(form, textFieldValuesToAdopt, sourceFrame));
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/FormState.h b/src/3rdparty/webkit/WebCore/loader/FormState.h
index 5370e8a..03317b1 100644
--- a/src/3rdparty/webkit/WebCore/loader/FormState.h
+++ b/src/3rdparty/webkit/WebCore/loader/FormState.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,28 +29,28 @@
 #ifndef FormState_h
 #define FormState_h
 
-#include <wtf/RefCounted.h>
-#include "StringHash.h"
-#include <wtf/HashMap.h>
+#include "PlatformString.h"
 
 namespace WebCore {
 
     class Frame;
     class HTMLFormElement;
 
+    typedef Vector<std::pair<String, String> > StringPairVector;
+
     class FormState : public RefCounted<FormState> {
     public:
-        static PassRefPtr<FormState> create(PassRefPtr<HTMLFormElement> form, const HashMap<String, String>& values, PassRefPtr<Frame> sourceFrame);
+        static PassRefPtr<FormState> create(PassRefPtr<HTMLFormElement>, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame>);
 
         HTMLFormElement* form() const { return m_form.get(); }
-        const HashMap<String, String>& values() const { return m_values; }
+        const StringPairVector& textFieldValues() const { return m_textFieldValues; }
         Frame* sourceFrame() const { return m_sourceFrame.get(); }
 
     private:
-        FormState(PassRefPtr<HTMLFormElement> form, const HashMap<String, String>& values, PassRefPtr<Frame> sourceFrame);
+        FormState(PassRefPtr<HTMLFormElement>, StringPairVector& textFieldValuesToAdopt, PassRefPtr<Frame>);
 
         RefPtr<HTMLFormElement> m_form;
-        HashMap<String, String> m_values;
+        StringPairVector m_textFieldValues;
         RefPtr<Frame> m_sourceFrame;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp b/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
index e36cb56..9a09e49 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoader.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
- * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
+ * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -52,10 +52,10 @@
 #include "Frame.h"
 #include "FrameLoadRequest.h"
 #include "FrameLoaderClient.h"
-#include "FramePrivate.h"
 #include "FrameTree.h"
 #include "FrameView.h"
 #include "HTMLAnchorElement.h"
+#include "HTMLAppletElement.h"
 #include "HTMLFormElement.h"
 #include "HTMLFrameElement.h"
 #include "HTMLNames.h"
@@ -81,15 +81,17 @@
 #include "ResourceRequest.h"
 #include "ScriptController.h"
 #include "ScriptSourceCode.h"
+#include "ScriptString.h"
 #include "ScriptValue.h"
 #include "SecurityOrigin.h"
 #include "SegmentedString.h"
 #include "Settings.h"
-#include "SystemTime.h"
 #include "TextResourceDecoder.h"
 #include "WindowFeatures.h"
 #include "XMLHttpRequest.h"
 #include "XMLTokenizer.h"
+#include "XSSAuditor.h"
+#include <wtf/CurrentTime.h>
 #include <wtf/StdLibExtras.h>
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
@@ -114,68 +116,50 @@ using namespace SVGNames;
 #endif
 using namespace HTMLNames;
 
-#if USE(LOW_BANDWIDTH_DISPLAY)
-const unsigned int cMaxPendingSourceLengthInLowBandwidthDisplay = 128 * 1024;
-#endif
-
-typedef HashSet<String, CaseFoldingHash> LocalSchemesMap;
-
-struct FormSubmission {
-    const char* action;
-    String url;
-    RefPtr<FormData> data;
-    String target;
-    String contentType;
-    String boundary;
-    RefPtr<Event> event;
-
-    FormSubmission(const char* a, const String& u, PassRefPtr<FormData> d, const String& t,
-            const String& ct, const String& b, PassRefPtr<Event> e)
-        : action(a)
-        , url(u)
-        , data(d)
-        , target(t)
-        , contentType(ct)
-        , boundary(b)
-        , event(e)
-    {
-    }
-};
-
 struct ScheduledRedirection {
-    enum Type { redirection, locationChange, historyNavigation, locationChangeDuringLoad };
-    Type type;
-    double delay;
-    String url;
-    String referrer;
-    int historySteps;
-    bool lockHistory;
-    bool wasUserGesture;
-    bool wasRefresh;
-
-    ScheduledRedirection(double redirectDelay, const String& redirectURL, bool redirectLockHistory, bool userGesture, bool refresh)
+    enum Type { redirection, locationChange, historyNavigation, formSubmission };
+
+    const Type type;
+    const double delay;
+    const String url;
+    const String referrer;
+    const FrameLoadRequest frameRequest;
+    const RefPtr<Event> event;
+    const RefPtr<FormState> formState;
+    const int historySteps;
+    const bool lockHistory;
+    const bool lockBackForwardList;
+    const bool wasUserGesture;
+    const bool wasRefresh;
+    const bool wasDuringLoad;
+
+    ScheduledRedirection(double delay, const String& url, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool refresh)
         : type(redirection)
-        , delay(redirectDelay)
-        , url(redirectURL)
+        , delay(delay)
+        , url(url)
         , historySteps(0)
-        , lockHistory(redirectLockHistory)
-        , wasUserGesture(userGesture)
+        , lockHistory(lockHistory)
+        , lockBackForwardList(lockBackForwardList)
+        , wasUserGesture(wasUserGesture)
         , wasRefresh(refresh)
+        , wasDuringLoad(false)
     {
+        ASSERT(!url.isEmpty());
     }
 
-    ScheduledRedirection(Type locationChangeType,
-            const String& locationChangeURL, const String& locationChangeReferrer,
-            bool locationChangeLockHistory, bool locationChangeWasUserGesture, bool refresh)
-        : type(locationChangeType)
+    ScheduledRedirection(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool refresh, bool duringLoad)
+        : type(locationChange)
         , delay(0)
-        , url(locationChangeURL)
-        , referrer(locationChangeReferrer)
+        , url(url)
+        , referrer(referrer)
         , historySteps(0)
-        , lockHistory(locationChangeLockHistory)
-        , wasUserGesture(locationChangeWasUserGesture)
+        , lockHistory(lockHistory)
+        , lockBackForwardList(lockBackForwardList)
+        , wasUserGesture(wasUserGesture)
         , wasRefresh(refresh)
+        , wasDuringLoad(duringLoad)
     {
+        ASSERT(!url.isEmpty());
     }
 
     explicit ScheduledRedirection(int historyNavigationSteps)
@@ -183,12 +167,38 @@ struct ScheduledRedirection {
         , delay(0)
         , historySteps(historyNavigationSteps)
         , lockHistory(false)
+        , lockBackForwardList(false)
         , wasUserGesture(false)
         , wasRefresh(false)
+        , wasDuringLoad(false)
     {
     }
-};
 
+    ScheduledRedirection(const FrameLoadRequest& frameRequest,
+            bool lockHistory, bool lockBackForwardList, PassRefPtr<Event> event, PassRefPtr<FormState> formState,
+            bool duringLoad)
+        : type(formSubmission)
+        , delay(0)
+        , frameRequest(frameRequest)
+        , event(event)
+        , formState(formState)
+        , historySteps(0)
+        , lockHistory(lockHistory)
+        , lockBackForwardList(lockBackForwardList)
+        , wasUserGesture(false)
+        , wasRefresh(false)
+        , wasDuringLoad(duringLoad)
+    {
+        ASSERT(!frameRequest.isEmpty());
+        ASSERT(this->formState);
+    }
+};
+ 
+#if ENABLE(XHTMLMP)
+static const char defaultAcceptHeader[] = "application/xml,application/vnd.wap.xhtml+xml,application/xhtml+xml;profile='http://www.wapforum.org/xhtml',text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
+#else
+static const char defaultAcceptHeader[] = "application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5";
+#endif
 static double storedTimeOfLastCompletedLoad;
 static FrameLoader::LocalLoadPolicy localLoadPolicy = FrameLoader::AllowLocalLoadsForLocalOnly;
 
@@ -197,10 +207,9 @@ bool isBackForwardLoadType(FrameLoadType type)
     switch (type) {
         case FrameLoadTypeStandard:
         case FrameLoadTypeReload:
-        case FrameLoadTypeReloadAllowingStaleData:
         case FrameLoadTypeReloadFromOrigin:
         case FrameLoadTypeSame:
-        case FrameLoadTypeRedirectWithLockedHistory:
+        case FrameLoadTypeRedirectWithLockedBackForwardList:
         case FrameLoadTypeReplace:
             return false;
         case FrameLoadTypeBack:
@@ -220,6 +229,11 @@ static int numRequests(Document* document)
     return document->docLoader()->requestCount();
 }
 
+static inline bool canReferToParentFrameEncoding(const Frame* frame, const Frame* parentFrame) 
+{
+    return parentFrame && parentFrame->document()->securityOrigin()->canAccess(frame->document()->securityOrigin());
+}
+
 FrameLoader::FrameLoader(Frame* frame, FrameLoaderClient* client)
     : m_frame(frame)
     , m_client(client)
@@ -233,11 +247,11 @@ FrameLoader::FrameLoader(Frame* frame, FrameLoaderClient* client)
     , m_quickRedirectComing(false)
     , m_sentRedirectNotification(false)
     , m_inStopAllLoaders(false)
-    , m_navigationDuringLoad(false)
     , m_isExecutingJavaScriptFormAction(false)
     , m_isRunningScript(false)
     , m_didCallImplicitClose(false)
     , m_wasUnloadEventEmitted(false)
+    , m_unloadEventBeingDispatched(false)
     , m_isComplete(false)
     , m_isLoadingMainResource(false)
     , m_cancellingWithLoadInProgress(false)
@@ -257,11 +271,6 @@ FrameLoader::FrameLoader(Frame* frame, FrameLoaderClient* client)
 #ifndef NDEBUG
     , m_didDispatchDidCommitLoad(false)
 #endif
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    , m_useLowBandwidthDisplay(true)
-    , m_finishedParsingDuringLowBandwidthDisplay(false)
-    , m_needToSwitchOutLowBandwidthDisplay(false)
-#endif 
 #if ENABLE(WML)
     , m_forceReloadWmlDeck(false)
 #endif
@@ -284,7 +293,7 @@ void FrameLoader::init()
     // this somewhat odd set of steps is needed to give the frame an initial empty document
     m_isDisplayingInitialEmptyDocument = false;
     m_creatingInitialEmptyDocument = true;
-    setPolicyDocumentLoader(m_client->createDocumentLoader(ResourceRequest(String("")), SubstituteData()).get());
+    setPolicyDocumentLoader(m_client->createDocumentLoader(ResourceRequest(KURL("")), SubstituteData()).get());
     setProvisionalDocumentLoader(m_policyDocumentLoader.get());
     setState(FrameStateProvisional);
     m_provisionalDocumentLoader->setResponse(ResourceResponse(KURL(), "text/html", 0, String(), String()));
@@ -314,7 +323,7 @@ Frame* FrameLoader::createWindow(FrameLoader* frameLoaderForFrameLookup, const F
         Frame* frame = frameLoaderForFrameLookup->frame()->tree()->find(request.frameName());
         if (frame && shouldAllowNavigation(frame)) {
             if (!request.resourceRequest().url().isEmpty())
-                frame->loader()->loadFrameRequestWithFormAndValues(request, false, 0, 0, HashMap<String, String>());
+                frame->loader()->loadFrameRequest(request, false, false, 0, 0);
             if (Page* page = frame->page())
                 page->chrome()->focus();
             created = false;
@@ -372,13 +381,7 @@ bool FrameLoader::canHandleRequest(const ResourceRequest& request)
     return m_client->canHandleRequest(request);
 }
 
-void FrameLoader::changeLocation(const String& url, const String& referrer, bool lockHistory, bool userGesture, bool refresh)
-{
-    changeLocation(completeURL(url), referrer, lockHistory, userGesture, refresh);
-}
-
-
-void FrameLoader::changeLocation(const KURL& url, const String& referrer, bool lockHistory, bool userGesture, bool refresh)
+void FrameLoader::changeLocation(const KURL& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool userGesture, bool refresh)
 {
     RefPtr<Frame> protect(m_frame);
 
@@ -387,55 +390,41 @@ void FrameLoader::changeLocation(const KURL& url, const String& referrer, bool l
     if (executeIfJavaScriptURL(request.url(), userGesture))
         return;
 
-    urlSelected(request, "_self", 0, lockHistory, userGesture);
+    urlSelected(request, "_self", 0, lockHistory, lockBackForwardList, userGesture);
 }
 
-void FrameLoader::urlSelected(const FrameLoadRequest& request, Event* event, bool lockHistory)
-{
-    FrameLoadRequest copy = request;
-    if (copy.resourceRequest().httpReferrer().isEmpty())
-        copy.resourceRequest().setHTTPReferrer(m_outgoingReferrer);
-    addHTTPOriginIfNeeded(copy.resourceRequest(), outgoingOrigin());
-
-    loadFrameRequestWithFormAndValues(copy, lockHistory, event, 0, HashMap<String, String>());
-}
-    
-void FrameLoader::urlSelected(const ResourceRequest& request, const String& _target, Event* triggeringEvent, bool lockHistory, bool userGesture)
+void FrameLoader::urlSelected(const ResourceRequest& request, const String& passedTarget, PassRefPtr<Event> triggeringEvent, bool lockHistory, bool lockBackForwardList, bool userGesture)
 {
     if (executeIfJavaScriptURL(request.url(), userGesture, false))
         return;
 
-    String target = _target;
-    if (target.isEmpty() && m_frame->document())
+    String target = passedTarget;
+    if (target.isEmpty())
         target = m_frame->document()->baseTarget();
 
     FrameLoadRequest frameRequest(request, target);
 
-    urlSelected(frameRequest, triggeringEvent, lockHistory);
+    if (frameRequest.resourceRequest().httpReferrer().isEmpty())
+        frameRequest.resourceRequest().setHTTPReferrer(m_outgoingReferrer);
+    addHTTPOriginIfNeeded(frameRequest.resourceRequest(), outgoingOrigin());
+
+    loadFrameRequest(frameRequest, lockHistory, lockBackForwardList, triggeringEvent, 0);
 }
 
 bool FrameLoader::requestFrame(HTMLFrameOwnerElement* ownerElement, const String& urlString, const AtomicString& frameName)
 {
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    // don't create sub-frame during low bandwidth display
-    if (frame()->document()->inLowBandwidthDisplay()) {
-        m_needToSwitchOutLowBandwidthDisplay = true;
-        return false;
-    }
-#endif
-
     // Support for <frame src="javascript:string">
     KURL scriptURL;
     KURL url;
-    if (protocolIs(urlString, "javascript")) {
-        scriptURL = KURL(urlString);
+    if (protocolIsJavaScript(urlString)) {
+        scriptURL = completeURL(urlString); // completeURL() encodes the URL.
         url = blankURL();
     } else
         url = completeURL(urlString);
 
     Frame* frame = ownerElement->contentFrame();
     if (frame)
-        frame->loader()->scheduleLocationChange(url.string(), m_outgoingReferrer, true, userGestureHint());
+        frame->loader()->scheduleLocationChange(url.string(), m_outgoingReferrer, true, true, userGestureHint());
     else
         frame = loadSubframe(ownerElement, url, frameName, m_outgoingReferrer);
     
@@ -466,8 +455,7 @@ Frame* FrameLoader::loadSubframe(HTMLFrameOwnerElement* ownerElement, const KURL
     }
 
     bool hideReferrer = shouldHideReferrer(url, referrer);
-    RefPtr<Frame> frame = m_client->createFrame(url, name, ownerElement, hideReferrer ? String() : referrer,
-                                         allowsScrolling, marginWidth, marginHeight);
+    RefPtr<Frame> frame = m_client->createFrame(url, name, ownerElement, hideReferrer ? String() : referrer, allowsScrolling, marginWidth, marginHeight);
 
     if (!frame)  {
         checkCallImplicitClose();
@@ -497,71 +485,69 @@ Frame* FrameLoader::loadSubframe(HTMLFrameOwnerElement* ownerElement, const KURL
     return frame.get();
 }
 
-void FrameLoader::submitFormAgain()
-{
-    if (m_isRunningScript)
-        return;
-    OwnPtr<FormSubmission> form(m_deferredFormSubmission.release());
-    if (form)
-        submitForm(form->action, form->url, form->data, form->target,
-            form->contentType, form->boundary, form->event.get());
-}
-
 void FrameLoader::submitForm(const char* action, const String& url, PassRefPtr<FormData> formData,
-    const String& target, const String& contentType, const String& boundary, Event* event)
+    const String& target, const String& contentType, const String& boundary,
+    bool lockHistory, bool lockBackForwardList, PassRefPtr<Event> event, PassRefPtr<FormState> formState)
 {
+    ASSERT(action);
+    ASSERT(strcmp(action, "GET") == 0 || strcmp(action, "POST") == 0);
     ASSERT(formData);
+    ASSERT(formState);
+    ASSERT(formState->sourceFrame() == m_frame);
     
     if (!m_frame->page())
         return;
     
     KURL u = completeURL(url.isNull() ? "" : url);
-    // FIXME: Do we really need to special-case an empty URL?
-    // Would it be better to just go on with the form submisson and let the I/O fail?
     if (u.isEmpty())
         return;
 
-    if (u.protocolIs("javascript")) {
+    if (protocolIsJavaScript(u)) {
         m_isExecutingJavaScriptFormAction = true;
         executeIfJavaScriptURL(u, false, false);
         m_isExecutingJavaScriptFormAction = false;
         return;
     }
 
-    if (m_isRunningScript) {
-        if (m_deferredFormSubmission)
-            return;
-        m_deferredFormSubmission.set(new FormSubmission(action, url, formData, target,
-            contentType, boundary, event));
+    FrameLoadRequest frameRequest;
+
+    String targetOrBaseTarget = target.isEmpty() ? m_frame->document()->baseTarget() : target;
+    Frame* targetFrame = findFrameForNavigation(targetOrBaseTarget);
+    if (!targetFrame) {
+        targetFrame = m_frame;
+        frameRequest.setFrameName(targetOrBaseTarget);
+    }
+    if (!targetFrame->page())
         return;
+
+    // FIXME: We'd like to remove this altogether and fix the multiple form submission issue another way.
+
+    // We do not want to submit more than one form from the same page, nor do we want to submit a single
+    // form more than once. This flag prevents these from happening; not sure how other browsers prevent this.
+    // The flag is reset in each time we start handle a new mouse or key down event, and
+    // also in setView since this part may get reused for a page from the back/forward cache.
+    // The form multi-submit logic here is only needed when we are submitting a form that affects this frame.
+
+    // FIXME: Frame targeting is only one of the ways the submission could end up doing something other
+    // than replacing this frame's content, so this check is flawed. On the other hand, the check is hardly
+    // needed any more now that we reset m_submittedFormURL on each mouse or key down event.
+
+    if (m_frame->tree()->isDescendantOf(targetFrame)) {
+        if (m_submittedFormURL == u)
+            return;
+        m_submittedFormURL = u;
     }
 
     formData->generateFiles(m_frame->page()->chrome()->client());
     
-    FrameLoadRequest frameRequest;
-
     if (!m_outgoingReferrer.isEmpty())
         frameRequest.resourceRequest().setHTTPReferrer(m_outgoingReferrer);
 
-    frameRequest.setFrameName(target.isEmpty() ? m_frame->document()->baseTarget() : target);
-
-    // Handle mailto: forms
-    bool isMailtoForm = equalIgnoringCase(u.protocol(), "mailto");
-    if (isMailtoForm && strcmp(action, "GET") != 0) {
-        // Append body= for POST mailto, replace the whole query string for GET one.
-        String body = formData->flattenToString();
-        String query = u.query();
-        if (!query.isEmpty())
-            query.append('&');
-        u.setQuery(query + body);
-    }
-
-    if (strcmp(action, "GET") == 0) {
+    if (strcmp(action, "GET") == 0)
         u.setQuery(formData->flattenToString());
-    } else {
-        if (!isMailtoForm)
-            frameRequest.resourceRequest().setHTTPBody(formData.get());
+    else {
         frameRequest.resourceRequest().setHTTPMethod("POST");
+        frameRequest.resourceRequest().setHTTPBody(formData);
 
         // construct some user headers if necessary
         if (contentType.isNull() || contentType == "application/x-www-form-urlencoded")
@@ -573,10 +559,23 @@ void FrameLoader::submitForm(const char* action, const String& url, PassRefPtr<F
     frameRequest.resourceRequest().setURL(u);
     addHTTPOriginIfNeeded(frameRequest.resourceRequest(), outgoingOrigin());
 
-    submitForm(frameRequest, event);
+    // Navigation of a subframe during loading of the main frame does not create a new back/forward item.
+    // Strangely, we only implement this rule for form submission; time will tell if we need it for other types of navigation.
+    // The definition of "during load" is any time before the load event has been handled.
+    // See https://bugs.webkit.org/show_bug.cgi?id=14957 for the original motivation for this.
+    if (Page* targetPage = targetFrame->page()) {
+        Frame* mainFrame = targetPage->mainFrame();
+        if (mainFrame != targetFrame) {
+            Document* document = mainFrame->document();
+            if (!mainFrame->loader()->isComplete() || document && document->processingLoadEvent())
+                lockBackForwardList = true;
+        }
+    }
+
+    targetFrame->loader()->scheduleFormSubmission(frameRequest, lockHistory, lockBackForwardList, event, formState);
 }
 
-void FrameLoader::stopLoading(bool sendUnload)
+void FrameLoader::stopLoading(bool sendUnload, DatabasePolicy databasePolicy)
 {
     if (m_frame->document() && m_frame->document()->tokenizer())
         m_frame->document()->tokenizer()->stopParsing();
@@ -587,18 +586,19 @@ void FrameLoader::stopLoading(bool sendUnload)
                 Node* currentFocusedNode = m_frame->document()->focusedNode();
                 if (currentFocusedNode)
                     currentFocusedNode->aboutToUnload();
-                m_frame->document()->dispatchWindowEvent(eventNames().unloadEvent, false, false);
+                m_unloadEventBeingDispatched = true;
+                if (m_frame->domWindow())
+                    m_frame->domWindow()->dispatchUnloadEvent();
+                m_unloadEventBeingDispatched = false;
                 if (m_frame->document())
-                    m_frame->document()->updateRendering();
+                    m_frame->document()->updateStyleIfNeeded();
                 m_wasUnloadEventEmitted = true;
-                if (m_frame->eventHandler()->pendingFrameUnloadEventCount())
-                    m_frame->eventHandler()->clearPendingFrameUnloadEventCount();
-                if (m_frame->eventHandler()->pendingFrameBeforeUnloadEventCount())
-                    m_frame->eventHandler()->clearPendingFrameBeforeUnloadEventCount();
             }
         }
+
+        // Dispatching the unload event could have made m_frame->document() null.
         if (m_frame->document() && !m_frame->document()->inPageCache())
-            m_frame->document()->removeAllEventListenersFromAllNodes();
+            m_frame->document()->removeAllEventListeners();
     }
 
     m_isComplete = true; // to avoid calling completed() in finishedParsing() (David)
@@ -617,7 +617,8 @@ void FrameLoader::stopLoading(bool sendUnload)
             cache()->loader()->cancelRequests(docLoader);
 
 #if ENABLE(DATABASE)
-        doc->stopDatabases();
+        if (databasePolicy == DatabasePolicyStop)
+            doc->stopDatabases();
 #endif
     }
 
@@ -626,14 +627,6 @@ void FrameLoader::stopLoading(bool sendUnload)
         child->loader()->stopLoading(sendUnload);
 
     cancelRedirection();
-
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    if (m_frame->document() && m_frame->document()->inLowBandwidthDisplay()) {
-        // Since loading is forced to stop, reset the state without really switching.
-        m_needToSwitchOutLowBandwidthDisplay = false;
-        switchOutLowBandwidthDisplayIfReady();
-    }
-#endif  
 }
 
 void FrameLoader::stop()
@@ -642,16 +635,10 @@ void FrameLoader::stop()
     // The frame's last ref may be removed and it will be deleted by checkCompleted().
     RefPtr<Frame> protector(m_frame);
     
-    if (m_frame->document()) {
-        if (m_frame->document()->tokenizer())
-            m_frame->document()->tokenizer()->stopParsing();
-        m_frame->document()->finishParsing();
-    } else
-        // WebKit partially uses WebCore when loading non-HTML docs.  In these cases doc==nil, but
-        // WebCore is enough involved that we need to checkCompleted() in order for m_bComplete to
-        // become true. An example is when a subframe is a pure text doc, and that subframe is the
-        // last one to complete.
-        checkCompleted();
+    if (m_frame->document()->tokenizer())
+        m_frame->document()->tokenizer()->stopParsing();
+    m_frame->document()->finishParsing();
+
     if (m_iconLoader)
         m_iconLoader->stopLoading();
 }
@@ -680,11 +667,11 @@ KURL FrameLoader::iconURL()
         return KURL();
 
     // If we have an iconURL from a Link element, return that
-    if (m_frame->document() && !m_frame->document()->iconURL().isEmpty())
+    if (!m_frame->document()->iconURL().isEmpty())
         return KURL(m_frame->document()->iconURL());
 
     // Don't return a favicon iconURL unless we're http or https
-    if (!m_URL.protocolIs("http") && !m_URL.protocolIs("https"))
+    if (!m_URL.protocolInHTTPFamily())
         return KURL();
 
     KURL url;
@@ -698,10 +685,11 @@ KURL FrameLoader::iconURL()
 
 bool FrameLoader::didOpenURL(const KURL& url)
 {
-    if (m_scheduledRedirection && m_scheduledRedirection->type == ScheduledRedirection::locationChangeDuringLoad)
+    if (m_scheduledRedirection && m_scheduledRedirection->wasDuringLoad) {
         // A redirect was scheduled before the document was created.
         // This can happen when one frame changes another frame's location.
         return false;
+    }
 
     cancelRedirection();
     m_frame->editor()->clearLastEditCommand();
@@ -711,11 +699,15 @@ bool FrameLoader::didOpenURL(const KURL& url)
     m_isLoadingMainResource = true;
     m_didCallImplicitClose = false;
 
-    m_frame->setJSStatusBarText(String());
-    m_frame->setJSDefaultStatusBarText(String());
-
+    // If we are still in the process of initializing an empty document then
+    // its frame is not in a consistent state for rendering, so avoid setJSStatusBarText
+    // since it may cause clients to attempt to render the frame.
+    if (!m_creatingInitialEmptyDocument) {
+        m_frame->setJSStatusBarText(String());
+        m_frame->setJSDefaultStatusBarText(String());
+    }
     m_URL = url;
-    if ((m_URL.protocolIs("http") || m_URL.protocolIs("https")) && !m_URL.host().isEmpty() && m_URL.path().isEmpty())
+    if (m_URL.protocolInHTTPFamily() && !m_URL.host().isEmpty() && m_URL.path().isEmpty())
         m_URL.setPath("/");
     m_workingURL = m_URL;
 
@@ -743,9 +735,12 @@ void FrameLoader::didExplicitOpen()
 
 bool FrameLoader::executeIfJavaScriptURL(const KURL& url, bool userGesture, bool replaceDocument)
 {
-    if (!url.protocolIs("javascript"))
+    if (!protocolIsJavaScript(url))
         return false;
 
+    if (m_frame->page() && !m_frame->page()->javaScriptURLsAreAllowed())
+        return true;
+
     String script = decodeURLEscapeSequences(url.string().substring(strlen("javascript:")));
     ScriptValue result = executeScript(script, userGesture);
 
@@ -754,13 +749,13 @@ bool FrameLoader::executeIfJavaScriptURL(const KURL& url, bool userGesture, bool
         return true;
 
     SecurityOrigin* currentSecurityOrigin = 0;
-    if (m_frame->document())
-        currentSecurityOrigin = m_frame->document()->securityOrigin();
+    currentSecurityOrigin = m_frame->document()->securityOrigin();
 
     // FIXME: We should always replace the document, but doing so
     //        synchronously can cause crashes:
     //        http://bugs.webkit.org/show_bug.cgi?id=16782
     if (replaceDocument) {
+        stopAllLoaders();
         begin(m_URL, true, currentSecurityOrigin);
         write(scriptResult);
         end();
@@ -786,8 +781,7 @@ ScriptValue FrameLoader::executeScript(const ScriptSourceCode& sourceCode)
 
     if (!wasRunningScript) {
         m_isRunningScript = false;
-        submitFormAgain();
-        Document::updateDocumentsRendering();
+        Document::updateStyleForAllDocuments();
     }
 
     return result;
@@ -812,7 +806,7 @@ void FrameLoader::clear(bool clearWindowProperties, bool clearScriptObjects)
         return;
     m_needsClear = false;
     
-    if (m_frame->document() && !m_frame->document()->inPageCache()) {
+    if (!m_frame->document()->inPageCache()) {
         m_frame->document()->cancelParsing();
         m_frame->document()->stopActiveDOMObjects();
         if (m_frame->document()->attached()) {
@@ -866,10 +860,12 @@ void FrameLoader::receivedFirstData()
     dispatchDidCommitLoad();
     dispatchWindowObjectAvailable();
     
-    String ptitle = m_documentLoader->title();
-    // If we have a title let the WebView know about it.
-    if (!ptitle.isNull())
-        m_client->dispatchDidReceiveTitle(ptitle);
+    if (m_documentLoader) {
+        String ptitle = m_documentLoader->title();
+        // If we have a title let the WebView know about it.
+        if (!ptitle.isNull())
+            m_client->dispatchDidReceiveTitle(ptitle);
+    }
 
     m_workingURL = KURL();
 
@@ -909,12 +905,18 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
     // might destroy the document that owns it.
     RefPtr<SecurityOrigin> forcedSecurityOrigin = origin;
 
-    bool resetScripting = !(m_isDisplayingInitialEmptyDocument && m_frame->document() && m_frame->document()->securityOrigin()->isSecureTransitionTo(url));
+    RefPtr<Document> document;
+
+    // Create a new document before clearing the frame, because it may need to inherit an aliased security context.
+    if (!m_isDisplayingInitialEmptyDocument && m_client->shouldUsePluginDocument(m_responseMIMEType))
+        document = PluginDocument::create(m_frame);
+    else
+        document = DOMImplementation::createDocument(m_responseMIMEType, m_frame, m_frame->inViewSourceMode());
+
+    bool resetScripting = !(m_isDisplayingInitialEmptyDocument && m_frame->document()->securityOrigin()->isSecureTransitionTo(url));
     clear(resetScripting, resetScripting);
     if (resetScripting)
         m_frame->script()->updatePlatformScriptObjects();
-    if (dispatch)
-        dispatchWindowObjectAvailable();
 
     m_needsClear = true;
     m_isComplete = false;
@@ -929,14 +931,11 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
     m_outgoingReferrer = ref.string();
     m_URL = url;
 
-    RefPtr<Document> document;
-    
-    if (!m_isDisplayingInitialEmptyDocument && m_client->shouldUsePluginDocument(m_responseMIMEType))
-        document = PluginDocument::create(m_frame);
-    else
-        document = DOMImplementation::createDocument(m_responseMIMEType, m_frame, m_frame->inViewSourceMode());
     m_frame->setDocument(document);
 
+    if (dispatch)
+        dispatchWindowObjectAvailable();
+
     document->setURL(m_URL);
     if (m_decoder)
         document->setDecoder(m_decoder.get());
@@ -946,7 +945,7 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
     m_frame->domWindow()->setURL(document->url());
     m_frame->domWindow()->setSecurityOrigin(document->securityOrigin());
 
-    updatePolicyBaseURL();
+    updateFirstPartyForCookies();
 
     Settings* settings = document->settings();
     document->docLoader()->setAutoLoadImages(settings && settings->loadsImagesAutomatically());
@@ -966,21 +965,9 @@ void FrameLoader::begin(const KURL& url, bool dispatch, SecurityOrigin* origin)
     restoreDocumentState();
 
     document->implicitOpen();
-
+    
     if (m_frame->view())
         m_frame->view()->setContentsSize(IntSize());
-
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    // Low bandwidth display is a first pass display without external resources
-    // used to give an instant visual feedback. We currently only enable it for
-    // HTML documents in the top frame.
-    if (document->isHTMLDocument() && !m_frame->tree()->parent() && m_useLowBandwidthDisplay) {
-        m_pendingSourceInLowBandwidthDisplay = String();
-        m_finishedParsingDuringLowBandwidthDisplay = false;
-        m_needToSwitchOutLowBandwidthDisplay = false;
-        document->setLowBandwidthDisplay(true);
-    }
-#endif
 }
 
 void FrameLoader::write(const char* str, int len, bool flush)
@@ -999,12 +986,28 @@ void FrameLoader::write(const char* str, int len, bool flush)
     }
     
     if (!m_decoder) {
-        Settings* settings = m_frame->settings();
-        m_decoder = TextResourceDecoder::create(m_responseMIMEType, settings ? settings->defaultTextEncodingName() : String());
-        if (m_encoding.isEmpty()) {
+        if (Settings* settings = m_frame->settings()) {
+            m_decoder = TextResourceDecoder::create(m_responseMIMEType,
+                settings->defaultTextEncodingName(),
+                settings->usesEncodingDetector());
             Frame* parentFrame = m_frame->tree()->parent();
-            if (parentFrame && parentFrame->document()->securityOrigin()->canAccess(m_frame->document()->securityOrigin()))
-                m_decoder->setEncoding(parentFrame->document()->inputEncoding(), TextResourceDecoder::DefaultEncoding);
+            // Set the hint encoding to the parent frame encoding only if
+            // the parent and the current frames share the security origin.
+            // We impose this condition because somebody can make a child frame 
+            // containing a carefully crafted html/javascript in one encoding
+            // that can be mistaken for hintEncoding (or related encoding) by
+            // an auto detector. When interpreted in the latter, it could be
+            // an attack vector.
+            // FIXME: This might be too cautious for non-7bit-encodings and
+            // we may consider relaxing this later after testing.
+            if (canReferToParentFrameEncoding(m_frame, parentFrame))
+                m_decoder->setHintEncoding(parentFrame->document()->decoder());
+        } else
+            m_decoder = TextResourceDecoder::create(m_responseMIMEType, String());
+        Frame* parentFrame = m_frame->tree()->parent();
+        if (m_encoding.isEmpty()) {
+            if (canReferToParentFrameEncoding(m_frame, parentFrame))
+                m_decoder->setEncoding(parentFrame->document()->inputEncoding(), TextResourceDecoder::EncodingFromParentFrame);
         } else {
             m_decoder->setEncoding(m_encoding,
                 m_encodingWasChosenByUser ? TextResourceDecoder::UserChosenEncoding : TextResourceDecoder::EncodingFromHTTPHeader);
@@ -1018,11 +1021,6 @@ void FrameLoader::write(const char* str, int len, bool flush)
     if (decoded.isEmpty())
         return;
 
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    if (m_frame->document()->inLowBandwidthDisplay())
-        m_pendingSourceInLowBandwidthDisplay.append(decoded);   
-#endif
-
     if (!m_receivedData) {
         m_receivedData = true;
         if (m_decoder->encoding().usesVisualOrdering())
@@ -1058,7 +1056,7 @@ void FrameLoader::end()
 
 void FrameLoader::endIfNotLoadingMainResource()
 {
-    if (m_isLoadingMainResource || !m_frame->page())
+    if (m_isLoadingMainResource || !m_frame->page() || !m_frame->document())
         return;
 
     // http://bugs.webkit.org/show_bug.cgi?id=10854
@@ -1067,21 +1065,8 @@ void FrameLoader::endIfNotLoadingMainResource()
     RefPtr<Frame> protector(m_frame);
 
     // make sure nothing's left in there
-    if (m_frame->document()) {
-        write(0, 0, true);
-        m_frame->document()->finishParsing();
-#if USE(LOW_BANDWIDTH_DISPLAY)
-        if (m_frame->document()->inLowBandwidthDisplay()) {
-            m_finishedParsingDuringLowBandwidthDisplay = true;
-            switchOutLowBandwidthDisplayIfReady();
-        }
-#endif            
-    } else
-        // WebKit partially uses WebCore when loading non-HTML docs.  In these cases doc==nil, but
-        // WebCore is enough involved that we need to checkCompleted() in order for m_bComplete to
-        // become true.  An example is when a subframe is a pure text doc, and that subframe is the
-        // last one to complete.
-        checkCompleted();
+    write(0, 0, true);
+    m_frame->document()->finishParsing();
 }
 
 void FrameLoader::iconLoadDecisionAvailable()
@@ -1165,23 +1150,6 @@ bool FrameLoader::allowSubstituteDataAccessToLocal()
     return localLoadPolicy != FrameLoader::AllowLocalLoadsForLocalOnly;
 }
 
-static LocalSchemesMap& localSchemes()
-{
-    DEFINE_STATIC_LOCAL(LocalSchemesMap, localSchemes, ());
-
-    if (localSchemes.isEmpty()) {
-        localSchemes.add("file");
-#if PLATFORM(MAC)
-        localSchemes.add("applewebdata");
-#endif
-#if PLATFORM(QT)
-        localSchemes.add("qrc");
-#endif
-    }
-
-    return localSchemes;
-}
-
 void FrameLoader::commitIconURLToIconDatabase(const KURL& icon)
 {
     ASSERT(iconDatabase());
@@ -1193,14 +1161,11 @@ void FrameLoader::commitIconURLToIconDatabase(const KURL& icon)
 void FrameLoader::restoreDocumentState()
 {
     Document* doc = m_frame->document();
-    if (!doc)
-        return;
         
     HistoryItem* itemToRestore = 0;
     
     switch (loadType()) {
         case FrameLoadTypeReload:
-        case FrameLoadTypeReloadAllowingStaleData:
         case FrameLoadTypeReloadFromOrigin:
         case FrameLoadTypeSame:
         case FrameLoadTypeReplace:
@@ -1208,14 +1173,15 @@ void FrameLoader::restoreDocumentState()
         case FrameLoadTypeBack:
         case FrameLoadTypeForward:
         case FrameLoadTypeIndexedBackForward:
-        case FrameLoadTypeRedirectWithLockedHistory:
+        case FrameLoadTypeRedirectWithLockedBackForwardList:
         case FrameLoadTypeStandard:
             itemToRestore = m_currentHistoryItem.get(); 
     }
     
     if (!itemToRestore)
         return;
-        
+
+    LOG(Loading, "WebCoreLoading %s: restoring form state from %p", m_frame->tree()->name().string().utf8().data(), itemToRestore);
     doc->setStateForNewFormElements(itemToRestore->documentState());
 }
 
@@ -1225,7 +1191,7 @@ void FrameLoader::gotoAnchor()
     // OTOH If CSS target was set previously, we want to set it to 0, recalc
     // and possibly repaint because :target pseudo class may have been
     // set (see bug 11321).
-    if (!m_URL.hasRef() && !(m_frame->document() && m_frame->document()->getCSSTarget()))
+    if (!m_URL.hasRef() && !m_frame->document()->cssTarget())
         return;
 
     String ref = m_URL.ref();
@@ -1263,12 +1229,14 @@ void FrameLoader::finishedParsing()
 
 void FrameLoader::loadDone()
 {
-    if (m_frame->document())
-        checkCompleted();
+    checkCompleted();
 }
 
 void FrameLoader::checkCompleted()
 {
+    if (m_frame->view())
+        m_frame->view()->checkStopDelayingDeferredRepaints();
+
     // Any frame that hasn't completed yet?
     for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
         if (!child->loader()->m_isComplete)
@@ -1279,19 +1247,12 @@ void FrameLoader::checkCompleted()
         return;
 
     // Are we still parsing?
-    if (m_frame->document() && m_frame->document()->parsing())
+    if (m_frame->document()->parsing())
         return;
 
     // Still waiting for images/scripts?
-    if (m_frame->document())
-        if (numRequests(m_frame->document()))
-            return;
-
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    // as switch will be called, don't complete yet
-    if (m_frame->document() && m_frame->document()->inLowBandwidthDisplay() && m_needToSwitchOutLowBandwidthDisplay)
+    if (numRequests(m_frame->document()))
         return;
-#endif
 
     // OK, completed.
     m_isComplete = true;
@@ -1335,7 +1296,7 @@ void FrameLoader::scheduleCheckLoadComplete()
 
 void FrameLoader::checkCallImplicitClose()
 {
-    if (m_didCallImplicitClose || !m_frame->document() || m_frame->document()->parsing())
+    if (m_didCallImplicitClose || m_frame->document()->parsing())
         return;
 
     for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
@@ -1344,8 +1305,7 @@ void FrameLoader::checkCallImplicitClose()
 
     m_didCallImplicitClose = true;
     m_wasUnloadEventEmitted = false;
-    if (m_frame->document())
-        m_frame->document()->implicitClose();
+    m_frame->document()->implicitClose();
 }
 
 KURL FrameLoader::baseURL() const
@@ -1354,12 +1314,6 @@ KURL FrameLoader::baseURL() const
     return m_frame->document()->baseURL();
 }
 
-String FrameLoader::baseTarget() const
-{
-    ASSERT(m_frame->document());
-    return m_frame->document()->baseTarget();
-}
-
 KURL FrameLoader::completeURL(const String& url)
 {
     ASSERT(m_frame->document());
@@ -1374,21 +1328,27 @@ void FrameLoader::scheduleHTTPRedirection(double delay, const String& url)
     if (!m_frame->page())
         return;
 
+    if (url.isEmpty())
+        return;
+
     // We want a new history item if the refresh timeout is > 1 second.
     if (!m_scheduledRedirection || delay <= m_scheduledRedirection->delay)
-        scheduleRedirection(new ScheduledRedirection(delay, url, delay <= 1, false, false));
+        scheduleRedirection(new ScheduledRedirection(delay, url, true, delay <= 1, false, false));
 }
 
-void FrameLoader::scheduleLocationChange(const String& url, const String& referrer, bool lockHistory, bool wasUserGesture)
+void FrameLoader::scheduleLocationChange(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture)
 {
     if (!m_frame->page())
         return;
 
+    if (url.isEmpty())
+        return;
+
     // If the URL we're going to navigate to is the same as the current one, except for the
     // fragment part, we don't need to schedule the location change.
     KURL parsedURL(url);
     if (parsedURL.hasRef() && equalIgnoringRef(m_URL, parsedURL)) {
-        changeLocation(url, referrer, lockHistory, wasUserGesture);
+        changeLocation(completeURL(url), referrer, lockHistory, lockBackForwardList, wasUserGesture);
         return;
     }
 
@@ -1396,18 +1356,23 @@ void FrameLoader::scheduleLocationChange(const String& url, const String& referr
     // This may happen when a frame changes the location of another frame.
     bool duringLoad = !m_committedFirstRealDocumentLoad;
 
-    // If a redirect was scheduled during a load, then stop the current load.
-    // Otherwise when the current load transitions from a provisional to a 
-    // committed state, pending redirects may be cancelled. 
-    if (duringLoad) {
-        if (m_provisionalDocumentLoader)
-            m_provisionalDocumentLoader->stopLoading();
-        stopLoading(true);   
-    }
+    scheduleRedirection(new ScheduledRedirection(url, referrer, lockHistory, lockBackForwardList, wasUserGesture, false, duringLoad));
+}
+
+void FrameLoader::scheduleFormSubmission(const FrameLoadRequest& frameRequest,
+    bool lockHistory, bool lockBackForwardList, PassRefPtr<Event> event, PassRefPtr<FormState> formState)
+{
+    ASSERT(m_frame->page());
+    ASSERT(!frameRequest.isEmpty());
+
+    // FIXME: Do we need special handling for form submissions where the URL is the same
+    // as the current one except for the fragment part? See scheduleLocationChange above.
 
-    ScheduledRedirection::Type type = duringLoad
-        ? ScheduledRedirection::locationChangeDuringLoad : ScheduledRedirection::locationChange;
-    scheduleRedirection(new ScheduledRedirection(type, url, referrer, lockHistory, wasUserGesture, false));
+    // Handle a location change of a page with no document as a special case.
+    // This may happen when a frame changes the location of another frame.
+    bool duringLoad = !m_committedFirstRealDocumentLoad;
+
+    scheduleRedirection(new ScheduledRedirection(frameRequest, lockHistory, lockBackForwardList, event, formState, duringLoad));
 }
 
 void FrameLoader::scheduleRefresh(bool wasUserGesture)
@@ -1415,19 +1380,10 @@ void FrameLoader::scheduleRefresh(bool wasUserGesture)
     if (!m_frame->page())
         return;
 
-    // Handle a location change of a page with no document as a special case.
-    // This may happen when a frame requests a refresh of another frame.
-    bool duringLoad = !m_frame->document();
-    
-    // If a refresh was scheduled during a load, then stop the current load.
-    // Otherwise when the current load transitions from a provisional to a 
-    // committed state, pending redirects may be cancelled. 
-    if (duringLoad)
-        stopLoading(true);   
+    if (m_URL.isEmpty())
+        return;
 
-    ScheduledRedirection::Type type = duringLoad
-        ? ScheduledRedirection::locationChangeDuringLoad : ScheduledRedirection::locationChange;
-    scheduleRedirection(new ScheduledRedirection(type, m_URL.string(), m_outgoingReferrer, true, wasUserGesture, true));
+    scheduleRedirection(new ScheduledRedirection(m_URL.string(), m_outgoingReferrer, true, true, wasUserGesture, true, false));
 }
 
 bool FrameLoader::isLocationChange(const ScheduledRedirection& redirection)
@@ -1437,7 +1393,7 @@ bool FrameLoader::isLocationChange(const ScheduledRedirection& redirection)
             return false;
         case ScheduledRedirection::historyNavigation:
         case ScheduledRedirection::locationChange:
-        case ScheduledRedirection::locationChangeDuringLoad:
+        case ScheduledRedirection::formSubmission:
             return true;
     }
     ASSERT_NOT_REACHED();
@@ -1455,18 +1411,6 @@ void FrameLoader::scheduleHistoryNavigation(int steps)
         return;
     }
 
-    // If the steps to navigate is not zero (which needs to force a reload), and if we think the navigation is going to be a fragment load
-    // (when the URL we're going to navigate to is the same as the current one, except for the fragment part - but not exactly the same because that's a reload),
-    // then we don't need to schedule the navigation.
-    if (steps != 0) {
-        KURL destination = historyURL(steps);
-        // FIXME: This doesn't seem like a reliable way to tell whether or not the load will be a fragment load.
-        if (equalIgnoringRef(m_URL, destination) && m_URL != destination) {
-            goBackOrForward(steps);
-            return;
-        }
-    }
-    
     scheduleRedirection(new ScheduledRedirection(steps));
 }
 
@@ -1509,62 +1453,55 @@ void FrameLoader::redirectionTimerFired(Timer<FrameLoader>*)
     switch (redirection->type) {
         case ScheduledRedirection::redirection:
         case ScheduledRedirection::locationChange:
-        case ScheduledRedirection::locationChangeDuringLoad:
-            changeLocation(redirection->url, redirection->referrer,
-                redirection->lockHistory, redirection->wasUserGesture, redirection->wasRefresh);
+            changeLocation(KURL(redirection->url), redirection->referrer,
+                redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture, redirection->wasRefresh);
             return;
         case ScheduledRedirection::historyNavigation:
             if (redirection->historySteps == 0) {
                 // Special case for go(0) from a frame -> reload only the frame
-                urlSelected(m_URL, "", 0, redirection->lockHistory, redirection->wasUserGesture);
+                urlSelected(m_URL, "", 0, redirection->lockHistory, redirection->lockBackForwardList, redirection->wasUserGesture);
                 return;
             }
             // go(i!=0) from a frame navigates into the history of the frame only,
             // in both IE and NS (but not in Mozilla). We can't easily do that.
             goBackOrForward(redirection->historySteps);
             return;
+        case ScheduledRedirection::formSubmission:
+            // The submitForm function will find a target frame before using the redirection timer.
+            // Now that the timer has fired, we need to repeat the security check which normally is done when
+            // selecting a target, in case conditions have changed. Other code paths avoid this by targeting
+            // without leaving a time window. If we fail the check just silently drop the form submission.
+            if (!redirection->formState->sourceFrame()->loader()->shouldAllowNavigation(m_frame))
+                return;
+            loadFrameRequest(redirection->frameRequest, redirection->lockHistory, redirection->lockBackForwardList,
+                redirection->event, redirection->formState);
+            return;
     }
 
     ASSERT_NOT_REACHED();
 }
 
-/*
-    In the case of saving state about a page with frames, we store a tree of items that mirrors the frame tree.  
-    The item that was the target of the user's navigation is designated as the "targetItem".  
-    When this method is called with doClip=YES we're able to create the whole tree except for the target's children, 
-    which will be loaded in the future.  That part of the tree will be filled out as the child loads are committed.
-*/
 void FrameLoader::loadURLIntoChildFrame(const KURL& url, const String& referer, Frame* childFrame)
 {
     ASSERT(childFrame);
+
     HistoryItem* parentItem = currentHistoryItem();
     FrameLoadType loadType = this->loadType();
-    FrameLoadType childLoadType = FrameLoadTypeRedirectWithLockedHistory;
+    FrameLoadType childLoadType = FrameLoadTypeRedirectWithLockedBackForwardList;
 
     KURL workingURL = url;
     
-    // If we're moving in the backforward list, we might want to replace the content
+    // If we're moving in the back/forward list, we might want to replace the content
     // of this child frame with whatever was there at that point.
-    // Reload will maintain the frame contents, LoadSame will not.
-    if (parentItem && parentItem->children().size() &&
-        (isBackForwardLoadType(loadType) || loadType == FrameLoadTypeReloadAllowingStaleData))
-    {
-        HistoryItem* childItem = parentItem->childItemWithName(childFrame->tree()->name());
+    if (parentItem && parentItem->children().size() && isBackForwardLoadType(loadType)) {
+        HistoryItem* childItem = parentItem->childItemWithTarget(childFrame->tree()->name());
         if (childItem) {
             // Use the original URL to ensure we get all the side-effects, such as
             // onLoad handlers, of any redirects that happened. An example of where
             // this is needed is Radar 3213556.
             workingURL = KURL(childItem->originalURLString());
-            // These behaviors implied by these loadTypes should apply to the child frames
             childLoadType = loadType;
-
-            if (isBackForwardLoadType(loadType)) {
-                // For back/forward, remember this item so we can traverse any child items as child frames load
-                childFrame->loader()->setProvisionalHistoryItem(childItem);
-            } else {
-                // For reload, just reinstall the current item, since a new child frame was created but we won't be creating a new BF item
-                childFrame->loader()->setCurrentHistoryItem(childItem);
-            }
+            childFrame->loader()->m_provisionalHistoryItem = childItem;
         }
     }
 
@@ -1573,7 +1510,7 @@ void FrameLoader::loadURLIntoChildFrame(const KURL& url, const String& referer,
     if (subframeArchive)
         childFrame->loader()->loadArchive(subframeArchive.release());
     else
-        childFrame->loader()->loadURL(workingURL, referer, String(), childLoadType, 0, 0);
+        childFrame->loader()->loadURL(workingURL, referer, String(), false, childLoadType, 0, 0);
 }
 
 void FrameLoader::loadArchive(PassRefPtr<Archive> prpArchive)
@@ -1651,12 +1588,10 @@ bool FrameLoader::gotoAnchor(const String& name)
 
     // We need to update the layout before scrolling, otherwise we could
     // really mess things up if an anchor scroll comes at a bad moment.
-    if (m_frame->document()) {
-        m_frame->document()->updateRendering();
-        // Only do a layout if changes have occurred that make it necessary.
-        if (m_frame->view() && m_frame->contentRenderer() && m_frame->contentRenderer()->needsLayout())
-            m_frame->view()->layout();
-    }
+    m_frame->document()->updateStyleIfNeeded();
+    // Only do a layout if changes have occurred that make it necessary.
+    if (m_frame->view() && m_frame->contentRenderer() && m_frame->contentRenderer()->needsLayout())
+        m_frame->view()->layout();
   
     // Scroll nested layers and frames to reveal the anchor.
     // Align to the top and to the closest side (this matches other browsers).
@@ -1668,8 +1603,11 @@ bool FrameLoader::gotoAnchor(const String& name)
         renderer = anchorNode->renderer();
         rect = anchorNode->getRect();
     }
-    if (renderer)
-        renderer->enclosingLayer()->scrollRectToVisible(rect, true, RenderLayer::gAlignToEdgeIfNeeded, RenderLayer::gAlignTopAlways);
+    if (renderer) {
+        renderer->enclosingLayer()->scrollRectToVisible(rect, true, ScrollAlignment::alignToEdgeIfNeeded, ScrollAlignment::alignTopAlways);
+        if (m_frame->view())
+            m_frame->view()->setLockedToAnchor(true);
+    }
 
     return true;
 }
@@ -1679,14 +1617,11 @@ bool FrameLoader::requestObject(RenderPart* renderer, const String& url, const A
 {
     if (url.isEmpty() && mimeType.isEmpty())
         return false;
-
-#if USE(LOW_BANDWIDTH_DISPLAY)
-    // don't care object during low bandwidth display
-    if (frame()->document()->inLowBandwidthDisplay()) {
-        m_needToSwitchOutLowBandwidthDisplay = true;
+    
+    if (!m_frame->script()->xssAuditor()->canLoadObject(url)) {
+        // It is unsafe to honor the request for this object.
         return false;
     }
-#endif
 
     KURL completedURL;
     if (!url.isEmpty())
@@ -1731,24 +1666,39 @@ bool FrameLoader::shouldUsePlugin(const KURL& url, const String& mimeType, bool
     return objectType == ObjectContentNone || objectType == ObjectContentNetscapePlugin || objectType == ObjectContentOtherPlugin;
 }
 
+static HTMLPlugInElement* toPlugInElement(Node* node)
+{
+    if (!node)
+        return 0;
+
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+    ASSERT(node->hasTagName(objectTag) || node->hasTagName(embedTag) 
+        || node->hasTagName(videoTag) || node->hasTagName(audioTag)
+        || node->hasTagName(appletTag));
+#else
+    ASSERT(node->hasTagName(objectTag) || node->hasTagName(embedTag) 
+        || node->hasTagName(appletTag));
+#endif
+
+    return static_cast<HTMLPlugInElement*>(node);
+}
+    
 bool FrameLoader::loadPlugin(RenderPart* renderer, const KURL& url, const String& mimeType, 
     const Vector<String>& paramNames, const Vector<String>& paramValues, bool useFallback)
 {
     Widget* widget = 0;
 
     if (renderer && !useFallback) {
-        Element* pluginElement = 0;
-        if (renderer->node() && renderer->node()->isElementNode())
-            pluginElement = static_cast<Element*>(renderer->node());
+        HTMLPlugInElement* element = toPlugInElement(renderer->node());
 
         if (!canLoad(url, String(), frame()->document())) {
             FrameLoader::reportLocalLoadFailed(m_frame, url.string());
             return false;
         }
 
-        widget = m_client->createPlugin(IntSize(renderer->contentWidth(), renderer->contentHeight()), 
-                                        pluginElement, url, paramNames, paramValues, mimeType,
-                                        m_frame->document()->isPluginDocument());
+        widget = m_client->createPlugin(IntSize(renderer->contentWidth(), renderer->contentHeight()),
+                                        element, url, paramNames, paramValues, mimeType,
+                                        m_frame->document()->isPluginDocument() && !m_containsPlugIns);
         if (widget) {
             renderer->setWidget(widget);
             m_containsPlugIns = true;
@@ -1758,22 +1708,6 @@ bool FrameLoader::loadPlugin(RenderPart* renderer, const KURL& url, const String
     return widget != 0;
 }
 
-void FrameLoader::clearRecordedFormValues()
-{
-    m_formAboutToBeSubmitted = 0;
-    m_formValuesAboutToBeSubmitted.clear();
-}
-
-void FrameLoader::setFormAboutToBeSubmitted(PassRefPtr<HTMLFormElement> element)
-{
-    m_formAboutToBeSubmitted = element;
-}
-
-void FrameLoader::recordFormValue(const String& name, const String& value)
-{
-    m_formValuesAboutToBeSubmitted.set(name, value);
-}
-
 void FrameLoader::parentCompleted()
 {
     if (m_scheduledRedirection && !m_redirectionTimer.isActive())
@@ -1787,10 +1721,7 @@ String FrameLoader::outgoingReferrer() const
 
 String FrameLoader::outgoingOrigin() const
 {
-    if (m_frame->document())
-        return m_frame->document()->securityOrigin()->toString();
-
-    return SecurityOrigin::createEmpty()->toString();
+    return m_frame->document()->securityOrigin()->toString();
 }
 
 Frame* FrameLoader::opener()
@@ -1831,17 +1762,7 @@ void FrameLoader::handleFallbackContent()
 }
 
 void FrameLoader::provisionalLoadStarted()
-{
-    Page* page = m_frame->page();
-    
-    // this is used to update the current history item
-    // in the event of a navigation aytime during loading
-    m_navigationDuringLoad = false;
-    if (page) {
-        Document *document = page->mainFrame()->document();
-        m_navigationDuringLoad = !page->mainFrame()->loader()->isComplete() || (document && document->processingLoadEvent());
-    }
-    
+{    
     m_firstLayoutDone = false;
     cancelRedirection(true);
     m_client->provisionalLoadStarted();
@@ -1849,20 +1770,10 @@ void FrameLoader::provisionalLoadStarted()
 
 bool FrameLoader::userGestureHint()
 {
-    Frame* rootFrame = m_frame;
-    while (rootFrame->tree()->parent())
-        rootFrame = rootFrame->tree()->parent();
-
-    if (rootFrame->script()->isEnabled())
-        return rootFrame->script()->processingUserGesture();
-
-    return true; // If JavaScript is disabled, a user gesture must have initiated the navigation
-}
-
-void FrameLoader::didNotOpenURL(const KURL& url)
-{
-    if (m_submittedFormURL == url)
-        m_submittedFormURL = KURL();
+    Frame* frame = m_frame->tree()->top();
+    if (!frame->script()->isEnabled())
+        return true; // If JavaScript is disabled, a user gesture must have initiated the navigation.
+    return frame->script()->processingUserGesture(); // FIXME: Use pageIsProcessingUserGesture.
 }
 
 void FrameLoader::resetMultipleFormSubmissionProtection()
@@ -1886,70 +1797,212 @@ void FrameLoader::addData(const char* bytes, int length)
     write(bytes, length);
 }
 
-bool FrameLoader::canCachePage()
-{    
-    // Cache the page, if possible.
-    // Don't write to the cache if in the middle of a redirect, since we will want to
-    // store the final page we end up on.
-    // No point writing to the cache on a reload or loadSame, since we will just write
-    // over it again when we leave that page.
-    // FIXME: <rdar://problem/4886592> - We should work out the complexities of caching pages with frames as they
-    // are the most interesting pages on the web, and often those that would benefit the most from caching!
-    FrameLoadType loadType = this->loadType();
-
+bool FrameLoader::canCachePageContainingThisFrame()
+{
     return m_documentLoader
         && m_documentLoader->mainDocumentError().isNull()
         && !m_frame->tree()->childCount()
-        && !m_frame->tree()->parent()
-        // FIXME: If we ever change this so that pages with plug-ins will be cached,
-        // we need to make sure that we don't cache pages that have outstanding NPObjects
+        // FIXME: If we ever change this so that frames with plug-ins will be cached,
+        // we need to make sure that we don't cache frames that have outstanding NPObjects
         // (objects created by the plug-in). Since there is no way to pause/resume a Netscape plug-in,
         // they would need to be destroyed and then recreated, and there is no way that we can recreate
         // the right NPObjects. See <rdar://problem/5197041> for more information.
         && !m_containsPlugIns
         && !m_URL.protocolIs("https")
-        && m_frame->document()
-        && !m_frame->document()->hasWindowEventListener(eventNames().unloadEvent)
+        && (!m_frame->domWindow() || !m_frame->domWindow()->hasEventListener(eventNames().unloadEvent))
 #if ENABLE(DATABASE)
         && !m_frame->document()->hasOpenDatabases()
 #endif
         && !m_frame->document()->usingGeolocation()
-        && m_frame->page()
-        && m_frame->page()->backForwardList()->enabled()
-        && m_frame->page()->backForwardList()->capacity() > 0
-        && m_frame->page()->settings()->usesPageCache()
         && m_currentHistoryItem
-        && !isQuickRedirectComing()
-        && loadType != FrameLoadTypeReload 
-        && loadType != FrameLoadTypeReloadAllowingStaleData
-        && loadType != FrameLoadTypeReloadFromOrigin
-        && loadType != FrameLoadTypeSame
+        && !m_quickRedirectComing
         && !m_documentLoader->isLoadingInAPISense()
         && !m_documentLoader->isStopping()
         && m_frame->document()->canSuspendActiveDOMObjects()
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-        // FIXME: We should investigating caching pages that have an associated
+        // FIXME: We should investigating caching frames that have an associated
         // application cache. <rdar://problem/5917899> tracks that work.
         && !m_documentLoader->applicationCache()
         && !m_documentLoader->candidateApplicationCacheGroup()
 #endif
+        && m_client->canCachePage()
+        ;
+}
+
+bool FrameLoader::canCachePage()
+{
+#ifndef NDEBUG
+    logCanCachePageDecision();
+#endif
+    
+    // Cache the page, if possible.
+    // Don't write to the cache if in the middle of a redirect, since we will want to
+    // store the final page we end up on.
+    // No point writing to the cache on a reload or loadSame, since we will just write
+    // over it again when we leave that page.
+    // FIXME: <rdar://problem/4886592> - We should work out the complexities of caching pages with frames as they
+    // are the most interesting pages on the web, and often those that would benefit the most from caching!
+    FrameLoadType loadType = this->loadType();
+    
+    return !m_frame->tree()->parent()
+        && canCachePageContainingThisFrame()
+        && m_frame->page()
+        && m_frame->page()->backForwardList()->enabled()
+        && m_frame->page()->backForwardList()->capacity() > 0
+        && m_frame->page()->settings()->usesPageCache()
+        && loadType != FrameLoadTypeReload 
+        && loadType != FrameLoadTypeReloadFromOrigin
+        && loadType != FrameLoadTypeSame
         ;
 }
 
-void FrameLoader::updatePolicyBaseURL()
+#ifndef NDEBUG
+static String& pageCacheLogPrefix(int indentLevel)
 {
-    if (m_frame->tree()->parent() && m_frame->tree()->parent()->document())
-        setPolicyBaseURL(m_frame->tree()->parent()->document()->policyBaseURL());
+    static int previousIndent = -1;
+    DEFINE_STATIC_LOCAL(String, prefix, ());
+    
+    if (indentLevel != previousIndent) {    
+        previousIndent = indentLevel;
+        prefix.truncate(0);
+        for (int i = 0; i < previousIndent; ++i)
+            prefix += "    ";
+    }
+    
+    return prefix;
+}
+
+static void pageCacheLog(const String& prefix, const String& message)
+{
+    LOG(PageCache, "%s%s", prefix.utf8().data(), message.utf8().data());
+}
+
+#define PCLOG(...) pageCacheLog(pageCacheLogPrefix(indentLevel), String::format(__VA_ARGS__))
+
+void FrameLoader::logCanCachePageDecision()
+{
+    // Only bother logging for main frames that have actually loaded and have content.
+    if (m_creatingInitialEmptyDocument)
+        return;
+    KURL currentURL = m_documentLoader ? m_documentLoader->url() : KURL();
+    if (currentURL.isEmpty())
+        return;
+
+    int indentLevel = 0;
+    PCLOG("--------\n Determining if page can be cached:");
+
+    bool cannotCache = !logCanCacheFrameDecision(1);
+        
+    FrameLoadType loadType = this->loadType();
+    do {
+        if (m_frame->tree()->parent())
+            { PCLOG("   -Frame has a parent frame"); cannotCache = true; }
+        if (!m_frame->page()) {
+            PCLOG("   -There is no Page object");
+            cannotCache = true;
+            break;
+        }
+        if (!m_frame->page()->backForwardList()->enabled())
+            { PCLOG("   -The back/forward list is disabled"); cannotCache = true; }
+        if (!(m_frame->page()->backForwardList()->capacity() > 0))
+            { PCLOG("   -The back/forward list has a 0 capacity"); cannotCache = true; }
+        if (!m_frame->page()->settings()->usesPageCache())
+            { PCLOG("   -Page settings says b/f cache disabled"); cannotCache = true; }
+        if (loadType == FrameLoadTypeReload)
+            { PCLOG("   -Load type is: Reload"); cannotCache = true; }
+        if (loadType == FrameLoadTypeReloadFromOrigin)
+            { PCLOG("   -Load type is: Reload from origin"); cannotCache = true; }
+        if (loadType == FrameLoadTypeSame)
+            { PCLOG("   -Load type is: Same"); cannotCache = true; }
+    } while (false);
+    
+    PCLOG(cannotCache ? " Page CANNOT be cached\n--------" : " Page CAN be cached\n--------");
+}
+
+bool FrameLoader::logCanCacheFrameDecision(int indentLevel)
+{
+    // Only bother logging for frames that have actually loaded and have content.
+    if (m_creatingInitialEmptyDocument)
+        return false;
+    KURL currentURL = m_documentLoader ? m_documentLoader->url() : KURL();
+    if (currentURL.isEmpty())
+        return false;
+
+    PCLOG("+---");
+    KURL newURL = m_provisionalDocumentLoader ? m_provisionalDocumentLoader->url() : KURL();
+    if (!newURL.isEmpty())
+        PCLOG(" Determining if frame can be cached navigating from (%s) to (%s):", currentURL.string().utf8().data(), newURL.string().utf8().data());
+    else
+        PCLOG(" Determining if subframe with URL (%s) can be cached:", currentURL.string().utf8().data());
+        
+    bool cannotCache = false;
+
+    do {
+        if (!m_documentLoader) {
+            PCLOG("   -There is no DocumentLoader object");
+            cannotCache = true;
+            break;
+        }
+        if (!m_documentLoader->mainDocumentError().isNull())
+            { PCLOG("   -Main document has an error"); cannotCache = true; }
+        if (m_frame->tree()->childCount())
+            { PCLOG("   -Frame has child frames"); cannotCache = true; }
+        if (m_containsPlugIns)
+            { PCLOG("   -Frame contains plugins"); cannotCache = true; }
+        if (m_URL.protocolIs("https"))
+            { PCLOG("   -Frame is HTTPS"); cannotCache = true; }
+        if (m_frame->domWindow() && m_frame->domWindow()->hasEventListener(eventNames().unloadEvent))
+            { PCLOG("   -Frame has an unload event listener"); cannotCache = true; }
+#if ENABLE(DATABASE)
+        if (m_frame->document()->hasOpenDatabases())
+            { PCLOG("   -Frame has open database handles"); cannotCache = true; }
+#endif
+        if (m_frame->document()->usingGeolocation())
+            { PCLOG("   -Frame uses Geolocation"); cannotCache = true; }
+        if (!m_currentHistoryItem)
+            { PCLOG("   -No current history item"); cannotCache = true; }
+        if (m_quickRedirectComing)
+            { PCLOG("   -Quick redirect is coming"); cannotCache = true; }
+        if (m_documentLoader->isLoadingInAPISense())
+            { PCLOG("   -DocumentLoader is still loading in API sense"); cannotCache = true; }
+        if (m_documentLoader->isStopping())
+            { PCLOG("   -DocumentLoader is in the middle of stopping"); cannotCache = true; }
+        if (!m_frame->document()->canSuspendActiveDOMObjects())
+            { PCLOG("   -The document cannot suspect its active DOM Objects"); cannotCache = true; }
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+        if (m_documentLoader->applicationCache())
+            { PCLOG("   -The DocumentLoader has an active application cache"); cannotCache = true; }
+        if (m_documentLoader->candidateApplicationCacheGroup())
+            { PCLOG("   -The DocumentLoader has a candidateApplicationCacheGroup"); cannotCache = true; }
+#endif
+        if (!m_client->canCachePage())
+            { PCLOG("   -The client says this frame cannot be cached"); cannotCache = true; }
+    } while (false);
+
+    for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
+        if (!child->loader()->logCanCacheFrameDecision(indentLevel + 1))
+            cannotCache = true;
+    
+    PCLOG(cannotCache ? " Frame CANNOT be cached" : " Frame CAN be cached");
+    PCLOG("+---");
+
+    return !cannotCache;
+}
+#endif
+
+void FrameLoader::updateFirstPartyForCookies()
+{
+    if (m_frame->tree()->parent())
+        setFirstPartyForCookies(m_frame->tree()->parent()->document()->firstPartyForCookies());
     else
-        setPolicyBaseURL(m_URL);
+        setFirstPartyForCookies(m_URL);
 }
 
-void FrameLoader::setPolicyBaseURL(const KURL& url)
+void FrameLoader::setFirstPartyForCookies(const KURL& url)
 {
-    if (m_frame->document())
-        m_frame->document()->setPolicyBaseURL(url);
+    m_frame->document()->setFirstPartyForCookies(url);
     for (Frame* child = m_frame->tree()->firstChild(); child; child = child->tree()->nextSibling())
-        child->loader()->setPolicyBaseURL(url);
+        child->loader()->setFirstPartyForCookies(url);
 }
 
 // This does the same kind of work that didOpenURL does, except it relies on the fact
@@ -1979,6 +2032,15 @@ void FrameLoader::scheduleRedirection(ScheduledRedirection* redirection)
 {
     ASSERT(m_frame->page());
 
+    // If a redirect was scheduled during a load, then stop the current load.
+    // Otherwise when the current load transitions from a provisional to a 
+    // committed state, pending redirects may be cancelled. 
+    if (redirection->wasDuringLoad) {
+        if (m_provisionalDocumentLoader)
+            m_provisionalDocumentLoader->stopLoading();
+        stopLoading(true);   
+    }
+
     stopRedirectionTimer();
     m_scheduledRedirection.set(redirection);
     if (!m_isComplete && redirection->type != ScheduledRedirection::redirection)
@@ -1996,14 +2058,17 @@ void FrameLoader::startRedirectionTimer()
     m_redirectionTimer.startOneShot(m_scheduledRedirection->delay);
 
     switch (m_scheduledRedirection->type) {
-        case ScheduledRedirection::redirection:
         case ScheduledRedirection::locationChange:
-        case ScheduledRedirection::locationChangeDuringLoad:
+        case ScheduledRedirection::redirection:
             clientRedirected(KURL(m_scheduledRedirection->url),
                 m_scheduledRedirection->delay,
                 currentTime() + m_redirectionTimer.nextFireInterval(),
-                m_scheduledRedirection->lockHistory,
-                m_isExecutingJavaScriptFormAction);
+                m_scheduledRedirection->lockBackForwardList);
+            return;
+        case ScheduledRedirection::formSubmission:
+            // FIXME: It would make sense to report form submissions as client redirects too.
+            // But we didn't do that in the past when form submission used a separate delay
+            // mechanism, so doing it will be a behavior change.
             return;
         case ScheduledRedirection::historyNavigation:
             // Don't report history navigations.
@@ -2021,11 +2086,15 @@ void FrameLoader::stopRedirectionTimer()
 
     if (m_scheduledRedirection) {
         switch (m_scheduledRedirection->type) {
-            case ScheduledRedirection::redirection:
             case ScheduledRedirection::locationChange:
-            case ScheduledRedirection::locationChangeDuringLoad:
+            case ScheduledRedirection::redirection:
                 clientRedirectCancelledOrFinished(m_cancellingWithLoadInProgress);
                 return;
+            case ScheduledRedirection::formSubmission:
+                // FIXME: It would make sense to report form submissions as client redirects too.
+                // But we didn't do that in the past when form submission used a separate delay
+                // mechanism, so doing it will be a behavior change.
+                return;
             case ScheduledRedirection::historyNavigation:
                 // Don't report history navigations.
                 return;
@@ -2041,7 +2110,8 @@ void FrameLoader::completed()
         child->loader()->parentCompleted();
     if (Frame* parent = m_frame->tree()->parent())
         parent->loader()->checkCompleted();
-    submitFormAgain();
+    if (m_frame->view())
+        m_frame->view()->setLockedToAnchor(false);
 }
 
 void FrameLoader::started()
@@ -2075,13 +2145,24 @@ void FrameLoader::setupForReplaceByMIMEType(const String& newMIMEType)
     activeDocumentLoader()->setupForReplaceByMIMEType(newMIMEType);
 }
 
-void FrameLoader::loadFrameRequestWithFormAndValues(const FrameLoadRequest& request, bool lockHistory, Event* event,
-    HTMLFormElement* submitForm, const HashMap<String, String>& formValues)
+// This is a hack to allow keep navigation to http/https feeds working. To remove this
+// we need to introduce new API akin to registerURLSchemeAsLocal, that registers a
+// protocols navigation policy.
+static bool isFeedWithNestedProtocolInHTTPFamily(const KURL& url)
 {
-    RefPtr<FormState> formState;
-    if (submitForm)
-        formState = FormState::create(submitForm, formValues, m_frame);
-    
+    const String& urlString = url.string();
+    if (!urlString.startsWith("feed", false))
+        return false;
+
+    return urlString.startsWith("feed://", false) 
+        || urlString.startsWith("feed:http:", false) || urlString.startsWith("feed:https:", false)
+        || urlString.startsWith("feeds:http:", false) || urlString.startsWith("feeds:https:", false)
+        || urlString.startsWith("feedsearch:http:", false) || urlString.startsWith("feedsearch:https:", false);
+}
+
+void FrameLoader::loadFrameRequest(const FrameLoadRequest& request, bool lockHistory, bool lockBackForwardList,
+    PassRefPtr<Event> event, PassRefPtr<FormState> formState)
+{    
     KURL url = request.resourceRequest().url();
 
     String referrer;
@@ -2092,7 +2173,7 @@ void FrameLoader::loadFrameRequestWithFormAndValues(const FrameLoadRequest& requ
         referrer = m_outgoingReferrer;
 
     ASSERT(frame()->document());
-    if (url.protocolIs("file")) {
+    if (SecurityOrigin::shouldTreatURLAsLocal(url.string()) && !isFeedWithNestedProtocolInHTTPFamily(url)) {
         if (!canLoad(url, String(), frame()->document()) && !canLoad(url, referrer)) {
             FrameLoader::reportLocalLoadFailed(m_frame, url.string());
             return;
@@ -2102,29 +2183,31 @@ void FrameLoader::loadFrameRequestWithFormAndValues(const FrameLoadRequest& requ
     if (shouldHideReferrer(url, referrer))
         referrer = String();
     
-    Frame* targetFrame = findFrameForNavigation(request.frameName());
-
-    if (request.resourceRequest().httpMethod() != "POST") {
-        FrameLoadType loadType;
-        if (request.resourceRequest().cachePolicy() == ReloadIgnoringCacheData)
-            loadType = FrameLoadTypeReload;
-        else if (lockHistory)
-            loadType = FrameLoadTypeRedirectWithLockedHistory;
-        else
-            loadType = FrameLoadTypeStandard;    
-    
-        loadURL(request.resourceRequest().url(), referrer, request.frameName(), loadType, 
-                event, formState.release());
-    } else
-        loadPostRequest(request.resourceRequest(), referrer, request.frameName(), event, formState.release());
+    FrameLoadType loadType;
+    if (request.resourceRequest().cachePolicy() == ReloadIgnoringCacheData)
+        loadType = FrameLoadTypeReload;
+    else if (lockBackForwardList)
+        loadType = FrameLoadTypeRedirectWithLockedBackForwardList;
+    else
+        loadType = FrameLoadTypeStandard;
 
-    if (targetFrame && targetFrame != m_frame)
+    if (request.resourceRequest().httpMethod() == "POST")
+        loadPostRequest(request.resourceRequest(), referrer, request.frameName(), lockHistory, loadType, event, formState.get());
+    else
+        loadURL(request.resourceRequest().url(), referrer, request.frameName(), lockHistory, loadType, event, formState.get());
+
+    // FIXME: It's possible this targetFrame will not be the same frame that was targeted by the actual
+    // load if frame names have changed.
+    Frame* sourceFrame = formState ? formState->sourceFrame() : m_frame;
+    Frame* targetFrame = sourceFrame->loader()->findFrameForNavigation(request.frameName());
+    if (targetFrame && targetFrame != sourceFrame) {
         if (Page* page = targetFrame->page())
             page->chrome()->focus();
+    }
 }
 
-void FrameLoader::loadURL(const KURL& newURL, const String& referrer, const String& frameName, FrameLoadType newLoadType,
-    Event* event, PassRefPtr<FormState> prpFormState)
+void FrameLoader::loadURL(const KURL& newURL, const String& referrer, const String& frameName, bool lockHistory, FrameLoadType newLoadType,
+    PassRefPtr<Event> event, PassRefPtr<FormState> prpFormState)
 {
     RefPtr<FormState> formState = prpFormState;
     bool isFormSubmission = formState;
@@ -2141,13 +2224,17 @@ void FrameLoader::loadURL(const KURL& newURL, const String& referrer, const Stri
 
     ASSERT(newLoadType != FrameLoadTypeSame);
 
+    // The search for a target frame is done earlier in the case of form submission.
+    Frame* targetFrame = isFormSubmission ? 0 : findFrameForNavigation(frameName);
+    if (targetFrame && targetFrame != m_frame) {
+        targetFrame->loader()->loadURL(newURL, referrer, String(), lockHistory, newLoadType, event, formState.release());
+        return;
+    }
+
     NavigationAction action(newURL, newLoadType, isFormSubmission, event);
 
-    if (!frameName.isEmpty()) {
-        if (Frame* targetFrame = findFrameForNavigation(frameName))
-            targetFrame->loader()->loadURL(newURL, referrer, String(), newLoadType, event, formState);
-        else
-            checkNewWindowPolicy(action, request, formState, frameName);
+    if (!targetFrame && !frameName.isEmpty()) {
+        checkNewWindowPolicy(action, request, formState.release(), frameName);
         return;
     }
 
@@ -2161,12 +2248,12 @@ void FrameLoader::loadURL(const KURL& newURL, const String& referrer, const Stri
     if (shouldScrollToAnchor(isFormSubmission, newLoadType, newURL)) {
         oldDocumentLoader->setTriggeringAction(action);
         stopPolicyCheck();
-        checkNavigationPolicy(request, oldDocumentLoader.get(), formState,
+        checkNavigationPolicy(request, oldDocumentLoader.get(), formState.release(),
             callContinueFragmentScrollAfterNavigationPolicy, this);
     } else {
         // must grab this now, since this load may stop the previous load and clear this flag
         bool isRedirect = m_quickRedirectComing;
-        loadWithNavigationAction(request, action, newLoadType, formState);
+        loadWithNavigationAction(request, action, lockHistory, newLoadType, formState.release());
         if (isRedirect) {
             m_quickRedirectComing = false;
             if (m_provisionalDocumentLoader)
@@ -2179,40 +2266,45 @@ void FrameLoader::loadURL(const KURL& newURL, const String& referrer, const Stri
     }
 }
 
-void FrameLoader::load(const ResourceRequest& request)
+void FrameLoader::load(const ResourceRequest& request, bool lockHistory)
 {
-    load(request, SubstituteData());
+    load(request, SubstituteData(), lockHistory);
 }
 
-void FrameLoader::load(const ResourceRequest& request, const SubstituteData& substituteData)
+void FrameLoader::load(const ResourceRequest& request, const SubstituteData& substituteData, bool lockHistory)
 {
     if (m_inStopAllLoaders)
         return;
         
     // FIXME: is this the right place to reset loadType? Perhaps this should be done after loading is finished or aborted.
     m_loadType = FrameLoadTypeStandard;
-    load(m_client->createDocumentLoader(request, substituteData).get());
+    RefPtr<DocumentLoader> loader = m_client->createDocumentLoader(request, substituteData);
+    if (lockHistory && m_documentLoader)
+        loader->setClientRedirectSourceForHistory(m_documentLoader->didCreateGlobalHistoryEntry() ? m_documentLoader->urlForHistory() : m_documentLoader->clientRedirectSourceForHistory());
+    load(loader.get());
 }
 
-void FrameLoader::load(const ResourceRequest& request, const String& frameName)
+void FrameLoader::load(const ResourceRequest& request, const String& frameName, bool lockHistory)
 {
     if (frameName.isEmpty()) {
-        load(request);
+        load(request, lockHistory);
         return;
     }
 
     Frame* frame = findFrameForNavigation(frameName);
     if (frame) {
-        frame->loader()->load(request);
+        frame->loader()->load(request, lockHistory);
         return;
     }
 
     checkNewWindowPolicy(NavigationAction(request.url(), NavigationTypeOther), request, 0, frameName);
 }
 
-void FrameLoader::loadWithNavigationAction(const ResourceRequest& request, const NavigationAction& action, FrameLoadType type, PassRefPtr<FormState> formState)
+void FrameLoader::loadWithNavigationAction(const ResourceRequest& request, const NavigationAction& action, bool lockHistory, FrameLoadType type, PassRefPtr<FormState> formState)
 {
     RefPtr<DocumentLoader> loader = m_client->createDocumentLoader(request, SubstituteData());
+    if (lockHistory && m_documentLoader)
+        loader->setClientRedirectSourceForHistory(m_documentLoader->didCreateGlobalHistoryEntry() ? m_documentLoader->urlForHistory() : m_documentLoader->clientRedirectSourceForHistory());
 
     loader->setTriggeringAction(action);
     if (m_documentLoader)
@@ -2280,6 +2372,8 @@ void FrameLoader::loadWithDocumentLoader(DocumentLoader* loader, FrameLoadType t
 
         stopPolicyCheck();
         setPolicyDocumentLoader(loader);
+        if (loader->triggeringAction().isEmpty())
+            loader->setTriggeringAction(NavigationAction(newURL, m_policyLoadType, isFormSubmission));
 
         checkNavigationPolicy(loader->request(), loader, formState,
             callContinueLoadAfterNavigationPolicy, this);
@@ -2288,18 +2382,22 @@ void FrameLoader::loadWithDocumentLoader(DocumentLoader* loader, FrameLoadType t
 
 bool FrameLoader::canLoad(const KURL& url, const String& referrer, const Document* doc)
 {
-    // We can always load any URL that isn't considered local (e.g. http URLs)
-    if (!shouldTreatURLAsLocal(url.string()))
+    return canLoad(url, referrer, doc ? doc->securityOrigin() : 0);
+}
+
+bool FrameLoader::canLoad(const KURL& url, const String& referrer, const SecurityOrigin* securityOrigin)
+{
+    // We can always load any URL that isn't considered local (e.g. http URLs).
+    if (!SecurityOrigin::shouldTreatURLAsLocal(url.string()))
         return true;
 
     // If we were provided a document, we let its local file policy dictate the result,
     // otherwise we allow local loads only if the supplied referrer is also local.
-    if (doc)
-        return doc->securityOrigin()->canLoadLocalResources();
-    else if (!referrer.isEmpty())
-        return shouldTreatURLAsLocal(referrer);
-    else
-        return false;
+    if (securityOrigin)
+        return securityOrigin->canLoadLocalResources();
+    if (!referrer.isEmpty())
+        return SecurityOrigin::shouldTreatURLAsLocal(referrer);
+    return false;
 }
 
 void FrameLoader::reportLocalLoadFailed(Frame* frame, const String& url)
@@ -2407,7 +2505,7 @@ bool FrameLoader::shouldReloadToHandleUnreachableURL(DocumentLoader* docLoader)
     return compareDocumentLoader && unreachableURL == compareDocumentLoader->request().url();
 }
 
-void FrameLoader::reloadAllowingStaleData(const String& encoding)
+void FrameLoader::reloadWithOverrideEncoding(const String& encoding)
 {
     if (!m_documentLoader)
         return;
@@ -2424,7 +2522,7 @@ void FrameLoader::reloadAllowingStaleData(const String& encoding)
 
     loader->setOverrideEncoding(encoding);
 
-    loadWithDocumentLoader(loader.get(), FrameLoadTypeReloadAllowingStaleData, 0);
+    loadWithDocumentLoader(loader.get(), FrameLoadTypeReload, 0);
 }
 
 void FrameLoader::reload(bool endToEndReload)
@@ -2537,8 +2635,11 @@ void FrameLoader::stopLoadingSubframes()
         child->loader()->stopAllLoaders();
 }
 
-void FrameLoader::stopAllLoaders()
+void FrameLoader::stopAllLoaders(DatabasePolicy databasePolicy)
 {
+    if (m_unloadEventBeingDispatched)
+        return;
+
     // If this method is called from within this method, infinite recursion can occur (3442218). Avoid this.
     if (m_inStopAllLoaders)
         return;
@@ -2549,9 +2650,9 @@ void FrameLoader::stopAllLoaders()
 
     stopLoadingSubframes();
     if (m_provisionalDocumentLoader)
-        m_provisionalDocumentLoader->stopLoading();
+        m_provisionalDocumentLoader->stopLoading(databasePolicy);
     if (m_documentLoader)
-        m_documentLoader->stopLoading();
+        m_documentLoader->stopLoading(databasePolicy);
 
     setProvisionalDocumentLoader(0);
     
@@ -2607,11 +2708,6 @@ void FrameLoader::setDocumentLoader(DocumentLoader* loader)
     m_documentLoader = loader;
 }
 
-DocumentLoader* FrameLoader::documentLoader() const
-{
-    return m_documentLoader.get();
-}
-
 void FrameLoader::setPolicyDocumentLoader(DocumentLoader* loader)
 {
     if (m_policyDocumentLoader == loader)
@@ -2628,16 +2724,6 @@ void FrameLoader::setPolicyDocumentLoader(DocumentLoader* loader)
     m_policyDocumentLoader = loader;
 }
 
-DocumentLoader* FrameLoader::policyDocumentLoader() const
-{
-    return m_policyDocumentLoader.get();
-}
-   
-DocumentLoader* FrameLoader::provisionalDocumentLoader() const
-{
-    return m_provisionalDocumentLoader.get();
-}
-
 void FrameLoader::setProvisionalDocumentLoader(DocumentLoader* loader)
 {
     ASSERT(!loader || !m_provisionalDocumentLoader);
@@ -2649,11 +2735,6 @@ void FrameLoader::setProvisionalDocumentLoader(DocumentLoader* loader)
     m_provisionalDocumentLoader = loader;
 }
 
-FrameState FrameLoader::state() const
-{
-    return m_state;
-}
-
 double FrameLoader::timeOfLastCompletedLoad()
 {
     return storedTimeOfLastCompletedLoad;
@@ -2690,14 +2771,12 @@ void FrameLoader::commitProvisionalLoad(PassRefPtr<CachedPage> prpCachedPage)
 {
     RefPtr<CachedPage> cachedPage = prpCachedPage;
     RefPtr<DocumentLoader> pdl = m_provisionalDocumentLoader;
-    
+
+    LOG(Loading, "WebCoreLoading %s: About to commit provisional load from previous URL %s", m_frame->tree()->name().string().utf8().data(), m_URL.string().utf8().data());
+
     // Check to see if we need to cache the page we are navigating away from into the back/forward cache.
     // We are doing this here because we know for sure that a new page is about to be loaded.
-    if (canCachePage() && m_client->canCachePage() && !m_currentHistoryItem->isInPageCache()) {
-        if (Document* document = m_frame->document())
-            document->suspendActiveDOMObjects();
-        cachePageForHistoryItem(m_currentHistoryItem.get());
-    }
+    cachePageForHistoryItem(m_currentHistoryItem.get());
     
     if (m_loadType != FrameLoadTypeReplace)
         closeOldDataSources();
@@ -2728,7 +2807,40 @@ void FrameLoader::commitProvisionalLoad(PassRefPtr<CachedPage> prpCachedPage)
 
         didOpenURL(url);
     }
-    opened();
+
+    LOG(Loading, "WebCoreLoading %s: Finished committing provisional load to URL %s", m_frame->tree()->name().string().utf8().data(), m_URL.string().utf8().data());
+
+    if (m_loadType == FrameLoadTypeStandard && m_documentLoader->isClientRedirect())
+        updateHistoryForClientRedirect();
+
+    if (m_documentLoader->isLoadingFromCachedPage()) {
+        m_frame->document()->documentDidBecomeActive();
+        
+        // Force a layout to update view size and thereby update scrollbars.
+        m_client->forceLayout();
+
+        const ResponseVector& responses = m_documentLoader->responses();
+        size_t count = responses.size();
+        for (size_t i = 0; i < count; i++) {
+            const ResourceResponse& response = responses[i];
+            // FIXME: If the WebKit client changes or cancels the request, this is not respected.
+            ResourceError error;
+            unsigned long identifier;
+            ResourceRequest request(response.url());
+            requestFromDelegate(request, identifier, error);
+            // FIXME: If we get a resource with more than 2B bytes, this code won't do the right thing.
+            // However, with today's computers and networking speeds, this won't happen in practice.
+            // Could be an issue with a giant local file.
+            sendRemainingDelegateMessages(identifier, response, static_cast<int>(response.expectedContentLength()), error);
+        }
+        
+        pageCache()->remove(m_currentHistoryItem.get());
+
+        m_documentLoader->setPrimaryLoadComplete(true);
+
+        // FIXME: Why only this frame and not parent frames?
+        checkLoadCompleteForThisFrame();
+    }
 }
 
 void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
@@ -2778,7 +2890,7 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
                         DocumentLoader* cachedDocumentLoader = cachedPage->documentLoader();
                         ASSERT(cachedDocumentLoader);
                         cachedDocumentLoader->setFrame(m_frame);
-                        m_client->transitionToCommittedFromCachedPage(cachedPage.get());
+                        m_client->transitionToCommittedFromCachedFrame(cachedPage->cachedMainFrame());
                         
                     } else
                         m_client->transitionToCommittedForNewPage();
@@ -2793,11 +2905,6 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
             m_client->transitionToCommittedForNewPage();
             break;
 
-        // FIXME - just get rid of this case, and merge FrameLoadTypeReloadAllowingStaleData with the above case
-        case FrameLoadTypeReloadAllowingStaleData:
-            m_client->transitionToCommittedForNewPage();
-            break;
-
         case FrameLoadTypeStandard:
             updateHistoryForStandardLoad();
 #ifndef BUILDING_ON_TIGER
@@ -2809,8 +2916,8 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
             m_client->transitionToCommittedForNewPage();
             break;
 
-        case FrameLoadTypeRedirectWithLockedHistory:
-            updateHistoryForRedirectWithLockedHistory();
+        case FrameLoadTypeRedirectWithLockedBackForwardList:
+            updateHistoryForRedirectWithLockedBackForwardList();
             m_client->transitionToCommittedForNewPage();
             break;
 
@@ -2827,9 +2934,9 @@ void FrameLoader::transitionToCommitted(PassRefPtr<CachedPage> cachedPage)
 
     if (m_creatingInitialEmptyDocument)
         return;
-
-    m_committedFirstRealDocumentLoad = true;
     
+    m_committedFirstRealDocumentLoad = true;
+
     // For non-cached HTML pages, these methods are called in FrameLoader::begin.
     if (cachedPage || !m_client->hasHTMLView()) {
         dispatchDidCommitLoad(); 
@@ -2853,7 +2960,7 @@ void FrameLoader::clientRedirectCancelledOrFinished(bool cancelWithLoadInProgres
     m_sentRedirectNotification = false;
 }
 
-void FrameLoader::clientRedirected(const KURL& url, double seconds, double fireDate, bool lockHistory, bool isJavaScriptFormAction)
+void FrameLoader::clientRedirected(const KURL& url, double seconds, double fireDate, bool lockBackForwardList)
 {
     m_client->dispatchWillPerformClientRedirect(url, seconds, fireDate);
     
@@ -2861,10 +2968,11 @@ void FrameLoader::clientRedirected(const KURL& url, double seconds, double fireD
     // the next provisional load, we can send a corresponding -webView:didCancelClientRedirectForFrame:
     m_sentRedirectNotification = true;
     
-    // If a "quick" redirect comes in an, we set a special mode so we treat the next
-    // load as part of the same navigation. If we don't have a document loader, we have
+    // If a "quick" redirect comes in, we set a special mode so we treat the next
+    // load as part of the original navigation. If we don't have a document loader, we have
     // no "original" load on which to base a redirect, so we treat the redirect as a normal load.
-    m_quickRedirectComing = lockHistory && m_documentLoader && !isJavaScriptFormAction;
+    // Loads triggered by JavaScript form submissions never count as quick redirects.
+    m_quickRedirectComing = lockBackForwardList && m_documentLoader && !m_isExecutingJavaScriptFormAction;
 }
 
 #if ENABLE(WML)
@@ -2906,6 +3014,7 @@ void FrameLoader::closeOldDataSources()
 
 void FrameLoader::open(CachedPage& cachedPage)
 {
+    ASSERT(!m_frame->tree()->parent());
     ASSERT(m_frame->page());
     ASSERT(m_frame->page()->mainFrame() == m_frame);
 
@@ -2913,11 +3022,6 @@ void FrameLoader::open(CachedPage& cachedPage)
 
     // We still have to close the previous part page.
     closeURL();
-
-    m_isComplete = false;
-    
-    // Don't re-emit the load event.
-    m_didCallImplicitClose = true;
     
     // Delete old status bar messages (if it _was_ activated on last URL).
     if (m_frame->script()->isEnabled()) {
@@ -2925,9 +3029,22 @@ void FrameLoader::open(CachedPage& cachedPage)
         m_frame->setJSDefaultStatusBarText(String());
     }
 
-    KURL url = cachedPage.url();
+    open(*cachedPage.cachedMainFrame());
+    cachedPage.restore(m_frame->page());
 
-    if ((url.protocolIs("http") || url.protocolIs("https")) && !url.host().isEmpty() && url.path().isEmpty())
+    checkCompleted();
+}
+
+void FrameLoader::open(CachedFrame& cachedFrame)
+{
+    m_isComplete = false;
+    
+    // Don't re-emit the load event.
+    m_didCallImplicitClose = true;
+
+    KURL url = cachedFrame.url();
+
+    if (url.protocolInHTTPFamily() && !url.host().isEmpty() && url.path().isEmpty())
         url.setPath("/");
     
     m_URL = url;
@@ -2937,7 +3054,7 @@ void FrameLoader::open(CachedPage& cachedPage)
 
     clear();
 
-    Document* document = cachedPage.document();
+    Document* document = cachedFrame.document();
     ASSERT(document);
     document->setInPageCache(false);
 
@@ -2946,28 +3063,24 @@ void FrameLoader::open(CachedPage& cachedPage)
     m_didCallImplicitClose = false;
     m_outgoingReferrer = url.string();
 
-    FrameView* view = cachedPage.view();
+    FrameView* view = cachedFrame.view();
+    
+    // When navigating to a CachedFrame its FrameView should never be null.  If it is we'll crash in creative ways downstream.
+    ASSERT(view);
     if (view)
         view->setWasScrolledByUser(false);
     m_frame->setView(view);
     
     m_frame->setDocument(document);
-    m_frame->setDOMWindow(cachedPage.domWindow());
+    m_frame->setDOMWindow(cachedFrame.domWindow());
     m_frame->domWindow()->setURL(document->url());
     m_frame->domWindow()->setSecurityOrigin(document->securityOrigin());
 
     m_decoder = document->decoder();
 
-    updatePolicyBaseURL();
+    updateFirstPartyForCookies();
 
-    cachedPage.restore(m_frame->page());
-    document->resumeActiveDOMObjects();
-
-    // It is necessary to update any platform script objects after restoring the
-    // cached page.
-    m_frame->script()->updatePlatformScriptObjects();
-
-    checkCompleted();
+    cachedFrame.restore();
 }
 
 bool FrameLoader::isStopping() const
@@ -3060,7 +3173,17 @@ void FrameLoader::finishedLoadingDocument(DocumentLoader* loader)
     
     ArchiveResource* mainResource = archive->mainResource();
     loader->setParsedArchiveData(mainResource->data());
-    continueLoadWithData(mainResource->data(), mainResource->mimeType(), mainResource->textEncoding(), mainResource->url());
+
+    m_responseMIMEType = mainResource->mimeType();
+    didOpenURL(mainResource->url());
+
+    String userChosenEncoding = documentLoader()->overrideEncoding();
+    bool encodingIsUserChosen = !userChosenEncoding.isNull();
+    setEncoding(encodingIsUserChosen ? userChosenEncoding : mainResource->textEncoding(), encodingIsUserChosen);
+
+    ASSERT(m_frame->document());
+
+    addData(mainResource->data()->data(), mainResource->data()->size());
 }
 
 bool FrameLoader::isReplacing() const
@@ -3103,20 +3226,28 @@ FrameLoadType FrameLoader::loadType() const
     return m_loadType;
 }
     
-CachePolicy FrameLoader::cachePolicy() const
+CachePolicy FrameLoader::subresourceCachePolicy() const
 {
     if (m_isComplete)
         return CachePolicyVerify;
-    
+
     if (m_loadType == FrameLoadTypeReloadFromOrigin)
         return CachePolicyReload;
-    
+
     if (Frame* parentFrame = m_frame->tree()->parent()) {
-        CachePolicy parentCachePolicy = parentFrame->loader()->cachePolicy();
+        CachePolicy parentCachePolicy = parentFrame->loader()->subresourceCachePolicy();
         if (parentCachePolicy != CachePolicyVerify)
             return parentCachePolicy;
     }
 
+    // FIXME: POST documents are always Reloads, but their subresources should still be Revalidate.
+    // If we bring the CachePolicy.h and ResourceRequest cache policy enums in sync with each other and
+    // remember "Revalidate" in ResourceRequests, we can remove this "POST" check and return either "Reload" 
+    // or "Revalidate" if the DocumentLoader was requested with either.
+    const ResourceRequest& request(documentLoader()->request());
+    if (request.cachePolicy() == ReloadIgnoringCacheData && !equalIgnoringCase(request.httpMethod(), "post"))
+        return CachePolicyRevalidate;
+
     if (m_loadType == FrameLoadTypeReload)
         return CachePolicyRevalidate;
 
@@ -3156,7 +3287,7 @@ void FrameLoader::checkLoadCompleteForThisFrame()
                     item = m_currentHistoryItem;
                 
             bool shouldReset = true;
-            if (!pdl->isLoadingInAPISense()) {
+            if (!(pdl->isLoadingInAPISense() && !pdl->isStopping())) {
                 m_delegateIsHandlingProvisionalLoadError = true;
                 m_client->dispatchDidFailProvisionalLoad(error);
                 m_delegateIsHandlingProvisionalLoadError = false;
@@ -3188,7 +3319,7 @@ void FrameLoader::checkLoadCompleteForThisFrame()
         
         case FrameStateCommittedPage: {
             DocumentLoader* dl = m_documentLoader.get();            
-            if (!dl || dl->isLoadingInAPISense())
+            if (!dl || (dl->isLoadingInAPISense() && !dl->isStopping()))
                 return;
 
             markLoadComplete();
@@ -3222,9 +3353,7 @@ void FrameLoader::checkLoadCompleteForThisFrame()
         }
         
         case FrameStateComplete:
-            // Even if already complete, we might have set a previous item on a frame that
-            // didn't do any data loading on the past transaction. Make sure to clear these out.
-            m_client->frameLoadCompleted();
+            frameLoadCompleted();
             return;
     }
 
@@ -3285,8 +3414,14 @@ void FrameLoader::didFirstVisuallyNonEmptyLayout()
 
 void FrameLoader::frameLoadCompleted()
 {
+    // Note: Can be called multiple times.
+
     m_client->frameLoadCompleted();
 
+    // Even if already complete, we might have set a previous item on a frame that
+    // didn't do any data loading on the past transaction. Make sure to clear these out.
+    m_previousHistoryItem = 0;
+
     // After a canceled provisional load, firstLayoutDone is false.
     // Reset it to true if we're displaying a page.
     if (m_documentLoader)
@@ -3298,11 +3433,6 @@ bool FrameLoader::firstLayoutDone() const
     return m_firstLayoutDone;
 }
 
-bool FrameLoader::isQuickRedirectComing() const
-{
-    return m_quickRedirectComing;
-}
-
 void FrameLoader::detachChildren()
 {
     // FIXME: Is it really necessary to do this in reverse order?
@@ -3313,6 +3443,18 @@ void FrameLoader::detachChildren()
     }
 }
 
+void FrameLoader::closeAndRemoveChild(Frame* child)
+{
+    child->tree()->detachFromParent();
+
+    child->setView(0);
+    if (child->ownerElement())
+        child->page()->decrementFrameCount();
+    child->pageDestroyed();
+
+    m_frame->tree()->removeChild(child);
+}
+
 void FrameLoader::recursiveCheckLoadComplete()
 {
     Vector<RefPtr<Frame>, 10> frames;
@@ -3349,36 +3491,6 @@ int FrameLoader::numPendingOrLoadingRequests(bool recurse) const
     return count;
 }
 
-FrameLoaderClient* FrameLoader::client() const
-{
-    return m_client;
-}
-
-void FrameLoader::submitForm(const FrameLoadRequest& request, Event* event)
-{
-    // FIXME: We'd like to remove this altogether and fix the multiple form submission issue another way.
-    // We do not want to submit more than one form from the same page,
-    // nor do we want to submit a single form more than once.
-    // This flag prevents these from happening; not sure how other browsers prevent this.
-    // The flag is reset in each time we start handle a new mouse or key down event, and
-    // also in setView since this part may get reused for a page from the back/forward cache.
-    // The form multi-submit logic here is only needed when we are submitting a form that affects this frame.
-    // FIXME: Frame targeting is only one of the ways the submission could end up doing something other
-    // than replacing this frame's content, so this check is flawed. On the other hand, the check is hardly
-    // needed any more now that we reset m_submittedFormURL on each mouse or key down event.
-    Frame* target = m_frame->tree()->find(request.frameName());
-    if (m_frame->tree()->isDescendantOf(target)) {
-        if (m_submittedFormURL == request.resourceRequest().url())
-            return;
-        m_submittedFormURL = request.resourceRequest().url();
-    }
-
-    // FIXME: We should probably call userGestureHint() to tell whether this form submission was the result of a user gesture.
-    loadFrameRequestWithFormAndValues(request, false, event, m_formAboutToBeSubmitted.get(), m_formValuesAboutToBeSubmitted);
-
-    clearRecordedFormValues();
-}
-
 String FrameLoader::userAgent(const KURL& url) const
 {
     return m_client->userAgent(url);
@@ -3386,9 +3498,6 @@ String FrameLoader::userAgent(const KURL& url) const
 
 void FrameLoader::tokenizerProcessedData()
 {
-//    ASSERT(m_frame->page());
-//    ASSERT(m_frame->document());
-
     checkCompleted();
 }
 
@@ -3400,8 +3509,7 @@ void FrameLoader::handledOnloadEvents()
 void FrameLoader::frameDetached()
 {
     stopAllLoaders();
-    if (Document* document = m_frame->document())
-        document->stopActiveDOMObjects();
+    m_frame->document()->stopActiveDOMObjects();
     detachFromParent();
 }
 
@@ -3421,7 +3529,7 @@ void FrameLoader::detachFromParent()
     setDocumentLoader(0);
     m_client->detachedFromParent3();
     if (Frame* parent = m_frame->tree()->parent()) {
-        parent->tree()->removeChild(m_frame);
+        parent->loader()->closeAndRemoveChild(m_frame);
         parent->loader()->scheduleCheckCompleted();
     } else {
         m_frame->setView(0);
@@ -3441,6 +3549,19 @@ void FrameLoader::addExtraFieldsToMainResourceRequest(ResourceRequest& request)
 
 void FrameLoader::addExtraFieldsToRequest(ResourceRequest& request, FrameLoadType loadType, bool mainResource, bool cookiePolicyURLFromRequest)
 {
+    // Don't set the cookie policy URL if it's already been set.
+    // But make sure to set it on all requests, as it has significance beyond the cookie policy for all protocols (<rdar://problem/6616664>).
+    if (request.firstPartyForCookies().isEmpty()) {
+        if (mainResource && (isLoadingMainFrame() || cookiePolicyURLFromRequest))
+            request.setFirstPartyForCookies(request.url());
+        else if (Document* document = m_frame->document())
+            request.setFirstPartyForCookies(document->firstPartyForCookies());
+    }
+
+    // The remaining modifications are only necessary for HTTP and HTTPS.
+    if (!request.url().isEmpty() && !request.url().protocolInHTTPFamily())
+        return;
+
     applyUserAgent(request);
     
     if (loadType == FrameLoadTypeReload) {
@@ -3452,16 +3573,8 @@ void FrameLoader::addExtraFieldsToRequest(ResourceRequest& request, FrameLoadTyp
         request.setHTTPHeaderField("Pragma", "no-cache");
     }
     
-    // Don't set the cookie policy URL if it's already been set.
-    if (request.mainDocumentURL().isEmpty()) {
-        if (mainResource && (isLoadingMainFrame() || cookiePolicyURLFromRequest))
-            request.setMainDocumentURL(request.url());
-        else if (Page* page = m_frame->page())
-            request.setMainDocumentURL(page->mainFrame()->loader()->url());
-    }
-    
     if (mainResource)
-        request.setHTTPAccept("application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5");
+        request.setHTTPAccept(defaultAcceptHeader);
 
     // Make sure we send the Origin header.
     addHTTPOriginIfNeeded(request, String());
@@ -3505,8 +3618,7 @@ void FrameLoader::committedLoad(DocumentLoader* loader, const char* data, int le
     m_client->committedLoad(loader, data, length);
 }
 
-void FrameLoader::loadPostRequest(const ResourceRequest& inRequest, const String& referrer, const String& frameName,
-    Event* event, PassRefPtr<FormState> prpFormState)
+void FrameLoader::loadPostRequest(const ResourceRequest& inRequest, const String& referrer, const String& frameName, bool lockHistory, FrameLoadType loadType, PassRefPtr<Event> event, PassRefPtr<FormState> prpFormState)
 {
     RefPtr<FormState> formState = prpFormState;
 
@@ -3533,29 +3645,22 @@ void FrameLoader::loadPostRequest(const ResourceRequest& inRequest, const String
     workingResourceRequest.setHTTPMethod("POST");
     workingResourceRequest.setHTTPBody(formData);
     workingResourceRequest.setHTTPContentType(contentType);
-    addExtraFieldsToRequest(workingResourceRequest, FrameLoadTypeStandard, true, true);
+    addExtraFieldsToRequest(workingResourceRequest, loadType, true, true);
 
-    NavigationAction action(url, FrameLoadTypeStandard, true, event);
+    NavigationAction action(url, loadType, true, event);
 
     if (!frameName.isEmpty()) {
-        if (Frame* targetFrame = findFrameForNavigation(frameName))
-            targetFrame->loader()->loadWithNavigationAction(workingResourceRequest, action, FrameLoadTypeStandard, formState.release());
+        // The search for a target frame is done earlier in the case of form submission.
+        if (Frame* targetFrame = formState ? 0 : findFrameForNavigation(frameName))
+            targetFrame->loader()->loadWithNavigationAction(workingResourceRequest, action, lockHistory, loadType, formState.release());
         else
             checkNewWindowPolicy(action, workingResourceRequest, formState.release(), frameName);
     } else
-        loadWithNavigationAction(workingResourceRequest, action, FrameLoadTypeStandard, formState.release());    
-}
-
-void FrameLoader::loadEmptyDocumentSynchronously()
-{
-    ResourceRequest request(KURL(""));
-    load(request);
+        loadWithNavigationAction(workingResourceRequest, action, lockHistory, loadType, formState.release());    
 }
 
-unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& request, ResourceError& error, ResourceResponse& response, Vector<char>& data)
+unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& request, StoredCredentials storedCredentials, ResourceError& error, ResourceResponse& response, Vector<char>& data)
 {
-    // Since this is a subresource, we can load any URL (we ignore the return value).
-    // But we still want to know whether we should hide the referrer or not, so we call the canLoad method.
     String referrer = m_outgoingReferrer;
     if (shouldHideReferrer(request.url(), referrer))
         referrer = String();
@@ -3573,7 +3678,7 @@ unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& requ
     addHTTPOriginIfNeeded(initialRequest, outgoingOrigin());
 
     if (Page* page = m_frame->page())
-        initialRequest.setMainDocumentURL(page->mainFrame()->loader()->documentLoader()->request().url());
+        initialRequest.setFirstPartyForCookies(page->mainFrame()->loader()->documentLoader()->request().url());
     initialRequest.setHTTPUserAgent(client()->userAgent(request.url()));
 
     unsigned long identifier = 0;    
@@ -3593,7 +3698,7 @@ unsigned long FrameLoader::loadResourceSynchronously(const ResourceRequest& requ
                 error = cannotShowURLError(newRequest);
         } else {
 #endif
-            ResourceHandle::loadResourceSynchronously(newRequest, error, response, data, m_frame);
+            ResourceHandle::loadResourceSynchronously(newRequest, storedCredentials, error, response, data, m_frame);
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
             // If normal loading results in a redirect to a resource with another origin (indicative of a captive portal), or a 4xx or 5xx status code or equivalent,
@@ -3651,6 +3756,11 @@ void FrameLoader::didFailToLoad(ResourceLoader* loader, const ResourceError& err
         m_client->dispatchDidFailLoading(loader->documentLoader(), loader->identifier(), error);
 }
 
+void FrameLoader::didLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString)
+{
+    m_client->dispatchDidLoadResourceByXMLHttpRequest(identifier, sourceString);
+}
+
 const ResourceRequest& FrameLoader::originalRequest() const
 {
     return activeDocumentLoader()->originalRequestCopy();
@@ -3672,8 +3782,8 @@ void FrameLoader::receivedMainResourceError(const ResourceError& error, bool isC
     }
     
     if (m_state == FrameStateProvisional && m_provisionalDocumentLoader) {
-        KURL failedURL = m_provisionalDocumentLoader->originalRequestCopy().url();
-        didNotOpenURL(failedURL);
+        if (m_submittedFormURL == m_provisionalDocumentLoader->originalRequestCopy().url())
+            m_submittedFormURL = KURL();
             
         // We might have made a page cache item, but now we're bailing out due to an error before we ever
         // transitioned to the new page (before WebFrameState == commit).  The goal here is to restore any state
@@ -3702,10 +3812,7 @@ void FrameLoader::callContinueFragmentScrollAfterNavigationPolicy(void* argument
 
 void FrameLoader::continueFragmentScrollAfterNavigationPolicy(const ResourceRequest& request, bool shouldContinue)
 {
-    // FIXME:
-    // some functions check m_quickRedirectComing, and others check for
-    // FrameLoadTypeRedirectWithLockedHistory.  
-    bool isRedirect = m_quickRedirectComing || m_policyLoadType == FrameLoadTypeRedirectWithLockedHistory;
+    bool isRedirect = m_quickRedirectComing || m_policyLoadType == FrameLoadTypeRedirectWithLockedBackForwardList;
     m_quickRedirectComing = false;
 
     if (!shouldContinue)
@@ -3758,42 +3865,7 @@ bool FrameLoader::shouldScrollToAnchor(bool isFormSubmission, FrameLoadType load
         && !shouldReload(this->url(), url)
         // We don't want to just scroll if a link from within a
         // frameset is trying to reload the frameset into _top.
-        && !m_frame->isFrameSet();
-}
-
-void FrameLoader::opened()
-{
-    if (m_loadType == FrameLoadTypeStandard && m_documentLoader->isClientRedirect())
-        updateHistoryForClientRedirect();
-
-    if (m_documentLoader->isLoadingFromCachedPage()) {
-        m_frame->document()->documentDidBecomeActive();
-        
-        // Force a layout to update view size and thereby update scrollbars.
-        m_client->forceLayout();
-
-        const ResponseVector& responses = m_documentLoader->responses();
-        size_t count = responses.size();
-        for (size_t i = 0; i < count; i++) {
-            const ResourceResponse& response = responses[i];
-            // FIXME: If the WebKit client changes or cancels the request, this is not respected.
-            ResourceError error;
-            unsigned long identifier;
-            ResourceRequest request(response.url());
-            requestFromDelegate(request, identifier, error);
-            // FIXME: If we get a resource with more than 2B bytes, this code won't do the right thing.
-            // However, with today's computers and networking speeds, this won't happen in practice.
-            // Could be an issue with a giant local file.
-            sendRemainingDelegateMessages(identifier, response, static_cast<int>(response.expectedContentLength()), error);
-        }
-        
-        pageCache()->remove(m_currentHistoryItem.get());
-
-        m_documentLoader->setPrimaryLoadComplete(true);
-
-        // FIXME: Why only this frame and not parent frames?
-        checkLoadCompleteForThisFrame();
-    }
+        && !m_frame->document()->isFrameSet();
 }
 
 void FrameLoader::checkNewWindowPolicy(const NavigationAction& action, const ResourceRequest& request,
@@ -3944,7 +4016,14 @@ void FrameLoader::continueLoadAfterNavigationPolicy(const ResourceRequest&, Pass
     // might detach the current FrameLoader, in which case we should bail on this newly defunct load. 
     if (!m_frame->page())
         return;
-        
+
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    if (Page* page = m_frame->page()) {
+        if (page->mainFrame() == m_frame)
+            page->inspectorController()->resumeDebugger();
+    }
+#endif
+
     setProvisionalDocumentLoader(m_policyDocumentLoader.get());
     m_loadType = type;
     setState(FrameStateProvisional);
@@ -3985,7 +4064,7 @@ void FrameLoader::continueLoadAfterNewWindowPolicy(const ResourceRequest& reques
     mainFrame->loader()->setOpenedByDOM();
     mainFrame->loader()->m_client->dispatchShow();
     mainFrame->loader()->setOpener(frame.get());
-    mainFrame->loader()->loadWithNavigationAction(request, NavigationAction(), FrameLoadTypeStandard, formState);
+    mainFrame->loader()->loadWithNavigationAction(request, NavigationAction(), false, FrameLoadTypeStandard, formState);
 }
 
 void FrameLoader::sendRemainingDelegateMessages(unsigned long identifier, const ResourceResponse& response, int length, const ResourceError& error)
@@ -4059,6 +4138,24 @@ void FrameLoader::applyUserAgent(ResourceRequest& request)
     request.setHTTPUserAgent(userAgent);
 }
 
+bool FrameLoader::shouldInterruptLoadForXFrameOptions(const String& content, const KURL& url)
+{
+    Frame* topFrame = m_frame->tree()->top();
+    if (m_frame == topFrame)
+        return false;
+
+    if (equalIgnoringCase(content, "deny"))
+        return true;
+
+    if (equalIgnoringCase(content, "sameorigin")) {
+        RefPtr<SecurityOrigin> origin = SecurityOrigin::create(url);
+        if (!origin->isSameSchemeHostPort(topFrame->document()->securityOrigin()))
+            return true;
+    }
+
+    return false;
+}
+
 bool FrameLoader::canGoBackOrForward(int distance) const
 {
     if (Page* page = m_frame->page()) {
@@ -4079,28 +4176,6 @@ int FrameLoader::getHistoryLength()
     return 0;
 }
 
-KURL FrameLoader::historyURL(int distance)
-{
-    if (Page* page = m_frame->page()) {
-        BackForwardList* list = page->backForwardList();
-        HistoryItem* item = list->itemAtIndex(distance);
-        if (!item) {
-            if (distance > 0) {
-                int forwardListCount = list->forwardListCount();
-                if (forwardListCount > 0)
-                    item = list->itemAtIndex(forwardListCount);
-            } else {
-                int backListCount = list->backListCount();
-                if (backListCount > 0)
-                    item = list->itemAtIndex(-backListCount);
-            }
-        }
-        if (item)
-            return item->url();
-    }
-    return KURL();
-}
-
 void FrameLoader::addHistoryItemForFragmentScroll()
 {
     addBackForwardItemClippedAtTarget(false);
@@ -4117,12 +4192,11 @@ bool FrameLoader::loadProvisionalItemFromCachedPage()
 
 void FrameLoader::cachePageForHistoryItem(HistoryItem* item)
 {
+    if (!canCachePage() || item->isInPageCache())
+        return;
+
     if (Page* page = m_frame->page()) {
         RefPtr<CachedPage> cachedPage = CachedPage::create(page);
-        cachedPage->setTimeStampToNow();
-        cachedPage->setDocumentLoader(documentLoader());
-        m_client->savePlatformDataToCachedPage(cachedPage.get());
-
         pageCache()->add(item, cachedPage.release());
     }
 }
@@ -4193,6 +4267,11 @@ PassRefPtr<HistoryItem> FrameLoader::createHistoryItem(bool useOriginal)
 
 void FrameLoader::addBackForwardItemClippedAtTarget(bool doClip)
 {
+    // In the case of saving state about a page with frames, we store a tree of items that mirrors the frame tree.  
+    // The item that was the target of the user's navigation is designated as the "targetItem".  
+    // When this function is called with doClip=true we're able to create the whole tree except for the target's children, 
+    // which will be loaded in the future. That part of the tree will be filled out as the child loads are committed.
+
     Page* page = m_frame->page();
     if (!page)
         return;
@@ -4242,9 +4321,9 @@ PassRefPtr<HistoryItem> FrameLoader::createHistoryItemTree(Frame* targetFrame, b
 Frame* FrameLoader::findFrameForNavigation(const AtomicString& name)
 {
     Frame* frame = m_frame->tree()->find(name);
-    if (shouldAllowNavigation(frame))
-        return frame;  
-    return 0;
+    if (!shouldAllowNavigation(frame))
+        return 0;  
+    return frame;
 }
 
 void FrameLoader::saveScrollPositionAndViewStateToItem(HistoryItem* item)
@@ -4334,7 +4413,7 @@ void FrameLoader::saveDocumentState()
     Document* document = m_frame->document();
     ASSERT(document);
     
-    if (document && item->isCurrentDocument(document)) {
+    if (item->isCurrentDocument(document)) {
         LOG(Loading, "WebCoreLoading %s: saving form state to %p", m_frame->tree()->name().string().utf8().data(), item);
         item->setDocumentState(document->formElementsState());
     }
@@ -4357,13 +4436,16 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
     // Note if we have child frames we do a real reload, since the child frames might not
     // match our current frame structure, or they might not have the right content.  We could
     // check for all that as an additional optimization.
-    // We also do not do anchor-style navigation if we're posting a form.
-    
+    // We also do not do anchor-style navigation if we're posting a form or navigating from
+    // a page that was resulted from a form post.
+    bool shouldScroll = !formData && !(m_currentHistoryItem && m_currentHistoryItem->formData()) && urlsMatchItem(item);
+
 #if ENABLE(WML)
-    if (!formData && urlsMatchItem(item) && !m_frame->document()->isWMLDocument()) {
-#else
-    if (!formData && urlsMatchItem(item)) {
+    if (m_frame->document()->isWMLDocument())
+        shouldScroll = false;
 #endif
+
+    if (shouldScroll) {
         // Must do this maintenance here, since we don't go through a real page reload
         saveScrollPositionAndViewStateToItem(m_currentHistoryItem.get());
 
@@ -4417,6 +4499,9 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
             bool addedExtraFields = false;
             ResourceRequest request(itemURL);
 
+            if (!item->referrer().isNull())
+                request.setHTTPReferrer(item->referrer());
+            
             // If this was a repost that failed the page cache, we might try to repost the form.
             NavigationAction action;
             if (formData) {
@@ -4424,10 +4509,9 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
                 formData->generateFiles(m_frame->page()->chrome()->client());
 
                 request.setHTTPMethod("POST");
-                request.setHTTPReferrer(item->formReferrer());
                 request.setHTTPBody(formData);
                 request.setHTTPContentType(item->formContentType());
-                RefPtr<SecurityOrigin> securityOrigin = SecurityOrigin::createFromString(item->formReferrer());
+                RefPtr<SecurityOrigin> securityOrigin = SecurityOrigin::createFromString(item->referrer());
                 addHTTPOriginIfNeeded(request, securityOrigin->toString());
         
                 // Make sure to add extra fields to the request after the Origin header is added for the FormData case.
@@ -4462,12 +4546,9 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
                             request.setCachePolicy(ReturnCacheDataElseLoad);
                         break;
                     case FrameLoadTypeStandard:
-                    case FrameLoadTypeRedirectWithLockedHistory:
-                        // no-op: leave as protocol default
-                        // FIXME:  I wonder if we ever hit this case
+                    case FrameLoadTypeRedirectWithLockedBackForwardList:
                         break;
                     case FrameLoadTypeSame:
-                    case FrameLoadTypeReloadAllowingStaleData:
                     default:
                         ASSERT_NOT_REACHED();
                 }
@@ -4478,7 +4559,7 @@ void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
             if (!addedExtraFields)
                 addExtraFieldsToRequest(request, m_loadType, true, formData);
 
-            loadWithNavigationAction(request, action, loadType, 0);
+            loadWithNavigationAction(request, action, false, loadType, 0);
         }
     }
 }
@@ -4575,10 +4656,10 @@ void FrameLoader::recursiveGoToItem(HistoryItem* item, HistoryItem* fromItem, Fr
         
         int size = childItems.size();
         for (int i = 0; i < size; ++i) {
-            String childName = childItems[i]->target();
-            HistoryItem* fromChildItem = fromItem->childItemWithName(childName);
+            String childFrameName = childItems[i]->target();
+            HistoryItem* fromChildItem = fromItem->childItemWithTarget(childFrameName);
             ASSERT(fromChildItem || fromItem->isTargetItem());
-            Frame* childFrame = m_frame->tree()->child(childName);
+            Frame* childFrame = m_frame->tree()->child(childFrameName);
             ASSERT(childFrame);
             childFrame->loader()->recursiveGoToItem(childItems[i].get(), fromChildItem, type);
         }
@@ -4596,9 +4677,10 @@ bool FrameLoader::childFramesMatchItem(HistoryItem* item) const
         return false;
     
     unsigned size = childItems.size();
-    for (unsigned i = 0; i < size; ++i)
+    for (unsigned i = 0; i < size; ++i) {
         if (!m_frame->tree()->child(childItems[i]->target()))
             return false;
+    }
     
     // Found matches for all item targets
     return true;
@@ -4618,21 +4700,15 @@ void FrameLoader::updateHistoryForStandardLoad()
     bool needPrivacy = !settings || settings->privateBrowsingEnabled();
     const KURL& historyURL = documentLoader()->urlForHistory();
 
-    // If the navigation occured during load and this is a subframe, update the current
-    // back/forward item rather than adding a new one and don't add the new URL to global
-    // history at all. But do add it to visited links. <rdar://problem/5333496>
-    bool frameNavigationDuringLoad = false;
-    if (m_navigationDuringLoad) {
-        HTMLFrameOwnerElement* owner = m_frame->ownerElement();
-        frameNavigationDuringLoad = owner && !owner->createdByParser();
-        m_navigationDuringLoad = false;
-    }
-
-    if (!frameNavigationDuringLoad && !documentLoader()->isClientRedirect()) {
+    if (!documentLoader()->isClientRedirect()) {
         if (!historyURL.isEmpty()) {
             addBackForwardItemClippedAtTarget(true);
-            if (!needPrivacy)
+            if (!needPrivacy) {
                 m_client->updateGlobalHistory();
+                m_documentLoader->setDidCreateGlobalHistoryEntry(true);
+                if (m_documentLoader->unreachableURL().isEmpty())
+                    m_client->updateGlobalHistoryRedirectLinks();
+            }
             if (Page* page = m_frame->page())
                 page->setGlobalHistoryItem(needPrivacy ? 0 : page->backForwardList()->currentItem());
         }
@@ -4644,6 +4720,9 @@ void FrameLoader::updateHistoryForStandardLoad()
     if (!historyURL.isEmpty() && !needPrivacy) {
         if (Page* page = m_frame->page())
             page->group().addVisitedLink(historyURL);
+
+        if (!m_documentLoader->didCreateGlobalHistoryEntry() && documentLoader()->unreachableURL().isEmpty() && !url().isEmpty())
+            m_client->updateGlobalHistoryRedirectLinks();
     }
 }
 
@@ -4701,11 +4780,11 @@ void FrameLoader::updateHistoryForReload()
     }
 }
 
-void FrameLoader::updateHistoryForRedirectWithLockedHistory()
+void FrameLoader::updateHistoryForRedirectWithLockedBackForwardList()
 {
 #if !LOG_DISABLED
     if (documentLoader())
-        LOG(History, "WebCoreHistory: Updating History for internal load in frame %s", documentLoader()->title().utf8().data());
+        LOG(History, "WebCoreHistory: Updating History for redirect load in frame %s", documentLoader()->title().utf8().data());
 #endif
     
     Settings* settings = m_frame->settings();
@@ -4714,10 +4793,14 @@ void FrameLoader::updateHistoryForRedirectWithLockedHistory()
 
     if (documentLoader()->isClientRedirect()) {
         if (!m_currentHistoryItem && !m_frame->tree()->parent()) {
-            addBackForwardItemClippedAtTarget(true);
             if (!historyURL.isEmpty()) {
-                if (!needPrivacy)
+                addBackForwardItemClippedAtTarget(true);
+                if (!needPrivacy) {
                     m_client->updateGlobalHistory();
+                    m_documentLoader->setDidCreateGlobalHistoryEntry(true);
+                    if (m_documentLoader->unreachableURL().isEmpty())
+                        m_client->updateGlobalHistoryRedirectLinks();
+                }
                 if (Page* page = m_frame->page())
                     page->setGlobalHistoryItem(needPrivacy ? 0 : page->backForwardList()->currentItem());
             }
@@ -4729,12 +4812,15 @@ void FrameLoader::updateHistoryForRedirectWithLockedHistory()
     } else {
         Frame* parentFrame = m_frame->tree()->parent();
         if (parentFrame && parentFrame->loader()->m_currentHistoryItem)
-            parentFrame->loader()->m_currentHistoryItem->addChildItem(createHistoryItem(true));
+            parentFrame->loader()->m_currentHistoryItem->setChildItem(createHistoryItem(true));
     }
 
     if (!historyURL.isEmpty() && !needPrivacy) {
         if (Page* page = m_frame->page())
             page->group().addVisitedLink(historyURL);
+
+        if (!m_documentLoader->didCreateGlobalHistoryEntry() && documentLoader()->unreachableURL().isEmpty() && !url().isEmpty())
+            m_client->updateGlobalHistoryRedirectLinks();
     }
 }
 
@@ -4784,38 +4870,16 @@ void FrameLoader::saveDocumentAndScrollState()
     }
 }
 
-// FIXME: These 6 setter/getters are here for a dwindling number of users in WebKit, WebFrame
-// being the primary one.  After they're no longer needed there, they can be removed!
 HistoryItem* FrameLoader::currentHistoryItem()
 {
     return m_currentHistoryItem.get();
 }
 
-HistoryItem* FrameLoader::previousHistoryItem()
-{
-    return m_previousHistoryItem.get();
-}
-
-HistoryItem* FrameLoader::provisionalHistoryItem()
-{
-    return m_provisionalHistoryItem.get();
-}
-
 void FrameLoader::setCurrentHistoryItem(PassRefPtr<HistoryItem> item)
 {
     m_currentHistoryItem = item;
 }
 
-void FrameLoader::setPreviousHistoryItem(PassRefPtr<HistoryItem> item)
-{
-    m_previousHistoryItem = item;
-}
-
-void FrameLoader::setProvisionalHistoryItem(PassRefPtr<HistoryItem> item)
-{
-    m_provisionalHistoryItem = item;
-}
-
 void FrameLoader::setMainDocumentError(DocumentLoader* loader, const ResourceError& error)
 {
     m_client->setMainDocumentError(loader, error);
@@ -4982,6 +5046,11 @@ String FrameLoader::referrer() const
     return documentLoader()->request().httpReferrer();
 }
 
+void FrameLoader::dispatchDocumentElementAvailable()
+{
+    m_client->documentElementAvailable();
+}
+
 void FrameLoader::dispatchWindowObjectAvailable()
 {
     if (!m_frame->script()->isEnabled() || !m_frame->script()->haveWindowShell())
@@ -4997,27 +5066,39 @@ void FrameLoader::dispatchWindowObjectAvailable()
     }
 }
 
-Widget* FrameLoader::createJavaAppletWidget(const IntSize& size, Element* element, const HashMap<String, String>& args)
+Widget* FrameLoader::createJavaAppletWidget(const IntSize& size, HTMLAppletElement* element, const HashMap<String, String>& args)
 {
     String baseURLString;
+    String codeBaseURLString;
     Vector<String> paramNames;
     Vector<String> paramValues;
     HashMap<String, String>::const_iterator end = args.end();
     for (HashMap<String, String>::const_iterator it = args.begin(); it != end; ++it) {
         if (equalIgnoringCase(it->first, "baseurl"))
             baseURLString = it->second;
+        else if (equalIgnoringCase(it->first, "codebase"))
+            codeBaseURLString = it->second;
         paramNames.append(it->first);
         paramValues.append(it->second);
     }
-    
+
+    if (!codeBaseURLString.isEmpty()) {
+        KURL codeBaseURL = completeURL(codeBaseURLString);
+        if (!canLoad(codeBaseURL, String(), element->document())) {
+            FrameLoader::reportLocalLoadFailed(m_frame, codeBaseURL.string());
+            return 0;
+        }
+    }
+
     if (baseURLString.isEmpty())
         baseURLString = m_frame->document()->baseURL().string();
     KURL baseURL = completeURL(baseURLString);
 
     Widget* widget = m_client->createJavaAppletWidget(size, element, baseURL, paramNames, paramValues);
-    if (widget)
-        m_containsPlugIns = true;
-    
+    if (!widget)
+        return 0;
+
+    m_containsPlugIns = true;
     return widget;
 }
 
@@ -5037,67 +5118,6 @@ void FrameLoader::didChangeTitle(DocumentLoader* loader)
     }
 }
 
-void FrameLoader::continueLoadWithData(SharedBuffer* buffer, const String& mimeType, const String& textEncoding, const KURL& url)
-{
-    m_responseMIMEType = mimeType;
-    didOpenURL(url);
-
-    String encoding;
-    if (m_frame)
-        encoding = documentLoader()->overrideEncoding();
-    bool userChosen = !encoding.isNull();
-    if (encoding.isNull())
-        encoding = textEncoding;
-    setEncoding(encoding, userChosen);
-
-    ASSERT(m_frame->document());
-
-    addData(buffer->data(), buffer->size());
-}
-
-void FrameLoader::registerURLSchemeAsLocal(const String& scheme)
-{
-    localSchemes().add(scheme);
-}
-
-bool FrameLoader::shouldTreatURLAsLocal(const String& url)
-{
-    // This avoids an allocation of another String and the HashSet contains()
-    // call for the file: and http: schemes.
-    if (url.length() >= 5) {
-        const UChar* s = url.characters();
-        if (s[0] == 'h' && s[1] == 't' && s[2] == 't' && s[3] == 'p' && s[4] == ':')
-            return false;
-        if (s[0] == 'f' && s[1] == 'i' && s[2] == 'l' && s[3] == 'e' && s[4] == ':')
-            return true;
-    }
-
-    int loc = url.find(':');
-    if (loc == -1)
-        return false;
-
-    String scheme = url.left(loc);
-    return localSchemes().contains(scheme);
-}
-
-bool FrameLoader::shouldTreatSchemeAsLocal(const String& scheme)
-{
-    // This avoids an allocation of another String and the HashSet contains()
-    // call for the file: and http: schemes.
-    if (scheme.length() == 4) {
-        const UChar* s = scheme.characters();
-        if (s[0] == 'h' && s[1] == 't' && s[2] == 't' && s[3] == 'p')
-            return false;
-        if (s[0] == 'f' && s[1] == 'i' && s[2] == 'l' && s[3] == 'e')
-            return true;
-    }
-
-    if (scheme.isEmpty())
-        return false;
-
-    return localSchemes().contains(scheme);
-}
-
 void FrameLoader::dispatchDidCommitLoad()
 {
     if (m_creatingInitialEmptyDocument)
@@ -5129,7 +5149,7 @@ void FrameLoader::dispatchWillSendRequest(DocumentLoader* loader, unsigned long
     m_client->dispatchWillSendRequest(loader, identifier, request, redirectResponse);
 
     // If the URL changed, then we want to put that new URL in the "did tell client" set too.
-    if (oldRequestURL != request.url().string().impl())
+    if (!request.isNull() && oldRequestURL != request.url().string().impl())
         m_documentLoader->didTellClientAboutLoad(request.url());
 
     if (Page* page = m_frame->page())
@@ -5187,124 +5207,9 @@ void FrameLoader::tellClientAboutPastMemoryCacheLoads()
     }
 }
 
-#if USE(LOW_BANDWIDTH_DISPLAY)
-
-bool FrameLoader::addLowBandwidthDisplayRequest(CachedResource* cache)
-{
-    if (m_frame->document()->inLowBandwidthDisplay() == false)
-        return false;
-        
-    // if cache is loaded, don't add to the list, where notifyFinished() is expected. 
-    if (cache->isLoaded())
-        return false;
-                
-    switch (cache->type()) {
-        case CachedResource::CSSStyleSheet:
-        case CachedResource::Script:
-            m_needToSwitchOutLowBandwidthDisplay = true;
-            m_externalRequestsInLowBandwidthDisplay.add(cache);
-            cache->addClient(this);
-            return true;
-        case CachedResource::ImageResource:
-        case CachedResource::FontResource:
-#if ENABLE(XSLT)
-        case CachedResource::XSLStyleSheet:
-#endif
-#if ENABLE(XBL)
-        case CachedResource::XBLStyleSheet:
-#endif
-            return false;
-    }
-
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
-void FrameLoader::removeAllLowBandwidthDisplayRequests()
-{
-    HashSet<CachedResource*>::iterator end = m_externalRequestsInLowBandwidthDisplay.end();
-    for (HashSet<CachedResource*>::iterator it = m_externalRequestsInLowBandwidthDisplay.begin(); it != end; ++it)
-        (*it)->removeClient(this);
-    m_externalRequestsInLowBandwidthDisplay.clear();
-}
-    
-void FrameLoader::notifyFinished(CachedResource* script)
-{
-    HashSet<CachedResource*>::iterator it = m_externalRequestsInLowBandwidthDisplay.find(script);
-    if (it != m_externalRequestsInLowBandwidthDisplay.end()) {
-        (*it)->removeClient(this);
-        m_externalRequestsInLowBandwidthDisplay.remove(it);
-        switchOutLowBandwidthDisplayIfReady();        
-    }
-}
-
-void FrameLoader::switchOutLowBandwidthDisplayIfReady()
+bool FrameLoaderClient::hasHTMLView() const
 {
-    RefPtr<Document> oldDoc = m_frame->document();
-    if (oldDoc->inLowBandwidthDisplay()) {
-        if (!m_needToSwitchOutLowBandwidthDisplay) {
-            // no need to switch, just reset state
-            oldDoc->setLowBandwidthDisplay(false);
-            removeAllLowBandwidthDisplayRequests();        
-            m_pendingSourceInLowBandwidthDisplay = String();
-            m_finishedParsingDuringLowBandwidthDisplay = false;
-            return;
-        } else if (m_externalRequestsInLowBandwidthDisplay.isEmpty() || 
-            m_pendingSourceInLowBandwidthDisplay.length() > cMaxPendingSourceLengthInLowBandwidthDisplay) {
-            // clear the flag first
-            oldDoc->setLowBandwidthDisplay(false);
-            
-            // similar to clear(), should be refactored to share more code
-            oldDoc->cancelParsing();
-            oldDoc->detach();
-            if (m_frame->script()->isEnabled())
-                m_frame->script()->clearWindowShell();
-            if (m_frame->view())
-                m_frame->view()->clear();
-            
-            // similar to begin(), should be refactored to share more code
-            RefPtr<Document> newDoc = DOMImplementation::createDocument(m_responseMIMEType, m_frame, m_frame->inViewSourceMode());
-            m_frame->setDocument(newDoc);
-            newDoc->setURL(m_URL);
-            if (m_decoder)
-                newDoc->setDecoder(m_decoder.get());
-            restoreDocumentState();
-            dispatchWindowObjectAvailable();         
-            newDoc->implicitOpen();
-
-            // swap DocLoader ownership
-            DocLoader* docLoader = newDoc->docLoader();
-            newDoc->setDocLoader(oldDoc->docLoader());
-            newDoc->docLoader()->replaceDocument(newDoc.get());
-            docLoader->replaceDocument(oldDoc.get());
-            oldDoc->setDocLoader(docLoader);
-            
-            // drop the old doc            
-            oldDoc = 0;
-
-            // write decoded data to the new doc, similar to write()
-            if (m_pendingSourceInLowBandwidthDisplay.length()) {
-                if (m_decoder->encoding().usesVisualOrdering())
-                    newDoc->setVisuallyOrdered();                    
-                newDoc->recalcStyle(Node::Force);                
-                newDoc->tokenizer()->write(m_pendingSourceInLowBandwidthDisplay, true);
-            
-                if (m_finishedParsingDuringLowBandwidthDisplay)
-                    newDoc->finishParsing();
-            }
-
-            // update rendering
-            newDoc->updateRendering();
-                        
-            // reset states
-            removeAllLowBandwidthDisplayRequests();        
-            m_pendingSourceInLowBandwidthDisplay = String();
-            m_finishedParsingDuringLowBandwidthDisplay = false;
-            m_needToSwitchOutLowBandwidthDisplay = false;
-        }
-    }
+    return true;
 }
 
-#endif
-
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoader.h b/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
index dd55552..d96329f 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoader.h
@@ -31,29 +31,27 @@
 #define FrameLoader_h
 
 #include "CachePolicy.h"
-#include "FormState.h"
 #include "FrameLoaderTypes.h"
 #include "ResourceRequest.h"
+#include "ThreadableLoader.h"
 #include "Timer.h"
 
-#if USE(LOW_BANDWIDTH_DISPLAY)
-#include "CachedResourceClient.h"
-#endif
-
 namespace WebCore {
 
     class Archive;
     class AuthenticationChallenge;
+    class CachedFrame;
     class CachedPage;
     class CachedResource;
     class Document;
     class DocumentLoader;
-    class Element;
     class Event;
     class FormData;
+    class FormState;
     class Frame;
     class FrameLoaderClient;
     class HistoryItem;
+    class HTMLAppletElement;
     class HTMLFormElement;
     class HTMLFrameOwnerElement;
     class IconLoader;
@@ -64,6 +62,7 @@ namespace WebCore {
     class ResourceLoader;
     class ResourceResponse;
     class ScriptSourceCode;
+    class ScriptString;
     class ScriptValue;
     class SecurityOrigin;
     class SharedBuffer;
@@ -71,7 +70,6 @@ namespace WebCore {
     class TextResourceDecoder;
     class Widget;
 
-    struct FormSubmission;
     struct FrameLoadRequest;
     struct ScheduledRedirection;
     struct WindowFeatures;
@@ -113,11 +111,7 @@ namespace WebCore {
         void* m_argument;
     };
 
-    class FrameLoader : Noncopyable
-#if USE(LOW_BANDWIDTH_DISPLAY)
-        , private CachedResourceClient
-#endif
-    {
+    class FrameLoader : Noncopyable {
     public:
         FrameLoader(Frame*, FrameLoaderClient*);
         ~FrameLoader();
@@ -126,50 +120,42 @@ namespace WebCore {
 
         Frame* frame() const { return m_frame; }
 
-        // FIXME: This is not cool, people. We should aim to consolidate these variety of loading related methods into a smaller set,
-        // and try to reuse more of the same logic by extracting common code paths.
+        // FIXME: This is not cool, people. There are too many different functions that all start loads.
+        // We should aim to consolidate these into a smaller set of functions, and try to reuse more of
+        // the logic by extracting common code paths.
+
         void prepareForLoadStart();
         void setupForReplace();
         void setupForReplaceByMIMEType(const String& newMIMEType);
 
-        void loadWithDocumentLoader(DocumentLoader*, FrameLoadType, PassRefPtr<FormState>);         // Calls continueLoadAfterNavigationPolicy
-        void load(DocumentLoader*);                                                                 // Calls loadWithDocumentLoader   
-
-        void loadWithNavigationAction(const ResourceRequest&, const NavigationAction&,              // Calls loadWithDocumentLoader()
-            FrameLoadType, PassRefPtr<FormState>);
-
-        void loadPostRequest(const ResourceRequest& inRequest, const String& referrer,              // Called by loadFrameRequestWithFormAndValues(), calls loadWithNavigationAction
-            const String& frameName, Event* event, PassRefPtr<FormState> prpFormState);
-
-        void loadURL(const KURL& newURL, const String& referrer, const String& frameName,           // Called by loadFrameRequestWithFormAndValues(), calls loadWithNavigationAction or else dispatches to navigation policy delegate    
-            FrameLoadType, Event* event, PassRefPtr<FormState> prpFormState);                                                         
         void loadURLIntoChildFrame(const KURL&, const String& referer, Frame*);
 
-        void loadFrameRequestWithFormAndValues(const FrameLoadRequest&, bool lockHistory,           // Called by submitForm, calls loadPostRequest()
-            Event*, HTMLFormElement*, const HashMap<String, String>& formValues);
+        void loadFrameRequest(const FrameLoadRequest&, bool lockHistory, bool lockBackForwardList,  // Called by submitForm, calls loadPostRequest and loadURL.
+            PassRefPtr<Event>, PassRefPtr<FormState>);
 
-        void load(const ResourceRequest&);                                                          // Called by WebFrame, calls (ResourceRequest, SubstituteData)
-        void load(const ResourceRequest&, const SubstituteData&);                                   // Called both by WebFrame and internally, calls (DocumentLoader*)
-        void load(const ResourceRequest&, const String& frameName);                                 // Called by WebPluginController
+        void load(const ResourceRequest&, bool lockHistory);                                        // Called by WebFrame, calls load(ResourceRequest, SubstituteData).
+        void load(const ResourceRequest&, const SubstituteData&, bool lockHistory);                 // Called both by WebFrame and internally, calls load(DocumentLoader*).
+        void load(const ResourceRequest&, const String& frameName, bool lockHistory);               // Called by WebPluginController.
         
-        void loadArchive(PassRefPtr<Archive> archive);
+        void loadArchive(PassRefPtr<Archive>);
 
-        // Returns true for any non-local URL. If Document parameter is supplied, its local load policy dictates,
+        // Returns true for any non-local URL. If document parameter is supplied, its local load policy dictates,
         // otherwise if referrer is non-empty and represents a local file, then the local load is allowed.
-        static bool canLoad(const KURL&, const String& referrer, const Document* theDocument = 0);
+        static bool canLoad(const KURL&, const String& referrer, const Document*);
+        static bool canLoad(const KURL&, const String& referrer, const SecurityOrigin* = 0);
         static void reportLocalLoadFailed(Frame*, const String& url);
 
-        static bool shouldHideReferrer(const KURL& url, const String& referrer);
+        static bool shouldHideReferrer(const KURL&, const String& referrer);
 
         // Called by createWindow in JSDOMWindowBase.cpp, e.g. to fulfill a modal dialog creation
         Frame* createWindow(FrameLoader* frameLoaderForFrameLookup, const FrameLoadRequest&, const WindowFeatures&, bool& created);
 
-        unsigned long loadResourceSynchronously(const ResourceRequest&, ResourceError&, ResourceResponse&, Vector<char>& data);
+        unsigned long loadResourceSynchronously(const ResourceRequest&, StoredCredentials, ResourceError&, ResourceResponse&, Vector<char>& data);
 
         bool canHandleRequest(const ResourceRequest&);
 
         // Also not cool.
-        void stopAllLoaders();
+        void stopAllLoaders(DatabasePolicy = DatabasePolicyStop);
         void stopForUserCancel(bool deferCheckLoadComplete = false);
 
         bool isLoadingMainResource() const { return m_isLoadingMainResource; }
@@ -180,13 +166,12 @@ namespace WebCore {
         String referrer() const;
         String outgoingReferrer() const;
         String outgoingOrigin() const;
-        void loadEmptyDocumentSynchronously();
 
         DocumentLoader* activeDocumentLoader() const;
-        DocumentLoader* documentLoader() const;
-        DocumentLoader* policyDocumentLoader() const;
-        DocumentLoader* provisionalDocumentLoader() const;
-        FrameState state() const;
+        DocumentLoader* documentLoader() const { return m_documentLoader.get(); }
+        DocumentLoader* policyDocumentLoader() const { return m_policyDocumentLoader.get(); }
+        DocumentLoader* provisionalDocumentLoader() const { return m_provisionalDocumentLoader.get(); }
+        FrameState state() const { return m_state; }
         static double timeOfLastCompletedLoad();
 
         bool shouldUseCredentialStorage(ResourceLoader*);
@@ -199,6 +184,7 @@ namespace WebCore {
         void didReceiveData(ResourceLoader*, const char*, int, int lengthReceived);
         void didFinishLoad(ResourceLoader*);
         void didFailToLoad(ResourceLoader*, const ResourceError&);
+        void didLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString);
         const ResourceRequest& originalRequest() const;
         const ResourceRequest& initialRequest() const;
         void receivedMainResourceError(const ResourceError&, bool isComplete);
@@ -223,14 +209,12 @@ namespace WebCore {
         bool representationExistsForURLScheme(const String& URLScheme);
         String generatedMIMETypeForURLScheme(const String& URLScheme);
 
-        void notifyIconChanged();
-
         void checkNavigationPolicy(const ResourceRequest&, NavigationPolicyDecisionFunction function, void* argument);
         void checkContentPolicy(const String& MIMEType, ContentPolicyDecisionFunction, void* argument);
         void cancelContentPolicyCheck();
 
         void reload(bool endToEndReload = false);
-        void reloadAllowingStaleData(const String& overrideEncoding);
+        void reloadWithOverrideEncoding(const String& overrideEncoding);
 
         void didReceiveServerRedirectForProvisionalLoadForFrame();
         void finishedLoadingDocument(DocumentLoader*);
@@ -245,55 +229,42 @@ namespace WebCore {
         void didChangeTitle(DocumentLoader*);
 
         FrameLoadType loadType() const;
-        CachePolicy cachePolicy() const;
+        CachePolicy subresourceCachePolicy() const;
 
         void didFirstLayout();
         bool firstLayoutDone() const;
 
         void didFirstVisuallyNonEmptyLayout();
 
-        void clientRedirectCancelledOrFinished(bool cancelWithLoadInProgress);
-        void clientRedirected(const KURL&, double delay, double fireDate, bool lockHistory, bool isJavaScriptFormAction);
-        bool shouldReload(const KURL& currentURL, const KURL& destinationURL);
 #if ENABLE(WML)
         void setForceReloadWmlDeck(bool);
 #endif
 
-        bool isQuickRedirectComing() const;
-
-        void sendRemainingDelegateMessages(unsigned long identifier, const ResourceResponse&, int length, const ResourceError&);
-        void requestFromDelegate(ResourceRequest&, unsigned long& identifier, ResourceError&);
         void loadedResourceFromMemoryCache(const CachedResource*);
         void tellClientAboutPastMemoryCacheLoads();
 
-        void recursiveCheckLoadComplete();
         void checkLoadComplete();
         void detachFromParent();
-        void detachChildren();
 
         void addExtraFieldsToSubresourceRequest(ResourceRequest&);
         void addExtraFieldsToMainResourceRequest(ResourceRequest&);
         
         static void addHTTPOriginIfNeeded(ResourceRequest&, String origin);
 
-        FrameLoaderClient* client() const;
+        FrameLoaderClient* client() const { return m_client; }
 
         void setDefersLoading(bool);
 
-        void changeLocation(const String& url, const String& referrer, bool lockHistory = true, bool userGesture = false, bool refresh = false);
-        void changeLocation(const KURL&, const String& referrer, bool lockHistory = true, bool userGesture = false, bool refresh = false);
-        void urlSelected(const ResourceRequest&, const String& target, Event*, bool lockHistory, bool userGesture);
-        void urlSelected(const FrameLoadRequest&, Event*, bool lockHistory);
-      
+        void changeLocation(const KURL&, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false, bool refresh = false);
+        void urlSelected(const ResourceRequest&, const String& target, PassRefPtr<Event>, bool lockHistory, bool lockBackForwardList, bool userGesture);
         bool requestFrame(HTMLFrameOwnerElement*, const String& url, const AtomicString& frameName);
-        Frame* loadSubframe(HTMLFrameOwnerElement*, const KURL&, const String& name, const String& referrer);
 
-        void submitForm(const char* action, const String& url, PassRefPtr<FormData>, const String& target, const String& contentType, const String& boundary, Event*);
-        void submitFormAgain();
-        void submitForm(const FrameLoadRequest&, Event*);
+        void submitForm(const char* action, const String& url,
+            PassRefPtr<FormData>, const String& target, const String& contentType, const String& boundary,
+            bool lockHistory, bool lockBackForwardList, PassRefPtr<Event>, PassRefPtr<FormState>);
 
         void stop();
-        void stopLoading(bool sendUnload);
+        void stopLoading(bool sendUnload, DatabasePolicy = DatabasePolicyStop);
         bool closeURL();
 
         void didExplicitOpen();
@@ -302,24 +273,21 @@ namespace WebCore {
         void commitIconURLToIconDatabase(const KURL&);
 
         KURL baseURL() const;
-        String baseTarget() const;
-        KURL dataURLBaseFromRequest(const ResourceRequest& request) const;
 
         bool isScheduledLocationChangePending() const { return m_scheduledRedirection && isLocationChange(*m_scheduledRedirection); }
         void scheduleHTTPRedirection(double delay, const String& url);
-        void scheduleLocationChange(const String& url, const String& referrer, bool lockHistory = true, bool userGesture = false);
+        void scheduleLocationChange(const String& url, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false);
         void scheduleRefresh(bool userGesture = false);
         void scheduleHistoryNavigation(int steps);
 
         bool canGoBackOrForward(int distance) const;
         void goBackOrForward(int distance);
         int getHistoryLength();
-        KURL historyURL(int distance);
 
         void begin();
         void begin(const KURL&, bool dispatchWindowObjectAvailable = true, SecurityOrigin* forcedSecurityOrigin = 0);
 
-        void write(const char* str, int len = -1, bool flush = false);
+        void write(const char* string, int length = -1, bool flush = false);
         void write(const String&);
         void end();
         void endIfNotLoadingMainResource();
@@ -327,24 +295,20 @@ namespace WebCore {
         void setEncoding(const String& encoding, bool userChosen);
         String encoding() const;
 
-        // Returns true if url is a JavaScript URL.
-        bool executeIfJavaScriptURL(const KURL& url, bool userGesture = false, bool replaceDocument = true);
-
         ScriptValue executeScript(const ScriptSourceCode&);
         ScriptValue executeScript(const String& script, bool forceUserGesture = false);
 
         void gotoAnchor();
-        bool gotoAnchor(const String& name); // returns true if the anchor was found
-        void scrollToAnchor(const KURL&);
 
         void tokenizerProcessedData();
 
         void handledOnloadEvents();
         String userAgent(const KURL&) const;
 
-        Widget* createJavaAppletWidget(const IntSize&, Element*, const HashMap<String, String>& args);
+        Widget* createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const HashMap<String, String>& args);
 
         void dispatchWindowObjectAvailable();
+        void dispatchDocumentElementAvailable();
         void restoreDocumentState();
 
         Frame* opener();
@@ -352,26 +316,18 @@ namespace WebCore {
         bool openedByDOM() const;
         void setOpenedByDOM();
 
-        void provisionalLoadStarted();
-
         bool userGestureHint();
 
         void resetMultipleFormSubmissionProtection();
-        void didNotOpenURL(const KURL&);
 
         void addData(const char* bytes, int length);
 
-        bool canCachePage();
-
         void checkCallImplicitClose();
-        bool didOpenURL(const KURL&);
 
         void frameDetached();
 
         const KURL& url() const { return m_URL; }
 
-        void updateBaseURLForEmptyDocument();
-
         void setResponseMIMEType(const String&);
         const String& responseMIMEType() const;
 
@@ -380,12 +336,6 @@ namespace WebCore {
         void loadDone();
         void finishedParsing();
         void checkCompleted();
-        void scheduleCheckCompleted();
-        void scheduleCheckLoadComplete();
-
-        void clearRecordedFormValues();
-        void setFormAboutToBeSubmitted(PassRefPtr<HTMLFormElement> element);
-        void recordFormValue(const String& name, const String& value);
 
         bool isComplete() const;
 
@@ -394,54 +344,27 @@ namespace WebCore {
 
         KURL completeURL(const String& url);
 
-        KURL originalRequestURL() const;
-
         void cancelAndClear();
 
         void setTitle(const String&);
-        
-        bool shouldTreatURLAsSameAsCurrent(const KURL&) const;
 
         void commitProvisionalLoad(PassRefPtr<CachedPage>);
 
         void goToItem(HistoryItem*, FrameLoadType);
         void saveDocumentAndScrollState();
-        void saveScrollPositionAndViewStateToItem(HistoryItem*);
 
-        // FIXME: These accessors are here for a dwindling number of users in WebKit, WebFrame
-        // being the primary one.  After they're no longer needed there, they can be removed!
         HistoryItem* currentHistoryItem();
-        HistoryItem* previousHistoryItem();
-        HistoryItem* provisionalHistoryItem();
         void setCurrentHistoryItem(PassRefPtr<HistoryItem>);
-        void setPreviousHistoryItem(PassRefPtr<HistoryItem>);
-        void setProvisionalHistoryItem(PassRefPtr<HistoryItem>);
-
-        void continueLoadWithData(SharedBuffer*, const String& mimeType, const String& textEncoding, const KURL&); 
 
         enum LocalLoadPolicy {
-          AllowLocalLoadsForAll,  // No restriction on local loads.
-          AllowLocalLoadsForLocalAndSubstituteData,
-          AllowLocalLoadsForLocalOnly,
+            AllowLocalLoadsForAll,  // No restriction on local loads.
+            AllowLocalLoadsForLocalAndSubstituteData,
+            AllowLocalLoadsForLocalOnly,
         };
         static void setLocalLoadPolicy(LocalLoadPolicy);
         static bool restrictAccessToLocal();
         static bool allowSubstituteDataAccessToLocal();
 
-        static void registerURLSchemeAsLocal(const String& scheme);
-        static bool shouldTreatURLAsLocal(const String&);
-        static bool shouldTreatSchemeAsLocal(const String&);
-
-#if USE(LOW_BANDWIDTH_DISPLAY)    
-        bool addLowBandwidthDisplayRequest(CachedResource*);
-        void needToSwitchOutLowBandwidthDisplay() { m_needToSwitchOutLowBandwidthDisplay = true; }
-
-        // Client can control whether to use low bandwidth display on a per frame basis.
-        // However, this should only be used for the top frame, not sub-frame.
-        void setUseLowBandwidthDisplay(bool lowBandwidth) { m_useLowBandwidthDisplay = lowBandwidth; }
-        bool useLowBandwidthDisplay() const { return m_useLowBandwidthDisplay; }
-#endif
-
         bool committingFirstRealLoad() const { return !m_creatingInitialEmptyDocument && !m_committedFirstRealDocumentLoad; }
 
         void iconLoadDecisionAvailable();
@@ -453,10 +376,18 @@ namespace WebCore {
 
         void applyUserAgent(ResourceRequest& request);
 
+        bool shouldInterruptLoadForXFrameOptions(const String&, const KURL&);
+
     private:
         PassRefPtr<HistoryItem> createHistoryItem(bool useOriginal);
         PassRefPtr<HistoryItem> createHistoryItemTree(Frame* targetFrame, bool clipAtTarget);
 
+        bool canCachePageContainingThisFrame();
+#ifndef NDEBUG
+        void logCanCachePageDecision();
+        bool logCanCacheFrameDecision(int indentLevel);
+#endif
+
         void addBackForwardItemClippedAtTarget(bool doClip);
         void restoreScrollPositionAndViewState();
         void saveDocumentState();
@@ -469,7 +400,7 @@ namespace WebCore {
         void updateHistoryForBackForwardNavigation();
         void updateHistoryForReload();
         void updateHistoryForStandardLoad();
-        void updateHistoryForRedirectWithLockedHistory();
+        void updateHistoryForRedirectWithLockedBackForwardList();
         void updateHistoryForClientRedirect();
         void updateHistoryForCommit();
         void updateHistoryForAnchorScroll();
@@ -494,8 +425,8 @@ namespace WebCore {
 
         void receivedFirstData();
 
-        void updatePolicyBaseURL();
-        void setPolicyBaseURL(const KURL&);
+        void updateFirstPartyForCookies();
+        void setFirstPartyForCookies(const KURL&);
         
         void addExtraFieldsToRequest(ResourceRequest&, FrameLoadType loadType, bool isMainResource, bool cookiePolicyURLFromRequest);
 
@@ -511,10 +442,8 @@ namespace WebCore {
 
         void setLoadType(FrameLoadType);
 
-        void checkNavigationPolicy(const ResourceRequest&, DocumentLoader*, PassRefPtr<FormState>,
-                                   NavigationPolicyDecisionFunction, void* argument);
-        void checkNewWindowPolicy(const NavigationAction&, const ResourceRequest&, 
-                                  PassRefPtr<FormState>, const String& frameName);
+        void checkNavigationPolicy(const ResourceRequest&, DocumentLoader*, PassRefPtr<FormState>, NavigationPolicyDecisionFunction, void* argument);
+        void checkNewWindowPolicy(const NavigationAction&, const ResourceRequest&, PassRefPtr<FormState>, const String& frameName);
 
         void continueAfterNavigationPolicy(PolicyAction);
         void continueAfterNewWindowPolicy(PolicyAction);
@@ -527,13 +456,11 @@ namespace WebCore {
         void continueLoadAfterNewWindowPolicy(const ResourceRequest&, PassRefPtr<FormState>, const String& frameName, bool shouldContinue);
         static void callContinueFragmentScrollAfterNavigationPolicy(void*, const ResourceRequest&, PassRefPtr<FormState>, bool shouldContinue);
         void continueFragmentScrollAfterNavigationPolicy(const ResourceRequest&, bool shouldContinue);
-        bool shouldScrollToAnchor(bool isFormSubmission, FrameLoadType loadType, const KURL& url);
+        bool shouldScrollToAnchor(bool isFormSubmission, FrameLoadType, const KURL&);
         void addHistoryItemForFragmentScroll();
 
         void stopPolicyCheck();
 
-        void closeDocument();
-        
         void checkLoadCompleteForThisFrame();
 
         void setDocumentLoader(DocumentLoader*);
@@ -544,7 +471,8 @@ namespace WebCore {
 
         void closeOldDataSources();
         void open(CachedPage&);
-        void opened();
+        void open(CachedFrame&);
+
         void updateHistoryAfterClientRedirect();
 
         void clear(bool clearWindowProperties = true, bool clearScriptObjects = true);
@@ -556,14 +484,6 @@ namespace WebCore {
         void startRedirectionTimer();
         void stopRedirectionTimer();
 
-#if USE(LOW_BANDWIDTH_DISPLAY)
-        // implementation of CachedResourceClient        
-        virtual void notifyFinished(CachedResource*);
-
-        void removeAllLowBandwidthDisplayRequests();    
-        void switchOutLowBandwidthDisplayIfReady();        
-#endif
-
         void dispatchDidCommitLoad();
         void dispatchAssignIdentifierToInitialRequest(unsigned long identifier, DocumentLoader*, const ResourceRequest&);
         void dispatchWillSendRequest(DocumentLoader*, unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
@@ -572,6 +492,53 @@ namespace WebCore {
         void dispatchDidFinishLoading(DocumentLoader*, unsigned long identifier);
 
         static bool isLocationChange(const ScheduledRedirection&);
+        void scheduleFormSubmission(const FrameLoadRequest&, bool lockHistory, bool lockBackForwardList, PassRefPtr<Event>, PassRefPtr<FormState>);
+
+        void loadWithDocumentLoader(DocumentLoader*, FrameLoadType, PassRefPtr<FormState>); // Calls continueLoadAfterNavigationPolicy
+        void load(DocumentLoader*);                                                         // Calls loadWithDocumentLoader   
+
+        void loadWithNavigationAction(const ResourceRequest&, const NavigationAction&,      // Calls loadWithDocumentLoader
+            bool lockHistory, FrameLoadType, PassRefPtr<FormState>);
+
+        void loadPostRequest(const ResourceRequest&, const String& referrer,                // Called by loadFrameRequest, calls loadWithNavigationAction
+            const String& frameName, bool lockHistory, FrameLoadType, PassRefPtr<Event>, PassRefPtr<FormState>);
+        void loadURL(const KURL&, const String& referrer, const String& frameName,          // Called by loadFrameRequest, calls loadWithNavigationAction or dispatches to navigation policy delegate
+            bool lockHistory, FrameLoadType, PassRefPtr<Event>, PassRefPtr<FormState>);                                                         
+
+        void clientRedirectCancelledOrFinished(bool cancelWithLoadInProgress);
+        void clientRedirected(const KURL&, double delay, double fireDate, bool lockBackForwardList);
+        bool shouldReload(const KURL& currentURL, const KURL& destinationURL);
+
+        void sendRemainingDelegateMessages(unsigned long identifier, const ResourceResponse&, int length, const ResourceError&);
+        void requestFromDelegate(ResourceRequest&, unsigned long& identifier, ResourceError&);
+
+        void recursiveCheckLoadComplete();
+
+        void detachChildren();
+        void closeAndRemoveChild(Frame*);
+
+        Frame* loadSubframe(HTMLFrameOwnerElement*, const KURL&, const String& name, const String& referrer);
+
+        // Returns true if argument is a JavaScript URL.
+        bool executeIfJavaScriptURL(const KURL&, bool userGesture = false, bool replaceDocument = true);
+
+        bool gotoAnchor(const String& name); // returns true if the anchor was found
+        void scrollToAnchor(const KURL&);
+
+        void provisionalLoadStarted();
+
+        bool canCachePage();
+
+        bool didOpenURL(const KURL&);
+
+        void scheduleCheckCompleted();
+        void scheduleCheckLoadComplete();
+
+        KURL originalRequestURL() const;
+
+        bool shouldTreatURLAsSameAsCurrent(const KURL&) const;
+
+        void saveScrollPositionAndViewStateToItem(HistoryItem*);
 
         Frame* m_frame;
         FrameLoaderClient* m_client;
@@ -601,12 +568,9 @@ namespace WebCore {
         bool m_quickRedirectComing;
         bool m_sentRedirectNotification;
         bool m_inStopAllLoaders;
-        bool m_navigationDuringLoad;
 
         String m_outgoingReferrer;
 
-        OwnPtr<FormSubmission> m_deferredFormSubmission;
-
         bool m_isExecutingJavaScriptFormAction;
         bool m_isRunningScript;
 
@@ -614,6 +578,7 @@ namespace WebCore {
 
         bool m_didCallImplicitClose;
         bool m_wasUnloadEventEmitted;
+        bool m_unloadEventBeingDispatched;
         bool m_isComplete;
         bool m_isLoadingMainResource;
 
@@ -636,8 +601,6 @@ namespace WebCore {
 
         bool m_containsPlugIns;
 
-        RefPtr<HTMLFormElement> m_formAboutToBeSubmitted;
-        HashMap<String, String> m_formValuesAboutToBeSubmitted;
         KURL m_submittedFormURL;
     
         Timer<FrameLoader> m_redirectionTimer;
@@ -663,26 +626,11 @@ namespace WebCore {
         bool m_didDispatchDidCommitLoad;
 #endif
 
-#if USE(LOW_BANDWIDTH_DISPLAY)
-        // whether to use low bandwidth dislay, set by client
-        bool m_useLowBandwidthDisplay;
-
-        // whether to call finishParsing() in switchOutLowBandwidthDisplayIfReady() 
-        bool m_finishedParsingDuringLowBandwidthDisplay;
-
-        // whether to call switchOutLowBandwidthDisplayIfReady;
-        // true if there is external css, javascript, or subframe/plugin
-        bool m_needToSwitchOutLowBandwidthDisplay;
-        
-        String m_pendingSourceInLowBandwidthDisplay;        
-        HashSet<CachedResource*> m_externalRequestsInLowBandwidthDisplay;
-#endif
-
 #if ENABLE(WML)
         bool m_forceReloadWmlDeck;
 #endif
     };
 
-}
+} // namespace WebCore
 
-#endif
+#endif // FrameLoader_h
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.cpp b/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.cpp
deleted file mode 100644
index 9610fd1..0000000
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.cpp
+++ /dev/null
@@ -1,92 +0,0 @@
-/*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
- * Copyright (C) 2008 Holger Hans Peter Freyther
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "FrameLoaderClient.h"
-
-#include "Color.h"
-#include "Frame.h"
-#include "FrameView.h"
-#include "HTMLFrameOwnerElement.h"
-#include "Page.h"
-#include "RenderPart.h"
-
-namespace WebCore {
-
-FrameLoaderClient::~FrameLoaderClient()
-{}
-
-void FrameLoaderClient::transitionToCommittedForNewPage(Frame* frame,
-                                                        const IntSize& viewportSize,
-                                                        const Color& backgroundColor, bool transparent,
-                                                        const IntSize& fixedLayoutSize, bool useFixedLayout,
-                                                        ScrollbarMode horizontalScrollbarMode, ScrollbarMode verticalScrollbarMode)
-{
-    ASSERT(frame);
-
-    Page* page = frame->page();
-    ASSERT(page);
-
-    bool isMainFrame = frame == page->mainFrame();
-
-    if (isMainFrame && frame->view())
-        frame->view()->setParentVisible(false);
-
-    frame->setView(0);
-
-    FrameView* frameView;
-    if (isMainFrame) {
-        frameView = new FrameView(frame, viewportSize);
-        frameView->setFixedLayoutSize(fixedLayoutSize);
-        frameView->setUseFixedLayout(useFixedLayout);
-    } else
-        frameView = new FrameView(frame);
-
-    frameView->setScrollbarModes(horizontalScrollbarMode, verticalScrollbarMode);
-    frameView->updateDefaultScrollbarState();
-
-    frame->setView(frameView);
-    // FrameViews are created with a ref count of 1. Release this ref since we've assigned it to frame.
-    frameView->deref();
-
-    if (backgroundColor.isValid())
-        frameView->updateBackgroundRecursively(backgroundColor, transparent);
-
-    if (isMainFrame)
-        frameView->setParentVisible(true);
-
-    if (frame->ownerRenderer())
-        frame->ownerRenderer()->setWidget(frameView);
-
-    if (HTMLFrameOwnerElement* owner = frame->ownerElement())
-        frame->view()->setCanHaveScrollbars(owner->scrollingMode() != ScrollbarAlwaysOff);
-}
-
-}
-
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h b/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
index 44ab4a4..8c050f0 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoaderClient.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -45,7 +45,7 @@ class NSView;
 namespace WebCore {
 
     class AuthenticationChallenge;
-    class CachedPage;
+    class CachedFrame;
     class Color;
     class DocumentLoader;
     class Element;
@@ -53,31 +53,38 @@ namespace WebCore {
     class Frame;
     class FrameLoader;
     class HistoryItem;
+    class HTMLAppletElement;
     class HTMLFrameOwnerElement;
+    class HTMLPlugInElement;
     class IntSize;
     class KURL;
     class NavigationAction;
     class ResourceError;
     class ResourceHandle;
     class ResourceLoader;
+    struct ResourceRequest;
     class ResourceResponse;
+    class ScriptString;
     class SharedBuffer;
     class SubstituteData;
     class String;
     class Widget;
 
-    class ResourceRequest;
-
     typedef void (FrameLoader::*FramePolicyFunction)(PolicyAction);
 
     class FrameLoaderClient {
     public:
-        virtual ~FrameLoaderClient();
+        // An inline function cannot be the first non-abstract virtual function declared
+        // in the class as it results in the vtable being generated as a weak symbol.
+        // This hurts performance (in Mac OS X at least, when loadig frameworks), so we
+        // don't want to do it in WebKit.
+        virtual bool hasHTMLView() const;
+
+        virtual ~FrameLoaderClient() { }
+
         virtual void frameLoaderDestroyed() = 0;
-        
-        virtual bool hasWebView() const = 0; // mainly for assertions
 
-        virtual bool hasHTMLView() const { return true; }
+        virtual bool hasWebView() const = 0; // mainly for assertions
 
         virtual void makeRepresentation(DocumentLoader*) = 0;
         virtual void forceLayout() = 0;
@@ -99,6 +106,7 @@ namespace WebCore {
         virtual void dispatchDidFinishLoading(DocumentLoader*, unsigned long identifier) = 0;
         virtual void dispatchDidFailLoading(DocumentLoader*, unsigned long identifier, const ResourceError&) = 0;
         virtual bool dispatchDidLoadResourceFromMemoryCache(DocumentLoader*, const ResourceRequest&, const ResourceResponse&, int length) = 0;
+        virtual void dispatchDidLoadResourceByXMLHttpRequest(unsigned long identifier, const ScriptString&) = 0;
 
         virtual void dispatchDidHandleOnloadEvents() = 0;
         virtual void dispatchDidReceiveServerRedirectForProvisionalLoad() = 0;
@@ -151,6 +159,8 @@ namespace WebCore {
         virtual void finishedLoading(DocumentLoader*) = 0;
         
         virtual void updateGlobalHistory() = 0;
+        virtual void updateGlobalHistoryRedirectLinks() = 0;
+
         virtual bool shouldGoToHistoryItem(HistoryItem*) const = 0;
 
         virtual ResourceError cancelledError(const ResourceRequest&) = 0;
@@ -181,8 +191,8 @@ namespace WebCore {
 
         virtual String userAgent(const KURL&) = 0;
         
-        virtual void savePlatformDataToCachedPage(CachedPage*) = 0;
-        virtual void transitionToCommittedFromCachedPage(CachedPage*) = 0;
+        virtual void savePlatformDataToCachedFrame(CachedFrame*) = 0;
+        virtual void transitionToCommittedFromCachedFrame(CachedFrame*) = 0;
         virtual void transitionToCommittedForNewPage() = 0;
 
         virtual bool canCachePage() const = 0;
@@ -190,17 +200,23 @@ namespace WebCore {
 
         virtual PassRefPtr<Frame> createFrame(const KURL& url, const String& name, HTMLFrameOwnerElement* ownerElement,
                                    const String& referrer, bool allowsScrolling, int marginWidth, int marginHeight) = 0;
-        virtual Widget* createPlugin(const IntSize&, Element*, const KURL&, const Vector<String>&, const Vector<String>&, const String&, bool loadManually) = 0;
+        virtual Widget* createPlugin(const IntSize&, HTMLPlugInElement*, const KURL&, const Vector<String>&, const Vector<String>&, const String&, bool loadManually) = 0;
         virtual void redirectDataToPlugin(Widget* pluginWidget) = 0;
         
-        virtual Widget* createJavaAppletWidget(const IntSize&, Element*, const KURL& baseURL, const Vector<String>& paramNames, const Vector<String>& paramValues) = 0;
+        virtual Widget* createJavaAppletWidget(const IntSize&, HTMLAppletElement*, const KURL& baseURL, const Vector<String>& paramNames, const Vector<String>& paramValues) = 0;
 
         virtual ObjectContentType objectContentType(const KURL& url, const String& mimeType) = 0;
         virtual String overrideMediaType() const = 0;
 
         virtual void windowObjectCleared() = 0;
+        virtual void documentElementAvailable() = 0;
         virtual void didPerformFirstNavigation() const = 0; // "Navigation" here means a transition from one page to another that ends up in the back/forward list.
-        
+
+#if USE(V8)
+        virtual void didCreateScriptContext() = 0;
+        virtual void didDestroyScriptContext() = 0;
+#endif
+
         virtual void registerForIconNotification(bool listen = true) = 0;
         
 #if PLATFORM(MAC)
@@ -209,12 +225,11 @@ namespace WebCore {
 #endif
         virtual NSCachedURLResponse* willCacheResponse(DocumentLoader*, unsigned long identifier, NSCachedURLResponse*) const = 0;
 #endif
+#if USE(CFNETWORK)
+        virtual bool shouldCacheResponse(DocumentLoader*, unsigned long identifier, const ResourceResponse&, const unsigned char* data, unsigned long long length) = 0;
+#endif
 
-        virtual bool shouldUsePluginDocument(const String& mimeType) const { return false; }
-
-    protected:
-        static void transitionToCommittedForNewPage(Frame*, const IntSize&, const Color&, bool, const IntSize &, bool,
-                                                    ScrollbarMode = ScrollbarAuto, ScrollbarMode = ScrollbarAuto);
+        virtual bool shouldUsePluginDocument(const String& /*mimeType*/) const { return false; }
     };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h b/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h
index b661f9f..c264b47 100644
--- a/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h
+++ b/src/3rdparty/webkit/WebCore/loader/FrameLoaderTypes.h
@@ -51,9 +51,8 @@ namespace WebCore {
         FrameLoadTypeForward,
         FrameLoadTypeIndexedBackForward, // a multi-item hop in the backforward list
         FrameLoadTypeReload,
-        FrameLoadTypeReloadAllowingStaleData,
         FrameLoadTypeSame,               // user loads same URL again (but not reload button)
-        FrameLoadTypeRedirectWithLockedHistory,
+        FrameLoadTypeRedirectWithLockedBackForwardList, // FIXME: Merge "lockBackForwardList", "lockHistory", "quickRedirect" and "clientRedirect" into a single concept of redirect.
         FrameLoadTypeReplace,
         FrameLoadTypeReloadFromOrigin
     };
@@ -67,6 +66,11 @@ namespace WebCore {
         NavigationTypeOther
     };
 
+    enum DatabasePolicy {
+        DatabasePolicyStop,    // The database thread should be stopped and database connections closed.
+        DatabasePolicyContinue
+    };
+
     enum ObjectContentType {
         ObjectContentNone,
         ObjectContentImage,
diff --git a/src/3rdparty/webkit/WebCore/loader/ImageDocument.cpp b/src/3rdparty/webkit/WebCore/loader/ImageDocument.cpp
index 8f58179..08f2e9a 100644
--- a/src/3rdparty/webkit/WebCore/loader/ImageDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/ImageDocument.cpp
@@ -25,6 +25,7 @@
 #include "config.h"
 #include "ImageDocument.h"
 
+#include "CSSStyleDeclaration.h"
 #include "CachedImage.h"
 #include "DocumentLoader.h"
 #include "Element.h"
@@ -37,6 +38,7 @@
 #include "HTMLNames.h"
 #include "LocalizedStrings.h"
 #include "MouseEvent.h"
+#include "NotImplemented.h"
 #include "Page.h"
 #include "SegmentedString.h"
 #include "Settings.h"
@@ -63,7 +65,7 @@ class ImageTokenizer : public Tokenizer {
 public:
     ImageTokenizer(ImageDocument* doc) : m_doc(doc) {}
 
-    virtual bool write(const SegmentedString&, bool appendData);
+    virtual void write(const SegmentedString&, bool appendData);
     virtual void finish();
     virtual bool isWaitingForScripts() const;
     
@@ -91,10 +93,10 @@ private:
 
 // --------
 
-bool ImageTokenizer::write(const SegmentedString&, bool)
+void ImageTokenizer::write(const SegmentedString&, bool)
 {
-    ASSERT_NOT_REACHED();
-    return false;
+    // <https://bugs.webkit.org/show_bug.cgi?id=25397>: JS code can always call document.write, we need to handle it.
+    notImplemented();
 }
 
 bool ImageTokenizer::writeRawData(const char*, int)
@@ -125,9 +127,9 @@ void ImageTokenizer::finish()
 
         IntSize size = cachedImage->imageSize(m_doc->frame()->pageZoomFactor());
         if (size.width()) {
-            // Compute the title, we use the filename of the resource, falling
-            // back on the hostname if there is no path.
-            String fileName = m_doc->url().lastPathComponent();
+            // Compute the title, we use the decoded filename of the resource, falling
+            // back on the (decoded) hostname if there is no path.
+            String fileName = decodeURLEscapeSequences(m_doc->url().lastPathComponent());
             if (fileName.isEmpty())
                 fileName = m_doc->url().host();
             m_doc->setTitle(imageTitle(fileName, size));
@@ -166,10 +168,10 @@ void ImageDocument::createDocumentStructure()
 {
     ExceptionCode ec;
     
-    RefPtr<Element> rootElement = createElementNS(xhtmlNamespaceURI, "html", ec);
+    RefPtr<Element> rootElement = Document::createElement(htmlTag, false);
     appendChild(rootElement, ec);
     
-    RefPtr<Element> body = createElementNS(xhtmlNamespaceURI, "body", ec);
+    RefPtr<Element> body = Document::createElement(bodyTag, false);
     body->setAttribute(styleAttr, "margin: 0px;");
     
     rootElement->appendChild(body, ec);
@@ -185,7 +187,8 @@ void ImageDocument::createDocumentStructure()
     if (shouldShrinkToFit()) {
         // Add event listeners
         RefPtr<EventListener> listener = ImageEventListener::create(this);
-        addWindowEventListener("resize", listener, false);
+        if (DOMWindow* domWindow = this->domWindow())
+            domWindow->addEventListener("resize", listener, false);
         imageElement->addEventListener("click", listener.release(), false);
     }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/ImageLoader.cpp b/src/3rdparty/webkit/WebCore/loader/ImageLoader.cpp
index 43e08c0..b183a66 100644
--- a/src/3rdparty/webkit/WebCore/loader/ImageLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/ImageLoader.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -31,8 +31,33 @@
 
 namespace WebCore {
 
-ImageLoader::ImageLoader(Element* elt)
-    : m_element(elt)
+class ImageLoadEventSender {
+public:
+    ImageLoadEventSender();
+
+    void dispatchLoadEventSoon(ImageLoader*);
+    void cancelLoadEvent(ImageLoader*);
+
+    void dispatchPendingLoadEvents();
+
+private:
+    ~ImageLoadEventSender();
+
+    void timerFired(Timer<ImageLoadEventSender>*);
+
+    Timer<ImageLoadEventSender> m_timer;
+    Vector<ImageLoader*> m_dispatchSoonList;
+    Vector<ImageLoader*> m_dispatchingList;
+};
+
+static ImageLoadEventSender& loadEventSender()
+{
+    DEFINE_STATIC_LOCAL(ImageLoadEventSender, sender, ());
+    return sender;
+}
+
+ImageLoader::ImageLoader(Element* element)
+    : m_element(element)
     , m_image(0)
     , m_firedLoad(true)
     , m_imageComplete(true)
@@ -44,7 +69,7 @@ ImageLoader::~ImageLoader()
 {
     if (m_image)
         m_image->removeClient(this);
-    m_element->document()->removeImage(this);
+    loadEventSender().cancelLoadEvent(this);
 }
 
 void ImageLoader::setImage(CachedImage* newImage)
@@ -61,11 +86,11 @@ void ImageLoader::setImage(CachedImage* newImage)
             oldImage->removeClient(this);
     }
 
-    if (RenderObject* renderer = element()->renderer()) {
+    if (RenderObject* renderer = m_element->renderer()) {
         if (!renderer->isImage())
             return;
 
-        static_cast<RenderImage*>(renderer)->resetAnimation();
+        toRenderImage(renderer)->resetAnimation();
     }
 }
 
@@ -80,12 +105,11 @@ void ImageLoader::updateFromElement()
 {
     // If we're not making renderers for the page, then don't load images.  We don't want to slow
     // down the raw HTML parsing case by loading images we don't intend to display.
-    Element* elem = element();
-    Document* doc = elem->document();
-    if (!doc->renderer())
+    Document* document = m_element->document();
+    if (!document->renderer())
         return;
 
-    AtomicString attr = elem->getAttribute(elem->imageSourceAttributeName());
+    AtomicString attr = m_element->getAttribute(m_element->imageSourceAttributeName());
 
     if (attr == m_failedLoadURL)
         return;
@@ -95,15 +119,15 @@ void ImageLoader::updateFromElement()
     // a quirk that preserves old behavior that Dashboard widgets
     // need (<rdar://problem/5994621>).
     CachedImage* newImage = 0;
-    if (!(attr.isNull() || attr.isEmpty() && doc->baseURI().isLocalFile())) {
+    if (!(attr.isNull() || (attr.isEmpty() && document->baseURI().isLocalFile()))) {
         if (m_loadManually) {
-            doc->docLoader()->setAutoLoadImages(false);
+            document->docLoader()->setAutoLoadImages(false);
             newImage = new CachedImage(sourceURI(attr));
             newImage->setLoading(true);
-            newImage->setDocLoader(doc->docLoader());
-            doc->docLoader()->m_documentResources.set(newImage->url(), newImage);
+            newImage->setDocLoader(document->docLoader());
+            document->docLoader()->m_documentResources.set(newImage->url(), newImage);
         } else
-            newImage = doc->docLoader()->requestImage(sourceURI(attr));
+            newImage = document->docLoader()->requestImage(sourceURI(attr));
 
         // If we do not have an image here, it means that a cross-site
         // violation occurred.
@@ -119,11 +143,11 @@ void ImageLoader::updateFromElement()
             oldImage->removeClient(this);
     }
 
-    if (RenderObject* renderer = elem->renderer()) {
+    if (RenderObject* renderer = m_element->renderer()) {
         if (!renderer->isImage())
             return;
 
-        static_cast<RenderImage*>(renderer)->resetAnimation();
+        toRenderImage(renderer)->resetAnimation();
     }
 }
 
@@ -139,15 +163,85 @@ void ImageLoader::notifyFinished(CachedResource*)
     ASSERT(m_failedLoadURL.isEmpty());
     m_imageComplete = true;
 
-    Element* elem = element();
-    elem->document()->dispatchImageLoadEventSoon(this);
+    loadEventSender().dispatchLoadEventSoon(this);
 
-    if (RenderObject* renderer = elem->renderer()) {
+    if (RenderObject* renderer = m_element->renderer()) {
         if (!renderer->isImage())
             return;
 
-        static_cast<RenderImage*>(renderer)->setCachedImage(m_image.get());
+        toRenderImage(renderer)->setCachedImage(m_image.get());
     }
 }
 
+void ImageLoader::dispatchPendingLoadEvent()
+{
+    if (m_firedLoad)
+        return;
+    if (!m_image)
+        return;
+    if (!m_element->document()->attached())
+        return;
+    m_firedLoad = true;
+    dispatchLoadEvent();
+}
+
+void ImageLoader::dispatchPendingLoadEvents()
+{
+    loadEventSender().dispatchPendingLoadEvents();
+}
+
+ImageLoadEventSender::ImageLoadEventSender()
+    : m_timer(this, &ImageLoadEventSender::timerFired)
+{
+}
+
+void ImageLoadEventSender::dispatchLoadEventSoon(ImageLoader* loader)
+{
+    m_dispatchSoonList.append(loader);
+    if (!m_timer.isActive())
+        m_timer.startOneShot(0);
+}
+
+void ImageLoadEventSender::cancelLoadEvent(ImageLoader* loader)
+{
+    // Remove instances of this loader from both lists.
+    // Use loops because we allow multiple instances to get into the lists.
+    size_t size = m_dispatchSoonList.size();
+    for (size_t i = 0; i < size; ++i) {
+        if (m_dispatchSoonList[i] == loader)
+            m_dispatchSoonList[i] = 0;
+    }
+    size = m_dispatchingList.size();
+    for (size_t i = 0; i < size; ++i) {
+        if (m_dispatchingList[i] == loader)
+            m_dispatchingList[i] = 0;
+    }
+    if (m_dispatchSoonList.isEmpty())
+        m_timer.stop();
+}
+
+void ImageLoadEventSender::dispatchPendingLoadEvents()
+{
+    // Need to avoid re-entering this function; if new dispatches are
+    // scheduled before the parent finishes processing the list, they
+    // will set a timer and eventually be processed.
+    if (!m_dispatchingList.isEmpty())
+        return;
+
+    m_timer.stop();
+
+    m_dispatchingList.swap(m_dispatchSoonList);
+    size_t size = m_dispatchingList.size();
+    for (size_t i = 0; i < size; ++i) {
+        if (ImageLoader* loader = m_dispatchingList[i])
+            loader->dispatchPendingLoadEvent();
+    }
+    m_dispatchingList.clear();
+}
+
+void ImageLoadEventSender::timerFired(Timer<ImageLoadEventSender>*)
+{
+    dispatchPendingLoadEvents();
+}
+
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/ImageLoader.h b/src/3rdparty/webkit/WebCore/loader/ImageLoader.h
index fc3a58a..3496f75 100644
--- a/src/3rdparty/webkit/WebCore/loader/ImageLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/ImageLoader.h
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
- * Copyright (C) 2004 Apple Computer, Inc.
+ * Copyright (C) 2004, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -30,22 +30,21 @@
 namespace WebCore {
 
 class Element;
+class ImageLoadEventSender;
 
 class ImageLoader : public CachedResourceClient {
 public:
     ImageLoader(Element*);
     virtual ~ImageLoader();
 
+    // This function should be called when the element is attached to a document; starts
+    // loading if a load hasn't already been started.
     void updateFromElement();
 
-    // This method should be called after the 'src' attribute
-    // is set (even when it is not modified) to force the update
-    // and match Firefox and Opera.
+    // This function should be called whenever the 'src' attribute is set, even if its value
+    // doesn't change; starts new load unconditionally (matches Firefox and Opera behavior).
     void updateFromElementIgnoringPreviousError();
 
-    virtual void dispatchLoadEvent() = 0;
-    virtual String sourceURI(const AtomicString&) const = 0;
-
     Element* element() const { return m_element; }
     bool imageComplete() const { return m_imageComplete; }
 
@@ -54,16 +53,22 @@ public:
 
     void setLoadManually(bool loadManually) { m_loadManually = loadManually; }
 
-    // CachedResourceClient API
-    virtual void notifyFinished(CachedResource*);
-
     bool haveFiredLoadEvent() const { return m_firedLoad; }
+
+    static void dispatchPendingLoadEvents();
+
 protected:
-    void setLoadingImage(CachedImage*);
-    
-    void setHaveFiredLoadEvent(bool firedLoad) { m_firedLoad = firedLoad; }
+    virtual void notifyFinished(CachedResource*);
 
 private:
+    virtual void dispatchLoadEvent() = 0;
+    virtual String sourceURI(const AtomicString&) const = 0;
+
+    friend class ImageLoadEventSender;
+    void dispatchPendingLoadEvent();
+
+    void setLoadingImage(CachedImage*);
+
     Element* m_element;
     CachedResourceHandle<CachedImage> m_image;
     AtomicString m_failedLoadURL;
diff --git a/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp b/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp
index 325809b..39e5b90 100644
--- a/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30,12 +30,8 @@
 #include "config.h"
 #include "MainResourceLoader.h"
 
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-#include "ApplicationCache.h"
-#include "ApplicationCacheGroup.h"
-#include "ApplicationCacheResource.h"
-#endif
 #include "DocumentLoader.h"
+#include "FormState.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
@@ -45,6 +41,12 @@
 #include "ResourceHandle.h"
 #include "Settings.h"
 
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+#include "ApplicationCache.h"
+#include "ApplicationCacheGroup.h"
+#include "ApplicationCacheResource.h"
+#endif
+
 // FIXME: More that is in common with SubresourceLoader should move up into ResourceLoader.
 
 namespace WebCore {
@@ -161,7 +163,7 @@ void MainResourceLoader::willSendRequest(ResourceRequest& newRequest, const Reso
     // Update cookie policy base URL as URL changes, except for subframes, which use the
     // URL of the main frame which doesn't change when we redirect.
     if (frameLoader()->isLoadingMainFrame())
-        newRequest.setMainDocumentURL(newRequest.url());
+        newRequest.setFirstPartyForCookies(newRequest.url());
     
     // If we're fielding a redirect in response to a POST, force a load from origin, since
     // this is a common site technique to return to a page viewing some data that the POST
@@ -179,14 +181,19 @@ void MainResourceLoader::willSendRequest(ResourceRequest& newRequest, const Reso
     // listener. But there's no way to do that in practice. So instead we cancel later if the
     // listener tells us to. In practice that means the navigation policy needs to be decided
     // synchronously for these redirect cases.
-
-    ref(); // balanced by deref in continueAfterNavigationPolicy
-    frameLoader()->checkNavigationPolicy(newRequest, callContinueAfterNavigationPolicy, this);
+    if (!redirectResponse.isNull()) {
+        ref(); // balanced by deref in continueAfterNavigationPolicy
+        frameLoader()->checkNavigationPolicy(newRequest, callContinueAfterNavigationPolicy, this);
+    }
 }
 
 static bool shouldLoadAsEmptyDocument(const KURL& url)
 {
-    return url.isEmpty() || equalIgnoringCase(String(url.protocol()), "about");
+#if PLATFORM(TORCHMOBILE)
+    return url.isEmpty() || (url.protocolIs("about") && equalIgnoringRef(url, blankURL()));
+#else 
+    return url.isEmpty() || url.protocolIs("about");
+#endif
 }
 
 void MainResourceLoader::continueAfterContentPolicy(PolicyAction contentPolicy, const ResourceResponse& r)
@@ -248,7 +255,7 @@ void MainResourceLoader::continueAfterContentPolicy(PolicyAction contentPolicy,
     if (!reachedTerminalState())
         ResourceLoader::didReceiveResponse(r);
 
-    if (frameLoader() && !frameLoader()->isStopping())
+    if (frameLoader() && !frameLoader()->isStopping()) {
         if (m_substituteData.isValid()) {
             if (m_substituteData.content()->size())
                 didReceiveData(m_substituteData.content()->data(), m_substituteData.content()->size(), m_substituteData.content()->size(), true);
@@ -256,6 +263,7 @@ void MainResourceLoader::continueAfterContentPolicy(PolicyAction contentPolicy,
                 didFinishLoading();
         } else if (shouldLoadAsEmptyDocument(url) || frameLoader()->representationExistsForURLScheme(url.protocol()))
             didFinishLoading();
+    }
 }
 
 void MainResourceLoader::callContinueAfterContentPolicy(void* argument, PolicyAction policy)
@@ -286,6 +294,15 @@ void MainResourceLoader::didReceiveResponse(const ResourceResponse& r)
     }
 #endif
 
+    HTTPHeaderMap::const_iterator it = r.httpHeaderFields().find(AtomicString("x-frame-options"));
+    if (it != r.httpHeaderFields().end()) {
+        String content = it->second;
+        if (m_frame->loader()->shouldInterruptLoadForXFrameOptions(content, r.url())) {
+            cancel();
+            return;
+        }
+    }
+
     // There is a bug in CFNetwork where callbacks can be dispatched even when loads are deferred.
     // See <rdar://problem/6304600> for more details.
 #if !PLATFORM(CF)
@@ -319,6 +336,17 @@ void MainResourceLoader::didReceiveData(const char* data, int length, long long
     ASSERT(data);
     ASSERT(length != 0);
 
+    ASSERT(!m_response.isNull());
+
+#if USE(CFNETWORK) || (PLATFORM(MAC) && !defined(BUILDING_ON_TIGER))
+    // Workaround for <rdar://problem/6060782>
+    if (m_response.isNull()) {
+        m_response = ResourceResponse(KURL(), "text/html", 0, String(), String());
+        if (DocumentLoader* documentLoader = frameLoader()->activeDocumentLoader())
+            documentLoader->setResponse(m_response);
+    }
+#endif
+
     // There is a bug in CFNetwork where callbacks can be dispatched even when loads are deferred.
     // See <rdar://problem/6304600> for more details.
 #if !PLATFORM(CF)
@@ -396,7 +424,7 @@ void MainResourceLoader::handleEmptyLoad(const KURL& url, bool forURLScheme)
     didReceiveResponse(response);
 }
 
-void MainResourceLoader::handleDataLoadNow(Timer<MainResourceLoader>*)
+void MainResourceLoader::handleDataLoadNow(MainResourceLoaderTimer*)
 {
     RefPtr<MainResourceLoader> protect(this);
 
@@ -408,12 +436,22 @@ void MainResourceLoader::handleDataLoadNow(Timer<MainResourceLoader>*)
     didReceiveResponse(response);
 }
 
+void MainResourceLoader::startDataLoadTimer()
+{
+    m_dataLoadTimer.startOneShot(0);
+
+#if HAVE(RUNLOOP_TIMER)
+    if (SchedulePairHashSet* scheduledPairs = m_frame->page()->scheduledRunLoopPairs())
+        m_dataLoadTimer.schedule(*scheduledPairs);
+#endif
+}
+
 void MainResourceLoader::handleDataLoadSoon(ResourceRequest& r)
 {
     m_initialRequest = r;
     
     if (m_documentLoader->deferMainResourceDataLoad())
-        m_dataLoadTimer.startOneShot(0);
+        startDataLoadTimer();
     else
         handleDataLoadNow(0);
 }
@@ -497,17 +535,16 @@ bool MainResourceLoader::load(const ResourceRequest& r, const SubstituteData& su
 void MainResourceLoader::setDefersLoading(bool defers)
 {
     ResourceLoader::setDefersLoading(defers);
-    
+
     if (defers) {
         if (m_dataLoadTimer.isActive())
             m_dataLoadTimer.stop();
     } else {
         if (m_initialRequest.isNull())
             return;
-        
-        if (m_substituteData.isValid() &&
-            m_documentLoader->deferMainResourceDataLoad())
-                m_dataLoadTimer.startOneShot(0);
+
+        if (m_substituteData.isValid() && m_documentLoader->deferMainResourceDataLoad())
+            startDataLoadTimer();
         else {
             ResourceRequest r(m_initialRequest);
             m_initialRequest = ResourceRequest();
diff --git a/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.h b/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.h
index 6c69c1f..d9ce2f9 100644
--- a/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/MainResourceLoader.h
@@ -29,16 +29,21 @@
 #include "FrameLoaderTypes.h"
 #include "ResourceLoader.h"
 #include "SubstituteData.h"
-#include "Timer.h"
 #include <wtf/Forward.h>
 
+#if HAVE(RUNLOOP_TIMER)
+#include "RunLoopTimer.h"
+#else
+#include "Timer.h"
+#endif
+
 namespace WebCore {
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     class ApplicationCache;
 #endif
     class FormState;
-    class ResourceRequest;
+    struct ResourceRequest;
 
     class MainResourceLoader : public ResourceLoader {
     public:
@@ -56,7 +61,13 @@ namespace WebCore {
         virtual void didFinishLoading();
         virtual void didFail(const ResourceError&);
 
-        void handleDataLoadNow(Timer<MainResourceLoader>*);
+#if HAVE(RUNLOOP_TIMER)
+        typedef RunLoopTimer<MainResourceLoader> MainResourceLoaderTimer;
+#else
+        typedef Timer<MainResourceLoader> MainResourceLoaderTimer;
+#endif
+
+        void handleDataLoadNow(MainResourceLoaderTimer*);
 
         bool isLoadingMultipartContent() const { return m_loadingMultipartContent; }
 
@@ -74,6 +85,7 @@ namespace WebCore {
         void handleEmptyLoad(const KURL&, bool forURLScheme);
         void handleDataLoadSoon(ResourceRequest& r);
 
+        void startDataLoadTimer();
         void handleDataLoad(ResourceRequest&);
 
         void receivedError(const ResourceError&);
@@ -90,7 +102,8 @@ namespace WebCore {
 
         ResourceRequest m_initialRequest;
         SubstituteData m_substituteData;
-        Timer<MainResourceLoader> m_dataLoadTimer;
+
+        MainResourceLoaderTimer m_dataLoadTimer;
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
         // The application cache that the main resource was loaded from (if any).
diff --git a/src/3rdparty/webkit/WebCore/loader/MediaDocument.cpp b/src/3rdparty/webkit/WebCore/loader/MediaDocument.cpp
index 8ed5b45..0b1fd59 100644
--- a/src/3rdparty/webkit/WebCore/loader/MediaDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/MediaDocument.cpp
@@ -38,7 +38,9 @@
 #include "HTMLEmbedElement.h"
 #include "HTMLNames.h"
 #include "HTMLVideoElement.h"
+#include "KeyboardEvent.h"
 #include "MainResourceLoader.h"
+#include "NodeList.h"
 #include "Page.h"
 #include "SegmentedString.h"
 #include "Settings.h"
@@ -54,7 +56,7 @@ public:
     MediaTokenizer(Document* doc) : m_doc(doc), m_mediaElement(0) {}
         
 private:
-    virtual bool write(const SegmentedString&, bool appendData);
+    virtual void write(const SegmentedString&, bool appendData);
     virtual void stopParsing();
     virtual void finish();
     virtual bool isWaitingForScripts() const;
@@ -68,24 +70,23 @@ private:
     HTMLMediaElement* m_mediaElement;
 };
 
-bool MediaTokenizer::write(const SegmentedString&, bool)
+void MediaTokenizer::write(const SegmentedString&, bool)
 {
     ASSERT_NOT_REACHED();
-    return false;
 }
     
 void MediaTokenizer::createDocumentStructure()
 {
     ExceptionCode ec;
-    RefPtr<Element> rootElement = m_doc->createElementNS(xhtmlNamespaceURI, "html", ec);
+    RefPtr<Element> rootElement = m_doc->createElement(htmlTag, false);
     m_doc->appendChild(rootElement, ec);
         
-    RefPtr<Element> body = m_doc->createElementNS(xhtmlNamespaceURI, "body", ec);
+    RefPtr<Element> body = m_doc->createElement(bodyTag, false);
     body->setAttribute(styleAttr, "background-color: rgb(38,38,38);");
 
     rootElement->appendChild(body, ec);
         
-    RefPtr<Element> mediaElement = m_doc->createElementNS(xhtmlNamespaceURI, "video", ec);
+    RefPtr<Element> mediaElement = m_doc->createElement(videoTag, false);
         
     m_mediaElement = static_cast<HTMLVideoElement*>(mediaElement.get());
     m_mediaElement->setAttribute(controlsAttr, "");
@@ -134,10 +135,16 @@ bool MediaTokenizer::isWaitingForScripts() const
     
 MediaDocument::MediaDocument(Frame* frame)
     : HTMLDocument(frame)
+    , m_replaceMediaElementTimer(this, &MediaDocument::replaceMediaElementTimerFired)
 {
     setParseMode(Compat);
 }
 
+MediaDocument::~MediaDocument()
+{
+    ASSERT(!m_replaceMediaElementTimer.isActive());
+}
+
 Tokenizer* MediaDocument::createTokenizer()
 {
     return new MediaTokenizer(this);
@@ -147,23 +154,85 @@ void MediaDocument::defaultEventHandler(Event* event)
 {
     // Match the default Quicktime plugin behavior to allow 
     // clicking and double-clicking to pause and play the media.
-    EventTargetNode* targetNode = event->target()->toNode();
+    Node* targetNode = event->target()->toNode();
     if (targetNode && targetNode->hasTagName(videoTag)) {
         HTMLVideoElement* video = static_cast<HTMLVideoElement*>(targetNode);
-        ExceptionCode ec;
         if (event->type() == eventNames().clickEvent) {
             if (!video->canPlay()) {
-                video->pause(ec);
+                video->pause();
                 event->setDefaultHandled();
             }
         } else if (event->type() == eventNames().dblclickEvent) {
             if (video->canPlay()) {
-                video->play(ec);
+                video->play();
+                event->setDefaultHandled();
+            }
+        }
+    }
+
+    if (event->type() == eventNames().keydownEvent && event->isKeyboardEvent()) {
+        HTMLVideoElement* video = 0;
+        if (targetNode) {
+            if (targetNode->hasTagName(videoTag))
+                video = static_cast<HTMLVideoElement*>(targetNode);
+            else {
+                RefPtr<NodeList> nodeList = targetNode->getElementsByTagName("video");
+                if (nodeList.get()->length() > 0)
+                    video = static_cast<HTMLVideoElement*>(nodeList.get()->item(0));
+            }
+        }
+        if (video) {
+            KeyboardEvent* keyboardEvent = static_cast<KeyboardEvent*>(event);
+            if (keyboardEvent->keyIdentifier() == "U+0020") { // space
+                if (video->paused()) {
+                    if (video->canPlay())
+                        video->play();
+                } else
+                    video->pause();
                 event->setDefaultHandled();
             }
         }
     }
 }
 
+void MediaDocument::mediaElementSawUnsupportedTracks()
+{
+    // The HTMLMediaElement was told it has something that the underlying 
+    // MediaPlayer cannot handle so we should switch from <video> to <embed> 
+    // and let the plugin handle this. Don't do it immediately as this 
+    // function may be called directly from a media engine callback, and 
+    // replaceChild will destroy the element, media player, and media engine.
+    m_replaceMediaElementTimer.startOneShot(0);
+}
+
+void MediaDocument::replaceMediaElementTimerFired(Timer<MediaDocument>*)
+{
+    HTMLElement* htmlBody = body();
+    if (!htmlBody)
+        return;
+
+    // Set body margin width and height to 0 as that is what a PluginDocument uses.
+    htmlBody->setAttribute(marginwidthAttr, "0");
+    htmlBody->setAttribute(marginheightAttr, "0");
+
+    RefPtr<NodeList> nodeList = htmlBody->getElementsByTagName("video");
+
+    if (nodeList.get()->length() > 0) {
+        HTMLVideoElement* videoElement = static_cast<HTMLVideoElement*>(nodeList.get()->item(0));
+
+        RefPtr<Element> element = Document::createElement(embedTag, false);
+        HTMLEmbedElement* embedElement = static_cast<HTMLEmbedElement*>(element.get());
+
+        embedElement->setAttribute(widthAttr, "100%");
+        embedElement->setAttribute(heightAttr, "100%");
+        embedElement->setAttribute(nameAttr, "plugin");
+        embedElement->setSrc(url().string());
+        embedElement->setType(frame()->loader()->responseMIMEType());
+
+        ExceptionCode ec;
+        videoElement->parent()->replaceChild(embedElement, videoElement, ec);
+    }
+}
+
 }
 #endif
diff --git a/src/3rdparty/webkit/WebCore/loader/MediaDocument.h b/src/3rdparty/webkit/WebCore/loader/MediaDocument.h
index e5167e4..ac286f0 100644
--- a/src/3rdparty/webkit/WebCore/loader/MediaDocument.h
+++ b/src/3rdparty/webkit/WebCore/loader/MediaDocument.h
@@ -41,11 +41,17 @@ public:
 
     virtual void defaultEventHandler(Event*);
 
+    void mediaElementSawUnsupportedTracks();
+
 private:
     MediaDocument(Frame*);
+    virtual ~MediaDocument();
+    Timer<MediaDocument> m_replaceMediaElementTimer;
 
     virtual bool isMediaDocument() const { return true; }        
     virtual Tokenizer* createTokenizer();
+
+    void replaceMediaElementTimerFired(Timer<MediaDocument>*);
 };
     
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/NetscapePlugInStreamLoader.cpp b/src/3rdparty/webkit/WebCore/loader/NetscapePlugInStreamLoader.cpp
index e12ed07..9d0e81b 100644
--- a/src/3rdparty/webkit/WebCore/loader/NetscapePlugInStreamLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/NetscapePlugInStreamLoader.cpp
@@ -119,6 +119,11 @@ void NetscapePlugInStreamLoader::didCancel(const ResourceError& error)
 
     m_client->didFail(this, error);
 
+    // If calling didFail spins the run loop the stream loader can reach the terminal state.
+    // If that's the case we just return early.
+    if (reachedTerminalState())
+        return;
+    
     // We need to remove the stream loader after the call to didFail, since didFail can 
     // spawn a new run loop and if the loader has been removed it won't be deferred when
     // the document loader is asked to defer loading.
diff --git a/src/3rdparty/webkit/WebCore/loader/PluginDocument.cpp b/src/3rdparty/webkit/WebCore/loader/PluginDocument.cpp
index 42c801c..373126f 100644
--- a/src/3rdparty/webkit/WebCore/loader/PluginDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/PluginDocument.cpp
@@ -49,7 +49,7 @@ public:
     PluginTokenizer(Document* doc) : m_doc(doc), m_embedElement(0) {}
         
 private:
-    virtual bool write(const SegmentedString&, bool appendData);
+    virtual void write(const SegmentedString&, bool appendData);
     virtual void stopParsing();
     virtual void finish();
     virtual bool isWaitingForScripts() const;
@@ -63,26 +63,25 @@ private:
     HTMLEmbedElement* m_embedElement;
 };
     
-bool PluginTokenizer::write(const SegmentedString&, bool)
+void PluginTokenizer::write(const SegmentedString&, bool)
 {
     ASSERT_NOT_REACHED();
-    return false;
 }
     
 void PluginTokenizer::createDocumentStructure()
 {
     ExceptionCode ec;
-    RefPtr<Element> rootElement = m_doc->createElementNS(xhtmlNamespaceURI, "html", ec);
+    RefPtr<Element> rootElement = m_doc->createElement(htmlTag, false);
     m_doc->appendChild(rootElement, ec);
-        
-    RefPtr<Element> body = m_doc->createElementNS(xhtmlNamespaceURI, "body", ec);
+
+    RefPtr<Element> body = m_doc->createElement(bodyTag, false);
     body->setAttribute(marginwidthAttr, "0");
     body->setAttribute(marginheightAttr, "0");
     body->setAttribute(bgcolorAttr, "rgb(38,38,38)");
 
     rootElement->appendChild(body, ec);
         
-    RefPtr<Element> embedElement = m_doc->createElementNS(xhtmlNamespaceURI, "embed", ec);
+    RefPtr<Element> embedElement = m_doc->createElement(embedTag, false);
         
     m_embedElement = static_cast<HTMLEmbedElement*>(embedElement.get());
     m_embedElement->setAttribute(widthAttr, "100%");
diff --git a/src/3rdparty/webkit/WebCore/loader/ProgressTracker.cpp b/src/3rdparty/webkit/WebCore/loader/ProgressTracker.cpp
index 56aa976..e682b9b 100644
--- a/src/3rdparty/webkit/WebCore/loader/ProgressTracker.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/ProgressTracker.cpp
@@ -26,11 +26,12 @@
 #include "config.h"
 #include "ProgressTracker.h"
 
+#include "DocumentLoader.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
 #include "ResourceResponse.h"
-#include "SystemTime.h"
+#include <wtf/CurrentTime.h>
 
 using std::min;
 
@@ -196,8 +197,11 @@ void ProgressTracker::incrementProgress(unsigned long identifier, const char*, i
     else
         percentOfRemainingBytes = 1.0;
     
-    // Treat the first layout as the half-way point.
-    double maxProgressValue = m_originatingProgressFrame->loader()->firstLayoutDone() ? finalProgressValue : .5;
+    // For documents that use WebCore's layout system, treat first layout as the half-way point.
+    // FIXME: The hasHTMLView function is a sort of roundabout way of asking "do you use WebCore's layout system".
+    bool useClampedMaxProgress = m_originatingProgressFrame->loader()->client()->hasHTMLView()
+        && !m_originatingProgressFrame->loader()->firstLayoutDone();
+    double maxProgressValue = useClampedMaxProgress ? 0.5 : finalProgressValue;
     increment = (maxProgressValue - m_progressValue) * percentOfRemainingBytes;
     m_progressValue += increment;
     m_progressValue = min(m_progressValue, maxProgressValue);
diff --git a/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp b/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp
index 3bac2a7..e2fc7ba 100644
--- a/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/ResourceLoader.cpp
@@ -64,9 +64,6 @@ ResourceLoader::ResourceLoader(Frame* frame, bool sendResourceLoadCallbacks, boo
     , m_shouldContentSniff(shouldContentSniff)
     , m_shouldBufferData(true)
     , m_defersLoading(frame->page()->defersLoading())
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    , m_wasLoadedFromApplicationCache(false)
-#endif
 {
 }
 
@@ -122,10 +119,8 @@ bool ResourceLoader::load(const ResourceRequest& r)
         return true;
     
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    if (m_documentLoader->scheduleApplicationCacheLoad(this, clientRequest, r.url())) {
-        m_wasLoadedFromApplicationCache = true;
+    if (m_documentLoader->scheduleApplicationCacheLoad(this, clientRequest, r.url()))
         return true;
-    }
 #endif
 
     if (m_defersLoading) {
@@ -200,7 +195,6 @@ bool ResourceLoader::scheduleLoadFallbackResourceFromApplicationCache(Applicatio
 {
     if (documentLoader()->scheduleLoadFallbackResourceFromApplicationCache(this, m_request, cache)) {
         handle()->cancel();
-        m_wasLoadedFromApplicationCache = true;
         return true;
     }
     return false;
diff --git a/src/3rdparty/webkit/WebCore/loader/ResourceLoader.h b/src/3rdparty/webkit/WebCore/loader/ResourceLoader.h
index 83e56f5..d3e7b80 100644
--- a/src/3rdparty/webkit/WebCore/loader/ResourceLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/ResourceLoader.h
@@ -106,6 +106,9 @@ namespace WebCore {
 #if PLATFORM(MAC)
         virtual NSCachedURLResponse* willCacheResponse(ResourceHandle*, NSCachedURLResponse*);
 #endif
+#if USE(CFNETWORK)
+        virtual bool shouldCacheResponse(ResourceHandle*, CFCachedURLResponseRef);
+#endif
 
         ResourceHandle* handle() const { return m_handle.get(); }
         bool sendResourceLoadCallbacks() const { return m_sendResourceLoadCallbacks; }
@@ -146,9 +149,6 @@ namespace WebCore {
         bool m_shouldContentSniff;
         bool m_shouldBufferData;
         bool m_defersLoading;
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-        bool m_wasLoadedFromApplicationCache;
-#endif
         ResourceRequest m_deferredRequest;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.cpp b/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.cpp
index 4a339ef..047cc6d 100644
--- a/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.cpp
@@ -66,7 +66,7 @@ PassRefPtr<SubresourceLoader> SubresourceLoader::create(Frame* frame, Subresourc
         return 0;
 
     FrameLoader* fl = frame->loader();
-    if (!skipCanLoadCheck && fl->state() == FrameStateProvisional)
+    if (!skipCanLoadCheck && (fl->state() == FrameStateProvisional || fl->activeDocumentLoader()->isStopping()))
         return 0;
 
     ResourceRequest newRequest = request;
@@ -222,6 +222,13 @@ void SubresourceLoader::didCancel(const ResourceError& error)
     
     if (cancelled())
         return;
+    
+    // The only way the subresource loader can reach the terminal state here is if the run loop spins when calling
+    // m_client->didFail. This should in theory not happen which is why the assert is here. 
+    ASSERT(!reachedTerminalState());
+    if (reachedTerminalState())
+        return;
+    
     m_documentLoader->removeSubresourceLoader(this);
     ResourceLoader::didCancel(error);
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.h b/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.h
index 1a94c73..0fce930 100644
--- a/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.h
+++ b/src/3rdparty/webkit/WebCore/loader/SubresourceLoader.h
@@ -33,7 +33,7 @@
  
 namespace WebCore {
 
-    class ResourceRequest;
+    struct ResourceRequest;
     class SubresourceLoaderClient;
     
     class SubresourceLoader : public ResourceLoader {
diff --git a/src/3rdparty/webkit/WebCore/loader/SubresourceLoaderClient.h b/src/3rdparty/webkit/WebCore/loader/SubresourceLoaderClient.h
index 4e14dea..acf8e6a 100644
--- a/src/3rdparty/webkit/WebCore/loader/SubresourceLoaderClient.h
+++ b/src/3rdparty/webkit/WebCore/loader/SubresourceLoaderClient.h
@@ -33,7 +33,7 @@ namespace WebCore {
 
 class AuthenticationChallenge;
 class ResourceError;
-class ResourceRequest;
+struct ResourceRequest;
 class ResourceResponse;
 class SubresourceLoader;
     
@@ -46,7 +46,7 @@ public:
     virtual void didSendData(SubresourceLoader*, unsigned long long /*bytesSent*/, unsigned long long /*totalBytesToBeSent*/) { }
 
     virtual void didReceiveResponse(SubresourceLoader*, const ResourceResponse&) { }
-    virtual void didReceiveData(SubresourceLoader*, const char*, int) { }
+    virtual void didReceiveData(SubresourceLoader*, const char*, int /*lengthReceived*/) { }
     virtual void didFinishLoading(SubresourceLoader*) { }
     virtual void didFail(SubresourceLoader*, const ResourceError&) { }
     
diff --git a/src/3rdparty/webkit/WebCore/loader/TextDocument.cpp b/src/3rdparty/webkit/WebCore/loader/TextDocument.cpp
index bd2c446..0d86c1b 100644
--- a/src/3rdparty/webkit/WebCore/loader/TextDocument.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/TextDocument.cpp
@@ -41,9 +41,10 @@ using namespace HTMLNames;
 class TextTokenizer : public Tokenizer {
 public:
     TextTokenizer(Document*);
+    virtual ~TextTokenizer();
     TextTokenizer(HTMLViewSourceDocument*);
 
-    virtual bool write(const SegmentedString&, bool appendData);
+    virtual void write(const SegmentedString&, bool appendData);
     virtual void finish();
     virtual bool isWaitingForScripts() const;
     
@@ -91,9 +92,15 @@ TextTokenizer::TextTokenizer(HTMLViewSourceDocument* doc)
     m_size = 254;
     m_buffer = static_cast<UChar*>(fastMalloc(sizeof(UChar) * m_size));
     m_dest = m_buffer;
-}    
+}
+
+TextTokenizer::~TextTokenizer()
+{
+    // finish() should have been called to prevent any leaks
+    ASSERT(!m_buffer);
+}
 
-bool TextTokenizer::write(const SegmentedString& s, bool)
+void TextTokenizer::write(const SegmentedString& s, bool)
 {
     ExceptionCode ec;
 
@@ -125,13 +132,13 @@ bool TextTokenizer::write(const SegmentedString& s, bool)
     }
 
     if (!m_preElement && !inViewSourceMode()) {
-        RefPtr<Element> rootElement = m_doc->createElementNS(xhtmlNamespaceURI, "html", ec);
+        RefPtr<Element> rootElement = m_doc->createElement(htmlTag, false);
         m_doc->appendChild(rootElement, ec);
 
-        RefPtr<Element> body = m_doc->createElementNS(xhtmlNamespaceURI, "body", ec);
+        RefPtr<Element> body = m_doc->createElement(bodyTag, false);
         rootElement->appendChild(body, ec);
 
-        RefPtr<Element> preElement = m_doc->createElementNS(xhtmlNamespaceURI, "pre", ec);
+        RefPtr<Element> preElement = m_doc->createElement(preTag, false);
         preElement->setAttribute("style", "word-wrap: break-word; white-space: pre-wrap;", ec);
 
         body->appendChild(preElement, ec);
@@ -142,7 +149,7 @@ bool TextTokenizer::write(const SegmentedString& s, bool)
     String string = String(m_buffer, m_dest - m_buffer);
     if (inViewSourceMode()) {
         static_cast<HTMLViewSourceDocument*>(m_doc)->addViewSourceText(string);
-        return false;
+        return;
     }
 
     unsigned charsLeft = string.length();
@@ -151,15 +158,15 @@ bool TextTokenizer::write(const SegmentedString& s, bool)
         RefPtr<Text> text = Text::createWithLengthLimit(m_doc, string, charsLeft);
         m_preElement->appendChild(text, ec);
     }
-
-    return false;
 }
 
 void TextTokenizer::finish()
 {
     m_preElement = 0;
     fastFree(m_buffer);
-        
+    m_buffer = 0;
+    m_dest = 0;
+
     m_doc->finishedParsing();
 }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.cpp b/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.cpp
index f37d8f7..db68441 100644
--- a/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.cpp
@@ -1,6 +1,6 @@
 /*
     Copyright (C) 1999 Lars Knoll (knoll@mpi-hd.mpg.de)
-    Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+    Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
     Copyright (C) 2005, 2006, 2007 Alexey Proskuryakov (ap@nypop.com)
 
     This library is free software; you can redistribute it and/or
@@ -26,6 +26,9 @@
 #include "DOMImplementation.h"
 #include "HTMLNames.h"
 #include "TextCodec.h"
+#include "TextEncoding.h"
+#include "TextEncodingDetector.h"
+#include "TextEncodingRegistry.h"
 #include <wtf/ASCIICType.h>
 #include <wtf/StringExtras.h>
 
@@ -320,14 +323,17 @@ const TextEncoding& TextResourceDecoder::defaultEncoding(ContentType contentType
     return specifiedDefaultEncoding;
 }
 
-TextResourceDecoder::TextResourceDecoder(const String& mimeType, const TextEncoding& specifiedDefaultEncoding)
+TextResourceDecoder::TextResourceDecoder(const String& mimeType, const TextEncoding& specifiedDefaultEncoding, bool usesEncodingDetector)
     : m_contentType(determineContentType(mimeType))
-    , m_decoder(defaultEncoding(m_contentType, specifiedDefaultEncoding))
+    , m_encoding(defaultEncoding(m_contentType, specifiedDefaultEncoding))
     , m_source(DefaultEncoding)
+    , m_hintEncoding(0)
     , m_checkedForBOM(false)
     , m_checkedForCSSCharset(false)
     , m_checkedForHeadCharset(false)
+    , m_useLenientXMLDecoding(false)
     , m_sawError(false)
+    , m_usesEncodingDetector(usesEncodingDetector)
 {
 }
 
@@ -344,12 +350,13 @@ void TextResourceDecoder::setEncoding(const TextEncoding& encoding, EncodingSour
     // When encoding comes from meta tag (i.e. it cannot be XML files sent via XHR),
     // treat x-user-defined as windows-1252 (bug 18270)
     if (source == EncodingFromMetaTag && strcasecmp(encoding.name(), "x-user-defined") == 0)
-        m_decoder.reset("windows-1252"); 
+        m_encoding = "windows-1252";
     else if (source == EncodingFromMetaTag || source == EncodingFromXMLHeader || source == EncodingFromCSSCharset)        
-        m_decoder.reset(encoding.closestByteBasedEquivalent());
+        m_encoding = encoding.closestByteBasedEquivalent();
     else
-        m_decoder.reset(encoding);
+        m_encoding = encoding;
 
+    m_codec.clear();
     m_source = source;
 }
 
@@ -401,51 +408,54 @@ static inline bool skipWhitespace(const char*& pos, const char* dataEnd)
     return pos != dataEnd;
 }
 
-void TextResourceDecoder::checkForBOM(const char* data, size_t len)
+size_t TextResourceDecoder::checkForBOM(const char* data, size_t len)
 {
     // Check for UTF-16/32 or UTF-8 BOM mark at the beginning, which is a sure sign of a Unicode encoding.
+    // We let it override even a user-chosen encoding.
+    ASSERT(!m_checkedForBOM);
 
-    if (m_source == UserChosenEncoding) {
-        // FIXME: Maybe a BOM should override even a user-chosen encoding.
-        m_checkedForBOM = true;
-        return;
-    }
+    size_t lengthOfBOM = 0;
 
-    // Check if we have enough data.
     size_t bufferLength = m_buffer.size();
-    if (bufferLength + len < 4)
-        return;
-
-    m_checkedForBOM = true;
 
-    // Extract the first four bytes.
-    // Handle the case where some of bytes are already in the buffer.
-    // The last byte is always guaranteed to not be in the buffer.
-    const unsigned char* udata = reinterpret_cast<const unsigned char*>(data);
-    unsigned char c1 = bufferLength >= 1 ? m_buffer[0] : *udata++;
-    unsigned char c2 = bufferLength >= 2 ? m_buffer[1] : *udata++;
-    unsigned char c3 = bufferLength >= 3 ? m_buffer[2] : *udata++;
-    ASSERT(bufferLength < 4);
-    unsigned char c4 = *udata;
+    size_t buf1Len = bufferLength;
+    size_t buf2Len = len;
+    const unsigned char* buf1 = reinterpret_cast<const unsigned char*>(m_buffer.data());
+    const unsigned char* buf2 = reinterpret_cast<const unsigned char*>(data);
+    unsigned char c1 = buf1Len ? (--buf1Len, *buf1++) : buf2Len ? (--buf2Len, *buf2++) : 0;
+    unsigned char c2 = buf1Len ? (--buf1Len, *buf1++) : buf2Len ? (--buf2Len, *buf2++) : 0;
+    unsigned char c3 = buf1Len ? (--buf1Len, *buf1++) : buf2Len ? (--buf2Len, *buf2++) : 0;
+    unsigned char c4 = buf2Len ? (--buf2Len, *buf2++) : 0;
 
     // Check for the BOM.
     if (c1 == 0xFF && c2 == 0xFE) {
-        if (c3 !=0 || c4 != 0)
+        if (c3 != 0 || c4 != 0) {
             setEncoding(UTF16LittleEndianEncoding(), AutoDetectedEncoding);
-        else 
+            lengthOfBOM = 2;
+        } else {
             setEncoding(UTF32LittleEndianEncoding(), AutoDetectedEncoding);
-    }
-    else if (c1 == 0xEF && c2 == 0xBB && c3 == 0xBF)
+            lengthOfBOM = 4;
+        }
+    } else if (c1 == 0xEF && c2 == 0xBB && c3 == 0xBF) {
         setEncoding(UTF8Encoding(), AutoDetectedEncoding);
-    else if (c1 == 0xFE && c2 == 0xFF)
+        lengthOfBOM = 3;
+    } else if (c1 == 0xFE && c2 == 0xFF) {
         setEncoding(UTF16BigEndianEncoding(), AutoDetectedEncoding);
-    else if (c1 == 0 && c2 == 0 && c3 == 0xFE && c4 == 0xFF)
+        lengthOfBOM = 2;
+    } else if (c1 == 0 && c2 == 0 && c3 == 0xFE && c4 == 0xFF) {
         setEncoding(UTF32BigEndianEncoding(), AutoDetectedEncoding);
+        lengthOfBOM = 4;
+    }
+
+    if (lengthOfBOM || bufferLength + len >= 4)
+        m_checkedForBOM = true;
+
+    return lengthOfBOM;
 }
 
 bool TextResourceDecoder::checkForCSSCharset(const char* data, size_t len, bool& movedDataToBuffer)
 {
-    if (m_source != DefaultEncoding) {
+    if (m_source != DefaultEncoding && m_source != EncodingFromParentFrame) {
         m_checkedForCSSCharset = true;
         return true;
     }
@@ -499,11 +509,13 @@ bool TextResourceDecoder::checkForCSSCharset(const char* data, size_t len, bool&
 static inline void skipComment(const char*& ptr, const char* pEnd)
 {
     const char* p = ptr;
+    if (p == pEnd)
+      return;
     // Allow <!-->; other browsers do.
     if (*p == '>') {
         p++;
     } else {
-        while (p != pEnd) {
+        while (p + 2 < pEnd) {
             if (*p == '-') {
                 // This is the real end of comment, "-->".
                 if (p[1] == '-' && p[2] == '>') {
@@ -511,7 +523,7 @@ static inline void skipComment(const char*& ptr, const char* pEnd)
                     break;
                 }
                 // This is the incorrect end of comment that other browsers allow, "--!>".
-                if (p[1] == '-' && p[2] == '!' && p[3] == '>') {
+                if (p + 3 < pEnd && p[1] == '-' && p[2] == '!' && p[3] == '>') {
                     p += 4;
                     break;
                 }
@@ -526,7 +538,7 @@ const int bytesToCheckUnconditionally = 1024; // That many input bytes will be c
 
 bool TextResourceDecoder::checkForHeadCharset(const char* data, size_t len, bool& movedDataToBuffer)
 {
-    if (m_source != DefaultEncoding) {
+    if (m_source != DefaultEncoding && m_source != EncodingFromParentFrame) {
         m_checkedForHeadCharset = true;
         return true;
     }
@@ -636,7 +648,7 @@ bool TextResourceDecoder::checkForHeadCharset(const char* data, size_t len, bool
                     ptr++;
                     continue;
                 }
-                if (c >= 'a' && c <= 'z' || c >= '0' && c <= '9')
+                if ((c >= 'a' && c <= 'z') || (c >= '0' && c <= '9'))
                     ;
                 else if (c >= 'A' && c <= 'Z')
                     c += 'a' - 'A';
@@ -695,8 +707,8 @@ bool TextResourceDecoder::checkForHeadCharset(const char* data, size_t len, bool
                         break;
                     if (str[pos++] != '=')
                         continue;
-                    while (pos < length &&
-                            (str[pos] <= ' ') || str[pos] == '=' || str[pos] == '"' || str[pos] == '\'')
+                    while ((pos < length) &&
+                            (str[pos] <= ' ' || str[pos] == '=' || str[pos] == '"' || str[pos] == '\''))
                         pos++;
 
                     // end ?
@@ -753,10 +765,28 @@ void TextResourceDecoder::detectJapaneseEncoding(const char* data, size_t len)
     }
 }
 
+// We use the encoding detector in two cases:
+//   1. Encoding detector is turned ON and no other encoding source is
+//      available (that is, it's DefaultEncoding).
+//   2. Encoding detector is turned ON and the encoding is set to
+//      the encoding of the parent frame, which is also auto-detected.
+//   Note that condition #2 is NOT satisfied unless parent-child frame
+//   relationship is compliant to the same-origin policy. If they're from
+//   different domains, |m_source| would not be set to EncodingFromParentFrame
+//   in the first place. 
+bool TextResourceDecoder::shouldAutoDetect() const
+{
+    // Just checking m_hintEncoding suffices here because it's only set
+    // in setHintEncoding when the source is AutoDetectedEncoding.
+    return m_usesEncodingDetector
+        && (m_source == DefaultEncoding || (m_source == EncodingFromParentFrame && m_hintEncoding)); 
+}
+
 String TextResourceDecoder::decode(const char* data, size_t len)
 {
+    size_t lengthOfBOM = 0;
     if (!m_checkedForBOM)
-        checkForBOM(data, len);
+        lengthOfBOM = checkForBOM(data, len);
 
     bool movedDataToBuffer = false;
 
@@ -768,15 +798,32 @@ String TextResourceDecoder::decode(const char* data, size_t len)
         if (!checkForHeadCharset(data, len, movedDataToBuffer))
             return "";
 
-    // Do the auto-detect if our default encoding is one of the Japanese ones.
-    // FIXME: It seems wrong to change our encoding downstream after we have already done some decoding.
-    if (m_source != UserChosenEncoding && m_source != AutoDetectedEncoding && encoding().isJapanese())
+    // FIXME: It seems wrong to change our encoding downstream after
+    // we have already done some decoding. However, it's not possible
+    // to avoid in a sense in two cases below because triggering conditions
+    // for both cases depend on the information that won't be available
+    // until we do partial read. 
+    // The first case had better be removed altogether (see bug 21990)
+    // or at least be made to be invoked only when the encoding detection
+    // is turned on. 
+    // Do the auto-detect 1) using Japanese detector if our default encoding is
+    // one of the Japanese detector or 2) using detectTextEncoding if encoding
+    // detection is turned on.
+    if (m_source != UserChosenEncoding && m_source != AutoDetectedEncoding && m_encoding.isJapanese())
         detectJapaneseEncoding(data, len);
+    else if (shouldAutoDetect()) {
+        TextEncoding detectedEncoding;
+        if (detectTextEncoding(data, len, m_hintEncoding, &detectedEncoding))
+            setEncoding(detectedEncoding, AutoDetectedEncoding);
+    }
+
+    ASSERT(m_encoding.isValid());
 
-    ASSERT(encoding().isValid());
+    if (!m_codec)
+        m_codec.set(newTextCodec(m_encoding).release());
 
     if (m_buffer.isEmpty())
-        return m_decoder.decode(data, len, false, m_contentType == XML, m_sawError);
+        return m_codec->decode(data + lengthOfBOM, len - lengthOfBOM, false, m_contentType == XML, m_sawError);
 
     if (!movedDataToBuffer) {
         size_t oldSize = m_buffer.size();
@@ -784,16 +831,31 @@ String TextResourceDecoder::decode(const char* data, size_t len)
         memcpy(m_buffer.data() + oldSize, data, len);
     }
 
-    String result = m_decoder.decode(m_buffer.data(), m_buffer.size(), false, m_contentType == XML, m_sawError);
+    String result = m_codec->decode(m_buffer.data() + lengthOfBOM, m_buffer.size() - lengthOfBOM, false, m_contentType == XML && !m_useLenientXMLDecoding, m_sawError);
     m_buffer.clear();
     return result;
 }
 
 String TextResourceDecoder::flush()
 {
-    String result = m_decoder.decode(m_buffer.data(), m_buffer.size(), true, m_contentType == XML, m_sawError);
+   // If we can not identify the encoding even after a document is completely
+   // loaded, we need to detect the encoding if other conditions for
+   // autodetection is satisfied.
+    if (m_buffer.size() && shouldAutoDetect()
+        && ((!m_checkedForHeadCharset && (m_contentType == HTML || m_contentType == XML)) || (!m_checkedForCSSCharset && (m_contentType == CSS)))) {
+         TextEncoding detectedEncoding;
+         if (detectTextEncoding(m_buffer.data(), m_buffer.size(),
+                                m_hintEncoding, &detectedEncoding))
+             setEncoding(detectedEncoding, AutoDetectedEncoding);
+    }
+
+    if (!m_codec)
+        m_codec.set(newTextCodec(m_encoding).release());
+
+    String result = m_codec->decode(m_buffer.data(), m_buffer.size(), true, m_contentType == XML && !m_useLenientXMLDecoding, m_sawError);
     m_buffer.clear();
-    m_decoder.reset(m_decoder.encoding());
+    m_codec.clear();
+    m_checkedForBOM = false; // Skip BOM again when re-decoding.
     return result;
 }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.h b/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.h
index 8bbe85e..fb755c9 100644
--- a/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.h
+++ b/src/3rdparty/webkit/WebCore/loader/TextResourceDecoder.h
@@ -23,7 +23,7 @@
 #ifndef TextResourceDecoder_h
 #define TextResourceDecoder_h
 
-#include "TextDecoder.h"
+#include "TextEncoding.h"
 
 namespace WebCore {
 
@@ -36,43 +36,59 @@ public:
         EncodingFromMetaTag,
         EncodingFromCSSCharset,
         EncodingFromHTTPHeader,
-        UserChosenEncoding
+        UserChosenEncoding,
+        EncodingFromParentFrame
     };
 
-    static PassRefPtr<TextResourceDecoder> create(const String& mimeType, const TextEncoding& defaultEncoding = TextEncoding())
+    static PassRefPtr<TextResourceDecoder> create(const String& mimeType, const TextEncoding& defaultEncoding = TextEncoding(), bool usesEncodingDetector = false)
     {
-        return adoptRef(new TextResourceDecoder(mimeType, defaultEncoding));
+        return adoptRef(new TextResourceDecoder(mimeType, defaultEncoding, usesEncodingDetector));
     }
     ~TextResourceDecoder();
 
     void setEncoding(const TextEncoding&, EncodingSource);
-    const TextEncoding& encoding() const { return m_decoder.encoding(); }
+    const TextEncoding& encoding() const { return m_encoding; }
 
     String decode(const char* data, size_t length);
     String flush();
-    
+
+    void setHintEncoding(const TextResourceDecoder* hintDecoder)
+    {
+        // hintEncoding is for use with autodetection, which should be 
+        // only invoked when hintEncoding comes from auto-detection.
+        if (hintDecoder && hintDecoder->m_source == AutoDetectedEncoding)
+            m_hintEncoding = hintDecoder->encoding().name();
+    }
+   
+    void useLenientXMLDecoding() { m_useLenientXMLDecoding = true; }
     bool sawError() const { return m_sawError; }
 
 private:
-    TextResourceDecoder(const String& mimeType, const TextEncoding& defaultEncoding);
+    TextResourceDecoder(const String& mimeType, const TextEncoding& defaultEncoding,
+                        bool usesEncodingDetector);
 
-    enum ContentType { PlainText, HTML, XML, CSS }; // PlainText is equivalent to directly using TextDecoder.
+    enum ContentType { PlainText, HTML, XML, CSS }; // PlainText only checks for BOM.
     static ContentType determineContentType(const String& mimeType);
     static const TextEncoding& defaultEncoding(ContentType, const TextEncoding& defaultEncoding);
 
-    void checkForBOM(const char*, size_t);
+    size_t checkForBOM(const char*, size_t);
     bool checkForCSSCharset(const char*, size_t, bool& movedDataToBuffer);
     bool checkForHeadCharset(const char*, size_t, bool& movedDataToBuffer);
     void detectJapaneseEncoding(const char*, size_t);
+    bool shouldAutoDetect() const;
 
     ContentType m_contentType;
-    TextDecoder m_decoder;
+    TextEncoding m_encoding;
+    OwnPtr<TextCodec> m_codec;
     EncodingSource m_source;
+    const char* m_hintEncoding;
     Vector<char> m_buffer;
     bool m_checkedForBOM;
     bool m_checkedForCSSCharset;
     bool m_checkedForHeadCharset;
+    bool m_useLenientXMLDecoding; // Don't stop on XML decoding errors.
     bool m_sawError;
+    bool m_usesEncodingDetector;
 };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.cpp b/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.cpp
new file mode 100644
index 0000000..b174af7
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ThreadableLoader.h"
+
+#include "ScriptExecutionContext.h"
+#include "Document.h"
+#include "DocumentThreadableLoader.h"
+#include "WorkerContext.h"
+#include "WorkerRunLoop.h"
+#include "WorkerThreadableLoader.h"
+
+namespace WebCore {
+
+PassRefPtr<ThreadableLoader> ThreadableLoader::create(ScriptExecutionContext* context, ThreadableLoaderClient* client, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy) 
+{
+    ASSERT(client);
+    ASSERT(context);
+
+#if ENABLE(WORKERS)
+    if (context->isWorkerContext())
+        return WorkerThreadableLoader::create(static_cast<WorkerContext*>(context), client, WorkerRunLoop::defaultMode(), request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy);
+#endif // ENABLE(WORKERS)
+
+    ASSERT(context->isDocument());
+    return DocumentThreadableLoader::create(static_cast<Document*>(context), client, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy);
+}
+
+void ThreadableLoader::loadResourceSynchronously(ScriptExecutionContext* context, const ResourceRequest& request, ThreadableLoaderClient& client, StoredCredentials storedCredentials)
+{
+    ASSERT(context);
+
+#if ENABLE(WORKERS)
+    if (context->isWorkerContext()) {
+        WorkerThreadableLoader::loadResourceSynchronously(static_cast<WorkerContext*>(context), request, client, storedCredentials, DenyCrossOriginRedirect);
+        return;
+    }
+#endif // ENABLE(WORKERS)
+
+    ASSERT(context->isDocument());
+    DocumentThreadableLoader::loadResourceSynchronously(static_cast<Document*>(context), request, client, storedCredentials);
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.h b/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.h
new file mode 100644
index 0000000..87ae229
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/ThreadableLoader.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ThreadableLoader_h
+#define ThreadableLoader_h
+
+#include <wtf/Noncopyable.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+    class ResourceError;
+    struct ResourceRequest;
+    class ResourceResponse;
+    class ScriptExecutionContext;
+    class ThreadableLoaderClient;
+
+    enum LoadCallbacks {
+        SendLoadCallbacks,
+        DoNotSendLoadCallbacks
+    };
+
+    enum ContentSniff {
+        SniffContent,
+        DoNotSniffContent
+    };
+
+    enum StoredCredentials {
+        AllowStoredCredentials,
+        DoNotAllowStoredCredentials
+    };
+
+    enum CrossOriginRedirectPolicy {
+        DenyCrossOriginRedirect,
+        AllowCrossOriginRedirect
+    };
+
+    // Useful for doing loader operations from any thread (not threadsafe, 
+    // just able to run on threads other than the main thread).
+    class ThreadableLoader : Noncopyable {
+    public:
+        static void loadResourceSynchronously(ScriptExecutionContext*, const ResourceRequest&, ThreadableLoaderClient&, StoredCredentials);
+        static PassRefPtr<ThreadableLoader> create(ScriptExecutionContext*, ThreadableLoaderClient*, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+
+        virtual void cancel() = 0;
+        void ref() { refThreadableLoader(); }
+        void deref() { derefThreadableLoader(); }
+
+    protected:
+        virtual ~ThreadableLoader() { }
+        virtual void refThreadableLoader() = 0;
+        virtual void derefThreadableLoader() = 0;
+    };
+
+} // namespace WebCore
+
+#endif // ThreadableLoader_h
diff --git a/src/3rdparty/webkit/WebCore/loader/ThreadableLoaderClient.h b/src/3rdparty/webkit/WebCore/loader/ThreadableLoaderClient.h
new file mode 100644
index 0000000..93a8e86
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/ThreadableLoaderClient.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ThreadableLoaderClient_h
+#define ThreadableLoaderClient_h
+
+namespace WebCore {
+
+    class ResourceError;
+    class ResourceResponse;
+
+    class ThreadableLoaderClient {
+    public:
+        virtual void didSendData(unsigned long long /*bytesSent*/, unsigned long long /*totalBytesToBeSent*/) { }
+
+        virtual void didReceiveResponse(const ResourceResponse&) { }
+        virtual void didReceiveData(const char*, int /*lengthReceived*/) { }
+        virtual void didFinishLoading(unsigned long /*identifier*/) { }
+        virtual void didFail(const ResourceError&) { }
+        virtual void didFailRedirectCheck() { }
+
+        virtual void didReceiveAuthenticationCancellation(const ResourceResponse&) { }
+
+    protected:
+        virtual ~ThreadableLoaderClient() { }
+    };
+
+} // namespace WebCore
+
+#endif // ThreadableLoaderClient_h
diff --git a/src/3rdparty/webkit/WebCore/loader/ThreadableLoaderClientWrapper.h b/src/3rdparty/webkit/WebCore/loader/ThreadableLoaderClientWrapper.h
new file mode 100644
index 0000000..d3c1a9f
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/ThreadableLoaderClientWrapper.h
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ThreadableLoaderClientWrapper_h
+#define ThreadableLoaderClientWrapper_h
+
+#include "ThreadableLoaderClient.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+    class ThreadableLoaderClientWrapper : public ThreadSafeShared<ThreadableLoaderClientWrapper> {
+    public:
+        static PassRefPtr<ThreadableLoaderClientWrapper> create(ThreadableLoaderClient* client)
+        {
+            return adoptRef(new ThreadableLoaderClientWrapper(client));
+        }
+
+        void clearClient()
+        {
+            m_done = true;
+            m_client = 0;
+        }
+
+        bool done() const
+        {
+            return m_done;
+        }
+
+        void didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
+        {
+            if (m_client)
+                m_client->didSendData(bytesSent, totalBytesToBeSent);
+        }
+
+        void didReceiveResponse(const ResourceResponse& response)
+        {
+            if (m_client)
+                m_client->didReceiveResponse(response);
+        }
+
+        void didReceiveData(const char* data, int lengthReceived)
+        {
+            if (m_client)
+                m_client->didReceiveData(data, lengthReceived);
+        }
+
+        void didFinishLoading(unsigned long identifier)
+        {
+            m_done = true;
+            if (m_client)
+                m_client->didFinishLoading(identifier);
+        }
+
+        void didFail(const ResourceError& error)
+        {
+            m_done = true;
+            if (m_client)
+                m_client->didFail(error);
+        }
+
+        void didFailRedirectCheck()
+        {
+            m_done = true;
+            if (m_client)
+                m_client->didFailRedirectCheck();
+        }
+
+        void didReceiveAuthenticationCancellation(const ResourceResponse& response)
+        {
+            if (m_client)
+                m_client->didReceiveResponse(response);
+        }
+
+    protected:
+        ThreadableLoaderClientWrapper(ThreadableLoaderClient* client)
+            : m_client(client)
+            , m_done(false)
+        {
+        }
+
+        ThreadableLoaderClient* m_client;
+        bool m_done;
+    };
+
+} // namespace WebCore
+
+#endif // ThreadableLoaderClientWrapper_h
diff --git a/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp
new file mode 100644
index 0000000..4d12b8d
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.cpp
@@ -0,0 +1,253 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WORKERS)
+
+#include "WorkerThreadableLoader.h"
+
+#include "GenericWorkerTask.h"
+#include "ResourceError.h"
+#include "ResourceRequest.h"
+#include "ResourceResponse.h"
+#include "ThreadableLoader.h"
+#include "WorkerContext.h"
+#include "WorkerLoaderProxy.h"
+#include "WorkerThread.h"
+#include <memory>
+#include <wtf/OwnPtr.h>
+#include <wtf/Threading.h>
+#include <wtf/Vector.h>
+
+using namespace std;
+
+namespace WebCore {
+
+static const char loadResourceSynchronouslyMode[] = "loadResourceSynchronouslyMode";
+
+WorkerThreadableLoader::WorkerThreadableLoader(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, LoadCallbacks callbacksSetting,
+                                               ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+    : m_workerContext(workerContext)
+    , m_workerClientWrapper(ThreadableLoaderClientWrapper::create(client))
+    , m_bridge(*(new MainThreadBridge(m_workerClientWrapper, m_workerContext->thread()->workerLoaderProxy(), taskMode, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy)))
+{
+}
+
+WorkerThreadableLoader::~WorkerThreadableLoader()
+{
+    m_bridge.destroy();
+}
+
+void WorkerThreadableLoader::loadResourceSynchronously(WorkerContext* workerContext, const ResourceRequest& request, ThreadableLoaderClient& client, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+{
+    WorkerRunLoop& runLoop = workerContext->thread()->runLoop();
+
+    // Create a unique mode just for this synchronous resource load.
+    String mode = loadResourceSynchronouslyMode;
+    mode.append(String::number(runLoop.createUniqueId()));
+
+    ContentSniff contentSniff = request.url().isLocalFile() ? SniffContent : DoNotSniffContent;
+    RefPtr<WorkerThreadableLoader> loader = WorkerThreadableLoader::create(workerContext, &client, mode, request, DoNotSendLoadCallbacks, contentSniff, storedCredentials, crossOriginRedirectPolicy);
+
+    MessageQueueWaitResult result = MessageQueueMessageReceived;
+    while (!loader->done() && result != MessageQueueTerminated)
+        result = runLoop.runInMode(workerContext, mode);
+
+    if (!loader->done() && result == MessageQueueTerminated)
+        loader->cancel();
+}
+
+void WorkerThreadableLoader::cancel()
+{
+    m_bridge.cancel();
+}
+
+WorkerThreadableLoader::MainThreadBridge::MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, WorkerLoaderProxy& loaderProxy, const String& taskMode,
+                                                           const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials,
+                                                           CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+    : m_workerClientWrapper(workerClientWrapper)
+    , m_loaderProxy(loaderProxy)
+    , m_taskMode(taskMode.copy())
+{
+    ASSERT(m_workerClientWrapper.get());
+    m_loaderProxy.postTaskToLoader(createCallbackTask(&MainThreadBridge::mainThreadCreateLoader, this, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy));
+}
+
+WorkerThreadableLoader::MainThreadBridge::~MainThreadBridge()
+{
+}
+
+void WorkerThreadableLoader::MainThreadBridge::mainThreadCreateLoader(ScriptExecutionContext* context, MainThreadBridge* thisPtr, auto_ptr<CrossThreadResourceRequestData> requestData, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+{
+    ASSERT(isMainThread());
+    ASSERT(context->isDocument());
+
+    // FIXME: the created loader has no knowledge of the origin of the worker doing the load request.
+    // Basically every setting done in SubresourceLoader::create (including the contents of addExtraFieldsToRequest)
+    // needs to be examined for how it should take into account a different originator.
+    OwnPtr<ResourceRequest> request(ResourceRequest::adopt(requestData));
+    // FIXME: If the a site requests a local resource, then this will return a non-zero value but the sync path
+    // will return a 0 value.  Either this should return 0 or the other code path should do a callback with
+    // a failure.
+    thisPtr->m_mainThreadLoader = ThreadableLoader::create(context, thisPtr, *request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy);
+    ASSERT(thisPtr->m_mainThreadLoader);
+}
+
+void WorkerThreadableLoader::MainThreadBridge::mainThreadDestroy(ScriptExecutionContext* context, MainThreadBridge* thisPtr)
+{
+    ASSERT(isMainThread());
+    ASSERT_UNUSED(context, context->isDocument());
+    delete thisPtr;
+}
+
+void WorkerThreadableLoader::MainThreadBridge::destroy()
+{
+    // Ensure that no more client callbacks are done in the worker context's thread.
+    clearClientWrapper();
+
+    // "delete this" and m_mainThreadLoader::deref() on the worker object's thread.
+    m_loaderProxy.postTaskToLoader(createCallbackTask(&MainThreadBridge::mainThreadDestroy, this));
+}
+
+void WorkerThreadableLoader::MainThreadBridge::mainThreadCancel(ScriptExecutionContext* context, MainThreadBridge* thisPtr)
+{
+    ASSERT(isMainThread());
+    ASSERT_UNUSED(context, context->isDocument());
+
+    if (!thisPtr->m_mainThreadLoader)
+        return;
+    thisPtr->m_mainThreadLoader->cancel();
+    thisPtr->m_mainThreadLoader = 0;
+}
+
+void WorkerThreadableLoader::MainThreadBridge::cancel()
+{
+    m_loaderProxy.postTaskToLoader(createCallbackTask(&MainThreadBridge::mainThreadCancel, this));
+    ThreadableLoaderClientWrapper* clientWrapper = static_cast<ThreadableLoaderClientWrapper*>(m_workerClientWrapper.get());
+    if (!clientWrapper->done()) {
+        // If the client hasn't reached a termination state, then transition it by sending a cancellation error.
+        // Note: no more client callbacks will be done after this method -- the clearClientWrapper() call ensures that.
+        ResourceError error(String(), 0, String(), String());
+        error.setIsCancellation(true);
+        clientWrapper->didFail(error);
+    }
+    clearClientWrapper();
+}
+
+void WorkerThreadableLoader::MainThreadBridge::clearClientWrapper()
+{
+    static_cast<ThreadableLoaderClientWrapper*>(m_workerClientWrapper.get())->clearClient();
+}
+
+static void workerContextDidSendData(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
+{
+    ASSERT_UNUSED(context, context->isWorkerContext());
+    workerClientWrapper->didSendData(bytesSent, totalBytesToBeSent);
+}
+
+void WorkerThreadableLoader::MainThreadBridge::didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent)
+{
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidSendData, m_workerClientWrapper, bytesSent, totalBytesToBeSent), m_taskMode);
+}
+
+static void workerContextDidReceiveResponse(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, auto_ptr<CrossThreadResourceResponseData> responseData)
+{
+    ASSERT_UNUSED(context, context->isWorkerContext());
+    OwnPtr<ResourceResponse> response(ResourceResponse::adopt(responseData));
+    workerClientWrapper->didReceiveResponse(*response);
+}
+
+void WorkerThreadableLoader::MainThreadBridge::didReceiveResponse(const ResourceResponse& response)
+{
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveResponse, m_workerClientWrapper, response), m_taskMode);
+}
+
+static void workerContextDidReceiveData(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, auto_ptr<Vector<char> > vectorData)
+{
+    ASSERT_UNUSED(context, context->isWorkerContext());
+    workerClientWrapper->didReceiveData(vectorData->data(), vectorData->size());
+}
+
+void WorkerThreadableLoader::MainThreadBridge::didReceiveData(const char* data, int lengthReceived)
+{
+    auto_ptr<Vector<char> > vector(new Vector<char>(lengthReceived)); // needs to be an auto_ptr for usage with createCallbackTask.
+    memcpy(vector->data(), data, lengthReceived);
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveData, m_workerClientWrapper, vector), m_taskMode);
+}
+
+static void workerContextDidFinishLoading(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, unsigned long identifier)
+{
+    ASSERT_UNUSED(context, context->isWorkerContext());
+    workerClientWrapper->didFinishLoading(identifier);
+}
+
+void WorkerThreadableLoader::MainThreadBridge::didFinishLoading(unsigned long identifier)
+{
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidFinishLoading, m_workerClientWrapper, identifier), m_taskMode);
+}
+
+static void workerContextDidFail(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, const ResourceError& error)
+{
+    ASSERT_UNUSED(context, context->isWorkerContext());
+    workerClientWrapper->didFail(error);
+}
+
+void WorkerThreadableLoader::MainThreadBridge::didFail(const ResourceError& error)
+{
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidFail, m_workerClientWrapper, error), m_taskMode);
+}
+
+static void workerContextDidFailRedirectCheck(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper)
+{
+    ASSERT_UNUSED(context, context->isWorkerContext());
+    workerClientWrapper->didFailRedirectCheck();
+}
+
+void WorkerThreadableLoader::MainThreadBridge::didFailRedirectCheck()
+{
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidFailRedirectCheck, m_workerClientWrapper), m_taskMode);
+}
+
+static void workerContextDidReceiveAuthenticationCancellation(ScriptExecutionContext* context, RefPtr<ThreadableLoaderClientWrapper> workerClientWrapper, auto_ptr<CrossThreadResourceResponseData> responseData)
+{
+    ASSERT_UNUSED(context, context->isWorkerContext());
+    OwnPtr<ResourceResponse> response(ResourceResponse::adopt(responseData));
+    workerClientWrapper->didReceiveAuthenticationCancellation(*response);
+}
+
+void WorkerThreadableLoader::MainThreadBridge::didReceiveAuthenticationCancellation(const ResourceResponse& response)
+{
+    m_loaderProxy.postTaskForModeToWorkerContext(createCallbackTask(&workerContextDidReceiveAuthenticationCancellation, m_workerClientWrapper, response), m_taskMode);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS)
diff --git a/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.h b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.h
new file mode 100644
index 0000000..8b11b70
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/WorkerThreadableLoader.h
@@ -0,0 +1,147 @@
+/*
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WorkerThreadableLoader_h
+#define WorkerThreadableLoader_h
+
+#if ENABLE(WORKERS)
+
+#include "PlatformString.h"
+#include "ThreadableLoader.h"
+#include "ThreadableLoaderClient.h"
+#include "ThreadableLoaderClientWrapper.h"
+
+#include <memory>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+    class ResourceError;
+    struct ResourceRequest;
+    class WorkerContext;
+    class WorkerLoaderProxy;
+    struct CrossThreadResourceResponseData;
+    struct CrossThreadResourceRequestData;
+
+    class WorkerThreadableLoader : public RefCounted<WorkerThreadableLoader>, public ThreadableLoader {
+    public:
+        static void loadResourceSynchronously(WorkerContext*, const ResourceRequest&, ThreadableLoaderClient&, StoredCredentials, CrossOriginRedirectPolicy);
+        static PassRefPtr<WorkerThreadableLoader> create(WorkerContext* workerContext, ThreadableLoaderClient* client, const String& taskMode, const ResourceRequest& request, LoadCallbacks callbacksSetting, ContentSniff contentSniff, StoredCredentials storedCredentials, CrossOriginRedirectPolicy crossOriginRedirectPolicy)
+        {
+            return adoptRef(new WorkerThreadableLoader(workerContext, client, taskMode, request, callbacksSetting, contentSniff, storedCredentials, crossOriginRedirectPolicy));
+        }
+
+        ~WorkerThreadableLoader();
+
+        virtual void cancel();
+
+        bool done() const { return m_workerClientWrapper->done(); }
+
+        using RefCounted<WorkerThreadableLoader>::ref;
+        using RefCounted<WorkerThreadableLoader>::deref;
+
+    protected:
+        virtual void refThreadableLoader() { ref(); }
+        virtual void derefThreadableLoader() { deref(); }
+
+    private:
+        // Creates a loader on the main thread and bridges communication between
+        // the main thread and the worker context's thread where WorkerThreadableLoader runs.
+        //
+        // Regarding the bridge and lifetimes of items used in callbacks, there are a few cases:
+        //
+        // all cases. All tasks posted from the worker context's thread are ok because
+        //    the last task posted always is "mainThreadDestroy", so MainThreadBridge is
+        //    around for all tasks that use it on the mian thread.
+        //
+        // case 1. worker.terminate is called.
+        //    In this case, no more tasks are posted from the worker object's thread to the worker
+        //    context's thread -- WorkerContextProxy implementation enforces this.
+        //
+        // case 2. xhr gets aborted and the worker context continues running.
+        //    The ThreadableLoaderClientWrapper has the underlying client cleared, so no more calls
+        //    go through it.  All tasks posted from the worker object's thread to the worker context's
+        //    thread do "ThreadableLoaderClientWrapper::ref" (automatically inside of the cross thread copy
+        //    done in createCallbackTask), so the ThreadableLoaderClientWrapper instance is there until all
+        //    tasks are executed.
+        class MainThreadBridge : ThreadableLoaderClient {
+        public:
+            // All executed on the worker context's thread.
+            MainThreadBridge(PassRefPtr<ThreadableLoaderClientWrapper>, WorkerLoaderProxy&, const String& taskMode, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+            void cancel();
+            void destroy();
+
+        private:
+            // Executed on the worker context's thread.
+            void clearClientWrapper();
+
+            // All executed on the main thread.
+            static void mainThreadDestroy(ScriptExecutionContext*, MainThreadBridge*);
+            ~MainThreadBridge();
+
+            static void mainThreadCreateLoader(ScriptExecutionContext*, MainThreadBridge*, std::auto_ptr<CrossThreadResourceRequestData>, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+            static void mainThreadCancel(ScriptExecutionContext*, MainThreadBridge*);
+            virtual void didSendData(unsigned long long bytesSent, unsigned long long totalBytesToBeSent);
+            virtual void didReceiveResponse(const ResourceResponse&);
+            virtual void didReceiveData(const char*, int lengthReceived);
+            virtual void didFinishLoading(unsigned long identifier);
+            virtual void didFail(const ResourceError&);
+            virtual void didFailRedirectCheck();
+            virtual void didReceiveAuthenticationCancellation(const ResourceResponse&);
+
+            // Only to be used on the main thread.
+            RefPtr<ThreadableLoader> m_mainThreadLoader;
+
+            // ThreadableLoaderClientWrapper is to be used on the worker context thread.
+            // The ref counting is done on either thread.
+            RefPtr<ThreadSafeShared<ThreadableLoaderClientWrapper> > m_workerClientWrapper;
+
+            // May be used on either thread.
+            WorkerLoaderProxy& m_loaderProxy;
+
+            // For use on the main thread.
+            String m_taskMode;
+        };
+
+        WorkerThreadableLoader(WorkerContext*, ThreadableLoaderClient*, const String& taskMode, const ResourceRequest&, LoadCallbacks, ContentSniff, StoredCredentials, CrossOriginRedirectPolicy);
+
+        RefPtr<WorkerContext> m_workerContext;
+        RefPtr<ThreadableLoaderClientWrapper> m_workerClientWrapper;
+        MainThreadBridge& m_bridge;
+    };
+
+} // namespace WebCore
+
+#endif // ENABLE(WORKERS)
+
+#endif // WorkerThreadableLoader_h
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.cpp
index d738799..3033718 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.cpp
@@ -51,10 +51,15 @@ ApplicationCache::~ApplicationCache()
     
 void ApplicationCache::setGroup(ApplicationCacheGroup* group)
 {
-    ASSERT(!m_group);
+    ASSERT(!m_group || group == m_group);
     m_group = group;
 }
 
+bool ApplicationCache::isComplete() const
+{
+    return !m_group->cacheIsBeingUpdated(this);
+}
+
 void ApplicationCache::setManifestResource(PassRefPtr<ApplicationCacheResource> manifest)
 {
     ASSERT(manifest);
@@ -76,6 +81,7 @@ void ApplicationCache::addResource(PassRefPtr<ApplicationCacheResource> resource
     
     if (m_storageID) {
         ASSERT(!resource->storageID());
+        ASSERT(resource->type() & ApplicationCacheResource::Master);
         
         // Add the resource to the storage.
         cacheStorage().store(resource.get(), this);
@@ -105,7 +111,7 @@ ApplicationCacheResource* ApplicationCache::resourceForURL(const String& url)
 
 bool ApplicationCache::requestIsHTTPOrHTTPSGet(const ResourceRequest& request)
 {
-    if (!request.url().protocolIs("http") && !request.url().protocolIs("https"))
+    if (!request.url().protocolInHTTPFamily())
         return false;
     
     if (!equalIgnoringCase(request.httpMethod(), "GET"))
@@ -123,32 +129,6 @@ ApplicationCacheResource* ApplicationCache::resourceForRequest(const ResourceReq
     return resourceForURL(request.url());
 }
 
-unsigned ApplicationCache::numDynamicEntries() const
-{
-    // FIXME: Implement
-    return 0;
-}
-    
-String ApplicationCache::dynamicEntry(unsigned) const
-{
-    // FIXME: Implement
-    return String();
-}
-    
-bool ApplicationCache::addDynamicEntry(const String& url)
-{
-    if (!equalIgnoringCase(m_group->manifestURL().protocol(), KURL(url).protocol()))
-        return false;
-
-    // FIXME: Implement
-    return true;
-}
-    
-void ApplicationCache::removeDynamicEntry(const String&)
-{
-    // FIXME: Implement
-}
-
 void ApplicationCache::setOnlineWhitelist(const Vector<KURL>& onlineWhitelist)
 {
     ASSERT(m_onlineWhitelist.isEmpty());
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.h b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.h
index 9bfa16a..9609f8d 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.h
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCache.h
@@ -41,7 +41,8 @@ class ApplicationCacheGroup;
 class ApplicationCacheResource;
 class DocumentLoader;
 class KURL;
-class ResourceRequest;
+
+struct ResourceRequest;
 
 typedef Vector<std::pair<KURL, KURL> > FallbackURLVector;
 
@@ -58,16 +59,12 @@ public:
     
     void setGroup(ApplicationCacheGroup*);
     ApplicationCacheGroup* group() const { return m_group; }
-    
+
+    bool isComplete() const;
+
     ApplicationCacheResource* resourceForRequest(const ResourceRequest&);
     ApplicationCacheResource* resourceForURL(const String& url);
 
-    unsigned numDynamicEntries() const;
-    String dynamicEntry(unsigned index) const;
-    
-    bool addDynamicEntry(const String& url);
-    void removeDynamicEntry(const String& url);
-    
     void setOnlineWhitelist(const Vector<KURL>& onlineWhitelist);
     const Vector<KURL>& onlineWhitelist() const { return m_onlineWhitelist; }
     bool isURLInOnlineWhitelist(const KURL&); // There is an entry in online whitelist that has the same origin as the resource's URL and that is a prefix match for the resource's URL.
@@ -100,9 +97,6 @@ private:
     Vector<KURL> m_onlineWhitelist;
     FallbackURLVector m_fallbackURLs;
 
-    // While an update is in progress, changes in dynamic entries are queued for later execution.
-    Vector<std::pair<KURL, bool> > m_pendingDynamicEntryActions;
-
     unsigned m_storageID;
 };
 
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
index b53787f..642ec61 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -46,10 +46,12 @@ namespace WebCore {
 
 ApplicationCacheGroup::ApplicationCacheGroup(const KURL& manifestURL, bool isCopy)
     : m_manifestURL(manifestURL)
-    , m_status(Idle)
-    , m_savedNewestCachePointer(0)
+    , m_updateStatus(Idle)
+    , m_downloadingPendingMasterResourceLoadersCount(0)
     , m_frame(0)
     , m_storageID(0)
+    , m_isObsolete(false)
+    , m_completionType(None)
     , m_isCopy(isCopy)
 {
 }
@@ -62,7 +64,7 @@ ApplicationCacheGroup::~ApplicationCacheGroup()
         ASSERT(m_caches.contains(m_newestCache.get()));
         ASSERT(!m_cacheBeingUpdated);
         ASSERT(m_associatedDocumentLoaders.isEmpty());
-        ASSERT(m_cacheCandidates.isEmpty());
+        ASSERT(m_pendingMasterResourceLoaders.isEmpty());
         ASSERT(m_newestCache->group() == this);
         
         return;
@@ -83,6 +85,7 @@ ApplicationCache* ApplicationCacheGroup::cacheForMainRequest(const ResourceReque
 
     if (ApplicationCacheGroup* group = cacheStorage().cacheGroupForURL(request.url())) {
         ASSERT(group->newestCache());
+        ASSERT(!group->isObsolete());
         
         return group->newestCache();
     }
@@ -97,7 +100,8 @@ ApplicationCache* ApplicationCacheGroup::fallbackCacheForMainRequest(const Resou
 
     if (ApplicationCacheGroup* group = cacheStorage().fallbackCacheGroupForURL(request.url())) {
         ASSERT(group->newestCache());
-        
+        ASSERT(!group->isObsolete());
+
         return group->newestCache();
     }
     
@@ -124,7 +128,7 @@ void ApplicationCacheGroup::selectCache(Frame* frame, const KURL& manifestURL)
     if (mainResourceCache) {
         if (manifestURL == mainResourceCache->group()->m_manifestURL) {
             mainResourceCache->group()->associateDocumentLoaderWithCache(documentLoader, mainResourceCache);
-            mainResourceCache->group()->update(frame);
+            mainResourceCache->group()->update(frame, ApplicationCacheUpdateWithBrowsingContext);
         } else {
             // The main resource was loaded from cache, so the cache must have an entry for it. Mark it as foreign.
             ApplicationCacheResource* resource = mainResourceCache->resourceForURL(documentLoader->url());
@@ -145,53 +149,28 @@ void ApplicationCacheGroup::selectCache(Frame* frame, const KURL& manifestURL)
     // The resource was loaded from the network, check if it is a HTTP/HTTPS GET.    
     const ResourceRequest& request = frame->loader()->activeDocumentLoader()->request();
 
-    if (!ApplicationCache::requestIsHTTPOrHTTPSGet(request)) {
-        selectCacheWithoutManifestURL(frame);
+    if (!ApplicationCache::requestIsHTTPOrHTTPSGet(request))
         return;
-    }
 
     // Check that the resource URL has the same scheme/host/port as the manifest URL.
-    if (!protocolHostAndPortAreEqual(manifestURL, request.url())) {
-        selectCacheWithoutManifestURL(frame);
+    if (!protocolHostAndPortAreEqual(manifestURL, request.url()))
+        return;
+
+    // Don't change anything on disk if private browsing is enabled.
+    if (!frame->settings() || frame->settings()->privateBrowsingEnabled()) {
+        postListenerTask(&DOMApplicationCache::callCheckingListener, documentLoader);
+        postListenerTask(&DOMApplicationCache::callErrorListener, documentLoader);
         return;
     }
-            
+
     ApplicationCacheGroup* group = cacheStorage().findOrCreateCacheGroup(manifestURL);
-            
-    if (ApplicationCache* cache = group->newestCache()) {
-        ASSERT(cache->manifestResource());
-                
-        group->associateDocumentLoaderWithCache(frame->loader()->documentLoader(), cache);
-              
-        if (!frame->loader()->documentLoader()->isLoadingMainResource())
-            group->finishedLoadingMainResource(frame->loader()->documentLoader());
-
-        group->update(frame);
-    } else {
-        bool isUpdating = group->m_cacheBeingUpdated;
-                
-        if (!isUpdating)
-            group->m_cacheBeingUpdated = ApplicationCache::create();
-        documentLoader->setCandidateApplicationCacheGroup(group);
-        group->m_cacheCandidates.add(documentLoader);
-
-        const KURL& url = frame->loader()->documentLoader()->originalURL();
-                
-        unsigned type = 0;
-
-        // If the resource has already been downloaded, remove it so that it will be replaced with the implicit resource
-        if (isUpdating)
-            type = group->m_cacheBeingUpdated->removeResource(url);
-               
-        // Add the main resource URL as an implicit entry.
-        group->addEntry(url, type | ApplicationCacheResource::Implicit);
 
-        if (!frame->loader()->documentLoader()->isLoadingMainResource())
-            group->finishedLoadingMainResource(frame->loader()->documentLoader());
-                
-        if (!isUpdating)
-            group->update(frame);                
-    }               
+    documentLoader->setCandidateApplicationCacheGroup(group);
+    group->m_pendingMasterResourceLoaders.add(documentLoader);
+    group->m_downloadingPendingMasterResourceLoadersCount++;
+
+    ASSERT(!group->m_cacheBeingUpdated || group->m_updateStatus != Idle);
+    group->update(frame, ApplicationCacheUpdateWithBrowsingContext);
 }
 
 void ApplicationCacheGroup::selectCacheWithoutManifestURL(Frame* frame)
@@ -206,43 +185,101 @@ void ApplicationCacheGroup::selectCacheWithoutManifestURL(Frame* frame)
 
     if (mainResourceCache) {
         mainResourceCache->group()->associateDocumentLoaderWithCache(documentLoader, mainResourceCache);
-        mainResourceCache->group()->update(frame);
+        mainResourceCache->group()->update(frame, ApplicationCacheUpdateWithBrowsingContext);
     }
 }
 
 void ApplicationCacheGroup::finishedLoadingMainResource(DocumentLoader* loader)
 {
-    const KURL& url = loader->originalURL();
-    
-    if (ApplicationCache* cache = loader->applicationCache()) {
-        RefPtr<ApplicationCacheResource> resource = ApplicationCacheResource::create(url, loader->response(), ApplicationCacheResource::Implicit, loader->mainResourceData());
-        cache->addResource(resource.release());
-        
-        if (!m_cacheBeingUpdated)
-            return;
-    }
-    
-    ASSERT(m_pendingEntries.contains(url));
- 
-    EntryMap::iterator it = m_pendingEntries.find(url);
-    ASSERT(it->second & ApplicationCacheResource::Implicit);
+    ASSERT(m_pendingMasterResourceLoaders.contains(loader));
+    ASSERT(m_completionType == None || m_pendingEntries.isEmpty());
+    const KURL& url = loader->url();
 
-    RefPtr<ApplicationCacheResource> resource = ApplicationCacheResource::create(url, loader->response(), it->second, loader->mainResourceData());
+    switch (m_completionType) {
+    case None:
+        // The main resource finished loading before the manifest was ready. It will be handled via dispatchMainResources() later.
+        return;
+    case NoUpdate:
+        ASSERT(!m_cacheBeingUpdated);
+        associateDocumentLoaderWithCache(loader, m_newestCache.get());
+
+        if (ApplicationCacheResource* resource = m_newestCache->resourceForURL(url)) {
+            if (!(resource->type() & ApplicationCacheResource::Master)) {
+                resource->addType(ApplicationCacheResource::Master);
+                ASSERT(!resource->storageID());
+            }
+        } else
+            m_newestCache->addResource(ApplicationCacheResource::create(url, loader->response(), ApplicationCacheResource::Master, loader->mainResourceData()));
+
+        break;
+    case Failure:
+        // Cache update has been a failure, so there is no reason to keep the document associated with the incomplete cache
+        // (its main resource was not cached yet, so it is likely that the application changed significantly server-side).
+        ASSERT(!m_cacheBeingUpdated); // Already cleared out by stopLoading().
+        loader->setApplicationCache(0); // Will unset candidate, too.
+        m_associatedDocumentLoaders.remove(loader);
+        postListenerTask(&DOMApplicationCache::callErrorListener, loader);
+        break;
+    case Completed:
+        ASSERT(m_associatedDocumentLoaders.contains(loader));
+
+        if (ApplicationCacheResource* resource = m_cacheBeingUpdated->resourceForURL(url)) {
+            if (!(resource->type() & ApplicationCacheResource::Master)) {
+                resource->addType(ApplicationCacheResource::Master);
+                ASSERT(!resource->storageID());
+            }
+        } else
+            m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, loader->response(), ApplicationCacheResource::Master, loader->mainResourceData()));
+        // The "cached" event will be posted to all associated documents once update is complete.
+        break;
+    }
 
-    ASSERT(m_cacheBeingUpdated);
-    m_cacheBeingUpdated->addResource(resource.release());
-    
-    m_pendingEntries.remove(it);
-    
+    m_downloadingPendingMasterResourceLoadersCount--;
     checkIfLoadIsComplete();
 }
 
 void ApplicationCacheGroup::failedLoadingMainResource(DocumentLoader* loader)
 {
-    ASSERT(m_cacheCandidates.contains(loader) || m_associatedDocumentLoaders.contains(loader));
+    ASSERT(m_pendingMasterResourceLoaders.contains(loader));
+    ASSERT(m_completionType == None || m_pendingEntries.isEmpty());
 
-    // Note that cacheUpdateFailed() can cause the cache group to be deleted.
-    cacheUpdateFailed();
+    switch (m_completionType) {
+    case None:
+        // The main resource finished loading before the manifest was ready. It will be handled via dispatchMainResources() later.
+        return;
+    case NoUpdate:
+        ASSERT(!m_cacheBeingUpdated);
+
+        // The manifest didn't change, and we have a relevant cache - but the main resource download failed mid-way, so it cannot be stored to the cache,
+        // and the loader does not get associated to it. If there are other main resources being downloaded for this cache group, they may still succeed.
+        postListenerTask(&DOMApplicationCache::callErrorListener, loader);
+
+        break;
+    case Failure:
+        // Cache update failed, too.
+        ASSERT(!m_cacheBeingUpdated); // Already cleared out by stopLoading().
+        ASSERT(!loader->applicationCache() || loader->applicationCache() == m_cacheBeingUpdated);
+
+        loader->setApplicationCache(0); // Will unset candidate, too.
+        m_associatedDocumentLoaders.remove(loader);
+        postListenerTask(&DOMApplicationCache::callErrorListener, loader);
+        break;
+    case Completed:
+        // The cache manifest didn't list this main resource, and all cache entries were already updated successfully - but the main resource failed to load,
+        // so it cannot be stored to the cache. If there are other main resources being downloaded for this cache group, they may still succeed.
+        ASSERT(m_associatedDocumentLoaders.contains(loader));
+        ASSERT(loader->applicationCache() == m_cacheBeingUpdated);
+        ASSERT(!loader->candidateApplicationCacheGroup());
+        m_associatedDocumentLoaders.remove(loader);
+        loader->setApplicationCache(0);
+
+        postListenerTask(&DOMApplicationCache::callErrorListener, loader);
+
+        break;
+    }
+
+    m_downloadingPendingMasterResourceLoadersCount--;
+    checkIfLoadIsComplete();
 }
 
 void ApplicationCacheGroup::stopLoading()
@@ -265,95 +302,129 @@ void ApplicationCacheGroup::stopLoading()
     }    
     
     m_cacheBeingUpdated = 0;
+    m_pendingEntries.clear();
 }    
 
-void ApplicationCacheGroup::documentLoaderDestroyed(DocumentLoader* loader)
+void ApplicationCacheGroup::disassociateDocumentLoader(DocumentLoader* loader)
 {
     HashSet<DocumentLoader*>::iterator it = m_associatedDocumentLoaders.find(loader);
-    
-    if (it != m_associatedDocumentLoaders.end()) {
-        ASSERT(!m_cacheCandidates.contains(loader));
-    
+    if (it != m_associatedDocumentLoaders.end())
         m_associatedDocumentLoaders.remove(it);
-    } else {
-        ASSERT(m_cacheCandidates.contains(loader));
-        m_cacheCandidates.remove(loader);
-    }
-    
-    if (!m_associatedDocumentLoaders.isEmpty() || !m_cacheCandidates.isEmpty())
+
+    m_pendingMasterResourceLoaders.remove(loader);
+
+    loader->setApplicationCache(0); // Will set candidate to 0, too.
+
+    if (!m_associatedDocumentLoaders.isEmpty() || !m_pendingMasterResourceLoaders.isEmpty())
         return;
-    
-    // We should only have the newest cache remaining, or there is an initial cache attempt in progress.
-    ASSERT(m_caches.size() == 1 || m_cacheBeingUpdated);
-        
-    // If a cache update is in progress, stop it.
-    if (m_caches.size() == 1) {
-        ASSERT(m_caches.contains(m_newestCache.get()));
-        
-        // Release our reference to the newest cache.
-        m_savedNewestCachePointer = m_newestCache.get();
-        
-        // This could cause us to be deleted.
-        m_newestCache = 0;
-        
+
+    if (m_caches.isEmpty()) {
+        // There is an initial cache attempt in progress.
+        ASSERT(!m_newestCache);
+        // Delete ourselves, causing the cache attempt to be stopped.
+        delete this;
         return;
     }
-    
-    // There is an initial cache attempt in progress
-    ASSERT(m_cacheBeingUpdated);
-    ASSERT(m_caches.size() == 0);
-    
-    // Delete ourselves, causing the cache attempt to be stopped.
-    delete this;
-}    
+
+    ASSERT(m_caches.contains(m_newestCache.get()));
+
+    // Release our reference to the newest cache. This could cause us to be deleted.
+    // Any ongoing updates will be stopped from destructor.
+    m_newestCache.release();
+}
 
 void ApplicationCacheGroup::cacheDestroyed(ApplicationCache* cache)
 {
-    ASSERT(m_caches.contains(cache));
+    if (!m_caches.contains(cache))
+        return;
     
     m_caches.remove(cache);
-    
-    if (cache != m_savedNewestCachePointer)
-        cacheStorage().remove(cache);
 
-    if (m_caches.isEmpty())
+    if (m_caches.isEmpty()) {
+        ASSERT(m_associatedDocumentLoaders.isEmpty());
+        ASSERT(m_pendingMasterResourceLoaders.isEmpty());
         delete this;
+    }
 }
 
 void ApplicationCacheGroup::setNewestCache(PassRefPtr<ApplicationCache> newestCache)
-{ 
-    ASSERT(!m_newestCache);
-    ASSERT(!m_caches.contains(newestCache.get()));
-    ASSERT(!newestCache->group());
-           
-    m_newestCache = newestCache; 
+{
+    m_newestCache = newestCache;
+
     m_caches.add(m_newestCache.get());
     m_newestCache->setGroup(this);
 }
 
-void ApplicationCacheGroup::update(Frame* frame)
+void ApplicationCacheGroup::makeObsolete()
+{
+    if (isObsolete())
+        return;
+
+    m_isObsolete = true;
+    cacheStorage().cacheGroupMadeObsolete(this);
+    ASSERT(!m_storageID);
+}
+
+void ApplicationCacheGroup::update(Frame* frame, ApplicationCacheUpdateOption updateOption)
 {
-    if (m_status == Checking || m_status == Downloading) 
+    if (m_updateStatus == Checking || m_updateStatus == Downloading) {
+        if (updateOption == ApplicationCacheUpdateWithBrowsingContext) {
+            postListenerTask(&DOMApplicationCache::callCheckingListener, frame->loader()->documentLoader());
+            if (m_updateStatus == Downloading)
+                postListenerTask(&DOMApplicationCache::callDownloadingListener, frame->loader()->documentLoader());
+        }
         return;
+    }
+
+    // Don't change anything on disk if private browsing is enabled.
+    if (!frame->settings() || frame->settings()->privateBrowsingEnabled()) {
+        ASSERT(m_pendingMasterResourceLoaders.isEmpty());
+        ASSERT(m_pendingEntries.isEmpty());
+        ASSERT(!m_cacheBeingUpdated);
+        postListenerTask(&DOMApplicationCache::callCheckingListener, frame->loader()->documentLoader());
+        postListenerTask(&DOMApplicationCache::callNoUpdateListener, frame->loader()->documentLoader());
+        return;
+    }
 
     ASSERT(!m_frame);
     m_frame = frame;
 
-    m_status = Checking;
+    m_updateStatus = Checking;
 
-    callListenersOnAssociatedDocuments(&DOMApplicationCache::callCheckingListener);
+    postListenerTask(&DOMApplicationCache::callCheckingListener, m_associatedDocumentLoaders);
+    if (!m_newestCache) {
+        ASSERT(updateOption == ApplicationCacheUpdateWithBrowsingContext);
+        postListenerTask(&DOMApplicationCache::callCheckingListener, frame->loader()->documentLoader());
+    }
     
     ASSERT(!m_manifestHandle);
     ASSERT(!m_manifestResource);
-    
+    ASSERT(m_completionType == None);
+
     // FIXME: Handle defer loading
-    
-    ResourceRequest request(m_manifestURL);
+    m_manifestHandle = createResourceHandle(m_manifestURL, m_newestCache ? m_newestCache->manifestResource() : 0);
+}
+
+PassRefPtr<ResourceHandle> ApplicationCacheGroup::createResourceHandle(const KURL& url, ApplicationCacheResource* newestCachedResource)
+{
+    ResourceRequest request(url);
     m_frame->loader()->applyUserAgent(request);
+    request.setHTTPHeaderField("Cache-Control", "max-age=0");
+
+    if (newestCachedResource) {
+        const String& lastModified = newestCachedResource->response().httpHeaderField("Last-Modified");
+        const String& eTag = newestCachedResource->response().httpHeaderField("ETag");
+        if (!lastModified.isEmpty() || !eTag.isEmpty()) {
+            if (!lastModified.isEmpty())
+                request.setHTTPHeaderField("If-Modified-Since", lastModified);
+            if (!eTag.isEmpty())
+                request.setHTTPHeaderField("If-None-Match", eTag);
+        }
+    }
     
-    m_manifestHandle = ResourceHandle::create(request, this, m_frame, false, true, false);
+    return ResourceHandle::create(request, this, m_frame, false, true, false);
 }
- 
+
 void ApplicationCacheGroup::didReceiveResponse(ResourceHandle* handle, const ResourceResponse& response)
 {
     if (handle == m_manifestHandle) {
@@ -362,14 +433,7 @@ void ApplicationCacheGroup::didReceiveResponse(ResourceHandle* handle, const Res
     }
     
     ASSERT(handle == m_currentHandle);
-    
-    int statusCode = response.httpStatusCode() / 100;
-    if (statusCode == 4 || statusCode == 5) {
-        // Note that cacheUpdateFailed() can cause the cache group to be deleted.
-        cacheUpdateFailed();
-        return;
-    }
-    
+
     const KURL& url = handle->request().url();
     
     ASSERT(!m_currentResource);
@@ -377,9 +441,50 @@ void ApplicationCacheGroup::didReceiveResponse(ResourceHandle* handle, const Res
     
     unsigned type = m_pendingEntries.get(url);
     
-    // If this is an initial cache attempt, we should not get implicit resources delivered here.
+    // If this is an initial cache attempt, we should not get master resources delivered here.
     if (!m_newestCache)
-        ASSERT(!(type & ApplicationCacheResource::Implicit));
+        ASSERT(!(type & ApplicationCacheResource::Master));
+
+    if (m_newestCache && response.httpStatusCode() == 304) { // Not modified.
+        ApplicationCacheResource* newestCachedResource = m_newestCache->resourceForURL(handle->request().url());
+        if (newestCachedResource) {
+            m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, newestCachedResource->response(), type, newestCachedResource->data()));
+            m_currentHandle->cancel();
+            m_currentHandle = 0;
+            m_pendingEntries.remove(handle->request().url());
+            // Load the next resource, if any.
+            startLoadingEntry();
+            return;
+        }
+        // The server could return 304 for an unconditional request - in this case, we handle the response as a normal error.
+    }
+
+    if (response.httpStatusCode() / 100 != 2 || response.url() != m_currentHandle->request().url()) {
+        if ((type & ApplicationCacheResource::Explicit) || (type & ApplicationCacheResource::Fallback)) {
+            // Note that cacheUpdateFailed() can cause the cache group to be deleted.
+            cacheUpdateFailed();
+        } else if (response.httpStatusCode() == 404 || response.httpStatusCode() == 410) {
+            // Skip this resource. It is dropped from the cache.
+            m_currentHandle->cancel();
+            m_currentHandle = 0;
+            m_pendingEntries.remove(handle->request().url());
+            // Load the next resource, if any.
+            startLoadingEntry();
+        } else {
+            // Copy the resource and its metadata from the newest application cache in cache group whose completeness flag is complete, and act
+            // as if that was the fetched resource, ignoring the resource obtained from the network.
+            ASSERT(m_newestCache);
+            ApplicationCacheResource* newestCachedResource = m_newestCache->resourceForURL(handle->request().url());
+            ASSERT(newestCachedResource);
+            m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, newestCachedResource->response(), type, newestCachedResource->data()));
+            m_currentHandle->cancel();
+            m_currentHandle = 0;
+            m_pendingEntries.remove(handle->request().url());
+            // Load the next resource, if any.
+            startLoadingEntry();
+        }
+        return;
+    }
     
     m_currentResource = ApplicationCacheResource::create(url, response, type);
 }
@@ -414,105 +519,121 @@ void ApplicationCacheGroup::didFinishLoading(ResourceHandle* handle)
     m_cacheBeingUpdated->addResource(m_currentResource.release());
     m_currentHandle = 0;
     
-    // Load the next file.
-    if (!m_pendingEntries.isEmpty()) {
-        startLoadingEntry();
-        return;
-    }
-    
-    checkIfLoadIsComplete();
+    // Load the next resource, if any.
+    startLoadingEntry();
 }
 
 void ApplicationCacheGroup::didFail(ResourceHandle* handle, const ResourceError&)
 {
     if (handle == m_manifestHandle) {
-        didFailToLoadManifest();
+        cacheUpdateFailed();
         return;
     }
-    
-    // Note that cacheUpdateFailed() can cause the cache group to be deleted.
-    cacheUpdateFailed();
+
+    unsigned type = m_currentResource ? m_currentResource->type() : m_pendingEntries.get(handle->request().url());
+    const KURL& url = handle->request().url();
+
+    ASSERT(!m_currentResource || !m_pendingEntries.contains(url));
+    m_currentResource = 0;
+    m_pendingEntries.remove(url);
+
+    if ((type & ApplicationCacheResource::Explicit) || (type & ApplicationCacheResource::Fallback)) {
+        // Note that cacheUpdateFailed() can cause the cache group to be deleted.
+        cacheUpdateFailed();
+    } else {
+        // Copy the resource and its metadata from the newest application cache in cache group whose completeness flag is complete, and act
+        // as if that was the fetched resource, ignoring the resource obtained from the network.
+        ASSERT(m_newestCache);
+        ApplicationCacheResource* newestCachedResource = m_newestCache->resourceForURL(url);
+        ASSERT(newestCachedResource);
+        m_cacheBeingUpdated->addResource(ApplicationCacheResource::create(url, newestCachedResource->response(), type, newestCachedResource->data()));
+        // Load the next resource, if any.
+        startLoadingEntry();
+    }
 }
 
 void ApplicationCacheGroup::didReceiveManifestResponse(const ResourceResponse& response)
 {
-    int statusCode = response.httpStatusCode() / 100;
+    ASSERT(!m_manifestResource);
+    ASSERT(m_manifestHandle);
 
-    if (statusCode == 4 || statusCode == 5 || 
-        !equalIgnoringCase(response.mimeType(), "text/cache-manifest")) {
-        didFailToLoadManifest();
+    if (response.httpStatusCode() == 404 || response.httpStatusCode() == 410) {
+        manifestNotFound();
         return;
     }
-    
-    ASSERT(!m_manifestResource);
-    ASSERT(m_manifestHandle);
+
+    if (response.httpStatusCode() == 304)
+        return;
+
+    if (response.httpStatusCode() / 100 != 2 || response.url() != m_manifestHandle->request().url() || !equalIgnoringCase(response.mimeType(), "text/cache-manifest")) {
+        cacheUpdateFailed();
+        return;
+    }
+
     m_manifestResource = ApplicationCacheResource::create(m_manifestHandle->request().url(), response, 
                                                           ApplicationCacheResource::Manifest);
 }
 
 void ApplicationCacheGroup::didReceiveManifestData(const char* data, int length)
 {
-    ASSERT(m_manifestResource);
-    m_manifestResource->data()->append(data, length);
+    if (m_manifestResource)
+        m_manifestResource->data()->append(data, length);
 }
 
 void ApplicationCacheGroup::didFinishLoadingManifest()
 {
-    if (!m_manifestResource) {
-        didFailToLoadManifest();
+    bool isUpgradeAttempt = m_newestCache;
+
+    if (!isUpgradeAttempt && !m_manifestResource) {
+        // The server returned 304 Not Modified even though we didn't send a conditional request.
+        cacheUpdateFailed();
         return;
     }
 
-    bool isUpgradeAttempt = m_newestCache;
-    
     m_manifestHandle = 0;
 
-    // Check if the manifest is byte-for-byte identical.
+    // Check if the manifest was not modified.
     if (isUpgradeAttempt) {
         ApplicationCacheResource* newestManifest = m_newestCache->manifestResource();
         ASSERT(newestManifest);
     
-        if (newestManifest->data()->size() == m_manifestResource->data()->size() &&
-            !memcmp(newestManifest->data()->data(), m_manifestResource->data()->data(), newestManifest->data()->size())) {
-            
-            callListenersOnAssociatedDocuments(&DOMApplicationCache::callNoUpdateListener);
-         
-            m_status = Idle;
-            m_frame = 0;
+        if (!m_manifestResource || // The resource will be null if HTTP response was 304 Not Modified.
+            newestManifest->data()->size() == m_manifestResource->data()->size() && !memcmp(newestManifest->data()->data(), m_manifestResource->data()->data(), newestManifest->data()->size())) {
+
+            m_completionType = NoUpdate;
             m_manifestResource = 0;
+            deliverDelayedMainResources();
+
             return;
         }
     }
     
     Manifest manifest;
     if (!parseManifest(m_manifestURL, m_manifestResource->data()->data(), m_manifestResource->data()->size(), manifest)) {
-        didFailToLoadManifest();
+        cacheUpdateFailed();
         return;
     }
-        
+
+    ASSERT(!m_cacheBeingUpdated);
+    m_cacheBeingUpdated = ApplicationCache::create();
+    m_cacheBeingUpdated->setGroup(this);
+
+    HashSet<DocumentLoader*>::const_iterator masterEnd = m_pendingMasterResourceLoaders.end();
+    for (HashSet<DocumentLoader*>::const_iterator iter = m_pendingMasterResourceLoaders.begin(); iter != masterEnd; ++iter)
+        associateDocumentLoaderWithCache(*iter, m_cacheBeingUpdated.get());
+
     // We have the manifest, now download the resources.
-    m_status = Downloading;
+    m_updateStatus = Downloading;
     
-    callListenersOnAssociatedDocuments(&DOMApplicationCache::callDownloadingListener);
+    postListenerTask(&DOMApplicationCache::callDownloadingListener, m_associatedDocumentLoaders);
+
+    ASSERT(m_pendingEntries.isEmpty());
 
-#ifndef NDEBUG
-    // We should only have implicit entries.
-    {
-        EntryMap::const_iterator end = m_pendingEntries.end();
-        for (EntryMap::const_iterator it = m_pendingEntries.begin(); it != end; ++it)
-            ASSERT(it->second & ApplicationCacheResource::Implicit);
-    }
-#endif
-    
     if (isUpgradeAttempt) {
-        ASSERT(!m_cacheBeingUpdated);
-        
-        m_cacheBeingUpdated = ApplicationCache::create();
-        
         ApplicationCache::ResourceMap::const_iterator end = m_newestCache->end();
         for (ApplicationCache::ResourceMap::const_iterator it = m_newestCache->begin(); it != end; ++it) {
             unsigned type = it->second->type();
-            if (type & (ApplicationCacheResource::Implicit | ApplicationCacheResource::Dynamic))
+            if (type & ApplicationCacheResource::Master)
                 addEntry(it->first, type);
         }
     }
@@ -534,81 +655,125 @@ void ApplicationCacheGroup::didFinishLoadingManifest()
 void ApplicationCacheGroup::cacheUpdateFailed()
 {
     stopLoading();
-        
-    callListenersOnAssociatedDocuments(&DOMApplicationCache::callErrorListener);
+    m_manifestResource = 0;
 
-    m_pendingEntries.clear();
+    // Wait for master resource loads to finish.
+    m_completionType = Failure;
+    deliverDelayedMainResources();
+}
+    
+void ApplicationCacheGroup::manifestNotFound()
+{
+    makeObsolete();
+
+    postListenerTask(&DOMApplicationCache::callObsoleteListener, m_associatedDocumentLoaders);
+    postListenerTask(&DOMApplicationCache::callErrorListener, m_pendingMasterResourceLoaders);
+
+    stopLoading();
+
+    ASSERT(m_pendingEntries.isEmpty());
     m_manifestResource = 0;
 
-    while (!m_cacheCandidates.isEmpty()) {
-        HashSet<DocumentLoader*>::iterator it = m_cacheCandidates.begin();
+    while (!m_pendingMasterResourceLoaders.isEmpty()) {
+        HashSet<DocumentLoader*>::iterator it = m_pendingMasterResourceLoaders.begin();
         
         ASSERT((*it)->candidateApplicationCacheGroup() == this);
+        ASSERT(!(*it)->applicationCache());
         (*it)->setCandidateApplicationCacheGroup(0);
-        m_cacheCandidates.remove(it);
+        m_pendingMasterResourceLoaders.remove(it);
     }
-    
-    m_status = Idle;    
+
+    m_downloadingPendingMasterResourceLoadersCount = 0;
+    m_updateStatus = Idle;    
     m_frame = 0;
     
-    // If there are no associated caches, delete ourselves
-    if (m_associatedDocumentLoaders.isEmpty())
+    if (m_caches.isEmpty()) {
+        ASSERT(m_associatedDocumentLoaders.isEmpty());
+        ASSERT(!m_cacheBeingUpdated);
         delete this;
-}
-    
-    
-void ApplicationCacheGroup::didFailToLoadManifest()
-{
-    // Note that cacheUpdateFailed() can cause the cache group to be deleted.
-    cacheUpdateFailed();
+    }
 }
 
 void ApplicationCacheGroup::checkIfLoadIsComplete()
 {
-    ASSERT(m_cacheBeingUpdated);
-    
-    if (m_manifestHandle)
-        return;
-    
-    if (!m_pendingEntries.isEmpty())
+    if (m_manifestHandle || !m_pendingEntries.isEmpty() || m_downloadingPendingMasterResourceLoadersCount)
         return;
     
-    // We're done    
+    // We're done, all resources have finished downloading (successfully or not).
+
     bool isUpgradeAttempt = m_newestCache;
-    
-    m_cacheBeingUpdated->setManifestResource(m_manifestResource.release());
-    
-    Vector<RefPtr<DocumentLoader> > documentLoaders;
 
-    if (isUpgradeAttempt) {
-        ASSERT(m_cacheCandidates.isEmpty());
-        
-        copyToVector(m_associatedDocumentLoaders, documentLoaders);
-    } else {
-        while (!m_cacheCandidates.isEmpty()) {
-            HashSet<DocumentLoader*>::iterator it = m_cacheCandidates.begin();
-            
-            DocumentLoader* loader = *it;
-            ASSERT(!loader->applicationCache());
-            ASSERT(loader->candidateApplicationCacheGroup() == this);
-            
-            associateDocumentLoaderWithCache(loader, m_cacheBeingUpdated.get());
-    
-            documentLoaders.append(loader);
-
-            m_cacheCandidates.remove(it);
+    switch (m_completionType) {
+    case None:
+        ASSERT_NOT_REACHED();
+        return;
+    case NoUpdate:
+        ASSERT(isUpgradeAttempt);
+        ASSERT(!m_cacheBeingUpdated);
+
+        // The storage could have been manually emptied by the user.
+        if (!m_storageID)
+            cacheStorage().storeNewestCache(this);
+
+        postListenerTask(&DOMApplicationCache::callNoUpdateListener, m_associatedDocumentLoaders);
+        break;
+    case Failure:
+        ASSERT(!m_cacheBeingUpdated);
+        postListenerTask(&DOMApplicationCache::callErrorListener, m_associatedDocumentLoaders);
+        if (m_caches.isEmpty()) {
+            ASSERT(m_associatedDocumentLoaders.isEmpty());
+            delete this;
+            return;
         }
+        break;
+    case Completed: {
+        // FIXME: Fetch the resource from manifest URL again, and check whether it is identical to the one used for update (in case the application was upgraded server-side in the meanwhile). (<rdar://problem/6467625>)
+
+        ASSERT(m_cacheBeingUpdated);
+        m_cacheBeingUpdated->setManifestResource(m_manifestResource.release());
+
+        RefPtr<ApplicationCache> oldNewestCache = (m_newestCache == m_cacheBeingUpdated) ? 0 : m_newestCache;
+
+        setNewestCache(m_cacheBeingUpdated.release());
+        if (cacheStorage().storeNewestCache(this)) {
+            // New cache stored, now remove the old cache.
+            if (oldNewestCache)
+                cacheStorage().remove(oldNewestCache.get());
+            // Fire the success events.
+            postListenerTask(isUpgradeAttempt ? &DOMApplicationCache::callUpdateReadyListener : &DOMApplicationCache::callCachedListener, m_associatedDocumentLoaders);
+        } else {
+            // Run the "cache failure steps"
+            // Fire the error events to all pending master entries, as well any other cache hosts
+            // currently associated with a cache in this group.
+            postListenerTask(&DOMApplicationCache::callErrorListener, m_associatedDocumentLoaders);
+            // Disassociate the pending master entries from the failed new cache. Note that
+            // all other loaders in the m_associatedDocumentLoaders are still associated with
+            // some other cache in this group. They are not associated with the failed new cache.
+
+            // Need to copy loaders, because the cache group may be destroyed at the end of iteration.
+            Vector<DocumentLoader*> loaders;
+            copyToVector(m_pendingMasterResourceLoaders, loaders);
+            size_t count = loaders.size();
+            for (size_t i = 0; i != count; ++i)
+                disassociateDocumentLoader(loaders[i]); // This can delete this group.
+
+            // Reinstate the oldNewestCache, if there was one.
+            if (oldNewestCache) {
+                // This will discard the failed new cache.
+                setNewestCache(oldNewestCache.release());
+            } else {
+                // We must have been deleted by the last call to disassociateDocumentLoader().
+                return;
+            }
+        }
+        break;
+    }
     }
-    
-    setNewestCache(m_cacheBeingUpdated.release());
-        
-    // Store the cache 
-    cacheStorage().storeNewestCache(this);
-    
-    callListeners(isUpgradeAttempt ? &DOMApplicationCache::callUpdateReadyListener : &DOMApplicationCache::callCachedListener, 
-                  documentLoaders);
 
-    m_status = Idle;
+    // Empty cache group's list of pending master entries.
+    m_pendingMasterResourceLoaders.clear();
+    m_completionType = None;
+    m_updateStatus = Idle;
     m_frame = 0;
 }
 
@@ -617,52 +782,58 @@ void ApplicationCacheGroup::startLoadingEntry()
     ASSERT(m_cacheBeingUpdated);
 
     if (m_pendingEntries.isEmpty()) {
-        checkIfLoadIsComplete();
+        m_completionType = Completed;
+        deliverDelayedMainResources();
         return;
     }
     
     EntryMap::const_iterator it = m_pendingEntries.begin();
 
-    // If this is an initial cache attempt, we do not want to fetch any implicit entries,
-    // since those are fed to us by the normal loader machinery.
-    if (!m_newestCache) {
-        // Get the first URL in the entry table that is not implicit
-        EntryMap::const_iterator end = m_pendingEntries.end();
-    
-        while (it->second & ApplicationCacheResource::Implicit) {
-            ++it;
+    postListenerTask(&DOMApplicationCache::callProgressListener, m_associatedDocumentLoaders);
 
-            if (it == end)
-                return;
-        }
-    }
-    
-    callListenersOnAssociatedDocuments(&DOMApplicationCache::callProgressListener);
-
-    // FIXME: If this is an upgrade attempt, the newest cache should be used as an HTTP cache.
-    
     ASSERT(!m_currentHandle);
     
-    ResourceRequest request(it->first);
-    m_frame->loader()->applyUserAgent(request);
+    m_currentHandle = createResourceHandle(KURL(it->first), m_newestCache ? m_newestCache->resourceForURL(it->first) : 0);
+}
 
-    m_currentHandle = ResourceHandle::create(request, this, m_frame, false, true, false);
+void ApplicationCacheGroup::deliverDelayedMainResources()
+{
+    // Need to copy loaders, because the cache group may be destroyed at the end of iteration.
+    Vector<DocumentLoader*> loaders;
+    copyToVector(m_pendingMasterResourceLoaders, loaders);
+    size_t count = loaders.size();
+    for (size_t i = 0; i != count; ++i) {
+        DocumentLoader* loader = loaders[i];
+        if (loader->isLoadingMainResource())
+            continue;
+
+        const ResourceError& error = loader->mainDocumentError();
+        if (error.isNull())
+            finishedLoadingMainResource(loader);
+        else
+            failedLoadingMainResource(loader);
+    }
+    if (!count)
+        checkIfLoadIsComplete();
 }
 
 void ApplicationCacheGroup::addEntry(const String& url, unsigned type)
 {
     ASSERT(m_cacheBeingUpdated);
     
-    // Don't add the URL if we already have an implicit resource in the cache
+    // Don't add the URL if we already have an master resource in the cache
+    // (i.e., the main resource finished loading before the manifest).
     if (ApplicationCacheResource* resource = m_cacheBeingUpdated->resourceForURL(url)) {
-        ASSERT(resource->type() & ApplicationCacheResource::Implicit);
+        ASSERT(resource->type() & ApplicationCacheResource::Master);
+        ASSERT(!m_frame->loader()->documentLoader()->isLoadingMainResource());
     
         resource->addType(type);
         return;
     }
 
     // Don't add the URL if it's the same as the manifest URL.
-    if (m_manifestResource && m_manifestResource->url() == url) {
+    ASSERT(m_manifestResource);
+    if (m_manifestResource->url() == url) {
         m_manifestResource->addType(type);
         return;
     }
@@ -675,33 +846,60 @@ void ApplicationCacheGroup::addEntry(const String& url, unsigned type)
 
 void ApplicationCacheGroup::associateDocumentLoaderWithCache(DocumentLoader* loader, ApplicationCache* cache)
 {
+    // If teardown started already, revive the group.
+    if (!m_newestCache && !m_cacheBeingUpdated)
+        m_newestCache = cache;
+
+    ASSERT(!m_isObsolete);
+
     loader->setApplicationCache(cache);
-    
+
     ASSERT(!m_associatedDocumentLoaders.contains(loader));
     m_associatedDocumentLoaders.add(loader);
 }
  
-void ApplicationCacheGroup::callListenersOnAssociatedDocuments(ListenerFunction listenerFunction)
-{
-    Vector<RefPtr<DocumentLoader> > loaders;
-    copyToVector(m_associatedDocumentLoaders, loaders);
+class CallCacheListenerTask : public ScriptExecutionContext::Task {
+    typedef void (DOMApplicationCache::*ListenerFunction)();
+public:
+    static PassRefPtr<CallCacheListenerTask> create(ListenerFunction listenerFunction)
+    {
+        return adoptRef(new CallCacheListenerTask(listenerFunction));
+    }
+
+    virtual void performTask(ScriptExecutionContext* context)
+    {
+        ASSERT(context->isDocument());
+        if (DOMWindow* window = static_cast<Document*>(context)->domWindow()) {
+            if (DOMApplicationCache* domCache = window->optionalApplicationCache())
+                (domCache->*m_listenerFunction)();
+        }
+    }
 
-    callListeners(listenerFunction, loaders);
+private:
+    CallCacheListenerTask(ListenerFunction listenerFunction)
+        : m_listenerFunction(listenerFunction)
+    {
+    }
+
+    ListenerFunction m_listenerFunction;
+};
+
+void ApplicationCacheGroup::postListenerTask(ListenerFunction listenerFunction, const HashSet<DocumentLoader*>& loaderSet)
+{
+    HashSet<DocumentLoader*>::const_iterator loaderSetEnd = loaderSet.end();
+    for (HashSet<DocumentLoader*>::const_iterator iter = loaderSet.begin(); iter != loaderSetEnd; ++iter)
+        postListenerTask(listenerFunction, *iter);
 }
-    
-void ApplicationCacheGroup::callListeners(ListenerFunction listenerFunction, const Vector<RefPtr<DocumentLoader> >& loaders)
+
+void ApplicationCacheGroup::postListenerTask(ListenerFunction listenerFunction, DocumentLoader* loader)
 {
-    for (unsigned i = 0; i < loaders.size(); i++) {
-        Frame* frame = loaders[i]->frame();
-        if (!frame)
-            continue;
-        
-        ASSERT(frame->loader()->documentLoader() == loaders[i]);
-        DOMWindow* window = frame->domWindow();
-        
-        if (DOMApplicationCache* domCache = window->optionalApplicationCache())
-            (domCache->*listenerFunction)();
-    }    
+    Frame* frame = loader->frame();
+    if (!frame)
+        return;
+    
+    ASSERT(frame->loader()->documentLoader() == loader);
+
+    frame->document()->postTask(CallCacheListenerTask::create(listenerFunction));
 }
 
 void ApplicationCacheGroup::clearStorageID()
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.h b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.h
index 8928e75..063fb3b 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.h
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheGroup.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -47,12 +47,17 @@ class Document;
 class DocumentLoader;
 class Frame;
 
+enum ApplicationCacheUpdateOption {
+    ApplicationCacheUpdateWithBrowsingContext,
+    ApplicationCacheUpdateWithoutBrowsingContext
+};
+
 class ApplicationCacheGroup : Noncopyable, ResourceHandleClient {
 public:
     ApplicationCacheGroup(const KURL& manifestURL, bool isCopy = false);    
     ~ApplicationCacheGroup();
     
-    enum Status { Idle, Checking, Downloading };
+    enum UpdateStatus { Idle, Checking, Downloading };
 
     static ApplicationCache* cacheForMainRequest(const ResourceRequest&, DocumentLoader*);
     static ApplicationCache* fallbackCacheForMainRequest(const ResourceRequest&, DocumentLoader*);
@@ -61,30 +66,38 @@ public:
     static void selectCacheWithoutManifestURL(Frame*);
     
     const KURL& manifestURL() const { return m_manifestURL; }
-    Status status() const { return m_status; }
-    
+    UpdateStatus updateStatus() const { return m_updateStatus; }
+
     void setStorageID(unsigned storageID) { m_storageID = storageID; }
     unsigned storageID() const { return m_storageID; }
     void clearStorageID();
     
-    void update(Frame*);
+    void update(Frame*, ApplicationCacheUpdateOption); // FIXME: Frame should not bee needed when updating witout browsing context.
     void cacheDestroyed(ApplicationCache*);
-        
+
+    bool cacheIsBeingUpdated(const ApplicationCache* cache) const { return cache == m_cacheBeingUpdated; }
+
     ApplicationCache* newestCache() const { return m_newestCache.get(); }
-    ApplicationCache* savedNewestCachePointer() const { return m_savedNewestCachePointer; }
-    
+    void setNewestCache(PassRefPtr<ApplicationCache>);
+
+    void makeObsolete();
+    bool isObsolete() const { return m_isObsolete; }
+
     void finishedLoadingMainResource(DocumentLoader*);
     void failedLoadingMainResource(DocumentLoader*);
-    void documentLoaderDestroyed(DocumentLoader*);
 
-    void setNewestCache(PassRefPtr<ApplicationCache> newestCache);
+    void disassociateDocumentLoader(DocumentLoader*);
 
     bool isCopy() const { return m_isCopy; }
+
 private:
     typedef void (DOMApplicationCache::*ListenerFunction)();
-    void callListenersOnAssociatedDocuments(ListenerFunction);
-    void callListeners(ListenerFunction, const Vector<RefPtr<DocumentLoader> >& loaders);
-    
+    static void postListenerTask(ListenerFunction, const HashSet<DocumentLoader*>&);
+    static void postListenerTask(ListenerFunction, const Vector<RefPtr<DocumentLoader> >& loaders);
+    static void postListenerTask(ListenerFunction, DocumentLoader*);
+
+    PassRefPtr<ResourceHandle> createResourceHandle(const KURL&, ApplicationCacheResource* newestCachedResource);
+
     virtual void didReceiveResponse(ResourceHandle*, const ResourceResponse&);
     virtual void didReceiveData(ResourceHandle*, const char*, int, int lengthReceived);
     virtual void didFinishLoading(ResourceHandle*);
@@ -93,11 +106,12 @@ private:
     void didReceiveManifestResponse(const ResourceResponse&);
     void didReceiveManifestData(const char*, int);
     void didFinishLoadingManifest();
-    void didFailToLoadManifest();
     
     void startLoadingEntry();
+    void deliverDelayedMainResources();
     void checkIfLoadIsComplete();
     void cacheUpdateFailed();
+    void manifestNotFound();
     
     void addEntry(const String&, unsigned type);
     
@@ -106,37 +120,47 @@ private:
     void stopLoading();
     
     KURL m_manifestURL;
-    Status m_status;
+    UpdateStatus m_updateStatus;
     
-    // This is the newest cache in the group.
+    // This is the newest complete cache in the group.
     RefPtr<ApplicationCache> m_newestCache;
     
-    // During tear-down we save the pointer to the newest cache to prevent reference cycles.
-    ApplicationCache* m_savedNewestCachePointer;
-    
-    // The caches in this cache group.
+    // All complete caches in this cache group.
     HashSet<ApplicationCache*> m_caches;
     
     // The cache being updated (if any). Note that cache updating does not immediately create a new
-    // ApplicationCache object, so this may be null even when status is not Idle.
+    // ApplicationCache object, so this may be null even when update status is not Idle.
     RefPtr<ApplicationCache> m_cacheBeingUpdated;
 
-    // When a cache group does not yet have a complete cache, this contains the document loaders
-    // that should be associated with the cache once it has been downloaded.
-    HashSet<DocumentLoader*> m_cacheCandidates;
+    // List of pending master entries, used during the update process to ensure that new master entries are cached.
+    HashSet<DocumentLoader*> m_pendingMasterResourceLoaders;
+    // How many of the above pending master entries have not yet finished downloading.
+    int m_downloadingPendingMasterResourceLoadersCount;
     
     // These are all the document loaders that are associated with a cache in this group.
     HashSet<DocumentLoader*> m_associatedDocumentLoaders;
-    
+
     // The URLs and types of pending cache entries.
     typedef HashMap<String, unsigned> EntryMap;
     EntryMap m_pendingEntries;
 
-    // Frame used for fetching resources when updating
+    // Frame used for fetching resources when updating.
+    // FIXME: An update started by a particular frame should not stop if it is destroyed, but there are other frames associated with the same cache group.
     Frame* m_frame;
   
+    // An obsolete cache group is never stored, but the opposite is not true - storing may fail for multiple reasons, such as exceeding disk quota.
     unsigned m_storageID;
-  
+    bool m_isObsolete;
+
+    // During update, this is used to handle asynchronously arriving results.
+    enum CompletionType {
+        None,
+        NoUpdate,
+        Failure,
+        Completed
+    };
+    CompletionType m_completionType;
+
     // Whether this cache group is a copy that's only used for transferring the cache to another file.
     bool m_isCopy;
     
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.cpp
index d78cf7f..4beb76a 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.cpp
@@ -47,8 +47,8 @@ void ApplicationCacheResource::addType(unsigned type)
 #ifndef NDEBUG
 void ApplicationCacheResource::dumpType(unsigned type)
 {
-    if (type & Implicit)
-        printf("implicit ");
+    if (type & Master)
+        printf("master ");
     if (type & Manifest)
         printf("manifest ");
     if (type & Explicit)
@@ -57,8 +57,6 @@ void ApplicationCacheResource::dumpType(unsigned type)
         printf("foreign ");
     if (type & Fallback)
         printf("fallback ");
-    if (type & Dynamic)
-        printf("dynamic ");
     
     printf("\n");
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.h b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.h
index 96f5a0e..0a8d6c2 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.h
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheResource.h
@@ -35,12 +35,11 @@ namespace WebCore {
 class ApplicationCacheResource : public SubstituteResource {
 public:
     enum Type {
-        Implicit = 1 << 0,
+        Master = 1 << 0,
         Manifest = 1 << 1,
         Explicit = 1 << 2,
         Foreign = 1 << 3,
-        Fallback = 1 << 4,
-        Dynamic = 1 << 5
+        Fallback = 1 << 4
     };
         
     static PassRefPtr<ApplicationCacheResource> create(const KURL& url, const ResourceResponse& response, unsigned type, PassRefPtr<SharedBuffer> buffer = SharedBuffer::create())
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.cpp
index 97a6d5a..7e611cd 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -43,6 +43,44 @@ using namespace std;
 
 namespace WebCore {
 
+class ResourceStorageIDJournal {
+public:  
+    ~ResourceStorageIDJournal()
+    {
+        size_t size = m_records.size();
+        for (size_t i = 0; i < size; ++i)
+            m_records[i].restore();
+    }
+
+    void add(ApplicationCacheResource* resource, unsigned storageID)
+    {
+        m_records.append(Record(resource, storageID));
+    }
+
+    void commit()
+    {
+        m_records.clear();
+    }
+
+private:
+    class Record {
+    public:
+        Record() : m_resource(0), m_storageID(0) { }
+        Record(ApplicationCacheResource* resource, unsigned storageID) : m_resource(resource), m_storageID(storageID) { }
+
+        void restore()
+        {
+            m_resource->setStorageID(m_storageID);
+        }
+
+    private:
+        ApplicationCacheResource* m_resource;
+        unsigned m_storageID;
+    };
+
+    Vector<Record> m_records;
+};
+
 static unsigned urlHostHash(const KURL& url)
 {
     unsigned hostStart = url.hostStart();
@@ -147,7 +185,9 @@ ApplicationCacheGroup* ApplicationCacheStorage::cacheGroupForURL(const KURL& url
     CacheGroupMap::const_iterator end = m_cachesInMemory.end();
     for (CacheGroupMap::const_iterator it = m_cachesInMemory.begin(); it != end; ++it) {
         ApplicationCacheGroup* group = it->second;
-        
+
+        ASSERT(!group->isObsolete());
+
         if (!protocolHostAndPortAreEqual(url, group->manifestURL()))
             continue;
         
@@ -213,6 +253,8 @@ ApplicationCacheGroup* ApplicationCacheStorage::fallbackCacheGroupForURL(const K
     for (CacheGroupMap::const_iterator it = m_cachesInMemory.begin(); it != end; ++it) {
         ApplicationCacheGroup* group = it->second;
         
+        ASSERT(!group->isObsolete());
+
         if (ApplicationCache* cache = group->newestCache()) {
             KURL fallbackURL;
             if (!cache->urlMatchesFallbackNamespace(url, &fallbackURL))
@@ -271,15 +313,33 @@ ApplicationCacheGroup* ApplicationCacheStorage::fallbackCacheGroupForURL(const K
 
 void ApplicationCacheStorage::cacheGroupDestroyed(ApplicationCacheGroup* group)
 {
+    if (group->isObsolete()) {
+        ASSERT(!group->storageID());
+        ASSERT(m_cachesInMemory.get(group->manifestURL()) != group);
+        return;
+    }
+
     ASSERT(m_cachesInMemory.get(group->manifestURL()) == group);
 
     m_cachesInMemory.remove(group->manifestURL());
     
-    // If the cache is half-created, we don't want it in the saved set.
-    if (!group->savedNewestCachePointer())
+    // If the cache group is half-created, we don't want it in the saved set (as it is not stored in database).
+    if (!group->storageID())
         m_cacheHostSet.remove(urlHostHash(group->manifestURL()));
 }
 
+void ApplicationCacheStorage::cacheGroupMadeObsolete(ApplicationCacheGroup* group)
+{
+    ASSERT(m_cachesInMemory.get(group->manifestURL()) == group);
+    ASSERT(m_cacheHostSet.contains(urlHostHash(group->manifestURL())));
+
+    if (ApplicationCache* newestCache = group->newestCache())
+        remove(newestCache);
+
+    m_cachesInMemory.remove(group->manifestURL());
+    m_cacheHostSet.remove(urlHostHash(group->manifestURL()));
+}
+
 void ApplicationCacheStorage::setCacheDirectory(const String& cacheDirectory)
 {
     ASSERT(m_cacheDirectory.isNull());
@@ -321,8 +381,8 @@ void ApplicationCacheStorage::verifySchemaVersion()
     setDatabaseVersion.begin();
 
     char userVersionSQL[32];
-    int numBytes = snprintf(userVersionSQL, sizeof(userVersionSQL), "PRAGMA user_version=%d", schemaVersion);
-    ASSERT_UNUSED(numBytes, static_cast<int>(sizeof(userVersionSQL)) >= numBytes);
+    int unusedNumBytes = snprintf(userVersionSQL, sizeof(userVersionSQL), "PRAGMA user_version=%d", schemaVersion);
+    ASSERT_UNUSED(unusedNumBytes, static_cast<int>(sizeof(userVersionSQL)) >= unusedNumBytes);
 
     SQLiteStatement statement(m_database, userVersionSQL);
     if (statement.prepare() != SQLResultOk)
@@ -372,7 +432,13 @@ void ApplicationCacheStorage::openDatabase(bool createIfDoesNotExist)
                       "  DELETE FROM CacheWhitelistURLs WHERE cache = OLD.id;"
                       "  DELETE FROM FallbackURLs WHERE cache = OLD.id;"
                       " END");
-    
+
+    // When a cache entry is deleted, its resource should also be deleted.
+    executeSQLCommand("CREATE TRIGGER IF NOT EXISTS CacheEntryDeleted AFTER DELETE ON CacheEntries"
+                      " FOR EACH ROW BEGIN"
+                      "  DELETE FROM CacheResources WHERE id = OLD.resource;"
+                      " END");
+
     // When a cache resource is deleted, its data blob should also be deleted.
     executeSQLCommand("CREATE TRIGGER IF NOT EXISTS CacheResourceDeleted AFTER DELETE ON CacheResources"
                       " FOR EACH ROW BEGIN"
@@ -408,10 +474,11 @@ bool ApplicationCacheStorage::store(ApplicationCacheGroup* group)
     return true;
 }    
 
-bool ApplicationCacheStorage::store(ApplicationCache* cache)
+bool ApplicationCacheStorage::store(ApplicationCache* cache, ResourceStorageIDJournal* storageIDJournal)
 {
     ASSERT(cache->storageID() == 0);
     ASSERT(cache->group()->storageID() != 0);
+    ASSERT(storageIDJournal);
     
     SQLiteStatement statement(m_database, "INSERT INTO Caches (cacheGroup) VALUES (?)");
     if (statement.prepare() != SQLResultOk)
@@ -428,8 +495,13 @@ bool ApplicationCacheStorage::store(ApplicationCache* cache)
     {
         ApplicationCache::ResourceMap::const_iterator end = cache->end();
         for (ApplicationCache::ResourceMap::const_iterator it = cache->begin(); it != end; ++it) {
+            unsigned oldStorageID = it->second->storageID();
             if (!store(it->second.get(), cacheStorageID))
                 return false;
+
+            // Storing the resource succeeded. Log its old storageID in case
+            // it needs to be restored later.
+            storageIDJournal->add(it->second.get(), oldStorageID);
         }
     }
     
@@ -543,9 +615,6 @@ bool ApplicationCacheStorage::storeUpdatedType(ApplicationCacheResource* resourc
     ASSERT_UNUSED(cache, cache->storageID());
     ASSERT(resource->storageID());
 
-    // FIXME: If the resource gained a Dynamic bit, it should be re-inserted at the end for correct order.
-    ASSERT(!(resource->type() & ApplicationCacheResource::Dynamic));
-    
     // First, insert the data
     SQLiteStatement entryStatement(m_database, "UPDATE CacheEntries SET type=? WHERE resource=?");
     if (entryStatement.prepare() != SQLResultOk)
@@ -587,10 +656,16 @@ bool ApplicationCacheStorage::storeNewestCache(ApplicationCacheGroup* group)
     }
     
     ASSERT(group->newestCache());
+    ASSERT(!group->isObsolete());
     ASSERT(!group->newestCache()->storageID());
     
+    // Log the storageID changes to the in-memory resource objects. The journal
+    // object will roll them back automatically in case a database operation
+    // fails and this method returns early.
+    ResourceStorageIDJournal storageIDJournal;
+
     // Store the newest cache
-    if (!store(group->newestCache()))
+    if (!store(group->newestCache(), &storageIDJournal))
         return false;
     
     // Update the newest cache in the group.
@@ -605,6 +680,7 @@ bool ApplicationCacheStorage::storeNewestCache(ApplicationCacheGroup* group)
     if (!executeStatement(statement))
         return false;
     
+    storageIDJournal.commit();
     storeCacheTransaction.commit();
     return true;
 }
@@ -724,12 +800,30 @@ void ApplicationCacheStorage::remove(ApplicationCache* cache)
     if (!m_database.isOpen())
         return;
 
+    ASSERT(cache->group());
+    ASSERT(cache->group()->storageID());
+
+    // All associated data will be deleted by database triggers.
     SQLiteStatement statement(m_database, "DELETE FROM Caches WHERE id=?");
     if (statement.prepare() != SQLResultOk)
         return;
     
     statement.bindInt64(1, cache->storageID());
     executeStatement(statement);
+
+    cache->clearStorageID();
+
+    if (cache->group()->newestCache() == cache) {
+        // Currently, there are no triggers on the cache group, which is why the cache had to be removed separately above.
+        SQLiteStatement groupStatement(m_database, "DELETE FROM CacheGroups WHERE id=?");
+        if (groupStatement.prepare() != SQLResultOk)
+            return;
+        
+        groupStatement.bindInt64(1, cache->group()->storageID());
+        executeStatement(groupStatement);
+
+        cache->group()->clearStorageID();
+    }
 }    
 
 void ApplicationCacheStorage::empty()
@@ -742,7 +836,6 @@ void ApplicationCacheStorage::empty()
     // Clear cache groups, caches and cache resources.
     executeSQLCommand("DELETE FROM CacheGroups");
     executeSQLCommand("DELETE FROM Caches");
-    executeSQLCommand("DELETE FROM CacheResources");
     
     // Clear the storage IDs for the caches in memory.
     // The caches will still work, but cached resources will not be saved to disk 
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.h b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.h
index cf64dd4..b13b596 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.h
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ApplicationCacheStorage.h
@@ -40,6 +40,7 @@ class ApplicationCache;
 class ApplicationCacheGroup;
 class ApplicationCacheResource;
 class KURL;
+class ResourceStorageIDJournal;
     
 class ApplicationCacheStorage {
 public:
@@ -51,11 +52,13 @@ public:
 
     ApplicationCacheGroup* findOrCreateCacheGroup(const KURL& manifestURL);
     void cacheGroupDestroyed(ApplicationCacheGroup*);
+    void cacheGroupMadeObsolete(ApplicationCacheGroup*);
         
-    bool storeNewestCache(ApplicationCacheGroup*);
+    bool storeNewestCache(ApplicationCacheGroup*); // Updates the cache group, but doesn't remove old cache.
     void store(ApplicationCacheResource*, ApplicationCache*);
     bool storeUpdatedType(ApplicationCacheResource*, ApplicationCache*);
 
+    // Removes the group if the cache to be removed is the newest one (so, storeNewestCache() needs to be called beforehand when updating).
     void remove(ApplicationCache*);
     
     void empty();
@@ -67,7 +70,7 @@ private:
     ApplicationCacheGroup* loadCacheGroup(const KURL& manifestURL);
     
     bool store(ApplicationCacheGroup*);
-    bool store(ApplicationCache*);
+    bool store(ApplicationCache*, ResourceStorageIDJournal*);
     bool store(ApplicationCacheResource*, unsigned cacheStorageID);
 
     void loadManifestHostHashes();
@@ -84,11 +87,11 @@ private:
     SQLiteDatabase m_database;
 
     // In order to quickly determine if a given resource exists in an application cache,
-    // we keep a hash set of the hosts of the manifest URLs of all cache groups.
+    // we keep a hash set of the hosts of the manifest URLs of all non-obsolete cache groups.
     HashCountedSet<unsigned, AlreadyHashed> m_cacheHostSet;
     
     typedef HashMap<String, ApplicationCacheGroup*> CacheGroupMap;
-    CacheGroupMap m_cachesInMemory;
+    CacheGroupMap m_cachesInMemory; // Excludes obsolete cache groups.
 };
  
 ApplicationCacheStorage& cacheStorage();
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.cpp
index a07442b..5ea5d4f 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -38,7 +38,6 @@
 #include "EventNames.h"
 #include "Frame.h"
 #include "FrameLoader.h"
-#include "StaticStringList.h"
 
 namespace WebCore {
 
@@ -65,22 +64,22 @@ unsigned short DOMApplicationCache::status() const
     ApplicationCache* cache = associatedCache();    
     if (!cache)
         return UNCACHED;
-    
-    switch (cache->group()->status()) {
+
+    switch (cache->group()->updateStatus()) {
         case ApplicationCacheGroup::Checking:
             return CHECKING;
         case ApplicationCacheGroup::Downloading:
             return DOWNLOADING;
         case ApplicationCacheGroup::Idle: {
+            if (cache->group()->isObsolete())
+                return OBSOLETE;
             if (cache != cache->group()->newestCache())
                 return UPDATEREADY;
-            
             return IDLE;
         }
-        default:
-            ASSERT_NOT_REACHED();
     }
-    
+
+    ASSERT_NOT_REACHED();
     return 0;
 }
 
@@ -92,7 +91,7 @@ void DOMApplicationCache::update(ExceptionCode& ec)
         return;
     }
     
-    cache->group()->update(m_frame);
+    cache->group()->update(m_frame, ApplicationCacheUpdateWithoutBrowsingContext);
 }
 
 bool DOMApplicationCache::swapCache()
@@ -103,8 +102,14 @@ bool DOMApplicationCache::swapCache()
     ApplicationCache* cache = m_frame->loader()->documentLoader()->applicationCache();
     if (!cache)
         return false;
-    
-    // Check if we already have the newest cache
+
+    // If the group of application caches to which cache belongs has the lifecycle status obsolete, unassociate document from cache.
+    if (cache->group()->isObsolete()) {
+        cache->group()->disassociateDocumentLoader(m_frame->loader()->documentLoader());
+        return true;
+    }
+
+    // If there is no newer cache, raise an INVALID_STATE_ERR exception.
     ApplicationCache* newestCache = cache->group()->newestCache();
     if (cache == newestCache)
         return false;
@@ -121,65 +126,6 @@ void DOMApplicationCache::swapCache(ExceptionCode& ec)
         ec = INVALID_STATE_ERR;
 }
 
-PassRefPtr<DOMStringList> DOMApplicationCache::items()
-{
-    Vector<String> result;
-    if (ApplicationCache* cache = associatedCache()) {
-        unsigned numEntries = cache->numDynamicEntries();
-        result.reserveCapacity(numEntries);
-        for (unsigned i = 0; i < numEntries; ++i)
-            result.append(cache->dynamicEntry(i));
-    }
-    return StaticStringList::adopt(result);
-}
-
-bool DOMApplicationCache::hasItem(const KURL& url, ExceptionCode& ec)
-{
-    ApplicationCache* cache = associatedCache();
-    if (!cache) {
-        ec = INVALID_STATE_ERR;
-        return false;
-    }
-
-    if (!url.isValid()) {
-        ec = SYNTAX_ERR;
-        return false;
-    }
-
-    ApplicationCacheResource* resource = cache->resourceForURL(url.string());
-    return resource && (resource->type() & ApplicationCacheResource::Dynamic);
-}
-    
-void DOMApplicationCache::add(const KURL& url, ExceptionCode& ec)
-{
-    ApplicationCache* cache = associatedCache();
-    if (!cache) {
-        ec = INVALID_STATE_ERR;
-        return;
-    }
- 
-    if (!url.isValid()) {
-        ec = SYNTAX_ERR;
-        return;
-    }
-        
-    if (!cache->addDynamicEntry(url)) {
-        // This should use the (currently not specified) security exceptions in HTML5 4.3.4
-        ec = SECURITY_ERR;
-    }
-}
-
-void DOMApplicationCache::remove(const KURL& url, ExceptionCode& ec)
-{
-    ApplicationCache* cache = associatedCache();
-    if (!cache) {
-        ec = INVALID_STATE_ERR;
-        return;
-    }
-    
-    cache->removeDynamicEntry(url);
-}
-
 ScriptExecutionContext* DOMApplicationCache::scriptExecutionContext() const
 {
     return m_frame->document();
@@ -287,6 +233,11 @@ void DOMApplicationCache::callCachedListener()
     callListener(eventNames().cachedEvent, m_onCachedListener.get());
 }
 
+void DOMApplicationCache::callObsoleteListener()
+{
+    callListener(eventNames().obsoleteEvent, m_onObsoleteListener.get());
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(OFFLINE_WEB_APPLICATIONS)
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.h b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.h
index 9371cd7..4fe1511 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.h
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -40,7 +40,6 @@ namespace WebCore {
 
 class ApplicationCache;
 class AtomicStringImpl;
-class DOMStringList;
 class Frame;
 class KURL;
 class String;
@@ -56,6 +55,7 @@ public:
         CHECKING = 2,
         DOWNLOADING = 3,
         UPDATEREADY = 4,
+        OBSOLETE = 5
     };
 
     unsigned short status() const;
@@ -63,11 +63,6 @@ public:
     void update(ExceptionCode&);
     void swapCache(ExceptionCode&);
     
-    PassRefPtr<DOMStringList> items();
-    bool hasItem(const KURL&, ExceptionCode&);
-    void add(const KURL&, ExceptionCode&);
-    void remove(const KURL&, ExceptionCode&);
-
     virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
     virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
     virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
@@ -100,6 +95,9 @@ public:
     void setOncached(PassRefPtr<EventListener> eventListener) { m_onCachedListener = eventListener; }
     EventListener* oncached() const { return m_onCachedListener.get(); }
 
+    void setOnobsolete(PassRefPtr<EventListener> eventListener) { m_onObsoleteListener = eventListener; }
+    EventListener* onobsolete() const { return m_onObsoleteListener.get(); }
+
     virtual ScriptExecutionContext* scriptExecutionContext() const;
     DOMApplicationCache* toDOMApplicationCache() { return this; }
 
@@ -110,6 +108,7 @@ public:
     void callProgressListener();
     void callUpdateReadyListener();
     void callCachedListener();
+    void callObsoleteListener();
     
 private:
     DOMApplicationCache(Frame*);
@@ -128,6 +127,7 @@ private:
     RefPtr<EventListener> m_onProgressListener;
     RefPtr<EventListener> m_onUpdateReadyListener;
     RefPtr<EventListener> m_onCachedListener;
+    RefPtr<EventListener> m_onObsoleteListener;
     
     EventListenersMap m_eventListeners;
 
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.idl b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.idl
index f38cd74..ebc1d19 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.idl
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/DOMApplicationCache.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -35,21 +35,13 @@ module offline {
         const unsigned short CHECKING = 2;
         const unsigned short DOWNLOADING = 3;
         const unsigned short UPDATEREADY = 4;
+        const unsigned short OBSOLETE = 5;
         readonly attribute unsigned short status;
 
         void update()
             raises(DOMException);
         void swapCache()
             raises(DOMException);
-    
-        // dynamic entries
-        readonly attribute DOMStringList items;
-        [Custom] boolean hasItem(in DOMString url)
-            raises(DOMException);
-        [Custom] void add(in DOMString uri)
-            raises(DOMException);
-        [Custom] void remove(in DOMString uri)
-            raises(DOMException);
 
         // events
         attribute EventListener onchecking;
@@ -59,6 +51,7 @@ module offline {
         attribute EventListener onprogress;
         attribute EventListener onupdateready;
         attribute EventListener oncached;
+        attribute EventListener onobsolete;
 
         // EventTarget interface
         [Custom] void addEventListener(in DOMString type, 
diff --git a/src/3rdparty/webkit/WebCore/loader/appcache/ManifestParser.cpp b/src/3rdparty/webkit/WebCore/loader/appcache/ManifestParser.cpp
index f1b60fc..4169313 100644
--- a/src/3rdparty/webkit/WebCore/loader/appcache/ManifestParser.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/appcache/ManifestParser.cpp
@@ -30,7 +30,7 @@
 
 #include "CharacterNames.h"
 #include "KURL.h"
-#include "TextEncoding.h"
+#include "TextResourceDecoder.h"
 
 using namespace std;
 
@@ -45,36 +45,27 @@ bool parseManifest(const KURL& manifestURL, const char* data, int length, Manife
     ASSERT(manifest.fallbackURLs.isEmpty());
     
     Mode mode = Explicit;
-    String s = UTF8Encoding().decode(data, length);
-    
-    if (s.isEmpty())
-        return false;
-    
-    // Replace nulls with U+FFFD REPLACEMENT CHARACTER
-    s.replace(0, replacementCharacter);
+
+    RefPtr<TextResourceDecoder> decoder = TextResourceDecoder::create("text/cache-manifest", "UTF-8");
+    String s = decoder->decode(data, length);
+    s += decoder->flush();
     
-    // Look for the magic signature
-    if (!s.startsWith("CACHE MANIFEST")) {
-        // The magic signature was not found.
+    // Look for the magic signature: "^\xFEFF?CACHE MANIFEST[ \t]?" (the BOM is removed by TextResourceDecoder).
+    // Example: "CACHE MANIFEST #comment" is a valid signature.
+    // Example: "CACHE MANIFEST;V2" is not.
+    if (!s.startsWith("CACHE MANIFEST"))
         return false;
-    }
     
     const UChar* end = s.characters() + s.length();    
     const UChar* p = s.characters() + 14; // "CACHE MANIFEST" is 14 characters.
-    
-    while (p < end) {
-        // Skip whitespace
-        if (*p == ' ' || *p == '\t') {
-            p++;
-        } else
-            break;
-    }
-    
-    if (p < end && *p != '\n' && *p != '\r') {
-        // The magic signature was invalid
+
+    if (p < end && *p != ' ' && *p != '\t' && *p != '\n' && *p != '\r')
         return false;
-    }
-    
+
+    // Skip to the end of the line.
+    while (p < end && *p != '\r' && *p != '\n')
+        p++;
+
     while (1) {
         // Skip whitespace
         while (p < end && (*p == '\n' || *p == '\r' || *p == ' ' || *p == '\t'))
diff --git a/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.cpp b/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.cpp
index 81e2b78..d1269cc 100644
--- a/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -38,6 +38,8 @@
 #include "FrameTree.h"
 #include "HTMLFrameOwnerElement.h"
 #include "HTMLNames.h"
+#include "IconDatabase.h"
+#include "Image.h"
 #include "KURLHash.h"
 #include "Logging.h"
 #include "markup.h"
@@ -61,15 +63,16 @@ static const CFStringRef LegacyWebArchiveResourceTextEncodingNameKey = CFSTR("We
 static const CFStringRef LegacyWebArchiveResourceResponseKey = CFSTR("WebResourceResponse");
 static const CFStringRef LegacyWebArchiveResourceResponseVersionKey = CFSTR("WebResourceResponseVersion");
 
-static RetainPtr<CFDictionaryRef> createPropertyListRepresentationFromResource(ArchiveResource* resource, bool mainResource)
+RetainPtr<CFDictionaryRef> LegacyWebArchive::createPropertyListRepresentation(ArchiveResource* resource, MainResourceStatus isMainResource)
 {
     if (!resource) {
-        // The property list representation of a null/empty WebResource has the following 3 objects stored as nil
+        // The property list representation of a null/empty WebResource has the following 3 objects stored as nil.
+        // FIXME: 0 is not serializable. Presumably we need to use kCFNull here instead for compatibility.
+        // FIXME: But why do we need to support a resource of 0? Who relies on that?
         RetainPtr<CFMutableDictionaryRef> propertyList(AdoptCF, CFDictionaryCreateMutable(0, 3, 0, 0));
         CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceDataKey, 0);
         CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceURLKey, 0);
         CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceMIMETypeKey, 0);
-
         return propertyList;
     }
     
@@ -95,7 +98,7 @@ static RetainPtr<CFDictionaryRef> createPropertyListRepresentationFromResource(A
 
     // FrameName should be left out if empty for subresources, but always included for main resources
     const String& frameName(resource->frameName());
-    if (!frameName.isEmpty() || mainResource) {
+    if (!frameName.isEmpty() || isMainResource) {
         RetainPtr<CFStringRef> cfFrameName(AdoptCF, frameName.createCFString());
         CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceFrameNameKey, cfFrameName.get());
     }
@@ -114,8 +117,8 @@ static RetainPtr<CFDictionaryRef> createPropertyListRepresentationFromResource(A
     }
 
     // Don't include the resource response for the main resource
-    if (!mainResource) {
-        RetainPtr<CFDataRef> resourceResponseData = propertyListDataFromResourceResponse(resource->response());
+    if (!isMainResource) {
+        RetainPtr<CFDataRef> resourceResponseData = createPropertyListRepresentation(resource->response());
         if (resourceResponseData)
             CFDictionarySetValue(propertyList.get(), LegacyWebArchiveResourceResponseKey, resourceResponseData.get());    
     }
@@ -123,19 +126,20 @@ static RetainPtr<CFDictionaryRef> createPropertyListRepresentationFromResource(A
     return propertyList;
 }
 
-static RetainPtr<CFDictionaryRef> createPropertyListRep(Archive* archive)
+RetainPtr<CFDictionaryRef> LegacyWebArchive::createPropertyListRepresentation(Archive* archive)
 {
     RetainPtr<CFMutableDictionaryRef> propertyList(AdoptCF, CFDictionaryCreateMutable(0, 3, 0, &kCFTypeDictionaryValueCallBacks));
     
-    RetainPtr<CFDictionaryRef> mainResourceDict = createPropertyListRepresentationFromResource(archive->mainResource(), true);
+    RetainPtr<CFDictionaryRef> mainResourceDict = createPropertyListRepresentation(archive->mainResource(), MainResource);
+    ASSERT(mainResourceDict);
     if (!mainResourceDict)
         return 0;
     CFDictionarySetValue(propertyList.get(), LegacyWebArchiveMainResourceKey, mainResourceDict.get());
-        
+
     RetainPtr<CFMutableArrayRef> subresourcesArray(AdoptCF, CFArrayCreateMutable(0, archive->subresources().size(), &kCFTypeArrayCallBacks));
     const Vector<RefPtr<ArchiveResource> >& subresources(archive->subresources());
     for (unsigned i = 0; i < subresources.size(); ++i) {
-        RetainPtr<CFDictionaryRef> subresource = createPropertyListRepresentationFromResource(subresources[i].get(), false);
+        RetainPtr<CFDictionaryRef> subresource = createPropertyListRepresentation(subresources[i].get(), Subresource);
         if (subresource)
             CFArrayAppendValue(subresourcesArray.get(), subresource.get());
         else
@@ -147,7 +151,7 @@ static RetainPtr<CFDictionaryRef> createPropertyListRep(Archive* archive)
     RetainPtr<CFMutableArrayRef> subframesArray(AdoptCF, CFArrayCreateMutable(0, archive->subframeArchives().size(), &kCFTypeArrayCallBacks));
     const Vector<RefPtr<Archive> >& subframeArchives(archive->subframeArchives());
     for (unsigned i = 0; i < subframeArchives.size(); ++i) {
-        RetainPtr<CFDictionaryRef> subframeArchive = createPropertyListRep(subframeArchives[i].get());
+        RetainPtr<CFDictionaryRef> subframeArchive = createPropertyListRepresentation(subframeArchives[i].get());
         if (subframeArchive)
             CFArrayAppendValue(subframesArray.get(), subframeArchive.get());
         else
@@ -159,22 +163,23 @@ static RetainPtr<CFDictionaryRef> createPropertyListRep(Archive* archive)
     return propertyList;
 }
 
-static ResourceResponse createResourceResponseFromPropertyListData(CFDataRef data, CFStringRef responseDataType)
+ResourceResponse LegacyWebArchive::createResourceResponseFromPropertyListData(CFDataRef data, CFStringRef responseDataType)
 {
     ASSERT(data);
     if (!data)
         return ResourceResponse();
     
-    // If the ResourceResponseVersion (passed in as responseDataType) exists at all, this is a "new" webarchive that we can parse well in a cross platform manner
-    // If it doesn't exist, we will assume this is an "old" Cocoa-based WebArchive, and parse the ResourceResponse as such
+    // If the ResourceResponseVersion (passed in as responseDataType) exists at all, this is a "new" web archive that we
+    // can parse well in a cross platform manner If it doesn't exist, we will assume this is an "old" web archive with,
+    // NSURLResponse objects in it and parse the ResourceResponse as such.
     if (!responseDataType)
         return createResourceResponseFromMacArchivedData(data);
         
-    // FIXME: Parse the "new" format that the above comment references here
+    // FIXME: Parse the "new" format that the above comment references here. This format doesn't exist yet.
     return ResourceResponse();
 }
 
-static PassRefPtr<ArchiveResource> createResource(CFDictionaryRef dictionary)
+PassRefPtr<ArchiveResource> LegacyWebArchive::createResource(CFDictionaryRef dictionary)
 {
     ASSERT(dictionary);
     if (!dictionary)
@@ -236,17 +241,6 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::create()
     return adoptRef(new LegacyWebArchive);
 }
 
-PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(SharedBuffer* data)
-{
-    LOG(Archives, "LegacyWebArchive - Creating from raw data");
-    
-    RefPtr<LegacyWebArchive> archive = create();
-    if (!archive->init(data))
-        return 0;
-        
-    return archive.release();
-}
-
 PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(PassRefPtr<ArchiveResource> mainResource, Vector<PassRefPtr<ArchiveResource> >& subresources, Vector<PassRefPtr<LegacyWebArchive> >& subframeArchives)
 {
     ASSERT(mainResource);
@@ -265,19 +259,19 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(PassRefPtr<ArchiveResource
     return archive.release();
 }
 
-LegacyWebArchive::LegacyWebArchive()
-{
-}
-
-bool LegacyWebArchive::init(SharedBuffer* data)
+PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(SharedBuffer* data)
 {
+    LOG(Archives, "LegacyWebArchive - Creating from raw data");
+    
+    RefPtr<LegacyWebArchive> archive = create();
+        
     ASSERT(data);
     if (!data)
-        return false;
+        return 0;
         
     RetainPtr<CFDataRef> cfData(AdoptCF, data->createCFData());
     if (!cfData)
-        return false;
+        return 0;
         
     CFStringRef errorString = 0;
     
@@ -289,15 +283,18 @@ bool LegacyWebArchive::init(SharedBuffer* data)
 #endif
         if (errorString)
             CFRelease(errorString);
-        return false;
+        return 0;
     }
     
     if (CFGetTypeID(plist.get()) != CFDictionaryGetTypeID()) {
         LOG(Archives, "LegacyWebArchive - Archive property list is not the expected CFDictionary, aborting invalid WebArchive");
-        return false;
+        return 0;
     }
     
-    return extract(plist.get());
+    if (!archive->extract(plist.get()))
+        return 0;
+
+    return archive.release();
 }
 
 bool LegacyWebArchive::extract(CFDictionaryRef dictionary)
@@ -370,38 +367,47 @@ bool LegacyWebArchive::extract(CFDictionaryRef dictionary)
 
 RetainPtr<CFDataRef> LegacyWebArchive::rawDataRepresentation()
 {
-    RetainPtr<CFDictionaryRef> propertyList = createPropertyListRep(this);
+    RetainPtr<CFDictionaryRef> propertyList = createPropertyListRepresentation(this);
+    ASSERT(propertyList);
     if (!propertyList) {
         LOG(Archives, "LegacyWebArchive - Failed to create property list for archive, returning no data");
         return 0;
     }
-    
-    // FIXME: On Mac, WebArchives have been written out as Binary Property Lists until this change.
-    // Unless we jump through CFWriteStream hoops, they'll now be textual XML data.  Is this okay?
-    RetainPtr<CFDataRef> plistData(AdoptCF, CFPropertyListCreateXMLData(0, propertyList.get()));
+
+    RetainPtr<CFWriteStreamRef> stream(AdoptCF, CFWriteStreamCreateWithAllocatedBuffers(0, 0));
+
+    CFWriteStreamOpen(stream.get());
+    CFPropertyListWriteToStream(propertyList.get(), stream.get(), kCFPropertyListBinaryFormat_v1_0, 0);
+
+    RetainPtr<CFDataRef> plistData(AdoptCF, static_cast<CFDataRef>(CFWriteStreamCopyProperty(stream.get(), kCFStreamPropertyDataWritten)));
+    ASSERT(plistData);
+
+    CFWriteStreamClose(stream.get());
+
     if (!plistData) {
         LOG(Archives, "LegacyWebArchive - Failed to convert property list into raw data, returning no data");
         return 0;
     }
-    
+
     return plistData;
 }
 
 #if !PLATFORM(MAC)
-// FIXME: Is it possible to parse in a Cocoa-style resource response manually, 
-// without NSKeyed(Un)Archiver, manipulating plists directly?
-// If so, the code that does it will go here.  
-// In the meantime, Mac will continue to NSKeyed(Un)Archive the response as it always has
-ResourceResponse createResourceResponseFromMacArchivedData(CFDataRef responseData)
+
+ResourceResponse LegacyWebArchive::createResourceResponseFromMacArchivedData(CFDataRef responseData)
 {
+    // FIXME: If is is possible to parse in a serialized NSURLResponse manually, without using
+    // NSKeyedUnarchiver, manipulating plists directly, then we want to do that here.
+    // Until then, this can be done on Mac only.
     return ResourceResponse();
 }
 
-RetainPtr<CFDataRef> propertyListDataFromResourceResponse(const ResourceResponse& response)
+RetainPtr<CFDataRef> LegacyWebArchive::createPropertyListRepresentation(const ResourceResponse& response)
 {
-    // FIXME: Write out the "new" format described in ::createResourceResponseFromPropertyListData() up above
+    // FIXME: Write out the "new" format described in createResourceResponseFromPropertyListData once we invent it.
     return 0;
 }
+
 #endif
 
 PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(Node* node)
@@ -445,7 +451,7 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(Frame* frame)
     Vector<PassRefPtr<ArchiveResource> > subresources;
     documentLoader->getSubresources(subresources);
 
-    return LegacyWebArchive::create(documentLoader->mainResource(), subresources, subframeArchives);
+    return create(documentLoader->mainResource(), subresources, subframeArchives);
 }
 
 PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(Range* range)
@@ -473,7 +479,7 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(Range* range)
     return create(markupString, frame, nodeList);
 }
 
-PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(const String& markupString, Frame* frame, Vector<Node*>& nodes)
+PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(const String& markupString, Frame* frame, const Vector<Node*>& nodes)
 {
     ASSERT(frame);
     
@@ -490,19 +496,14 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(const String& markupString
     Vector<PassRefPtr<LegacyWebArchive> > subframeArchives;
     Vector<PassRefPtr<ArchiveResource> > subresources;
     HashSet<KURL> uniqueSubresources;
-    
-    Vector<Node*>::iterator it = nodes.begin();
-    Vector<Node*>::iterator end = nodes.end();
-    
-    for (; it != end; ++it) {
+
+    size_t nodesSize = nodes.size();    
+    for (size_t i = 0; i < nodesSize; ++i) {
+        Node* node = nodes[i];
         Frame* childFrame;
-        if (((*it)->hasTagName(HTMLNames::frameTag) || (*it)->hasTagName(HTMLNames::iframeTag) || (*it)->hasTagName(HTMLNames::objectTag)) &&
-             (childFrame = static_cast<HTMLFrameOwnerElement*>(*it)->contentFrame())) {
-            RefPtr<LegacyWebArchive> subframeArchive;
-            if (Document* document = childFrame->document())
-                subframeArchive = LegacyWebArchive::create(document);
-            else
-                subframeArchive = create(childFrame);
+        if ((node->hasTagName(HTMLNames::frameTag) || node->hasTagName(HTMLNames::iframeTag) || node->hasTagName(HTMLNames::objectTag)) &&
+             (childFrame = static_cast<HTMLFrameOwnerElement*>(node)->contentFrame())) {
+            RefPtr<LegacyWebArchive> subframeArchive = create(childFrame->document());
             
             if (subframeArchive)
                 subframeArchives.append(subframeArchive);
@@ -510,7 +511,7 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(const String& markupString
                 LOG_ERROR("Unabled to archive subframe %s", childFrame->tree()->name().string().utf8().data());
         } else {
             ListHashSet<KURL> subresourceURLs;
-            (*it)->getSubresourceURLs(subresourceURLs);
+            node->getSubresourceURLs(subresourceURLs);
             
             DocumentLoader* documentLoader = frame->loader()->documentLoader();
             ListHashSet<KURL>::iterator iterEnd = subresourceURLs.end();
@@ -541,7 +542,18 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::create(const String& markupString
             }
         }
     }
-    
+
+    // Add favicon if one exists for this page, if we are archiving the entire page.
+    if (nodesSize && nodes[0]->isDocumentNode() && iconDatabase() && iconDatabase()->isEnabled()) {
+        const String& iconURL = iconDatabase()->iconURLForPageURL(responseURL);
+        if (!iconURL.isEmpty() && iconDatabase()->iconDataKnownForIconURL(iconURL)) {
+            if (Image* iconImage = iconDatabase()->iconForPageURL(responseURL, IntSize(16, 16))) {
+                if (RefPtr<ArchiveResource> resource = ArchiveResource::create(iconImage->data(), KURL(iconURL), "image/x-icon", "", ""))
+                    subresources.append(resource.release());
+            }
+        }
+    }
+
     return create(mainResource, subresources, subframeArchives);
 }
 
@@ -550,13 +562,13 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::createFromSelection(Frame* frame)
     if (!frame)
         return 0;
     
-    RefPtr<Range> selectionRange = frame->selection()->toRange();
+    RefPtr<Range> selectionRange = frame->selection()->toNormalizedRange();
     Vector<Node*> nodeList;
     String markupString = frame->documentTypeString() + createMarkup(selectionRange.get(), &nodeList, AnnotateForInterchange);
     
     RefPtr<LegacyWebArchive> archive = create(markupString, frame, nodeList);
     
-    if (!frame->isFrameSet()) 
+    if (!frame->document() || !frame->document()->isFrameSet())
         return archive.release();
         
     // Wrap the frameset document in an iframe so it can be pasted into
@@ -570,7 +582,7 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::createFromSelection(Frame* frame)
     Vector<PassRefPtr<LegacyWebArchive> > subframeArchives;
     subframeArchives.append(archive);
     
-    archive = LegacyWebArchive::create(iframeResource.release(), subresources, subframeArchives);
+    archive = create(iframeResource.release(), subresources, subframeArchives);
     
     return archive.release();
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.h b/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.h
index 70faba5..8c8f2e4 100644
--- a/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.h
+++ b/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchive.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,8 +31,6 @@
 
 #include "Archive.h"
 
-#include <wtf/PassRefPtr.h>
-
 namespace WebCore {
 
 class Frame;
@@ -40,28 +38,33 @@ class Node;
 class Range;
 
 class LegacyWebArchive : public Archive {
-public:    
+public:
     static PassRefPtr<LegacyWebArchive> create();
     static PassRefPtr<LegacyWebArchive> create(SharedBuffer*);
     static PassRefPtr<LegacyWebArchive> create(PassRefPtr<ArchiveResource> mainResource, Vector<PassRefPtr<ArchiveResource> >& subresources, Vector<PassRefPtr<LegacyWebArchive> >& subframeArchives);
     static PassRefPtr<LegacyWebArchive> create(Node*);
     static PassRefPtr<LegacyWebArchive> create(Frame*);
-    static PassRefPtr<LegacyWebArchive> createFromSelection(Frame* frame);
+    static PassRefPtr<LegacyWebArchive> createFromSelection(Frame*);
     static PassRefPtr<LegacyWebArchive> create(Range*);
-    static PassRefPtr<LegacyWebArchive> create(const String& markupString, Frame*, Vector<Node*>& nodes);
 
     RetainPtr<CFDataRef> rawDataRepresentation();
 
 private:
-    LegacyWebArchive();
-    bool init(SharedBuffer*);
+    LegacyWebArchive() { }
+
+    enum MainResourceStatus { Subresource, MainResource };
+
+    static PassRefPtr<LegacyWebArchive> create(const String& markupString, Frame*, const Vector<Node*>& nodes);
+    static PassRefPtr<ArchiveResource> createResource(CFDictionaryRef);
+    static ResourceResponse createResourceResponseFromMacArchivedData(CFDataRef);
+    static ResourceResponse createResourceResponseFromPropertyListData(CFDataRef, CFStringRef responseDataType);
+    static RetainPtr<CFDataRef> createPropertyListRepresentation(const ResourceResponse&);
+    static RetainPtr<CFDictionaryRef> createPropertyListRepresentation(Archive*);
+    static RetainPtr<CFDictionaryRef> createPropertyListRepresentation(ArchiveResource*, MainResourceStatus);
+
     bool extract(CFDictionaryRef);
-    
 };
 
-ResourceResponse createResourceResponseFromMacArchivedData(CFDataRef);
-RetainPtr<CFDataRef> propertyListDataFromResourceResponse(const ResourceResponse&);
-
 }
 
 #endif // Archive
diff --git a/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchiveMac.mm b/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchiveMac.mm
index b853a15..c474bba 100644
--- a/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchiveMac.mm
+++ b/src/3rdparty/webkit/WebCore/loader/archive/cf/LegacyWebArchiveMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -33,9 +33,9 @@ namespace WebCore {
 
 static const NSString *LegacyWebArchiveResourceResponseKey = @"WebResourceResponse";
 
-// FIXME: Is it possible to parse in a Cocoa-style resource response manually, 
-// without NSKeyed(Un)Archiver, manipulating plists directly?
-ResourceResponse createResourceResponseFromMacArchivedData(CFDataRef responseData)
+// FIXME: If is is possible to parse in a serialized NSURLResponse manually, without using
+// NSKeyedUnarchiver, manipulating plists directly, we would prefer to do that instead.
+ResourceResponse LegacyWebArchive::createResourceResponseFromMacArchivedData(CFDataRef responseData)
 {    
     ASSERT(responseData);
     if (!responseData)
@@ -56,19 +56,21 @@ ResourceResponse createResourceResponseFromMacArchivedData(CFDataRef responseDat
     return ResourceResponse(response);
 }
 
-RetainPtr<CFDataRef> propertyListDataFromResourceResponse(const ResourceResponse& response)
+RetainPtr<CFDataRef> LegacyWebArchive::createPropertyListRepresentation(const ResourceResponse& response)
 {    
     NSURLResponse *nsResponse = response.nsURLResponse();
+    ASSERT(nsResponse);
     if (!nsResponse)
         return 0;
-        
-    NSMutableData *responseData = (NSMutableData *)CFDataCreateMutable(0, 0);
-    NSKeyedArchiver *archiver = [[NSKeyedArchiver alloc] initForWritingWithMutableData:responseData];
+
+    CFMutableDataRef responseData = CFDataCreateMutable(0, 0);
+
+    NSKeyedArchiver *archiver = [[NSKeyedArchiver alloc] initForWritingWithMutableData:(NSMutableData *)responseData];
     [archiver encodeObject:nsResponse forKey:LegacyWebArchiveResourceResponseKey];
     [archiver finishEncoding];
     [archiver release];
     
-    return RetainPtr<CFDataRef>(AdoptCF, (CFDataRef)responseData);
+    return RetainPtr<CFDataRef>(AdoptCF, responseData);
 }
 
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/cf/ResourceLoaderCFNet.cpp b/src/3rdparty/webkit/WebCore/loader/cf/ResourceLoaderCFNet.cpp
new file mode 100644
index 0000000..83642c6
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/loader/cf/ResourceLoaderCFNet.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ResourceLoader.h"
+
+#include "FrameLoader.h"
+#include "FrameLoaderClient.h"
+
+namespace WebCore {
+
+bool ResourceLoader::shouldCacheResponse(ResourceHandle*, CFCachedURLResponseRef cachedResponse)
+{
+    if (!m_sendResourceLoadCallbacks)
+        return 0;
+
+    CFURLResponseRef response = CFCachedURLResponseGetWrappedResponse(cachedResponse);
+    CFDataRef data = CFCachedURLResponseGetReceiverData(cachedResponse);
+    return frameLoader()->client()->shouldCacheResponse(documentLoader(), identifier(), response, CFDataGetBytePtr(data), CFDataGetLength(data));
+}
+
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp
index d033b24..3ded4f3 100644
--- a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Justin Haygood (jhaygood@reaktix.com)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -28,35 +28,20 @@
 #include "IconDatabase.h"
 
 #include "AutodrainedPool.h"
-#include "CString.h"
 #include "DocumentLoader.h"
 #include "FileSystem.h"
 #include "IconDatabaseClient.h"
 #include "IconRecord.h"
-#include "Image.h"
 #include "IntSize.h"
-#include "KURL.h"
 #include "Logging.h"
-#include "PageURLRecord.h"
 #include "SQLiteStatement.h"
 #include "SQLiteTransaction.h"
-#include "SystemTime.h"
+#include "SuddenTermination.h"
 #include <runtime/InitializeThreading.h>
+#include <wtf/CurrentTime.h>
 #include <wtf/MainThread.h>
 #include <wtf/StdLibExtras.h>
 
-#if PLATFORM(WIN_OS)
-#include <windows.h>
-#include <winbase.h>
-#include <shlobj.h>
-#else
-#include <sys/stat.h>
-#endif
-
-#if PLATFORM(DARWIN)
-#include <pthread.h>
-#endif
-
 // For methods that are meant to support API from the main thread - should not be called internally
 #define ASSERT_NOT_SYNC_THREAD() ASSERT(!m_syncThreadRunning || !IS_ICON_SYNC_THREAD())
 
@@ -64,7 +49,7 @@
 #define IS_ICON_SYNC_THREAD() (m_syncThread == currentThread())
 #define ASSERT_ICON_SYNC_THREAD() ASSERT(IS_ICON_SYNC_THREAD())
 
-#if PLATFORM(QT)
+#if PLATFORM(QT) || PLATFORM(GTK)
 #define CAN_THEME_URL_ICON
 #endif
 
@@ -77,12 +62,12 @@ static int databaseCleanupCounter = 0;
 // Currently, a mismatched schema causes the DB to be wiped and reset.  This isn't 
 // so bad during development but in the future, we would need to write a conversion
 // function to advance older released schemas to "current"
-const int currentDatabaseVersion = 6;
+static const int currentDatabaseVersion = 6;
 
 // Icons expire once every 4 days
-const int iconExpirationTime = 60*60*24*4; 
+static const int iconExpirationTime = 60*60*24*4; 
 
-const int updateTimerDelay = 5; 
+static const int updateTimerDelay = 5; 
 
 static bool checkIntegrityOnOpen = false;
 
@@ -149,7 +134,8 @@ bool IconDatabase::open(const String& databasePath)
     // Lock here as well as first thing in the thread so the thread doesn't actually commence until the createThread() call 
     // completes and m_syncThreadRunning is properly set
     m_syncLock.lock();
-    m_syncThread = createThread(IconDatabase::iconDatabaseSyncThreadStart, this, "WebCore::IconDatabase");
+    m_syncThread = createThread(IconDatabase::iconDatabaseSyncThreadStart, this, "WebCore: IconDatabase");
+    m_syncThreadRunning = m_syncThread;
     m_syncLock.unlock();
     if (!m_syncThread)
         return false;
@@ -174,6 +160,9 @@ void IconDatabase::close()
     m_syncThreadRunning = false;    
     m_threadTerminationRequested = false;
     m_removeIconsRequested = false;
+
+    m_syncDB.close();
+    ASSERT(!isOpen());
 }
 
 void IconDatabase::removeAllIcons()
@@ -765,8 +754,8 @@ size_t IconDatabase::iconRecordCountWithData()
 }
 
 IconDatabase::IconDatabase()
-    : m_syncThreadRunning(false)
-    , m_defaultIconRecord(0)
+    : m_syncTimer(this, &IconDatabase::syncTimerFired)
+    , m_syncThreadRunning(false)
     , m_isEnabled(false)
     , m_privateBrowsingEnabled(false)
     , m_threadTerminationRequested(false)
@@ -777,9 +766,7 @@ IconDatabase::IconDatabase()
     , m_imported(false)
     , m_isImportedSet(false)
 {
-#if PLATFORM(DARWIN)
-    ASSERT(pthread_main_np());
-#endif
+    ASSERT(isMainThread());
 }
 
 IconDatabase::~IconDatabase()
@@ -812,6 +799,12 @@ void IconDatabase::notifyPendingLoadDecisions()
 
 void IconDatabase::wakeSyncThread()
 {
+    // The following is balanced by the call to enableSuddenTermination in the
+    // syncThreadMainLoop function.
+    // FIXME: It would be better to only disable sudden termination if we have
+    // something to write, not just if we have something to read.
+    disableSuddenTermination();
+
     MutexLocker locker(m_syncLock);
     m_syncCondition.signal();
 }
@@ -819,16 +812,24 @@ void IconDatabase::wakeSyncThread()
 void IconDatabase::scheduleOrDeferSyncTimer()
 {
     ASSERT_NOT_SYNC_THREAD();
-    if (!m_syncTimer)
-        m_syncTimer.set(new Timer<IconDatabase>(this, &IconDatabase::syncTimerFired));
 
-    m_syncTimer->startOneShot(updateTimerDelay);
+    if (!m_syncTimer.isActive()) {
+        // The following is balanced by the call to enableSuddenTermination in the
+        // syncTimerFired function.
+        disableSuddenTermination();
+    }
+
+    m_syncTimer.startOneShot(updateTimerDelay);
 }
 
 void IconDatabase::syncTimerFired(Timer<IconDatabase>*)
 {
     ASSERT_NOT_SYNC_THREAD();
     wakeSyncThread();
+
+    // The following is balanced by the call to disableSuddenTermination in the
+    // scheduleOrDeferSyncTimer function.
+    enableSuddenTermination();
 }
 
 // ******************
@@ -1325,7 +1326,8 @@ void IconDatabase::performURLImport()
 void* IconDatabase::syncThreadMainLoop()
 {
     ASSERT_ICON_SYNC_THREAD();
-    static bool prunedUnretainedIcons = false;
+
+    bool shouldReenableSuddenTermination = false;
 
     m_syncLock.lock();
 
@@ -1364,6 +1366,7 @@ void* IconDatabase::syncThreadMainLoop()
             // or if private browsing is enabled
             // We also don't want to prune if the m_databaseCleanupCounter count is non-zero - that means someone
             // has asked to delay pruning
+            static bool prunedUnretainedIcons = false;
             if (didWrite && !m_privateBrowsingEnabled && !prunedUnretainedIcons && !databaseCleanupCounter) {
 #ifndef NDEBUG
                 double time = currentTime();
@@ -1396,13 +1399,32 @@ void* IconDatabase::syncThreadMainLoop()
         // We handle those at the top of this main loop so continue to jump back up there
         if (shouldStopThreadActivity())
             continue;
-            
-        m_syncCondition.wait(m_syncLock); 
+
+        if (shouldReenableSuddenTermination) {
+            // The following is balanced by the call to disableSuddenTermination in the
+            // wakeSyncThread function. Any time we wait on the condition, we also have
+            // to enableSuddenTermation, after doing the next batch of work.
+            enableSuddenTermination();
+        }
+
+        m_syncCondition.wait(m_syncLock);
+
+        shouldReenableSuddenTermination = true;
     }
+
     m_syncLock.unlock();
     
     // Thread is terminating at this point
-    return cleanupSyncThread();
+    cleanupSyncThread();
+
+    if (shouldReenableSuddenTermination) {
+        // The following is balanced by the call to disableSuddenTermination in the
+        // wakeSyncThread function. Any time we wait on the condition, we also have
+        // to enableSuddenTermation, after doing the next batch of work.
+        enableSuddenTermination();
+    }
+
+    return 0;
 }
 
 bool IconDatabase::readFromDatabase()
@@ -1689,23 +1711,23 @@ void IconDatabase::removeAllIconsOnThread()
 }
 
 void IconDatabase::deleteAllPreparedStatements()
-{        
+{
     ASSERT_ICON_SYNC_THREAD();
     
-    m_setIconIDForPageURLStatement.set(0);
-    m_removePageURLStatement.set(0);
-    m_getIconIDForIconURLStatement.set(0);
-    m_getImageDataForIconURLStatement.set(0);
-    m_addIconToIconInfoStatement.set(0);
-    m_addIconToIconDataStatement.set(0);
-    m_getImageDataStatement.set(0);
-    m_deletePageURLsForIconURLStatement.set(0);
-    m_deleteIconFromIconInfoStatement.set(0);
-    m_deleteIconFromIconDataStatement.set(0);
-    m_updateIconInfoStatement.set(0);
-    m_updateIconDataStatement.set(0);
-    m_setIconInfoStatement.set(0);
-    m_setIconDataStatement.set(0);
+    m_setIconIDForPageURLStatement.clear();
+    m_removePageURLStatement.clear();
+    m_getIconIDForIconURLStatement.clear();
+    m_getImageDataForIconURLStatement.clear();
+    m_addIconToIconInfoStatement.clear();
+    m_addIconToIconDataStatement.clear();
+    m_getImageDataStatement.clear();
+    m_deletePageURLsForIconURLStatement.clear();
+    m_deleteIconFromIconInfoStatement.clear();
+    m_deleteIconFromIconDataStatement.clear();
+    m_updateIconInfoStatement.clear();
+    m_updateIconDataStatement.clear();
+    m_setIconInfoStatement.clear();
+    m_setIconDataStatement.clear();
 }
 
 void* IconDatabase::cleanupSyncThread()
diff --git a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.h b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.h
index 4303ae1..40f641a 100644
--- a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.h
+++ b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabase.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Justin Haygood (jhaygood@reaktix.com)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -27,17 +27,15 @@
 #ifndef IconDatabase_h
 #define IconDatabase_h
 
-#if ENABLE(ICONDATABASE)
-#include "SQLiteDatabase.h"
-#endif
-
 #include "StringHash.h"
 #include "Timer.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
+
 #if ENABLE(ICONDATABASE)
+#include "SQLiteDatabase.h"
 #include <wtf/Threading.h>
 #endif
 
@@ -116,9 +114,9 @@ private:
 
     void wakeSyncThread();
     void scheduleOrDeferSyncTimer();
-    OwnPtr<Timer<IconDatabase> > m_syncTimer;
     void syncTimerFired(Timer<IconDatabase>*);
     
+    Timer<IconDatabase> m_syncTimer;
     ThreadIdentifier m_syncThread;
     bool m_syncThreadRunning;
     
diff --git a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabaseNone.cpp b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabaseNone.cpp
index c76a2c4..a7fb88d 100644
--- a/src/3rdparty/webkit/WebCore/loader/icon/IconDatabaseNone.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/icon/IconDatabaseNone.cpp
@@ -25,7 +25,10 @@
 
 #include "config.h"
 #include "IconDatabase.h"
+
+#include "PlatformString.h"
 #include "SharedBuffer.h"
+#include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
@@ -47,8 +50,8 @@ const int updateTimerDelay = 5;
 
 String IconDatabase::defaultDatabaseFilename()
 {
-    static String defaultDatabaseFilename = "Icons.db";
-    return defaultDatabaseFilename;
+    DEFINE_STATIC_LOCAL(String, defaultDatabaseFilename, ("Icons.db"));
+    return defaultDatabaseFilename.copy();
 }
 
 IconDatabase* iconDatabase()
@@ -62,7 +65,7 @@ IconDatabase::IconDatabase()
 {
 }
 
-bool IconDatabase::open(const String& databasePath)
+bool IconDatabase::open(const String& /*databasePath*/)
 {
     return false;
 }
@@ -85,7 +88,7 @@ void IconDatabase::removeAllIcons()
 {
 }
 
-void IconDatabase::setPrivateBrowsingEnabled(bool flag)
+void IconDatabase::setPrivateBrowsingEnabled(bool /*flag*/)
 {
 }
 
@@ -99,7 +102,7 @@ void IconDatabase::readIconForPageURLFromDisk(const String&)
 
 }
 
-Image* IconDatabase::iconForPageURL(const String& pageURL, const IntSize& size)
+Image* IconDatabase::iconForPageURL(const String& /*pageURL*/, const IntSize& size)
 {
     return defaultIcon(size);
 }
@@ -115,33 +118,33 @@ bool IconDatabase::iconDataKnownForIconURL(const String&)
     return false;
 }
 
-String IconDatabase::iconURLForPageURL(const String& pageURL)
+String IconDatabase::iconURLForPageURL(const String& /*pageURL*/)
 {
     return String();
 }
 
-Image* IconDatabase::defaultIcon(const IntSize& size)
+Image* IconDatabase::defaultIcon(const IntSize& /*size*/)
 {
     return 0;
 }
 
-void IconDatabase::retainIconForPageURL(const String& pageURL)
+void IconDatabase::retainIconForPageURL(const String& /*pageURL*/)
 {
 }
 
-void IconDatabase::releaseIconForPageURL(const String& pageURL)
+void IconDatabase::releaseIconForPageURL(const String& /*pageURL*/)
 {
 }
 
-void IconDatabase::setIconDataForIconURL(PassRefPtr<SharedBuffer> data, const String& iconURL)
+void IconDatabase::setIconDataForIconURL(PassRefPtr<SharedBuffer> /*data*/, const String& /*iconURL*/)
 {
 }
 
-void IconDatabase::setIconURLForPageURL(const String& iconURL, const String& pageURL)
+void IconDatabase::setIconURLForPageURL(const String& /*iconURL*/, const String& /*pageURL*/)
 {
 }
 
-void IconDatabase::setEnabled(bool enabled)
+void IconDatabase::setEnabled(bool /*enabled*/)
 {
 }
 
@@ -167,6 +170,26 @@ void IconDatabase::allowDatabaseCleanup()
 {
 }
 
+size_t IconDatabase::pageURLMappingCount()
+{
+    return 0;
+}
+
+size_t IconDatabase::retainedPageURLCount()
+{
+    return 0;
+}
+
+size_t IconDatabase::iconRecordCount()
+{
+    return 0;
+}
+
+size_t IconDatabase::iconRecordCountWithData()
+{
+    return 0;
+}
+
 void IconDatabase::setClient(IconDatabaseClient*)
 {
 }
diff --git a/src/3rdparty/webkit/WebCore/loader/icon/IconFetcher.cpp b/src/3rdparty/webkit/WebCore/loader/icon/IconFetcher.cpp
index efa7e14..d1aa2f3 100644
--- a/src/3rdparty/webkit/WebCore/loader/icon/IconFetcher.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/icon/IconFetcher.cpp
@@ -26,16 +26,12 @@
 #include "config.h"
 #include "IconFetcher.h"
 
-#include "Document.h"
 #include "Frame.h"
 #include "HTMLHeadElement.h"
 #include "HTMLLinkElement.h"
 #include "HTMLNames.h"
-#include "MIMETypeRegistry.h"
 #include "ResourceHandle.h"
 #include "ResourceRequest.h"
-#include "SharedBuffer.h"
-#include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
@@ -105,8 +101,6 @@ static void parseIconLink(HTMLLinkElement* link, Vector<IconLinkEntry>& entries)
 PassRefPtr<IconFetcher> IconFetcher::create(Frame* frame, IconFetcherClient* client)
 {
     Document* document = frame->document();
-    if (!document)
-        return 0;
     
     HTMLHeadElement* head = document->head();
     if (!head)
@@ -164,7 +158,7 @@ void IconFetcher::cancel()
     if (m_handle)
         m_handle->cancel();
 }
-    
+
 PassRefPtr<SharedBuffer> IconFetcher::createIcon()
 {
     ASSERT(!m_entries.isEmpty());
@@ -172,8 +166,7 @@ PassRefPtr<SharedBuffer> IconFetcher::createIcon()
     // For now, just return the data of the first entry.
     return m_entries.first().buffer();
 }
-    
-    
+
 void IconFetcher::loadEntry()
 {
     ASSERT(m_currentEntry < m_entries.size());
@@ -191,7 +184,7 @@ void IconFetcher::loadFailed()
     
 void IconFetcher::didReceiveResponse(ResourceHandle* handle, const ResourceResponse& response)
 {
-    ASSERT(m_handle == handle);
+    ASSERT_UNUSED(handle, m_handle == handle);
     
     int statusCode = response.httpStatusCode() / 100;
     if (statusCode == 4 || statusCode == 5) {
@@ -200,16 +193,16 @@ void IconFetcher::didReceiveResponse(ResourceHandle* handle, const ResourceRespo
     }    
 }
     
-void IconFetcher::didReceiveData(ResourceHandle* handle, const char* data, int length, int lengthReceived)
+void IconFetcher::didReceiveData(ResourceHandle* handle, const char* data, int length, int)
 {
-    ASSERT(m_handle == handle);
+    ASSERT_UNUSED(handle, m_handle == handle);
     
     m_entries[m_currentEntry].buffer()->append(data, length);
 }
 
 void IconFetcher::didFinishLoading(ResourceHandle* handle)
 {
-    ASSERT(m_handle == handle);
+    ASSERT_UNUSED(handle, m_handle == handle);
     
     if (m_currentEntry == m_entries.size() - 1) {
         // We finished loading, create the icon
@@ -227,10 +220,9 @@ void IconFetcher::didFinishLoading(ResourceHandle* handle)
     
 void IconFetcher::didFail(ResourceHandle* handle, const ResourceError&)
 {
-    ASSERT(m_handle == handle);
+    ASSERT_UNUSED(handle, m_handle == handle);
     
     loadFailed();
 }
 
-    
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/loader/icon/IconLoader.cpp b/src/3rdparty/webkit/WebCore/loader/icon/IconLoader.cpp
index 933a6ab..5dd000e 100644
--- a/src/3rdparty/webkit/WebCore/loader/icon/IconLoader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/icon/IconLoader.cpp
@@ -35,7 +35,9 @@
 #include "ResourceHandle.h"
 #include "ResourceResponse.h"
 #include "ResourceRequest.h"
+#include "SharedBuffer.h"
 #include "SubresourceLoader.h"
+#include <wtf/UnusedParam.h>
 
 using namespace std;
 
@@ -61,14 +63,6 @@ void IconLoader::startLoading()
     if (m_resourceLoader)
         return;
 
-    // FIXME: http://bugs.webkit.org/show_bug.cgi?id=10902
-    // Once ResourceHandle will load without a DocLoader, we can remove this check.
-    // A frame may be documentless - one example is a frame containing only a PDF.
-    if (!m_frame->document()) {
-        LOG(IconDatabase, "Documentless-frame - icon won't be loaded");
-        return;
-    }
-
     // Set flag so we can detect the case where the load completes before
     // SubresourceLoader::create returns.
     m_loadIsInProgress = true;
@@ -101,9 +95,13 @@ void IconLoader::didReceiveResponse(SubresourceLoader* resourceLoader, const Res
     }
 }
 
-void IconLoader::didReceiveData(SubresourceLoader* loader, const char*, int size)
+void IconLoader::didReceiveData(SubresourceLoader* unusedLoader, const char*, int unusedSize)
 {
-    LOG(IconDatabase, "IconLoader::didReceiveData() - Loader %p, number of bytes %i", loader, size);
+#if LOG_DISABLED
+    UNUSED_PARAM(unusedLoader);
+    UNUSED_PARAM(unusedSize);
+#endif
+    LOG(IconDatabase, "IconLoader::didReceiveData() - Loader %p, number of bytes %i", unusedLoader, unusedSize);
 }
 
 void IconLoader::didFail(SubresourceLoader* resourceLoader, const ResourceError&)
@@ -153,9 +151,12 @@ void IconLoader::finishLoading(const KURL& iconURL, PassRefPtr<SharedBuffer> dat
     // <rdar://problem/5463392> tracks that enhancement
     
     if (!iconURL.isEmpty() && m_loadIsInProgress) {
-        iconDatabase()->setIconDataForIconURL(data, iconURL.string());
         LOG(IconDatabase, "IconLoader::finishLoading() - Committing iconURL %s to database", iconURL.string().ascii().data());
         m_frame->loader()->commitIconURLToIconDatabase(iconURL);
+        // Setting the icon data only after committing to the database ensures that the data is
+        // kept in memory (so it does not have to be read from the database asynchronously), since
+        // there is a page URL referencing it.
+        iconDatabase()->setIconDataForIconURL(data, iconURL.string());
         m_frame->loader()->client()->dispatchDidReceiveIcon();
     }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/icon/IconRecord.cpp b/src/3rdparty/webkit/WebCore/loader/icon/IconRecord.cpp
index 599aad3..ffea318 100644
--- a/src/3rdparty/webkit/WebCore/loader/icon/IconRecord.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/icon/IconRecord.cpp
@@ -34,7 +34,6 @@
 #include "Logging.h"
 #include "SQLiteStatement.h"
 #include "SQLiteTransaction.h"
-#include "SystemTime.h"
 
 #include <limits.h>
 
diff --git a/src/3rdparty/webkit/WebCore/loader/loader.cpp b/src/3rdparty/webkit/WebCore/loader/loader.cpp
index 26b8ad1..d10877f 100644
--- a/src/3rdparty/webkit/WebCore/loader/loader.cpp
+++ b/src/3rdparty/webkit/WebCore/loader/loader.cpp
@@ -48,20 +48,20 @@ namespace WebCore {
 
 #if REQUEST_MANAGEMENT_ENABLED
 // Match the parallel connection count used by the networking layer
-// FIXME should not hardcode something like this
-static const unsigned maxRequestsInFlightPerHost = 4;
+static unsigned maxRequestsInFlightPerHost;
 // Having a limit might still help getting more important resources first
 static const unsigned maxRequestsInFlightForNonHTTPProtocols = 20;
 #else
 static const unsigned maxRequestsInFlightPerHost = 10000;
 static const unsigned maxRequestsInFlightForNonHTTPProtocols = 10000;
 #endif
-    
-    
+
 Loader::Loader()
-    : m_nonHTTPProtocolHost(AtomicString(), maxRequestsInFlightForNonHTTPProtocols)
-    , m_requestTimer(this, &Loader::requestTimerFired)
+    : m_requestTimer(this, &Loader::requestTimerFired)
+    , m_isSuspendingPendingRequests(false)
 {
+    m_nonHTTPProtocolHost = Host::create(AtomicString(), maxRequestsInFlightForNonHTTPProtocols);
+    maxRequestsInFlightPerHost = initializeMaximumHTTPConnectionCountPerHost();
 }
 
 Loader::~Loader()
@@ -99,25 +99,24 @@ void Loader::load(DocLoader* docLoader, CachedResource* resource, bool increment
     ASSERT(docLoader);
     Request* request = new Request(docLoader, resource, incremental, skipCanLoadCheck, sendResourceLoadCallbacks);
 
-    Host* host;
+    RefPtr<Host> host;
     KURL url(resource->url());
-    bool isHTTP = url.protocolIs("http") || url.protocolIs("https");
-    if (isHTTP) {
+    if (url.protocolInHTTPFamily()) {
         AtomicString hostName = url.host();
         host = m_hosts.get(hostName.impl());
         if (!host) {
-            host = new Host(hostName, maxRequestsInFlightPerHost);
+            host = Host::create(hostName, maxRequestsInFlightPerHost);
             m_hosts.add(hostName.impl(), host);
         }
     } else 
-        host = &m_nonHTTPProtocolHost;
+        host = m_nonHTTPProtocolHost;
     
     bool hadRequests = host->hasRequests();
     Priority priority = determinePriority(resource);
     host->addRequest(request, priority);
     docLoader->incrementRequestCount();
 
-    if (priority > Low || !isHTTP || !hadRequests) {
+    if (priority > Low || !url.protocolInHTTPFamily() || !hadRequests) {
         // Try to request important resources immediately
         host->servePendingRequests(priority);
     } else {
@@ -139,31 +138,57 @@ void Loader::requestTimerFired(Timer<Loader>*)
 
 void Loader::servePendingRequests(Priority minimumPriority)
 {
+    if (m_isSuspendingPendingRequests)
+        return;
+
     m_requestTimer.stop();
     
-    m_nonHTTPProtocolHost.servePendingRequests(minimumPriority);
+    m_nonHTTPProtocolHost->servePendingRequests(minimumPriority);
 
     Vector<Host*> hostsToServe;
-    copyValuesToVector(m_hosts, hostsToServe);
+    HostMap::iterator i = m_hosts.begin();
+    HostMap::iterator end = m_hosts.end();
+    for (;i != end; ++i)
+        hostsToServe.append(i->second.get());
+        
     for (unsigned n = 0; n < hostsToServe.size(); ++n) {
         Host* host = hostsToServe[n];
         if (host->hasRequests())
             host->servePendingRequests(minimumPriority);
         else if (!host->processingResource()){
             AtomicString name = host->name();
-            delete host;
             m_hosts.remove(name.impl());
         }
     }
 }
-    
+
+void Loader::suspendPendingRequests()
+{
+    ASSERT(!m_isSuspendingPendingRequests);
+    m_isSuspendingPendingRequests = true;
+}
+
+void Loader::resumePendingRequests()
+{
+    ASSERT(m_isSuspendingPendingRequests);
+    m_isSuspendingPendingRequests = false;
+    if (!m_hosts.isEmpty() || m_nonHTTPProtocolHost->hasRequests())
+        scheduleServePendingRequests();
+}
+
 void Loader::cancelRequests(DocLoader* docLoader)
 {
-    if (m_nonHTTPProtocolHost.hasRequests())
-        m_nonHTTPProtocolHost.cancelRequests(docLoader);
+    docLoader->clearPendingPreloads();
+
+    if (m_nonHTTPProtocolHost->hasRequests())
+        m_nonHTTPProtocolHost->cancelRequests(docLoader);
     
     Vector<Host*> hostsToCancel;
-    copyValuesToVector(m_hosts, hostsToCancel);
+    HostMap::iterator i = m_hosts.begin();
+    HostMap::iterator end = m_hosts.end();
+    for (;i != end; ++i)
+        hostsToCancel.append(i->second.get());
+
     for (unsigned n = 0; n < hostsToCancel.size(); ++n) {
         Host* host = hostsToCancel[n];
         if (host->hasRequests())
@@ -172,12 +197,9 @@ void Loader::cancelRequests(DocLoader* docLoader)
 
     scheduleServePendingRequests();
     
-    if (docLoader->loadInProgress())
-        ASSERT(docLoader->requestCount() == 1);
-    else
-        ASSERT(docLoader->requestCount() == 0);
+    ASSERT(docLoader->requestCount() == (docLoader->loadInProgress() ? 1 : 0));
 }
-    
+
 Loader::Host::Host(const AtomicString& name, unsigned maxRequestsInFlight)
     : m_name(name)
     , m_maxRequestsInFlight(maxRequestsInFlight)
@@ -210,6 +232,9 @@ bool Loader::Host::hasRequests() const
 
 void Loader::Host::servePendingRequests(Loader::Priority minimumPriority)
 {
+    if (cache()->loader()->isSuspendingPendingRequests())
+        return;
+
     bool serveMore = true;
     for (int priority = High; priority >= minimumPriority && serveMore; --priority)
         servePendingRequests(m_requestsPending[priority], serveMore);
@@ -236,11 +261,7 @@ void Loader::Host::servePendingRequests(RequestQueue& requestsPending, bool& ser
         if (!request->cachedResource()->accept().isEmpty())
             resourceRequest.setHTTPAccept(request->cachedResource()->accept());
         
-        KURL referrer = docLoader->doc()->url();
-        if ((referrer.protocolIs("http") || referrer.protocolIs("https")) && referrer.path().isEmpty())
-            referrer.setPath("/");
-        resourceRequest.setHTTPReferrer(referrer.string());
-        FrameLoader::addHTTPOriginIfNeeded(resourceRequest, docLoader->doc()->securityOrigin()->toString());
+         // Do not set the referrer or HTTP origin here. That's handled by SubresourceLoader::create.
         
         if (resourceIsCacheValidator) {
             CachedResource* resourceToRevalidate = request->cachedResource()->resourceToRevalidate();
@@ -260,7 +281,7 @@ void Loader::Host::servePendingRequests(RequestQueue& requestsPending, bool& ser
         }
 
         RefPtr<SubresourceLoader> loader = SubresourceLoader::create(docLoader->doc()->frame(),
-                                                                     this, resourceRequest, request->shouldSkipCanLoadCheck(), request->sendResourceLoadCallbacks());
+            this, resourceRequest, request->shouldSkipCanLoadCheck(), request->sendResourceLoadCallbacks());
         if (loader) {
             m_requestsLoading.add(loader.release(), request);
             request->cachedResource()->setRequestedFromNetworkingLayer();
@@ -279,15 +300,18 @@ void Loader::Host::servePendingRequests(RequestQueue& requestsPending, bool& ser
 
 void Loader::Host::didFinishLoading(SubresourceLoader* loader)
 {
+    RefPtr<Host> myProtector(this);
+
     RequestMap::iterator i = m_requestsLoading.find(loader);
     if (i == m_requestsLoading.end())
         return;
     
-    ProcessingResource processingResource(this);
-
     Request* request = i->second;
     m_requestsLoading.remove(i);
     DocLoader* docLoader = request->docLoader();
+    // Prevent the document from being destroyed before we are done with
+    // the docLoader that it will delete when the document gets deleted.
+    DocPtr<Document> protector(docLoader->doc());
     if (!request->isMultipart())
         docLoader->decrementRequestCount();
 
@@ -322,17 +346,20 @@ void Loader::Host::didFail(SubresourceLoader* loader, const ResourceError&)
 
 void Loader::Host::didFail(SubresourceLoader* loader, bool cancelled)
 {
+    RefPtr<Host> myProtector(this);
+
     loader->clearClient();
 
     RequestMap::iterator i = m_requestsLoading.find(loader);
     if (i == m_requestsLoading.end())
         return;
-
-    ProcessingResource processingResource(this);
     
     Request* request = i->second;
     m_requestsLoading.remove(i);
     DocLoader* docLoader = request->docLoader();
+    // Prevent the document from being destroyed before we are done with
+    // the docLoader that it will delete when the document gets deleted.
+    DocPtr<Document> protector(docLoader->doc());
     if (!request->isMultipart())
         docLoader->decrementRequestCount();
 
@@ -359,6 +386,8 @@ void Loader::Host::didFail(SubresourceLoader* loader, bool cancelled)
 
 void Loader::Host::didReceiveResponse(SubresourceLoader* loader, const ResourceResponse& response)
 {
+    RefPtr<Host> protector(this);
+
     Request* request = m_requestsLoading.get(loader);
     
     // FIXME: This is a workaround for <rdar://problem/5236843>
@@ -420,6 +449,8 @@ void Loader::Host::didReceiveResponse(SubresourceLoader* loader, const ResourceR
 
 void Loader::Host::didReceiveData(SubresourceLoader* loader, const char* data, int size)
 {
+    RefPtr<Host> protector(this);
+
     Request* request = m_requestsLoading.get(loader);
     if (!request)
         return;
@@ -429,12 +460,11 @@ void Loader::Host::didReceiveData(SubresourceLoader* loader, const char* data, i
     
     if (resource->errorOccurred())
         return;
-    
-    ProcessingResource processingResource(this);
-    
+        
     if (resource->response().httpStatusCode() / 100 == 4) {
-        // Treat a 4xx response like a network error.
-        resource->error();
+        // Treat a 4xx response like a network error for all resources but images (which will ignore the error and continue to load for 
+        // legacy compatibility).
+        resource->httpStatusCodeError();
         return;
     }
 
diff --git a/src/3rdparty/webkit/WebCore/loader/loader.h b/src/3rdparty/webkit/WebCore/loader/loader.h
index 19c3fda..c5b9416 100644
--- a/src/3rdparty/webkit/WebCore/loader/loader.h
+++ b/src/3rdparty/webkit/WebCore/loader/loader.h
@@ -49,15 +49,22 @@ namespace WebCore {
         enum Priority { Low, Medium, High };
         void servePendingRequests(Priority minimumPriority = Low);
 
+        bool isSuspendingPendingRequests() { return m_isSuspendingPendingRequests; }
+        void suspendPendingRequests();
+        void resumePendingRequests();
+
     private:
         Priority determinePriority(const CachedResource*) const;
         void scheduleServePendingRequests();
         
         void requestTimerFired(Timer<Loader>*);
 
-        class Host : private SubresourceLoaderClient {
+        class Host : public RefCounted<Host>, private SubresourceLoaderClient {
         public:
-            Host(const AtomicString& name, unsigned maxRequestsInFlight);
+            static PassRefPtr<Host> create(const AtomicString& name, unsigned maxRequestsInFlight) 
+            {
+                return adoptRef(new Host(name, maxRequestsInFlight));
+            }
             ~Host();
             
             const AtomicString& name() const { return m_name; }
@@ -69,22 +76,7 @@ namespace WebCore {
             bool processingResource() const { return m_numResourcesProcessing != 0; }
 
         private:
-            class ProcessingResource {
-            public:
-                ProcessingResource(Host* host)
-                    : m_host(host)
-                {
-                    m_host->m_numResourcesProcessing++;
-                }
-
-                ~ProcessingResource()
-                {
-                    m_host->m_numResourcesProcessing--;
-                }
-
-            private:
-                Host* m_host;
-            };
+            Host(const AtomicString&, unsigned);
 
             virtual void didReceiveResponse(SubresourceLoader*, const ResourceResponse&);
             virtual void didReceiveData(SubresourceLoader*, const char*, int);
@@ -103,11 +95,13 @@ namespace WebCore {
             const int m_maxRequestsInFlight;
             int m_numResourcesProcessing;
         };
-        typedef HashMap<AtomicStringImpl*, Host*> HostMap;
+        typedef HashMap<AtomicStringImpl*, RefPtr<Host> > HostMap;
         HostMap m_hosts;
-        Host m_nonHTTPProtocolHost;
+        RefPtr<Host> m_nonHTTPProtocolHost;
         
         Timer<Loader> m_requestTimer;
+
+        bool m_isSuspendingPendingRequests;
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/make-generated-sources.sh b/src/3rdparty/webkit/WebCore/make-generated-sources.sh
index 9ccfff1..88173d5 100755
--- a/src/3rdparty/webkit/WebCore/make-generated-sources.sh
+++ b/src/3rdparty/webkit/WebCore/make-generated-sources.sh
@@ -5,4 +5,4 @@ export WebCore=$PWD
 export CREATE_HASH_TABLE="$SRCROOT/../JavaScriptCore/create_hash_table"
 
 mkdir -p DerivedSources/WebCore &&
-make -C DerivedSources/WebCore -f ../../DerivedSources.make
+make -C DerivedSources/WebCore -f ../../DerivedSources.make $@
diff --git a/src/3rdparty/webkit/WebCore/page/BarInfo.cpp b/src/3rdparty/webkit/WebCore/page/BarInfo.cpp
index 153aee0..f6a1210 100644
--- a/src/3rdparty/webkit/WebCore/page/BarInfo.cpp
+++ b/src/3rdparty/webkit/WebCore/page/BarInfo.cpp
@@ -41,11 +41,21 @@ BarInfo::BarInfo(Frame* frame, Type type)
 {
 }
 
+Frame* BarInfo::frame() const
+{
+    return m_frame;
+}
+
 void BarInfo::disconnectFrame()
 {
     m_frame = 0;
 }
 
+BarInfo::Type BarInfo::type() const
+{
+    return m_type;
+}
+
 bool BarInfo::visible() const
 {
     if (!m_frame)
diff --git a/src/3rdparty/webkit/WebCore/page/BarInfo.h b/src/3rdparty/webkit/WebCore/page/BarInfo.h
index 4cbbcfc..376b8fc 100644
--- a/src/3rdparty/webkit/WebCore/page/BarInfo.h
+++ b/src/3rdparty/webkit/WebCore/page/BarInfo.h
@@ -42,8 +42,11 @@ namespace WebCore {
 
         static PassRefPtr<BarInfo> create(Frame* frame, Type type) { return adoptRef(new BarInfo(frame, type)); }
 
+        Frame* frame() const;
         void disconnectFrame();
 
+        Type type() const;
+
         bool visible() const;
 
     private:
diff --git a/src/3rdparty/webkit/WebCore/page/Chrome.cpp b/src/3rdparty/webkit/WebCore/page/Chrome.cpp
index 1f6e198..2170723 100644
--- a/src/3rdparty/webkit/WebCore/page/Chrome.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Chrome.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  *
  * This library is free software; you can redistribute it and/or
@@ -28,13 +28,14 @@
 #include "FloatRect.h"
 #include "Frame.h"
 #include "FrameTree.h"
+#include "Geolocation.h"
 #include "HTMLFormElement.h"
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
 #include "HitTestResult.h"
 #include "InspectorController.h"
 #include "Page.h"
-#include "PageGroup.h"
+#include "PageGroupLoadDeferrer.h"
 #include "ResourceHandle.h"
 #include "ScriptController.h"
 #include "SecurityOrigin.h"
@@ -45,7 +46,7 @@
 #include <wtf/Vector.h>
 
 #if ENABLE(DOM_STORAGE)
-#include "SessionStorage.h"
+#include "StorageNamespace.h"
 #endif
 
 namespace WebCore {
@@ -53,14 +54,6 @@ namespace WebCore {
 using namespace HTMLNames;
 using namespace std;
 
-class PageGroupLoadDeferrer : Noncopyable {
-public:
-    PageGroupLoadDeferrer(Page*, bool deferSelf);
-    ~PageGroupLoadDeferrer();
-private:
-    Vector<RefPtr<Frame>, 16> m_deferredFrames;
-};
-
 Chrome::Chrome(Page* page, ChromeClient* client)
     : m_page(page)
     , m_client(client)
@@ -151,13 +144,14 @@ void Chrome::takeFocus(FocusDirection direction) const
 Page* Chrome::createWindow(Frame* frame, const FrameLoadRequest& request, const WindowFeatures& features) const
 {
     Page* newPage = m_client->createWindow(frame, request, features);
+
 #if ENABLE(DOM_STORAGE)
-    
     if (newPage) {
-        if (SessionStorage* oldSessionStorage = m_page->sessionStorage(false))
-                newPage->setSessionStorage(oldSessionStorage->copy(newPage));
+        if (StorageNamespace* oldSessionStorage = m_page->sessionStorage(false))
+            newPage->setSessionStorage(oldSessionStorage->copy());
     }
 #endif
+
     return newPage;
 }
 
@@ -259,10 +253,7 @@ void Chrome::runJavaScriptAlert(Frame* frame, const String& message)
     PageGroupLoadDeferrer deferrer(m_page, true);
 
     ASSERT(frame);
-    String text = message;
-    text.replace('\\', frame->backslashAsCurrencySymbol());
-
-    m_client->runJavaScriptAlert(frame, text);
+    m_client->runJavaScriptAlert(frame, frame->displayStringModifiedByEncoding(message));
 }
 
 bool Chrome::runJavaScriptConfirm(Frame* frame, const String& message)
@@ -272,10 +263,7 @@ bool Chrome::runJavaScriptConfirm(Frame* frame, const String& message)
     PageGroupLoadDeferrer deferrer(m_page, true);
 
     ASSERT(frame);
-    String text = message;
-    text.replace('\\', frame->backslashAsCurrencySymbol());
-    
-    return m_client->runJavaScriptConfirm(frame, text);
+    return m_client->runJavaScriptConfirm(frame, frame->displayStringModifiedByEncoding(message));
 }
 
 bool Chrome::runJavaScriptPrompt(Frame* frame, const String& prompt, const String& defaultValue, String& result)
@@ -285,15 +273,10 @@ bool Chrome::runJavaScriptPrompt(Frame* frame, const String& prompt, const Strin
     PageGroupLoadDeferrer deferrer(m_page, true);
 
     ASSERT(frame);
-    String promptText = prompt;
-    promptText.replace('\\', frame->backslashAsCurrencySymbol());
-    String defaultValueText = defaultValue;
-    defaultValueText.replace('\\', frame->backslashAsCurrencySymbol());
-    
-    bool ok = m_client->runJavaScriptPrompt(frame, promptText, defaultValueText, result);
+    bool ok = m_client->runJavaScriptPrompt(frame, frame->displayStringModifiedByEncoding(prompt), frame->displayStringModifiedByEncoding(defaultValue), result);
     
     if (ok)
-        result.replace(frame->backslashAsCurrencySymbol(), '\\');
+        result = frame->displayStringModifiedByEncoding(result);
     
     return ok;
 }
@@ -301,10 +284,7 @@ bool Chrome::runJavaScriptPrompt(Frame* frame, const String& prompt, const Strin
 void Chrome::setStatusbarText(Frame* frame, const String& status)
 {
     ASSERT(frame);
-    String text = status;
-    text.replace('\\', frame->backslashAsCurrencySymbol());
-    
-    m_client->setStatusbarText(text);
+    m_client->setStatusbarText(frame->displayStringModifiedByEncoding(status));
 }
 
 bool Chrome::shouldInterruptJavaScript()
@@ -391,20 +371,26 @@ void Chrome::print(Frame* frame)
     m_client->print(frame);
 }
 
-void Chrome::disableSuddenTermination()
+void Chrome::requestGeolocationPermissionForFrame(Frame* frame, Geolocation* geolocation)
 {
-    m_client->disableSuddenTermination();
-}
+    // Defer loads in case the client method runs a new event loop that would 
+    // otherwise cause the load to continue while we're in the middle of executing JavaScript.
+    PageGroupLoadDeferrer deferrer(m_page, true);
 
-void Chrome::enableSuddenTermination()
-{
-    m_client->enableSuddenTermination();
+    ASSERT(frame);
+    m_client->requestGeolocationPermissionForFrame(frame, geolocation);
 }
 
 void Chrome::runOpenPanel(Frame* frame, PassRefPtr<FileChooser> fileChooser)
 {
     m_client->runOpenPanel(frame, fileChooser);
 }
+
+bool Chrome::setCursor(PlatformCursorHandle cursor)
+{
+    return m_client->setCursor(cursor);
+}
+
 // --------
 
 #if ENABLE(DASHBOARD_SUPPORT)
@@ -437,14 +423,6 @@ String ChromeClient::generateReplacementFile(const String&)
     return String(); 
 }
 
-void ChromeClient::disableSuddenTermination()
-{
-}
-
-void ChromeClient::enableSuddenTermination()
-{
-}
-
 bool ChromeClient::paintCustomScrollbar(GraphicsContext*, const FloatRect&, ScrollbarControlSize, 
                                         ScrollbarControlState, ScrollbarPart, bool,
                                         float, float, ScrollbarControlPartMask)
@@ -457,49 +435,5 @@ bool ChromeClient::paintCustomScrollCorner(GraphicsContext*, const FloatRect&)
     return false;
 }
 
-// --------
-
-PageGroupLoadDeferrer::PageGroupLoadDeferrer(Page* page, bool deferSelf)
-{
-    const HashSet<Page*>& pages = page->group().pages();
-
-    HashSet<Page*>::const_iterator end = pages.end();
-    for (HashSet<Page*>::const_iterator it = pages.begin(); it != end; ++it) {
-        Page* otherPage = *it;
-        if ((deferSelf || otherPage != page)) {
-            if (!otherPage->defersLoading())
-                m_deferredFrames.append(otherPage->mainFrame());
-
-#if !PLATFORM(MAC)
-            for (Frame* frame = otherPage->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-                if (Document* document = frame->document())
-                    document->suspendActiveDOMObjects();
-            }
-#endif
-        }
-    }
-
-    size_t count = m_deferredFrames.size();
-    for (size_t i = 0; i < count; ++i)
-        if (Page* page = m_deferredFrames[i]->page())
-            page->setDefersLoading(true);
-}
-
-PageGroupLoadDeferrer::~PageGroupLoadDeferrer()
-{
-    for (size_t i = 0; i < m_deferredFrames.size(); ++i) {
-        if (Page* page = m_deferredFrames[i]->page()) {
-            page->setDefersLoading(false);
-
-#if !PLATFORM(MAC)
-            for (Frame* frame = page->mainFrame(); frame; frame = frame->tree()->traverseNext()) {
-                if (Document* document = frame->document())
-                    document->resumeActiveDOMObjects();
-            }
-#endif
-        }
-    }
-}
-
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Chrome.h b/src/3rdparty/webkit/WebCore/page/Chrome.h
index 47b912d..c26e450 100644
--- a/src/3rdparty/webkit/WebCore/page/Chrome.h
+++ b/src/3rdparty/webkit/WebCore/page/Chrome.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -20,6 +20,7 @@
 #ifndef Chrome_h
 #define Chrome_h
 
+#include "Cursor.h"
 #include "FileChooser.h"
 #include "FocusDirection.h"
 #include "HostWindow.h"
@@ -38,6 +39,7 @@ namespace WebCore {
     class ContextMenu;
     class FloatRect;
     class Frame;
+    class Geolocation;
     class HitTestResult;
     class IntRect;
     class Page;
@@ -116,11 +118,12 @@ namespace WebCore {
 
         void print(Frame*);
 
-        void enableSuddenTermination();
-        void disableSuddenTermination();
+        void requestGeolocationPermissionForFrame(Frame*, Geolocation*);
 
         void runOpenPanel(Frame*, PassRefPtr<FileChooser>);
 
+        bool setCursor(PlatformCursorHandle);
+
 #if PLATFORM(MAC)
         void focusNSView(NSView*);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/page/ChromeClient.h b/src/3rdparty/webkit/WebCore/page/ChromeClient.h
index 5d90b2f..e155754 100644
--- a/src/3rdparty/webkit/WebCore/page/ChromeClient.h
+++ b/src/3rdparty/webkit/WebCore/page/ChromeClient.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple, Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple, Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -20,11 +20,15 @@
 #ifndef ChromeClient_h
 #define ChromeClient_h
 
-#include "GraphicsContext.h"
+#include "Console.h"
+#include "Cursor.h"
 #include "FocusDirection.h"
-#include "ScrollTypes.h"
+#include "GraphicsContext.h"
+#include "HTMLParserQuirks.h"
 #include "HostWindow.h"
+#include "ScrollTypes.h"
 #include <wtf/Forward.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 
 #if PLATFORM(MAC)
@@ -42,16 +46,22 @@ namespace WebCore {
     class FileChooser;
     class FloatRect;
     class Frame;
+    class Geolocation;
+    class HTMLParserQuirks;
     class HitTestResult;
     class IntRect;
     class Node;
     class Page;
     class String;
     class Widget;
-    
+
     struct FrameLoadRequest;
     struct WindowFeatures;
 
+#if USE(ACCELERATED_COMPOSITING)
+    class GraphicsLayer;
+#endif
+
     class ChromeClient {
     public:
         virtual void chromeDestroyed() = 0;
@@ -93,7 +103,7 @@ namespace WebCore {
 
         virtual void setResizable(bool) = 0;
         
-        virtual void addMessageToConsole(const String& message, unsigned int lineNumber, const String& sourceID) = 0;
+        virtual void addMessageToConsole(MessageSource, MessageLevel, const String& message, unsigned int lineNumber, const String& sourceID) = 0;
 
         virtual bool canRunBeforeUnloadConfirmPanel() = 0;
         virtual bool runBeforeUnloadConfirmPanel(const String& message, Frame* frame) = 0;
@@ -116,7 +126,7 @@ namespace WebCore {
         virtual IntRect windowToScreen(const IntRect&) const = 0;
         virtual PlatformWidget platformWindow() const = 0;
         virtual void contentsSizeChanged(Frame*, const IntSize&) const = 0;
-        virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const {} // Platforms other than Mac can implement this if it ever becomes necessary for them to do so.
+        virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const = 0; // Currently only Mac has a non empty implementation.
         // End methods used by HostWindow.
 
         virtual void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags) = 0;
@@ -125,7 +135,9 @@ namespace WebCore {
 
         virtual void print(Frame*) = 0;
 
+#if ENABLE(DATABASE)
         virtual void exceededDatabaseQuota(Frame*, const String& databaseName) = 0;
+#endif
 
 #if ENABLE(DASHBOARD_SUPPORT)
         virtual void dashboardRegionsChanged();
@@ -139,21 +151,37 @@ namespace WebCore {
             
         virtual bool shouldReplaceWithGeneratedFileForUpload(const String& path, String& generatedFilename);
         virtual String generateReplacementFile(const String& path);
-        
-        virtual void enableSuddenTermination();
-        virtual void disableSuddenTermination();
 
         virtual bool paintCustomScrollbar(GraphicsContext*, const FloatRect&, ScrollbarControlSize, 
                                           ScrollbarControlState, ScrollbarPart pressedPart, bool vertical,
                                           float value, float proportion, ScrollbarControlPartMask);
         virtual bool paintCustomScrollCorner(GraphicsContext*, const FloatRect&);
 
+        // This is an asynchronous call. The ChromeClient can display UI asking the user for permission
+        // to use Geolococation. The ChromeClient must call Geolocation::setShouldClearCache() appropriately.
+        virtual void requestGeolocationPermissionForFrame(Frame*, Geolocation*) = 0;
+            
         virtual void runOpenPanel(Frame*, PassRefPtr<FileChooser>) = 0;
 
+        virtual bool setCursor(PlatformCursorHandle) = 0;
+
         // Notification that the given form element has changed. This function
         // will be called frequently, so handling should be very fast.
         virtual void formStateDidChange(const Node*) = 0;
 
+        virtual PassOwnPtr<HTMLParserQuirks> createHTMLParserQuirks() = 0;
+
+#if USE(ACCELERATED_COMPOSITING)
+        // Pass 0 as the GraphicsLayer to detatch the root layer.
+        virtual void attachRootGraphicsLayer(Frame*, GraphicsLayer*) = 0;
+        // Sets a flag to specify that the next time content is drawn to the window,
+        // the changes appear on the screen in synchrony with updates to GraphicsLayers.
+        virtual void setNeedsOneShotDrawingSynchronization() = 0;
+        // Sets a flag to specify that the view needs to be updated, so we need
+        // to do an eager layout before the drawing.
+        virtual void scheduleViewUpdate() = 0;
+#endif
+
 #if PLATFORM(MAC)
         virtual KeyboardUIMode keyboardUIMode() { return KeyboardAccessDefault; }
 
diff --git a/src/3rdparty/webkit/WebCore/page/Console.cpp b/src/3rdparty/webkit/WebCore/page/Console.cpp
index 8755f0e..1a654ab 100644
--- a/src/3rdparty/webkit/WebCore/page/Console.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Console.cpp
@@ -39,7 +39,7 @@
 #include "PageGroup.h"
 #include "PlatformString.h"
 
-#if USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
 #include <profiler/Profiler.h>
 #endif
 
@@ -53,6 +53,11 @@ Console::Console(Frame* frame)
 {
 }
 
+Frame* Console::frame() const
+{
+    return m_frame;
+}
+
 void Console::disconnectFrame()
 {
     m_frame = 0;
@@ -68,7 +73,7 @@ static void printSourceURLAndLine(const String& sourceURL, unsigned lineNumber)
     }
 }
 
-static bool getFirstArgumentAsString(const ScriptCallFrame& callFrame, String& result, bool checkForNullOrUndefined = false)
+static bool getFirstArgumentAsString(ScriptState* scriptState, const ScriptCallFrame& callFrame, String& result, bool checkForNullOrUndefined = false)
 {
     if (!callFrame.argumentCount())
         return false;
@@ -77,7 +82,8 @@ static bool getFirstArgumentAsString(const ScriptCallFrame& callFrame, String& r
     if (checkForNullOrUndefined && (value.isNull() || value.isUndefined()))
         return false;
 
-    return value.getString(result);
+    result = value.toString(scriptState);
+    return true;
 }
 
 static void printMessageSourceAndLevelPrefix(MessageSource source, MessageLevel level)
@@ -99,12 +105,13 @@ static void printMessageSourceAndLevelPrefix(MessageSource source, MessageLevel
         case CSSMessageSource:
             sourceString = "CSS";
             break;
-        default:
-            ASSERT_NOT_REACHED();
-            // Fall thru.
         case OtherMessageSource:
             sourceString = "OTHER";
             break;
+        default:
+            ASSERT_NOT_REACHED();
+            sourceString = "UNKNOWN";
+            break;
     }
 
     const char* levelString;
@@ -112,9 +119,6 @@ static void printMessageSourceAndLevelPrefix(MessageSource source, MessageLevel
         case TipMessageLevel:
             levelString = "TIP";
             break;
-        default:
-            ASSERT_NOT_REACHED();
-            // Fall thru.
         case LogMessageLevel:
             levelString = "LOG";
             break;
@@ -124,6 +128,22 @@ static void printMessageSourceAndLevelPrefix(MessageSource source, MessageLevel
         case ErrorMessageLevel:
             levelString = "ERROR";
             break;
+        case ObjectMessageLevel:
+            levelString = "OBJECT";
+            break;
+        case TraceMessageLevel:
+            levelString = "TRACE";
+            break;
+        case StartGroupMessageLevel:
+            levelString = "START GROUP";
+            break;
+        case EndGroupMessageLevel:
+            levelString = "END GROUP";
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+            levelString = "UNKNOWN";
+            break;
     }
 
     printf("%s %s:", sourceString, levelString);
@@ -136,7 +156,7 @@ void Console::addMessage(MessageSource source, MessageLevel level, const String&
         return;
 
     if (source == JSMessageSource || source == WMLMessageSource)
-        page->chrome()->client()->addMessageToConsole(message, lineNumber, sourceURL);
+        page->chrome()->client()->addMessageToConsole(source, level, message, lineNumber, sourceURL);
 
     page->inspectorController()->addMessageToConsole(source, level, message, lineNumber, sourceURL);
 
@@ -160,8 +180,8 @@ void Console::addMessage(MessageLevel level, ScriptCallStack* callStack, bool ac
         return;
 
     String message;
-    if (getFirstArgumentAsString(lastCaller, message))
-        page->chrome()->client()->addMessageToConsole(message, lastCaller.lineNumber(), lastCaller.sourceURL().prettyURL());
+    if (getFirstArgumentAsString(callStack->state(), lastCaller, message))
+        page->chrome()->client()->addMessageToConsole(JSMessageSource, level, message, lastCaller.lineNumber(), lastCaller.sourceURL().prettyURL());
 
     page->inspectorController()->addMessageToConsole(JSMessageSource, level, callStack);
 
@@ -207,7 +227,8 @@ void Console::dir(ScriptCallStack* callStack)
 
 void Console::dirxml(ScriptCallStack* callStack)
 {
-    addMessage(NodeMessageLevel, callStack);
+    // The standard behavior of our console.log will print the DOM tree for nodes.
+    log(callStack);
 }
 
 void Console::trace(ScriptCallStack* callStack)
@@ -243,12 +264,12 @@ void Console::count(ScriptCallStack* callStack)
     // Follow Firebug's behavior of counting with null and undefined title in
     // the same bucket as no argument
     String title;
-    getFirstArgumentAsString(lastCaller, title);
+    getFirstArgumentAsString(callStack->state(), lastCaller, title);
 
     page->inspectorController()->count(title, lastCaller.lineNumber(), lastCaller.sourceURL().string());
 }
 
-#if USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
 
 void Console::profile(const JSC::UString& title, ScriptCallStack* callStack)
 {
@@ -256,14 +277,19 @@ void Console::profile(const JSC::UString& title, ScriptCallStack* callStack)
     if (!page)
         return;
 
-    if (title.isNull())
+    InspectorController* controller = page->inspectorController();
+    // FIXME: log a console message when profiling is disabled. 
+    if (!controller->profilerEnabled())
         return;
 
-    // FIXME: log a console message when profiling is disabled.
-    if (!page->inspectorController()->profilerEnabled())
-        return;
+    JSC::UString resolvedTitle = title;
+    if (title.isNull())   // no title so give it the next user initiated profile title.
+        resolvedTitle = controller->getCurrentUserInitiatedProfileName(true);
 
-    JSC::Profiler::profiler()->startProfiling(callStack->state(), title);
+    JSC::Profiler::profiler()->startProfiling(callStack->state(), resolvedTitle);
+
+    const ScriptCallFrame& lastCaller = callStack->at(0);
+    controller->addStartProfilingMessageToConsole(resolvedTitle, lastCaller.lineNumber(), lastCaller.sourceURL());
 }
 
 void Console::profileEnd(const JSC::UString& title, ScriptCallStack* callStack)
@@ -272,7 +298,11 @@ void Console::profileEnd(const JSC::UString& title, ScriptCallStack* callStack)
     if (!page)
         return;
 
-    if (!page->inspectorController()->profilerEnabled())
+    if (!this->page())
+        return;
+
+    InspectorController* controller = page->inspectorController();
+    if (!controller->profilerEnabled())
         return;
 
     RefPtr<JSC::Profile> profile = JSC::Profiler::profiler()->stopProfiling(callStack->state(), title);
@@ -281,10 +311,8 @@ void Console::profileEnd(const JSC::UString& title, ScriptCallStack* callStack)
 
     m_profiles.append(profile);
 
-    if (Page* page = this->page()) {
-        const ScriptCallFrame& lastCaller = callStack->at(0);
-        page->inspectorController()->addProfile(profile, lastCaller.lineNumber(), lastCaller.sourceURL());
-    }
+    const ScriptCallFrame& lastCaller = callStack->at(0);
+    controller->addProfile(profile, lastCaller.lineNumber(), lastCaller.sourceURL());
 }
 
 #endif
diff --git a/src/3rdparty/webkit/WebCore/page/Console.h b/src/3rdparty/webkit/WebCore/page/Console.h
index 7301fc9..79396ea 100644
--- a/src/3rdparty/webkit/WebCore/page/Console.h
+++ b/src/3rdparty/webkit/WebCore/page/Console.h
@@ -31,7 +31,7 @@
 
 #include "PlatformString.h"
 
-#if USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
 #include <profiler/Profile.h>
 #endif
 
@@ -40,7 +40,7 @@
 
 namespace WebCore {
 
-#if USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
     typedef Vector<RefPtr<JSC::Profile> > ProfilesArray;
 #endif
 
@@ -64,8 +64,8 @@ namespace WebCore {
         LogMessageLevel,
         WarningMessageLevel,
         ErrorMessageLevel,
+        // FIXME: the remaining levels should become a new MessageType enum.
         ObjectMessageLevel,
-        NodeMessageLevel,
         TraceMessageLevel,
         StartGroupMessageLevel,
         EndGroupMessageLevel
@@ -75,6 +75,7 @@ namespace WebCore {
     public:
         static PassRefPtr<Console> create(Frame* frame) { return adoptRef(new Console(frame)); }
 
+        Frame* frame() const;
         void disconnectFrame();
 
         void addMessage(MessageSource, MessageLevel, const String& message, unsigned lineNumber, const String& sourceURL);
@@ -89,7 +90,7 @@ namespace WebCore {
         void trace(ScriptCallStack*);
         void assertCondition(bool condition, ScriptCallStack*);
         void count(ScriptCallStack*);
-#if USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
         void profile(const JSC::UString&, ScriptCallStack*);
         void profileEnd(const JSC::UString&, ScriptCallStack*);
 #endif
@@ -101,7 +102,7 @@ namespace WebCore {
         static bool shouldPrintExceptions();
         static void setShouldPrintExceptions(bool);
 
-#if USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
         const ProfilesArray& profiles() const { return m_profiles; }
 #endif
 
@@ -112,7 +113,7 @@ namespace WebCore {
         Console(Frame*);
 
         Frame* m_frame;
-#if USE(JSC)
+#if ENABLE(JAVASCRIPT_DEBUGGER)
         ProfilesArray m_profiles;
 #endif
     };
diff --git a/src/3rdparty/webkit/WebCore/page/Console.idl b/src/3rdparty/webkit/WebCore/page/Console.idl
index fb7688d..4803508 100644
--- a/src/3rdparty/webkit/WebCore/page/Console.idl
+++ b/src/3rdparty/webkit/WebCore/page/Console.idl
@@ -30,7 +30,7 @@ module window {
 
     interface Console {
 
-#if !defined(V8_BINDING)
+#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
         readonly attribute [CustomGetter] Array profiles;
 #endif
     
@@ -45,7 +45,7 @@ module window {
         [CustomArgumentHandling, ImplementationFunction=assertCondition] void assert(in boolean condition);
         [CustomArgumentHandling] void count();
 
-#if !defined(V8_BINDING)
+#if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
         [CustomArgumentHandling] void profile(in [ConvertUndefinedOrNullToNullString] DOMString title);
         [CustomArgumentHandling] void profileEnd(in [ConvertUndefinedOrNullToNullString] DOMString title);
 #endif
diff --git a/src/3rdparty/webkit/WebCore/page/ContextMenuClient.h b/src/3rdparty/webkit/WebCore/page/ContextMenuClient.h
index 775adc5..1997cd0 100644
--- a/src/3rdparty/webkit/WebCore/page/ContextMenuClient.h
+++ b/src/3rdparty/webkit/WebCore/page/ContextMenuClient.h
@@ -47,6 +47,7 @@ namespace WebCore {
         virtual void downloadURL(const KURL& url) = 0;
         virtual void searchWithGoogle(const Frame*) = 0;
         virtual void lookUpInDictionary(Frame*) = 0;
+        virtual bool isSpeaking() = 0;
         virtual void speak(const String&) = 0;
         virtual void stopSpeaking() = 0;
 
diff --git a/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp b/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp
index 5e9f8b5..58e6519 100644
--- a/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/ContextMenuController.cpp
@@ -37,11 +37,13 @@
 #include "Event.h"
 #include "EventHandler.h"
 #include "EventNames.h"
+#include "FormState.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoadRequest.h"
 #include "HitTestRequest.h"
 #include "HitTestResult.h"
+#include "HTMLFormElement.h"
 #include "InspectorController.h"
 #include "MouseEvent.h"
 #include "Node.h"
@@ -83,15 +85,10 @@ void ContextMenuController::handleContextMenuEvent(Event* event)
     if (!event->isMouseEvent())
         return;
     MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
-    IntPoint point = IntPoint(mouseEvent->pageX(), mouseEvent->pageY());
-    HitTestResult result(point);
+    HitTestResult result(mouseEvent->absoluteLocation());
 
-    if (Frame* frame = event->target()->toNode()->document()->frame()) {
-        float zoomFactor = frame->pageZoomFactor();
-        point.setX(static_cast<int>(point.x() * zoomFactor));
-        point.setY(static_cast<int>(point.y() * zoomFactor));
-        result = frame->eventHandler()->hitTestResultAtPoint(point, false);
-    }
+    if (Frame* frame = event->target()->toNode()->document()->frame())
+        result = frame->eventHandler()->hitTestResultAtPoint(mouseEvent->absoluteLocation(), false);
 
     if (!result.innerNonSharedNode())
         return;
@@ -193,14 +190,14 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
 #endif
         case ContextMenuItemTagSpellingGuess:
             ASSERT(frame->selectedText().length());
-            if (frame->editor()->shouldInsertText(item->title(), frame->selection()->toRange().get(),
+            if (frame->editor()->shouldInsertText(item->title(), frame->selection()->toNormalizedRange().get(),
                 EditorInsertActionPasted)) {
                 Document* document = frame->document();
                 RefPtr<ReplaceSelectionCommand> command =
                     ReplaceSelectionCommand::create(document, createFragmentFromMarkup(document, item->title(), ""),
                                                                                    true, false, true);
                 applyCommand(command);
-                frame->revealSelection(RenderLayer::gAlignToEdgeIfNeeded);
+                frame->revealSelection(ScrollAlignment::alignToEdgeIfNeeded);
             }
             break;
         case ContextMenuItemTagIgnoreSpelling:
@@ -217,10 +214,10 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
             m_client->lookUpInDictionary(frame);
             break;
         case ContextMenuItemTagOpenLink:
-            if (Frame* targetFrame = result.targetFrame())
-                targetFrame->loader()->loadFrameRequestWithFormAndValues(FrameLoadRequest(ResourceRequest(result.absoluteLinkURL(), 
-                    frame->loader()->outgoingReferrer())), false, 0, 0, HashMap<String, String>());
-            else
+            if (Frame* targetFrame = result.targetFrame()) {
+                targetFrame->loader()->loadFrameRequest(FrameLoadRequest(ResourceRequest(result.absoluteLinkURL(), 
+                    frame->loader()->outgoingReferrer())), false, false, 0, 0);
+            } else
                 openNewWindow(result.absoluteLinkURL(), frame);
             break;
         case ContextMenuItemTagBold:
@@ -238,7 +235,7 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
             break;
         case ContextMenuItemTagStartSpeaking: {
             ExceptionCode ec;
-            RefPtr<Range> selectedRange = frame->selection()->toRange();
+            RefPtr<Range> selectedRange = frame->selection()->toNormalizedRange();
             if (!selectedRange || selectedRange->collapsed(ec)) {
                 Document* document = result.innerNonSharedNode()->document();
                 selectedRange = document->createRange();
@@ -298,6 +295,41 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
             frame->editor()->showColorPanel();
             break;
 #endif
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+        case ContextMenuItemTagMakeUpperCase:
+            frame->editor()->uppercaseWord();
+            break;
+        case ContextMenuItemTagMakeLowerCase:
+            frame->editor()->lowercaseWord();
+            break;
+        case ContextMenuItemTagCapitalize:
+            frame->editor()->capitalizeWord();
+            break;
+        case ContextMenuItemTagShowSubstitutions:
+            frame->editor()->showSubstitutionsPanel();
+            break;
+        case ContextMenuItemTagSmartCopyPaste:
+            frame->editor()->toggleSmartInsertDelete();
+            break;
+        case ContextMenuItemTagSmartQuotes:
+            frame->editor()->toggleAutomaticQuoteSubstitution();
+            break;
+        case ContextMenuItemTagSmartDashes:
+            frame->editor()->toggleAutomaticDashSubstitution();
+            break;
+        case ContextMenuItemTagSmartLinks:
+            frame->editor()->toggleAutomaticLinkDetection();
+            break;
+        case ContextMenuItemTagTextReplacement:
+            frame->editor()->toggleAutomaticTextReplacement();
+            break;
+        case ContextMenuItemTagCorrectSpellingAutomatically:
+            frame->editor()->toggleAutomaticSpellingCorrection();
+            break;
+        case ContextMenuItemTagChangeBack:
+            frame->editor()->changeBackToReplacedString(result.replacedString());
+            break;
+#endif
         case ContextMenuItemTagInspectElement:
             if (Page* page = frame->page())
                 page->inspectorController()->inspect(result.innerNonSharedNode());
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMStringListCustom.cpp b/src/3rdparty/webkit/WebCore/page/Coordinates.cpp
index ccf0ce8..637a8c2 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/JSDOMStringListCustom.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Coordinates.cpp
@@ -24,26 +24,15 @@
  */
 
 #include "config.h"
-#include "JSDOMStringList.h"
-
-#include "DOMStringList.h"
-
-using namespace JSC;
+#include "Coordinates.h"
 
 namespace WebCore {
 
-JSValuePtr JSDOMStringList::getByIndex(ExecState* exec, unsigned index)
-{
-    return jsString(exec, impl()->item(index));
-}
-
-JSValuePtr JSDOMStringList::item(ExecState* exec, const ArgList& args)
+String Coordinates::toString() const
 {
-    unsigned index = args.at(exec, 0)->toUInt32(exec);
-    if (index >= impl()->length())
-        return jsNull();
-
-    return jsString(exec, impl()->item(index));
+    return String::format("coordinate(%.6lg, %.6lg, %.6lg, %.6lg, %.6lg, %.6lg, %.6lg)",
+                          m_latitude, m_longitude, m_altitude, m_accuracy, 
+                          m_altitudeAccuracy, m_heading, m_speed);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Coordinates.h b/src/3rdparty/webkit/WebCore/page/Coordinates.h
new file mode 100644
index 0000000..acb5dd0
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/Coordinates.h
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef Coordinates_h
+#define Coordinates_h
+
+#include "Event.h"
+#include "PlatformString.h"
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+typedef int ExceptionCode;
+
+class Coordinates : public RefCounted<Coordinates> {
+public:
+    static PassRefPtr<Coordinates> create(double latitude, double longitude, bool providesAltitude, double altitude, double accuracy, bool providesAltitudeAccuracy, double altitudeAccuracy, bool providesHeading, double heading, bool providesSpeed, double speed) { return adoptRef(new Coordinates(latitude, longitude, providesAltitude, altitude, accuracy, providesAltitudeAccuracy, altitudeAccuracy, providesHeading, heading, providesSpeed, speed)); }
+    
+    double latitude() const { return m_latitude; }
+    double longitude() const { return m_longitude; }
+    double altitude() const { return m_altitude; }
+    double accuracy() const { return m_accuracy; }
+    double altitudeAccuracy() const { return m_altitudeAccuracy; }
+    double heading() const { return m_heading; }
+    double speed() const { return m_speed; }
+
+    bool canProvideAltitude() const { return m_canProvideAltitude; }
+    bool canProvideAltitudeAccuracy() const { return m_canProvideAltitudeAccuracy; }
+    bool canProvideHeading() const { return m_canProvideHeading; }
+    bool canProvideSpeed() const { return m_canProvideSpeed; }
+    
+    String toString() const;
+
+private:
+    Coordinates(double latitude, double longitude, bool providesAltitude, double altitude, double accuracy, bool providesAltitudeAccuracy, double altitudeAccuracy, bool providesHeading, double heading, bool providesSpeed, double speed)
+        : m_latitude(latitude)
+        , m_longitude(longitude)
+        , m_altitude(altitude)
+        , m_accuracy(accuracy)
+        , m_altitudeAccuracy(altitudeAccuracy)
+        , m_heading(heading)
+        , m_speed(speed)
+        , m_canProvideAltitude(providesAltitude)
+        , m_canProvideAltitudeAccuracy(providesAltitudeAccuracy)
+        , m_canProvideHeading(providesHeading)
+        , m_canProvideSpeed(providesSpeed)
+    {
+    }
+
+    double m_latitude;
+    double m_longitude;
+    double m_altitude;
+    double m_accuracy;
+    double m_altitudeAccuracy;
+    double m_heading;
+    double m_speed;
+    
+    bool m_canProvideAltitude;
+    bool m_canProvideAltitudeAccuracy;
+    bool m_canProvideHeading;
+    bool m_canProvideSpeed;
+};
+    
+} // namespace WebCore
+
+#endif // Coordinates_h
diff --git a/src/3rdparty/webkit/WebCore/page/Coordinates.idl b/src/3rdparty/webkit/WebCore/page/Coordinates.idl
new file mode 100644
index 0000000..f6c82b5
--- /dev/null
+++ b/src/3rdparty/webkit/WebCore/page/Coordinates.idl
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2009 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+module core {
+
+    interface Coordinates {
+        readonly attribute double latitude;
+        readonly attribute double longitude;
+        readonly attribute [Custom] double altitude;
+        readonly attribute double accuracy;
+        readonly attribute [Custom] double altitudeAccuracy;
+        readonly attribute [Custom] double heading;
+        readonly attribute [Custom] double speed;
+
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+        [DontEnum] DOMString toString();
+#endif
+    };
+}
diff --git a/src/3rdparty/webkit/WebCore/page/DOMSelection.cpp b/src/3rdparty/webkit/WebCore/page/DOMSelection.cpp
index 5dab325..3b54f02 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMSelection.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DOMSelection.cpp
@@ -56,76 +56,89 @@ void DOMSelection::disconnectFrame()
     m_frame = 0;
 }
 
-Node* DOMSelection::anchorNode() const
+const VisibleSelection& DOMSelection::visibleSelection() const
 {
-    if (!m_frame)
-        return 0;
+    ASSERT(m_frame);
+    return m_frame->selection()->selection();
+}
 
-    const Selection& selection = m_frame->selection()->selection();
+static Position anchorPosition(const VisibleSelection& selection)
+{
     Position anchor = selection.isBaseFirst() ? selection.start() : selection.end();
-    anchor = rangeCompliantEquivalent(anchor);
-    return anchor.node();
+    return rangeCompliantEquivalent(anchor);
 }
 
-Node* DOMSelection::baseNode() const
+static Position focusPosition(const VisibleSelection& selection)
+{
+    Position focus = selection.isBaseFirst() ? selection.end() : selection.start();
+    return rangeCompliantEquivalent(focus);
+}
+
+static Position basePosition(const VisibleSelection& selection)
+{
+    return rangeCompliantEquivalent(selection.base());
+}
+
+static Position extentPosition(const VisibleSelection& selection)
+{
+    return rangeCompliantEquivalent(selection.extent());
+}
+
+Node* DOMSelection::anchorNode() const
 {
     if (!m_frame)
         return 0;
-    return rangeCompliantEquivalent(m_frame->selection()->selection().base()).node();
+    return anchorPosition(visibleSelection()).node();
 }
 
 int DOMSelection::anchorOffset() const
 {
     if (!m_frame)
         return 0;
-
-    const Selection& selection = m_frame->selection()->selection();
-    Position anchor = selection.isBaseFirst() ? selection.start() : selection.end();
-    anchor = rangeCompliantEquivalent(anchor);
-    return anchor.offset();
+    return anchorPosition(visibleSelection()).deprecatedEditingOffset();
 }
 
-int DOMSelection::baseOffset() const
+Node* DOMSelection::focusNode() const
 {
     if (!m_frame)
         return 0;
-    return rangeCompliantEquivalent(m_frame->selection()->selection().base()).offset();
+    return focusPosition(visibleSelection()).node();
 }
 
-Node* DOMSelection::focusNode() const
+int DOMSelection::focusOffset() const
 {
     if (!m_frame)
         return 0;
-
-    const Selection& selection = m_frame->selection()->selection();
-    Position focus = selection.isBaseFirst() ? selection.end() : selection.start();
-    focus = rangeCompliantEquivalent(focus);
-    return focus.node();
+    return focusPosition(visibleSelection()).deprecatedEditingOffset();
 }
 
-Node* DOMSelection::extentNode() const
+Node* DOMSelection::baseNode() const
 {
     if (!m_frame)
         return 0;
-    return rangeCompliantEquivalent(m_frame->selection()->selection().extent()).node();
+    return basePosition(visibleSelection()).node();
 }
 
-int DOMSelection::focusOffset() const
+int DOMSelection::baseOffset() const
 {
     if (!m_frame)
         return 0;
+    return basePosition(visibleSelection()).deprecatedEditingOffset();
+}
 
-    const Selection& selection = m_frame->selection()->selection();
-    Position focus = selection.isBaseFirst() ? selection.end() : selection.start();
-    focus = rangeCompliantEquivalent(focus);
-    return focus.offset();
+
+Node* DOMSelection::extentNode() const
+{
+    if (!m_frame)
+        return 0;
+    return extentPosition(visibleSelection()).node();
 }
 
 int DOMSelection::extentOffset() const
 {
     if (!m_frame)
         return 0;
-    return rangeCompliantEquivalent(m_frame->selection()->selection().extent()).offset();
+    return extentPosition(visibleSelection()).deprecatedEditingOffset();
 }
 
 bool DOMSelection::isCollapsed() const
@@ -142,6 +155,9 @@ String DOMSelection::type() const
 
     SelectionController* selection = m_frame->selection();
 
+    // This is a WebKit DOM extension, incompatible with an IE extension
+    // IE has this same attribute, but returns "none", "text" and "control"
+    // http://msdn.microsoft.com/en-us/library/ms534692(VS.85).aspx
     if (selection->isNone())
         return "None";
     if (selection->isCaret())
@@ -173,7 +189,7 @@ void DOMSelection::collapseToEnd()
     if (!m_frame)
         return;
 
-    const Selection& selection = m_frame->selection()->selection();
+    const VisibleSelection& selection = m_frame->selection()->selection();
     m_frame->selection()->moveTo(VisiblePosition(selection.end(), DOWNSTREAM));
 }
 
@@ -182,7 +198,7 @@ void DOMSelection::collapseToStart()
     if (!m_frame)
         return;
 
-    const Selection& selection = m_frame->selection()->selection();
+    const VisibleSelection& selection = m_frame->selection()->selection();
     m_frame->selection()->moveTo(VisiblePosition(selection.start(), DOWNSTREAM));
 }
 
@@ -298,8 +314,11 @@ PassRefPtr<Range> DOMSelection::getRangeAt(int index, ExceptionCode& ec)
         return 0;
     }
 
-    const Selection& selection = m_frame->selection()->selection();
-    return selection.toRange();
+    // If you're hitting this, you've added broken multi-range selection support
+    ASSERT(rangeCount() == 1);
+
+    const VisibleSelection& selection = m_frame->selection()->selection();
+    return selection.firstRange();
 }
 
 void DOMSelection::removeAllRanges()
@@ -319,31 +338,31 @@ void DOMSelection::addRange(Range* r)
     SelectionController* selection = m_frame->selection();
     
     if (selection->isNone()) {
-        selection->setSelection(Selection(r));
+        selection->setSelection(VisibleSelection(r));
         return;
     }
 
-    RefPtr<Range> range = selection->selection().toRange();
+    RefPtr<Range> range = selection->selection().toNormalizedRange();
     ExceptionCode ec = 0;
     if (r->compareBoundaryPoints(Range::START_TO_START, range.get(), ec) == -1) {
         // We don't support discontiguous selection. We don't do anything if r and range don't intersect.
         if (r->compareBoundaryPoints(Range::START_TO_END, range.get(), ec) > -1) {
             if (r->compareBoundaryPoints(Range::END_TO_END, range.get(), ec) == -1)
                 // The original range and r intersect.
-                selection->setSelection(Selection(r->startPosition(), range->endPosition(), DOWNSTREAM));
+                selection->setSelection(VisibleSelection(r->startPosition(), range->endPosition(), DOWNSTREAM));
             else
                 // r contains the original range.
-                selection->setSelection(Selection(r));
+                selection->setSelection(VisibleSelection(r));
         }
     } else {
         // We don't support discontiguous selection. We don't do anything if r and range don't intersect.
         if (r->compareBoundaryPoints(Range::END_TO_START, range.get(), ec) < 1) {
             if (r->compareBoundaryPoints(Range::END_TO_END, range.get(), ec) == -1)
                 // The original range contains r.
-                selection->setSelection(Selection(range.get()));
+                selection->setSelection(VisibleSelection(range.get()));
             else
                 // The original range and r intersect.
-                selection->setSelection(Selection(range->startPosition(), r->endPosition(), DOWNSTREAM));
+                selection->setSelection(VisibleSelection(range->startPosition(), r->endPosition(), DOWNSTREAM));
         }
     }
 }
@@ -361,7 +380,7 @@ void DOMSelection::deleteFromDocument()
     if (isCollapsed())
         selection->modify(SelectionController::EXTEND, SelectionController::BACKWARD, CharacterGranularity);
 
-    RefPtr<Range> selectedRange = selection->selection().toRange();
+    RefPtr<Range> selectedRange = selection->selection().toNormalizedRange();
 
     ExceptionCode ec = 0;
     selectedRange->deleteContents(ec);
@@ -383,7 +402,7 @@ bool DOMSelection::containsNode(const Node* n, bool allowPartial) const
 
     Node* parentNode = n->parentNode();
     unsigned nodeIndex = n->nodeIndex();
-    RefPtr<Range> selectedRange = selection->selection().toRange();
+    RefPtr<Range> selectedRange = selection->selection().toNormalizedRange();
 
     if (!parentNode)
         return false;
@@ -418,7 +437,7 @@ String DOMSelection::toString()
     if (!m_frame)
         return String();
 
-    return plainText(m_frame->selection()->selection().toRange().get());
+    return plainText(m_frame->selection()->selection().toNormalizedRange().get());
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/DOMSelection.h b/src/3rdparty/webkit/WebCore/page/DOMSelection.h
index fd8d1fc..6a914d6 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMSelection.h
+++ b/src/3rdparty/webkit/WebCore/page/DOMSelection.h
@@ -40,6 +40,7 @@ namespace WebCore {
     class Range;
     class Node;
     class String;
+    class VisibleSelection;
 
     typedef int ExceptionCode;
 
@@ -88,12 +89,13 @@ namespace WebCore {
 
         // Microsoft Selection Object API
         void empty();
-        //void clear();
-        //TextRange *createRange();
 
     private:
         DOMSelection(Frame*);
-        
+
+        // Convenience method for accessors, does not NULL check m_frame.
+        const VisibleSelection& visibleSelection() const;
+
         Frame* m_frame;
     };
 
diff --git a/src/3rdparty/webkit/WebCore/page/DOMSelection.idl b/src/3rdparty/webkit/WebCore/page/DOMSelection.idl
index 85d23bf..be6c2b4 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMSelection.idl
+++ b/src/3rdparty/webkit/WebCore/page/DOMSelection.idl
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2009 Google Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,43 +29,58 @@
 
 module window {
 
+    // This is based off of Mozilla's Selection interface
+    // https://developer.mozilla.org/En/DOM/Selection
     interface DOMSelection {
         readonly attribute Node anchorNode;
         readonly attribute long anchorOffset;
         readonly attribute Node focusNode;
         readonly attribute long focusOffset;
-        readonly attribute Node baseNode;
-        readonly attribute long baseOffset;
-        readonly attribute Node extentNode;
-        readonly attribute long extentOffset;
+
         readonly attribute boolean isCollapsed;
-        readonly attribute DOMString type;
         readonly attribute long rangeCount;
 
         void collapse(in Node node, in long index)
             raises(DOMException);
         void collapseToEnd();
         void collapseToStart();
+
         void deleteFromDocument();
         boolean containsNode(in Node node, in boolean allowPartial);
         void selectAllChildren(in Node node)
             raises(DOMException);
-        void empty();
-        void setBaseAndExtent(in Node baseNode, in long baseOffset, in Node extentNode, in long extentOffset)
-            raises(DOMException);
-        void setPosition(in Node node, in long offset)
-            raises(DOMException);
-        void modify(in DOMString alter, in DOMString direction, in DOMString granularity);
+
         void extend(in Node node, in long offset)
             raises(DOMException);
+
         Range getRangeAt(in long index)
             raises(DOMException);
         void removeAllRanges();
         void addRange(in Range range);
 
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         [DontEnum] DOMString toString();
 #endif
+
+        // WebKit extensions
+        readonly attribute Node baseNode;
+        readonly attribute long baseOffset;
+        readonly attribute Node extentNode;
+        readonly attribute long extentOffset;
+
+        // WebKit's "type" accessor returns "None", "Range" and "Caret"
+        // IE's type accessor returns "none", "text" and "control"
+        readonly attribute DOMString type;
+
+        void modify(in DOMString alter, in DOMString direction, in DOMString granularity);
+        void setBaseAndExtent(in Node baseNode, in long baseOffset, in Node extentNode, in long extentOffset)
+            raises(DOMException);
+        void setPosition(in Node node, in long offset)
+            raises(DOMException);
+
+        // IE extentions
+        // http://msdn.microsoft.com/en-us/library/ms535869(VS.85).aspx
+        void empty();
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMTimer.cpp b/src/3rdparty/webkit/WebCore/page/DOMTimer.cpp
index 911da71..1cc7730 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/DOMTimer.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DOMTimer.cpp
@@ -27,7 +27,6 @@
 #include "config.h"
 #include "DOMTimer.h"
 
-#include "Document.h"
 #include "ScheduledAction.h"
 #include "ScriptExecutionContext.h"
 #include <wtf/HashSet.h>
@@ -39,7 +38,7 @@ namespace WebCore {
 
 static const int maxTimerNestingLevel = 5;
 static const double oneMillisecond = 0.001;
-static const double minTimerInterval = 0.010; // 10 milliseconds
+double DOMTimer::s_minTimerInterval = 0.010; // 10 milliseconds
 
 static int timerNestingLevel = 0;
 
@@ -58,18 +57,15 @@ DOMTimer::DOMTimer(ScriptExecutionContext* context, ScheduledAction* action, int
     
     m_nestingLevel = timerNestingLevel + 1;
 
-    // FIXME: Move the timeout map and API to ScriptExecutionContext to be able
-    // to create timeouts from Workers.
-    ASSERT(scriptExecutionContext() && scriptExecutionContext()->isDocument());
-    static_cast<Document*>(scriptExecutionContext())->addTimeout(m_timeoutId, this);
+    scriptExecutionContext()->addTimeout(m_timeoutId, this);
 
     double intervalMilliseconds = max(oneMillisecond, timeout * oneMillisecond);
 
     // Use a minimum interval of 10 ms to match other browsers, but only once we've
     // nested enough to notice that we're repeating.
     // Faster timers might be "better", but they're incompatible.
-    if (intervalMilliseconds < minTimerInterval && m_nestingLevel >= maxTimerNestingLevel)
-        intervalMilliseconds = minTimerInterval;
+    if (intervalMilliseconds < s_minTimerInterval && m_nestingLevel >= maxTimerNestingLevel)
+        intervalMilliseconds = s_minTimerInterval;
     if (singleShot)
         startOneShot(intervalMilliseconds);
     else
@@ -79,8 +75,7 @@ DOMTimer::DOMTimer(ScriptExecutionContext* context, ScheduledAction* action, int
 DOMTimer::~DOMTimer()
 {
     if (scriptExecutionContext()) {
-        ASSERT(scriptExecutionContext()->isDocument());
-        static_cast<Document*>(scriptExecutionContext())->removeTimeout(m_timeoutId);
+        scriptExecutionContext()->removeTimeout(m_timeoutId);
     }
 }
     
@@ -100,8 +95,7 @@ void DOMTimer::removeById(ScriptExecutionContext* context, int timeoutId)
     // respectively
     if (timeoutId <= 0)
         return;
-    ASSERT(context && context->isDocument());
-    delete static_cast<Document*>(context)->findTimeout(timeoutId);
+    delete context->findTimeout(timeoutId);
 }
 
 void DOMTimer::fired()
@@ -111,10 +105,10 @@ void DOMTimer::fired()
 
     // Simple case for non-one-shot timers.
     if (isActive()) {
-        if (repeatInterval() && repeatInterval() < minTimerInterval) {
+        if (repeatInterval() && repeatInterval() < s_minTimerInterval) {
             m_nestingLevel++;
             if (m_nestingLevel >= maxTimerNestingLevel)
-                augmentRepeatInterval(minTimerInterval - repeatInterval());
+                augmentRepeatInterval(s_minTimerInterval - repeatInterval());
         }
         
         // No access to member variables after this point, it can delete the timer.
diff --git a/src/3rdparty/webkit/WebCore/bindings/js/DOMTimer.h b/src/3rdparty/webkit/WebCore/page/DOMTimer.h
index 200b9b1..f6343fc 100644
--- a/src/3rdparty/webkit/WebCore/bindings/js/DOMTimer.h
+++ b/src/3rdparty/webkit/WebCore/page/DOMTimer.h
@@ -51,6 +51,12 @@ public:
     virtual void suspend();
     virtual void resume();
 
+    // The lowest allowable timer setting (in seconds, 0.001 == 1 ms).
+    // Default is 10ms.
+    // Chromium uses a non-default timeout.
+    static double minTimerInterval() { return s_minTimerInterval; }
+    static void setMinTimerInterval(double value) { s_minTimerInterval = value; }
+
 private:
     DOMTimer(ScriptExecutionContext*, ScheduledAction*, int timeout, bool singleShot);
     virtual void fired();
@@ -60,6 +66,7 @@ private:
     OwnPtr<ScheduledAction> m_action;
     double m_nextFireInterval;
     double m_repeatInterval;
+    static double s_minTimerInterval;
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp b/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
index dd14fb9..eb1981c 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.cpp
@@ -27,6 +27,7 @@
 #include "DOMWindow.h"
 
 #include "BarInfo.h"
+#include "BeforeUnloadEvent.h"
 #include "CSSComputedStyleDeclaration.h"
 #include "CSSRuleList.h"
 #include "CSSStyleSelector.h"
@@ -34,8 +35,10 @@
 #include "Chrome.h"
 #include "Console.h"
 #include "DOMSelection.h"
+#include "DOMTimer.h"
 #include "Document.h"
 #include "Element.h"
+#include "EventException.h"
 #include "EventListener.h"
 #include "EventNames.h"
 #include "ExceptionCode.h"
@@ -46,6 +49,7 @@
 #include "FrameView.h"
 #include "HTMLFrameOwnerElement.h"
 #include "History.h"
+#include "InspectorController.h"
 #include "Location.h"
 #include "MessageEvent.h"
 #include "Navigator.h"
@@ -56,6 +60,8 @@
 #include "Screen.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
+#include "SuddenTermination.h"
+#include "WebKitPoint.h"
 #include <algorithm>
 #include <wtf/MathExtras.h>
 
@@ -64,10 +70,9 @@
 #endif
 
 #if ENABLE(DOM_STORAGE)
-#include "LocalStorage.h"
-#include "SessionStorage.h"
 #include "Storage.h"
 #include "StorageArea.h"
+#include "StorageNamespace.h"
 #endif
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
@@ -81,14 +86,25 @@ namespace WebCore {
 
 class PostMessageTimer : public TimerBase {
 public:
-    PostMessageTimer(DOMWindow* window, PassRefPtr<MessageEvent> event, SecurityOrigin* targetOrigin)
+    PostMessageTimer(DOMWindow* window, const String& message, const String& sourceOrigin, PassRefPtr<DOMWindow> source, PassOwnPtr<MessagePortChannel> channel, SecurityOrigin* targetOrigin)
         : m_window(window)
-        , m_event(event)
+        , m_message(message)
+        , m_origin(sourceOrigin)
+        , m_source(source)
+        , m_channel(channel)
         , m_targetOrigin(targetOrigin)
     {
     }
 
-    MessageEvent* event() const { return m_event.get(); }
+    PassRefPtr<MessageEvent> event(ScriptExecutionContext* context)
+    {
+        RefPtr<MessagePort> messagePort;
+        if (m_channel) {
+            messagePort = MessagePort::create(*context);
+            messagePort->entangle(m_channel.release());
+        }
+        return MessageEvent::create(m_message, m_origin, "", m_source, messagePort.release());
+    }
     SecurityOrigin* targetOrigin() const { return m_targetOrigin.get(); }
 
 private:
@@ -98,10 +114,159 @@ private:
     }
 
     RefPtr<DOMWindow> m_window;
-    RefPtr<MessageEvent> m_event;
+    String m_message;
+    String m_origin;
+    RefPtr<DOMWindow> m_source;
+    OwnPtr<MessagePortChannel> m_channel;
     RefPtr<SecurityOrigin> m_targetOrigin;
 };
 
+typedef HashMap<DOMWindow*, RegisteredEventListenerVector*> DOMWindowRegisteredEventListenerMap;
+
+static DOMWindowRegisteredEventListenerMap& pendingUnloadEventListenerMap()
+{
+    DEFINE_STATIC_LOCAL(DOMWindowRegisteredEventListenerMap, eventListenerMap, ());
+    return eventListenerMap;
+}
+
+static DOMWindowRegisteredEventListenerMap& pendingBeforeUnloadEventListenerMap()
+{
+    DEFINE_STATIC_LOCAL(DOMWindowRegisteredEventListenerMap, eventListenerMap, ());
+    return eventListenerMap;
+}
+
+static bool allowsPendingBeforeUnloadListeners(DOMWindow* window)
+{
+    ASSERT_ARG(window, window);
+    Frame* frame = window->frame();
+    Page* page = frame->page();
+    return page && frame == page->mainFrame();
+}
+
+static void addPendingEventListener(DOMWindowRegisteredEventListenerMap& map, DOMWindow* window, RegisteredEventListener* listener)
+{
+    ASSERT_ARG(window, window);
+    ASSERT_ARG(listener, listener);
+
+    if (map.isEmpty())
+        disableSuddenTermination();
+
+    pair<DOMWindowRegisteredEventListenerMap::iterator, bool> result = map.add(window, 0);
+    if (result.second)
+        result.first->second = new RegisteredEventListenerVector;
+    result.first->second->append(listener);
+}
+
+static void removePendingEventListener(DOMWindowRegisteredEventListenerMap& map, DOMWindow* window, RegisteredEventListener* listener)
+{
+    ASSERT_ARG(window, window);
+    ASSERT_ARG(listener, listener);
+
+    DOMWindowRegisteredEventListenerMap::iterator it = map.find(window);
+    ASSERT(it != map.end());
+
+    RegisteredEventListenerVector* listeners = it->second;
+    size_t index = listeners->find(listener);
+    ASSERT(index != WTF::notFound);
+    listeners->remove(index);
+
+    if (!listeners->isEmpty())
+        return;
+
+    map.remove(it);
+    delete listeners;
+
+    if (map.isEmpty())
+        enableSuddenTermination();
+}
+
+static void removePendingEventListeners(DOMWindowRegisteredEventListenerMap& map, DOMWindow* window)
+{
+    ASSERT_ARG(window, window);
+
+    RegisteredEventListenerVector* listeners = map.take(window);
+    if (!listeners)
+        return;
+
+    delete listeners;
+
+    if (map.isEmpty())
+        enableSuddenTermination();
+}
+
+bool DOMWindow::dispatchAllPendingBeforeUnloadEvents()
+{
+    DOMWindowRegisteredEventListenerMap& map = pendingBeforeUnloadEventListenerMap();
+    if (map.isEmpty())
+        return true;
+
+    static bool alreadyDispatched = false;
+    ASSERT(!alreadyDispatched);
+    if (alreadyDispatched)
+        return true;
+
+    Vector<RefPtr<DOMWindow> > windows;
+    DOMWindowRegisteredEventListenerMap::iterator mapEnd = map.end();
+    for (DOMWindowRegisteredEventListenerMap::iterator it = map.begin(); it != mapEnd; ++it)
+        windows.append(it->first);
+
+    size_t size = windows.size();
+    for (size_t i = 0; i < size; ++i) {
+        DOMWindow* window = windows[i].get();
+        RegisteredEventListenerVector* listeners = map.get(window);
+        if (!listeners)
+            continue;
+
+        RegisteredEventListenerVector listenersCopy = *listeners;
+        Frame* frame = window->frame();
+        if (!frame->shouldClose(&listenersCopy))
+            return false;
+    }
+
+    enableSuddenTermination();
+
+    alreadyDispatched = true;
+
+    return true;
+}
+
+unsigned DOMWindow::pendingUnloadEventListeners() const
+{
+    RegisteredEventListenerVector* listeners = pendingUnloadEventListenerMap().get(const_cast<DOMWindow*>(this));
+    return listeners ? listeners->size() : 0;
+}
+
+void DOMWindow::dispatchAllPendingUnloadEvents()
+{
+    DOMWindowRegisteredEventListenerMap& map = pendingUnloadEventListenerMap();
+    if (map.isEmpty())
+        return;
+
+    static bool alreadyDispatched = false;
+    ASSERT(!alreadyDispatched);
+    if (alreadyDispatched)
+        return;
+
+    Vector<RefPtr<DOMWindow> > windows;
+    DOMWindowRegisteredEventListenerMap::iterator mapEnd = map.end();
+    for (DOMWindowRegisteredEventListenerMap::iterator it = map.begin(); it != mapEnd; ++it)
+        windows.append(it->first);
+
+    size_t size = windows.size();
+    for (size_t i = 0; i < size; ++i) {
+        DOMWindow* window = windows[i].get();
+        RegisteredEventListenerVector* listeners = map.get(window);
+        if (!listeners)
+            continue;
+        RegisteredEventListenerVector listenersCopy = *listeners;
+        window->dispatchUnloadEvent(&listenersCopy);
+    }
+
+    enableSuddenTermination();
+
+    alreadyDispatched = true;
+}
+
 // This function:
 // 1) Validates the pending changes are not changing to NaN
 // 2) Constrains the window rect to no smaller than 100 in each dimension and no
@@ -142,6 +307,62 @@ void DOMWindow::adjustWindowRect(const FloatRect& screen, FloatRect& window, con
     window.setY(max(screen.y(), min(window.y(), screen.bottom() - window.height())));
 }
 
+void DOMWindow::parseModalDialogFeatures(const String& featuresArg, HashMap<String, String>& map)
+{
+    Vector<String> features;
+    featuresArg.split(';', features);
+    Vector<String>::const_iterator end = features.end();
+    for (Vector<String>::const_iterator it = features.begin(); it != end; ++it) {
+        String s = *it;
+        int pos = s.find('=');
+        int colonPos = s.find(':');
+        if (pos >= 0 && colonPos >= 0)
+            continue; // ignore any strings that have both = and :
+        if (pos < 0)
+            pos = colonPos;
+        if (pos < 0) {
+            // null string for value means key without value
+            map.set(s.stripWhiteSpace().lower(), String());
+        } else {
+            String key = s.left(pos).stripWhiteSpace().lower();
+            String val = s.substring(pos + 1).stripWhiteSpace().lower();
+            int spacePos = val.find(' ');
+            if (spacePos != -1)
+                val = val.left(spacePos);
+            map.set(key, val);
+        }
+    }
+}
+
+bool DOMWindow::allowPopUp(Frame* activeFrame)
+{
+    ASSERT(activeFrame);
+    if (activeFrame->script()->processingUserGesture())
+        return true;
+    Settings* settings = activeFrame->settings();
+    return settings && settings->javaScriptCanOpenWindowsAutomatically();
+}
+
+bool DOMWindow::canShowModalDialog(const Frame* frame)
+{
+    if (!frame)
+        return false;
+    Page* page = frame->page();
+    if (!page)
+        return false;
+    return page->chrome()->canRunModal();
+}
+
+bool DOMWindow::canShowModalDialogNow(const Frame* frame)
+{
+    if (!frame)
+        return false;
+    Page* page = frame->page();
+    if (!page)
+        return false;
+    return page->chrome()->canRunModalNow();
+}
+
 DOMWindow::DOMWindow(Frame* frame)
     : m_frame(frame)
 {
@@ -151,6 +372,14 @@ DOMWindow::~DOMWindow()
 {
     if (m_frame)
         m_frame->clearFormerDOMWindow(this);
+
+    removePendingEventListeners(pendingUnloadEventListenerMap(), this);
+    removePendingEventListeners(pendingBeforeUnloadEventListenerMap(), this);
+}
+
+ScriptExecutionContext* DOMWindow::scriptExecutionContext() const
+{
+    return document();
 }
 
 void DOMWindow::disconnectFrame()
@@ -323,10 +552,10 @@ Storage* DOMWindow::sessionStorage() const
         return 0;
 
     Document* document = m_frame->document();
-    if (!document)
-        return 0;
 
     RefPtr<StorageArea> storageArea = page->sessionStorage()->storageArea(document->securityOrigin());
+    page->inspectorController()->didUseDOMStorage(storageArea.get(), false, m_frame);
+
     m_sessionStorage = Storage::create(m_frame, storageArea.release());
     return m_sessionStorage.get();
 }
@@ -348,10 +577,12 @@ Storage* DOMWindow::localStorage() const
     if (!settings || !settings->localStorageEnabled())
         return 0;
 
-    LocalStorage* localStorage = page->group().localStorage();
-    RefPtr<StorageArea> storageArea = localStorage ? localStorage->storageArea(m_frame, document->securityOrigin()) : 0; 
-    if (storageArea)
+    StorageNamespace* localStorage = page->group().localStorage();
+    RefPtr<StorageArea> storageArea = localStorage ? localStorage->storageArea(document->securityOrigin()) : 0; 
+    if (storageArea) {
+        page->inspectorController()->didUseDOMStorage(storageArea.get(), true, m_frame);
         m_localStorage = Storage::create(m_frame, storageArea.release());
+    }
 
     return m_localStorage.get();
 }
@@ -366,16 +597,16 @@ void DOMWindow::postMessage(const String& message, MessagePort* messagePort, con
     // to generate the SYNTAX_ERR exception correctly.
     RefPtr<SecurityOrigin> target;
     if (targetOrigin != "*") {
-        target = SecurityOrigin::create(KURL(targetOrigin));
+        target = SecurityOrigin::createFromString(targetOrigin);
         if (target->isEmpty()) {
             ec = SYNTAX_ERR;
             return;
         }
     }
 
-    RefPtr<MessagePort> newMessagePort;
+    OwnPtr<MessagePortChannel> channel;
     if (messagePort)
-        newMessagePort = messagePort->clone(ec);
+        channel = messagePort->disentangle(ec);
     if (ec)
         return;
 
@@ -387,7 +618,7 @@ void DOMWindow::postMessage(const String& message, MessagePort* messagePort, con
     String sourceOrigin = sourceDocument->securityOrigin()->toString();
 
     // Schedule the message.
-    PostMessageTimer* timer = new PostMessageTimer(this, MessageEvent::create(message, sourceOrigin, "", source, newMessagePort), target.get());
+    PostMessageTimer* timer = new PostMessageTimer(this, message, sourceOrigin, source, channel.release(), target.get());
     timer->startOneShot(0);
 }
 
@@ -408,12 +639,8 @@ void DOMWindow::postMessageTimerFired(PostMessageTimer* t)
         }
     }
 
-    MessagePort* messagePort = timer->event()->messagePort();
-    ASSERT(!messagePort || !messagePort->scriptExecutionContext());
-    if (messagePort)
-        messagePort->attachToContext(document());
-
-    document()->dispatchWindowEvent(timer->event());
+    ExceptionCode ec = 0;
+    dispatchEvent(timer->event(document()), ec);
 }
 
 DOMSelection* DOMWindow::getSelection()
@@ -452,7 +679,20 @@ void DOMWindow::close()
     if (!m_frame)
         return;
 
-    if (m_frame->loader()->openedByDOM() || m_frame->loader()->getHistoryLength() <= 1)
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+
+    if (m_frame != page->mainFrame())
+        return;
+
+    Settings* settings = m_frame->settings();
+    bool allowScriptsToCloseWindows =
+        settings && settings->allowScriptsToCloseWindows();
+
+    if (m_frame->loader()->openedByDOM()
+        || m_frame->loader()->getHistoryLength() <= 1
+        || allowScriptsToCloseWindows)
         m_frame->scheduleClose();
 }
 
@@ -483,10 +723,7 @@ void DOMWindow::alert(const String& message)
     if (!m_frame)
         return;
 
-    Document* doc = m_frame->document();
-    ASSERT(doc);
-    if (doc)
-        doc->updateRendering();
+    m_frame->document()->updateStyleIfNeeded();
 
     Page* page = m_frame->page();
     if (!page)
@@ -500,10 +737,7 @@ bool DOMWindow::confirm(const String& message)
     if (!m_frame)
         return false;
 
-    Document* doc = m_frame->document();
-    ASSERT(doc);
-    if (doc)
-        doc->updateRendering();
+    m_frame->document()->updateStyleIfNeeded();
 
     Page* page = m_frame->page();
     if (!page)
@@ -517,10 +751,7 @@ String DOMWindow::prompt(const String& message, const String& defaultValue)
     if (!m_frame)
         return String();
 
-    Document* doc = m_frame->document();
-    ASSERT(doc);
-    if (doc)
-        doc->updateRendering();
+    m_frame->document()->updateStyleIfNeeded();
 
     Page* page = m_frame->page();
     if (!page)
@@ -628,10 +859,7 @@ int DOMWindow::scrollX() const
     if (!view)
         return 0;
 
-    Document* doc = m_frame->document();
-    ASSERT(doc);
-    if (doc)
-        doc->updateLayoutIgnorePendingStylesheets();
+    m_frame->document()->updateLayoutIgnorePendingStylesheets();
 
     return static_cast<int>(view->scrollX() / m_frame->pageZoomFactor());
 }
@@ -645,10 +873,7 @@ int DOMWindow::scrollY() const
     if (!view)
         return 0;
 
-    Document* doc = m_frame->document();
-    ASSERT(doc);
-    if (doc)
-        doc->updateLayoutIgnorePendingStylesheets();
+    m_frame->document()->updateLayoutIgnorePendingStylesheets();
 
     return static_cast<int>(view->scrollY() / m_frame->pageZoomFactor());
 }
@@ -760,9 +985,15 @@ DOMWindow* DOMWindow::top() const
 
 Document* DOMWindow::document() const
 {
+    // FIXME: This function shouldn't need a frame to work.
     if (!m_frame)
         return 0;
 
+    // The m_frame pointer is not zeroed out when the window is put into b/f cache, so it can hold an unrelated document/window pair.
+    // FIXME: We should always zero out the frame pointer on navigation to avoid accidentally accessing the new frame content.
+    if (m_frame->domWindow() != this)
+        return 0;
+
     ASSERT(m_frame->document());
     return m_frame->document();
 }
@@ -782,15 +1013,32 @@ PassRefPtr<CSSRuleList> DOMWindow::getMatchedCSSRules(Element* elt, const String
         return 0;
 
     Document* doc = m_frame->document();
-    ASSERT(doc);
-    if (!doc)
-        return 0;
 
     if (!pseudoElt.isEmpty())
         return doc->styleSelector()->pseudoStyleRulesForElement(elt, pseudoElt, authorOnly);
     return doc->styleSelector()->styleRulesForElement(elt, authorOnly);
 }
 
+PassRefPtr<WebKitPoint> DOMWindow::webkitConvertPointFromNodeToPage(Node* node, const WebKitPoint* p) const
+{
+    if (!node || !p)
+        return 0;
+        
+    FloatPoint pagePoint(p->x(), p->y());
+    pagePoint = node->convertToPage(pagePoint);
+    return WebKitPoint::create(pagePoint.x(), pagePoint.y());
+}
+
+PassRefPtr<WebKitPoint> DOMWindow::webkitConvertPointFromPageToNode(Node* node, const WebKitPoint* p) const
+{
+    if (!node || !p)
+        return 0;
+        
+    FloatPoint nodePoint(p->x(), p->y());
+    nodePoint = node->convertFromPage(nodePoint);
+    return WebKitPoint::create(nodePoint.x(), nodePoint.y());
+}
+
 double DOMWindow::devicePixelRatio() const
 {
     if (!m_frame)
@@ -810,9 +1058,6 @@ PassRefPtr<Database> DOMWindow::openDatabase(const String& name, const String& v
         return 0;
 
     Document* doc = m_frame->document();
-    ASSERT(doc);
-    if (!doc)
-        return 0;
 
     Settings* settings = m_frame->settings();
     if (!settings || !settings->databasesEnabled())
@@ -827,10 +1072,7 @@ void DOMWindow::scrollBy(int x, int y) const
     if (!m_frame)
         return;
 
-    Document* doc = m_frame->document();
-    ASSERT(doc);
-    if (doc)
-        doc->updateLayoutIgnorePendingStylesheets();
+    m_frame->document()->updateLayoutIgnorePendingStylesheets();
 
     FrameView* view = m_frame->view();
     if (!view)
@@ -844,10 +1086,7 @@ void DOMWindow::scrollTo(int x, int y) const
     if (!m_frame)
         return;
 
-    Document* doc = m_frame->document();
-    ASSERT(doc);
-    if (doc)
-        doc->updateLayoutIgnorePendingStylesheets();
+    m_frame->document()->updateLayoutIgnorePendingStylesheets();
 
     FrameView* view = m_frame->view();
     if (!view)
@@ -938,310 +1177,832 @@ void DOMWindow::resizeTo(float width, float height) const
     page->chrome()->setWindowRect(fr);
 }
 
-inline void DOMWindow::setInlineEventListenerForType(const AtomicString& eventType, PassRefPtr<EventListener> eventListener)
+int DOMWindow::setTimeout(ScheduledAction* action, int timeout)
 {
-    Document* document = this->document();
-    if (!document)
+    return DOMTimer::install(scriptExecutionContext(), action, timeout, true);
+}
+
+void DOMWindow::clearTimeout(int timeoutId)
+{
+    DOMTimer::removeById(scriptExecutionContext(), timeoutId);
+}
+
+int DOMWindow::setInterval(ScheduledAction* action, int timeout)
+{
+    return DOMTimer::install(scriptExecutionContext(), action, timeout, false);
+}
+
+void DOMWindow::clearInterval(int timeoutId)
+{
+    DOMTimer::removeById(scriptExecutionContext(), timeoutId);
+}
+
+void DOMWindow::handleEvent(Event* event, bool useCapture, RegisteredEventListenerVector* alternateListeners)
+{
+    RegisteredEventListenerVector& listeners = (alternateListeners ? *alternateListeners : m_eventListeners);
+    if (listeners.isEmpty())
         return;
-    document->setWindowInlineEventListenerForType(eventType, eventListener);
+
+    // If any HTML event listeners are registered on the window, dispatch them here.
+    RegisteredEventListenerVector listenersCopy = listeners;
+    size_t size = listenersCopy.size();
+    for (size_t i = 0; i < size; ++i) {
+        RegisteredEventListener& r = *listenersCopy[i];
+        if (r.eventType() == event->type() && r.useCapture() == useCapture && !r.removed())
+            r.listener()->handleEvent(event, true);
+    }
 }
 
-inline EventListener* DOMWindow::inlineEventListenerForType(const AtomicString& eventType) const
+void DOMWindow::addEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener, bool useCapture)
 {
-    Document* document = this->document();
-    if (!document)
-        return 0;
-    return document->windowInlineEventListenerForType(eventType);
+    // Remove existing identical listener set with identical arguments.
+    // The DOM 2 spec says that "duplicate instances are discarded" in this case.
+    removeEventListener(eventType, listener.get(), useCapture);
+    if (Document* document = this->document())
+        document->addListenerTypeIfNeeded(eventType);
+
+    RefPtr<RegisteredEventListener> registeredListener = RegisteredEventListener::create(eventType, listener, useCapture);
+    m_eventListeners.append(registeredListener);
+
+    if (eventType == eventNames().unloadEvent)
+        addPendingEventListener(pendingUnloadEventListenerMap(), this, registeredListener.get());
+    else if (eventType == eventNames().beforeunloadEvent && allowsPendingBeforeUnloadListeners(this))
+        addPendingEventListener(pendingBeforeUnloadEventListenerMap(), this, registeredListener.get());
+}
+
+void DOMWindow::removeEventListener(const AtomicString& eventType, EventListener* listener, bool useCapture)
+{
+    size_t size = m_eventListeners.size();
+    for (size_t i = 0; i < size; ++i) {
+        RegisteredEventListener& r = *m_eventListeners[i];
+        if (r.eventType() == eventType && r.listener() == listener && r.useCapture() == useCapture) {
+            if (eventType == eventNames().unloadEvent)
+                removePendingEventListener(pendingUnloadEventListenerMap(), this, &r);
+            else if (eventType == eventNames().beforeunloadEvent && allowsPendingBeforeUnloadListeners(this))
+                removePendingEventListener(pendingBeforeUnloadEventListenerMap(), this, &r);
+            r.setRemoved(true);
+            m_eventListeners.remove(i);
+            return;
+        }
+    }
+}
+
+bool DOMWindow::dispatchEvent(PassRefPtr<Event> e, ExceptionCode& ec)
+{
+    ASSERT(!eventDispatchForbidden());
+
+    RefPtr<Event> event = e;
+    if (!event || event->type().isEmpty()) {
+        ec = EventException::UNSPECIFIED_EVENT_TYPE_ERR;
+        return true;
+    }
+
+    RefPtr<DOMWindow> protect(this);
+
+    event->setTarget(this);
+    event->setCurrentTarget(this);
+
+    handleEvent(event.get(), true);
+    handleEvent(event.get(), false);
+
+    return !event->defaultPrevented();
+}
+
+void DOMWindow::dispatchEvent(const AtomicString& eventType, bool canBubble, bool cancelable)
+{
+    ASSERT(!eventDispatchForbidden());
+    ExceptionCode ec = 0;
+    dispatchEvent(Event::create(eventType, canBubble, cancelable), ec);
+}
+
+// This function accommodates the Firefox quirk of dispatching the load, unload and
+// beforeunload events on the window, but setting event.target to be the Document. 
+inline void DOMWindow::dispatchEventWithDocumentAsTarget(PassRefPtr<Event> e, RegisteredEventListenerVector* alternateEventListeners)
+{
+    ASSERT(!eventDispatchForbidden());
+
+    RefPtr<Event> event = e;
+    RefPtr<DOMWindow> protect(this);
+    RefPtr<Document> document = this->document();
+
+    event->setTarget(document);
+    event->setCurrentTarget(this);
+
+    handleEvent(event.get(), true, alternateEventListeners);
+    handleEvent(event.get(), false, alternateEventListeners);
+}
+
+void DOMWindow::dispatchLoadEvent()
+{
+    dispatchEventWithDocumentAsTarget(Event::create(eventNames().loadEvent, false, false));
+
+    // For load events, send a separate load event to the enclosing frame only.
+    // This is a DOM extension and is independent of bubbling/capturing rules of
+    // the DOM.
+    Element* ownerElement = document()->ownerElement();
+    if (ownerElement) {
+        RefPtr<Event> ownerEvent = Event::create(eventNames().loadEvent, false, false);
+        ownerEvent->setTarget(ownerElement);
+        ownerElement->dispatchGenericEvent(ownerEvent.release());
+    }
+}
+
+void DOMWindow::dispatchUnloadEvent(RegisteredEventListenerVector* alternateEventListeners)
+{
+    dispatchEventWithDocumentAsTarget(Event::create(eventNames().unloadEvent, false, false), alternateEventListeners);
+}
+
+PassRefPtr<BeforeUnloadEvent> DOMWindow::dispatchBeforeUnloadEvent(RegisteredEventListenerVector* alternateEventListeners)
+{
+    RefPtr<BeforeUnloadEvent> beforeUnloadEvent = BeforeUnloadEvent::create();
+    dispatchEventWithDocumentAsTarget(beforeUnloadEvent.get(), alternateEventListeners);
+    return beforeUnloadEvent.release();
+}
+
+void DOMWindow::removeAllEventListeners()
+{
+    size_t size = m_eventListeners.size();
+    for (size_t i = 0; i < size; ++i)
+        m_eventListeners[i]->setRemoved(true);
+    m_eventListeners.clear();
+
+    removePendingEventListeners(pendingUnloadEventListenerMap(), this);
+    removePendingEventListeners(pendingBeforeUnloadEventListenerMap(), this);
+}
+
+bool DOMWindow::hasEventListener(const AtomicString& eventType)
+{
+    size_t size = m_eventListeners.size();
+    for (size_t i = 0; i < size; ++i) {
+        if (m_eventListeners[i]->eventType() == eventType)
+            return true;
+    }
+    return false;
+}
+
+void DOMWindow::setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener> listener)
+{
+    clearAttributeEventListener(eventType);
+    if (listener)
+        addEventListener(eventType, listener, false);
+}
+
+void DOMWindow::clearAttributeEventListener(const AtomicString& eventType)
+{
+    size_t size = m_eventListeners.size();
+    for (size_t i = 0; i < size; ++i) {
+        RegisteredEventListener& r = *m_eventListeners[i];
+        if (r.eventType() == eventType && r.listener()->isAttribute()) {
+            if (eventType == eventNames().unloadEvent)
+                removePendingEventListener(pendingUnloadEventListenerMap(), this, &r);
+            else if (eventType == eventNames().beforeunloadEvent && allowsPendingBeforeUnloadListeners(this))
+                removePendingEventListener(pendingBeforeUnloadEventListenerMap(), this, &r);
+            r.setRemoved(true);
+            m_eventListeners.remove(i);
+            return;
+        }
+    }
+}
+
+EventListener* DOMWindow::getAttributeEventListener(const AtomicString& eventType) const
+{
+    size_t size = m_eventListeners.size();
+    for (size_t i = 0; i < size; ++i) {
+        RegisteredEventListener& r = *m_eventListeners[i];
+        if (r.eventType() == eventType && r.listener()->isAttribute())
+            return r.listener();
+    }
+    return 0;
 }
 
 EventListener* DOMWindow::onabort() const
 {
-    return inlineEventListenerForType(eventNames().abortEvent);
+    return getAttributeEventListener(eventNames().abortEvent);
 }
 
 void DOMWindow::setOnabort(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().abortEvent, eventListener);
+    setAttributeEventListener(eventNames().abortEvent, eventListener);
 }
 
 EventListener* DOMWindow::onblur() const
 {
-    return inlineEventListenerForType(eventNames().blurEvent);
+    return getAttributeEventListener(eventNames().blurEvent);
 }
 
 void DOMWindow::setOnblur(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().blurEvent, eventListener);
+    setAttributeEventListener(eventNames().blurEvent, eventListener);
 }
 
 EventListener* DOMWindow::onchange() const
 {
-    return inlineEventListenerForType(eventNames().changeEvent);
+    return getAttributeEventListener(eventNames().changeEvent);
 }
 
 void DOMWindow::setOnchange(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().changeEvent, eventListener);
+    setAttributeEventListener(eventNames().changeEvent, eventListener);
 }
 
 EventListener* DOMWindow::onclick() const
 {
-    return inlineEventListenerForType(eventNames().clickEvent);
+    return getAttributeEventListener(eventNames().clickEvent);
 }
 
 void DOMWindow::setOnclick(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().clickEvent, eventListener);
+    setAttributeEventListener(eventNames().clickEvent, eventListener);
 }
 
 EventListener* DOMWindow::ondblclick() const
 {
-    return inlineEventListenerForType(eventNames().dblclickEvent);
+    return getAttributeEventListener(eventNames().dblclickEvent);
 }
 
 void DOMWindow::setOndblclick(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().dblclickEvent, eventListener);
+    setAttributeEventListener(eventNames().dblclickEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondrag() const
+{
+    return getAttributeEventListener(eventNames().dragEvent);
+}
+
+void DOMWindow::setOndrag(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondragend() const
+{
+    return getAttributeEventListener(eventNames().dragendEvent);
+}
+
+void DOMWindow::setOndragend(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragendEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondragenter() const
+{
+    return getAttributeEventListener(eventNames().dragenterEvent);
+}
+
+void DOMWindow::setOndragenter(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragenterEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondragleave() const
+{
+    return getAttributeEventListener(eventNames().dragleaveEvent);
+}
+
+void DOMWindow::setOndragleave(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragleaveEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondragover() const
+{
+    return getAttributeEventListener(eventNames().dragoverEvent);
+}
+
+void DOMWindow::setOndragover(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragoverEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondragstart() const
+{
+    return getAttributeEventListener(eventNames().dragstartEvent);
+}
+
+void DOMWindow::setOndragstart(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dragstartEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondrop() const
+{
+    return getAttributeEventListener(eventNames().dropEvent);
+}
+
+void DOMWindow::setOndrop(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().dropEvent, eventListener);
 }
 
 EventListener* DOMWindow::onerror() const
 {
-    return inlineEventListenerForType(eventNames().errorEvent);
+    return getAttributeEventListener(eventNames().errorEvent);
 }
 
 void DOMWindow::setOnerror(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().errorEvent, eventListener);
+    setAttributeEventListener(eventNames().errorEvent, eventListener);
 }
 
 EventListener* DOMWindow::onfocus() const
 {
-    return inlineEventListenerForType(eventNames().focusEvent);
+    return getAttributeEventListener(eventNames().focusEvent);
 }
 
 void DOMWindow::setOnfocus(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().focusEvent, eventListener);
+    setAttributeEventListener(eventNames().focusEvent, eventListener);
 }
 
 EventListener* DOMWindow::onkeydown() const
 {
-    return inlineEventListenerForType(eventNames().keydownEvent);
+    return getAttributeEventListener(eventNames().keydownEvent);
 }
 
 void DOMWindow::setOnkeydown(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().keydownEvent, eventListener);
+    setAttributeEventListener(eventNames().keydownEvent, eventListener);
 }
 
 EventListener* DOMWindow::onkeypress() const
 {
-    return inlineEventListenerForType(eventNames().keypressEvent);
+    return getAttributeEventListener(eventNames().keypressEvent);
 }
 
 void DOMWindow::setOnkeypress(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().keypressEvent, eventListener);
+    setAttributeEventListener(eventNames().keypressEvent, eventListener);
 }
 
 EventListener* DOMWindow::onkeyup() const
 {
-    return inlineEventListenerForType(eventNames().keyupEvent);
+    return getAttributeEventListener(eventNames().keyupEvent);
 }
 
 void DOMWindow::setOnkeyup(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().keyupEvent, eventListener);
+    setAttributeEventListener(eventNames().keyupEvent, eventListener);
 }
 
 EventListener* DOMWindow::onload() const
 {
-    return inlineEventListenerForType(eventNames().loadEvent);
+    return getAttributeEventListener(eventNames().loadEvent);
 }
 
 void DOMWindow::setOnload(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().loadEvent, eventListener);
+    setAttributeEventListener(eventNames().loadEvent, eventListener);
 }
 
 EventListener* DOMWindow::onmousedown() const
 {
-    return inlineEventListenerForType(eventNames().mousedownEvent);
+    return getAttributeEventListener(eventNames().mousedownEvent);
 }
 
 void DOMWindow::setOnmousedown(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mousedownEvent, eventListener);
+    setAttributeEventListener(eventNames().mousedownEvent, eventListener);
 }
 
 EventListener* DOMWindow::onmousemove() const
 {
-    return inlineEventListenerForType(eventNames().mousemoveEvent);
+    return getAttributeEventListener(eventNames().mousemoveEvent);
 }
 
 void DOMWindow::setOnmousemove(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mousemoveEvent, eventListener);
+    setAttributeEventListener(eventNames().mousemoveEvent, eventListener);
 }
 
 EventListener* DOMWindow::onmouseout() const
 {
-    return inlineEventListenerForType(eventNames().mouseoutEvent);
+    return getAttributeEventListener(eventNames().mouseoutEvent);
 }
 
 void DOMWindow::setOnmouseout(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mouseoutEvent, eventListener);
+    setAttributeEventListener(eventNames().mouseoutEvent, eventListener);
 }
 
 EventListener* DOMWindow::onmouseover() const
 {
-    return inlineEventListenerForType(eventNames().mouseoverEvent);
+    return getAttributeEventListener(eventNames().mouseoverEvent);
 }
 
 void DOMWindow::setOnmouseover(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mouseoverEvent, eventListener);
+    setAttributeEventListener(eventNames().mouseoverEvent, eventListener);
 }
 
 EventListener* DOMWindow::onmouseup() const
 {
-    return inlineEventListenerForType(eventNames().mouseupEvent);
+    return getAttributeEventListener(eventNames().mouseupEvent);
 }
 
 void DOMWindow::setOnmouseup(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mouseupEvent, eventListener);
+    setAttributeEventListener(eventNames().mouseupEvent, eventListener);
 }
 
 EventListener* DOMWindow::onmousewheel() const
 {
-    return inlineEventListenerForType(eventNames().mousewheelEvent);
+    return getAttributeEventListener(eventNames().mousewheelEvent);
 }
 
 void DOMWindow::setOnmousewheel(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().mousewheelEvent, eventListener);
+    setAttributeEventListener(eventNames().mousewheelEvent, eventListener);
+}
+
+EventListener* DOMWindow::onoffline() const
+{
+    return getAttributeEventListener(eventNames().offlineEvent);
+}
+
+void DOMWindow::setOnoffline(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().offlineEvent, eventListener);
+}
+
+EventListener* DOMWindow::ononline() const
+{
+    return getAttributeEventListener(eventNames().onlineEvent);
+}
+
+void DOMWindow::setOnonline(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().onlineEvent, eventListener);
 }
 
 EventListener* DOMWindow::onreset() const
 {
-    return inlineEventListenerForType(eventNames().resetEvent);
+    return getAttributeEventListener(eventNames().resetEvent);
 }
 
 void DOMWindow::setOnreset(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().resetEvent, eventListener);
+    setAttributeEventListener(eventNames().resetEvent, eventListener);
 }
 
 EventListener* DOMWindow::onresize() const
 {
-    return inlineEventListenerForType(eventNames().resizeEvent);
+    return getAttributeEventListener(eventNames().resizeEvent);
 }
 
 void DOMWindow::setOnresize(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().resizeEvent, eventListener);
+    setAttributeEventListener(eventNames().resizeEvent, eventListener);
 }
 
 EventListener* DOMWindow::onscroll() const
 {
-    return inlineEventListenerForType(eventNames().scrollEvent);
+    return getAttributeEventListener(eventNames().scrollEvent);
 }
 
 void DOMWindow::setOnscroll(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().scrollEvent, eventListener);
+    setAttributeEventListener(eventNames().scrollEvent, eventListener);
 }
 
 EventListener* DOMWindow::onsearch() const
 {
-    return inlineEventListenerForType(eventNames().searchEvent);
+    return getAttributeEventListener(eventNames().searchEvent);
 }
 
 void DOMWindow::setOnsearch(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().searchEvent, eventListener);
+    setAttributeEventListener(eventNames().searchEvent, eventListener);
 }
 
 EventListener* DOMWindow::onselect() const
 {
-    return inlineEventListenerForType(eventNames().selectEvent);
+    return getAttributeEventListener(eventNames().selectEvent);
 }
 
 void DOMWindow::setOnselect(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().selectEvent, eventListener);
+    setAttributeEventListener(eventNames().selectEvent, eventListener);
+}
+
+EventListener* DOMWindow::onstorage() const
+{
+    return getAttributeEventListener(eventNames().storageEvent);
+}
+
+void DOMWindow::setOnstorage(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().storageEvent, eventListener);
 }
 
 EventListener* DOMWindow::onsubmit() const
 {
-    return inlineEventListenerForType(eventNames().submitEvent);
+    return getAttributeEventListener(eventNames().submitEvent);
 }
 
 void DOMWindow::setOnsubmit(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().submitEvent, eventListener);
+    setAttributeEventListener(eventNames().submitEvent, eventListener);
 }
 
 EventListener* DOMWindow::onunload() const
 {
-    return inlineEventListenerForType(eventNames().unloadEvent);
+    return getAttributeEventListener(eventNames().unloadEvent);
 }
 
 void DOMWindow::setOnunload(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().unloadEvent, eventListener);
+    setAttributeEventListener(eventNames().unloadEvent, eventListener);
 }
 
 EventListener* DOMWindow::onbeforeunload() const
 {
-    return inlineEventListenerForType(eventNames().beforeunloadEvent);
+    return getAttributeEventListener(eventNames().beforeunloadEvent);
 }
 
 void DOMWindow::setOnbeforeunload(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().beforeunloadEvent, eventListener);
+    setAttributeEventListener(eventNames().beforeunloadEvent, eventListener);
 }
 
 EventListener* DOMWindow::onwebkitanimationstart() const
 {
-    return inlineEventListenerForType(eventNames().webkitAnimationStartEvent);
+    return getAttributeEventListener(eventNames().webkitAnimationStartEvent);
 }
 
 void DOMWindow::setOnwebkitanimationstart(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().webkitAnimationStartEvent, eventListener);
+    setAttributeEventListener(eventNames().webkitAnimationStartEvent, eventListener);
 }
 
 EventListener* DOMWindow::onwebkitanimationiteration() const
 {
-    return inlineEventListenerForType(eventNames().webkitAnimationIterationEvent);
+    return getAttributeEventListener(eventNames().webkitAnimationIterationEvent);
 }
 
 void DOMWindow::setOnwebkitanimationiteration(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().webkitAnimationIterationEvent, eventListener);
+    setAttributeEventListener(eventNames().webkitAnimationIterationEvent, eventListener);
 }
 
 EventListener* DOMWindow::onwebkitanimationend() const
 {
-    return inlineEventListenerForType(eventNames().webkitAnimationEndEvent);
+    return getAttributeEventListener(eventNames().webkitAnimationEndEvent);
 }
 
 void DOMWindow::setOnwebkitanimationend(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().webkitAnimationEndEvent, eventListener);
+    setAttributeEventListener(eventNames().webkitAnimationEndEvent, eventListener);
 }
 
 EventListener* DOMWindow::onwebkittransitionend() const
 {
-    return inlineEventListenerForType(eventNames().webkitTransitionEndEvent);
+    return getAttributeEventListener(eventNames().webkitTransitionEndEvent);
 }
 
 void DOMWindow::setOnwebkittransitionend(PassRefPtr<EventListener> eventListener)
 {
-    setInlineEventListenerForType(eventNames().webkitTransitionEndEvent, eventListener);
+    setAttributeEventListener(eventNames().webkitTransitionEndEvent, eventListener);
+}
+
+EventListener* DOMWindow::oncanplay() const
+{
+    return getAttributeEventListener(eventNames().canplayEvent);
+}
+
+void DOMWindow::setOncanplay(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().canplayEvent, eventListener);
+}
+
+EventListener* DOMWindow::oncanplaythrough() const
+{
+    return getAttributeEventListener(eventNames().canplaythroughEvent);
+}
+
+void DOMWindow::setOncanplaythrough(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().canplaythroughEvent, eventListener);
+}
+
+EventListener* DOMWindow::ondurationchange() const
+{
+    return getAttributeEventListener(eventNames().durationchangeEvent);
+}
+
+void DOMWindow::setOndurationchange(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().durationchangeEvent, eventListener);
+}
+
+EventListener* DOMWindow::onemptied() const
+{
+    return getAttributeEventListener(eventNames().emptiedEvent);
+}
+
+void DOMWindow::setOnemptied(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().emptiedEvent, eventListener);
+}
+
+EventListener* DOMWindow::onended() const
+{
+    return getAttributeEventListener(eventNames().endedEvent);
+}
+
+void DOMWindow::setOnended(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().endedEvent, eventListener);
+}
+
+EventListener* DOMWindow::onloadeddata() const
+{
+    return getAttributeEventListener(eventNames().loadeddataEvent);
+}
+
+void DOMWindow::setOnloadeddata(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().loadeddataEvent, eventListener);
+}
+
+EventListener* DOMWindow::onloadedmetadata() const
+{
+    return getAttributeEventListener(eventNames().loadedmetadataEvent);
+}
+
+void DOMWindow::setOnloadedmetadata(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().loadedmetadataEvent, eventListener);
+}
+
+EventListener* DOMWindow::onpause() const
+{
+    return getAttributeEventListener(eventNames().pauseEvent);
+}
+
+void DOMWindow::setOnpause(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().pauseEvent, eventListener);
+}
+
+EventListener* DOMWindow::onplay() const
+{
+    return getAttributeEventListener(eventNames().playEvent);
+}
+
+void DOMWindow::setOnplay(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().playEvent, eventListener);
+}
+
+EventListener* DOMWindow::onplaying() const
+{
+    return getAttributeEventListener(eventNames().playingEvent);
+}
+
+void DOMWindow::setOnplaying(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().playingEvent, eventListener);
+}
+
+EventListener* DOMWindow::onratechange() const
+{
+    return getAttributeEventListener(eventNames().ratechangeEvent);
+}
+
+void DOMWindow::setOnratechange(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().ratechangeEvent, eventListener);
+}
+
+EventListener* DOMWindow::onseeked() const
+{
+    return getAttributeEventListener(eventNames().seekedEvent);
+}
+
+void DOMWindow::setOnseeked(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().seekedEvent, eventListener);
+}
+
+EventListener* DOMWindow::onseeking() const
+{
+    return getAttributeEventListener(eventNames().seekingEvent);
+}
+
+void DOMWindow::setOnseeking(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().seekingEvent, eventListener);
+}
+
+EventListener* DOMWindow::ontimeupdate() const
+{
+    return getAttributeEventListener(eventNames().timeupdateEvent);
+}
+
+void DOMWindow::setOntimeupdate(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().timeupdateEvent, eventListener);
+}
+
+EventListener* DOMWindow::onvolumechange() const
+{
+    return getAttributeEventListener(eventNames().volumechangeEvent);
+}
+
+void DOMWindow::setOnvolumechange(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().volumechangeEvent, eventListener);
+}
+
+EventListener* DOMWindow::onwaiting() const
+{
+    return getAttributeEventListener(eventNames().waitingEvent);
+}
+
+void DOMWindow::setOnwaiting(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().waitingEvent, eventListener);
+}
+
+EventListener* DOMWindow::onloadstart() const
+{
+    return getAttributeEventListener(eventNames().loadstartEvent);
+}
+
+void DOMWindow::setOnloadstart(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().loadstartEvent, eventListener);
+}
+
+EventListener* DOMWindow::onprogress() const
+{
+    return getAttributeEventListener(eventNames().progressEvent);
+}
+
+void DOMWindow::setOnprogress(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().progressEvent, eventListener);
+}
+
+EventListener* DOMWindow::onstalled() const
+{
+    return getAttributeEventListener(eventNames().stalledEvent);
+}
+
+void DOMWindow::setOnstalled(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().stalledEvent, eventListener);
+}
+
+EventListener* DOMWindow::onsuspend() const
+{
+    return getAttributeEventListener(eventNames().suspendEvent);
+}
+
+void DOMWindow::setOnsuspend(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().suspendEvent, eventListener);
+}
+
+EventListener* DOMWindow::oninput() const
+{
+    return getAttributeEventListener(eventNames().inputEvent);
+}
+
+void DOMWindow::setOninput(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().inputEvent, eventListener);
+}
+
+EventListener* DOMWindow::onmessage() const
+{
+    return getAttributeEventListener(eventNames().messageEvent);
+}
+
+void DOMWindow::setOnmessage(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().messageEvent, eventListener);
+}
+
+EventListener* DOMWindow::oncontextmenu() const
+{
+    return getAttributeEventListener(eventNames().contextmenuEvent);
+}
+
+void DOMWindow::setOncontextmenu(PassRefPtr<EventListener> eventListener)
+{
+    setAttributeEventListener(eventNames().contextmenuEvent, eventListener);
+}
+
+void DOMWindow::captureEvents()
+{
+    // Not implemented.
+}
+
+void DOMWindow::releaseEvents()
+{
+    // Not implemented.
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.h b/src/3rdparty/webkit/WebCore/page/DOMWindow.h
index e7fab18..eac936f 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.h
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,8 +26,10 @@
 #ifndef DOMWindow_h
 #define DOMWindow_h
 
+#include "EventTarget.h"
 #include "KURL.h"
 #include "PlatformString.h"
+#include "RegisteredEventListener.h"
 #include "SecurityOrigin.h"
 #include <wtf/Forward.h>
 #include <wtf/RefCounted.h>
@@ -36,6 +38,7 @@
 namespace WebCore {
 
     class BarInfo;
+    class BeforeUnloadEvent;
     class CSSRuleList;
     class CSSStyleDeclaration;
     class Console;
@@ -43,6 +46,7 @@ namespace WebCore {
     class Database;
     class Document;
     class Element;
+    class Event;
     class EventListener;
     class FloatRect;
     class Frame;
@@ -50,11 +54,13 @@ namespace WebCore {
     class Location;
     class MessagePort;
     class Navigator;
+    class Node;
     class PostMessageTimer;
+    class ScheduledAction;
     class Screen;
+    class WebKitPoint;
 
 #if ENABLE(DOM_STORAGE)
-    class SessionStorage;
     class Storage;
 #endif
 
@@ -64,12 +70,15 @@ namespace WebCore {
 
     typedef int ExceptionCode;
 
-    class DOMWindow : public RefCounted<DOMWindow> {
+    class DOMWindow : public RefCounted<DOMWindow>, public EventTarget {
     public:
         static PassRefPtr<DOMWindow> create(Frame* frame) { return adoptRef(new DOMWindow(frame)); }
         virtual ~DOMWindow();
 
-        Frame* frame() { return m_frame; }
+        virtual DOMWindow* toDOMWindow() { return this; }
+        virtual ScriptExecutionContext* scriptExecutionContext() const;
+
+        Frame* frame() const { return m_frame; }
         void disconnectFrame();
 
         void clear();
@@ -80,7 +89,17 @@ namespace WebCore {
         void setURL(const KURL& url) { m_url = url; }
         KURL url() const { return m_url; }
 
+        unsigned pendingUnloadEventListeners() const;
+
+        static bool dispatchAllPendingBeforeUnloadEvents();
+        static void dispatchAllPendingUnloadEvents();
+
         static void adjustWindowRect(const FloatRect& screen, FloatRect& window, const FloatRect& pendingChanges);
+        static void parseModalDialogFeatures(const String& featuresArg, HashMap<String, String>& map);
+
+        static bool allowPopUp(Frame* activeFrame);
+        static bool canShowModalDialog(const Frame*);
+        static bool canShowModalDialogNow(const Frame*);
 
         // DOM Level 0
         Screen* screen() const;
@@ -160,6 +179,9 @@ namespace WebCore {
         PassRefPtr<CSSRuleList> getMatchedCSSRules(Element*, const String& pseudoElt, bool authorOnly = true) const;
         double devicePixelRatio() const;
 
+        PassRefPtr<WebKitPoint> webkitConvertPointFromPageToNode(Node* node, const WebKitPoint* p) const;
+        PassRefPtr<WebKitPoint> webkitConvertPointFromNodeToPage(Node* node, const WebKitPoint* p) const;        
+
 #if ENABLE(DATABASE)
         // HTML 5 client-side database
         PassRefPtr<Database> openDatabase(const String& name, const String& version, const String& displayName, unsigned long estimatedSize, ExceptionCode&);
@@ -190,6 +212,34 @@ namespace WebCore {
         void resizeBy(float x, float y) const;
         void resizeTo(float width, float height) const;
 
+        // Timers
+        int setTimeout(ScheduledAction*, int timeout);
+        void clearTimeout(int timeoutId);
+        int setInterval(ScheduledAction*, int timeout);
+        void clearInterval(int timeoutId);
+
+        // Events
+        // EventTarget API
+        virtual void addEventListener(const AtomicString& eventType, PassRefPtr<EventListener>, bool useCapture);
+        virtual void removeEventListener(const AtomicString& eventType, EventListener*, bool useCapture);
+        virtual bool dispatchEvent(PassRefPtr<Event>, ExceptionCode&);
+
+        void handleEvent(Event*, bool useCapture, RegisteredEventListenerVector* = 0);
+
+        void dispatchEvent(const AtomicString& eventType, bool canBubble, bool cancelable);
+        void dispatchLoadEvent();
+        void dispatchUnloadEvent(RegisteredEventListenerVector* = 0);
+        PassRefPtr<BeforeUnloadEvent> dispatchBeforeUnloadEvent(RegisteredEventListenerVector* = 0);
+
+        // Used for legacy "onEvent" property APIs.
+        void setAttributeEventListener(const AtomicString& eventType, PassRefPtr<EventListener>);
+        void clearAttributeEventListener(const AtomicString& eventType);
+        EventListener* getAttributeEventListener(const AtomicString& eventType) const;
+
+        const RegisteredEventListenerVector& eventListeners() const { return m_eventListeners; }
+        bool hasEventListener(const AtomicString& eventType);
+        void removeAllEventListeners();
+
         EventListener* onabort() const;
         void setOnabort(PassRefPtr<EventListener>);
         EventListener* onblur() const;
@@ -200,6 +250,20 @@ namespace WebCore {
         void setOnclick(PassRefPtr<EventListener>);
         EventListener* ondblclick() const;
         void setOndblclick(PassRefPtr<EventListener>);
+        EventListener* ondrag() const;
+        void setOndrag(PassRefPtr<EventListener>);
+        EventListener* ondragend() const;
+        void setOndragend(PassRefPtr<EventListener>);
+        EventListener* ondragenter() const;
+        void setOndragenter(PassRefPtr<EventListener>);
+        EventListener* ondragleave() const;
+        void setOndragleave(PassRefPtr<EventListener>);
+        EventListener* ondragover() const;
+        void setOndragover(PassRefPtr<EventListener>);
+        EventListener* ondragstart() const;
+        void setOndragstart(PassRefPtr<EventListener>);
+        EventListener* ondrop() const;
+        void setOndrop(PassRefPtr<EventListener>);
         EventListener* onerror() const;
         void setOnerror(PassRefPtr<EventListener>);
         EventListener* onfocus() const;
@@ -224,6 +288,10 @@ namespace WebCore {
         void setOnmouseup(PassRefPtr<EventListener>);
         EventListener* onmousewheel() const;
         void setOnmousewheel(PassRefPtr<EventListener>);
+        EventListener* onoffline() const;
+        void setOnoffline(PassRefPtr<EventListener>);
+        EventListener* ononline() const;
+        void setOnonline(PassRefPtr<EventListener>);
         EventListener* onreset() const;
         void setOnreset(PassRefPtr<EventListener>);
         EventListener* onresize() const;
@@ -234,6 +302,8 @@ namespace WebCore {
         void setOnsearch(PassRefPtr<EventListener>);
         EventListener* onselect() const;
         void setOnselect(PassRefPtr<EventListener>);
+        EventListener* onstorage() const;
+        void setOnstorage(PassRefPtr<EventListener>);
         EventListener* onsubmit() const;
         void setOnsubmit(PassRefPtr<EventListener>);
         EventListener* onunload() const;
@@ -248,6 +318,55 @@ namespace WebCore {
         void setOnwebkitanimationend(PassRefPtr<EventListener>);
         EventListener* onwebkittransitionend() const;
         void setOnwebkittransitionend(PassRefPtr<EventListener>);
+        EventListener* oncanplay() const;
+        void setOncanplay(PassRefPtr<EventListener>);
+        EventListener* oncanplaythrough() const;
+        void setOncanplaythrough(PassRefPtr<EventListener>);
+        EventListener* ondurationchange() const;
+        void setOndurationchange(PassRefPtr<EventListener>);
+        EventListener* onemptied() const;
+        void setOnemptied(PassRefPtr<EventListener>);
+        EventListener* onended() const;
+        void setOnended(PassRefPtr<EventListener>);
+        EventListener* onloadeddata() const;
+        void setOnloadeddata(PassRefPtr<EventListener>);
+        EventListener* onloadedmetadata() const;
+        void setOnloadedmetadata(PassRefPtr<EventListener>);
+        EventListener* onpause() const;
+        void setOnpause(PassRefPtr<EventListener>);
+        EventListener* onplay() const;
+        void setOnplay(PassRefPtr<EventListener>);
+        EventListener* onplaying() const;
+        void setOnplaying(PassRefPtr<EventListener>);
+        EventListener* onratechange() const;
+        void setOnratechange(PassRefPtr<EventListener>);
+        EventListener* onseeked() const;
+        void setOnseeked(PassRefPtr<EventListener>);
+        EventListener* onseeking() const;
+        void setOnseeking(PassRefPtr<EventListener>);
+        EventListener* ontimeupdate() const;
+        void setOntimeupdate(PassRefPtr<EventListener>);
+        EventListener* onvolumechange() const;
+        void setOnvolumechange(PassRefPtr<EventListener>);
+        EventListener* onwaiting() const;
+        void setOnwaiting(PassRefPtr<EventListener>);
+        EventListener* onloadstart() const;
+        void setOnloadstart(PassRefPtr<EventListener>);
+        EventListener* onprogress() const;
+        void setOnprogress(PassRefPtr<EventListener>);
+        EventListener* onstalled() const;
+        void setOnstalled(PassRefPtr<EventListener>);
+        EventListener* onsuspend() const;
+        void setOnsuspend(PassRefPtr<EventListener>);
+        EventListener* oninput() const;
+        void setOninput(PassRefPtr<EventListener>);
+        EventListener* onmessage() const;
+        void setOnmessage(PassRefPtr<EventListener>);
+        EventListener* oncontextmenu() const;
+        void setOncontextmenu(PassRefPtr<EventListener>);
+
+        void captureEvents();
+        void releaseEvents();
 
         // These methods are used for GC marking. See JSDOMWindow::mark() in
         // JSDOMWindowCustom.cpp.
@@ -271,11 +390,16 @@ namespace WebCore {
         DOMApplicationCache* optionalApplicationCache() const { return m_applicationCache.get(); }
 #endif
 
+        using RefCounted<DOMWindow>::ref;
+        using RefCounted<DOMWindow>::deref;
+
     private:
         DOMWindow(Frame*);
 
-        void setInlineEventListenerForType(const AtomicString& eventType, PassRefPtr<EventListener>);
-        EventListener* inlineEventListenerForType(const AtomicString& eventType) const;
+        virtual void refEventTarget() { ref(); }
+        virtual void derefEventTarget() { deref(); }
+
+        void dispatchEventWithDocumentAsTarget(PassRefPtr<Event>, RegisteredEventListenerVector* = 0);
 
         RefPtr<SecurityOrigin> m_securityOrigin;
         KURL m_url;
@@ -300,8 +424,10 @@ namespace WebCore {
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
         mutable RefPtr<DOMApplicationCache> m_applicationCache;
 #endif
+
+        RegisteredEventListenerVector m_eventListeners;
     };
 
 } // namespace WebCore
 
-#endif
+#endif // DOMWindow_h
diff --git a/src/3rdparty/webkit/WebCore/page/DOMWindow.idl b/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
index 504b705..942facc 100644
--- a/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
+++ b/src/3rdparty/webkit/WebCore/page/DOMWindow.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -44,7 +44,7 @@ module window {
     ] DOMWindow {
         // DOM Level 0
         readonly attribute Screen screen;
-        readonly attribute [DoNotCheckDomainSecurity] History history;
+        readonly attribute [DoNotCheckDomainSecurity, JSCCustomGetter] History history;
         attribute [Replaceable] BarInfo locationbar;
         attribute [Replaceable] BarInfo menubar;
         attribute [Replaceable] BarInfo personalbar;
@@ -53,7 +53,11 @@ module window {
         attribute [Replaceable] BarInfo toolbar;
         attribute [Replaceable] Navigator navigator;
         attribute [Replaceable] Navigator clientInformation;
-        attribute [DoNotCheckDomainSecurity, CustomSetter] Location location;
+        attribute [DoNotCheckDomainSecurity, JSCCustom, V8CustomSetter, V8DisallowShadowing] Location location;
+
+        attribute [Replaceable, CustomGetter] Event event;
+
+        readonly attribute [Custom] Crypto crypto;
 
         DOMSelection getSelection();
 
@@ -66,6 +70,14 @@ module window {
         void print();
         void stop();
 
+        [Custom] DOMWindow open(in DOMString url,
+                                in DOMString name,
+                                in [Optional] DOMString options);
+
+        [Custom] DOMObject showModalDialog(in DOMString url, 
+                                           in [Optional] DOMObject dialogArgs,
+                                           in [Optional] DOMString featureArgs);
+
         void alert(in DOMString message);
         boolean confirm(in DOMString message);
         [ConvertNullStringTo=Null] DOMString prompt(in DOMString message,
@@ -110,19 +122,19 @@ module window {
 
         attribute DOMString status;
         attribute DOMString defaultStatus;
-#if defined(LANGUAGE_JAVASCRIPT)
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // This attribute is an alias of defaultStatus and is necessary for legacy uses.
         attribute DOMString defaultstatus;
 #endif
 
         // Self referential attributes
         attribute [Replaceable, DoNotCheckDomainSecurityOnGet] DOMWindow self;
-        readonly attribute [DoNotCheckDomainSecurity] DOMWindow window;
+        readonly attribute [DoNotCheckDomainSecurity, V8DisallowShadowing] DOMWindow window;
         attribute [Replaceable, DoNotCheckDomainSecurityOnGet] DOMWindow frames;
 
-        attribute [Replaceable, DoNotCheckDomainSecurityOnGet] DOMWindow opener;
-        attribute [Replaceable, DoNotCheckDomainSecurity] DOMWindow parent;
-        attribute [Replaceable, DoNotCheckDomainSecurity] DOMWindow top;
+        attribute [Replaceable, DoNotCheckDomainSecurityOnGet, V8CustomSetter] DOMWindow opener;
+        attribute [Replaceable, DoNotCheckDomainSecurityOnGet] DOMWindow parent;
+        attribute [Replaceable, DoNotCheckDomainSecurityOnGet, V8DisallowShadowing, V8ReadOnly] DOMWindow top;
 
         // DOM Level 2 AbstractView Interface
         readonly attribute Document document;
@@ -136,15 +148,18 @@ module window {
                                        in DOMString pseudoElement,
                                        in [Optional] boolean authorOnly);
         attribute [Replaceable] double devicePixelRatio;
+        
+        WebKitPoint webkitConvertPointFromPageToNode(in Node node, in WebKitPoint p);
+        WebKitPoint webkitConvertPointFromNodeToPage(in Node node, in WebKitPoint p);
 
-#if ENABLE_OFFLINE_WEB_APPLICATIONS
+#if defined(ENABLE_OFFLINE_WEB_APPLICATIONS) && ENABLE_OFFLINE_WEB_APPLICATIONS
         readonly attribute DOMApplicationCache applicationCache;
 #endif    
-#if ENABLE_DATABASE
+#if defined(ENABLE_DATABASE) && ENABLE_DATABASE
         Database openDatabase(in DOMString name, in DOMString version, in DOMString displayName, in unsigned long estimatedSize)
             raises(DOMException);
 #endif
-#if ENABLE_DOM_STORAGE
+#if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
         readonly attribute Storage sessionStorage;
         readonly attribute Storage localStorage;
 #endif
@@ -157,12 +172,13 @@ module window {
 
         // Timers
         [Custom] long setTimeout(in TimeoutHandler handler, in long timeout);
+        // [Custom] long setTimeout(in TimeoutHandler handler, in long timeout, arguments...);
         // [Custom] long setTimeout(in DOMString code, in long timeout);
-        [Custom] void clearTimeout(in long handle);
-
+        void clearTimeout(in long handle);
         [Custom] long setInterval(in TimeoutHandler handler, in long timeout);
+        // [Custom] long setInterval(in TimeoutHandler handler, in long timeout, arguments...);
         // [Custom] long setInterval(in DOMString code, in long timeout);
-        [Custom] void clearInterval(in long handle);
+        void clearInterval(in long handle);
 
         // Base64
         [Custom] DOMString atob(in DOMString string)
@@ -171,46 +187,98 @@ module window {
             raises(DOMException);
 
         // Events
-        attribute [ProtectedListener] EventListener onabort;
-        attribute [ProtectedListener] EventListener onblur;
-        attribute [ProtectedListener] EventListener onchange;
-        attribute [ProtectedListener] EventListener onclick;
-        attribute [ProtectedListener] EventListener ondblclick;
-        attribute [ProtectedListener] EventListener onerror;
-        attribute [ProtectedListener] EventListener onfocus;
-        attribute [ProtectedListener] EventListener onkeydown;
-        attribute [ProtectedListener] EventListener onkeypress;
-        attribute [ProtectedListener] EventListener onkeyup;
-        attribute [ProtectedListener] EventListener onload;
-        attribute [ProtectedListener] EventListener onmousedown;
-        attribute [ProtectedListener] EventListener onmousemove;
-        attribute [ProtectedListener] EventListener onmouseout;
-        attribute [ProtectedListener] EventListener onmouseover;
-        attribute [ProtectedListener] EventListener onmouseup;
-        attribute [ProtectedListener] EventListener onmousewheel;
-        attribute [ProtectedListener] EventListener onreset;
-        attribute [ProtectedListener] EventListener onresize;
-        attribute [ProtectedListener] EventListener onscroll;
-        attribute [ProtectedListener] EventListener onsearch;
-        attribute [ProtectedListener] EventListener onselect;
-        attribute [ProtectedListener] EventListener onsubmit;
-        attribute [ProtectedListener] EventListener onunload;
-        attribute [ProtectedListener] EventListener onbeforeunload;
-        attribute [ProtectedListener] EventListener onwebkitanimationstart;
-        attribute [ProtectedListener] EventListener onwebkitanimationiteration;
-        attribute [ProtectedListener] EventListener onwebkitanimationend;
-        attribute [ProtectedListener] EventListener onwebkittransitionend;
+        attribute EventListener onabort;
+        attribute EventListener onbeforeunload;
+        attribute EventListener onblur;
+        attribute EventListener oncanplay;
+        attribute EventListener oncanplaythrough;
+        attribute EventListener onchange;
+        attribute EventListener onclick;
+        attribute EventListener oncontextmenu;
+        attribute EventListener ondblclick;
+        attribute EventListener ondrag;
+        attribute EventListener ondragend;
+        attribute EventListener ondragenter;
+        attribute EventListener ondragleave;
+        attribute EventListener ondragover;
+        attribute EventListener ondragstart;
+        attribute EventListener ondrop;
+        attribute EventListener ondurationchange;
+        attribute EventListener onemptied;
+        attribute EventListener onended;
+        attribute EventListener onerror;
+        attribute EventListener onfocus;
+        attribute EventListener oninput;
+        attribute EventListener onkeydown;
+        attribute EventListener onkeypress;
+        attribute EventListener onkeyup;
+        attribute EventListener onload;
+        attribute EventListener onloadeddata;
+        attribute EventListener onloadedmetadata;
+        attribute EventListener onloadstart;
+        attribute EventListener onmessage;
+        attribute EventListener onmousedown;
+        attribute EventListener onmousemove;
+        attribute EventListener onmouseout;
+        attribute EventListener onmouseover;
+        attribute EventListener onmouseup;
+        attribute EventListener onmousewheel;
+        attribute EventListener onoffline;
+        attribute EventListener ononline;
+        attribute EventListener onpause;
+        attribute EventListener onplay;
+        attribute EventListener onplaying;
+        attribute EventListener onprogress;
+        attribute EventListener onratechange;
+        attribute EventListener onresize;
+        attribute EventListener onscroll;
+        attribute EventListener onseeked;
+        attribute EventListener onseeking;
+        attribute EventListener onselect;
+        attribute EventListener onstalled;
+        attribute EventListener onstorage;
+        attribute EventListener onsubmit;
+        attribute EventListener onsuspend;
+        attribute EventListener ontimeupdate;
+        attribute EventListener onunload;
+        attribute EventListener onvolumechange;
+        attribute EventListener onwaiting;
+
+        // Not implemented yet.
+        // attribute EventListener onafterprint;
+        // attribute EventListener onbeforeprint;
+        // attribute EventListener onformchange;
+        // attribute EventListener onforminput;
+        // attribute EventListener onhashchange;
+        // attribute EventListener oninvalid;
+        // attribute EventListener onpopstate;
+        // attribute EventListener onreadystatechange;
+        // attribute EventListener onredo;
+        // attribute EventListener onshow;
+        // attribute EventListener onundo;
+
+        // Webkit extensions
+        attribute EventListener onreset;
+        attribute EventListener onsearch;
+        attribute EventListener onwebkitanimationend;
+        attribute EventListener onwebkitanimationiteration;
+        attribute EventListener onwebkitanimationstart;
+        attribute EventListener onwebkittransitionend;
 
         // EventTarget interface
-        [Custom] void addEventListener(in DOMString type, 
-                                      in EventListener listener, 
+        [Custom] void addEventListener(in DOMString type,
+                                      in EventListener listener,
                                       in boolean useCapture);
-        [Custom] void removeEventListener(in DOMString type, 
-                                          in EventListener listener, 
+        [Custom] void removeEventListener(in DOMString type,
+                                          in EventListener listener,
                                           in boolean useCapture);
-        // FIXME: Implement dispatchEvent
+        boolean dispatchEvent(in Event evt)
+            raises(EventException);
 
-#if defined(LANGUAGE_JAVASCRIPT)
+        [V8Custom=DOMWindowNOP] void captureEvents(/*in long eventFlags*/);
+        [V8Custom=DOMWindowNOP] void releaseEvents(/*in long eventFlags*/);
+
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         // Global constructors
         attribute StyleSheetConstructor StyleSheet;
         attribute CSSStyleSheetConstructor CSSStyleSheet;
@@ -240,7 +308,7 @@ module window {
 
         // FIXME: Implement the commented-out global constructors for interfaces listed in DOM Level 3 Core specification.
         attribute DOMCoreExceptionConstructor DOMException;
-        attribute DOMStringListConstructor DOMStringList;
+//        attribute DOMStringListConstructor DOMStringList;
 //        attribute NameListConstructor NameList;
 //        attribute DOMImplementationListConstructor DOMImplementationList;
 //        attribute DOMImplementationSourceConstructor DOMImplementationSource;
@@ -281,6 +349,8 @@ module window {
         attribute HTMLBodyElementConstructor HTMLBodyElement;
         attribute HTMLButtonElementConstructor HTMLButtonElement;
         attribute HTMLCanvasElementConstructor HTMLCanvasElement;
+        attribute HTMLDataGridElementConstructor HTMLDataGridElement;
+        attribute HTMLDataGridColElementConstructor HTMLDataGridColElement;
         attribute HTMLDListElementConstructor HTMLDListElement;
         attribute HTMLDirectoryElementConstructor HTMLDirectoryElement;
         attribute HTMLDivElementConstructor HTMLDivElement;
@@ -330,6 +400,9 @@ module window {
 
         attribute HTMLCollectionConstructor HTMLCollection;
 
+        attribute [CustomGetter] HTMLImageElementConstructor Image; // Usable with new operator
+        attribute [CustomGetter] HTMLOptionElementConstructor Option; // Usable with new operator
+
         attribute CanvasRenderingContext2DConstructor CanvasRenderingContext2D;
         attribute TextMetricsConstructor TextMetrics;
 
@@ -350,9 +423,9 @@ module window {
         attribute WebKitCSSKeyframeRuleConstructor WebKitCSSKeyframeRule;
         attribute WebKitCSSKeyframesRuleConstructor WebKitCSSKeyframesRule;
 
-#if ENABLE_CHANNEL_MESSAGING
-        attribute MessagePortConstructor MessagePort;
-#endif
+        attribute [JSCCustomGetter] WebKitCSSMatrixConstructor WebKitCSSMatrix; // Usable with the new operator
+
+        attribute [JSCCustomGetter] WebKitPointConstructor WebKitPoint; // Usable with new the operator
 
         attribute ClipboardConstructor Clipboard;
 
@@ -370,32 +443,50 @@ module window {
         attribute DOMParserConstructor DOMParser;
         attribute XMLSerializerConstructor XMLSerializer;
 
+        attribute [JSCCustomGetter] XMLHttpRequestConstructor XMLHttpRequest; // Usable with the new operator
         attribute XMLHttpRequestUploadConstructor XMLHttpRequestUpload;
         attribute XMLHttpRequestExceptionConstructor XMLHttpRequestException;
 
+#if defined(ENABLE_XSLT) && ENABLE_XSLT
+        attribute [JSCCustomGetter] XSLTProcessorConstructor XSLTProcessor; // Usable with the new operator
+#endif
+
+#if defined(ENABLE_CHANNEL_MESSAGING) && ENABLE_CHANNEL_MESSAGING
+        attribute MessagePortConstructor MessagePort;
+        attribute [JSCCustomGetter] MessageChannelConstructor MessageChannel; // Usable with the new operator
+#endif
+
+#if defined(ENABLE_WORKERS) && ENABLE_WORKERS
+        attribute [JSCCustomGetter] WorkerConstructor Worker; // Usable with the new operator
+#endif
+
         attribute PluginConstructor Plugin;
         attribute PluginArrayConstructor PluginArray;
 
         attribute MimeTypeConstructor MimeType;
         attribute MimeTypeArrayConstructor MimeTypeArray;
 
-#if ENABLE_DOM_STORAGE
+        attribute ClientRectConstructor ClientRect;
+        attribute ClientRectListConstructor ClientRectList;
+
+#if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
         attribute StorageConstructor Storage;
         attribute StorageEventConstructor StorageEvent;
 #endif
 
+        attribute [CustomGetter,Conditional=VIDEO] HTMLAudioElementConstructor Audio; // Usable with the new operator
         attribute [Conditional=VIDEO] HTMLAudioElementConstructor HTMLAudioElement;
         attribute [Conditional=VIDEO] HTMLMediaElementConstructor HTMLMediaElement;
         attribute [Conditional=VIDEO] HTMLVideoElementConstructor HTMLVideoElement;
         attribute [Conditional=VIDEO] MediaErrorConstructor MediaError;
 
-#if ENABLE_XPATH
+#if defined(ENABLE_XPATH) && ENABLE_XPATH
         attribute XPathEvaluatorConstructor XPathEvaluator;
         attribute XPathResultConstructor XPathResult;
         attribute XPathExceptionConstructor XPathException;
 #endif
 
-#if ENABLE_SVG
+#if defined(ENABLE_SVG) && ENABLE_SVG
         attribute SVGAngleConstructor SVGAngle;
         attribute SVGColorConstructor SVGColor;
 //      attribute SVGCSSRuleConstructor SVGCSSRule;
@@ -412,9 +503,8 @@ module window {
         attribute SVGTransformConstructor SVGTransform;
         attribute SVGUnitTypesConstructor SVGUnitTypes;
 //      attribute SVGZoomAndPanConstructor SVGZoomAndPan;
-#endif
 
-#if ENABLE_SVG_FILTERS
+#if defined(ENABLE_FILTERS) && ENABLE_FILTERS
         attribute SVGComponentTransferFunctionElementConstructor SVGComponentTransferFunctionElement;
         attribute SVGFEBlendElementConstructor SVGFEBlendElement;
         attribute SVGFEColorMatrixElementConstructor SVGFEColorMatrixElement;
@@ -424,8 +514,14 @@ module window {
 //      attribute SVGFEMorphologyElementConstructor SVGFEMorphologyElement;
         attribute SVGFETurbulenceElementConstructor SVGFETurbulenceElement;
 #endif
+#endif
 
 #endif // defined(LANGUAGE_JAVASCRIPT)
+
+#if defined(V8_BINDING) && V8_BINDING
+        // window.toString() requires special handling in V8
+        [V8DoNotCheckSignature, DoNotCheckDomainSecurity, Custom, DontEnum] DOMString toString();
+#endif // defined(V8_BINDING)
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/page/DragController.cpp b/src/3rdparty/webkit/WebCore/page/DragController.cpp
index 8490f2d..2fe5d97 100644
--- a/src/3rdparty/webkit/WebCore/page/DragController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/DragController.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -57,10 +57,10 @@
 #include "ResourceRequest.h"
 #include "SelectionController.h"
 #include "Settings.h"
-#include "SystemTime.h"
 #include "Text.h"
 #include "htmlediting.h"
 #include "markup.h"
+#include <wtf/CurrentTime.h>
 #include <wtf/RefPtr.h>
 
 namespace WebCore {
@@ -76,13 +76,13 @@ static PlatformMouseEvent createMouseEvent(DragData* dragData)
 DragController::DragController(Page* page, DragClient* client)
     : m_page(page)
     , m_client(client)
-    , m_document(0)
+    , m_documentUnderMouse(0)
     , m_dragInitiator(0)
     , m_dragDestinationAction(DragDestinationActionNone)
     , m_dragSourceAction(DragSourceActionNone)
     , m_didInitiateDrag(false)
     , m_isHandlingDrag(false)
-    , m_dragOperation(DragOperationNone)
+    , m_sourceDragOperation(DragOperationNone)
 {
 }
     
@@ -107,9 +107,9 @@ static PassRefPtr<DocumentFragment> documentFragmentFromDragData(DragData* dragD
             String title;
             String url = dragData->asURL(&title);
             if (!url.isEmpty()) {
-                ExceptionCode ec;
-                RefPtr<HTMLAnchorElement> anchor = static_cast<HTMLAnchorElement*>(document->createElement("a", ec).get());
+                RefPtr<HTMLAnchorElement> anchor = new HTMLAnchorElement(document);
                 anchor->setHref(url);
+                ExceptionCode ec;
                 RefPtr<Node> anchorText = document->createTextNode(title);
                 anchor->appendChild(anchorText, ec);
                 RefPtr<DocumentFragment> fragment = document->createDocumentFragment();
@@ -126,13 +126,12 @@ static PassRefPtr<DocumentFragment> documentFragmentFromDragData(DragData* dragD
     return 0;
 }
 
-bool DragController::dragIsMove(SelectionController* selection, DragData* dragData) 
+bool DragController::dragIsMove(SelectionController* selection)
 {
-    return m_document == m_dragInitiator
-        && selection->isContentEditable()
-        && !isCopyKeyDown();
+    return m_documentUnderMouse == m_dragInitiator && selection->isContentEditable() && !isCopyKeyDown();
 }
 
+// FIXME: This method is poorly named.  We're just clearing the selection from the document this drag is exiting.
 void DragController::cancelDrag()
 {
     m_page->dragCaretController()->clear();
@@ -156,16 +155,15 @@ void DragController::dragExited(DragData* dragData)
     Frame* mainFrame = m_page->mainFrame();
     
     if (RefPtr<FrameView> v = mainFrame->view()) {
-        ClipboardAccessPolicy policy = mainFrame->loader()->baseURL().isLocalFile() ? ClipboardReadable : ClipboardTypesReadable;
+        ClipboardAccessPolicy policy = (!m_documentUnderMouse || m_documentUnderMouse->securityOrigin()->isLocal()) ? ClipboardReadable : ClipboardTypesReadable;
         RefPtr<Clipboard> clipboard = dragData->createClipboard(policy);
         clipboard->setSourceOperation(dragData->draggingSourceOperationMask());
         mainFrame->eventHandler()->cancelDragAndDrop(createMouseEvent(dragData), clipboard.get());
         clipboard->setAccessPolicy(ClipboardNumb);    // invalidate clipboard here for security
     }
-
-    cancelDrag();
-    m_document = 0;
+    mouseMovedIntoDocument(0);
 }
+
     
 DragOperation DragController::dragUpdated(DragData* dragData) 
 {
@@ -175,7 +173,7 @@ DragOperation DragController::dragUpdated(DragData* dragData)
 bool DragController::performDrag(DragData* dragData)
 {   
     ASSERT(dragData);
-    m_document = m_page->mainFrame()->documentAtPoint(dragData->clientPosition());
+    m_documentUnderMouse = m_page->mainFrame()->documentAtPoint(dragData->clientPosition());
     if (m_isHandlingDrag) {
         ASSERT(m_dragDestinationAction & DragDestinationActionDHTML);
         m_client->willPerformDragDestinationAction(DragDestinationActionDHTML, dragData);
@@ -187,51 +185,52 @@ bool DragController::performDrag(DragData* dragData)
             mainFrame->eventHandler()->performDragAndDrop(createMouseEvent(dragData), clipboard.get());
             clipboard->setAccessPolicy(ClipboardNumb);    // invalidate clipboard here for security
         }
-        m_document = 0;
+        m_documentUnderMouse = 0;
         return true;
     } 
     
-    if ((m_dragDestinationAction & DragDestinationActionEdit) && concludeDrag(dragData, m_dragDestinationAction)) {
-        m_document = 0;
+    if ((m_dragDestinationAction & DragDestinationActionEdit) && concludeEditDrag(dragData)) {
+        m_documentUnderMouse = 0;
         return true;
     }
     
-    m_document = 0;
+    m_documentUnderMouse = 0;
 
     if (operationForLoad(dragData) == DragOperationNone)
         return false;
 
     m_client->willPerformDragDestinationAction(DragDestinationActionLoad, dragData);
-    m_page->mainFrame()->loader()->load(ResourceRequest(dragData->asURL()));
+    m_page->mainFrame()->loader()->load(ResourceRequest(dragData->asURL()), false);
     return true;
 }
-    
+
+void DragController::mouseMovedIntoDocument(Document* newDocument)
+{
+    if (m_documentUnderMouse == newDocument)
+        return;
+
+    // If we were over another document clear the selection
+    if (m_documentUnderMouse)
+        cancelDrag();
+    m_documentUnderMouse = newDocument;
+}
+
 DragOperation DragController::dragEnteredOrUpdated(DragData* dragData)
 {
     ASSERT(dragData);
-    IntPoint windowPoint = dragData->clientPosition();
-    
-    Document* newDraggingDoc = 0;
-    if (Frame* frame = m_page->mainFrame())
-        newDraggingDoc = frame->documentAtPoint(windowPoint);
-    if (m_document != newDraggingDoc) {
-        if (m_document)
-            cancelDrag();
-        m_document = newDraggingDoc;
-    }
-    
+    ASSERT(m_page->mainFrame()); // It is not possible in Mac WebKit to have a Page without a mainFrame()
+    mouseMovedIntoDocument(m_page->mainFrame()->documentAtPoint(dragData->clientPosition()));
+
     m_dragDestinationAction = m_client->actionMaskForDrag(dragData);
-    
-    DragOperation operation = DragOperationNone;
-    
-    if (m_dragDestinationAction == DragDestinationActionNone)
-        cancelDrag();
-    else {
-        operation = tryDocumentDrag(dragData, m_dragDestinationAction);
-        if (operation == DragOperationNone && (m_dragDestinationAction & DragDestinationActionLoad))
-            return operationForLoad(dragData);
+    if (m_dragDestinationAction == DragDestinationActionNone) {
+        cancelDrag(); // FIXME: Why not call mouseMovedIntoDocument(0)?
+        return DragOperationNone;
     }
-    
+
+    DragOperation operation = DragOperationNone;
+    bool handledByDocument = tryDocumentDrag(dragData, m_dragDestinationAction, operation);
+    if (!handledByDocument && (m_dragDestinationAction & DragDestinationActionLoad))
+        return operationForLoad(dragData);
     return operation;
 }
 
@@ -255,44 +254,56 @@ static HTMLInputElement* asFileInput(Node* node)
     return 0;
 }
     
-DragOperation DragController::tryDocumentDrag(DragData* dragData, DragDestinationAction actionMask)
+bool DragController::tryDocumentDrag(DragData* dragData, DragDestinationAction actionMask, DragOperation& operation)
 {
     ASSERT(dragData);
     
-    if (!m_document)
-        return DragOperationNone;
+    if (!m_documentUnderMouse)
+        return false;
     
-    DragOperation operation = DragOperationNone;
-    if (actionMask & DragDestinationActionDHTML)
-        operation = tryDHTMLDrag(dragData);
-    m_isHandlingDrag = operation != DragOperationNone; 
+    m_isHandlingDrag = false;
+    if (actionMask & DragDestinationActionDHTML) {
+        m_isHandlingDrag = tryDHTMLDrag(dragData, operation);
+        // Do not continue if m_documentUnderMouse has been reset by tryDHTMLDrag.
+        // tryDHTMLDrag fires dragenter event. The event listener that listens
+        // to this event may create a nested message loop (open a modal dialog),
+        // which could process dragleave event and reset m_documentUnderMouse in
+        // dragExited.
+        if (!m_documentUnderMouse)
+            return false;
+    }
 
-    RefPtr<FrameView> frameView = m_document->view();
+    // It's unclear why this check is after tryDHTMLDrag.
+    // We send drag events in tryDHTMLDrag and that may be the reason.
+    RefPtr<FrameView> frameView = m_documentUnderMouse->view();
     if (!frameView)
-        return operation;
-    
+        return false;
+
+    if (m_isHandlingDrag) {
+        m_page->dragCaretController()->clear();
+        return true;
+    }
+
     if ((actionMask & DragDestinationActionEdit) && !m_isHandlingDrag && canProcessDrag(dragData)) {
-        if (dragData->containsColor()) 
-            return DragOperationGeneric;
+        if (dragData->containsColor()) {
+            operation = DragOperationGeneric;
+            return true;
+        }
         
         IntPoint dragPos = dragData->clientPosition();
         IntPoint point = frameView->windowToContents(dragPos);
-        Element* element = m_document->elementFromPoint(point.x(), point.y());
+        Element* element = m_documentUnderMouse->elementFromPoint(point.x(), point.y());
         ASSERT(element);
-        Frame* innerFrame = element->document()->frame();
-        ASSERT(innerFrame);
         if (!asFileInput(element)) {
-            Selection dragCaret;
-            if (Frame* frame = m_document->frame())
-                dragCaret = frame->visiblePositionForPoint(point);
+            VisibleSelection dragCaret = m_documentUnderMouse->frame()->visiblePositionForPoint(point);
             m_page->dragCaretController()->setSelection(dragCaret);
         }
-        
-        return dragIsMove(innerFrame->selection(), dragData) ? DragOperationMove : DragOperationCopy;
-    } 
-    
-    m_page->dragCaretController()->clear();
-    return operation;
+
+        Frame* innerFrame = element->document()->frame();
+        operation = dragIsMove(innerFrame->selection()) ? DragOperationMove : DragOperationCopy;
+        return true;
+    }
+    return false;
 }
 
 DragSourceAction DragController::delegateDragSourceAction(const IntPoint& windowPoint)
@@ -304,35 +315,33 @@ DragSourceAction DragController::delegateDragSourceAction(const IntPoint& window
 DragOperation DragController::operationForLoad(DragData* dragData)
 {
     ASSERT(dragData);
-    Document* doc = 0;
-    doc = m_page->mainFrame()->documentAtPoint(dragData->clientPosition());
+    Document* doc = m_page->mainFrame()->documentAtPoint(dragData->clientPosition());
     if (doc && (m_didInitiateDrag || doc->isPluginDocument() || (doc->frame() && doc->frame()->editor()->clientIsEditable())))
         return DragOperationNone;
     return dragOperation(dragData);
 }
 
-static bool setSelectionToDragCaret(Frame* frame, Selection& dragCaret, RefPtr<Range>& range, const IntPoint& point)
+static bool setSelectionToDragCaret(Frame* frame, VisibleSelection& dragCaret, RefPtr<Range>& range, const IntPoint& point)
 {
     frame->selection()->setSelection(dragCaret);
     if (frame->selection()->isNone()) {
         dragCaret = frame->visiblePositionForPoint(point);
         frame->selection()->setSelection(dragCaret);
-        range = dragCaret.toRange();
+        range = dragCaret.toNormalizedRange();
     }
     return !frame->selection()->isNone() && frame->selection()->isContentEditable();
 }
 
-bool DragController::concludeDrag(DragData* dragData, DragDestinationAction actionMask)
+bool DragController::concludeEditDrag(DragData* dragData)
 {
     ASSERT(dragData);
     ASSERT(!m_isHandlingDrag);
-    ASSERT(actionMask & DragDestinationActionEdit);
     
-    if (!m_document)
+    if (!m_documentUnderMouse)
         return false;
     
-    IntPoint point = m_document->view()->windowToContents(dragData->clientPosition());
-    Element* element =  m_document->elementFromPoint(point.x(), point.y());
+    IntPoint point = m_documentUnderMouse->view()->windowToContents(dragData->clientPosition());
+    Element* element =  m_documentUnderMouse->elementFromPoint(point.x(), point.y());
     ASSERT(element);
     Frame* innerFrame = element->ownerDocument()->frame();
     ASSERT(innerFrame);    
@@ -343,8 +352,8 @@ bool DragController::concludeDrag(DragData* dragData, DragDestinationAction acti
             return false;
         if (!innerFrame)
             return false;
-        RefPtr<Range> innerRange = innerFrame->selection()->toRange();
-        RefPtr<CSSStyleDeclaration> style = m_document->createCSSStyleDeclaration();
+        RefPtr<Range> innerRange = innerFrame->selection()->toNormalizedRange();
+        RefPtr<CSSStyleDeclaration> style = m_documentUnderMouse->createCSSStyleDeclaration();
         ExceptionCode ec;
         style->setProperty("color", color.name(), ec);
         if (!innerFrame->editor()->shouldApplyStyle(style.get(), innerRange.get()))
@@ -360,8 +369,7 @@ bool DragController::concludeDrag(DragData* dragData, DragDestinationAction acti
     }
     
     if (HTMLInputElement* fileInput = asFileInput(element)) {
-        
-        if (!fileInput->isEnabled())
+        if (!fileInput->isEnabledFormControl())
             return false;
         
         if (!dragData->containsFiles())
@@ -384,9 +392,9 @@ bool DragController::concludeDrag(DragData* dragData, DragDestinationAction acti
         return true;
     }
 
-    Selection dragCaret(m_page->dragCaretController()->selection());
+    VisibleSelection dragCaret(m_page->dragCaretController()->selection());
     m_page->dragCaretController()->clear();
-    RefPtr<Range> range = dragCaret.toRange();
+    RefPtr<Range> range = dragCaret.toNormalizedRange();
     
     // For range to be null a WebKit client must have done something bad while
     // manually controlling drag behaviour
@@ -394,7 +402,7 @@ bool DragController::concludeDrag(DragData* dragData, DragDestinationAction acti
         return false;
     DocLoader* loader = range->ownerDocument()->docLoader();
     loader->setAllowStaleResources(true);
-    if (dragIsMove(innerFrame->selection(), dragData) || dragCaret.isContentRichlyEditable()) { 
+    if (dragIsMove(innerFrame->selection()) || dragCaret.isContentRichlyEditable()) { 
         bool chosePlainText = false;
         RefPtr<DocumentFragment> fragment = documentFragmentFromDragData(dragData, range, true, chosePlainText);
         if (!fragment || !innerFrame->editor()->shouldInsertFragment(fragment, range, EditorInsertActionDropped)) {
@@ -403,14 +411,14 @@ bool DragController::concludeDrag(DragData* dragData, DragDestinationAction acti
         }
         
         m_client->willPerformDragDestinationAction(DragDestinationActionEdit, dragData);
-        if (dragIsMove(innerFrame->selection(), dragData)) {
+        if (dragIsMove(innerFrame->selection())) {
             bool smartMove = innerFrame->selectionGranularity() == WordGranularity 
                           && innerFrame->editor()->smartInsertDeleteEnabled() 
                           && dragData->canSmartReplace();
             applyCommand(MoveSelectionCommand::create(fragment, dragCaret.base(), smartMove));
         } else {
             if (setSelectionToDragCaret(innerFrame, dragCaret, range, point))
-                applyCommand(ReplaceSelectionCommand::create(m_document, fragment, true, dragData->canSmartReplace(), chosePlainText)); 
+                applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse, fragment, true, dragData->canSmartReplace(), chosePlainText)); 
         }    
     } else {
         String text = dragData->asPlainText();
@@ -421,7 +429,7 @@ bool DragController::concludeDrag(DragData* dragData, DragDestinationAction acti
         
         m_client->willPerformDragDestinationAction(DragDestinationActionEdit, dragData);
         if (setSelectionToDragCaret(innerFrame, dragCaret, range, point))
-            applyCommand(ReplaceSelectionCommand::create(m_document, createFragmentFromText(range.get(), text), true, false, true)); 
+            applyCommand(ReplaceSelectionCommand::create(m_documentUnderMouse, createFragmentFromText(range.get(), text), true, false, true)); 
     }
     loader->setAllowStaleResources(false);
 
@@ -452,49 +460,57 @@ bool DragController::canProcessDrag(DragData* dragData)
     if (!result.innerNonSharedNode()->isContentEditable())
         return false;
         
-    if (m_didInitiateDrag && m_document == m_dragInitiator && result.isSelected())
+    if (m_didInitiateDrag && m_documentUnderMouse == m_dragInitiator && result.isSelected())
         return false;
 
     return true;
 }
 
-DragOperation DragController::tryDHTMLDrag(DragData* dragData)
+static DragOperation defaultOperationForDrag(DragOperation srcOpMask)
+{
+    // This is designed to match IE's operation fallback for the case where
+    // the page calls preventDefault() in a drag event but doesn't set dropEffect.
+    if (srcOpMask & DragOperationCopy)
+         return DragOperationCopy;
+    if (srcOpMask & DragOperationMove || srcOpMask & DragOperationGeneric)
+        return DragOperationMove;
+    if (srcOpMask & DragOperationLink)
+        return DragOperationLink;
+
+    // FIXME: Does IE really return "generic" even if no operations were allowed by the source?
+    return DragOperationGeneric;
+}
+
+bool DragController::tryDHTMLDrag(DragData* dragData, DragOperation& operation)
 {   
     ASSERT(dragData);
-    ASSERT(m_document);
-    DragOperation op = DragOperationNone;
-    RefPtr<Frame> frame = m_page->mainFrame();
-    RefPtr<FrameView> viewProtector = frame->view();
+    ASSERT(m_documentUnderMouse);
+    RefPtr<Frame> mainFrame = m_page->mainFrame();
+    RefPtr<FrameView> viewProtector = mainFrame->view();
     if (!viewProtector)
-        return DragOperationNone;
-    
-    ClipboardAccessPolicy policy = frame->loader()->baseURL().isLocalFile() ? ClipboardReadable : ClipboardTypesReadable;
+        return false;
+
+    ClipboardAccessPolicy policy = m_documentUnderMouse->securityOrigin()->isLocal() ? ClipboardReadable : ClipboardTypesReadable;
     RefPtr<Clipboard> clipboard = dragData->createClipboard(policy);
-    DragOperation srcOp = dragData->draggingSourceOperationMask();
-    clipboard->setSourceOperation(srcOp);
-    
-    PlatformMouseEvent event = createMouseEvent(dragData);
-    if (frame->eventHandler()->updateDragAndDrop(event, clipboard.get())) {
-        // *op unchanged if no source op was set
-        if (!clipboard->destinationOperation(op)) {
-            // The element accepted but they didn't pick an operation, so we pick one for them
-            // (as does WinIE).
-            if (srcOp & DragOperationCopy)
-                op = DragOperationCopy;
-            else if (srcOp & DragOperationMove || srcOp & DragOperationGeneric)
-                op = DragOperationMove;
-            else if (srcOp & DragOperationLink)
-                op = DragOperationLink;
-            else
-                op = DragOperationGeneric;
-        } else if (!(op & srcOp)) {
-            op = DragOperationNone;
-        }
+    DragOperation srcOpMask = dragData->draggingSourceOperationMask();
+    clipboard->setSourceOperation(srcOpMask);
 
+    PlatformMouseEvent event = createMouseEvent(dragData);
+    if (!mainFrame->eventHandler()->updateDragAndDrop(event, clipboard.get())) {
         clipboard->setAccessPolicy(ClipboardNumb);    // invalidate clipboard here for security
-        return op;
+        return false;
     }
-    return op;
+
+    if (!clipboard->destinationOperation(operation)) {
+        // The element accepted but they didn't pick an operation, so we pick one (to match IE).
+        operation = defaultOperationForDrag(srcOpMask);
+    } else if (!(srcOpMask & operation)) {
+        // The element picked an operation which is not supported by the source
+        operation = DragOperationNone;
+    }
+
+    clipboard->setAccessPolicy(ClipboardNumb);    // invalidate clipboard here for security
+    return true;
 }
 
 bool DragController::mayStartDragAtEventLocation(const Frame* frame, const IntPoint& framePos)
@@ -534,7 +550,7 @@ static CachedImage* getCachedImage(Element* element)
     RenderObject* renderer = element->renderer();
     if (!renderer || !renderer->isImage()) 
         return 0;
-    RenderImage* image = static_cast<RenderImage*>(renderer);
+    RenderImage* image = toRenderImage(renderer);
     return image->cachedImage();
 }
     
@@ -545,7 +561,7 @@ static Image* getImage(Element* element)
     if (!renderer || !renderer->isImage()) 
         return 0;
     
-    RenderImage* image = static_cast<RenderImage*>(renderer);
+    RenderImage* image = toRenderImage(renderer);
     if (image->cachedImage() && !image->cachedImage()->errorOccurred())
         return image->cachedImage()->image();
     return 0;
@@ -557,7 +573,7 @@ static void prepareClipboardForImageDrag(Frame* src, Clipboard* clipboard, Eleme
     ExceptionCode ec = 0;
     range->selectNode(node, ec);
     ASSERT(ec == 0);
-    src->selection()->setSelection(Selection(range.get(), DOWNSTREAM));           
+    src->selection()->setSelection(VisibleSelection(range.get(), DOWNSTREAM));           
     clipboard->declareAndWriteDragImage(node, !linkURL.isEmpty() ? linkURL : imageURL, label, src);
 }
     
@@ -609,7 +625,7 @@ bool DragController::startDrag(Frame* src, Clipboard* clipboard, DragOperation s
     IntPoint mouseDraggedPoint = src->view()->windowToContents(dragEvent.pos());
     
     m_draggingImageURL = KURL();
-    m_dragOperation = srcOp;
+    m_sourceDragOperation = srcOp;
     
     DragImageRef dragImage = 0;
     IntPoint dragLoc(0, 0);
@@ -664,7 +680,7 @@ bool DragController::startDrag(Frame* src, Clipboard* clipboard, DragOperation s
             Position pos = src->selection()->base();
             Node* node = enclosingAnchorElement(pos);
             if (node)
-                src->selection()->setSelection(Selection::selectionFromContentsOfNode(node));
+                src->selection()->setSelection(VisibleSelection::selectionFromContentsOfNode(node));
         }
 
         m_client->willPerformDragSourceAction(DragSourceActionLink, dragOrigin, clipboard);
@@ -676,7 +692,7 @@ bool DragController::startDrag(Frame* src, Clipboard* clipboard, DragOperation s
         } 
         doSystemDrag(dragImage, dragLoc, mouseDraggedPoint, clipboard, src, true);
     } else if (isSelected && (m_dragSourceAction & DragSourceActionSelection)) {
-        RefPtr<Range> selectionRange = src->selection()->toRange();
+        RefPtr<Range> selectionRange = src->selection()->toNormalizedRange();
         ASSERT(selectionRange);
         if (!clipboard->hasData()) 
             clipboard->writeRange(selectionRange.get(), src);
@@ -701,7 +717,7 @@ bool DragController::startDrag(Frame* src, Clipboard* clipboard, DragOperation s
         deleteDragImage(dragImage);
     return startedDrag;
 }
-    
+
 void DragController::doImageDrag(Element* element, const IntPoint& dragOrigin, const IntRect& rect, Clipboard* clipboard, Frame* frame, IntPoint& dragImageOffset)
 {
     IntPoint mouseDownPoint = dragOrigin;
@@ -759,23 +775,16 @@ void DragController::doSystemDrag(DragImageRef image, const IntPoint& dragLoc, c
 // Manual drag caret manipulation
 void DragController::placeDragCaret(const IntPoint& windowPoint)
 {
-    Frame* mainFrame = m_page->mainFrame();    
-    Document* newDraggingDoc = mainFrame->documentAtPoint(windowPoint);
-    if (m_document != newDraggingDoc) {
-        if (m_document)
-            cancelDrag();
-        m_document = newDraggingDoc;
-    }
-    if (!m_document)
+    mouseMovedIntoDocument(m_page->mainFrame()->documentAtPoint(windowPoint));
+    if (!m_documentUnderMouse)
         return;
-    Frame* frame = m_document->frame();
-    ASSERT(frame);
+    Frame* frame = m_documentUnderMouse->frame();
     FrameView* frameView = frame->view();
     if (!frameView)
         return;
     IntPoint framePoint = frameView->windowToContents(windowPoint);
-    Selection dragCaret(frame->visiblePositionForPoint(framePoint));  
+    VisibleSelection dragCaret(frame->visiblePositionForPoint(framePoint));  
     m_page->dragCaretController()->setSelection(dragCaret);
 }
     
-}
+} // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/DragController.h b/src/3rdparty/webkit/WebCore/page/DragController.h
index 0c2504e..9472589 100644
--- a/src/3rdparty/webkit/WebCore/page/DragController.h
+++ b/src/3rdparty/webkit/WebCore/page/DragController.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -29,7 +29,6 @@
 #include "DragActions.h"
 #include "DragImage.h"
 #include "IntPoint.h"
-#include "IntRect.h"
 #include "KURL.h"
 
 namespace WebCore {
@@ -41,6 +40,7 @@ namespace WebCore {
     class Element;
     class Frame;
     class Image;
+    class IntRect;
     class Node;
     class Page;
     class PlatformMouseEvent;
@@ -58,14 +58,13 @@ namespace WebCore {
         DragOperation dragUpdated(DragData*);
         bool performDrag(DragData*);
         
-        //FIXME: It should be possible to remove a number of these accessors once all
-        //drag logic is in WebCore
+        // FIXME: It should be possible to remove a number of these accessors once all
+        // drag logic is in WebCore.
         void setDidInitiateDrag(bool initiated) { m_didInitiateDrag = initiated; } 
         bool didInitiateDrag() const { return m_didInitiateDrag; }
         void setIsHandlingDrag(bool handling) { m_isHandlingDrag = handling; }
         bool isHandlingDrag() const { return m_isHandlingDrag; }
-        void setDragOperation(DragOperation dragOp) { m_dragOperation = dragOp; }
-        DragOperation dragOperation() const { return m_dragOperation; }       
+        DragOperation sourceDragOperation() const { return m_sourceDragOperation; }
         void setDraggingImageURL(const KURL& url) { m_draggingImageURL = url; }
         const KURL& draggingImageURL() const { return m_draggingImageURL; }
         void setDragInitiator(Document* initiator) { m_dragInitiator = initiator; m_didInitiateDrag = true; }
@@ -73,8 +72,8 @@ namespace WebCore {
         void setDragOffset(const IntPoint& offset) { m_dragOffset = offset; }
         const IntPoint& dragOffset() const { return m_dragOffset; }
         DragSourceAction dragSourceAction() const { return m_dragSourceAction; }
-        
-        Document* document() const { return m_document; }
+
+        Document* documentUnderMouse() const { return m_documentUnderMouse; }
         DragDestinationAction dragDestinationAction() const { return m_dragDestinationAction; }
         DragSourceAction delegateDragSourceAction(const IntPoint& pagePoint);
         
@@ -91,40 +90,40 @@ namespace WebCore {
         static const int DragIconRightInset;
         static const int DragIconBottomInset;        
         static const float DragImageAlpha;
+
     private:
         bool canProcessDrag(DragData*);
-        bool concludeDrag(DragData*, DragDestinationAction);
+        bool concludeEditDrag(DragData*);
         DragOperation dragEnteredOrUpdated(DragData*);
         DragOperation operationForLoad(DragData*);
-        DragOperation tryDocumentDrag(DragData*, DragDestinationAction);
-        DragOperation tryDHTMLDrag(DragData*);
+        bool tryDocumentDrag(DragData*, DragDestinationAction, DragOperation&);
+        bool tryDHTMLDrag(DragData*, DragOperation&);
         DragOperation dragOperation(DragData*);
         void cancelDrag();
-        bool dragIsMove(SelectionController*, DragData*);
+        bool dragIsMove(SelectionController*);
         bool isCopyKeyDown();
 
+        void mouseMovedIntoDocument(Document*);
+
         IntRect selectionDraggingRect(Frame*);
         bool doDrag(Frame* src, Clipboard* clipboard, DragImageRef dragImage, const KURL& linkURL, const KURL& imageURL, Node* node, IntPoint& dragLoc, IntPoint& dragImageOffset);
         void doImageDrag(Element*, const IntPoint&, const IntRect&, Clipboard*, Frame*, IntPoint&);
         void doSystemDrag(DragImageRef, const IntPoint&, const IntPoint&, Clipboard*, Frame*, bool forLink);
         void cleanupAfterSystemDrag();
+
         Page* m_page;
         DragClient* m_client;
         
-        //The Document the mouse was last dragged over
-        Document* m_document;
-        
-        //The Document (if any) that initiated the drag
-        Document* m_dragInitiator;
+        Document* m_documentUnderMouse; // The document the mouse was last dragged over.
+        Document* m_dragInitiator; // The Document (if any) that initiated the drag.
         
         DragDestinationAction m_dragDestinationAction;
         DragSourceAction m_dragSourceAction;
         bool m_didInitiateDrag;
         bool m_isHandlingDrag;
-        DragOperation m_dragOperation;
+        DragOperation m_sourceDragOperation; // Set in startDrag when a drag starts from a mouse down within WebKit
         IntPoint m_dragOffset;
         KURL m_draggingImageURL;
-        
     };
 
 }
diff --git a/src/3rdparty/webkit/WebCore/page/EditorClient.h b/src/3rdparty/webkit/WebCore/page/EditorClient.h
index 56d0435..cdf0bd8 100644
--- a/src/3rdparty/webkit/WebCore/page/EditorClient.h
+++ b/src/3rdparty/webkit/WebCore/page/EditorClient.h
@@ -50,7 +50,7 @@ class HTMLElement;
 class KeyboardEvent;
 class Node;
 class Range;
-class Selection;
+class VisibleSelection;
 class String;
 class VisiblePosition;
 
@@ -61,6 +61,24 @@ struct GrammarDetail {
     String userDescription;
 };
 
+enum TextCheckingType {
+    TextCheckingTypeSpelling    = 1 << 1,
+    TextCheckingTypeGrammar     = 1 << 2,
+    TextCheckingTypeLink        = 1 << 5,
+    TextCheckingTypeQuote       = 1 << 6,
+    TextCheckingTypeDash        = 1 << 7,
+    TextCheckingTypeReplacement = 1 << 8,
+    TextCheckingTypeCorrection  = 1 << 9
+};
+
+struct TextCheckingResult {
+    TextCheckingType type;
+    int location;
+    int length;
+    Vector<GrammarDetail> details;
+    String replacement;
+};
+ 
 class EditorClient {
 public:
     virtual ~EditorClient() {  }
@@ -126,10 +144,33 @@ public:
 #endif
 #endif
 
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    virtual void uppercaseWord() = 0;
+    virtual void lowercaseWord() = 0;
+    virtual void capitalizeWord() = 0;
+    virtual void showSubstitutionsPanel(bool show) = 0;
+    virtual bool substitutionsPanelIsShowing() = 0;
+    virtual void toggleSmartInsertDelete() = 0;
+    virtual bool isAutomaticQuoteSubstitutionEnabled() = 0;
+    virtual void toggleAutomaticQuoteSubstitution() = 0;
+    virtual bool isAutomaticLinkDetectionEnabled() = 0;
+    virtual void toggleAutomaticLinkDetection() = 0;
+    virtual bool isAutomaticDashSubstitutionEnabled() = 0;
+    virtual void toggleAutomaticDashSubstitution() = 0;
+    virtual bool isAutomaticTextReplacementEnabled() = 0;
+    virtual void toggleAutomaticTextReplacement() = 0;
+    virtual bool isAutomaticSpellingCorrectionEnabled() = 0;
+    virtual void toggleAutomaticSpellingCorrection() = 0;
+#endif
+
     virtual void ignoreWordInSpellDocument(const String&) = 0;
     virtual void learnWord(const String&) = 0;
     virtual void checkSpellingOfString(const UChar*, int length, int* misspellingLocation, int* misspellingLength) = 0;
+    virtual String getAutoCorrectSuggestionForMisspelledWord(const String& misspelledWord) = 0;
     virtual void checkGrammarOfString(const UChar*, int length, Vector<GrammarDetail>&, int* badGrammarLocation, int* badGrammarLength) = 0;
+#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+    virtual void checkTextOfParagraph(const UChar* text, int length, uint64_t checkingTypes, Vector<TextCheckingResult>& results) = 0;
+#endif
     virtual void updateSpellingUIWithGrammarString(const String&, const GrammarDetail& detail) = 0;
     virtual void updateSpellingUIWithMisspelledWord(const String&) = 0;
     virtual void showSpellingUI(bool show) = 0;
@@ -141,3 +182,4 @@ public:
 }
 
 #endif // EditorClient_h
+
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
index cc0e358..8f0b420 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -42,12 +42,12 @@
 #include "FrameLoader.h"
 #include "FrameTree.h"
 #include "FrameView.h"
-#include "HitTestRequest.h"
-#include "HitTestResult.h"
-#include "HTMLFrameSetElement.h"
 #include "HTMLFrameElementBase.h"
+#include "HTMLFrameSetElement.h"
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
+#include "HitTestRequest.h"
+#include "HitTestResult.h"
 #include "Image.h"
 #include "InspectorController.h"
 #include "KeyboardEvent.h"
@@ -57,12 +57,14 @@
 #include "PlatformKeyboardEvent.h"
 #include "PlatformWheelEvent.h"
 #include "RenderFrameSet.h"
-#include "RenderWidget.h"
+#include "RenderTextControlSingleLine.h"
 #include "RenderView.h"
+#include "RenderWidget.h"
 #include "Scrollbar.h"
 #include "SelectionController.h"
 #include "Settings.h"
 #include "TextEvent.h"
+#include "htmlediting.h" // for comparePositions()
 #include <wtf/StdLibExtras.h>
 
 #if ENABLE(SVG)
@@ -102,21 +104,38 @@ static inline void scrollAndAcceptEvent(float delta, ScrollDirection positiveDir
 {
     if (!delta)
         return;
+        
+    // Find the nearest enclosing box.
+    RenderBox* enclosingBox = node->renderer()->enclosingBox();
+
     if (e.granularity() == ScrollByPageWheelEvent) {
-        if (node->renderer()->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPage, 1))
+        if (enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPage, 1))
             e.accept();
         return;
     } 
     float pixelsToScroll = delta > 0 ? delta : -delta;
-    if (e.granularity() == ScrollByLineWheelEvent)
-        pixelsToScroll *= cMouseWheelPixelsPerLineStep;
-    if (node->renderer()->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPixel, pixelsToScroll))
+    if (enclosingBox->scroll(delta < 0 ? negativeDirection : positiveDirection, ScrollByPixel, pixelsToScroll))
         e.accept();
 }
 
+#if !PLATFORM(MAC)
+
+inline bool EventHandler::eventLoopHandleMouseUp(const MouseEventWithHitTestResults&)
+{
+    return false;
+}
+
+inline bool EventHandler::eventLoopHandleMouseDragged(const MouseEventWithHitTestResults&)
+{
+    return false;
+}
+
+#endif
+
 EventHandler::EventHandler(Frame* frame)
     : m_frame(frame)
     , m_mousePressed(false)
+    , m_capturesDragging(false)
     , m_mouseDownMayStartSelect(false)
     , m_mouseDownMayStartDrag(false)
     , m_mouseDownWasSingleClickInSelection(false)
@@ -135,8 +154,6 @@ EventHandler::EventHandler(Frame* frame)
     , m_capturingMouseEventsNode(0)
     , m_clickCount(0)
     , m_mouseDownTimestamp(0)
-    , m_pendingFrameUnloadEventCount(0)
-    , m_pendingFrameBeforeUnloadEventCount(0)
 #if PLATFORM(MAC)
     , m_mouseDownView(nil)
     , m_sendingEventToSubview(false)
@@ -174,18 +191,19 @@ void EventHandler::clear()
     m_currentMousePosition = IntPoint();
     m_mousePressNode = 0;
     m_mousePressed = false;
+    m_capturesDragging = false;
     m_capturingMouseEventsNode = 0;
 }
 
 void EventHandler::selectClosestWordFromMouseEvent(const MouseEventWithHitTestResults& result)
 {
     Node* innerNode = result.targetNode();
-    Selection newSelection;
+    VisibleSelection newSelection;
 
     if (innerNode && innerNode->renderer() && m_mouseDownMayStartSelect) {
         VisiblePosition pos(innerNode->renderer()->positionForPoint(result.localPoint()));
         if (pos.isNotNull()) {
-            newSelection = Selection(pos);
+            newSelection = VisibleSelection(pos);
             newSelection.expandUsingGranularity(WordGranularity);
         }
     
@@ -209,11 +227,11 @@ void EventHandler::selectClosestWordOrLinkFromMouseEvent(const MouseEventWithHit
     Node* innerNode = result.targetNode();
 
     if (innerNode && innerNode->renderer() && m_mouseDownMayStartSelect) {
-        Selection newSelection;
+        VisibleSelection newSelection;
         Element* URLElement = result.hitTestResult().URLElement();
         VisiblePosition pos(innerNode->renderer()->positionForPoint(result.localPoint()));
         if (pos.isNotNull() && pos.deepEquivalent().node()->isDescendantOf(URLElement))
-            newSelection = Selection::selectionFromContentsOfNode(URLElement);
+            newSelection = VisibleSelection::selectionFromContentsOfNode(URLElement);
     
         if (newSelection.isRange()) {
             m_frame->setSelectionGranularity(WordGranularity);
@@ -252,10 +270,10 @@ bool EventHandler::handleMousePressEventTripleClick(const MouseEventWithHitTestR
     if (!(innerNode && innerNode->renderer() && m_mouseDownMayStartSelect))
         return false;
 
-    Selection newSelection;
+    VisibleSelection newSelection;
     VisiblePosition pos(innerNode->renderer()->positionForPoint(event.localPoint()));
     if (pos.isNotNull()) {
-        newSelection = Selection(pos);
+        newSelection = VisibleSelection(pos);
         newSelection.expandUsingGranularity(ParagraphGranularity);
     }
     if (newSelection.isRange()) {
@@ -271,9 +289,6 @@ bool EventHandler::handleMousePressEventTripleClick(const MouseEventWithHitTestR
 
 bool EventHandler::handleMousePressEventSingleClick(const MouseEventWithHitTestResults& event)
 {
-    if (event.event().button() != LeftButton)
-        return false;
-    
     Node* innerNode = event.targetNode();
     if (!(innerNode && innerNode->renderer() && m_mouseDownMayStartSelect))
         return false;
@@ -283,10 +298,12 @@ bool EventHandler::handleMousePressEventSingleClick(const MouseEventWithHitTestR
 
     // Don't restart the selection when the mouse is pressed on an
     // existing selection so we can allow for text dragging.
-    IntPoint vPoint = m_frame->view()->windowToContents(event.event().pos());
-    if (!extendSelection && m_frame->selection()->contains(vPoint)) {
-        m_mouseDownWasSingleClickInSelection = true;
-        return false;
+    if (FrameView* view = m_frame->view()) {
+        IntPoint vPoint = view->windowToContents(event.event().pos());
+        if (!extendSelection && m_frame->selection()->contains(vPoint)) {
+            m_mouseDownWasSingleClickInSelection = true;
+            return false;
+        }
     }
 
     VisiblePosition visiblePos(innerNode->renderer()->positionForPoint(event.localPoint()));
@@ -294,7 +311,7 @@ bool EventHandler::handleMousePressEventSingleClick(const MouseEventWithHitTestR
         visiblePos = VisiblePosition(innerNode, 0, DOWNSTREAM);
     Position pos = visiblePos.deepEquivalent();
     
-    Selection newSelection = m_frame->selection()->selection();
+    VisibleSelection newSelection = m_frame->selection()->selection();
     if (extendSelection && newSelection.isCaretOrRange()) {
         m_frame->selection()->setLastChangeWasHorizontalExtension(false);
         
@@ -302,17 +319,16 @@ bool EventHandler::handleMousePressEventSingleClick(const MouseEventWithHitTestR
         // was created right-to-left
         Position start = newSelection.start();
         Position end = newSelection.end();
-        short before = Range::compareBoundaryPoints(pos.node(), pos.offset(), start.node(), start.offset());
-        if (before <= 0)
-            newSelection = Selection(pos, end);
+        if (comparePositions(pos, start) <= 0)
+            newSelection = VisibleSelection(pos, end);
         else
-            newSelection = Selection(start, pos);
+            newSelection = VisibleSelection(start, pos);
 
         if (m_frame->selectionGranularity() != CharacterGranularity)
             newSelection.expandUsingGranularity(m_frame->selectionGranularity());
         m_beganSelectingText = true;
     } else {
-        newSelection = Selection(visiblePos);
+        newSelection = VisibleSelection(visiblePos);
         m_frame->setSelectionGranularity(CharacterGranularity);
     }
     
@@ -338,6 +354,8 @@ bool EventHandler::handleMousePressEvent(const MouseEventWithHitTestResults& eve
 
     m_mouseDownWasSingleClickInSelection = false;
 
+    m_mouseDown = event.event();
+
     if (event.isOverWidget() && passWidgetMouseDownEventToWidget(event))
         return true;
 
@@ -363,21 +381,19 @@ bool EventHandler::handleMousePressEvent(const MouseEventWithHitTestResults& eve
     m_dragStartPos = event.event().pos();
 
     bool swallowEvent = false;
-    if (event.event().button() == LeftButton || event.event().button() == MiddleButton) {
-        m_frame->selection()->setCaretBlinkingSuspended(true);
-        m_mousePressed = true;
-        m_beganSelectingText = false;
-
-        if (event.event().clickCount() == 2)
-            swallowEvent = handleMousePressEventDoubleClick(event);
-        else if (event.event().clickCount() >= 3)
-            swallowEvent = handleMousePressEventTripleClick(event);
-        else
-            swallowEvent = handleMousePressEventSingleClick(event);
-    }
+    m_frame->selection()->setCaretBlinkingSuspended(true);
+    m_mousePressed = true;
+    m_beganSelectingText = false;
+
+    if (event.event().clickCount() == 2)
+        swallowEvent = handleMousePressEventDoubleClick(event);
+    else if (event.event().clickCount() >= 3)
+        swallowEvent = handleMousePressEventTripleClick(event);
+    else
+        swallowEvent = handleMousePressEventSingleClick(event);
     
-   m_mouseDownMayStartAutoscroll = m_mouseDownMayStartSelect || 
-        (m_mousePressNode && m_mousePressNode->renderer() && m_mousePressNode->renderer()->canBeProgramaticallyScrolled(true));
+    m_mouseDownMayStartAutoscroll = m_mouseDownMayStartSelect || 
+        (m_mousePressNode && m_mousePressNode->renderBox() && m_mousePressNode->renderBox()->canBeProgramaticallyScrolled(true));
 
    return swallowEvent;
 }
@@ -404,7 +420,7 @@ bool EventHandler::handleMouseDraggedEvent(const MouseEventWithHitTestResults& e
         // If the selection is contained in a layer that can scroll, that layer should handle the autoscroll
         // Otherwise, let the bridge handle it so the view can scroll itself.
         RenderObject* renderer = targetNode->renderer();
-        while (renderer && !renderer->canBeProgramaticallyScrolled(false)) {
+        while (renderer && (!renderer->isBox() || !toRenderBox(renderer)->canBeProgramaticallyScrolled(false))) {
             if (!renderer->parent() && renderer->node() == renderer->document() && renderer->document()->ownerElement())
                 renderer = renderer->document()->ownerElement()->renderer();
             else
@@ -429,8 +445,10 @@ bool EventHandler::eventMayStartDrag(const PlatformMouseEvent& event) const
     // that its logic needs to stay in sync with handleMouseMoveEvent() and the way we setMouseDownMayStartDrag
     // in handleMousePressEvent
     
-    if (!m_frame->contentRenderer() || !m_frame->contentRenderer()->hasLayer()
-        || event.button() != LeftButton || event.clickCount() != 1)
+    if (!m_frame->contentRenderer() || !m_frame->contentRenderer()->hasLayer())
+        return false;
+
+    if (event.button() != LeftButton || event.clickCount() != 1)
         return false;
     
     bool DHTMLFlag;
@@ -438,9 +456,13 @@ bool EventHandler::eventMayStartDrag(const PlatformMouseEvent& event) const
     allowDHTMLDrag(DHTMLFlag, UAFlag);
     if (!DHTMLFlag && !UAFlag)
         return false;
-    
-    HitTestRequest request(true, false);
-    HitTestResult result(m_frame->view()->windowToContents(event.pos()));
+
+    FrameView* view = m_frame->view();
+    if (!view)
+        return false;
+
+    HitTestRequest request(HitTestRequest::ReadOnly);
+    HitTestResult result(view->windowToContents(event.pos()));
     m_frame->contentRenderer()->layer()->hitTest(request, result);
     bool srcIsDHTML;
     return result.innerNode() && result.innerNode()->renderer()->draggableNode(DHTMLFlag, UAFlag, result.point().x(), result.point().y(), srcIsDHTML);
@@ -451,15 +473,18 @@ void EventHandler::updateSelectionForMouseDrag()
     FrameView* view = m_frame->view();
     if (!view)
         return;
-    RenderObject* renderer = m_frame->contentRenderer();
+    RenderView* renderer = m_frame->contentRenderer();
     if (!renderer)
         return;
     RenderLayer* layer = renderer->layer();
     if (!layer)
         return;
 
+    HitTestRequest request(HitTestRequest::ReadOnly |
+                           HitTestRequest::Active |
+                           HitTestRequest::MouseMove);
     HitTestResult result(view->windowToContents(m_currentMousePosition));
-    layer->hitTest(HitTestRequest(true, true, true), result);
+    layer->hitTest(request, result);
     updateSelectionForMouseDrag(result.innerNode(), result.localPoint());
 }
 
@@ -486,7 +511,7 @@ void EventHandler::updateSelectionForMouseDrag(Node* targetNode, const IntPoint&
 
     // Restart the selection if this is the first mouse move. This work is usually
     // done in handleMousePressEvent, but not if the mouse press was on an existing selection.
-    Selection newSelection = m_frame->selection()->selection();
+    VisibleSelection newSelection = m_frame->selection()->selection();
 
 #if ENABLE(SVG)
     // Special case to limit selection to the containing block for SVG text.
@@ -500,7 +525,7 @@ void EventHandler::updateSelectionForMouseDrag(Node* targetNode, const IntPoint&
 
     if (!m_beganSelectingText) {
         m_beganSelectingText = true;
-        newSelection = Selection(targetPosition);
+        newSelection = VisibleSelection(targetPosition);
     }
 
     newSelection.setExtent(targetPosition);
@@ -538,6 +563,7 @@ bool EventHandler::handleMouseReleaseEvent(const MouseEventWithHitTestResults& e
     // the mouse is pressed again.
     m_frame->selection()->setCaretBlinkingSuspended(false);
     m_mousePressed = false;
+    m_capturesDragging = false;
     m_mouseDownMayStartDrag = false;
     m_mouseDownMayStartSelect = false;
     m_mouseDownMayStartAutoscroll = false;
@@ -545,17 +571,20 @@ bool EventHandler::handleMouseReleaseEvent(const MouseEventWithHitTestResults& e
   
     bool handled = false;
 
-    // Clear the selection if the mouse didn't move after the last mouse press.
-    // We do this so when clicking on the selection, the selection goes away.
-    // However, if we are editing, place the caret.
+    // Clear the selection if the mouse didn't move after the last mouse
+    // press and it's not a context menu click.  We do this so when clicking
+    // on the selection, the selection goes away.  However, if we are
+    // editing, place the caret.
     if (m_mouseDownWasSingleClickInSelection && !m_beganSelectingText
             && m_dragStartPos == event.event().pos()
-            && m_frame->selection()->isRange()) {
-        Selection newSelection;
+            && m_frame->selection()->isRange()
+            && event.event().button() != RightButton) {
+        VisibleSelection newSelection;
         Node *node = event.targetNode();
-        if (node && node->isContentEditable() && node->renderer()) {
+        bool caretBrowsing = m_frame->settings()->caretBrowsingEnabled();
+        if (node && (caretBrowsing || node->isContentEditable()) && node->renderer()) {
             VisiblePosition pos = node->renderer()->positionForPoint(event.localPoint());
-            newSelection = Selection(pos);
+            newSelection = VisibleSelection(pos);
         }
         if (m_frame->shouldChangeSelection(newSelection))
             m_frame->selection()->setSelection(newSelection);
@@ -581,10 +610,14 @@ void EventHandler::handleAutoscroll(RenderObject* renderer)
 #if ENABLE(PAN_SCROLLING)
     if (m_panScrollInProgress) {
         m_panScrollStartPos = currentMousePosition();
-        m_frame->view()->addPanScrollIcon(m_panScrollStartPos);
-        // If we're not in the top frame we notify it that we are using the panScroll
-        if (m_frame != m_frame->page()->mainFrame())
-            m_frame->page()->mainFrame()->eventHandler()->setPanScrollInProgress(true);
+        if (FrameView* view = m_frame->view())
+            view->addPanScrollIcon(m_panScrollStartPos);
+        // If we're not in the top frame we notify it that we doing a panScroll.
+        if (Page* page = m_frame->page()) {
+            Frame* mainFrame = page->mainFrame();
+            if (m_frame != mainFrame)
+                mainFrame->eventHandler()->setPanScrollInProgress(true);
+        }
     }
 #endif
 
@@ -594,7 +627,7 @@ void EventHandler::handleAutoscroll(RenderObject* renderer)
 void EventHandler::autoscrollTimerFired(Timer<EventHandler>*)
 {
     RenderObject* r = autoscrollRenderer();
-    if (!r) {
+    if (!r || !r->isBox()) {
         stopAutoscrollTimer();
         return;
     }
@@ -604,52 +637,61 @@ void EventHandler::autoscrollTimerFired(Timer<EventHandler>*)
             stopAutoscrollTimer();
             return;
         }
-        r->autoscroll();
+        toRenderBox(r)->autoscroll();
     } else {
         // we verify that the main frame hasn't received the order to stop the panScroll
-        if (!m_frame->page()->mainFrame()->eventHandler()->panScrollInProgress()) {
-            stopAutoscrollTimer();
-            return;
+        if (Page* page = m_frame->page()) {
+            if (!page->mainFrame()->eventHandler()->panScrollInProgress()) {
+                stopAutoscrollTimer();
+                return;
+            }
         }
 #if ENABLE(PAN_SCROLLING)
         setPanScrollCursor();
-        r->panScroll(m_panScrollStartPos);
+        toRenderBox(r)->panScroll(m_panScrollStartPos);
 #endif
     }
 }
 
+#if ENABLE(PAN_SCROLLING)
+
 void EventHandler::setPanScrollCursor()
 {
+    FrameView* view = m_frame->view();
+    if (!view)
+        return;
+
     // At the original click location we draw a 4 arrowed icon. Over this icon there won't be any scroll
     // So we don't want to change the cursor over this area
-    const int noScrollRadius = 9;
-    bool east = m_panScrollStartPos.x() < (m_currentMousePosition.x() - noScrollRadius);
-    bool west = m_panScrollStartPos.x() > (m_currentMousePosition.x() + noScrollRadius);
-    bool north = m_panScrollStartPos.y() > (m_currentMousePosition.y() + noScrollRadius);
-    bool south = m_panScrollStartPos.y() < (m_currentMousePosition.y() - noScrollRadius);
+    bool east = m_panScrollStartPos.x() < (m_currentMousePosition.x() - ScrollView::noPanScrollRadius);
+    bool west = m_panScrollStartPos.x() > (m_currentMousePosition.x() + ScrollView::noPanScrollRadius);
+    bool north = m_panScrollStartPos.y() > (m_currentMousePosition.y() + ScrollView::noPanScrollRadius);
+    bool south = m_panScrollStartPos.y() < (m_currentMousePosition.y() - ScrollView::noPanScrollRadius);
          
     if (north) {
         if (east)
-            m_frame->view()->setCursor(northEastPanningCursor());
+            view->setCursor(northEastPanningCursor());
         else if (west)
-            m_frame->view()->setCursor(northWestPanningCursor());
+            view->setCursor(northWestPanningCursor());
         else
-            m_frame->view()->setCursor(northPanningCursor());
+            view->setCursor(northPanningCursor());
     } else if (south) {
         if (east)
-            m_frame->view()->setCursor(southEastPanningCursor());
+            view->setCursor(southEastPanningCursor());
         else if (west)
-            m_frame->view()->setCursor(southWestPanningCursor());
+            view->setCursor(southWestPanningCursor());
         else
-            m_frame->view()->setCursor(southPanningCursor());
+            view->setCursor(southPanningCursor());
     } else if (east)
-        m_frame->view()->setCursor(eastPanningCursor());
+        view->setCursor(eastPanningCursor());
     else if (west)
-        m_frame->view()->setCursor(westPanningCursor());
+        view->setCursor(westPanningCursor());
     else
-        m_frame->view()->setCursor(middlePanningCursor());
+        view->setCursor(middlePanningCursor());
 }
 
+#endif  // ENABLE(PAN_SCROLLING)
+
 RenderObject* EventHandler::autoscrollRenderer() const
 {
     return m_autoscrollRenderer;
@@ -665,7 +707,7 @@ void EventHandler::updateAutoscrollRenderer()
     if (Node* nodeAtPoint = hitTest.innerNode())
         m_autoscrollRenderer = nodeAtPoint->renderer();
 
-    while (m_autoscrollRenderer && !m_autoscrollRenderer->canBeProgramaticallyScrolled(false))
+    while (m_autoscrollRenderer && (!m_autoscrollRenderer->isBox() || !toRenderBox(m_autoscrollRenderer)->canBeProgramaticallyScrolled(false)))
         m_autoscrollRenderer = m_autoscrollRenderer->parent();
 }
 
@@ -676,50 +718,74 @@ void EventHandler::setAutoscrollRenderer(RenderObject* renderer)
 
 void EventHandler::allowDHTMLDrag(bool& flagDHTML, bool& flagUA) const
 {
-    if (!m_frame || !m_frame->document()) {
-        flagDHTML = false;
-        flagUA = false;
+    flagDHTML = false;
+    flagUA = false;
+
+    if (!m_frame)
         return;
-    }
-    
-    unsigned mask = m_frame->page()->dragController()->delegateDragSourceAction(m_frame->view()->contentsToWindow(m_mouseDownPos));
+
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+
+    FrameView* view = m_frame->view();
+    if (!view)
+        return;
+
+    unsigned mask = page->dragController()->delegateDragSourceAction(view->contentsToWindow(m_mouseDownPos));
     flagDHTML = (mask & DragSourceActionDHTML) != DragSourceActionNone;
     flagUA = ((mask & DragSourceActionImage) || (mask & DragSourceActionLink) || (mask & DragSourceActionSelection));
 }
     
-HitTestResult EventHandler::hitTestResultAtPoint(const IntPoint& point, bool allowShadowContent)
+HitTestResult EventHandler::hitTestResultAtPoint(const IntPoint& point, bool allowShadowContent, bool ignoreClipping, HitTestScrollbars testScrollbars)
 {
     HitTestResult result(point);
     if (!m_frame->contentRenderer())
         return result;
-    m_frame->contentRenderer()->layer()->hitTest(HitTestRequest(true, true), result);
+    int hitType = HitTestRequest::ReadOnly | HitTestRequest::Active;
+    if (ignoreClipping)
+        hitType |= HitTestRequest::IgnoreClipping;
+    m_frame->contentRenderer()->layer()->hitTest(HitTestRequest(hitType), result);
 
     while (true) {
         Node* n = result.innerNode();
         if (!result.isOverWidget() || !n || !n->renderer() || !n->renderer()->isWidget())
             break;
-        Widget* widget = static_cast<RenderWidget*>(n->renderer())->widget();
+        RenderWidget* renderWidget = static_cast<RenderWidget*>(n->renderer());
+        Widget* widget = renderWidget->widget();
         if (!widget || !widget->isFrameView())
             break;
         Frame* frame = static_cast<HTMLFrameElementBase*>(n)->contentFrame();
         if (!frame || !frame->contentRenderer())
             break;
         FrameView* view = static_cast<FrameView*>(widget);
-        IntPoint widgetPoint(result.localPoint().x() + view->scrollX() - n->renderer()->borderLeft() - n->renderer()->paddingLeft(), 
-            result.localPoint().y() + view->scrollY() - n->renderer()->borderTop() - n->renderer()->paddingTop());
+        IntPoint widgetPoint(result.localPoint().x() + view->scrollX() - renderWidget->borderLeft() - renderWidget->paddingLeft(), 
+            result.localPoint().y() + view->scrollY() - renderWidget->borderTop() - renderWidget->paddingTop());
         HitTestResult widgetHitTestResult(widgetPoint);
-        frame->contentRenderer()->layer()->hitTest(HitTestRequest(true, true), widgetHitTestResult);
+        frame->contentRenderer()->layer()->hitTest(HitTestRequest(hitType), widgetHitTestResult);
         result = widgetHitTestResult;
+
+        if (testScrollbars == ShouldHitTestScrollbars) {
+            Scrollbar* eventScrollbar = view->scrollbarUnderPoint(point);
+            if (eventScrollbar)
+                result.setScrollbar(eventScrollbar);
+        }
     }
     
     // If our HitTestResult is not visible, then we started hit testing too far down the frame chain. 
     // Another hit test at the main frame level should get us the correct visible result.
     Frame* resultFrame = result.innerNonSharedNode() ? result.innerNonSharedNode()->document()->frame() : 0;
-    Frame* mainFrame = m_frame->page()->mainFrame();
-    if (m_frame != mainFrame && resultFrame && resultFrame != mainFrame && !resultFrame->editor()->insideVisibleArea(result.point())) {
-        IntPoint windowPoint = resultFrame->view()->contentsToWindow(result.point());
-        IntPoint mainFramePoint = mainFrame->view()->windowToContents(windowPoint);
-        result = mainFrame->eventHandler()->hitTestResultAtPoint(mainFramePoint, allowShadowContent);
+    if (Page* page = m_frame->page()) {
+        Frame* mainFrame = page->mainFrame();
+        if (m_frame != mainFrame && resultFrame && resultFrame != mainFrame && !resultFrame->editor()->insideVisibleArea(result.point())) {
+            FrameView* resultView = resultFrame->view();
+            FrameView* mainView = mainFrame->view();
+            if (resultView && mainView) {
+                IntPoint windowPoint = resultView->contentsToWindow(result.point());
+                IntPoint mainFramePoint = mainView->windowToContents(windowPoint);
+                result = mainFrame->eventHandler()->hitTestResultAtPoint(mainFramePoint, allowShadowContent, ignoreClipping);
+            }
+        }
     }
 
     if (!allowShadowContent)
@@ -746,11 +812,13 @@ void EventHandler::stopAutoscrollTimer(bool rendererIsBeingDestroyed)
 
     if (autoscrollRenderer()) {
         if (!rendererIsBeingDestroyed && (m_autoscrollInProgress || m_panScrollInProgress))
-            autoscrollRenderer()->stopAutoscroll();
+            toRenderBox(autoscrollRenderer())->stopAutoscroll();
 #if ENABLE(PAN_SCROLLING)
         if (m_panScrollInProgress) {
-            m_frame->view()->removePanScrollIcon();
-            m_frame->view()->setCursor(pointerCursor());
+            if (FrameView* view = m_frame->view()) {
+                view->removePanScrollIcon();
+                view->setCursor(pointerCursor());
+            }
         }
 #endif
 
@@ -760,9 +828,14 @@ void EventHandler::stopAutoscrollTimer(bool rendererIsBeingDestroyed)
     m_autoscrollTimer.stop();
 
     m_panScrollInProgress = false;
-    // If we're not in the top frame we notify it that we are not using the panScroll anymore
-    if (m_frame->page() && m_frame != m_frame->page()->mainFrame())
-            m_frame->page()->mainFrame()->eventHandler()->setPanScrollInProgress(false);
+
+    // If we're not in the top frame we notify it that we are not doing a panScroll any more.
+    if (Page* page = m_frame->page()) {
+        Frame* mainFrame = page->mainFrame();
+        if (m_frame != mainFrame)
+            mainFrame->eventHandler()->setPanScrollInProgress(false);
+    }
+
     m_autoscrollInProgress = false;
 }
 
@@ -778,22 +851,34 @@ void EventHandler::setMousePressNode(PassRefPtr<Node> node)
 
 bool EventHandler::scrollOverflow(ScrollDirection direction, ScrollGranularity granularity)
 {
-    if (!m_frame->document())
-        return false;
-    
     Node* node = m_frame->document()->focusedNode();
     if (!node)
         node = m_mousePressNode.get();
     
     if (node) {
-        RenderObject *r = node->renderer();
+        RenderObject* r = node->renderer();
         if (r && !r->isListBox())
-            return r->scroll(direction, granularity);
+            return r->enclosingBox()->scroll(direction, granularity);
     }
 
     return false;
 }
 
+bool EventHandler::scrollRecursively(ScrollDirection direction, ScrollGranularity granularity)
+{
+    bool handled = scrollOverflow(direction, granularity);
+    if (!handled) {
+        Frame* frame = m_frame;
+        do {
+            FrameView* view = frame->view();
+            handled = view ? view->scroll(direction, granularity) : false;
+            frame = frame->tree()->parent();
+        } while (!handled && frame);
+     }
+
+    return handled;
+}
+
 IntPoint EventHandler::currentMousePosition() const
 {
     return m_currentMousePosition;
@@ -905,10 +990,13 @@ Cursor EventHandler::selectCursor(const MouseEventWithHitTestResults& event, Scr
             
             if ((event.isOverLink() || isSubmitImage(node)) && (!editable || editableLinkEnabled))
                 return handCursor();
-            RenderLayer* layer = renderer ? renderer->enclosingLayer() : 0;
             bool inResizer = false;
-            if (m_frame->view() && layer && layer->isPointInResizeControl(m_frame->view()->windowToContents(event.event().pos())))
-                inResizer = true;
+            if (renderer) {
+                if (RenderLayer* layer = renderer->enclosingLayer()) {
+                    if (FrameView* view = m_frame->view())
+                        inResizer = layer->isPointInResizeControl(view->windowToContents(event.event().pos()));
+                }
+            }
             if ((editable || (renderer && renderer->isText() && node->canStartSelection())) && !inResizer && !scrollbar)
                 return iBeamCursor();
             return pointerCursor();
@@ -986,24 +1074,39 @@ Cursor EventHandler::selectCursor(const MouseEventWithHitTestResults& event, Scr
     }
     return pointerCursor();
 }
+    
+static IntPoint documentPointForWindowPoint(Frame* frame, const IntPoint& windowPoint)
+{
+    FrameView* view = frame->view();
+    // FIXME: Is it really OK to use the wrong coordinates here when view is 0?
+    // Historically the code would just crash; this is clearly no worse than that.
+    return view ? view->windowToContents(windowPoint) : windowPoint;
+}
 
 bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
 {
-    if (!m_frame->document())
-        return false;
-
     RefPtr<FrameView> protector(m_frame->view());
 
     m_mousePressed = true;
+    m_capturesDragging = true;
     m_currentMousePosition = mouseEvent.pos();
     m_mouseDownTimestamp = mouseEvent.timestamp();
     m_mouseDownMayStartDrag = false;
     m_mouseDownMayStartSelect = false;
     m_mouseDownMayStartAutoscroll = false;
-    m_mouseDownPos = m_frame->view()->windowToContents(mouseEvent.pos());
+    if (FrameView* view = m_frame->view())
+        m_mouseDownPos = view->windowToContents(mouseEvent.pos());
+    else {
+        invalidateClick();
+        return false;
+    }
     m_mouseDownWasInSubframe = false;
 
-    MouseEventWithHitTestResults mev = prepareMouseEvent(HitTestRequest(false, true), mouseEvent);
+    HitTestRequest request(HitTestRequest::Active);
+    // Save the document point we generate in case the window coordinate is invalidated by what happens 
+    // when we dispatch the event.
+    IntPoint documentPoint = documentPointForWindowPoint(m_frame, mouseEvent.pos());
+    MouseEventWithHitTestResults mev = m_frame->document()->prepareMouseEvent(request, documentPoint, mouseEvent);
 
     if (!mev.targetNode()) {
         invalidateClick();
@@ -1012,34 +1115,38 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
 
     m_mousePressNode = mev.targetNode();
 
-    InspectorController* inspector = m_frame->page()->inspectorController();
-    if (inspector && inspector->enabled() && inspector->searchingForNodeInPage()) {
-        inspector->handleMousePressOnNode(m_mousePressNode.get());
-        invalidateClick();
-        return true;
+    if (Page* page = m_frame->page()) {
+        InspectorController* inspector = page->inspectorController();
+        if (inspector && inspector->enabled() && inspector->searchingForNodeInPage()) {
+            inspector->handleMousePressOnNode(m_mousePressNode.get());
+            invalidateClick();
+            return true;
+        }
     }
 
     Frame* subframe = subframeForHitTestResult(mev);
     if (subframe && passMousePressEventToSubframe(mev, subframe)) {
         // Start capturing future events for this frame.  We only do this if we didn't clear
         // the m_mousePressed flag, which may happen if an AppKit widget entered a modal event loop.
-        if (m_mousePressed)
+        m_capturesDragging = subframe->eventHandler()->capturesDragging();
+        if (m_mousePressed && m_capturesDragging)
             m_capturingMouseEventsNode = mev.targetNode();
         invalidateClick();
         return true;
     }
 
 #if ENABLE(PAN_SCROLLING)
-    if (m_frame->page()->mainFrame()->eventHandler()->panScrollInProgress() || m_autoscrollInProgress) {
+    Page* page = m_frame->page();
+    if (page && page->mainFrame()->eventHandler()->panScrollInProgress() || m_autoscrollInProgress) {
         stopAutoscrollTimer();
         invalidateClick();
         return true;
     }
-    
+
     if (mouseEvent.button() == MiddleButton && !mev.isOverLink()) {
         RenderObject* renderer = mev.targetNode()->renderer();
 
-        while (renderer && !renderer->canBeProgramaticallyScrolled(false)) {
+        while (renderer && (!renderer->isBox() || !toRenderBox(renderer)->canBeProgramaticallyScrolled(false))) {
             if (!renderer->parent() && renderer->node() == renderer->document() && renderer->document()->ownerElement())
                 renderer = renderer->document()->ownerElement()->renderer();
             else
@@ -1057,25 +1164,28 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
 
     m_clickCount = mouseEvent.clickCount();
     m_clickNode = mev.targetNode();
-    
-    RenderLayer* layer = m_clickNode->renderer() ? m_clickNode->renderer()->enclosingLayer() : 0;
-    IntPoint p = m_frame->view()->windowToContents(mouseEvent.pos());
-    if (layer && layer->isPointInResizeControl(p)) {
-        layer->setInResizeMode(true);
-        m_resizeLayer = layer;
-        m_offsetFromResizeCorner = layer->offsetFromResizeCorner(p);
-        invalidateClick();
-        return true;
+
+    if (FrameView* view = m_frame->view()) {
+        RenderLayer* layer = m_clickNode->renderer() ? m_clickNode->renderer()->enclosingLayer() : 0;
+        IntPoint p = view->windowToContents(mouseEvent.pos());
+        if (layer && layer->isPointInResizeControl(p)) {
+            layer->setInResizeMode(true);
+            m_resizeLayer = layer;
+            m_offsetFromResizeCorner = layer->offsetFromResizeCorner(p);
+            invalidateClick();
+            return true;
+        }
     }
 
     bool swallowEvent = dispatchMouseEvent(eventNames().mousedownEvent, mev.targetNode(), true, m_clickCount, mouseEvent, true);
+    m_capturesDragging = !swallowEvent;
 
     // If the hit testing originally determined the event was in a scrollbar, refetch the MouseEventWithHitTestResults
     // in case the scrollbar widget was destroyed when the mouse event was handled.
     if (mev.scrollbar()) {
         const bool wasLastScrollBar = mev.scrollbar() == m_lastScrollbarUnderMouse.get();
-        mev = prepareMouseEvent(HitTestRequest(true, true), mouseEvent);
-
+        HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
+        mev = m_frame->document()->prepareMouseEvent(request, documentPoint, mouseEvent);
         if (wasLastScrollBar && mev.scrollbar() != m_lastScrollbarUnderMouse.get())
             m_lastScrollbarUnderMouse = 0;
     }
@@ -1089,10 +1199,13 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
         // If a mouse event handler changes the input element type to one that has a widget associated,
         // we'd like to EventHandler::handleMousePressEvent to pass the event to the widget and thus the
         // event target node can't still be the shadow node.
-        if (mev.targetNode()->isShadowNode() && mev.targetNode()->shadowParentNode()->hasTagName(inputTag))
-            mev = prepareMouseEvent(HitTestRequest(true, true), mouseEvent);
+        if (mev.targetNode()->isShadowNode() && mev.targetNode()->shadowParentNode()->hasTagName(inputTag)) {
+            HitTestRequest request(HitTestRequest::ReadOnly | HitTestRequest::Active);
+            mev = m_frame->document()->prepareMouseEvent(request, documentPoint, mouseEvent);
+        }
 
-        Scrollbar* scrollbar = m_frame->view()->scrollbarUnderMouse(mouseEvent);
+        FrameView* view = m_frame->view();
+        Scrollbar* scrollbar = view ? view->scrollbarUnderPoint(mouseEvent.pos()) : 0;
         if (!scrollbar)
             scrollbar = mev.scrollbar();
         if (scrollbar && passMousePressEventToScrollbar(mev, scrollbar))
@@ -1107,16 +1220,14 @@ bool EventHandler::handleMousePressEvent(const PlatformMouseEvent& mouseEvent)
 // This method only exists for platforms that don't know how to deliver 
 bool EventHandler::handleMouseDoubleClickEvent(const PlatformMouseEvent& mouseEvent)
 {
-    if (!m_frame->document())
-        return false;
-
     RefPtr<FrameView> protector(m_frame->view());
 
     // We get this instead of a second mouse-up 
     m_mousePressed = false;
     m_currentMousePosition = mouseEvent.pos();
 
-    MouseEventWithHitTestResults mev = prepareMouseEvent(HitTestRequest(false, true), mouseEvent);
+    HitTestRequest request(HitTestRequest::Active);
+    MouseEventWithHitTestResults mev = prepareMouseEvent(request, mouseEvent);
     Frame* subframe = subframeForHitTestResult(mev);
     if (subframe && passMousePressEventToSubframe(mev, subframe)) {
         m_capturingMouseEventsNode = 0;
@@ -1165,7 +1276,7 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, Hi
     // but also assert so that we can try to figure this out in debug
     // builds, if it happens.
     ASSERT(m_frame);
-    if (!m_frame || !m_frame->document())
+    if (!m_frame)
         return false;
 
     RefPtr<FrameView> protector(m_frame->view());
@@ -1192,7 +1303,12 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, Hi
     // if we are allowed to select.
     // This means that :hover and :active freeze in the state they were in when the mouse
     // was pressed, rather than updating for nodes the mouse moves over as you hold the mouse down.
-    HitTestRequest request(m_mousePressed && m_mouseDownMayStartSelect, m_mousePressed, true);
+    int hitType = HitTestRequest::MouseMove;
+    if (m_mousePressed && m_mouseDownMayStartSelect)
+        hitType |= HitTestRequest::ReadOnly;
+    if (m_mousePressed)
+        hitType |= HitTestRequest::Active;
+    HitTestRequest request(hitType);
     MouseEventWithHitTestResults mev = prepareMouseEvent(request, mouseEvent);
     if (hoveredNode)
         *hoveredNode = mev.hitTestResult();
@@ -1202,8 +1318,8 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, Hi
     if (m_resizeLayer && m_resizeLayer->inResizeMode())
         m_resizeLayer->resize(mouseEvent, m_offsetFromResizeCorner);
     else {
-        if (m_frame->view())
-            scrollbar = m_frame->view()->scrollbarUnderMouse(mouseEvent);
+        if (FrameView* view = m_frame->view())
+            scrollbar = view->scrollbarUnderPoint(mouseEvent.pos());
 
         if (!scrollbar)
             scrollbar = mev.scrollbar();
@@ -1234,8 +1350,12 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, Hi
     } else {
         if (scrollbar && !m_mousePressed)
             scrollbar->mouseMoved(scrollbar->transformEvent(mouseEvent)); // Handle hover effects on platforms that support visual feedback on scrollbar hovering.
-        if ((!m_resizeLayer || !m_resizeLayer->inResizeMode()) && !m_frame->page()->mainFrame()->eventHandler()->panScrollInProgress() && m_frame->view())
-            m_frame->view()->setCursor(selectCursor(mev, scrollbar));
+        if (Page* page = m_frame->page()) {
+            if ((!m_resizeLayer || !m_resizeLayer->inResizeMode()) && !page->mainFrame()->eventHandler()->panScrollInProgress()) {
+                if (FrameView* view = m_frame->view())
+                    view->setCursor(selectCursor(mev, scrollbar));
+            }
+        }
     }
     
     m_lastMouseMoveEventSubframe = newSubframe;
@@ -1258,9 +1378,6 @@ void EventHandler::invalidateClick()
 
 bool EventHandler::handleMouseReleaseEvent(const PlatformMouseEvent& mouseEvent)
 {
-    if (!m_frame->document())
-        return false;
-
     RefPtr<FrameView> protector(m_frame->view());
 
     m_mousePressed = false;
@@ -1282,7 +1399,8 @@ bool EventHandler::handleMouseReleaseEvent(const PlatformMouseEvent& mouseEvent)
         return m_lastScrollbarUnderMouse->mouseUp();
     }
 
-    MouseEventWithHitTestResults mev = prepareMouseEvent(HitTestRequest(false, false, false, true), mouseEvent);
+    HitTestRequest request(HitTestRequest::MouseUp);
+    MouseEventWithHitTestResults mev = prepareMouseEvent(request, mouseEvent);
     Frame* subframe = m_capturingMouseEventsNode.get() ? subframeForTargetNode(m_capturingMouseEventsNode.get()) : subframeForHitTestResult(mev);
     if (subframe && passMouseReleaseEventToSubframe(mev, subframe)) {
         m_capturingMouseEventsNode = 0;
@@ -1312,16 +1430,23 @@ bool EventHandler::handleMouseReleaseEvent(const PlatformMouseEvent& mouseEvent)
 
 bool EventHandler::dispatchDragEvent(const AtomicString& eventType, Node* dragTarget, const PlatformMouseEvent& event, Clipboard* clipboard)
 {
-    IntPoint contentsPos = m_frame->view()->windowToContents(event.pos());
-    
+    FrameView* view = m_frame->view();
+
+    // FIXME: We might want to dispatch a dragleave even if the view is gone.
+    if (!view)
+        return false;
+
+    view->resetDeferredRepaintDelay();
+    IntPoint contentsPos = view->windowToContents(event.pos());
+
     RefPtr<MouseEvent> me = MouseEvent::create(eventType,
         true, true, m_frame->document()->defaultView(),
         0, event.globalX(), event.globalY(), contentsPos.x(), contentsPos.y(),
         event.ctrlKey(), event.altKey(), event.shiftKey(), event.metaKey(),
         0, 0, clipboard);
 
-    ExceptionCode ec = 0;
-    EventTargetNodeCast(dragTarget)->dispatchEvent(me.get(), ec);
+    ExceptionCode ec;
+    dragTarget->dispatchEvent(me.get(), ec);
     return me->defaultPrevented();
 }
 
@@ -1329,13 +1454,11 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
 {
     bool accept = false;
 
-    if (!m_frame->document())
-        return false;
-
     if (!m_frame->view())
         return false;
-    
-    MouseEventWithHitTestResults mev = prepareMouseEvent(HitTestRequest(true, false), event);
+
+    HitTestRequest request(HitTestRequest::ReadOnly);
+    MouseEventWithHitTestResults mev = prepareMouseEvent(request, event);
 
     // Drag events should never go to text nodes (following IE, and proper mouseover/out dispatch)
     Node* newTarget = mev.targetNode();
@@ -1348,12 +1471,13 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
         // FIXME: this ordering was explicitly chosen to match WinIE. However,
         // it is sometimes incorrect when dragging within subframes, as seen with
         // LayoutTests/fast/events/drag-in-frames.html.
-        if (newTarget)
+        if (newTarget) {
             if (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag))
                 accept = static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame()->eventHandler()->updateDragAndDrop(event, clipboard);
             else
                 accept = dispatchDragEvent(eventNames().dragenterEvent, newTarget, event, clipboard);
-        
+        }
+
         if (m_dragTarget) {
             Frame* frame = (m_dragTarget->hasTagName(frameTag) || m_dragTarget->hasTagName(iframeTag)) 
                             ? static_cast<HTMLFrameElementBase*>(m_dragTarget.get())->contentFrame() : 0;
@@ -1363,11 +1487,12 @@ bool EventHandler::updateDragAndDrop(const PlatformMouseEvent& event, Clipboard*
                 dispatchDragEvent(eventNames().dragleaveEvent, m_dragTarget.get(), event, clipboard);
         }
     } else {
-        if (newTarget)
+        if (newTarget) {
             if (newTarget->hasTagName(frameTag) || newTarget->hasTagName(iframeTag))
                 accept = static_cast<HTMLFrameElementBase*>(newTarget)->contentFrame()->eventHandler()->updateDragAndDrop(event, clipboard);
             else
                 accept = dispatchDragEvent(eventNames().dragoverEvent, newTarget, event, clipboard);
+        }
     }
     m_dragTarget = newTarget;
 
@@ -1421,8 +1546,7 @@ MouseEventWithHitTestResults EventHandler::prepareMouseEvent(const HitTestReques
     ASSERT(m_frame);
     ASSERT(m_frame->document());
     
-    IntPoint documentPoint = m_frame->view()->windowToContents(mev.pos());
-    return m_frame->document()->prepareMouseEvent(request, documentPoint, mev);
+    return m_frame->document()->prepareMouseEvent(request, documentPointForWindowPoint(m_frame, mev.pos()), mev);
 }
 
 #if ENABLE(SVG)
@@ -1507,10 +1631,10 @@ void EventHandler::updateMouseEventTargetNode(Node* targetNode, const PlatformMo
         if (m_lastNodeUnderMouse != m_nodeUnderMouse) {
             // send mouseout event to the old node
             if (m_lastNodeUnderMouse)
-                EventTargetNodeCast(m_lastNodeUnderMouse.get())->dispatchMouseEvent(mouseEvent, eventNames().mouseoutEvent, 0, m_nodeUnderMouse.get());
+                m_lastNodeUnderMouse->dispatchMouseEvent(mouseEvent, eventNames().mouseoutEvent, 0, m_nodeUnderMouse.get());
             // send mouseover event to the new node
             if (m_nodeUnderMouse)
-                EventTargetNodeCast(m_nodeUnderMouse.get())->dispatchMouseEvent(mouseEvent, eventNames().mouseoverEvent, 0, m_lastNodeUnderMouse.get());
+                m_nodeUnderMouse->dispatchMouseEvent(mouseEvent, eventNames().mouseoverEvent, 0, m_lastNodeUnderMouse.get());
         }
         m_lastNodeUnderMouse = m_nodeUnderMouse;
 #if ENABLE(SVG)
@@ -1521,12 +1645,15 @@ void EventHandler::updateMouseEventTargetNode(Node* targetNode, const PlatformMo
 
 bool EventHandler::dispatchMouseEvent(const AtomicString& eventType, Node* targetNode, bool /*cancelable*/, int clickCount, const PlatformMouseEvent& mouseEvent, bool setUnder)
 {
+    if (FrameView* view = m_frame->view())
+        view->resetDeferredRepaintDelay();
+
     updateMouseEventTargetNode(targetNode, mouseEvent, setUnder);
 
     bool swallowEvent = false;
 
     if (m_nodeUnderMouse)
-        swallowEvent = EventTargetNodeCast(m_nodeUnderMouse.get())->dispatchMouseEvent(mouseEvent, eventType, clickCount);
+        swallowEvent = m_nodeUnderMouse->dispatchMouseEvent(mouseEvent, eventType, clickCount);
     
     if (!swallowEvent && eventType == eventNames().mousedownEvent) {
         // Blur current focus node when a link/button is clicked; this
@@ -1538,7 +1665,7 @@ bool EventHandler::dispatchMouseEvent(const AtomicString& eventType, Node* targe
         // Walk up the render tree to search for a node to focus.
         // Walking up the DOM tree wouldn't work for shadow trees, like those behind the engine-based text fields.
         while (renderer) {
-            node = renderer->element();
+            node = renderer->node();
             if (node && node->isFocusable()) {
                 // To fix <rdar://problem/4895428> Can't drag selected ToDo, we don't focus a 
                 // node on mouse down if it's selected and inside a focused node. It will be 
@@ -1547,7 +1674,7 @@ bool EventHandler::dispatchMouseEvent(const AtomicString& eventType, Node* targe
                 ExceptionCode ec = 0;
                 Node* n = node->isShadowNode() ? node->shadowParentNode() : node;
                 if (m_frame->selection()->isRange() && 
-                    m_frame->selection()->toRange()->compareNode(n, ec) == Range::NODE_INSIDE &&
+                    m_frame->selection()->toNormalizedRange()->compareNode(n, ec) == Range::NODE_INSIDE &&
                     n->isDescendantOf(m_frame->document()->focusedNode()))
                     return false;
                     
@@ -1556,14 +1683,17 @@ bool EventHandler::dispatchMouseEvent(const AtomicString& eventType, Node* targe
             
             renderer = renderer->parent();
         }
+
         // If focus shift is blocked, we eat the event.  Note we should never clear swallowEvent
         // if the page already set it (e.g., by canceling default behavior).
-        if (node && node->isMouseFocusable()) {
-            if (!m_frame->page()->focusController()->setFocusedNode(node, m_frame))
-                swallowEvent = true;
-        } else if (!node || !node->focused()) {
-            if (!m_frame->page()->focusController()->setFocusedNode(0, m_frame))
-                swallowEvent = true;
+        if (Page* page = m_frame->page()) {
+            if (node && node->isMouseFocusable()) {
+                if (!page->focusController()->setFocusedNode(node, m_frame))
+                    swallowEvent = true;
+            } else if (!node || !node->focused()) {
+                if (!page->focusController()->setFocusedNode(0, m_frame))
+                    swallowEvent = true;
+            }
         }
     }
 
@@ -1573,18 +1703,21 @@ bool EventHandler::dispatchMouseEvent(const AtomicString& eventType, Node* targe
 bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
 {
     Document* doc = m_frame->document();
-    if (!doc)
-        return false;
 
     RenderObject* docRenderer = doc->renderer();
     if (!docRenderer)
         return false;
+    
+    RefPtr<FrameView> protector(m_frame->view());
 
-    IntPoint vPoint = m_frame->view()->windowToContents(e.pos());
+    FrameView* view = m_frame->view();
+    if (!view)
+        return false;
+    IntPoint vPoint = view->windowToContents(e.pos());
 
-    HitTestRequest request(true, false);
+    HitTestRequest request(HitTestRequest::ReadOnly);
     HitTestResult result(vPoint);
-    doc->renderer()->layer()->hitTest(request, result);
+    doc->renderView()->layer()->hitTest(request, result);
     Node* node = result.innerNode();
     
     if (node) {
@@ -1601,11 +1734,16 @@ bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
         }
 
         node = node->shadowAncestorNode();
-        EventTargetNodeCast(node)->dispatchWheelEvent(e);
+        node->dispatchWheelEvent(e);
         if (e.isAccepted())
             return true;
-            
-        if (node->renderer()) {
+        
+        // If we don't have a renderer, send the wheel event to the first node we find with a renderer.
+        // This is needed for <option> and <optgroup> elements so that <select>s get a wheel scroll.
+        while (node && !node->renderer())
+            node = node->parent();
+        
+        if (node && node->renderer()) {
             // Just break up into two scrolls if we need to.  Diagonal movement on 
             // a MacBook pro is an example of a 2-dimensional mouse wheel event (where both deltaX and deltaY can be set).
             scrollAndAcceptEvent(e.deltaX(), ScrollLeft, ScrollRight, e, node);
@@ -1613,9 +1751,14 @@ bool EventHandler::handleWheelEvent(PlatformWheelEvent& e)
         }
     }
 
-    if (!e.isAccepted())
-        m_frame->view()->wheelEvent(e);
-    
+    if (e.isAccepted())
+        return true;
+
+    view = m_frame->view();
+    if (!view)
+        return false;
+
+    view->wheelEvent(e);
     return e.isAccepted();
 }
 
@@ -1623,20 +1766,23 @@ bool EventHandler::sendContextMenuEvent(const PlatformMouseEvent& event)
 {
     Document* doc = m_frame->document();
     FrameView* v = m_frame->view();
-    if (!doc || !v)
+    if (!v)
         return false;
     
     bool swallowEvent;
     IntPoint viewportPos = v->windowToContents(event.pos());
-    MouseEventWithHitTestResults mev = doc->prepareMouseEvent(HitTestRequest(false, true), viewportPos, event);
+    HitTestRequest request(HitTestRequest::Active);
+    MouseEventWithHitTestResults mev = doc->prepareMouseEvent(request, viewportPos, event);
 
-    // Context menu events shouldn't select text in GTK+ applications.
-#if !PLATFORM(GTK)
+    // Context menu events shouldn't select text in GTK+ applications or in Chromium.
+    // FIXME: This should probably be configurable by embedders. Consider making it a WebPreferences setting.
+    // See: https://bugs.webkit.org/show_bug.cgi?id=15279
+#if !PLATFORM(GTK) && !PLATFORM(CHROMIUM)
     if (!m_frame->selection()->contains(viewportPos) && 
         // FIXME: In the editable case, word selection sometimes selects content that isn't underneath the mouse.
         // If the selection is non-editable, we do word selection to make it easier to use the contextual menu items
         // available for text selections.  But only if we're above text.
-        (m_frame->selection()->isContentEditable() || mev.targetNode() && mev.targetNode()->isTextNode())) {
+        (m_frame->selection()->isContentEditable() || (mev.targetNode() && mev.targetNode()->isTextNode()))) {
         m_mouseDownMayStartSelect = true; // context menu events are always allowed to perform a selection
         selectClosestWordOrLinkFromMouseEvent(mev);
     }
@@ -1663,10 +1809,11 @@ bool EventHandler::canMouseDownStartSelect(Node* node)
     if (!node->canStartSelection())
         return false;
             
-    for (RenderObject* curr = node->renderer(); curr; curr = curr->parent())    
-        if (Node* node = curr->element())
-            return EventTargetNodeCast(node)->dispatchEventForType(eventNames().selectstartEvent, true, true);
-    
+    for (RenderObject* curr = node->renderer(); curr; curr = curr->parent()) {
+        if (Node* node = curr->node())
+            return node->dispatchEvent(eventNames().selectstartEvent, true, true);
+    }
+
     return true;
 }
 
@@ -1675,10 +1822,11 @@ bool EventHandler::canMouseDragExtendSelect(Node* node)
     if (!node || !node->renderer())
         return true;
             
-    for (RenderObject* curr = node->renderer(); curr; curr = curr->parent())    
-        if (Node* node = curr->element())
-            return EventTargetNodeCast(node)->dispatchEventForType(eventNames().selectstartEvent, true, true);
-    
+    for (RenderObject* curr = node->renderer(); curr; curr = curr->parent()) {
+        if (Node* node = curr->node())
+            return node->dispatchEvent(eventNames().selectstartEvent, true, true);
+    }
+
     return true;
 }
 
@@ -1700,27 +1848,26 @@ void EventHandler::hoverTimerFired(Timer<EventHandler>*)
     ASSERT(m_frame);
     ASSERT(m_frame->document());
 
-    if (RenderObject* renderer = m_frame->contentRenderer()) {
-        HitTestResult result(m_frame->view()->windowToContents(m_currentMousePosition));
-        renderer->layer()->hitTest(HitTestRequest(false, false, true), result);
-        m_frame->document()->updateRendering();
+    if (RenderView* renderer = m_frame->contentRenderer()) {
+        if (FrameView* view = m_frame->view()) {
+            HitTestRequest request(HitTestRequest::MouseMove);
+            HitTestResult result(view->windowToContents(m_currentMousePosition));
+            renderer->layer()->hitTest(request, result);
+            m_frame->document()->updateStyleIfNeeded();
+        }
     }
 }
 
-static EventTargetNode* eventTargetNodeForDocument(Document* doc)
+static Node* eventTargetNodeForDocument(Document* doc)
 {
     if (!doc)
         return 0;
     Node* node = doc->focusedNode();
-    if (!node) {
-        if (doc->isHTMLDocument())
-            node = doc->body();
-        else
-            node = doc->documentElement();
-        if (!node)
-            return 0;
-    }
-    return EventTargetNodeCast(node);
+    if (!node && doc->isHTMLDocument())
+        node = doc->body();
+    if (!node)
+        node = doc->documentElement();
+    return node;
 }
 
 bool EventHandler::handleAccessKey(const PlatformKeyboardEvent& evt)
@@ -1750,23 +1897,29 @@ bool EventHandler::needsKeyboardEventDisambiguationQuirks() const
 bool EventHandler::keyEvent(const PlatformKeyboardEvent& initialKeyEvent)
 {
 #if ENABLE(PAN_SCROLLING)
-    if (m_frame->page()->mainFrame()->eventHandler()->panScrollInProgress() || m_autoscrollInProgress) {
-        String escKeyId = "U+001B";
-        // If a key is pressed while the autoscroll/panScroll is in progress then we want to stop
-        if (initialKeyEvent.keyIdentifier() == escKeyId && initialKeyEvent.type() == PlatformKeyboardEvent::KeyUp) 
-            stopAutoscrollTimer();
+    if (Page* page = m_frame->page()) {
+        if (page->mainFrame()->eventHandler()->panScrollInProgress() || m_autoscrollInProgress) {
+            static const char* const escapeKeyIdentifier = "U+001B";
 
-        // If we were in autoscroll/panscroll mode, we swallow the key event
-        return true;
+            // If a key is pressed while the autoscroll/panScroll is in progress then we want to stop
+            if (initialKeyEvent.keyIdentifier() == escapeKeyIdentifier && initialKeyEvent.type() == PlatformKeyboardEvent::KeyUp) 
+                stopAutoscrollTimer();
+
+            // If we were in autoscroll/panscroll mode, we swallow the key event
+            return true;
+        }
     }
 #endif
 
     // Check for cases where we are too early for events -- possible unmatched key up
     // from pressing return in the location bar.
-    RefPtr<EventTargetNode> node = eventTargetNodeForDocument(m_frame->document());
+    RefPtr<Node> node = eventTargetNodeForDocument(m_frame->document());
     if (!node)
         return false;
 
+    if (FrameView* view = m_frame->view())
+        view->resetDeferredRepaintDelay();
+
     // FIXME: what is this doing here, in keyboard event handler?
     m_frame->loader()->resetMultipleFormSubmissionProtection();
 
@@ -1852,21 +2005,22 @@ void EventHandler::handleKeyboardSelectionMovement(KeyboardEvent* event)
     String key = event->keyIdentifier();           
     bool isShifted = event->getModifierState("Shift");
     bool isOptioned = event->getModifierState("Alt");
+    bool isCommanded = event->getModifierState("Meta");
     
     if (key == "Up") {
-        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::BACKWARD, LineGranularity, true);
+        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::BACKWARD, (isCommanded) ? DocumentBoundary : LineGranularity, true);
         event->setDefaultHandled();
     }
     else if (key == "Down") { 
-        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::FORWARD, LineGranularity, true);
+        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::FORWARD, (isCommanded) ? DocumentBoundary : LineGranularity, true);
         event->setDefaultHandled();
     }
     else if (key == "Left") {
-        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::LEFT, (isOptioned) ? WordGranularity : CharacterGranularity, true);
+        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::LEFT, (isCommanded) ? LineBoundary : (isOptioned) ? WordGranularity : CharacterGranularity, true);
         event->setDefaultHandled();
     }
     else if (key == "Right") {
-        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::RIGHT, (isOptioned) ? WordGranularity : CharacterGranularity, true);
+        m_frame->selection()->modify((isShifted) ? SelectionController::EXTEND : SelectionController::MOVE, SelectionController::RIGHT, (isCommanded) ? LineBoundary : (isOptioned) ? WordGranularity : CharacterGranularity, true);
         event->setDefaultHandled();
     }    
 }
@@ -1877,11 +2031,8 @@ void EventHandler::defaultKeyboardEventHandler(KeyboardEvent* event)
         m_frame->editor()->handleKeyboardEvent(event);
         if (event->defaultHandled())
             return;
-        const String& keyIdentifier = event->keyIdentifier();
-        if (keyIdentifier == "U+0009")
+        if (event->keyIdentifier() == "U+0009")
             defaultTabEventHandler(event);
-        else if (keyIdentifier == "U+0020")
-            defaultSpaceEventHandler(event);
 
        // provides KB navigation and selection for enhanced accessibility users
        if (AXObjectCache::accessibilityEnhancedUserInterfaceEnabled())
@@ -1904,7 +2055,10 @@ bool EventHandler::dragHysteresisExceeded(const FloatPoint& floatDragViewportLoc
     
 bool EventHandler::dragHysteresisExceeded(const IntPoint& dragViewportLocation) const
 {
-    IntPoint dragLocation = m_frame->view()->windowToContents(dragViewportLocation);
+    FrameView* view = m_frame->view();
+    if (!view)
+        return false;
+    IntPoint dragLocation = view->windowToContents(dragViewportLocation);
     IntSize delta = dragLocation - m_mouseDownPos;
     
     int threshold = GeneralDragHysteresis;
@@ -1926,10 +2080,10 @@ void EventHandler::freeClipboard()
 
 bool EventHandler::shouldDragAutoNode(Node* node, const IntPoint& point) const
 {
-    ASSERT(node);
-    if (node->hasChildNodes() || !m_frame->view())
+    if (!node || node->hasChildNodes() || !m_frame->view())
         return false;
-    return m_frame->page() && m_frame->page()->dragController()->mayStartDragAtEventLocation(m_frame, point);
+    Page* page = m_frame->page();
+    return page && page->dragController()->mayStartDragAtEventLocation(m_frame, point);
 }
     
 void EventHandler::dragSourceMovedTo(const PlatformMouseEvent& event)
@@ -1980,7 +2134,7 @@ bool EventHandler::handleDrag(const MouseEventWithHitTestResults& event)
 
     if (m_mouseDownMayStartDrag && !dragState().m_dragSrc) {
         // try to find an element that wants to be dragged
-        HitTestRequest request(true, false);
+        HitTestRequest request(HitTestRequest::ReadOnly);
         HitTestResult result(m_mouseDownPos);
         m_frame->contentRenderer()->layer()->hitTest(request, result);
         Node* node = result.innerNode();
@@ -2018,7 +2172,8 @@ bool EventHandler::handleDrag(const MouseEventWithHitTestResults& event)
         return !mouseDownMayStartSelect() && !m_mouseDownMayStartAutoscroll;
     
     // We are starting a text/image/url drag, so the cursor should be an arrow
-    m_frame->view()->setCursor(pointerCursor());
+    if (FrameView* view = m_frame->view())
+        view->setCursor(pointerCursor());
     
     if (!dragHysteresisExceeded(event.event().pos())) 
         return true;
@@ -2068,7 +2223,8 @@ bool EventHandler::handleDrag(const MouseEventWithHitTestResults& event)
     }
     
     if (m_mouseDownMayStartDrag) {
-        DragController* dragController = m_frame->page() ? m_frame->page()->dragController() : 0;
+        Page* page = m_frame->page();
+        DragController* dragController = page ? page->dragController() : 0;
         bool startedDrag = dragController && dragController->startDrag(m_frame, dragState().m_dragClipboard.get(), srcOp, event.event(), m_mouseDownPos, dragState().m_dragSrcIsDHTML);
         if (!startedDrag && dragState().m_dragSrcMayBeDHTML) {
             // Drag was canned at the last minute - we owe m_dragSrc a DRAGEND event
@@ -2104,6 +2260,9 @@ bool EventHandler::handleTextInputEvent(const String& text, Event* underlyingEve
         target = eventTargetNodeForDocument(m_frame->document());
     if (!target)
         return false;
+    
+    if (FrameView* view = m_frame->view())
+        view->resetDeferredRepaintDelay();
 
     RefPtr<TextEvent> event = TextEvent::create(m_frame->domWindow(), text);
     event->setUnderlyingEvent(underlyingEvent);
@@ -2205,64 +2364,27 @@ void EventHandler::defaultTabEventHandler(KeyboardEvent* event)
 
 void EventHandler::capsLockStateMayHaveChanged()
 {
-    if (Document* d = m_frame->document())
-        if (Node* node = d->focusedNode())
-            if (RenderObject* r = node->renderer())
-                r->capsLockStateMayHaveChanged();
-}
-
-unsigned EventHandler::pendingFrameUnloadEventCount()
-{
-    return m_pendingFrameUnloadEventCount;
-}
-
-void EventHandler::addPendingFrameUnloadEventCount() 
-{
-    m_pendingFrameUnloadEventCount += 1;
-    m_frame->page()->changePendingUnloadEventCount(1);
-    return; 
-}
-    
-void EventHandler::removePendingFrameUnloadEventCount() 
-{
-    ASSERT( (-1 + (int)m_pendingFrameUnloadEventCount) >= 0 );
-    m_pendingFrameUnloadEventCount -= 1;
-    m_frame->page()->changePendingUnloadEventCount(-1);
-    return; 
-}
-    
-void EventHandler::clearPendingFrameUnloadEventCount() 
-{
-    m_frame->page()->changePendingUnloadEventCount(-((int)m_pendingFrameUnloadEventCount));
-    m_pendingFrameUnloadEventCount = 0;
-    return; 
-}
-
-unsigned EventHandler::pendingFrameBeforeUnloadEventCount()
-{
-    return m_pendingFrameBeforeUnloadEventCount;
+    Document* d = m_frame->document();
+    if (Node* node = d->focusedNode()) {
+        if (RenderObject* r = node->renderer()) {
+            if (r->isTextField())
+                static_cast<RenderTextControlSingleLine*>(r)->capsLockStateMayHaveChanged();
+        }
+    }
 }
 
-void EventHandler::addPendingFrameBeforeUnloadEventCount() 
-{
-    m_pendingFrameBeforeUnloadEventCount += 1;
-    m_frame->page()->changePendingBeforeUnloadEventCount(1);
-    return; 
-}
-    
-void EventHandler::removePendingFrameBeforeUnloadEventCount() 
+void EventHandler::sendResizeEvent()
 {
-    ASSERT( (-1 + (int)m_pendingFrameBeforeUnloadEventCount) >= 0 );
-    m_pendingFrameBeforeUnloadEventCount -= 1;
-    m_frame->page()->changePendingBeforeUnloadEventCount(-1);
-    return; 
+    m_frame->document()->dispatchWindowEvent(eventNames().resizeEvent, false, false);
 }
 
-    void EventHandler::clearPendingFrameBeforeUnloadEventCount() 
+void EventHandler::sendScrollEvent()
 {
-    m_frame->page()->changePendingBeforeUnloadEventCount(-((int)m_pendingFrameBeforeUnloadEventCount));
-    m_pendingFrameBeforeUnloadEventCount = 0;
-    return; 
+    FrameView* v = m_frame->view();
+    if (!v)
+        return;
+    v->setWasScrolledByUser(true);
+    m_frame->document()->dispatchEvent(eventNames().scrollEvent, true, false);
 }
 
 bool EventHandler::passMousePressEventToScrollbar(MouseEventWithHitTestResults& mev, Scrollbar* scrollbar)
diff --git a/src/3rdparty/webkit/WebCore/page/EventHandler.h b/src/3rdparty/webkit/WebCore/page/EventHandler.h
index 5d51cb6..f76716e 100644
--- a/src/3rdparty/webkit/WebCore/page/EventHandler.h
+++ b/src/3rdparty/webkit/WebCore/page/EventHandler.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,33 +27,25 @@
 #define EventHandler_h
 
 #include "DragActions.h"
-#include "FocusDirection.h"
 #include "PlatformMouseEvent.h"
 #include "ScrollTypes.h"
 #include "Timer.h"
 #include <wtf/Forward.h>
-#include <wtf/Noncopyable.h>
-#include <wtf/Platform.h>
 #include <wtf/RefPtr.h>
 
-#if PLATFORM(MAC)
-#include "WebCoreKeyboardUIMode.h"
-#ifndef __OBJC__
-class NSEvent;
+#if PLATFORM(MAC) && !defined(__OBJC__)
 class NSView;
 #endif
-#endif
 
 namespace WebCore {
 
 class AtomicString;
 class Clipboard;
 class Cursor;
-class EventTargetNode;
 class Event;
 class FloatPoint;
-class FloatRect;
 class Frame;
+class HitTestRequest;
 class HitTestResult;
 class HTMLFrameSetElement;
 class KeyboardEvent;
@@ -68,16 +60,15 @@ class Scrollbar;
 class String;
 class SVGElementInstance;
 class TextEvent;
-class VisiblePosition;
 class Widget;
     
-struct HitTestRequest;
-
 extern const int LinkDragHysteresis;
 extern const int ImageDragHysteresis;
 extern const int TextDragHysteresis;
 extern const int GeneralDragHysteresis;
 
+enum HitTestScrollbars { ShouldHitTestScrollbars, DontHitTestScrollbars };
+
 class EventHandler : Noncopyable {
 public:
     EventHandler(Frame*);
@@ -97,7 +88,7 @@ public:
     RenderObject* autoscrollRenderer() const;
     void updateAutoscrollRenderer();
 
-    HitTestResult hitTestResultAtPoint(const IntPoint&, bool allowShadowContent);
+    HitTestResult hitTestResultAtPoint(const IntPoint&, bool allowShadowContent, bool ignoreClipping = false, HitTestScrollbars scrollbars = DontHitTestScrollbars);
 
     bool mousePressed() const { return m_mousePressed; }
     void setMousePressed(bool pressed) { m_mousePressed = pressed; }
@@ -120,6 +111,8 @@ public:
 
     bool scrollOverflow(ScrollDirection, ScrollGranularity);
 
+    bool scrollRecursively(ScrollDirection, ScrollGranularity);
+
     bool shouldDragAutoNode(Node*, const IntPoint&) const; // -webkit-user-drag == auto
 
     bool tabsToLinks(KeyboardEvent*) const;
@@ -158,30 +151,27 @@ public:
 
     void capsLockStateMayHaveChanged();
     
-    unsigned pendingFrameUnloadEventCount();
-    void addPendingFrameUnloadEventCount();
-    void removePendingFrameUnloadEventCount();
-    void clearPendingFrameUnloadEventCount();
-    unsigned pendingFrameBeforeUnloadEventCount();
-    void addPendingFrameBeforeUnloadEventCount();
-    void removePendingFrameBeforeUnloadEventCount();
-    void clearPendingFrameBeforeUnloadEventCount();
+    void sendResizeEvent();
+    void sendScrollEvent();
     
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) && defined(__OBJC__)
     PassRefPtr<KeyboardEvent> currentKeyboardEvent() const;
 
-    void mouseDown(NSEvent*);
-    void mouseDragged(NSEvent*);
-    void mouseUp(NSEvent*);
-    void mouseMoved(NSEvent*);
-    bool keyEvent(NSEvent*);
-    bool wheelEvent(NSEvent*);
+    void mouseDown(NSEvent *);
+    void mouseDragged(NSEvent *);
+    void mouseUp(NSEvent *);
+    void mouseMoved(NSEvent *);
+    bool keyEvent(NSEvent *);
+    bool wheelEvent(NSEvent *);
+
+    bool sendContextMenuEvent(NSEvent *);
+    bool eventMayStartDrag(NSEvent *);
 
-    void sendFakeEventsAfterWidgetTracking(NSEvent* initiatingEvent);
+    void sendFakeEventsAfterWidgetTracking(NSEvent *initiatingEvent);
 
     void setActivationEventNumber(int num) { m_activationEventNumber = num; }
 
-    NSEvent *currentNSEvent();
+    static NSEvent *currentNSEvent();
 #endif
 
 private:
@@ -201,8 +191,8 @@ private:
     PassRefPtr<Clipboard> createDraggingClipboard() const;
     
     bool eventActivatedView(const PlatformMouseEvent&) const;
-    void selectClosestWordFromMouseEvent(const MouseEventWithHitTestResults& event);
-    void selectClosestWordOrLinkFromMouseEvent(const MouseEventWithHitTestResults& event);
+    void selectClosestWordFromMouseEvent(const MouseEventWithHitTestResults&);
+    void selectClosestWordOrLinkFromMouseEvent(const MouseEventWithHitTestResults&);
 
     bool handleMouseDoubleClickEvent(const PlatformMouseEvent&);
 
@@ -216,7 +206,9 @@ private:
     void handleKeyboardSelectionMovement(KeyboardEvent*);
     
     Cursor selectCursor(const MouseEventWithHitTestResults&, Scrollbar*);
+#if ENABLE(PAN_SCROLLING)
     void setPanScrollCursor();
+#endif
 
     void hoverTimerFired(Timer<EventHandler>*);
 
@@ -272,22 +264,25 @@ private:
 
     // The following are called at the beginning of handleMouseUp and handleDrag.  
     // If they return true it indicates that they have consumed the event.
-#if PLATFORM(MAC)
     bool eventLoopHandleMouseUp(const MouseEventWithHitTestResults&);
     bool eventLoopHandleMouseDragged(const MouseEventWithHitTestResults&);
-    NSView *mouseDownViewIfStillGood();
-#else
-    bool eventLoopHandleMouseUp(const MouseEventWithHitTestResults&) { return false; }
-    bool eventLoopHandleMouseDragged(const MouseEventWithHitTestResults&) { return false; }
-#endif
 
     bool invertSenseOfTabsToLinks(KeyboardEvent*) const;
 
     void updateSelectionForMouseDrag(Node* targetNode, const IntPoint& localPoint);
 
+    bool capturesDragging() const { return m_capturesDragging; }
+
+#if PLATFORM(MAC) && defined(__OBJC__)
+    NSView *mouseDownViewIfStillGood();
+
+    PlatformMouseEvent currentPlatformMouseEvent() const;
+#endif
+
     Frame* m_frame;
 
     bool m_mousePressed;
+    bool m_capturesDragging;
     RefPtr<Node> m_mousePressNode;
 
     bool m_mouseDownMayStartSelect;
@@ -307,6 +302,7 @@ private:
     bool m_autoscrollInProgress;
     bool m_mouseDownMayStartAutoscroll;
     bool m_mouseDownWasInSubframe;
+
 #if ENABLE(SVG)
     bool m_svgPan;
     RefPtr<SVGElementInstance> m_instanceUnderMouse;
@@ -335,16 +331,12 @@ private:
     IntPoint m_mouseDownPos; // in our view's coords
     double m_mouseDownTimestamp;
     PlatformMouseEvent m_mouseDown;
-    
-    unsigned m_pendingFrameUnloadEventCount;
-    unsigned m_pendingFrameBeforeUnloadEventCount;
 
 #if PLATFORM(MAC)
     NSView *m_mouseDownView;
     bool m_sendingEventToSubview;
     int m_activationEventNumber;
 #endif
-
 };
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/FocusController.cpp b/src/3rdparty/webkit/WebCore/page/FocusController.cpp
index 9b30362..8dad846 100644
--- a/src/3rdparty/webkit/WebCore/page/FocusController.cpp
+++ b/src/3rdparty/webkit/WebCore/page/FocusController.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2008 Nuanti Ltd.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -34,6 +35,7 @@
 #include "Element.h"
 #include "Event.h"
 #include "EventHandler.h"
+#include "EventNames.h"
 #include "Frame.h"
 #include "FrameView.h"
 #include "FrameTree.h"
@@ -45,6 +47,7 @@
 #include "RenderObject.h"
 #include "RenderWidget.h"
 #include "SelectionController.h"
+#include "Settings.h"
 #include "Widget.h"
 #include <wtf/Platform.h>
 
@@ -63,13 +66,17 @@ void FocusController::setFocusedFrame(PassRefPtr<Frame> frame)
     if (m_focusedFrame == frame)
         return;
 
-    if (m_focusedFrame && m_focusedFrame->view())
+    if (m_focusedFrame && m_focusedFrame->view()) {
         m_focusedFrame->selection()->setFocused(false);
+        m_focusedFrame->document()->dispatchWindowEvent(eventNames().blurEvent, false, false);
+    }
 
     m_focusedFrame = frame;
 
-    if (m_focusedFrame && m_focusedFrame->view())
+    if (m_focusedFrame && m_focusedFrame->view()) {
         m_focusedFrame->selection()->setFocused(true);
+        m_focusedFrame->document()->dispatchWindowEvent(eventNames().focusEvent, false, false);
+    }
 }
 
 Frame* FocusController::focusedOrMainFrame()
@@ -90,8 +97,6 @@ static Node* deepFocusableNode(FocusDirection direction, Node* node, KeyboardEve
             break;
 
         Document* document = owner->contentFrame()->document();
-        if (!document)
-            break;
 
         node = (direction == FocusDirectionForward)
             ? document->nextFocusableNode(0, event)
@@ -115,12 +120,17 @@ bool FocusController::advanceFocus(FocusDirection direction, KeyboardEvent* even
     Frame* frame = focusedOrMainFrame();
     ASSERT(frame);
     Document* document = frame->document();
-    if (!document)
-        return false;
+
+    Node* currentNode = document->focusedNode();
+    // FIXME: Not quite correct when it comes to focus transitions leaving/entering the WebView itself
+    bool caretBrowsing = focusedOrMainFrame()->settings()->caretBrowsingEnabled();
+
+    if (caretBrowsing && !currentNode)
+        currentNode = frame->selection()->start().node();
 
     Node* node = (direction == FocusDirectionForward)
-        ? document->nextFocusableNode(document->focusedNode(), event)
-        : document->previousFocusableNode(document->focusedNode(), event);
+        ? document->nextFocusableNode(currentNode, event)
+        : document->previousFocusableNode(currentNode, event);
             
     // If there's no focusable node to advance to, move up the frame tree until we find one.
     while (!node && frame) {
@@ -129,8 +139,6 @@ bool FocusController::advanceFocus(FocusDirection direction, KeyboardEvent* even
             break;
 
         Document* parentDocument = parentFrame->document();
-        if (!parentDocument)
-            break;
 
         HTMLFrameOwnerElement* owner = frame->ownerElement();
         if (!owner)
@@ -155,10 +163,10 @@ bool FocusController::advanceFocus(FocusDirection direction, KeyboardEvent* even
         }
 
         // Chrome doesn't want focus, so we should wrap focus.
-        if (Document* d = m_page->mainFrame()->document())
-            node = (direction == FocusDirectionForward)
-                ? d->nextFocusableNode(0, event)
-                : d->previousFocusableNode(0, event);
+        Document* d = m_page->mainFrame()->document();
+        node = (direction == FocusDirectionForward)
+            ? d->nextFocusableNode(0, event)
+            : d->previousFocusableNode(0, event);
 
         node = deepFocusableNode(direction, node, event);
 
@@ -201,6 +209,12 @@ bool FocusController::advanceFocus(FocusDirection direction, KeyboardEvent* even
     if (newDocument)
         setFocusedFrame(newDocument->frame());
 
+    if (caretBrowsing) {
+        VisibleSelection newSelection(Position(node, 0), Position(node, 0), DOWNSTREAM);
+        if (frame->shouldChangeSelection(newSelection))
+            frame->selection()->setSelection(newSelection);
+    }
+
     static_cast<Element*>(node)->focus(false);
     return true;
 }
@@ -229,7 +243,11 @@ static void clearSelectionIfNeeded(Frame* oldFocusedFrame, Frame* newFocusedFram
     SelectionController* s = oldFocusedFrame->selection();
     if (s->isNone())
         return;
-    
+
+    bool caretBrowsing = oldFocusedFrame->settings()->caretBrowsingEnabled();
+    if (caretBrowsing)
+        return;
+
     Node* selectionStartNode = s->selection().start().node();
     if (selectionStartNode == newFocusedNode || selectionStartNode->isDescendantOf(newFocusedNode) || selectionStartNode->shadowAncestorNode() == newFocusedNode)
         return;
@@ -254,7 +272,8 @@ bool FocusController::setFocusedNode(Node* node, PassRefPtr<Frame> newFocusedFra
     Node* oldFocusedNode = oldDocument ? oldDocument->focusedNode() : 0;
     if (oldFocusedNode == node)
         return true;
-        
+
+    // FIXME: Might want to disable this check for caretBrowsing
     if (oldFocusedNode && oldFocusedNode->rootEditableElement() == oldFocusedNode && !relinquishesEditingFocus(oldFocusedNode))
         return false;
         
@@ -266,9 +285,9 @@ bool FocusController::setFocusedNode(Node* node, PassRefPtr<Frame> newFocusedFra
         m_page->editorClient()->setInputMethodState(false);
         return true;
     }
-    
-    RefPtr<Document> newDocument = node ? node->document() : 0;
-    
+
+    RefPtr<Document> newDocument = node->document();
+
     if (newDocument && newDocument->focusedNode() == node) {
         m_page->editorClient()->setInputMethodState(node->shouldUseInputMethod());
         return true;
@@ -302,6 +321,9 @@ void FocusController::setActive(bool active)
     }
 
     focusedOrMainFrame()->selection()->pageActivationChanged();
+    
+    if (m_focusedFrame)
+        m_focusedFrame->document()->dispatchWindowEvent(active ? eventNames().focusEvent : eventNames().blurEvent, false, false);
 }
 
 } // namespace WebCore
diff --git a/src/3rdparty/webkit/WebCore/page/Frame.cpp b/src/3rdparty/webkit/WebCore/page/Frame.cpp
index a4c0b57..8905bd9 100644
--- a/src/3rdparty/webkit/WebCore/page/Frame.cpp
+++ b/src/3rdparty/webkit/WebCore/page/Frame.cpp
@@ -5,7 +5,7 @@
  *                     2000 Simon Hausmann <hausmann@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
  *                     2001 George Staikos <staikos@kde.org>
- * Copyright (C) 2004, 2005, 2006, 2007 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov <ap@nypop.com>
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
@@ -28,11 +28,11 @@
 
 #include "config.h"
 #include "Frame.h"
-#include "FramePrivate.h"
 
 #include "ApplyStyleCommand.h"
 #include "BeforeUnloadEvent.h"
 #include "CSSComputedStyleDeclaration.h"
+#include "CSSMutableStyleDeclaration.h"
 #include "CSSProperty.h"
 #include "CSSPropertyNames.h"
 #include "CachedCSSStyleSheet.h"
@@ -43,7 +43,9 @@
 #include "EditorClient.h"
 #include "EventNames.h"
 #include "FocusController.h"
+#include "FloatQuad.h"
 #include "FrameLoader.h"
+#include "FrameLoaderClient.h"
 #include "FrameView.h"
 #include "GraphicsContext.h"
 #include "HTMLDocument.h"
@@ -53,7 +55,6 @@
 #include "HTMLNames.h"
 #include "HTMLTableCellElement.h"
 #include "HitTestResult.h"
-#include "JSDOMWindowShell.h"
 #include "Logging.h"
 #include "markup.h"
 #include "MediaFeatureNames.h"
@@ -67,17 +68,21 @@
 #include "RenderTheme.h"
 #include "RenderView.h"
 #include "Settings.h"
-#include "SystemTime.h"
 #include "TextIterator.h"
 #include "TextResourceDecoder.h"
 #include "XMLNames.h"
 #include "ScriptController.h"
+#include "htmlediting.h"
 #include "npruntime_impl.h"
-#include "runtime_root.h"
 #include "visible_units.h"
 #include <wtf/RefCountedLeakCounter.h>
 #include <wtf/StdLibExtras.h>
 
+#if USE(JSC)
+#include "JSDOMWindowShell.h"
+#include "runtime_root.h"
+#endif
+
 #if FRAME_LOADS_USER_STYLESHEET
 #include "UserStyleSheetLoader.h"
 #endif
@@ -111,8 +116,32 @@ static inline Frame* parentFromOwnerElement(HTMLFrameOwnerElement* ownerElement)
 }
 
 Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoaderClient* frameLoaderClient) 
-    : d(new FramePrivate(page, parentFromOwnerElement(ownerElement), this, ownerElement, frameLoaderClient))
+    : m_page(page)
+    , m_treeNode(this, parentFromOwnerElement(ownerElement))
+    , m_loader(this, frameLoaderClient)
+    , m_ownerElement(ownerElement)
+    , m_script(this)
+    , m_selectionGranularity(CharacterGranularity)
+    , m_selectionController(this)
+    , m_caretBlinkTimer(this, &Frame::caretBlinkTimerFired)
+    , m_editor(this)
+    , m_eventHandler(this)
+    , m_animationController(this)
+    , m_lifeSupportTimer(this, &Frame::lifeSupportTimerFired)
+    , m_caretVisible(false)
+    , m_caretPaint(true)
+    , m_highlightTextMatches(false)
+    , m_inViewSourceMode(false)
+    , m_needsReapplyStyles(false)
+    , m_isDisconnected(false)
+    , m_excludeFromTextSearch(false)
+#if FRAME_LOADS_USER_STYLESHEET
+    , m_userStyleSheetLoader(0)
+#endif
 {
+    Frame* parent = parentFromOwnerElement(ownerElement);
+    m_zoomFactor = parent ? parent->m_zoomFactor : 1.0f;
+
     AtomicString::init();
     HTMLNames::init();
     QualifiedName::init();
@@ -146,73 +175,66 @@ Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoaderClient*
 Frame::~Frame()
 {
     setView(0);
-    loader()->clearRecordedFormValues();
     loader()->cancelAndClear();
     
     // FIXME: We should not be doing all this work inside the destructor
 
-    ASSERT(!d->m_lifeSupportTimer.isActive());
+    ASSERT(!m_lifeSupportTimer.isActive());
 
 #ifndef NDEBUG
     frameCounter.decrement();
 #endif
 
-    if (d->m_script.haveWindowShell())
-        d->m_script.windowShell()->disconnectFrame();
-
     disconnectOwnerElement();
     
-    if (d->m_domWindow)
-        d->m_domWindow->disconnectFrame();
+    if (m_domWindow)
+        m_domWindow->disconnectFrame();
 
-    HashSet<DOMWindow*>::iterator end = d->m_liveFormerWindows.end();
-    for (HashSet<DOMWindow*>::iterator it = d->m_liveFormerWindows.begin(); it != end; ++it)
+    HashSet<DOMWindow*>::iterator end = m_liveFormerWindows.end();
+    for (HashSet<DOMWindow*>::iterator it = m_liveFormerWindows.begin(); it != end; ++it)
         (*it)->disconnectFrame();
             
-    if (d->m_view) {
-        d->m_view->hide();
-        d->m_view->clearFrame();
+    if (m_view) {
+        m_view->hide();
+        m_view->clearFrame();
     }
 
-    ASSERT(!d->m_lifeSupportTimer.isActive());
+    ASSERT(!m_lifeSupportTimer.isActive());
 
 #if FRAME_LOADS_USER_STYLESHEET
-    delete d->m_userStyleSheetLoader;
+    delete m_userStyleSheetLoader;
 #endif
-
-    delete d;
-    d = 0;
 }
 
 void Frame::init()
 {
-    d->m_loader.init();
+    m_loader.init();
 }
 
 FrameLoader* Frame::loader() const
 {
-    return &d->m_loader;
+    return &m_loader;
 }
 
 FrameView* Frame::view() const
 {
-    return d->m_view.get();
+    return m_view.get();
 }
 
-void Frame::setView(FrameView* view)
+void Frame::setView(PassRefPtr<FrameView> view)
 {
     // Detach the document now, so any onUnload handlers get run - if
     // we wait until the view is destroyed, then things won't be
     // hooked up enough for some JavaScript calls to work.
-    if (!view && d->m_doc && d->m_doc->attached() && !d->m_doc->inPageCache()) {
+    if (!view && m_doc && m_doc->attached() && !m_doc->inPageCache()) {
         // FIXME: We don't call willRemove here. Why is that OK?
-        d->m_doc->detach();
-        if (d->m_view)
-            d->m_view->unscheduleRelayout();
+        m_doc->detach();
+        if (m_view)
+            m_view->unscheduleRelayout();
     }
     eventHandler()->clear();
 
-    d->m_view = view;
+    m_view = view;
 
     // Only one form submission is allowed per view of a part.
     // Since this part may be getting reused as a result of being
@@ -222,40 +244,40 @@ void Frame::setView(FrameView* view)
 
 ScriptController* Frame::script()
 {
-    return &d->m_script;
+    return &m_script;
 }
 
 Document* Frame::document() const
 {
-    return d->m_doc.get();
+    return m_doc.get();
 }
 
 void Frame::setDocument(PassRefPtr<Document> newDoc)
 {
-    if (d->m_doc && d->m_doc->attached() && !d->m_doc->inPageCache()) {
+    if (m_doc && m_doc->attached() && !m_doc->inPageCache()) {
         // FIXME: We don't call willRemove here. Why is that OK?
-        d->m_doc->detach();
+        m_doc->detach();
     }
 
-    d->m_doc = newDoc;
-    if (d->m_doc && selection()->isFocusedAndActive())
-        setUseSecureKeyboardEntry(d->m_doc->useSecureKeyboardEntryWhenActive());
+    m_doc = newDoc;
+    if (m_doc && selection()->isFocusedAndActive())
+        setUseSecureKeyboardEntry(m_doc->useSecureKeyboardEntryWhenActive());
         
-    if (d->m_doc && !d->m_doc->attached())
-        d->m_doc->attach();
+    if (m_doc && !m_doc->attached())
+        m_doc->attach();
 
     // Update the cached 'document' property, which is now stale.
-    d->m_script.updateDocument();
+    m_script.updateDocument();
 }
 
 Settings* Frame::settings() const
 {
-    return d->m_page ? d->m_page->settings() : 0;
+    return m_page ? m_page->settings() : 0;
 }
 
 String Frame::selectedText() const
 {
-    return plainText(selection()->toRange().get());
+    return plainText(selection()->toNormalizedRange().get());
 }
 
 IntRect Frame::firstRectForRange(Range* range) const
@@ -300,33 +322,33 @@ IntRect Frame::firstRectForRange(Range* range) const
 
 SelectionController* Frame::selection() const
 {
-    return &d->m_selectionController;
+    return &m_selectionController;
 }
 
 Editor* Frame::editor() const
 {
-    return &d->m_editor;
+    return &m_editor;
 }
 
 TextGranularity Frame::selectionGranularity() const
 {
-    return d->m_selectionGranularity;
+    return m_selectionGranularity;
 }
 
-void Frame::setSelectionGranularity(TextGranularity granularity) const
+void Frame::setSelectionGranularity(TextGranularity granularity)
 {
-    d->m_selectionGranularity = granularity;
+    m_selectionGranularity = granularity;
 }
 
 SelectionController* Frame::dragCaretController() const
 {
-    return d->m_page->dragCaretController();
+    return m_page->dragCaretController();
 }
 
 
 AnimationController* Frame::animation() const
 {
-    return &d->m_animationController;
+    return &m_animationController;
 }
 
 static RegularExpression* createRegExpForLabels(const Vector<String>& labels)
@@ -334,7 +356,7 @@ static RegularExpression* createRegExpForLabels(const Vector<String>& labels)
     // REVIEW- version of this call in FrameMac.mm caches based on the NSArray ptrs being
     // the same across calls.  We can't do that.
 
-    DEFINE_STATIC_LOCAL(RegularExpression, wordRegExp, ("\\w"));
+    DEFINE_STATIC_LOCAL(RegularExpression, wordRegExp, ("\\w", TextCaseSensitive));
     String pattern("(");
     unsigned int numLabels = labels.size();
     unsigned int i;
@@ -344,8 +366,8 @@ static RegularExpression* createRegExpForLabels(const Vector<String>& labels)
         bool startsWithWordChar = false;
         bool endsWithWordChar = false;
         if (label.length() != 0) {
-            startsWithWordChar = wordRegExp.search(label.substring(0, 1)) >= 0;
-            endsWithWordChar = wordRegExp.search(label.substring(label.length() - 1, 1)) >= 0;
+            startsWithWordChar = wordRegExp.match(label.substring(0, 1)) >= 0;
+            endsWithWordChar = wordRegExp.match(label.substring(label.length() - 1, 1)) >= 0;
         }
         
         if (i != 0)
@@ -362,7 +384,7 @@ static RegularExpression* createRegExpForLabels(const Vector<String>& labels)
         }
     }
     pattern.append(")");
-    return new RegularExpression(pattern, false);
+    return new RegularExpression(pattern, TextCaseInsensitive);
 }
 
 String Frame::searchForLabelsAboveCell(RegularExpression* regExp, HTMLTableCellElement* cell)
@@ -374,7 +396,7 @@ String Frame::searchForLabelsAboveCell(RegularExpression* regExp, HTMLTableCellE
 
         if (cellAboveRenderer) {
             HTMLTableCellElement* aboveCell =
-                static_cast<HTMLTableCellElement*>(cellAboveRenderer->element());
+                static_cast<HTMLTableCellElement*>(cellAboveRenderer->node());
 
             if (aboveCell) {
                 // search within the above cell we found for a match
@@ -414,8 +436,7 @@ String Frame::searchForLabelsBeforeElement(const Vector<String>& labels, Element
          n = n->traversePreviousNode())
     {
         if (n->hasTagName(formTag)
-            || (n->isHTMLElement()
-                && static_cast<HTMLElement*>(n)->isGenericFormElement()))
+            || (n->isHTMLElement() && static_cast<Element*>(n)->isFormControlElement()))
         {
             // We hit another form element or the start of the form - bail out
             break;
@@ -454,7 +475,7 @@ String Frame::matchLabelsAgainstElement(const Vector<String>& labels, Element* e
         return String();
 
     // Make numbers and _'s in field names behave like word boundaries, e.g., "address2"
-    replace(name, RegularExpression("\\d"), " ");
+    replace(name, RegularExpression("\\d", TextCaseSensitive), " ");
     name.replace('_', ' ');
     
     OwnPtr<RegularExpression> regExp(createRegExpForLabels(labels));
@@ -465,7 +486,7 @@ String Frame::matchLabelsAgainstElement(const Vector<String>& labels, Element* e
     int bestLength = -1;
     int start = 0;
     do {
-        pos = regExp->search(name, start);
+        pos = regExp->match(name, start);
         if (pos != -1) {
             length = regExp->matchedLength();
             if (length >= bestLength) {
@@ -481,19 +502,19 @@ String Frame::matchLabelsAgainstElement(const Vector<String>& labels, Element* e
     return String();
 }
 
-const Selection& Frame::mark() const
+const VisibleSelection& Frame::mark() const
 {
-    return d->m_mark;
+    return m_mark;
 }
 
-void Frame::setMark(const Selection& s)
+void Frame::setMark(const VisibleSelection& s)
 {
     ASSERT(!s.base().node() || s.base().node()->document() == document());
     ASSERT(!s.extent().node() || s.extent().node()->document() == document());
     ASSERT(!s.start().node() || s.start().node()->document() == document());
     ASSERT(!s.end().node() || s.end().node()->document() == document());
 
-    d->m_mark = s;
+    m_mark = s;
 }
 
 void Frame::notifyRendererOfSelectionChange(bool userTriggered)
@@ -503,8 +524,8 @@ void Frame::notifyRendererOfSelectionChange(bool userTriggered)
         renderer = selection()->rootEditableElement()->shadowAncestorNode()->renderer();
 
     // If the current selection is in a textfield or textarea, notify the renderer that the selection has changed
-    if (renderer && (renderer->isTextArea() || renderer->isTextField()))
-        static_cast<RenderTextControl*>(renderer)->selectionChanged(userTriggered);
+    if (renderer && renderer->isTextControl())
+        toRenderTextControl(renderer)->selectionChanged(userTriggered);
 }
 
 void Frame::invalidateSelection()
@@ -515,18 +536,18 @@ void Frame::invalidateSelection()
 
 void Frame::setCaretVisible(bool flag)
 {
-    if (d->m_caretVisible == flag)
+    if (m_caretVisible == flag)
         return;
     clearCaretRectIfNeeded();
-    d->m_caretVisible = flag;
+    m_caretVisible = flag;
     selectionLayoutChanged();
 }
 
 void Frame::clearCaretRectIfNeeded()
 {
 #if ENABLE(TEXT_CARET)
-    if (d->m_caretPaint) {
-        d->m_caretPaint = false;
+    if (m_caretPaint) {
+        m_caretPaint = false;
         selection()->invalidateCaretRect();
     }
 #endif
@@ -547,9 +568,18 @@ static bool isFrameElement(const Node *n)
 
 void Frame::setFocusedNodeIfNeeded()
 {
-    if (!document() || selection()->isNone() || !selection()->isFocusedAndActive())
+    if (selection()->isNone() || !selection()->isFocused())
         return;
 
+    bool caretBrowsing = settings() && settings()->caretBrowsingEnabled();
+    if (caretBrowsing) {
+        Node* anchor = enclosingAnchorElement(selection()->base());
+        if (anchor) {
+            page()->focusController()->setFocusedNode(anchor, this);
+            return;
+        }
+    }
+
     Node* target = selection()->rootEditableElement();
     if (target) {
         RenderObject* renderer = target->renderer();
@@ -566,10 +596,13 @@ void Frame::setFocusedNodeIfNeeded()
             }
             renderer = renderer->parent();
             if (renderer)
-                target = renderer->element();
+                target = renderer->node();
         }
         document()->setFocusedNode(0);
     }
+
+    if (caretBrowsing)
+        page()->focusController()->setFocusedNode(0, this);
 }
 
 void Frame::selectionLayoutChanged()
@@ -577,22 +610,23 @@ void Frame::selectionLayoutChanged()
     bool caretRectChanged = selection()->recomputeCaretRect();
 
 #if ENABLE(TEXT_CARET)
-    bool shouldBlink = d->m_caretVisible
-        && selection()->isCaret() && selection()->isContentEditable();
+    bool caretBrowsing = settings() && settings()->caretBrowsingEnabled();
+    bool shouldBlink = m_caretVisible
+        && selection()->isCaret() && (selection()->isContentEditable() || caretBrowsing);
 
     // If the caret moved, stop the blink timer so we can restart with a
     // black caret in the new location.
     if (caretRectChanged || !shouldBlink)
-        d->m_caretBlinkTimer.stop();
+        m_caretBlinkTimer.stop();
 
     // Start blinking with a black caret. Be sure not to restart if we're
     // already blinking in the right location.
-    if (shouldBlink && !d->m_caretBlinkTimer.isActive()) {
-        if (double blinkInterval = theme()->caretBlinkInterval())
-            d->m_caretBlinkTimer.startRepeating(blinkInterval);
+    if (shouldBlink && !m_caretBlinkTimer.isActive()) {
+        if (double blinkInterval = page()->theme()->caretBlinkInterval())
+            m_caretBlinkTimer.startRepeating(blinkInterval);
 
-        if (!d->m_caretPaint) {
-            d->m_caretPaint = true;
+        if (!m_caretPaint) {
+            m_caretPaint = true;
             selection()->invalidateCaretRect();
         }
     }
@@ -605,7 +639,7 @@ void Frame::selectionLayoutChanged()
     if (!view)
         return;
 
-    Selection selection = this->selection()->selection();
+    VisibleSelection selection = this->selection()->selection();
         
     if (!selection.isRange())
         view->clearSelection();
@@ -626,7 +660,7 @@ void Frame::selectionLayoutChanged()
         if (startPos.isNotNull() && endPos.isNotNull() && selection.visibleStart() != selection.visibleEnd()) {
             RenderObject *startRenderer = startPos.node()->renderer();
             RenderObject *endRenderer = endPos.node()->renderer();
-            view->setSelection(startRenderer, startPos.offset(), endRenderer, endPos.offset());
+            view->setSelection(startRenderer, startPos.deprecatedEditingOffset(), endRenderer, endPos.deprecatedEditingOffset());
         }
     }
 }
@@ -634,12 +668,12 @@ void Frame::selectionLayoutChanged()
 void Frame::caretBlinkTimerFired(Timer<Frame>*)
 {
 #if ENABLE(TEXT_CARET)
-    ASSERT(d->m_caretVisible);
+    ASSERT(m_caretVisible);
     ASSERT(selection()->isCaret());
-    bool caretPaint = d->m_caretPaint;
+    bool caretPaint = m_caretPaint;
     if (selection()->isCaretBlinkingSuspended() && caretPaint)
         return;
-    d->m_caretPaint = !caretPaint;
+    m_caretPaint = !caretPaint;
     selection()->invalidateCaretRect();
 #endif
 }
@@ -647,7 +681,7 @@ void Frame::caretBlinkTimerFired(Timer<Frame>*)
 void Frame::paintCaret(GraphicsContext* p, int tx, int ty, const IntRect& clipRect) const
 {
 #if ENABLE(TEXT_CARET)
-    if (d->m_caretPaint && d->m_caretVisible)
+    if (m_caretPaint && m_caretVisible)
         selection()->paintCaret(p, tx, ty, clipRect);
 #endif
 }
@@ -655,7 +689,7 @@ void Frame::paintCaret(GraphicsContext* p, int tx, int ty, const IntRect& clipRe
 void Frame::paintDragCaret(GraphicsContext* p, int tx, int ty, const IntRect& clipRect) const
 {
 #if ENABLE(TEXT_CARET)
-    SelectionController* dragCaretController = d->m_page->dragCaretController();
+    SelectionController* dragCaretController = m_page->dragCaretController();
     ASSERT(dragCaretController->selection().isCaret());
     if (dragCaretController->selection().start().node()->document()->frame() == this)
         dragCaretController->paintCaret(p, tx, ty, clipRect);
@@ -664,20 +698,20 @@ void Frame::paintDragCaret(GraphicsContext* p, int tx, int ty, const IntRect& cl
 
 float Frame::zoomFactor() const
 {
-    return d->m_zoomFactor;
+    return m_zoomFactor;
 }
 
 bool Frame::isZoomFactorTextOnly() const
 {
-    return d->m_page->settings()->zoomsTextOnly();
+    return m_page->settings()->zoomsTextOnly();
 }
 
 bool Frame::shouldApplyTextZoom() const
 {
-    if (d->m_zoomFactor == 1.0f || !isZoomFactorTextOnly())
+    if (m_zoomFactor == 1.0f || !isZoomFactorTextOnly())
         return false;
 #if ENABLE(SVG)
-    if (d->m_doc && d->m_doc->isSVGDocument())
+    if (m_doc->isSVGDocument())
         return false;
 #endif
     return true;
@@ -685,10 +719,10 @@ bool Frame::shouldApplyTextZoom() const
 
 bool Frame::shouldApplyPageZoom() const
 {
-    if (d->m_zoomFactor == 1.0f || isZoomFactorTextOnly())
+    if (m_zoomFactor == 1.0f || isZoomFactorTextOnly())
         return false;